From 5d5e35fb9be0d7854febd1f22a45d403209fb966 Mon Sep 17 00:00:00 2001
From: "Alexander J. Semenuk" <semeaj@pm.me>
Date: Mon, 27 Jul 2026 19:19:18 -0400
Subject: [PATCH] fix: Windows toolchain compatibility (curl 8.21 re-vendor,
 endless reconfigure loop) (#4355)

## Problem

Windows builds break with a current local toolchain (Scoop LLVM 22.1.8,
CMake 4.4.0, VS 2026), in two independent ways:

1. The build stops at curl's deliberate guard: `#error "no non-blocking
method was found/used/set"` in `third-party/curl/lib/nonblock.c`.
2. From the second configure onward, `cmake --build` re-runs CMake in an
endless loop (observed 42 consecutive reconfigure cycles in a single
build). Likely the same mechanism behind the "endlessly building" VS
2026 note in `docs/setup/dev/vs.md`.

## Root cause

1. `third-party/curl/CMake/CurlTests.c` passes `int *` to
`ioctlsocket()`, whose third parameter is `u_long *`. Clang 22 promotes
`-Wincompatible-pointer-types` to a hard error in C, so the
`HAVE_IOCTLSOCKET_FIONBIO` try_compile silently fails and
`curl_config.h` never defines it. Upstream CI does not see this because
the windows-2022 runner image ships an older LLVM. GCC 14 promotes the
same warning to a hard error, which is very likely the `CurlTests.c.obj`
failure reported from MSYS2 in open-goal/jak-project#3551. Upstream curl
hit the identical problem with GCC 14 and fixed the probe in curl 8.8.0
(curl/curl#13578).
2. The root CMakeLists copies the build tree's `compile_commands.json`
into `<src>/build/` for clangd using `configure_file()`, which registers
its input as a configure dependency. CMake rewrites
`compile_commands.json` late in every generation, after
`CTestTestfile.cmake` and `cmake_install.cmake` (outputs of the same
Ninja regen rule), so once the dependency is registered the rule is
deterministically dirty and every `ninja` invocation re-runs CMake. A
pristine first configure is safe (the file does not exist yet, so the
`if(EXISTS ...)` guard skips the copy), which is why the loop looks
machine- or IDE-specific.

## Fix

1. Per review, re-vendor `third-party/curl` at the `curl-8_21_0` tag
(previously `curl-8_3_0`), which carries the upstream probe fix plus two
years of upstream development; `vendor.yaml` updated to match.
Adjustments the version jump forced:
- curl 8.15 removed the native macOS Secure Transport backend
(`CURL_USE_SECTRANSP`), so macOS now builds curl against OpenSSL like
Linux. The two macOS workflows install Homebrew `openssl@3` and export
`OPENSSL_ROOT_DIR` (keg-only), and the macOS setup docs gained the same
two lines.
- `CURL_BROTLI` / `CURL_ZSTD` switched to AUTO-detection in curl 8.10;
pinned OFF to keep the previous no-compression behavior and avoid
silently linking whatever the CI images happen to have.
- curl's new top-level `BUILD_EXAMPLES` cache option (default ON) leaked
into discord-rpc's identically named option and broke configure at a
nonexistent `examples/send-presence` directory; pinned OFF ahead of the
third-party subdirectories.

The diff is dominated by the mechanical tag-tree swap under
`third-party/curl` (linguist-vendored, collapsed in review). The
hand-written changes are `CMakeLists.txt`, the two macOS workflows,
`docs/setup/system/macos.md`, and `vendor.yaml`.
2. Swap `configure_file()` for `file(COPY ...)`: the same clangd copy
with no configure dependency registered. (`file(COPY_FILE ...
ONLY_IF_DIFFERENT)` would be cleaner still but requires CMake 3.21,
above the declared `cmake_minimum_required(VERSION 3.10)`.)

## Test plan

- [x] Fresh `cmake --preset Release-windows-clang` (LLVM 22, no cache
seeding) completes and logs `Enabled SSL backends: Schannel`; the
FIONBIO probe passes without the previous `#error`
- [x] Full Windows Release build from scratch in the branch worktree
(all 1422 targets)
- [x] goalc-test suite: 1509 passed, 0 failed
- [x] Second consecutive configure with `compile_commands.json` present:
the regen rule in `build.ninja` has no `compile_commands.json` input;
`<src>/build/compile_commands.json` is still refreshed for clangd
- [x] Repeated `ninja` invocations after a full build no longer re-run
CMake
- [x] macOS Intel and ARM CI green (first exercise of the OpenSSL
backend switch)

---

I work off a self-hosted forge, so this GitHub account is quiet; the
configure logs and ninja dirty-node traces from the investigation are
available if anyone wants the raw data.

(AI-assisted)
---
 .github/workflows/macos-build-arm.yaml        |    6 +-
 .github/workflows/macos-build.yaml            |    6 +-
 CMakeLists.txt                                |   19 +-
 docs/setup/system/macos.md                    |    6 +-
 third-party/curl/.azure-pipelines.yml         |  315 -
 third-party/curl/.circleci/config.yml         |  424 +-
 third-party/curl/.cirrus.yml                  |   85 -
 third-party/curl/.clang-tidy.yml              |   59 +
 third-party/curl/.dcignore                    |    7 -
 third-party/curl/.editorconfig                |   18 +
 third-party/curl/.gitattributes               |    6 +-
 third-party/curl/.github/CONTRIBUTING.md      |   27 +-
 .../.github/ISSUE_TEMPLATE/bug_report.yml     |   20 +-
 .../curl/.github/ISSUE_TEMPLATE/config.yml    |   15 +-
 .../curl/.github/ISSUE_TEMPLATE/docs.yml      |   43 +
 third-party/curl/.github/dependabot.yml       |   38 +
 third-party/curl/.github/labeler.yml          |  722 +-
 .../curl/.github/pull_request_template.md     |    8 +
 third-party/curl/.github/scripts/cleancmd.pl  |  130 +
 .../curl/.github/scripts/cleanspell.pl        |   79 -
 .../curl/.github/scripts/cmp-config.pl        |  136 +
 .../curl/.github/scripts/cmp-pkg-config.sh    |   49 +
 .../.github/scripts/codespell-ignore.words    |   21 +
 third-party/curl/.github/scripts/codespell.sh |   22 +
 third-party/curl/.github/scripts/distfiles.sh |   54 +
 .../curl/.github/scripts/pyspelling.words     | 1023 +++
 .../curl/.github/scripts/pyspelling.yaml      |   33 +
 third-party/curl/.github/scripts/randcurl.pl  |  251 +
 .../.github/scripts/requirements-docs.txt     |    5 +
 .../scripts/requirements-proselint.txt        |    5 +
 .../curl/.github/scripts/requirements.txt     |    8 +
 .../curl/.github/scripts/shellcheck-ci.sh     |   30 +
 .../curl/.github/scripts/shellcheck.sh        |   13 +
 .../curl/.github/scripts/spellcheck.curl      |  153 +
 .../curl/.github/scripts/spellcheck.words     |  909 ---
 .../curl/.github/scripts/spellcheck.yaml      |   32 -
 .../.github/scripts/trimmarkdownheader.pl     |   44 +
 third-party/curl/.github/scripts/typos.sh     |   14 +
 third-party/curl/.github/scripts/typos.toml   |   36 +
 .../curl/.github/scripts/verify-examples.pl   |  106 +
 .../curl/.github/scripts/verify-synopsis.pl   |   87 +
 third-party/curl/.github/scripts/yamlcheck.sh |   15 +
 .../curl/.github/scripts/yamlcheck.yaml       |   17 +
 third-party/curl/.github/stale.yml            |    4 +-
 .../.github/workflows/appveyor-status.yml     |   18 +-
 third-party/curl/.github/workflows/awslc.yml  |  152 -
 .../curl/.github/workflows/checkdocs.yml      |  135 +
 .../curl/.github/workflows/checksrc.yml       |  214 +
 .../curl/.github/workflows/checkurls.yml      |   43 +
 .../.github/workflows/codeql-analysis.yml     |   80 -
 third-party/curl/.github/workflows/codeql.yml |  142 +
 .../.github/workflows/configure-vs-cmake.yml  |  194 +
 .../curl/.github/workflows/curl-for-win.yml   |  199 +
 .../curl/.github/workflows/distcheck.yml      |  409 +
 third-party/curl/.github/workflows/fuzz.yml   |   58 +-
 .../workflows/hacktoberfest-accepted.yml      |   67 -
 .../curl/.github/workflows/http3-linux.yml    |  894 +++
 third-party/curl/.github/workflows/label.yml  |   37 +-
 .../curl/.github/workflows/linkcheck.yml      |   36 -
 .../curl/.github/workflows/linux-old.yml      |  185 +
 third-party/curl/.github/workflows/linux.yml  | 1258 +++-
 .../curl/.github/workflows/linux32.yml        |   93 -
 third-party/curl/.github/workflows/macos.yml  |  928 ++-
 .../curl/.github/workflows/ngtcp2-linux.yml   |  279 -
 .../curl/.github/workflows/non-native.yml     |  565 ++
 .../curl/.github/workflows/proselint.yml      |   68 -
 .../curl/.github/workflows/quiche-linux.yml   |  209 -
 third-party/curl/.github/workflows/reuse.yml  |   29 -
 .../curl/.github/workflows/spellcheck.yml     |   66 -
 .../curl/.github/workflows/torture.yml        |   92 -
 .../curl/.github/workflows/windows.yml        | 1197 +++
 .../curl/.github/workflows/wolfssl.yml        |  105 -
 third-party/curl/.gitignore                   |   11 +-
 third-party/curl/.mailmap                     |   27 +-
 third-party/curl/.reuse/dep5                  |   98 -
 third-party/curl/CHANGES                      |    7 -
 third-party/curl/CHANGES.md                   |   12 +
 .../curl/CMake/CMakeConfigurableFile.in       |   24 -
 third-party/curl/CMake/CurlSymbolHiding.cmake |   92 +-
 third-party/curl/CMake/CurlTests.c            |  459 +-
 third-party/curl/CMake/FindBearSSL.cmake      |   32 -
 third-party/curl/CMake/FindBrotli.cmake       |   79 +-
 third-party/curl/CMake/FindCARES.cmake        |  123 +-
 third-party/curl/CMake/FindGSS.cmake          |  410 +-
 third-party/curl/CMake/FindGnuTLS.cmake       |   92 +
 third-party/curl/CMake/FindLDAP.cmake         |  115 +
 third-party/curl/CMake/FindLibPSL.cmake       |   79 +-
 third-party/curl/CMake/FindLibSSH2.cmake      |  104 +-
 third-party/curl/CMake/FindLibbacktrace.cmake |   61 +
 third-party/curl/CMake/FindLibgsasl.cmake     |   91 +
 third-party/curl/CMake/FindLibidn2.cmake      |   92 +
 third-party/curl/CMake/FindLibssh.cmake       |  118 +
 third-party/curl/CMake/FindLibuv.cmake        |  102 +
 third-party/curl/CMake/FindMSH3.cmake         |   70 -
 third-party/curl/CMake/FindMbedTLS.cmake      |  119 +-
 third-party/curl/CMake/FindNGHTTP2.cmake      |   97 +-
 third-party/curl/CMake/FindNGHTTP3.cmake      |  128 +-
 third-party/curl/CMake/FindNGTCP2.cmake       |  224 +-
 third-party/curl/CMake/FindNettle.cmake       |   97 +
 third-party/curl/CMake/FindQUICHE.cmake       |   84 +-
 third-party/curl/CMake/FindRustls.cmake       |  116 +
 third-party/curl/CMake/FindWolfSSL.cmake      |  117 +-
 third-party/curl/CMake/FindZstd.cmake         |  157 +-
 third-party/curl/CMake/Macros.cmake           |  314 +-
 third-party/curl/CMake/OtherTests.cmake       |  194 +-
 third-party/curl/CMake/PickyWarnings.cmake    |  429 +-
 .../curl/CMake/Platforms/WindowsCache.cmake   |  127 -
 third-party/curl/CMake/Utilities.cmake        |   65 +-
 .../curl/CMake/cmake_uninstall.cmake.in       |   49 -
 .../curl/CMake/cmake_uninstall.in.cmake       |   50 +
 third-party/curl/CMake/curl-config.cmake.in   |   38 -
 third-party/curl/CMake/curl-config.in.cmake   |  196 +
 third-party/curl/CMake/unix-cache.cmake       |  332 +
 third-party/curl/CMake/win32-cache.cmake      |  192 +
 third-party/curl/CMakeLists.txt               | 3104 +++++---
 third-party/curl/COPYING                      |    2 +-
 third-party/curl/Dockerfile                   |   41 +
 third-party/curl/GIT-INFO                     |   44 -
 third-party/curl/GIT-INFO.md                  |   33 +
 third-party/curl/LICENSES/BSD-3-Clause.txt    |   11 -
 third-party/curl/LICENSES/BSD-4-Clause-UC.txt |   32 +-
 third-party/curl/MacOSX-Framework             |  160 -
 third-party/curl/Makefile.am                  |  569 +-
 third-party/curl/Makefile.dist                |   92 -
 third-party/curl/README                       |   17 +-
 third-party/curl/README.md                    |   56 +-
 third-party/curl/RELEASE-NOTES                |  983 ++-
 third-party/curl/REUSE.toml                   |   41 +
 third-party/curl/SECURITY.md                  |   22 +-
 third-party/curl/acinclude.m4                 | 1625 ++--
 third-party/curl/appveyor.sh                  |  132 +
 third-party/curl/appveyor.yml                 |  467 +-
 third-party/curl/buildconf                    |    8 -
 third-party/curl/buildconf.bat                |  319 -
 third-party/curl/configure.ac                 | 5193 +++++++------
 third-party/curl/curl-config.in               |  271 +-
 third-party/curl/docs/.gitignore              |    7 +-
 third-party/curl/docs/ALTSVC.md               |   24 +-
 third-party/curl/docs/BINDINGS.md             |   56 +-
 third-party/curl/docs/BUFQ.md                 |  141 -
 third-party/curl/docs/BUG-BOUNTY.md           |   84 +-
 third-party/curl/docs/BUGS.md                 |  348 +-
 third-party/curl/docs/CHECKSRC.md             |  182 -
 third-party/curl/docs/CIPHERS-TLS12.md        |  336 +
 third-party/curl/docs/CIPHERS.md              |  644 +-
 third-party/curl/docs/CMakeLists.txt          |   31 +-
 third-party/curl/docs/CODE_OF_CONDUCT.md      |   14 +-
 third-party/curl/docs/CODE_REVIEW.md          |   27 +-
 third-party/curl/docs/CONNECTION-FILTERS.md   |  127 -
 third-party/curl/docs/CONTRIBUTE.md           |  335 +-
 third-party/curl/docs/CURL-DISABLE.md         |   43 +-
 third-party/curl/docs/CURLDOWN.md             |  165 +
 third-party/curl/docs/DEPRECATE.md            |   97 +-
 third-party/curl/docs/DISTROS.md              |  304 +
 third-party/curl/docs/DYNBUF.md               |  128 -
 third-party/curl/docs/EARLY-RELEASE.md        |   54 +-
 third-party/curl/docs/ECH.md                  |  492 ++
 third-party/curl/docs/EXPERIMENTAL.md         |   95 +-
 third-party/curl/docs/FAQ                     | 1544 ----
 third-party/curl/docs/FAQ.md                  | 1427 ++++
 third-party/curl/docs/FEATURES.md             |  356 +-
 third-party/curl/docs/GOVERNANCE.md           |   82 +-
 third-party/curl/docs/HELP-US.md              |   35 +-
 third-party/curl/docs/HISTORY.md              |  334 +-
 third-party/curl/docs/HSTS.md                 |   27 +-
 third-party/curl/docs/HTTP-COOKIES.md         |  214 +-
 third-party/curl/docs/HTTP2.md                |  102 -
 third-party/curl/docs/HTTP3.md                |  319 +-
 third-party/curl/docs/HTTPSRR.md              |  100 +
 third-party/curl/docs/HYPER.md                |   69 -
 third-party/curl/docs/INFRASTRUCTURE.md       |  201 +
 third-party/curl/docs/INSTALL-CMAKE.md        |  612 ++
 third-party/curl/docs/INSTALL.cmake           |   89 -
 third-party/curl/docs/INSTALL.md              |  667 +-
 third-party/curl/docs/INTERNALS.md            |   90 +-
 third-party/curl/docs/IPFS.md                 |  150 +
 third-party/curl/docs/KNOWN_BUGS              |  625 --
 third-party/curl/docs/KNOWN_BUGS.md           |  548 ++
 third-party/curl/docs/KNOWN_RISKS.md          |  149 +
 third-party/curl/docs/MAIL-ETIQUETTE          |  285 -
 third-party/curl/docs/MAIL-ETIQUETTE.md       |  257 +
 third-party/curl/docs/MANUAL.md               |  410 +-
 third-party/curl/docs/MQTT.md                 |   27 -
 third-party/curl/docs/Makefile.am             |  210 +-
 third-party/curl/docs/PARALLEL-TRANSFERS.md   |   50 -
 third-party/curl/docs/README.md               |   12 +-
 third-party/curl/docs/RELEASE-PROCEDURE.md    |   90 +-
 third-party/curl/docs/ROADMAP.md              |   25 +-
 third-party/curl/docs/RUSTLS.md               |   83 +-
 third-party/curl/docs/SECURITY-ADVISORY.md    |   52 +-
 third-party/curl/docs/SECURITY-PROCESS.md     |  285 -
 third-party/curl/docs/SPONSORS.md             |   55 +
 third-party/curl/docs/SSL-PROBLEMS.md         |  126 +-
 third-party/curl/docs/SSLCERTS.md             |  242 +-
 third-party/curl/docs/THANKS                  | 1457 +++-
 third-party/curl/docs/THANKS-filter           |   29 +-
 third-party/curl/docs/TODO                    | 1385 ----
 third-party/curl/docs/TODO.md                 | 1032 +++
 .../curl/docs/TheArtOfHttpScripting.md        |  840 +--
 third-party/curl/docs/URL-SYNTAX.md           |  183 +-
 third-party/curl/docs/VERIFY.md               |  168 +
 third-party/curl/docs/VERSIONS.md             |  365 +-
 .../curl/docs/VULN-DISCLOSURE-POLICY.md       |  484 ++
 third-party/curl/docs/cmdline-opts/.gitignore |    5 +
 .../curl/docs/cmdline-opts/CMakeLists.txt     |   39 +-
 third-party/curl/docs/cmdline-opts/MANPAGE.md |  125 +-
 .../curl/docs/cmdline-opts/Makefile.am        |   33 +-
 .../curl/docs/cmdline-opts/Makefile.inc       |  556 +-
 .../curl/docs/cmdline-opts/_AUTHORS.md        |    5 +
 third-party/curl/docs/cmdline-opts/_BUGS.md   |    5 +
 .../curl/docs/cmdline-opts/_DESCRIPTION.md    |   11 +
 .../curl/docs/cmdline-opts/_ENVIRONMENT.md    |  120 +
 .../curl/docs/cmdline-opts/_EXITCODES.md      |  203 +
 third-party/curl/docs/cmdline-opts/_FILES.md  |    6 +
 .../curl/docs/cmdline-opts/_GLOBBING.md       |   55 +
 third-party/curl/docs/cmdline-opts/_NAME.md   |    4 +
 .../curl/docs/cmdline-opts/_OPTIONS.md        |   39 +
 third-party/curl/docs/cmdline-opts/_OUTPUT.md |   11 +
 .../curl/docs/cmdline-opts/_PROGRESS.md       |   26 +
 .../curl/docs/cmdline-opts/_PROTOCOLS.md      |   50 +
 .../curl/docs/cmdline-opts/_PROXYPREFIX.md    |   22 +
 .../curl/docs/cmdline-opts/_SEEALSO.md        |    5 +
 .../curl/docs/cmdline-opts/_SYNOPSIS.md       |    5 +
 third-party/curl/docs/cmdline-opts/_URL.md    |   24 +
 .../curl/docs/cmdline-opts/_VARIABLES.md      |   43 +
 .../curl/docs/cmdline-opts/_VERSION.md        |   15 +
 third-party/curl/docs/cmdline-opts/_WWW.md    |    4 +
 .../docs/cmdline-opts/abstract-unix-socket.d  |   15 -
 .../docs/cmdline-opts/abstract-unix-socket.md |   21 +
 third-party/curl/docs/cmdline-opts/alt-svc.d  |   21 -
 third-party/curl/docs/cmdline-opts/alt-svc.md |   31 +
 third-party/curl/docs/cmdline-opts/anyauth.d  |   22 -
 third-party/curl/docs/cmdline-opts/anyauth.md |   30 +
 third-party/curl/docs/cmdline-opts/append.d   |   16 -
 third-party/curl/docs/cmdline-opts/append.md  |   23 +
 .../curl/docs/cmdline-opts/aws-sigv4.d        |   22 -
 .../curl/docs/cmdline-opts/aws-sigv4.md       |   30 +
 third-party/curl/docs/cmdline-opts/basic.d    |   17 -
 third-party/curl/docs/cmdline-opts/basic.md   |   23 +
 .../curl/docs/cmdline-opts/ca-native.d        |   21 -
 .../curl/docs/cmdline-opts/ca-native.md       |   44 +
 third-party/curl/docs/cmdline-opts/cacert.d   |   35 -
 third-party/curl/docs/cmdline-opts/cacert.md  |   40 +
 third-party/curl/docs/cmdline-opts/capath.d   |   21 -
 third-party/curl/docs/cmdline-opts/capath.md  |   31 +
 .../curl/docs/cmdline-opts/cert-status.d      |   19 -
 .../curl/docs/cmdline-opts/cert-status.md     |   25 +
 .../curl/docs/cmdline-opts/cert-type.d        |   18 -
 .../curl/docs/cmdline-opts/cert-type.md       |   26 +
 third-party/curl/docs/cmdline-opts/cert.d     |   49 -
 third-party/curl/docs/cmdline-opts/cert.md    |   53 +
 third-party/curl/docs/cmdline-opts/ciphers.d  |   16 -
 third-party/curl/docs/cmdline-opts/ciphers.md |   25 +
 .../curl/docs/cmdline-opts/compressed-ssh.d   |   13 -
 .../curl/docs/cmdline-opts/compressed-ssh.md  |   20 +
 .../curl/docs/cmdline-opts/compressed.d       |   21 -
 .../curl/docs/cmdline-opts/compressed.md      |   32 +
 third-party/curl/docs/cmdline-opts/config.d   |   77 -
 third-party/curl/docs/cmdline-opts/config.md  |   84 +
 .../curl/docs/cmdline-opts/connect-timeout.d  |   22 -
 .../curl/docs/cmdline-opts/connect-timeout.md |   28 +
 .../curl/docs/cmdline-opts/connect-to.d       |   24 -
 .../curl/docs/cmdline-opts/connect-to.md      |   40 +
 .../curl/docs/cmdline-opts/continue-at.d      |   20 -
 .../curl/docs/cmdline-opts/continue-at.md     |   37 +
 .../curl/docs/cmdline-opts/cookie-jar.d       |   31 -
 .../curl/docs/cmdline-opts/cookie-jar.md      |   42 +
 third-party/curl/docs/cmdline-opts/cookie.d   |   42 -
 third-party/curl/docs/cmdline-opts/cookie.md  |   63 +
 .../curl/docs/cmdline-opts/create-dirs.d      |   19 -
 .../curl/docs/cmdline-opts/create-dirs.md     |   26 +
 .../curl/docs/cmdline-opts/create-file-mode.d |   17 -
 .../docs/cmdline-opts/create-file-mode.md     |   23 +
 third-party/curl/docs/cmdline-opts/crlf.d     |   15 -
 third-party/curl/docs/cmdline-opts/crlf.md    |   19 +
 third-party/curl/docs/cmdline-opts/crlfile.d  |   14 -
 third-party/curl/docs/cmdline-opts/crlfile.md |   21 +
 third-party/curl/docs/cmdline-opts/curves.d   |   22 -
 third-party/curl/docs/cmdline-opts/curves.md  |   28 +
 .../curl/docs/cmdline-opts/data-ascii.d       |   13 -
 .../curl/docs/cmdline-opts/data-ascii.md      |   21 +
 .../curl/docs/cmdline-opts/data-binary.d      |   25 -
 .../curl/docs/cmdline-opts/data-binary.md     |   32 +
 third-party/curl/docs/cmdline-opts/data-raw.d |   15 -
 .../curl/docs/cmdline-opts/data-raw.md        |   21 +
 .../curl/docs/cmdline-opts/data-urlencode.d   |   42 -
 .../curl/docs/cmdline-opts/data-urlencode.md  |   51 +
 third-party/curl/docs/cmdline-opts/data.d     |   41 -
 third-party/curl/docs/cmdline-opts/data.md    |   49 +
 .../curl/docs/cmdline-opts/delegation.d       |   24 -
 .../curl/docs/cmdline-opts/delegation.md      |   30 +
 third-party/curl/docs/cmdline-opts/digest.d   |   15 -
 third-party/curl/docs/cmdline-opts/digest.md  |   22 +
 .../curl/docs/cmdline-opts/disable-eprt.d     |   25 -
 .../curl/docs/cmdline-opts/disable-eprt.md    |   32 +
 .../curl/docs/cmdline-opts/disable-epsv.d     |   23 -
 .../curl/docs/cmdline-opts/disable-epsv.md    |   30 +
 third-party/curl/docs/cmdline-opts/disable.d  |   17 -
 third-party/curl/docs/cmdline-opts/disable.md |   20 +
 .../cmdline-opts/disallow-username-in-url.d   |   13 -
 .../cmdline-opts/disallow-username-in-url.md  |   21 +
 .../curl/docs/cmdline-opts/dns-interface.d    |   16 -
 .../curl/docs/cmdline-opts/dns-interface.md   |   23 +
 .../curl/docs/cmdline-opts/dns-ipv4-addr.d    |   16 -
 .../curl/docs/cmdline-opts/dns-ipv4-addr.md   |   23 +
 .../curl/docs/cmdline-opts/dns-ipv6-addr.d    |   16 -
 .../curl/docs/cmdline-opts/dns-ipv6-addr.md   |   23 +
 .../curl/docs/cmdline-opts/dns-servers.d      |   16 -
 .../curl/docs/cmdline-opts/dns-servers.md     |   24 +
 .../curl/docs/cmdline-opts/doh-cert-status.d  |   11 -
 .../curl/docs/cmdline-opts/doh-cert-status.md |   27 +
 .../curl/docs/cmdline-opts/doh-insecure.d     |   11 -
 .../curl/docs/cmdline-opts/doh-insecure.md    |   28 +
 third-party/curl/docs/cmdline-opts/doh-url.d  |   21 -
 third-party/curl/docs/cmdline-opts/doh-url.md |   31 +
 .../curl/docs/cmdline-opts/dump-ca-embed.md   |   25 +
 .../curl/docs/cmdline-opts/dump-header.d      |   21 -
 .../curl/docs/cmdline-opts/dump-header.md     |   35 +
 third-party/curl/docs/cmdline-opts/ech.md     |   52 +
 third-party/curl/docs/cmdline-opts/egd-file.d |   17 -
 .../curl/docs/cmdline-opts/egd-file.md        |   23 +
 third-party/curl/docs/cmdline-opts/engine.d   |   15 -
 third-party/curl/docs/cmdline-opts/engine.md  |   25 +
 .../curl/docs/cmdline-opts/etag-compare.d     |   23 -
 .../curl/docs/cmdline-opts/etag-compare.md    |   30 +
 .../curl/docs/cmdline-opts/etag-save.d        |   16 -
 .../curl/docs/cmdline-opts/etag-save.md       |   30 +
 .../docs/cmdline-opts/expect100-timeout.d     |   19 -
 .../docs/cmdline-opts/expect100-timeout.md    |   25 +
 .../curl/docs/cmdline-opts/fail-early.d       |   25 -
 .../curl/docs/cmdline-opts/fail-early.md      |   32 +
 .../curl/docs/cmdline-opts/fail-with-body.d   |   20 -
 .../curl/docs/cmdline-opts/fail-with-body.md  |   27 +
 third-party/curl/docs/cmdline-opts/fail.d     |   22 -
 third-party/curl/docs/cmdline-opts/fail.md    |   35 +
 .../curl/docs/cmdline-opts/false-start.d      |   18 -
 .../curl/docs/cmdline-opts/false-start.md     |   22 +
 third-party/curl/docs/cmdline-opts/follow.md  |   33 +
 .../curl/docs/cmdline-opts/form-escape.d      |   13 -
 .../curl/docs/cmdline-opts/form-escape.md     |   19 +
 .../curl/docs/cmdline-opts/form-string.d      |   17 -
 .../curl/docs/cmdline-opts/form-string.md     |   23 +
 third-party/curl/docs/cmdline-opts/form.d     |  134 -
 third-party/curl/docs/cmdline-opts/form.md    |  143 +
 .../curl/docs/cmdline-opts/ftp-account.d      |   14 -
 .../curl/docs/cmdline-opts/ftp-account.md     |   20 +
 .../cmdline-opts/ftp-alternative-to-user.d    |   16 -
 .../cmdline-opts/ftp-alternative-to-user.md   |   23 +
 .../curl/docs/cmdline-opts/ftp-create-dirs.d  |   14 -
 .../curl/docs/cmdline-opts/ftp-create-dirs.md |   20 +
 .../curl/docs/cmdline-opts/ftp-method.d       |   30 -
 .../curl/docs/cmdline-opts/ftp-method.md      |   36 +
 third-party/curl/docs/cmdline-opts/ftp-pasv.d |   20 -
 .../curl/docs/cmdline-opts/ftp-pasv.md        |   27 +
 third-party/curl/docs/cmdline-opts/ftp-port.d |   41 -
 .../curl/docs/cmdline-opts/ftp-port.md        |   51 +
 third-party/curl/docs/cmdline-opts/ftp-pret.d |   14 -
 .../curl/docs/cmdline-opts/ftp-pret.md        |   21 +
 .../curl/docs/cmdline-opts/ftp-skip-pasv-ip.d |   18 -
 .../docs/cmdline-opts/ftp-skip-pasv-ip.md     |   24 +
 .../curl/docs/cmdline-opts/ftp-ssl-ccc-mode.d |   16 -
 .../docs/cmdline-opts/ftp-ssl-ccc-mode.md     |   22 +
 .../curl/docs/cmdline-opts/ftp-ssl-ccc.d      |   15 -
 .../curl/docs/cmdline-opts/ftp-ssl-ccc.md     |   22 +
 .../curl/docs/cmdline-opts/ftp-ssl-control.d  |   14 -
 .../curl/docs/cmdline-opts/ftp-ssl-control.md |   22 +
 third-party/curl/docs/cmdline-opts/gen.pl     |  744 --
 third-party/curl/docs/cmdline-opts/get.d      |   20 -
 third-party/curl/docs/cmdline-opts/get.md     |   28 +
 third-party/curl/docs/cmdline-opts/globoff.d  |   15 -
 third-party/curl/docs/cmdline-opts/globoff.md |   25 +
 .../cmdline-opts/happy-eyeballs-timeout-ms.d  |   21 -
 .../cmdline-opts/happy-eyeballs-timeout-ms.md |   30 +
 .../curl/docs/cmdline-opts/haproxy-clientip.d |   29 -
 .../docs/cmdline-opts/haproxy-clientip.md     |   33 +
 .../curl/docs/cmdline-opts/haproxy-protocol.d |   17 -
 .../docs/cmdline-opts/haproxy-protocol.md     |   23 +
 third-party/curl/docs/cmdline-opts/head.d     |   15 -
 third-party/curl/docs/cmdline-opts/head.md    |   23 +
 third-party/curl/docs/cmdline-opts/header.d   |   56 -
 third-party/curl/docs/cmdline-opts/header.md  |   69 +
 third-party/curl/docs/cmdline-opts/help.d     |   21 -
 third-party/curl/docs/cmdline-opts/help.md    |   39 +
 .../curl/docs/cmdline-opts/hostpubmd5.d       |   15 -
 .../curl/docs/cmdline-opts/hostpubmd5.md      |   21 +
 .../curl/docs/cmdline-opts/hostpubsha256.d    |   17 -
 .../curl/docs/cmdline-opts/hostpubsha256.md   |   20 +
 third-party/curl/docs/cmdline-opts/hsts.d     |   26 -
 third-party/curl/docs/cmdline-opts/hsts.md    |   40 +
 third-party/curl/docs/cmdline-opts/http0.9.d  |   19 -
 third-party/curl/docs/cmdline-opts/http0.9.md |   27 +
 third-party/curl/docs/cmdline-opts/http1.0.d  |   16 -
 third-party/curl/docs/cmdline-opts/http1.0.md |   22 +
 third-party/curl/docs/cmdline-opts/http1.1.d  |   14 -
 third-party/curl/docs/cmdline-opts/http1.1.md |   21 +
 .../docs/cmdline-opts/http2-prior-knowledge.d |   18 -
 .../cmdline-opts/http2-prior-knowledge.md     |   29 +
 third-party/curl/docs/cmdline-opts/http2.d    |   25 -
 third-party/curl/docs/cmdline-opts/http2.md   |   34 +
 .../curl/docs/cmdline-opts/http3-only.d       |   25 -
 .../curl/docs/cmdline-opts/http3-only.md      |   32 +
 third-party/curl/docs/cmdline-opts/http3.d    |   27 -
 third-party/curl/docs/cmdline-opts/http3.md   |   37 +
 .../docs/cmdline-opts/ignore-content-length.d |   19 -
 .../cmdline-opts/ignore-content-length.md     |   23 +
 third-party/curl/docs/cmdline-opts/include.d  |   19 -
 third-party/curl/docs/cmdline-opts/insecure.d |   33 -
 .../curl/docs/cmdline-opts/insecure.md        |   41 +
 .../curl/docs/cmdline-opts/interface.d        |   19 -
 .../curl/docs/cmdline-opts/interface.md       |   51 +
 third-party/curl/docs/cmdline-opts/ip-tos.md  |   26 +
 .../curl/docs/cmdline-opts/ipfs-gateway.md    |   40 +
 third-party/curl/docs/cmdline-opts/ipv4.d     |   17 -
 third-party/curl/docs/cmdline-opts/ipv4.md    |   24 +
 third-party/curl/docs/cmdline-opts/ipv6.d     |   17 -
 third-party/curl/docs/cmdline-opts/ipv6.md    |   28 +
 third-party/curl/docs/cmdline-opts/json.d     |   35 -
 third-party/curl/docs/cmdline-opts/json.md    |   42 +
 .../docs/cmdline-opts/junk-session-cookies.d  |   15 -
 .../docs/cmdline-opts/junk-session-cookies.md |   25 +
 .../curl/docs/cmdline-opts/keepalive-cnt.md   |   27 +
 .../curl/docs/cmdline-opts/keepalive-time.d   |   21 -
 .../curl/docs/cmdline-opts/keepalive-time.md  |   30 +
 third-party/curl/docs/cmdline-opts/key-type.d |   14 -
 .../curl/docs/cmdline-opts/key-type.md        |   20 +
 third-party/curl/docs/cmdline-opts/key.d      |   27 -
 third-party/curl/docs/cmdline-opts/key.md     |   33 +
 .../curl/docs/cmdline-opts/knownhosts.md      |   31 +
 third-party/curl/docs/cmdline-opts/krb.d      |   16 -
 third-party/curl/docs/cmdline-opts/krb.md     |   25 +
 third-party/curl/docs/cmdline-opts/libcurl.d  |   15 -
 third-party/curl/docs/cmdline-opts/libcurl.md |   21 +
 .../curl/docs/cmdline-opts/limit-rate.d       |   29 -
 .../curl/docs/cmdline-opts/limit-rate.md      |   42 +
 .../curl/docs/cmdline-opts/list-only.d        |   36 -
 .../curl/docs/cmdline-opts/list-only.md       |   43 +
 .../curl/docs/cmdline-opts/local-port.d       |   15 -
 .../curl/docs/cmdline-opts/local-port.md      |   21 +
 .../curl/docs/cmdline-opts/location-trusted.d |   15 -
 .../docs/cmdline-opts/location-trusted.md     |   27 +
 third-party/curl/docs/cmdline-opts/location.d |   33 -
 .../curl/docs/cmdline-opts/location.md        |   48 +
 .../curl/docs/cmdline-opts/login-options.d    |   25 -
 .../curl/docs/cmdline-opts/login-options.md   |   32 +
 .../curl/docs/cmdline-opts/mail-auth.d        |   14 -
 .../curl/docs/cmdline-opts/mail-auth.md       |   21 +
 .../curl/docs/cmdline-opts/mail-from.d        |   13 -
 .../curl/docs/cmdline-opts/mail-from.md       |   20 +
 .../docs/cmdline-opts/mail-rcpt-allowfails.d  |   22 -
 .../docs/cmdline-opts/mail-rcpt-allowfails.md |   28 +
 .../curl/docs/cmdline-opts/mail-rcpt.d        |   22 -
 .../curl/docs/cmdline-opts/mail-rcpt.md       |   28 +
 .../curl/docs/cmdline-opts/mainpage.idx       |   43 +
 third-party/curl/docs/cmdline-opts/manual.d   |   12 -
 third-party/curl/docs/cmdline-opts/manual.md  |   20 +
 .../curl/docs/cmdline-opts/max-filesize.d     |   23 -
 .../curl/docs/cmdline-opts/max-filesize.md    |   42 +
 .../curl/docs/cmdline-opts/max-redirs.d       |   15 -
 .../curl/docs/cmdline-opts/max-redirs.md      |   23 +
 third-party/curl/docs/cmdline-opts/max-time.d |   23 -
 .../curl/docs/cmdline-opts/max-time.md        |   30 +
 third-party/curl/docs/cmdline-opts/metalink.d |   12 -
 .../curl/docs/cmdline-opts/metalink.md        |   18 +
 third-party/curl/docs/cmdline-opts/mptcp.md   |   31 +
 .../curl/docs/cmdline-opts/negotiate.d        |   19 -
 .../curl/docs/cmdline-opts/negotiate.md       |   28 +
 .../curl/docs/cmdline-opts/netrc-file.d       |   17 -
 .../curl/docs/cmdline-opts/netrc-file.md      |   24 +
 .../curl/docs/cmdline-opts/netrc-optional.d   |   13 -
 .../curl/docs/cmdline-opts/netrc-optional.md  |   19 +
 third-party/curl/docs/cmdline-opts/netrc.d    |   27 -
 third-party/curl/docs/cmdline-opts/netrc.md   |   52 +
 third-party/curl/docs/cmdline-opts/next.d     |   27 -
 third-party/curl/docs/cmdline-opts/next.md    |   33 +
 third-party/curl/docs/cmdline-opts/no-alpn.d  |   19 -
 third-party/curl/docs/cmdline-opts/no-alpn.md |   26 +
 .../curl/docs/cmdline-opts/no-buffer.d        |   18 -
 .../curl/docs/cmdline-opts/no-buffer.md       |   24 +
 .../curl/docs/cmdline-opts/no-clobber.d       |   19 -
 .../curl/docs/cmdline-opts/no-clobber.md      |   28 +
 .../curl/docs/cmdline-opts/no-keepalive.d     |   15 -
 .../curl/docs/cmdline-opts/no-keepalive.md    |   22 +
 third-party/curl/docs/cmdline-opts/no-npn.d   |   19 -
 third-party/curl/docs/cmdline-opts/no-npn.md  |   26 +
 .../docs/cmdline-opts/no-progress-meter.d     |   15 -
 .../docs/cmdline-opts/no-progress-meter.md    |   22 +
 .../curl/docs/cmdline-opts/no-sessionid.d     |   19 -
 .../curl/docs/cmdline-opts/no-sessionid.md    |   25 +
 third-party/curl/docs/cmdline-opts/noproxy.d  |   27 -
 third-party/curl/docs/cmdline-opts/noproxy.md |   36 +
 third-party/curl/docs/cmdline-opts/ntlm-wb.d  |   13 -
 third-party/curl/docs/cmdline-opts/ntlm-wb.md |   22 +
 third-party/curl/docs/cmdline-opts/ntlm.d     |   22 -
 third-party/curl/docs/cmdline-opts/ntlm.md    |   27 +
 .../curl/docs/cmdline-opts/oauth2-bearer.d    |   17 -
 .../curl/docs/cmdline-opts/oauth2-bearer.md   |   25 +
 .../curl/docs/cmdline-opts/out-null.md        |   26 +
 .../curl/docs/cmdline-opts/output-dir.d       |   19 -
 .../curl/docs/cmdline-opts/output-dir.md      |   26 +
 third-party/curl/docs/cmdline-opts/output.d   |   49 -
 third-party/curl/docs/cmdline-opts/output.md  |   90 +
 .../curl/docs/cmdline-opts/page-footer        |  322 -
 .../curl/docs/cmdline-opts/page-header        |  258 -
 .../docs/cmdline-opts/parallel-immediate.d    |   15 -
 .../docs/cmdline-opts/parallel-immediate.md   |   25 +
 .../docs/cmdline-opts/parallel-max-host.md    |   28 +
 .../curl/docs/cmdline-opts/parallel-max.d     |   18 -
 .../curl/docs/cmdline-opts/parallel-max.md    |   23 +
 third-party/curl/docs/cmdline-opts/parallel.d |   14 -
 .../curl/docs/cmdline-opts/parallel.md        |   32 +
 third-party/curl/docs/cmdline-opts/pass.d     |   13 -
 third-party/curl/docs/cmdline-opts/pass.md    |   20 +
 .../curl/docs/cmdline-opts/path-as-is.d       |   13 -
 .../curl/docs/cmdline-opts/path-as-is.md      |   19 +
 .../curl/docs/cmdline-opts/pinnedpubkey.d     |   32 -
 .../curl/docs/cmdline-opts/pinnedpubkey.md    |   43 +
 third-party/curl/docs/cmdline-opts/post301.d  |   16 -
 third-party/curl/docs/cmdline-opts/post301.md |   24 +
 third-party/curl/docs/cmdline-opts/post302.d  |   16 -
 third-party/curl/docs/cmdline-opts/post302.md |   24 +
 third-party/curl/docs/cmdline-opts/post303.d  |   15 -
 third-party/curl/docs/cmdline-opts/post303.md |   22 +
 third-party/curl/docs/cmdline-opts/preproxy.d |   26 -
 .../curl/docs/cmdline-opts/preproxy.md        |   33 +
 .../curl/docs/cmdline-opts/progress-bar.d     |   20 -
 .../curl/docs/cmdline-opts/progress-bar.md    |   26 +
 .../curl/docs/cmdline-opts/proto-default.d    |   20 -
 .../curl/docs/cmdline-opts/proto-default.md   |   30 +
 .../curl/docs/cmdline-opts/proto-redir.d      |   22 -
 .../curl/docs/cmdline-opts/proto-redir.md     |   28 +
 third-party/curl/docs/cmdline-opts/proto.d    |   48 -
 third-party/curl/docs/cmdline-opts/proto.md   |   48 +
 .../curl/docs/cmdline-opts/proxy-anyauth.d    |   12 -
 .../curl/docs/cmdline-opts/proxy-anyauth.md   |   20 +
 .../curl/docs/cmdline-opts/proxy-basic.d      |   13 -
 .../curl/docs/cmdline-opts/proxy-basic.md     |   21 +
 .../curl/docs/cmdline-opts/proxy-ca-native.d  |   21 -
 .../curl/docs/cmdline-opts/proxy-ca-native.md |   30 +
 .../curl/docs/cmdline-opts/proxy-cacert.d     |   12 -
 .../curl/docs/cmdline-opts/proxy-cacert.md    |   28 +
 .../curl/docs/cmdline-opts/proxy-capath.d     |   12 -
 .../curl/docs/cmdline-opts/proxy-capath.md    |   31 +
 .../curl/docs/cmdline-opts/proxy-cert-type.d  |   12 -
 .../curl/docs/cmdline-opts/proxy-cert-type.md |   26 +
 .../curl/docs/cmdline-opts/proxy-cert.d       |   12 -
 .../curl/docs/cmdline-opts/proxy-cert.md      |   25 +
 .../curl/docs/cmdline-opts/proxy-ciphers.d    |   18 -
 .../curl/docs/cmdline-opts/proxy-ciphers.md   |   27 +
 .../curl/docs/cmdline-opts/proxy-crlfile.d    |   12 -
 .../curl/docs/cmdline-opts/proxy-crlfile.md   |   23 +
 .../curl/docs/cmdline-opts/proxy-digest.d     |   12 -
 .../curl/docs/cmdline-opts/proxy-digest.md    |   20 +
 .../curl/docs/cmdline-opts/proxy-header.d     |   32 -
 .../curl/docs/cmdline-opts/proxy-header.md    |   39 +
 .../curl/docs/cmdline-opts/proxy-http2.d      |   18 -
 .../curl/docs/cmdline-opts/proxy-http2.md     |   26 +
 .../curl/docs/cmdline-opts/proxy-http3.md     |   31 +
 .../curl/docs/cmdline-opts/proxy-insecure.d   |   11 -
 .../curl/docs/cmdline-opts/proxy-insecure.md  |   30 +
 .../curl/docs/cmdline-opts/proxy-key-type.d   |   12 -
 .../curl/docs/cmdline-opts/proxy-key-type.md  |   22 +
 .../curl/docs/cmdline-opts/proxy-key.d        |   12 -
 .../curl/docs/cmdline-opts/proxy-key.md       |   21 +
 .../curl/docs/cmdline-opts/proxy-negotiate.d  |   13 -
 .../curl/docs/cmdline-opts/proxy-negotiate.md |   21 +
 .../curl/docs/cmdline-opts/proxy-ntlm.d       |   12 -
 .../curl/docs/cmdline-opts/proxy-ntlm.md      |   20 +
 .../curl/docs/cmdline-opts/proxy-pass.d       |   12 -
 .../curl/docs/cmdline-opts/proxy-pass.md      |   21 +
 .../docs/cmdline-opts/proxy-pinnedpubkey.d    |   22 -
 .../docs/cmdline-opts/proxy-pinnedpubkey.md   |   31 +
 .../docs/cmdline-opts/proxy-service-name.d    |   12 -
 .../docs/cmdline-opts/proxy-service-name.md   |   20 +
 .../docs/cmdline-opts/proxy-ssl-allow-beast.d |   11 -
 .../cmdline-opts/proxy-ssl-allow-beast.md     |   29 +
 .../cmdline-opts/proxy-ssl-auto-client-cert.d |   11 -
 .../proxy-ssl-auto-client-cert.md             |   20 +
 .../docs/cmdline-opts/proxy-tls13-ciphers.d   |   21 -
 .../docs/cmdline-opts/proxy-tls13-ciphers.md  |   33 +
 .../docs/cmdline-opts/proxy-tlsauthtype.d     |   12 -
 .../docs/cmdline-opts/proxy-tlsauthtype.md    |   24 +
 .../docs/cmdline-opts/proxy-tlspassword.d     |   12 -
 .../docs/cmdline-opts/proxy-tlspassword.md    |   25 +
 .../curl/docs/cmdline-opts/proxy-tlsuser.d    |   12 -
 .../curl/docs/cmdline-opts/proxy-tlsuser.md   |   23 +
 .../curl/docs/cmdline-opts/proxy-tlsv1.d      |   11 -
 .../curl/docs/cmdline-opts/proxy-tlsv1.md     |   20 +
 .../curl/docs/cmdline-opts/proxy-user.d       |   23 -
 .../curl/docs/cmdline-opts/proxy-user.md      |   29 +
 third-party/curl/docs/cmdline-opts/proxy.d    |   51 -
 third-party/curl/docs/cmdline-opts/proxy.md   |   61 +
 third-party/curl/docs/cmdline-opts/proxy1.0.d |   17 -
 .../curl/docs/cmdline-opts/proxy1.0.md        |   25 +
 .../curl/docs/cmdline-opts/proxytunnel.d      |   18 -
 .../curl/docs/cmdline-opts/proxytunnel.md     |   24 +
 third-party/curl/docs/cmdline-opts/pubkey.d   |   19 -
 third-party/curl/docs/cmdline-opts/pubkey.md  |   25 +
 third-party/curl/docs/cmdline-opts/quote.d    |   87 -
 third-party/curl/docs/cmdline-opts/quote.md   |   93 +
 .../curl/docs/cmdline-opts/random-file.d      |   16 -
 .../curl/docs/cmdline-opts/random-file.md     |   22 +
 third-party/curl/docs/cmdline-opts/range.d    |   50 -
 third-party/curl/docs/cmdline-opts/range.md   |   66 +
 third-party/curl/docs/cmdline-opts/rate.d     |   35 -
 third-party/curl/docs/cmdline-opts/rate.md    |   46 +
 third-party/curl/docs/cmdline-opts/raw.d      |   13 -
 third-party/curl/docs/cmdline-opts/raw.md     |   19 +
 third-party/curl/docs/cmdline-opts/referer.d  |   20 -
 third-party/curl/docs/cmdline-opts/referer.md |   27 +
 .../docs/cmdline-opts/remote-header-name.d    |   34 -
 .../docs/cmdline-opts/remote-header-name.md   |   42 +
 .../curl/docs/cmdline-opts/remote-name-all.d  |   14 -
 .../curl/docs/cmdline-opts/remote-name-all.md |   20 +
 .../curl/docs/cmdline-opts/remote-name.d      |   28 -
 .../curl/docs/cmdline-opts/remote-name.md     |   42 +
 .../curl/docs/cmdline-opts/remote-time.d      |   14 -
 .../curl/docs/cmdline-opts/remote-time.md     |   21 +
 .../curl/docs/cmdline-opts/remove-on-error.d  |   15 -
 .../curl/docs/cmdline-opts/remove-on-error.md |   23 +
 .../curl/docs/cmdline-opts/request-target.d   |   16 -
 .../curl/docs/cmdline-opts/request-target.md  |   25 +
 third-party/curl/docs/cmdline-opts/request.d  |   51 -
 third-party/curl/docs/cmdline-opts/request.md |   58 +
 third-party/curl/docs/cmdline-opts/resolve.d  |   41 -
 third-party/curl/docs/cmdline-opts/resolve.md |   50 +
 .../curl/docs/cmdline-opts/retry-all-errors.d |   34 -
 .../docs/cmdline-opts/retry-all-errors.md     |   40 +
 .../docs/cmdline-opts/retry-connrefused.d     |   12 -
 .../docs/cmdline-opts/retry-connrefused.md    |   21 +
 .../curl/docs/cmdline-opts/retry-delay.d      |   15 -
 .../curl/docs/cmdline-opts/retry-delay.md     |   28 +
 .../curl/docs/cmdline-opts/retry-max-time.d   |   17 -
 .../curl/docs/cmdline-opts/retry-max-time.md  |   38 +
 third-party/curl/docs/cmdline-opts/retry.d    |   25 -
 third-party/curl/docs/cmdline-opts/retry.md   |   34 +
 .../curl/docs/cmdline-opts/sasl-authzid.d     |   19 -
 .../curl/docs/cmdline-opts/sasl-authzid.md    |   26 +
 third-party/curl/docs/cmdline-opts/sasl-ir.d  |   11 -
 third-party/curl/docs/cmdline-opts/sasl-ir.md |   20 +
 .../curl/docs/cmdline-opts/service-name.d     |   12 -
 .../curl/docs/cmdline-opts/service-name.md    |   19 +
 .../curl/docs/cmdline-opts/show-error.d       |   13 -
 .../curl/docs/cmdline-opts/show-error.md      |   19 +
 .../curl/docs/cmdline-opts/show-headers.md    |   39 +
 third-party/curl/docs/cmdline-opts/sigalgs.md |   33 +
 third-party/curl/docs/cmdline-opts/silent.d   |   17 -
 third-party/curl/docs/cmdline-opts/silent.md  |   25 +
 .../curl/docs/cmdline-opts/skip-existing.md   |   22 +
 third-party/curl/docs/cmdline-opts/socks4.d   |   28 -
 third-party/curl/docs/cmdline-opts/socks4.md  |   38 +
 third-party/curl/docs/cmdline-opts/socks4a.d  |   27 -
 third-party/curl/docs/cmdline-opts/socks4a.md |   37 +
 .../curl/docs/cmdline-opts/socks5-basic.d     |   13 -
 .../curl/docs/cmdline-opts/socks5-basic.md    |   19 +
 .../docs/cmdline-opts/socks5-gssapi-nec.d     |   14 -
 .../docs/cmdline-opts/socks5-gssapi-nec.md    |   21 +
 .../docs/cmdline-opts/socks5-gssapi-service.d |   13 -
 .../cmdline-opts/socks5-gssapi-service.md     |   18 +
 .../curl/docs/cmdline-opts/socks5-gssapi.d    |   14 -
 .../curl/docs/cmdline-opts/socks5-gssapi.md   |   21 +
 .../curl/docs/cmdline-opts/socks5-hostname.d  |   27 -
 .../curl/docs/cmdline-opts/socks5-hostname.md |   36 +
 third-party/curl/docs/cmdline-opts/socks5.d   |   29 -
 third-party/curl/docs/cmdline-opts/socks5.md  |   39 +
 .../curl/docs/cmdline-opts/speed-limit.d      |   15 -
 .../curl/docs/cmdline-opts/speed-limit.md     |   23 +
 .../curl/docs/cmdline-opts/speed-time.d       |   18 -
 .../curl/docs/cmdline-opts/speed-time.md      |   25 +
 .../curl/docs/cmdline-opts/ssl-allow-beast.d  |   17 -
 .../curl/docs/cmdline-opts/ssl-allow-beast.md |   27 +
 .../docs/cmdline-opts/ssl-auto-client-cert.d  |   14 -
 .../docs/cmdline-opts/ssl-auto-client-cert.md |   21 +
 .../curl/docs/cmdline-opts/ssl-no-revoke.d    |   13 -
 .../curl/docs/cmdline-opts/ssl-no-revoke.md   |   19 +
 third-party/curl/docs/cmdline-opts/ssl-reqd.d |   23 -
 .../curl/docs/cmdline-opts/ssl-reqd.md        |   31 +
 .../cmdline-opts/ssl-revoke-best-effort.d     |   13 -
 .../cmdline-opts/ssl-revoke-best-effort.md    |   20 +
 .../curl/docs/cmdline-opts/ssl-sessions.md    |   39 +
 third-party/curl/docs/cmdline-opts/ssl.d      |   26 -
 third-party/curl/docs/cmdline-opts/ssl.md     |   36 +
 third-party/curl/docs/cmdline-opts/sslv2.d    |   17 -
 third-party/curl/docs/cmdline-opts/sslv2.md   |   24 +
 third-party/curl/docs/cmdline-opts/sslv3.d    |   17 -
 third-party/curl/docs/cmdline-opts/sslv3.md   |   24 +
 third-party/curl/docs/cmdline-opts/stderr.d   |   14 -
 third-party/curl/docs/cmdline-opts/stderr.md  |   21 +
 .../curl/docs/cmdline-opts/styled-output.d    |   16 -
 .../curl/docs/cmdline-opts/styled-output.md   |   23 +
 .../cmdline-opts/suppress-connect-headers.d   |   14 -
 .../cmdline-opts/suppress-connect-headers.md  |   23 +
 .../curl/docs/cmdline-opts/tcp-fastopen.d     |   14 -
 .../curl/docs/cmdline-opts/tcp-fastopen.md    |   19 +
 .../curl/docs/cmdline-opts/tcp-nodelay.d      |   15 -
 .../curl/docs/cmdline-opts/tcp-nodelay.md     |   30 +
 .../curl/docs/cmdline-opts/telnet-option.d    |   23 -
 .../curl/docs/cmdline-opts/telnet-option.md   |   29 +
 .../curl/docs/cmdline-opts/tftp-blksize.d     |   15 -
 .../curl/docs/cmdline-opts/tftp-blksize.md    |   21 +
 .../curl/docs/cmdline-opts/tftp-no-options.d  |   16 -
 .../curl/docs/cmdline-opts/tftp-no-options.md |   20 +
 .../curl/docs/cmdline-opts/time-cond.d        |   27 -
 .../curl/docs/cmdline-opts/time-cond.md       |   34 +
 .../curl/docs/cmdline-opts/tls-earlydata.md   |   46 +
 third-party/curl/docs/cmdline-opts/tls-max.d  |   34 -
 third-party/curl/docs/cmdline-opts/tls-max.md |   44 +
 .../curl/docs/cmdline-opts/tls13-ciphers.d    |   21 -
 .../curl/docs/cmdline-opts/tls13-ciphers.md   |   31 +
 .../curl/docs/cmdline-opts/tlsauthtype.d      |   16 -
 .../curl/docs/cmdline-opts/tlsauthtype.md     |   23 +
 .../curl/docs/cmdline-opts/tlspassword.d      |   15 -
 .../curl/docs/cmdline-opts/tlspassword.md     |   22 +
 third-party/curl/docs/cmdline-opts/tlsuser.d  |   15 -
 third-party/curl/docs/cmdline-opts/tlsuser.md |   22 +
 third-party/curl/docs/cmdline-opts/tlsv1.0.d  |   16 -
 third-party/curl/docs/cmdline-opts/tlsv1.0.md |   22 +
 third-party/curl/docs/cmdline-opts/tlsv1.1.d  |   16 -
 third-party/curl/docs/cmdline-opts/tlsv1.1.md |   23 +
 third-party/curl/docs/cmdline-opts/tlsv1.2.d  |   16 -
 third-party/curl/docs/cmdline-opts/tlsv1.2.md |   23 +
 third-party/curl/docs/cmdline-opts/tlsv1.3.d  |   18 -
 third-party/curl/docs/cmdline-opts/tlsv1.3.md |   25 +
 third-party/curl/docs/cmdline-opts/tlsv1.d    |   17 -
 third-party/curl/docs/cmdline-opts/tlsv1.md   |   24 +
 .../curl/docs/cmdline-opts/tr-encoding.d      |   13 -
 .../curl/docs/cmdline-opts/tr-encoding.md     |   24 +
 .../curl/docs/cmdline-opts/trace-ascii.d      |   24 -
 .../curl/docs/cmdline-opts/trace-ascii.md     |   31 +
 .../curl/docs/cmdline-opts/trace-config.d     |   21 -
 .../curl/docs/cmdline-opts/trace-config.md    |   27 +
 .../curl/docs/cmdline-opts/trace-ids.d        |   12 -
 .../curl/docs/cmdline-opts/trace-ids.md       |   24 +
 .../curl/docs/cmdline-opts/trace-time.d       |   12 -
 .../curl/docs/cmdline-opts/trace-time.md      |   19 +
 third-party/curl/docs/cmdline-opts/trace.d    |   21 -
 third-party/curl/docs/cmdline-opts/trace.md   |   30 +
 .../curl/docs/cmdline-opts/unix-socket.d      |   13 -
 .../curl/docs/cmdline-opts/unix-socket.md     |   22 +
 .../curl/docs/cmdline-opts/upload-file.d      |   37 -
 .../curl/docs/cmdline-opts/upload-file.md     |   63 +
 .../curl/docs/cmdline-opts/upload-flags.md    |   25 +
 .../curl/docs/cmdline-opts/url-query.d        |   25 -
 .../curl/docs/cmdline-opts/url-query.md       |   31 +
 third-party/curl/docs/cmdline-opts/url.d      |   26 -
 third-party/curl/docs/cmdline-opts/url.md     |   49 +
 .../curl/docs/cmdline-opts/use-ascii.d        |   15 -
 .../curl/docs/cmdline-opts/use-ascii.md       |   23 +
 .../curl/docs/cmdline-opts/user-agent.d       |   20 -
 .../curl/docs/cmdline-opts/user-agent.md      |   29 +
 third-party/curl/docs/cmdline-opts/user.d     |   44 -
 third-party/curl/docs/cmdline-opts/user.md    |   50 +
 third-party/curl/docs/cmdline-opts/variable.d |   55 -
 .../curl/docs/cmdline-opts/variable.md        |  110 +
 third-party/curl/docs/cmdline-opts/verbose.d  |   28 -
 third-party/curl/docs/cmdline-opts/verbose.md |   81 +
 third-party/curl/docs/cmdline-opts/version.d  |   88 -
 third-party/curl/docs/cmdline-opts/version.md |  134 +
 .../curl/docs/cmdline-opts/vlan-priority.md   |   22 +
 .../curl/docs/cmdline-opts/write-out.d        |  292 -
 .../curl/docs/cmdline-opts/write-out.md       |  557 ++
 third-party/curl/docs/cmdline-opts/xattr.d    |   15 -
 third-party/curl/docs/cmdline-opts/xattr.md   |   25 +
 third-party/curl/docs/curl-config.1           |  105 -
 third-party/curl/docs/curl-config.md          |  124 +
 third-party/curl/docs/examples/.checksrc      |   39 +-
 third-party/curl/docs/examples/.gitignore     |   42 +-
 third-party/curl/docs/examples/10-at-a-time.c |  195 +-
 third-party/curl/docs/examples/CMakeLists.txt |   92 +
 third-party/curl/docs/examples/Makefile.am    |   32 +-
 .../curl/docs/examples/Makefile.example       |   37 +-
 third-party/curl/docs/examples/Makefile.inc   |   34 +-
 third-party/curl/docs/examples/Makefile.mk    |   74 -
 third-party/curl/docs/examples/README.md      |    7 +-
 third-party/curl/docs/examples/adddocsref.pl  |   21 +-
 .../curl/docs/examples/address-scope.c        |   69 +
 third-party/curl/docs/examples/altsvc.c       |   21 +-
 third-party/curl/docs/examples/anyauthput.c   |   78 +-
 third-party/curl/docs/examples/block_ip.c     |  351 +
 third-party/curl/docs/examples/cacertinmem.c  |  227 +-
 third-party/curl/docs/examples/certinfo.c     |   22 +-
 third-party/curl/docs/examples/chkspeed.c     |  138 +-
 third-party/curl/docs/examples/connect-to.c   |   34 +-
 .../curl/docs/examples/cookie_interface.c     |   79 +-
 third-party/curl/docs/examples/crawler.c      |  252 +-
 third-party/curl/docs/examples/debug.c        |   58 +-
 .../curl/docs/examples/default-scheme.c       |   18 +-
 third-party/curl/docs/examples/ephiperfifo.c  |  404 +-
 third-party/curl/docs/examples/evhiperfifo.c  |  345 +-
 .../curl/docs/examples/externalsocket.c       |   68 +-
 third-party/curl/docs/examples/fileupload.c   |   51 +-
 third-party/curl/docs/examples/ftp-delete.c   |   84 +
 third-party/curl/docs/examples/ftp-wildcard.c |  134 +-
 third-party/curl/docs/examples/ftpget.c       |   34 +-
 third-party/curl/docs/examples/ftpgetinfo.c   |   48 +-
 third-party/curl/docs/examples/ftpgetresp.c   |   56 +-
 third-party/curl/docs/examples/ftpsget.c      |   38 +-
 third-party/curl/docs/examples/ftpupload.c    |  103 +-
 .../curl/docs/examples/ftpuploadfrommem.c     |   33 +-
 .../curl/docs/examples/ftpuploadresume.c      |   93 +-
 third-party/curl/docs/examples/getinfo.c      |   19 +-
 third-party/curl/docs/examples/getinmemory.c  |   78 +-
 third-party/curl/docs/examples/getredirect.c  |   31 +-
 third-party/curl/docs/examples/getreferrer.c  |   22 +-
 third-party/curl/docs/examples/ghiper.c       |  323 +-
 third-party/curl/docs/examples/headerapi.c    |   22 +-
 third-party/curl/docs/examples/hiperfifo.c    |  353 +-
 .../curl/docs/examples/href_extractor.c       |   88 -
 third-party/curl/docs/examples/hsts-preload.c |   46 +-
 third-party/curl/docs/examples/htmltidy.c     |   94 +-
 third-party/curl/docs/examples/htmltitle.cpp  |  153 +-
 third-party/curl/docs/examples/http-options.c |   17 +-
 third-party/curl/docs/examples/http-post.c    |   22 +-
 .../curl/docs/examples/http2-download.c       |  175 +-
 .../curl/docs/examples/http2-pushinmemory.c   |   72 +-
 .../curl/docs/examples/http2-serverpush.c     |  159 +-
 third-party/curl/docs/examples/http2-upload.c |  271 +-
 .../curl/docs/examples/http3-present.c        |    5 +-
 third-party/curl/docs/examples/http3.c        |   20 +-
 .../curl/docs/examples/httpcustomheader.c     |   15 +-
 .../curl/docs/examples/httpput-postfields.c   |   30 +-
 third-party/curl/docs/examples/httpput.c      |   61 +-
 third-party/curl/docs/examples/https.c        |   22 +-
 third-party/curl/docs/examples/imap-append.c  |   38 +-
 third-party/curl/docs/examples/imap-authzid.c |   20 +-
 third-party/curl/docs/examples/imap-copy.c    |   20 +-
 third-party/curl/docs/examples/imap-create.c  |   20 +-
 third-party/curl/docs/examples/imap-delete.c  |   20 +-
 third-party/curl/docs/examples/imap-examine.c |   20 +-
 third-party/curl/docs/examples/imap-fetch.c   |   20 +-
 third-party/curl/docs/examples/imap-list.c    |   22 +-
 third-party/curl/docs/examples/imap-lsub.c    |   20 +-
 third-party/curl/docs/examples/imap-multi.c   |   61 +-
 third-party/curl/docs/examples/imap-noop.c    |   20 +-
 third-party/curl/docs/examples/imap-search.c  |   20 +-
 third-party/curl/docs/examples/imap-ssl.c     |   30 +-
 third-party/curl/docs/examples/imap-store.c   |   24 +-
 third-party/curl/docs/examples/imap-tls.c     |   32 +-
 third-party/curl/docs/examples/interface.c    |   58 +
 third-party/curl/docs/examples/ipv6.c         |   34 +-
 third-party/curl/docs/examples/keepalive.c    |   64 +
 third-party/curl/docs/examples/localport.c    |   59 +
 .../curl/docs/examples/log_failed_transfers.c |  337 +
 third-party/curl/docs/examples/maxconnects.c  |   24 +-
 third-party/curl/docs/examples/multi-app.c    |  119 +-
 .../curl/docs/examples/multi-debugcallback.c  |  101 +-
 third-party/curl/docs/examples/multi-double.c |   96 +-
 third-party/curl/docs/examples/multi-event.c  |  190 +-
 .../curl/docs/examples/multi-formadd.c        |  110 +-
 third-party/curl/docs/examples/multi-legacy.c |  226 +-
 third-party/curl/docs/examples/multi-post.c   |  102 +-
 third-party/curl/docs/examples/multi-single.c |   67 +-
 third-party/curl/docs/examples/multi-uv.c     |  193 +-
 third-party/curl/docs/examples/multithread.c  |   96 -
 third-party/curl/docs/examples/netrc.c        |   54 +
 third-party/curl/docs/examples/parseurl.c     |    7 +-
 third-party/curl/docs/examples/persistent.c   |   27 +-
 third-party/curl/docs/examples/pop3-authzid.c |   20 +-
 third-party/curl/docs/examples/pop3-dele.c    |   18 +-
 third-party/curl/docs/examples/pop3-list.c    |   20 +-
 third-party/curl/docs/examples/pop3-multi.c   |   61 +-
 third-party/curl/docs/examples/pop3-noop.c    |   20 +-
 third-party/curl/docs/examples/pop3-retr.c    |   20 +-
 third-party/curl/docs/examples/pop3-ssl.c     |   30 +-
 third-party/curl/docs/examples/pop3-stat.c    |   20 +-
 third-party/curl/docs/examples/pop3-tls.c     |   32 +-
 third-party/curl/docs/examples/pop3-top.c     |   20 +-
 third-party/curl/docs/examples/pop3-uidl.c    |   20 +-
 .../curl/docs/examples/post-callback.c        |   42 +-
 third-party/curl/docs/examples/postinmemory.c |   32 +-
 .../curl/docs/examples/postit2-formadd.c      |   77 +-
 third-party/curl/docs/examples/postit2.c      |   35 +-
 third-party/curl/docs/examples/progressfunc.c |   39 +-
 third-party/curl/docs/examples/protofeats.c   |    9 +-
 third-party/curl/docs/examples/range.c        |   50 +
 third-party/curl/docs/examples/resolve.c      |   19 +-
 third-party/curl/docs/examples/rtsp-options.c |   60 +
 third-party/curl/docs/examples/sendrecv.c     |   60 +-
 third-party/curl/docs/examples/sepheaders.c   |  101 +-
 third-party/curl/docs/examples/sessioninfo.c  |   40 +-
 third-party/curl/docs/examples/sftpget.c      |   34 +-
 .../curl/docs/examples/sftpuploadresume.c     |   84 +-
 .../docs/examples/shared-connection-cache.c   |   32 +-
 third-party/curl/docs/examples/simple.c       |   17 +-
 third-party/curl/docs/examples/simplepost.c   |   26 +-
 third-party/curl/docs/examples/simplessl.c    |  157 +-
 .../curl/docs/examples/smooth-gtk-thread.c    |   77 +-
 third-party/curl/docs/examples/smtp-authzid.c |   68 +-
 third-party/curl/docs/examples/smtp-expn.c    |   23 +-
 third-party/curl/docs/examples/smtp-mail.c    |   62 +-
 third-party/curl/docs/examples/smtp-mime.c    |   33 +-
 third-party/curl/docs/examples/smtp-multi.c   |  128 +-
 third-party/curl/docs/examples/smtp-ssl.c     |   70 +-
 third-party/curl/docs/examples/smtp-tls.c     |   72 +-
 third-party/curl/docs/examples/smtp-vrfy.c    |   25 +-
 third-party/curl/docs/examples/sslbackend.c   |   12 +-
 third-party/curl/docs/examples/synctime.c     |  325 +-
 third-party/curl/docs/examples/threaded-ssl.c |  168 -
 third-party/curl/docs/examples/threaded.c     |  116 +
 third-party/curl/docs/examples/unixsocket.c   |   21 +-
 third-party/curl/docs/examples/url2file.c     |   87 +-
 third-party/curl/docs/examples/urlapi.c       |   24 +-
 .../curl/docs/examples/usercertinmem.c        |  255 +-
 .../curl/docs/examples/version-check.pl       |   22 +-
 third-party/curl/docs/examples/websocket-cb.c |   28 +-
 .../curl/docs/examples/websocket-updown.c     |  128 +
 third-party/curl/docs/examples/websocket.c    |  139 +-
 third-party/curl/docs/examples/xmlstream.c    |  115 +-
 third-party/curl/docs/internals/BUFQ.md       |  184 +
 .../curl/docs/{ => internals}/BUFREF.md       |   33 +-
 third-party/curl/docs/internals/CHECKSRC.md   |  195 +
 .../curl/docs/internals/CLIENT-READERS.md     |  206 +
 .../curl/docs/internals/CLIENT-WRITERS.md     |  168 +
 .../curl/docs/{ => internals}/CODE_STYLE.md   |  132 +-
 .../curl/docs/internals/CONNECTION-FILTERS.md |  343 +
 .../curl/docs/internals/CREDENTIALS.md        |   76 +
 third-party/curl/docs/internals/CURLX.md      |   24 +
 third-party/curl/docs/internals/DYNBUF.md     |  145 +
 third-party/curl/docs/internals/HASH.md       |  151 +
 third-party/curl/docs/internals/LLIST.md      |  195 +
 third-party/curl/docs/internals/MID.md        |   72 +
 third-party/curl/docs/internals/MQTT.md       |   61 +
 third-party/curl/docs/internals/MULTI-EV.md   |  127 +
 .../curl/docs/{ => internals}/NEW-PROTOCOL.md |   44 +-
 third-party/curl/docs/internals/PEERS.md      |  130 +
 third-party/curl/docs/internals/PORTING.md    |   47 +
 third-party/curl/docs/internals/RATELIMITS.md |  100 +
 third-party/curl/docs/internals/README.md     |   12 +
 third-party/curl/docs/internals/SCORECARD.md  |   90 +
 third-party/curl/docs/internals/SPLAY.md      |  111 +
 third-party/curl/docs/internals/STRPARSE.md   |  230 +
 .../curl/docs/internals/THRDPOOL-AND-QUEUE.md |  112 +
 .../curl/docs/internals/TIME-KEEPING.md       |   53 +
 .../curl/docs/internals/TLS-SESSIONS.md       |  161 +
 third-party/curl/docs/internals/UINT_SETS.md  |  137 +
 .../curl/docs/{ => internals}/WEBSOCKET.md    |   38 +-
 third-party/curl/docs/libcurl/.gitignore      |    5 +-
 third-party/curl/docs/libcurl/ABI.md          |   75 +-
 third-party/curl/docs/libcurl/CMakeLists.txt  |   85 +-
 third-party/curl/docs/libcurl/Makefile.am     |   56 +-
 third-party/curl/docs/libcurl/Makefile.inc    |  202 +-
 .../curl/docs/libcurl/curl_easy_cleanup.3     |   75 -
 .../curl/docs/libcurl/curl_easy_cleanup.md    |   79 +
 .../curl/docs/libcurl/curl_easy_duphandle.3   |   70 -
 .../curl/docs/libcurl/curl_easy_duphandle.md  |   77 +
 .../curl/docs/libcurl/curl_easy_escape.3      |   75 -
 .../curl/docs/libcurl/curl_easy_escape.md     |   92 +
 .../curl/docs/libcurl/curl_easy_getinfo.3     |  325 -
 .../curl/docs/libcurl/curl_easy_getinfo.md    |  447 ++
 .../curl/docs/libcurl/curl_easy_header.3      |  140 -
 .../curl/docs/libcurl/curl_easy_header.md     |  165 +
 .../curl/docs/libcurl/curl_easy_init.3        |   76 -
 .../curl/docs/libcurl/curl_easy_init.md       |   76 +
 .../curl/docs/libcurl/curl_easy_nextheader.3  |   96 -
 .../curl/docs/libcurl/curl_easy_nextheader.md |  107 +
 .../docs/libcurl/curl_easy_option_by_id.3     |   55 -
 .../docs/libcurl/curl_easy_option_by_id.md    |   56 +
 .../docs/libcurl/curl_easy_option_by_name.3   |   54 -
 .../docs/libcurl/curl_easy_option_by_name.md  |   55 +
 .../curl/docs/libcurl/curl_easy_option_next.3 |   86 -
 .../docs/libcurl/curl_easy_option_next.md     |   92 +
 .../curl/docs/libcurl/curl_easy_pause.3       |  116 -
 .../curl/docs/libcurl/curl_easy_pause.md      |  142 +
 .../curl/docs/libcurl/curl_easy_perform.3     |   85 -
 .../curl/docs/libcurl/curl_easy_perform.md    |   88 +
 .../curl/docs/libcurl/curl_easy_recv.3        |   97 -
 .../curl/docs/libcurl/curl_easy_recv.md       |  106 +
 .../curl/docs/libcurl/curl_easy_reset.3       |   55 -
 .../curl/docs/libcurl/curl_easy_reset.md      |   59 +
 .../curl/docs/libcurl/curl_easy_send.3        |   90 -
 .../curl/docs/libcurl/curl_easy_send.md       |   98 +
 .../curl/docs/libcurl/curl_easy_setopt.3      |  742 --
 .../curl/docs/libcurl/curl_easy_setopt.md     | 1391 ++++
 .../docs/libcurl/curl_easy_ssls_export.md     |  175 +
 .../docs/libcurl/curl_easy_ssls_import.md     |   89 +
 .../curl/docs/libcurl/curl_easy_strerror.3    |   54 -
 .../curl/docs/libcurl/curl_easy_strerror.md   |   62 +
 .../curl/docs/libcurl/curl_easy_unescape.3    |   75 -
 .../curl/docs/libcurl/curl_easy_unescape.md   |   77 +
 .../curl/docs/libcurl/curl_easy_upkeep.3      |   81 -
 .../curl/docs/libcurl/curl_easy_upkeep.md     |   90 +
 third-party/curl/docs/libcurl/curl_escape.3   |   59 -
 third-party/curl/docs/libcurl/curl_escape.md  |   66 +
 third-party/curl/docs/libcurl/curl_formadd.3  |  268 -
 third-party/curl/docs/libcurl/curl_formadd.md |  322 +
 third-party/curl/docs/libcurl/curl_formfree.3 |   70 -
 .../curl/docs/libcurl/curl_formfree.md        |   83 +
 third-party/curl/docs/libcurl/curl_formget.3  |   73 -
 third-party/curl/docs/libcurl/curl_formget.md |   75 +
 third-party/curl/docs/libcurl/curl_free.3     |   53 -
 third-party/curl/docs/libcurl/curl_free.md    |   55 +
 third-party/curl/docs/libcurl/curl_getdate.3  |  120 -
 third-party/curl/docs/libcurl/curl_getdate.md |  134 +
 third-party/curl/docs/libcurl/curl_getenv.3   |   57 -
 third-party/curl/docs/libcurl/curl_getenv.md  |   61 +
 .../curl/docs/libcurl/curl_global_cleanup.3   |   74 -
 .../curl/docs/libcurl/curl_global_cleanup.md  |   82 +
 .../curl/docs/libcurl/curl_global_init.3      |  121 -
 .../curl/docs/libcurl/curl_global_init.md     |  138 +
 .../curl/docs/libcurl/curl_global_init_mem.3  |   79 -
 .../curl/docs/libcurl/curl_global_init_mem.md |  111 +
 .../curl/docs/libcurl/curl_global_sslset.3    |  132 -
 .../curl/docs/libcurl/curl_global_sslset.md   |  141 +
 .../curl/docs/libcurl/curl_global_trace.3     |  118 -
 .../curl/docs/libcurl/curl_global_trace.md    |  212 +
 .../curl/docs/libcurl/curl_mime_addpart.3     |   69 -
 .../curl/docs/libcurl/curl_mime_addpart.md    |   75 +
 .../curl/docs/libcurl/curl_mime_data.3        |   75 -
 .../curl/docs/libcurl/curl_mime_data.md       |   86 +
 .../curl/docs/libcurl/curl_mime_data_cb.3     |  168 -
 .../curl/docs/libcurl/curl_mime_data_cb.md    |  180 +
 .../curl/docs/libcurl/curl_mime_encoder.3     |   99 -
 .../curl/docs/libcurl/curl_mime_encoder.md    |  110 +
 .../curl/docs/libcurl/curl_mime_filedata.3    |   87 -
 .../curl/docs/libcurl/curl_mime_filedata.md   |   99 +
 .../curl/docs/libcurl/curl_mime_filename.3    |   75 -
 .../curl/docs/libcurl/curl_mime_filename.md   |   89 +
 .../curl/docs/libcurl/curl_mime_free.3        |   63 -
 .../curl/docs/libcurl/curl_mime_free.md       |   70 +
 .../curl/docs/libcurl/curl_mime_headers.3     |   68 -
 .../curl/docs/libcurl/curl_mime_headers.md    |   88 +
 .../curl/docs/libcurl/curl_mime_init.3        |   73 -
 .../curl/docs/libcurl/curl_mime_init.md       |   77 +
 .../curl/docs/libcurl/curl_mime_name.3        |   66 -
 .../curl/docs/libcurl/curl_mime_name.md       |   77 +
 .../curl/docs/libcurl/curl_mime_subparts.3    |   75 -
 .../curl/docs/libcurl/curl_mime_subparts.md   |   93 +
 .../curl/docs/libcurl/curl_mime_type.3        |   85 -
 .../curl/docs/libcurl/curl_mime_type.md       |   96 +
 third-party/curl/docs/libcurl/curl_mprintf.3  |  254 -
 third-party/curl/docs/libcurl/curl_mprintf.md |  290 +
 .../curl/docs/libcurl/curl_multi_add_handle.3 |   83 -
 .../docs/libcurl/curl_multi_add_handle.md     |   94 +
 .../curl/docs/libcurl/curl_multi_assign.3     |   74 -
 .../curl/docs/libcurl/curl_multi_assign.md    |   84 +
 .../curl/docs/libcurl/curl_multi_cleanup.3    |   62 -
 .../curl/docs/libcurl/curl_multi_cleanup.md   |   76 +
 .../curl/docs/libcurl/curl_multi_fdset.3      |  102 -
 .../curl/docs/libcurl/curl_multi_fdset.md     |  129 +
 .../docs/libcurl/curl_multi_get_handles.md    |   81 +
 .../curl/docs/libcurl/curl_multi_get_offt.md  |   87 +
 .../curl/docs/libcurl/curl_multi_info_read.3  |   98 -
 .../curl/docs/libcurl/curl_multi_info_read.md |  105 +
 .../curl/docs/libcurl/curl_multi_init.3       |   53 -
 .../curl/docs/libcurl/curl_multi_init.md      |   64 +
 .../docs/libcurl/curl_multi_notify_disable.md |   66 +
 .../docs/libcurl/curl_multi_notify_enable.md  |   66 +
 .../curl/docs/libcurl/curl_multi_perform.3    |   99 -
 .../curl/docs/libcurl/curl_multi_perform.md   |  118 +
 .../curl/docs/libcurl/curl_multi_poll.3       |  119 -
 .../curl/docs/libcurl/curl_multi_poll.md      |  150 +
 .../docs/libcurl/curl_multi_remove_handle.3   |   71 -
 .../docs/libcurl/curl_multi_remove_handle.md  |   79 +
 .../curl/docs/libcurl/curl_multi_setopt.3     |   89 -
 .../curl/docs/libcurl/curl_multi_setopt.md    |  154 +
 .../curl/docs/libcurl/curl_multi_socket.3     |   92 -
 .../curl/docs/libcurl/curl_multi_socket.md    |   89 +
 .../docs/libcurl/curl_multi_socket_action.3   |  114 -
 .../docs/libcurl/curl_multi_socket_action.md  |  127 +
 .../curl/docs/libcurl/curl_multi_socket_all.3 |    1 -
 .../docs/libcurl/curl_multi_socket_all.md     |   69 +
 .../curl/docs/libcurl/curl_multi_strerror.3   |   48 -
 .../curl/docs/libcurl/curl_multi_strerror.md  |   54 +
 .../curl/docs/libcurl/curl_multi_timeout.3    |   83 -
 .../curl/docs/libcurl/curl_multi_timeout.md   |   95 +
 .../curl/docs/libcurl/curl_multi_wait.3       |  126 -
 .../curl/docs/libcurl/curl_multi_wait.md      |  128 +
 .../curl/docs/libcurl/curl_multi_waitfds.md   |  112 +
 .../curl/docs/libcurl/curl_multi_wakeup.3     |   88 -
 .../curl/docs/libcurl/curl_multi_wakeup.md    |   99 +
 .../docs/libcurl/curl_pushheader_byname.3     |   80 -
 .../docs/libcurl/curl_pushheader_byname.md    |   86 +
 .../curl/docs/libcurl/curl_pushheader_bynum.3 |   70 -
 .../docs/libcurl/curl_pushheader_bynum.md     |   73 +
 .../curl/docs/libcurl/curl_share_cleanup.3    |   55 -
 .../curl/docs/libcurl/curl_share_cleanup.md   |   66 +
 .../curl/docs/libcurl/curl_share_init.3       |   57 -
 .../curl/docs/libcurl/curl_share_init.md      |   59 +
 .../curl/docs/libcurl/curl_share_setopt.3     |   61 -
 .../curl/docs/libcurl/curl_share_setopt.md    |   74 +
 .../curl/docs/libcurl/curl_share_strerror.3   |   48 -
 .../curl/docs/libcurl/curl_share_strerror.md  |   53 +
 .../curl/docs/libcurl/curl_slist_append.3     |   77 -
 .../curl/docs/libcurl/curl_slist_append.md    |   79 +
 .../curl/docs/libcurl/curl_slist_free_all.3   |   60 -
 .../curl/docs/libcurl/curl_slist_free_all.md  |   64 +
 third-party/curl/docs/libcurl/curl_strequal.3 |   59 -
 .../curl/docs/libcurl/curl_strequal.md        |   59 +
 .../curl/docs/libcurl/curl_strnequal.3        |    1 -
 .../curl/docs/libcurl/curl_strnequal.md       |   62 +
 third-party/curl/docs/libcurl/curl_unescape.3 |   65 -
 .../curl/docs/libcurl/curl_unescape.md        |   73 +
 third-party/curl/docs/libcurl/curl_url.3      |   62 -
 third-party/curl/docs/libcurl/curl_url.md     |   70 +
 .../curl/docs/libcurl/curl_url_cleanup.3      |   50 -
 .../curl/docs/libcurl/curl_url_cleanup.md     |   57 +
 third-party/curl/docs/libcurl/curl_url_dup.3  |   55 -
 third-party/curl/docs/libcurl/curl_url_dup.md |   59 +
 third-party/curl/docs/libcurl/curl_url_get.3  |  171 -
 third-party/curl/docs/libcurl/curl_url_get.md |  249 +
 third-party/curl/docs/libcurl/curl_url_set.3  |  205 -
 third-party/curl/docs/libcurl/curl_url_set.md |  280 +
 .../curl/docs/libcurl/curl_url_strerror.3     |   51 -
 .../curl/docs/libcurl/curl_url_strerror.md    |   56 +
 third-party/curl/docs/libcurl/curl_version.3  |   49 -
 third-party/curl/docs/libcurl/curl_version.md |   53 +
 .../curl/docs/libcurl/curl_version_info.3     |  320 -
 .../curl/docs/libcurl/curl_version_info.md    |  423 ++
 third-party/curl/docs/libcurl/curl_ws_meta.3  |  118 -
 third-party/curl/docs/libcurl/curl_ws_meta.md |  172 +
 third-party/curl/docs/libcurl/curl_ws_recv.3  |   69 -
 third-party/curl/docs/libcurl/curl_ws_recv.md |  134 +
 third-party/curl/docs/libcurl/curl_ws_send.3  |  100 -
 third-party/curl/docs/libcurl/curl_ws_send.md |  137 +
 .../curl/docs/libcurl/curl_ws_start_frame.md  |  150 +
 third-party/curl/docs/libcurl/libcurl-easy.3  |   61 -
 third-party/curl/docs/libcurl/libcurl-easy.md |   54 +
 .../curl/docs/libcurl/libcurl-env-dbg.md      |  206 +
 third-party/curl/docs/libcurl/libcurl-env.3   |   99 -
 third-party/curl/docs/libcurl/libcurl-env.md  |   93 +
 .../curl/docs/libcurl/libcurl-errors.3        |  438 --
 .../curl/docs/libcurl/libcurl-errors.md       |  762 ++
 third-party/curl/docs/libcurl/libcurl-multi.3 |  182 -
 .../curl/docs/libcurl/libcurl-multi.md        |  180 +
 .../curl/docs/libcurl/libcurl-security.3      |  426 --
 .../curl/docs/libcurl/libcurl-security.md     |  520 ++
 third-party/curl/docs/libcurl/libcurl-share.3 |   67 -
 .../curl/docs/libcurl/libcurl-share.md        |   65 +
 .../curl/docs/libcurl/libcurl-thread.3        |  123 -
 .../curl/docs/libcurl/libcurl-thread.md       |  127 +
 .../curl/docs/libcurl/libcurl-tutorial.3      | 1394 ----
 .../curl/docs/libcurl/libcurl-tutorial.md     | 1465 ++++
 third-party/curl/docs/libcurl/libcurl-url.3   |  147 -
 third-party/curl/docs/libcurl/libcurl-url.md  |  163 +
 third-party/curl/docs/libcurl/libcurl-ws.3    |  114 -
 third-party/curl/docs/libcurl/libcurl-ws.md   |  154 +
 third-party/curl/docs/libcurl/libcurl.3       |  228 -
 third-party/curl/docs/libcurl/libcurl.m4      |  343 +-
 third-party/curl/docs/libcurl/libcurl.md      |  250 +
 .../curl/docs/libcurl/mksymbolsmanpage.pl     |  295 +-
 .../curl/docs/libcurl/opts/CMakeLists.txt     |   21 +-
 .../docs/libcurl/opts/CURLINFO_ACTIVESOCKET.3 |   75 -
 .../libcurl/opts/CURLINFO_ACTIVESOCKET.md     |   84 +
 .../libcurl/opts/CURLINFO_APPCONNECT_TIME.3   |   69 -
 .../libcurl/opts/CURLINFO_APPCONNECT_TIME.md  |   73 +
 .../libcurl/opts/CURLINFO_APPCONNECT_TIME_T.3 |   71 -
 .../opts/CURLINFO_APPCONNECT_TIME_T.md        |   74 +
 .../curl/docs/libcurl/opts/CURLINFO_CAINFO.3  |   67 -
 .../curl/docs/libcurl/opts/CURLINFO_CAINFO.md |   70 +
 .../curl/docs/libcurl/opts/CURLINFO_CAPATH.3  |   67 -
 .../curl/docs/libcurl/opts/CURLINFO_CAPATH.md |   73 +
 .../docs/libcurl/opts/CURLINFO_CERTINFO.3     |   98 -
 .../docs/libcurl/opts/CURLINFO_CERTINFO.md    |  109 +
 .../libcurl/opts/CURLINFO_CONDITION_UNMET.3   |   76 -
 .../libcurl/opts/CURLINFO_CONDITION_UNMET.md  |   81 +
 .../docs/libcurl/opts/CURLINFO_CONNECT_TIME.3 |   65 -
 .../libcurl/opts/CURLINFO_CONNECT_TIME.md     |   69 +
 .../libcurl/opts/CURLINFO_CONNECT_TIME_T.3    |   67 -
 .../libcurl/opts/CURLINFO_CONNECT_TIME_T.md   |   72 +
 .../curl/docs/libcurl/opts/CURLINFO_CONN_ID.3 |   69 -
 .../docs/libcurl/opts/CURLINFO_CONN_ID.md     |   72 +
 .../opts/CURLINFO_CONTENT_LENGTH_DOWNLOAD.3   |   69 -
 .../opts/CURLINFO_CONTENT_LENGTH_DOWNLOAD.md  |   76 +
 .../opts/CURLINFO_CONTENT_LENGTH_DOWNLOAD_T.3 |   66 -
 .../CURLINFO_CONTENT_LENGTH_DOWNLOAD_T.md     |   70 +
 .../opts/CURLINFO_CONTENT_LENGTH_UPLOAD.3     |   68 -
 .../opts/CURLINFO_CONTENT_LENGTH_UPLOAD.md    |   75 +
 .../opts/CURLINFO_CONTENT_LENGTH_UPLOAD_T.3   |   65 -
 .../opts/CURLINFO_CONTENT_LENGTH_UPLOAD_T.md  |   73 +
 .../docs/libcurl/opts/CURLINFO_CONTENT_TYPE.3 |   73 -
 .../libcurl/opts/CURLINFO_CONTENT_TYPE.md     |   77 +
 .../docs/libcurl/opts/CURLINFO_COOKIELIST.3   |   81 -
 .../docs/libcurl/opts/CURLINFO_COOKIELIST.md  |   84 +
 .../libcurl/opts/CURLINFO_EARLYDATA_SENT_T.md |   78 +
 .../libcurl/opts/CURLINFO_EFFECTIVE_METHOD.3  |   70 -
 .../libcurl/opts/CURLINFO_EFFECTIVE_METHOD.md |   74 +
 .../libcurl/opts/CURLINFO_EFFECTIVE_URL.3     |   67 -
 .../libcurl/opts/CURLINFO_EFFECTIVE_URL.md    |   70 +
 .../docs/libcurl/opts/CURLINFO_FILETIME.3     |   73 -
 .../docs/libcurl/opts/CURLINFO_FILETIME.md    |   79 +
 .../docs/libcurl/opts/CURLINFO_FILETIME_T.3   |   76 -
 .../docs/libcurl/opts/CURLINFO_FILETIME_T.md  |   80 +
 .../libcurl/opts/CURLINFO_FTP_ENTRY_PATH.3    |   69 -
 .../libcurl/opts/CURLINFO_FTP_ENTRY_PATH.md   |   77 +
 .../docs/libcurl/opts/CURLINFO_HEADER_SIZE.3  |   65 -
 .../docs/libcurl/opts/CURLINFO_HEADER_SIZE.md |   71 +
 .../libcurl/opts/CURLINFO_HTTPAUTH_AVAIL.3    |   74 -
 .../libcurl/opts/CURLINFO_HTTPAUTH_AVAIL.md   |   77 +
 .../libcurl/opts/CURLINFO_HTTPAUTH_USED.md    |   79 +
 .../libcurl/opts/CURLINFO_HTTP_CONNECTCODE.3  |   65 -
 .../libcurl/opts/CURLINFO_HTTP_CONNECTCODE.md |   67 +
 .../docs/libcurl/opts/CURLINFO_HTTP_VERSION.3 |   61 -
 .../libcurl/opts/CURLINFO_HTTP_VERSION.md     |   63 +
 .../docs/libcurl/opts/CURLINFO_LASTSOCKET.3   |   75 -
 .../docs/libcurl/opts/CURLINFO_LASTSOCKET.md  |   88 +
 .../docs/libcurl/opts/CURLINFO_LOCAL_IP.3     |   71 -
 .../docs/libcurl/opts/CURLINFO_LOCAL_IP.md    |   75 +
 .../docs/libcurl/opts/CURLINFO_LOCAL_PORT.3   |   69 -
 .../docs/libcurl/opts/CURLINFO_LOCAL_PORT.md  |   77 +
 .../libcurl/opts/CURLINFO_NAMELOOKUP_TIME.3   |   66 -
 .../libcurl/opts/CURLINFO_NAMELOOKUP_TIME.md  |   70 +
 .../libcurl/opts/CURLINFO_NAMELOOKUP_TIME_T.3 |   67 -
 .../opts/CURLINFO_NAMELOOKUP_TIME_T.md        |   72 +
 .../docs/libcurl/opts/CURLINFO_NUM_CONNECTS.3 |   65 -
 .../libcurl/opts/CURLINFO_NUM_CONNECTS.md     |   67 +
 .../docs/libcurl/opts/CURLINFO_OS_ERRNO.3     |   62 -
 .../docs/libcurl/opts/CURLINFO_OS_ERRNO.md    |   72 +
 .../opts/CURLINFO_POSTTRANSFER_TIME_T.md      |   73 +
 .../libcurl/opts/CURLINFO_PRETRANSFER_TIME.3  |   70 -
 .../libcurl/opts/CURLINFO_PRETRANSFER_TIME.md |   76 +
 .../opts/CURLINFO_PRETRANSFER_TIME_T.3        |   71 -
 .../opts/CURLINFO_PRETRANSFER_TIME_T.md       |   78 +
 .../docs/libcurl/opts/CURLINFO_PRIMARY_IP.3   |   71 -
 .../docs/libcurl/opts/CURLINFO_PRIMARY_IP.md  |   75 +
 .../docs/libcurl/opts/CURLINFO_PRIMARY_PORT.3 |   65 -
 .../libcurl/opts/CURLINFO_PRIMARY_PORT.md     |   74 +
 .../curl/docs/libcurl/opts/CURLINFO_PRIVATE.3 |   64 -
 .../docs/libcurl/opts/CURLINFO_PRIVATE.md     |   70 +
 .../docs/libcurl/opts/CURLINFO_PROTOCOL.3     |   72 -
 .../docs/libcurl/opts/CURLINFO_PROTOCOL.md    |   79 +
 .../libcurl/opts/CURLINFO_PROXYAUTH_AVAIL.3   |   76 -
 .../libcurl/opts/CURLINFO_PROXYAUTH_AVAIL.md  |   78 +
 .../libcurl/opts/CURLINFO_PROXYAUTH_USED.md   |   82 +
 .../docs/libcurl/opts/CURLINFO_PROXY_ERROR.3  |  104 -
 .../docs/libcurl/opts/CURLINFO_PROXY_ERROR.md |  107 +
 .../opts/CURLINFO_PROXY_SSL_VERIFYRESULT.3    |   62 -
 .../opts/CURLINFO_PROXY_SSL_VERIFYRESULT.md   |   80 +
 .../libcurl/opts/CURLINFO_QUEUE_TIME_T.md     |   72 +
 .../libcurl/opts/CURLINFO_REDIRECT_COUNT.3    |   60 -
 .../libcurl/opts/CURLINFO_REDIRECT_COUNT.md   |   64 +
 .../libcurl/opts/CURLINFO_REDIRECT_TIME.3     |   66 -
 .../libcurl/opts/CURLINFO_REDIRECT_TIME.md    |   72 +
 .../libcurl/opts/CURLINFO_REDIRECT_TIME_T.3   |   68 -
 .../libcurl/opts/CURLINFO_REDIRECT_TIME_T.md  |   74 +
 .../docs/libcurl/opts/CURLINFO_REDIRECT_URL.3 |   66 -
 .../libcurl/opts/CURLINFO_REDIRECT_URL.md     |   71 +
 .../curl/docs/libcurl/opts/CURLINFO_REFERER.3 |   65 -
 .../docs/libcurl/opts/CURLINFO_REFERER.md     |   69 +
 .../docs/libcurl/opts/CURLINFO_REQUEST_SIZE.3 |   63 -
 .../libcurl/opts/CURLINFO_REQUEST_SIZE.md     |   65 +
 .../libcurl/opts/CURLINFO_RESPONSE_CODE.3     |   65 -
 .../libcurl/opts/CURLINFO_RESPONSE_CODE.md    |   74 +
 .../docs/libcurl/opts/CURLINFO_RETRY_AFTER.3  |   68 -
 .../docs/libcurl/opts/CURLINFO_RETRY_AFTER.md |   78 +
 .../libcurl/opts/CURLINFO_RTSP_CLIENT_CSEQ.3  |   59 -
 .../libcurl/opts/CURLINFO_RTSP_CLIENT_CSEQ.md |   63 +
 .../libcurl/opts/CURLINFO_RTSP_CSEQ_RECV.3    |   60 -
 .../libcurl/opts/CURLINFO_RTSP_CSEQ_RECV.md   |   63 +
 .../libcurl/opts/CURLINFO_RTSP_SERVER_CSEQ.3  |   64 -
 .../libcurl/opts/CURLINFO_RTSP_SERVER_CSEQ.md |   67 +
 .../libcurl/opts/CURLINFO_RTSP_SESSION_ID.3   |   65 -
 .../libcurl/opts/CURLINFO_RTSP_SESSION_ID.md  |   68 +
 .../curl/docs/libcurl/opts/CURLINFO_SCHEME.3  |   66 -
 .../curl/docs/libcurl/opts/CURLINFO_SCHEME.md |   74 +
 .../libcurl/opts/CURLINFO_SIZE_DELIVERED.md   |   78 +
 .../libcurl/opts/CURLINFO_SIZE_DOWNLOAD.3     |   71 -
 .../libcurl/opts/CURLINFO_SIZE_DOWNLOAD.md    |   79 +
 .../libcurl/opts/CURLINFO_SIZE_DOWNLOAD_T.3   |   68 -
 .../libcurl/opts/CURLINFO_SIZE_DOWNLOAD_T.md  |   72 +
 .../docs/libcurl/opts/CURLINFO_SIZE_UPLOAD.3  |   67 -
 .../docs/libcurl/opts/CURLINFO_SIZE_UPLOAD.md |   75 +
 .../libcurl/opts/CURLINFO_SIZE_UPLOAD_T.3     |   64 -
 .../libcurl/opts/CURLINFO_SIZE_UPLOAD_T.md    |   68 +
 .../libcurl/opts/CURLINFO_SPEED_DOWNLOAD.3    |   67 -
 .../libcurl/opts/CURLINFO_SPEED_DOWNLOAD.md   |   75 +
 .../libcurl/opts/CURLINFO_SPEED_DOWNLOAD_T.3  |   64 -
 .../libcurl/opts/CURLINFO_SPEED_DOWNLOAD_T.md |   69 +
 .../docs/libcurl/opts/CURLINFO_SPEED_UPLOAD.3 |   65 -
 .../libcurl/opts/CURLINFO_SPEED_UPLOAD.md     |   73 +
 .../libcurl/opts/CURLINFO_SPEED_UPLOAD_T.3    |   63 -
 .../libcurl/opts/CURLINFO_SPEED_UPLOAD_T.md   |   67 +
 .../docs/libcurl/opts/CURLINFO_SSL_ENGINES.3  |   64 -
 .../docs/libcurl/opts/CURLINFO_SSL_ENGINES.md |   69 +
 .../libcurl/opts/CURLINFO_SSL_VERIFYRESULT.3  |   62 -
 .../libcurl/opts/CURLINFO_SSL_VERIFYRESULT.md |   79 +
 .../opts/CURLINFO_STARTTRANSFER_TIME.3        |   68 -
 .../opts/CURLINFO_STARTTRANSFER_TIME.md       |   73 +
 .../opts/CURLINFO_STARTTRANSFER_TIME_T.3      |   70 -
 .../opts/CURLINFO_STARTTRANSFER_TIME_T.md     |   75 +
 .../docs/libcurl/opts/CURLINFO_TLS_SESSION.3  |   72 -
 .../docs/libcurl/opts/CURLINFO_TLS_SESSION.md |   94 +
 .../docs/libcurl/opts/CURLINFO_TLS_SSL_PTR.3  |  163 -
 .../docs/libcurl/opts/CURLINFO_TLS_SSL_PTR.md |  171 +
 .../docs/libcurl/opts/CURLINFO_TOTAL_TIME.3   |   66 -
 .../docs/libcurl/opts/CURLINFO_TOTAL_TIME.md  |   71 +
 .../docs/libcurl/opts/CURLINFO_TOTAL_TIME_T.3 |   68 -
 .../libcurl/opts/CURLINFO_TOTAL_TIME_T.md     |   72 +
 .../docs/libcurl/opts/CURLINFO_USED_PROXY.md  |   71 +
 .../curl/docs/libcurl/opts/CURLINFO_XFER_ID.3 |   70 -
 .../docs/libcurl/opts/CURLINFO_XFER_ID.md     |   72 +
 .../libcurl/opts/CURLMINFO_XFERS_ADDED.md     |   63 +
 .../libcurl/opts/CURLMINFO_XFERS_CURRENT.md   |   62 +
 .../docs/libcurl/opts/CURLMINFO_XFERS_DONE.md |   58 +
 .../libcurl/opts/CURLMINFO_XFERS_PENDING.md   |   60 +
 .../libcurl/opts/CURLMINFO_XFERS_RUNNING.md   |   58 +
 .../opts/CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE.3 |   59 -
 .../CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE.md     |   63 +
 .../CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE.3    |   58 -
 .../CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE.md   |   62 +
 .../docs/libcurl/opts/CURLMOPT_MAXCONNECTS.3  |   69 -
 .../docs/libcurl/opts/CURLMOPT_MAXCONNECTS.md |   75 +
 .../opts/CURLMOPT_MAX_CONCURRENT_STREAMS.3    |   57 -
 .../opts/CURLMOPT_MAX_CONCURRENT_STREAMS.md   |   61 +
 .../opts/CURLMOPT_MAX_HOST_CONNECTIONS.3      |   70 -
 .../opts/CURLMOPT_MAX_HOST_CONNECTIONS.md     |   80 +
 .../opts/CURLMOPT_MAX_PIPELINE_LENGTH.3       |   62 -
 .../opts/CURLMOPT_MAX_PIPELINE_LENGTH.md      |   66 +
 .../opts/CURLMOPT_MAX_TOTAL_CONNECTIONS.3     |   68 -
 .../opts/CURLMOPT_MAX_TOTAL_CONNECTIONS.md    |   77 +
 .../libcurl/opts/CURLMOPT_NETWORK_CHANGED.md  |   83 +
 .../docs/libcurl/opts/CURLMOPT_NOTIFYDATA.md  |   72 +
 .../libcurl/opts/CURLMOPT_NOTIFYFUNCTION.md   |  130 +
 .../docs/libcurl/opts/CURLMOPT_PIPELINING.3   |   71 -
 .../docs/libcurl/opts/CURLMOPT_PIPELINING.md  |   85 +
 .../opts/CURLMOPT_PIPELINING_SERVER_BL.3      |   67 -
 .../opts/CURLMOPT_PIPELINING_SERVER_BL.md     |   72 +
 .../opts/CURLMOPT_PIPELINING_SITE_BL.3        |   63 -
 .../opts/CURLMOPT_PIPELINING_SITE_BL.md       |   68 +
 .../docs/libcurl/opts/CURLMOPT_PUSHDATA.3     |   81 -
 .../docs/libcurl/opts/CURLMOPT_PUSHDATA.md    |   89 +
 .../docs/libcurl/opts/CURLMOPT_PUSHFUNCTION.3 |  130 -
 .../libcurl/opts/CURLMOPT_PUSHFUNCTION.md     |  150 +
 .../docs/libcurl/opts/CURLMOPT_QUICK_EXIT.md  |   60 +
 .../opts/CURLMOPT_RESOLVE_THREADS_MAX.md      |   75 +
 .../docs/libcurl/opts/CURLMOPT_SOCKETDATA.3   |   78 -
 .../docs/libcurl/opts/CURLMOPT_SOCKETDATA.md  |   81 +
 .../libcurl/opts/CURLMOPT_SOCKETFUNCTION.3    |  121 -
 .../libcurl/opts/CURLMOPT_SOCKETFUNCTION.md   |  156 +
 .../docs/libcurl/opts/CURLMOPT_TIMERDATA.3    |   84 -
 .../docs/libcurl/opts/CURLMOPT_TIMERDATA.md   |   78 +
 .../libcurl/opts/CURLMOPT_TIMERFUNCTION.3     |  112 -
 .../libcurl/opts/CURLMOPT_TIMERFUNCTION.md    |  111 +
 .../opts/CURLOPT_ABSTRACT_UNIX_SOCKET.3       |   64 -
 .../opts/CURLOPT_ABSTRACT_UNIX_SOCKET.md      |   75 +
 .../libcurl/opts/CURLOPT_ACCEPTTIMEOUT_MS.3   |   58 -
 .../libcurl/opts/CURLOPT_ACCEPTTIMEOUT_MS.md  |   70 +
 .../libcurl/opts/CURLOPT_ACCEPT_ENCODING.3    |  108 -
 .../libcurl/opts/CURLOPT_ACCEPT_ENCODING.md   |  129 +
 .../docs/libcurl/opts/CURLOPT_ADDRESS_SCOPE.3 |   59 -
 .../libcurl/opts/CURLOPT_ADDRESS_SCOPE.md     |   65 +
 .../curl/docs/libcurl/opts/CURLOPT_ALTSVC.3   |   89 -
 .../curl/docs/libcurl/opts/CURLOPT_ALTSVC.md  |  136 +
 .../docs/libcurl/opts/CURLOPT_ALTSVC_CTRL.3   |   86 -
 .../docs/libcurl/opts/CURLOPT_ALTSVC_CTRL.md  |  108 +
 .../curl/docs/libcurl/opts/CURLOPT_APPEND.3   |   59 -
 .../curl/docs/libcurl/opts/CURLOPT_APPEND.md  |   69 +
 .../docs/libcurl/opts/CURLOPT_AUTOREFERER.3   |   68 -
 .../docs/libcurl/opts/CURLOPT_AUTOREFERER.md  |   79 +
 .../docs/libcurl/opts/CURLOPT_AWS_SIGV4.3     |  105 -
 .../docs/libcurl/opts/CURLOPT_AWS_SIGV4.md    |  131 +
 .../docs/libcurl/opts/CURLOPT_BUFFERSIZE.3    |   75 -
 .../docs/libcurl/opts/CURLOPT_BUFFERSIZE.md   |   86 +
 .../curl/docs/libcurl/opts/CURLOPT_CAINFO.3   |   83 -
 .../curl/docs/libcurl/opts/CURLOPT_CAINFO.md  |   92 +
 .../docs/libcurl/opts/CURLOPT_CAINFO_BLOB.3   |   73 -
 .../docs/libcurl/opts/CURLOPT_CAINFO_BLOB.md  |   93 +
 .../curl/docs/libcurl/opts/CURLOPT_CAPATH.3   |   76 -
 .../curl/docs/libcurl/opts/CURLOPT_CAPATH.md  |   85 +
 .../libcurl/opts/CURLOPT_CA_CACHE_TIMEOUT.3   |   78 -
 .../libcurl/opts/CURLOPT_CA_CACHE_TIMEOUT.md  |   92 +
 .../curl/docs/libcurl/opts/CURLOPT_CERTINFO.3 |   83 -
 .../docs/libcurl/opts/CURLOPT_CERTINFO.md     |   99 +
 .../libcurl/opts/CURLOPT_CHUNK_BGN_FUNCTION.3 |  143 -
 .../opts/CURLOPT_CHUNK_BGN_FUNCTION.md        |  155 +
 .../docs/libcurl/opts/CURLOPT_CHUNK_DATA.3    |   94 -
 .../docs/libcurl/opts/CURLOPT_CHUNK_DATA.md   |  104 +
 .../libcurl/opts/CURLOPT_CHUNK_END_FUNCTION.3 |   73 -
 .../opts/CURLOPT_CHUNK_END_FUNCTION.md        |   85 +
 .../libcurl/opts/CURLOPT_CLOSESOCKETDATA.3    |   60 -
 .../libcurl/opts/CURLOPT_CLOSESOCKETDATA.md   |   84 +
 .../opts/CURLOPT_CLOSESOCKETFUNCTION.3        |   71 -
 .../opts/CURLOPT_CLOSESOCKETFUNCTION.md       |   95 +
 .../libcurl/opts/CURLOPT_CONNECTTIMEOUT.3     |   86 -
 .../libcurl/opts/CURLOPT_CONNECTTIMEOUT.md    |   91 +
 .../libcurl/opts/CURLOPT_CONNECTTIMEOUT_MS.3  |   62 -
 .../libcurl/opts/CURLOPT_CONNECTTIMEOUT_MS.md |   92 +
 .../docs/libcurl/opts/CURLOPT_CONNECT_ONLY.3  |   80 -
 .../docs/libcurl/opts/CURLOPT_CONNECT_ONLY.md |   89 +
 .../docs/libcurl/opts/CURLOPT_CONNECT_TO.3    |  113 -
 .../docs/libcurl/opts/CURLOPT_CONNECT_TO.md   |  120 +
 .../opts/CURLOPT_CONV_FROM_NETWORK_FUNCTION.3 |  105 -
 .../CURLOPT_CONV_FROM_NETWORK_FUNCTION.md     |  120 +
 .../opts/CURLOPT_CONV_FROM_UTF8_FUNCTION.3    |  103 -
 .../opts/CURLOPT_CONV_FROM_UTF8_FUNCTION.md   |  113 +
 .../opts/CURLOPT_CONV_TO_NETWORK_FUNCTION.3   |  104 -
 .../opts/CURLOPT_CONV_TO_NETWORK_FUNCTION.md  |  116 +
 .../curl/docs/libcurl/opts/CURLOPT_COOKIE.3   |   87 -
 .../curl/docs/libcurl/opts/CURLOPT_COOKIE.md  |   97 +
 .../docs/libcurl/opts/CURLOPT_COOKIEFILE.3    |   95 -
 .../docs/libcurl/opts/CURLOPT_COOKIEFILE.md   |  108 +
 .../docs/libcurl/opts/CURLOPT_COOKIEJAR.3     |   83 -
 .../docs/libcurl/opts/CURLOPT_COOKIEJAR.md    |   99 +
 .../docs/libcurl/opts/CURLOPT_COOKIELIST.3    |  123 -
 .../docs/libcurl/opts/CURLOPT_COOKIELIST.md   |  142 +
 .../docs/libcurl/opts/CURLOPT_COOKIESESSION.3 |   71 -
 .../libcurl/opts/CURLOPT_COOKIESESSION.md     |   77 +
 .../libcurl/opts/CURLOPT_COPYPOSTFIELDS.3     |   74 -
 .../libcurl/opts/CURLOPT_COPYPOSTFIELDS.md    |   88 +
 .../curl/docs/libcurl/opts/CURLOPT_CRLF.3     |   60 -
 .../curl/docs/libcurl/opts/CURLOPT_CRLF.md    |   64 +
 .../curl/docs/libcurl/opts/CURLOPT_CRLFILE.3  |   79 -
 .../curl/docs/libcurl/opts/CURLOPT_CRLFILE.md |   91 +
 .../curl/docs/libcurl/opts/CURLOPT_CURLU.3    |   74 -
 .../curl/docs/libcurl/opts/CURLOPT_CURLU.md   |   81 +
 .../docs/libcurl/opts/CURLOPT_CUSTOMREQUEST.3 |  115 -
 .../libcurl/opts/CURLOPT_CUSTOMREQUEST.md     |  142 +
 .../docs/libcurl/opts/CURLOPT_DEBUGDATA.3     |   73 -
 .../docs/libcurl/opts/CURLOPT_DEBUGDATA.md    |   89 +
 .../docs/libcurl/opts/CURLOPT_DEBUGFUNCTION.3 |  194 -
 .../libcurl/opts/CURLOPT_DEBUGFUNCTION.md     |  221 +
 .../libcurl/opts/CURLOPT_DEFAULT_PROTOCOL.3   |   86 -
 .../libcurl/opts/CURLOPT_DEFAULT_PROTOCOL.md  |   93 +
 .../docs/libcurl/opts/CURLOPT_DIRLISTONLY.3   |   77 -
 .../docs/libcurl/opts/CURLOPT_DIRLISTONLY.md  |   91 +
 .../opts/CURLOPT_DISALLOW_USERNAME_IN_URL.3   |   65 -
 .../opts/CURLOPT_DISALLOW_USERNAME_IN_URL.md  |   73 +
 .../libcurl/opts/CURLOPT_DNS_CACHE_TIMEOUT.3  |   85 -
 .../libcurl/opts/CURLOPT_DNS_CACHE_TIMEOUT.md |   95 +
 .../docs/libcurl/opts/CURLOPT_DNS_INTERFACE.3 |   64 -
 .../libcurl/opts/CURLOPT_DNS_INTERFACE.md     |   76 +
 .../docs/libcurl/opts/CURLOPT_DNS_LOCAL_IP4.3 |   66 -
 .../libcurl/opts/CURLOPT_DNS_LOCAL_IP4.md     |   75 +
 .../docs/libcurl/opts/CURLOPT_DNS_LOCAL_IP6.3 |   66 -
 .../libcurl/opts/CURLOPT_DNS_LOCAL_IP6.md     |   75 +
 .../docs/libcurl/opts/CURLOPT_DNS_SERVERS.3   |   71 -
 .../docs/libcurl/opts/CURLOPT_DNS_SERVERS.md  |   80 +
 .../opts/CURLOPT_DNS_SHUFFLE_ADDRESSES.3      |   73 -
 .../opts/CURLOPT_DNS_SHUFFLE_ADDRESSES.md     |   75 +
 .../opts/CURLOPT_DNS_USE_GLOBAL_CACHE.3       |   65 -
 .../opts/CURLOPT_DNS_USE_GLOBAL_CACHE.md      |   74 +
 .../libcurl/opts/CURLOPT_DOH_SSL_VERIFYHOST.3 |   88 -
 .../opts/CURLOPT_DOH_SSL_VERIFYHOST.md        |   94 +
 .../libcurl/opts/CURLOPT_DOH_SSL_VERIFYPEER.3 |  101 -
 .../opts/CURLOPT_DOH_SSL_VERIFYPEER.md        |  106 +
 .../opts/CURLOPT_DOH_SSL_VERIFYSTATUS.3       |   74 -
 .../opts/CURLOPT_DOH_SSL_VERIFYSTATUS.md      |   81 +
 .../curl/docs/libcurl/opts/CURLOPT_DOH_URL.3  |   90 -
 .../curl/docs/libcurl/opts/CURLOPT_DOH_URL.md |  104 +
 .../curl/docs/libcurl/opts/CURLOPT_ECH.md     |  109 +
 .../docs/libcurl/opts/CURLOPT_EGDSOCKET.3     |   65 -
 .../docs/libcurl/opts/CURLOPT_EGDSOCKET.md    |   47 +
 .../docs/libcurl/opts/CURLOPT_ERRORBUFFER.3   |   96 -
 .../docs/libcurl/opts/CURLOPT_ERRORBUFFER.md  |  113 +
 .../opts/CURLOPT_EXPECT_100_TIMEOUT_MS.3      |   61 -
 .../opts/CURLOPT_EXPECT_100_TIMEOUT_MS.md     |   68 +
 .../docs/libcurl/opts/CURLOPT_FAILONERROR.3   |   71 -
 .../docs/libcurl/opts/CURLOPT_FAILONERROR.md  |   76 +
 .../curl/docs/libcurl/opts/CURLOPT_FILETIME.3 |   68 -
 .../docs/libcurl/opts/CURLOPT_FILETIME.md     |   78 +
 .../docs/libcurl/opts/CURLOPT_FNMATCH_DATA.3  |   66 -
 .../docs/libcurl/opts/CURLOPT_FNMATCH_DATA.md |   84 +
 .../libcurl/opts/CURLOPT_FNMATCH_FUNCTION.3   |   76 -
 .../libcurl/opts/CURLOPT_FNMATCH_FUNCTION.md  |   92 +
 .../libcurl/opts/CURLOPT_FOLLOWLOCATION.3     |   88 -
 .../libcurl/opts/CURLOPT_FOLLOWLOCATION.md    |  160 +
 .../docs/libcurl/opts/CURLOPT_FORBID_REUSE.3  |   64 -
 .../docs/libcurl/opts/CURLOPT_FORBID_REUSE.md |   74 +
 .../docs/libcurl/opts/CURLOPT_FRESH_CONNECT.3 |   63 -
 .../libcurl/opts/CURLOPT_FRESH_CONNECT.md     |   72 +
 .../curl/docs/libcurl/opts/CURLOPT_FTPPORT.3  |   95 -
 .../curl/docs/libcurl/opts/CURLOPT_FTPPORT.md |  100 +
 .../docs/libcurl/opts/CURLOPT_FTPSSLAUTH.3    |   67 -
 .../docs/libcurl/opts/CURLOPT_FTPSSLAUTH.md   |   83 +
 .../docs/libcurl/opts/CURLOPT_FTP_ACCOUNT.3   |   64 -
 .../docs/libcurl/opts/CURLOPT_FTP_ACCOUNT.md  |   71 +
 .../opts/CURLOPT_FTP_ALTERNATIVE_TO_USER.3    |   65 -
 .../opts/CURLOPT_FTP_ALTERNATIVE_TO_USER.md   |   71 +
 .../opts/CURLOPT_FTP_CREATE_MISSING_DIRS.3    |   83 -
 .../opts/CURLOPT_FTP_CREATE_MISSING_DIRS.md   |   91 +
 .../libcurl/opts/CURLOPT_FTP_FILEMETHOD.3     |   76 -
 .../libcurl/opts/CURLOPT_FTP_FILEMETHOD.md    |   92 +
 .../libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.3   |   69 -
 .../libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.md  |   78 +
 .../docs/libcurl/opts/CURLOPT_FTP_SSL_CCC.3   |   68 -
 .../docs/libcurl/opts/CURLOPT_FTP_SSL_CCC.md  |   85 +
 .../docs/libcurl/opts/CURLOPT_FTP_USE_EPRT.3  |   73 -
 .../docs/libcurl/opts/CURLOPT_FTP_USE_EPRT.md |   77 +
 .../docs/libcurl/opts/CURLOPT_FTP_USE_EPSV.3  |   70 -
 .../docs/libcurl/opts/CURLOPT_FTP_USE_EPSV.md |   75 +
 .../docs/libcurl/opts/CURLOPT_FTP_USE_PRET.3  |   62 -
 .../docs/libcurl/opts/CURLOPT_FTP_USE_PRET.md |   68 +
 .../libcurl/opts/CURLOPT_GSSAPI_DELEGATION.3  |   64 -
 .../libcurl/opts/CURLOPT_GSSAPI_DELEGATION.md |   72 +
 .../opts/CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS.3  |   69 -
 .../opts/CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS.md |  130 +
 .../libcurl/opts/CURLOPT_HAPROXYPROTOCOL.3    |   63 -
 .../libcurl/opts/CURLOPT_HAPROXYPROTOCOL.md   |   70 +
 .../libcurl/opts/CURLOPT_HAPROXY_CLIENT_IP.3  |   62 -
 .../libcurl/opts/CURLOPT_HAPROXY_CLIENT_IP.md |   81 +
 .../curl/docs/libcurl/opts/CURLOPT_HEADER.3   |   75 -
 .../curl/docs/libcurl/opts/CURLOPT_HEADER.md  |   84 +
 .../docs/libcurl/opts/CURLOPT_HEADERDATA.3    |   86 -
 .../docs/libcurl/opts/CURLOPT_HEADERDATA.md   |   94 +
 .../libcurl/opts/CURLOPT_HEADERFUNCTION.3     |  128 -
 .../libcurl/opts/CURLOPT_HEADERFUNCTION.md    |  140 +
 .../docs/libcurl/opts/CURLOPT_HEADEROPT.3     |   79 -
 .../docs/libcurl/opts/CURLOPT_HEADEROPT.md    |   88 +
 .../curl/docs/libcurl/opts/CURLOPT_HSTS.3     |   78 -
 .../curl/docs/libcurl/opts/CURLOPT_HSTS.md    |  105 +
 .../docs/libcurl/opts/CURLOPT_HSTSREADDATA.3  |   65 -
 .../docs/libcurl/opts/CURLOPT_HSTSREADDATA.md |   82 +
 .../libcurl/opts/CURLOPT_HSTSREADFUNCTION.3   |   88 -
 .../libcurl/opts/CURLOPT_HSTSREADFUNCTION.md  |  110 +
 .../docs/libcurl/opts/CURLOPT_HSTSWRITEDATA.3 |   65 -
 .../libcurl/opts/CURLOPT_HSTSWRITEDATA.md     |   73 +
 .../libcurl/opts/CURLOPT_HSTSWRITEFUNCTION.3  |   92 -
 .../libcurl/opts/CURLOPT_HSTSWRITEFUNCTION.md |  109 +
 .../docs/libcurl/opts/CURLOPT_HSTS_CTRL.3     |   70 -
 .../docs/libcurl/opts/CURLOPT_HSTS_CTRL.md    |   85 +
 .../libcurl/opts/CURLOPT_HTTP09_ALLOWED.3     |   62 -
 .../libcurl/opts/CURLOPT_HTTP09_ALLOWED.md    |   70 +
 .../libcurl/opts/CURLOPT_HTTP200ALIASES.3     |   72 -
 .../libcurl/opts/CURLOPT_HTTP200ALIASES.md    |   85 +
 .../curl/docs/libcurl/opts/CURLOPT_HTTPAUTH.3 |  138 -
 .../docs/libcurl/opts/CURLOPT_HTTPAUTH.md     |  168 +
 .../curl/docs/libcurl/opts/CURLOPT_HTTPGET.3  |   68 -
 .../curl/docs/libcurl/opts/CURLOPT_HTTPGET.md |   75 +
 .../docs/libcurl/opts/CURLOPT_HTTPHEADER.3    |  162 -
 .../docs/libcurl/opts/CURLOPT_HTTPHEADER.md   |  205 +
 .../curl/docs/libcurl/opts/CURLOPT_HTTPPOST.3 |   83 -
 .../docs/libcurl/opts/CURLOPT_HTTPPOST.md     |  107 +
 .../libcurl/opts/CURLOPT_HTTPPROXYTUNNEL.3    |   72 -
 .../libcurl/opts/CURLOPT_HTTPPROXYTUNNEL.md   |   79 +
 .../opts/CURLOPT_HTTP_CONTENT_DECODING.3      |   59 -
 .../opts/CURLOPT_HTTP_CONTENT_DECODING.md     |   64 +
 .../opts/CURLOPT_HTTP_TRANSFER_DECODING.3     |   58 -
 .../opts/CURLOPT_HTTP_TRANSFER_DECODING.md    |   62 +
 .../docs/libcurl/opts/CURLOPT_HTTP_VERSION.3  |  101 -
 .../docs/libcurl/opts/CURLOPT_HTTP_VERSION.md |  131 +
 .../opts/CURLOPT_IGNORE_CONTENT_LENGTH.3      |   70 -
 .../opts/CURLOPT_IGNORE_CONTENT_LENGTH.md     |   81 +
 .../docs/libcurl/opts/CURLOPT_INFILESIZE.3    |   78 -
 .../docs/libcurl/opts/CURLOPT_INFILESIZE.md   |   93 +
 .../libcurl/opts/CURLOPT_INFILESIZE_LARGE.3   |   74 -
 .../libcurl/opts/CURLOPT_INFILESIZE_LARGE.md  |   89 +
 .../docs/libcurl/opts/CURLOPT_INTERFACE.3     |   80 -
 .../docs/libcurl/opts/CURLOPT_INTERFACE.md    |   95 +
 .../libcurl/opts/CURLOPT_INTERLEAVEDATA.3     |   62 -
 .../libcurl/opts/CURLOPT_INTERLEAVEDATA.md    |   76 +
 .../libcurl/opts/CURLOPT_INTERLEAVEFUNCTION.3 |   92 -
 .../opts/CURLOPT_INTERLEAVEFUNCTION.md        |  104 +
 .../docs/libcurl/opts/CURLOPT_IOCTLDATA.3     |   64 -
 .../docs/libcurl/opts/CURLOPT_IOCTLDATA.md    |   78 +
 .../docs/libcurl/opts/CURLOPT_IOCTLFUNCTION.3 |   94 -
 .../libcurl/opts/CURLOPT_IOCTLFUNCTION.md     |  109 +
 .../docs/libcurl/opts/CURLOPT_IPRESOLVE.3     |   74 -
 .../docs/libcurl/opts/CURLOPT_IPRESOLVE.md    |   90 +
 .../docs/libcurl/opts/CURLOPT_ISSUERCERT.3    |   73 -
 .../docs/libcurl/opts/CURLOPT_ISSUERCERT.md   |   84 +
 .../libcurl/opts/CURLOPT_ISSUERCERT_BLOB.3    |   84 -
 .../libcurl/opts/CURLOPT_ISSUERCERT_BLOB.md   |   95 +
 .../opts/CURLOPT_KEEP_SENDING_ON_ERROR.3      |   65 -
 .../opts/CURLOPT_KEEP_SENDING_ON_ERROR.md     |   70 +
 .../docs/libcurl/opts/CURLOPT_KEYPASSWD.3     |   65 -
 .../docs/libcurl/opts/CURLOPT_KEYPASSWD.md    |   83 +
 .../curl/docs/libcurl/opts/CURLOPT_KRBLEVEL.3 |   63 -
 .../docs/libcurl/opts/CURLOPT_KRBLEVEL.md     |   81 +
 .../docs/libcurl/opts/CURLOPT_LOCALPORT.3     |   60 -
 .../docs/libcurl/opts/CURLOPT_LOCALPORT.md    |   66 +
 .../libcurl/opts/CURLOPT_LOCALPORTRANGE.3     |   64 -
 .../libcurl/opts/CURLOPT_LOCALPORTRANGE.md    |   69 +
 .../docs/libcurl/opts/CURLOPT_LOGIN_OPTIONS.3 |   74 -
 .../libcurl/opts/CURLOPT_LOGIN_OPTIONS.md     |   96 +
 .../libcurl/opts/CURLOPT_LOW_SPEED_LIMIT.3    |   65 -
 .../libcurl/opts/CURLOPT_LOW_SPEED_LIMIT.md   |   72 +
 .../libcurl/opts/CURLOPT_LOW_SPEED_TIME.3     |   64 -
 .../libcurl/opts/CURLOPT_LOW_SPEED_TIME.md    |   69 +
 .../docs/libcurl/opts/CURLOPT_MAIL_AUTH.3     |   73 -
 .../docs/libcurl/opts/CURLOPT_MAIL_AUTH.md    |   79 +
 .../docs/libcurl/opts/CURLOPT_MAIL_FROM.3     |   66 -
 .../docs/libcurl/opts/CURLOPT_MAIL_FROM.md    |   76 +
 .../docs/libcurl/opts/CURLOPT_MAIL_RCPT.3     |   76 -
 .../docs/libcurl/opts/CURLOPT_MAIL_RCPT.md    |   91 +
 .../opts/CURLOPT_MAIL_RCPT_ALLOWFAILS.3       |   77 -
 .../opts/CURLOPT_MAIL_RCPT_ALLOWFAILS.md      |   86 +
 .../docs/libcurl/opts/CURLOPT_MAXAGE_CONN.3   |   68 -
 .../docs/libcurl/opts/CURLOPT_MAXAGE_CONN.md  |   75 +
 .../docs/libcurl/opts/CURLOPT_MAXCONNECTS.3   |   71 -
 .../docs/libcurl/opts/CURLOPT_MAXCONNECTS.md  |   77 +
 .../docs/libcurl/opts/CURLOPT_MAXFILESIZE.3   |   64 -
 .../docs/libcurl/opts/CURLOPT_MAXFILESIZE.md  |   79 +
 .../libcurl/opts/CURLOPT_MAXFILESIZE_LARGE.3  |   64 -
 .../libcurl/opts/CURLOPT_MAXFILESIZE_LARGE.md |   79 +
 .../libcurl/opts/CURLOPT_MAXLIFETIME_CONN.3   |   70 -
 .../libcurl/opts/CURLOPT_MAXLIFETIME_CONN.md  |   79 +
 .../docs/libcurl/opts/CURLOPT_MAXREDIRS.3     |   69 -
 .../docs/libcurl/opts/CURLOPT_MAXREDIRS.md    |   76 +
 .../opts/CURLOPT_MAX_RECV_SPEED_LARGE.3       |   66 -
 .../opts/CURLOPT_MAX_RECV_SPEED_LARGE.md      |   72 +
 .../opts/CURLOPT_MAX_SEND_SPEED_LARGE.3       |   69 -
 .../opts/CURLOPT_MAX_SEND_SPEED_LARGE.md      |   74 +
 .../curl/docs/libcurl/opts/CURLOPT_MIMEPOST.3 |   74 -
 .../docs/libcurl/opts/CURLOPT_MIMEPOST.md     |   84 +
 .../docs/libcurl/opts/CURLOPT_MIME_OPTIONS.3  |   93 -
 .../docs/libcurl/opts/CURLOPT_MIME_OPTIONS.md |  107 +
 .../curl/docs/libcurl/opts/CURLOPT_NETRC.3    |  121 -
 .../curl/docs/libcurl/opts/CURLOPT_NETRC.md   |  159 +
 .../docs/libcurl/opts/CURLOPT_NETRC_FILE.3    |   63 -
 .../docs/libcurl/opts/CURLOPT_NETRC_FILE.md   |   75 +
 .../opts/CURLOPT_NEW_DIRECTORY_PERMS.3        |   59 -
 .../opts/CURLOPT_NEW_DIRECTORY_PERMS.md       |   68 +
 .../libcurl/opts/CURLOPT_NEW_FILE_PERMS.3     |   58 -
 .../libcurl/opts/CURLOPT_NEW_FILE_PERMS.md    |   64 +
 .../curl/docs/libcurl/opts/CURLOPT_NOBODY.3   |   74 -
 .../curl/docs/libcurl/opts/CURLOPT_NOBODY.md  |   82 +
 .../docs/libcurl/opts/CURLOPT_NOPROGRESS.3    |   63 -
 .../docs/libcurl/opts/CURLOPT_NOPROGRESS.md   |   69 +
 .../curl/docs/libcurl/opts/CURLOPT_NOPROXY.3  |   86 -
 .../curl/docs/libcurl/opts/CURLOPT_NOPROXY.md |  103 +
 .../curl/docs/libcurl/opts/CURLOPT_NOSIGNAL.3 |   76 -
 .../docs/libcurl/opts/CURLOPT_NOSIGNAL.md     |   78 +
 .../libcurl/opts/CURLOPT_OPENSOCKETDATA.3     |   86 -
 .../libcurl/opts/CURLOPT_OPENSOCKETDATA.md    |   93 +
 .../libcurl/opts/CURLOPT_OPENSOCKETFUNCTION.3 |  127 -
 .../opts/CURLOPT_OPENSOCKETFUNCTION.md        |  140 +
 .../curl/docs/libcurl/opts/CURLOPT_PASSWORD.3 |   67 -
 .../docs/libcurl/opts/CURLOPT_PASSWORD.md     |   75 +
 .../docs/libcurl/opts/CURLOPT_PATH_AS_IS.3    |   71 -
 .../docs/libcurl/opts/CURLOPT_PATH_AS_IS.md   |   82 +
 .../libcurl/opts/CURLOPT_PINNEDPUBLICKEY.3    |  131 -
 .../libcurl/opts/CURLOPT_PINNEDPUBLICKEY.md   |  161 +
 .../curl/docs/libcurl/opts/CURLOPT_PIPEWAIT.3 |   75 -
 .../docs/libcurl/opts/CURLOPT_PIPEWAIT.md     |   80 +
 .../curl/docs/libcurl/opts/CURLOPT_PORT.3     |   68 -
 .../curl/docs/libcurl/opts/CURLOPT_PORT.md    |   74 +
 .../curl/docs/libcurl/opts/CURLOPT_POST.3     |   98 -
 .../curl/docs/libcurl/opts/CURLOPT_POST.md    |  104 +
 .../docs/libcurl/opts/CURLOPT_POSTFIELDS.3    |  121 -
 .../docs/libcurl/opts/CURLOPT_POSTFIELDS.md   |  133 +
 .../docs/libcurl/opts/CURLOPT_POSTFIELDSIZE.3 |   67 -
 .../libcurl/opts/CURLOPT_POSTFIELDSIZE.md     |   77 +
 .../opts/CURLOPT_POSTFIELDSIZE_LARGE.3        |   67 -
 .../opts/CURLOPT_POSTFIELDSIZE_LARGE.md       |   78 +
 .../docs/libcurl/opts/CURLOPT_POSTQUOTE.3     |   69 -
 .../docs/libcurl/opts/CURLOPT_POSTQUOTE.md    |   80 +
 .../docs/libcurl/opts/CURLOPT_POSTREDIR.3     |   75 -
 .../docs/libcurl/opts/CURLOPT_POSTREDIR.md    |   95 +
 .../curl/docs/libcurl/opts/CURLOPT_PREQUOTE.3 |   73 -
 .../docs/libcurl/opts/CURLOPT_PREQUOTE.md     |   81 +
 .../docs/libcurl/opts/CURLOPT_PREREQDATA.3    |   64 -
 .../docs/libcurl/opts/CURLOPT_PREREQDATA.md   |   77 +
 .../libcurl/opts/CURLOPT_PREREQFUNCTION.3     |  105 -
 .../libcurl/opts/CURLOPT_PREREQFUNCTION.md    |  130 +
 .../docs/libcurl/opts/CURLOPT_PRE_PROXY.3     |   83 -
 .../docs/libcurl/opts/CURLOPT_PRE_PROXY.md    |   90 +
 .../curl/docs/libcurl/opts/CURLOPT_PRIVATE.3  |   65 -
 .../curl/docs/libcurl/opts/CURLOPT_PRIVATE.md |   77 +
 .../docs/libcurl/opts/CURLOPT_PROGRESSDATA.3  |   73 -
 .../docs/libcurl/opts/CURLOPT_PROGRESSDATA.md |   84 +
 .../libcurl/opts/CURLOPT_PROGRESSFUNCTION.3   |  118 -
 .../libcurl/opts/CURLOPT_PROGRESSFUNCTION.md  |  134 +
 .../docs/libcurl/opts/CURLOPT_PROTOCOLS.3     |  101 -
 .../docs/libcurl/opts/CURLOPT_PROTOCOLS.md    |  120 +
 .../docs/libcurl/opts/CURLOPT_PROTOCOLS_STR.3 |   84 -
 .../libcurl/opts/CURLOPT_PROTOCOLS_STR.md     |   96 +
 .../curl/docs/libcurl/opts/CURLOPT_PROXY.3    |  132 -
 .../curl/docs/libcurl/opts/CURLOPT_PROXY.md   |  174 +
 .../docs/libcurl/opts/CURLOPT_PROXYAUTH.3     |   73 -
 .../docs/libcurl/opts/CURLOPT_PROXYAUTH.md    |   82 +
 .../docs/libcurl/opts/CURLOPT_PROXYHEADER.3   |   77 -
 .../docs/libcurl/opts/CURLOPT_PROXYHEADER.md  |   88 +
 .../docs/libcurl/opts/CURLOPT_PROXYPASSWORD.3 |   66 -
 .../libcurl/opts/CURLOPT_PROXYPASSWORD.md     |   74 +
 .../docs/libcurl/opts/CURLOPT_PROXYPORT.3     |   61 -
 .../docs/libcurl/opts/CURLOPT_PROXYPORT.md    |   74 +
 .../docs/libcurl/opts/CURLOPT_PROXYTYPE.3     |   84 -
 .../docs/libcurl/opts/CURLOPT_PROXYTYPE.md    |  113 +
 .../docs/libcurl/opts/CURLOPT_PROXYUSERNAME.3 |   68 -
 .../libcurl/opts/CURLOPT_PROXYUSERNAME.md     |   74 +
 .../docs/libcurl/opts/CURLOPT_PROXYUSERPWD.3  |   66 -
 .../docs/libcurl/opts/CURLOPT_PROXYUSERPWD.md |   75 +
 .../docs/libcurl/opts/CURLOPT_PROXY_CAINFO.3  |   87 -
 .../docs/libcurl/opts/CURLOPT_PROXY_CAINFO.md |   96 +
 .../libcurl/opts/CURLOPT_PROXY_CAINFO_BLOB.3  |   80 -
 .../libcurl/opts/CURLOPT_PROXY_CAINFO_BLOB.md |   94 +
 .../docs/libcurl/opts/CURLOPT_PROXY_CAPATH.3  |   77 -
 .../docs/libcurl/opts/CURLOPT_PROXY_CAPATH.md |   85 +
 .../docs/libcurl/opts/CURLOPT_PROXY_CRLFILE.3 |   79 -
 .../libcurl/opts/CURLOPT_PROXY_CRLFILE.md     |   91 +
 .../libcurl/opts/CURLOPT_PROXY_ISSUERCERT.3   |   77 -
 .../libcurl/opts/CURLOPT_PROXY_ISSUERCERT.md  |   88 +
 .../opts/CURLOPT_PROXY_ISSUERCERT_BLOB.3      |   87 -
 .../opts/CURLOPT_PROXY_ISSUERCERT_BLOB.md     |   98 +
 .../libcurl/opts/CURLOPT_PROXY_KEYPASSWD.3    |   66 -
 .../libcurl/opts/CURLOPT_PROXY_KEYPASSWD.md   |   79 +
 .../opts/CURLOPT_PROXY_PINNEDPUBLICKEY.3      |  115 -
 .../opts/CURLOPT_PROXY_PINNEDPUBLICKEY.md     |  139 +
 .../libcurl/opts/CURLOPT_PROXY_SERVICE_NAME.3 |   62 -
 .../opts/CURLOPT_PROXY_SERVICE_NAME.md        |   69 +
 .../docs/libcurl/opts/CURLOPT_PROXY_SSLCERT.3 |   76 -
 .../libcurl/opts/CURLOPT_PROXY_SSLCERT.md     |   84 +
 .../libcurl/opts/CURLOPT_PROXY_SSLCERTTYPE.3  |   72 -
 .../libcurl/opts/CURLOPT_PROXY_SSLCERTTYPE.md |   81 +
 .../libcurl/opts/CURLOPT_PROXY_SSLCERT_BLOB.3 |   77 -
 .../opts/CURLOPT_PROXY_SSLCERT_BLOB.md        |   88 +
 .../docs/libcurl/opts/CURLOPT_PROXY_SSLKEY.3  |   72 -
 .../docs/libcurl/opts/CURLOPT_PROXY_SSLKEY.md |   84 +
 .../libcurl/opts/CURLOPT_PROXY_SSLKEYTYPE.3   |   65 -
 .../libcurl/opts/CURLOPT_PROXY_SSLKEYTYPE.md  |   74 +
 .../libcurl/opts/CURLOPT_PROXY_SSLKEY_BLOB.3  |   75 -
 .../libcurl/opts/CURLOPT_PROXY_SSLKEY_BLOB.md |   89 +
 .../libcurl/opts/CURLOPT_PROXY_SSLVERSION.3   |  105 -
 .../libcurl/opts/CURLOPT_PROXY_SSLVERSION.md  |  130 +
 .../opts/CURLOPT_PROXY_SSL_CIPHER_LIST.3      |   87 -
 .../opts/CURLOPT_PROXY_SSL_CIPHER_LIST.md     |  106 +
 .../libcurl/opts/CURLOPT_PROXY_SSL_OPTIONS.3  |  102 -
 .../libcurl/opts/CURLOPT_PROXY_SSL_OPTIONS.md |  132 +
 .../opts/CURLOPT_PROXY_SSL_VERIFYHOST.3       |   91 -
 .../opts/CURLOPT_PROXY_SSL_VERIFYHOST.md      |   96 +
 .../opts/CURLOPT_PROXY_SSL_VERIFYPEER.3       |   94 -
 .../opts/CURLOPT_PROXY_SSL_VERIFYPEER.md      |   98 +
 .../opts/CURLOPT_PROXY_TLS13_CIPHERS.3        |   74 -
 .../opts/CURLOPT_PROXY_TLS13_CIPHERS.md       |  101 +
 .../opts/CURLOPT_PROXY_TLSAUTH_PASSWORD.3     |   67 -
 .../opts/CURLOPT_PROXY_TLSAUTH_PASSWORD.md    |   78 +
 .../libcurl/opts/CURLOPT_PROXY_TLSAUTH_TYPE.3 |   75 -
 .../opts/CURLOPT_PROXY_TLSAUTH_TYPE.md        |   85 +
 .../opts/CURLOPT_PROXY_TLSAUTH_USERNAME.3     |   67 -
 .../opts/CURLOPT_PROXY_TLSAUTH_USERNAME.md    |   78 +
 .../opts/CURLOPT_PROXY_TRANSFER_MODE.3        |   63 -
 .../opts/CURLOPT_PROXY_TRANSFER_MODE.md       |   70 +
 .../curl/docs/libcurl/opts/CURLOPT_PUT.3      |   73 -
 .../curl/docs/libcurl/opts/CURLOPT_PUT.md     |  101 +
 .../docs/libcurl/opts/CURLOPT_QUICK_EXIT.3    |   59 -
 .../docs/libcurl/opts/CURLOPT_QUICK_EXIT.md   |   64 +
 .../curl/docs/libcurl/opts/CURLOPT_QUOTE.3    |  126 -
 .../curl/docs/libcurl/opts/CURLOPT_QUOTE.md   |  176 +
 .../docs/libcurl/opts/CURLOPT_RANDOM_FILE.3   |   65 -
 .../docs/libcurl/opts/CURLOPT_RANDOM_FILE.md  |   47 +
 .../curl/docs/libcurl/opts/CURLOPT_RANGE.3    |   80 -
 .../curl/docs/libcurl/opts/CURLOPT_RANGE.md   |  100 +
 .../curl/docs/libcurl/opts/CURLOPT_READDATA.3 |   69 -
 .../docs/libcurl/opts/CURLOPT_READDATA.md     |   82 +
 .../docs/libcurl/opts/CURLOPT_READFUNCTION.3  |  119 -
 .../docs/libcurl/opts/CURLOPT_READFUNCTION.md |  130 +
 .../libcurl/opts/CURLOPT_REDIR_PROTOCOLS.3    |  111 -
 .../libcurl/opts/CURLOPT_REDIR_PROTOCOLS.md   |  125 +
 .../opts/CURLOPT_REDIR_PROTOCOLS_STR.3        |   89 -
 .../opts/CURLOPT_REDIR_PROTOCOLS_STR.md       |   98 +
 .../curl/docs/libcurl/opts/CURLOPT_REFERER.3  |   64 -
 .../curl/docs/libcurl/opts/CURLOPT_REFERER.md |   73 +
 .../libcurl/opts/CURLOPT_REQUEST_TARGET.3     |   60 -
 .../libcurl/opts/CURLOPT_REQUEST_TARGET.md    |   77 +
 .../curl/docs/libcurl/opts/CURLOPT_RESOLVE.3  |  112 -
 .../curl/docs/libcurl/opts/CURLOPT_RESOLVE.md |  133 +
 .../opts/CURLOPT_RESOLVER_START_DATA.3        |   68 -
 .../opts/CURLOPT_RESOLVER_START_DATA.md       |   73 +
 .../opts/CURLOPT_RESOLVER_START_FUNCTION.3    |   85 -
 .../opts/CURLOPT_RESOLVER_START_FUNCTION.md   |   91 +
 .../docs/libcurl/opts/CURLOPT_RESUME_FROM.3   |   76 -
 .../docs/libcurl/opts/CURLOPT_RESUME_FROM.md  |   84 +
 .../libcurl/opts/CURLOPT_RESUME_FROM_LARGE.3  |   76 -
 .../libcurl/opts/CURLOPT_RESUME_FROM_LARGE.md |   83 +
 .../libcurl/opts/CURLOPT_RTSP_CLIENT_CSEQ.3   |   57 -
 .../libcurl/opts/CURLOPT_RTSP_CLIENT_CSEQ.md  |   64 +
 .../docs/libcurl/opts/CURLOPT_RTSP_REQUEST.3  |  117 -
 .../docs/libcurl/opts/CURLOPT_RTSP_REQUEST.md |  146 +
 .../libcurl/opts/CURLOPT_RTSP_SERVER_CSEQ.3   |   57 -
 .../libcurl/opts/CURLOPT_RTSP_SERVER_CSEQ.md  |   63 +
 .../libcurl/opts/CURLOPT_RTSP_SESSION_ID.3    |   64 -
 .../libcurl/opts/CURLOPT_RTSP_SESSION_ID.md   |   75 +
 .../libcurl/opts/CURLOPT_RTSP_STREAM_URI.3    |   70 -
 .../libcurl/opts/CURLOPT_RTSP_STREAM_URI.md   |   76 +
 .../libcurl/opts/CURLOPT_RTSP_TRANSPORT.3     |   64 -
 .../libcurl/opts/CURLOPT_RTSP_TRANSPORT.md    |   74 +
 .../docs/libcurl/opts/CURLOPT_SASL_AUTHZID.3  |   68 -
 .../docs/libcurl/opts/CURLOPT_SASL_AUTHZID.md |   80 +
 .../curl/docs/libcurl/opts/CURLOPT_SASL_IR.3  |   68 -
 .../curl/docs/libcurl/opts/CURLOPT_SASL_IR.md |   75 +
 .../curl/docs/libcurl/opts/CURLOPT_SEEKDATA.3 |   60 -
 .../docs/libcurl/opts/CURLOPT_SEEKDATA.md     |   71 +
 .../docs/libcurl/opts/CURLOPT_SEEKFUNCTION.3  |   91 -
 .../docs/libcurl/opts/CURLOPT_SEEKFUNCTION.md |  106 +
 .../opts/CURLOPT_SERVER_RESPONSE_TIMEOUT.3    |   72 -
 .../opts/CURLOPT_SERVER_RESPONSE_TIMEOUT.md   |   79 +
 .../CURLOPT_SERVER_RESPONSE_TIMEOUT_MS.md     |   80 +
 .../docs/libcurl/opts/CURLOPT_SERVICE_NAME.3  |   63 -
 .../docs/libcurl/opts/CURLOPT_SERVICE_NAME.md |   74 +
 .../curl/docs/libcurl/opts/CURLOPT_SHARE.3    |   85 -
 .../curl/docs/libcurl/opts/CURLOPT_SHARE.md   |   92 +
 .../docs/libcurl/opts/CURLOPT_SOCKOPTDATA.3   |   71 -
 .../docs/libcurl/opts/CURLOPT_SOCKOPTDATA.md  |   74 +
 .../libcurl/opts/CURLOPT_SOCKOPTFUNCTION.3    |  125 -
 .../libcurl/opts/CURLOPT_SOCKOPTFUNCTION.md   |  134 +
 .../docs/libcurl/opts/CURLOPT_SOCKS5_AUTH.3   |   67 -
 .../docs/libcurl/opts/CURLOPT_SOCKS5_AUTH.md  |   86 +
 .../libcurl/opts/CURLOPT_SOCKS5_GSSAPI_NEC.3  |   60 -
 .../libcurl/opts/CURLOPT_SOCKS5_GSSAPI_NEC.md |   65 +
 .../opts/CURLOPT_SOCKS5_GSSAPI_SERVICE.3      |   65 -
 .../opts/CURLOPT_SOCKS5_GSSAPI_SERVICE.md     |   73 +
 .../libcurl/opts/CURLOPT_SSH_AUTH_TYPES.3     |   63 -
 .../libcurl/opts/CURLOPT_SSH_AUTH_TYPES.md    |   75 +
 .../libcurl/opts/CURLOPT_SSH_COMPRESSION.3    |   62 -
 .../libcurl/opts/CURLOPT_SSH_COMPRESSION.md   |   68 +
 .../libcurl/opts/CURLOPT_SSH_HOSTKEYDATA.3    |   65 -
 .../libcurl/opts/CURLOPT_SSH_HOSTKEYDATA.md   |   82 +
 .../opts/CURLOPT_SSH_HOSTKEYFUNCTION.3        |   87 -
 .../opts/CURLOPT_SSH_HOSTKEYFUNCTION.md       |  110 +
 .../opts/CURLOPT_SSH_HOST_PUBLIC_KEY_MD5.3    |   66 -
 .../opts/CURLOPT_SSH_HOST_PUBLIC_KEY_MD5.md   |   90 +
 .../opts/CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256.3 |   61 -
 .../CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256.md     |   83 +
 .../docs/libcurl/opts/CURLOPT_SSH_KEYDATA.3   |   67 -
 .../docs/libcurl/opts/CURLOPT_SSH_KEYDATA.md  |   80 +
 .../libcurl/opts/CURLOPT_SSH_KEYFUNCTION.3    |  132 -
 .../libcurl/opts/CURLOPT_SSH_KEYFUNCTION.md   |  157 +
 .../libcurl/opts/CURLOPT_SSH_KNOWNHOSTS.3     |   65 -
 .../libcurl/opts/CURLOPT_SSH_KNOWNHOSTS.md    |   90 +
 .../opts/CURLOPT_SSH_PRIVATE_KEYFILE.3        |   67 -
 .../opts/CURLOPT_SSH_PRIVATE_KEYFILE.md       |   78 +
 .../libcurl/opts/CURLOPT_SSH_PUBLIC_KEYFILE.3 |   67 -
 .../opts/CURLOPT_SSH_PUBLIC_KEYFILE.md        |   77 +
 .../curl/docs/libcurl/opts/CURLOPT_SSLCERT.3  |   84 -
 .../curl/docs/libcurl/opts/CURLOPT_SSLCERT.md |   87 +
 .../docs/libcurl/opts/CURLOPT_SSLCERTTYPE.3   |   68 -
 .../docs/libcurl/opts/CURLOPT_SSLCERTTYPE.md  |   80 +
 .../docs/libcurl/opts/CURLOPT_SSLCERT_BLOB.3  |   75 -
 .../docs/libcurl/opts/CURLOPT_SSLCERT_BLOB.md |   87 +
 .../docs/libcurl/opts/CURLOPT_SSLENGINE.3     |   70 -
 .../docs/libcurl/opts/CURLOPT_SSLENGINE.md    |   83 +
 .../libcurl/opts/CURLOPT_SSLENGINE_DEFAULT.3  |   67 -
 .../libcurl/opts/CURLOPT_SSLENGINE_DEFAULT.md |   71 +
 .../curl/docs/libcurl/opts/CURLOPT_SSLKEY.3   |   67 -
 .../curl/docs/libcurl/opts/CURLOPT_SSLKEY.md  |   81 +
 .../docs/libcurl/opts/CURLOPT_SSLKEYTYPE.3    |   68 -
 .../docs/libcurl/opts/CURLOPT_SSLKEYTYPE.md   |   85 +
 .../docs/libcurl/opts/CURLOPT_SSLKEY_BLOB.3   |   77 -
 .../docs/libcurl/opts/CURLOPT_SSLKEY_BLOB.md  |   91 +
 .../docs/libcurl/opts/CURLOPT_SSLVERSION.3    |  119 -
 .../docs/libcurl/opts/CURLOPT_SSLVERSION.md   |  155 +
 .../libcurl/opts/CURLOPT_SSL_CIPHER_LIST.3    |   88 -
 .../libcurl/opts/CURLOPT_SSL_CIPHER_LIST.md   |  111 +
 .../docs/libcurl/opts/CURLOPT_SSL_CTX_DATA.3  |  125 -
 .../docs/libcurl/opts/CURLOPT_SSL_CTX_DATA.md |  130 +
 .../libcurl/opts/CURLOPT_SSL_CTX_FUNCTION.3   |  167 -
 .../libcurl/opts/CURLOPT_SSL_CTX_FUNCTION.md  |  184 +
 .../docs/libcurl/opts/CURLOPT_SSL_EC_CURVES.3 |   58 -
 .../libcurl/opts/CURLOPT_SSL_EC_CURVES.md     |   72 +
 .../libcurl/opts/CURLOPT_SSL_ENABLE_ALPN.3    |   57 -
 .../libcurl/opts/CURLOPT_SSL_ENABLE_ALPN.md   |   64 +
 .../libcurl/opts/CURLOPT_SSL_ENABLE_NPN.3     |   59 -
 .../libcurl/opts/CURLOPT_SSL_ENABLE_NPN.md    |   70 +
 .../libcurl/opts/CURLOPT_SSL_FALSESTART.3     |   61 -
 .../libcurl/opts/CURLOPT_SSL_FALSESTART.md    |   70 +
 .../docs/libcurl/opts/CURLOPT_SSL_OPTIONS.3   |   99 -
 .../docs/libcurl/opts/CURLOPT_SSL_OPTIONS.md  |  145 +
 .../opts/CURLOPT_SSL_SESSIONID_CACHE.3        |   60 -
 .../opts/CURLOPT_SSL_SESSIONID_CACHE.md       |   70 +
 .../opts/CURLOPT_SSL_SIGNATURE_ALGORITHMS.md  |   84 +
 .../libcurl/opts/CURLOPT_SSL_VERIFYHOST.3     |  110 -
 .../libcurl/opts/CURLOPT_SSL_VERIFYHOST.md    |  120 +
 .../libcurl/opts/CURLOPT_SSL_VERIFYPEER.3     |   97 -
 .../libcurl/opts/CURLOPT_SSL_VERIFYPEER.md    |  104 +
 .../libcurl/opts/CURLOPT_SSL_VERIFYSTATUS.3   |   66 -
 .../libcurl/opts/CURLOPT_SSL_VERIFYSTATUS.md  |   71 +
 .../curl/docs/libcurl/opts/CURLOPT_STDERR.3   |   63 -
 .../curl/docs/libcurl/opts/CURLOPT_STDERR.md  |   73 +
 .../libcurl/opts/CURLOPT_STREAM_DEPENDS.3     |   73 -
 .../libcurl/opts/CURLOPT_STREAM_DEPENDS.md    |   87 +
 .../libcurl/opts/CURLOPT_STREAM_DEPENDS_E.3   |   76 -
 .../libcurl/opts/CURLOPT_STREAM_DEPENDS_E.md  |   90 +
 .../docs/libcurl/opts/CURLOPT_STREAM_WEIGHT.3 |   78 -
 .../libcurl/opts/CURLOPT_STREAM_WEIGHT.md     |   82 +
 .../opts/CURLOPT_SUPPRESS_CONNECT_HEADERS.3   |   97 -
 .../opts/CURLOPT_SUPPRESS_CONNECT_HEADERS.md  |  103 +
 .../docs/libcurl/opts/CURLOPT_TCP_FASTOPEN.3  |   63 -
 .../docs/libcurl/opts/CURLOPT_TCP_FASTOPEN.md |   70 +
 .../docs/libcurl/opts/CURLOPT_TCP_KEEPALIVE.3 |   67 -
 .../libcurl/opts/CURLOPT_TCP_KEEPALIVE.md     |   79 +
 .../docs/libcurl/opts/CURLOPT_TCP_KEEPCNT.md  |   79 +
 .../docs/libcurl/opts/CURLOPT_TCP_KEEPIDLE.3  |   68 -
 .../docs/libcurl/opts/CURLOPT_TCP_KEEPIDLE.md |   78 +
 .../docs/libcurl/opts/CURLOPT_TCP_KEEPINTVL.3 |   67 -
 .../libcurl/opts/CURLOPT_TCP_KEEPINTVL.md     |   77 +
 .../docs/libcurl/opts/CURLOPT_TCP_NODELAY.3   |   68 -
 .../docs/libcurl/opts/CURLOPT_TCP_NODELAY.md  |   78 +
 .../docs/libcurl/opts/CURLOPT_TELNETOPTIONS.3 |   63 -
 .../libcurl/opts/CURLOPT_TELNETOPTIONS.md     |   74 +
 .../docs/libcurl/opts/CURLOPT_TFTP_BLKSIZE.3  |   61 -
 .../docs/libcurl/opts/CURLOPT_TFTP_BLKSIZE.md |   65 +
 .../libcurl/opts/CURLOPT_TFTP_NO_OPTIONS.3    |   77 -
 .../libcurl/opts/CURLOPT_TFTP_NO_OPTIONS.md   |   81 +
 .../docs/libcurl/opts/CURLOPT_TIMECONDITION.3 |   70 -
 .../libcurl/opts/CURLOPT_TIMECONDITION.md     |   82 +
 .../curl/docs/libcurl/opts/CURLOPT_TIMEOUT.3  |   87 -
 .../curl/docs/libcurl/opts/CURLOPT_TIMEOUT.md |   93 +
 .../docs/libcurl/opts/CURLOPT_TIMEOUT_MS.3    |   61 -
 .../docs/libcurl/opts/CURLOPT_TIMEOUT_MS.md   |   68 +
 .../docs/libcurl/opts/CURLOPT_TIMEVALUE.3     |   67 -
 .../docs/libcurl/opts/CURLOPT_TIMEVALUE.md    |   78 +
 .../libcurl/opts/CURLOPT_TIMEVALUE_LARGE.3    |   69 -
 .../libcurl/opts/CURLOPT_TIMEVALUE_LARGE.md   |   80 +
 .../docs/libcurl/opts/CURLOPT_TLS13_CIPHERS.3 |   74 -
 .../libcurl/opts/CURLOPT_TLS13_CIPHERS.md     |  101 +
 .../libcurl/opts/CURLOPT_TLSAUTH_PASSWORD.3   |   66 -
 .../libcurl/opts/CURLOPT_TLSAUTH_PASSWORD.md  |   77 +
 .../docs/libcurl/opts/CURLOPT_TLSAUTH_TYPE.3  |   71 -
 .../docs/libcurl/opts/CURLOPT_TLSAUTH_TYPE.md |   81 +
 .../libcurl/opts/CURLOPT_TLSAUTH_USERNAME.3   |   66 -
 .../libcurl/opts/CURLOPT_TLSAUTH_USERNAME.md  |   76 +
 .../docs/libcurl/opts/CURLOPT_TRAILERDATA.3   |   55 -
 .../docs/libcurl/opts/CURLOPT_TRAILERDATA.md  |   61 +
 .../libcurl/opts/CURLOPT_TRAILERFUNCTION.3    |  108 -
 .../libcurl/opts/CURLOPT_TRAILERFUNCTION.md   |  116 +
 .../docs/libcurl/opts/CURLOPT_TRANSFERTEXT.3  |   63 -
 .../docs/libcurl/opts/CURLOPT_TRANSFERTEXT.md |   67 +
 .../libcurl/opts/CURLOPT_TRANSFER_ENCODING.3  |   66 -
 .../libcurl/opts/CURLOPT_TRANSFER_ENCODING.md |   72 +
 .../libcurl/opts/CURLOPT_UNIX_SOCKET_PATH.3   |   83 -
 .../libcurl/opts/CURLOPT_UNIX_SOCKET_PATH.md  |   93 +
 .../libcurl/opts/CURLOPT_UNRESTRICTED_AUTH.3  |   75 -
 .../libcurl/opts/CURLOPT_UNRESTRICTED_AUTH.md |   89 +
 .../libcurl/opts/CURLOPT_UPKEEP_INTERVAL_MS.3 |   82 -
 .../opts/CURLOPT_UPKEEP_INTERVAL_MS.md        |   85 +
 .../curl/docs/libcurl/opts/CURLOPT_UPLOAD.3   |   82 -
 .../curl/docs/libcurl/opts/CURLOPT_UPLOAD.md  |  101 +
 .../libcurl/opts/CURLOPT_UPLOAD_BUFFERSIZE.3  |   76 -
 .../libcurl/opts/CURLOPT_UPLOAD_BUFFERSIZE.md |   82 +
 .../docs/libcurl/opts/CURLOPT_UPLOAD_FLAGS.md |  129 +
 .../curl/docs/libcurl/opts/CURLOPT_URL.3      |  138 -
 .../curl/docs/libcurl/opts/CURLOPT_URL.md     |  149 +
 .../docs/libcurl/opts/CURLOPT_USERAGENT.3     |   62 -
 .../docs/libcurl/opts/CURLOPT_USERAGENT.md    |   72 +
 .../curl/docs/libcurl/opts/CURLOPT_USERNAME.3 |   87 -
 .../docs/libcurl/opts/CURLOPT_USERNAME.md     |   92 +
 .../curl/docs/libcurl/opts/CURLOPT_USERPWD.3  |   95 -
 .../curl/docs/libcurl/opts/CURLOPT_USERPWD.md |  101 +
 .../curl/docs/libcurl/opts/CURLOPT_USE_SSL.3  |   76 -
 .../curl/docs/libcurl/opts/CURLOPT_USE_SSL.md |  106 +
 .../curl/docs/libcurl/opts/CURLOPT_VERBOSE.3  |   69 -
 .../curl/docs/libcurl/opts/CURLOPT_VERBOSE.md |   78 +
 .../docs/libcurl/opts/CURLOPT_WILDCARDMATCH.3 |  108 -
 .../libcurl/opts/CURLOPT_WILDCARDMATCH.md     |  113 +
 .../docs/libcurl/opts/CURLOPT_WRITEDATA.3     |   64 -
 .../docs/libcurl/opts/CURLOPT_WRITEDATA.md    |   66 +
 .../docs/libcurl/opts/CURLOPT_WRITEFUNCTION.3 |  132 -
 .../libcurl/opts/CURLOPT_WRITEFUNCTION.md     |  140 +
 .../docs/libcurl/opts/CURLOPT_WS_OPTIONS.3    |   69 -
 .../docs/libcurl/opts/CURLOPT_WS_OPTIONS.md   |   90 +
 .../docs/libcurl/opts/CURLOPT_XFERINFODATA.3  |   75 -
 .../docs/libcurl/opts/CURLOPT_XFERINFODATA.md |   82 +
 .../libcurl/opts/CURLOPT_XFERINFOFUNCTION.3   |  114 -
 .../libcurl/opts/CURLOPT_XFERINFOFUNCTION.md  |  126 +
 .../libcurl/opts/CURLOPT_XOAUTH2_BEARER.3     |   64 -
 .../libcurl/opts/CURLOPT_XOAUTH2_BEARER.md    |   79 +
 .../docs/libcurl/opts/CURLSHOPT_LOCKFUNC.3    |   72 -
 .../docs/libcurl/opts/CURLSHOPT_LOCKFUNC.md   |   76 +
 .../curl/docs/libcurl/opts/CURLSHOPT_SHARE.3  |  103 -
 .../curl/docs/libcurl/opts/CURLSHOPT_SHARE.md |  119 +
 .../docs/libcurl/opts/CURLSHOPT_UNLOCKFUNC.3  |   68 -
 .../docs/libcurl/opts/CURLSHOPT_UNLOCKFUNC.md |   71 +
 .../docs/libcurl/opts/CURLSHOPT_UNSHARE.3     |   72 -
 .../docs/libcurl/opts/CURLSHOPT_UNSHARE.md    |   83 +
 .../docs/libcurl/opts/CURLSHOPT_USERDATA.3    |   56 -
 .../docs/libcurl/opts/CURLSHOPT_USERDATA.md   |   61 +
 .../curl/docs/libcurl/opts/Makefile.am        |   46 +-
 .../curl/docs/libcurl/opts/Makefile.inc       |   29 +-
 third-party/curl/docs/libcurl/opts/template.3 |   40 -
 .../curl/docs/libcurl/symbols-in-versions     |  134 +-
 third-party/curl/docs/libcurl/symbols.pl      |   16 +-
 third-party/curl/docs/mk-ca-bundle.1          |  120 -
 third-party/curl/docs/mk-ca-bundle.md         |  125 +
 third-party/curl/docs/options-in-versions     |   25 +-
 third-party/curl/docs/runtests.md             |  320 +
 third-party/curl/docs/testcurl.md             |  138 +
 third-party/curl/docs/tests/CI.md             |   92 +
 third-party/curl/docs/tests/FILEFORMAT.md     |  823 ++
 third-party/curl/docs/tests/HTTP.md           |  206 +
 third-party/curl/docs/tests/TEST-SUITE.md     |  323 +
 third-party/curl/docs/wcurl.md                |  154 +
 third-party/curl/include/README.md            |    2 +-
 third-party/curl/include/curl/.gitignore      |    7 -
 third-party/curl/include/curl/Makefile.am     |    6 +-
 third-party/curl/include/curl/curl.h          | 1080 +--
 third-party/curl/include/curl/curlver.h       |   17 +-
 third-party/curl/include/curl/easy.h          |   14 +-
 third-party/curl/include/curl/header.h        |   20 +-
 third-party/curl/include/curl/mprintf.h       |   31 +-
 third-party/curl/include/curl/multi.h         |  290 +-
 third-party/curl/include/curl/options.h       |    4 +-
 third-party/curl/include/curl/system.h        |  274 +-
 third-party/curl/include/curl/typecheck-gcc.h | 1147 +--
 third-party/curl/include/curl/urlapi.h        |   57 +-
 third-party/curl/include/curl/websockets.h    |   36 +-
 third-party/curl/lib/.checksrc                |    1 -
 third-party/curl/lib/.gitattributes           |    3 -
 third-party/curl/lib/.gitignore               |   13 +-
 third-party/curl/lib/CMakeLists.txt           |  346 +-
 third-party/curl/lib/Makefile.am              |   98 +-
 third-party/curl/lib/Makefile.inc             |  226 +-
 third-party/curl/lib/Makefile.mk              |  421 --
 third-party/curl/lib/Makefile.soname          |    7 +-
 third-party/curl/lib/altsvc.c                 |  711 +-
 third-party/curl/lib/altsvc.h                 |   29 +-
 third-party/curl/lib/amigaos.c                |   46 +-
 third-party/curl/lib/amigaos.h                |    2 +-
 third-party/curl/lib/arpa_telnet.h            |   46 +-
 third-party/curl/lib/asyn-ares.c              | 1183 ++-
 third-party/curl/lib/asyn-base.c              |  265 +
 third-party/curl/lib/asyn-thrdd.c             |  838 +++
 third-party/curl/lib/asyn-thread.c            |  760 --
 third-party/curl/lib/asyn.h                   |  329 +-
 third-party/curl/lib/base64.c                 |  292 -
 third-party/curl/lib/bufq.c                   |  339 +-
 third-party/curl/lib/bufq.h                   |  114 +-
 third-party/curl/lib/bufref.c                 |   35 +-
 third-party/curl/lib/bufref.h                 |    9 +-
 third-party/curl/lib/c-hyper.c                | 1281 ----
 third-party/curl/lib/c-hyper.h                |   59 -
 third-party/curl/lib/cf-dns.c                 |  596 ++
 third-party/curl/lib/cf-dns.h                 |   79 +
 third-party/curl/lib/cf-h1-proxy.c            | 1235 ++-
 third-party/curl/lib/cf-h1-proxy.h            |   11 +-
 third-party/curl/lib/cf-h2-proxy.c            | 1264 ++--
 third-party/curl/lib/cf-h2-proxy.h            |    8 +-
 third-party/curl/lib/cf-haproxy.c             |  150 +-
 third-party/curl/lib/cf-haproxy.h             |    4 +-
 third-party/curl/lib/cf-https-connect.c       |  751 +-
 third-party/curl/lib/cf-https-connect.h       |   22 +-
 third-party/curl/lib/cf-ip-happy.c            | 1054 +++
 third-party/curl/lib/cf-ip-happy.h            |   73 +
 third-party/curl/lib/cf-recvbuf.c             |  157 +
 third-party/curl/lib/cf-recvbuf.h             |   40 +
 third-party/curl/lib/cf-setup.c               |  476 ++
 third-party/curl/lib/cf-setup.h               |   46 +
 third-party/curl/lib/cf-socket.c              | 2149 +++---
 third-party/curl/lib/cf-socket.h              |  121 +-
 third-party/curl/lib/cfilters.c               |  977 ++-
 third-party/curl/lib/cfilters.h               |  468 +-
 third-party/curl/lib/config-amigaos.h         |  135 -
 third-party/curl/lib/config-dos.h             |  142 -
 third-party/curl/lib/config-mac.h             |   33 +-
 third-party/curl/lib/config-os400.h           |  532 +-
 third-party/curl/lib/config-plan9.h           |  156 -
 third-party/curl/lib/config-riscos.h          |  164 +-
 third-party/curl/lib/config-win32.h           |  451 +-
 third-party/curl/lib/config-win32ce.h         |  325 -
 third-party/curl/lib/conncache.c              | 1186 +--
 third-party/curl/lib/conncache.h              |  199 +-
 third-party/curl/lib/connect.c                | 1654 +---
 third-party/curl/lib/connect.h                |  128 +-
 third-party/curl/lib/content_encoding.c       | 1048 +--
 third-party/curl/lib/content_encoding.h       |   28 +-
 third-party/curl/lib/cookie.c                 | 2131 +++---
 third-party/curl/lib/cookie.h                 |  105 +-
 third-party/curl/lib/creds.c                  |  189 +
 third-party/curl/lib/creds.h                  |   91 +
 third-party/curl/lib/cshutdn.c                |  534 ++
 third-party/curl/lib/cshutdn.h                |  106 +
 third-party/curl/lib/curl_addrinfo.c          |  388 +-
 third-party/curl/lib/curl_addrinfo.h          |   60 +-
 third-party/curl/lib/curl_base64.h            |   41 -
 third-party/curl/lib/curl_config-cmake.h.in   |  801 ++
 third-party/curl/lib/curl_config.h.cmake      |  794 --
 third-party/curl/lib/curl_ctype.h             |   17 +-
 third-party/curl/lib/curl_des.c               |   69 -
 third-party/curl/lib/curl_des.h               |   40 -
 third-party/curl/lib/curl_endian.c            |   13 +-
 third-party/curl/lib/curl_fnmatch.c           |   75 +-
 third-party/curl/lib/curl_fnmatch.h           |    3 +-
 third-party/curl/lib/curl_fopen.c             |  165 +
 third-party/curl/lib/curl_fopen.h             |   31 +
 third-party/curl/lib/curl_get_line.c          |   75 +-
 third-party/curl/lib/curl_get_line.h          |    6 +-
 third-party/curl/lib/curl_gethostname.c       |   36 +-
 third-party/curl/lib/curl_gssapi.c            |  359 +-
 third-party/curl/lib/curl_gssapi.h            |   41 +-
 third-party/curl/lib/curl_hmac.h              |   50 +-
 third-party/curl/lib/curl_krb5.h              |   52 -
 third-party/curl/lib/curl_ldap.h              |   10 +-
 third-party/curl/lib/curl_md4.h               |    6 +-
 third-party/curl/lib/curl_md5.h               |   36 +-
 third-party/curl/lib/curl_memory.h            |  178 -
 third-party/curl/lib/curl_memrchr.c           |   15 +-
 third-party/curl/lib/curl_memrchr.h           |    8 +-
 third-party/curl/lib/curl_multibyte.c         |  179 -
 third-party/curl/lib/curl_multibyte.h         |   91 -
 third-party/curl/lib/curl_ntlm_core.c         |  451 +-
 third-party/curl/lib/curl_ntlm_core.h         |   32 +-
 third-party/curl/lib/curl_ntlm_wb.c           |  500 --
 third-party/curl/lib/curl_ntlm_wb.h           |   45 -
 third-party/curl/lib/curl_path.c              |  199 -
 third-party/curl/lib/curl_path.h              |   49 -
 third-party/curl/lib/curl_printf.h            |   30 +-
 third-party/curl/lib/curl_range.c             |   59 +-
 third-party/curl/lib/curl_range.h             |    2 +-
 third-party/curl/lib/curl_rtmp.c              |  338 -
 third-party/curl/lib/curl_rtmp.h              |   35 -
 third-party/curl/lib/curl_sasl.c              |  738 +-
 third-party/curl/lib/curl_sasl.h              |   15 +-
 third-party/curl/lib/curl_setup.h             | 1486 +++-
 third-party/curl/lib/curl_setup_once.h        |  422 --
 third-party/curl/lib/curl_sha256.h            |   21 +-
 third-party/curl/lib/curl_sha512_256.c        |  847 +++
 third-party/curl/lib/curl_sha512_256.h        |   43 +
 third-party/curl/lib/curl_share.c             |  472 ++
 third-party/curl/lib/curl_share.h             |   92 +
 third-party/curl/lib/curl_sspi.c              |  132 +-
 third-party/curl/lib/curl_sspi.h              |  290 +-
 third-party/curl/lib/curl_threads.c           |  187 +-
 third-party/curl/lib/curl_threads.h           |   43 +-
 third-party/curl/lib/curl_trc.c               |  763 +-
 third-party/curl/lib/curl_trc.h               |  340 +-
 third-party/curl/lib/curlx.h                  |  118 -
 third-party/curl/lib/curlx/base64.c           |  267 +
 third-party/curl/lib/curlx/base64.h           |   40 +
 third-party/curl/lib/curlx/basename.c         |   74 +
 third-party/curl/lib/curlx/basename.h         |   39 +
 third-party/curl/lib/curlx/dynbuf.c           |  292 +
 third-party/curl/lib/curlx/dynbuf.h           |   83 +
 third-party/curl/lib/curlx/fopen.c            |  508 ++
 third-party/curl/lib/curlx/fopen.h            |   87 +
 third-party/curl/lib/curlx/inet_ntop.c        |  222 +
 third-party/curl/lib/curlx/inet_ntop.h        |   50 +
 third-party/curl/lib/curlx/inet_pton.c        |  221 +
 third-party/curl/lib/{ => curlx}/inet_pton.h  |   22 +-
 third-party/curl/lib/curlx/multibyte.c        |   78 +
 third-party/curl/lib/curlx/multibyte.h        |   73 +
 third-party/curl/lib/{ => curlx}/nonblock.c   |   38 +-
 third-party/curl/lib/{ => curlx}/nonblock.h   |    2 -
 third-party/curl/lib/curlx/snprintf.c         |   49 +
 third-party/curl/lib/curlx/snprintf.h         |   45 +
 third-party/curl/lib/curlx/strcopy.c          |   50 +
 third-party/curl/lib/curlx/strcopy.h          |   32 +
 third-party/curl/lib/curlx/strdup.c           |  125 +
 third-party/curl/lib/{ => curlx}/strdup.h     |   18 +-
 third-party/curl/lib/curlx/strerr.c           |  329 +
 third-party/curl/lib/curlx/strerr.h           |   29 +
 third-party/curl/lib/curlx/strparse.c         |  317 +
 third-party/curl/lib/curlx/strparse.h         |  114 +
 third-party/curl/lib/{ => curlx}/timediff.c   |   11 +-
 third-party/curl/lib/{ => curlx}/timediff.h   |    5 +-
 third-party/curl/lib/curlx/timeval.c          |  273 +
 third-party/curl/lib/curlx/timeval.h          |   74 +
 third-party/curl/lib/curlx/version_win32.c    |  238 +
 .../curl/lib/{ => curlx}/version_win32.h      |   12 +-
 third-party/curl/lib/curlx/wait.c             |   94 +
 third-party/curl/lib/curlx/wait.h             |   30 +
 third-party/curl/lib/curlx/warnless.c         |  341 +
 third-party/curl/lib/curlx/warnless.h         |   74 +
 third-party/curl/lib/curlx/winapi.c           |  106 +
 third-party/curl/lib/curlx/winapi.h           |   33 +
 third-party/curl/lib/cw-out.c                 |  522 ++
 third-party/curl/lib/cw-out.h                 |   52 +
 third-party/curl/lib/cw-pause.c               |  227 +
 third-party/curl/lib/cw-pause.h               |   38 +
 third-party/curl/lib/dict.c                   |  157 +-
 third-party/curl/lib/dict.h                   |    3 +-
 third-party/curl/lib/dllmain.c                |   64 +
 third-party/curl/lib/dnscache.c               |  859 +++
 third-party/curl/lib/dnscache.h               |  138 +
 third-party/curl/lib/doh.c                    | 1179 ++-
 third-party/curl/lib/doh.h                    |  164 +-
 third-party/curl/lib/dynbuf.c                 |  275 -
 third-party/curl/lib/dynbuf.h                 |   92 -
 third-party/curl/lib/dynhds.c                 |  241 +-
 third-party/curl/lib/dynhds.h                 |   69 +-
 third-party/curl/lib/easy.c                   |  913 +--
 third-party/curl/lib/easy_lock.h              |   53 +-
 third-party/curl/lib/easygetopt.c             |   27 +-
 third-party/curl/lib/easyif.h                 |    7 +-
 third-party/curl/lib/easyoptions.c            |  688 +-
 third-party/curl/lib/easyoptions.h            |    8 +-
 third-party/curl/lib/escape.c                 |  161 +-
 third-party/curl/lib/escape.h                 |   10 +-
 third-party/curl/lib/fake_addrinfo.c          |  202 +
 third-party/curl/lib/fake_addrinfo.h          |   53 +
 third-party/curl/lib/file.c                   |  478 +-
 third-party/curl/lib/file.h                   |   14 +-
 third-party/curl/lib/fileinfo.c               |   16 +-
 third-party/curl/lib/fileinfo.h               |    6 +-
 third-party/curl/lib/fopen.c                  |  112 -
 third-party/curl/lib/fopen.h                  |   30 -
 third-party/curl/lib/formdata.c               |  873 +--
 third-party/curl/lib/formdata.h               |   32 +-
 third-party/curl/lib/ftp-int.h                |  160 +
 third-party/curl/lib/ftp.c                    | 5015 ++++++------
 third-party/curl/lib/ftp.h                    |  129 +-
 third-party/curl/lib/ftplistparser.c          | 1338 ++--
 third-party/curl/lib/ftplistparser.h          |   10 +-
 third-party/curl/lib/functypes.h              |   15 +-
 third-party/curl/lib/getenv.c                 |   32 +-
 third-party/curl/lib/getinfo.c                |  296 +-
 third-party/curl/lib/getinfo.h                |    2 +-
 third-party/curl/lib/gopher.c                 |  191 +-
 third-party/curl/lib/gopher.h                 |    7 +-
 third-party/curl/lib/hash.c                   |  390 +-
 third-party/curl/lib/hash.h                   |   77 +-
 third-party/curl/lib/headers.c                |  291 +-
 third-party/curl/lib/headers.h                |   18 +-
 third-party/curl/lib/hmac.c                   |  117 +-
 third-party/curl/lib/hostasyn.c               |  123 -
 third-party/curl/lib/hostip.c                 | 1765 ++---
 third-party/curl/lib/hostip.h                 |  288 +-
 third-party/curl/lib/hostip4.c                |  116 +-
 third-party/curl/lib/hostip6.c                |   74 +-
 third-party/curl/lib/hostsyn.c                |  104 -
 third-party/curl/lib/hsts.c                   |  521 +-
 third-party/curl/lib/hsts.h                   |   33 +-
 third-party/curl/lib/http.c                   | 6703 +++++++++--------
 third-party/curl/lib/http.h                   |  221 +-
 third-party/curl/lib/http1.c                  |  187 +-
 third-party/curl/lib/http1.h                  |   16 +-
 third-party/curl/lib/http2.c                  | 2861 +++----
 third-party/curl/lib/http2.h                  |   35 +-
 third-party/curl/lib/http_aws_sigv4.c         | 1238 ++-
 third-party/curl/lib/http_aws_sigv4.h         |    7 +-
 third-party/curl/lib/http_chunks.c            |  633 +-
 third-party/curl/lib/http_chunks.h            |   82 +-
 third-party/curl/lib/http_digest.c            |  107 +-
 third-party/curl/lib/http_negotiate.c         |  168 +-
 third-party/curl/lib/http_negotiate.h         |    5 +-
 third-party/curl/lib/http_ntlm.c              |  162 +-
 third-party/curl/lib/http_ntlm.h              |    9 +-
 third-party/curl/lib/http_proxy.c             |  745 +-
 third-party/curl/lib/http_proxy.h             |   54 +-
 third-party/curl/lib/httpsrr.c                |  311 +
 third-party/curl/lib/httpsrr.h                |  102 +
 third-party/curl/lib/idn.c                    |  310 +-
 third-party/curl/lib/idn.h                    |   17 +-
 third-party/curl/lib/if2ip.c                  |   86 +-
 third-party/curl/lib/if2ip.h                  |   45 +-
 third-party/curl/lib/imap.c                   | 2098 +++---
 third-party/curl/lib/imap.h                   |   72 +-
 third-party/curl/lib/inet_ntop.c              |  205 -
 third-party/curl/lib/inet_ntop.h              |   39 -
 third-party/curl/lib/inet_pton.c              |  242 -
 third-party/curl/lib/krb5.c                   |  902 ---
 third-party/curl/lib/ldap.c                   |  836 +-
 third-party/curl/{ => lib}/libcurl.def        |    8 +
 third-party/curl/lib/libcurl.plist.in         |   35 -
 third-party/curl/lib/libcurl.rc               |    2 +-
 third-party/curl/lib/libcurl.vers.in          |   10 +-
 third-party/curl/lib/llist.c                  |  276 +-
 third-party/curl/lib/llist.h                  |   68 +-
 third-party/curl/lib/macos.c                  |   31 +-
 third-party/curl/lib/macos.h                  |    5 -
 third-party/curl/lib/md4.c                    |  467 +-
 third-party/curl/lib/md5.c                    |  660 +-
 third-party/curl/lib/memdebug.c               |  389 +-
 third-party/curl/lib/memdebug.h               |  202 -
 third-party/curl/lib/mime.c                   | 1127 +--
 third-party/curl/lib/mime.h                   |   35 +-
 third-party/curl/lib/mprintf.c                | 1967 ++---
 third-party/curl/lib/mqtt.c                   |  678 +-
 third-party/curl/lib/mqtt.h                   |   36 +-
 third-party/curl/lib/multi.c                  | 5661 +++++++-------
 third-party/curl/lib/multi_ev.c               |  646 ++
 third-party/curl/lib/multi_ev.h               |   80 +
 third-party/curl/lib/multi_ntfy.c             |  207 +
 third-party/curl/lib/multi_ntfy.h             |   60 +
 third-party/curl/lib/multihandle.h            |  171 +-
 third-party/curl/lib/multiif.h                |  161 +-
 third-party/curl/lib/netrc.c                  |  885 ++-
 third-party/curl/lib/netrc.h                  |   45 +-
 third-party/curl/lib/noproxy.c                |  266 -
 third-party/curl/lib/noproxy.h                |   45 -
 third-party/curl/lib/openldap.c               |  863 ++-
 third-party/curl/lib/optiontable.pl           |   64 +-
 third-party/curl/lib/parsedate.c              |  759 +-
 third-party/curl/lib/parsedate.h              |    7 +-
 third-party/curl/lib/peer.c                   |  740 ++
 third-party/curl/lib/peer.h                   |  110 +
 third-party/curl/lib/pingpong.c               |  427 +-
 third-party/curl/lib/pingpong.h               |   68 +-
 third-party/curl/lib/pop3.c                   | 1344 ++--
 third-party/curl/lib/pop3.h                   |   73 +-
 third-party/curl/lib/progress.c               |  864 ++-
 third-party/curl/lib/progress.h               |   47 +-
 third-party/curl/lib/protocol.c               |  536 ++
 third-party/curl/lib/protocol.h               |  296 +
 third-party/curl/lib/proxy.c                  |  673 ++
 third-party/curl/lib/proxy.h                  |   59 +
 third-party/curl/lib/psl.c                    |   44 +-
 third-party/curl/lib/psl.h                    |    6 +-
 third-party/curl/lib/rand.c                   |  269 +-
 third-party/curl/lib/rand.h                   |   25 +-
 third-party/curl/lib/ratelimit.c              |  295 +
 third-party/curl/lib/ratelimit.h              |  108 +
 third-party/curl/lib/rename.c                 |   73 -
 third-party/curl/lib/rename.h                 |   29 -
 third-party/curl/lib/request.c                |  503 ++
 third-party/curl/lib/request.h                |  251 +
 third-party/curl/lib/rtsp.c                   | 1195 +--
 third-party/curl/lib/rtsp.h                   |   48 +-
 third-party/curl/lib/select.c                 |  590 +-
 third-party/curl/lib/select.h                 |  168 +-
 third-party/curl/lib/sendf.c                  | 1723 ++++-
 third-party/curl/lib/sendf.h                  |  414 +-
 third-party/curl/lib/setopt.c                 | 5233 ++++++-------
 third-party/curl/lib/setopt.h                 |   14 +-
 third-party/curl/lib/setup-os400.h            |   41 +-
 third-party/curl/lib/setup-vms.h              |  450 +-
 third-party/curl/lib/setup-win32.h            |  113 +-
 third-party/curl/lib/sha256.c                 |  404 +-
 third-party/curl/lib/share.c                  |  290 -
 third-party/curl/lib/share.h                  |   76 -
 third-party/curl/lib/sigpipe.h                |   50 +-
 third-party/curl/lib/slist.c                  |   37 +-
 third-party/curl/lib/slist.h                  |    2 +-
 third-party/curl/lib/smb.c                    |  787 +-
 third-party/curl/lib/smb.h                    |   35 +-
 third-party/curl/lib/smtp.c                   | 1728 +++--
 third-party/curl/lib/smtp.h                   |   76 +-
 third-party/curl/lib/sockaddr.h               |   21 +-
 third-party/curl/lib/socketpair.c             |  263 +-
 third-party/curl/lib/socketpair.h             |   18 +-
 third-party/curl/lib/socks.c                  | 2092 ++---
 third-party/curl/lib/socks.h                  |   38 +-
 third-party/curl/lib/socks_gssapi.c           |  436 +-
 third-party/curl/lib/socks_sspi.c             |  671 +-
 third-party/curl/lib/speedcheck.c             |   79 -
 third-party/curl/lib/speedcheck.h             |   35 -
 third-party/curl/lib/splay.c                  |  109 +-
 third-party/curl/lib/splay.h                  |   23 +-
 third-party/curl/lib/strcase.c                |  152 +-
 third-party/curl/lib/strcase.h                |   21 +-
 third-party/curl/lib/strdup.c                 |  123 -
 third-party/curl/lib/strequal.c               |   95 +
 third-party/curl/lib/strerror.c               |  727 +-
 third-party/curl/lib/strerror.h               |   11 +-
 third-party/curl/lib/strtok.c                 |   68 -
 third-party/curl/lib/strtok.h                 |   36 -
 third-party/curl/lib/strtoofft.c              |  245 -
 third-party/curl/lib/strtoofft.h              |   54 -
 third-party/curl/lib/system_win32.c           |  165 +-
 third-party/curl/lib/system_win32.h           |   18 +-
 third-party/curl/lib/telnet.c                 | 1467 ++--
 third-party/curl/lib/telnet.h                 |    2 +-
 third-party/curl/lib/tftp.c                   | 1124 ++-
 third-party/curl/lib/tftp.h                   |    5 +-
 third-party/curl/lib/thrdpool.c               |  481 ++
 third-party/curl/lib/thrdpool.h               |  106 +
 third-party/curl/lib/thrdqueue.c              |  416 +
 third-party/curl/lib/thrdqueue.h              |  119 +
 third-party/curl/lib/timeval.c                |  224 -
 third-party/curl/lib/timeval.h                |   54 -
 third-party/curl/lib/transfer.c               | 2033 ++---
 third-party/curl/lib/transfer.h               |  143 +-
 third-party/curl/lib/uint-bset.c              |  233 +
 third-party/curl/lib/uint-bset.h              |  109 +
 third-party/curl/lib/uint-hash.c              |  235 +
 third-party/curl/lib/uint-hash.h              |   59 +
 third-party/curl/lib/uint-spbset.c            |  253 +
 third-party/curl/lib/uint-spbset.h            |   91 +
 third-party/curl/lib/uint-table.c             |  202 +
 third-party/curl/lib/uint-table.h             |   96 +
 third-party/curl/lib/url.c                    | 5028 +++++--------
 third-party/curl/lib/url.h                    |   68 +-
 third-party/curl/lib/urlapi-int.h             |   41 +-
 third-party/curl/lib/urlapi.c                 | 2688 +++----
 third-party/curl/lib/urldata.h                | 1674 ++--
 third-party/curl/lib/vauth/cleartext.c        |   89 +-
 third-party/curl/lib/vauth/cram.c             |   30 +-
 third-party/curl/lib/vauth/digest.c           |  788 +-
 third-party/curl/lib/vauth/digest.h           |    3 +-
 third-party/curl/lib/vauth/digest_sspi.c      |  319 +-
 third-party/curl/lib/vauth/gsasl.c            |   34 +-
 third-party/curl/lib/vauth/krb5_gssapi.c      |   66 +-
 third-party/curl/lib/vauth/krb5_sspi.c        |  180 +-
 third-party/curl/lib/vauth/ntlm.c             |  552 +-
 third-party/curl/lib/vauth/ntlm.h             |  143 -
 third-party/curl/lib/vauth/ntlm_sspi.c        |  169 +-
 third-party/curl/lib/vauth/oauth2.c           |   40 +-
 third-party/curl/lib/vauth/spnego_gssapi.c    |   78 +-
 third-party/curl/lib/vauth/spnego_sspi.c      |  161 +-
 third-party/curl/lib/vauth/vauth.c            |  181 +-
 third-party/curl/lib/vauth/vauth.h            |  211 +-
 third-party/curl/lib/version.c                |  335 +-
 third-party/curl/lib/version_win32.c          |  319 -
 third-party/curl/lib/vquic/capsule.c          |  301 +
 third-party/curl/lib/vquic/capsule.h          |   70 +
 third-party/curl/lib/vquic/cf-capsule.c       |  306 +
 third-party/curl/lib/vquic/cf-capsule.h       |   40 +
 third-party/curl/lib/vquic/cf-ngtcp2-cmn.c    | 1969 +++++
 third-party/curl/lib/vquic/cf-ngtcp2-cmn.h    |  239 +
 third-party/curl/lib/vquic/cf-ngtcp2-proxy.c  | 1316 ++++
 third-party/curl/lib/vquic/cf-ngtcp2-proxy.h  |   52 +
 third-party/curl/lib/vquic/cf-ngtcp2.c        | 1166 +++
 third-party/curl/lib/vquic/cf-ngtcp2.h        |   63 +
 third-party/curl/lib/vquic/cf-quiche.c        | 1713 +++++
 third-party/curl/lib/vquic/cf-quiche.h        |   50 +
 third-party/curl/lib/vquic/curl_msh3.c        | 1087 ---
 third-party/curl/lib/vquic/curl_msh3.h        |   46 -
 third-party/curl/lib/vquic/curl_ngtcp2.c      | 2748 -------
 third-party/curl/lib/vquic/curl_ngtcp2.h      |   61 -
 third-party/curl/lib/vquic/curl_quiche.c      | 1709 -----
 third-party/curl/lib/vquic/curl_quiche.h      |   50 -
 third-party/curl/lib/vquic/vquic-tls.c        |  241 +
 third-party/curl/lib/vquic/vquic-tls.h        |  125 +
 third-party/curl/lib/vquic/vquic.c            |  808 +-
 third-party/curl/lib/vquic/vquic.h            |   49 +-
 third-party/curl/lib/vquic/vquic_int.h        |   97 +-
 third-party/curl/lib/vssh/libssh.c            | 5148 +++++++------
 third-party/curl/lib/vssh/libssh2.c           | 5840 +++++++-------
 third-party/curl/lib/vssh/ssh.h               |  138 +-
 third-party/curl/lib/vssh/vssh.c              |  333 +
 third-party/curl/lib/vssh/vssh.h              |   42 +
 third-party/curl/lib/vssh/wolfssh.c           | 1173 ---
 third-party/curl/lib/vtls/apple.c             |  291 +
 third-party/curl/lib/vtls/apple.h             |   54 +
 third-party/curl/lib/vtls/bearssl.c           | 1230 ---
 third-party/curl/lib/vtls/bearssl.h           |   34 -
 third-party/curl/lib/vtls/cipher_suite.c      |  702 ++
 third-party/curl/lib/vtls/cipher_suite.h      |   44 +
 third-party/curl/lib/vtls/gtls.c              | 2689 ++++---
 third-party/curl/lib/vtls/gtls.h              |   87 +-
 third-party/curl/lib/vtls/hostcheck.c         |   27 +-
 third-party/curl/lib/vtls/hostcheck.h         |    9 +-
 third-party/curl/lib/vtls/keylog.c            |  108 +-
 third-party/curl/lib/vtls/keylog.h            |   25 +-
 third-party/curl/lib/vtls/mbedtls.c           | 1943 +++--
 .../curl/lib/vtls/mbedtls_threadlock.c        |  134 -
 .../curl/lib/vtls/mbedtls_threadlock.h        |   50 -
 third-party/curl/lib/vtls/openssl.c           | 6203 ++++++++-------
 third-party/curl/lib/vtls/openssl.h           |  169 +-
 third-party/curl/lib/vtls/rustls.c            | 1529 +++-
 third-party/curl/lib/vtls/rustls.h            |    8 +-
 third-party/curl/lib/vtls/schannel.c          | 4194 ++++++-----
 third-party/curl/lib/vtls/schannel.h          |   45 +-
 third-party/curl/lib/vtls/schannel_int.h      |  235 +-
 third-party/curl/lib/vtls/schannel_verify.c   |  714 +-
 third-party/curl/lib/vtls/sectransp.c         | 3505 ---------
 third-party/curl/lib/vtls/sectransp.h         |   34 -
 third-party/curl/lib/vtls/vtls.c              | 2006 +++--
 third-party/curl/lib/vtls/vtls.h              |  221 +-
 third-party/curl/lib/vtls/vtls_config.c       |  423 ++
 third-party/curl/lib/vtls/vtls_config.h       |  125 +
 third-party/curl/lib/vtls/vtls_int.h          |  225 +-
 third-party/curl/lib/vtls/vtls_scache.c       | 1316 ++++
 third-party/curl/lib/vtls/vtls_scache.h       |  216 +
 third-party/curl/lib/vtls/vtls_spack.c        |  322 +
 third-party/curl/lib/vtls/vtls_spack.h        |   43 +
 third-party/curl/lib/vtls/wolfssl.c           | 2671 ++++---
 third-party/curl/lib/vtls/wolfssl.h           |   68 +
 third-party/curl/lib/vtls/x509asn1.c          | 1281 ++--
 third-party/curl/lib/vtls/x509asn1.h          |   51 +-
 third-party/curl/lib/warnless.c               |  437 --
 third-party/curl/lib/warnless.h               |   99 -
 third-party/curl/lib/ws.c                     | 1945 +++--
 third-party/curl/lib/ws.h                     |   69 +-
 third-party/curl/libcurl.pc.in                |   14 +-
 third-party/curl/m4/.gitignore                |    1 -
 third-party/curl/m4/curl-amissl.m4            |   15 +-
 third-party/curl/m4/curl-apple-sectrust.m4    |   61 +
 third-party/curl/m4/curl-bearssl.m4           |  110 -
 third-party/curl/m4/curl-compilers.m4         |  764 +-
 third-party/curl/m4/curl-confopts.m4          |  385 +-
 third-party/curl/m4/curl-functions.m4         | 3246 +++-----
 third-party/curl/m4/curl-gnutls.m4            |  272 +-
 third-party/curl/m4/curl-mbedtls.m4           |  138 +-
 third-party/curl/m4/curl-openssl.m4           |  504 +-
 third-party/curl/m4/curl-override.m4          |   23 +-
 third-party/curl/m4/curl-reentrant.m4         |  180 +-
 third-party/curl/m4/curl-rustls.m4            |  215 +-
 third-party/curl/m4/curl-schannel.m4          |   15 +-
 third-party/curl/m4/curl-sectransp.m4         |   45 -
 third-party/curl/m4/curl-sysconfig.m4         |   51 +-
 third-party/curl/m4/curl-wolfssl.m4           |  244 +-
 third-party/curl/m4/xc-am-iface.m4            |   41 +-
 third-party/curl/m4/xc-cc-check.m4            |   50 +-
 third-party/curl/m4/xc-lt-iface.m4            |  228 +-
 third-party/curl/m4/xc-translit.m4            |  165 -
 third-party/curl/m4/xc-val-flgs.m4            |   40 +-
 third-party/curl/m4/zz40-xc-ovr.m4            |  386 +-
 third-party/curl/m4/zz50-xc-ovr.m4            |   10 +-
 third-party/curl/m4/zz60-xc-ovr.m4            |   65 -
 third-party/curl/maketgz                      |  225 -
 third-party/curl/packages/Makefile.am         |   51 -
 third-party/curl/packages/OS400/ccsidcurl.c   | 1527 ----
 third-party/curl/packages/OS400/make-lib.sh   |  183 -
 third-party/curl/packages/OS400/make-src.sh   |   99 -
 third-party/curl/packages/OS400/os400sys.c    | 1040 ---
 third-party/curl/packages/OS400/os400sys.h    |   57 -
 third-party/curl/packages/README.md           |   12 -
 third-party/curl/packages/vms/Makefile.am     |   59 -
 third-party/curl/packages/vms/config_h.com    | 2004 -----
 .../curl/packages/vms/curl_crtl_init.c        |  333 -
 third-party/curl/packages/vms/curlmsg.h       |  143 -
 third-party/curl/packages/vms/curlmsg.msg     |  134 -
 third-party/curl/packages/vms/curlmsg_vms.h   |  143 -
 .../packages/vms/report_openssl_version.c     |  100 -
 third-party/curl/plan9/README                 |   55 -
 third-party/curl/plan9/include/mkfile         |   36 -
 third-party/curl/plan9/lib/mkfile             |   41 -
 third-party/curl/plan9/lib/mkfile.inc         |   27 -
 third-party/curl/plan9/mkfile                 |   38 -
 third-party/curl/plan9/mkfile.proto           |   32 -
 third-party/curl/plan9/src/mkfile             |   47 -
 third-party/curl/plan9/src/mkfile.inc         |   27 -
 third-party/curl/projects/Makefile.am         |   60 +
 third-party/curl/projects/OS400/.checksrc     |    9 +
 .../{packages => projects}/OS400/README.OS400 |   52 +-
 third-party/curl/projects/OS400/ccsidcurl.c   | 1471 ++++
 .../{packages => projects}/OS400/ccsidcurl.h  |    1 -
 .../OS400/config400.default                   |    1 +
 .../{packages => projects}/OS400/curl.cmd     |    2 +-
 .../{packages => projects}/OS400/curl.inc.in  |  153 +-
 .../{packages => projects}/OS400/curlcl.c     |   26 +-
 .../{packages => projects}/OS400/curlmain.c   |   20 +-
 .../OS400/initscript.sh                       |   94 +-
 third-party/curl/projects/OS400/make-docs.sh  |   65 +
 .../OS400/make-include.sh                     |   10 +-
 third-party/curl/projects/OS400/make-lib.sh   |  181 +
 third-party/curl/projects/OS400/make-src.sh   |  118 +
 .../OS400/make-tests.sh                       |   45 +-
 .../{packages => projects}/OS400/makefile.sh  |   38 +-
 third-party/curl/projects/OS400/os400sys.c    | 1038 +++
 third-party/curl/projects/OS400/os400sys.h    |   54 +
 .../OS400/rpg-examples/HEADERAPI              |    4 +-
 .../OS400/rpg-examples/HTTPPOST               |    4 +-
 .../OS400/rpg-examples/INMEMORY               |    4 +-
 .../OS400/rpg-examples/SIMPLE1                |    4 +-
 .../OS400/rpg-examples/SIMPLE2                |    4 +-
 .../OS400/rpg-examples/SMTPSRCMBR             |    4 +-
 third-party/curl/projects/README.md           |  158 +-
 third-party/curl/projects/Windows/.gitignore  |    7 +-
 third-party/curl/projects/Windows/README.md   |  148 +
 .../curl/projects/Windows/VC10/.gitignore     |    8 -
 .../curl/projects/Windows/VC10/curl-all.sln   |  298 -
 .../curl/projects/Windows/VC10/lib/.gitignore |   10 -
 .../projects/Windows/VC10/lib/libcurl.sln     |  181 -
 .../projects/Windows/VC10/lib/libcurl.tmpl    | 2353 ------
 .../Windows/VC10/lib/libcurl.vcxproj.filters  |   17 -
 .../curl/projects/Windows/VC10/src/.gitignore |   10 -
 .../curl/projects/Windows/VC10/src/curl.sln   |  181 -
 .../curl/projects/Windows/VC10/src/curl.tmpl  | 2643 -------
 .../Windows/VC10/src/curl.vcxproj.filters     |   17 -
 .../curl/projects/Windows/VC11/.gitignore     |    8 -
 .../curl/projects/Windows/VC11/curl-all.sln   |  298 -
 .../curl/projects/Windows/VC11/lib/.gitignore |   10 -
 .../projects/Windows/VC11/lib/libcurl.sln     |  181 -
 .../projects/Windows/VC11/lib/libcurl.tmpl    | 2409 ------
 .../Windows/VC11/lib/libcurl.vcxproj.filters  |   17 -
 .../curl/projects/Windows/VC11/src/.gitignore |   10 -
 .../curl/projects/Windows/VC11/src/curl.sln   |  181 -
 .../curl/projects/Windows/VC11/src/curl.tmpl  | 2699 -------
 .../Windows/VC11/src/curl.vcxproj.filters     |   17 -
 .../curl/projects/Windows/VC12/.gitignore     |    8 -
 .../curl/projects/Windows/VC12/curl-all.sln   |  298 -
 .../curl/projects/Windows/VC12/lib/.gitignore |   10 -
 .../projects/Windows/VC12/lib/libcurl.sln     |  181 -
 .../projects/Windows/VC12/lib/libcurl.tmpl    | 2409 ------
 .../Windows/VC12/lib/libcurl.vcxproj.filters  |   17 -
 .../curl/projects/Windows/VC12/src/.gitignore |   10 -
 .../curl/projects/Windows/VC12/src/curl.sln   |  181 -
 .../curl/projects/Windows/VC12/src/curl.tmpl  | 2699 -------
 .../Windows/VC12/src/curl.vcxproj.filters     |   17 -
 .../curl/projects/Windows/VC14.10/.gitignore  |    9 -
 .../projects/Windows/VC14.10/curl-all.sln     |  298 -
 .../projects/Windows/VC14.10/lib/.gitignore   |   10 -
 .../projects/Windows/VC14.10/lib/libcurl.sln  |  181 -
 .../projects/Windows/VC14.10/lib/libcurl.tmpl | 2381 ------
 .../VC14.10/lib/libcurl.vcxproj.filters       |   17 -
 .../projects/Windows/VC14.10/src/.gitignore   |   10 -
 .../projects/Windows/VC14.10/src/curl.sln     |  181 -
 .../projects/Windows/VC14.10/src/curl.tmpl    | 2671 -------
 .../Windows/VC14.10/src/curl.vcxproj.filters  |   17 -
 .../curl/projects/Windows/VC14.30/.gitignore  |    9 -
 .../projects/Windows/VC14.30/curl-all.sln     |  298 -
 .../projects/Windows/VC14.30/lib/.gitignore   |   10 -
 .../projects/Windows/VC14.30/lib/libcurl.sln  |  181 -
 .../projects/Windows/VC14.30/lib/libcurl.tmpl | 2381 ------
 .../VC14.30/lib/libcurl.vcxproj.filters       |   17 -
 .../projects/Windows/VC14.30/src/.gitignore   |   10 -
 .../projects/Windows/VC14.30/src/curl.sln     |  181 -
 .../projects/Windows/VC14.30/src/curl.tmpl    | 2671 -------
 .../Windows/VC14.30/src/curl.vcxproj.filters  |   17 -
 .../curl/projects/Windows/VC14/.gitignore     |    9 -
 .../curl/projects/Windows/VC14/curl-all.sln   |  298 -
 .../curl/projects/Windows/VC14/lib/.gitignore |   10 -
 .../projects/Windows/VC14/lib/libcurl.sln     |  181 -
 .../projects/Windows/VC14/lib/libcurl.tmpl    | 2409 ------
 .../Windows/VC14/lib/libcurl.vcxproj.filters  |   17 -
 .../curl/projects/Windows/VC14/src/.gitignore |   10 -
 .../curl/projects/Windows/VC14/src/curl.sln   |  181 -
 .../curl/projects/Windows/VC14/src/curl.tmpl  | 2699 -------
 .../Windows/VC14/src/curl.vcxproj.filters     |   17 -
 .../curl/projects/Windows/generate.bat        |  355 +
 .../Windows/{ => tmpl}/.gitattributes         |    0
 .../curl/projects/Windows/tmpl/README.txt     |    6 +
 .../curl/projects/Windows/tmpl/curl-all.sln   |  257 +
 .../curl/projects/Windows/tmpl/curl.sln       |  156 +
 .../curl/projects/Windows/tmpl/curl.vcxproj   | 2314 ++++++
 .../Windows/tmpl/curl.vcxproj.filters         |   17 +
 .../curl/projects/Windows/tmpl/libcurl.sln    |  156 +
 .../projects/Windows/tmpl/libcurl.vcxproj     | 2055 +++++
 .../Windows/tmpl/libcurl.vcxproj.filters      |   17 +
 third-party/curl/projects/build-openssl.bat   |  739 --
 third-party/curl/projects/build-wolfssl.bat   |  429 --
 third-party/curl/projects/checksrc.bat        |  225 -
 third-party/curl/projects/generate.bat        |  405 -
 third-party/curl/projects/vms/Makefile.am     |   59 +
 .../vms/backup_gnv_curl_src.com               |    0
 .../vms/build_curl-config_script.com          |    2 +-
 .../vms/build_gnv_curl.com                    |    0
 .../vms/build_gnv_curl_pcsi_desc.com          |    6 +-
 .../vms/build_gnv_curl_pcsi_text.com          |    4 +-
 .../vms/build_gnv_curl_release_notes.com      |   10 +-
 .../vms/build_libcurl_pc.com                  |    4 +-
 .../{packages => projects}/vms/build_vms.com  |   46 +-
 .../vms/clean_gnv_curl.com                    |   29 +-
 .../vms/compare_curl_source.com               |    6 +-
 third-party/curl/projects/vms/config_h.com    | 1932 +++++
 .../curl/projects/vms/curl_crtl_init.c        |  323 +
 .../vms/curl_gnv_build_steps.txt              |   14 +-
 .../vms/curl_release_note_start.txt           |   10 +-
 .../vms/curl_startup.com                      |    4 +-
 third-party/curl/projects/vms/curlmsg.h       |  143 +
 third-party/curl/projects/vms/curlmsg.msg     |  134 +
 .../{packages => projects}/vms/curlmsg.sdl    |    0
 third-party/curl/projects/vms/curlmsg_vms.h   |  129 +
 .../vms/generate_config_vms_h_curl.com        |   99 +-
 .../vms/generate_vax_transfer.com             |    0
 .../vms/gnv_conftest.c_first                  |    2 +-
 .../vms/gnv_curl_configure.sh                 |    8 +-
 .../vms/gnv_libcurl_symbols.opt               |    0
 .../vms/gnv_link_curl.com                     |   44 +-
 .../vms/macro32_exactcase.patch               |    0
 .../vms/make_gnv_curl_install.sh              |    4 +-
 .../vms/make_pcsi_curl_kit_name.com           |    2 +-
 .../vms/pcsi_gnv_curl_file_list.txt           |    2 +-
 .../vms/pcsi_product_gnv_curl.com             |    8 +-
 .../curl/{packages => projects}/vms/readme    |   30 +-
 .../projects/vms/report_openssl_version.c     |   98 +
 .../vms/setup_gnv_curl_build.com              |   22 +-
 .../vms/stage_curl_install.com                |    2 +-
 .../vms/vms_eco_level.h                       |    0
 third-party/curl/projects/wolfssl_options.h   |  308 -
 .../curl/projects/wolfssl_override.props      |   40 -
 third-party/curl/renovate.json                |   97 +
 third-party/curl/scripts/.checksrc            |    5 +
 third-party/curl/scripts/CMakeLists.txt       |   80 +
 third-party/curl/scripts/Makefile.am          |   47 +-
 third-party/curl/scripts/badwords             |  336 +
 third-party/curl/scripts/badwords-all         |   14 +
 third-party/curl/scripts/badwords.txt         |  135 +
 third-party/curl/scripts/cd2cd                |  233 +
 third-party/curl/scripts/cd2nroff             |  588 ++
 third-party/curl/scripts/cdall                |   47 +
 third-party/curl/scripts/checksrc-all.pl      |   48 +
 third-party/curl/scripts/checksrc.pl          |  603 +-
 third-party/curl/scripts/ciconfig.pl          |  185 -
 third-party/curl/scripts/cijobs.pl            |  510 --
 third-party/curl/scripts/cmakelint.sh         |   79 +
 third-party/curl/scripts/completion.pl        |   94 +-
 third-party/curl/scripts/contributors.sh      |   91 +-
 third-party/curl/scripts/contrithanks.sh      |  106 +-
 third-party/curl/scripts/copyright.pl         |  227 -
 third-party/curl/scripts/coverage.sh          |    2 +
 third-party/curl/scripts/delta                |  135 +-
 third-party/curl/scripts/dmaketgz             |   55 +
 third-party/curl/scripts/extract-unit-protos  |  151 +
 third-party/curl/scripts/firefox-db2pem.sh    |   27 +-
 third-party/curl/scripts/installcheck.sh      |   24 +-
 third-party/curl/scripts/log2changes.pl       |  103 -
 third-party/curl/scripts/maketgz              |  246 +
 third-party/curl/scripts/managen              | 1383 ++++
 third-party/curl/scripts/mdlinkcheck          |  254 +
 third-party/curl/scripts/mk-ca-bundle.pl      |  911 ++-
 third-party/curl/scripts/mk-unity.pl          |  115 +
 third-party/curl/scripts/nroff2cd             |  197 +
 third-party/curl/scripts/perlcheck.sh         |   48 +
 third-party/curl/scripts/pythonlint.sh        |   37 +
 third-party/curl/scripts/randdisable          |   83 +
 third-party/curl/scripts/release-notes.pl     |   62 +-
 third-party/curl/scripts/release-tools.sh     |   79 +
 third-party/curl/scripts/schemetable.c        |  186 +
 third-party/curl/scripts/singleuse.pl         |  111 +-
 third-party/curl/scripts/spacecheck.pl        |  306 +
 third-party/curl/scripts/top-complexity       |  134 +
 third-party/curl/scripts/top-length           |  133 +
 third-party/curl/scripts/updatemanpages.pl    |  357 -
 third-party/curl/scripts/verify-release       |  121 +
 third-party/curl/scripts/wcurl                |  352 +
 third-party/curl/src/.checksrc                |    5 +
 third-party/curl/src/.gitignore               |   12 +-
 third-party/curl/src/CMakeLists.txt           |  189 +-
 third-party/curl/src/Makefile.am              |  187 +-
 third-party/curl/src/Makefile.inc             |   92 +-
 third-party/curl/src/Makefile.mk              |  111 -
 third-party/curl/src/config2setopts.c         | 1092 +++
 third-party/curl/src/config2setopts.h         |   32 +
 third-party/curl/src/curl.rc                  |   52 +-
 third-party/curl/src/curlinfo.c               |  277 +
 third-party/curl/src/mk-file-embed.pl         |   63 +
 third-party/curl/src/mkhelp.pl                |  236 +-
 third-party/curl/src/slist_wc.c               |   11 +-
 third-party/curl/src/slist_wc.h               |    8 +-
 third-party/curl/src/terminal.c               |   86 +
 third-party/curl/src/terminal.h               |   30 +
 third-party/curl/src/tool_binmode.c           |   53 -
 third-party/curl/src/tool_binmode.h           |   38 -
 third-party/curl/src/tool_bname.c             |   51 -
 third-party/curl/src/tool_bname.h             |   36 -
 third-party/curl/src/tool_cb_dbg.c            |  216 +-
 third-party/curl/src/tool_cb_hdr.c            |  749 +-
 third-party/curl/src/tool_cb_hdr.h            |    4 +-
 third-party/curl/src/tool_cb_prg.c            |  162 +-
 third-party/curl/src/tool_cb_prg.h            |   17 +-
 third-party/curl/src/tool_cb_rea.c            |  134 +-
 third-party/curl/src/tool_cb_see.c            |   88 +-
 third-party/curl/src/tool_cb_see.h            |   13 -
 third-party/curl/src/tool_cb_soc.c            |   58 +
 third-party/curl/src/tool_cb_soc.h            |   36 +
 third-party/curl/src/tool_cb_wrt.c            |  397 +-
 third-party/curl/src/tool_cfgable.c           |  371 +-
 third-party/curl/src/tool_cfgable.h           |  389 +-
 third-party/curl/src/tool_dirhie.c            |  155 +-
 third-party/curl/src/tool_dirhie.h            |    8 +-
 third-party/curl/src/tool_doswin.c            |  900 ++-
 third-party/curl/src/tool_doswin.h            |   46 +-
 third-party/curl/src/tool_easysrc.c           |  120 +-
 third-party/curl/src/tool_easysrc.h           |    8 +-
 third-party/curl/src/tool_filetime.c          |  163 +-
 third-party/curl/src/tool_filetime.h          |   17 +-
 third-party/curl/src/tool_findfile.c          |   43 +-
 third-party/curl/src/tool_findfile.h          |    2 +-
 third-party/curl/src/tool_formparse.c         |  779 +-
 third-party/curl/src/tool_formparse.h         |    8 +-
 third-party/curl/src/tool_getparam.c          | 5169 +++++++------
 third-party/curl/src/tool_getparam.h          |  354 +-
 third-party/curl/src/tool_getpass.c           |   75 +-
 third-party/curl/src/tool_getpass.h           |    4 +-
 third-party/curl/src/tool_help.c              |  356 +-
 third-party/curl/src/tool_help.h              |   83 +-
 third-party/curl/src/tool_helpers.c           |   45 +-
 third-party/curl/src/tool_helpers.h           |   10 +-
 third-party/curl/src/tool_hugehelp.c.cvs      |   31 -
 third-party/curl/src/tool_hugehelp.h          |    4 +-
 third-party/curl/src/tool_ipfs.c              |  239 +
 third-party/curl/src/tool_ipfs.h              |   34 +
 third-party/curl/src/tool_libinfo.c           |   93 +-
 third-party/curl/src/tool_libinfo.h           |    8 +-
 third-party/curl/src/tool_listhelp.c          | 1611 ++--
 third-party/curl/src/tool_main.c              |  173 +-
 third-party/curl/src/tool_main.h              |   15 +-
 third-party/curl/src/tool_msgs.c              |  128 +-
 third-party/curl/src/tool_msgs.h              |    9 +-
 third-party/curl/src/tool_operate.c           | 4078 +++++-----
 third-party/curl/src/tool_operate.h           |   52 +-
 third-party/curl/src/tool_operhlp.c           |  158 +-
 third-party/curl/src/tool_operhlp.h           |    7 +-
 third-party/curl/src/tool_paramhlp.c          |  519 +-
 third-party/curl/src/tool_paramhlp.h          |   28 +-
 third-party/curl/src/tool_parsecfg.c          |  613 +-
 third-party/curl/src/tool_parsecfg.h          |    6 +-
 third-party/curl/src/tool_progress.c          |  280 +-
 third-party/curl/src/tool_progress.h          |   10 +-
 third-party/curl/src/tool_sdecls.h            |   70 +-
 third-party/curl/src/tool_setopt.c            |  699 +-
 third-party/curl/src/tool_setopt.h            |  145 +-
 third-party/curl/src/tool_setup.h             |   75 +-
 third-party/curl/src/tool_sleep.c             |   61 -
 third-party/curl/src/tool_sleep.h             |   30 -
 third-party/curl/src/tool_ssls.c              |  213 +
 third-party/curl/src/tool_ssls.h              |   33 +
 third-party/curl/src/tool_stderr.c            |   23 +-
 third-party/curl/src/tool_stderr.h            |    3 +-
 third-party/curl/src/tool_strdup.c            |   44 -
 third-party/curl/src/tool_strdup.h            |   32 -
 third-party/curl/src/tool_urlglob.c           |  847 ++-
 third-party/curl/src/tool_urlglob.h           |   63 +-
 third-party/curl/src/tool_util.c              |  181 +-
 third-party/curl/src/tool_util.h              |   15 +-
 third-party/curl/src/tool_version.h           |    8 +-
 third-party/curl/src/tool_vms.c               |   46 +-
 third-party/curl/src/tool_vms.h               |   10 +-
 third-party/curl/src/tool_writeout.c          |  690 +-
 third-party/curl/src/tool_writeout.h          |   11 +-
 third-party/curl/src/tool_writeout_json.c     |   38 +-
 third-party/curl/src/tool_writeout_json.h     |    5 +-
 third-party/curl/src/tool_xattr.c             |   18 +-
 third-party/curl/src/tool_xattr.h             |    8 +-
 third-party/curl/src/toolx/tool_time.c        |   61 +
 third-party/curl/src/toolx/tool_time.h        |   30 +
 third-party/curl/src/var.c                    |  288 +-
 third-party/curl/src/var.h                    |   18 +-
 third-party/curl/tests/.gitignore             |    7 +-
 third-party/curl/tests/CI.md                  |  117 -
 third-party/curl/tests/CMakeLists.txt         |  139 +-
 third-party/curl/tests/FILEFORMAT.md          |  659 --
 third-party/curl/tests/Makefile.am            |  139 +-
 third-party/curl/tests/README.md              |  269 -
 third-party/curl/tests/allversions.pm         |   53 +
 third-party/curl/tests/appveyor.pm            |   37 +-
 third-party/curl/tests/azure.pm               |   34 +-
 third-party/curl/tests/badsymbols.pl          |  158 -
 third-party/curl/tests/certs/.gitignore       |   18 +-
 third-party/curl/tests/certs/CMakeLists.txt   |   50 +
 .../curl/tests/certs/EdelCurlRoot-ca.cacert   |   95 -
 .../curl/tests/certs/EdelCurlRoot-ca.cnf      |   11 -
 .../curl/tests/certs/EdelCurlRoot-ca.crt      |   95 -
 .../curl/tests/certs/EdelCurlRoot-ca.csr      |   17 -
 .../curl/tests/certs/EdelCurlRoot-ca.der      |  Bin 1080 -> 0 bytes
 .../curl/tests/certs/EdelCurlRoot-ca.key      |   28 -
 .../curl/tests/certs/EdelCurlRoot-ca.prm      |   30 -
 third-party/curl/tests/certs/Makefile.am      |  124 +-
 third-party/curl/tests/certs/Makefile.inc     |   88 +
 .../certs/Server-localhost-firstSAN-sv.crl    |   14 -
 .../certs/Server-localhost-firstSAN-sv.crt    |  100 -
 .../certs/Server-localhost-firstSAN-sv.csr    |   16 -
 .../certs/Server-localhost-firstSAN-sv.der    |  Bin 1123 -> 0 bytes
 .../certs/Server-localhost-firstSAN-sv.dhp    |    0
 .../certs/Server-localhost-firstSAN-sv.key    |   28 -
 .../certs/Server-localhost-firstSAN-sv.pem    |  167 -
 .../certs/Server-localhost-firstSAN-sv.prm    |   39 -
 .../Server-localhost-firstSAN-sv.pub.der      |  Bin 294 -> 0 bytes
 .../Server-localhost-firstSAN-sv.pub.pem      |    9 -
 ...Server-localhost-firstSAN-sv.pubkey-pinned |    1 -
 .../certs/Server-localhost-lastSAN-sv.crl     |   15 -
 .../certs/Server-localhost-lastSAN-sv.crt     |  100 -
 .../certs/Server-localhost-lastSAN-sv.csr     |   16 -
 .../certs/Server-localhost-lastSAN-sv.der     |  Bin 1123 -> 0 bytes
 .../certs/Server-localhost-lastSAN-sv.dhp     |    0
 .../certs/Server-localhost-lastSAN-sv.key     |   28 -
 .../certs/Server-localhost-lastSAN-sv.pem     |  166 -
 .../certs/Server-localhost-lastSAN-sv.prm     |   38 -
 .../certs/Server-localhost-lastSAN-sv.pub.der |  Bin 294 -> 0 bytes
 .../certs/Server-localhost-lastSAN-sv.pub.pem |    9 -
 .../Server-localhost-lastSAN-sv.pubkey-pinned |    1 -
 .../curl/tests/certs/Server-localhost-sv.crl  |   12 -
 .../curl/tests/certs/Server-localhost-sv.crt  |   99 -
 .../curl/tests/certs/Server-localhost-sv.csr  |   16 -
 .../curl/tests/certs/Server-localhost-sv.der  |  Bin 1096 -> 0 bytes
 .../curl/tests/certs/Server-localhost-sv.dhp  |    0
 .../curl/tests/certs/Server-localhost-sv.key  |   28 -
 .../curl/tests/certs/Server-localhost-sv.pem  |  165 -
 .../curl/tests/certs/Server-localhost-sv.prm  |   38 -
 .../tests/certs/Server-localhost-sv.pub.der   |  Bin 294 -> 0 bytes
 .../tests/certs/Server-localhost-sv.pub.pem   |    9 -
 .../certs/Server-localhost-sv.pubkey-pinned   |    1 -
 .../tests/certs/Server-localhost.nn-sv.crl    |   13 -
 .../tests/certs/Server-localhost.nn-sv.crt    |   99 -
 .../tests/certs/Server-localhost.nn-sv.csr    |   16 -
 .../tests/certs/Server-localhost.nn-sv.der    |  Bin 1102 -> 0 bytes
 .../tests/certs/Server-localhost.nn-sv.dhp    |    0
 .../tests/certs/Server-localhost.nn-sv.key    |   28 -
 .../tests/certs/Server-localhost.nn-sv.pem    |  165 -
 .../tests/certs/Server-localhost.nn-sv.prm    |   38 -
 .../certs/Server-localhost.nn-sv.pub.der      |  Bin 294 -> 0 bytes
 .../certs/Server-localhost.nn-sv.pub.pem      |    9 -
 .../Server-localhost.nn-sv.pubkey-pinned      |    1 -
 .../tests/certs/Server-localhost0h-sv.crl     |   14 -
 .../tests/certs/Server-localhost0h-sv.crt     |   99 -
 .../tests/certs/Server-localhost0h-sv.csr     |   16 -
 .../tests/certs/Server-localhost0h-sv.der     |  Bin 1098 -> 0 bytes
 .../tests/certs/Server-localhost0h-sv.dhp     |    0
 .../tests/certs/Server-localhost0h-sv.key     |   28 -
 .../tests/certs/Server-localhost0h-sv.pem     |  166 -
 .../tests/certs/Server-localhost0h-sv.prm     |   39 -
 .../tests/certs/Server-localhost0h-sv.pub.der |  Bin 294 -> 0 bytes
 .../tests/certs/Server-localhost0h-sv.pub.pem |    9 -
 .../certs/Server-localhost0h-sv.pubkey-pinned |    1 -
 third-party/curl/tests/certs/genserv.pl       |  146 +
 .../curl/tests/certs/scripts/Makefile.am      |   30 -
 .../curl/tests/certs/scripts/genroot.sh       |   89 -
 .../curl/tests/certs/scripts/genserv.sh       |  143 -
 third-party/curl/tests/certs/stunnel-sv.crl   |   15 -
 third-party/curl/tests/certs/stunnel-sv.crt   |   99 -
 third-party/curl/tests/certs/stunnel-sv.csr   |   16 -
 third-party/curl/tests/certs/stunnel-sv.der   |  Bin 1096 -> 0 bytes
 third-party/curl/tests/certs/stunnel-sv.dhp   |    0
 third-party/curl/tests/certs/stunnel-sv.key   |   28 -
 third-party/curl/tests/certs/stunnel-sv.pem   |  165 -
 third-party/curl/tests/certs/stunnel-sv.prm   |   38 -
 .../curl/tests/certs/stunnel-sv.pub.der       |  Bin 294 -> 0 bytes
 .../curl/tests/certs/stunnel-sv.pub.pem       |    9 -
 .../curl/tests/certs/stunnel-sv.pubkey-pinned |    1 -
 third-party/curl/tests/certs/test-ca.cnf      |   11 +
 third-party/curl/tests/certs/test-ca.prm      |   32 +
 .../curl/tests/certs/test-client-cert.prm     |   34 +
 .../curl/tests/certs/test-client-eku-only.prm |   34 +
 .../tests/certs/test-localhost-san-first.prm  |   34 +
 .../tests/certs/test-localhost-san-last.prm   |   34 +
 .../curl/tests/certs/test-localhost.nn.prm    |   34 +
 .../curl/tests/certs/test-localhost.prm       |   34 +
 .../curl/tests/certs/test-localhost0h.prm     |   35 +
 third-party/curl/tests/check-deprecated.pl    |  329 -
 .../curl/tests/check-translatable-options.pl  |  147 -
 third-party/curl/tests/cmake/CMakeLists.txt   |  138 +
 third-party/curl/tests/cmake/test.c           |   35 +
 third-party/curl/tests/cmake/test.cpp         |   47 +
 third-party/curl/tests/cmake/test.sh          |   94 +
 third-party/curl/tests/configurehelp.pm.in    |   45 +
 third-party/curl/tests/conftest.py            |   60 -
 third-party/curl/tests/convsrctest.pl         |  263 -
 third-party/curl/tests/data/.gitattributes    |    5 -
 third-party/curl/tests/data/CMakeLists.txt    |   26 -
 third-party/curl/tests/data/DISABLED          |   79 +-
 third-party/curl/tests/data/Makefile.am       |  277 +-
 third-party/curl/tests/data/Makefile.inc      |  261 -
 third-party/curl/tests/data/data-xml1         |  112 +
 third-party/curl/tests/data/data1400.c        |   46 +
 third-party/curl/tests/data/data1401.c        |   58 +
 third-party/curl/tests/data/data1402.c        |   48 +
 third-party/curl/tests/data/data1403.c        |   46 +
 third-party/curl/tests/data/data1404.c        |   83 +
 third-party/curl/tests/data/data1405.c        |   66 +
 third-party/curl/tests/data/data1406.c        |   56 +
 third-party/curl/tests/data/data1407.c        |   46 +
 third-party/curl/tests/data/data1420.c        |   46 +
 third-party/curl/tests/data/data1461.txt      |   23 +
 third-party/curl/tests/data/data1463.txt      |    5 +
 third-party/curl/tests/data/data1465.c        |   48 +
 third-party/curl/tests/data/data1481.c        |   49 +
 third-party/curl/tests/data/data1705-1.md     |   11 +
 third-party/curl/tests/data/data1705-2.md     |   40 +
 third-party/curl/tests/data/data1705-3.md     |   48 +
 third-party/curl/tests/data/data1705-4.md     |   22 +
 third-party/curl/tests/data/data1705-stdout.1 |  126 +
 third-party/curl/tests/data/data1706-1.md     |   11 +
 third-party/curl/tests/data/data1706-2.md     |   36 +
 third-party/curl/tests/data/data1706-3.md     |   48 +
 third-party/curl/tests/data/data1706-4.md     |   22 +
 .../curl/tests/data/data1706-stdout.txt       |  116 +
 third-party/curl/tests/data/data320.html      |   19 +
 third-party/curl/tests/data/test1             |   20 +-
 third-party/curl/tests/data/test10            |    9 +-
 third-party/curl/tests/data/test100           |   14 +-
 third-party/curl/tests/data/test1000          |   12 +-
 third-party/curl/tests/data/test1001          |   21 +-
 third-party/curl/tests/data/test1002          |   21 +-
 third-party/curl/tests/data/test1003          |   11 +-
 third-party/curl/tests/data/test1004          |   15 +-
 third-party/curl/tests/data/test1005          |   11 +-
 third-party/curl/tests/data/test1006          |   13 +-
 third-party/curl/tests/data/test1007          |   13 +-
 third-party/curl/tests/data/test1008          |   31 +-
 third-party/curl/tests/data/test1009          |   10 +-
 third-party/curl/tests/data/test101           |   15 +-
 third-party/curl/tests/data/test1010          |   21 +-
 third-party/curl/tests/data/test1011          |   24 +-
 third-party/curl/tests/data/test1012          |   24 +-
 third-party/curl/tests/data/test1013          |   19 +-
 third-party/curl/tests/data/test1014          |   19 +-
 third-party/curl/tests/data/test1015          |   24 +-
 third-party/curl/tests/data/test1016          |   10 +-
 third-party/curl/tests/data/test1017          |   10 +-
 third-party/curl/tests/data/test1018          |   10 +-
 third-party/curl/tests/data/test1019          |   10 +-
 third-party/curl/tests/data/test102           |    9 +-
 third-party/curl/tests/data/test1020          |   10 +-
 third-party/curl/tests/data/test1021          |   41 +-
 third-party/curl/tests/data/test1022          |   19 +-
 third-party/curl/tests/data/test1023          |   19 +-
 third-party/curl/tests/data/test1024          |   17 +-
 third-party/curl/tests/data/test1025          |   17 +-
 third-party/curl/tests/data/test1026          |   23 +-
 third-party/curl/tests/data/test1027          |   23 +-
 third-party/curl/tests/data/test1028          |   16 +-
 third-party/curl/tests/data/test1029          |   13 +-
 third-party/curl/tests/data/test103           |    9 +-
 third-party/curl/tests/data/test1030          |   18 +-
 third-party/curl/tests/data/test1031          |    9 +-
 third-party/curl/tests/data/test1032          |   12 +-
 third-party/curl/tests/data/test1033          |   13 +-
 third-party/curl/tests/data/test1034          |   30 +-
 third-party/curl/tests/data/test1035          |   27 +-
 third-party/curl/tests/data/test1036          |    9 +-
 third-party/curl/tests/data/test1037          |    9 +-
 third-party/curl/tests/data/test1038          |   13 +-
 third-party/curl/tests/data/test1039          |   13 +-
 third-party/curl/tests/data/test104           |    9 +-
 third-party/curl/tests/data/test1040          |   19 +-
 third-party/curl/tests/data/test1041          |   13 +-
 third-party/curl/tests/data/test1042          |   22 +-
 third-party/curl/tests/data/test1043          |   25 +-
 third-party/curl/tests/data/test1044          |   13 +-
 third-party/curl/tests/data/test1045          |   14 +-
 third-party/curl/tests/data/test1046          |   22 +-
 third-party/curl/tests/data/test1047          |   18 +-
 third-party/curl/tests/data/test1048          |   26 +-
 third-party/curl/tests/data/test1049          |   10 +-
 third-party/curl/tests/data/test105           |    9 +-
 third-party/curl/tests/data/test1050          |   26 +-
 third-party/curl/tests/data/test1051          |   15 +-
 third-party/curl/tests/data/test1052          |   15 +-
 third-party/curl/tests/data/test1053          |   97 +-
 third-party/curl/tests/data/test1054          |   18 +-
 third-party/curl/tests/data/test1055          |   38 +-
 third-party/curl/tests/data/test1056          |   26 +-
 third-party/curl/tests/data/test1057          |    9 +-
 third-party/curl/tests/data/test1058          |   11 +-
 third-party/curl/tests/data/test1059          |   19 +-
 third-party/curl/tests/data/test106           |    9 +-
 third-party/curl/tests/data/test1060          |  833 +-
 third-party/curl/tests/data/test1061          |  847 +--
 third-party/curl/tests/data/test1062          |   11 +-
 third-party/curl/tests/data/test1063          |   17 +-
 third-party/curl/tests/data/test1064          |   16 +-
 third-party/curl/tests/data/test1065          |   16 +-
 third-party/curl/tests/data/test1066          |   53 +-
 third-party/curl/tests/data/test1067          |    9 +-
 third-party/curl/tests/data/test1068          |   27 +-
 third-party/curl/tests/data/test1069          |    5 +-
 third-party/curl/tests/data/test107           |    9 +-
 third-party/curl/tests/data/test1070          |   20 +-
 third-party/curl/tests/data/test1071          |   16 +-
 third-party/curl/tests/data/test1072          |   35 +-
 third-party/curl/tests/data/test1073          |   35 +-
 third-party/curl/tests/data/test1074          |   15 +-
 third-party/curl/tests/data/test1075          |   17 +-
 third-party/curl/tests/data/test1076          |   18 +-
 third-party/curl/tests/data/test1077          |   16 +-
 third-party/curl/tests/data/test1078          |   20 +-
 third-party/curl/tests/data/test1079          |   14 +-
 third-party/curl/tests/data/test108           |    9 +-
 third-party/curl/tests/data/test1080          |   13 +-
 third-party/curl/tests/data/test1081          |   15 +-
 third-party/curl/tests/data/test1082          |   16 +-
 third-party/curl/tests/data/test1083          |   18 +-
 third-party/curl/tests/data/test1084          |   14 +-
 third-party/curl/tests/data/test1085          |   18 +-
 third-party/curl/tests/data/test1086          |   71 +-
 third-party/curl/tests/data/test1087          |   22 +-
 third-party/curl/tests/data/test1088          |   24 +-
 third-party/curl/tests/data/test1089          |   18 +-
 third-party/curl/tests/data/test109           |    9 +-
 third-party/curl/tests/data/test1090          |   20 +-
 third-party/curl/tests/data/test1091          |    9 +-
 third-party/curl/tests/data/test1092          |   12 +-
 third-party/curl/tests/data/test1093          |   14 +-
 third-party/curl/tests/data/test1094          |   12 +-
 third-party/curl/tests/data/test1095          |   16 +-
 third-party/curl/tests/data/test1096          |   10 +-
 third-party/curl/tests/data/test1097          |   17 +-
 third-party/curl/tests/data/test1098          |   16 +-
 third-party/curl/tests/data/test1099          |   10 +-
 third-party/curl/tests/data/test11            |    9 +-
 third-party/curl/tests/data/test110           |    9 +-
 third-party/curl/tests/data/test1100          |   32 +-
 third-party/curl/tests/data/test1101          |   17 +-
 third-party/curl/tests/data/test1102          |    9 +-
 third-party/curl/tests/data/test1103          |    9 +-
 third-party/curl/tests/data/test1104          |    9 +-
 third-party/curl/tests/data/test1105          |   33 +-
 third-party/curl/tests/data/test1106          |   11 +-
 third-party/curl/tests/data/test1107          |    9 +-
 third-party/curl/tests/data/test1108          |   11 +-
 third-party/curl/tests/data/test1109          |   10 +-
 third-party/curl/tests/data/test111           |   10 +-
 third-party/curl/tests/data/test1110          |   10 +-
 third-party/curl/tests/data/test1111          |   10 +-
 third-party/curl/tests/data/test1112          |   72 +-
 third-party/curl/tests/data/test1113          |    7 +-
 third-party/curl/tests/data/test1114          |    9 +-
 third-party/curl/tests/data/test1115          |   12 +-
 third-party/curl/tests/data/test1116          |   24 +-
 third-party/curl/tests/data/test1117          |   17 +-
 third-party/curl/tests/data/test1118          |   12 +-
 third-party/curl/tests/data/test1119          |   12 +-
 third-party/curl/tests/data/test112           |   13 +-
 third-party/curl/tests/data/test1120          |   10 +-
 third-party/curl/tests/data/test1121          |   14 +-
 third-party/curl/tests/data/test1122          |   35 +-
 third-party/curl/tests/data/test1123          |  185 +-
 third-party/curl/tests/data/test1124          |   36 +-
 third-party/curl/tests/data/test1125          |   37 +-
 third-party/curl/tests/data/test1126          |   12 +-
 third-party/curl/tests/data/test1127          |   12 +-
 third-party/curl/tests/data/test1128          |   12 +-
 third-party/curl/tests/data/test1129          |   17 +-
 third-party/curl/tests/data/test113           |   10 +-
 third-party/curl/tests/data/test1130          |   19 +-
 third-party/curl/tests/data/test1131          |   19 +-
 third-party/curl/tests/data/test1132          |   53 +-
 third-party/curl/tests/data/test1133          |   92 +-
 third-party/curl/tests/data/test1134          |   16 +-
 third-party/curl/tests/data/test1135          |   21 +-
 third-party/curl/tests/data/test1136          |    2 +
 third-party/curl/tests/data/test1137          |    9 +-
 third-party/curl/tests/data/test1138          |   24 +-
 third-party/curl/tests/data/test1139          |    8 +-
 third-party/curl/tests/data/test114           |   10 +-
 third-party/curl/tests/data/test1140          |   12 +-
 third-party/curl/tests/data/test1141          |    9 +-
 third-party/curl/tests/data/test1142          |    9 +-
 third-party/curl/tests/data/test1143          |    9 +-
 third-party/curl/tests/data/test1144          |   18 +-
 third-party/curl/tests/data/test1145          |    3 +
 third-party/curl/tests/data/test1146          |    1 +
 third-party/curl/tests/data/test1147          |   16 +-
 third-party/curl/tests/data/test1148          |   16 +-
 third-party/curl/tests/data/test1149          |   18 +-
 third-party/curl/tests/data/test115           |   10 +-
 third-party/curl/tests/data/test1150          |    9 +-
 third-party/curl/tests/data/test1151          |   21 +-
 third-party/curl/tests/data/test1152          |   42 +-
 third-party/curl/tests/data/test1153          |   14 +-
 third-party/curl/tests/data/test1154          |   16 +-
 third-party/curl/tests/data/test1155          |   11 +-
 third-party/curl/tests/data/test1156          |   18 +-
 third-party/curl/tests/data/test1157          |   12 +-
 third-party/curl/tests/data/test1158          |   76 +-
 third-party/curl/tests/data/test1159          |   11 +-
 third-party/curl/tests/data/test116           |   12 +-
 third-party/curl/tests/data/test1160          |   14 +-
 third-party/curl/tests/data/test1161          |   11 +-
 third-party/curl/tests/data/test1162          |    4 +-
 third-party/curl/tests/data/test1163          |    4 +-
 third-party/curl/tests/data/test1164          |   25 +-
 third-party/curl/tests/data/test1165          |   12 +-
 third-party/curl/tests/data/test1166          |   11 +-
 third-party/curl/tests/data/test1167          |   12 +-
 third-party/curl/tests/data/test1168          |   13 +-
 third-party/curl/tests/data/test1169          |    5 +-
 third-party/curl/tests/data/test117           |   10 +-
 third-party/curl/tests/data/test1170          |   37 +-
 third-party/curl/tests/data/test1171          |   37 +-
 third-party/curl/tests/data/test1172          |   12 +-
 third-party/curl/tests/data/test1173          |   12 +-
 third-party/curl/tests/data/test1174          |   12 +-
 third-party/curl/tests/data/test1175          |   12 +-
 third-party/curl/tests/data/test1176          |   16 +-
 third-party/curl/tests/data/test1177          |   13 +-
 third-party/curl/tests/data/test1178          |   16 +-
 third-party/curl/tests/data/test1179          |    7 +-
 third-party/curl/tests/data/test118           |   10 +-
 third-party/curl/tests/data/test1180          |    9 +-
 third-party/curl/tests/data/test1181          |   13 +-
 third-party/curl/tests/data/test1182          |   12 +-
 third-party/curl/tests/data/test1183          |   11 +-
 third-party/curl/tests/data/test1184          |   22 +-
 third-party/curl/tests/data/test1185          |  125 +-
 third-party/curl/tests/data/test1186          |   76 +-
 third-party/curl/tests/data/test1187          |   28 +-
 third-party/curl/tests/data/test1188          |    9 +-
 third-party/curl/tests/data/test1189          |  107 +-
 third-party/curl/tests/data/test119           |   10 +-
 third-party/curl/tests/data/test1190          |    8 +-
 third-party/curl/tests/data/test1191          |    5 +-
 third-party/curl/tests/data/test1192          |   14 +-
 third-party/curl/tests/data/test1193          |   26 +-
 third-party/curl/tests/data/test1194          |   10 +-
 third-party/curl/tests/data/test1195          |    8 +-
 third-party/curl/tests/data/test1196          |   10 +-
 third-party/curl/tests/data/test1197          |   18 +-
 third-party/curl/tests/data/test1198          |    8 +-
 third-party/curl/tests/data/test1199          |    8 +-
 third-party/curl/tests/data/test12            |   11 +-
 third-party/curl/tests/data/test120           |    9 +-
 third-party/curl/tests/data/test1200          |   13 +-
 third-party/curl/tests/data/test1201          |   17 +-
 third-party/curl/tests/data/test1202          |   13 +-
 third-party/curl/tests/data/test1203          |   15 +-
 third-party/curl/tests/data/test1204          |   17 +-
 third-party/curl/tests/data/test1205          |   14 +-
 third-party/curl/tests/data/test1206          |   12 +-
 third-party/curl/tests/data/test1207          |   11 +-
 third-party/curl/tests/data/test1208          |   18 +-
 third-party/curl/tests/data/test1209          |   14 +-
 third-party/curl/tests/data/test121           |    9 +-
 third-party/curl/tests/data/test1210          |   16 +-
 third-party/curl/tests/data/test1211          |   14 +-
 third-party/curl/tests/data/test1212          |    9 +-
 third-party/curl/tests/data/test1213          |   11 +-
 third-party/curl/tests/data/test1214          |   11 +-
 third-party/curl/tests/data/test1215          |    5 +-
 third-party/curl/tests/data/test1216          |   13 +-
 third-party/curl/tests/data/test1217          |    9 +-
 third-party/curl/tests/data/test1218          |   13 +-
 third-party/curl/tests/data/test1219          |    9 +-
 third-party/curl/tests/data/test122           |    9 +-
 third-party/curl/tests/data/test1220          |    5 +-
 third-party/curl/tests/data/test1221          |   26 +-
 third-party/curl/tests/data/test1222          |   12 +-
 third-party/curl/tests/data/test1223          |   12 +-
 third-party/curl/tests/data/test1224          |    9 +-
 third-party/curl/tests/data/test1225          |    9 +-
 third-party/curl/tests/data/test1226          |    9 +-
 third-party/curl/tests/data/test1227          |    9 +-
 third-party/curl/tests/data/test1228          |    9 +-
 third-party/curl/tests/data/test1229          |   18 +-
 third-party/curl/tests/data/test123           |    9 +-
 third-party/curl/tests/data/test1230          |   20 +-
 third-party/curl/tests/data/test1231          |   12 +-
 third-party/curl/tests/data/test1232          |   12 +-
 third-party/curl/tests/data/test1233          |   13 +-
 third-party/curl/tests/data/test1234          |   11 +-
 third-party/curl/tests/data/test1235          |   15 +-
 third-party/curl/tests/data/test1236          |   11 +-
 third-party/curl/tests/data/test1237          |   15 +-
 third-party/curl/tests/data/test1238          |   13 +-
 third-party/curl/tests/data/test1239          |   12 +-
 third-party/curl/tests/data/test124           |    9 +-
 third-party/curl/tests/data/test1240          |    9 +-
 third-party/curl/tests/data/test1241          |   12 +-
 third-party/curl/tests/data/test1242          |   10 +-
 third-party/curl/tests/data/test1243          |    9 +-
 third-party/curl/tests/data/test1244          |    6 +-
 third-party/curl/tests/data/test1245          |    8 +-
 third-party/curl/tests/data/test1246          |   14 +-
 third-party/curl/tests/data/test1247          |   10 +-
 third-party/curl/tests/data/test1248          |    7 +-
 third-party/curl/tests/data/test1249          |    7 +-
 third-party/curl/tests/data/test125           |   10 +-
 third-party/curl/tests/data/test1250          |    7 +-
 third-party/curl/tests/data/test1251          |    7 +-
 third-party/curl/tests/data/test1252          |    5 +-
 third-party/curl/tests/data/test1253          |    5 +-
 third-party/curl/tests/data/test1254          |    5 +-
 third-party/curl/tests/data/test1255          |    6 +-
 third-party/curl/tests/data/test1256          |    6 +-
 third-party/curl/tests/data/test1257          |    6 +-
 third-party/curl/tests/data/test1258          |   11 +-
 third-party/curl/tests/data/test1259          |   13 +-
 third-party/curl/tests/data/test126           |    9 +-
 third-party/curl/tests/data/test1260          |   10 +-
 third-party/curl/tests/data/test1261          |   13 +-
 third-party/curl/tests/data/test1262          |    9 +-
 third-party/curl/tests/data/test1263          |   10 +-
 third-party/curl/tests/data/test1264          |   12 +-
 third-party/curl/tests/data/test1265          |    9 +-
 third-party/curl/tests/data/test1266          |   16 +-
 third-party/curl/tests/data/test1267          |   18 +-
 third-party/curl/tests/data/test1268          |   22 +-
 third-party/curl/tests/data/test1269          |   13 +-
 third-party/curl/tests/data/test127           |    9 +-
 third-party/curl/tests/data/test1270          |   13 +-
 third-party/curl/tests/data/test1271          |   11 +-
 third-party/curl/tests/data/test1272          |   13 +-
 third-party/curl/tests/data/test1273          |   19 +-
 third-party/curl/tests/data/test1274          |   51 +-
 third-party/curl/tests/data/test1275          |    8 +-
 third-party/curl/tests/data/test1276          |   12 +-
 third-party/curl/tests/data/test1277          |  191 +-
 third-party/curl/tests/data/test1278          |    6 +-
 third-party/curl/tests/data/test1279          |   14 +-
 third-party/curl/tests/data/test128           |   15 +-
 third-party/curl/tests/data/test1280          |   12 +-
 third-party/curl/tests/data/test1281          |   13 +-
 third-party/curl/tests/data/test1282          |   16 +-
 third-party/curl/tests/data/test1283          |    8 +-
 third-party/curl/tests/data/test1284          |   15 +-
 third-party/curl/tests/data/test1285          |   15 +-
 third-party/curl/tests/data/test1286          |   17 +-
 third-party/curl/tests/data/test1287          |   17 +-
 third-party/curl/tests/data/test1288          |   44 +-
 third-party/curl/tests/data/test1289          |    4 +-
 third-party/curl/tests/data/test129           |   12 +-
 third-party/curl/tests/data/test1290          |    4 +-
 third-party/curl/tests/data/test1291          |   12 +-
 third-party/curl/tests/data/test1292          |   14 +-
 third-party/curl/tests/data/test1293          |   18 +-
 third-party/curl/tests/data/test1294          |   17 +-
 third-party/curl/tests/data/test1295          |   17 +-
 third-party/curl/tests/data/test1296          |    6 +-
 third-party/curl/tests/data/test1297          |   10 +-
 third-party/curl/tests/data/test1298          |   12 +-
 third-party/curl/tests/data/test1299          |   12 +-
 third-party/curl/tests/data/test13            |   11 +-
 third-party/curl/tests/data/test130           |   19 +-
 third-party/curl/tests/data/test1300          |    9 +-
 third-party/curl/tests/data/test1301          |    9 +-
 third-party/curl/tests/data/test1302          |    9 +-
 third-party/curl/tests/data/test1303          |   13 +-
 third-party/curl/tests/data/test1304          |    9 +-
 third-party/curl/tests/data/test1305          |    9 +-
 third-party/curl/tests/data/test1306          |   12 +-
 third-party/curl/tests/data/test1307          |    9 +-
 third-party/curl/tests/data/test1308          |   16 +-
 third-party/curl/tests/data/test1309          |    9 +-
 third-party/curl/tests/data/test131           |   19 +-
 third-party/curl/tests/data/test1310          |  129 +-
 third-party/curl/tests/data/test1311          |   16 +-
 third-party/curl/tests/data/test1312          |   16 +-
 third-party/curl/tests/data/test1313          |   16 +-
 third-party/curl/tests/data/test1314          |    9 +-
 third-party/curl/tests/data/test1315          |   71 +-
 third-party/curl/tests/data/test1316          |   26 +-
 third-party/curl/tests/data/test1317          |    6 +-
 third-party/curl/tests/data/test1318          |   14 +-
 third-party/curl/tests/data/test1319          |   20 +-
 third-party/curl/tests/data/test132           |   18 +-
 third-party/curl/tests/data/test1320          |   24 +-
 third-party/curl/tests/data/test1321          |   20 +-
 third-party/curl/tests/data/test1322          |    8 +-
 third-party/curl/tests/data/test1323          |    7 +-
 third-party/curl/tests/data/test1324          |   11 +-
 third-party/curl/tests/data/test1325          |   18 +-
 third-party/curl/tests/data/test1326          |   14 +-
 third-party/curl/tests/data/test1327          |   16 +-
 third-party/curl/tests/data/test1328          |   13 +-
 third-party/curl/tests/data/test1329          |    9 +-
 third-party/curl/tests/data/test133           |   18 +-
 third-party/curl/tests/data/test1330          |   11 +-
 third-party/curl/tests/data/test1331          |   21 +-
 third-party/curl/tests/data/test1332          |   18 +-
 third-party/curl/tests/data/test1333          |   14 +-
 third-party/curl/tests/data/test1334          |   20 +-
 third-party/curl/tests/data/test1335          |   20 +-
 third-party/curl/tests/data/test1336          |   27 +-
 third-party/curl/tests/data/test1337          |   27 +-
 third-party/curl/tests/data/test1338          |   20 +-
 third-party/curl/tests/data/test1339          |   20 +-
 third-party/curl/tests/data/test134           |   12 +-
 third-party/curl/tests/data/test1340          |   22 +-
 third-party/curl/tests/data/test1341          |   22 +-
 third-party/curl/tests/data/test1342          |   22 +-
 third-party/curl/tests/data/test1343          |   22 +-
 third-party/curl/tests/data/test1344          |   29 +-
 third-party/curl/tests/data/test1345          |   29 +-
 third-party/curl/tests/data/test1346          |   20 +-
 third-party/curl/tests/data/test1347          |   26 +-
 third-party/curl/tests/data/test1348          |   13 +-
 third-party/curl/tests/data/test1349          |   27 +-
 third-party/curl/tests/data/test135           |    9 +-
 third-party/curl/tests/data/test1350          |   27 +-
 third-party/curl/tests/data/test1351          |   27 +-
 third-party/curl/tests/data/test1352          |   27 +-
 third-party/curl/tests/data/test1353          |   27 +-
 third-party/curl/tests/data/test1354          |   23 +-
 third-party/curl/tests/data/test1355          |   13 +-
 third-party/curl/tests/data/test1356          |   24 +-
 third-party/curl/tests/data/test1357          |   30 +-
 third-party/curl/tests/data/test1358          |   29 +-
 third-party/curl/tests/data/test1359          |   29 +-
 third-party/curl/tests/data/test136           |   11 +-
 third-party/curl/tests/data/test1360          |   29 +-
 third-party/curl/tests/data/test1361          |   29 +-
 third-party/curl/tests/data/test1362          |   29 +-
 third-party/curl/tests/data/test1363          |   23 +-
 third-party/curl/tests/data/test1364          |   16 +-
 third-party/curl/tests/data/test1365          |   16 +-
 third-party/curl/tests/data/test1366          |   17 +-
 third-party/curl/tests/data/test1367          |   17 +-
 third-party/curl/tests/data/test1368          |   16 +-
 third-party/curl/tests/data/test1369          |   16 +-
 third-party/curl/tests/data/test137           |    9 +-
 third-party/curl/tests/data/test1370          |   17 +-
 third-party/curl/tests/data/test1371          |   17 +-
 third-party/curl/tests/data/test1372          |   18 +-
 third-party/curl/tests/data/test1373          |   18 +-
 third-party/curl/tests/data/test1374          |   19 +-
 third-party/curl/tests/data/test1375          |   19 +-
 third-party/curl/tests/data/test1376          |   16 +-
 third-party/curl/tests/data/test1377          |   17 +-
 third-party/curl/tests/data/test1378          |    9 +-
 third-party/curl/tests/data/test1379          |   19 +-
 third-party/curl/tests/data/test138           |    9 +-
 third-party/curl/tests/data/test1380          |   19 +-
 third-party/curl/tests/data/test1381          |   19 +-
 third-party/curl/tests/data/test1382          |   19 +-
 third-party/curl/tests/data/test1383          |   19 +-
 third-party/curl/tests/data/test1384          |   19 +-
 third-party/curl/tests/data/test1385          |    9 +-
 third-party/curl/tests/data/test1386          |   14 +-
 third-party/curl/tests/data/test1387          |   24 +-
 third-party/curl/tests/data/test1388          |   24 +-
 third-party/curl/tests/data/test1389          |   26 +-
 third-party/curl/tests/data/test139           |    9 +-
 third-party/curl/tests/data/test1390          |   24 +-
 third-party/curl/tests/data/test1391          |   24 +-
 third-party/curl/tests/data/test1392          |   24 +-
 third-party/curl/tests/data/test1393          |   14 +-
 third-party/curl/tests/data/test1394          |   12 +-
 third-party/curl/tests/data/test1395          |    9 +-
 third-party/curl/tests/data/test1396          |    9 +-
 third-party/curl/tests/data/test1397          |    5 +-
 third-party/curl/tests/data/test1398          |    9 +-
 third-party/curl/tests/data/test1399          |    9 +-
 third-party/curl/tests/data/test14            |    9 +-
 third-party/curl/tests/data/test140           |    9 +-
 third-party/curl/tests/data/test1400          |   69 +-
 third-party/curl/tests/data/test1401          |   81 +-
 third-party/curl/tests/data/test1402          |   74 +-
 third-party/curl/tests/data/test1403          |   72 +-
 third-party/curl/tests/data/test1404          |  180 +-
 third-party/curl/tests/data/test1405          |   91 +-
 third-party/curl/tests/data/test1406          |   95 +-
 third-party/curl/tests/data/test1407          |   74 +-
 third-party/curl/tests/data/test1408          |   16 +-
 third-party/curl/tests/data/test1409          |   14 +-
 third-party/curl/tests/data/test141           |   11 +-
 third-party/curl/tests/data/test1410          |   14 +-
 third-party/curl/tests/data/test1411          |   16 +-
 third-party/curl/tests/data/test1412          |   22 +-
 third-party/curl/tests/data/test1413          |   18 +-
 third-party/curl/tests/data/test1414          |   13 +-
 third-party/curl/tests/data/test1415          |   15 +-
 third-party/curl/tests/data/test1416          |   28 +-
 third-party/curl/tests/data/test1417          |   40 +-
 third-party/curl/tests/data/test1418          |   22 +-
 third-party/curl/tests/data/test1419          |   15 +-
 third-party/curl/tests/data/test142           |   13 +-
 third-party/curl/tests/data/test1420          |   75 +-
 third-party/curl/tests/data/test1421          |   14 +-
 third-party/curl/tests/data/test1422          |   17 +-
 third-party/curl/tests/data/test1423          |   17 +-
 third-party/curl/tests/data/test1424          |    6 +-
 third-party/curl/tests/data/test1425          |  Bin 1735 -> 1296 bytes
 third-party/curl/tests/data/test1426          |  Bin 1672 -> 1244 bytes
 third-party/curl/tests/data/test1427          |   12 +-
 third-party/curl/tests/data/test1428          |   22 +-
 third-party/curl/tests/data/test1429          |   13 +-
 third-party/curl/tests/data/test143           |    9 +-
 third-party/curl/tests/data/test1430          |   11 +-
 third-party/curl/tests/data/test1431          |   11 +-
 third-party/curl/tests/data/test1432          |    9 +-
 third-party/curl/tests/data/test1433          |    9 +-
 third-party/curl/tests/data/test1434          |   29 +-
 third-party/curl/tests/data/test1435          |   13 +-
 third-party/curl/tests/data/test1436          |   13 +-
 third-party/curl/tests/data/test1437          |   16 +-
 third-party/curl/tests/data/test1438          |    5 +-
 third-party/curl/tests/data/test1439          |    3 +-
 third-party/curl/tests/data/test144           |    9 +-
 third-party/curl/tests/data/test1440          |    3 +-
 third-party/curl/tests/data/test1441          |    3 +-
 third-party/curl/tests/data/test1442          |    3 +-
 third-party/curl/tests/data/test1443          |   24 +-
 third-party/curl/tests/data/test1444          |   19 +-
 third-party/curl/tests/data/test1445          |   16 +-
 third-party/curl/tests/data/test1446          |   24 +-
 third-party/curl/tests/data/test1447          |   16 +-
 third-party/curl/tests/data/test1448          |   29 +-
 third-party/curl/tests/data/test1449          |    9 +-
 third-party/curl/tests/data/test145           |    9 +-
 third-party/curl/tests/data/test1450          |   10 +-
 third-party/curl/tests/data/test1451          |    7 +-
 third-party/curl/tests/data/test1452          |   10 +-
 third-party/curl/tests/data/test1453          |   18 +-
 third-party/curl/tests/data/test1454          |   10 +-
 third-party/curl/tests/data/test1455          |    6 +-
 third-party/curl/tests/data/test1456          |   16 +-
 third-party/curl/tests/data/test1457          |    3 +-
 third-party/curl/tests/data/test1458          |    6 +-
 third-party/curl/tests/data/test1459          |   29 +-
 third-party/curl/tests/data/test146           |    9 +-
 third-party/curl/tests/data/test1460          |   25 +-
 third-party/curl/tests/data/test1461          |   34 +-
 third-party/curl/tests/data/test1462          |   61 +-
 third-party/curl/tests/data/test1463          |   19 +-
 third-party/curl/tests/data/test1464          |   19 +-
 third-party/curl/tests/data/test1465          |   71 +-
 third-party/curl/tests/data/test1466          |    9 +-
 third-party/curl/tests/data/test1467          |   20 +-
 third-party/curl/tests/data/test1468          |   20 +-
 third-party/curl/tests/data/test1469          |   11 +-
 third-party/curl/tests/data/test147           |    9 +-
 third-party/curl/tests/data/test1470          |   22 +-
 third-party/curl/tests/data/test1471          |   10 +-
 third-party/curl/tests/data/test1472          |   10 +-
 third-party/curl/tests/data/test1473          |   20 +-
 third-party/curl/tests/data/test1474          |  106 +-
 third-party/curl/tests/data/test1475          |   84 +
 third-party/curl/tests/data/test1476          |   60 +
 third-party/curl/tests/data/test1477          |   26 +
 third-party/curl/tests/data/test1478          |   28 +
 third-party/curl/tests/data/test1479          |   59 +
 third-party/curl/tests/data/test148           |    9 +-
 third-party/curl/tests/data/test1480          |   51 +
 third-party/curl/tests/data/test1481          |   69 +
 third-party/curl/tests/data/test1482          |   79 +
 third-party/curl/tests/data/test1483          |   82 +
 third-party/curl/tests/data/test1484          |   51 +
 third-party/curl/tests/data/test1485          |   52 +
 third-party/curl/tests/data/test1486          |   28 +
 third-party/curl/tests/data/test1487          |   52 +
 third-party/curl/tests/data/test1488          |   27 +
 third-party/curl/tests/data/test1489          |   64 +
 third-party/curl/tests/data/test149           |    9 +-
 third-party/curl/tests/data/test1490          |   44 +
 third-party/curl/tests/data/test1491          |   38 +
 third-party/curl/tests/data/test1492          |   61 +
 third-party/curl/tests/data/test1493          |   76 +
 third-party/curl/tests/data/test1494          |   48 +
 third-party/curl/tests/data/test1495          |   51 +
 third-party/curl/tests/data/test1496          |   51 +
 third-party/curl/tests/data/test1497          |   59 +
 third-party/curl/tests/data/test1498          |   60 +
 third-party/curl/tests/data/test1499          |   74 +
 third-party/curl/tests/data/test15            |   13 +-
 third-party/curl/tests/data/test150           |   11 +-
 third-party/curl/tests/data/test1500          |    9 +-
 third-party/curl/tests/data/test1501          |    9 +-
 third-party/curl/tests/data/test1502          |   13 +-
 third-party/curl/tests/data/test1503          |   15 +-
 third-party/curl/tests/data/test1504          |   15 +-
 third-party/curl/tests/data/test1505          |   15 +-
 third-party/curl/tests/data/test1506          |   33 +-
 third-party/curl/tests/data/test1507          |   16 +-
 third-party/curl/tests/data/test1508          |   11 +-
 third-party/curl/tests/data/test1509          |   19 +-
 third-party/curl/tests/data/test151           |   13 +-
 third-party/curl/tests/data/test1510          |   30 +-
 third-party/curl/tests/data/test1511          |    9 +-
 third-party/curl/tests/data/test1512          |   21 +-
 third-party/curl/tests/data/test1513          |   13 +-
 third-party/curl/tests/data/test1514          |    5 +-
 third-party/curl/tests/data/test1515          |    4 +-
 third-party/curl/tests/data/test1516          |    8 +-
 third-party/curl/tests/data/test1517          |   23 +-
 third-party/curl/tests/data/test1518          |   14 +-
 third-party/curl/tests/data/test1519          |   14 +-
 third-party/curl/tests/data/test152           |   13 +-
 third-party/curl/tests/data/test1520          |   21 +-
 third-party/curl/tests/data/test1521          |   16 +-
 third-party/curl/tests/data/test1522          |    3 +-
 third-party/curl/tests/data/test1523          |    3 +-
 third-party/curl/tests/data/test1524          |   18 +-
 third-party/curl/tests/data/test1525          |   19 +-
 third-party/curl/tests/data/test1526          |   19 +-
 third-party/curl/tests/data/test1527          |   21 +-
 third-party/curl/tests/data/test1528          |   15 +-
 third-party/curl/tests/data/test1529          |   11 +-
 third-party/curl/tests/data/test153           |   27 +-
 third-party/curl/tests/data/test1530          |    8 +-
 third-party/curl/tests/data/test1531          |  Bin 573 -> 632 bytes
 third-party/curl/tests/data/test1532          |    7 +-
 third-party/curl/tests/data/test1533          |    9 +-
 third-party/curl/tests/data/test1534          |    7 +-
 third-party/curl/tests/data/test1535          |    5 +-
 third-party/curl/tests/data/test1536          |    5 +-
 third-party/curl/tests/data/test1537          |    9 +-
 third-party/curl/tests/data/test1538          |   43 +-
 third-party/curl/tests/data/test1539          |    5 +-
 third-party/curl/tests/data/test154           |   16 +-
 third-party/curl/tests/data/test1540          |   43 +-
 third-party/curl/tests/data/test1541          |   75 +
 third-party/curl/tests/data/test1542          |   27 +-
 third-party/curl/tests/data/test1543          |   10 +-
 third-party/curl/tests/data/test1544          |   12 +-
 third-party/curl/tests/data/test1545          |   37 +
 third-party/curl/tests/data/test1546          |   61 +
 third-party/curl/tests/data/test1547          |   54 +
 third-party/curl/tests/data/test1548          |   41 +
 third-party/curl/tests/data/test1549          |   57 +
 third-party/curl/tests/data/test155           |   13 +-
 third-party/curl/tests/data/test1550          |   13 +-
 third-party/curl/tests/data/test1551          |    9 +-
 third-party/curl/tests/data/test1552          |   14 +-
 third-party/curl/tests/data/test1553          |   16 +-
 third-party/curl/tests/data/test1554          |  105 +-
 third-party/curl/tests/data/test1555          |   13 +-
 third-party/curl/tests/data/test1556          |   14 +-
 third-party/curl/tests/data/test1557          |    9 +-
 third-party/curl/tests/data/test1558          |    5 +-
 third-party/curl/tests/data/test1559          |    9 +-
 third-party/curl/tests/data/test156           |   11 +-
 third-party/curl/tests/data/test1560          |   17 +-
 third-party/curl/tests/data/test1561          |    9 +-
 third-party/curl/tests/data/test1562          |    5 +-
 third-party/curl/tests/data/test1563          |    3 +-
 third-party/curl/tests/data/test1564          |    6 +-
 third-party/curl/tests/data/test1565          |    3 +-
 third-party/curl/tests/data/test1566          |    8 +-
 third-party/curl/tests/data/test1567          |    9 +-
 third-party/curl/tests/data/test1568          |   10 +-
 third-party/curl/tests/data/test1569          |    7 +-
 third-party/curl/tests/data/test157           |   13 +-
 third-party/curl/tests/data/test1570          |    7 +-
 third-party/curl/tests/data/test1571          |   92 +
 third-party/curl/tests/data/test1572          |   94 +
 third-party/curl/tests/data/test1573          |   89 +
 third-party/curl/tests/data/test1574          |   89 +
 third-party/curl/tests/data/test1575          |   94 +
 third-party/curl/tests/data/test1576          |   92 +
 third-party/curl/tests/data/test1577          |   92 +
 third-party/curl/tests/data/test1578          |   92 +
 third-party/curl/tests/data/test1579          |   90 +
 third-party/curl/tests/data/test158           |   13 +-
 third-party/curl/tests/data/test1580          |   92 +
 third-party/curl/tests/data/test1581          |   94 +
 third-party/curl/tests/data/test1582          |   55 +
 third-party/curl/tests/data/test1583          |   36 +
 third-party/curl/tests/data/test1584          |   53 +
 third-party/curl/tests/data/test1585          |   53 +
 third-party/curl/tests/data/test1586          |   73 +
 third-party/curl/tests/data/test1587          |   51 +
 third-party/curl/tests/data/test1588          |  106 +
 third-party/curl/tests/data/test1589          |  108 +
 third-party/curl/tests/data/test159           |   26 +-
 third-party/curl/tests/data/test1590          |   14 +-
 third-party/curl/tests/data/test1591          |    7 +-
 third-party/curl/tests/data/test1592          |   16 +-
 third-party/curl/tests/data/test1593          |    3 +-
 third-party/curl/tests/data/test1594          |    3 +-
 third-party/curl/tests/data/test1595          |    3 +-
 third-party/curl/tests/data/test1596          |   12 +-
 third-party/curl/tests/data/test1597          |    7 +-
 third-party/curl/tests/data/test1598          |   60 +
 third-party/curl/tests/data/test1599          |   43 +
 third-party/curl/tests/data/test16            |   15 +-
 third-party/curl/tests/data/test160           |   15 +-
 third-party/curl/tests/data/test1600          |    9 +-
 third-party/curl/tests/data/test1601          |    9 +-
 third-party/curl/tests/data/test1602          |    9 +-
 third-party/curl/tests/data/test1603          |    9 +-
 third-party/curl/tests/data/test1604          |   14 +-
 third-party/curl/tests/data/test1605          |    9 +-
 third-party/curl/tests/data/test1606          |    9 +-
 third-party/curl/tests/data/test1607          |    9 +-
 third-party/curl/tests/data/test1608          |    9 +-
 third-party/curl/tests/data/test1609          |   22 -
 third-party/curl/tests/data/test161           |   14 +-
 third-party/curl/tests/data/test1610          |    9 +-
 third-party/curl/tests/data/test1611          |    9 +-
 third-party/curl/tests/data/test1612          |    9 +-
 third-party/curl/tests/data/test1613          |    7 +-
 third-party/curl/tests/data/test1614          |   10 +-
 third-party/curl/tests/data/test1615          |   20 +
 third-party/curl/tests/data/test1616          |   19 +
 third-party/curl/tests/data/test1617          |   73 +
 third-party/curl/tests/data/test1618          |   68 +
 third-party/curl/tests/data/test1619          |   45 +
 third-party/curl/tests/data/test162           |   18 +-
 third-party/curl/tests/data/test1620          |    9 +-
 third-party/curl/tests/data/test1621          |   13 +-
 third-party/curl/tests/data/test1622          |  160 +
 third-party/curl/tests/data/test1623          |   25 +
 third-party/curl/tests/data/test1624          |   57 +
 third-party/curl/tests/data/test1625          |   25 +
 third-party/curl/tests/data/test1626          |   25 +
 third-party/curl/tests/data/test1627          |   24 +
 third-party/curl/tests/data/test1628          |   53 +
 third-party/curl/tests/data/test1629          |   54 +
 third-party/curl/tests/data/test163           |   45 +-
 third-party/curl/tests/data/test1630          |   19 +-
 third-party/curl/tests/data/test1631          |   27 +-
 third-party/curl/tests/data/test1632          |   29 +-
 third-party/curl/tests/data/test1633          |    6 +-
 third-party/curl/tests/data/test1634          |    8 +-
 third-party/curl/tests/data/test1635          |    8 +-
 third-party/curl/tests/data/test1636          |  161 +
 third-party/curl/tests/data/test1637          |   58 +
 third-party/curl/tests/data/test1638          |   79 +
 third-party/curl/tests/data/test1639          |   65 +
 third-party/curl/tests/data/test164           |   49 +-
 third-party/curl/tests/data/test1640          |   51 +
 third-party/curl/tests/data/test1641          |   62 +
 third-party/curl/tests/data/test1642          |   61 +
 third-party/curl/tests/data/test1643          |   71 +
 third-party/curl/tests/data/test1644          |   65 +
 third-party/curl/tests/data/test1645          |   74 +
 third-party/curl/tests/data/test1646          |   46 +
 third-party/curl/tests/data/test1647          |  103 +
 third-party/curl/tests/data/test1648          |   63 +
 third-party/curl/tests/data/test1649          |   55 +
 third-party/curl/tests/data/test165           |   27 +-
 third-party/curl/tests/data/test1650          |   11 +-
 third-party/curl/tests/data/test1651          |   16 +-
 third-party/curl/tests/data/test1652          |    5 +-
 third-party/curl/tests/data/test1653          |    4 +-
 third-party/curl/tests/data/test1654          |   28 +-
 third-party/curl/tests/data/test1655          |   13 +-
 third-party/curl/tests/data/test1656          |   19 +
 third-party/curl/tests/data/test1657          |   19 +
 third-party/curl/tests/data/test1658          |   27 +
 third-party/curl/tests/data/test1659          |   27 +
 third-party/curl/tests/data/test166           |   33 +-
 third-party/curl/tests/data/test1660          |    6 +-
 third-party/curl/tests/data/test1661          |    9 +-
 third-party/curl/tests/data/test1662          |    6 +-
 third-party/curl/tests/data/test1663          |   20 +
 third-party/curl/tests/data/test1664          |  242 +
 third-party/curl/tests/data/test1665          |   51 +
 third-party/curl/tests/data/test1666          |   20 +
 third-party/curl/tests/data/test1667          |   20 +
 third-party/curl/tests/data/test1668          |   21 +
 third-party/curl/tests/data/test1669          |   37 +
 third-party/curl/tests/data/test167           |   24 +-
 third-party/curl/tests/data/test1670          |    6 +-
 third-party/curl/tests/data/test1671          |    6 +-
 third-party/curl/tests/data/test1672          |   55 +
 third-party/curl/tests/data/test1673          |   25 +
 third-party/curl/tests/data/test1674          |   38 +
 third-party/curl/tests/data/test1675          |   18 +
 third-party/curl/tests/data/test1676          |   21 +
 third-party/curl/tests/data/test1677          |   77 +
 third-party/curl/tests/data/test168           |   22 +-
 third-party/curl/tests/data/test1680          |    4 +-
 third-party/curl/tests/data/test1681          |    4 +-
 third-party/curl/tests/data/test1682          |    4 +-
 third-party/curl/tests/data/test1683          |   14 +-
 third-party/curl/tests/data/test1684          |   46 +
 third-party/curl/tests/data/test1685          |   57 +
 third-party/curl/tests/data/test1686          |   84 +
 third-party/curl/tests/data/test169           |   20 +-
 third-party/curl/tests/data/test17            |   18 +-
 third-party/curl/tests/data/test170           |   11 +-
 third-party/curl/tests/data/test1700          |   23 +-
 third-party/curl/tests/data/test1701          |   19 +-
 third-party/curl/tests/data/test1702          |   19 +-
 third-party/curl/tests/data/test1703          |    3 +-
 third-party/curl/tests/data/test1704          |   64 +
 third-party/curl/tests/data/test1705          |   57 +
 third-party/curl/tests/data/test1706          |   58 +
 third-party/curl/tests/data/test1707          |   24 +
 third-party/curl/tests/data/test1708          |   24 +
 third-party/curl/tests/data/test1709          |   29 +
 third-party/curl/tests/data/test171           |   11 +-
 third-party/curl/tests/data/test1710          |   24 +
 third-party/curl/tests/data/test1711          |   49 +
 third-party/curl/tests/data/test1712          |   61 +
 third-party/curl/tests/data/test1713          |   36 +
 third-party/curl/tests/data/test1714          |   56 +
 third-party/curl/tests/data/test1715          |   54 +
 third-party/curl/tests/data/test172           |   11 +-
 third-party/curl/tests/data/test1720          |   24 +
 third-party/curl/tests/data/test1721          |   45 +
 third-party/curl/tests/data/test1722          |   61 +
 third-party/curl/tests/data/test1723          |   61 +
 third-party/curl/tests/data/test1724          |   53 +
 third-party/curl/tests/data/test1725          |   29 +
 third-party/curl/tests/data/test173           |   43 +-
 third-party/curl/tests/data/test174           |   14 +-
 third-party/curl/tests/data/test175           |   21 +-
 third-party/curl/tests/data/test176           |   21 +-
 third-party/curl/tests/data/test177           |   13 +-
 third-party/curl/tests/data/test178           |   23 +-
 third-party/curl/tests/data/test179           |    9 +-
 third-party/curl/tests/data/test18            |   17 +-
 third-party/curl/tests/data/test180           |    9 +-
 third-party/curl/tests/data/test1800          |   13 +-
 third-party/curl/tests/data/test1801          |    9 +-
 third-party/curl/tests/data/test1802          |   62 +
 third-party/curl/tests/data/test181           |    9 +-
 third-party/curl/tests/data/test182           |    3 +-
 third-party/curl/tests/data/test183           |   11 +-
 third-party/curl/tests/data/test184           |   15 +-
 third-party/curl/tests/data/test1847          |   58 +
 third-party/curl/tests/data/test1848          |   51 +
 third-party/curl/tests/data/test1849          |   89 +
 third-party/curl/tests/data/test185           |   15 +-
 third-party/curl/tests/data/test1850          |   39 +
 third-party/curl/tests/data/test1851          |   55 +
 third-party/curl/tests/data/test186           |   15 +-
 third-party/curl/tests/data/test187           |   11 +-
 third-party/curl/tests/data/test188           |   13 +-
 third-party/curl/tests/data/test189           |   15 +-
 third-party/curl/tests/data/test19            |   15 +-
 third-party/curl/tests/data/test190           |   12 +-
 third-party/curl/tests/data/test1900          |   36 +
 third-party/curl/tests/data/test1901          |   61 +
 third-party/curl/tests/data/test1902          |   44 +
 third-party/curl/tests/data/test1903          |   20 +-
 third-party/curl/tests/data/test1904          |   20 +-
 third-party/curl/tests/data/test1905          |   11 +-
 third-party/curl/tests/data/test1906          |    7 +-
 third-party/curl/tests/data/test1907          |    7 +-
 third-party/curl/tests/data/test1908          |    9 +-
 third-party/curl/tests/data/test1909          |   12 +-
 third-party/curl/tests/data/test191           |    9 +-
 third-party/curl/tests/data/test1910          |    7 +-
 third-party/curl/tests/data/test1911          |    4 +-
 third-party/curl/tests/data/test1912          |    4 +-
 third-party/curl/tests/data/test1913          |    3 +-
 third-party/curl/tests/data/test1914          |    3 +-
 third-party/curl/tests/data/test1915          |   13 +-
 third-party/curl/tests/data/test1916          |    8 +-
 third-party/curl/tests/data/test1917          |   12 +-
 third-party/curl/tests/data/test1918          |    4 +-
 third-party/curl/tests/data/test1919          |    5 +-
 third-party/curl/tests/data/test192           |   12 +-
 third-party/curl/tests/data/test1920          |   65 +
 third-party/curl/tests/data/test1921          |   30 +
 third-party/curl/tests/data/test1922          |   91 +
 third-party/curl/tests/data/test193           |   12 +-
 third-party/curl/tests/data/test1933          |   10 +-
 third-party/curl/tests/data/test1934          |   10 +-
 third-party/curl/tests/data/test1935          |   10 +-
 third-party/curl/tests/data/test1936          |   10 +-
 third-party/curl/tests/data/test1937          |   10 +-
 third-party/curl/tests/data/test1938          |  Bin 1308 -> 1377 bytes
 third-party/curl/tests/data/test1939          |    1 +
 third-party/curl/tests/data/test194           |   16 +-
 third-party/curl/tests/data/test1940          |   13 +-
 third-party/curl/tests/data/test1941          |   14 +-
 third-party/curl/tests/data/test1942          |    3 +-
 third-party/curl/tests/data/test1943          |   31 +-
 third-party/curl/tests/data/test1944          |    3 +-
 third-party/curl/tests/data/test1945          |    7 +-
 third-party/curl/tests/data/test1946          |    5 +-
 third-party/curl/tests/data/test1947          |    3 +-
 third-party/curl/tests/data/test1948          |    9 +-
 third-party/curl/tests/data/test195           |    9 +-
 third-party/curl/tests/data/test1955          |   15 +-
 third-party/curl/tests/data/test1956          |   13 +-
 third-party/curl/tests/data/test1957          |   13 +-
 third-party/curl/tests/data/test1958          |   16 +-
 third-party/curl/tests/data/test1959          |   13 +-
 third-party/curl/tests/data/test196           |   14 +-
 third-party/curl/tests/data/test1960          |    7 +-
 third-party/curl/tests/data/test1964          |    9 +-
 third-party/curl/tests/data/test1965          |   44 +
 third-party/curl/tests/data/test1966          |  118 +
 third-party/curl/tests/data/test1967          |   30 +
 third-party/curl/tests/data/test197           |   12 +-
 third-party/curl/tests/data/test1970          |   13 +-
 third-party/curl/tests/data/test1971          |   13 +-
 third-party/curl/tests/data/test1972          |   18 +-
 third-party/curl/tests/data/test1973          |   13 +-
 third-party/curl/tests/data/test1974          |   13 +-
 third-party/curl/tests/data/test1975          |   13 +-
 third-party/curl/tests/data/test1976          |   63 +
 third-party/curl/tests/data/test1977          |   63 +
 third-party/curl/tests/data/test1978          |   75 +
 third-party/curl/tests/data/test1979          |   20 +
 third-party/curl/tests/data/test198           |   12 +-
 third-party/curl/tests/data/test1980          |   20 +
 third-party/curl/tests/data/test1981          |   61 +
 third-party/curl/tests/data/test1982          |   53 +
 third-party/curl/tests/data/test1983          |   71 +
 third-party/curl/tests/data/test1984          |   76 +
 third-party/curl/tests/data/test199           |   18 +-
 third-party/curl/tests/data/test2             |   20 +-
 third-party/curl/tests/data/test20            |   15 +-
 third-party/curl/tests/data/test200           |    5 +-
 third-party/curl/tests/data/test2000          |   10 +-
 third-party/curl/tests/data/test2001          |   12 +-
 third-party/curl/tests/data/test2002          |   36 +-
 third-party/curl/tests/data/test2003          |   63 +-
 third-party/curl/tests/data/test2004          |   22 +-
 third-party/curl/tests/data/test2005          |   53 +
 third-party/curl/tests/data/test2006          |   98 +
 third-party/curl/tests/data/test2007          |   32 +
 third-party/curl/tests/data/test2008          |   50 +
 third-party/curl/tests/data/test2009          |   70 +
 third-party/curl/tests/data/test201           |   10 +-
 third-party/curl/tests/data/test2010          |   71 +
 third-party/curl/tests/data/test2011          |   70 +
 third-party/curl/tests/data/test2012          |   90 +
 third-party/curl/tests/data/test2013          |   85 +
 third-party/curl/tests/data/test2014          |   97 +
 third-party/curl/tests/data/test2015          |   92 +
 third-party/curl/tests/data/test202           |    5 +-
 third-party/curl/tests/data/test2023          |   42 +-
 third-party/curl/tests/data/test2024          |   39 +-
 third-party/curl/tests/data/test2025          |   41 +-
 third-party/curl/tests/data/test2026          |   45 +-
 third-party/curl/tests/data/test2027          |   51 +-
 third-party/curl/tests/data/test2028          |   42 +-
 third-party/curl/tests/data/test2029          |   37 +-
 third-party/curl/tests/data/test203           |    5 +-
 third-party/curl/tests/data/test2030          |   49 +-
 third-party/curl/tests/data/test2031          |   47 +-
 third-party/curl/tests/data/test2032          |   22 +-
 third-party/curl/tests/data/test2033          |   27 +-
 third-party/curl/tests/data/test2034          |   21 +-
 third-party/curl/tests/data/test2035          |   19 +-
 third-party/curl/tests/data/test2036          |   28 +-
 third-party/curl/tests/data/test2037          |   21 +-
 third-party/curl/tests/data/test2038          |   19 +-
 third-party/curl/tests/data/test2039          |   18 +-
 third-party/curl/tests/data/test204           |    5 +-
 third-party/curl/tests/data/test2040          |    5 +-
 third-party/curl/tests/data/test2041          |   21 +-
 third-party/curl/tests/data/test2042          |   19 +-
 third-party/curl/tests/data/test2043          |   12 +-
 third-party/curl/tests/data/test2044          |    9 +-
 third-party/curl/tests/data/test2045          |   28 +-
 third-party/curl/tests/data/test2046          |   27 +-
 third-party/curl/tests/data/test2047          |   27 +-
 third-party/curl/tests/data/test2048          |    8 +-
 third-party/curl/tests/data/test2049          |   17 +-
 third-party/curl/tests/data/test205           |   10 +-
 third-party/curl/tests/data/test2050          |   25 +-
 third-party/curl/tests/data/test2051          |   18 +-
 third-party/curl/tests/data/test2052          |   20 +-
 third-party/curl/tests/data/test2053          |   17 +-
 third-party/curl/tests/data/test2054          |   28 +-
 third-party/curl/tests/data/test2055          |   25 +-
 third-party/curl/tests/data/test2056          |    9 +-
 third-party/curl/tests/data/test2057          |   13 +-
 third-party/curl/tests/data/test2058          |   23 +-
 third-party/curl/tests/data/test2059          |   23 +-
 third-party/curl/tests/data/test206           |   31 +-
 third-party/curl/tests/data/test2060          |   25 +-
 third-party/curl/tests/data/test2061          |   16 +-
 third-party/curl/tests/data/test2062          |   18 +-
 third-party/curl/tests/data/test2063          |   16 +-
 third-party/curl/tests/data/test2064          |   16 +-
 third-party/curl/tests/data/test2065          |   20 +-
 third-party/curl/tests/data/test2066          |   18 +-
 third-party/curl/tests/data/test2067          |   15 +-
 third-party/curl/tests/data/test2068          |   19 +-
 third-party/curl/tests/data/test2069          |   17 +-
 third-party/curl/tests/data/test207           |   22 +-
 third-party/curl/tests/data/test2070          |   27 +-
 third-party/curl/tests/data/test2071          |    5 +-
 third-party/curl/tests/data/test2072          |    7 +-
 third-party/curl/tests/data/test2073          |   16 +-
 third-party/curl/tests/data/test2074          |   14 +-
 third-party/curl/tests/data/test2075          |    6 +-
 third-party/curl/tests/data/test2076          |   10 +-
 third-party/curl/tests/data/test2077          |    3 +-
 third-party/curl/tests/data/test2078          |    5 +-
 third-party/curl/tests/data/test2079          |   27 +-
 third-party/curl/tests/data/test208           |   25 +-
 third-party/curl/tests/data/test2080          |  Bin 20683 -> 518 bytes
 third-party/curl/tests/data/test2081          |   19 +-
 third-party/curl/tests/data/test2082          |    3 +-
 third-party/curl/tests/data/test2083          |    3 +-
 third-party/curl/tests/data/test2084          |    3 +-
 third-party/curl/tests/data/test2085          |    3 +-
 third-party/curl/tests/data/test2086          |   11 +-
 third-party/curl/tests/data/test2087          |   27 +-
 third-party/curl/tests/data/test2088          |   51 +
 third-party/curl/tests/data/test2089          |   51 +
 third-party/curl/tests/data/test209           |   29 +-
 third-party/curl/tests/data/test2090          |   59 +
 third-party/curl/tests/data/test2091          |   98 +
 third-party/curl/tests/data/test2092          |   28 +
 third-party/curl/tests/data/test21            |    8 +-
 third-party/curl/tests/data/test210           |    7 +-
 third-party/curl/tests/data/test2100          |   47 +-
 third-party/curl/tests/data/test2101          |   48 +
 third-party/curl/tests/data/test2102          |   62 +
 third-party/curl/tests/data/test2103          |   43 +
 third-party/curl/tests/data/test2104          |   47 +
 third-party/curl/tests/data/test2105          |   49 +
 third-party/curl/tests/data/test2106          |   53 +
 third-party/curl/tests/data/test2107          |   49 +
 third-party/curl/tests/data/test2108          |   41 +
 third-party/curl/tests/data/test211           |    9 +-
 third-party/curl/tests/data/test212           |   15 +-
 third-party/curl/tests/data/test213           |   29 +-
 third-party/curl/tests/data/test214           |   10 +-
 third-party/curl/tests/data/test215           |   15 +-
 third-party/curl/tests/data/test216           |    9 +-
 third-party/curl/tests/data/test217           |   17 +-
 third-party/curl/tests/data/test218           |   42 +-
 third-party/curl/tests/data/test219           |   14 +-
 third-party/curl/tests/data/test22            |   15 +-
 third-party/curl/tests/data/test220           |   37 +-
 third-party/curl/tests/data/test2200          |   10 +-
 third-party/curl/tests/data/test2201          |    5 +-
 third-party/curl/tests/data/test2202          |    6 +-
 third-party/curl/tests/data/test2203          |   10 +-
 third-party/curl/tests/data/test2204          |    8 +-
 third-party/curl/tests/data/test2205          |   13 +-
 third-party/curl/tests/data/test2206          |   59 +
 third-party/curl/tests/data/test2207          |   59 +
 third-party/curl/tests/data/test2208          |   90 +
 third-party/curl/tests/data/test221           |   33 +-
 third-party/curl/tests/data/test222           |  173 +-
 third-party/curl/tests/data/test223           |   57 +-
 third-party/curl/tests/data/test224           |   69 +-
 third-party/curl/tests/data/test225           |    8 +-
 third-party/curl/tests/data/test226           |    8 +-
 third-party/curl/tests/data/test227           |    9 +-
 third-party/curl/tests/data/test228           |   10 +-
 third-party/curl/tests/data/test229           |   10 +-
 third-party/curl/tests/data/test23            |   10 +-
 third-party/curl/tests/data/test230           |  174 +-
 third-party/curl/tests/data/test2300          |   25 +-
 third-party/curl/tests/data/test2301          |   17 +-
 third-party/curl/tests/data/test2302          |   27 +-
 third-party/curl/tests/data/test2303          |   19 +-
 third-party/curl/tests/data/test2304          |   25 +-
 third-party/curl/tests/data/test2305          |   59 -
 third-party/curl/tests/data/test2306          |   15 +-
 third-party/curl/tests/data/test2307          |   58 +
 third-party/curl/tests/data/test2308          |   56 +
 third-party/curl/tests/data/test2309          |   65 +
 third-party/curl/tests/data/test231           |    5 +-
 third-party/curl/tests/data/test2310          |   50 +
 third-party/curl/tests/data/test2311          |   58 +
 third-party/curl/tests/data/test232           |  173 +-
 third-party/curl/tests/data/test233           |   18 +-
 third-party/curl/tests/data/test234           |   22 +-
 third-party/curl/tests/data/test235           |   14 +-
 third-party/curl/tests/data/test236           |    9 +-
 third-party/curl/tests/data/test237           |   11 +-
 third-party/curl/tests/data/test238           |   11 +-
 third-party/curl/tests/data/test239           |   11 +-
 third-party/curl/tests/data/test24            |   11 +-
 third-party/curl/tests/data/test240           |   14 +-
 third-party/curl/tests/data/test2400          |   24 +-
 third-party/curl/tests/data/test2401          |   29 +-
 third-party/curl/tests/data/test2402          |   35 +-
 third-party/curl/tests/data/test2403          |   23 +-
 third-party/curl/tests/data/test2404          |   33 +-
 third-party/curl/tests/data/test2405          |   52 +
 third-party/curl/tests/data/test2406          |   63 +
 third-party/curl/tests/data/test2407          |   53 +
 third-party/curl/tests/data/test2408          |   92 +
 third-party/curl/tests/data/test2409          |   92 +
 third-party/curl/tests/data/test241           |   16 +-
 third-party/curl/tests/data/test2410          |   34 +
 third-party/curl/tests/data/test2411          |   37 +
 third-party/curl/tests/data/test2412          |   50 +
 third-party/curl/tests/data/test2413          |   19 +
 third-party/curl/tests/data/test242           |   16 +-
 third-party/curl/tests/data/test243           |   13 +-
 third-party/curl/tests/data/test244           |   10 +-
 third-party/curl/tests/data/test245           |   21 +-
 third-party/curl/tests/data/test246           |   21 +-
 third-party/curl/tests/data/test247           |   12 +-
 third-party/curl/tests/data/test248           |   11 +-
 third-party/curl/tests/data/test249           |   12 +-
 third-party/curl/tests/data/test25            |    9 +-
 third-party/curl/tests/data/test250           |   16 +-
 third-party/curl/tests/data/test2500          |   26 +-
 third-party/curl/tests/data/test2501          |   26 +-
 third-party/curl/tests/data/test2502          |   34 +-
 third-party/curl/tests/data/test2503          |   23 +-
 third-party/curl/tests/data/test2504          |   55 +
 third-party/curl/tests/data/test2505          |   67 +
 third-party/curl/tests/data/test2506          |   64 +
 third-party/curl/tests/data/test251           |   15 +-
 third-party/curl/tests/data/test252           |   20 +-
 third-party/curl/tests/data/test253           |   24 +-
 third-party/curl/tests/data/test254           |   20 +-
 third-party/curl/tests/data/test255           |   22 +-
 third-party/curl/tests/data/test256           |   12 +-
 third-party/curl/tests/data/test257           |   13 +-
 third-party/curl/tests/data/test258           |  112 +-
 third-party/curl/tests/data/test259           |  116 +-
 third-party/curl/tests/data/test26            |    9 +-
 third-party/curl/tests/data/test260           |   14 +-
 third-party/curl/tests/data/test2600          |   13 +-
 third-party/curl/tests/data/test2601          |   14 +-
 third-party/curl/tests/data/test2602          |    9 +-
 third-party/curl/tests/data/test2603          |    9 +-
 third-party/curl/tests/data/test2604          |   19 +
 third-party/curl/tests/data/test2605          |   20 +
 third-party/curl/tests/data/test261           |   12 +-
 third-party/curl/tests/data/test262           |  Bin 1228 -> 850 bytes
 third-party/curl/tests/data/test263           |   14 +-
 third-party/curl/tests/data/test264           |   13 +-
 third-party/curl/tests/data/test265           |   33 +-
 third-party/curl/tests/data/test266           |   58 +-
 third-party/curl/tests/data/test267           |   11 +-
 third-party/curl/tests/data/test268           |   57 +
 third-party/curl/tests/data/test269           |   15 +-
 third-party/curl/tests/data/test27            |    9 +-
 third-party/curl/tests/data/test270           |    9 +-
 third-party/curl/tests/data/test2700          |   77 +
 third-party/curl/tests/data/test2701          |   73 +
 third-party/curl/tests/data/test2702          |   73 +
 third-party/curl/tests/data/test2703          |   73 +
 third-party/curl/tests/data/test2704          |   73 +
 third-party/curl/tests/data/test2705          |   73 +
 third-party/curl/tests/data/test2706          |   73 +
 third-party/curl/tests/data/test2707          |   85 +
 third-party/curl/tests/data/test2708          |   75 +
 third-party/curl/tests/data/test2709          |   74 +
 third-party/curl/tests/data/test271           |   10 +-
 third-party/curl/tests/data/test2710          |   74 +
 third-party/curl/tests/data/test2711          |   75 +
 third-party/curl/tests/data/test2712          |   75 +
 third-party/curl/tests/data/test2713          |   73 +
 third-party/curl/tests/data/test2714          |   73 +
 third-party/curl/tests/data/test2715          |   73 +
 third-party/curl/tests/data/test2716          |   73 +
 third-party/curl/tests/data/test2717          |   73 +
 third-party/curl/tests/data/test2718          |   73 +
 third-party/curl/tests/data/test2719          |   82 +
 third-party/curl/tests/data/test272           |    9 +-
 third-party/curl/tests/data/test2720          |   87 +
 third-party/curl/tests/data/test2721          |   78 +
 third-party/curl/tests/data/test2722          |   74 +
 third-party/curl/tests/data/test2723          |   75 +
 third-party/curl/tests/data/test273           |   16 +-
 third-party/curl/tests/data/test274           |    9 +-
 third-party/curl/tests/data/test275           |   28 +-
 third-party/curl/tests/data/test276           |    9 +-
 third-party/curl/tests/data/test277           |   15 +-
 third-party/curl/tests/data/test278           |   13 +-
 third-party/curl/tests/data/test279           |   13 +-
 third-party/curl/tests/data/test28            |   13 +-
 third-party/curl/tests/data/test280           |   20 +-
 third-party/curl/tests/data/test281           |    9 +-
 third-party/curl/tests/data/test282           |   12 +-
 third-party/curl/tests/data/test283           |   10 +-
 third-party/curl/tests/data/test284           |   14 +-
 third-party/curl/tests/data/test285           |   11 +-
 third-party/curl/tests/data/test286           |   15 +-
 third-party/curl/tests/data/test287           |   17 +-
 third-party/curl/tests/data/test288           |    8 +-
 third-party/curl/tests/data/test289           |    8 +-
 third-party/curl/tests/data/test29            |   15 +-
 third-party/curl/tests/data/test290           |    9 +-
 third-party/curl/tests/data/test291           |    9 +-
 third-party/curl/tests/data/test292           |   12 +-
 third-party/curl/tests/data/test293           |   13 +-
 third-party/curl/tests/data/test294           |   18 +-
 third-party/curl/tests/data/test295           |   13 +-
 third-party/curl/tests/data/test296           |   10 +-
 third-party/curl/tests/data/test297           |   10 +-
 third-party/curl/tests/data/test298           |   10 +-
 third-party/curl/tests/data/test299           |   11 +-
 third-party/curl/tests/data/test3             |   22 +-
 third-party/curl/tests/data/test30            |   10 +-
 third-party/curl/tests/data/test300           |   13 +-
 third-party/curl/tests/data/test3000          |   17 +-
 third-party/curl/tests/data/test3001          |   17 +-
 third-party/curl/tests/data/test3002          |   40 +-
 third-party/curl/tests/data/test3003          |   40 +-
 third-party/curl/tests/data/test3004          |   40 +-
 third-party/curl/tests/data/test3005          |   40 +-
 third-party/curl/tests/data/test3006          |   36 +-
 third-party/curl/tests/data/test3007          |   24 +-
 third-party/curl/tests/data/test3008          |    6 +-
 third-party/curl/tests/data/test3009          |    6 +-
 third-party/curl/tests/data/test301           |   16 +-
 third-party/curl/tests/data/test3010          |    1 +
 third-party/curl/tests/data/test3011          |    6 +-
 third-party/curl/tests/data/test3012          |   11 +-
 third-party/curl/tests/data/test3013          |    6 +-
 third-party/curl/tests/data/test3014          |    7 +-
 third-party/curl/tests/data/test3015          |   40 +-
 third-party/curl/tests/data/test3016          |   11 +-
 third-party/curl/tests/data/test3017          |   10 +-
 third-party/curl/tests/data/test3018          |   10 +-
 third-party/curl/tests/data/test3019          |    4 +-
 third-party/curl/tests/data/test302           |   15 +-
 third-party/curl/tests/data/test3020          |    4 +-
 third-party/curl/tests/data/test3021          |   22 +-
 third-party/curl/tests/data/test3022          |   22 +-
 third-party/curl/tests/data/test3023          |   19 +-
 third-party/curl/tests/data/test3024          |   19 +-
 third-party/curl/tests/data/test3025          |    7 +-
 third-party/curl/tests/data/test3026          |   10 +-
 third-party/curl/tests/data/test3027          |    7 +-
 third-party/curl/tests/data/test3028          |    8 +-
 third-party/curl/tests/data/test3029          |    6 +-
 third-party/curl/tests/data/test303           |   14 +-
 third-party/curl/tests/data/test3030          |    3 +-
 third-party/curl/tests/data/test3031          |   65 +
 third-party/curl/tests/data/test3032          |  113 +
 third-party/curl/tests/data/test3033          |   51 +
 third-party/curl/tests/data/test3034          |   41 +
 third-party/curl/tests/data/test3035          |  118 +
 third-party/curl/tests/data/test3036          |   62 +
 third-party/curl/tests/data/test304           |   55 +-
 third-party/curl/tests/data/test305           |   15 +-
 third-party/curl/tests/data/test306           |   17 +-
 third-party/curl/tests/data/test307           |   16 +-
 third-party/curl/tests/data/test308           |   12 +-
 third-party/curl/tests/data/test309           |   17 +-
 third-party/curl/tests/data/test31            |  208 +-
 third-party/curl/tests/data/test310           |   23 +-
 third-party/curl/tests/data/test3100          |   13 +-
 third-party/curl/tests/data/test3101          |   11 +-
 third-party/curl/tests/data/test3102          |   15 +-
 third-party/curl/tests/data/test3103          |   58 +
 third-party/curl/tests/data/test3104          |   58 +
 third-party/curl/tests/data/test3105          |   25 +
 third-party/curl/tests/data/test3106          |   77 +
 third-party/curl/tests/data/test311           |   19 +-
 third-party/curl/tests/data/test312           |   19 +-
 third-party/curl/tests/data/test313           |   20 +-
 third-party/curl/tests/data/test314           |  171 +-
 third-party/curl/tests/data/test315           |   53 +-
 third-party/curl/tests/data/test316           |  164 +-
 third-party/curl/tests/data/test317           |   16 +-
 third-party/curl/tests/data/test318           |   18 +-
 third-party/curl/tests/data/test319           |   45 +-
 third-party/curl/tests/data/test32            |   16 +-
 third-party/curl/tests/data/test320           |   39 +-
 third-party/curl/tests/data/test3200          |    9 +-
 third-party/curl/tests/data/test3201          |   10 +-
 third-party/curl/tests/data/test3202          |   18 +-
 third-party/curl/tests/data/test3203          |   38 +
 third-party/curl/tests/data/test3204          |   51 +
 third-party/curl/tests/data/test3205          |   19 +
 third-party/curl/tests/data/test3206          |   47 +
 third-party/curl/tests/data/test3207          |   52 +
 third-party/curl/tests/data/test3208          |   63 +
 third-party/curl/tests/data/test3209          |   60 +
 third-party/curl/tests/data/test321           |    6 +-
 third-party/curl/tests/data/test3210          |   60 +
 third-party/curl/tests/data/test3211          |   19 +
 third-party/curl/tests/data/test3212          |   19 +
 third-party/curl/tests/data/test3213          |   19 +
 third-party/curl/tests/data/test3214          |   19 +
 third-party/curl/tests/data/test3215          |   54 +
 third-party/curl/tests/data/test3216          |   19 +
 third-party/curl/tests/data/test3217          |   41 +
 third-party/curl/tests/data/test3218          |   41 +
 third-party/curl/tests/data/test3219          |   19 +
 third-party/curl/tests/data/test322           |    6 +-
 third-party/curl/tests/data/test3220          |   61 +
 third-party/curl/tests/data/test3221          |   74 +
 third-party/curl/tests/data/test3222          |   57 +
 third-party/curl/tests/data/test323           |    6 +-
 third-party/curl/tests/data/test324           |    6 +-
 third-party/curl/tests/data/test325           |   14 +-
 third-party/curl/tests/data/test326           |   45 +-
 third-party/curl/tests/data/test327           |    9 +-
 third-party/curl/tests/data/test328           |   11 +-
 third-party/curl/tests/data/test329           |   13 +-
 third-party/curl/tests/data/test33            |    9 +-
 third-party/curl/tests/data/test330           |   12 +-
 third-party/curl/tests/data/test3300          |   19 +
 third-party/curl/tests/data/test3301          |   19 +
 third-party/curl/tests/data/test3302          |   19 +
 third-party/curl/tests/data/test3303          |   20 +
 third-party/curl/tests/data/test3304          |   20 +
 third-party/curl/tests/data/test3305          |   84 +
 third-party/curl/tests/data/test331           |   11 +-
 third-party/curl/tests/data/test332           |   10 +-
 third-party/curl/tests/data/test333           |   15 +-
 third-party/curl/tests/data/test334           |    3 +-
 third-party/curl/tests/data/test335           |   14 +-
 third-party/curl/tests/data/test336           |   11 +-
 third-party/curl/tests/data/test337           |    9 +-
 third-party/curl/tests/data/test338           |   12 +-
 third-party/curl/tests/data/test339           |   38 +-
 third-party/curl/tests/data/test34            |   28 +-
 third-party/curl/tests/data/test340           |   10 +-
 third-party/curl/tests/data/test3400          |   19 +
 third-party/curl/tests/data/test3401          |   55 +
 third-party/curl/tests/data/test341           |   31 +-
 third-party/curl/tests/data/test342           |    6 +-
 third-party/curl/tests/data/test343           |    6 +-
 third-party/curl/tests/data/test344           |    6 +-
 third-party/curl/tests/data/test345           |    6 +-
 third-party/curl/tests/data/test346           |   10 +-
 third-party/curl/tests/data/test347           |   38 +-
 third-party/curl/tests/data/test348           |    9 +-
 third-party/curl/tests/data/test349           |   11 +-
 third-party/curl/tests/data/test35            |  Bin 849 -> 920 bytes
 third-party/curl/tests/data/test350           |   18 +-
 third-party/curl/tests/data/test351           |   18 +-
 third-party/curl/tests/data/test352           |   18 +-
 third-party/curl/tests/data/test353           |   18 +-
 third-party/curl/tests/data/test354           |    9 +-
 third-party/curl/tests/data/test355           |   22 +-
 third-party/curl/tests/data/test356           |   16 +-
 third-party/curl/tests/data/test357           |   18 +-
 third-party/curl/tests/data/test358           |   24 +-
 third-party/curl/tests/data/test359           |   22 +-
 third-party/curl/tests/data/test36            |   21 +-
 third-party/curl/tests/data/test360           |   33 +-
 third-party/curl/tests/data/test361           |   11 +-
 third-party/curl/tests/data/test362           |    9 +-
 third-party/curl/tests/data/test363           |   22 +-
 third-party/curl/tests/data/test364           |   11 +-
 third-party/curl/tests/data/test365           |   22 +-
 third-party/curl/tests/data/test366           |   12 +-
 third-party/curl/tests/data/test367           |   12 +-
 third-party/curl/tests/data/test368           |   12 +-
 third-party/curl/tests/data/test369           |    6 +-
 third-party/curl/tests/data/test37            |   13 +-
 third-party/curl/tests/data/test370           |    7 +-
 third-party/curl/tests/data/test371           |   12 +-
 third-party/curl/tests/data/test372           |    5 +-
 third-party/curl/tests/data/test373           |   41 +-
 third-party/curl/tests/data/test374           |    5 +-
 third-party/curl/tests/data/test375           |    5 +-
 third-party/curl/tests/data/test376           |   18 +-
 third-party/curl/tests/data/test378           |   15 +-
 third-party/curl/tests/data/test379           |   18 +-
 third-party/curl/tests/data/test38            |   10 +-
 third-party/curl/tests/data/test380           |   14 +-
 third-party/curl/tests/data/test381           |   13 +-
 third-party/curl/tests/data/test383           |   18 +-
 third-party/curl/tests/data/test384           |   16 +-
 third-party/curl/tests/data/test385           |   18 +-
 third-party/curl/tests/data/test386           |   18 +-
 third-party/curl/tests/data/test387           |   12 +-
 third-party/curl/tests/data/test388           |   27 +-
 third-party/curl/tests/data/test389           |   22 +-
 third-party/curl/tests/data/test39            |  107 +-
 third-party/curl/tests/data/test390           |    5 +-
 third-party/curl/tests/data/test391           |   14 +-
 third-party/curl/tests/data/test392           |   17 +-
 third-party/curl/tests/data/test393           |   17 +-
 third-party/curl/tests/data/test394           |   17 +-
 third-party/curl/tests/data/test395           |   19 +-
 third-party/curl/tests/data/test396           |  172 +-
 third-party/curl/tests/data/test397           |  165 +-
 third-party/curl/tests/data/test398           |   16 +-
 third-party/curl/tests/data/test399           |    5 +-
 third-party/curl/tests/data/test4             |   28 +-
 third-party/curl/tests/data/test40            |   28 +-
 third-party/curl/tests/data/test400           |   20 +-
 third-party/curl/tests/data/test4000          |   49 +
 third-party/curl/tests/data/test4001          |   44 +
 third-party/curl/tests/data/test401           |   11 +-
 third-party/curl/tests/data/test402           |   12 +-
 third-party/curl/tests/data/test403           |   21 +-
 third-party/curl/tests/data/test404           |   15 +-
 third-party/curl/tests/data/test405           |   10 +-
 third-party/curl/tests/data/test406           |   20 +-
 third-party/curl/tests/data/test407           |   11 +-
 third-party/curl/tests/data/test408           |   11 +-
 third-party/curl/tests/data/test409           |   57 -
 third-party/curl/tests/data/test41            |    8 +-
 third-party/curl/tests/data/test410           |   16 +-
 third-party/curl/tests/data/test411           |   13 +-
 third-party/curl/tests/data/test412           |   18 +-
 third-party/curl/tests/data/test413           |   18 +-
 third-party/curl/tests/data/test414           |    8 +-
 third-party/curl/tests/data/test415           |   32 +-
 third-party/curl/tests/data/test416           |    9 +-
 third-party/curl/tests/data/test417           |   34 +-
 third-party/curl/tests/data/test418           |   10 +-
 third-party/curl/tests/data/test419           |   11 +-
 third-party/curl/tests/data/test42            |   26 +-
 third-party/curl/tests/data/test420           |   22 +-
 third-party/curl/tests/data/test421           |   12 +-
 third-party/curl/tests/data/test422           |    7 +-
 third-party/curl/tests/data/test423           |   12 +-
 third-party/curl/tests/data/test424           |   21 +-
 third-party/curl/tests/data/test425           |   14 +-
 third-party/curl/tests/data/test426           |    5 +-
 third-party/curl/tests/data/test427           |   10 +-
 third-party/curl/tests/data/test428           |    7 +-
 third-party/curl/tests/data/test429           |   12 +-
 third-party/curl/tests/data/test43            |    9 +-
 third-party/curl/tests/data/test430           |   12 +-
 third-party/curl/tests/data/test431           |   12 +-
 third-party/curl/tests/data/test432           |   12 +-
 third-party/curl/tests/data/test433           |   32 +-
 third-party/curl/tests/data/test434           |    6 +-
 third-party/curl/tests/data/test435           |   10 +-
 third-party/curl/tests/data/test436           |   13 +-
 third-party/curl/tests/data/test437           |   17 +-
 third-party/curl/tests/data/test438           |   20 +-
 third-party/curl/tests/data/test439           |   17 +-
 third-party/curl/tests/data/test44            |   49 +-
 third-party/curl/tests/data/test440           |   18 +-
 third-party/curl/tests/data/test441           |   14 +-
 third-party/curl/tests/data/test442           |   11 +-
 third-party/curl/tests/data/test443           |   50 +-
 third-party/curl/tests/data/test444           |  109 +-
 third-party/curl/tests/data/test445           |   18 +-
 third-party/curl/tests/data/test446           |   12 +-
 third-party/curl/tests/data/test447           |    8 +-
 third-party/curl/tests/data/test448           |    7 +-
 third-party/curl/tests/data/test449           |    7 +-
 third-party/curl/tests/data/test45            |   15 +-
 third-party/curl/tests/data/test450           |    7 +-
 third-party/curl/tests/data/test451           |    6 +-
 third-party/curl/tests/data/test452           |    4 +-
 third-party/curl/tests/data/test453           |    3 +-
 third-party/curl/tests/data/test454           |    4 +-
 third-party/curl/tests/data/test455           |   10 +-
 third-party/curl/tests/data/test456           |    3 +-
 third-party/curl/tests/data/test457           |   67 +
 third-party/curl/tests/data/test458           |   73 +
 third-party/curl/tests/data/test459           |   61 +
 third-party/curl/tests/data/test46            |   28 +-
 third-party/curl/tests/data/test460           |   25 +
 third-party/curl/tests/data/test461           |   46 +
 third-party/curl/tests/data/test462           |   34 +
 third-party/curl/tests/data/test463           |   51 +
 third-party/curl/tests/data/test467           |   27 +
 third-party/curl/tests/data/test468           |   58 +
 third-party/curl/tests/data/test469           |   50 +
 third-party/curl/tests/data/test47            |   12 +-
 third-party/curl/tests/data/test470           |   50 +
 third-party/curl/tests/data/test471           |   72 +
 third-party/curl/tests/data/test472           |   58 +
 third-party/curl/tests/data/test473           |   60 +
 third-party/curl/tests/data/test474           |   50 +
 third-party/curl/tests/data/test475           |   47 +
 third-party/curl/tests/data/test476           |   43 +
 third-party/curl/tests/data/test477           |   65 +
 third-party/curl/tests/data/test478           |   72 +
 third-party/curl/tests/data/test479           |  106 +
 third-party/curl/tests/data/test48            |   18 +-
 third-party/curl/tests/data/test480           |   37 +
 third-party/curl/tests/data/test481           |   47 +
 third-party/curl/tests/data/test482           |   43 +
 third-party/curl/tests/data/test483           |   64 +
 third-party/curl/tests/data/test484           |   39 +
 third-party/curl/tests/data/test485           |   39 +
 third-party/curl/tests/data/test486           |  104 +
 third-party/curl/tests/data/test487           |   50 +
 third-party/curl/tests/data/test488           |   61 +
 third-party/curl/tests/data/test489           |   61 +
 third-party/curl/tests/data/test49            |   12 +-
 third-party/curl/tests/data/test490           |   12 +-
 third-party/curl/tests/data/test491           |   12 +-
 third-party/curl/tests/data/test492           |   12 +-
 third-party/curl/tests/data/test493           |   12 +-
 third-party/curl/tests/data/test494           |   12 +-
 third-party/curl/tests/data/test495           |    8 +-
 third-party/curl/tests/data/test496           |    9 +-
 third-party/curl/tests/data/test497           |   17 +-
 third-party/curl/tests/data/test498           |   48 +
 third-party/curl/tests/data/test499           |   63 +
 third-party/curl/tests/data/test5             |   12 +-
 third-party/curl/tests/data/test50            |   12 +-
 third-party/curl/tests/data/test500           |   17 +-
 third-party/curl/tests/data/test501           |   13 +-
 third-party/curl/tests/data/test502           |   10 +-
 third-party/curl/tests/data/test503           |   21 +-
 third-party/curl/tests/data/test504           |   15 +-
 third-party/curl/tests/data/test505           |   10 +-
 third-party/curl/tests/data/test506           |  203 +-
 third-party/curl/tests/data/test507           |    4 +-
 third-party/curl/tests/data/test508           |   17 +-
 third-party/curl/tests/data/test509           |    9 +-
 third-party/curl/tests/data/test51            |   12 +-
 third-party/curl/tests/data/test510           |   17 +-
 third-party/curl/tests/data/test511           |   11 +-
 third-party/curl/tests/data/test512           |   13 +-
 third-party/curl/tests/data/test513           |   19 +-
 third-party/curl/tests/data/test514           |   14 +-
 third-party/curl/tests/data/test515           |   13 +-
 third-party/curl/tests/data/test516           |   13 +-
 third-party/curl/tests/data/test517           |   21 +-
 third-party/curl/tests/data/test518           |   18 +-
 third-party/curl/tests/data/test519           |   21 +-
 third-party/curl/tests/data/test52            |   12 +-
 third-party/curl/tests/data/test520           |   11 +-
 third-party/curl/tests/data/test521           |   18 +-
 third-party/curl/tests/data/test522           |   16 +-
 third-party/curl/tests/data/test523           |   16 +-
 third-party/curl/tests/data/test524           |   12 +-
 third-party/curl/tests/data/test525           |    9 +-
 third-party/curl/tests/data/test526           |    9 +-
 third-party/curl/tests/data/test527           |   13 +-
 third-party/curl/tests/data/test528           |   11 +-
 third-party/curl/tests/data/test529           |   11 +-
 third-party/curl/tests/data/test53            |   11 +-
 third-party/curl/tests/data/test530           |    3 +-
 third-party/curl/tests/data/test531           |   11 +-
 third-party/curl/tests/data/test532           |   11 +-
 third-party/curl/tests/data/test533           |    9 +-
 third-party/curl/tests/data/test534           |    9 +-
 third-party/curl/tests/data/test535           |   14 +-
 third-party/curl/tests/data/test536           |   73 +
 third-party/curl/tests/data/test537           |   18 +-
 third-party/curl/tests/data/test538           |   14 +-
 third-party/curl/tests/data/test539           |   35 +-
 third-party/curl/tests/data/test54            |   11 +-
 third-party/curl/tests/data/test540           |   18 +-
 third-party/curl/tests/data/test541           |   10 +-
 third-party/curl/tests/data/test542           |   14 +-
 third-party/curl/tests/data/test543           |   15 +-
 third-party/curl/tests/data/test544           |   13 +-
 third-party/curl/tests/data/test545           |  Bin 822 -> 848 bytes
 third-party/curl/tests/data/test546           |    9 +-
 third-party/curl/tests/data/test547           |   13 +-
 third-party/curl/tests/data/test548           |   15 +-
 third-party/curl/tests/data/test549           |   14 +-
 third-party/curl/tests/data/test55            |    9 +-
 third-party/curl/tests/data/test550           |   14 +-
 third-party/curl/tests/data/test551           |   22 +-
 third-party/curl/tests/data/test552           |   44 +-
 third-party/curl/tests/data/test553           |   11 +-
 third-party/curl/tests/data/test554           |  133 +-
 third-party/curl/tests/data/test555           |   15 +-
 third-party/curl/tests/data/test556           |   13 +-
 third-party/curl/tests/data/test557           |   10 +-
 third-party/curl/tests/data/test558           |   13 +-
 third-party/curl/tests/data/test559           |    7 +-
 third-party/curl/tests/data/test56            |   21 +-
 third-party/curl/tests/data/test560           |   14 +-
 third-party/curl/tests/data/test561           |   14 +-
 third-party/curl/tests/data/test562           |   14 +-
 third-party/curl/tests/data/test563           |   13 +-
 third-party/curl/tests/data/test564           |    7 +-
 third-party/curl/tests/data/test565           |   24 +-
 third-party/curl/tests/data/test566           |   13 +-
 third-party/curl/tests/data/test567           |    8 +-
 third-party/curl/tests/data/test568           |   33 +-
 third-party/curl/tests/data/test569           |    5 +-
 third-party/curl/tests/data/test57            |   11 +-
 third-party/curl/tests/data/test570           |   11 +-
 third-party/curl/tests/data/test571           |   17 +-
 third-party/curl/tests/data/test572           |   15 +-
 third-party/curl/tests/data/test573           |   12 +-
 third-party/curl/tests/data/test574           |   12 +-
 third-party/curl/tests/data/test575           |   15 +-
 third-party/curl/tests/data/test576           |    9 +-
 third-party/curl/tests/data/test577           |    7 +-
 third-party/curl/tests/data/test578           |   11 +-
 third-party/curl/tests/data/test579           |   28 +-
 third-party/curl/tests/data/test58            |    7 +-
 third-party/curl/tests/data/test580           |   22 +-
 third-party/curl/tests/data/test581           |   11 +-
 third-party/curl/tests/data/test582           |   16 +-
 third-party/curl/tests/data/test583           |   20 +-
 third-party/curl/tests/data/test584           |   23 +-
 third-party/curl/tests/data/test585           |   27 +-
 third-party/curl/tests/data/test586           |   14 +-
 third-party/curl/tests/data/test587           |   28 +-
 third-party/curl/tests/data/test588           |   19 +-
 third-party/curl/tests/data/test589           |   13 +-
 third-party/curl/tests/data/test59            |   14 +-
 third-party/curl/tests/data/test590           |   13 +-
 third-party/curl/tests/data/test591           |   15 +-
 third-party/curl/tests/data/test592           |   15 +-
 third-party/curl/tests/data/test593           |   15 +-
 third-party/curl/tests/data/test594           |   16 +-
 third-party/curl/tests/data/test595           |   15 +-
 third-party/curl/tests/data/test596           |   17 +-
 third-party/curl/tests/data/test597           |    8 +-
 third-party/curl/tests/data/test598           |   15 +-
 third-party/curl/tests/data/test599           |   35 +-
 third-party/curl/tests/data/test6             |   11 +-
 third-party/curl/tests/data/test60            |   31 +-
 third-party/curl/tests/data/test600           |   15 +-
 third-party/curl/tests/data/test601           |   15 +-
 third-party/curl/tests/data/test602           |   15 +-
 third-party/curl/tests/data/test603           |   15 +-
 third-party/curl/tests/data/test604           |   15 +-
 third-party/curl/tests/data/test605           |   15 +-
 third-party/curl/tests/data/test606           |   15 +-
 third-party/curl/tests/data/test607           |   15 +-
 third-party/curl/tests/data/test608           |   23 +-
 third-party/curl/tests/data/test609           |   16 +-
 third-party/curl/tests/data/test61            |   20 +-
 third-party/curl/tests/data/test610           |   23 +-
 third-party/curl/tests/data/test611           |   25 +-
 third-party/curl/tests/data/test612           |   24 +-
 third-party/curl/tests/data/test613           |   28 +-
 third-party/curl/tests/data/test614           |   28 +-
 third-party/curl/tests/data/test615           |   23 +-
 third-party/curl/tests/data/test616           |   15 +-
 third-party/curl/tests/data/test617           |   15 +-
 third-party/curl/tests/data/test618           |   16 +-
 third-party/curl/tests/data/test619           |   16 +-
 third-party/curl/tests/data/test62            |   16 +-
 third-party/curl/tests/data/test620           |   15 +-
 third-party/curl/tests/data/test621           |   15 +-
 third-party/curl/tests/data/test622           |   16 +-
 third-party/curl/tests/data/test623           |   16 +-
 third-party/curl/tests/data/test624           |   21 +-
 third-party/curl/tests/data/test625           |   24 +-
 third-party/curl/tests/data/test626           |   16 +-
 third-party/curl/tests/data/test627           |   23 +-
 third-party/curl/tests/data/test628           |   15 +-
 third-party/curl/tests/data/test629           |   15 +-
 third-party/curl/tests/data/test63            |   14 +-
 third-party/curl/tests/data/test630           |   15 +-
 third-party/curl/tests/data/test631           |   15 +-
 third-party/curl/tests/data/test632           |   15 +-
 third-party/curl/tests/data/test633           |   15 +-
 third-party/curl/tests/data/test634           |   15 +-
 third-party/curl/tests/data/test635           |   15 +-
 third-party/curl/tests/data/test636           |   15 +-
 third-party/curl/tests/data/test637           |   17 +-
 third-party/curl/tests/data/test638           |   23 +-
 third-party/curl/tests/data/test639           |   25 +-
 third-party/curl/tests/data/test64            |   24 +-
 third-party/curl/tests/data/test640           |   15 +-
 third-party/curl/tests/data/test641           |   15 +-
 third-party/curl/tests/data/test642           |   17 +-
 third-party/curl/tests/data/test643           |  129 +-
 third-party/curl/tests/data/test644           |    9 +-
 third-party/curl/tests/data/test645           |  263 +-
 third-party/curl/tests/data/test646           |  114 +-
 third-party/curl/tests/data/test647           |   84 +-
 third-party/curl/tests/data/test648           |   32 +-
 third-party/curl/tests/data/test649           |   42 +-
 third-party/curl/tests/data/test65            |   16 +-
 third-party/curl/tests/data/test650           |  313 +-
 third-party/curl/tests/data/test651           |   21 +-
 third-party/curl/tests/data/test652           |   22 +-
 third-party/curl/tests/data/test653           |   23 +-
 third-party/curl/tests/data/test654           |  115 +-
 third-party/curl/tests/data/test655           |   13 +-
 third-party/curl/tests/data/test656           |   15 +-
 third-party/curl/tests/data/test658           |    7 +-
 third-party/curl/tests/data/test659           |    7 +-
 third-party/curl/tests/data/test66            |   13 +-
 third-party/curl/tests/data/test660           |    8 +-
 third-party/curl/tests/data/test661           |   11 +-
 third-party/curl/tests/data/test662           |   18 +-
 third-party/curl/tests/data/test663           |   20 +-
 third-party/curl/tests/data/test664           |   15 +-
 third-party/curl/tests/data/test665           |   15 +-
 third-party/curl/tests/data/test666           |   44 +-
 third-party/curl/tests/data/test667           |   27 +-
 third-party/curl/tests/data/test668           |   87 +-
 third-party/curl/tests/data/test669           |   15 +-
 third-party/curl/tests/data/test67            |   11 +-
 third-party/curl/tests/data/test670           |   21 +-
 third-party/curl/tests/data/test671           |   23 +-
 third-party/curl/tests/data/test672           |   23 +-
 third-party/curl/tests/data/test673           |   23 +-
 third-party/curl/tests/data/test674           |    7 +-
 third-party/curl/tests/data/test675           |   13 +-
 third-party/curl/tests/data/test676           |   15 +-
 third-party/curl/tests/data/test677           |   10 +-
 third-party/curl/tests/data/test678           |   18 +-
 third-party/curl/tests/data/test679           |   18 +-
 third-party/curl/tests/data/test68            |   11 +-
 third-party/curl/tests/data/test680           |   13 +-
 third-party/curl/tests/data/test681           |    6 +-
 third-party/curl/tests/data/test682           |   12 +-
 third-party/curl/tests/data/test683           |   12 +-
 third-party/curl/tests/data/test684           |   12 +-
 third-party/curl/tests/data/test685           |   18 +-
 third-party/curl/tests/data/test686           |   13 +-
 third-party/curl/tests/data/test687           |    9 +-
 third-party/curl/tests/data/test688           |   11 +-
 third-party/curl/tests/data/test689           |   52 +
 third-party/curl/tests/data/test69            |   13 +-
 third-party/curl/tests/data/test690           |   65 +
 third-party/curl/tests/data/test691           |   65 +
 third-party/curl/tests/data/test692           |   54 +
 third-party/curl/tests/data/test693           |   60 +
 third-party/curl/tests/data/test694           |  128 +
 third-party/curl/tests/data/test695           |   79 +
 third-party/curl/tests/data/test696           |   69 +
 third-party/curl/tests/data/test697           |   32 +
 third-party/curl/tests/data/test698           |   55 +
 third-party/curl/tests/data/test699           |   55 +
 third-party/curl/tests/data/test7             |   12 +-
 third-party/curl/tests/data/test70            |   16 +-
 third-party/curl/tests/data/test700           |   12 +-
 third-party/curl/tests/data/test701           |   12 +-
 third-party/curl/tests/data/test702           |    8 +-
 third-party/curl/tests/data/test703           |    8 +-
 third-party/curl/tests/data/test704           |    8 +-
 third-party/curl/tests/data/test705           |    8 +-
 third-party/curl/tests/data/test706           |   18 +-
 third-party/curl/tests/data/test707           |   18 +-
 third-party/curl/tests/data/test708           |   14 +-
 third-party/curl/tests/data/test709           |   13 +-
 third-party/curl/tests/data/test71            |   47 +-
 third-party/curl/tests/data/test710           |   12 +-
 third-party/curl/tests/data/test711           |   12 +-
 third-party/curl/tests/data/test712           |   12 +-
 third-party/curl/tests/data/test713           |   12 +-
 third-party/curl/tests/data/test714           |   12 +-
 third-party/curl/tests/data/test715           |   12 +-
 third-party/curl/tests/data/test716           |   10 +-
 third-party/curl/tests/data/test717           |   10 +-
 third-party/curl/tests/data/test718           |   15 +-
 third-party/curl/tests/data/test719           |   14 +-
 third-party/curl/tests/data/test72            |   16 +-
 third-party/curl/tests/data/test720           |   12 +-
 third-party/curl/tests/data/test721           |   14 +-
 third-party/curl/tests/data/test722           |   53 +
 third-party/curl/tests/data/test723           |   36 +
 third-party/curl/tests/data/test724           |   59 +
 third-party/curl/tests/data/test725           |   41 +
 third-party/curl/tests/data/test726           |   40 +
 third-party/curl/tests/data/test727           |   53 +
 third-party/curl/tests/data/test728           |   62 +
 third-party/curl/tests/data/test729           |   39 +
 third-party/curl/tests/data/test73            |   11 +-
 third-party/curl/tests/data/test730           |   53 +
 third-party/curl/tests/data/test731           |   59 +
 third-party/curl/tests/data/test732           |   53 +
 third-party/curl/tests/data/test733           |   53 +
 third-party/curl/tests/data/test734           |   53 +
 third-party/curl/tests/data/test735           |   53 +
 third-party/curl/tests/data/test736           |   59 +
 third-party/curl/tests/data/test737           |   59 +
 third-party/curl/tests/data/test738           |   38 +
 third-party/curl/tests/data/test739           |   35 +
 third-party/curl/tests/data/test74            |   12 +-
 third-party/curl/tests/data/test740           |   61 +
 third-party/curl/tests/data/test741           |   43 +
 third-party/curl/tests/data/test742           |   64 +
 third-party/curl/tests/data/test743           |   58 +
 third-party/curl/tests/data/test744           |   77 +
 third-party/curl/tests/data/test745           |   28 +
 third-party/curl/tests/data/test746           |   32 +
 third-party/curl/tests/data/test747           |   57 +
 third-party/curl/tests/data/test748           |   32 +
 third-party/curl/tests/data/test749           |   62 +
 third-party/curl/tests/data/test75            |   16 +-
 third-party/curl/tests/data/test750           |   58 +
 third-party/curl/tests/data/test751           |   32 +
 third-party/curl/tests/data/test752           |   70 +
 third-party/curl/tests/data/test753           |   46 +
 third-party/curl/tests/data/test754           |   62 +
 third-party/curl/tests/data/test755           |   57 +
 third-party/curl/tests/data/test756           |   74 +
 third-party/curl/tests/data/test757           |   79 +
 third-party/curl/tests/data/test758           |   52 +
 third-party/curl/tests/data/test759           |   26 +
 third-party/curl/tests/data/test76            |  105 +-
 third-party/curl/tests/data/test760           |   26 +
 third-party/curl/tests/data/test761           |   29 +
 third-party/curl/tests/data/test762           |   54 +
 third-party/curl/tests/data/test763           |   30 +
 third-party/curl/tests/data/test764           |   65 +
 third-party/curl/tests/data/test765           |   65 +
 third-party/curl/tests/data/test766           |   60 +
 third-party/curl/tests/data/test767           |   56 +
 third-party/curl/tests/data/test768           |   55 +
 third-party/curl/tests/data/test769           |   51 +
 third-party/curl/tests/data/test77            |   12 +-
 third-party/curl/tests/data/test770           |   52 +
 third-party/curl/tests/data/test771           |   55 +
 third-party/curl/tests/data/test772           |   50 +
 third-party/curl/tests/data/test773           |   47 +
 third-party/curl/tests/data/test774           |   26 +
 third-party/curl/tests/data/test775           |   68 +
 third-party/curl/tests/data/test776           |   53 +
 third-party/curl/tests/data/test777           |   46 +
 third-party/curl/tests/data/test778           |   95 +
 third-party/curl/tests/data/test779           |   75 +
 third-party/curl/tests/data/test78            |   12 +-
 third-party/curl/tests/data/test780           |   86 +
 third-party/curl/tests/data/test781           |   88 +
 third-party/curl/tests/data/test782           |   88 +
 third-party/curl/tests/data/test783           |   88 +
 third-party/curl/tests/data/test784           |   57 +
 third-party/curl/tests/data/test785           |   57 +
 third-party/curl/tests/data/test786           |   57 +
 third-party/curl/tests/data/test787           |   33 +
 third-party/curl/tests/data/test788           |   57 +
 third-party/curl/tests/data/test789           |   56 +
 third-party/curl/tests/data/test79            |   12 +-
 third-party/curl/tests/data/test790           |   54 +
 third-party/curl/tests/data/test791           |   54 +
 third-party/curl/tests/data/test792           |   47 +
 third-party/curl/tests/data/test793           |   47 +
 third-party/curl/tests/data/test794           |   94 +
 third-party/curl/tests/data/test795           |   73 +
 third-party/curl/tests/data/test796           |   91 +
 third-party/curl/tests/data/test797           |   93 +
 third-party/curl/tests/data/test798           |   64 +
 third-party/curl/tests/data/test799           |   14 +-
 third-party/curl/tests/data/test8             |   11 +-
 third-party/curl/tests/data/test80            |   28 +-
 third-party/curl/tests/data/test800           |   16 +-
 third-party/curl/tests/data/test801           |   14 +-
 third-party/curl/tests/data/test802           |   14 +-
 third-party/curl/tests/data/test803           |   13 +-
 third-party/curl/tests/data/test804           |   16 +-
 third-party/curl/tests/data/test805           |   24 +-
 third-party/curl/tests/data/test806           |   14 +-
 third-party/curl/tests/data/test807           |   14 +-
 third-party/curl/tests/data/test808           |   14 +-
 third-party/curl/tests/data/test809           |   14 +-
 third-party/curl/tests/data/test81            |   11 +-
 third-party/curl/tests/data/test810           |   14 +-
 third-party/curl/tests/data/test811           |   12 +-
 third-party/curl/tests/data/test812           |   12 +-
 third-party/curl/tests/data/test813           |   12 +-
 third-party/curl/tests/data/test814           |   12 +-
 third-party/curl/tests/data/test815           |   14 +-
 third-party/curl/tests/data/test816           |   16 +-
 third-party/curl/tests/data/test817           |   12 +-
 third-party/curl/tests/data/test818           |   14 +-
 third-party/curl/tests/data/test819           |   18 +-
 third-party/curl/tests/data/test82            |   13 +-
 third-party/curl/tests/data/test820           |   24 +-
 third-party/curl/tests/data/test821           |   21 +-
 third-party/curl/tests/data/test822           |   12 +-
 third-party/curl/tests/data/test823           |   26 +-
 third-party/curl/tests/data/test824           |   18 +-
 third-party/curl/tests/data/test825           |   16 +-
 third-party/curl/tests/data/test826           |   22 +-
 third-party/curl/tests/data/test827           |   10 +-
 third-party/curl/tests/data/test828           |   16 +-
 third-party/curl/tests/data/test829           |    8 +-
 third-party/curl/tests/data/test83            |   22 +-
 third-party/curl/tests/data/test830           |   16 +-
 third-party/curl/tests/data/test831           |   28 +-
 third-party/curl/tests/data/test832           |   18 +-
 third-party/curl/tests/data/test833           |   19 +-
 third-party/curl/tests/data/test834           |   31 +-
 third-party/curl/tests/data/test835           |   21 +-
 third-party/curl/tests/data/test836           |   14 +-
 third-party/curl/tests/data/test837           |   18 +-
 third-party/curl/tests/data/test838           |   14 +-
 third-party/curl/tests/data/test839           |   16 +-
 third-party/curl/tests/data/test84            |   14 +-
 third-party/curl/tests/data/test840           |   14 +-
 third-party/curl/tests/data/test841           |   25 +-
 third-party/curl/tests/data/test842           |   16 +-
 third-party/curl/tests/data/test843           |   14 +-
 third-party/curl/tests/data/test844           |   15 +-
 third-party/curl/tests/data/test845           |   17 +-
 third-party/curl/tests/data/test846           |   14 +-
 third-party/curl/tests/data/test847           |   16 +-
 third-party/curl/tests/data/test848           |   18 +-
 third-party/curl/tests/data/test849           |   21 +-
 third-party/curl/tests/data/test85            |   16 +-
 third-party/curl/tests/data/test850           |   14 +-
 third-party/curl/tests/data/test851           |   12 +-
 third-party/curl/tests/data/test852           |   13 +-
 third-party/curl/tests/data/test853           |   16 +-
 third-party/curl/tests/data/test854           |   12 +-
 third-party/curl/tests/data/test855           |   13 +-
 third-party/curl/tests/data/test856           |   16 +-
 third-party/curl/tests/data/test857           |   16 +-
 third-party/curl/tests/data/test858           |   12 +-
 third-party/curl/tests/data/test859           |   12 +-
 third-party/curl/tests/data/test86            |   12 +-
 third-party/curl/tests/data/test860           |   12 +-
 third-party/curl/tests/data/test861           |   14 +-
 third-party/curl/tests/data/test862           |   14 +-
 third-party/curl/tests/data/test863           |   12 +-
 third-party/curl/tests/data/test864           |   17 +-
 third-party/curl/tests/data/test865           |   18 +-
 third-party/curl/tests/data/test866           |   24 +-
 third-party/curl/tests/data/test867           |   21 +-
 third-party/curl/tests/data/test868           |   12 +-
 third-party/curl/tests/data/test869           |   26 +-
 third-party/curl/tests/data/test87            |   21 +-
 third-party/curl/tests/data/test870           |   18 +-
 third-party/curl/tests/data/test871           |   16 +-
 third-party/curl/tests/data/test872           |   22 +-
 third-party/curl/tests/data/test873           |   10 +-
 third-party/curl/tests/data/test874           |   16 +-
 third-party/curl/tests/data/test875           |    8 +-
 third-party/curl/tests/data/test876           |   16 +-
 third-party/curl/tests/data/test877           |   28 +-
 third-party/curl/tests/data/test878           |   18 +-
 third-party/curl/tests/data/test879           |   19 +-
 third-party/curl/tests/data/test88            |   16 +-
 third-party/curl/tests/data/test880           |   31 +-
 third-party/curl/tests/data/test881           |   21 +-
 third-party/curl/tests/data/test882           |   14 +-
 third-party/curl/tests/data/test883           |   18 +-
 third-party/curl/tests/data/test884           |   14 +-
 third-party/curl/tests/data/test885           |   16 +-
 third-party/curl/tests/data/test886           |   14 +-
 third-party/curl/tests/data/test887           |   14 +-
 third-party/curl/tests/data/test888           |   14 +-
 third-party/curl/tests/data/test889           |   17 +-
 third-party/curl/tests/data/test89            |   17 +-
 third-party/curl/tests/data/test890           |   17 +-
 third-party/curl/tests/data/test891           |   15 +-
 third-party/curl/tests/data/test892           |   18 +-
 third-party/curl/tests/data/test893           |   21 +-
 third-party/curl/tests/data/test894           |   10 +-
 third-party/curl/tests/data/test895           |   14 +-
 third-party/curl/tests/data/test896           |   10 +-
 third-party/curl/tests/data/test897           |   24 +-
 third-party/curl/tests/data/test898           |   18 +-
 third-party/curl/tests/data/test899           |   16 +-
 third-party/curl/tests/data/test9             |   49 +-
 third-party/curl/tests/data/test90            |   21 +-
 third-party/curl/tests/data/test900           |   42 +-
 third-party/curl/tests/data/test901           |   20 +-
 third-party/curl/tests/data/test902           |   20 +-
 third-party/curl/tests/data/test903           |   24 +-
 third-party/curl/tests/data/test904           |   28 +-
 third-party/curl/tests/data/test905           |   27 +-
 third-party/curl/tests/data/test906           |   18 +-
 third-party/curl/tests/data/test907           |   34 +-
 third-party/curl/tests/data/test908           |   24 +-
 third-party/curl/tests/data/test909           |   20 +-
 third-party/curl/tests/data/test91            |   17 +-
 third-party/curl/tests/data/test910           |   20 +-
 third-party/curl/tests/data/test911           |   18 +-
 third-party/curl/tests/data/test912           |   20 +-
 third-party/curl/tests/data/test913           |   16 +-
 third-party/curl/tests/data/test914           |   16 +-
 third-party/curl/tests/data/test915           |   20 +-
 third-party/curl/tests/data/test916           |   18 +-
 third-party/curl/tests/data/test917           |   37 +-
 third-party/curl/tests/data/test918           |   29 +-
 third-party/curl/tests/data/test919           |   22 +-
 third-party/curl/tests/data/test92            |   13 +-
 third-party/curl/tests/data/test920           |   28 +-
 third-party/curl/tests/data/test921           |   16 +-
 third-party/curl/tests/data/test922           |   22 +-
 third-party/curl/tests/data/test923           |   12 +-
 third-party/curl/tests/data/test924           |   20 +-
 third-party/curl/tests/data/test925           |   14 +-
 third-party/curl/tests/data/test926           |   12 +-
 third-party/curl/tests/data/test927           |   20 +-
 third-party/curl/tests/data/test928           |   14 +-
 third-party/curl/tests/data/test929           |   12 +-
 third-party/curl/tests/data/test93            |   12 +-
 third-party/curl/tests/data/test930           |   12 +-
 third-party/curl/tests/data/test931           |    8 +-
 third-party/curl/tests/data/test932           |   16 +-
 third-party/curl/tests/data/test933           |   28 +-
 third-party/curl/tests/data/test934           |   18 +-
 third-party/curl/tests/data/test935           |   25 +-
 third-party/curl/tests/data/test936           |   37 +-
 third-party/curl/tests/data/test937           |   27 +-
 third-party/curl/tests/data/test938           |   35 +-
 third-party/curl/tests/data/test939           |   20 +-
 third-party/curl/tests/data/test94            |   15 +-
 third-party/curl/tests/data/test940           |   20 +-
 third-party/curl/tests/data/test941           |   24 +-
 third-party/curl/tests/data/test942           |   24 +-
 third-party/curl/tests/data/test943           |   20 +-
 third-party/curl/tests/data/test944           |   22 +-
 third-party/curl/tests/data/test945           |   20 +-
 third-party/curl/tests/data/test946           |   20 +-
 third-party/curl/tests/data/test947           |   20 +-
 third-party/curl/tests/data/test948           |   18 +-
 third-party/curl/tests/data/test949           |   19 +-
 third-party/curl/tests/data/test95            |   20 +-
 third-party/curl/tests/data/test950           |   16 +-
 third-party/curl/tests/data/test951           |   18 +-
 third-party/curl/tests/data/test952           |   18 +-
 third-party/curl/tests/data/test953           |   24 +-
 third-party/curl/tests/data/test954           |   23 +-
 third-party/curl/tests/data/test955           |   23 +-
 third-party/curl/tests/data/test956           |   25 +-
 third-party/curl/tests/data/test957           |   23 +-
 third-party/curl/tests/data/test958           |   23 +-
 third-party/curl/tests/data/test959           |   25 +-
 third-party/curl/tests/data/test96            |   12 +-
 third-party/curl/tests/data/test960           |   27 +-
 third-party/curl/tests/data/test961           |   25 +-
 third-party/curl/tests/data/test962           |   31 +-
 third-party/curl/tests/data/test963           |   31 +-
 third-party/curl/tests/data/test964           |   23 +-
 third-party/curl/tests/data/test965           |   29 +-
 third-party/curl/tests/data/test966           |   29 +-
 third-party/curl/tests/data/test967           |   25 +-
 third-party/curl/tests/data/test968           |   23 +-
 third-party/curl/tests/data/test969           |   22 +-
 third-party/curl/tests/data/test97            |   16 +-
 third-party/curl/tests/data/test970           |   10 +-
 third-party/curl/tests/data/test971           |   12 +-
 third-party/curl/tests/data/test972           |   10 +-
 third-party/curl/tests/data/test973           |   14 +-
 third-party/curl/tests/data/test974           |   14 +-
 third-party/curl/tests/data/test975           |   14 +-
 third-party/curl/tests/data/test976           |   16 +-
 third-party/curl/tests/data/test977           |   12 +-
 third-party/curl/tests/data/test978           |   14 +-
 third-party/curl/tests/data/test979           |   16 +-
 third-party/curl/tests/data/test98            |   16 +-
 third-party/curl/tests/data/test980           |   14 +-
 third-party/curl/tests/data/test981           |   16 +-
 third-party/curl/tests/data/test982           |   14 +-
 third-party/curl/tests/data/test983           |   10 +-
 third-party/curl/tests/data/test984           |   16 +-
 third-party/curl/tests/data/test985           |   14 +-
 third-party/curl/tests/data/test986           |   10 +-
 third-party/curl/tests/data/test987           |   23 +-
 third-party/curl/tests/data/test988           |   16 +-
 third-party/curl/tests/data/test989           |   16 +-
 third-party/curl/tests/data/test99            |   15 +-
 third-party/curl/tests/data/test990           |   10 +-
 third-party/curl/tests/data/test991           |    8 +-
 third-party/curl/tests/data/test992           |   52 +
 third-party/curl/tests/data/test993           |   43 +
 third-party/curl/tests/data/test994           |   40 +
 third-party/curl/tests/data/test995           |   54 +
 third-party/curl/tests/data/test996           |   39 +
 third-party/curl/tests/data/test997           |   45 +
 third-party/curl/tests/data/test998           |   86 +
 third-party/curl/tests/data/test999           |   76 +
 third-party/curl/tests/devtest.pl             |   27 +-
 third-party/curl/tests/dictserver.py          |   47 +-
 third-party/curl/tests/directories.pm         |  394 +-
 third-party/curl/tests/disable-scan.pl        |  148 -
 third-party/curl/tests/ech_combos.py          |   98 +
 third-party/curl/tests/ech_tests.sh           | 1102 +++
 third-party/curl/tests/error-codes.pl         |   82 -
 third-party/curl/tests/extern-scan.pl         |  114 -
 third-party/curl/tests/ftpserver.pl           |  654 +-
 third-party/curl/tests/getpart.pm             |  230 +-
 third-party/curl/tests/globalconfig.pm        |   88 +-
 third-party/curl/tests/http-server.pl         |   13 +-
 third-party/curl/tests/http/CMakeLists.txt    |   80 +
 third-party/curl/tests/http/Makefile.am       |   63 +-
 third-party/curl/tests/http/README.md         |  128 -
 .../curl/tests/http/clients/.gitignore        |   10 -
 .../curl/tests/http/clients/Makefile.am       |   73 -
 .../curl/tests/http/clients/Makefile.inc      |   32 -
 .../curl/tests/http/clients/h2-download.c     |  352 -
 .../curl/tests/http/clients/h2-serverpush.c   |  272 -
 .../tests/http/clients/h2-upgrade-extreme.c   |  249 -
 .../tests/http/clients/tls-session-reuse.c    |  306 -
 third-party/curl/tests/http/clients/ws-data.c |  263 -
 .../curl/tests/http/clients/ws-pingpong.c     |  158 -
 third-party/curl/tests/http/config.ini.in     |   14 +-
 third-party/curl/tests/http/conftest.py       |  175 +-
 third-party/curl/tests/http/requirements.txt  |   33 +-
 third-party/curl/tests/http/scorecard.py      | 1234 ++-
 third-party/curl/tests/http/test_01_basic.py  |  257 +-
 .../curl/tests/http/test_02_download.py       |  644 +-
 third-party/curl/tests/http/test_03_goaway.py |   74 +-
 .../curl/tests/http/test_04_stuttered.py      |   57 +-
 third-party/curl/tests/http/test_05_errors.py |  187 +-
 .../curl/tests/http/test_06_eyeballs.py       |  175 +-
 third-party/curl/tests/http/test_07_upload.py |  588 +-
 third-party/curl/tests/http/test_08_caddy.py  |  165 +-
 third-party/curl/tests/http/test_09_push.py   |   44 +-
 third-party/curl/tests/http/test_10_proxy.py  |  290 +-
 third-party/curl/tests/http/test_11_unix.py   |   48 +-
 third-party/curl/tests/http/test_12_reuse.py  |   31 +-
 .../curl/tests/http/test_13_proxy_auth.py     |  100 +-
 third-party/curl/tests/http/test_14_auth.py   |   70 +-
 .../curl/tests/http/test_15_tracing.py        |   13 +-
 third-party/curl/tests/http/test_16_info.py   |  122 +
 .../curl/tests/http/test_17_ssl_use.py        |  601 ++
 .../curl/tests/http/test_18_methods.py        |   65 +
 .../curl/tests/http/test_19_shutdown.py       |  213 +
 .../curl/tests/http/test_20_websockets.py     |  245 +-
 .../curl/tests/http/test_21_resolve.py        |  202 +
 .../curl/tests/http/test_22_httpsrr.py        |  131 +
 third-party/curl/tests/http/test_30_vsftpd.py |  277 +
 .../curl/tests/http/test_31_vsftpds.py        |  328 +
 .../curl/tests/http/test_32_ftps_vsftpd.py    |  317 +
 third-party/curl/tests/http/test_40_socks.py  |  122 +
 third-party/curl/tests/http/test_50_scp.py    |  214 +
 third-party/curl/tests/http/test_51_sftp.py   |  214 +
 .../curl/tests/http/test_60_h3_proxy.py       |  626 ++
 .../curl/tests/http/testenv/__init__.py       |   20 +-
 third-party/curl/tests/http/testenv/caddy.py  |   99 +-
 third-party/curl/tests/http/testenv/certs.py  |  105 +-
 third-party/curl/tests/http/testenv/client.py |   53 +-
 third-party/curl/tests/http/testenv/curl.py   |  850 ++-
 third-party/curl/tests/http/testenv/dante.py  |  179 +
 third-party/curl/tests/http/testenv/dnsd.py   |  175 +
 third-party/curl/tests/http/testenv/env.py    |  796 +-
 third-party/curl/tests/http/testenv/h2o.py    |  448 ++
 third-party/curl/tests/http/testenv/httpd.py  |  417 +-
 .../http/testenv/mod_curltest/mod_curltest.c  |  639 +-
 .../curl/tests/http/testenv/nghttpx.py        |  214 +-
 third-party/curl/tests/http/testenv/ports.py  |   22 +-
 third-party/curl/tests/http/testenv/sshd.py   |  293 +
 third-party/curl/tests/http/testenv/vsftpd.py |  231 +
 .../curl/tests/http/testenv/ws_echo_server.py |    2 +-
 third-party/curl/tests/http2-server.pl        |   24 +-
 third-party/curl/tests/http3-server.pl        |   22 +-
 third-party/curl/tests/libtest/.checksrc      |    2 -
 third-party/curl/tests/libtest/.gitignore     |    8 +-
 third-party/curl/tests/libtest/CMakeLists.txt |   97 +-
 third-party/curl/tests/libtest/Makefile.am    |  107 +-
 third-party/curl/tests/libtest/Makefile.inc   |  768 +-
 third-party/curl/tests/libtest/chkhostname.c  |   49 -
 .../curl/tests/libtest/cli_ftp_upload.c       |  182 +
 .../curl/tests/libtest/cli_h2_pausing.c       |  316 +
 .../curl/tests/libtest/cli_h2_serverpush.c    |  192 +
 .../tests/libtest/cli_h2_upgrade_extreme.c    |  171 +
 .../curl/tests/libtest/cli_hx_download.c      |  607 ++
 .../curl/tests/libtest/cli_hx_upload.c        |  548 ++
 .../tests/libtest/cli_tls_session_reuse.c     |  266 +
 .../curl/tests/libtest/cli_upload_pausing.c   |  215 +
 third-party/curl/tests/libtest/cli_ws_data.c  |  484 ++
 .../curl/tests/libtest/cli_ws_pingpong.c      |   96 +
 third-party/curl/tests/libtest/first.c        |  274 +-
 third-party/curl/tests/libtest/first.h        |  536 ++
 third-party/curl/tests/libtest/lib1156.c      |   92 +-
 third-party/curl/tests/libtest/lib1301.c      |   34 +-
 third-party/curl/tests/libtest/lib1308.c      |   99 +
 third-party/curl/tests/libtest/lib1485.c      |  117 +
 third-party/curl/tests/libtest/lib1500.c      |   39 +-
 third-party/curl/tests/libtest/lib1501.c      |   73 +-
 third-party/curl/tests/libtest/lib1502.c      |  111 +-
 third-party/curl/tests/libtest/lib1506.c      |   68 +-
 third-party/curl/tests/libtest/lib1507.c      |   93 +-
 third-party/curl/tests/libtest/lib1508.c      |   20 +-
 third-party/curl/tests/libtest/lib1509.c      |   81 +-
 third-party/curl/tests/libtest/lib1510.c      |   42 +-
 third-party/curl/tests/libtest/lib1511.c      |   26 +-
 third-party/curl/tests/libtest/lib1512.c      |   53 +-
 third-party/curl/tests/libtest/lib1513.c      |   26 +-
 third-party/curl/tests/libtest/lib1514.c      |   45 +-
 third-party/curl/tests/libtest/lib1515.c      |   94 +-
 third-party/curl/tests/libtest/lib1517.c      |   78 +-
 third-party/curl/tests/libtest/lib1518.c      |   78 +-
 third-party/curl/tests/libtest/lib1520.c      |   82 +-
 third-party/curl/tests/libtest/lib1522.c      |   43 +-
 third-party/curl/tests/libtest/lib1523.c      |   58 +-
 third-party/curl/tests/libtest/lib1525.c      |   62 +-
 third-party/curl/tests/libtest/lib1526.c      |   61 +-
 third-party/curl/tests/libtest/lib1527.c      |   60 +-
 third-party/curl/tests/libtest/lib1528.c      |   33 +-
 third-party/curl/tests/libtest/lib1529.c      |   31 +-
 third-party/curl/tests/libtest/lib1530.c      |   25 +-
 third-party/curl/tests/libtest/lib1531.c      |   76 +-
 third-party/curl/tests/libtest/lib1532.c      |   51 +-
 third-party/curl/tests/libtest/lib1533.c      |  102 +-
 third-party/curl/tests/libtest/lib1534.c      |   99 +-
 third-party/curl/tests/libtest/lib1535.c      |  112 +-
 third-party/curl/tests/libtest/lib1536.c      |  102 +-
 third-party/curl/tests/libtest/lib1537.c      |   52 +-
 third-party/curl/tests/libtest/lib1538.c      |   25 +-
 third-party/curl/tests/libtest/lib1540.c      |   71 +-
 third-party/curl/tests/libtest/lib1541.c      |  229 +-
 third-party/curl/tests/libtest/lib1542.c      |   52 +-
 third-party/curl/tests/libtest/lib1545.c      |   52 +
 third-party/curl/tests/libtest/lib1549.c      |   75 +
 third-party/curl/tests/libtest/lib1550.c      |   26 +-
 third-party/curl/tests/libtest/lib1551.c      |   22 +-
 third-party/curl/tests/libtest/lib1552.c      |   43 +-
 third-party/curl/tests/libtest/lib1553.c      |   67 +-
 third-party/curl/tests/libtest/lib1554.c      |   66 +-
 third-party/curl/tests/libtest/lib1555.c      |   42 +-
 third-party/curl/tests/libtest/lib1556.c      |   30 +-
 third-party/curl/tests/libtest/lib1557.c      |   32 +-
 third-party/curl/tests/libtest/lib1558.c      |   34 +-
 third-party/curl/tests/libtest/lib1559.c      |   58 +-
 third-party/curl/tests/libtest/lib1560.c      | 1272 +++-
 third-party/curl/tests/libtest/lib1564.c      |   75 +-
 third-party/curl/tests/libtest/lib1565.c      |  126 +-
 third-party/curl/tests/libtest/lib1567.c      |   29 +-
 third-party/curl/tests/libtest/lib1568.c      |   44 +-
 third-party/curl/tests/libtest/lib1569.c      |   34 +-
 third-party/curl/tests/libtest/lib1571.c      |   70 +
 third-party/curl/tests/libtest/lib1576.c      |   94 +
 third-party/curl/tests/libtest/lib1582.c      |   58 +
 third-party/curl/tests/libtest/lib1587.c      |   98 +
 third-party/curl/tests/libtest/lib1588.c      |  150 +
 third-party/curl/tests/libtest/lib1589.c      |  132 +
 third-party/curl/tests/libtest/lib1591.c      |   49 +-
 third-party/curl/tests/libtest/lib1592.c      |   86 +-
 third-party/curl/tests/libtest/lib1593.c      |   26 +-
 third-party/curl/tests/libtest/lib1594.c      |   26 +-
 third-party/curl/tests/libtest/lib1597.c      |   62 +-
 third-party/curl/tests/libtest/lib1598.c      |  104 +
 third-party/curl/tests/libtest/lib1599.c      |   44 +
 third-party/curl/tests/libtest/lib1647.c      |  120 +
 third-party/curl/tests/libtest/lib1648.c      |  135 +
 third-party/curl/tests/libtest/lib1649.c      |   90 +
 third-party/curl/tests/libtest/lib1662.c      |   66 +-
 third-party/curl/tests/libtest/lib1686.c      |   93 +
 third-party/curl/tests/libtest/lib1900.c      |   51 +
 third-party/curl/tests/libtest/lib1901.c      |   79 +
 third-party/curl/tests/libtest/lib1902.c      |   46 +
 third-party/curl/tests/libtest/lib1903.c      |   41 +-
 third-party/curl/tests/libtest/lib1905.c      |   63 +-
 third-party/curl/tests/libtest/lib1906.c      |   66 +-
 third-party/curl/tests/libtest/lib1907.c      |   26 +-
 third-party/curl/tests/libtest/lib1908.c      |   44 +-
 third-party/curl/tests/libtest/lib1910.c      |   30 +-
 third-party/curl/tests/libtest/lib1911.c      |   64 +-
 third-party/curl/tests/libtest/lib1912.c      |   97 +-
 third-party/curl/tests/libtest/lib1913.c      |   28 +-
 third-party/curl/tests/libtest/lib1915.c      |  147 +-
 third-party/curl/tests/libtest/lib1916.c      |   32 +-
 third-party/curl/tests/libtest/lib1918.c      |   23 +-
 third-party/curl/tests/libtest/lib1919.c      |   43 +-
 third-party/curl/tests/libtest/lib1920.c      |   55 +
 third-party/curl/tests/libtest/lib1921.c      |   52 +
 third-party/curl/tests/libtest/lib1922.c      |  116 +
 third-party/curl/tests/libtest/lib1933.c      |   30 +-
 third-party/curl/tests/libtest/lib1934.c      |   32 +-
 third-party/curl/tests/libtest/lib1935.c      |   32 +-
 third-party/curl/tests/libtest/lib1936.c      |   32 +-
 third-party/curl/tests/libtest/lib1937.c      |   37 +-
 third-party/curl/tests/libtest/lib1938.c      |   41 +-
 third-party/curl/tests/libtest/lib1939.c      |   45 +-
 third-party/curl/tests/libtest/lib1940.c      |  134 +-
 third-party/curl/tests/libtest/lib1945.c      |   73 +-
 third-party/curl/tests/libtest/lib1947.c      |  107 +-
 third-party/curl/tests/libtest/lib1948.c      |   67 +-
 third-party/curl/tests/libtest/lib1955.c      |   32 +-
 third-party/curl/tests/libtest/lib1956.c      |   32 +-
 third-party/curl/tests/libtest/lib1957.c      |   32 +-
 third-party/curl/tests/libtest/lib1958.c      |   32 +-
 third-party/curl/tests/libtest/lib1959.c      |   32 +-
 third-party/curl/tests/libtest/lib1960.c      |   86 +-
 third-party/curl/tests/libtest/lib1964.c      |   18 +-
 third-party/curl/tests/libtest/lib1965.c      |   55 +
 third-party/curl/tests/libtest/lib1967.c      |   42 +
 third-party/curl/tests/libtest/lib1970.c      |   38 +-
 third-party/curl/tests/libtest/lib1971.c      |   49 +-
 third-party/curl/tests/libtest/lib1972.c      |   36 +-
 third-party/curl/tests/libtest/lib1973.c      |   36 +-
 third-party/curl/tests/libtest/lib1974.c      |   32 +-
 third-party/curl/tests/libtest/lib1975.c      |   49 +-
 third-party/curl/tests/libtest/lib1977.c      |   89 +
 third-party/curl/tests/libtest/lib1978.c      |  102 +
 third-party/curl/tests/libtest/lib2023.c      |  148 +
 third-party/curl/tests/libtest/lib2032.c      |  234 +
 third-party/curl/tests/libtest/lib2082.c      |  102 +
 third-party/curl/tests/libtest/lib2301.c      |  116 +-
 third-party/curl/tests/libtest/lib2302.c      |  192 +-
 third-party/curl/tests/libtest/lib2304.c      |  106 +-
 third-party/curl/tests/libtest/lib2305.c      |  109 -
 third-party/curl/tests/libtest/lib2306.c      |   36 +-
 third-party/curl/tests/libtest/lib2308.c      |   50 +
 third-party/curl/tests/libtest/lib2309.c      |   63 +
 third-party/curl/tests/libtest/lib2402.c      |   64 +-
 third-party/curl/tests/libtest/lib2404.c      |   66 +-
 third-party/curl/tests/libtest/lib2405.c      |  392 +
 third-party/curl/tests/libtest/lib2412.c      |   95 +
 third-party/curl/tests/libtest/lib2502.c      |   72 +-
 third-party/curl/tests/libtest/lib2504.c      |   86 +
 third-party/curl/tests/libtest/lib2505.c      |   64 +
 third-party/curl/tests/libtest/lib2506.c      |   64 +
 third-party/curl/tests/libtest/lib2700.c      |  256 +
 third-party/curl/tests/libtest/lib3010.c      |   36 +-
 third-party/curl/tests/libtest/lib3025.c      |   24 +-
 third-party/curl/tests/libtest/lib3026.c      |  128 +-
 third-party/curl/tests/libtest/lib3027.c      |   36 +-
 third-party/curl/tests/libtest/lib3033.c      |  128 +
 third-party/curl/tests/libtest/lib3034.c      |   77 +
 third-party/curl/tests/libtest/lib3100.c      |   39 +-
 third-party/curl/tests/libtest/lib3101.c      |   35 +-
 third-party/curl/tests/libtest/lib3102.c      |   86 +-
 third-party/curl/tests/libtest/lib3103.c      |   64 +
 third-party/curl/tests/libtest/lib3104.c      |   64 +
 third-party/curl/tests/libtest/lib3105.c      |   62 +
 third-party/curl/tests/libtest/lib3207.c      |  214 +
 third-party/curl/tests/libtest/lib3208.c      |  100 +
 third-party/curl/tests/libtest/lib500.c       |  132 +-
 third-party/curl/tests/libtest/lib501.c       |   24 +-
 third-party/curl/tests/libtest/lib502.c       |   36 +-
 third-party/curl/tests/libtest/lib503.c       |   49 +-
 third-party/curl/tests/libtest/lib504.c       |   69 +-
 third-party/curl/tests/libtest/lib505.c       |  106 +-
 third-party/curl/tests/libtest/lib506.c       |  317 +-
 third-party/curl/tests/libtest/lib507.c       |   30 +-
 third-party/curl/tests/libtest/lib508.c       |   63 +-
 third-party/curl/tests/libtest/lib509.c       |   61 +-
 third-party/curl/tests/libtest/lib510.c       |   77 +-
 third-party/curl/tests/libtest/lib511.c       |   24 +-
 third-party/curl/tests/libtest/lib512.c       |   22 +-
 third-party/curl/tests/libtest/lib513.c       |   34 +-
 third-party/curl/tests/libtest/lib514.c       |   32 +-
 third-party/curl/tests/libtest/lib515.c       |   26 +-
 third-party/curl/tests/libtest/lib516.c       |   26 +-
 third-party/curl/tests/libtest/lib517.c       |  355 +-
 third-party/curl/tests/libtest/lib518.c       |  440 +-
 third-party/curl/tests/libtest/lib519.c       |   30 +-
 third-party/curl/tests/libtest/lib520.c       |   22 +-
 third-party/curl/tests/libtest/lib521.c       |   32 +-
 third-party/curl/tests/libtest/lib523.c       |   26 +-
 third-party/curl/tests/libtest/lib524.c       |   22 +-
 third-party/curl/tests/libtest/lib525.c       |   96 +-
 third-party/curl/tests/libtest/lib526.c       |  155 +-
 third-party/curl/tests/libtest/lib530.c       |  288 +-
 third-party/curl/tests/libtest/lib533.c       |   40 +-
 third-party/curl/tests/libtest/lib536.c       |   81 +
 third-party/curl/tests/libtest/lib537.c       |  451 +-
 third-party/curl/tests/libtest/lib539.c       |  105 +-
 third-party/curl/tests/libtest/lib540.c       |  200 +-
 third-party/curl/tests/libtest/lib541.c       |   71 +-
 third-party/curl/tests/libtest/lib542.c       |   30 +-
 third-party/curl/tests/libtest/lib543.c       |   41 +-
 third-party/curl/tests/libtest/lib544.c       |   56 +-
 third-party/curl/tests/libtest/lib547.c       |   98 +-
 third-party/curl/tests/libtest/lib549.c       |   28 +-
 third-party/curl/tests/libtest/lib552.c       |  168 +-
 third-party/curl/tests/libtest/lib553.c       |   44 +-
 third-party/curl/tests/libtest/lib554.c       |  123 +-
 third-party/curl/tests/libtest/lib555.c       |   71 +-
 third-party/curl/tests/libtest/lib556.c       |  100 +-
 third-party/curl/tests/libtest/lib557.c       |  853 +--
 third-party/curl/tests/libtest/lib558.c       |   22 +-
 third-party/curl/tests/libtest/lib559.c       |   23 +-
 third-party/curl/tests/libtest/lib560.c       |   50 +-
 third-party/curl/tests/libtest/lib562.c       |   43 +-
 third-party/curl/tests/libtest/lib564.c       |   37 +-
 third-party/curl/tests/libtest/lib566.c       |   35 +-
 third-party/curl/tests/libtest/lib567.c       |   31 +-
 third-party/curl/tests/libtest/lib568.c       |  130 +-
 third-party/curl/tests/libtest/lib569.c       |   81 +-
 third-party/curl/tests/libtest/lib570.c       |   79 +-
 third-party/curl/tests/libtest/lib571.c       |  147 +-
 third-party/curl/tests/libtest/lib572.c       |  138 +-
 third-party/curl/tests/libtest/lib573.c       |   57 +-
 third-party/curl/tests/libtest/lib574.c       |   40 +-
 third-party/curl/tests/libtest/lib575.c       |   60 +-
 third-party/curl/tests/libtest/lib576.c       |   97 +-
 third-party/curl/tests/libtest/lib578.c       |   60 +-
 third-party/curl/tests/libtest/lib579.c       |  135 +-
 third-party/curl/tests/libtest/lib582.c       |  212 +-
 third-party/curl/tests/libtest/lib583.c       |   46 +-
 third-party/curl/tests/libtest/lib586.c       |  189 +-
 third-party/curl/tests/libtest/lib589.c       |   48 +-
 third-party/curl/tests/libtest/lib590.c       |   49 +-
 third-party/curl/tests/libtest/lib591.c       |   73 +-
 third-party/curl/tests/libtest/lib597.c       |   47 +-
 third-party/curl/tests/libtest/lib598.c       |   44 +-
 third-party/curl/tests/libtest/lib599.c       |   52 +-
 third-party/curl/tests/libtest/lib643.c       |  212 +-
 third-party/curl/tests/libtest/lib650.c       |   83 +-
 third-party/curl/tests/libtest/lib651.c       |   45 +-
 third-party/curl/tests/libtest/lib652.c       |   78 +-
 third-party/curl/tests/libtest/lib653.c       |   37 +-
 third-party/curl/tests/libtest/lib654.c       |  104 +-
 third-party/curl/tests/libtest/lib655.c       |   73 +-
 third-party/curl/tests/libtest/lib658.c       |   39 +-
 third-party/curl/tests/libtest/lib659.c       |   39 +-
 third-party/curl/tests/libtest/lib661.c       |  230 +-
 third-party/curl/tests/libtest/lib666.c       |   74 +-
 third-party/curl/tests/libtest/lib667.c       |   69 +-
 third-party/curl/tests/libtest/lib668.c       |   67 +-
 third-party/curl/tests/libtest/lib670.c       |  302 +-
 third-party/curl/tests/libtest/lib674.c       |   46 +-
 third-party/curl/tests/libtest/lib676.c       |   38 +-
 third-party/curl/tests/libtest/lib677.c       |   77 +-
 third-party/curl/tests/libtest/lib678.c       |   66 +-
 third-party/curl/tests/libtest/lib694.c       |   75 +
 third-party/curl/tests/libtest/lib695.c       |  104 +
 third-party/curl/tests/libtest/lib751.c       |   86 +
 third-party/curl/tests/libtest/lib753.c       |  183 +
 third-party/curl/tests/libtest/lib757.c       |  125 +
 third-party/curl/tests/libtest/lib758.c       |  505 ++
 third-party/curl/tests/libtest/lib766.c       |   64 +
 third-party/curl/tests/libtest/libauthretry.c |  149 -
 .../curl/tests/libtest/libntlmconnect.c       |  238 -
 third-party/curl/tests/libtest/libprereq.c    |   99 -
 third-party/curl/tests/libtest/memptr.c       |   46 +
 third-party/curl/tests/libtest/mk-lib1521.pl  |  483 +-
 third-party/curl/tests/libtest/notexists.pl   |   38 -
 third-party/curl/tests/libtest/sethostname.c  |   43 -
 third-party/curl/tests/libtest/sethostname.h  |   42 -
 third-party/curl/tests/libtest/stub_gssapi.c  |  462 --
 third-party/curl/tests/libtest/stub_gssapi.h  |  184 -
 third-party/curl/tests/libtest/test.h         |  500 --
 third-party/curl/tests/libtest/test1013.pl    |   40 +-
 third-party/curl/tests/libtest/test1022.pl    |   24 +-
 third-party/curl/tests/libtest/test307.pl     |   16 +-
 third-party/curl/tests/libtest/test610.pl     |   26 +-
 third-party/curl/tests/libtest/test613.pl     |   86 +-
 third-party/curl/tests/libtest/testtrace.c    |  170 +-
 third-party/curl/tests/libtest/testtrace.h    |   20 +-
 third-party/curl/tests/libtest/testutil.c     |  145 +-
 third-party/curl/tests/libtest/testutil.h     |   35 +-
 third-party/curl/tests/libtest/unitcheck.h    |  124 +
 third-party/curl/tests/manpage-scan.pl        |  305 -
 third-party/curl/tests/manpage-syntax.pl      |  288 -
 third-party/curl/tests/markdown-uppercase.pl  |  100 -
 third-party/curl/tests/mem-include-scan.pl    |   98 -
 third-party/curl/tests/memanalyze.pl          |  406 +-
 third-party/curl/tests/memanalyzer.pm         |  446 ++
 third-party/curl/tests/negtelnetserver.py     |   67 +-
 third-party/curl/tests/nroff-scan.pl          |  112 -
 third-party/curl/tests/option-check.pl        |   66 -
 third-party/curl/tests/options-scan.pl        |  125 -
 third-party/curl/tests/pathhelp.pm            |  754 +-
 third-party/curl/tests/processhelp.pm         |  233 +-
 third-party/curl/tests/requirements.txt       |   25 +-
 third-party/curl/tests/rtspserver.pl          |   11 +-
 third-party/curl/tests/runner.pm              |  582 +-
 third-party/curl/tests/runtests.1             |  196 -
 third-party/curl/tests/runtests.pl            | 1511 ++--
 third-party/curl/tests/secureserver.pl        |   89 +-
 third-party/curl/tests/server/.checksrc       |   19 +
 third-party/curl/tests/server/.gitignore      |   12 +-
 third-party/curl/tests/server/CMakeLists.txt  |   81 +-
 third-party/curl/tests/server/Makefile.am     |   34 +-
 third-party/curl/tests/server/Makefile.inc    |  124 +-
 third-party/curl/tests/server/base64.pl       |   32 -
 third-party/curl/tests/server/disabled.c      |  117 -
 third-party/curl/tests/server/dnsd.c          | 1077 +++
 third-party/curl/tests/server/fake_ntlm.c     |  286 -
 third-party/curl/tests/server/first.c         |   59 +
 third-party/curl/tests/server/first.h         |  181 +
 third-party/curl/tests/server/getpart.c       |  186 +-
 third-party/curl/tests/server/getpart.h       |   36 -
 third-party/curl/tests/server/mqttd.c         |  674 +-
 third-party/curl/tests/server/resolve.c       |   79 +-
 third-party/curl/tests/server/rtspd.c         |  646 +-
 third-party/curl/tests/server/server_setup.h  |   31 -
 .../curl/tests/server/server_sockaddr.h       |   43 -
 third-party/curl/tests/server/sockfilt.c      |  909 +--
 third-party/curl/tests/server/socksd.c        |  723 +-
 third-party/curl/tests/server/sws.c           | 1509 ++--
 third-party/curl/tests/server/testpart.c      |   51 -
 third-party/curl/tests/server/tftp.h          |   63 -
 third-party/curl/tests/server/tftpd.c         | 1717 +++--
 third-party/curl/tests/server/util.c          | 1016 +--
 third-party/curl/tests/server/util.h          |   99 -
 third-party/curl/tests/serverhelp.pm          |  134 +-
 third-party/curl/tests/servers.pm             | 1184 +--
 third-party/curl/tests/smbserver.py           |  149 +-
 third-party/curl/tests/sshhelp.pm             |   55 +-
 third-party/curl/tests/sshserver.pl           |  244 +-
 third-party/curl/tests/stunnel.pem            |  165 -
 third-party/curl/tests/symbol-scan.pl         |  245 -
 third-party/curl/tests/test1119.pl            |  247 +
 third-party/curl/tests/test1135.pl            |  108 +
 third-party/curl/tests/test1139.pl            |  316 +
 third-party/curl/tests/test1140.pl            |  115 +
 third-party/curl/tests/test1165.pl            |  215 +
 third-party/curl/tests/test1167.pl            |  156 +
 third-party/curl/tests/test1173.pl            |  394 +
 third-party/curl/tests/test1175.pl            |   80 +
 third-party/curl/tests/test1177.pl            |   95 +
 third-party/curl/tests/test1222.pl            |  335 +
 third-party/curl/tests/test1275.pl            |  131 +
 third-party/curl/tests/test1276.pl            |   69 +
 third-party/curl/tests/test1477.pl            |  101 +
 third-party/curl/tests/test1486.pl            |  113 +
 third-party/curl/tests/test1488.pl            |  141 +
 third-party/curl/tests/test1544.pl            |  147 +
 third-party/curl/tests/test1707.pl            |  130 +
 third-party/curl/tests/test745.pl             |   92 +
 third-party/curl/tests/test971.pl             |  145 +
 third-party/curl/tests/testcurl.1             |  126 -
 third-party/curl/tests/testcurl.pl            |  988 ++-
 third-party/curl/tests/testutil.pm            |  137 +-
 third-party/curl/tests/tftpserver.pl          |   12 +-
 third-party/curl/tests/tunit/.gitignore       |    6 +
 third-party/curl/tests/tunit/CMakeLists.txt   |   57 +
 third-party/curl/tests/tunit/Makefile.am      |   82 +
 third-party/curl/tests/tunit/Makefile.inc     |   38 +
 third-party/curl/tests/tunit/README.md        |   11 +
 third-party/curl/tests/tunit/tool1394.c       |  122 +
 third-party/curl/tests/tunit/tool1604.c       |  232 +
 third-party/curl/tests/tunit/tool1621.c       |   84 +
 third-party/curl/tests/tunit/tool1622.c       |   98 +
 third-party/curl/tests/tunit/tool1623.c       |  125 +
 third-party/curl/tests/tunit/tool1720.c       |   79 +
 third-party/curl/tests/unit/.gitignore        |    3 +-
 third-party/curl/tests/unit/CMakeLists.txt    |   51 +-
 third-party/curl/tests/unit/Makefile.am       |   47 +-
 third-party/curl/tests/unit/Makefile.inc      |  131 +-
 third-party/curl/tests/unit/README.md         |   84 +-
 third-party/curl/tests/unit/curlcheck.h       |  113 -
 third-party/curl/tests/unit/unit1300.c        |  219 +-
 third-party/curl/tests/unit/unit1302.c        |  331 +-
 third-party/curl/tests/unit/unit1303.c        |  160 +-
 third-party/curl/tests/unit/unit1304.c        |  216 +-
 third-party/curl/tests/unit/unit1305.c        |   71 +-
 third-party/curl/tests/unit/unit1307.c        |  484 +-
 third-party/curl/tests/unit/unit1308.c        |   98 -
 third-party/curl/tests/unit/unit1309.c        |   81 +-
 third-party/curl/tests/unit/unit1323.c        |   61 +-
 third-party/curl/tests/unit/unit1330.c        |   25 +-
 third-party/curl/tests/unit/unit1394.c        |  133 -
 third-party/curl/tests/unit/unit1395.c        |  148 +-
 third-party/curl/tests/unit/unit1396.c        |  110 +-
 third-party/curl/tests/unit/unit1397.c        |  158 +-
 third-party/curl/tests/unit/unit1398.c        |  241 +-
 third-party/curl/tests/unit/unit1399.c        |   96 +-
 third-party/curl/tests/unit/unit1600.c        |   61 +-
 third-party/curl/tests/unit/unit1601.c        |   36 +-
 third-party/curl/tests/unit/unit1602.c        |   53 +-
 third-party/curl/tests/unit/unit1603.c        |   67 +-
 third-party/curl/tests/unit/unit1604.c        |  358 -
 third-party/curl/tests/unit/unit1605.c        |   31 +-
 third-party/curl/tests/unit/unit1606.c        |   57 +-
 third-party/curl/tests/unit/unit1607.c        |  235 +-
 third-party/curl/tests/unit/unit1608.c        |   47 +-
 third-party/curl/tests/unit/unit1609.c        |  195 +-
 third-party/curl/tests/unit/unit1610.c        |   45 +-
 third-party/curl/tests/unit/unit1611.c        |   38 +-
 third-party/curl/tests/unit/unit1612.c        |   52 +-
 third-party/curl/tests/unit/unit1614.c        |  249 +-
 third-party/curl/tests/unit/unit1615.c        |  147 +
 third-party/curl/tests/unit/unit1616.c        |   85 +
 third-party/curl/tests/unit/unit1620.c        |  119 +-
 third-party/curl/tests/unit/unit1621.c        |   81 -
 third-party/curl/tests/unit/unit1625.c        |  135 +
 third-party/curl/tests/unit/unit1626.c        |  129 +
 third-party/curl/tests/unit/unit1627.c        |  104 +
 third-party/curl/tests/unit/unit1636.c        |   82 +
 third-party/curl/tests/unit/unit1650.c        |  228 +-
 third-party/curl/tests/unit/unit1651.c        |  679 +-
 third-party/curl/tests/unit/unit1652.c        |  159 +-
 third-party/curl/tests/unit/unit1653.c        |  115 +-
 third-party/curl/tests/unit/unit1654.c        |  108 +-
 third-party/curl/tests/unit/unit1655.c        |  274 +-
 third-party/curl/tests/unit/unit1656.c        |  125 +
 third-party/curl/tests/unit/unit1657.c        |  125 +
 third-party/curl/tests/unit/unit1658.c        |  565 ++
 third-party/curl/tests/unit/unit1660.c        |  181 +-
 third-party/curl/tests/unit/unit1661.c        |   57 +-
 third-party/curl/tests/unit/unit1663.c        |   90 +
 third-party/curl/tests/unit/unit1664.c        |  489 ++
 third-party/curl/tests/unit/unit1666.c        |  202 +
 third-party/curl/tests/unit/unit1667.c        |  335 +
 third-party/curl/tests/unit/unit1668.c        |  177 +
 third-party/curl/tests/unit/unit1669.c        |   58 +
 third-party/curl/tests/unit/unit1674.c        |   85 +
 third-party/curl/tests/unit/unit1675.c        |  443 ++
 third-party/curl/tests/unit/unit1676.c        |  119 +
 third-party/curl/tests/unit/unit1979.c        |  142 +
 third-party/curl/tests/unit/unit1980.c        |  117 +
 third-party/curl/tests/unit/unit2413.c        |  112 +
 third-party/curl/tests/unit/unit2600.c        |  311 +-
 third-party/curl/tests/unit/unit2601.c        |  131 +-
 third-party/curl/tests/unit/unit2602.c        |   81 +-
 third-party/curl/tests/unit/unit2603.c        |  202 +-
 third-party/curl/tests/unit/unit2604.c        |  115 +
 third-party/curl/tests/unit/unit2605.c        |  112 +
 third-party/curl/tests/unit/unit3200.c        |  248 +-
 third-party/curl/tests/unit/unit3205.c        |  614 ++
 third-party/curl/tests/unit/unit3211.c        |  149 +
 third-party/curl/tests/unit/unit3212.c        |  134 +
 third-party/curl/tests/unit/unit3213.c        |  123 +
 third-party/curl/tests/unit/unit3214.c        |   85 +
 third-party/curl/tests/unit/unit3216.c        |  103 +
 third-party/curl/tests/unit/unit3219.c        |   43 +
 third-party/curl/tests/unit/unit3300.c        |  162 +
 third-party/curl/tests/unit/unit3301.c        |  142 +
 third-party/curl/tests/unit/unit3302.c        |   89 +
 third-party/curl/tests/unit/unit3303.c        |  140 +
 third-party/curl/tests/unit/unit3304.c        |  166 +
 third-party/curl/tests/unit/unit3400.c        |  261 +
 third-party/curl/tests/util.py                |   21 +-
 third-party/curl/tests/valgrind.pm            |    3 +-
 third-party/curl/tests/valgrind.supp          |   37 +-
 third-party/curl/tests/version-scan.pl        |   94 -
 third-party/curl/winbuild/.gitignore          |    6 -
 third-party/curl/winbuild/Makefile.vc         |  310 -
 third-party/curl/winbuild/MakefileBuild.vc    |  714 --
 third-party/curl/winbuild/README.md           |  199 -
 third-party/curl/winbuild/gen_resp_file.bat   |   34 -
 third-party/curl/winbuild/makedebug.cmd       |   36 -
 vendor.yaml                                   |    2 +-
 5480 files changed, 345923 insertions(+), 288294 deletions(-)
 delete mode 100644 third-party/curl/.azure-pipelines.yml
 delete mode 100644 third-party/curl/.cirrus.yml
 create mode 100644 third-party/curl/.clang-tidy.yml
 delete mode 100644 third-party/curl/.dcignore
 create mode 100644 third-party/curl/.editorconfig
 create mode 100644 third-party/curl/.github/ISSUE_TEMPLATE/docs.yml
 create mode 100644 third-party/curl/.github/dependabot.yml
 create mode 100644 third-party/curl/.github/pull_request_template.md
 create mode 100644 third-party/curl/.github/scripts/cleancmd.pl
 delete mode 100644 third-party/curl/.github/scripts/cleanspell.pl
 create mode 100644 third-party/curl/.github/scripts/cmp-config.pl
 create mode 100644 third-party/curl/.github/scripts/cmp-pkg-config.sh
 create mode 100644 third-party/curl/.github/scripts/codespell-ignore.words
 create mode 100644 third-party/curl/.github/scripts/codespell.sh
 create mode 100644 third-party/curl/.github/scripts/distfiles.sh
 create mode 100644 third-party/curl/.github/scripts/pyspelling.words
 create mode 100644 third-party/curl/.github/scripts/pyspelling.yaml
 create mode 100644 third-party/curl/.github/scripts/randcurl.pl
 create mode 100644 third-party/curl/.github/scripts/requirements-docs.txt
 create mode 100644 third-party/curl/.github/scripts/requirements-proselint.txt
 create mode 100644 third-party/curl/.github/scripts/requirements.txt
 create mode 100644 third-party/curl/.github/scripts/shellcheck-ci.sh
 create mode 100644 third-party/curl/.github/scripts/shellcheck.sh
 create mode 100644 third-party/curl/.github/scripts/spellcheck.curl
 delete mode 100644 third-party/curl/.github/scripts/spellcheck.words
 delete mode 100644 third-party/curl/.github/scripts/spellcheck.yaml
 create mode 100644 third-party/curl/.github/scripts/trimmarkdownheader.pl
 create mode 100644 third-party/curl/.github/scripts/typos.sh
 create mode 100644 third-party/curl/.github/scripts/typos.toml
 create mode 100644 third-party/curl/.github/scripts/verify-examples.pl
 create mode 100644 third-party/curl/.github/scripts/verify-synopsis.pl
 create mode 100644 third-party/curl/.github/scripts/yamlcheck.sh
 create mode 100644 third-party/curl/.github/scripts/yamlcheck.yaml
 delete mode 100644 third-party/curl/.github/workflows/awslc.yml
 create mode 100644 third-party/curl/.github/workflows/checkdocs.yml
 create mode 100644 third-party/curl/.github/workflows/checksrc.yml
 create mode 100644 third-party/curl/.github/workflows/checkurls.yml
 delete mode 100644 third-party/curl/.github/workflows/codeql-analysis.yml
 create mode 100644 third-party/curl/.github/workflows/codeql.yml
 create mode 100644 third-party/curl/.github/workflows/configure-vs-cmake.yml
 create mode 100644 third-party/curl/.github/workflows/curl-for-win.yml
 create mode 100644 third-party/curl/.github/workflows/distcheck.yml
 delete mode 100644 third-party/curl/.github/workflows/hacktoberfest-accepted.yml
 create mode 100644 third-party/curl/.github/workflows/http3-linux.yml
 delete mode 100644 third-party/curl/.github/workflows/linkcheck.yml
 create mode 100644 third-party/curl/.github/workflows/linux-old.yml
 delete mode 100644 third-party/curl/.github/workflows/linux32.yml
 delete mode 100644 third-party/curl/.github/workflows/ngtcp2-linux.yml
 create mode 100644 third-party/curl/.github/workflows/non-native.yml
 delete mode 100644 third-party/curl/.github/workflows/proselint.yml
 delete mode 100644 third-party/curl/.github/workflows/quiche-linux.yml
 delete mode 100644 third-party/curl/.github/workflows/reuse.yml
 delete mode 100644 third-party/curl/.github/workflows/spellcheck.yml
 delete mode 100644 third-party/curl/.github/workflows/torture.yml
 create mode 100644 third-party/curl/.github/workflows/windows.yml
 delete mode 100644 third-party/curl/.github/workflows/wolfssl.yml
 delete mode 100644 third-party/curl/.reuse/dep5
 delete mode 100644 third-party/curl/CHANGES
 create mode 100644 third-party/curl/CHANGES.md
 delete mode 100644 third-party/curl/CMake/CMakeConfigurableFile.in
 delete mode 100644 third-party/curl/CMake/FindBearSSL.cmake
 create mode 100644 third-party/curl/CMake/FindGnuTLS.cmake
 create mode 100644 third-party/curl/CMake/FindLDAP.cmake
 create mode 100644 third-party/curl/CMake/FindLibbacktrace.cmake
 create mode 100644 third-party/curl/CMake/FindLibgsasl.cmake
 create mode 100644 third-party/curl/CMake/FindLibidn2.cmake
 create mode 100644 third-party/curl/CMake/FindLibssh.cmake
 create mode 100644 third-party/curl/CMake/FindLibuv.cmake
 delete mode 100644 third-party/curl/CMake/FindMSH3.cmake
 create mode 100644 third-party/curl/CMake/FindNettle.cmake
 create mode 100644 third-party/curl/CMake/FindRustls.cmake
 delete mode 100644 third-party/curl/CMake/Platforms/WindowsCache.cmake
 delete mode 100644 third-party/curl/CMake/cmake_uninstall.cmake.in
 create mode 100644 third-party/curl/CMake/cmake_uninstall.in.cmake
 delete mode 100644 third-party/curl/CMake/curl-config.cmake.in
 create mode 100644 third-party/curl/CMake/curl-config.in.cmake
 create mode 100644 third-party/curl/CMake/unix-cache.cmake
 create mode 100644 third-party/curl/CMake/win32-cache.cmake
 create mode 100644 third-party/curl/Dockerfile
 delete mode 100644 third-party/curl/GIT-INFO
 create mode 100644 third-party/curl/GIT-INFO.md
 delete mode 100644 third-party/curl/LICENSES/BSD-3-Clause.txt
 delete mode 100644 third-party/curl/MacOSX-Framework
 delete mode 100644 third-party/curl/Makefile.dist
 create mode 100644 third-party/curl/REUSE.toml
 create mode 100644 third-party/curl/appveyor.sh
 delete mode 100644 third-party/curl/buildconf
 delete mode 100644 third-party/curl/buildconf.bat
 delete mode 100644 third-party/curl/docs/BUFQ.md
 delete mode 100644 third-party/curl/docs/CHECKSRC.md
 create mode 100644 third-party/curl/docs/CIPHERS-TLS12.md
 delete mode 100644 third-party/curl/docs/CONNECTION-FILTERS.md
 create mode 100644 third-party/curl/docs/CURLDOWN.md
 create mode 100644 third-party/curl/docs/DISTROS.md
 delete mode 100644 third-party/curl/docs/DYNBUF.md
 create mode 100644 third-party/curl/docs/ECH.md
 delete mode 100644 third-party/curl/docs/FAQ
 create mode 100644 third-party/curl/docs/FAQ.md
 delete mode 100644 third-party/curl/docs/HTTP2.md
 create mode 100644 third-party/curl/docs/HTTPSRR.md
 delete mode 100644 third-party/curl/docs/HYPER.md
 create mode 100644 third-party/curl/docs/INFRASTRUCTURE.md
 create mode 100644 third-party/curl/docs/INSTALL-CMAKE.md
 delete mode 100644 third-party/curl/docs/INSTALL.cmake
 create mode 100644 third-party/curl/docs/IPFS.md
 delete mode 100644 third-party/curl/docs/KNOWN_BUGS
 create mode 100644 third-party/curl/docs/KNOWN_BUGS.md
 create mode 100644 third-party/curl/docs/KNOWN_RISKS.md
 delete mode 100644 third-party/curl/docs/MAIL-ETIQUETTE
 create mode 100644 third-party/curl/docs/MAIL-ETIQUETTE.md
 delete mode 100644 third-party/curl/docs/MQTT.md
 delete mode 100644 third-party/curl/docs/PARALLEL-TRANSFERS.md
 delete mode 100644 third-party/curl/docs/SECURITY-PROCESS.md
 create mode 100644 third-party/curl/docs/SPONSORS.md
 delete mode 100644 third-party/curl/docs/TODO
 create mode 100644 third-party/curl/docs/TODO.md
 create mode 100644 third-party/curl/docs/VERIFY.md
 create mode 100644 third-party/curl/docs/VULN-DISCLOSURE-POLICY.md
 create mode 100644 third-party/curl/docs/cmdline-opts/.gitignore
 create mode 100644 third-party/curl/docs/cmdline-opts/_AUTHORS.md
 create mode 100644 third-party/curl/docs/cmdline-opts/_BUGS.md
 create mode 100644 third-party/curl/docs/cmdline-opts/_DESCRIPTION.md
 create mode 100644 third-party/curl/docs/cmdline-opts/_ENVIRONMENT.md
 create mode 100644 third-party/curl/docs/cmdline-opts/_EXITCODES.md
 create mode 100644 third-party/curl/docs/cmdline-opts/_FILES.md
 create mode 100644 third-party/curl/docs/cmdline-opts/_GLOBBING.md
 create mode 100644 third-party/curl/docs/cmdline-opts/_NAME.md
 create mode 100644 third-party/curl/docs/cmdline-opts/_OPTIONS.md
 create mode 100644 third-party/curl/docs/cmdline-opts/_OUTPUT.md
 create mode 100644 third-party/curl/docs/cmdline-opts/_PROGRESS.md
 create mode 100644 third-party/curl/docs/cmdline-opts/_PROTOCOLS.md
 create mode 100644 third-party/curl/docs/cmdline-opts/_PROXYPREFIX.md
 create mode 100644 third-party/curl/docs/cmdline-opts/_SEEALSO.md
 create mode 100644 third-party/curl/docs/cmdline-opts/_SYNOPSIS.md
 create mode 100644 third-party/curl/docs/cmdline-opts/_URL.md
 create mode 100644 third-party/curl/docs/cmdline-opts/_VARIABLES.md
 create mode 100644 third-party/curl/docs/cmdline-opts/_VERSION.md
 create mode 100644 third-party/curl/docs/cmdline-opts/_WWW.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/abstract-unix-socket.d
 create mode 100644 third-party/curl/docs/cmdline-opts/abstract-unix-socket.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/alt-svc.d
 create mode 100644 third-party/curl/docs/cmdline-opts/alt-svc.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/anyauth.d
 create mode 100644 third-party/curl/docs/cmdline-opts/anyauth.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/append.d
 create mode 100644 third-party/curl/docs/cmdline-opts/append.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/aws-sigv4.d
 create mode 100644 third-party/curl/docs/cmdline-opts/aws-sigv4.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/basic.d
 create mode 100644 third-party/curl/docs/cmdline-opts/basic.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ca-native.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ca-native.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/cacert.d
 create mode 100644 third-party/curl/docs/cmdline-opts/cacert.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/capath.d
 create mode 100644 third-party/curl/docs/cmdline-opts/capath.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/cert-status.d
 create mode 100644 third-party/curl/docs/cmdline-opts/cert-status.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/cert-type.d
 create mode 100644 third-party/curl/docs/cmdline-opts/cert-type.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/cert.d
 create mode 100644 third-party/curl/docs/cmdline-opts/cert.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ciphers.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ciphers.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/compressed-ssh.d
 create mode 100644 third-party/curl/docs/cmdline-opts/compressed-ssh.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/compressed.d
 create mode 100644 third-party/curl/docs/cmdline-opts/compressed.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/config.d
 create mode 100644 third-party/curl/docs/cmdline-opts/config.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/connect-timeout.d
 create mode 100644 third-party/curl/docs/cmdline-opts/connect-timeout.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/connect-to.d
 create mode 100644 third-party/curl/docs/cmdline-opts/connect-to.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/continue-at.d
 create mode 100644 third-party/curl/docs/cmdline-opts/continue-at.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/cookie-jar.d
 create mode 100644 third-party/curl/docs/cmdline-opts/cookie-jar.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/cookie.d
 create mode 100644 third-party/curl/docs/cmdline-opts/cookie.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/create-dirs.d
 create mode 100644 third-party/curl/docs/cmdline-opts/create-dirs.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/create-file-mode.d
 create mode 100644 third-party/curl/docs/cmdline-opts/create-file-mode.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/crlf.d
 create mode 100644 third-party/curl/docs/cmdline-opts/crlf.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/crlfile.d
 create mode 100644 third-party/curl/docs/cmdline-opts/crlfile.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/curves.d
 create mode 100644 third-party/curl/docs/cmdline-opts/curves.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/data-ascii.d
 create mode 100644 third-party/curl/docs/cmdline-opts/data-ascii.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/data-binary.d
 create mode 100644 third-party/curl/docs/cmdline-opts/data-binary.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/data-raw.d
 create mode 100644 third-party/curl/docs/cmdline-opts/data-raw.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/data-urlencode.d
 create mode 100644 third-party/curl/docs/cmdline-opts/data-urlencode.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/data.d
 create mode 100644 third-party/curl/docs/cmdline-opts/data.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/delegation.d
 create mode 100644 third-party/curl/docs/cmdline-opts/delegation.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/digest.d
 create mode 100644 third-party/curl/docs/cmdline-opts/digest.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/disable-eprt.d
 create mode 100644 third-party/curl/docs/cmdline-opts/disable-eprt.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/disable-epsv.d
 create mode 100644 third-party/curl/docs/cmdline-opts/disable-epsv.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/disable.d
 create mode 100644 third-party/curl/docs/cmdline-opts/disable.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/disallow-username-in-url.d
 create mode 100644 third-party/curl/docs/cmdline-opts/disallow-username-in-url.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/dns-interface.d
 create mode 100644 third-party/curl/docs/cmdline-opts/dns-interface.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/dns-ipv4-addr.d
 create mode 100644 third-party/curl/docs/cmdline-opts/dns-ipv4-addr.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/dns-ipv6-addr.d
 create mode 100644 third-party/curl/docs/cmdline-opts/dns-ipv6-addr.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/dns-servers.d
 create mode 100644 third-party/curl/docs/cmdline-opts/dns-servers.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/doh-cert-status.d
 create mode 100644 third-party/curl/docs/cmdline-opts/doh-cert-status.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/doh-insecure.d
 create mode 100644 third-party/curl/docs/cmdline-opts/doh-insecure.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/doh-url.d
 create mode 100644 third-party/curl/docs/cmdline-opts/doh-url.md
 create mode 100644 third-party/curl/docs/cmdline-opts/dump-ca-embed.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/dump-header.d
 create mode 100644 third-party/curl/docs/cmdline-opts/dump-header.md
 create mode 100644 third-party/curl/docs/cmdline-opts/ech.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/egd-file.d
 create mode 100644 third-party/curl/docs/cmdline-opts/egd-file.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/engine.d
 create mode 100644 third-party/curl/docs/cmdline-opts/engine.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/etag-compare.d
 create mode 100644 third-party/curl/docs/cmdline-opts/etag-compare.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/etag-save.d
 create mode 100644 third-party/curl/docs/cmdline-opts/etag-save.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/expect100-timeout.d
 create mode 100644 third-party/curl/docs/cmdline-opts/expect100-timeout.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/fail-early.d
 create mode 100644 third-party/curl/docs/cmdline-opts/fail-early.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/fail-with-body.d
 create mode 100644 third-party/curl/docs/cmdline-opts/fail-with-body.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/fail.d
 create mode 100644 third-party/curl/docs/cmdline-opts/fail.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/false-start.d
 create mode 100644 third-party/curl/docs/cmdline-opts/false-start.md
 create mode 100644 third-party/curl/docs/cmdline-opts/follow.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/form-escape.d
 create mode 100644 third-party/curl/docs/cmdline-opts/form-escape.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/form-string.d
 create mode 100644 third-party/curl/docs/cmdline-opts/form-string.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/form.d
 create mode 100644 third-party/curl/docs/cmdline-opts/form.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ftp-account.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ftp-account.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ftp-alternative-to-user.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ftp-alternative-to-user.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ftp-create-dirs.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ftp-create-dirs.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ftp-method.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ftp-method.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ftp-pasv.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ftp-pasv.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ftp-port.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ftp-port.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ftp-pret.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ftp-pret.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ftp-skip-pasv-ip.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ftp-skip-pasv-ip.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ftp-ssl-ccc-mode.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ftp-ssl-ccc-mode.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ftp-ssl-ccc.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ftp-ssl-ccc.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ftp-ssl-control.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ftp-ssl-control.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/gen.pl
 delete mode 100644 third-party/curl/docs/cmdline-opts/get.d
 create mode 100644 third-party/curl/docs/cmdline-opts/get.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/globoff.d
 create mode 100644 third-party/curl/docs/cmdline-opts/globoff.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/happy-eyeballs-timeout-ms.d
 create mode 100644 third-party/curl/docs/cmdline-opts/happy-eyeballs-timeout-ms.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/haproxy-clientip.d
 create mode 100644 third-party/curl/docs/cmdline-opts/haproxy-clientip.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/haproxy-protocol.d
 create mode 100644 third-party/curl/docs/cmdline-opts/haproxy-protocol.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/head.d
 create mode 100644 third-party/curl/docs/cmdline-opts/head.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/header.d
 create mode 100644 third-party/curl/docs/cmdline-opts/header.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/help.d
 create mode 100644 third-party/curl/docs/cmdline-opts/help.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/hostpubmd5.d
 create mode 100644 third-party/curl/docs/cmdline-opts/hostpubmd5.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/hostpubsha256.d
 create mode 100644 third-party/curl/docs/cmdline-opts/hostpubsha256.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/hsts.d
 create mode 100644 third-party/curl/docs/cmdline-opts/hsts.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/http0.9.d
 create mode 100644 third-party/curl/docs/cmdline-opts/http0.9.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/http1.0.d
 create mode 100644 third-party/curl/docs/cmdline-opts/http1.0.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/http1.1.d
 create mode 100644 third-party/curl/docs/cmdline-opts/http1.1.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/http2-prior-knowledge.d
 create mode 100644 third-party/curl/docs/cmdline-opts/http2-prior-knowledge.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/http2.d
 create mode 100644 third-party/curl/docs/cmdline-opts/http2.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/http3-only.d
 create mode 100644 third-party/curl/docs/cmdline-opts/http3-only.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/http3.d
 create mode 100644 third-party/curl/docs/cmdline-opts/http3.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ignore-content-length.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ignore-content-length.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/include.d
 delete mode 100644 third-party/curl/docs/cmdline-opts/insecure.d
 create mode 100644 third-party/curl/docs/cmdline-opts/insecure.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/interface.d
 create mode 100644 third-party/curl/docs/cmdline-opts/interface.md
 create mode 100644 third-party/curl/docs/cmdline-opts/ip-tos.md
 create mode 100644 third-party/curl/docs/cmdline-opts/ipfs-gateway.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ipv4.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ipv4.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ipv6.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ipv6.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/json.d
 create mode 100644 third-party/curl/docs/cmdline-opts/json.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/junk-session-cookies.d
 create mode 100644 third-party/curl/docs/cmdline-opts/junk-session-cookies.md
 create mode 100644 third-party/curl/docs/cmdline-opts/keepalive-cnt.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/keepalive-time.d
 create mode 100644 third-party/curl/docs/cmdline-opts/keepalive-time.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/key-type.d
 create mode 100644 third-party/curl/docs/cmdline-opts/key-type.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/key.d
 create mode 100644 third-party/curl/docs/cmdline-opts/key.md
 create mode 100644 third-party/curl/docs/cmdline-opts/knownhosts.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/krb.d
 create mode 100644 third-party/curl/docs/cmdline-opts/krb.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/libcurl.d
 create mode 100644 third-party/curl/docs/cmdline-opts/libcurl.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/limit-rate.d
 create mode 100644 third-party/curl/docs/cmdline-opts/limit-rate.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/list-only.d
 create mode 100644 third-party/curl/docs/cmdline-opts/list-only.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/local-port.d
 create mode 100644 third-party/curl/docs/cmdline-opts/local-port.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/location-trusted.d
 create mode 100644 third-party/curl/docs/cmdline-opts/location-trusted.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/location.d
 create mode 100644 third-party/curl/docs/cmdline-opts/location.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/login-options.d
 create mode 100644 third-party/curl/docs/cmdline-opts/login-options.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/mail-auth.d
 create mode 100644 third-party/curl/docs/cmdline-opts/mail-auth.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/mail-from.d
 create mode 100644 third-party/curl/docs/cmdline-opts/mail-from.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/mail-rcpt-allowfails.d
 create mode 100644 third-party/curl/docs/cmdline-opts/mail-rcpt-allowfails.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/mail-rcpt.d
 create mode 100644 third-party/curl/docs/cmdline-opts/mail-rcpt.md
 create mode 100644 third-party/curl/docs/cmdline-opts/mainpage.idx
 delete mode 100644 third-party/curl/docs/cmdline-opts/manual.d
 create mode 100644 third-party/curl/docs/cmdline-opts/manual.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/max-filesize.d
 create mode 100644 third-party/curl/docs/cmdline-opts/max-filesize.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/max-redirs.d
 create mode 100644 third-party/curl/docs/cmdline-opts/max-redirs.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/max-time.d
 create mode 100644 third-party/curl/docs/cmdline-opts/max-time.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/metalink.d
 create mode 100644 third-party/curl/docs/cmdline-opts/metalink.md
 create mode 100644 third-party/curl/docs/cmdline-opts/mptcp.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/negotiate.d
 create mode 100644 third-party/curl/docs/cmdline-opts/negotiate.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/netrc-file.d
 create mode 100644 third-party/curl/docs/cmdline-opts/netrc-file.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/netrc-optional.d
 create mode 100644 third-party/curl/docs/cmdline-opts/netrc-optional.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/netrc.d
 create mode 100644 third-party/curl/docs/cmdline-opts/netrc.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/next.d
 create mode 100644 third-party/curl/docs/cmdline-opts/next.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/no-alpn.d
 create mode 100644 third-party/curl/docs/cmdline-opts/no-alpn.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/no-buffer.d
 create mode 100644 third-party/curl/docs/cmdline-opts/no-buffer.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/no-clobber.d
 create mode 100644 third-party/curl/docs/cmdline-opts/no-clobber.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/no-keepalive.d
 create mode 100644 third-party/curl/docs/cmdline-opts/no-keepalive.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/no-npn.d
 create mode 100644 third-party/curl/docs/cmdline-opts/no-npn.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/no-progress-meter.d
 create mode 100644 third-party/curl/docs/cmdline-opts/no-progress-meter.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/no-sessionid.d
 create mode 100644 third-party/curl/docs/cmdline-opts/no-sessionid.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/noproxy.d
 create mode 100644 third-party/curl/docs/cmdline-opts/noproxy.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ntlm-wb.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ntlm-wb.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ntlm.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ntlm.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/oauth2-bearer.d
 create mode 100644 third-party/curl/docs/cmdline-opts/oauth2-bearer.md
 create mode 100644 third-party/curl/docs/cmdline-opts/out-null.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/output-dir.d
 create mode 100644 third-party/curl/docs/cmdline-opts/output-dir.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/output.d
 create mode 100644 third-party/curl/docs/cmdline-opts/output.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/page-footer
 delete mode 100644 third-party/curl/docs/cmdline-opts/page-header
 delete mode 100644 third-party/curl/docs/cmdline-opts/parallel-immediate.d
 create mode 100644 third-party/curl/docs/cmdline-opts/parallel-immediate.md
 create mode 100644 third-party/curl/docs/cmdline-opts/parallel-max-host.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/parallel-max.d
 create mode 100644 third-party/curl/docs/cmdline-opts/parallel-max.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/parallel.d
 create mode 100644 third-party/curl/docs/cmdline-opts/parallel.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/pass.d
 create mode 100644 third-party/curl/docs/cmdline-opts/pass.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/path-as-is.d
 create mode 100644 third-party/curl/docs/cmdline-opts/path-as-is.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/pinnedpubkey.d
 create mode 100644 third-party/curl/docs/cmdline-opts/pinnedpubkey.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/post301.d
 create mode 100644 third-party/curl/docs/cmdline-opts/post301.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/post302.d
 create mode 100644 third-party/curl/docs/cmdline-opts/post302.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/post303.d
 create mode 100644 third-party/curl/docs/cmdline-opts/post303.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/preproxy.d
 create mode 100644 third-party/curl/docs/cmdline-opts/preproxy.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/progress-bar.d
 create mode 100644 third-party/curl/docs/cmdline-opts/progress-bar.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proto-default.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proto-default.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proto-redir.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proto-redir.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proto.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proto.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-anyauth.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-anyauth.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-basic.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-basic.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-ca-native.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-ca-native.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-cacert.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-cacert.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-capath.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-capath.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-cert-type.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-cert-type.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-cert.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-cert.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-ciphers.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-ciphers.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-crlfile.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-crlfile.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-digest.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-digest.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-header.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-header.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-http2.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-http2.md
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-http3.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-insecure.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-insecure.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-key-type.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-key-type.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-key.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-key.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-negotiate.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-negotiate.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-ntlm.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-ntlm.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-pass.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-pass.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-pinnedpubkey.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-pinnedpubkey.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-service-name.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-service-name.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-ssl-allow-beast.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-ssl-allow-beast.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-ssl-auto-client-cert.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-ssl-auto-client-cert.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-tls13-ciphers.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-tls13-ciphers.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-tlsauthtype.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-tlsauthtype.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-tlspassword.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-tlspassword.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-tlsuser.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-tlsuser.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-tlsv1.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-tlsv1.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy-user.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy-user.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxy1.0.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxy1.0.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/proxytunnel.d
 create mode 100644 third-party/curl/docs/cmdline-opts/proxytunnel.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/pubkey.d
 create mode 100644 third-party/curl/docs/cmdline-opts/pubkey.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/quote.d
 create mode 100644 third-party/curl/docs/cmdline-opts/quote.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/random-file.d
 create mode 100644 third-party/curl/docs/cmdline-opts/random-file.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/range.d
 create mode 100644 third-party/curl/docs/cmdline-opts/range.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/rate.d
 create mode 100644 third-party/curl/docs/cmdline-opts/rate.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/raw.d
 create mode 100644 third-party/curl/docs/cmdline-opts/raw.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/referer.d
 create mode 100644 third-party/curl/docs/cmdline-opts/referer.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/remote-header-name.d
 create mode 100644 third-party/curl/docs/cmdline-opts/remote-header-name.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/remote-name-all.d
 create mode 100644 third-party/curl/docs/cmdline-opts/remote-name-all.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/remote-name.d
 create mode 100644 third-party/curl/docs/cmdline-opts/remote-name.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/remote-time.d
 create mode 100644 third-party/curl/docs/cmdline-opts/remote-time.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/remove-on-error.d
 create mode 100644 third-party/curl/docs/cmdline-opts/remove-on-error.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/request-target.d
 create mode 100644 third-party/curl/docs/cmdline-opts/request-target.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/request.d
 create mode 100644 third-party/curl/docs/cmdline-opts/request.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/resolve.d
 create mode 100644 third-party/curl/docs/cmdline-opts/resolve.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/retry-all-errors.d
 create mode 100644 third-party/curl/docs/cmdline-opts/retry-all-errors.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/retry-connrefused.d
 create mode 100644 third-party/curl/docs/cmdline-opts/retry-connrefused.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/retry-delay.d
 create mode 100644 third-party/curl/docs/cmdline-opts/retry-delay.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/retry-max-time.d
 create mode 100644 third-party/curl/docs/cmdline-opts/retry-max-time.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/retry.d
 create mode 100644 third-party/curl/docs/cmdline-opts/retry.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/sasl-authzid.d
 create mode 100644 third-party/curl/docs/cmdline-opts/sasl-authzid.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/sasl-ir.d
 create mode 100644 third-party/curl/docs/cmdline-opts/sasl-ir.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/service-name.d
 create mode 100644 third-party/curl/docs/cmdline-opts/service-name.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/show-error.d
 create mode 100644 third-party/curl/docs/cmdline-opts/show-error.md
 create mode 100644 third-party/curl/docs/cmdline-opts/show-headers.md
 create mode 100644 third-party/curl/docs/cmdline-opts/sigalgs.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/silent.d
 create mode 100644 third-party/curl/docs/cmdline-opts/silent.md
 create mode 100644 third-party/curl/docs/cmdline-opts/skip-existing.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/socks4.d
 create mode 100644 third-party/curl/docs/cmdline-opts/socks4.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/socks4a.d
 create mode 100644 third-party/curl/docs/cmdline-opts/socks4a.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/socks5-basic.d
 create mode 100644 third-party/curl/docs/cmdline-opts/socks5-basic.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/socks5-gssapi-nec.d
 create mode 100644 third-party/curl/docs/cmdline-opts/socks5-gssapi-nec.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/socks5-gssapi-service.d
 create mode 100644 third-party/curl/docs/cmdline-opts/socks5-gssapi-service.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/socks5-gssapi.d
 create mode 100644 third-party/curl/docs/cmdline-opts/socks5-gssapi.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/socks5-hostname.d
 create mode 100644 third-party/curl/docs/cmdline-opts/socks5-hostname.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/socks5.d
 create mode 100644 third-party/curl/docs/cmdline-opts/socks5.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/speed-limit.d
 create mode 100644 third-party/curl/docs/cmdline-opts/speed-limit.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/speed-time.d
 create mode 100644 third-party/curl/docs/cmdline-opts/speed-time.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ssl-allow-beast.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ssl-allow-beast.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ssl-auto-client-cert.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ssl-auto-client-cert.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ssl-no-revoke.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ssl-no-revoke.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ssl-reqd.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ssl-reqd.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ssl-revoke-best-effort.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ssl-revoke-best-effort.md
 create mode 100644 third-party/curl/docs/cmdline-opts/ssl-sessions.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/ssl.d
 create mode 100644 third-party/curl/docs/cmdline-opts/ssl.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/sslv2.d
 create mode 100644 third-party/curl/docs/cmdline-opts/sslv2.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/sslv3.d
 create mode 100644 third-party/curl/docs/cmdline-opts/sslv3.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/stderr.d
 create mode 100644 third-party/curl/docs/cmdline-opts/stderr.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/styled-output.d
 create mode 100644 third-party/curl/docs/cmdline-opts/styled-output.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/suppress-connect-headers.d
 create mode 100644 third-party/curl/docs/cmdline-opts/suppress-connect-headers.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/tcp-fastopen.d
 create mode 100644 third-party/curl/docs/cmdline-opts/tcp-fastopen.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/tcp-nodelay.d
 create mode 100644 third-party/curl/docs/cmdline-opts/tcp-nodelay.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/telnet-option.d
 create mode 100644 third-party/curl/docs/cmdline-opts/telnet-option.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/tftp-blksize.d
 create mode 100644 third-party/curl/docs/cmdline-opts/tftp-blksize.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/tftp-no-options.d
 create mode 100644 third-party/curl/docs/cmdline-opts/tftp-no-options.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/time-cond.d
 create mode 100644 third-party/curl/docs/cmdline-opts/time-cond.md
 create mode 100644 third-party/curl/docs/cmdline-opts/tls-earlydata.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/tls-max.d
 create mode 100644 third-party/curl/docs/cmdline-opts/tls-max.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/tls13-ciphers.d
 create mode 100644 third-party/curl/docs/cmdline-opts/tls13-ciphers.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/tlsauthtype.d
 create mode 100644 third-party/curl/docs/cmdline-opts/tlsauthtype.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/tlspassword.d
 create mode 100644 third-party/curl/docs/cmdline-opts/tlspassword.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/tlsuser.d
 create mode 100644 third-party/curl/docs/cmdline-opts/tlsuser.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/tlsv1.0.d
 create mode 100644 third-party/curl/docs/cmdline-opts/tlsv1.0.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/tlsv1.1.d
 create mode 100644 third-party/curl/docs/cmdline-opts/tlsv1.1.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/tlsv1.2.d
 create mode 100644 third-party/curl/docs/cmdline-opts/tlsv1.2.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/tlsv1.3.d
 create mode 100644 third-party/curl/docs/cmdline-opts/tlsv1.3.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/tlsv1.d
 create mode 100644 third-party/curl/docs/cmdline-opts/tlsv1.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/tr-encoding.d
 create mode 100644 third-party/curl/docs/cmdline-opts/tr-encoding.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/trace-ascii.d
 create mode 100644 third-party/curl/docs/cmdline-opts/trace-ascii.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/trace-config.d
 create mode 100644 third-party/curl/docs/cmdline-opts/trace-config.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/trace-ids.d
 create mode 100644 third-party/curl/docs/cmdline-opts/trace-ids.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/trace-time.d
 create mode 100644 third-party/curl/docs/cmdline-opts/trace-time.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/trace.d
 create mode 100644 third-party/curl/docs/cmdline-opts/trace.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/unix-socket.d
 create mode 100644 third-party/curl/docs/cmdline-opts/unix-socket.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/upload-file.d
 create mode 100644 third-party/curl/docs/cmdline-opts/upload-file.md
 create mode 100644 third-party/curl/docs/cmdline-opts/upload-flags.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/url-query.d
 create mode 100644 third-party/curl/docs/cmdline-opts/url-query.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/url.d
 create mode 100644 third-party/curl/docs/cmdline-opts/url.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/use-ascii.d
 create mode 100644 third-party/curl/docs/cmdline-opts/use-ascii.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/user-agent.d
 create mode 100644 third-party/curl/docs/cmdline-opts/user-agent.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/user.d
 create mode 100644 third-party/curl/docs/cmdline-opts/user.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/variable.d
 create mode 100644 third-party/curl/docs/cmdline-opts/variable.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/verbose.d
 create mode 100644 third-party/curl/docs/cmdline-opts/verbose.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/version.d
 create mode 100644 third-party/curl/docs/cmdline-opts/version.md
 create mode 100644 third-party/curl/docs/cmdline-opts/vlan-priority.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/write-out.d
 create mode 100644 third-party/curl/docs/cmdline-opts/write-out.md
 delete mode 100644 third-party/curl/docs/cmdline-opts/xattr.d
 create mode 100644 third-party/curl/docs/cmdline-opts/xattr.md
 delete mode 100644 third-party/curl/docs/curl-config.1
 create mode 100644 third-party/curl/docs/curl-config.md
 create mode 100644 third-party/curl/docs/examples/CMakeLists.txt
 delete mode 100644 third-party/curl/docs/examples/Makefile.mk
 create mode 100644 third-party/curl/docs/examples/address-scope.c
 create mode 100644 third-party/curl/docs/examples/block_ip.c
 create mode 100644 third-party/curl/docs/examples/ftp-delete.c
 delete mode 100644 third-party/curl/docs/examples/href_extractor.c
 create mode 100644 third-party/curl/docs/examples/interface.c
 create mode 100644 third-party/curl/docs/examples/keepalive.c
 create mode 100644 third-party/curl/docs/examples/localport.c
 create mode 100644 third-party/curl/docs/examples/log_failed_transfers.c
 delete mode 100644 third-party/curl/docs/examples/multithread.c
 create mode 100644 third-party/curl/docs/examples/netrc.c
 create mode 100644 third-party/curl/docs/examples/range.c
 create mode 100644 third-party/curl/docs/examples/rtsp-options.c
 delete mode 100644 third-party/curl/docs/examples/threaded-ssl.c
 create mode 100644 third-party/curl/docs/examples/threaded.c
 create mode 100644 third-party/curl/docs/examples/websocket-updown.c
 create mode 100644 third-party/curl/docs/internals/BUFQ.md
 rename third-party/curl/docs/{ => internals}/BUFREF.md (75%)
 create mode 100644 third-party/curl/docs/internals/CHECKSRC.md
 create mode 100644 third-party/curl/docs/internals/CLIENT-READERS.md
 create mode 100644 third-party/curl/docs/internals/CLIENT-WRITERS.md
 rename third-party/curl/docs/{ => internals}/CODE_STYLE.md (75%)
 create mode 100644 third-party/curl/docs/internals/CONNECTION-FILTERS.md
 create mode 100644 third-party/curl/docs/internals/CREDENTIALS.md
 create mode 100644 third-party/curl/docs/internals/CURLX.md
 create mode 100644 third-party/curl/docs/internals/DYNBUF.md
 create mode 100644 third-party/curl/docs/internals/HASH.md
 create mode 100644 third-party/curl/docs/internals/LLIST.md
 create mode 100644 third-party/curl/docs/internals/MID.md
 create mode 100644 third-party/curl/docs/internals/MQTT.md
 create mode 100644 third-party/curl/docs/internals/MULTI-EV.md
 rename third-party/curl/docs/{ => internals}/NEW-PROTOCOL.md (75%)
 create mode 100644 third-party/curl/docs/internals/PEERS.md
 create mode 100644 third-party/curl/docs/internals/PORTING.md
 create mode 100644 third-party/curl/docs/internals/RATELIMITS.md
 create mode 100644 third-party/curl/docs/internals/README.md
 create mode 100644 third-party/curl/docs/internals/SCORECARD.md
 create mode 100644 third-party/curl/docs/internals/SPLAY.md
 create mode 100644 third-party/curl/docs/internals/STRPARSE.md
 create mode 100644 third-party/curl/docs/internals/THRDPOOL-AND-QUEUE.md
 create mode 100644 third-party/curl/docs/internals/TIME-KEEPING.md
 create mode 100644 third-party/curl/docs/internals/TLS-SESSIONS.md
 create mode 100644 third-party/curl/docs/internals/UINT_SETS.md
 rename third-party/curl/docs/{ => internals}/WEBSOCKET.md (77%)
 delete mode 100644 third-party/curl/docs/libcurl/curl_easy_cleanup.3
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_cleanup.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_easy_duphandle.3
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_duphandle.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_easy_escape.3
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_escape.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_easy_getinfo.3
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_getinfo.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_easy_header.3
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_header.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_easy_init.3
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_init.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_easy_nextheader.3
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_nextheader.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_easy_option_by_id.3
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_option_by_id.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_easy_option_by_name.3
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_option_by_name.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_easy_option_next.3
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_option_next.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_easy_pause.3
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_pause.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_easy_perform.3
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_perform.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_easy_recv.3
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_recv.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_easy_reset.3
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_reset.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_easy_send.3
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_send.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_easy_setopt.3
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_setopt.md
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_ssls_export.md
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_ssls_import.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_easy_strerror.3
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_strerror.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_easy_unescape.3
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_unescape.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_easy_upkeep.3
 create mode 100644 third-party/curl/docs/libcurl/curl_easy_upkeep.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_escape.3
 create mode 100644 third-party/curl/docs/libcurl/curl_escape.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_formadd.3
 create mode 100644 third-party/curl/docs/libcurl/curl_formadd.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_formfree.3
 create mode 100644 third-party/curl/docs/libcurl/curl_formfree.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_formget.3
 create mode 100644 third-party/curl/docs/libcurl/curl_formget.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_free.3
 create mode 100644 third-party/curl/docs/libcurl/curl_free.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_getdate.3
 create mode 100644 third-party/curl/docs/libcurl/curl_getdate.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_getenv.3
 create mode 100644 third-party/curl/docs/libcurl/curl_getenv.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_global_cleanup.3
 create mode 100644 third-party/curl/docs/libcurl/curl_global_cleanup.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_global_init.3
 create mode 100644 third-party/curl/docs/libcurl/curl_global_init.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_global_init_mem.3
 create mode 100644 third-party/curl/docs/libcurl/curl_global_init_mem.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_global_sslset.3
 create mode 100644 third-party/curl/docs/libcurl/curl_global_sslset.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_global_trace.3
 create mode 100644 third-party/curl/docs/libcurl/curl_global_trace.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_mime_addpart.3
 create mode 100644 third-party/curl/docs/libcurl/curl_mime_addpart.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_mime_data.3
 create mode 100644 third-party/curl/docs/libcurl/curl_mime_data.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_mime_data_cb.3
 create mode 100644 third-party/curl/docs/libcurl/curl_mime_data_cb.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_mime_encoder.3
 create mode 100644 third-party/curl/docs/libcurl/curl_mime_encoder.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_mime_filedata.3
 create mode 100644 third-party/curl/docs/libcurl/curl_mime_filedata.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_mime_filename.3
 create mode 100644 third-party/curl/docs/libcurl/curl_mime_filename.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_mime_free.3
 create mode 100644 third-party/curl/docs/libcurl/curl_mime_free.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_mime_headers.3
 create mode 100644 third-party/curl/docs/libcurl/curl_mime_headers.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_mime_init.3
 create mode 100644 third-party/curl/docs/libcurl/curl_mime_init.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_mime_name.3
 create mode 100644 third-party/curl/docs/libcurl/curl_mime_name.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_mime_subparts.3
 create mode 100644 third-party/curl/docs/libcurl/curl_mime_subparts.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_mime_type.3
 create mode 100644 third-party/curl/docs/libcurl/curl_mime_type.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_mprintf.3
 create mode 100644 third-party/curl/docs/libcurl/curl_mprintf.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_multi_add_handle.3
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_add_handle.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_multi_assign.3
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_assign.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_multi_cleanup.3
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_cleanup.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_multi_fdset.3
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_fdset.md
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_get_handles.md
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_get_offt.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_multi_info_read.3
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_info_read.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_multi_init.3
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_init.md
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_notify_disable.md
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_notify_enable.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_multi_perform.3
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_perform.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_multi_poll.3
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_poll.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_multi_remove_handle.3
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_remove_handle.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_multi_setopt.3
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_setopt.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_multi_socket.3
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_socket.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_multi_socket_action.3
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_socket_action.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_multi_socket_all.3
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_socket_all.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_multi_strerror.3
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_strerror.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_multi_timeout.3
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_timeout.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_multi_wait.3
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_wait.md
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_waitfds.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_multi_wakeup.3
 create mode 100644 third-party/curl/docs/libcurl/curl_multi_wakeup.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_pushheader_byname.3
 create mode 100644 third-party/curl/docs/libcurl/curl_pushheader_byname.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_pushheader_bynum.3
 create mode 100644 third-party/curl/docs/libcurl/curl_pushheader_bynum.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_share_cleanup.3
 create mode 100644 third-party/curl/docs/libcurl/curl_share_cleanup.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_share_init.3
 create mode 100644 third-party/curl/docs/libcurl/curl_share_init.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_share_setopt.3
 create mode 100644 third-party/curl/docs/libcurl/curl_share_setopt.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_share_strerror.3
 create mode 100644 third-party/curl/docs/libcurl/curl_share_strerror.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_slist_append.3
 create mode 100644 third-party/curl/docs/libcurl/curl_slist_append.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_slist_free_all.3
 create mode 100644 third-party/curl/docs/libcurl/curl_slist_free_all.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_strequal.3
 create mode 100644 third-party/curl/docs/libcurl/curl_strequal.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_strnequal.3
 create mode 100644 third-party/curl/docs/libcurl/curl_strnequal.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_unescape.3
 create mode 100644 third-party/curl/docs/libcurl/curl_unescape.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_url.3
 create mode 100644 third-party/curl/docs/libcurl/curl_url.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_url_cleanup.3
 create mode 100644 third-party/curl/docs/libcurl/curl_url_cleanup.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_url_dup.3
 create mode 100644 third-party/curl/docs/libcurl/curl_url_dup.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_url_get.3
 create mode 100644 third-party/curl/docs/libcurl/curl_url_get.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_url_set.3
 create mode 100644 third-party/curl/docs/libcurl/curl_url_set.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_url_strerror.3
 create mode 100644 third-party/curl/docs/libcurl/curl_url_strerror.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_version.3
 create mode 100644 third-party/curl/docs/libcurl/curl_version.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_version_info.3
 create mode 100644 third-party/curl/docs/libcurl/curl_version_info.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_ws_meta.3
 create mode 100644 third-party/curl/docs/libcurl/curl_ws_meta.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_ws_recv.3
 create mode 100644 third-party/curl/docs/libcurl/curl_ws_recv.md
 delete mode 100644 third-party/curl/docs/libcurl/curl_ws_send.3
 create mode 100644 third-party/curl/docs/libcurl/curl_ws_send.md
 create mode 100644 third-party/curl/docs/libcurl/curl_ws_start_frame.md
 delete mode 100644 third-party/curl/docs/libcurl/libcurl-easy.3
 create mode 100644 third-party/curl/docs/libcurl/libcurl-easy.md
 create mode 100644 third-party/curl/docs/libcurl/libcurl-env-dbg.md
 delete mode 100644 third-party/curl/docs/libcurl/libcurl-env.3
 create mode 100644 third-party/curl/docs/libcurl/libcurl-env.md
 delete mode 100644 third-party/curl/docs/libcurl/libcurl-errors.3
 create mode 100644 third-party/curl/docs/libcurl/libcurl-errors.md
 delete mode 100644 third-party/curl/docs/libcurl/libcurl-multi.3
 create mode 100644 third-party/curl/docs/libcurl/libcurl-multi.md
 delete mode 100644 third-party/curl/docs/libcurl/libcurl-security.3
 create mode 100644 third-party/curl/docs/libcurl/libcurl-security.md
 delete mode 100644 third-party/curl/docs/libcurl/libcurl-share.3
 create mode 100644 third-party/curl/docs/libcurl/libcurl-share.md
 delete mode 100644 third-party/curl/docs/libcurl/libcurl-thread.3
 create mode 100644 third-party/curl/docs/libcurl/libcurl-thread.md
 delete mode 100644 third-party/curl/docs/libcurl/libcurl-tutorial.3
 create mode 100644 third-party/curl/docs/libcurl/libcurl-tutorial.md
 delete mode 100644 third-party/curl/docs/libcurl/libcurl-url.3
 create mode 100644 third-party/curl/docs/libcurl/libcurl-url.md
 delete mode 100644 third-party/curl/docs/libcurl/libcurl-ws.3
 create mode 100644 third-party/curl/docs/libcurl/libcurl-ws.md
 delete mode 100644 third-party/curl/docs/libcurl/libcurl.3
 create mode 100644 third-party/curl/docs/libcurl/libcurl.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_ACTIVESOCKET.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_ACTIVESOCKET.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_APPCONNECT_TIME.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_APPCONNECT_TIME.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_APPCONNECT_TIME_T.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_APPCONNECT_TIME_T.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CAINFO.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CAINFO.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CAPATH.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CAPATH.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CERTINFO.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CERTINFO.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CONDITION_UNMET.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CONDITION_UNMET.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CONNECT_TIME.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CONNECT_TIME.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CONNECT_TIME_T.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CONNECT_TIME_T.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CONN_ID.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CONN_ID.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_DOWNLOAD.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_DOWNLOAD.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_DOWNLOAD_T.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_DOWNLOAD_T.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_UPLOAD.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_UPLOAD.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_UPLOAD_T.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_UPLOAD_T.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_TYPE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_TYPE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_COOKIELIST.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_COOKIELIST.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_EARLYDATA_SENT_T.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_EFFECTIVE_METHOD.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_EFFECTIVE_METHOD.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_EFFECTIVE_URL.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_EFFECTIVE_URL.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_FILETIME.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_FILETIME.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_FILETIME_T.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_FILETIME_T.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_FTP_ENTRY_PATH.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_FTP_ENTRY_PATH.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_HEADER_SIZE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_HEADER_SIZE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_HTTPAUTH_AVAIL.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_HTTPAUTH_AVAIL.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_HTTPAUTH_USED.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_HTTP_CONNECTCODE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_HTTP_CONNECTCODE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_HTTP_VERSION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_HTTP_VERSION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_LASTSOCKET.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_LASTSOCKET.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_LOCAL_IP.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_LOCAL_IP.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_LOCAL_PORT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_LOCAL_PORT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_NAMELOOKUP_TIME.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_NAMELOOKUP_TIME.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_NAMELOOKUP_TIME_T.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_NAMELOOKUP_TIME_T.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_NUM_CONNECTS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_NUM_CONNECTS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_OS_ERRNO.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_OS_ERRNO.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_POSTTRANSFER_TIME_T.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_PRETRANSFER_TIME.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_PRETRANSFER_TIME.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_PRETRANSFER_TIME_T.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_PRETRANSFER_TIME_T.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_PRIMARY_IP.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_PRIMARY_IP.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_PRIMARY_PORT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_PRIMARY_PORT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_PRIVATE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_PRIVATE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_PROTOCOL.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_PROTOCOL.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_PROXYAUTH_AVAIL.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_PROXYAUTH_AVAIL.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_PROXYAUTH_USED.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_PROXY_ERROR.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_PROXY_ERROR.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_PROXY_SSL_VERIFYRESULT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_PROXY_SSL_VERIFYRESULT.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_QUEUE_TIME_T.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_COUNT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_COUNT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_TIME.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_TIME.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_TIME_T.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_TIME_T.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_URL.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_URL.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_REFERER.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_REFERER.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_REQUEST_SIZE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_REQUEST_SIZE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_RESPONSE_CODE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_RESPONSE_CODE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_RETRY_AFTER.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_RETRY_AFTER.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_CLIENT_CSEQ.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_CLIENT_CSEQ.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_CSEQ_RECV.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_CSEQ_RECV.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_SERVER_CSEQ.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_SERVER_CSEQ.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_SESSION_ID.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_SESSION_ID.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SCHEME.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SCHEME.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DELIVERED.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DOWNLOAD.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DOWNLOAD.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DOWNLOAD_T.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DOWNLOAD_T.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_UPLOAD.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_UPLOAD.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_UPLOAD_T.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_UPLOAD_T.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_DOWNLOAD.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_DOWNLOAD.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_DOWNLOAD_T.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_DOWNLOAD_T.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_UPLOAD.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_UPLOAD.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_UPLOAD_T.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_UPLOAD_T.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SSL_ENGINES.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SSL_ENGINES.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SSL_VERIFYRESULT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_SSL_VERIFYRESULT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_STARTTRANSFER_TIME.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_STARTTRANSFER_TIME.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_STARTTRANSFER_TIME_T.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_STARTTRANSFER_TIME_T.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_TLS_SESSION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_TLS_SESSION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_TLS_SSL_PTR.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_TLS_SSL_PTR.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_TOTAL_TIME.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_TOTAL_TIME.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_TOTAL_TIME_T.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_TOTAL_TIME_T.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_USED_PROXY.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_XFER_ID.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLINFO_XFER_ID.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_ADDED.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_CURRENT.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_DONE.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_PENDING.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_RUNNING.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_MAXCONNECTS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_MAXCONNECTS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_CONCURRENT_STREAMS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_CONCURRENT_STREAMS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_HOST_CONNECTIONS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_HOST_CONNECTIONS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_PIPELINE_LENGTH.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_PIPELINE_LENGTH.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_TOTAL_CONNECTIONS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_TOTAL_CONNECTIONS.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_NETWORK_CHANGED.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_NOTIFYDATA.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_NOTIFYFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING_SERVER_BL.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING_SERVER_BL.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING_SITE_BL.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING_SITE_BL.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_PUSHDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_PUSHDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_PUSHFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_PUSHFUNCTION.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_QUICK_EXIT.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_RESOLVE_THREADS_MAX.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_SOCKETDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_SOCKETDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_SOCKETFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_SOCKETFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_TIMERDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_TIMERDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_TIMERFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLMOPT_TIMERFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_ABSTRACT_UNIX_SOCKET.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_ABSTRACT_UNIX_SOCKET.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_ACCEPTTIMEOUT_MS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_ACCEPTTIMEOUT_MS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_ACCEPT_ENCODING.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_ACCEPT_ENCODING.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_ADDRESS_SCOPE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_ADDRESS_SCOPE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_ALTSVC.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_ALTSVC.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_ALTSVC_CTRL.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_ALTSVC_CTRL.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_APPEND.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_APPEND.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_AUTOREFERER.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_AUTOREFERER.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_AWS_SIGV4.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_AWS_SIGV4.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_BUFFERSIZE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_BUFFERSIZE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CAINFO.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CAINFO.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CAINFO_BLOB.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CAINFO_BLOB.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CAPATH.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CAPATH.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CA_CACHE_TIMEOUT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CA_CACHE_TIMEOUT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CERTINFO.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CERTINFO.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_BGN_FUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_BGN_FUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_DATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_DATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_END_FUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_END_FUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CLOSESOCKETDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CLOSESOCKETDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CLOSESOCKETFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CLOSESOCKETFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CONNECTTIMEOUT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CONNECTTIMEOUT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CONNECTTIMEOUT_MS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CONNECTTIMEOUT_MS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CONNECT_ONLY.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CONNECT_ONLY.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CONNECT_TO.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CONNECT_TO.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CONV_FROM_NETWORK_FUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CONV_FROM_NETWORK_FUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CONV_FROM_UTF8_FUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CONV_FROM_UTF8_FUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CONV_TO_NETWORK_FUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CONV_TO_NETWORK_FUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_COOKIE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_COOKIE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_COOKIEFILE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_COOKIEFILE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_COOKIEJAR.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_COOKIEJAR.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_COOKIELIST.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_COOKIELIST.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_COOKIESESSION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_COOKIESESSION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_COPYPOSTFIELDS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_COPYPOSTFIELDS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CRLF.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CRLF.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CRLFILE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CRLFILE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CURLU.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CURLU.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CUSTOMREQUEST.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_CUSTOMREQUEST.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DEBUGDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DEBUGDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DEBUGFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DEBUGFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DEFAULT_PROTOCOL.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DEFAULT_PROTOCOL.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DIRLISTONLY.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DIRLISTONLY.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DISALLOW_USERNAME_IN_URL.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DISALLOW_USERNAME_IN_URL.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DNS_CACHE_TIMEOUT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DNS_CACHE_TIMEOUT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DNS_INTERFACE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DNS_INTERFACE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DNS_LOCAL_IP4.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DNS_LOCAL_IP4.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DNS_LOCAL_IP6.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DNS_LOCAL_IP6.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DNS_SERVERS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DNS_SERVERS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DNS_SHUFFLE_ADDRESSES.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DNS_SHUFFLE_ADDRESSES.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DNS_USE_GLOBAL_CACHE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DNS_USE_GLOBAL_CACHE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYHOST.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYHOST.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYPEER.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYPEER.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYSTATUS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYSTATUS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DOH_URL.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_DOH_URL.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_ECH.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_EGDSOCKET.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_EGDSOCKET.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_ERRORBUFFER.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_ERRORBUFFER.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_EXPECT_100_TIMEOUT_MS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_EXPECT_100_TIMEOUT_MS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FAILONERROR.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FAILONERROR.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FILETIME.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FILETIME.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FNMATCH_DATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FNMATCH_DATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FNMATCH_FUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FNMATCH_FUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FOLLOWLOCATION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FOLLOWLOCATION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FORBID_REUSE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FORBID_REUSE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FRESH_CONNECT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FRESH_CONNECT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTPPORT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTPPORT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTPSSLAUTH.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTPSSLAUTH.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTP_ACCOUNT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTP_ACCOUNT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTP_ALTERNATIVE_TO_USER.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTP_ALTERNATIVE_TO_USER.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTP_CREATE_MISSING_DIRS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTP_CREATE_MISSING_DIRS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTP_FILEMETHOD.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTP_FILEMETHOD.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTP_SSL_CCC.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTP_SSL_CCC.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_EPRT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_EPRT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_EPSV.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_EPSV.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_PRET.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_PRET.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_GSSAPI_DELEGATION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_GSSAPI_DELEGATION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HAPROXYPROTOCOL.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HAPROXYPROTOCOL.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HAPROXY_CLIENT_IP.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HAPROXY_CLIENT_IP.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HEADER.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HEADER.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HEADERDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HEADERDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HEADERFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HEADERFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HEADEROPT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HEADEROPT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HSTS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HSTS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HSTSREADDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HSTSREADDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HSTSREADFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HSTSREADFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HSTSWRITEDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HSTSWRITEDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HSTSWRITEFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HSTSWRITEFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HSTS_CTRL.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HSTS_CTRL.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTP09_ALLOWED.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTP09_ALLOWED.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTP200ALIASES.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTP200ALIASES.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTPAUTH.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTPAUTH.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTPGET.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTPGET.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTPHEADER.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTPHEADER.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTPPOST.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTPPOST.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTPPROXYTUNNEL.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTPPROXYTUNNEL.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_CONTENT_DECODING.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_CONTENT_DECODING.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_TRANSFER_DECODING.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_TRANSFER_DECODING.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_VERSION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_VERSION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_IGNORE_CONTENT_LENGTH.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_IGNORE_CONTENT_LENGTH.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_INFILESIZE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_INFILESIZE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_INFILESIZE_LARGE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_INFILESIZE_LARGE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_INTERFACE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_INTERFACE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_INTERLEAVEDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_INTERLEAVEDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_INTERLEAVEFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_INTERLEAVEFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_IOCTLDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_IOCTLDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_IOCTLFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_IOCTLFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_IPRESOLVE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_IPRESOLVE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_ISSUERCERT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_ISSUERCERT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_ISSUERCERT_BLOB.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_ISSUERCERT_BLOB.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_KEEP_SENDING_ON_ERROR.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_KEEP_SENDING_ON_ERROR.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_KEYPASSWD.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_KEYPASSWD.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_KRBLEVEL.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_KRBLEVEL.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_LOCALPORT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_LOCALPORT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_LOCALPORTRANGE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_LOCALPORTRANGE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_LOGIN_OPTIONS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_LOGIN_OPTIONS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_LOW_SPEED_LIMIT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_LOW_SPEED_LIMIT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_LOW_SPEED_TIME.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_LOW_SPEED_TIME.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_AUTH.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_AUTH.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_FROM.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_FROM.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_RCPT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_RCPT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_RCPT_ALLOWFAILS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_RCPT_ALLOWFAILS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAXAGE_CONN.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAXAGE_CONN.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAXCONNECTS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAXCONNECTS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAXFILESIZE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAXFILESIZE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAXFILESIZE_LARGE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAXFILESIZE_LARGE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAXLIFETIME_CONN.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAXLIFETIME_CONN.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAXREDIRS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAXREDIRS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAX_RECV_SPEED_LARGE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAX_RECV_SPEED_LARGE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAX_SEND_SPEED_LARGE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MAX_SEND_SPEED_LARGE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MIMEPOST.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MIMEPOST.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MIME_OPTIONS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_MIME_OPTIONS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_NETRC.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_NETRC.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_NETRC_FILE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_NETRC_FILE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_NEW_DIRECTORY_PERMS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_NEW_DIRECTORY_PERMS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_NEW_FILE_PERMS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_NEW_FILE_PERMS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_NOBODY.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_NOBODY.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_NOPROGRESS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_NOPROGRESS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_NOPROXY.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_NOPROXY.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_NOSIGNAL.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_NOSIGNAL.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_OPENSOCKETDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_OPENSOCKETDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_OPENSOCKETFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_OPENSOCKETFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PASSWORD.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PASSWORD.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PATH_AS_IS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PATH_AS_IS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PIPEWAIT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PIPEWAIT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PORT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PORT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_POST.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_POST.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDSIZE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDSIZE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDSIZE_LARGE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDSIZE_LARGE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_POSTQUOTE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_POSTQUOTE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_POSTREDIR.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_POSTREDIR.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PREQUOTE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PREQUOTE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PREREQDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PREREQDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PREREQFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PREREQFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PRE_PROXY.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PRE_PROXY.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PRIVATE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PRIVATE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROGRESSDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROGRESSDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROGRESSFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROGRESSFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROTOCOLS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROTOCOLS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROTOCOLS_STR.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROTOCOLS_STR.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXYAUTH.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXYAUTH.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXYHEADER.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXYHEADER.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXYPASSWORD.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXYPASSWORD.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXYPORT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXYPORT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXYTYPE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXYTYPE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXYUSERNAME.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXYUSERNAME.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXYUSERPWD.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXYUSERPWD.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAINFO.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAINFO.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAINFO_BLOB.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAINFO_BLOB.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAPATH.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAPATH.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CRLFILE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CRLFILE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_ISSUERCERT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_ISSUERCERT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_ISSUERCERT_BLOB.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_ISSUERCERT_BLOB.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_KEYPASSWD.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_KEYPASSWD.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_PINNEDPUBLICKEY.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_PINNEDPUBLICKEY.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SERVICE_NAME.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SERVICE_NAME.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERTTYPE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERTTYPE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERT_BLOB.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERT_BLOB.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEY.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEY.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEYTYPE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEYTYPE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEY_BLOB.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEY_BLOB.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLVERSION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLVERSION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_CIPHER_LIST.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_CIPHER_LIST.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_OPTIONS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_OPTIONS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_VERIFYHOST.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_VERIFYHOST.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_VERIFYPEER.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_VERIFYPEER.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLS13_CIPHERS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLS13_CIPHERS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_PASSWORD.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_PASSWORD.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_TYPE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_TYPE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_USERNAME.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_USERNAME.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TRANSFER_MODE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TRANSFER_MODE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PUT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_PUT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_QUICK_EXIT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_QUICK_EXIT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_QUOTE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_QUOTE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RANDOM_FILE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RANDOM_FILE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RANGE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RANGE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_READDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_READDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_READFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_READFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_REDIR_PROTOCOLS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_REDIR_PROTOCOLS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_REDIR_PROTOCOLS_STR.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_REDIR_PROTOCOLS_STR.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_REFERER.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_REFERER.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_REQUEST_TARGET.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_REQUEST_TARGET.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVER_START_DATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVER_START_DATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVER_START_FUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVER_START_FUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RESUME_FROM.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RESUME_FROM.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RESUME_FROM_LARGE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RESUME_FROM_LARGE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_CLIENT_CSEQ.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_CLIENT_CSEQ.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_REQUEST.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_REQUEST.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_SERVER_CSEQ.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_SERVER_CSEQ.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_SESSION_ID.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_SESSION_ID.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_STREAM_URI.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_STREAM_URI.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_TRANSPORT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_TRANSPORT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SASL_AUTHZID.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SASL_AUTHZID.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SASL_IR.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SASL_IR.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SEEKDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SEEKDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SEEKFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SEEKFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SERVER_RESPONSE_TIMEOUT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SERVER_RESPONSE_TIMEOUT.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SERVER_RESPONSE_TIMEOUT_MS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SERVICE_NAME.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SERVICE_NAME.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SHARE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SHARE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SOCKOPTDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SOCKOPTDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SOCKOPTFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SOCKOPTFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_AUTH.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_AUTH.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_GSSAPI_NEC.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_GSSAPI_NEC.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_GSSAPI_SERVICE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_GSSAPI_SERVICE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_AUTH_TYPES.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_AUTH_TYPES.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_COMPRESSION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_COMPRESSION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOSTKEYDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOSTKEYDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOSTKEYFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOSTKEYFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_MD5.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_MD5.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KEYDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KEYDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KEYFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KEYFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KNOWNHOSTS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KNOWNHOSTS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_PRIVATE_KEYFILE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_PRIVATE_KEYFILE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_PUBLIC_KEYFILE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSH_PUBLIC_KEYFILE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERTTYPE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERTTYPE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERT_BLOB.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERT_BLOB.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSLENGINE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSLENGINE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSLENGINE_DEFAULT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSLENGINE_DEFAULT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEY.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEY.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEYTYPE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEYTYPE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEY_BLOB.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEY_BLOB.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSLVERSION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSLVERSION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CIPHER_LIST.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CIPHER_LIST.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CTX_DATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CTX_DATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CTX_FUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CTX_FUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_EC_CURVES.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_EC_CURVES.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_ENABLE_ALPN.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_ENABLE_ALPN.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_ENABLE_NPN.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_ENABLE_NPN.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_FALSESTART.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_FALSESTART.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_OPTIONS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_OPTIONS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_SESSIONID_CACHE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_SESSIONID_CACHE.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_SIGNATURE_ALGORITHMS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYHOST.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYHOST.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYPEER.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYPEER.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYSTATUS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYSTATUS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_STDERR.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_STDERR.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS_E.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS_E.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_WEIGHT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_WEIGHT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SUPPRESS_CONNECT_HEADERS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_SUPPRESS_CONNECT_HEADERS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TCP_FASTOPEN.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TCP_FASTOPEN.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPALIVE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPALIVE.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPCNT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPIDLE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPIDLE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPINTVL.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPINTVL.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TCP_NODELAY.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TCP_NODELAY.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TELNETOPTIONS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TELNETOPTIONS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TFTP_BLKSIZE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TFTP_BLKSIZE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TFTP_NO_OPTIONS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TFTP_NO_OPTIONS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TIMECONDITION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TIMECONDITION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TIMEOUT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TIMEOUT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TIMEOUT_MS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TIMEOUT_MS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TIMEVALUE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TIMEVALUE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TIMEVALUE_LARGE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TIMEVALUE_LARGE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TLS13_CIPHERS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TLS13_CIPHERS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_PASSWORD.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_PASSWORD.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_TYPE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_TYPE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_USERNAME.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_USERNAME.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TRAILERDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TRAILERDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TRAILERFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TRAILERFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TRANSFERTEXT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TRANSFERTEXT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TRANSFER_ENCODING.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_TRANSFER_ENCODING.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_UNIX_SOCKET_PATH.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_UNIX_SOCKET_PATH.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_UNRESTRICTED_AUTH.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_UNRESTRICTED_AUTH.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_UPKEEP_INTERVAL_MS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_UPKEEP_INTERVAL_MS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD_BUFFERSIZE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD_BUFFERSIZE.md
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD_FLAGS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_URL.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_URL.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_USERAGENT.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_USERAGENT.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_USERNAME.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_USERNAME.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_USERPWD.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_USERPWD.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_USE_SSL.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_USE_SSL.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_VERBOSE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_VERBOSE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_WILDCARDMATCH.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_WILDCARDMATCH.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_WRITEDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_WRITEDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_WRITEFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_WRITEFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_WS_OPTIONS.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_WS_OPTIONS.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_XFERINFODATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_XFERINFODATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_XFERINFOFUNCTION.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_XFERINFOFUNCTION.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_XOAUTH2_BEARER.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLOPT_XOAUTH2_BEARER.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLSHOPT_LOCKFUNC.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLSHOPT_LOCKFUNC.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLSHOPT_SHARE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLSHOPT_SHARE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLSHOPT_UNLOCKFUNC.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLSHOPT_UNLOCKFUNC.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLSHOPT_UNSHARE.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLSHOPT_UNSHARE.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/CURLSHOPT_USERDATA.3
 create mode 100644 third-party/curl/docs/libcurl/opts/CURLSHOPT_USERDATA.md
 delete mode 100644 third-party/curl/docs/libcurl/opts/template.3
 delete mode 100644 third-party/curl/docs/mk-ca-bundle.1
 create mode 100644 third-party/curl/docs/mk-ca-bundle.md
 create mode 100644 third-party/curl/docs/runtests.md
 create mode 100644 third-party/curl/docs/testcurl.md
 create mode 100644 third-party/curl/docs/tests/CI.md
 create mode 100644 third-party/curl/docs/tests/FILEFORMAT.md
 create mode 100644 third-party/curl/docs/tests/HTTP.md
 create mode 100644 third-party/curl/docs/tests/TEST-SUITE.md
 create mode 100644 third-party/curl/docs/wcurl.md
 delete mode 100644 third-party/curl/include/curl/.gitignore
 delete mode 100644 third-party/curl/lib/.checksrc
 delete mode 100644 third-party/curl/lib/.gitattributes
 delete mode 100644 third-party/curl/lib/Makefile.mk
 create mode 100644 third-party/curl/lib/asyn-base.c
 create mode 100644 third-party/curl/lib/asyn-thrdd.c
 delete mode 100644 third-party/curl/lib/asyn-thread.c
 delete mode 100644 third-party/curl/lib/base64.c
 delete mode 100644 third-party/curl/lib/c-hyper.c
 delete mode 100644 third-party/curl/lib/c-hyper.h
 create mode 100644 third-party/curl/lib/cf-dns.c
 create mode 100644 third-party/curl/lib/cf-dns.h
 create mode 100644 third-party/curl/lib/cf-ip-happy.c
 create mode 100644 third-party/curl/lib/cf-ip-happy.h
 create mode 100644 third-party/curl/lib/cf-recvbuf.c
 create mode 100644 third-party/curl/lib/cf-recvbuf.h
 create mode 100644 third-party/curl/lib/cf-setup.c
 create mode 100644 third-party/curl/lib/cf-setup.h
 delete mode 100644 third-party/curl/lib/config-amigaos.h
 delete mode 100644 third-party/curl/lib/config-dos.h
 delete mode 100644 third-party/curl/lib/config-plan9.h
 delete mode 100644 third-party/curl/lib/config-win32ce.h
 create mode 100644 third-party/curl/lib/creds.c
 create mode 100644 third-party/curl/lib/creds.h
 create mode 100644 third-party/curl/lib/cshutdn.c
 create mode 100644 third-party/curl/lib/cshutdn.h
 delete mode 100644 third-party/curl/lib/curl_base64.h
 create mode 100644 third-party/curl/lib/curl_config-cmake.h.in
 delete mode 100644 third-party/curl/lib/curl_config.h.cmake
 delete mode 100644 third-party/curl/lib/curl_des.c
 delete mode 100644 third-party/curl/lib/curl_des.h
 create mode 100644 third-party/curl/lib/curl_fopen.c
 create mode 100644 third-party/curl/lib/curl_fopen.h
 delete mode 100644 third-party/curl/lib/curl_krb5.h
 delete mode 100644 third-party/curl/lib/curl_memory.h
 delete mode 100644 third-party/curl/lib/curl_multibyte.c
 delete mode 100644 third-party/curl/lib/curl_multibyte.h
 delete mode 100644 third-party/curl/lib/curl_ntlm_wb.c
 delete mode 100644 third-party/curl/lib/curl_ntlm_wb.h
 delete mode 100644 third-party/curl/lib/curl_path.c
 delete mode 100644 third-party/curl/lib/curl_path.h
 delete mode 100644 third-party/curl/lib/curl_rtmp.c
 delete mode 100644 third-party/curl/lib/curl_rtmp.h
 delete mode 100644 third-party/curl/lib/curl_setup_once.h
 create mode 100644 third-party/curl/lib/curl_sha512_256.c
 create mode 100644 third-party/curl/lib/curl_sha512_256.h
 create mode 100644 third-party/curl/lib/curl_share.c
 create mode 100644 third-party/curl/lib/curl_share.h
 delete mode 100644 third-party/curl/lib/curlx.h
 create mode 100644 third-party/curl/lib/curlx/base64.c
 create mode 100644 third-party/curl/lib/curlx/base64.h
 create mode 100644 third-party/curl/lib/curlx/basename.c
 create mode 100644 third-party/curl/lib/curlx/basename.h
 create mode 100644 third-party/curl/lib/curlx/dynbuf.c
 create mode 100644 third-party/curl/lib/curlx/dynbuf.h
 create mode 100644 third-party/curl/lib/curlx/fopen.c
 create mode 100644 third-party/curl/lib/curlx/fopen.h
 create mode 100644 third-party/curl/lib/curlx/inet_ntop.c
 create mode 100644 third-party/curl/lib/curlx/inet_ntop.h
 create mode 100644 third-party/curl/lib/curlx/inet_pton.c
 rename third-party/curl/lib/{ => curlx}/inet_pton.h (77%)
 create mode 100644 third-party/curl/lib/curlx/multibyte.c
 create mode 100644 third-party/curl/lib/curlx/multibyte.h
 rename third-party/curl/lib/{ => curlx}/nonblock.c (79%)
 rename third-party/curl/lib/{ => curlx}/nonblock.h (96%)
 create mode 100644 third-party/curl/lib/curlx/snprintf.c
 create mode 100644 third-party/curl/lib/curlx/snprintf.h
 create mode 100644 third-party/curl/lib/curlx/strcopy.c
 create mode 100644 third-party/curl/lib/curlx/strcopy.h
 create mode 100644 third-party/curl/lib/curlx/strdup.c
 rename third-party/curl/lib/{ => curlx}/strdup.h (77%)
 create mode 100644 third-party/curl/lib/curlx/strerr.c
 create mode 100644 third-party/curl/lib/curlx/strerr.h
 create mode 100644 third-party/curl/lib/curlx/strparse.c
 create mode 100644 third-party/curl/lib/curlx/strparse.h
 rename third-party/curl/lib/{ => curlx}/timediff.c (91%)
 rename third-party/curl/lib/{ => curlx}/timediff.h (93%)
 create mode 100644 third-party/curl/lib/curlx/timeval.c
 create mode 100644 third-party/curl/lib/curlx/timeval.h
 create mode 100644 third-party/curl/lib/curlx/version_win32.c
 rename third-party/curl/lib/{ => curlx}/version_win32.h (89%)
 create mode 100644 third-party/curl/lib/curlx/wait.c
 create mode 100644 third-party/curl/lib/curlx/wait.h
 create mode 100644 third-party/curl/lib/curlx/warnless.c
 create mode 100644 third-party/curl/lib/curlx/warnless.h
 create mode 100644 third-party/curl/lib/curlx/winapi.c
 create mode 100644 third-party/curl/lib/curlx/winapi.h
 create mode 100644 third-party/curl/lib/cw-out.c
 create mode 100644 third-party/curl/lib/cw-out.h
 create mode 100644 third-party/curl/lib/cw-pause.c
 create mode 100644 third-party/curl/lib/cw-pause.h
 create mode 100644 third-party/curl/lib/dllmain.c
 create mode 100644 third-party/curl/lib/dnscache.c
 create mode 100644 third-party/curl/lib/dnscache.h
 delete mode 100644 third-party/curl/lib/dynbuf.c
 delete mode 100644 third-party/curl/lib/dynbuf.h
 create mode 100644 third-party/curl/lib/fake_addrinfo.c
 create mode 100644 third-party/curl/lib/fake_addrinfo.h
 delete mode 100644 third-party/curl/lib/fopen.c
 delete mode 100644 third-party/curl/lib/fopen.h
 create mode 100644 third-party/curl/lib/ftp-int.h
 delete mode 100644 third-party/curl/lib/hostasyn.c
 delete mode 100644 third-party/curl/lib/hostsyn.c
 create mode 100644 third-party/curl/lib/httpsrr.c
 create mode 100644 third-party/curl/lib/httpsrr.h
 delete mode 100644 third-party/curl/lib/inet_ntop.c
 delete mode 100644 third-party/curl/lib/inet_ntop.h
 delete mode 100644 third-party/curl/lib/inet_pton.c
 delete mode 100644 third-party/curl/lib/krb5.c
 rename third-party/curl/{ => lib}/libcurl.def (89%)
 delete mode 100644 third-party/curl/lib/libcurl.plist.in
 delete mode 100644 third-party/curl/lib/memdebug.h
 create mode 100644 third-party/curl/lib/multi_ev.c
 create mode 100644 third-party/curl/lib/multi_ev.h
 create mode 100644 third-party/curl/lib/multi_ntfy.c
 create mode 100644 third-party/curl/lib/multi_ntfy.h
 delete mode 100644 third-party/curl/lib/noproxy.c
 delete mode 100644 third-party/curl/lib/noproxy.h
 create mode 100644 third-party/curl/lib/peer.c
 create mode 100644 third-party/curl/lib/peer.h
 create mode 100644 third-party/curl/lib/protocol.c
 create mode 100644 third-party/curl/lib/protocol.h
 create mode 100644 third-party/curl/lib/proxy.c
 create mode 100644 third-party/curl/lib/proxy.h
 create mode 100644 third-party/curl/lib/ratelimit.c
 create mode 100644 third-party/curl/lib/ratelimit.h
 delete mode 100644 third-party/curl/lib/rename.c
 delete mode 100644 third-party/curl/lib/rename.h
 create mode 100644 third-party/curl/lib/request.c
 create mode 100644 third-party/curl/lib/request.h
 delete mode 100644 third-party/curl/lib/share.c
 delete mode 100644 third-party/curl/lib/share.h
 delete mode 100644 third-party/curl/lib/speedcheck.c
 delete mode 100644 third-party/curl/lib/speedcheck.h
 delete mode 100644 third-party/curl/lib/strdup.c
 create mode 100644 third-party/curl/lib/strequal.c
 delete mode 100644 third-party/curl/lib/strtok.c
 delete mode 100644 third-party/curl/lib/strtok.h
 delete mode 100644 third-party/curl/lib/strtoofft.c
 delete mode 100644 third-party/curl/lib/strtoofft.h
 create mode 100644 third-party/curl/lib/thrdpool.c
 create mode 100644 third-party/curl/lib/thrdpool.h
 create mode 100644 third-party/curl/lib/thrdqueue.c
 create mode 100644 third-party/curl/lib/thrdqueue.h
 delete mode 100644 third-party/curl/lib/timeval.c
 delete mode 100644 third-party/curl/lib/timeval.h
 create mode 100644 third-party/curl/lib/uint-bset.c
 create mode 100644 third-party/curl/lib/uint-bset.h
 create mode 100644 third-party/curl/lib/uint-hash.c
 create mode 100644 third-party/curl/lib/uint-hash.h
 create mode 100644 third-party/curl/lib/uint-spbset.c
 create mode 100644 third-party/curl/lib/uint-spbset.h
 create mode 100644 third-party/curl/lib/uint-table.c
 create mode 100644 third-party/curl/lib/uint-table.h
 delete mode 100644 third-party/curl/lib/vauth/ntlm.h
 delete mode 100644 third-party/curl/lib/version_win32.c
 create mode 100644 third-party/curl/lib/vquic/capsule.c
 create mode 100644 third-party/curl/lib/vquic/capsule.h
 create mode 100644 third-party/curl/lib/vquic/cf-capsule.c
 create mode 100644 third-party/curl/lib/vquic/cf-capsule.h
 create mode 100644 third-party/curl/lib/vquic/cf-ngtcp2-cmn.c
 create mode 100644 third-party/curl/lib/vquic/cf-ngtcp2-cmn.h
 create mode 100644 third-party/curl/lib/vquic/cf-ngtcp2-proxy.c
 create mode 100644 third-party/curl/lib/vquic/cf-ngtcp2-proxy.h
 create mode 100644 third-party/curl/lib/vquic/cf-ngtcp2.c
 create mode 100644 third-party/curl/lib/vquic/cf-ngtcp2.h
 create mode 100644 third-party/curl/lib/vquic/cf-quiche.c
 create mode 100644 third-party/curl/lib/vquic/cf-quiche.h
 delete mode 100644 third-party/curl/lib/vquic/curl_msh3.c
 delete mode 100644 third-party/curl/lib/vquic/curl_msh3.h
 delete mode 100644 third-party/curl/lib/vquic/curl_ngtcp2.c
 delete mode 100644 third-party/curl/lib/vquic/curl_ngtcp2.h
 delete mode 100644 third-party/curl/lib/vquic/curl_quiche.c
 delete mode 100644 third-party/curl/lib/vquic/curl_quiche.h
 create mode 100644 third-party/curl/lib/vquic/vquic-tls.c
 create mode 100644 third-party/curl/lib/vquic/vquic-tls.h
 create mode 100644 third-party/curl/lib/vssh/vssh.c
 create mode 100644 third-party/curl/lib/vssh/vssh.h
 delete mode 100644 third-party/curl/lib/vssh/wolfssh.c
 create mode 100644 third-party/curl/lib/vtls/apple.c
 create mode 100644 third-party/curl/lib/vtls/apple.h
 delete mode 100644 third-party/curl/lib/vtls/bearssl.c
 delete mode 100644 third-party/curl/lib/vtls/bearssl.h
 create mode 100644 third-party/curl/lib/vtls/cipher_suite.c
 create mode 100644 third-party/curl/lib/vtls/cipher_suite.h
 delete mode 100644 third-party/curl/lib/vtls/mbedtls_threadlock.c
 delete mode 100644 third-party/curl/lib/vtls/mbedtls_threadlock.h
 delete mode 100644 third-party/curl/lib/vtls/sectransp.c
 delete mode 100644 third-party/curl/lib/vtls/sectransp.h
 create mode 100644 third-party/curl/lib/vtls/vtls_config.c
 create mode 100644 third-party/curl/lib/vtls/vtls_config.h
 create mode 100644 third-party/curl/lib/vtls/vtls_scache.c
 create mode 100644 third-party/curl/lib/vtls/vtls_scache.h
 create mode 100644 third-party/curl/lib/vtls/vtls_spack.c
 create mode 100644 third-party/curl/lib/vtls/vtls_spack.h
 delete mode 100644 third-party/curl/lib/warnless.c
 delete mode 100644 third-party/curl/lib/warnless.h
 create mode 100644 third-party/curl/m4/curl-apple-sectrust.m4
 delete mode 100644 third-party/curl/m4/curl-bearssl.m4
 delete mode 100644 third-party/curl/m4/curl-sectransp.m4
 delete mode 100644 third-party/curl/m4/xc-translit.m4
 delete mode 100644 third-party/curl/m4/zz60-xc-ovr.m4
 delete mode 100644 third-party/curl/maketgz
 delete mode 100644 third-party/curl/packages/Makefile.am
 delete mode 100644 third-party/curl/packages/OS400/ccsidcurl.c
 delete mode 100644 third-party/curl/packages/OS400/make-lib.sh
 delete mode 100644 third-party/curl/packages/OS400/make-src.sh
 delete mode 100644 third-party/curl/packages/OS400/os400sys.c
 delete mode 100644 third-party/curl/packages/OS400/os400sys.h
 delete mode 100644 third-party/curl/packages/README.md
 delete mode 100644 third-party/curl/packages/vms/Makefile.am
 delete mode 100644 third-party/curl/packages/vms/config_h.com
 delete mode 100644 third-party/curl/packages/vms/curl_crtl_init.c
 delete mode 100644 third-party/curl/packages/vms/curlmsg.h
 delete mode 100644 third-party/curl/packages/vms/curlmsg.msg
 delete mode 100644 third-party/curl/packages/vms/curlmsg_vms.h
 delete mode 100644 third-party/curl/packages/vms/report_openssl_version.c
 delete mode 100644 third-party/curl/plan9/README
 delete mode 100644 third-party/curl/plan9/include/mkfile
 delete mode 100644 third-party/curl/plan9/lib/mkfile
 delete mode 100644 third-party/curl/plan9/lib/mkfile.inc
 delete mode 100644 third-party/curl/plan9/mkfile
 delete mode 100644 third-party/curl/plan9/mkfile.proto
 delete mode 100644 third-party/curl/plan9/src/mkfile
 delete mode 100644 third-party/curl/plan9/src/mkfile.inc
 create mode 100644 third-party/curl/projects/Makefile.am
 create mode 100644 third-party/curl/projects/OS400/.checksrc
 rename third-party/curl/{packages => projects}/OS400/README.OS400 (93%)
 create mode 100644 third-party/curl/projects/OS400/ccsidcurl.c
 rename third-party/curl/{packages => projects}/OS400/ccsidcurl.h (99%)
 rename third-party/curl/{packages => projects}/OS400/config400.default (97%)
 rename third-party/curl/{packages => projects}/OS400/curl.cmd (97%)
 rename third-party/curl/{packages => projects}/OS400/curl.inc.in (95%)
 rename third-party/curl/{packages => projects}/OS400/curlcl.c (86%)
 rename third-party/curl/{packages => projects}/OS400/curlmain.c (89%)
 rename third-party/curl/{packages => projects}/OS400/initscript.sh (77%)
 create mode 100644 third-party/curl/projects/OS400/make-docs.sh
 rename third-party/curl/{packages => projects}/OS400/make-include.sh (92%)
 create mode 100644 third-party/curl/projects/OS400/make-lib.sh
 create mode 100644 third-party/curl/projects/OS400/make-src.sh
 rename third-party/curl/{packages => projects}/OS400/make-tests.sh (78%)
 rename third-party/curl/{packages => projects}/OS400/makefile.sh (76%)
 create mode 100644 third-party/curl/projects/OS400/os400sys.c
 create mode 100644 third-party/curl/projects/OS400/os400sys.h
 rename third-party/curl/{packages => projects}/OS400/rpg-examples/HEADERAPI (98%)
 rename third-party/curl/{packages => projects}/OS400/rpg-examples/HTTPPOST (97%)
 rename third-party/curl/{packages => projects}/OS400/rpg-examples/INMEMORY (98%)
 rename third-party/curl/{packages => projects}/OS400/rpg-examples/SIMPLE1 (98%)
 rename third-party/curl/{packages => projects}/OS400/rpg-examples/SIMPLE2 (96%)
 rename third-party/curl/{packages => projects}/OS400/rpg-examples/SMTPSRCMBR (98%)
 create mode 100644 third-party/curl/projects/Windows/README.md
 delete mode 100644 third-party/curl/projects/Windows/VC10/.gitignore
 delete mode 100644 third-party/curl/projects/Windows/VC10/curl-all.sln
 delete mode 100644 third-party/curl/projects/Windows/VC10/lib/.gitignore
 delete mode 100644 third-party/curl/projects/Windows/VC10/lib/libcurl.sln
 delete mode 100644 third-party/curl/projects/Windows/VC10/lib/libcurl.tmpl
 delete mode 100644 third-party/curl/projects/Windows/VC10/lib/libcurl.vcxproj.filters
 delete mode 100644 third-party/curl/projects/Windows/VC10/src/.gitignore
 delete mode 100644 third-party/curl/projects/Windows/VC10/src/curl.sln
 delete mode 100644 third-party/curl/projects/Windows/VC10/src/curl.tmpl
 delete mode 100644 third-party/curl/projects/Windows/VC10/src/curl.vcxproj.filters
 delete mode 100644 third-party/curl/projects/Windows/VC11/.gitignore
 delete mode 100644 third-party/curl/projects/Windows/VC11/curl-all.sln
 delete mode 100644 third-party/curl/projects/Windows/VC11/lib/.gitignore
 delete mode 100644 third-party/curl/projects/Windows/VC11/lib/libcurl.sln
 delete mode 100644 third-party/curl/projects/Windows/VC11/lib/libcurl.tmpl
 delete mode 100644 third-party/curl/projects/Windows/VC11/lib/libcurl.vcxproj.filters
 delete mode 100644 third-party/curl/projects/Windows/VC11/src/.gitignore
 delete mode 100644 third-party/curl/projects/Windows/VC11/src/curl.sln
 delete mode 100644 third-party/curl/projects/Windows/VC11/src/curl.tmpl
 delete mode 100644 third-party/curl/projects/Windows/VC11/src/curl.vcxproj.filters
 delete mode 100644 third-party/curl/projects/Windows/VC12/.gitignore
 delete mode 100644 third-party/curl/projects/Windows/VC12/curl-all.sln
 delete mode 100644 third-party/curl/projects/Windows/VC12/lib/.gitignore
 delete mode 100644 third-party/curl/projects/Windows/VC12/lib/libcurl.sln
 delete mode 100644 third-party/curl/projects/Windows/VC12/lib/libcurl.tmpl
 delete mode 100644 third-party/curl/projects/Windows/VC12/lib/libcurl.vcxproj.filters
 delete mode 100644 third-party/curl/projects/Windows/VC12/src/.gitignore
 delete mode 100644 third-party/curl/projects/Windows/VC12/src/curl.sln
 delete mode 100644 third-party/curl/projects/Windows/VC12/src/curl.tmpl
 delete mode 100644 third-party/curl/projects/Windows/VC12/src/curl.vcxproj.filters
 delete mode 100644 third-party/curl/projects/Windows/VC14.10/.gitignore
 delete mode 100644 third-party/curl/projects/Windows/VC14.10/curl-all.sln
 delete mode 100644 third-party/curl/projects/Windows/VC14.10/lib/.gitignore
 delete mode 100644 third-party/curl/projects/Windows/VC14.10/lib/libcurl.sln
 delete mode 100644 third-party/curl/projects/Windows/VC14.10/lib/libcurl.tmpl
 delete mode 100644 third-party/curl/projects/Windows/VC14.10/lib/libcurl.vcxproj.filters
 delete mode 100644 third-party/curl/projects/Windows/VC14.10/src/.gitignore
 delete mode 100644 third-party/curl/projects/Windows/VC14.10/src/curl.sln
 delete mode 100644 third-party/curl/projects/Windows/VC14.10/src/curl.tmpl
 delete mode 100644 third-party/curl/projects/Windows/VC14.10/src/curl.vcxproj.filters
 delete mode 100644 third-party/curl/projects/Windows/VC14.30/.gitignore
 delete mode 100644 third-party/curl/projects/Windows/VC14.30/curl-all.sln
 delete mode 100644 third-party/curl/projects/Windows/VC14.30/lib/.gitignore
 delete mode 100644 third-party/curl/projects/Windows/VC14.30/lib/libcurl.sln
 delete mode 100644 third-party/curl/projects/Windows/VC14.30/lib/libcurl.tmpl
 delete mode 100644 third-party/curl/projects/Windows/VC14.30/lib/libcurl.vcxproj.filters
 delete mode 100644 third-party/curl/projects/Windows/VC14.30/src/.gitignore
 delete mode 100644 third-party/curl/projects/Windows/VC14.30/src/curl.sln
 delete mode 100644 third-party/curl/projects/Windows/VC14.30/src/curl.tmpl
 delete mode 100644 third-party/curl/projects/Windows/VC14.30/src/curl.vcxproj.filters
 delete mode 100644 third-party/curl/projects/Windows/VC14/.gitignore
 delete mode 100644 third-party/curl/projects/Windows/VC14/curl-all.sln
 delete mode 100644 third-party/curl/projects/Windows/VC14/lib/.gitignore
 delete mode 100644 third-party/curl/projects/Windows/VC14/lib/libcurl.sln
 delete mode 100644 third-party/curl/projects/Windows/VC14/lib/libcurl.tmpl
 delete mode 100644 third-party/curl/projects/Windows/VC14/lib/libcurl.vcxproj.filters
 delete mode 100644 third-party/curl/projects/Windows/VC14/src/.gitignore
 delete mode 100644 third-party/curl/projects/Windows/VC14/src/curl.sln
 delete mode 100644 third-party/curl/projects/Windows/VC14/src/curl.tmpl
 delete mode 100644 third-party/curl/projects/Windows/VC14/src/curl.vcxproj.filters
 create mode 100644 third-party/curl/projects/Windows/generate.bat
 rename third-party/curl/projects/Windows/{ => tmpl}/.gitattributes (100%)
 create mode 100644 third-party/curl/projects/Windows/tmpl/README.txt
 create mode 100644 third-party/curl/projects/Windows/tmpl/curl-all.sln
 create mode 100644 third-party/curl/projects/Windows/tmpl/curl.sln
 create mode 100644 third-party/curl/projects/Windows/tmpl/curl.vcxproj
 create mode 100644 third-party/curl/projects/Windows/tmpl/curl.vcxproj.filters
 create mode 100644 third-party/curl/projects/Windows/tmpl/libcurl.sln
 create mode 100644 third-party/curl/projects/Windows/tmpl/libcurl.vcxproj
 create mode 100644 third-party/curl/projects/Windows/tmpl/libcurl.vcxproj.filters
 delete mode 100644 third-party/curl/projects/build-openssl.bat
 delete mode 100644 third-party/curl/projects/build-wolfssl.bat
 delete mode 100644 third-party/curl/projects/checksrc.bat
 delete mode 100644 third-party/curl/projects/generate.bat
 create mode 100644 third-party/curl/projects/vms/Makefile.am
 rename third-party/curl/{packages => projects}/vms/backup_gnv_curl_src.com (100%)
 rename third-party/curl/{packages => projects}/vms/build_curl-config_script.com (98%)
 rename third-party/curl/{packages => projects}/vms/build_gnv_curl.com (100%)
 rename third-party/curl/{packages => projects}/vms/build_gnv_curl_pcsi_desc.com (99%)
 rename third-party/curl/{packages => projects}/vms/build_gnv_curl_pcsi_text.com (97%)
 rename third-party/curl/{packages => projects}/vms/build_gnv_curl_release_notes.com (90%)
 rename third-party/curl/{packages => projects}/vms/build_libcurl_pc.com (97%)
 rename third-party/curl/{packages => projects}/vms/build_vms.com (96%)
 rename third-party/curl/{packages => projects}/vms/clean_gnv_curl.com (88%)
 rename third-party/curl/{packages => projects}/vms/compare_curl_source.com (98%)
 create mode 100644 third-party/curl/projects/vms/config_h.com
 create mode 100644 third-party/curl/projects/vms/curl_crtl_init.c
 rename third-party/curl/{packages => projects}/vms/curl_gnv_build_steps.txt (96%)
 rename third-party/curl/{packages => projects}/vms/curl_release_note_start.txt (91%)
 rename third-party/curl/{packages => projects}/vms/curl_startup.com (97%)
 create mode 100644 third-party/curl/projects/vms/curlmsg.h
 create mode 100644 third-party/curl/projects/vms/curlmsg.msg
 rename third-party/curl/{packages => projects}/vms/curlmsg.sdl (100%)
 create mode 100644 third-party/curl/projects/vms/curlmsg_vms.h
 rename third-party/curl/{packages => projects}/vms/generate_config_vms_h_curl.com (83%)
 rename third-party/curl/{packages => projects}/vms/generate_vax_transfer.com (100%)
 rename third-party/curl/{packages => projects}/vms/gnv_conftest.c_first (97%)
 rename third-party/curl/{packages => projects}/vms/gnv_curl_configure.sh (85%)
 rename third-party/curl/{packages => projects}/vms/gnv_libcurl_symbols.opt (100%)
 rename third-party/curl/{packages => projects}/vms/gnv_link_curl.com (95%)
 rename third-party/curl/{packages => projects}/vms/macro32_exactcase.patch (100%)
 rename third-party/curl/{packages => projects}/vms/make_gnv_curl_install.sh (94%)
 rename third-party/curl/{packages => projects}/vms/make_pcsi_curl_kit_name.com (98%)
 rename third-party/curl/{packages => projects}/vms/pcsi_gnv_curl_file_list.txt (98%)
 rename third-party/curl/{packages => projects}/vms/pcsi_product_gnv_curl.com (95%)
 rename third-party/curl/{packages => projects}/vms/readme (90%)
 create mode 100644 third-party/curl/projects/vms/report_openssl_version.c
 rename third-party/curl/{packages => projects}/vms/setup_gnv_curl_build.com (93%)
 rename third-party/curl/{packages => projects}/vms/stage_curl_install.com (99%)
 rename third-party/curl/{packages => projects}/vms/vms_eco_level.h (100%)
 delete mode 100644 third-party/curl/projects/wolfssl_options.h
 delete mode 100644 third-party/curl/projects/wolfssl_override.props
 create mode 100644 third-party/curl/renovate.json
 create mode 100644 third-party/curl/scripts/.checksrc
 create mode 100644 third-party/curl/scripts/CMakeLists.txt
 create mode 100644 third-party/curl/scripts/badwords
 create mode 100644 third-party/curl/scripts/badwords-all
 create mode 100644 third-party/curl/scripts/badwords.txt
 create mode 100644 third-party/curl/scripts/cd2cd
 create mode 100644 third-party/curl/scripts/cd2nroff
 create mode 100644 third-party/curl/scripts/cdall
 create mode 100644 third-party/curl/scripts/checksrc-all.pl
 delete mode 100644 third-party/curl/scripts/ciconfig.pl
 delete mode 100644 third-party/curl/scripts/cijobs.pl
 create mode 100644 third-party/curl/scripts/cmakelint.sh
 delete mode 100644 third-party/curl/scripts/copyright.pl
 create mode 100644 third-party/curl/scripts/dmaketgz
 create mode 100644 third-party/curl/scripts/extract-unit-protos
 delete mode 100644 third-party/curl/scripts/log2changes.pl
 create mode 100644 third-party/curl/scripts/maketgz
 create mode 100644 third-party/curl/scripts/managen
 create mode 100644 third-party/curl/scripts/mdlinkcheck
 create mode 100644 third-party/curl/scripts/mk-unity.pl
 create mode 100644 third-party/curl/scripts/nroff2cd
 create mode 100644 third-party/curl/scripts/perlcheck.sh
 create mode 100644 third-party/curl/scripts/pythonlint.sh
 create mode 100644 third-party/curl/scripts/randdisable
 create mode 100644 third-party/curl/scripts/release-tools.sh
 create mode 100644 third-party/curl/scripts/schemetable.c
 create mode 100644 third-party/curl/scripts/spacecheck.pl
 create mode 100644 third-party/curl/scripts/top-complexity
 create mode 100644 third-party/curl/scripts/top-length
 delete mode 100644 third-party/curl/scripts/updatemanpages.pl
 create mode 100644 third-party/curl/scripts/verify-release
 create mode 100644 third-party/curl/scripts/wcurl
 create mode 100644 third-party/curl/src/.checksrc
 delete mode 100644 third-party/curl/src/Makefile.mk
 create mode 100644 third-party/curl/src/config2setopts.c
 create mode 100644 third-party/curl/src/config2setopts.h
 create mode 100644 third-party/curl/src/curlinfo.c
 create mode 100644 third-party/curl/src/mk-file-embed.pl
 create mode 100644 third-party/curl/src/terminal.c
 create mode 100644 third-party/curl/src/terminal.h
 delete mode 100644 third-party/curl/src/tool_binmode.c
 delete mode 100644 third-party/curl/src/tool_binmode.h
 delete mode 100644 third-party/curl/src/tool_bname.c
 delete mode 100644 third-party/curl/src/tool_bname.h
 create mode 100644 third-party/curl/src/tool_cb_soc.c
 create mode 100644 third-party/curl/src/tool_cb_soc.h
 delete mode 100644 third-party/curl/src/tool_hugehelp.c.cvs
 create mode 100644 third-party/curl/src/tool_ipfs.c
 create mode 100644 third-party/curl/src/tool_ipfs.h
 delete mode 100644 third-party/curl/src/tool_sleep.c
 delete mode 100644 third-party/curl/src/tool_sleep.h
 create mode 100644 third-party/curl/src/tool_ssls.c
 create mode 100644 third-party/curl/src/tool_ssls.h
 delete mode 100644 third-party/curl/src/tool_strdup.c
 delete mode 100644 third-party/curl/src/tool_strdup.h
 create mode 100644 third-party/curl/src/toolx/tool_time.c
 create mode 100644 third-party/curl/src/toolx/tool_time.h
 delete mode 100644 third-party/curl/tests/CI.md
 delete mode 100644 third-party/curl/tests/FILEFORMAT.md
 delete mode 100644 third-party/curl/tests/README.md
 create mode 100644 third-party/curl/tests/allversions.pm
 delete mode 100644 third-party/curl/tests/badsymbols.pl
 create mode 100644 third-party/curl/tests/certs/CMakeLists.txt
 delete mode 100644 third-party/curl/tests/certs/EdelCurlRoot-ca.cacert
 delete mode 100644 third-party/curl/tests/certs/EdelCurlRoot-ca.cnf
 delete mode 100644 third-party/curl/tests/certs/EdelCurlRoot-ca.crt
 delete mode 100644 third-party/curl/tests/certs/EdelCurlRoot-ca.csr
 delete mode 100644 third-party/curl/tests/certs/EdelCurlRoot-ca.der
 delete mode 100644 third-party/curl/tests/certs/EdelCurlRoot-ca.key
 delete mode 100644 third-party/curl/tests/certs/EdelCurlRoot-ca.prm
 create mode 100644 third-party/curl/tests/certs/Makefile.inc
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-firstSAN-sv.crl
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-firstSAN-sv.crt
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-firstSAN-sv.csr
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-firstSAN-sv.der
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-firstSAN-sv.dhp
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-firstSAN-sv.key
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-firstSAN-sv.pem
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-firstSAN-sv.prm
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-firstSAN-sv.pub.der
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-firstSAN-sv.pub.pem
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-firstSAN-sv.pubkey-pinned
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-lastSAN-sv.crl
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-lastSAN-sv.crt
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-lastSAN-sv.csr
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-lastSAN-sv.der
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-lastSAN-sv.dhp
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-lastSAN-sv.key
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-lastSAN-sv.pem
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-lastSAN-sv.prm
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-lastSAN-sv.pub.der
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-lastSAN-sv.pub.pem
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-lastSAN-sv.pubkey-pinned
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-sv.crl
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-sv.crt
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-sv.csr
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-sv.der
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-sv.dhp
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-sv.key
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-sv.pem
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-sv.prm
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-sv.pub.der
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-sv.pub.pem
 delete mode 100644 third-party/curl/tests/certs/Server-localhost-sv.pubkey-pinned
 delete mode 100644 third-party/curl/tests/certs/Server-localhost.nn-sv.crl
 delete mode 100644 third-party/curl/tests/certs/Server-localhost.nn-sv.crt
 delete mode 100644 third-party/curl/tests/certs/Server-localhost.nn-sv.csr
 delete mode 100644 third-party/curl/tests/certs/Server-localhost.nn-sv.der
 delete mode 100644 third-party/curl/tests/certs/Server-localhost.nn-sv.dhp
 delete mode 100644 third-party/curl/tests/certs/Server-localhost.nn-sv.key
 delete mode 100644 third-party/curl/tests/certs/Server-localhost.nn-sv.pem
 delete mode 100644 third-party/curl/tests/certs/Server-localhost.nn-sv.prm
 delete mode 100644 third-party/curl/tests/certs/Server-localhost.nn-sv.pub.der
 delete mode 100644 third-party/curl/tests/certs/Server-localhost.nn-sv.pub.pem
 delete mode 100644 third-party/curl/tests/certs/Server-localhost.nn-sv.pubkey-pinned
 delete mode 100644 third-party/curl/tests/certs/Server-localhost0h-sv.crl
 delete mode 100644 third-party/curl/tests/certs/Server-localhost0h-sv.crt
 delete mode 100644 third-party/curl/tests/certs/Server-localhost0h-sv.csr
 delete mode 100644 third-party/curl/tests/certs/Server-localhost0h-sv.der
 delete mode 100644 third-party/curl/tests/certs/Server-localhost0h-sv.dhp
 delete mode 100644 third-party/curl/tests/certs/Server-localhost0h-sv.key
 delete mode 100644 third-party/curl/tests/certs/Server-localhost0h-sv.pem
 delete mode 100644 third-party/curl/tests/certs/Server-localhost0h-sv.prm
 delete mode 100644 third-party/curl/tests/certs/Server-localhost0h-sv.pub.der
 delete mode 100644 third-party/curl/tests/certs/Server-localhost0h-sv.pub.pem
 delete mode 100644 third-party/curl/tests/certs/Server-localhost0h-sv.pubkey-pinned
 create mode 100644 third-party/curl/tests/certs/genserv.pl
 delete mode 100644 third-party/curl/tests/certs/scripts/Makefile.am
 delete mode 100644 third-party/curl/tests/certs/scripts/genroot.sh
 delete mode 100644 third-party/curl/tests/certs/scripts/genserv.sh
 delete mode 100644 third-party/curl/tests/certs/stunnel-sv.crl
 delete mode 100644 third-party/curl/tests/certs/stunnel-sv.crt
 delete mode 100644 third-party/curl/tests/certs/stunnel-sv.csr
 delete mode 100644 third-party/curl/tests/certs/stunnel-sv.der
 delete mode 100644 third-party/curl/tests/certs/stunnel-sv.dhp
 delete mode 100644 third-party/curl/tests/certs/stunnel-sv.key
 delete mode 100644 third-party/curl/tests/certs/stunnel-sv.pem
 delete mode 100644 third-party/curl/tests/certs/stunnel-sv.prm
 delete mode 100644 third-party/curl/tests/certs/stunnel-sv.pub.der
 delete mode 100644 third-party/curl/tests/certs/stunnel-sv.pub.pem
 delete mode 100644 third-party/curl/tests/certs/stunnel-sv.pubkey-pinned
 create mode 100644 third-party/curl/tests/certs/test-ca.cnf
 create mode 100644 third-party/curl/tests/certs/test-ca.prm
 create mode 100644 third-party/curl/tests/certs/test-client-cert.prm
 create mode 100644 third-party/curl/tests/certs/test-client-eku-only.prm
 create mode 100644 third-party/curl/tests/certs/test-localhost-san-first.prm
 create mode 100644 third-party/curl/tests/certs/test-localhost-san-last.prm
 create mode 100644 third-party/curl/tests/certs/test-localhost.nn.prm
 create mode 100644 third-party/curl/tests/certs/test-localhost.prm
 create mode 100644 third-party/curl/tests/certs/test-localhost0h.prm
 delete mode 100644 third-party/curl/tests/check-deprecated.pl
 delete mode 100644 third-party/curl/tests/check-translatable-options.pl
 create mode 100644 third-party/curl/tests/cmake/CMakeLists.txt
 create mode 100644 third-party/curl/tests/cmake/test.c
 create mode 100644 third-party/curl/tests/cmake/test.cpp
 create mode 100644 third-party/curl/tests/cmake/test.sh
 create mode 100644 third-party/curl/tests/configurehelp.pm.in
 delete mode 100644 third-party/curl/tests/conftest.py
 delete mode 100644 third-party/curl/tests/convsrctest.pl
 delete mode 100644 third-party/curl/tests/data/.gitattributes
 delete mode 100644 third-party/curl/tests/data/CMakeLists.txt
 delete mode 100644 third-party/curl/tests/data/Makefile.inc
 create mode 100644 third-party/curl/tests/data/data-xml1
 create mode 100644 third-party/curl/tests/data/data1400.c
 create mode 100644 third-party/curl/tests/data/data1401.c
 create mode 100644 third-party/curl/tests/data/data1402.c
 create mode 100644 third-party/curl/tests/data/data1403.c
 create mode 100644 third-party/curl/tests/data/data1404.c
 create mode 100644 third-party/curl/tests/data/data1405.c
 create mode 100644 third-party/curl/tests/data/data1406.c
 create mode 100644 third-party/curl/tests/data/data1407.c
 create mode 100644 third-party/curl/tests/data/data1420.c
 create mode 100644 third-party/curl/tests/data/data1461.txt
 create mode 100644 third-party/curl/tests/data/data1463.txt
 create mode 100644 third-party/curl/tests/data/data1465.c
 create mode 100644 third-party/curl/tests/data/data1481.c
 create mode 100644 third-party/curl/tests/data/data1705-1.md
 create mode 100644 third-party/curl/tests/data/data1705-2.md
 create mode 100644 third-party/curl/tests/data/data1705-3.md
 create mode 100644 third-party/curl/tests/data/data1705-4.md
 create mode 100644 third-party/curl/tests/data/data1705-stdout.1
 create mode 100644 third-party/curl/tests/data/data1706-1.md
 create mode 100644 third-party/curl/tests/data/data1706-2.md
 create mode 100644 third-party/curl/tests/data/data1706-3.md
 create mode 100644 third-party/curl/tests/data/data1706-4.md
 create mode 100644 third-party/curl/tests/data/data1706-stdout.txt
 create mode 100644 third-party/curl/tests/data/data320.html
 create mode 100644 third-party/curl/tests/data/test1475
 create mode 100644 third-party/curl/tests/data/test1476
 create mode 100644 third-party/curl/tests/data/test1477
 create mode 100644 third-party/curl/tests/data/test1478
 create mode 100644 third-party/curl/tests/data/test1479
 create mode 100644 third-party/curl/tests/data/test1480
 create mode 100644 third-party/curl/tests/data/test1481
 create mode 100644 third-party/curl/tests/data/test1482
 create mode 100644 third-party/curl/tests/data/test1483
 create mode 100644 third-party/curl/tests/data/test1484
 create mode 100644 third-party/curl/tests/data/test1485
 create mode 100644 third-party/curl/tests/data/test1486
 create mode 100644 third-party/curl/tests/data/test1487
 create mode 100644 third-party/curl/tests/data/test1488
 create mode 100644 third-party/curl/tests/data/test1489
 create mode 100644 third-party/curl/tests/data/test1490
 create mode 100644 third-party/curl/tests/data/test1491
 create mode 100644 third-party/curl/tests/data/test1492
 create mode 100644 third-party/curl/tests/data/test1493
 create mode 100644 third-party/curl/tests/data/test1494
 create mode 100644 third-party/curl/tests/data/test1495
 create mode 100644 third-party/curl/tests/data/test1496
 create mode 100644 third-party/curl/tests/data/test1497
 create mode 100644 third-party/curl/tests/data/test1498
 create mode 100644 third-party/curl/tests/data/test1499
 create mode 100644 third-party/curl/tests/data/test1541
 create mode 100644 third-party/curl/tests/data/test1545
 create mode 100644 third-party/curl/tests/data/test1546
 create mode 100644 third-party/curl/tests/data/test1547
 create mode 100644 third-party/curl/tests/data/test1548
 create mode 100644 third-party/curl/tests/data/test1549
 create mode 100644 third-party/curl/tests/data/test1571
 create mode 100644 third-party/curl/tests/data/test1572
 create mode 100644 third-party/curl/tests/data/test1573
 create mode 100644 third-party/curl/tests/data/test1574
 create mode 100644 third-party/curl/tests/data/test1575
 create mode 100644 third-party/curl/tests/data/test1576
 create mode 100644 third-party/curl/tests/data/test1577
 create mode 100644 third-party/curl/tests/data/test1578
 create mode 100644 third-party/curl/tests/data/test1579
 create mode 100644 third-party/curl/tests/data/test1580
 create mode 100644 third-party/curl/tests/data/test1581
 create mode 100644 third-party/curl/tests/data/test1582
 create mode 100644 third-party/curl/tests/data/test1583
 create mode 100644 third-party/curl/tests/data/test1584
 create mode 100644 third-party/curl/tests/data/test1585
 create mode 100644 third-party/curl/tests/data/test1586
 create mode 100644 third-party/curl/tests/data/test1587
 create mode 100644 third-party/curl/tests/data/test1588
 create mode 100644 third-party/curl/tests/data/test1589
 create mode 100644 third-party/curl/tests/data/test1598
 create mode 100644 third-party/curl/tests/data/test1599
 delete mode 100644 third-party/curl/tests/data/test1609
 create mode 100644 third-party/curl/tests/data/test1615
 create mode 100644 third-party/curl/tests/data/test1616
 create mode 100644 third-party/curl/tests/data/test1617
 create mode 100644 third-party/curl/tests/data/test1618
 create mode 100644 third-party/curl/tests/data/test1619
 create mode 100644 third-party/curl/tests/data/test1622
 create mode 100644 third-party/curl/tests/data/test1623
 create mode 100644 third-party/curl/tests/data/test1624
 create mode 100644 third-party/curl/tests/data/test1625
 create mode 100644 third-party/curl/tests/data/test1626
 create mode 100644 third-party/curl/tests/data/test1627
 create mode 100644 third-party/curl/tests/data/test1628
 create mode 100644 third-party/curl/tests/data/test1629
 create mode 100644 third-party/curl/tests/data/test1636
 create mode 100644 third-party/curl/tests/data/test1637
 create mode 100644 third-party/curl/tests/data/test1638
 create mode 100644 third-party/curl/tests/data/test1639
 create mode 100644 third-party/curl/tests/data/test1640
 create mode 100644 third-party/curl/tests/data/test1641
 create mode 100644 third-party/curl/tests/data/test1642
 create mode 100644 third-party/curl/tests/data/test1643
 create mode 100644 third-party/curl/tests/data/test1644
 create mode 100644 third-party/curl/tests/data/test1645
 create mode 100644 third-party/curl/tests/data/test1646
 create mode 100644 third-party/curl/tests/data/test1647
 create mode 100644 third-party/curl/tests/data/test1648
 create mode 100644 third-party/curl/tests/data/test1649
 create mode 100644 third-party/curl/tests/data/test1656
 create mode 100644 third-party/curl/tests/data/test1657
 create mode 100644 third-party/curl/tests/data/test1658
 create mode 100644 third-party/curl/tests/data/test1659
 create mode 100644 third-party/curl/tests/data/test1663
 create mode 100644 third-party/curl/tests/data/test1664
 create mode 100644 third-party/curl/tests/data/test1665
 create mode 100644 third-party/curl/tests/data/test1666
 create mode 100644 third-party/curl/tests/data/test1667
 create mode 100644 third-party/curl/tests/data/test1668
 create mode 100644 third-party/curl/tests/data/test1669
 create mode 100644 third-party/curl/tests/data/test1672
 create mode 100644 third-party/curl/tests/data/test1673
 create mode 100644 third-party/curl/tests/data/test1674
 create mode 100644 third-party/curl/tests/data/test1675
 create mode 100644 third-party/curl/tests/data/test1676
 create mode 100644 third-party/curl/tests/data/test1677
 create mode 100644 third-party/curl/tests/data/test1684
 create mode 100644 third-party/curl/tests/data/test1685
 create mode 100644 third-party/curl/tests/data/test1686
 create mode 100644 third-party/curl/tests/data/test1704
 create mode 100644 third-party/curl/tests/data/test1705
 create mode 100644 third-party/curl/tests/data/test1706
 create mode 100644 third-party/curl/tests/data/test1707
 create mode 100644 third-party/curl/tests/data/test1708
 create mode 100644 third-party/curl/tests/data/test1709
 create mode 100644 third-party/curl/tests/data/test1710
 create mode 100644 third-party/curl/tests/data/test1711
 create mode 100644 third-party/curl/tests/data/test1712
 create mode 100644 third-party/curl/tests/data/test1713
 create mode 100644 third-party/curl/tests/data/test1714
 create mode 100644 third-party/curl/tests/data/test1715
 create mode 100644 third-party/curl/tests/data/test1720
 create mode 100644 third-party/curl/tests/data/test1721
 create mode 100644 third-party/curl/tests/data/test1722
 create mode 100644 third-party/curl/tests/data/test1723
 create mode 100644 third-party/curl/tests/data/test1724
 create mode 100644 third-party/curl/tests/data/test1725
 create mode 100644 third-party/curl/tests/data/test1802
 create mode 100644 third-party/curl/tests/data/test1847
 create mode 100644 third-party/curl/tests/data/test1848
 create mode 100644 third-party/curl/tests/data/test1849
 create mode 100644 third-party/curl/tests/data/test1850
 create mode 100644 third-party/curl/tests/data/test1851
 create mode 100644 third-party/curl/tests/data/test1900
 create mode 100644 third-party/curl/tests/data/test1901
 create mode 100644 third-party/curl/tests/data/test1902
 create mode 100644 third-party/curl/tests/data/test1920
 create mode 100644 third-party/curl/tests/data/test1921
 create mode 100644 third-party/curl/tests/data/test1922
 create mode 100644 third-party/curl/tests/data/test1965
 create mode 100644 third-party/curl/tests/data/test1966
 create mode 100644 third-party/curl/tests/data/test1967
 create mode 100644 third-party/curl/tests/data/test1976
 create mode 100644 third-party/curl/tests/data/test1977
 create mode 100644 third-party/curl/tests/data/test1978
 create mode 100644 third-party/curl/tests/data/test1979
 create mode 100644 third-party/curl/tests/data/test1980
 create mode 100644 third-party/curl/tests/data/test1981
 create mode 100644 third-party/curl/tests/data/test1982
 create mode 100644 third-party/curl/tests/data/test1983
 create mode 100644 third-party/curl/tests/data/test1984
 create mode 100644 third-party/curl/tests/data/test2005
 create mode 100644 third-party/curl/tests/data/test2006
 create mode 100644 third-party/curl/tests/data/test2007
 create mode 100644 third-party/curl/tests/data/test2008
 create mode 100644 third-party/curl/tests/data/test2009
 create mode 100644 third-party/curl/tests/data/test2010
 create mode 100644 third-party/curl/tests/data/test2011
 create mode 100644 third-party/curl/tests/data/test2012
 create mode 100644 third-party/curl/tests/data/test2013
 create mode 100644 third-party/curl/tests/data/test2014
 create mode 100644 third-party/curl/tests/data/test2015
 create mode 100644 third-party/curl/tests/data/test2088
 create mode 100644 third-party/curl/tests/data/test2089
 create mode 100644 third-party/curl/tests/data/test2090
 create mode 100644 third-party/curl/tests/data/test2091
 create mode 100644 third-party/curl/tests/data/test2092
 create mode 100644 third-party/curl/tests/data/test2101
 create mode 100644 third-party/curl/tests/data/test2102
 create mode 100644 third-party/curl/tests/data/test2103
 create mode 100644 third-party/curl/tests/data/test2104
 create mode 100644 third-party/curl/tests/data/test2105
 create mode 100644 third-party/curl/tests/data/test2106
 create mode 100644 third-party/curl/tests/data/test2107
 create mode 100644 third-party/curl/tests/data/test2108
 create mode 100644 third-party/curl/tests/data/test2206
 create mode 100644 third-party/curl/tests/data/test2207
 create mode 100644 third-party/curl/tests/data/test2208
 delete mode 100644 third-party/curl/tests/data/test2305
 create mode 100644 third-party/curl/tests/data/test2307
 create mode 100644 third-party/curl/tests/data/test2308
 create mode 100644 third-party/curl/tests/data/test2309
 create mode 100644 third-party/curl/tests/data/test2310
 create mode 100644 third-party/curl/tests/data/test2311
 create mode 100644 third-party/curl/tests/data/test2405
 create mode 100644 third-party/curl/tests/data/test2406
 create mode 100644 third-party/curl/tests/data/test2407
 create mode 100644 third-party/curl/tests/data/test2408
 create mode 100644 third-party/curl/tests/data/test2409
 create mode 100644 third-party/curl/tests/data/test2410
 create mode 100644 third-party/curl/tests/data/test2411
 create mode 100644 third-party/curl/tests/data/test2412
 create mode 100644 third-party/curl/tests/data/test2413
 create mode 100644 third-party/curl/tests/data/test2504
 create mode 100644 third-party/curl/tests/data/test2505
 create mode 100644 third-party/curl/tests/data/test2506
 create mode 100644 third-party/curl/tests/data/test2604
 create mode 100644 third-party/curl/tests/data/test2605
 create mode 100644 third-party/curl/tests/data/test268
 create mode 100644 third-party/curl/tests/data/test2700
 create mode 100644 third-party/curl/tests/data/test2701
 create mode 100644 third-party/curl/tests/data/test2702
 create mode 100644 third-party/curl/tests/data/test2703
 create mode 100644 third-party/curl/tests/data/test2704
 create mode 100644 third-party/curl/tests/data/test2705
 create mode 100644 third-party/curl/tests/data/test2706
 create mode 100644 third-party/curl/tests/data/test2707
 create mode 100644 third-party/curl/tests/data/test2708
 create mode 100644 third-party/curl/tests/data/test2709
 create mode 100644 third-party/curl/tests/data/test2710
 create mode 100644 third-party/curl/tests/data/test2711
 create mode 100644 third-party/curl/tests/data/test2712
 create mode 100644 third-party/curl/tests/data/test2713
 create mode 100644 third-party/curl/tests/data/test2714
 create mode 100644 third-party/curl/tests/data/test2715
 create mode 100644 third-party/curl/tests/data/test2716
 create mode 100644 third-party/curl/tests/data/test2717
 create mode 100644 third-party/curl/tests/data/test2718
 create mode 100644 third-party/curl/tests/data/test2719
 create mode 100644 third-party/curl/tests/data/test2720
 create mode 100644 third-party/curl/tests/data/test2721
 create mode 100644 third-party/curl/tests/data/test2722
 create mode 100644 third-party/curl/tests/data/test2723
 create mode 100644 third-party/curl/tests/data/test3031
 create mode 100644 third-party/curl/tests/data/test3032
 create mode 100644 third-party/curl/tests/data/test3033
 create mode 100644 third-party/curl/tests/data/test3034
 create mode 100644 third-party/curl/tests/data/test3035
 create mode 100644 third-party/curl/tests/data/test3036
 create mode 100644 third-party/curl/tests/data/test3103
 create mode 100644 third-party/curl/tests/data/test3104
 create mode 100644 third-party/curl/tests/data/test3105
 create mode 100644 third-party/curl/tests/data/test3106
 create mode 100644 third-party/curl/tests/data/test3203
 create mode 100644 third-party/curl/tests/data/test3204
 create mode 100644 third-party/curl/tests/data/test3205
 create mode 100644 third-party/curl/tests/data/test3206
 create mode 100644 third-party/curl/tests/data/test3207
 create mode 100644 third-party/curl/tests/data/test3208
 create mode 100644 third-party/curl/tests/data/test3209
 create mode 100644 third-party/curl/tests/data/test3210
 create mode 100644 third-party/curl/tests/data/test3211
 create mode 100644 third-party/curl/tests/data/test3212
 create mode 100644 third-party/curl/tests/data/test3213
 create mode 100644 third-party/curl/tests/data/test3214
 create mode 100644 third-party/curl/tests/data/test3215
 create mode 100644 third-party/curl/tests/data/test3216
 create mode 100644 third-party/curl/tests/data/test3217
 create mode 100644 third-party/curl/tests/data/test3218
 create mode 100644 third-party/curl/tests/data/test3219
 create mode 100644 third-party/curl/tests/data/test3220
 create mode 100644 third-party/curl/tests/data/test3221
 create mode 100644 third-party/curl/tests/data/test3222
 create mode 100644 third-party/curl/tests/data/test3300
 create mode 100644 third-party/curl/tests/data/test3301
 create mode 100644 third-party/curl/tests/data/test3302
 create mode 100644 third-party/curl/tests/data/test3303
 create mode 100644 third-party/curl/tests/data/test3304
 create mode 100644 third-party/curl/tests/data/test3305
 create mode 100644 third-party/curl/tests/data/test3400
 create mode 100644 third-party/curl/tests/data/test3401
 create mode 100644 third-party/curl/tests/data/test4000
 create mode 100644 third-party/curl/tests/data/test4001
 delete mode 100644 third-party/curl/tests/data/test409
 create mode 100644 third-party/curl/tests/data/test457
 create mode 100644 third-party/curl/tests/data/test458
 create mode 100644 third-party/curl/tests/data/test459
 create mode 100644 third-party/curl/tests/data/test460
 create mode 100644 third-party/curl/tests/data/test461
 create mode 100644 third-party/curl/tests/data/test462
 create mode 100644 third-party/curl/tests/data/test463
 create mode 100644 third-party/curl/tests/data/test467
 create mode 100644 third-party/curl/tests/data/test468
 create mode 100644 third-party/curl/tests/data/test469
 create mode 100644 third-party/curl/tests/data/test470
 create mode 100644 third-party/curl/tests/data/test471
 create mode 100644 third-party/curl/tests/data/test472
 create mode 100644 third-party/curl/tests/data/test473
 create mode 100644 third-party/curl/tests/data/test474
 create mode 100644 third-party/curl/tests/data/test475
 create mode 100644 third-party/curl/tests/data/test476
 create mode 100644 third-party/curl/tests/data/test477
 create mode 100644 third-party/curl/tests/data/test478
 create mode 100644 third-party/curl/tests/data/test479
 create mode 100644 third-party/curl/tests/data/test480
 create mode 100644 third-party/curl/tests/data/test481
 create mode 100644 third-party/curl/tests/data/test482
 create mode 100644 third-party/curl/tests/data/test483
 create mode 100644 third-party/curl/tests/data/test484
 create mode 100644 third-party/curl/tests/data/test485
 create mode 100644 third-party/curl/tests/data/test486
 create mode 100644 third-party/curl/tests/data/test487
 create mode 100644 third-party/curl/tests/data/test488
 create mode 100644 third-party/curl/tests/data/test489
 create mode 100644 third-party/curl/tests/data/test498
 create mode 100644 third-party/curl/tests/data/test499
 create mode 100644 third-party/curl/tests/data/test536
 create mode 100644 third-party/curl/tests/data/test689
 create mode 100644 third-party/curl/tests/data/test690
 create mode 100644 third-party/curl/tests/data/test691
 create mode 100644 third-party/curl/tests/data/test692
 create mode 100644 third-party/curl/tests/data/test693
 create mode 100644 third-party/curl/tests/data/test694
 create mode 100644 third-party/curl/tests/data/test695
 create mode 100644 third-party/curl/tests/data/test696
 create mode 100644 third-party/curl/tests/data/test697
 create mode 100644 third-party/curl/tests/data/test698
 create mode 100644 third-party/curl/tests/data/test699
 create mode 100644 third-party/curl/tests/data/test722
 create mode 100644 third-party/curl/tests/data/test723
 create mode 100644 third-party/curl/tests/data/test724
 create mode 100644 third-party/curl/tests/data/test725
 create mode 100644 third-party/curl/tests/data/test726
 create mode 100644 third-party/curl/tests/data/test727
 create mode 100644 third-party/curl/tests/data/test728
 create mode 100644 third-party/curl/tests/data/test729
 create mode 100644 third-party/curl/tests/data/test730
 create mode 100644 third-party/curl/tests/data/test731
 create mode 100644 third-party/curl/tests/data/test732
 create mode 100644 third-party/curl/tests/data/test733
 create mode 100644 third-party/curl/tests/data/test734
 create mode 100644 third-party/curl/tests/data/test735
 create mode 100644 third-party/curl/tests/data/test736
 create mode 100644 third-party/curl/tests/data/test737
 create mode 100644 third-party/curl/tests/data/test738
 create mode 100644 third-party/curl/tests/data/test739
 create mode 100644 third-party/curl/tests/data/test740
 create mode 100644 third-party/curl/tests/data/test741
 create mode 100644 third-party/curl/tests/data/test742
 create mode 100644 third-party/curl/tests/data/test743
 create mode 100644 third-party/curl/tests/data/test744
 create mode 100644 third-party/curl/tests/data/test745
 create mode 100644 third-party/curl/tests/data/test746
 create mode 100644 third-party/curl/tests/data/test747
 create mode 100644 third-party/curl/tests/data/test748
 create mode 100644 third-party/curl/tests/data/test749
 create mode 100644 third-party/curl/tests/data/test750
 create mode 100644 third-party/curl/tests/data/test751
 create mode 100644 third-party/curl/tests/data/test752
 create mode 100644 third-party/curl/tests/data/test753
 create mode 100644 third-party/curl/tests/data/test754
 create mode 100644 third-party/curl/tests/data/test755
 create mode 100644 third-party/curl/tests/data/test756
 create mode 100644 third-party/curl/tests/data/test757
 create mode 100644 third-party/curl/tests/data/test758
 create mode 100644 third-party/curl/tests/data/test759
 create mode 100644 third-party/curl/tests/data/test760
 create mode 100644 third-party/curl/tests/data/test761
 create mode 100644 third-party/curl/tests/data/test762
 create mode 100644 third-party/curl/tests/data/test763
 create mode 100644 third-party/curl/tests/data/test764
 create mode 100644 third-party/curl/tests/data/test765
 create mode 100644 third-party/curl/tests/data/test766
 create mode 100644 third-party/curl/tests/data/test767
 create mode 100644 third-party/curl/tests/data/test768
 create mode 100644 third-party/curl/tests/data/test769
 create mode 100644 third-party/curl/tests/data/test770
 create mode 100644 third-party/curl/tests/data/test771
 create mode 100644 third-party/curl/tests/data/test772
 create mode 100644 third-party/curl/tests/data/test773
 create mode 100644 third-party/curl/tests/data/test774
 create mode 100644 third-party/curl/tests/data/test775
 create mode 100644 third-party/curl/tests/data/test776
 create mode 100644 third-party/curl/tests/data/test777
 create mode 100644 third-party/curl/tests/data/test778
 create mode 100644 third-party/curl/tests/data/test779
 create mode 100644 third-party/curl/tests/data/test780
 create mode 100644 third-party/curl/tests/data/test781
 create mode 100644 third-party/curl/tests/data/test782
 create mode 100644 third-party/curl/tests/data/test783
 create mode 100644 third-party/curl/tests/data/test784
 create mode 100644 third-party/curl/tests/data/test785
 create mode 100644 third-party/curl/tests/data/test786
 create mode 100644 third-party/curl/tests/data/test787
 create mode 100644 third-party/curl/tests/data/test788
 create mode 100644 third-party/curl/tests/data/test789
 create mode 100644 third-party/curl/tests/data/test790
 create mode 100644 third-party/curl/tests/data/test791
 create mode 100644 third-party/curl/tests/data/test792
 create mode 100644 third-party/curl/tests/data/test793
 create mode 100644 third-party/curl/tests/data/test794
 create mode 100644 third-party/curl/tests/data/test795
 create mode 100644 third-party/curl/tests/data/test796
 create mode 100644 third-party/curl/tests/data/test797
 create mode 100644 third-party/curl/tests/data/test798
 create mode 100644 third-party/curl/tests/data/test992
 create mode 100644 third-party/curl/tests/data/test993
 create mode 100644 third-party/curl/tests/data/test994
 create mode 100644 third-party/curl/tests/data/test995
 create mode 100644 third-party/curl/tests/data/test996
 create mode 100644 third-party/curl/tests/data/test997
 create mode 100644 third-party/curl/tests/data/test998
 create mode 100644 third-party/curl/tests/data/test999
 delete mode 100644 third-party/curl/tests/disable-scan.pl
 create mode 100644 third-party/curl/tests/ech_combos.py
 create mode 100644 third-party/curl/tests/ech_tests.sh
 delete mode 100644 third-party/curl/tests/error-codes.pl
 delete mode 100644 third-party/curl/tests/extern-scan.pl
 create mode 100644 third-party/curl/tests/http/CMakeLists.txt
 delete mode 100644 third-party/curl/tests/http/README.md
 delete mode 100644 third-party/curl/tests/http/clients/.gitignore
 delete mode 100644 third-party/curl/tests/http/clients/Makefile.am
 delete mode 100644 third-party/curl/tests/http/clients/Makefile.inc
 delete mode 100644 third-party/curl/tests/http/clients/h2-download.c
 delete mode 100644 third-party/curl/tests/http/clients/h2-serverpush.c
 delete mode 100644 third-party/curl/tests/http/clients/h2-upgrade-extreme.c
 delete mode 100644 third-party/curl/tests/http/clients/tls-session-reuse.c
 delete mode 100644 third-party/curl/tests/http/clients/ws-data.c
 delete mode 100644 third-party/curl/tests/http/clients/ws-pingpong.c
 create mode 100644 third-party/curl/tests/http/test_16_info.py
 create mode 100644 third-party/curl/tests/http/test_17_ssl_use.py
 create mode 100644 third-party/curl/tests/http/test_18_methods.py
 create mode 100644 third-party/curl/tests/http/test_19_shutdown.py
 create mode 100644 third-party/curl/tests/http/test_21_resolve.py
 create mode 100644 third-party/curl/tests/http/test_22_httpsrr.py
 create mode 100644 third-party/curl/tests/http/test_30_vsftpd.py
 create mode 100644 third-party/curl/tests/http/test_31_vsftpds.py
 create mode 100644 third-party/curl/tests/http/test_32_ftps_vsftpd.py
 create mode 100644 third-party/curl/tests/http/test_40_socks.py
 create mode 100644 third-party/curl/tests/http/test_50_scp.py
 create mode 100644 third-party/curl/tests/http/test_51_sftp.py
 create mode 100644 third-party/curl/tests/http/test_60_h3_proxy.py
 create mode 100644 third-party/curl/tests/http/testenv/dante.py
 create mode 100644 third-party/curl/tests/http/testenv/dnsd.py
 create mode 100644 third-party/curl/tests/http/testenv/h2o.py
 create mode 100644 third-party/curl/tests/http/testenv/sshd.py
 create mode 100644 third-party/curl/tests/http/testenv/vsftpd.py
 delete mode 100644 third-party/curl/tests/libtest/.checksrc
 delete mode 100644 third-party/curl/tests/libtest/chkhostname.c
 create mode 100644 third-party/curl/tests/libtest/cli_ftp_upload.c
 create mode 100644 third-party/curl/tests/libtest/cli_h2_pausing.c
 create mode 100644 third-party/curl/tests/libtest/cli_h2_serverpush.c
 create mode 100644 third-party/curl/tests/libtest/cli_h2_upgrade_extreme.c
 create mode 100644 third-party/curl/tests/libtest/cli_hx_download.c
 create mode 100644 third-party/curl/tests/libtest/cli_hx_upload.c
 create mode 100644 third-party/curl/tests/libtest/cli_tls_session_reuse.c
 create mode 100644 third-party/curl/tests/libtest/cli_upload_pausing.c
 create mode 100644 third-party/curl/tests/libtest/cli_ws_data.c
 create mode 100644 third-party/curl/tests/libtest/cli_ws_pingpong.c
 create mode 100644 third-party/curl/tests/libtest/first.h
 create mode 100644 third-party/curl/tests/libtest/lib1308.c
 create mode 100644 third-party/curl/tests/libtest/lib1485.c
 create mode 100644 third-party/curl/tests/libtest/lib1545.c
 create mode 100644 third-party/curl/tests/libtest/lib1549.c
 create mode 100644 third-party/curl/tests/libtest/lib1571.c
 create mode 100644 third-party/curl/tests/libtest/lib1576.c
 create mode 100644 third-party/curl/tests/libtest/lib1582.c
 create mode 100644 third-party/curl/tests/libtest/lib1587.c
 create mode 100644 third-party/curl/tests/libtest/lib1588.c
 create mode 100644 third-party/curl/tests/libtest/lib1589.c
 create mode 100644 third-party/curl/tests/libtest/lib1598.c
 create mode 100644 third-party/curl/tests/libtest/lib1599.c
 create mode 100644 third-party/curl/tests/libtest/lib1647.c
 create mode 100644 third-party/curl/tests/libtest/lib1648.c
 create mode 100644 third-party/curl/tests/libtest/lib1649.c
 create mode 100644 third-party/curl/tests/libtest/lib1686.c
 create mode 100644 third-party/curl/tests/libtest/lib1900.c
 create mode 100644 third-party/curl/tests/libtest/lib1901.c
 create mode 100644 third-party/curl/tests/libtest/lib1902.c
 create mode 100644 third-party/curl/tests/libtest/lib1920.c
 create mode 100644 third-party/curl/tests/libtest/lib1921.c
 create mode 100644 third-party/curl/tests/libtest/lib1922.c
 create mode 100644 third-party/curl/tests/libtest/lib1965.c
 create mode 100644 third-party/curl/tests/libtest/lib1967.c
 create mode 100644 third-party/curl/tests/libtest/lib1977.c
 create mode 100644 third-party/curl/tests/libtest/lib1978.c
 create mode 100644 third-party/curl/tests/libtest/lib2023.c
 create mode 100644 third-party/curl/tests/libtest/lib2032.c
 create mode 100644 third-party/curl/tests/libtest/lib2082.c
 delete mode 100644 third-party/curl/tests/libtest/lib2305.c
 create mode 100644 third-party/curl/tests/libtest/lib2308.c
 create mode 100644 third-party/curl/tests/libtest/lib2309.c
 create mode 100644 third-party/curl/tests/libtest/lib2405.c
 create mode 100644 third-party/curl/tests/libtest/lib2412.c
 create mode 100644 third-party/curl/tests/libtest/lib2504.c
 create mode 100644 third-party/curl/tests/libtest/lib2505.c
 create mode 100644 third-party/curl/tests/libtest/lib2506.c
 create mode 100644 third-party/curl/tests/libtest/lib2700.c
 create mode 100644 third-party/curl/tests/libtest/lib3033.c
 create mode 100644 third-party/curl/tests/libtest/lib3034.c
 create mode 100644 third-party/curl/tests/libtest/lib3103.c
 create mode 100644 third-party/curl/tests/libtest/lib3104.c
 create mode 100644 third-party/curl/tests/libtest/lib3105.c
 create mode 100644 third-party/curl/tests/libtest/lib3207.c
 create mode 100644 third-party/curl/tests/libtest/lib3208.c
 create mode 100644 third-party/curl/tests/libtest/lib536.c
 create mode 100644 third-party/curl/tests/libtest/lib694.c
 create mode 100644 third-party/curl/tests/libtest/lib695.c
 create mode 100644 third-party/curl/tests/libtest/lib751.c
 create mode 100644 third-party/curl/tests/libtest/lib753.c
 create mode 100644 third-party/curl/tests/libtest/lib757.c
 create mode 100644 third-party/curl/tests/libtest/lib758.c
 create mode 100644 third-party/curl/tests/libtest/lib766.c
 delete mode 100644 third-party/curl/tests/libtest/libauthretry.c
 delete mode 100644 third-party/curl/tests/libtest/libntlmconnect.c
 delete mode 100644 third-party/curl/tests/libtest/libprereq.c
 create mode 100644 third-party/curl/tests/libtest/memptr.c
 delete mode 100644 third-party/curl/tests/libtest/notexists.pl
 delete mode 100644 third-party/curl/tests/libtest/sethostname.c
 delete mode 100644 third-party/curl/tests/libtest/sethostname.h
 delete mode 100644 third-party/curl/tests/libtest/stub_gssapi.c
 delete mode 100644 third-party/curl/tests/libtest/stub_gssapi.h
 delete mode 100644 third-party/curl/tests/libtest/test.h
 create mode 100644 third-party/curl/tests/libtest/unitcheck.h
 delete mode 100644 third-party/curl/tests/manpage-scan.pl
 delete mode 100644 third-party/curl/tests/manpage-syntax.pl
 delete mode 100644 third-party/curl/tests/markdown-uppercase.pl
 delete mode 100644 third-party/curl/tests/mem-include-scan.pl
 create mode 100644 third-party/curl/tests/memanalyzer.pm
 delete mode 100644 third-party/curl/tests/nroff-scan.pl
 delete mode 100644 third-party/curl/tests/option-check.pl
 delete mode 100644 third-party/curl/tests/options-scan.pl
 delete mode 100644 third-party/curl/tests/runtests.1
 create mode 100644 third-party/curl/tests/server/.checksrc
 delete mode 100644 third-party/curl/tests/server/base64.pl
 delete mode 100644 third-party/curl/tests/server/disabled.c
 create mode 100644 third-party/curl/tests/server/dnsd.c
 delete mode 100644 third-party/curl/tests/server/fake_ntlm.c
 create mode 100644 third-party/curl/tests/server/first.c
 create mode 100644 third-party/curl/tests/server/first.h
 delete mode 100644 third-party/curl/tests/server/getpart.h
 delete mode 100644 third-party/curl/tests/server/server_setup.h
 delete mode 100644 third-party/curl/tests/server/server_sockaddr.h
 delete mode 100644 third-party/curl/tests/server/testpart.c
 delete mode 100644 third-party/curl/tests/server/tftp.h
 delete mode 100644 third-party/curl/tests/server/util.h
 delete mode 100644 third-party/curl/tests/stunnel.pem
 delete mode 100644 third-party/curl/tests/symbol-scan.pl
 create mode 100644 third-party/curl/tests/test1119.pl
 create mode 100644 third-party/curl/tests/test1135.pl
 create mode 100644 third-party/curl/tests/test1139.pl
 create mode 100644 third-party/curl/tests/test1140.pl
 create mode 100644 third-party/curl/tests/test1165.pl
 create mode 100644 third-party/curl/tests/test1167.pl
 create mode 100644 third-party/curl/tests/test1173.pl
 create mode 100644 third-party/curl/tests/test1175.pl
 create mode 100644 third-party/curl/tests/test1177.pl
 create mode 100644 third-party/curl/tests/test1222.pl
 create mode 100644 third-party/curl/tests/test1275.pl
 create mode 100644 third-party/curl/tests/test1276.pl
 create mode 100644 third-party/curl/tests/test1477.pl
 create mode 100644 third-party/curl/tests/test1486.pl
 create mode 100644 third-party/curl/tests/test1488.pl
 create mode 100644 third-party/curl/tests/test1544.pl
 create mode 100644 third-party/curl/tests/test1707.pl
 create mode 100644 third-party/curl/tests/test745.pl
 create mode 100644 third-party/curl/tests/test971.pl
 delete mode 100644 third-party/curl/tests/testcurl.1
 create mode 100644 third-party/curl/tests/tunit/.gitignore
 create mode 100644 third-party/curl/tests/tunit/CMakeLists.txt
 create mode 100644 third-party/curl/tests/tunit/Makefile.am
 create mode 100644 third-party/curl/tests/tunit/Makefile.inc
 create mode 100644 third-party/curl/tests/tunit/README.md
 create mode 100644 third-party/curl/tests/tunit/tool1394.c
 create mode 100644 third-party/curl/tests/tunit/tool1604.c
 create mode 100644 third-party/curl/tests/tunit/tool1621.c
 create mode 100644 third-party/curl/tests/tunit/tool1622.c
 create mode 100644 third-party/curl/tests/tunit/tool1623.c
 create mode 100644 third-party/curl/tests/tunit/tool1720.c
 delete mode 100644 third-party/curl/tests/unit/curlcheck.h
 delete mode 100644 third-party/curl/tests/unit/unit1308.c
 delete mode 100644 third-party/curl/tests/unit/unit1394.c
 delete mode 100644 third-party/curl/tests/unit/unit1604.c
 create mode 100644 third-party/curl/tests/unit/unit1615.c
 create mode 100644 third-party/curl/tests/unit/unit1616.c
 delete mode 100644 third-party/curl/tests/unit/unit1621.c
 create mode 100644 third-party/curl/tests/unit/unit1625.c
 create mode 100644 third-party/curl/tests/unit/unit1626.c
 create mode 100644 third-party/curl/tests/unit/unit1627.c
 create mode 100644 third-party/curl/tests/unit/unit1636.c
 create mode 100644 third-party/curl/tests/unit/unit1656.c
 create mode 100644 third-party/curl/tests/unit/unit1657.c
 create mode 100644 third-party/curl/tests/unit/unit1658.c
 create mode 100644 third-party/curl/tests/unit/unit1663.c
 create mode 100644 third-party/curl/tests/unit/unit1664.c
 create mode 100644 third-party/curl/tests/unit/unit1666.c
 create mode 100644 third-party/curl/tests/unit/unit1667.c
 create mode 100644 third-party/curl/tests/unit/unit1668.c
 create mode 100644 third-party/curl/tests/unit/unit1669.c
 create mode 100644 third-party/curl/tests/unit/unit1674.c
 create mode 100644 third-party/curl/tests/unit/unit1675.c
 create mode 100644 third-party/curl/tests/unit/unit1676.c
 create mode 100644 third-party/curl/tests/unit/unit1979.c
 create mode 100644 third-party/curl/tests/unit/unit1980.c
 create mode 100644 third-party/curl/tests/unit/unit2413.c
 create mode 100644 third-party/curl/tests/unit/unit2604.c
 create mode 100644 third-party/curl/tests/unit/unit2605.c
 create mode 100644 third-party/curl/tests/unit/unit3205.c
 create mode 100644 third-party/curl/tests/unit/unit3211.c
 create mode 100644 third-party/curl/tests/unit/unit3212.c
 create mode 100644 third-party/curl/tests/unit/unit3213.c
 create mode 100644 third-party/curl/tests/unit/unit3214.c
 create mode 100644 third-party/curl/tests/unit/unit3216.c
 create mode 100644 third-party/curl/tests/unit/unit3219.c
 create mode 100644 third-party/curl/tests/unit/unit3300.c
 create mode 100644 third-party/curl/tests/unit/unit3301.c
 create mode 100644 third-party/curl/tests/unit/unit3302.c
 create mode 100644 third-party/curl/tests/unit/unit3303.c
 create mode 100644 third-party/curl/tests/unit/unit3304.c
 create mode 100644 third-party/curl/tests/unit/unit3400.c
 delete mode 100644 third-party/curl/tests/version-scan.pl
 delete mode 100644 third-party/curl/winbuild/.gitignore
 delete mode 100644 third-party/curl/winbuild/Makefile.vc
 delete mode 100644 third-party/curl/winbuild/MakefileBuild.vc
 delete mode 100644 third-party/curl/winbuild/README.md
 delete mode 100644 third-party/curl/winbuild/gen_resp_file.bat
 delete mode 100644 third-party/curl/winbuild/makedebug.cmd

diff --git a/.github/workflows/macos-build-arm.yaml b/.github/workflows/macos-build-arm.yaml
index 52d89308a7..8ffa196b76 100644
--- a/.github/workflows/macos-build-arm.yaml
+++ b/.github/workflows/macos-build-arm.yaml
@@ -29,10 +29,12 @@ jobs:
           HOMEBREW_NO_INSTALL_CLEANUP: 1
           HOMEBREW_NO_ANALYTICS: 1
         run: |
-          if ! brew install ninja nasm; then
+          if ! brew install ninja nasm openssl@3; then
             brew update
-            brew install ninja nasm
+            brew install ninja nasm openssl@3
           fi
+          # keg-only, so give CMake's FindOpenSSL an explicit hint
+          echo "OPENSSL_ROOT_DIR=$(brew --prefix openssl@3)" >> $GITHUB_ENV
 
       - name: Setup sccache
         uses: hendrikmuhs/ccache-action@v1.2.23
diff --git a/.github/workflows/macos-build.yaml b/.github/workflows/macos-build.yaml
index 99f51a7983..d66a378b35 100644
--- a/.github/workflows/macos-build.yaml
+++ b/.github/workflows/macos-build.yaml
@@ -39,10 +39,12 @@ jobs:
           HOMEBREW_NO_INSTALL_CLEANUP: 1
           HOMEBREW_NO_ANALYTICS: 1
         run: |
-          if ! brew install ninja nasm; then
+          if ! brew install ninja nasm openssl@3; then
             brew update
-            brew install ninja nasm
+            brew install ninja nasm openssl@3
           fi
+          # keg-only, so give CMake's FindOpenSSL an explicit hint
+          echo "OPENSSL_ROOT_DIR=$(brew --prefix openssl@3)" >> $GITHUB_ENV
 
       - name: Setup sccache
         uses: hendrikmuhs/ccache-action@v1.2.23
diff --git a/CMakeLists.txt b/CMakeLists.txt
index b66598562b..f6ddddf93a 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -26,10 +26,13 @@ else()
 endif()
 
 # For clangd
+# file(COPY), not configure_file(): configure_file registers its input as a
+# configure dependency, putting the ever-rewritten compile_commands.json into
+# the Ninja regen rule and causing an endless reconfigure loop.
 if (EXISTS "${CMAKE_CURRENT_BINARY_DIR}/compile_commands.json" )
-    configure_file(
+    file(COPY
         "${CMAKE_CURRENT_BINARY_DIR}/compile_commands.json"
-        "${PROJECT_SOURCE_DIR}/build/compile_commands.json")
+        DESTINATION "${PROJECT_SOURCE_DIR}/build")
 endif()
 
 # NOTE - for SDL, i think SDL3 regressed this - https://github.com/libsdl-org/SDL/pull/6455
@@ -213,18 +216,24 @@ set(CURL_USE_LIBSSH2 OFF)
 # but this is another part of libcurl we probably don't need (multi-threading/parallelism)
 set(CURL_USE_LIBPSL OFF)
 set(CURL_ZLIB OFF)
+# these default to AUTO since curl 8.10 and would silently pick up system libs
+set(CURL_BROTLI OFF)
+set(CURL_ZSTD OFF)
+# curl's BUILD_EXAMPLES cache option (default ON) would otherwise leak into
+# discord-rpc's identically named option and break its examples add_subdirectory
+set(BUILD_EXAMPLES OFF)
 # suddenly became enabled on macOS atleast, only needed for unicode URLs
 # wasn't being properly statically linked
 set(USE_LIBIDN2 OFF)
 if(WIN32)
     set(CURL_USE_SCHANNEL ON) # native Windows SSL support
-elseif(APPLE)
-    set(CURL_USE_SECTRANSP ON) # native macOS SSL support
 else()
+    # curl 8.15 removed the native macOS backend (CURL_USE_SECTRANSP), so macOS
+    # uses OpenSSL like linux (Homebrew openssl@3, see the macOS build workflows)
     if(STATICALLY_LINK)
         set(OPENSSL_USE_STATIC_LIBS TRUE)
     endif()
-    set(CURL_USE_OPENSSL ON) # not native, but seems to be the best choice for linux
+    set(CURL_USE_OPENSSL ON)
 endif()
 include_directories(third-party/curl/include)
 if(STATICALLY_LINK)
diff --git a/docs/setup/system/macos.md b/docs/setup/system/macos.md
index de3205e5de..36c42e41ce 100644
--- a/docs/setup/system/macos.md
+++ b/docs/setup/system/macos.md
@@ -17,7 +17,8 @@ softwareupdate --install-rosetta
 ## Building for x86_64
 
 ```bash
-brew install cmake nasm ninja go-task clang-format
+brew install cmake nasm ninja go-task clang-format openssl@3
+export OPENSSL_ROOT_DIR=$(brew --prefix openssl@3)
 cmake -B build --preset=Release-macos-x86_64-clang
 cmake --build build --parallel $((`sysctl -n hw.logicalcpu`))
 ```
@@ -25,7 +26,8 @@ cmake --build build --parallel $((`sysctl -n hw.logicalcpu`))
 ## Building for ARM64 (experimental, unsupported)
 
 ```bash
-brew install cmake ninja go-task clang-format
+brew install cmake ninja go-task clang-format openssl@3
+export OPENSSL_ROOT_DIR=$(brew --prefix openssl@3)
 cmake -B build --preset=Release-macos-arm64-clang
 cmake --build build --parallel $((`sysctl -n hw.logicalcpu`))
 ```
diff --git a/third-party/curl/.azure-pipelines.yml b/third-party/curl/.azure-pipelines.yml
deleted file mode 100644
index ec04019339..0000000000
--- a/third-party/curl/.azure-pipelines.yml
+++ /dev/null
@@ -1,315 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# https://dev.azure.com/daniel0244/curl/_build?view=runs
-#
-# Azure Pipelines configuration:
-# https://aka.ms/yaml
-
-trigger:
-  branches:
-    include:
-    - 'master'
-    - '*/ci'
-  paths:
-    exclude:
-    - '.circleci/*'
-    - '.cirrus.yml'
-    - '.github/*'
-    - '.github/workflows/*'
-    - 'appveyor.yml'
-    - 'packages/*'
-    - 'plan9/*'
-
-pr:
-  branches:
-    include:
-    - 'master'
-  paths:
-    exclude:
-    - '.circleci/*'
-    - '.cirrus.yml'
-    - '.github/*'
-    - '.github/workflows/*'
-    - 'appveyor.yml'
-    - 'packages/*'
-    - 'plan9/*'
-
-stages:
-
-##########################################
-### Linux jobs first
-##########################################
-
-- stage: linux
-  dependsOn: []
-  jobs:
-  - job: ubuntu
-    # define defaults to make sure variables are always expanded/replaced
-    variables:
-      install: ''
-      configure: ''
-      tests: '!433'
-    timeoutInMinutes: 60
-    pool:
-      vmImage: 'ubuntu-latest'
-    strategy:
-      matrix:
-        default:
-          name: default
-          install:
-          configure: --enable-debug --with-openssl
-        disable_ipv6:
-          name: w/o IPv6
-          configure: --disable-ipv6 --with-openssl
-        disable_http_smtp_imap:
-          name: w/o HTTP/SMTP/IMAP
-          configure: --disable-http --disable-smtp --disable-imap --without-ssl
-        disable_thredres:
-          name: sync resolver
-          configure: --disable-threaded-resolver --with-openssl
-        https_only:
-          name: HTTPS only
-          configure: --disable-dict --disable-file --disable-ftp --disable-gopher --disable-imap --disable-ldap --disable-pop3 --disable-rtmp --disable-rtsp --disable-scp --disable-sftp --disable-smb --disable-smtp --disable-telnet --disable-tftp --with-openssl
-        torture:
-          name: torture
-          install: libnghttp2-dev
-          configure: --enable-debug --disable-shared --disable-threaded-resolver --with-openssl
-          tests: -n -t --shallow=25 !FTP
-    steps:
-    - script: sudo apt-get update && sudo apt-get install -y stunnel4 python3-impacket libzstd-dev libbrotli-dev $(install)
-      displayName: 'apt install'
-      retryCountOnTaskFailure: 3
-
-    - script: autoreconf -fi && ./configure --enable-warnings --enable-werror $(configure)
-      displayName: 'configure $(name)'
-
-    - script: make V=1 && make V=1 examples && cd tests && make V=1
-      displayName: 'compile'
-      env:
-        MAKEFLAGS: "-j 2"
-
-    - script: make V=1 test-ci
-      displayName: 'test'
-      env:
-        AZURE_ACCESS_TOKEN: "$(System.AccessToken)"
-        TFLAGS: "-ac /usr/bin/curl -r $(tests)"
-
-- stage: distcheck
-  dependsOn: []
-  jobs:
-  - job: ubuntu
-    timeoutInMinutes: 30
-    pool:
-      vmImage: 'ubuntu-latest'
-    steps:
-    - script: autoreconf -fi && ./configure --without-ssl
-      displayName: 'configure $(name)'
-
-    - script: make && ./maketgz 99.98.97
-      displayName: 'make tarball'
-
-    - script: |
-        tar xf curl-99.98.97.tar.gz
-        cd curl-99.98.97
-        ./configure --prefix=$HOME/temp --without-ssl
-        make
-        make TFLAGS=1 test
-        make install
-        # basic check of the installed files
-        cd ..
-        bash scripts/installcheck.sh $HOME/temp
-        rm -rf curl-99.98.97
-
-      displayName: 'verify in-tree configure build'
-
-    - script: |
-        # verify out-of-tree build
-        tar xf curl-99.98.97.tar.gz
-        touch curl-99.98.97/docs/{cmdline-opts,libcurl}/Makefile.inc
-        mkdir build
-        cd build
-        ../curl-99.98.97/configure --without-ssl
-        make
-        make TFLAGS='-p 1 1139' test
-        # verify cmake build
-        cd ..
-        rm -rf curl-99.98.97
-
-      displayName: 'verify out-of-tree configure build'
-
-    - script: |
-        tar xf curl-99.98.97.tar.gz
-        cd curl-99.98.97
-        mkdir build
-        cd build
-        cmake ..
-        make
-
-      displayName: 'verify out-of-tree cmake build'
-
-- stage: scanbuild
-  dependsOn: []
-  jobs:
-  - job: ubuntu
-    timeoutInMinutes: 30
-    pool:
-      vmImage: 'ubuntu-latest'
-    steps:
-    - script: sudo apt-get update && sudo apt-get install -y clang-tools clang libssl-dev libssh2-1-dev libpsl-dev libbrotli-dev libzstd-dev
-      displayName: 'apt install'
-      retryCountOnTaskFailure: 3
-
-    - script: autoreconf -fi
-      displayName: 'autoreconf'
-
-    - script: scan-build ./configure --enable-debug --enable-werror --with-openssl --with-libssh2
-      displayName: 'configure'
-      env:
-        CC: "clang"
-        CCX: "clang++"
-
-    - script: scan-build --status-bugs make
-      displayName: 'make'
-
-    - script: scan-build --status-bugs make examples
-      displayName: 'make examples'
-
-##########################################
-### Windows jobs below
-##########################################
-
-- stage: windows
-  dependsOn: []
-  variables:
-    agent.preferPowerShellOnContainers: true
-  jobs:
-  - job: msys
-    # define defaults to make sure variables are always expanded/replaced
-    variables:
-      container_img: ''
-      container_cmd: ''
-      configure: ''
-      tests: ''
-    timeoutInMinutes: 120
-    pool:
-      vmImage: 'windows-2019'
-    strategy:
-      matrix:
-        v2_mingw32_openssl:
-          name: 32-bit OpenSSL/libssh2
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw32:ltsc2019
-          container_cmd: C:\msys64\usr\bin\sh
-          prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-i686-libssh2 mingw-w64-i686-python-pip mingw-w64-i686-python-wheel mingw-w64-i686-python-pyopenssl && python3 -m pip install --prefer-binary impacket
-          configure: --host=i686-w64-mingw32 --build=i686-w64-mingw32 --prefix=/mingw32 --enable-debug --enable-werror --with-libssh2 --with-openssl
-          tests: "~571"
-        v2_mingw64_openssl:
-          name: 64-bit OpenSSL/libssh2
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw64:ltsc2019
-          container_cmd: C:\msys64\usr\bin\sh
-          prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-x86_64-libssh2 mingw-w64-x86_64-python-pip mingw-w64-x86_64-python-wheel mingw-w64-x86_64-python-pyopenssl && python3 -m pip install --prefer-binary impacket
-          configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64 --enable-debug --enable-werror --with-libssh2 --with-openssl
-          tests: "~571"
-        v2_mingw64_libssh:
-          name: 64-bit OpenSSL/libssh
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw64:ltsc2019
-          container_cmd: C:\msys64\usr\bin\sh
-          prepare: pacman -S --needed --noconfirm --noprogressbar libssh-devel mingw-w64-x86_64-libssh
-          configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64 --enable-debug --enable-werror --with-libssh --with-openssl
-          tests: "~571 ~614"
-        v1_mingw:
-          name: 32-bit (legacy)
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys1-mingw:ltsc2019
-          container_cmd: C:\MinGW\msys\1.0\bin\sh
-          configure: --host=i686-pc-mingw32 --build=i686-pc-mingw32 --prefix=/mingw --enable-debug --without-ssl --with-mingw1-deprecated
-          tests: "!203 !1143"
-        v1_mingw32:
-          name: 32-bit w/o zlib
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys1-mingw32:ltsc2019
-          container_cmd: C:\MinGW\msys\1.0\bin\sh
-          configure: --host=i686-w64-mingw32 --build=i686-w64-mingw32 --prefix=/mingw32 --enable-debug --enable-werror --without-zlib --without-ssl
-          tests: "!203 !1143"
-        v1_mingw64:
-          name: 64-bit w/o zlib
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys1-mingw64:ltsc2019
-          container_cmd: C:\MinGW\msys\1.0\bin\sh
-          configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64 --enable-debug --enable-werror --without-zlib --without-ssl
-          tests: "!203 !1143"
-        v2_mingw32_schannel:
-          name: 32-bit Schannel/SSPI/WinIDN/libssh2
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw32:ltsc2019
-          container_cmd: C:\msys64\usr\bin\sh
-          prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-i686-libssh2 mingw-w64-i686-python-pip mingw-w64-i686-python-wheel mingw-w64-i686-python-pyopenssl && python3 -m pip install --prefer-binary impacket
-          configure: --host=i686-w64-mingw32 --build=i686-w64-mingw32 --prefix=/mingw32 --enable-debug --enable-werror --enable-sspi --with-schannel --with-winidn --with-libssh2
-          tests: "~571"
-        v2_mingw64_schannel:
-          name: 64-bit Schannel/SSPI/WinIDN/libssh2
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw64:ltsc2019
-          container_cmd: C:\msys64\usr\bin\sh
-          prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-x86_64-libssh2 mingw-w64-x86_64-python-pip mingw-w64-x86_64-python-wheel mingw-w64-x86_64-python-pyopenssl && python3 -m pip install --prefer-binary impacket
-          configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64 --enable-debug --enable-werror --enable-sspi --with-schannel --with-winidn --with-libssh2
-          tests: "~571"
-        v1_mingw_schannel:
-          name: 32-bit Schannel/SSPI/WinIDN (legacy)
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys1-mingw:ltsc2019
-          container_cmd: C:\MinGW\msys\1.0\bin\sh
-          configure: --host=i686-pc-mingw32 --build=i686-pc-mingw32 --prefix=/mingw --enable-debug --enable-sspi --with-schannel --with-winidn --with-mingw1-deprecated
-          tests: "!203 !305 !311 !312 !313 !404 !1143 !2033 !2035 !2038 !2041 !2042 !2048 !2070 !2079 !2087 !3023 !3024"
-        v1_mingw32_schannel:
-          name: 32-bit Schannel/SSPI/WinIDN w/o zlib
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys1-mingw32:ltsc2019
-          container_cmd: C:\MinGW\msys\1.0\bin\sh
-          configure: --host=i686-w64-mingw32 --build=i686-w64-mingw32 --prefix=/mingw32 --enable-debug --enable-werror --enable-sspi --with-schannel --with-winidn --without-zlib
-          tests: "!203 !1143"
-        v1_mingw64_schannel:
-          name: 64-bit Schannel/SSPI/WinIDN w/o zlib
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys1-mingw64:ltsc2019
-          container_cmd: C:\MinGW\msys\1.0\bin\sh
-          configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64  --enable-debug --enable-werror --enable-sspi --with-schannel --with-winidn --without-zlib
-          tests: "!203 !1143"
-    container:
-      image: $(container_img)
-      env:
-        MSYS2_PATH_TYPE: inherit
-    steps:
-    - script: $(container_cmd) -l -c "cd $(echo '%cd%') && $(prepare)"
-      displayName: 'prepare'
-      condition: variables.prepare
-      retryCountOnTaskFailure: 3
-
-    - script: $(container_cmd) -l -c "cd $(echo '%cd%') && autoreconf -fi && ./configure $(configure)"
-      displayName: 'configure $(name)'
-
-    - script: $(container_cmd) -l -c "cd $(echo '%cd%') && make V=1 && make V=1 examples && cd tests && make V=1"
-      displayName: 'compile'
-      env:
-        MAKEFLAGS: "-j 2"
-
-    - script: $(container_cmd) -l -c "cd $(echo '%cd%') && make V=1 install && PATH=/usr/bin:/bin find . -type f -path '*/.libs/*.exe' -print -execdir mv -t .. {} \;"
-      displayName: 'install'
-
-    - script: $(container_cmd) -l -c "cd $(echo '%cd%') && make V=1 test-ci"
-      displayName: 'test'
-      env:
-        AZURE_ACCESS_TOKEN: "$(System.AccessToken)"
-        TFLAGS: "-ac /usr/bin/curl.exe !IDN !SCP ~612 ~1056 $(tests)"
diff --git a/third-party/curl/.circleci/config.yml b/third-party/curl/.circleci/config.yml
index 11bb0ef7b2..30eec16e5a 100644
--- a/third-party/curl/.circleci/config.yml
+++ b/third-party/curl/.circleci/config.yml
@@ -24,115 +24,10 @@
 
 # View these jobs in the browser: https://app.circleci.com/pipelines/github/curl/curl
 
-# Use the latest 2.1 version of CircleCI pipeline process engine. See: https://circleci.com/docs/2.0/configuration-reference
+# Use the latest 2.1 version of CircleCI pipeline process engine. See: https://circleci.com/docs/configuration-reference/
 version: 2.1
 
 commands:
-  configure:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-werror --with-openssl
-
-  configure-openssl-no-verbose:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --disable-verbose --enable-werror --with-openssl
-
-  configure-no-proxy:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --disable-proxy --enable-werror --with-openssl
-
-  configure-macos-normal:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --without-ssl CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
-  configure-macos-debug:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --without-ssl --enable-debug CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
-  configure-macos-libssh2:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --without-ssl --with-libssh2=/opt/homebrew/opt/libssh2 --enable-debug CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
-  configure-macos-libssh-c-ares:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --with-openssl --with-libssh --enable-ares --enable-debug PKG_CONFIG_PATH="$(brew --prefix openssl)/lib/pkgconfig" CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
-  configure-macos-libssh:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --with-openssl --with-libssh --enable-debug PKG_CONFIG_PATH="$(brew --prefix openssl)/lib/pkgconfig" CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
-  configure-macos-c-ares:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --without-ssl --enable-ares --enable-debug CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
-  configure-macos-http-only:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-maintainer-mode --disable-dict --disable-file --disable-ftp --disable-gopher --disable-imap --disable-ldap --disable-pop3 --disable-rtmp --disable-rtsp --disable-scp --disable-sftp --disable-smb --disable-smtp --disable-telnet --disable-tftp --disable-unix-sockets --disable-shared --without-brotli --without-gssapi --without-libidn2 --without-libpsl --without-librtmp --without-libssh2 --without-nghttp2 --without-ntlm-auth --without-ssl --without-zlib --enable-debug CFLAGS='-Wno-vla -mmacosx-version-min=10.15'
-
-  configure-macos-securetransport-http2:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --with-secure-transport CFLAGS='-Wno-vla -mmacosx-version-min=10.8'
-
-  configure-macos-openssl-http2:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --with-openssl --enable-debug PKG_CONFIG_PATH="$(brew --prefix openssl)/lib/pkgconfig" CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
-  configure-macos-libressl-http2:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --with-openssl --enable-debug PKG_CONFIG_PATH="$(brew --prefix libressl)/lib/pkgconfig" CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
-  configure-macos-torture:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --disable-shared --disable-threaded-resolver --with-openssl --enable-debug PKG_CONFIG_PATH="$(brew --prefix openssl)/lib/pkgconfig" CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
-  configure-macos-torture-ftp:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --disable-shared --disable-threaded-resolver --with-openssl --enable-debug PKG_CONFIG_PATH="$(brew --prefix openssl)/lib/pkgconfig" CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
   install-cares:
     steps:
       - run:
@@ -143,6 +38,7 @@ commands:
     steps:
       - run:
           command: |
+            export DEBIAN_FRONTEND=noninteractive
             sudo apt-get update && sudo apt-get install -y libssh-dev
 
   install-deps:
@@ -150,127 +46,86 @@ commands:
       - run:
           command: |
             sudo apt-get update && sudo apt-get install -y libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev python3-pip
-            sudo python3 -m pip install impacket
+            python3 -m venv ~/venv
+            ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/requirements.txt
 
-  install-deps-brew:
+  configure:
     steps:
       - run:
           command: |
-            # Drop libressl as long as we're not trying to build it
-            echo libtool autoconf automake pkg-config nghttp2 libssh2 openssl libssh c-ares | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
-            while [ $? -eq 0 ]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done
-            sudo python3 -m pip install impacket
+            autoreconf -fi
+            ./configure --disable-dependency-tracking --enable-option-checking=fatal --enable-unity --enable-werror --enable-warnings \
+              --with-openssl \
+              || { tail -1000 config.log; false; }
+
+  configure-no-proxy:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --disable-dependency-tracking --enable-option-checking=fatal --enable-unity --enable-werror \
+              --with-openssl --disable-proxy \
+              || { tail -1000 config.log; false; }
 
   configure-libssh:
     steps:
       - run:
           command: |
             autoreconf -fi
-            ./configure --enable-warnings --enable-werror --with-openssl --with-libssh
-
-  install-wolfssl:
-    steps:
-      - run:
-          command: |
-            WOLFSSL_VER=5.6.0
-            curl -LOsSf --retry 6 --retry-connrefused --max-time 999 https://github.com/wolfSSL/wolfssl/archive/v$WOLFSSL_VER-stable.tar.gz
-            tar -xzf v$WOLFSSL_VER-stable.tar.gz
-            cd wolfssl-$WOLFSSL_VER-stable
-            ./autogen.sh
-            ./configure --enable-tls13 --enable-all --enable-harden --prefix=$HOME/wssl
-            make install
-
-  install-wolfssh:
-    steps:
-      - run:
-          command: |
-            WOLFSSH_VER=1.4.12
-            curl -LOsSf --retry 6 --retry-connrefused --max-time 999 https://github.com/wolfSSL/wolfssh/archive/v$WOLFSSH_VER-stable.tar.gz
-            tar -xzf v$WOLFSSH_VER-stable.tar.gz
-            cd wolfssh-$WOLFSSH_VER-stable
-            ./autogen.sh
-            ./configure --with-wolfssl=$HOME/wssl --prefix=$HOME/wssh --enable-scp --enable-sftp --disable-examples
-            make install
+            ./configure --disable-dependency-tracking --enable-option-checking=fatal --enable-unity --enable-werror --enable-warnings \
+              --with-openssl --with-libssh \
+              || { tail -1000 config.log; false; }
 
   configure-cares:
     steps:
       - run:
           command: |
             autoreconf -fi
-            ./configure --enable-warnings --enable-werror --with-openssl --enable-ares
-
-  configure-wolfssh:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            LDFLAGS="-Wl,-rpath,$HOME/wssh/lib" ./configure --enable-warnings --enable-werror --with-wolfssl=$HOME/wssl --with-wolfssh=$HOME/wssh
+            ./configure --disable-dependency-tracking --enable-option-checking=fatal --enable-unity --enable-werror --enable-warnings \
+              --with-openssl --enable-ares \
+              || { tail -1000 config.log; false; }
 
   configure-cares-debug:
     steps:
       - run:
           command: |
             autoreconf -fi
-            ./configure --enable-debug --enable-werror --with-openssl --enable-ares
+            ./configure --disable-dependency-tracking --enable-option-checking=fatal --enable-unity --enable-werror --enable-debug \
+              --with-openssl --enable-ares \
+              || { tail -1000 config.log; false; }
 
   build:
     steps:
       - run: make -j3 V=1
+      - run: src/curl --disable --version
       - run: make -j3 V=1 examples
 
-  build-macos:
-    steps:
-      - run: make -j7 V=1
-      - run: make -j7 V=1 examples
-
   test:
     steps:
-      - run: make -j3 V=1 test-ci
-
-  test-macos:
-    steps:
-      - run: make -j7 V=1 test-ci
-
-  test-torture:
-    steps:
-      - run: make -j5 V=1 test-ci TFLAGS="-n -t --shallow=25 !FTP"
-
-  test-torture-ftp:
-    steps:
-      - run: make -j5 V=1 test-ci TFLAGS="-n -t --shallow=20 FTP"
+      - run:
+          command: |
+            source ~/venv/bin/activate
+            # Revert a CircleCI-specific local setting that makes test 1459
+            # return 67 (CURLE_LOGIN_DENIED) instead of the
+            # expected 60 (CURLE_PEER_FAILED_VERIFICATION).
+            echo 'StrictHostKeyChecking yes' >> ~/.ssh/config
+            make -j3 V=1 test-ci TFLAGS='-j14'
 
 executors:
   ubuntu:
     machine:
-      image: ubuntu-2004:202010-01
+      image: ubuntu-2204:2025.09.1
 
 jobs:
   basic:
     executor: ubuntu
     steps:
       - checkout
+      - install-deps
       - configure
       - build
       - test
 
-  no-verbose:
-    executor: ubuntu
-    steps:
-      - checkout
-      - install-deps
-      - configure-openssl-no-verbose
-      - build
-
-  wolfssh:
-    executor: ubuntu
-    steps:
-      - checkout
-      - install-deps
-      - install-wolfssl
-      - install-wolfssh
-      - configure-wolfssh
-      - build
-
   no-proxy:
     executor: ubuntu
     steps:
@@ -284,6 +139,7 @@ jobs:
     executor: ubuntu
     steps:
       - checkout
+      - install-deps
       - install-cares
       - configure-cares
       - build
@@ -293,6 +149,7 @@ jobs:
     executor: ubuntu
     steps:
       - checkout
+      - install-deps
       - install-libssh
       - configure-libssh
       - build
@@ -300,162 +157,27 @@ jobs:
 
   arm:
     machine:
-      image: ubuntu-2004:202101-01
+      image: ubuntu-2204:2025.09.1
     resource_class: arm.medium
     steps:
       - checkout
+      - install-deps
       - configure
       - build
       - test
 
   arm-cares:
     machine:
-      image: ubuntu-2004:202101-01
+      image: ubuntu-2204:2025.09.1
     resource_class: arm.medium
     steps:
       - checkout
+      - install-deps
       - install-cares
       - configure-cares-debug
       - build
       - test
 
-  # TODO: All builds with "macos.x86.medium.gen2" must be changed to
-  # "macos.m1.medium.gen1" in January 2024 because the former will be removed
-  # (the names should also be changed from macos-x86-* to macos-arm-*).  We
-  # want the M1 (ARM) machines anyway, for platform diversity.
-  # See https://circleci.com/docs/configuration-reference/#macos-execution-environment
-  macos-x86-normal:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-normal
-      - build-macos
-      - test-macos
-
-  macos-x86-debug:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-debug
-      - build-macos
-      - test-macos
-
-  macos-x86-libssh2:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-libssh2
-      - build-macos
-      - test-macos
-
-  macos-x86-libssh-c-ares:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-libssh-c-ares
-      - build-macos
-      - test-macos
-
-  macos-x86-libssh:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-libssh
-      - build-macos
-      - test-macos
-
-  macos-x86-c-ares:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-c-ares
-      - build-macos
-      - test-macos
-
-  macos-x86-http-only:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-http-only
-      - build-macos
-      - test-macos
-
-  macos-x86-http-securetransport-http2:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-securetransport-http2
-      - build-macos
-      - test-macos
-
-  macos-x86-http-openssl-http2:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-openssl-http2
-      - build-macos
-      - test-macos
-
-  macos-x86-http-libressl-http2:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-libressl-http2
-      - build-macos
-      - test-macos
-
-  macos-x86-http-torture:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-torture
-      - build-macos
-      - test-torture
-
-  macos-x86-http-torture-ftp:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-torture-ftp
-      - build-macos
-      - test-torture-ftp
-
 workflows:
   x86-openssl:
     jobs:
@@ -473,14 +195,6 @@ workflows:
     jobs:
       - no-proxy
 
-  openssl-no-verbose:
-    jobs:
-      - no-verbose
-
-  wolfssl-wolfssh:
-    jobs:
-      - wolfssh
-
   arm-openssl:
     jobs:
       - arm
@@ -488,53 +202,3 @@ workflows:
   arm-openssl-c-ares:
     jobs:
       - arm-cares
-
-  macos-x86-normal:
-    jobs:
-      - macos-x86-normal
-
-  macos-x86-debug:
-    jobs:
-      - macos-x86-debug
-
-  macos-x86-libssh2:
-    jobs:
-      - macos-x86-libssh2
-
-  macos-x86-libssh-c-ares:
-    jobs:
-      - macos-x86-libssh-c-ares
-
-  macos-x86-libssh:
-    jobs:
-      - macos-x86-libssh
-
-  macos-x86-c-ares:
-    jobs:
-      - macos-x86-c-ares
-
-  macos-x86-http-only:
-    jobs:
-      - macos-x86-http-only
-
-  macos-x86-http-securetransport-http2:
-    jobs:
-      - macos-x86-http-securetransport-http2
-
-  macos-x86-http-openssl-http2:
-    jobs:
-      - macos-x86-http-openssl-http2
-
-  # There are problem linking with LibreSSL on the CI boxes that prevent this
-  # from working.
-  #macos-x86-http-libressl-http2:
-  #  jobs:
-  #    - macos-x86-http-libressl-http2
-
-  macos-x86-http-torture:
-    jobs:
-      - macos-x86-http-torture
-
-  macos-x86-http-torture-ftp:
-    jobs:
-      - macos-x86-http-torture-ftp
diff --git a/third-party/curl/.cirrus.yml b/third-party/curl/.cirrus.yml
deleted file mode 100644
index 26aa20e526..0000000000
--- a/third-party/curl/.cirrus.yml
+++ /dev/null
@@ -1,85 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# https://cirrus-ci.com/github/curl/curl
-#
-# Cirrus CI configuration:
-# https://cirrus-ci.org/guide/writing-tasks/
-
-freebsd_task:
-  skip: "changesIncludeOnly(
-    '**/CMakeLists.txt',
-    '.azure-pipelines.yml',
-    '.circleci/**',
-    '.github/**',
-    'appveyor.yml',
-    'CMake/**',
-    'packages/**',
-    'plan9/**',
-    'projects/**',
-    'winbuild/**'
-    )"
-
-  name: FreeBSD
-
-  matrix:
-    - name: FreeBSD 13.2
-      freebsd_instance:
-        image_family: freebsd-13-2
-
-  env:
-    CIRRUS_CLONE_DEPTH: 10
-    CRYPTOGRAPHY_DONT_BUILD_RUST: 1
-    MAKEFLAGS: -j 3
-
-  pkginstall_script:
-    - pkg update -f
-    - pkg install -y autoconf automake libtool pkgconf brotli openldap24-client heimdal libpsl libssh2 openssh-portable libidn2 librtmp libnghttp2 nghttp2 stunnel py39-openssl py39-impacket py39-cryptography
-    - pkg delete -y curl
-  configure_script:
-    - autoreconf -fi
-    # Building with the address sanitizer is causing unexplainable test issues due to timeouts
-    #- case `uname -r` in
-    #    12.2*)
-    #    export CC=clang;
-    #    export CFLAGS="-fsanitize=address,undefined,signed-integer-overflow -fno-sanitize-recover=undefined,integer -Wformat -Werror=format-security -Werror=array-bounds -g";
-    #    export CXXFLAGS="-fsanitize=address,undefined -fno-sanitize-recover=undefined,integer -Wformat -Werror=format-security -Werror=array-bounds -g";
-    #    export LDFLAGS="-fsanitize=address,undefined -fno-sanitize-recover=undefined,integer" ;;
-    #  esac
-    - ./configure --prefix="${HOME}"/install --enable-debug --with-openssl --with-libssh2 --with-brotli --with-gssapi --with-libidn2 --enable-manual --enable-ldap --enable-ldaps --with-librtmp --with-libpsl --with-nghttp2 || { tail -300 config.log; false; }
-  compile_script:
-    - make V=1 && make V=1 examples && cd tests && make V=1
-  test_script:
-    # blackhole?
-    - sysctl net.inet.tcp.blackhole
-    # make sure we don't run blackhole != 0
-    - sudo sysctl net.inet.tcp.blackhole=0
-    # Some tests won't run if run as root so run them as another user.
-    # Make directories world writable so the test step can write wherever it needs.
-    - find . -type d -exec chmod 777 {} \;
-    # The OpenSSH server instance for the testsuite cannot be started on FreeBSD,
-    # therefore the SFTP and SCP tests are disabled right away from the beginning.
-    #
-    - sudo -u nobody make V=1 TFLAGS="-n !SFTP !SCP" test-ci
-  install_script:
-    - make V=1 install
diff --git a/third-party/curl/.clang-tidy.yml b/third-party/curl/.clang-tidy.yml
new file mode 100644
index 0000000000..5f523fb50b
--- /dev/null
+++ b/third-party/curl/.clang-tidy.yml
@@ -0,0 +1,59 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+---
+# https://clang.llvm.org/extra/clang-tidy/
+
+# https://clang.llvm.org/extra/clang-tidy/checks/list.html
+Checks:
+  - clang-analyzer-*
+  - -clang-analyzer-optin.performance.Padding
+  - -clang-analyzer-security.ArrayBound  # due to false positives with clang-tidy v21.1.0+
+  - -clang-analyzer-security.insecureAPI.bzero  # for FD_ZERO() (seen on macOS)
+  - -clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling
+  - -clang-diagnostic-nullability-extension
+  - bugprone-assert-side-effect
+  - bugprone-assignment-in-if-condition
+  - bugprone-chained-comparison
+  - bugprone-dynamic-static-initializers
+  - bugprone-invalid-enum-default-initialization
+  - bugprone-macro-parentheses
+  - bugprone-macro-repeated-side-effects
+  - bugprone-misplaced-operator-in-strlen-in-alloc
+  - bugprone-misplaced-pointer-arithmetic-in-alloc
+  - bugprone-not-null-terminated-result
+  - bugprone-posix-return
+  - bugprone-redundant-branch-condition
+  - bugprone-signed-char-misuse
+  - bugprone-sizeof-expression
+  - bugprone-suspicious-enum-usage
+  - bugprone-suspicious-memset-usage
+  - bugprone-suspicious-missing-comma
+  - bugprone-suspicious-realloc-usage
+  - bugprone-suspicious-semicolon
+  # bugprone-unchecked-string-to-number-conversion  # needs converting sscanf to strtol or curlx_str_*
+  - misc-const-correctness
+  - misc-header-include-cycle
+  # misc-redundant-expression  # undesired hits due to system macros, e.g. due to POLLIN == POLLRDNORM | POLLRDBAND, then or-ing all three
+  - portability-*
+  - readability-duplicate-include
+  # readability-else-after-return
+  # readability-enum-initial-value
+  # readability-function-cognitive-complexity
+  - readability-inconsistent-declaration-parameter-name
+  # readability-misleading-indentation  # too many false positives and oddball/conditional source
+  - readability-named-parameter
+  # readability-redundant-casting  # false positives in types that change from platform to platform, even with IgnoreTypeAliases: true
+  - readability-redundant-control-flow
+  - readability-redundant-declaration
+  - readability-redundant-function-ptr-dereference
+  - readability-redundant-parentheses
+  - readability-redundant-preprocessor
+  - readability-suspicious-call-argument
+  - readability-uppercase-literal-suffix
+
+CheckOptions:
+  misc-header-include-cycle.IgnoredFilesList: 'curl/curl.h'
+  readability-inconsistent-declaration-parameter-name.Strict: true
+
+HeaderFilterRegex: '.*'  # Default in v22.1.0+
diff --git a/third-party/curl/.dcignore b/third-party/curl/.dcignore
deleted file mode 100644
index e33af3ecc8..0000000000
--- a/third-party/curl/.dcignore
+++ /dev/null
@@ -1,7 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-tests/**
-docs/**
-docs/examples/**
diff --git a/third-party/curl/.editorconfig b/third-party/curl/.editorconfig
new file mode 100644
index 0000000000..edcc4629fb
--- /dev/null
+++ b/third-party/curl/.editorconfig
@@ -0,0 +1,18 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+root = true
+
+[*]
+charset = utf-8
+insert_final_newline = true
+indent_style = space
+trim_trailing_whitespace = true
+
+[*.{c,h}]
+indent_size = 2
+max_line_length = 79
+
+[*.{pl,pm}]
+indent_size = 4
diff --git a/third-party/curl/.gitattributes b/third-party/curl/.gitattributes
index 481fd5cff6..fc4480fb72 100644
--- a/third-party/curl/.gitattributes
+++ b/third-party/curl/.gitattributes
@@ -2,8 +2,6 @@
 #
 # SPDX-License-Identifier: curl
 
-*.dsw -crlf
-buildconf eol=lf
 configure.ac eol=lf
 *.m4 eol=lf
 *.in eol=lf
@@ -11,8 +9,6 @@ configure.ac eol=lf
 *.sh eol=lf
 *.[ch] whitespace=tab-in-indent
 
-# Batch files (bat,btm,cmd) must be run with CRLF line endings.
+# Batch files must be run with CRLF line endings.
 # Refer to https://github.com/curl/curl/pull/6442
 *.bat text eol=crlf
-*.btm text eol=crlf
-*.cmd text eol=crlf
diff --git a/third-party/curl/.github/CONTRIBUTING.md b/third-party/curl/.github/CONTRIBUTING.md
index 18be9ed224..6121de5b8b 100644
--- a/third-party/curl/.github/CONTRIBUTING.md
+++ b/third-party/curl/.github/CONTRIBUTING.md
@@ -4,26 +4,19 @@ Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
 SPDX-License-Identifier: curl
 -->
 
-How to contribute to curl
-=========================
+# How to contribute to curl
 
-Join the community
-------------------
+## Join the community
 
- 1. Click 'watch' on the GitHub repo
+1. Click 'watch' on the GitHub repo
+2. Subscribe to the suitable [mailing lists](https://curl.se/mail/)
 
- 2. Subscribe to the suitable [mailing lists](https://curl.se/mail/)
+## Read [CONTRIBUTE](/docs/CONTRIBUTE.md)
 
-Read [CONTRIBUTE](../docs/CONTRIBUTE.md)
----------------------------------------
+## Send your suggestions using one of these methods:
 
-Send your suggestions using one of these methods:
--------------------------------------------------
+1. in a mail to the mailing list
+2. as a [pull request](https://github.com/curl/curl/pulls)
+3. as an [issue](https://github.com/curl/curl/issues)
 
- 1. in a mail to the mailing list
-
- 2. as a [pull request](https://github.com/curl/curl/pulls)
-
- 3. as an [issue](https://github.com/curl/curl/issues)
-
-/ The curl team!
+/ The curl team
diff --git a/third-party/curl/.github/ISSUE_TEMPLATE/bug_report.yml b/third-party/curl/.github/ISSUE_TEMPLATE/bug_report.yml
index e74ac08175..52011a6f19 100644
--- a/third-party/curl/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/third-party/curl/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -2,8 +2,8 @@
 #
 # SPDX-License-Identifier: curl
 
-name: Bug Report
-description: Create a report to help us improve
+name: Bug Report on code
+description: Tell us about your problem with curl or libcurl
 
 body:
   - type: markdown
@@ -13,12 +13,18 @@ body:
 
         Only file bugs here! Ask questions on the mailing lists https://curl.se/mail/
 
-        **SECURITY RELATED?** Post it here: https://hackerone.com/curl
+        **SECURITY RELATED?** Submit here: https://hackerone.com/curl
 
-        There are collections of known issues to be aware of:
+  - type: markdown
+    attributes:
+      value: "
+        > [!IMPORTANT]
 
-        - https://curl.se/docs/knownbugs.html
-        - https://curl.se/docs/todo.html
+        > If you cannot understand or explain your work without using
+        Artificial Intelligence (AI) then do not file here. Do not paste
+        massive AI generated explanations. We accept the use of AI as long as
+        it is digestible. Please explain your issues or improvements briefly
+        and clearly in your own human voice."
 
   - type: textarea
     id: reproducer
@@ -40,7 +46,7 @@ body:
       label: curl/libcurl version
       description: |
         Please paste the output of `curl -V` here.
-      placeholder: 'curl 8.2.0'
+      placeholder: 'curl 8.18.0'
     validations:
       required: true
 
diff --git a/third-party/curl/.github/ISSUE_TEMPLATE/config.yml b/third-party/curl/.github/ISSUE_TEMPLATE/config.yml
index 9ca2c8fd11..bce618da79 100644
--- a/third-party/curl/.github/ISSUE_TEMPLATE/config.yml
+++ b/third-party/curl/.github/ISSUE_TEMPLATE/config.yml
@@ -4,12 +4,15 @@
 
 blank_issues_enabled: false
 contact_links:
+  - name: Ask a question (without email)
+    url: https://github.com/curl/curl/discussions
+    about: Use the Discussion forum here on GitHub
+  - name: Ask a question (using email)
+    url: https://curl.se/mail/
+    about: Send question to the suitable mailing list
+  - name: Commercial support
+    url: https://curl.se/support.html
+    about: Pay for fast quality support for and help with curl/libcurl
   - name: Feature request
     url: https://curl.se/mail/
     about: To propose new features or enhancements, please bring that discussion to a suitable curl mailing list.
-  - name: Question
-    url: https://curl.se/mail/
-    about: Questions should go to the mailing list
-  - name: Commercial support
-    url: https://curl.se/support.html
-    about: Several companies are offering paid support for curl/libcurl
diff --git a/third-party/curl/.github/ISSUE_TEMPLATE/docs.yml b/third-party/curl/.github/ISSUE_TEMPLATE/docs.yml
new file mode 100644
index 0000000000..d0c3852183
--- /dev/null
+++ b/third-party/curl/.github/ISSUE_TEMPLATE/docs.yml
@@ -0,0 +1,43 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: Bug Report on documentation
+description: Problems, errors, mistakes or typos in documentation.
+labels: documentation
+
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to fill out this bug report!
+
+        Only file documentation bugs here! Ask questions on the mailing lists https://curl.se/mail/
+
+  - type: markdown
+    attributes:
+      value: "
+        > [!IMPORTANT]
+
+        > If you cannot understand or explain your work without using
+        Artificial Intelligence (AI) then do not file here. Do not paste
+        massive AI generated explanations. We accept the use of AI as long as
+        it is digestible. Please explain your issues or improvements briefly
+        and clearly in your own human voice."
+
+  - type: textarea
+    id: source
+    attributes:
+      label: Specify which documentation you found a problem with
+      description: |
+        Include function name, URL, tarball version and all other relevant
+        details that identify the documentation source.
+    validations:
+      required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+    validations:
+      required: true
diff --git a/third-party/curl/.github/dependabot.yml b/third-party/curl/.github/dependabot.yml
new file mode 100644
index 0000000000..c68d6301ef
--- /dev/null
+++ b/third-party/curl/.github/dependabot.yml
@@ -0,0 +1,38 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+# https://docs.github.com/code-security/dependabot/working-with-dependabot/dependabot-options-reference
+
+version: 2
+updates:
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'monthly'
+    cooldown:
+      default-days: 7
+    groups:
+      gha-dependencies:
+        patterns:
+          - '*'
+    commit-message:
+      prefix: 'GHA:'
+
+  - package-ecosystem: 'pip'
+    directories:
+      - '.github/scripts'
+      - 'tests'
+    schedule:
+      interval: 'monthly'
+    cooldown:
+      default-days: 7
+      semver-major-days: 15
+      semver-minor-days: 7
+      semver-patch-days: 3
+    groups:
+      pip-dependencies:
+        patterns:
+          - '*'
+    commit-message:
+      prefix: 'GHA:'
diff --git a/third-party/curl/.github/labeler.yml b/third-party/curl/.github/labeler.yml
index 83f9e7d68a..f7adaba865 100644
--- a/third-party/curl/.github/labeler.yml
+++ b/third-party/curl/.github/labeler.yml
@@ -7,297 +7,563 @@
 # triaging, but is intended to add labels to the easy cases. If the matching
 # language becomes more powerful, more cases should be able to be handled.
 #
-# The biggest low-hanging problem is this:
-# It looks like there's no way of specifying that a label be added if *all* the
-# files match *any* one of a number of globs. This feature request is tracked
-# in https://github.com/actions/labeler/issues/423
+# Labels are added in two ways: the any-glob-to-all-files ones are added if all
+# the files fit into the category, and the any-glob-to-any-file ones are added
+# as long as any file matches. The first ones are for "major" categories (the
+# PR is all about that one topic, like HTTP/3), while the second ones are
+# "addendums" that give useful information about a PR that is really mostly
+# something else (e.g. CI if the PR also touches CI jobs).
+#
+# N.B. any-glob-to-all-files is misnamed; it acts like one-glob-to-all-files.
+# Therefore, to get any-glob-to-all-files semantics with multiple matching
+# patterns, they must be joined with commas to a single string surrounded by
+# braces. For example: '{lib/**,src/**}'.
+#
+# See https://github.com/actions/labeler/ for documentation on this file.
+---
+
+appleOS:
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              .github/workflows/macos.yml,\
+              lib/config-mac.h,\
+              lib/macos*,\
+              lib/vtls/apple.*,\
+              m4/curl-apple-sectrust.m4\
+              }"
 
 authentication:
-- all: ['docs/mk-ca-bundle.1']
-- all: ['docs/libcurl/opts/CURLINFO_HTTPAUTH*']
-- all: ['docs/libcurl/opts/CURLINFO_PROXYAUTH*']
-- all: ['docs/libcurl/opts/CURLOPT_KRB*']
-- all: ['docs/libcurl/opts/CURLOPT_SASL*']
-- all: ['docs/libcurl/opts/CURLOPT_SERVICE_NAME*']
-- all: ['docs/libcurl/opts/CURLOPT_USERNAME*']
-- all: ['docs/libcurl/opts/CURLOPT_USERPWD*']
-- all: ['docs/libcurl/opts/CURLOPT_XOAUTH*']
-- all: ['lib/*gssapi*']
-- all: ['lib/*krb5*']
-- all: ['lib/*ntlm*']
-- all: ['lib/curl_sasl.*']
-- all: ['lib/http_aws*']
-- all: ['lib/http_digest.*']
-- all: ['lib/http_negotiate.*']
-- all: ['lib/vauth/**']
-- all: ['tests/server/fake_ntlm.c']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              CMake/FindGSS.cmake,\
+              CMake/FindLibgsasl.cmake,\
+              docs/internals/CREDENTIALS.md,\
+              docs/libcurl/opts/CURLINFO_HTTPAUTH*,\
+              docs/libcurl/opts/CURLINFO_PROXYAUTH*,\
+              docs/libcurl/opts/CURLOPT_KRB*,\
+              docs/libcurl/opts/CURLOPT_SASL*,\
+              docs/libcurl/opts/CURLOPT_SERVICE_NAME*,\
+              docs/libcurl/opts/CURLOPT_USERNAME*,\
+              docs/libcurl/opts/CURLOPT_USERPWD*,\
+              docs/libcurl/opts/CURLOPT_XOAUTH*,\
+              lib/*gssapi*,\
+              lib/*ntlm*,\
+              lib/creds.*,\
+              lib/curl_ntlm*,\
+              lib/curl_sasl.*,\
+              lib/http_aws*,\
+              lib/http_digest.*,\
+              lib/http_negotiate.*,\
+              lib/http_ntlm.*,\
+              lib/vauth/**\
+              }"
 
 build:
-- all: ['**/CMakeLists.txt']
-- all: ['**/Makefile.am']
-- all: ['**/Makefile.inc']
-- all: ['**/Makefile.mk']
-- all: ['**/*.m4']
-- all: ['**/*.mk']
-- all: ['lib/libcurl*.in']
-- all: ['CMake/**']
-- all: ['configure.ac']
-- all: ['m4/**']
-- all: ['MacOSX-Framework']
-- all: ['packages/**']
-- all: ['plan9/**']
-- all: ['projects/**']
-- all: ['winbuild/**']
-- all: ['libcurl.def']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              **/CMakeLists.txt,\
+              **/Makefile.am,\
+              **/Makefile.inc,\
+              **/*.m4,\
+              *.m4,\
+              docs/INSTALL-CMAKE.md,\
+              lib/curl_config-cmake.h.in,\
+              lib/libcurl*.in,\
+              CMake/**,\
+              CMakeLists.txt,\
+              configure.ac,\
+              m4/**,\
+              Makefile.*,\
+              projects/**,\
+              lib/libcurl.def,\
+              tests/cmake/**\
+              }"
 
 CI:
-- any: ['.azure-pipelines.yml']
-- any: ['.circleci/**']
-- any: ['.cirrus.yml']
-- any: ['.github/**']
-- any: ['appveyor.yml']
-- any: ['tests/azure.pm']
-- any: ['tests/appveyor.pm']
+  - all:
+      - changed-files:
+          - any-glob-to-any-file:
+              - '.circleci/**'
+              - '.github/**'
+              - 'appveyor.*'
+              - 'scripts/ci*'
+              - 'tests/azure.pm'
+              - 'tests/appveyor.pm'
+              - 'tests/CI.md'
 
 cmake:
-- all: ['**/CMakeLists.txt']
-- all: ['CMake/**']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              **/CMakeLists.txt,\
+              CMake/**,\
+              docs/INSTALL-CMAKE.md,\
+              lib/curl_config-cmake.h.in,\
+              tests/cmake/**\
+              }"
 
 cmdline tool:
-- any: ['docs/cmdline-opts/**']
-- any: ['src/**']
+  - all:
+      - changed-files:
+          - any-glob-to-any-file:
+              - 'docs/cmdline-opts/**'
+              - 'src/**'
 
 connecting & proxies:
-- all: ['docs/CONNECTION-FILTERS.md']
-- all: ['docs/libcurl/opts/CURLINFO_CONNECT*']
-- all: ['docs/libcurl/opts/CURLINFO_PROXY*']
-- all: ['docs/libcurl/opts/CURLOPT_ADDRESS*']
-- all: ['docs/libcurl/opts/CURLOPT_CONNECT*']
-- all: ['docs/libcurl/opts/CURLOPT_HAPROXY*']
-- all: ['docs/libcurl/opts/CURLOPT_OPENSOCKET*']
-- all: ['docs/libcurl/opts/CURLOPT_PRE_PROXY*']
-- all: ['docs/libcurl/opts/CURLOPT_PROXY*']
-- all: ['docs/libcurl/opts/CURLOPT_SOCKOPT*']
-- all: ['docs/libcurl/opts/CURLOPT_SOCKS*']
-- all: ['docs/libcurl/opts/CURLOPT_TCP*']
-- all: ['docs/libcurl/opts/CURLOPT_TIMEOUT*']
-- all: ['lib/cf-*proxy.*']
-- all: ['lib/cf-socket.*']
-- all: ['lib/cfilters.*']
-- all: ['lib/conncache.*']
-- all: ['lib/connect.*']
-- all: ['lib/http_proxy.*']
-- all: ['lib/if2ip.*']
-- all: ['lib/noproxy.*']
-- all: ['lib/socks.*']
-- all: ['tests/server/socksd.c']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/cmdline-opts/happy-eyeballs*,\
+              docs/cmdline-opts/ipv*,\
+              docs/cmdline-opts/*proxy*,\
+              docs/internals/CONNECTION-FILTERS.md,\
+              docs/examples/ipv6.c,\
+              docs/libcurl/opts/CURLINFO_CONNECT*,\
+              docs/libcurl/opts/CURLINFO_PROXY*,\
+              docs/libcurl/opts/CURLOPT_ADDRESS*,\
+              docs/libcurl/opts/CURLOPT_CONNECT*,\
+              docs/libcurl/opts/CURLOPT_HAPROXY*,\
+              docs/libcurl/opts/CURLOPT_OPENSOCKET*,\
+              docs/libcurl/opts/CURLOPT_PRE_PROXY*,\
+              docs/libcurl/opts/CURLOPT_PROXY*,\
+              docs/libcurl/opts/CURLOPT_SOCKOPT*,\
+              docs/libcurl/opts/CURLOPT_SOCKS*,\
+              docs/libcurl/opts/CURLOPT_TCP*,\
+              docs/libcurl/opts/CURLOPT_TIMEOUT*,\
+              lib/cf-https-connect.*,\
+              lib/cf-ip-happy.*,\
+              lib/cf-*proxy.*,\
+              lib/cf-socket.*,\
+              lib/cfilters.*,\
+              lib/conncache.*,\
+              lib/connect.*,\
+              lib/http_proxy.*,\
+              lib/if2ip.*,\
+              lib/proxy.*,\
+              lib/socks.*,\
+              src/tool_cb_soc.*,\
+              tests/http/*proxy*,\
+              tests/http/*socks*,\
+              tests/server/socksd.c\
+              }"
 
 cookies:
-- all: ['docs/HTTP-COOKIES.md']
-- all: ['docs/libcurl/opts/CURLINFO_COOKIE*']
-- all: ['docs/libcurl/opts/CURLOPT_COOKIE*']
-- all: ['lib/cookie.*']
-- all: ['lib/psl.*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              CMake/FindLibpsl.cmake,\
+              docs/HTTP-COOKIES.md,\
+              docs/cmdline-opts/cookie*,\
+              docs/cmdline-opts/junk-session-cookies.md,\
+              docs/libcurl/opts/CURLINFO_COOKIE*,\
+              docs/libcurl/opts/CURLOPT_COOKIE*,\
+              docs/examples/cookie_interface.c,\
+              lib/cookie.*,\
+              lib/psl.*\
+              }"
 
 cryptography:
-- all: ['docs/CIPHERS.md']
-- all: ['docs/RUSTLS.md']
-- all: ['docs/libcurl/opts/CURLOPT_EGDSOCKET*']
-- all: ['lib/*sha256*']
-- all: ['lib/curl_des.*']
-- all: ['lib/curl_hmac.*']
-- all: ['lib/curl_md?.*']
-- all: ['lib/md?.*']
-- all: ['lib/rand.*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/CIPHERS.md,\
+              docs/RUSTLS.md,\
+              docs/libcurl/opts/CURLOPT_EGDSOCKET*,\
+              lib/*sha256*,\
+              lib/*sha512*,\
+              lib/curl_hmac.*,\
+              lib/curl_md?.*,\
+              lib/curl_ntlm_core.*,\
+              lib/md?.*,\
+              lib/rand.*\
+              }"
 
 DICT:
-- all: ['lib/dict.*']
-- all: ['tests/dictserver.py']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              lib/dict.*,\
+              tests/dictserver.py\
+              }"
 
 documentation:
-- all: ['**/*.md']
-- all: ['**/*.txt', '!**/CMakeLists.txt']
-- all: ['**/*.1']
-- all: ['**/*.3']
-- all: ['CHANGES']
-- all: ['docs/**', '!docs/examples/**']
-- all: ['GIT-INFO']
-- all: ['LICENSES/**']
-- all: ['README']
-- all: ['RELEASE-NOTES']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              .github/workflows/checkdocs.yml,\
+              .github/scripts/pyspelling*,\
+              .github/scripts/requirements-docs.txt,\
+              .github/scripts/requirements-proselint.txt,\
+              .github/scripts/typos*,\
+              .github/scripts/verify-examples.pl,\
+              .github/scripts/verify-synopsis.pl,\
+              **/*.md,\
+              **/*.txt,\
+              **/*.1,\
+              CHANGES.md,\
+              docs/**,\
+              LICENSES/**,\
+              README,\
+              RELEASE-NOTES,\
+              scripts/badwords.*,\
+              scripts/cd*,\
+              scripts/mdlinkcheck,\
+              scripts/nroff2cd,\
+              scripts/release-notes.pl\
+              }"
+          - all-globs-to-all-files:
+              # negative matches
+              - '!**/CMakeLists.txt'
+              - '!**/Makefile.am'
 
 FTP:
-- all: ['docs/libcurl/opts/CURLINFO_FTP*']
-- all: ['docs/libcurl/opts/CURLOPT_FTP*']
-- all: ['docs/libcurl/opts/CURLOPT_WILDCARDMATCH*']
-- all: ['lib/curl_fnmatch.*']
-- all: ['lib/curl_range.*']
-- all: ['lib/ftp*']
-- all: ['tests/ftp*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/cmdline-opts/ftp*,\
+              docs/libcurl/opts/CURLINFO_FTP*,\
+              docs/libcurl/opts/CURLOPT_FTP*,\
+              docs/libcurl/opts/CURLOPT_WILDCARDMATCH*,\
+              docs/examples/ftp*,\
+              lib/curl_fnmatch.*,\
+              lib/curl_range.*,\
+              lib/ftp*,\
+              tests/ftp*,\
+              tests/http/*ftpd*,\
+              tests/http/testenv/*ftpd*,\
+              tests/libtest/*_ftp_*\
+              }"
 
 GOPHER:
-- all: ['lib/gopher*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              lib/gopher*\
+              }"
 
 HTTP:
-- all: ['docs/HSTS.md']
-- all: ['docs/HTTP-COOKIES.md']
-- all: ['docs/libcurl/opts/CURLINFO_COOKIE*']
-- all: ['docs/libcurl/opts/CURLOPT_COOKIE*']
-- all: ['docs/libcurl/opts/CURLINFO_HTTP_**']
-- all: ['docs/libcurl/opts/CURLINFO_REDIRECT*']
-- all: ['docs/libcurl/opts/CURLINFO_REFER*']
-- all: ['docs/libcurl/opts/CURLOPT_FOLLOWLOCATION*']
-- all: ['docs/libcurl/opts/CURLOPT_HSTS*']
-- all: ['docs/libcurl/opts/CURLOPT_HTTP*']
-- all: ['docs/libcurl/opts/CURLOPT_POST.*']
-- all: ['docs/libcurl/opts/CURLOPT_POSTFIELD*']
-- all: ['docs/libcurl/opts/CURLOPT_POSTREDIR*']
-- all: ['docs/libcurl/opts/CURLOPT_REDIR*']
-- all: ['docs/libcurl/opts/CURLOPT_REFER*']
-- all: ['docs/libcurl/opts/CURLOPT_TRAILER*']
-- all: ['docs/libcurl/opts/CURLOPT_TRANSFER_ENCODING*']
-- all: ['lib/cf-https*']
-- all: ['lib/cf-h1*']
-- all: ['lib/cf-h2*']
-- all: ['lib/cookie.*']
-- all: ['lib/http*']
-- all: ['tests/http*']
-- all: ['tests/http-server.pl']
-- all: ['tests/http/*']
-- all: ['tests/nghttp*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/HTTPSRR.md,\
+              docs/HSTS.md,\
+              docs/examples/hsts*,\
+              docs/examples/http-*,\
+              docs/examples/httpput*,\
+              docs/examples/https*,\
+              docs/examples/*post*,\
+              docs/HTTP-COOKIES.md,\
+              docs/libcurl/opts/CURLINFO_COOKIE*,\
+              docs/libcurl/opts/CURLINFO_HTTP*,\
+              docs/libcurl/opts/CURLINFO_REDIRECT*,\
+              docs/libcurl/opts/CURLINFO_REFER*,\
+              docs/libcurl/opts/CURLOPT_COOKIE*,\
+              docs/libcurl/opts/CURLOPT_FOLLOWLOCATION*,\
+              docs/libcurl/opts/CURLOPT_HSTS*,\
+              docs/libcurl/opts/CURLOPT_HTTP*,\
+              docs/libcurl/opts/CURLOPT_POST.*,\
+              docs/libcurl/opts/CURLOPT_POSTFIELD*,\
+              docs/libcurl/opts/CURLOPT_POSTREDIR*,\
+              docs/libcurl/opts/CURLOPT_REDIR*,\
+              docs/libcurl/opts/CURLOPT_REFER*,\
+              docs/libcurl/opts/CURLOPT_TRAILER*,\
+              docs/libcurl/opts/CURLOPT_TRANSFER_ENCODING*,\
+              lib/cf-https*,\
+              lib/cf-h1*,\
+              lib/cf-h2*,\
+              lib/cookie.*,\
+              lib/hsts.*,\
+              lib/http*,\
+              tests/http*,\
+              tests/http-server.pl,\
+              tests/http/*,\
+              tests/nghttp*\
+              }"
 
 HTTP/2:
-- all: ['docs/HTTP2.md']
-- all: ['docs/libcurl/opts/CURLOPT_STREAM*']
-- all: ['lib/http2*']
-- all: ['tests/http2-server.pl']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              CMake/FindNGHTTP2.cmake,\
+              CMake/FindQuiche.cmake,\
+              docs/libcurl/opts/CURLOPT_STREAM*,\
+              docs/examples/http2*,\
+              lib/http2*,\
+              tests/http2-server.pl\
+              }"
 
 HTTP/3:
-- all: ['.github/workflows/ngtcp2*']
-- all: ['.github/workflows/quiche*']
-- all: ['docs/HTTP3.md']
-- all: ['lib/vquic/**']
-- all: ['tests/http3-server.pl']
-- all: ['tests/nghttpx.conf']
-
-Hyper:
-- all: ['docs/HYPER.md']
-- all: ['lib/c-hyper.*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              .github/workflows/http3-linux.yml,\
+              CMake/FindNGHTTP3.cmake,\
+              CMake/FindNGTCP2.cmake,\
+              docs/cmdline-opts/proxy-http3.md,\
+              docs/HTTP3.md,\
+              docs/examples/http3*,\
+              lib/cf-h3-proxy.*,\
+              lib/vquic/**,\
+              tests/http3-server.pl,\
+              tests/nghttpx.conf,\
+              tests/http/*httpsrr*\
+              }"
 
 IMAP:
-- all: ['lib/imap*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              lib/imap*,\
+              docs/examples/imap*\
+              }"
 
 LDAP:
-- all: ['lib/*ldap*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              lib/*ldap*\
+              }"
 
 libcurl API:
-- all: ['docs/libcurl/ABI.md']
-- any: ['include/curl/**']
+  - all:
+      - changed-files:
+          - any-glob-to-any-file:
+              - 'docs/libcurl/ABI.md'
+              - 'docs/libcurl/curl_*.md'
+              - 'include/curl/**'
+
+logging:
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/cmdline-opts/trace*,\
+              docs/libcurl/curl_global_trace*,\
+              lib/curl_trc*,\
+              tests/http/test_15_tracing.py\
+              }"
 
 MIME:
-- all: ['docs/libcurl/curl_mime_*']
-- all: ['docs/libcurl/opts/CURLOPT_MIME*']
-- all: ['lib/mime*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/libcurl/curl_form*,\
+              docs/libcurl/curl_mime_*,\
+              docs/libcurl/opts/CURLOPT_MIME*,\
+              docs/libcurl/opts/CURLOPT_HTTPPOST*,\
+              lib/formdata*,\
+              lib/mime*,\
+              src/tool_formparse.*\
+              }"
 
 MQTT:
-- all: ['docs/MQTT.md']
-- all: ['lib/mqtt*']
-- all: ['tests/server/mqttd.c']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/internals/MQTT.md,\
+              lib/mqtt*,\
+              tests/server/mqttd.c\
+              }"
 
 name lookup:
-- all: ['docs/libcurl/opts/CURLINFO_NAMELOOKUP*']
-- all: ['docs/libcurl/opts/CURLOPT_DNS*']
-- all: ['docs/libcurl/opts/CURLOPT_DOH*']
-- all: ['docs/libcurl/opts/CURLOPT_RESOLVE*']
-- all: ['lib/asyn*']
-- all: ['lib/curl_gethostname.*']
-- all: ['lib/doh*']
-- all: ['lib/host*']
-- all: ['lib/idn*']
-- all: ['lib/inet_pton.*']
-- all: ['lib/socketpair*']
-- all: ['tests/server/resolve.c']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              CMake/FindLibidn2.cmake,\
+              docs/cmdline-opts/doh*,\
+              docs/cmdline-opts/dns*,\
+              docs/examples/resolve.c,\
+              docs/internals/THRDPOOL-AND-QUEUE.md,\
+              docs/libcurl/opts/CURLINFO_NAMELOOKUP*,\
+              docs/libcurl/opts/CURLOPT_DNS*,\
+              docs/libcurl/opts/CURLOPT_DOH*,\
+              docs/libcurl/opts/CURLOPT_RESOLVE*,\
+              lib/*addrinfo*,\
+              lib/asyn*,\
+              lib/cf-dns.*,\
+              lib/curl_gethostname.*,\
+              lib/dns*,\
+              lib/doh*,\
+              lib/host*,\
+              lib/idn*,\
+              lib/socketpair*,\
+              lib/thrdpool.*,\
+              lib/thrdqueue.*,\
+              tests/http/testenv/dnsd.*,\
+              tests/http/*httpsrr*,\
+              tests/http/*resolve.py,\
+              tests/server/dnsd.c,\
+              tests/server/resolve.c\
+              }"
 
 POP3:
-- all: ['lib/pop3.*']
-
-RTMP:
-- all: ['lib/curl_rtmp.*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/examples/pop3*,\
+              lib/pop3.*\
+              }"
 
 RTSP:
-- all: ['docs/libcurl/opts/CURLINFO_RTSP*']
-- all: ['docs/libcurl/opts/CURLOPT_RTSP*']
-- all: ['lib/rtsp.*']
-- all: ['tests/rtspserver.pl']
-- all: ['tests/server/rtspd.c']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/libcurl/opts/CURLINFO_RTSP*,\
+              docs/libcurl/opts/CURLOPT_RTSP*,\
+              lib/rtsp.*,\
+              tests/rtspserver.pl,\
+              tests/server/rtspd.c\
+              }"
 
 SCP/SFTP:
-- all: ['docs/libcurl/opts/CURLOPT_SSH*']
-- all: ['lib/vssh/**']
-- all: ['tests/sshhelp.pm']
-- all: ['tests/sshserver.pl']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              CMake/FindLibssh.cmake,\
+              CMake/FindLibssh2.cmake,\
+              docs/cmdline-opts/knownhosts.md,\
+              docs/libcurl/opts/CURLOPT_SSH*,\
+              docs/examples/sftp*,\
+              lib/vssh/**,\
+              tests/sshhelp.pm,\
+              tests/sshserver.pl,\
+              tests/http/*scp*,\
+              tests/http/*sftp*,\
+              tests/http/testenv/sshd.py\
+              }"
 
 script:
-- all: ['**/*.pl']
-- all: ['**/*.sh']
-- all: ['curl-config.in']
-- all: ['docs/curl-config.1']
-- all: ['docs/mk-ca-bundle.1']
-- all: ['docs/THANKS-filter']
-- all: ['scripts/**']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              **/*.pl,\
+              **/*.sh,\
+              curl-config.in,\
+              docs/curl-config.md,\
+              docs/mk-ca-bundle.md,\
+              docs/wcurl.md,\
+              docs/THANKS-filter,\
+              scripts/**\
+              }"
 
 SMB:
-- all: ['lib/smb.*']
-- all: ['tests/smbserver.py']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              lib/smb.*,\
+              tests/smbserver.py\
+              }"
 
 SMTP:
-- all: ['docs/libcurl/opts/CURLOPT_MAIL*']
-- all: ['lib/smtp.*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/cmdline-opts/mail*,\
+              docs/examples/smtp-*,\
+              docs/libcurl/opts/CURLOPT_MAIL*,\
+              lib/smtp.*\
+              }"
 
 tests:
-- any: ['tests/**']
+  - all:
+      - changed-files:
+          - any-glob-to-any-file:
+              - 'docs/tests/**'
+              - 'tests/**'
 
 TFTP:
-- all: ['lib/tftp.*']
-- all: ['tests/tftpserver.pl']
-- all: ['tests/server/tftp*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              lib/tftp.*,\
+              tests/tftpserver.pl,\
+              tests/server/tftp*\
+              }"
 
 TLS:
-- all: ['docs/SSL*']
-- all: ['docs/libcurl/opts/CURLINFO_CA*']
-- all: ['docs/libcurl/opts/CURLINFO_CERT*']
-- all: ['docs/libcurl/opts/CURLINFO_SSL*']
-- all: ['docs/libcurl/opts/CURLINFO_TLS*']
-- all: ['docs/libcurl/opts/CURLOPT_CA*']
-- all: ['docs/libcurl/opts/CURLOPT_CERT*']
-- all: ['docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY*']
-- all: ['docs/libcurl/opts/CURLOPT_SSL*']
-- all: ['docs/libcurl/opts/CURLOPT_TLS*']
-- all: ['docs/libcurl/opts/CURLOPT_USE_SSL*']
-- all: ['lib/vtls/**']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              CMake/FindGnuTLS.cmake,\
+              CMake/FindMbedTLS.cmake,\
+              CMake/FindWolfSSL.cmake,\
+              CMake/FindRustls.cmake,\
+              docs/CIPHERS-TLS12.md,\
+              docs/SSL*,\
+              docs/cmdline-opts/dump-ca-embed.md,\
+              docs/cmdline-opts/*cert*,\
+              docs/cmdline-opts/*ssl*,\
+              docs/cmdline-opts/*tls*,\
+              docs/examples/ssl*,\
+              docs/examples/*ssl.*,\
+              docs/examples/*tls.*,\
+              docs/internals/TLS-SESSIONS.md,\
+              docs/libcurl/curl_global_sslset*,\
+              docs/libcurl/curl_easy_ssls*,\
+              docs/libcurl/opts/CURLINFO_CA*,\
+              docs/libcurl/opts/CURLINFO_CERT*,\
+              docs/libcurl/opts/CURLINFO_EARLYDATA*,\
+              docs/libcurl/opts/CURLINFO_SSL*,\
+              docs/libcurl/opts/CURLINFO_TLS*,\
+              docs/libcurl/opts/CURLOPT_CA*,\
+              docs/libcurl/opts/CURLOPT_CERT*,\
+              docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY*,\
+              docs/libcurl/opts/CURLOPT_SSL*,\
+              docs/libcurl/opts/CURLOPT_TLS*,\
+              docs/libcurl/opts/CURLOPT_USE_SSL*,\
+              lib/vtls/**,\
+              m4/curl-gnutls.m4,\
+              m4/curl-mbedtls.m4,\
+              m4/curl-openssl.m4,\
+              m4/curl-rustls.m4,\
+              m4/curl-schannel.m4,\
+              m4/curl-wolfssl.m4,\
+              src/tool_ssls.*\
+              }"
 
 URL:
-- all: ['docs/libcurl/curl_url*']
-- all: ['docs/URL-SYNTAX.md']
-- all: ['include/curl/urlapi.h']
-- all: ['lib/urlapi*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/libcurl/curl_url*,\
+              docs/URL-SYNTAX.md,\
+              docs/examples/parseurl*,\
+              include/curl/urlapi.h,\
+              lib/urlapi*\
+              }"
 
 WebSocket:
-- all: ['docs/WEBSOCKET.md*']
-- all: ['docs/libcurl/curl_ws_*']
-- all: ['docs/libcurl/libcurl-ws.3']
-- all: ['docs/libcurl/opts/CURLOPT_WS_*']
-- all: ['include/curl/websockets.h']
-- all: ['lib/ws.*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/internals/WEBSOCKET.md,\
+              docs/examples/websocket*,\
+              docs/libcurl/curl_ws_*,\
+              docs/libcurl/libcurl-ws*,\
+              docs/libcurl/opts/CURLOPT_WS_*,\
+              include/curl/websockets.h,\
+              lib/ws.*,\
+              tests/http/test_20_websockets.py,\
+              tests/http/testenv/ws*,\
+              tests/libtest/cli_ws*\
+              }"
 
 Windows:
-- all: ['CMake/Platforms/WindowsCache.cmake']
-- all: ['lib/*win32*']
-- all: ['lib/curl_multibyte.*']
-- all: ['lib/rename.*']
-- all: ['lib/vtls/schannel*']
-- all: ['m4/curl-schannel.m4']
-- all: ['projects/**']
-- all: ['src/tool_doswin.c']
-- all: ['winbuild/**']
-- all: ['libcurl.def']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              .github/workflows/windows.yml,\
+              appveyor.*,\
+              CMake/win32-cache.cmake,\
+              lib/*win32*,\
+              lib/curlx/fopen.*,\
+              lib/curlx/multibyte.*,\
+              lib/curlx/winapi.*,\
+              lib/libcurl.def,\
+              lib/vtls/schannel*,\
+              m4/curl-schannel.m4,\
+              projects/Windows/**,\
+              src/tool_doswin.c\
+              }"
diff --git a/third-party/curl/.github/pull_request_template.md b/third-party/curl/.github/pull_request_template.md
new file mode 100644
index 0000000000..34e39a2172
--- /dev/null
+++ b/third-party/curl/.github/pull_request_template.md
@@ -0,0 +1,8 @@
+<!--
+        IMPORTANT:
+        If you cannot understand or explain your work without using
+        Artificial Intelligence (AI) then do not file here. Do not paste
+        massive AI generated explanations. We accept the use of AI as long as
+        it is digestible. Please explain your issues or improvements briefly
+        and clearly in your own human voice.
+-->
diff --git a/third-party/curl/.github/scripts/cleancmd.pl b/third-party/curl/.github/scripts/cleancmd.pl
new file mode 100644
index 0000000000..d6ddeb7274
--- /dev/null
+++ b/third-party/curl/.github/scripts/cleancmd.pl
@@ -0,0 +1,130 @@
+#!/usr/bin/env perl
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+#
+# Input: cmdline docs markdown files, they get modified *in place*
+#
+# Strip off the leading meta-data/header part, remove all known curl symbols
+# and long command line options. Also clean up whatever else the spell checker
+# might have a problem with that we still deem is fine.
+#
+
+use strict;
+use warnings;
+
+my @asyms;
+
+open(S, "<./docs/libcurl/symbols-in-versions")
+    or die "cannot find symbols-in-versions";
+while(<S>) {
+    if(/^([^ ]*) /) {
+        push @asyms, $1;
+    }
+}
+close(S);
+
+# init the opts table with "special" options not easy to figure out
+my @aopts = (
+    '--ftp-ssl-reqd', # old alias
+    );
+
+open(O, "<./docs/options-in-versions")
+    or die "cannot find options-in-versions";
+while(<O>) {
+    chomp;
+    if(/^([^ ]+)/) {
+        my $o = $1;
+        push @aopts, $o;
+        if($o =~ /^--no-(.*)/) {
+            # for the --no options, also make one without it
+            push @aopts, "--$1";
+        }
+        elsif($o =~ /^--disable-(.*)/) {
+            # for the --disable options, also make the special ones
+            push @aopts, "--$1";
+            push @aopts, "--no-$1";
+        }
+    }
+}
+close(O);
+
+open(C, "<./.github/scripts/spellcheck.curl")
+    or die "cannot find spellcheck.curl";
+while(<C>) {
+    if(/^\#/) {
+        next;
+    }
+    chomp;
+    if(/^([^ ]+)/) {
+        push @asyms, $1;
+    }
+}
+close(C);
+
+# longest symbols first
+my @syms = sort { length($b) <=> length($a) } @asyms;
+
+# longest cmdline options first
+my @opts = sort { length($b) <=> length($a) } @aopts;
+
+sub process {
+    my ($f) = @_;
+
+    my $ignore = 0;
+    my $sepcount = 0;
+    my $out;
+    my $line = 0;
+    open(F, "<$f") or die;
+
+    while(<F>) {
+        $line++;
+        if(/^---/ && ($line == 1)) {
+            $ignore = 1;
+            next;
+        }
+        elsif(/^---/ && $ignore) {
+            $ignore = 0;
+            next;
+        }
+        next if($ignore);
+
+        my $l = $_;
+
+        # strip out backticked words
+        $l =~ s/`[^`]+`//g;
+
+        # **bold**
+        $l =~ s/\*\*(\S.*?)\*\*//g;
+        # *italics*
+        $l =~ s/\*(\S.*?)\*//g;
+
+        # strip out https URLs, we do not want them spellchecked
+        $l =~ s!https://[a-z0-9\#_/.-]+!!gi;
+
+        # strip links, both name and target
+        $l =~ s/(\[.*?\])\(.*?\)//g;
+        $out .= $l;
+    }
+    close(F);
+
+    # cut out all known curl cmdline options
+    map { $out =~ s/$_//g; } (@opts);
+
+    # cut out all known curl symbols
+    map { $out =~ s/\b$_\b//g; } (@syms);
+
+    if(!$ignore) {
+        open(O, ">$f") or die;
+        print O $out;
+        close(O);
+    }
+}
+
+my @filemasks = @ARGV;
+open(my $git_ls_files, '-|', 'git', 'ls-files', '--', @filemasks) or die "Failed running git ls-files: $!";
+while(my $f = <$git_ls_files>) {
+    chomp $f;
+    process($f);
+}
+close $git_ls_files;
diff --git a/third-party/curl/.github/scripts/cleanspell.pl b/third-party/curl/.github/scripts/cleanspell.pl
deleted file mode 100644
index 329a972403..0000000000
--- a/third-party/curl/.github/scripts/cleanspell.pl
+++ /dev/null
@@ -1,79 +0,0 @@
-#!/usr/bin/perl
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-#
-# Input: a libcurl nroff man page
-# Output: the same file, minus the SYNOPSIS and the EXAMPLE sections
-#
-
-my $f = $ARGV[0];
-my $o = $ARGV[1];
-
-open(F, "<$f") or die;
-open(O, ">$o") or die;
-
-my $ignore = 0;
-while(<F>) {
-    if($_ =~ /^.SH (SYNOPSIS|EXAMPLE|\"SEE ALSO\"|SEE ALSO)/) {
-        $ignore = 1;
-    }
-    elsif($ignore && ($_ =~ /^.SH/)) {
-        $ignore = 0;
-    }
-    elsif(!$ignore) {
-        # filter out mentioned CURLE_ names
-        $_ =~ s/CURL(M|SH|U|H)code//g;
-        $_ =~ s/CURL_(READ|WRITE)FUNC_[A-Z0-9_]*//g;
-        $_ =~ s/CURL_CSELECT_[A-Z0-9_]*//g;
-        $_ =~ s/CURL_DISABLE_[A-Z0-9_]*//g;
-        $_ =~ s/CURL_FORMADD_[A-Z0-9_]*//g;
-        $_ =~ s/CURL_HET_DEFAULT//g;
-        $_ =~ s/CURL_IPRESOLVE_[A-Z0-9_]*//g;
-        $_ =~ s/CURL_PROGRESSFUNC_CONTINUE//g;
-        $_ =~ s/CURL_REDIR_[A-Z0-9_]*//g;
-        $_ =~ s/CURL_RTSPREQ_[A-Z0-9_]*//g;
-        $_ =~ s/CURL_TIMECOND_[A-Z0-9_]*//g;
-        $_ =~ s/CURL_VERSION_[A-Z0-9_]*//g;
-        $_ =~ s/CURLALTSVC_[A-Z0-9_]*//g;
-        $_ =~ s/CURLAUTH_[A-Z0-9_]*//g;
-        $_ =~ s/CURLE_[A-Z0-9_]*//g;
-        $_ =~ s/CURLFORM_[A-Z0-9_]*//g;
-        $_ =~ s/CURLFTP_[A-Z0-9_]*//g;
-        $_ =~ s/CURLFTPAUTH_[A-Z0-9_]*//g;
-        $_ =~ s/CURLFTPMETHOD_[A-Z0-9_]*//g;
-        $_ =~ s/CURLFTPSSL_[A-Z0-9_]*//g;
-        $_ =~ s/CURLGSSAPI_[A-Z0-9_]*//g;
-        $_ =~ s/CURLHEADER_[A-Z0-9_]*//g;
-        $_ =~ s/CURLINFO_[A-Z0-9_]*//g;
-        $_ =~ s/CURLM_[A-Z0-9_]*//g;
-        $_ =~ s/CURLMIMEOPT_[A-Z0-9_]*//g;
-        $_ =~ s/CURLMOPT_[A-Z0-9_]*//g;
-        $_ =~ s/CURLOPT_[A-Z0-9_]*//g;
-        $_ =~ s/CURLPIPE_[A-Z0-9_]*//g;
-        $_ =~ s/CURLPROTO_[A-Z0-9_]*//g;
-        $_ =~ s/CURLPROXY_[A-Z0-9_]*//g;
-        $_ =~ s/CURLPX_[A-Z0-9_]*//g;
-        $_ =~ s/CURLSHE_[A-Z0-9_]*//g;
-        $_ =~ s/CURLSHOPT_[A-Z0-9_]*//g;
-        $_ =~ s/CURLSSH_[A-Z0-9_]*//g;
-        $_ =~ s/CURLSSLBACKEND_[A-Z0-9_]*//g;
-        $_ =~ s/CURLU_[A-Z0-9_]*//g;
-        $_ =~ s/CURLUE_[A-Z0-9_]*//g;
-        $_ =~ s/CURLUPART_[A-Z0-9_]*//g;
-        $_ =~ s/CURLUSESSL_[A-Z0-9_]*//g;
-        $_ =~ s/curl_global_(init_mem|sslset|cleanup)//g;
-        $_ =~ s/curl_(strequal|strnequal|formadd|waitfd|formget|getdate|formfree)//g;
-        $_ =~ s/curl_easy_(nextheader|duphandle)//g;
-        $_ =~ s/curl_multi_fdset//g;
-        $_ =~ s/curl_mime_(subparts|addpart|filedata|data_cb)//g;
-        $_ =~ s/curl_ws_(send|recv|meta)//g;
-        $_ =~ s/curl_url_(dup)//g;
-        $_ =~ s/curl_pushheader_by(name|num)//g;
-        $_ =~ s/libcurl-(env|ws)//g;
-        $_ =~ s/(^|\W)((tftp|https|http|ftp):\/\/[a-z0-9\-._~%:\/?\#\[\]\@!\$&'()*+,;=]+)//gi;
-        print O $_;
-    }
-}
-close(F);
-close(O);
diff --git a/third-party/curl/.github/scripts/cmp-config.pl b/third-party/curl/.github/scripts/cmp-config.pl
new file mode 100644
index 0000000000..9c353432bb
--- /dev/null
+++ b/third-party/curl/.github/scripts/cmp-config.pl
@@ -0,0 +1,136 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+my $autotools = $ARGV[0];
+my $cmake = $ARGV[1];
+
+if(!$cmake) {
+    print "Usage: cmp-config <config1> <config2.h>\n";
+    exit;
+}
+
+# this lists complete lines that are removed from the output if matching
+my %remove = (
+    '#define CURL_EXTERN_SYMBOL' => 1,
+    '#define CURL_OS "Linux"' => 1,
+    '#define CURL_OS "x86_64-pc-linux-gnu"' => 1,
+    '#define GETHOSTNAME_TYPE_ARG2 int' => 1,
+    '#define GETHOSTNAME_TYPE_ARG2 size_t' => 1,
+    '#define HAVE_BROTLI 1' => 1,
+    '#define HAVE_BROTLI_DECODE_H 1' => 1,
+    '#define HAVE_DLFCN_H 1' => 1,
+    '#define HAVE_GSSAPI_GSSAPI_GENERIC_H 1' => 1,
+    '#define HAVE_GSSAPI_GSSAPI_H 1' => 1,
+    '#define HAVE_GSSAPI_GSSAPI_KRB5_H 1' => 1,
+    '#define HAVE_INTTYPES_H 1' => 1,
+    '#define HAVE_LDAP_H 1' => 1,
+    '#define HAVE_LDAP_SSL 1' => 1,
+    '#define HAVE_LIBBROTLIDEC 1' => 1,
+    '#define HAVE_LIBPSL_H 1' => 1,
+    '#define HAVE_LIBSOCKET 1' => 1,
+    '#define HAVE_LIBSSH' => 1,
+    '#define HAVE_LIBSSH2 1' => 1,
+    '#define HAVE_LIBSSL 1' => 1,
+    '#define HAVE_LIBZSTD 1' => 1,
+    '#define HAVE_NGHTTP2_NGHTTP2_H 1' => 1,
+    '#define HAVE_NGHTTP3_NGHTTP3_H 1' => 1,
+    '#define HAVE_NGTCP2_NGTCP2_CRYPTO_H 1' => 1,
+    '#define HAVE_NGTCP2_NGTCP2_H 1' => 1,
+    '#define HAVE_OPENSSL_CRYPTO_H 1' => 1,
+    '#define HAVE_OPENSSL_ERR_H 1' => 1,
+    '#define HAVE_OPENSSL_PEM_H 1' => 1,
+    '#define HAVE_OPENSSL_RSA_H 1' => 1,
+    '#define HAVE_OPENSSL_SSL_H 1' => 1,
+    '#define HAVE_QUICHE_H 1' => 1,
+    '#define HAVE_SSL_SET_QUIC_TLS_CBS 1' => 1,
+    '#define HAVE_SSL_SET_QUIC_USE_LEGACY_CODEPOINT 1' => 1,
+    '#define HAVE_STDINT_H 1' => 1,
+    '#define HAVE_STDIO_H 1' => 1,
+    '#define HAVE_STDLIB_H 1' => 1,
+    '#define HAVE_STRING_H 1' => 1,
+    '#define HAVE_SYS_STAT_H 1' => 1,
+    '#define HAVE_SYS_XATTR_H 1' => 1,
+    '#define HAVE_UNICODE_UIDNA_H 1' => 1,
+    '#define HAVE_WOLFSSL_SET_QUIC_USE_LEGACY_CODEPOINT 1' => 1,
+    '#define HAVE_ZSTD 1' => 1,
+    '#define HAVE_ZSTD_H 1' => 1,
+    '#define LT_OBJDIR ".libs/"' => 1,
+    '#define NEED_LBER_H 1' => 1,
+    '#define PACKAGE "curl"' => 1,
+    '#define PACKAGE_BUGREPORT "a suitable curl mailing list: https://curl.se/mail/"' => 1,
+    '#define PACKAGE_NAME "curl"' => 1,
+    '#define PACKAGE_STRING "curl -"' => 1,
+    '#define PACKAGE_TARNAME "curl"' => 1,
+    '#define PACKAGE_URL ""' => 1,
+    '#define PACKAGE_VERSION "-"' => 1,
+    '#define VERSION "-"' => 1,
+    '#define _FILE_OFFSET_BITS 64' => 1,
+    );
+
+sub filter {
+    my ($line) = @_;
+    if(!$remove{$line}) {
+        return "$line\n";
+    }
+    $remove{$line}++;
+    return "";
+}
+
+sub grepit {
+    my ($input, $output) = @_;
+    my @defines;
+    # first get all the #define lines
+    open(F, "<$input");
+    while(<F>) {
+        if($_ =~ /^#def/) {
+            chomp;
+            push @defines, $_;
+        }
+    }
+    close(F);
+
+    open(O, ">$output");
+
+    # output the sorted list through the filter
+    foreach my $d(sort @defines) {
+        print O filter($d);
+    }
+    close(O);
+}
+
+grepit($autotools, "/tmp/autotools");
+grepit($cmake, "/tmp/cmake");
+
+foreach my $v (keys %remove) {
+    if($remove{$v} == 1) {
+        print "Ignored, never matched line: $v\n";
+    }
+}
+
+# return the exit code from diff
+exit system('diff', ('-u', '/tmp/autotools', '/tmp/cmake')) >> 8;
diff --git a/third-party/curl/.github/scripts/cmp-pkg-config.sh b/third-party/curl/.github/scripts/cmp-pkg-config.sh
new file mode 100644
index 0000000000..37a316218c
--- /dev/null
+++ b/third-party/curl/.github/scripts/cmp-pkg-config.sh
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+# Sort list of libs, libpaths, cflags found in libcurl.pc and curl-config files,
+# then diff the autotools and cmake generated ones.
+
+sort_lists() {
+  prevline=''
+  section=''
+  while IFS= read -r l; do
+    if [[ "${prevline}" =~ (--cc|--configure) ]]; then  # curl-config
+      echo "<IGNORED>"
+    else
+      # libcurl.pc
+      if [[ "${l}" =~ ^(Requires|Libs|Cflags)(\.private)?:\ (.+)$ ]]; then
+        if [ "${BASH_REMATCH[1]}" = 'Requires' ]; then
+          # Spec does not allow duplicates here:
+          # https://manpages.debian.org/unstable/pkg-config/pkg-config.1.en.html#Requires:
+          # "You may only mention the same package one time on the Requires: line"
+          val="$(printf '%s' "${BASH_REMATCH[3]}" | tr ',' '\n' | sort | tr '\n' ' ')"
+        else
+          val="$(printf '%s' "${BASH_REMATCH[3]}" | tr ' ' '\n' | sort -u | tr '\n' ' ')"
+        fi
+        l="${BASH_REMATCH[1]}${BASH_REMATCH[2]}: ${val}"
+      # curl-config
+      elif [[ "${section}" =~ (--libs|--static-libs) && "${l}" =~ ^( *echo\ \")(.+)(\")$ ]]; then
+        val="$(printf '%s' "${BASH_REMATCH[2]}" | tr ' ' '\n' | sort -u | tr '\n' ' ')"
+        l="${BASH_REMATCH[1]}${val}${BASH_REMATCH[3]}"
+        section=''
+      fi
+      echo "${l}"
+    fi
+    # curl-config
+    prevline="${l}"
+    if [[ "${l}" =~ --[a-z-]+\) ]]; then
+      section="${BASH_REMATCH[0]}"
+    fi
+  done < "$1"
+}
+
+am=$(mktemp -t autotools.XXX); sort_lists "$1" > "${am}"
+cm=$(mktemp -t cmake.XXX)    ; sort_lists "$2" > "${cm}"
+diff -u "${am}" "${cm}"
+res="$?"
+rm -r -f "${am}" "${cm}"
+
+exit "${res}"
diff --git a/third-party/curl/.github/scripts/codespell-ignore.words b/third-party/curl/.github/scripts/codespell-ignore.words
new file mode 100644
index 0000000000..1a5e106400
--- /dev/null
+++ b/third-party/curl/.github/scripts/codespell-ignore.words
@@ -0,0 +1,21 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+anonymou
+aNULL
+bu
+clen
+CNA
+hel
+htpts
+inout
+PASE
+passwor
+perfec
+proxys
+seh
+ser
+strat
+te
+UE
+WONT
diff --git a/third-party/curl/.github/scripts/codespell.sh b/third-party/curl/.github/scripts/codespell.sh
new file mode 100644
index 0000000000..c5ddf90a47
--- /dev/null
+++ b/third-party/curl/.github/scripts/codespell.sh
@@ -0,0 +1,22 @@
+#!/bin/sh
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+set -eu
+
+cd "$(dirname "${0}")"/../..
+
+git ls-files -z | xargs -0 -r \
+codespell \
+  --skip '.github/scripts/pyspelling.words' \
+  --skip '.github/scripts/typos.toml' \
+  --skip 'docs/THANKS' \
+  --skip 'projects/OS400/*' \
+  --skip 'projects/vms/*' \
+  --skip 'RELEASE-NOTES' \
+  --skip 'scripts/wcurl' \
+  --skip 'tests/unit/unit1625.c' \
+  --ignore-regex '.*spellchecker:disable-line' \
+  --ignore-words '.github/scripts/codespell-ignore.words' \
+  --
diff --git a/third-party/curl/.github/scripts/distfiles.sh b/third-party/curl/.github/scripts/distfiles.sh
new file mode 100644
index 0000000000..5eb6a470a8
--- /dev/null
+++ b/third-party/curl/.github/scripts/distfiles.sh
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+# Compare git repo files with tarball files and report a mismatch
+# after excluding exceptions.
+
+set -eu
+
+gitonly=".git*
+^.*
+^appveyor.*
+^GIT-INFO.md
+^README.md
+^renovate.json
+^REUSE.toml
+^SECURITY.md
+^LICENSES/*
+^docs/examples/adddocsref.pl
+^docs/tests/CI.md
+^docs/THANKS-filter
+^projects/Windows/*
+^scripts/contributors.sh
+^scripts/contrithanks.sh
+^scripts/delta
+^scripts/installcheck.sh
+^scripts/release-notes.pl
+^scripts/singleuse.pl"
+
+tarfiles="$(mktemp)"
+gitfiles="$(mktemp)"
+
+tar -tf "$1" \
+  | sed -E 's|^[^/]+/||g' \
+  | grep -v -E '(/|^)$' \
+  | sort > "${tarfiles}"
+
+git -C "${2:-.}" ls-files \
+  | grep -v -E "($(printf '%s' "${gitonly}" | tr $'\n' '|' | sed -e 's|\.|\\.|g' -e 's|\*|.+|g'))$" \
+  | sort > "${gitfiles}"
+
+dif="$(diff -u "${tarfiles}" "${gitfiles}" | tail -n +3 || true)"
+
+rm -rf "${tarfiles:?}" "${gitfiles:?}"
+
+echo 'Only in tarball:'
+echo "${dif}" | grep '^-' || true
+echo
+
+echo 'Missing from tarball:'
+if echo "${dif}" | grep '^+'; then
+  exit 1
+fi
diff --git a/third-party/curl/.github/scripts/pyspelling.words b/third-party/curl/.github/scripts/pyspelling.words
new file mode 100644
index 0000000000..1c0fb96d9b
--- /dev/null
+++ b/third-party/curl/.github/scripts/pyspelling.words
@@ -0,0 +1,1023 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+#
+AAAA
+ABI
+accessor
+ACK
+AES
+AIA
+AIX
+al
+Alessandro
+aliasMode
+allocator
+alnum
+ALPN
+Altera
+AltSvc
+ALTSVC
+amiga
+AmigaOS
+AmiSSL
+anyauth
+anycast
+apache
+Apache
+API
+APIs
+APOP
+AppVeyor
+archivers
+Archos
+Arntsen
+Aros
+asynch
+AsynchDNS
+atime
+auth
+autobuild
+autobuilds
+Autoconf
+autoconf
+Automake
+automake
+autoreconf
+Autotools
+autotools
+AVR
+AWS
+AWS-LC
+axTLS
+backend
+backends
+backoff
+backtick
+backticks
+balancers
+Baratov
+basename
+bashrc
+BDFL
+BearSSL
+Benoit
+BeOS
+bitmask
+bitset
+bitwise
+Björn
+Bjørn
+bool
+boolean
+BoringSSL
+Boukris
+Broadcom
+brotli
+bufq
+bufref
+bugfix
+bugfixes
+buildable
+buildbot
+Caddy
+calloc
+CAPA
+capath
+CCC
+CDN
+CentOS
+CFLAGS
+cflags
+CGI's
+CHACHA
+chacha
+Chaffraix
+changelog
+changeset
+CharConv
+charset
+charsets
+checkdocs
+checksrc
+checksums
+chgrp
+chmod
+chown
+ChromeOS
+CI's
+CIDR
+CIFS
+CLA
+CLAs
+cleartext
+CLI
+ClientHello
+clientp
+cliget
+closesocket
+CMake
+cmake
+CMake's
+cmake's
+CMakeLists
+CNA
+CNAME
+CNAMEs
+CodeQL
+CODESET
+codeset
+CodeSonar
+Comcast
+commit's
+Config
+config
+conncache
+connectdata
+CookieInfo
+Coverity
+CPUs
+CR
+CRL
+CRLF
+crontab
+crt
+crypto
+cryptographic
+cryptographically
+CSEQ
+CSeq
+csh
+cshrc
+CTRL
+CURLcode
+curldown
+CURLE
+CURLECH
+CURLH
+curlimages
+CURLINFO
+curlrc
+curltest
+customizable
+CVE
+CVSS
+CWD
+CWE
+cyassl
+Cygwin
+daniel
+datagrams
+datatracker
+dbg
+decapsulation
+Debian
+DEBUGBUILD
+decrypt
+decrypted
+decrypting
+deepcode
+defacto
+DELE
+DER
+dereference
+dereferences
+DES
+deselectable
+deserialization
+Deserialized
+destructor
+detections
+dev
+devcpp
+DevOps
+devtools
+DHCP
+DHE
+dir
+discoverable
+distro
+distro's
+distros
+DJGPP
+dlist
+DLL
+dll
+DLLs
+DNS
+dns
+dnsop
+DNSSEC
+DoH
+DoT
+doxygen
+drftpd
+dsa
+DSN
+dtrace
+Dudka
+Dymond
+dynbuf
+EAGAIN
+EBCDIC
+ECC
+ECCN
+ECDHE
+ECH
+ECHConfig
+ECHConfigList
+ecl
+ECONNREFUSED
+eCOS
+ECT
+EF
+EFnet
+EGD
+EHLO
+EINTR
+else's
+encapsulation
+encodings
+enctype
+endianness
+Engler
+enum
+enums
+epoll
+EPRT
+EPSV
+ERRNO
+errno
+ESNI
+et
+etag
+ETag
+ETags
+exa
+exe
+executables
+EXPN
+extensibility
+failsafe
+Falkeborn
+Fandrich
+Fastly
+fcpp
+Fedora
+Feltzing
+ffi
+filesize
+filesystem
+FindCURL
+FLOSS
+fnmatch
+footguns
+formpost
+formposts
+Fortnite
+FOSS
+FPL
+fread
+FreeBSD
+FreeDOS
+FreeRTOS
+freshmeat
+Frexx
+FS
+fseek
+FTPing
+fuzzer
+fwrite
+Garmin
+gcc
+GCM
+gdb
+Genode
+Gentoo
+Gergely
+getaddrinfo
+getenv
+gethostbyname
+gethostname
+Getinfo
+getinfo
+GETing
+getpwuid
+ggcov
+GHA
+Ghedini
+giga
+Gisle
+Glesys
+glibc
+globbed
+globbing
+gmail
+GnuTLS
+Golemon
+GOST
+GPG
+GPL
+GPLed
+GREASE
+GREASEing
+Greear
+groff
+gsasl
+GSKit
+gskit
+GSS
+GSSAPI
+GTFO
+Guenter
+GUIs
+Gunderson
+Gustafsson
+gzip
+Gzipped
+gzipped
+HackerOne
+HackerOne's
+HAProxy
+HardenedBSD
+Hards
+Haxx
+haxx
+Heimdal
+HelloRetryRequest
+HELO
+HH
+HMAC
+Hoersken
+Holme
+homebrew
+hostname
+hostnames
+Housley
+HRR
+Hruska
+HSTS
+hsts
+HTC
+html
+http
+HTTPAUTH
+httpd
+HTTPD
+httpget
+HttpGet
+HTTPS
+https
+HTTPSRR
+hyper's
+IANA
+Icecast
+ICONV
+iconv
+IDN
+IDNA
+IETF
+ietf
+ifdef
+ifdefed
+Ifdefs
+ifdefs
+ifhost
+IIS
+ILE
+illumos
+IMAP
+imap
+IMAPS
+imaps
+impacket
+implementers
+init
+initializer
+inlined
+interop
+interoperable
+interoperates
+IoT
+ipadOS
+IPCXN
+IPFS
+ipld
+IPNS
+IPv
+IPv4
+IPv4/6
+IPv6
+IRIs
+IRIX
+Itanium
+iX
+Jakub
+Jiri
+jo
+jpeg
+jq
+JSON
+json
+Julien
+Kamil
+Kaufmann
+kB
+KDE
+keepalive
+Keil
+kerberos
+Keychain
+keychain
+KiB
+kibibyte
+kickstart
+Kirei
+Knauf
+kqueue
+Krb
+krb
+Kubernetes
+Kuhrt
+Largefile
+LDAP
+ldap
+LDAPS
+ldaps
+LF
+LGPL
+LGTM
+libbacktrace
+libbrotlidec
+libc
+libcurl
+libcurl's
+libcurls
+libera
+libev
+libevent
+libgsasl
+libidn
+libnssckbi
+libnsspem
+libpsl
+Libre
+libre
+LibreSSL
+librtmp
+libs
+libssh
+libssh2
+libtest
+libtests
+Libtool
+libtool
+libuv
+libWebSocket
+libz
+libzstd
+LineageOS
+linter
+linux
+lldb
+ln
+localhost
+LOGDIR
+logfile
+lookups
+loopback
+LOWCOST
+LOWDELAY
+LPRT
+LSB
+lseek
+Lua
+lwIP
+macdef
+macOS
+macos
+Makefile
+makefiles
+malloc
+mallocs
+manpage
+manpages
+maprintf
+Marek
+Mavrogiannopoulos
+Mbed
+mbedTLS
+md
+mebibyte
+Meglio
+memdebug
+MesaLink
+mesalink
+Metalink
+mfprintf
+Michal
+Micrium
+MicroBlaze
+MicroOS
+middlebox
+MINCOST
+mingw
+MinGW
+MINIX
+misconfigured
+Mishyn
+mitigations
+MITM
+mk
+mkdir
+mktime
+Monnerat
+monospace
+MorphOS
+MPE
+MPL
+mprintf
+MPTCP
+MQTT
+mqtt
+mqtts
+MSB
+MSGSENT
+msh
+MSIE
+msnprintf
+msprintf
+msquic
+mstate
+MSVC
+MSYS
+msys
+mtime
+mTLS
+MUA
+multicwd
+multiparts
+multipath
+MultiSSL
+mumbo
+musedev
+mutex
+mvaprintf
+mvfprintf
+mvprintf
+mvsnprintf
+mvsprintf
+MX
+Nagel
+Nagle
+NAMELOOKUP
+Natively
+NATs
+nc
+NCR
+NDK
+NEC
+Necko
+NetBSD
+netrc
+netstat
+NetWare
+Netware
+NFS
+nghttp
+nghttpx
+ngtcp
+Nikos
+Nios
+nitems
+NixOS
+NLST
+nmake
+nmemb
+nocwd
+NODELAY
+NonStop
+NOOP
+Novell
+NPN
+nroff
+nslookup
+NSS
+nss
+NTLM
+NTLMUSER
+NTLMv
+NUM
+NuttX
+OAuth
+objcopy
+OCSP
+Ok
+OpenBSD
+OpenLDAP
+OpenRISC
+OpenSSF
+OpenSSF's
+OpenSSH
+OpenSSL
+OpenStep
+openSUSE
+openwall
+Orbis
+ORing
+Osipov
+OSS
+PaaS
+pac
+pacman
+parser's
+parsers
+PASE
+PASV
+PEM
+pem
+perl
+permafailing
+peta
+PINGs
+pipelining
+PKCS
+pkcs
+PKGBUILD
+PKI
+pluggable
+pn
+PolarSSL
+Polhem
+pollset
+POSIX
+Postfix
+POSTing
+POSTs
+PowerShell
+pre
+prebuilt
+precompiled
+prepend
+prepended
+prepending
+prepends
+preprocess
+preprocessed
+Preprocessing
+preprocessor
+Prereq
+PRET
+pretransfer
+printf
+printf's
+PSL
+pthreads
+PTR
+ptr
+punycode
+PWD
+pwd
+py
+pycurl
+pytest
+Pytest
+qname
+QNX
+QoS
+Qubes
+QUIC
+quictls
+quicwg
+Raad
+radix
+RAS
+RBS
+ReactOS
+README
+realloc
+Realtime
+rebalances
+rebase
+RECV
+recv
+Redhat
+redirections
+redirs
+redistributable
+Redox
+reentrant
+Referer
+referer
+reinitializes
+Relatedly
+repo
+reprioritized
+resending
+resends
+RETR
+retransmit
+retrigger
+RHEL
+Rikard
+rmdir
+ROADMAP
+Roadmap
+Rockbox
+roffit
+RPC
+RPG
+RR
+RRs
+RRtype
+RSA
+RTMP
+rtmp
+rtmpdump
+RTMPE
+RTMPS
+RTMPT
+RTMPTE
+RTMPTS
+RTOS
+RTP
+RTSP
+rtsp
+RTT
+runtests
+runtime
+Ruslan
+rustc
+Rustls
+rustls
+rustup
+Sagula
+SanDisk
+SAS
+SASL
+Satiro
+Schannel
+Schindelin
+SCO
+SCP
+scp
+SDK
+se
+SEB
+SecTrust
+SEK
+selectable
+Serv
+setopt
+setsockopt
+setuid
+SFTP
+sftp
+sha
+SHOUTcast
+SIGALRM
+SIGCHLD
+SIGPIPE
+singlecwd
+SINIX
+Sintonen
+sizeof
+SLE
+slist
+sln
+Slowloris
+SMB
+smb
+SMBS
+smbs
+SMBv
+SMTP
+smtp
+smtps
+SMTPS
+SNI
+sockd
+socketopen
+socketpair
+sockopt
+SOCKOPT
+SOCKSv
+Solaris
+SONAME
+Soref
+SOVERSION
+SPARC
+SPDX
+SPNEGO
+Spotify
+sprintf
+src
+SRP
+SRWLOCK
+SSI
+SSL
+ssl
+SSLeay
+SSLKEYLOGFILE
+SSLS
+sslv
+SSLv
+SSLVERSION
+SSPI
+stackoverflow
+STARTTLS
+STARTTRANSFER
+stateful
+statvfs
+stderr
+stdin
+stdint
+stdout
+Steinar
+Stenberg
+STLS
+STOR
+strcat
+strcpy
+strdup
+strerror
+strlen
+strncat
+struct
+structs
+Structs
+stunnel
+subdirectories
+subdirectory
+submitters
+substring
+substrings
+sudo
+SunOS
+SunSSH
+superset
+svc
+svcb
+SVCB
+SVG
+Svyatoslav
+Swisscom
+sws
+Symbian
+symlink
+symlinks
+syntaxes
+Szakats
+TABs
+Tatsuhiro
+TBD
+TCP
+tcpdump
+tera
+testability
+testcurl
+TFTP
+tftp
+threadsafe
+Tizen
+TLS
+tlsv
+TLSv
+TODO
+Tomtom
+toolchain
+toolchains
+toolset
+toplevel
+TOS
+TPF
+TrackMemory
+transcode
+Tru
+trurl
+trustless
+Tse
+Tsujikawa
+TTL
+tty
+tvOS
+txt
+typedef
+typedefed
+Ubuntu
+ucLinux
+UCRT
+UDP
+UI
+UID
+UIDL
+uint
+Ultrix
+umask
+Unary
+unassign
+UNC
+uncompress
+unencoded
+unencrypted
+unescape
+Unglobbed
+Unicode
+UNICOS
+UnixSockets
+UnixWare
+unlink
+unpause
+unpaused
+unpauses
+unpausing
+unsanitized
+Unshare
+unsharing
+untrusted
+unwrite
+UPN
+upstreaming
+URI
+URIs
+url
+URL's
+urlencoded
+urlget
+USD
+userdata
+Userinfo
+userinfo
+USERPROFILE
+UTF
+UX
+valgrind
+Vanem
+vararg
+VC
+vcpkg
+vexxhost
+Viktor
+virtualized
+Virtuozzo
+VLAN
+VM
+VMS
+VMware
+vnd
+VRF
+VRFY
+VSE
+vsftpd
+vsprintf
+vt
+vtls
+vxWorks
+wakeup
+Warta
+watchOS
+WAV
+WB
+wcurl
+WebDAV
+WebOS
+webpage
+webpages
+WebSocket
+WEBSOCKET
+Wget
+WHATWG
+whitespace
+Whitespaces
+winbind
+winbuild
+WinIDN
+WinLDAP
+winsock
+Wireshark
+wolfSSH
+wolfSSL
+ws
+WS
+WSS
+www
+Xbox
+XDG
+xdigit
+XHTML
+Xilinx
+xmllint
+XP
+Xtensa
+XYZ
+Youtube
+YYYY
+YYYYMMDD
+Zakrzewski
+Zeropath
+Zitzmann
+zlib
+zsh
+zstd
+Zuul
+zuul
diff --git a/third-party/curl/.github/scripts/pyspelling.yaml b/third-party/curl/.github/scripts/pyspelling.yaml
new file mode 100644
index 0000000000..bb0585ab7a
--- /dev/null
+++ b/third-party/curl/.github/scripts/pyspelling.yaml
@@ -0,0 +1,33 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+#
+# Docs: https://facelessuser.github.io/pyspelling/configuration/
+# Docs: https://github.com/UnicornGlobal/spellcheck-github-actions
+matrix:
+  - name: Markdown
+    expect_match: false
+    apsell:
+      mode: en
+    dictionary:
+      wordlists:
+        - wordlist.txt
+      output: wordlist.dic
+      encoding: utf-8
+    pipeline:
+      - pyspelling.filters.markdown:
+          markdown_extensions:
+            - markdown.extensions.extra:
+      - pyspelling.filters.html:
+          comments: true
+          attributes:
+            - title
+            - alt
+          ignores:
+            - ':matches(code, pre)'
+            - 'code'
+            - 'pre'
+            - 'strong'
+            - 'em'
+    sources:
+      - '**/*.md|!docs/BINDINGS.md|!docs/DISTROS.md|!docs/CIPHERS-TLS12.md|!docs/wcurl.md|!tests/data/data*.md'
diff --git a/third-party/curl/.github/scripts/randcurl.pl b/third-party/curl/.github/scripts/randcurl.pl
new file mode 100644
index 0000000000..2c24a6b500
--- /dev/null
+++ b/third-party/curl/.github/scripts/randcurl.pl
@@ -0,0 +1,251 @@
+#!/usr/bin/env perl
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+#
+# Input: number of seconds to run.
+#
+# 1. Figure out all existing command line options
+# 2. Generate random command line using supported options
+# 3. Run the command line
+# 4. Verify that it does not return an unexpected return code
+# 5. Iterate until the time runs out
+#
+# Do the same with regular command lines as well as reading the options from a
+# -K config file
+#
+# BEWARE: this may create a large amount of files using random names in the
+# directory where it runs.
+#
+
+use strict;
+use warnings;
+
+my $curl = "../src/curl";
+my $url = "localhost:7777"; # not listening to this
+
+my $seconds = $ARGV[0];
+if($ARGV[1]) {
+    $curl = $ARGV[1];
+}
+
+if(!$seconds) {
+    $seconds = 10;
+}
+print "Run $curl for $seconds seconds\n";
+
+my @opt;
+my %arg;
+my %uniq;
+my %allrc;
+
+my $totalargs = 0;
+my $totalcmds = 0;
+
+my $counter = 0xabcdef + time();
+sub getnum {
+    my ($max) = @_;
+    return int(rand($max));
+}
+
+sub storedata {
+    my ($short, $long, $arg) = @_;
+    push @opt, "-$short" if($short);
+    push @opt, "--$long";
+
+    if($arg =~ /^</) {
+        # these take an argument
+        $arg{"-$short"} = $arg if($short);
+        $arg{"--$long"} = $arg;
+    }
+}
+
+sub getoptions {
+    my @all = qx($curl --help all);
+    for my $o (@all) {
+        chomp $o;
+        if($o =~ /^ -(.), --([^ ]*) (.*)/) {
+            storedata($1, $2, $3);
+        }
+        elsif($o =~ /^     --([^ ]*) (.*)/) {
+            storedata("", $1, $2);
+        }
+    }
+}
+
+# this adds a fake randomly generated command line option
+sub addarg {
+    my $nice = "abcdefhijklmnopqrstuvwqxyz".
+        "ABCDEFHIJKLMNOPQRSTUVWQXYZ".
+        "0123456789-";
+    my $len = getnum(20) + 2;
+    my $o;
+    for (1 .. $len) {
+        $o .= substr($nice, getnum(length($nice)), 1);
+    }
+    return "--$o";
+}
+
+sub randarg {
+    my $nice = "abcdefhijklmnopqrstuvwqxyz".
+        "ABCDEFHIJKLMNOPQRSTUVWQXYZ".
+        "0123456789".
+        ",-?#$%!@ ";
+    my $len = getnum(20);
+    my $o = '';
+    for (1 .. $len) {
+        $o .= substr($nice, getnum(length($nice)), 1);
+    }
+    return "\'$o\'";
+}
+
+getoptions();
+
+my $nopts = scalar(@opt);
+
+my %useropt = (
+    '-U' => 1,
+    '-u' => 1,
+    '--user' => 1,
+    '--proxy-user' => 1);
+
+my %commonrc = (
+    '0' => 1,
+    '1' => 1,
+    '2' => 1,
+    '26' => 1,
+    );
+
+sub runone {
+    my $a;
+    my $nargs = getnum(60) + 1;
+
+    $totalargs += $nargs;
+    $totalcmds++;
+    for (1 .. $nargs) {
+        my $o = getnum($nopts);
+        my $option = $opt[$o];
+        my $ar = "";
+        $uniq{$option}++;
+        if($arg{$option}) {
+            $ar = " ".randarg();
+
+            if($useropt{$option}) {
+                # append password to avoid prompting
+                $ar .= ":".randarg();
+            }
+        }
+        $a .= sprintf(" %s%s", $option, $ar);
+    }
+    if(getnum(100) < 15) {
+        # add a fake arg
+        $a .= " ".addarg();
+    }
+
+    my $cmd = "$curl$a $url";
+
+    my $rc = system("$cmd >curl-output 2>&1 </dev/null -M 0.1") >> 8;
+    #my $rc = system("valgrind -q $cmd >/dev/null 2>&1 </dev/null -M 0.1") >> 8;
+
+    $allrc{$rc}++;
+
+    #print "CMD: $cmd\n";
+    if(!$commonrc{$rc}) {
+        print "CMD: $cmd\n";
+        print "RC: $rc\n";
+        print "== curl-output == \n";
+        open(D, "<curl-output");
+        my @out = <D>;
+        print @out;
+        close(D);
+        exit;
+    }
+}
+
+sub runconfig {
+    my $a;
+    my $nargs = getnum(80) + 1;
+
+    open(C, ">config");
+
+    $totalargs += $nargs;
+    $totalcmds++;
+    for (1 .. $nargs) {
+        my $o = getnum($nopts);
+        my $option = $opt[$o];
+        my $ar = "";
+        $uniq{$option} = 0 if(!exists $uniq{$option});
+        $uniq{$option}++;
+        if($arg{$option}) {
+            $ar = " ".randarg();
+
+            if($useropt{$option}) {
+                # append password
+                $ar .= ":".randarg();
+            }
+        }
+        $a .= sprintf("\n%s%s", $option, $ar);
+    }
+    if(getnum(100) < 15) {
+        # add a fake arg
+        $a .= "\n".addarg();
+    }
+
+    print C "$a\n";
+    close(C);
+
+    my $cmd = "$curl -K config $url";
+
+    my $rc = system("$cmd >curl-output 2>&1 </dev/null -M 0.1") >> 8;
+
+    $allrc{$rc}++;
+
+    if(!$commonrc{$rc}) {
+        print "CMD: $cmd\n";
+        print "RC: $rc\n";
+        print "== config == \n";
+        open(D, "<config");
+        my @all = <D>;
+        print @all;
+        close(D);
+        print "\n== curl-output == \n";
+        open(D, "<curl-output");
+        my @out = <D>;
+        print @out;
+        close(D);
+        exit 2;
+    }
+}
+
+# run curl command lines using -K
+my $end = time() + $seconds / 2;
+my $c = 0;
+print "Running command lines\n";
+do {
+    runconfig();
+    $c++;
+} while(time() <= $end);
+print "$c command lines\n";
+
+# run curl command lines
+$end = time() + $seconds / 2;
+$c = 0;
+print "Running config lines\n";
+do {
+    runone();
+    $c++;
+} while(time() <= $end);
+
+print "$c config line uses\n";
+
+print "Recorded exit codes:\n";
+for my $rc (keys %allrc) {
+    printf " %2d: %d times\n", $rc, $allrc{$rc};
+}
+printf "Number or command lines tested:\n".
+    " $totalcmds (%.1f/second)\n", $totalcmds/$seconds;
+printf "Number or command line options tested:\n".
+    " $totalargs (average %.1f per command line)\n",
+    $totalargs/$totalcmds;
+printf "Number or different options tested:\n".
+    " %u out of %u\n", scalar(keys %uniq), $nopts;
diff --git a/third-party/curl/.github/scripts/requirements-docs.txt b/third-party/curl/.github/scripts/requirements-docs.txt
new file mode 100644
index 0000000000..6850461de7
--- /dev/null
+++ b/third-party/curl/.github/scripts/requirements-docs.txt
@@ -0,0 +1,5 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+pyspelling==2.12.1
diff --git a/third-party/curl/.github/scripts/requirements-proselint.txt b/third-party/curl/.github/scripts/requirements-proselint.txt
new file mode 100644
index 0000000000..1896109442
--- /dev/null
+++ b/third-party/curl/.github/scripts/requirements-proselint.txt
@@ -0,0 +1,5 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+proselint==0.16.0
diff --git a/third-party/curl/.github/scripts/requirements.txt b/third-party/curl/.github/scripts/requirements.txt
new file mode 100644
index 0000000000..adf6d03ba4
--- /dev/null
+++ b/third-party/curl/.github/scripts/requirements.txt
@@ -0,0 +1,8 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+cmakelang==0.6.13
+codespell==2.4.2
+reuse==6.2.0
+ruff==0.15.16
diff --git a/third-party/curl/.github/scripts/shellcheck-ci.sh b/third-party/curl/.github/scripts/shellcheck-ci.sh
new file mode 100644
index 0000000000..87e03b9d12
--- /dev/null
+++ b/third-party/curl/.github/scripts/shellcheck-ci.sh
@@ -0,0 +1,30 @@
+#!/bin/sh
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+# Required: yq
+
+set -eu
+
+export SHELLCHECK_OPTS='--exclude=1090,1091,2086,2153 --enable=avoid-nullary-conditions,deprecate-which'
+
+# GHA
+git ls-files '.github/workflows/*.yml' | while read -r f; do
+  echo "Verifying ${f}..."
+  {
+    echo '#!/usr/bin/env bash'
+    echo 'set -eu'
+    yq eval '.. | select(has("run") and (.run | type == "!!str")) | .run + "\ntrue\n"' "${f}"
+  } | sed -E 's|\$\{\{ .+ \}\}|GHA_EXPRESSION|g' | shellcheck -
+done
+
+# Circle CI
+git ls-files '.circleci/*.yml' | while read -r f; do
+  echo "Verifying ${f}..."
+  {
+    echo '#!/usr/bin/env bash'
+    echo 'set -eu'
+    yq eval '.. | select(has("command") and (.command | type == "!!str")) | .command + "\ntrue\n"' "${f}"
+  } | shellcheck -
+done
diff --git a/third-party/curl/.github/scripts/shellcheck.sh b/third-party/curl/.github/scripts/shellcheck.sh
new file mode 100644
index 0000000000..59b49131ac
--- /dev/null
+++ b/third-party/curl/.github/scripts/shellcheck.sh
@@ -0,0 +1,13 @@
+#!/bin/sh
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+set -eu
+
+cd "$(dirname "${0}")"/../..
+
+git grep -z -l -E '^#!(/usr/bin/env bash|/bin/sh|/bin/bash)' | xargs -0 -r \
+shellcheck --exclude=1091,2248 \
+  --enable=avoid-nullary-conditions,deprecate-which \
+  --
diff --git a/third-party/curl/.github/scripts/spellcheck.curl b/third-party/curl/.github/scripts/spellcheck.curl
new file mode 100644
index 0000000000..1d8be5ed3e
--- /dev/null
+++ b/third-party/curl/.github/scripts/spellcheck.curl
@@ -0,0 +1,153 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+#
+# common variable types + structs
+# callback typedefs
+# public functions names
+# some man page names
+curl_fileinfo
+curl_forms
+curl_hstsentry
+curl_httppost
+curl_index
+curl_khkey
+curl_pushheaders
+curl_waitfd
+CURLcode
+CURLformoption
+CURLHcode
+CURLMcode
+CURLMsg
+CURLSHcode
+CURLUcode
+curl_calloc_callback
+curl_chunk_bgn_callback
+curl_chunk_end_callback
+curl_conv_callback
+curl_debug_callback
+curl_fnmatch_callback
+curl_formget_callback
+curl_free_callback
+curl_hstsread_callback
+curl_hstswrite_callback
+curl_ioctl_callback
+curl_malloc_callback
+curl_multi_timer_callback
+curl_opensocket_callback
+curl_prereq_callback
+curl_progress_callback
+curl_push_callback
+curl_read_callback
+curl_realloc_callback
+curl_resolver_start_callback
+curl_seek_callback
+curl_socket_callback
+curl_sockopt_callback
+curl_ssl_ctx_callback
+curl_strdup_callback
+curl_trailer_callback
+curl_write_callback
+curl_xferinfo_callback
+curl_strequal
+curl_strnequal
+curl_mime_init
+curl_mime_free
+curl_mime_addpart
+curl_mime_name
+curl_mime_filename
+curl_mime_type
+curl_mime_encoder
+curl_mime_data
+curl_mime_filedata
+curl_mime_data_cb
+curl_mime_subparts
+curl_mime_headers
+curl_formadd
+curl_formget
+curl_formfree
+curl_getdate
+curl_getenv
+curl_version
+curl_easy_escape
+curl_escape
+curl_easy_unescape
+curl_unescape
+curl_free
+curl_global_init
+curl_global_init_mem
+curl_global_cleanup
+curl_global_trace
+curl_global_sslset
+curl_slist_append
+curl_slist_free_all
+curl_getdate
+curl_share_init
+curl_share_setopt
+curl_share_cleanup
+curl_version_info
+curl_easy_strerror
+curl_share_strerror
+curl_easy_pause
+curl_easy_ssls_import
+curl_easy_ssls_export
+curl_easy_init
+curl_easy_setopt
+curl_easy_perform
+curl_easy_cleanup
+curl_easy_getinfo
+curl_easy_duphandle
+curl_easy_reset
+curl_easy_recv
+curl_easy_send
+curl_easy_upkeep
+curl_easy_header
+curl_easy_nextheader
+curl_mprintf
+curl_mfprintf
+curl_msprintf
+curl_msnprintf
+curl_mvprintf
+curl_mvfprintf
+curl_mvsprintf
+curl_mvsnprintf
+curl_maprintf
+curl_mvaprintf
+curl_multi_init
+curl_multi_add_handle
+curl_multi_remove_handle
+curl_multi_fdset
+curl_multi_waitfds
+curl_multi_wait
+curl_multi_poll
+curl_multi_wakeup
+curl_multi_perform
+curl_multi_cleanup
+curl_multi_info_read
+curl_multi_strerror
+curl_multi_socket
+curl_multi_socket_action
+curl_multi_socket_all
+curl_multi_timeout
+curl_multi_setopt
+curl_multi_assign
+curl_multi_get_handles
+curl_multi_get_offt
+curl_multi_notify_disable
+curl_multi_notify_enable
+curl_pushheader_bynum
+curl_pushheader_byname
+curl_easy_option_by_name
+curl_easy_option_by_id
+curl_easy_option_next
+curl_url
+curl_url_cleanup
+curl_url_dup
+curl_url_get
+curl_url_set
+curl_url_strerror
+curl_ws_recv
+curl_ws_send
+curl_ws_meta
+libcurl-env
+libcurl-ws
diff --git a/third-party/curl/.github/scripts/spellcheck.words b/third-party/curl/.github/scripts/spellcheck.words
deleted file mode 100644
index 11be5ba76e..0000000000
--- a/third-party/curl/.github/scripts/spellcheck.words
+++ /dev/null
@@ -1,909 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-#
-ABI
-accessor
-ACK
-AES
-AIA
-AIX
-al
-Alessandro
-allocator
-alnum
-ALPN
-Altera
-ALTSVC
-amiga
-AmigaOS
-AmiSSL
-anyauth
-anycast
-apache
-Apache
-API
-APIs
-APOP
-AppVeyor
-archivers
-Archos
-Arntsen
-Aros
-ascii
-asynch
-AsynchDNS
-atime
-auth
-autobuild
-autobuilds
-Autoconf
-Automake
-Autotools
-autotools
-AVR
-AWS
-AWS-LC
-axTLS
-backend
-backends
-backoff
-backticks
-Baratov
-basename
-bashrc
-BDFL
-BearSSL
-Benoit
-BeOS
-bitmask
-bitwise
-Björn
-Bjørn
-bool
-boolean
-BoringSSL
-boringssl
-Boukris
-Broadcom
-brotli
-bufq
-bufref
-bugfix
-bugfixes
-buildable
-buildbot
-buildconf
-Caddy
-calloc
-CAPA
-capath
-CCC
-CDN
-CentOS
-CFLAGS
-CGI's
-CHACHA
-chacha
-Chaffraix
-changelog
-changeset
-CharConv
-charset
-charsets
-checksrc
-checksums
-chgrp
-chmod
-chown
-ChromeOS
-CI's
-CIDR
-CIFS
-CLA
-CLAs
-cleartext
-CLI
-clientp
-cliget
-closesocket
-CMake
-cmake
-cmake's
-CMakeLists
-CodeQL
-codeql
-CODESET
-codeset
-Comcast
-Config
-config
-conncache
-connectdata
-CookieInfo
-Coverity
-CPUs
-CR
-CRL
-CRLF
-crt
-crypto
-cryptographic
-cryptographically
-CSEQ
-CSeq
-csh
-cshrc
-CTRL
-cURL
-CURLcode
-CURLE
-CURLH
-curlimages
-curlrc
-curltest
-customizable
-CVE
-CVSS
-CWD
-CWE
-cyassl
-Cygwin
-daniel
-datatracker
-Debian
-decrypt
-deepcode
-DELE
-DER
-deselectable
-destructor
-detections
-dev
-devcpp
-DevOps
-devtools
-DHCP
-dir
-distro
-distro's
-distros
-DJGPP
-dlist
-DLL
-dll
-DLLs
-DNS
-dns
-dnsop
-DoH
-doxygen
-drftpd
-dsa
-Dudka
-Dymond
-dynbuf
-EAGAIN
-EBCDIC
-ECC
-ECDHE
-ECH
-ECONNREFUSED
-eCOS
-EFnet
-EGD
-EHLO
-EINTR
-else's
-encodings
-enctype
-endianness
-Engler
-enum
-epoll
-EPRT
-EPSV
-ERRNO
-errno
-ESNI
-et
-etag
-ETag
-ETags
-exe
-executables
-EXPN
-extensibility
-failsafe
-Falkeborn
-Fandrich
-Fastly
-fcpp
-Fedora
-Feltzing
-ffi
-filesize
-filesystem
-FLOSS
-fnmatch
-formpost
-formposts
-Fortnite
-FOSS
-FPL
-fread
-FreeBSD
-FreeDOS
-FreeRTOS
-freshmeat
-Frexx
-FS
-fseek
-FTPing
-fuzzer
-fwrite
-Garmin
-gcc
-GCM
-gdb
-Genode
-Gentoo
-Gergely
-getaddrinfo
-getenv
-gethostbyname
-gethostname
-Getinfo
-getinfo
-GETing
-getpwuid
-ggcov
-Ghedini
-Gisle
-Glesys
-globbed
-globbing
-gmail
-GnuTLS
-gnutls
-Golemon
-GOST
-GPG
-GPL
-GPLed
-Greear
-groff
-GSKit
-gskit
-GSS
-GSSAPI
-GTFO
-Guenter
-Gunderson
-Gustafsson
-gzip
-Gzipped
-gzipped
-HackerOne
-HackerOne's
-HAProxy
-HardenedBSD
-Hards
-Haxx
-haxx
-Heimdal
-HELO
-HH
-HMAC
-Hoersken
-Holme
-homebrew
-hostname
-hostnames
-Housley
-Hruska
-HSTS
-hsts
-HTC
-html
-http
-HTTPAUTH
-httpd
-HTTPD
-httpget
-HttpGet
-HTTPS
-https
-hyper's
-Högskolan
-IANA
-Icecast
-ICONV
-iconv
-IDN
-IDNA
-IETF
-ietf
-ifdef
-ifdefed
-Ifdefs
-ifdefs
-IIS
-ILE
-Illumos
-IMAP
-imap
-IMAPS
-imaps
-impacket
-init
-initializer
-inlined
-interop
-interoperable
-interoperates
-IoT
-ipadOS
-IPCXN
-IPv
-IPv4
-IPv4/6
-IPv6
-IRIs
-IRIX
-Itanium
-iX
-Jakub
-Jiri
-jo
-jpeg
-jq
-JSON
-json
-Julien
-Kamil
-Kaufmann
-kB
-KDE
-keepalive
-Keil
-kerberos
-Keychain
-keychain
-KiB
-kickstart
-Kirei
-Knauf
-kqueue
-Krb
-krb
-Kubernetes
-Kuhrt
-Kungliga
-Largefile
-LDAP
-ldap
-LDAPS
-ldaps
-LF
-LGTM
-libbrotlidec
-libc
-libcurl
-libcurl's
-libcurls
-libera
-libev
-libevent
-libgsasl
-libidn
-libnssckbi
-libnsspem
-libpsl
-Libre
-libre
-LibreSSL
-libressl
-librtmp
-libs
-libssh
-libSSH
-libssh2
-Libtool
-libuv
-libWebSocket
-libz
-libzstd
-LineageOS
-linux
-ln
-localhost
-LOGDIR
-logfile
-lookups
-loopback
-LPRT
-LSB
-lseek
-Lua
-lwIP
-macdef
-macOS
-macos
-Makefile
-makefiles
-malloc
-mallocs
-maprintf
-Marek
-Mavrogiannopoulos
-Mbed
-mbedTLS
-Meglio
-memdebug
-MesaLink
-mesalink
-Metalink
-mfprintf
-Michal
-Micrium
-MicroBlaze
-MicroOS
-mingw
-MinGW
-MINIX
-misconfigured
-Mishyn
-mitigations
-MITM
-mk
-mkdir
-mktime
-Monnerat
-monospace
-MorphOS
-MPE
-MPL
-mprintf
-MQTT
-mqtt
-mqtts
-MSB
-MSGSENT
-msh
-MSIE
-msnprintf
-msprintf
-msquic
-mstate
-MSVC
-MSYS
-msys
-mtime
-mTLS
-MUA
-multicwd
-multiparts
-MultiSSL
-mumbo
-musedev
-mutex
-mvaprintf
-mvfprintf
-mvprintf
-mvsnprintf
-mvsprintf
-MX
-Nagel
-Nagle
-NAMELOOKUP
-Natively
-NATs
-nc
-NCR
-NDK
-NEC
-Necko
-NetBSD
-netrc
-netstat
-Netware
-NFS
-nghttp
-nghttpx
-ngtcp
-Nikos
-Nios
-nitems
-NixOS
-NLST
-nmake
-nmemb
-nocwd
-NODELAY
-NonStop
-NOOP
-Novell
-NPN
-nroff
-nslookup
-NSS
-nss
-NTLM
-NTLMUSER
-NTLMv
-NUM
-NuttX
-OAuth
-objcopy
-OCSP
-Ok
-OpenBSD
-OpenLDAP
-OpenRISC
-OpenSSF
-OpenSSF's
-OpenSSH
-OpenSSL
-OpenStep
-openSUSE
-openwall
-Orbis
-ORing
-Osipov
-OSS
-pac
-pacman
-parser's
-parsers
-PASE
-PASV
-PEM
-pem
-perl
-permafailing
-PINGs
-pipelining
-PKCS
-pkcs
-PKGBUILD
-PKI
-pluggable
-PolarSSL
-Polhem
-pollset
-POSIX
-Postfix
-POSTing
-POSTs
-PowerShell
-pre
-prebuilt
-precompiled
-prepend
-prepended
-prepending
-prepends
-preprocess
-preprocessed
-Preprocessing
-preprocessor
-Prereq
-PRET
-pretransfer
-printf
-printf's
-PSL
-pthreads
-PTR
-ptr
-punycode
-PWD
-pwd
-py
-pycurl
-pytest
-Pytest
-QNX
-QoS
-Qubes
-QUIC
-quictls
-quicwg
-Raad
-radix
-RAS
-RBS
-ReactOS
-README
-realloc
-Realtime
-rebase
-RECV
-recv
-Redhat
-redirections
-redirs
-redistributable
-Redox
-reentrant
-Referer
-referer
-reinitializes
-Relatedly
-repo
-reprioritized
-resending
-resends
-RETR
-retransmit
-retrigger
-RHEL
-RICS
-Rikard
-rmdir
-ROADMAP
-Roadmap
-Rockbox
-roffit
-RPG
-RSA
-RTMP
-rtmp
-RTMPE
-RTMPS
-RTMPT
-RTMPTE
-RTMPTS
-RTOS
-RTP
-RTSP
-rtsp
-RTT
-runtests
-runtime
-Ruslan
-rustc
-rustls
-Sagula
-SanDisk
-SAS
-SASL
-Satiro
-Schannel
-Schindelin
-SCO
-SCP
-scp
-SDK
-se
-SEB
-SEK
-selectable
-Serv
-setopt
-setsockopt
-setuid
-SFTP
-sftp
-sha
-SHOUTcast
-SIGALRM
-SIGCHLD
-SIGPIPE
-singlecwd
-SINIX
-Sintonen
-sizeof
-SLE
-slist
-sln
-SMB
-smb
-SMBS
-smbs
-SMBv
-SMTP
-smtp
-smtps
-SMTPS
-SNI
-socketopen
-socketpair
-sockopt
-SOCKOPT
-SOCKSv
-Solaris
-SONAME
-Soref
-SPARC
-SPDX
-SPNEGO
-Spotify
-sprintf
-src
-SRP
-SRWLOCK
-SSL
-ssl
-SSLeay
-SSLKEYLOGFILE
-sslv
-SSLv
-SSLVERSION
-SSPI
-stackoverflow
-STARTTLS
-STARTTRANSFER
-stateful
-statvfs
-stderr
-stdin
-stdout
-Steinar
-Stenberg
-STOR
-strcat
-strcpy
-strdup
-strerror
-strlen
-strncat
-struct
-structs
-Structs
-stunnel
-subdirectories
-subdirectory
-submitters
-substring
-substrings
-SunOS
-SunSSH
-superset
-svc
-svcb
-Svyatoslav
-Swisscom
-sws
-Symbian
-symlink
-symlinks
-syntaxes
-Szakats
-TABs
-Tatsuhiro
-TBD
-TCP
-tcpdump
-Tekniska
-testability
-TFTP
-tftp
-Tizen
-TLS
-tlsv
-TLSv
-TODO
-Tomtom
-toolchain
-toolchains
-toolset
-toplevel
-TPF
-TrackMemory
-transcode
-Tru
-Tse
-Tsujikawa
-TTL
-tvOS
-txt
-typedef
-typedefed
-Ubuntu
-ucLinux
-UDP
-UI
-UID
-UIDL
-Ultrix
-Unary
-unassign
-UNC
-uncompress
-unencoded
-unencrypted
-unescape
-Unglobbed
-UNICOS
-unix
-UnixSockets
-UnixWare
-unlink
-unpause
-unpaused
-unpauses
-unpausing
-unsanitized
-Unshare
-unsharing
-untrusted
-UPN
-upstreaming
-URI
-URIs
-url
-URL's
-urlencoded
-urlget
-USD
-userdata
-Userinfo
-userinfo
-USERPROFILE
-UTF
-UX
-valgrind
-Vanem
-vararg
-VC
-vcpkg
-vexxhost
-Viktor
-VM
-VMS
-VMware
-VRF
-VRFY
-VSE
-vsprintf
-vt
-vtls
-vxWorks
-wakeup
-Warta
-watchOS
-WAV
-WB
-web page
-WebDAV
-WebOS
-WebSocket
-WEBSOCKET
-WHATWG
-whitespace
-Whitespaces
-winbind
-WinBind
-winbuild
-winidn
-WinIDN
-WinLDAP
-WinSock
-winsock
-WinSSL
-winssl
-Wireshark
-wolfSSH
-wolfSSL
-WS
-WSS
-www
-Xbox
-XDG
-xdigit
-Xilinx
-XP
-Xtensa
-XYZ
-Youtube
-YYYY
-YYYYMMDD
-Zakrzewski
-Zitzmann
-zlib
-zsh
-zstd
-Zuul
-zuul
diff --git a/third-party/curl/.github/scripts/spellcheck.yaml b/third-party/curl/.github/scripts/spellcheck.yaml
deleted file mode 100644
index 4e4e13d48c..0000000000
--- a/third-party/curl/.github/scripts/spellcheck.yaml
+++ /dev/null
@@ -1,32 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-#
-# Docs: https://github.com/UnicornGlobal/spellcheck-github-actions
-matrix:
-- name: Markdown
-  expect_match: false
-  apsell:
-    mode: en
-  dictionary:
-    wordlists:
-    - wordlist.txt
-    output: wordlist.dic
-    encoding: utf-8
-  pipeline:
-  - pyspelling.filters.markdown:
-      markdown_extensions:
-      - markdown.extensions.extra:
-  - pyspelling.filters.html:
-      comments: true
-      attributes:
-      - title
-      - alt
-      ignores:
-      - ':matches(code, pre)'
-      - 'code'
-      - 'pre'
-      - 'strong'
-      - 'em'
-  sources:
-  - '**/*.md|!docs/BINDINGS.md'
diff --git a/third-party/curl/.github/scripts/trimmarkdownheader.pl b/third-party/curl/.github/scripts/trimmarkdownheader.pl
new file mode 100644
index 0000000000..89b2e7d9fd
--- /dev/null
+++ b/third-party/curl/.github/scripts/trimmarkdownheader.pl
@@ -0,0 +1,44 @@
+#!/usr/bin/env perl
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+#
+# Given: a libcurl curldown man page
+# Outputs: the same file, minus the header
+#
+
+use strict;
+use warnings;
+
+my $f = $ARGV[0] || '';
+
+open(F, "<$f") or die;
+
+my @out;
+my $line = 0;
+my $hideheader = 0;
+
+while(<F>) {
+    if($hideheader) {
+        if(/^---/) {
+            # end if hiding
+            $hideheader = 0;
+        }
+        push @out, "\n"; # replace with blank
+        next;
+    }
+    elsif(!$line++ && /^---/) {
+        # starts with a header, strip off the header
+        $hideheader = 1;
+        push @out, "\n"; # replace with blank
+        next;
+    }
+    push @out, $_;
+}
+close(F);
+
+open(O, ">$f") or die;
+for my $l (@out) {
+    print O $l;
+}
+close(O);
diff --git a/third-party/curl/.github/scripts/typos.sh b/third-party/curl/.github/scripts/typos.sh
new file mode 100644
index 0000000000..76735c1d9f
--- /dev/null
+++ b/third-party/curl/.github/scripts/typos.sh
@@ -0,0 +1,14 @@
+#!/bin/sh
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+set -eu
+
+cd "$(dirname "${0}")"/../..
+
+git ls-files | typos \
+  --isolated \
+  --force-exclude \
+  --config '.github/scripts/typos.toml' \
+  --file-list -
diff --git a/third-party/curl/.github/scripts/typos.toml b/third-party/curl/.github/scripts/typos.toml
new file mode 100644
index 0000000000..3192a2987c
--- /dev/null
+++ b/third-party/curl/.github/scripts/typos.toml
@@ -0,0 +1,36 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+[default]
+extend-ignore-identifiers-re = [
+  "^(ba|fo|pn|PN|UE)$",
+  "^(CNA|cpy|ser)$",
+  "^(ECT0|ECT1|HELO|htpts|mport|PASE)$",
+  "^[A-Za-z0-9_-]*(EDE|GOST)[A-Z0-9_-]*$",  # ciphers
+  "^0x[0-9a-fA-F]+FUL$",  # unsigned long hex literals ending with 'F'
+   "^[0-9a-zA-Z+]{64,}$",  # possibly base64
+  "^(eyeballers|HELO_smtp|Januar|optin|passin|perfec|SMTP_HELO)$",
+  "^(clen|req_clen|smtp_perform_helo|smtp_state_helo_resp|Tru64|_stati64)$",
+  "(_ccontains|_controllen|O_WRONLY|secur32)",
+  "proxys",  # this should be limited to tests/http/*. Short for secure proxy.
+]
+
+extend-ignore-re = [
+  ".*spellchecker:disable-line",
+]
+
+[files]
+extend-exclude = [
+  ".github/scripts/codespell-ignore.words",
+  ".github/scripts/pyspelling.words",
+  "docs/THANKS",
+  "projects/OS400/*",
+  "projects/vms/*",
+  "projects/Windows/tmpl/curl.vcxproj",
+  "projects/Windows/tmpl/libcurl.vcxproj",
+  "RELEASE-NOTES",
+  "scripts/wcurl",
+  "tests/data/test*",
+  "tests/unit/unit1625.c",
+]
diff --git a/third-party/curl/.github/scripts/verify-examples.pl b/third-party/curl/.github/scripts/verify-examples.pl
new file mode 100644
index 0000000000..a23dc412f0
--- /dev/null
+++ b/third-party/curl/.github/scripts/verify-examples.pl
@@ -0,0 +1,106 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+my @files = @ARGV;
+my $cfile = "test.c";
+my $check = "./scripts/checksrc.pl";
+my $error = 0;
+
+if(!@files || $files[0] eq "-h") {
+    print "Usage: verify-examples [markdown pages]\n";
+    exit;
+}
+
+sub testcompile {
+    my $rc = system('gcc -c test.c -I include -W -Wall -pedantic -Werror ' .
+        '-Wno-unused-parameter -Wno-unused-but-set-variable ' .
+        '-DCURL_ALLOW_OLD_MULTI_SOCKET -DCURL_DISABLE_DEPRECATION') >> 8;
+    return $rc;
+}
+
+sub checksrc {
+    my $rc = system($check, ('test.c')) >> 8;
+    return $rc;
+}
+
+sub extract {
+    my($f) = @_;
+    my $syn = 0;
+    my $l = 0;
+    my $iline = 0;
+    my $fail = 0;
+    open(F, "<$f") or die "failed opening input file $f : $!";
+    open(O, ">$cfile") or die "failed opening output file $cfile : $!";
+    print O "#include <curl/curl.h>\n";
+    while(<F>) {
+        $iline++;
+        if(/^# EXAMPLE/) {
+            $syn = 1
+        }
+        elsif($syn == 1) {
+            if(/^~~~/) {
+                $syn++;
+                print O "/* !checksrc! disable BANNEDFUNC all */\n";  # for fopen()
+                print O "/* !checksrc! disable COPYRIGHT all */\n";
+                print O "/* !checksrc! disable UNUSEDIGNORE all */\n";
+                printf O "#line %d \"$f\"\n", $iline + 1;
+            }
+        }
+        elsif($syn == 2) {
+            if(/^~~~/) {
+                last;
+            }
+            # two backslashes become one
+            $_ =~ s/\\\\/\\/g;
+            print O $_;
+            $l++;
+        }
+    }
+    close(F);
+    close(O);
+
+    return ($fail ? 0 : $l);
+}
+
+my $count = 0;
+for my $m (@files) {
+    #print "Verify $m\n";
+    my $out = extract($m);
+    if($out) {
+      $error |= testcompile($m);
+      $error |= checksrc($m);
+    }
+    $count++;
+}
+if(!$error) {
+    print "Verified $count man pages ok\n";
+}
+else {
+    print "Detected problems\n";
+}
+exit $error;
diff --git a/third-party/curl/.github/scripts/verify-synopsis.pl b/third-party/curl/.github/scripts/verify-synopsis.pl
new file mode 100644
index 0000000000..02918dd65d
--- /dev/null
+++ b/third-party/curl/.github/scripts/verify-synopsis.pl
@@ -0,0 +1,87 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+my @files = @ARGV;
+my $cfile = "test.c";
+
+if(!@files || $files[0] eq "-h") {
+    print "Usage: verify-synopsis [man pages]\n";
+    exit;
+}
+
+sub testcompile {
+    my $rc = system('gcc -c test.c -I include -W -Wall -pedantic -Werror ' .
+        '-DCURL_ALLOW_OLD_MULTI_SOCKET -DCURL_DISABLE_TYPECHECK') >> 8;
+    return $rc;
+}
+
+sub extract {
+    my($f) = @_;
+    my $syn = 0;
+    my $l = 0;
+    my $iline = 0;
+    open(F, "<$f");
+    open(O, ">$cfile");
+    while(<F>) {
+        $iline++;
+        if(/^# SYNOPSIS/) {
+            $syn = 1
+        }
+        elsif($syn == 1) {
+            if(/^\~\~\~/) {
+                $syn++;
+                print O "#line $iline \"$f\"\n";
+            }
+        }
+        elsif($syn == 2) {
+            if(/^\~\~\~/) {
+                last;
+            }
+            # turn the vararg argument into vararg
+            $_ =~ s/, parameter\)\;/, ...);/;
+            print O $_;
+            $l++;
+        }
+    }
+    close(F);
+    close(O);
+
+    if($syn < 2) {
+        print STDERR "Found no synopsis in $f\n";
+        return 1;
+    }
+
+    return 0;
+}
+
+my $error;
+for my $m (@files) {
+    $error |= extract($m);
+    $error |= testcompile($m);
+}
+exit $error;
diff --git a/third-party/curl/.github/scripts/yamlcheck.sh b/third-party/curl/.github/scripts/yamlcheck.sh
new file mode 100644
index 0000000000..4bdeff45cb
--- /dev/null
+++ b/third-party/curl/.github/scripts/yamlcheck.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+set -eu
+
+cd "$(dirname "${0}")"/../..
+
+git ls-files '*.yaml' '*.yml' -z | xargs -0 -r \
+yamllint \
+  --format standard \
+  --strict \
+  --config-data .github/scripts/yamlcheck.yaml \
+  --
diff --git a/third-party/curl/.github/scripts/yamlcheck.yaml b/third-party/curl/.github/scripts/yamlcheck.yaml
new file mode 100644
index 0000000000..a6e16410c1
--- /dev/null
+++ b/third-party/curl/.github/scripts/yamlcheck.yaml
@@ -0,0 +1,17 @@
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+#
+# Docs: https://yamllint.readthedocs.io/en/stable/configuration.html
+
+extends: default
+
+rules:
+  line-length:
+    max: 500
+    level: warning
+
+  braces: disable
+  commas: disable
+  comments: disable
+  document-start: disable
diff --git a/third-party/curl/.github/stale.yml b/third-party/curl/.github/stale.yml
index dc239b56ce..1c2b57c2cf 100644
--- a/third-party/curl/.github/stale.yml
+++ b/third-party/curl/.github/stale.yml
@@ -6,7 +6,7 @@
 daysUntilStale: 180
 # Number of days of inactivity before a stale issue is closed
 daysUntilClose: 14
-# Issues with these labels will never be considered stale
+# Issues with these labels are never considered stale
 exemptLabels:
   - pinned
   - security
@@ -15,7 +15,7 @@ staleLabel: stale
 # Comment to post when marking an issue as stale. Set to `false` to disable
 markComment: >
   This issue has been automatically marked as stale because it has not had
-  recent activity. It will be closed if no further activity occurs. Thank you
+  recent activity. It is closed if no further activity occurs. Thank you
   for your contributions.
 # Comment to post when closing a stale issue. Set to `false` to disable
 closeComment: false
diff --git a/third-party/curl/.github/workflows/appveyor-status.yml b/third-party/curl/.github/workflows/appveyor-status.yml
index df54422ff7..c821771fc4 100644
--- a/third-party/curl/.github/workflows/appveyor-status.yml
+++ b/third-party/curl/.github/workflows/appveyor-status.yml
@@ -2,9 +2,9 @@
 #
 # SPDX-License-Identifier: curl
 
-name: AppVeyor Status Report
+name: 'AppVeyor Status Report'
 
-on:
+'on':
   status
 
 concurrency:
@@ -15,20 +15,22 @@ permissions: {}
 
 jobs:
   split:
-    runs-on: ubuntu-latest
+    name: 'split'
+    runs-on: ubuntu-24.04-arm
     if: ${{ github.event.sender.login == 'appveyor[bot]' }}
     permissions:
-      statuses: write
+      statuses: write  # To update build statuses
     steps:
-      - name: Create individual AppVeyor build statuses
+      - name: 'Create individual AppVeyor build statuses'
         if: ${{ github.event.sha && github.event.target_url }}
         env:
           APPVEYOR_COMMIT_SHA: ${{ github.event.sha }}
           APPVEYOR_TARGET_URL: ${{ github.event.target_url }}
           APPVEYOR_REPOSITORY: ${{ github.event.repository.full_name }}
+          DO_NOT_TRACK: '1'  # for gh
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          echo ${APPVEYOR_TARGET_URL} | sed 's/\/project\//\/api\/projects\//' | xargs -t -n1 curl -s | \
+          echo "${APPVEYOR_TARGET_URL}" | sed 's/\/project\//\/api\/projects\//' | xargs -t -n1 curl -s -- | \
             jq -c '.build.jobs[] | {target_url: ($target_url + "/job/" + .jobId),
                                     context: (.name | sub("^(Environment: )?"; "AppVeyor / ")),
                                     state: (.status | sub("queued"; "pending")
@@ -37,5 +39,5 @@ jobs:
                                                     | sub("failed"; "failure")
                                                     | sub("cancelled"; "error")),
                                     description: .status}' \
-                --arg target_url ${APPVEYOR_TARGET_URL} | tee /dev/stderr | parallel --pipe -j 1 -N 1 \
-              gh api --silent --input - repos/${APPVEYOR_REPOSITORY}/statuses/${APPVEYOR_COMMIT_SHA}
+                --arg target_url "${APPVEYOR_TARGET_URL}" | tee /dev/stderr | parallel --pipe -j 1 -N 1 \
+              gh api --silent --input - "repos/${APPVEYOR_REPOSITORY}/statuses/${APPVEYOR_COMMIT_SHA}"
diff --git a/third-party/curl/.github/workflows/awslc.yml b/third-party/curl/.github/workflows/awslc.yml
deleted file mode 100644
index d183389c40..0000000000
--- a/third-party/curl/.github/workflows/awslc.yml
+++ /dev/null
@@ -1,152 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: Linux AWS-LC
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-    paths-ignore:
-    - '**/*.md'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-  pull_request:
-    branches:
-    - master
-    paths-ignore:
-    - '**/*.md'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-
-concurrency:
-  # Hardcoded workflow filename as workflow name above is just Linux again
-  group: awslc-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-env:
-  MAKEFLAGS: -j 3
-  awslc-version: 1.13.0
-
-jobs:
-  autoconf:
-    name: awslc (autoconf)
-    runs-on: 'ubuntu-latest'
-    timeout-minutes: 30
-
-    steps:
-    - run: |
-        sudo apt-get update --yes
-        sudo apt-get install --yes libtool autoconf automake pkg-config stunnel4
-        # ensure we don't pick up openssl in this build
-        sudo apt remove --yes libssl-dev
-        sudo python3 -m pip install impacket
-      name: 'install prereqs and impacket'
-
-    - name: cache awslc
-      uses: actions/cache@v3
-      id: cache-awslc
-      env:
-        cache-name: cache-awslc
-      with:
-        path: /home/runner/awslc
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.awslc-version }}
-
-    - name: build awslc
-      if: steps.cache-awslc.outputs.cache-hit != 'true'
-      run: |
-        curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
-          https://github.com/awslabs/aws-lc/archive/refs/tags/v${{ env.awslc-version }}.tar.gz
-        tar xzf v${{ env.awslc-version }}.tar.gz
-        mkdir aws-lc-${{ env.awslc-version }}-build
-        cd aws-lc-${{ env.awslc-version }}-build
-        cmake -DCMAKE_INSTALL_PREFIX=$HOME/awslc ../aws-lc-${{ env.awslc-version }}
-        cmake --build . --parallel
-        cmake --install .
-
-    - uses: actions/checkout@v3
-
-    - run: autoreconf -fi
-      name: 'autoreconf'
-
-    - run: |
-        mkdir build
-        cd build
-        ../configure --enable-warnings --enable-werror --with-openssl=$HOME/awslc
-        cd ..
-      name: 'configure out-of-tree'
-
-    - run: make -C build V=1
-      name: 'make'
-
-    - run: make -C build V=1 examples
-      name: 'make examples'
-
-    - run: make -C build V=1 -C tests
-      name: 'make tests'
-
-    - run: make -C build V=1 test-ci
-      name: 'run tests'
-
-  cmake:
-    name: awslc (cmake)
-    runs-on: 'ubuntu-latest'
-    timeout-minutes: 15
-
-    steps:
-    - run: |
-        sudo apt-get update
-        sudo apt-get install cmake stunnel4
-        # ensure we don't pick up openssl in this build
-        sudo apt remove --yes libssl-dev
-        sudo python3 -m pip install impacket
-      name: 'install prereqs and impacket'
-
-    - name: cache awslc
-      uses: actions/cache@v3
-      id: cache-awslc
-      env:
-        cache-name: cache-awslc
-      with:
-        path: /home/runner/awslc
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.awslc-version }}
-
-    - name: build awslc
-      if: steps.cache-awslc.outputs.cache-hit != 'true'
-      run: |
-        curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
-          https://github.com/awslabs/aws-lc/archive/refs/tags/v${{ env.awslc-version }}.tar.gz
-        tar xzf v${{ env.awslc-version }}.tar.gz
-        mkdir aws-lc-${{ env.awslc-version }}-build
-        cd aws-lc-${{ env.awslc-version }}-build
-        cmake -DCMAKE_INSTALL_PREFIX=$HOME/awslc ../aws-lc-${{ env.awslc-version }}
-        cmake --build . --parallel
-        cmake --install .
-
-    - uses: actions/checkout@v3
-
-    # CMAKE_COMPILE_WARNING_AS_ERROR is available in cmake 3.24 or later
-    - run: cmake -Bbuild -DOPENSSL_ROOT_DIR=$HOME/awslc -DBUILD_SHARED_LIBS=ON -DCMAKE_COMPILE_WARNING_AS_ERROR=ON .
-      name: 'cmake generate out-of-tree'
-
-    - run: cmake --build build --parallel
-      name: 'cmake build'
-
-    - run: cmake --install build --prefix $HOME/curl --strip
-      name: 'cmake install'
diff --git a/third-party/curl/.github/workflows/checkdocs.yml b/third-party/curl/.github/workflows/checkdocs.yml
new file mode 100644
index 0000000000..52f002fa71
--- /dev/null
+++ b/third-party/curl/.github/workflows/checkdocs.yml
@@ -0,0 +1,135 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+# This workflow contains tests that operate on documentation files only. Some
+# checks modify the source so they cannot be combined into a single job.
+
+name: 'Docs'
+
+'on':
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths:
+      - '.github/workflows/checkdocs.yml'
+      - '.github/scripts/**'
+      - 'scripts/**'
+      - '**.md'
+      - 'docs/*'
+  pull_request:
+    branches:
+      - master
+    paths:
+      - '.github/workflows/checkdocs.yml'
+      - '.github/scripts/**'
+      - 'scripts/**'
+      - '**.md'
+      - 'docs/*'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  DO_NOT_TRACK: '1'
+
+jobs:
+  # config file help: https://github.com/amperser/proselint/
+  proselint:
+    name: 'proselint'
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'install prereqs'
+        run: |
+          python3 -m venv ~/venv
+          ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r .github/scripts/requirements-proselint.txt
+
+      - name: 'trim headers off all *.md files'
+        run: git ls-files '*.md' -z | xargs -0 -n1 .github/scripts/trimmarkdownheader.pl
+
+      - name: 'check prose'
+        run: |
+          cat <<JSON > ~/.proselintrc.json
+          {
+            "checks": {
+              "annotations.misc": false,
+              "lexical_illusions": false,
+              "misc.annotations": false,
+              "redundancy.misc.garner": false,
+              "security.password": false,
+              "spelling.ve_of": false,
+              "typography.diacritical_marks": false,
+              "typography.symbols": false
+            }
+          }
+          JSON
+          source ~/venv/bin/activate
+          git ls-files README '*.md' -z | grep -Evz '(CHECKSRC|DISTROS|CURLOPT_INTERFACE|interface)\.md' | xargs -0 proselint check --
+
+      - name: 'check special prose'  # For CHECKSRC and files with aggressive exclamation mark needs
+        run: |
+          cat <<JSON > ~/.proselintrc.json
+          {
+            "checks": {
+              "annotations.misc": false,
+              "lexical_illusions": false,
+              "typography.diacritical_marks": false,
+              "typography.punctuation.exclamation": false,
+              "typography.symbols": false
+            }
+          }
+          JSON
+          source ~/venv/bin/activate
+          proselint check docs/internals/CHECKSRC.md docs/libcurl/opts/CURLOPT_INTERFACE.md docs/cmdline-opts/interface.md
+
+  pyspelling:
+    name: 'pyspelling'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'trim all *.md files in docs/'
+        run: .github/scripts/cleancmd.pl 'docs/*.md'
+
+      - name: 'install'
+        timeout-minutes: 2
+        run: |
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo apt-get -o Dpkg::Use-Pty=0 update
+          sudo apt-get -o Dpkg::Use-Pty=0 install aspell aspell-en
+          python3 -m venv ~/venv
+          ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r .github/scripts/requirements-docs.txt
+
+      - name: 'check spelling'
+        run: |
+          source ~/venv/bin/activate
+          # setup the custom wordlist
+          grep -v '^#' .github/scripts/pyspelling.words > wordlist.txt
+          aspell --version
+          pyspelling --version
+          pyspelling --verbose --jobs 5 --config .github/scripts/pyspelling.yaml
+
+  synopsis-man-examples:
+    name: 'synopsis, man-examples'
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'verify synopsis'
+        run: .github/scripts/verify-synopsis.pl docs/libcurl/curl*.md
+
+      - name: 'verify examples'
+        run: .github/scripts/verify-examples.pl docs/libcurl/curl*.md docs/libcurl/opts/*.md
diff --git a/third-party/curl/.github/workflows/checksrc.yml b/third-party/curl/.github/workflows/checksrc.yml
new file mode 100644
index 0000000000..83f5afe7a1
--- /dev/null
+++ b/third-party/curl/.github/workflows/checksrc.yml
@@ -0,0 +1,214 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+# This workflow contains checks at the source code level only.
+
+name: 'Source'
+
+'on':
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths-ignore:
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  DO_NOT_TRACK: '1'
+
+jobs:
+  checksrc:
+    name: 'checksrc'
+    runs-on: ubuntu-slim
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'check'
+        run: scripts/checksrc-all.pl
+
+  linters:
+    name: 'spellcheck, linters, REUSE'
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'install prereqs'
+        run: |
+          python3 -m venv ~/venv
+          ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary \
+            -r .github/scripts/requirements.txt \
+            -r tests/http/requirements.txt \
+            -r tests/requirements.txt
+
+      - name: 'REUSE check'
+        run: |
+          source ~/venv/bin/activate
+          reuse lint
+
+      - name: 'codespell'
+        run: |
+          source ~/venv/bin/activate
+          codespell --version
+          .github/scripts/codespell.sh
+
+      - name: 'typos'
+        timeout-minutes: 2
+        run: |
+          /home/linuxbrew/.linuxbrew/bin/brew install typos-cli
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+          typos --version
+          .github/scripts/typos.sh
+
+      - name: 'cmakelint'
+        run: |
+          source ~/venv/bin/activate
+          scripts/cmakelint.sh
+
+      - name: 'perlcheck'
+        run: |
+          scripts/perlcheck.sh
+
+      - name: 'ruff'
+        run: |
+          source ~/venv/bin/activate
+          scripts/pythonlint.sh
+
+  pytype:
+    name: 'pytype'
+    runs-on: ubuntu-24.04-arm  # pytype is discontinued and requires python 3.8-3.12
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'install prereqs'
+        run: |
+          python3 -m venv ~/venv
+          ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary pytype==2024.10.11 \
+            -r .github/scripts/requirements.txt \
+            -r tests/http/requirements.txt \
+            -r tests/requirements.txt
+
+      - name: 'check'
+        run: |
+          source ~/venv/bin/activate
+          find . -name '*.py' -exec pytype -j auto -k -- {} +
+
+  complexity:
+    name: 'complexity and function sizes'
+    runs-on: ubuntu-slim
+    timeout-minutes: 3
+    steps:
+      - name: 'install pmccabe'
+        timeout-minutes: 2
+        run: |
+          ls -l /etc/apt/sources.list.d
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo apt-get -o Dpkg::Use-Pty=0 update
+          sudo apt-get -o Dpkg::Use-Pty=0 install pmccabe
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'check function complexity'
+        run: ./scripts/top-complexity
+
+      - name: 'check function lengths'
+        run: ./scripts/top-length
+
+  xmllint:
+    name: 'xmllint'
+    runs-on: ubuntu-slim
+    timeout-minutes: 3
+    steps:
+      - name: 'install prereqs'
+        timeout-minutes: 2
+        run: |
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo apt-get -o Dpkg::Use-Pty=0 update
+          sudo apt-get -o Dpkg::Use-Pty=0 install libxml2-utils
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'check'
+        run: git grep -z -i -l -E '^<\?xml' | xargs -0 -r xmllint --output /dev/null
+
+  miscchecks:
+    name: 'misc checks'
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 5
+    steps:
+      - name: 'install prereqs'
+        timeout-minutes: 2
+        run: /home/linuxbrew/.linuxbrew/bin/brew install actionlint shellcheck zizmor
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'zizmor GHA'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+          zizmor --persona pedantic .github/workflows/*.yml .github/dependabot.yml
+
+      - name: 'zizmor GHA (auditor, warning-only)'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+          zizmor --persona auditor .github/workflows/*.yml .github/dependabot.yml || true
+
+      - name: 'actionlint'
+        run: |
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+          export SHELLCHECK_OPTS='--exclude=1090,1091,2086,2153 --enable=avoid-nullary-conditions,deprecate-which'
+          actionlint --version
+          actionlint --ignore matrix --ignore ubuntu-26.04 .github/workflows/*.yml
+
+      - name: 'shellcheck CI'
+        run: |
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+          shellcheck --version
+          .github/scripts/shellcheck-ci.sh
+
+      - name: 'shellcheck'
+        run: |
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+          shellcheck --version
+          .github/scripts/shellcheck.sh
+
+      - name: 'spacecheck'
+        run: scripts/spacecheck.pl
+
+      - name: 'yamlcheck'
+        run: .github/scripts/yamlcheck.sh
+
+      - name: 'badwords'
+        run: scripts/badwords-all
diff --git a/third-party/curl/.github/workflows/checkurls.yml b/third-party/curl/.github/workflows/checkurls.yml
new file mode 100644
index 0000000000..da5a99b861
--- /dev/null
+++ b/third-party/curl/.github/workflows/checkurls.yml
@@ -0,0 +1,43 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: 'URLs'
+
+'on':
+  push:
+    branches:
+      - master
+      - '*/ci'
+  pull_request:
+    branches:
+      - master
+  schedule:
+    - cron: '10 5 * * *'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  DO_NOT_TRACK: '1'
+
+jobs:
+  linkcheck:
+    if: ${{ github.repository_owner == 'curl' || github.event_name != 'schedule' }}
+    name: 'linkcheck'
+    runs-on: ubuntu-slim
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'mdlinkcheck (dry run)'
+        if: ${{ github.event_name != 'schedule' }}
+        run: ./scripts/mdlinkcheck --dry-run
+
+      - name: 'mdlinkcheck'
+        if: ${{ github.event_name == 'schedule' }}
+        run: ./scripts/mdlinkcheck
diff --git a/third-party/curl/.github/workflows/codeql-analysis.yml b/third-party/curl/.github/workflows/codeql-analysis.yml
deleted file mode 100644
index e5f38cc831..0000000000
--- a/third-party/curl/.github/workflows/codeql-analysis.yml
+++ /dev/null
@@ -1,80 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: CodeQL
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-    paths-ignore:
-    - '**/*.md'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'docs/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'tests/data/**'
-    - 'winbuild/**'
-  pull_request:
-    branches:
-    - master
-    paths-ignore:
-    - '**/*.md'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'docs/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'tests/data/**'
-    - 'winbuild/**'
-  schedule:
-    - cron: '0 0 * * 4'
-
-concurrency:
-  group: ${{ github.workflow }}
-
-permissions: {}
-
-jobs:
-  codeql:
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      with:
-        languages: cpp
-        queries: security-extended
-
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
-
-    # ℹ� Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
-
-    # �� If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
diff --git a/third-party/curl/.github/workflows/codeql.yml b/third-party/curl/.github/workflows/codeql.yml
new file mode 100644
index 0000000000..15b91c18c4
--- /dev/null
+++ b/third-party/curl/.github/workflows/codeql.yml
@@ -0,0 +1,142 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: 'CodeQL'
+
+'on':
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'projects/**'
+      - 'tests/data/**'
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'projects/**'
+      - 'tests/data/**'
+  schedule:
+    - cron: '0 0 * * 4'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  DO_NOT_TRACK: '1'
+
+jobs:
+  gha_python:
+    if: ${{ github.repository_owner == 'curl' || github.event_name != 'schedule' }}
+    name: 'GHA and Python'
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write  # To create/update security events
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'initialize'
+        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        with:
+          languages: actions, python
+          queries: security-extended
+
+      - name: 'perform analysis'
+        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+
+  c:
+    if: ${{ github.repository_owner == 'curl' || github.event_name != 'schedule' }}
+    name: 'C'
+    runs-on: ${{ matrix.platform == 'Linux' && 'ubuntu-latest' || 'windows-2022' }}
+    permissions:
+      security-events: write  # To create/update security events
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [Linux, Windows]
+    env:
+      MATRIX_PLATFORM: '${{ matrix.platform }}'
+    steps:
+      - name: 'install prereqs'
+        if: ${{ matrix.platform == 'Linux' }}
+        timeout-minutes: 2
+        run: |
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo apt-get -o Dpkg::Use-Pty=0 update
+          sudo apt-get -o Dpkg::Use-Pty=0 install \
+            libpsl-dev libbrotli-dev libidn2-dev libssh2-1-dev libssh-dev \
+            libnghttp2-dev libldap-dev libkrb5-dev libgnutls28-dev libwolfssl-dev
+          /home/linuxbrew/.linuxbrew/bin/brew install c-ares gsasl libnghttp3 libngtcp2 mbedtls rustls-ffi
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'delete test input C files'
+        shell: bash
+        run: find tests/data -name '*.c' -delete
+
+      - name: 'initialize'
+        # https://github.com/github/codeql-action/blob/main/init/action.yml
+        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        with:
+          languages: cpp
+          build-mode: manual
+          trap-caching: false
+
+      - name: 'build'
+        timeout-minutes: 10
+        shell: bash
+        run: |
+          if [ "${MATRIX_PLATFORM}" = 'Windows' ]; then
+            cmake -B . -DBUILD_SHARED_LIBS=OFF -DCURL_DROP_UNUSED=ON -DCURL_WERROR=ON \
+              -DCMAKE_VS_GLOBALS=TrackFileAccess=false \
+              -DCURL_USE_SCHANNEL=ON -DCURL_USE_LIBPSL=OFF -DUSE_WIN32_IDN=ON
+            cmake --build . --verbose
+            src/Debug/curl.exe --disable --version
+          else
+            eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+
+            export PKG_CONFIG_PATH
+
+            # MultiSSL
+            PKG_CONFIG_PATH="$(brew --prefix c-ares)/lib/pkgconfig:$(brew --prefix mbedtls)/lib/pkgconfig:$(brew --prefix rustls-ffi)/lib/pkgconfig:$(brew --prefix gsasl)/lib/pkgconfig"
+            cmake -B _bld1 -G Ninja -DCURL_DISABLE_TYPECHECK=ON -DCURL_WERROR=ON -DENABLE_DEBUG=ON \
+              -DCURL_USE_GNUTLS=ON -DCURL_USE_MBEDTLS=ON -DCURL_USE_RUSTLS=ON -DCURL_USE_WOLFSSL=ON \
+              -DCURL_USE_GSASL=ON -DCURL_USE_GSSAPI=ON -DUSE_SSLS_EXPORT=ON -DUSE_ECH=ON -DENABLE_ARES=ON \
+              -DCURL_DISABLE_VERBOSE_STRINGS=ON
+            cmake --build _bld1
+            cmake --build _bld1 --target testdeps
+            cmake --build _bld1 --target curl-examples-build
+
+            # HTTP/3
+            PKG_CONFIG_PATH="$(brew --prefix libnghttp3)/lib/pkgconfig:$(brew --prefix libngtcp2)/lib/pkgconfig:$(brew --prefix gsasl)/lib/pkgconfig"
+            cmake -B _bld2 -G Ninja -DCURL_DISABLE_TYPECHECK=ON -DCURL_WERROR=ON \
+              -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR="$(brew --prefix openssl)" -DUSE_NGTCP2=ON \
+              -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=ON \
+              -DCURL_USE_GSASL=ON -DCURL_USE_GSSAPI=ON -DUSE_SSLS_EXPORT=ON -DUSE_PROXY_HTTP3=ON
+            cmake --build _bld2
+            cmake --build _bld2 --target testdeps
+            cmake --build _bld2 --target curl-examples-build
+
+            _bld1/src/curl --disable --version
+            _bld2/src/curl --disable --version
+          fi
+
+      - name: 'perform analysis'
+        # https://github.com/github/codeql-action/blob/main/analyze/action.yml
+        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
diff --git a/third-party/curl/.github/workflows/configure-vs-cmake.yml b/third-party/curl/.github/workflows/configure-vs-cmake.yml
new file mode 100644
index 0000000000..bcab34395f
--- /dev/null
+++ b/third-party/curl/.github/workflows/configure-vs-cmake.yml
@@ -0,0 +1,194 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: 'configure-vs-cmake'
+'on':
+  push:
+    branches:
+      - master
+    paths:
+      - '*.ac'
+      - '**/*.m4'
+      - '**/CMakeLists.txt'
+      - 'CMake/**'
+      - 'lib/curl_config-cmake.h.in'
+      - 'tests/cmake/**'
+      - '.github/scripts/cmp-config.pl'
+      - '.github/workflows/configure-vs-cmake.yml'
+
+  pull_request:
+    branches:
+      - master
+    paths:
+      - '*.ac'
+      - '**/*.m4'
+      - '**/CMakeLists.txt'
+      - 'CMake/**'
+      - 'lib/curl_config-cmake.h.in'
+      - 'tests/cmake/**'
+      - '.github/scripts/cmp-config.pl'
+      - '.github/workflows/configure-vs-cmake.yml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  DO_NOT_TRACK: '1'
+
+jobs:
+  check-linux:
+    name: 'Linux'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'run configure --with-openssl'
+        run: |
+          autoreconf -fi
+          export PKG_CONFIG_DEBUG_SPEW=1
+          mkdir bld-am && cd bld-am && ../configure --enable-static=no --with-openssl --without-libpsl
+
+      - name: 'run cmake'
+        run: cmake -B bld-cm -DCURL_WERROR=ON -DCURL_USE_CMAKECONFIG=OFF -DCURL_USE_LIBPSL=OFF
+
+      - name: 'configure log'
+        run: cat bld-am/config.log 2>/dev/null || true
+
+      - name: 'cmake log'
+        run: cat bld-cm/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+
+      - name: 'dump generated files'
+        run: |
+          for f in libcurl.pc curl-config; do
+            echo "::group::AM ${f}"; grep -v '^#' bld-am/"${f}" || true; echo '::endgroup::'
+            echo "::group::CM ${f}"; grep -v '^#' bld-cm/"${f}" || true; echo '::endgroup::'
+          done
+
+      - name: 'compare generated curl_config.h files'
+        run: ./.github/scripts/cmp-config.pl bld-am/lib/curl_config.h bld-cm/lib/curl_config.h
+
+      - name: 'compare generated libcurl.pc files'
+        run: ./.github/scripts/cmp-pkg-config.sh bld-am/libcurl.pc bld-cm/libcurl.pc
+
+      - name: 'compare generated curl-config files'
+        run: ./.github/scripts/cmp-pkg-config.sh bld-am/curl-config bld-cm/curl-config
+
+  check-macos:
+    name: 'macOS'
+    runs-on: macos-latest
+    steps:
+      - name: 'install packages'
+        timeout-minutes: 2
+        run: |
+          # shellcheck disable=SC2181
+          while [[ $? == 0 ]]; do
+            for i in 1 2 3; do
+              if brew install automake libtool; then
+                break 2
+              else
+                echo "Error: wait to try again: $i"
+                sleep 10
+              fi
+            done
+            false Too many retries
+          done
+
+      - name: 'toolchain versions'
+        run: echo '::group::brew packages installed'; ls -l /opt/homebrew/opt; echo '::endgroup::'
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'run configure --with-openssl'
+        run: |
+          autoreconf -fi
+          export PKG_CONFIG_DEBUG_SPEW=1
+          mkdir bld-am && cd bld-am && ../configure --enable-static=no --with-openssl --without-libpsl --disable-ldap --with-brotli --with-zstd --with-apple-sectrust
+
+      - name: 'run cmake'
+        run: |
+          cmake -B bld-cm -DCURL_WERROR=ON -DCURL_USE_CMAKECONFIG=OFF -DCURL_USE_LIBPSL=OFF -DCURL_DISABLE_LDAP=ON \
+            -DCMAKE_C_COMPILER_TARGET="$(uname -m | sed 's/arm64/aarch64/')-apple-darwin$(uname -r)" \
+            -DCURL_USE_LIBSSH2=OFF -DUSE_APPLE_SECTRUST=ON
+
+      - name: 'configure log'
+        run: cat bld-am/config.log 2>/dev/null || true
+
+      - name: 'cmake log'
+        run: cat bld-cm/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+
+      - name: 'dump generated files'
+        run: |
+          for f in libcurl.pc curl-config; do
+            echo "::group::AM ${f}"; grep -v '^#' bld-am/"${f}" || true; echo '::endgroup::'
+            echo "::group::CM ${f}"; grep -v '^#' bld-cm/"${f}" || true; echo '::endgroup::'
+          done
+
+      - name: 'compare generated curl_config.h files'
+        run: ./.github/scripts/cmp-config.pl bld-am/lib/curl_config.h bld-cm/lib/curl_config.h
+
+      - name: 'compare generated libcurl.pc files'
+        run: ./.github/scripts/cmp-pkg-config.sh bld-am/libcurl.pc bld-cm/libcurl.pc
+
+      - name: 'compare generated curl-config files'
+        run: ./.github/scripts/cmp-pkg-config.sh bld-am/curl-config bld-cm/curl-config
+
+  check-windows:
+    name: 'Windows'
+    runs-on: ubuntu-latest
+    env:
+      TRIPLET: 'x86_64-w64-mingw32'
+    steps:
+      - name: 'install packages'
+        timeout-minutes: 1
+        run: |
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo apt-get -o Dpkg::Use-Pty=0 update
+          sudo apt-get -o Dpkg::Use-Pty=0 install gcc-mingw-w64-x86-64-win32
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'run configure --with-schannel'
+        run: |
+          autoreconf -fi
+          export PKG_CONFIG_DEBUG_SPEW=1
+          mkdir bld-am && cd bld-am && ../configure --enable-static=no --with-schannel --without-libpsl --host="${TRIPLET}"
+
+      - name: 'run cmake'
+        run: |
+          cmake -B bld-cm -DCURL_WERROR=ON -DCURL_USE_CMAKECONFIG=OFF -DCURL_USE_SCHANNEL=ON -DCURL_USE_LIBPSL=OFF \
+            -DCMAKE_SYSTEM_NAME=Windows \
+            -DCMAKE_C_COMPILER_TARGET="${TRIPLET}" \
+            -DCMAKE_C_COMPILER="${TRIPLET}-gcc"
+
+      - name: 'configure log'
+        run: cat bld-am/config.log 2>/dev/null || true
+
+      - name: 'cmake log'
+        run: cat bld-cm/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+
+      - name: 'dump generated files'
+        run: |
+          for f in libcurl.pc curl-config; do
+            echo "::group::AM ${f}"; grep -v '^#' bld-am/"${f}" || true; echo '::endgroup::'
+            echo "::group::CM ${f}"; grep -v '^#' bld-cm/"${f}" || true; echo '::endgroup::'
+          done
+
+      - name: 'compare generated curl_config.h files'
+        run: ./.github/scripts/cmp-config.pl bld-am/lib/curl_config.h bld-cm/lib/curl_config.h
+
+      - name: 'compare generated libcurl.pc files'
+        run: ./.github/scripts/cmp-pkg-config.sh bld-am/libcurl.pc bld-cm/libcurl.pc
+
+      - name: 'compare generated curl-config files'
+        run: ./.github/scripts/cmp-pkg-config.sh bld-am/curl-config bld-cm/curl-config
diff --git a/third-party/curl/.github/workflows/curl-for-win.yml b/third-party/curl/.github/workflows/curl-for-win.yml
new file mode 100644
index 0000000000..2f47321a19
--- /dev/null
+++ b/third-party/curl/.github/workflows/curl-for-win.yml
@@ -0,0 +1,199 @@
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+---
+name: 'curl-for-win'
+
+'on':
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  CW_NOGET: 'curl trurl'
+  CW_MAP: '0'
+  CW_JOBS: '5'
+  CW_NOPKG: '1'
+  DO_NOT_TRACK: '1'
+
+jobs:
+  linux-glibc-gcc:
+    name: 'Linux gcc glibc (amd64, arm64)'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          path: 'curl'
+          fetch-depth: 8
+      - name: 'build'
+        run: |
+          git clone --depth 1 https://github.com/curl/curl-for-win
+          mv curl-for-win/* .
+          export CW_CONFIG='-main-werror-unitybatch-nocertdata-linux-a64-x64-gcc'
+          export CW_REVISION="${GITHUB_SHA}"
+          . ./_versions.sh
+          export CW_CCSUFFIX='-15'
+          export CW_GCCSUFFIX='-12'
+          sudo podman image trust set --type reject default
+          sudo podman image trust set --type accept docker.io/library
+          time podman pull "${OCI_IMAGE_DEBIAN_STABLE}"
+          podman images --digests
+          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
+            --env-file <(env | grep -a -E \
+              '^(CW_|DO_NOT_TRACK|GITHUB_)') \
+            "${OCI_IMAGE_DEBIAN_STABLE}" \
+            sh -c ./_ci-linux-debian.sh
+
+  linux-glibc-gcc-minimal:  # use gcc to minimize installed packages
+    name: 'Linux gcc glibc minimal (amd64)'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          path: 'curl'
+          fetch-depth: 8
+      - name: 'build'
+        run: |
+          git clone --depth 1 https://github.com/curl/curl-for-win
+          mv curl-for-win/* .
+          export CW_CONFIG='-main-werror-unitybatch-nocertdata-prefill-zero-osnotls-osnoidn-nohttp-nocurltool-linux-x64-gcc'
+          export CW_REVISION="${GITHUB_SHA}"
+          . ./_versions.sh
+          sudo podman image trust set --type reject default
+          sudo podman image trust set --type accept docker.io/library
+          time podman pull "${OCI_IMAGE_DEBIAN}"
+          podman images --digests
+          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
+            --env-file <(env | grep -a -E \
+              '^(CW_|DO_NOT_TRACK|GITHUB_)') \
+            "${OCI_IMAGE_DEBIAN}" \
+            sh -c ./_ci-linux-debian.sh
+
+  linux-musl-llvm:
+    name: 'Linux llvm MUSL (amd64, riscv64)'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          path: 'curl'
+          fetch-depth: 8
+      - name: 'build'
+        run: |
+          git clone --depth 1 https://github.com/curl/curl-for-win
+          mv curl-for-win/* .
+          export CW_CONFIG='-main-werror-unitybatch-nocertdata-linux-musl-r64-x64'
+          export CW_REVISION="${GITHUB_SHA}"
+          . ./_versions.sh
+          export CW_CCSUFFIX='-19'
+          export CW_GCCSUFFIX='-14'
+          sudo podman image trust set --type reject default
+          sudo podman image trust set --type accept docker.io/library
+          time podman pull "${OCI_IMAGE_DEBIAN_STABLE}"
+          podman images --digests
+          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
+            --env-file <(env | grep -a -E \
+              '^(CW_|DO_NOT_TRACK|GITHUB_)') \
+            "${OCI_IMAGE_DEBIAN_STABLE}" \
+            sh -c ./_ci-linux-debian.sh
+
+  mac-clang:
+    name: 'macOS clang cares (x86_64)'
+    runs-on: macos-latest
+    timeout-minutes: 10
+    env:
+      CW_JOBS: '4'
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          path: 'curl'
+          fetch-depth: 8
+      - name: 'build'
+        run: |
+          git clone --depth 1 https://github.com/curl/curl-for-win
+          mv curl-for-win/* .
+          export CW_CONFIG='-main-werror-unitybatch-nocertdata-mac-x64-cares'
+          export CW_REVISION="${GITHUB_SHA}"
+          sh -c ./_ci-mac-homebrew.sh
+
+  win-llvm:
+    name: 'Windows llvm (x64)'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          path: 'curl'
+          fetch-depth: 8
+      - name: 'build'
+        run: |
+          git clone --depth 1 https://github.com/curl/curl-for-win
+          mv curl-for-win/* .
+          export CW_CONFIG='-main-werror-unitybatch-nocertdata-win-x64-noWINE'
+          export CW_REVISION="${GITHUB_SHA}"
+          . ./_versions.sh
+          sudo podman image trust set --type reject default
+          sudo podman image trust set --type accept docker.io/library
+          time podman pull "${OCI_IMAGE_DEBIAN}"
+          podman images --digests
+          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
+            --env-file <(env | grep -a -E \
+              '^(CW_|DO_NOT_TRACK|GITHUB_)') \
+            "${OCI_IMAGE_DEBIAN}" \
+            sh -c ./_ci-linux-debian.sh
+
+  win-gcc-zlibold-x64:
+    name: 'Windows gcc zlib-classic (x64)'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          path: 'curl'
+          fetch-depth: 8
+      - name: 'build'
+        run: |
+          git clone --depth 1 https://github.com/curl/curl-for-win
+          mv curl-for-win/* .
+          export CW_CONFIG='-main-werror-unitybatch-nocertdata-win-x64-gcc-zlibold-noWINE'
+          export CW_REVISION="${GITHUB_SHA}"
+          . ./_versions.sh
+          sudo podman image trust set --type reject default
+          sudo podman image trust set --type accept docker.io/library
+          time podman pull "${OCI_IMAGE_DEBIAN}"
+          podman images --digests
+          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
+            --env-file <(env | grep -a -E \
+              '^(CW_|DO_NOT_TRACK|GITHUB_)') \
+            "${OCI_IMAGE_DEBIAN}" \
+            sh -c ./_ci-linux-debian.sh
diff --git a/third-party/curl/.github/workflows/distcheck.yml b/third-party/curl/.github/workflows/distcheck.yml
new file mode 100644
index 0000000000..6aa969cd0f
--- /dev/null
+++ b/third-party/curl/.github/workflows/distcheck.yml
@@ -0,0 +1,409 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: 'dist'
+
+'on':
+  push:
+    branches:
+      - master
+      - '*/ci'
+  pull_request:
+    branches:
+      - master
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  CURL_TEST_MIN: 1500
+  DO_NOT_TRACK: '1'
+  MAKEFLAGS: -j 5
+
+jobs:
+  maketgz-and-verify-in-tree:
+    name: 'AM in-tree & maketgz'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'remove preinstalled curl libcurl4{-doc}'
+        run: sudo apt-get -o Dpkg::Use-Pty=0 purge curl libcurl4 libcurl4-doc
+
+      - name: 'autoreconf'
+        run: autoreconf -fi
+
+      - name: 'configure'
+        run: ./configure --without-ssl --without-libpsl
+
+      - name: 'make'
+        run: make V=1
+
+      - name: 'maketgz'
+        run: SOURCE_DATE_EPOCH=1711526400 ./scripts/maketgz 99.98.97
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: 'release-tgz'
+          path: 'curl-99.98.97.tar.gz'
+          retention-days: 1
+
+      - name: 'configure build & install'
+        run: |
+          echo "::stop-commands::$(uuidgen)"
+          tar xvf curl-99.98.97.tar.gz
+          pushd curl-99.98.97
+          ./configure --prefix="$HOME"/temp --enable-option-checking=fatal --enable-werror --without-ssl --without-libpsl
+          make
+          make test-ci
+          make install
+          popd
+          # basic check of the installed files
+          bash scripts/installcheck.sh "$HOME"/temp
+          rm -rf curl-99.98.97
+
+  verify-out-of-tree-docs:
+    name: 'AM out-of-tree docs'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    needs: maketgz-and-verify-in-tree
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: 'release-tgz'
+
+      - name: 'configure build & docs'
+        run: |
+          echo "::stop-commands::$(uuidgen)"
+          tar xvf curl-99.98.97.tar.gz
+          touch curl-99.98.97/docs/{cmdline-opts,libcurl}/Makefile.inc
+          mkdir build
+          pushd build
+          ../curl-99.98.97/configure --enable-option-checking=fatal --enable-werror --without-ssl --without-libpsl
+          make
+          make test-ci
+          popd
+          rm -rf build
+          rm -rf curl-99.98.97
+
+  verify-out-of-tree-autotools-debug:
+    name: 'AM out-of-tree (debug)'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    needs: maketgz-and-verify-in-tree
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: 'release-tgz'
+
+      - name: 'build & install'
+        run: |
+          echo "::stop-commands::$(uuidgen)"
+          tar xvf curl-99.98.97.tar.gz
+          pushd curl-99.98.97
+          mkdir build
+          pushd build
+          ../configure --prefix="$PWD"/curl-install --enable-option-checking=fatal --enable-werror --without-ssl --enable-debug --without-libpsl
+          make
+          make test-ci
+          make install
+          curl-install/bin/curl --disable --version
+          curl-install/bin/curl --manual | wc -l | grep -v '^ *0$'
+          popd
+          scripts/checksrc-all.pl
+
+  verify-out-of-tree-autotools:
+    name: 'AM out-of-tree !perl'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    needs: maketgz-and-verify-in-tree
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: 'release-tgz'
+
+      - name: 'build & install'
+        run: |
+          echo "::stop-commands::$(uuidgen)"
+          tar xvf curl-99.98.97.tar.gz
+          pushd curl-99.98.97
+          mkdir build
+          pushd build
+          ../configure --prefix="$PWD"/curl-install --enable-option-checking=fatal --enable-werror --without-ssl --without-libpsl ac_cv_path_PERL=
+          make
+          make install
+          curl-install/bin/curl --disable --version
+          curl-install/bin/curl --manual | wc -l | grep -v '^ *0$'
+          popd
+
+  verify-in-tree-autotools:
+    name: 'AM in-tree !perl'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    needs: maketgz-and-verify-in-tree
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: 'release-tgz'
+
+      - name: 'build & install'
+        run: |
+          echo "::stop-commands::$(uuidgen)"
+          tar xvf curl-99.98.97.tar.gz
+          pushd curl-99.98.97
+          ./configure --prefix="$PWD"/curl-install --enable-option-checking=fatal --enable-werror --without-ssl --without-libpsl ac_cv_path_PERL=
+          make
+          make install
+          curl-install/bin/curl --disable --version
+          curl-install/bin/curl --manual | wc -l | grep -v '^ *0$'
+
+  verify-out-of-tree-cmake:
+    name: 'CM out-of-tree !perl'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    needs: maketgz-and-verify-in-tree
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: 'release-tgz'
+
+      - name: 'build & install'
+        run: |
+          echo "::stop-commands::$(uuidgen)"
+          tar xvf curl-99.98.97.tar.gz
+          pushd curl-99.98.97
+          cmake -B build -DCMAKE_INSTALL_PREFIX="$PWD"/curl-install -DCURL_WERROR=ON -DCURL_USE_LIBPSL=OFF -DPERL_EXECUTABLE=
+          cmake --build build
+          cmake --install build
+          export LD_LIBRARY_PATH="$PWD/curl-install/lib:$LD_LIBRARY_PATH"
+          curl-install/bin/curl --disable --version
+          curl-install/bin/curl --manual | wc -l | grep -v '^ *0$'
+
+  verify-in-tree-cmake:
+    name: 'CM in-tree !perl'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    needs: maketgz-and-verify-in-tree
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: 'release-tgz'
+
+      - name: 'build & install'
+        run: |
+          echo "::stop-commands::$(uuidgen)"
+          tar xvf curl-99.98.97.tar.gz
+          pushd curl-99.98.97
+          cmake . -G Ninja -DCMAKE_INSTALL_PREFIX="$PWD"/curl-install -DCURL_WERROR=ON -DCURL_USE_LIBPSL=OFF -DPERL_EXECUTABLE=
+          cmake --build .
+          cmake --install .
+          export LD_LIBRARY_PATH="$PWD/curl-install/lib:$LD_LIBRARY_PATH"
+          curl-install/bin/curl --disable --version
+          curl-install/bin/curl --manual | wc -l | grep -v '^ *0$'
+
+  missing-files:
+    name: 'missing files'
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
+    needs: maketgz-and-verify-in-tree
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: 'release-tgz'
+
+      - name: 'detect files missing from release tarball'
+        run: .github/scripts/distfiles.sh curl-99.98.97.tar.gz
+
+  reproducible-releases:
+    name: 'reproducible releases'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'remove preinstalled curl libcurl4{-doc}'
+        run: sudo apt-get -o Dpkg::Use-Pty=0 purge curl libcurl4 libcurl4-doc
+
+      - name: 'generate release tarballs'
+        run: ./scripts/dmaketgz 9.10.11
+
+      - name: 'verify release tarballs'
+        run: |
+          mkdir _verify
+          mv curl-9.10.11.tar.gz _verify
+          cd _verify
+          ../scripts/verify-release curl-9.10.11.tar.gz
+
+  cmake-integration:
+    name: 'CM integration ${{ matrix.image }}'
+    runs-on: ${{ matrix.image }}
+    timeout-minutes: 15
+    defaults:
+      run:
+        shell: ${{ contains(matrix.image, 'windows') && 'msys2 {0}' || 'bash' }}
+    env:
+      CC: ${{ !contains(matrix.image, 'windows') && 'clang' || '' }}
+      MAKEFLAGS: ${{ contains(matrix.image, 'macos') && '-j 4' || '-j 5' }}
+      MATRIX_IMAGE: '${{ matrix.image }}'
+      TESTOPTS: ${{ contains(matrix.image, 'macos') && '-D_CURL_PREFILL=ON' || '' }} ${{ contains(matrix.image, 'windows') && '-DCMAKE_UNITY_BUILD_BATCH_SIZE=30' || '' }}
+      OLD_CMAKE_VERSION: 3.19.8
+      OLD_CMAKE_SHA256_LINUX_ARM: 807f5afb2a560e00af9640e496d5673afefc2888bf0ed076412884a5ebb547a1
+      OLD_CMAKE_SHA256_MACOS_UNI: 0976d23d982af05dcbfb3aa34fcb62ead43bea27f0e3bb95222f2a78161423f2
+      OLD_CMAKE_SHA256_WIN_INTEL: 2a30877a3d6b50da305b289f4d1c03befdfaeb2edba02a563c681e883d810380
+    strategy:
+      fail-fast: false
+      matrix:
+        image: [ubuntu-24.04-arm, macos-latest, windows-2022]
+    steps:
+      - uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1
+        if: ${{ contains(matrix.image, 'windows') }}
+        with:
+          msystem: mingw64
+          release: false
+          update: false
+          cache: false
+          path-type: inherit
+          install: >-
+            mingw-w64-x86_64-zlib mingw-w64-x86_64-zstd mingw-w64-x86_64-libpsl mingw-w64-x86_64-libssh2 mingw-w64-x86_64-nghttp2 mingw-w64-x86_64-openssl
+
+      - name: 'install prereqs'
+        timeout-minutes: 3
+        run: |
+          if [[ "${MATRIX_IMAGE}" = *'windows'* ]]; then
+            cd ~
+            curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+              --location --proto-redir =https "https://github.com/Kitware/CMake/releases/download/v${OLD_CMAKE_VERSION}/cmake-${OLD_CMAKE_VERSION}-win64-x64.zip" --output pkg.bin
+            sha256sum pkg.bin && sha256sum pkg.bin | grep -qwF -- "${OLD_CMAKE_SHA256_WIN_INTEL}" && unzip -q pkg.bin && rm -f pkg.bin
+            printf '%s' ~/cmake-"${OLD_CMAKE_VERSION}"-win64-x64/bin/cmake.exe > ~/old-cmake-path.txt
+          elif [[ "${MATRIX_IMAGE}" = *'ubuntu'* ]]; then
+            sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+            sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+            sudo apt-get -o Dpkg::Use-Pty=0 update
+            sudo apt-get -o Dpkg::Use-Pty=0 install libpsl-dev libssl-dev
+            cd ~
+            curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+              --location --proto-redir =https "https://github.com/Kitware/CMake/releases/download/v${OLD_CMAKE_VERSION}/cmake-${OLD_CMAKE_VERSION}-Linux-aarch64.tar.gz" --output pkg.bin
+            sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${OLD_CMAKE_SHA256_LINUX_ARM}" && tar -xzf pkg.bin && rm -f pkg.bin
+            printf '%s' ~/cmake-"${OLD_CMAKE_VERSION}"-Linux-aarch64/bin/cmake > ~/old-cmake-path.txt
+          else
+            brew install libpsl openssl
+            cd ~
+            curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+              --location --proto-redir =https "https://github.com/Kitware/CMake/releases/download/v${OLD_CMAKE_VERSION}/cmake-${OLD_CMAKE_VERSION}-macos-universal.tar.gz" --output pkg.bin
+            sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${OLD_CMAKE_SHA256_MACOS_UNI}" && tar -xzf pkg.bin && rm -f pkg.bin
+            printf '%s' ~/cmake-"${OLD_CMAKE_VERSION}"-macos-universal/CMake.app/Contents/bin/cmake > ~/old-cmake-path.txt
+          fi
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'via ExternalProject'
+        if: ${{ !contains(matrix.image, 'ubuntu') }}
+        run: ./tests/cmake/test.sh ExternalProject ${TESTOPTS}
+      - name: 'via FetchContent'
+        run: ./tests/cmake/test.sh FetchContent ${TESTOPTS} -DCURL_USE_OPENSSL=ON
+      - name: 'via add_subdirectory'
+        run: ./tests/cmake/test.sh add_subdirectory ${TESTOPTS} -DCURL_USE_OPENSSL=ON
+      - name: 'via find_package'
+        run: ./tests/cmake/test.sh find_package ${TESTOPTS} -DCURL_USE_OPENSSL=ON
+      - name: 'via find_package (C++)'
+        if: ${{ contains(matrix.image, 'ubuntu') }}
+        run: TEST_CMAKE_FLAGS=-DTEST_CPP=ON ./tests/cmake/test.sh find_package ${TESTOPTS} -DCURL_USE_OPENSSL=ON
+      - name: 'via find_package (PREFER_CONFIG=ON)'
+        if: ${{ contains(matrix.image, 'windows') }}
+        run: |
+          export TEST_CMAKE_FLAGS_PROVIDER='-DCMAKE_FIND_PACKAGE_PREFER_CONFIG=ON -DCURL_ZSTD=OFF'
+          TEST_CMAKE_FLAGS_PROVIDER+=' -DNGHTTP2_INCLUDE_DIR=C:/msys64/mingw64/include -DNGHTTP2_LIBRARY=C:/msys64/mingw64/lib/libnghttp2.dll.a'
+          export TEST_CMAKE_FLAGS_CONSUMER="${TEST_CMAKE_FLAGS_PROVIDER}"
+          ./tests/cmake/test.sh find_package ${TESTOPTS} -DCURL_USE_OPENSSL=ON
+
+      - name: 'via ExternalProject (old cmake)'
+        if: ${{ contains(matrix.image, 'ubuntu') }}
+        run: |
+          export TEST_CMAKE_CONSUMER; TEST_CMAKE_CONSUMER="$(cat ~/old-cmake-path.txt)"
+          if [[ "${MATRIX_IMAGE}" = *'macos'* ]]; then
+            export CFLAGS='-arch arm64'
+          fi
+          if [[ "${MATRIX_IMAGE}" = *'windows'* ]]; then
+            export TEST_CMAKE_GENERATOR='MSYS Makefiles'
+            export TEST_CMAKE_FLAGS='-DCMAKE_C_COMPILER=x86_64-w64-mingw32-gcc'
+          fi
+          ./tests/cmake/test.sh ExternalProject ${TESTOPTS}
+
+      - name: 'via add_subdirectory OpenSSL (old cmake)'
+        run: |
+          export TEST_CMAKE_CONSUMER; TEST_CMAKE_CONSUMER="$(cat ~/old-cmake-path.txt)"
+          if [[ "${MATRIX_IMAGE}" = *'macos'* ]]; then
+            export CFLAGS='-arch arm64'
+            export TEST_CMAKE_FLAGS='-DCURL_USE_LIBPSL=OFF'  # auto-detection does not work with old-cmake
+          fi
+          if [[ "${MATRIX_IMAGE}" = *'windows'* ]]; then
+            export TEST_CMAKE_GENERATOR='MSYS Makefiles'
+            export TEST_CMAKE_FLAGS='-DCMAKE_C_COMPILER=x86_64-w64-mingw32-gcc -DOPENSSL_ROOT_DIR=C:/msys64/mingw64'
+          fi
+          ./tests/cmake/test.sh add_subdirectory ${TESTOPTS} -DCURL_USE_OPENSSL=ON
+
+      - name: 'via find_package OpenSSL (old cmake)'
+        run: |
+          export TEST_CMAKE_CONSUMER; TEST_CMAKE_CONSUMER="$(cat ~/old-cmake-path.txt)"
+          if [[ "${MATRIX_IMAGE}" = *'macos'* ]]; then
+            export CFLAGS='-arch arm64'
+            export TEST_CMAKE_FLAGS='-DCURL_USE_LIBPSL=OFF'  # auto-detection does not work with old-cmake
+          fi
+          if [[ "${MATRIX_IMAGE}" = *'windows'* ]]; then
+            export TEST_CMAKE_GENERATOR='MSYS Makefiles'
+            export TEST_CMAKE_FLAGS='-DCMAKE_C_COMPILER=x86_64-w64-mingw32-gcc -DOPENSSL_ROOT_DIR=C:/msys64/mingw64'
+          fi
+          ./tests/cmake/test.sh find_package ${TESTOPTS} -DCURL_USE_OPENSSL=ON
+
+  verify-tarball-downloads:
+    name: 'Verify tarball downloads'
+    runs-on: ubuntu-slim
+    timeout-minutes: 2
+    steps:
+      - name: 'download and import GPG key'
+        env:
+          CURL_GPG_ID: 27EDEAF22F3ABCEB50DB9A125CC908FDB71E12C2
+        run: |
+          for keyserver in \
+            https://keyserver.ubuntu.com/ \
+            https://pgpkeys.eu/ \
+          ; do
+            echo "--- Downloading from ${keyserver}..."
+            if curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+               "${keyserver}pks/lookup?op=get&options=mr&exact=on&search=0x${CURL_GPG_ID}" \
+               | gpg --batch --keyserver-options timeout=15 --display-charset utf-8 --keyid-format 0xlong --import --status-fd 1 2>&1; then
+              break
+            fi
+          done
+
+      - name: 'download and verify tarballs'
+        run: |
+          echo "--- Detecting latest curl tarball version..."
+          curl_version="$(curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused https://curl.se/info.json \
+            | jq --raw-output .Version)"
+
+          for suffix in .tar.bz2 .tar.gz .tar.xz .zip; do
+            echo "--- Downloading ${curl_version} ${suffix}..."
+            curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+              --output pkg.bin "https://curl.se/download/curl-${curl_version}${suffix}" \
+              --output pkg.sig "https://curl.se/download/curl-${curl_version}${suffix}.asc"
+            echo "--- Verifying ${curl_version} ${suffix}..."
+            gpg --batch --keyserver-options timeout=15 --display-charset utf-8 --keyid-format 0xlong --verify-options show-primary-uid-only \
+              --verify pkg.sig pkg.bin 2>&1
+            echo '---'
+          done
diff --git a/third-party/curl/.github/workflows/fuzz.yml b/third-party/curl/.github/workflows/fuzz.yml
index 695e0def97..dc15b9c9db 100644
--- a/third-party/curl/.github/workflows/fuzz.yml
+++ b/third-party/curl/.github/workflows/fuzz.yml
@@ -2,49 +2,45 @@
 #
 # SPDX-License-Identifier: curl
 
-name: Fuzzer
+name: 'Fuzzer'
 
-on:
+'on':
   push:
     branches:
-    - master
-    - '*/ci'
+      - master
+      - '*/ci'
     paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'tests/data/**'
-    - 'winbuild/**'
+      - '**/*.md'
+      - '**/CMakeLists.txt'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'CMake/**'
+      - 'Dockerfile'
+      - 'projects/**'
+      - 'tests/data/**'
   pull_request:
     branches:
-    - master
+      - master
     paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'tests/data/**'
-    - 'winbuild/**'
+      - '**/*.md'
+      - '**/CMakeLists.txt'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'CMake/**'
+      - 'Dockerfile'
+      - 'projects/**'
+      - 'tests/data/**'
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  # Hard-coded workflow name to avoid colliding with curl-fuzzer's group
+  group: curl-fuzz-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
 permissions: {}
 
+env:
+  DO_NOT_TRACK: '1'
+
 jobs:
   Fuzzing:
-    uses: curl/curl-fuzzer/.github/workflows/ci.yml@master
+    uses: curl/curl-fuzzer/.github/workflows/ci.yml@master  # zizmor: ignore[unpinned-uses]
diff --git a/third-party/curl/.github/workflows/hacktoberfest-accepted.yml b/third-party/curl/.github/workflows/hacktoberfest-accepted.yml
deleted file mode 100644
index c78ff4e301..0000000000
--- a/third-party/curl/.github/workflows/hacktoberfest-accepted.yml
+++ /dev/null
@@ -1,67 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: Hacktoberfest
-
-on:
-  # this must not ever run on any other branch than master
-  push:
-    branches:
-    - master
-
-concurrency:
-  # this should not run in parallel, so just run one at a time
-  group: ${{ github.workflow }}
-
-permissions: {}
-
-jobs:
-  # add hacktoberfest-accepted label to PRs opened starting from September 30th
-  # till November 1st which are closed via commit reference from master branch.
-  merged:
-    runs-on: ubuntu-latest
-    permissions:
-      # requires issues AND pull-requests write permissions to edit labels on PRs!
-      issues: write
-      pull-requests: write
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 100
-
-      - name: Check whether repo participates in Hacktoberfest
-        run: |
-          gh config set prompt disabled && echo "label=$(
-            gh repo view --json repositoryTopics --jq '.repositoryTopics[].name' | grep '^hacktoberfest$')" >> $GITHUB_OUTPUT
-        id: check
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Search relevant commit message lines starting with Closes/Merges
-        run: |
-          git log --format=email ${{ github.event.before }}..${{ github.event.after }} | \
-            grep -Ei "^Close[sd]? " | sort | uniq | tee log
-        if: steps.check.outputs.label == 'hacktoberfest'
-
-      - name: Search for Number-based PR references
-        run: |
-          grep -Eo "#([0-9]+)" log | cut -d# -f2 | sort | uniq | xargs -t -n1 -I{} \
-            gh pr view {} --json number,createdAt \
-              --jq '{number, opened: .createdAt} | [.number, .opened] | join(":")' | tee /dev/stderr | \
-            grep -Eo '^([0-9]+):[0-9]{4}-(09-30T|10-|11-01T)' | cut -d: -f1 | sort | uniq | xargs -t -n1 -I {} \
-              gh pr edit {} --add-label 'hacktoberfest-accepted'
-        if: steps.check.outputs.label == 'hacktoberfest'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Search for URL-based PR references
-        run: |
-          grep -Eo "github.com/(.+)/(.+)/pull/([0-9]+)" log | sort | uniq | xargs -t -n1 -I{} \
-            gh pr view "https://{}" --json number,createdAt \
-              --jq '{number, opened: .createdAt} | [.number, .opened] | join(":")' | tee /dev/stderr | \
-            grep -Eo '^([0-9]+):[0-9]{4}-(09-30T|10-|11-01T)' | cut -d: -f1 | sort | uniq | xargs -t -n1 -I {} \
-              gh pr edit {} --add-label 'hacktoberfest-accepted'
-        if: steps.check.outputs.label == 'hacktoberfest'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/third-party/curl/.github/workflows/http3-linux.yml b/third-party/curl/.github/workflows/http3-linux.yml
new file mode 100644
index 0000000000..2be2399744
--- /dev/null
+++ b/third-party/curl/.github/workflows/http3-linux.yml
@@ -0,0 +1,894 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: 'Linux HTTP/3'
+
+'on':
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  MAKEFLAGS: -j 5
+  CURL_CI: github
+  CURL_TEST_MIN: 1850
+  DO_NOT_TRACK: '1'
+  # renovate: datasource=github-tags depName=awslabs/aws-lc versioning=semver registryUrl=https://github.com
+  AWSLC_VERSION: 5.0.0
+  # renovate: datasource=github-tags depName=google/boringssl versioning=semver registryUrl=https://github.com
+  BORINGSSL_VERSION: 0.20260616.0
+  # renovate: datasource=github-tags depName=gnutls/nettle versioning=semver registryUrl=https://github.com
+  NETTLE_VERSION: 3.10.2
+  # renovate: datasource=github-tags depName=gnutls/gnutls versioning=semver extractVersion=^nettle_?(?<version>.+)_release_.+$ registryUrl=https://github.com
+  GNUTLS_VERSION: 3.8.11
+  # renovate: datasource=github-tags depName=libressl/portable versioning=semver registryUrl=https://github.com
+  LIBRESSL_VERSION: 4.3.2
+  # renovate: datasource=github-releases depName=openssl/openssl versioning=semver extractVersion=^openssl-(?<version>.+)$ registryUrl=https://github.com
+  OPENSSL_VERSION: 4.0.1
+  # manually bumped
+  OPENSSL_PREV_VERSION: 3.6.2
+  OPENSSL_PREV_SHA256: aaf51a1fe064384f811daeaeb4ec4dce7340ec8bd893027eee676af31e83a04f
+  # renovate: datasource=github-tags depName=cloudflare/quiche versioning=semver registryUrl=https://github.com
+  QUICHE_VERSION: 0.29.2
+  # renovate: datasource=github-tags depName=wolfSSL/wolfssl versioning=semver extractVersion=^v?(?<version>.+)-stable$ registryUrl=https://github.com
+  WOLFSSL_VERSION: 5.9.1
+  # renovate: datasource=github-tags depName=ngtcp2/nghttp3 versioning=semver registryUrl=https://github.com
+  NGHTTP3_VERSION: 1.16.0
+  # renovate: datasource=github-tags depName=ngtcp2/ngtcp2 versioning=semver registryUrl=https://github.com
+  NGTCP2_VERSION: 1.23.0
+  # renovate: datasource=github-tags depName=nghttp2/nghttp2 versioning=semver registryUrl=https://github.com
+  NGHTTP2_VERSION: 1.69.0
+  # no tagged releases
+  H2O_VERSION: 11b0cfa2771e3ccad4a852e72473e4e278ab1de7 # 2026-05-28
+  H2O_SHA256: 5ae1bd7b09970d7d49c41fa68193e24da04c2a7ac5581fbe2affc79200b0721f
+
+jobs:
+  build-cache:
+    name: 'Build caches'
+    runs-on: ubuntu-26.04
+
+    steps:
+      - name: 'cache awslc'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-awslc
+        env:
+          cache-name: cache-awslc
+        with:
+          path: ~/awslc/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.AWSLC_VERSION }}
+
+      - name: 'cache boringssl'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-boringssl
+        env:
+          cache-name: cache-boringssl
+        with:
+          path: ~/boringssl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.BORINGSSL_VERSION }}
+
+      - name: 'cache nettle'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-nettle
+        env:
+          cache-name: cache-nettle
+        with:
+          path: ~/nettle/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NETTLE_VERSION }}
+
+      - name: 'cache gnutls'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-gnutls
+        env:
+          cache-name: cache-gnutls
+        with:
+          path: ~/gnutls/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.GNUTLS_VERSION }}-${{ env.NETTLE_VERSION }}
+
+      - name: 'cache libressl'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-libressl
+        env:
+          cache-name: cache-libressl
+        with:
+          path: ~/libressl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.LIBRESSL_VERSION }}
+
+      - name: 'cache openssl'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-openssl-http3-no-deprecated
+        env:
+          cache-name: cache-openssl-http3-no-deprecated
+        with:
+          path: ~/openssl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.OPENSSL_VERSION }}
+
+      - name: 'cache openssl-prev'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-openssl-prev-http3
+        env:
+          cache-name: cache-openssl-prev-http3
+        with:
+          path: ~/openssl-prev/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.OPENSSL_PREV_VERSION }}
+
+      - name: 'cache wolfssl'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-wolfssl
+        env:
+          cache-name: cache-wolfssl
+        with:
+          path: ~/wolfssl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.WOLFSSL_VERSION }}
+
+      - name: 'cache nghttp3'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-nghttp3
+        env:
+          cache-name: cache-nghttp3
+        with:
+          path: ~/nghttp3/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGHTTP3_VERSION }}
+
+      - name: 'cache ngtcp2'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-ngtcp2
+        env:
+          cache-name: cache-ngtcp2
+        with:
+          path: ~/ngtcp2/build
+          key: "${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.OPENSSL_VERSION }}-\
+            ${{ env.LIBRESSL_VERSION }}-${{ env.AWSLC_VERSION }}-${{ env.NETTLE_VERSION }}-${{ env.GNUTLS_VERSION }}-${{ env.WOLFSSL_VERSION }}"
+
+      - name: 'cache ngtcp2 boringssl'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-ngtcp2-boringssl
+        env:
+          cache-name: cache-ngtcp2-boringssl
+        with:
+          path: ~/ngtcp2-boringssl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.BORINGSSL_VERSION }}
+
+      - name: 'cache ngtcp2 openssl-prev'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-ngtcp2-openssl-prev
+        env:
+          cache-name: cache-ngtcp2-openssl-prev
+        with:
+          path: ~/ngtcp2-openssl-prev/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.OPENSSL_PREV_VERSION }}
+
+      - name: 'cache nghttp2'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-nghttp2
+        env:
+          cache-name: cache-nghttp2
+        with:
+          path: ~/nghttp2/build
+          key: "${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGHTTP2_VERSION }}-${{ env.OPENSSL_VERSION }}-\
+            ${{ env.NGTCP2_VERSION }}-${{ env.NGHTTP3_VERSION }}"
+
+      - name: 'cache h2o'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-h2o
+        env:
+          cache-name: cache-h2o
+        with:
+          path: ~/h2o/build
+          key: "${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.H2O_VERSION }}-${{ env.OPENSSL_PREV_VERSION }}"
+
+      - id: settings
+        if: >-
+          ${{ !steps.cache-awslc.outputs.cache-hit ||
+              !steps.cache-boringssl.outputs.cache-hit ||
+              !steps.cache-nettle.outputs.cache-hit ||
+              !steps.cache-gnutls.outputs.cache-hit ||
+              !steps.cache-libressl.outputs.cache-hit ||
+              !steps.cache-openssl-http3-no-deprecated.outputs.cache-hit ||
+              !steps.cache-openssl-prev-http3.outputs.cache-hit ||
+              !steps.cache-wolfssl.outputs.cache-hit ||
+              !steps.cache-nghttp3.outputs.cache-hit ||
+              !steps.cache-ngtcp2-boringssl.outputs.cache-hit ||
+              !steps.cache-ngtcp2-openssl-prev.outputs.cache-hit ||
+              !steps.cache-ngtcp2.outputs.cache-hit ||
+              !steps.cache-nghttp2.outputs.cache-hit ||
+              !steps.cache-h2o.outputs.cache-hit }}
+
+        run: echo 'needs-build=true' >> "$GITHUB_OUTPUT"
+
+      - name: 'install build prereqs'
+        if: ${{ steps.settings.outputs.needs-build == 'true' }}
+        timeout-minutes: 2
+        run: |
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo apt-get -o Dpkg::Use-Pty=0 update
+          sudo apt-get -o Dpkg::Use-Pty=0 install \
+            libtool autoconf automake pkgconf \
+            libbrotli-dev libzstd-dev zlib1g-dev \
+            libev-dev \
+            libuv1-dev \
+            libc-ares-dev \
+            libp11-kit-dev autopoint bison gperf gtk-doc-tools libtasn1-bin  # for GnuTLS
+
+      - name: 'build awslc'
+        if: ${{ !steps.cache-awslc.outputs.cache-hit }}
+        run: |
+          cd ~
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/awslabs/aws-lc/archive/refs/tags/v${AWSLC_VERSION}.tar.gz" --output pkg.bin
+          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
+          cd "aws-lc-${AWSLC_VERSION}"
+          cmake -B . -G Ninja -DBUILD_SHARED_LIBS=ON -DBUILD_TOOL=OFF -DBUILD_TESTING=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/awslc/build
+          cmake --build .
+          cmake --install .
+
+      - name: 'build boringssl'
+        if: ${{ !steps.cache-boringssl.outputs.cache-hit }}
+        run: |
+          mkdir boringssl-src
+          cd boringssl-src
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            "https://boringssl.googlesource.com/boringssl/+archive/${BORINGSSL_VERSION}.tar.gz" --output pkg.bin
+          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
+          cmake -B . -G Ninja -DBUILD_SHARED_LIBS=ON -DBUILD_TESTING=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/boringssl/build
+          cmake --build .
+          cmake --install .
+
+      - name: 'build nettle'
+        if: ${{ !steps.cache-nettle.outputs.cache-hit }}
+        run: |
+          cd ~
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --location --proto-redir =https "https://ftpmirror.gnu.org/nettle/nettle-${NETTLE_VERSION}.tar.gz" --output pkg.bin
+          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
+          cd "nettle-${NETTLE_VERSION}"
+          autoreconf -fi
+          ./configure --disable-dependency-tracking --prefix=/home/runner/nettle/build \
+            --disable-static --disable-openssl --disable-documentation
+          make install
+
+      - name: 'build gnutls'
+        if: ${{ !steps.cache-gnutls.outputs.cache-hit }}
+        run: |
+          cd ~
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            "https://www.gnupg.org/ftp/gcrypt/gnutls/v${GNUTLS_VERSION%.*}/gnutls-${GNUTLS_VERSION}.tar.xz" --output pkg.bin
+          sha256sum pkg.bin && tar -xJf pkg.bin && rm -f pkg.bin
+          cd "gnutls-${GNUTLS_VERSION}"
+          autoreconf -fi
+          # required: libp11-kit-dev libev-dev autopoint bison gperf gtk-doc-tools libtasn1-bin
+          ./configure --disable-dependency-tracking --prefix=/home/runner/gnutls/build \
+            PKG_CONFIG_PATH=/home/runner/nettle/build/lib64/pkgconfig \
+            LDFLAGS=-Wl,-rpath,/home/runner/nettle/build/lib64 \
+            --with-included-libtasn1 --with-included-unistring \
+            --disable-guile --disable-doc --disable-tests --disable-tools
+          make install
+
+      - name: 'build libressl'
+        if: ${{ !steps.cache-libressl.outputs.cache-hit }}
+        run: |
+          cd ~
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-${LIBRESSL_VERSION}.tar.gz" --output pkg.bin
+          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
+          cd "libressl-${LIBRESSL_VERSION}"
+          cmake -B . -G Ninja -DLIBRESSL_APPS=OFF -DLIBRESSL_TESTS=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/libressl/build
+          cmake --build .
+          cmake --install .
+
+      - name: 'build openssl'
+        if: ${{ !steps.cache-openssl-http3-no-deprecated.outputs.cache-hit }}
+        run: |
+          cd ~
+          git clone --quiet --depth 1 --branch "openssl-${OPENSSL_VERSION}" https://github.com/openssl/openssl
+          cd openssl
+          ./config --prefix="$PWD"/build --libdir=lib no-makedepend no-apps no-docs no-tests no-deprecated
+          make
+          make -j1 install_sw
+
+      - name: 'build openssl-prev'
+        if: ${{ !steps.cache-openssl-prev-http3.outputs.cache-hit }}
+        run: |
+          cd ~
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_PREV_VERSION}/openssl-${OPENSSL_PREV_VERSION}.tar.gz" --output pkg.bin
+          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${OPENSSL_PREV_SHA256}" && tar -xzf pkg.bin && rm -f pkg.bin
+          cd "openssl-${OPENSSL_PREV_VERSION}"
+          ./config --prefix=/home/runner/openssl-prev/build --libdir=lib no-makedepend no-apps no-docs no-tests
+          make
+          make -j1 install_sw
+
+      - name: 'build wolfssl'
+        if: ${{ !steps.cache-wolfssl.outputs.cache-hit }}
+        run: |
+          cd ~
+          git clone --quiet --depth 1 --branch "v${WOLFSSL_VERSION}-stable" https://github.com/wolfSSL/wolfssl
+          cd wolfssl
+          ./autogen.sh
+          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-all --enable-quic \
+            --disable-benchmark --disable-crypttests --disable-examples
+          make
+          make install
+
+      - name: 'build nghttp3'
+        if: ${{ !steps.cache-nghttp3.outputs.cache-hit }}
+        run: |
+          cd ~
+          git clone --quiet --depth 1 --branch "v${NGHTTP3_VERSION}" https://github.com/ngtcp2/nghttp3
+          cd nghttp3
+          git submodule update --init --depth 1
+          autoreconf -fi
+          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-lib-only
+          make
+          make install
+
+      - name: 'build ngtcp2'
+        if: ${{ !steps.cache-ngtcp2.outputs.cache-hit }}
+        # building twice to get crypto libs for ossl, libressl and awslc installed
+        run: |
+          cd ~
+          git clone --quiet --depth 1 --branch "v${NGTCP2_VERSION}" https://github.com/ngtcp2/ngtcp2
+          cd ngtcp2
+          autoreconf -fi
+          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-lib-only \
+            PKG_CONFIG_PATH=/home/runner/libressl/build/lib/pkgconfig \
+            --with-openssl
+          make install
+          make clean
+          export PKG_CONFIG_PATH=/home/runner/openssl/build/lib/pkgconfig
+          PKG_CONFIG_PATH+=:/home/runner/nettle/build/lib64/pkgconfig
+          PKG_CONFIG_PATH+=:/home/runner/gnutls/build/lib/pkgconfig
+          PKG_CONFIG_PATH+=:/home/runner/wolfssl/build/lib/pkgconfig
+          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-lib-only \
+            --with-openssl --with-gnutls --with-wolfssl --with-boringssl \
+            BORINGSSL_LIBS='-L/home/runner/awslc/build/lib -lssl -lcrypto' \
+            BORINGSSL_CFLAGS='-I/home/runner/awslc/build/include'
+          make install
+
+      - name: 'build ngtcp2 openssl-prev'
+        if: ${{ !steps.cache-ngtcp2-openssl-prev.outputs.cache-hit }}
+        run: |
+          cd ~
+          git clone --quiet --depth 1 --branch "v${NGTCP2_VERSION}" https://github.com/ngtcp2/ngtcp2 ngtcp2-openssl-prev
+          cd ngtcp2-openssl-prev
+          autoreconf -fi
+          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-lib-only \
+            PKG_CONFIG_PATH=/home/runner/openssl-prev/build/lib/pkgconfig \
+            --with-openssl
+          make install
+
+      - name: 'build ngtcp2 boringssl'
+        if: ${{ !steps.cache-ngtcp2-boringssl.outputs.cache-hit }}
+        run: |
+          cd ~
+          git clone --quiet --depth 1 --branch "v${NGTCP2_VERSION}" https://github.com/ngtcp2/ngtcp2 ngtcp2-boringssl
+          cd ngtcp2-boringssl
+          autoreconf -fi
+          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-lib-only \
+            --with-openssl=no --with-boringssl \
+            BORINGSSL_LIBS='-L/home/runner/boringssl/build/lib -lssl -lcrypto' \
+            BORINGSSL_CFLAGS='-I/home/runner/boringssl/build/include'
+          make install
+
+      - name: 'build nghttp2'
+        if: ${{ !steps.cache-nghttp2.outputs.cache-hit }}
+        run: |
+          cd ~
+          git clone --quiet --depth 1 --branch "v${NGHTTP2_VERSION}" https://github.com/nghttp2/nghttp2
+          cd nghttp2
+          git submodule update --init --depth 1
+          autoreconf -fi
+          # required (for nghttpx application): libc-ares-dev libev-dev zlib1g-dev
+          # optional (for nghttpx application): libbrotli-dev
+          export PKG_CONFIG_PATH=/home/runner/openssl/build/lib/pkgconfig
+          PKG_CONFIG_PATH+=:/home/runner/nghttp3/build/lib/pkgconfig
+          PKG_CONFIG_PATH+=:/home/runner/ngtcp2/build/lib/pkgconfig
+          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-app --enable-http3 \
+            LDFLAGS=-Wl,-rpath,/home/runner/openssl/build/lib \
+            --with-libbrotlienc --with-libbrotlidec
+          make install
+
+      - name: 'build h2o'
+        if: ${{ !steps.cache-h2o.outputs.cache-hit }}
+        run: |
+          cd ~
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/h2o/h2o/archive/${H2O_VERSION}.tar.gz" --output pkg.bin
+          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${H2O_SHA256}" && tar -xzf pkg.bin && rm -f pkg.bin
+          cd "h2o-${H2O_VERSION}"
+          cmake -B . -G Ninja -DWITHOUT_LIBS=ON -DOPENSSL_ROOT_DIR=/home/runner/openssl-prev/build -DCMAKE_INSTALL_PREFIX=/home/runner/h2o/build
+          cmake --build .
+          cmake --install .
+
+  linux:
+    name: ${{ matrix.build.generate && 'CM' || 'AM' }} ${{ matrix.build.name }}
+    needs: build-cache
+    runs-on: ubuntu-26.04
+    timeout-minutes: 10
+    env:
+      CURL_TRACE_PKG_CONFIG: '1'
+      MATRIX_BUILD: ${{ matrix.build.generate && 'cmake' || 'autotools' }}
+      MATRIX_INSTALL_PACKAGES: '${{ matrix.build.install_packages }}'
+    strategy:
+      fail-fast: false
+      matrix:
+        build:
+          - name: 'awslc'
+            install_steps: skipall
+            LDFLAGS: -Wl,-rpath,/home/runner/awslc/build/lib
+            PKG_CONFIG_PATH: /home/runner/awslc/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            # Intentionally using bare '--with-ngtcp2' + 'PKG_CONFIG_PATH' to test this way of configuration, in addition to '--with-ngtcp2=<path>' in other jobs.
+            configure: >-
+              --with-openssl=/home/runner/awslc/build --with-ngtcp2 --enable-ssls-export
+
+          - name: 'awslc'
+            PKG_CONFIG_PATH: /home/runner/awslc/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            generate: >-
+              -DOPENSSL_ROOT_DIR=/home/runner/awslc/build -DUSE_NGTCP2=ON -DBUILD_SHARED_LIBS=OFF
+              -DCMAKE_UNITY_BUILD=ON -DCURL_DROP_UNUSED=ON
+
+          - name: 'boringssl'
+            install_steps: skipall
+            LDFLAGS: -Wl,-rpath,/home/runner/boringssl/build/lib
+            PKG_CONFIG_PATH: /home/runner/boringssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            configure: >-
+              --with-openssl=/home/runner/boringssl/build --with-ngtcp2=/home/runner/ngtcp2-boringssl/build --enable-ssls-export
+
+          - name: 'boringssl'
+            PKG_CONFIG_PATH: "\
+              /home/runner/boringssl/build/lib/pkgconfig:\
+              /home/runner/nghttp3/build/lib/pkgconfig:\
+              /home/runner/ngtcp2-boringssl/build/lib/pkgconfig:\
+              /home/runner/nghttp2/build/lib/pkgconfig"
+            generate: >-
+              -DOPENSSL_ROOT_DIR=/home/runner/boringssl/build -DUSE_NGTCP2=ON -DBUILD_SHARED_LIBS=OFF
+              -DCMAKE_UNITY_BUILD=ON
+
+          - name: 'gnutls'
+            install_packages: libp11-kit-dev libssh-dev
+            install_steps: skipall
+            LDFLAGS: -Wl,-rpath,/home/runner/gnutls/build/lib -Wl,-rpath,/home/runner/nettle/build/lib64 -Wl,-rpath,/home/runner/ngtcp2/build/lib
+            PKG_CONFIG_PATH: /home/runner/nettle/build/lib64/pkgconfig:/home/runner/gnutls/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            configure: >-
+              --with-gnutls=/home/runner/gnutls/build --with-ngtcp2=/home/runner/ngtcp2/build --with-libssh --enable-ssls-export
+
+          - name: 'gnutls'
+            install_packages: libp11-kit-dev libssh-dev
+            LDFLAGS: -Wl,-rpath,/home/runner/gnutls/build/lib
+            PKG_CONFIG_PATH: "\
+              /home/runner/nettle/build/lib64/pkgconfig:\
+              /home/runner/gnutls/build/lib/pkgconfig:\
+              /home/runner/nghttp3/build/lib/pkgconfig:\
+              /home/runner/ngtcp2/build/lib/pkgconfig:\
+              /home/runner/nghttp2/build/lib/pkgconfig"
+            generate: >-
+              -DCURL_USE_GNUTLS=ON -DUSE_NGTCP2=ON -DCURL_USE_LIBSSH=ON
+              -DCMAKE_UNITY_BUILD=ON
+
+          - name: 'libressl'
+            install_steps: skipall
+            LDFLAGS: -Wl,-rpath,/home/runner/libressl/build/lib
+            PKG_CONFIG_PATH: /home/runner/libressl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            # Intentionally using '--with-ngtcp2=<path>' to test this way of configuration, in addition to bare '--with-ngtcp2' + 'PKG_CONFIG_PATH' in other jobs.
+            configure: >-
+              --with-openssl=/home/runner/libressl/build --with-ngtcp2=/home/runner/ngtcp2/build --enable-ssls-export
+              --enable-unity
+
+          - name: 'libressl'
+            PKG_CONFIG_PATH: /home/runner/libressl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            generate: >-
+              -DOPENSSL_ROOT_DIR=/home/runner/libressl/build -DUSE_NGTCP2=ON
+
+          - name: 'openssl'
+            tflags: '--min=1700'
+            LDFLAGS: -Wl,-rpath,/home/runner/openssl/build/lib
+            PKG_CONFIG_PATH: /home/runner/openssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            configure: >-
+              --with-openssl=/home/runner/openssl/build --with-ngtcp2=/home/runner/ngtcp2/build --enable-ech --enable-ssls-export --enable-proxy-http3
+
+          - name: 'openssl'
+            install_steps: skipall
+            PKG_CONFIG_PATH: /home/runner/openssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            generate: >-
+              -DOPENSSL_ROOT_DIR=/home/runner/openssl/build -DUSE_NGTCP2=ON
+              -DCURL_DISABLE_LDAP=ON
+              -DUSE_ECH=ON -DUSE_PROXY_HTTP3=ON
+              -DCMAKE_UNITY_BUILD=ON
+
+          - name: 'openssl-prev'
+            install_steps: skipall
+            LDFLAGS: -Wl,-rpath,/home/runner/openssl-prev/build/lib
+            PKG_CONFIG_PATH: "\
+              /home/runner/openssl-prev/build/lib/pkgconfig:\
+              /home/runner/nghttp3/build/lib/pkgconfig:\
+              /home/runner/nghttp2-openssl-prev/build/lib/pkgconfig"
+            configure: >-
+              --with-openssl=/home/runner/openssl-prev/build --with-ngtcp2=/home/runner/ngtcp2-openssl-prev/build --enable-ssls-export
+
+          - name: 'openssl-prev'
+            tflags: '--min=1700'
+            PKG_CONFIG_PATH: "\
+              /home/runner/openssl-prev/build/lib/pkgconfig:\
+              /home/runner/nghttp3/build/lib/pkgconfig:\
+              /home/runner/ngtcp2-openssl-prev/build/lib/pkgconfig:\
+              /home/runner/nghttp2/build/lib/pkgconfig"
+            generate: >-
+              -DOPENSSL_ROOT_DIR=/home/runner/openssl-prev/build -DUSE_NGTCP2=ON
+              -DCURL_DISABLE_LDAP=ON
+
+          - name: 'quiche'
+            install_steps: skipall
+            LDFLAGS: -Wl,-rpath,/home/runner/quiche/target/release
+            PKG_CONFIG_PATH: /home/runner/nghttp2/build/lib/pkgconfig
+            configure: >-
+              --with-openssl=/home/runner/quiche/boringssl
+              --with-quiche=/home/runner/quiche/target/release
+              --with-ca-fallback
+              --enable-unity
+
+          - name: 'quiche'
+            PKG_CONFIG_PATH: /home/runner/nghttp2/build/lib/pkgconfig:/home/runner/quiche/target/release
+            generate: >-
+              -DOPENSSL_ROOT_DIR=/home/runner/quiche/boringssl
+              -DUSE_QUICHE=ON
+              -DCURL_CA_FALLBACK=ON
+
+          - name: 'wolfssl'
+            install_packages: libssh2-1-dev
+            install_steps: skipall
+            LDFLAGS: -Wl,-rpath,/home/runner/wolfssl/build/lib
+            PKG_CONFIG_PATH: /home/runner/wolfssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            configure: >-
+              --with-wolfssl=/home/runner/wolfssl/build --with-ngtcp2=/home/runner/ngtcp2/build --enable-ech --with-libssh2 --enable-ssls-export
+              --enable-unity
+
+          - name: 'wolfssl'
+            install_packages: libssh2-1-dev
+            tflags: '--min=1900'
+            PKG_CONFIG_PATH: /home/runner/wolfssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            generate: >-
+              -DCURL_USE_WOLFSSL=ON -DUSE_NGTCP2=ON
+              -DUSE_ECH=ON
+
+    steps:
+      - name: 'install prereqs'
+        timeout-minutes: 2
+        env:
+          INSTALL_PACKAGES: >-
+            ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') && 'stunnel4 ' || '' }}
+            ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') &&
+              'apache2 apache2-dev libnghttp2-dev vsftpd dante-server libev-dev' || '' }}
+
+        run: |
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo apt-get -o Dpkg::Use-Pty=0 update
+          sudo apt-get -o Dpkg::Use-Pty=0 install \
+            libtool autoconf automake pkgconf \
+            libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libidn2-0-dev libldap-dev libuv1-dev valgrind \
+            ${INSTALL_PACKAGES} \
+            ${MATRIX_INSTALL_PACKAGES}
+
+      - name: 'cache awslc'
+        if: ${{ contains(matrix.build.name, 'awslc') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-awslc
+        env:
+          cache-name: cache-awslc
+        with:
+          path: ~/awslc/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.AWSLC_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache boringssl'
+        if: ${{ contains(matrix.build.name, 'boringssl') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-boringssl
+        env:
+          cache-name: cache-boringssl
+        with:
+          path: ~/boringssl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.BORINGSSL_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache nettle'
+        if: ${{ contains(matrix.build.name, 'gnutls') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-nettle
+        env:
+          cache-name: cache-nettle
+        with:
+          path: ~/nettle/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NETTLE_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache gnutls'
+        if: ${{ contains(matrix.build.name, 'gnutls') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-gnutls
+        env:
+          cache-name: cache-gnutls
+        with:
+          path: ~/gnutls/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.GNUTLS_VERSION }}-${{ env.NETTLE_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache libressl'
+        if: ${{ contains(matrix.build.name, 'libressl') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-libressl
+        env:
+          cache-name: cache-libressl
+        with:
+          path: ~/libressl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.LIBRESSL_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache openssl'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-openssl-http3-no-deprecated
+        env:
+          cache-name: cache-openssl-http3-no-deprecated
+        with:
+          path: ~/openssl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.OPENSSL_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache openssl-prev'
+        if: ${{ contains(matrix.build.name, 'openssl-prev') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-openssl-prev-http3
+        env:
+          cache-name: cache-openssl-prev-http3
+        with:
+          path: ~/openssl-prev/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.OPENSSL_PREV_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache wolfssl'
+        if: ${{ contains(matrix.build.name, 'wolfssl') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-wolfssl
+        env:
+          cache-name: cache-wolfssl
+        with:
+          path: ~/wolfssl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.WOLFSSL_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache nghttp3'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-nghttp3
+        env:
+          cache-name: cache-nghttp3
+        with:
+          path: ~/nghttp3/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGHTTP3_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache ngtcp2'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-ngtcp2
+        env:
+          cache-name: cache-ngtcp2
+        with:
+          path: ~/ngtcp2/build
+          key: "${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.OPENSSL_VERSION }}-\
+            ${{ env.LIBRESSL_VERSION }}-${{ env.AWSLC_VERSION }}-${{ env.NETTLE_VERSION }}-${{ env.GNUTLS_VERSION }}-${{ env.WOLFSSL_VERSION }}"
+          fail-on-cache-miss: true
+
+      - name: 'cache ngtcp2 boringssl'
+        if: ${{ contains(matrix.build.name, 'boringssl') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-ngtcp2-boringssl
+        env:
+          cache-name: cache-ngtcp2-boringssl
+        with:
+          path: ~/ngtcp2-boringssl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.BORINGSSL_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache ngtcp2 openssl-prev'
+        if: ${{ contains(matrix.build.name, 'openssl-prev') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-ngtcp2-openssl-prev
+        env:
+          cache-name: cache-ngtcp2-openssl-prev
+        with:
+          path: ~/ngtcp2-openssl-prev/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.OPENSSL_PREV_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache nghttp2'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-nghttp2
+        env:
+          cache-name: cache-nghttp2
+        with:
+          path: ~/nghttp2/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGHTTP2_VERSION }}-${{ env.OPENSSL_VERSION }}-${{ env.NGTCP2_VERSION }}-${{ env.NGHTTP3_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache h2o'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-h2o
+        env:
+          cache-name: cache-h2o
+        with:
+          path: ~/h2o/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.H2O_VERSION }}-${{ env.OPENSSL_PREV_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache quiche'
+        if: ${{ contains(matrix.build.name, 'quiche') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-quiche
+        env:
+          cache-name: cache-quiche
+        with:
+          path: ~/quiche
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.QUICHE_VERSION }}
+
+      - name: 'build quiche and boringssl'
+        if: ${{ contains(matrix.build.name, 'quiche') && !steps.cache-quiche.outputs.cache-hit }}
+        run: |
+          cd ~
+          git clone --quiet --depth 1 --branch "${QUICHE_VERSION}" --recursive https://github.com/cloudflare/quiche
+          cd quiche
+          cargo build -v --package quiche --release --features ffi,pkg-config-meta,qlog --verbose
+          ln -s libquiche.so target/release/libquiche.so.0
+          cd ..
+          mkdir -p quiche/boringssl/lib
+          find quiche/target/release \( -name libcrypto.a -o -name libssl.a \) -exec ln -vnf -- '{}' quiche/boringssl/lib \;
+          find quiche/target/release/build/boring-sys-*/out/boringssl/src -maxdepth 1 \( -name include \) -exec ln -vsf -- '../../{}' quiche/boringssl \;
+
+          # include dir
+          # /home/runner/quiche/boringssl/include
+          # lib dir
+          # /home/runner/quiche/boringssl/lib
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'autoreconf'
+        if: ${{ matrix.build.configure }}
+        run: autoreconf -fi
+
+      - name: 'configure'
+        env:
+          LDFLAGS: '${{ matrix.build.LDFLAGS }}'
+          MATRIX_CONFIGURE: '${{ matrix.build.configure }}'
+          MATRIX_GENERATE: '${{ matrix.build.generate }}'
+          MATRIX_PKG_CONFIG_PATH: '${{ matrix.build.PKG_CONFIG_PATH }}'
+        run: |
+          [ -n "${MATRIX_PKG_CONFIG_PATH}" ] && export PKG_CONFIG_PATH="${MATRIX_PKG_CONFIG_PATH}"
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            [[ "${MATRIX_GENERATE}" = *'boringssl'* ]] && options=" -DBORINGSSL_VERSION=${BORINGSSL_VERSION}"
+            cmake -B bld -G Ninja \
+              -DCMAKE_C_COMPILER_TARGET="$(uname -m)-unknown-linux-gnu" -DBUILD_STATIC_LIBS=ON \
+              -DCURL_WERROR=ON -DENABLE_DEBUG=ON \
+              -DCURL_USE_LIBUV=ON -DCURL_ENABLE_NTLM=ON \
+              -DTEST_NGHTTPX=/home/runner/nghttp2/build/bin/nghttpx \
+              -DH2O=/home/runner/h2o/build/bin/h2o \
+              -DHTTPD_NGHTTPX=/home/runner/nghttp2/build/bin/nghttpx \
+              ${MATRIX_GENERATE} ${options}
+          else
+            [[ "${MATRIX_CONFIGURE}" = *'boringssl'* ]] && export CPPFLAGS="-DCURL_BORINGSSL_VERSION=\\\"${BORINGSSL_VERSION}\\\""
+            mkdir bld && cd bld && ../configure --enable-warnings --enable-werror --enable-debug --disable-static \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              --with-libuv --enable-ntlm \
+              --with-test-h2o=/home/runner/h2o/build/bin/h2o \
+              --with-test-nghttpx=/home/runner/nghttp2/build/bin/nghttpx \
+              ${MATRIX_CONFIGURE}
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+
+      - name: 'test configs'
+        run: grep -H -v '^#' bld/tests/config bld/tests/http/config.ini || true
+
+      - name: 'build'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose
+          else
+            make -C bld V=1
+          fi
+
+      - name: 'curl -V'
+        run: |
+          find . -type f \( -name curl -o -name '*.so.*' -o -name '*.a' \) -print0 | xargs -0 file --
+          find . -type f \( -name curl -o -name '*.so.*' -o -name '*.a' \) -print0 | xargs -0 stat -c '%10s bytes: %n' --
+          bld/src/curl --disable -V
+
+      - name: 'build tests'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') }}
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target testdeps
+          else
+            make -C bld V=1 -C tests
+          fi
+
+      - name: 'install test prereqs'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
+        run: |
+          python3 -m venv ~/venv
+          if bld/src/curl --disable -V 2>/dev/null | grep smb; then
+            ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/requirements.txt
+          fi
+
+      - name: 'run tests'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
+        env:
+          TFLAGS: '${{ matrix.build.tflags }}'
+        run: |
+          TFLAGS+=' -n'
+          source ~/venv/bin/activate
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target test-ci
+          else
+            make -C bld V=1 test-ci
+          fi
+
+      - name: 'run tests (valgrind)'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
+        run: |
+          export TFLAGS='-j6 --min=4 HTTP/3'
+          source ~/venv/bin/activate
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target test-ci
+          else
+            make -C bld V=1 test-ci
+          fi
+
+      - name: 'install pytest prereqs'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
+        run: |
+          [ -d ~/venv ] || python3 -m venv ~/venv
+          ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/http/requirements.txt
+
+      - name: 'run pytest (event based)'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
+        env:
+          CURL_TEST_EVENT: 1
+          PYTEST_ADDOPTS: '--color=yes'
+          PYTEST_XDIST_AUTO_NUM_WORKERS: 4
+        run: |
+          source ~/venv/bin/activate
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target curl-pytest-ci
+          else
+            make -C bld V=1 pytest-ci
+          fi
diff --git a/third-party/curl/.github/workflows/label.yml b/third-party/curl/.github/workflows/label.yml
index baab1e42a3..3922b8b7df 100644
--- a/third-party/curl/.github/workflows/label.yml
+++ b/third-party/curl/.github/workflows/label.yml
@@ -2,27 +2,34 @@
 #
 # SPDX-License-Identifier: curl
 
-# This workflow will triage pull requests and apply a label based on the
+# This workflow triages pull requests and applies a label based on the
 # paths that are modified in the pull request.
 #
-# To use this workflow, you will need to set up a .github/labeler.yml
-# file with configuration.  For more information, see:
-# https://github.com/actions/labeler
+# To use this workflow, you need to set up a .github/labeler.yml file with
+# configuration.  For more information, see: https://github.com/actions/labeler
 
-name: Labeler
-on: [pull_request_target]
+name: 'Labeler'
+
+'on': [pull_request_target]  # zizmor: ignore[dangerous-triggers]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  DO_NOT_TRACK: '1'
 
 jobs:
   label:
-
-    runs-on: ubuntu-latest
+    name: 'Labeler'
+    runs-on: ubuntu-slim
     permissions:
-      contents: read
-      pull-requests: write
+      contents: read        # To comply with https://github.com/actions/labeler documentation
+      pull-requests: write  # To edit labels on PRs
 
     steps:
-    - uses: actions/labeler@v4
-      with:
-        repo-token: "${{ secrets.GITHUB_TOKEN }}"
-        # Workaround for actions/labeler#112
-        sync-labels: ''
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
+        with:
+          repo-token: '${{ secrets.GITHUB_TOKEN }}'
diff --git a/third-party/curl/.github/workflows/linkcheck.yml b/third-party/curl/.github/workflows/linkcheck.yml
deleted file mode 100644
index 18d12990bc..0000000000
--- a/third-party/curl/.github/workflows/linkcheck.yml
+++ /dev/null
@@ -1,36 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: Markdown links
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-    paths:
-    - '.github/workflows/linkcheck.yml'
-    - '**.md'
-  pull_request:
-    branches:
-    - master
-    paths:
-    - '.github/workflows/linkcheck.yml'
-    - '**.md'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  # Docs: https://github.com/marketplace/actions/markdown-link-check
-  check:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v3
-    - uses: gaurav-nelson/github-action-markdown-link-check@v1
-      with:
-        use-quiet-mode: 'yes'
diff --git a/third-party/curl/.github/workflows/linux-old.yml b/third-party/curl/.github/workflows/linux-old.yml
new file mode 100644
index 0000000000..46fa9acffd
--- /dev/null
+++ b/third-party/curl/.github/workflows/linux-old.yml
@@ -0,0 +1,185 @@
+# Copyright (C) Daniel Fandrich, <dan@coneharvesters.com>, et al.
+#
+# SPDX-License-Identifier: curl
+#
+# Compile on an old version of Linux that has barely the minimal build
+# requirements for CMake. This tests that curl is still usable on really
+# outdated systems.
+#
+# Debian stretch is chosen as it closely matches some of the oldest major
+# versions we support (especially cmake); see docs/INTERNALS.md and it
+# is still supported (as of this writing).
+# stretch has ELTS support from Freexian until 2027-06-30
+# For ELTS info see https://www.freexian.com/lts/extended/docs/how-to-use-extended-lts/
+# The Debian key expires 2025-05-20, after which package signature
+# verification may need to be disabled.
+# httrack is one of the smallest downloaders, needed to bootstrap ELTS,
+# and doesn not conflict with the curl we are building.
+
+name: 'Linux Old'
+
+'on':
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  MAKEFLAGS: -j 5
+  CURL_CI: github
+  CURL_TEST_MIN: 1560
+  DEBIAN_FRONTEND: noninteractive
+  DO_NOT_TRACK: '1'
+
+jobs:
+  cmake-autotools:
+    name: 'autotools & cmake'
+    runs-on: ubuntu-latest
+    container: debian:stretch-20220622-slim@sha256:c5cd3ffceeb25b683bf5111ea89bf8049a177e00fb237235d48076a19cc80097
+
+    steps:
+      - name: 'install prereqs'
+        # Remember, this shell is dash, not bash
+        run: |
+          sed -E -i -e s@[a-z]+\.debian\.org/@archive.debian.org/debian-archive/@ -e '/ stretch-updates /d' /etc/apt/sources.list
+          apt-get -o Dpkg::Use-Pty=0 update
+          # See comment above if this fails after 2025-05-20
+          apt-get -o Dpkg::Use-Pty=0 install -y --no-install-suggests --no-install-recommends httrack
+          httrack --get https://deb.freexian.com/extended-lts/pool/main/f/freexian-archive-keyring/freexian-archive-keyring_2022.06.08_all.deb
+          sha256sum freexian-archive-keyring_2022.06.08_all.deb && dpkg -i freexian-archive-keyring_2022.06.08_all.deb
+          echo 'deb http://deb.freexian.com/extended-lts stretch-lts main contrib non-free' | tee /etc/apt/sources.list.d/extended-lts.list
+          apt-get -o Dpkg::Use-Pty=0 update
+          apt-get -o Dpkg::Use-Pty=0 install -y --no-install-suggests --no-install-recommends \
+            make automake autoconf libtool ninja-build gcc pkg-config libpsl-dev libzstd-dev zlib1g-dev libkrb5-dev libldap2-dev stunnel4
+          # GitHub's actions/checkout needs newer glibc and libstdc++. The latter also depends on
+          # gcc-8-base, but it does not actually seem used in our situation and is not available in
+          # the main repo, so force the install.
+          httrack --get https://deb.freexian.com/extended-lts/pool/main/g/glibc/libc6_2.28-10+deb10u5_amd64.deb
+          httrack --get https://deb.freexian.com/extended-lts/pool/main/g/gcc-8/libstdc++6_8.3.0-6_amd64.deb
+          sha256sum libc6_*_amd64.deb libstdc++6_*_amd64.deb && dpkg -i --force-depends libc6_*_amd64.deb libstdc++6_*_amd64.deb
+
+      - name: 'install prereqs (cmake)'
+        env:
+          CMAKE_VERSION: 3.18.0  # Earliest version supported by curl
+          CMAKE_SHA256: 4d9a9d3351161073a67e49366d701b6fa4b0343781982dc5eef08a02a750d403
+        run: |
+          cd ~
+          fn="cmake-${CMAKE_VERSION}-linux-x86_64"
+          httrack --get "https://github.com/Kitware/CMake/releases/download/v${CMAKE_VERSION}/${fn}.tar.gz"
+          sha256sum "${fn}".tar*.gz | tee /dev/stderr | grep -qwF -- "${CMAKE_SHA256}" && tar -xf "${fn}".tar*.gz && rm -f "${fn}".tar*.gz
+          mv "cmake-${CMAKE_VERSION}-Linux-x86_64" cmake
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'CM build-only configure (out-of-tree)'
+        run: |
+          ~/cmake/bin/cmake -B bld-1 -G Ninja -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON -DBUILD_SHARED_LIBS=ON \
+            -DCURL_ENABLE_SSL=OFF -DENABLE_ARES=OFF -DCURL_ZSTD=OFF -DCURL_USE_GSSAPI=OFF -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=OFF
+
+      - name: 'CM build-only build'
+        run: |
+          ~/cmake/bin/cmake --build bld-1 --verbose
+          ~/cmake/bin/cmake --install bld-1 --verbose
+
+      - name: 'CM build-only curl -V'
+        run: bld-1/src/curl --disable --version
+
+      - name: 'CM build-only configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld-1/CMakeFiles/CMake*.log 2>/dev/null || true
+
+      - name: 'CM build-only curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld-1/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld-1/lib/curl_config.h | sort || true
+
+      # when this job can get libssh 0.9.0 or greater, this should get that enabled again
+      # when this job can get c-ares 1.16.0 or greater, this should get that enabled again
+
+      - name: 'CM configure (out-of-tree, zstd, gssapi)'
+        run: |
+          ~/cmake/bin/cmake -B bld-oldie -G Ninja -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON -DBUILD_SHARED_LIBS=ON \
+            -DCURL_ENABLE_SSL=OFF -DENABLE_ARES=OFF -DCURL_USE_GSSAPI=ON -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=OFF \
+            -DCURL_LIBCURL_VERSIONED_SYMBOLS=ON
+
+      - name: 'CM configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld-oldie/CMakeFiles/CMake*.log 2>/dev/null || true
+
+      - name: 'CM curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld-oldie/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld-oldie/lib/curl_config.h | sort || true
+
+      - name: 'CM build'
+        run: ~/cmake/bin/cmake --build bld-oldie
+
+      - name: 'CM curl -V'
+        run: bld-oldie/src/curl --disable --version
+
+      - name: 'CM install'
+        run: ~/cmake/bin/cmake --install bld-oldie
+
+      - name: 'CM build tests'
+        run: ~/cmake/bin/cmake --build bld-oldie --target testdeps
+
+      - name: 'CM run tests'
+        run: ~/cmake/bin/cmake --build bld-oldie --target test-ci
+
+      - name: 'CM build examples'
+        run: ~/cmake/bin/cmake --build bld-oldie --target curl-examples-build
+
+      - name: 'AM autoreconf'
+        run: autoreconf -fi
+
+      - name: 'AM configure (out-of-tree, zstd, gssapi)'
+        run: |
+          mkdir bld-am
+          cd bld-am
+          ../configure --prefix="$PWD"/../curl-install-am --enable-unity --enable-warnings --enable-werror --disable-shared \
+            --disable-dependency-tracking --enable-option-checking=fatal \
+            --without-ssl --disable-ares --without-libssh2 --with-zstd --with-gssapi
+
+      - name: 'AM configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld-am/config.log 2>/dev/null || true
+
+      - name: 'AM curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld-am/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld-am/lib/curl_config.h | sort || true
+
+      - name: 'AM build'
+        run: make -C bld-am
+
+      - name: 'AM curl -V'
+        run: bld-am/src/curl --disable --version
+
+      - name: 'AM install'
+        run: make -C bld-am install
+
+      - name: 'AM build tests'
+        run: make -C bld-am/tests all
diff --git a/third-party/curl/.github/workflows/linux.yml b/third-party/curl/.github/workflows/linux.yml
index d39b959bb9..fff7f1c876 100644
--- a/third-party/curl/.github/workflows/linux.yml
+++ b/third-party/curl/.github/workflows/linux.yml
@@ -2,36 +2,26 @@
 #
 # SPDX-License-Identifier: curl
 
-name: Linux
+name: 'Linux'
 
-on:
+'on':
   push:
     branches:
-    - master
-    - '*/ci'
+      - master
+      - '*/ci'
     paths-ignore:
-    - '**/*.md'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
   pull_request:
     branches:
-    - master
+      - master
     paths-ignore:
-    - '**/*.md'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
@@ -40,372 +30,974 @@ concurrency:
 permissions: {}
 
 env:
-  MAKEFLAGS: -j 3
-  bearssl-version: 0.6
-  libressl-version: v3.7.3
-  mbedtls-version: v3.4.0
-  mod_h2-version: v2.0.21
-  msh3-version: v0.6.0
-  openssl3-version: openssl-3.1.1
-  quictls-version: OpenSSL_1_1_1t+quic
-  rustls-version: v0.10.0
+  MAKEFLAGS: -j 5
+  CURL_CI: github
+  CURL_TEST_MIN: 1660
+  DO_NOT_TRACK: '1'
+  # renovate: datasource=github-tags depName=awslabs/aws-lc versioning=semver registryUrl=https://github.com
+  AWSLC_VERSION: 5.0.0
+  # renovate: datasource=github-tags depName=google/boringssl versioning=semver registryUrl=https://github.com
+  BORINGSSL_VERSION: 0.20260616.0
+  # renovate: datasource=github-releases depName=pizlonator/fil-c versioning=semver-coerced registryUrl=https://github.com
+  FIL_C_VERSION: '0.680'
+  # renovate: datasource=github-tags depName=libressl/portable versioning=semver registryUrl=https://github.com
+  LIBRESSL_VERSION: 4.3.2
+  # renovate: datasource=github-tags depName=Mbed-TLS/mbedtls versioning=semver registryUrl=https://github.com
+  MBEDTLS_VERSION: 4.0.0
+  # manually bumped
+  MBEDTLS_PREV_VERSION: 3.6.5
+  MBEDTLS_PREV_SHA256: 4a11f1777bb95bf4ad96721cac945a26e04bf19f57d905f241fe77ebeddf46d8
+  # renovate: datasource=github-tags depName=nghttp2/nghttp2 versioning=semver registryUrl=https://github.com
+  NGHTTP2_VERSION: 1.69.0
+  # handled in renovate.json
+  OPENLDAP_VERSION: 2.6.10
+  # renovate: datasource=github-releases depName=openssl/openssl versioning=semver extractVersion=^openssl-(?<version>.+)$ registryUrl=https://github.com
+  OPENSSL_VERSION: 4.0.1
+  # renovate: datasource=github-tags depName=rustls/rustls-ffi versioning=semver registryUrl=https://github.com
+  RUSTLS_VERSION: 0.15.3
+  # renovate: datasource=github-tags depName=wolfSSL/wolfssl versioning=semver extractVersion=^v?(?<version>.+)-stable$ registryUrl=https://github.com
+  WOLFSSL_VERSION: 5.9.1
 
 jobs:
-  autotools:
-    name: ${{ matrix.build.name }}
-    runs-on: 'ubuntu-latest'
+  linux:
+    name: ${{ matrix.build.generate && 'CM' || 'AM' }} ${{ matrix.build.name }}
+    runs-on: ${{ matrix.build.image || 'ubuntu-latest' }}
     container: ${{ matrix.build.container }}
-    timeout-minutes: 90
+    timeout-minutes: 15
+    env:
+      MATRIX_BUILD: ${{ matrix.build.generate && 'cmake' || 'autotools' }}
+      MATRIX_INSTALL_PACKAGES: '${{ matrix.build.install_packages }}'
+      MATRIX_INSTALL_STEPS: '${{ matrix.build.install_steps }}'
     strategy:
       fail-fast: false
       matrix:
         build:
-        - name: bearssl
-          install_packages: zlib1g-dev valgrind
-          install_steps: bearssl pytest
-          configure: LDFLAGS="-Wl,-rpath,$HOME/bearssl/lib" --with-bearssl=$HOME/bearssl --enable-debug
+          - name: 'awslc'
+            install_steps: awslc pytest
+            LDFLAGS: -Wl,-rpath,/home/runner/awslc/lib
+            configure: --with-openssl=/home/runner/awslc --enable-ech --enable-ntlm --enable-smb
 
-        - name: bearssl-clang
-          install_packages: zlib1g-dev clang
-          install_steps: bearssl
-          configure: CC=clang LDFLAGS="-Wl,-rpath,$HOME/bearssl/lib" --with-bearssl=$HOME/bearssl --enable-debug
+          - name: 'awslc'
+            install_packages: libidn2-dev
+            install_steps: awslc
+            generate: -DOPENSSL_ROOT_DIR=/home/runner/awslc -DUSE_ECH=ON -DCMAKE_UNITY_BUILD=OFF -DCURL_DROP_UNUSED=ON -DCURL_PATCHSTAMP=test-patch -DCURL_ENABLE_NTLM=ON
 
-        - name: libressl
-          install_packages: zlib1g-dev valgrind
-          install_steps: libressl pytest
-          configure: LDFLAGS="-Wl,-rpath,$HOME/libressl/lib" --with-openssl=$HOME/libressl --enable-debug
+          - name: 'boringssl'
+            install_steps: boringssl pytest
+            generate: -DOPENSSL_ROOT_DIR=/home/runner/boringssl -DUSE_ECH=ON -DCURL_ENABLE_NTLM=ON
 
-        - name: libressl-clang
-          install_packages: zlib1g-dev clang
-          install_steps: libressl
-          configure: CC=clang LDFLAGS="-Wl,-rpath,$HOME/libressl/lib" --with-openssl=$HOME/libressl --enable-debug
+          - name: 'libressl krb5'
+            image: ubuntu-24.04-arm
+            install_packages: libidn2-dev libnghttp2-dev libldap-dev libkrb5-dev
+            install_steps: libressl-c-arm pytest codeset-test1
+            LDFLAGS: -Wl,-rpath,/home/runner/libressl/lib
+            configure: --with-openssl=/home/runner/libressl --with-gssapi --enable-debug
 
-        - name: mbedtls
-          install_packages: libnghttp2-dev valgrind
-          install_steps: mbedtls pytest
-          configure: LDFLAGS="-Wl,-rpath,$HOME/mbedtls/lib" --with-mbedtls=$HOME/mbedtls --enable-debug
+          - name: 'libressl krb5 valgrind 1'
+            image: ubuntu-24.04-arm
+            install_packages: libnghttp2-dev libldap-dev libkrb5-dev valgrind
+            install_steps: libressl-c-arm
+            tflags: '--min=870 1 to 950'
+            generate: -DOPENSSL_ROOT_DIR=/home/runner/libressl -DCURL_USE_GSSAPI=ON -DENABLE_DEBUG=ON -DCURL_LIBCURL_VERSIONED_SYMBOLS=ON -DCURL_ENABLE_NTLM=ON
 
-        - name: mbedtls-clang
-          install_packages: libnghttp2-dev clang
-          install_steps: mbedtls
-          configure: CC=clang LDFLAGS="-Wl,-rpath,$HOME/mbedtls/lib" --with-mbedtls=$HOME/mbedtls --enable-debug
+          - name: 'libressl krb5 valgrind 2'
+            image: ubuntu-24.04-arm
+            install_packages: libnghttp2-dev libldap-dev libkrb5-dev valgrind
+            install_steps: libressl-c-arm
+            tflags: '--min=900 951 to 9999'
+            generate: -DOPENSSL_ROOT_DIR=/home/runner/libressl -DCURL_USE_GSSAPI=ON -DENABLE_DEBUG=ON -DCURL_LIBCURL_VERSIONED_SYMBOLS=ON -DCURL_ENABLE_NTLM=ON
 
-        - name: msh3
-          install_packages: zlib1g-dev valgrind
-          install_steps: quictls msh3
-          configure: LDFLAGS="-Wl,-rpath,$HOME/msh3/lib -Wl,-rpath,$HOME/quictls/lib" --with-msh3=$HOME/msh3 --with-openssl=$HOME/quictls --enable-debug
+          - name: 'libressl clang'
+            image: ubuntu-24.04-arm
+            install_packages: clang
+            install_steps: libressl-c-arm
+            CC: clang
+            LDFLAGS: -Wl,-rpath,/home/runner/libressl/lib
+            configure: --with-openssl=/home/runner/libressl --enable-debug
 
-        - name: openssl3
-          install_packages: zlib1g-dev valgrind
-          install_steps: gcc-11 openssl3 pytest
-          configure: LDFLAGS="-Wl,-rpath,$HOME/openssl3/lib64" --with-openssl=$HOME/openssl3 --enable-debug --enable-websockets
+          - name: 'libressl Fil-C'
+            install_steps: filc libressl-filc nghttp2-filc pytest
+            tflags: '!776'  # adds 1-9 minutes to the test run step, and fails consistently
+            CC: /home/runner/filc/build/bin/filcc
+            PKG_CONFIG_PATH: /home/runner/nghttp2/lib/pkgconfig
+            generate: >-
+              -DBUILD_STATIC_LIBS=ON -DBUILD_SHARED_LIBS=OFF -DCMAKE_UNITY_BUILD=OFF -DCURL_DISABLE_TYPECHECK=ON
+              -DOPENSSL_ROOT_DIR=/home/runner/libressl -DCURL_USE_LIBPSL=OFF
+              -DCURL_ZLIB=OFF -DCURL_BROTLI=OFF -DCURL_ZSTD=OFF
+              -DCURL_DISABLE_LDAP=ON -DUSE_LIBIDN2=OFF -DCURL_USE_LIBSSH2=OFF
+              -DCURL_ENABLE_NTLM=ON
 
-        - name: openssl3-O3
-          install_packages: zlib1g-dev valgrind
-          install_steps: gcc-11 openssl3
-          configure: CFLAGS=-O3 LDFLAGS="-Wl,-rpath,$HOME/openssl3/lib64" --with-openssl=$HOME/openssl3 --enable-debug --enable-websockets
+          - name: 'mbedtls gss valgrind 1'
+            image: ubuntu-24.04-arm
+            install_packages: libnghttp2-dev libidn2-dev libldap-dev libgss-dev valgrind
+            install_steps: mbedtls-latest-arm
+            tflags: '--min=850 1 to 1000'
+            LDFLAGS: -Wl,-rpath,/home/runner/mbedtls/lib
+            PKG_CONFIG_PATH: /home/runner/mbedtls/lib/pkgconfig
+            generate: -DCURL_USE_MBEDTLS=ON -DENABLE_DEBUG=ON -DCURL_USE_GSSAPI=ON -DCURL_DROP_UNUSED=ON
 
-        - name: openssl3-clang
-          install_packages: zlib1g-dev clang
-          install_steps: openssl3
-          configure: CC=clang LDFLAGS="-Wl,-rpath,$HOME/openssl3/lib64" --with-openssl=$HOME/openssl3 --enable-debug --enable-websockets
+          - name: 'mbedtls gss valgrind 2'
+            image: ubuntu-24.04-arm
+            install_packages: libnghttp2-dev libidn2-dev libldap-dev libgss-dev valgrind
+            install_steps: mbedtls-latest-arm
+            tflags: '--min=900 1001 to 9999'
+            LDFLAGS: -Wl,-rpath,/home/runner/mbedtls/lib
+            PKG_CONFIG_PATH: /home/runner/mbedtls/lib/pkgconfig
+            generate: -DCURL_USE_MBEDTLS=ON -DENABLE_DEBUG=ON -DCURL_USE_GSSAPI=ON
 
-        - name: address-sanitizer
-          install_packages: zlib1g-dev libssh2-1-dev clang libssl-dev libubsan1 libasan8 libtsan2
-          install_steps: pytest
-          configure: >
-            CC=clang
-            CFLAGS="-fsanitize=address,undefined,signed-integer-overflow -fno-sanitize-recover=undefined,integer -Wformat -Werror=format-security -Werror=array-bounds -g"
-            LDFLAGS="-fsanitize=address,undefined -fno-sanitize-recover=undefined,integer"
-            LIBS="-ldl -lubsan"
-            --with-openssl --enable-debug --enable-websockets
+          - name: 'mbedtls clang'
+            install_packages: libssh-dev libnghttp2-dev libldap-dev clang
+            install_steps: mbedtls-latest-intel pytest
+            CC: clang
+            LDFLAGS: -Wl,-rpath,/home/runner/mbedtls/lib
+            configure: --with-mbedtls=/home/runner/mbedtls --with-libssh --enable-debug --with-fish-functions-dir --with-zsh-functions-dir
 
-        - name: memory-sanitizer
-          install_packages: clang
-          install_steps:
-          configure: >
-            CC=clang
-            CFLAGS="-fsanitize=memory -Wformat -Werror=format-security -Werror=array-bounds -g"
-            LDFLAGS="-fsanitize=memory"
-            LIBS="-ldl"
-            --without-ssl --without-zlib --without-brotli --without-zstd --without-libpsl --without-nghttp2 --enable-debug --enable-websocketsx
+          - name: 'mbedtls-prev'
+            install_packages: libssh2-1-dev libnghttp2-dev libuv1-dev
+            install_steps: mbedtls-prev pytest
+            PKG_CONFIG_PATH: /home/runner/mbedtls-prev/lib/pkgconfig  # Requires v3.6.0
+            generate: -DCURL_USE_MBEDTLS=ON -DCURL_USE_LIBUV=ON -DENABLE_DEBUG=ON
 
-        - name: event-based
-          install_packages: libssh-dev valgrind
-          configure: --enable-debug --disable-shared --disable-threaded-resolver --with-libssh --with-openssl
-          tflags: -n -e '!TLS-SRP'
+          - name: 'mbedtls-pkg MultiSSL !pc'
+            install_packages: libnghttp2-dev libmbedtls-dev
+            install_steps: mbedtls-latest-intel skipall
+            generate: >-
+              -DCURL_USE_MBEDTLS=ON -DENABLE_DEBUG=ON -DCURL_DEFAULT_SSL_BACKEND=mbedtls
+              -DMBEDTLS_INCLUDE_DIR=/home/runner/mbedtls/include
+              -DMBEDTLS_LIBRARY=/home/runner/mbedtls/lib/libmbedtls.a
+              -DMBEDX509_LIBRARY=/home/runner/mbedtls/lib/libmbedx509.a
+              -DMBEDCRYPTO_LIBRARY=/home/runner/mbedtls/lib/libmbedcrypto.a
+              -DCURL_USE_PKGCONFIG=OFF -DCURL_USE_OPENSSL=ON
+              -DBUILD_LIBCURL_DOCS=OFF -DBUILD_MISC_DOCS=OFF -DENABLE_CURL_MANUAL=OFF
+              -DCURL_COMPLETION_FISH=ON -DCURL_COMPLETION_ZSH=ON
 
-        - name: hyper
-          install_steps: rust hyper valgrind
-          configure: LDFLAGS="-Wl,-rpath,$HOME/hyper/target/debug" --with-openssl --with-hyper=$HOME/hyper --enable-debug --enable-websockets
+          - name: 'rustls valgrind 1'
+            install_packages: libnghttp2-dev libldap-dev valgrind
+            install_steps: rust rustls
+            tflags: '--min=820 1 to 1000'
+            generate: -DCURL_USE_RUSTLS=ON -DUSE_ECH=ON -DENABLE_DEBUG=ON
 
-        - name: rustls
-          install_steps: rust rustls pytest valgrind
-          configure: --with-rustls=$HOME/rustls --enable-debug
+          - name: 'rustls valgrind 2'
+            install_packages: libnghttp2-dev libldap-dev valgrind
+            install_steps: rust rustls
+            tflags: '--min=830 1001 to 9999'
+            generate: -DCURL_USE_RUSTLS=ON -DUSE_ECH=ON -DENABLE_DEBUG=ON
 
-        - name: Intel compiler - without SSL
-          install_packages: zlib1g-dev valgrind
-          install_steps: intel
-          configure: CC=icc --enable-debug --without-ssl
+          - name: 'rustls'
+            install_packages: libnghttp2-dev libldap-dev
+            install_steps: rust rustls skiprun pytest
+            configure: --with-rustls --enable-ech --enable-debug
 
-        - name: Intel compiler - OpenSSL
-          install_packages: zlib1g-dev libssl-dev valgrind
-          install_steps: intel
-          configure: CC=icc --enable-debug --with-openssl
+          - name: 'wolfssl-all'
+            image: ubuntu-24.04-arm
+            install_steps: wolfssl-all-arm
+            LDFLAGS: -Wl,-rpath,/home/runner/wolfssl-all/lib
+            configure: --with-wolfssl=/home/runner/wolfssl-all --enable-ech --enable-debug
 
-        - name: Slackware-openssl-with-gssapi-gcc
-          # These are essentially the same flags used to build the curl Slackware package
-          # https://ftpmirror.infania.net/slackware/slackware64-current/source/n/curl/curl.SlackBuild
-          configure: --with-openssl --with-libssh2 --with-gssapi --enable-ares --enable-static=no --without-ca-bundle --with-ca-path=/etc/ssl/certs
-          # Docker Hub image that `container-job` executes in
-          container: 'andy5995/slackware-build-essential:15.0'
+          - name: 'wolfssl-opensslextra valgrind 1'
+            image: ubuntu-24.04-arm
+            install_packages: valgrind
+            install_steps: wolfssl-opensslextra-arm
+            tflags: '--min=815 1 to 1000'
+            LDFLAGS: -Wl,-rpath,/home/runner/wolfssl-opensslextra/lib
+            configure: --with-wolfssl=/home/runner/wolfssl-opensslextra --enable-ech --enable-debug
 
-        - name: Alpine MUSL
-          configure: --enable-debug --enable-websockets --with-ssl --with-libssh2 --with-libidn2 --with-gssapi --enable-ldap --with-libpsl
-          container: 'alpine:3.18'
+          - name: 'wolfssl-opensslextra valgrind 2'
+            image: ubuntu-24.04-arm
+            install_packages: valgrind
+            install_steps: wolfssl-opensslextra-arm
+            tflags: '--min=835 1001 to 9999'
+            LDFLAGS: -Wl,-rpath,/home/runner/wolfssl-opensslextra/lib
+            configure: --with-wolfssl=/home/runner/wolfssl-opensslextra --enable-ech --enable-debug
+
+          - name: 'openssl default'
+            install_steps: pytest
+            configure: --with-openssl --enable-debug --disable-unity
+
+          - name: 'openssl libssh2 sync-resolver valgrind 1 +analyzer'
+            image: ubuntu-26.04-arm
+            install_packages: gcc-16 libidn2-dev libssh2-1-dev libnghttp2-dev libldap-dev valgrind
+            CC: gcc-16
+            tflags: '--min=965 1 to 1000'
+            generate: -DENABLE_DEBUG=ON -DENABLE_THREADED_RESOLVER=OFF -DCURL_GCC_ANALYZER=ON -DCURL_ENABLE_NTLM=ON
+
+          - name: 'openssl libssh2 sync-resolver valgrind 2'
+            image: ubuntu-26.04-arm
+            install_packages: gcc-16 libidn2-dev libssh2-1-dev libnghttp2-dev libldap-dev valgrind
+            CC: gcc-16
+            tflags: '--min=920 1001 to 9999'
+            generate: -DENABLE_DEBUG=ON -DENABLE_THREADED_RESOLVER=OFF -DCURL_ENABLE_NTLM=ON
+
+          - name: 'openssl intel C89'
+            install_packages: libssh-dev
+            install_steps: pytest
+            configure: CFLAGS=-std=gnu89 --with-openssl --with-libssh --enable-debug
+
+          - name: 'openssl arm C89'
+            image: ubuntu-24.04-arm
+            install_packages: libssh2-1-dev
+            install_steps: pytest
+            configure: CFLAGS=-std=gnu89 --with-openssl --with-libssh2 --enable-debug --disable-verbose
+
+          - name: 'openssl -O3 libssh valgrind 1'
+            install_packages: libssh-dev valgrind
+            CFLAGS: -O3
+            tflags: '--min=950 1 to 1000'
+            generate: -DENABLE_DEBUG=ON -DCURL_USE_LIBSSH=ON -DCMAKE_UNITY_BUILD_BATCH_SIZE=50 -DCURL_ENABLE_NTLM=ON
+
+          - name: 'openssl -O3 libssh valgrind 2'
+            install_packages: libssh-dev valgrind
+            CFLAGS: -O3
+            tflags: '--min=900 1001 to 9999'
+            generate: -DENABLE_DEBUG=ON -DCURL_USE_LIBSSH=ON -DCMAKE_UNITY_BUILD_BATCH_SIZE=50 -DCURL_ENABLE_NTLM=ON
+
+          - name: 'openssl clang krb5 openldap static'
+            install_steps: openldap-static
+            install_packages: libidn2-dev libkrb5-dev clang libssl-dev
+            CC: clang
+            configure: >-
+              --enable-static --disable-shared --with-openssl --with-gssapi --enable-debug --disable-docs
+              --disable-manual --with-ldap=/home/runner/openldap-static --with-ldap-lib=ldap --with-lber-lib=lber
+
+          - name: 'openssl clang krb5 LTO'
+            image: ubuntu-24.04-arm
+            install_packages: libssh2-1-dev libkrb5-dev clang
+            install_steps: skiprun pytest
+            CC: clang
+            generate: -DCURL_USE_OPENSSL=ON -DCURL_USE_GSSAPI=ON -DENABLE_DEBUG=ON -DCURL_LTO=ON
+
+          - name: 'openssl !ipv6 !--libcurl !--digest-auth'
+            image: ubuntu-24.04-arm
+            configure: --with-openssl --disable-ipv6 --enable-debug --disable-unity --disable-libcurl-option --disable-digest-auth --enable-ntlm --enable-smb
+
+          - name: 'curl_global_init_mem debug valgrind'
+            image: ubuntu-24.04-arm
+            install_packages: valgrind
+            tflags: '--min=1700'
+            configure: >-
+              --enable-init-mem-debug
+              --with-openssl --disable-debug --enable-unity
+              --enable-ntlm --enable-smb
+
+          - name: 'openssl https-only'
+            image: ubuntu-24.04-arm
+            tflags: '--min=1260'
+            configure: >-
+              --with-openssl --enable-debug --disable-unity
+              --disable-dict --disable-gopher --disable-ldap --disable-telnet
+              --disable-imap --disable-pop3 --disable-smtp
+              --disable-rtsp
+              --without-libssh2 --without-libssh
+              --disable-tftp --disable-ftp --disable-file --disable-smb
+              --enable-ntlm
+
+          - name: 'openssl torture 1'
+            install_packages: libnghttp2-dev libssh2-1-dev libc-ares-dev
+            tflags: '-t --shallow=25 --min=960 1 to 1000'
+            torture: true
+            generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON -DCURL_ENABLE_NTLM=ON
+
+          - name: 'openssl torture 2'
+            install_packages: libnghttp2-dev libssh2-1-dev libc-ares-dev
+            tflags: '-t --shallow=25 --min=915 1001 to 9999'
+            torture: true
+            generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON -DCURL_ENABLE_NTLM=ON
+
+          - name: 'openssl i686'
+            install_packages: gcc-14-i686-linux-gnu libssl-dev:i386 libssh2-1-dev:i386 libidn2-dev:i386 libc-ares-dev:i386 zlib1g-dev:i386
+            CC: i686-linux-gnu-gcc-14
+            LDFLAGS: -L/usr/lib/i386-linux-gnu
+            PKG_CONFIG_PATH: /usr/lib/i386-linux-gnu/pkgconfig
+            configure: >-
+              CPPFLAGS=-I/usr/include/i386-linux-gnu
+              --host=i686-linux-gnu
+              --with-openssl --with-libssh2 --with-libidn2 --enable-ares --enable-debug
+
+          - name: '!ssl !http !smtp !imap'
+            image: ubuntu-24.04-arm
+            tflags: '--min=500'
+            configure: --without-ssl --enable-debug --disable-http --disable-smtp --disable-imap --disable-unity
+
+          - name: 'clang-tidy'
+            image: ubuntu-26.04
+            install_packages: clang-22 clang-tidy-22 libssl-dev libidn2-dev libssh2-1-dev libnghttp2-dev libldap-dev libkrb5-dev libgnutls28-dev
+            install_steps: skiprun mbedtls-latest-intel rustls wolfssl-opensslextra-intel
+            install_steps_brew: openssl@4 gsasl
+            CC: clang-22
+            CFLAGS: -Wunused-macros
+            LDFLAGS: >-
+              -Wl,-rpath,/home/runner/wolfssl-opensslextra/lib
+              -Wl,-rpath,/home/runner/mbedtls/lib
+              -Wl,-rpath,/home/runner/rustls/lib
+              -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/openssl@4/lib
+              -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/gsasl/lib
+
+            PKG_CONFIG_PATH: "\
+              /home/runner/wolfssl-opensslextra/lib/pkgconfig:\
+              /home/runner/mbedtls/lib/pkgconfig:\
+              /home/runner/rustls/lib/pkgconfig:\
+              /home/linuxbrew/.linuxbrew/opt/gsasl/lib/pkgconfig"
+            generate: >-
+              -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/home/linuxbrew/.linuxbrew/opt/openssl@4
+              -DCURL_USE_WOLFSSL=ON -DCURL_USE_GNUTLS=ON -DCURL_USE_MBEDTLS=ON -DCURL_USE_RUSTLS=ON
+              -DCURL_USE_GSASL=ON
+              -DUSE_ECH=ON -DCURL_USE_GSSAPI=ON -DUSE_SSLS_EXPORT=ON
+              -DCURL_CLANG_TIDY=ON -DCLANG_TIDY=/usr/bin/clang-tidy-22
+
+          - name: 'clang-tidy H3 c-ares !examples'
+            image: ubuntu-26.04
+            install_packages: clang-22 clang-tidy-22 libidn2-dev libssh-dev libnghttp2-dev
+            install_steps: skiprun
+            install_steps_brew: libngtcp2 libnghttp3 c-ares
+            CC: clang-22
+            CFLAGS: -Wunused-macros
+            LDFLAGS: >-
+              -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/openssl/lib
+              -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/libngtcp2/lib
+              -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/libnghttp3/lib
+              -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/c-ares/lib
+
+            PKG_CONFIG_PATH: "\
+              /home/linuxbrew/.linuxbrew/opt/libngtcp2/lib/pkgconfig:\
+              /home/linuxbrew/.linuxbrew/opt/libnghttp3/lib/pkgconfig:\
+              /home/linuxbrew/.linuxbrew/opt/c-ares/lib/pkgconfig"
+            generate: >-
+              -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/home/linuxbrew/.linuxbrew/opt/openssl -DUSE_NGTCP2=ON
+              -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=ON -DUSE_HTTPSRR=ON -DENABLE_ARES=ON -DUSE_PROXY_HTTP3=ON
+              -DCURL_DISABLE_VERBOSE_STRINGS=ON
+              -DCURL_CLANG_TIDY=ON -DCLANG_TIDY=/usr/bin/clang-tidy-22
+
+          - name: 'address-sanitizer'
+            image: ubuntu-26.04
+            install_packages: clang-22 libssh-dev libidn2-dev libnghttp2-dev libubsan1 libasan8 libtsan2
+            install_steps: pytest randcurl
+            install_steps_brew: openssl@4
+            CC: clang-22
+            CFLAGS: >-
+              -fsanitize=address,bounds,leak,signed-integer-overflow,undefined
+              -fno-sanitize-recover=address,bounds,leak,signed-integer-overflow,undefined
+              -fPIC
+
+            LDFLAGS: >-
+              -fsanitize=address,bounds,leak,signed-integer-overflow,undefined
+              -fno-sanitize-recover=address,bounds,leak,signed-integer-overflow,undefined -ldl -lubsan
+
+            generate: -DENABLE_DEBUG=ON -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/home/linuxbrew/.linuxbrew/opt/openssl@4 -DUSE_ECH=ON -DCURL_USE_LIBSSH=ON
+
+          - name: 'address-sanitizer H3 c-ares'
+            image: ubuntu-26.04
+            install_packages: clang-22 libubsan1 libasan8 libtsan2
+            install_steps: pytest
+            install_steps_brew: openssl libssh2 libngtcp2 libnghttp3 c-ares
+            CC: clang-22
+            CFLAGS: >-
+              -fsanitize=address,bounds,leak,signed-integer-overflow,undefined
+              -fno-sanitize-recover=address,bounds,leak,signed-integer-overflow,undefined
+
+            LDFLAGS: >-
+              -fsanitize=address,bounds,leak,signed-integer-overflow,undefined
+              -fno-sanitize-recover=address,bounds,leak,signed-integer-overflow,undefined -ldl -lubsan
+              -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/c-ares/lib
+
+            PKG_CONFIG_PATH: "\
+              /home/linuxbrew/.linuxbrew/opt/libssh2/lib/pkgconfig:\
+              /home/linuxbrew/.linuxbrew/opt/libngtcp2/lib/pkgconfig:\
+              /home/linuxbrew/.linuxbrew/opt/libnghttp3/lib/pkgconfig:\
+              /home/linuxbrew/.linuxbrew/opt/c-ares/lib/pkgconfig"
+            generate: >-
+              -DENABLE_DEBUG=ON -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/home/linuxbrew/.linuxbrew/opt/openssl -DUSE_NGTCP2=ON
+              -DUSE_SSLS_EXPORT=ON -DENABLE_ARES=ON -DUSE_PROXY_HTTP3=ON
+
+          - name: 'thread-sanitizer'
+            image: ubuntu-26.04
+            install_packages: clang-22 libtsan2
+            install_steps: pytest openssl-tsan
+            CC: clang-22
+            CFLAGS: -fsanitize=thread -g
+            LDFLAGS: -fsanitize=thread
+            generate: -DOPENSSL_ROOT_DIR=/home/runner/openssl -DUSE_ECH=ON -DENABLE_DEBUG=ON
+
+          - name: 'memory-sanitizer'
+            image: ubuntu-26.04
+            install_packages: clang-22
+            install_steps: randcurl
+            CC: clang-22
+            CFLAGS: -fsanitize=memory -Wformat -Werror=format-security -Werror=array-bounds -g
+            LDFLAGS: -fsanitize=memory
+            LIBS: -ldl
+            configure: --without-ssl --without-zlib --without-brotli --without-zstd --without-libpsl --without-nghttp2 --enable-debug
+            tflags: '--min=1540'
+
+          - name: 'event-based'
+            install_packages: libssh-dev
+            configure: --enable-debug --enable-static --disable-shared --disable-threaded-resolver --with-libssh --with-openssl --enable-ntlm --enable-smb
+            tflags: '-n --test-event --min=1420'
+
+          - name: 'duphandle'
+            image: ubuntu-24.04-arm
+            install_packages: libssh-dev
+            configure: --enable-debug --enable-static --disable-shared --disable-threaded-resolver --with-libssh --with-openssl
+            tflags: '-n --test-duphandle'
+
+          - name: 'IntelC openssl'
+            install_packages: libssl-dev
+            install_steps: intelc
+            CC: icc
+            configure: --enable-debug --with-openssl
+
+          - name: 'Slackware !ssl gssapi gcc'
+            # Flags used to build the curl Slackware package, except OpenSSL 1.1.0:
+            # https://ftpmirror.infania.net/slackware/slackware64-current/source/n/curl/curl.SlackBuild
+            configure: --enable-debug --without-ssl --with-libssh2 --with-gssapi --enable-ares --without-ca-bundle --with-ca-path=/etc/ssl/certs
+            # Docker Hub image that `container-job` executes in
+            container: andy5995/slackware-build-essential:15.0@sha256:f4f2242999038a2c2deb4e5727187caaae92502a7daf8353068932621e1ec92f
+
+          - name: 'Alpine MUSL https-rr'
+            configure: --enable-debug --with-ssl --with-libssh2 --with-libidn2 --with-gssapi --enable-ldap --with-libpsl --enable-httpsrr --enable-ares --enable-threaded-resolver
+            container: alpine:3.23@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11 # 3.23.4
+
+          - name: 'Alpine MUSL https-rr c-ares'
+            configure: --enable-debug --with-ssl --with-libssh2 --with-libidn2 --with-gssapi --enable-ldap --with-libpsl --enable-httpsrr --enable-ares --disable-threaded-resolver
+            container: alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc # 3.20.10
 
     steps:
-    - if: matrix.build.container == null
-      run: |
-        sudo apt-get update
-        sudo apt-get install libtool autoconf automake pkg-config stunnel4 libpsl-dev libbrotli-dev libzstd-dev ${{ matrix.build.install_packages }}
-        sudo python3 -m pip install impacket
-      name: 'install prereqs and impacket'
+      - name: 'install prereqs'
+        if: ${{ matrix.build.container == null && !contains(matrix.build.name, 'i686') }}
+        timeout-minutes: 3
+        env:
+          INSTALL_PACKAGES_BREW: '${{ matrix.build.install_steps_brew }}'
+          INSTALL_PACKAGES: >-
+            ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') && 'stunnel4' || '' }}
+            ${{ contains(matrix.build.install_steps, 'pytest') && 'apache2 apache2-dev libnghttp2-dev vsftpd dante-server' || '' }}
 
-    - if: startsWith(matrix.build.container, 'alpine')
-      run: |
-        apk add --no-cache build-base autoconf automake libtool perl openssl-dev libssh2-dev zlib-dev brotli-dev zstd-dev libidn2-dev openldap-dev heimdal-dev libpsl-dev py3-impacket py3-asn1 py3-six py3-pycryptodomex perl-time-hires openssh stunnel sudo
-      name: 'install dependencies'
+        run: |
+          ls -l /etc/apt/sources.list.d
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo apt-get -o Dpkg::Use-Pty=0 update
+          sudo apt-get -o Dpkg::Use-Pty=0 install \
+            libtool autoconf automake pkgconf \
+            libpsl-dev zlib1g-dev libbrotli-dev libzstd-dev \
+            ${INSTALL_PACKAGES} \
+            ${MATRIX_INSTALL_PACKAGES}
+          if [ -n "${INSTALL_PACKAGES_BREW}" ]; then
+            /home/linuxbrew/.linuxbrew/bin/brew install ${INSTALL_PACKAGES_BREW}
+          fi
 
-    - uses: actions/checkout@v3
+      - name: 'install prereqs (i686)'
+        if: ${{ contains(matrix.build.name, 'i686') }}
+        timeout-minutes: 2
+        run: |
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo dpkg --add-architecture i386
+          sudo apt-get -o Dpkg::Use-Pty=0 update
+          sudo apt-get -o Dpkg::Use-Pty=0 install \
+            libtool autoconf automake pkgconf stunnel4 \
+            libpsl-dev:i386 libbrotli-dev:i386 libzstd-dev:i386 \
+            ${MATRIX_INSTALL_PACKAGES}
 
-    - if: contains(matrix.build.install_steps, 'gcc-11')
-      run: |
-        sudo add-apt-repository ppa:ubuntu-toolchain-r/ppa
-        sudo apt-get update
-        sudo apt-get install gcc-11
-        sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-11 100
-        sudo update-alternatives --set gcc /usr/bin/gcc-11
-        gcc --version
-      name: 'install gcc-11'
+      - name: 'install prereqs (alpine)'
+        if: ${{ startsWith(matrix.build.container, 'alpine') }}
+        run: |
+          apk add --no-cache build-base autoconf automake libtool perl openssl-dev \
+            libssh2-dev zlib-dev brotli-dev zstd-dev libidn2-dev openldap-dev \
+            krb5-dev libpsl-dev c-ares-dev \
+            py3-impacket py3-asn1 py3-six py3-pycryptodomex \
+            perl-time-hires openssh stunnel sudo git openssl
 
-    - name: cache bearssl
-      if: contains(matrix.build.install_steps, 'bearssl')
-      uses: actions/cache@v3
-      id: cache-bearssl
-      env:
-        cache-name: cache-bearssl
-      with:
-        path: /home/runner/bearssl
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-bearssl-${{ env.bearssl-version }}
+      - name: 'install Fil-C'
+        if: ${{ contains(matrix.build.install_steps, 'filc') }}
+        run: |
+          cd /home/runner
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/pizlonator/fil-c/releases/download/v${FIL_C_VERSION}/filc-${FIL_C_VERSION}-linux-x86_64.tar.xz" --output pkg.bin
+          sha256sum pkg.bin && tar -xJf pkg.bin && rm -f pkg.bin && mv "filc-${FIL_C_VERSION}-linux-x86_64" filc
+          cd filc
+          ./setup.sh
 
-    - name: 'build bearssl'
-      if: contains(matrix.build.install_steps, 'bearssl') && steps.cache-bearssl.outputs.cache-hit != 'true'
-      run: |
-        curl -LOsSf --retry 6 --retry-connrefused --max-time 999 https://bearssl.org/bearssl-${{ env.bearssl-version }}.tar.gz
-        tar -xzf bearssl-${{ env.bearssl-version }}.tar.gz
-        cd bearssl-${{ env.bearssl-version }}
-        make
-        mkdir -p $HOME/bearssl/lib $HOME/bearssl/include
-        cp inc/*.h $HOME/bearssl/include
-        cp build/libbearssl.* $HOME/bearssl/lib
+      - name: 'cache libressl (c-arm)'
+        if: ${{ contains(matrix.build.install_steps, 'libressl-c-arm') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-libressl-c-arm
+        env:
+          cache-name: cache-libressl-c-arm
+        with:
+          path: ~/libressl
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.LIBRESSL_VERSION }}
 
-    - name: cache libressl
-      if: contains(matrix.build.install_steps, 'libressl')
-      uses: actions/cache@v3
-      id: cache-libressl
-      env:
-        cache-name: cache-libressl
-      with:
-        path: /home/runner/libressl
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-libressl-${{ env.libressl-version }}
+      - name: 'build libressl (c-arm)'
+        if: ${{ contains(matrix.build.install_steps, 'libressl-c-arm') && !steps.cache-libressl-c-arm.outputs.cache-hit }}
+        run: |
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-${LIBRESSL_VERSION}.tar.gz" --output pkg.bin
+          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
+          cd "libressl-${LIBRESSL_VERSION}"
+          cmake -B . -G Ninja -DLIBRESSL_APPS=OFF -DLIBRESSL_TESTS=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/libressl -DCURL_ENABLE_NTLM=ON
+          cmake --build .
+          cmake --install .
 
-    - name: 'build libressl'
-      if: contains(matrix.build.install_steps, 'libressl') && steps.cache-libressl.outputs.cache-hit != 'true'
-      run: |
-        git clone --quiet --depth=1 -b ${{ env.libressl-version }} https://github.com/libressl-portable/portable.git libressl-git
-        cd libressl-git
-        ./autogen.sh
-        ./configure --prefix=$HOME/libressl
-        make install
+      - name: 'cache libressl (filc)'
+        if: ${{ contains(matrix.build.install_steps, 'libressl-filc') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-libressl-filc
+        env:
+          cache-name: cache-libressl-filc
+        with:
+          path: ~/libressl
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.LIBRESSL_VERSION }}-${{ env.FIL_C_VERSION }}
 
-    - name: cache mbedtls
-      if: contains(matrix.build.install_steps, 'mbedtls')
-      uses: actions/cache@v3
-      id: cache-mbedtls
-      env:
-        cache-name: cache-mbedtls
-      with:
-        path: /home/runner/mbedtls
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-mbedtls-${{ env.mbedtls-version }}
+      - name: 'build libressl (filc)'
+        if: ${{ contains(matrix.build.install_steps, 'libressl-filc') && !steps.cache-libressl-filc.outputs.cache-hit }}
+        run: |
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-${LIBRESSL_VERSION}.tar.gz" --output pkg.bin
+          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
+          cd "libressl-${LIBRESSL_VERSION}"
+          cmake -B . -G Ninja -DLIBRESSL_APPS=OFF -DLIBRESSL_TESTS=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/libressl \
+            -DCMAKE_C_COMPILER=/home/runner/filc/build/bin/filcc -DENABLE_ASM=OFF
+          cmake --build .
+          cmake --install .
 
-    - name: 'build mbedtls'
-      if: contains(matrix.build.install_steps, 'mbedtls') && steps.cache-mbedtls.outputs.cache-hit != 'true'
-      run: |
-        git clone --quiet --depth=1 -b ${{ env.mbedtls-version }} https://github.com/ARMmbed/mbedtls
-        cd mbedtls
-        make DESTDIR=$HOME/mbedtls install
+      - name: 'cache nghttp2 (filc)'
+        if: ${{ contains(matrix.build.install_steps, 'nghttp2-filc') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-nghttp2-filc
+        env:
+          cache-name: cache-nghttp2-filc
+        with:
+          path: ~/nghttp2
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.NGHTTP2_VERSION }}-${{ env.FIL_C_VERSION }}
 
-    - name: cache openssl3
-      if: contains(matrix.build.install_steps, 'openssl3')
-      uses: actions/cache@v3
-      id: cache-openssl3
-      env:
-        cache-name: cache-openssl3
-      with:
-        path: /home/runner/openssl3
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.openssl3-version }}
+      - name: 'build nghttp2 (filc)'
+        if: ${{ contains(matrix.build.install_steps, 'nghttp2-filc') && !steps.cache-nghttp2-filc.outputs.cache-hit }}
+        run: |
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/nghttp2/nghttp2/releases/download/v${NGHTTP2_VERSION}/nghttp2-${NGHTTP2_VERSION}.tar.xz" --output pkg.bin
+          sha256sum pkg.bin && tar -xJf pkg.bin && rm -f pkg.bin
+          cd "nghttp2-${NGHTTP2_VERSION}"
+          cmake -B . -G Ninja -DENABLE_LIB_ONLY=ON -DBUILD_TESTING=OFF -DENABLE_DOC=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/nghttp2 \
+            -DBUILD_STATIC_LIBS=ON -DBUILD_SHARED_LIBS=OFF \
+            -DCMAKE_C_COMPILER=/home/runner/filc/build/bin/filcc
+          cmake --build .
+          cmake --install .
 
-    - name: 'install openssl3'
-      if: contains(matrix.build.install_steps, 'openssl3') && steps.cache-openssl3.outputs.cache-hit != 'true'
-      run: |
-        git clone --quiet --depth=1 -b ${{ env.openssl3-version }} https://github.com/openssl/openssl
-        cd openssl
-        ./config enable-tls1_3 --prefix=$HOME/openssl3
-        make -j1 install_sw
+      - name: 'cache wolfssl (all-arm)'
+        if: ${{ contains(matrix.build.install_steps, 'wolfssl-all-arm') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-wolfssl-all-arm
+        env:
+          cache-name: cache-wolfssl-all-arm
+        with:
+          path: ~/wolfssl-all
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.WOLFSSL_VERSION }}
 
-    - name: cache quictls
-      if: contains(matrix.build.install_steps, 'quictls')
-      uses: actions/cache@v3
-      id: cache-quictls
-      env:
-        cache-name: cache-quictls
-      with:
-        path: /home/runner/quictls
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-quictls-${{ env.quictls-version }}
+      - name: 'build wolfssl (all-arm)'  # does not support `OPENSSL_COEXIST`
+        if: ${{ contains(matrix.build.install_steps, 'wolfssl-all-arm') && !steps.cache-wolfssl-all-arm.outputs.cache-hit }}
+        run: |
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/wolfSSL/wolfssl/archive/v${WOLFSSL_VERSION}-stable.tar.gz" --output pkg.bin
+          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
+          cd "wolfssl-${WOLFSSL_VERSION}-stable"
+          ./autogen.sh
+          ./configure --disable-dependency-tracking --prefix=/home/runner/wolfssl-all \
+            --enable-tls13 --enable-harden --enable-all \
+            --disable-benchmark --disable-crypttests --disable-examples
+          make install
 
-    - name: 'build quictls'
-      if: contains(matrix.build.install_steps, 'quictls') && steps.cache-quictls.outputs.cache-hit != 'true'
-      run: |
-        git clone --quiet --depth=1 -b ${{ env.quictls-version }} https://github.com/quictls/openssl
-        cd openssl
-        ./config enable-tls1_3 --prefix=$HOME/quictls
-        make -j1 install_sw
+      - name: 'cache wolfssl (opensslextra-intel)'  # does support `OPENSSL_COEXIST`
+        if: ${{ contains(matrix.build.install_steps, 'wolfssl-opensslextra-intel') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-wolfssl-opensslextra-intel
+        env:
+          cache-name: cache-wolfssl-opensslextra-intel
+        with:
+          path: ~/wolfssl-opensslextra
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.WOLFSSL_VERSION }}
 
-    - name: cache msh3
-      if: contains(matrix.build.install_steps, 'msh3')
-      uses: actions/cache@v3
-      id: cache-msh3
-      env:
-        cache-name: cache-msh3
-      with:
-        path: /home/runner/msh3
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-msh3-${{ env.msh3-version }}
+      - name: 'build wolfssl (opensslextra-intel)'
+        if: ${{ contains(matrix.build.install_steps, 'wolfssl-opensslextra-intel') && !steps.cache-wolfssl-opensslextra-intel.outputs.cache-hit }}
+        run: |
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/wolfSSL/wolfssl/archive/v${WOLFSSL_VERSION}-stable.tar.gz" --output pkg.bin
+          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
+          cd "wolfssl-${WOLFSSL_VERSION}-stable"
+          ./autogen.sh
+          ./configure --disable-dependency-tracking --prefix=/home/runner/wolfssl-opensslextra \
+            --enable-tls13 --enable-harden --enable-ech --enable-ed25519 --enable-opensslextra \
+            --disable-benchmark --disable-crypttests --disable-examples
+          make install
 
-    - name: 'build msh3'
-      if: contains(matrix.build.install_steps, 'msh3') && steps.cache-msh3.outputs.cache-hit != 'true'
-      run: |
-        git clone --quiet -b ${{ env.msh3-version }} --depth=1 --recursive https://github.com/nibanks/msh3
-        cd msh3 && mkdir build && cd build
-        cmake -G 'Unix Makefiles' -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_INSTALL_PREFIX=$HOME/msh3 ..
-        cmake --build .
-        cmake --install .
+      - name: 'cache wolfssl (opensslextra-arm)'  # does support `OPENSSL_COEXIST`
+        if: ${{ contains(matrix.build.install_steps, 'wolfssl-opensslextra-arm') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-wolfssl-opensslextra-arm
+        env:
+          cache-name: cache-wolfssl-opensslextra-arm
+        with:
+          path: ~/wolfssl-opensslextra
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.WOLFSSL_VERSION }}
 
-    - if: contains(matrix.build.install_steps, 'rust')
-      run: |
-        cd $HOME
-        curl -sSf --compressed https://sh.rustup.rs/ | sh -s -- -y
-        source $HOME/.cargo/env
-        rustup toolchain install nightly
-      name: 'install rust'
+      - name: 'build wolfssl (opensslextra-arm)'
+        if: ${{ contains(matrix.build.install_steps, 'wolfssl-opensslextra-arm') && !steps.cache-wolfssl-opensslextra-arm.outputs.cache-hit }}
+        run: |
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/wolfSSL/wolfssl/archive/v${WOLFSSL_VERSION}-stable.tar.gz" --output pkg.bin
+          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
+          cd "wolfssl-${WOLFSSL_VERSION}-stable"
+          ./autogen.sh
+          ./configure --disable-dependency-tracking --prefix=/home/runner/wolfssl-opensslextra \
+            --enable-tls13 --enable-harden --enable-ech --enable-ed25519 --enable-opensslextra \
+            --disable-benchmark --disable-crypttests --disable-examples
+          make install
 
-    - name: cache rustls
-      if: contains(matrix.build.install_steps, 'rustls')
-      uses: actions/cache@v3
-      id: cache-rustls
-      env:
-        cache-name: cache-rustls
-      with:
-        path: /home/runner/rustls
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-rustls-${{ env.rustls-version }}
+      - name: 'cache mbedtls (latest-intel)'
+        if: ${{ contains(matrix.build.install_steps, 'mbedtls-latest-intel') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-mbedtls-latest-intel
+        env:
+          cache-name: cache-mbedtls-latest-intel
+        with:
+          path: ~/mbedtls
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.MBEDTLS_VERSION }}
 
-    - name: 'build rustls'
-      if: contains(matrix.build.install_steps, 'rustls') && steps.cache-rustls.outputs.cache-hit != 'true'
-      run: |
-        git clone --quiet --depth=1 -b ${{ env.rustls-version }} --recursive https://github.com/rustls/rustls-ffi.git
-        cd rustls-ffi
-        make DESTDIR=$HOME/rustls install
+      - name: 'build mbedtls (latest-intel)'
+        if: ${{ contains(matrix.build.install_steps, 'mbedtls-latest-intel') && !steps.cache-mbedtls-latest-intel.outputs.cache-hit }}
+        run: |
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-${MBEDTLS_VERSION}/mbedtls-${MBEDTLS_VERSION}.tar.bz2" --output pkg.bin
+          sha256sum pkg.bin && tar -xjf pkg.bin && rm -f pkg.bin
+          cd "mbedtls-${MBEDTLS_VERSION}"
+          ./scripts/config.py set MBEDTLS_THREADING_C
+          ./scripts/config.py set MBEDTLS_THREADING_PTHREAD
+          cmake -B . -G Ninja -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_POSITION_INDEPENDENT_CODE=ON -DCMAKE_INSTALL_PREFIX=/home/runner/mbedtls \
+            -DENABLE_PROGRAMS=OFF -DENABLE_TESTING=OFF
+          cmake --build .
+          cmake --install .
 
-    - if: contains(matrix.build.install_steps, 'hyper')
-      run: |
-        cd $HOME
-        git clone --quiet --depth=1 https://github.com/hyperium/hyper.git
-        cd $HOME/hyper
-        RUSTFLAGS="--cfg hyper_unstable_ffi" cargo +nightly rustc --features client,http1,http2,ffi -Z unstable-options --crate-type cdylib
-        echo "LD_LIBRARY_PATH=$HOME/hyper/target/debug:/usr/local/lib" >> $GITHUB_ENV
-      name: 'install hyper'
+      - name: 'cache mbedtls (latest-arm)'
+        if: ${{ contains(matrix.build.install_steps, 'mbedtls-latest-arm') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-mbedtls-latest-arm
+        env:
+          cache-name: cache-mbedtls-latest-arm
+        with:
+          path: ~/mbedtls
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.MBEDTLS_VERSION }}
 
-    - if: contains(matrix.build.install_steps, 'intel')
-      run: |
-        cd /tmp
-        curl -sSf --compressed https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB | sudo apt-key add -
-        sudo add-apt-repository "deb https://apt.repos.intel.com/oneapi all main"
-        sudo apt install --no-install-recommends intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic
-        source /opt/intel/oneapi/setvars.sh
-        printenv >> $GITHUB_ENV
-      name: 'install Intel compilers'
+      - name: 'build mbedtls (latest-arm)'
+        if: ${{ contains(matrix.build.install_steps, 'mbedtls-latest-arm') && !steps.cache-mbedtls-latest-arm.outputs.cache-hit }}
+        run: |
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-${MBEDTLS_VERSION}/mbedtls-${MBEDTLS_VERSION}.tar.bz2" --output pkg.bin
+          sha256sum pkg.bin && tar -xjf pkg.bin && rm -f pkg.bin
+          cd "mbedtls-${MBEDTLS_VERSION}"
+          ./scripts/config.py set MBEDTLS_THREADING_C
+          ./scripts/config.py set MBEDTLS_THREADING_PTHREAD
+          cmake -B . -G Ninja -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_POSITION_INDEPENDENT_CODE=ON -DCMAKE_INSTALL_PREFIX=/home/runner/mbedtls \
+            -DENABLE_PROGRAMS=OFF -DENABLE_TESTING=OFF
+          cmake --build .
+          cmake --install .
 
-    - if: contains(matrix.build.install_steps, 'pytest')
-      run: |
-        sudo apt-get install apache2 apache2-dev libnghttp2-dev
-        sudo python3 -m pip install -r tests/http/requirements.txt
-      name: 'install pytest and apach2-dev'
+      - name: 'cache mbedtls (prev)'
+        if: ${{ contains(matrix.build.install_steps, 'mbedtls-prev') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-mbedtls-prev
+        env:
+          cache-name: cache-mbedtls-prev
+        with:
+          path: ~/mbedtls-prev
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.MBEDTLS_PREV_VERSION }}
 
-    - name: cache mod_h2
-      if: contains(matrix.build.install_steps, 'pytest')
-      uses: actions/cache@v3
-      id: cache-mod_h2
-      env:
-        cache-name: cache-mod_h2
-      with:
-        path: /home/runner/mod_h2
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.mod_h2-version }}
+      - name: 'build mbedtls (prev)'
+        if: ${{ contains(matrix.build.install_steps, 'mbedtls-prev') && !steps.cache-mbedtls-prev.outputs.cache-hit }}
+        run: |
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-${MBEDTLS_PREV_VERSION}/mbedtls-${MBEDTLS_PREV_VERSION}.tar.bz2" --output pkg.bin
+          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${MBEDTLS_PREV_SHA256}" && tar -xjf pkg.bin && rm -f pkg.bin
+          cd "mbedtls-${MBEDTLS_PREV_VERSION}"
+          ./scripts/config.py set MBEDTLS_THREADING_C
+          ./scripts/config.py set MBEDTLS_THREADING_PTHREAD
+          cmake -B . -G Ninja -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_POSITION_INDEPENDENT_CODE=ON -DCMAKE_INSTALL_PREFIX=/home/runner/mbedtls-prev \
+            -DENABLE_PROGRAMS=OFF -DENABLE_TESTING=OFF
+          cmake --build .
+          cmake --install .
 
-    - name: 'build mod_h2'
-      if: contains(matrix.build.install_steps, 'pytest') && steps.cache-mod_h2.outputs.cache-hit != 'true'
-      run: |
-        cd $HOME
-        git clone --quiet --depth=1 -b  ${{ env.mod_h2-version }} https://github.com/icing/mod_h2
-        cd mod_h2
-        autoreconf -fi
-        ./configure
-        make
+      - name: 'cache openldap (static)'
+        if: ${{ contains(matrix.build.install_steps, 'openldap-static') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-openldap-static
+        env:
+          cache-name: cache-openldap-static
+        with:
+          path: ~/openldap-static
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.OPENLDAP_VERSION }}
 
-    - name: 'install mod_h2'
-      if: contains(matrix.build.install_steps, 'pytest')
-      run: |
-        cd $HOME/mod_h2
-        sudo make install
+      - name: 'build openldap (static)'
+        if: ${{ contains(matrix.build.install_steps, 'openldap-static') && !steps.cache-openldap-static.outputs.cache-hit }}
+        run: |
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            "https://www.openldap.org/software/download/OpenLDAP/openldap-release/openldap-${OPENLDAP_VERSION}.tgz" --output pkg.bin
+          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
+          cd "openldap-${OPENLDAP_VERSION}"
+          autoreconf -fi
+          ./configure --prefix=/home/runner/openldap-static --enable-static --disable-shared --disable-slapd
+          make install
 
-    - run: autoreconf -fi
-      name: 'autoreconf'
+      - name: 'cache openssl (thread sanitizer)'
+        if: ${{ contains(matrix.build.install_steps, 'openssl-tsan') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-openssl-tsan
+        env:
+          cache-name: cache-openssl-tsan
+        with:
+          path: ~/openssl
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.OPENSSL_VERSION }}
 
-    - run: ./configure --enable-warnings --enable-werror ${{ matrix.build.configure }}
-      name: 'configure'
+      - name: 'build openssl (thread sanitizer)'
+        if: ${{ contains(matrix.build.install_steps, 'openssl-tsan') && !steps.cache-openssl-tsan.outputs.cache-hit }}
+        run: |
+          git clone --quiet --depth 1 --branch "openssl-${OPENSSL_VERSION}" https://github.com/openssl/openssl
+          cd openssl
+          CC=clang CFLAGS='-fsanitize=thread' LDFLAGS='-fsanitize=thread' ./config --prefix=/home/runner/openssl --libdir=lib no-makedepend no-apps no-docs no-tests
+          make
+          make -j1 install_sw
 
-    - run: make V=1
-      name: 'make'
+      - name: 'cache awslc'
+        if: ${{ contains(matrix.build.install_steps, 'awslc') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-awslc
+        env:
+          cache-name: cache-awslc
+        with:
+          path: ~/awslc
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.AWSLC_VERSION }}
 
-    - run: ./src/curl -V
-      name: 'check curl -V output'
+      - name: 'build awslc'
+        if: ${{ contains(matrix.build.install_steps, 'awslc') && !steps.cache-awslc.outputs.cache-hit }}
+        run: |
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/awslabs/aws-lc/archive/refs/tags/v${AWSLC_VERSION}.tar.gz" --output pkg.bin
+          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
+          cd "aws-lc-${AWSLC_VERSION}"
+          cmake -B . -G Ninja -DCMAKE_INSTALL_PREFIX=/home/runner/awslc -DBUILD_TOOL=OFF -DBUILD_TESTING=OFF
+          cmake --build .
+          cmake --install .
 
-    - run: make V=1 examples
-      name: 'make examples'
+      - name: 'cache boringssl'
+        if: ${{ contains(matrix.build.install_steps, 'boringssl') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-boringssl
+        env:
+          cache-name: cache-boringssl
+        with:
+          path: ~/boringssl
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.BORINGSSL_VERSION }}
 
-    - run: make V=1 -C tests
-      name: 'make tests'
+      - name: 'build boringssl'
+        if: ${{ contains(matrix.build.install_steps, 'boringssl') && !steps.cache-boringssl.outputs.cache-hit }}
+        run: |
+          mkdir boringssl-src
+          cd boringssl-src
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            "https://boringssl.googlesource.com/boringssl/+archive/${BORINGSSL_VERSION}.tar.gz" --output pkg.bin
+          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
+          cmake -B . -G Ninja -DCMAKE_INSTALL_PREFIX=/home/runner/boringssl -DBUILD_TESTING=OFF -DBUILD_SHARED_LIBS=ON
+          cmake --build .
+          cmake --install .
 
-    - run: make V=1 test-ci
-      name: 'run tests'
-      env:
-        TFLAGS: "${{ matrix.build.tflags }}"
+      - name: 'cache rustls'
+        if: ${{ contains(matrix.build.install_steps, 'rustls') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-rustls
+        env:
+          cache-name: cache-rustls
+        with:
+          path: ~/rustls
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.RUSTLS_VERSION }}
 
-    - if: contains(matrix.build.install_steps, 'pytest')
-      # run for `tests` directory, so pytest does not pick up any other
-      # packages we might have built here
-      run:
-        pytest -v tests
-      name: 'run pytest'
-      env:
-        TFLAGS: "${{ matrix.build.tflags }}"
-        CURL_CI: github
+      - name: 'fetch rustls deb'
+        if: ${{ contains(matrix.build.install_steps, 'rustls') && !steps.cache-rustls.outputs.cache-hit }}
+        run: |
+          cd ~
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/rustls/rustls-ffi/releases/download/v${RUSTLS_VERSION}/librustls_${RUSTLS_VERSION}_amd64.deb.zip" --output pkg.bin
+          sha256sum pkg.bin && unzip pkg.bin -d rustls && rm -f pkg.bin
+
+      - name: 'build rustls'
+        # Note: we do not check cache-hit here. If the cache is hit, we need to dpkg install the deb.
+        if: ${{ contains(matrix.build.install_steps, 'rustls') }}
+        run: sudo dpkg -i ~/rustls/"librustls_${RUSTLS_VERSION}_amd64.deb"
+
+      - name: 'install Intel compilers'
+        if: ${{ contains(matrix.build.install_steps, 'intelc') }}
+        timeout-minutes: 4
+        run: |
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --compressed https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB | \
+            sudo tee /etc/apt/trusted.gpg.d/intel-sw.asc >/dev/null
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo add-apt-repository 'deb https://apt.repos.intel.com/oneapi all main'
+          sudo apt-get -o Dpkg::Use-Pty=0 install intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic
+          source /opt/intel/oneapi/setvars.sh
+          printenv >> "$GITHUB_ENV"
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'autoreconf'
+        if: ${{ matrix.build.configure }}
+        run: autoreconf -fi
+
+      - name: 'configure'
+        env:
+          CC: '${{ matrix.build.CC }}'
+          CFLAGS: '${{ matrix.build.CFLAGS }}'
+          LDFLAGS: '${{ matrix.build.LDFLAGS }}'
+          LIBS: '${{ matrix.build.LIBS }}'
+          MATRIX_CONFIGURE: '${{ matrix.build.configure }}'
+          MATRIX_GENERATE: '${{ matrix.build.generate }}'
+          MATRIX_PKG_CONFIG_PATH: '${{ matrix.build.PKG_CONFIG_PATH }}'
+        run: |
+          [[ "${MATRIX_INSTALL_STEPS}" = *'awslc'* ]] && sudo apt-get -o Dpkg::Use-Pty=0 purge libssl-dev
+          [ -n "${MATRIX_PKG_CONFIG_PATH}" ] && export PKG_CONFIG_PATH="${MATRIX_PKG_CONFIG_PATH}"
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake -B bld -G Ninja \
+              -DCMAKE_INSTALL_PREFIX="$HOME"/curl-install \
+              -DCMAKE_C_COMPILER_TARGET="$(uname -m)-unknown-linux-gnu" -DBUILD_STATIC_LIBS=ON \
+              -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON \
+              ${MATRIX_GENERATE}
+          else
+            mkdir bld && cd bld && \
+            ../configure --prefix="$HOME"/curl-install --enable-unity --enable-warnings --enable-werror --disable-static \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              ${MATRIX_CONFIGURE}
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+
+      - name: 'test configs'
+        run: grep -H -v '^#' bld/tests/config bld/tests/http/config.ini || true
+
+      - name: 'build'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose
+          else
+            make -C bld V=1
+          fi
+
+      - name: 'single-use function check'
+        if: ${{ (contains(matrix.build.configure, '--disable-unity') || contains(matrix.build.generate, '-DCMAKE_UNITY_BUILD=OFF')) && !contains(matrix.build.install_steps, 'filc') }}
+        run: |
+          git config --global --add safe.directory "*"
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            libcurla=bld/lib/libcurl.a
+          else
+            libcurla=bld/lib/.libs/libcurl.a
+          fi
+          ./scripts/singleuse.pl --unit "${libcurla}"
+
+      - name: 'curl -V'
+        run: |
+          find . -type f \( -name curl -o -name '*.so.*' -o -name '*.a' \) -print0 | xargs -0 file --
+          find . -type f \( -name curl -o -name '*.so.*' -o -name '*.a' \) -print0 | xargs -0 stat -c '%10s bytes: %n' --
+          bld/src/curl --disable -V
+
+      - name: 'curl install'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --install bld --strip
+          else
+            make -C bld V=1 install
+          fi
+
+      - name: 'build tests'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') }}
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target testdeps
+          else
+            make -C bld V=1 -C tests
+          fi
+
+      - name: 'install test prereqs'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') && matrix.build.container == null }}
+        run: |
+          python3 -m venv ~/venv
+          if bld/src/curl --disable -V 2>/dev/null | grep smb; then
+            ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/requirements.txt
+          fi
+
+      - name: 'run tests'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
+        timeout-minutes: ${{ contains(matrix.build.install_packages, 'valgrind') && 20 || 10 }}
+        env:
+          TEST_TARGET: ${{ matrix.build.torture && 'test-torture' || 'test-ci' }}
+          TFLAGS: '${{ matrix.build.tflags }}'
+        run: |
+          if [ "${TEST_TARGET}" = 'test-ci' ] && [[ "${MATRIX_INSTALL_PACKAGES}" = *'valgrind'* ]]; then
+            TFLAGS+=' -j6'
+            TFLAGS+=' !776'  # skip long-running flaky test
+            if [[ "${MATRIX_INSTALL_PACKAGES}" = *'libgss-dev'* ]]; then
+              TFLAGS+=' ~2077 ~2078'  # memory leaks from Curl_auth_decode_spnego_message() -> gss_init_sec_context()
+            fi
+          elif [ "${TEST_TARGET}" != 'test-ci' ]; then
+            TFLAGS+=' --buildinfo'  # only test-ci sets this by default, set it manually for test-torture
+          fi
+          [ -f ~/venv/bin/activate ] && source ~/venv/bin/activate
+          if [[ "${MATRIX_INSTALL_STEPS}" = *'codeset-test1'* ]]; then
+            locale || true
+            export LC_ALL=C
+            export LC_CTYPE=C
+            export LC_NUMERIC=fr_FR.UTF-8
+          fi
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target "${TEST_TARGET}"
+          else
+            make -C bld V=1 "${TEST_TARGET}"
+          fi
+
+      - name: 'install pytest prereqs'
+        if: ${{ contains(matrix.build.install_steps, 'pytest') }}
+        run: |
+          [ -d ~/venv ] || python3 -m venv ~/venv
+          ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/http/requirements.txt
+
+      - name: 'run pytest'
+        if: ${{ contains(matrix.build.install_steps, 'pytest') }}
+        env:
+          PYTEST_ADDOPTS: '--color=yes'
+          PYTEST_XDIST_AUTO_NUM_WORKERS: 4
+        run: |
+          [ -f ~/venv/bin/activate ] && source ~/venv/bin/activate
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target curl-pytest-ci
+          else
+            make -C bld V=1 pytest-ci
+          fi
+
+      - name: 'randcurl'
+        if: ${{ contains(matrix.build.install_steps, 'randcurl') }}
+        run: |
+          mkdir run
+          cd run
+          ../.github/scripts/randcurl.pl 60 ../bld/src/curl
+
+      - name: 'build examples'
+        if: ${{ !contains(matrix.build.install_packages, 'valgrind') && !contains(matrix.build.name, '!examples') }}
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target curl-examples-build
+          else
+            make -C bld V=1 examples
+          fi
diff --git a/third-party/curl/.github/workflows/linux32.yml b/third-party/curl/.github/workflows/linux32.yml
deleted file mode 100644
index dae828f437..0000000000
--- a/third-party/curl/.github/workflows/linux32.yml
+++ /dev/null
@@ -1,93 +0,0 @@
-# Copyright (C) Dan Fandrich
-#
-# SPDX-License-Identifier: curl
-
-name: Linux 32-bit
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-  pull_request:
-    branches:
-    - master
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-env:
-  MAKEFLAGS: -j 3
-
-jobs:
-  linux-i686:
-    name: ${{ matrix.build.name }}
-    runs-on: 'ubuntu-22.04'
-    timeout-minutes: 90
-    strategy:
-      fail-fast: false
-      matrix:
-        build:
-        - name: Linux i686
-          install_packages: gcc-11-i686-linux-gnu libssl-dev:i386 zlib1g-dev:i386 libpsl-dev:i386 libbrotli-dev:i386 libzstd-dev:i386
-          configure: --enable-debug --enable-websockets --with-openssl --host=i686-linux-gnu CC=i686-linux-gnu-gcc-11 PKG_CONFIG_PATH=/usr/lib/i386-linux-gnu/pkgconfig CPPFLAGS=-I/usr/include/i386-linux-gnu LDFLAGS=-L/usr/lib/i386-linux-gnu
-
-    steps:
-    - run: |
-        sudo dpkg --add-architecture i386
-        sudo apt-get update -y
-        sudo apt-get install -y --no-install-suggests --no-install-recommends libtool autoconf automake pkg-config stunnel4 ${{ matrix.build.install_packages }}
-        sudo python3 -m pip install impacket
-      name: 'install prereqs'
-
-    - uses: actions/checkout@v3
-
-    - run: autoreconf -fi
-      name: 'autoreconf'
-
-    - run: ./configure --enable-warnings --enable-werror ${{ matrix.build.configure }}
-      name: 'configure'
-
-    - run: make V=1
-      name: 'make'
-
-    - run: ./src/curl -V
-      name: 'check curl -V output'
-
-    - run: make V=1 examples
-      name: 'make examples'
-
-    - run: make V=1 -C tests
-      name: 'make tests'
-
-    - run: make V=1 test-ci
-      name: 'run tests'
-      env:
-        TFLAGS: "${{ matrix.build.tflags }}"
diff --git a/third-party/curl/.github/workflows/macos.yml b/third-party/curl/.github/workflows/macos.yml
index 5539e48cc8..685a533c50 100644
--- a/third-party/curl/.github/workflows/macos.yml
+++ b/third-party/curl/.github/workflows/macos.yml
@@ -2,36 +2,28 @@
 #
 # SPDX-License-Identifier: curl
 
-name: macOS
+name: 'macOS'
 
-on:
+'on':
   push:
     branches:
-    - master
-    - '*/ci'
+      - master
+      - '*/ci'
     paths-ignore:
-    - '**/*.md'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
   pull_request:
     branches:
-    - master
+      - master
     paths-ignore:
-    - '**/*.md'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
@@ -39,201 +31,753 @@ concurrency:
 
 permissions: {}
 
+# Apple APIs and the macos-version-min value required to avoid deprecation
+# warnings with llvm/clang, and/or the feature getting enabled at build-time
+# or runtime:
+#
+# - 10.7   Lion (2011)          - GSS (build-time, deprecated MIT Kerberos shim)
+# - 10.9   Mavericks (2013)     - LDAP (build-time, deprecated), memset_s(), OCSP (runtime)
+# - 10.11  El Capitan (2015)    - connectx() (runtime)
+# - 10.12  Sierra (2016)        - clock_gettime() (build-time, runtime)
+# - 10.14  Mojave (2018)        - SecTrustEvaluateWithError() (runtime)
+
 env:
-  DEVELOPER_DIR: /Applications/Xcode_14.0.1.app/Contents/Developer
-  MAKEFLAGS: -j 5
+  CURL_CI: github
+  CURL_TEST_MIN: 1750
+  DO_NOT_TRACK: '1'
+  MAKEFLAGS: -j 4
+  LDFLAGS: -w  # suppress 'object file was built for newer macOS version than being linked' warnings
 
 jobs:
-  autotools:
-    name: ${{ matrix.build.name }}
-    runs-on: 'macos-latest'
-    timeout-minutes: 90
+  ios:
+    name: "iOS, ${{ (matrix.build.generator && format('CM-{0}', matrix.build.generator)) || (matrix.build.generate && 'CM' || 'AM' )}} ${{ matrix.build.name }} arm64"
+    runs-on: macos-latest
+    timeout-minutes: 10
+    env:
+      DEVELOPER_DIR: "/Applications/Xcode${{ matrix.build.xcode && format('_{0}', matrix.build.xcode) || '' }}.app/Contents/Developer"
+      CC: 'clang'
+      LDFLAGS: ''
+      MATRIX_BUILD: ${{ matrix.build.generate && 'cmake' || 'autotools' }}
+      MATRIX_OPTIONS: ${{ matrix.build.options }}
+      # renovate: datasource=github-tags depName=libressl/portable versioning=semver registryUrl=https://github.com
+      LIBRESSL_VERSION: 4.3.1
     strategy:
       fail-fast: false
       matrix:
         build:
-        - name: normal
-          install: nghttp2
-          configure: --without-ssl --enable-websockets
-          macosx-version-min: 10.9
-        - name: debug
-          install: nghttp2
-          configure: --enable-debug --without-ssl --enable-websockets
-          macosx-version-min: 10.9
-        - name: libssh2
-          install: nghttp2 libssh2
-          configure: --enable-debug --with-libssh2 --without-ssl --enable-websockets
-          macosx-version-min: 10.9
-        - name: libssh-c-ares
-          install: openssl nghttp2 libssh
-          configure: --enable-debug --with-libssh --with-openssl=/usr/local/opt/openssl --enable-ares --enable-websockets
-          macosx-version-min: 10.9
-        - name: libssh
-          install: openssl nghttp2 libssh
-          configure: --enable-debug --with-libssh --with-openssl=/usr/local/opt/openssl --enable-websockets
-          macosx-version-min: 10.9
-        - name: c-ares
-          install: nghttp2
-          configure: --enable-debug --enable-ares --without-ssl --enable-websockets
-          macosx-version-min: 10.9
-        - name: HTTP only
-          install: nghttp2
-          configure: |
-            --enable-debug \
-            --enable-maintainer-mode \
-            --disable-alt-svc \
-            --disable-dict \
-            --disable-file \
-            --disable-ftp \
-            --disable-gopher \
-            --disable-imap \
-            --disable-ldap \
-            --disable-pop3 \
-            --disable-rtmp \
-            --disable-rtsp \
-            --disable-scp \
-            --disable-sftp \
-            --disable-shared \
-            --disable-smb \
-            --disable-smtp \
-            --disable-telnet \
-            --disable-tftp \
-            --disable-unix-sockets \
-            --without-brotli \
-            --without-gssapi \
-            --without-libidn2 \
-            --without-libpsl \
-            --without-librtmp \
-            --without-libssh2 \
-            --without-nghttp2 \
-            --without-ntlm-auth \
-            --without-ssl \
-            --without-zlib \
-            --without-zstd
-          macosx-version-min: 10.15
-        - name: SecureTransport http2
-          install: nghttp2
-          configure: --enable-debug --with-secure-transport --enable-websockets
-          macosx-version-min: 10.8
-        - name: gcc SecureTransport
-          configure: CC=gcc-12 --enable-debug --with-secure-transport --enable-websockets
-          macosx-version-min: 10.8
-        - name: OpenSSL http2
-          install: nghttp2 openssl
-          configure: --enable-debug --with-openssl=/usr/local/opt/openssl --enable-websockets
-          macosx-version-min: 10.9
-        - name: LibreSSL http2
-          install: nghttp2 libressl
-          configure: --enable-debug --with-openssl=/usr/local/opt/libressl --enable-websockets
-          macosx-version-min: 10.9
-        - name: torture
-          install: nghttp2 openssl
-          configure: --enable-debug --disable-shared --disable-threaded-resolver --with-openssl=/usr/local/opt/openssl --enable-websockets
-          tflags: -n -t --shallow=25 !FTP
-          macosx-version-min: 10.9
-        - name: torture-ftp
-          install: nghttp2 openssl
-          configure: --enable-debug --disable-shared --disable-threaded-resolver --with-openssl=/usr/local/opt/openssl --enable-websockets
-          tflags: -n -t --shallow=20 FTP
-          macosx-version-min: 10.9
-        - name: macOS 10.15
-          install: nghttp2 libssh2 openssl
-          configure: --enable-debug --disable-ldap --with-openssl=/usr/local/opt/openssl --enable-websockets
-          macosx-version-min: 10.15
+          - name: 'libressl'
+            install_steps: libressl
+            configure: --with-openssl=/Users/runner/libressl --without-libpsl
+
+          - name: 'libressl'
+            install_steps: libressl
+            # FIXME: Could not make OPENSSL_ROOT_DIR work. CMake seems to prepend sysroot to it.
+            generator: Xcode
+            xcode: ''  # default Xcode. Set it once to silence actionlint.
+            options: --config Debug
+            generate: >-
+              -DCMAKE_XCODE_ATTRIBUTE_CODE_SIGNING_ALLOWED=OFF
+              -DMACOSX_BUNDLE_GUI_IDENTIFIER=se.curl
+              -DOPENSSL_INCLUDE_DIR=/Users/runner/libressl/include
+              -DOPENSSL_SSL_LIBRARY=/Users/runner/libressl/lib/libssl.a
+              -DOPENSSL_CRYPTO_LIBRARY=/Users/runner/libressl/lib/libcrypto.a
+              -DCURL_USE_LIBPSL=OFF -DCURL_ENABLE_NTLM=ON
+
     steps:
-    - run: echo libtool autoconf automake pkg-config ${{ matrix.build.install }} | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
-      name: 'brew bundle'
+      - name: 'brew install'
+        if: ${{ matrix.build.configure }}
+        timeout-minutes: 5
+        run: |
+          # shellcheck disable=SC2181
+          while [[ $? == 0 ]]; do
+            for i in 1 2 3; do
+              if brew install automake libtool; then
+                break 2
+              else
+                echo "Error: wait to try again: $i"
+                sleep 10
+              fi
+            done
+            false Too many retries
+          done
 
-    # Run this command with retries because of spurious failures seen
-    # while running the tests, for example
-    # https://github.com/curl/curl/runs/4095721123?check_suite_focus=true
-    - run: "while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done"
-      name: 'brew install'
+      - name: 'toolchain versions'
+        run: |
+          command -v "${CC}"; "${CC}" --version || true
+          xcodebuild -version || true
+          xcodebuild -sdk -version | grep '^Path:' || true
+          xcrun --sdk iphoneos --show-sdk-path 2>/dev/null || true
+          xcrun --sdk iphoneos --show-sdk-version || true
+          echo '::group::compiler defaults'; echo 'int main(void) {}' | "${CC}" -v -x c -; echo '::endgroup::'
+          echo '::group::macros predefined'; "${CC}" -dM -E - < /dev/null | sort || true; echo '::endgroup::'
+          echo '::group::brew packages installed'; ls -l "$(brew --prefix)"/opt; echo '::endgroup::'
 
-    - run: |
-        case "${{ matrix.build.install }}" in
-          *openssl*)
-            ;;
-          *)
-            if test -d /usr/local/include/openssl; then
-              brew unlink openssl
-            fi;;
-        esac
-      name: 'brew unlink openssl'
+      - name: 'cache libressl'
+        if: ${{ contains(matrix.build.install_steps, 'libressl') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-libressl
+        env:
+          cache-name: cache-libressl
+        with:
+          path: ~/libressl
+          key: iOS-${{ env.cache-name }}-${{ env.LIBRESSL_VERSION }}
 
-    - run: python3 -m pip install impacket
-      name: 'pip3 install'
+      - name: 'build libressl'
+        if: ${{ contains(matrix.build.install_steps, 'libressl') && !steps.cache-libressl.outputs.cache-hit }}
+        run: |
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/libressl/portable/releases/download/v${LIBRESSL_VERSION}/libressl-${LIBRESSL_VERSION}.tar.gz" --output pkg.bin
+          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
+          cd "libressl-${LIBRESSL_VERSION}"
+          cmake -B . -G Ninja \
+            -DCMAKE_INSTALL_PREFIX=/Users/runner/libressl \
+            -DCMAKE_SYSTEM_NAME=iOS \
+            -DCMAKE_SYSTEM_PROCESSOR=aarch64 \
+            -DBUILD_SHARED_LIBS=OFF \
+            -DLIBRESSL_APPS=OFF \
+            -DLIBRESSL_TESTS=OFF
+          cmake --build .
+          cmake --install . --verbose
 
-    - uses: actions/checkout@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
-    - run: autoreconf -fi
-      name: 'autoreconf'
+      - name: 'autoreconf'
+        if: ${{ matrix.build.configure }}
+        run: autoreconf -fi
 
-    - run: ./configure --enable-warnings --enable-werror ${{ matrix.build.configure }}
-      name: 'configure'
-      env:
-        CFLAGS: "-mmacosx-version-min=${{ matrix.build.macosx-version-min }}"
+      - name: 'configure'
+        env:
+          MATRIX_CONFIGURE: '${{ matrix.build.configure }}'
+          MATRIX_GENERATE: '${{ matrix.build.generate }}'
+          MATRIX_GENERATOR: '${{ matrix.build.generator }}'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            # https://cmake.org/cmake/help/latest/manual/cmake-toolchains.7.html#cross-compiling-for-ios-tvos-visionos-or-watchos
+            [ -n "${MATRIX_GENERATOR}" ] && options="-G ${MATRIX_GENERATOR}"
+            cmake -B bld -G Ninja -D_CURL_PREFILL=ON \
+              -DCMAKE_UNITY_BUILD=ON -DCURL_DROP_UNUSED=ON -DCURL_WERROR=ON \
+              -DCMAKE_SYSTEM_NAME=iOS \
+              -DUSE_APPLE_IDN=ON \
+              ${MATRIX_GENERATE} ${options}
+          else
+            mkdir bld && cd bld && ../configure --enable-unity --enable-warnings --enable-werror \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              CFLAGS="-isysroot $(xcrun --sdk iphoneos --show-sdk-path 2>/dev/null)" \
+              --host=aarch64-apple-darwin \
+              --with-apple-idn \
+              ${MATRIX_CONFIGURE}
+          fi
 
-    - run: make V=1
-      name: 'make'
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
 
-    - run: make V=1 examples
-      name: 'make examples'
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
 
-    - run: make V=1 -C tests
-      name: 'make tests'
+      - name: 'build'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld ${MATRIX_OPTIONS} --parallel 4 --verbose
+          else
+            make -C bld V=1
+          fi
 
-    - run: make V=1 test-ci
-      name: 'run tests'
-      env:
-        TFLAGS: "${{ matrix.build.tflags }} ~1452"
+      - name: 'curl info'
+        run: |
+          find . -type f \( -name curl -o -name '*.dylib' -o -name '*.a' \) -print0 | xargs -0 file --
+          find . -type f \( -name curl -o -name '*.dylib' -o -name '*.a' \) -print0 | xargs -0 stat -f '%10z bytes: %N' --
 
-  cmake:
-    name: cmake ${{ matrix.compiler.CC }} ${{ matrix.build.name }}
-    runs-on: 'macos-latest'
-    env: ${{ matrix.compiler }}
+      - name: 'build tests'
+        if: ${{ matrix.build.generate }}  # skip for autotools to save time
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld ${MATRIX_OPTIONS} --parallel 4 --target testdeps --verbose
+          else
+            make -C bld V=1 -C tests
+          fi
+
+      - name: 'build examples'
+        if: ${{ matrix.build.generate }}  # skip for autotools to save time
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld ${MATRIX_OPTIONS} --parallel 4 --target curl-examples-build --verbose
+          else
+            make -C bld examples V=1
+          fi
+
+  macos:
+    name: "${{ matrix.build.generate && 'CM' || 'AM' }} ${{ matrix.build.compiler }} ${{ matrix.build.name }}"
+    runs-on: ${{ matrix.build.image || 'macos-15' }}
+    timeout-minutes: 15
+    env:
+      DEVELOPER_DIR: "/Applications/Xcode${{ matrix.build.xcode && format('_{0}', matrix.build.xcode) || '' }}.app/Contents/Developer"
+      CC: '${{ matrix.build.compiler }}'
+      MATRIX_BUILD: ${{ matrix.build.generate && 'cmake' || 'autotools' }}
+      MATRIX_COMPILER: '${{ matrix.build.compiler }}'
+      MATRIX_INSTALL: '${{ matrix.build.install }}'
+      MATRIX_INSTALL_STEPS: '${{ matrix.build.install_steps }}'
+      MATRIX_MACOS_VERSION_MIN: '${{ matrix.build.macos-version-min }}'
     strategy:
       fail-fast: false
       matrix:
-        compiler:
-        - CC: clang
-          CXX: clang++
-          CFLAGS: "-mmacosx-version-min=10.15 -Wno-deprecated-declarations"
-        - CC: gcc-12
-          CXX: g++-12
-          CFLAGS: "-mmacosx-version-min=10.15 -Wno-error=undef -Wno-error=conversion"
         build:
-        - name: OpenSSL
-          install: nghttp2 openssl
-          generate: -DOPENSSL_ROOT_DIR=/usr/local/opt/openssl -DCURL_DISABLE_LDAP=ON -DCURL_DISABLE_LDAPS=ON
-        - name: LibreSSL
-          install: nghttp2 libressl
-          generate: -DOPENSSL_ROOT_DIR=/usr/local/opt/libressl -DCURL_DISABLE_LDAP=ON -DCURL_DISABLE_LDAPS=ON -DCMAKE_UNITY_BUILD=ON
-        - name: libssh2
-          install: nghttp2 openssl libssh2
-          generate: -DOPENSSL_ROOT_DIR=/usr/local/opt/openssl -DCURL_USE_LIBSSH2=ON -DBUILD_SHARED_LIBS=ON -DBUILD_STATIC_LIBS=ON
+          - name: '!ssl !debug brotli zstd'
+            compiler: gcc-13
+            configure: --without-ssl --with-brotli --with-zstd --with-apple-idn
+            tflags: '--min=1520'
+            xcode: ''  # default Xcode. Set it once to silence actionlint.
+
+          - name: '!ssl libssh2 AppleIDN'
+            compiler: clang
+            generate: -DENABLE_DEBUG=ON -DCURL_USE_LIBSSH2=ON -DUSE_APPLE_IDN=ON -DCURL_ENABLE_SSL=OFF -DCURL_BROTLI=OFF -DCURL_ZSTD=OFF
+            tflags: '--min=1630'
+
+          - name: 'OpenSSL libssh c-ares'
+            compiler: clang
+            install: openssl@4 libssh
+            configure: --enable-debug --with-libssh --with-openssl=/opt/homebrew/opt/openssl@4 --enable-ech --enable-ares --with-fish-functions-dir --with-zsh-functions-dir
+
+          - name: 'OpenSSL libssh'
+            compiler: llvm@18
+            install: libssh
+            generate: -DENABLE_DEBUG=ON -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl -DCURL_BROTLI=OFF -DCURL_ZSTD=OFF
+
+          - name: '!ssl HTTP-only c-ares'
+            macos-version-min: '10.15'  # Catalina (2019)
+            compiler: clang
+            tflags: '--min=960'
+            generate: >-
+              -DENABLE_DEBUG=ON -DENABLE_ARES=ON
+              -DCURL_ENABLE_SSL=OFF -DHTTP_ONLY=ON
+              -DCURL_DISABLE_ALTSVC=ON -DENABLE_UNIX_SOCKETS=OFF
+              -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=OFF -DUSE_NGHTTP2=OFF
+              -DCURL_USE_GSSAPI=OFF -DUSE_LIBIDN2=OFF -DCURL_USE_LIBPSL=OFF
+              -DCURL_BROTLI=OFF -DCURL_ZLIB=OFF -DCURL_ZSTD=OFF
+              -DBUILD_STATIC_LIBS=ON -DBUILD_SHARED_LIBS=OFF
+
+          - name: 'LibreSSL !ldap +examples'
+            compiler: clang
+            install: libressl
+            install_steps: pytest
+            generate: >-
+              -DENABLE_DEBUG=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/libressl -DCURL_DISABLE_LDAP=ON -DCURL_BROTLI=OFF -DCURL_ZSTD=OFF
+              -DCURL_USE_LIBSSH2=OFF -DCURL_ENABLE_NTLM=ON
+
+          - name: 'OpenSSL 10.15 C89'
+            macos-version-min: '10.15'
+            compiler: clang
+            install: libnghttp3 libngtcp2
+            install_steps: pytest
+            generate: >-
+              -DENABLE_DEBUG=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl -DUSE_NGTCP2=ON -DCURL_BROTLI=OFF -DCURL_ZSTD=OFF -DCURL_USE_LIBSSH2=OFF
+              -DCMAKE_C_STANDARD=90 -DCURL_ENABLE_NTLM=ON -DUSE_PROXY_HTTP3=ON
+
+          - name: 'OpenSSL SecTrust krb5'
+            compiler: clang
+            install: libnghttp3 libngtcp2
+            install_steps: pytest
+            configure: --enable-debug --with-openssl=/opt/homebrew/opt/openssl --with-ngtcp2 --with-apple-sectrust --enable-ntlm --enable-proxy-http3 --with-gssapi
+
+          - name: 'OpenSSL event-based'
+            compiler: clang
+            generate: -DENABLE_DEBUG=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl -DCURL_BROTLI=OFF -DCURL_ZSTD=OFF -DCURL_USE_LIBSSH2=OFF -DCURL_ENABLE_NTLM=ON
+            tflags: '--test-event --min=1400'
+
+          - name: 'OpenSSL gsasl AppleIDN SecTrust +examples'
+            compiler: clang
+            install: openssl@4 libnghttp3 libngtcp2 gsasl
+            generate: >-
+              -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl@4 -DUSE_ECH=ON -DCURL_USE_GSASL=ON -DUSE_APPLE_IDN=ON -DUSE_NGTCP2=ON -DCURL_DISABLE_VERBOSE_STRINGS=ON
+              -DUSE_APPLE_SECTRUST=ON -DCURL_ENABLE_NTLM=ON -DUSE_PROXY_HTTP3=ON
+
+          - name: 'MultiSSL AppleIDN clang-tidy +examples'
+            image: macos-26
+            compiler: clang
+            install: llvm gnutls nettle libressl krb5 mbedtls gsasl rustls-ffi libssh fish
+            install_steps: skiprun
+            CFLAGS: -Wunused-macros
+            chkprefill: _chkprefill
+            generate: >-
+              -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/libressl -DCURL_DEFAULT_SSL_BACKEND=openssl
+              -DCURL_USE_GNUTLS=ON -DCURL_USE_MBEDTLS=ON -DCURL_USE_RUSTLS=ON -DENABLE_ARES=ON -DCURL_USE_GSASL=ON
+              -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=ON -DUSE_APPLE_IDN=ON -DUSE_SSLS_EXPORT=ON
+              -DCURL_USE_GSSAPI=ON -DGSS_ROOT_DIR=/opt/homebrew/opt/krb5
+              -DCURL_BROTLI=ON -DCURL_ZSTD=ON
+              -DCURL_CLANG_TIDY=ON -DCLANG_TIDY=/opt/homebrew/opt/llvm/bin/clang-tidy
+              -DCURL_COMPLETION_FISH=ON -DCURL_COMPLETION_ZSH=ON
+              -DCURL_ENABLE_NTLM=ON
+
+          - name: 'HTTP/3 clang-tidy'
+            image: macos-26
+            compiler: clang
+            install: llvm libnghttp3 libngtcp2 openldap krb5
+            install_steps: skipall
+            CFLAGS: -Wunused-macros
+            generate: >-
+              -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl -DUSE_NGTCP2=ON
+              -DLDAP_INCLUDE_DIR=/opt/homebrew/opt/openldap/include
+              -DLDAP_LIBRARY=/opt/homebrew/opt/openldap/lib/libldap.dylib
+              -DLDAP_LBER_LIBRARY=/opt/homebrew/opt/openldap/lib/liblber.dylib
+              -DCURL_USE_GSSAPI=ON -DGSS_ROOT_DIR=/opt/homebrew/opt/krb5
+              -DCURL_BROTLI=ON -DCURL_ZSTD=ON
+              -DCURL_CLANG_TIDY=ON -DCLANG_TIDY=/opt/homebrew/opt/llvm/bin/clang-tidy
+              -DCURL_ENABLE_NTLM=ON -DUSE_PROXY_HTTP3=ON
+
+          - name: 'LibreSSL openldap krb5 c-ares +examples'
+            compiler: clang
+            install: libressl krb5 openldap
+            generate: >-
+              -DENABLE_DEBUG=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/libressl -DENABLE_ARES=ON -DCURL_USE_GSSAPI=ON
+              -DGSS_ROOT_DIR=/opt/homebrew/opt/krb5
+              -DLDAP_INCLUDE_DIR=/opt/homebrew/opt/openldap/include
+              -DLDAP_LIBRARY=/opt/homebrew/opt/openldap/lib/libldap.dylib
+              -DLDAP_LBER_LIBRARY=/opt/homebrew/opt/openldap/lib/liblber.dylib
+
+          - name: 'wolfSSL !ldap brotli zstd'
+            compiler: clang
+            install: brotli wolfssl zstd
+            install_steps: pytest
+            generate: -DCURL_USE_WOLFSSL=ON -DCURL_DISABLE_LDAP=ON -DUSE_ECH=ON -DCURL_ENABLE_NTLM=ON
+
+          - name: 'mbedTLS !ldap brotli zstd MultiSSL AppleIDN'
+            compiler: llvm@18
+            install: brotli mbedtls zstd
+            install_steps: codeset-test1
+            generate: -DCURL_USE_MBEDTLS=ON -DCURL_DISABLE_LDAP=ON -DCURL_DEFAULT_SSL_BACKEND=mbedtls -DCURL_USE_OPENSSL=ON -DUSE_APPLE_IDN=ON -DCURL_ENABLE_NTLM=ON
+
+          - name: 'GnuTLS !ldap krb5 +examples'
+            compiler: clang
+            install: gnutls nettle krb5
+            install_steps: codeset-test2
+            generate: >-
+              -DENABLE_DEBUG=ON -DCURL_USE_GNUTLS=ON -DCURL_USE_OPENSSL=OFF
+              -DCURL_USE_GSSAPI=ON -DGSS_ROOT_DIR=/opt/homebrew/opt/krb5
+              -DCURL_DISABLE_LDAP=ON -DUSE_SSLS_EXPORT=ON
+
+          - name: 'aws-lc +analyzer'
+            compiler: gcc-15
+            install: aws-lc
+            generate: >-
+              -DENABLE_DEBUG=ON -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/aws-lc -DUSE_ECH=ON
+              -DCURL_DISABLE_LDAP=ON -DUSE_SSLS_EXPORT=ON -DCURL_GCC_ANALYZER=ON
+
+          - name: 'Rustls'
+            compiler: clang
+            install: rustls-ffi
+            generate: -DENABLE_DEBUG=ON -DCURL_USE_RUSTLS=ON -DUSE_ECH=ON -DCURL_DISABLE_LDAP=ON -DCURL_ENABLE_NTLM=ON
+            tflags: '--min=1730'
+
+          - name: 'OpenSSL torture 1'
+            compiler: clang
+            install: openssl@4
+            install_steps: torture
+            generate: -DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DENABLE_THREADED_RESOLVER=OFF -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl@4 -DUSE_ECH=ON -DCURL_ENABLE_NTLM=ON
+            tflags: '-t --shallow=25 --min=480 1 to 500'
+
+          - name: 'OpenSSL torture 2'
+            compiler: clang
+            install: openssl@4
+            install_steps: torture
+            generate: -DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DENABLE_THREADED_RESOLVER=OFF -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl@4 -DUSE_ECH=ON -DCURL_ENABLE_NTLM=ON
+            tflags: '-t --shallow=25 --min=730 501 to 1250'
+
+          - name: 'OpenSSL torture 3'
+            compiler: clang
+            install: openssl@4
+            install_steps: torture
+            generate: -DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DENABLE_THREADED_RESOLVER=OFF -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl@4 -DUSE_ECH=ON -DCURL_ENABLE_NTLM=ON
+            tflags: '-t --shallow=25 --min=628 1251 to 9999'
+
     steps:
-    - run: echo libtool autoconf automake pkg-config ${{ matrix.build.install }} | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
-      name: 'brew bundle'
+      - name: 'brew unlink openssl'
+        if: ${{ contains(matrix.build.install, 'aws-lc') || contains(matrix.build.install, 'libressl') || contains(matrix.build.install, 'openssl@4') }}
+        run: |
+          if [ -d "$(brew --prefix)"/include/openssl ]; then
+            brew unlink openssl
+          fi
 
-    - run: "while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done"
-      name: 'brew install'
+      - name: 'brew install'
+        timeout-minutes: 5
+        # Run this command with retries because of spurious failures seen
+        # while running the tests, for example
+        # https://github.com/curl/curl/runs/4095721123?check_suite_focus=true
+        env:
+          INSTALL_PACKAGES: >-
+            ${{ matrix.build.generate && 'ninja' || 'automake libtool' }}
+            ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') && 'nghttp2 stunnel' || '' }}
+            ${{ contains(matrix.build.install_steps, 'pytest') && 'caddy httpd vsftpd' || '' }}
 
-    - run: |
-        case "${{ matrix.build.install }}" in
-          *openssl*)
-            ;;
-          *)
-            if test -d /usr/local/include/openssl; then
-              brew unlink openssl
-            fi;;
-        esac
-      name: 'brew unlink openssl'
+        run: |
+          # shellcheck disable=SC2181
+          while [[ $? == 0 ]]; do
+            for i in 1 2 3; do
+              if brew install pkgconf libpsl libssh2 ${INSTALL_PACKAGES} ${MATRIX_INSTALL}; then
+                break 2
+              else
+                echo "Error: wait to try again: $i"
+                sleep 10
+              fi
+            done
+            false Too many retries
+          done
 
-    - uses: actions/checkout@v3
+      - name: 'toolchain versions'
+        run: |
+          [[ "${MATRIX_COMPILER}" = 'llvm'* ]] && CC="$(brew --prefix "${MATRIX_COMPILER}")/bin/clang"
+          [[ "${MATRIX_COMPILER}" = 'gcc'* ]] && "${CC}" --print-sysroot
+          command -v "${CC}"; "${CC}" --version || true
+          xcodebuild -version || true
+          xcrun --sdk macosx --show-sdk-path 2>/dev/null || true
+          xcrun --sdk macosx --show-sdk-version || true
+          ls -l /Library/Developer/CommandLineTools/SDKs || true
+          echo '::group::macros predefined'; "${CC}" -dM -E - < /dev/null | sort || true; echo '::endgroup::'
+          echo '::group::brew packages installed'; ls -l "$(brew --prefix)"/opt; echo '::endgroup::'
 
-    - run: cmake -S. -Bbuild -DCURL_WERROR=ON -DPICKY_COMPILER=ON ${{ matrix.build.generate }}
-      name: 'cmake generate'
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
-    - run: cmake --build build
-      name: 'cmake build'
+      - name: 'autoreconf'
+        if: ${{ matrix.build.configure }}
+        run: autoreconf -fi
+
+      - name: 'configure'
+        env:
+          CFLAGS: '${{ matrix.build.CFLAGS }}'
+          MATRIX_CHKPREFILL: '${{ matrix.build.chkprefill }}'
+          MATRIX_CONFIGURE: '${{ matrix.build.configure }}'
+          MATRIX_GENERATE: '${{ matrix.build.generate }}'
+        run: |
+          if [[ "${MATRIX_COMPILER}" = 'gcc'* ]]; then
+            sysroot="$("${CC}" --print-sysroot)"  # Must match the SDK gcc was built for
+          else
+            sysroot="$(xcrun --sdk macosx --show-sdk-path 2>/dev/null)"
+          fi
+
+          if [[ "${MATRIX_COMPILER}" = 'llvm'* ]]; then
+            CC="$(brew --prefix "${MATRIX_COMPILER}")/bin/clang"
+            CC+=" --sysroot=${sysroot}"
+            CC+=" --target=$(uname -m)-apple-darwin"
+          fi
+
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            for _chkprefill in '' ${MATRIX_CHKPREFILL}; do
+              options=''
+              [ -n "${MATRIX_MACOS_VERSION_MIN}" ] && options+=" -DCMAKE_OSX_DEPLOYMENT_TARGET=${MATRIX_MACOS_VERSION_MIN}"
+              [[ "${MATRIX_INSTALL_STEPS}" = *'pytest'* ]] && options+=' -DVSFTPD=NO'  # Skip ~20 tests that stretch run time by 7x on macOS
+              [ "${_chkprefill}" = '_chkprefill' ] && options+=' -D_CURL_PREFILL=OFF'
+              cmake -B "bld${_chkprefill}" -G Ninja -D_CURL_PREFILL=ON \
+                -DCMAKE_INSTALL_PREFIX="$HOME"/curl-install \
+                -DCMAKE_UNITY_BUILD=ON -DCURL_DROP_UNUSED=ON -DCURL_WERROR=ON \
+                -DCMAKE_OSX_SYSROOT="${sysroot}" \
+                -DCMAKE_C_COMPILER_TARGET="$(uname -m | sed 's/arm64/aarch64e/')-apple-darwin$(uname -r)" \
+                ${MATRIX_GENERATE} ${options}
+            done
+            if [ -d bld_chkprefill ] && ! diff -u bld/lib/curl_config.h bld_chkprefill/lib/curl_config.h; then
+              echo '::group::reference configure log'; cat bld_chkprefill/CMakeFiles/CMake*.yaml 2>/dev/null || true; echo '::endgroup::'
+              false
+            fi
+          else
+            if [[ "${MATRIX_COMPILER}" = 'llvm'* ]]; then
+              options+=" --target=$(uname -m)-apple-darwin"
+            fi
+            if [ "${MATRIX_COMPILER}" != 'clang' ]; then
+              options+=" --with-sysroot=${sysroot}"
+              CFLAGS+=" --sysroot=${sysroot}"
+            fi
+            [ -n "${MATRIX_MACOS_VERSION_MIN}" ] && CFLAGS+=" -mmacosx-version-min=${MATRIX_MACOS_VERSION_MIN}"
+            [[ "${MATRIX_INSTALL_STEPS}" = *'pytest'* ]] && options+=' --with-test-vsftpd=no'  # Skip ~20 tests that stretch run time by 7x on macOS
+            mkdir bld && cd bld && ../configure --prefix="$PWD"/curl-install --enable-unity --enable-warnings --enable-werror --disable-static \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              --with-libpsl="$(brew --prefix libpsl)" \
+              ${MATRIX_CONFIGURE} ${options}
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+
+      - name: 'test configs'
+        run: grep -H -v '^#' bld/tests/config bld/tests/http/config.ini || true
+
+      - name: 'build'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose
+          else
+            make -C bld V=1
+          fi
+
+      - name: 'curl -V'
+        run: |
+          find . -type f \( -name curl -o -name '*.dylib' -o -name '*.a' \) -print0 | xargs -0 file --
+          find . -type f \( -name curl -o -name '*.dylib' -o -name '*.a' \) -print0 | xargs -0 stat -f '%10z bytes: %N' --
+          bld/src/curl --disable --version
+
+      - name: 'curl install'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --install bld --strip
+          else
+            make -C bld V=1 install
+          fi
+
+      - name: 'build tests'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') }}
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target testdeps
+          else
+            make -C bld V=1 -C tests
+          fi
+
+      - name: 'install test prereqs'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
+        run: |
+          python3 -m venv ~/venv
+          if bld/src/curl --disable -V 2>/dev/null | grep smb; then
+            ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/requirements.txt
+          fi
+
+      - name: 'run tests'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
+        timeout-minutes: ${{ contains(matrix.build.install_steps, 'torture') && 20 || 10 }}
+        env:
+          TEST_TARGET: ${{ contains(matrix.build.install_steps, 'torture') && 'test-torture' || 'test-ci' }}
+          TFLAGS: '${{ matrix.build.tflags }}'
+        run: |
+          TFLAGS="-j20 ${TFLAGS}"
+          if [ "${TEST_TARGET}" != 'test-ci' ]; then
+            TFLAGS+=' --buildinfo'  # only test-ci sets this by default, set it manually for test-torture
+          fi
+          source ~/venv/bin/activate
+          if [[ "${MATRIX_INSTALL_STEPS}" = *'codeset-test1'* ]]; then
+            locale || true
+            unset LANG
+            unset LC_ALL
+            unset LC_COLLATE
+            unset LC_MESSAGES
+            unset LC_MONETARY
+            unset LC_TIME
+            export LC_CTYPE=C
+            export LC_NUMERIC=fr_FR.UTF-8
+          elif [[ "${MATRIX_INSTALL_STEPS}" = *'codeset-test2'* ]]; then
+            locale || true
+            unset LC_ALL
+            export LC_TIME=fr_FR
+          fi
+          rm -f ~/.curlrc
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target "${TEST_TARGET}"
+          else
+            make -C bld V=1 "${TEST_TARGET}"
+          fi
+
+      - name: 'install pytest prereqs'
+        if: ${{ contains(matrix.build.install_steps, 'pytest') }}
+        run: |
+          [ -d ~/venv ] || python3 -m venv ~/venv
+          ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/http/requirements.txt
+
+      - name: 'run pytest'
+        if: ${{ contains(matrix.build.install_steps, 'pytest') }}
+        env:
+          PYTEST_ADDOPTS: '--color=yes'
+          PYTEST_XDIST_AUTO_NUM_WORKERS: 4
+        run: |
+          source ~/venv/bin/activate
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target curl-pytest-ci
+          else
+            make -C bld V=1 pytest-ci
+          fi
+
+      - name: 'build examples'
+        if: ${{ contains(matrix.build.name, '+examples') }}
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target curl-examples-build
+          else
+            make -C bld examples V=1
+          fi
+
+  combinations:  # Test buildability with host OS, Xcode / SDK, compiler, target-OS, built tool, combinations
+    name: "${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.compiler }} ${{ matrix.image }} ${{ matrix.xcode }}"
+    runs-on: ${{ matrix.image }}
+    timeout-minutes: 10
+    env:
+      DEVELOPER_DIR: "/Applications/Xcode${{ matrix.xcode && format('_{0}', matrix.xcode) || '' }}.app/Contents/Developer"
+      CC: '${{ matrix.compiler }}'
+      MATRIX_BUILD: '${{ matrix.build }}'
+      MATRIX_COMPILER: '${{ matrix.compiler }}'
+      MATRIX_IMAGE: '${{ matrix.image }}'
+      MATRIX_MACOS_VERSION_MIN: '${{ matrix.macos-version-min }}'
+    strategy:
+      fail-fast: false
+      matrix:
+        # Sources:
+        # https://github.com/actions/runner-images/blob/main/images/macos/macos-14-arm64-Readme.md
+        # https://github.com/actions/runner-images/blob/main/images/macos/macos-15-arm64-Readme.md
+        # https://github.com/actions/runner-images/blob/main/images/macos/macos-26-arm64-Readme.md
+        compiler: [gcc-13, gcc-14, gcc-15, llvm@15, llvm@18, llvm@20, clang]
+        # Xcode support matrix as of 2025-10, with default macOS SDK versions and OS names, years:
+        # * = default Xcode on the runner.
+        # macos-14: 15.0.1, 15.1, 15.2, 15.3,*15.4
+        # macos-15:                                 16.0, 16.1, 16.2, 16.3,*16.4, 26.0
+        # macos-26:                                                         16.4 *26.0
+        # macOSSDK: 14.0,   14.2, 14.2, 14.4, 14.5, 15.0, 15.1, 15.2, 15.4, 15.5, 26.0
+        #           Sonoma (2023)                   Sequoia (2024)                Tahoe (2025)
+        # https://github.com/actions/runner-images/tree/main/images/macos
+        # https://en.wikipedia.org/wiki/MacOS_version_history
+        image: [macos-14, macos-15, macos-26]
+        xcode: ['']  # default Xcodes
+        macos-version-min: ['']
+        build: [autotools, cmake]
+        exclude:
+          # Combinations not covered by runner images:
+          - { image: macos-14, compiler: 'llvm@18' }
+          - { image: macos-14, compiler: 'llvm@20' }
+          - { image: macos-15, compiler: 'llvm@15' }
+          - { image: macos-15, compiler: 'llvm@20' }
+          - { image: macos-26, compiler: 'llvm@15' }
+          - { image: macos-26, compiler: 'llvm@18' }
+          # Covered by the main workflow
+          - { image: macos-15, compiler: 'gcc-13' }
+          - { image: macos-15, compiler: 'llvm@18' }
+          - { image: macos-15, compiler: 'clang' }
+          # Reduce build combinations, by dropping less interesting ones
+          - { image: macos-26, compiler: 'gcc-13' }
+          - { compiler: 'gcc-14' , build: cmake }
+          # Reduce autotools to only one job that is also build with cmake
+          - { compiler: 'gcc-13' , build: autotools }
+          - { compiler: 'gcc-14' , build: autotools }
+          - { compiler: 'gcc-15' , build: autotools }
+          - { compiler: 'llvm@15', build: autotools }
+          - { compiler: 'llvm@18', build: autotools }
+          - { compiler: 'llvm@20', build: autotools }
+          - { image: macos-14,     build: autotools }
+          - { image: macos-15,     build: autotools }
+    steps:
+      - name: 'install autotools'
+        if: ${{ matrix.build == 'autotools' }}
+        run: |
+          # shellcheck disable=SC2181
+          while [[ $? == 0 ]]; do
+            for i in 1 2 3; do
+              if brew install automake libtool; then
+                break 2
+              else
+                echo "Error: wait to try again: $i"
+                sleep 10
+              fi
+            done
+            false Too many retries
+          done
+
+      - name: 'toolchain versions'
+        run: |
+          [[ "${MATRIX_COMPILER}" = 'llvm'* ]] && CC="$(brew --prefix "${MATRIX_COMPILER}")/bin/clang"
+          [[ "${MATRIX_COMPILER}" = 'gcc'* ]] && "${CC}" --print-sysroot
+          command -v "${CC}"; "${CC}" --version || true
+          xcodebuild -version || true
+          xcrun --sdk macosx --show-sdk-path 2>/dev/null || true
+          xcrun --sdk macosx --show-sdk-version || true
+          ls -l /Library/Developer/CommandLineTools/SDKs || true
+          echo '::group::compiler defaults'; echo 'int main(void) {}' | "${CC}" -v -x c -; echo '::endgroup::'
+          echo '::group::macros predefined'; "${CC}" -dM -E - < /dev/null | sort || true; echo '::endgroup::'
+          echo '::group::brew packages preinstalled'; ls -l "$(brew --prefix)"/opt; echo '::endgroup::'
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'autoreconf'
+        if: ${{ matrix.build == 'autotools' }}
+        run: autoreconf -fi
+
+      - name: 'configure / ${{ matrix.build }}'
+        run: |
+          if [ "${MATRIX_COMPILER}" = 'gcc-13' ] && [ "${MATRIX_IMAGE}" = 'macos-15' ]; then
+            # Ref: https://github.com/Homebrew/homebrew-core/issues/194778#issuecomment-2793243409
+            "$(brew --prefix gcc@13)"/libexec/gcc/aarch64-apple-darwin24/13/install-tools/mkheaders
+          fi
+
+          if [[ "${MATRIX_COMPILER}" = 'gcc'* ]]; then
+            sysroot="$("${CC}" --print-sysroot)"  # Must match the SDK gcc was built for
+          else
+            sysroot="$(xcrun --sdk macosx --show-sdk-path 2>/dev/null)"
+          fi
+
+          if [[ "${MATRIX_COMPILER}" = 'llvm'* ]]; then
+            CC="$(brew --prefix "${MATRIX_COMPILER}")/bin/clang"
+            CC+=" --sysroot=${sysroot}"
+            CC+=" --target=$(uname -m)-apple-darwin"
+          fi
+
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            [ -n "${MATRIX_MACOS_VERSION_MIN}" ] && options+=" -DCMAKE_OSX_DEPLOYMENT_TARGET=${MATRIX_MACOS_VERSION_MIN}"
+            # would pick up nghttp2, libidn2, and libssh2
+            cmake -B bld -G Ninja -D_CURL_PREFILL=ON \
+              -DCMAKE_UNITY_BUILD=ON -DCURL_DROP_UNUSED=ON -DCURL_WERROR=ON \
+              -DCMAKE_OSX_SYSROOT="${sysroot}" \
+              -DCMAKE_C_COMPILER_TARGET="$(uname -m | sed 's/arm64/aarch64e/')-apple-darwin$(uname -r)" \
+              -DCMAKE_IGNORE_PREFIX_PATH="$(brew --prefix)" \
+              -DBUILD_LIBCURL_DOCS=OFF -DBUILD_MISC_DOCS=OFF -DENABLE_CURL_MANUAL=OFF \
+              -DCURL_USE_OPENSSL=ON \
+              -DUSE_NGHTTP2=OFF -DUSE_LIBIDN2=OFF \
+              -DCURL_USE_LIBPSL=OFF -DCURL_USE_LIBSSH2=OFF \
+              -DUSE_APPLE_IDN=ON -DUSE_APPLE_SECTRUST=ON \
+              ${options}
+          else
+            export CFLAGS
+            if [[ "${MATRIX_COMPILER}" = 'llvm'* ]]; then
+              options+=" --target=$(uname -m)-apple-darwin"
+            fi
+            if [ "${MATRIX_COMPILER}" != 'clang' ]; then
+              options+=" --with-sysroot=${sysroot}"
+              CFLAGS+=" --sysroot=${sysroot}"
+            fi
+            [ -n "${MATRIX_MACOS_VERSION_MIN}" ] && CFLAGS+=" -mmacosx-version-min=${MATRIX_MACOS_VERSION_MIN}"
+            # would pick up nghttp2, libidn2, but libssh2 is disabled by default
+            mkdir bld && cd bld && ../configure --enable-unity --enable-warnings --enable-werror --disable-static \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              --disable-docs --disable-manual \
+              --with-openssl="$(brew --prefix openssl)" \
+              --without-nghttp2 --without-libidn2 \
+              --without-libpsl \
+              --with-apple-idn --with-apple-sectrust \
+              ${options}
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+
+      - name: 'build / ${{ matrix.build }}'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose
+          else
+            make -C bld V=1
+          fi
+
+      - name: 'curl -V'
+        run: |
+          find . -type f \( -name curl -o -name '*.dylib' -o -name '*.a' \) -print0 | xargs -0 file --
+          find . -type f \( -name curl -o -name '*.dylib' -o -name '*.a' \) -print0 | xargs -0 stat -f '%10z bytes: %N' --
+          bld/src/curl --disable --version
diff --git a/third-party/curl/.github/workflows/ngtcp2-linux.yml b/third-party/curl/.github/workflows/ngtcp2-linux.yml
deleted file mode 100644
index 338418cbb1..0000000000
--- a/third-party/curl/.github/workflows/ngtcp2-linux.yml
+++ /dev/null
@@ -1,279 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: ngtcp2-linux
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-  pull_request:
-    branches:
-    - master
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-
-concurrency:
-  # Hardcoded workflow filename as workflow name above is just Linux again
-  group: ngtcp2-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-env:
-  MAKEFLAGS: -j 3
-  quictls-version: 3.0.10+quic
-  gnutls-version: 3.8.0
-  wolfssl-version: master
-  nghttp3-version: v0.15.0
-  ngtcp2-version: v0.19.1
-  nghttp2-version: v1.56.0
-  mod_h2-version: v2.0.21
-
-jobs:
-  autotools:
-    name: ${{ matrix.build.name }}
-    runs-on: 'ubuntu-latest'
-    timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        build:
-        - name: quictls
-          configure: >-
-            PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" LDFLAGS="-Wl,-rpath,$HOME/nghttpx/lib"
-            --with-ngtcp2=$HOME/nghttpx --enable-warnings --enable-werror --enable-debug
-            --with-test-nghttpx="$HOME/nghttpx/bin/nghttpx"
-            --with-openssl=$HOME/nghttpx
-        - name: gnutls
-          configure: >-
-            PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" LDFLAGS="-Wl,-rpath,$HOME/nghttpx/lib"
-            --with-ngtcp2=$HOME/nghttpx --enable-warnings --enable-werror --enable-debug
-            --with-test-nghttpx="$HOME/nghttpx/bin/nghttpx"
-            --with-gnutls=$HOME/nghttpx
-        - name: wolfssl
-          configure: >-
-            PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" LDFLAGS="-Wl,-rpath,$HOME/nghttpx/lib"
-            --with-ngtcp2=$HOME/nghttpx --enable-warnings --enable-werror --enable-debug
-            --with-test-nghttpx="$HOME/nghttpx/bin/nghttpx"
-            --with-wolfssl=$HOME/nghttpx
-
-    steps:
-    - run: |
-        sudo apt-get update
-        sudo apt-get install libtool autoconf automake pkg-config stunnel4 \
-          libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libev-dev libc-ares-dev \
-          nettle-dev libp11-kit-dev libtspi-dev libunistring-dev guile-2.2-dev libtasn1-bin \
-          libtasn1-6-dev libidn2-0-dev gawk gperf libtss2-dev dns-root-data bison gtk-doc-tools \
-          texinfo texlive texlive-extra-utils autopoint libev-dev \
-          apache2 apache2-dev libnghttp2-dev
-      name: 'install prereqs and impacket, pytest, crypto, apache2'
-
-    - name: cache quictls
-      uses: actions/cache@v3
-      id: cache-quictls
-      env:
-        cache-name: cache-quictls
-      with:
-        path: /home/runner/quictls
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.quictls-version }}
-
-    - if: steps.cache-quictls.outputs.cache-hit != 'true'
-      run: |
-        cd $HOME
-        git clone --quiet --depth=1 -b openssl-${{ env.quictls-version }} https://github.com/quictls/openssl quictls
-        cd quictls
-        ./config --prefix=$HOME/nghttpx --libdir=$HOME/nghttpx/lib
-        make
-      name: 'build quictls'
-
-    - run: |
-        cd $HOME/quictls
-        make -j1 install_sw
-      name: 'install quictls'
-
-
-    - name: cache gnutls
-      uses: actions/cache@v3
-      id: cache-gnutls
-      env:
-        cache-name: cache-gnutls
-      with:
-        path: /home/runner/gnutls
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.gnutls-version }}
-
-    - if: steps.cache-gnutls.outputs.cache-hit != 'true'
-      run: |
-        cd $HOME
-        git clone --quiet --depth=1 -b ${{ env.gnutls-version }} https://github.com/gnutls/gnutls.git
-        cd gnutls
-        ./bootstrap
-        ./configure  --prefix=$HOME/nghttpx \
-          PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" LDFLAGS="-Wl,-rpath,$HOME/nghttpx/lib -L$HOME/nghttpx/lib" \
-          --with-included-libtasn1 --with-included-unistring \
-          --disable-guile --disable-doc --disable-tests --disable-tools
-        make
-      name: 'build gnutls'
-
-    - run: |
-        cd $HOME/gnutls
-        make install
-      name: 'install gnutls'
-
-
-    - name: cache wolfssl
-      uses: actions/cache@v3
-      id: cache-wolfssl
-      env:
-        cache-name: cache-wolfssl
-      with:
-        path: /home/runner/wolfssl
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.wolfssl-version }}
-
-    - if: steps.cache-wolfssl.outputs.cache-hit != 'true' || ${{ env.wolfssl-version }} == 'master'
-      run: |
-        cd $HOME
-        rm -rf wolfssl
-        git clone --quiet --depth=1 -b ${{ env.wolfssl-version }} https://github.com/wolfSSL/wolfssl.git
-        cd wolfssl
-        ./autogen.sh
-        ./configure --enable-all --enable-quic --prefix=$HOME/nghttpx
-        make
-      name: 'build wolfssl'
-
-    - run: |
-        cd $HOME/wolfssl
-        make install
-      name: 'install wolfssl'
-
-
-    - name: cache nghttp3
-      uses: actions/cache@v3
-      id: cache-nghttp3
-      env:
-        cache-name: cache-nghttp3
-      with:
-        path: /home/runner/nghttp3
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.nghttp3-version }}
-
-    - if: steps.cache-nghttp3.outputs.cache-hit != 'true'
-      run: |
-        cd $HOME
-        git clone --quiet --depth=1 -b ${{ env.nghttp3-version }} https://github.com/ngtcp2/nghttp3
-        cd nghttp3
-        autoreconf -fi
-        ./configure --prefix=$HOME/nghttpx PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" --enable-lib-only
-        make
-      name: 'build nghttp3'
-
-    - run: |
-        cd $HOME/nghttp3
-        make install
-      name: 'install nghttp3'
-
-    # depends on all other cached libs built so far
-    - run: |
-        git clone --quiet --depth=1 -b ${{ env.ngtcp2-version }} https://github.com/ngtcp2/ngtcp2
-        cd ngtcp2
-        autoreconf -fi
-        ./configure --prefix=$HOME/nghttpx PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" --enable-lib-only --with-openssl --with-gnutls --with-wolfssl
-        make install
-      name: 'install ngtcp2'
-
-    # depends on all other cached libs built so far
-    - run: |
-        git clone --quiet --depth=1 -b ${{ env.nghttp2-version }} https://github.com/nghttp2/nghttp2
-        cd nghttp2
-        autoreconf -fi
-        ./configure --prefix=$HOME/nghttpx PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" --enable-http3
-        make install
-      name: 'install nghttp2'
-
-    - name: cache mod_h2
-      uses: actions/cache@v3
-      id: cache-mod_h2
-      env:
-        cache-name: cache-mod_h2
-      with:
-        path: /home/runner/mod_h2
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.mod_h2-version }}
-
-    - if: steps.cache-mod_h2.outputs.cache-hit != 'true'
-      run: |
-        cd $HOME
-        git clone --quiet --depth=1 -b  ${{ env.mod_h2-version }} https://github.com/icing/mod_h2
-        cd mod_h2
-        autoreconf -fi
-        ./configure
-        make
-      name: 'build mod_h2'
-
-    - run: |
-        cd $HOME/mod_h2
-        sudo make install
-      name: 'install mod_h2'
-
-    - uses: actions/checkout@v3
-
-    - run: |
-        sudo python3 -m pip install -r tests/requirements.txt -r tests/http/requirements.txt
-      name: 'install python test prereqs'
-
-    - run: autoreconf -fi
-      name: 'autoreconf'
-
-    - run: ./configure ${{ matrix.build.configure }}
-      name: 'configure'
-
-    - run: make V=1
-      name: 'make'
-
-    - run: make V=1 examples
-      name: 'make examples'
-
-    - run: make V=1 -C tests
-      name: 'make tests'
-
-    - run: make V=1 test-ci
-      name: 'run tests'
-      env:
-        TFLAGS: "${{ matrix.build.tflags }}"
-
-    - run: pytest -v tests
-      name: 'run pytest'
-      env:
-        TFLAGS: "${{ matrix.build.tflags }}"
-        CURL_CI: github
-
-    - run: pytest -v tests
-      name: 'run pytest with slowed network'
-      env:
-        # 33% of sends are EAGAINed
-        CURL_DBG_SOCK_WBLOCK: 33
-        # only 80% of data > 10 bytes is send
-        CURL_DBG_SOCK_WPARTIAL: 80
-        CURL_CI: github
diff --git a/third-party/curl/.github/workflows/non-native.yml b/third-party/curl/.github/workflows/non-native.yml
new file mode 100644
index 0000000000..621605a45e
--- /dev/null
+++ b/third-party/curl/.github/workflows/non-native.yml
@@ -0,0 +1,565 @@
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+name: 'non-native'
+
+'on':
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  CURL_CI: github
+  CURL_TEST_MIN: 1820
+  DO_NOT_TRACK: '1'
+
+jobs:
+  cross:
+    name: "${{ matrix.os }} ${{ matrix.version }}, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.cc }} ${{ matrix.desc }} ${{ matrix.arch }}"
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        shell: cpa.sh {0}  # zizmor: ignore[misfeature]
+    env:
+      CC: '${{ matrix.cc }}'
+      MAKEFLAGS: -j 3
+      MATRIX_ARCH: '${{ matrix.arch }}'
+      MATRIX_BUILD: '${{ matrix.build }}'
+      MATRIX_INSTALL: '${{ matrix.install }}'
+      MATRIX_OPTIONS: '${{ matrix.options }}'
+      MATRIX_OS: '${{ matrix.os }}'
+      MATRIX_VERSION: '${{ matrix.version }}'
+    strategy:
+      matrix:
+        include:
+          # https://github.com/DragonFlyBSD/DPorts
+          # { os: 'dragonflybsd', version: '6.4.2', build: 'autotools', arch: 'x86_64', cc: 'gcc'  , desc: 'openssl skiprun',
+          #   install: 'autoconf automake libtool openldap26-client libidn2',
+          #   options: '--with-openssl --enable-ldap --enable-ldaps --with-libidn2' }
+
+          # { os: 'dragonflybsd', version: '6.4.2', build: 'cmake'    , arch: 'x86_64', cc: 'gcc'  , desc: 'openssl skipall',
+          #   install: 'cmake ninja' }
+
+          # https://ports.freebsd.org/
+          - { os: 'freebsd'     , version: '15.1',  build: 'autotools', arch: 'x86_64', cc: 'clang', desc: 'openssl',
+              install: 'autoconf automake libtool krb5-devel openldap26-client libidn2 stunnel',
+              options: '--with-openssl --with-gssapi --enable-ldap --enable-ldaps --with-libidn2' }
+
+          - { os: 'freebsd'     , version: '15.1',  build: 'cmake'    , arch: 'x86_64', cc: 'clang', desc: 'openssl !unity skiprun !examples',
+              install: 'cmake-core ninja perl5 krb5-devel openldap26-client libidn2',
+              options: '-DCURL_USE_GSSAPI=ON -DCMAKE_UNITY_BUILD=OFF' }
+
+          - { os: 'freebsd'     , version: '14.3',  build: 'autotools', arch: 'arm64' , cc: 'clang', desc: 'openssl !examples',
+              install: 'autoconf automake libtool krb5-devel openldap26-client libidn2 stunnel',
+              options: '--with-openssl --with-gssapi --enable-ldap --enable-ldaps --with-libidn2' }
+
+          - { os: 'freebsd'     , version: '14.3',  build: 'cmake'    , arch: 'arm64' , cc: 'clang', desc: 'openssl',
+              install: 'cmake-core ninja perl5 krb5-devel openldap26-client libidn2 stunnel',
+              options: '-DCURL_USE_GSSAPI=ON' }
+
+          # https://app.midnightbsd.org/
+          # https://man.midnightbsd.org/cgi-bin/man.cgi/mport
+          # { os: 'midnightbsd' , version: '4.0.4', build: 'autotools' , arch: 'x86_64', cc: 'clang', desc: 'gnutls skipall !examples',
+          #   install: 'autoconf autoconf-archive automake libtool gnutls',
+          #   options: '--with-gnutls' }
+
+          - { os: 'midnightbsd' , version: '4.0.4', build: 'cmake'    , arch: 'x86_64', cc: 'clang', desc: 'gnutls skiprun',
+              install: 'cmake-core ninja perl5 gnutls openldap26-client libidn2',
+              options: '-DCURL_USE_GNUTLS=ON' }
+
+          # https://pkgsrc.se/
+          - { os: 'netbsd'      , version: '10.1' , build: 'autotools', arch: 'x86_64', cc: 'gcc'  , desc: 'openssl skipall !examples',
+              install: 'autoconf automake libtool mit-krb5',
+              options: '--with-openssl --with-gssapi' }
+
+          - { os: 'netbsd'      , version: '10.1' , build: 'cmake'    , arch: 'x86_64', cc: 'gcc'  , desc: 'openssl',
+              install: 'cmake ninja-build mit-krb5 openldap-client libidn2',
+              options: '-DCURL_USE_GSSAPI=ON' }
+
+          # https://openbsd.app/
+          # https://www.openbsd.org/faq/faq15.html
+          # https://github.com/OpenMPT/openmpt/blob/master/.github/workflows/OpenBSD-Autotools.yml
+          - { os: 'openbsd'     , version: '7.9'  , build: 'autotools', arch: 'x86_64', cc: 'clang', desc: 'libressl skipall !examples',
+              install: 'autoconf-2.72p0 automake-1.18.1 libtool',  # NOTE: also sync these versions with the autoreconf step!
+              options: '--with-openssl' }
+
+          - { os: 'openbsd'     , version: '7.9'  , build: 'cmake'    , arch: 'x86_64', cc: 'clang', desc: 'libressl',
+              install: 'cmake ninja openldap-client-- libidn2' }
+
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'setup VM'
+        uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0
+        with:
+          environment_variables: 'CC CURL_CI CURL_TEST_MIN DO_NOT_TRACK MAKEFLAGS MATRIX_ARCH MATRIX_BUILD MATRIX_INSTALL MATRIX_OPTIONS MATRIX_OS MATRIX_VERSION'
+          operating_system: '${{ matrix.os }}'
+          version: '${{ matrix.version }}'
+          architecture: '${{ matrix.arch }}'
+
+      - name: 'install prereqs'
+        run: |
+          if [ "${MATRIX_OS}" = 'dragonflybsd' ]; then
+            sudo pkg install -y pkgconf brotli libnghttp2 ${MATRIX_INSTALL}
+          elif [ "${MATRIX_OS}" = 'freebsd' ]; then
+            sudo pkg install -y pkgconf brotli libnghttp2 ${MATRIX_INSTALL}
+          elif [ "${MATRIX_OS}" = 'midnightbsd' ]; then
+            if [ "${MATRIX_BUILD}" = 'autotools' ]; then
+              sudo mport index | grep -v -E 'Downloading.+%'
+              sudo mport upgrade | grep -v -E '(Downloading.+%|^/usr/local)'
+            fi
+            sudo mport install pkgconf brotli libnghttp2 ${MATRIX_INSTALL} | grep -v -E '(Downloading.+%|^/usr/local)' || true
+          elif [ "${MATRIX_OS}" = 'netbsd' ]; then
+            sudo pkgin -y install pkg-config perl brotli libssh2 libpsl nghttp2 ${MATRIX_INSTALL}
+          elif [ "${MATRIX_OS}" = 'openbsd' ]; then
+            sudo pkg_add -I brotli libssh2 libpsl nghttp2 ${MATRIX_INSTALL}
+            if [ "${MATRIX_BUILD}" = 'autotools' ]; then
+              sudo pkg_delete -I curl  # to avoid autotools build linking against system libcurl
+            fi
+          fi
+
+      - name: 'autoreconf'
+        if: ${{ matrix.build == 'autotools' }}
+        run: |
+          if [ "${MATRIX_OS}" = 'openbsd' ]; then
+            if [ "${MATRIX_VERSION}" = '7.9' ]; then
+              export AUTOCONF_VERSION=2.72
+              export AUTOMAKE_VERSION=1.18
+            fi
+          fi
+          autoreconf -fi
+
+      - name: 'configure'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake -B bld -G Ninja -DCMAKE_INSTALL_PREFIX="$HOME"/curl-install \
+              -DCMAKE_C_COMPILER="${CC}" \
+              -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON -DENABLE_DEBUG=ON -DCMAKE_BUILD_TYPE=Debug \
+              -DCURL_ENABLE_NTLM=ON ${MATRIX_OPTIONS}
+          else
+            if [ "${MATRIX_ARCH}" != 'x86_64' ]; then
+              options='--disable-manual --disable-docs'  # Slow with autotools, skip on emulated CPU
+            fi
+            mkdir bld && cd bld
+            ../configure --prefix="$HOME"/curl-install --enable-unity --enable-debug --enable-warnings --enable-werror --disable-static \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              --with-brotli --with-libssh2 --with-nghttp2  \
+              ${options} ${MATRIX_OPTIONS}
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+
+      - name: 'build'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld
+          else
+            make -C bld V=1
+          fi
+
+      - name: 'curl -V'
+        run: bld/src/curl --disable --version
+
+      - name: 'curl install'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --install bld
+          else
+            make -C bld install
+          fi
+
+      - name: 'build tests'
+        if: ${{ matrix.arch == 'x86_64' && !contains(matrix.desc, 'skipall') }}  # Slow on emulated CPU
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --target testdeps
+          else
+            make -C bld -C tests
+          fi
+
+      - name: 'run tests'
+        if: ${{ matrix.arch == 'x86_64' && !contains(matrix.desc, 'skipall') && !contains(matrix.desc, 'skiprun') }}  # Slow on emulated CPU
+        run: |
+          export TFLAGS='-j8'
+          if [ "${MATRIX_OS}" = 'openbsd' ]; then
+            TFLAGS="$TFLAGS !2707"  # Skip 2707 'ws: Peculiar frame sizes' on suspicion of hangs
+          fi
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target test-ci
+          else
+            make -C bld V=1 test-ci
+          fi
+
+      - name: 'build examples'
+        if: ${{ !contains(matrix.desc, '!examples') }}
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --target curl-examples-build
+          else
+            make -C bld examples
+          fi
+
+  amiga:
+    name: "AmigaOS, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} gcc AmiSSL m68k"
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    env:
+      MAKEFLAGS: -j 5
+      MATRIX_BUILD: '${{ matrix.build }}'
+      AMISSL_VERSION: '5.27'
+      AMISSL_SHA256: 5003bef8c5930354d16b0ce7196d71b2811891c42fad38a9238c5ce4098ad42a
+      TOOLCHAIN_VERSION: 6.5.0
+      TOOLCHAIN_SHA256: 381e227c9ef552f073771d6f851cfdf873b574f3cf5db7c1c0107ea5d7146edc
+    strategy:
+      matrix:
+        build: [autotools, cmake]
+      fail-fast: false
+    steps:
+      - name: 'cache compiler'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-compiler
+        with:
+          path: ~/opt/amiga
+          key: ${{ runner.os }}-amigaos-${{ env.TOOLCHAIN_VERSION }}-${{ env.AMISSL_VERSION }}-amd64
+
+      - name: 'install compiler'
+        if: ${{ !steps.cache-compiler.outputs.cache-hit }}
+        run: |
+          cd ~
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 3 --retry-connrefused \
+            https://franke.ms/download/amiga-gcc.tgz --output pkg.bin
+          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${TOOLCHAIN_SHA256}" && tar -xf pkg.bin && rm -f pkg.bin
+          cd opt/amiga
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/jens-maus/amissl/releases/download/${AMISSL_VERSION}/AmiSSL-${AMISSL_VERSION}-SDK.lha" --output pkg.bin
+          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${AMISSL_SHA256}" && 7z x -bd -y pkg.bin && rm -f pkg.bin
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'configure'
+        run: |
+          ln -s ~/opt/amiga /opt
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake -B bld -G Ninja \
+              -DAMIGA=1 \
+              -DCMAKE_SYSTEM_NAME=Generic \
+              -DCMAKE_SYSTEM_PROCESSOR=m68k \
+              -DCMAKE_C_COMPILER_TARGET=m68k-unknown-amigaos \
+              -DCMAKE_C_COMPILER=/opt/amiga/bin/m68k-amigaos-gcc \
+              -DCMAKE_C_FLAGS='-O0 -msoft-float -mcrt=clib2' \
+              -DCMAKE_UNITY_BUILD=ON \
+              -DCURL_WERROR=ON \
+              -DCURL_USE_LIBPSL=OFF \
+              -DAMISSL_INCLUDE_DIR=/opt/amiga/AmiSSL/Developer/include \
+              -DAMISSL_STUBS_LIBRARY=/opt/amiga/AmiSSL/Developer/lib/AmigaOS3/libamisslstubs.a \
+              -DAMISSL_AUTO_LIBRARY=/opt/amiga/AmiSSL/Developer/lib/AmigaOS3/libamisslauto.a
+          else
+            autoreconf -fi
+            mkdir bld && cd bld && ../configure --enable-unity --enable-warnings --enable-werror \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              CC=/opt/amiga/bin/m68k-amigaos-gcc \
+              AR=/opt/amiga/bin/m68k-amigaos-ar \
+              RANLIB=/opt/amiga/bin/m68k-amigaos-ranlib \
+              --host=m68k-amigaos \
+              --disable-shared \
+              --without-libpsl \
+              --with-amissl \
+              LDFLAGS=-L/opt/amiga/AmiSSL/Developer/lib/AmigaOS3 \
+              CPPFLAGS=-I/opt/amiga/AmiSSL/Developer/include \
+              CFLAGS='-O0 -msoft-float -mcrt=clib2' \
+              LIBS='-lnet -lm -latomic'
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/config.log bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+
+      - name: 'build'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld
+          else
+            make -C bld
+          fi
+
+      - name: 'curl info'
+        run: |
+          find . -type f \( -name curl -o -name '*.a' \) -print0 | xargs -0 file --
+          find . -type f \( -name curl -o -name '*.a' \) -print0 | xargs -0 stat -c '%10s bytes: %n' --
+
+      - name: 'build tests'
+        if: ${{ matrix.build == 'cmake' }}  # skip for autotools to save time
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --target testdeps
+          else
+            make -C bld -C tests
+          fi
+
+      - name: 'build examples'
+        if: ${{ matrix.build == 'cmake' }}  # skip for autotools to save time
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --target curl-examples-build
+          else
+            make -C bld examples
+          fi
+
+  android:
+    name: "Android ${{ matrix.platform }}, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.name }} arm64"
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    env:
+      LDFLAGS: -s
+      MAKEFLAGS: -j 5
+      MATRIX_BUILD: '${{ matrix.build }}'
+    strategy:
+      matrix:
+        include:
+          - { build: 'autotools', platform: '21', name: "!ssl !zstd",
+              options: '--without-ssl --without-libpsl --without-zstd' }
+
+          - { build: 'cmake'    , platform: '21', name: "!ssl !zstd",
+              options: '-DCURL_ENABLE_SSL=OFF -DCURL_USE_LIBPSL=OFF -DCURL_ZSTD=OFF' }
+
+          - { build: 'autotools', platform: '35', name: "!ssl !zstd",
+              options: '--without-ssl --without-libpsl --without-zstd' }
+
+          - { build: 'cmake'    , platform: '35', name: "!ssl !zstd",
+              options: '-DCURL_ENABLE_SSL=OFF -DCURL_USE_LIBPSL=OFF -DCURL_ZSTD=OFF' }
+
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'autoreconf'
+        if: ${{ matrix.build == 'autotools' }}
+        run: autoreconf -fi
+
+      - name: 'configure'
+        env:
+          MATRIX_OPTIONS: '${{ matrix.options }}'
+          MATRIX_PLATFORM: '${{ matrix.platform }}'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then  # https://developer.android.com/ndk/guides/cmake
+            cmake -B bld -G Ninja \
+              -DANDROID_ABI=arm64-v8a \
+              -DANDROID_PLATFORM="android-${MATRIX_PLATFORM}" \
+              -DCMAKE_TOOLCHAIN_FILE="${ANDROID_NDK_HOME}/build/cmake/android.toolchain.cmake" -DCMAKE_WARN_DEPRECATED=OFF \
+              -DCMAKE_UNITY_BUILD=ON \
+              -DCURL_WERROR=ON \
+              ${MATRIX_OPTIONS}
+          else
+            TOOLCHAIN="${ANDROID_NDK_HOME}/toolchains/llvm/prebuilt/linux-x86_64"
+            mkdir bld && cd bld && ../configure --enable-unity --enable-warnings --enable-werror --disable-shared \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              CC="$TOOLCHAIN/bin/aarch64-linux-android${MATRIX_PLATFORM}-clang" \
+              AR="$TOOLCHAIN/bin/llvm-ar" \
+              RANLIB="$TOOLCHAIN/bin/llvm-ranlib" \
+              --host="aarch64-linux-android${MATRIX_PLATFORM}" \
+              ${MATRIX_OPTIONS}
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/config.log bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
+
+      - name: 'dump config files'
+        run: |
+          for f in libcurl.pc curl-config; do
+            echo "::group::${f}"; grep -v '^#' bld/"${f}" || true; echo '::endgroup::'
+          done
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+
+      - name: 'build'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose
+          else
+            make -C bld V=1
+          fi
+
+      - name: 'curl info'
+        run: |
+          find . -type f \( -name curl -o -name '*.so' -o -name '*.a' \) -print0 | xargs -0 file --
+          find . -type f \( -name curl -o -name '*.so' -o -name '*.a' \) -print0 | xargs -0 stat -c '%10s bytes: %n' --
+
+      - name: 'build tests'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --target testdeps
+          else
+            make -C bld -C tests
+          fi
+
+      - name: 'build examples'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --target curl-examples-build
+          else
+            make -C bld examples
+          fi
+
+  msdos:
+    name: "MS-DOS, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} djgpp !ssl i586"
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    env:
+      LDFLAGS: -s
+      MAKEFLAGS: -j 5
+      MATRIX_BUILD: '${{ matrix.build }}'
+      # renovate: datasource=github-releases depName=andrewwutw/build-djgpp versioning=semver-coerced registryUrl=https://github.com
+      TOOLCHAIN_VERSION: '3.4'
+      TOOLCHAIN_SHA256: 8464f17017d6ab1b2bb2df4ed82357b5bf692e6e2b7fee37e315638f3d505f00
+    strategy:
+      matrix:
+        build: [autotools, cmake]
+      fail-fast: false
+    steps:
+      - name: 'install packages'
+        timeout-minutes: 2
+        run: |
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo apt-get -o Dpkg::Use-Pty=0 update
+          sudo apt-get -o Dpkg::Use-Pty=0 install libfl2
+
+      - name: 'cache compiler (djgpp)'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-compiler
+        with:
+          path: ~/djgpp
+          key: ${{ runner.os }}-djgpp-${{ env.TOOLCHAIN_VERSION }}-amd64
+
+      - name: 'install compiler (djgpp)'
+        if: ${{ !steps.cache-compiler.outputs.cache-hit }}
+        run: |
+          cd ~
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 3 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/andrewwutw/build-djgpp/releases/download/v${TOOLCHAIN_VERSION}/djgpp-linux64-gcc1220.tar.bz2" --output pkg.bin
+          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${TOOLCHAIN_SHA256}" && tar -xjf pkg.bin && rm -f pkg.bin
+          cd djgpp
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+            https://www.delorie.com/pub/djgpp/current/v2tk/wat3211b.zip --output pkg.bin
+          sha256sum pkg.bin | tee /dev/stderr | grep -qwF faa2222ab5deb2c2aac229c760bf4d45aca5379f5af97865c308a0467046b67a && unzip -q pkg.bin && rm -f pkg.bin
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+            https://www.delorie.com/pub/djgpp/current/v2tk/zlb13b.zip --output pkg.bin
+          sha256sum pkg.bin | tee /dev/stderr | grep -qwF f3d2fa8129e7591c7e79074306d8ab91a70ec172cc01baedeae74992285dd3a3 && unzip -q pkg.bin && rm -f pkg.bin
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'configure'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake -B bld -G Ninja \
+              -DCMAKE_SYSTEM_NAME=DOS \
+              -DCMAKE_SYSTEM_PROCESSOR=x86 \
+              -DCMAKE_C_COMPILER_TARGET=i586-pc-msdosdjgpp \
+              -DCMAKE_C_COMPILER="$HOME"/djgpp/bin/i586-pc-msdosdjgpp-gcc \
+              -DCMAKE_UNITY_BUILD=ON \
+              -DCURL_WERROR=ON \
+              -DCURL_ENABLE_SSL=OFF -DCURL_USE_LIBPSL=OFF \
+              -DZLIB_INCLUDE_DIR="$HOME"/djgpp/include \
+              -DZLIB_LIBRARY="$HOME"/djgpp/lib/libz.a \
+              -DWATT_ROOT="$HOME"/djgpp/net/watt
+          else
+            autoreconf -fi
+            mkdir bld && cd bld && ../configure --enable-unity --enable-warnings --enable-werror --disable-shared \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              CC="$HOME"/djgpp/bin/i586-pc-msdosdjgpp-gcc \
+              AR="$HOME"/djgpp/bin/i586-pc-msdosdjgpp-ar \
+              RANLIB="$HOME"/djgpp/bin/i586-pc-msdosdjgpp-ranlib \
+              WATT_ROOT="$HOME"/djgpp/net/watt \
+              --host=i586-pc-msdosdjgpp \
+              --without-ssl --without-libpsl \
+              --with-zlib="$HOME"/djgpp
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/config.log bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+
+      - name: 'build'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld
+          else
+            make -C bld
+          fi
+
+      - name: 'curl info'
+        run: |
+          find . \( -name '*.exe' -o -name '*.a' \) -print0 | xargs -0 file --
+          find . \( -name '*.exe' -o -name '*.a' \) -print0 | xargs -0 stat -c '%10s bytes: %n' --
+
+      - name: 'build tests'
+        if: ${{ matrix.build == 'cmake' }}  # skip for autotools to save time
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --target testdeps
+          else
+            make -C bld -C tests
+          fi
+
+      - name: 'build examples'
+        if: ${{ matrix.build == 'cmake' }}  # skip for autotools to save time
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --target curl-examples-build
+          else
+            make -C bld examples
+          fi
diff --git a/third-party/curl/.github/workflows/proselint.yml b/third-party/curl/.github/workflows/proselint.yml
deleted file mode 100644
index 01a7cf5c74..0000000000
--- a/third-party/curl/.github/workflows/proselint.yml
+++ /dev/null
@@ -1,68 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: proselint
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-    paths:
-    - '.github/workflows/proselint.yml'
-    - '**.md'
-  pull_request:
-    branches:
-    - master
-    paths:
-    - '.github/workflows/proselint.yml'
-    - '**.md'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v2
-
-    - name: install prereqs
-      run: sudo apt-get install python3-proselint
-
-    # config file help: https://github.com/amperser/proselint/
-    - name: create proselint config
-      run: |
-        cat <<JSON > $HOME/.proselintrc
-        {
-          "checks": {
-            "typography.diacritical_marks": false,
-            "typography.symbols": false,
-            "annotations.misc": false
-          }
-        }
-        JSON
-
-    - name: check prose
-      run: a=`git ls-files '*.md' | grep -v docs/CHECKSRC.md` && proselint $a README
-
-    # This is for CHECKSRC and files with aggressive exclamation mark needs
-    - name: create second proselint config
-      run: |
-        cat <<JSON > $HOME/.proselintrc
-        {
-          "checks": {
-            "typography.diacritical_marks": false,
-            "typography.symbols": false,
-            "typography.exclamation": false,
-            "annotations.misc": false
-          }
-        }
-        JSON
-
-    - name: check special prose
-      run: a=docs/CHECKSRC.md && proselint $a
diff --git a/third-party/curl/.github/workflows/quiche-linux.yml b/third-party/curl/.github/workflows/quiche-linux.yml
deleted file mode 100644
index 69c328b47b..0000000000
--- a/third-party/curl/.github/workflows/quiche-linux.yml
+++ /dev/null
@@ -1,209 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: quiche
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-  pull_request:
-    branches:
-    - master
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-
-concurrency:
-  # Hardcoded workflow filename as workflow name above is just Linux again
-  group: quiche-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-env:
-  MAKEFLAGS: -j 3
-  openssl-version: 3.0.10+quic
-  nghttp3-version: v0.15.0
-  ngtcp2-version: v0.19.1
-  nghttp2-version: v1.56.0
-  quiche-version: 0.17.2
-  mod_h2-version: v2.0.21
-
-jobs:
-  autotools:
-    name: ${{ matrix.build.name }}
-    runs-on: 'ubuntu-latest'
-    timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        build:
-        - name: quiche
-          install: >-
-            libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libev-dev libc-ares-dev
-          install_steps: pytest
-          configure: >-
-            LDFLAGS="-Wl,-rpath,/home/runner/quiche/target/release"
-            --with-openssl=/home/runner/quiche/quiche/deps/boringssl/src
-            --enable-debug
-            --with-quiche=/home/runner/quiche/target/release
-            --with-test-nghttpx="$HOME/nghttpx/bin/nghttpx"
-
-    steps:
-    - run: |
-        sudo apt-get update
-        sudo apt-get install libtool autoconf automake pkg-config stunnel4 ${{ matrix.build.install }}
-        sudo apt-get install apache2 apache2-dev libnghttp2-dev
-      name: 'install prereqs and impacket, pytest, crypto'
-
-    - name: cache nghttpx
-      uses: actions/cache@v3
-      id: cache-nghttpx
-      env:
-        cache-name: cache-nghttpx
-      with:
-        path: /home/runner/nghttpx
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-openssl-${{ env.openssl-version }}-nghttp3-${{ env.nghttp3-version }}-ngtcp2-${{ env.ngtcp2-version }}-nghttp2-${{ env.nghttp2-version }}
-
-    - if: steps.cache-nghttpx.outputs.cache-hit != 'true'
-      run: |
-        git clone --quiet --depth=1 -b openssl-${{ env.openssl-version }} https://github.com/quictls/openssl
-        cd openssl
-        ./config --prefix=$HOME/nghttpx --libdir=$HOME/nghttpx/lib
-        make -j1 install_sw
-      name: 'install quictls'
-
-    - if: steps.cache-nghttpx.outputs.cache-hit != 'true'
-      run: |
-        git clone --quiet --depth=1 -b ${{ env.nghttp3-version }} https://github.com/ngtcp2/nghttp3
-        cd nghttp3
-        autoreconf -fi
-        ./configure --prefix=$HOME/nghttpx PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" --enable-lib-only
-        make install
-      name: 'install nghttp3'
-
-    - if: steps.cache-nghttpx.outputs.cache-hit != 'true'
-      run: |
-        git clone --quiet --depth=1 -b ${{ env.ngtcp2-version }} https://github.com/ngtcp2/ngtcp2
-        cd ngtcp2
-        autoreconf -fi
-        ./configure --prefix=$HOME/nghttpx PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" --enable-lib-only --with-openssl
-        make install
-      name: 'install ngtcp2'
-
-    - if: steps.cache-nghttpx.outputs.cache-hit != 'true'
-      run: |
-        git clone --quiet --depth=1 -b ${{ env.nghttp2-version }} https://github.com/nghttp2/nghttp2
-        cd nghttp2
-        autoreconf -fi
-        ./configure --prefix=$HOME/nghttpx PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" --enable-http3
-        make install
-      name: 'install nghttp2'
-
-    - name: cache quiche
-      uses: actions/cache@v3
-      id: cache-quiche
-      env:
-        cache-name: cache-quiche
-      with:
-        path: /home/runner/quiche
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-quiche-${{ env.quiche-version }}
-
-    - if: steps.cache-quiche.outputs.cache-hit != 'true'
-      run: |
-        cd $HOME
-        git clone --quiet --depth=1 -b ${{ env.quiche-version }} --recursive https://github.com/cloudflare/quiche.git
-        cd quiche
-        #### Work-around https://github.com/curl/curl/issues/7927 #######
-        #### See https://github.com/alexcrichton/cmake-rs/issues/131 ####
-        sed -i -e 's/cmake = "0.1"/cmake = "=0.1.45"/' quiche/Cargo.toml
-
-        cargo build -v --package quiche --release --features ffi,pkg-config-meta,qlog --verbose
-        mkdir -v quiche/deps/boringssl/src/lib
-        ln -vnf $(find target/release -name libcrypto.a -o -name libssl.a) quiche/deps/boringssl/src/lib/
-
-        # include dir
-        # /home/runner/quiche/quiche/deps/boringssl/src/include
-        # lib dir
-        # /home/runner/quiche/quiche/deps/boringssl/src/lib
-      name: 'build quiche and boringssl'
-
-    - name: cache mod_h2
-      uses: actions/cache@v3
-      id: cache-mod_h2
-      env:
-        cache-name: cache-mod_h2
-      with:
-        path: /home/runner/mod_h2
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.mod_h2-version }}
-
-    - if: steps.cache-mod_h2.outputs.cache-hit != 'true'
-      run: |
-        cd $HOME
-        git clone --quiet --depth=1 -b  ${{ env.mod_h2-version }} https://github.com/icing/mod_h2
-        cd mod_h2
-        autoreconf -fi
-        ./configure
-        make
-      name: 'build mod_h2'
-
-    - run: |
-        cd $HOME/mod_h2
-        sudo make install
-      name: 'install mod_h2'
-
-    - uses: actions/checkout@v3
-
-    - run: |
-        sudo python3 -m pip install -r tests/requirements.txt -r tests/http/requirements.txt
-      name: 'install python test prereqs'
-
-    - run: autoreconf -fi
-      name: 'autoreconf'
-
-    - run: ./configure ${{ matrix.build.configure }}
-      name: 'configure'
-
-    - run: make V=1
-      name: 'make'
-
-    - run: make V=1 examples
-      name: 'make examples'
-
-    - run: make V=1 -C tests
-      name: 'make tests'
-
-    - run: make V=1 test-ci
-      name: 'run tests'
-      env:
-        TFLAGS: "${{ matrix.build.tflags }}"
-
-    - run: pytest -v tests
-      name: 'run pytest'
-      env:
-        TFLAGS: "${{ matrix.build.tflags }}"
-        CURL_CI: github
diff --git a/third-party/curl/.github/workflows/reuse.yml b/third-party/curl/.github/workflows/reuse.yml
deleted file mode 100644
index 95ad6e9295..0000000000
--- a/third-party/curl/.github/workflows/reuse.yml
+++ /dev/null
@@ -1,29 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-# SPDX-FileCopyrightText: 2022 Free Software Foundation Europe e.V. <https://fsfe.org>
-#
-# SPDX-License-Identifier: curl
-
-name: REUSE compliance
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-  pull_request:
-    branches:
-    - master
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v3
-    - name: REUSE Compliance Check
-      uses: fsfe/reuse-action@v1
diff --git a/third-party/curl/.github/workflows/spellcheck.yml b/third-party/curl/.github/workflows/spellcheck.yml
deleted file mode 100644
index 1e43707722..0000000000
--- a/third-party/curl/.github/workflows/spellcheck.yml
+++ /dev/null
@@ -1,66 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: spell
-on:
-  push:
-    branches:
-    - master
-    paths:
-    - '**.md'
-    - '**.3'
-    - '**.1'
-    - '**/spellcheck.yml'
-    - '**/spellcheck.yaml'
-    - '**/wordlist.txt'
-  pull_request:
-    branches:
-    - master
-    paths:
-    - '**.md'
-    - '**.3'
-    - '**.1'
-    - '**/spellcheck.yml'
-    - '**/spellcheck.yaml'
-    - '**/wordlist.txt'
-
-permissions: {}
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v3
-
-    - name: install pandoc
-      run: sudo apt-get install pandoc
-
-    - name: build curl.1
-      run: |
-         autoreconf -fi
-         ./configure --without-ssl
-         make -C docs
-
-    - name: strip "uncheckable" sections from .3 pages
-      run: find docs -name "*.3" -size +40c | sed 's/\.3//' | xargs -t -n1 -I OO  ./.github/scripts/cleanspell.pl OO.3 OO.33
-
-    - name: convert .3 man pages to markdown
-      run: find docs -name "*.33" -size +40c | sed 's/\.33//' | xargs -t -n1 -I OO pandoc -f man -t markdown OO.33 -o OO.md
-
-    - name: convert .1 man pages to markdown
-      run: find docs -name "*.1" -size +40c | sed 's/\.1//' | xargs -t -n1 -I OO pandoc OO.1 -o OO.md
-
-    - name: trim the curl.1 markdown file
-      run: |
-        perl -pi -e 's/^    .*//' docs/curl.md
-        perl -pi -e 's/\-\-[\a-z0-9-]*//ig' docs/curl.md
-        perl -pi -e 's!https://[a-z0-9%/.-]*!!ig' docs/curl.md
-
-    - name: setup the custom wordlist
-      run: grep -v '^#' .github/scripts/spellcheck.words >  wordlist.txt
-
-    - name: Check Spelling
-      uses: rojopolis/spellcheck-github-actions@v0
-      with:
-        config_path: .github/scripts/spellcheck.yaml
diff --git a/third-party/curl/.github/workflows/torture.yml b/third-party/curl/.github/workflows/torture.yml
deleted file mode 100644
index cb639a5e38..0000000000
--- a/third-party/curl/.github/workflows/torture.yml
+++ /dev/null
@@ -1,92 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: Linux torture
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-  pull_request:
-    branches:
-    - master
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-
-concurrency:
-  # Hardcoded workflow filename as workflow name above is just Linux again
-  group: torture-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-env:
-  MAKEFLAGS: -j 3
-
-jobs:
-  autotools:
-    name: ${{ matrix.build.name }}
-    runs-on: 'ubuntu-latest'
-    timeout-minutes: 90
-    strategy:
-      fail-fast: false
-      matrix:
-        build:
-        - name: torture
-          install: libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libnghttp2-dev libssh2-1-dev libc-ares-dev
-          configure: --with-openssl --enable-debug --enable-ares --enable-websockets
-          tflags: -n -t --shallow=25 !FTP
-        - name: torture-ftp
-          install: libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libnghttp2-dev libssh2-1-dev libc-ares-dev
-          configure: --with-openssl --enable-debug --enable-ares
-          tflags: -n -t --shallow=20 FTP
-
-    steps:
-    - run: |
-        sudo apt-get update
-        sudo apt-get install libtool autoconf automake pkg-config stunnel4 ${{ matrix.build.install }}
-        sudo python3 -m pip install impacket
-      name: 'install prereqs and impacket'
-
-    - uses: actions/checkout@v3
-
-    - run: autoreconf -fi
-      name: 'autoreconf'
-
-    - run: ./configure --enable-warnings --enable-werror ${{ matrix.build.configure }}
-      name: 'configure'
-
-    - run: make V=1
-      name: 'make'
-
-    - run: make V=1 -C tests
-      name: 'make tests'
-
-    - run: make V=1 test-torture
-      name: 'run tests'
-      env:
-        TFLAGS: "${{ matrix.build.tflags }}"
diff --git a/third-party/curl/.github/workflows/windows.yml b/third-party/curl/.github/workflows/windows.yml
new file mode 100644
index 0000000000..53429d1f2b
--- /dev/null
+++ b/third-party/curl/.github/workflows/windows.yml
@@ -0,0 +1,1197 @@
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+name: 'Windows'
+
+'on':
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  CURL_CI: github
+  CURL_TEST_MIN: 1800
+  CURL_TEST_SSH_KEYALGO: ed25519
+  DO_NOT_TRACK: '1'
+  OPENSSH_WINDOWS_VERSION: 10.0.0.0p2-Preview
+  OPENSSH_WINDOWS_SHA256_ARM64: 698c6aec31c1dd0fb996206e8741f4531a97355686b5431ef347d531b07fcd42
+  OPENSSH_WINDOWS_SHA256_WIN64: 23f50f3458c4c5d0b12217c6a5ddfde0137210a30fa870e98b29827f7b43aba5
+  STUNNEL_VERSION: '5.78'
+  STUNNEL_SHA256: 32a88dcc5654f955266109be8bf10fd7d56fa4e125cab821ee508230570e46c5
+
+jobs:
+  build-cache:
+    name: 'Build caches'
+    runs-on: ${{ matrix.image }}
+    strategy:
+      matrix:
+        image: [windows-11-arm, windows-2022]  # Cannot share cache between arm and intel: https://github.com/actions/cache/issues/1622
+    steps:
+      - name: 'cache test prereqs (stunnel)'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-stunnel
+        with:
+          path: C:\my-stunnel
+          key: ${{ runner.os }}-stunnel-${{ env.STUNNEL_VERSION }}-amd64
+          lookup-only: true
+
+      - name: 'install test prereqs (stunnel)'
+        if: ${{ !steps.cache-stunnel.outputs.cache-hit }}
+        timeout-minutes: 2
+        shell: bash
+        run: |
+          cd /c && mkdir my-stunnel && cd my-stunnel
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 240 --retry 3 --retry-connrefused \
+            "https://www.stunnel.org/archive/5.x/stunnel-${STUNNEL_VERSION}-win64-installer.exe" --output pkg.bin
+          sha256sum pkg.bin && sha256sum pkg.bin | grep -qwF -- "${STUNNEL_SHA256}" && 7z x -y pkg.bin >/dev/null && rm -f pkg.bin && ls -l && bin/tstunnel -version
+
+  cygwin:
+    name: "cygwin, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.platform }} ${{ matrix.name }}"
+    needs: build-cache
+    runs-on: windows-2022
+    timeout-minutes: 10
+    defaults:
+      run:
+        shell: D:\cygwin\bin\bash.exe '{0}'  # zizmor: ignore[misfeature]
+    env:
+      CURL_TEST_MIN: 1850
+      LDFLAGS: -s
+      MAKEFLAGS: -j 5
+      SHELLOPTS: 'igncr'
+      MATRIX_BUILD: '${{ matrix.build }}'
+    strategy:
+      matrix:
+        include:
+          - { name: 'openssl R',
+              build: 'autotools', platform: 'x86_64', tflags: 'skiprun',
+              config: '--with-openssl',
+              install: 'libssl-devel libssh2-devel' }
+          - { name: 'openssl',
+              build: 'cmake', platform: 'x86_64', tflags: '',
+              config: '-DENABLE_DEBUG=ON -DCURL_USE_OPENSSL=ON -DENABLE_THREADED_RESOLVER=OFF -DCURL_ENABLE_NTLM=ON',
+              install: 'libssl-devel libssh2-devel' }
+      fail-fast: false
+    steps:
+      - uses: cygwin/cygwin-install-action@3f0a3f9f988f7e96b8c18098ae05eaec175f5b52 # v6.0.2
+        with:
+          platform: ${{ matrix.platform }}
+          work-vol: 'D:'
+          # https://cygwin.com/mirrors.html
+          # Main mirror status: https://archlinux.org/mirrors/kernel.org/
+          site: https://mirrors.kernel.org/sourceware/cygwin/
+          # https://cygwin.com/cgi-bin2/package-grep.cgi
+          packages: >-
+            ${{ matrix.build == 'autotools' && 'autoconf automake libtool make' || 'cmake ninja' }}
+            gcc-core binutils perl
+            openssh
+            libpsl-devel
+            zlib-devel
+            libbrotli-devel
+            libzstd-devel
+            libnghttp2-devel
+            ${{ matrix.install }}
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'autoreconf'
+        if: ${{ matrix.build == 'autotools' }}
+        timeout-minutes: 2
+        run: |
+          PATH=/usr/bin
+          autoreconf -fi
+
+      - name: 'configure'
+        timeout-minutes: 5
+        env:
+          MATRIX_CONFIG: '${{ matrix.config }}'
+        run: |
+          PATH=/usr/bin
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake -B bld -G Ninja -D_CURL_PREFILL=ON ${options} \
+              -DCMAKE_INSTALL_PREFIX="$HOME"/curl-install \
+              -DCMAKE_UNITY_BUILD=ON -DCMAKE_UNITY_BUILD_BATCH_SIZE=30 \
+              -DCURL_WERROR=ON \
+              ${MATRIX_CONFIG}
+          else
+            mkdir bld && cd bld && ../configure --prefix="$HOME"/curl-install --enable-unity --enable-warnings --enable-werror --disable-static \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              --with-libssh2 \
+              ${MATRIX_CONFIG}
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: |
+          PATH=/usr/bin
+          cat bld/config.log bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
+
+      - name: 'curl_config.h'
+        run: |
+          PATH=/usr/bin
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+
+      - name: 'build'
+        timeout-minutes: 10
+        run: |
+          PATH=/usr/bin
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose
+            cmake --install bld --verbose
+          else
+            make -C bld V=1 install
+          fi
+
+      - name: 'curl -V'
+        timeout-minutes: 1
+        run: |
+          PATH=/usr/bin
+          find . \( -name '*.exe' -o -name '*.dll' -o -name '*.a' \) -print0 | grep -z curl | xargs -0 file --
+          find . \( -name '*.exe' -o -name '*.dll' -o -name '*.a' \) -print0 | grep -z curl | xargs -0 stat -c '%10s bytes: %n' --
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            PATH="$PWD/bld/lib:$PATH"
+          fi
+          bld/src/curl.exe --disable --version
+
+      - name: 'build tests'
+        if: ${{ matrix.tflags != 'skipall' }}
+        timeout-minutes: 15
+        run: |
+          PATH=/usr/bin
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target testdeps
+          else
+            make -C bld V=1 -C tests
+          fi
+
+      - name: 'cache test prereqs (stunnel)'
+        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-stunnel
+        with:
+          path: C:\my-stunnel
+          key: ${{ runner.os }}-stunnel-${{ env.STUNNEL_VERSION }}-amd64
+          fail-on-cache-miss: true
+
+      - name: 'run tests'
+        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
+        timeout-minutes: 15
+        env:
+          TFLAGS: '${{ matrix.tflags }}'
+        run: |
+          PATH=/usr/bin:/cygdrive/c/my-stunnel/bin
+          TFLAGS="-j8 ${TFLAGS}"
+          if [ -x "$(cygpath "${SYSTEMROOT}/System32/curl.exe")" ]; then
+            TFLAGS+=" -ac $(cygpath "${SYSTEMROOT}/System32/curl.exe")"
+          fi
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            PATH="$PWD/bld/lib:$PATH"
+            cmake --build bld --verbose --target test-ci
+          else
+            make -C bld V=1 test-ci
+          fi
+
+      - name: 'build examples'
+        if: ${{ matrix.build == 'cmake' }}
+        timeout-minutes: 5
+        run: |
+          PATH=/usr/bin
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target curl-examples-build
+          else
+            make -C bld V=1 examples
+          fi
+
+      - name: 'disk space used'
+        run: du -sh .; echo; du -sh -t 250KB ./*; echo; du -h -t 250KB bld
+
+  msys2:  # both msys and mingw-w64
+    name: "${{ matrix.sys == 'msys' && 'msys2' || 'mingw' }}, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.env }} ${{ matrix.name }} ${{ matrix.test }}"
+    needs: build-cache
+    runs-on: ${{ matrix.image || 'windows-2022' }}
+    timeout-minutes: ${{ contains(matrix.tflags, '-t') && 14 || 10 }}
+    defaults:
+      run:
+        shell: msys2 {0}  # zizmor: ignore[misfeature]
+    env:
+      LDFLAGS: -s
+      MAKEFLAGS: -j 5
+      MATRIX_BUILD: '${{ matrix.build }}'
+      MATRIX_OPENSSH: '${{ matrix.openssh }}'
+      MATRIX_SYS: '${{ matrix.sys }}'
+      MATRIX_TEST: '${{ matrix.test }}'
+    strategy:
+      matrix:
+        include:
+          # MSYS
+          - { name: '!proxy',
+              build: 'autotools', sys: 'msys'      , env: 'x86_64'       , tflags: '--min=1620',
+              config: '--enable-debug --with-openssl --disable-threaded-resolver --disable-proxy --enable-ntlm',
+              install: 'openssl-devel libssh2-devel' }
+          - { name: 'default',
+              build: 'autotools', sys: 'msys'      , env: 'x86_64'       , tflags: 'skiprun'   ,
+              config: '--enable-debug --with-openssl --disable-threaded-resolver --enable-ntlm',
+              install: 'openssl-devel libssh2-devel' }
+          - { name: 'default',
+              build: 'cmake'    , sys: 'msys'      , env: 'x86_64'       , tflags: ''          ,
+              config: '-DENABLE_DEBUG=ON -DENABLE_THREADED_RESOLVER=OFF -DCURL_ENABLE_NTLM=ON',
+              install: 'openssl-devel libssh2-devel' }
+          - { name: 'default R',
+              build: 'autotools', sys: 'msys'      , env: 'x86_64'       , tflags: ''          ,
+              config: '--with-openssl --enable-ntlm', install: 'openssl-devel libssh2-devel' }
+          # MinGW
+          - { name: 'default',
+              build: 'autotools', sys: 'mingw64'   , env: 'x86_64'       , tflags: 'skiprun'   ,
+              config: '--enable-debug --with-openssl --disable-threaded-resolver --enable-static --without-zlib',
+              install: 'mingw-w64-x86_64-openssl mingw-w64-x86_64-libssh2' }
+          - { name: 'c-ares U',
+              build: 'autotools', sys: 'ucrt64'    , env: 'ucrt-x86_64'  , tflags: ''          ,
+              config: '--enable-debug --with-openssl --enable-windows-unicode --enable-ares --enable-static --disable-shared --enable-ca-native --enable-ntlm',
+              install: 'mingw-w64-ucrt-x86_64-c-ares mingw-w64-ucrt-x86_64-openssl mingw-w64-ucrt-x86_64-nghttp3 mingw-w64-ucrt-x86_64-libssh2' }
+          - { name: 'schannel c-ares U', type: 'Debug',
+              build: 'cmake'    , sys: 'mingw64'   , env: 'x86_64'       , tflags: '--min=1720',
+              config: '-DENABLE_DEBUG=ON  -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON -DENABLE_ARES=ON -DCURL_DROP_UNUSED=ON',
+              install: 'mingw-w64-x86_64-c-ares mingw-w64-x86_64-libssh2' }
+          # MinGW torture
+          - { name: 'schannel U torture 1', type: 'Debug',
+              build: 'cmake'    , sys: 'ucrt64'    , env: 'ucrt-x86_64'  , tflags: '-t --shallow=13 --min=820 1 to 950',
+              config: '-DENABLE_DEBUG=ON  -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON -DENABLE_ARES=ON',
+              install: 'mingw-w64-ucrt-x86_64-c-ares mingw-w64-ucrt-x86_64-libssh2' }
+          - { name: 'schannel U torture 2', type: 'Debug',
+              build: 'cmake'    , sys: 'ucrt64'    , env: 'ucrt-x86_64'  , tflags: '-t --shallow=13 --min=820 951 to 9999',
+              config: '-DENABLE_DEBUG=ON  -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON -DENABLE_ARES=ON',
+              install: 'mingw-w64-ucrt-x86_64-c-ares mingw-w64-ucrt-x86_64-libssh2' }
+          # WARNING: libssh uses hard-coded world-writable paths (C:ProgramData/, /etc/..., ~/.ssh/)
+          #          to read its configuration from, making it vulnerable to attacks on
+          #          Windows. Do not use this component till there is a fix for these.
+          #          Holds true after CVE-2025-14821 mitigations in 0.12.0.
+          # https://github.com/curl/curl-for-win/blob/471a065705a16c61a343b15d3e4ef195e2df2f9e/libssh.sh#L6-L94
+          - { name: 'gnutls libssh', type: 'Debug', openssh: 'OpenSSH-Windows',
+              build: 'cmake'    , sys: 'clang64'   , env: 'clang-x86_64' , tflags: ''          ,
+              config: '-DENABLE_DEBUG=ON  -DBUILD_SHARED_LIBS=OFF -DCURL_USE_GNUTLS=ON -DENABLE_UNICODE=OFF -DUSE_NGTCP2=ON -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=ON -DCURL_ENABLE_NTLM=ON',
+              install: 'mingw-w64-clang-x86_64-gnutls mingw-w64-clang-x86_64-nghttp3 mingw-w64-clang-x86_64-ngtcp2 mingw-w64-clang-x86_64-libssh unzip' }
+          - { name: 'schannel R', type: 'Release', image: 'windows-11-arm',
+              build: 'cmake'    , sys: 'clangarm64', env: 'clang-aarch64', tflags: 'skiprun'   ,
+              config: '-DENABLE_DEBUG=OFF -DBUILD_SHARED_LIBS=ON  -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON -DCURL_DROP_UNUSED=ON',
+              install: 'mingw-w64-clang-aarch64-libssh2' }
+          - { name: 'openssl', type: 'Release', chkprefill: '_chkprefill',
+              build: 'cmake'    , sys: 'clang64'   , env: 'clang-x86_64' , tflags: 'skiprun'   ,
+              config: '-DENABLE_DEBUG=ON  -DBUILD_SHARED_LIBS=OFF -DCURL_USE_OPENSSL=ON  -DENABLE_UNICODE=OFF -DUSE_NGTCP2=ON -DUSE_PROXY_HTTP3=ON',
+              install: 'mingw-w64-clang-x86_64-openssl mingw-w64-clang-x86_64-nghttp3 mingw-w64-clang-x86_64-ngtcp2 mingw-w64-clang-x86_64-libssh2' }
+          - { name: 'schannel', type: 'Release', test: 'uwp',
+              build: 'cmake'    , sys: 'ucrt64'    , env: 'ucrt-x86_64'  , tflags: 'skiprun'   ,
+              config: '-DENABLE_DEBUG=OFF -DBUILD_SHARED_LIBS=ON  -DCURL_USE_OPENSSL=ON',
+              install: 'mingw-w64-ucrt-x86_64-openssl mingw-w64-ucrt-x86_64-libssh2' }
+          # { name: 'schannel', type: 'Release', test: 'uwp',
+          #   build: 'autotools', sys: 'ucrt64'    , env: 'ucrt-x86_64'  , tflags: 'skiprun'   ,
+          #   config: '--without-debug --with-schannel --disable-static',
+          #   install: 'mingw-w64-ucrt-x86_64-libssh2' }
+          - { name: 'schannel dev debug', type: 'Debug', cppflags: '-DCURL_SCHANNEL_DEV_DEBUG', image: 'windows-2025',
+              build: 'cmake'    , sys: 'mingw64'   , env: 'x86_64'       , tflags: 'skiprun'   ,
+              config: '-DENABLE_DEBUG=ON  -DBUILD_SHARED_LIBS=ON  -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON -DCMAKE_VERBOSE_MAKEFILE=ON',
+              install: 'mingw-w64-x86_64-libssh2' }
+          - { name: 'MultiSSL R', type: 'Release',
+              build: 'cmake'    , sys: 'mingw32'   , env: 'i686'         , tflags: 'skiprun'   ,
+              config: '-DENABLE_DEBUG=OFF -DBUILD_SHARED_LIBS=ON -DCURL_USE_GNUTLS=ON -DCURL_USE_OPENSSL=ON -DCURL_USE_SCHANNEL=ON -DENABLE_ARES=ON -DENABLE_UNICODE=ON',
+              install: 'mingw-w64-i686-c-ares mingw-w64-i686-gnutls mingw-w64-i686-libssh2 mingw-w64-i686-openssl' }
+      fail-fast: false
+    steps:
+      - uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1
+        if: ${{ matrix.sys == 'msys' }}
+        with:
+          msystem: ${{ matrix.sys }}
+          # https://packages.msys2.org/search
+          install: >-
+            gcc
+            ${{ matrix.build }} ${{ matrix.build == 'autotools' && 'make' || 'ninja' }}
+            diffutils
+            zlib-devel
+            brotli-devel
+            libzstd-devel
+            libnghttp2-devel
+            libpsl-devel
+            ${{ matrix.install }}
+
+      - uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1
+        if: ${{ matrix.sys != 'msys' }}
+        with:
+          msystem: ${{ matrix.sys }}
+          install: >-
+            mingw-w64-${{ matrix.env }}-cc
+            mingw-w64-${{ matrix.env }}-${{ matrix.build }} ${{ matrix.build == 'autotools' && 'make' || '' }}
+            mingw-w64-${{ matrix.env }}-diffutils
+            mingw-w64-${{ matrix.env }}-libpsl
+            ${{ matrix.install }}
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'autoreconf'
+        if: ${{ matrix.build == 'autotools' }}
+        timeout-minutes: 2
+        run: autoreconf -fi
+
+      - name: 'configure'
+        timeout-minutes: 5
+        env:
+          CPPFLAGS: '${{ matrix.cppflags }}'
+          MATRIX_CHKPREFILL: '${{ matrix.chkprefill }}'
+          MATRIX_CONFIG: '${{ matrix.config }}'
+          MATRIX_ENV: '${{ matrix.env }}'
+          MATRIX_TYPE: '${{ matrix.type }}'
+          TFLAGS: '${{ matrix.tflags }}'
+        run: |
+          if [ "${MATRIX_TEST}" = 'uwp' ]; then
+            CPPFLAGS+=' -DWINSTORECOMPAT -DWINAPI_FAMILY=WINAPI_FAMILY_APP -D_WIN32_WINNT=0x0a00'
+            if [[ "${MATRIX_ENV}" != 'clang'* ]]; then
+              specs="$(realpath gcc-specs-uwp)"
+              gcc -dumpspecs | sed -e 's/-lmingwex/-lwindowsapp -lmingwex -lwindowsapp/' -e 's/-lmsvcrt/-lucrtapp/' > "${specs}"
+              CFLAGS="-specs=${specs}"
+              CFLAGS_CMAKE="-specs=$(cygpath -w "${specs}")"
+            fi
+          fi
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            for _chkprefill in '' ${MATRIX_CHKPREFILL}; do
+              if [[ "${MATRIX_ENV}" = 'clang'* ]]; then
+                options='-DCMAKE_C_COMPILER=clang'
+              else
+                options='-DCMAKE_C_COMPILER=gcc'
+              fi
+              [ "${MATRIX_SYS}" = 'msys' ] && options+=' -D_CURL_PREFILL=ON'
+              [ "${MATRIX_TEST}" = 'uwp' ] && options+=' -DCMAKE_SYSTEM_NAME=WindowsStore'
+              [ "${TFLAGS}" = 'skiprun' ] && options+=' -D_CURL_SKIP_BUILD_CERTS=ON'
+              [ "${_chkprefill}" = '_chkprefill' ] && options+=' -D_CURL_PREFILL=OFF'
+              cmake -B "bld${_chkprefill}" -G Ninja ${options} \
+                -DCMAKE_INSTALL_PREFIX="${HOME}"/curl-install \
+                -DCMAKE_C_FLAGS="${CFLAGS_CMAKE} ${CPPFLAGS}" \
+                -DCMAKE_BUILD_TYPE="${MATRIX_TYPE}" \
+                -DCMAKE_UNITY_BUILD=ON -DCMAKE_UNITY_BUILD_BATCH_SIZE=30 \
+                -DCURL_WERROR=ON \
+                ${MATRIX_CONFIG}
+            done
+            if [ -d bld_chkprefill ] && ! diff -u bld/lib/curl_config.h bld_chkprefill/lib/curl_config.h; then
+              echo '::group::reference configure log'; cat bld_chkprefill/CMakeFiles/CMake*.yaml 2>/dev/null || true; echo '::endgroup::'
+              false
+            fi
+          else
+            export CFLAGS
+            mkdir bld && cd bld && ../configure --prefix="$HOME"/curl-install --enable-unity --enable-warnings --enable-werror --disable-static \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              --with-libssh2 \
+              ${MATRIX_CONFIG}
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/config.log bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+          cat bld/cmake_install.cmake || true
+
+      - name: 'build'
+        timeout-minutes: 10
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose
+            cmake --install bld --verbose
+          else
+            make -C bld V=1 install
+          fi
+
+      - name: 'curl -V'
+        timeout-minutes: 1
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            PATH="$PWD/bld/lib:$PATH"
+          else
+            PATH="$PWD/bld/lib/.libs:$PATH"
+            # avoid libtool's curl.exe wrapper for shared builds
+            mv bld/src/.libs/curl.exe bld/src/curl.exe || true
+          fi
+          find . \( -name '*.exe' -o -name '*.dll' -o -name '*.a' \) -print0 | grep -z curl | xargs -0 file --
+          find . \( -name '*.exe' -o -name '*.dll' -o -name '*.a' \) -print0 | grep -z curl | xargs -0 stat -c '%10s bytes: %n' --
+          if [ "${MATRIX_TEST}" != 'uwp' ]; then  # curl: error initializing curl library
+            bld/src/curl.exe --disable --version
+          fi
+
+      - name: 'build tests'
+        if: ${{ matrix.tflags != 'skipall' }}  # Save time by skipping this for autotools
+        timeout-minutes: 10
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target testdeps
+          else
+            make -C bld V=1 -C tests
+          fi
+          if [ "${MATRIX_BUILD}" != 'cmake' ]; then
+            # avoid libtool's .exe wrappers for shared builds
+            mv bld/tests/libtest/.libs/*.exe bld/tests/libtest || true
+            mv bld/tests/server/.libs/*.exe bld/tests/server || true
+            mv bld/tests/tunit/.libs/*.exe bld/tests/tunit || true
+            mv bld/tests/unit/.libs/*.exe bld/tests/unit || true
+          fi
+
+      - name: 'cache test prereqs (stunnel)'
+        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-stunnel
+        with:
+          path: C:\my-stunnel
+          key: ${{ runner.os }}-stunnel-${{ env.STUNNEL_VERSION }}-amd64
+          fail-on-cache-miss: true
+
+      - name: 'install test prereqs'
+        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
+        timeout-minutes: 2
+        run: |
+          if [ -z "${MATRIX_OPENSSH}" ]; then  # MSYS2 openssh
+            /usr/bin/pacman --noconfirm --noprogressbar --sync --needed openssh
+          elif [ "${MATRIX_OPENSSH}" = 'OpenSSH-Windows-builtin' ]; then
+            # https://learn.microsoft.com/windows-server/administration/openssh/openssh_install_firstuse
+            if [[ "${MATRIX_IMAGE}" = *'windows-2025'* ]]; then
+              pwsh -Command 'Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0'
+              pwsh -Command 'Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0'
+            fi
+          else  # OpenSSH-Windows
+            cd /c  # no D: drive on windows-11-arm runners
+            if [[ "${MATRIX_IMAGE}" = *'-arm'* ]]; then
+              curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+                --location --proto-redir =https "https://github.com/PowerShell/Win32-OpenSSH/releases/download/${OPENSSH_WINDOWS_VERSION}/OpenSSH-ARM64.zip" --output pkg.bin
+              sha256sum pkg.bin && sha256sum pkg.bin | grep -qwF -- "${OPENSSH_WINDOWS_SHA256_ARM64}" && unzip pkg.bin && rm -f pkg.bin
+            else
+              curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+                --location --proto-redir =https "https://github.com/PowerShell/Win32-OpenSSH/releases/download/${OPENSSH_WINDOWS_VERSION}/OpenSSH-Win64.zip" --output pkg.bin
+              sha256sum pkg.bin && sha256sum pkg.bin | grep -qwF -- "${OPENSSH_WINDOWS_SHA256_WIN64}" && unzip pkg.bin && rm -f pkg.bin
+            fi
+          fi
+
+      - name: 'run tests'
+        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
+        timeout-minutes: ${{ contains(matrix.tflags, '-t') && 15 || 10 }}
+        env:
+          MATRIX_ENV: '${{ matrix.env }}'
+          MATRIX_INSTALL: '${{ matrix.install }}'
+          TFLAGS: '${{ matrix.tflags }}'
+        run: |
+          TFLAGS="-j8 ${TFLAGS}"
+          if [ "${MATRIX_SYS}" != 'msys' ]; then
+            TFLAGS+=' !498'  # 'Reject too large HTTP response headers on endless redirects' HTTP, HTTP GET (runtests detecting result code 2009 instead of 56 returned by curl)
+            TFLAGS+=' ~3000 ~3001 ~3023 ~3024'  # 'HTTPS localhost, first/last subject alt name matches, CN does not match' HTTPS, HTTP GET, PEM certificate (returning 56)
+            if [[ "${MATRIX_INSTALL}" = *'libssh2-wincng'* ]]; then
+              TFLAGS+=' ~SCP ~SFTP'  # Flaky: `-8, Unable to exchange encryption keys`. https://github.com/libssh2/libssh2/issues/804
+              unset CURL_TEST_SSH_KEYALGO  # libssh2 built with WinCNG does not support ssh-ed25519 hostkeys
+              export CURL_TEST_SSH_ENABLE_KEX=diffie-hellman-group-exchange-sha256
+            fi
+            if [[ "${TFLAGS}" = *'-t'* ]]; then
+              TFLAGS+=' !2300'  # Leaks memory and file handle via tool_doswin.c / win32_stdin_read_thread()
+              export CURL_TEST_NO_TASKKILL=1  # experiment to see if it reduces flaky failures
+            fi
+            if [[ "${MATRIX_INSTALL} " = *'-libssh '* && \
+                  "${MATRIX_ENV}" = *'x86_64'* ]]; then
+              export CURL_TEST_SSH_DISABLE_KEX=mlkem768x25519-sha256  # broken with libssh 0.12.0 Windows x64
+            fi
+          fi
+          if [ -n "${MATRIX_OPENSSH}" ]; then  # OpenSSH-Windows
+            TFLAGS+=' ~601 ~603 ~617 ~619 ~621 ~641 ~665 ~2004 ~3022'  # SCP
+            if [[ "${MATRIX_INSTALL} " = *'libssh '* ]]; then
+              TFLAGS+=' ~614'  # 'SFTP pre-quote chmod' SFTP, pre-quote, directory
+            fi
+          fi
+          if [ "${MATRIX_OPENSSH}" = 'OpenSSH-Windows' ]; then
+            if [[ "${MATRIX_IMAGE}" = *'-arm'* ]]; then
+              PATH="/c/OpenSSH-ARM64:$PATH"
+            else
+              PATH="/c/OpenSSH-Win64:$PATH"
+            fi
+          fi
+          if [ -x "$(cygpath "${SYSTEMROOT}/System32/curl.exe")" ]; then
+            TFLAGS+=" -ac $(cygpath "${SYSTEMROOT}/System32/curl.exe")"
+          fi
+          PATH="$PATH:/c/my-stunnel/bin"
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            PATH="$PWD/bld/lib:$PATH"
+            cmake --build bld --verbose --target test-ci
+          else
+            PATH="$PWD/bld/lib/.libs:$PATH"
+            make -C bld V=1 test-ci
+          fi
+
+      - name: 'build examples'
+        if: ${{ matrix.build == 'cmake' || (matrix.tflags == 'skipall' || matrix.tflags == 'skiprun') }}  # Save time by skipping this for autotools running tests
+        timeout-minutes: 5
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target curl-examples-build
+          else
+            make -C bld V=1 examples
+          fi
+
+      - name: 'disk space used'
+        run: du -sh .; echo; du -sh -t 250KB ./*; echo; du -h -t 250KB bld
+
+  mingw-w64-standalone-downloads:
+    name: 'dl-mingw, CM ${{ matrix.ver }}-${{ matrix.env }} ${{ matrix.name }}'
+    needs: build-cache
+    runs-on: windows-2022
+    timeout-minutes: 10
+    defaults:
+      run:
+        shell: msys2 {0}  # zizmor: ignore[misfeature]
+    env:
+      CURL_TEST_MIN: 1630
+      LDFLAGS: -s
+      MAKEFLAGS: -j 5
+      MATRIX_DIR: '${{ matrix.dir }}'
+    strategy:
+      matrix:
+        include:
+          - name: 'schannel +analyzer'  # mingw-w64 14.0
+            sys: 'mingw64'
+            dir: 'w64devkit'
+            env: 'x86_64'
+            ver: '16.1.0'
+            url: 'https://github.com/skeeto/w64devkit/releases/download/v2.8.0/w64devkit-x64-2.8.0.7z.exe'
+            SHA256: 6252bf34fe2231a55ac7f03d482b36d2c7c58697990551bba508102cfb3f342e
+            config: '-DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=OFF -DENABLE_UNIX_SOCKETS=OFF -DCURL_GCC_ANALYZER=ON'
+            type: 'Release'
+          - name: 'schannel'  # mingw-w64 10.0
+            sys: 'mingw64'
+            dir: 'mingw64'
+            env: 'x86_64'
+            ver: '9.5.0'
+            url: 'https://github.com/brechtsanders/winlibs_mingw/releases/download/9.5.0-10.0.0-msvcrt-r1/winlibs-x86_64-posix-seh-gcc-9.5.0-mingw-w64msvcrt-10.0.0-r1.7z'
+            SHA256: 41637132ea7dc36a7f86a1961eaa334c380b5a3423d36aecb481cabcd006e3fe
+            config: '-DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=OFF -DCURL_DISABLE_VERBOSE_STRINGS=ON'
+            type: 'Release'
+            tflags: 'skiprun'
+          - name: 'schannel mbedtls U'  # mingw-w64 6.0
+            sys: 'mingw64'
+            dir: 'mingw64'
+            env: 'x86_64'
+            ver: '7.3.0'
+            url: 'https://downloads.sourceforge.net/mingw-w64/Toolchains%20targetting%20Win64/Personal%20Builds/mingw-builds/7.3.0/threads-win32/seh/x86_64-7.3.0-release-win32-seh-rt_v5-rev0.7z'
+            SHA256: 9dc08c9c2bdd5d8173f87791bed644f6e290624f739de474f117b590dfd8a721
+            config: '-DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON -DCURL_USE_MBEDTLS=ON -DCURL_TARGET_WINDOWS_VERSION=0x0600'
+            install: mingw-w64-x86_64-mbedtls
+            type: 'Release'
+            tflags: 'skiprun'
+          - name: 'schannel !unity'  # mingw-w64 5.0
+            sys: 'mingw32'
+            dir: 'mingw32'
+            env: 'i686'
+            ver: '6.4.0'
+            url: 'https://downloads.sourceforge.net/mingw-w64/Toolchains%20targetting%20Win32/Personal%20Builds/mingw-builds/6.4.0/threads-win32/dwarf/i686-6.4.0-release-win32-dwarf-rt_v5-rev0.7z'
+            SHA256: 12d2c62ad4527ec8a52275ea8485678dcbe20bec4716a3c7ba274f225d696085
+            config: '-DENABLE_DEBUG=ON -DCURL_USE_SCHANNEL=ON -DCURL_USE_LIBSSH=ON -DENABLE_UNICODE=OFF -DCMAKE_UNITY_BUILD=OFF -DCURL_TARGET_WINDOWS_VERSION=0x0600'
+            install: mingw-w64-i686-libssh
+            type: 'Debug'
+            tflags: 'skiprun'
+          - name: 'schannel !examples'  # mingw-w64 3.0
+            sys: 'mingw64'
+            dir: 'mingw64'
+            env: 'x86_64'
+            ver: '4.8.1'
+            url: 'https://downloads.sourceforge.net/mingw-w64/Toolchains%20targetting%20Win64/Personal%20Builds/mingw-builds/4.8.1/threads-win32/seh/x86_64-4.8.1-release-win32-seh-rt_v3-rev2.7z'
+            SHA256: 1353d997e85bb4494ebbebb432d824848d66b32c6045900da9a38a767b3c4ab4
+            config: '-DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=ON -DCURL_TARGET_WINDOWS_VERSION=0x0600'
+            type: 'Debug'
+            tflags: 'skipall'
+            chkprefill: ''  # Set it once to silence actionlint
+      fail-fast: false
+    steps:
+      - uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1
+        with:
+          msystem: ${{ matrix.sys }}
+          release: false
+          update: false
+          cache: false
+          path-type: inherit
+          install: >-
+            mingw-w64-${{ matrix.env }}-libpsl
+            ${{ matrix.install }}
+
+      - name: 'cache compiler (gcc ${{ matrix.ver }}-${{ matrix.env }})'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-compiler
+        with:
+          path: D:\my-cache
+          key: ${{ runner.os }}-mingw-w64-${{ matrix.ver }}-${{ matrix.env }}
+
+      - name: 'install compiler (gcc ${{ matrix.ver }}-${{ matrix.env }})'
+        if: ${{ !steps.cache-compiler.outputs.cache-hit }}
+        timeout-minutes: 5
+        env:
+          MATRIX_URL: '${{ matrix.url }}'
+          MATRIX_SHA256: '${{ matrix.SHA256 }}'
+        run: |
+          cd /d
+          mkdir my-cache
+          cd my-cache
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 240 --retry 3 --retry-connrefused \
+            --location --proto-redir =https "${MATRIX_URL}" --output pkg.bin
+          pwd
+          sha256sum pkg.bin && sha256sum pkg.bin | grep -qwF -- "${MATRIX_SHA256}" && 7z x -y pkg.bin >/dev/null && rm -f pkg.bin && ls -l
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'configure'
+        timeout-minutes: 5
+        env:
+          MATRIX_CHKPREFILL: '${{ matrix.chkprefill }}'
+          MATRIX_CONFIG: '${{ matrix.config }}'
+          MATRIX_TYPE: '${{ matrix.type }}'
+          TFLAGS: '${{ matrix.tflags }}'
+        run: |
+          PATH="/d/my-cache/${MATRIX_DIR}/bin:$PATH"
+          for _chkprefill in '' ${MATRIX_CHKPREFILL}; do
+            options=''
+            [ "${TFLAGS}" = 'skiprun' ] && options+=' -D_CURL_SKIP_BUILD_CERTS=ON'
+            [ "${_chkprefill}" = '_chkprefill' ] && options+=' -D_CURL_PREFILL=OFF'
+            cmake -B "bld${_chkprefill}" -G Ninja ${options} \
+              -DCMAKE_C_COMPILER=gcc \
+              -DCMAKE_BUILD_TYPE="${MATRIX_TYPE}" \
+              -DCMAKE_UNITY_BUILD=ON -DCMAKE_UNITY_BUILD_BATCH_SIZE=30 \
+              -DCURL_DROP_UNUSED=ON \
+              -DCURL_WERROR=ON \
+              -DUSE_LIBIDN2=OFF \
+              ${MATRIX_CONFIG}
+          done
+          if [ -d bld_chkprefill ] && ! diff -u bld/lib/curl_config.h bld_chkprefill/lib/curl_config.h; then
+            echo '::group::reference configure log'; cat bld_chkprefill/CMakeFiles/CMake*.yaml 2>/dev/null || true; echo '::endgroup::'
+            false
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+
+      - name: 'build'
+        timeout-minutes: 5
+        run: |
+          PATH="/d/my-cache/${MATRIX_DIR}/bin:$PATH"
+          cmake --build bld
+
+      - name: 'curl -V'
+        timeout-minutes: 1
+        run: |
+          /usr/bin/find . \( -name '*.exe' -o -name '*.dll' -o -name '*.a' \) -print0 | grep -z curl | xargs -0 file --
+          /usr/bin/find . \( -name '*.exe' -o -name '*.dll' -o -name '*.a' \) -print0 | grep -z curl | xargs -0 stat -c '%10s bytes: %n' --
+          PATH="$PWD/bld/lib:$PATH"
+          bld/src/curl.exe --disable --version
+
+      - name: 'build tests'
+        if: ${{ matrix.tflags != 'skipall' }}
+        timeout-minutes: 10
+        run: |
+          PATH="/d/my-cache/${MATRIX_DIR}/bin:$PATH"
+          cmake --build bld --target testdeps
+
+      - name: 'cache test prereqs (stunnel)'
+        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-stunnel
+        with:
+          path: C:\my-stunnel
+          key: ${{ runner.os }}-stunnel-${{ env.STUNNEL_VERSION }}-amd64
+          fail-on-cache-miss: true
+
+      - name: 'install test prereqs'
+        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
+        timeout-minutes: 2
+        run: |
+          if bld/src/curl.exe --disable -V 2>/dev/null | grep smb; then
+            python3 -m pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/requirements.txt
+          fi
+
+      - name: 'run tests'
+        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
+        timeout-minutes: 10
+        env:
+          TFLAGS: '${{ matrix.tflags }}'
+        run: |
+          PATH="/d/my-cache/${MATRIX_DIR}/bin:$PATH"
+          TFLAGS="-j8 ${TFLAGS}"
+          TFLAGS+=' !498'  # 'Reject too large HTTP response headers on endless redirects' HTTP, HTTP GET (runtests detecting result code 2009 instead of 56 returned by curl)
+          TFLAGS+=' ~3000 ~3001 ~3023 ~3024'  # 'HTTPS localhost, last subject alt name matches, CN does not match' HTTPS, HTTP GET, PEM certificate (returning 56)
+          if [ -x "$(cygpath "${SYSTEMROOT}/System32/curl.exe")" ]; then
+            TFLAGS+=" -ac $(cygpath "${SYSTEMROOT}/System32/curl.exe")"
+          fi
+          PATH="$PWD/bld/lib:$PATH:/c/my-stunnel/bin"
+          cmake --build bld --target test-ci
+
+      - name: 'build examples'
+        if: ${{ !contains(matrix.name, '!examples') }}
+        timeout-minutes: 5
+        run: |
+          PATH="/d/my-cache/${MATRIX_DIR}/bin:$PATH"
+          cmake --build bld --target curl-examples-build
+
+      - name: 'disk space used'
+        run: du -sh .; echo; du -sh -t 250KB ./*; echo; du -h -t 250KB bld
+
+  linux-cross-mingw-w64:
+    name: "linux-mingw, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.compiler }}"
+    runs-on: ubuntu-26.04
+    timeout-minutes: 10
+    env:
+      LDFLAGS: -s
+      MAKEFLAGS: -j 5
+      TRIPLET: 'x86_64-w64-mingw32'
+      MATRIX_BUILD: '${{ matrix.build }}'
+      MATRIX_COMPILER: '${{ matrix.compiler }}'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { build: 'autotools', compiler: 'gcc' }
+          - { build: 'cmake'    , compiler: 'gcc' }
+          - { build: 'cmake'    , compiler: 'clang-tidy', install_packages: 'clang-22 clang-tidy-22', CFLAGS: '-Wunused-macros' }
+    steps:
+      - name: 'install packages'
+        timeout-minutes: 2
+        env:
+          MATRIX_INSTALL_PACKAGES: '${{ matrix.install_packages }}'
+        run: |
+          ls -l /etc/apt/sources.list.d
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo apt-get -o Dpkg::Use-Pty=0 update
+          sudo apt-get -o Dpkg::Use-Pty=0 install gcc-mingw-w64-x86-64-win32 ${MATRIX_INSTALL_PACKAGES}
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'autoreconf'
+        if: ${{ matrix.build == 'autotools' }}
+        run: autoreconf -fi
+
+      - name: 'configure'
+        env:
+          CFLAGS: '${{ matrix.CFLAGS }}'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            if [ "${MATRIX_COMPILER}" = 'clang-tidy' ]; then
+              options+=' -DCURL_CLANG_TIDY=ON -DCLANG_TIDY=/usr/bin/clang-tidy-22'
+              options+=' -DENABLE_UNICODE=ON -DUSE_SSLS_EXPORT=ON'
+              options+=' -DCMAKE_C_COMPILER=clang-22'
+              options+=" -DCMAKE_RC_COMPILER=llvm-windres-$(clang-22 -dumpversion | cut -d '.' -f 1)"
+            else
+              options+=" -DCMAKE_C_COMPILER=${TRIPLET}-gcc"
+            fi
+            cmake -B bld -G Ninja \
+              -DCMAKE_SYSTEM_NAME=Windows \
+              -DCMAKE_C_COMPILER_TARGET="${TRIPLET}" \
+              -DCMAKE_UNITY_BUILD=ON -D_CURL_TESTS_CONCAT=ON \
+              -DCURL_WERROR=ON \
+              -DCURL_USE_SCHANNEL=ON -DUSE_WIN32_IDN=ON \
+              -DCURL_USE_LIBPSL=OFF \
+              -DCURL_ENABLE_NTLM=ON \
+              -D_CURL_SKIP_BUILD_CERTS=ON \
+              ${options}
+          else
+            mkdir bld && cd bld && ../configure --enable-unity --enable-warnings --enable-werror --disable-static \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              --host="${TRIPLET}" \
+              --with-schannel --with-winidn \
+              --without-libpsl
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/config.log bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+
+      - name: 'build'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld
+          else
+            make -C bld
+          fi
+
+      - name: 'curl info'
+        run: |
+          find . \( -name '*.exe' -o -name '*.dll' -o -name '*.a' \) -print0 | grep -z curl | xargs -0 file --
+          find . \( -name '*.exe' -o -name '*.dll' -o -name '*.a' \) -print0 | grep -z curl | xargs -0 stat -c '%10s bytes: %n' --
+
+      - name: 'build tests'
+        if: ${{ matrix.build == 'cmake' }}  # Save time by skipping this for autotools and clang-tidy
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --target testdeps
+          else
+            make -C bld -C tests
+          fi
+
+      - name: 'build examples'
+        if: ${{ matrix.compiler != 'clang-tidy' }}  # Save time by skipping this for clang-tidy
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --target curl-examples-build
+          else
+            make -C bld examples
+          fi
+
+      - name: 'disk space used'
+        run: du -sh .; echo; du -sh -t 250KB ./*; echo; du -h -t 250KB bld
+
+  msvc:
+    name: 'msvc, CM ${{ matrix.arch }}-${{ matrix.plat }} ${{ matrix.name }}'
+    needs: build-cache
+    runs-on: ${{ matrix.image || 'windows-2022' }}
+    timeout-minutes: ${{ matrix.arch == 'arm64' && 12 || 10 }}
+    defaults:
+      run:
+        shell: msys2 {0}  # zizmor: ignore[misfeature]
+    env:
+      MATRIX_ARCH: '${{ matrix.arch }}'
+      MATRIX_IMAGE: '${{ matrix.image }}'
+      MATRIX_INSTALL_MSYS2: '${{ matrix.install-msys2 }}'
+      MATRIX_INSTALL_VCPKG: '${{ matrix.install-vcpkg }}'
+      MATRIX_OPENSSH: '${{ matrix.openssh }}'
+      MATRIX_PLAT: '${{ matrix.plat }}'
+      MATRIX_TYPE: '${{ matrix.type }}'
+      VCPKG_DISABLE_METRICS: '1'
+    strategy:
+      matrix:
+        include:
+          - name: '!ssl +examples'
+            install-vcpkg: 'zlib libssh2[core,zlib]'
+            arch: 'x64'
+            env: 'ucrt-x86_64'
+            plat: 'uwp'
+            type: 'Debug'
+            image: 'windows-2025'
+            tflags: 'skiprun'
+            config: >-
+              -DENABLE_DEBUG=ON
+              -DCURL_ENABLE_SSL=OFF
+              -DUSE_WIN32_IDN=ON
+
+          - name: 'openssl +examples'
+            install-msys2: >-
+              mingw-w64-ucrt-x86_64-brotli
+              mingw-w64-ucrt-x86_64-zlib
+              mingw-w64-ucrt-x86_64-zstd
+              mingw-w64-ucrt-x86_64-openssl
+              mingw-w64-ucrt-x86_64-libssh2
+              mingw-w64-ucrt-x86_64-nghttp2
+              mingw-w64-ucrt-x86_64-nghttp3
+              mingw-w64-ucrt-x86_64-ngtcp2
+
+            arch: 'x64'
+            env: 'ucrt-x86_64'
+            plat: 'windows'
+            type: 'Debug'
+            image: 'windows-2025'
+            chkprefill: '_chkprefill'
+            tflags: '--min=1850'
+            config: >-
+              -DENABLE_DEBUG=ON
+              -DCURL_USE_OPENSSL=ON -DUSE_NGTCP2=ON
+              -DOPENSSL_INCLUDE_DIR=/ucrt64/include
+              -DSSL_EAY_DEBUG=/ucrt64/lib/libssl.dll.a
+              -DSSL_EAY_RELEASE=/ucrt64/lib/libssl.dll.a
+              -DLIB_EAY_DEBUG=/ucrt64/lib/libcrypto.dll.a
+              -DLIB_EAY_RELEASE=/ucrt64/lib/libcrypto.dll.a
+              -DUSE_WIN32_IDN=ON -DUSE_SSLS_EXPORT=ON
+              -DBROTLI_INCLUDE_DIR=/ucrt64/include
+              -DBROTLICOMMON_LIBRARY=/ucrt64/lib/libbrotlicommon.dll.a
+              -DBROTLIDEC_LIBRARY=/ucrt64/lib/libbrotlidec.dll.a
+              -DZSTD_INCLUDE_DIR=/ucrt64/include
+              -DZSTD_LIBRARY=/ucrt64/lib/libzstd.dll.a
+              -DZLIB_INCLUDE_DIR=/ucrt64/include
+              -DZLIB_LIBRARY=/ucrt64/lib/libz.dll.a
+              -DLIBSSH2_INCLUDE_DIR=/ucrt64/include
+              -DLIBSSH2_LIBRARY=/ucrt64/lib/libssh2.dll.a
+              -DNGHTTP2_INCLUDE_DIR=/ucrt64/include
+              -DNGHTTP2_LIBRARY=/ucrt64/lib/libnghttp2.dll.a
+              -DNGHTTP3_INCLUDE_DIR=/ucrt64/include
+              -DNGHTTP3_LIBRARY=/ucrt64/lib/libnghttp3.dll.a
+              -DNGTCP2_INCLUDE_DIR=/ucrt64/include
+              -DNGTCP2_LIBRARY=/ucrt64/lib/libngtcp2.dll.a
+              -DNGTCP2_CRYPTO_OSSL_LIBRARY=/ucrt64/lib/libngtcp2_crypto_ossl.dll.a
+              -DCURL_CA_NATIVE=ON
+              -DCURL_ENABLE_NTLM=ON -DUSE_PROXY_HTTP3=ON
+
+          - name: 'schannel U'
+            install-vcpkg: 'zlib libssh2[core,zlib]'
+            arch: 'arm64'
+            env: 'clang-aarch64'
+            plat: 'windows'
+            type: 'Debug'
+            image: 'windows-11-arm'
+            openssh: 'OpenSSH-Windows'
+            tflags: '--min=1720'
+            # leave SMB disabled to save 30-60 seconds by omitting prereqs,
+            # to counteract the slower test run step
+            config: >-
+              -DENABLE_DEBUG=ON
+              -DCURL_USE_SCHANNEL=ON
+              -DUSE_WIN32_IDN=ON -DENABLE_UNICODE=ON -DUSE_SSLS_EXPORT=ON
+
+      fail-fast: false
+    steps:
+      - uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1
+        with:
+          msystem: ${{ matrix.arch == 'arm64' && 'clangarm64' || 'ucrt64' }}
+          release: ${{ contains(matrix.image, 'arm') }}
+          cache: ${{ contains(matrix.image, 'arm') }}
+          path-type: inherit
+          install: >-
+            mingw-w64-${{ matrix.env }}-libpsl
+            ${{ matrix.install-msys2 }}
+
+      - name: 'vcpkg versions'
+        if: ${{ matrix.install-vcpkg  }}
+        timeout-minutes: 1
+        run: |
+          git -C "$VCPKG_INSTALLATION_ROOT" show --no-patch --format='%H %ai'
+          vcpkg version
+
+      - name: 'vcpkg build'
+        if: ${{ matrix.install-vcpkg  }}
+        timeout-minutes: 45
+        run: vcpkg x-set-installed ${MATRIX_INSTALL_VCPKG} --triplet="${MATRIX_ARCH}-${MATRIX_PLAT}"
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'configure'
+        timeout-minutes: 5
+        env:
+          MATRIX_CHKPREFILL: '${{ matrix.chkprefill }}'
+          MATRIX_CONFIG: '${{ matrix.config }}'
+          TFLAGS: '${{ matrix.tflags }}'
+        run: |
+          [ -f "${MINGW_PREFIX}/include/zconf.h" ] && sed -i -E 's|(# +define +Z_HAVE_UNISTD_H)|/*\1*/|g' "${MINGW_PREFIX}/include/zconf.h"  # Patch MSYS2 zconf.h for MSVC
+          for _chkprefill in '' ${MATRIX_CHKPREFILL}; do
+            options=''
+            cflags=''
+            rcflags=''
+            ldflags=''
+            if [ "${MATRIX_PLAT}" = 'uwp' ]; then
+              options+=' -DCMAKE_SYSTEM_NAME=WindowsStore -DCMAKE_SYSTEM_VERSION=10.0'
+              cflags+=' -DWINAPI_FAMILY=WINAPI_FAMILY_PC_APP'
+              ldflags+=' -OPT:NOREF -OPT:NOICF -APPCONTAINER:NO'
+              vsglobals=';AppxPackage=false;WindowsAppContainer=false'
+            fi
+            if [ "${TFLAGS}" = 'skiprun' ]; then
+              [ "${MATRIX_ARCH}" = 'arm64' ] && options+=' -A ARM64'
+              [ "${MATRIX_ARCH}" = 'x64' ] && options+=' -A x64'
+              [ "${MATRIX_ARCH}" = 'x86' ] && options+=' -A Win32'
+              options+=" -DCMAKE_VS_GLOBALS=TrackFileAccess=false${vsglobals}"
+              options+=' -D_CURL_SKIP_BUILD_CERTS=ON'
+              unset CMAKE_GENERATOR
+            else
+              # Use Ninja when running tests to avoid MSBuild heuristics picking
+              # up "error messages" in the test log output and making the job fail.
+              # Officially this requires the vcvarsall.bat MS-DOS batch file (as of
+              # VS2022). Since it integrates badly with CI steps and shell scripts,
+              # reproduce the necessary build configuration manually, without envs.
+              MSVC_EDITION='2022/Enterprise/vc/tools/msvc'
+              [[ "${MATRIX_IMAGE}" = *'windows-2025'* ]] && MSVC_EDITION='18/Enterprise/vc/tools/msvc'
+              [[ "$(uname -s)" = *'ARM64'* ]] && MSVC_HOST='arm64' || MSVC_HOST='x64'  # x86
+              MSVC_ROOTD="$(cygpath --mixed --short-name "$PROGRAMFILES/Microsoft Visual Studio")"  # to avoid spaces in directory names
+              MSVC_ROOTU="$(/usr/bin/find "$(cygpath --unix "$MSVC_ROOTD/$MSVC_EDITION")" -mindepth 1 -maxdepth 1 -type d -name '*.*' | sort | tail -n 1)"
+              MSVC_ROOTW="$(cygpath --mixed "$MSVC_ROOTU")"
+              MSVC_ROOTU="$(cygpath --unix "$MSVC_ROOTW")"
+              MSVC_BINU="$MSVC_ROOTU/bin/Host$MSVC_HOST/$MATRIX_ARCH"
+              MSDK_ROOTW="$(cygpath --mixed --short-name "$(printenv 'ProgramFiles(x86)')/Windows Kits")/10"
+              MSDK_ROOTU="$(cygpath --unix "$MSDK_ROOTW")"
+              MSDK_VER="$(basename "$(/usr/bin/find "$MSDK_ROOTU/lib" -mindepth 1 -maxdepth 1 -type d -name '*.*' | sort | tail -n 1)")"
+              MSDK_LIBW="$MSDK_ROOTW/lib/$MSDK_VER"
+              MSDK_INCW="$MSDK_ROOTW/include/$MSDK_VER"
+              MSDK_BINU="$MSDK_ROOTU/bin/$MSDK_VER/$MSVC_HOST"
+              cflags+=" -external:W0"
+              cflags+=" -external:I$MSVC_ROOTW/include"
+              cflags+=" -external:I$MSDK_INCW/shared"
+              cflags+=" -external:I$MSDK_INCW/ucrt"
+              cflags+=" -external:I$MSDK_INCW/um"
+              cflags+=" -external:I$MSDK_INCW/km"
+              rcflags+=" -I$MSDK_INCW/shared"
+              rcflags+=" -I$MSDK_INCW/um"
+              ldflags+=" -libpath:$MSVC_ROOTW/lib/$MATRIX_ARCH"
+              ldflags+=" -libpath:$MSDK_LIBW/ucrt/$MATRIX_ARCH"
+              ldflags+=" -libpath:$MSDK_LIBW/um/$MATRIX_ARCH"
+              ldflags+=" -libpath:$MSDK_LIBW/km/$MATRIX_ARCH"
+              options+=" -DCMAKE_RC_COMPILER=$MSDK_BINU/rc.exe"
+              options+=" -DCMAKE_MT=$MSDK_BINU/mt.exe"
+              options+=" -DCMAKE_C_COMPILER=$MSVC_BINU/cl.exe"
+              export CMAKE_GENERATOR='Ninja Multi-Config'  # pass it via env to avoid space issues
+              echo "Using MSVC: ${MSVC_ROOTW}"
+              echo "Using Windows SDK: ${MSDK_VER}"
+            fi
+            [ "${_chkprefill}" = '_chkprefill' ] && options+=' -D_CURL_PREFILL=OFF'
+            if [ -n "${MATRIX_INSTALL_VCPKG}" ]; then
+              options+=" -DCMAKE_TOOLCHAIN_FILE=$VCPKG_INSTALLATION_ROOT/scripts/buildsystems/vcpkg.cmake"
+              options+=" -DVCPKG_INSTALLED_DIR=$VCPKG_INSTALLATION_ROOT/installed"
+              options+=" -DVCPKG_TARGET_TRIPLET=${MATRIX_ARCH}-${MATRIX_PLAT}"
+              options+=" -DCMAKE_C_COMPILER_TARGET=${MATRIX_ARCH}-${MATRIX_PLAT}"
+            fi
+            cmake -B "bld${_chkprefill}" ${options} \
+              -DCMAKE_C_FLAGS="${cflags}" \
+              -DCMAKE_RC_FLAGS="${rcflags}" \
+              -DCMAKE_EXE_LINKER_FLAGS="-INCREMENTAL:NO ${ldflags}" \
+              -DCMAKE_SHARED_LINKER_FLAGS="-INCREMENTAL:NO ${ldflags}" \
+              -DCMAKE_UNITY_BUILD=ON \
+              -DCURL_DROP_UNUSED=ON \
+              -DCURL_WERROR=ON \
+              -DLIBPSL_INCLUDE_DIR="${MINGW_PREFIX}/include" \
+              -DLIBPSL_LIBRARY="${MINGW_PREFIX}/lib/libpsl.dll.a" \
+              -DBUILD_SHARED_LIBS=OFF \
+              ${MATRIX_CONFIG}
+          done
+          if [ -d bld_chkprefill ] && ! diff -u bld/lib/curl_config.h bld_chkprefill/lib/curl_config.h; then
+            echo '::group::reference configure log'; cat bld_chkprefill/CMakeFiles/CMake*.yaml 2>/dev/null || true; echo '::endgroup::'
+            false
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+
+      - name: 'build'
+        timeout-minutes: 5
+        run: cmake --build bld --config "${MATRIX_TYPE}" --parallel 5
+
+      - name: 'curl -V'
+        timeout-minutes: 1
+        run: |
+          /usr/bin/find . \( -name '*.exe' -o -name '*.dll' -o -name '*.lib' -o -name '*.pdb' \) -print0 | grep -z curl | xargs -0 file --
+          /usr/bin/find . \( -name '*.exe' -o -name '*.dll' -o -name '*.lib' -o -name '*.pdb' \) -print0 | grep -z curl | xargs -0 stat -c '%10s bytes: %n' --
+          if [ "${MATRIX_PLAT}" != 'uwp' ]; then  # Missing: ucrtbased.dll, VCRUNTIME140D.dll, VCRUNTIME140D_APP.dll
+            PATH="$PWD/bld/lib/${MATRIX_TYPE}:$PATH"
+            "bld/src/${MATRIX_TYPE}/curl.exe" --disable --version
+          fi
+
+      - name: 'build tests'
+        if: ${{ matrix.tflags != 'skipall' }}
+        timeout-minutes: 10
+        run: cmake --build bld --config "${MATRIX_TYPE}" --parallel 5 --target testdeps
+
+      - name: 'cache test prereqs (stunnel)'
+        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-stunnel
+        with:
+          path: C:\my-stunnel
+          key: ${{ runner.os }}-stunnel-${{ env.STUNNEL_VERSION }}-amd64
+          fail-on-cache-miss: true
+
+      - name: 'install test prereqs'
+        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
+        timeout-minutes: 2
+        run: |
+          if [ -z "${MATRIX_OPENSSH}" ]; then  # MSYS2 openssh
+            /usr/bin/pacman --noconfirm --noprogressbar --sync --needed openssh
+          elif [ "${MATRIX_OPENSSH}" = 'OpenSSH-Windows-builtin' ]; then
+            # https://learn.microsoft.com/windows-server/administration/openssh/openssh_install_firstuse
+            if [[ "${MATRIX_IMAGE}" = *'windows-2025'* ]]; then
+              pwsh -Command 'Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0'
+              pwsh -Command 'Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0'
+            fi
+          else  # OpenSSH-Windows
+            cd /c  # no D: drive on windows-11-arm runners
+            if [[ "${MATRIX_IMAGE}" = *'-arm'* ]]; then
+              curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+                --location --proto-redir =https "https://github.com/PowerShell/Win32-OpenSSH/releases/download/${OPENSSH_WINDOWS_VERSION}/OpenSSH-ARM64.zip" --output pkg.bin
+              sha256sum pkg.bin && sha256sum pkg.bin | grep -qwF -- "${OPENSSH_WINDOWS_SHA256_ARM64}" && unzip pkg.bin && rm -f pkg.bin
+            else
+              curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+                --location --proto-redir =https "https://github.com/PowerShell/Win32-OpenSSH/releases/download/${OPENSSH_WINDOWS_VERSION}/OpenSSH-Win64.zip" --output pkg.bin
+              sha256sum pkg.bin && sha256sum pkg.bin | grep -qwF -- "${OPENSSH_WINDOWS_SHA256_WIN64}" && unzip pkg.bin && rm -f pkg.bin
+            fi
+          fi
+          if "bld/src/${MATRIX_TYPE}/curl.exe" --disable -V 2>/dev/null | grep smb; then
+            python3 -m pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/requirements.txt
+          fi
+
+      - name: 'run tests'
+        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
+        timeout-minutes: 10
+        env:
+          TFLAGS: '${{ matrix.tflags }}'
+        run: |
+          TFLAGS="-j8 ${TFLAGS}"
+          TFLAGS+=' !498'  # 'Reject too large HTTP response headers on endless redirects' HTTP, HTTP GET (runtests detecting result code 2009 instead of 56 returned by curl)
+          TFLAGS+=' ~3000 ~3001 ~3023 ~3024'  # 'HTTPS localhost, last subject alt name matches, CN does not match' HTTPS, HTTP GET, PEM certificate (returning 56)
+          if [[ "${MATRIX_INSTALL_MSYS2}" = *'libssh2-wincng'* || \
+                "${MATRIX_INSTALL_VCPKG}" = *'libssh2[core,zlib]'* ]]; then
+            TFLAGS+=' ~SCP ~SFTP'  # Flaky: `-8, Unable to exchange encryption keys`. https://github.com/libssh2/libssh2/issues/804
+            unset CURL_TEST_SSH_KEYALGO  # libssh2 built with WinCNG does not support ssh-ed25519 hostkeys
+            export CURL_TEST_SSH_ENABLE_KEX=diffie-hellman-group-exchange-sha256
+          fi
+          if [ -n "${MATRIX_OPENSSH}" ]; then  # OpenSSH-Windows
+            TFLAGS+=' ~601 ~603 ~617 ~619 ~621 ~641 ~665 ~2004'  # SCP
+            if [[ "${MATRIX_INSTALL_MSYS2} " = *'libssh '* || \
+                  "${MATRIX_INSTALL_VCPKG} " = *'libssh '* ]]; then
+              TFLAGS+=' ~614'  # 'SFTP pre-quote chmod' SFTP, pre-quote, directory
+            else
+              TFLAGS+=' ~3022'  # 'SCP correct sha256 host key' SCP, server sha256 key check
+            fi
+          fi
+          if [ "${MATRIX_OPENSSH}" = 'OpenSSH-Windows' ]; then
+            if [[ "${MATRIX_IMAGE}" = *'-arm'* ]]; then
+              PATH="/c/OpenSSH-ARM64:$PATH"
+            else
+              PATH="/c/OpenSSH-Win64:$PATH"
+            fi
+          fi
+          PATH="$PWD/bld/lib/${MATRIX_TYPE}:$PATH:/c/my-stunnel/bin"
+          cmake --build bld --config "${MATRIX_TYPE}" --target test-ci
+
+      - name: 'build examples'
+        timeout-minutes: 5
+        if: ${{ contains(matrix.name, '+examples') }}
+        run: cmake --build bld --config "${MATRIX_TYPE}" --parallel 5 --target curl-examples-build
+
+      - name: 'disk space used'
+        run: du -sh .; echo; du -sh -t 250KB ./*; echo; du -h -t 250KB bld
diff --git a/third-party/curl/.github/workflows/wolfssl.yml b/third-party/curl/.github/workflows/wolfssl.yml
deleted file mode 100644
index 53ed0cc857..0000000000
--- a/third-party/curl/.github/workflows/wolfssl.yml
+++ /dev/null
@@ -1,105 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: Linux wolfSSL
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-  pull_request:
-    branches:
-    - master
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-
-concurrency:
-  # Hardcoded workflow filename as workflow name above is just Linux again
-  group: wolfssl-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-env:
-  MAKEFLAGS: -j 3
-
-jobs:
-  autotools:
-    name: ${{ matrix.build.name }}
-    runs-on: 'ubuntu-latest'
-    timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        build:
-        - name: wolfssl (configured with --enable-all)
-          install:
-          configure: LDFLAGS="-Wl,-rpath,$HOME/wssl/lib" --with-wolfssl=$HOME/wssl --enable-debug
-          wolfssl-configure: --enable-all
-        - name: wolfssl (configured with --enable-opensslextra)
-          install:
-          configure: LDFLAGS="-Wl,-rpath,$HOME/wssl/lib" --with-wolfssl=$HOME/wssl --enable-debug
-          wolfssl-configure: --enable-opensslextra
-
-    steps:
-    - run: |
-        sudo apt-get update
-        sudo apt-get install libtool autoconf automake pkg-config stunnel4 ${{ matrix.build.install }}
-        sudo python3 -m pip install impacket
-      name: 'install prereqs and impacket'
-
-    - run: |
-        WOLFSSL_VER=5.6.3
-        curl -LOsSf --retry 6 --retry-connrefused --max-time 999 https://github.com/wolfSSL/wolfssl/archive/v$WOLFSSL_VER-stable.tar.gz
-        tar -xzf v$WOLFSSL_VER-stable.tar.gz
-        cd wolfssl-$WOLFSSL_VER-stable
-        ./autogen.sh
-        ./configure --enable-tls13 ${{ matrix.build.wolfssl-configure }} --enable-harden --prefix=$HOME/wssl
-        make install
-      name: 'install wolfssl'
-
-    - uses: actions/checkout@v3
-
-    - run: autoreconf -fi
-      name: 'autoreconf'
-
-    - run: ./configure --enable-warnings --enable-werror ${{ matrix.build.configure }}
-      name: 'configure'
-
-    - run: make V=1
-      name: 'make'
-
-    - run: make V=1 examples
-      name: 'make examples'
-
-    - run: make V=1 -C tests
-      name: 'make tests'
-
-    - run: make V=1 test-ci
-      name: 'run tests'
-      env:
-        TFLAGS: "${{ matrix.build.tflags }}"
diff --git a/third-party/curl/.gitignore b/third-party/curl/.gitignore
index 2d5c292325..0ac1002956 100644
--- a/third-party/curl/.gitignore
+++ b/third-party/curl/.gitignore
@@ -8,11 +8,15 @@
 *.exp
 *.la
 *.lib
+*.a
+*.res
 *.lo
 *.o
 *.obj
 *.pdb
 *.pyc
+*.orig
+*.rej
 *~
 .*.sw?
 .cproject
@@ -24,10 +28,8 @@
 /.vs
 /bld/
 /build/
-/builds/
 /stats/
 __pycache__
-CHANGES.dist
 Debug
 INSTALL
 Makefile
@@ -37,6 +39,9 @@ TAGS
 aclocal.m4
 aclocal.m4.bak
 autom4te.cache
+buildinfo.txt
+ca-bundle.crt
+certdata.txt
 compile
 config.cache
 config.guess
@@ -58,6 +63,7 @@ missing
 mkinstalldirs
 tags
 test-driver
+stamp-h*
 scripts/_curl
 scripts/curl.fish
 curl_fuzzer
@@ -65,3 +71,4 @@ curl_fuzzer_seed_corpus.zip
 libstandaloneengine.a
 tests/string
 tests/config
+tests/ech-log/
diff --git a/third-party/curl/.mailmap b/third-party/curl/.mailmap
index 2bc5635145..20384c0101 100644
--- a/third-party/curl/.mailmap
+++ b/third-party/curl/.mailmap
@@ -1,6 +1,10 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
 Guenter Knauf <lists@gknw.net> <gk@gknw.de>
-Gisle Vanem <gisle.vanem@gmail.com> <gvanem@yahoo.no>
-Gisle Vanem <gisle.vanem@gmail.com> <gvanem@broadpark.no>
+Gisle Vanem <gvanem@yahoo.no> <gisle.vanem@gmail.com>
+Gisle Vanem <gvanem@yahoo.no> <gvanem@broadpark.no>
 Alessandro Ghedini <alessandro@ghedini.me> <alessandro@cloudflare.com>
 Alessandro Ghedini <alessandro@ghedini.me> <al3xbio@gmail.com>
 Björn Stenberg <bjorn@haxx.se>
@@ -65,7 +69,8 @@ Jessa Chandler <jessachandler@gmail.com>
 Gökhan Şengün <gsengun@linux-5d7d.site> <gokhansengun@gmai.com>
 Svyatoslav Mishyn <juef@openmailbox.org>
 Douglas Steinwand <dzs-curl@dzs.fx.org>
-James Fuller <jim@webcomposite.com>
+James Fuller <jim@webcomposite.com> <jfuller@redhat.com>
+James Fuller <jim@webcomposite.com> Jim Fuller <jim@webcomposite.com>
 Don J Olmstead <don.j.olmstead@gmail.com>
 Nicolas Sterchele <sterchelen@gmail.com>
 Sergey Raevskiy <ccik@inbox.ru>
@@ -79,8 +84,8 @@ Tobias Nyholm <tobias.nyholm@gmail.com>
 Timur Artikov <t.artikov@2gis.ru>
 Michał Antoniak <47522782+MAntoniak@users.noreply.github.com>
 Gleb Ivanovsky <gl.ivanovsky@gmail.com>
-Max Dymond <max.dymond@microsoft.com> <max.dymond@metaswitch.com>
-Max Dymond <max.dymond@microsoft.com> <cmeister2@gmail.com>
+Max Dymond <cmeister2@gmail.com> <max.dymond@metaswitch.com>
+Max Dymond <cmeister2@gmail.com> <max.dymond@microsoft.com>
 Abhinav Singh <theawless@gmail.com>
 Malik Idrees Hasan Khan <77000356+MalikIdreesHasanKhan@users.noreply.github.com>
 Yongkang Huang <hyk68691@hotmail.com>
@@ -106,3 +111,15 @@ Thomas1664 on github <46387399+Thomas1664@users.noreply.github.com>
 dengjfzh on github <dengjfzh@gmail.com>
 Brad Harder <brad.harder@gmail.com>
 Derzsi Dániel <daniel@tohka.us>
+Michael Osipov <michael.osipov@siemens.com> <1983-01-06@gmx.net>
+Michael Osipov <michael.osipov@siemens.com> <michael-o@users.sf.net>
+Christian Weisgerber <naddy@mips.inka.de> <curl-library@lists.haxx.se>
+Moritz Buhl <git@moritzbuhl.de>
+Aki Sakurai <75532970+AkiSakurai@users.noreply.github.com>
+Sinkevich Artem <artsin666@gmail.com>
+Andrew Kirillov <akirillo@uk.ibm.com>
+Stephen Farrell <stephen.farrell@cs.tcd.ie>
+Calvin Ruocco <calvin.ruocco@vector.com>
+Hamza Bensliman <benslimanhamza99@gmail.com>
+Kaixuan Li <kaixuan.li@ntu.edu.sg>
+Darren Banfi <boingball@gmail.com>
diff --git a/third-party/curl/.reuse/dep5 b/third-party/curl/.reuse/dep5
deleted file mode 100644
index cdefb1698f..0000000000
--- a/third-party/curl/.reuse/dep5
+++ /dev/null
@@ -1,98 +0,0 @@
-Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: curl
-Upstream-Contact: Daniel Stenberg <daniel@haxx.se>
-Source: https://curl.se
-
-# Tests
-Files: tests/data/test* tests/certs/* tests/stunnel.pem tests/valgrind.supp
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-# Markdown documentation in docs/
-Files: docs/*.md
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-# Docs in docs/
-Files: docs/FAQ docs/INSTALL docs/INSTALL.cmake docs/KNOWN_BUGS docs/MAIL-ETIQUETTE docs/THANKS docs/TODO docs/cmdline-opts/page-footer docs/libcurl/curl_multi_socket_all.3 docs/libcurl/curl_strnequal.3 docs/libcurl/symbols-in-versions docs/options-in-versions
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-# Windows
-Files: projects/Windows/*
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: libcurl.def
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-# Single files we do not want to edit directly
-Files: CHANGES
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: GIT-INFO
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: RELEASE-NOTES
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-# checksrc control files
-Files: lib/.checksrc docs/examples/.checksrc tests/libtest/.checksrc
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: lib/libcurl.plist.in
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: lib/libcurl.vers.in
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: packages/OS400/README.OS400
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: packages/vms/build_vms.com
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: packages/vms/curl_release_note_start.txt
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: packages/vms/curlmsg.sdl
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: packages/vms/macro32_exactcase.patch
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: packages/vms/readme
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: plan9/README
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: projects/wolfssl_override.props
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: README
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: .github/ISSUE_TEMPLATE/bug_report.md
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: .mailmap
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
diff --git a/third-party/curl/CHANGES b/third-party/curl/CHANGES
deleted file mode 100644
index 3e2cd9947d..0000000000
--- a/third-party/curl/CHANGES
+++ /dev/null
@@ -1,7 +0,0 @@
-See https://curl.se/changes.html for the edited and human readable online
-version of what has changed over the years in different curl releases.
-
-Generate a CHANGES file like the one present in every release like this:
-
-$ git log --pretty=fuller --no-color --date=short --decorate=full | \
-  ./scripts/log2changes.pl
diff --git a/third-party/curl/CHANGES.md b/third-party/curl/CHANGES.md
new file mode 100644
index 0000000000..3eabec9cb8
--- /dev/null
+++ b/third-party/curl/CHANGES.md
@@ -0,0 +1,12 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+In a release tarball, check the RELEASE-NOTES file for what was done in the
+most recent release. In a git check-out, that file mentions changes that have
+been done since the previous release.
+
+See the online [changelog](https://curl.se/changes.html) for the edited and
+human readable version of what has changed in different curl releases.
diff --git a/third-party/curl/CMake/CMakeConfigurableFile.in b/third-party/curl/CMake/CMakeConfigurableFile.in
deleted file mode 100644
index a3d2bc4a28..0000000000
--- a/third-party/curl/CMake/CMakeConfigurableFile.in
+++ /dev/null
@@ -1,24 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-@CMAKE_CONFIGURABLE_FILE_CONTENT@
diff --git a/third-party/curl/CMake/CurlSymbolHiding.cmake b/third-party/curl/CMake/CurlSymbolHiding.cmake
index 142e919449..51a2d94de1 100644
--- a/third-party/curl/CMake/CurlSymbolHiding.cmake
+++ b/third-party/curl/CMake/CurlSymbolHiding.cmake
@@ -21,58 +21,48 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-include(CheckCSourceCompiles)
-
-option(CURL_HIDDEN_SYMBOLS "Set to ON to hide libcurl internal symbols (=hide all symbols that aren't officially external)." ON)
+option(CURL_HIDDEN_SYMBOLS "Hide libcurl internal symbols (=hide all symbols that are not officially external)" ON)
 mark_as_advanced(CURL_HIDDEN_SYMBOLS)
 
-if(CURL_HIDDEN_SYMBOLS)
-  set(SUPPORTS_SYMBOL_HIDING FALSE)
-
-  if(CMAKE_C_COMPILER_ID MATCHES "Clang" AND NOT MSVC)
-    set(SUPPORTS_SYMBOL_HIDING TRUE)
-    set(_SYMBOL_EXTERN "__attribute__ ((__visibility__ (\"default\")))")
-    set(_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
-  elseif(CMAKE_COMPILER_IS_GNUCC)
-    if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 3.4)
-      # note: this is considered buggy prior to 4.0 but the autotools don't care, so let's ignore that fact
-      set(SUPPORTS_SYMBOL_HIDING TRUE)
-      set(_SYMBOL_EXTERN "__attribute__ ((__visibility__ (\"default\")))")
-      set(_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
-    endif()
-  elseif(CMAKE_C_COMPILER_ID MATCHES "SunPro" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 8.0)
-    set(SUPPORTS_SYMBOL_HIDING TRUE)
-    set(_SYMBOL_EXTERN "__global")
-    set(_CFLAG_SYMBOLS_HIDE "-xldscope=hidden")
-  elseif(CMAKE_C_COMPILER_ID MATCHES "Intel" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 9.0)
-    # note: this should probably just check for version 9.1.045 but I'm not 100% sure
-    #       so let's do it the same way autotools do.
-    set(SUPPORTS_SYMBOL_HIDING TRUE)
-    set(_SYMBOL_EXTERN "__attribute__ ((__visibility__ (\"default\")))")
-    set(_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
-    check_c_source_compiles("#include <stdio.h>
-        int main (void) { printf(\"icc fvisibility bug test\"); return 0; }" _no_bug)
-    if(NOT _no_bug)
-      set(SUPPORTS_SYMBOL_HIDING FALSE)
-      set(_SYMBOL_EXTERN "")
-      set(_CFLAG_SYMBOLS_HIDE "")
-    endif()
-  elseif(MSVC)
-    set(SUPPORTS_SYMBOL_HIDING TRUE)
-  endif()
-
-  set(HIDES_CURL_PRIVATE_SYMBOLS ${SUPPORTS_SYMBOL_HIDING})
-elseif(MSVC)
-  if(NOT CMAKE_VERSION VERSION_LESS 3.7)
-    set(CMAKE_WINDOWS_EXPORT_ALL_SYMBOLS TRUE) #present since 3.4.3 but broken
-    set(HIDES_CURL_PRIVATE_SYMBOLS FALSE)
-  else()
-    message(WARNING "Hiding private symbols regardless CURL_HIDDEN_SYMBOLS being disabled.")
-    set(HIDES_CURL_PRIVATE_SYMBOLS TRUE)
-  endif()
-else()
-  set(HIDES_CURL_PRIVATE_SYMBOLS FALSE)
+if(WIN32 AND ENABLE_DEBUG)
+  # We need to export internal debug functions,
+  # e.g. curl_easy_perform_ev() or curl_dbg_*(),
+  # so disable symbol hiding for debug builds and for memory tracking.
+  set(CURL_HIDDEN_SYMBOLS OFF)
+elseif(DOS OR AMIGA)
+  set(CURL_HIDDEN_SYMBOLS OFF)
 endif()
 
-set(CURL_CFLAG_SYMBOLS_HIDE ${_CFLAG_SYMBOLS_HIDE})
-set(CURL_EXTERN_SYMBOL ${_SYMBOL_EXTERN})
+set(CURL_HIDES_PRIVATE_SYMBOLS FALSE)
+set(CURL_EXTERN_SYMBOL "")
+set(CURL_CFLAG_SYMBOLS_HIDE "")
+
+if(CURL_HIDDEN_SYMBOLS)
+  if(CMAKE_C_COMPILER_ID MATCHES "Clang" AND NOT MSVC)
+    set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
+    set(CURL_EXTERN_SYMBOL "__attribute__((__visibility__(\"default\")))")
+    set(CURL_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
+  elseif(CMAKE_C_COMPILER_ID STREQUAL "GNU")
+    if(CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 3.4)
+      # Note: This is considered buggy prior to 4.0 but the autotools do not care, so let us ignore that fact
+      set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
+      set(CURL_EXTERN_SYMBOL "__attribute__((__visibility__(\"default\")))")
+      set(CURL_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
+    endif()
+  elseif(CMAKE_C_COMPILER_ID MATCHES "SunPro" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 8.0)
+    set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
+    set(CURL_EXTERN_SYMBOL "__global")
+    set(CURL_CFLAG_SYMBOLS_HIDE "-xldscope=hidden")
+  elseif(CMAKE_C_COMPILER_ID MATCHES "Intel" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 9.0)  # Requires 9.1.045
+    set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
+    set(CURL_EXTERN_SYMBOL "__attribute__((__visibility__(\"default\")))")
+    set(CURL_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
+  elseif(MSVC)
+    set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
+  endif()
+else()
+  if(MSVC)
+    # Note: This option is prone to export non-curl extra symbols.
+    set(CMAKE_WINDOWS_EXPORT_ALL_SYMBOLS TRUE)
+  endif()
+endif()
diff --git a/third-party/curl/CMake/CurlTests.c b/third-party/curl/CMake/CurlTests.c
index 38be522d5e..be3b6f73ee 100644
--- a/third-party/curl/CMake/CurlTests.c
+++ b/third-party/curl/CMake/CurlTests.c
@@ -21,145 +21,86 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#ifdef TIME_WITH_SYS_TIME
-/* Time with sys/time test */
-
-#include <sys/types.h>
-#include <sys/time.h>
-#include <time.h>
-
-int
-main ()
-{
-if ((struct tm *) 0)
-return 0;
-  ;
-  return 0;
-}
-
-#endif
 
 #ifdef HAVE_FCNTL_O_NONBLOCK
-
 /* headers for FCNTL_O_NONBLOCK test */
 #include <sys/types.h>
 #include <unistd.h>
 #include <fcntl.h>
-/* */
+
 #if defined(sun) || defined(__sun__) || \
-    defined(__SUNPRO_C) || defined(__SUNPRO_CC)
-# if defined(__SVR4) || defined(__srv4__)
-#  define PLATFORM_SOLARIS
-# else
-#  define PLATFORM_SUNOS4
-# endif
+  defined(__SUNPRO_C) || defined(__SUNPRO_CC)
+#  if defined(__SVR4) || defined(__srv4__)
+#    define PLATFORM_SOLARIS
+#  else
+#    define PLATFORM_SUNOS4
+#  endif
 #endif
 #if (defined(_AIX) || defined(__xlC__)) && !defined(_AIX41)
-# define PLATFORM_AIX_V3
+#  define PLATFORM_AIX_V3
 #endif
-/* */
+
 #if defined(PLATFORM_SUNOS4) || defined(PLATFORM_AIX_V3)
 #error "O_NONBLOCK does not work on this platform"
 #endif
 
-int
-main ()
+int main(void)
 {
-      /* O_NONBLOCK source test */
-      int flags = 0;
-      if(0 != fcntl(0, F_SETFL, flags | O_NONBLOCK))
-          return 1;
-      return 0;
+  /* O_NONBLOCK source test */
+  int flags = 0;
+  if(0 != fcntl(0, F_SETFL, flags | O_NONBLOCK))
+    return 1;
+  return 0;
 }
 #endif
 
 /* tests for gethostbyname_r */
-#if defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT) || \
-    defined(HAVE_GETHOSTBYNAME_R_5_REENTRANT) || \
-    defined(HAVE_GETHOSTBYNAME_R_6_REENTRANT)
-#   define _REENTRANT
-    /* no idea whether _REENTRANT is always set, just invent a new flag */
-#   define TEST_GETHOSTBYFOO_REENTRANT
-#endif
 #if defined(HAVE_GETHOSTBYNAME_R_3) || \
+    defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT) || \
     defined(HAVE_GETHOSTBYNAME_R_5) || \
+    defined(HAVE_GETHOSTBYNAME_R_5_REENTRANT) || \
     defined(HAVE_GETHOSTBYNAME_R_6) || \
-    defined(TEST_GETHOSTBYFOO_REENTRANT)
+    defined(HAVE_GETHOSTBYNAME_R_6_REENTRANT)
 #include <sys/types.h>
 #include <netdb.h>
 int main(void)
 {
-  char *address = "example.com";
-  int length = 0;
-  int type = 0;
+  const char *address = "example.com";
   struct hostent h;
   int rc = 0;
-#if defined(HAVE_GETHOSTBYNAME_R_3) || \
-    defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT)
+#if   defined(HAVE_GETHOSTBYNAME_R_3) || \
+      defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT)
   struct hostent_data hdata;
 #elif defined(HAVE_GETHOSTBYNAME_R_5) || \
       defined(HAVE_GETHOSTBYNAME_R_5_REENTRANT) || \
       defined(HAVE_GETHOSTBYNAME_R_6) || \
       defined(HAVE_GETHOSTBYNAME_R_6_REENTRANT)
   char buffer[8192];
-  int h_errnop;
   struct hostent *hp;
+  int h_errnop;
 #endif
 
 #if   defined(HAVE_GETHOSTBYNAME_R_3) || \
       defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT)
   rc = gethostbyname_r(address, &h, &hdata);
+  (void)hdata;
 #elif defined(HAVE_GETHOSTBYNAME_R_5) || \
       defined(HAVE_GETHOSTBYNAME_R_5_REENTRANT)
   rc = gethostbyname_r(address, &h, buffer, 8192, &h_errnop);
-  (void)hp; /* not used for test */
+  (void)hp;
+  (void)h_errnop;
 #elif defined(HAVE_GETHOSTBYNAME_R_6) || \
       defined(HAVE_GETHOSTBYNAME_R_6_REENTRANT)
   rc = gethostbyname_r(address, &h, buffer, 8192, &hp, &h_errnop);
+  (void)hp;
+  (void)h_errnop;
 #endif
-
-  (void)length;
-  (void)type;
+  (void)h;
   (void)rc;
   return 0;
 }
 #endif
 
-#ifdef HAVE_SOCKLEN_T
-#ifdef _WIN32
-#include <ws2tcpip.h>
-#else
-#include <sys/types.h>
-#include <sys/socket.h>
-#endif
-int
-main ()
-{
-if ((socklen_t *) 0)
-  return 0;
-if (sizeof (socklen_t))
-  return 0;
-  ;
-  return 0;
-}
-#endif
-#ifdef HAVE_IN_ADDR_T
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <arpa/inet.h>
-
-int
-main ()
-{
-if ((in_addr_t *) 0)
-  return 0;
-if (sizeof (in_addr_t))
-  return 0;
-  ;
-  return 0;
-}
-#endif
-
 #ifdef HAVE_BOOL_T
 #ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
@@ -167,13 +108,9 @@ if (sizeof (in_addr_t))
 #ifdef HAVE_STDBOOL_H
 #include <stdbool.h>
 #endif
-int
-main ()
+int main(void)
 {
-if (sizeof (bool *) )
-  return 0;
-  ;
-  return 0;
+  return (int)sizeof(bool *);
 }
 #endif
 
@@ -182,130 +119,94 @@ if (sizeof (bool *) )
 #include <stdarg.h>
 #include <string.h>
 #include <float.h>
-int main() { return 0; }
+int main(void)
+{
+  return 0;
+}
 #endif
+
 #ifdef HAVE_FILE_OFFSET_BITS
-#ifdef _FILE_OFFSET_BITS
-#undef _FILE_OFFSET_BITS
-#endif
-#define _FILE_OFFSET_BITS 64
 #include <sys/types.h>
- /* Check that off_t can represent 2**63 - 1 correctly.
-    We can't simply define LARGE_OFF_T to be 9223372036854775807,
-    since some C++ compilers masquerading as C compilers
-    incorrectly reject 9223372036854775807.  */
-#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
-  int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
-                       && LARGE_OFF_T % 2147483647 == 1)
-                      ? 1 : -1];
-int main () { ; return 0; }
+/* Check that off_t can represent 2**63 - 1 correctly.
+   We cannot define LARGE_OFF_T to be 9223372036854775807,
+   since some C++ compilers masquerading as C compilers
+   incorrectly reject 9223372036854775807. */
+#define LARGE_OFF_T (((off_t)1 << 62) - 1 + ((off_t)1 << 62))
+static int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 &&
+                           LARGE_OFF_T % 2147483647 == 1)
+                          ? 1 : -1];
+int main(void)
+{
+  (void)off_t_is_large;
+  return 0;
+}
 #endif
+
 #ifdef HAVE_IOCTLSOCKET
-/* includes start */
-#ifdef HAVE_WINDOWS_H
-#  ifndef WIN32_LEAN_AND_MEAN
-#    define WIN32_LEAN_AND_MEAN
-#  endif
-#  include <windows.h>
-#  ifdef HAVE_WINSOCK2_H
-#    include <winsock2.h>
-#  endif
+#ifdef _WIN32
+#  include <winsock2.h>
 #endif
-
-int
-main ()
+int main(void)
 {
-
-/* ioctlsocket source code */
- int socket;
- unsigned long flags = ioctlsocket(socket, FIONBIO, &flags);
-
-  ;
+  /* ioctlsocket source code */
+  int socket = -1;
+  unsigned long flags = ioctlsocket(socket, FIONBIO, &flags);
+  (void)flags;
   return 0;
 }
 
 #endif
+
 #ifdef HAVE_IOCTLSOCKET_CAMEL
-/* includes start */
-#ifdef HAVE_WINDOWS_H
-#  ifndef WIN32_LEAN_AND_MEAN
-#    define WIN32_LEAN_AND_MEAN
-#  endif
-#  include <windows.h>
-#  ifdef HAVE_WINSOCK2_H
-#    include <winsock2.h>
-#  endif
-#endif
-
-int
-main ()
+#include <proto/bsdsocket.h>
+int main(void)
 {
-
-/* IoctlSocket source code */
-    if(0 != IoctlSocket(0, 0, 0))
-      return 1;
-  ;
+  /* IoctlSocket source code */
+  if(0 != IoctlSocket(0, 0, 0))
+    return 1;
   return 0;
 }
 #endif
+
 #ifdef HAVE_IOCTLSOCKET_CAMEL_FIONBIO
-/* includes start */
-#ifdef HAVE_WINDOWS_H
-#  ifndef WIN32_LEAN_AND_MEAN
-#    define WIN32_LEAN_AND_MEAN
-#  endif
-#  include <windows.h>
-#  ifdef HAVE_WINSOCK2_H
-#    include <winsock2.h>
-#  endif
+#include <proto/bsdsocket.h>
+#ifdef HAVE_SYS_IOCTL_H
+#  include <sys/ioctl.h>
 #endif
-
-int
-main ()
+int main(void)
 {
-
-/* IoctlSocket source code */
-        long flags = 0;
-        if(0 != IoctlSocket(0, FIONBIO, &flags))
-          return 1;
-  ;
+  /* IoctlSocket source code */
+  long flags = 0;
+  if(0 != IoctlSocket(0, FIONBIO, &flags))
+    return 1;
+  (void)flags;
   return 0;
 }
 #endif
+
 #ifdef HAVE_IOCTLSOCKET_FIONBIO
-/* includes start */
-#ifdef HAVE_WINDOWS_H
-#  ifndef WIN32_LEAN_AND_MEAN
-#    define WIN32_LEAN_AND_MEAN
-#  endif
-#  include <windows.h>
-#  ifdef HAVE_WINSOCK2_H
-#    include <winsock2.h>
-#  endif
+#ifdef _WIN32
+#  include <winsock2.h>
 #endif
-
-int
-main ()
+int main(void)
 {
-
-        int flags = 0;
-        if(0 != ioctlsocket(0, FIONBIO, &flags))
-          return 1;
-
-  ;
+  unsigned long flags = 0;
+  if(0 != ioctlsocket(0, FIONBIO, &flags))
+    return 1;
+  (void)flags;
   return 0;
 }
 #endif
+
 #ifdef HAVE_IOCTL_FIONBIO
 /* headers for FIONBIO test */
-/* includes start */
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
 #ifdef HAVE_UNISTD_H
 #  include <unistd.h>
 #endif
-#ifdef HAVE_SYS_SOCKET_H
+#ifndef _WIN32
 #  include <sys/socket.h>
 #endif
 #ifdef HAVE_SYS_IOCTL_H
@@ -314,29 +215,25 @@ main ()
 #ifdef HAVE_STROPTS_H
 #  include <stropts.h>
 #endif
-
-int
-main ()
+int main(void)
 {
-
-        int flags = 0;
-        if(0 != ioctl(0, FIONBIO, &flags))
-          return 1;
-
-  ;
+  int flags = 0;
+  if(0 != ioctl(0, FIONBIO, &flags))
+    return 1;
+  (void)flags;
   return 0;
 }
 #endif
+
 #ifdef HAVE_IOCTL_SIOCGIFADDR
 /* headers for FIONBIO test */
-/* includes start */
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
 #ifdef HAVE_UNISTD_H
 #  include <unistd.h>
 #endif
-#ifdef HAVE_SYS_SOCKET_H
+#ifndef _WIN32
 #  include <sys/socket.h>
 #endif
 #ifdef HAVE_SYS_IOCTL_H
@@ -346,156 +243,111 @@ main ()
 #  include <stropts.h>
 #endif
 #include <net/if.h>
-
-int
-main ()
+int main(void)
 {
-        struct ifreq ifr;
-        if(0 != ioctl(0, SIOCGIFADDR, &ifr))
-          return 1;
-
-  ;
+  struct ifreq ifr;
+  if(0 != ioctl(0, SIOCGIFADDR, &ifr))
+    return 1;
+  (void)ifr;
   return 0;
 }
 #endif
+
 #ifdef HAVE_SETSOCKOPT_SO_NONBLOCK
-/* includes start */
-#ifdef HAVE_WINDOWS_H
-#  ifndef WIN32_LEAN_AND_MEAN
-#    define WIN32_LEAN_AND_MEAN
-#  endif
-#  include <windows.h>
-#  ifdef HAVE_WINSOCK2_H
-#    include <winsock2.h>
-#  endif
+#ifdef _WIN32
+#  include <winsock2.h>
 #endif
-/* includes start */
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
-#ifdef HAVE_SYS_SOCKET_H
+#ifndef _WIN32
 #  include <sys/socket.h>
 #endif
-/* includes end */
-
-int
-main ()
+int main(void)
 {
-        if(0 != setsockopt(0, SOL_SOCKET, SO_NONBLOCK, 0, 0))
-          return 1;
-  ;
+  if(0 != setsockopt(0, SOL_SOCKET, SO_NONBLOCK, 0, 0))
+    return 1;
   return 0;
 }
 #endif
+
 #ifdef HAVE_GLIBC_STRERROR_R
 #include <string.h>
 #include <errno.h>
 
-void check(char c) {}
+static void check(char c)
+{
+  (void)c;
+}
 
-int
-main () {
+int main(void)
+{
   char buffer[1024];
-  /* This will not compile if strerror_r does not return a char* */
+  /* This does not compile if strerror_r does not return a char* */
+  /* !checksrc! disable ERRNOVAR 1 */
   check(strerror_r(EACCES, buffer, sizeof(buffer))[0]);
   return 0;
 }
 #endif
+
 #ifdef HAVE_POSIX_STRERROR_R
 #include <string.h>
 #include <errno.h>
 
-/* float, because a pointer can't be implicitly cast to float */
-void check(float f) {}
+/* Float, because a pointer cannot be implicitly cast to float */
+static void check(float f)
+{
+  (void)f;
+}
 
-int
-main () {
+int main(void)
+{
   char buffer[1024];
-  /* This will not compile if strerror_r does not return an int */
+  /* This does not compile if strerror_r does not return an int */
+  /* !checksrc! disable ERRNOVAR 1 */
   check(strerror_r(EACCES, buffer, sizeof(buffer)));
   return 0;
 }
 #endif
+
 #ifdef HAVE_FSETXATTR_6
 #include <sys/xattr.h> /* header from libc, not from libattr */
-int
-main() {
+int main(void)
+{
   fsetxattr(0, 0, 0, 0, 0, 0);
   return 0;
 }
 #endif
+
 #ifdef HAVE_FSETXATTR_5
 #include <sys/xattr.h> /* header from libc, not from libattr */
-int
-main() {
-  fsetxattr(0, 0, 0, 0, 0);
+int main(void)
+{
+  fsetxattr(0, "", 0, 0, 0);
   return 0;
 }
 #endif
+
 #ifdef HAVE_CLOCK_GETTIME_MONOTONIC
 #include <time.h>
-int
-main() {
-  struct timespec ts = {0, 0};
-  clock_gettime(CLOCK_MONOTONIC, &ts);
+int main(void)
+{
+  struct timespec ts;
+  (void)clock_gettime(CLOCK_MONOTONIC, &ts);
+  (void)ts;
   return 0;
 }
 #endif
+
 #ifdef HAVE_BUILTIN_AVAILABLE
-int
-main() {
-  if(__builtin_available(macOS 10.12, *)) {}
+int main(void)
+{
+  if(__builtin_available(macOS 10.12, iOS 5.0, *)) {}
   return 0;
 }
 #endif
-#ifdef HAVE_VARIADIC_MACROS_C99
-#define c99_vmacro3(first, ...) fun3(first, __VA_ARGS__)
-#define c99_vmacro2(first, ...) fun2(first, __VA_ARGS__)
 
-int fun3(int arg1, int arg2, int arg3);
-int fun2(int arg1, int arg2);
-
-int fun3(int arg1, int arg2, int arg3) {
-  return arg1 + arg2 + arg3;
-}
-int fun2(int arg1, int arg2) {
-  return arg1 + arg2;
-}
-
-int
-main() {
-  int res3 = c99_vmacro3(1, 2, 3);
-  int res2 = c99_vmacro2(1, 2);
-  (void)res3;
-  (void)res2;
-  return 0;
-}
-#endif
-#ifdef HAVE_VARIADIC_MACROS_GCC
-#define gcc_vmacro3(first, args...) fun3(first, args)
-#define gcc_vmacro2(first, args...) fun2(first, args)
-
-int fun3(int arg1, int arg2, int arg3);
-int fun2(int arg1, int arg2);
-
-int fun3(int arg1, int arg2, int arg3) {
-  return arg1 + arg2 + arg3;
-}
-int fun2(int arg1, int arg2) {
-  return arg1 + arg2;
-}
-
-int
-main() {
-  int res3 = gcc_vmacro3(1, 2, 3);
-  int res2 = gcc_vmacro2(1, 2);
-  (void)res3;
-  (void)res2;
-  return 0;
-}
-#endif
 #ifdef HAVE_ATOMIC
-/* includes start */
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
@@ -505,28 +357,45 @@ main() {
 #ifdef HAVE_STDATOMIC_H
 #  include <stdatomic.h>
 #endif
-/* includes end */
-
-int
-main() {
+int main(void)
+{
   _Atomic int i = 1;
   i = 0;  /* Force an atomic-write operation. */
   return i;
 }
 #endif
+
 #ifdef HAVE_WIN32_WINNT
-/* includes start */
-#ifdef WIN32
-#  include "../lib/setup-win32.h"
+#ifdef _WIN32
+#  ifndef NOGDI
+#  define NOGDI
+#  endif
+#  include <windows.h>
 #endif
-/* includes end */
 
 #define enquote(x) #x
 #define expand(x) enquote(x)
 #pragma message("_WIN32_WINNT=" expand(_WIN32_WINNT))
 
-int
-main() {
+int main(void)
+{
+  return 0;
+}
+#endif
+
+#ifdef MINGW64_VERSION
+#ifdef __MINGW32__
+#  include <_mingw.h>
+#endif
+
+#define enquote(x) #x
+#define expand(x) enquote(x)
+#pragma message("MINGW64_VERSION=" \
+  expand(__MINGW64_VERSION_MAJOR) "." \
+  expand(__MINGW64_VERSION_MINOR))
+
+int main(void)
+{
   return 0;
 }
 #endif
diff --git a/third-party/curl/CMake/FindBearSSL.cmake b/third-party/curl/CMake/FindBearSSL.cmake
deleted file mode 100644
index 56a064eacd..0000000000
--- a/third-party/curl/CMake/FindBearSSL.cmake
+++ /dev/null
@@ -1,32 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-find_path(BEARSSL_INCLUDE_DIRS bearssl.h)
-
-find_library(BEARSSL_LIBRARY bearssl)
-
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(BEARSSL DEFAULT_MSG
-    BEARSSL_INCLUDE_DIRS BEARSSL_LIBRARY)
-
-mark_as_advanced(BEARSSL_INCLUDE_DIRS BEARSSL_LIBRARY)
diff --git a/third-party/curl/CMake/FindBrotli.cmake b/third-party/curl/CMake/FindBrotli.cmake
index 11ab7f8254..bd3363cce0 100644
--- a/third-party/curl/CMake/FindBrotli.cmake
+++ b/third-party/curl/CMake/FindBrotli.cmake
@@ -21,23 +21,76 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-include(FindPackageHandleStandardArgs)
+# Find the brotli library
+#
+# Input variables:
+#
+# - `BROTLI_INCLUDE_DIR`:      Absolute path to brotli include directory.
+# - `BROTLICOMMON_LIBRARY`:    Absolute path to `brotlicommon` library.
+# - `BROTLIDEC_LIBRARY`:       Absolute path to `brotlidec` library.
+# - `BROTLI_USE_STATIC_LIBS`:  Configure for static brotli libraries.
+#
+# Defines:
+#
+# - `BROTLI_FOUND`:            System has brotli.
+# - `BROTLI_VERSION`:          Version of brotli.
+# - `CURL::brotli`:            brotli library target.
 
-find_path(BROTLI_INCLUDE_DIR "brotli/decode.h")
+set(_brotli_pc_requires "libbrotlidec" "libbrotlicommon")  # order is significant: brotlidec then brotlicommon
 
-find_library(BROTLICOMMON_LIBRARY NAMES brotlicommon)
-find_library(BROTLIDEC_LIBRARY NAMES brotlidec)
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED BROTLI_INCLUDE_DIR AND
+   NOT DEFINED BROTLICOMMON_LIBRARY AND
+   NOT DEFINED BROTLIDEC_LIBRARY)
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(_brotli ${_brotli_pc_requires})
+endif()
 
-find_package_handle_standard_args(Brotli
-    FOUND_VAR
-      BROTLI_FOUND
+if(_brotli_FOUND)
+  set(Brotli_FOUND TRUE)
+  set(BROTLI_FOUND TRUE)
+  set(BROTLI_VERSION ${_brotli_libbrotlicommon_VERSION})
+  if(BROTLI_USE_STATIC_LIBS)
+    set(_brotli_CFLAGS       "${_brotli_STATIC_CFLAGS}")
+    set(_brotli_INCLUDE_DIRS "${_brotli_STATIC_INCLUDE_DIRS}")
+    set(_brotli_LIBRARY_DIRS "${_brotli_STATIC_LIBRARY_DIRS}")
+    set(_brotli_LIBRARIES    "${_brotli_STATIC_LIBRARIES}")
+  endif()
+  message(STATUS "Found Brotli (via pkg-config): ${_brotli_INCLUDE_DIRS} (found version \"${BROTLI_VERSION}\")")
+else()
+  find_path(BROTLI_INCLUDE_DIR "brotli/decode.h")
+  if(BROTLI_USE_STATIC_LIBS)
+    find_library(BROTLICOMMON_LIBRARY NAMES "brotlicommon-static" "brotlicommon")
+    find_library(BROTLIDEC_LIBRARY NAMES "brotlidec-static" "brotlidec")
+  else()
+    find_library(BROTLICOMMON_LIBRARY NAMES "brotlicommon")
+    find_library(BROTLIDEC_LIBRARY NAMES "brotlidec")
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Brotli
     REQUIRED_VARS
+      BROTLI_INCLUDE_DIR
       BROTLIDEC_LIBRARY
       BROTLICOMMON_LIBRARY
-      BROTLI_INCLUDE_DIR
-    FAIL_MESSAGE
-      "Could NOT find Brotli"
-)
+  )
 
-set(BROTLI_INCLUDE_DIRS ${BROTLI_INCLUDE_DIR})
-set(BROTLI_LIBRARIES ${BROTLICOMMON_LIBRARY} ${BROTLIDEC_LIBRARY})
+  if(BROTLI_FOUND)
+    set(_brotli_INCLUDE_DIRS ${BROTLI_INCLUDE_DIR})
+    set(_brotli_LIBRARIES ${BROTLIDEC_LIBRARY} ${BROTLICOMMON_LIBRARY})
+  endif()
+
+  mark_as_advanced(BROTLI_INCLUDE_DIR BROTLIDEC_LIBRARY BROTLICOMMON_LIBRARY)
+endif()
+
+if(BROTLI_FOUND)
+  if(NOT TARGET CURL::brotli)
+    add_library(CURL::brotli INTERFACE IMPORTED)
+    set_target_properties(CURL::brotli PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_brotli_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_brotli_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_brotli_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_brotli_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_brotli_LIBRARIES}")
+  endif()
+endif()
diff --git a/third-party/curl/CMake/FindCARES.cmake b/third-party/curl/CMake/FindCARES.cmake
index fa75891189..26efdf87ff 100644
--- a/third-party/curl/CMake/FindCARES.cmake
+++ b/third-party/curl/CMake/FindCARES.cmake
@@ -21,27 +21,112 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# - Find c-ares
-# Find the c-ares includes and library
-# This module defines
-#  CARES_INCLUDE_DIR, where to find ares.h, etc.
-#  CARES_LIBRARIES, the libraries needed to use c-ares.
-#  CARES_FOUND, If false, do not try to use c-ares.
-# also defined, but not for general use are
-# CARES_LIBRARY, where to find the c-ares library.
+# Find the c-ares library
+#
+# Input variables:
+#
+# - `CARES_INCLUDE_DIR`:      Absolute path to c-ares include directory.
+# - `CARES_LIBRARY`:          Absolute path to `cares` library.
+# - `CARES_USE_STATIC_LIBS`:  Configure for static c-ares libraries.
+#
+# Defines:
+#
+# - `CARES_FOUND`:            System has c-ares.
+# - `CARES_VERSION`:          Version of c-ares.
+# - `CURL::cares`:            c-ares library target.
 
-find_path(CARES_INCLUDE_DIR ares.h)
+set(_cares_pc_requires "libcares")
 
-set(CARES_NAMES ${CARES_NAMES} cares)
-find_library(CARES_LIBRARY
-  NAMES ${CARES_NAMES}
+if(NOT DEFINED CARES_INCLUDE_DIR AND
+   NOT DEFINED CARES_LIBRARY)
+  if(CURL_USE_PKGCONFIG)
+    find_package(PkgConfig QUIET)
+    pkg_check_modules(_cares ${_cares_pc_requires})
+  endif()
+  if(NOT _cares_FOUND AND CURL_USE_CMAKECONFIG)
+    find_package(c-ares CONFIG QUIET)
+  endif()
+endif()
+
+if(_cares_FOUND)
+  set(Cares_FOUND TRUE)
+  set(CARES_FOUND TRUE)
+  set(CARES_VERSION ${_cares_VERSION})
+  if(CARES_USE_STATIC_LIBS)
+    set(_cares_CFLAGS       "${_cares_STATIC_CFLAGS}")
+    set(_cares_INCLUDE_DIRS "${_cares_STATIC_INCLUDE_DIRS}")
+    set(_cares_LIBRARY_DIRS "${_cares_STATIC_LIBRARY_DIRS}")
+    set(_cares_LIBRARIES    "${_cares_STATIC_LIBRARIES}")
+  endif()
+  message(STATUS "Found Cares (via pkg-config): ${_cares_INCLUDE_DIRS} (found version \"${CARES_VERSION}\")")
+elseif(c-ares_CONFIG)
+  set(Cares_FOUND TRUE)
+  set(CARES_FOUND TRUE)
+  set(CARES_VERSION ${c-ares_VERSION})
+  if(CARES_USE_STATIC_LIBS)
+    set(_cares_LIBRARIES c-ares::cares_static)
+  else()
+    set(_cares_LIBRARIES c-ares::cares)
+  endif()
+  message(STATUS "Found Cares (via CMake Config): ${c-ares_CONFIG} (found version \"${CARES_VERSION}\")")
+else()
+  find_path(CARES_INCLUDE_DIR NAMES "ares.h")
+  if(CARES_USE_STATIC_LIBS)
+    set(_cares_CFLAGS "-DCARES_STATICLIB")
+    find_library(CARES_LIBRARY NAMES ${CARES_NAMES} "cares_static" "cares")
+  else()
+    find_library(CARES_LIBRARY NAMES ${CARES_NAMES} "cares")
+  endif()
+
+  unset(CARES_VERSION CACHE)
+  if(CARES_INCLUDE_DIR AND EXISTS "${CARES_INCLUDE_DIR}/ares_version.h")
+    set(_version_regex1 "#[\t ]*define[\t ]+ARES_VERSION_MAJOR[\t ]+([0-9]+).*")
+    set(_version_regex2 "#[\t ]*define[\t ]+ARES_VERSION_MINOR[\t ]+([0-9]+).*")
+    set(_version_regex3 "#[\t ]*define[\t ]+ARES_VERSION_PATCH[\t ]+([0-9]+).*")
+    file(STRINGS "${CARES_INCLUDE_DIR}/ares_version.h" _version_str1 REGEX "${_version_regex1}")
+    file(STRINGS "${CARES_INCLUDE_DIR}/ares_version.h" _version_str2 REGEX "${_version_regex2}")
+    file(STRINGS "${CARES_INCLUDE_DIR}/ares_version.h" _version_str3 REGEX "${_version_regex3}")
+    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
+    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
+    string(REGEX REPLACE "${_version_regex3}" "\\1" _version_str3 "${_version_str3}")
+    set(CARES_VERSION "${_version_str1}.${_version_str2}.${_version_str3}")
+    unset(_version_regex1)
+    unset(_version_regex2)
+    unset(_version_regex3)
+    unset(_version_str1)
+    unset(_version_str2)
+    unset(_version_str3)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Cares
+    REQUIRED_VARS
+      CARES_INCLUDE_DIR
+      CARES_LIBRARY
+    VERSION_VAR
+      CARES_VERSION
   )
 
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(CARES
-    REQUIRED_VARS CARES_LIBRARY CARES_INCLUDE_DIR)
+  if(CARES_FOUND)
+    set(_cares_INCLUDE_DIRS ${CARES_INCLUDE_DIR})
+    set(_cares_LIBRARIES    ${CARES_LIBRARY})
+  endif()
 
-mark_as_advanced(
-  CARES_LIBRARY
-  CARES_INCLUDE_DIR
-  )
+  mark_as_advanced(CARES_INCLUDE_DIR CARES_LIBRARY)
+endif()
+
+if(CARES_FOUND)
+  if(WIN32)
+    list(APPEND _cares_LIBRARIES "iphlpapi")  # for if_indextoname and others
+  endif()
+
+  if(NOT TARGET CURL::cares)
+    add_library(CURL::cares INTERFACE IMPORTED)
+    set_target_properties(CURL::cares PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_cares_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_cares_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_cares_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_cares_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_cares_LIBRARIES}")
+  endif()
+endif()
diff --git a/third-party/curl/CMake/FindGSS.cmake b/third-party/curl/CMake/FindGSS.cmake
index b244e610ec..6f352b2e4f 100644
--- a/third-party/curl/CMake/FindGSS.cmake
+++ b/third-party/curl/CMake/FindGSS.cmake
@@ -21,292 +21,244 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# - Try to find the GSS Kerberos library
-# Once done this will define
+# Find the GSS Kerberos library
 #
-#  GSS_ROOT_DIR - Set this variable to the root installation of GSS
+# Input variables:
 #
-# Read-Only variables:
-#  GSS_FOUND - system has the Heimdal library
-#  GSS_FLAVOUR - "MIT" or "Heimdal" if anything found.
-#  GSS_INCLUDE_DIR - the Heimdal include directory
-#  GSS_LIBRARIES - The libraries needed to use GSS
-#  GSS_LINK_DIRECTORIES - Directories to add to linker search path
-#  GSS_LINKER_FLAGS - Additional linker flags
-#  GSS_COMPILER_FLAGS - Additional compiler flags
-#  GSS_VERSION - This is set to version advertised by pkg-config or read from manifest.
-#                In case the library is found but no version info available it'll be set to "unknown"
+# - `GSS_ROOT_DIR`:  Absolute path to the root installation of GSS. (also supported as environment)
+#
+# Defines:
+#
+# - `GSS_FOUND`:     System has GSS.
+# - `GSS_VERSION`:   Version of GSS.
+# - `CURL::gss`:     GSS library target.
+#   - `INTERFACE_CURL_GSS_FLAVOR`: Custom property. "GNU" or "MIT" if detected.
 
-set(_MIT_MODNAME mit-krb5-gssapi)
-set(_HEIMDAL_MODNAME heimdal-gssapi)
+set(_gnu_modname "gss")
+set(_mit_modname "mit-krb5-gssapi")
 
 include(CheckIncludeFile)
 include(CheckIncludeFiles)
 include(CheckTypeSize)
 
-set(_GSS_ROOT_HINTS
-    "${GSS_ROOT_DIR}"
-    "$ENV{GSS_ROOT_DIR}"
-)
+set(_gss_root_hints "${GSS_ROOT_DIR}" "$ENV{GSS_ROOT_DIR}")
 
-# try to find library using system pkg-config if user didn't specify root dir
+set(_gss_CFLAGS "")
+set(_gss_LIBRARY_DIRS "")
+
+# Try to find library using system pkg-config if user did not specify root dir
 if(NOT GSS_ROOT_DIR AND NOT "$ENV{GSS_ROOT_DIR}")
-  if(UNIX)
+  if(CURL_USE_PKGCONFIG)
     find_package(PkgConfig QUIET)
-    pkg_search_module(_GSS_PKG ${_MIT_MODNAME} ${_HEIMDAL_MODNAME})
-    list(APPEND _GSS_ROOT_HINTS "${_GSS_PKG_PREFIX}")
-  elseif(WIN32)
-    list(APPEND _GSS_ROOT_HINTS "[HKEY_LOCAL_MACHINE\\SOFTWARE\\MIT\\Kerberos;InstallDir]")
+    pkg_search_module(_gss ${_mit_modname} ${_gnu_modname})
+    list(APPEND _gss_root_hints "${_gss_PREFIX}")
+    set(_gss_version "${_gss_VERSION}")
+  endif()
+  if(WIN32)
+    list(APPEND _gss_root_hints "[HKEY_LOCAL_MACHINE\\SOFTWARE\\MIT\\Kerberos;InstallDir]")
   endif()
 endif()
 
-if(NOT _GSS_FOUND) #not found by pkg-config. Let's take more traditional approach.
-  find_file(_GSS_CONFIGURE_SCRIPT
-      NAMES
-          "krb5-config"
-      HINTS
-          ${_GSS_ROOT_HINTS}
-      PATH_SUFFIXES
-          bin
-      NO_CMAKE_PATH
-      NO_CMAKE_ENVIRONMENT_PATH
-  )
+if(NOT _gss_FOUND)  # Not found by pkg-config. Let us take more traditional approach.
+  find_file(_gss_configure_script NAMES "krb5-config" PATH_SUFFIXES "bin" HINTS ${_gss_root_hints}
+    NO_CMAKE_PATH NO_CMAKE_ENVIRONMENT_PATH)
+  # If not found in user-supplied directories, maybe system knows better
+  find_file(_gss_configure_script NAMES "krb5-config" PATH_SUFFIXES "bin")
 
-  # if not found in user-supplied directories, maybe system knows better
-  find_file(_GSS_CONFIGURE_SCRIPT
-      NAMES
-          "krb5-config"
-      PATH_SUFFIXES
-          bin
-  )
+  if(_gss_configure_script)
 
-  if(_GSS_CONFIGURE_SCRIPT)
-    execute_process(
-          COMMAND ${_GSS_CONFIGURE_SCRIPT} "--cflags" "gssapi"
-          OUTPUT_VARIABLE _GSS_CFLAGS
-          RESULT_VARIABLE _GSS_CONFIGURE_FAILED
-          OUTPUT_STRIP_TRAILING_WHITESPACE
-      )
-    message(STATUS "CFLAGS: ${_GSS_CFLAGS}")
-    if(NOT _GSS_CONFIGURE_FAILED) # 0 means success
-      # should also work in an odd case when multiple directories are given
-      string(STRIP "${_GSS_CFLAGS}" _GSS_CFLAGS)
-      string(REGEX REPLACE " +-I" ";" _GSS_CFLAGS "${_GSS_CFLAGS}")
-      string(REGEX REPLACE " +-([^I][^ \\t;]*)" ";-\\1" _GSS_CFLAGS "${_GSS_CFLAGS}")
+    set(_gss_INCLUDE_DIRS "")
+    set(_gss_LIBRARIES "")
 
-      foreach(_flag ${_GSS_CFLAGS})
-        if(_flag MATCHES "^-I.*")
-          string(REGEX REPLACE "^-I" "" _val "${_flag}")
-          list(APPEND _GSS_INCLUDE_DIR "${_val}")
+    execute_process(COMMAND ${_gss_configure_script} "--cflags" "gssapi"
+      OUTPUT_VARIABLE _gss_cflags_raw
+      RESULT_VARIABLE _gss_configure_failed
+      OUTPUT_STRIP_TRAILING_WHITESPACE)
+    message(STATUS "FindGSS krb5-config --cflags: ${_gss_cflags_raw}")
+
+    if(NOT _gss_configure_failed)  # 0 means success
+      # Should also work in an odd case when multiple directories are given.
+      string(STRIP "${_gss_cflags_raw}" _gss_cflags_raw)
+      string(REGEX REPLACE " +-(I)" ";-\\1" _gss_cflags_raw "${_gss_cflags_raw}")
+      string(REGEX REPLACE " +-([^I][^ \\t;]*)" ";-\\1" _gss_cflags_raw "${_gss_cflags_raw}")
+
+      foreach(_flag IN LISTS _gss_cflags_raw)
+        if(_flag MATCHES "^-I")
+          string(REGEX REPLACE "^-I" "" _flag "${_flag}")
+          list(APPEND _gss_INCLUDE_DIRS "${_flag}")
         else()
-          list(APPEND _GSS_COMPILER_FLAGS "${_flag}")
+          list(APPEND _gss_CFLAGS "${_flag}")
         endif()
       endforeach()
     endif()
 
-    execute_process(
-        COMMAND ${_GSS_CONFIGURE_SCRIPT} "--libs" "gssapi"
-        OUTPUT_VARIABLE _GSS_LIB_FLAGS
-        RESULT_VARIABLE _GSS_CONFIGURE_FAILED
-        OUTPUT_STRIP_TRAILING_WHITESPACE
-    )
-    message(STATUS "LDFLAGS: ${_GSS_LIB_FLAGS}")
+    execute_process(COMMAND ${_gss_configure_script} "--libs" "gssapi"
+      OUTPUT_VARIABLE _gss_lib_flags
+      RESULT_VARIABLE _gss_configure_failed
+      OUTPUT_STRIP_TRAILING_WHITESPACE)
+    message(STATUS "FindGSS krb5-config --libs: ${_gss_lib_flags}")
 
-    if(NOT _GSS_CONFIGURE_FAILED) # 0 means success
-      # this script gives us libraries and link directories. Blah. We have to deal with it.
-      string(STRIP "${_GSS_LIB_FLAGS}" _GSS_LIB_FLAGS)
-      string(REGEX REPLACE " +-(L|l)" ";-\\1" _GSS_LIB_FLAGS "${_GSS_LIB_FLAGS}")
-      string(REGEX REPLACE " +-([^Ll][^ \\t;]*)" ";-\\1" _GSS_LIB_FLAGS "${_GSS_LIB_FLAGS}")
+    if(NOT _gss_configure_failed)  # 0 means success
+      # This script gives us libraries and link directories.
+      string(STRIP "${_gss_lib_flags}" _gss_lib_flags)
+      string(REGEX REPLACE " +-(L|l)" ";-\\1" _gss_lib_flags "${_gss_lib_flags}")
+      string(REGEX REPLACE " +-([^Ll][^ \\t;]*)" ";-\\1" _gss_lib_flags "${_gss_lib_flags}")
 
-      foreach(_flag ${_GSS_LIB_FLAGS})
-        if(_flag MATCHES "^-l.*")
-          string(REGEX REPLACE "^-l" "" _val "${_flag}")
-          list(APPEND _GSS_LIBRARIES "${_val}")
-        elseif(_flag MATCHES "^-L.*")
-          string(REGEX REPLACE "^-L" "" _val "${_flag}")
-          list(APPEND _GSS_LINK_DIRECTORIES "${_val}")
-        else()
-          list(APPEND _GSS_LINKER_FLAGS "${_flag}")
+      foreach(_flag IN LISTS _gss_lib_flags)
+        if(_flag MATCHES "^-l")
+          string(REGEX REPLACE "^-l" "" _flag "${_flag}")
+          list(APPEND _gss_LIBRARIES "${_flag}")
+        elseif(_flag MATCHES "^-L")
+          string(REGEX REPLACE "^-L" "" _flag "${_flag}")
+          list(APPEND _gss_LIBRARY_DIRS "${_flag}")
         endif()
       endforeach()
     endif()
 
-    execute_process(
-        COMMAND ${_GSS_CONFIGURE_SCRIPT} "--version"
-        OUTPUT_VARIABLE _GSS_VERSION
-        RESULT_VARIABLE _GSS_CONFIGURE_FAILED
-        OUTPUT_STRIP_TRAILING_WHITESPACE
-    )
+    execute_process(COMMAND ${_gss_configure_script} "--version"
+      OUTPUT_VARIABLE _gss_version
+      RESULT_VARIABLE _gss_configure_failed
+      OUTPUT_STRIP_TRAILING_WHITESPACE)
 
-    # older versions may not have the "--version" parameter. In this case we just don't care.
-    if(_GSS_CONFIGURE_FAILED)
-      set(_GSS_VERSION 0)
-    endif()
-
-    execute_process(
-        COMMAND ${_GSS_CONFIGURE_SCRIPT} "--vendor"
-        OUTPUT_VARIABLE _GSS_VENDOR
-        RESULT_VARIABLE _GSS_CONFIGURE_FAILED
-        OUTPUT_STRIP_TRAILING_WHITESPACE
-    )
-
-    # older versions may not have the "--vendor" parameter. In this case we just don't care.
-    if(_GSS_CONFIGURE_FAILED)
-      set(GSS_FLAVOUR "Heimdal") # most probably, shouldn't really matter
+    # Older versions may not have the "--version" parameter. In this case we do not care.
+    if(_gss_configure_failed)
+      set(_gss_version 0)
     else()
-      if(_GSS_VENDOR MATCHES ".*H|heimdal.*")
-        set(GSS_FLAVOUR "Heimdal")
-      else()
-        set(GSS_FLAVOUR "MIT")
-      endif()
+      # Strip prefix string to leave the version number only
+      string(REPLACE "Kerberos 5 release " "" _gss_version "${_gss_version}")
     endif()
 
-  else() # either there is no config script or we are on a platform that doesn't provide one (Windows?)
+    execute_process(COMMAND ${_gss_configure_script} "--vendor"
+      OUTPUT_VARIABLE _gss_vendor
+      RESULT_VARIABLE _gss_configure_failed
+      OUTPUT_STRIP_TRAILING_WHITESPACE)
 
-    find_path(_GSS_INCLUDE_DIR
-        NAMES
-            "gssapi/gssapi.h"
-        HINTS
-            ${_GSS_ROOT_HINTS}
-        PATH_SUFFIXES
-            include
-            inc
-    )
-
-    if(_GSS_INCLUDE_DIR) #jay, we've found something
-      set(CMAKE_REQUIRED_INCLUDES "${_GSS_INCLUDE_DIR}")
-      check_include_files( "gssapi/gssapi_generic.h;gssapi/gssapi_krb5.h" _GSS_HAVE_MIT_HEADERS)
-
-      if(_GSS_HAVE_MIT_HEADERS)
-        set(GSS_FLAVOUR "MIT")
-      else()
-        # prevent compiling the header - just check if we can include it
-        list(APPEND CMAKE_REQUIRED_DEFINITIONS -D__ROKEN_H__)
-        check_include_file( "roken.h" _GSS_HAVE_ROKEN_H)
-
-        check_include_file( "heimdal/roken.h" _GSS_HAVE_HEIMDAL_ROKEN_H)
-        if(_GSS_HAVE_ROKEN_H OR _GSS_HAVE_HEIMDAL_ROKEN_H)
-          set(GSS_FLAVOUR "Heimdal")
-        endif()
-        list(REMOVE_ITEM CMAKE_REQUIRED_DEFINITIONS -D__ROKEN_H__)
-      endif()
-    else()
-      # I'm not convinced if this is the right way but this is what autotools do at the moment
-      find_path(_GSS_INCLUDE_DIR
-          NAMES
-              "gssapi.h"
-          HINTS
-              ${_GSS_ROOT_HINTS}
-          PATH_SUFFIXES
-              include
-              inc
-      )
-
-      if(_GSS_INCLUDE_DIR)
-        set(GSS_FLAVOUR "Heimdal")
-      endif()
+    # Older versions may not have the "--vendor" parameter. In this case we do not care.
+    if(NOT _gss_configure_failed AND NOT _gss_vendor MATCHES "Heimdal|heimdal")
+      set(_gss_flavor "MIT")  # assume a default, should not really matter
     endif()
 
-    # if we have headers, check if we can link libraries
-    if(GSS_FLAVOUR)
-      set(_GSS_LIBDIR_SUFFIXES "")
-      set(_GSS_LIBDIR_HINTS ${_GSS_ROOT_HINTS})
-      get_filename_component(_GSS_CALCULATED_POTENTIAL_ROOT "${_GSS_INCLUDE_DIR}" PATH)
-      list(APPEND _GSS_LIBDIR_HINTS ${_GSS_CALCULATED_POTENTIAL_ROOT})
+  else()  # Either there is no config script or we are on a platform that does not provide one (Windows?)
 
-      if(WIN32)
-        if(CMAKE_SIZEOF_VOID_P EQUAL 8)
-          list(APPEND _GSS_LIBDIR_SUFFIXES "lib/AMD64")
-          if(GSS_FLAVOUR STREQUAL "MIT")
-            set(_GSS_LIBNAME "gssapi64")
+    find_path(_gss_INCLUDE_DIRS NAMES "gssapi/gssapi.h" HINTS ${_gss_root_hints} PATH_SUFFIXES "include" "inc")
+
+    if(_gss_INCLUDE_DIRS)  # We have found something
+      set(_gss_libdir_suffixes "")
+
+      cmake_push_check_state()
+      list(APPEND CMAKE_REQUIRED_INCLUDES "${_gss_INCLUDE_DIRS}")
+      check_include_files("gssapi/gssapi_generic.h;gssapi/gssapi_krb5.h" _gss_have_mit_headers)
+      cmake_pop_check_state()
+
+      if(_gss_have_mit_headers)
+        set(_gss_flavor "MIT")
+        if(WIN32)
+          if(CMAKE_SIZEOF_VOID_P EQUAL 8)
+            list(APPEND _gss_libdir_suffixes "lib/AMD64")
+            set(_gss_libname "gssapi64")
           else()
-            set(_GSS_LIBNAME "libgssapi")
+            list(APPEND _gss_libdir_suffixes "lib/i386")
+            set(_gss_libname "gssapi32")
           endif()
         else()
-          list(APPEND _GSS_LIBDIR_SUFFIXES "lib/i386")
-          if(GSS_FLAVOUR STREQUAL "MIT")
-            set(_GSS_LIBNAME "gssapi32")
-          else()
-            set(_GSS_LIBNAME "libgssapi")
-          endif()
-        endif()
-      else()
-        list(APPEND _GSS_LIBDIR_SUFFIXES "lib;lib64") # those suffixes are not checked for HINTS
-        if(GSS_FLAVOUR STREQUAL "MIT")
-          set(_GSS_LIBNAME "gssapi_krb5")
-        else()
-          set(_GSS_LIBNAME "gssapi")
+          list(APPEND _gss_libdir_suffixes "lib" "lib64")  # those suffixes are not checked for HINTS
+          set(_gss_libname "gssapi_krb5")
         endif()
       endif()
+    else()
+      find_path(_gss_INCLUDE_DIRS NAMES "gss.h" HINTS ${_gss_root_hints} PATH_SUFFIXES "include")
 
-      find_library(_GSS_LIBRARIES
-          NAMES
-              ${_GSS_LIBNAME}
-          HINTS
-              ${_GSS_LIBDIR_HINTS}
-          PATH_SUFFIXES
-              ${_GSS_LIBDIR_SUFFIXES}
-      )
-
+      if(_gss_INCLUDE_DIRS)
+        set(_gss_flavor "GNU")
+        set(_gss_pc_requires ${_gnu_modname})
+        set(_gss_libname "gss")
+      endif()
     endif()
+
+    # If we have headers, look up libraries
+    if(_gss_flavor)
+      set(_gss_libdir_hints ${_gss_root_hints})
+      if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.20)
+        cmake_path(GET _gss_INCLUDE_DIRS PARENT_PATH _gss_calculated_potential_root)
+      else()
+        get_filename_component(_gss_calculated_potential_root "${_gss_INCLUDE_DIRS}" DIRECTORY)
+      endif()
+      list(APPEND _gss_libdir_hints ${_gss_calculated_potential_root})
+
+      find_library(_gss_LIBRARIES NAMES ${_gss_libname} HINTS ${_gss_libdir_hints} PATH_SUFFIXES ${_gss_libdir_suffixes})
+    endif()
+  endif()
+  if(NOT _gss_flavor)
+    message(FATAL_ERROR "GNU or MIT GSS is required")
   endif()
 else()
-  if(_GSS_PKG_${_MIT_MODNAME}_VERSION)
-    set(GSS_FLAVOUR "MIT")
-    set(_GSS_VERSION _GSS_PKG_${_MIT_MODNAME}_VERSION)
+  if(_gss_MODULE_NAME STREQUAL _gnu_modname)
+    set(_gss_flavor "GNU")
+    set(_gss_pc_requires ${_gnu_modname})
+  elseif(_gss_MODULE_NAME STREQUAL _mit_modname)
+    set(_gss_flavor "MIT")
+    set(_gss_pc_requires ${_mit_modname})
   else()
-    set(GSS_FLAVOUR "Heimdal")
-    set(_GSS_VERSION _GSS_PKG_${_MIT_HEIMDAL}_VERSION)
+    message(FATAL_ERROR "GNU or MIT GSS is required")
   endif()
+  message(STATUS "Found GSS/${_gss_flavor} (via pkg-config): ${_gss_INCLUDE_DIRS} (found version \"${_gss_version}\")")
 endif()
 
-set(GSS_INCLUDE_DIR ${_GSS_INCLUDE_DIR})
-set(GSS_LIBRARIES ${_GSS_LIBRARIES})
-set(GSS_LINK_DIRECTORIES ${_GSS_LINK_DIRECTORIES})
-set(GSS_LINKER_FLAGS ${_GSS_LINKER_FLAGS})
-set(GSS_COMPILER_FLAGS ${_GSS_COMPILER_FLAGS})
-set(GSS_VERSION ${_GSS_VERSION})
+set(GSS_VERSION ${_gss_version})
 
-if(GSS_FLAVOUR)
-  if(NOT GSS_VERSION AND GSS_FLAVOUR STREQUAL "Heimdal")
-    if(CMAKE_SIZEOF_VOID_P EQUAL 8)
-      set(HEIMDAL_MANIFEST_FILE "Heimdal.Application.amd64.manifest")
+if(NOT GSS_VERSION)
+  if(_gss_flavor STREQUAL "MIT" AND WIN32)
+    if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.24)
+      cmake_host_system_information(RESULT _mit_version QUERY WINDOWS_REGISTRY
+        "HKLM/SOFTWARE/MIT/Kerberos/SDK/CurrentVersion" VALUE "VersionString")
     else()
-      set(HEIMDAL_MANIFEST_FILE "Heimdal.Application.x86.manifest")
+      get_filename_component(_mit_version
+        "[HKEY_LOCAL_MACHINE\\SOFTWARE\\MIT\\Kerberos\\SDK\\CurrentVersion;VersionString]" NAME CACHE)
     endif()
-
-    if(EXISTS "${GSS_INCLUDE_DIR}/${HEIMDAL_MANIFEST_FILE}")
-      file(STRINGS "${GSS_INCLUDE_DIR}/${HEIMDAL_MANIFEST_FILE}" heimdal_version_str
-           REGEX "^.*version=\"[0-9]\\.[^\"]+\".*$")
-
-      string(REGEX MATCH "[0-9]\\.[^\"]+"
-             GSS_VERSION "${heimdal_version_str}")
-    endif()
-
-    if(NOT GSS_VERSION)
-      set(GSS_VERSION "Heimdal Unknown")
-    endif()
-  elseif(NOT GSS_VERSION AND GSS_FLAVOUR STREQUAL "MIT")
-    get_filename_component(_MIT_VERSION "[HKEY_LOCAL_MACHINE\\SOFTWARE\\MIT\\Kerberos\\SDK\\CurrentVersion;VersionString]" NAME CACHE)
-    if(WIN32 AND _MIT_VERSION)
-      set(GSS_VERSION "${_MIT_VERSION}")
-    else()
-      set(GSS_VERSION "MIT Unknown")
+    set(GSS_VERSION "${_mit_version}")
+  elseif(_gss_flavor STREQUAL "GNU")
+    if(_gss_INCLUDE_DIRS AND EXISTS "${_gss_INCLUDE_DIRS}/gss.h")
+      set(_version_regex "#[\t ]*define[\t ]+GSS_VERSION[\t ]+\"([^\"]*)\"")
+      file(STRINGS "${_gss_INCLUDE_DIRS}/gss.h" _version_str REGEX "${_version_regex}")
+      string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+      set(GSS_VERSION "${_version_str}")
+      unset(_version_regex)
+      unset(_version_str)
     endif()
   endif()
 endif()
 
 include(FindPackageHandleStandardArgs)
-
-set(_GSS_REQUIRED_VARS GSS_LIBRARIES GSS_FLAVOUR)
-
 find_package_handle_standard_args(GSS
-    REQUIRED_VARS
-        ${_GSS_REQUIRED_VARS}
-    VERSION_VAR
-        GSS_VERSION
-    FAIL_MESSAGE
-        "Could NOT find GSS, try to set the path to GSS root folder in the system variable GSS_ROOT_DIR"
+  REQUIRED_VARS
+    _gss_flavor
+    _gss_LIBRARIES
+  VERSION_VAR
+    GSS_VERSION
+  FAIL_MESSAGE
+    "Could NOT find GSS, try to set the absolute path to GSS installation root directory in the environment variable GSS_ROOT_DIR"
 )
 
-mark_as_advanced(GSS_INCLUDE_DIR GSS_LIBRARIES)
+mark_as_advanced(
+  _gss_CFLAGS
+  _gss_FOUND
+  _gss_INCLUDE_DIRS
+  _gss_LIBRARIES
+  _gss_LIBRARY_DIRS
+  _gss_MODULE_NAME
+  _gss_PREFIX
+  _gss_version
+)
+
+if(GSS_FOUND)
+  if(NOT TARGET CURL::gss)
+    add_library(CURL::gss INTERFACE IMPORTED)
+    set_target_properties(CURL::gss PROPERTIES
+      INTERFACE_CURL_GSS_FLAVOR "${_gss_flavor}"
+      INTERFACE_LIBCURL_PC_MODULES "${_gss_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_gss_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_gss_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_gss_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_gss_LIBRARIES}")
+  endif()
+endif()
diff --git a/third-party/curl/CMake/FindGnuTLS.cmake b/third-party/curl/CMake/FindGnuTLS.cmake
new file mode 100644
index 0000000000..7f5b227dc2
--- /dev/null
+++ b/third-party/curl/CMake/FindGnuTLS.cmake
@@ -0,0 +1,92 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Find the GnuTLS library
+#
+# Input variables:
+#
+# - `GNUTLS_INCLUDE_DIR`:  Absolute path to GnuTLS include directory.
+# - `GNUTLS_LIBRARY`:      Absolute path to `gnutls` library.
+#
+# Defines:
+#
+# - `GNUTLS_FOUND`:        System has GnuTLS.
+# - `GNUTLS_VERSION`:      Version of GnuTLS.
+# - `CURL::gnutls`:        GnuTLS library target.
+
+set(_gnutls_pc_requires "gnutls")
+
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED GNUTLS_INCLUDE_DIR AND
+   NOT DEFINED GNUTLS_LIBRARY)
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(_gnutls ${_gnutls_pc_requires})
+endif()
+
+if(_gnutls_FOUND)
+  set(GnuTLS_FOUND TRUE)
+  set(GNUTLS_FOUND TRUE)
+  set(GNUTLS_VERSION ${_gnutls_VERSION})
+  message(STATUS "Found GnuTLS (via pkg-config): ${_gnutls_INCLUDE_DIRS} (found version \"${GNUTLS_VERSION}\")")
+else()
+  find_path(GNUTLS_INCLUDE_DIR NAMES "gnutls/gnutls.h")
+  find_library(GNUTLS_LIBRARY NAMES "gnutls" "libgnutls")
+
+  unset(GNUTLS_VERSION CACHE)
+  if(GNUTLS_INCLUDE_DIR AND EXISTS "${GNUTLS_INCLUDE_DIR}/gnutls/gnutls.h")
+    set(_version_regex "#[\t ]*define[\t ]+GNUTLS_VERSION[\t ]+\"([^\"]*)\"")
+    file(STRINGS "${GNUTLS_INCLUDE_DIR}/gnutls/gnutls.h" _version_str REGEX "${_version_regex}")
+    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+    set(GNUTLS_VERSION "${_version_str}")
+    unset(_version_regex)
+    unset(_version_str)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(GnuTLS
+    REQUIRED_VARS
+      GNUTLS_INCLUDE_DIR
+      GNUTLS_LIBRARY
+    VERSION_VAR
+      GNUTLS_VERSION
+  )
+
+  if(GNUTLS_FOUND)
+    set(_gnutls_INCLUDE_DIRS ${GNUTLS_INCLUDE_DIR})
+    set(_gnutls_LIBRARIES    ${GNUTLS_LIBRARY})
+  endif()
+
+  mark_as_advanced(GNUTLS_INCLUDE_DIR GNUTLS_LIBRARY)
+endif()
+
+if(GNUTLS_FOUND)
+  if(NOT TARGET CURL::gnutls)
+    add_library(CURL::gnutls INTERFACE IMPORTED)
+    set_target_properties(CURL::gnutls PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_gnutls_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_gnutls_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_gnutls_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_gnutls_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_gnutls_LIBRARIES}")
+  endif()
+endif()
diff --git a/third-party/curl/CMake/FindLDAP.cmake b/third-party/curl/CMake/FindLDAP.cmake
new file mode 100644
index 0000000000..8902b23f8d
--- /dev/null
+++ b/third-party/curl/CMake/FindLDAP.cmake
@@ -0,0 +1,115 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Find the ldap library
+#
+# Input variables:
+#
+# - `LDAP_INCLUDE_DIR`:   Absolute path to ldap include directory.
+# - `LDAP_LIBRARY`:       Absolute path to `ldap` library.
+# - `LDAP_LBER_LIBRARY`:  Absolute path to `lber` library.
+#
+# Defines:
+#
+# - `LDAP_FOUND`:         System has ldap.
+# - `LDAP_VERSION`:       Version of ldap.
+# - `CURL::ldap`:         ldap library target.
+
+set(_ldap_pc_requires "ldap" "lber")
+
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED LDAP_INCLUDE_DIR AND
+   NOT DEFINED LDAP_LIBRARY AND
+   NOT DEFINED LDAP_LBER_LIBRARY)
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(_ldap ${_ldap_pc_requires})
+endif()
+
+if(_ldap_FOUND)
+  set(LDAP_FOUND TRUE)
+  set(LDAP_VERSION ${_ldap_ldap_VERSION})
+  message(STATUS "Found LDAP (via pkg-config): ${_ldap_INCLUDE_DIRS} (found version \"${LDAP_VERSION}\")")
+else()
+  set(_ldap_pc_requires "")  # Depend on pkg-config only when found via pkg-config
+
+  # On Apple the SDK LDAP gets picked up from
+  # 'MacOSX.sdk/System/Library/Frameworks/LDAP.framework/Headers', which contains
+  # ldap.h and lber.h both being stubs to include <ldap.h> and <lber.h>.
+  # This causes an infinite inclusion loop in compile. Also do this for libraries
+  # to avoid picking up the 'ldap.framework' with a full path.
+  set(_save_cmake_system_framework_path ${CMAKE_SYSTEM_FRAMEWORK_PATH})
+  set(CMAKE_SYSTEM_FRAMEWORK_PATH "")
+  find_path(LDAP_INCLUDE_DIR NAMES "ldap.h")
+  find_library(LDAP_LIBRARY NAMES "ldap")
+  find_library(LDAP_LBER_LIBRARY NAMES "lber")
+  set(CMAKE_SYSTEM_FRAMEWORK_PATH ${_save_cmake_system_framework_path})
+
+  unset(LDAP_VERSION CACHE)
+  if(LDAP_INCLUDE_DIR AND EXISTS "${LDAP_INCLUDE_DIR}/ldap_features.h")
+    set(_version_regex1 "#[\t ]*define[\t ]+LDAP_VENDOR_VERSION_MAJOR[\t ]+([0-9]+).*")
+    set(_version_regex2 "#[\t ]*define[\t ]+LDAP_VENDOR_VERSION_MINOR[\t ]+([0-9]+).*")
+    set(_version_regex3 "#[\t ]*define[\t ]+LDAP_VENDOR_VERSION_PATCH[\t ]+([0-9]+).*")
+    file(STRINGS "${LDAP_INCLUDE_DIR}/ldap_features.h" _version_str1 REGEX "${_version_regex1}")
+    file(STRINGS "${LDAP_INCLUDE_DIR}/ldap_features.h" _version_str2 REGEX "${_version_regex2}")
+    file(STRINGS "${LDAP_INCLUDE_DIR}/ldap_features.h" _version_str3 REGEX "${_version_regex3}")
+    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
+    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
+    string(REGEX REPLACE "${_version_regex3}" "\\1" _version_str3 "${_version_str3}")
+    set(LDAP_VERSION "${_version_str1}.${_version_str2}.${_version_str3}")
+    unset(_version_regex1)
+    unset(_version_regex2)
+    unset(_version_regex3)
+    unset(_version_str1)
+    unset(_version_str2)
+    unset(_version_str3)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(LDAP
+    REQUIRED_VARS
+      LDAP_INCLUDE_DIR
+      LDAP_LIBRARY
+      LDAP_LBER_LIBRARY
+    VERSION_VAR
+      LDAP_VERSION
+  )
+
+  if(LDAP_FOUND)
+    set(_ldap_INCLUDE_DIRS ${LDAP_INCLUDE_DIR})
+    set(_ldap_LIBRARIES    ${LDAP_LIBRARY} ${LDAP_LBER_LIBRARY})
+  endif()
+
+  mark_as_advanced(LDAP_INCLUDE_DIR LDAP_LIBRARY LDAP_LBER_LIBRARY)
+endif()
+
+if(LDAP_FOUND)
+  if(NOT TARGET CURL::ldap)
+    add_library(CURL::ldap INTERFACE IMPORTED)
+    set_target_properties(CURL::ldap PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_ldap_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_ldap_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_ldap_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_ldap_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_ldap_LIBRARIES}")
+  endif()
+endif()
diff --git a/third-party/curl/CMake/FindLibPSL.cmake b/third-party/curl/CMake/FindLibPSL.cmake
index e3bd68d1d7..2287e676d3 100644
--- a/third-party/curl/CMake/FindLibPSL.cmake
+++ b/third-party/curl/CMake/FindLibPSL.cmake
@@ -21,25 +21,72 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# - Try to find the libpsl library
-# Once done this will define
+# Find the libpsl library
 #
-# LIBPSL_FOUND - system has the libpsl library
-# LIBPSL_INCLUDE_DIR - the libpsl include directory
-# LIBPSL_LIBRARY - the libpsl library name
+# Input variables:
+#
+# - `LIBPSL_INCLUDE_DIR`:  Absolute path to libpsl include directory.
+# - `LIBPSL_LIBRARY`:      Absolute path to `libpsl` library.
+#
+# Defines:
+#
+# - `LIBPSL_FOUND`:        System has libpsl.
+# - `LIBPSL_VERSION`:      Version of libpsl.
+# - `CURL::libpsl`:        libpsl library target.
 
-find_path(LIBPSL_INCLUDE_DIR libpsl.h)
+set(_libpsl_pc_requires "libpsl")
 
-find_library(LIBPSL_LIBRARY NAMES psl libpsl)
-
-if(LIBPSL_INCLUDE_DIR)
-  file(STRINGS "${LIBPSL_INCLUDE_DIR}/libpsl.h" libpsl_version_str REGEX "^#define[\t ]+PSL_VERSION[\t ]+\"(.*)\"")
-  string(REGEX REPLACE "^.*\"([^\"]+)\"" "\\1"  LIBPSL_VERSION "${libpsl_version_str}")
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED LIBPSL_INCLUDE_DIR AND
+   NOT DEFINED LIBPSL_LIBRARY)
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(_libpsl ${_libpsl_pc_requires})
 endif()
 
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(LibPSL
-    REQUIRED_VARS LIBPSL_LIBRARY LIBPSL_INCLUDE_DIR
-    VERSION_VAR LIBPSL_VERSION)
+if(_libpsl_FOUND AND _libpsl_INCLUDE_DIRS)
+  set(Libpsl_FOUND TRUE)
+  set(LIBPSL_FOUND TRUE)
+  set(LIBPSL_VERSION ${_libpsl_VERSION})
+  message(STATUS "Found Libpsl (via pkg-config): ${_libpsl_INCLUDE_DIRS} (found version \"${LIBPSL_VERSION}\")")
+else()
+  find_path(LIBPSL_INCLUDE_DIR NAMES "libpsl.h")
+  find_library(LIBPSL_LIBRARY NAMES "psl" "libpsl")
 
-mark_as_advanced(LIBPSL_INCLUDE_DIR LIBPSL_LIBRARY)
+  unset(LIBPSL_VERSION CACHE)
+  if(LIBPSL_INCLUDE_DIR AND EXISTS "${LIBPSL_INCLUDE_DIR}/libpsl.h")
+    set(_version_regex "#[\t ]*define[\t ]+PSL_VERSION[\t ]+\"([^\"]*)\"")
+    file(STRINGS "${LIBPSL_INCLUDE_DIR}/libpsl.h" _version_str REGEX "${_version_regex}")
+    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+    set(LIBPSL_VERSION "${_version_str}")
+    unset(_version_regex)
+    unset(_version_str)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Libpsl
+    REQUIRED_VARS
+      LIBPSL_INCLUDE_DIR
+      LIBPSL_LIBRARY
+    VERSION_VAR
+      LIBPSL_VERSION
+  )
+
+  if(LIBPSL_FOUND)
+    set(_libpsl_INCLUDE_DIRS ${LIBPSL_INCLUDE_DIR})
+    set(_libpsl_LIBRARIES    ${LIBPSL_LIBRARY})
+  endif()
+
+  mark_as_advanced(LIBPSL_INCLUDE_DIR LIBPSL_LIBRARY)
+endif()
+
+if(LIBPSL_FOUND)
+  if(NOT TARGET CURL::libpsl)
+    add_library(CURL::libpsl INTERFACE IMPORTED)
+    set_target_properties(CURL::libpsl PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_libpsl_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_libpsl_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_libpsl_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_libpsl_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_libpsl_LIBRARIES}")
+  endif()
+endif()
diff --git a/third-party/curl/CMake/FindLibSSH2.cmake b/third-party/curl/CMake/FindLibSSH2.cmake
index a0c251ae39..22481d67ae 100644
--- a/third-party/curl/CMake/FindLibSSH2.cmake
+++ b/third-party/curl/CMake/FindLibSSH2.cmake
@@ -21,25 +21,97 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# - Try to find the libssh2 library
-# Once done this will define
+# Find the libssh2 library
 #
-# LIBSSH2_FOUND - system has the libssh2 library
-# LIBSSH2_INCLUDE_DIR - the libssh2 include directory
-# LIBSSH2_LIBRARY - the libssh2 library name
+# Input variables:
+#
+# - `LIBSSH2_INCLUDE_DIR`:      Absolute path to libssh2 include directory.
+# - `LIBSSH2_LIBRARY`:          Absolute path to `libssh2` library.
+# - `LIBSSH2_USE_STATIC_LIBS`:  Configure for static libssh2 libraries.
+#
+# Defines:
+#
+# - `LIBSSH2_FOUND`:            System has libssh2.
+# - `LIBSSH2_VERSION`:          Version of libssh2.
+# - `CURL::libssh2`:            libssh2 library target.
 
-find_path(LIBSSH2_INCLUDE_DIR libssh2.h)
+set(_libssh2_pc_requires "libssh2")
 
-find_library(LIBSSH2_LIBRARY NAMES ssh2 libssh2)
-
-if(LIBSSH2_INCLUDE_DIR)
-  file(STRINGS "${LIBSSH2_INCLUDE_DIR}/libssh2.h" libssh2_version_str REGEX "^#define[\t ]+LIBSSH2_VERSION[\t ]+\"(.*)\"")
-  string(REGEX REPLACE "^.*\"([^\"]+)\"" "\\1"  LIBSSH2_VERSION "${libssh2_version_str}")
+if(NOT DEFINED LIBSSH2_INCLUDE_DIR AND
+   NOT DEFINED LIBSSH2_LIBRARY)
+  if(CURL_USE_PKGCONFIG)
+    find_package(PkgConfig QUIET)
+    pkg_check_modules(_libssh2 ${_libssh2_pc_requires})
+  endif()
+  if(NOT _libssh2_FOUND AND CURL_USE_CMAKECONFIG)
+    find_package(libssh2 CONFIG QUIET)
+  endif()
 endif()
 
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(LibSSH2
-    REQUIRED_VARS LIBSSH2_LIBRARY LIBSSH2_INCLUDE_DIR
-    VERSION_VAR LIBSSH2_VERSION)
+if(_libssh2_FOUND AND _libssh2_INCLUDE_DIRS)
+  set(Libssh2_FOUND TRUE)
+  set(LIBSSH2_FOUND TRUE)
+  set(LIBSSH2_VERSION ${_libssh2_VERSION})
+  if(LIBSSH2_USE_STATIC_LIBS)
+    set(_libssh2_CFLAGS       "${_libssh2_STATIC_CFLAGS}")
+    set(_libssh2_INCLUDE_DIRS "${_libssh2_STATIC_INCLUDE_DIRS}")
+    set(_libssh2_LIBRARY_DIRS "${_libssh2_STATIC_LIBRARY_DIRS}")
+    set(_libssh2_LIBRARIES    "${_libssh2_STATIC_LIBRARIES}")
+  endif()
+  message(STATUS "Found Libssh2 (via pkg-config): ${_libssh2_INCLUDE_DIRS} (found version \"${LIBSSH2_VERSION}\")")
+elseif(libssh2_CONFIG)
+  set(Libssh2_FOUND TRUE)
+  set(LIBSSH2_FOUND TRUE)
+  set(LIBSSH2_VERSION ${libssh2_VERSION})
+  if(LIBSSH2_USE_STATIC_LIBS)
+    set(_libssh2_LIBRARIES libssh2::libssh2_static)
+  else()
+    set(_libssh2_LIBRARIES libssh2::libssh2)
+  endif()
+  message(STATUS "Found Libssh2 (via CMake Config): ${libssh2_CONFIG} (found version \"${LIBSSH2_VERSION}\")")
+else()
+  find_path(LIBSSH2_INCLUDE_DIR NAMES "libssh2.h")
+  if(LIBSSH2_USE_STATIC_LIBS)
+    find_library(LIBSSH2_LIBRARY NAMES "ssh2_static" "libssh2_static" "ssh2" "libssh2")
+  else()
+    find_library(LIBSSH2_LIBRARY NAMES "ssh2" "libssh2")
+  endif()
 
-mark_as_advanced(LIBSSH2_INCLUDE_DIR LIBSSH2_LIBRARY)
+  unset(LIBSSH2_VERSION CACHE)
+  if(LIBSSH2_INCLUDE_DIR AND EXISTS "${LIBSSH2_INCLUDE_DIR}/libssh2.h")
+    set(_version_regex "#[\t ]*define[\t ]+LIBSSH2_VERSION[\t ]+\"([^\"]*)\"")
+    file(STRINGS "${LIBSSH2_INCLUDE_DIR}/libssh2.h" _version_str REGEX "${_version_regex}")
+    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+    set(LIBSSH2_VERSION "${_version_str}")
+    unset(_version_regex)
+    unset(_version_str)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Libssh2
+    REQUIRED_VARS
+      LIBSSH2_INCLUDE_DIR
+      LIBSSH2_LIBRARY
+    VERSION_VAR
+      LIBSSH2_VERSION
+  )
+
+  if(LIBSSH2_FOUND)
+    set(_libssh2_INCLUDE_DIRS ${LIBSSH2_INCLUDE_DIR})
+    set(_libssh2_LIBRARIES    ${LIBSSH2_LIBRARY})
+  endif()
+
+  mark_as_advanced(LIBSSH2_INCLUDE_DIR LIBSSH2_LIBRARY)
+endif()
+
+if(LIBSSH2_FOUND)
+  if(NOT TARGET CURL::libssh2)
+    add_library(CURL::libssh2 INTERFACE IMPORTED)
+    set_target_properties(CURL::libssh2 PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_libssh2_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_libssh2_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_libssh2_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_libssh2_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_libssh2_LIBRARIES}")
+  endif()
+endif()
diff --git a/third-party/curl/CMake/FindLibbacktrace.cmake b/third-party/curl/CMake/FindLibbacktrace.cmake
new file mode 100644
index 0000000000..59da7fdf19
--- /dev/null
+++ b/third-party/curl/CMake/FindLibbacktrace.cmake
@@ -0,0 +1,61 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Find the libbacktrace library
+#
+# Input variables:
+#
+# - `LIBBACKTRACE_INCLUDE_DIR`:  Absolute path to libbacktrace include directory.
+# - `LIBBACKTRACE_LIBRARY`:      Absolute path to `libbacktrace` library.
+#
+# Defines:
+#
+# - `LIBBACKTRACE_FOUND`:        System has libbacktrace.
+# - `CURL::libbacktrace`:        libbacktrace library target.
+
+find_path(LIBBACKTRACE_INCLUDE_DIR NAMES "backtrace.h")
+find_library(LIBBACKTRACE_LIBRARY NAMES "backtrace" "libbacktrace")
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(Libbacktrace
+  REQUIRED_VARS
+    LIBBACKTRACE_INCLUDE_DIR
+    LIBBACKTRACE_LIBRARY
+)
+
+if(LIBBACKTRACE_FOUND)
+  set(_libbacktrace_INCLUDE_DIRS ${LIBBACKTRACE_INCLUDE_DIR})
+  set(_libbacktrace_LIBRARIES    ${LIBBACKTRACE_LIBRARY})
+
+  if(NOT TARGET CURL::libbacktrace)
+    add_library(CURL::libbacktrace INTERFACE IMPORTED)
+    set_target_properties(CURL::libbacktrace PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_libbacktrace_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_libbacktrace_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_libbacktrace_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_libbacktrace_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_libbacktrace_LIBRARIES}")
+  endif()
+endif()
+
+mark_as_advanced(LIBBACKTRACE_INCLUDE_DIR LIBBACKTRACE_LIBRARY)
diff --git a/third-party/curl/CMake/FindLibgsasl.cmake b/third-party/curl/CMake/FindLibgsasl.cmake
new file mode 100644
index 0000000000..7fbaa7128f
--- /dev/null
+++ b/third-party/curl/CMake/FindLibgsasl.cmake
@@ -0,0 +1,91 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Find the libgsasl library
+#
+# Input variables:
+#
+# - `LIBGSASL_INCLUDE_DIR`:  Absolute path to libgsasl include directory.
+# - `LIBGSASL_LIBRARY`:      Absolute path to `libgsasl` library.
+#
+# Defines:
+#
+# - `LIBGSASL_FOUND`:        System has libgsasl.
+# - `LIBGSASL_VERSION`:      Version of libgsasl.
+# - `CURL::libgsasl`:        libgsasl library target.
+
+set(_libgsasl_pc_requires "libgsasl")
+
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED LIBGSASL_INCLUDE_DIR AND
+   NOT DEFINED LIBGSASL_LIBRARY)
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(_libgsasl ${_libgsasl_pc_requires})
+endif()
+
+if(_libgsasl_FOUND)
+  set(Libgsasl_FOUND TRUE)
+  set(LIBGSASL_FOUND TRUE)
+  message(STATUS "Found Libgsasl (via pkg-config): ${_libgsasl_INCLUDE_DIRS} (found version \"${LIBGSASL_VERSION}\")")
+else()
+  find_path(LIBGSASL_INCLUDE_DIR NAMES "gsasl.h")
+  find_library(LIBGSASL_LIBRARY NAMES "gsasl" "libgsasl")
+
+  unset(LIBGSASL_VERSION CACHE)
+  if(LIBGSASL_INCLUDE_DIR AND EXISTS "${LIBGSASL_INCLUDE_DIR}/gsasl-version.h")
+    set(_version_regex "#[\t ]*define[\t ]+GSASL_VERSION[\t ]+\"([^\"]*)\"")
+    file(STRINGS "${LIBGSASL_INCLUDE_DIR}/gsasl-version.h" _version_str REGEX "${_version_regex}")
+    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+    set(LIBGSASL_VERSION "${_version_str}")
+    unset(_version_regex)
+    unset(_version_str)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Libgsasl
+  REQUIRED_VARS
+    LIBGSASL_INCLUDE_DIR
+    LIBGSASL_LIBRARY
+  VERSION_VAR
+    LIBGSASL_VERSION
+  )
+
+  if(LIBGSASL_FOUND)
+    set(_libgsasl_INCLUDE_DIRS ${LIBGSASL_INCLUDE_DIR})
+    set(_libgsasl_LIBRARIES    ${LIBGSASL_LIBRARY})
+  endif()
+
+  mark_as_advanced(LIBGSASL_INCLUDE_DIR LIBGSASL_LIBRARY)
+endif()
+
+if(LIBGSASL_FOUND)
+  if(NOT TARGET CURL::libgsasl)
+    add_library(CURL::libgsasl INTERFACE IMPORTED)
+    set_target_properties(CURL::libgsasl PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_libgsasl_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_libgsasl_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_libgsasl_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_libgsasl_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_libgsasl_LIBRARIES}")
+  endif()
+endif()
diff --git a/third-party/curl/CMake/FindLibidn2.cmake b/third-party/curl/CMake/FindLibidn2.cmake
new file mode 100644
index 0000000000..dc7873489a
--- /dev/null
+++ b/third-party/curl/CMake/FindLibidn2.cmake
@@ -0,0 +1,92 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Find the libidn2 library
+#
+# Input variables:
+#
+# - `LIBIDN2_INCLUDE_DIR`:  Absolute path to libidn2 include directory.
+# - `LIBIDN2_LIBRARY`:      Absolute path to `libidn2` library.
+#
+# Defines:
+#
+# - `LIBIDN2_FOUND`:        System has libidn2.
+# - `LIBIDN2_VERSION`:      Version of libidn2.
+# - `CURL::libidn2`:        libidn2 library target.
+
+set(_libidn2_pc_requires "libidn2")
+
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED LIBIDN2_INCLUDE_DIR AND
+   NOT DEFINED LIBIDN2_LIBRARY)
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(_libidn2 ${_libidn2_pc_requires})
+endif()
+
+if(_libidn2_FOUND)
+  set(Libidn2_FOUND TRUE)
+  set(LIBIDN2_FOUND TRUE)
+  set(LIBIDN2_VERSION ${_libidn2_VERSION})
+  message(STATUS "Found Libidn2 (via pkg-config): ${_libidn2_INCLUDE_DIRS} (found version \"${LIBIDN2_VERSION}\")")
+else()
+  find_path(LIBIDN2_INCLUDE_DIR NAMES "idn2.h")
+  find_library(LIBIDN2_LIBRARY NAMES "idn2" "libidn2")
+
+  unset(LIBIDN2_VERSION CACHE)
+  if(LIBIDN2_INCLUDE_DIR AND EXISTS "${LIBIDN2_INCLUDE_DIR}/idn2.h")
+    set(_version_regex "#[\t ]*define[\t ]+IDN2_VERSION[\t ]+\"([^\"]*)\"")
+    file(STRINGS "${LIBIDN2_INCLUDE_DIR}/idn2.h" _version_str REGEX "${_version_regex}")
+    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+    set(LIBIDN2_VERSION "${_version_str}")
+    unset(_version_regex)
+    unset(_version_str)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Libidn2
+    REQUIRED_VARS
+      LIBIDN2_INCLUDE_DIR
+      LIBIDN2_LIBRARY
+    VERSION_VAR
+      LIBIDN2_VERSION
+  )
+
+  if(LIBIDN2_FOUND)
+    set(_libidn2_INCLUDE_DIRS ${LIBIDN2_INCLUDE_DIR})
+    set(_libidn2_LIBRARIES    ${LIBIDN2_LIBRARY})
+  endif()
+
+  mark_as_advanced(LIBIDN2_INCLUDE_DIR LIBIDN2_LIBRARY)
+endif()
+
+if(LIBIDN2_FOUND)
+  if(NOT TARGET CURL::libidn2)
+    add_library(CURL::libidn2 INTERFACE IMPORTED)
+    set_target_properties(CURL::libidn2 PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_libidn2_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_libidn2_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_libidn2_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_libidn2_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_libidn2_LIBRARIES}")
+  endif()
+endif()
diff --git a/third-party/curl/CMake/FindLibssh.cmake b/third-party/curl/CMake/FindLibssh.cmake
new file mode 100644
index 0000000000..3837d4de62
--- /dev/null
+++ b/third-party/curl/CMake/FindLibssh.cmake
@@ -0,0 +1,118 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Find the libssh library
+#
+# Input variables:
+#
+# - `LIBSSH_INCLUDE_DIR`:      Absolute path to libssh include directory.
+# - `LIBSSH_LIBRARY`:          Absolute path to `libssh` library.
+# - `LIBSSH_USE_STATIC_LIBS`:  Configure for static libssh libraries.
+#
+# Defines:
+#
+# - `LIBSSH_FOUND`:            System has libssh.
+# - `LIBSSH_VERSION`:          Version of libssh.
+# - `CURL::libssh`:            libssh library target.
+
+set(_libssh_pc_requires "libssh")
+
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED LIBSSH_INCLUDE_DIR AND
+   NOT DEFINED LIBSSH_LIBRARY)
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(_libssh ${_libssh_pc_requires})
+endif()
+
+if(_libssh_FOUND)
+  set(Libssh_FOUND TRUE)
+  set(LIBSSH_FOUND TRUE)
+  set(LIBSSH_VERSION ${_libssh_VERSION})
+  if(LIBSSH_USE_STATIC_LIBS)
+    set(_libssh_CFLAGS       "${_libssh_STATIC_CFLAGS}")
+    set(_libssh_INCLUDE_DIRS "${_libssh_STATIC_INCLUDE_DIRS}")
+    set(_libssh_LIBRARY_DIRS "${_libssh_STATIC_LIBRARY_DIRS}")
+    set(_libssh_LIBRARIES    "${_libssh_STATIC_LIBRARIES}")
+  endif()
+  message(STATUS "Found Libssh (via pkg-config): ${_libssh_INCLUDE_DIRS} (found version \"${LIBSSH_VERSION}\")")
+else()
+  find_path(LIBSSH_INCLUDE_DIR NAMES "libssh/libssh.h")
+  if(LIBSSH_USE_STATIC_LIBS)
+    set(_libssh_CFLAGS "-DLIBSSH_STATIC")
+    find_library(LIBSSH_LIBRARY NAMES "ssh_static" "libssh_static" "ssh" "libssh")
+  else()
+    find_library(LIBSSH_LIBRARY NAMES "ssh" "libssh")
+  endif()
+
+  unset(LIBSSH_VERSION CACHE)
+  if(LIBSSH_INCLUDE_DIR AND EXISTS "${LIBSSH_INCLUDE_DIR}/libssh/libssh_version.h")
+    set(_version_regex1 "#[\t ]*define[\t ]+LIBSSH_VERSION_MAJOR[\t ]+([0-9]+).*")
+    set(_version_regex2 "#[\t ]*define[\t ]+LIBSSH_VERSION_MINOR[\t ]+([0-9]+).*")
+    set(_version_regex3 "#[\t ]*define[\t ]+LIBSSH_VERSION_MICRO[\t ]+([0-9]+).*")
+    file(STRINGS "${LIBSSH_INCLUDE_DIR}/libssh/libssh_version.h" _version_str1 REGEX "${_version_regex1}")
+    file(STRINGS "${LIBSSH_INCLUDE_DIR}/libssh/libssh_version.h" _version_str2 REGEX "${_version_regex2}")
+    file(STRINGS "${LIBSSH_INCLUDE_DIR}/libssh/libssh_version.h" _version_str3 REGEX "${_version_regex3}")
+    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
+    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
+    string(REGEX REPLACE "${_version_regex3}" "\\1" _version_str3 "${_version_str3}")
+    set(LIBSSH_VERSION "${_version_str1}.${_version_str2}.${_version_str3}")
+    unset(_version_regex1)
+    unset(_version_regex2)
+    unset(_version_regex3)
+    unset(_version_str1)
+    unset(_version_str2)
+    unset(_version_str3)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Libssh
+    REQUIRED_VARS
+      LIBSSH_INCLUDE_DIR
+      LIBSSH_LIBRARY
+    VERSION_VAR
+      LIBSSH_VERSION
+  )
+
+  if(LIBSSH_FOUND)
+    set(_libssh_INCLUDE_DIRS ${LIBSSH_INCLUDE_DIR})
+    set(_libssh_LIBRARIES    ${LIBSSH_LIBRARY})
+  endif()
+
+  mark_as_advanced(LIBSSH_INCLUDE_DIR LIBSSH_LIBRARY)
+endif()
+
+if(LIBSSH_FOUND)
+  if(WIN32)
+    list(APPEND _libssh_LIBRARIES "iphlpapi")  # for if_nametoindex
+  endif()
+
+  if(NOT TARGET CURL::libssh)
+    add_library(CURL::libssh INTERFACE IMPORTED)
+    set_target_properties(CURL::libssh PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_libssh_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_libssh_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_libssh_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_libssh_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_libssh_LIBRARIES}")
+  endif()
+endif()
diff --git a/third-party/curl/CMake/FindLibuv.cmake b/third-party/curl/CMake/FindLibuv.cmake
new file mode 100644
index 0000000000..47d043cff6
--- /dev/null
+++ b/third-party/curl/CMake/FindLibuv.cmake
@@ -0,0 +1,102 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Find the libuv library
+#
+# Input variables:
+#
+# - `LIBUV_INCLUDE_DIR`:  Absolute path to libuv include directory.
+# - `LIBUV_LIBRARY`:      Absolute path to `libuv` library.
+#
+# Defines:
+#
+# - `LIBUV_FOUND`:        System has libuv.
+# - `LIBUV_VERSION`:      Version of libuv.
+# - `CURL::libuv`:        libuv library target.
+
+set(_libuv_pc_requires "libuv")
+
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED LIBUV_INCLUDE_DIR AND
+   NOT DEFINED LIBUV_LIBRARY)
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(_libuv ${_libuv_pc_requires})
+endif()
+
+if(_libuv_FOUND)
+  set(Libuv_FOUND TRUE)
+  set(LIBUV_FOUND TRUE)
+  set(LIBUV_VERSION ${_libuv_VERSION})
+  message(STATUS "Found Libuv (via pkg-config): ${_libuv_INCLUDE_DIRS} (found version \"${LIBUV_VERSION}\")")
+else()
+  find_path(LIBUV_INCLUDE_DIR NAMES "uv.h")
+  find_library(LIBUV_LIBRARY NAMES "uv" "libuv")
+
+  unset(LIBUV_VERSION CACHE)
+  if(LIBUV_INCLUDE_DIR AND EXISTS "${LIBUV_INCLUDE_DIR}/uv/version.h")
+    set(_version_regex1 "#[\t ]*define[\t ]+UV_VERSION_MAJOR[\t ]+([0-9]+).*")
+    set(_version_regex2 "#[\t ]*define[\t ]+UV_VERSION_MINOR[\t ]+([0-9]+).*")
+    set(_version_regex3 "#[\t ]*define[\t ]+UV_VERSION_PATCH[\t ]+([0-9]+).*")
+    file(STRINGS "${LIBUV_INCLUDE_DIR}/uv/version.h" _version_str1 REGEX "${_version_regex1}")
+    file(STRINGS "${LIBUV_INCLUDE_DIR}/uv/version.h" _version_str2 REGEX "${_version_regex2}")
+    file(STRINGS "${LIBUV_INCLUDE_DIR}/uv/version.h" _version_str3 REGEX "${_version_regex3}")
+    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
+    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
+    string(REGEX REPLACE "${_version_regex3}" "\\1" _version_str3 "${_version_str3}")
+    set(LIBUV_VERSION "${_version_str1}.${_version_str2}.${_version_str3}")
+    unset(_version_regex1)
+    unset(_version_regex2)
+    unset(_version_regex3)
+    unset(_version_str1)
+    unset(_version_str2)
+    unset(_version_str3)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Libuv
+    REQUIRED_VARS
+      LIBUV_INCLUDE_DIR
+      LIBUV_LIBRARY
+    VERSION_VAR
+      LIBUV_VERSION
+  )
+
+  if(LIBUV_FOUND)
+    set(_libuv_INCLUDE_DIRS ${LIBUV_INCLUDE_DIR})
+    set(_libuv_LIBRARIES    ${LIBUV_LIBRARY})
+  endif()
+
+  mark_as_advanced(LIBUV_INCLUDE_DIR LIBUV_LIBRARY)
+endif()
+
+if(LIBUV_FOUND)
+  if(NOT TARGET CURL::libuv)
+    add_library(CURL::libuv INTERFACE IMPORTED)
+    set_target_properties(CURL::libuv PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_libuv_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_libuv_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_libuv_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_libuv_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_libuv_LIBRARIES}")
+  endif()
+endif()
diff --git a/third-party/curl/CMake/FindMSH3.cmake b/third-party/curl/CMake/FindMSH3.cmake
deleted file mode 100644
index 7d9c6b6544..0000000000
--- a/third-party/curl/CMake/FindMSH3.cmake
+++ /dev/null
@@ -1,70 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-#[=======================================================================[.rst:
-FindMSH3
-----------
-
-Find the msh3 library
-
-Result Variables
-^^^^^^^^^^^^^^^^
-
-``MSH3_FOUND``
-  System has msh3
-``MSH3_INCLUDE_DIRS``
-  The msh3 include directories.
-``MSH3_LIBRARIES``
-  The libraries needed to use msh3
-#]=======================================================================]
-if(UNIX)
-  find_package(PkgConfig QUIET)
-  pkg_search_module(PC_MSH3 libmsh3)
-endif()
-
-find_path(MSH3_INCLUDE_DIR msh3.h
-  HINTS
-    ${PC_MSH3_INCLUDEDIR}
-    ${PC_MSH3_INCLUDE_DIRS}
-)
-
-find_library(MSH3_LIBRARY NAMES msh3
-  HINTS
-    ${PC_MSH3_LIBDIR}
-    ${PC_MSH3_LIBRARY_DIRS}
-)
-
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(MSH3
-  REQUIRED_VARS
-    MSH3_LIBRARY
-    MSH3_INCLUDE_DIR
-)
-
-if(MSH3_FOUND)
-  set(MSH3_LIBRARIES    ${MSH3_LIBRARY})
-  set(MSH3_INCLUDE_DIRS ${MSH3_INCLUDE_DIR})
-endif()
-
-mark_as_advanced(MSH3_INCLUDE_DIRS MSH3_LIBRARIES)
diff --git a/third-party/curl/CMake/FindMbedTLS.cmake b/third-party/curl/CMake/FindMbedTLS.cmake
index 814bd97da1..21a5f4aec7 100644
--- a/third-party/curl/CMake/FindMbedTLS.cmake
+++ b/third-party/curl/CMake/FindMbedTLS.cmake
@@ -21,16 +21,117 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-find_path(MBEDTLS_INCLUDE_DIRS mbedtls/ssl.h)
+# Find the mbedTLS library
+#
+# Input variables:
+#
+# - `MBEDTLS_INCLUDE_DIR`:      Absolute path to mbedTLS include directory.
+# - `MBEDTLS_LIBRARY`:          Absolute path to `mbedtls` library.
+# - `MBEDX509_LIBRARY`:         Absolute path to `mbedx509` library.
+# - `MBEDCRYPTO_LIBRARY`:       Absolute path to `mbedcrypto` library.
+# - `MBEDTLS_USE_STATIC_LIBS`:  Configure for static mbedTLS libraries.
+#
+# Defines:
+#
+# - `MBEDTLS_FOUND`:            System has mbedTLS.
+# - `MBEDTLS_VERSION`:          Version of mbedTLS.
+# - `CURL::mbedtls`:            mbedTLS library target.
 
-find_library(MBEDTLS_LIBRARY mbedtls)
-find_library(MBEDX509_LIBRARY mbedx509)
-find_library(MBEDCRYPTO_LIBRARY mbedcrypto)
+if(DEFINED MBEDTLS_INCLUDE_DIRS AND NOT DEFINED MBEDTLS_INCLUDE_DIR)
+  message(WARNING "MBEDTLS_INCLUDE_DIRS is deprecated, use MBEDTLS_INCLUDE_DIR instead.")
+  set(MBEDTLS_INCLUDE_DIR "${MBEDTLS_INCLUDE_DIRS}")
+  unset(MBEDTLS_INCLUDE_DIRS)
+endif()
 
-set(MBEDTLS_LIBRARIES "${MBEDTLS_LIBRARY}" "${MBEDX509_LIBRARY}" "${MBEDCRYPTO_LIBRARY}")
+set(_mbedtls_pc_requires "mbedtls" "mbedx509" "mbedcrypto")
 
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(MbedTLS DEFAULT_MSG
-    MBEDTLS_INCLUDE_DIRS MBEDTLS_LIBRARY MBEDX509_LIBRARY MBEDCRYPTO_LIBRARY)
+if(NOT DEFINED MBEDTLS_INCLUDE_DIR AND
+   NOT DEFINED MBEDTLS_LIBRARY AND
+   NOT DEFINED MBEDX509_LIBRARY AND
+   NOT DEFINED MBEDCRYPTO_LIBRARY)
+  if(CURL_USE_PKGCONFIG)
+    find_package(PkgConfig QUIET)
+    pkg_check_modules(_mbedtls ${_mbedtls_pc_requires})
+  endif()
+  if(NOT _mbedtls_FOUND AND CURL_USE_CMAKECONFIG)
+    find_package(MbedTLS CONFIG QUIET)
+  endif()
+endif()
 
-mark_as_advanced(MBEDTLS_INCLUDE_DIRS MBEDTLS_LIBRARY MBEDX509_LIBRARY MBEDCRYPTO_LIBRARY)
+if(_mbedtls_FOUND)
+  set(MbedTLS_FOUND TRUE)
+  set(MBEDTLS_FOUND TRUE)
+  set(MBEDTLS_VERSION ${_mbedtls_mbedtls_VERSION})
+  if(MBEDTLS_USE_STATIC_LIBS)
+    set(_mbedtls_CFLAGS       "${_mbedtls_STATIC_CFLAGS}")
+    set(_mbedtls_INCLUDE_DIRS "${_mbedtls_STATIC_INCLUDE_DIRS}")
+    set(_mbedtls_LIBRARY_DIRS "${_mbedtls_STATIC_LIBRARY_DIRS}")
+    set(_mbedtls_LIBRARIES    "${_mbedtls_STATIC_LIBRARIES}")
+  endif()
+  message(STATUS "Found MbedTLS (via pkg-config): ${_mbedtls_INCLUDE_DIRS} (found version \"${MBEDTLS_VERSION}\")")
+elseif(MbedTLS_CONFIG)
+  set(MbedTLS_FOUND TRUE)
+  set(MBEDTLS_FOUND TRUE)
+  set(MBEDTLS_VERSION ${MbedTLS_VERSION})
+  if(MBEDTLS_VERSION GREATER_EQUAL 4.0.0)
+    set(_mbedtls_LIBRARIES MbedTLS::tfpsacrypto)
+  else()
+    set(_mbedtls_LIBRARIES MbedTLS::mbedcrypto)
+  endif()
+  list(APPEND _mbedtls_LIBRARIES MbedTLS::mbedx509 MbedTLS::mbedtls)
+  message(STATUS "Found MbedTLS (via CMake Config): ${MbedTLS_CONFIG} (found version \"${MBEDTLS_VERSION}\")")
+else()
+  set(_mbedtls_pc_requires "")  # Depend on pkg-config only when found via pkg-config
+
+  find_path(MBEDTLS_INCLUDE_DIR NAMES "mbedtls/ssl.h")
+  if(MBEDTLS_USE_STATIC_LIBS)
+    find_library(MBEDTLS_LIBRARY NAMES "mbedtls_static" "libmbedtls_static" "mbedtls" "libmbedtls")
+    find_library(MBEDX509_LIBRARY NAMES "mbedx509_static" "libmbedx509_static" "mbedx509" "libmbedx509")
+    find_library(MBEDCRYPTO_LIBRARY NAMES "mbedcrypto_static" "libmbedcrypto_static" "mbedcrypto" "libmbedcrypto"
+      "tfpsacrypto_static" "libtfpsacrypto_static" "tfpsacrypto" "libtfpsacrypto")
+  else()
+    find_library(MBEDTLS_LIBRARY NAMES "mbedtls" "libmbedtls")
+    find_library(MBEDX509_LIBRARY NAMES "mbedx509" "libmbedx509")
+    find_library(MBEDCRYPTO_LIBRARY NAMES "mbedcrypto" "libmbedcrypto" "tfpsacrypto" "libtfpsacrypto")
+  endif()
+
+  unset(MBEDTLS_VERSION CACHE)
+  if(MBEDTLS_INCLUDE_DIR AND EXISTS "${MBEDTLS_INCLUDE_DIR}/mbedtls/build_info.h")
+    set(_version_regex "#[\t ]*define[\t ]+MBEDTLS_VERSION_STRING[\t ]+\"([0-9.]+)\"")
+    file(STRINGS "${MBEDTLS_INCLUDE_DIR}/mbedtls/build_info.h" _version_str REGEX "${_version_regex}")
+    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+    set(MBEDTLS_VERSION "${_version_str}")
+    unset(_version_regex)
+    unset(_version_str)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(MbedTLS
+    REQUIRED_VARS
+      MBEDTLS_INCLUDE_DIR
+      MBEDTLS_LIBRARY
+      MBEDX509_LIBRARY
+      MBEDCRYPTO_LIBRARY
+    VERSION_VAR
+      MBEDTLS_VERSION
+  )
+
+  if(MBEDTLS_FOUND)
+    set(_mbedtls_INCLUDE_DIRS ${MBEDTLS_INCLUDE_DIR})
+    set(_mbedtls_LIBRARIES    ${MBEDTLS_LIBRARY} ${MBEDX509_LIBRARY} ${MBEDCRYPTO_LIBRARY})
+  endif()
+
+  mark_as_advanced(MBEDTLS_INCLUDE_DIR MBEDTLS_LIBRARY MBEDX509_LIBRARY MBEDCRYPTO_LIBRARY)
+endif()
+
+if(MBEDTLS_FOUND)
+  if(NOT TARGET CURL::mbedtls)
+    add_library(CURL::mbedtls INTERFACE IMPORTED)
+    set_target_properties(CURL::mbedtls PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_mbedtls_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_mbedtls_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_mbedtls_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_mbedtls_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_mbedtls_LIBRARIES}")
+  endif()
+endif()
diff --git a/third-party/curl/CMake/FindNGHTTP2.cmake b/third-party/curl/CMake/FindNGHTTP2.cmake
index 3957646c43..bca7cf8a81 100644
--- a/third-party/curl/CMake/FindNGHTTP2.cmake
+++ b/third-party/curl/CMake/FindNGHTTP2.cmake
@@ -21,21 +21,96 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-include(FindPackageHandleStandardArgs)
+# Find the nghttp2 library
+#
+# Input variables:
+#
+# - `NGHTTP2_INCLUDE_DIR`:      Absolute path to nghttp2 include directory.
+# - `NGHTTP2_LIBRARY`:          Absolute path to `nghttp2` library.
+# - `NGHTTP2_USE_STATIC_LIBS`:  Configure for static nghttp2 libraries.
+#
+# Defines:
+#
+# - `NGHTTP2_FOUND`:            System has nghttp2.
+# - `NGHTTP2_VERSION`:          Version of nghttp2.
+# - `CURL::nghttp2`:            nghttp2 library target.
 
-find_path(NGHTTP2_INCLUDE_DIR "nghttp2/nghttp2.h")
+set(_nghttp2_pc_requires "libnghttp2")
 
-find_library(NGHTTP2_LIBRARY NAMES nghttp2)
+if(NOT DEFINED NGHTTP2_INCLUDE_DIR AND
+   NOT DEFINED NGHTTP2_LIBRARY)
+  if(CURL_USE_PKGCONFIG)
+    find_package(PkgConfig QUIET)
+    pkg_check_modules(_nghttp2 ${_nghttp2_pc_requires})
+  endif()
+  if(NOT _nghttp2_FOUND AND CURL_USE_CMAKECONFIG)
+    find_package(nghttp2 CONFIG QUIET)
+  endif()
+endif()
 
-find_package_handle_standard_args(NGHTTP2
-    FOUND_VAR
-      NGHTTP2_FOUND
+if(_nghttp2_FOUND)
+  set(NGHTTP2_FOUND TRUE)
+  set(NGHTTP2_VERSION ${_nghttp2_VERSION})
+  if(NGHTTP2_USE_STATIC_LIBS)
+    set(_nghttp2_CFLAGS       "${_nghttp2_STATIC_CFLAGS}")
+    set(_nghttp2_INCLUDE_DIRS "${_nghttp2_STATIC_INCLUDE_DIRS}")
+    set(_nghttp2_LIBRARY_DIRS "${_nghttp2_STATIC_LIBRARY_DIRS}")
+    set(_nghttp2_LIBRARIES    "${_nghttp2_STATIC_LIBRARIES}")
+  endif()
+  message(STATUS "Found NGHTTP2 (via pkg-config): ${_nghttp2_INCLUDE_DIRS} (found version \"${NGHTTP2_VERSION}\")")
+elseif(nghttp2_CONFIG)
+  set(NGHTTP2_FOUND TRUE)
+  set(NGHTTP2_VERSION ${nghttp2_VERSION})
+  if(NGHTTP2_USE_STATIC_LIBS OR NOT TARGET nghttp2::nghttp2)
+    set(_nghttp2_LIBRARIES nghttp2::nghttp2_static)
+  else()
+    set(_nghttp2_LIBRARIES nghttp2::nghttp2)
+  endif()
+  message(STATUS "Found NGHTTP2 (via CMake Config): ${nghttp2_CONFIG} (found version \"${NGHTTP2_VERSION}\")")
+else()
+  find_path(NGHTTP2_INCLUDE_DIR NAMES "nghttp2/nghttp2.h")
+  if(NGHTTP2_USE_STATIC_LIBS)
+    set(_nghttp2_CFLAGS "-DNGHTTP2_STATICLIB")
+    find_library(NGHTTP2_LIBRARY NAMES "nghttp2_static" "nghttp2")
+  else()
+    find_library(NGHTTP2_LIBRARY NAMES "nghttp2" "nghttp2_static")
+  endif()
+
+  unset(NGHTTP2_VERSION CACHE)
+  if(NGHTTP2_INCLUDE_DIR AND EXISTS "${NGHTTP2_INCLUDE_DIR}/nghttp2/nghttp2ver.h")
+    set(_version_regex "#[\t ]*define[\t ]+NGHTTP2_VERSION[\t ]+\"([^\"]*)\"")
+    file(STRINGS "${NGHTTP2_INCLUDE_DIR}/nghttp2/nghttp2ver.h" _version_str REGEX "${_version_regex}")
+    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+    set(NGHTTP2_VERSION "${_version_str}")
+    unset(_version_regex)
+    unset(_version_str)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(NGHTTP2
     REQUIRED_VARS
-      NGHTTP2_LIBRARY
       NGHTTP2_INCLUDE_DIR
-)
+      NGHTTP2_LIBRARY
+    VERSION_VAR
+      NGHTTP2_VERSION
+  )
 
-set(NGHTTP2_INCLUDE_DIRS ${NGHTTP2_INCLUDE_DIR})
-set(NGHTTP2_LIBRARIES ${NGHTTP2_LIBRARY})
+  if(NGHTTP2_FOUND)
+    set(_nghttp2_INCLUDE_DIRS ${NGHTTP2_INCLUDE_DIR})
+    set(_nghttp2_LIBRARIES    ${NGHTTP2_LIBRARY})
+  endif()
 
-mark_as_advanced(NGHTTP2_INCLUDE_DIRS NGHTTP2_LIBRARIES)
+  mark_as_advanced(NGHTTP2_INCLUDE_DIR NGHTTP2_LIBRARY)
+endif()
+
+if(NGHTTP2_FOUND)
+  if(NOT TARGET CURL::nghttp2)
+    add_library(CURL::nghttp2 INTERFACE IMPORTED)
+    set_target_properties(CURL::nghttp2 PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_nghttp2_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_nghttp2_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_nghttp2_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_nghttp2_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_nghttp2_LIBRARIES}")
+  endif()
+endif()
diff --git a/third-party/curl/CMake/FindNGHTTP3.cmake b/third-party/curl/CMake/FindNGHTTP3.cmake
index 9b13e6c6ff..ed671b7a49 100644
--- a/third-party/curl/CMake/FindNGHTTP3.cmake
+++ b/third-party/curl/CMake/FindNGHTTP3.cmake
@@ -21,58 +21,96 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+# Find the nghttp3 library
+#
+# Input variables:
+#
+# - `NGHTTP3_INCLUDE_DIR`:      Absolute path to nghttp3 include directory.
+# - `NGHTTP3_LIBRARY`:          Absolute path to `nghttp3` library.
+# - `NGHTTP3_USE_STATIC_LIBS`:  Configure for static nghttp3 libraries.
+#
+# Defines:
+#
+# - `NGHTTP3_FOUND`:            System has nghttp3.
+# - `NGHTTP3_VERSION`:          Version of nghttp3.
+# - `CURL::nghttp3`:            nghttp3 library target.
 
-#[=======================================================================[.rst:
-FindNGHTTP3
-----------
+set(_nghttp3_pc_requires "libnghttp3")
 
-Find the nghttp3 library
-
-Result Variables
-^^^^^^^^^^^^^^^^
-
-``NGHTTP3_FOUND``
-  System has nghttp3
-``NGHTTP3_INCLUDE_DIRS``
-  The nghttp3 include directories.
-``NGHTTP3_LIBRARIES``
-  The libraries needed to use nghttp3
-``NGHTTP3_VERSION``
-  version of nghttp3.
-#]=======================================================================]
-
-if(UNIX)
-  find_package(PkgConfig QUIET)
-  pkg_search_module(PC_NGHTTP3 libnghttp3)
+if(NOT DEFINED NGHTTP3_INCLUDE_DIR AND
+   NOT DEFINED NGHTTP3_LIBRARY)
+  if(CURL_USE_PKGCONFIG)
+    find_package(PkgConfig QUIET)
+    pkg_check_modules(_nghttp3 ${_nghttp3_pc_requires})
+  endif()
+  if(NOT _nghttp3_FOUND AND CURL_USE_CMAKECONFIG)
+    find_package(nghttp3 CONFIG QUIET)
+  endif()
 endif()
 
-find_path(NGHTTP3_INCLUDE_DIR nghttp3/nghttp3.h
-  HINTS
-    ${PC_NGHTTP3_INCLUDEDIR}
-    ${PC_NGHTTP3_INCLUDE_DIRS}
-)
+if(_nghttp3_FOUND)
+  set(NGHTTP3_FOUND TRUE)
+  set(NGHTTP3_VERSION ${_nghttp3_VERSION})
+  if(NGHTTP3_USE_STATIC_LIBS)
+    set(_nghttp3_CFLAGS       "${_nghttp3_STATIC_CFLAGS}")
+    set(_nghttp3_INCLUDE_DIRS "${_nghttp3_STATIC_INCLUDE_DIRS}")
+    set(_nghttp3_LIBRARY_DIRS "${_nghttp3_STATIC_LIBRARY_DIRS}")
+    set(_nghttp3_LIBRARIES    "${_nghttp3_STATIC_LIBRARIES}")
+  endif()
+  message(STATUS "Found NGHTTP3 (via pkg-config): ${_nghttp3_INCLUDE_DIRS} (found version \"${NGHTTP3_VERSION}\")")
+elseif(nghttp3_CONFIG)
+  set(NGHTTP3_FOUND TRUE)
+  set(NGHTTP3_VERSION ${nghttp3_VERSION})
+  if(NGHTTP3_USE_STATIC_LIBS OR NOT TARGET nghttp3::nghttp3)
+    set(_nghttp3_LIBRARIES nghttp3::nghttp3_static)
+  else()
+    set(_nghttp3_LIBRARIES nghttp3::nghttp3)
+  endif()
+  message(STATUS "Found NGHTTP3 (via CMake Config): ${nghttp3_CONFIG} (found version \"${NGHTTP3_VERSION}\")")
+else()
+  find_path(NGHTTP3_INCLUDE_DIR NAMES "nghttp3/nghttp3.h")
+  if(NGHTTP3_USE_STATIC_LIBS)
+    set(_nghttp3_CFLAGS "-DNGHTTP3_STATICLIB")
+    find_library(NGHTTP3_LIBRARY NAMES "nghttp3_static" "nghttp3")
+  else()
+    find_library(NGHTTP3_LIBRARY NAMES "nghttp3")
+  endif()
 
-find_library(NGHTTP3_LIBRARY NAMES nghttp3
-  HINTS
-    ${PC_NGHTTP3_LIBDIR}
-    ${PC_NGHTTP3_LIBRARY_DIRS}
-)
+  unset(NGHTTP3_VERSION CACHE)
+  if(NGHTTP3_INCLUDE_DIR AND EXISTS "${NGHTTP3_INCLUDE_DIR}/nghttp3/version.h")
+    set(_version_regex "#[\t ]*define[\t ]+NGHTTP3_VERSION[\t ]+\"([^\"]*)\"")
+    file(STRINGS "${NGHTTP3_INCLUDE_DIR}/nghttp3/version.h" _version_str REGEX "${_version_regex}")
+    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+    set(NGHTTP3_VERSION "${_version_str}")
+    unset(_version_regex)
+    unset(_version_str)
+  endif()
 
-if(PC_NGHTTP3_VERSION)
-  set(NGHTTP3_VERSION ${PC_NGHTTP3_VERSION})
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(NGHTTP3
+    REQUIRED_VARS
+      NGHTTP3_INCLUDE_DIR
+      NGHTTP3_LIBRARY
+    VERSION_VAR
+      NGHTTP3_VERSION
+  )
+
+  if(NGHTTP3_FOUND)
+    set(_nghttp3_INCLUDE_DIRS ${NGHTTP3_INCLUDE_DIR})
+    set(_nghttp3_LIBRARIES    ${NGHTTP3_LIBRARY})
+  endif()
+
+  mark_as_advanced(NGHTTP3_INCLUDE_DIR NGHTTP3_LIBRARY)
 endif()
 
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(NGHTTP3
-  REQUIRED_VARS
-    NGHTTP3_LIBRARY
-    NGHTTP3_INCLUDE_DIR
-  VERSION_VAR NGHTTP3_VERSION
-)
-
 if(NGHTTP3_FOUND)
-  set(NGHTTP3_LIBRARIES    ${NGHTTP3_LIBRARY})
-  set(NGHTTP3_INCLUDE_DIRS ${NGHTTP3_INCLUDE_DIR})
+  if(NOT TARGET CURL::nghttp3)
+    add_library(CURL::nghttp3 INTERFACE IMPORTED)
+    set_target_properties(CURL::nghttp3 PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_nghttp3_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_nghttp3_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_nghttp3_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_nghttp3_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_nghttp3_LIBRARIES}")
+  endif()
 endif()
-
-mark_as_advanced(NGHTTP3_INCLUDE_DIRS NGHTTP3_LIBRARIES)
diff --git a/third-party/curl/CMake/FindNGTCP2.cmake b/third-party/curl/CMake/FindNGTCP2.cmake
index ae92e417a5..bf2f488777 100644
--- a/third-party/curl/CMake/FindNGTCP2.cmake
+++ b/third-party/curl/CMake/FindNGTCP2.cmake
@@ -21,95 +21,167 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+# Find the ngtcp2 library
+#
+# This module accepts optional COMPONENTS to control the crypto library (these are
+# mutually exclusive):
+#
+# - BoringSSL:  Use `libngtcp2_crypto_boringssl`. (also for AWS-LC)
+# - GnuTLS:     Use `libngtcp2_crypto_gnutls`.
+# - LibreSSL:   Use `libngtcp2_crypto_libressl`. (requires ngtcp2 1.15.0+)
+# - ossl:       Use `libngtcp2_crypto_ossl`.
+# - quictls:    Use `libngtcp2_crypto_quictls`. (also for LibreSSL with ngtcp2 <1.15.0)
+# - wolfSSL:    Use `libngtcp2_crypto_wolfssl`.
+#
+# Input variables:
+#
+# - `NGTCP2_INCLUDE_DIR`:               Absolute path to ngtcp2 include directory.
+# - `NGTCP2_LIBRARY`:                   Absolute path to `ngtcp2` library.
+# - `NGTCP2_CRYPTO_BORINGSSL_LIBRARY`:  Absolute path to `ngtcp2_crypto_boringssl` library.
+# - `NGTCP2_CRYPTO_GNUTLS_LIBRARY`:     Absolute path to `ngtcp2_crypto_gnutls` library.
+# - `NGTCP2_CRYPTO_LIBRESSL_LIBRARY`:   Absolute path to `ngtcp2_crypto_libressl` library.
+# - `NGTCP2_CRYPTO_OSSL_LIBRARY`:       Absolute path to `ngtcp2_crypto_ossl` library.
+# - `NGTCP2_CRYPTO_QUICTLS_LIBRARY`:    Absolute path to `ngtcp2_crypto_quictls` library.
+# - `NGTCP2_CRYPTO_WOLFSSL_LIBRARY`:    Absolute path to `ngtcp2_crypto_wolfssl` library.
+# - `NGTCP2_USE_STATIC_LIBS`:           Configure for static ngtcp2 libraries.
+#
+# Defines:
+#
+# - `NGTCP2_FOUND`:                     System has ngtcp2.
+# - `NGTCP2_VERSION`:                   Version of ngtcp2.
+# - `NGTCP2_CRYPTO_BACKEND`:            Name of the crypto library component. (Empty if COMPONENTS was not used.)
+# - `CURL::ngtcp2`:                     ngtcp2 library target.
 
-#[=======================================================================[.rst:
-FindNGTCP2
-----------
-
-Find the ngtcp2 library
-
-This module accepts optional COMPONENTS to control the crypto library (these are
-mutually exclusive)::
-
-  OpenSSL:  Use libngtcp2_crypto_quictls
-  GnuTLS:   Use libngtcp2_crypto_gnutls
-
-Result Variables
-^^^^^^^^^^^^^^^^
-
-``NGTCP2_FOUND``
-  System has ngtcp2
-``NGTCP2_INCLUDE_DIRS``
-  The ngtcp2 include directories.
-``NGTCP2_LIBRARIES``
-  The libraries needed to use ngtcp2
-``NGTCP2_VERSION``
-  version of ngtcp2.
-#]=======================================================================]
-
-if(UNIX)
-  find_package(PkgConfig QUIET)
-  pkg_search_module(PC_NGTCP2 libngtcp2)
-endif()
-
-find_path(NGTCP2_INCLUDE_DIR ngtcp2/ngtcp2.h
-  HINTS
-    ${PC_NGTCP2_INCLUDEDIR}
-    ${PC_NGTCP2_INCLUDE_DIRS}
-)
-
-find_library(NGTCP2_LIBRARY NAMES ngtcp2
-  HINTS
-    ${PC_NGTCP2_LIBDIR}
-    ${PC_NGTCP2_LIBRARY_DIRS}
-)
-
-if(PC_NGTCP2_VERSION)
-  set(NGTCP2_VERSION ${PC_NGTCP2_VERSION})
-endif()
-
+set(NGTCP2_CRYPTO_BACKEND "")
 if(NGTCP2_FIND_COMPONENTS)
-  set(NGTCP2_CRYPTO_BACKEND "")
-  foreach(component IN LISTS NGTCP2_FIND_COMPONENTS)
-    if(component MATCHES "^(BoringSSL|quictls|wolfSSL|GnuTLS)")
+  foreach(_component IN LISTS NGTCP2_FIND_COMPONENTS)
+    if(_component MATCHES "^(BoringSSL|GnuTLS|LibreSSL|ossl|quictls|wolfSSL)")
       if(NGTCP2_CRYPTO_BACKEND)
         message(FATAL_ERROR "NGTCP2: Only one crypto library can be selected")
       endif()
-      set(NGTCP2_CRYPTO_BACKEND ${component})
+      set(NGTCP2_CRYPTO_BACKEND ${_component})
     endif()
   endforeach()
 
   if(NGTCP2_CRYPTO_BACKEND)
-    string(TOLOWER "ngtcp2_crypto_${NGTCP2_CRYPTO_BACKEND}" _crypto_library)
-    if(UNIX)
-      pkg_search_module(PC_${_crypto_library} lib${_crypto_library})
-    endif()
-    find_library(${_crypto_library}_LIBRARY
-      NAMES
-        ${_crypto_library}
-      HINTS
-        ${PC_${_crypto_library}_LIBDIR}
-        ${PC_${_crypto_library}_LIBRARY_DIRS}
-    )
-    if(${_crypto_library}_LIBRARY)
-      set(NGTCP2_${NGTCP2_CRYPTO_BACKEND}_FOUND TRUE)
-      set(NGTCP2_CRYPTO_LIBRARY ${${_crypto_library}_LIBRARY})
+    string(TOLOWER "ngtcp2_crypto_${NGTCP2_CRYPTO_BACKEND}" _crypto_library_lower)
+    string(TOUPPER "ngtcp2_crypto_${NGTCP2_CRYPTO_BACKEND}" _crypto_library_upper)
+  endif()
+endif()
+
+set(_ngtcp2_pc_requires "libngtcp2")
+if(NGTCP2_CRYPTO_BACKEND)
+  list(APPEND _ngtcp2_pc_requires "lib${_crypto_library_lower}")
+endif()
+
+set(_tried_pkgconfig FALSE)
+if(NOT DEFINED NGTCP2_INCLUDE_DIR AND
+   NOT DEFINED NGTCP2_LIBRARY)
+  if(CURL_USE_PKGCONFIG)
+    find_package(PkgConfig QUIET)
+    pkg_check_modules(_ngtcp2 ${_ngtcp2_pc_requires})
+    set(_tried_pkgconfig TRUE)
+  endif()
+  if(NOT _ngtcp2_FOUND AND CURL_USE_CMAKECONFIG AND NGTCP2_CRYPTO_BACKEND)
+    find_package(ngtcp2 CONFIG QUIET)
+    # Skip using it if the crypto library target is not available
+    if(ngtcp2_CONFIG AND
+       NOT TARGET ngtcp2::${_crypto_library_lower}_static AND
+       NOT TARGET ngtcp2::${_crypto_library_lower})
+      unset(ngtcp2_CONFIG)
     endif()
   endif()
 endif()
 
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(NGTCP2
-  REQUIRED_VARS
-    NGTCP2_LIBRARY
-    NGTCP2_INCLUDE_DIR
-  VERSION_VAR NGTCP2_VERSION
-  HANDLE_COMPONENTS
-)
+if(_ngtcp2_FOUND)
+  set(NGTCP2_FOUND TRUE)
+  set(NGTCP2_VERSION ${_ngtcp2_libngtcp2_VERSION})
+  if(NGTCP2_USE_STATIC_LIBS)
+    set(_ngtcp2_CFLAGS       "${_ngtcp2_STATIC_CFLAGS}")
+    set(_ngtcp2_INCLUDE_DIRS "${_ngtcp2_STATIC_INCLUDE_DIRS}")
+    set(_ngtcp2_LIBRARY_DIRS "${_ngtcp2_STATIC_LIBRARY_DIRS}")
+    set(_ngtcp2_LIBRARIES    "${_ngtcp2_STATIC_LIBRARIES}")
+  endif()
+  message(STATUS "Found NGTCP2 (via pkg-config): ${_ngtcp2_INCLUDE_DIRS} (found version \"${NGTCP2_VERSION}\")")
+elseif(ngtcp2_CONFIG)
+  set(NGTCP2_FOUND TRUE)
+  set(NGTCP2_VERSION ${ngtcp2_VERSION})
+  if(NGTCP2_USE_STATIC_LIBS OR NOT TARGET ngtcp2::ngtcp2)
+    set(_ngtcp2_LIBRARIES ngtcp2::ngtcp2_static ngtcp2::${_crypto_library_lower}_static)
+  else()
+    set(_ngtcp2_LIBRARIES ngtcp2::ngtcp2 ngtcp2::${_crypto_library_lower})
+  endif()
+  message(STATUS "Found NGTCP2 (via CMake Config): ${ngtcp2_CONFIG} (found version \"${NGTCP2_VERSION}\")")
+else()
+  find_path(NGTCP2_INCLUDE_DIR NAMES "ngtcp2/ngtcp2.h")
+  if(NGTCP2_USE_STATIC_LIBS)
+    set(_ngtcp2_CFLAGS "-DNGTCP2_STATICLIB")
+    find_library(NGTCP2_LIBRARY NAMES "ngtcp2_static" "ngtcp2")
+  else()
+    find_library(NGTCP2_LIBRARY NAMES "ngtcp2")
+  endif()
 
-if(NGTCP2_FOUND)
-  set(NGTCP2_LIBRARIES    ${NGTCP2_LIBRARY} ${NGTCP2_CRYPTO_LIBRARY})
-  set(NGTCP2_INCLUDE_DIRS ${NGTCP2_INCLUDE_DIR})
+  unset(NGTCP2_VERSION CACHE)
+  if(NGTCP2_INCLUDE_DIR AND EXISTS "${NGTCP2_INCLUDE_DIR}/ngtcp2/version.h")
+    set(_version_regex "#[\t ]*define[\t ]+NGTCP2_VERSION[\t ]+\"([^\"]*)\"")
+    file(STRINGS "${NGTCP2_INCLUDE_DIR}/ngtcp2/version.h" _version_str REGEX "${_version_regex}")
+    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+    set(NGTCP2_VERSION "${_version_str}")
+    unset(_version_regex)
+    unset(_version_str)
+  endif()
+
+  if(NGTCP2_CRYPTO_BACKEND)
+    if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.20)
+      cmake_path(GET NGTCP2_LIBRARY PARENT_PATH _ngtcp2_library_dir)
+    else()
+      get_filename_component(_ngtcp2_library_dir "${NGTCP2_LIBRARY}" DIRECTORY)
+    endif()
+    if(NGTCP2_USE_STATIC_LIBS)
+      find_library(${_crypto_library_upper}_LIBRARY NAMES ${_crypto_library_lower}_static ${_crypto_library_lower}
+        HINTS ${_ngtcp2_library_dir})
+    else()
+      find_library(${_crypto_library_upper}_LIBRARY NAMES ${_crypto_library_lower}
+        HINTS ${_ngtcp2_library_dir})
+    endif()
+
+    if(${_crypto_library_upper}_LIBRARY)
+      set(NGTCP2_${NGTCP2_CRYPTO_BACKEND}_FOUND TRUE)
+      set(NGTCP2_CRYPTO_LIBRARY ${${_crypto_library_upper}_LIBRARY})
+    endif()
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(NGTCP2
+    REQUIRED_VARS
+      NGTCP2_INCLUDE_DIR
+      NGTCP2_LIBRARY
+    VERSION_VAR
+      NGTCP2_VERSION
+    HANDLE_COMPONENTS
+  )
+
+  if(NGTCP2_FOUND)
+    set(_ngtcp2_INCLUDE_DIRS ${NGTCP2_INCLUDE_DIR})
+    set(_ngtcp2_LIBRARIES    ${NGTCP2_LIBRARY} ${NGTCP2_CRYPTO_LIBRARY})
+  endif()
+
+  mark_as_advanced(NGTCP2_INCLUDE_DIR NGTCP2_LIBRARY NGTCP2_CRYPTO_LIBRARY)
+
+  if(NOT NGTCP2_FOUND AND _tried_pkgconfig)  # reset variables to allow another round of detection
+    unset(NGTCP2_INCLUDE_DIR CACHE)
+    unset(NGTCP2_LIBRARY CACHE)
+  endif()
 endif()
 
-mark_as_advanced(NGTCP2_INCLUDE_DIRS NGTCP2_LIBRARIES)
+if(NGTCP2_FOUND)
+  if(NOT TARGET CURL::ngtcp2)
+    add_library(CURL::ngtcp2 INTERFACE IMPORTED)
+    set_target_properties(CURL::ngtcp2 PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_ngtcp2_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_ngtcp2_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_ngtcp2_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_ngtcp2_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_ngtcp2_LIBRARIES}")
+  endif()
+endif()
diff --git a/third-party/curl/CMake/FindNettle.cmake b/third-party/curl/CMake/FindNettle.cmake
new file mode 100644
index 0000000000..c963180cba
--- /dev/null
+++ b/third-party/curl/CMake/FindNettle.cmake
@@ -0,0 +1,97 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Find the nettle library
+#
+# Input variables:
+#
+# - `NETTLE_INCLUDE_DIR`:  Absolute path to nettle include directory.
+# - `NETTLE_LIBRARY`:      Absolute path to `nettle` library.
+#
+# Defines:
+#
+# - `NETTLE_FOUND`:        System has nettle.
+# - `NETTLE_VERSION`:      Version of nettle.
+# - `CURL::nettle`:        nettle library target.
+
+set(_nettle_pc_requires "nettle")
+
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED NETTLE_INCLUDE_DIR AND
+   NOT DEFINED NETTLE_LIBRARY)
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(_nettle ${_nettle_pc_requires})
+endif()
+
+if(_nettle_FOUND)
+  set(Nettle_FOUND TRUE)
+  set(NETTLE_FOUND TRUE)
+  set(NETTLE_VERSION ${_nettle_VERSION})
+  message(STATUS "Found Nettle (via pkg-config): ${_nettle_INCLUDE_DIRS} (found version \"${NETTLE_VERSION}\")")
+else()
+  find_path(NETTLE_INCLUDE_DIR NAMES "nettle/sha2.h")
+  find_library(NETTLE_LIBRARY NAMES "nettle")
+
+  unset(NETTLE_VERSION CACHE)
+  if(NETTLE_INCLUDE_DIR AND EXISTS "${NETTLE_INCLUDE_DIR}/nettle/version.h")
+    set(_version_regex1 "#[\t ]*define[ \t]+NETTLE_VERSION_MAJOR[ \t]+([0-9]+).*")
+    set(_version_regex2 "#[\t ]*define[ \t]+NETTLE_VERSION_MINOR[ \t]+([0-9]+).*")
+    file(STRINGS "${NETTLE_INCLUDE_DIR}/nettle/version.h" _version_str1 REGEX "${_version_regex1}")
+    file(STRINGS "${NETTLE_INCLUDE_DIR}/nettle/version.h" _version_str2 REGEX "${_version_regex2}")
+    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
+    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
+    set(NETTLE_VERSION "${_version_str1}.${_version_str2}")
+    unset(_version_regex1)
+    unset(_version_regex2)
+    unset(_version_str1)
+    unset(_version_str2)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Nettle
+    REQUIRED_VARS
+      NETTLE_INCLUDE_DIR
+      NETTLE_LIBRARY
+    VERSION_VAR
+      NETTLE_VERSION
+  )
+
+  if(NETTLE_FOUND)
+    set(_nettle_INCLUDE_DIRS ${NETTLE_INCLUDE_DIR})
+    set(_nettle_LIBRARIES    ${NETTLE_LIBRARY})
+  endif()
+
+  mark_as_advanced(NETTLE_INCLUDE_DIR NETTLE_LIBRARY)
+endif()
+
+if(NETTLE_FOUND)
+  if(NOT TARGET CURL::nettle)
+    add_library(CURL::nettle INTERFACE IMPORTED)
+    set_target_properties(CURL::nettle PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_nettle_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_nettle_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_nettle_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_nettle_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_nettle_LIBRARIES}")
+  endif()
+endif()
diff --git a/third-party/curl/CMake/FindQUICHE.cmake b/third-party/curl/CMake/FindQUICHE.cmake
index 0488463d55..137679b5b3 100644
--- a/third-party/curl/CMake/FindQUICHE.cmake
+++ b/third-party/curl/CMake/FindQUICHE.cmake
@@ -21,50 +21,60 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+# Find the quiche library
+#
+# Input variables:
+#
+# - `QUICHE_INCLUDE_DIR`:  Absolute path to quiche include directory.
+# - `QUICHE_LIBRARY`:      Absolute path to `quiche` library.
+#
+# Defines:
+#
+# - `QUICHE_FOUND`:        System has quiche.
+# - `QUICHE_VERSION`:      Version of quiche.
+# - `CURL::quiche`:        quiche library target.
 
-#[=======================================================================[.rst:
-FindQUICHE
-----------
+set(_quiche_pc_requires "quiche")
 
-Find the quiche library
-
-Result Variables
-^^^^^^^^^^^^^^^^
-
-``QUICHE_FOUND``
-  System has quiche
-``QUICHE_INCLUDE_DIRS``
-  The quiche include directories.
-``QUICHE_LIBRARIES``
-  The libraries needed to use quiche
-#]=======================================================================]
-if(UNIX)
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED QUICHE_INCLUDE_DIR AND
+   NOT DEFINED QUICHE_LIBRARY)
   find_package(PkgConfig QUIET)
-  pkg_search_module(PC_QUICHE quiche)
+  pkg_check_modules(_quiche ${_quiche_pc_requires})
 endif()
 
-find_path(QUICHE_INCLUDE_DIR quiche.h
-  HINTS
-    ${PC_QUICHE_INCLUDEDIR}
-    ${PC_QUICHE_INCLUDE_DIRS}
-)
+if(_quiche_FOUND)
+  set(Quiche_FOUND TRUE)
+  set(QUICHE_FOUND TRUE)
+  set(QUICHE_VERSION ${_quiche_VERSION})
+  message(STATUS "Found Quiche (via pkg-config): ${_quiche_INCLUDE_DIRS} (found version \"${QUICHE_VERSION}\")")
+else()
+  find_path(QUICHE_INCLUDE_DIR NAMES "quiche.h")
+  find_library(QUICHE_LIBRARY NAMES "quiche")
 
-find_library(QUICHE_LIBRARY NAMES quiche
-  HINTS
-    ${PC_QUICHE_LIBDIR}
-    ${PC_QUICHE_LIBRARY_DIRS}
-)
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Quiche
+    REQUIRED_VARS
+      QUICHE_INCLUDE_DIR
+      QUICHE_LIBRARY
+  )
 
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(QUICHE
-  REQUIRED_VARS
-    QUICHE_LIBRARY
-    QUICHE_INCLUDE_DIR
-)
+  if(QUICHE_FOUND)
+    set(_quiche_INCLUDE_DIRS ${QUICHE_INCLUDE_DIR})
+    set(_quiche_LIBRARIES    ${QUICHE_LIBRARY})
+  endif()
+
+  mark_as_advanced(QUICHE_INCLUDE_DIR QUICHE_LIBRARY)
+endif()
 
 if(QUICHE_FOUND)
-  set(QUICHE_LIBRARIES    ${QUICHE_LIBRARY})
-  set(QUICHE_INCLUDE_DIRS ${QUICHE_INCLUDE_DIR})
+  if(NOT TARGET CURL::quiche)
+    add_library(CURL::quiche INTERFACE IMPORTED)
+    set_target_properties(CURL::quiche PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_quiche_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_quiche_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_quiche_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_quiche_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_quiche_LIBRARIES}")
+  endif()
 endif()
-
-mark_as_advanced(QUICHE_INCLUDE_DIRS QUICHE_LIBRARIES)
diff --git a/third-party/curl/CMake/FindRustls.cmake b/third-party/curl/CMake/FindRustls.cmake
new file mode 100644
index 0000000000..1e07565189
--- /dev/null
+++ b/third-party/curl/CMake/FindRustls.cmake
@@ -0,0 +1,116 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Find the Rustls library
+#
+# Input variables:
+#
+# - `RUSTLS_INCLUDE_DIR`:  Absolute path to Rustls include directory.
+# - `RUSTLS_LIBRARY`:      Absolute path to `rustls` library.
+#
+# Defines:
+#
+# - `RUSTLS_FOUND`:        System has Rustls.
+# - `RUSTLS_VERSION`:      Version of Rustls.
+# - `CURL::rustls`:        Rustls library target.
+
+set(_rustls_pc_requires "rustls")
+
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED RUSTLS_INCLUDE_DIR AND
+   NOT DEFINED RUSTLS_LIBRARY)
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(_rustls ${_rustls_pc_requires})
+endif()
+
+if(_rustls_FOUND)
+  set(Rustls_FOUND TRUE)
+  set(RUSTLS_FOUND TRUE)
+  set(RUSTLS_VERSION ${_rustls_VERSION})
+  message(STATUS "Found Rustls (via pkg-config): ${_rustls_INCLUDE_DIRS} (found version \"${RUSTLS_VERSION}\")")
+else()
+  set(_rustls_pc_requires "")  # Depend on pkg-config only when found via pkg-config
+
+  find_path(RUSTLS_INCLUDE_DIR NAMES "rustls.h")
+  find_library(RUSTLS_LIBRARY NAMES "rustls")
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Rustls
+    REQUIRED_VARS
+      RUSTLS_INCLUDE_DIR
+      RUSTLS_LIBRARY
+  )
+
+  if(RUSTLS_FOUND)
+    set(_rustls_INCLUDE_DIRS ${RUSTLS_INCLUDE_DIR})
+    set(_rustls_LIBRARIES    ${RUSTLS_LIBRARY})
+  endif()
+
+  mark_as_advanced(RUSTLS_INCLUDE_DIR RUSTLS_LIBRARY)
+endif()
+
+if(RUSTLS_FOUND)
+  if(APPLE)
+    find_library(SECURITY_FRAMEWORK NAMES "Security")
+    mark_as_advanced(SECURITY_FRAMEWORK)
+    if(NOT SECURITY_FRAMEWORK)
+      message(FATAL_ERROR "Security framework not found")
+    endif()
+    list(APPEND _rustls_LIBRARIES "-framework Security")
+
+    find_library(FOUNDATION_FRAMEWORK NAMES "Foundation")
+    mark_as_advanced(FOUNDATION_FRAMEWORK)
+    if(NOT FOUNDATION_FRAMEWORK)
+      message(FATAL_ERROR "Foundation framework not found")
+    endif()
+    list(APPEND _rustls_LIBRARIES "-framework Foundation")
+  elseif(NOT WIN32)
+    find_library(PTHREAD_LIBRARY NAMES "pthread")
+    if(PTHREAD_LIBRARY)
+      list(APPEND _rustls_LIBRARIES ${PTHREAD_LIBRARY})
+    endif()
+    mark_as_advanced(PTHREAD_LIBRARY)
+
+    find_library(DL_LIBRARY NAMES "dl")
+    if(DL_LIBRARY)
+      list(APPEND _rustls_LIBRARIES ${DL_LIBRARY})
+    endif()
+    mark_as_advanced(DL_LIBRARY)
+
+    find_library(MATH_LIBRARY NAMES "m")
+    if(MATH_LIBRARY)
+      list(APPEND _rustls_LIBRARIES ${MATH_LIBRARY})
+    endif()
+    mark_as_advanced(MATH_LIBRARY)
+  endif()
+
+  if(NOT TARGET CURL::rustls)
+    add_library(CURL::rustls INTERFACE IMPORTED)
+    set_target_properties(CURL::rustls PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_rustls_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_rustls_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_rustls_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_rustls_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_rustls_LIBRARIES}")
+  endif()
+endif()
diff --git a/third-party/curl/CMake/FindWolfSSL.cmake b/third-party/curl/CMake/FindWolfSSL.cmake
index d67c0eb24d..964320ad6b 100644
--- a/third-party/curl/CMake/FindWolfSSL.cmake
+++ b/third-party/curl/CMake/FindWolfSSL.cmake
@@ -21,16 +21,115 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-find_path(WolfSSL_INCLUDE_DIR NAMES wolfssl/ssl.h)
-find_library(WolfSSL_LIBRARY NAMES wolfssl)
-mark_as_advanced(WolfSSL_INCLUDE_DIR WolfSSL_LIBRARY)
+# Find the wolfSSL library
+#
+# Input variables:
+#
+# - `WOLFSSL_INCLUDE_DIR`:  Absolute path to wolfSSL include directory.
+# - `WOLFSSL_LIBRARY`:      Absolute path to `wolfssl` library.
+#
+# Defines:
+#
+# - `WOLFSSL_FOUND`:        System has wolfSSL.
+# - `WOLFSSL_VERSION`:      Version of wolfSSL.
+# - `CURL::wolfssl`:        wolfSSL library target.
 
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(WolfSSL
-  REQUIRED_VARS WolfSSL_INCLUDE_DIR WolfSSL_LIBRARY
+if(DEFINED WolfSSL_INCLUDE_DIR AND NOT DEFINED WOLFSSL_INCLUDE_DIR)
+  message(WARNING "WolfSSL_INCLUDE_DIR is deprecated, use WOLFSSL_INCLUDE_DIR instead.")
+  set(WOLFSSL_INCLUDE_DIR "${WolfSSL_INCLUDE_DIR}")
+endif()
+if(DEFINED WolfSSL_LIBRARY AND NOT DEFINED WOLFSSL_LIBRARY)
+  message(WARNING "WolfSSL_LIBRARY is deprecated, use WOLFSSL_LIBRARY instead.")
+  set(WOLFSSL_LIBRARY "${WolfSSL_LIBRARY}")
+endif()
+
+set(_wolfssl_pc_requires "wolfssl")
+
+if(NOT DEFINED WOLFSSL_INCLUDE_DIR AND
+   NOT DEFINED WOLFSSL_LIBRARY)
+  if(CURL_USE_PKGCONFIG)
+    find_package(PkgConfig QUIET)
+    pkg_check_modules(_wolfssl ${_wolfssl_pc_requires})
+  endif()
+  if(NOT _wolfssl_FOUND AND CURL_USE_CMAKECONFIG)
+    find_package(wolfssl CONFIG QUIET)
+  endif()
+endif()
+
+if(_wolfssl_FOUND)
+  set(WolfSSL_FOUND TRUE)
+  set(WOLFSSL_FOUND TRUE)
+  set(WOLFSSL_VERSION ${_wolfssl_VERSION})
+  message(STATUS "Found WolfSSL (via pkg-config): ${_wolfssl_INCLUDE_DIRS} (found version \"${WOLFSSL_VERSION}\")")
+elseif(wolfssl_CONFIG)
+  set(WolfSSL_FOUND TRUE)
+  set(WOLFSSL_FOUND TRUE)
+  set(WOLFSSL_VERSION ${wolfssl_VERSION})
+  set(_wolfssl_LIBRARIES wolfssl::wolfssl)
+  message(STATUS "Found WolfSSL (via CMake Config): ${wolfssl_CONFIG} (found version \"${WOLFSSL_VERSION}\")")
+else()
+  find_path(WOLFSSL_INCLUDE_DIR NAMES "wolfssl/ssl.h")
+  find_library(WOLFSSL_LIBRARY NAMES "wolfssl")
+
+  unset(WOLFSSL_VERSION CACHE)
+  if(WOLFSSL_INCLUDE_DIR AND EXISTS "${WOLFSSL_INCLUDE_DIR}/wolfssl/version.h")
+    set(_version_regex "#[\t ]*define[\t ]+LIBWOLFSSL_VERSION_STRING[\t ]+\"([^\"]*)\"")
+    file(STRINGS "${WOLFSSL_INCLUDE_DIR}/wolfssl/version.h" _version_str REGEX "${_version_regex}")
+    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+    set(WOLFSSL_VERSION "${_version_str}")
+    unset(_version_regex)
+    unset(_version_str)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(WolfSSL
+    REQUIRED_VARS
+      WOLFSSL_INCLUDE_DIR
+      WOLFSSL_LIBRARY
+    VERSION_VAR
+      WOLFSSL_VERSION
   )
 
-if(WolfSSL_FOUND)
-  set(WolfSSL_INCLUDE_DIRS ${WolfSSL_INCLUDE_DIR})
-  set(WolfSSL_LIBRARIES ${WolfSSL_LIBRARY})
+  if(WOLFSSL_FOUND)
+    set(_wolfssl_INCLUDE_DIRS ${WOLFSSL_INCLUDE_DIR})
+    set(_wolfssl_LIBRARIES    ${WOLFSSL_LIBRARY})
+  endif()
+
+  mark_as_advanced(WOLFSSL_INCLUDE_DIR WOLFSSL_LIBRARY)
+endif()
+
+if(WOLFSSL_FOUND)
+  if(APPLE)
+    find_library(SECURITY_FRAMEWORK NAMES "Security")
+    mark_as_advanced(SECURITY_FRAMEWORK)
+    if(NOT SECURITY_FRAMEWORK)
+      message(FATAL_ERROR "Security framework not found")
+    endif()
+    list(APPEND _wolfssl_LIBRARIES "-framework Security")
+
+    find_library(COREFOUNDATION_FRAMEWORK NAMES "CoreFoundation")
+    mark_as_advanced(COREFOUNDATION_FRAMEWORK)
+    if(NOT COREFOUNDATION_FRAMEWORK)
+      message(FATAL_ERROR "CoreFoundation framework not found")
+    endif()
+    list(APPEND _wolfssl_LIBRARIES "-framework CoreFoundation")
+  elseif(WIN32)
+    list(APPEND _wolfssl_LIBRARIES "crypt32")
+  else()
+    find_library(MATH_LIBRARY NAMES "m")
+    if(MATH_LIBRARY)
+      list(APPEND _wolfssl_LIBRARIES ${MATH_LIBRARY})  # for log and pow
+    endif()
+    mark_as_advanced(MATH_LIBRARY)
+  endif()
+
+  if(NOT TARGET CURL::wolfssl)
+    add_library(CURL::wolfssl INTERFACE IMPORTED)
+    set_target_properties(CURL::wolfssl PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_wolfssl_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_wolfssl_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_wolfssl_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_wolfssl_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_wolfssl_LIBRARIES}")
+  endif()
 endif()
diff --git a/third-party/curl/CMake/FindZstd.cmake b/third-party/curl/CMake/FindZstd.cmake
index 973e6ad4a9..176645d97b 100644
--- a/third-party/curl/CMake/FindZstd.cmake
+++ b/third-party/curl/CMake/FindZstd.cmake
@@ -21,51 +21,124 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+# Find the zstd library
+#
+# Input variables:
+#
+# - `ZSTD_INCLUDE_DIR`:      Absolute path to zstd include directory.
+# - `ZSTD_LIBRARY`:          Absolute path to `zstd` library.
+# - `ZSTD_USE_STATIC_LIBS`:  Configure for static zstd libraries.
+#
+# Defines:
+#
+# - `ZSTD_FOUND`:            System has zstd.
+# - `ZSTD_VERSION`:          Version of zstd.
+# - `CURL::zstd`:            zstd library target.
 
-#[=======================================================================[.rst:
-FindZstd
-----------
-
-Find the zstd library
-
-Result Variables
-^^^^^^^^^^^^^^^^
-
-``Zstd_FOUND``
-  System has zstd
-``Zstd_INCLUDE_DIRS``
-  The zstd include directories.
-``Zstd_LIBRARIES``
-  The libraries needed to use zstd
-#]=======================================================================]
-
-if(UNIX)
-  find_package(PkgConfig QUIET)
-  pkg_search_module(PC_Zstd libzstd)
+if(DEFINED Zstd_INCLUDE_DIR AND NOT DEFINED ZSTD_INCLUDE_DIR)
+  message(WARNING "Zstd_INCLUDE_DIR is deprecated, use ZSTD_INCLUDE_DIR instead.")
+  set(ZSTD_INCLUDE_DIR "${Zstd_INCLUDE_DIR}")
+endif()
+if(DEFINED Zstd_LIBRARY AND NOT DEFINED ZSTD_LIBRARY)
+  message(WARNING "Zstd_LIBRARY is deprecated, use ZSTD_LIBRARY instead.")
+  set(ZSTD_LIBRARY "${Zstd_LIBRARY}")
 endif()
 
-find_path(Zstd_INCLUDE_DIR zstd.h
-  HINTS
-    ${PC_Zstd_INCLUDEDIR}
-    ${PC_Zstd_INCLUDE_DIRS}
-)
+set(_zstd_pc_requires "libzstd")
 
-find_library(Zstd_LIBRARY NAMES zstd
-  HINTS
-    ${PC_Zstd_LIBDIR}
-    ${PC_Zstd_LIBRARY_DIRS}
-)
-
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(Zstd
-  REQUIRED_VARS
-    Zstd_LIBRARY
-    Zstd_INCLUDE_DIR
-)
-
-if(Zstd_FOUND)
-  set(Zstd_LIBRARIES    ${Zstd_LIBRARY})
-  set(Zstd_INCLUDE_DIRS ${Zstd_INCLUDE_DIR})
+if(NOT DEFINED ZSTD_INCLUDE_DIR AND
+   NOT DEFINED ZSTD_LIBRARY)
+  if(CURL_USE_PKGCONFIG)
+    find_package(PkgConfig QUIET)
+    pkg_check_modules(_zstd ${_zstd_pc_requires})
+  endif()
+  if(NOT _zstd_FOUND AND CURL_USE_CMAKECONFIG)
+    find_package(zstd CONFIG QUIET)
+    # Skip using if older than v1.4.5
+    if(zstd_CONFIG AND
+       NOT TARGET zstd::libzstd_static AND
+       NOT TARGET zstd::libzstd_shared)
+      unset(zstd_CONFIG)
+    endif()
+  endif()
 endif()
 
-mark_as_advanced(Zstd_INCLUDE_DIRS Zstd_LIBRARIES)
+if(_zstd_FOUND)
+  set(Zstd_FOUND TRUE)
+  set(ZSTD_FOUND TRUE)
+  set(ZSTD_VERSION ${_zstd_VERSION})
+  if(ZSTD_USE_STATIC_LIBS)
+    set(_zstd_CFLAGS       "${_zstd_STATIC_CFLAGS}")
+    set(_zstd_INCLUDE_DIRS "${_zstd_STATIC_INCLUDE_DIRS}")
+    set(_zstd_LIBRARY_DIRS "${_zstd_STATIC_LIBRARY_DIRS}")
+    set(_zstd_LIBRARIES    "${_zstd_STATIC_LIBRARIES}")
+  endif()
+  message(STATUS "Found Zstd (via pkg-config): ${_zstd_INCLUDE_DIRS} (found version \"${ZSTD_VERSION}\")")
+elseif(zstd_CONFIG)
+  set(Zstd_FOUND TRUE)
+  set(ZSTD_FOUND TRUE)
+  set(ZSTD_VERSION ${zstd_VERSION})
+  if(ZSTD_USE_STATIC_LIBS)
+    set(_zstd_LIBRARIES zstd::libzstd_static)
+  elseif(TARGET zstd::libzstd)
+    set(_zstd_LIBRARIES zstd::libzstd)  # v1.5.6+
+  else()
+    set(_zstd_LIBRARIES zstd::libzstd_shared)
+  endif()
+  message(STATUS "Found Zstd (via CMake Config): ${zstd_CONFIG} (found version \"${ZSTD_VERSION}\")")
+else()
+  find_path(ZSTD_INCLUDE_DIR NAMES "zstd.h")
+  if(ZSTD_USE_STATIC_LIBS)
+    find_library(ZSTD_LIBRARY NAMES "zstd_static" "zstd")
+  else()
+    find_library(ZSTD_LIBRARY NAMES "zstd")
+  endif()
+
+  unset(ZSTD_VERSION CACHE)
+  if(ZSTD_INCLUDE_DIR AND EXISTS "${ZSTD_INCLUDE_DIR}/zstd.h")
+    set(_version_regex1 "#[\t ]*define[ \t]+ZSTD_VERSION_MAJOR[ \t]+([0-9]+).*")
+    set(_version_regex2 "#[\t ]*define[ \t]+ZSTD_VERSION_MINOR[ \t]+([0-9]+).*")
+    set(_version_regex3 "#[\t ]*define[ \t]+ZSTD_VERSION_RELEASE[ \t]+([0-9]+).*")
+    file(STRINGS "${ZSTD_INCLUDE_DIR}/zstd.h" _version_str1 REGEX "${_version_regex1}")
+    file(STRINGS "${ZSTD_INCLUDE_DIR}/zstd.h" _version_str2 REGEX "${_version_regex2}")
+    file(STRINGS "${ZSTD_INCLUDE_DIR}/zstd.h" _version_str3 REGEX "${_version_regex3}")
+    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
+    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
+    string(REGEX REPLACE "${_version_regex3}" "\\1" _version_str3 "${_version_str3}")
+    set(ZSTD_VERSION "${_version_str1}.${_version_str2}.${_version_str3}")
+    unset(_version_regex1)
+    unset(_version_regex2)
+    unset(_version_regex3)
+    unset(_version_str1)
+    unset(_version_str2)
+    unset(_version_str3)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Zstd
+    REQUIRED_VARS
+      ZSTD_INCLUDE_DIR
+      ZSTD_LIBRARY
+    VERSION_VAR
+      ZSTD_VERSION
+  )
+
+  if(ZSTD_FOUND)
+    set(_zstd_INCLUDE_DIRS ${ZSTD_INCLUDE_DIR})
+    set(_zstd_LIBRARIES    ${ZSTD_LIBRARY})
+  endif()
+
+  mark_as_advanced(ZSTD_INCLUDE_DIR ZSTD_LIBRARY)
+endif()
+
+if(ZSTD_FOUND)
+  if(NOT TARGET CURL::zstd)
+    add_library(CURL::zstd INTERFACE IMPORTED)
+    set_target_properties(CURL::zstd PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_zstd_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_zstd_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_zstd_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_zstd_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_zstd_LIBRARIES}")
+  endif()
+endif()
diff --git a/third-party/curl/CMake/Macros.cmake b/third-party/curl/CMake/Macros.cmake
index e12bf303f4..953c1c6ee6 100644
--- a/third-party/curl/CMake/Macros.cmake
+++ b/third-party/curl/CMake/Macros.cmake
@@ -21,102 +21,260 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-#File defines convenience macros for available feature testing
-
-# This macro checks if the symbol exists in the library and if it
-# does, it prepends library to the list.  It is intended to be called
-# multiple times with a sequence of possibly dependent libraries in
-# order of least-to-most-dependent.  Some libraries depend on others
-# to link correctly.
-macro(check_library_exists_concat LIBRARY SYMBOL VARIABLE)
-  check_library_exists("${LIBRARY};${CURL_LIBS}" ${SYMBOL} "${CMAKE_LIBRARY_PATH}"
-    ${VARIABLE})
-  if(${VARIABLE})
-    set(CURL_LIBS ${LIBRARY} ${CURL_LIBS})
-  endif()
-endmacro()
+# File defines convenience macros for available feature testing
 
 # Check if header file exists and add it to the list.
 # This macro is intended to be called multiple times with a sequence of
 # possibly dependent header files.  Some headers depend on others to be
 # compiled correctly.
-macro(check_include_file_concat FILE VARIABLE)
-  check_include_files("${CURL_INCLUDES};${FILE}" ${VARIABLE})
-  if(${VARIABLE})
-    set(CURL_INCLUDES ${CURL_INCLUDES} ${FILE})
-    set(CURL_TEST_DEFINES "${CURL_TEST_DEFINES} -D${VARIABLE}")
+macro(check_include_file_concat_curl _file _variable)
+  check_include_files("${CURL_INCLUDES};${_file}" ${_variable})
+  if(${_variable})
+    list(APPEND CURL_INCLUDES ${_file})
   endif()
 endmacro()
 
+set(CURL_TEST_DEFINES "")  # Initialize global variable
+
 # For other curl specific tests, use this macro.
-macro(curl_internal_test CURL_TEST)
-  if(NOT DEFINED "${CURL_TEST}")
-    set(MACRO_CHECK_FUNCTION_DEFINITIONS
-      "-D${CURL_TEST} ${CURL_TEST_DEFINES} ${CMAKE_REQUIRED_FLAGS}")
-    if(CMAKE_REQUIRED_LIBRARIES)
-      set(CURL_TEST_ADD_LIBRARIES
-        "-DLINK_LIBRARIES:STRING=${CMAKE_REQUIRED_LIBRARIES}")
-    endif()
-
-    message(STATUS "Performing Curl Test ${CURL_TEST}")
-    try_compile(${CURL_TEST}
-      ${CMAKE_BINARY_DIR}
-      ${CMAKE_CURRENT_SOURCE_DIR}/CMake/CurlTests.c
-      CMAKE_FLAGS -DCOMPILE_DEFINITIONS:STRING=${MACRO_CHECK_FUNCTION_DEFINITIONS}
-      "${CURL_TEST_ADD_LIBRARIES}"
-      OUTPUT_VARIABLE OUTPUT)
-    if(${CURL_TEST})
-      set(${CURL_TEST} 1 CACHE INTERNAL "Curl test ${FUNCTION}")
-      message(STATUS "Performing Curl Test ${CURL_TEST} - Success")
-      file(APPEND ${CMAKE_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/CMakeOutput.log
-        "Performing Curl Test ${CURL_TEST} passed with the following output:\n"
-        "${OUTPUT}\n")
+# Return result in variable: CURL_TEST_OUTPUT
+macro(curl_internal_test _curl_test)
+  if(NOT DEFINED "${_curl_test}")
+    message(STATUS "Performing Test ${_curl_test}")
+    try_compile(${_curl_test}
+      ${PROJECT_BINARY_DIR}
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/CurlTests.c"
+      COMPILE_DEFINITIONS "-D${_curl_test}" ${CURL_TEST_DEFINES} ${CMAKE_REQUIRED_FLAGS} ${CMAKE_REQUIRED_DEFINITIONS}
+      LINK_LIBRARIES "${CMAKE_REQUIRED_LIBRARIES}"
+      OUTPUT_VARIABLE CURL_TEST_OUTPUT)
+    if(${_curl_test})
+      set(${_curl_test} 1 CACHE INTERNAL "curl test")
+      message(STATUS "Performing Test ${_curl_test} - Success")
     else()
-      message(STATUS "Performing Curl Test ${CURL_TEST} - Failed")
-      set(${CURL_TEST} "" CACHE INTERNAL "Curl test ${FUNCTION}")
-      file(APPEND ${CMAKE_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/CMakeError.log
-        "Performing Curl Test ${CURL_TEST} failed with the following output:\n"
-        "${OUTPUT}\n")
+      set(${_curl_test} "" CACHE INTERNAL "curl test")
+      message(STATUS "Performing Test ${_curl_test} - Failed")
     endif()
   endif()
 endmacro()
 
-macro(curl_nroff_check)
-  find_program(NROFF NAMES gnroff nroff)
-  if(NROFF)
-    # Need a way to write to stdin, this will do
-    file(WRITE "${CMAKE_CURRENT_BINARY_DIR}/nroff-input.txt" "test")
-    # Tests for a valid nroff option to generate a manpage
-    foreach(_MANOPT "-man" "-mandoc")
-      execute_process(COMMAND "${NROFF}" ${_MANOPT}
-        OUTPUT_VARIABLE NROFF_MANOPT_OUTPUT
-        INPUT_FILE "${CMAKE_CURRENT_BINARY_DIR}/nroff-input.txt"
-        ERROR_QUIET)
-      # Save the option if it was valid
-      if(NROFF_MANOPT_OUTPUT)
-        message("Found *nroff option: -- ${_MANOPT}")
-        set(NROFF_MANOPT ${_MANOPT})
-        set(NROFF_USEFUL ON)
-        break()
-      endif()
-    endforeach()
-    # No need for the temporary file
-    file(REMOVE "${CMAKE_CURRENT_BINARY_DIR}/nroff-input.txt")
-    if(NOT NROFF_USEFUL)
-      message(WARNING "Found no *nroff option to get plaintext from man pages")
+# Option for dependencies that accepts an 'AUTO' value, which enables the dependency if detected.
+macro(curl_dependency_option _option_name _find_name _desc_name)
+  set(${_option_name} "AUTO" CACHE STRING "Build curl with ${_desc_name} support (AUTO, ON or OFF)")
+  set_property(CACHE ${_option_name} PROPERTY STRINGS "AUTO" "ON" "OFF")
+
+  if(${_option_name} STREQUAL "AUTO")
+    if(_find_name STREQUAL "ZLIB")
+      find_package(${_find_name})
+    else()
+      find_package(${_find_name} MODULE)
+    endif()
+  elseif(${_option_name})
+    if(_find_name STREQUAL "ZLIB")
+      find_package(${_find_name} REQUIRED)
+    else()
+      find_package(${_find_name} MODULE REQUIRED)
     endif()
   else()
-    message(WARNING "Found no *nroff program")
+    string(TOUPPER "${_find_name}" _find_name_upper)
+    set(${_find_name}_FOUND OFF)  # cmake-lint: disable=C0103
+    set(${_find_name_upper}_FOUND OFF)  # cmake-lint: disable=C0103
   endif()
 endmacro()
 
-macro(optional_dependency DEPENDENCY)
-  set(CURL_${DEPENDENCY} AUTO CACHE STRING "Build curl with ${DEPENDENCY} support (AUTO, ON or OFF)")
-  set_property(CACHE CURL_${DEPENDENCY} PROPERTY STRINGS AUTO ON OFF)
-
-  if(CURL_${DEPENDENCY} STREQUAL AUTO)
-    find_package(${DEPENDENCY})
-  elseif(CURL_${DEPENDENCY})
-    find_package(${DEPENDENCY} REQUIRED)
+# Convert the passed paths to libpath linker options and add them to CMAKE_REQUIRED_*.
+macro(curl_required_libpaths _libpaths_arg)
+  if(CMAKE_VERSION VERSION_LESS 3.31)
+    set(_libpaths "${_libpaths_arg}")
+    foreach(_libpath IN LISTS _libpaths)
+      list(APPEND CMAKE_REQUIRED_LINK_OPTIONS "${CMAKE_LIBRARY_PATH_FLAG}${_libpath}")
+    endforeach()
+  else()
+    list(APPEND CMAKE_REQUIRED_LINK_DIRECTORIES "${_libpaths_arg}")
   endif()
 endmacro()
+
+# Pre-fill variables set by a check_type_size() call.
+macro(curl_prefill_type_size _type _size)
+  set(HAVE_SIZEOF_${_type} TRUE)
+  set(SIZEOF_${_type} ${_size})
+  set(SIZEOF_${_type}_CODE "#define SIZEOF_${_type} ${_size}")
+endmacro()
+
+# Internal: Recurse into target libraries and collect their include directories
+# and macro definitions.
+macro(curl_collect_target_compile_options _target)
+  get_target_property(_val ${_target} INTERFACE_COMPILE_DEFINITIONS)
+  if(_val)
+    list(APPEND _definitions ${_val})
+  endif()
+  get_target_property(_val ${_target} INTERFACE_INCLUDE_DIRECTORIES)
+  if(_val)
+    list(APPEND _incsys ${_val})
+  endif()
+  get_target_property(_val ${_target} INTERFACE_COMPILE_OPTIONS)
+  if(_val)
+    list(APPEND _options ${_val})
+  endif()
+  get_target_property(_val ${_target} LINK_LIBRARIES)
+  if(_val)
+    foreach(_lib IN LISTS _val)
+      if(TARGET "${_lib}")
+        curl_collect_target_compile_options(${_lib})
+      endif()
+    endforeach()
+  endif()
+  unset(_val)
+endmacro()
+
+# Create a clang-tidy target for test targets
+function(curl_add_clang_tidy_test_target _target_clang_tidy _target)
+  if(CURL_CLANG_TIDY)
+
+    set(_definitions "")
+    set(_includes "")
+    set(_incsys "")
+    set(_options "")
+
+    # Make a list of known system include directories
+    set(_sys_incdirs "${CMAKE_C_IMPLICIT_INCLUDE_DIRECTORIES}")
+    foreach(_inc IN LISTS CMAKE_SYSTEM_PREFIX_PATH)
+      if(NOT _inc MATCHES "/$")
+        string(APPEND _inc "/")
+      endif()
+      string(APPEND _inc "include")
+      if(NOT _inc IN_LIST _sys_incdirs AND IS_DIRECTORY "${_inc}")
+        list(APPEND _sys_incdirs "${_inc}")
+      endif()
+    endforeach()
+
+    # Collect options applying to the directory
+    get_directory_property(_val COMPILE_DEFINITIONS)
+    if(_val)
+      list(APPEND _definitions ${_val})
+    endif()
+    get_directory_property(_val INCLUDE_DIRECTORIES)
+    if(_val)
+      list(APPEND _includes ${_val})
+    endif()
+    get_directory_property(_val COMPILE_OPTIONS)
+    if(_val)
+      list(APPEND _options ${_val})
+    endif()
+
+    # Collect options applying to the target
+    get_target_property(_val ${_target} COMPILE_DEFINITIONS)
+    if(_val)
+      list(APPEND _definitions ${_val})
+    endif()
+    get_target_property(_val ${_target} INCLUDE_DIRECTORIES)
+    if(_val)
+      list(APPEND _includes ${_val})
+    endif()
+    get_target_property(_val ${_target} COMPILE_OPTIONS)
+    if(_val)
+      list(APPEND _options ${_val})
+    endif()
+
+    # Collect header directories and macro definitions from lib dependencies
+    curl_collect_target_compile_options(${_target})
+
+    list(REMOVE_ITEM _definitions "")
+    string(REPLACE ";" ";-D" _definitions ";${_definitions}")
+    list(REMOVE_DUPLICATES _definitions)
+    list(SORT _definitions)  # Sort like CMake does
+
+    list(REMOVE_ITEM _includes "")
+    string(REPLACE ";" ";-I" _includes ";${_includes}")
+    list(REMOVE_DUPLICATES _includes)
+
+    set(_incsys_tmp ${_incsys})
+    list(REMOVE_DUPLICATES _incsys_tmp)
+    set(_incsys "")
+    set(_incsystop "")
+    foreach(_inc IN LISTS _incsys_tmp)
+      if(_inc IN_LIST _sys_incdirs)
+        list(APPEND _incsystop "${_inc}")  # Save system prefixes to re-add them later to the end of list
+        continue()
+      endif()
+      # Avoid empty and '$<INSTALL_INTERFACE:include>' items. The latter
+      # evaluates to an empty path in this context. Also skip
+      # '$<BUILD_INTERFACE:curl-include>', as already present in '_includes'.
+      if(_inc AND
+         NOT _inc MATCHES "INSTALL_INTERFACE:" AND
+         NOT _inc MATCHES "BUILD_INTERFACE:")
+        list(APPEND _incsys "-isystem" "${_inc}")
+      endif()
+    endforeach()
+    foreach(_inc IN LISTS _incsystop)
+      list(APPEND _incsys "-isystem" "${_inc}")
+    endforeach()
+
+    if(CMAKE_C_COMPILER_ID MATCHES "Clang")
+      list(REMOVE_DUPLICATES _options)  # Keep the first of duplicates to imitate CMake
+    else()
+      set(_options)
+    endif()
+
+    # Assemble source list
+    set(_sources "")
+    foreach(_source IN ITEMS ${ARGN})
+      if(NOT EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/${_source}")  # if not in source tree
+        set(_source "${CMAKE_CURRENT_BINARY_DIR}/${_source}")  # look in the build tree, for generated files, e.g. lib1521.c
+      endif()
+      list(APPEND _sources "${_source}")
+    endforeach()
+
+    set(_cc "${CMAKE_C_COMPILER}")
+    if(CMAKE_C_COMPILER_TARGET AND CMAKE_C_COMPILE_OPTIONS_TARGET)
+      list(APPEND _cc "${CMAKE_C_COMPILE_OPTIONS_TARGET}${CMAKE_C_COMPILER_TARGET}")
+    endif()
+    if(APPLE AND CMAKE_OSX_SYSROOT)
+      list(APPEND _cc "-isysroot" "${CMAKE_OSX_SYSROOT}")
+    elseif(CMAKE_SYSROOT AND CMAKE_C_COMPILE_OPTIONS_SYSROOT)
+      list(APPEND _cc "${CMAKE_C_COMPILE_OPTIONS_SYSROOT}${CMAKE_SYSROOT}")
+    endif()
+
+    # Pass -clang-diagnostic-unused-function to disable -Wunused-function implied by -Wunused
+    add_custom_target(${_target_clang_tidy} USES_TERMINAL
+      WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
+      COMMAND ${CMAKE_C_CLANG_TIDY}
+        "--checks=-clang-diagnostic-unused-function"
+        ${_sources} -- ${_cc} ${_definitions} ${_includes} ${_incsys} ${_options}
+      DEPENDS ${_sources})
+    add_dependencies(tests-clang-tidy ${_target_clang_tidy})
+  endif()
+endfunction()
+
+# Internal: Recurse into interface targets and collect their libraries
+# and library paths.
+macro(curl_collect_target_link_options _target)
+  get_target_property(_val ${_target} INTERFACE_LINK_DIRECTORIES)
+  if(_val)
+    list(APPEND _libdirs ${_val})
+  endif()
+  get_target_property(_val ${_target} IMPORTED)
+  if(_val)
+    # LOCATION is empty for interface library targets and safe to ignore.
+    # Explicitly skip this query to avoid CMake v3.18 and older erroring out.
+    get_target_property(_val ${_target} TYPE)
+    if(NOT "${_val}" STREQUAL "INTERFACE_LIBRARY")
+      get_target_property(_val ${_target} LOCATION)
+      if(_val)
+        list(APPEND _libs ${_val})
+      endif()
+    endif()
+  endif()
+  get_target_property(_val ${_target} INTERFACE_LINK_LIBRARIES)
+  if(_val)
+    foreach(_lib IN LISTS _val)
+      # Extract imported target name from e.g. "$<LINK_ONLY:OpenSSL::Crypto>" set by libssh2
+      string(REGEX REPLACE "^\\\$<LINK_ONLY:(.*)>\$" "\\1" _lib "${_lib}")
+      if(TARGET "${_lib}")
+        curl_collect_target_link_options(${_lib})
+      else()
+        list(APPEND _libs ${_lib})
+      endif()
+    endforeach()
+  endif()
+  unset(_val)
+endmacro()
diff --git a/third-party/curl/CMake/OtherTests.cmake b/third-party/curl/CMake/OtherTests.cmake
index 762e6d1a5e..6619f3ab3e 100644
--- a/third-party/curl/CMake/OtherTests.cmake
+++ b/third-party/curl/CMake/OtherTests.cmake
@@ -22,114 +22,128 @@
 #
 ###########################################################################
 include(CheckCSourceCompiles)
-# The begin of the sources (macros and includes)
-set(_source_epilogue "#undef inline")
+include(CheckCSourceRuns)
+include(CheckTypeSize)
 
-macro(add_header_include check header)
-  if(${check})
-    set(_source_epilogue "${_source_epilogue}\n#include <${header}>")
+# #include header if condition is true
+macro(curl_add_header_include _check _header)
+  if(${_check})
+    set(_source_epilogue "${_source_epilogue}
+      #include <${_header}>")
   endif()
 endmacro()
 
-set(signature_call_conv)
-if(HAVE_WINDOWS_H)
-  add_header_include(HAVE_WINSOCK2_H "winsock2.h")
-  add_header_include(HAVE_WINDOWS_H "windows.h")
-  set(_source_epilogue
-      "${_source_epilogue}\n#ifndef WIN32_LEAN_AND_MEAN\n#define WIN32_LEAN_AND_MEAN\n#endif")
-  set(signature_call_conv "PASCAL")
+set(_cmake_try_compile_target_type_save ${CMAKE_TRY_COMPILE_TARGET_TYPE})
+set(CMAKE_TRY_COMPILE_TARGET_TYPE "STATIC_LIBRARY")
+
+if(NOT DEFINED HAVE_STRUCT_SOCKADDR_STORAGE)
+  cmake_push_check_state()
+  set(CMAKE_EXTRA_INCLUDE_FILES "")
   if(WIN32)
-    set(CMAKE_REQUIRED_LIBRARIES ws2_32)
+    set(CMAKE_EXTRA_INCLUDE_FILES "winsock2.h")
+    list(APPEND CMAKE_REQUIRED_LIBRARIES "ws2_32")
+  else()
+    set(CMAKE_EXTRA_INCLUDE_FILES "sys/socket.h")
   endif()
-else()
-  add_header_include(HAVE_SYS_TYPES_H "sys/types.h")
-  add_header_include(HAVE_SYS_SOCKET_H "sys/socket.h")
+  check_type_size("struct sockaddr_storage" SIZEOF_STRUCT_SOCKADDR_STORAGE)
+  set(HAVE_STRUCT_SOCKADDR_STORAGE ${HAVE_SIZEOF_STRUCT_SOCKADDR_STORAGE})
+  cmake_pop_check_state()
 endif()
 
-set(CMAKE_TRY_COMPILE_TARGET_TYPE STATIC_LIBRARY)
-
+set(_source_epilogue "#undef inline")
 check_c_source_compiles("${_source_epilogue}
-  int main(void) {
-    int flag = MSG_NOSIGNAL;
-    (void)flag;
+  #ifdef _MSC_VER
+  #include <winsock2.h>
+  #endif
+  #ifndef _WIN32
+  #include <sys/time.h>
+  #endif
+  #include <time.h>
+  int main(void)
+  {
+    struct timeval ts;
+    ts.tv_sec  = 0;
+    ts.tv_usec = 0;
+    (void)ts;
     return 0;
-  }" HAVE_MSG_NOSIGNAL)
+  }" HAVE_STRUCT_TIMEVAL)
 
-if(NOT HAVE_WINDOWS_H)
-  add_header_include(HAVE_SYS_TIME_H "sys/time.h")
-  add_header_include(TIME_WITH_SYS_TIME "time.h")
-  add_header_include(HAVE_TIME_H "time.h")
-endif()
-check_c_source_compiles("${_source_epilogue}
-int main(void) {
-  struct timeval ts;
-  ts.tv_sec  = 0;
-  ts.tv_usec = 0;
-  (void)ts;
-  return 0;
-}" HAVE_STRUCT_TIMEVAL)
+set(CMAKE_TRY_COMPILE_TARGET_TYPE ${_cmake_try_compile_target_type_save})
+unset(_cmake_try_compile_target_type_save)
 
-if(HAVE_WINDOWS_H)
-  set(CMAKE_EXTRA_INCLUDE_FILES winsock2.h)
-else()
-  set(CMAKE_EXTRA_INCLUDE_FILES)
-  if(HAVE_SYS_SOCKET_H)
-    set(CMAKE_EXTRA_INCLUDE_FILES sys/socket.h)
-  endif()
+# Detect HAVE_GETADDRINFO_THREADSAFE
+
+if(WIN32)
+  set(HAVE_GETADDRINFO_THREADSAFE ${HAVE_GETADDRINFO})
+elseif(NOT HAVE_GETADDRINFO)
+  set(HAVE_GETADDRINFO_THREADSAFE FALSE)
+elseif(APPLE OR
+       AIX OR CMAKE_SYSTEM_NAME STREQUAL "AIX" OR
+       CMAKE_SYSTEM_NAME STREQUAL "FreeBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "HP-UX" OR
+       CMAKE_SYSTEM_NAME STREQUAL "MidnightBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "NetBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "SunOS")
+  set(HAVE_GETADDRINFO_THREADSAFE TRUE)
+elseif(BSD OR CMAKE_SYSTEM_NAME MATCHES "BSD")
+  set(HAVE_GETADDRINFO_THREADSAFE FALSE)
 endif()
 
-check_type_size("struct sockaddr_storage" SIZEOF_STRUCT_SOCKADDR_STORAGE)
-if(HAVE_SIZEOF_STRUCT_SOCKADDR_STORAGE)
-  set(HAVE_STRUCT_SOCKADDR_STORAGE 1)
-endif()
-
-unset(CMAKE_TRY_COMPILE_TARGET_TYPE)
-
-if(NOT CMAKE_CROSSCOMPILING)
-  if(NOT ${CMAKE_SYSTEM_NAME} MATCHES "Darwin" AND NOT ${CMAKE_SYSTEM_NAME} MATCHES "iOS")
-    # only try this on non-apple platforms
-
-    # if not cross-compilation...
-    include(CheckCSourceRuns)
-    set(CMAKE_REQUIRED_FLAGS "")
-    if(HAVE_SYS_POLL_H)
-      set(CMAKE_REQUIRED_FLAGS "-DHAVE_SYS_POLL_H")
-    elseif(HAVE_POLL_H)
-      set(CMAKE_REQUIRED_FLAGS "-DHAVE_POLL_H")
-    endif()
-    check_c_source_runs("
-      #include <stdlib.h>
-      #include <sys/time.h>
-
-      #ifdef HAVE_SYS_POLL_H
-      #  include <sys/poll.h>
-      #elif  HAVE_POLL_H
-      #  include <poll.h>
-      #endif
+if(NOT DEFINED HAVE_GETADDRINFO_THREADSAFE)
+  set(_source_epilogue "#undef inline
+    #ifndef _WIN32
+    #include <sys/socket.h>
+    #include <sys/time.h>
+    #endif")
+  curl_add_header_include(HAVE_NETDB_H "netdb.h")
+  check_c_source_compiles("${_source_epilogue}
+    int main(void)
+    {
+    #ifndef h_errno
+      #error force compilation error
+    #endif
+      return 0;
+    }" HAVE_H_ERRNO)
 
+  if(NOT HAVE_H_ERRNO)
+    check_c_source_compiles("${_source_epilogue}
       int main(void)
       {
-          if(0 != poll(0, 0, 10)) {
-            return 1; /* fail */
-          }
-          else {
-            /* detect the 10.12 poll() breakage */
-            struct timeval before, after;
-            int rc;
-            size_t us;
+        h_errno = 2;
+        return h_errno != 0 ? 1 : 0;
+      }" HAVE_H_ERRNO_ASSIGNABLE)
 
-            gettimeofday(&before, NULL);
-            rc = poll(NULL, 0, 500);
-            gettimeofday(&after, NULL);
-
-            us = (after.tv_sec - before.tv_sec) * 1000000 +
-              (after.tv_usec - before.tv_usec);
-
-            if(us < 400000) {
-              return 1;
-            }
-          }
+    if(NOT HAVE_H_ERRNO_ASSIGNABLE)
+      check_c_source_compiles("${_source_epilogue}
+        int main(void)
+        {
+        #if defined(_POSIX_C_SOURCE) && (_POSIX_C_SOURCE >= 200809L)
+        #elif defined(_XOPEN_SOURCE) && (_XOPEN_SOURCE >= 700)
+        #else
+          #error force compilation error
+        #endif
           return 0;
-    }" HAVE_POLL_FINE)
+        }" HAVE_H_ERRNO_SBS_ISSUE_7)
+    endif()
+  endif()
+
+  if(HAVE_H_ERRNO OR HAVE_H_ERRNO_ASSIGNABLE OR HAVE_H_ERRNO_SBS_ISSUE_7)
+    set(HAVE_GETADDRINFO_THREADSAFE TRUE)
   endif()
 endif()
+
+if(NOT WIN32 AND NOT DEFINED HAVE_CLOCK_GETTIME_MONOTONIC_RAW)
+  set(_source_epilogue "#undef inline")
+  curl_add_header_include(HAVE_SYS_TYPES_H "sys/types.h")
+  check_c_source_compiles("${_source_epilogue}
+    #include <sys/time.h>
+    #include <time.h>
+    int main(void)
+    {
+      struct timespec ts;
+      (void)clock_gettime(CLOCK_MONOTONIC_RAW, &ts);
+      return 0;
+    }" HAVE_CLOCK_GETTIME_MONOTONIC_RAW)
+endif()
+
+unset(_source_epilogue)
diff --git a/third-party/curl/CMake/PickyWarnings.cmake b/third-party/curl/CMake/PickyWarnings.cmake
index 1310cb4fbe..1ce5f7bda6 100644
--- a/third-party/curl/CMake/PickyWarnings.cmake
+++ b/third-party/curl/CMake/PickyWarnings.cmake
@@ -23,38 +23,84 @@
 ###########################################################################
 include(CheckCCompilerFlag)
 
+set(_picky "")
+set(_picky_nocheck "")  # not to pass to feature checks
+
+if(CURL_WERROR)
+  if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.24)
+    set(CMAKE_COMPILE_WARNING_AS_ERROR ON)
+  elseif(MSVC)
+    list(APPEND _picky_nocheck "-WX")
+  else()  # llvm/clang and gcc-style options
+    list(APPEND _picky_nocheck "-Werror")
+  endif()
+
+  if((CMAKE_C_COMPILER_ID STREQUAL "GNU" AND
+      NOT DOS AND  # Watt-32 headers use the '#include_next' GCC extension
+      CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 5.0) OR
+     CMAKE_C_COMPILER_ID MATCHES "Clang")
+    list(APPEND _picky_nocheck "-pedantic-errors")
+  endif()
+endif()
+
+if(APPLE AND
+   (CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 3.6) OR
+   (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 6.1))
+  list(APPEND _picky "-Werror=partial-availability")  # clang 3.6  appleclang 6.1
+endif()
+
+if(CMAKE_C_COMPILER_ID STREQUAL "GNU" OR CMAKE_C_COMPILER_ID MATCHES "Clang")
+  list(APPEND _picky "-Werror-implicit-function-declaration")  # clang 1.0  gcc 2.95
+endif()
+
+if(MSVC)
+  list(APPEND _picky "-W4")  # Use the highest warning level for Visual Studio.
+elseif(BORLAND)
+  list(APPEND _picky "-w-")  # Disable warnings on Borland to avoid changing 3rd party code.
+endif()
+
 if(PICKY_COMPILER)
-  if(CMAKE_COMPILER_IS_GNUCC OR CMAKE_C_COMPILER_ID MATCHES "Clang")
+  # Leave disabled for GCC <4.6, because they lack #pragma features to silence locally.
+  if((CMAKE_C_COMPILER_ID STREQUAL "GNU" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 4.6) OR
+     CMAKE_C_COMPILER_ID MATCHES "Clang")
 
     # https://clang.llvm.org/docs/DiagnosticsReference.html
     # https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html
 
-    # WPICKY_ENABLE = Options we want to enable as-is.
-    # WPICKY_DETECT = Options we want to test first and enable if available.
+    # _picky_enable = Options we want to enable as-is.
+    # _picky_detect = Options we want to test first and enable if available.
 
     # Prefer the -Wextra alias with clang.
     if(CMAKE_C_COMPILER_ID MATCHES "Clang")
-      set(WPICKY_ENABLE "-Wextra")
+      set(_picky_enable "-Wextra")
     else()
-      set(WPICKY_ENABLE "-W")
+      set(_picky_enable "-W")
     endif()
 
-    list(APPEND WPICKY_ENABLE
-      -Wall -pedantic
-    )
+    list(APPEND _picky_enable "-Wall")
+
+    if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 3.2) OR
+       (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 4.2) OR
+       CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 4.8)
+      list(APPEND _picky_enable "-Wpedantic")  # clang  3.2  gcc  4.8  appleclang  4.2
+    else()
+      list(APPEND _picky_enable "-pedantic")
+    endif()
 
     # ----------------------------------
     # Add new options here, if in doubt:
     # ----------------------------------
-    set(WPICKY_DETECT
+    set(_picky_detect
     )
 
+    # Notes: -Wno-* options should ideally be disabled at their precise cutoff versions,
+    #        to suppress undesired warnings in case -Weverything is passed as a custom option.
+
     # Assume these options always exist with both clang and gcc.
     # Require clang 3.0 / gcc 2.95 or later.
-    list(APPEND WPICKY_ENABLE
-      -Wbad-function-cast                  # clang  3.0  gcc  2.95
-      -Wconversion                         # clang  3.0  gcc  2.95
-      -Winline                             # clang  1.0  gcc  1.0
+    list(APPEND _picky_enable
+      -Wbad-function-cast                  # clang  2.7  gcc  2.95
+      -Wconversion                         # clang  2.7  gcc  2.95
       -Wmissing-declarations               # clang  1.0  gcc  2.7
       -Wmissing-prototypes                 # clang  1.0  gcc  1.0
       -Wnested-externs                     # clang  1.0  gcc  2.7
@@ -69,129 +115,348 @@ if(PICKY_COMPILER)
     )
 
     # Always enable with clang, version dependent with gcc
-    set(WPICKY_COMMON_OLD
+    set(_picky_common_old
+      -Waddress                            # clang  2.7  gcc  4.3
+      -Wattributes                         # clang  2.7  gcc  4.1
       -Wcast-align                         # clang  1.0  gcc  4.2
+      -Wcast-qual                          # clang  2.7  gcc  3.4.6
       -Wdeclaration-after-statement        # clang  1.0  gcc  3.4
-      -Wempty-body                         # clang  3.0  gcc  4.3
+      -Wdiv-by-zero                        # clang  2.7  gcc  4.1
+      -Wempty-body                         # clang  2.7  gcc  4.3
       -Wendif-labels                       # clang  1.0  gcc  3.3
       -Wfloat-equal                        # clang  1.0  gcc  2.96 (3.0)
-      -Wignored-qualifiers                 # clang  3.0  gcc  4.3
-      -Wno-format-nonliteral               # clang  1.0  gcc  2.96 (3.0)
-      -Wno-sign-conversion                 # clang  3.0  gcc  4.3
+      -Wformat-security                    # clang  2.7  gcc  4.1
+      -Wignored-qualifiers                 # clang  2.8  gcc  4.3
+      -Wmissing-field-initializers         # clang  2.7  gcc  4.1
+      -Wmissing-noreturn                   # clang  2.7  gcc  4.1
+      -Wno-padded                          # clang  2.9  gcc  4.1               # Not used: We cannot change public structs
+      -Wno-sign-conversion                 # clang  2.9  gcc  4.3
+      -Wno-switch-default                  # clang  2.7  gcc  4.1               # Not used: Annoying to fix or silence
+      -Wno-switch-enum                     # clang  2.7  gcc  4.1               # Not used: It basically disallows default case
       -Wno-system-headers                  # clang  1.0  gcc  3.0
+      -Wold-style-definition               # clang  2.7  gcc  3.4
+      -Wredundant-decls                    # clang  2.7  gcc  4.1
       -Wstrict-prototypes                  # clang  1.0  gcc  3.3
-      -Wtype-limits                        # clang  3.0  gcc  4.3
+      -Wtype-limits                        # clang  2.7  gcc  4.3
+      -Wunreachable-code                   # clang  2.7  gcc  4.1
+    # -Wunused-macros                      # clang  2.7  gcc  4.1               # Not practical
+    #   -Wno-error=unused-macros           # clang  2.7  gcc  4.1
+      -Wunused-parameter                   # clang  2.7  gcc  4.1
       -Wvla                                # clang  2.8  gcc  4.3
     )
 
-    set(WPICKY_COMMON
-      -Wdouble-promotion                   # clang  3.6  gcc  4.6  appleclang  6.3
-      -Wenum-conversion                    # clang  3.2  gcc 10.0  appleclang  4.6  g++ 11.0
-      -Wunused-const-variable              # clang  3.4  gcc  6.0  appleclang  5.1
-    )
-
     if(CMAKE_C_COMPILER_ID MATCHES "Clang")
-      list(APPEND WPICKY_ENABLE
-        ${WPICKY_COMMON_OLD}
+      list(APPEND _picky_enable
+        ${_picky_common_old}
+        -Wconditional-uninitialized        # clang  3.0
+        -Wno-used-but-marked-unused        # clang  2.9            # for typecheck-gcc.h with clang 14+, dependency headers
         -Wshift-sign-overflow              # clang  2.9
         -Wshorten-64-to-32                 # clang  1.0
+        -Wformat=2                         # clang  2.7  gcc  4.8
       )
+      if(NOT MSVC)
+        list(APPEND _picky_enable
+          -Wlanguage-extension-token       # clang  3.0
+        )
+      endif()
       # Enable based on compiler version
-      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 3.6) OR
-         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 6.3))
-        list(APPEND WPICKY_ENABLE
-          ${WPICKY_COMMON}
+      if(CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 3.1)
+        list(APPEND _picky_enable
+          -Wno-covered-switch-default      # clang  3.1            appleclang  3.1  # Annoying to fix or silence
+          -Wno-disabled-macro-expansion    # clang  3.1            appleclang  3.1  # for std headers, and curl/curl.h (rare combos)
+        )
+        if(MSVC)
+          list(APPEND _picky_enable
+            -Wno-format-non-iso            # clang  3.1            appleclang  3.1  # 'q' length modifier is not supported by ISO C
+          )
+        else()
+          list(APPEND _picky_enable
+            -Wformat-non-iso               # clang  3.1            appleclang  3.1
+          )
+        endif()
+      endif()
+      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 3.3) OR
+         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 5.0))
+        list(APPEND _picky_enable
+          -Wenum-conversion                # clang  3.2  gcc 10.0  appleclang  4.2  g++ 11.0
+          -Wmissing-variable-declarations  # clang  3.2            appleclang  4.2
+          -Wno-documentation-unknown-command # clang  3.3            appleclang  5.0
+          -Wsometimes-uninitialized        # clang  3.2            appleclang  4.2
         )
       endif()
-      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 3.9) OR
-         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 8.3))
-        list(APPEND WPICKY_ENABLE
-          -Wcomma                          # clang  3.9            appleclang  8.3
-          -Wmissing-variable-declarations  # clang  3.2            appleclang  4.6
+      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 3.6) OR
+         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 6.1))
+        list(APPEND _picky_enable
+          -Wdouble-promotion               # clang  3.6  gcc  4.6  appleclang  6.1
+          -Wheader-guard                   # clang  3.4            appleclang  5.1
+          -Wpragmas                        # clang  3.5  gcc  4.1  appleclang  6.0
+        # -Wunreachable-code-break         # clang  3.5            appleclang  6.0  # Not used: Silent in "unity" builds
+          -Wunused-const-variable          # clang  3.4  gcc  6.0  appleclang  5.1
         )
       endif()
-      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 7.0) OR
-         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 10.3))
-        list(APPEND WPICKY_ENABLE
-          -Wassign-enum                    # clang  7.0            appleclang 10.3
-          -Wextra-semi-stmt                # clang  7.0            appleclang 10.3
+      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 3.9) OR
+         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 8.1))
+        list(APPEND _picky_enable
+          -Wcomma                          # clang  3.9            appleclang  8.1
         )
+        if(MSVC)
+          list(APPEND _picky_enable
+            -Wno-nonportable-system-include-path  # clang 3.9            appleclang  8.1  # No truly portable solution to this
+          )
+        endif()
+      endif()
+      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 7.0) OR
+         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 11))
+        list(APPEND _picky_enable
+          -Wassign-enum                    # clang  7.0            appleclang 11.0
+          -Wextra-semi-stmt                # clang  7.0            appleclang 11.0
+        )
+      endif()
+      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 10.0) OR
+         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 12))
+        list(APPEND _picky_enable
+          -Wimplicit-fallthrough           # clang  4.0  gcc  7.0  appleclang  9.0  # We do silencing for clang 10.0 and above only
+          -Wxor-used-as-pow                # clang 10.0  gcc 13.0  appleclang 12.0
+        )
+      endif()
+      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 13.0) OR
+         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 13.1))
+        list(APPEND _picky_enable
+          -Wcast-function-type             # clang 13.0            appleclang 13.1
+          -Wreserved-identifier            # clang 13.0            appleclang 13.1  # Keep it before -Wno-reserved-macro-identifier
+            -Wno-reserved-macro-identifier # clang 13.0            appleclang 13.1  # External macros have to be set sometimes
+        )
+      endif()
+      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 15.0) OR
+         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 14.0.3))
+        if(CMAKE_GENERATOR STREQUAL "FASTBuild")
+          list(APPEND _picky_enable
+            -Wno-gnu-line-marker           # clang 15.0            appleclang 14.0.3
+          )
+        endif()
+      endif()
+      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 16.0) OR
+         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 15.0))
+        list(APPEND _picky_enable
+          -Wno-unsafe-buffer-usage         # clang 16.0            appleclang 15.0
+        )
+      endif()
+      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 16.0) OR
+         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 16.0))
+        list(APPEND _picky_enable
+          -Wcast-function-type-strict      # clang 16.0            appleclang 16.0
+        )
+      endif()
+      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 19.1) OR
+         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 17.0))
+        list(APPEND _picky_enable
+          -Wformat-signedness              # clang 19.1  gcc  5.1  appleclang 17.0  # In clang-cl enums are signed ints by default
+        )
+      endif()
+      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 21.1) OR
+         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 26.4))
+        list(APPEND _picky_enable
+          -Warray-compare                  # clang 20.1  gcc 12.0  appleclang 26.4
+          -Wc++-hidden-decl                # clang 21.1            appleclang 26.4
+          -Wimplicit-int-enum-cast         # clang 21.1
+          -Wjump-misses-init               # clang 21.1  gcc  4.5  appleclang 26.4
+          -Wno-implicit-void-ptr-cast      # clang 21.1            appleclang 26.4
+          -Wtentative-definition-compat    # clang 21.1            appleclang 26.4
+        )
+        if(WIN32)
+          list(APPEND _picky_enable
+            -Wno-c++-keyword               # clang 21.1            appleclang 26.4  # `wchar_t` triggers it on Windows
+          )
+        else()
+          list(APPEND _picky_enable
+            -Wc++-keyword                  # clang 21.1            appleclang 26.4
+          )
+        endif()
       endif()
     else()  # gcc
-      list(APPEND WPICKY_DETECT
-        ${WPICKY_COMMON}
-      )
       # Enable based on compiler version
-      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 4.3)
-        list(APPEND WPICKY_ENABLE
-          ${WPICKY_COMMON_OLD}
+      if(CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 4.3)
+        list(APPEND _picky_enable
+          ${_picky_common_old}
+          -Wclobbered                      #             gcc  4.3
           -Wmissing-parameter-type         #             gcc  4.3
           -Wold-style-declaration          #             gcc  4.3
+          -Wpragmas                        # clang  3.5  gcc  4.1  appleclang  6.0
           -Wstrict-aliasing=3              #             gcc  4.0
+          -ftree-vrp                       #             gcc  4.3 (required for -Warray-bounds, included in -Wall)
         )
       endif()
-      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 4.5 AND MINGW)
-        list(APPEND WPICKY_ENABLE
-          -Wno-pedantic-ms-format          #             gcc  4.5 (mingw-only)
+      if(CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 4.5)
+        list(APPEND _picky_enable
+          -Wjump-misses-init               # clang 21.1  gcc  4.5  appleclang 26.4
+        )
+        if(MINGW)
+          list(APPEND _picky_enable
+            -Wno-pedantic-ms-format        #             gcc  4.5 (MinGW-only)
+          )
+        endif()
+      endif()
+      if(CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 4.8)
+        list(APPEND _picky_enable
+          -Wdouble-promotion               # clang  3.6  gcc  4.6  appleclang  6.1
+          -Wformat=2                       # clang  2.7  gcc  4.8
+          -Wlogical-op                     #             gcc  4.4
+          -Wtrampolines                    #             gcc  4.6
         )
       endif()
-      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 4.8)
-        list(APPEND WPICKY_ENABLE
-          -Wformat=2                       # clang  3.0  gcc  4.8 (clang part-default, enabling it fully causes -Wformat-nonliteral warnings)
+      if(CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 5.0)
+        list(APPEND _picky_enable
+          -Warray-bounds=2                 # clang  2.9  gcc  5.0 (clang default: -Warray-bounds)
+          -Wformat-signedness              # clang 19.1  gcc  5.1  appleclang 17.0
         )
       endif()
-      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 5.0)
-        list(APPEND WPICKY_ENABLE
-          -Warray-bounds=2 -ftree-vrp      # clang  3.0  gcc  5.0 (clang default: -Warray-bounds)
-        )
-      endif()
-      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 6.0)
-        list(APPEND WPICKY_ENABLE
+      if(CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 6.0)
+        list(APPEND _picky_enable
           -Wduplicated-cond                #             gcc  6.0
-          -Wnull-dereference               # clang  3.0  gcc  6.0 (clang default)
+          -Wnull-dereference               # clang  2.9  gcc  6.0 (clang default)
             -fdelete-null-pointer-checks
           -Wshift-negative-value           # clang  3.7  gcc  6.0 (clang default)
-          -Wshift-overflow=2               # clang  3.0  gcc  6.0 (clang default: -Wshift-overflow)
+          -Wshift-overflow=2               # clang  2.9  gcc  6.0 (clang default: -Wshift-overflow)
+          -Wunused-const-variable          # clang  3.4  gcc  6.0  appleclang  5.1
         )
       endif()
-      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 7.0)
-        list(APPEND WPICKY_ENABLE
+      if(CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 7.0)
+        list(APPEND _picky_enable
           -Walloc-zero                     #             gcc  7.0
           -Wduplicated-branches            #             gcc  7.0
-          -Wformat-overflow=2              #             gcc  7.0
-          -Wformat-truncation=1            #             gcc  7.0
+          -Wformat-truncation=2            #             gcc  7.0
+          -Wimplicit-fallthrough           # clang  4.0  gcc  7.0  appleclang  9.0
           -Wrestrict                       #             gcc  7.0
         )
       endif()
-      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 10.0)
-        list(APPEND WPICKY_ENABLE
+      if(CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 10.0)
+        list(APPEND _picky_enable
           -Warith-conversion               #             gcc 10.0
+          -Wenum-conversion                # clang  3.2  gcc 10.0  appleclang  4.2  g++ 11.0
+        )
+      endif()
+      if(CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 13.0)
+        list(APPEND _picky_enable
+          -Warray-compare                  # clang 20.1  gcc 12.0  appleclang 26.4
+          -Wenum-int-mismatch              #             gcc 13.0
+          -Wxor-used-as-pow                # clang 10.0  gcc 13.0  appleclang 12.0
+        )
+      endif()
+      if(CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 15.0)
+        list(APPEND _picky_enable
+          -Wleading-whitespace=spaces      #             gcc 15.0
+          -Wtrailing-whitespace=any        #             gcc 15.0
+          -Wunterminated-string-initialization  #        gcc 15.0
         )
       endif()
     endif()
 
-    #
+    # Assemble list of flags
 
-    unset(WPICKY)
-
-    foreach(_CCOPT ${WPICKY_ENABLE})
-      set(WPICKY "${WPICKY} ${_CCOPT}")
+    set(_picky_skipped "")
+    foreach(_ccopt IN LISTS _picky_enable)
+      string(REGEX MATCH "-W([a-z0-9+-]+)" _ccmatch "${_ccopt}")
+      string(REPLACE "+" "\\+" _cmake_match_1 "${CMAKE_MATCH_1}")  # escape '+' to make it a valid regex
+      if(_ccmatch AND "${CMAKE_C_FLAGS} " MATCHES "-Wno-${_cmake_match_1} " AND
+         NOT _ccopt STREQUAL "-Wall" AND
+         NOT _ccopt MATCHES "^-Wno-")
+        string(APPEND _picky_skipped " ${_ccopt}")
+      else()
+        list(APPEND _picky "${_ccopt}")
+      endif()
     endforeach()
+    if(_picky_skipped)
+      message(STATUS "Picky compiler options skipped due to CMAKE_C_FLAGS override:${_picky_skipped}")
+    endif()
 
-    foreach(_CCOPT ${WPICKY_DETECT})
-      # surprisingly, CHECK_C_COMPILER_FLAG needs a new variable to store each new
-      # test result in.
-      string(MAKE_C_IDENTIFIER "OPT${_CCOPT}" _optvarname)
+    foreach(_ccopt IN LISTS _picky_detect)
+      # Use a unique variable name 1. for meaningful log output 2. to have a fresh, undefined variable for each detection
+      string(MAKE_C_IDENTIFIER "OPT${_ccopt}" _optvarname)
       # GCC only warns about unknown -Wno- options if there are also other diagnostic messages,
       # so test for the positive form instead
-      string(REPLACE "-Wno-" "-W" _CCOPT_ON "${_CCOPT}")
-      check_c_compiler_flag(${_CCOPT_ON} ${_optvarname})
+      string(REPLACE "-Wno-" "-W" _ccopt_on "${_ccopt}")
+      check_c_compiler_flag(${_ccopt_on} ${_optvarname})
       if(${_optvarname})
-        set(WPICKY "${WPICKY} ${_CCOPT}")
+        list(APPEND _picky "${_ccopt}")
       endif()
     endforeach()
 
-    message(STATUS "Picky compiler options:${WPICKY}")
-    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${WPICKY}")
+    if(CMAKE_C_COMPILER_ID STREQUAL "GNU")
+      if(CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 4.0 AND CMAKE_C_COMPILER_VERSION VERSION_LESS 4.7)
+        list(APPEND _picky "-Wno-missing-field-initializers")  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=36750
+      endif()
+      if(CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 4.3 AND CMAKE_C_COMPILER_VERSION VERSION_LESS 4.8)
+        list(APPEND _picky "-Wno-type-limits")  # Avoid false positives
+      endif()
+      if(CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 5.1 AND CMAKE_C_COMPILER_VERSION VERSION_LESS 5.5)
+        list(APPEND _picky "-Wno-conversion")  # Avoid false positives
+      endif()
+    endif()
+  elseif(MSVC AND MSVC_VERSION LESS_EQUAL 1951)  # Enable for tested versions only
+    list(APPEND _picky "-Wall")
+    list(APPEND _picky "-wd4061")  # enumerator 'A' in switch of enum 'B' is not explicitly handled by a case label
+    list(APPEND _picky "-wd4191")  # 'type cast': unsafe conversion from 'FARPROC' to 'void (__cdecl *)(void)'
+    list(APPEND _picky "-wd4255")  # no function prototype given: converting '()' to '(void)' (in winuser.h)
+    list(APPEND _picky "-wd4464")  # relative include path contains '..'
+    list(APPEND _picky "-wd4548")  # expression before comma has no effect; expected expression with side-effect (in FD_SET())
+    list(APPEND _picky "-wd4574")  # 'M' is defined to be '0': did you mean to use '#if M'? (in ws2tcpip.h)
+    list(APPEND _picky "-wd4668")  # 'M' is not defined as a preprocessor macro, replacing with '0' for '#if/#elif' (in winbase.h)
+    list(APPEND _picky "-wd4710")  # 'fprintf'/'printf'/'sscanf': function not inlined (in tests, with VS2022+ Release)
+    list(APPEND _picky "-wd4711")  # function 'A' selected for automatic inline expansion
+    # volatile access of '<expression>' is subject to /volatile:<iso|ms> setting;
+    #   consider using __iso_volatile_load/store intrinsic functions (ARM64)
+    list(APPEND _picky "-wd4746")
+    list(APPEND _picky "-wd4820")  # 'A': 'N' bytes padding added after data member 'B'
+    if(MSVC_VERSION GREATER_EQUAL 1900)
+      list(APPEND _picky "-wd5045")  # Compiler inserts Spectre mitigation for memory load if /Qspectre switch specified
+    endif()
   endif()
 endif()
+
+# clang-cl
+if(CMAKE_C_COMPILER_ID STREQUAL "Clang" AND MSVC)
+  list(APPEND _picky "-Wno-language-extension-token")  # Allow __int64
+
+  foreach(_wlist IN ITEMS _picky_nocheck _picky)
+    set(_picky_tmp "")
+    foreach(_ccopt IN LISTS "${_wlist}")
+      # Prefix -Wall, otherwise clang-cl interprets it as an MSVC option and translates it to -Weverything
+      if(_ccopt MATCHES "^-W" AND NOT _ccopt STREQUAL "-Wall")
+        list(APPEND _picky_tmp ${_ccopt})
+      else()
+        list(APPEND _picky_tmp "-clang:${_ccopt}")
+      endif()
+    endforeach()
+    set("${_wlist}" ${_picky_tmp})  # cmake-lint: disable=C0103
+  endforeach()
+endif()
+
+if(CMAKE_C_STANDARD STREQUAL 90)
+  if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 3.0) OR
+     (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 4.2))
+    list(APPEND _picky "-Wno-c99-extensions")  # Avoid: warning: '_Bool' is a C99 extension
+  endif()
+  if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 3.9) OR
+     (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 8.1))
+    list(APPEND _picky "-Wno-comma")  # Silly
+  endif()
+endif()
+
+if(DOS AND CMAKE_C_COMPILER_ID STREQUAL "GNU" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 10.0)
+  list(APPEND _picky "-Wno-arith-conversion")  # Avoid warnings in DJGPP's built-in FD_SET() macro
+endif()
+
+if(_picky_nocheck OR _picky)
+  set(_picky_tmp "${_picky_nocheck}" "${_picky}")
+  string(REPLACE ";" " " _picky_tmp "${_picky_tmp}")
+  string(STRIP "${_picky_tmp}" _picky_tmp)
+  message(STATUS "Picky compiler options: ${_picky_tmp}")
+  set_property(DIRECTORY APPEND PROPERTY COMPILE_OPTIONS "${_picky_nocheck}" "${_picky}")
+
+  # Apply to all feature checks
+  string(REPLACE ";" " " _picky_tmp "${_picky}")
+  string(APPEND CMAKE_REQUIRED_FLAGS " ${_picky_tmp}")
+
+  unset(_picky)
+  unset(_picky_tmp)
+endif()
diff --git a/third-party/curl/CMake/Platforms/WindowsCache.cmake b/third-party/curl/CMake/Platforms/WindowsCache.cmake
deleted file mode 100644
index 44a1fc9699..0000000000
--- a/third-party/curl/CMake/Platforms/WindowsCache.cmake
+++ /dev/null
@@ -1,127 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-if(NOT UNIX)
-  if(WIN32)
-
-    set(HAVE_WINDOWS_H 1)
-    set(HAVE_WS2TCPIP_H 1)
-    set(HAVE_WINSOCK2_H 1)
-
-    if(MINGW)
-      set(HAVE_SNPRINTF 1)
-      set(HAVE_UNISTD_H 1)
-      set(HAVE_INTTYPES_H 1)
-      set(HAVE_STRTOLL 1)
-    elseif(MSVC)
-      if(NOT MSVC_VERSION LESS 1800)
-        set(HAVE_INTTYPES_H 1)
-        set(HAVE_STRTOLL 1)
-      else()
-        set(HAVE_INTTYPES_H 0)
-        set(HAVE_STRTOLL 0)
-      endif()
-      if(NOT MSVC_VERSION LESS 1900)
-        set(HAVE_SNPRINTF 1)
-      else()
-        set(HAVE_SNPRINTF 0)
-      endif()
-    endif()
-
-    set(HAVE_LIBSOCKET 0)
-    set(HAVE_GETHOSTNAME 1)
-    set(HAVE_LIBZ 0)
-
-    set(HAVE_ARPA_INET_H 0)
-    set(HAVE_ARPA_TFTP_H 0)
-    set(HAVE_FCNTL_H 1)
-    set(HAVE_IFADDRS_H 0)
-    set(HAVE_IO_H 1)
-    set(HAVE_NETDB_H 0)
-    set(HAVE_NETINET_IN_H 0)
-    set(HAVE_NETINET_TCP_H 0)
-    set(HAVE_NET_IF_H 0)
-    set(HAVE_IOCTL_SIOCGIFADDR 0)
-    set(HAVE_POLL_H 0)
-    set(HAVE_PWD_H 0)
-    set(HAVE_SETJMP_H 1)
-    set(HAVE_SIGNAL_H 1)
-    set(HAVE_STDLIB_H 1)
-    set(HAVE_STRINGS_H 0)
-    set(HAVE_STRING_H 1)
-    set(HAVE_SYS_FILIO_H 0)
-    set(HAVE_SYS_IOCTL_H 0)
-    set(HAVE_SYS_PARAM_H 0)
-    set(HAVE_SYS_POLL_H 0)
-    set(HAVE_SYS_RESOURCE_H 0)
-    set(HAVE_SYS_SELECT_H 0)
-    set(HAVE_SYS_SOCKET_H 0)
-    set(HAVE_SYS_SOCKIO_H 0)
-    set(HAVE_SYS_STAT_H 1)
-    set(HAVE_SYS_TIME_H 0)
-    set(HAVE_SYS_TYPES_H 1)
-    set(HAVE_SYS_UN_H 0)
-    set(HAVE_SYS_UTIME_H 1)
-    set(HAVE_TERMIOS_H 0)
-    set(HAVE_TERMIO_H 0)
-    set(HAVE_TIME_H 1)
-    set(HAVE_UTIME_H 0)
-
-    set(HAVE_SOCKET 1)
-    set(HAVE_SELECT 1)
-    set(HAVE_STRDUP 1)
-    set(HAVE_STRICMP 1)
-    set(HAVE_STRCMPI 1)
-    set(HAVE_GETTIMEOFDAY 0)
-    set(HAVE_CLOSESOCKET 1)
-    set(HAVE_SIGSETJMP 0)
-    set(HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID 1)
-    set(HAVE_GETPASS_R 0)
-    set(HAVE_GETPWUID 0)
-    set(HAVE_GETEUID 0)
-    set(HAVE_UTIME 1)
-    set(HAVE_GMTIME_R 0)
-    set(HAVE_GETHOSTBYNAME_R 0)
-    set(HAVE_SIGNAL 1)
-    set(HAVE_LINUX_TCP_H 0)
-    set(HAVE_GLIBC_STRERROR_R 0)
-    set(HAVE_MACH_ABSOLUTE_TIME 0)
-
-    set(HAVE_GETHOSTBYNAME_R_3 0)
-    set(HAVE_GETHOSTBYNAME_R_3_REENTRANT 0)
-    set(HAVE_GETHOSTBYNAME_R_5 0)
-    set(HAVE_GETHOSTBYNAME_R_5_REENTRANT 0)
-    set(HAVE_GETHOSTBYNAME_R_6 0)
-    set(HAVE_GETHOSTBYNAME_R_6_REENTRANT 0)
-
-    set(TIME_WITH_SYS_TIME 0)
-    set(HAVE_O_NONBLOCK 0)
-    set(HAVE_IN_ADDR_T 0)
-    set(STDC_HEADERS 1)
-
-    set(HAVE_SIGACTION 0)
-    set(HAVE_MACRO_SIGSETJMP 0)
-  else()
-    message("This file should be included on Windows platform only")
-  endif()
-endif()
diff --git a/third-party/curl/CMake/Utilities.cmake b/third-party/curl/CMake/Utilities.cmake
index 9ff38e3a0f..f86a6aa1e8 100644
--- a/third-party/curl/CMake/Utilities.cmake
+++ b/third-party/curl/CMake/Utilities.cmake
@@ -23,13 +23,64 @@
 ###########################################################################
 # File containing various utilities
 
-# Returns a list of arguments that evaluate to true
-function(count_true output_count_var)
-  set(lst_len 0)
-  foreach(option_var IN LISTS ARGN)
-    if(${option_var})
-      math(EXPR lst_len "${lst_len} + 1")
+# Return number of arguments that evaluate to true
+function(curl_count_true _output_count_var)
+  set(_list_len 0)
+  foreach(_option_var IN LISTS ARGN)
+    if(${_option_var})
+      math(EXPR _list_len "${_list_len} + 1")
     endif()
   endforeach()
-  set(${output_count_var} ${lst_len} PARENT_SCOPE)
+  set(${_output_count_var} ${_list_len} PARENT_SCOPE)
+endfunction()
+
+# Dump all defined variables with their values
+function(curl_dumpvars)
+  message("::group::CMake Variable Dump")
+  get_cmake_property(_vars VARIABLES)
+  foreach(_var IN ITEMS ${_vars})
+    get_property(_var_type CACHE ${_var} PROPERTY TYPE)
+    get_property(_var_advanced CACHE ${_var} PROPERTY ADVANCED)
+    if(_var_type)
+      set(_var_type ":${_var_type}")
+    endif()
+    if(_var_advanced)
+      set(_var_advanced " [adv]")
+    endif()
+    message("${_var}${_var_type}${_var_advanced} = '${${_var}}'")
+  endforeach()
+  message("::endgroup::")
+endfunction()
+
+# Dump all target properties
+function(curl_dumptargetprops _target)
+  if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.19 AND TARGET "${_target}")
+    execute_process(COMMAND "${CMAKE_COMMAND}" "--help-property-list" OUTPUT_VARIABLE _cmake_property_list)
+    string(REPLACE "\n" ";" _cmake_property_list "${_cmake_property_list}")
+    list(REMOVE_DUPLICATES _cmake_property_list)
+    list(REMOVE_ITEM _cmake_property_list "")
+    list(APPEND _cmake_property_list "INTERFACE_LIBCURL_PC_MODULES")
+    get_target_property(_target_imported ${_target} IMPORTED)
+    if(NOT _target_imported)
+      list(REMOVE_ITEM _cmake_property_list "LOCATION" "LOCATION_<CONFIG>" "MACOSX_PACKAGE_LOCATION" "VS_DEPLOYMENT_LOCATION")
+    endif()
+    foreach(_prop IN LISTS _cmake_property_list)
+      if(_prop MATCHES "<CONFIG>")
+        foreach(_config IN ITEMS "DEBUG" "RELEASE" "MINSIZEREL" "RELWITHDEBINFO")
+          string(REPLACE "<CONFIG>" "${_config}" _propconfig "${_prop}")
+          get_property(_is_set TARGET "${_target}" PROPERTY "${_propconfig}" SET)
+          if(_is_set)
+            get_target_property(_val "${_target}" "${_propconfig}")
+            message("${_target}.${_propconfig} = '${_val}'")
+          endif()
+        endforeach()
+      else()
+        get_property(_is_set TARGET "${_target}" PROPERTY "${_prop}" SET)
+        if(_is_set)
+          get_target_property(_val "${_target}" "${_prop}")
+          message("${_target}.${_prop} = '${_val}'")
+        endif()
+      endif()
+    endforeach()
+  endif()
 endfunction()
diff --git a/third-party/curl/CMake/cmake_uninstall.cmake.in b/third-party/curl/CMake/cmake_uninstall.cmake.in
deleted file mode 100644
index 47aec8d42c..0000000000
--- a/third-party/curl/CMake/cmake_uninstall.cmake.in
+++ /dev/null
@@ -1,49 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-if(NOT EXISTS "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt")
-  message(FATAL_ERROR "Cannot find install manifest: @CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt")
-endif()
-
-if(NOT DEFINED CMAKE_INSTALL_PREFIX)
-  set(CMAKE_INSTALL_PREFIX "@CMAKE_INSTALL_PREFIX@")
-endif()
-message(${CMAKE_INSTALL_PREFIX})
-
-file(READ "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt" files)
-string(REGEX REPLACE "\n" ";" files "${files}")
-foreach(file ${files})
-  message(STATUS "Uninstalling $ENV{DESTDIR}${file}")
-  if(IS_SYMLINK "$ENV{DESTDIR}${file}" OR EXISTS "$ENV{DESTDIR}${file}")
-    exec_program(
-      "@CMAKE_COMMAND@" ARGS "-E remove \"$ENV{DESTDIR}${file}\""
-      OUTPUT_VARIABLE rm_out
-      RETURN_VALUE rm_retval
-      )
-    if(NOT "${rm_retval}" STREQUAL 0)
-      message(FATAL_ERROR "Problem when removing $ENV{DESTDIR}${file}")
-    endif()
-  else()
-    message(STATUS "File $ENV{DESTDIR}${file} does not exist.")
-  endif()
-endforeach()
diff --git a/third-party/curl/CMake/cmake_uninstall.in.cmake b/third-party/curl/CMake/cmake_uninstall.in.cmake
new file mode 100644
index 0000000000..bb95d85a0a
--- /dev/null
+++ b/third-party/curl/CMake/cmake_uninstall.in.cmake
@@ -0,0 +1,50 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+if(NOT EXISTS "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt")
+  message(FATAL_ERROR "Cannot find install manifest: @CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt")
+endif()
+
+if(NOT DEFINED CMAKE_INSTALL_PREFIX)
+  set(CMAKE_INSTALL_PREFIX "@CMAKE_INSTALL_PREFIX@")
+endif()
+message(${CMAKE_INSTALL_PREFIX})
+
+file(READ "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt" _files)
+string(REGEX REPLACE "\n" ";" _files "${_files}")
+foreach(_file ${_files})
+  message(STATUS "Uninstalling $ENV{DESTDIR}${_file}")
+  if(IS_SYMLINK "$ENV{DESTDIR}${_file}" OR EXISTS "$ENV{DESTDIR}${_file}")
+    execute_process(
+      COMMAND "@CMAKE_COMMAND@" -E remove "$ENV{DESTDIR}${_file}"
+      RESULT_VARIABLE rm_retval
+      OUTPUT_QUIET
+      ERROR_QUIET
+    )
+    if(NOT "${rm_retval}" STREQUAL 0)
+      message(FATAL_ERROR "Problem when removing $ENV{DESTDIR}${_file}")
+    endif()
+  else()
+    message(STATUS "File $ENV{DESTDIR}${_file} does not exist.")
+  endif()
+endforeach()
diff --git a/third-party/curl/CMake/curl-config.cmake.in b/third-party/curl/CMake/curl-config.cmake.in
deleted file mode 100644
index 056907c4f9..0000000000
--- a/third-party/curl/CMake/curl-config.cmake.in
+++ /dev/null
@@ -1,38 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-@PACKAGE_INIT@
-
-include(CMakeFindDependencyMacro)
-if(@USE_OPENSSL@)
-  find_dependency(OpenSSL @OPENSSL_VERSION_MAJOR@)
-endif()
-if(@USE_ZLIB@)
-  find_dependency(ZLIB @ZLIB_VERSION_MAJOR@)
-endif()
-
-include("${CMAKE_CURRENT_LIST_DIR}/@TARGETS_EXPORT_NAME@.cmake")
-check_required_components("@PROJECT_NAME@")
-
-# Alias for either shared or static library
-add_library(@PROJECT_NAME@::libcurl ALIAS @PROJECT_NAME@::@LIB_SELECTED@)
diff --git a/third-party/curl/CMake/curl-config.in.cmake b/third-party/curl/CMake/curl-config.in.cmake
new file mode 100644
index 0000000000..b4300ca210
--- /dev/null
+++ b/third-party/curl/CMake/curl-config.in.cmake
@@ -0,0 +1,196 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+@PACKAGE_INIT@
+
+option(CURL_USE_CMAKECONFIG "Enable detecting @PROJECT_NAME@ dependencies via CMake Config. Default: @CURL_USE_CMAKECONFIG@"
+  "@CURL_USE_CMAKECONFIG@")
+option(CURL_USE_PKGCONFIG "Enable pkg-config to detect @PROJECT_NAME@ dependencies. Default: @CURL_USE_PKGCONFIG@"
+  "@CURL_USE_PKGCONFIG@")
+
+if(CMAKE_VERSION VERSION_LESS @CMAKE_MINIMUM_REQUIRED_VERSION@)
+  message(STATUS "@PROJECT_NAME@: @PROJECT_NAME@-specific Find modules require "
+    "CMake @CMAKE_MINIMUM_REQUIRED_VERSION@ or upper, found: ${CMAKE_VERSION}.")
+endif()
+
+include(CMakeFindDependencyMacro)
+
+if("@HAVE_THREADS_POSIX@" OR "@HAVE_THREADS_POSIX_BORINGSSL@")
+  find_dependency(Threads)  # for Threads::Threads
+endif()
+
+if("@USE_OPENSSL@")
+  if("@OPENSSL_VERSION_MAJOR@")
+    find_dependency(OpenSSL "@OPENSSL_VERSION_MAJOR@")
+  else()
+    find_dependency(OpenSSL)
+  endif()
+  # Define lib duplicate to fixup lib order for GCC binutils ld in static builds
+  if(TARGET OpenSSL::Crypto AND NOT TARGET CURL::OpenSSL_Crypto)
+    add_library(CURL::OpenSSL_Crypto INTERFACE IMPORTED)
+    set_target_properties(CURL::OpenSSL_Crypto PROPERTIES INTERFACE_LINK_LIBRARIES OpenSSL::Crypto)
+  endif()
+endif()
+if("@HAVE_LIBZ@")
+  find_dependency(ZLIB "@ZLIB_VERSION_MAJOR@")
+  # Define lib duplicate to fixup lib order for GCC binutils ld in static builds
+  if(TARGET ZLIB::ZLIB AND NOT TARGET CURL::ZLIB)
+    add_library(CURL::ZLIB INTERFACE IMPORTED)
+    set_target_properties(CURL::ZLIB PROPERTIES INTERFACE_LINK_LIBRARIES ZLIB::ZLIB)
+  endif()
+endif()
+
+set(_curl_cmake_module_path_save ${CMAKE_MODULE_PATH})
+list(PREPEND CMAKE_MODULE_PATH ${CMAKE_CURRENT_LIST_DIR})
+
+set(_curl_libs "")
+
+if("@HAVE_BROTLI@")
+  find_dependency(Brotli MODULE)
+  list(APPEND _curl_libs CURL::brotli)
+endif()
+if("@USE_ARES@")
+  find_dependency(Cares MODULE)
+  list(APPEND _curl_libs CURL::cares)
+endif()
+if("@HAVE_GSSAPI@")
+  find_dependency(GSS MODULE)
+  list(APPEND _curl_libs CURL::gss)
+endif()
+if("@USE_BACKTRACE@")
+  find_dependency(Libbacktrace MODULE)
+  list(APPEND _curl_libs CURL::libbacktrace)
+endif()
+if("@USE_GSASL@")
+  find_dependency(Libgsasl MODULE)
+  list(APPEND _curl_libs CURL::libgsasl)
+endif()
+if(NOT "@USE_WIN32_LDAP@" AND NOT "@CURL_DISABLE_LDAP@")
+  find_dependency(LDAP MODULE)
+  list(APPEND _curl_libs CURL::ldap)
+endif()
+if("@HAVE_LIBIDN2@")
+  find_dependency(Libidn2 MODULE)
+  list(APPEND _curl_libs CURL::libidn2)
+endif()
+if("@USE_LIBPSL@")
+  find_dependency(Libpsl MODULE)
+  list(APPEND _curl_libs CURL::libpsl)
+endif()
+if("@USE_LIBSSH@")
+  find_dependency(Libssh MODULE)
+  list(APPEND _curl_libs CURL::libssh)
+endif()
+if("@USE_LIBSSH2@")
+  find_dependency(Libssh2 MODULE)
+  list(APPEND _curl_libs CURL::libssh2)
+endif()
+if("@USE_LIBUV@")
+  find_dependency(Libuv MODULE)
+  list(APPEND _curl_libs CURL::libuv)
+endif()
+if("@USE_MBEDTLS@")
+  find_dependency(MbedTLS MODULE)
+  list(APPEND _curl_libs CURL::mbedtls)
+endif()
+if("@USE_NGHTTP2@")
+  find_dependency(NGHTTP2 MODULE)
+  list(APPEND _curl_libs CURL::nghttp2)
+endif()
+if("@USE_NGHTTP3@")
+  find_dependency(NGHTTP3 MODULE)
+  list(APPEND _curl_libs CURL::nghttp3)
+endif()
+if("@USE_NGTCP2@")
+  find_dependency(NGTCP2 MODULE COMPONENTS "@NGTCP2_CRYPTO_BACKEND@")
+  list(APPEND _curl_libs CURL::ngtcp2)
+endif()
+if("@USE_GNUTLS@")
+  find_dependency(GnuTLS MODULE)
+  list(APPEND _curl_libs CURL::gnutls)
+  find_dependency(Nettle MODULE)
+  list(APPEND _curl_libs CURL::nettle)
+endif()
+if("@USE_QUICHE@")
+  find_dependency(Quiche MODULE)
+  list(APPEND _curl_libs CURL::quiche)
+endif()
+if("@USE_RUSTLS@")
+  find_dependency(Rustls MODULE)
+  list(APPEND _curl_libs CURL::rustls)
+endif()
+if("@USE_WOLFSSL@")
+  find_dependency(WolfSSL MODULE)
+  list(APPEND _curl_libs CURL::wolfssl)
+endif()
+if("@HAVE_ZSTD@")
+  find_dependency(Zstd MODULE)
+  list(APPEND _curl_libs CURL::zstd)
+endif()
+
+set(CMAKE_MODULE_PATH ${_curl_cmake_module_path_save})
+
+# Define lib duplicate to fixup lib order for GCC binutils ld in static builds
+if(WIN32 AND NOT TARGET CURL::win32_winsock)
+  add_library(CURL::win32_winsock INTERFACE IMPORTED)
+  set_target_properties(CURL::win32_winsock PROPERTIES INTERFACE_LINK_LIBRARIES "ws2_32")
+endif()
+
+include("${CMAKE_CURRENT_LIST_DIR}/@TARGETS_EXPORT_NAME@.cmake")
+
+# Alias for either shared or static library
+if(NOT TARGET @PROJECT_NAME@::@LIB_NAME@)
+  add_library(@PROJECT_NAME@::@LIB_NAME@ ALIAS @PROJECT_NAME@::@LIB_SELECTED@)
+endif()
+
+# For compatibility with CMake's FindCURL.cmake
+set(CURL_VERSION_STRING "@CURLVERSION@")
+set(CURL_LIBRARIES @PROJECT_NAME@::@LIB_NAME@)
+set(CURL_LIBRARIES_PRIVATE "@LIBCURL_PC_LIBS_PRIVATE_LIST@")
+set_and_check(CURL_INCLUDE_DIRS "@PACKAGE_CMAKE_INSTALL_INCLUDEDIR@")
+
+set(CURL_SUPPORTED_PROTOCOLS "@CURL_SUPPORTED_PROTOCOLS_LIST@")
+set(CURL_SUPPORTED_FEATURES "@CURL_SUPPORTED_FEATURES_LIST@")
+
+foreach(_curl_item IN LISTS CURL_SUPPORTED_PROTOCOLS CURL_SUPPORTED_FEATURES)
+  set(CURL_SUPPORTS_${_curl_item} TRUE)
+endforeach()
+
+set(_curl_missing_req "")
+foreach(_curl_item IN LISTS CURL_FIND_COMPONENTS)
+  if(CURL_SUPPORTS_${_curl_item})
+    set(CURL_${_curl_item}_FOUND TRUE)
+  elseif(CURL_FIND_REQUIRED_${_curl_item})
+    list(APPEND _curl_missing_req ${_curl_item})
+  endif()
+endforeach()
+
+if(_curl_missing_req)
+  string(REPLACE ";" " " _curl_missing_req "${_curl_missing_req}")
+  if(CURL_FIND_REQUIRED)
+    message(FATAL_ERROR "@PROJECT_NAME@: missing required components: ${_curl_missing_req}")
+  endif()
+  unset(_curl_missing_req)
+endif()
+
+check_required_components("@PROJECT_NAME@")
diff --git a/third-party/curl/CMake/unix-cache.cmake b/third-party/curl/CMake/unix-cache.cmake
new file mode 100644
index 0000000000..78816499ca
--- /dev/null
+++ b/third-party/curl/CMake/unix-cache.cmake
@@ -0,0 +1,332 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Based on CI runs for Cygwin/MSYS2, Linux, macOS/iOS, DragonFly BSD, FreeBSD, MidnightBSD, NetBSD, OpenBSD
+if(NOT UNIX)
+  message(FATAL_ERROR "This file should be included on Unix platforms only")
+endif()
+
+if(APPLE OR
+   CYGWIN)
+  set(HAVE_ACCEPT4 0)
+elseif(CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
+       CMAKE_SYSTEM_NAME STREQUAL "DragonFlyBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "FreeBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "MidnightBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "NetBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "OpenBSD")
+  set(HAVE_ACCEPT4 1)
+endif()
+set(HAVE_ALARM 1)
+if(ANDROID)
+  set(HAVE_ARC4RANDOM 1)
+else()
+  set(HAVE_ARC4RANDOM 0)
+endif()
+set(HAVE_ARPA_INET_H 1)
+set(HAVE_ATOMIC 1)
+set(HAVE_BASENAME 1)
+set(HAVE_BOOL_T 1)
+if(NOT APPLE)
+  set(HAVE_CLOCK_GETTIME_MONOTONIC 1)
+  if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
+    set(HAVE_CLOCK_GETTIME_MONOTONIC_RAW 1)
+  else()
+    set(HAVE_CLOCK_GETTIME_MONOTONIC_RAW 0)
+  endif()
+endif()
+set(HAVE_CLOSESOCKET 0)
+set(HAVE_DECL_FSEEKO 1)
+set(HAVE_DIRENT_H 1)
+if(APPLE OR
+   CYGWIN OR
+   CMAKE_SYSTEM_NAME STREQUAL "DragonFlyBSD" OR
+   CMAKE_SYSTEM_NAME STREQUAL "OpenBSD")
+  set(HAVE_EVENTFD 0)
+elseif(CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
+       CMAKE_SYSTEM_NAME STREQUAL "FreeBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "MidnightBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "NetBSD")
+  set(HAVE_EVENTFD 1)
+endif()
+if(ANDROID AND ANDROID_PLATFORM_LEVEL GREATER_EQUAL 34)
+  set(HAVE_MEMSET_EXPLICIT 1)
+endif()
+if((APPLE AND CMAKE_OSX_DEPLOYMENT_TARGET VERSION_GREATER_EQUAL 10.9) OR
+   CMAKE_SYSTEM_NAME STREQUAL "DragonFlyBSD" OR  # v6+
+   CMAKE_SYSTEM_NAME STREQUAL "FreeBSD" OR  # v11.2+
+   CMAKE_SYSTEM_NAME STREQUAL "MidnightBSD")  # v1.3+
+  set(HAVE_MEMSET_S 1)
+elseif(NOT APPLE)
+  set(HAVE_MEMSET_S 0)
+endif()
+set(HAVE_FCNTL 1)
+set(HAVE_FCNTL_H 1)
+set(HAVE_FCNTL_O_NONBLOCK 1)
+set(HAVE_FILE_OFFSET_BITS 1)
+set(HAVE_FNMATCH 1)
+set(HAVE_FREEADDRINFO 1)
+set(HAVE_FSEEKO 1)
+if(APPLE)
+  set(HAVE_FSETXATTR 1)
+  set(HAVE_FSETXATTR_5 0)
+  set(HAVE_FSETXATTR_6 1)
+elseif(CMAKE_SYSTEM_NAME STREQUAL "DragonFlyBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "FreeBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "MidnightBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "OpenBSD")
+  set(HAVE_FSETXATTR 0)
+  set(HAVE_FSETXATTR_5 0)
+  set(HAVE_FSETXATTR_6 0)
+elseif(CYGWIN OR
+       CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
+       CMAKE_SYSTEM_NAME STREQUAL "NetBSD")
+  set(HAVE_FSETXATTR 1)
+  set(HAVE_FSETXATTR_5 1)
+  set(HAVE_FSETXATTR_6 0)
+endif()
+set(HAVE_GETADDRINFO 1)
+if(CMAKE_SYSTEM_NAME STREQUAL "OpenBSD")
+  set(HAVE_GETADDRINFO_THREADSAFE 0)
+elseif(CYGWIN OR
+       CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
+       CMAKE_SYSTEM_NAME STREQUAL "DragonFlyBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "FreeBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "MidnightBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "NetBSD")
+  set(HAVE_GETADDRINFO_THREADSAFE 1)
+endif()
+set(HAVE_GETEUID 1)
+if(APPLE OR
+   CYGWIN OR
+   CMAKE_SYSTEM_NAME STREQUAL "NetBSD" OR
+   CMAKE_SYSTEM_NAME STREQUAL "OpenBSD")
+  set(HAVE_GETHOSTBYNAME_R 0)
+elseif(CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
+       CMAKE_SYSTEM_NAME STREQUAL "DragonFlyBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "FreeBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "MidnightBSD")
+  set(HAVE_GETHOSTBYNAME_R 1)
+endif()
+set(HAVE_GETHOSTBYNAME_R_3 0)
+set(HAVE_GETHOSTBYNAME_R_3_REENTRANT 0)
+set(HAVE_GETHOSTBYNAME_R_5 0)
+set(HAVE_GETHOSTBYNAME_R_5_REENTRANT 0)
+if(CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
+   CMAKE_SYSTEM_NAME STREQUAL "DragonFlyBSD" OR
+   CMAKE_SYSTEM_NAME STREQUAL "MidnightBSD")
+  set(HAVE_GETHOSTBYNAME_R_6 1)
+  set(HAVE_GETHOSTBYNAME_R_6_REENTRANT 1)
+else()
+  set(HAVE_GETHOSTBYNAME_R_6 0)
+  set(HAVE_GETHOSTBYNAME_R_6_REENTRANT 0)
+endif()
+set(HAVE_GETHOSTNAME 1)
+if(NOT ANDROID OR ANDROID_PLATFORM_LEVEL GREATER_EQUAL 24)
+  set(HAVE_GETIFADDRS 1)
+else()
+  set(HAVE_GETIFADDRS 0)
+endif()
+if(APPLE OR
+   CYGWIN OR
+   CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
+   CMAKE_SYSTEM_NAME STREQUAL "DragonFlyBSD" OR
+   CMAKE_SYSTEM_NAME STREQUAL "FreeBSD" OR
+   CMAKE_SYSTEM_NAME STREQUAL "MidnightBSD" OR
+   CMAKE_SYSTEM_NAME STREQUAL "OpenBSD")
+  set(HAVE_GETPASS_R 0)
+elseif(CMAKE_SYSTEM_NAME STREQUAL "NetBSD")
+  set(HAVE_GETPASS_R 1)
+endif()
+set(HAVE_GETPEERNAME 1)
+set(HAVE_GETPPID 1)
+set(HAVE_GETPWUID 1)
+set(HAVE_GETPWUID_R 1)
+set(HAVE_GETRLIMIT 1)
+set(HAVE_GETSOCKNAME 1)
+set(HAVE_GETTIMEOFDAY 1)
+if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
+  # Depends on C library.
+else()
+  set(HAVE_GLIBC_STRERROR_R 0)
+endif()
+set(HAVE_GMTIME_R 1)
+set(HAVE_IFADDRS_H 1)
+set(HAVE_IF_NAMETOINDEX 1)
+set(HAVE_INET_NTOP 1)
+set(HAVE_INET_PTON 1)
+set(HAVE_IOCTLSOCKET 0)
+set(HAVE_IOCTLSOCKET_CAMEL 0)
+set(HAVE_IOCTLSOCKET_CAMEL_FIONBIO 0)
+set(HAVE_IOCTLSOCKET_FIONBIO 0)
+set(HAVE_IOCTL_FIONBIO 1)
+set(HAVE_IOCTL_SIOCGIFADDR 1)
+if(CYGWIN)
+  set(HAVE_IO_H 1)
+else()
+  set(HAVE_IO_H 0)
+endif()
+set(HAVE_LIBGEN_H 1)
+if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
+  # Requires Linux kernel userspace headers. Expected with glibc. May be missing by default with MUSL.
+else()
+  set(HAVE_LINUX_TCP_H 0)
+endif()
+set(HAVE_LOCALE_H 1)
+set(HAVE_LOCALTIME_R 1)
+if(APPLE)
+  set(HAVE_MACH_ABSOLUTE_TIME 1)
+endif()
+if(APPLE OR
+   CYGWIN)
+  set(HAVE_MEMRCHR 0)
+else()
+  set(HAVE_MEMRCHR 1)
+endif()
+set(HAVE_NETDB_H 1)
+if(ANDROID)
+  set(HAVE_NETINET_IN6_H 1)
+else()
+  set(HAVE_NETINET_IN6_H 0)
+endif()
+set(HAVE_NETINET_IN_H 1)
+set(HAVE_NETINET_TCP_H 1)
+set(HAVE_NETINET_UDP_H 1)
+set(HAVE_NET_IF_H 1)
+set(HAVE_OPENDIR 1)
+set(HAVE_PIPE 1)
+if(APPLE OR
+   CYGWIN)
+  set(HAVE_PIPE2 0)
+elseif(CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
+       BSD OR
+       CMAKE_SYSTEM_NAME STREQUAL "DragonFlyBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "FreeBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "MidnightBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "NetBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "OpenBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "SunOS")
+  set(HAVE_PIPE2 1)
+endif()
+set(HAVE_POLL 1)
+set(HAVE_POLL_H 1)
+if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
+  # Depends on C library.
+else()
+  set(HAVE_POSIX_STRERROR_R 1)
+endif()
+set(HAVE_PWD_H 1)
+set(HAVE_REALPATH 1)
+set(HAVE_RECV 1)
+set(HAVE_SA_FAMILY_T 1)
+set(HAVE_SCHED_YIELD 1)
+set(HAVE_SELECT 1)
+set(HAVE_SEND 1)
+if(APPLE OR
+   CYGWIN OR
+   CMAKE_SYSTEM_NAME STREQUAL "DragonFlyBSD")
+  set(HAVE_SENDMMSG 0)
+else()
+  set(HAVE_SENDMMSG 1)
+endif()
+set(HAVE_SENDMSG 1)
+set(HAVE_SETLOCALE 1)
+set(HAVE_SETRLIMIT 1)
+set(HAVE_SETSOCKOPT_SO_NONBLOCK 0)
+set(HAVE_SIGACTION 1)
+set(HAVE_SIGINTERRUPT 1)
+set(HAVE_SIGNAL 1)
+set(HAVE_SIGSETJMP 1)
+set(HAVE_SOCKADDR_IN6_SIN6_ADDR 1)
+set(HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID 1)
+set(HAVE_SOCKET 1)
+set(HAVE_SOCKETPAIR 1)
+set(HAVE_STDATOMIC_H 1)
+set(HAVE_STDBOOL_H 1)
+set(HAVE_STDDEF_H 1)  # detected by CMake internally in check_type_size()
+set(HAVE_STDINT_H 1)  # detected by CMake internally in check_type_size()
+set(HAVE_STRCASECMP 1)
+set(HAVE_STRCMPI 0)
+set(HAVE_STRERROR_R 1)
+set(HAVE_STRICMP 0)
+set(HAVE_STRINGS_H 1)
+if(_CURL_OLD_LINUX)
+  set(HAVE_STROPTS_H 1)
+else()
+  set(HAVE_STROPTS_H 0)  # glibc 2.30 or newer. https://sourceware.org/legacy-ml/libc-alpha/2019-08/msg00029.html
+endif()
+set(HAVE_STRUCT_SOCKADDR_STORAGE 1)
+set(HAVE_STRUCT_TIMEVAL 1)
+if(ANDROID OR CMAKE_SYSTEM_NAME STREQUAL "iOS")
+  set(HAVE_SUSECONDS_T 1)
+endif()
+if(APPLE OR
+   CYGWIN OR
+   CMAKE_SYSTEM_NAME STREQUAL "DragonFlyBSD" OR
+   CMAKE_SYSTEM_NAME STREQUAL "OpenBSD")
+  set(HAVE_SYS_EVENTFD_H 0)
+elseif(CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
+       CMAKE_SYSTEM_NAME STREQUAL "FreeBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "MidnightBSD" OR
+       CMAKE_SYSTEM_NAME STREQUAL "NetBSD")
+  set(HAVE_SYS_EVENTFD_H 1)
+endif()
+if(CYGWIN OR
+   CMAKE_SYSTEM_NAME STREQUAL "Linux")
+  set(HAVE_SYS_FILIO_H 0)
+else()
+  set(HAVE_SYS_FILIO_H 1)
+endif()
+set(HAVE_SYS_IOCTL_H 1)
+set(HAVE_SYS_PARAM_H 1)
+set(HAVE_SYS_POLL_H 1)
+set(HAVE_SYS_RESOURCE_H 1)
+set(HAVE_SYS_SELECT_H 1)
+if(CYGWIN OR
+   CMAKE_SYSTEM_NAME STREQUAL "Linux")
+  set(HAVE_SYS_SOCKIO_H 0)
+else()
+  set(HAVE_SYS_SOCKIO_H 1)
+endif()
+set(HAVE_SYS_TYPES_H 1)
+set(HAVE_SYS_UN_H 1)
+if(CYGWIN)
+  set(HAVE_SYS_UTIME_H 1)
+else()
+  set(HAVE_SYS_UTIME_H 0)
+endif()
+set(HAVE_TERMIOS_H 1)
+if(CYGWIN OR
+   CMAKE_SYSTEM_NAME STREQUAL "Linux")
+  set(HAVE_TERMIO_H 1)
+else()
+  set(HAVE_TERMIO_H 0)
+endif()
+set(HAVE_TIME_T_UNSIGNED 0)
+set(HAVE_UNISTD_H 1)
+set(HAVE_UTIME 1)
+set(HAVE_UTIMES 1)
+set(HAVE_UTIME_H 1)
+set(HAVE_WRITABLE_ARGV 1)
+set(STDC_HEADERS 1)
+set(USE_UNIX_SOCKETS 1)
diff --git a/third-party/curl/CMake/win32-cache.cmake b/third-party/curl/CMake/win32-cache.cmake
new file mode 100644
index 0000000000..bd9bb6e3fc
--- /dev/null
+++ b/third-party/curl/CMake/win32-cache.cmake
@@ -0,0 +1,192 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+if(NOT WIN32)
+  message(FATAL_ERROR "This file should be included on Windows platform only")
+endif()
+
+if(MINGW)
+  set(HAVE_BASENAME 1)
+  set(HAVE_BOOL_T 1)  # = HAVE_STDBOOL_H
+  set(HAVE_DIRENT_H 1)
+  set(HAVE_GETTIMEOFDAY 1)
+  set(HAVE_LIBGEN_H 1)
+  set(HAVE_OPENDIR 1)
+  set(HAVE_STDBOOL_H 1)
+  set(HAVE_STDDEF_H 1)  # detected by CMake internally in check_type_size()
+  set(HAVE_STDINT_H 1)  # detected by CMake internally in check_type_size()
+  set(HAVE_STRINGS_H 1)  # wrapper to string.h
+  set(HAVE_SYS_PARAM_H 1)
+  set(HAVE_UNISTD_H 1)
+  set(HAVE_UTIME_H 1)  # wrapper to sys/utime.h
+else()
+  set(HAVE_DIRENT_H 0)
+  set(HAVE_GETTIMEOFDAY 0)
+  set(HAVE_LIBGEN_H 0)
+  set(HAVE_OPENDIR 0)
+  set(HAVE_STRINGS_H 0)
+  set(HAVE_SYS_PARAM_H 0)
+  set(HAVE_UTIME_H 0)
+  if(MSVC)
+    set(HAVE_UNISTD_H 0)
+    set(HAVE_STDDEF_H 1)  # detected by CMake internally in check_type_size()
+    set(HAVE_STDINT_H 1)  # detected by CMake internally in check_type_size()
+    if(MSVC_VERSION GREATER_EQUAL 1800)
+      set(HAVE_STDBOOL_H 1)
+    else()
+      set(HAVE_STDBOOL_H 0)
+    endif()
+    set(HAVE_BOOL_T "${HAVE_STDBOOL_H}")
+    set(HAVE_BASENAME 0)
+  endif()
+endif()
+
+if((CMAKE_C_COMPILER_ID STREQUAL "GNU"   AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 4.9) OR
+   (CMAKE_C_COMPILER_ID STREQUAL "Clang" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 3.6))
+  # MinGW or clang-cl
+  set(HAVE_STDATOMIC_H 1)
+  set(HAVE_ATOMIC 1)
+else()
+  set(HAVE_STDATOMIC_H 0)
+  set(HAVE_ATOMIC 0)
+endif()
+
+set(HAVE_ACCEPT4 0)
+set(HAVE_ALARM 0)
+set(HAVE_ARC4RANDOM 0)
+set(HAVE_ARPA_INET_H 0)
+set(HAVE_CLOSESOCKET 1)
+set(HAVE_EVENTFD 0)
+set(HAVE_FCNTL 0)
+set(HAVE_FCNTL_H 1)
+set(HAVE_FCNTL_O_NONBLOCK 0)
+set(HAVE_FNMATCH 0)
+set(HAVE_FREEADDRINFO 1)  # Available in Windows XP and newer
+set(HAVE_FSETXATTR 0)
+set(HAVE_GETADDRINFO 1)  # Available in Windows XP and newer
+set(HAVE_GETEUID 0)
+set(HAVE_GETHOSTBYNAME_R 0)
+set(HAVE_GETHOSTBYNAME_R_3 0)
+set(HAVE_GETHOSTBYNAME_R_3_REENTRANT 0)
+set(HAVE_GETHOSTBYNAME_R_5 0)
+set(HAVE_GETHOSTBYNAME_R_5_REENTRANT 0)
+set(HAVE_GETHOSTBYNAME_R_6 0)
+set(HAVE_GETHOSTBYNAME_R_6_REENTRANT 0)
+set(HAVE_GETHOSTNAME 1)
+set(HAVE_GETIFADDRS 0)
+set(HAVE_GETPASS_R 0)
+set(HAVE_GETPEERNAME 1)
+set(HAVE_GETPPID 0)
+set(HAVE_GETPWUID 0)
+set(HAVE_GETPWUID_R 0)
+set(HAVE_GETRLIMIT 0)
+set(HAVE_GETSOCKNAME 1)
+set(HAVE_GLIBC_STRERROR_R 0)
+set(HAVE_GMTIME_R 0)
+set(HAVE_IFADDRS_H 0)
+set(HAVE_INET_NTOP 0)
+set(HAVE_INET_PTON 0)
+set(HAVE_IOCTLSOCKET 1)
+set(HAVE_IOCTLSOCKET_CAMEL 0)
+set(HAVE_IOCTLSOCKET_CAMEL_FIONBIO 0)
+set(HAVE_IOCTLSOCKET_FIONBIO 1)
+set(HAVE_IOCTL_FIONBIO 0)
+set(HAVE_IOCTL_SIOCGIFADDR 0)
+set(HAVE_IO_H 1)
+set(HAVE_LINUX_TCP_H 0)
+set(HAVE_LOCALE_H 1)
+set(HAVE_LOCALTIME_R 0)
+set(HAVE_MEMRCHR 0)
+set(HAVE_NETDB_H 0)
+set(HAVE_NETINET_IN6_H 0)
+set(HAVE_NETINET_IN_H 0)
+set(HAVE_NETINET_TCP_H 0)
+set(HAVE_NETINET_UDP_H 0)
+set(HAVE_NET_IF_H 0)
+set(HAVE_PIPE 0)
+set(HAVE_PIPE2 0)
+set(HAVE_POLL 0)
+set(HAVE_POLL_H 0)
+set(HAVE_POSIX_STRERROR_R 0)
+set(HAVE_PWD_H 0)
+set(HAVE_RECV 1)
+set(HAVE_SELECT 1)
+set(HAVE_SEND 1)
+set(HAVE_SENDMMSG 0)
+set(HAVE_SENDMSG 0)
+set(HAVE_SETLOCALE 1)
+set(HAVE_SETRLIMIT 0)
+set(HAVE_SETSOCKOPT_SO_NONBLOCK 0)
+set(HAVE_SIGACTION 0)
+set(HAVE_SIGINTERRUPT 0)
+set(HAVE_SIGNAL 1)
+set(HAVE_SIGSETJMP 0)
+set(HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID 1)
+set(HAVE_SOCKET 1)
+set(HAVE_SOCKETPAIR 0)
+set(HAVE_STRERROR_R 0)
+set(HAVE_STROPTS_H 0)
+set(HAVE_STRUCT_SOCKADDR_STORAGE 1)
+set(HAVE_STRUCT_TIMEVAL 1)
+set(HAVE_SYS_EVENTFD_H 0)
+set(HAVE_SYS_FILIO_H 0)
+set(HAVE_SYS_IOCTL_H 0)
+set(HAVE_SYS_POLL_H 0)
+set(HAVE_SYS_RESOURCE_H 0)
+set(HAVE_SYS_SELECT_H 0)
+set(HAVE_SYS_SOCKIO_H 0)
+set(HAVE_SYS_TYPES_H 1)
+set(HAVE_SYS_UN_H 0)
+set(HAVE_SYS_UTIME_H 1)
+set(HAVE_TERMIOS_H 0)
+set(HAVE_TERMIO_H 0)
+set(HAVE_TIME_T_UNSIGNED 0)
+set(HAVE_UTIME 1)
+set(HAVE_UTIMES 0)
+set(STDC_HEADERS 1)
+
+# Types and sizes
+
+set(HAVE_SIZEOF_SA_FAMILY_T 0)
+set(HAVE_SIZEOF_SUSECONDS_T 0)
+
+if(MINGW OR MSVC)
+  curl_prefill_type_size("INT" 4)
+  curl_prefill_type_size("LONG" 4)
+  curl_prefill_type_size("__INT64" 8)
+  curl_prefill_type_size("CURL_OFF_T" 8)
+  curl_prefill_type_size("CURL_SOCKET_T" ${CMAKE_SIZEOF_VOID_P})
+  curl_prefill_type_size("SIZE_T" ${CMAKE_SIZEOF_VOID_P})
+  # TIME_T: 8 for _WIN64 or UCRT or MSVC, 4 otherwise
+  #   Also 4 for non-UCRT 32-bit when _USE_32BIT_TIME_T is set.
+  #   mingw-w64 sets _USE_32BIT_TIME_T unless __MINGW_USE_VC2005_COMPAT is explicit defined.
+  if(MSVC)
+    set(HAVE_SIZEOF_SSIZE_T 0)
+    set(HAVE_FILE_OFFSET_BITS 0)
+    curl_prefill_type_size("OFF_T" 4)
+  else()
+    curl_prefill_type_size("SSIZE_T" ${CMAKE_SIZEOF_VOID_P})
+    set(HAVE_FILE_OFFSET_BITS 1)  # mingw-w64 v3+
+    curl_prefill_type_size("OFF_T" 8)  # mingw-w64 v3+
+  endif()
+endif()
diff --git a/third-party/curl/CMakeLists.txt b/third-party/curl/CMakeLists.txt
index bc42c6a628..e459b3d076 100644
--- a/third-party/curl/CMakeLists.txt
+++ b/third-party/curl/CMakeLists.txt
@@ -21,125 +21,324 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# curl/libcurl CMake script
-# by Tetetest and Sukender (Benoit Neil)
 
-# TODO:
-# The output .so file lacks the soname number which we currently have within the lib/Makefile.am file
-# Add full (4 or 5 libs) SSL support
-# Add INSTALL target (EXTRA_DIST variables in Makefile.am may be moved to Makefile.inc so that CMake/CPack is aware of what's to include).
-# Check on all possible platforms
-# Test with as many configurations possible (With or without any option)
-# Create scripts that help keeping the CMake build system up to date (to reduce maintenance). According to Tetetest:
-#  - lists of headers that 'configure' checks for;
-#  - curl-specific tests (the ones that are in m4/curl-*.m4 files);
-#  - (most obvious thing:) curl version numbers.
-# Add documentation subproject
-#
-# To check:
-# (From Daniel Stenberg) The cmake build selected to run gcc with -fPIC on my box while the plain configure script did not.
-# (From Daniel Stenberg) The gcc command line use neither -g nor any -O options. As a developer, I also treasure our configure scripts's --enable-debug option that sets a long range of "picky" compiler options.
+cmake_minimum_required(VERSION 3.18 FATAL_ERROR)
+message(STATUS "Using CMake version ${CMAKE_VERSION}")
 
-# Note: By default this CMake build script detects the version of some
-# dependencies using `check_symbol_exists`.  Those checks do not work
-# in the case that both CURL and its dependency are included as
-# sub-projects in a larger build using `FetchContent`.  To support
-# that case, additional variables may be defined by the parent
-# project, ideally in the "extra" find package redirect file:
-# https://cmake.org/cmake/help/latest/module/FetchContent.html#integrating-with-find-package
-#
-# The following variables are available:
-#   HAVE_SSL_SET0_WBIO: `SSL_set0_wbio` present in OpenSSL
-#   HAVE_AWSLC: OpenSSL is AWS-LC
-#   HAVE_BORINGSSL: OpenSSL is BoringSSL
-#   HAVE_SSL_CTX_SET_QUIC_METHOD: `SSL_CTX_set_quic_method` present in OpenSSL/wolfSSL
-#   HAVE_QUICHE_CONN_SET_QLOG_FD: `quiche_conn_set_qlog_fd` present in QUICHE
-#   HAVE_ZSTD_CREATEDSTREAM: `ZSTD_createDStream` present in Zstd
-#
-# For each of the above variables, if the variable is DEFINED (either
-# to ON or OFF), the symbol detection will be skipped.  If the
-# variable is NOT DEFINED, the symbol detection will be performed.
+# Collect command-line arguments for buildinfo.txt.
+# Must reside at the top of the script to work as expected.
+set(_cmake_args "")
+if(NOT "$ENV{CURL_BUILDINFO}$ENV{CURL_CI}$ENV{CI}" STREQUAL "")
+  get_cmake_property(_cache_vars CACHE_VARIABLES)
+  foreach(_cache_var IN ITEMS ${_cache_vars})
+    get_property(_cache_var_helpstring CACHE ${_cache_var} PROPERTY HELPSTRING)
+    if(_cache_var_helpstring STREQUAL "No help, variable specified on the command line.")
+      get_property(_cache_var_type CACHE ${_cache_var} PROPERTY TYPE)
+      get_property(_cache_var_value CACHE ${_cache_var} PROPERTY VALUE)
+      if(_cache_var_type STREQUAL "UNINITIALIZED")
+        set(_cache_var_type "")
+      else()
+        set(_cache_var_type ":${_cache_var_type}")
+      endif()
+      string(APPEND _cmake_args " -D${_cache_var}${_cache_var_type}=\"${_cache_var_value}\"")
+    endif()
+  endforeach()
+endif()
 
-cmake_minimum_required(VERSION 3.7...3.16 FATAL_ERROR)
-
-set(CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/CMake;${CMAKE_MODULE_PATH}")
+list(PREPEND CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/CMake")
 include(Utilities)
 include(Macros)
 include(CMakeDependentOption)
 include(CheckCCompilerFlag)
 
-project(CURL C)
+file(STRINGS "${CMAKE_CURRENT_SOURCE_DIR}/include/curl/curlver.h" _curl_version_h_contents REGEX "#define LIBCURL_VERSION( |_NUM )")
+string(REGEX MATCH "#define LIBCURL_VERSION \"[^\"]*" _curl_version ${_curl_version_h_contents})
+string(REGEX REPLACE "[^\"]+\"" "" _curl_version ${_curl_version})
+string(REGEX MATCH "#define LIBCURL_VERSION_NUM 0x[0-9a-fA-F]+" _curl_version_num ${_curl_version_h_contents})
+string(REGEX REPLACE "[^0]+0x" "" _curl_version_num ${_curl_version_num})
+unset(_curl_version_h_contents)
 
-file(STRINGS ${CURL_SOURCE_DIR}/include/curl/curlver.h CURL_VERSION_H_CONTENTS REGEX "#define LIBCURL_VERSION( |_NUM )")
-string(REGEX MATCH "#define LIBCURL_VERSION \"[^\"]*"
-  CURL_VERSION ${CURL_VERSION_H_CONTENTS})
-string(REGEX REPLACE "[^\"]+\"" "" CURL_VERSION ${CURL_VERSION})
-string(REGEX MATCH "#define LIBCURL_VERSION_NUM 0x[0-9a-fA-F]+"
-  CURL_VERSION_NUM ${CURL_VERSION_H_CONTENTS})
-string(REGEX REPLACE "[^0]+0x" "" CURL_VERSION_NUM ${CURL_VERSION_NUM})
+message(STATUS "curl version=[${_curl_version}]")
 
+string(REGEX REPLACE "([0-9]+\.[0-9]+\.[0-9]+).+" "\\1" _curl_version_sem "${_curl_version}")
+project(CURL
+  VERSION "${_curl_version_sem}"
+  LANGUAGES C)
 
-# Setup package meta-data
-# SET(PACKAGE "curl")
-message(STATUS "curl version=[${CURL_VERSION}]")
-# SET(PACKAGE_TARNAME "curl")
-# SET(PACKAGE_NAME "curl")
-# SET(PACKAGE_VERSION "-")
-# SET(PACKAGE_STRING "curl-")
-# SET(PACKAGE_BUGREPORT "a suitable curl mailing list => https://curl.se/mail/")
-set(OPERATING_SYSTEM "${CMAKE_SYSTEM_NAME}")
-if(CMAKE_C_COMPILER_TARGET)
-  set(OS "\"${CMAKE_C_COMPILER_TARGET}\"")
-else()
-  set(OS "\"${CMAKE_SYSTEM_NAME}\"")
+# CMake does not recognize some targets accurately. Touch up configuration manually as a workaround.
+if(WINDOWS_STORE AND MINGW)  # MinGW UWP build
+  # CMake (as of v3.31.2) gets confused and applies the MSVC rc.exe command-line
+  # template to windres. Reset it to the windres template as in 'Modules/Platform/Windows-windres.cmake':
+  set(CMAKE_RC_COMPILE_OBJECT "<CMAKE_RC_COMPILER> -O coff <DEFINES> <INCLUDES> <FLAGS> <SOURCE> <OBJECT>")
+elseif(DOS AND CMAKE_C_COMPILER_ID STREQUAL "GNU")  # DJGPP
+  set(CMAKE_STATIC_LIBRARY_PREFIX "lib")
+  set(CMAKE_STATIC_LIBRARY_SUFFIX ".a")
+  set(CMAKE_FIND_LIBRARY_PREFIXES "lib")
+  set(CMAKE_FIND_LIBRARY_SUFFIXES ".a")
 endif()
 
-include_directories(${CURL_SOURCE_DIR}/include)
+# Fill platform level variable when using CMake's built-in Android configuration
+if(ANDROID AND NOT DEFINED ANDROID_PLATFORM_LEVEL AND NOT CMAKE_SYSTEM_VERSION EQUAL 1)
+  set(ANDROID_PLATFORM_LEVEL "${CMAKE_SYSTEM_VERSION}")
+endif()
 
-set(CMAKE_UNITY_BUILD_BATCH_SIZE 0)
+set(_target_flags "")
+if(APPLE)
+  string(APPEND _target_flags " APPLE")
+endif()
+if(UNIX)
+  string(APPEND _target_flags " UNIX")
+endif()
+if(BSD)
+  string(APPEND _target_flags " BSD")
+endif()
+if(ANDROID)
+  string(APPEND _target_flags " ANDROID-${ANDROID_PLATFORM_LEVEL}")
+endif()
+if(WIN32)
+  string(APPEND _target_flags " WIN32")
+endif()
+if(WINDOWS_STORE)
+  string(APPEND _target_flags " UWP")
+endif()
+if(CYGWIN)
+  string(APPEND _target_flags " CYGWIN")
+endif()
+if(DOS)
+  string(APPEND _target_flags " DOS")
+endif()
+if(AMIGA)
+  string(APPEND _target_flags " AMIGA")
+endif()
+if(CMAKE_C_COMPILER_ID STREQUAL "GNU")
+  string(APPEND _target_flags " GCC")
+endif()
+if(CMAKE_C_COMPILER_ID STREQUAL "AppleClang")
+  string(APPEND _target_flags " APPLE-CLANG")
+elseif(CMAKE_C_COMPILER_ID STREQUAL "Clang" AND MSVC)
+  string(APPEND _target_flags " CLANG-CL")
+elseif(CMAKE_C_COMPILER_ID MATCHES "Clang")
+  string(APPEND _target_flags " LLVM-CLANG")
+endif()
+if(MINGW)
+  string(APPEND _target_flags " MINGW")
+endif()
+if(MSVC)
+  string(APPEND _target_flags " MSVC-${MSVC_VERSION}")
+endif()
+if(VCPKG_TOOLCHAIN)
+  string(APPEND _target_flags " VCPKG")
+endif()
+if(CMAKE_CROSSCOMPILING)
+  string(APPEND _target_flags " CROSS")
+endif()
+if(CMAKE_C_STANDARD)
+  string(APPEND _target_flags " C${CMAKE_C_STANDARD}")
+endif()
+message(STATUS "CMake platform flags:${_target_flags}")
+
+if(CMAKE_CROSSCOMPILING)
+  message(STATUS "Cross-compiling: "
+    "${CMAKE_HOST_SYSTEM_NAME}/${CMAKE_HOST_SYSTEM_PROCESSOR} -> "
+    "${CMAKE_SYSTEM_NAME}/${CMAKE_SYSTEM_PROCESSOR}")
+endif()
+
+if(CMAKE_C_COMPILER_TARGET)
+  set(CURL_OS "\"${CMAKE_C_COMPILER_TARGET}\"")
+else()
+  set(CURL_OS "\"${CMAKE_SYSTEM_NAME}\"")
+endif()
+
+if(CURL_PATCHSTAMP)
+  set(CURL_PATCHSTAMP "\"${CURL_PATCHSTAMP}\"")
+endif()
+
+set(LIB_NAME "libcurl")
+set(EXE_NAME "curl")
+
+set_property(DIRECTORY APPEND PROPERTY INCLUDE_DIRECTORIES "${PROJECT_SOURCE_DIR}/include")
+
+if(NOT DEFINED CMAKE_UNITY_BUILD_BATCH_SIZE)
+  set(CMAKE_UNITY_BUILD_BATCH_SIZE 0)
+endif()
+
+# Having CMAKE_TRY_COMPILE_TARGET_TYPE set to STATIC_LIBRARY breaks certain
+# 'check_function_exists()' detections (possibly more), by detecting
+# non-existing features. This happens by default when using 'ios.toolchain.cmake'.
+# Work it around by setting this value to `EXECUTABLE`.
+if(CMAKE_TRY_COMPILE_TARGET_TYPE STREQUAL "STATIC_LIBRARY")
+  message(STATUS "CMAKE_TRY_COMPILE_TARGET_TYPE was found set to STATIC_LIBRARY. "
+    "Overriding with EXECUTABLE for feature detections to work.")
+  set(_cmake_try_compile_target_type_save ${CMAKE_TRY_COMPILE_TARGET_TYPE})
+  set(CMAKE_TRY_COMPILE_TARGET_TYPE "EXECUTABLE")
+endif()
 
 option(CURL_WERROR "Turn compiler warnings into errors" OFF)
 option(PICKY_COMPILER "Enable picky compiler options" ON)
-option(BUILD_CURL_EXE "Set to ON to build curl executable." ON)
-option(BUILD_SHARED_LIBS "Build shared libraries" ON)
-option(BUILD_STATIC_LIBS "Build shared libraries" OFF)
+option(BUILD_CURL_EXE "Build curl executable" ON)
+get_property(_has_shared GLOBAL PROPERTY TARGET_SUPPORTS_SHARED_LIBS)
+option(BUILD_SHARED_LIBS "Build shared libraries" ${_has_shared})
+option(BUILD_STATIC_LIBS "Build static libraries" OFF)
 option(BUILD_STATIC_CURL "Build curl executable with static libcurl" OFF)
-option(ENABLE_ARES "Set to ON to enable c-ares support" OFF)
+option(ENABLE_ARES "Enable c-ares support" OFF)
+option(CURL_DISABLE_INSTALL "Disable installation targets" OFF)
+option(CURL_BUILD_EVERYTHING "Build optional build targets (examples, tests) by default" OFF)
+
 if(WIN32)
-  option(CURL_STATIC_CRT "Set to ON to build libcurl with static CRT on Windows (/MT)." OFF)
-  option(ENABLE_UNICODE "Set to ON to use the Unicode version of the Windows API functions" OFF)
-  set(CURL_TARGET_WINDOWS_VERSION "" CACHE STRING "Minimum target Windows version as hex string")
-  if(CURL_TARGET_WINDOWS_VERSION)
-    add_definitions(-D_WIN32_WINNT=${CURL_TARGET_WINDOWS_VERSION})
-    list(APPEND CMAKE_REQUIRED_DEFINITIONS -D_WIN32_WINNT=${CURL_TARGET_WINDOWS_VERSION})
-    set(CURL_TEST_DEFINES "${CURL_TEST_DEFINES} -D_WIN32_WINNT=${CURL_TARGET_WINDOWS_VERSION}")
+  option(ENABLE_UNICODE "Use the Unicode version of the Windows API functions" OFF)
+  if(WINDOWS_STORE)
+    set(ENABLE_UNICODE ON)
   endif()
   if(ENABLE_UNICODE)
-    add_definitions(-DUNICODE -D_UNICODE)
+    set_property(DIRECTORY APPEND PROPERTY COMPILE_DEFINITIONS "UNICODE" "_UNICODE")
     if(MINGW)
-      add_compile_options(-municode)
+      set_property(DIRECTORY APPEND PROPERTY COMPILE_OPTIONS "-municode")
     endif()
   endif()
+
+  # Apply to all feature checks
+  list(APPEND CMAKE_REQUIRED_DEFINITIONS "-DWIN32_LEAN_AND_MEAN")
+
+  set(CURL_TARGET_WINDOWS_VERSION "" CACHE STRING "Minimum target Windows version as hex string")
+  if(CURL_TARGET_WINDOWS_VERSION)
+    if(CURL_TARGET_WINDOWS_VERSION MATCHES "^0x[0-9a-fA-F]+$")
+      set_property(DIRECTORY APPEND PROPERTY COMPILE_DEFINITIONS "_WIN32_WINNT=${CURL_TARGET_WINDOWS_VERSION}")
+      list(APPEND CMAKE_REQUIRED_DEFINITIONS "-D_WIN32_WINNT=${CURL_TARGET_WINDOWS_VERSION}")  # Apply to all feature checks
+    else()
+      message(WARNING "CURL_TARGET_WINDOWS_VERSION value '${CURL_TARGET_WINDOWS_VERSION}' is not a valid hex string.")
+    endif()
+  endif()
+
+  # Detect actual value of _WIN32_WINNT and store as HAVE_WIN32_WINNT
+  curl_internal_test(HAVE_WIN32_WINNT)
+  if(HAVE_WIN32_WINNT)
+    string(REGEX MATCH "_WIN32_WINNT=0x[0-9a-fA-F]+" CURL_TEST_OUTPUT "${CURL_TEST_OUTPUT}")
+    string(REGEX REPLACE "_WIN32_WINNT=" "" CURL_TEST_OUTPUT "${CURL_TEST_OUTPUT}")
+    string(REGEX REPLACE "0x([0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])$" "0x0\\1" CURL_TEST_OUTPUT "${CURL_TEST_OUTPUT}") # pad to 4 digits
+    string(TOLOWER "${CURL_TEST_OUTPUT}" HAVE_WIN32_WINNT)
+    message(STATUS "Found _WIN32_WINNT=${HAVE_WIN32_WINNT}")
+  endif()
+  unset(HAVE_WIN32_WINNT CACHE)  # Avoid storing in CMake cache
+
+  if(MINGW)
+    # Detect __MINGW64_VERSION_MAJOR, __MINGW64_VERSION_MINOR and store as MINGW64_VERSION
+    curl_internal_test(MINGW64_VERSION)
+    if(MINGW64_VERSION)
+      string(REGEX MATCH "MINGW64_VERSION=[0-9]+\.[0-9]+" CURL_TEST_OUTPUT "${CURL_TEST_OUTPUT}")
+      string(REGEX REPLACE "MINGW64_VERSION=" "" MINGW64_VERSION "${CURL_TEST_OUTPUT}")
+      if(MINGW64_VERSION)
+        message(STATUS "Found MINGW64_VERSION=${MINGW64_VERSION}")
+        if(MINGW64_VERSION VERSION_LESS 3.0)
+          message(FATAL_ERROR "mingw-w64 3.0 or upper is required")
+        endif()
+      endif()
+    endif()
+    unset(MINGW64_VERSION CACHE)  # Avoid storing in CMake cache
+  endif()
+elseif(DOS)
+  set(BUILD_SHARED_LIBS OFF)
+  set(BUILD_STATIC_LIBS ON)
 endif()
-option(CURL_LTO "Turn on compiler Link Time Optimizations" OFF)
+option(CURL_LTO "Enable compiler Link Time Optimizations" OFF)
 
-cmake_dependent_option(ENABLE_THREADED_RESOLVER "Set to ON to enable threaded DNS lookup"
-        ON "NOT ENABLE_ARES"
-        OFF)
+if(NOT DOS AND NOT AMIGA)
+  # if c-ares is used, default the threaded resolver to OFF
+  if(ENABLE_ARES)
+    set(_enable_threaded_resolver_default OFF)
+  else()
+    set(_enable_threaded_resolver_default ON)
+  endif()
+  option(ENABLE_THREADED_RESOLVER "Enable threaded DNS lookup" ${_enable_threaded_resolver_default})
+endif()
 
-option(ENABLE_DEBUG "Set to ON to enable curl debug features" OFF)
-option(ENABLE_CURLDEBUG "Set to ON to build with TrackMemory feature enabled" OFF)
+if(CYGWIN OR CMAKE_SYSTEM_NAME STREQUAL "Linux" OR CMAKE_SYSTEM_NAME STREQUAL "GNU")
+  set_property(DIRECTORY APPEND PROPERTY COMPILE_DEFINITIONS "_GNU_SOURCE")  # Required for accept4(), pipe2(), sendmmsg()
+  list(APPEND CMAKE_REQUIRED_DEFINITIONS "-D_GNU_SOURCE")  # Apply to all feature checks
+endif()
+
+option(ENABLE_DEBUG "Enable curl debug features (for developing curl itself)" OFF)
+if(ENABLE_DEBUG)
+  message(WARNING "This curl build is Debug-enabled and insecure, do not use in production.")
+endif()
+
+set(CURL_DEBUG_MACROS "")
+if(ENABLE_DEBUG)
+  list(APPEND CURL_DEBUG_MACROS "DEBUGBUILD")
+endif()
+
+option(CURL_CLANG_TIDY "Run the build through clang-tidy" OFF)
+if(CURL_CLANG_TIDY)
+  find_program(CLANG_TIDY NAMES "clang-tidy" REQUIRED)
+  if(NOT CMAKE_C_COMPILER_ID MATCHES "Clang")
+    set(PICKY_COMPILER OFF)  # Do a best effort and skip passing non-clang warning options to clang-tidy.
+    # This lets through warning options enabled via CURL_WERROR=ON, affecting lib and src.
+  endif()
+  set(CURL_DISABLE_TYPECHECK ON)  # to improve performance (1.4x), avoid potential interference and bugprone-macro-parentheses.
+  set(CMAKE_C_CLANG_TIDY "${CLANG_TIDY}")
+  list(APPEND CMAKE_C_CLANG_TIDY "--config-file=${PROJECT_SOURCE_DIR}/.clang-tidy.yml")
+  if(CURL_WERROR)
+    list(APPEND CMAKE_C_CLANG_TIDY "--warnings-as-errors=*")
+  endif()
+  if(CURL_CLANG_TIDYFLAGS)
+    string(REPLACE " " ";" _tidy_flags_list "${CURL_CLANG_TIDYFLAGS}")
+    list(APPEND CMAKE_C_CLANG_TIDY ${_tidy_flags_list})
+  endif()
+endif()
+
+option(CURL_GCC_ANALYZER "Enable GCC --analyzer option" OFF)
+if(CURL_GCC_ANALYZER AND CMAKE_C_COMPILER_ID STREQUAL "GNU" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 11.0)
+  set(CURL_DISABLE_TYPECHECK ON)  # to improve performance (1.1x).
+  # https://gcc.gnu.org/onlinedocs/gcc/Static-Analyzer-Options.html
+  set(CURL_ANALYZER_CFLAGS "-fanalyzer")
+  # disable checks causing false positives only
+  list(APPEND CURL_ANALYZER_CFLAGS "-Wno-analyzer-fd-leak" "-Wno-analyzer-fd-use-without-check" "-Wno-analyzer-file-leak")
+  list(APPEND CURL_ANALYZER_CFLAGS "-Wno-analyzer-infinite-loop")
+  list(APPEND CURL_ANALYZER_CFLAGS "-Wno-analyzer-malloc-leak")
+  list(APPEND CURL_ANALYZER_CFLAGS "-Wno-analyzer-out-of-bounds")
+endif()
+
+option(CURL_CODE_COVERAGE "Enable code coverage build options" OFF)
+if(CURL_CODE_COVERAGE)
+  if(CMAKE_C_COMPILER_ID STREQUAL "GNU")
+    set(CURL_COVERAGE_MACROS "NDEBUG")
+    set(CURL_COVERAGE_CFLAGS "-O0" "-g" "-fprofile-arcs")
+    if(CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 4.1)
+      list(APPEND CURL_COVERAGE_CFLAGS "--coverage")
+    else()
+      list(APPEND CURL_COVERAGE_CFLAGS "-ftest-coverage")
+    endif()
+    set(CURL_COVERAGE_LIBS "gcov")
+  elseif(CMAKE_C_COMPILER_ID MATCHES "Clang")
+    set(CURL_COVERAGE_MACROS "NDEBUG")
+    set(CURL_COVERAGE_CFLAGS "-O0" "-g" "-fprofile-instr-generate" "-fcoverage-mapping")
+    set(CURL_COVERAGE_LDFLAGS "-fprofile-instr-generate" "-fcoverage-mapping")
+  else()
+    set(CURL_CODE_COVERAGE OFF)
+  endif()
+endif()
 
 include(PickyWarnings)
 
-if(ENABLE_DEBUG)
-  # DEBUGBUILD will be defined only for Debug builds
-  set_property(DIRECTORY APPEND PROPERTY COMPILE_DEFINITIONS $<$<CONFIG:Debug>:DEBUGBUILD>)
-  set(ENABLE_CURLDEBUG ON)
-endif()
+set(CURL_CFLAGS "")  # C flags set for libcurl and curl tool (aka public binaries) only
 
-if(ENABLE_CURLDEBUG)
-  set_property(DIRECTORY APPEND PROPERTY COMPILE_DEFINITIONS CURLDEBUG)
+option(CURL_DROP_UNUSED "Drop unused code and data from built binaries" OFF)
+if(CURL_DROP_UNUSED)
+  if(APPLE)
+    set_property(DIRECTORY APPEND PROPERTY LINK_OPTIONS "-Wl,-dead_strip")
+  elseif(MSVC)  # Options below are toolchain defaults in Release configurations.
+    # This option does not seem to have an effect with VS2010:
+    set_property(DIRECTORY APPEND PROPERTY LINK_OPTIONS "-OPT:REF")
+    # Optional, but reduces binary size further, with the cost of larger objects/static libraries:
+    list(APPEND CURL_CFLAGS "-Gy")
+  elseif(CMAKE_C_COMPILER_ID STREQUAL "GNU" OR CMAKE_C_COMPILER_ID MATCHES "Clang")
+    if(WIN32)
+      # To make -Wl,--gc-sections work on Windows: https://sourceware.org/bugzilla/show_bug.cgi?id=11539
+      set_property(DIRECTORY APPEND PROPERTY COMPILE_OPTIONS "-fno-asynchronous-unwind-tables")
+    endif()
+    set_property(DIRECTORY APPEND PROPERTY LINK_OPTIONS "-Wl,--gc-sections")
+    # Optional, but reduces binary size further, with the cost of larger objects/static libraries:
+    list(APPEND CURL_CFLAGS "-ffunction-sections" "-fdata-sections")
+  endif()
 endif()
 
 # For debug libs and exes, add "-d" postfix
@@ -159,114 +358,180 @@ elseif(BUILD_STATIC_CURL AND NOT BUILD_STATIC_LIBS)
   set(BUILD_STATIC_CURL OFF)
 endif()
 
-# lib flavour selected for curl tool
+# Lib flavor selected for curl tool
 if(BUILD_STATIC_CURL)
   set(LIB_SELECTED_FOR_EXE ${LIB_STATIC})
 else()
   set(LIB_SELECTED_FOR_EXE ${LIB_SHARED})
 endif()
 
-# lib flavour selected for example and test programs.
+# Lib flavor selected for example and test programs.
 if(BUILD_SHARED_LIBS)
   set(LIB_SELECTED ${LIB_SHARED})
 else()
   set(LIB_SELECTED ${LIB_STATIC})
 endif()
 
-# initialize CURL_LIBS
+if(WIN32)
+  option(CURL_STATIC_CRT "Build libcurl with static CRT with MSVC (/MT)" OFF)
+  if(CURL_STATIC_CRT AND MSVC)
+    if(MSVC_VERSION GREATER_EQUAL 1900 OR BUILD_STATIC_CURL OR NOT BUILD_CURL_EXE)
+      set(CMAKE_MSVC_RUNTIME_LIBRARY "MultiThreaded$<$<CONFIG:Debug>:Debug>")
+      set_property(DIRECTORY APPEND PROPERTY COMPILE_OPTIONS "$<$<CONFIG:Release>:-MT>")
+      set_property(DIRECTORY APPEND PROPERTY COMPILE_OPTIONS "$<$<CONFIG:Debug>:-MTd>")
+    else()
+      message(WARNING "Static CRT requires UCRT, static libcurl or no curl executable.")
+    endif()
+  endif()
+endif()
+
+# Override to force-disable or force-enable the use of CMake Configs.
+if(MSVC AND NOT VCPKG_TOOLCHAIN AND NOT CMAKE_CROSSCOMPILING)
+  set(_curl_use_cmakeconfig_default ON)
+else()
+  set(_curl_use_cmakeconfig_default OFF)
+endif()
+option(CURL_USE_CMAKECONFIG "Enable detecting dependencies via CMake Config" ${_curl_use_cmakeconfig_default})
+
+# Override to force-disable or force-enable the use of pkg-config.
+if((UNIX AND NOT ANDROID AND (NOT APPLE OR CMAKE_SYSTEM_NAME STREQUAL "Darwin")) OR
+   VCPKG_TOOLCHAIN OR
+   (MINGW AND NOT CMAKE_CROSSCOMPILING))
+  set(_curl_use_pkgconfig_default ON)
+else()
+  set(_curl_use_pkgconfig_default OFF)
+endif()
+option(CURL_USE_PKGCONFIG "Enable pkg-config to detect dependencies" ${_curl_use_pkgconfig_default})
+
+# Initialize variables collecting system and dependency libs.
+set(CURL_NETWORK_AND_TIME_LIBS "")
 set(CURL_LIBS "")
 
 if(ENABLE_ARES)
   set(USE_ARES 1)
-  find_package(CARES REQUIRED)
-  list(APPEND CURL_LIBS ${CARES_LIBRARY})
+  find_package(Cares MODULE REQUIRED)
+  list(APPEND CURL_LIBS CURL::cares)
 endif()
 
 include(CurlSymbolHiding)
 
-option(CURL_ENABLE_EXPORT_TARGET "to enable cmake export target" ON)
+option(CURL_ENABLE_EXPORT_TARGET "Enable CMake export target" ON)
 mark_as_advanced(CURL_ENABLE_EXPORT_TARGET)
 
-option(CURL_DISABLE_ALTSVC "disables alt-svc support" OFF)
+option(CURL_DISABLE_ALTSVC "Disable alt-svc support" OFF)
 mark_as_advanced(CURL_DISABLE_ALTSVC)
-option(CURL_DISABLE_COOKIES "disables cookies support" OFF)
+option(CURL_DISABLE_SRP "Disable TLS-SRP support" OFF)
+mark_as_advanced(CURL_DISABLE_SRP)
+option(CURL_DISABLE_COOKIES "Disable cookies support" OFF)
 mark_as_advanced(CURL_DISABLE_COOKIES)
-option(CURL_DISABLE_BASIC_AUTH "disables Basic authentication" OFF)
+option(CURL_DISABLE_BASIC_AUTH "Disable Basic authentication" OFF)
 mark_as_advanced(CURL_DISABLE_BASIC_AUTH)
-option(CURL_DISABLE_BEARER_AUTH "disables Bearer authentication" OFF)
+option(CURL_DISABLE_BEARER_AUTH "Disable Bearer authentication" OFF)
 mark_as_advanced(CURL_DISABLE_BEARER_AUTH)
-option(CURL_DISABLE_DIGEST_AUTH "disables Digest authentication" OFF)
+option(CURL_DISABLE_DIGEST_AUTH "Disable Digest authentication" OFF)
 mark_as_advanced(CURL_DISABLE_DIGEST_AUTH)
-option(CURL_DISABLE_KERBEROS_AUTH "disables Kerberos authentication" OFF)
+option(CURL_DISABLE_KERBEROS_AUTH "Disable Kerberos authentication" OFF)
 mark_as_advanced(CURL_DISABLE_KERBEROS_AUTH)
-option(CURL_DISABLE_NEGOTIATE_AUTH "disables negotiate authentication" OFF)
+option(CURL_DISABLE_NEGOTIATE_AUTH "Disable negotiate authentication" OFF)
 mark_as_advanced(CURL_DISABLE_NEGOTIATE_AUTH)
-option(CURL_DISABLE_AWS "disables AWS-SIG4" OFF)
+option(CURL_DISABLE_AWS "Disable aws-sigv4" OFF)
 mark_as_advanced(CURL_DISABLE_AWS)
-option(CURL_DISABLE_DICT "disables DICT" OFF)
+option(CURL_DISABLE_DICT "Disable DICT" OFF)
 mark_as_advanced(CURL_DISABLE_DICT)
-option(CURL_DISABLE_DOH "disables DNS-over-HTTPS" OFF)
+option(CURL_DISABLE_DOH "Disable DNS-over-HTTPS" OFF)
 mark_as_advanced(CURL_DISABLE_DOH)
-option(CURL_DISABLE_FILE "disables FILE" OFF)
+option(CURL_DISABLE_FILE "Disable FILE" OFF)
 mark_as_advanced(CURL_DISABLE_FILE)
-cmake_dependent_option(CURL_DISABLE_FORM_API "disables form api" OFF
-                       "NOT CURL_DISABLE_MIME" ON)
-mark_as_advanced(CURL_DISABLE_FORM_API)
-option(CURL_DISABLE_FTP "disables FTP" OFF)
+option(CURL_DISABLE_FTP "Disable FTP" OFF)
 mark_as_advanced(CURL_DISABLE_FTP)
-option(CURL_DISABLE_GETOPTIONS "disables curl_easy_options API for existing options to curl_easy_setopt" OFF)
+option(CURL_DISABLE_GETOPTIONS "Disable curl_easy_options API for existing options to curl_easy_setopt" OFF)
 mark_as_advanced(CURL_DISABLE_GETOPTIONS)
-option(CURL_DISABLE_GOPHER "disables Gopher" OFF)
+option(CURL_DISABLE_GOPHER "Disable Gopher" OFF)
 mark_as_advanced(CURL_DISABLE_GOPHER)
-option(CURL_DISABLE_HSTS "disables HSTS support" OFF)
+option(CURL_DISABLE_HEADERS_API "Disable headers-api support" OFF)
+mark_as_advanced(CURL_DISABLE_HEADERS_API)
+option(CURL_DISABLE_HSTS "Disable HSTS support" OFF)
 mark_as_advanced(CURL_DISABLE_HSTS)
-option(CURL_DISABLE_HTTP "disables HTTP" OFF)
+option(CURL_DISABLE_HTTP "Disable HTTP" OFF)
 mark_as_advanced(CURL_DISABLE_HTTP)
-option(CURL_DISABLE_HTTP_AUTH "disables all HTTP authentication methods" OFF)
+option(CURL_DISABLE_HTTP_AUTH "Disable all HTTP authentication methods" OFF)
 mark_as_advanced(CURL_DISABLE_HTTP_AUTH)
-option(CURL_DISABLE_IMAP "disables IMAP" OFF)
+option(CURL_DISABLE_IMAP "Disable IMAP" OFF)
 mark_as_advanced(CURL_DISABLE_IMAP)
-option(CURL_DISABLE_LDAP "disables LDAP" OFF)
+option(CURL_DISABLE_LDAP "Disable LDAP" OFF)
 mark_as_advanced(CURL_DISABLE_LDAP)
-option(CURL_DISABLE_LDAPS "disables LDAPS" OFF)
+option(CURL_DISABLE_LDAPS "Disable LDAPS" ${CURL_DISABLE_LDAP})
 mark_as_advanced(CURL_DISABLE_LDAPS)
-option(CURL_DISABLE_LIBCURL_OPTION "disables --libcurl option from the curl tool" OFF)
+option(CURL_DISABLE_LIBCURL_OPTION "Disable --libcurl option from the curl tool" OFF)
 mark_as_advanced(CURL_DISABLE_LIBCURL_OPTION)
-option(CURL_DISABLE_MIME "disables MIME support" OFF)
+option(CURL_DISABLE_MIME "Disable MIME support" OFF)
 mark_as_advanced(CURL_DISABLE_MIME)
-option(CURL_DISABLE_MQTT "disables MQTT" OFF)
+cmake_dependent_option(CURL_DISABLE_FORM_API "Disable form-api"
+  OFF "NOT CURL_DISABLE_MIME"
+  ON)
+mark_as_advanced(CURL_DISABLE_FORM_API)
+option(CURL_DISABLE_MQTT "Disable MQTT" OFF)
 mark_as_advanced(CURL_DISABLE_MQTT)
-option(CURL_DISABLE_NETRC "disables netrc parser" OFF)
+option(CURL_DISABLE_BINDLOCAL "Disable local binding support" OFF)
+mark_as_advanced(CURL_DISABLE_BINDLOCAL)
+option(CURL_DISABLE_NETRC "Disable netrc parser" OFF)
 mark_as_advanced(CURL_DISABLE_NETRC)
-option(CURL_DISABLE_NTLM "disables NTLM support" OFF)
-mark_as_advanced(CURL_DISABLE_NTLM)
-option(CURL_DISABLE_PARSEDATE "disables date parsing" OFF)
+option(CURL_ENABLE_NTLM "Enable NTLM support" OFF)
+mark_as_advanced(CURL_ENABLE_NTLM)
+option(CURL_DISABLE_PARSEDATE "Disable date parsing" OFF)
 mark_as_advanced(CURL_DISABLE_PARSEDATE)
-option(CURL_DISABLE_POP3 "disables POP3" OFF)
+option(CURL_DISABLE_POP3 "Disable POP3" OFF)
 mark_as_advanced(CURL_DISABLE_POP3)
-option(CURL_DISABLE_PROGRESS_METER "disables built-in progress meter" OFF)
+option(CURL_DISABLE_PROGRESS_METER "Disable built-in progress meter" OFF)
 mark_as_advanced(CURL_DISABLE_PROGRESS_METER)
-option(CURL_DISABLE_PROXY "disables proxy support" OFF)
+option(CURL_DISABLE_PROXY "Disable proxy support" OFF)
 mark_as_advanced(CURL_DISABLE_PROXY)
-option(CURL_DISABLE_RTSP "disables RTSP" OFF)
+option(CURL_DISABLE_IPFS "Disable IPFS" OFF)
+mark_as_advanced(CURL_DISABLE_IPFS)
+option(CURL_DISABLE_RTSP "Disable RTSP" OFF)
 mark_as_advanced(CURL_DISABLE_RTSP)
-option(CURL_DISABLE_SHUFFLE_DNS "disables shuffle DNS feature" OFF)
+option(CURL_DISABLE_SHA512_256 "Disable SHA-512/256 hash algorithm" OFF)
+mark_as_advanced(CURL_DISABLE_SHA512_256)
+option(CURL_DISABLE_SHUFFLE_DNS "Disable shuffle DNS feature" OFF)
 mark_as_advanced(CURL_DISABLE_SHUFFLE_DNS)
-option(CURL_DISABLE_SMB "disables SMB" OFF)
-mark_as_advanced(CURL_DISABLE_SMB)
-option(CURL_DISABLE_SMTP "disables SMTP" OFF)
+option(CURL_ENABLE_SMB "Enable SMB" OFF)
+mark_as_advanced(CURL_ENABLE_SMB)
+option(CURL_DISABLE_SMTP "Disable SMTP" OFF)
 mark_as_advanced(CURL_DISABLE_SMTP)
-option(CURL_DISABLE_SOCKETPAIR "disables use of socketpair for curl_multi_poll" OFF)
+option(CURL_DISABLE_SOCKETPAIR "Disable use of socketpair for curl_multi_poll()" OFF)
 mark_as_advanced(CURL_DISABLE_SOCKETPAIR)
-option(CURL_DISABLE_TELNET "disables Telnet" OFF)
+option(CURL_DISABLE_WEBSOCKETS "Disable WebSocket" OFF)
+mark_as_advanced(CURL_DISABLE_WEBSOCKETS)
+option(CURL_DISABLE_TELNET "Disable Telnet" OFF)
 mark_as_advanced(CURL_DISABLE_TELNET)
-option(CURL_DISABLE_TFTP "disables TFTP" OFF)
+option(CURL_DISABLE_TFTP "Disable TFTP" OFF)
 mark_as_advanced(CURL_DISABLE_TFTP)
-option(CURL_DISABLE_VERBOSE_STRINGS "disables verbose strings" OFF)
+option(CURL_DISABLE_TYPECHECK "Disable curl_easy_setopt()/curl_easy_getinfo() type checking" OFF)
+mark_as_advanced(CURL_DISABLE_TYPECHECK)
+option(CURL_DISABLE_VERBOSE_STRINGS "Disable verbose strings" OFF)
 mark_as_advanced(CURL_DISABLE_VERBOSE_STRINGS)
+option(CURL_DEBUG_GLOBAL_MEM "Debug curl_global_init_mem" OFF)
+mark_as_advanced(CURL_DEBUG_GLOBAL_MEM)
+
+if(CURL_DEBUG_GLOBAL_MEM)
+  # Set it via the command-line to make it apply to the entire directory.
+  set_property(DIRECTORY APPEND PROPERTY COMPILE_DEFINITIONS "CURL_DEBUG_GLOBAL_MEM")
+endif()
+if(CURL_DISABLE_TYPECHECK)
+  # Set it via the command-line to make it apply to examples also.
+  set_property(DIRECTORY APPEND PROPERTY COMPILE_DEFINITIONS "CURL_DISABLE_TYPECHECK")
+endif()
+
+if(CURL_DISABLE_HTTP)
+  set(CURL_DISABLE_ALTSVC ON)
+  set(CURL_DISABLE_HSTS ON)
+  set(CURL_DISABLE_IPFS ON)
+  set(CURL_DISABLE_RTSP ON)
+  set(CURL_DISABLE_WEBSOCKETS ON)
+endif()
 
 # Corresponds to HTTP_ONLY in lib/curl_setup.h
-option(HTTP_ONLY "disables all protocols except HTTP (This overrides all CURL_DISABLE_* options)" OFF)
+option(HTTP_ONLY "Disable all protocols except HTTP (This overrides all CURL_DISABLE_* options)" OFF)
 mark_as_advanced(HTTP_ONLY)
 
 if(HTTP_ONLY)
@@ -275,77 +540,72 @@ if(HTTP_ONLY)
   set(CURL_DISABLE_FTP ON)
   set(CURL_DISABLE_GOPHER ON)
   set(CURL_DISABLE_IMAP ON)
+  set(CURL_DISABLE_IPFS ON)
   set(CURL_DISABLE_LDAP ON)
   set(CURL_DISABLE_LDAPS ON)
   set(CURL_DISABLE_MQTT ON)
   set(CURL_DISABLE_POP3 ON)
   set(CURL_DISABLE_RTSP ON)
-  set(CURL_DISABLE_SMB ON)
   set(CURL_DISABLE_SMTP ON)
   set(CURL_DISABLE_TELNET ON)
   set(CURL_DISABLE_TFTP ON)
+  set(CURL_DISABLE_WEBSOCKETS ON)
 endif()
 
-option(ENABLE_IPV6 "Define if you want to enable IPv6 support" ON)
-mark_as_advanced(ENABLE_IPV6)
-if(ENABLE_IPV6 AND NOT WIN32)
-  include(CheckStructHasMember)
-  check_struct_has_member("struct sockaddr_in6" sin6_addr "netinet/in.h"
-                          HAVE_SOCKADDR_IN6_SIN6_ADDR)
-  check_struct_has_member("struct sockaddr_in6" sin6_scope_id "netinet/in.h"
-                          HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID)
-  if(NOT HAVE_SOCKADDR_IN6_SIN6_ADDR)
-    message(WARNING "struct sockaddr_in6 not available, disabling IPv6 support")
-    # Force the feature off as this name is used as guard macro...
-    set(ENABLE_IPV6 OFF
-        CACHE BOOL "Define if you want to enable IPv6 support" FORCE)
-  endif()
-
-  if(CMAKE_SYSTEM_NAME STREQUAL "Darwin" AND NOT ENABLE_ARES)
-    set(use_core_foundation ON)
-
-    find_library(SYSTEMCONFIGURATION_FRAMEWORK "SystemConfiguration")
-    if(NOT SYSTEMCONFIGURATION_FRAMEWORK)
-      message(FATAL_ERROR "SystemConfiguration framework not found")
-    endif()
-
-    list(APPEND CURL_LIBS "-framework SystemConfiguration")
-  endif()
+if(WINDOWS_STORE)
+  set(CURL_DISABLE_TELNET ON)  # telnet code needs fixing to compile for UWP.
 endif()
 
-if(USE_MANUAL)
-    #nroff is currently only used when USE_MANUAL is set, so we can prevent the warning of no *NROFF if USE_MANUAL is OFF (or not defined), by not even looking for NROFF..
-    curl_nroff_check()
-endif()
+option(CURL_LINT "Run lint checks while building" OFF)
+
 find_package(Perl)
 
-cmake_dependent_option(ENABLE_MANUAL "to provide the built-in manual"
-    ON "NROFF_USEFUL;PERL_FOUND"
-    OFF)
-
-if(ENABLE_MANUAL)
-  set(USE_MANUAL ON)
+if(PERL_EXECUTABLE)
+  add_custom_target(curl-ca-bundle
+    COMMENT "Generating a fresh ca-bundle.crt" VERBATIM USES_TERMINAL
+    COMMAND "${PERL_EXECUTABLE}" "${PROJECT_SOURCE_DIR}/scripts/mk-ca-bundle.pl" -b -l -u "lib/ca-bundle.crt"
+    DEPENDS "${PROJECT_SOURCE_DIR}/scripts/mk-ca-bundle.pl"
+  )
+  add_custom_target(curl-ca-firefox
+    COMMENT "Generating a fresh ca-bundle.crt" VERBATIM USES_TERMINAL
+    COMMAND "${PERL_EXECUTABLE}" "${PROJECT_SOURCE_DIR}/scripts/firefox-db2pem.sh" "lib/ca-bundle.crt"
+    DEPENDS "${PROJECT_SOURCE_DIR}/scripts/firefox-db2pem.sh"
+  )
+  add_custom_target(curl-lint
+    COMMENT "Running lint checks" VERBATIM USES_TERMINAL
+    WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}
+    COMMAND "${PERL_EXECUTABLE}" "${PROJECT_SOURCE_DIR}/scripts/badwords-all"
+    COMMAND "${PERL_EXECUTABLE}" "${PROJECT_SOURCE_DIR}/scripts/checksrc-all.pl"
+    COMMAND "${PERL_EXECUTABLE}" "${PROJECT_SOURCE_DIR}/scripts/spacecheck.pl"
+    DEPENDS
+      "${PROJECT_SOURCE_DIR}/scripts/badwords-all" "${PROJECT_SOURCE_DIR}/scripts/badwords"
+      "${PROJECT_SOURCE_DIR}/scripts/checksrc-all.pl" "${PROJECT_SOURCE_DIR}/scripts/checksrc.pl"
+      "${PROJECT_SOURCE_DIR}/scripts/spacecheck.pl"
+  )
+  if(CURL_LINT)
+    set_target_properties(curl-lint PROPERTIES EXCLUDE_FROM_ALL FALSE)
+  endif()
 endif()
 
-if(CURL_STATIC_CRT)
-  set(CMAKE_MSVC_RUNTIME_LIBRARY "MultiThreaded$<$<CONFIG:Debug>:Debug>")
-  set(CMAKE_C_FLAGS_RELEASE "${CMAKE_C_FLAGS_RELEASE} /MT")
-  set(CMAKE_C_FLAGS_DEBUG "${CMAKE_C_FLAGS_DEBUG} /MTd")
-endif()
+option(BUILD_LIBCURL_DOCS "Build libcurl man pages" ON)
+option(BUILD_MISC_DOCS "Build misc man pages (e.g. curl-config and mk-ca-bundle)" ON)
+option(ENABLE_CURL_MANUAL "Build the man page for curl and enable its -M/--manual option" ON)
 
-# Disable warnings on Borland to avoid changing 3rd party code.
-if(BORLAND)
-  set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -w-")
+if((ENABLE_CURL_MANUAL OR BUILD_LIBCURL_DOCS) AND NOT Perl_FOUND)
+  message(WARNING "Perl not found. Cannot build manuals.")
 endif()
 
 # If we are on AIX, do the _ALL_SOURCE magic
-if(${CMAKE_SYSTEM_NAME} MATCHES AIX)
-  set(_ALL_SOURCE 1)
+if(AIX OR CMAKE_SYSTEM_NAME STREQUAL "AIX")
+  set_property(DIRECTORY APPEND PROPERTY COMPILE_DEFINITIONS "_ALL_SOURCE")
 endif()
 
 # If we are on Haiku, make sure that the network library is brought in.
-if(${CMAKE_SYSTEM_NAME} MATCHES Haiku)
-  set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -lnetwork")
+if(CMAKE_SYSTEM_NAME STREQUAL "Haiku")
+  list(APPEND CURL_NETWORK_AND_TIME_LIBS "network")
+elseif(AMIGA)
+  list(APPEND CURL_NETWORK_AND_TIME_LIBS "net" "m" "atomic")
+  list(APPEND CMAKE_REQUIRED_LIBRARIES "net" "m" "atomic")
 endif()
 
 # Include all the necessary files for macros
@@ -358,341 +618,597 @@ include(CheckSymbolExists)
 include(CheckTypeSize)
 include(CheckCSourceCompiles)
 
-# On windows preload settings
-if(WIN32)
-  list(APPEND CMAKE_REQUIRED_DEFINITIONS -D_WINSOCKAPI_=)
-  include(${CMAKE_CURRENT_SOURCE_DIR}/CMake/Platforms/WindowsCache.cmake)
+option(_CURL_PREFILL "Fast-track known feature detection results (Windows, some Apple)" "${WIN32}")
+mark_as_advanced(_CURL_PREFILL)
+if(_CURL_PREFILL)
+  if(WIN32)
+    include("${CMAKE_CURRENT_SOURCE_DIR}/CMake/win32-cache.cmake")
+  elseif(UNIX)
+    include("${CMAKE_CURRENT_SOURCE_DIR}/CMake/unix-cache.cmake")
+    message(STATUS "Pre-filling feature detection results for UNIX")
+  endif()
+elseif(WIN32)
+  message(STATUS "Pre-filling feature detection results disabled.")
+elseif(APPLE)
+  set(HAVE_EVENTFD 0)
+  set(HAVE_GETPASS_R 0)
+  set(HAVE_WRITABLE_ARGV 1)
+  set(HAVE_SENDMMSG 0)
+endif()
+
+if(AMIGA)
+  set(HAVE_GETADDRINFO 0)  # Breaks the build when detected and used.
+endif()
+if(DOS OR AMIGA)
+  set(HAVE_TIME_T_UNSIGNED 1)
+endif()
+
+if(NOT WIN32)
+  find_package(Threads)
+  if(CMAKE_USE_PTHREADS_INIT)
+    set(HAVE_THREADS_POSIX 1)
+    list(APPEND CURL_NETWORK_AND_TIME_LIBS Threads::Threads)
+  endif()
 endif()
 
 if(ENABLE_THREADED_RESOLVER)
-  find_package(Threads REQUIRED)
-  if(WIN32)
-    set(USE_THREADS_WIN32 ON)
-  else()
-    set(USE_THREADS_POSIX ${CMAKE_USE_PTHREADS_INIT})
-    set(HAVE_PTHREAD_H ${CMAKE_USE_PTHREADS_INIT})
+  if(NOT WIN32 AND NOT HAVE_THREADS_POSIX)
+    message(FATAL_ERROR "Threaded resolver requires POSIX Threads.")
   endif()
-  set(CURL_LIBS ${CURL_LIBS} ${CMAKE_THREAD_LIBS_INIT})
+  set(USE_RESOLV_THREADED ON)
+elseif(USE_ARES)
+  set(USE_RESOLV_ARES ON)
 endif()
 
 # Check for all needed libraries
-check_library_exists_concat("socket" connect      HAVE_LIBSOCKET)
-
-check_function_exists(gethostname HAVE_GETHOSTNAME)
-
-if(WIN32)
-  list(APPEND CURL_LIBS "ws2_32")
-  if(USE_LIBRTMP)
-    list(APPEND CURL_LIBS "winmm")
+if(DOS)
+  if(WATT_ROOT)
+    set(USE_WATT32 ON)
+    # FIXME upstream: must specify the full path to avoid CMake converting "watt" to "watt.lib"
+    list(APPEND CURL_NETWORK_AND_TIME_LIBS "${WATT_ROOT}/lib/libwatt.a")
+    include_directories(SYSTEM "${WATT_ROOT}/inc")
+    list(APPEND CMAKE_REQUIRED_INCLUDES "${WATT_ROOT}/inc")
+  else()
+    message(FATAL_ERROR "Set WATT_ROOT variable to the absolute path to the root installation of Watt-32.")
   endif()
-
-  # Matching logic used for Curl_win32_random()
-  if(MINGW)
-    check_c_source_compiles("
-      #include <_mingw.h>
-      #if defined(__MINGW64_VERSION_MAJOR)
-      #error
-      #endif
-      int main(void) {
-        return 0;
-      }"
-      HAVE_MINGW_ORIGINAL)
+elseif(AMIGA)
+  if(AMISSL_INCLUDE_DIR AND AMISSL_STUBS_LIBRARY AND AMISSL_AUTO_LIBRARY)
+    set(USE_AMISSL ON)
+    list(APPEND CMAKE_REQUIRED_INCLUDES "${AMISSL_INCLUDE_DIR}")
+    list(APPEND CMAKE_REQUIRED_LIBRARIES "${AMISSL_STUBS_LIBRARY}" "${AMISSL_AUTO_LIBRARY}")
+    set(OPENSSL_INCLUDE_DIR "${AMISSL_INCLUDE_DIR}")
+    set(OPENSSL_SSL_LIBRARY "${AMISSL_STUBS_LIBRARY}")
+    set(OPENSSL_CRYPTO_LIBRARY "${AMISSL_AUTO_LIBRARY}")
+    set(CURL_USE_OPENSSL ON)
+    set(CURL_CA_FALLBACK ON CACHE BOOL "")
+    list(PREPEND CURL_NETWORK_AND_TIME_LIBS "${AMISSL_STUBS_LIBRARY}" "${AMISSL_AUTO_LIBRARY}")
+  endif()
+elseif(NOT WIN32 AND NOT APPLE)
+  check_library_exists("socket" "connect" "" HAVE_LIBSOCKET)
+  if(HAVE_LIBSOCKET)
+    list(PREPEND CURL_NETWORK_AND_TIME_LIBS "socket")
   endif()
 endif()
 
-# check SSL libraries
+option(ENABLE_IPV6 "Enable IPv6 support" ON)
+mark_as_advanced(ENABLE_IPV6)
+if(ENABLE_IPV6)
+  include(CheckStructHasMember)
+  if(WIN32)
+    check_struct_has_member("struct sockaddr_in6" "sin6_scope_id" "winsock2.h;ws2tcpip.h" HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID)
+  else()
+    check_struct_has_member("struct sockaddr_in6" "sin6_scope_id" "netinet/in.h" HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID)
+    check_struct_has_member("struct sockaddr_in6" "sin6_addr" "netinet/in.h" HAVE_SOCKADDR_IN6_SIN6_ADDR)
+    if(NOT HAVE_SOCKADDR_IN6_SIN6_ADDR)
+      if(NOT DOS AND NOT AMIGA)
+        message(WARNING "struct sockaddr_in6 not available, disabling IPv6 support")
+      endif()
+      set(ENABLE_IPV6 OFF CACHE BOOL "Enable IPv6 support" FORCE)  # Force the feature off as we use this name as guard macro
+    endif()
+
+    if(CMAKE_SYSTEM_NAME STREQUAL "Darwin" AND NOT ENABLE_ARES)
+      set(_use_core_foundation_and_core_services ON)
+
+      find_library(SYSTEMCONFIGURATION_FRAMEWORK NAMES "SystemConfiguration")
+      mark_as_advanced(SYSTEMCONFIGURATION_FRAMEWORK)
+      if(NOT SYSTEMCONFIGURATION_FRAMEWORK)
+        message(FATAL_ERROR "SystemConfiguration framework not found")
+      endif()
+      list(APPEND CURL_LIBS "-framework SystemConfiguration")
+    endif()
+  endif()
+endif()
+if(ENABLE_IPV6)
+  set(USE_IPV6 ON)
+endif()
+
+# Check SSL libraries
 option(CURL_ENABLE_SSL "Enable SSL support" ON)
 
-if(APPLE)
-  cmake_dependent_option(CURL_USE_SECTRANSP "Enable Apple OS native SSL/TLS" OFF CURL_ENABLE_SSL OFF)
+if(CURL_DEFAULT_SSL_BACKEND)
+  set(_valid_default_ssl_backend FALSE)
 endif()
+
 if(WIN32)
-  cmake_dependent_option(CURL_USE_SCHANNEL "Enable Windows native SSL/TLS" OFF CURL_ENABLE_SSL OFF)
-  cmake_dependent_option(CURL_WINDOWS_SSPI "Use windows libraries to allow NTLM authentication without OpenSSL" ON
-    CURL_USE_SCHANNEL OFF)
+  cmake_dependent_option(CURL_USE_SCHANNEL "Enable Windows native SSL/TLS (Schannel)" OFF CURL_ENABLE_SSL OFF)
+  option(CURL_WINDOWS_SSPI "Enable SSPI on Windows" ${CURL_USE_SCHANNEL})
+else()
+  set(CURL_USE_SCHANNEL OFF)
+  set(CURL_WINDOWS_SSPI OFF)
 endif()
 cmake_dependent_option(CURL_USE_MBEDTLS "Enable mbedTLS for SSL/TLS" OFF CURL_ENABLE_SSL OFF)
-cmake_dependent_option(CURL_USE_BEARSSL "Enable BearSSL for SSL/TLS" OFF CURL_ENABLE_SSL OFF)
 cmake_dependent_option(CURL_USE_WOLFSSL "Enable wolfSSL for SSL/TLS" OFF CURL_ENABLE_SSL OFF)
-cmake_dependent_option(CURL_USE_GNUTLS "Enable GNUTLS for SSL/TLS" OFF CURL_ENABLE_SSL OFF)
+cmake_dependent_option(CURL_USE_GNUTLS "Enable GnuTLS for SSL/TLS" OFF CURL_ENABLE_SSL OFF)
+cmake_dependent_option(CURL_USE_RUSTLS "Enable Rustls for SSL/TLS (experimental)" OFF CURL_ENABLE_SSL OFF)
 
-set(openssl_default ON)
-if(WIN32 OR CURL_USE_SECTRANSP OR CURL_USE_SCHANNEL OR CURL_USE_MBEDTLS OR CURL_USE_WOLFSSL)
-  set(openssl_default OFF)
+if(WIN32 OR
+   CURL_USE_SCHANNEL OR
+   CURL_USE_MBEDTLS OR
+   CURL_USE_WOLFSSL OR
+   CURL_USE_GNUTLS OR
+   CURL_USE_RUSTLS)
+  set(_openssl_default OFF)
+else()
+  set(_openssl_default ON)
 endif()
-cmake_dependent_option(CURL_USE_OPENSSL "Use OpenSSL code. Experimental" ${openssl_default} CURL_ENABLE_SSL OFF)
+cmake_dependent_option(CURL_USE_OPENSSL "Enable OpenSSL for SSL/TLS" ${_openssl_default} CURL_ENABLE_SSL OFF)
 option(CURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG "Disable automatic loading of OpenSSL configuration" OFF)
 
-count_true(enabled_ssl_options_count
+curl_count_true(_enabled_ssl_options_count
   CURL_USE_SCHANNEL
-  CURL_USE_SECTRANSP
   CURL_USE_OPENSSL
   CURL_USE_MBEDTLS
-  CURL_USE_BEARSSL
   CURL_USE_WOLFSSL
+  CURL_USE_GNUTLS
+  CURL_USE_RUSTLS
 )
-if(enabled_ssl_options_count GREATER "1")
+if(_enabled_ssl_options_count GREATER 1)
   set(CURL_WITH_MULTI_SSL ON)
+elseif(_enabled_ssl_options_count EQUAL 0)
+  set(CURL_DISABLE_HSTS ON)
 endif()
 
 if(CURL_USE_SCHANNEL)
-  set(SSL_ENABLED ON)
-  set(USE_SCHANNEL ON) # Windows native SSL/TLS support
-  set(USE_WINDOWS_SSPI ON) # CURL_USE_SCHANNEL implies CURL_WINDOWS_SSPI
+  if(WINDOWS_STORE)
+    message(FATAL_ERROR "UWP does not support Schannel.")
+  endif()
+  set(_ssl_enabled ON)
+  set(USE_SCHANNEL ON)  # Windows native SSL/TLS support
+  set(USE_WINDOWS_SSPI ON)  # CURL_USE_SCHANNEL requires CURL_WINDOWS_SSPI
+
+  if(CURL_DEFAULT_SSL_BACKEND AND CURL_DEFAULT_SSL_BACKEND STREQUAL "schannel")
+    set(_valid_default_ssl_backend TRUE)
+  endif()
 endif()
-if(CURL_WINDOWS_SSPI)
+if(CURL_WINDOWS_SSPI AND NOT WINDOWS_STORE)
   set(USE_WINDOWS_SSPI ON)
 endif()
 
-if(CURL_USE_SECTRANSP)
-  set(use_core_foundation ON)
+if(APPLE)
+  option(USE_APPLE_SECTRUST "Use Apple OS-native certificate verification" OFF)
+  if(USE_APPLE_SECTRUST)
+    if(NOT CURL_USE_OPENSSL AND NOT CURL_USE_GNUTLS)
+      message(FATAL_ERROR "Apple SecTrust is only supported with Openssl/GnuTLS")
+    endif()
+    find_library(SECURITY_FRAMEWORK NAMES "Security")
+    mark_as_advanced(SECURITY_FRAMEWORK)
+    if(NOT SECURITY_FRAMEWORK)
+      message(FATAL_ERROR "Security framework not found")
+    endif()
+    list(APPEND CURL_LIBS "-framework Security")
 
-  find_library(SECURITY_FRAMEWORK "Security")
-  if(NOT SECURITY_FRAMEWORK)
-     message(FATAL_ERROR "Security framework not found")
+    set(_use_core_foundation_and_core_services ON)
+    message(STATUS "Apple OS-native certificate verification enabled")
   endif()
-
-  set(SSL_ENABLED ON)
-  set(USE_SECTRANSP ON)
-  list(APPEND CURL_LIBS "-framework Security")
+else()
+  set(USE_APPLE_SECTRUST OFF)
 endif()
 
-if(use_core_foundation)
-  find_library(COREFOUNDATION_FRAMEWORK "CoreFoundation")
+if(_use_core_foundation_and_core_services)
+  find_library(COREFOUNDATION_FRAMEWORK NAMES "CoreFoundation")
+  mark_as_advanced(COREFOUNDATION_FRAMEWORK)
   if(NOT COREFOUNDATION_FRAMEWORK)
-      message(FATAL_ERROR "CoreFoundation framework not found")
+    message(FATAL_ERROR "CoreFoundation framework not found")
   endif()
-
   list(APPEND CURL_LIBS "-framework CoreFoundation")
+
+  find_library(CORESERVICES_FRAMEWORK NAMES "CoreServices")
+  mark_as_advanced(CORESERVICES_FRAMEWORK)
+  if(NOT CORESERVICES_FRAMEWORK)
+    message(FATAL_ERROR "CoreServices framework not found")
+  endif()
+  list(APPEND CURL_LIBS "-framework CoreServices")
 endif()
 
 if(CURL_USE_OPENSSL)
   find_package(OpenSSL REQUIRED)
-  set(SSL_ENABLED ON)
+  set(_ssl_enabled ON)
   set(USE_OPENSSL ON)
 
-  # Depend on OpenSSL via imported targets if supported by the running
-  # version of CMake.  This allows our dependents to get our dependencies
-  # transitively.
-  if(NOT CMAKE_VERSION VERSION_LESS 3.4)
-    list(APPEND CURL_LIBS OpenSSL::SSL OpenSSL::Crypto)
-  else()
-    list(APPEND CURL_LIBS ${OPENSSL_LIBRARIES})
-    include_directories(${OPENSSL_INCLUDE_DIR})
-  endif()
+  # Depend on OpenSSL via imported targets. This allows our dependents to
+  # get our dependencies transitively.
+  list(APPEND CURL_LIBS OpenSSL::SSL OpenSSL::Crypto)
 
-  if(WIN32)
-    list(APPEND CURL_LIBS "ws2_32")
-    if(NOT HAVE_MINGW_ORIGINAL)
-      list(APPEND CURL_LIBS "bcrypt")  # for OpenSSL/LibreSSL
+  if(CURL_DEFAULT_SSL_BACKEND AND CURL_DEFAULT_SSL_BACKEND STREQUAL "openssl")
+    set(_valid_default_ssl_backend TRUE)
+  endif()
+  set(_curl_ca_bundle_supported TRUE)
+
+  cmake_push_check_state()
+  list(APPEND CMAKE_REQUIRED_LIBRARIES OpenSSL::SSL OpenSSL::Crypto)
+  if(NOT DEFINED HAVE_AWSLC)
+    check_symbol_exists("OPENSSL_IS_AWSLC" "openssl/base.h" HAVE_AWSLC)
+  endif()
+  if(NOT DEFINED HAVE_BORINGSSL)
+    check_symbol_exists("OPENSSL_IS_BORINGSSL" "openssl/base.h" HAVE_BORINGSSL)
+  endif()
+  if(NOT DEFINED HAVE_LIBRESSL)
+    check_symbol_exists("LIBRESSL_VERSION_NUMBER" "openssl/opensslv.h" HAVE_LIBRESSL)
+  endif()
+  cmake_pop_check_state()
+
+  if(HAVE_AWSLC OR HAVE_BORINGSSL)
+    if(NOT MSVC AND NOT ANDROID)  # AWS-LC/BoringSSL MSVC builds use native Windows threads
+      find_package(Threads)
+      if(CMAKE_USE_PTHREADS_INIT)
+        set(HAVE_THREADS_POSIX_BORINGSSL 1)
+        list(APPEND CURL_NETWORK_AND_TIME_LIBS Threads::Threads)
+        list(APPEND CMAKE_REQUIRED_LIBRARIES Threads::Threads)
+      elseif(OPENSSL_USE_STATIC_LIBS)
+        message(WARNING "AWS-LC/BoringSSL requires POSIX Threads.")
+      endif()
+    endif()
+    if(OPENSSL_USE_STATIC_LIBS AND CMAKE_C_COMPILER_ID MATCHES "Clang")
+      list(APPEND CURL_LIBS "stdc++")
+      list(APPEND CMAKE_REQUIRED_LIBRARIES "stdc++")
     endif()
   endif()
 
-  set(CMAKE_REQUIRED_INCLUDES ${OPENSSL_INCLUDE_DIR})
-  if(NOT DEFINED HAVE_BORINGSSL)
-    check_symbol_exists(OPENSSL_IS_BORINGSSL "openssl/base.h" HAVE_BORINGSSL)
-  endif()
-  if(NOT DEFINED HAVE_AWSLC)
-    check_symbol_exists(OPENSSL_IS_AWSLC "openssl/base.h" HAVE_AWSLC)
+  if(USE_AMISSL)
+    set(_openssl "AmiSSL")
+  elseif(HAVE_AWSLC)
+    set(_openssl "AWS-LC")
+  elseif(HAVE_BORINGSSL)
+    if(BORINGSSL_VERSION)
+      set(CURL_BORINGSSL_VERSION "\"${BORINGSSL_VERSION}\"")
+    endif()
+    set(_openssl "BoringSSL")
+  elseif(HAVE_LIBRESSL)
+    set(_openssl "LibreSSL")
+  else()
+    set(_openssl "OpenSSL")
   endif()
 endif()
 
 if(CURL_USE_MBEDTLS)
-  find_package(MbedTLS REQUIRED)
-  set(SSL_ENABLED ON)
+  find_package(MbedTLS MODULE REQUIRED)
+  if(MBEDTLS_VERSION VERSION_LESS 3.2.0)
+    message(FATAL_ERROR "mbedTLS v3.2.0 or newer is required.")
+  endif()
+  set(_ssl_enabled ON)
   set(USE_MBEDTLS ON)
-  list(APPEND CURL_LIBS ${MBEDTLS_LIBRARIES})
-  include_directories(${MBEDTLS_INCLUDE_DIRS})
-endif()
+  list(APPEND CURL_LIBS CURL::mbedtls)
 
-if(CURL_USE_BEARSSL)
-  find_package(BearSSL REQUIRED)
-  set(SSL_ENABLED ON)
-  set(USE_BEARSSL ON)
-  list(APPEND CURL_LIBS ${BEARSSL_LIBRARY})
-  include_directories(${BEARSSL_INCLUDE_DIRS})
+  if(CURL_DEFAULT_SSL_BACKEND AND CURL_DEFAULT_SSL_BACKEND STREQUAL "mbedtls")
+    set(_valid_default_ssl_backend TRUE)
+  endif()
+  set(_curl_ca_bundle_supported TRUE)
+
+  if(MBEDTLS_VERSION VERSION_GREATER_EQUAL 4.0.0)
+    set(HAVE_MBEDTLS_DES_CRYPT_ECB 0)  # pre-fill detection result
+  endif()
+  if(NOT DEFINED HAVE_MBEDTLS_DES_CRYPT_ECB)
+    cmake_push_check_state()
+    list(APPEND CMAKE_REQUIRED_LIBRARIES CURL::mbedtls)
+    check_function_exists("mbedtls_des_crypt_ecb" HAVE_MBEDTLS_DES_CRYPT_ECB)  # in mbedTLS <4
+    cmake_pop_check_state()
+  endif()
 endif()
 
 if(CURL_USE_WOLFSSL)
-  find_package(WolfSSL REQUIRED)
-  set(SSL_ENABLED ON)
+  find_package(WolfSSL MODULE REQUIRED)
+  set(_ssl_enabled ON)
   set(USE_WOLFSSL ON)
-  list(APPEND CURL_LIBS ${WolfSSL_LIBRARIES})
-  include_directories(${WolfSSL_INCLUDE_DIRS})
+  list(APPEND CURL_LIBS CURL::wolfssl)
+
+  if(CURL_DEFAULT_SSL_BACKEND AND CURL_DEFAULT_SSL_BACKEND STREQUAL "wolfssl")
+    set(_valid_default_ssl_backend TRUE)
+  endif()
+  set(_curl_ca_bundle_supported TRUE)
+
+  if(USE_OPENSSL AND WOLFSSL_VERSION VERSION_LESS 5.7.6)
+    message(FATAL_ERROR "wolfSSL 5.7.6 or newer is required to coexist with OpenSSL.")
+  endif()
+
+  set_property(DIRECTORY APPEND PROPERTY COMPILE_DEFINITIONS "WOLFSSL_OPTIONS_IGNORE_SYS")
 endif()
 
 if(CURL_USE_GNUTLS)
-   set(SSL_ENABLED ON)
-   set(USE_GNUTLS ON)
+  find_package(GnuTLS MODULE REQUIRED)
+  list(APPEND CURL_LIBS CURL::gnutls)
+  find_package(Nettle MODULE REQUIRED)
+  list(APPEND CURL_LIBS CURL::nettle)
+  set(_ssl_enabled ON)
+  set(USE_GNUTLS ON)
+
+  if(CURL_DEFAULT_SSL_BACKEND AND CURL_DEFAULT_SSL_BACKEND STREQUAL "gnutls")
+    set(_valid_default_ssl_backend TRUE)
+  endif()
+  set(_curl_ca_bundle_supported TRUE)
+
+  if(NOT DEFINED HAVE_GNUTLS_SRP AND NOT CURL_DISABLE_SRP)
+    cmake_push_check_state()
+    list(APPEND CMAKE_REQUIRED_LIBRARIES CURL::gnutls)
+    # In GnuTLS 3.8.0 (2023-02-10) and upper, this check always succeeds.
+    # Detecting actual TLS-SRP support needs poking the API at runtime.
+    check_symbol_exists("gnutls_srp_verifier" "gnutls/gnutls.h" HAVE_GNUTLS_SRP)
+    cmake_pop_check_state()
+  endif()
+endif()
+
+if(CURL_USE_RUSTLS)
+  find_package(Rustls MODULE REQUIRED)
+  set(_ssl_enabled ON)
+  set(USE_RUSTLS ON)
+  list(APPEND CURL_LIBS CURL::rustls)
+
+  if(NOT DEFINED HAVE_RUSTLS_SUPPORTED_HPKE)
+    if(RUSTLS_VERSION AND RUSTLS_VERSION VERSION_GREATER_EQUAL 0.15)
+      set(HAVE_RUSTLS_SUPPORTED_HPKE TRUE)
+    elseif(NOT RUSTLS_VERSION)
+      cmake_push_check_state()
+      list(APPEND CMAKE_REQUIRED_LIBRARIES CURL::rustls)
+      check_symbol_exists("rustls_supported_hpke" "rustls.h" HAVE_RUSTLS_SUPPORTED_HPKE)
+      cmake_pop_check_state()
+    endif()
+  endif()
+  if(NOT HAVE_RUSTLS_SUPPORTED_HPKE)
+    message(FATAL_ERROR "rustls-ffi library does not provide rustls_supported_hpke function. Required version is 0.15 or newer.")
+  endif()
+
+  if(CURL_DEFAULT_SSL_BACKEND AND CURL_DEFAULT_SSL_BACKEND STREQUAL "rustls")
+    set(_valid_default_ssl_backend TRUE)
+  endif()
+  set(_curl_ca_bundle_supported TRUE)
+endif()
+
+if(CURL_DEFAULT_SSL_BACKEND AND NOT _valid_default_ssl_backend)
+  message(FATAL_ERROR "CURL_DEFAULT_SSL_BACKEND '${CURL_DEFAULT_SSL_BACKEND}' not enabled.")
 endif()
 
 # Keep ZLIB detection after TLS detection,
-# and before calling openssl_check_symbol_exists().
+# and before calling curl_openssl_check_exists().
 
 set(HAVE_LIBZ OFF)
-set(USE_ZLIB OFF)
-optional_dependency(ZLIB)
+curl_dependency_option(CURL_ZLIB ZLIB "ZLIB")
 if(ZLIB_FOUND)
   set(HAVE_LIBZ ON)
-  set(USE_ZLIB ON)
-
-  # Depend on ZLIB via imported targets if supported by the running
-  # version of CMake.  This allows our dependents to get our dependencies
-  # transitively.
-  if(NOT CMAKE_VERSION VERSION_LESS 3.4)
-    list(APPEND CURL_LIBS ZLIB::ZLIB)
-  else()
-    list(APPEND CURL_LIBS ${ZLIB_LIBRARIES})
-    include_directories(${ZLIB_INCLUDE_DIRS})
-  endif()
-  list(APPEND CMAKE_REQUIRED_INCLUDES ${ZLIB_INCLUDE_DIRS})
+  # Depend on ZLIB via imported targets. This allows our dependents to
+  # get our dependencies transitively.
+  list(APPEND CURL_LIBS ZLIB::ZLIB)
 endif()
 
-option(CURL_BROTLI "Set to ON to enable building curl with brotli support." OFF)
 set(HAVE_BROTLI OFF)
-if(CURL_BROTLI)
-  find_package(Brotli REQUIRED)
-  if(BROTLI_FOUND)
-    set(HAVE_BROTLI ON)
-    set(CURL_LIBS "${BROTLI_LIBRARIES};${CURL_LIBS}")  # For 'ld' linker. Emulate `list(PREPEND ...)` to stay compatible with <v3.15 CMake.
-    list(APPEND CURL_LIBS ${BROTLI_LIBRARIES})
-    include_directories(${BROTLI_INCLUDE_DIRS})
-    list(APPEND CMAKE_REQUIRED_INCLUDES ${BROTLI_INCLUDE_DIRS})
-  endif()
+curl_dependency_option(CURL_BROTLI Brotli "brotli")
+if(BROTLI_FOUND)
+  set(HAVE_BROTLI ON)
+  list(APPEND CURL_LIBS CURL::brotli)
 endif()
 
-option(CURL_ZSTD "Set to ON to enable building curl with zstd support." OFF)
 set(HAVE_ZSTD OFF)
-if(CURL_ZSTD)
-  find_package(Zstd REQUIRED)
-  if (NOT DEFINED HAVE_ZSTD_CREATEDSTREAM)
-    cmake_push_check_state()
-    set(CMAKE_REQUIRED_INCLUDES ${Zstd_INCLUDE_DIRS})
-    set(CMAKE_REQUIRED_LIBRARIES ${Zstd_LIBRARIES})
-    check_symbol_exists(ZSTD_createDStream "zstd.h" HAVE_ZSTD_CREATEDSTREAM)
-    cmake_pop_check_state()
-  endif()
-  if(Zstd_FOUND AND HAVE_ZSTD_CREATEDSTREAM)
+curl_dependency_option(CURL_ZSTD Zstd "zstd")
+if(ZSTD_FOUND)
+  if(ZSTD_VERSION VERSION_GREATER_EQUAL 1.0.0)
     set(HAVE_ZSTD ON)
-    list(APPEND CURL_LIBS ${Zstd_LIBRARIES})
-    include_directories(${Zstd_INCLUDE_DIRS})
+    list(APPEND CURL_LIBS CURL::zstd)
+  else()
+    message(WARNING "zstd v1.0.0 or newer is required, disabling zstd support.")
   endif()
 endif()
 
-# Check symbol in OpenSSL-like TLS backends.
-macro(openssl_check_symbol_exists SYMBOL FILES VARIABLE)
+# Check function in an OpenSSL-like TLS backend.
+macro(curl_openssl_check_exists)
   cmake_push_check_state()
   if(USE_OPENSSL)
-    set(CMAKE_REQUIRED_INCLUDES   "${OPENSSL_INCLUDE_DIR}")
-    set(CMAKE_REQUIRED_LIBRARIES  "${OPENSSL_LIBRARIES}")
+    list(APPEND CMAKE_REQUIRED_LIBRARIES OpenSSL::SSL OpenSSL::Crypto)
+    list(APPEND CMAKE_REQUIRED_DEFINITIONS "-DOPENSSL_SUPPRESS_DEPRECATED")  # for SSL_CTX_set_srp_username deprecated since 3.0.0
     if(HAVE_LIBZ)
-      list(APPEND CMAKE_REQUIRED_LIBRARIES "${ZLIB_LIBRARIES}")
+      list(APPEND CMAKE_REQUIRED_LIBRARIES ZLIB::ZLIB)
     endif()
     if(WIN32)
-      list(APPEND CMAKE_REQUIRED_LIBRARIES "ws2_32")
-      if(NOT HAVE_MINGW_ORIGINAL)
-        list(APPEND CMAKE_REQUIRED_LIBRARIES "bcrypt")  # for OpenSSL/LibreSSL
-      endif()
+      list(APPEND CMAKE_REQUIRED_LIBRARIES "bcrypt")  # for OpenSSL/LibreSSL BCryptGenRandom()
     endif()
-  elseif(USE_WOLFSSL)
-    set(CMAKE_REQUIRED_INCLUDES   "${WolfSSL_INCLUDE_DIRS}")
-    set(CMAKE_REQUIRED_LIBRARIES  "${WolfSSL_LIBRARIES}")
-    if(HAVE_LIBZ)
-      list(APPEND CMAKE_REQUIRED_INCLUDES  "${ZLIB_INCLUDE_DIRS}")  # Public wolfSSL headers require zlib headers
-      list(APPEND CMAKE_REQUIRED_LIBRARIES "${ZLIB_LIBRARIES}")
-    endif()
-    if(WIN32)
-      list(APPEND CMAKE_REQUIRED_LIBRARIES "ws2_32" "crypt32")
-    endif()
-    list(APPEND CMAKE_REQUIRED_DEFINITIONS -DHAVE_UINTPTR_T)  # to pull in stdint.h (as of wolfSSL v5.5.4)
   endif()
-  check_symbol_exists("${SYMBOL}" "${FILES}" "${VARIABLE}")
+  if(USE_WOLFSSL)
+    list(APPEND CMAKE_REQUIRED_LIBRARIES CURL::wolfssl)
+    list(APPEND CMAKE_REQUIRED_DEFINITIONS "-DWOLFSSL_OPTIONS_IGNORE_SYS")
+    if(HAVE_LIBZ)
+      list(APPEND CMAKE_REQUIRED_LIBRARIES ZLIB::ZLIB)  # Public wolfSSL headers also require zlib headers
+    endif()
+    list(APPEND CMAKE_REQUIRED_DEFINITIONS "-DHAVE_UINTPTR_T")  # to pull in stdint.h (as of wolfSSL v5.5.4)
+  endif()
+  if(WIN32)
+    list(APPEND CMAKE_REQUIRED_LIBRARIES "ws2_32" "crypt32")  # for OpenSSL/wolfSSL
+  endif()
+  if(${ARGC} EQUAL 2)
+    check_function_exists(${ARGN})
+  else()
+    check_symbol_exists(${ARGN})  # Uses CMAKE_REQUIRED_INCLUDES and CMAKE_REQUIRED_DEFINITIONS
+  endif()
   cmake_pop_check_state()
 endmacro()
 
-if(USE_OPENSSL OR USE_WOLFSSL)
+# Ensure that OpenSSL (or fork) or wolfSSL actually supports QUICTLS API.
+macro(curl_openssl_check_quic)
+  if(USE_OPENSSL)
+    if(OPENSSL_VERSION VERSION_GREATER_EQUAL 3.5.0)
+      if(NOT DEFINED HAVE_SSL_SET_QUIC_TLS_CBS)
+        curl_openssl_check_exists("SSL_set_quic_tls_cbs" HAVE_SSL_SET_QUIC_TLS_CBS)
+      endif()
+    else()
+      if(NOT DEFINED HAVE_SSL_SET_QUIC_USE_LEGACY_CODEPOINT)
+        curl_openssl_check_exists("SSL_set_quic_use_legacy_codepoint" HAVE_SSL_SET_QUIC_USE_LEGACY_CODEPOINT)
+      endif()
+    endif()
+  endif()
+  if(USE_WOLFSSL AND NOT DEFINED HAVE_WOLFSSL_SET_QUIC_USE_LEGACY_CODEPOINT)
+    curl_openssl_check_exists("wolfSSL_set_quic_use_legacy_codepoint" HAVE_WOLFSSL_SET_QUIC_USE_LEGACY_CODEPOINT)
+  endif()
+  if(NOT HAVE_SSL_SET_QUIC_TLS_CBS AND
+     NOT HAVE_SSL_SET_QUIC_USE_LEGACY_CODEPOINT AND
+     NOT HAVE_WOLFSSL_SET_QUIC_USE_LEGACY_CODEPOINT)
+    message(FATAL_ERROR "QUICTLS API support is missing from OpenSSL/fork/wolfSSL. Try setting -DOPENSSL_ROOT_DIR")
+  endif()
+endmacro()
+
+if(USE_WOLFSSL)
+  curl_openssl_check_exists("wolfSSL_get_peer_certificate" HAVE_WOLFSSL_GET_PEER_CERTIFICATE)
+  curl_openssl_check_exists("wolfSSL_UseALPN" HAVE_WOLFSSL_USEALPN)
+  curl_openssl_check_exists("wolfSSL_BIO_new" HAVE_WOLFSSL_BIO_NEW)
+  curl_openssl_check_exists("wolfSSL_BIO_set_shutdown" HAVE_WOLFSSL_BIO_SET_SHUTDOWN)
+  curl_openssl_check_exists("wc_Des_EcbEncrypt" HAVE_WC_DES_ECBENCRYPT)
+endif()
+
+if(USE_OPENSSL)
+  if(NOT DEFINED HAVE_DES_ECB_ENCRYPT)
+    curl_openssl_check_exists("DES_ecb_encrypt" "openssl/des.h" HAVE_DES_ECB_ENCRYPT)
+  endif()
   if(NOT DEFINED HAVE_SSL_SET0_WBIO)
-    openssl_check_symbol_exists(SSL_set0_wbio "openssl/ssl.h" HAVE_SSL_SET0_WBIO)
+    curl_openssl_check_exists("SSL_set0_wbio" HAVE_SSL_SET0_WBIO)
+  endif()
+  if(NOT DEFINED HAVE_OPENSSL_SRP AND NOT CURL_DISABLE_SRP)
+    curl_openssl_check_exists("SSL_CTX_set_srp_username" "openssl/ssl.h" HAVE_OPENSSL_SRP)
   endif()
 endif()
 
-option(USE_NGHTTP2 "Use nghttp2 library" OFF)
+option(USE_HTTPSRR "Enable HTTPS RR support (experimental)" OFF)
+option(USE_ECH "Enable ECH support (experimental)" OFF)
+if(USE_ECH)
+  if(USE_OPENSSL OR USE_WOLFSSL OR USE_RUSTLS)
+    # Be sure that the TLS library actually supports ECH.
+    if(USE_WOLFSSL)
+      curl_openssl_check_exists("wolfSSL_CTX_GenerateEchConfig" HAVE_WOLFSSL_CTX_GENERATEECHCONFIG)
+    endif()
+    if(USE_OPENSSL)
+      curl_openssl_check_exists("SSL_set1_ech_config_list" HAVE_SSL_SET1_ECH_CONFIG_LIST)
+    endif()
+    if(HAVE_WOLFSSL_CTX_GENERATEECHCONFIG OR
+       HAVE_SSL_SET1_ECH_CONFIG_LIST OR
+       USE_RUSTLS)
+      set(HAVE_ECH 1)
+    endif()
+    if(NOT HAVE_ECH)
+      message(FATAL_ERROR "ECH support missing in AWS-LC/BoringSSL/OpenSSL/Rustls/wolfSSL")
+    else()
+      message(STATUS "ECH enabled")
+      # ECH wants HTTPSRR
+      set(USE_HTTPSRR ON)
+      message(STATUS "HTTPSRR enabled")
+    endif()
+  else()
+    message(FATAL_ERROR "ECH requires ECH-enabled AWS-LC, BoringSSL, OpenSSL, Rustls or wolfSSL")
+  endif()
+endif()
+
+option(USE_SSLS_EXPORT "Enable SSL session import/export (experimental)" OFF)
+if(USE_SSLS_EXPORT)
+  if(_ssl_enabled)
+    message(STATUS "SSL export enabled.")
+  else()
+    message(WARNING "SSL session export requires SSL enabled")
+  endif()
+endif()
+
+option(USE_PROXY_HTTP3 "Enable HTTP/3 proxy support (experimental)" OFF)
+
+option(USE_NGHTTP2 "Use nghttp2 library" ON)
 if(USE_NGHTTP2)
-  find_package(NGHTTP2 REQUIRED)
-  include_directories(${NGHTTP2_INCLUDE_DIRS})
-  list(APPEND CURL_LIBS ${NGHTTP2_LIBRARIES})
+  find_package(NGHTTP2 MODULE)
+  if(NGHTTP2_FOUND)
+    list(APPEND CURL_LIBS CURL::nghttp2)
+  else()
+    set(USE_NGHTTP2 OFF)
+  endif()
 endif()
 
 option(USE_NGTCP2 "Use ngtcp2 and nghttp3 libraries for HTTP/3 support" OFF)
 if(USE_NGTCP2)
-  if(USE_OPENSSL OR USE_WOLFSSL)
+  if(CURL_WITH_MULTI_SSL)
+    message(FATAL_ERROR "MultiSSL cannot be enabled with HTTP/3 and vice versa.")
+  elseif(USE_OPENSSL OR USE_WOLFSSL)
     if(USE_WOLFSSL)
-      find_package(NGTCP2 REQUIRED wolfSSL)
-    elseif(HAVE_BORINGSSL)
-      find_package(NGTCP2 REQUIRED BoringSSL)
-    else()
-      find_package(NGTCP2 REQUIRED quictls)
-    endif()
-
-    # Be sure that the OpenSSL/wolfSSL library actually supports QUIC.
-    if(NOT DEFINED HAVE_SSL_CTX_SET_QUIC_METHOD)
-      if(USE_OPENSSL)
-        openssl_check_symbol_exists(SSL_CTX_set_quic_method "openssl/ssl.h" HAVE_SSL_CTX_SET_QUIC_METHOD)
-      elseif(USE_WOLFSSL)
-        openssl_check_symbol_exists(wolfSSL_set_quic_method "wolfssl/options.h;wolfssl/openssl/ssl.h" HAVE_SSL_CTX_SET_QUIC_METHOD)
+      find_package(NGTCP2 MODULE REQUIRED COMPONENTS "wolfSSL")
+    elseif(HAVE_BORINGSSL OR HAVE_AWSLC)
+      find_package(NGTCP2 MODULE REQUIRED COMPONENTS "BoringSSL")
+    elseif(OPENSSL_VERSION VERSION_GREATER_EQUAL 3.5.0)
+      find_package(NGTCP2 MODULE REQUIRED COMPONENTS "ossl")
+      if(NGTCP2_VERSION VERSION_LESS 1.12.0)
+        message(FATAL_ERROR "ngtcp2 1.12.0 or upper required for OpenSSL")
       endif()
+      set(OPENSSL_QUIC_API2 1)
+    elseif(HAVE_LIBRESSL)
+      find_package(NGTCP2 MODULE COMPONENTS "LibreSSL")
+      if(NOT NGTCP2_FOUND)
+        find_package(NGTCP2 MODULE REQUIRED COMPONENTS "quictls")  # for ngtcp2 <1.15.0
+      endif()
+    else()
+      find_package(NGTCP2 MODULE REQUIRED COMPONENTS "quictls")
+      set(_openssl "quictls")
     endif()
-    if(NOT HAVE_SSL_CTX_SET_QUIC_METHOD)
-      message(FATAL_ERROR "QUIC support is missing in OpenSSL/LibreSSL/BoringSSL/wolfSSL. Try setting -DOPENSSL_ROOT_DIR")
-    endif()
-
+    curl_openssl_check_quic()
   elseif(USE_GNUTLS)
-    # TODO add GnuTLS support as vtls library.
-    find_package(NGTCP2 REQUIRED GnuTLS)
+    find_package(NGTCP2 MODULE REQUIRED "GnuTLS")
   else()
-    message(FATAL_ERROR "ngtcp2 requires OpenSSL, wolfSSL or GnuTLS")
+    message(FATAL_ERROR "ngtcp2 requires a supported TLS-backend")
   endif()
-  set(USE_NGTCP2 ON)
-  include_directories(${NGTCP2_INCLUDE_DIRS})
-  list(APPEND CURL_LIBS ${NGTCP2_LIBRARIES})
+  list(APPEND CURL_LIBS CURL::ngtcp2)
 
-  find_package(NGHTTP3 REQUIRED)
+  find_package(NGHTTP3 MODULE REQUIRED)
   set(USE_NGHTTP3 ON)
-  include_directories(${NGHTTP3_INCLUDE_DIRS})
-  list(APPEND CURL_LIBS ${NGHTTP3_LIBRARIES})
+  list(APPEND CURL_LIBS CURL::nghttp3)
 endif()
 
-option(USE_QUICHE "Use quiche library for HTTP/3 support" OFF)
+option(USE_QUICHE "Use quiche library for HTTP/3 support (experimental)" OFF)
 if(USE_QUICHE)
   if(USE_NGTCP2)
-    message(FATAL_ERROR "Only one HTTP/3 backend can be selected!")
+    message(FATAL_ERROR "Only one HTTP/3 backend can be selected")
+  elseif(CURL_WITH_MULTI_SSL)
+    message(FATAL_ERROR "MultiSSL cannot be enabled with HTTP/3 and vice versa.")
   endif()
-  find_package(QUICHE REQUIRED)
-  CheckQuicSupportInOpenSSL()
-  set(USE_QUICHE ON)
-  include_directories(${QUICHE_INCLUDE_DIRS})
-  list(APPEND CURL_LIBS ${QUICHE_LIBRARIES})
+  find_package(Quiche MODULE REQUIRED)
+  if(NOT HAVE_BORINGSSL)
+    message(FATAL_ERROR "quiche requires BoringSSL")
+  endif()
+  curl_openssl_check_quic()
+  list(APPEND CURL_LIBS CURL::quiche)
   if(NOT DEFINED HAVE_QUICHE_CONN_SET_QLOG_FD)
     cmake_push_check_state()
-    set(CMAKE_REQUIRED_INCLUDES   "${QUICHE_INCLUDE_DIRS}")
-    set(CMAKE_REQUIRED_LIBRARIES  "${QUICHE_LIBRARIES}")
-    check_symbol_exists(quiche_conn_set_qlog_fd "quiche.h" HAVE_QUICHE_CONN_SET_QLOG_FD)
+    list(APPEND CMAKE_REQUIRED_LIBRARIES CURL::quiche)
+    check_symbol_exists("quiche_conn_set_qlog_fd" "quiche.h" HAVE_QUICHE_CONN_SET_QLOG_FD)
     cmake_pop_check_state()
   endif()
 endif()
 
-option(USE_MSH3 "Use msquic library for HTTP/3 support" OFF)
-if(USE_MSH3)
-  if(USE_NGTCP2 OR USE_QUICHE)
-    message(FATAL_ERROR "Only one HTTP/3 backend can be selected!")
+if(USE_PROXY_HTTP3)
+  if(CURL_DISABLE_PROXY)
+    message(FATAL_ERROR "USE_PROXY_HTTP3 requires proxy support")
+  elseif(CURL_DISABLE_HTTP)
+    message(FATAL_ERROR "USE_PROXY_HTTP3 requires HTTP support")
+  elseif(NOT USE_NGTCP2 OR NOT USE_NGHTTP3)
+    message(FATAL_ERROR "USE_PROXY_HTTP3 requires ngtcp2 + nghttp3")
+  elseif(NOT USE_OPENSSL)
+    message(FATAL_ERROR "USE_PROXY_HTTP3 currently requires OpenSSL")
+  else()
+    message(STATUS "HTTP/3 proxy support enabled (experimental)")
   endif()
-  set(USE_MSH3 ON)
-  include_directories(${MSH3_INCLUDE_DIRS})
-  list(APPEND CURL_LIBS ${MSH3_LIBRARIES})
+endif()
+
+if(NOT CURL_DISABLE_SRP AND (HAVE_GNUTLS_SRP OR HAVE_OPENSSL_SRP))
+  set(USE_TLS_SRP 1)
 endif()
 
 if(NOT CURL_DISABLE_LDAP)
-  if(WIN32)
+  if(WIN32 AND NOT WINDOWS_STORE)
     option(USE_WIN32_LDAP "Use Windows LDAP implementation" ON)
     if(USE_WIN32_LDAP)
       list(APPEND CURL_LIBS "wldap32")
@@ -702,85 +1218,39 @@ if(NOT CURL_DISABLE_LDAP)
     endif()
   endif()
 
-  option(CURL_USE_OPENLDAP "Use OpenLDAP code." OFF)
-  mark_as_advanced(CURL_USE_OPENLDAP)
-  set(CMAKE_LDAP_LIB "ldap" CACHE STRING "Name or full path to ldap library")
-  set(CMAKE_LBER_LIB "lber" CACHE STRING "Name or full path to lber library")
-
-  if(CURL_USE_OPENLDAP AND USE_WIN32_LDAP)
-    message(FATAL_ERROR "Cannot use USE_WIN32_LDAP and CURL_USE_OPENLDAP at the same time")
-  endif()
-
-  # Now that we know, we're not using windows LDAP...
+  # Now that we know, we are not using Windows LDAP...
   if(NOT USE_WIN32_LDAP)
     # Check for LDAP
-    set(CMAKE_REQUIRED_LIBRARIES ${OPENSSL_LIBRARIES})
-    check_library_exists_concat(${CMAKE_LDAP_LIB} ldap_init HAVE_LIBLDAP)
-    check_library_exists_concat(${CMAKE_LBER_LIB} ber_init HAVE_LIBLBER)
-
-    set(CMAKE_REQUIRED_INCLUDES_BAK ${CMAKE_REQUIRED_INCLUDES})
-    set(CMAKE_LDAP_INCLUDE_DIR "" CACHE STRING "Path to LDAP include directory")
-    if(CMAKE_LDAP_INCLUDE_DIR)
-      list(APPEND CMAKE_REQUIRED_INCLUDES ${CMAKE_LDAP_INCLUDE_DIR})
+    cmake_push_check_state()
+    if(USE_OPENSSL)
+      list(APPEND CMAKE_REQUIRED_LIBRARIES OpenSSL::SSL OpenSSL::Crypto)
     endif()
-    check_include_file_concat("ldap.h"           HAVE_LDAP_H)
-    check_include_file_concat("lber.h"           HAVE_LBER_H)
+    find_package(LDAP MODULE)
+    if(LDAP_FOUND)
+      set(HAVE_LBER_H 1)
+      list(PREPEND CURL_LIBS CURL::ldap)
 
-    if(NOT HAVE_LDAP_H)
-      message(STATUS "LDAP_H not found CURL_DISABLE_LDAP set ON")
-      set(CURL_DISABLE_LDAP ON CACHE BOOL "" FORCE)
-      set(CMAKE_REQUIRED_INCLUDES ${CMAKE_REQUIRED_INCLUDES_BAK}) #LDAP includes won't be used
-    elseif(NOT HAVE_LIBLDAP)
-      message(STATUS "LDAP library '${CMAKE_LDAP_LIB}' not found CURL_DISABLE_LDAP set ON")
-      set(CURL_DISABLE_LDAP ON CACHE BOOL "" FORCE)
-      set(CMAKE_REQUIRED_INCLUDES ${CMAKE_REQUIRED_INCLUDES_BAK}) #LDAP includes won't be used
-    else()
-      if(CURL_USE_OPENLDAP)
+      # LDAP feature checks
+
+      list(APPEND CMAKE_REQUIRED_DEFINITIONS "-DLDAP_DEPRECATED=1")
+      list(APPEND CMAKE_REQUIRED_LIBRARIES CURL::ldap)
+
+      check_function_exists("ldap_url_parse" HAVE_LDAP_URL_PARSE)
+      check_function_exists("ldap_init_fd" HAVE_LDAP_INIT_FD)
+
+      check_include_file("ldap_ssl.h" HAVE_LDAP_SSL_H)
+
+      if(HAVE_LDAP_INIT_FD)
         set(USE_OPENLDAP ON)
       endif()
-      if(CMAKE_LDAP_INCLUDE_DIR)
-        include_directories(${CMAKE_LDAP_INCLUDE_DIR})
-      endif()
-      set(NEED_LBER_H ON)
-      set(_HEADER_LIST)
-      if(HAVE_WINDOWS_H)
-        list(APPEND _HEADER_LIST "windows.h")
-      endif()
-      if(HAVE_SYS_TYPES_H)
-        list(APPEND _HEADER_LIST "sys/types.h")
-      endif()
-      list(APPEND _HEADER_LIST "ldap.h")
-
-      set(_SRC_STRING "")
-      foreach(_HEADER ${_HEADER_LIST})
-        set(_INCLUDE_STRING "${_INCLUDE_STRING}#include <${_HEADER}>\n")
-      endforeach()
-
-      set(_SRC_STRING
-        "
-        ${_INCLUDE_STRING}
-        int main(int argc, char ** argv)
-        {
-          BerValue *bvp = NULL;
-          BerElement *bep = ber_init(bvp);
-          ber_free(bep, 1);
-          return 0;
-        }"
-      )
-      list(APPEND CMAKE_REQUIRED_DEFINITIONS -DLDAP_DEPRECATED=1)
-      list(APPEND CMAKE_REQUIRED_LIBRARIES ${CMAKE_LDAP_LIB})
-      if(HAVE_LIBLBER)
-        list(APPEND CMAKE_REQUIRED_LIBRARIES ${CMAKE_LBER_LIB})
-      endif()
-      check_c_source_compiles("${_SRC_STRING}" NOT_NEED_LBER_H)
-      unset(CMAKE_REQUIRED_LIBRARIES)
-
-      if(NOT_NEED_LBER_H)
-        set(NEED_LBER_H OFF)
-      else()
-        set(CURL_TEST_DEFINES "${CURL_TEST_DEFINES} -DNEED_LBER_H")
+      if(NOT CURL_DISABLE_LDAPS)
+        set(HAVE_LDAP_SSL ON)
       endif()
+    else()
+      message(STATUS "LDAP not found. CURL_DISABLE_LDAP set ON")
+      set(CURL_DISABLE_LDAP ON CACHE BOOL "" FORCE)
     endif()
+    cmake_pop_check_state()
   endif()
 endif()
 
@@ -792,407 +1262,464 @@ if(CURL_DISABLE_LDAP)
   endif()
 endif()
 
-if(NOT CURL_DISABLE_LDAPS)
-  check_include_file_concat("ldap_ssl.h" HAVE_LDAP_SSL_H)
-endif()
-
-# Check for idn2
-option(USE_LIBIDN2 "Use libidn2 for IDN support" ON)
-if(USE_LIBIDN2)
-  check_library_exists_concat("idn2" idn2_lookup_ul HAVE_LIBIDN2)
-else()
-  set(HAVE_LIBIDN2 OFF)
-endif()
-
 if(WIN32)
   option(USE_WIN32_IDN "Use WinIDN for IDN support" OFF)
   if(USE_WIN32_IDN)
-    list(APPEND CURL_LIBS "normaliz")
+    list(APPEND CURL_LIBS "normaliz")  # for IdnToAscii(), IdnToUnicode()
+  endif()
+else()
+  set(USE_WIN32_IDN OFF)
+endif()
+
+if(APPLE)
+  option(USE_APPLE_IDN "Use Apple built-in IDN support" OFF)
+  if(USE_APPLE_IDN)
+    cmake_push_check_state()
+    list(APPEND CMAKE_REQUIRED_LIBRARIES "icucore")
+    check_symbol_exists("uidna_openUTS46" "unicode/uidna.h" HAVE_APPLE_IDN)
+    cmake_pop_check_state()
+    if(HAVE_APPLE_IDN)
+      list(APPEND CURL_LIBS "icucore" "iconv")
+    else()
+      set(USE_APPLE_IDN OFF)
+    endif()
+  endif()
+else()
+  set(USE_APPLE_IDN OFF)
+endif()
+
+# Check for libidn2
+option(USE_LIBIDN2 "Use libidn2 for IDN support" ON)
+set(HAVE_IDN2_H OFF)
+set(HAVE_LIBIDN2 OFF)
+if(USE_LIBIDN2 AND NOT USE_APPLE_IDN AND NOT USE_WIN32_IDN)
+  find_package(Libidn2 MODULE)
+  if(LIBIDN2_FOUND)
+    list(PREPEND CURL_LIBS CURL::libidn2)
+    set(HAVE_IDN2_H 1)
+    set(HAVE_LIBIDN2 1)
   endif()
 endif()
 
-#libpsl
-option(CURL_USE_LIBPSL "Use libPSL" ON)
+# libpsl
+option(CURL_USE_LIBPSL "Use libpsl" ON)
 mark_as_advanced(CURL_USE_LIBPSL)
 set(USE_LIBPSL OFF)
-
 if(CURL_USE_LIBPSL)
-  find_package(LibPSL)
-  if(LIBPSL_FOUND)
-    list(APPEND CURL_LIBS ${LIBPSL_LIBRARY})
-    list(APPEND CMAKE_REQUIRED_INCLUDES "${LIBPSL_INCLUDE_DIR}")
-    include_directories("${LIBPSL_INCLUDE_DIR}")
-    set(USE_LIBPSL ON)
-  endif()
+  find_package(Libpsl MODULE REQUIRED)
+  list(APPEND CURL_LIBS CURL::libpsl)
+  set(USE_LIBPSL ON)
 endif()
 
-#libSSH2
-option(CURL_USE_LIBSSH2 "Use libSSH2" ON)
+# libssh2
+option(CURL_USE_LIBSSH2 "Use libssh2" ON)
 mark_as_advanced(CURL_USE_LIBSSH2)
 set(USE_LIBSSH2 OFF)
-
 if(CURL_USE_LIBSSH2)
-  find_package(LibSSH2)
+  find_package(Libssh2 MODULE)
   if(LIBSSH2_FOUND)
-    list(APPEND CURL_LIBS ${LIBSSH2_LIBRARY})
-    list(APPEND CMAKE_REQUIRED_INCLUDES "${LIBSSH2_INCLUDE_DIR}")
-    include_directories("${LIBSSH2_INCLUDE_DIR}")
+    list(PREPEND CURL_LIBS CURL::libssh2)  # keep it before TLS-crypto, compression
     set(USE_LIBSSH2 ON)
   endif()
 endif()
 
 # libssh
-option(CURL_USE_LIBSSH "Use libSSH" OFF)
+option(CURL_USE_LIBSSH "Use libssh" OFF)
 mark_as_advanced(CURL_USE_LIBSSH)
 if(NOT USE_LIBSSH2 AND CURL_USE_LIBSSH)
-  find_package(libssh CONFIG)
-  if(libssh_FOUND)
-    message(STATUS "Found libssh ${libssh_VERSION}")
-    # Use imported target for include and library paths.
-    list(APPEND CURL_LIBS ssh)
-    set(USE_LIBSSH ON)
-  endif()
+  find_package(Libssh MODULE REQUIRED)
+  list(PREPEND CURL_LIBS CURL::libssh)  # keep it before TLS-crypto, compression
+  set(USE_LIBSSH ON)
 endif()
 
-option(CURL_USE_GSSAPI "Use GSSAPI implementation (right now only Heimdal is supported with CMake build)" OFF)
+option(CURL_USE_GSASL "Use libgsasl" OFF)
+mark_as_advanced(CURL_USE_GSASL)
+if(CURL_USE_GSASL)
+  find_package(Libgsasl MODULE REQUIRED)
+  list(APPEND CURL_LIBS CURL::libgsasl)
+  set(USE_GSASL ON)
+endif()
+
+option(CURL_USE_GSSAPI "Use GSSAPI implementation" OFF)
 mark_as_advanced(CURL_USE_GSSAPI)
 
 if(CURL_USE_GSSAPI)
-  find_package(GSS)
+  find_package(GSS MODULE)
 
   set(HAVE_GSSAPI ${GSS_FOUND})
   if(GSS_FOUND)
+    list(APPEND CURL_LIBS CURL::gss)
 
-    message(STATUS "Found ${GSS_FLAVOUR} GSSAPI version: \"${GSS_VERSION}\"")
-
-    list(APPEND CMAKE_REQUIRED_INCLUDES ${GSS_INCLUDE_DIR})
-    check_include_file_concat("gssapi/gssapi.h"  HAVE_GSSAPI_GSSAPI_H)
-    check_include_file_concat("gssapi/gssapi_generic.h" HAVE_GSSAPI_GSSAPI_GENERIC_H)
-    check_include_file_concat("gssapi/gssapi_krb5.h" HAVE_GSSAPI_GSSAPI_KRB5_H)
-
-    if(GSS_FLAVOUR STREQUAL "Heimdal")
-      set(HAVE_GSSHEIMDAL ON)
-    else() # MIT
-      set(HAVE_GSSMIT ON)
-      set(_INCLUDE_LIST "")
-      if(HAVE_GSSAPI_GSSAPI_H)
-        list(APPEND _INCLUDE_LIST "gssapi/gssapi.h")
-      endif()
-      if(HAVE_GSSAPI_GSSAPI_GENERIC_H)
-        list(APPEND _INCLUDE_LIST "gssapi/gssapi_generic.h")
-      endif()
-      if(HAVE_GSSAPI_GSSAPI_KRB5_H)
-        list(APPEND _INCLUDE_LIST "gssapi/gssapi_krb5.h")
-      endif()
-
-      string(REPLACE ";" " " _COMPILER_FLAGS_STR "${GSS_COMPILER_FLAGS}")
-      string(REPLACE ";" " " _LINKER_FLAGS_STR "${GSS_LINKER_FLAGS}")
-
-      foreach(_dir ${GSS_LINK_DIRECTORIES})
-        set(_LINKER_FLAGS_STR "${_LINKER_FLAGS_STR} -L\"${_dir}\"")
-      endforeach()
-
-      if(NOT DEFINED HAVE_GSS_C_NT_HOSTBASED_SERVICE)
-        set(CMAKE_REQUIRED_FLAGS "${_COMPILER_FLAGS_STR} ${_LINKER_FLAGS_STR}")
-        set(CMAKE_REQUIRED_LIBRARIES ${GSS_LIBRARIES})
-        check_symbol_exists("GSS_C_NT_HOSTBASED_SERVICE" ${_INCLUDE_LIST} HAVE_GSS_C_NT_HOSTBASED_SERVICE)
-        unset(CMAKE_REQUIRED_LIBRARIES)
-      endif()
-      if(NOT HAVE_GSS_C_NT_HOSTBASED_SERVICE)
-        set(HAVE_OLD_GSSMIT ON)
-      endif()
+    get_target_property(_gss_flavor CURL::gss INTERFACE_CURL_GSS_FLAVOR)
+    if(_gss_flavor STREQUAL "GNU")
+      set(HAVE_GSSGNU 1)
+    elseif(GSS_VERSION)  # MIT
+      set(CURL_KRB5_VERSION "\"${GSS_VERSION}\"")
     endif()
-
-    include_directories(${GSS_INCLUDE_DIR})
-    link_directories(${GSS_LINK_DIRECTORIES})
-    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${GSS_COMPILER_FLAGS}")
-    string(REPLACE ";" " " GSS_LINKER_FLAGS "${GSS_LINKER_FLAGS}")
-    set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} ${GSS_LINKER_FLAGS}")
-    set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} ${GSS_LINKER_FLAGS}")
-    set(CMAKE_STATIC_LINKER_FLAGS "${CMAKE_STATIC_LINKER_FLAGS} ${GSS_LINKER_FLAGS}")
-    list(APPEND CURL_LIBS ${GSS_LIBRARIES})
-
   else()
-    message(WARNING "GSSAPI support has been requested but no supporting libraries found. Skipping.")
+    message(WARNING "GSSAPI has been requested, but no supporting libraries found. Skipping.")
   endif()
 endif()
 
-option(ENABLE_UNIX_SOCKETS "Define if you want Unix domain sockets support" ON)
+# libbacktrace
+option(CURL_USE_LIBBACKTRACE "Use libbacktrace. Requires debug-enabled build and DWARF debug information." OFF)
+if(CURL_USE_LIBBACKTRACE)
+  if(NOT ENABLE_DEBUG)
+    message(FATAL_ERROR "libbacktrace requires debug-enabled build for TrackMemory")
+  endif()
+  if(NOT CMAKE_BUILD_TYPE MATCHES "(Debug|RelWithDebInfo)")
+    message(FATAL_ERROR "libbacktrace requires debug information")
+  endif()
+  find_package(Libbacktrace MODULE REQUIRED)
+  list(APPEND CURL_LIBS CURL::libbacktrace)
+  set(USE_BACKTRACE ON)
+endif()
+
+# libuv
+option(CURL_USE_LIBUV "Use libuv for event-based tests" OFF)
+if(CURL_USE_LIBUV)
+  if(NOT ENABLE_DEBUG)
+    message(FATAL_ERROR "Using libuv without debug support enabled is useless")
+  endif()
+  find_package(Libuv MODULE REQUIRED)
+  list(APPEND CURL_LIBS CURL::libuv)
+  set(USE_LIBUV ON)
+  set(HAVE_UV_H ON)
+endif()
+
+option(ENABLE_UNIX_SOCKETS "Enable Unix domain sockets support" ON)
 if(ENABLE_UNIX_SOCKETS)
-  include(CheckStructHasMember)
-  if(WIN32)
-    set(USE_UNIX_SOCKETS ON)
+  if(WIN32 OR DOS)
+    set(USE_UNIX_SOCKETS 1)
   else()
-    check_struct_has_member("struct sockaddr_un" sun_path "sys/un.h" USE_UNIX_SOCKETS)
+    include(CheckStructHasMember)
+    check_struct_has_member("struct sockaddr_un" "sun_path" "sys/un.h" USE_UNIX_SOCKETS)
   endif()
 else()
+  set(USE_UNIX_SOCKETS 0)
   unset(USE_UNIX_SOCKETS CACHE)
 endif()
 
-
 #
 # CA handling
 #
-set(CURL_CA_BUNDLE "auto" CACHE STRING
-    "Path to the CA bundle. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
-set(CURL_CA_FALLBACK OFF CACHE BOOL
-    "Set ON to use built-in CA store of TLS backend. Defaults to OFF")
-set(CURL_CA_PATH "auto" CACHE STRING
-    "Location of default CA path. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
-
-if("${CURL_CA_BUNDLE}" STREQUAL "")
-  message(FATAL_ERROR "Invalid value of CURL_CA_BUNDLE. Use 'none', 'auto' or file path.")
-elseif("${CURL_CA_BUNDLE}" STREQUAL "none")
-  unset(CURL_CA_BUNDLE CACHE)
-elseif("${CURL_CA_BUNDLE}" STREQUAL "auto")
-  unset(CURL_CA_BUNDLE CACHE)
-  if(NOT CMAKE_CROSSCOMPILING)
-    set(CURL_CA_BUNDLE_AUTODETECT TRUE)
-  endif()
+option(CURL_CA_NATIVE "Use native CA store" OFF)
+if(CURL_CA_NATIVE)
+  set(_curl_disable_ca_search_default ON)
 else()
-  set(CURL_CA_BUNDLE_SET TRUE)
+  set(_curl_disable_ca_search_default OFF)
 endif()
 
-if("${CURL_CA_PATH}" STREQUAL "")
-  message(FATAL_ERROR "Invalid value of CURL_CA_PATH. Use 'none', 'auto' or directory path.")
-elseif("${CURL_CA_PATH}" STREQUAL "none")
-  unset(CURL_CA_PATH CACHE)
-elseif("${CURL_CA_PATH}" STREQUAL "auto")
-  unset(CURL_CA_PATH CACHE)
-  if(NOT CMAKE_CROSSCOMPILING)
-    set(CURL_CA_PATH_AUTODETECT TRUE)
+if(_curl_ca_bundle_supported)
+  set(_ca_opt_desc "Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
+
+  set(CURL_CA_BUNDLE "auto" CACHE
+    STRING "Absolute path to the CA bundle. ${_ca_opt_desc}")
+  set(CURL_CA_FALLBACK OFF CACHE
+    BOOL "Use built-in CA store of OpenSSL. Defaults to OFF")
+  set(CURL_CA_PATH "auto" CACHE
+    STRING "Absolute path to a directory containing CA certificates stored individually. ${_ca_opt_desc}")
+  set(CURL_CA_EMBED "" CACHE
+    STRING "Absolute path to the CA bundle to embed in the curl tool.")
+
+  if(CURL_CA_FALLBACK AND NOT CURL_USE_OPENSSL)
+    message(FATAL_ERROR "CURL_CA_FALLBACK only works with OpenSSL.")
   endif()
-else()
-  set(CURL_CA_PATH_SET TRUE)
-endif()
 
-if(CURL_CA_BUNDLE_SET AND CURL_CA_PATH_AUTODETECT)
-  # Skip autodetection of unset CA path because CA bundle is set explicitly
-elseif(CURL_CA_PATH_SET AND CURL_CA_BUNDLE_AUTODETECT)
-  # Skip autodetection of unset CA bundle because CA path is set explicitly
-elseif(CURL_CA_PATH_AUTODETECT OR CURL_CA_BUNDLE_AUTODETECT)
-  # first try autodetecting a CA bundle, then a CA path
+  if(CURL_CA_BUNDLE STREQUAL "")
+    message(FATAL_ERROR "Invalid value of CURL_CA_BUNDLE. Use 'none', 'auto' or file path.")
+  elseif(CURL_CA_BUNDLE STREQUAL "none")
+    unset(CURL_CA_BUNDLE CACHE)
+  elseif(CURL_CA_BUNDLE STREQUAL "auto")
+    unset(CURL_CA_BUNDLE CACHE)
+    if(NOT CMAKE_CROSSCOMPILING AND NOT WIN32 AND NOT USE_APPLE_SECTRUST AND NOT CURL_CA_NATIVE)
+      set(_curl_ca_bundle_autodetect TRUE)
+    endif()
+  else()
+    set(CURL_CA_BUNDLE_SET TRUE)
+  endif()
+  mark_as_advanced(CURL_CA_BUNDLE_SET)
 
-  if(CURL_CA_BUNDLE_AUTODETECT)
-    set(SEARCH_CA_BUNDLE_PATHS
-        /etc/ssl/certs/ca-certificates.crt
-        /etc/pki/tls/certs/ca-bundle.crt
-        /usr/share/ssl/certs/ca-bundle.crt
-        /usr/local/share/certs/ca-root-nss.crt
-        /etc/ssl/cert.pem)
+  if(CURL_CA_PATH STREQUAL "")
+    message(FATAL_ERROR "Invalid value of CURL_CA_PATH. Use 'none', 'auto' or directory path.")
+  elseif(CURL_CA_PATH STREQUAL "none")
+    unset(CURL_CA_PATH CACHE)
+  elseif(CURL_CA_PATH STREQUAL "auto")
+    unset(CURL_CA_PATH CACHE)
+    if(NOT CMAKE_CROSSCOMPILING AND NOT WIN32 AND NOT USE_APPLE_SECTRUST AND NOT CURL_CA_NATIVE)
+      set(_curl_ca_path_autodetect TRUE)
+    endif()
+  else()
+    set(CURL_CA_PATH_SET TRUE)
+  endif()
+  mark_as_advanced(CURL_CA_PATH_SET)
 
-    foreach(SEARCH_CA_BUNDLE_PATH ${SEARCH_CA_BUNDLE_PATHS})
-      if(EXISTS "${SEARCH_CA_BUNDLE_PATH}")
-        message(STATUS "Found CA bundle: ${SEARCH_CA_BUNDLE_PATH}")
-        set(CURL_CA_BUNDLE "${SEARCH_CA_BUNDLE_PATH}" CACHE STRING
-            "Path to the CA bundle. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
-        set(CURL_CA_BUNDLE_SET TRUE CACHE BOOL "Path to the CA bundle has been set")
-        break()
+  if(CURL_CA_BUNDLE_SET AND _curl_ca_path_autodetect)
+    # Skip auto-detection of unset CA path because CA bundle is set explicitly
+  elseif(CURL_CA_PATH_SET AND _curl_ca_bundle_autodetect)
+    # Skip auto-detection of unset CA bundle because CA path is set explicitly
+  elseif(_curl_ca_bundle_autodetect OR _curl_ca_path_autodetect)
+    # First try auto-detecting a CA bundle, then a CA path
+
+    if(_curl_ca_bundle_autodetect)
+      foreach(_search_ca_bundle_path IN ITEMS
+          "/etc/ssl/certs/ca-certificates.crt"
+          "/etc/pki/tls/certs/ca-bundle.crt"
+          "/usr/share/ssl/certs/ca-bundle.crt"
+          "/usr/local/share/certs/ca-root-nss.crt"
+          "/etc/ssl/cert.pem")
+        if(EXISTS "${_search_ca_bundle_path}")
+          message(STATUS "Found CA bundle: ${_search_ca_bundle_path}")
+          set(CURL_CA_BUNDLE "${_search_ca_bundle_path}" CACHE
+            STRING "Absolute path to the CA bundle. ${_ca_opt_desc}")
+          set(CURL_CA_BUNDLE_SET TRUE CACHE BOOL "Absolute path to the CA bundle has been set")
+          break()
+        endif()
+      endforeach()
+    endif()
+
+    if(_curl_ca_path_autodetect AND NOT CURL_CA_PATH_SET)
+      set(_search_ca_path "/etc/ssl/certs")
+      file(GLOB _curl_ca_files_found "${_search_ca_path}/[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f].0")
+      if(_curl_ca_files_found)
+        unset(_curl_ca_files_found)
+        message(STATUS "Found CA path: ${_search_ca_path}")
+        set(CURL_CA_PATH "${_search_ca_path}" CACHE
+          STRING "Absolute path to a directory containing CA certificates stored individually. ${_ca_opt_desc}")
+        set(CURL_CA_PATH_SET TRUE CACHE BOOL "Absolute path to the CA bundle has been set")
       endif()
-    endforeach()
+    endif()
   endif()
 
-  if(CURL_CA_PATH_AUTODETECT AND (NOT CURL_CA_PATH_SET))
-    if(EXISTS "/etc/ssl/certs")
-      set(CURL_CA_PATH "/etc/ssl/certs" CACHE STRING
-          "Location of default CA path. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
-      set(CURL_CA_PATH_SET TRUE CACHE BOOL "Path to the CA bundle has been set")
+  set(CURL_CA_EMBED_SET FALSE)
+  if(BUILD_CURL_EXE AND NOT CURL_CA_EMBED STREQUAL "")
+    if(EXISTS "${CURL_CA_EMBED}")
+      set(CURL_CA_EMBED_SET TRUE)
+      message(STATUS "Found CA bundle to embed: ${CURL_CA_EMBED}")
+    else()
+      message(FATAL_ERROR "CA bundle to embed is missing: '${CURL_CA_EMBED}'")
     endif()
   endif()
 endif()
 
-if(CURL_CA_PATH_SET AND NOT USE_OPENSSL AND NOT USE_MBEDTLS)
-  message(STATUS
-          "CA path only supported by OpenSSL, GnuTLS or mbed TLS. "
-          "Set CURL_CA_PATH=none or enable one of those TLS backends.")
+if(WIN32)
+  option(CURL_DISABLE_CA_SEARCH "Disable unsafe CA bundle search in PATH on Windows" ${_curl_disable_ca_search_default})
+  option(CURL_CA_SEARCH_SAFE "Enable safe CA bundle search (within the curl tool directory) on Windows" OFF)
 endif()
 
+set(CURL_INCLUDES "")
+
 # Check for header files
-if(NOT UNIX)
-  check_include_file_concat("windows.h"      HAVE_WINDOWS_H)
-  check_include_file_concat("ws2tcpip.h"     HAVE_WS2TCPIP_H)
-  check_include_file_concat("winsock2.h"     HAVE_WINSOCK2_H)
+if(WIN32)
+  list(APPEND CURL_INCLUDES "winsock2.h")
+  list(APPEND CURL_INCLUDES "ws2tcpip.h")
+
+  if(HAVE_WIN32_WINNT AND HAVE_WIN32_WINNT LESS 0x0600)
+    # Windows Vista is required for freeaddrinfo, getaddrinfo, if_nametoindex
+    message(FATAL_ERROR "Building for Windows Vista or newer is required.")
+  endif()
 endif()
 
-check_include_file_concat("inttypes.h"       HAVE_INTTYPES_H)
-check_include_file_concat("sys/filio.h"      HAVE_SYS_FILIO_H)
-check_include_file_concat("sys/ioctl.h"      HAVE_SYS_IOCTL_H)
-check_include_file_concat("sys/param.h"      HAVE_SYS_PARAM_H)
-check_include_file_concat("sys/poll.h"       HAVE_SYS_POLL_H)
-check_include_file_concat("sys/resource.h"   HAVE_SYS_RESOURCE_H)
-check_include_file_concat("sys/select.h"     HAVE_SYS_SELECT_H)
-check_include_file_concat("sys/socket.h"     HAVE_SYS_SOCKET_H)
-check_include_file_concat("sys/sockio.h"     HAVE_SYS_SOCKIO_H)
-check_include_file_concat("sys/stat.h"       HAVE_SYS_STAT_H)
-check_include_file_concat("sys/time.h"       HAVE_SYS_TIME_H)
-check_include_file_concat("sys/types.h"      HAVE_SYS_TYPES_H)
-check_include_file_concat("sys/un.h"         HAVE_SYS_UN_H)
-check_include_file_concat("sys/utime.h"      HAVE_SYS_UTIME_H)
-check_include_file_concat("sys/xattr.h"      HAVE_SYS_XATTR_H)
-check_include_file_concat("arpa/inet.h"      HAVE_ARPA_INET_H)
-check_include_file_concat("arpa/tftp.h"      HAVE_ARPA_TFTP_H)
-check_include_file_concat("fcntl.h"          HAVE_FCNTL_H)
-check_include_file_concat("idn2.h"           HAVE_IDN2_H)
-check_include_file_concat("ifaddrs.h"        HAVE_IFADDRS_H)
-check_include_file_concat("io.h"             HAVE_IO_H)
-check_include_file_concat("libgen.h"         HAVE_LIBGEN_H)
-check_include_file_concat("locale.h"         HAVE_LOCALE_H)
-check_include_file_concat("net/if.h"         HAVE_NET_IF_H)
-check_include_file_concat("netdb.h"          HAVE_NETDB_H)
-check_include_file_concat("netinet/in.h"     HAVE_NETINET_IN_H)
-check_include_file_concat("netinet/tcp.h"    HAVE_NETINET_TCP_H)
+if(NOT WIN32)
+  list(APPEND CURL_INCLUDES "sys/socket.h")
+endif()
+if(NOT WIN32 OR MINGW)
+  list(APPEND CURL_INCLUDES "sys/time.h")
+endif()
+
+# Detect headers
+
+# Use check_include_file_concat_curl() for headers required by subsequent
+# check_include_file_concat_curl() or check_symbol_exists() detections.
+# Order for these is significant.
+check_include_file("sys/eventfd.h"    HAVE_SYS_EVENTFD_H)
+check_include_file("sys/filio.h"      HAVE_SYS_FILIO_H)
+check_include_file("sys/ioctl.h"      HAVE_SYS_IOCTL_H)
+check_include_file("sys/param.h"      HAVE_SYS_PARAM_H)
+check_include_file("sys/poll.h"       HAVE_SYS_POLL_H)
+check_include_file("sys/resource.h"   HAVE_SYS_RESOURCE_H)
+check_include_file_concat_curl("sys/select.h"     HAVE_SYS_SELECT_H)
+check_include_file("sys/sockio.h"     HAVE_SYS_SOCKIO_H)
+check_include_file_concat_curl("sys/types.h"      HAVE_SYS_TYPES_H)
+check_include_file("sys/un.h"         HAVE_SYS_UN_H)
+check_include_file_concat_curl("sys/utime.h"      HAVE_SYS_UTIME_H)  # sys/types.h (AmigaOS)
+
+check_include_file_concat_curl("arpa/inet.h"      HAVE_ARPA_INET_H)
+check_include_file("dirent.h"         HAVE_DIRENT_H)
+check_include_file("fcntl.h"          HAVE_FCNTL_H)
+check_include_file_concat_curl("ifaddrs.h"        HAVE_IFADDRS_H)
+check_include_file("io.h"             HAVE_IO_H)
+check_include_file_concat_curl("libgen.h"         HAVE_LIBGEN_H)
 check_include_file("linux/tcp.h"      HAVE_LINUX_TCP_H)
+check_include_file("locale.h"         HAVE_LOCALE_H)
+check_include_file_concat_curl("net/if.h"         HAVE_NET_IF_H)  # sys/select.h (e.g. MS-DOS/Watt-32)
+check_include_file_concat_curl("netdb.h"          HAVE_NETDB_H)
+check_include_file_concat_curl("netinet/in.h"     HAVE_NETINET_IN_H)
+check_include_file("netinet/in6.h"    HAVE_NETINET_IN6_H)
+check_include_file_concat_curl("netinet/tcp.h"    HAVE_NETINET_TCP_H)  # sys/types.h (e.g. Cygwin) netinet/in.h
+check_include_file_concat_curl("netinet/udp.h"    HAVE_NETINET_UDP_H)  # sys/types.h (e.g. Cygwin)
+check_include_file("poll.h"           HAVE_POLL_H)
+check_include_file("pwd.h"            HAVE_PWD_H)
+check_include_file("stdatomic.h"      HAVE_STDATOMIC_H)
+check_include_file("stdbool.h"        HAVE_STDBOOL_H)
+check_include_file("strings.h"        HAVE_STRINGS_H)
+check_include_file("stropts.h"        HAVE_STROPTS_H)
+check_include_file("termio.h"         HAVE_TERMIO_H)
+check_include_file("termios.h"        HAVE_TERMIOS_H)
+check_include_file_concat_curl("unistd.h"         HAVE_UNISTD_H)
+check_include_file("utime.h"          HAVE_UTIME_H)
 
-check_include_file_concat("poll.h"           HAVE_POLL_H)
-check_include_file_concat("pwd.h"            HAVE_PWD_H)
-check_include_file_concat("setjmp.h"         HAVE_SETJMP_H)
-check_include_file_concat("signal.h"         HAVE_SIGNAL_H)
-check_include_file_concat("stdatomic.h"      HAVE_STDATOMIC_H)
-check_include_file_concat("stdbool.h"        HAVE_STDBOOL_H)
-check_include_file_concat("stdint.h"         HAVE_STDINT_H)
-check_include_file_concat("stdlib.h"         HAVE_STDLIB_H)
-check_include_file_concat("string.h"         HAVE_STRING_H)
-check_include_file_concat("strings.h"        HAVE_STRINGS_H)
-check_include_file_concat("stropts.h"        HAVE_STROPTS_H)
-check_include_file_concat("termio.h"         HAVE_TERMIO_H)
-check_include_file_concat("termios.h"        HAVE_TERMIOS_H)
-check_include_file_concat("time.h"           HAVE_TIME_H)
-check_include_file_concat("unistd.h"         HAVE_UNISTD_H)
-check_include_file_concat("utime.h"          HAVE_UTIME_H)
+if(AMIGA)
+  check_include_file_concat_curl("proto/bsdsocket.h" HAVE_PROTO_BSDSOCKET_H)
+endif()
 
-check_include_file_concat("stddef.h"         HAVE_STDDEF_H)
+# Pass these detection results to curl_internal_test() for use in CurlTests.c
+# Add here all feature flags referenced from CurlTests.c
+foreach(_variable IN ITEMS
+    HAVE_STDATOMIC_H
+    HAVE_STDBOOL_H
+    HAVE_STROPTS_H
+    HAVE_SYS_IOCTL_H
+    HAVE_SYS_TYPES_H
+    HAVE_UNISTD_H
+)
+  if(${_variable})
+    list(APPEND CURL_TEST_DEFINES "-D${_variable}")
+  endif()
+endforeach()
 
-check_type_size(size_t  SIZEOF_SIZE_T)
-check_type_size(ssize_t  SIZEOF_SSIZE_T)
-check_type_size("long long"  SIZEOF_LONG_LONG)
-check_type_size("long"  SIZEOF_LONG)
-check_type_size("int"  SIZEOF_INT)
-check_type_size("__int64"  SIZEOF___INT64)
-check_type_size("time_t"  SIZEOF_TIME_T)
+check_type_size("size_t"      SIZEOF_SIZE_T)
+check_type_size("ssize_t"     SIZEOF_SSIZE_T)
+check_type_size("long"        SIZEOF_LONG)
+check_type_size("int"         SIZEOF_INT)
+check_type_size("__int64"     SIZEOF___INT64)
+check_type_size("time_t"      SIZEOF_TIME_T)
+check_type_size("suseconds_t" SIZEOF_SUSECONDS_T)
 if(NOT HAVE_SIZEOF_SSIZE_T)
   if(SIZEOF_LONG EQUAL SIZEOF_SIZE_T)
-    set(ssize_t long)
+    set(ssize_t "long")
   endif()
   if(NOT ssize_t AND SIZEOF___INT64 EQUAL SIZEOF_SIZE_T)
-    set(ssize_t __int64)
+    set(ssize_t "__int64")
   endif()
 endif()
 # off_t is sized later, after the HAVE_FILE_OFFSET_BITS test
 
-if(HAVE_SIZEOF_LONG_LONG)
-  set(HAVE_LONGLONG 1)
-endif()
-
-if(NOT CMAKE_CROSSCOMPILING)
-  find_file(RANDOM_FILE urandom /dev)
-  mark_as_advanced(RANDOM_FILE)
+if(SIZEOF_SUSECONDS_T)
+  set(HAVE_SUSECONDS_T 1)
 endif()
 
 # Check for some functions that are used
+
+# Apply to all feature checks
 if(WIN32)
-  set(CMAKE_REQUIRED_LIBRARIES ws2_32)
+  list(APPEND CMAKE_REQUIRED_LIBRARIES "ws2_32")
+  if(NOT WINDOWS_STORE)
+    list(APPEND CMAKE_REQUIRED_LIBRARIES "iphlpapi")
+  endif()
 elseif(HAVE_LIBSOCKET)
-  set(CMAKE_REQUIRED_LIBRARIES socket)
+  list(APPEND CMAKE_REQUIRED_LIBRARIES "socket")
+elseif(DOS)
+  list(APPEND CMAKE_REQUIRED_LIBRARIES "${WATT_ROOT}/lib/libwatt.a")
 endif()
 
-check_symbol_exists(fchmod        "${CURL_INCLUDES}" HAVE_FCHMOD)
-check_symbol_exists(basename      "${CURL_INCLUDES}" HAVE_BASENAME)
-check_symbol_exists(socket        "${CURL_INCLUDES}" HAVE_SOCKET)
-check_symbol_exists(socketpair    "${CURL_INCLUDES}" HAVE_SOCKETPAIR)
-check_symbol_exists(recv          "${CURL_INCLUDES}" HAVE_RECV)
-check_symbol_exists(send          "${CURL_INCLUDES}" HAVE_SEND)
-check_symbol_exists(sendmsg       "${CURL_INCLUDES}" HAVE_SENDMSG)
-check_symbol_exists(select        "${CURL_INCLUDES}" HAVE_SELECT)
-check_symbol_exists(strdup        "${CURL_INCLUDES}" HAVE_STRDUP)
-check_symbol_exists(strtok_r      "${CURL_INCLUDES}" HAVE_STRTOK_R)
-check_symbol_exists(strcasecmp    "${CURL_INCLUDES}" HAVE_STRCASECMP)
-check_symbol_exists(stricmp       "${CURL_INCLUDES}" HAVE_STRICMP)
-check_symbol_exists(strcmpi       "${CURL_INCLUDES}" HAVE_STRCMPI)
-check_symbol_exists(alarm         "${CURL_INCLUDES}" HAVE_ALARM)
-check_symbol_exists(getppid       "${CURL_INCLUDES}" HAVE_GETPPID)
-check_symbol_exists(utimes        "${CURL_INCLUDES}" HAVE_UTIMES)
+check_function_exists("accept4"       HAVE_ACCEPT4)
+check_function_exists("fnmatch"       HAVE_FNMATCH)
+check_symbol_exists("basename"        "${CURL_INCLUDES};string.h" HAVE_BASENAME)  # libgen.h unistd.h
+check_symbol_exists("opendir"         "dirent.h" HAVE_OPENDIR)
+check_function_exists("poll"          HAVE_POLL)  # poll.h
+check_symbol_exists("socket"          "${CURL_INCLUDES}" HAVE_SOCKET)  # winsock2.h sys/socket.h
+check_symbol_exists("socketpair"      "${CURL_INCLUDES}" HAVE_SOCKETPAIR)  # sys/socket.h
+check_symbol_exists("recv"            "${CURL_INCLUDES}" HAVE_RECV)  # proto/bsdsocket.h sys/types.h sys/socket.h
+check_symbol_exists("send"            "${CURL_INCLUDES}" HAVE_SEND)  # proto/bsdsocket.h sys/types.h sys/socket.h
+check_function_exists("sendmsg"       HAVE_SENDMSG)
+check_function_exists("sendmmsg"      HAVE_SENDMMSG)
+check_symbol_exists("select"          "${CURL_INCLUDES}" HAVE_SELECT)  # proto/bsdsocket.h sys/select.h sys/socket.h
+check_symbol_exists("memrchr"         "string.h" HAVE_MEMRCHR)
+check_symbol_exists("alarm"           "unistd.h" HAVE_ALARM)
+check_symbol_exists("fcntl"           "fcntl.h" HAVE_FCNTL)
+check_function_exists("getppid"       HAVE_GETPPID)
+check_function_exists("utimes"        HAVE_UTIMES)
 
-check_symbol_exists(gettimeofday  "${CURL_INCLUDES}" HAVE_GETTIMEOFDAY)
-check_symbol_exists(closesocket   "${CURL_INCLUDES}" HAVE_CLOSESOCKET)
-check_symbol_exists(sigsetjmp     "${CURL_INCLUDES}" HAVE_SIGSETJMP)
-check_symbol_exists(getpass_r     "${CURL_INCLUDES}" HAVE_GETPASS_R)
-check_symbol_exists(getpwuid      "${CURL_INCLUDES}" HAVE_GETPWUID)
-check_symbol_exists(getpwuid_r    "${CURL_INCLUDES}" HAVE_GETPWUID_R)
-check_symbol_exists(geteuid       "${CURL_INCLUDES}" HAVE_GETEUID)
-check_symbol_exists(utime         "${CURL_INCLUDES}" HAVE_UTIME)
-check_symbol_exists(gmtime_r      "${CURL_INCLUDES}" HAVE_GMTIME_R)
+check_function_exists("gettimeofday"  HAVE_GETTIMEOFDAY)  # sys/time.h
+check_symbol_exists("closesocket"     "${CURL_INCLUDES}" HAVE_CLOSESOCKET)  # winsock2.h
+check_symbol_exists("sigsetjmp"       "setjmp.h" HAVE_SIGSETJMP)
+check_function_exists("getpass_r"     HAVE_GETPASS_R)
+check_function_exists("getpwuid"      HAVE_GETPWUID)
+check_function_exists("getpwuid_r"    HAVE_GETPWUID_R)
+check_function_exists("geteuid"       HAVE_GETEUID)
+check_function_exists("utime"         HAVE_UTIME)
+check_symbol_exists("gmtime_r"        "stdlib.h;time.h" HAVE_GMTIME_R)
+check_symbol_exists("localtime_r"     "stdlib.h;time.h" HAVE_LOCALTIME_R)
 
-check_symbol_exists(gethostbyname_r "${CURL_INCLUDES}" HAVE_GETHOSTBYNAME_R)
+check_symbol_exists("gethostbyname_r" "netdb.h" HAVE_GETHOSTBYNAME_R)
+check_symbol_exists("gethostname"     "${CURL_INCLUDES}" HAVE_GETHOSTNAME)  # winsock2.h unistd.h proto/bsdsocket.h
 
-check_symbol_exists(signal         "${CURL_INCLUDES}" HAVE_SIGNAL)
-check_symbol_exists(strtoll        "${CURL_INCLUDES}" HAVE_STRTOLL)
-check_symbol_exists(strerror_r     "${CURL_INCLUDES}" HAVE_STRERROR_R)
-check_symbol_exists(siginterrupt   "${CURL_INCLUDES}" HAVE_SIGINTERRUPT)
-check_symbol_exists(getaddrinfo    "${CURL_INCLUDES}" HAVE_GETADDRINFO)
-if(WIN32)
-  set(HAVE_GETADDRINFO_THREADSAFE ${HAVE_GETADDRINFO})
-endif()
-check_symbol_exists(freeaddrinfo   "${CURL_INCLUDES}" HAVE_FREEADDRINFO)
-check_symbol_exists(pipe           "${CURL_INCLUDES}" HAVE_PIPE)
-check_symbol_exists(ftruncate      "${CURL_INCLUDES}" HAVE_FTRUNCATE)
-check_symbol_exists(getpeername    "${CURL_INCLUDES}" HAVE_GETPEERNAME)
-check_symbol_exists(getsockname    "${CURL_INCLUDES}" HAVE_GETSOCKNAME)
-check_symbol_exists(if_nametoindex "${CURL_INCLUDES}" HAVE_IF_NAMETOINDEX)
-check_symbol_exists(getrlimit      "${CURL_INCLUDES}" HAVE_GETRLIMIT)
-check_symbol_exists(setlocale      "${CURL_INCLUDES}" HAVE_SETLOCALE)
-check_symbol_exists(setmode        "${CURL_INCLUDES}" HAVE_SETMODE)
-check_symbol_exists(setrlimit      "${CURL_INCLUDES}" HAVE_SETRLIMIT)
+check_symbol_exists("signal"          "signal.h" HAVE_SIGNAL)
+check_symbol_exists("strerror_r"      "stdlib.h;string.h" HAVE_STRERROR_R)
+check_symbol_exists("sigaction"       "signal.h" HAVE_SIGACTION)
+check_symbol_exists("siginterrupt"    "signal.h" HAVE_SIGINTERRUPT)
+check_symbol_exists("getaddrinfo"     "${CURL_INCLUDES};stdlib.h;string.h" HAVE_GETADDRINFO)  # ws2tcpip.h sys/socket.h netdb.h
+check_symbol_exists("getifaddrs"      "${CURL_INCLUDES};stdlib.h" HAVE_GETIFADDRS)  # ifaddrs.h
+check_symbol_exists("freeaddrinfo"    "${CURL_INCLUDES}" HAVE_FREEADDRINFO)  # ws2tcpip.h sys/socket.h netdb.h
+check_function_exists("pipe"          HAVE_PIPE)
+check_function_exists("eventfd"       HAVE_EVENTFD)
+check_symbol_exists("getpeername"     "${CURL_INCLUDES}" HAVE_GETPEERNAME)  # winsock2.h unistd.h proto/bsdsocket.h
+check_symbol_exists("getsockname"     "${CURL_INCLUDES}" HAVE_GETSOCKNAME)  # winsock2.h unistd.h proto/bsdsocket.h
+check_function_exists("getrlimit"     HAVE_GETRLIMIT)
+check_function_exists("setlocale"     HAVE_SETLOCALE)
+check_function_exists("setrlimit"     HAVE_SETRLIMIT)
 
-if(NOT MSVC OR (MSVC_VERSION GREATER_EQUAL 1900))
-  # earlier MSVC compilers had faulty snprintf implementations
-  check_symbol_exists(snprintf       "stdio.h" HAVE_SNPRINTF)
-endif()
-check_function_exists(mach_absolute_time HAVE_MACH_ABSOLUTE_TIME)
-check_symbol_exists(inet_ntop      "${CURL_INCLUDES}" HAVE_INET_NTOP)
-if(MSVC AND (MSVC_VERSION LESS_EQUAL 1600))
-  set(HAVE_INET_NTOP OFF)
-endif()
-check_symbol_exists(inet_pton      "${CURL_INCLUDES}" HAVE_INET_PTON)
-
-check_symbol_exists(fsetxattr "${CURL_INCLUDES}" HAVE_FSETXATTR)
-if(HAVE_FSETXATTR)
-  foreach(CURL_TEST HAVE_FSETXATTR_5 HAVE_FSETXATTR_6)
-    curl_internal_test(${CURL_TEST})
-  endforeach()
+if(APPLE)
+  check_function_exists("mach_absolute_time" HAVE_MACH_ABSOLUTE_TIME)
+else()
+  # Apple platforms do not offer pipe2(), but the iPhone Simulator-specific
+  # /usr/lib/system/libsystem_sim_kernel.dylib exports it. To avoid false
+  # detection, omit this feature check for Apple targets.
+  check_function_exists("pipe2"         HAVE_PIPE2)
 endif()
 
-set(CMAKE_EXTRA_INCLUDE_FILES   "sys/socket.h")
-check_type_size("sa_family_t"   SIZEOF_SA_FAMILY_T)
-set(HAVE_SA_FAMILY_T            ${HAVE_SIZEOF_SA_FAMILY_T})
-set(CMAKE_EXTRA_INCLUDE_FILES   "")
+if(NOT WIN32)
+  check_function_exists("if_nametoindex"  HAVE_IF_NAMETOINDEX)  # net/if.h
+  check_function_exists("realpath"        HAVE_REALPATH)
+  check_function_exists("sched_yield"     HAVE_SCHED_YIELD)
 
-set(CMAKE_EXTRA_INCLUDE_FILES   "ws2def.h")
-check_type_size("ADDRESS_FAMILY"    SIZEOF_ADDRESS_FAMILY)
-set(HAVE_ADDRESS_FAMILY         ${HAVE_SIZEOF_ADDRESS_FAMILY})
-set(CMAKE_EXTRA_INCLUDE_FILES   "")
+  check_symbol_exists("inet_ntop"       "${CURL_INCLUDES};stdlib.h;string.h" HAVE_INET_NTOP) # arpa/inet.h netinet/in.h sys/socket.h
+  check_symbol_exists("inet_pton"       "${CURL_INCLUDES};stdlib.h;string.h" HAVE_INET_PTON) # arpa/inet.h netinet/in.h sys/socket.h
+  check_symbol_exists("strcasecmp"      "string.h" HAVE_STRCASECMP)
+  check_symbol_exists("stricmp"         "string.h" HAVE_STRICMP)
+  check_symbol_exists("strcmpi"         "string.h" HAVE_STRCMPI)
 
-# sigaction and sigsetjmp are special. Use special mechanism for
-# detecting those, but only if previous attempt failed.
-if(HAVE_SIGNAL_H)
-  check_symbol_exists(sigaction "signal.h" HAVE_SIGACTION)
-endif()
-
-if(NOT HAVE_SIGSETJMP)
-  if(HAVE_SETJMP_H)
-    check_symbol_exists(sigsetjmp "setjmp.h" HAVE_MACRO_SIGSETJMP)
-    if(HAVE_MACRO_SIGSETJMP)
-      set(HAVE_SIGSETJMP 1)
-    endif()
+  check_symbol_exists("memset_s" "string.h" HAVE_MEMSET_S)
+  if(NOT HAVE_MEMSET_S)
+    check_function_exists("memset_explicit" HAVE_MEMSET_EXPLICIT)
   endif()
 endif()
 
-# If there is no stricmp(), do not allow LDAP to parse URLs
-if(NOT HAVE_STRICMP)
-  set(HAVE_LDAP_URL_PARSE 1)
+if(AMIGA)
+  check_symbol_exists("CloseSocket" "${CURL_INCLUDES}" HAVE_CLOSESOCKET_CAMEL)  # sys/socket.h proto/bsdsocket.h
 endif()
 
+if(NOT _ssl_enabled)
+  check_symbol_exists("arc4random" "${CURL_INCLUDES};stdlib.h" HAVE_ARC4RANDOM)
+endif()
+
+check_symbol_exists("fsetxattr" "sys/xattr.h" HAVE_FSETXATTR)
+if(HAVE_FSETXATTR)
+  curl_internal_test(HAVE_FSETXATTR_5)
+  curl_internal_test(HAVE_FSETXATTR_6)
+endif()
+
+cmake_push_check_state()
+if(NOT WIN32)
+  list(APPEND CMAKE_EXTRA_INCLUDE_FILES "sys/socket.h")
+  check_type_size("sa_family_t" SIZEOF_SA_FAMILY_T)
+  set(HAVE_SA_FAMILY_T ${HAVE_SIZEOF_SA_FAMILY_T})
+endif()
+cmake_pop_check_state()
+
 # Do curl specific tests
-foreach(CURL_TEST
+foreach(_curl_test IN ITEMS
     HAVE_FCNTL_O_NONBLOCK
     HAVE_IOCTLSOCKET
     HAVE_IOCTLSOCKET_CAMEL
@@ -1201,150 +1728,125 @@ foreach(CURL_TEST
     HAVE_IOCTL_FIONBIO
     HAVE_IOCTL_SIOCGIFADDR
     HAVE_SETSOCKOPT_SO_NONBLOCK
-    TIME_WITH_SYS_TIME
-    HAVE_O_NONBLOCK
     HAVE_GETHOSTBYNAME_R_3
     HAVE_GETHOSTBYNAME_R_5
     HAVE_GETHOSTBYNAME_R_6
-    HAVE_GETHOSTBYNAME_R_3_REENTRANT
-    HAVE_GETHOSTBYNAME_R_5_REENTRANT
-    HAVE_GETHOSTBYNAME_R_6_REENTRANT
-    HAVE_IN_ADDR_T
     HAVE_BOOL_T
     STDC_HEADERS
-    HAVE_FILE_OFFSET_BITS
-    HAVE_VARIADIC_MACROS_C99
-    HAVE_VARIADIC_MACROS_GCC
     HAVE_ATOMIC
-    )
-  curl_internal_test(${CURL_TEST})
-endforeach()
-
-if(HAVE_FILE_OFFSET_BITS)
-  set(_FILE_OFFSET_BITS 64)
-  set(CMAKE_REQUIRED_FLAGS "-D_FILE_OFFSET_BITS=64")
-endif()
-check_type_size("off_t"  SIZEOF_OFF_T)
-
-# include this header to get the type
-set(CMAKE_REQUIRED_INCLUDES "${CURL_SOURCE_DIR}/include")
-set(CMAKE_EXTRA_INCLUDE_FILES "curl/system.h")
-check_type_size("curl_off_t"  SIZEOF_CURL_OFF_T)
-set(CMAKE_EXTRA_INCLUDE_FILES "curl/curl.h")
-check_type_size("curl_socket_t"  SIZEOF_CURL_SOCKET_T)
-set(CMAKE_EXTRA_INCLUDE_FILES "")
-
-if(WIN32)
-  # detect actual value of _WIN32_WINNT and store as HAVE_WIN32_WINNT
-  curl_internal_test(HAVE_WIN32_WINNT)
-  if(HAVE_WIN32_WINNT)
-    string(REGEX MATCH ".*_WIN32_WINNT=0x[0-9a-fA-F]+" OUTPUT "${OUTPUT}")
-    string(REGEX REPLACE ".*_WIN32_WINNT=" "" HAVE_WIN32_WINNT "${OUTPUT}")
-    message(STATUS "Found _WIN32_WINNT=${HAVE_WIN32_WINNT}")
-  endif()
-  # avoid storing HAVE_WIN32_WINNT in CMake cache
-  unset(HAVE_WIN32_WINNT CACHE)
-endif()
-
-set(CMAKE_REQUIRED_FLAGS)
-
-option(ENABLE_WEBSOCKETS "Set to ON to enable EXPERIMENTAL websockets" OFF)
-
-if(ENABLE_WEBSOCKETS)
-  if(${SIZEOF_CURL_OFF_T} GREATER "4")
-    set(USE_WEBSOCKETS ON)
-  else()
-    message(WARNING "curl_off_t is too small to enable WebSockets")
-  endif()
-endif()
-
-foreach(CURL_TEST
-    HAVE_GLIBC_STRERROR_R
-    HAVE_POSIX_STRERROR_R
-    )
-  curl_internal_test(${CURL_TEST})
+)
+  curl_internal_test(${_curl_test})
 endforeach()
 
 # Check for reentrant
-foreach(CURL_TEST
+cmake_push_check_state()
+list(APPEND CMAKE_REQUIRED_DEFINITIONS "-D_REENTRANT")
+foreach(_curl_test IN ITEMS
     HAVE_GETHOSTBYNAME_R_3
     HAVE_GETHOSTBYNAME_R_5
     HAVE_GETHOSTBYNAME_R_6)
-  if(NOT ${CURL_TEST})
-    if(${CURL_TEST}_REENTRANT)
-      set(NEED_REENTRANT 1)
-    endif()
+  curl_internal_test(${_curl_test}_REENTRANT)
+  if(NOT ${_curl_test} AND ${_curl_test}_REENTRANT)
+    set(NEED_REENTRANT 1)
   endif()
 endforeach()
+cmake_pop_check_state()
 
 if(NEED_REENTRANT)
-  foreach(CURL_TEST
+  foreach(_curl_test IN ITEMS
       HAVE_GETHOSTBYNAME_R_3
       HAVE_GETHOSTBYNAME_R_5
       HAVE_GETHOSTBYNAME_R_6)
-    set(${CURL_TEST} 0)
-    if(${CURL_TEST}_REENTRANT)
-      set(${CURL_TEST} 1)
+    set(${_curl_test} 0)
+    if(${_curl_test}_REENTRANT)
+      set(${_curl_test} 1)
     endif()
   endforeach()
 endif()
 
-# Check clock_gettime(CLOCK_MONOTONIC, x) support
-curl_internal_test(HAVE_CLOCK_GETTIME_MONOTONIC)
+cmake_push_check_state()
+list(APPEND CMAKE_REQUIRED_DEFINITIONS "-D_FILE_OFFSET_BITS=64")
+curl_internal_test(HAVE_FILE_OFFSET_BITS)
+cmake_pop_check_state()
 
-# Check compiler support of __builtin_available()
-curl_internal_test(HAVE_BUILTIN_AVAILABLE)
-
-# Some other minor tests
-
-if(NOT HAVE_IN_ADDR_T)
-  set(in_addr_t "unsigned long")
+cmake_push_check_state()
+if(HAVE_FILE_OFFSET_BITS)
+  set(_FILE_OFFSET_BITS 64)
+  list(APPEND CMAKE_REQUIRED_DEFINITIONS "-D_FILE_OFFSET_BITS=64")
 endif()
+check_type_size("off_t" SIZEOF_OFF_T)
 
-# Check for nonblocking
-set(HAVE_DISABLED_NONBLOCKING 1)
-if(HAVE_FIONBIO OR
-    HAVE_IOCTLSOCKET OR
-    HAVE_IOCTLSOCKET_CASE OR
-    HAVE_O_NONBLOCK)
-  set(HAVE_DISABLED_NONBLOCKING)
-endif()
+if(NOT WIN32)
+  # fseeko may not exist with _FILE_OFFSET_BITS=64 but can exist with
+  # _FILE_OFFSET_BITS unset or 32 (as in Android ARMv7 with NDK 26b and API level < 24)
+  # so we need to test fseeko after testing for _FILE_OFFSET_BITS
+  check_symbol_exists("fseeko" "${CURL_INCLUDES};stdio.h" HAVE_FSEEKO)
 
-if(CMAKE_COMPILER_IS_GNUCC AND APPLE)
-  include(CheckCCompilerFlag)
-  check_c_compiler_flag(-Wno-long-double HAVE_C_FLAG_Wno_long_double)
-  if(HAVE_C_FLAG_Wno_long_double)
-    # The Mac version of GCC warns about use of long double.  Disable it.
-    get_source_file_property(MPRINTF_COMPILE_FLAGS mprintf.c COMPILE_FLAGS)
-    if(MPRINTF_COMPILE_FLAGS)
-      set(MPRINTF_COMPILE_FLAGS "${MPRINTF_COMPILE_FLAGS} -Wno-long-double")
-    else()
-      set(MPRINTF_COMPILE_FLAGS "-Wno-long-double")
-    endif()
-    set_source_files_properties(mprintf.c PROPERTIES
-      COMPILE_FLAGS ${MPRINTF_COMPILE_FLAGS})
+  if(HAVE_FSEEKO)
+    set(HAVE_DECL_FSEEKO 1)
   endif()
 endif()
 
-# TODO test which of these headers are required
-if(WIN32)
-  set(CURL_PULL_WS2TCPIP_H ${HAVE_WS2TCPIP_H})
-else()
-  set(CURL_PULL_SYS_TYPES_H ${HAVE_SYS_TYPES_H})
-  set(CURL_PULL_SYS_SOCKET_H ${HAVE_SYS_SOCKET_H})
-  set(CURL_PULL_SYS_POLL_H ${HAVE_SYS_POLL_H})
+# Include this header to get the type
+cmake_push_check_state()
+list(APPEND CMAKE_REQUIRED_INCLUDES "${PROJECT_SOURCE_DIR}/include")
+list(APPEND CMAKE_EXTRA_INCLUDE_FILES "curl/system.h")
+check_type_size("curl_off_t" SIZEOF_CURL_OFF_T)
+list(APPEND CMAKE_EXTRA_INCLUDE_FILES "curl/curl.h")
+check_type_size("curl_socket_t" SIZEOF_CURL_SOCKET_T)
+cmake_pop_check_state()  # pop curl system headers
+cmake_pop_check_state()  # pop -D_FILE_OFFSET_BITS=64
+
+if(NOT WIN32 AND NOT CMAKE_CROSSCOMPILING)
+  # On non-Windows and not cross-compiling, check for writable argv[]
+  include(CheckCSourceRuns)
+  check_c_source_runs("
+    int main(int argc, char **argv)
+    {
+      (void)argc;
+      argv[0][0] = ' ';
+      return (argv[0][0] == ' ') ? 0 : 1;
+    }" HAVE_WRITABLE_ARGV)
+endif()
+
+if(NOT CMAKE_CROSSCOMPILING)
+  include(CheckCSourceRuns)
+  check_c_source_runs("
+    #include <time.h>
+    int main(void) {
+      time_t t = -1;
+      return t < 0;
+    }" HAVE_TIME_T_UNSIGNED)
+endif()
+
+curl_internal_test(HAVE_GLIBC_STRERROR_R)
+curl_internal_test(HAVE_POSIX_STRERROR_R)
+
+if(NOT WIN32)
+  curl_internal_test(HAVE_CLOCK_GETTIME_MONOTONIC)  # Check clock_gettime(CLOCK_MONOTONIC, x) support
+endif()
+
+if(APPLE)
+  curl_internal_test(HAVE_BUILTIN_AVAILABLE)  # Check compiler support of __builtin_available()
+endif()
+
+# Some other minor tests
+
+if(_cmake_try_compile_target_type_save)
+  set(CMAKE_TRY_COMPILE_TARGET_TYPE ${_cmake_try_compile_target_type_save})
+  unset(_cmake_try_compile_target_type_save)
 endif()
 
 include(CMake/OtherTests.cmake)
 
-add_definitions(-DHAVE_CONFIG_H)
+set_property(DIRECTORY APPEND PROPERTY COMPILE_DEFINITIONS "HAVE_CONFIG_H")
 
-# For Windows, all compilers used by CMake should support large files
 if(WIN32)
-  set(USE_WIN32_LARGE_FILES ON)
-
-  # Use the manifest embedded in the Windows Resource
-  set(CMAKE_RC_FLAGS "${CMAKE_RC_FLAGS} -DCURL_EMBED_MANIFEST")
+  list(APPEND CURL_NETWORK_AND_TIME_LIBS "ws2_32")
+  if(NOT WINDOWS_STORE)
+    list(APPEND CURL_NETWORK_AND_TIME_LIBS "iphlpapi")  # for if_nametoindex()
+  endif()
+  list(APPEND CURL_LIBS "bcrypt")  # for BCryptGenRandom()
 
   # We use crypto functions that are not available for UWP apps
   if(NOT WINDOWS_STORE)
@@ -1353,216 +1855,247 @@ if(WIN32)
 
   # Link required libraries for USE_WIN32_CRYPTO or USE_SCHANNEL
   if(USE_WIN32_CRYPTO OR USE_SCHANNEL)
-    list(APPEND CURL_LIBS "advapi32" "crypt32")
+    # for CryptAcquireContext(), CryptCreateHash(), CryptDestroyHash(), CryptGetHashParam(), CryptHashData(),
+    #     CryptReleaseContext() in NTLM, md4, md5, sha256, Schannel
+    # for CryptDestroyKey(), CryptEncrypt(), CryptImportKey() in NTLM
+    list(APPEND CURL_LIBS "advapi32")
+    # for Cert*() in openssl.c Native CA, Schannel
+    # for CryptDecodeObjectEx(), CryptQueryObject(), CryptStringToBinary(), PFXImportCertStore() in Schannel
+    list(APPEND CURL_LIBS "crypt32")
   endif()
-
-  if(NOT HAVE_MINGW_ORIGINAL)
-    list(APPEND CURL_LIBS "bcrypt")
-  else()
-    set(HAVE_FTRUNCATE OFF)
+  if(USE_WINDOWS_SSPI)
+    list(APPEND CURL_LIBS "secur32")  # for InitSecurityInterface()
   endif()
 endif()
 
-if(MSVC)
-  # Disable default manifest added by CMake
-  set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} /MANIFEST:NO")
+list(APPEND CURL_LIBS ${CURL_NETWORK_AND_TIME_LIBS})
+if(CURL_CODE_COVERAGE)
+  list(APPEND CURL_LIBS ${CURL_COVERAGE_LIBS})
+endif()
 
-  add_definitions(-D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE)
-  if(CMAKE_C_FLAGS MATCHES "/W[0-4]")
-    string(REGEX REPLACE "/W[0-4]" "/W4" CMAKE_C_FLAGS "${CMAKE_C_FLAGS}")
-  else()
-    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} /W4")
+# Hack to add some libraries to the end of the library list to make binutils ld
+# for GCC find symbols when linking statically. Necessary for libs detected via
+# CMake's built-in find modules, which CMake adds to the beginning of the lib
+# list on the linker command-line for some reason. This makes them appear
+# before dependencies detected via curl's custom Find modules, and breaks
+# linkers sensitive to lib order. There must be a better solution to this.
+# Enable the workaround for all compilers, to make it available when using GCC
+# to consume libcurl, regardless of the compiler used to build libcurl itself.
+if(CMAKE_C_COMPILER_ID STREQUAL "GNU")
+  if(USE_OPENSSL AND TARGET OpenSSL::Crypto)
+    add_library(CURL::OpenSSL_Crypto INTERFACE IMPORTED)
+    set_target_properties(CURL::OpenSSL_Crypto PROPERTIES INTERFACE_LINK_LIBRARIES OpenSSL::Crypto)
+    list(APPEND CURL_LIBS CURL::OpenSSL_Crypto)
   endif()
-
-  # Use multithreaded compilation on VS 2008+
-  if(MSVC_VERSION GREATER_EQUAL 1500)
-    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} /MP")
+  if(HAVE_LIBZ AND TARGET ZLIB::ZLIB)
+    add_library(CURL::ZLIB INTERFACE IMPORTED)
+    set_target_properties(CURL::ZLIB PROPERTIES INTERFACE_LINK_LIBRARIES ZLIB::ZLIB)
+    list(APPEND CURL_LIBS CURL::ZLIB)
+  endif()
+  if(WIN32)
+    add_library(CURL::win32_winsock INTERFACE IMPORTED)
+    set_target_properties(CURL::win32_winsock PROPERTIES INTERFACE_LINK_LIBRARIES "ws2_32")
+    list(APPEND CURL_LIBS CURL::win32_winsock)
   endif()
 endif()
 
-if(CURL_WERROR)
-  if(MSVC_VERSION)
-    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} /WX")
-  else()
-    # this assumes clang or gcc style options
-    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Werror")
-  endif()
+if(CMAKE_C_COMPILER_ID STREQUAL "MSVC")  # MSVC but exclude clang-cl
+  set_property(DIRECTORY APPEND PROPERTY COMPILE_OPTIONS "-MP")  # Parallel compilation
 endif()
 
 if(CURL_LTO)
-  if(CMAKE_VERSION VERSION_LESS 3.9)
-    message(FATAL_ERROR "Requested LTO but your cmake version ${CMAKE_VERSION} is to old. You need at least 3.9")
-  endif()
-
-  cmake_policy(SET CMP0069 NEW)
-
   include(CheckIPOSupported)
-  check_ipo_supported(RESULT CURL_HAS_LTO OUTPUT CURL_LTO_ERROR LANGUAGES C)
+  check_ipo_supported(RESULT CURL_HAS_LTO OUTPUT _lto_error LANGUAGES C)
   if(CURL_HAS_LTO)
     message(STATUS "LTO supported and enabled")
   else()
-    message(FATAL_ERROR "LTO was requested - but compiler doesn't support it\n${CURL_LTO_ERROR}")
+    message(FATAL_ERROR "LTO has been requested, but the compiler does not support it\n${_lto_error}")
   endif()
 endif()
 
+# Ugly (but functional) way to include "Makefile.inc" by transforming it
+# (= regenerate it).
+function(curl_transform_makefile_inc _input_file _output_file)
+  file(READ ${_input_file} _makefile_inc_text)
+  string(REPLACE "$(top_srcdir)"   "\${PROJECT_SOURCE_DIR}" _makefile_inc_text ${_makefile_inc_text})  # cmake-lint: disable=W0106
+  string(REPLACE "$(top_builddir)" "\${PROJECT_BINARY_DIR}" _makefile_inc_text ${_makefile_inc_text})  # cmake-lint: disable=W0106
 
-# Ugly (but functional) way to include "Makefile.inc" by transforming it (= regenerate it).
-function(transform_makefile_inc INPUT_FILE OUTPUT_FILE)
-  file(READ ${INPUT_FILE} MAKEFILE_INC_TEXT)
-  string(REPLACE "$(top_srcdir)"   "\${CURL_SOURCE_DIR}" MAKEFILE_INC_TEXT ${MAKEFILE_INC_TEXT})
-  string(REPLACE "$(top_builddir)" "\${CURL_BINARY_DIR}" MAKEFILE_INC_TEXT ${MAKEFILE_INC_TEXT})
+  string(REGEX REPLACE "\\\\\n" "!^!^!" _makefile_inc_text ${_makefile_inc_text})
+  string(REGEX REPLACE "([a-zA-Z_][a-zA-Z0-9_]*)[\t ]*=[\t ]*([^\n]*)" "set(\\1 \\2)" _makefile_inc_text ${_makefile_inc_text})
+  string(REPLACE "!^!^!" "\n" _makefile_inc_text ${_makefile_inc_text})
 
-  string(REGEX REPLACE "\\\\\n" "!π!α!" MAKEFILE_INC_TEXT ${MAKEFILE_INC_TEXT})
-  string(REGEX REPLACE "([a-zA-Z_][a-zA-Z0-9_]*)[\t ]*=[\t ]*([^\n]*)" "SET(\\1 \\2)" MAKEFILE_INC_TEXT ${MAKEFILE_INC_TEXT})
-  string(REPLACE "!π!α!" "\n" MAKEFILE_INC_TEXT ${MAKEFILE_INC_TEXT})
+  # Replace $() with ${}
+  string(REGEX REPLACE "\\$\\(([a-zA-Z_][a-zA-Z0-9_]*)\\)" "\${\\1}" _makefile_inc_text ${_makefile_inc_text})
+  # Replace @@ with ${}, even if that may not be read by CMake scripts.
+  string(REGEX REPLACE "@([a-zA-Z_][a-zA-Z0-9_]*)@" "\${\\1}" _makefile_inc_text ${_makefile_inc_text})
 
-  string(REGEX REPLACE "\\$\\(([a-zA-Z_][a-zA-Z0-9_]*)\\)" "\${\\1}" MAKEFILE_INC_TEXT ${MAKEFILE_INC_TEXT})    # Replace $() with ${}
-  string(REGEX REPLACE "@([a-zA-Z_][a-zA-Z0-9_]*)@" "\${\\1}" MAKEFILE_INC_TEXT ${MAKEFILE_INC_TEXT})    # Replace @@ with ${}, even if that may not be read by CMake scripts.
-  file(WRITE ${OUTPUT_FILE} ${MAKEFILE_INC_TEXT})
-  set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS "${INPUT_FILE}")
+  file(WRITE ${_output_file} ${_makefile_inc_text})
+  set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS "${_input_file}")
 endfunction()
 
 include(GNUInstallDirs)
 
-set(CURL_INSTALL_CMAKE_DIR ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME})
+set(_install_cmake_dir "${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}")
 set(TARGETS_EXPORT_NAME "${PROJECT_NAME}Targets")
-set(generated_dir "${CMAKE_CURRENT_BINARY_DIR}/generated")
-set(project_config "${generated_dir}/${PROJECT_NAME}Config.cmake")
-set(version_config "${generated_dir}/${PROJECT_NAME}ConfigVersion.cmake")
+set(_generated_dir "${CMAKE_CURRENT_BINARY_DIR}/generated")
+set(_project_config "${_generated_dir}/${PROJECT_NAME}Config.cmake")
+set(_version_config "${_generated_dir}/${PROJECT_NAME}ConfigVersion.cmake")
 
-if(USE_MANUAL)
+option(BUILD_TESTING "Build tests" ON)
+if(BUILD_TESTING AND Perl_FOUND)
+  set(CURL_BUILD_TESTING ON)
+else()
+  set(CURL_BUILD_TESTING OFF)
+endif()
+
+if(Perl_FOUND)
+  set(CURL_MANPAGE "${PROJECT_BINARY_DIR}/docs/cmdline-opts/curl.1")
+  set(CURL_ASCIIPAGE "${PROJECT_BINARY_DIR}/docs/cmdline-opts/curl.txt")
   add_subdirectory(docs)
 endif()
 
+add_subdirectory(scripts)  # for shell completions
+
 add_subdirectory(lib)
 
 if(BUILD_CURL_EXE)
   add_subdirectory(src)
 endif()
 
-cmake_dependent_option(BUILD_TESTING "Build tests"
-  ON "PERL_FOUND;NOT CURL_DISABLE_TESTS"
-  OFF)
-if(BUILD_TESTING)
+option(BUILD_EXAMPLES "Build libcurl examples" ON)
+if(BUILD_EXAMPLES)
+  add_subdirectory(docs/examples)
+endif()
+
+if(CURL_BUILD_TESTING)
   add_subdirectory(tests)
 endif()
 
-# Helper to populate a list (_items) with a label when conditions (the remaining
-# args) are satisfied
-macro(_add_if label)
-  # needs to be a macro to allow this indirection
+# Helper to populate a list (_items) with a label when conditions
+# (the remaining args) are satisfied
+macro(curl_add_if _label)
+  # Needs to be a macro to allow this indirection
   if(${ARGN})
-    set(_items ${_items} "${label}")
+    list(APPEND _items "${_label}")
   endif()
 endmacro()
 
-# NTLM support requires crypto function adaptions from various SSL libs
-# TODO alternative SSL libs tests for SSP1, GNUTLS, NSS
-if(NOT (CURL_DISABLE_NTLM) AND
-    (USE_OPENSSL OR USE_MBEDTLS OR USE_DARWINSSL OR USE_WIN32_CRYPTO OR USE_GNUTLS))
-  set(use_curl_ntlm_core ON)
+# NTLM support requires crypto functions from various SSL libs.
+# These conditions must match those in lib/curl_setup.h.
+if(CURL_ENABLE_NTLM AND
+   ((USE_OPENSSL AND HAVE_DES_ECB_ENCRYPT) OR
+    (USE_MBEDTLS AND HAVE_MBEDTLS_DES_CRYPT_ECB) OR
+    USE_GNUTLS OR
+    USE_WIN32_CRYPTO OR
+    (USE_WOLFSSL AND HAVE_WC_DES_ECBENCRYPT)))
+  set(_use_curl_ntlm_core ON)
 endif()
 
-# Clear list and try to detect available features
-set(_items)
-_add_if("SSL"           SSL_ENABLED)
-_add_if("IPv6"          ENABLE_IPV6)
-_add_if("unixsockets"   USE_UNIX_SOCKETS)
-_add_if("libz"          HAVE_LIBZ)
-_add_if("brotli"        HAVE_BROTLI)
-_add_if("zstd"          HAVE_ZSTD)
-_add_if("AsynchDNS"     USE_ARES OR USE_THREADS_POSIX OR USE_THREADS_WIN32)
-_add_if("IDN"           HAVE_LIBIDN2 OR USE_WIN32_IDN)
-_add_if("Largefile"     (SIZEOF_CURL_OFF_T GREATER 4) AND
-                        ((SIZEOF_OFF_T GREATER 4) OR USE_WIN32_LARGE_FILES))
-# TODO SSP1 (Schannel) check is missing
-_add_if("SSPI"          USE_WINDOWS_SSPI)
-_add_if("GSS-API"       HAVE_GSSAPI)
-_add_if("alt-svc"       NOT CURL_DISABLE_ALTSVC)
-_add_if("HSTS"          NOT CURL_DISABLE_HSTS)
-# TODO SSP1 missing for SPNEGO
-_add_if("SPNEGO"        NOT CURL_DISABLE_NEGOTIATE_AUTH AND
-                        (HAVE_GSSAPI OR USE_WINDOWS_SSPI))
-_add_if("Kerberos"      NOT CURL_DISABLE_KERBEROS_AUTH AND
-                        (HAVE_GSSAPI OR USE_WINDOWS_SSPI))
-# NTLM support requires crypto function adaptions from various SSL libs
-# TODO alternative SSL libs tests for SSP1, GNUTLS, NSS
-_add_if("NTLM"          NOT (CURL_DISABLE_NTLM) AND
-                        (use_curl_ntlm_core OR USE_WINDOWS_SSPI))
-# TODO missing option (autoconf: --enable-ntlm-wb)
-_add_if("NTLM_WB"       NOT (CURL_DISABLE_NTLM) AND
-                        (use_curl_ntlm_core OR USE_WINDOWS_SSPI) AND
-                        NOT CURL_DISABLE_HTTP AND NTLM_WB_ENABLED)
-# TODO missing option (--enable-tls-srp), depends on GNUTLS_SRP/OPENSSL_SRP
-_add_if("TLS-SRP"       USE_TLS_SRP)
-# TODO option --with-nghttp2 tests for nghttp2 lib and nghttp2/nghttp2.h header
-_add_if("HTTP2"         USE_NGHTTP2)
-_add_if("HTTP3"         USE_NGTCP2 OR USE_QUICHE)
-_add_if("MultiSSL"      CURL_WITH_MULTI_SSL)
-# TODO wolfSSL only support this from v5.0.0 onwards
-_add_if("HTTPS-proxy"   SSL_ENABLED AND (USE_OPENSSL OR USE_GNUTLS
-                        OR USE_SCHANNEL OR USE_RUSTLS OR USE_BEARSSL OR
-                        USE_MBEDTLS OR USE_SECTRANSP))
-_add_if("unicode"       ENABLE_UNICODE)
-_add_if("threadsafe"    HAVE_ATOMIC OR (WIN32 AND
-                        HAVE_WIN32_WINNT GREATER_EQUAL 0x600))
-_add_if("PSL"           USE_LIBPSL)
-string(REPLACE ";" " " SUPPORT_FEATURES "${_items}")
-message(STATUS "Enabled features: ${SUPPORT_FEATURES}")
-
 # Clear list and try to detect available protocols
-set(_items)
-_add_if("HTTP"          NOT CURL_DISABLE_HTTP)
-_add_if("HTTPS"         NOT CURL_DISABLE_HTTP AND SSL_ENABLED)
-_add_if("FTP"           NOT CURL_DISABLE_FTP)
-_add_if("FTPS"          NOT CURL_DISABLE_FTP AND SSL_ENABLED)
-_add_if("FILE"          NOT CURL_DISABLE_FILE)
-_add_if("TELNET"        NOT CURL_DISABLE_TELNET)
-_add_if("LDAP"          NOT CURL_DISABLE_LDAP)
+set(_items "")
+curl_add_if("HTTP"          NOT CURL_DISABLE_HTTP)
+curl_add_if("HTTPS"         NOT CURL_DISABLE_HTTP AND _ssl_enabled)
+curl_add_if("FTP"           NOT CURL_DISABLE_FTP)
+curl_add_if("FTPS"          NOT CURL_DISABLE_FTP AND _ssl_enabled)
+curl_add_if("FILE"          NOT CURL_DISABLE_FILE)
+curl_add_if("TELNET"        NOT CURL_DISABLE_TELNET)
+curl_add_if("LDAP"          NOT CURL_DISABLE_LDAP)
 # CURL_DISABLE_LDAP implies CURL_DISABLE_LDAPS
-# TODO check HAVE_LDAP_SSL (in autoconf this is enabled with --enable-ldaps)
-_add_if("LDAPS"         NOT CURL_DISABLE_LDAPS AND
-                        ((USE_OPENLDAP AND SSL_ENABLED) OR
-                        (NOT USE_OPENLDAP AND HAVE_LDAP_SSL)))
-_add_if("DICT"          NOT CURL_DISABLE_DICT)
-_add_if("TFTP"          NOT CURL_DISABLE_TFTP)
-_add_if("GOPHER"        NOT CURL_DISABLE_GOPHER)
-_add_if("GOPHERS"       NOT CURL_DISABLE_GOPHER AND SSL_ENABLED)
-_add_if("POP3"          NOT CURL_DISABLE_POP3)
-_add_if("POP3S"         NOT CURL_DISABLE_POP3 AND SSL_ENABLED)
-_add_if("IMAP"          NOT CURL_DISABLE_IMAP)
-_add_if("IMAPS"         NOT CURL_DISABLE_IMAP AND SSL_ENABLED)
-_add_if("SMB"           NOT CURL_DISABLE_SMB AND
-                        use_curl_ntlm_core AND (SIZEOF_CURL_OFF_T GREATER 4))
-_add_if("SMBS"          NOT CURL_DISABLE_SMB AND SSL_ENABLED AND
-                        use_curl_ntlm_core AND (SIZEOF_CURL_OFF_T GREATER 4))
-_add_if("SMTP"          NOT CURL_DISABLE_SMTP)
-_add_if("SMTPS"         NOT CURL_DISABLE_SMTP AND SSL_ENABLED)
-_add_if("SCP"           USE_LIBSSH2 OR USE_LIBSSH)
-_add_if("SFTP"          USE_LIBSSH2 OR USE_LIBSSH)
-_add_if("RTSP"          NOT CURL_DISABLE_RTSP)
-_add_if("RTMP"          USE_LIBRTMP)
-_add_if("MQTT"          NOT CURL_DISABLE_MQTT)
-_add_if("WS"            USE_WEBSOCKETS)
-_add_if("WSS"           USE_WEBSOCKETS)
+curl_add_if("LDAPS"         NOT CURL_DISABLE_LDAPS AND
+                            ((USE_OPENLDAP AND _ssl_enabled) OR
+                            (NOT USE_OPENLDAP AND HAVE_LDAP_SSL)))
+curl_add_if("DICT"          NOT CURL_DISABLE_DICT)
+curl_add_if("TFTP"          NOT CURL_DISABLE_TFTP)
+curl_add_if("GOPHER"        NOT CURL_DISABLE_GOPHER)
+curl_add_if("GOPHERS"       NOT CURL_DISABLE_GOPHER AND _ssl_enabled)
+curl_add_if("POP3"          NOT CURL_DISABLE_POP3)
+curl_add_if("POP3S"         NOT CURL_DISABLE_POP3 AND _ssl_enabled)
+curl_add_if("IMAP"          NOT CURL_DISABLE_IMAP)
+curl_add_if("IMAPS"         NOT CURL_DISABLE_IMAP AND _ssl_enabled)
+curl_add_if("SMB"           CURL_ENABLE_SMB AND
+                            _use_curl_ntlm_core AND (SIZEOF_CURL_OFF_T GREATER 4))
+curl_add_if("SMBS"          CURL_ENABLE_SMB AND _ssl_enabled AND
+                            _use_curl_ntlm_core AND (SIZEOF_CURL_OFF_T GREATER 4))
+curl_add_if("SMTP"          NOT CURL_DISABLE_SMTP)
+curl_add_if("SMTPS"         NOT CURL_DISABLE_SMTP AND _ssl_enabled)
+curl_add_if("SCP"           USE_LIBSSH2 OR USE_LIBSSH)
+curl_add_if("SFTP"          USE_LIBSSH2 OR USE_LIBSSH)
+curl_add_if("IPFS"          NOT CURL_DISABLE_IPFS)
+curl_add_if("IPNS"          NOT CURL_DISABLE_IPFS)
+curl_add_if("RTSP"          NOT CURL_DISABLE_RTSP)
+curl_add_if("MQTT"          NOT CURL_DISABLE_MQTT)
+curl_add_if("MQTTS"         NOT CURL_DISABLE_MQTT AND _ssl_enabled)
+curl_add_if("WS"            NOT CURL_DISABLE_WEBSOCKETS)
+curl_add_if("WSS"           NOT CURL_DISABLE_WEBSOCKETS AND _ssl_enabled)
 if(_items)
   list(SORT _items)
 endif()
+set(CURL_SUPPORTED_PROTOCOLS_LIST "${_items}")
 string(REPLACE ";" " " SUPPORT_PROTOCOLS "${_items}")
-message(STATUS "Enabled protocols: ${SUPPORT_PROTOCOLS}")
+string(TOLOWER "${SUPPORT_PROTOCOLS}" _support_protocols_lower)
+message(STATUS "Protocols: ${_support_protocols_lower}")
+
+# Clear list and try to detect available features
+set(_items "")
+curl_add_if("SSL"           _ssl_enabled)
+curl_add_if("IPv6"          USE_IPV6)
+curl_add_if("UnixSockets"   USE_UNIX_SOCKETS)
+curl_add_if("libz"          HAVE_LIBZ)
+curl_add_if("brotli"        HAVE_BROTLI)
+curl_add_if("gsasl"         USE_GSASL)
+curl_add_if("zstd"          HAVE_ZSTD)
+curl_add_if("AsynchDNS"     USE_RESOLV_ARES OR USE_RESOLV_THREADED)
+curl_add_if("asyn-rr"       USE_ARES AND USE_RESOLV_THREADED AND USE_HTTPSRR)
+curl_add_if("IDN"           (HAVE_LIBIDN2 AND HAVE_IDN2_H) OR
+                            USE_WIN32_IDN OR
+                            USE_APPLE_IDN)
+curl_add_if("Largefile"     (SIZEOF_CURL_OFF_T GREATER 4) AND ((SIZEOF_OFF_T GREATER 4) OR WIN32))
+curl_add_if("SSPI"          USE_WINDOWS_SSPI)
+curl_add_if("GSS-API"       HAVE_GSSAPI)
+curl_add_if("alt-svc"       NOT CURL_DISABLE_ALTSVC)
+curl_add_if("HSTS"          NOT CURL_DISABLE_HSTS)
+curl_add_if("SPNEGO"        NOT CURL_DISABLE_NEGOTIATE_AUTH AND
+                            (HAVE_GSSAPI OR USE_WINDOWS_SSPI))
+curl_add_if("Kerberos"      NOT CURL_DISABLE_KERBEROS_AUTH AND
+                            (HAVE_GSSAPI OR USE_WINDOWS_SSPI))
+curl_add_if("NTLM"          CURL_ENABLE_NTLM AND
+                            (_use_curl_ntlm_core OR USE_WINDOWS_SSPI))
+curl_add_if("TLS-SRP"       USE_TLS_SRP)
+curl_add_if("HTTP2"         USE_NGHTTP2)
+curl_add_if("HTTP3"         USE_NGTCP2 OR USE_QUICHE)
+curl_add_if("proxy-HTTP3"   USE_PROXY_HTTP3)
+curl_add_if("MultiSSL"      CURL_WITH_MULTI_SSL)
+curl_add_if("HTTPS-proxy"   NOT CURL_DISABLE_PROXY AND _ssl_enabled AND (USE_OPENSSL OR USE_GNUTLS
+                            OR USE_SCHANNEL OR USE_RUSTLS OR USE_MBEDTLS OR
+                            (USE_WOLFSSL AND HAVE_WOLFSSL_BIO_NEW)))
+curl_add_if("Unicode"       ENABLE_UNICODE)
+curl_add_if("threadsafe"    HAVE_ATOMIC OR HAVE_THREADS_POSIX OR WIN32)
+curl_add_if("Debug"         ENABLE_DEBUG)
+curl_add_if("ECH"           _ssl_enabled AND HAVE_ECH)
+curl_add_if("HTTPSRR"       _ssl_enabled AND USE_HTTPSRR)
+curl_add_if("PSL"           USE_LIBPSL)
+curl_add_if("CAcert"        CURL_CA_EMBED_SET)
+curl_add_if("SSLS-EXPORT"   _ssl_enabled AND USE_SSLS_EXPORT)
+curl_add_if("AppleSecTrust" USE_APPLE_SECTRUST AND _ssl_enabled AND (USE_OPENSSL OR USE_GNUTLS))
+curl_add_if("NativeCA"      NOT USE_APPLE_SECTRUST AND _ssl_enabled AND CURL_CA_NATIVE)
+if(_items)
+  list(SORT _items CASE INSENSITIVE)
+endif()
+set(CURL_SUPPORTED_FEATURES_LIST "${_items}")
+string(REPLACE ";" " " SUPPORT_FEATURES "${_items}")
+message(STATUS "Features: ${SUPPORT_FEATURES}")
 
 # Clear list and collect SSL backends
-set(_items)
-_add_if("Schannel"         SSL_ENABLED AND USE_SCHANNEL)
-_add_if("OpenSSL"          SSL_ENABLED AND USE_OPENSSL)
-_add_if("Secure Transport" SSL_ENABLED AND USE_SECTRANSP)
-_add_if("mbedTLS"          SSL_ENABLED AND USE_MBEDTLS)
-_add_if("BearSSL"          SSL_ENABLED AND USE_BEARSSL)
-_add_if("wolfSSL"          SSL_ENABLED AND USE_WOLFSSL)
-_add_if("GnuTLS"           SSL_ENABLED AND USE_GNUTLS)
+set(_items "")
+curl_add_if("Schannel"         _ssl_enabled AND USE_SCHANNEL)
+curl_add_if("${_openssl}"      _ssl_enabled AND USE_OPENSSL)
+curl_add_if("mbedTLS"          _ssl_enabled AND USE_MBEDTLS)
+curl_add_if("wolfSSL"          _ssl_enabled AND USE_WOLFSSL)
+curl_add_if("GnuTLS"           _ssl_enabled AND USE_GNUTLS)
+curl_add_if("Rustls"           _ssl_enabled AND USE_RUSTLS)
 
 if(_items)
-  list(SORT _items)
+  list(SORT _items CASE INSENSITIVE)
 endif()
 string(REPLACE ";" " " SSL_BACKENDS "${_items}")
 message(STATUS "Enabled SSL backends: ${SSL_BACKENDS}")
@@ -1570,137 +2103,404 @@ if(CURL_DEFAULT_SSL_BACKEND)
   message(STATUS "Default SSL backend: ${CURL_DEFAULT_SSL_BACKEND}")
 endif()
 
-# curl-config needs the following options to be set.
-set(CC                      "${CMAKE_C_COMPILER}")
-# TODO probably put a -D... options here?
-set(CONFIGURE_OPTIONS       "")
-set(CURLVERSION             "${CURL_VERSION}")
-set(exec_prefix             "\${prefix}")
-set(includedir              "\${prefix}/include")
-set(LDFLAGS                 "${CMAKE_SHARED_LINKER_FLAGS}")
-set(LIBCURL_LIBS            "")
-set(libdir                  "${CMAKE_INSTALL_PREFIX}/lib")
-foreach(_lib ${CMAKE_C_IMPLICIT_LINK_LIBRARIES} ${CURL_LIBS})
-  if(TARGET "${_lib}")
-    set(_libname "${_lib}")
-    get_target_property(_imported "${_libname}" IMPORTED)
-    if(NOT _imported)
-      # Reading the LOCATION property on non-imported target will error out.
-      # Assume the user won't need this information in the .pc file.
-      continue()
-    endif()
-    get_target_property(_lib "${_libname}" LOCATION)
-    if(NOT _lib)
-      message(WARNING "Bad lib in library list: ${_libname}")
-      continue()
-    endif()
-  endif()
-  if(_lib MATCHES ".*/.*" OR _lib MATCHES "^-")
-    set(LIBCURL_LIBS          "${LIBCURL_LIBS} ${_lib}")
+if(NOT CURL_DISABLE_INSTALL)
+
+  # curl-config needs the following options to be set.
+  set(CC                      "${CMAKE_C_COMPILER}")
+  set(CONFIGURE_OPTIONS       "")
+  set(CURLVERSION             "${_curl_version}")
+  set(VERSIONNUM              "${_curl_version_num}")
+  set(prefix                  "${CMAKE_INSTALL_PREFIX}")
+  set(exec_prefix             "\${prefix}")
+  if(IS_ABSOLUTE ${CMAKE_INSTALL_INCLUDEDIR})
+    set(includedir            "${CMAKE_INSTALL_INCLUDEDIR}")
   else()
-    set(LIBCURL_LIBS          "${LIBCURL_LIBS} -l${_lib}")
+    set(includedir            "\${prefix}/${CMAKE_INSTALL_INCLUDEDIR}")
   endif()
-endforeach()
-if(BUILD_SHARED_LIBS)
-  set(ENABLE_SHARED         "yes")
-  set(LIBCURL_NO_SHARED     "")
-  set(CPPFLAG_CURL_STATICLIB "")
-else()
-  set(ENABLE_SHARED         "no")
-  set(LIBCURL_NO_SHARED     "${LIBCURL_LIBS}")
-  set(CPPFLAG_CURL_STATICLIB "-DCURL_STATICLIB")
-endif()
-if(BUILD_STATIC_LIBS)
-  set(ENABLE_STATIC         "yes")
-else()
-  set(ENABLE_STATIC         "no")
-endif()
-# "a" (Linux) or "lib" (Windows)
-string(REPLACE "." "" libext "${CMAKE_STATIC_LIBRARY_SUFFIX}")
-set(prefix                  "${CMAKE_INSTALL_PREFIX}")
-# Set this to "yes" to append all libraries on which -lcurl is dependent
-set(REQUIRE_LIB_DEPS        "no")
-# SUPPORT_FEATURES
-# SUPPORT_PROTOCOLS
-set(VERSIONNUM              "${CURL_VERSION_NUM}")
+  if(IS_ABSOLUTE ${CMAKE_INSTALL_LIBDIR})
+    set(libdir                "${CMAKE_INSTALL_LIBDIR}")
+  else()
+    set(libdir                "\${exec_prefix}/${CMAKE_INSTALL_LIBDIR}")
+  endif()
+  # "a" (Linux) or "lib" (Windows)
+  string(REPLACE "." "" libext "${CMAKE_STATIC_LIBRARY_SUFFIX}")
 
-# Finally generate a "curl-config" matching this config
-# Use:
-# * ENABLE_SHARED
-# * ENABLE_STATIC
-configure_file("${CURL_SOURCE_DIR}/curl-config.in"
-               "${CURL_BINARY_DIR}/curl-config" @ONLY)
-install(FILES "${CURL_BINARY_DIR}/curl-config"
-        DESTINATION ${CMAKE_INSTALL_BINDIR}
-        PERMISSIONS
-          OWNER_READ OWNER_WRITE OWNER_EXECUTE
-          GROUP_READ GROUP_EXECUTE
-          WORLD_READ WORLD_EXECUTE)
+  set(_ldflags "")
+  set(LIBCURL_PC_LIBS_PRIVATE "")
 
-# Finally generate a pkg-config file matching this config
-configure_file("${CURL_SOURCE_DIR}/libcurl.pc.in"
-               "${CURL_BINARY_DIR}/libcurl.pc" @ONLY)
-install(FILES "${CURL_BINARY_DIR}/libcurl.pc"
-        DESTINATION ${CMAKE_INSTALL_LIBDIR}/pkgconfig)
+  # Filter CMAKE_SHARED_LINKER_FLAGS for libs and libpaths
+  string(STRIP "${CMAKE_SHARED_LINKER_FLAGS}" _custom_ldflags)
+  string(REGEX REPLACE " +-([^ \\t;]*)" ";-\\1" _custom_ldflags "${_custom_ldflags}")
 
-# install headers
-install(DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}/include/curl"
+  set(_custom_libs "")
+  set(_custom_libdirs "")
+  foreach(_flag IN LISTS _custom_ldflags)
+    if(_flag MATCHES "^-l")
+      string(REGEX REPLACE "^-l" "" _flag "${_flag}")
+      list(APPEND _custom_libs "${_flag}")
+    elseif(_flag MATCHES "^-framework|^-F")
+      list(APPEND _custom_libs "${_flag}")
+    elseif(_flag MATCHES "^-L")
+      string(REGEX REPLACE "^-L" "" _flag "${_flag}")
+      list(APPEND _custom_libdirs "${_flag}")
+    elseif(_flag MATCHES "^--library-path=")
+      string(REGEX REPLACE "^--library-path=" "" _flag "${_flag}")
+      list(APPEND _custom_libdirs "${_flag}")
+    endif()
+  endforeach()
+
+  # Avoid getting unnecessary -L options for known system directories.
+  set(_sys_libdirs "${CMAKE_C_IMPLICIT_LINK_DIRECTORIES}")
+  foreach(_libdir IN LISTS CMAKE_SYSTEM_PREFIX_PATH)
+    if(_libdir MATCHES "/$")
+      string(APPEND _libdir "lib")
+    else()
+      string(APPEND _libdir "/lib")
+    endif()
+    if(IS_DIRECTORY "${_libdir}")
+      list(APPEND _sys_libdirs "${_libdir}")
+    endif()
+    if(DEFINED CMAKE_LIBRARY_ARCHITECTURE)
+      string(APPEND _libdir "/${CMAKE_LIBRARY_ARCHITECTURE}")
+      if(IS_DIRECTORY "${_libdir}")
+        list(APPEND _sys_libdirs "${_libdir}")
+      endif()
+    endif()
+  endforeach()
+
+  set(_implicit_libs "")
+  if(NOT MINGW AND NOT UNIX)
+    set(_implicit_libs "${CMAKE_C_IMPLICIT_LINK_LIBRARIES}")
+  endif()
+
+  set(_explicit_libdirs "")
+  set(LIBCURL_PC_REQUIRES_PRIVATE "")
+  set(LIBCURL_PC_LIBS_PRIVATE_LIST "")
+  foreach(_lib IN LISTS CURL_LIBS _custom_libs _implicit_libs)
+    if(TARGET "${_lib}")
+      set(_explicit_libs "")
+      get_target_property(_imported "${_lib}" IMPORTED)
+      if(NOT _imported)
+        # Reading the LOCATION property on non-imported target errors out.
+        # Assume the user does not need this information in the .pc file.
+        continue()
+      endif()
+      set(_libdirs "")
+      set(_libs "")
+      curl_collect_target_link_options("${_lib}")  # look into the target recursively
+      list(APPEND _explicit_libdirs ${_libdirs})
+      list(APPEND _explicit_libs ${_libs})
+      if(NOT _libs AND NOT _libdirs AND NOT _lib STREQUAL Threads::Threads)
+        message(WARNING "Bad lib in library list: ${_lib}")
+      endif()
+      if(_lib STREQUAL OpenSSL::SSL AND NOT HAVE_BORINGSSL)  # BoringSSL does not provide openssl.pc
+        set(_modules "openssl")
+      elseif(_lib STREQUAL ZLIB::ZLIB AND NOT ANDROID)  # Android does not provide zlib.pc
+        set(_modules "zlib")
+      else()
+        get_target_property(_modules "${_lib}" INTERFACE_LIBCURL_PC_MODULES)
+      endif()
+      if(_modules)
+        list(APPEND LIBCURL_PC_REQUIRES_PRIVATE "${_modules}")
+      endif()
+
+      foreach(_lib IN LISTS _explicit_libs)
+        if(_lib MATCHES "/")
+          # This gets a bit more complex, because we want to specify the
+          # directory separately, and only once per directory
+          if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.20)
+            cmake_path(GET _lib PARENT_PATH _libdir)
+            cmake_path(GET _lib STEM _libname)
+          else()
+            get_filename_component(_libdir "${_lib}" DIRECTORY)
+            get_filename_component(_libname "${_lib}" NAME_WE)
+          endif()
+          if(_libname MATCHES "^lib")
+            if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.20)
+              cmake_path(SET _libdir NORMALIZE "${_libdir}")
+            endif()
+            if(NOT _libdir IN_LIST _sys_libdirs)
+              list(APPEND _ldflags "-L${_libdir}")
+            endif()
+            string(REGEX REPLACE "^lib" "" _libname "${_libname}")
+            list(APPEND LIBCURL_PC_LIBS_PRIVATE "-l${_libname}")
+            list(APPEND LIBCURL_PC_LIBS_PRIVATE_LIST "${_lib}")
+          else()
+            list(APPEND LIBCURL_PC_LIBS_PRIVATE "${_lib}")
+            list(APPEND LIBCURL_PC_LIBS_PRIVATE_LIST "${_lib}")
+          endif()
+        elseif(_lib MATCHES "^-")  # '-option'
+          list(APPEND _ldflags "${_lib}")
+          list(APPEND LIBCURL_PC_LIBS_PRIVATE_LIST "${_lib}")
+        else()
+          list(APPEND LIBCURL_PC_LIBS_PRIVATE "-l${_lib}")
+          list(APPEND LIBCURL_PC_LIBS_PRIVATE_LIST "${_lib}")
+        endif()
+      endforeach()
+    elseif(_lib MATCHES "^-")  # '-framework <name>'
+      list(APPEND _ldflags "${_lib}")
+      list(APPEND LIBCURL_PC_LIBS_PRIVATE_LIST "${_lib}")
+    else()
+      list(APPEND LIBCURL_PC_LIBS_PRIVATE "-l${_lib}")
+      list(APPEND LIBCURL_PC_LIBS_PRIVATE_LIST "${_lib}")
+    endif()
+  endforeach()
+
+  foreach(_libdir IN LISTS _custom_libdirs _explicit_libdirs)
+    if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.20)
+      cmake_path(SET _libdir NORMALIZE "${_libdir}")
+    endif()
+    if(NOT _libdir IN_LIST _sys_libdirs)
+      list(APPEND _ldflags "-L${_libdir}")
+    endif()
+  endforeach()
+
+  list(REMOVE_DUPLICATES _ldflags)
+
+  if(LIBCURL_PC_REQUIRES_PRIVATE)
+    list(REMOVE_DUPLICATES LIBCURL_PC_REQUIRES_PRIVATE)
+    string(REPLACE ";" "," LIBCURL_PC_REQUIRES_PRIVATE "${LIBCURL_PC_REQUIRES_PRIVATE}")
+  endif()
+  if(LIBCURL_PC_LIBS_PRIVATE)
+    # Remove duplicates listed next to each other
+    set(_libs "")
+    set(_prev "")
+    foreach(_lib IN LISTS LIBCURL_PC_LIBS_PRIVATE)
+      if(NOT _prev STREQUAL _lib)
+        list(APPEND _libs "${_lib}")
+        set(_prev "${_lib}")
+      endif()
+    endforeach()
+    set(LIBCURL_PC_LIBS_PRIVATE "${_libs}")
+
+    string(REPLACE ";" " " LIBCURL_PC_LIBS_PRIVATE "${LIBCURL_PC_LIBS_PRIVATE}")
+  endif()
+  if(_ldflags)
+    list(REMOVE_DUPLICATES _ldflags)
+    string(REPLACE ";" " " _ldflags "${_ldflags}")
+    set(LIBCURL_PC_LDFLAGS_PRIVATE "${_ldflags}")
+    string(STRIP "${LIBCURL_PC_LDFLAGS_PRIVATE}" LIBCURL_PC_LDFLAGS_PRIVATE)
+  else()
+    set(LIBCURL_PC_LDFLAGS_PRIVATE "")
+  endif()
+  set(LIBCURL_PC_CFLAGS_PRIVATE "-DCURL_STATICLIB")
+
+  # Merge pkg-config private fields into public ones when static-only
+  if(BUILD_SHARED_LIBS)
+    set(ENABLE_SHARED       "yes")
+    set(LIBCURL_PC_REQUIRES "")
+    set(LIBCURL_PC_LIBS     "")
+    set(LIBCURL_PC_CFLAGS   "")
+  else()
+    set(ENABLE_SHARED       "no")
+    set(LIBCURL_PC_REQUIRES "${LIBCURL_PC_REQUIRES_PRIVATE}")
+    set(LIBCURL_PC_LIBS     "${LIBCURL_PC_LIBS_PRIVATE}")
+    set(LIBCURL_PC_CFLAGS   "${LIBCURL_PC_CFLAGS_PRIVATE}")
+  endif()
+  if(BUILD_STATIC_LIBS)
+    set(ENABLE_STATIC       "yes")
+  else()
+    set(ENABLE_STATIC       "no")
+  endif()
+
+  # Generate a "curl-config" matching this config.
+  # Consumed variables:
+  #   CC
+  #   CONFIGURE_OPTIONS
+  #   CURLVERSION
+  #   CURL_CA_BUNDLE
+  #   ENABLE_SHARED
+  #   ENABLE_STATIC
+  #   exec_prefix
+  #   includedir
+  #   LIBCURL_PC_CFLAGS
+  #   LIBCURL_PC_LDFLAGS_PRIVATE
+  #   LIBCURL_PC_LIBS_PRIVATE
+  #   libdir
+  #   libext
+  #   prefix
+  #   SSL_BACKENDS
+  #   SUPPORT_FEATURES
+  #   SUPPORT_PROTOCOLS
+  #   VERSIONNUM
+  configure_file(
+    "${PROJECT_SOURCE_DIR}/curl-config.in"
+    "${PROJECT_BINARY_DIR}/curl-config" @ONLY)
+  install(FILES "${PROJECT_BINARY_DIR}/curl-config"
+    DESTINATION ${CMAKE_INSTALL_BINDIR}
+    PERMISSIONS
+      OWNER_READ OWNER_WRITE OWNER_EXECUTE
+      GROUP_READ GROUP_EXECUTE
+      WORLD_READ WORLD_EXECUTE)
+
+  # Generate a pkg-config file matching this config.
+  # Consumed variables:
+  #   CURLVERSION
+  #   exec_prefix
+  #   includedir
+  #   LIBCURL_PC_CFLAGS
+  #   LIBCURL_PC_CFLAGS_PRIVATE
+  #   LIBCURL_PC_LDFLAGS_PRIVATE
+  #   LIBCURL_PC_LIBS
+  #   LIBCURL_PC_LIBS_PRIVATE
+  #   LIBCURL_PC_REQUIRES
+  #   LIBCURL_PC_REQUIRES_PRIVATE
+  #   libdir
+  #   prefix
+  #   SUPPORT_FEATURES
+  #   SUPPORT_PROTOCOLS
+  # Documentation:
+  #   https://people.freedesktop.org/~dbn/pkg-config-guide.html
+  #   https://manpages.debian.org/unstable/pkgconf/pkg-config.1.en.html
+  #   https://manpages.debian.org/unstable/pkg-config/pkg-config.1.en.html
+  #   https://www.msys2.org/docs/pkgconfig/
+  configure_file(
+    "${PROJECT_SOURCE_DIR}/libcurl.pc.in"
+    "${PROJECT_BINARY_DIR}/libcurl.pc" @ONLY)
+  install(FILES "${PROJECT_BINARY_DIR}/libcurl.pc"
+    DESTINATION "${CMAKE_INSTALL_LIBDIR}/pkgconfig")
+
+  # Install headers
+  install(DIRECTORY "${PROJECT_SOURCE_DIR}/include/curl"
     DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
     FILES_MATCHING PATTERN "*.h")
 
-include(CMakePackageConfigHelpers)
-write_basic_package_version_file(
-    "${version_config}"
-    VERSION ${CURL_VERSION}
-    COMPATIBILITY SameMajorVersion
-)
-file(READ "${version_config}" generated_version_config)
-file(WRITE "${version_config}"
-"if(NOT PACKAGE_FIND_VERSION_RANGE AND PACKAGE_FIND_VERSION_MAJOR STREQUAL \"7\")
-    # Version 8 satisfies version 7... requirements
-    set(PACKAGE_FIND_VERSION_MAJOR 8)
-    set(PACKAGE_FIND_VERSION_COUNT 1)
-endif()
-${generated_version_config}"
-)
+  include(CMakePackageConfigHelpers)
+  write_basic_package_version_file("${_version_config}"
+    VERSION ${_curl_version}
+    COMPATIBILITY SameMajorVersion)
+  file(READ "${_version_config}" _generated_version_config)
+  file(WRITE "${_version_config}" "
+    if(NOT PACKAGE_FIND_VERSION_RANGE AND PACKAGE_FIND_VERSION_MAJOR STREQUAL \"7\")
+      # Version 8 satisfies version 7... requirements
+      set(PACKAGE_FIND_VERSION_MAJOR 8)
+      set(PACKAGE_FIND_VERSION_COUNT 1)
+    endif()
+    ${_generated_version_config}")
 
-# Use:
-# * TARGETS_EXPORT_NAME
-# * PROJECT_NAME
-configure_package_config_file(CMake/curl-config.cmake.in
-        "${project_config}"
-        INSTALL_DESTINATION ${CURL_INSTALL_CMAKE_DIR}
-)
+  # Consumed custom variables:
+  #   CMAKE_MINIMUM_REQUIRED_VERSION
+  #   CURLVERSION
+  #   LIBCURL_PC_LIBS_PRIVATE_LIST
+  #   LIB_NAME
+  #   LIB_SELECTED
+  #   LIB_STATIC
+  #   TARGETS_EXPORT_NAME
+  #   CURL_SUPPORTED_FEATURES_LIST
+  #   CURL_SUPPORTED_PROTOCOLS_LIST
+  #   CURL_USE_CMAKECONFIG
+  #   CURL_USE_PKGCONFIG
+  #   HAVE_BROTLI
+  #   HAVE_GSSAPI
+  #   HAVE_LIBIDN2
+  #   HAVE_LIBZ ZLIB_VERSION_MAJOR
+  #   HAVE_THREADS_POSIX
+  #   HAVE_THREADS_POSIX_BORINGSSL
+  #   HAVE_ZSTD
+  #   USE_ARES
+  #   USE_BACKTRACE
+  #   USE_GNUTLS
+  #   USE_GSASL
+  #   USE_LIBPSL
+  #   USE_LIBSSH
+  #   USE_LIBSSH2
+  #   USE_LIBUV
+  #   USE_MBEDTLS
+  #   USE_NGHTTP2
+  #   USE_NGHTTP3
+  #   USE_NGTCP2 NGTCP2_CRYPTO_BACKEND
+  #   USE_OPENSSL OPENSSL_VERSION_MAJOR
+  #   USE_QUICHE
+  #   USE_RUSTLS
+  #   USE_WIN32_LDAP CURL_DISABLE_LDAP
+  #   USE_WOLFSSL
+  configure_package_config_file("CMake/curl-config.in.cmake"
+    "${_project_config}"
+    INSTALL_DESTINATION ${_install_cmake_dir}
+    PATH_VARS CMAKE_INSTALL_INCLUDEDIR)
 
-if(CURL_ENABLE_EXPORT_TARGET)
-  install(
-          EXPORT "${TARGETS_EXPORT_NAME}"
-          NAMESPACE "${PROJECT_NAME}::"
-          DESTINATION ${CURL_INSTALL_CMAKE_DIR}
-  )
-endif()
-
-install(
-        FILES ${version_config} ${project_config}
-        DESTINATION ${CURL_INSTALL_CMAKE_DIR}
-)
-
-# Workaround for MSVS10 to avoid the Dialog Hell
-# FIXME: This could be removed with future version of CMake.
-if(MSVC_VERSION EQUAL 1600)
-  set(CURL_SLN_FILENAME "${CMAKE_CURRENT_BINARY_DIR}/CURL.sln")
-  if(EXISTS "${CURL_SLN_FILENAME}")
-    file(APPEND "${CURL_SLN_FILENAME}" "\n# This should be regenerated!\n")
+  if(CURL_ENABLE_EXPORT_TARGET)
+    install(EXPORT "${TARGETS_EXPORT_NAME}"
+      NAMESPACE "${PROJECT_NAME}::"
+      DESTINATION ${_install_cmake_dir})
   endif()
+
+  install(
+    FILES
+      ${_version_config}
+      ${_project_config}
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindBrotli.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindCares.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindGSS.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindGnuTLS.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindLDAP.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindLibbacktrace.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindLibgsasl.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindLibidn2.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindLibpsl.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindLibssh.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindLibssh2.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindLibuv.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindMbedTLS.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindNGHTTP2.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindNGHTTP3.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindNGTCP2.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindNettle.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindQuiche.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindRustls.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindWolfSSL.cmake"
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindZstd.cmake"
+    DESTINATION ${_install_cmake_dir})
+
+  if(NOT TARGET curl_uninstall)
+    configure_file(
+      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/cmake_uninstall.in.cmake"
+      "${CMAKE_CURRENT_BINARY_DIR}/CMake/cmake_uninstall.cmake"
+      @ONLY)
+
+    add_custom_target(curl_uninstall
+      COMMAND ${CMAKE_COMMAND} -P "${CMAKE_CURRENT_BINARY_DIR}/CMake/cmake_uninstall.cmake")
+  endif()
+
+  if(BUILD_CURL_EXE)
+    install(FILES "${PROJECT_SOURCE_DIR}/scripts/wcurl"
+      DESTINATION ${CMAKE_INSTALL_BINDIR}
+      PERMISSIONS
+        OWNER_READ OWNER_WRITE OWNER_EXECUTE
+        GROUP_READ GROUP_EXECUTE
+        WORLD_READ WORLD_EXECUTE)
+  endif()
+
+  # The `-DEV` part is important
+  string(REGEX REPLACE "([0-9]+\.[0-9]+)\.([0-9]+.*)" "\\2" CPACK_PACKAGE_VERSION_PATCH "${_curl_version}")
+  set(CPACK_GENERATOR "TGZ")
+  include(CPack)
 endif()
 
-if(NOT TARGET curl_uninstall)
-  configure_file(
-      ${CMAKE_CURRENT_SOURCE_DIR}/CMake/cmake_uninstall.cmake.in
-      ${CMAKE_CURRENT_BINARY_DIR}/CMake/cmake_uninstall.cmake
-      IMMEDIATE @ONLY)
-
-  add_custom_target(curl_uninstall
-      COMMAND ${CMAKE_COMMAND} -P
-      ${CMAKE_CURRENT_BINARY_DIR}/CMake/cmake_uninstall.cmake)
+# Save build info for test runner to pick up and log
+set(_cmake_sysroot "")
+if(CMAKE_OSX_SYSROOT)
+  set(_cmake_sysroot ${CMAKE_OSX_SYSROOT})
+elseif(CMAKE_SYSROOT)
+  set(_cmake_sysroot ${CMAKE_SYSROOT})
+endif()
+set(_buildinfo "\
+buildinfo.configure.tool: cmake
+buildinfo.configure.command: ${CMAKE_COMMAND}
+buildinfo.configure.version: ${CMAKE_VERSION}
+buildinfo.configure.args:${_cmake_args}
+buildinfo.configure.generator: ${CMAKE_GENERATOR}
+buildinfo.configure.make: ${CMAKE_MAKE_PROGRAM}
+buildinfo.host.cpu: ${CMAKE_HOST_SYSTEM_PROCESSOR}
+buildinfo.host.os: ${CMAKE_HOST_SYSTEM_NAME}
+buildinfo.target.cpu: ${CMAKE_SYSTEM_PROCESSOR}
+buildinfo.target.os: ${CMAKE_SYSTEM_NAME}
+buildinfo.target.flags:${_target_flags}
+buildinfo.compiler: ${CMAKE_C_COMPILER_ID}
+buildinfo.compiler.version: ${CMAKE_C_COMPILER_VERSION}
+buildinfo.sysroot: ${_cmake_sysroot}
+")
+file(WRITE "${PROJECT_BINARY_DIR}/buildinfo.txt" "# This is a generated file.  Do not edit.\n${_buildinfo}")
+if(NOT "$ENV{CURL_BUILDINFO}$ENV{CURL_CI}$ENV{CI}" STREQUAL "")
+  message(STATUS "\n${_buildinfo}")
 endif()
diff --git a/third-party/curl/COPYING b/third-party/curl/COPYING
index d1eab3eb93..2f71d999a9 100644
--- a/third-party/curl/COPYING
+++ b/third-party/curl/COPYING
@@ -1,6 +1,6 @@
 COPYRIGHT AND PERMISSION NOTICE
 
-Copyright (c) 1996 - 2023, Daniel Stenberg, <daniel@haxx.se>, and many
+Copyright (c) 1996 - 2026, Daniel Stenberg, <daniel@haxx.se>, and many
 contributors, see the THANKS file.
 
 All rights reserved.
diff --git a/third-party/curl/Dockerfile b/third-party/curl/Dockerfile
new file mode 100644
index 0000000000..369583f62f
--- /dev/null
+++ b/third-party/curl/Dockerfile
@@ -0,0 +1,41 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+# Self-contained build environment to match the release environment.
+#
+# Build and set the timestamp for the date corresponding to the release
+#
+#   docker build --build-arg SOURCE_DATE_EPOCH=1711526400 --build-arg UID=$(id -u) --build-arg GID=$(id -g) -t curl/curl .
+#
+# Then run commands from within the build environment, for example
+#
+#   docker run --rm -it -u $(id -u):$(id -g) -v $(pwd):/usr/src -w /usr/src curl/curl autoreconf -fi
+#   docker run --rm -it -u $(id -u):$(id -g) -v $(pwd):/usr/src -w /usr/src curl/curl ./configure --without-ssl --without-libpsl
+#   docker run --rm -it -u $(id -u):$(id -g) -v $(pwd):/usr/src -w /usr/src curl/curl make
+#   docker run --rm -it -u $(id -u):$(id -g) -v $(pwd):/usr/src -w /usr/src curl/curl ./scripts/maketgz 8.7.1
+#
+# or get into a shell in the build environment, for example
+#
+#   docker run --rm -it -u $(id -u):$(id -g) -v $(pwd):/usr/src -w /usr/src curl/curl bash
+#   $ autoreconf -fi
+#   $ ./configure --without-ssl --without-libpsl
+#   $ make
+#   $ ./scripts/maketgz 8.7.1
+
+# To update, get the latest digest e.g. from https://hub.docker.com/_/debian/tags
+FROM debian:bookworm-slim@sha256:96e378d7e6531ac9a15ad505478fcc2e69f371b10f5cdf87857c4b8188404716
+
+RUN apt-get update -qq && apt-get install -qq -y --no-install-recommends \
+    build-essential make autoconf automake libtool git perl zip zlib1g-dev gawk && \
+    rm -rf /var/lib/apt/lists/*
+
+ARG UID=1000 GID=1000
+
+RUN groupadd --gid $GID dev && \
+    useradd --uid $UID --gid dev --shell /bin/bash --create-home dev
+
+USER dev:dev
+
+ARG SOURCE_DATE_EPOCH
+ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH:-1}
diff --git a/third-party/curl/GIT-INFO b/third-party/curl/GIT-INFO
deleted file mode 100644
index 62efbd938c..0000000000
--- a/third-party/curl/GIT-INFO
+++ /dev/null
@@ -1,44 +0,0 @@
-                                  _   _ ____  _
-                              ___| | | |  _ \| |
-                             / __| | | | |_) | |
-                            | (__| |_| |  _ <| |___
-                             \___|\___/|_| \_\_____|
-
-GIT-INFO
-
-This file is only present in git - never in release archives. It contains
-information about other files and things that the git repository keeps in its
-inner sanctum.
-
-To build in environments that support configure, after having extracted
-everything from git, do this:
-
-autoreconf -fi
-./configure --with-openssl
-make
-
-  Daniel uses a ./configure line similar to this for easier development:
-
-  ./configure --disable-shared --enable-debug --enable-maintainer-mode
-
-In environments that don't support configure (i.e. Microsoft), do this:
-
-buildconf.bat
-
-
-REQUIREMENTS
-
-For autoreconf and configure (not buildconf.bat) to work, you need the
-following software installed:
-
- o autoconf 2.57  (or later)
- o automake 1.7   (or later)
- o libtool  1.4.2 (or later)
- o GNU m4 (required by autoconf)
-
- o nroff + perl
-
-   If you don't have nroff and perl and you for some reason don't want to
-   install them, you can rename the source file src/tool_hugehelp.c.cvs to
-   src/tool_hugehelp.c and avoid having to generate this file. This will
-   give you a stubbed version of the file that doesn't contain actual content.
diff --git a/third-party/curl/GIT-INFO.md b/third-party/curl/GIT-INFO.md
new file mode 100644
index 0000000000..ee912560fd
--- /dev/null
+++ b/third-party/curl/GIT-INFO.md
@@ -0,0 +1,33 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+                                  _   _ ____  _
+                              ___| | | |  _ \| |
+                             / __| | | | |_) | |
+                            | (__| |_| |  _ <| |___
+                             \___|\___/|_| \_\_____|
+
+# GIT-INFO
+
+This file is only present in git - never in release archives. It contains
+information about other files and things that the git repository keeps in its
+inner sanctum.
+
+To build in environments that support configure, after having extracted
+everything from git, do this:
+
+    autoreconf -fi
+    ./configure --with-openssl
+    make
+
+Daniel uses a configure line similar to this for easier development:
+
+    ./configure --disable-shared --enable-debug --enable-maintainer-mode
+
+## REQUIREMENTS
+
+See [docs/INTERNALS.md][0] for requirement details.
+
+[0]: docs/INTERNALS.md
diff --git a/third-party/curl/LICENSES/BSD-3-Clause.txt b/third-party/curl/LICENSES/BSD-3-Clause.txt
deleted file mode 100644
index 086d3992cb..0000000000
--- a/third-party/curl/LICENSES/BSD-3-Clause.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-Copyright (c) <year> <owner>.
-
-Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
-
-1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
-
-2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
-
-3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/third-party/curl/LICENSES/BSD-4-Clause-UC.txt b/third-party/curl/LICENSES/BSD-4-Clause-UC.txt
index 69edbe3242..0fffd039d8 100644
--- a/third-party/curl/LICENSES/BSD-4-Clause-UC.txt
+++ b/third-party/curl/LICENSES/BSD-4-Clause-UC.txt
@@ -1,15 +1,33 @@
 BSD-4-Clause (University of California-Specific)
 
-Copyright [various years] The Regents of the University of California. All rights reserved.
+Copyright [various years] The Regents of the University of California.
+All rights reserved.
 
-Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
 
-1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
 
-2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
 
-3. All advertising materials mentioning features or use of this software must display the following acknowledgement: This product includes software developed by the University of California, Berkeley and its contributors.
+3. All advertising materials mentioning features or use of this software must
+   display the following acknowledgement: This product includes software
+   developed by the University of California, Berkeley and its contributors.
 
-4. Neither the name of the University nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+4. Neither the name of the University nor the names of its contributors may be
+   used to endorse or promote products derived from this software without
+   specific prior written permission.
 
-THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND ANY
+EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/third-party/curl/MacOSX-Framework b/third-party/curl/MacOSX-Framework
deleted file mode 100644
index 5ac537633c..0000000000
--- a/third-party/curl/MacOSX-Framework
+++ /dev/null
@@ -1,160 +0,0 @@
-#!/usr/bin/env bash
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# This script performs all of the steps needed to build a
-# universal binary libcurl.framework for Mac OS X 10.4 or greater.
-#
-# Hendrik Visage:
-#  Generalizations added since  Snowleopard (10.6) do not include
-# the 10.4u SDK.
-#
-# Also note:
-# 10.5 is the *ONLY* SDK that support PPC64 :( -- 10.6 do not have ppc64 support
-#If you need to have PPC64 support then change below to 1
-PPC64_NEEDED=0
-# Apple does not support building for PPC anymore in Xcode 4 and later.
-# If you're using Xcode 3 or earlier and need PPC support, then change
-# the setting below to 1
-PPC_NEEDED=0
-
-# For me the default is to develop for the platform I am on, and if you
-#desire compatibility with older versions then change USE_OLD to 1 :)
-USE_OLD=0
-
-VERSION=`/usr/bin/sed -ne 's/^#define LIBCURL_VERSION "\(.*\)"/\1/p' include/curl/curlver.h`
-FRAMEWORK_VERSION=Versions/Release-$VERSION
-
-#I also wanted to "copy over" the system, and thus the reason I added the
-# version to Versions/Release-7.20.1 etc.
-# now a simple rsync -vaP libcurl.framework /Library/Frameworks will install it
-# and setup the right paths to this version, leaving the system version
-# "intact", so you can "fix" it later with the links to Versions/A/...
-
-DEVELOPER_PATH=`xcode-select --print-path`
-# Around Xcode 4.3, SDKs were moved from the Developer folder into the
-# MacOSX.platform folder
-if test -d "$DEVELOPER_PATH/Platforms/MacOSX.platform/Developer/SDKs"; then
- SDK_PATH="$DEVELOPER_PATH/Platforms/MacOSX.platform/Developer/SDKs"
-else
- SDK_PATH="$DEVELOPER_PATH/SDKs"
-fi
-OLD_SDK=`ls  $SDK_PATH|head -1`
-NEW_SDK=`ls -r $SDK_PATH|head -1`
-
-if test "0"$USE_OLD -gt 0
-then
- SDK32=$OLD_SDK
-else
- SDK32=$NEW_SDK
-fi
-
-MACVER=`echo $SDK32|sed -e s/[a-zA-Z]//g -e s/.\$//`
-
-SDK32_DIR=$SDK_PATH/$SDK32
-MINVER32='-mmacosx-version-min='$MACVER
-if test $PPC_NEEDED -gt 0; then
- ARCHES32='-arch i386 -arch ppc'
-else
- ARCHES32='-arch i386'
-fi
-
-if test $PPC64_NEEDED -gt 0
-then
-  SDK64=10.5
-  ARCHES64='-arch x86_64 -arch ppc64'
-  SDK64=`ls  $SDK_PATH | grep "10\.5" | head -1`
-else
- ARCHES64='-arch x86_64'
- #We "know" that 10.4 and earlier do not support 64bit
- OLD_SDK64=`ls  $SDK_PATH | grep -v "10\.[0-4]" | head -1`
- NEW_SDK64=`ls -r $SDK_PATH | grep -v "10\.[0-4][^0-9]" | head -1`
- if test $USE_OLD -gt 0
-  then
-   SDK64=$OLD_SDK64
-  else
-   SDK64=$NEW_SDK64
-  fi
-fi
-
-SDK64_DIR=$SDK_PATH/$SDK64
-MACVER64=`echo $SDK64|sed -e s/[a-zA-Z]//g -e s/.\$//`
-
-MINVER64='-mmacosx-version-min='$MACVER64
-
-if test ! -z $SDK32; then
-  echo "----Configuring libcurl for 32 bit universal framework..."
-  make clean
-  ./configure --disable-dependency-tracking --disable-static --with-gssapi --with-secure-transport \
-    CFLAGS="-Os -isysroot $SDK32_DIR $ARCHES32" \
-    LDFLAGS="-Wl,-syslibroot,$SDK32_DIR $ARCHES32 -Wl,-headerpad_max_install_names" \
-    CC=$CC
-
-  echo "----Building 32 bit libcurl..."
-  make -j `sysctl -n hw.logicalcpu_max`
-
-  echo "----Creating 32 bit framework..."
-  rm -r libcurl.framework
-  mkdir -p libcurl.framework/${FRAMEWORK_VERSION}/Resources
-  cp lib/.libs/libcurl.dylib libcurl.framework/${FRAMEWORK_VERSION}/libcurl
-  install_name_tool -id @rpath/libcurl.framework/${FRAMEWORK_VERSION}/libcurl libcurl.framework/${FRAMEWORK_VERSION}/libcurl
-  cp lib/libcurl.plist libcurl.framework/${FRAMEWORK_VERSION}/Resources/Info.plist
-  mkdir -p libcurl.framework/${FRAMEWORK_VERSION}/Headers/curl
-  cp include/curl/*.h libcurl.framework/${FRAMEWORK_VERSION}/Headers/curl
-  pushd libcurl.framework
-  ln -fs ${FRAMEWORK_VERSION}/libcurl libcurl
-  ln -fs ${FRAMEWORK_VERSION}/Resources Resources
-  ln -fs ${FRAMEWORK_VERSION}/Headers Headers
-  cd Versions
-  ln -fs $(basename "${FRAMEWORK_VERSION}") Current
-
-  echo Testing for SDK64
-  if test -d $SDK64_DIR; then
-  echo entering...
-    popd
-    make clean
-    echo "----Configuring libcurl for 64 bit universal framework..."
-    ./configure --disable-dependency-tracking --disable-static --with-gssapi --with-secure-transport \
-      CFLAGS="-Os -isysroot $SDK64_DIR $ARCHES64" \
-      LDFLAGS="-Wl,-syslibroot,$SDK64_DIR $ARCHES64 -Wl,-headerpad_max_install_names" \
-      CC=$CC
-
-    echo "----Building 64 bit libcurl..."
-    make -j `sysctl -n hw.logicalcpu_max`
-
-    echo "----Appending 64 bit framework to 32 bit framework..."
-    cp lib/.libs/libcurl.dylib libcurl.framework/${FRAMEWORK_VERSION}/libcurl64
-    install_name_tool -id @rpath/libcurl.framework/${FRAMEWORK_VERSION}/libcurl libcurl.framework/${FRAMEWORK_VERSION}/libcurl64
-    cp libcurl.framework/${FRAMEWORK_VERSION}/libcurl libcurl.framework/${FRAMEWORK_VERSION}/libcurl32
-    pwd
-    lipo libcurl.framework/${FRAMEWORK_VERSION}/libcurl32 libcurl.framework/${FRAMEWORK_VERSION}/libcurl64 -create -output libcurl.framework/${FRAMEWORK_VERSION}/libcurl
-    rm libcurl.framework/${FRAMEWORK_VERSION}/libcurl32 libcurl.framework/${FRAMEWORK_VERSION}/libcurl64
-  fi
-
-  pwd
-  lipo -info libcurl.framework/${FRAMEWORK_VERSION}/libcurl
-  echo "libcurl.framework is built and can now be included in other projects."
-  echo "Copy libcurl.framework to your bundle's Contents/Frameworks folder, ~/Library/Frameworks or /Library/Frameworks."
-else
-  echo "Building libcurl.framework requires Mac OS X 10.4 or later with the MacOSX10.4/5/6 SDK installed."
-fi
diff --git a/third-party/curl/Makefile.am b/third-party/curl/Makefile.am
index 6c780a849d..83fdadf035 100644
--- a/third-party/curl/Makefile.am
+++ b/third-party/curl/Makefile.am
@@ -26,171 +26,79 @@ AUTOMAKE_OPTIONS = foreign
 
 ACLOCAL_AMFLAGS = -I m4
 
-CMAKE_DIST =                                    \
- CMake/cmake_uninstall.cmake.in                 \
- CMake/CMakeConfigurableFile.in                 \
- CMake/curl-config.cmake.in                     \
- CMake/CurlSymbolHiding.cmake                   \
- CMake/CurlTests.c                              \
- CMake/FindBearSSL.cmake                        \
- CMake/FindBrotli.cmake                         \
- CMake/FindCARES.cmake                          \
- CMake/FindGSS.cmake                            \
- CMake/FindLibPSL.cmake                         \
- CMake/FindLibSSH2.cmake                        \
- CMake/FindMbedTLS.cmake                        \
- CMake/FindMSH3.cmake                           \
- CMake/FindNGHTTP2.cmake                        \
- CMake/FindNGHTTP3.cmake                        \
- CMake/FindNGTCP2.cmake                         \
- CMake/FindQUICHE.cmake                         \
- CMake/FindWolfSSL.cmake                        \
- CMake/FindZstd.cmake                           \
- CMake/Macros.cmake                             \
- CMake/OtherTests.cmake                         \
- CMake/PickyWarnings.cmake                      \
- CMake/Platforms/WindowsCache.cmake             \
- CMake/Utilities.cmake                          \
- CMakeLists.txt
+CMAKE_DIST =                                     \
+  CMake/cmake_uninstall.in.cmake                 \
+  CMake/curl-config.in.cmake                     \
+  CMake/CurlSymbolHiding.cmake                   \
+  CMake/CurlTests.c                              \
+  CMake/FindBrotli.cmake                         \
+  CMake/FindCares.cmake                          \
+  CMake/FindGnuTLS.cmake                         \
+  CMake/FindGSS.cmake                            \
+  CMake/FindLDAP.cmake                           \
+  CMake/FindLibbacktrace.cmake                   \
+  CMake/FindLibgsasl.cmake                       \
+  CMake/FindLibidn2.cmake                        \
+  CMake/FindLibpsl.cmake                         \
+  CMake/FindLibssh.cmake                         \
+  CMake/FindLibssh2.cmake                        \
+  CMake/FindLibuv.cmake                          \
+  CMake/FindMbedTLS.cmake                        \
+  CMake/FindNGHTTP2.cmake                        \
+  CMake/FindNGHTTP3.cmake                        \
+  CMake/FindNGTCP2.cmake                         \
+  CMake/FindNettle.cmake                         \
+  CMake/FindQuiche.cmake                         \
+  CMake/FindRustls.cmake                         \
+  CMake/FindWolfSSL.cmake                        \
+  CMake/FindZstd.cmake                           \
+  CMake/Macros.cmake                             \
+  CMake/OtherTests.cmake                         \
+  CMake/PickyWarnings.cmake                      \
+  CMake/Utilities.cmake                          \
+  CMake/unix-cache.cmake                         \
+  CMake/win32-cache.cmake                        \
+  CMakeLists.txt                                 \
+  tests/cmake/CMakeLists.txt                     \
+  tests/cmake/test.c                             \
+  tests/cmake/test.cpp                           \
+  tests/cmake/test.sh
 
-VC10_LIBTMPL = projects/Windows/VC10/lib/libcurl.tmpl
-VC10_LIBVCXPROJ = projects/Windows/VC10/lib/libcurl.vcxproj.dist
-VC10_LIBVCXPROJ_DEPS = $(VC10_LIBTMPL) Makefile.am lib/Makefile.inc
-VC10_SRCTMPL = projects/Windows/VC10/src/curl.tmpl
-VC10_SRCVCXPROJ = projects/Windows/VC10/src/curl.vcxproj.dist
-VC10_SRCVCXPROJ_DEPS = $(VC10_SRCTMPL) Makefile.am src/Makefile.inc
+EXTRA_DIST = CHANGES.md COPYING RELEASE-NOTES Dockerfile .clang-tidy.yml .editorconfig $(CMAKE_DIST)
 
-VC11_LIBTMPL = projects/Windows/VC11/lib/libcurl.tmpl
-VC11_LIBVCXPROJ = projects/Windows/VC11/lib/libcurl.vcxproj.dist
-VC11_LIBVCXPROJ_DEPS = $(VC11_LIBTMPL) Makefile.am lib/Makefile.inc
-VC11_SRCTMPL = projects/Windows/VC11/src/curl.tmpl
-VC11_SRCVCXPROJ = projects/Windows/VC11/src/curl.vcxproj.dist
-VC11_SRCVCXPROJ_DEPS = $(VC11_SRCTMPL) Makefile.am src/Makefile.inc
-
-VC12_LIBTMPL = projects/Windows/VC12/lib/libcurl.tmpl
-VC12_LIBVCXPROJ = projects/Windows/VC12/lib/libcurl.vcxproj.dist
-VC12_LIBVCXPROJ_DEPS = $(VC12_LIBTMPL) Makefile.am lib/Makefile.inc
-VC12_SRCTMPL = projects/Windows/VC12/src/curl.tmpl
-VC12_SRCVCXPROJ = projects/Windows/VC12/src/curl.vcxproj.dist
-VC12_SRCVCXPROJ_DEPS = $(VC12_SRCTMPL) Makefile.am src/Makefile.inc
-
-VC14_LIBTMPL = projects/Windows/VC14/lib/libcurl.tmpl
-VC14_LIBVCXPROJ = projects/Windows/VC14/lib/libcurl.vcxproj.dist
-VC14_LIBVCXPROJ_DEPS = $(VC14_LIBTMPL) Makefile.am lib/Makefile.inc
-VC14_SRCTMPL = projects/Windows/VC14/src/curl.tmpl
-VC14_SRCVCXPROJ = projects/Windows/VC14/src/curl.vcxproj.dist
-VC14_SRCVCXPROJ_DEPS = $(VC14_SRCTMPL) Makefile.am src/Makefile.inc
-
-VC14_10_LIBTMPL = projects/Windows/VC14.10/lib/libcurl.tmpl
-VC14_10_LIBVCXPROJ = projects/Windows/VC14.10/lib/libcurl.vcxproj.dist
-VC14_10_LIBVCXPROJ_DEPS = $(VC14_10_LIBTMPL) Makefile.am lib/Makefile.inc
-VC14_10_SRCTMPL = projects/Windows/VC14.10/src/curl.tmpl
-VC14_10_SRCVCXPROJ = projects/Windows/VC14.10/src/curl.vcxproj.dist
-VC14_10_SRCVCXPROJ_DEPS = $(VC14_10_SRCTMPL) Makefile.am src/Makefile.inc
-
-VC14_30_LIBTMPL = projects/Windows/VC14.30/lib/libcurl.tmpl
-VC14_30_LIBVCXPROJ = projects/Windows/VC14.30/lib/libcurl.vcxproj.dist
-VC14_30_LIBVCXPROJ_DEPS = $(VC14_30_LIBTMPL) Makefile.am lib/Makefile.inc
-VC14_30_SRCTMPL = projects/Windows/VC14.30/src/curl.tmpl
-VC14_30_SRCVCXPROJ = projects/Windows/VC14.30/src/curl.vcxproj.dist
-VC14_30_SRCVCXPROJ_DEPS = $(VC14_30_SRCTMPL) Makefile.am src/Makefile.inc
-
-VC_DIST = projects/README.md                           \
- projects/build-openssl.bat                            \
- projects/build-wolfssl.bat                            \
- projects/checksrc.bat                                 \
- projects/Windows/VC10/curl-all.sln                    \
- projects/Windows/VC10/lib/libcurl.sln                 \
- projects/Windows/VC10/lib/libcurl.vcxproj.filters     \
- projects/Windows/VC10/src/curl.sln                    \
- projects/Windows/VC10/src/curl.vcxproj.filters        \
- projects/Windows/VC11/curl-all.sln                    \
- projects/Windows/VC11/lib/libcurl.sln                 \
- projects/Windows/VC11/lib/libcurl.vcxproj.filters     \
- projects/Windows/VC11/src/curl.sln                    \
- projects/Windows/VC11/src/curl.vcxproj.filters        \
- projects/Windows/VC12/curl-all.sln                    \
- projects/Windows/VC12/lib/libcurl.sln                 \
- projects/Windows/VC12/lib/libcurl.vcxproj.filters     \
- projects/Windows/VC12/src/curl.sln                    \
- projects/Windows/VC12/src/curl.vcxproj.filters        \
- projects/Windows/VC14/curl-all.sln                    \
- projects/Windows/VC14/lib/libcurl.sln                 \
- projects/Windows/VC14/lib/libcurl.vcxproj.filters     \
- projects/Windows/VC14/src/curl.sln                    \
- projects/Windows/VC14/src/curl.vcxproj.filters        \
- projects/Windows/VC14.10/curl-all.sln                 \
- projects/Windows/VC14.10/lib/libcurl.sln              \
- projects/Windows/VC14.10/lib/libcurl.vcxproj.filters  \
- projects/Windows/VC14.10/src/curl.sln                 \
- projects/Windows/VC14.10/src/curl.vcxproj.filters     \
- projects/Windows/VC14.30/curl-all.sln                 \
- projects/Windows/VC14.30/lib/libcurl.sln              \
- projects/Windows/VC14.30/lib/libcurl.vcxproj.filters  \
- projects/Windows/VC14.30/src/curl.sln                 \
- projects/Windows/VC14.30/src/curl.vcxproj.filters     \
- projects/generate.bat                                 \
- projects/wolfssl_options.h                            \
- projects/wolfssl_override.props
-
-WINBUILD_DIST = winbuild/README.md winbuild/gen_resp_file.bat \
- winbuild/MakefileBuild.vc winbuild/Makefile.vc
-
-PLAN9_DIST = plan9/include/mkfile \
- plan9/include/mkfile             \
- plan9/mkfile.proto               \
- plan9/mkfile                     \
- plan9/README                     \
- plan9/lib/mkfile.inc             \
- plan9/lib/mkfile                 \
- plan9/src/mkfile.inc             \
- plan9/src/mkfile
-
-EXTRA_DIST = CHANGES COPYING maketgz Makefile.dist curl-config.in            \
- RELEASE-NOTES buildconf libcurl.pc.in MacOSX-Framework $(CMAKE_DIST)        \
- $(VC_DIST) $(WINBUILD_DIST) $(PLAN9_DIST) lib/libcurl.vers.in buildconf.bat \
- libcurl.def
-
-CLEANFILES = $(VC10_LIBVCXPROJ) $(VC10_SRCVCXPROJ) $(VC11_LIBVCXPROJ)        \
- $(VC11_SRCVCXPROJ) $(VC12_LIBVCXPROJ) $(VC12_SRCVCXPROJ) $(VC14_LIBVCXPROJ) \
- $(VC14_SRCVCXPROJ) $(VC14_10_LIBVCXPROJ) $(VC14_10_SRCVCXPROJ)              \
- $(VC14_30_LIBVCXPROJ) $(VC14_30_SRCVCXPROJ)
+DISTCLEANFILES = buildinfo.txt
 
 bin_SCRIPTS = curl-config
 
-SUBDIRS = lib src
-DIST_SUBDIRS = $(SUBDIRS) tests packages scripts include docs
+SUBDIRS = lib docs src scripts
+DIST_SUBDIRS = $(SUBDIRS) tests projects include docs
 
 pkgconfigdir = $(libdir)/pkgconfig
 pkgconfig_DATA = libcurl.pc
 
-# List of files required to generate VC IDE .dsp, .vcproj and .vcxproj files
-include lib/Makefile.inc
-include src/Makefile.inc
-
 dist-hook:
 	rm -rf $(top_builddir)/tests/log
-	find $(distdir) -name "*.dist" -exec rm {} \;
-	(distit=`find $(srcdir) -name "*.dist" | grep -v ./ares/`; \
+	find $(distdir) -name "*.dist" -exec rm -- {} \;
+	(distit=`find $(srcdir) -name "*.dist" | grep -v Makefile`; \
 	for file in $$distit; do \
 	  strip=`echo $$file | sed -e s/^$(srcdir)// -e s/\.dist//`; \
 	  cp -p $$file $(distdir)$$strip; \
 	done)
 
-html:
-	cd docs && $(MAKE) html
-
-pdf:
-	cd docs && $(MAKE) pdf
-
 check: test examples check-docs
 
 if CROSSCOMPILING
 test-full: test
+test-nonflaky: test
 test-torture: test
+test-event: test
+test-am: test
+test-ci: test
+pytest: test
+pytest-ci: test
 
 test:
-	@echo "NOTICE: we can't run the tests when cross-compiling!"
+	@echo "NOTICE: we cannot run the tests when cross-compiling!"
 
 else
 
@@ -215,6 +123,12 @@ test-am:
 test-ci:
 	@(cd tests; $(MAKE) all ci-test)
 
+pytest:
+	@(cd tests; $(MAKE) all default-pytest)
+
+pytest-ci:
+	@(cd tests; $(MAKE) all ci-pytest)
+
 endif
 
 examples:
@@ -223,58 +137,17 @@ examples:
 check-docs:
 	@(cd docs/libcurl; $(MAKE) check)
 
-# Build source and binary rpms. For rpm-3.0 and above, the ~/.rpmmacros
-# must contain the following line:
-# %_topdir /home/loic/local/rpm
-# and that /home/loic/local/rpm contains the directory SOURCES, BUILD etc.
-#
-# cd /home/loic/local/rpm ; mkdir -p SOURCES BUILD RPMS/i386 SPECS SRPMS
-#
-# If additional configure flags are needed to build the package, add the
-# following in ~/.rpmmacros
-# %configure CFLAGS="%{optflags}" ./configure %{_target_platform} --prefix=%{_prefix} ${AM_CONFIGFLAGS}
-# and run make rpm in the following way:
-# AM_CONFIGFLAGS='--with-uri=/home/users/loic/local/RedHat-6.2' make rpm
-#
-
-rpms:
-	$(MAKE) RPMDIST=curl rpm
-	$(MAKE) RPMDIST=curl-ssl rpm
-
-rpm:
-	RPM_TOPDIR=`rpm --showrc | $(PERL) -n -e 'print if(s/.*_topdir\s+(.*)/$$1/)'` ; \
-	cp $(srcdir)/packages/Linux/RPM/$(RPMDIST).spec $$RPM_TOPDIR/SPECS ; \
-	cp $(PACKAGE)-$(VERSION).tar.gz $$RPM_TOPDIR/SOURCES ; \
-	rpm -ba --clean --rmsource $$RPM_TOPDIR/SPECS/$(RPMDIST).spec ; \
-	mv $$RPM_TOPDIR/RPMS/i386/$(RPMDIST)-*.rpm . ; \
-	mv $$RPM_TOPDIR/SRPMS/$(RPMDIST)-*.src.rpm .
-
-#
-# Build a Solaris pkgadd format file
-# run 'make pkgadd' once you've done './configure' and 'make' to make a Solaris pkgadd format
-# file (which ends up back in this directory).
-# The pkgadd file is in 'pkgtrans' format, so to install on Solaris, do
-# pkgadd -d ./HAXXcurl-*
-#
-
-# gak - libtool requires an absolute directory, hence the pwd below...
-pkgadd:
-	umask 022 ; \
-	$(MAKE) install DESTDIR=`/bin/pwd`/packages/Solaris/root ; \
-	cat COPYING > $(srcdir)/packages/Solaris/copyright ; \
-	cd $(srcdir)/packages/Solaris && $(MAKE) package
-
-#
-# Build a cygwin binary tarball installation file
-# resulting .tar.bz2 file will end up at packages/Win32/cygwin
-cygwinbin:
-	$(MAKE) -C packages/Win32/cygwin cygwinbin
-
 # We extend the standard install with a custom hook:
+if BUILD_DOCS
 install-data-hook:
 	(cd include && $(MAKE) install)
 	(cd docs && $(MAKE) install)
 	(cd docs/libcurl && $(MAKE) install)
+else
+install-data-hook:
+	(cd include && $(MAKE) install)
+	(cd docs && $(MAKE) install)
+endif
 
 # We extend the standard uninstall with a custom hook:
 uninstall-hook:
@@ -296,319 +169,17 @@ checksrc:
 	(cd tests && $(MAKE) checksrc)
 	(cd include/curl && $(MAKE) checksrc)
 	(cd docs/examples && $(MAKE) checksrc)
-	(cd packages && $(MAKE) checksrc)
+	(cd projects && $(MAKE) checksrc)
 
-.PHONY: vc-ide
+badwords:
+	@PERL@ $(top_srcdir)/scripts/badwords-all
 
-vc-ide: $(VC10_LIBVCXPROJ_DEPS) $(VC10_SRCVCXPROJ_DEPS)                  \
- $(VC11_LIBVCXPROJ_DEPS) $(VC11_SRCVCXPROJ_DEPS) $(VC12_LIBVCXPROJ_DEPS) \
- $(VC12_SRCVCXPROJ_DEPS) $(VC14_LIBVCXPROJ_DEPS) $(VC14_SRCVCXPROJ_DEPS) \
- $(VC14_10_LIBVCXPROJ_DEPS) $(VC14_10_SRCVCXPROJ_DEPS)                   \
- $(VC14_30_LIBVCXPROJ_DEPS) $(VC14_30_SRCVCXPROJ_DEPS)
-	@(win32_lib_srcs='$(LIB_CFILES)'; \
-	win32_lib_hdrs='$(LIB_HFILES) config-win32.h'; \
-	win32_lib_rc='$(LIB_RCFILES)'; \
-	win32_lib_vauth_srcs='$(LIB_VAUTH_CFILES)'; \
-	win32_lib_vauth_hdrs='$(LIB_VAUTH_HFILES)'; \
-	win32_lib_vquic_srcs='$(LIB_VQUIC_CFILES)'; \
-	win32_lib_vquic_hdrs='$(LIB_VQUIC_HFILES)'; \
-	win32_lib_vssh_srcs='$(LIB_VSSH_CFILES)'; \
-	win32_lib_vssh_hdrs='$(LIB_VSSH_HFILES)'; \
-	win32_lib_vtls_srcs='$(LIB_VTLS_CFILES)'; \
-	win32_lib_vtls_hdrs='$(LIB_VTLS_HFILES)'; \
-	win32_src_srcs='$(CURL_CFILES)'; \
-	win32_src_hdrs='$(CURL_HFILES)'; \
-	win32_src_rc='$(CURL_RCFILES)'; \
-	win32_src_x_srcs='$(CURLX_CFILES)'; \
-	win32_src_x_hdrs='$(CURLX_HFILES) ../lib/config-win32.h'; \
-	\
-	sorted_lib_srcs=`for file in $$win32_lib_srcs; do echo $$file; done | sort`; \
-	sorted_lib_hdrs=`for file in $$win32_lib_hdrs; do echo $$file; done | sort`; \
-	sorted_lib_vauth_srcs=`for file in $$win32_lib_vauth_srcs; do echo $$file; done | sort`; \
-	sorted_lib_vauth_hdrs=`for file in $$win32_lib_vauth_hdrs; do echo $$file; done | sort`; \
-	sorted_lib_vquic_srcs=`for file in $$win32_lib_vquic_srcs; do echo $$file; done | sort`; \
-	sorted_lib_vquic_hdrs=`for file in $$win32_lib_vquic_hdrs; do echo $$file; done | sort`; \
-	sorted_lib_vssh_srcs=`for file in $$win32_lib_vssh_srcs; do echo $$file; done | sort`; \
-	sorted_lib_vssh_hdrs=`for file in $$win32_lib_vssh_hdrs; do echo $$file; done | sort`; \
-	sorted_lib_vtls_srcs=`for file in $$win32_lib_vtls_srcs; do echo $$file; done | sort`; \
-	sorted_lib_vtls_hdrs=`for file in $$win32_lib_vtls_hdrs; do echo $$file; done | sort`; \
-	sorted_src_srcs=`for file in $$win32_src_srcs; do echo $$file; done | sort`; \
-	sorted_src_hdrs=`for file in $$win32_src_hdrs; do echo $$file; done | sort`; \
-	sorted_src_x_srcs=`for file in $$win32_src_x_srcs; do echo $$file; done | sort`; \
-	sorted_src_x_hdrs=`for file in $$win32_src_x_hdrs; do echo $$file; done | sort`; \
-	\
-	awk_code='\
-function gen_element(type, dir, file)\
-{\
-  sub(/vauth\//, "", file);\
-  sub(/vquic\//, "", file);\
-  sub(/vssh\//, "", file);\
-  sub(/vtls\//, "", file);\
-\
-  spaces="    ";\
-  if(dir == "lib\\vauth" ||\
-     dir == "lib\\vquic" ||\
-     dir == "lib\\vssh"  ||\
-     dir == "lib\\vtls")\
-    tabs="				";\
-  else\
-    tabs="			";\
-\
-  if(type == "dsp") {\
-    printf("# Begin Source File\r\n");\
-    printf("\r\n");\
-    printf("SOURCE=..\\..\\..\\..\\%s\\%s\r\n", dir, file);\
-    printf("# End Source File\r\n");\
-  }\
-  else if(type == "vcproj1") {\
-    printf("%s<File\r\n", tabs);\
-    printf("%s	RelativePath=\"..\\..\\..\\..\\%s\\%s\">\r\n",\
-           tabs, dir, file);\
-    printf("%s</File>\r\n", tabs);\
-  }\
-  else if(type == "vcproj2") {\
-    printf("%s<File\r\n", tabs);\
-    printf("%s	RelativePath=\"..\\..\\..\\..\\%s\\%s\"\r\n",\
-           tabs, dir, file);\
-    printf("%s>\r\n", tabs);\
-    printf("%s</File>\r\n", tabs);\
-  }\
-  else if(type == "vcxproj") {\
-    i = index(file, ".");\
-    ext = substr(file, i == 0 ? 0 : i + 1);\
-\
-    if(ext == "c")\
-      printf("%s<ClCompile Include=\"..\\..\\..\\..\\%s\\%s\" />\r\n",\
-             spaces, dir, file);\
-    else if(ext == "h")\
-      printf("%s<ClInclude Include=\"..\\..\\..\\..\\%s\\%s\" />\r\n",\
-             spaces, dir, file);\
-    else if(ext == "rc")\
-      printf("%s<ResourceCompile Include=\"..\\..\\..\\..\\%s\\%s\" />\r\n",\
-      spaces, dir, file);\
-  }\
-}\
-\
-{\
-\
-  if($$0 == "CURL_LIB_C_FILES") {\
-    split(lib_srcs, arr);\
-    for(val in arr) gen_element(proj_type, "lib", arr[val]);\
-  }\
-  else if($$0 == "CURL_LIB_H_FILES") {\
-    split(lib_hdrs, arr);\
-    for(val in arr) gen_element(proj_type, "lib", arr[val]);\
-  }\
-  else if($$0 == "CURL_LIB_RC_FILES") {\
-    split(lib_rc, arr);\
-    for(val in arr) gen_element(proj_type, "lib", arr[val]);\
-  }\
-  else if($$0 == "CURL_LIB_VAUTH_C_FILES") {\
-    split(lib_vauth_srcs, arr);\
-    for(val in arr) gen_element(proj_type, "lib\\vauth", arr[val]);\
-  }\
-  else if($$0 == "CURL_LIB_VAUTH_H_FILES") {\
-    split(lib_vauth_hdrs, arr);\
-    for(val in arr) gen_element(proj_type, "lib\\vauth", arr[val]);\
-  }\
-  else if($$0 == "CURL_LIB_VQUIC_C_FILES") {\
-    split(lib_vquic_srcs, arr);\
-    for(val in arr) gen_element(proj_type, "lib\\vquic", arr[val]);\
-  }\
-  else if($$0 == "CURL_LIB_VQUIC_H_FILES") {\
-    split(lib_vquic_hdrs, arr);\
-    for(val in arr) gen_element(proj_type, "lib\\vquic", arr[val]);\
-  }\
-  else if($$0 == "CURL_LIB_VSSH_C_FILES") {\
-    split(lib_vssh_srcs, arr);\
-    for(val in arr) gen_element(proj_type, "lib\\vssh", arr[val]);\
-  }\
-  else if($$0 == "CURL_LIB_VSSH_H_FILES") {\
-    split(lib_vssh_hdrs, arr);\
-    for(val in arr) gen_element(proj_type, "lib\\vssh", arr[val]);\
-  }\
-  else if($$0 == "CURL_LIB_VTLS_C_FILES") {\
-    split(lib_vtls_srcs, arr);\
-    for(val in arr) gen_element(proj_type, "lib\\vtls", arr[val]);\
-  }\
-  else if($$0 == "CURL_LIB_VTLS_H_FILES") {\
-    split(lib_vtls_hdrs, arr);\
-    for(val in arr) gen_element(proj_type, "lib\\vtls", arr[val]);\
-  }\
-  else if($$0 == "CURL_SRC_C_FILES") {\
-    split(src_srcs, arr);\
-    for(val in arr) gen_element(proj_type, "src", arr[val]);\
-  }\
-  else if($$0 == "CURL_SRC_H_FILES") {\
-    split(src_hdrs, arr);\
-    for(val in arr) gen_element(proj_type, "src", arr[val]);\
-  }\
-  else if($$0 == "CURL_SRC_RC_FILES") {\
-    split(src_rc, arr);\
-    for(val in arr) gen_element(proj_type, "src", arr[val]);\
-  }\
-  else if($$0 == "CURL_SRC_X_C_FILES") {\
-    split(src_x_srcs, arr);\
-    for(val in arr) {\
-      sub(/..\/lib\//, "", arr[val]);\
-      gen_element(proj_type, "lib", arr[val]);\
-    }\
-  }\
-  else if($$0 == "CURL_SRC_X_H_FILES") {\
-    split(src_x_hdrs, arr);\
-    for(val in arr) {\
-      sub(/..\/lib\//, "", arr[val]);\
-      gen_element(proj_type, "lib", arr[val]);\
-    }\
-  }\
-  else\
-    printf("%s\r\n", $$0);\
-}';\
-	\
-	echo "generating '$(VC10_LIBVCXPROJ)'"; \
-	awk -v proj_type=vcxproj \
-		-v lib_srcs="$$sorted_lib_srcs" \
-		-v lib_hdrs="$$sorted_lib_hdrs" \
-		-v lib_rc="$$win32_lib_rc" \
-		-v lib_vauth_srcs="$$sorted_lib_vauth_srcs" \
-		-v lib_vauth_hdrs="$$sorted_lib_vauth_hdrs" \
-		-v lib_vquic_srcs="$$sorted_lib_vquic_srcs" \
-		-v lib_vquic_hdrs="$$sorted_lib_vquic_hdrs" \
-		-v lib_vssh_srcs="$$sorted_lib_vssh_srcs" \
-		-v lib_vssh_hdrs="$$sorted_lib_vssh_hdrs" \
-		-v lib_vtls_srcs="$$sorted_lib_vtls_srcs" \
-		-v lib_vtls_hdrs="$$sorted_lib_vtls_hdrs" \
-		"$$awk_code" $(srcdir)/$(VC10_LIBTMPL) > $(VC10_LIBVCXPROJ) || { exit 1; }; \
-	\
-	echo "generating '$(VC10_SRCVCXPROJ)'"; \
-	awk -v proj_type=vcxproj \
-		-v src_srcs="$$sorted_src_srcs" \
-		-v src_hdrs="$$sorted_src_hdrs" \
-		-v src_rc="$$win32_src_rc" \
-		-v src_x_srcs="$$sorted_src_x_srcs" \
-		-v src_x_hdrs="$$sorted_src_x_hdrs" \
-		"$$awk_code" $(srcdir)/$(VC10_SRCTMPL) > $(VC10_SRCVCXPROJ) || { exit 1; }; \
-	\
-	echo "generating '$(VC11_LIBVCXPROJ)'"; \
-	awk -v proj_type=vcxproj \
-		-v lib_srcs="$$sorted_lib_srcs" \
-		-v lib_hdrs="$$sorted_lib_hdrs" \
-		-v lib_rc="$$win32_lib_rc" \
-		-v lib_vauth_srcs="$$sorted_lib_vauth_srcs" \
-		-v lib_vauth_hdrs="$$sorted_lib_vauth_hdrs" \
-		-v lib_vquic_srcs="$$sorted_lib_vquic_srcs" \
-		-v lib_vquic_hdrs="$$sorted_lib_vquic_hdrs" \
-		-v lib_vssh_srcs="$$sorted_lib_vssh_srcs" \
-		-v lib_vssh_hdrs="$$sorted_lib_vssh_hdrs" \
-		-v lib_vtls_srcs="$$sorted_lib_vtls_srcs" \
-		-v lib_vtls_hdrs="$$sorted_lib_vtls_hdrs" \
-		"$$awk_code" $(srcdir)/$(VC11_LIBTMPL) > $(VC11_LIBVCXPROJ) || { exit 1; }; \
-	\
-	echo "generating '$(VC11_SRCVCXPROJ)'"; \
-	awk -v proj_type=vcxproj \
-		-v src_srcs="$$sorted_src_srcs" \
-		-v src_hdrs="$$sorted_src_hdrs" \
-		-v src_rc="$$win32_src_rc" \
-		-v src_x_srcs="$$sorted_src_x_srcs" \
-		-v src_x_hdrs="$$sorted_src_x_hdrs" \
-		"$$awk_code" $(srcdir)/$(VC11_SRCTMPL) > $(VC11_SRCVCXPROJ) || { exit 1; }; \
-	\
-	echo "generating '$(VC12_LIBVCXPROJ)'"; \
-	awk -v proj_type=vcxproj \
-		-v lib_srcs="$$sorted_lib_srcs" \
-		-v lib_hdrs="$$sorted_lib_hdrs" \
-		-v lib_rc="$$win32_lib_rc" \
-		-v lib_vauth_srcs="$$sorted_lib_vauth_srcs" \
-		-v lib_vauth_hdrs="$$sorted_lib_vauth_hdrs" \
-		-v lib_vquic_srcs="$$sorted_lib_vquic_srcs" \
-		-v lib_vquic_hdrs="$$sorted_lib_vquic_hdrs" \
-		-v lib_vssh_srcs="$$sorted_lib_vssh_srcs" \
-		-v lib_vssh_hdrs="$$sorted_lib_vssh_hdrs" \
-		-v lib_vtls_srcs="$$sorted_lib_vtls_srcs" \
-		-v lib_vtls_hdrs="$$sorted_lib_vtls_hdrs" \
-		"$$awk_code" $(srcdir)/$(VC12_LIBTMPL) > $(VC12_LIBVCXPROJ) || { exit 1; }; \
-	\
-	echo "generating '$(VC12_SRCVCXPROJ)'"; \
-	awk -v proj_type=vcxproj \
-		-v src_srcs="$$sorted_src_srcs" \
-		-v src_hdrs="$$sorted_src_hdrs" \
-		-v src_rc="$$win32_src_rc" \
-		-v src_x_srcs="$$sorted_src_x_srcs" \
-		-v src_x_hdrs="$$sorted_src_x_hdrs" \
-		"$$awk_code" $(srcdir)/$(VC12_SRCTMPL) > $(VC12_SRCVCXPROJ) || { exit 1; }; \
-	\
-	echo "generating '$(VC14_LIBVCXPROJ)'"; \
-	awk -v proj_type=vcxproj \
-		-v lib_srcs="$$sorted_lib_srcs" \
-		-v lib_hdrs="$$sorted_lib_hdrs" \
-		-v lib_rc="$$win32_lib_rc" \
-		-v lib_vauth_srcs="$$sorted_lib_vauth_srcs" \
-		-v lib_vauth_hdrs="$$sorted_lib_vauth_hdrs" \
-		-v lib_vquic_srcs="$$sorted_lib_vquic_srcs" \
-		-v lib_vquic_hdrs="$$sorted_lib_vquic_hdrs" \
-		-v lib_vssh_srcs="$$sorted_lib_vssh_srcs" \
-		-v lib_vssh_hdrs="$$sorted_lib_vssh_hdrs" \
-		-v lib_vtls_srcs="$$sorted_lib_vtls_srcs" \
-		-v lib_vtls_hdrs="$$sorted_lib_vtls_hdrs" \
-		"$$awk_code" $(srcdir)/$(VC14_LIBTMPL) > $(VC14_LIBVCXPROJ) || { exit 1; }; \
-	\
-	echo "generating '$(VC14_SRCVCXPROJ)'"; \
-	awk -v proj_type=vcxproj \
-		-v src_srcs="$$sorted_src_srcs" \
-		-v src_hdrs="$$sorted_src_hdrs" \
-		-v src_rc="$$win32_src_rc" \
-		-v src_x_srcs="$$sorted_src_x_srcs" \
-		-v src_x_hdrs="$$sorted_src_x_hdrs" \
-		"$$awk_code" $(srcdir)/$(VC14_SRCTMPL) > $(VC14_SRCVCXPROJ) || { exit 1; }; \
-	\
-	echo "generating '$(VC14_10_LIBVCXPROJ)'"; \
-	awk -v proj_type=vcxproj \
-		-v lib_srcs="$$sorted_lib_srcs" \
-		-v lib_hdrs="$$sorted_lib_hdrs" \
-		-v lib_rc="$$win32_lib_rc" \
-		-v lib_vauth_srcs="$$sorted_lib_vauth_srcs" \
-		-v lib_vauth_hdrs="$$sorted_lib_vauth_hdrs" \
-		-v lib_vquic_srcs="$$sorted_lib_vquic_srcs" \
-		-v lib_vquic_hdrs="$$sorted_lib_vquic_hdrs" \
-		-v lib_vssh_srcs="$$sorted_lib_vssh_srcs" \
-		-v lib_vssh_hdrs="$$sorted_lib_vssh_hdrs" \
-		-v lib_vtls_srcs="$$sorted_lib_vtls_srcs" \
-		-v lib_vtls_hdrs="$$sorted_lib_vtls_hdrs" \
-		"$$awk_code" $(srcdir)/$(VC14_10_LIBTMPL) > $(VC14_10_LIBVCXPROJ) || { exit 1; }; \
-	\
-	echo "generating '$(VC14_10_SRCVCXPROJ)'"; \
-	awk -v proj_type=vcxproj \
-		-v src_srcs="$$sorted_src_srcs" \
-		-v src_hdrs="$$sorted_src_hdrs" \
-		-v src_rc="$$win32_src_rc" \
-		-v src_x_srcs="$$sorted_src_x_srcs" \
-		-v src_x_hdrs="$$sorted_src_x_hdrs" \
-		"$$awk_code" $(srcdir)/$(VC14_10_SRCTMPL) > $(VC14_10_SRCVCXPROJ) || { exit 1; }; \
-	\
-	echo "generating '$(VC14_30_LIBVCXPROJ)'"; \
-	awk -v proj_type=vcxproj \
-		-v lib_srcs="$$sorted_lib_srcs" \
-		-v lib_hdrs="$$sorted_lib_hdrs" \
-		-v lib_rc="$$win32_lib_rc" \
-		-v lib_vauth_srcs="$$sorted_lib_vauth_srcs" \
-		-v lib_vauth_hdrs="$$sorted_lib_vauth_hdrs" \
-		-v lib_vquic_srcs="$$sorted_lib_vquic_srcs" \
-		-v lib_vquic_hdrs="$$sorted_lib_vquic_hdrs" \
-		-v lib_vssh_srcs="$$sorted_lib_vssh_srcs" \
-		-v lib_vssh_hdrs="$$sorted_lib_vssh_hdrs" \
-		-v lib_vtls_srcs="$$sorted_lib_vtls_srcs" \
-		-v lib_vtls_hdrs="$$sorted_lib_vtls_hdrs" \
-		"$$awk_code" $(srcdir)/$(VC14_30_LIBTMPL) > $(VC14_30_LIBVCXPROJ) || { exit 1; }; \
-	\
-	echo "generating '$(VC14_30_SRCVCXPROJ)'"; \
-	awk -v proj_type=vcxproj \
-		-v src_srcs="$$sorted_src_srcs" \
-		-v src_hdrs="$$sorted_src_hdrs" \
-		-v src_rc="$$win32_src_rc" \
-		-v src_x_srcs="$$sorted_src_x_srcs" \
-		-v src_x_hdrs="$$sorted_src_x_hdrs" \
-		"$$awk_code" $(srcdir)/$(VC14_30_SRCTMPL) > $(VC14_30_SRCVCXPROJ) || { exit 1; };)
+lint: badwords checksrc
+	@PERL@ $(top_srcdir)/scripts/spacecheck.pl
 
 tidy:
 	(cd src && $(MAKE) tidy)
 	(cd lib && $(MAKE) tidy)
+
+clean-local:
+	(cd tests && $(MAKE) clean)
diff --git a/third-party/curl/Makefile.dist b/third-party/curl/Makefile.dist
deleted file mode 100644
index a5818e1da5..0000000000
--- a/third-party/curl/Makefile.dist
+++ /dev/null
@@ -1,92 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-all:
-	./configure
-	make
-
-ssl:
-	./configure --with-openssl
-	make
-
-mingw32:
-	$(MAKE) -C lib -f Makefile.mk
-	$(MAKE) -C src -f Makefile.mk
-
-mingw32-clean:
-	$(MAKE) -C lib -f Makefile.mk clean
-	$(MAKE) -C src -f Makefile.mk clean
-	$(MAKE) -C docs/examples -f Makefile.mk clean
-
-mingw32-vclean mingw32-distclean:
-	$(MAKE) -C lib -f Makefile.mk vclean
-	$(MAKE) -C src -f Makefile.mk vclean
-	$(MAKE) -C docs/examples -f Makefile.mk vclean
-
-mingw32-examples%:
-	$(MAKE) -C docs/examples -f Makefile.mk CFG=$@
-
-mingw32%:
-	$(MAKE) -C lib -f Makefile.mk CFG=$@
-	$(MAKE) -C src -f Makefile.mk CFG=$@
-
-vc:
-	cd winbuild
-	nmake /f Makefile.vc MACHINE=x86
-
-vc-x64:
-	cd winbuild
-	nmake /f Makefile.vc MACHINE=x64
-
-djgpp%:
-	$(MAKE) -C lib -f Makefile.mk CFG=$@ CROSSPREFIX=i586-pc-msdosdjgpp-
-	$(MAKE) -C src -f Makefile.mk CFG=$@ CROSSPREFIX=i586-pc-msdosdjgpp-
-
-cygwin:
-	./configure
-	make
-
-cygwin-ssl:
-	./configure --with-openssl
-	make
-
-amiga%:
-	$(MAKE) -C lib -f Makefile.mk CFG=$@ CROSSPREFIX=m68k-amigaos-
-	$(MAKE) -C src -f Makefile.mk CFG=$@ CROSSPREFIX=m68k-amigaos-
-
-unix: all
-
-unix-ssl: ssl
-
-linux: all
-
-linux-ssl: ssl
-
-ca-bundle: scripts/mk-ca-bundle.pl
-	@echo "generate a fresh ca-bundle.crt"
-	@perl $< -b -l -u lib/ca-bundle.crt
-
-ca-firefox: lib/firefox-db2pem.sh
-	@echo "generate a fresh ca-bundle.crt"
-	./lib/firefox-db2pem.sh lib/ca-bundle.crt
diff --git a/third-party/curl/README b/third-party/curl/README
index f5efbd70a6..4ee7e43a2c 100644
--- a/third-party/curl/README
+++ b/third-party/curl/README
@@ -15,7 +15,8 @@ README
   available to be used by your software. Read the libcurl.3 man page to
   learn how.
 
-  You find answers to the most frequent questions we get in the FAQ document.
+  You find answers to the most frequent questions we get in the FAQ.md
+  document.
 
   Study the COPYING file for distribution terms.
 
@@ -32,24 +33,18 @@ WEBSITE
 
   Visit the curl website for the latest news and downloads:
 
-        https://curl.se/
+  https://curl.se/
 
 GIT
 
   To download the latest source code off the GIT server, do this:
 
-    git clone https://github.com/curl/curl.git
+  git clone https://github.com/curl/curl
 
   (you will get a directory named curl created, filled with the source code)
 
 SECURITY PROBLEMS
 
-  Report suspected security problems via our HackerOne page and not in public.
+  Report suspected security problems privately and not in public.
 
-    https://hackerone.com/curl
-
-NOTICE
-
-  Curl contains pieces of source code that is Copyright (c) 1998, 1999
-  Kungliga Tekniska Högskolan. This notice is included here to comply with the
-  distribution terms.
+  https://curl.se/dev/vuln-disclosure.html
diff --git a/third-party/curl/README.md b/third-party/curl/README.md
index 8e58662603..9f77de607b 100644
--- a/third-party/curl/README.md
+++ b/third-party/curl/README.md
@@ -6,26 +6,33 @@ SPDX-License-Identifier: curl
 
 # [![curl logo](https://curl.se/logo/curl-logo.svg)](https://curl.se/)
 
-Curl is a command-line tool for transferring data specified with URL
-syntax. Find out how to use curl by reading [the curl.1 man
-page](https://curl.se/docs/manpage.html) or [the MANUAL
-document](https://curl.se/docs/manual.html). Find out how to install Curl
-by reading [the INSTALL document](https://curl.se/docs/install.html).
+curl is a command-line tool for transferring data from or to a server using
+URLs. It supports these protocols: DICT, FILE, FTP, FTPS, GOPHER, GOPHERS,
+HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, MQTTS, POP3, POP3S, RTSP, SCP,
+SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS.
+
+Learn how to use curl by reading [the
+man page](https://curl.se/docs/manpage.html) or [everything
+curl](https://everything.curl.dev/).
+
+Find out how to install curl by reading [the INSTALL
+document](https://curl.se/docs/install.html).
 
 libcurl is the library curl is using to do its job. It is readily available to
-be used by your software. Read [the libcurl.3 man
-page](https://curl.se/libcurl/c/libcurl.html) to learn how.
+be used by your software. Read [the libcurl
+man page](https://curl.se/libcurl/c/libcurl.html) to learn how.
 
-You can find answers to the most frequent questions we get in [the FAQ
-document](https://curl.se/docs/faq.html).
+## Open Source
 
-Study [the COPYING file](https://curl.se/docs/copyright.html) for
-distribution terms.
+curl is Open Source and is distributed under an MIT-like
+[license](https://curl.se/docs/copyright.html).
 
 ## Contact
 
-If you have problems, questions, ideas or suggestions, please contact us by
-posting to a suitable [mailing list](https://curl.se/mail/).
+Contact us on a suitable [mailing list](https://curl.se/mail/) or
+use GitHub [issues](https://github.com/curl/curl/issues)/
+[pull requests](https://github.com/curl/curl/pulls)/
+[discussions](https://github.com/curl/curl/discussions).
 
 All contributors to the project are listed in [the THANKS
 document](https://curl.se/docs/thanks.html).
@@ -37,31 +44,22 @@ applications using (lib)curl visit [the support page](https://curl.se/support.ht
 
 ## Website
 
-Visit the [curl website](https://curl.se/) for the latest news and
-downloads.
+Visit the [curl website](https://curl.se/) for the latest news and downloads.
 
-## Git
+## Source code
 
-To download the latest source from the Git server, do this:
+Download the latest source from the Git server:
 
-    git clone https://github.com/curl/curl.git
-
-(you will get a directory named curl created, filled with the source code)
+    git clone https://github.com/curl/curl
 
 ## Security problems
 
-Report suspected security problems via [our HackerOne
-page](https://hackerone.com/curl) and not in public.
-
-## Notice
-
-Curl contains pieces of source code that is Copyright (c) 1998, 1999 Kungliga
-Tekniska Högskolan. This notice is included here to comply with the
-distribution terms.
+Report suspected security problems
+[privately](https://curl.se/dev/vuln-disclosure.html) and not in public.
 
 ## Backers
 
-Thank you to all our backers! � [Become a backer](https://opencollective.com/curl#section-contribute).
+Thank you to all our backers :pray: [Become a backer](https://opencollective.com/curl#section-contribute).
 
 ## Sponsors
 
diff --git a/third-party/curl/RELEASE-NOTES b/third-party/curl/RELEASE-NOTES
index 0fc352c458..f6f67d988c 100644
--- a/third-party/curl/RELEASE-NOTES
+++ b/third-party/curl/RELEASE-NOTES
@@ -1,401 +1,624 @@
-curl and libcurl 8.3.0
+curl and libcurl 8.21.0
 
- Public curl releases:         251
- Command line options:         257
- curl_easy_setopt() options:   303
- Public functions in libcurl:  92
- Contributors:                 2977
+ Public curl releases:         275
+ Command line options:         274
+ curl_easy_setopt() options:   308
+ Public functions in libcurl:  100
+ Authors:                      1489
+ Contributors:                 3731
 
 This release includes the following changes:
 
- o curl: make %output{} in -w specify a file to write to [36]
- o gskit: remove [71]
- o lib: --disable-bindlocal builds curl without local binding support
- o nss: remove support for this TLS library [10]
- o tool: add "variable" support [1]
- o trace: make tracing available in non-debug builds [41]
- o url: change default value for CURLOPT_MAXREDIRS to 30 [46]
- o urlapi: CURLU_PUNY2IDN - convert from punycode to IDN name [54]
- o wolfssl: support loading system CA certificates [8]
+ o curl: named globs in output file name for upload glob references [77]
+ o HTTP/3: add proxy CONNECT and MASQUE CONNECT-UDP support (ngtcp2 QUIC) [53]
+ o http2: remove stream dependency tracking [40]
+ o lib: drop support for CURLAUTH_DIGEST_IE [4]
+ o libssh: add support for SHA256 host public keys [57]
+ o tool_urlglob: add named globs [92]
 
 This release includes the following bugfixes:
 
- o altsvc: accept and parse IPv6 addresses in response headers [113]
- o asyn-ares: reduce timeout to 2000ms [148]
- o aws-sigv4: canonicalize the query [127]
- o aws-sigv4: fix having date header twice in some cases [141]
- o aws-sigv4: handle no-value user header entries [159]
- o bearssl: don't load CA certs when peer verification is disabled [33]
- o bearssl: handshake fix, provide proper get_select_socks() implementation [99]
- o build: fix portability of mancheck and checksrc targets
- o build: streamline non-UWP wincrypt detections [87]
- o c-hyper: adjust the hyper to curlcode conversion [52]
- o c-hyper: fix memory leaks in `Curl_http` [126]
- o cf-haproxy: make CURLOPT_HAPROXY_CLIENT_IP set the *source* IP [61]
- o cf-socket: log successful interface bind [39]
- o CI/cirrus: disable python install on FreeBSD [83]
- o CI: add a 32-bit i686 Linux build [158]
- o CI: add caching to many jobs [19]
- o CI: move on to ngtcp2 v0.19.1 [154]
- o CI: move the Alpine build from Cirrus to GHA
- o CI: ngtcp2-linux: use separate caches for tls libraries [125]
- o CI: remove Windows builds from Cirrus, without replacement [131]
- o CI: switch macOS ARM build from Cirrus to Circle CI
- o CI: use master again for wolfssl
- o cirrus: install everthing with pkg, avoid pip [110]
- o cmake: add GnuTLS option [103]
- o cmake: add support for `CURL_DEFAULT_SSL_BACKEND` [128]
- o cmake: add support for single libcurl compilation pass [21]
- o cmake: allow `SHARE_LIB_OBJECT=ON` on all platforms [80]
- o cmake: assume `wldap32` availability on Windows [81]
- o cmake: cache more config and delete unused ones [4]
- o cmake: detect `SSL_set0_wbio` in OpenSSL [22]
- o cmake: drop `HAVE_LIBWINMM` and `HAVE_LIBWS2_32` feature checks [68]
- o cmake: fix to use variable for the curl namespace [79]
- o cmake: fixup H2 duplicate symbols for unity builds [23]
- o cmake: set SIZEOF_LONG_LONG in curl_config.h [165]
- o cmake: support building static and shared libcurl in one go [17]
- o cmdline-docs: make sure to phrase it as "added in ...." [161]
- o cmdline-docs: use present tense, not future [160]
- o cmdline-opts/docs: mention the negative option part [90]
- o cmdline-opts/page-header: clarify stronger that !opt == URL [123]
- o cmdline-opts/page-header: reorder, clean up [51]
- o configure, cmake, lib: more form api deprecation [7]
- o configure: fix `HAVE_TIME_T_UNSIGNED` check [153]
- o configure: trust pkg-config when it's used for zlib [149]
- o configure: use the pkg-config --libs-only-l flag for libssh2 [16]
- o connect: stop halving the remaining timeout when less than 600 ms left [147]
- o cookie-jar.d: emphasize that this option is ONLY writing cookies [72]
- o crypto: ensure crypto initialization works [69]
- o curl_url_get/set.3: add missing semicolon in SYNOPSIS
- o CURLINFO_CERTINFO.3: better explain curl_certinfo struct [64]
- o CURLINFO_TLS_SSL_PTR.3: clarify a recommendation [75]
- o CURLOPT_*TIMEOUT*: extend and clarify [101]
- o CURLOPT_SSL_VERIFYPEER.3: mention it does not load CA certs when disabled [42]
- o CURLOPT_URL.3: add two URL API calls in the see-also section
- o CURLOPT_URL.3: explain curl_url_set() uses the same parser
- o digest: Use hostname to generate spn instead of realm [164]
- o disable.d: explain --disable not implemented prior to 7.50.0 [115]
- o docs/cmdline-opts/gen.pl: hide "added in" before 7.50.0 [76]
- o docs/cmdline-opts: match the current output [104]
- o docs/cmdline-opts: spellfixes, typos and polish [9]
- o docs/cmdline: add small "warning" to verbose options [59]
- o docs/cmdline: remove repeated working for negotiate + ntlm [58]
- o docs/HYPER.md: document a workaround for a link error [73]
- o docs: add curl_global_trace to some SEE ALSO sections [133]
- o docs: link to the website versions instead of markdowns [3]
- o docs: mark --ssl-revoke-best-effort as Schannel specific [162]
- o docs: mention critical files in same directories as curl saves [119]
- o docs: removing "pausing transfers" from HYPER.md. [134]
- o docs: rewrite to present tense [105]
- o easy: remove #ifdefs to make code easier on the eye [34]
- o egd: delete feature detection and related source code [5]
- o ftp: fix temp write of ipv6 address [143]
- o gen.pl: escape all dashes (ascii minus) to avoid unicode hyphens [50]
- o gen.pl: replace all single quotes with aq [78]
- o GHA: adding quiche workflow [35]
- o headers: accept leading whitespaces on first response header [37]
- o http2: avoid too early connection re-use/multiplexing [20]
- o http2: cleanup trace messages [56]
- o http2: disable asssertion blocking OSSFuzz testing [31]
- o http2: fix in h2 proxy tunnel: progress in ingress on sending [32]
- o http2: polish things around POST [132]
- o http2: upgrade tests and add fix for non-existing stream [44]
- o http3/ngtcp2: shorten handshake, trace cleanup [13]
- o http3: quiche, handshake optimization, trace cleanup [63]
- o http: close the connection after a late 417 is received [109]
- o http: do not require a user name when using CURLAUTH_NEGOTIATE [86]
- o http: fix sending of large requests [156]
- o http: remove the p_pragma struct field [60]
- o http: return error when receiving too large header set [43]
- o hyper: fix a progress upload counter bug [122]
- o hyper: fix ownership problems [116]
- o hyper: remove `hyptransfer->endtask` [137]
- o imap: add a check for failing strdup()
- o imap: remove the only sscanf() call in the IMAP code [84]
- o include.d: explain headers not printed with --fail before 7.75.0 [155]
- o include/curl/mprintf.h: add __attribute__ for the prototypes [38]
- o krb5: fix "implicit conversion loses integer precision" warnings [152]
- o lib: add ability to disable auths individually [135]
- o lib: build fixups when built with most things disabled [97]
- o lib: fix a few *printf() flag mistakes [47]
- o lib: fix null ptr derefs and uninitialized vars (h2/h3) [107]
- o lib: move mimepost data from ->req.p.http to ->state [94]
- o libtest: use curl_free() to free libcurl allocated data [114]
- o list-only.d: mention SFTP as supported protocol [55]
- o macOS: fix target detection more [11]
- o misc: fix various typos [18]
- o multi.h: the 'revents' field of curl_waitfd is supported [117]
- o multi: more efficient pollfd count for poll [130]
- o multi: remove 'processing: <url>' debug message [142]
- o ngtcp2: fix handling of large requests [150]
- o openssl: auto-detect `SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED` [65]
- o openssl: clear error queue after SSL_shutdown [120]
- o openssl: make aws-lc version support OCSP [48]
- o openssl: Support async cert verify callback [24]
- o openssl: switch to modern init for LibreSSL 2.7.0+ [70]
- o openssl: use `SSL_CTX_set_ciphersuites` with LibreSSL 3.4.1 [66]
- o openssl: use `SSL_CTX_set_keylog_callback` with LibreSSL 3.5.0 [67]
- o openssl: when CURLOPT_SSL_CTX_FUNCTION is registered, init x509 store before [151]
- o os400: build test servers [136]
- o os400: do not check translatable options at build time [95]
- o os400: implement CLI tool [140]
- o page-footer: QLOGDIR works with ngtcp2 and quiche [62]
- o page-header: move up a URL paragraph from GLOBBING to URL
- o pytest: fix check for slow_network skips to only apply when intended [157]
- o quic: don't set SNI if hostname is an IP address [166]
- o quiche: adjust quiche `QUIC_IDLE_TIMEOUT` to 60s
- o quiche: enable quiche to handle timeout events [82]
- o resolve: use PF_INET6 family lookups when CURL_IPRESOLVE_V6 is set [2]
- o revert "schannel: reverse the order of certinfo insertions" [14]
- o schannel: fix ordering of cert chain info [163]
- o schannel: fix user-set legacy algorithms in Windows 10 & 11 [53]
- o schannel: verify hostname independent of verify cert [74]
- o sectransp: fix compiler warnings [129]
- o sectransp: prevent CFRelease() of NULL [26]
- o secureserver.pl: fix stunnel path quoting [112]
- o secureserver.pl: fix stunnel version parsing [111]
- o SECURITY-PROCESS.md: not a sec issue: Tricking user to run a cmdline [146]
- o system.h: add CURL_OFF_T definitions on HP-UX with HP aCC [108]
- o test1304: build and skip without netrc support
- o test1554: check translatable string options in OS400 wrapper [96]
- o test1608: make it build and get skipped without shuffle DNS support
- o test687/688: two more basic --xattr tests [89]
- o tests/tftpd+mqttd: make variables static to silence picky warnings [57]
- o tests: add 'large-time' as a testable feature [92]
- o tests: add support for nested %if conditions [91]
- o tests: don't call HTTP errors OK in test cases
- o tests: ensure `libcurl.def` contains all exports [45]
- o tests: fix h3 server check and parallel instances [6]
- o tests: TLS session sharing test [100]
- o tests: update cookie expiry dates to far in the future [121]
- o time-cond.d: mention what happens on a missing file [93]
- o tool: avoid including leading spaces in the Location hyperlink [145]
- o tool: change some fopen failures from warnings to errors [144]
- o tool: make the length argument an int for printf()-.* flags [49]
- o tool_cb_wrt: fix invalid unicode for windows console [25]
- o tool_filetime: make -z work with file dates before 1970 [139]
- o tool_operate: allow both SSL_CERT_FILE and SSL_CERT_DIR [12]
- o tool_operate: make aws-sigv4 not require TLS to be used
- o tool_paramhlp: improve str2num(): avoid unnecessary call to strlen() [118]
- o tool_urlglob: use the correct format specifier for curl_off_t in msnprintf [88]
- o transfer: also stop the sending on closed connection [124]
- o transfer: don't set TIMER_STARTTRANSFER on first send [77]
- o unit2600: fix build warning if built without verbose messages
- o url: remove infof() output for "still name resolving" [28]
- o urlapi: fix heap buffer overflow [30]
- o urlapi: make sure zoneid is also duplicated in curl_url_dup [29]
- o urlapi: return CURLUE_BAD_HOSTNAME if puny2idn encoding fails [102]
- o urlapi: setting a blank URL ("") is not an ok URL [106]
- o vquic: show stringified messages for errno [40]
- o vtls: clarify "ALPN: offers" message [27]
- o winbuild: improve check for static zlib [15]
- o wolfSSL: avoid the OpenSSL compat API when not needed [85]
- o workflows/macos.yml: disable zstd and alt-svc in the http-only build [98]
- o write-out.d: clarify %{time_starttransfer}
- o ws: fix spelling mistakes in examples and tests [138]
+ o _ENVIRONMENT.md. Windows does case insensitive env variables [214]
+ o _URL.md: remove the zone-id mention [227]
+ o AmigaOS: curl_setup.h avoid explicit_bzero with clib2 [283]
+ o AmigaOS: fix build fallouts, re-add to CI [279]
+ o asyn-thrdd: add IPv6 guards [195]
+ o asyn-thrdd: fix result processing without wakeup socketpair [2]
+ o autotools: mbedtls detection fixes [163]
+ o BINDINGS: Update Hollywood link [181]
+ o BUFQ.md: re-sync with source code [111]
+ o build: enable `-Wlogical-op` picky warning for GCC 4.4+ [277]
+ o build: omit zlib pkg-config reference for Android [130]
+ o cf-h2-prox: fix peer leak [132]
+ o cf-h2-proxy: drop interim responses [47]
+ o cf-https-connect: do not engage on proxy origin [236]
+ o cf-ip-happy.c: minor comment typo
+ o cf-ip-happy: update documentation [223]
+ o cf-socket: make Curl_addr2string static [224]
+ o cf-socket: set scope_id for IPv6 link-local addresses [150]
+ o cf-socket: store errno from do_connect in ctx->error [199]
+ o cfilters: fix busy loop on blocked transfers [72]
+ o chunked: reject invalid bytes in trailer [210]
+ o CIPHERS.md: fix the example that uses only TLS 1.3 [137]
+ o cmake/FindGSS: drop "MIT Unknown" version value, related tidy ups [292]
+ o cmake/FindGSS: drop CMake <3.16 compatibility logic [291]
+ o cmake/FindGSS: fix comment, adjust custom flavor property name [261]
+ o cmake/FindGSS: prioritize MIT over GNU in pkg-config detection [196]
+ o cmake: auto-select static nghttp2/nghttp3/ngtcp2 Config [8]
+ o cmake: export/forward `NGTCP2_CRYPTO_BACKEND` [99]
+ o cmake: fix three issues generating lib options in config files [126]
+ o cmake: fix zstd CMake config name [5]
+ o cmake: opt in `MSVC_VERSION` 1951 to picky warnings [55]
+ o cmake: quote `COMPONENTS` string in `curl-config.in.cmake` [80]
+ o cmake: simplify `LINK_ONLY` imported target extraction [294]
+ o config2setopts: use default protocol properly [286]
+ o connect: remove deref of freed pointer in trace call [128]
+ o content_encoding: fix limit failure message [171]
+ o content_encoding: fix non-last chunked rejection [209]
+ o content_encoding: timeout during slow decoding [170]
+ o cookie: check __Secure- and __Host- case sensitively when read from file [256]
+ o cookie: compare path case sensitively [52]
+ o cookie: reject control octets in file-loaded cookies [289]
+ o cookie: simplify strstore(), remove outdated comment [12]
+ o cookie: tailmatch the domains for secure override [200]
+ o cookie: trim trailing dots when checking PSL [39]
+ o creds: add sasl service name [75]
+ o creds: create with empty user+pass [304]
+ o creds: mask OAuth bearer token in trace logs [117]
+ o creds: remove two unused functions [158]
+ o curl_easy_pause.md: rephrase the stream cache when pause clause [120]
+ o curl_easy_setopt.md: change options when no transfer runs [122]
+ o curl_formdata: fix to pass long where missing, document `CURLFORM_NAMELENGTH` [243]
+ o curl_multi_assign.md: clarify lifetime [264]
+ o curl_ntlm_core: fix nettle 4+ builds in certain MultiSSL combos [87]
+ o curl_ntlm_core: propagate DES `CryptEncrypt()` error [84]
+ o curl_sha512_256: fix result code on error [166]
+ o CURLINFO_CONTENT_LENGTH_UPLOAD_T.md: expand [215]
+ o CURLMOPT_SOCKETFUNCTION.md: this sends *all* file descriptors [266]
+ o CURLOPT_CHUNK_BGN_FUNCTION: target is there for symlinks only [156]
+ o CURLOPT_DISALLOW_USERNAME_IN_URL: is for CURLOPT_URL only [61]
+ o CURLOPT_DOH_URL.md: does not inherit proxy options [213]
+ o CURLOPT_ECH.md: simplify the description language [18]
+ o CURLOPT_HAPROXYPROTOCOL.md: only sent for newly setup connections [32]
+ o CURLOPT_MAXFILESIZE: clarify this also works for on-going transfers [78]
+ o CURLOPT_PINNEDPUBLICKEY.md: does not apply for other origins [152]
+ o CURLOPT_PORT.md: use stronger language [133]
+ o CURLOPT_SHARE: warn about early remove [51]
+ o CURLOPT_SSH_HOSTKEYFUNCTION.md: for new connections only [48]
+ o CURLOPT_WRITEFUNCTION.md: mention redirects [226]
+ o CURLOPT_WRITEFUNCTION.md: remove stray reference to HSTS [208]
+ o delta: harden external command invocations [98]
+ o digest: escape control codes too [206]
+ o digest: flush proxy state on proxy or credential change [225]
+ o digest: flush state on origin or credential change [235]
+ o dns-httpsrr-lookup: use origin, not peer [302]
+ o dnscache: remove Curl_dns_entry_link [160]
+ o docs/libcurl: fix the version for curl_multi_socket_action
+ o docs: end "...can be used several times..." sentences with period [34]
+ o docs: fix --follow doc typo [97]
+ o docs: fix a couple of typos [62]
+ o docs: fix grammar and wording in FAQ [66]
+ o docs: fix odd wording in CONTRIBUTE.md [107]
+ o docs: note CURLOPT_PINNEDPUBLICKEY has no effect on legacy LDAP backend [65]
+ o docs: returned header size reflects HTTP/1-style format [203]
+ o doh: cap the maximum TTL to 24 hours [234]
+ o doh: drop redundant `curlx_dyn_free()` call in `doh_probe_done()` [232]
+ o doh: stricter HTTPS RNAME parsing [233]
+ o ECH: cleanups [20]
+ o event: fix wakeup consumption [93]
+ o ftp: avoid accessing EPSV response one byte past the NULL [9]
+ o ftp: remove 2 Curl_resolv_blocking() calls [30]
+ o ftp: remove bits.ftp_use_control_ssl [28]
+ o ftplistparser: clear strings.target if not symlink [148]
+ o gnutls: allow building with nettle 4.0 [96]
+ o gnutls: fix more nettle 4+ compatibility issues [94]
+ o gnutls: require 3.7.2 for earlydata [103]
+ o gsasl: fix potential double free [56]
+ o gtls: fix ignored return and uninitialized status in OCSP check [49]
+ o gtls: fix some typos [15]
+ o gtls: minor fixes and improvements [190]
+ o gtls: use the correct return code in trace output [173]
+ o gtls: verify OCSP response signature in gtls_verify_ocsp_status [86]
+ o h3-proxy: fix callback return values, and a typo in tests [139]
+ o hostip: remove unused MAX_HOSTCACHE_LEN and MAX_DNS_CACHE_SIZE [101]
+ o hsts.md: mention multiple curl invokes effect [189]
+ o hsts: duplicate live HSTS data in curl_easy_duphandle [183]
+ o http-proxy: verify CONNECT response headers [192]
+ o HTTP3.md: update quiche build [229]
+ o http: don't pass on set cookies to new origins [140]
+ o http: prefer chunked encoding over Content-Length: 0 [146]
+ o http: reject spurious CR bytes in headers [157]
+ o http_digest: return better error [204]
+ o idn: replace header guards with forward declaration [100]
+ o INSTALL-CMAKE.md: document CMake environment variables [246]
+ o INTERNALS.md: document minimum nghttp3 and ngtcp2 versions [299]
+ o KNOWN_BUGS.md: remove fixed GnuTLS <-> OpenSSL incompat bug [41]
+ o KNOWN_BUGS: remove stale Threads::Threads entry [135]
+ o krb5_sspi: fix error message on `DecryptMessage()` fail [269]
+ o ldap: base64 encode binary LDIF values with WinLDAP [273]
+ o ldap: fix minor leak on write callback error [24]
+ o ldap: fix to not leak `attribute` on OOM (WinLDAP) [79]
+ o ldap: switch off chasing referrals [114]
+ o lib678: fix to not be perma-skipped [10]
+ o lib: make `__STDC_VERSION__` literals `L` (where missing)
+ o lib: transfer origin and proxy handling [276]
+ o lib: two minor typos [16]
+ o libcurl-easy.md: minor clarifications [19]
+ o libssh2: do not use deprecated macros when unavailable [177]
+ o libssh2: drop stray double-negative from `strncmp()` result [194]
+ o libssh2: fix to return error code on missing parameter [198]
+ o libssh2: replace macro names with non-misspelled alternatives [169]
+ o libssh2: save non-standard port to `known_hosts` [217]
+ o libssh2: sync version check with INTERNALS.md [176]
+ o libssh2: use non-deprecated `libssh2_knownhost_addc()` [178]
+ o libssh: map SSH_KNOWN_HOSTS_OTHER to CURLKHMATCH_MISMATCH [125]
+ o m4: drop redundant conditions in TLS library detections [155]
+ o Makefile.am: drop test1190 listed twice [144]
+ o managen: apply minor fixes and improvements [115]
+ o mbedtls: null-terminate the private key blob [36]
+ o mk-unity.pl: `#include`, and not concatenate input headers [124]
+ o mqtt: return error on truncated Remaining Length [230]
+ o mqtt: validate PINGRESP and DISCONNECT have remaining_length == 0 [7]
+ o multi: handle pause in multi socket callback [109]
+ o multi: remove a stale comment [216]
+ o multi: silence gcc 16 `-Wnull-dereference`, bump CI job to test [54]
+ o multi: xfers_really_alive [288]
+ o netrc: remember and check filename loaded [212]
+ o netrc: scanner refactor [121]
+ o ngtcp2: fail handshake directly [138]
+ o openssl: do not mix OpenSSL int result with `CURLcode` variable [265]
+ o os400sys: fix theoretical length overflows [141]
+ o peer.h: fix typo in comment [202]
+ o pingpong: reject nul byte in server response line [268]
+ o progress: fix CURLINFO time reporting [145]
+ o psl: require libpsl 0.16.0 (2016-12-10) or greater [188]
+ o pytest: pass `--disable` to curl [175]
+ o pytest: re-enable test test_05_01 and test_05_02 for quiche 0.29.0+ [154]
+ o pythonlint.sh: make it fail on error, fix ruff warnings in pytest [67]
+ o quic: count zero length packets against max [179]
+ o ratelimits: use minimal burst rate [245]
+ o RELEASE-PROCEDURE.md: update coming relese dates
+ o resolve: mention in error that IP address is expected [205]
+ o rtsp: bump buf after rtsp_filter_rtp() [88]
+ o runner.pm: apply minor correctness fix [105]
+ o runner.pm: set `CURL_TESTNUM` for `precheck` commands [13]
+ o runtests: fix tests for curl builds with embedded CA bundle [187]
+ o rustls: error on CURLOPT_CRLFILE with native CA store [59]
+ o schannel: check `schannel_sha256sum()` success, and more [165]
+ o schannel: enforce Extended Key Usage for custom CA roots [29]
+ o schannel: error on TLS 1.3-only with cipher list [136]
+ o schannel: fix https proxy for client cert and certinfo [280]
+ o schannel: fix revoke_best_effort setting for proxy [70]
+ o schannel: use fopen instead CreateFile [191]
+ o schannel_verify: avoid out of blob access [11]
+ o schannel_verify: simplify CryptQueryObject use [159]
+ o scripts: catch Credits-to contributors [127]
+ o SECURITY-ADVISORY.md: expand [220]
+ o setopt: changing the proxy port is also a proxy change [23]
+ o setopt: clear proxy auth properly on NULL [81]
+ o setopt: clear the "custom" CA booleans when set to NULL [218]
+ o setopt: CURLOPT_MAXCONNECTS set to 0 restores default value [161]
+ o setopt: defref the old referer when setting a new [168]
+ o setopt: fix to honor `CURLOPT_PROXY_CAINFO_BLOB` over Native CA [26]
+ o setopt: gate a few proxy TLS options by checking backend support [35]
+ o setopt: more careful cleanup of the HSTS cache [45]
+ o setopt: return error if received `curl_blob->data` is NULL [185]
+ o show-headers.md: mention bold headers and --no-styled-output [17]
+ o sigv4: URL encode the user name in the header [193]
+ o smb: constify `strchr()` result variable [257]
+ o smb: integer overflow proof a size check [263]
+ o smbserver: update internal id generation for Python 3 [238]
+ o socket: introduce `SOCK_EAGAIN()` and use it [278]
+ o socket: use name `sockerr` for socket error variables [271]
+ o socks_sspi: invalid response length is a fatal error [272]
+ o socks_sspi: store socks5_gssapi_enctype [262]
+ o spnego_sspi: honor CURLOPT_GSSAPI_DELEGATION for Windows SSPI [89]
+ o spnego_sspi: preserve distinction btw policy-only and uncond delegation [74]
+ o src: fix comment typos [83]
+ o src: sync nghttp2 versions checks with current requirements [300]
+ o ssl native_ca_store: always reinit [211]
+ o SSLCERTS: document 8.19.0 default Native CA builds (Windows) [14]
+ o sspi: clear SSPI credentials on AcquireCredentialsHandle failure [76]
+ o sspi: free libcurl allocated memory with curlx_free [274]
+ o telnet: drop an `int` cast no longer necessary [270]
+ o telnet: drop redundant interim variables [275]
+ o telnet: fix error message typos [186]
+ o telnet: fix old copy-paste typo in variable name [281]
+ o telnet: honor CURLOPT_TIMEOUT in send_telnet_data() [104]
+ o test1588: use %TESTNUMBER, not hard-coded number [118]
+ o test1981: explicitly set the locale [85]
+ o tests: add `cookies` feature to some tests [182]
+ o tests: add an assert to avoid IPC blocking [69]
+ o tests: add the "--resolve" keyword to tests that lack it [184]
+ o tests: fix unit1636 with --disable-progress-meter [37]
+ o tftp: avoid the timeout calc if the timeout is crazy [151]
+ o tftp: stricter option name checks [90]
+ o tidy-up: add space around operators, where missing [147]
+ o tidy-up: apply clang-format fixes [153]
+ o tidy-up: drop stray casts for allocated pointers [174]
+ o tidy-up: miscellaneous [106]
+ o tls: fix incomplete mTLS config in conn reuse and session cache [108]
+ o tls: wolfssl: fixes for PQC key shares [239]
+ o tool: warn when --ssl and --ftp-ssl-control override each other [129]
+ o tool_formparse.c: fix two minor comment typos [25]
+ o tool_formparse: polish error message + make two functions static [1]
+ o tool_formparse: tool2curlparts is no longer recursive [33]
+ o tool_help: rectify a bad assert [143]
+ o tool_operhlp: avoid NULL to %s [142]
+ o tool_urlglob: avoid overflow at end of range [22]
+ o tool_urlglob: better 'Duplicate glob name' position [82]
+ o tool_urlglob: make globbing error reported for correct position [91]
+ o tool_writeout: fix %time{} output for %s [231]
+ o transfer: clear referer when set to NULL [112]
+ o unit1675: fix potential memory leak on dynbuf fail path [197]
+ o unix-sockets: ignore proxy settings [6]
+ o URL-SYNTAX: document more URL parsing details [134]
+ o url: compare full origin when setting credentials [42]
+ o url: connection credentials origin [228]
+ o url: connection reuse fixes for starttls [68]
+ o url: detect proxy changes read from environment [110]
+ o url: don't log bits.close state [290]
+ o url: fix connection reuse for starttls protocols [27]
+ o url: keep the question mark for empty queries [73]
+ o url: remove superfluous check [131]
+ o url: url_match_destination fix [43]
+ o urlapi: accept 0X prefix in IPv4 address as well [63]
+ o urlapi: change more lowercase percent-encoded to uppercase [71]
+ o urlapi: compare zone-id in Curl_url_same_origin() [95]
+ o urlapi: consume trailing dots after IPv4 numerical addresses [50]
+ o urlapi: deny hostnames with more than one trailing dot [58]
+ o urlapi: drop base fragment on empty redirect [64]
+ o urlapi: fix an issue parsing file URLs [149]
+ o urlapi: fix memleaks on error in `parse_hostname_login()` [221]
+ o urlapi: fix redirect handling if CURLU_NO_GUESS_SCHEME is set [46]
+ o urlapi: forbid '|' in host [172]
+ o urlapi: handle redirect without set scheme with default-scheme [38]
+ o urlapi: URL decode hostname before IP address normalization [207]
+ o user-agent.md: mention double quotes too [3]
+ o var: use a dedicated pointer for the alloc [219]
+ o verify-release: verify more thoroughly with git [249]
+ o vquic: drop stray casts for `iovec.iov_len` [162]
+ o vquic: fix `-Wunused-parameter` with proxies disabled [260]
+ o vtls: more large buffer support and error checks for SHA-256 [164]
+ o vtls: use Curl_safecmp for CRLfile and pinned_key comparison [116]
+ o vtls_scache: include signature_algorithms in the SSL peer cache key [123]
+ o vtls_spack: drop redundant macro fallbacks [167]
+ o VULN-DISCLOSURE-POLICY.md: emphasize comm as a human [180]
+ o VULN-DISCLOSURE-POLICY.md: emphasize the no email thank you part [113]
+ o VULN-DISCLOSURE-POLICY.md: test code is not secure [119]
+ o VULN-DISCLOSURE-POLICY: non-released code [253]
+ o websockets: auto-tunnel through http proxy [102]
+ o websockets: buffer ugprade data at connection level [237]
+ o windows: update MS SDK versions in comments [60]
+ o winldap: avoid NULL pointer deref on `ldap_get_dn()` fail [242]
+ o ws: make pong sending lazy [201]
+ o x509asn1: fix DH public key parameter extraction [44]
+ o x509asn1: fix operator order in do_pubkey [21]
 
 This release includes the following known bugs:
 
- o see docs/KNOWN_BUGS (https://curl.se/docs/knownbugs.html)
+ See https://curl.se/docs/knownbugs.html
+
+For all changes ever done in curl:
+
+ See https://curl.se/changes.html
 
 Planned upcoming removals include:
 
- o support for space-separated NOPROXY patterns
- o support for the original legacy mingw version 1
+ o local crypto implementations
+ o NTLM
+ o SMB
+ o TLS-SRP support
 
- See https://curl.se/dev/deprecate.html for details
+ See https://curl.se/dev/deprecate.html
 
 This release would not have looked like this without help, code, reports and
 advice from friends like these:
 
-  ad0p on github, Alexander Jaeger, Alexander Kanavin, apparentorder on github,
-  balikalina on Github, Benoit Pierre, Chris Talbot, Christian Hesse,
-  Dan Fandrich, Daniel Gustafsson, Daniel Stenberg, Dan Jacobson,
-  Dave Cottlehuber, Davide Masserut, Derzsi Dániel, Douglas R. Reno,
-  ed0d2b2ce19451f2, Emanuele Torre, Enrico Scholz, eppesuig, FC Stegerman,
-  Gabriel Corona, Gerome Fournier, Gisle Vanem, Goro FUJI, Graham Campbell,
-  Guillaume Algis, guoxinvmware on github, Harry Sintonen, Jacob Mealey,
-  JazJas on github, John Bampton, John Hawthorn, John Walker, Joseph Tharayil,
-  junsik on github, kyled-dell on github, Lukas Tribus, Maksim Arhipov,
-  Maksim Sciepanienka, Marcel Raad, Marin Hannache, Markus Sommer,
-  Martin Galvan, Mathew Benson, Matthias Gatto, Maurício Meneghini Fauth,
-  Michael Osipov, Mohamed Daahir, Nathan Moinvaziri, Niall McGee,
-  Nicholas Nethercote, Nicolas Noben, Nicolás Ojeda Bär, Oleg Jukovec,
-  oliverpool on github, Pablo Busse, Patrick Monnerat,
-  Philippe Antoine on HackerOne, pszlazak on github, Randall S. Becker,
-  Ray Satiro, Richard W.M. Jones, Rutger Broekhoff, Ryan Schmidt,
-  Samuel Chiang, Satana de Sant'Ana, Sergey, Sevan Janiyan, Stefan Eissing,
-  Thomas M. DuBuisson, Thorsten Klein, trrui-huawei, Viktor Szakats, vvb2060,
-  wangzhikun, Wilhelm von Thiele, Wyatt O'Day, yushicheng7788 on github,
-  zhihaoy on github
-  (80 contributors)
+  0xN3R3K3, 11soda11, Ady Elouej, A Johnston, Alan De Smet, alhudz,
+  alienowo on hackerone, ambikeesshh, amitbidlan, Andreas Falkenhahn,
+  Andrei Rybak, Andrew Nesbitt, Aritra Basu, av223119 on github,
+  azraelxuemo on hackerone, Bartel Sielski, Bastian Jesuiter,
+  BazaarAcc32 on github, Bill Mill, Bryan Henderson, ByteRay on hackerone,
+  chrizilla on github, co-authors in libssh2, correctmost on github,
+  Dan Fandrich, Daniel Gustafsson, Daniel Stenberg, Dario Vinella,
+  Darren Banfi, Dave Walker, daviey on hackerone, dependabot[bot],
+  dyingc on github, Earnestly on github, Elise Vance, Emanuel Krollmann,
+  Eunsoo Kim, evergarden1123 on hackerone, Fabian Keil, Filipe Casal,
+  Gao Liyou, Guancheng Li, Guannan Wang, Harry Sintonen, Hem Parekh, htasta,
+  jeffhuang, Jeremy Nicoll, Jiashuo Liang, jjchuck on hackerone,
+  Johannes Schlatow, Josef Cejka, Joshua Rogers, Kai Pastor, Marcel Raad,
+  Mark Esler, Max Dymond, Michael Kaufmann, mik, Mike-menny on github,
+  Muhamad Arga Reksapati, mulan_dh on hackerone, netspacer.research,
+  oreadvanthink on github, parasol-aser, penpal, Peter Krefting, Philip H.,
+  Rainer Jung, Randall S. Becker, Raymond Steen, Ray Satiro,
+  renjian on hackerone, renovate[bot], Ross Burton, Saud Alshareef,
+  Sergio Correia, sfan5 on github, Shintomon Mathew, sideshowbarker on github,
+  Sollace on github, Song X. Gao, sourceturner, Stefan Eissing,
+  Tatsuhiro Tsujikawa, Tim Martin, tiymat, Tobias Frauenschläger,
+  Trail of Bits, Vasiliy-Kkk, vectorqueue on hackerone, vegagent on hackerone,
+  Viktor Szakats, violet12331 on hackerone, Will Cosgrove,
+  wulin-nudt on github, Xi Ruoyao, x-xiang on github, Yedaya Katsman,
+  Zartaj Majeed, zhanhb on github, Zhanpeng Liu
+  (102 contributors)
 
 References to bug reports and discussions on issues:
 
- [1] = https://curl.se/bug/?i=11346
- [2] = https://curl.se/bug/?i=11564
- [3] = https://github.com/curl/curl-www/issues/272
- [4] = https://curl.se/bug/?i=11551
- [5] = https://curl.se/bug/?i=11556
- [6] = https://curl.se/bug/?i=11553
- [7] = https://curl.se/bug/?i=9621
- [8] = https://curl.se/bug/?i=11452
- [9] = https://curl.se/bug/?i=11562
- [10] = https://curl.se/bug/?i=11459
- [11] = https://curl.se/bug/?i=11502
- [12] = https://curl.se/bug/?i=11325
- [13] = https://curl.se/bug/?i=11609
- [14] = https://curl.se/bug/?i=11536
- [15] = https://curl.se/bug/?i=11521
- [16] = https://curl.se/bug/?i=11538
- [17] = https://curl.se/bug/?i=11505
- [18] = https://curl.se/bug/?i=11561
- [19] = https://curl.se/bug/?i=11532
- [20] = https://curl.se/mail/lib-2023-07/0045.html
- [21] = https://curl.se/bug/?i=11546
- [22] = https://curl.se/bug/?i=11555
- [23] = https://curl.se/bug/?i=11550
- [24] = https://curl.se/bug/?i=11499
- [25] = https://curl.se/bug/?i=9841
- [26] = https://curl.se/bug/?i=9194
- [27] = https://curl.se/mail/lib-2023-07/0041.html
- [28] = https://curl.se/bug/?i=11394
- [29] = https://curl.se/mail/lib-2023-07/0047.html
- [30] = https://curl.se/bug/?i=11560
- [31] = https://curl.se/bug/?i=11500
- [32] = https://curl.se/bug/?i=11527
- [33] = https://curl.se/bug/?i=11457
- [34] = https://curl.se/bug/?i=11525
- [35] = https://curl.se/bug/?i=11517
- [36] = https://curl.se/bug/?i=11416
- [37] = https://curl.se/bug/?i=11605
- [38] = https://curl.se/bug/?i=11589
- [39] = https://curl.se/bug/?i=11608
- [40] = https://curl.se/bug/?i=11584
- [41] = https://curl.se/bug/?i=11421
- [42] = https://curl.se/bug/?i=11606
- [43] = https://curl.se/bug/?i=11582
- [44] = https://curl.se/bug/?i=11563
- [45] = https://curl.se/bug/?i=11570
- [46] = https://curl.se/bug/?i=11581
- [47] = https://curl.se/bug/?i=11579
- [48] = https://curl.se/bug/?i=11568
- [49] = https://curl.se/bug/?i=11578
- [50] = https://curl.se/bug/?i=11635
- [51] = https://curl.se/bug/?i=11638
- [52] = https://curl.se/bug/?i=11621
- [53] = https://curl.se/bug/?i=10741
- [54] = https://curl.se/bug/?i=11655
- [55] = https://curl.se/bug/?i=11628
- [56] = https://curl.se/bug/?i=11592
- [57] = https://curl.se/bug/?i=11594
- [58] = https://curl.se/bug/?i=11597
- [59] = https://curl.se/bug/?i=11596
- [60] = https://curl.se/bug/?i=11681
- [61] = https://curl.se/bug/?i=11619
- [62] = https://curl.se/bug/?i=11631
- [63] = https://curl.se/bug/?i=11618
- [64] = https://curl.se/bug/?i=11666
- [65] = https://curl.se/bug/?i=11617
- [66] = https://curl.se/bug/?i=11616
- [67] = https://curl.se/bug/?i=11615
- [68] = https://curl.se/bug/?i=11612
- [69] = https://curl.se/bug/?i=11614
- [70] = https://curl.se/bug/?i=11611
- [71] = https://curl.se/bug/?i=11460
- [72] = https://curl.se/bug/?i=11661
- [73] = https://curl.se/bug/?i=11653
- [74] = https://curl.haxx.se/mail/lib-2018-10/0113.html
- [75] = https://curl.se/bug/?i=11665
- [76] = https://curl.se/bug/?i=11651
- [77] = https://curl.se/bug/?i=11669
- [78] = https://curl.se/bug/?i=11645
- [79] = https://curl.se/bug/?i=1199308
- [80] = https://curl.se/bug/?i=11627
- [81] = https://curl.se/bug/?i=11624
- [82] = https://curl.se/bug/?i=11654
- [83] = https://curl.se/bug/?i=11705
- [84] = https://curl.se/bug/?i=11673
- [85] = https://curl.se/bug/?i=11752
- [86] = https://sourceforge.net/p/curl/bugs/440/
- [87] = https://curl.se/bug/?i=11657
- [88] = https://curl.se/bug/?i=11698
- [89] = https://curl.se/bug/?i=11697
- [90] = https://curl.se/bug/?i=11695
- [91] = https://curl.se/bug/?i=11728
- [92] = https://curl.se/bug/?i=11696
- [93] = https://curl.se/bug/?i=11727
- [94] = https://curl.se/bug/?i=11680
- [95] = https://curl.se/bug/?i=11650
- [96] = https://curl.se/bug/?i=11650
- [97] = https://curl.se/bug/?i=11687
- [98] = https://curl.se/bug/?i=11683
- [99] = https://curl.se/bug/?i=11675
- [100] = https://curl.se/bug/?i=11675
- [101] = https://curl.se/bug/?i=11686
- [102] = https://curl.se/bug/?i=11674
- [103] = https://curl.se/bug/?i=11685
- [104] = https://curl.se/bug/?i=11723
- [105] = https://curl.se/bug/?i=11713
- [106] = https://curl.se/bug/?i=11714
- [107] = https://curl.se/bug/?i=11739
- [108] = https://curl.se/bug/?i=11718
- [109] = https://curl.se/bug/?i=11678
- [110] = https://curl.se/bug/?i=11711
- [111] = https://curl.se/bug/?i=11722
- [112] = https://curl.se/bug/?i=11721
- [113] = https://curl.se/bug/?i=11737
- [114] = https://curl.se/bug/?i=11746
- [115] = https://curl.se/bug/?i=11710
- [116] = https://curl.se/bug/?i=11745
- [117] = https://curl.se/bug/?i=11749
- [118] = https://curl.se/bug/?i=11742
- [119] = https://curl.se/bug/?i=11530
- [120] = https://curl.se/bug/?i=11736
- [121] = https://curl.se/bug/?i=11576
- [122] = https://curl.se/bug/?i=11780
- [123] = https://curl.se/bug/?i=11734
- [124] = https://curl.se/bug/?i=11769
- [125] = https://curl.se/bug/?i=11766
- [126] = https://curl.se/bug/?i=11729
- [127] = https://curl.se/bug/?i=11794
- [128] = https://curl.se/bug/?i=11774
- [129] = https://curl.se/bug/?i=11773
- [130] = https://curl.se/bug/?i=11792
- [131] = https://curl.se/bug/?i=11771
- [132] = https://curl.se/bug/?i=11756
- [133] = https://curl.se/bug/?i=11791
- [134] = https://curl.se/bug/?i=11764
- [135] = https://curl.se/bug/?i=11490
- [136] = https://curl.se/bug/?i=11547
- [137] = https://curl.se/bug/?i=11779
- [138] = https://curl.se/bug/?i=11784
- [139] = https://curl.se/bug/?i=11785
- [140] = https://curl.se/bug/?i=11547
- [141] = https://curl.se/bug/?i=11738
- [142] = https://curl.se/bug/?i=11759
- [143] = https://curl.se/bug/?i=11747
- [144] = https://curl.se/bug/?i=11677
- [145] = https://curl.se/bug/?i=11735
- [146] = https://curl.se/bug/?i=11757
- [147] = https://curl.se/bug/?i=11693
- [148] = https://curl.se/bug/?i=11753
- [149] = https://curl.se/mail/lib-2023-08/0081.html
- [150] = https://curl.se/bug/?i=11815
- [151] = https://curl.se/bug/?i=11800
- [152] = https://curl.se/bug/?i=11814
- [153] = https://curl.se/bug/?i=11825
- [154] = https://curl.se/bug/?i=11809
- [155] = https://curl.se/bug/?i=11822
- [156] = https://curl.se/bug/?i=11342
- [157] = https://curl.se/bug/?i=11801
- [158] = https://curl.se/bug/?i=11799
- [159] = https://curl.se/bug/?i=11664
- [160] = https://curl.se/bug/?i=11821
- [161] = https://curl.se/bug/?i=11821
- [162] = https://curl.se/bug/?i=11760
- [163] = https://curl.se/bug/?i=11632
- [164] = https://curl.se/bug/?i=11395
- [165] = https://curl.se/bug/?i=11839
- [166] = https://curl.se/bug/?i=11827
+ [1] = https://curl.se/bug/?i=21510
+ [2] = https://curl.se/bug/?i=21476
+ [3] = https://curl.se/mail/archive-2026-04/0029.html
+ [4] = https://curl.se/bug/?i=21486
+ [5] = https://curl.se/bug/?i=21538
+ [6] = https://curl.se/bug/?i=21630
+ [7] = https://hackerone.com/reports/3702718
+ [8] = https://curl.se/bug/?i=21470
+ [9] = https://curl.se/bug/?i=21545
+ [10] = https://curl.se/bug/?i=21641
+ [11] = https://curl.se/bug/?i=21543
+ [12] = https://curl.se/bug/?i=21541
+ [13] = https://curl.se/bug/?i=21640
+ [14] = https://curl.se/bug/?i=21634
+ [15] = https://curl.se/bug/?i=21498
+ [16] = https://curl.se/bug/?i=21496
+ [17] = https://curl.se/bug/?i=21495
+ [18] = https://curl.se/bug/?i=21536
+ [19] = https://curl.se/bug/?i=21491
+ [20] = https://curl.se/bug/?i=21532
+ [21] = https://curl.se/bug/?i=21533
+ [22] = https://curl.se/bug/?i=21529
+ [23] = https://curl.se/bug/?i=21485
+ [24] = https://curl.se/bug/?i=21530
+ [25] = https://curl.se/bug/?i=21480
+ [26] = https://curl.se/bug/?i=21631
+ [27] = https://curl.se/bug/?i=21522
+ [28] = https://curl.se/bug/?i=21521
+ [29] = https://curl.se/bug/?i=21629
+ [30] = https://curl.se/bug/?i=21512
+ [32] = https://curl.se/bug/?i=21517
+ [33] = https://curl.se/bug/?i=21518
+ [34] = https://curl.se/bug/?i=21644
+ [35] = https://curl.se/bug/?i=21514
+ [36] = https://curl.se/bug/?i=21515
+ [37] = https://curl.se/bug/?i=21500
+ [38] = https://curl.se/bug/?i=21632
+ [39] = https://curl.se/bug/?i=21636
+ [40] = https://curl.se/bug/?i=21723
+ [41] = https://curl.se/bug/?i=21720
+ [42] = https://curl.se/bug/?i=21575
+ [43] = https://curl.se/bug/?i=21573
+ [44] = https://curl.se/bug/?i=21595
+ [45] = https://curl.se/bug/?i=21615
+ [46] = https://curl.se/bug/?i=21721
+ [47] = https://curl.se/bug/?i=21626
+ [48] = https://curl.se/bug/?i=21606
+ [49] = https://curl.se/bug/?i=21679
+ [50] = https://curl.se/bug/?i=21635
+ [51] = https://curl.se/bug/?i=21633
+ [52] = https://curl.se/bug/?i=21616
+ [53] = https://curl.se/bug/?i=21153
+ [54] = https://curl.se/bug/?i=21707
+ [55] = https://curl.se/bug/?i=21714
+ [56] = https://curl.se/bug/?i=21609
+ [57] = https://curl.se/bug/?i=21605
+ [58] = https://curl.se/bug/?i=21622
+ [59] = https://curl.se/bug/?i=21614
+ [60] = https://curl.se/bug/?i=21621
+ [61] = https://curl.se/bug/?i=21890
+ [62] = https://curl.se/bug/?i=21617
+ [63] = https://curl.se/bug/?i=21820
+ [64] = https://curl.se/bug/?i=21745
+ [65] = https://curl.se/bug/?i=21682
+ [66] = https://curl.se/bug/?i=21593
+ [67] = https://curl.se/bug/?i=21597
+ [68] = https://curl.se/bug/?i=21665
+ [69] = https://curl.se/bug/?i=21688
+ [70] = https://curl.se/bug/?i=21683
+ [71] = https://curl.se/bug/?i=21592
+ [72] = https://curl.se/bug/?i=21671
+ [73] = https://curl.se/bug/?i=21544
+ [74] = https://curl.se/bug/?i=21583
+ [75] = https://curl.se/bug/?i=21585
+ [76] = https://curl.se/bug/?i=21642
+ [77] = https://curl.se/bug/?i=21407
+ [78] = https://curl.se/bug/?i=21582
+ [79] = https://curl.se/bug/?i=21576
+ [80] = https://curl.se/bug/?i=21699
+ [81] = https://curl.se/bug/?i=21696
+ [82] = https://curl.se/bug/?i=21567
+ [83] = https://curl.se/bug/?i=21570
+ [84] = https://curl.se/bug/?i=21569
+ [85] = https://curl.se/bug/?i=21749
+ [86] = https://curl.se/bug/?i=21677
+ [87] = https://curl.se/bug/?i=21562
+ [88] = https://curl.se/bug/?i=21563
+ [89] = https://curl.se/bug/?i=21528
+ [90] = https://curl.se/bug/?i=21560
+ [91] = https://curl.se/bug/?i=21561
+ [92] = https://curl.se/bug/?i=21409
+ [93] = https://curl.se/bug/?i=21547
+ [94] = https://curl.se/bug/?i=21557
+ [95] = https://curl.se/bug/?i=21686
+ [96] = https://curl.se/bug/?i=21169
+ [97] = https://curl.se/bug/?i=21553
+ [98] = https://curl.se/bug/?i=21104
+ [99] = https://curl.se/bug/?i=21523
+ [100] = https://curl.se/bug/?i=21551
+ [101] = https://curl.se/bug/?i=21550
+ [102] = https://curl.se/bug/?i=21663
+ [103] = https://curl.se/bug/?i=21750
+ [104] = https://curl.se/bug/?i=21685
+ [105] = https://curl.se/bug/?i=21672
+ [106] = https://curl.se/bug/?i=21646
+ [107] = https://curl.se/bug/?i=21705
+ [108] = https://curl.se/bug/?i=21667
+ [109] = https://curl.se/bug/?i=21748
+ [110] = https://curl.se/bug/?i=21666
+ [111] = https://curl.se/bug/?i=21678
+ [112] = https://curl.se/bug/?i=21741
+ [113] = https://curl.se/bug/?i=21747
+ [114] = https://curl.se/bug/?i=21732
+ [115] = https://curl.se/bug/?i=21670
+ [116] = https://curl.se/bug/?i=21668
+ [117] = https://curl.se/bug/?i=21659
+ [118] = https://curl.se/bug/?i=21662
+ [119] = https://curl.se/bug/?i=21660
+ [120] = https://curl.se/bug/?i=21658
+ [121] = https://curl.se/bug/?i=21624
+ [122] = https://curl.se/bug/?i=21604
+ [123] = https://curl.se/bug/?i=21651
+ [124] = https://curl.se/bug/?i=21656
+ [125] = https://curl.se/bug/?i=21724
+ [126] = https://curl.se/bug/?i=21654
+ [127] = https://curl.se/bug/?i=21653
+ [128] = https://curl.se/bug/?i=21649
+ [129] = https://curl.se/bug/?i=21887
+ [130] = https://curl.se/bug/?i=21647
+ [131] = https://curl.se/bug/?i=21650
+ [132] = https://curl.se/bug/?i=21602
+ [133] = https://curl.se/bug/?i=21886
+ [134] = https://curl.se/bug/?i=21841
+ [135] = https://curl.se/bug/?i=21734
+ [136] = https://curl.se/bug/?i=21702
+ [137] = https://curl.se/bug/?i=21719
+ [138] = https://curl.se/bug/?i=21712
+ [139] = https://curl.se/bug/?i=21802
+ [140] = https://curl.se/bug/?i=21794
+ [141] = https://curl.se/bug/?i=21840
+ [142] = https://curl.se/bug/?i=21836
+ [143] = https://curl.se/bug/?i=21837
+ [144] = https://curl.se/bug/?i=21839
+ [145] = https://curl.se/bug/?i=21828
+ [146] = https://curl.se/bug/?i=21706
+ [147] = https://curl.se/bug/?i=21793
+ [148] = https://curl.se/bug/?i=21884
+ [149] = https://curl.se/bug/?i=21743
+ [150] = https://curl.se/bug/?i=21669
+ [151] = https://curl.se/bug/?i=21782
+ [152] = https://curl.se/bug/?i=21885
+ [153] = https://curl.se/bug/?i=21786
+ [154] = https://curl.se/bug/?i=21784
+ [155] = https://curl.se/bug/?i=21781
+ [156] = https://curl.se/bug/?i=21883
+ [157] = https://curl.se/bug/?i=21882
+ [158] = https://curl.se/bug/?i=21776
+ [159] = https://curl.se/bug/?i=21760
+ [160] = https://curl.se/bug/?i=21774
+ [161] = https://curl.se/bug/?i=21829
+ [162] = https://curl.se/bug/?i=21877
+ [163] = https://curl.se/bug/?i=21727
+ [164] = https://curl.se/bug/?i=21771
+ [165] = https://curl.se/bug/?i=21739
+ [166] = https://curl.se/bug/?i=21767
+ [167] = https://curl.se/bug/?i=21768
+ [168] = https://curl.se/bug/?i=21826
+ [169] = https://curl.se/bug/?i=21876
+ [170] = https://curl.se/bug/?i=21603
+ [171] = https://curl.se/bug/?i=21756
+ [172] = https://curl.se/bug/?i=21762
+ [173] = https://curl.se/bug/?i=21766
+ [174] = https://curl.se/bug/?i=21865
+ [175] = https://curl.se/bug/?i=21816
+ [176] = https://curl.se/bug/?i=21868
+ [177] = https://curl.se/bug/?i=21867
+ [178] = https://curl.se/bug/?i=21866
+ [179] = https://curl.se/bug/?i=21869
+ [180] = https://curl.se/bug/?i=21870
+ [181] = https://curl.se/bug/?i=21862
+ [182] = https://curl.se/bug/?i=21858
+ [183] = https://curl.se/bug/?i=21809
+ [184] = https://curl.se/bug/?i=21930
+ [185] = https://curl.se/bug/?i=22129
+ [186] = https://curl.se/bug/?i=21976
+ [187] = https://curl.se/bug/?i=21970
+ [188] = https://curl.se/bug/?i=21933
+ [189] = https://curl.se/bug/?i=21851
+ [190] = https://curl.se/bug/?i=21850
+ [191] = https://curl.se/bug/?i=21773
+ [192] = https://curl.se/bug/?i=21927
+ [193] = https://curl.se/bug/?i=21923
+ [194] = https://curl.se/bug/?i=22126
+ [195] = https://curl.se/bug/?i=21881
+ [196] = https://curl.se/bug/?i=22052
+ [197] = https://curl.se/bug/?i=21922
+ [198] = https://curl.se/bug/?i=22125
+ [199] = https://curl.se/bug/?i=21914
+ [200] = https://curl.se/bug/?i=21910
+ [201] = https://curl.se/bug/?i=21911
+ [202] = https://curl.se/bug/?i=21920
+ [203] = https://curl.se/bug/?i=21912
+ [204] = https://curl.se/bug/?i=21969
+ [205] = https://curl.se/bug/?i=21913
+ [206] = https://curl.se/bug/?i=21915
+ [207] = https://curl.se/bug/?i=21918
+ [208] = https://curl.se/bug/?i=21968
+ [209] = https://curl.se/bug/?i=21966
+ [210] = https://curl.se/bug/?i=21896
+ [211] = https://curl.se/bug/?i=21902
+ [212] = https://curl.se/bug/?i=21903
+ [213] = https://curl.se/bug/?i=21904
+ [214] = https://curl.se/bug/?i=21907
+ [215] = https://curl.se/bug/?i=21953
+ [216] = https://curl.se/bug/?i=21961
+ [217] = https://curl.se/bug/?i=21863
+ [218] = https://curl.se/bug/?i=21901
+ [219] = https://curl.se/bug/?i=21898
+ [220] = https://curl.se/bug/?i=21964
+ [221] = https://curl.se/bug/?i=21879
+ [223] = https://curl.se/bug/?i=21957
+ [224] = https://curl.se/bug/?i=21946
+ [225] = https://curl.se/bug/?i=21951
+ [226] = https://curl.se/bug/?i=21945
+ [227] = https://curl.se/bug/?i=22048
+ [228] = https://curl.se/bug/?i=22040
+ [229] = https://curl.se/bug/?i=22105
+ [230] = https://curl.se/bug/?i=21949
+ [231] = https://curl.se/bug/?i=22038
+ [232] = https://curl.se/bug/?i=22133
+ [233] = https://curl.se/bug/?i=22124
+ [234] = https://curl.se/bug/?i=22122
+ [235] = https://curl.se/bug/?i=21944
+ [236] = https://curl.se/bug/?i=22033
+ [237] = https://curl.se/bug/?i=22107
+ [238] = https://curl.se/bug/?i=21937
+ [239] = https://curl.se/bug/?i=22030
+ [242] = https://curl.se/bug/?i=22000
+ [243] = https://curl.se/bug/?i=22017
+ [245] = https://curl.se/bug/?i=22016
+ [246] = https://curl.se/bug/?i=22114
+ [249] = https://curl.se/bug/?i=22018
+ [253] = https://curl.se/bug/?i=22025
+ [256] = https://curl.se/bug/?i=22085
+ [257] = https://curl.se/bug/?i=22094
+ [260] = https://curl.se/bug/?i=22104
+ [261] = https://curl.se/bug/?i=22013
+ [262] = https://curl.se/bug/?i=22004
+ [263] = https://curl.se/bug/?i=22001
+ [264] = https://curl.se/bug/?i=22088
+ [265] = https://curl.se/bug/?i=22087
+ [266] = https://curl.se/bug/?i=22081
+ [268] = https://curl.se/bug/?i=21996
+ [269] = https://curl.se/bug/?i=22003
+ [270] = https://curl.se/bug/?i=22002
+ [271] = https://curl.se/bug/?i=21998
+ [272] = https://curl.se/bug/?i=21999
+ [273] = https://curl.se/bug/?i=21926
+ [274] = https://curl.se/bug/?i=21990
+ [275] = https://curl.se/bug/?i=21995
+ [276] = https://curl.se/bug/?i=21967
+ [277] = https://curl.se/bug/?i=21893
+ [278] = https://curl.se/bug/?i=21992
+ [279] = https://curl.se/bug/?i=21993
+ [280] = https://curl.se/bug/?i=21986
+ [281] = https://curl.se/bug/?i=21979
+ [283] = https://curl.se/bug/?i=21989
+ [286] = https://curl.se/bug/?i=21983
+ [288] = https://curl.se/bug/?i=22050
+ [289] = https://curl.se/bug/?i=22070
+ [290] = https://curl.se/bug/?i=22073
+ [291] = https://curl.se/bug/?i=22072
+ [292] = https://curl.se/bug/?i=22052
+ [294] = https://curl.se/bug/?i=22063
+ [299] = https://curl.se/bug/?i=22062
+ [300] = https://curl.se/bug/?i=22061
+ [302] = https://curl.se/bug/?i=22059
+ [304] = https://curl.se/bug/?i=21943
diff --git a/third-party/curl/REUSE.toml b/third-party/curl/REUSE.toml
new file mode 100644
index 0000000000..9e6d2d166b
--- /dev/null
+++ b/third-party/curl/REUSE.toml
@@ -0,0 +1,41 @@
+# SPDX-License-Identifier: curl
+# SPDX-FileCopyrightText: Daniel Stenberg, <daniel@haxx.se>, et al.
+
+# This file describes the licensing and copyright situation for files that
+# cannot be annotated directly, for example because of being uncommentable.
+# Unless this is the case, a file should be annotated directly.
+#
+# This follows the REUSE specification: https://reuse.software/spec-3.2/#reusetoml
+
+version = 1
+SPDX-PackageName = "curl"
+SPDX-PackageDownloadLocation = "https://curl.se/"
+
+[[annotations]]
+path = [
+  ".github/pull_request_template.md",
+  "docs/INSTALL",
+  "docs/libcurl/symbols-in-versions",
+  "docs/options-in-versions",
+  "docs/THANKS",
+  "lib/libcurl.vers.in",
+  "lib/libcurl.def",
+  "projects/OS400/README.OS400",
+  "projects/vms/build_vms.com",
+  "projects/vms/curl_release_note_start.txt",
+  "projects/vms/curlmsg.sdl",
+  "projects/vms/macro32_exactcase.patch",
+  "projects/vms/readme",
+  "projects/Windows/**",
+  "README",
+  "RELEASE-NOTES",
+  "renovate.json",
+  "tests/certs/**",
+  "tests/data/data**",
+  "tests/data/test**",
+  "tests/valgrind.supp",
+]
+SPDX-FileCopyrightText = "Daniel Stenberg, <daniel@haxx.se>, et al."
+SPDX-License-Identifier = "curl"
+# If there is licensing/copyright information in or next to these files, prefer that
+precedence = "closest"
diff --git a/third-party/curl/SECURITY.md b/third-party/curl/SECURITY.md
index b76da78cea..e579ebb6e6 100644
--- a/third-party/curl/SECURITY.md
+++ b/third-party/curl/SECURITY.md
@@ -6,11 +6,25 @@ SPDX-License-Identifier: curl
 
 # Security Policy
 
-See [SECURITY-PROCESS](docs/SECURITY-PROCESS.md) for full details.
+Read our [Vulnerability Disclosure Policy](docs/VULN-DISCLOSURE-POLICY.md).
 
 ## Reporting a Vulnerability
 
-If you have found or just suspect a security problem somewhere in curl or
-libcurl, report it on [HackerOne](https://hackerone.com/curl).
+If you have found or suspect a security problem somewhere in curl or libcurl,
+[report it](https://curl.se/dev/vuln-disclosure.html)!
 
-We treat security issues with confidentiality until controlled and disclosed responsibly.
+We treat security issues with confidentiality until controlled and disclosed
+responsibly.
+
+## OpenSSF Best Practices
+
+curl has achieved Gold status on the Open Source Security Foundation (OpenSSF)
+[Best Practices](https://bestpractices.dev/) (formerly Core Infrastructure
+Initiative Best Practices), reflecting its adherence to rigorous security and
+best practice standards. This achievement highlights curl's comprehensive
+documentation, secure development processes, effective change control
+mechanisms, and strong maintenance routines. Meeting these criteria
+demonstrates curl's commitment to security and reliability, ensuring the
+project's sustainability and trustworthiness. This underscores curl's role as
+a leader in open-source software practices. More information can be found on
+[curl's OpenSSF Best Practices project page](https://www.bestpractices.dev/projects/63).
diff --git a/third-party/curl/acinclude.m4 b/third-party/curl/acinclude.m4
index 81a1c1d0de..ed8b0499dd 100644
--- a/third-party/curl/acinclude.m4
+++ b/third-party/curl/acinclude.m4
@@ -25,19 +25,19 @@
 dnl CURL_CHECK_DEF (SYMBOL, [INCLUDES], [SILENT])
 dnl -------------------------------------------------
 dnl Use the C preprocessor to find out if the given object-style symbol
-dnl is defined and get its expansion. This macro will not use default
-dnl includes even if no INCLUDES argument is given. This macro will run
+dnl is defined and get its expansion. This macro does not use default
+dnl includes even if no INCLUDES argument is given. This macro runs
 dnl silently when invoked with three arguments. If the expansion would
-dnl result in a set of double-quoted strings the returned expansion will
-dnl actually be a single double-quoted string concatenating all them.
+dnl result in a set of double-quoted strings the returned expansion is
+dnl actually a single double-quoted string concatenating all them.
 
 AC_DEFUN([CURL_CHECK_DEF], [
-  AC_REQUIRE([CURL_CPP_P])dnl
+  AC_REQUIRE([CURL_CPP_P])
   OLDCPPFLAGS=$CPPFLAGS
-  # CPPPFLAG comes from CURL_CPP_P
+  dnl CPPPFLAG comes from CURL_CPP_P
   CPPFLAGS="$CPPFLAGS $CPPPFLAG"
-  AS_VAR_PUSHDEF([ac_HaveDef], [curl_cv_have_def_$1])dnl
-  AS_VAR_PUSHDEF([ac_Def], [curl_cv_def_$1])dnl
+  AS_VAR_PUSHDEF([ac_HaveDef], [curl_cv_have_def_$1])
+  AS_VAR_PUSHDEF([ac_Def], [curl_cv_def_$1])
   if test -z "$SED"; then
     AC_MSG_ERROR([SED not set. Cannot continue without SED being set.])
   fi
@@ -48,10 +48,10 @@ AC_DEFUN([CURL_CHECK_DEF], [
   tmp_exp=""
   AC_PREPROC_IFELSE([
     AC_LANG_SOURCE(
-ifelse($2,,,[$2])[[
-#ifdef $1
-CURL_DEF_TOKEN $1
-#endif
+    ifelse($2,,,[$2])[[
+      #ifdef $1
+      CURL_DEF_TOKEN $1
+      #endif
     ]])
   ],[
     tmp_exp=`eval "$ac_cpp conftest.$ac_ext" 2>/dev/null | \
@@ -70,8 +70,8 @@ CURL_DEF_TOKEN $1
     AS_VAR_SET(ac_Def, $tmp_exp)
     ifelse($3,,[AC_MSG_RESULT([$tmp_exp])])
   fi
-  AS_VAR_POPDEF([ac_Def])dnl
-  AS_VAR_POPDEF([ac_HaveDef])dnl
+  AS_VAR_POPDEF([ac_Def])
+  AS_VAR_POPDEF([ac_HaveDef])
   CPPFLAGS=$OLDCPPFLAGS
 ])
 
@@ -79,24 +79,23 @@ CURL_DEF_TOKEN $1
 dnl CURL_CHECK_DEF_CC (SYMBOL, [INCLUDES], [SILENT])
 dnl -------------------------------------------------
 dnl Use the C compiler to find out only if the given symbol is defined
-dnl or not, this can not find out its expansion. This macro will not use
+dnl or not, this can not find out its expansion. This macro does not use
 dnl default includes even if no INCLUDES argument is given. This macro
-dnl will run silently when invoked with three arguments.
+dnl runs silently when invoked with three arguments.
 
 AC_DEFUN([CURL_CHECK_DEF_CC], [
-  AS_VAR_PUSHDEF([ac_HaveDef], [curl_cv_have_def_$1])dnl
+  AS_VAR_PUSHDEF([ac_HaveDef], [curl_cv_have_def_$1])
   ifelse($3,,[AC_MSG_CHECKING([for compiler definition of $1])])
   AC_COMPILE_IFELSE([
     AC_LANG_SOURCE(
-ifelse($2,,,[$2])[[
-int main (void)
-{
-#ifdef $1
-  return 0;
-#else
-  force compilation error
-#endif
-}
+    ifelse($2,,,[$2])[[
+      int main(void)
+      {
+      #ifndef $1
+        #error force compilation error
+      #endif
+        return 0;
+      }
     ]])
   ],[
     tst_symbol_defined="yes"
@@ -110,7 +109,7 @@ int main (void)
     AS_VAR_SET(ac_HaveDef, no)
     ifelse($3,,[AC_MSG_RESULT([no])])
   fi
-  AS_VAR_POPDEF([ac_HaveDef])dnl
+  AS_VAR_POPDEF([ac_HaveDef])
 ])
 
 
@@ -123,16 +122,15 @@ AC_DEFUN([CURL_CHECK_LIB_XNET], [
   tst_lib_xnet_required="no"
   AC_COMPILE_IFELSE([
     AC_LANG_SOURCE([[
-int main (void)
-{
-#if defined(__hpux) && defined(_XOPEN_SOURCE) && (_XOPEN_SOURCE >= 600)
-  return 0;
-#elif defined(__hpux) && defined(_XOPEN_SOURCE_EXTENDED)
-  return 0;
-#else
-  force compilation error
-#endif
-}
+      int main(void)
+      {
+      #if defined(__hpux) && defined(_XOPEN_SOURCE) && (_XOPEN_SOURCE >= 600)
+      #elif defined(__hpux) && defined(_XOPEN_SOURCE_EXTENDED)
+      #else
+        #error force compilation error
+      #endif
+        return 0;
+      }
     ]])
   ],[
     tst_lib_xnet_required="yes"
@@ -154,9 +152,8 @@ AC_DEFUN([CURL_CHECK_AIX_ALL_SOURCE], [
 #ifndef _ALL_SOURCE
 #  undef _ALL_SOURCE
 #endif])
-  AC_BEFORE([$0], [AC_SYS_LARGEFILE])dnl
-  AC_BEFORE([$0], [CURL_CONFIGURE_REENTRANT])dnl
-  AC_BEFORE([$0], [CURL_CONFIGURE_PULL_SYS_POLL])dnl
+  AC_BEFORE([$0], [AC_SYS_LARGEFILE])
+  AC_BEFORE([$0], [CURL_CONFIGURE_REENTRANT])
   AC_MSG_CHECKING([if OS is AIX (to define _ALL_SOURCE)])
   AC_EGREP_CPP([yes_this_is_aix],[
 #ifdef _AIX
@@ -171,144 +168,29 @@ AC_DEFUN([CURL_CHECK_AIX_ALL_SOURCE], [
 ])
 
 
-dnl CURL_CHECK_HEADER_WINDOWS
-dnl -------------------------------------------------
-dnl Check for compilable and valid windows.h header
-
-AC_DEFUN([CURL_CHECK_HEADER_WINDOWS], [
-  AC_CACHE_CHECK([for windows.h], [curl_cv_header_windows_h], [
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-#undef inline
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-      ]],[[
-#if defined(__CYGWIN__) || defined(__CEGCC__)
-        HAVE_WINDOWS_H shall not be defined.
-#else
-        int dummy=2*WINVER;
-#endif
-      ]])
-    ],[
-      curl_cv_header_windows_h="yes"
-    ],[
-      curl_cv_header_windows_h="no"
-    ])
-  ])
-  case "$curl_cv_header_windows_h" in
-    yes)
-      AC_DEFINE_UNQUOTED(HAVE_WINDOWS_H, 1,
-        [Define to 1 if you have the windows.h header file.])
-      ;;
-  esac
-])
-
-
 dnl CURL_CHECK_NATIVE_WINDOWS
 dnl -------------------------------------------------
 dnl Check if building a native Windows target
 
 AC_DEFUN([CURL_CHECK_NATIVE_WINDOWS], [
-  AC_REQUIRE([CURL_CHECK_HEADER_WINDOWS])dnl
   AC_CACHE_CHECK([whether build target is a native Windows one], [curl_cv_native_windows], [
-    if test "$curl_cv_header_windows_h" = "no"; then
+    AC_COMPILE_IFELSE([
+      AC_LANG_PROGRAM([[
+      ]],[[
+        #ifdef _WIN32
+          int dummy = 1;
+          (void)dummy;
+        #else
+          #error Not a native Windows build target.
+        #endif
+      ]])
+    ],[
+      curl_cv_native_windows="yes"
+    ],[
       curl_cv_native_windows="no"
-    else
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-        ]],[[
-#if defined(__MINGW32__) || defined(__MINGW32CE__) || \
-   (defined(_MSC_VER) && (defined(_WIN32) || defined(_WIN64)))
-          int dummy=1;
-#else
-          Not a native Windows build target.
-#endif
-        ]])
-      ],[
-        curl_cv_native_windows="yes"
-      ],[
-        curl_cv_native_windows="no"
-      ])
-    fi
-  ])
-  AM_CONDITIONAL(DOING_NATIVE_WINDOWS, test "x$curl_cv_native_windows" = xyes)
-])
-
-
-dnl CURL_CHECK_HEADER_WINSOCK2
-dnl -------------------------------------------------
-dnl Check for compilable and valid winsock2.h header
-
-AC_DEFUN([CURL_CHECK_HEADER_WINSOCK2], [
-  AC_REQUIRE([CURL_CHECK_HEADER_WINDOWS])dnl
-  AC_CACHE_CHECK([for winsock2.h], [curl_cv_header_winsock2_h], [
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-#undef inline
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#include <winsock2.h>
-      ]],[[
-#if defined(__CYGWIN__) || defined(__CEGCC__) || defined(__MINGW32CE__)
-        HAVE_WINSOCK2_H shall not be defined.
-#else
-        int dummy=2*IPPROTO_ESP;
-#endif
-      ]])
-    ],[
-      curl_cv_header_winsock2_h="yes"
-    ],[
-      curl_cv_header_winsock2_h="no"
     ])
   ])
-  case "$curl_cv_header_winsock2_h" in
-    yes)
-      AC_DEFINE_UNQUOTED(HAVE_WINSOCK2_H, 1,
-        [Define to 1 if you have the winsock2.h header file.])
-      ;;
-  esac
-])
-
-
-dnl CURL_CHECK_HEADER_WS2TCPIP
-dnl -------------------------------------------------
-dnl Check for compilable and valid ws2tcpip.h header
-
-AC_DEFUN([CURL_CHECK_HEADER_WS2TCPIP], [
-  AC_REQUIRE([CURL_CHECK_HEADER_WINSOCK2])dnl
-  AC_CACHE_CHECK([for ws2tcpip.h], [curl_cv_header_ws2tcpip_h], [
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-#undef inline
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#include <winsock2.h>
-#include <ws2tcpip.h>
-      ]],[[
-#if defined(__CYGWIN__) || defined(__CEGCC__) || defined(__MINGW32CE__)
-        HAVE_WS2TCPIP_H shall not be defined.
-#else
-        int dummy=2*IP_PKTINFO;
-#endif
-      ]])
-    ],[
-      curl_cv_header_ws2tcpip_h="yes"
-    ],[
-      curl_cv_header_ws2tcpip_h="no"
-    ])
-  ])
-  case "$curl_cv_header_ws2tcpip_h" in
-    yes)
-      AC_DEFINE_UNQUOTED(HAVE_WS2TCPIP_H, 1,
-        [Define to 1 if you have the ws2tcpip.h header file.])
-      ;;
-  esac
+  AM_CONDITIONAL(DOING_NATIVE_WINDOWS, test "$curl_cv_native_windows" = "yes")
 ])
 
 
@@ -318,25 +200,25 @@ dnl Check for compilable and valid lber.h header,
 dnl and check if it is needed even with ldap.h
 
 AC_DEFUN([CURL_CHECK_HEADER_LBER], [
-  AC_REQUIRE([CURL_CHECK_HEADER_WINDOWS])dnl
+  AC_REQUIRE([CURL_CHECK_NATIVE_WINDOWS])
   AC_CACHE_CHECK([for lber.h], [curl_cv_header_lber_h], [
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
-#undef inline
-#ifdef HAVE_WINDOWS_H
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#else
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#endif
-#ifndef NULL
-#define NULL (void *)0
-#endif
-#include <lber.h>
+        #undef inline
+        #ifdef _WIN32
+        #ifndef WIN32_LEAN_AND_MEAN
+        #define WIN32_LEAN_AND_MEAN
+        #endif
+        #include <windows.h>
+        #else
+        #ifdef HAVE_SYS_TYPES_H
+        #include <sys/types.h>
+        #endif
+        #endif
+        #ifndef NULL
+        #define NULL (void *)0
+        #endif
+        #include <lber.h>
       ]],[[
         BerValue *bvp = NULL;
         BerElement *bep = ber_init(bvp);
@@ -351,27 +233,27 @@ AC_DEFUN([CURL_CHECK_HEADER_LBER], [
   if test "$curl_cv_header_lber_h" = "yes"; then
     AC_DEFINE_UNQUOTED(HAVE_LBER_H, 1,
       [Define to 1 if you have the lber.h header file.])
-    #
+
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
-#undef inline
-#ifdef HAVE_WINDOWS_H
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#else
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#endif
-#ifndef NULL
-#define NULL (void *)0
-#endif
-#ifndef LDAP_DEPRECATED
-#define LDAP_DEPRECATED 1
-#endif
-#include <ldap.h>
+        #undef inline
+        #ifdef _WIN32
+        #ifndef WIN32_LEAN_AND_MEAN
+        #define WIN32_LEAN_AND_MEAN
+        #endif
+        #include <windows.h>
+        #else
+        #ifdef HAVE_SYS_TYPES_H
+        #include <sys/types.h>
+        #endif
+        #endif
+        #ifndef NULL
+        #define NULL (void *)0
+        #endif
+        #ifndef LDAP_DEPRECATED
+        #define LDAP_DEPRECATED 1
+        #endif
+        #include <ldap.h>
       ]],[[
         BerValue *bvp = NULL;
         BerElement *bep = ber_init(bvp);
@@ -382,7 +264,7 @@ AC_DEFUN([CURL_CHECK_HEADER_LBER], [
     ],[
       curl_cv_need_header_lber_h="yes"
     ])
-    #
+
     case "$curl_cv_need_header_lber_h" in
       yes)
         AC_DEFINE_UNQUOTED(NEED_LBER_H, 1,
@@ -398,31 +280,32 @@ dnl -------------------------------------------------
 dnl Check for compilable and valid ldap.h header
 
 AC_DEFUN([CURL_CHECK_HEADER_LDAP], [
-  AC_REQUIRE([CURL_CHECK_HEADER_LBER])dnl
+  AC_REQUIRE([CURL_CHECK_HEADER_LBER])
   AC_CACHE_CHECK([for ldap.h], [curl_cv_header_ldap_h], [
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
-#undef inline
-#ifdef HAVE_WINDOWS_H
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#else
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#endif
-#ifndef LDAP_DEPRECATED
-#define LDAP_DEPRECATED 1
-#endif
-#ifdef NEED_LBER_H
-#include <lber.h>
-#endif
-#include <ldap.h>
+        #undef inline
+        #ifdef _WIN32
+        #ifndef WIN32_LEAN_AND_MEAN
+        #define WIN32_LEAN_AND_MEAN
+        #endif
+        #include <windows.h>
+        #else
+        #ifdef HAVE_SYS_TYPES_H
+        #include <sys/types.h>
+        #endif
+        #endif
+        #ifndef LDAP_DEPRECATED
+        #define LDAP_DEPRECATED 1
+        #endif
+        #ifdef NEED_LBER_H
+        #include <lber.h>
+        #endif
+        #include <ldap.h>
       ]],[[
-        LDAP *ldp = ldap_init("dummy", LDAP_PORT);
+        LDAP *ldp = ldap_init("0.0.0.0", LDAP_PORT);
         int res = ldap_unbind(ldp);
+        (void)res;
       ]])
     ],[
       curl_cv_header_ldap_h="yes"
@@ -444,33 +327,34 @@ dnl -------------------------------------------------
 dnl Check for compilable and valid ldap_ssl.h header
 
 AC_DEFUN([CURL_CHECK_HEADER_LDAP_SSL], [
-  AC_REQUIRE([CURL_CHECK_HEADER_LDAP])dnl
+  AC_REQUIRE([CURL_CHECK_HEADER_LDAP])
   AC_CACHE_CHECK([for ldap_ssl.h], [curl_cv_header_ldap_ssl_h], [
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
-#undef inline
-#ifdef HAVE_WINDOWS_H
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#else
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#endif
-#ifndef LDAP_DEPRECATED
-#define LDAP_DEPRECATED 1
-#endif
-#ifdef NEED_LBER_H
-#include <lber.h>
-#endif
-#ifdef HAVE_LDAP_H
-#include <ldap.h>
-#endif
-#include <ldap_ssl.h>
+        #undef inline
+        #ifdef _WIN32
+        #ifndef WIN32_LEAN_AND_MEAN
+        #define WIN32_LEAN_AND_MEAN
+        #endif
+        #include <windows.h>
+        #else
+        #ifdef HAVE_SYS_TYPES_H
+        #include <sys/types.h>
+        #endif
+        #endif
+        #ifndef LDAP_DEPRECATED
+        #define LDAP_DEPRECATED 1
+        #endif
+        #ifdef NEED_LBER_H
+        #include <lber.h>
+        #endif
+        #ifdef HAVE_LDAP_H
+        #include <ldap.h>
+        #endif
+        #include <ldap_ssl.h>
       ]],[[
-        LDAP *ldp = ldapssl_init("dummy", LDAPS_PORT, 1);
+        LDAP *ldp = ldapssl_init("0.0.0.0", LDAPS_PORT, 1);
+        (void)ldp;
       ]])
     ],[
       curl_cv_header_ldap_ssl_h="yes"
@@ -496,12 +380,12 @@ dnl whitespace separated list of libraries to check
 dnl before the WINLDAP default ones.
 
 AC_DEFUN([CURL_CHECK_LIBS_WINLDAP], [
-  AC_REQUIRE([CURL_CHECK_HEADER_WINBER])dnl
-  #
+  AC_REQUIRE([CURL_CHECK_HEADER_WINBER])
+
   AC_MSG_CHECKING([for WINLDAP libraries])
-  #
+
   u_libs=""
-  #
+
   ifelse($1,,,[
     for x_lib in $1; do
       case "$x_lib" in
@@ -519,10 +403,10 @@ AC_DEFUN([CURL_CHECK_LIBS_WINLDAP], [
       fi
     done
   ])
-  #
+
   curl_cv_save_LIBS="$LIBS"
   curl_cv_ldap_LIBS="unknown"
-  #
+
   for x_nlibs in '' "$u_libs" \
     '-lwldap32' ; do
     if test "$curl_cv_ldap_LIBS" = "unknown"; then
@@ -533,32 +417,33 @@ AC_DEFUN([CURL_CHECK_LIBS_WINLDAP], [
       fi
       AC_LINK_IFELSE([
         AC_LANG_PROGRAM([[
-#undef inline
-#ifdef HAVE_WINDOWS_H
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#include <winldap.h>
-#ifdef HAVE_WINBER_H
-#include <winber.h>
-#endif
-#endif
+          #undef inline
+          #ifdef _WIN32
+          #ifndef WIN32_LEAN_AND_MEAN
+          #define WIN32_LEAN_AND_MEAN
+          #endif
+          #include <windows.h>
+          #include <winldap.h>
+          #ifdef HAVE_WINBER_H
+          #include <winber.h>
+          #endif
+          #endif
         ]],[[
           BERVAL *bvp = NULL;
           BerElement *bep = ber_init(bvp);
-          LDAP *ldp = ldap_init("dummy", LDAP_PORT);
+          LDAP *ldp = ldap_init("0.0.0.0", LDAP_PORT);
           ULONG res = ldap_unbind(ldp);
           ber_free(bep, 1);
+          (void)res;
         ]])
       ],[
         curl_cv_ldap_LIBS="$x_nlibs"
       ])
     fi
   done
-  #
+
   LIBS="$curl_cv_save_LIBS"
-  #
+
   case X-"$curl_cv_ldap_LIBS" in
     X-unknown)
       AC_MSG_RESULT([cannot find WINLDAP libraries])
@@ -575,7 +460,6 @@ AC_DEFUN([CURL_CHECK_LIBS_WINLDAP], [
       AC_MSG_RESULT([$curl_cv_ldap_LIBS])
       ;;
   esac
-  #
 ])
 
 
@@ -588,12 +472,12 @@ dnl whitespace separated list of libraries to check
 dnl before the default ones.
 
 AC_DEFUN([CURL_CHECK_LIBS_LDAP], [
-  AC_REQUIRE([CURL_CHECK_HEADER_LDAP])dnl
-  #
+  AC_REQUIRE([CURL_CHECK_HEADER_LDAP])
+
   AC_MSG_CHECKING([for LDAP libraries])
-  #
+
   u_libs=""
-  #
+
   ifelse($1,,,[
     for x_lib in $1; do
       case "$x_lib" in
@@ -611,17 +495,17 @@ AC_DEFUN([CURL_CHECK_LIBS_LDAP], [
       fi
     done
   ])
-  #
+
   curl_cv_save_LIBS="$LIBS"
   curl_cv_ldap_LIBS="unknown"
-  #
+
   for x_nlibs in '' "$u_libs" \
     '-lldap' \
     '-lldap -llber' \
     '-llber -lldap' \
     '-lldapssl -lldapx -lldapsdk' \
     '-lldapsdk -lldapx -lldapssl' \
-    '-lldap -llber -lssl -lcrypto' ; do
+    '-lldap -llber -lssl -lcrypto'; do
 
     if test "$curl_cv_ldap_LIBS" = "unknown"; then
       if test -z "$x_nlibs"; then
@@ -631,44 +515,45 @@ AC_DEFUN([CURL_CHECK_LIBS_LDAP], [
       fi
       AC_LINK_IFELSE([
         AC_LANG_PROGRAM([[
-#undef inline
-#ifdef HAVE_WINDOWS_H
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#else
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#endif
-#ifndef NULL
-#define NULL (void *)0
-#endif
-#ifndef LDAP_DEPRECATED
-#define LDAP_DEPRECATED 1
-#endif
-#ifdef NEED_LBER_H
-#include <lber.h>
-#endif
-#ifdef HAVE_LDAP_H
-#include <ldap.h>
-#endif
+          #undef inline
+          #ifdef _WIN32
+          #ifndef WIN32_LEAN_AND_MEAN
+          #define WIN32_LEAN_AND_MEAN
+          #endif
+          #include <windows.h>
+          #else
+          #ifdef HAVE_SYS_TYPES_H
+          #include <sys/types.h>
+          #endif
+          #endif
+          #ifndef NULL
+          #define NULL (void *)0
+          #endif
+          #ifndef LDAP_DEPRECATED
+          #define LDAP_DEPRECATED 1
+          #endif
+          #ifdef NEED_LBER_H
+          #include <lber.h>
+          #endif
+          #ifdef HAVE_LDAP_H
+          #include <ldap.h>
+          #endif
         ]],[[
           BerValue *bvp = NULL;
           BerElement *bep = ber_init(bvp);
-          LDAP *ldp = ldap_init("dummy", LDAP_PORT);
+          LDAP *ldp = ldap_init("0.0.0.0", LDAP_PORT);
           int res = ldap_unbind(ldp);
           ber_free(bep, 1);
+          (void)res;
         ]])
       ],[
         curl_cv_ldap_LIBS="$x_nlibs"
       ])
     fi
   done
-  #
+
   LIBS="$curl_cv_save_LIBS"
-  #
+
   case X-"$curl_cv_ldap_LIBS" in
     X-unknown)
       AC_MSG_RESULT([cannot find LDAP libraries])
@@ -682,10 +567,13 @@ AC_DEFUN([CURL_CHECK_LIBS_LDAP], [
       else
         LIBS="$curl_cv_ldap_LIBS $curl_cv_save_LIBS"
       fi
+      dnl FIXME: Enable when ldap was detected via pkg-config
+      if false; then
+        LIBCURL_PC_REQUIRES_PRIVATE="ldap $LIBCURL_PC_REQUIRES_PRIVATE"
+      fi
       AC_MSG_RESULT([$curl_cv_ldap_LIBS])
       ;;
   esac
-  #
 ])
 
 
@@ -697,32 +585,27 @@ dnl hosts have it, but AIX 4.3 is one known exception.
 AC_DEFUN([TYPE_SOCKADDR_STORAGE],
 [
    AC_CHECK_TYPE([struct sockaddr_storage],
-        AC_DEFINE(HAVE_STRUCT_SOCKADDR_STORAGE, 1,
-                  [if struct sockaddr_storage is defined]), ,
+     AC_DEFINE(HAVE_STRUCT_SOCKADDR_STORAGE, 1,
+       [if struct sockaddr_storage is defined]), ,
    [
-#undef inline
-#ifdef HAVE_WINDOWS_H
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#ifdef HAVE_WINSOCK2_H
-#include <winsock2.h>
-#endif
-#else
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-#endif
+     #undef inline
+     #ifdef _WIN32
+     #ifndef WIN32_LEAN_AND_MEAN
+     #define WIN32_LEAN_AND_MEAN
+     #endif
+     #include <winsock2.h>
+     #else
+     #ifdef HAVE_SYS_TYPES_H
+     #include <sys/types.h>
+     #endif
+     #include <sys/socket.h>
+     #ifdef HAVE_NETINET_IN_H
+     #include <netinet/in.h>
+     #endif
+     #ifdef HAVE_ARPA_INET_H
+     #include <arpa/inet.h>
+     #endif
+     #endif
    ])
 ])
 
@@ -731,31 +614,26 @@ dnl -------------------------------------------------
 dnl Test if the socket recv() function is available,
 
 AC_DEFUN([CURL_CHECK_FUNC_RECV], [
-  AC_REQUIRE([CURL_CHECK_HEADER_WINSOCK2])dnl
-  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])dnl
-  AC_CHECK_HEADERS(sys/types.h sys/socket.h)
-  #
+  AC_REQUIRE([CURL_CHECK_NATIVE_WINDOWS])
+  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])
+  AC_CHECK_HEADERS(sys/types.h)
+
   AC_MSG_CHECKING([for recv])
   AC_LINK_IFELSE([
     AC_LANG_PROGRAM([[
-#undef inline
-#ifdef HAVE_WINDOWS_H
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#ifdef HAVE_WINSOCK2_H
-#include <winsock2.h>
-#endif
-#else
-$curl_includes_bsdsocket
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
-#endif
+      #undef inline
+      #ifdef _WIN32
+      #ifndef WIN32_LEAN_AND_MEAN
+      #define WIN32_LEAN_AND_MEAN
+      #endif
+      #include <winsock2.h>
+      #else
+      $curl_includes_bsdsocket
+      #ifdef HAVE_SYS_TYPES_H
+      #include <sys/types.h>
+      #endif
+      #include <sys/socket.h>
+      #endif
     ]],[[
       recv(0, 0, 0, 0);
     ]])
@@ -766,11 +644,11 @@ $curl_includes_bsdsocket
     AC_MSG_RESULT([no])
     curl_cv_recv="no"
   ])
-  #
+
   if test "$curl_cv_recv" = "yes"; then
-      AC_DEFINE_UNQUOTED(HAVE_RECV, 1,
-        [Define to 1 if you have the recv function.])
-      curl_cv_func_recv="yes"
+    AC_DEFINE_UNQUOTED(HAVE_RECV, 1,
+      [Define to 1 if you have the recv function.])
+    curl_cv_func_recv="yes"
   else
     AC_MSG_ERROR([Unable to link function recv])
   fi
@@ -782,33 +660,29 @@ dnl -------------------------------------------------
 dnl Test if the socket send() function is available,
 
 AC_DEFUN([CURL_CHECK_FUNC_SEND], [
-  AC_REQUIRE([CURL_CHECK_HEADER_WINSOCK2])dnl
-  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])dnl
-  AC_CHECK_HEADERS(sys/types.h sys/socket.h)
-  #
+  AC_REQUIRE([CURL_CHECK_NATIVE_WINDOWS])
+  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])
+  AC_CHECK_HEADERS(sys/types.h)
+
   AC_MSG_CHECKING([for send])
   AC_LINK_IFELSE([
     AC_LANG_PROGRAM([[
-#undef inline
-#ifdef HAVE_WINDOWS_H
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#ifdef HAVE_WINSOCK2_H
-#include <winsock2.h>
-#endif
-#else
-$curl_includes_bsdsocket
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
-#endif
+      #undef inline
+      #ifdef _WIN32
+      #ifndef WIN32_LEAN_AND_MEAN
+      #define WIN32_LEAN_AND_MEAN
+      #endif
+      #include <winsock2.h>
+      #else
+      $curl_includes_bsdsocket
+      #ifdef HAVE_SYS_TYPES_H
+      #include <sys/types.h>
+      #endif
+      #include <sys/socket.h>
+      #endif
     ]],[[
-      send(0, 0, 0, 0);
+      char s[] = "";
+      send(0, (void *)s, 0, 0);
     ]])
   ],[
     AC_MSG_RESULT([yes])
@@ -817,7 +691,7 @@ $curl_includes_bsdsocket
     AC_MSG_RESULT([no])
     curl_cv_send="no"
   ])
-  #
+
   if test "$curl_cv_send" = "yes"; then
     AC_DEFINE_UNQUOTED(HAVE_SEND, 1,
       [Define to 1 if you have the send function.])
@@ -827,84 +701,36 @@ $curl_includes_bsdsocket
   fi
 ])
 
-dnl CURL_CHECK_MSG_NOSIGNAL
-dnl -------------------------------------------------
-dnl Check for MSG_NOSIGNAL
-
-AC_DEFUN([CURL_CHECK_MSG_NOSIGNAL], [
-  AC_CHECK_HEADERS(sys/types.h sys/socket.h)
-  AC_CACHE_CHECK([for MSG_NOSIGNAL], [curl_cv_msg_nosignal], [
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-#undef inline
-#ifdef HAVE_WINDOWS_H
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#ifdef HAVE_WINSOCK2_H
-#include <winsock2.h>
-#endif
-#else
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
-#endif
-      ]],[[
-        int flag=MSG_NOSIGNAL;
-      ]])
-    ],[
-      curl_cv_msg_nosignal="yes"
-    ],[
-      curl_cv_msg_nosignal="no"
-    ])
-  ])
-  case "$curl_cv_msg_nosignal" in
-    yes)
-      AC_DEFINE_UNQUOTED(HAVE_MSG_NOSIGNAL, 1,
-        [Define to 1 if you have the MSG_NOSIGNAL flag.])
-      ;;
-  esac
-])
-
 
 dnl CURL_CHECK_STRUCT_TIMEVAL
 dnl -------------------------------------------------
 dnl Check for timeval struct
 
 AC_DEFUN([CURL_CHECK_STRUCT_TIMEVAL], [
-  AC_REQUIRE([CURL_CHECK_HEADER_WINSOCK2])dnl
-  AC_CHECK_HEADERS(sys/types.h sys/time.h sys/socket.h)
+  AC_REQUIRE([CURL_CHECK_NATIVE_WINDOWS])
+  AC_CHECK_HEADERS(sys/types.h)
   AC_CACHE_CHECK([for struct timeval], [curl_cv_struct_timeval], [
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
-#undef inline
-#ifdef HAVE_WINDOWS_H
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#ifdef HAVE_WINSOCK2_H
-#include <winsock2.h>
-#endif
-#endif
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#ifdef HAVE_SYS_TIME_H
-#include <sys/time.h>
-#endif
-#include <time.h>
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
+        #undef inline
+        #ifdef _WIN32
+        #ifndef WIN32_LEAN_AND_MEAN
+        #define WIN32_LEAN_AND_MEAN
+        #endif
+        #include <winsock2.h>
+        #else
+        #include <sys/socket.h>
+        #include <sys/time.h>
+        #endif
+        #ifdef HAVE_SYS_TYPES_H
+        #include <sys/types.h>
+        #endif
+        #include <time.h>
       ]],[[
         struct timeval ts;
-        ts.tv_sec  = 0;
+        ts.tv_sec = 0;
         ts.tv_usec = 0;
+        (void)ts;
       ]])
     ],[
       curl_cv_struct_timeval="yes"
@@ -921,122 +747,38 @@ AC_DEFUN([CURL_CHECK_STRUCT_TIMEVAL], [
 ])
 
 
-dnl TYPE_IN_ADDR_T
-dnl -------------------------------------------------
-dnl Check for in_addr_t: it is used to receive the return code of inet_addr()
-dnl and a few other things.
-
-AC_DEFUN([TYPE_IN_ADDR_T], [
-  AC_CHECK_TYPE([in_addr_t], ,[
-    dnl in_addr_t not available
-    AC_CACHE_CHECK([for in_addr_t equivalent],
-      [curl_cv_in_addr_t_equiv], [
-      curl_cv_in_addr_t_equiv="unknown"
-      for t in "unsigned long" int size_t unsigned long; do
-        if test "$curl_cv_in_addr_t_equiv" = "unknown"; then
-          AC_LINK_IFELSE([
-            AC_LANG_PROGRAM([[
-#undef inline
-#ifdef HAVE_WINDOWS_H
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#ifdef HAVE_WINSOCK2_H
-#include <winsock2.h>
-#endif
-#else
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-#endif
-            ]],[[
-              $t data = inet_addr ("1.2.3.4");
-            ]])
-          ],[
-            curl_cv_in_addr_t_equiv="$t"
-          ])
-        fi
-      done
-    ])
-    case "$curl_cv_in_addr_t_equiv" in
-      unknown)
-        AC_MSG_ERROR([Cannot find a type to use in place of in_addr_t])
-        ;;
-      *)
-        AC_DEFINE_UNQUOTED(in_addr_t, $curl_cv_in_addr_t_equiv,
-          [Type to use in place of in_addr_t when system does not provide it.])
-        ;;
-    esac
-  ],[
-#undef inline
-#ifdef HAVE_WINDOWS_H
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#ifdef HAVE_WINSOCK2_H
-#include <winsock2.h>
-#endif
-#else
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-#endif
-  ])
-])
-
-
 dnl CURL_CHECK_FUNC_CLOCK_GETTIME_MONOTONIC
 dnl -------------------------------------------------
 dnl Check if monotonic clock_gettime is available.
 
 AC_DEFUN([CURL_CHECK_FUNC_CLOCK_GETTIME_MONOTONIC], [
-  AC_CHECK_HEADERS(sys/types.h sys/time.h)
+  AC_CHECK_HEADERS(sys/types.h)
   AC_MSG_CHECKING([for monotonic clock_gettime])
-  #
-  if test "x$dontwant_rt" = "xno" ; then
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#ifdef HAVE_SYS_TIME_H
-#include <sys/time.h>
-#endif
-#include <time.h>
-      ]],[[
-        struct timespec ts;
-        (void)clock_gettime(CLOCK_MONOTONIC, &ts);
-      ]])
-    ],[
-      AC_MSG_RESULT([yes])
-      curl_func_clock_gettime="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      curl_func_clock_gettime="no"
-    ])
-  fi
+
+  AC_COMPILE_IFELSE([
+    AC_LANG_PROGRAM([[
+      #ifdef HAVE_SYS_TYPES_H
+      #include <sys/types.h>
+      #endif
+      #ifndef _WIN32
+      #include <sys/time.h>
+      #endif
+      #include <time.h>
+    ]],[[
+      struct timespec ts;
+      (void)clock_gettime(CLOCK_MONOTONIC, &ts);
+      (void)ts;
+    ]])
+  ],[
+    AC_MSG_RESULT([yes])
+    curl_func_clock_gettime="yes"
+  ],[
+    AC_MSG_RESULT([no])
+    curl_func_clock_gettime="no"
+  ])
+
   dnl Definition of HAVE_CLOCK_GETTIME_MONOTONIC is intentionally postponed
-  dnl until library linking and run-time checks for clock_gettime succeed.
+  dnl until library linking and runtime checks for clock_gettime succeed.
 ])
 
 dnl CURL_CHECK_FUNC_CLOCK_GETTIME_MONOTONIC_RAW
@@ -1044,31 +786,30 @@ dnl -------------------------------------------------
 dnl Check if monotonic clock_gettime is available.
 
 AC_DEFUN([CURL_CHECK_FUNC_CLOCK_GETTIME_MONOTONIC_RAW], [
-  AC_CHECK_HEADERS(sys/types.h sys/time.h)
+  AC_CHECK_HEADERS(sys/types.h)
   AC_MSG_CHECKING([for raw monotonic clock_gettime])
-  #
-  if test "x$dontwant_rt" = "xno" ; then
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#ifdef HAVE_SYS_TIME_H
-#include <sys/time.h>
-#endif
-#include <time.h>
-      ]],[[
-        struct timespec ts;
-        (void)clock_gettime(CLOCK_MONOTONIC_RAW, &ts);
-      ]])
-    ],[
-      AC_MSG_RESULT([yes])
-      AC_DEFINE_UNQUOTED(HAVE_CLOCK_GETTIME_MONOTONIC_RAW, 1,
-        [Define to 1 if you have the clock_gettime function and raw monotonic timer.])
-    ],[
-      AC_MSG_RESULT([no])
-    ])
-  fi
+
+  AC_COMPILE_IFELSE([
+    AC_LANG_PROGRAM([[
+      #ifdef HAVE_SYS_TYPES_H
+      #include <sys/types.h>
+      #endif
+      #ifndef _WIN32
+      #include <sys/time.h>
+      #endif
+      #include <time.h>
+    ]],[[
+      struct timespec ts;
+      (void)clock_gettime(CLOCK_MONOTONIC_RAW, &ts);
+      (void)ts;
+    ]])
+  ],[
+    AC_MSG_RESULT([yes])
+    AC_DEFINE_UNQUOTED(HAVE_CLOCK_GETTIME_MONOTONIC_RAW, 1,
+      [Define to 1 if you have the clock_gettime function and raw monotonic timer.])
+  ],[
+    AC_MSG_RESULT([no])
+  ])
 ])
 
 
@@ -1078,15 +819,15 @@ dnl If monotonic clock_gettime is available then,
 dnl check and prepended to LIBS any needed libraries.
 
 AC_DEFUN([CURL_CHECK_LIBS_CLOCK_GETTIME_MONOTONIC], [
-  AC_REQUIRE([CURL_CHECK_FUNC_CLOCK_GETTIME_MONOTONIC])dnl
-  #
+  AC_REQUIRE([CURL_CHECK_FUNC_CLOCK_GETTIME_MONOTONIC])
+
   if test "$curl_func_clock_gettime" = "yes"; then
-    #
+
     AC_MSG_CHECKING([for clock_gettime in libraries])
-    #
+
     curl_cv_save_LIBS="$LIBS"
     curl_cv_gclk_LIBS="unknown"
-    #
+
     for x_xlibs in '' '-lrt' '-lposix4' ; do
       if test "$curl_cv_gclk_LIBS" = "unknown"; then
         if test -z "$x_xlibs"; then
@@ -1096,29 +837,30 @@ AC_DEFUN([CURL_CHECK_LIBS_CLOCK_GETTIME_MONOTONIC], [
         fi
         AC_LINK_IFELSE([
           AC_LANG_PROGRAM([[
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#ifdef HAVE_SYS_TIME_H
-#include <sys/time.h>
-#endif
-#include <time.h>
+            #ifdef HAVE_SYS_TYPES_H
+            #include <sys/types.h>
+            #endif
+            #ifndef _WIN32
+            #include <sys/time.h>
+            #endif
+            #include <time.h>
           ]],[[
             struct timespec ts;
             (void)clock_gettime(CLOCK_MONOTONIC, &ts);
+            (void)ts;
           ]])
         ],[
           curl_cv_gclk_LIBS="$x_xlibs"
         ])
       fi
     done
-    #
+
     LIBS="$curl_cv_save_LIBS"
-    #
+
     case X-"$curl_cv_gclk_LIBS" in
       X-unknown)
         AC_MSG_RESULT([cannot find clock_gettime])
-        AC_MSG_WARN([HAVE_CLOCK_GETTIME_MONOTONIC will not be defined])
+        AC_MSG_WARN([HAVE_CLOCK_GETTIME_MONOTONIC is not defined])
         curl_func_clock_gettime="no"
         ;;
       X-)
@@ -1126,58 +868,59 @@ AC_DEFUN([CURL_CHECK_LIBS_CLOCK_GETTIME_MONOTONIC], [
         curl_func_clock_gettime="yes"
         ;;
       *)
-        if test -z "$curl_cv_save_LIBS"; then
-          LIBS="$curl_cv_gclk_LIBS"
+        if test "$dontwant_rt" = "yes"; then
+          AC_MSG_WARN([needs -lrt but asked not to use it, HAVE_CLOCK_GETTIME_MONOTONIC is not defined])
+          curl_func_clock_gettime="no"
         else
-          LIBS="$curl_cv_gclk_LIBS $curl_cv_save_LIBS"
+          if test -z "$curl_cv_save_LIBS"; then
+            LIBS="$curl_cv_gclk_LIBS"
+          else
+            LIBS="$curl_cv_gclk_LIBS $curl_cv_save_LIBS"
+          fi
+          AC_MSG_RESULT([$curl_cv_gclk_LIBS])
+          curl_func_clock_gettime="yes"
         fi
-        AC_MSG_RESULT([$curl_cv_gclk_LIBS])
-        curl_func_clock_gettime="yes"
         ;;
     esac
-    #
+
     dnl only do runtime verification when not cross-compiling
-    if test "x$cross_compiling" != "xyes" &&
+    if test "$cross_compiling" != "yes" &&
       test "$curl_func_clock_gettime" = "yes"; then
       AC_MSG_CHECKING([if monotonic clock_gettime works])
       CURL_RUN_IFELSE([
         AC_LANG_PROGRAM([[
-#ifdef HAVE_STDLIB_H
-#include <stdlib.h>
-#endif
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#ifdef HAVE_SYS_TIME_H
-#include <sys/time.h>
-#endif
-#include <time.h>
+          #include <stdlib.h>
+          #ifdef HAVE_SYS_TYPES_H
+          #include <sys/types.h>
+          #endif
+          #ifndef _WIN32
+          #include <sys/time.h>
+          #endif
+          #include <time.h>
         ]],[[
           struct timespec ts;
-          if (0 == clock_gettime(CLOCK_MONOTONIC, &ts))
-            exit(0);
-          else
-            exit(1);
+          if(0 == clock_gettime(CLOCK_MONOTONIC, &ts))
+            return 0;
+          (void)ts;
+          return 1;
         ]])
       ],[
         AC_MSG_RESULT([yes])
       ],[
         AC_MSG_RESULT([no])
-        AC_MSG_WARN([HAVE_CLOCK_GETTIME_MONOTONIC will not be defined])
+        AC_MSG_WARN([HAVE_CLOCK_GETTIME_MONOTONIC is not defined])
         curl_func_clock_gettime="no"
         LIBS="$curl_cv_save_LIBS"
       ])
     fi
-    #
+
     case "$curl_func_clock_gettime" in
       yes)
         AC_DEFINE_UNQUOTED(HAVE_CLOCK_GETTIME_MONOTONIC, 1,
           [Define to 1 if you have the clock_gettime function and monotonic timer.])
         ;;
     esac
-    #
   fi
-  #
 ])
 
 
@@ -1187,8 +930,8 @@ dnl Verify if network connect function is already available
 dnl using current libraries or if another one is required.
 
 AC_DEFUN([CURL_CHECK_LIBS_CONNECT], [
-  AC_REQUIRE([CURL_INCLUDES_WINSOCK2])dnl
-  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])dnl
+  AC_REQUIRE([CURL_INCLUDES_WINSOCK2])
+  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])
   AC_MSG_CHECKING([for connect in libraries])
   tst_connect_save_LIBS="$LIBS"
   tst_connect_need_LIBS="unknown"
@@ -1199,7 +942,7 @@ AC_DEFUN([CURL_CHECK_LIBS_CONNECT], [
         AC_LANG_PROGRAM([[
           $curl_includes_winsock2
           $curl_includes_bsdsocket
-          #if !defined(HAVE_WINDOWS_H) && !defined(HAVE_PROTO_BSDSOCKET_H)
+          #if !defined(_WIN32) && !defined(HAVE_PROTO_BSDSOCKET_H)
             int connect(int, void*, int);
           #endif
         ]],[[
@@ -1212,7 +955,7 @@ AC_DEFUN([CURL_CHECK_LIBS_CONNECT], [
     fi
   done
   LIBS="$tst_connect_save_LIBS"
-  #
+
   case X-"$tst_connect_need_LIBS" in
     X-unknown)
       AC_MSG_RESULT([cannot find connect])
@@ -1229,100 +972,40 @@ AC_DEFUN([CURL_CHECK_LIBS_CONNECT], [
 ])
 
 
-dnl CURL_DEFINE_UNQUOTED (VARIABLE, [VALUE])
-dnl -------------------------------------------------
-dnl Like AC_DEFINE_UNQUOTED this macro will define a C preprocessor
-dnl symbol that can be further used in custom template configuration
-dnl files. This macro, unlike AC_DEFINE_UNQUOTED, does not use a third
-dnl argument for the description. Symbol definitions done with this
-dnl macro are intended to be exclusively used in handcrafted *.h.in
-dnl template files. Contrary to what AC_DEFINE_UNQUOTED does, this one
-dnl prevents autoheader generation and insertion of symbol template
-dnl stub and definition into the first configuration header file. Do
-dnl not use this macro as a replacement for AC_DEFINE_UNQUOTED, each
-dnl one serves different functional needs.
-
-AC_DEFUN([CURL_DEFINE_UNQUOTED], [
-cat >>confdefs.h <<_EOF
-[@%:@define] $1 ifelse($#, 2, [$2], 1)
-_EOF
-])
-
-dnl CURL_CONFIGURE_PULL_SYS_POLL
-dnl -------------------------------------------------
-dnl The need for the sys/poll.h inclusion arises mainly to properly
-dnl interface AIX systems which define macros 'events' and 'revents'.
-
-AC_DEFUN([CURL_CONFIGURE_PULL_SYS_POLL], [
-  AC_REQUIRE([CURL_INCLUDES_POLL])dnl
-  #
-  tst_poll_events_macro_defined="unknown"
-  #
-  AC_COMPILE_IFELSE([
-    AC_LANG_PROGRAM([[
-      $curl_includes_poll
-    ]],[[
-#if defined(events) || defined(revents)
-      return 0;
-#else
-      force compilation error
-#endif
-    ]])
-  ],[
-    tst_poll_events_macro_defined="yes"
-  ],[
-    tst_poll_events_macro_defined="no"
-  ])
-  #
-  if test "$tst_poll_events_macro_defined" = "yes"; then
-    if test "x$ac_cv_header_sys_poll_h" = "xyes"; then
-      CURL_DEFINE_UNQUOTED([CURL_PULL_SYS_POLL_H])
-    fi
-  fi
-  #
-])
-
-
 dnl CURL_CHECK_FUNC_SELECT
 dnl -------------------------------------------------
 dnl Test if the socket select() function is available.
 
 AC_DEFUN([CURL_CHECK_FUNC_SELECT], [
-  AC_REQUIRE([CURL_CHECK_STRUCT_TIMEVAL])dnl
-  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])dnl
-  AC_CHECK_HEADERS(sys/select.h sys/socket.h)
-  #
+  AC_REQUIRE([CURL_CHECK_STRUCT_TIMEVAL])
+  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])
+  AC_CHECK_HEADERS(sys/select.h)
+
   AC_MSG_CHECKING([for select])
   AC_LINK_IFELSE([
     AC_LANG_PROGRAM([[
-#undef inline
-#ifdef HAVE_WINDOWS_H
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#ifdef HAVE_WINSOCK2_H
-#include <winsock2.h>
-#endif
-#endif
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#ifdef HAVE_SYS_TIME_H
-#include <sys/time.h>
-#endif
-#include <time.h>
-#ifndef HAVE_WINDOWS_H
-#ifdef HAVE_SYS_SELECT_H
-#include <sys/select.h>
-#elif defined(HAVE_UNISTD_H)
-#include <unistd.h>
-#endif
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
-$curl_includes_bsdsocket
-#endif
+      #undef inline
+      #ifdef _WIN32
+      #ifndef WIN32_LEAN_AND_MEAN
+      #define WIN32_LEAN_AND_MEAN
+      #endif
+      #include <winsock2.h>
+      #else
+      #include <sys/socket.h>
+      #include <sys/time.h>
+      #endif
+      #ifdef HAVE_SYS_TYPES_H
+      #include <sys/types.h>
+      #endif
+      #include <time.h>
+      #ifndef _WIN32
+      #ifdef HAVE_SYS_SELECT_H
+      #include <sys/select.h>
+      #elif defined(HAVE_UNISTD_H)
+      #include <unistd.h>
+      #endif
+      $curl_includes_bsdsocket
+      #endif
     ]],[[
       select(0, 0, 0, 0, 0);
     ]])
@@ -1333,7 +1016,7 @@ $curl_includes_bsdsocket
     AC_MSG_RESULT([no])
     curl_cv_select="no"
   ])
-  #
+
   if test "$curl_cv_select" = "yes"; then
     AC_DEFINE_UNQUOTED(HAVE_SELECT, 1,
       [Define to 1 if you have the select function.])
@@ -1345,7 +1028,7 @@ $curl_includes_bsdsocket
 dnl CURL_VERIFY_RUNTIMELIBS
 dnl -------------------------------------------------
 dnl Verify that the shared libs found so far can be used when running
-dnl programs, since otherwise the situation will create odd configure errors
+dnl programs, since otherwise the situation creates odd configure errors
 dnl that are misleading people.
 dnl
 dnl Make sure this test is run BEFORE the first test in the script that
@@ -1355,20 +1038,20 @@ dnl macro. It must also run AFTER all lib-checking macros are complete.
 AC_DEFUN([CURL_VERIFY_RUNTIMELIBS], [
 
   dnl this test is of course not sensible if we are cross-compiling!
-  if test "x$cross_compiling" != xyes; then
+  if test "$cross_compiling" != "yes"; then
 
-    dnl just run a program to verify that the libs checked for previous to this
-    dnl point also is available run-time!
-    AC_MSG_CHECKING([run-time libs availability])
+    dnl run a program to verify that the libs checked for previous to this
+    dnl point also is available runtime!
+    AC_MSG_CHECKING([runtime libs availability])
     CURL_RUN_IFELSE([
-int main()
-{
-  return 0;
-}
-],
+      int main(void)
+      {
+        return 0;
+      }
+    ],
     AC_MSG_RESULT([fine]),
     AC_MSG_RESULT([failed])
-    AC_MSG_ERROR([one or more libs available at link-time are not available run-time. Libs used at link-time: $LIBS])
+    AC_MSG_ERROR([one or more libs available at link-time are not available runtime. Libs used at link-time: $LIBS])
     )
 
     dnl if this test fails, configure has already stopped
@@ -1376,81 +1059,17 @@ int main()
 ])
 
 
-dnl CURL_CHECK_VARIADIC_MACROS
-dnl -------------------------------------------------
-dnl Check compiler support of variadic macros
-
-AC_DEFUN([CURL_CHECK_VARIADIC_MACROS], [
-  AC_CACHE_CHECK([for compiler support of C99 variadic macro style],
-    [curl_cv_variadic_macros_c99], [
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-#define c99_vmacro3(first, ...) fun3(first, __VA_ARGS__)
-#define c99_vmacro2(first, ...) fun2(first, __VA_ARGS__)
-        int fun3(int arg1, int arg2, int arg3);
-        int fun2(int arg1, int arg2);
-        int fun3(int arg1, int arg2, int arg3)
-        { return arg1 + arg2 + arg3; }
-        int fun2(int arg1, int arg2)
-        { return arg1 + arg2; }
-      ]],[[
-        int res3 = c99_vmacro3(1, 2, 3);
-        int res2 = c99_vmacro2(1, 2);
-      ]])
-    ],[
-      curl_cv_variadic_macros_c99="yes"
-    ],[
-      curl_cv_variadic_macros_c99="no"
-    ])
-  ])
-  case "$curl_cv_variadic_macros_c99" in
-    yes)
-      AC_DEFINE_UNQUOTED(HAVE_VARIADIC_MACROS_C99, 1,
-        [Define to 1 if compiler supports C99 variadic macro style.])
-      ;;
-  esac
-  AC_CACHE_CHECK([for compiler support of old gcc variadic macro style],
-    [curl_cv_variadic_macros_gcc], [
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-#define gcc_vmacro3(first, args...) fun3(first, args)
-#define gcc_vmacro2(first, args...) fun2(first, args)
-        int fun3(int arg1, int arg2, int arg3);
-        int fun2(int arg1, int arg2);
-        int fun3(int arg1, int arg2, int arg3)
-        { return arg1 + arg2 + arg3; }
-        int fun2(int arg1, int arg2)
-        { return arg1 + arg2; }
-      ]],[[
-        int res3 = gcc_vmacro3(1, 2, 3);
-        int res2 = gcc_vmacro2(1, 2);
-      ]])
-    ],[
-      curl_cv_variadic_macros_gcc="yes"
-    ],[
-      curl_cv_variadic_macros_gcc="no"
-    ])
-  ])
-  case "$curl_cv_variadic_macros_gcc" in
-    yes)
-      AC_DEFINE_UNQUOTED(HAVE_VARIADIC_MACROS_GCC, 1,
-        [Define to 1 if compiler supports old gcc variadic macro style.])
-      ;;
-  esac
-])
-
-
 dnl CURL_CHECK_CA_BUNDLE
 dnl -------------------------------------------------
 dnl Check if a default ca-bundle should be used
 dnl
-dnl regarding the paths this will scan:
+dnl regarding the paths this scans:
 dnl /etc/ssl/certs/ca-certificates.crt Debian systems
 dnl /etc/pki/tls/certs/ca-bundle.crt Redhat and Mandriva
 dnl /usr/share/ssl/certs/ca-bundle.crt old(er) Redhat
-dnl /usr/local/share/certs/ca-root-nss.crt FreeBSD, MidnightBSD
-dnl /etc/ssl/cert.pem OpenBSD, FreeBSD, MidnightBSD (symlink)
-dnl /etc/ssl/certs/ (ca path) SUSE
+dnl /usr/local/share/certs/ca-root-nss.crt MidnightBSD
+dnl /etc/ssl/cert.pem OpenBSD, MidnightBSD (symlink)
+dnl /etc/ssl/certs (CA path) SUSE, FreeBSD
 
 AC_DEFUN([CURL_CHECK_CA_BUNDLE], [
 
@@ -1458,8 +1077,8 @@ AC_DEFUN([CURL_CHECK_CA_BUNDLE], [
 
   AC_ARG_WITH(ca-bundle,
 AS_HELP_STRING([--with-ca-bundle=FILE],
-[Path to a file containing CA certificates (example: /etc/ca-bundle.crt)])
-AS_HELP_STRING([--without-ca-bundle], [Don't use a default CA bundle]),
+  [Absolute path to a file containing CA certificates (example: /etc/ca-bundle.crt)])
+AS_HELP_STRING([--without-ca-bundle], [Do not use a default CA bundle]),
   [
     want_ca="$withval"
     if test "x$want_ca" = "xyes"; then
@@ -1469,11 +1088,11 @@ AS_HELP_STRING([--without-ca-bundle], [Don't use a default CA bundle]),
   [ want_ca="unset" ])
   AC_ARG_WITH(ca-path,
 AS_HELP_STRING([--with-ca-path=DIRECTORY],
-[Path to a directory containing CA certificates stored individually, with \
+  [Absolute path to a directory containing CA certificates stored individually, with \
 their filenames in a hash format. This option can be used with the OpenSSL, \
-GnuTLS and mbedTLS backends. Refer to OpenSSL c_rehash for details. \
+GnuTLS, mbedTLS and wolfSSL backends. Refer to OpenSSL c_rehash for details. \
 (example: /etc/certificates)])
-AS_HELP_STRING([--without-ca-path], [Don't use a default CA path]),
+AS_HELP_STRING([--without-ca-path], [Do not use a default CA path]),
   [
     want_capath="$withval"
     if test "x$want_capath" = "xyes"; then
@@ -1486,35 +1105,45 @@ AS_HELP_STRING([--without-ca-path], [Don't use a default CA path]),
   capath_warning="   (warning: certs not found)"
   check_capath=""
 
-  if test "x$want_ca" != "xno" -a "x$want_ca" != "xunset" -a \
-          "x$want_capath" != "xno" -a "x$want_capath" != "xunset"; then
+  if test "$APPLE_SECTRUST_ENABLED" = "1"; then
+    ca_native="Apple SecTrust"
+  elif test "$ca_native_opt" = "1"; then
+    ca_native="yes"
+  else
+    ca_native="no"
+  fi
+
+  if test "x$want_ca" != "xno" && test "x$want_ca" != "xunset" &&
+     test "x$want_capath" != "xno" && test "x$want_capath" != "xunset"; then
     dnl both given
     ca="$want_ca"
     capath="$want_capath"
-  elif test "x$want_ca" != "xno" -a "x$want_ca" != "xunset"; then
+  elif test "x$want_ca" != "xno" && test "x$want_ca" != "xunset"; then
     dnl --with-ca-bundle given
     ca="$want_ca"
     capath="no"
-  elif test "x$want_capath" != "xno" -a "x$want_capath" != "xunset"; then
+  elif test "x$want_capath" != "xno" && test "x$want_capath" != "xunset"; then
     dnl --with-ca-path given
-    if test "x$OPENSSL_ENABLED" != "x1" -a "x$GNUTLS_ENABLED" != "x1" -a "x$MBEDTLS_ENABLED" != "x1"; then
-      AC_MSG_ERROR([--with-ca-path only works with OpenSSL, GnuTLS or mbedTLS])
-    fi
     capath="$want_capath"
     ca="no"
-  else
-    dnl first try autodetecting a CA bundle , then a CA path
-    dnl both autodetections can be skipped by --without-ca-*
+  elif test "$ca_native" != "no"; then
+    dnl native CA configured, do not look further
     ca="no"
     capath="no"
-    if test "x$cross_compiling" != "xyes"; then
+  else
+    dnl First try auto-detecting a CA bundle, then a CA path.
+    dnl Both auto-detections can be skipped by --without-ca-*
+    ca="no"
+    capath="no"
+    if test "$cross_compiling" != "yes" &&
+       test "$curl_cv_native_windows" != "yes"; then
       dnl NOT cross-compiling and...
       dnl neither of the --with-ca-* options are provided
       if test "x$want_ca" = "xunset"; then
-        dnl the path we previously would have installed the curl ca bundle
+        dnl the path we previously would have installed the curl CA bundle
         dnl to, and thus we now check for an already existing cert in that
         dnl place in case we find no other
-        if test "x$prefix" != xNONE; then
+        if test "x$prefix" != "xNONE"; then
           cac="${prefix}/share/curl/curl-ca-bundle.crt"
         else
           cac="$ac_default_prefix/share/curl/curl-ca-bundle.crt"
@@ -1532,9 +1161,9 @@ AS_HELP_STRING([--without-ca-path], [Don't use a default CA path]),
           fi
         done
       fi
-      if test "x$want_capath" = "xunset" -a "x$ca" = "xno" -a \
-              "x$OPENSSL_ENABLED" = "x1"; then
-        check_capath="/etc/ssl/certs/"
+      AC_MSG_NOTICE([want $want_capath CA $ca])
+      if test "x$want_capath" = "xunset"; then
+        check_capath="/etc/ssl/certs"
       fi
     else
       dnl no option given and cross-compiling
@@ -1550,7 +1179,7 @@ AS_HELP_STRING([--without-ca-path], [Don't use a default CA path]),
     check_capath="$capath"
   fi
 
-  if test ! -z "$check_capath"; then
+  if test -n "$check_capath"; then
     for a in "$check_capath"; do
       if test -d "$a" && ls "$a"/[[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]].0 >/dev/null 2>/dev/null; then
         if test "x$capath" = "xno"; then
@@ -1567,115 +1196,92 @@ AS_HELP_STRING([--without-ca-path], [Don't use a default CA path]),
   fi
 
   if test "x$ca" != "xno"; then
-    CURL_CA_BUNDLE='"'$ca'"'
-    AC_DEFINE_UNQUOTED(CURL_CA_BUNDLE, "$ca", [Location of default ca bundle])
+    CURL_CA_BUNDLE="$ca"
+    AC_DEFINE_UNQUOTED(CURL_CA_BUNDLE, "$ca", [Location of default CA bundle])
     AC_SUBST(CURL_CA_BUNDLE)
     AC_MSG_RESULT([$ca])
   fi
   if test "x$capath" != "xno"; then
     CURL_CA_PATH="\"$capath\""
-    AC_DEFINE_UNQUOTED(CURL_CA_PATH, "$capath", [Location of default ca path])
+    AC_DEFINE_UNQUOTED(CURL_CA_PATH, "$capath", [Location of default CA path])
     AC_MSG_RESULT([$capath (capath)])
   fi
   if test "x$ca" = "xno" && test "x$capath" = "xno"; then
     AC_MSG_RESULT([no])
   fi
 
-  AC_MSG_CHECKING([whether to use builtin CA store of SSL library])
+  AC_MSG_CHECKING([whether to use OpenSSL's built-in CA store])
   AC_ARG_WITH(ca-fallback,
-AS_HELP_STRING([--with-ca-fallback], [Use the built in CA store of the SSL library])
-AS_HELP_STRING([--without-ca-fallback], [Don't use the built in CA store of the SSL library]),
+AS_HELP_STRING([--with-ca-fallback], [Use OpenSSL's built-in CA store])
+AS_HELP_STRING([--without-ca-fallback], [Do not use OpenSSL's built-in CA store]),
   [
-    if test "x$with_ca_fallback" != "xyes" -a "x$with_ca_fallback" != "xno"; then
+    if test "x$with_ca_fallback" != "xyes" && test "x$with_ca_fallback" != "xno"; then
       AC_MSG_ERROR([--with-ca-fallback only allows yes or no as parameter])
     fi
   ],
   [ with_ca_fallback="no"])
   AC_MSG_RESULT([$with_ca_fallback])
   if test "x$with_ca_fallback" = "xyes"; then
-    if test "x$OPENSSL_ENABLED" != "x1" -a "x$GNUTLS_ENABLED" != "x1"; then
-      AC_MSG_ERROR([--with-ca-fallback only works with OpenSSL or GnuTLS])
+    if test "$OPENSSL_ENABLED" != "1"; then
+      AC_MSG_ERROR([--with-ca-fallback only works with OpenSSL])
     fi
-    AC_DEFINE_UNQUOTED(CURL_CA_FALLBACK, 1, [define "1" to use built in CA store of SSL library ])
+    AC_DEFINE_UNQUOTED(CURL_CA_FALLBACK, 1, [define "1" to use OpenSSL's built-in CA store])
   fi
 ])
 
-dnl CURL_CHECK_WIN32_LARGEFILE
-dnl -------------------------------------------------
-dnl Check if curl's WIN32 large file will be used
 
-AC_DEFUN([CURL_CHECK_WIN32_LARGEFILE], [
-  AC_REQUIRE([CURL_CHECK_HEADER_WINDOWS])dnl
-  AC_MSG_CHECKING([whether build target supports WIN32 file API])
-  curl_win32_file_api="no"
-  if test "$curl_cv_header_windows_h" = "yes"; then
-    if test x"$enable_largefile" != "xno"; then
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-        ]],[[
-#if !defined(_WIN32_WCE) && \
-    (defined(__MINGW32__) || \
-    (defined(_MSC_VER) && (defined(_WIN32) || defined(_WIN64))))
-          int dummy=1;
-#else
-          WIN32 large file API not supported.
-#endif
-        ]])
-      ],[
-        curl_win32_file_api="win32_large_files"
-      ])
+dnl CURL_CHECK_CA_EMBED
+dnl -------------------------------------------------
+dnl Check if a ca-bundle should be embedded
+
+AC_DEFUN([CURL_CHECK_CA_EMBED], [
+
+  AC_MSG_CHECKING([CA cert bundle path to embed in the curl tool])
+
+  AC_ARG_WITH(ca-embed,
+AS_HELP_STRING([--with-ca-embed=FILE],
+  [Absolute path to a file containing CA certificates to embed in the curl tool (example: /etc/ca-bundle.crt)])
+AS_HELP_STRING([--without-ca-embed], [Do not embed a default CA bundle in the curl tool]),
+  [
+    want_ca_embed="$withval"
+    if test "x$want_ca_embed" = "xyes"; then
+      AC_MSG_ERROR([--with-ca-embed=FILE requires a path to the CA bundle])
     fi
-    if test "$curl_win32_file_api" = "no"; then
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-        ]],[[
-#if defined(_WIN32_WCE) || defined(__MINGW32__) || defined(_MSC_VER)
-          int dummy=1;
-#else
-          WIN32 small file API not supported.
-#endif
-        ]])
-      ],[
-        curl_win32_file_api="win32_small_files"
-      ])
-    fi
-  fi
-  case "$curl_win32_file_api" in
-    win32_large_files)
-      AC_MSG_RESULT([yes (large file enabled)])
-      AC_DEFINE_UNQUOTED(USE_WIN32_LARGE_FILES, 1,
-        [Define to 1 if you are building a Windows target with large file support.])
-      AC_SUBST(USE_WIN32_LARGE_FILES, [1])
-      ;;
-    win32_small_files)
-      AC_MSG_RESULT([yes (large file disabled)])
-      AC_DEFINE_UNQUOTED(USE_WIN32_SMALL_FILES, 1,
-        [Define to 1 if you are building a Windows target without large file support.])
-      AC_SUBST(USE_WIN32_SMALL_FILES, [1])
-      ;;
-    *)
+  ],
+  [ want_ca_embed="unset" ])
+
+  CURL_CA_EMBED=''
+  if test "x$want_ca_embed" != "xno" && test "x$want_ca_embed" != "xunset" && test -f "$want_ca_embed"; then
+    if test -n "$PERL"; then
+      CURL_CA_EMBED="$want_ca_embed"
+      AC_SUBST(CURL_CA_EMBED)
+      AC_MSG_RESULT([$want_ca_embed])
+    else
       AC_MSG_RESULT([no])
-      ;;
-  esac
+      AC_MSG_WARN([perl was not found. Cannot do CA embed.])
+    fi
+  else
+    AC_MSG_RESULT([no])
+  fi
 ])
 
 dnl CURL_CHECK_WIN32_CRYPTO
 dnl -------------------------------------------------
-dnl Check if curl's WIN32 crypto lib can be used
+dnl Check if curl's Win32 crypto lib can be used
 
 AC_DEFUN([CURL_CHECK_WIN32_CRYPTO], [
-  AC_REQUIRE([CURL_CHECK_HEADER_WINDOWS])dnl
-  AC_MSG_CHECKING([whether build target supports WIN32 crypto API])
+  AC_REQUIRE([CURL_CHECK_NATIVE_WINDOWS])
+  AC_MSG_CHECKING([whether build target supports Win32 crypto API])
   curl_win32_crypto_api="no"
-  if test "$curl_cv_header_windows_h" = "yes"; then
+  if test "$curl_cv_native_windows" = "yes" && test "$curl_cv_winuwp" != "yes"; then
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
-#undef inline
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#include <wincrypt.h>
+        #undef inline
+        #ifndef WIN32_LEAN_AND_MEAN
+        #define WIN32_LEAN_AND_MEAN
+        #endif
+        #include <windows.h>
+        #include <wincrypt.h>
       ]],[[
         HCRYPTPROV hCryptProv;
         if(CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL,
@@ -1692,7 +1298,7 @@ AC_DEFUN([CURL_CHECK_WIN32_CRYPTO], [
       AC_MSG_RESULT([yes])
       AC_DEFINE_UNQUOTED(USE_WIN32_CRYPTO, 1,
         [Define to 1 if you are building a Windows target with crypto API support.])
-      AC_SUBST(USE_WIN32_CRYPTO, [1])
+      USE_WIN32_CRYPTO=1
       ;;
     *)
       AC_MSG_RESULT([no])
@@ -1700,22 +1306,65 @@ AC_DEFUN([CURL_CHECK_WIN32_CRYPTO], [
   esac
 ])
 
-dnl CURL_EXPORT_PCDIR ($pcdir)
+dnl CURL_EXPORT_PCDIR ($pcdir, [$additive])
 dnl ------------------------
-dnl if $pcdir is not empty, set PKG_CONFIG_LIBDIR to $pcdir and export
+dnl if $pcdir is not empty, set PKG_CONFIG_LIBDIR to $pcdir and export.
+dnl if $additive is set, extend PKG_CONFIG_PATH instead, by prepending $pcdir
+dnl to it, to ensure that system locations are still checked. This is
+dnl necessary for modules that depend on modules residing there
+dnl (e.g. gnutls.pc).
 dnl
-dnl we need this macro since pkg-config distinguishes among empty and unset
-dnl variable while checking PKG_CONFIG_LIBDIR
+dnl we need this macro to limit/expand search locations to/with a custom
+dnl configured one.
 dnl
 
 AC_DEFUN([CURL_EXPORT_PCDIR], [
-    if test -n "$1"; then
+  if test -n "$1"; then
+    if test -n "$2"; then
+      dnl honor system locations
+      PKG_CONFIG_PATH="$1${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}"
+      export PKG_CONFIG_PATH
+    else
+      dnl ignore and override system locations
       PKG_CONFIG_LIBDIR="$1"
       export PKG_CONFIG_LIBDIR
     fi
+  fi
 ])
 
-dnl CURL_CHECK_PKGCONFIG ($module, [$pcdir])
+dnl CURL_TRACE_PCDIR ($module, [$pcdir], [$additive])
+dnl ------------------------
+dnl show pkg-config module lookup details, along with a detailed errors
+dnl message in case of failure. Supports both pkg-config and pkgconf.
+dnl
+
+AC_DEFUN([CURL_TRACE_PCDIR], [
+  dnl Example pkgconf line:
+  dnl   libpkgconf/pkg.c:746 [pkgconf_pkg_t *pkgconf_pkg_try_specific_path(pkgconf_client_t *, [...]*)]:
+  dnl     trying path: /usr/local/lib/pkgconfig for libngtcp2_crypto_gnutls
+  dnl Rest of strings are for catching classic pkg-config lines.
+  trc=`CURL_EXPORT_PCDIR([$2], [$3])
+    if test -n "$PKG_CONFIG_LIBDIR"; then
+      echo "PKG_CONFIG_LIBDIR: '$PKG_CONFIG_LIBDIR'"
+    fi
+    if test -n "$PKG_CONFIG_PATH"; then
+      echo "PKG_CONFIG_PATH: '$PKG_CONFIG_PATH'"
+    fi
+    $PKGCONFIG --exists --debug $1 2>&1 | \
+      $EGREP '(trying path:|Adding directory|Looking for|Scanning directory|Cannot open directory)' | \
+      $SED 's/^.*trying path:/trying path:/'`
+  msg=`CURL_EXPORT_PCDIR([$2], [$3])
+    $PKGCONFIG --exists --print-errors $1 2>&1`
+  if test -n "$msg"; then
+    trc=`echo "$trc"; echo '==== error:'; echo "$msg"`
+  fi
+  AC_MSG_NOTICE([pkg-config --exists $1 trace:
+---- begin
+${trc}
+---- end])
+])
+
+dnl CURL_CHECK_PKGCONFIG ($module, [$pcdir], [$additive])
 dnl ------------------------
 dnl search for the pkg-config tool. Set the PKGCONFIG variable to hold the
 dnl path to it, or 'no' if not found/present.
@@ -1727,76 +1376,127 @@ dnl Optionally PKG_CONFIG_LIBDIR may be given as $pcdir.
 dnl
 
 AC_DEFUN([CURL_CHECK_PKGCONFIG], [
-    if test -n "$PKG_CONFIG"; then
-      PKGCONFIG="$PKG_CONFIG"
+  if test -n "$PKG_CONFIG"; then
+    PKGCONFIG="$PKG_CONFIG"
+  else
+    AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no],
+      [$PATH:/usr/bin:/usr/local/bin])
+  fi
+
+  if test "$PKGCONFIG" != "no"; then
+    AC_MSG_CHECKING([for $1 options with pkg-config])
+    dnl ask pkg-config about $1
+    itexists=`CURL_EXPORT_PCDIR([$2], [$3])
+      $PKGCONFIG --exists $1 >/dev/null 2>&1 && echo 1`
+
+    if test -z "$itexists"; then
+      dnl pkg-config does not have info about the given module! set the
+      dnl variable to 'no'
+      AC_MSG_RESULT([no])
+      if test -n "$CURL_TRACE_PKG_CONFIG$CURL_CI"; then
+        CURL_TRACE_PCDIR([$1], [$2], [$3])
+      fi
+      PKGCONFIG="no"
     else
-      AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no],
-        [$PATH:/usr/bin:/usr/local/bin])
-    fi
-
-    if test "x$PKGCONFIG" != "xno"; then
-      AC_MSG_CHECKING([for $1 options with pkg-config])
-      dnl ask pkg-config about $1
-      itexists=`CURL_EXPORT_PCDIR([$2]) dnl
-        $PKGCONFIG --exists $1 >/dev/null 2>&1 && echo 1`
-
-      if test -z "$itexists"; then
-        dnl pkg-config does not have info about the given module! set the
-        dnl variable to 'no'
-        PKGCONFIG="no"
-        AC_MSG_RESULT([no])
-      else
-        AC_MSG_RESULT([found])
+      AC_MSG_RESULT([found])
+      if test -n "$CURL_TRACE_PKG_CONFIG"; then
+        CURL_TRACE_PCDIR([$1], [$2], [$3])
       fi
     fi
+  fi
 ])
 
 
-dnl CURL_GENERATE_CONFIGUREHELP_PM
+dnl CURL_PREPARE_CONFIGUREHELP_PM
 dnl -------------------------------------------------
-dnl Generate test harness configurehelp.pm module, defining and
+dnl Prepare test harness configurehelp.pm module, defining and
 dnl initializing some perl variables with values which are known
 dnl when the configure script runs. For portability reasons, test
 dnl harness needs information on how to run the C preprocessor.
 
-AC_DEFUN([CURL_GENERATE_CONFIGUREHELP_PM], [
-  AC_REQUIRE([AC_PROG_CPP])dnl
+AC_DEFUN([CURL_PREPARE_CONFIGUREHELP_PM], [
+  AC_REQUIRE([AC_PROG_CPP])
   tmp_cpp=`eval echo "$ac_cpp" 2>/dev/null`
   if test -z "$tmp_cpp"; then
     tmp_cpp='cpp'
   fi
-  cat >./tests/configurehelp.pm <<_EOF
-[@%:@] This is a generated file.  Do not edit.
-
-package configurehelp;
-
-use strict;
-use warnings;
-use Exporter;
-
-use vars qw(
-    @ISA
-    @EXPORT_OK
-    \$Cpreprocessor
-    );
-
-@ISA = qw(Exporter);
-
-@EXPORT_OK = qw(
-    \$Cpreprocessor
-    );
-
-\$Cpreprocessor = '$tmp_cpp';
-
-1;
-_EOF
+  AC_SUBST(CURL_CPP, $tmp_cpp)
 ])
 
+
+dnl CURL_PREPARE_BUILDINFO
+dnl -------------------------------------------------
+dnl Save build info for test runner to pick up and log
+
+AC_DEFUN([CURL_PREPARE_BUILDINFO], [
+  curl_pflags=""
+  if test "$curl_cv_apple" = "yes"; then
+    curl_pflags="${curl_pflags} APPLE"
+  fi
+  case $host in
+    *-*-*bsd*|*-*-aix*|*-*-hpux*|*-*-interix*|*-*-irix*|*-*-linux*|*-*-solaris*|*-*-sunos*|*-apple-*|*-*-cygwin*|*-*-msys*)
+      curl_pflags="${curl_pflags} UNIX";;
+  esac
+  case $host in
+    *-*-*bsd*)
+      curl_pflags="${curl_pflags} BSD";;
+  esac
+  if test "$curl_cv_android" = "yes"; then
+    curl_pflags="${curl_pflags} ANDROID"
+    ANDROID_PLATFORM_LEVEL=`echo "$host_os" | $SED -ne 's/.*android\(@<:@0-9@:>@*\).*/\1/p'`
+    if test -n "${ANDROID_PLATFORM_LEVEL}"; then
+      curl_pflags="${curl_pflags}-${ANDROID_PLATFORM_LEVEL}"
+    fi
+  fi
+  if test "$curl_cv_native_windows" = "yes"; then
+    curl_pflags="${curl_pflags} WIN32"
+  fi
+  if test "$curl_cv_winuwp" = "yes"; then
+    curl_pflags="${curl_pflags} UWP"
+  fi
+  case $host_os in
+    cygwin*|msys*) curl_pflags="${curl_pflags} CYGWIN";;
+  esac
+  case $host_os in
+    msdos*) curl_pflags="${curl_pflags} DOS";;
+    amiga*) curl_pflags="${curl_pflags} AMIGA";;
+  esac
+  if test "$compiler_id" = "GNU_C"; then
+    curl_pflags="${curl_pflags} GCC"
+  fi
+  if test "$compiler_id" = "APPLECLANG"; then
+    curl_pflags="${curl_pflags} APPLE-CLANG"
+  elif test "$compiler_id" = "CLANG"; then
+    curl_pflags="${curl_pflags} LLVM-CLANG"
+  fi
+  case $host_os in
+    mingw*) curl_pflags="${curl_pflags} MINGW";;
+  esac
+  if test "$cross_compiling" = "yes"; then
+    curl_pflags="${curl_pflags} CROSS"
+  fi
+  squeeze curl_pflags
+  curl_buildinfo="
+buildinfo.configure.tool: configure
+buildinfo.configure.args: $ac_configure_args
+buildinfo.host: $build
+buildinfo.host.cpu: $build_cpu
+buildinfo.host.os: $build_os
+buildinfo.target: $host
+buildinfo.target.cpu: $host_cpu
+buildinfo.target.os: $host_os
+buildinfo.target.flags: $curl_pflags
+buildinfo.compiler: $compiler_id
+buildinfo.compiler.version: $compiler_ver
+buildinfo.sysroot: $lt_sysroot"
+])
+
+
 dnl CURL_CPP_P
 dnl
 dnl Check if $cpp -P should be used for extract define values due to gcc 5
 dnl splitting up strings and defines between line outputs. gcc by default
-dnl (without -P) will show TEST EINVAL TEST as
+dnl (without -P) shows TEST EINVAL TEST as
 dnl
 dnl # 13 "conftest.c"
 dnl TEST
@@ -1814,7 +1514,7 @@ TEST EINVAL TEST
   AC_MSG_RESULT([$cpp])
 
   dnl we need cpp -P so check if it works then
-  if test "x$cpp" = "xyes"; then
+  if test "$cpp" = "yes"; then
     AC_MSG_CHECKING([if cpp -P works])
     OLDCPPFLAGS=$CPPFLAGS
     CPPFLAGS="$CPPFLAGS -P"
@@ -1824,18 +1524,18 @@ TEST EINVAL TEST
     ], [cpp_p=yes], [cpp_p=no])
     AC_MSG_RESULT([$cpp_p])
 
-    if test "x$cpp_p" = "xno"; then
+    if test "$cpp_p" = "no"; then
       AC_MSG_WARN([failed to figure out cpp -P alternative])
-      # without -P
+      dnl without -P
       CPPPFLAG=""
     else
-      # with -P
+      dnl with -P
       CPPPFLAG="-P"
     fi
     dnl restore CPPFLAGS
     CPPFLAGS=$OLDCPPFLAGS
   else
-    # without -P
+    dnl without -P
     CPPPFLAG=""
   fi
 ])
@@ -1844,38 +1544,24 @@ TEST EINVAL TEST
 dnl CURL_DARWIN_CFLAGS
 dnl
 dnl Set -Werror=partial-availability to detect possible breaking code
-dnl with very low deployment targets.
+dnl with low deployment targets.
 dnl
 
 AC_DEFUN([CURL_DARWIN_CFLAGS], [
-
-  tst_cflags="no"
-  case $host_os in
-    darwin*)
-      tst_cflags="yes"
-      ;;
-  esac
-
-  AC_MSG_CHECKING([for good-to-use Darwin CFLAGS])
-  AC_MSG_RESULT([$tst_cflags]);
-
-  if test "$tst_cflags" = "yes"; then
-    old_CFLAGS=$CFLAGS
-    CFLAGS="$CFLAGS -Werror=partial-availability"
-    AC_MSG_CHECKING([whether $CC accepts -Werror=partial-availability])
-    AC_COMPILE_IFELSE([AC_LANG_PROGRAM()],
-      [AC_MSG_RESULT([yes])],
-      [AC_MSG_RESULT([no])
-      CFLAGS=$old_CFLAGS])
-  fi
-
+  old_CFLAGS=$CFLAGS
+  CFLAGS="$CFLAGS -Werror=partial-availability"
+  AC_MSG_CHECKING([whether $CC accepts -Werror=partial-availability])
+  AC_COMPILE_IFELSE([AC_LANG_PROGRAM()],
+    [AC_MSG_RESULT([yes])],
+    [AC_MSG_RESULT([no])
+    CFLAGS=$old_CFLAGS])
 ])
 
 
 dnl CURL_SUPPORTS_BUILTIN_AVAILABLE
 dnl
 dnl Check to see if the compiler supports __builtin_available. This built-in
-dnl compiler function first appeared in Apple LLVM 9.0.0. It's so new that, at
+dnl compiler function first appeared in Apple LLVM 9.0.0. It is so new that, at
 dnl the time this macro was written, the function was not yet documented. Its
 dnl purpose is to return true if the code is running under a certain OS version
 dnl or later.
@@ -1884,14 +1570,13 @@ AC_DEFUN([CURL_SUPPORTS_BUILTIN_AVAILABLE], [
   AC_MSG_CHECKING([to see if the compiler supports __builtin_available()])
   AC_COMPILE_IFELSE([
     AC_LANG_PROGRAM([[
-#include <stdlib.h>
     ]],[[
-      if (__builtin_available(macOS 10.8, iOS 5.0, *)) {}
+      if(__builtin_available(macOS 10.12, iOS 5.0, *)) {}
     ]])
   ],[
     AC_MSG_RESULT([yes])
     AC_DEFINE_UNQUOTED(HAVE_BUILTIN_AVAILABLE, 1,
-        [Define to 1 if you have the __builtin_available function.])
+      [Define to 1 if you have the __builtin_available function.])
   ],[
     AC_MSG_RESULT([no])
   ])
diff --git a/third-party/curl/appveyor.sh b/third-party/curl/appveyor.sh
new file mode 100644
index 0000000000..8852caec9b
--- /dev/null
+++ b/third-party/curl/appveyor.sh
@@ -0,0 +1,132 @@
+#!/usr/bin/env bash
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+# shellcheck disable=SC3040,SC2039
+set -eux; [ -n "${BASH:-}${ZSH_NAME:-}" ] && set -o pipefail
+
+# build
+
+if [ -n "${CMAKE_GENERATOR:-}" ]; then
+
+  PRJ_CFG='Debug'
+  [[ "${APPVEYOR_JOB_NAME}" = *'Release'* ]] && PRJ_CFG='Release'
+
+  # Configure OpenSSL
+  case "${CMAKE_GENERATE:-}" in
+    *Win32*) openssl_suffix='-Win32';;
+    *)       openssl_suffix='-Win64';;
+  esac
+
+  if [ "${APPVEYOR_BUILD_WORKER_IMAGE}" = 'Visual Studio 2026' ]; then
+    openssl_root_win="C:/OpenSSL-v36${openssl_suffix}"
+  elif [ "${APPVEYOR_BUILD_WORKER_IMAGE}" = 'Visual Studio 2022' ]; then
+    openssl_root_win="C:/OpenSSL-v35${openssl_suffix}"
+  elif [ "${APPVEYOR_BUILD_WORKER_IMAGE}" = 'Visual Studio 2019' ]; then
+    openssl_root_win="C:/OpenSSL-v30${openssl_suffix}"
+  fi
+  [ -n "${openssl_root_win:-}" ] && openssl_root="$(cygpath "${openssl_root_win}")"
+
+  # Install custom cmake version
+  if [ -n "${CMAKE_VERSION:-}" ]; then
+    cmake_ver="$(printf '%02d%02d' \
+      "$(echo "${CMAKE_VERSION}" | cut -f1 -d.)" \
+      "$(echo "${CMAKE_VERSION}" | cut -f2 -d.)")"
+    if [ "${cmake_ver}" -ge '0320' ]; then
+      fn="cmake-${CMAKE_VERSION}-windows-x86_64"
+    else
+      fn="cmake-${CMAKE_VERSION}-win64-x64"
+    fi
+    curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+      --location --proto-redir =https "https://github.com/Kitware/CMake/releases/download/v${CMAKE_VERSION}/${fn}.zip" --output pkg.bin
+    sha256sum pkg.bin && sha256sum pkg.bin | grep -qwF -- "${CMAKE_SHA256}" && 7z x -y pkg.bin >/dev/null && rm -f pkg.bin
+    PATH="$PWD/${fn}/bin:$PATH"
+  fi
+
+  # Set env CHKPREFILL to the value '_chkprefill' to compare feature detection
+  # results with and without the pre-fill feature. They have to match.
+  for _chkprefill in '' ${CHKPREFILL:-}; do
+    options=''
+    [ "${_chkprefill}" = '_chkprefill' ] && options+=' -D_CURL_PREFILL=OFF'
+    [[ "${CMAKE_GENERATE:-}" = *'-A ARM64'* ]] && SKIP_RUN='ARM64 architecture'
+    [[ "${CMAKE_GENERATE:-}" = *'-DCURL_USE_OPENSSL=ON'* ]] && options+=" -DOPENSSL_ROOT_DIR=${openssl_root_win}"
+    # shellcheck disable=SC2086
+    time cmake -B "_bld${_chkprefill}" \
+      -DENABLE_DEBUG=ON \
+      -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON \
+      -DCMAKE_VS_GLOBALS=TrackFileAccess=false \
+      -DCURL_STATIC_CRT=ON \
+      -DCURL_DROP_UNUSED=ON \
+      -DCURL_USE_SCHANNEL=ON -DCURL_USE_LIBPSL=OFF \
+      ${CMAKE_GENERATE:-} \
+      ${options} \
+      || { cat _bld/CMakeFiles/CMake* 2>/dev/null; false; }
+  done
+  if [ -d _bld_chkprefill ] && ! diff -u _bld/lib/curl_config.h _bld_chkprefill/lib/curl_config.h; then
+    cat _bld_chkprefill/CMakeFiles/CMake* 2>/dev/null || true
+    false
+  fi
+  echo 'curl_config.h'; grep -F '#define' _bld/lib/curl_config.h | sort || true
+  time cmake --build _bld --config "${PRJ_CFG}" --parallel 2
+  [[ "${CMAKE_GENERATE:-}" != *'-DBUILD_SHARED_LIBS=OFF'* ]] && PATH="$PWD/_bld/lib/${PRJ_CFG}:$PATH"
+  [[ "${CMAKE_GENERATE:-}" = *'-DCURL_USE_OPENSSL=ON'* ]] && { PATH="${openssl_root}:$PATH"; cp "${openssl_root}"/*.dll "_bld/src/${PRJ_CFG}"; }
+  curl="_bld/src/${PRJ_CFG}/curl.exe"
+else
+  (
+    cd projects/Windows
+    ./generate.bat "${VC_VERSION}"
+    msbuild.exe -maxcpucount "-property:Configuration=${PRJ_CFG}" "-property:Platform=${PLAT}" "${VC_VERSION}/curl-all.sln"
+  )
+  [ "${PLAT}" = 'x64' ] && platdir='Win64' || platdir='Win32'
+  [[ "${PRJ_CFG}" = *'Debug'* ]] && binsuffix='d' || binsuffix=''
+  curl="build/${platdir}/${VC_VERSION}/${PRJ_CFG}/curl${binsuffix}.exe"
+fi
+
+find . \( -name '*.exe' -o -name '*.dll' -o -name '*.lib' -o -name '*.pdb' \) -print0 | grep -z curl | xargs -0 file --
+find . \( -name '*.exe' -o -name '*.dll' -o -name '*.lib' -o -name '*.pdb' \) -print0 | grep -z curl | xargs -0 stat -c '%10s bytes: %n' --
+
+if [ -z "${SKIP_RUN:-}" ]; then
+  "${curl}" --disable --version
+else
+  echo "Skip running curl.exe. Reason: ${SKIP_RUN}"
+fi
+
+# build tests
+
+if [ -n "${CMAKE_GENERATOR:-}" ] && [[ "${APPVEYOR_JOB_NAME}" = *'Build-tests'* ]]; then
+  time cmake --build _bld --config "${PRJ_CFG}" --parallel 2 --target testdeps
+fi
+
+# build examples
+
+if [ -n "${CMAKE_GENERATOR:-}" ] && [[ "${APPVEYOR_JOB_NAME}" = *'examples'* ]]; then
+  time cmake --build _bld --config "${PRJ_CFG}" --parallel 2 --target curl-examples-build
+fi
+
+# disk space used
+
+du -sh .; echo; du -sh -t 250KB ./*
+if [ -n "${CMAKE_GENERATOR:-}" ]; then
+  echo; du -h -t 250KB _bld
+fi
diff --git a/third-party/curl/appveyor.yml b/third-party/curl/appveyor.yml
index fda46e68e9..9335da3892 100644
--- a/third-party/curl/appveyor.yml
+++ b/third-party/curl/appveyor.yml
@@ -21,371 +21,138 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+
 # https://ci.appveyor.com/project/curlorg/curl/history
-# Appveyor configuration
-# https://www.appveyor.com/docs/appveyor-yml/
+# AppVeyor configuration:
+#   https://www.appveyor.com/docs/appveyor-yml/
+# AppVeyor worker images:
+#   https://www.appveyor.com/docs/windows-images-software/
 
 version: 7.50.0.{build}
 
 environment:
-    UNITY: "OFF"
-    matrix:
-      # generated CMake-based Visual Studio Release builds
-      - job_name: "CMake, VS2008, Release x86, Schannel"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2015"
-        BUILD_SYSTEM: CMake
-        PRJ_GEN: "Visual Studio 9 2008"
-        PRJ_CFG: Release
-        OPENSSL: OFF
-        SCHANNEL: ON
-        ENABLE_UNICODE: OFF
-        HTTP_ONLY: OFF
-        TESTING: OFF
-        SHARED: ON
-        DISABLED_TESTS: ""
-      - job_name: "CMake, VS2022, Release x64, OpenSSL, WebSockets, Unity"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2022"
-        BUILD_SYSTEM: CMake
-        PRJ_GEN: "Visual Studio 17 2022"
-        TARGET: "-A x64"
-        PRJ_CFG: Release
-        OPENSSL: ON
-        SCHANNEL: OFF
-        ENABLE_UNICODE: OFF
-        HTTP_ONLY: OFF
-        TESTING: OFF
-        SHARED: ON
-        DISABLED_TESTS: ""
-        WEBSOCKETS: ON
-        UNITY: "ON"
-      - job_name: "CMake, VS2022, Release arm64, Schannel, Static"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2022"
-        BUILD_SYSTEM: CMake
-        PRJ_GEN: "Visual Studio 17 2022"
-        TARGET: "-A ARM64"
-        PRJ_CFG: Release
-        OPENSSL: OFF
-        SCHANNEL: ON
-        ENABLE_UNICODE: OFF
-        HTTP_ONLY: OFF
-        TESTING: OFF
-        SHARED: OFF
-        DISABLED_TESTS: ""
-      # generated CMake-based Visual Studio Debug builds
-      - job_name: "CMake, VS2010, Debug x64, no SSL, Static"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2015"
-        BUILD_SYSTEM: CMake
-        PRJ_GEN: "Visual Studio 10 2010 Win64"
-        PRJ_CFG: Debug
-        OPENSSL: OFF
-        SCHANNEL: OFF
-        ENABLE_UNICODE: OFF
-        HTTP_ONLY: OFF
-        TESTING: ON
-        SHARED: OFF
-        DISABLED_TESTS: "!1139 !1501 ~1056"
-        ADD_PATH: "C:\\msys64\\usr\\bin"
-      - job_name: "CMake, VS2022, Debug x64, Schannel, Static, Unicode"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2022"
-        BUILD_SYSTEM: CMake
-        PRJ_GEN: "Visual Studio 17 2022"
-        TARGET: "-A x64"
-        PRJ_CFG: Debug
-        OPENSSL: OFF
-        SCHANNEL: ON
-        ENABLE_UNICODE: ON
-        HTTP_ONLY: OFF
-        TESTING: ON
-        SHARED: OFF
-        DISABLED_TESTS: "~571 !1139 !1501 ~1056"
-        ADD_PATH: "C:\\msys64\\usr\\bin"
-      - job_name: "CMake, VS2022, Debug x64, no SSL, Static"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2022"
-        BUILD_SYSTEM: CMake
-        PRJ_GEN: "Visual Studio 17 2022"
-        TARGET: "-A x64"
-        PRJ_CFG: Debug
-        OPENSSL: OFF
-        SCHANNEL: OFF
-        ENABLE_UNICODE: OFF
-        HTTP_ONLY: OFF
-        TESTING: ON
-        SHARED: OFF
-        DISABLED_TESTS: "~571 !1139 !1501 ~1056"
-        ADD_PATH: "C:\\msys64\\usr\\bin"
-      - job_name: "CMake, VS2022, Debug x64, no SSL, Static, HTTP only"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2022"
-        BUILD_SYSTEM: CMake
-        PRJ_GEN: "Visual Studio 17 2022"
-        TARGET: "-A x64"
-        PRJ_CFG: Debug
-        OPENSSL: OFF
-        SCHANNEL: OFF
-        ENABLE_UNICODE: OFF
-        HTTP_ONLY: ON
-        TESTING: ON
-        SHARED: OFF
-        DISABLED_TESTS: "!1139 !1501 ~1056"
-        ADD_PATH: "C:\\msys64\\usr\\bin"
-      # generated CMake-based MSYS Makefiles builds (mingw cross-compiling)
-      - job_name: "CMake, mingw-w64, gcc 8, Debug x64, Schannel, Static, Unicode"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2015"
-        BUILD_SYSTEM: CMake
-        PRJ_GEN: "MSYS Makefiles"
-        PRJ_CFG: Debug
-        OPENSSL: OFF
-        SCHANNEL: ON
-        ENABLE_UNICODE: ON
-        HTTP_ONLY: OFF
-        TESTING: ON
-        SHARED: OFF
-        DISABLED_TESTS: "!1139 !1501 ~1056"
-        ADD_PATH: "C:\\mingw-w64\\x86_64-8.1.0-posix-seh-rt_v6-rev0\\mingw64\\bin;C:\\msys64\\usr\\bin"
-        MSYS2_ARG_CONV_EXCL: "/*"
-        BUILD_OPT: -k
-      - job_name: "CMake, mingw-w64, gcc 7, Debug x64, Schannel, Static, Unicode"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2017"
-        BUILD_SYSTEM: CMake
-        PRJ_GEN: "MSYS Makefiles"
-        PRJ_CFG: Debug
-        OPENSSL: OFF
-        SCHANNEL: ON
-        ENABLE_UNICODE: ON
-        HTTP_ONLY: OFF
-        TESTING: ON
-        SHARED: OFF
-        DISABLED_TESTS: "!1139 !1501 ~1056"
-        ADD_PATH: "C:\\mingw-w64\\x86_64-7.2.0-posix-seh-rt_v5-rev1\\mingw64\\bin;C:\\msys64\\usr\\bin"
-        MSYS2_ARG_CONV_EXCL: "/*"
-        BUILD_OPT: -k
-      - job_name: "CMake, mingw-w64, Debug x64, Schannel, Static, Unity"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2017"
-        BUILD_SYSTEM: CMake
-        PRJ_GEN: "MSYS Makefiles"
-        PRJ_CFG: Debug
-        OPENSSL: OFF
-        SCHANNEL: ON
-        ENABLE_UNICODE: OFF
-        HTTP_ONLY: OFF
-        TESTING: OFF
-        SHARED: OFF
-        ADD_PATH: "C:\\mingw-w64\\x86_64-8.1.0-posix-seh-rt_v6-rev0\\mingw64\\bin;C:\\msys64\\usr\\bin"
-        MSYS2_ARG_CONV_EXCL: "/*"
-        BUILD_OPT: -k
-        UNITY: "ON"
-      - job_name: "CMake, mingw-w64, Debug x86, Schannel, Static"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2015"
-        BUILD_SYSTEM: CMake
-        PRJ_GEN: "MSYS Makefiles"
-        PRJ_CFG: Debug
-        OPENSSL: OFF
-        SCHANNEL: ON
-        ENABLE_UNICODE: OFF
-        HTTP_ONLY: OFF
-        TESTING: ON
-        SHARED: OFF
-        DISABLED_TESTS: "!1139 !1501 ~1056"
-        ADD_PATH: "C:\\mingw-w64\\i686-6.3.0-posix-dwarf-rt_v5-rev1\\mingw32\\bin;C:\\msys64\\usr\\bin"
-        MSYS2_ARG_CONV_EXCL: "/*"
-        BUILD_OPT: -k
-      - job_name: "CMake, mingw, Debug x86, no SSL, Static"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2022"
-        BUILD_SYSTEM: CMake
-        PRJ_GEN: "MSYS Makefiles"
-        PRJ_CFG: Debug
-        OPENSSL: OFF
-        SCHANNEL: OFF
-        ENABLE_UNICODE: OFF
-        HTTP_ONLY: OFF
-        TESTING: ON
-        SHARED: OFF
-        DISABLED_TESTS: "!1139 !1501 ~1056"
-        ADD_PATH: "C:\\MinGW\\bin;C:\\msys64\\usr\\bin"
-        MSYS2_ARG_CONV_EXCL: "/*"
-        BUILD_OPT: -k
-      # winbuild-based builds
-      - job_name: "winbuild, VS2015, Debug"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2015"
-        BUILD_SYSTEM: winbuild_vs2015
-        DEBUG: yes
-        PATHPART: debug
-        TESTING: OFF
-        ENABLE_UNICODE: no
-      - job_name: "winbuild, VS2015, Release"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2015"
-        BUILD_SYSTEM: winbuild_vs2015
-        DEBUG: no
-        PATHPART: release
-        TESTING: OFF
-        ENABLE_UNICODE: no
-      - job_name: "winbuild, VS2017, Debug"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2017"
-        BUILD_SYSTEM: winbuild_vs2017
-        DEBUG: yes
-        PATHPART: debug
-        TESTING: OFF
-        ENABLE_UNICODE: no
-      - job_name: "winbuild, VS2017, Release"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2017"
-        BUILD_SYSTEM: winbuild_vs2017
-        DEBUG: no
-        PATHPART: release
-        TESTING: OFF
-        ENABLE_UNICODE: no
-      - job_name: "winbuild, VS2015, Debug, Unicode"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2015"
-        BUILD_SYSTEM: winbuild_vs2015
-        DEBUG: yes
-        PATHPART: debug
-        TESTING: OFF
-        ENABLE_UNICODE: yes
-      - job_name: "winbuild, VS2015, Release, Unicode"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2015"
-        BUILD_SYSTEM: winbuild_vs2015
-        DEBUG: no
-        PATHPART: release
-        TESTING: OFF
-        ENABLE_UNICODE: yes
-      - job_name: "winbuild, VS2017, Debug, Unicode"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2017"
-        BUILD_SYSTEM: winbuild_vs2017
-        DEBUG: yes
-        PATHPART: debug
-        TESTING: OFF
-        ENABLE_UNICODE: yes
-      - job_name: "winbuild, VS2017, Release, Unicode"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2017"
-        BUILD_SYSTEM: winbuild_vs2017
-        DEBUG: no
-        PATHPART: release
-        TESTING: OFF
-        ENABLE_UNICODE: yes
-      # generated VisualStudioSolution-based builds
-      - job_name: "VisualStudioSolution, VS2017, Debug"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2017"
-        BUILD_SYSTEM: VisualStudioSolution
-        PRJ_CFG: "DLL Debug - DLL Windows SSPI - DLL WinIDN"
-        TESTING: OFF
-        VC_VERSION: VC14.10
-      # autotools-based builds (NOT mingw cross-compiling, but msys2 native)
-      - job_name: "autotools, msys2, Debug, no Proxy, no SSL"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2017"
-        BUILD_SYSTEM: autotools
-        TESTING: ON
-        DISABLED_TESTS: "!19 ~1056 !1233"
-        ADD_PATH: "C:\\msys64\\usr\\bin"
-        CONFIG_ARGS: "--enable-debug --enable-werror --disable-threaded-resolver --disable-proxy --without-ssl --enable-websockets"
-      - job_name: "autotools, msys2, Debug, no SSL"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2017"
-        BUILD_SYSTEM: autotools
-        TESTING: ON
-        DISABLED_TESTS: "!19 !504 !704 !705 ~1056 !1233"
-        ADD_PATH: "C:\\msys64\\usr\\bin"
-        CONFIG_ARGS: "--enable-debug --enable-werror --disable-threaded-resolver --without-ssl --enable-websockets"
-      - job_name: "autotools, msys2, Release, no SSL"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2017"
-        BUILD_SYSTEM: autotools
-        TESTING: ON
-        DISABLED_TESTS: "!19 !504 !704 !705 ~1056 !1233"
-        ADD_PATH: "C:\\msys64\\usr\\bin"
-        CONFIG_ARGS: "--enable-warnings --enable-werror --without-ssl --enable-websockets"
-      # autotools-based Cygwin build
-      - job_name: "autotools, cygwin, Debug, no SSL"
-        APPVEYOR_BUILD_WORKER_IMAGE: "Visual Studio 2022"
-        BUILD_SYSTEM: autotools
-        TESTING: ON
-        DISABLED_TESTS: "~1056"
-        ADD_PATH: "C:\\cygwin64\\bin"
-        CONFIG_ARGS: "--enable-debug --enable-werror --disable-threaded-resolver --without-ssl --enable-websockets"
-        POSIX_PATH_PREFIX: "/cygdrive"
+  DO_NOT_TRACK: '1'
+
+  matrix:
+    # CMake Visual Studio builds
+
+    - job_name: 'CM VS2022, Release, x64, OpenSSL 3.5, Shared, Build-tests'
+      APPVEYOR_BUILD_WORKER_IMAGE: 'Visual Studio 2022'
+      CMAKE_GENERATOR: 'Visual Studio 17 2022'
+      CMAKE_GENERATE: '-A x64 -DCURL_USE_SCHANNEL=OFF -DCURL_USE_OPENSSL=ON'
+
+    - job_name: 'CM VS2026, Release, arm64, Schannel, Static, !DEBUGBUILD, Build-tests'
+      APPVEYOR_BUILD_WORKER_IMAGE: 'Visual Studio 2026'
+      CMAKE_VERSION: 4.2.1
+      CMAKE_SHA256: dfc2b2afac257555e3b9ce375b12b2883964283a366c17fec96cf4d17e4f1677
+      CMAKE_GENERATOR: 'Visual Studio 18 2026'
+      CMAKE_GENERATE: '-A ARM64 -DENABLE_DEBUG=OFF -DBUILD_SHARED_LIBS=OFF'
+
+    - job_name: 'CM VS2010, Debug, x64, Schannel, Shared, Build-tests & examples'
+      APPVEYOR_BUILD_WORKER_IMAGE: 'Visual Studio 2015'
+      CMAKE_VERSION: 3.18.4
+      CMAKE_SHA256: a932bc0c8ee79f1003204466c525b38a840424d4ae29f9e5fb88959116f2407d
+      CMAKE_GENERATOR: 'Visual Studio 10 2010'
+      CMAKE_GENERATE: '-A x64'
+
+    - job_name: 'CM VS2012, Release, x86, Schannel, Shared, Build-tests'
+      APPVEYOR_BUILD_WORKER_IMAGE: 'Visual Studio 2015'
+      CMAKE_VERSION: 3.21.7
+      CMAKE_SHA256: 4c4840e2dc2bf82e8a16081ff506bba54f3a228b91ce36317129fed4035ef2e3
+      CMAKE_GENERATOR: 'Visual Studio 11 2012'
+      CMAKE_GENERATE: '-A Win32'
+
+    - job_name: 'CM VS2013, Debug, x64, Schannel, Shared'
+      APPVEYOR_BUILD_WORKER_IMAGE: 'Visual Studio 2015'
+      CMAKE_VERSION: 3.18.4
+      CMAKE_SHA256: a932bc0c8ee79f1003204466c525b38a840424d4ae29f9e5fb88959116f2407d
+      CMAKE_GENERATOR: 'Visual Studio 12 2013'
+      CMAKE_GENERATE: '-A x64'
+
+    - job_name: 'CM VS2015, Debug, x64, Schannel, Static'
+      APPVEYOR_BUILD_WORKER_IMAGE: 'Visual Studio 2015'
+      CMAKE_VERSION: 3.19.8
+      CMAKE_SHA256: 2a30877a3d6b50da305b289f4d1c03befdfaeb2edba02a563c681e883d810380
+      CMAKE_GENERATOR: 'Visual Studio 14 2015'
+      CMAKE_GENERATE: '-A x64 -DBUILD_SHARED_LIBS=OFF'
+
+    - job_name: 'CM VS2017, Debug, x64, Schannel, Shared'
+      APPVEYOR_BUILD_WORKER_IMAGE: 'Visual Studio 2017'
+      CMAKE_VERSION: 3.20.6
+      CMAKE_SHA256: f240a38c964712aac474644b3ba21bdc2b4e8d5e31179f67bd2e6f45fa349419
+      CMAKE_GENERATOR: 'Visual Studio 15 2017'
+      CMAKE_GENERATE: '-A x64'
+
+    - job_name: 'CM VS2019, Debug, x64, OpenSSL 3.0 + Schannel, Shared, !verbose, Build-tests'
+      APPVEYOR_BUILD_WORKER_IMAGE: 'Visual Studio 2019'
+      CMAKE_GENERATOR: 'Visual Studio 16 2019'
+      CMAKE_GENERATE: '-A x64 -DCURL_USE_OPENSSL=ON -DCURL_DISABLE_VERBOSE_STRINGS=ON'
+
+    - job_name: 'CM VS2026, Debug, x64, OpenSSL 3.5 + Schannel, Static, Unicode, Build-tests & examples, clang-cl'
+      APPVEYOR_BUILD_WORKER_IMAGE: 'Visual Studio 2026'
+      CMAKE_VERSION: 4.2.1
+      CMAKE_SHA256: dfc2b2afac257555e3b9ce375b12b2883964283a366c17fec96cf4d17e4f1677
+      CMAKE_GENERATOR: 'Visual Studio 18 2026'
+      CMAKE_GENERATE: '-A x64 -T ClangCl -DBUILD_SHARED_LIBS=OFF -DCURL_USE_OPENSSL=ON -DENABLE_UNICODE=ON'
+
+    - job_name: 'CM VS2022, Release, x64, Schannel, Shared, Unicode, !DEBUGBUILD, Build-tests'
+      APPVEYOR_BUILD_WORKER_IMAGE: 'Visual Studio 2022'
+      CMAKE_GENERATOR: 'Visual Studio 17 2022'
+      ENABLE_UNICODE: 'ON'
+      CMAKE_GENERATE: '-A x64 -DENABLE_UNICODE=ON -DENABLE_DEBUG=OFF'
+
+    - job_name: 'CM VS2026, Debug, x64, !ssl, Static, Build-tests'
+      APPVEYOR_BUILD_WORKER_IMAGE: 'Visual Studio 2026'
+      CMAKE_VERSION: 4.2.1
+      CMAKE_SHA256: dfc2b2afac257555e3b9ce375b12b2883964283a366c17fec96cf4d17e4f1677
+      CMAKE_GENERATOR: 'Visual Studio 18 2026'
+      CMAKE_GENERATE: '-A x64 -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=OFF'
+
+    - job_name: 'CM VS2022, Debug, x64, !ssl, Static, HTTP-only, Build-tests'
+      APPVEYOR_BUILD_WORKER_IMAGE: 'Visual Studio 2022'
+      CMAKE_GENERATOR: 'Visual Studio 17 2022'
+      CMAKE_GENERATE: '-A x64 -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=OFF -DHTTP_ONLY=ON'
+
+    # VisualStudioSolution builds
+
+    - job_name: 'VisualStudioSolution VS2010, Release, x86, Schannel'
+      APPVEYOR_BUILD_WORKER_IMAGE: 'Visual Studio 2015'
+      PRJ_CFG: 'DLL Release - DLL Windows SSPI - DLL WinIDN'
+      PLAT: 'Win32'
+      VC_VERSION: VC10
+
+    - job_name: 'VisualStudioSolution VS2013, Debug, x64, Schannel'
+      APPVEYOR_BUILD_WORKER_IMAGE: 'Visual Studio 2015'
+      PRJ_CFG: 'DLL Debug - DLL Windows SSPI - DLL WinIDN'
+      PLAT: 'x64'
+      VC_VERSION: VC12
 
 install:
-    - if not "%ADD_PATH%"=="" (
-        set "PATH=%ADD_PATH%;%PATH%" )
+  - ps: $env:PATH = "C:/msys64/usr/bin;$env:PATH"
 
 build_script:
-    - if %BUILD_SYSTEM%==CMake (
-        cmake .
-        -G"%PRJ_GEN%"
-        %TARGET%
-        -DCURL_USE_OPENSSL=%OPENSSL%
-        -DCURL_USE_SCHANNEL=%SCHANNEL%
-        -DHTTP_ONLY=%HTTP_ONLY%
-        -DBUILD_SHARED_LIBS=%SHARED%
-        -DBUILD_TESTING=%TESTING%
-        -DENABLE_WEBSOCKETS=%WEBSOCKETS%
-        -DCMAKE_UNITY_BUILD=%UNITY%
-        -DCURL_WERROR=ON
-        -DENABLE_DEBUG=ON
-        -DENABLE_UNICODE=%ENABLE_UNICODE%
-        -DCMAKE_RUNTIME_OUTPUT_DIRECTORY_RELEASE=""
-        -DCMAKE_RUNTIME_OUTPUT_DIRECTORY_DEBUG=""
-        -DCMAKE_INSTALL_PREFIX="C:/CURL"
-        -DCMAKE_BUILD_TYPE=%PRJ_CFG% &&
-        cmake --build . --config %PRJ_CFG% --parallel 2 --clean-first -- %BUILD_OPT%
-      ) else (
-      if %BUILD_SYSTEM%==VisualStudioSolution (
-        cd projects &&
-        .\\generate.bat %VC_VERSION% &&
-        msbuild.exe /p:Configuration="%PRJ_CFG%" "Windows\\%VC_VERSION%\\curl-all.sln"
-      ) else (
-      if %BUILD_SYSTEM%==winbuild_vs2015 (
-        call buildconf.bat &&
-        cd winbuild &&
-        call "C:\Program Files\Microsoft SDKs\Windows\v7.1\Bin\SetEnv.cmd" /x64 &&
-        call "C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\vcvarsall.bat" x86_amd64 &&
-        nmake /f Makefile.vc mode=dll VC=14 "SSL_PATH=C:\OpenSSL-v111-Win64" WITH_SSL=dll MACHINE=x64 DEBUG=%DEBUG% ENABLE_UNICODE=%ENABLE_UNICODE% &&
-        ..\builds\libcurl-vc14-x64-%PATHPART%-dll-ssl-dll-ipv6-sspi\bin\curl.exe -V
-      ) else (
-      if %BUILD_SYSTEM%==winbuild_vs2017 (
-        call buildconf.bat &&
-        cd winbuild &&
-        call "C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\VC\Auxiliary\Build\vcvars64.bat" &&
-        nmake /f Makefile.vc mode=dll VC=14.10 "SSL_PATH=C:\OpenSSL-v111-Win64" WITH_SSL=dll MACHINE=x64 DEBUG=%DEBUG% ENABLE_UNICODE=%ENABLE_UNICODE% &&
-        ..\builds\libcurl-vc14.10-x64-%PATHPART%-dll-ssl-dll-ipv6-sspi\bin\curl.exe -V
-      ) else (
-      if %BUILD_SYSTEM%==autotools (
-        bash.exe -e -l -c "cd %POSIX_PATH_PREFIX%/c/projects/curl && autoreconf -fi && ./configure %CONFIG_ARGS% && make V=1 && make V=1 examples && cd tests && make V=1"
-      )))))
-    - if %TESTING%==ON (
-        if %BUILD_SYSTEM%==CMake (
-          cmake --build . --config %PRJ_CFG% --parallel 2 --target testdeps
-      ))
+  - cmd: sh -c ./appveyor.sh
 
-test_script:
-    - if exist C:/msys64/usr/bin/curl.exe (
-        set ACURL=-ac %POSIX_PATH_PREFIX%/c/msys64/usr/bin/curl.exe )
-    - if exist C:/Windows/System32/curl.exe (
-        set ACURL=-ac %POSIX_PATH_PREFIX%/c/Windows/System32/curl.exe )
-    - if %TESTING%==ON (
-        if %BUILD_SYSTEM%==CMake (
-          set TFLAGS=%ACURL% %DISABLED_TESTS% &&
-          cmake --build . --config %PRJ_CFG% --target test-ci
-        ) else (
-        if %BUILD_SYSTEM%==autotools (
-          bash.exe -e -l -c "cd %POSIX_PATH_PREFIX%/c/projects/curl && make V=1 TFLAGS='%ACURL% %DISABLED_TESTS%' test-ci"
-        ) else (
-          bash.exe -e -l -c "cd %POSIX_PATH_PREFIX%/c/projects/curl/tests && ./runtests.pl -a -p !flaky -r -rm %ACURL% %DISABLED_TESTS%"
-        ))
-      )
+clone_depth: 10
 
 # select branches to avoid testing feature branches twice (as branch and as pull request)
 branches:
-    only:
-        - master
-        - /\/ci$/
+  only:
+    - master
+    - /\/ci$/
 
 skip_commits:
   files:
-    - '.azure-pipelines.yml'
-    - '.circleci/**/*'
-    - '.cirrus.yml'
+    - '.circleci/*'
     - '.github/**/*'
-    - 'packages/**/*'
-    - 'plan9/**/*'
+    - 'Dockerfile'
+    - 'projects/OS400/*'
+    - 'projects/vms/*'
 
-artifacts:
-  - path: '**/curl.exe'
-    name: curl
-  - path: '**/*curl*.dll'
-    name: libcurl dll
+#artifacts:
+#  - path: '**/curl.exe'
+#    name: curl
+#  - path: '**/*.dll'
+#    name: libcurl dll
+#  - path: '**/*.lib'
+#    name: libcurl lib
diff --git a/third-party/curl/buildconf b/third-party/curl/buildconf
deleted file mode 100644
index ee6a2800be..0000000000
--- a/third-party/curl/buildconf
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-echo "*** Do not use buildconf. Instead, just use: autoreconf -fi" >&2
-exec ${AUTORECONF:-autoreconf} -fi "${@}"
diff --git a/third-party/curl/buildconf.bat b/third-party/curl/buildconf.bat
deleted file mode 100644
index 6153661185..0000000000
--- a/third-party/curl/buildconf.bat
+++ /dev/null
@@ -1,319 +0,0 @@
-@echo off
-rem ***************************************************************************
-rem *                                  _   _ ____  _
-rem *  Project                     ___| | | |  _ \| |
-rem *                             / __| | | | |_) | |
-rem *                            | (__| |_| |  _ <| |___
-rem *                             \___|\___/|_| \_\_____|
-rem *
-rem * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-rem *
-rem * This software is licensed as described in the file COPYING, which
-rem * you should have received as part of this distribution. The terms
-rem * are also available at https://curl.se/docs/copyright.html.
-rem *
-rem * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-rem * copies of the Software, and permit persons to whom the Software is
-rem * furnished to do so, under the terms of the COPYING file.
-rem *
-rem * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-rem * KIND, either express or implied.
-rem *
-rem * SPDX-License-Identifier: curl
-rem *
-rem ***************************************************************************
-
-rem NOTES
-rem
-rem This batch file must be used to set up a git tree to build on systems where
-rem there is no autotools support (i.e. DOS and Windows).
-rem
-
-:begin
-  rem Set our variables
-  if "%OS%" == "Windows_NT" setlocal
-  set MODE=GENERATE
-
-  rem Switch to this batch file's directory
-  cd /d "%~0\.." 1>NUL 2>&1
-
-  rem Check we are running from a curl git repository
-  if not exist GIT-INFO goto norepo
-
-  rem Detect programs. HAVE_<PROGNAME>
-  rem When not found the variable is set undefined. The undefined pattern
-  rem allows for statements like "if not defined HAVE_PERL (command)"
-  groff --version <NUL 1>NUL 2>&1
-  if errorlevel 1 (set HAVE_GROFF=) else (set HAVE_GROFF=Y)
-  nroff --version <NUL 1>NUL 2>&1
-  if errorlevel 1 (set HAVE_NROFF=) else (set HAVE_NROFF=Y)
-  perl --version <NUL 1>NUL 2>&1
-  if errorlevel 1 (set HAVE_PERL=) else (set HAVE_PERL=Y)
-  gzip --version <NUL 1>NUL 2>&1
-  if errorlevel 1 (set HAVE_GZIP=) else (set HAVE_GZIP=Y)
-
-:parseArgs
-  if "%~1" == "" goto start
-
-  if /i "%~1" == "-clean" (
-    set MODE=CLEAN
-  ) else if /i "%~1" == "-?" (
-    goto syntax
-  ) else if /i "%~1" == "-h" (
-    goto syntax
-  ) else if /i "%~1" == "-help" (
-    goto syntax
-  ) else (
-    goto unknown
-  )
-
-  shift & goto parseArgs
-
-:start
-  if "%MODE%" == "GENERATE" (
-    echo.
-    echo Generating prerequisite files
-
-    call :generate
-    if errorlevel 3 goto nogenhugehelp
-    if errorlevel 2 goto nogenmakefile
-    if errorlevel 1 goto warning
-
-  ) else (
-    echo.
-    echo Removing prerequisite files
-
-    call :clean
-    if errorlevel 2 goto nocleanhugehelp
-    if errorlevel 1 goto nocleanmakefile
-  )
-
-  goto success
-
-rem Main generate function.
-rem
-rem Returns:
-rem
-rem 0 - success
-rem 1 - success with simplified tool_hugehelp.c
-rem 2 - failed to generate Makefile
-rem 3 - failed to generate tool_hugehelp.c
-rem
-:generate
-  if "%OS%" == "Windows_NT" setlocal
-  set BASIC_HUGEHELP=0
-
-  rem Create Makefile
-  echo * %CD%\Makefile
-  if exist Makefile.dist (
-    copy /Y Makefile.dist Makefile 1>NUL 2>&1
-    if errorlevel 1 (
-      if "%OS%" == "Windows_NT" endlocal
-      exit /B 2
-    )
-  )
-
-  rem Create tool_hugehelp.c
-  echo * %CD%\src\tool_hugehelp.c
-  call :genHugeHelp
-  if errorlevel 2 (
-    if "%OS%" == "Windows_NT" endlocal
-    exit /B 3
-  )
-  if errorlevel 1 (
-    set BASIC_HUGEHELP=1
-  )
-  cmd /c exit 0
-
-  rem Setup c-ares git tree
-  if exist ares\buildconf.bat (
-    echo.
-    echo Configuring c-ares build environment
-    cd ares
-    call buildconf.bat
-    cd ..
-  )
-
-  if "%BASIC_HUGEHELP%" == "1" (
-    if "%OS%" == "Windows_NT" endlocal
-    exit /B 1
-  )
-
-  if "%OS%" == "Windows_NT" endlocal
-  exit /B 0
-
-rem Main clean function.
-rem
-rem Returns:
-rem
-rem 0 - success
-rem 1 - failed to clean Makefile
-rem 2 - failed to clean tool_hugehelp.c
-rem
-:clean
-  rem Remove Makefile
-  echo * %CD%\Makefile
-  if exist Makefile (
-    del Makefile 2>NUL
-    if exist Makefile (
-      exit /B 1
-    )
-  )
-
-  rem Remove tool_hugehelp.c
-  echo * %CD%\src\tool_hugehelp.c
-  if exist src\tool_hugehelp.c (
-    del src\tool_hugehelp.c 2>NUL
-    if exist src\tool_hugehelp.c (
-      exit /B 2
-    )
-  )
-
-  exit /B
-
-rem Function to generate src\tool_hugehelp.c
-rem
-rem Returns:
-rem
-rem 0 - full tool_hugehelp.c generated
-rem 1 - simplified tool_hugehelp.c
-rem 2 - failure
-rem
-:genHugeHelp
-  if "%OS%" == "Windows_NT" setlocal
-  set LC_ALL=C
-  set ROFFCMD=
-  set BASIC=1
-
-  if defined HAVE_PERL (
-    if defined HAVE_GROFF (
-      set ROFFCMD=groff -mtty-char -Tascii -P-c -man
-    ) else if defined HAVE_NROFF (
-      set ROFFCMD=nroff -c -Tascii -man
-    )
-  )
-
-  if defined ROFFCMD (
-    echo #include "tool_setup.h"> src\tool_hugehelp.c
-    echo #include "tool_hugehelp.h">> src\tool_hugehelp.c
-
-    if defined HAVE_GZIP (
-      echo #ifndef HAVE_LIBZ>> src\tool_hugehelp.c
-    )
-
-    %ROFFCMD% docs\curl.1 2>NUL | perl src\mkhelp.pl docs\MANUAL >> src\tool_hugehelp.c
-    if defined HAVE_GZIP (
-      echo #else>> src\tool_hugehelp.c
-      %ROFFCMD% docs\curl.1 2>NUL | perl src\mkhelp.pl -c docs\MANUAL >> src\tool_hugehelp.c
-      echo #endif /^* HAVE_LIBZ ^*/>> src\tool_hugehelp.c
-    )
-
-    set BASIC=0
-  ) else (
-    if exist src\tool_hugehelp.c.cvs (
-      copy /Y src\tool_hugehelp.c.cvs src\tool_hugehelp.c 1>NUL 2>&1
-    ) else (
-      echo #include "tool_setup.h"> src\tool_hugehelp.c
-      echo #include "tool_hugehelp.h">> src\tool_hugehelp.c
-      echo.>> src\tool_hugehelp.c
-      echo void hugehelp(void^)>> src\tool_hugehelp.c
-      echo {>> src\tool_hugehelp.c
-      echo #ifdef USE_MANUAL>> src\tool_hugehelp.c
-      echo   fputs("Built-in manual not included\n", stdout^);>> src\tool_hugehelp.c
-      echo #endif>> src\tool_hugehelp.c
-      echo }>> src\tool_hugehelp.c
-    )
-  )
-
-  findstr "/C:void hugehelp(void)" src\tool_hugehelp.c 1>NUL 2>&1
-  if errorlevel 1 (
-    if "%OS%" == "Windows_NT" endlocal
-    exit /B 2
-  )
-
-  if "%BASIC%" == "1" (
-    if "%OS%" == "Windows_NT" endlocal
-    exit /B 1
-  )
-
-  if "%OS%" == "Windows_NT" endlocal
-  exit /B 0
-
-rem Function to clean-up local variables under DOS, Windows 3.x and
-rem Windows 9x as setlocal isn't available until Windows NT
-rem
-:dosCleanup
-  set MODE=
-  set HAVE_GROFF=
-  set HAVE_NROFF=
-  set HAVE_PERL=
-  set HAVE_GZIP=
-  set BASIC_HUGEHELP=
-  set LC_ALL
-  set ROFFCMD=
-  set BASIC=
-
-  exit /B
-
-:syntax
-  rem Display the help
-  echo.
-  echo Usage: buildconf [-clean]
-  echo.
-  echo -clean    - Removes the files
-  goto error
-
-:unknown
-  echo.
-  echo Error: Unknown argument '%1'
-  goto error
-
-:norepo
-  echo.
-  echo Error: This batch file should only be used with a curl git repository
-  goto error
-
-:nogenmakefile
-  echo.
-  echo Error: Unable to generate Makefile
-  goto error
-
-:nogenhugehelp
-  echo.
-  echo Error: Unable to generate src\tool_hugehelp.c
-  goto error
-
-:nocleanmakefile
-  echo.
-  echo Error: Unable to clean Makefile
-  goto error
-
-:nocleanhugehelp
-  echo.
-  echo Error: Unable to clean src\tool_hugehelp.c
-  goto error
-
-:warning
-  echo.
-  echo Warning: The curl manual could not be integrated in the source. This means when
-  echo you build curl the manual will not be available (curl --man^). Integration of
-  echo the manual is not required and a summary of the options will still be available
-  echo (curl --help^). To integrate the manual your PATH is required to have
-  echo groff/nroff, perl and optionally gzip for compression.
-  goto success
-
-:error
-  if "%OS%" == "Windows_NT" (
-    endlocal
-  ) else (
-    call :dosCleanup
-  )
-  exit /B 1
-
-:success
-  if "%OS%" == "Windows_NT" (
-    endlocal
-  ) else (
-    call :dosCleanup
-  )
-  exit /B 0
diff --git a/third-party/curl/configure.ac b/third-party/curl/configure.ac
index 15fbda12ad..a21847ea66 100644
--- a/third-party/curl/configure.ac
+++ b/third-party/curl/configure.ac
@@ -25,11 +25,10 @@ dnl Process this file with autoconf to produce a configure script.
 
 AC_PREREQ(2.59)
 
-dnl We don't know the version number "statically" so we use a dash here
+dnl We do not know the version number "statically" so we use a dash here
 AC_INIT([curl], [-], [a suitable curl mailing list: https://curl.se/mail/])
 
 XC_OVR_ZZ50
-XC_OVR_ZZ60
 CURL_OVERRIDE_AUTOCONF
 
 dnl configure script copyright
@@ -39,25 +38,52 @@ terms of the curl license; see COPYING for more details])
 
 AC_CONFIG_SRCDIR([lib/urldata.h])
 AC_CONFIG_HEADERS(lib/curl_config.h)
+AH_TOP([/* !checksrc! disable COPYRIGHT all */])
 AC_CONFIG_MACRO_DIR([m4])
 AM_MAINTAINER_MODE
 m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
 
 CURL_CHECK_OPTION_DEBUG
+AM_CONDITIONAL(DEBUGBUILD, test "$want_debug" = "yes")
 CURL_CHECK_OPTION_OPTIMIZE
 CURL_CHECK_OPTION_WARNINGS
 CURL_CHECK_OPTION_WERROR
-CURL_CHECK_OPTION_CURLDEBUG
 CURL_CHECK_OPTION_SYMBOL_HIDING
 CURL_CHECK_OPTION_ARES
 CURL_CHECK_OPTION_RT
+CURL_CHECK_OPTION_HTTPSRR
 CURL_CHECK_OPTION_ECH
+CURL_CHECK_OPTION_SSLS_EXPORT
+AC_MSG_CHECKING([whether to enable HTTP/3 proxy support])
+OPT_PROXY_HTTP3="default"
+AC_ARG_ENABLE(proxy-http3,
+AS_HELP_STRING([--enable-proxy-http3],[Enable HTTP/3 proxy support (experimental)])
+AS_HELP_STRING([--disable-proxy-http3],[Disable HTTP/3 proxy support (experimental)]),
+  OPT_PROXY_HTTP3=$enableval)
+case "$OPT_PROXY_HTTP3" in
+  no)
+    want_proxy_http3="no"
+    curl_proxy_http3_msg="no      (--enable-proxy-http3)"
+    AC_MSG_RESULT([no])
+    ;;
+  default)
+    want_proxy_http3="no"
+    curl_proxy_http3_msg="no      (--enable-proxy-http3)"
+    AC_MSG_RESULT([no])
+    ;;
+  *)
+    want_proxy_http3="yes"
+    curl_proxy_http3_msg="enabled (--disable-proxy-http3)"
+    AC_MSG_RESULT([yes])
+    ;;
+esac
+USE_PROXY_HTTP3=0
 
 XC_CHECK_PATH_SEPARATOR
 
-#
-# save the configure arguments
-#
+dnl
+dnl save the configure arguments
+dnl
 CONFIGURE_OPTIONS="\"$ac_configure_args\""
 AC_SUBST(CONFIGURE_OPTIONS)
 
@@ -118,14 +144,16 @@ AC_SUBST([AR])
 
 AC_SUBST(libext)
 
+if test -z "$CLANG_TIDY"; then
+  CLANG_TIDY=clang-tidy
+fi
+AC_SUBST(CLANG_TIDY)
+
 dnl figure out the libcurl version
 CURLVERSION=`$SED -ne 's/^#define LIBCURL_VERSION "\(.*\)".*/\1/p' ${srcdir}/include/curl/curlver.h`
 XC_CHECK_PROG_CC
 CURL_ATOMIC
 
-dnl for --enable-code-coverage
-CURL_COVERAGE
-
 XC_AUTOMAKE
 AC_MSG_CHECKING([curl version])
 AC_MSG_RESULT($CURLVERSION)
@@ -137,45 +165,38 @@ dnl we extract the numerical version for curl-config only
 VERSIONNUM=`$SED -ne 's/^#define LIBCURL_VERSION_NUM 0x\([0-9A-Fa-f]*\).*/\1/p' ${srcdir}/include/curl/curlver.h`
 AC_SUBST(VERSIONNUM)
 
-dnl Solaris pkgadd support definitions
-PKGADD_PKG="HAXXcurl"
-PKGADD_NAME="curl - a client that groks URLs"
-PKGADD_VENDOR="curl.se"
-AC_SUBST(PKGADD_PKG)
-AC_SUBST(PKGADD_NAME)
-AC_SUBST(PKGADD_VENDOR)
-
 dnl
 dnl initialize all the info variables
-    curl_ssl_msg="no      (--with-{openssl,gnutls,mbedtls,wolfssl,schannel,secure-transport,amissl,bearssl,rustls} )"
-    curl_ssh_msg="no      (--with-{libssh,libssh2})"
-   curl_zlib_msg="no      (--with-zlib)"
- curl_brotli_msg="no      (--with-brotli)"
-   curl_zstd_msg="no      (--with-zstd)"
-    curl_gss_msg="no      (--with-gssapi)"
-  curl_gsasl_msg="no      (--with-gsasl)"
-curl_tls_srp_msg="no      (--enable-tls-srp)"
-    curl_res_msg="default (--enable-ares / --enable-threaded-resolver)"
-   curl_ipv6_msg="no      (--enable-ipv6)"
-curl_unix_sockets_msg="no      (--enable-unix-sockets)"
-    curl_idn_msg="no      (--with-{libidn2,winidn})"
- curl_manual_msg="no      (--enable-manual)"
-curl_libcurl_msg="enabled (--disable-libcurl-option)"
-curl_verbose_msg="enabled (--disable-verbose)"
-   curl_sspi_msg="no      (--enable-sspi)"
-   curl_ldap_msg="no      (--enable-ldap / --with-ldap-lib / --with-lber-lib)"
-  curl_ldaps_msg="no      (--enable-ldaps)"
-   curl_rtsp_msg="no      (--enable-rtsp)"
-   curl_rtmp_msg="no      (--with-librtmp)"
-    curl_psl_msg="no      (--with-libpsl)"
- curl_altsvc_msg="enabled (--disable-alt-svc)"
-curl_headers_msg="enabled (--disable-headers-api)"
-   curl_hsts_msg="enabled (--disable-hsts)"
-     curl_ws_msg="no      (--enable-websockets)"
-    ssl_backends=
-     curl_h1_msg="enabled (internal)"
-     curl_h2_msg="no      (--with-nghttp2, --with-hyper)"
-     curl_h3_msg="no      (--with-ngtcp2 --with-nghttp3, --with-quiche, --with-msh3)"
+         curl_ssl_msg="no       (--with-{openssl,gnutls,mbedtls,wolfssl,schannel,amissl,rustls} )"
+         curl_ssh_msg="no       (--with-{libssh,libssh2})"
+        curl_zlib_msg="no       (--with-zlib)"
+      curl_brotli_msg="no       (--with-brotli)"
+        curl_zstd_msg="no       (--with-zstd)"
+         curl_gss_msg="no       (--with-gssapi)"
+       curl_gsasl_msg="no       (--with-gsasl)"
+     curl_tls_srp_msg="no       (--enable-tls-srp)"
+         curl_res_msg="blocking (--enable-ares / --enable-threaded-resolver)"
+        curl_ipv6_msg="no       (--enable-ipv6)"
+curl_unix_sockets_msg="no       (--enable-unix-sockets)"
+         curl_idn_msg="no       (--with-{libidn2,winidn})"
+        curl_docs_msg="enabled  (--disable-docs)"
+      curl_manual_msg="no       (--enable-manual)"
+     curl_libcurl_msg="enabled  (--disable-libcurl-option)"
+   curl_typecheck_msg="enabled  (--disable-typecheck)"
+     curl_verbose_msg="enabled  (--disable-verbose)"
+        curl_sspi_msg="no       (--enable-sspi)"
+        curl_ldap_msg="no       (--enable-ldap / --with-ldap-lib / --with-lber-lib)"
+       curl_ldaps_msg="no       (--enable-ldaps)"
+        curl_ipfs_msg="no       (--enable-ipfs)"
+        curl_rtsp_msg="no       (--enable-rtsp)"
+         curl_psl_msg="no       (--with-libpsl)"
+      curl_altsvc_msg="enabled  (--disable-alt-svc)"
+     curl_headers_msg="enabled  (--disable-headers-api)"
+        curl_hsts_msg="enabled  (--disable-hsts)"
+         ssl_backends=
+          curl_h1_msg="enabled  (internal)"
+          curl_h2_msg="no       (--with-nghttp2)"
+          curl_h3_msg="no       (--with-ngtcp2 --with-nghttp3, --with-quiche)"
 
 enable_altsvc="yes"
 hsts="yes"
@@ -206,24 +227,17 @@ exec $CC "$@"
 EOF
 
 dnl **********************************************************************
-dnl See which TLS backend(s) that are requested. Just do all the
+dnl See which TLS backend(s) that are requested. Do all the
 dnl TLS AC_ARG_WITH() invokes here and do the checks later
 dnl **********************************************************************
 OPT_SCHANNEL=no
-AC_ARG_WITH(schannel,dnl
+AC_ARG_WITH(schannel,
 AS_HELP_STRING([--with-schannel],[enable Windows native SSL/TLS]),
   OPT_SCHANNEL=$withval
-  TLSCHOICE="schannel")
-
-OPT_SECURETRANSPORT=no
-AC_ARG_WITH(secure-transport,dnl
-AS_HELP_STRING([--with-secure-transport],[enable Apple OS native SSL/TLS]),[
-  OPT_SECURETRANSPORT=$withval
-  TLSCHOICE="${TLSCHOICE:+$TLSCHOICE, }Secure-Transport"
-])
+  TLSCHOICE="Schannel")
 
 OPT_AMISSL=no
-AC_ARG_WITH(amissl,dnl
+AC_ARG_WITH(amissl,
 AS_HELP_STRING([--with-amissl],[enable Amiga native SSL/TLS (AmiSSL)]),[
   OPT_AMISSL=$withval
   TLSCHOICE="${TLSCHOICE:+$TLSCHOICE, }AmiSSL"
@@ -232,134 +246,170 @@ AS_HELP_STRING([--with-amissl],[enable Amiga native SSL/TLS (AmiSSL)]),[
 OPT_OPENSSL=no
 dnl Default to no CA bundle
 ca="no"
-AC_ARG_WITH(ssl,dnl
+AC_ARG_WITH(ssl,
 AS_HELP_STRING([--with-ssl=PATH],[old version of --with-openssl])
 AS_HELP_STRING([--without-ssl], [build without any TLS library]),[
   OPT_SSL=$withval
   OPT_OPENSSL=$withval
-  if test X"$withval" != Xno; then
+  if test "x$withval" != "xno"; then
     TLSCHOICE="${TLSCHOICE:+$TLSCHOICE, }OpenSSL"
   else
     SSL_DISABLED="D"
   fi
 ])
 
-AC_ARG_WITH(openssl,dnl
-AS_HELP_STRING([--with-openssl=PATH],[Where to look for OpenSSL, PATH points to the SSL installation (default: /usr/local/ssl); when possible, set the PKG_CONFIG_PATH environment variable instead of using this option]),[
+AC_ARG_WITH(openssl,
+AS_HELP_STRING([--with-openssl=PATH],[Where to look for OpenSSL, PATH points
+  to the SSL installation (default: /usr/local/ssl); when possible, set
+  the PKG_CONFIG_PATH environment variable instead of using this option]),
+[
   OPT_OPENSSL=$withval
-  if test X"$withval" != Xno; then
+  if test "x$withval" != "xno"; then
     TLSCHOICE="${TLSCHOICE:+$TLSCHOICE, }OpenSSL"
   fi
 ])
 
 OPT_GNUTLS=no
-AC_ARG_WITH(gnutls,dnl
+AC_ARG_WITH(gnutls,
 AS_HELP_STRING([--with-gnutls=PATH],[where to look for GnuTLS, PATH points to the installation root]),[
   OPT_GNUTLS=$withval
-  if test X"$withval" != Xno; then
+  if test "x$withval" != "xno"; then
     TLSCHOICE="${TLSCHOICE:+$TLSCHOICE, }GnuTLS"
   fi
 ])
 
 OPT_MBEDTLS=no
-AC_ARG_WITH(mbedtls,dnl
+AC_ARG_WITH(mbedtls,
 AS_HELP_STRING([--with-mbedtls=PATH],[where to look for mbedTLS, PATH points to the installation root]),[
   OPT_MBEDTLS=$withval
-  if test X"$withval" != Xno; then
+  if test "x$withval" != "xno"; then
     TLSCHOICE="${TLSCHOICE:+$TLSCHOICE, }mbedTLS"
   fi
 ])
 
 OPT_WOLFSSL=no
-AC_ARG_WITH(wolfssl,dnl
-AS_HELP_STRING([--with-wolfssl=PATH],[where to look for WolfSSL, PATH points to the installation root (default: system lib default)]),[
+AC_ARG_WITH(wolfssl,
+AS_HELP_STRING([--with-wolfssl=PATH],[where to look for wolfSSL, PATH points to the installation root (default: system lib default)]),[
   OPT_WOLFSSL=$withval
-  if test X"$withval" != Xno; then
+  if test "x$withval" != "xno"; then
     TLSCHOICE="${TLSCHOICE:+$TLSCHOICE, }wolfSSL"
   fi
 ])
 
-OPT_BEARSSL=no
-AC_ARG_WITH(bearssl,dnl
-AS_HELP_STRING([--with-bearssl=PATH],[where to look for BearSSL, PATH points to the installation root]),[
-  OPT_BEARSSL=$withval
-  if test X"$withval" != Xno; then
-    TLSCHOICE="${TLSCHOICE:+$TLSCHOICE, }BearSSL"
+OPT_RUSTLS=no
+AC_ARG_WITH(rustls,
+AS_HELP_STRING([--with-rustls=PATH],[where to look for Rustls, PATH points to the installation root]),[
+  OPT_RUSTLS=$withval
+  if test "x$withval" != "xno"; then
+    TLSCHOICE="${TLSCHOICE:+$TLSCHOICE, }Rustls"
+    experimental="$experimental Rustls"
   fi
 ])
 
-OPT_RUSTLS=no
-AC_ARG_WITH(rustls,dnl
-AS_HELP_STRING([--with-rustls=PATH],[where to look for rustls, PATH points to the installation root]),[
-  OPT_RUSTLS=$withval
-  if test X"$withval" != Xno; then
-    TLSCHOICE="${TLSCHOICE:+$TLSCHOICE, }rustls"
-    experimental="$experimental rustls"
-  fi
+OPT_APPLE_SECTRUST=no
+AC_ARG_WITH(apple-sectrust,
+AS_HELP_STRING([--with-apple-sectrust],[enable Apple OS native certificate verification]),[
+  OPT_APPLE_SECTRUST=$withval
 ])
 
+AC_PATH_PROG(PERL, perl,, $PATH:/usr/local/bin/perl:/usr/bin/:/usr/local/bin)
+AC_SUBST(PERL)
+AM_CONDITIONAL(PERL, test -n "$PERL")
+
 TEST_NGHTTPX=nghttpx
-AC_ARG_WITH(test-nghttpx,dnl
+AC_ARG_WITH(test-nghttpx,
 AS_HELP_STRING([--with-test-nghttpx=PATH],[where to find nghttpx for testing]),
   TEST_NGHTTPX=$withval
-  if test X"$OPT_TEST_NGHTTPX" = "Xno" ; then
-      TEST_NGHTTPX=""
+  if test "x$TEST_NGHTTPX" = "xno"; then
+    TEST_NGHTTPX=""
   fi
 )
 AC_SUBST(TEST_NGHTTPX)
 
-CADDY=caddy
-AC_ARG_WITH(test-caddy,dnl
+if test -x /usr/bin/caddy; then
+  CADDY=/usr/bin/caddy
+elif test -x /usr/local/bin/caddy; then
+  CADDY=/usr/local/bin/caddy
+elif test -x "`brew --prefix 2>/dev/null`/bin/caddy"; then
+  CADDY=`brew --prefix`/bin/caddy
+fi
+AC_ARG_WITH(test-caddy,
 AS_HELP_STRING([--with-test-caddy=PATH],[where to find caddy for testing]),
   CADDY=$withval
-  if test X"$OPT_CADDY" = "Xno" ; then
-      CADDY=""
+  if test "x$CADDY" = "xno"; then
+    CADDY=""
   fi
 )
 AC_SUBST(CADDY)
 
-dnl we'd like a httpd+apachectl as test server
+if test -x /usr/local/bin/h2o; then
+  H2O=/usr/local/bin/h2o
+elif test -x /usr/bin/h2o; then
+  H2O=/usr/bin/h2o
+elif test -x "`brew --prefix 2>/dev/null`/bin/h2o"; then
+  H2O=`brew --prefix`/bin/h2o
+fi
+AC_ARG_WITH(test-h2o,dnl
+AS_HELP_STRING([--with-test-h2o=PATH],[where to find h2o for testing]),
+  H2O=$withval
+  if test "x$H2O" = "xno"; then
+    H2O=""
+  fi
+)
+AC_SUBST(H2O)
+
+if test -x /usr/sbin/vsftpd; then
+  VSFTPD=/usr/sbin/vsftpd
+elif test -x /usr/local/sbin/vsftpd; then
+  VSFTPD=/usr/local/sbin/vsftpd
+elif test -x "`brew --prefix 2>/dev/null`/sbin/vsftpd"; then
+  VSFTPD=`brew --prefix`/sbin/vsftpd
+fi
+AC_ARG_WITH(test-vsftpd,
+AS_HELP_STRING([--with-test-vsftpd=PATH],[where to find vsftpd for testing]),
+  VSFTPD=$withval
+  if test "x$VSFTPD" = "xno"; then
+    VSFTPD=""
+  fi
+)
+AC_SUBST(VSFTPD)
+
+dnl we would like an httpd as test server
 dnl
 HTTPD_ENABLED="maybe"
 AC_ARG_WITH(test-httpd, [AS_HELP_STRING([--with-test-httpd=PATH],
-                         [where to find httpd/apache2 for testing])],
+                        [where to find httpd/apache2 for testing])],
   [request_httpd=$withval], [request_httpd=check])
-if test x"$request_httpd" = "xcheck" -o x"$request_httpd" = "xyes"; then
-  if test -x "/usr/sbin/apache2" -a -x "/usr/sbin/apache2ctl"; then
-    # common location on distros (debian/ubuntu)
+if test "x$request_httpd" = "xcheck" || test "x$request_httpd" = "xyes"; then
+  if test -x "/usr/sbin/apache2"; then
+    dnl common location on distros (debian/ubuntu)
     HTTPD="/usr/sbin/apache2"
-    APACHECTL="/usr/sbin/apache2ctl"
     AC_PATH_PROG([APXS], [apxs])
-    if test "x$APXS" = "x"; then
+    if test -z "$APXS"; then
       AC_MSG_NOTICE([apache2-dev not installed, httpd tests disabled])
       HTTPD_ENABLED="no"
     fi
   else
     AC_PATH_PROG([HTTPD], [httpd])
-    if test "x$HTTPD" = "x"; then
+    if test -z "$HTTPD"; then
       AC_PATH_PROG([HTTPD], [apache2])
     fi
-    AC_PATH_PROG([APACHECTL], [apachectl])
     AC_PATH_PROG([APXS], [apxs])
-    if test "x$HTTPD" = "x" -o "x$APACHECTL" = "x"; then
+    if test -z "$HTTPD"; then
       AC_MSG_NOTICE([httpd/apache2 not in PATH, http tests disabled])
       HTTPD_ENABLED="no"
     fi
-    if test "x$APXS" = "x"; then
+    if test -z "$APXS"; then
       AC_MSG_NOTICE([apxs not in PATH, http tests disabled])
       HTTPD_ENABLED="no"
     fi
   fi
-elif test x"$request_httpd" != "xno"; then
+elif test "x$request_httpd" != "xno"; then
   HTTPD="${request_httpd}/bin/httpd"
-  APACHECTL="${request_httpd}/bin/apachectl"
   APXS="${request_httpd}/bin/apxs"
   if test ! -x "${HTTPD}"; then
     AC_MSG_NOTICE([httpd not found as ${HTTPD}, http tests disabled])
     HTTPD_ENABLED="no"
-  elif test ! -x "${APACHECTL}"; then
-    AC_MSG_NOTICE([apachectl not found as ${APACHECTL}, http tests disabled])
-    HTTPD_ENABLED="no"
   elif test ! -x "${APXS}"; then
     AC_MSG_NOTICE([apxs not found as ${APXS}, http tests disabled])
     HTTPD_ENABLED="no"
@@ -367,17 +417,90 @@ elif test x"$request_httpd" != "xno"; then
     AC_MSG_NOTICE([using HTTPD=$HTTPD for tests])
   fi
 fi
-if test x"$HTTPD_ENABLED" = "xno"; then
+if test "$HTTPD_ENABLED" = "no"; then
   HTTPD=""
-  APACHECTL=""
   APXS=""
 fi
 AC_SUBST(HTTPD)
-AC_SUBST(APACHECTL)
 AC_SUBST(APXS)
 
+dnl we would like a dante as test socks server
+dnl
+DANTED_ENABLED="maybe"
+AC_ARG_WITH(test-danted, [AS_HELP_STRING([--with-test-danted=PATH],
+                         [where to find danted socks daemon for testing])],
+  [request_danted=$withval], [request_danted=check])
+if test "x$request_danted" = "xcheck" || test "x$request_danted" = "xyes"; then
+  if test -x "/usr/sbin/danted"; then
+    dnl common location on distros (debian/ubuntu)
+    DANTED="/usr/sbin/danted"
+  else
+    AC_PATH_PROG([DANTED], [danted])
+    if test -z "$DANTED"; then
+      AC_PATH_PROG([DANTED], [danted])
+    fi
+  fi
+elif test "x$request_danted" != "xno"; then
+  DANTED="${request_danted}"
+  if test ! -x "${DANTED}"; then
+    AC_MSG_NOTICE([danted not found as ${DANTED}, danted tests disabled])
+    DANTED_ENABLED="no"
+  else
+    AC_MSG_NOTICE([using DANTED=$DANTED for tests])
+  fi
+fi
+if test "$DANTED_ENABLED" = "no"; then
+  DANTED=""
+fi
+AC_SUBST(DANTED)
+
+dnl we would like a sshd as test server
+dnl
+SSHD_ENABLED="maybe"
+AC_ARG_WITH(test-sshd, [AS_HELP_STRING([--with-test-sshd=PATH],
+                       [where to find sshd for testing])],
+  [request_sshd=$withval], [request_sshd=check])
+if test "x$request_sshd" = "xcheck" || test "x$request_sshd" = "xyes"; then
+  if test -x "/usr/sbin/sshd"; then
+    dnl common location on distros (debian/ubuntu)
+    SSHD="/usr/sbin/sshd"
+  else
+    AC_PATH_PROG([SSHD], [sshd])
+    if test -z "$SSHD"; then
+      AC_PATH_PROG([SSHD], [sshd])
+    fi
+  fi
+elif test "x$request_sshd" != "xno"; then
+  SSHD="${request_sshd}"
+  if test ! -x "${SSHD}"; then
+    AC_MSG_NOTICE([sshd not found as ${SSHD}, sshd tests disabled])
+    SSHD_ENABLED="no"
+  else
+    AC_MSG_NOTICE([using SSHD=$SSHD for tests])
+  fi
+fi
+if test "$SSHD_ENABLED" = "no"; then
+  SSHD=""
+  SFTPD=""
+else
+  if test -x "/usr/libexec/sftp-server"; then
+    dnl common location on macOS)
+    SFTPD="/usr/libexec/sftp-server"
+  elif test -x "/usr/lib/openssh/sftp-server"; then
+    dnl common location on debian
+    SFTPD="/usr/lib/openssh/sftp-server"
+  else
+    AC_PATH_PROG([SFTPD], [sftp-server])
+    if test -z "$SFTPD"; then
+      AC_PATH_PROG([SFTPD], [sftp-server])
+    fi
+  fi
+fi
+AC_SUBST(SSHD)
+AC_SUBST(SFTPD)
+
 dnl the nghttpx we might use in httpd testing
-if test "x$TEST_NGHTTPX" != "x" -a "x$TEST_NGHTTPX" != "xnghttpx"; then
+if test -n "$TEST_NGHTTPX" && test "x$TEST_NGHTTPX" != "xnghttpx"; then
   HTTPD_NGHTTPX="$TEST_NGHTTPX"
 else
   AC_PATH_PROG([HTTPD_NGHTTPX], [nghttpx], [],
@@ -386,7 +509,7 @@ fi
 AC_SUBST(HTTPD_NGHTTPX)
 
 dnl the Caddy server we might use in testing
-if test "x$TEST_CADDY" != "x"; then
+if test -n "$TEST_CADDY"; then
   CADDY="$TEST_CADDY"
 else
   AC_PATH_PROG([CADDY], [caddy])
@@ -402,13 +525,11 @@ if test -z "$TLSCHOICE"; then
 Select from these:
 
   --with-amissl
-  --with-bearssl
   --with-gnutls
   --with-mbedtls
-  --with-openssl (also works for BoringSSL and libressl)
+  --with-openssl (also works for AWS-LC, BoringSSL and LibreSSL)
   --with-rustls
   --with-schannel
-  --with-secure-transport
   --with-wolfssl
 ])
   fi
@@ -423,9 +544,9 @@ dnl
 
 AC_CANONICAL_HOST
 dnl Get system canonical name
-AC_DEFINE_UNQUOTED(OS, "${host}", [cpu-machine-OS])
+AC_DEFINE_UNQUOTED(CURL_OS, "${host}", [cpu-machine-OS])
 
-# Silence warning: ar: 'u' modifier ignored since 'D' is the default
+dnl Silence warning: ar: 'u' modifier ignored since 'D' is the default
 AC_SUBST(AR_FLAGS, [cr])
 
 dnl This defines _ALL_SOURCE for AIX
@@ -442,74 +563,91 @@ XC_LIBTOOL
 
 LT_LANG([Windows Resource])
 
-#
-# Automake conditionals based on libtool related checks
-#
+AM_CONDITIONAL(NOT_CURL_CI, test -z "$CURL_CI")
+
+dnl
+dnl Automake conditionals based on libtool related checks
+dnl
 
 AM_CONDITIONAL([CURL_LT_SHLIB_USE_VERSION_INFO],
-  [test "x$xc_lt_shlib_use_version_info" = 'xyes'])
+  [test "$xc_lt_shlib_use_version_info" = "yes"])
 AM_CONDITIONAL([CURL_LT_SHLIB_USE_NO_UNDEFINED],
-  [test "x$xc_lt_shlib_use_no_undefined" = 'xyes'])
+  [test "$xc_lt_shlib_use_no_undefined" = "yes"])
 AM_CONDITIONAL([CURL_LT_SHLIB_USE_MIMPURE_TEXT],
-  [test "x$xc_lt_shlib_use_mimpure_text" = 'xyes'])
+  [test "$xc_lt_shlib_use_mimpure_text" = "yes"])
 
-#
-# Due to libtool and automake machinery limitations of not allowing
-# specifying separate CPPFLAGS or CFLAGS when compiling objects for
-# inclusion of these in shared or static libraries, we are forced to
-# build using separate configure runs for shared and static libraries
-# on systems where different CPPFLAGS or CFLAGS are mandatory in order
-# to compile objects for each kind of library. Notice that relying on
-# the '-DPIC' CFLAG that libtool provides is not valid given that the
-# user might for example choose to build static libraries with PIC.
-#
+dnl
+dnl Due to libtool and automake machinery limitations of not allowing
+dnl specifying separate CPPFLAGS or CFLAGS when compiling objects for
+dnl inclusion of these in shared or static libraries, we are forced to
+dnl build using separate configure runs for shared and static libraries
+dnl on systems where different CPPFLAGS or CFLAGS are mandatory in order
+dnl to compile objects for each kind of library. Notice that relying on
+dnl the '-DPIC' CFLAG that libtool provides is not valid given that the
+dnl user might for example choose to build static libraries with PIC.
+dnl
 
-#
-# Make our Makefile.am files use the staticlib CPPFLAG only when strictly
-# targeting a static library and not building its shared counterpart.
-#
+dnl
+dnl Make our Makefile.am files use the staticlib CPPFLAG only when strictly
+dnl targeting a static library and not building its shared counterpart.
+dnl
 
 AM_CONDITIONAL([USE_CPPFLAG_CURL_STATICLIB],
-  [test "x$xc_lt_build_static_only" = 'xyes'])
+  [test "$xc_lt_build_static_only" = "yes"])
 
-#
-# Make staticlib CPPFLAG variable and its definition visible in output
-# files unconditionally, providing an empty definition unless strictly
-# targeting a static library and not building its shared counterpart.
-#
+dnl
+dnl Make staticlib CPPFLAG variable and its definition visible in output
+dnl files unconditionally, providing an empty definition unless strictly
+dnl targeting a static library and not building its shared counterpart.
+dnl
 
-CPPFLAG_CURL_STATICLIB=
-if test "x$xc_lt_build_static_only" = 'xyes'; then
-  CPPFLAG_CURL_STATICLIB='-DCURL_STATICLIB'
+LIBCURL_PC_CFLAGS_PRIVATE='-DCURL_STATICLIB'
+AC_SUBST(LIBCURL_PC_CFLAGS_PRIVATE)
+
+LIBCURL_PC_CFLAGS=
+if test "$xc_lt_build_static_only" = "yes"; then
+  LIBCURL_PC_CFLAGS="${LIBCURL_PC_CFLAGS_PRIVATE}"
 fi
-AC_SUBST([CPPFLAG_CURL_STATICLIB])
-
-
-# Determine whether all dependent libraries must be specified when linking
-if test "X$enable_shared" = "Xyes" -a "X$link_all_deplibs" = "Xno"
-then
-    REQUIRE_LIB_DEPS=no
-else
-    REQUIRE_LIB_DEPS=yes
-fi
-AC_SUBST(REQUIRE_LIB_DEPS)
-AM_CONDITIONAL(USE_EXPLICIT_LIB_DEPS, test x$REQUIRE_LIB_DEPS = xyes)
-
-dnl check if there's a way to force code inline
-AC_C_INLINE
+AC_SUBST([LIBCURL_PC_CFLAGS])
 
 dnl **********************************************************************
 dnl platform/compiler/architecture specific checks/flags
 dnl **********************************************************************
 
 CURL_CHECK_COMPILER
+dnl for --enable-code-coverage
+CURL_COVERAGE
+CURL_CHECK_NATIVE_WINDOWS
+
+curl_cv_winuwp='no'
+if test "$curl_cv_native_windows" = "yes"; then
+  case "$CPPFLAGS" in
+    *-DWINSTORECOMPAT*) curl_cv_winuwp='yes';;
+  esac
+
+  AC_MSG_CHECKING([if building for Windows Vista or newer])
+  AC_COMPILE_IFELSE([
+    AC_LANG_PROGRAM([[
+      #include <windows.h>
+    ]],[[
+      #if (_WIN32_WINNT < 0x600)
+      #error
+      #endif
+    ]])
+  ],[
+    AC_MSG_RESULT([yes])
+  ],[
+    AC_MSG_RESULT([no])
+    AC_MSG_ERROR([Building for Windows Vista or newer is required.])
+  ])
+fi
+
 CURL_SET_COMPILER_BASIC_OPTS
 CURL_SET_COMPILER_DEBUG_OPTS
 CURL_SET_COMPILER_OPTIMIZE_OPTS
 CURL_SET_COMPILER_WARNING_OPTS
 
 if test "$compiler_id" = "INTEL_UNIX_C"; then
-  #
   if test "$compiler_num" -ge "1000"; then
     dnl icc 10.X or later
     CFLAGS="$CFLAGS -shared-intel"
@@ -517,11 +655,19 @@ if test "$compiler_id" = "INTEL_UNIX_C"; then
     dnl icc 9.X specific
     CFLAGS="$CFLAGS -i-dynamic"
   fi
-  #
 fi
 
+case $host in
+  *msdosdjgpp)
+    if test "$compiler_num" -ge "1000"; then
+      dnl Avoid warnings in DJGPP's built-in FD_SET() macro
+      CFLAGS="$CFLAGS -Wno-arith-conversion"
+    fi
+    ;;
+esac
+
 CURL_CFLAG_EXTRAS=""
-if test X"$want_werror" = Xyes; then
+if test "$want_werror" = "yes"; then
   CURL_CFLAG_EXTRAS="-Werror"
   if test "$compiler_id" = "GNU_C"; then
     dnl enable -pedantic-errors for GCC 5 and later,
@@ -529,30 +675,30 @@ if test X"$want_werror" = Xyes; then
     if test "$compiler_num" -ge "500"; then
       CURL_CFLAG_EXTRAS="$CURL_CFLAG_EXTRAS -pedantic-errors"
     fi
+  elif test "$compiler_id" = "CLANG" || test "$compiler_id" = "APPLECLANG"; then
+    CURL_CFLAG_EXTRAS="$CURL_CFLAG_EXTRAS -pedantic-errors"
   fi
 fi
 AC_SUBST(CURL_CFLAG_EXTRAS)
+AM_CONDITIONAL(CURL_WERROR, test "$want_werror" = "yes")
 
 CURL_CHECK_COMPILER_HALT_ON_ERROR
 CURL_CHECK_COMPILER_ARRAY_SIZE_NEGATIVE
 CURL_CHECK_COMPILER_PROTOTYPE_MISMATCH
 CURL_CHECK_COMPILER_SYMBOL_HIDING
 
-CURL_CHECK_CURLDEBUG
-AM_CONDITIONAL(CURLDEBUG, test x$want_curldebug = xyes)
-
 supports_unittests=yes
-# cross-compilation of unit tests static library/programs fails when
-# libcurl shared library is built. This might be due to a libtool or
-# automake issue. In this case we disable unit tests.
-if test "x$cross_compiling" != "xno" &&
-   test "x$enable_shared" != "xno"; then
+dnl cross-compilation of unit tests static library/programs fails when
+dnl libcurl shared library is built. This might be due to a libtool or
+dnl automake issue. In this case we disable unit tests.
+if test "$cross_compiling" != "no" &&
+   test "$enable_shared" != "no"; then
   supports_unittests=no
 fi
 
-# IRIX 6.5.24 gcc 3.3 autobuilds fail unittests library compilation due to
-# a problem related with OpenSSL headers and library versions not matching.
-# Disable unit tests while time to further investigate this is found.
+dnl IRIX 6.5.24 gcc 3.3 autobuilds fail unittests library compilation due to
+dnl a problem related with OpenSSL headers and library versions not matching.
+dnl Disable unit tests while time to further investigate this is found.
 case $host in
   mips-sgi-irix6.5)
     if test "$compiler_id" = "GNU_C"; then
@@ -561,114 +707,44 @@ case $host in
     ;;
 esac
 
-# All AIX autobuilds fails unit tests linking against unittests library
-# due to unittests library being built with no symbols or members. Libtool ?
-# Disable unit tests while time to further investigate this is found.
+dnl All AIX autobuilds fails unit tests linking against unittests library
+dnl due to unittests library being built with no symbols or members. Libtool ?
+dnl Disable unit tests while time to further investigate this is found.
 case $host_os in
   aix*)
     supports_unittests=no
     ;;
 esac
 
-dnl Build unit tests when option --enable-debug is given.
-if test "x$want_debug" = "xyes" &&
-   test "x$supports_unittests" = "xyes"; then
-  want_unittests=yes
-else
-  want_unittests=no
-fi
-AM_CONDITIONAL(BUILD_UNITTESTS, test x$want_unittests = xyes)
+AM_CONDITIONAL(BUILD_UNITTESTS, test "$supports_unittests" = "yes")
 
-# For original MinGW (ie not MinGW-w64) define the Windows minimum supported OS
-# version to Windows XP (0x501) if it hasn't already been defined by the user.
-# Without this override original MinGW defaults the version to Windows NT 4.0.
-# Note original MinGW sets _WIN32_WINNT if not defined to whatever WINVER is.
-case $host in
-  *-*-mingw32*)
-    AC_MSG_CHECKING([if MinGW minimum supported OS should be set to XP])
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-#include <_mingw.h>
-      ]],[[
-#if defined(__MINGW64_VERSION_MAJOR) || \
-    defined(WINVER) || \
-    defined(_WIN32_WINNT)
-#error
-#endif
-      ]])
-    ],[
-      CPPFLAGS="$CPPFLAGS -DWINVER=0x501"
-      AC_MSG_RESULT([yes])
-    ],[
-      AC_MSG_RESULT([no])
-    ])
+dnl In order to detect support of sendmmsg() and accept4(), we need to escape
+dnl the POSIX jail by defining _GNU_SOURCE or <sys/socket.h> does not expose it.
+case $host_os in
+  *linux*|cygwin*|msys*|gnu*)
+    CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE"
     ;;
 esac
 
-# Detect original MinGW (not MinGW-w64)
-curl_mingw_original=no
-case $host in
-  *-*-mingw32*)
-    AC_MSG_CHECKING([using original MinGW (not MinGW-w64)])
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-#include <_mingw.h>
-      ]],[[
-#if defined(__MINGW64_VERSION_MAJOR)
-#error
-#endif
-      ]])
-    ],[
-      curl_mingw_original=yes
-      curl_mingw_die=yes
-      AC_MSG_RESULT([yes])
-    ],[
-      AC_MSG_RESULT([no])
-    ])
-    ;;
-esac
-
-
-AC_ARG_WITH(mingw1-deprecated,dnl
-AS_HELP_STRING([--with-mingw1-deprecated],[confirm you realize support for mingw v1 is dying]),
-  if test X"$withval" != Xno; then
-    curl_mingw_die=
-  fi
-)
-
-if test -n "$curl_mingw_die"; then
-  AC_MSG_ERROR([support for mingw v1 is going away, enable temporarily with --with-mingw1-deprecated])
-fi
+AM_CONDITIONAL(CLANG, test "$compiler_id" = "APPLECLANG" || test "$compiler_id" = "CLANG")
 
 dnl **********************************************************************
 dnl Compilation based checks should not be done before this point.
 dnl **********************************************************************
 
-dnl **********************************************************************
-dnl Make sure that our checks for headers windows.h winsock2.h
-dnl and ws2tcpip.h take precedence over any other further checks which
-dnl could be done later using AC_CHECK_HEADER or AC_CHECK_HEADERS for
-dnl this specific header files. And do them before its results are used.
-dnl **********************************************************************
-
-CURL_CHECK_HEADER_WINDOWS
-CURL_CHECK_NATIVE_WINDOWS
-case X-"$curl_cv_native_windows" in
-  X-yes)
-    CURL_CHECK_HEADER_WINSOCK2
-    CURL_CHECK_HEADER_WS2TCPIP
-    ;;
-  *)
-    curl_cv_header_winsock2_h="no"
-    curl_cv_header_ws2tcpip_h="no"
-    ;;
-esac
-CURL_CHECK_WIN32_LARGEFILE
 CURL_CHECK_WIN32_CRYPTO
 
-CURL_DARWIN_CFLAGS
-CURL_DARWIN_SYSTEMCONFIGURATION
-CURL_SUPPORTS_BUILTIN_AVAILABLE
+curl_cv_android='no'
+curl_cv_apple='no'
+case $host in
+  *-*-android*) curl_cv_android='yes';;
+  *-apple-*) curl_cv_apple='yes';;
+esac
+
+if test "$curl_cv_apple" = "yes"; then
+  CURL_DARWIN_CFLAGS
+  CURL_SUPPORTS_BUILTIN_AVAILABLE
+fi
 
 AM_CONDITIONAL([HAVE_WINDRES],
   [test "$curl_cv_native_windows" = "yes" && test -n "${RC}"])
@@ -678,6 +754,32 @@ if test "$curl_cv_native_windows" = "yes"; then
     [AC_MSG_ERROR([windres not found in PATH. Windows builds require windres. Cannot continue.])])
 fi
 
+dnl ----------------------------------------
+dnl whether use "unity" mode for lib and src
+dnl ----------------------------------------
+
+want_unity='no'
+AC_MSG_CHECKING([whether to build libcurl and curl in "unity" mode])
+AC_ARG_ENABLE(unity,
+AS_HELP_STRING([--enable-unity],[Enable unity mode])
+AS_HELP_STRING([--disable-unity],[Disable unity (default)]),
+[ case "$enableval" in
+  yes)
+    want_unity='yes'
+    AC_MSG_RESULT([yes])
+    ;;
+  *)
+    AC_MSG_RESULT([no])
+    ;;
+  esac ],
+    AC_MSG_RESULT([no])
+)
+if test -z "$PERL" && test "$want_unity" = "yes"; then
+  AC_MSG_WARN([perl was not found. Cannot enable unity.])
+  want_unity='no'
+fi
+AM_CONDITIONAL([USE_UNITY], [test "$want_unity" = "yes"])
+
 dnl ************************************************************
 dnl switch off particular protocols
 dnl
@@ -687,26 +789,29 @@ AS_HELP_STRING([--enable-http],[Enable HTTP support])
 AS_HELP_STRING([--disable-http],[Disable HTTP support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_HTTP, 1, [to disable HTTP])
-       disable_http="yes"
-       AC_MSG_WARN([disable HTTP disables FTP over proxy and RTSP])
-       AC_SUBST(CURL_DISABLE_HTTP, [1])
-       AC_DEFINE(CURL_DISABLE_RTSP, 1, [to disable RTSP])
-       AC_SUBST(CURL_DISABLE_RTSP, [1])
-       dnl toggle off alt-svc too when HTTP is disabled
-       AC_DEFINE(CURL_DISABLE_ALTSVC, 1, [disable alt-svc])
-       AC_DEFINE(CURL_DISABLE_HSTS, 1, [disable HSTS])
-       curl_h1_msg="no      (--enable-http, --with-hyper)"
-       curl_altsvc_msg="no";
-       curl_hsts_msg="no      (--enable-hsts)";
-       enable_altsvc="no"
-       hsts="no"
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_HTTP, 1, [to disable HTTP])
+    disable_http="yes"
+    AC_MSG_WARN([disable HTTP disables FTP over proxy, IPFS and RTSP])
+    CURL_DISABLE_HTTP=1
+    AC_DEFINE(CURL_DISABLE_IPFS, 1, [to disable IPFS])
+    CURL_DISABLE_IPFS=1
+    AC_DEFINE(CURL_DISABLE_RTSP, 1, [to disable RTSP])
+    CURL_DISABLE_RTSP=1
+    dnl toggle off alt-svc too when HTTP is disabled
+    AC_DEFINE(CURL_DISABLE_ALTSVC, 1, [disable alt-svc])
+    AC_DEFINE(CURL_DISABLE_HSTS, 1, [disable HSTS])
+    curl_h1_msg="no      (--enable-http)"
+    curl_altsvc_msg="no";
+    curl_hsts_msg="no      (--enable-hsts)";
+    enable_altsvc="no"
+    hsts="no"
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 AC_MSG_CHECKING([whether to support ftp])
 AC_ARG_ENABLE(ftp,
@@ -714,14 +819,15 @@ AS_HELP_STRING([--enable-ftp],[Enable FTP support])
 AS_HELP_STRING([--disable-ftp],[Disable FTP support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_FTP, 1, [to disable FTP])
-       AC_SUBST(CURL_DISABLE_FTP, [1])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_FTP, 1, [to disable FTP])
+    CURL_DISABLE_FTP=1
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 AC_MSG_CHECKING([whether to support file])
 AC_ARG_ENABLE(file,
@@ -729,14 +835,41 @@ AS_HELP_STRING([--enable-file],[Enable FILE support])
 AS_HELP_STRING([--disable-file],[Disable FILE support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_FILE, 1, [to disable FILE])
-       AC_SUBST(CURL_DISABLE_FILE, [1])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_FILE, 1, [to disable FILE])
+    CURL_DISABLE_FILE=1
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
+)
+AC_MSG_CHECKING([whether to support IPFS])
+AC_ARG_ENABLE(ipfs,
+AS_HELP_STRING([--enable-ipfs],[Enable IPFS support])
+AS_HELP_STRING([--disable-ipfs],[Disable IPFS support]),
+[ case "$enableval" in
+  no)
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_IPFS, 1, [to disable IPFS])
+    CURL_DISABLE_IPFS=1
+    ;;
+  *)
+    if test "$CURL_DISABLE_HTTP" = "1"; then
+      AC_MSG_ERROR(HTTP support needs to be enabled in order to enable IPFS support!)
+    else
+      AC_MSG_RESULT(yes)
+      curl_ipfs_msg="enabled"
+    fi
+    ;;
+  esac ],
+    if test "$CURL_DISABLE_HTTP" != "1"; then
+      AC_MSG_RESULT(yes)
+      curl_ipfs_msg="enabled"
+    else
+      AC_MSG_RESULT(no)
+    fi
 )
 AC_MSG_CHECKING([whether to support ldap])
 AC_ARG_ENABLE(ldap,
@@ -744,19 +877,19 @@ AS_HELP_STRING([--enable-ldap],[Enable LDAP support])
 AS_HELP_STRING([--disable-ldap],[Disable LDAP support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_LDAP, 1, [to disable LDAP])
-       AC_SUBST(CURL_DISABLE_LDAP, [1])
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_LDAP, 1, [to disable LDAP])
+    CURL_DISABLE_LDAP=1
+    ;;
   yes)
-       ldap_askedfor="yes"
-       AC_MSG_RESULT(yes)
-       ;;
+    ldap_askedfor="yes"
+    AC_MSG_RESULT(yes)
+    ;;
   *)
-       AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],[
-       AC_MSG_RESULT(yes) ]
+    AC_MSG_RESULT(yes) ]
 )
 AC_MSG_CHECKING([whether to support ldaps])
 AC_ARG_ENABLE(ldaps,
@@ -764,157 +897,59 @@ AS_HELP_STRING([--enable-ldaps],[Enable LDAPS support])
 AS_HELP_STRING([--disable-ldaps],[Disable LDAPS support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_LDAPS, 1, [to disable LDAPS])
-       AC_SUBST(CURL_DISABLE_LDAPS, [1])
-       ;;
-  *)   if test "x$CURL_DISABLE_LDAP" = "x1" ; then
-         AC_MSG_RESULT(LDAP needs to be enabled to support LDAPS)
-         AC_DEFINE(CURL_DISABLE_LDAPS, 1, [to disable LDAPS])
-         AC_SUBST(CURL_DISABLE_LDAPS, [1])
-       else
-         AC_MSG_RESULT(yes)
-         AC_DEFINE(HAVE_LDAP_SSL, 1, [Use LDAPS implementation])
-         AC_SUBST(HAVE_LDAP_SSL, [1])
-       fi
-       ;;
-  esac ],[
-       if test "x$CURL_DISABLE_LDAP" = "x1" ; then
-         AC_MSG_RESULT(no)
-         AC_DEFINE(CURL_DISABLE_LDAPS, 1, [to disable LDAPS])
-         AC_SUBST(CURL_DISABLE_LDAPS, [1])
-       else
-         AC_MSG_RESULT(yes)
-         AC_DEFINE(HAVE_LDAP_SSL, 1, [Use LDAPS implementation])
-         AC_SUBST(HAVE_LDAP_SSL, [1])
-       fi ]
-)
-
-dnl **********************************************************************
-dnl Check for Hyper
-dnl **********************************************************************
-
-OPT_HYPER="no"
-
-AC_ARG_WITH(hyper,
-AS_HELP_STRING([--with-hyper=PATH],[Enable hyper usage])
-AS_HELP_STRING([--without-hyper],[Disable hyper usage]),
-  [OPT_HYPER=$withval])
-case "$OPT_HYPER" in
-  no)
-    dnl --without-hyper option used
-    want_hyper="no"
-    ;;
-  yes)
-    dnl --with-hyper option used without path
-    want_hyper="default"
-    want_hyper_path=""
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_LDAPS, 1, [to disable LDAPS])
+    CURL_DISABLE_LDAPS=1
     ;;
   *)
-    dnl --with-hyper option used with path
-    want_hyper="yes"
-    want_hyper_path="$withval"
+    if test "$CURL_DISABLE_LDAP" = "1"; then
+      AC_MSG_RESULT(LDAP needs to be enabled to support LDAPS)
+      AC_DEFINE(CURL_DISABLE_LDAPS, 1, [to disable LDAPS])
+      CURL_DISABLE_LDAPS=1
+    else
+      AC_MSG_RESULT(yes)
+      AC_DEFINE(HAVE_LDAP_SSL, 1, [Use LDAPS implementation])
+      HAVE_LDAP_SSL=1
+    fi
     ;;
-esac
+  esac ],[
+    if test "$CURL_DISABLE_LDAP" = "1"; then
+      AC_MSG_RESULT(no)
+      AC_DEFINE(CURL_DISABLE_LDAPS, 1, [to disable LDAPS])
+      CURL_DISABLE_LDAPS=1
+    else
+      AC_MSG_RESULT(yes)
+      AC_DEFINE(HAVE_LDAP_SSL, 1, [Use LDAPS implementation])
+      HAVE_LDAP_SSL=1
+    fi ]
+)
 
-if test X"$want_hyper" != Xno; then
-  if test "x$disable_http" = "xyes"; then
-    AC_MSG_ERROR([--with-hyper is not compatible with --disable-http])
-  fi
-
-  dnl backup the pre-hyper variables
-  CLEANLDFLAGS="$LDFLAGS"
-  CLEANCPPFLAGS="$CPPFLAGS"
-  CLEANLIBS="$LIBS"
-
-  CURL_CHECK_PKGCONFIG(hyper, $want_hyper_path)
-
-  if test "$PKGCONFIG" != "no" ; then
-    LIB_HYPER=`CURL_EXPORT_PCDIR([$want_hyper_path])
-      $PKGCONFIG --libs-only-l hyper`
-    CPP_HYPER=`CURL_EXPORT_PCDIR([$want_hyper_path]) dnl
-      $PKGCONFIG --cflags-only-I hyper`
-    LD_HYPER=`CURL_EXPORT_PCDIR([$want_hyper_path])
-      $PKGCONFIG --libs-only-L hyper`
-  else
-    dnl no hyper pkg-config found
-    LIB_HYPER="-lhyper -ldl -lpthread -lm"
-    if test X"$want_hyper" != Xdefault; then
-      CPP_HYPER=-I"$want_hyper_path/capi/include"
-      LD_HYPER="-L$want_hyper_path/target/release -L$want_hyper_path/target/debug"
-    fi
-  fi
-  if test -n "$LIB_HYPER"; then
-    AC_MSG_NOTICE([-l is $LIB_HYPER])
-    AC_MSG_NOTICE([-I is $CPP_HYPER])
-    AC_MSG_NOTICE([-L is $LD_HYPER])
-
-    LDFLAGS="$LDFLAGS $LD_HYPER"
-    CPPFLAGS="$CPPFLAGS $CPP_HYPER"
-    LIBS="$LIB_HYPER $LIBS"
-
-    if test "x$cross_compiling" != "xyes"; then
-      dnl remove -L, separate with colon if more than one
-      DIR_HYPER=`echo $LD_HYPER | $SED -e 's/^-L//' -e 's/ -L/:/g'`
-    fi
-
-    AC_CHECK_LIB(hyper, hyper_io_new,
-      [
-       AC_CHECK_HEADERS(hyper.h,
-          experimental="$experimental Hyper"
-          AC_MSG_NOTICE([Hyper support is experimental])
-          curl_h1_msg="enabled (Hyper)"
-          curl_h2_msg=$curl_h1_msg
-          HYPER_ENABLED=1
-          AC_DEFINE(USE_HYPER, 1, [if hyper is in use])
-          AC_SUBST(USE_HYPER, [1])
-          CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_HYPER"
-          export CURL_LIBRARY_PATH
-          AC_MSG_NOTICE([Added $DIR_HYPER to CURL_LIBRARY_PATH]),
-       )
-      ],
-      for d in `echo $DIR_HYPER | $SED -e 's/:/ /'`; do
-        if test -f "$d/libhyper.a"; then
-          AC_MSG_ERROR([hyper was found in $d but was probably built with wrong flags. See docs/HYPER.md.])
-        fi
-      done
-      AC_MSG_ERROR([--with-hyper but hyper was not found. See docs/HYPER.md.])
-    )
-  fi
-fi
-
-if test X"$want_hyper" != Xno; then
-  AC_MSG_NOTICE([Disable RTSP support with hyper])
-  AC_DEFINE(CURL_DISABLE_RTSP, 1, [to disable RTSP])
-  AC_SUBST(CURL_DISABLE_RTSP, [1])
-else
-  AC_MSG_CHECKING([whether to support rtsp])
-  AC_ARG_ENABLE(rtsp,
+AC_MSG_CHECKING([whether to support rtsp])
+AC_ARG_ENABLE(rtsp,
 AS_HELP_STRING([--enable-rtsp],[Enable RTSP support])
 AS_HELP_STRING([--disable-rtsp],[Disable RTSP support]),
-  [ case "$enableval" in
+[ case "$enableval" in
     no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_RTSP, 1, [to disable RTSP])
-       AC_SUBST(CURL_DISABLE_RTSP, [1])
-       ;;
-    *)
-       if test x$CURL_DISABLE_HTTP = x1 ; then
-         AC_MSG_ERROR(HTTP support needs to be enabled in order to enable RTSP support!)
-       else
-         AC_MSG_RESULT(yes)
-         curl_rtsp_msg="enabled"
-       fi
-       ;;
-    esac ],
-       if test "x$CURL_DISABLE_HTTP" != "x1"; then
-          AC_MSG_RESULT(yes)
-          curl_rtsp_msg="enabled"
-       else
-          AC_MSG_RESULT(no)
-       fi
-  )
-fi
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_RTSP, 1, [to disable RTSP])
+    CURL_DISABLE_RTSP=1
+    ;;
+  *)
+    if test "$CURL_DISABLE_HTTP" = "1"; then
+      AC_MSG_ERROR(HTTP support needs to be enabled in order to enable RTSP support!)
+    else
+      AC_MSG_RESULT(yes)
+      curl_rtsp_msg="enabled"
+    fi
+    ;;
+  esac ],
+    if test "$CURL_DISABLE_HTTP" != "1"; then
+      AC_MSG_RESULT(yes)
+      curl_rtsp_msg="enabled"
+    else
+      AC_MSG_RESULT(no)
+    fi
+)
 
 AC_MSG_CHECKING([whether to support proxies])
 AC_ARG_ENABLE(proxy,
@@ -922,15 +957,16 @@ AS_HELP_STRING([--enable-proxy],[Enable proxy support])
 AS_HELP_STRING([--disable-proxy],[Disable proxy support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_PROXY, 1, [to disable proxies])
-       AC_SUBST(CURL_DISABLE_PROXY, [1])
-       https_proxy="no"
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_PROXY, 1, [to disable proxies])
+    CURL_DISABLE_PROXY=1
+    https_proxy="no"
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 AC_MSG_CHECKING([whether to support dict])
@@ -939,44 +975,54 @@ AS_HELP_STRING([--enable-dict],[Enable DICT support])
 AS_HELP_STRING([--disable-dict],[Disable DICT support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_DICT, 1, [to disable DICT])
-       AC_SUBST(CURL_DISABLE_DICT, [1])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_DICT, 1, [to disable DICT])
+    CURL_DISABLE_DICT=1
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
+
 AC_MSG_CHECKING([whether to support telnet])
 AC_ARG_ENABLE(telnet,
 AS_HELP_STRING([--enable-telnet],[Enable TELNET support])
 AS_HELP_STRING([--disable-telnet],[Disable TELNET support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_TELNET, 1, [to disable TELNET])
-       AC_SUBST(CURL_DISABLE_TELNET, [1])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_TELNET, 1, [to disable TELNET])
+    CURL_DISABLE_TELNET=1
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
+
+if test "$curl_cv_winuwp" = "yes"; then
+  AC_DEFINE(CURL_DISABLE_TELNET, 1, [to disable TELNET])
+  CURL_DISABLE_TELNET=1
+fi
+
 AC_MSG_CHECKING([whether to support tftp])
 AC_ARG_ENABLE(tftp,
 AS_HELP_STRING([--enable-tftp],[Enable TFTP support])
 AS_HELP_STRING([--disable-tftp],[Disable TFTP support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_TFTP, 1, [to disable TFTP])
-       AC_SUBST(CURL_DISABLE_TFTP, [1])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_TFTP, 1, [to disable TFTP])
+    CURL_DISABLE_TFTP=1
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 AC_MSG_CHECKING([whether to support pop3])
@@ -985,48 +1031,49 @@ AS_HELP_STRING([--enable-pop3],[Enable POP3 support])
 AS_HELP_STRING([--disable-pop3],[Disable POP3 support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_POP3, 1, [to disable POP3])
-       AC_SUBST(CURL_DISABLE_POP3, [1])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_POP3, 1, [to disable POP3])
+    CURL_DISABLE_POP3=1
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
-
 AC_MSG_CHECKING([whether to support imap])
 AC_ARG_ENABLE(imap,
 AS_HELP_STRING([--enable-imap],[Enable IMAP support])
 AS_HELP_STRING([--disable-imap],[Disable IMAP support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_IMAP, 1, [to disable IMAP])
-       AC_SUBST(CURL_DISABLE_IMAP, [1])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_IMAP, 1, [to disable IMAP])
+    CURL_DISABLE_IMAP=1
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
-
 AC_MSG_CHECKING([whether to support smb])
 AC_ARG_ENABLE(smb,
-AS_HELP_STRING([--enable-smb],[Enable SMB/CIFS support])
-AS_HELP_STRING([--disable-smb],[Disable SMB/CIFS support]),
+AS_HELP_STRING([--enable-smb],[Enable SMB support])
+AS_HELP_STRING([--disable-smb],[Disable SMB support]),
 [ case "$enableval" in
-  no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_SMB, 1, [to disable SMB/CIFS])
-       AC_SUBST(CURL_DISABLE_SMB, [1])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+  yes)
+    AC_MSG_RESULT(yes)
+    AC_DEFINE(CURL_ENABLE_SMB, 1, [to enable SMB])
+    CURL_ENABLE_SMB=1
+    ;;
+  *)
+    AC_MSG_RESULT(no)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(no)
 )
 
 AC_MSG_CHECKING([whether to support smtp])
@@ -1035,14 +1082,15 @@ AS_HELP_STRING([--enable-smtp],[Enable SMTP support])
 AS_HELP_STRING([--disable-smtp],[Disable SMTP support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_SMTP, 1, [to disable SMTP])
-       AC_SUBST(CURL_DISABLE_SMTP, [1])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_SMTP, 1, [to disable SMTP])
+    CURL_DISABLE_SMTP=1
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 AC_MSG_CHECKING([whether to support gopher])
@@ -1051,14 +1099,15 @@ AS_HELP_STRING([--enable-gopher],[Enable Gopher support])
 AS_HELP_STRING([--disable-gopher],[Disable Gopher support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_GOPHER, 1, [to disable Gopher])
-       AC_SUBST(CURL_DISABLE_GOPHER, [1])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_GOPHER, 1, [to disable Gopher])
+    CURL_DISABLE_GOPHER=1
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 AC_MSG_CHECKING([whether to support mqtt])
@@ -1067,14 +1116,32 @@ AS_HELP_STRING([--enable-mqtt],[Enable MQTT support])
 AS_HELP_STRING([--disable-mqtt],[Disable MQTT support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_MQTT, 1, [to disable MQTT])
-       AC_SUBST(CURL_DISABLE_MQTT, [1])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_MQTT, 1, [to disable MQTT])
+    CURL_DISABLE_MQTT=1
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(no)
+    AC_MSG_RESULT(no)
+)
+
+AC_MSG_CHECKING([enable curl_global_init_mem debug build])
+AC_ARG_ENABLE(init-mem-debug,
+AS_HELP_STRING([--enable-init-mem-debug],[curl_global_init_mem debug])
+AS_HELP_STRING([--disable-init-mem-debug],[]),
+[ case "$enableval" in
+  yes)
+    AC_MSG_RESULT(yes)
+    AC_DEFINE(CURL_DEBUG_GLOBAL_MEM, 1, [curl_debug_global_mem debug build])
+    SUPPORT_FEATURES="$SUPPORT_FEATURES global-mem-debug"
+    ;;
+  *)
+    AC_MSG_RESULT(no)
+    ;;
+  esac ],
+    AC_MSG_RESULT(no)
 )
 
 dnl **********************************************************************
@@ -1087,18 +1154,48 @@ AS_HELP_STRING([--enable-manual],[Enable built-in manual])
 AS_HELP_STRING([--disable-manual],[Disable built-in manual]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       USE_MANUAL="1"
-       ;;
+    AC_MSG_RESULT(no)
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    USE_MANUAL="1"
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
-       USE_MANUAL="1"
+    AC_MSG_RESULT(yes)
+    USE_MANUAL="1"
 )
 dnl The actual use of the USE_MANUAL variable is done much later in this
 dnl script to allow other actions to disable it as well.
 
+dnl **********************************************************************
+dnl Check whether to build documentation
+dnl **********************************************************************
+
+AC_MSG_CHECKING([whether to build documentation])
+AC_ARG_ENABLE(docs,
+AS_HELP_STRING([--enable-docs],[Enable documentation])
+AS_HELP_STRING([--disable-docs],[Disable documentation]),
+[ case "$enableval" in
+  no)
+    AC_MSG_RESULT(no)
+    BUILD_DOCS=0
+    dnl disable manual too because it needs built documentation
+    USE_MANUAL=0
+    curl_docs_msg="no"
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    BUILD_DOCS=1
+    ;;
+  esac ],
+    AC_MSG_RESULT(yes)
+    BUILD_DOCS=1
+)
+if test -z "$PERL" && test "$BUILD_DOCS" != "0"; then
+  AC_MSG_WARN([perl was not found. Cannot build documentation.])
+  BUILD_DOCS=0
+fi
+
 dnl ************************************************************
 dnl disable C code generation support
 dnl
@@ -1108,14 +1205,15 @@ AS_HELP_STRING([--enable-libcurl-option],[Enable --libcurl C code generation sup
 AS_HELP_STRING([--disable-libcurl-option],[Disable --libcurl C code generation support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_LIBCURL_OPTION, 1, [to disable --libcurl C code generation option])
-       curl_libcurl_msg="no"
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_LIBCURL_OPTION, 1, [to disable --libcurl C code generation option])
+    curl_libcurl_msg="no"
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 dnl **********************************************************************
@@ -1127,51 +1225,81 @@ AC_ARG_ENABLE(libgcc,
 AS_HELP_STRING([--enable-libgcc],[use libgcc when linking]),
 [ case "$enableval" in
   yes)
-       LIBS="-lgcc $LIBS"
-       AC_MSG_RESULT(yes)
-       ;;
-  *)   AC_MSG_RESULT(no)
-       ;;
+    LIBS="-lgcc $LIBS"
+    AC_MSG_RESULT(yes)
+    ;;
+  *)
+    AC_MSG_RESULT(no)
+    ;;
   esac ],
-       AC_MSG_RESULT(no)
+    AC_MSG_RESULT(no)
+)
+
+AC_MSG_CHECKING([whether to use libbacktrace])
+AC_ARG_WITH(backtrace,
+AS_HELP_STRING([--enable-backtrace],[use libbacktrace when linking]),
+[ case "$enableval" in
+  yes)
+    LIBS="-lbacktrace $LIBS"
+    AC_DEFINE(USE_BACKTRACE, 1, [if libbacktrace is in use])
+    AC_MSG_RESULT(yes)
+    ;;
+  *)
+    AC_MSG_RESULT(no)
+    ;;
+  esac ],
+    AC_MSG_RESULT(no)
 )
 
 CURL_CHECK_LIB_XNET
 
 dnl gethostbyname without lib or in the nsl lib?
 AC_CHECK_FUNC(gethostbyname,
-              [HAVE_GETHOSTBYNAME="1"
-              ],
-              [ AC_CHECK_LIB(nsl, gethostbyname,
-                             [HAVE_GETHOSTBYNAME="1"
-                             LIBS="-lnsl $LIBS"
-                             ])
-              ])
+  [
+    HAVE_GETHOSTBYNAME="1"
+  ],
+  [
+    AC_CHECK_LIB(nsl, gethostbyname,
+      [
+        HAVE_GETHOSTBYNAME="1"
+        LIBS="-lnsl $LIBS"
+      ]
+    )
+  ]
+)
 
-if test "$HAVE_GETHOSTBYNAME" != "1"
-then
+if test "$HAVE_GETHOSTBYNAME" != "1"; then
   dnl gethostbyname in the socket lib?
   AC_CHECK_LIB(socket, gethostbyname,
-               [HAVE_GETHOSTBYNAME="1"
-               LIBS="-lsocket $LIBS"
-               ])
+    [
+      HAVE_GETHOSTBYNAME="1"
+      LIBS="-lsocket $LIBS"
+    ]
+  )
 fi
 
-if test "$HAVE_GETHOSTBYNAME" != "1"
-then
+if test "$HAVE_GETHOSTBYNAME" != "1"; then
   dnl gethostbyname in the watt lib?
+  clean_CPPFLAGS=$CPPFLAGS
+  clean_LDFLAGS=$LDFLAGS
+  CPPFLAGS="-I${WATT_ROOT}/inc"
+  LDFLAGS="-L${WATT_ROOT}/lib"
   AC_CHECK_LIB(watt, gethostbyname,
-               [HAVE_GETHOSTBYNAME="1"
-               CPPFLAGS="-I/dev/env/WATT_ROOT/inc"
-               LDFLAGS="-L/dev/env/WATT_ROOT/lib"
-               LIBS="-lwatt $LIBS"
-               ])
+    [
+      HAVE_GETHOSTBYNAME="1"
+      LIBS="-lwatt $LIBS"
+      AC_DEFINE(USE_WATT32, 1, [if Watt-32 is in use])
+    ],
+    [
+      CPPFLAGS=$clean_CPPFLAGS
+      LDFLAGS=$clean_LDFLAGS
+    ]
+  )
 fi
 
 dnl At least one system has been identified to require BOTH nsl and socket
 dnl libs at the same time to link properly.
-if test "$HAVE_GETHOSTBYNAME" != "1"
-then
+if test "$HAVE_GETHOSTBYNAME" != "1"; then
   AC_MSG_CHECKING([for gethostbyname with both nsl and socket libs])
   my_ac_save_LIBS=$LIBS
   LIBS="-lnsl -lsocket $LIBS"
@@ -1189,53 +1317,49 @@ then
   ])
 fi
 
-if test "$HAVE_GETHOSTBYNAME" != "1"
-then
-  dnl This is for winsock systems
-  if test "$curl_cv_header_windows_h" = "yes"; then
-    if test "$curl_cv_header_winsock2_h" = "yes"; then
-      winsock_LIB="-lws2_32"
-    fi
-    if test ! -z "$winsock_LIB"; then
-      my_ac_save_LIBS=$LIBS
-      LIBS="$winsock_LIB $LIBS"
-      AC_MSG_CHECKING([for gethostbyname in $winsock_LIB])
-      AC_LINK_IFELSE([
-        AC_LANG_PROGRAM([[
-#ifdef HAVE_WINDOWS_H
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#ifdef HAVE_WINSOCK2_H
-#include <winsock2.h>
-#endif
-#endif
-        ]],[[
-          gethostbyname("www.dummysite.com");
-        ]])
-      ],[
-        AC_MSG_RESULT([yes])
-        HAVE_GETHOSTBYNAME="1"
-      ],[
-        AC_MSG_RESULT([no])
-        winsock_LIB=""
-        LIBS=$my_ac_save_LIBS
-      ])
+dnl In UWP mode gethostbyname gets detected via the core libs, but some
+dnl code (in6addr_any) still need ws2_32, so let us detect and add it.
+if test "$HAVE_GETHOSTBYNAME" != "1" || test "$curl_cv_winuwp" = "yes"; then
+  if test "$curl_cv_native_windows" = "yes"; then
+    dnl This is for Winsock systems
+    winsock_LIB="-lws2_32"
+    if test "$curl_cv_winuwp" != "yes"; then
+      winsock_LIB="$winsock_LIB -liphlpapi"
     fi
+    my_ac_save_LIBS=$LIBS
+    LIBS="$winsock_LIB $LIBS"
+    AC_MSG_CHECKING([for gethostbyname in $winsock_LIB])
+    AC_LINK_IFELSE([
+      AC_LANG_PROGRAM([[
+        #ifdef _WIN32
+        #ifndef WIN32_LEAN_AND_MEAN
+        #define WIN32_LEAN_AND_MEAN
+        #endif
+        #include <winsock2.h>
+        #endif
+      ]],[[
+        gethostbyname("localhost");
+      ]])
+    ],[
+      AC_MSG_RESULT([yes])
+      HAVE_GETHOSTBYNAME="1"
+    ],[
+      AC_MSG_RESULT([no])
+      winsock_LIB=""
+      LIBS=$my_ac_save_LIBS
+    ])
   fi
 fi
 
-if test "$HAVE_GETHOSTBYNAME" != "1"
-then
+if test "$HAVE_GETHOSTBYNAME" != "1"; then
   dnl This is for Minix 3.1
   AC_MSG_CHECKING([for gethostbyname for Minix 3])
   AC_LINK_IFELSE([
     AC_LANG_PROGRAM([[
-/* Older Minix versions may need <net/gen/netdb.h> here instead */
-#include <netdb.h>
+      /* Older Minix versions may need <net/gen/netdb.h> here instead */
+      #include <netdb.h>
     ]],[[
-      gethostbyname("www.dummysite.com");
+      gethostbyname("localhost");
     ]])
   ],[
     AC_MSG_RESULT([yes])
@@ -1245,16 +1369,15 @@ then
   ])
 fi
 
-if test "$HAVE_GETHOSTBYNAME" != "1"
-then
+if test "$HAVE_GETHOSTBYNAME" != "1"; then
   dnl This is for eCos with a stubbed DNS implementation
   AC_MSG_CHECKING([for gethostbyname for eCos])
   AC_LINK_IFELSE([
     AC_LANG_PROGRAM([[
-#include <stdio.h>
-#include <netdb.h>
+      #include <stdio.h>
+      #include <netdb.h>
     ]],[[
-      gethostbyname("www.dummysite.com");
+      gethostbyname("localhost");
     ]])
   ],[
     AC_MSG_RESULT([yes])
@@ -1264,50 +1387,44 @@ then
   ])
 fi
 
-if test "$HAVE_GETHOSTBYNAME" != "1" -o "${with_amissl+set}" = set
-then
+if test "$HAVE_GETHOSTBYNAME" != "1" || test "${with_amissl+set}" = "set"; then
   dnl This is for AmigaOS with bsdsocket.library - needs testing before -lnet
   AC_MSG_CHECKING([for gethostbyname for AmigaOS bsdsocket.library])
   AC_LINK_IFELSE([
     AC_LANG_PROGRAM([[
-  #define __USE_INLINE__
-  #include <proto/bsdsocket.h>
-  #ifdef __amigaos4__
-  struct SocketIFace *ISocket = NULL;
-  #else
-  struct Library *SocketBase = NULL;
-  #endif
+      #define __USE_INLINE__
+      #include <proto/bsdsocket.h>
+      #ifdef __amigaos4__
+      struct SocketIFace *ISocket = NULL;
+      #else
+      struct Library *SocketBase = NULL;
+      #endif
     ]],[[
-      gethostbyname("www.dummysite.com");
+      unsigned char host[] = "localhost";
+      gethostbyname(host);
     ]])
   ],[
     AC_MSG_RESULT([yes])
     HAVE_GETHOSTBYNAME="1"
     HAVE_PROTO_BSDSOCKET_H="1"
     AC_DEFINE(HAVE_PROTO_BSDSOCKET_H, 1, [if Amiga bsdsocket.library is in use])
-    AC_SUBST(HAVE_PROTO_BSDSOCKET_H, [1])
   ],[
     AC_MSG_RESULT([no])
   ])
 fi
 
-if test "$HAVE_GETHOSTBYNAME" != "1"
-then
+if test "$HAVE_GETHOSTBYNAME" != "1"; then
   dnl gethostbyname in the network lib - for Haiku OS
   AC_CHECK_LIB(network, gethostbyname,
-               [HAVE_GETHOSTBYNAME="1"
-               LIBS="-lnetwork $LIBS"
-               ])
-fi
-
-if test "$HAVE_GETHOSTBYNAME" != "1"; then
-  AC_MSG_ERROR([couldn't find libraries for gethostbyname()])
+    [
+      HAVE_GETHOSTBYNAME="1"
+      LIBS="-lnetwork $LIBS"
+    ]
+  )
 fi
 
 CURL_CHECK_LIBS_CONNECT
 
-CURL_NETWORK_LIBS=$LIBS
-
 dnl **********************************************************************
 dnl In case that function clock_gettime with monotonic timer is available,
 dnl check for additional required libraries.
@@ -1338,19 +1455,19 @@ ZLIB_LIBS=""
 AC_ARG_WITH(zlib,
 AS_HELP_STRING([--with-zlib=PATH],[search for zlib in PATH])
 AS_HELP_STRING([--without-zlib],[disable use of zlib]),
-               [OPT_ZLIB="$withval"])
+  [OPT_ZLIB="$withval"])
 
-if test "$OPT_ZLIB" = "no" ; then
-    AC_MSG_WARN([zlib disabled])
+if test "x$OPT_ZLIB" = "xno"; then
+  AC_MSG_WARN([zlib disabled])
 else
-  if test "$OPT_ZLIB" = "yes" ; then
+  if test "x$OPT_ZLIB" = "xyes"; then
     OPT_ZLIB=""
   fi
 
-  if test -z "$OPT_ZLIB" ; then
+  if test -z "$OPT_ZLIB"; then
     CURL_CHECK_PKGCONFIG(zlib)
 
-    if test "$PKGCONFIG" != "no" ; then
+    if test "$PKGCONFIG" != "no"; then
       ZLIB_LIBS="`$PKGCONFIG --libs-only-l zlib`"
       if test -n "$ZLIB_LIBS"; then
         LDFLAGS="$LDFLAGS `$PKGCONFIG --libs-only-L zlib`"
@@ -1369,37 +1486,45 @@ else
       dnl people have it in the default path
 
       AC_CHECK_LIB(z, inflateEnd,
-                   dnl libz found, set the variable
-                   [HAVE_LIBZ="1"
-                    ZLIB_LIBS="-lz"
-                    LIBS="$ZLIB_LIBS $LIBS"],
-                   dnl if no lib found, try /usr/local
-                   [OPT_ZLIB="/usr/local"])
+        dnl libz found, set the variable
+        [
+          HAVE_LIBZ="1"
+          ZLIB_LIBS="-lz"
+          LIBS="$ZLIB_LIBS $LIBS"
+        ],
+        dnl if no lib found, try /usr/local
+        [
+          OPT_ZLIB="/usr/local"
+        ]
+      )
     fi
   fi
 
   dnl Add a nonempty path to the compiler flags
   if test -n "$OPT_ZLIB"; then
-     CPPFLAGS="$CPPFLAGS -I$OPT_ZLIB/include"
-     LDFLAGS="$LDFLAGS -L$OPT_ZLIB/lib$libsuff"
+    CPPFLAGS="$CPPFLAGS -I$OPT_ZLIB/include"
+    LDFLAGS="$LDFLAGS -L$OPT_ZLIB/lib$libsuff"
   fi
 
   AC_CHECK_HEADER(zlib.h,
     [
-    dnl zlib.h was found
-    HAVE_ZLIB_H="1"
-    dnl if the lib wasn't found already, try again with the new paths
-    if test "$HAVE_LIBZ" != "1"; then
-      AC_CHECK_LIB(z, gzread,
-                   [
-                   dnl the lib was found!
-                   HAVE_LIBZ="1"
-                   ZLIB_LIBS="-lz"
-                   LIBS="$ZLIB_LIBS $LIBS"
-                   ],
-                   [ CPPFLAGS=$clean_CPPFLAGS
-                   LDFLAGS=$clean_LDFLAGS])
-    fi
+      dnl zlib.h was found
+      HAVE_ZLIB_H="1"
+      dnl if the lib was not found already, try again with the new paths
+      if test "$HAVE_LIBZ" != "1"; then
+        AC_CHECK_LIB(z, gzread,
+          [
+            dnl the lib was found!
+            HAVE_LIBZ="1"
+            ZLIB_LIBS="-lz"
+            LIBS="$ZLIB_LIBS $LIBS"
+          ],
+          [
+            CPPFLAGS=$clean_CPPFLAGS
+            LDFLAGS=$clean_LDFLAGS
+          ]
+        )
+      fi
     ],
     [
       dnl zlib.h was not found, restore the flags
@@ -1407,23 +1532,20 @@ else
       LDFLAGS=$clean_LDFLAGS]
     )
 
-  if test "$HAVE_LIBZ" = "1" && test "$HAVE_ZLIB_H" != "1"
-  then
+  if test "$HAVE_LIBZ" = "1" && test "$HAVE_ZLIB_H" != "1"; then
     AC_MSG_WARN([configure found only the libz lib, not the header file!])
     HAVE_LIBZ=""
     CPPFLAGS=$clean_CPPFLAGS
     LDFLAGS=$clean_LDFLAGS
     LIBS=$clean_LIBS
     ZLIB_LIBS=""
-  elif test "$HAVE_LIBZ" != "1" && test "$HAVE_ZLIB_H" = "1"
-  then
+  elif test "$HAVE_LIBZ" != "1" && test "$HAVE_ZLIB_H" = "1"; then
     AC_MSG_WARN([configure found only the libz header file, not the lib!])
     CPPFLAGS=$clean_CPPFLAGS
     LDFLAGS=$clean_LDFLAGS
     LIBS=$clean_LIBS
     ZLIB_LIBS=""
-  elif test "$HAVE_LIBZ" = "1" && test "$HAVE_ZLIB_H" = "1"
-  then
+  elif test "$HAVE_LIBZ" = "1" && test "$HAVE_ZLIB_H" = "1"; then
     dnl both header and lib were found!
     AC_SUBST(HAVE_LIBZ)
     AC_DEFINE(HAVE_LIBZ, 1, [if zlib is available])
@@ -1432,12 +1554,16 @@ else
     dnl replace 'HAVE_LIBZ' in the automake makefile.ams
     AMFIXLIB="1"
     AC_MSG_NOTICE([found both libz and libz.h header])
+    dnl Android does not provide zlib.pc
+    if test "$curl_cv_android" = "no"; then
+      LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE zlib"
+    fi
     curl_zlib_msg="enabled"
   fi
 fi
 
 dnl set variable for use in automakefile(s)
-AM_CONDITIONAL(HAVE_LIBZ, test x"$AMFIXLIB" = x1)
+AM_CONDITIONAL(HAVE_LIBZ, test "$AMFIXLIB" = "1")
 AC_SUBST(ZLIB_LIBS)
 
 dnl **********************************************************************
@@ -1448,49 +1574,60 @@ dnl Brotli project home page: https://github.com/google/brotli
 
 dnl Default to compiler & linker defaults for BROTLI files & libraries.
 OPT_BROTLI=off
-AC_ARG_WITH(brotli,dnl
-AS_HELP_STRING([--with-brotli=PATH],[Where to look for brotli, PATH points to the BROTLI installation; when possible, set the PKG_CONFIG_PATH environment variable instead of using this option])
+AC_ARG_WITH(brotli,
+AS_HELP_STRING([--with-brotli=PATH],[Where to look for brotli, PATH points to the BROTLI installation;
+  when possible, set the PKG_CONFIG_PATH environment variable instead of using this option])
 AS_HELP_STRING([--without-brotli], [disable BROTLI]),
   OPT_BROTLI=$withval)
 
-if test X"$OPT_BROTLI" != Xno; then
+if test "x$OPT_BROTLI" != "xno"; then
   dnl backup the pre-brotli variables
   CLEANLDFLAGS="$LDFLAGS"
+  CLEANLDFLAGSPC="$LDFLAGSPC"
   CLEANCPPFLAGS="$CPPFLAGS"
   CLEANLIBS="$LIBS"
 
   case "$OPT_BROTLI" in
-  yes)
-    dnl --with-brotli (without path) used
-    CURL_CHECK_PKGCONFIG(libbrotlidec)
+    yes)
+      dnl --with-brotli (without path) used
+      CURL_CHECK_PKGCONFIG(libbrotlidec)
+
+      if test "$PKGCONFIG" != "no"; then
+        LIB_BROTLI=`$PKGCONFIG --libs-only-l libbrotlidec`
+        LD_BROTLI=`$PKGCONFIG --libs-only-L libbrotlidec`
+        CPP_BROTLI=`$PKGCONFIG --cflags-only-I libbrotlidec`
+        version=`$PKGCONFIG --modversion libbrotlidec`
+      fi
+
+      CURL_CHECK_PKGCONFIG(libbrotlicommon)
+
+      if test "$PKGCONFIG" != "no"; then
+        LIB_BROTLI="$LIB_BROTLI `$PKGCONFIG --libs-only-l libbrotlicommon`"
+        LD_BROTLI="$LD_BROTLI `$PKGCONFIG --libs-only-L libbrotlicommon`"
+        CPP_BROTLI="$CPP_BROTLI `$PKGCONFIG --cflags-only-I libbrotlicommon`"
+      fi
 
-    if test "$PKGCONFIG" != "no" ; then
-      LIB_BROTLI=`$PKGCONFIG --libs-only-l libbrotlidec`
-      LD_BROTLI=`$PKGCONFIG --libs-only-L libbrotlidec`
-      CPP_BROTLI=`$PKGCONFIG --cflags-only-I libbrotlidec`
-      version=`$PKGCONFIG --modversion libbrotlidec`
       DIR_BROTLI=`echo $LD_BROTLI | $SED -e 's/^-L//'`
-    fi
-
-    ;;
-  off)
-    dnl no --with-brotli option given, just check default places
-    ;;
-  *)
-    dnl use the given --with-brotli spot
-    PREFIX_BROTLI=$OPT_BROTLI
-    ;;
+      ;;
+    off)
+      dnl no --with-brotli option given, check default places
+      ;;
+    *)
+      dnl use the given --with-brotli spot
+      PREFIX_BROTLI=$OPT_BROTLI
+      ;;
   esac
 
   dnl if given with a prefix, we set -L and -I based on that
   if test -n "$PREFIX_BROTLI"; then
-    LIB_BROTLI="-lbrotlidec"
+    LIB_BROTLI="-lbrotlidec -lbrotlicommon"
     LD_BROTLI=-L${PREFIX_BROTLI}/lib$libsuff
     CPP_BROTLI=-I${PREFIX_BROTLI}/include
     DIR_BROTLI=${PREFIX_BROTLI}/lib$libsuff
   fi
 
   LDFLAGS="$LDFLAGS $LD_BROTLI"
+  LDFLAGSPC="$LDFLAGSPC $LD_BROTLI"
   CPPFLAGS="$CPPFLAGS $CPP_BROTLI"
   LIBS="$LIB_BROTLI $LIBS"
 
@@ -1500,29 +1637,30 @@ if test X"$OPT_BROTLI" != Xno; then
     curl_brotli_msg="enabled (libbrotlidec)"
     HAVE_BROTLI=1
     AC_DEFINE(HAVE_BROTLI, 1, [if BROTLI is in use])
-    AC_SUBST(HAVE_BROTLI, [1])
   )
 
-  if test X"$OPT_BROTLI" != Xoff &&
+  if test "x$OPT_BROTLI" != "xoff" &&
      test "$HAVE_BROTLI" != "1"; then
     AC_MSG_ERROR([BROTLI libs and/or directories were not found where specified!])
   fi
 
   if test "$HAVE_BROTLI" = "1"; then
     if test -n "$DIR_BROTLI"; then
-       dnl when the brotli shared libs were found in a path that the run-time
-       dnl linker doesn't search through, we need to add it to CURL_LIBRARY_PATH
-       dnl to prevent further configure tests to fail due to this
+      dnl when the brotli shared libs were found in a path that the runtime
+      dnl linker does not search through, we need to add it to CURL_LIBRARY_PATH
+      dnl to prevent further configure tests to fail due to this
 
-       if test "x$cross_compiling" != "xyes"; then
-         CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_BROTLI"
-         export CURL_LIBRARY_PATH
-         AC_MSG_NOTICE([Added $DIR_BROTLI to CURL_LIBRARY_PATH])
-       fi
+      if test "$cross_compiling" != "yes"; then
+        CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_BROTLI"
+        export CURL_LIBRARY_PATH
+        AC_MSG_NOTICE([Added $DIR_BROTLI to CURL_LIBRARY_PATH])
+      fi
     fi
+    LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE libbrotlidec libbrotlicommon"
   else
     dnl no brotli, revert back to clean variables
     LDFLAGS=$CLEANLDFLAGS
+    LDFLAGSPC=$CLEANLDFLAGSPC
     CPPFLAGS=$CLEANCPPFLAGS
     LIBS=$CLEANLIBS
   fi
@@ -1534,38 +1672,40 @@ dnl **********************************************************************
 
 dnl Default to compiler & linker defaults for libzstd
 OPT_ZSTD=off
-AC_ARG_WITH(zstd,dnl
-AS_HELP_STRING([--with-zstd=PATH],[Where to look for libzstd, PATH points to the libzstd installation; when possible, set the PKG_CONFIG_PATH environment variable instead of using this option])
+AC_ARG_WITH(zstd,
+AS_HELP_STRING([--with-zstd=PATH],[Where to look for libzstd, PATH points to the libzstd installation;
+  when possible, set the PKG_CONFIG_PATH environment variable instead of using this option])
 AS_HELP_STRING([--without-zstd], [disable libzstd]),
   OPT_ZSTD=$withval)
 
-if test X"$OPT_ZSTD" != Xno; then
+if test "x$OPT_ZSTD" != "xno"; then
   dnl backup the pre-zstd variables
   CLEANLDFLAGS="$LDFLAGS"
+  CLEANLDFLAGSPC="$LDFLAGSPC"
   CLEANCPPFLAGS="$CPPFLAGS"
   CLEANLIBS="$LIBS"
 
   case "$OPT_ZSTD" in
-  yes)
-    dnl --with-zstd (without path) used
-    CURL_CHECK_PKGCONFIG(libzstd)
+    yes)
+      dnl --with-zstd (without path) used
+      CURL_CHECK_PKGCONFIG(libzstd)
 
-    if test "$PKGCONFIG" != "no" ; then
-      LIB_ZSTD=`$PKGCONFIG --libs-only-l libzstd`
-      LD_ZSTD=`$PKGCONFIG --libs-only-L libzstd`
-      CPP_ZSTD=`$PKGCONFIG --cflags-only-I libzstd`
-      version=`$PKGCONFIG --modversion libzstd`
-      DIR_ZSTD=`echo $LD_ZSTD | $SED -e 's/-L//'`
-    fi
+      if test "$PKGCONFIG" != "no"; then
+        LIB_ZSTD=`$PKGCONFIG --libs-only-l libzstd`
+        LD_ZSTD=`$PKGCONFIG --libs-only-L libzstd`
+        CPP_ZSTD=`$PKGCONFIG --cflags-only-I libzstd`
+        version=`$PKGCONFIG --modversion libzstd`
+        DIR_ZSTD=`echo $LD_ZSTD | $SED -e 's/-L//'`
+      fi
 
-    ;;
-  off)
-    dnl no --with-zstd option given, just check default places
-    ;;
-  *)
-    dnl use the given --with-zstd spot
-    PREFIX_ZSTD=$OPT_ZSTD
-    ;;
+      ;;
+    off)
+      dnl no --with-zstd option given, check default places
+      ;;
+    *)
+      dnl use the given --with-zstd spot
+      PREFIX_ZSTD=$OPT_ZSTD
+      ;;
   esac
 
   dnl if given with a prefix, we set -L and -I based on that
@@ -1577,6 +1717,7 @@ if test X"$OPT_ZSTD" != Xno; then
   fi
 
   LDFLAGS="$LDFLAGS $LD_ZSTD"
+  LDFLAGSPC="$LDFLAGSPC $LD_ZSTD"
   CPPFLAGS="$CPPFLAGS $CPP_ZSTD"
   LIBS="$LIB_ZSTD $LIBS"
 
@@ -1586,129 +1727,36 @@ if test X"$OPT_ZSTD" != Xno; then
     curl_zstd_msg="enabled (libzstd)"
     HAVE_ZSTD=1
     AC_DEFINE(HAVE_ZSTD, 1, [if libzstd is in use])
-    AC_SUBST(HAVE_ZSTD, [1])
   )
 
-  if test X"$OPT_ZSTD" != Xoff &&
+  if test "x$OPT_ZSTD" != "xoff" &&
      test "$HAVE_ZSTD" != "1"; then
     AC_MSG_ERROR([libzstd was not found where specified!])
   fi
 
   if test "$HAVE_ZSTD" = "1"; then
     if test -n "$DIR_ZSTD"; then
-       dnl when the zstd shared lib were found in a path that the run-time
-       dnl linker doesn't search through, we need to add it to
-       dnl CURL_LIBRARY_PATH to prevent further configure tests to fail due to
-       dnl this
+      dnl when the zstd shared lib were found in a path that the runtime
+      dnl linker does not search through, we need to add it to
+      dnl CURL_LIBRARY_PATH to prevent further configure tests to fail due to
+      dnl this
 
-       if test "x$cross_compiling" != "xyes"; then
-         CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_ZSTD"
-         export CURL_LIBRARY_PATH
-         AC_MSG_NOTICE([Added $DIR_ZSTD to CURL_LIBRARY_PATH])
-       fi
+      if test "$cross_compiling" != "yes"; then
+        CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_ZSTD"
+        export CURL_LIBRARY_PATH
+        AC_MSG_NOTICE([Added $DIR_ZSTD to CURL_LIBRARY_PATH])
+      fi
     fi
+    LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE libzstd"
   else
     dnl no zstd, revert back to clean variables
     LDFLAGS=$CLEANLDFLAGS
+    LDFLAGSPC=$CLEANLDFLAGSPC
     CPPFLAGS=$CLEANCPPFLAGS
     LIBS=$CLEANLIBS
   fi
 fi
 
-dnl **********************************************************************
-dnl Check for LDAP
-dnl **********************************************************************
-
-LDAPLIBNAME=""
-AC_ARG_WITH(ldap-lib,
-AS_HELP_STRING([--with-ldap-lib=libname],[Specify name of ldap lib file]),
- [LDAPLIBNAME="$withval"])
-
-LBERLIBNAME=""
-AC_ARG_WITH(lber-lib,
-AS_HELP_STRING([--with-lber-lib=libname],[Specify name of lber lib file]),
- [LBERLIBNAME="$withval"])
-
-if test x$CURL_DISABLE_LDAP != x1 ; then
-
-  CURL_CHECK_HEADER_LBER
-  CURL_CHECK_HEADER_LDAP
-  CURL_CHECK_HEADER_LDAP_SSL
-
-  if test -z "$LDAPLIBNAME" ; then
-    if test "$curl_cv_native_windows" = "yes"; then
-      dnl Windows uses a single and unique LDAP library name
-      LDAPLIBNAME="wldap32"
-      LBERLIBNAME="no"
-    fi
-  fi
-
-  if test "$LDAPLIBNAME" ; then
-    AC_CHECK_LIB("$LDAPLIBNAME", ldap_init,, [
-      if test -n "$ldap_askedfor"; then
-        AC_MSG_ERROR([couldn't detect the LDAP libraries])
-      fi
-      AC_MSG_WARN(["$LDAPLIBNAME" is not an LDAP library: LDAP disabled])
-      AC_DEFINE(CURL_DISABLE_LDAP, 1, [to disable LDAP])
-      AC_SUBST(CURL_DISABLE_LDAP, [1])
-      AC_DEFINE(CURL_DISABLE_LDAPS, 1, [to disable LDAPS])
-      AC_SUBST(CURL_DISABLE_LDAPS, [1])])
-  else
-    dnl Try to find the right ldap libraries for this system
-    CURL_CHECK_LIBS_LDAP
-    case X-"$curl_cv_ldap_LIBS" in
-      X-unknown)
-        if test -n "$ldap_askedfor"; then
-          AC_MSG_ERROR([couldn't detect the LDAP libraries])
-        fi
-        AC_MSG_WARN([Cannot find libraries for LDAP support: LDAP disabled])
-        AC_DEFINE(CURL_DISABLE_LDAP, 1, [to disable LDAP])
-        AC_SUBST(CURL_DISABLE_LDAP, [1])
-        AC_DEFINE(CURL_DISABLE_LDAPS, 1, [to disable LDAPS])
-        AC_SUBST(CURL_DISABLE_LDAPS, [1])
-        ;;
-    esac
-  fi
-fi
-
-if test x$CURL_DISABLE_LDAP != x1 ; then
-
-  if test "$LBERLIBNAME" ; then
-    dnl If name is "no" then don't define this library at all
-    dnl (it's only needed if libldap.so's dependencies are broken).
-    if test "$LBERLIBNAME" != "no" ; then
-      AC_CHECK_LIB("$LBERLIBNAME", ber_free,, [
-        AC_MSG_WARN(["$LBERLIBNAME" is not an LBER library: LDAP disabled])
-        AC_DEFINE(CURL_DISABLE_LDAP, 1, [to disable LDAP])
-        AC_SUBST(CURL_DISABLE_LDAP, [1])
-        AC_DEFINE(CURL_DISABLE_LDAPS, 1, [to disable LDAPS])
-        AC_SUBST(CURL_DISABLE_LDAPS, [1])])
-    fi
-  fi
-fi
-
-if test x$CURL_DISABLE_LDAP != x1 ; then
-  AC_CHECK_FUNCS([ldap_url_parse \
-                  ldap_init_fd])
-
-  if test "$LDAPLIBNAME" = "wldap32"; then
-    curl_ldap_msg="enabled (winldap)"
-    AC_DEFINE(USE_WIN32_LDAP, 1, [Use Windows LDAP implementation])
-  else
-    if test "x$ac_cv_func_ldap_init_fd" = "xyes"; then
-      curl_ldap_msg="enabled (OpenLDAP)"
-      AC_DEFINE(USE_OPENLDAP, 1, [Use OpenLDAP-specific code])
-      AC_SUBST(USE_OPENLDAP, [1])
-    else
-      curl_ldap_msg="enabled (ancient OpenLDAP)"
-    fi
-  fi
-fi
-
-if test x$CURL_DISABLE_LDAPS != x1 ; then
-    curl_ldaps_msg="enabled"
-fi
-
 dnl **********************************************************************
 dnl Checks for IPv6
 dnl **********************************************************************
@@ -1719,74 +1767,73 @@ AS_HELP_STRING([--enable-ipv6],[Enable IPv6 (with IPv4) support])
 AS_HELP_STRING([--disable-ipv6],[Disable IPv6 support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       ipv6=no
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ipv6=yes
-       ;;
+    AC_MSG_RESULT(no)
+    ipv6=no
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ipv6=yes
+    ;;
   esac ],
 
-  AC_RUN_IFELSE([AC_LANG_SOURCE([[
-/* are AF_INET6 and sockaddr_in6 available? */
-#include <sys/types.h>
-#ifdef HAVE_WINSOCK2_H
-#include <winsock2.h>
-#include <ws2tcpip.h>
-#else
-#include <sys/socket.h>
-#include <netinet/in.h>
-#if defined (__TANDEM)
-# include <netinet/in6.h>
-#endif
-#endif
-#include <stdlib.h> /* for exit() */
-main()
-{
- struct sockaddr_in6 s;
- (void)s;
- if (socket(AF_INET6, SOCK_STREAM, 0) < 0)
-   exit(1);
- else
-   exit(0);
-}
-]])
-],
-  AC_MSG_RESULT(yes)
-  ipv6=yes,
-  AC_MSG_RESULT(no)
-  ipv6=no,
-  AC_MSG_RESULT(yes)
-  ipv6=yes
-))
+  AC_COMPILE_IFELSE([
+    AC_LANG_SOURCE([[
+      /* are AF_INET6 and sockaddr_in6 available? */
+      #include <sys/types.h>
+      #ifdef _WIN32
+      #include <winsock2.h>
+      #include <ws2tcpip.h>
+      #else
+      #include <sys/socket.h>
+      #include <netinet/in.h>
+      #ifdef __TANDEM
+      #include <netinet/in6.h>
+      #endif
+      #endif
+      int main(void)
+      {
+        int s = (int)sizeof(struct sockaddr_in6);
+        (void)s;
+        return socket(AF_INET6, SOCK_STREAM, 0) > 0;
+      }
+    ]])
+  ],
+    AC_MSG_RESULT(yes)
+    ipv6=yes,
+    AC_MSG_RESULT(no)
+    ipv6=no
+  )
+)
 
-if test "$ipv6" = yes; then
+if test "$ipv6" = "yes"; then
   curl_ipv6_msg="enabled"
-  AC_DEFINE(ENABLE_IPV6, 1, [Define if you want to enable IPv6 support])
+  AC_DEFINE(USE_IPV6, 1, [Define if you want to enable IPv6 support])
   IPV6_ENABLED=1
-  AC_SUBST(IPV6_ENABLED)
 
   AC_MSG_CHECKING([if struct sockaddr_in6 has sin6_scope_id member])
-  AC_COMPILE_IFELSE([ AC_LANG_PROGRAM([[
-#include <sys/types.h>
-#ifdef HAVE_WINSOCK2_H
-#include <winsock2.h>
-#include <ws2tcpip.h>
-#else
-#include <netinet/in.h>
-#if defined (__TANDEM)
-# include <netinet/in6.h>
-#endif
-#endif
-]], [[
-  struct sockaddr_in6 s;
-  s.sin6_scope_id = 0;
-]])], [
-  AC_MSG_RESULT([yes])
-  AC_DEFINE(HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID, 1, [Define to 1 if struct sockaddr_in6 has the sin6_scope_id member])
- ], [
+  AC_COMPILE_IFELSE([
+    AC_LANG_PROGRAM([[
+      #include <sys/types.h>
+      #ifdef _WIN32
+      #include <winsock2.h>
+      #include <ws2tcpip.h>
+      #else
+      #include <netinet/in.h>
+      #ifdef __TANDEM
+      #include <netinet/in6.h>
+      #endif
+      #endif
+    ]], [[
+      struct sockaddr_in6 s;
+      s.sin6_scope_id = 0;
+      (void)s;
+    ]])
+  ],[
+    AC_MSG_RESULT([yes])
+    AC_DEFINE(HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID, 1, [Define to 1 if struct sockaddr_in6 has the sin6_scope_id member])
+  ],[
     AC_MSG_RESULT([no])
- ])
+  ])
 fi
 
 dnl **********************************************************************
@@ -1799,14 +1846,14 @@ int main(int argc, char **argv)
 {
 #ifdef _WIN32
   /* on Windows, writing to the argv does not hide the argument in
-     process lists so it can just be skipped */
+     process lists so it can be skipped */
   (void)argc;
   (void)argv;
   return 1;
 #else
   (void)argc;
   argv[0][0] = ' ';
-  return (argv[0][0] == ' ')?0:1;
+  return (argv[0][0] == ' ') ? 0 : 1;
 #endif
 }
 ]],[
@@ -1816,18 +1863,21 @@ int main(int argc, char **argv)
 ],[
   curl_cv_writable_argv=cross
 ])
+if test "$curl_cv_writable_argv" = "cross" && test "$curl_cv_apple" = "yes"; then
+  curl_cv_writable_argv=yes
+fi
 case $curl_cv_writable_argv in
-yes)
-        AC_DEFINE(HAVE_WRITABLE_ARGV, 1, [Define this symbol if your OS supports changing the contents of argv])
-        AC_MSG_RESULT(yes)
-        ;;
-no)
-        AC_MSG_RESULT(no)
-        ;;
-*)
-        AC_MSG_RESULT(no)
-        AC_MSG_WARN([the previous check could not be made default was used])
-        ;;
+  yes)
+    AC_DEFINE(HAVE_WRITABLE_ARGV, 1, [Define this symbol if your OS supports changing the contents of argv])
+    AC_MSG_RESULT(yes)
+    ;;
+  no)
+    AC_MSG_RESULT(no)
+    ;;
+  *)
+    AC_MSG_RESULT(no)
+    AC_MSG_WARN([the previous check could not be made default was used])
+    ;;
 esac
 
 dnl **********************************************************************
@@ -1838,54 +1888,54 @@ dnl check for GSS-API stuff in the /usr as default
 
 GSSAPI_ROOT="/usr"
 AC_ARG_WITH(gssapi-includes,
-  AS_HELP_STRING([--with-gssapi-includes=DIR],
-                 [Specify location of GSS-API headers]),
-  [ GSSAPI_INCS="-I$withval"
-    want_gss="yes" ]
+  AS_HELP_STRING([--with-gssapi-includes=DIR], [Specify location of GSS-API headers]), [
+    GSSAPI_INCS="-I$withval"
+    want_gss="yes"
+  ]
 )
 
 AC_ARG_WITH(gssapi-libs,
-  AS_HELP_STRING([--with-gssapi-libs=DIR],
-                 [Specify location of GSS-API libs]),
-  [ GSSAPI_LIB_DIR="-L$withval"
-    want_gss="yes" ]
+  AS_HELP_STRING([--with-gssapi-libs=DIR], [Specify location of GSS-API libs]), [
+    GSSAPI_LIB_DIR="-L$withval"
+    want_gss="yes"
+  ]
 )
 
 AC_ARG_WITH(gssapi,
-  AS_HELP_STRING([--with-gssapi=DIR],
-                 [Where to look for GSS-API]), [
-  GSSAPI_ROOT="$withval"
-  if test x"$GSSAPI_ROOT" != xno; then
-    want_gss="yes"
-    if test x"$GSSAPI_ROOT" = xyes; then
-      dnl if yes, then use default root
-      GSSAPI_ROOT="/usr"
+  AS_HELP_STRING([--with-gssapi=DIR], [Where to look for GSS-API]), [
+    GSSAPI_ROOT="$withval"
+    if test "$GSSAPI_ROOT" != "no"; then
+      want_gss="yes"
+      if test "$GSSAPI_ROOT" = "yes"; then
+        dnl if yes, then use default root
+        GSSAPI_ROOT="/usr"
+      fi
     fi
-  fi
-])
+  ]
+)
 
 : ${KRB5CONFIG:="$GSSAPI_ROOT/bin/krb5-config"}
 
 save_CPPFLAGS="$CPPFLAGS"
 AC_MSG_CHECKING([if GSS-API support is requested])
-if test x"$want_gss" = xyes; then
+if test "$want_gss" = "yes"; then
   AC_MSG_RESULT(yes)
 
-  if test $GSSAPI_ROOT != "/usr"; then
+  if test "$GSSAPI_ROOT" != "/usr"; then
     CURL_CHECK_PKGCONFIG(mit-krb5-gssapi, $GSSAPI_ROOT/lib/pkgconfig)
   else
     CURL_CHECK_PKGCONFIG(mit-krb5-gssapi)
   fi
   if test -z "$GSSAPI_INCS"; then
-     if test -n "$host_alias" -a -f "$GSSAPI_ROOT/bin/$host_alias-krb5-config"; then
-        GSSAPI_INCS=`$GSSAPI_ROOT/bin/$host_alias-krb5-config --cflags gssapi`
-     elif test "$PKGCONFIG" != "no" ; then
-        GSSAPI_INCS=`$PKGCONFIG --cflags mit-krb5-gssapi`
-     elif test -f "$KRB5CONFIG"; then
-        GSSAPI_INCS=`$KRB5CONFIG --cflags gssapi`
-     elif test "$GSSAPI_ROOT" != "yes"; then
-        GSSAPI_INCS="-I$GSSAPI_ROOT/include"
-     fi
+    if test -n "$host_alias" && test -f "$GSSAPI_ROOT/bin/$host_alias-krb5-config"; then
+      GSSAPI_INCS=`$GSSAPI_ROOT/bin/$host_alias-krb5-config --cflags gssapi`
+    elif test "$PKGCONFIG" != "no"; then
+      GSSAPI_INCS=`$PKGCONFIG --cflags mit-krb5-gssapi`
+    elif test -f "$KRB5CONFIG"; then
+      GSSAPI_INCS=`$KRB5CONFIG --cflags gssapi`
+    elif test "$GSSAPI_ROOT" != "yes"; then
+      GSSAPI_INCS="-I$GSSAPI_ROOT/include"
+    fi
   fi
 
   CPPFLAGS="$CPPFLAGS $GSSAPI_INCS"
@@ -1897,129 +1947,111 @@ if test x"$want_gss" = xyes; then
       gnu_gss=yes
     ],
     [
-      dnl not found, check Heimdal or MIT
-      AC_CHECK_HEADERS([gssapi/gssapi.h], [], [not_mit=1])
+      dnl not found, check for MIT
       AC_CHECK_HEADERS(
-        [gssapi/gssapi_generic.h gssapi/gssapi_krb5.h],
+        [gssapi/gssapi.h gssapi/gssapi_generic.h gssapi/gssapi_krb5.h],
         [],
-        [not_mit=1],
-        [
-AC_INCLUDES_DEFAULT
-#ifdef HAVE_GSSAPI_GSSAPI_H
-#include <gssapi/gssapi.h>
-#endif
-        ])
-      if test "x$not_mit" = "x1"; then
-        dnl MIT not found, check for Heimdal
-        AC_CHECK_HEADER(gssapi.h,
-            [
-              dnl found
-              AC_DEFINE(HAVE_GSSHEIMDAL, 1, [if you have Heimdal])
-            ],
-            [
-              dnl no header found, disabling GSS
-              want_gss=no
-              AC_MSG_WARN(disabling GSS-API support since no header files were found)
-            ]
-          )
-      else
-        dnl MIT found
-        AC_DEFINE(HAVE_GSSMIT, 1, [if you have MIT Kerberos])
-        dnl check if we have a really old MIT Kerberos version (<= 1.2)
-        AC_MSG_CHECKING([if GSS-API headers declare GSS_C_NT_HOSTBASED_SERVICE])
-        AC_COMPILE_IFELSE([
-          AC_LANG_PROGRAM([[
-#include <gssapi/gssapi.h>
-#include <gssapi/gssapi_generic.h>
-#include <gssapi/gssapi_krb5.h>
-          ]],[[
-            gss_import_name(
-                            (OM_uint32 *)0,
-                            (gss_buffer_t)0,
-                            GSS_C_NT_HOSTBASED_SERVICE,
-                            (gss_name_t *)0);
-          ]])
-        ],[
-          AC_MSG_RESULT([yes])
-        ],[
-          AC_MSG_RESULT([no])
-          AC_DEFINE(HAVE_OLD_GSSMIT, 1,
-            [if you have an old MIT Kerberos version, lacking GSS_C_NT_HOSTBASED_SERVICE])
-        ])
+        [not_mit=1])
+      if test "$not_mit" = "1"; then
+        dnl MIT not found
+        AC_MSG_ERROR([MIT or GNU GSS library required, but not found])
       fi
     ]
   )
 else
   AC_MSG_RESULT(no)
 fi
-if test x"$want_gss" = xyes; then
+if test "$want_gss" = "yes"; then
   AC_DEFINE(HAVE_GSSAPI, 1, [if you have GSS-API libraries])
   HAVE_GSSAPI=1
-  curl_gss_msg="enabled (MIT Kerberos/Heimdal)"
+  curl_gss_msg="enabled (MIT Kerberos)"
+  link_pkgconfig=''
 
   if test -n "$gnu_gss"; then
     curl_gss_msg="enabled (GNU GSS)"
     LDFLAGS="$LDFLAGS $GSSAPI_LIB_DIR"
+    LDFLAGSPC="$LDFLAGSPC $GSSAPI_LIB_DIR"
     LIBS="-lgss $LIBS"
+    link_pkgconfig=1
   elif test -z "$GSSAPI_LIB_DIR"; then
-     case $host in
-     *-*-darwin*)
-        LIBS="-lgssapi_krb5 -lresolv $LIBS"
-        ;;
-     *)
-        if test $GSSAPI_ROOT != "/usr"; then
-          CURL_CHECK_PKGCONFIG(mit-krb5-gssapi, $GSSAPI_ROOT/lib/pkgconfig)
-        else
-          CURL_CHECK_PKGCONFIG(mit-krb5-gssapi)
-        fi
-        if test -n "$host_alias" -a -f "$GSSAPI_ROOT/bin/$host_alias-krb5-config"; then
-           dnl krb5-config doesn't have --libs-only-L or similar, put everything
-           dnl into LIBS
-           gss_libs=`$GSSAPI_ROOT/bin/$host_alias-krb5-config --libs gssapi`
-           LIBS="$gss_libs $LIBS"
-        elif test "$PKGCONFIG" != "no" ; then
-           gss_libs=`$PKGCONFIG --libs mit-krb5-gssapi`
-           LIBS="$gss_libs $LIBS"
-        elif test -f "$KRB5CONFIG"; then
-           dnl krb5-config doesn't have --libs-only-L or similar, put everything
-           dnl into LIBS
-           gss_libs=`$KRB5CONFIG --libs gssapi`
-           LIBS="$gss_libs $LIBS"
-        else
-           case $host in
-           *-hp-hpux*)
-              gss_libname="gss"
-              ;;
-           *)
-              gss_libname="gssapi"
-              ;;
-           esac
+    if test "$curl_cv_apple" = "yes"; then
+      LIBS="-lgssapi_krb5 -lresolv $LIBS"
+    else
+      if test "$GSSAPI_ROOT" != "/usr"; then
+        CURL_CHECK_PKGCONFIG(mit-krb5-gssapi, $GSSAPI_ROOT/lib/pkgconfig)
+      else
+        CURL_CHECK_PKGCONFIG(mit-krb5-gssapi)
+      fi
+      if test -n "$host_alias" && test -f "$GSSAPI_ROOT/bin/$host_alias-krb5-config"; then
+        dnl krb5-config does not have --libs-only-L or similar, put everything
+        dnl into LIBS
+        gss_libs=`$GSSAPI_ROOT/bin/$host_alias-krb5-config --libs gssapi`
+        LIBS="$gss_libs $LIBS"
+      elif test "$PKGCONFIG" != "no"; then
+        gss_libs=`$PKGCONFIG --libs mit-krb5-gssapi`
+        LIBS="$gss_libs $LIBS"
+        link_pkgconfig=1
+      elif test -f "$KRB5CONFIG"; then
+        dnl krb5-config does not have --libs-only-L or similar, put everything
+        dnl into LIBS
+        gss_libs=`$KRB5CONFIG --libs gssapi`
+        LIBS="$gss_libs $LIBS"
+        link_pkgconfig=1
+      else
+        case $host in
+          *-hp-hpux*)
+            gss_libname="gss"
+            ;;
+          *)
+            gss_libname="gssapi"
+            ;;
+        esac
 
-           if test "$GSSAPI_ROOT" != "yes"; then
-              LDFLAGS="$LDFLAGS -L$GSSAPI_ROOT/lib$libsuff"
-              LIBS="-l$gss_libname $LIBS"
-           else
-              LIBS="-l$gss_libname $LIBS"
-           fi
+        if test "$GSSAPI_ROOT" != "yes"; then
+          LDFLAGS="$LDFLAGS -L$GSSAPI_ROOT/lib$libsuff"
+          LDFLAGSPC="$LDFLAGSPC -L$GSSAPI_ROOT/lib$libsuff"
+          LIBS="-l$gss_libname $LIBS"
+        else
+          LIBS="-l$gss_libname $LIBS"
         fi
-        ;;
-     esac
+      fi
+    fi
+    gss_version=""
+    if test -n "$host_alias" && test -f "$GSSAPI_ROOT/bin/$host_alias-krb5-config"; then
+      gss_version=`$GSSAPI_ROOT/bin/$host_alias-krb5-config --version | $SED 's/Kerberos 5 release //'`
+    elif test "$PKGCONFIG" != "no"; then
+      gss_version=`$PKGCONFIG --modversion mit-krb5-gssapi`
+    elif test -f "$KRB5CONFIG"; then
+      gss_version=`$KRB5CONFIG --version | $SED 's/Kerberos 5 release //'`
+    fi
+    if test -n "$gss_version"; then
+      AC_MSG_NOTICE([GSS-API MIT Kerberos version detected: $gss_version])
+      AC_DEFINE_UNQUOTED([CURL_KRB5_VERSION], ["$gss_version"], [MIT Kerberos version])
+    fi
   else
-     LDFLAGS="$LDFLAGS $GSSAPI_LIB_DIR"
-     case $host in
-     *-hp-hpux*)
+    LDFLAGS="$LDFLAGS $GSSAPI_LIB_DIR"
+    LDFLAGSPC="$LDFLAGSPC $GSSAPI_LIB_DIR"
+    case $host in
+      *-hp-hpux*)
         LIBS="-lgss $LIBS"
         ;;
-     *)
+      *)
         LIBS="-lgssapi $LIBS"
         ;;
-     esac
+    esac
+  fi
+  if test -n "$link_pkgconfig"; then
+    if test -n "$gnu_gss"; then
+      LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE gss"
+    else
+      LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE mit-krb5-gssapi"
+    fi
   fi
 else
   CPPFLAGS="$save_CPPFLAGS"
 fi
 
-if test x"$want_gss" = xyes; then
+if test "$want_gss" = "yes"; then
   AC_MSG_CHECKING([if we can link against GSS-API library])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([gss_init_sec_context])
@@ -2032,11 +2064,11 @@ if test x"$want_gss" = xyes; then
 fi
 
 build_libstubgss=no
-if test x"$want_gss" = "xyes"; then
+if test "$want_gss" = "yes"; then
   build_libstubgss=yes
 fi
 
-AM_CONDITIONAL(BUILD_STUB_GSS, test "x$build_libstubgss" = "xyes")
+AM_CONDITIONAL(BUILD_STUB_GSS, test "$build_libstubgss" = "yes")
 
 dnl -------------------------------------------------------------
 dnl parse --with-default-ssl-backend so it can be validated below
@@ -2058,128 +2090,305 @@ case "$DEFAULT_SSL_BACKEND" in
     ;;
   *)
     dnl --with-default-ssl-backend option used with name
-    AC_SUBST(DEFAULT_SSL_BACKEND)
     dnl needs to be validated below
     VALID_DEFAULT_SSL_BACKEND=no
     ;;
 esac
 
 CURL_WITH_SCHANNEL
-CURL_WITH_SECURETRANSPORT
 CURL_WITH_AMISSL
 CURL_WITH_OPENSSL
 CURL_WITH_GNUTLS
 CURL_WITH_MBEDTLS
 CURL_WITH_WOLFSSL
-CURL_WITH_BEARSSL
 CURL_WITH_RUSTLS
+CURL_WITH_APPLE_SECTRUST
 
-dnl link required libraries for USE_WIN32_CRYPTO or USE_SCHANNEL
-if test "x$USE_WIN32_CRYPTO" = "x1" -o "x$USE_SCHANNEL" = "x1"; then
+dnl link required libraries for USE_WIN32_CRYPTO or SCHANNEL_ENABLED
+if test "$USE_WIN32_CRYPTO" = "1" || test "$SCHANNEL_ENABLED" = "1"; then
   LIBS="-ladvapi32 -lcrypt32 $LIBS"
 fi
 
-dnl link bcrypt for BCryptGenRandom() (used when building for Vista or newer)
-if test "x$curl_cv_native_windows" = "xyes" &&
-   test "x$curl_mingw_original" = "xno"; then
+if test "$curl_cv_native_windows" = "yes"; then
+  dnl for BCryptGenRandom()
   LIBS="-lbcrypt $LIBS"
 fi
 
-case "x$SSL_DISABLED$OPENSSL_ENABLED$GNUTLS_ENABLED$MBEDTLS_ENABLED$WOLFSSL_ENABLED$SCHANNEL_ENABLED$SECURETRANSPORT_ENABLED$BEARSSL_ENABLED$RUSTLS_ENABLED"
-in
-x)
-  AC_MSG_ERROR([TLS not detected, you will not be able to use HTTPS, FTPS, NTLM and more.
-Use --with-openssl, --with-gnutls, --with-wolfssl, --with-mbedtls, --with-schannel, --with-secure-transport, --with-amissl, --with-bearssl or --with-rustls to address this.])
-  ;;
-x1)
-  # one SSL backend is enabled
-  AC_SUBST(SSL_ENABLED)
-  SSL_ENABLED="1"
-  AC_MSG_NOTICE([built with one SSL backend])
-  ;;
-xD)
-  # explicitly built without TLS
-  ;;
-xD*)
-  AC_MSG_ERROR([--without-ssl has been set together with an explicit option to use an ssl library
-(e.g. --with-openssl, --with-gnutls, --with-wolfssl, --with-mbedtls, --with-schannel, --with-secure-transport, --with-amissl, --with-bearssl, --with-rustls).
+case "x$SSL_DISABLED$OPENSSL_ENABLED$GNUTLS_ENABLED$MBEDTLS_ENABLED$WOLFSSL_ENABLED$SCHANNEL_ENABLED$RUSTLS_ENABLED" in
+  x)
+    AC_MSG_ERROR([TLS not detected, you will not be able to use HTTPS, FTPS, NTLM and more.
+Use --with-openssl, --with-gnutls, --with-wolfssl, --with-mbedtls, --with-schannel, --with-amissl or --with-rustls to address this.])
+    ;;
+  x1)
+    dnl one SSL backend is enabled
+    SSL_ENABLED="1"
+    AC_MSG_NOTICE([built with one SSL backend])
+    ;;
+  xD)
+    dnl explicitly built without TLS
+    ;;
+  xD*)
+    AC_MSG_ERROR([--without-ssl has been set together with an explicit option to use an SSL library
+(e.g. --with-openssl, --with-gnutls, --with-wolfssl, --with-mbedtls, --with-schannel, --with-amissl, --with-rustls).
 Since these are conflicting parameters, verify which is the desired one and drop the other.])
-  ;;
-*)
-  # more than one SSL backend is enabled
-  AC_SUBST(SSL_ENABLED)
-  SSL_ENABLED="1"
-  AC_SUBST(CURL_WITH_MULTI_SSL)
-  CURL_WITH_MULTI_SSL="1"
-  AC_DEFINE(CURL_WITH_MULTI_SSL, 1, [built with multiple SSL backends])
-  AC_MSG_NOTICE([built with multiple SSL backends])
-  ;;
+    ;;
+  *)
+    dnl more than one SSL backend is enabled
+    SSL_ENABLED="1"
+    CURL_WITH_MULTI_SSL="1"
+    AC_DEFINE(CURL_WITH_MULTI_SSL, 1, [built with multiple SSL backends])
+    AC_MSG_NOTICE([built with multiple SSL backends])
+    ;;
 esac
 
 if test -n "$ssl_backends"; then
   curl_ssl_msg="enabled ($ssl_backends)"
 fi
 
-if test no = "$VALID_DEFAULT_SSL_BACKEND"
-then
-  if test -n "$SSL_ENABLED"
-  then
+if test "$VALID_DEFAULT_SSL_BACKEND" = "no"; then
+  if test -n "$SSL_ENABLED"; then
     AC_MSG_ERROR([Default SSL backend $DEFAULT_SSL_BACKEND not enabled!])
   else
     AC_MSG_ERROR([Default SSL backend requires SSL!])
   fi
-elif test yes = "$VALID_DEFAULT_SSL_BACKEND"
-then
+elif test "$VALID_DEFAULT_SSL_BACKEND" = "yes"; then
   AC_DEFINE_UNQUOTED([CURL_DEFAULT_SSL_BACKEND], ["$DEFAULT_SSL_BACKEND"], [Default SSL backend])
 fi
 
+dnl ---------------------
+dnl check native CA store
+dnl ---------------------
+
+ca_native_opt=0
+AC_MSG_CHECKING([whether to use native CA store])
+AC_ARG_ENABLE(ca-native,
+AS_HELP_STRING([--enable-ca-native],[Enable native CA store])
+AS_HELP_STRING([--disable-ca-native],[Disable native CA store (default)]),
+[ case "$enableval" in
+  yes)
+    AC_MSG_RESULT([yes])
+    AC_DEFINE(CURL_CA_NATIVE, 1, [If native CA store is enabled])
+    ca_native_opt=1
+    ;;
+  *)
+    AC_MSG_RESULT([no])
+    ;;
+  esac ],
+    AC_MSG_RESULT([no])
+)
+
 dnl **********************************************************************
 dnl Check for the CA bundle
 dnl **********************************************************************
 
 if test -n "$check_for_ca_bundle"; then
   CURL_CHECK_CA_BUNDLE
+  CURL_CHECK_CA_EMBED
+fi
+
+AM_CONDITIONAL(CURL_CA_EMBED_SET, test -n "$CURL_CA_EMBED")
+
+dnl ----------------------
+dnl check unsafe CA search
+dnl ----------------------
+
+if test "$curl_cv_native_windows" = "yes"; then
+  ca_search=1
+  AC_MSG_CHECKING([whether to enable unsafe CA bundle search in PATH on Windows])
+  AC_ARG_ENABLE(ca-search,
+AS_HELP_STRING([--enable-ca-search],[Enable unsafe CA bundle search in PATH on Windows])
+AS_HELP_STRING([--disable-ca-search],[Disable unsafe CA bundle search in PATH on Windows]),
+  [ case "$enableval" in
+    no)
+      AC_MSG_RESULT([no])
+      ca_search=0
+      ;;
+    yes)
+      AC_MSG_RESULT([yes])
+      ;;
+    *)
+      if test "$ca_native_opt" = "1"; then
+        AC_MSG_RESULT([no])
+        ca_search=0
+      else
+        AC_MSG_RESULT([yes])
+      fi
+      ;;
+    esac ],
+      if test "$ca_native_opt" = "1"; then
+        AC_MSG_RESULT([no])
+        ca_search=0
+      else
+        AC_MSG_RESULT([yes])
+      fi
+  )
+  if test "$ca_search" = "0"; then
+    AC_DEFINE(CURL_DISABLE_CA_SEARCH, 1, [If unsafe CA bundle search in PATH on Windows is disabled])
+  fi
+fi
+
+dnl --------------------
+dnl check safe CA search
+dnl --------------------
+
+if test "$curl_cv_native_windows" = "yes"; then
+  AC_MSG_CHECKING([whether to enable safe CA bundle search (within the curl tool directory) on Windows])
+  AC_ARG_ENABLE(ca-search-safe,
+AS_HELP_STRING([--enable-ca-search-safe],[Enable safe CA bundle search])
+AS_HELP_STRING([--disable-ca-search-safe],[Disable safe CA bundle search (default)]),
+  [ case "$enableval" in
+    yes)
+      AC_MSG_RESULT([yes])
+      AC_DEFINE(CURL_CA_SEARCH_SAFE, 1, [If safe CA bundle search is enabled])
+      ;;
+    *)
+      AC_MSG_RESULT([no])
+      ;;
+    esac ],
+      AC_MSG_RESULT([no])
+  )
 fi
 
 dnl **********************************************************************
 dnl Check for libpsl
 dnl **********************************************************************
 
+dnl Default to compiler & linker defaults for LIBPSL files & libraries.
+OPT_LIBPSL=off
 AC_ARG_WITH(libpsl,
-           AS_HELP_STRING([--without-libpsl],
-           [disable support for libpsl cookie checking]),
-           with_libpsl=$withval,
-           with_libpsl=yes)
-if test $with_libpsl != "no"; then
-  AC_SEARCH_LIBS(psl_builtin, psl,
-    [curl_psl_msg="enabled";
-     AC_DEFINE([USE_LIBPSL], [1], [PSL support enabled])
-     ],
-    [curl_psl_msg="no      (libpsl not found)";
-     AC_MSG_WARN([libpsl was not found])
-     ]
+AS_HELP_STRING([--with-libpsl=PATH],[Where to look for libpsl, PATH points to the LIBPSL installation;
+  when possible, set the PKG_CONFIG_PATH environment variable instead of using this option])
+AS_HELP_STRING([--without-libpsl], [disable LIBPSL]),
+  OPT_LIBPSL=$withval)
+
+if test "x$OPT_LIBPSL" != "xno"; then
+  dnl backup the pre-libpsl variables
+  CLEANLDFLAGS="$LDFLAGS"
+  CLEANLDFLAGSPC="$LDFLAGSPC"
+  CLEANCPPFLAGS="$CPPFLAGS"
+  CLEANLIBS="$LIBS"
+
+  case "$OPT_LIBPSL" in
+    yes|off)
+      dnl --with-libpsl (without path) used
+      CURL_CHECK_PKGCONFIG(libpsl)
+
+      if test "$PKGCONFIG" != "no"; then
+        LIB_PSL=`$PKGCONFIG --libs-only-l libpsl`
+        LD_PSL=`$PKGCONFIG --libs-only-L libpsl`
+        CPP_PSL=`$PKGCONFIG --cflags-only-I libpsl`
+      else
+        dnl no libpsl pkg-config found
+        LIB_PSL="-lpsl"
+      fi
+
+      ;;
+    *)
+      dnl use the given --with-libpsl spot
+      LIB_PSL="-lpsl"
+      PREFIX_PSL=$OPT_LIBPSL
+      ;;
+  esac
+
+  dnl if given with a prefix, we set -L and -I based on that
+  if test -n "$PREFIX_PSL"; then
+    LD_PSL=-L${PREFIX_PSL}/lib$libsuff
+    CPP_PSL=-I${PREFIX_PSL}/include
+  fi
+
+  LDFLAGS="$LDFLAGS $LD_PSL"
+  LDFLAGSPC="$LDFLAGSPC $LD_PSL"
+  CPPFLAGS="$CPPFLAGS $CPP_PSL"
+  LIBS="$LIB_PSL $LIBS"
+
+  AC_CHECK_LIB(psl, psl_builtin,
+    [
+      AC_CHECK_HEADERS(libpsl.h,
+        curl_psl_msg="enabled"
+        AC_DEFINE(USE_LIBPSL, 1, [if libpsl is in use])
+        USE_LIBPSL=1
+        LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE libpsl"
+      )
+    ],
+      dnl not found, revert back to clean variables
+      LDFLAGS=$CLEANLDFLAGS
+      LDFLAGSPC=$CLEANLDFLAGSPC
+      CPPFLAGS=$CLEANCPPFLAGS
+      LIBS=$CLEANLIBS
   )
+
+  if test "$USE_LIBPSL" != "1"; then
+    AC_MSG_ERROR([libpsl libs and/or directories were not found where specified!])
+  fi
 fi
 AM_CONDITIONAL([USE_LIBPSL], [test "$curl_psl_msg" = "enabled"])
 
-
 dnl **********************************************************************
 dnl Check for libgsasl
 dnl **********************************************************************
 
+OPT_LIBGSASL=no
 AC_ARG_WITH(libgsasl,
-           AS_HELP_STRING([--without-libgsasl],
-           [disable libgsasl support for SCRAM]),
-           with_libgsasl=$withval,
-           with_libgsasl=yes)
-if test $with_libgsasl != "no"; then
-  AC_SEARCH_LIBS(gsasl_init, gsasl,
-    [curl_gsasl_msg="enabled";
-     AC_DEFINE([USE_GSASL], [1], [GSASL support enabled])
-     ],
-    [curl_gsasl_msg="no      (libgsasl not found)";
-     AC_MSG_WARN([libgsasl was not found])
-     ]
+AS_HELP_STRING([--with-libgsasl=PATH],[Where to look for libgsasl, PATH points to the libgsasl installation;
+  when possible, set the PKG_CONFIG_PATH environment variable instead of using this option])
+AS_HELP_STRING([--without-libgsasl], [disable libgsasl support for SCRAM]),
+  OPT_LIBGSASL=$withval)
+
+if test "x$OPT_LIBGSASL" != "xno"; then
+  dnl backup the pre-libgsasl variables
+  CLEANLDFLAGS="$LDFLAGS"
+  CLEANLDFLAGSPC="$LDFLAGSPC"
+  CLEANCPPFLAGS="$CPPFLAGS"
+  CLEANLIBS="$LIBS"
+
+  case "$OPT_LIBGSASL" in
+    yes)
+      dnl --with-libgsasl (without path) used
+      CURL_CHECK_PKGCONFIG(libgsasl)
+
+      if test "$PKGCONFIG" != "no"; then
+        LIB_GSASL=`$PKGCONFIG --libs-only-l libgsasl`
+        LD_GSASL=`$PKGCONFIG --libs-only-L libgsasl`
+        CPP_GSASL=`$PKGCONFIG --cflags-only-I libgsasl`
+      else
+        dnl no libgsasl pkg-config found
+        LIB_GSASL="-lgsasl"
+      fi
+      ;;
+    *)
+      dnl use the given --with-libgsasl spot
+      PREFIX_GSASL=$OPT_LIBGSASL
+      ;;
+  esac
+
+  dnl if given with a prefix, we set -L and -I based on that
+  if test -n "$PREFIX_GSASL"; then
+    LIB_GSASL="-lgsasl"
+    LD_GSASL=-L${PREFIX_GSASL}/lib$libsuff
+    CPP_GSASL=-I${PREFIX_GSASL}/include
+  fi
+
+  LDFLAGS="$LDFLAGS $LD_GSASL"
+  LDFLAGSPC="$LDFLAGSPC $LD_GSASL"
+  CPPFLAGS="$CPPFLAGS $CPP_GSASL"
+  LIBS="$LIB_GSASL $LIBS"
+
+  AC_CHECK_LIB(gsasl, gsasl_init,
+    [
+      AC_CHECK_HEADERS(gsasl.h,
+        curl_gsasl_msg="enabled"
+        AC_DEFINE(USE_GSASL, 1, [GSASL support enabled])
+        USE_LIBGSASL=1
+        LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE libgsasl"
+      )
+    ],
+      dnl not found, revert back to clean variables
+      LDFLAGS=$CLEANLDFLAGS
+      LDFLAGSPC=$CLEANLDFLAGSPC
+      CPPFLAGS=$CLEANCPPFLAGS
+      LIBS=$CLEANLIBS
+      curl_gsasl_msg="no      (libgsasl not found)"
+      AC_MSG_WARN([libgsasl was not found])
   )
 fi
 AM_CONDITIONAL([USE_GSASL], [test "$curl_gsasl_msg" = "enabled"])
@@ -2188,56 +2397,52 @@ AC_ARG_WITH(libmetalink,,
   AC_MSG_ERROR([--with-libmetalink and --without-libmetalink no longer work!]))
 
 dnl **********************************************************************
-dnl Check for the presence of LIBSSH2 libraries and headers
+dnl Check for the presence of libssh2 libraries and headers
 dnl **********************************************************************
 
-dnl Default to compiler & linker defaults for LIBSSH2 files & libraries.
+dnl Default to compiler & linker defaults for libssh2 files & libraries.
 OPT_LIBSSH2=off
-AC_ARG_WITH(libssh2,dnl
-AS_HELP_STRING([--with-libssh2=PATH],[Where to look for libssh2, PATH points to the libssh2 installation; when possible, set the PKG_CONFIG_PATH environment variable instead of using this option])
+AC_ARG_WITH(libssh2,
+AS_HELP_STRING([--with-libssh2=PATH],[Where to look for libssh2, PATH points to the libssh2 installation;
+  when possible, set the PKG_CONFIG_PATH environment variable instead of using this option])
 AS_HELP_STRING([--with-libssh2], [enable libssh2]),
   OPT_LIBSSH2=$withval, OPT_LIBSSH2=no)
 
-
 OPT_LIBSSH=off
-AC_ARG_WITH(libssh,dnl
-AS_HELP_STRING([--with-libssh=PATH],[Where to look for libssh, PATH points to the libssh installation; when possible, set the PKG_CONFIG_PATH environment variable instead of using this option])
+AC_ARG_WITH(libssh,
+AS_HELP_STRING([--with-libssh=PATH],[Where to look for libssh, PATH points to the libssh installation;
+  when possible, set the PKG_CONFIG_PATH environment variable instead of using this option])
 AS_HELP_STRING([--with-libssh], [enable libssh]),
   OPT_LIBSSH=$withval, OPT_LIBSSH=no)
 
-OPT_WOLFSSH=off
-AC_ARG_WITH(wolfssh,dnl
-AS_HELP_STRING([--with-wolfssh=PATH],[Where to look for wolfssh, PATH points to the wolfSSH installation; when possible, set the PKG_CONFIG_PATH environment variable instead of using this option])
-AS_HELP_STRING([--with-wolfssh], [enable wolfssh]),
-  OPT_WOLFSSH=$withval, OPT_WOLFSSH=no)
-
-if test X"$OPT_LIBSSH2" != Xno; then
+if test "x$OPT_LIBSSH2" != "xno"; then
   dnl backup the pre-libssh2 variables
   CLEANLDFLAGS="$LDFLAGS"
+  CLEANLDFLAGSPC="$LDFLAGSPC"
   CLEANCPPFLAGS="$CPPFLAGS"
   CLEANLIBS="$LIBS"
 
   case "$OPT_LIBSSH2" in
-  yes)
-    dnl --with-libssh2 (without path) used
-    CURL_CHECK_PKGCONFIG(libssh2)
+    yes)
+      dnl --with-libssh2 (without path) used
+      CURL_CHECK_PKGCONFIG(libssh2)
 
-    if test "$PKGCONFIG" != "no" ; then
-      LIB_SSH2=`$PKGCONFIG --libs-only-l libssh2`
-      LD_SSH2=`$PKGCONFIG --libs-only-L libssh2`
-      CPP_SSH2=`$PKGCONFIG --cflags-only-I libssh2`
-      version=`$PKGCONFIG --modversion libssh2`
-      DIR_SSH2=`echo $LD_SSH2 | $SED -e 's/^-L//'`
-    fi
+      if test "$PKGCONFIG" != "no"; then
+        LIB_SSH2=`$PKGCONFIG --libs-only-l libssh2`
+        LD_SSH2=`$PKGCONFIG --libs-only-L libssh2`
+        CPP_SSH2=`$PKGCONFIG --cflags-only-I libssh2`
+        version=`$PKGCONFIG --modversion libssh2`
+        DIR_SSH2=`echo $LD_SSH2 | $SED -e 's/^-L//'`
+      fi
 
-    ;;
-  off)
-    dnl no --with-libssh2 option given, just check default places
-    ;;
-  *)
-    dnl use the given --with-libssh2 spot
-    PREFIX_SSH2=$OPT_LIBSSH2
-    ;;
+      ;;
+    off)
+      dnl no --with-libssh2 option given, check default places
+      ;;
+    *)
+      dnl use the given --with-libssh2 spot
+      PREFIX_SSH2=$OPT_LIBSSH2
+      ;;
   esac
 
   dnl if given with a prefix, we set -L and -I based on that
@@ -2249,69 +2454,72 @@ if test X"$OPT_LIBSSH2" != Xno; then
   fi
 
   LDFLAGS="$LDFLAGS $LD_SSH2"
+  LDFLAGSPC="$LDFLAGSPC $LD_SSH2"
   CPPFLAGS="$CPPFLAGS $CPP_SSH2"
   LIBS="$LIB_SSH2 $LIBS"
 
-  dnl check for function added in libssh2 version 1.0
-  AC_CHECK_LIB(ssh2, libssh2_session_block_directions)
+  dnl check for function added in libssh2 v1.9.0
+  AC_CHECK_LIB(ssh2, libssh2_agent_get_identity_path)
 
   AC_CHECK_HEADER(libssh2.h,
-    curl_ssh_msg="enabled (libSSH2)"
-    LIBSSH2_ENABLED=1
-    AC_DEFINE(USE_LIBSSH2, 1, [if libSSH2 is in use])
-    AC_SUBST(USE_LIBSSH2, [1])
+    curl_ssh_msg="enabled (libssh2)"
+    AC_DEFINE(USE_LIBSSH2, 1, [if libssh2 is in use])
+    USE_LIBSSH2=1
   )
 
-  if test X"$OPT_LIBSSH2" != Xoff &&
-     test "$LIBSSH2_ENABLED" != "1"; then
-    AC_MSG_ERROR([libSSH2 libs and/or directories were not found where specified!])
+  if test "x$OPT_LIBSSH2" != "xoff" &&
+     test "$USE_LIBSSH2" != "1"; then
+    AC_MSG_ERROR([libssh2 libs and/or directories were not found where specified!])
   fi
 
-  if test "$LIBSSH2_ENABLED" = "1"; then
+  if test "$USE_LIBSSH2" = "1"; then
     if test -n "$DIR_SSH2"; then
-       dnl when the libssh2 shared libs were found in a path that the run-time
-       dnl linker doesn't search through, we need to add it to CURL_LIBRARY_PATH
-       dnl to prevent further configure tests to fail due to this
+      dnl when the libssh2 shared libs were found in a path that the runtime
+      dnl linker does not search through, we need to add it to CURL_LIBRARY_PATH
+      dnl to prevent further configure tests to fail due to this
 
-       if test "x$cross_compiling" != "xyes"; then
-         CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_SSH2"
-         export CURL_LIBRARY_PATH
-         AC_MSG_NOTICE([Added $DIR_SSH2 to CURL_LIBRARY_PATH])
-       fi
+      if test "$cross_compiling" != "yes"; then
+        CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_SSH2"
+        export CURL_LIBRARY_PATH
+        AC_MSG_NOTICE([Added $DIR_SSH2 to CURL_LIBRARY_PATH])
+      fi
     fi
+    LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE libssh2"
   else
     dnl no libssh2, revert back to clean variables
     LDFLAGS=$CLEANLDFLAGS
+    LDFLAGSPC=$CLEANLDFLAGSPC
     CPPFLAGS=$CLEANCPPFLAGS
     LIBS=$CLEANLIBS
   fi
-elif test X"$OPT_LIBSSH" != Xno; then
+elif test "x$OPT_LIBSSH" != "xno"; then
   dnl backup the pre-libssh variables
   CLEANLDFLAGS="$LDFLAGS"
+  CLEANLDFLAGSPC="$LDFLAGSPC"
   CLEANCPPFLAGS="$CPPFLAGS"
   CLEANLIBS="$LIBS"
 
   case "$OPT_LIBSSH" in
-  yes)
-    dnl --with-libssh (without path) used
-    CURL_CHECK_PKGCONFIG(libssh)
+    yes)
+      dnl --with-libssh (without path) used
+      CURL_CHECK_PKGCONFIG(libssh)
 
-    if test "$PKGCONFIG" != "no" ; then
-      LIB_SSH=`$PKGCONFIG --libs-only-l libssh`
-      LD_SSH=`$PKGCONFIG --libs-only-L libssh`
-      CPP_SSH=`$PKGCONFIG --cflags-only-I libssh`
-      version=`$PKGCONFIG --modversion libssh`
-      DIR_SSH=`echo $LD_SSH | $SED -e 's/^-L//'`
-    fi
+      if test "$PKGCONFIG" != "no"; then
+        LIB_SSH=`$PKGCONFIG --libs-only-l libssh`
+        LD_SSH=`$PKGCONFIG --libs-only-L libssh`
+        CPP_SSH=`$PKGCONFIG --cflags-only-I libssh`
+        version=`$PKGCONFIG --modversion libssh`
+        DIR_SSH=`echo $LD_SSH | $SED -e 's/^-L//'`
+      fi
 
-    ;;
-  off)
-    dnl no --with-libssh option given, just check default places
-    ;;
-  *)
-    dnl use the given --with-libssh spot
-    PREFIX_SSH=$OPT_LIBSSH
-    ;;
+      ;;
+    off)
+      dnl no --with-libssh option given, check default places
+      ;;
+    *)
+      dnl use the given --with-libssh spot
+      PREFIX_SSH=$OPT_LIBSSH
+      ;;
   esac
 
   dnl if given with a prefix, we set -L and -I based on that
@@ -2323,297 +2531,389 @@ elif test X"$OPT_LIBSSH" != Xno; then
   fi
 
   LDFLAGS="$LDFLAGS $LD_SSH"
+  LDFLAGSPC="$LDFLAGSPC $LD_SSH"
   CPPFLAGS="$CPPFLAGS $CPP_SSH"
   LIBS="$LIB_SSH $LIBS"
 
   AC_CHECK_LIB(ssh, ssh_new)
 
   AC_CHECK_HEADER(libssh/libssh.h,
-    curl_ssh_msg="enabled (libSSH)"
-    LIBSSH_ENABLED=1
-    AC_DEFINE(USE_LIBSSH, 1, [if libSSH is in use])
-    AC_SUBST(USE_LIBSSH, [1])
+    curl_ssh_msg="enabled (libssh)"
+    AC_DEFINE(USE_LIBSSH, 1, [if libssh is in use])
+    USE_LIBSSH=1
   )
 
-  if test X"$OPT_LIBSSH" != Xoff &&
-     test "$LIBSSH_ENABLED" != "1"; then
-    AC_MSG_ERROR([libSSH libs and/or directories were not found where specified!])
+  if test "x$OPT_LIBSSH" != "xoff" &&
+     test "$USE_LIBSSH" != "1"; then
+    AC_MSG_ERROR([libssh libs and/or directories were not found where specified!])
   fi
 
-  if test "$LIBSSH_ENABLED" = "1"; then
-    if test -n "$DIR_SSH"; then
-       dnl when the libssh shared libs were found in a path that the run-time
-       dnl linker doesn't search through, we need to add it to CURL_LIBRARY_PATH
-       dnl to prevent further configure tests to fail due to this
-
-       if test "x$cross_compiling" != "xyes"; then
-         CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_SSH"
-         export CURL_LIBRARY_PATH
-         AC_MSG_NOTICE([Added $DIR_SSH to CURL_LIBRARY_PATH])
-       fi
+  if test "$USE_LIBSSH" = "1"; then
+    if test "$curl_cv_native_windows" = "yes"; then
+      dnl for if_nametoindex
+      LIBS="-liphlpapi $LIBS"
     fi
+    if test -n "$DIR_SSH"; then
+      dnl when the libssh shared libs were found in a path that the runtime
+      dnl linker does not search through, we need to add it to CURL_LIBRARY_PATH
+      dnl to prevent further configure tests to fail due to this
+
+      if test "$cross_compiling" != "yes"; then
+        CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_SSH"
+        export CURL_LIBRARY_PATH
+        AC_MSG_NOTICE([Added $DIR_SSH to CURL_LIBRARY_PATH])
+      fi
+    fi
+    LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE libssh"
   else
     dnl no libssh, revert back to clean variables
     LDFLAGS=$CLEANLDFLAGS
+    LDFLAGSPC=$CLEANLDFLAGSPC
     CPPFLAGS=$CLEANCPPFLAGS
     LIBS=$CLEANLIBS
   fi
-elif test X"$OPT_WOLFSSH" != Xno; then
-  dnl backup the pre-wolfssh variables
-  CLEANLDFLAGS="$LDFLAGS"
-  CLEANCPPFLAGS="$CPPFLAGS"
-  CLEANLIBS="$LIBS"
-
-
-  if test "$OPT_WOLFSSH" != yes; then
-     WOLFCONFIG="$OPT_WOLFSSH/bin/wolfssh-config"
-     LDFLAGS="$LDFLAGS `$WOLFCONFIG --libs`"
-     CPPFLAGS="$CPPFLAGS `$WOLFCONFIG --cflags`"
-  fi
-
-  AC_CHECK_LIB(wolfssh, wolfSSH_Init)
-
-  AC_CHECK_HEADERS(wolfssh/ssh.h,
-    curl_ssh_msg="enabled (wolfSSH)"
-    WOLFSSH_ENABLED=1
-    AC_DEFINE(USE_WOLFSSH, 1, [if wolfSSH is in use])
-    AC_SUBST(USE_WOLFSSH, [1])
-  )
-
 fi
 
 dnl **********************************************************************
-dnl Check for the presence of LIBRTMP libraries and headers
+dnl Check for LDAP (after the SSL libraries)
 dnl **********************************************************************
 
-dnl Default to compiler & linker defaults for LIBRTMP files & libraries.
-OPT_LIBRTMP=off
-AC_ARG_WITH(librtmp,dnl
-AS_HELP_STRING([--with-librtmp=PATH],[Where to look for librtmp, PATH points to the LIBRTMP installation; when possible, set the PKG_CONFIG_PATH environment variable instead of using this option])
-AS_HELP_STRING([--without-librtmp], [disable LIBRTMP]),
-  OPT_LIBRTMP=$withval)
+LDAPLIBNAME=""
+AC_ARG_WITH(ldap-lib,
+AS_HELP_STRING([--with-ldap-lib=libname],[Specify name of ldap lib file]),
+  [LDAPLIBNAME="$withval"])
 
-if test X"$OPT_LIBRTMP" != Xno; then
-  dnl backup the pre-librtmp variables
-  CLEANLDFLAGS="$LDFLAGS"
-  CLEANCPPFLAGS="$CPPFLAGS"
-  CLEANLIBS="$LIBS"
+LBERLIBNAME=""
+AC_ARG_WITH(lber-lib,
+AS_HELP_STRING([--with-lber-lib=libname],[Specify name of lber lib file]),
+  [LBERLIBNAME="$withval"])
 
-  case "$OPT_LIBRTMP" in
+dnl Handle argument to --with-ldap.
+clean_LDAP_CPPFLAGS=$CPPFLAGS
+clean_LDAP_LDFLAGS=$LDFLAGS
+clean_LDAP_LIBS=$LIBS
+OPT_LDAP=off
+AC_ARG_WITH(ldap,
+AS_HELP_STRING([--with-ldap=PATH],[Where to look for LDAP, PATH points to the LDAP installation;
+  when possible, set the PKG_CONFIG_PATH environment variable instead of using this option])
+AS_HELP_STRING([--without-ldap], [disable LDAP]),
+  OPT_LDAP=$withval)
+
+case "$OPT_LDAP" in
+  no)
+    dnl --without-ldap option used
+    want_ldap="no"
+    ;;
   yes)
-    dnl --with-librtmp (without path) used
-    CURL_CHECK_PKGCONFIG(librtmp)
-
-    if test "$PKGCONFIG" != "no" ; then
-      LIB_RTMP=`$PKGCONFIG --libs-only-l librtmp`
-      LD_RTMP=`$PKGCONFIG --libs-only-L librtmp`
-      CPP_RTMP=`$PKGCONFIG --cflags-only-I librtmp`
-      version=`$PKGCONFIG --modversion librtmp`
-      DIR_RTMP=`echo $LD_RTMP | $SED -e 's/^-L//'`
-    else
-      dnl To avoid link errors, we do not allow --librtmp without
-      dnl a pkgconfig file
-      AC_MSG_ERROR([--librtmp was specified but could not find librtmp pkgconfig file.])
-    fi
-
+    dnl --with-ldap option used without path
+    want_ldap="yes"
     ;;
   off)
-    dnl no --with-librtmp option given, just check default places
-    LIB_RTMP="-lrtmp"
+    dnl no --with-ldap option given, do not change anything
+    want_ldap="default"
     ;;
   *)
-    dnl use the given --with-librtmp spot
-    LIB_RTMP="-lrtmp"
-    PREFIX_RTMP=$OPT_LIBRTMP
+    dnl --with-ldap option used with path
+    want_ldap="yes"
+    if test -d "$OPT_LDAP/lib$libsuff"; then
+      LDFLAGS="$LDFLAGS -L$OPT_LDAP/lib$libsuff"
+      DIR_LDAP="$OPT_LDAP/lib$libsuff"
+    elif test -d "$OPT_LDAP/lib"; then
+      LDFLAGS="$LDFLAGS -L$OPT_LDAP/lib"
+      DIR_LDAP="$OPT_LDAP/lib"
+    fi
+    if test -d "$OPT_LDAP/include"; then
+      CPPFLAGS="$CPPFLAGS -I$OPT_LDAP/include"
+    fi
+    ldap_askedfor="yes"
     ;;
-  esac
+esac
 
-  dnl if given with a prefix, we set -L and -I based on that
-  if test -n "$PREFIX_RTMP"; then
-    LD_RTMP=-L${PREFIX_RTMP}/lib$libsuff
-    CPP_RTMP=-I${PREFIX_RTMP}/include
-    DIR_RTMP=${PREFIX_RTMP}/lib$libsuff
+if test "$CURL_DISABLE_LDAP" != "1" && test "$want_ldap" != "no"; then
+
+  CURL_CHECK_HEADER_LBER
+  CURL_CHECK_HEADER_LDAP
+  CURL_CHECK_HEADER_LDAP_SSL
+
+  if test -z "$LDAPLIBNAME"; then
+    if test "$curl_cv_native_windows" = "yes" && test "$curl_cv_winuwp" != "yes"; then
+      dnl Windows uses a single and unique LDAP library name
+      LDAPLIBNAME="wldap32"
+      LBERLIBNAME="no"
+    fi
   fi
 
-  LDFLAGS="$LDFLAGS $LD_RTMP"
-  CPPFLAGS="$CPPFLAGS $CPP_RTMP"
-  LIBS="$LIB_RTMP $LIBS"
+  if test "$LDAPLIBNAME"; then
+    dnl If we have both LDAP and LBER library names, check if we need both
+    if test "$LBERLIBNAME" && test "$LBERLIBNAME" != "no"; then
+      dnl Try LDAP first, then with LBER if needed
+      AC_CHECK_LIB("$LDAPLIBNAME", ldap_init, [ldap_lib_ok=yes], [ldap_lib_ok=no])
+      if test "$ldap_lib_ok" = "no"; then
+        dnl LDAP alone failed, try with LBER using a different function
+        AC_CHECK_LIB("$LDAPLIBNAME", ldap_unbind, [ldap_lib_ok=yes], [ldap_lib_ok=no], [-l$LBERLIBNAME])
+        if test "$ldap_lib_ok" = "yes"; then
+          dnl We need both libraries
+          LIBS="-l$LDAPLIBNAME -l$LBERLIBNAME $LIBS"
+        fi
+      else
+        dnl LDAP alone is sufficient
+        LIBS="-l$LDAPLIBNAME $LIBS"
+      fi
+    else
+      dnl Only check LDAP library
+      AC_CHECK_LIB("$LDAPLIBNAME", ldap_init, [ldap_lib_ok=yes; LIBS="-l$LDAPLIBNAME $LIBS"], [ldap_lib_ok=no])
+    fi
 
-  AC_CHECK_LIB(rtmp, RTMP_Init,
-    [
-     AC_CHECK_HEADERS(librtmp/rtmp.h,
-        curl_rtmp_msg="enabled (librtmp)"
-        LIBRTMP_ENABLED=1
-        AC_DEFINE(USE_LIBRTMP, 1, [if librtmp is in use])
-        AC_SUBST(USE_LIBRTMP, [1])
-     )
-    ],
-      dnl not found, revert back to clean variables
-      LDFLAGS=$CLEANLDFLAGS
-      CPPFLAGS=$CLEANCPPFLAGS
-      LIBS=$CLEANLIBS
-  )
+    if test "$ldap_lib_ok" = "no"; then
+      if test -n "$ldap_askedfor"; then
+        AC_MSG_ERROR([could not detect the LDAP libraries])
+      fi
+      AC_MSG_WARN(["$LDAPLIBNAME" is not an LDAP library: LDAP disabled])
+      AC_DEFINE(CURL_DISABLE_LDAP, 1, [to disable LDAP])
+      CURL_DISABLE_LDAP=1
+      AC_DEFINE(CURL_DISABLE_LDAPS, 1, [to disable LDAPS])
+      CURL_DISABLE_LDAPS=1
+      dnl restore original flags
+      CPPFLAGS=$clean_LDAP_CPPFLAGS
+      LDFLAGS=$clean_LDAP_LDFLAGS
+      LIBS=$clean_LDAP_LIBS
+    fi
+  else
+    dnl Try to find the right ldap libraries for this system
+    CURL_CHECK_LIBS_LDAP
+    case X-"$curl_cv_ldap_LIBS" in
+      X-unknown)
+        if test -n "$ldap_askedfor"; then
+          AC_MSG_ERROR([could not detect the LDAP libraries])
+        fi
+        AC_MSG_WARN([Cannot find libraries for LDAP support: LDAP disabled])
+        AC_DEFINE(CURL_DISABLE_LDAP, 1, [to disable LDAP])
+        CURL_DISABLE_LDAP=1
+        AC_DEFINE(CURL_DISABLE_LDAPS, 1, [to disable LDAPS])
+        CURL_DISABLE_LDAPS=1
+        dnl restore original flags
+        CPPFLAGS=$clean_LDAP_CPPFLAGS
+        LDFLAGS=$clean_LDAP_LDFLAGS
+        LIBS=$clean_LDAP_LIBS
+        ;;
+    esac
+  fi
+fi
 
-  if test X"$OPT_LIBRTMP" != Xoff &&
-     test "$LIBRTMP_ENABLED" != "1"; then
-    AC_MSG_ERROR([librtmp libs and/or directories were not found where specified!])
+if test "$CURL_DISABLE_LDAP" != "1"; then
+  dnl Add to library path if needed
+  if test -n "$DIR_LDAP"; then
+    dnl when the ldap shared lib were found in a path that the runtime
+    dnl linker does not search through, we need to add it to
+    dnl CURL_LIBRARY_PATH to prevent further configure tests to fail due to
+    dnl this
+
+    if test "$cross_compiling" != "yes"; then
+      CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_LDAP"
+      export CURL_LIBRARY_PATH
+      AC_MSG_NOTICE([Added $DIR_LDAP to CURL_LIBRARY_PATH])
+    fi
   fi
 
+  if test "$LBERLIBNAME"; then
+    dnl If name is "no" then do not define this library at all
+    dnl (it is only needed if libldap.so's dependencies are broken).
+    dnl Skip this check if we already determined we need both libraries above
+    if test "$LBERLIBNAME" != "no" && test "$ldap_lib_ok" != "yes"; then
+      AC_CHECK_LIB("$LBERLIBNAME", ber_free,, [
+        AC_MSG_WARN(["$LBERLIBNAME" is not an LBER library: LDAP disabled])
+        AC_DEFINE(CURL_DISABLE_LDAP, 1, [to disable LDAP])
+        CURL_DISABLE_LDAP=1
+        AC_DEFINE(CURL_DISABLE_LDAPS, 1, [to disable LDAPS])
+        CURL_DISABLE_LDAPS=1
+        dnl restore original flags
+        CPPFLAGS=$clean_LDAP_CPPFLAGS
+        LDFLAGS=$clean_LDAP_LDFLAGS
+        LIBS=$clean_LDAP_LIBS
+        ]
+      )
+    fi
+  fi
+fi
+
+if test "$CURL_DISABLE_LDAP" != "1"; then
+  AC_CHECK_FUNCS([ldap_url_parse \
+                  ldap_init_fd])
+
+  if test "$LDAPLIBNAME" = "wldap32"; then
+    curl_ldap_msg="enabled (winldap)"
+    AC_DEFINE(USE_WIN32_LDAP, 1, [Use Windows LDAP implementation])
+  else
+    if test "$ac_cv_func_ldap_init_fd" = "yes"; then
+      curl_ldap_msg="enabled (OpenLDAP)"
+      AC_DEFINE(USE_OPENLDAP, 1, [Use OpenLDAP-specific code])
+      USE_OPENLDAP=1
+    else
+      curl_ldap_msg="enabled (ancient OpenLDAP)"
+    fi
+  fi
+fi
+
+if test "$CURL_DISABLE_LDAPS" != "1"; then
+  curl_ldaps_msg="enabled"
 fi
 
 dnl **********************************************************************
 dnl Check for linker switch for versioned symbols
 dnl **********************************************************************
 
-versioned_symbols_flavour=
+versioned_symbols_flavor=
 AC_MSG_CHECKING([whether versioned symbols are wanted])
 AC_ARG_ENABLE(versioned-symbols,
 AS_HELP_STRING([--enable-versioned-symbols], [Enable versioned symbols in shared library])
 AS_HELP_STRING([--disable-versioned-symbols], [Disable versioned symbols in shared library]),
 [ case "$enableval" in
-  yes) AC_MSG_RESULT(yes)
+  no)
+    AC_MSG_RESULT(no)
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
     AC_MSG_CHECKING([if libraries can be versioned])
     GLD=`$LD --help < /dev/null 2>/dev/null | grep version-script`
     if test -z "$GLD"; then
-        AC_MSG_RESULT(no)
-        AC_MSG_WARN([You need an ld version supporting the --version-script option])
+      AC_MSG_RESULT(no)
+      AC_MSG_WARN([You need an ld version supporting the --version-script option])
     else
-        AC_MSG_RESULT(yes)
-        if test "x$CURL_WITH_MULTI_SSL" = "x1"; then
-          versioned_symbols_flavour="MULTISSL_"
-        elif test "x$OPENSSL_ENABLED" = "x1"; then
-          versioned_symbols_flavour="OPENSSL_"
-        elif test "x$GNUTLS_ENABLED" = "x1"; then
-          versioned_symbols_flavour="GNUTLS_"
-        elif test "x$WOLFSSL_ENABLED" = "x1"; then
-          versioned_symbols_flavour="WOLFSSL_"
-        elif test "x$SCHANNEL_ENABLED" = "x1"; then
-          versioned_symbols_flavour="SCHANNEL_"
-        elif test "x$SECURETRANSPORT_ENABLED" = "x1"; then
-          versioned_symbols_flavour="SECURE_TRANSPORT_"
-        else
-          versioned_symbols_flavour=""
-        fi
-        versioned_symbols="yes"
+      AC_MSG_RESULT(yes)
+      if test "x$enableval" != "xyes"; then
+        versioned_symbols_flavor="$enableval"
+      elif test "$CURL_WITH_MULTI_SSL" = "1"; then
+        versioned_symbols_flavor="MULTISSL_"
+      elif test "$OPENSSL_ENABLED" = "1"; then
+        versioned_symbols_flavor="OPENSSL_"
+      elif test "$MBEDTLS_ENABLED" = "1"; then
+        versioned_symbols_flavor="MBEDTLS_"
+      elif test "$WOLFSSL_ENABLED" = "1"; then
+        versioned_symbols_flavor="WOLFSSL_"
+      elif test "$GNUTLS_ENABLED" = "1"; then
+        versioned_symbols_flavor="GNUTLS_"
+      elif test "$RUSTLS_ENABLED" = "1"; then
+        versioned_symbols_flavor="RUSTLS_"
+      else
+        versioned_symbols_flavor=""
+      fi
+      versioned_symbols="yes"
     fi
     ;;
 
-  *)   AC_MSG_RESULT(no)
-    ;;
   esac
 ], [
-AC_MSG_RESULT(no)
+  AC_MSG_RESULT(no)
 ]
 )
 
-AC_SUBST([CURL_LT_SHLIB_VERSIONED_FLAVOUR],
-  ["$versioned_symbols_flavour"])
+AC_SUBST([CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX], ["$versioned_symbols_flavor"])
+AC_SUBST([CURL_LIBCURL_VERSIONED_SYMBOLS_SONAME], ["4"])  dnl Keep in sync with VERSIONCHANGE - VERSIONDEL in lib/Makefile.soname
 AM_CONDITIONAL([CURL_LT_SHLIB_USE_VERSIONED_SYMBOLS],
-  [test "x$versioned_symbols" = 'xyes'])
+  [test "$versioned_symbols" = "yes"])
 
-dnl Update .plist file with current version
-AC_SUBST([CURL_PLIST_VERSION],
-  ["$CURLVERSION"])
+dnl ----------------------------
+dnl check Windows Unicode option
+dnl ----------------------------
 
-dnl -------------------------------------------------
-dnl check winidn option before other IDN libraries
-dnl -------------------------------------------------
-
-AC_MSG_CHECKING([whether to enable Windows native IDN (Windows native builds only)])
-OPT_WINIDN="default"
-AC_ARG_WITH(winidn,
-AS_HELP_STRING([--with-winidn=PATH],[enable Windows native IDN])
-AS_HELP_STRING([--without-winidn], [disable Windows native IDN]),
-  OPT_WINIDN=$withval)
-case "$OPT_WINIDN" in
-  no|default)
-    dnl --without-winidn option used or configure option not specified
-    want_winidn="no"
-    AC_MSG_RESULT([no])
-    ;;
-  yes)
-    dnl --with-winidn option used without path
-    want_winidn="yes"
-    want_winidn_path="default"
-    AC_MSG_RESULT([yes])
-    ;;
-  *)
-    dnl --with-winidn option used with path
-    want_winidn="yes"
-    want_winidn_path="$withval"
-    AC_MSG_RESULT([yes ($withval)])
-    ;;
-esac
-
-if test "$want_winidn" = "yes"; then
-  dnl winidn library support has been requested
-  clean_CFLAGS="$CFLAGS"
-  clean_CPPFLAGS="$CPPFLAGS"
-  clean_LDFLAGS="$LDFLAGS"
-  clean_LIBS="$LIBS"
-  WINIDN_LIBS="-lnormaliz"
-  WINIDN_CPPFLAGS=""
-  #
-  if test "$want_winidn_path" != "default"; then
-    dnl path has been specified
-    dnl pkg-config not available or provides no info
-    WINIDN_LDFLAGS="-L$want_winidn_path/lib$libsuff"
-    WINIDN_CPPFLAGS="-I$want_winidn_path/include"
-    WINIDN_DIR="$want_winidn_path/lib$libsuff"
-  fi
-  #
-  dnl WinIDN requires a minimum supported OS version of at least Vista (0x0600)
-  AC_COMPILE_IFELSE([
-    AC_LANG_PROGRAM([[
-      #include <windows.h>
-    ]],[[
-      #if (WINVER < 0x600) && (_WIN32_WINNT < 0x600)
-      #error
-      #endif
-    ]])
-  ],[
-  ],[
-     CFLAGS=`echo $CFLAGS | $SED -e 's/-DWINVER=[[^ ]]*//g'`
-     CFLAGS=`echo $CFLAGS | $SED -e 's/-D_WIN32_WINNT=[[^ ]]*//g'`
-     CPPFLAGS=`echo $CPPFLAGS | $SED -e 's/-DWINVER=[[^ ]]*//g'`
-     CPPFLAGS=`echo $CPPFLAGS | $SED -e 's/-D_WIN32_WINNT=[[^ ]]*//g'`
-     WINIDN_CPPFLAGS="$WINIDN_CPPFLAGS -DWINVER=0x0600"
-  ])
-  #
-  CPPFLAGS="$CPPFLAGS $WINIDN_CPPFLAGS"
-  LDFLAGS="$LDFLAGS $WINIDN_LDFLAGS"
-  LIBS="$WINIDN_LIBS $LIBS"
-  #
-  AC_MSG_CHECKING([if IdnToUnicode can be linked])
-  AC_LINK_IFELSE([
-    AC_LANG_PROGRAM([[
-      #include <windows.h>
-    ]],[[
-      IdnToUnicode(0, NULL, 0, NULL, 0);
-    ]])
-  ],[
-    AC_MSG_RESULT([yes])
-    tst_links_winidn="yes"
-  ],[
-    AC_MSG_RESULT([no])
-    tst_links_winidn="no"
-  ])
-  #
-  if test "$tst_links_winidn" = "yes"; then
-    AC_DEFINE(USE_WIN32_IDN, 1, [Define to 1 if you have the `normaliz' (WinIDN) library (-lnormaliz).])
-    AC_SUBST([IDN_ENABLED], [1])
-    curl_idn_msg="enabled (Windows-native)"
+want_winuni="no"
+if test "$curl_cv_native_windows" = "yes"; then
+  if test "$curl_cv_winuwp" = "yes"; then
+    want_winuni="yes"
   else
-    AC_MSG_WARN([Cannot find libraries for IDN support: IDN disabled])
-    CFLAGS="$clean_CFLAGS"
-    CPPFLAGS="$clean_CPPFLAGS"
-    LDFLAGS="$clean_LDFLAGS"
-    LIBS="$clean_LIBS"
+    AC_MSG_CHECKING([whether to enable Windows Unicode (Windows native builds only)])
+    AC_ARG_ENABLE(windows-unicode,
+AS_HELP_STRING([--enable-windows-unicode],[Enable Windows Unicode])
+AS_HELP_STRING([--disable-windows-unicode],[Disable Windows Unicode (default)]),
+    [ case "$enableval" in
+      yes)
+        want_winuni="yes"
+        AC_MSG_RESULT([yes])
+        ;;
+      *)
+        AC_MSG_RESULT([no])
+        ;;
+      esac ],
+        AC_MSG_RESULT([no])
+    )
+  fi
+
+  if test "$want_winuni" = "yes"; then
+    CPPFLAGS="${CPPFLAGS} -DUNICODE -D_UNICODE"
+  fi
+fi
+
+AM_CONDITIONAL([USE_UNICODE], [test "$want_winuni" = "yes"])
+
+dnl -------------------------------------------------
+dnl check WinIDN option before other IDN libraries
+dnl -------------------------------------------------
+
+tst_links_winidn='no'
+if test "$curl_cv_native_windows" = "yes"; then
+  AC_MSG_CHECKING([whether to enable Windows native IDN (Windows native builds only)])
+  OPT_WINIDN="default"
+  AC_ARG_WITH(winidn,
+AS_HELP_STRING([--with-winidn],[enable Windows native IDN])
+AS_HELP_STRING([--without-winidn], [disable Windows native IDN]),
+    OPT_WINIDN=$withval)
+  case "$OPT_WINIDN" in
+    no|default)
+      dnl --without-winidn option used or configure option not specified
+      want_winidn="no"
+      AC_MSG_RESULT([no])
+      ;;
+    *)
+      dnl --with-winidn option
+      want_winidn="yes"
+      AC_MSG_RESULT([yes])
+      ;;
+  esac
+
+  if test "$want_winidn" = "yes"; then
+    LIBS="-lnormaliz $LIBS"
+    AC_DEFINE(USE_WIN32_IDN, 1, [Define to 1 if you have the `normaliz' (WinIDN) library (-lnormaliz).])
+    IDN_ENABLED=1
+    curl_idn_msg="enabled (Windows-native)"
   fi
 fi
 
 dnl **********************************************************************
-dnl Check for the presence of IDN libraries and headers
+dnl Check for the presence of AppleIDN
+dnl **********************************************************************
+
+tst_links_appleidn='no'
+if test "$curl_cv_apple" = "yes"; then
+  AC_MSG_CHECKING([whether to build with Apple IDN])
+  OPT_IDN="default"
+  AC_ARG_WITH(apple-idn,
+AS_HELP_STRING([--with-apple-idn],[Enable AppleIDN])
+AS_HELP_STRING([--without-apple-idn],[Disable AppleIDN]),
+    [OPT_IDN=$withval])
+  case "$OPT_IDN" in
+    yes)
+      dnl --with-apple-idn option used
+      AC_MSG_RESULT([yes, check])
+      AC_CHECK_LIB(icucore, uidna_openUTS46,
+      [
+        AC_CHECK_HEADERS(unicode/uidna.h,
+          curl_idn_msg="enabled (AppleIDN)"
+          AC_DEFINE(USE_APPLE_IDN, 1, [if AppleIDN])
+          USE_APPLE_IDN=1
+          IDN_ENABLED=1
+          LIBS="-licucore -liconv $LIBS"
+          tst_links_appleidn='yes'
+        )
+      ])
+      ;;
+    *)
+      AC_MSG_RESULT([no])
+      ;;
+  esac
+fi
+
+dnl **********************************************************************
+dnl Check for the presence of libidn2
 dnl **********************************************************************
 
 AC_MSG_CHECKING([whether to build with libidn2])
@@ -2622,9 +2922,12 @@ AC_ARG_WITH(libidn2,
 AS_HELP_STRING([--with-libidn2=PATH],[Enable libidn2 usage])
 AS_HELP_STRING([--without-libidn2],[Disable libidn2 usage]),
   [OPT_IDN=$withval])
-if test "x$tst_links_winidn" = "xyes"; then
+if test "$tst_links_winidn" = "yes"; then
   want_idn="no"
-  AC_MSG_RESULT([no (using winidn instead)])
+  AC_MSG_RESULT([no (using WinIDN instead)])
+elif test "$tst_links_appleidn" = "yes"; then
+  want_idn="no"
+  AC_MSG_RESULT([no (using AppleIDN instead)])
 else
   case "$OPT_IDN" in
     no)
@@ -2657,19 +2960,20 @@ if test "$want_idn" = "yes"; then
   dnl idn library support has been requested
   clean_CPPFLAGS="$CPPFLAGS"
   clean_LDFLAGS="$LDFLAGS"
+  clean_LDFLAGSPC="$LDFLAGSPC"
   clean_LIBS="$LIBS"
   PKGCONFIG="no"
-  #
+
   if test "$want_idn_path" != "default"; then
     dnl path has been specified
     IDN_PCDIR="$want_idn_path/lib$libsuff/pkgconfig"
     CURL_CHECK_PKGCONFIG(libidn2, [$IDN_PCDIR])
     if test "$PKGCONFIG" != "no"; then
-      IDN_LIBS=`CURL_EXPORT_PCDIR([$IDN_PCDIR]) dnl
+      IDN_LIBS=`CURL_EXPORT_PCDIR([$IDN_PCDIR])
         $PKGCONFIG --libs-only-l libidn2 2>/dev/null`
-      IDN_LDFLAGS=`CURL_EXPORT_PCDIR([$IDN_PCDIR]) dnl
+      IDN_LDFLAGS=`CURL_EXPORT_PCDIR([$IDN_PCDIR])
         $PKGCONFIG --libs-only-L libidn2 2>/dev/null`
-      IDN_CPPFLAGS=`CURL_EXPORT_PCDIR([$IDN_PCDIR]) dnl
+      IDN_CPPFLAGS=`CURL_EXPORT_PCDIR([$IDN_PCDIR])
         $PKGCONFIG --cflags-only-I libidn2 2>/dev/null`
       IDN_DIR=`echo $IDN_LDFLAGS | $SED -e 's/^-L//'`
     else
@@ -2692,7 +2996,7 @@ if test "$want_idn" = "yes"; then
       IDN_LIBS="-lidn2"
     fi
   fi
-  #
+
   if test "$PKGCONFIG" != "no"; then
     AC_MSG_NOTICE([pkg-config: IDN_LIBS: "$IDN_LIBS"])
     AC_MSG_NOTICE([pkg-config: IDN_LDFLAGS: "$IDN_LDFLAGS"])
@@ -2704,11 +3008,12 @@ if test "$want_idn" = "yes"; then
     AC_MSG_NOTICE([IDN_CPPFLAGS: "$IDN_CPPFLAGS"])
     AC_MSG_NOTICE([IDN_DIR: "$IDN_DIR"])
   fi
-  #
+
   CPPFLAGS="$CPPFLAGS $IDN_CPPFLAGS"
   LDFLAGS="$LDFLAGS $IDN_LDFLAGS"
+  LDFLAGSPC="$LDFLAGSPC $IDN_LDFLAGS"
   LIBS="$IDN_LIBS $LIBS"
-  #
+
   AC_MSG_CHECKING([if idn2_lookup_ul can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([idn2_lookup_ul])
@@ -2719,25 +3024,28 @@ if test "$want_idn" = "yes"; then
     AC_MSG_RESULT([no])
     tst_links_libidn="no"
   ])
-  #
-  AC_CHECK_HEADERS( idn2.h )
+
+  AC_CHECK_HEADERS(idn2.h)
 
   if test "$tst_links_libidn" = "yes"; then
     AC_DEFINE(HAVE_LIBIDN2, 1, [Define to 1 if you have the `idn2' library (-lidn2).])
     dnl different versions of libidn have different setups of these:
 
-    AC_SUBST([IDN_ENABLED], [1])
+    IDN_ENABLED=1
     curl_idn_msg="enabled (libidn2)"
-    if test -n "$IDN_DIR" -a "x$cross_compiling" != "xyes"; then
+    if test -n "$IDN_DIR" && test "$cross_compiling" != "yes"; then
       CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$IDN_DIR"
       export CURL_LIBRARY_PATH
       AC_MSG_NOTICE([Added $IDN_DIR to CURL_LIBRARY_PATH])
     fi
+    LIBCURL_PC_REQUIRES_PRIVATE="libidn2 $LIBCURL_PC_REQUIRES_PRIVATE"
   else
-    AC_MSG_WARN([Cannot find libraries for IDN support: IDN disabled])
+    AC_MSG_WARN([Cannot find libidn2])
     CPPFLAGS="$clean_CPPFLAGS"
     LDFLAGS="$clean_LDFLAGS"
+    LDFLAGSPC="$clean_LDFLAGSPC"
     LIBS="$clean_LIBS"
+    want_idn="no"
   fi
 fi
 
@@ -2747,8 +3055,8 @@ dnl **********************************************************************
 
 OPT_H2="yes"
 
-if test "x$disable_http" = "xyes" -o X"$want_hyper" != Xno; then
-  # without HTTP or with Hyper, nghttp2 is no use
+if test "$disable_http" = "yes"; then
+  dnl without HTTP nghttp2 is no use
   OPT_H2="no"
 fi
 
@@ -2771,24 +3079,25 @@ case "$OPT_H2" in
     dnl --with-nghttp2 option used with path
     want_nghttp2="yes"
     want_nghttp2_path="$withval"
-    want_nghttp2_pkg_config_path="$withval/lib/pkgconfig"
+    want_nghttp2_pkg_config_path="$OPT_H2/lib/pkgconfig"
     ;;
 esac
 
-if test X"$want_nghttp2" != Xno; then
+if test "$want_nghttp2" != "no"; then
   dnl backup the pre-nghttp2 variables
   CLEANLDFLAGS="$LDFLAGS"
+  CLEANLDFLAGSPC="$LDFLAGSPC"
   CLEANCPPFLAGS="$CPPFLAGS"
   CLEANLIBS="$LIBS"
 
   CURL_CHECK_PKGCONFIG(libnghttp2, $want_nghttp2_pkg_config_path)
 
-  if test "$PKGCONFIG" != "no" ; then
+  if test "$PKGCONFIG" != "no"; then
     LIB_H2=`CURL_EXPORT_PCDIR([$want_nghttp2_pkg_config_path])
       $PKGCONFIG --libs-only-l libnghttp2`
     AC_MSG_NOTICE([-l is $LIB_H2])
 
-    CPP_H2=`CURL_EXPORT_PCDIR([$want_nghttp2_pkg_config_path]) dnl
+    CPP_H2=`CURL_EXPORT_PCDIR([$want_nghttp2_pkg_config_path])
       $PKGCONFIG --cflags-only-I libnghttp2`
     AC_MSG_NOTICE([-I is $CPP_H2])
 
@@ -2797,12 +3106,12 @@ if test X"$want_nghttp2" != Xno; then
     AC_MSG_NOTICE([-L is $LD_H2])
 
     DIR_H2=`echo $LD_H2 | $SED -e 's/^-L//'`
-  elif test x"$want_nghttp2_path" != x; then
+  elif test -n "$want_nghttp2_path"; then
     LIB_H2="-lnghttp2"
     LD_H2=-L${want_nghttp2_path}/lib$libsuff
     CPP_H2=-I${want_nghttp2_path}/include
     DIR_H2=${want_nghttp2_path}/lib$libsuff
-  elif test X"$want_nghttp2" != Xdefault; then
+  elif test "$want_nghttp2" != "default"; then
     dnl no nghttp2 pkg-config found and no custom directory specified,
     dnl deal with it
     AC_MSG_ERROR([--with-nghttp2 was specified but could not find libnghttp2 pkg-config file.])
@@ -2811,26 +3120,28 @@ if test X"$want_nghttp2" != Xno; then
   fi
 
   LDFLAGS="$LDFLAGS $LD_H2"
+  LDFLAGSPC="$LDFLAGSPC $LD_H2"
   CPPFLAGS="$CPPFLAGS $CPP_H2"
   LIBS="$LIB_H2 $LIBS"
 
-  # use nghttp2_session_get_stream_local_window_size to require nghttp2
-  # >= 1.15.0
+  dnl use nghttp2_session_get_stream_local_window_size to require nghttp2
+  dnl >= 1.15.0
   AC_CHECK_LIB(nghttp2, nghttp2_session_get_stream_local_window_size,
     [
-     AC_CHECK_HEADERS(nghttp2/nghttp2.h,
+      AC_CHECK_HEADERS(nghttp2/nghttp2.h,
         curl_h2_msg="enabled (nghttp2)"
-        NGHTTP2_ENABLED=1
         AC_DEFINE(USE_NGHTTP2, 1, [if nghttp2 is in use])
-        AC_SUBST(USE_NGHTTP2, [1])
-     )
+        USE_NGHTTP2=1
+        LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE libnghttp2"
+      )
 
-     CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_H2"
-     export CURL_LIBRARY_PATH
-     AC_MSG_NOTICE([Added $DIR_H2 to CURL_LIBRARY_PATH])
+      CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_H2"
+      export CURL_LIBRARY_PATH
+      AC_MSG_NOTICE([Added $DIR_H2 to CURL_LIBRARY_PATH])
     ],
       dnl not found, revert back to clean variables
       LDFLAGS=$CLEANLDFLAGS
+      LDFLAGSPC=$CLEANLDFLAGSPC
       CPPFLAGS=$CLEANCPPFLAGS
       LIBS=$CLEANLIBS
   )
@@ -2842,8 +3153,8 @@ dnl **********************************************************************
 
 OPT_TCP2="no"
 
-if test "x$disable_http" = "xyes"; then
-  # without HTTP, ngtcp2 is no use
+if test "$disable_http" = "yes"; then
+  dnl without HTTP, ngtcp2 is no use
   OPT_TCP2="no"
 fi
 
@@ -2864,25 +3175,31 @@ case "$OPT_TCP2" in
   *)
     dnl --with-ngtcp2 option used with path
     want_tcp2="yes"
-    want_tcp2_path="$withval/lib/pkgconfig"
+    want_tcp2_path="$OPT_TCP2/lib/pkgconfig"
     ;;
 esac
 
 curl_tcp2_msg="no      (--with-ngtcp2)"
-if test X"$want_tcp2" != Xno; then
+if test "$want_tcp2" != "no"; then
+
+  if test "$QUIC_ENABLED" != "yes"; then
+    AC_MSG_ERROR([the detected TLS library does not support QUIC, making --with-ngtcp2 a no-no])
+  fi
+
   dnl backup the pre-ngtcp2 variables
   CLEANLDFLAGS="$LDFLAGS"
+  CLEANLDFLAGSPC="$LDFLAGSPC"
   CLEANCPPFLAGS="$CPPFLAGS"
   CLEANLIBS="$LIBS"
 
   CURL_CHECK_PKGCONFIG(libngtcp2, $want_tcp2_path)
 
-  if test "$PKGCONFIG" != "no" ; then
+  if test "$PKGCONFIG" != "no"; then
     LIB_TCP2=`CURL_EXPORT_PCDIR([$want_tcp2_path])
       $PKGCONFIG --libs-only-l libngtcp2`
     AC_MSG_NOTICE([-l is $LIB_TCP2])
 
-    CPP_TCP2=`CURL_EXPORT_PCDIR([$want_tcp2_path]) dnl
+    CPP_TCP2=`CURL_EXPORT_PCDIR([$want_tcp2_path])
       $PKGCONFIG --cflags-only-I libngtcp2`
     AC_MSG_NOTICE([-I is $CPP_TCP2])
 
@@ -2891,88 +3208,153 @@ if test X"$want_tcp2" != Xno; then
     AC_MSG_NOTICE([-L is $LD_TCP2])
 
     LDFLAGS="$LDFLAGS $LD_TCP2"
+    LDFLAGSPC="$LDFLAGSPC $LD_TCP2"
     CPPFLAGS="$CPPFLAGS $CPP_TCP2"
     LIBS="$LIB_TCP2 $LIBS"
 
-    if test "x$cross_compiling" != "xyes"; then
+    if test "$cross_compiling" != "yes"; then
       DIR_TCP2=`echo $LD_TCP2 | $SED -e 's/^-L//'`
     fi
     AC_CHECK_LIB(ngtcp2, ngtcp2_conn_client_new_versioned,
       [
-       AC_CHECK_HEADERS(ngtcp2/ngtcp2.h,
-          NGTCP2_ENABLED=1
+        AC_CHECK_HEADERS(ngtcp2/ngtcp2.h,
           AC_DEFINE(USE_NGTCP2, 1, [if ngtcp2 is in use])
-          AC_SUBST(USE_NGTCP2, [1])
+          USE_NGTCP2=1
           CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_TCP2"
           export CURL_LIBRARY_PATH
           AC_MSG_NOTICE([Added $DIR_TCP2 to CURL_LIBRARY_PATH])
-       )
+          LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE libngtcp2"
+        )
       ],
         dnl not found, revert back to clean variables
         LDFLAGS=$CLEANLDFLAGS
+        LDFLAGSPC=$CLEANLDFLAGSPC
         CPPFLAGS=$CLEANCPPFLAGS
         LIBS=$CLEANLIBS
     )
 
   else
     dnl no ngtcp2 pkg-config found, deal with it
-    if test X"$want_tcp2" != Xdefault; then
+    if test "$want_tcp2" != "default"; then
       dnl To avoid link errors, we do not allow --with-ngtcp2 without
       dnl a pkgconfig file
       AC_MSG_ERROR([--with-ngtcp2 was specified but could not find ngtcp2 pkg-config file.])
     fi
   fi
-
 fi
 
-if test "x$NGTCP2_ENABLED" = "x1" -a "x$OPENSSL_ENABLED" = "x1"; then
-  dnl backup the pre-ngtcp2_crypto_quictls variables
+if test "$USE_NGTCP2" = "1" && test "$OPENSSL_ENABLED" = "1" && test "$HAVE_LIBRESSL" = "1"; then
+
+  dnl backup the pre-ngtcp2_crypto_libressl variables
   CLEANLDFLAGS="$LDFLAGS"
+  CLEANLDFLAGSPC="$LDFLAGSPC"
   CLEANCPPFLAGS="$CPPFLAGS"
   CLEANLIBS="$LIBS"
 
-  CURL_CHECK_PKGCONFIG(libngtcp2_crypto_quictls, $want_tcp2_path)
+  CURL_CHECK_PKGCONFIG(libngtcp2_crypto_libressl, $want_tcp2_path, 1)
 
-  if test "$PKGCONFIG" != "no" ; then
-    LIB_NGTCP2_CRYPTO_QUICTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path])
+  if test "$PKGCONFIG" != "no"; then
+    LIB_NGTCP2_CRYPTO_LIBRESSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
+      $PKGCONFIG --libs-only-l libngtcp2_crypto_libressl`
+    AC_MSG_NOTICE([-l is $LIB_NGTCP2_CRYPTO_LIBRESSL])
+
+    CPP_NGTCP2_CRYPTO_LIBRESSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
+      $PKGCONFIG --cflags-only-I libngtcp2_crypto_libressl`
+    AC_MSG_NOTICE([-I is $CPP_NGTCP2_CRYPTO_LIBRESSL])
+
+    LD_NGTCP2_CRYPTO_LIBRESSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
+      $PKGCONFIG --libs-only-L libngtcp2_crypto_libressl`
+    AC_MSG_NOTICE([-L is $LD_NGTCP2_CRYPTO_LIBRESSL])
+
+    LDFLAGS="$LDFLAGS $LD_NGTCP2_CRYPTO_LIBRESSL"
+    LDFLAGSPC="$LDFLAGSPC $LD_NGTCP2_CRYPTO_LIBRESSL"
+    CPPFLAGS="$CPPFLAGS $CPP_NGTCP2_CRYPTO_LIBRESSL"
+    LIBS="$LIB_NGTCP2_CRYPTO_LIBRESSL $LIBS"
+
+    if test "$cross_compiling" != "yes"; then
+      DIR_NGTCP2_CRYPTO_LIBRESSL=`echo $LD_NGTCP2_CRYPTO_LIBRESSL | $SED -e 's/^-L//'`
+    fi
+    AC_CHECK_LIB(ngtcp2_crypto_libressl, ngtcp2_crypto_recv_client_initial_cb,
+      [
+        AC_CHECK_HEADERS(ngtcp2/ngtcp2_crypto.h,
+          USE_NGTCP2=1
+          CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_NGTCP2_CRYPTO_LIBRESSL"
+          export CURL_LIBRARY_PATH
+          AC_MSG_NOTICE([Added $DIR_NGTCP2_CRYPTO_LIBRESSL to CURL_LIBRARY_PATH])
+          LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE libngtcp2_crypto_libressl"
+        )
+      ],
+        dnl not found, revert back to clean variables
+        LDFLAGS=$CLEANLDFLAGS
+        LDFLAGSPC=$CLEANLDFLAGSPC
+        CPPFLAGS=$CLEANCPPFLAGS
+        LIBS=$CLEANLIBS
+    )
+
+  else
+    dnl no ngtcp2_crypto_libressl pkg-config found, deal with it
+    if test "$want_tcp2" != "default"; then
+      dnl To avoid link errors, we do not allow --with-ngtcp2 without
+      dnl a pkgconfig file
+      AC_MSG_WARN([--with-ngtcp2 was specified but could not find ngtcp2_crypto_libressl pkg-config file.])
+      dnl Pretend to be quictls to fall back to using ngtcp2_crypto_quictls
+    fi
+    HAVE_LIBRESSL=0
+  fi
+fi
+
+if test "$USE_NGTCP2" = "1" && test "$OPENSSL_ENABLED" = "1" && test "$HAVE_LIBRESSL" != "1" &&
+   test "$OPENSSL_IS_AWSLC" != "1" && test "$OPENSSL_IS_BORINGSSL" != "1" && test "$OPENSSL_QUIC_API2" != "1"; then
+
+  dnl backup the pre-ngtcp2_crypto_quictls variables
+  CLEANLDFLAGS="$LDFLAGS"
+  CLEANLDFLAGSPC="$LDFLAGSPC"
+  CLEANCPPFLAGS="$CPPFLAGS"
+  CLEANLIBS="$LIBS"
+
+  CURL_CHECK_PKGCONFIG(libngtcp2_crypto_quictls, $want_tcp2_path, 1)
+
+  if test "$PKGCONFIG" != "no"; then
+    LIB_NGTCP2_CRYPTO_QUICTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
       $PKGCONFIG --libs-only-l libngtcp2_crypto_quictls`
     AC_MSG_NOTICE([-l is $LIB_NGTCP2_CRYPTO_QUICTLS])
 
-    CPP_NGTCP2_CRYPTO_QUICTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path]) dnl
+    CPP_NGTCP2_CRYPTO_QUICTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
       $PKGCONFIG --cflags-only-I libngtcp2_crypto_quictls`
     AC_MSG_NOTICE([-I is $CPP_NGTCP2_CRYPTO_QUICTLS])
 
-    LD_NGTCP2_CRYPTO_QUICTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path])
+    LD_NGTCP2_CRYPTO_QUICTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
       $PKGCONFIG --libs-only-L libngtcp2_crypto_quictls`
     AC_MSG_NOTICE([-L is $LD_NGTCP2_CRYPTO_QUICTLS])
 
     LDFLAGS="$LDFLAGS $LD_NGTCP2_CRYPTO_QUICTLS"
+    LDFLAGSPC="$LDFLAGSPC $LD_NGTCP2_CRYPTO_QUICTLS"
     CPPFLAGS="$CPPFLAGS $CPP_NGTCP2_CRYPTO_QUICTLS"
     LIBS="$LIB_NGTCP2_CRYPTO_QUICTLS $LIBS"
 
-    if test "x$cross_compiling" != "xyes"; then
+    if test "$cross_compiling" != "yes"; then
       DIR_NGTCP2_CRYPTO_QUICTLS=`echo $LD_NGTCP2_CRYPTO_QUICTLS | $SED -e 's/^-L//'`
     fi
     AC_CHECK_LIB(ngtcp2_crypto_quictls, ngtcp2_crypto_recv_client_initial_cb,
       [
-       AC_CHECK_HEADERS(ngtcp2/ngtcp2_crypto.h,
-          NGTCP2_ENABLED=1
-          AC_DEFINE(USE_NGTCP2_CRYPTO_QUICTLS, 1, [if ngtcp2_crypto_quictls is in use])
-          AC_SUBST(USE_NGTCP2_CRYPTO_QUICTLS, [1])
+        AC_CHECK_HEADERS(ngtcp2/ngtcp2_crypto.h,
+          USE_NGTCP2=1
           CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_NGTCP2_CRYPTO_QUICTLS"
           export CURL_LIBRARY_PATH
           AC_MSG_NOTICE([Added $DIR_NGTCP2_CRYPTO_QUICTLS to CURL_LIBRARY_PATH])
-       )
+          LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE libngtcp2_crypto_quictls"
+        )
       ],
         dnl not found, revert back to clean variables
         LDFLAGS=$CLEANLDFLAGS
+        LDFLAGSPC=$CLEANLDFLAGSPC
         CPPFLAGS=$CLEANCPPFLAGS
         LIBS=$CLEANLIBS
     )
 
   else
     dnl no ngtcp2_crypto_quictls pkg-config found, deal with it
-    if test X"$want_tcp2" != Xdefault; then
+    if test "$want_tcp2" != "default"; then
       dnl To avoid link errors, we do not allow --with-ngtcp2 without
       dnl a pkgconfig file
       AC_MSG_ERROR([--with-ngtcp2 was specified but could not find ngtcp2_crypto_quictls pkg-config file.])
@@ -2980,54 +3362,175 @@ if test "x$NGTCP2_ENABLED" = "x1" -a "x$OPENSSL_ENABLED" = "x1"; then
   fi
 fi
 
-if test "x$NGTCP2_ENABLED" = "x1" -a "x$GNUTLS_ENABLED" = "x1"; then
-  dnl backup the pre-ngtcp2_crypto_gnutls variables
+if test "$USE_NGTCP2" = "1" && test "$OPENSSL_ENABLED" = "1" &&
+   test "$OPENSSL_IS_AWSLC" != "1" && test "$OPENSSL_IS_BORINGSSL" != "1" && test "$OPENSSL_QUIC_API2" = "1"; then
+
+  dnl backup the pre-ngtcp2_crypto_ossl variables
   CLEANLDFLAGS="$LDFLAGS"
+  CLEANLDFLAGSPC="$LDFLAGSPC"
   CLEANCPPFLAGS="$CPPFLAGS"
   CLEANLIBS="$LIBS"
 
-  CURL_CHECK_PKGCONFIG(libngtcp2_crypto_gnutls, $want_tcp2_path)
+  CURL_CHECK_PKGCONFIG(libngtcp2_crypto_ossl, $want_tcp2_path, 1)
 
-  if test "$PKGCONFIG" != "no" ; then
-    LIB_NGTCP2_CRYPTO_GNUTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path])
+  if test "$PKGCONFIG" != "no"; then
+    LIB_NGTCP2_CRYPTO_OSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
+      $PKGCONFIG --libs-only-l libngtcp2_crypto_ossl`
+    AC_MSG_NOTICE([-l is $LIB_NGTCP2_CRYPTO_OSSL])
+
+    CPP_NGTCP2_CRYPTO_OSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
+      $PKGCONFIG --cflags-only-I libngtcp2_crypto_ossl`
+    AC_MSG_NOTICE([-I is $CPP_NGTCP2_CRYPTO_OSSL])
+
+    LD_NGTCP2_CRYPTO_OSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
+      $PKGCONFIG --libs-only-L libngtcp2_crypto_ossl`
+    AC_MSG_NOTICE([-L is $LD_NGTCP2_CRYPTO_OSSL])
+
+    LDFLAGS="$LDFLAGS $LD_NGTCP2_CRYPTO_OSSL"
+    LDFLAGSPC="$LDFLAGSPC $LD_NGTCP2_CRYPTO_OSSL"
+    CPPFLAGS="$CPPFLAGS $CPP_NGTCP2_CRYPTO_OSSL"
+    LIBS="$LIB_NGTCP2_CRYPTO_OSSL $LIBS"
+
+    if test "$cross_compiling" != "yes"; then
+      DIR_NGTCP2_CRYPTO_OSSL=`echo $LD_NGTCP2_CRYPTO_OSSL | $SED -e 's/^-L//'`
+    fi
+    AC_CHECK_LIB(ngtcp2_crypto_ossl, ngtcp2_crypto_recv_client_initial_cb,
+      [
+        AC_CHECK_HEADERS(ngtcp2/ngtcp2_crypto.h,
+          USE_NGTCP2=1
+          CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_NGTCP2_CRYPTO_OSSL"
+          export CURL_LIBRARY_PATH
+          AC_MSG_NOTICE([Added $DIR_NGTCP2_CRYPTO_OSSL to CURL_LIBRARY_PATH])
+          LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE libngtcp2_crypto_ossl"
+          AC_DEFINE(OPENSSL_QUIC_API2, 1, [openssl with new QUIC API])
+        )
+      ],
+        dnl not found, revert back to clean variables
+        LDFLAGS=$CLEANLDFLAGS
+        LDFLAGSPC=$CLEANLDFLAGSPC
+        CPPFLAGS=$CLEANCPPFLAGS
+        LIBS=$CLEANLIBS
+    )
+
+  else
+    dnl no ngtcp2_crypto_ossl pkg-config found, deal with it
+    if test "$want_tcp2" != "default"; then
+      dnl To avoid link errors, we do not allow --with-ngtcp2 without
+      dnl a pkgconfig file
+      AC_MSG_ERROR([--with-ngtcp2 was specified but could not find ngtcp2_crypto_ossl pkg-config file.])
+    fi
+  fi
+fi
+
+if test "$USE_NGTCP2" = "1" && test "$OPENSSL_ENABLED" = "1" &&
+   (test "$OPENSSL_IS_AWSLC" = "1" || test "$OPENSSL_IS_BORINGSSL" = "1"); then
+
+  dnl backup the pre-ngtcp2_crypto_boringssl variables
+  CLEANLDFLAGS="$LDFLAGS"
+  CLEANLDFLAGSPC="$LDFLAGSPC"
+  CLEANCPPFLAGS="$CPPFLAGS"
+  CLEANLIBS="$LIBS"
+
+  CURL_CHECK_PKGCONFIG(libngtcp2_crypto_boringssl, $want_tcp2_path, 1)
+
+  if test "$PKGCONFIG" != "no"; then
+    LIB_NGTCP2_CRYPTO_BORINGSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
+      $PKGCONFIG --libs-only-l libngtcp2_crypto_boringssl`
+    AC_MSG_NOTICE([-l is $LIB_NGTCP2_CRYPTO_BORINGSSL])
+
+    CPP_NGTCP2_CRYPTO_BORINGSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
+      $PKGCONFIG --cflags-only-I libngtcp2_crypto_boringssl`
+    AC_MSG_NOTICE([-I is $CPP_NGTCP2_CRYPTO_BORINGSSL])
+
+    LD_NGTCP2_CRYPTO_BORINGSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
+      $PKGCONFIG --libs-only-L libngtcp2_crypto_boringssl`
+    AC_MSG_NOTICE([-L is $LD_NGTCP2_CRYPTO_BORINGSSL])
+
+    LDFLAGS="$LDFLAGS $LD_NGTCP2_CRYPTO_BORINGSSL"
+    LDFLAGSPC="$LDFLAGSPC $LD_NGTCP2_CRYPTO_BORINGSSL"
+    CPPFLAGS="$CPPFLAGS $CPP_NGTCP2_CRYPTO_BORINGSSL"
+    LIBS="$LIB_NGTCP2_CRYPTO_BORINGSSL $LIBS"
+
+    if test "$cross_compiling" != "yes"; then
+      DIR_NGTCP2_CRYPTO_BORINGSSL=`echo $LD_NGTCP2_CRYPTO_BORINGSSL | $SED -e 's/^-L//'`
+    fi
+    AC_CHECK_LIB(ngtcp2_crypto_boringssl, ngtcp2_crypto_recv_client_initial_cb,
+      [
+        AC_CHECK_HEADERS(ngtcp2/ngtcp2_crypto.h,
+          USE_NGTCP2=1
+          CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_NGTCP2_CRYPTO_BORINGSSL"
+          export CURL_LIBRARY_PATH
+          AC_MSG_NOTICE([Added $DIR_NGTCP2_CRYPTO_BORINGSSL to CURL_LIBRARY_PATH])
+          LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE libngtcp2_crypto_boringssl"
+        )
+      ],
+        dnl not found, revert back to clean variables
+        LDFLAGS=$CLEANLDFLAGS
+        LDFLAGSPC=$CLEANLDFLAGSPC
+        CPPFLAGS=$CLEANCPPFLAGS
+        LIBS=$CLEANLIBS
+    )
+
+  else
+    dnl no ngtcp2_crypto_boringssl pkg-config found, deal with it
+    if test "$want_tcp2" != "default"; then
+      dnl To avoid link errors, we do not allow --with-ngtcp2 without
+      dnl a pkgconfig file
+      AC_MSG_ERROR([--with-ngtcp2 was specified but could not find ngtcp2_crypto_boringssl pkg-config file.])
+    fi
+  fi
+fi
+
+if test "$USE_NGTCP2" = "1" && test "$GNUTLS_ENABLED" = "1"; then
+  dnl backup the pre-ngtcp2_crypto_gnutls variables
+  CLEANLDFLAGS="$LDFLAGS"
+  CLEANLDFLAGSPC="$LDFLAGSPC"
+  CLEANCPPFLAGS="$CPPFLAGS"
+  CLEANLIBS="$LIBS"
+
+  CURL_CHECK_PKGCONFIG(libngtcp2_crypto_gnutls, $want_tcp2_path, 1)
+
+  if test "$PKGCONFIG" != "no"; then
+    LIB_NGTCP2_CRYPTO_GNUTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
       $PKGCONFIG --libs-only-l libngtcp2_crypto_gnutls`
     AC_MSG_NOTICE([-l is $LIB_NGTCP2_CRYPTO_GNUTLS])
 
-    CPP_NGTCP2_CRYPTO_GNUTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path]) dnl
+    CPP_NGTCP2_CRYPTO_GNUTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
       $PKGCONFIG --cflags-only-I libngtcp2_crypto_gnutls`
     AC_MSG_NOTICE([-I is $CPP_NGTCP2_CRYPTO_GNUTLS])
 
-    LD_NGTCP2_CRYPTO_GNUTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path])
+    LD_NGTCP2_CRYPTO_GNUTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
       $PKGCONFIG --libs-only-L libngtcp2_crypto_gnutls`
     AC_MSG_NOTICE([-L is $LD_NGTCP2_CRYPTO_GNUTLS])
 
     LDFLAGS="$LDFLAGS $LD_NGTCP2_CRYPTO_GNUTLS"
+    LDFLAGSPC="$LDFLAGSPC $LD_NGTCP2_CRYPTO_GNUTLS"
     CPPFLAGS="$CPPFLAGS $CPP_NGTCP2_CRYPTO_GNUTLS"
     LIBS="$LIB_NGTCP2_CRYPTO_GNUTLS $LIBS"
 
-    if test "x$cross_compiling" != "xyes"; then
+    if test "$cross_compiling" != "yes"; then
       DIR_NGTCP2_CRYPTO_GNUTLS=`echo $LD_NGTCP2_CRYPTO_GNUTLS | $SED -e 's/^-L//'`
     fi
     AC_CHECK_LIB(ngtcp2_crypto_gnutls, ngtcp2_crypto_recv_client_initial_cb,
       [
-       AC_CHECK_HEADERS(ngtcp2/ngtcp2_crypto.h,
-          NGTCP2_ENABLED=1
-          AC_DEFINE(USE_NGTCP2_CRYPTO_GNUTLS, 1, [if ngtcp2_crypto_gnutls is in use])
-          AC_SUBST(USE_NGTCP2_CRYPTO_GNUTLS, [1])
+        AC_CHECK_HEADERS(ngtcp2/ngtcp2_crypto.h,
+          USE_NGTCP2=1
           CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_NGTCP2_CRYPTO_GNUTLS"
           export CURL_LIBRARY_PATH
           AC_MSG_NOTICE([Added $DIR_NGTCP2_CRYPTO_GNUTLS to CURL_LIBRARY_PATH])
-       )
+          LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE libngtcp2_crypto_gnutls"
+        )
       ],
         dnl not found, revert back to clean variables
         LDFLAGS=$CLEANLDFLAGS
+        LDFLAGSPC=$CLEANLDFLAGSPC
         CPPFLAGS=$CLEANCPPFLAGS
         LIBS=$CLEANLIBS
     )
 
   else
     dnl no ngtcp2_crypto_gnutls pkg-config found, deal with it
-    if test X"$want_tcp2" != Xdefault; then
+    if test "$want_tcp2" != "default"; then
       dnl To avoid link errors, we do not allow --with-ngtcp2 without
       dnl a pkgconfig file
       AC_MSG_ERROR([--with-ngtcp2 was specified but could not find ngtcp2_crypto_gnutls pkg-config file.])
@@ -3035,54 +3538,56 @@ if test "x$NGTCP2_ENABLED" = "x1" -a "x$GNUTLS_ENABLED" = "x1"; then
   fi
 fi
 
-if test "x$NGTCP2_ENABLED" = "x1" -a "x$WOLFSSL_ENABLED" = "x1"; then
+if test "$USE_NGTCP2" = "1" && test "$WOLFSSL_ENABLED" = "1"; then
   dnl backup the pre-ngtcp2_crypto_wolfssl variables
   CLEANLDFLAGS="$LDFLAGS"
+  CLEANLDFLAGSPC="$LDFLAGSPC"
   CLEANCPPFLAGS="$CPPFLAGS"
   CLEANLIBS="$LIBS"
 
-  CURL_CHECK_PKGCONFIG(libngtcp2_crypto_wolfssl, $want_tcp2_path)
+  CURL_CHECK_PKGCONFIG(libngtcp2_crypto_wolfssl, $want_tcp2_path, 1)
 
-  if test "$PKGCONFIG" != "no" ; then
-    LIB_NGTCP2_CRYPTO_WOLFSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path])
+  if test "$PKGCONFIG" != "no"; then
+    LIB_NGTCP2_CRYPTO_WOLFSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
       $PKGCONFIG --libs-only-l libngtcp2_crypto_wolfssl`
     AC_MSG_NOTICE([-l is $LIB_NGTCP2_CRYPTO_WOLFSSL])
 
-    CPP_NGTCP2_CRYPTO_WOLFSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path]) dnl
+    CPP_NGTCP2_CRYPTO_WOLFSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
       $PKGCONFIG --cflags-only-I libngtcp2_crypto_wolfssl`
     AC_MSG_NOTICE([-I is $CPP_NGTCP2_CRYPTO_WOLFSSL])
 
-    LD_NGTCP2_CRYPTO_WOLFSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path])
+    LD_NGTCP2_CRYPTO_WOLFSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
       $PKGCONFIG --libs-only-L libngtcp2_crypto_wolfssl`
     AC_MSG_NOTICE([-L is $LD_NGTCP2_CRYPTO_WOLFSSL])
 
     LDFLAGS="$LDFLAGS $LD_NGTCP2_CRYPTO_WOLFSSL"
+    LDFLAGSPC="$LDFLAGSPC $LD_NGTCP2_CRYPTO_WOLFSSL"
     CPPFLAGS="$CPPFLAGS $CPP_NGTCP2_CRYPTO_WOLFSSL"
     LIBS="$LIB_NGTCP2_CRYPTO_WOLFSSL $LIBS"
 
-    if test "x$cross_compiling" != "xyes"; then
+    if test "$cross_compiling" != "yes"; then
       DIR_NGTCP2_CRYPTO_WOLFSSL=`echo $LD_NGTCP2_CRYPTO_WOLFSSL | $SED -e 's/^-L//'`
     fi
     AC_CHECK_LIB(ngtcp2_crypto_wolfssl, ngtcp2_crypto_recv_client_initial_cb,
       [
-       AC_CHECK_HEADERS(ngtcp2/ngtcp2_crypto.h,
-          NGTCP2_ENABLED=1
-          AC_DEFINE(USE_NGTCP2_CRYPTO_WOLFSSL, 1, [if ngtcp2_crypto_wolfssl is in use])
-          AC_SUBST(USE_NGTCP2_CRYPTO_WOLFSSL, [1])
+        AC_CHECK_HEADERS(ngtcp2/ngtcp2_crypto.h,
+          USE_NGTCP2=1
           CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_NGTCP2_CRYPTO_WOLFSSL"
           export CURL_LIBRARY_PATH
           AC_MSG_NOTICE([Added $DIR_NGTCP2_CRYPTO_WOLFSSL to CURL_LIBRARY_PATH])
-       )
+          LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE libngtcp2_crypto_wolfssl"
+        )
       ],
         dnl not found, revert back to clean variables
         LDFLAGS=$CLEANLDFLAGS
+        LDFLAGSPC=$CLEANLDFLAGSPC
         CPPFLAGS=$CLEANCPPFLAGS
         LIBS=$CLEANLIBS
     )
 
   else
     dnl no ngtcp2_crypto_wolfssl pkg-config found, deal with it
-    if test X"$want_tcp2" != Xdefault; then
+    if test "$want_tcp2" != "default"; then
       dnl To avoid link errors, we do not allow --with-ngtcp2 without
       dnl a pkgconfig file
       AC_MSG_ERROR([--with-ngtcp2 was specified but could not find ngtcp2_crypto_wolfssl pkg-config file.])
@@ -3096,9 +3601,10 @@ dnl **********************************************************************
 
 OPT_NGHTTP3="yes"
 
-if test "x$NGTCP2_ENABLED" = "x"; then
-  # without ngtcp2, nghttp3 is of no use for us
+if test "$USE_NGTCP2" != "1"; then
+  dnl without ngtcp2, nghttp3 is of no use for us
   OPT_NGHTTP3="no"
+  want_nghttp3="no"
 fi
 
 AC_ARG_WITH(nghttp3,
@@ -3118,25 +3624,32 @@ case "$OPT_NGHTTP3" in
   *)
     dnl --with-nghttp3 option used with path
     want_nghttp3="yes"
-    want_nghttp3_path="$withval/lib/pkgconfig"
+    want_nghttp3_path="$OPT_NGHTTP3/lib/pkgconfig"
     ;;
 esac
 
 curl_http3_msg="no      (--with-nghttp3)"
-if test X"$want_nghttp3" != Xno; then
+if test "$want_nghttp3" != "no"; then
+
+  if test "x$USE_NGTCP2" != "x1"; then
+    dnl without ngtcp2, nghttp3 is of no use for us
+    AC_MSG_ERROR([nghttp3 enabled without a QUIC library; enable ngtcp2])
+  fi
+
   dnl backup the pre-nghttp3 variables
   CLEANLDFLAGS="$LDFLAGS"
+  CLEANLDFLAGSPC="$LDFLAGSPC"
   CLEANCPPFLAGS="$CPPFLAGS"
   CLEANLIBS="$LIBS"
 
   CURL_CHECK_PKGCONFIG(libnghttp3, $want_nghttp3_path)
 
-  if test "$PKGCONFIG" != "no" ; then
+  if test "$PKGCONFIG" != "no"; then
     LIB_NGHTTP3=`CURL_EXPORT_PCDIR([$want_nghttp3_path])
       $PKGCONFIG --libs-only-l libnghttp3`
     AC_MSG_NOTICE([-l is $LIB_NGHTTP3])
 
-    CPP_NGHTTP3=`CURL_EXPORT_PCDIR([$want_nghttp3_path]) dnl
+    CPP_NGHTTP3=`CURL_EXPORT_PCDIR([$want_nghttp3_path])
       $PKGCONFIG --cflags-only-I libnghttp3`
     AC_MSG_NOTICE([-I is $CPP_NGHTTP3])
 
@@ -3145,40 +3658,47 @@ if test X"$want_nghttp3" != Xno; then
     AC_MSG_NOTICE([-L is $LD_NGHTTP3])
 
     LDFLAGS="$LDFLAGS $LD_NGHTTP3"
+    LDFLAGSPC="$LDFLAGSPC $LD_NGHTTP3"
     CPPFLAGS="$CPPFLAGS $CPP_NGHTTP3"
     LIBS="$LIB_NGHTTP3 $LIBS"
 
-    if test "x$cross_compiling" != "xyes"; then
+    if test "$cross_compiling" != "yes"; then
       DIR_NGHTTP3=`echo $LD_NGHTTP3 | $SED -e 's/^-L//'`
     fi
     AC_CHECK_LIB(nghttp3, nghttp3_conn_client_new_versioned,
       [
-       AC_CHECK_HEADERS(nghttp3/nghttp3.h,
-          curl_h3_msg="enabled (ngtcp2 + nghttp3)"
-          NGHTTP3_ENABLED=1
+        AC_CHECK_HEADERS(nghttp3/nghttp3.h,
           AC_DEFINE(USE_NGHTTP3, 1, [if nghttp3 is in use])
-          AC_SUBST(USE_NGHTTP3, [1])
+          USE_NGHTTP3=1
           CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_NGHTTP3"
           export CURL_LIBRARY_PATH
           AC_MSG_NOTICE([Added $DIR_NGHTTP3 to CURL_LIBRARY_PATH])
-          experimental="$experimental HTTP3"
-       )
+          LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE libnghttp3"
+        )
       ],
         dnl not found, revert back to clean variables
         LDFLAGS=$CLEANLDFLAGS
+        LDFLAGSPC=$CLEANLDFLAGSPC
         CPPFLAGS=$CLEANCPPFLAGS
         LIBS=$CLEANLIBS
     )
-
   else
     dnl no nghttp3 pkg-config found, deal with it
-    if test X"$want_nghttp3" != Xdefault; then
+    if test "$want_nghttp3" != "default"; then
       dnl To avoid link errors, we do not allow --with-nghttp3 without
       dnl a pkgconfig file
       AC_MSG_ERROR([--with-nghttp3 was specified but could not find nghttp3 pkg-config file.])
     fi
   fi
+fi
 
+dnl **********************************************************************
+dnl Check for ngtcp2 and nghttp3 (HTTP/3 with ngtcp2 + nghttp3)
+dnl **********************************************************************
+
+if test "$USE_NGTCP2" = "1" && test "$USE_NGHTTP3" = "1"; then
+  USE_NGTCP2_H3=1
+  curl_h3_msg="enabled (ngtcp2 + nghttp3)"
 fi
 
 dnl **********************************************************************
@@ -3187,14 +3707,14 @@ dnl **********************************************************************
 
 OPT_QUICHE="no"
 
-if test "x$disable_http" = "xyes" -o "x$USE_NGTCP" = "x1"; then
-  # without HTTP or with ngtcp2, quiche is no use
+if test "$disable_http" = "yes" || test "$USE_NGTCP" = "1"; then
+  dnl without HTTP or with ngtcp2, quiche is no use
   OPT_QUICHE="no"
 fi
 
 AC_ARG_WITH(quiche,
-AS_HELP_STRING([--with-quiche=PATH],[Enable quiche usage])
-AS_HELP_STRING([--without-quiche],[Disable quiche usage]),
+AS_HELP_STRING([--with-quiche=PATH],[Enable quiche usage (experimental)])
+AS_HELP_STRING([--without-quiche],[Disable quiche usage (experimental)]),
   [OPT_QUICHE=$withval])
 case "$OPT_QUICHE" in
   no)
@@ -3213,25 +3733,30 @@ case "$OPT_QUICHE" in
     ;;
 esac
 
-if test X"$want_quiche" != Xno; then
+if test "$want_quiche" != "no"; then
 
-  if test "$NGHTTP3_ENABLED" = 1; then
+  if test "$QUIC_ENABLED" != "yes"; then
+    AC_MSG_ERROR([the detected TLS library does not support QUIC, making --with-quiche a no-no])
+  fi
+
+  if test "$NGHTTP3_ENABLED" = "1"; then
     AC_MSG_ERROR([--with-quiche and --with-ngtcp2 are mutually exclusive])
   fi
 
   dnl backup the pre-quiche variables
   CLEANLDFLAGS="$LDFLAGS"
+  CLEANLDFLAGSPC="$LDFLAGSPC"
   CLEANCPPFLAGS="$CPPFLAGS"
   CLEANLIBS="$LIBS"
 
   CURL_CHECK_PKGCONFIG(quiche, $want_quiche_path)
 
-  if test "$PKGCONFIG" != "no" ; then
+  if test "$PKGCONFIG" != "no"; then
     LIB_QUICHE=`CURL_EXPORT_PCDIR([$want_quiche_path])
       $PKGCONFIG --libs-only-l quiche`
     AC_MSG_NOTICE([-l is $LIB_QUICHE])
 
-    CPP_QUICHE=`CURL_EXPORT_PCDIR([$want_quiche_path]) dnl
+    CPP_QUICHE=`CURL_EXPORT_PCDIR([$want_quiche_path])
       $PKGCONFIG --cflags-only-I quiche`
     AC_MSG_NOTICE([-I is $CPP_QUICHE])
 
@@ -3240,38 +3765,39 @@ if test X"$want_quiche" != Xno; then
     AC_MSG_NOTICE([-L is $LD_QUICHE])
 
     LDFLAGS="$LDFLAGS $LD_QUICHE"
+    LDFLAGSPC="$LDFLAGSPC $LD_QUICHE"
     CPPFLAGS="$CPPFLAGS $CPP_QUICHE"
     LIBS="$LIB_QUICHE $LIBS"
 
-    if test "x$cross_compiling" != "xyes"; then
+    if test "$cross_compiling" != "yes"; then
       DIR_QUICHE=`echo $LD_QUICHE | $SED -e 's/^-L//'`
     fi
     AC_CHECK_LIB(quiche, quiche_conn_send_ack_eliciting,
       [
-       AC_CHECK_HEADERS(quiche.h,
-          experimental="$experimental HTTP3"
+        AC_CHECK_HEADERS(quiche.h,
+          experimental="$experimental Quiche"
           AC_MSG_NOTICE([HTTP3 support is experimental])
           curl_h3_msg="enabled (quiche)"
-          QUICHE_ENABLED=1
           AC_DEFINE(USE_QUICHE, 1, [if quiche is in use])
-          AC_SUBST(USE_QUICHE, [1])
+          USE_QUICHE=1
           AC_CHECK_FUNCS([quiche_conn_set_qlog_fd])
           CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_QUICHE"
           export CURL_LIBRARY_PATH
-          AC_MSG_NOTICE([Added $DIR_QUICHE to CURL_LIBRARY_PATH]),
+          AC_MSG_NOTICE([Added $DIR_QUICHE to CURL_LIBRARY_PATH])
+          LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE quiche",
           [],
           [
-AC_INCLUDES_DEFAULT
-#include <sys/socket.h>
+            AC_INCLUDES_DEFAULT
+            #include <sys/socket.h>
           ]
-       )
+        )
       ],
         dnl not found, revert back to clean variables
-        AC_MSG_ERROR([couldn't use quiche])
+        AC_MSG_ERROR([could not use quiche])
     )
   else
     dnl no quiche pkg-config found, deal with it
-    if test X"$want_quiche" != Xdefault; then
+    if test "$want_quiche" != "default"; then
       dnl To avoid link errors, we do not allow --with-quiche without
       dnl a pkgconfig file
       AC_MSG_ERROR([--with-quiche was specified but could not find quiche pkg-config file.])
@@ -3280,75 +3806,91 @@ AC_INCLUDES_DEFAULT
 fi
 
 dnl **********************************************************************
-dnl Check for msh3 (QUIC)
+dnl libuv is only ever used for debug purposes
 dnl **********************************************************************
 
-OPT_MSH3="no"
-
-if test "x$disable_http" = "xyes" -o "x$USE_NGTCP" = "x1"; then
-  # without HTTP or with ngtcp2, msh3 is no use
-  OPT_MSH3="no"
-fi
-
-AC_ARG_WITH(msh3,
-AS_HELP_STRING([--with-msh3=PATH],[Enable msh3 usage])
-AS_HELP_STRING([--without-msh3],[Disable msh3 usage]),
-  [OPT_MSH3=$withval])
-case "$OPT_MSH3" in
+OPT_LIBUV=no
+AC_ARG_WITH(libuv,
+AS_HELP_STRING([--with-libuv=PATH],[Enable libuv])
+AS_HELP_STRING([--without-libuv],[Disable libuv]),
+  [OPT_LIBUV=$withval])
+case "$OPT_LIBUV" in
   no)
-    dnl --without-msh3 option used
-    want_msh3="no"
+    dnl --without-libuv option used
+    want_libuv="no"
     ;;
   yes)
-    dnl --with-msh3 option used without path
-    want_msh3="default"
-    want_msh3_path=""
+    dnl --with-libuv option used without path
+    want_libuv="default"
+    want_libuv_path=""
     ;;
   *)
-    dnl --with-msh3 option used with path
-    want_msh3="yes"
-    want_msh3_path="$withval"
+    dnl --with-libuv option used with path
+    want_libuv="yes"
+    want_libuv_path="$withval"
     ;;
 esac
 
-if test X"$want_msh3" != Xno; then
-
-  if test "$NGHTTP3_ENABLED" = 1; then
-    AC_MSG_ERROR([--with-msh3 and --with-ngtcp2 are mutually exclusive])
+if test "$want_libuv" != "no"; then
+  if test "$want_debug" != "yes"; then
+    AC_MSG_ERROR([Using libuv without debug support enabled is useless])
   fi
 
-  dnl backup the pre-msh3 variables
+  dnl backup the pre-libuv variables
   CLEANLDFLAGS="$LDFLAGS"
+  CLEANLDFLAGSPC="$LDFLAGSPC"
   CLEANCPPFLAGS="$CPPFLAGS"
   CLEANLIBS="$LIBS"
 
-  if test -n "$want_msh3_path"; then
-    LD_MSH3="-L$want_msh3_path/lib"
-    CPP_MSH3="-I$want_msh3_path/include"
-    DIR_MSH3="$want_msh3_path/lib"
-    LDFLAGS="$LDFLAGS $LD_MSH3"
-    CPPFLAGS="$CPPFLAGS $CPP_MSH3"
-  fi
-  LIBS="-lmsh3 $LIBS"
+  CURL_CHECK_PKGCONFIG(libuv, $want_libuv_path)
+
+  if test "$PKGCONFIG" != "no"; then
+    LIB_LIBUV=`CURL_EXPORT_PCDIR([$want_libuv_path])
+      $PKGCONFIG --libs-only-l libuv`
+    AC_MSG_NOTICE([-l is $LIB_LIBUV])
+
+    CPP_LIBUV=`CURL_EXPORT_PCDIR([$want_libuv_path])
+      $PKGCONFIG --cflags-only-I libuv`
+    AC_MSG_NOTICE([-I is $CPP_LIBUV])
+
+    LD_LIBUV=`CURL_EXPORT_PCDIR([$want_libuv_path])
+      $PKGCONFIG --libs-only-L libuv`
+    AC_MSG_NOTICE([-L is $LD_LIBUV])
+
+    LDFLAGS="$LDFLAGS $LD_LIBUV"
+    LDFLAGSPC="$LDFLAGSPC $LD_LIBUV"
+    CPPFLAGS="$CPPFLAGS $CPP_LIBUV"
+    LIBS="$LIB_LIBUV $LIBS"
+
+    if test "$cross_compiling" != "yes"; then
+      DIR_LIBUV=`echo $LD_LIBUV | $SED -e 's/^-L//'`
+    fi
+    AC_CHECK_LIB(uv, uv_default_loop,
+      [
+        AC_CHECK_HEADERS(uv.h,
+          AC_DEFINE(USE_LIBUV, 1, [if libuv is in use])
+          USE_LIBUV=1
+          CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_LIBUV"
+          export CURL_LIBRARY_PATH
+          AC_MSG_NOTICE([Added $DIR_LIBUV to CURL_LIBRARY_PATH])
+          LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE libuv"
+        )
+      ],
+        dnl not found, revert back to clean variables
+        LDFLAGS=$CLEANLDFLAGS
+        LDFLAGSPC=$CLEANLDFLAGSPC
+        CPPFLAGS=$CLEANCPPFLAGS
+        LIBS=$CLEANLIBS
+    )
+  else
+    dnl no libuv pkg-config found, deal with it
+    if test "$want_libuv" != "default"; then
+      dnl To avoid link errors, we do not allow --with-libuv without
+      dnl a pkgconfig file
+      AC_MSG_ERROR([--with-libuv was specified but could not find libuv pkg-config file.])
+    fi
+  fi
 
-  AC_CHECK_LIB(msh3, MsH3ApiOpen,
-    [
-    AC_CHECK_HEADERS(msh3.h,
-        curl_h3_msg="enabled (msh3)"
-        MSH3_ENABLED=1
-        AC_DEFINE(USE_MSH3, 1, [if msh3 is in use])
-        AC_SUBST(USE_MSH3, [1])
-        CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$DIR_MSH3"
-        export CURL_LIBRARY_PATH
-        AC_MSG_NOTICE([Added $DIR_MSH3 to CURL_LIBRARY_PATH]),
-        experimental="$experimental HTTP3"
-     )
-    ],
-      dnl not found, revert back to clean variables
-      LDFLAGS=$CLEANLDFLAGS
-      CPPFLAGS=$CLEANCPPFLAGS
-      LIBS=$CLEANLIBS
-  )
 fi
 
 dnl **********************************************************************
@@ -3361,10 +3903,10 @@ AS_HELP_STRING([--with-zsh-functions-dir=PATH],[Install zsh completions to PATH]
 AS_HELP_STRING([--without-zsh-functions-dir],[Do not install zsh completions]),
   [OPT_ZSH_FPATH=$withval])
 case "$OPT_ZSH_FPATH" in
-  no)
+  default|no)
     dnl --without-zsh-functions-dir option used
     ;;
-  default|yes)
+  yes)
     dnl --with-zsh-functions-dir option used without path
     ZSH_FUNCTIONS_DIR="$datarootdir/zsh/site-functions"
     AC_SUBST(ZSH_FUNCTIONS_DIR)
@@ -3375,6 +3917,11 @@ case "$OPT_ZSH_FPATH" in
     AC_SUBST(ZSH_FUNCTIONS_DIR)
     ;;
 esac
+if test -z "$PERL" && test -n "$ZSH_FUNCTIONS_DIR"; then
+  AC_MSG_WARN([perl was not found. Cannot install zsh completions.])
+  ZSH_FUNCTIONS_DIR=''
+fi
+AM_CONDITIONAL(USE_ZSH_COMPLETION, test -n "$ZSH_FUNCTIONS_DIR")
 
 dnl **********************************************************************
 dnl Check for fish completion path
@@ -3386,14 +3933,14 @@ AS_HELP_STRING([--with-fish-functions-dir=PATH],[Install fish completions to PAT
 AS_HELP_STRING([--without-fish-functions-dir],[Do not install fish completions]),
   [OPT_FISH_FPATH=$withval])
 case "$OPT_FISH_FPATH" in
-  no)
+  default|no)
     dnl --without-fish-functions-dir option used
     ;;
-  default|yes)
+  yes)
     dnl --with-fish-functions-dir option used without path
     CURL_CHECK_PKGCONFIG(fish)
-    if test "$PKGCONFIG" != "no" ; then
-      FISH_FUNCTIONS_DIR="$($PKGCONFIG --variable completionsdir fish)"
+    if test "$PKGCONFIG" != "no"; then
+      FISH_FUNCTIONS_DIR=`$PKGCONFIG --variable completionsdir fish`
     else
       FISH_FUNCTIONS_DIR="$datarootdir/fish/vendor_completions.d"
     fi
@@ -3405,58 +3952,54 @@ case "$OPT_FISH_FPATH" in
     AC_SUBST(FISH_FUNCTIONS_DIR)
     ;;
 esac
+if test -z "$PERL" && test -n "$FISH_FUNCTIONS_DIR"; then
+  AC_MSG_WARN([perl was not found. Cannot install fish completions.])
+  FISH_FUNCTIONS_DIR=''
+fi
+AM_CONDITIONAL(USE_FISH_COMPLETION, test -n "$FISH_FUNCTIONS_DIR")
 
-dnl Now check for the very most basic headers. Then we can use these
+dnl Now check for the most basic headers. Then we can use these
 dnl ones as default-headers when checking for the rest!
 AC_CHECK_HEADERS(
-        sys/types.h \
-        sys/time.h \
-        sys/select.h \
-        sys/socket.h \
-        sys/ioctl.h \
-        sys/uio.h \
-        unistd.h \
-        stdlib.h \
-        arpa/inet.h \
-        net/if.h \
-        netinet/in.h \
-        netinet/in6.h \
-        sys/un.h \
-        linux/tcp.h \
-        netinet/tcp.h \
-        netinet/udp.h \
-        netdb.h \
-        sys/sockio.h \
-        sys/stat.h \
-        sys/param.h \
-        termios.h \
-        termio.h \
-        fcntl.h \
-        io.h \
-        pwd.h \
-        utime.h \
-        sys/utime.h \
-        sys/poll.h \
-        poll.h \
-        socket.h \
-        sys/resource.h \
-        libgen.h \
-        locale.h \
-        stdbool.h \
-        arpa/tftp.h \
-        sys/filio.h \
-        sys/wait.h \
-        setjmp.h,
-dnl to do if not found
+  sys/types.h \
+  sys/select.h \
+  sys/ioctl.h \
+  unistd.h \
+  arpa/inet.h \
+  net/if.h \
+  netinet/in.h \
+  netinet/in6.h \
+  sys/un.h \
+  linux/tcp.h \
+  netinet/tcp.h \
+  netinet/udp.h \
+  netdb.h \
+  sys/sockio.h \
+  sys/param.h \
+  termios.h \
+  termio.h \
+  fcntl.h \
+  io.h \
+  pwd.h \
+  utime.h \
+  sys/utime.h \
+  sys/poll.h \
+  poll.h \
+  sys/resource.h \
+  libgen.h \
+  locale.h \
+  stdbool.h \
+  sys/filio.h \
+  sys/eventfd.h,
 [],
-dnl to do if found
 [],
-dnl default includes
+/* default includes */
 [
+#include <stdlib.h>
 #ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
 #endif
-#ifdef HAVE_SYS_TIME_H
+#if !defined(_WIN32) || defined(__MINGW32__)
 #include <sys/time.h>
 #endif
 #ifdef HAVE_SYS_SELECT_H
@@ -3464,25 +4007,23 @@ dnl default includes
 #elif defined(HAVE_UNISTD_H)
 #include <unistd.h>
 #endif
-#ifdef HAVE_SYS_SOCKET_H
+#ifndef _WIN32
 #include <sys/socket.h>
 #endif
 #ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
 #endif
 #ifdef HAVE_NETINET_IN6_H
-#include <netinet/in6.h>
+#include <netinet/in6.h>  /* is this really required to detect other headers? */
 #endif
 #ifdef HAVE_SYS_UN_H
-#include <sys/un.h>
+#include <sys/un.h>  /* is this really required to detect other headers? */
 #endif
 ]
 )
 
-
 dnl Checks for typedefs, structures, and compiler characteristics.
 AC_C_CONST
-CURL_CHECK_VARIADIC_MACROS
 AC_TYPE_SIZE_T
 
 CURL_CHECK_STRUCT_TIMEVAL
@@ -3504,21 +4045,15 @@ CURL_SIZEOF(curl_socket_t, [
 ])
 CPPFLAGS=$o
 
-AC_CHECK_TYPE(long long,
-   [AC_DEFINE(HAVE_LONGLONG, 1,
-      [Define to 1 if the compiler supports the 'long long' data type.])]
-   longlong="yes"
-)
-
-if test ${ac_cv_sizeof_curl_off_t} -lt 8; then
-  AC_MSG_ERROR([64 bit curl_off_t is required])
+if test "$ac_cv_sizeof_curl_off_t" -lt 8; then
+  AC_MSG_ERROR([64-bit curl_off_t is required])
 fi
 
-# check for ssize_t
+dnl check for ssize_t
 AC_CHECK_TYPE(ssize_t, ,
-   AC_DEFINE(ssize_t, int, [the signed version of size_t]))
+  AC_DEFINE(ssize_t, int, [the signed version of size_t]))
 
-# check for bool type
+dnl check for bool type
 AC_CHECK_TYPE([bool],[
   AC_DEFINE(HAVE_BOOL_T, 1,
     [Define to 1 if bool is an available type.])
@@ -3531,27 +4066,16 @@ AC_CHECK_TYPE([bool],[
 #endif
 ])
 
-# check for sa_family_t
-AC_CHECK_TYPE(sa_family_t,
-   AC_DEFINE(CURL_SA_FAMILY_T, sa_family_t, [IP address type in sockaddr]),
-   [
-   # The windows name?
-   AC_CHECK_TYPE(ADDRESS_FAMILY,
-     AC_DEFINE(CURL_SA_FAMILY_T, ADDRESS_FAMILY, [IP address type in sockaddr]),
-     AC_DEFINE(CURL_SA_FAMILY_T, unsigned short, [IP address type in sockaddr]),
-    [
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
-    ])
-   ],
-[
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
-])
+if test "$curl_cv_native_windows" != "yes"; then
+  dnl check for sa_family_t
+  AC_CHECK_TYPE(sa_family_t,
+    AC_DEFINE(HAVE_SA_FAMILY_T, 1, [Define to 1 if symbol `sa_family_t' exists]),,
+  [
+  #include <sys/socket.h>
+  ])
+fi
 
-# check for suseconds_t
+dnl check for suseconds_t
 AC_CHECK_TYPE([suseconds_t],[
   AC_DEFINE(HAVE_SUSECONDS_T, 1,
     [Define to 1 if suseconds_t is an available type.])
@@ -3559,33 +4083,35 @@ AC_CHECK_TYPE([suseconds_t],[
 #ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
 #endif
-#ifdef HAVE_SYS_TIME_H
+#ifndef _WIN32
 #include <sys/time.h>
 #endif
 ])
 
-AC_MSG_CHECKING([if time_t is unsigned])
-CURL_RUN_IFELSE(
-  [
-  #include <time.h>
-  #include <limits.h>
-  int main(void) {
-    time_t t = -1;
-    return (t < 0);
-  }
-  ],[
-  AC_MSG_RESULT([yes])
-  AC_DEFINE(HAVE_TIME_T_UNSIGNED, 1, [Define this if time_t is unsigned])
-],[
-  AC_MSG_RESULT([no])
-],[
-  dnl cross-compiling, most systems are unsigned
-  AC_MSG_RESULT([no])
-])
-
-CURL_CONFIGURE_PULL_SYS_POLL
-
-TYPE_IN_ADDR_T
+case $host_os in
+  amigaos*|msdos*)
+    AC_DEFINE(HAVE_TIME_T_UNSIGNED, 1, [Define this if time_t is unsigned])
+    ;;
+  *)
+    AC_MSG_CHECKING([if time_t is unsigned])
+    CURL_RUN_IFELSE(
+      [
+      #include <time.h>
+      int main(void) {
+        time_t t = -1;
+        return t < 0;
+      }
+      ],[
+      AC_MSG_RESULT([yes])
+      AC_DEFINE(HAVE_TIME_T_UNSIGNED, 1, [Define this if time_t is unsigned])
+    ],[
+      AC_MSG_RESULT([no])
+    ],[
+      dnl cross-compiling, most systems are signed
+      AC_MSG_RESULT([no])
+    ])
+    ;;
+esac
 
 TYPE_SOCKADDR_STORAGE
 
@@ -3593,62 +4119,46 @@ CURL_CHECK_FUNC_SELECT
 
 CURL_CHECK_FUNC_RECV
 CURL_CHECK_FUNC_SEND
-CURL_CHECK_MSG_NOSIGNAL
 
 CURL_CHECK_FUNC_ALARM
 CURL_CHECK_FUNC_BASENAME
 CURL_CHECK_FUNC_CLOSESOCKET
 CURL_CHECK_FUNC_CLOSESOCKET_CAMEL
-CURL_CHECK_FUNC_CONNECT
 CURL_CHECK_FUNC_FCNTL
 CURL_CHECK_FUNC_FREEADDRINFO
 CURL_CHECK_FUNC_FSETXATTR
-CURL_CHECK_FUNC_FTRUNCATE
 CURL_CHECK_FUNC_GETADDRINFO
-CURL_CHECK_FUNC_GETHOSTBYNAME
 CURL_CHECK_FUNC_GETHOSTBYNAME_R
 CURL_CHECK_FUNC_GETHOSTNAME
+CURL_CHECK_FUNC_GETIFADDRS
 CURL_CHECK_FUNC_GETPEERNAME
 CURL_CHECK_FUNC_GETSOCKNAME
-CURL_CHECK_FUNC_IF_NAMETOINDEX
-CURL_CHECK_FUNC_GETIFADDRS
 CURL_CHECK_FUNC_GMTIME_R
-CURL_CHECK_FUNC_INET_NTOP
-CURL_CHECK_FUNC_INET_PTON
+CURL_CHECK_FUNC_IOCTL
 CURL_CHECK_FUNC_IOCTLSOCKET
 CURL_CHECK_FUNC_IOCTLSOCKET_CAMEL
+CURL_CHECK_FUNC_LOCALTIME_R
 CURL_CHECK_FUNC_MEMRCHR
-CURL_CHECK_FUNC_POLL
 CURL_CHECK_FUNC_SIGACTION
 CURL_CHECK_FUNC_SIGINTERRUPT
 CURL_CHECK_FUNC_SIGNAL
 CURL_CHECK_FUNC_SIGSETJMP
 CURL_CHECK_FUNC_SOCKET
 CURL_CHECK_FUNC_SOCKETPAIR
-CURL_CHECK_FUNC_STRCASECMP
-CURL_CHECK_FUNC_STRCMPI
-CURL_CHECK_FUNC_STRDUP
 CURL_CHECK_FUNC_STRERROR_R
-CURL_CHECK_FUNC_STRICMP
-CURL_CHECK_FUNC_STRTOK_R
-CURL_CHECK_FUNC_STRTOLL
 
 case $host in
   *msdosdjgpp)
-     ac_cv_func_pipe=no
-     skipcheck_pipe=yes
-     AC_MSG_NOTICE([skip check for pipe on msdosdjgpp])
+    ac_cv_func_pipe=no
+    skipcheck_pipe=yes
+    AC_MSG_NOTICE([skip check for pipe on msdosdjgpp])
     ;;
 esac
 
-AC_CHECK_DECLS([getpwuid_r], [], [AC_DEFINE(HAVE_DECL_GETPWUID_R_MISSING, 1, "Set if getpwuid_r() declaration is missing")],
-        [[#include <pwd.h>
-          #include <sys/types.h>]])
-
-
-AC_CHECK_FUNCS([fnmatch \
-  fchmod \
-  fork \
+AC_CHECK_FUNCS([\
+  accept4 \
+  eventfd \
+  fnmatch \
   geteuid \
   getpass_r \
   getppid \
@@ -3656,156 +4166,90 @@ AC_CHECK_FUNCS([fnmatch \
   getpwuid_r \
   getrlimit \
   gettimeofday \
-  if_nametoindex \
   mach_absolute_time \
   pipe \
-  sched_yield \
+  poll \
+  sendmmsg \
   sendmsg \
   setlocale \
-  setmode \
   setrlimit \
-  snprintf \
   utime \
   utimes \
-  arc4random
-],[
-],[
-  func="$ac_func"
-  eval skipcheck=\$skipcheck_$func
-  if test "x$skipcheck" != "xyes"; then
-    AC_MSG_CHECKING([deeper for $func])
-    AC_LINK_IFELSE([
-      AC_LANG_PROGRAM([[
-      ]],[[
-        $func ();
-      ]])
-    ],[
-      AC_MSG_RESULT([yes])
-      eval "ac_cv_func_$func=yes"
-      AC_DEFINE_UNQUOTED(XC_SH_TR_CPP([HAVE_$func]), [1],
-        [Define to 1 if you have the $func function.])
-    ],[
-      AC_MSG_RESULT([but still no])
-    ])
-  fi
 ])
 
+if test "$curl_cv_apple" != "yes"; then
+  dnl Apple platforms do not offer pipe2(), but the iPhone Simulator-specific
+  dnl /usr/lib/system/libsystem_sim_kernel.dylib exports it. To avoid false
+  dnl detection, omit this feature check for Apple targets.
+  AC_CHECK_FUNCS([\
+    pipe2 \
+  ])
+fi
+
+if test "$curl_cv_native_windows" != "yes"; then
+  AC_CHECK_FUNCS([\
+    if_nametoindex \
+    realpath \
+    sched_yield \
+  ])
+  CURL_CHECK_FUNC_INET_NTOP
+  CURL_CHECK_FUNC_INET_PTON
+  CURL_CHECK_FUNC_STRCASECMP
+  CURL_CHECK_FUNC_STRCMPI
+  CURL_CHECK_FUNC_STRICMP
+
+  CURL_CHECK_FUNC_MEMSET_S
+  if test "$curl_cv_func_memset_s" = "no"; then
+    AC_CHECK_FUNCS([memset_explicit])
+  fi
+fi
+
+if test -z "$ssl_backends"; then
+  AC_CHECK_FUNCS([arc4random])
+fi
+
+if test "$curl_cv_native_windows" != "yes"; then
+  AC_CHECK_FUNCS([fseeko])
+
+  dnl On Android, the only way to know if fseeko can be used is to see if it is
+  dnl declared or not (for this API level), as the symbol always exists in the
+  dnl lib.
+  AC_CHECK_DECL([fseeko],
+    [AC_DEFINE([HAVE_DECL_FSEEKO], [1],
+     [Define to 1 if you have the fseeko declaration])],
+    [],
+    [[#include <stdio.h>]])
+fi
+
 CURL_CHECK_NONBLOCKING_SOCKET
 
-dnl ************************************************************
-dnl nroff tool stuff
-dnl
-
-AC_PATH_PROG( PERL, perl, ,
-  $PATH:/usr/local/bin/perl:/usr/bin/:/usr/local/bin )
-AC_SUBST(PERL)
-
-AC_PATH_PROGS( NROFF, gnroff nroff, ,
-  $PATH:/usr/bin/:/usr/local/bin )
-AC_SUBST(NROFF)
-
-if test -n "$NROFF"; then
-  dnl only check for nroff options if an nroff command was found
-
-  AC_MSG_CHECKING([how to use *nroff to get plain text from man pages])
-  MANOPT="-man"
-  mancheck=`echo foo | $NROFF $MANOPT 2>/dev/null`
-  if test -z "$mancheck"; then
-    MANOPT="-mandoc"
-   mancheck=`echo foo | $NROFF $MANOPT 2>/dev/null`
-    if test -z "$mancheck"; then
-      MANOPT=""
-      AC_MSG_RESULT([failed])
-      AC_MSG_WARN([found no *nroff option to get plaintext from man pages])
-    else
-      AC_MSG_RESULT([$MANOPT])
-    fi
-  else
-    AC_MSG_RESULT([$MANOPT])
-  fi
-  AC_SUBST(MANOPT)
-fi
-
-if test -z "$MANOPT"
-then
-  dnl if no nroff tool was found, or no option that could convert man pages
-  dnl was found, then disable the built-in manual stuff
-  AC_MSG_WARN([disabling built-in manual])
-  USE_MANUAL="no";
-fi
+dnl set variable for use in automakefile(s)
+AM_CONDITIONAL(BUILD_DOCS, test "$BUILD_DOCS" = "1")
 
 dnl *************************************************************************
 dnl If the manual variable still is set, then we go with providing a built-in
 dnl manual
 
 if test "$USE_MANUAL" = "1"; then
-  AC_DEFINE(USE_MANUAL, 1, [If you want to build curl with the built-in manual])
   curl_manual_msg="enabled"
 fi
 
 dnl set variable for use in automakefile(s)
-AM_CONDITIONAL(USE_MANUAL, test x"$USE_MANUAL" = x1)
+AM_CONDITIONAL(USE_MANUAL, test "$USE_MANUAL" = "1")
 
 CURL_CHECK_LIB_ARES
+CURL_CHECK_OPTION_THREADED_RESOLVER
 
-if test "x$curl_cv_native_windows" != "xyes" &&
-   test "x$enable_shared" = "xyes"; then
-  build_libhostname=yes
-else
-  build_libhostname=no
-fi
-AM_CONDITIONAL(BUILD_LIBHOSTNAME, test x$build_libhostname = xyes)
-
-if test "x$want_ares" != xyes; then
-  CURL_CHECK_OPTION_THREADED_RESOLVER
-fi
-
-dnl ************************************************************
-dnl disable POSIX threads
-dnl
-AC_MSG_CHECKING([whether to use POSIX threads for threaded resolver])
-AC_ARG_ENABLE(pthreads,
-AS_HELP_STRING([--enable-pthreads],
-               [Enable POSIX threads (default for threaded resolver)])
-AS_HELP_STRING([--disable-pthreads],[Disable POSIX threads]),
-[ case "$enableval" in
-  no)  AC_MSG_RESULT(no)
-       want_pthreads=no
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       want_pthreads=yes
-       ;;
-  esac ], [
-       AC_MSG_RESULT(auto)
-       want_pthreads=auto
-       ]
-)
-
-dnl turn off pthreads if rt is disabled
-if test "$want_pthreads" != "no"; then
-  if test "$want_pthreads" = "yes" && test "$dontwant_rt" = "yes"; then
-    AC_MSG_ERROR([options --enable-pthreads and --disable-rt are mutually exclusive])
-  fi
-  if test "$dontwant_rt" != "no"; then
-    dnl if --enable-pthreads was explicit then warn it's being ignored
-    if test "$want_pthreads" = "yes"; then
-      AC_MSG_WARN([--enable-pthreads Ignored since librt is disabled.])
-    fi
-    want_pthreads=no
-  fi
-fi
-
-dnl turn off pthreads if no threaded resolver
-if test "$want_pthreads" != "no" && test "$want_thres" != "yes"; then
-  want_pthreads=no
+if test "$ipv6" = "yes" && test "$curl_cv_apple" = "yes"; then
+  CURL_DARWIN_SYSTEMCONFIGURATION
 fi
 
 dnl detect pthreads
-if test "$want_pthreads" != "no"; then
+if test "$curl_cv_native_windows" != "yes"; then
   AC_CHECK_HEADER(pthread.h,
-    [ AC_DEFINE(HAVE_PTHREAD_H, 1, [if you have <pthread.h>])
+    [
       save_CFLAGS="$CFLAGS"
-      dnl When statically linking against boringssl, -lpthread is added to LIBS.
+      dnl When statically linking against BoringSSL, -lpthread is added to LIBS.
       dnl Make sure to that this does not pass the check below, we really want
       dnl -pthread in CFLAGS as recommended for GCC. This also ensures that
       dnl lib1541 and lib1565 tests are built with these options. Otherwise
@@ -3814,73 +4258,98 @@ if test "$want_pthreads" != "no"; then
 
       LIBS=
       dnl Check for libc variants without a separate pthread lib like bionic
-      AC_CHECK_FUNC(pthread_create, [USE_THREADS_POSIX=1] )
+      AC_CHECK_FUNC(pthread_create, [HAVE_THREADS_POSIX=1] )
       LIBS="$save_LIBS"
 
-      dnl on HPUX, life is more complicated...
       case $host in
-      *-hp-hpux*)
-         dnl it doesn't actually work without -lpthread
-         USE_THREADS_POSIX=""
-         ;;
-      *)
-         ;;
+        *-hp-hpux*)
+          CFLAGS="$CFLAGS -mt"
+          ;;
+        *)
+          ;;
       esac
 
-      dnl if it wasn't found without lib, search for it in pthread lib
-      if test "$USE_THREADS_POSIX" != "1"
-      then
-        # assign PTHREAD for pkg-config use
+      dnl if it was not found without lib, search for it in pthread lib
+      if test "$HAVE_THREADS_POSIX" != "1"; then
+        dnl assign PTHREAD for pkg-config use
         PTHREAD=" -pthread"
 
         case $host in
-        *-ibm-aix*)
-           dnl Check if compiler is xlC
-           COMPILER_VERSION=`"$CC" -qversion 2>/dev/null`
-           if test x"$COMPILER_VERSION" = "x"; then
-             CFLAGS="$CFLAGS -pthread"
-           else
-             CFLAGS="$CFLAGS -qthreaded"
-           fi
-           ;;
-        powerpc-*amigaos*)
-           dnl No -pthread option, but link with -lpthread
-           PTHREAD=" -lpthread"
-           ;;
-        *)
-           CFLAGS="$CFLAGS -pthread"
-           ;;
+          *-ibm-aix*)
+            dnl Check if compiler is xlC
+            COMPILER_VERSION=`"$CC" -qversion 2>/dev/null`
+            if test -z "$COMPILER_VERSION"; then
+              CFLAGS="$CFLAGS -pthread"
+            else
+              CFLAGS="$CFLAGS -qthreaded"
+            fi
+            ;;
+          powerpc-*amigaos*)
+            dnl No -pthread option, but link with -lpthread
+            PTHREAD=" -lpthread"
+            ;;
+          *)
+            CFLAGS="$CFLAGS -pthread"
+            ;;
         esac
         AC_CHECK_LIB(pthread, pthread_create,
-                     [USE_THREADS_POSIX=1],
+                     [HAVE_THREADS_POSIX=1],
                      [ CFLAGS="$save_CFLAGS"])
       fi
-
-      if test "x$USE_THREADS_POSIX" = "x1"
-      then
-        AC_DEFINE(USE_THREADS_POSIX, 1, [if you want POSIX threaded DNS lookup])
-        curl_res_msg="POSIX threaded"
-      fi
   ])
+  if test "$HAVE_THREADS_POSIX" = "1"; then
+    AC_DEFINE(HAVE_THREADS_POSIX, 1, [if POSIX pthreads are supported])
+  fi
 fi
 
 dnl threaded resolver check
-if test "$want_thres" = "yes" && test "x$USE_THREADS_POSIX" != "x1"; then
-  if test "$want_pthreads" = "yes"; then
-    AC_MSG_ERROR([--enable-pthreads but pthreads was not found])
-  fi
-  dnl If native Windows fallback on Win32 threads since no POSIX threads
+if test "$want_threaded_resolver" = "yes"; then
   if test "$curl_cv_native_windows" = "yes"; then
-    USE_THREADS_WIN32=1
-    AC_DEFINE(USE_THREADS_WIN32, 1, [if you want Win32 threaded DNS lookup])
+    USE_RESOLV_THREADED=1
+    AC_DEFINE(USE_RESOLV_THREADED, 1, [if you want threaded DNS lookup])
     curl_res_msg="Win32 threaded"
+  elif test "$HAVE_THREADS_POSIX" = "1"; then
+    USE_RESOLV_THREADED=1
+    AC_DEFINE(USE_RESOLV_THREADED, 1, [if you want threaded DNS lookup])
+    curl_res_msg="POSIX threaded"
   else
     AC_MSG_ERROR([Threaded resolver enabled but no thread library found])
   fi
+elif test "$USE_ARES" = "1"; then
+  USE_RESOLV_ARES=1
+  AC_DEFINE(USE_RESOLV_ARES, 1, [if you want c-ares for DNS lookup])
+  curl_res_msg="c-ares"
 fi
 
+AC_CHECK_HEADER(dirent.h,
+  [ AC_DEFINE(HAVE_DIRENT_H, 1, [if you have <dirent.h>])
+    AC_CHECK_FUNC(opendir, AC_DEFINE(HAVE_OPENDIR, 1, [if you have opendir]) )
+  ]
+)
+
 CURL_CONVERT_INCLUDE_TO_ISYSTEM
 
+dnl ************************************************************
+dnl disable curl_easy_setopt()/curl_easy_getinfo() type checking
+dnl
+AC_MSG_CHECKING([whether to enable curl_easy_setopt()/curl_easy_getinfo() type checking])
+AC_ARG_ENABLE(typecheck,
+AS_HELP_STRING([--enable-typecheck],[Enable type checking (default)])
+AS_HELP_STRING([--disable-typecheck],[Disable type checking]),
+[ case "$enableval" in
+  no)
+    AC_MSG_RESULT(no)
+    dnl Set it via the command-line to make it apply to examples also.
+    CPPFLAGS="$CPPFLAGS -DCURL_DISABLE_TYPECHECK"
+    curl_typecheck_msg="no"
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
+  esac ],
+    AC_MSG_RESULT(yes)
+)
+
 dnl ************************************************************
 dnl disable verbose text strings
 dnl
@@ -3890,51 +4359,58 @@ AS_HELP_STRING([--enable-verbose],[Enable verbose strings])
 AS_HELP_STRING([--disable-verbose],[Disable verbose strings]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_VERBOSE_STRINGS, 1, [to disable verbose strings])
-       curl_verbose_msg="no"
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_VERBOSE_STRINGS, 1, [to disable verbose strings])
+    curl_verbose_msg="no"
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
-dnl ************************************************************
-dnl enable SSPI support
-dnl
-AC_MSG_CHECKING([whether to enable SSPI support (Windows native builds only)])
-AC_ARG_ENABLE(sspi,
-AS_HELP_STRING([--enable-sspi],[Enable SSPI])
+if test "$curl_cv_winuwp" != "yes"; then
+  dnl ************************************************************
+  dnl enable SSPI support
+  dnl
+  AC_MSG_CHECKING([whether to enable SSPI support (Windows native builds only)])
+  AC_ARG_ENABLE(sspi,
+  AS_HELP_STRING([--enable-sspi],[Enable SSPI])
 AS_HELP_STRING([--disable-sspi],[Disable SSPI]),
-[ case "$enableval" in
-  yes)
-       if test "$curl_cv_native_windows" = "yes"; then
-         AC_MSG_RESULT(yes)
-         AC_DEFINE(USE_WINDOWS_SSPI, 1, [to enable SSPI support])
-         AC_SUBST(USE_WINDOWS_SSPI, [1])
-         curl_sspi_msg="enabled"
-       else
-         AC_MSG_RESULT(no)
-         AC_MSG_WARN([--enable-sspi Ignored. Only supported on native Windows builds.])
-       fi
-       ;;
-  *)
-       if test "x$SCHANNEL_ENABLED" = "x1"; then
-         # --with-schannel implies --enable-sspi
-         AC_MSG_RESULT(yes)
-       else
-         AC_MSG_RESULT(no)
-       fi
-       ;;
-  esac ],
-       if test "x$SCHANNEL_ENABLED" = "x1"; then
-         # --with-schannel implies --enable-sspi
-         AC_MSG_RESULT(yes)
-       else
-         AC_MSG_RESULT(no)
-       fi
-)
+  [ case "$enableval" in
+    yes)
+      if test "$curl_cv_native_windows" = "yes"; then
+        AC_MSG_RESULT(yes)
+        AC_DEFINE(USE_WINDOWS_SSPI, 1, [to enable SSPI support])
+        USE_WINDOWS_SSPI=1
+        curl_sspi_msg="enabled"
+      else
+        AC_MSG_RESULT(no)
+        AC_MSG_WARN([--enable-sspi Ignored. Only supported on native Windows builds.])
+      fi
+      ;;
+    *)
+      if test "$SCHANNEL_ENABLED" = "1"; then
+        dnl --with-schannel implies --enable-sspi
+        AC_MSG_RESULT(yes)
+      else
+        AC_MSG_RESULT(no)
+      fi
+      ;;
+    esac ],
+      if test "$SCHANNEL_ENABLED" = "1"; then
+        dnl --with-schannel implies --enable-sspi
+        AC_MSG_RESULT(yes)
+      else
+        AC_MSG_RESULT(no)
+      fi
+  )
+
+  if test "$USE_WINDOWS_SSPI" = "1"; then
+    LIBS="-lsecur32 $LIBS"
+  fi
+fi
 
 dnl ************************************************************
 dnl disable basic authentication
@@ -3945,14 +4421,14 @@ AS_HELP_STRING([--enable-basic-auth],[Enable basic authentication (default)])
 AS_HELP_STRING([--disable-basic-auth],[Disable basic authentication]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_BASIC_AUTH, 1, [to disable basic authentication])
-       CURL_DISABLE_BASIC_AUTH=1
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_BASIC_AUTH, 1, [to disable basic authentication])
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 dnl ************************************************************
@@ -3964,14 +4440,14 @@ AS_HELP_STRING([--enable-bearer-auth],[Enable bearer authentication (default)])
 AS_HELP_STRING([--disable-bearer-auth],[Disable bearer authentication]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_BEARER_AUTH, 1, [to disable bearer authentication])
-       CURL_DISABLE_BEARER_AUTH=1
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_BEARER_AUTH, 1, [to disable bearer authentication])
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 dnl ************************************************************
@@ -3983,14 +4459,14 @@ AS_HELP_STRING([--enable-digest-auth],[Enable digest authentication (default)])
 AS_HELP_STRING([--disable-digest-auth],[Disable digest authentication]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_DIGEST_AUTH, 1, [to disable digest authentication])
-       CURL_DISABLE_DIGEST_AUTH=1
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_DIGEST_AUTH, 1, [to disable digest authentication])
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 dnl ************************************************************
@@ -4002,14 +4478,15 @@ AS_HELP_STRING([--enable-kerberos-auth],[Enable kerberos authentication (default
 AS_HELP_STRING([--disable-kerberos-auth],[Disable kerberos authentication]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_KERBEROS_AUTH, 1, [to disable kerberos authentication])
-       CURL_DISABLE_KERBEROS_AUTH=1
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_KERBEROS_AUTH, 1, [to disable kerberos authentication])
+    CURL_DISABLE_KERBEROS_AUTH=1
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 dnl ************************************************************
@@ -4021,17 +4498,17 @@ AS_HELP_STRING([--enable-negotiate-auth],[Enable negotiate authentication (defau
 AS_HELP_STRING([--disable-negotiate-auth],[Disable negotiate authentication]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_NEGOTIATE_AUTH, 1, [to disable negotiate authentication])
-       CURL_DISABLE_NEGOTIATE_AUTH=1
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_NEGOTIATE_AUTH, 1, [to disable negotiate authentication])
+    CURL_DISABLE_NEGOTIATE_AUTH=1
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
-
 dnl ************************************************************
 dnl disable aws
 dnl
@@ -4041,14 +4518,14 @@ AS_HELP_STRING([--enable-aws],[Enable AWS sig support (default)])
 AS_HELP_STRING([--disable-aws],[Disable AWS sig support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_AWS, 1, [to disable AWS sig support])
-       CURL_DISABLE_AWS=1
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_AWS, 1, [to disable AWS sig support])
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 dnl ************************************************************
@@ -4059,21 +4536,18 @@ AC_ARG_ENABLE(ntlm,
 AS_HELP_STRING([--enable-ntlm],[Enable NTLM support])
 AS_HELP_STRING([--disable-ntlm],[Disable NTLM support]),
 [ case "$enableval" in
-  no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_NTLM, 1, [to disable NTLM support])
-       CURL_DISABLE_NTLM=1
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+  yes)
+    AC_MSG_RESULT(yes)
+    AC_DEFINE(CURL_ENABLE_NTLM, 1, [enable NTLM support])
+    CURL_ENABLE_NTLM=1
+    ;;
+  *)
+    AC_MSG_RESULT(no)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(no)
 )
 
-CURL_CHECK_OPTION_NTLM_WB
-
-CURL_CHECK_NTLM_WB
-
 dnl ************************************************************
 dnl disable TLS-SRP authentication
 dnl
@@ -4083,21 +4557,22 @@ AS_HELP_STRING([--enable-tls-srp],[Enable TLS-SRP authentication])
 AS_HELP_STRING([--disable-tls-srp],[Disable TLS-SRP authentication]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       want_tls_srp=no
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       want_tls_srp=yes
-       ;;
+    AC_MSG_RESULT(no)
+    want_tls_srp=no
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    want_tls_srp=yes
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
-       want_tls_srp=yes
+    AC_MSG_RESULT(yes)
+    want_tls_srp=yes
 )
 
-if test "$want_tls_srp" = "yes" && ( test "x$HAVE_GNUTLS_SRP" = "x1" || test "x$HAVE_OPENSSL_SRP" = "x1") ; then
-   AC_DEFINE(USE_TLS_SRP, 1, [Use TLS-SRP authentication])
-   USE_TLS_SRP=1
-   curl_tls_srp_msg="enabled"
+if test "$want_tls_srp" = "yes" && (test "$HAVE_GNUTLS_SRP" = "1" || test "$HAVE_OPENSSL_SRP" = "1"); then
+  AC_DEFINE(USE_TLS_SRP, 1, [Use TLS-SRP authentication])
+  USE_TLS_SRP=1
+  curl_tls_srp_msg="enabled"
 fi
 
 dnl ************************************************************
@@ -4108,29 +4583,31 @@ AC_ARG_ENABLE(unix-sockets,
 AS_HELP_STRING([--enable-unix-sockets],[Enable Unix domain sockets])
 AS_HELP_STRING([--disable-unix-sockets],[Disable Unix domain sockets]),
 [ case "$enableval" in
-  no)  AC_MSG_RESULT(no)
-       want_unix_sockets=no
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       want_unix_sockets=yes
-       ;;
+  no)
+    AC_MSG_RESULT(no)
+    want_unix_sockets=no
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    want_unix_sockets=yes
+    ;;
   esac ], [
-       AC_MSG_RESULT(auto)
-       want_unix_sockets=auto
-       ]
+    AC_MSG_RESULT(auto)
+    want_unix_sockets=auto
+    ]
 )
-if test "x$want_unix_sockets" != "xno"; then
-  if test "x$curl_cv_native_windows" = "xyes"; then
+if test "$want_unix_sockets" != "no"; then
+  if test "$curl_cv_native_windows" = "yes"; then
     USE_UNIX_SOCKETS=1
     AC_DEFINE(USE_UNIX_SOCKETS, 1, [Use Unix domain sockets])
     curl_unix_sockets_msg="enabled"
   else
     AC_CHECK_MEMBER([struct sockaddr_un.sun_path], [
       AC_DEFINE(USE_UNIX_SOCKETS, 1, [Use Unix domain sockets])
-      AC_SUBST(USE_UNIX_SOCKETS, [1])
+      USE_UNIX_SOCKETS=1
       curl_unix_sockets_msg="enabled"
     ], [
-      if test "x$want_unix_sockets" = "xyes"; then
+      if test "$want_unix_sockets" = "yes"; then
         AC_MSG_ERROR([--enable-unix-sockets is not available on this platform!])
       fi
     ], [
@@ -4148,13 +4625,14 @@ AS_HELP_STRING([--enable-cookies],[Enable cookies support])
 AS_HELP_STRING([--disable-cookies],[Disable cookies support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_COOKIES, 1, [to disable cookies support])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_COOKIES, 1, [to disable cookies support])
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 dnl ************************************************************
@@ -4166,13 +4644,14 @@ AS_HELP_STRING([--enable-socketpair],[Enable socketpair support])
 AS_HELP_STRING([--disable-socketpair],[Disable socketpair support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_SOCKETPAIR, 1, [to disable socketpair support])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_SOCKETPAIR, 1, [to disable socketpair support])
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 dnl ************************************************************
@@ -4184,13 +4663,14 @@ AS_HELP_STRING([--enable-http-auth],[Enable HTTP authentication support])
 AS_HELP_STRING([--disable-http-auth],[Disable HTTP authentication support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_HTTP_AUTH, 1, [disable HTTP authentication])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_HTTP_AUTH, 1, [disable HTTP authentication])
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 dnl ************************************************************
@@ -4202,13 +4682,14 @@ AS_HELP_STRING([--enable-doh],[Enable DoH support])
 AS_HELP_STRING([--disable-doh],[Disable DoH support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_DOH, 1, [disable DoH])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_DOH, 1, [disable DoH])
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 dnl ************************************************************
@@ -4220,13 +4701,14 @@ AS_HELP_STRING([--enable-mime],[Enable mime API support])
 AS_HELP_STRING([--disable-mime],[Disable mime API support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_MIME, 1, [disable mime API])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_MIME, 1, [disable mime API])
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 dnl ************************************************************
@@ -4238,13 +4720,14 @@ AS_HELP_STRING([--enable-bindlocal],[Enable local binding support])
 AS_HELP_STRING([--disable-bindlocal],[Disable local binding support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_BINDLOCAL, 1, [disable local binding support])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_BINDLOCAL, 1, [disable local binding support])
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 dnl ************************************************************
@@ -4255,16 +4738,18 @@ AC_ARG_ENABLE(form-api,
 AS_HELP_STRING([--enable-form-api],[Enable form API support])
 AS_HELP_STRING([--disable-form-api],[Disable form API support]),
 [ case "$enableval" in
-  no)  AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_FORM_API, 1, [disable form API])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       test "$enable_mime" = no &&
-         AC_MSG_ERROR(MIME support needs to be enabled in order to enable form API support)
-       ;;
+  no)
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_FORM_API, 1, [disable form API])
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    test "x$enable_mime" = "xno" &&
+      AC_MSG_ERROR(MIME support needs to be enabled in order to enable form API support)
+    ;;
   esac ],
 [
-  if test "$enable_mime" = no; then
+  if test "x$enable_mime" = "xno"; then
     enable_form_api=no
     AC_MSG_RESULT(no)
     AC_DEFINE(CURL_DISABLE_FORM_API, 1, [disable form API])
@@ -4282,13 +4767,14 @@ AS_HELP_STRING([--enable-dateparse],[Enable date parsing])
 AS_HELP_STRING([--disable-dateparse],[Disable date parsing]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_PARSEDATE, 1, [disable date parsing])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_PARSEDATE, 1, [disable date parsing])
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 dnl ************************************************************
@@ -4300,13 +4786,14 @@ AS_HELP_STRING([--enable-netrc],[Enable netrc parsing])
 AS_HELP_STRING([--disable-netrc],[Disable netrc parsing]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_NETRC, 1, [disable netrc parsing])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_NETRC, 1, [disable netrc parsing])
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 dnl ************************************************************
@@ -4318,13 +4805,33 @@ AS_HELP_STRING([--enable-progress-meter],[Enable progress-meter])
 AS_HELP_STRING([--disable-progress-meter],[Disable progress-meter]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_PROGRESS_METER, 1, [disable progress-meter])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_PROGRESS_METER, 1, [disable progress-meter])
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
+)
+
+dnl ************************************************************
+dnl disable SHA-512/256 hash algorithm
+dnl
+AC_MSG_CHECKING([whether to support the SHA-512/256 hash algorithm])
+AC_ARG_ENABLE(sha512-256,
+AS_HELP_STRING([--enable-sha512-256],[Enable SHA-512/256 hash algorithm (default)])
+AS_HELP_STRING([--disable-sha512-256],[Disable SHA-512/256 hash algorithm]),
+[ case "$enableval" in
+  no)
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_SHA512_256, 1, [disable SHA-512/256 hash algorithm])
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
+  esac ],
+    AC_MSG_RESULT(yes)
 )
 
 dnl ************************************************************
@@ -4336,13 +4843,14 @@ AS_HELP_STRING([--enable-dnsshuffle],[Enable DNS shuffling])
 AS_HELP_STRING([--disable-dnsshuffle],[Disable DNS shuffling]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_SHUFFLE_DNS, 1, [disable DNS shuffling])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_SHUFFLE_DNS, 1, [disable DNS shuffling])
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 dnl ************************************************************
@@ -4354,13 +4862,14 @@ AS_HELP_STRING([--enable-get-easy-options],[Enable curl_easy_options])
 AS_HELP_STRING([--disable-get-easy-options],[Disable curl_easy_options]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_GETOPTIONS, 1, [to disable curl_easy_options])
-       ;;
-  *)   AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_GETOPTIONS, 1, [to disable curl_easy_options])
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 dnl ************************************************************
@@ -4372,15 +4881,16 @@ AS_HELP_STRING([--enable-alt-svc],[Enable alt-svc support])
 AS_HELP_STRING([--disable-alt-svc],[Disable alt-svc support]),
 [ case "$enableval" in
   no)
-       AC_MSG_RESULT(no)
-       AC_DEFINE(CURL_DISABLE_ALTSVC, 1, [disable alt-svc])
-       curl_altsvc_msg="no";
-       enable_altsvc="no"
-       ;;
-  *) AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(no)
+    AC_DEFINE(CURL_DISABLE_ALTSVC, 1, [disable alt-svc])
+    curl_altsvc_msg="no";
+    enable_altsvc="no"
+    ;;
+  *)
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
 dnl ************************************************************
@@ -4391,18 +4901,19 @@ AC_ARG_ENABLE(headers-api,
 AS_HELP_STRING([--enable-headers-api],[Enable headers-api support])
 AS_HELP_STRING([--disable-headers-api],[Disable headers-api support]),
 [ case "$enableval" in
-  no) AC_MSG_RESULT(no)
-       curl_headers_msg="no      (--enable-headers-api)"
-       AC_DEFINE(CURL_DISABLE_HEADERS_API, 1, [disable headers-api])
-       ;;
+  no)
+    AC_MSG_RESULT(no)
+    curl_headers_msg="no      (--enable-headers-api)"
+    AC_DEFINE(CURL_DISABLE_HEADERS_API, 1, [disable headers-api])
+    ;;
   *)
-       AC_MSG_RESULT(yes)
-       ;;
+    AC_MSG_RESULT(yes)
+    ;;
   esac ],
-       AC_MSG_RESULT(yes)
+    AC_MSG_RESULT(yes)
 )
 
-dnl only check for HSTS if there's SSL present
+dnl only check for HSTS if there is SSL present
 if test -n "$SSL_ENABLED"; then
   dnl ************************************************************
   dnl switch on/off hsts
@@ -4413,20 +4924,21 @@ AS_HELP_STRING([--enable-hsts],[Enable HSTS support])
 AS_HELP_STRING([--disable-hsts],[Disable HSTS support]),
   [ case "$enableval" in
     no)
-       AC_MSG_RESULT(no)
-       hsts="no"
-       ;;
-    *) AC_MSG_RESULT(yes)
-       ;;
+      AC_MSG_RESULT(no)
+      hsts="no"
+      ;;
+    *)
+      AC_MSG_RESULT(yes)
+      ;;
     esac ],
-       AC_MSG_RESULT($hsts)
+      AC_MSG_RESULT($hsts)
   )
 else
   AC_MSG_NOTICE([disables HSTS due to lack of SSL])
   hsts="no"
 fi
 
-if test "x$hsts" != "xyes"; then
+if test "$hsts" != "yes"; then
   curl_hsts_msg="no      (--enable-hsts)";
   AC_DEFINE(CURL_DISABLE_HSTS, 1, [disable alt-svc])
 fi
@@ -4434,71 +4946,149 @@ fi
 dnl *************************************************************
 dnl check whether ECH support, if desired, is actually available
 dnl
-if test "x$want_ech" != "xno"; then
+if test "$want_ech" != "no"; then
   AC_MSG_CHECKING([whether ECH support is available])
 
   dnl assume NOT and look for sufficient condition
   ECH_ENABLED=0
+  ECH_ENABLED_OPENSSL=0
+  ECH_ENABLED_WOLFSSL=0
+  ECH_ENABLED_RUSTLS=0
   ECH_SUPPORT=''
 
-  dnl OpenSSL with a chosen ECH function should be enough
-  dnl so more exhaustive checking seems unnecessary for now
-  if test "x$OPENSSL_ENABLED" = "x1"; then
-    AC_CHECK_FUNCS(SSL_get_ech_status,
-      ECH_SUPPORT="ECH support available (OpenSSL with SSL_get_ech_status)"
-      ECH_ENABLED=1)
-
-  dnl add 'elif' chain here for additional implementations
+  dnl check for OpenSSL equivalent
+  if test "$OPENSSL_ENABLED" = "1"; then
+    AC_CHECK_FUNCS(SSL_set1_ech_config_list,
+      ECH_SUPPORT="$ECH_SUPPORT OpenSSL"
+      ECH_ENABLED_OPENSSL=1)
+  fi
+  if test "$WOLFSSL_ENABLED" = "1"; then
+    AC_CHECK_FUNCS(wolfSSL_CTX_GenerateEchConfig,
+      ECH_SUPPORT="$ECH_SUPPORT wolfSSL"
+      ECH_ENABLED_WOLFSSL=1)
+  fi
+  if test "$RUSTLS_ENABLED" = "1"; then
+    ECH_SUPPORT="$ECH_SUPPORT rustls-ffi"
+    ECH_ENABLED_RUSTLS=1
   fi
 
   dnl now deal with whatever we found
-  if test "x$ECH_ENABLED" = "x1"; then
+  if test "$ECH_ENABLED_OPENSSL" = "1" ||
+     test "$ECH_ENABLED_WOLFSSL" = "1" ||
+     test "$ECH_ENABLED_RUSTLS" = "1"; then
     AC_DEFINE(USE_ECH, 1, [if ECH support is available])
-    AC_MSG_RESULT($ECH_SUPPORT)
+    AC_MSG_RESULT(ECH support available via:$ECH_SUPPORT)
     experimental="$experimental ECH"
+    ECH_ENABLED=1
+    dnl ECH wants HTTPSRR
+    want_httpsrr="yes"
   else
     AC_MSG_ERROR([--enable-ech ignored: No ECH support found])
   fi
 fi
 
+AC_MSG_CHECKING([whether to enable HTTPS-RR support])
+dnl *************************************************************
+dnl check whether HTTPSRR support if desired
+dnl
+if test "$want_httpsrr" != "no"; then
+  AC_MSG_RESULT([yes])
+  AC_DEFINE(USE_HTTPSRR, 1, [enable HTTPS RR support])
+  experimental="$experimental HTTPSRR"
+  curl_httpsrr_msg="enabled (--disable-httpsrr)"
+else
+  AC_MSG_RESULT([no])
+  dnl no HTTPSRR wanted
+  if test "$want_threaded_resolver" = "yes"; then
+    dnl and using the threaded resolver
+    if test "$USE_ARES" = "1"; then
+      AC_MSG_ERROR([without HTTPS-RR support, asking for both threaded resolver and c-ares support is ambivalent. Please drop one of them.])
+    fi
+  fi
+fi
+
 dnl *************************************************************
 dnl check whether OpenSSL (lookalikes) have SSL_set0_wbio
 dnl
-if test "x$OPENSSL_ENABLED" = "x1"; then
+if test "$OPENSSL_ENABLED" = "1"; then
   AC_CHECK_FUNCS([SSL_set0_wbio])
 fi
 
 dnl *************************************************************
 dnl WebSockets
 dnl
-AC_MSG_CHECKING([whether to support WebSockets])
-AC_ARG_ENABLE(websockets,
-AS_HELP_STRING([--enable-websockets],[Enable WebSockets support])
+if test "$CURL_DISABLE_HTTP" != "1"; then
+  AC_MSG_CHECKING([whether to support WebSockets])
+  AC_ARG_ENABLE(websockets,
+  AS_HELP_STRING([--enable-websockets],[Enable WebSockets support])
 AS_HELP_STRING([--disable-websockets],[Disable WebSockets support]),
-[ case "$enableval" in
-  no)
-     AC_MSG_RESULT(no)
-     ;;
-  *)
-     if test ${ac_cv_sizeof_curl_off_t} -gt 4; then
-         AC_MSG_RESULT(yes)
-         curl_ws_msg="enabled"
-         AC_DEFINE_UNQUOTED(USE_WEBSOCKETS, [1], [enable websockets support])
-         SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS WS"
-         if test "x$SSL_ENABLED" = "x1"; then
-           SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS WSS"
-         fi
-         experimental="$experimental Websockets"
-     else
-         dnl websockets requires >32 bit curl_off_t
-         AC_MSG_RESULT(no)
-         AC_MSG_WARN([Websockets disabled due to lack of >32 bit curl_off_t])
-     fi
-     ;;
-  esac ],
-     AC_MSG_RESULT(no)
-)
+  [ case "$enableval" in
+    no)
+      AC_MSG_RESULT(no)
+      AC_DEFINE(CURL_DISABLE_WEBSOCKETS, [1], [disable WebSockets])
+      CURL_DISABLE_WEBSOCKETS=1
+      ;;
+    *)
+      if test "$ac_cv_sizeof_curl_off_t" -gt 4; then
+        AC_MSG_RESULT(yes)
+      else
+        dnl WebSockets requires >32-bit curl_off_t
+        AC_MSG_RESULT(no)
+        AC_MSG_WARN([WebSockets disabled due to lack of >32-bit curl_off_t])
+        AC_DEFINE(CURL_DISABLE_WEBSOCKETS, [1], [disable WebSockets])
+        CURL_DISABLE_WEBSOCKETS=1
+      fi
+      ;;
+    esac ],
+      AC_MSG_RESULT(yes)
+  )
+else
+  AC_MSG_WARN([WebSockets disabled because HTTP is disabled])
+  AC_DEFINE(CURL_DISABLE_WEBSOCKETS, [1], [disable WebSockets])
+  CURL_DISABLE_WEBSOCKETS=1
+fi
 
+dnl *************************************************************
+dnl check whether experimental SSL Session Im-/Export is enabled
+dnl
+if test "$want_ssls_export" != "no"; then
+  AC_MSG_CHECKING([whether SSL session export support is available])
+
+  dnl assume NOT and look for sufficient condition
+  SSLS_EXPORT_ENABLED=0
+  SSLS_EXPORT_SUPPORT=''
+
+  if test "$SSL_ENABLED" != "1"; then
+    AC_MSG_WARN([--enable-ssls-export ignored: No SSL support])
+  else
+    SSLS_EXPORT_ENABLED=1
+    AC_DEFINE(USE_SSLS_EXPORT, 1, [if SSL session export support is available])
+    AC_MSG_RESULT("SSL session im-/export enabled")
+    experimental="$experimental SSLS-EXPORT"
+  fi
+fi
+
+dnl *************************************************************
+dnl check whether experimental HTTP/3 proxy support is enabled
+dnl
+if test "$want_proxy_http3" = "yes"; then
+  AC_MSG_CHECKING([whether HTTP/3 proxy support is available])
+
+  if test "$CURL_DISABLE_PROXY" = "1"; then
+    AC_MSG_ERROR([--enable-proxy-http3 requires proxy support])
+  elif test "$CURL_DISABLE_HTTP" = "1"; then
+    AC_MSG_ERROR([--enable-proxy-http3 requires HTTP support])
+  elif test "$USE_NGTCP2_H3" != "1"; then
+    AC_MSG_ERROR([--enable-proxy-http3 requires ngtcp2 + nghttp3])
+  elif test "x$OPENSSL_ENABLED" != "x1"; then
+    AC_MSG_ERROR([--enable-proxy-http3 currently requires OpenSSL])
+  else
+    AC_DEFINE(USE_PROXY_HTTP3, 1, [if HTTP/3 proxy support is available])
+    USE_PROXY_HTTP3=1
+    AC_MSG_RESULT([yes])
+    experimental="$experimental proxy-HTTP3"
+  fi
+fi
 
 dnl ************************************************************
 dnl hiding of library internal symbols
@@ -4508,10 +5098,28 @@ CURL_CONFIGURE_SYMBOL_HIDING
 dnl
 dnl All the library dependencies put into $LIB apply to libcurl only.
 dnl
-LIBCURL_LIBS="$LIBS$PTHREAD"
+LIBCURL_PC_LDFLAGS_PRIVATE=''
+dnl Do not quote $INITIAL_LDFLAGS
+set -- $INITIAL_LDFLAGS
+while test -n "$1"; do
+  case "$1" in
+    -L* | --library-path=* | -F*)
+      LIBCURL_PC_LDFLAGS_PRIVATE="$LIBCURL_PC_LDFLAGS_PRIVATE $1"
+      ;;
+    -framework)
+      if test -n "$2"; then
+        LIBCURL_PC_LDFLAGS_PRIVATE="$LIBCURL_PC_LDFLAGS_PRIVATE $1 $2"
+        shift
+      fi
+      ;;
+  esac
+  shift
+done
+LIBCURL_PC_LDFLAGS_PRIVATE="$LIBCURL_PC_LDFLAGS_PRIVATE $LDFLAGSPC"
+LIBCURL_PC_LIBS_PRIVATE="$LIBS$PTHREAD"
 
-AC_SUBST(LIBCURL_LIBS)
-AC_SUBST(CURL_NETWORK_LIBS)
+AC_SUBST(LIBCURL_PC_LDFLAGS_PRIVATE)
+AC_SUBST(LIBCURL_PC_LIBS_PRIVATE)
 AC_SUBST(CURL_NETWORK_AND_TIME_LIBS)
 
 dnl BLANK_AT_MAKETIME may be used in our Makefile.am files to blank
@@ -4521,7 +5129,7 @@ dnl all link targets in given makefile.
 BLANK_AT_MAKETIME=
 AC_SUBST(BLANK_AT_MAKETIME)
 
-AM_CONDITIONAL(CROSSCOMPILING, test x$cross_compiling = xyes)
+AM_CONDITIONAL(CROSSCOMPILING, test "$cross_compiling" = "yes")
 
 dnl yes or no
 ENABLE_SHARED="$enable_shared"
@@ -4531,13 +5139,21 @@ dnl to let curl-config output the static libraries correctly
 ENABLE_STATIC="$enable_static"
 AC_SUBST(ENABLE_STATIC)
 
-dnl merge the pkg-config Libs.private field into Libs when static-only
-if test "x$enable_shared" = "xno"; then
-  LIBCURL_NO_SHARED=$LIBCURL_LIBS
+squeeze LIBCURL_PC_REQUIRES_PRIVATE
+LIBCURL_PC_REQUIRES_PRIVATE=`echo $LIBCURL_PC_REQUIRES_PRIVATE | tr ' ' ','`
+
+AC_SUBST(LIBCURL_PC_REQUIRES_PRIVATE)
+
+dnl Merge pkg-config private fields into public ones when static-only
+if test "$enable_shared" = "no"; then
+  LIBCURL_PC_REQUIRES=$LIBCURL_PC_REQUIRES_PRIVATE
+  LIBCURL_PC_LIBS=$LIBCURL_PC_LIBS_PRIVATE
 else
-  LIBCURL_NO_SHARED=
+  LIBCURL_PC_REQUIRES=
+  LIBCURL_PC_LIBS=
 fi
-AC_SUBST(LIBCURL_NO_SHARED)
+AC_SUBST(LIBCURL_PC_REQUIRES)
+AC_SUBST(LIBCURL_PC_LIBS)
 
 rm $compilersh
 
@@ -4546,239 +5162,282 @@ dnl For keeping supported features and protocols also in pkg-config file
 dnl since it is more cross-compile friendly than curl-config
 dnl
 
-if test "x$OPENSSL_ENABLED" = "x1"; then
+if test "$OPENSSL_ENABLED" = "1"; then
   SUPPORT_FEATURES="$SUPPORT_FEATURES SSL"
 elif test -n "$SSL_ENABLED"; then
   SUPPORT_FEATURES="$SUPPORT_FEATURES SSL"
 fi
-if test "x$IPV6_ENABLED" = "x1"; then
+if test "$IPV6_ENABLED" = "1"; then
   SUPPORT_FEATURES="$SUPPORT_FEATURES IPv6"
 fi
-if test "x$USE_UNIX_SOCKETS" = "x1"; then
+if test "$USE_UNIX_SOCKETS" = "1"; then
   SUPPORT_FEATURES="$SUPPORT_FEATURES UnixSockets"
 fi
-if test "x$HAVE_LIBZ" = "x1"; then
+if test "$HAVE_LIBZ" = "1"; then
   SUPPORT_FEATURES="$SUPPORT_FEATURES libz"
 fi
-if test "x$HAVE_BROTLI" = "x1"; then
+if test "$HAVE_BROTLI" = "1"; then
   SUPPORT_FEATURES="$SUPPORT_FEATURES brotli"
 fi
-if test "x$HAVE_ZSTD" = "x1"; then
+if test "$HAVE_ZSTD" = "1"; then
   SUPPORT_FEATURES="$SUPPORT_FEATURES zstd"
 fi
-if test "x$USE_ARES" = "x1" -o "x$USE_THREADS_POSIX" = "x1" \
-                            -o "x$USE_THREADS_WIN32" = "x1"; then
+if test "$USE_RESOLV_ARES" = "1" || test "$USE_RESOLV_THREADED" = "1"; then
   SUPPORT_FEATURES="$SUPPORT_FEATURES AsynchDNS"
 fi
-if test "x$IDN_ENABLED" = "x1"; then
+if test "$USE_ARES" = "1" && test "$want_threaded_resolver" = "yes" && test "$want_httpsrr" != "no"; then
+  SUPPORT_FEATURES="$SUPPORT_FEATURES asyn-rr"
+fi
+if test "$IDN_ENABLED" = "1"; then
   SUPPORT_FEATURES="$SUPPORT_FEATURES IDN"
 fi
-if test "x$USE_WINDOWS_SSPI" = "x1"; then
+if test "$USE_WINDOWS_SSPI" = "1"; then
   SUPPORT_FEATURES="$SUPPORT_FEATURES SSPI"
 fi
 
-if test "x$HAVE_GSSAPI" = "x1"; then
+if test "$HAVE_GSSAPI" = "1"; then
   SUPPORT_FEATURES="$SUPPORT_FEATURES GSS-API"
 fi
 
-if test "x$curl_psl_msg" = "xenabled"; then
+if test "$curl_psl_msg" = "enabled"; then
   SUPPORT_FEATURES="$SUPPORT_FEATURES PSL"
 fi
 
-if test "x$curl_gsasl_msg" = "xenabled"; then
-  SUPPORT_FEATURES="$SUPPORT_FEATURES GSASL"
+if test "$USE_PROXY_HTTP3" = "1"; then
+  SUPPORT_FEATURES="$SUPPORT_FEATURES proxy-HTTP3"
 fi
 
-if test "x$enable_altsvc" = "xyes"; then
+if test "$curl_gsasl_msg" = "enabled"; then
+  SUPPORT_FEATURES="$SUPPORT_FEATURES gsasl"
+fi
+
+if test "$enable_altsvc" = "yes"; then
   SUPPORT_FEATURES="$SUPPORT_FEATURES alt-svc"
 fi
-if test "x$hsts" = "xyes"; then
+if test "$hsts" = "yes"; then
   SUPPORT_FEATURES="$SUPPORT_FEATURES HSTS"
 fi
 
-if test "x$CURL_DISABLE_NEGOTIATE_AUTH" != "x1" -a \
-    \( "x$HAVE_GSSAPI" = "x1" -o "x$USE_WINDOWS_SSPI" = "x1" \); then
+if test "$CURL_DISABLE_NEGOTIATE_AUTH" != "1" && (test "$HAVE_GSSAPI" = "1" || test "$USE_WINDOWS_SSPI" = "1"); then
   SUPPORT_FEATURES="$SUPPORT_FEATURES SPNEGO"
 fi
 
-if test "x$CURL_DISABLE_KERBEROS_AUTH" != "x1" -a \
-    \( "x$HAVE_GSSAPI" = "x1" -o "x$USE_WINDOWS_SSPI" = "x1" \); then
+if test "$CURL_DISABLE_KERBEROS_AUTH" != "1" && (test "$HAVE_GSSAPI" = "1" || test "$USE_WINDOWS_SSPI" = "1"); then
   SUPPORT_FEATURES="$SUPPORT_FEATURES Kerberos"
 fi
 
 use_curl_ntlm_core=no
 
-if test "x$CURL_DISABLE_NTLM" != "x1"; then
-  if test "x$OPENSSL_ENABLED" = "x1" -o "x$MBEDTLS_ENABLED" = "x1" \
-      -o "x$GNUTLS_ENABLED" = "x1" \
-      -o "x$SECURETRANSPORT_ENABLED" = "x1" \
-      -o "x$USE_WIN32_CRYPTO" = "x1" \
-      -o "x$WOLFSSL_NTLM" = "x1"; then
+if test "$CURL_ENABLE_NTLM" = "1"; then
+  if test "$HAVE_DES_ECB_ENCRYPT" = "1" ||
+     test "$GNUTLS_ENABLED" = "1" ||
+     test "$USE_WIN32_CRYPTO" = "1" ||
+     test "$HAVE_WC_DES_ECBENCRYPT" = "1" ||
+     test "$HAVE_MBEDTLS_DES_CRYPT_ECB" = "1"; then
     use_curl_ntlm_core=yes
   fi
 
-  if test "x$use_curl_ntlm_core" = "xyes" \
-      -o "x$USE_WINDOWS_SSPI" = "x1"; then
+  if test "$use_curl_ntlm_core" = "yes" ||
+     test "$USE_WINDOWS_SSPI" = "1"; then
     SUPPORT_FEATURES="$SUPPORT_FEATURES NTLM"
-
-    if test "x$CURL_DISABLE_HTTP" != "x1" -a \
-        "x$NTLM_WB_ENABLED" = "x1"; then
-      SUPPORT_FEATURES="$SUPPORT_FEATURES NTLM_WB"
-    fi
   fi
 fi
 
-if test "x$USE_TLS_SRP" = "x1"; then
+if test "$USE_TLS_SRP" = "1"; then
   SUPPORT_FEATURES="$SUPPORT_FEATURES TLS-SRP"
 fi
 
-if test "x$USE_NGHTTP2" = "x1" -o "x$USE_HYPER" = "x1"; then
+if test "$USE_NGHTTP2" = "1"; then
   SUPPORT_FEATURES="$SUPPORT_FEATURES HTTP2"
 fi
 
-if test "x$USE_NGTCP2" = "x1" -o "x$USE_QUICHE" = "x1" \
-    -o "x$USE_MSH3" = "x1"; then
+if test "$USE_NGTCP2_H3" = "1" ||
+   test "$USE_QUICHE" = "1" ||
+   test "$USE_OPENSSL_H3" = "1"; then
+  if test "$CURL_WITH_MULTI_SSL" = "1"; then
+    AC_MSG_ERROR([MultiSSL cannot be enabled with HTTP/3 and vice versa])
+  fi
   SUPPORT_FEATURES="$SUPPORT_FEATURES HTTP3"
 fi
 
-if test "x$CURL_WITH_MULTI_SSL" = "x1"; then
+if test "$CURL_WITH_MULTI_SSL" = "1"; then
   SUPPORT_FEATURES="$SUPPORT_FEATURES MultiSSL"
 fi
 
+AC_MSG_CHECKING([if this build supports HTTPS-proxy])
 dnl if not explicitly turned off, HTTPS-proxy comes with some TLS backends
-if test "x$https_proxy" != "xno"; then
-  if test "x$OPENSSL_ENABLED" = "x1" \
-      -o "x$GNUTLS_ENABLED" = "x1" \
-      -o "x$SECURETRANSPORT_ENABLED" = "x1" \
-      -o "x$RUSTLS_ENABLED" = "x1" \
-      -o "x$BEARSSL_ENABLED" = "x1" \
-      -o "x$SCHANNEL_ENABLED" = "x1" \
-      -o "x$GNUTLS_ENABLED" = "x1" \
-      -o "x$MBEDTLS_ENABLED" = "x1"; then
-    SUPPORT_FEATURES="$SUPPORT_FEATURES HTTPS-proxy"
-  elif test "x$WOLFSSL_ENABLED" = "x1" -a "x$WOLFSSL_FULL_BIO" = "x1"; then
-    SUPPORT_FEATURES="$SUPPORT_FEATURES HTTPS-proxy"
+if test "$CURL_DISABLE_HTTP" != "1"; then
+  if test "$https_proxy" != "no"; then
+    if test "$OPENSSL_ENABLED" = "1" ||
+       test "$GNUTLS_ENABLED" = "1" ||
+       test "$RUSTLS_ENABLED" = "1" ||
+       test "$SCHANNEL_ENABLED" = "1" ||
+       test "$GNUTLS_ENABLED" = "1" ||
+       test "$MBEDTLS_ENABLED" = "1"; then
+      SUPPORT_FEATURES="$SUPPORT_FEATURES HTTPS-proxy"
+      AC_MSG_RESULT([yes])
+    elif test "$WOLFSSL_ENABLED" = "1" && test "$HAVE_WOLFSSL_BIO_NEW" = "1"; then
+      SUPPORT_FEATURES="$SUPPORT_FEATURES HTTPS-proxy"
+      AC_MSG_RESULT([yes])
+    else
+      AC_MSG_RESULT([no])
+    fi
+  else
+    AC_MSG_RESULT([no])
+  fi
+else
+  AC_MSG_RESULT([no])
+fi
+
+if test "$OPENSSL_ENABLED" = "1" || test -n "$SSL_ENABLED"; then
+  if test "$ECH_ENABLED" = "1"; then
+    SUPPORT_FEATURES="$SUPPORT_FEATURES ECH"
   fi
 fi
 
-if test "x$ECH_ENABLED" = "x1"; then
-  SUPPORT_FEATURES="$SUPPORT_FEATURES ECH"
+if test -n "$SSL_ENABLED"; then
+  if test "$APPLE_SECTRUST_ENABLED" = "1"; then
+    SUPPORT_FEATURES="$SUPPORT_FEATURES AppleSecTrust"
+  elif test "$ca_native_opt" = "1"; then
+    SUPPORT_FEATURES="$SUPPORT_FEATURES NativeCA"
+  fi
 fi
 
-if test ${ac_cv_sizeof_curl_off_t} -gt 4; then
-  if test ${ac_cv_sizeof_off_t} -gt 4 -o \
-     "$curl_win32_file_api" = "win32_large_files"; then
+if test "$want_httpsrr" != "no"; then
+  SUPPORT_FEATURES="$SUPPORT_FEATURES HTTPSRR"
+fi
+
+if test "$SSLS_EXPORT_ENABLED" = "1"; then
+  SUPPORT_FEATURES="$SUPPORT_FEATURES SSLS-EXPORT"
+fi
+
+if test "$ac_cv_sizeof_curl_off_t" -gt 4; then
+  if test "$ac_cv_sizeof_off_t" -gt 4 ||
+     test "$curl_cv_native_windows" = "yes"; then
     SUPPORT_FEATURES="$SUPPORT_FEATURES Largefile"
   fi
 fi
 
 if test "$tst_atomic" = "yes"; then
   SUPPORT_FEATURES="$SUPPORT_FEATURES threadsafe"
+elif test "$HAVE_THREADS_POSIX" = "1" && test "$ac_cv_header_pthread_h" = "yes"; then
+  SUPPORT_FEATURES="$SUPPORT_FEATURES threadsafe"
+elif test "$curl_cv_native_windows" = "yes"; then
+  SUPPORT_FEATURES="$SUPPORT_FEATURES threadsafe"
+fi
+
+if test "$want_winuni" = "yes"; then
+  SUPPORT_FEATURES="$SUPPORT_FEATURES Unicode"
+fi
+if test "$want_debug" = "yes"; then
+  SUPPORT_FEATURES="$SUPPORT_FEATURES Debug"
+fi
+if test -n "$CURL_CA_EMBED"; then
+  SUPPORT_FEATURES="$SUPPORT_FEATURES CAcert"
+  CURL_CA_EMBED_msg="$CURL_CA_EMBED"
 else
-  AC_COMPILE_IFELSE([
-    AC_LANG_PROGRAM([[
-      #include <windows.h>
-    ]],[[
-      #if (WINVER < 0x600) && (_WIN32_WINNT < 0x600)
-      #error
-      #endif
-    ]])
-  ],[
-     SUPPORT_FEATURES="$SUPPORT_FEATURES threadsafe"
-  ],[
-  ])
+  CURL_CA_EMBED_msg='no'
 fi
 
 dnl replace spaces with newlines
 dnl sort the lines
 dnl replace the newlines back to spaces
-SUPPORT_FEATURES=`echo $SUPPORT_FEATURES | tr ' ' '\012' | sort | tr '\012' ' '`
+if sort -f </dev/null >/dev/null 2>&1; then
+  SUPPORT_FEATURES=`echo $SUPPORT_FEATURES | tr ' ' '\012' | sort -f | tr '\012' ' '`
+else
+  SUPPORT_FEATURES=`echo $SUPPORT_FEATURES | tr ' ' '\012' | sort | tr '\012' ' '`
+fi
 AC_SUBST(SUPPORT_FEATURES)
 
 dnl For supported protocols in pkg-config file
-if test "x$CURL_DISABLE_HTTP" != "x1"; then
+if test "$CURL_DISABLE_HTTP" != "1"; then
   SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS HTTP"
-  if test "x$SSL_ENABLED" = "x1"; then
+  if test "$SSL_ENABLED" = "1"; then
     SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS HTTPS"
   fi
 fi
-if test "x$CURL_DISABLE_FTP" != "x1"; then
+if test "$CURL_DISABLE_FTP" != "1"; then
   SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS FTP"
-  if test "x$SSL_ENABLED" = "x1"; then
+  if test "$SSL_ENABLED" = "1"; then
     SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS FTPS"
   fi
 fi
-if test "x$CURL_DISABLE_FILE" != "x1"; then
+if test "$CURL_DISABLE_FILE" != "1"; then
   SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS FILE"
 fi
-if test "x$CURL_DISABLE_TELNET" != "x1"; then
+if test "$CURL_DISABLE_TELNET" != "1"; then
   SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS TELNET"
 fi
-if test "x$CURL_DISABLE_LDAP" != "x1"; then
+if test "$CURL_DISABLE_LDAP" != "1"; then
   SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS LDAP"
-  if test "x$CURL_DISABLE_LDAPS" != "x1"; then
-    if (test "x$USE_OPENLDAP" = "x1" && test "x$SSL_ENABLED" = "x1") ||
-      (test "x$USE_OPENLDAP" != "x1"  && test "x$HAVE_LDAP_SSL" = "x1"); then
+  if test "$CURL_DISABLE_LDAPS" != "1"; then
+    if (test "$USE_OPENLDAP" = "1" && test "$SSL_ENABLED" = "1") ||
+       (test "$USE_OPENLDAP" != "1" && test "$HAVE_LDAP_SSL" = "1"); then
       SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS LDAPS"
     fi
   fi
 fi
-if test "x$CURL_DISABLE_DICT" != "x1"; then
+if test "$CURL_DISABLE_DICT" != "1"; then
   SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS DICT"
 fi
-if test "x$CURL_DISABLE_TFTP" != "x1"; then
+if test "$CURL_DISABLE_TFTP" != "1"; then
   SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS TFTP"
 fi
-if test "x$CURL_DISABLE_GOPHER" != "x1"; then
+if test "$CURL_DISABLE_GOPHER" != "1"; then
   SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS GOPHER"
-  if test "x$SSL_ENABLED" = "x1"; then
+  if test "$SSL_ENABLED" = "1"; then
     SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS GOPHERS"
   fi
 fi
-if test "x$CURL_DISABLE_MQTT" != "x1"; then
+if test "$CURL_DISABLE_MQTT" != "1"; then
   SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS MQTT"
+  if test "$SSL_ENABLED" = "1"; then
+    SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS MQTTS"
+  fi
 fi
-if test "x$CURL_DISABLE_POP3" != "x1"; then
+if test "$CURL_DISABLE_POP3" != "1"; then
   SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS POP3"
-  if test "x$SSL_ENABLED" = "x1"; then
+  if test "$SSL_ENABLED" = "1"; then
     SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS POP3S"
   fi
 fi
-if test "x$CURL_DISABLE_IMAP" != "x1"; then
+if test "$CURL_DISABLE_IMAP" != "1"; then
   SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS IMAP"
-  if test "x$SSL_ENABLED" = "x1"; then
+  if test "$SSL_ENABLED" = "1"; then
     SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS IMAPS"
   fi
 fi
-if test "x$CURL_DISABLE_SMB" != "x1" \
-    -a "x$use_curl_ntlm_core" = "xyes"; then
+if test "$CURL_ENABLE_SMB" = "1" && test "$use_curl_ntlm_core" = "yes"; then
   SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS SMB"
-  if test "x$SSL_ENABLED" = "x1"; then
+  if test "$SSL_ENABLED" = "1"; then
     SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS SMBS"
   fi
 fi
-if test "x$CURL_DISABLE_SMTP" != "x1"; then
+if test "$CURL_DISABLE_SMTP" != "1"; then
   SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS SMTP"
-  if test "x$SSL_ENABLED" = "x1"; then
+  if test "$SSL_ENABLED" = "1"; then
     SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS SMTPS"
   fi
 fi
-if test "x$USE_LIBSSH2" = "x1"; then
+if test "$USE_LIBSSH2" = "1"; then
   SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS SCP"
   SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS SFTP"
 fi
-if test "x$USE_LIBSSH" = "x1"; then
+if test "$USE_LIBSSH" = "1"; then
   SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS SCP"
   SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS SFTP"
 fi
-if test "x$USE_WOLFSSH" = "x1"; then
-  SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS SFTP"
+if test "$CURL_DISABLE_IPFS" != "1"; then
+  SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS IPFS IPNS"
 fi
-if test "x$CURL_DISABLE_RTSP" != "x1"; then
+if test "$CURL_DISABLE_RTSP" != "1"; then
   SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS RTSP"
 fi
-if test "x$USE_LIBRTMP" = "x1"; then
-  SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS RTMP"
+if test "$CURL_DISABLE_WEBSOCKETS" != "1"; then
+  SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS WS"
+  if test "$SSL_ENABLED" = "1"; then
+    SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS WSS"
+  fi
 fi
 
 dnl replace spaces with newlines
@@ -4796,8 +5455,8 @@ squeeze DEFS
 squeeze LDFLAGS
 squeeze LIBS
 
-squeeze LIBCURL_LIBS
-squeeze CURL_NETWORK_LIBS
+squeeze LIBCURL_PC_LDFLAGS_PRIVATE
+squeeze LIBCURL_PC_LIBS_PRIVATE
 squeeze CURL_NETWORK_AND_TIME_LIBS
 
 squeeze SUPPORT_FEATURES
@@ -4808,43 +5467,40 @@ XC_CHECK_BUILD_FLAGS
 SSL_BACKENDS=${ssl_backends}
 AC_SUBST(SSL_BACKENDS)
 
-if test "x$want_curldebug_assumed" = "xyes" &&
-  test "x$want_curldebug" = "xyes" && test "x$USE_ARES" = "x1"; then
-  ac_configure_args="$ac_configure_args --enable-curldebug"
-fi
+CURL_PREPARE_CONFIGUREHELP_PM
 
-AC_CONFIG_FILES([Makefile \
-           docs/Makefile \
-           docs/examples/Makefile \
-           docs/libcurl/Makefile \
-           docs/libcurl/opts/Makefile \
-           docs/cmdline-opts/Makefile \
-           include/Makefile \
-           include/curl/Makefile \
-           src/Makefile \
-           lib/Makefile \
-           scripts/Makefile \
-           lib/libcurl.vers \
-           lib/libcurl.plist \
-           tests/Makefile \
-           tests/config \
-           tests/certs/Makefile \
-           tests/certs/scripts/Makefile \
-           tests/data/Makefile \
-           tests/server/Makefile \
-           tests/libtest/Makefile \
-           tests/unit/Makefile \
-           tests/http/config.ini \
-           tests/http/Makefile \
-           tests/http/clients/Makefile \
-           packages/Makefile \
-           packages/vms/Makefile \
-           curl-config \
-           libcurl.pc
+AC_CONFIG_FILES([\
+  Makefile \
+  docs/Makefile \
+  docs/examples/Makefile \
+  docs/libcurl/Makefile \
+  docs/libcurl/opts/Makefile \
+  docs/cmdline-opts/Makefile \
+  include/Makefile \
+  include/curl/Makefile \
+  src/Makefile \
+  lib/Makefile \
+  scripts/Makefile \
+  lib/libcurl.vers \
+  tests/Makefile \
+  tests/config \
+  tests/configurehelp.pm \
+  tests/certs/Makefile \
+  tests/data/Makefile \
+  tests/server/Makefile \
+  tests/libtest/Makefile \
+  tests/unit/Makefile \
+  tests/tunit/Makefile \
+  tests/http/config.ini \
+  tests/http/Makefile \
+  projects/Makefile \
+  projects/vms/Makefile \
+  libcurl.pc
 ])
+AC_CONFIG_FILES([curl-config], [chmod +x curl-config])
 AC_OUTPUT
 
-CURL_GENERATE_CONFIGUREHELP_PM
+SUPPORT_PROTOCOLS_LOWER=`echo "$SUPPORT_PROTOCOLS" | tr A-Z a-z`
 
 AC_MSG_NOTICE([Configured to build curl/libcurl:
 
@@ -4852,8 +5508,10 @@ AC_MSG_NOTICE([Configured to build curl/libcurl:
   Install prefix:   ${prefix}
   Compiler:         ${CC}
    CFLAGS:          ${CFLAGS}
+   CFLAGS extras:   ${CURL_CFLAG_EXTRAS}
    CPPFLAGS:        ${CPPFLAGS}
    LDFLAGS:         ${LDFLAGS}
+     curl-config:   ${LIBCURL_PC_LDFLAGS_PRIVATE}
    LIBS:            ${LIBS}
 
   curl version:     ${CURLVERSION}
@@ -4869,19 +5527,23 @@ AC_MSG_NOTICE([Configured to build curl/libcurl:
   IPv6:             ${curl_ipv6_msg}
   Unix sockets:     ${curl_unix_sockets_msg}
   IDN:              ${curl_idn_msg}
+  Build docs:       ${curl_docs_msg}
   Build libcurl:    Shared=${enable_shared}, Static=${enable_static}
   Built-in manual:  ${curl_manual_msg}
   --libcurl option: ${curl_libcurl_msg}
+  Type checking:    ${curl_typecheck_msg}
   Verbose errors:   ${curl_verbose_msg}
   Code coverage:    ${curl_coverage_msg}
   SSPI:             ${curl_sspi_msg}
-  ca cert bundle:   ${ca}${ca_warning}
-  ca cert path:     ${capath}${capath_warning}
-  ca fallback:      ${with_ca_fallback}
+  CA native:        ${ca_native}
+  CA cert bundle:   ${ca}${ca_warning}
+  CA cert path:     ${capath}${capath_warning}
+  CA cert embed:    ${CURL_CA_EMBED_msg}
+  CA fallback:      ${with_ca_fallback}
   LDAP:             ${curl_ldap_msg}
   LDAPS:            ${curl_ldaps_msg}
+  IPFS/IPNS:        ${curl_ipfs_msg}
   RTSP:             ${curl_rtsp_msg}
-  RTMP:             ${curl_rtmp_msg}
   PSL:              ${curl_psl_msg}
   Alt-svc:          ${curl_altsvc_msg}
   Headers API:      ${curl_headers_msg}
@@ -4889,13 +5551,22 @@ AC_MSG_NOTICE([Configured to build curl/libcurl:
   HTTP1:            ${curl_h1_msg}
   HTTP2:            ${curl_h2_msg}
   HTTP3:            ${curl_h3_msg}
+  proxy-HTTP3:      ${curl_proxy_http3_msg}
   ECH:              ${curl_ech_msg}
-  WebSockets:       ${curl_ws_msg}
-  Protocols:        ${SUPPORT_PROTOCOLS}
+  HTTPS RR:         ${curl_httpsrr_msg}
+  SSLS-EXPORT:      ${curl_ssls_export_msg}
+  Protocols:        ${SUPPORT_PROTOCOLS_LOWER}
   Features:         ${SUPPORT_FEATURES}
 ])
+
 if test -n "$experimental"; then
- cat >&2 << _EOF
-  WARNING: $experimental enabled but marked EXPERIMENTAL. Use with caution!
-_EOF
+  for a in $experimental; do
+    AC_MSG_WARN([$a is enabled but marked EXPERIMENTAL. Use with caution!])
+  done
+fi
+
+CURL_PREPARE_BUILDINFO
+echo "[@%:@] This is a generated file.  Do not edit.${curl_buildinfo}" > ./buildinfo.txt
+if test -n "$CURL_BUILDINFO$CURL_CI$CI"; then
+  AC_MSG_NOTICE([${curl_buildinfo}])
 fi
diff --git a/third-party/curl/curl-config.in b/third-party/curl/curl-config.in
index 54f92d9313..a1c8185875 100644
--- a/third-party/curl/curl-config.in
+++ b/third-party/curl/curl-config.in
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 #***************************************************************************
 #                                  _   _ ____  _
 #  Project                     ___| | | |  _ \| |
@@ -23,174 +23,167 @@
 #
 ###########################################################################
 
-prefix="@prefix@"
-exec_prefix=@exec_prefix@
-includedir=@includedir@
-cppflag_curl_staticlib=@CPPFLAG_CURL_STATICLIB@
+# shellcheck disable=SC2006
+
+prefix='@prefix@'
+# Used in 'libdir'
+# shellcheck disable=SC2034
+exec_prefix="@exec_prefix@"
+# shellcheck disable=SC2034
+includedir="@includedir@"
 
 usage()
 {
-    cat <<EOF
+  cat <<EOF
 Usage: curl-config [OPTION]
 
 Available values for OPTION include:
 
-  --built-shared says 'yes' if libcurl was built shared
-  --ca        ca bundle install path
-  --cc        compiler
-  --cflags    pre-processor and compiler flags
-  --checkfor [version] check for (lib)curl of the specified version
-  --configure the arguments given to configure when building curl
-  --features  newline separated list of enabled features
-  --help      display this help and exit
-  --libs      library linking information
-  --prefix    curl install prefix
-  --protocols newline separated list of enabled protocols
-  --ssl-backends output the SSL backends libcurl was built to support
-  --static-libs static libcurl library linking information
-  --version   output version information
-  --vernum    output the version information as a number (hexadecimal)
+  --built-shared        says 'yes' if libcurl was built shared
+  --ca                  CA bundle install path
+  --cc                  compiler
+  --cflags              preprocessor and compiler flags
+  --checkfor [version]  check for (lib)curl of the specified version
+  --configure           the arguments given to configure when building curl
+  --features            newline separated list of enabled features
+  --help                display this help and exit
+  --libs                library linking information
+  --prefix              curl install prefix
+  --protocols           newline separated list of enabled protocols
+  --ssl-backends        output the SSL backends libcurl was built to support
+  --static-libs         static libcurl library linking information
+  --version             output version information
+  --vernum              output version as a hexadecimal number
 EOF
 
-    exit $1
+  exit "$1"
 }
 
-if test $# -eq 0; then
-    usage 1
+if test "$#" -eq 0; then
+  usage 1
 fi
 
-while test $# -gt 0; do
-    case "$1" in
-    # this deals with options in the style
-    # --option=value and extracts the value part
-    # [not currently used]
-    -*=*) value=`echo "$1" | sed 's/[-_a-zA-Z0-9]*=//'` ;;
-    *) value= ;;
-    esac
+while test "$#" -gt 0; do
+  case "$1" in
+  --built-shared)
+    echo '@ENABLE_SHARED@'
+    ;;
 
-    case "$1" in
-    --built-shared)
-        echo @ENABLE_SHARED@
-        ;;
+  --ca)
+    echo '@CURL_CA_BUNDLE@'
+    ;;
 
-    --ca)
-        echo @CURL_CA_BUNDLE@
-        ;;
+  --cc)
+    echo '@CC@'
+    ;;
 
-    --cc)
-        echo "@CC@"
-        ;;
+  --prefix)
+    echo "$prefix"
+    ;;
 
-    --prefix)
-        echo "$prefix"
-        ;;
+  --feature|--features)
+    for feature in @SUPPORT_FEATURES@ ''; do
+      test -n "$feature" && echo "$feature"
+    done
+    ;;
 
-    --feature|--features)
-        for feature in @SUPPORT_FEATURES@ ""; do
-            test -n "$feature" && echo "$feature"
-        done
-        ;;
+  --protocols)
+    # shellcheck disable=SC2043
+    for protocol in @SUPPORT_PROTOCOLS@; do
+      echo "$protocol"
+    done
+    ;;
 
-    --protocols)
-        for protocol in @SUPPORT_PROTOCOLS@; do
-            echo "$protocol"
-        done
-        ;;
+  --version)
+    echo 'libcurl @CURLVERSION@'
+    exit 0
+    ;;
 
-    --version)
-        echo libcurl @CURLVERSION@
+  --checkfor)
+    checkfor="$2"
+    cmajor=`echo "$checkfor" | cut -d. -f1`
+    cminor=`echo "$checkfor" | cut -d. -f2`
+    # when extracting the patch part we strip off everything after a
+    # dash as that's used for things like version 1.2.3-pre1
+    cpatch=`echo "$checkfor" | cut -d. -f3 | cut -d- -f1`
+
+    vmajor=`echo '@CURLVERSION@' | cut -d. -f1`
+    vminor=`echo '@CURLVERSION@' | cut -d. -f2`
+    # when extracting the patch part we strip off everything after a
+    # dash as that's used for things like version 1.2.3-pre1
+    vpatch=`echo '@CURLVERSION@' | cut -d. -f3 | cut -d- -f1`
+
+    if test "$vmajor" -gt "$cmajor"; then
+      exit 0
+    fi
+    if test "$vmajor" -eq "$cmajor"; then
+      if test "$vminor" -gt "$cminor"; then
         exit 0
-        ;;
-
-    --checkfor)
-        checkfor=$2
-        cmajor=`echo $checkfor | cut -d. -f1`
-        cminor=`echo $checkfor | cut -d. -f2`
-        # when extracting the patch part we strip off everything after a
-        # dash as that's used for things like version 1.2.3-CVS
-        cpatch=`echo $checkfor | cut -d. -f3 | cut -d- -f1`
-
-        vmajor=`echo @CURLVERSION@ | cut -d. -f1`
-        vminor=`echo @CURLVERSION@ | cut -d. -f2`
-        # when extracting the patch part we strip off everything after a
-        # dash as that's used for things like version 1.2.3-CVS
-        vpatch=`echo @CURLVERSION@ | cut -d. -f3 | cut -d- -f1`
-
-        if test "$vmajor" -gt "$cmajor"; then
-            exit 0;
-        fi
-        if test "$vmajor" -eq "$cmajor"; then
-            if test "$vminor" -gt "$cminor"; then
-                exit 0
-            fi
-            if test "$vminor" -eq "$cminor"; then
-                if test "$cpatch" -le "$vpatch"; then
-                    exit 0
-                fi
-            fi
+      fi
+      if test "$vminor" -eq "$cminor"; then
+        if test "$cpatch" -le "$vpatch"; then
+          exit 0
         fi
+      fi
+    fi
 
-        echo "requested version $checkfor is newer than existing @CURLVERSION@"
-        exit 1
-        ;;
+    echo "requested version $checkfor is newer than existing @CURLVERSION@"
+    exit 1
+    ;;
 
-    --vernum)
-        echo @VERSIONNUM@
-        exit 0
-        ;;
+  --vernum)
+    echo '@VERSIONNUM@'
+    exit 0
+    ;;
 
-    --help)
-        usage 0
-        ;;
+  --help)
+    usage 0
+    ;;
 
-    --cflags)
-        if test "X$cppflag_curl_staticlib" = "X-DCURL_STATICLIB"; then
-          CPPFLAG_CURL_STATICLIB="-DCURL_STATICLIB "
-        else
-          CPPFLAG_CURL_STATICLIB=""
-        fi
-        if test "X@includedir@" = "X/usr/include"; then
-          echo "$CPPFLAG_CURL_STATICLIB"
-        else
-          echo "${CPPFLAG_CURL_STATICLIB}-I@includedir@"
-        fi
-        ;;
+  --cflags)
+    if test "@includedir@" = '/usr/include'; then
+      echo '@LIBCURL_PC_CFLAGS@'
+    else
+      echo "@LIBCURL_PC_CFLAGS@ -I@includedir@"
+    fi
+    ;;
 
-    --libs)
-        if test "X@libdir@" != "X/usr/lib" -a "X@libdir@" != "X/usr/lib64"; then
-           CURLLIBDIR="-L@libdir@ "
-        else
-           CURLLIBDIR=""
-        fi
-        if test "X@ENABLE_SHARED@" = "Xno"; then
-          echo ${CURLLIBDIR}-lcurl @LIBCURL_LIBS@
-        else
-          echo ${CURLLIBDIR}-lcurl
-        fi
-        ;;
-    --ssl-backends)
-        echo "@SSL_BACKENDS@"
-        ;;
+  --libs)
+    if test "@libdir@" != '/usr/lib' && test "@libdir@" != '/usr/lib64'; then
+      curllibdir="-L@libdir@ "
+    else
+      curllibdir=''
+    fi
+    if test '@ENABLE_SHARED@' = 'no'; then
+      echo "${curllibdir}-lcurl @LIBCURL_PC_LIBS_PRIVATE@"
+    else
+      echo "${curllibdir}-lcurl"
+    fi
+    ;;
 
-    --static-libs)
-        if test "X@ENABLE_STATIC@" != "Xno" ; then
-          echo "@libdir@/libcurl.@libext@" @LDFLAGS@ @LIBCURL_LIBS@
-        else
-          echo "curl was built with static libraries disabled" >&2
-          exit 1
-        fi
-        ;;
+  --ssl-backends)
+    echo '@SSL_BACKENDS@'
+    ;;
 
-    --configure)
-        echo @CONFIGURE_OPTIONS@
-        ;;
+  --static-libs)
+    if test '@ENABLE_STATIC@' != 'no'; then
+      echo "@libdir@/libcurl.@libext@ @LIBCURL_PC_LDFLAGS_PRIVATE@ @LIBCURL_PC_LIBS_PRIVATE@"
+    else
+      echo 'curl was built with static libraries disabled' >&2
+      exit 1
+    fi
+    ;;
 
-    *)
-        echo "unknown option: $1"
-        usage 1
-        ;;
-    esac
-    shift
+  --configure)
+    echo @CONFIGURE_OPTIONS@
+    ;;
+
+  *)
+    echo "unknown option: $1"
+    usage 1
+    ;;
+  esac
+  shift
 done
 
 exit 0
diff --git a/third-party/curl/docs/.gitignore b/third-party/curl/docs/.gitignore
index 8d0bfb31bb..31ca7656e9 100644
--- a/third-party/curl/docs/.gitignore
+++ b/third-party/curl/docs/.gitignore
@@ -2,7 +2,6 @@
 #
 # SPDX-License-Identifier: curl
 
-*.html
-*.pdf
-curl.1
-*.1.dist
+*.1
+*.3
+RELEASE-TOOLS.md.dist
diff --git a/third-party/curl/docs/ALTSVC.md b/third-party/curl/docs/ALTSVC.md
index b9117e4d46..24b961a3fb 100644
--- a/third-party/curl/docs/ALTSVC.md
+++ b/third-party/curl/docs/ALTSVC.md
@@ -1,3 +1,9 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # Alt-Svc
 
 curl features support for the Alt-Svc: HTTP header.
@@ -24,21 +30,15 @@ space separated fields.
 ## Fields
 
 1. The ALPN id for the source origin
-2. The host name for the source origin
+2. The hostname for the source origin
 3. The port number for the source origin
 4. The ALPN id for the destination host
-5. The host name for the destination host
-6. The host number for the destination host
-7. The expiration date and time of this entry within double quotes. The date format is "YYYYMMDD HH:MM:SS" and the time zone is GMT.
+5. The hostname for the destination host
+6. The port number for the destination host
+7. The expiration date and time of this entry within double quotes.
+   The date format is "YYYYMMDD HH:MM:SS" and the time zone is GMT.
 8. Boolean (1 or 0) if "persist" was set for this entry
 9. Integer priority value (not currently used)
 
-If the host name is an IPv6 numerical address, it is stored with brackets such
+If the hostname is an IPv6 numerical address, it is stored with brackets such
 as `[::1]`.
-
-# TODO
-
-- handle multiple response headers, when one of them says `clear` (should
-  override them all)
-- using `Age:` value for caching age as per spec
-- `CURLALTSVC_IMMEDIATELY` support
diff --git a/third-party/curl/docs/BINDINGS.md b/third-party/curl/docs/BINDINGS.md
index 7be5387eb2..6c9aba6105 100644
--- a/third-party/curl/docs/BINDINGS.md
+++ b/third-party/curl/docs/BINDINGS.md
@@ -1,14 +1,20 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 libcurl bindings
 ================
 
- Creative people have written bindings or interfaces for various environments
- and programming languages. Using one of these allows you to take advantage of
- curl powers from within your favourite language or system.
+Creative people have written bindings or interfaces for various environments
+and programming languages. Using one of these allows you to take advantage of
+curl powers from within your favorite language or system.
 
- This is a list of all known interfaces as of this writing.
+This is a list of all known interfaces as of this writing.
 
- The bindings listed below are not part of the curl/libcurl distribution
- archives, but must be downloaded and installed separately.
+The bindings listed below are not part of the curl/libcurl distribution
+archives, but must be downloaded and installed separately.
 
 <!-- markdown-link-check-disable -->
 
@@ -16,9 +22,9 @@ libcurl bindings
 
 [Basic](https://scriptbasic.com/) ScriptBasic bindings written by Peter Verhas
 
-C++: [curlpp](https://github.com/jpbarrette/curlpp/) Written by Jean-Philippe Barrette-LaPierre,
-[curlcpp](https://github.com/JosephP91/curlcpp) by Giuseppe Persico and [C++
-Requests](https://github.com/libcpr/cpr) by Huu Nguyen
+C++: [curlpp](https://github.com/jpbarrette/curlpp) Written by Jean-Philippe Barrette-LaPierre,
+[curlcpp](https://github.com/JosephP91/curlcpp) by Giuseppe Persico and
+[C++ Requests](https://github.com/libcpr/cpr) by Huu Nguyen
 
 [Ch](https://chcurl.sourceforge.net/) Written by Stephen Nestinger and Jonathan Rogado
 
@@ -37,13 +43,13 @@ Clojure: [clj-curl](https://github.com/lsevero/clj-curl) by Lucas Severo
 
 [Euphoria](https://web.archive.org/web/20050204080544/rays-web.com/eulibcurl.htm) Written by Ray Smith
 
-[Falcon](http://www.falconpl.org/project_docs/curl/)
+[Falcon](https://web.archive.org/web/20240130001835/www.falconpl.org/project_docs/curl/)
 
 [Ferite](https://web.archive.org/web/20150102192018/ferite.org/) Written by Paul Querna
 
 [Fortran](https://github.com/interkosmos/fortran-curl) Written by Philipp Engel
 
-[Gambas](https://gambas.sourceforge.net/)
+[Gambas](https://gambaswiki.org/website/en/main.html)
 
 [glib/GTK+](https://web.archive.org/web/20100526203452/atterer.net/glibcurl) Written by Richard Atterer
 
@@ -57,17 +63,19 @@ Go: [go-curl](https://github.com/andelf/go-curl) by ShuYu Wang
 
 [Hollywood](https://www.hollywood-mal.com/download.html) hURL by Andreas Falkenhahn
 
-[Java](https://github.com/pjlegato/curl-java)
+[Java](https://github.com/covers1624/curl4j)
 
 [Julia](https://github.com/JuliaWeb/LibCURL.jl) Written by Amit Murthy
 
-[Kapito](https://github.com/puzza007/katipo) is an Erlang HTTP library around libcurl.
+[Katipo](https://github.com/puzza007/katipo) is an Erlang HTTP library around libcurl.
 
 [Lisp](https://common-lisp.net/project/cl-curl/) Written by Liam Healy
 
-Lua: [luacurl](https://web.archive.org/web/20201205052437/luacurl.luaforge.net/) by Alexander Marinov, [Lua-cURL](https://github.com/Lua-cURL) by Jürgen Hötzel
+[LibQurl](https://github.com/Qriist/LibQurl) a feature-rich AutoHotKey v2 (AHKv2) wrapper around libcurl.
 
-[Mono](https://web.archive.org/web/20070606064500/https://forge.novell.com/modules/xfmod/project/?libcurl-mono) Written by Jeffrey Phillips
+Lua: [luacurl](https://web.archive.org/web/20201205052437/luacurl.luaforge.net/) by Alexander Marinov, [Lua-curl](https://github.com/Lua-cURL) by Jürgen Hötzel
+
+[Mono](https://web.archive.org/web/20070606064500/forge.novell.com/modules/xfmod/project/?libcurl-mono) Written by Jeffrey Phillips
 
 [.NET](https://sourceforge.net/projects/libcurl-net/) libcurl-net by Jeffrey Phillips
 
@@ -90,19 +98,21 @@ Bailiff and Bálint Szilakszi,
 
 [PostgreSQL](https://github.com/pramsey/pgsql-http) - HTTP client for PostgreSQL
 
-[PostgreSQL](https://github.com/RekGRpth/pg_curl) - cURL client for PostgreSQL
+[PostgreSQL](https://github.com/RekGRpth/pg_curl) - curl client for PostgreSQL
 
-[PureBasic](https://www.purebasic.com/documentation/http/index.html) uses libcurl in its "native" HTTP subsystem
+[PureBasic](https://web.archive.org/web/20250325015028/www.purebasic.com/documentation/http/index.html) uses libcurl in its "native" HTTP subsystem
 
-[Python](http://pycurl.io/) PycURL by Kjetil Jacobsen
+[Python](https://github.com/pycurl/pycurl) PycURL by Kjetil Jacobsen
+
+[Python](https://pypi.org/project/pymcurl/) mcurl by Ganesh Viswanathan
 
 [Q](https://q-lang.sourceforge.net/) The libcurl module is part of the default install
 
 [R](https://cran.r-project.org/package=curl)
 
-[Rexx](https://rexxcurl.sourceforge.net/) Written Mark Hessling
+[Rexx](https://rexxcurl.sourceforge.net/) Written by Mark Hessling
 
-[Ring](https://ring-lang.sourceforge.io/doc1.3/libcurl.html) RingLibCurl by Mahmoud Fayed
+[Ring](https://ring-lang.github.io/doc1.24/libcurl.html) RingLibCurl by Mahmoud Fayed
 
 RPG, support for ILE/RPG on OS/400 is included in source distribution
 
@@ -111,7 +121,7 @@ Ruby: [curb](https://github.com/taf2/curb) written by Ross Bamford,
 
 [Rust](https://github.com/alexcrichton/curl-rust) curl-rust - by Carl Lerche
 
-[Scheme](http://www.metapaper.net/lisovsky/web/curl/) Bigloo binding by Kirill Lisovsky
+[Scheme](https://metapaper.net/lisovsky/web/curl/) Bigloo binding by Kirill Lisovsky
 
 [Scilab](https://help.scilab.org/docs/current/fr_FR/getURL.html) binding by Sylvestre Ledru
 
@@ -125,6 +135,8 @@ Ruby: [curb](https://github.com/taf2/curb) written by Ross Bamford,
 
 [Tcl](https://web.archive.org/web/20160826011806/mirror.yellow5.com/tclcurl/) Tclcurl by Andrés García
 
+[Vibe](https://github.com/ttytm/vibe) HTTP requests through libcurl in V
+
 [Visual Basic](https://sourceforge.net/projects/libcurl-vb/) libcurl-vb by Jeffrey Phillips
 
 [Visual Foxpro](https://web.archive.org/web/20130730181523/www.ctl32.com.ar/libcurl.asp) by Carlos Alloatti
@@ -134,3 +146,5 @@ Ruby: [curb](https://github.com/taf2/curb) written by Ross Bamford,
 [XBLite](https://web.archive.org/web/20060426150418/perso.wanadoo.fr/xblite/libraries.html) Written by David Szafranski
 
 [Xojo](https://github.com/charonn0/RB-libcURL) Written by Andrew Lambert
+
+[Zig](https://github.com/jiacai2050/zig-curl) Written by Jiacai Liu, both easy and multi API are supported.
diff --git a/third-party/curl/docs/BUFQ.md b/third-party/curl/docs/BUFQ.md
deleted file mode 100644
index 5ff9e28b8c..0000000000
--- a/third-party/curl/docs/BUFQ.md
+++ /dev/null
@@ -1,141 +0,0 @@
-# bufq
-
-This is an internal module for managing I/O buffers. A `bufq` can be written
-to and read from. It manages read and write positions and has a maximum size.
-
-## read/write
-
-Its basic read/write functions have a similar signature and return code handling
-as many internal Curl read and write ones.
-
-
-```
-ssize_t Curl_bufq_write(struct bufq *q, const unsigned char *buf, size_t len, CURLcode *err);
-
-- returns the length written into `q` or -1 on error.
-- writing to a full `q` will return -1 and set *err to CURLE_AGAIN
-
-ssize_t Curl_bufq_read(struct bufq *q, unsigned char *buf, size_t len, CURLcode *err);
-
-- returns the length read from `q` or -1 on error.
-- reading from an empty `q` will return -1 and set *err to CURLE_AGAIN
-
-```
-
-To pass data into a `bufq` without an extra copy, read callbacks can be used.
-
-```
-typedef ssize_t Curl_bufq_reader(void *reader_ctx, unsigned char *buf, size_t len,
-                                 CURLcode *err);
-
-ssize_t Curl_bufq_slurp(struct bufq *q, Curl_bufq_reader *reader, void *reader_ctx,
-                        CURLcode *err);
-```
-
-`Curl_bufq_slurp()` will invoke the given `reader` callback, passing it its own internal
-buffer memory to write to. It may invoke the `reader` several times, as long as it has space
-and while the `reader` always returns the length that was requested. There are variations of `slurp` that call the `reader` at most once or only read in a
-maximum amount of bytes.
-
-The analog mechanism for write out buffer data is:
-
-```
-typedef ssize_t Curl_bufq_writer(void *writer_ctx, const unsigned char *buf, size_t len,
-                                 CURLcode *err);
-
-ssize_t Curl_bufq_pass(struct bufq *q, Curl_bufq_writer *writer, void *writer_ctx,
-                       CURLcode *err);
-```
-
-`Curl_bufq_pass()` will invoke the `writer`, passing its internal memory and remove the
-amount that `writer` reports.
-
-## peek and skip
-
-It is possible to get access to the memory of data stored in a `bufq` with:
-
-```
-bool Curl_bufq_peek(const struct bufq *q, const unsigned char **pbuf, size_t *plen);
-```
-
-On returning TRUE, `pbuf` will point to internal memory with `plen` bytes that one may read. This will only
-be valid until another operation on `bufq` is performed.
-
-Instead of reading `bufq` data, one may simply skip it:
-
-```
-void Curl_bufq_skip(struct bufq *q, size_t amount);
-```
-
-This will remove `amount` number of bytes from the `bufq`.
-
-
-## lifetime
-
-`bufq` is initialized and freed similar to the `dynbuf` module. Code using `bufq` will
-hold a `struct bufq` somewhere. Before it uses it, it invokes:
-
-```
-void Curl_bufq_init(struct bufq *q, size_t chunk_size, size_t max_chunks);
-```
-
-The `bufq` is told how many "chunks" of data it shall hold at maximum and how large those
-"chunks" should be. There are some variants of this, allowing for more options. How "chunks" are handled in a `bufq` is presented in the section about memory management.
-
-The user of the `bufq` has the responsibility to call:
-
-```
-void Curl_bufq_free(struct bufq *q);
-```
-to free all resources held by `q`. It is possible to reset a `bufq` to empty via:
-
-```
-void Curl_bufq_reset(struct bufq *q);
-```
-
-## memory management
-
-Internally, a `bufq` uses allocation of fixed size, e.g. the "chunk_size", up to a maximum number, e.g. "max_chunks". These chunks are allocated on demand, therefore writing to a `bufq` may return `CURLE_OUT_OF_MEMORY`. Once the max number of chunks are used, the `bufq` will report that it is "full".
-
-Each chunks has a `read` and `write` index. A `bufq` keeps its chunks in a list. Reading happens always at the head chunk, writing always goes to the tail chunk. When the head chunk becomes empty, it is removed. When the tail chunk becomes full, another chunk is added to the end of the list, becoming the new tail.
-
-Chunks that are no longer used are returned to a `spare` list by default. If the `bufq` is created with option `BUFQ_OPT_NO_SPARES` those chunks will be freed right away.
-
-If a `bufq` is created with a `bufc_pool`, the no longer used chunks are returned to the pool. Also `bufq` will ask the pool for a chunk when it needs one. More in section "pools".
-
-## empty, full and overflow
-
-One can ask about the state of a `bufq` with methods such as `Curl_bufq_is_empty(q)`,
-`Curl_bufq_is_full(q)`, etc. The amount of data held by a `bufq` is the sum of the data in all its chunks. This is what is reported by `Curl_bufq_len(q)`.
-
-Note that a `bufq` length and it being "full" are only loosely related. A simple example:
-
-* create a `bufq` with chunk_size=1000 and max_chunks=4.
-* write 4000 bytes to it, it will report "full"
-* read 1 bytes from it, it will still report "full"
-* read 999 more bytes from it, and it will no longer be "full"
-
-The reason for this is that full really means: *bufq uses max_chunks and the last one cannot be written to*.
-
-So when you read 1 byte from the head chunk in the example above, the head still hold 999 unread bytes. Only when those are also read, can the head chunk be removed and a new tail be added.
-
-There is another variation to this. If you initialized a `bufq` with option `BUFQ_OPT_SOFT_LIMIT`, it will allow writes **beyond** the `max_chunks`. It will report **full**, but one can **still** write. This option is necessary, if partial writes need to be avoided. But it means that you will need other checks to keep the `bufq` from growing ever larger and larger.
-
-
-## pools
-
-A `struct bufc_pool` may be used to create chunks for a `bufq` and keep spare ones around. It is initialized
-and used via:
-
-```
-void Curl_bufcp_init(struct bufc_pool *pool, size_t chunk_size, size_t spare_max);
-
-void Curl_bufq_initp(struct bufq *q, struct bufc_pool *pool, size_t max_chunks, int opts);
-```
-
-The pool gets the size and the mount of spares to keep. The `bufq` gets the pool and the `max_chunks`. It no longer needs to know the chunk sizes, as those are managed by the pool.
-
-A pool can be shared between many `bufq`s, as long as all of them operate in the same thread. In curl that would be true for all transfers using the same multi handle. The advantages of a pool are:
-
-* when all `bufq`s are empty, only memory for `max_spare` chunks in the pool is used. Empty `bufq`s will hold no memory.
-* the latest spare chunk is the first to be handed out again, no matter which `bufq` needs it. This keeps the footprint of "recently used" memory smaller.
diff --git a/third-party/curl/docs/BUG-BOUNTY.md b/third-party/curl/docs/BUG-BOUNTY.md
index 3714efda52..765cf493e6 100644
--- a/third-party/curl/docs/BUG-BOUNTY.md
+++ b/third-party/curl/docs/BUG-BOUNTY.md
@@ -1,78 +1,16 @@
-# The curl bug bounty
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
 
-The curl project runs a bug bounty program in association with
-[HackerOne](https://www.hackerone.com) and the [Internet Bug
-Bounty](https://internetbugbounty.org).
+SPDX-License-Identifier: curl
+-->
 
-## How does it work?
+# No curl bug bounty
 
-Start out by posting your suspected security vulnerability directly to [curl's
-HackerOne program](https://hackerone.com/curl).
+The curl project does not offer any rewards for reported bugs or
+vulnerabilities. We do not aid security researchers to get such rewards for
+curl problems from other sources.
 
-After you have reported a security issue, it has been deemed credible, and a
-patch and advisory has been made public, you may be eligible for a bounty from
-this program. See the [Security Process](https://curl.se/dev/secprocess.html)
-document for how we work with security issues.
+A bug bounty gives people too strong incentives to find and make up "problems"
+in bad faith that cause overload and abuse.
 
-## What are the reward amounts?
-
-The curl project offers monetary compensation for reported and published
-security vulnerabilities. The amount of money that is rewarded depends on how
-serious the flaw is determined to be.
-
-Since 2021, the Bug Bounty is managed in association with the Internet Bug
-Bounty and they will set the reward amounts. If it would turn out that they
-set amounts that are way lower than we can accept, the curl project intends to
-"top up" rewards.
-
-In 2022, typical "Medium" rated vulnerabilities have been rewarded 2,400 USD
-each.
-
-## Who is eligible for a reward?
-
-Everyone and anyone who reports a security problem in a released curl version
-that has not already been reported can ask for a bounty.
-
-Dedicated - paid for - security audits that are performed in collaboration
-with curl developers are not eligible for bounties.
-
-Vulnerabilities in features that are off by default and documented as
-experimental are not eligible for a reward.
-
-The vulnerability has to be fixed and publicly announced (by the curl project)
-before a bug bounty will be considered.
-
-Once the vulnerability has been published by curl, the researcher can request
-their bounty from the [Internet Bug Bounty](https://hackerone.com/ibb).
-
-Bounties need to be requested within twelve months from the publication of the
-vulnerability.
-
-## Product vulnerabilities only
-
-This bug bounty only concerns the curl and libcurl products and thus their
-respective source codes - when running on existing hardware. It does not
-include curl documentation, curl websites, or other curl related
-infrastructure.
-
-The curl security team is the sole arbiter if a reported flaw is subject to a
-bounty or not.
-
-## How are vulnerabilities graded?
-
-The grading of each reported vulnerability that makes a reward claim will be
-performed by the curl security team. The grading will be based on the CVSS
-(Common Vulnerability Scoring System) 3.0.
-
-## How are reward amounts determined?
-
-The curl security team gives the vulnerability a score or severity level, as
-mentioned above. The actual monetary reward amount is decided and paid by the
-Internet Bug Bounty..
-
-## Regarding taxes, etc. on the bounties
-
-In the event that the individual receiving a bug bounty needs to pay taxes on
-the reward money, the responsibility lies with the receiver. The curl project
-or its security team never actually receive any of this money, hold the money,
-or pay out the money.
+We still appreciate and value valid vulnerability reports.
diff --git a/third-party/curl/docs/BUGS.md b/third-party/curl/docs/BUGS.md
index 2a8c56fe62..5f3704771b 100644
--- a/third-party/curl/docs/BUGS.md
+++ b/third-party/curl/docs/BUGS.md
@@ -1,265 +1,267 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # BUGS
 
 ## There are still bugs
 
- Curl and libcurl keep being developed. Adding features and changing code
- means that bugs will sneak in, no matter how hard we try to keep them out.
+curl and libcurl keep being developed. Adding features and changing code
+means that bugs sneak in, no matter how hard we try to keep them out.
 
- Of course there are lots of bugs left. And lots of misfeatures.
+Of course there are lots of bugs left. Not to mention misfeatures.
 
- To help us make curl the stable and solid product we want it to be, we need
- bug reports and bug fixes.
+To help us make curl the stable and solid product we want it to be, we need
+bug reports and bug fixes.
 
 ## Where to report
 
- If you cannot fix a bug yourself and submit a fix for it, try to report an as
- detailed report as possible to a curl mailing list to allow one of us to have
- a go at a solution. You can optionally also submit your problem in [curl's
- bug tracking system](https://github.com/curl/curl/issues).
+If you cannot fix a bug yourself and submit a fix for it, try to report an as
+detailed report as possible to a curl mailing list to allow one of us to have
+a go at a solution. You can optionally also submit your problem in
+[curl's bug tracking system](https://github.com/curl/curl/issues).
 
- Please read the rest of this document below first before doing that.
+Please read the rest of this document below first before doing that.
 
- If you feel you need to ask around first, find a suitable [mailing list](
- https://curl.se/mail/) and post your questions there.
+If you feel you need to ask around first, find a suitable
+[mailing list](https://curl.se/mail/) and post your questions there.
 
 ## Security bugs
 
- If you find a bug or problem in curl or libcurl that you think has a security
- impact, for example a bug that can put users in danger or make them
- vulnerable if the bug becomes public knowledge, then please report that bug
- using our security development process.
+If you find a bug or problem in curl or libcurl that you think has a security
+impact, for example a bug that can put users in danger or make them
+vulnerable if the bug becomes public knowledge, then please report that bug
+using our security development process.
 
- Security related bugs or bugs that are suspected to have a security impact,
- should be reported on the [curl security tracker at
- HackerOne](https://hackerone.com/curl).
+Security related bugs or bugs that are suspected to have a security impact,
+should be reported [privately](https://curl.se/dev/vuln-disclosure.html).
 
- This ensures that the report reaches the curl security team so that they
- first can deal with the report away from the public to minimize the harm
- and impact it will have on existing users out there who might be using the
- vulnerable versions.
+This ensures that the report reaches the curl security team so that they first
+can deal with the report away from the public to minimize the harm and impact
+it has on existing users out there who might be using the vulnerable versions.
 
- The curl project's process for handling security related issues is
- [documented separately](https://curl.se/dev/secprocess.html).
+The curl project's process for handling security related issues is
+[documented separately](https://curl.se/dev/secprocess.html).
 
 ## What to report
 
- When reporting a bug, you should include all information that will help us
- understand what is wrong, what you expected to happen and how to repeat the
- bad behavior. You therefore need to tell us:
+When reporting a bug, you should include all information to help us
+understand what is wrong, what you expected to happen and how to repeat the
+bad behavior. You therefore need to tell us:
 
- - your operating system's name and version number
+- your operating system's name and version number
 
- - what version of curl you are using (`curl -V` is fine)
+- what version of curl you are using (`curl -V` is fine)
 
- - versions of the used libraries that libcurl is built to use
+- versions of the used libraries that libcurl is built to use
 
- - what URL you were working with (if possible), at least which protocol
+- what URL you were working with (if possible), at least which protocol
 
- and anything and everything else you think matters. Tell us what you expected
- to happen, tell use what did happen, tell us how you could make it work
- another way. Dig around, try out, test. Then include all the tiny bits and
- pieces in your report. You will benefit from this yourself, as it will enable
- us to help you quicker and more accurately.
+and anything and everything else you think matters. Tell us what you expected
+to happen, tell us what did happen, tell us how you could make it work
+another way. Dig around, try out, test. Then include all the tiny bits and
+pieces in your report. You benefit from this yourself, as it enables us to
+help you quicker and more accurately.
 
- Since curl deals with networks, it often helps us if you include a protocol
- debug dump with your bug report. The output you get by using the `-v` or
- `--trace` options.
+Since curl deals with networks, it often helps us if you include a protocol
+debug dump with your bug report. The output you get by using the `-v` or
+`--trace` options.
 
- If curl crashed, causing a core dump (in Unix), there is hardly any use to
- send that huge file to anyone of us. Unless we have the same system setup as
- you, we cannot do much with it. Instead, we ask you to get a stack trace and
- send that (much smaller) output to us instead.
+If curl crashed, causing a core dump (in Unix), there is hardly any use to
+send that huge file to anyone of us. Unless we have the same system setup as
+you, we cannot do much with it. Instead, we ask you to get a stack trace and
+send that (much smaller) output to us instead.
 
- The address and how to subscribe to the mailing lists are detailed in the
- `MANUAL.md` file.
+The address and how to subscribe to the mailing lists are detailed in the
+`MANUAL.md` file.
 
 ## libcurl problems
 
- When you have written your own application with libcurl to perform transfers,
- it is even more important to be specific and detailed when reporting bugs.
+When you have written your own application with libcurl to perform transfers,
+it is even more important to be specific and detailed when reporting bugs.
 
- Tell us the libcurl version and your operating system. Tell us the name and
- version of all relevant sub-components like for example the SSL library
- you are using and what name resolving your libcurl uses. If you use SFTP or
- SCP, the libssh2 version is relevant etc.
+Tell us the libcurl version and your operating system. Tell us the name and
+version of all relevant sub-components like for example the SSL library
+you are using and what name resolving your libcurl uses. If you use SFTP or
+SCP, the libssh2 version is relevant etc.
 
- Showing us a real source code example repeating your problem is the best way
- to get our attention and it will greatly increase our chances to understand
- your problem and to work on a fix (if we agree it truly is a problem).
+Showing us a real source code example repeating your problem is the best way
+to get our attention and it greatly increases our chances to understand your
+problem and to work on a fix (if we agree it truly is a problem).
 
- Lots of problems that appear to be libcurl problems are actually just abuses
- of the libcurl API or other malfunctions in your applications. It is advised
- that you run your problematic program using a memory debug tool like valgrind
- or similar before you post memory-related or "crashing" problems to us.
+Lots of problems that appear to be libcurl problems are instead abuses of the
+libcurl API or other malfunctions in your applications. It is advised that you
+run your problematic program using a memory debug tool like valgrind or
+similar before you post memory-related or "crashing" problems to us.
 
-## Who will fix the problems
+## Who fixes the problems
 
- If the problems or bugs you describe are considered to be bugs, we want to
- have the problems fixed.
+If the problems or bugs you describe are considered to be bugs, we want to
+have the problems fixed.
 
- There are no developers in the curl project that are paid to work on bugs.
- All developers that take on reported bugs do this on a voluntary basis. We do
- it out of an ambition to keep curl and libcurl excellent products and out of
- pride.
+There are no developers in the curl project that are paid to work on bugs.
+All developers that take on reported bugs do this on a voluntary basis. We do
+it out of an ambition to keep curl and libcurl excellent products and out of
+pride.
 
- Please do not assume that you can just lump over something to us and it will
- then magically be fixed after some given time. Most often we need feedback
- and help to understand what you have experienced and how to repeat a
- problem. Then we may only be able to assist YOU to debug the problem and to
- track down the proper fix.
+Please do not assume that you can lump over something to us and it then
+automatically gets fixed after some given time. Most often we need feedback
+and help to understand what you have experienced and how to repeat a problem.
+Then we may only be able to assist YOU to debug the problem and to track down
+the proper fix.
 
- We get reports from many people every month and each report can take a
- considerable amount of time to really go to the bottom with.
+We get reports from many people every month and each report can take a
+considerable amount of time to really go to the bottom with.
 
 ## How to get a stack trace
 
- First, you must make sure that you compile all sources with `-g` and that you
- do not 'strip' the final executable. Try to avoid optimizing the code as well,
- remove `-O`, `-O2` etc from the compiler options.
+First, you must make sure that you compile all sources with `-g` and that you
+do not 'strip' the final executable. Try to avoid optimizing the code as well,
+remove `-O`, `-O2` etc from the compiler options.
 
- Run the program until it cores.
+Run the program until it cores.
 
- Run your debugger on the core file, like `<debugger> curl
- core`. `<debugger>` should be replaced with the name of your debugger, in
- most cases that will be `gdb`, but `dbx` and others also occur.
+Run your debugger on the core file, like `<debugger> curl core`. `<debugger>`
+should be replaced with the name of your debugger, in most cases that is
+`gdb`, but `dbx` and others also occur.
 
- When the debugger has finished loading the core file and presents you a
- prompt, enter `where` (without quotes) and press return.
+When the debugger has finished loading the core file and presents you a
+prompt, enter `where` (without quotes) and press return.
 
- The list that is presented is the stack trace. If everything worked, it is
- supposed to contain the chain of functions that were called when curl
- crashed. Include the stack trace with your detailed bug report, it will help a
- lot.
+The list that is presented is the stack trace. If everything worked, it is
+supposed to contain the chain of functions that were called when curl
+crashed. Include the stack trace with your detailed bug report, it helps a
+lot.
 
 ## Bugs in libcurl bindings
 
- There will of course pop up bugs in libcurl bindings. You should then
- primarily approach the team that works on that particular binding and see
- what you can do to help them fix the problem.
+There are of course bugs in libcurl bindings. You should then primarily
+approach the team that works on that particular binding and see what you can
+do to help them fix the problem.
 
- If you suspect that the problem exists in the underlying libcurl, then please
- convert your program over to plain C and follow the steps outlined above.
+If you suspect that the problem exists in the underlying libcurl, then please
+convert your program over to plain C and follow the steps outlined above.
 
 ## Bugs in old versions
 
- The curl project typically releases new versions every other month, and we
- fix several hundred bugs per year. For a huge table of releases, number of
- bug fixes and more, see: https://curl.se/docs/releases.html
+The curl project typically releases new versions every other month, and we
+fix several hundred bugs per year. For a huge table of releases, number of
+bug fixes and more, see: https://curl.se/docs/releases.html
 
- The developers in the curl project do not have bandwidth or energy enough to
- maintain several branches or to spend much time on hunting down problems in
- old versions when chances are we already fixed them or at least that they have
- changed nature and appearance in later versions.
+The developers in the curl project do not have bandwidth or energy enough to
+maintain several branches or to spend much time on hunting down problems in
+old versions when chances are we already fixed them or at least that they have
+changed nature and appearance in later versions.
 
- When you experience a problem and want to report it, you really SHOULD
- include the version number of the curl you are using when you experience the
- issue. If that version number shows us that you are using an out-of-date curl,
- you should also try out a modern curl version to see if the problem persists
- or how/if it has changed in appearance.
+When you experience a problem and want to report it, you really SHOULD
+include the version number of the curl you are using when you experience the
+issue. If that version number shows us that you are using an out-of-date curl,
+you should also try out a modern curl version to see if the problem persists
+or how/if it has changed in appearance.
 
- Even if you cannot immediately upgrade your application/system to run the
- latest curl version, you can most often at least run a test version or
- experimental build or similar, to get this confirmed or not.
+Even if you cannot immediately upgrade your application/system to run the
+latest curl version, you can most often at least run a test version or
+experimental build or similar, to get this confirmed or not.
 
- At times people insist that they cannot upgrade to a modern curl version, but
- instead, they "just want the bug fixed". That is fine, just do not count on us
- spending many cycles on trying to identify which single commit, if that is
- even possible, that at some point in the past fixed the problem you are now
- experiencing.
+At times people insist that they cannot upgrade to a modern curl version, they
+only "want the bug fixed". That is fine, but do not count on us spending many
+cycles on trying to identify which single commit, if that is even possible,
+that at some point in the past fixed the problem you are now experiencing.
 
- Security wise, it is almost always a bad idea to lag behind the current curl
- versions by a lot. We keep discovering and reporting security problems
- over time see you can see in [this
- table](https://curl.se/docs/vulnerabilities.html)
+Security wise, it is almost always a bad idea to lag behind the current curl
+versions by a lot. We keep discovering and reporting security problems
+over time see you can see in
+[this table](https://curl.se/docs/vulnerabilities.html)
 
 # Bug fixing procedure
 
 ## What happens on first filing
 
- When a new issue is posted in the issue tracker or on the mailing list, the
- team of developers first needs to see the report. Maybe they took the day off,
- maybe they are off in the woods hunting. Have patience. Allow at least a few
- days before expecting someone to have responded.
+When a new issue is posted in the issue tracker or on the mailing list, the
+team of developers first needs to see the report. Maybe they took the day off,
+maybe they are off in the woods hunting. Have patience. Allow at least a few
+days before expecting someone to have responded.
 
- In the issue tracker, you can expect that some labels will be set on the issue
- to help categorize it.
+In the issue tracker, you can expect that some labels are set on the issue to
+help categorize it.
 
 ## First response
 
- If your issue/bug report was not perfect at once (and few are), chances are
- that someone will ask follow-up questions. Which version did you use? Which
- options did you use? How often does the problem occur? How can we reproduce
- this problem? Which protocols does it involve? Or perhaps much more specific
- and deep diving questions. It all depends on your specific issue.
+If your issue/bug report was not perfect at once (and few are), chances are
+that someone asks follow-up questions. Which version did you use? Which
+options did you use? How often does the problem occur? How can we reproduce
+this problem? Which protocols does it involve? Or perhaps much more specific
+and deep diving questions. It all depends on your specific issue.
 
- You should then respond to these follow-up questions and provide more info
- about the problem, so that we can help you figure it out. Or maybe you can
- help us figure it out. An active back-and-forth communication is important
- and the key for finding a cure and landing a fix.
+You should then respond to these follow-up questions and provide more info
+about the problem, so that we can help you figure it out. Or maybe you can
+help us figure it out. An active back-and-forth communication is important
+and the key for finding a cure and landing a fix.
 
 ## Not reproducible
 
- We may require further work from you who actually see or experience the
- problem if we cannot reproduce it and cannot understand it even after having
- gotten all the info we need and having studied the source code over again.
+We may require further work from you who actually see or experience the
+problem if we cannot reproduce it and cannot understand it even after having
+gotten all the info we need and having studied the source code over again.
 
 ## Unresponsive
 
- If the problem have not been understood or reproduced, and there is nobody
- responding to follow-up questions or questions asking for clarifications or
- for discussing possible ways to move forward with the task, we take that as a
- strong suggestion that the bug is unimportant.
+If the problem have not been understood or reproduced, and there is nobody
+responding to follow-up questions or questions asking for clarifications or
+for discussing possible ways to move forward with the task, we take that as a
+strong suggestion that the bug is unimportant.
 
- Unimportant issues will be closed as inactive sooner or later as they cannot
- be fixed. The inactivity period (waiting for responses) should not be shorter
- than two weeks but may extend months.
+Unimportant issues are closed as inactive sooner or later as they cannot be
+fixed. The inactivity period (waiting for responses) should not be shorter
+than two weeks but may extend months.
 
 ## Lack of time/interest
 
- Bugs that are filed and are understood can unfortunately end up in the
- "nobody cares enough about it to work on it" category. Such bugs are
- perfectly valid problems that *should* get fixed but apparently are not. We
- try to mark such bugs as `KNOWN_BUGS material` after a time of inactivity and
- if no activity is noticed after yet some time those bugs are added to the
- `KNOWN_BUGS` document and are closed in the issue tracker.
+Bugs that are filed and are understood can unfortunately end up in the
+"nobody cares enough about it to work on it" category. Such bugs are
+perfectly valid problems that *should* get fixed but apparently are not. We
+try to mark such bugs as `KNOWN_BUGS material` after a time of inactivity and
+if no activity is noticed after yet some time those bugs are added to the
+`KNOWN_BUGS` document and are closed in the issue tracker.
 
 ## `KNOWN_BUGS`
 
- This is a list of known bugs. Bugs we know exist and that have been pointed
- out but that have not yet been fixed. The reasons for why they have not been
- fixed can involve anything really, but the primary reason is that nobody has
- considered these problems to be important enough to spend the necessary time
- and effort to have them fixed.
+This is a list of known bugs. Bugs we know exist and that have been pointed
+out but that have not yet been fixed. The reasons for why they have not been
+fixed can involve anything really, but the primary reason is that nobody has
+considered these problems to be important enough to spend the necessary time
+and effort to have them fixed.
 
- The `KNOWN_BUGS` items are always up for grabs and we love the ones who bring
- one of them back to life and offer solutions to them.
+The `KNOWN_BUGS` items are always up for grabs and we love the ones who bring
+one of them back to life and offer solutions to them.
 
- The `KNOWN_BUGS` document has a sibling document known as `TODO`.
+The `KNOWN_BUGS` document has a sibling document known as `TODO`.
 
 ## `TODO`
 
- Issues that are filed or reported that are not really bugs but more missing
- features or ideas for future improvements and so on are marked as
- 'enhancement' or 'feature-request' and will be added to the `TODO` document
- and the issues are closed. We do not keep TODO items open in the issue
- tracker.
+Issues that are filed or reported that are not really bugs but more missing
+features or ideas for future improvements and so on are marked as
+*enhancement* or *feature-request* and get added to the `TODO` document and
+the issues are closed. We do not keep TODO items open in the issue tracker.
 
- The `TODO` document is full of ideas and suggestions of what we can add or
- fix one day. You are always encouraged and free to grab one of those items and
- take up a discussion with the curl development team on how that could be
- implemented or provided in the project so that you can work on ticking it odd
- that document.
+The `TODO` document is full of ideas and suggestions of what we can add or
+fix one day. You are always encouraged and free to grab one of those items and
+take up a discussion with the curl development team on how that could be
+implemented or provided in the project so that you can work on ticking it odd
+that document.
 
- If an issue is rather a bug and not a missing feature or functionality, it is
- listed in `KNOWN_BUGS` instead.
+If an issue is rather a bug and not a missing feature or functionality, it is
+listed in `KNOWN_BUGS` instead.
 
 ## Closing off stalled bugs
 
- The [issue and pull request trackers](https://github.com/curl/curl) only
- hold "active" entries open (using a non-precise definition of what active
- actually is, but they are at least not completely dead). Those that are
- abandoned or in other ways dormant will be closed and sometimes added to
- `TODO` and `KNOWN_BUGS` instead.
+The [issue and pull request trackers](https://github.com/curl/curl) only hold
+"active" entries open (using a non-precise definition of what active actually
+is, but they are at least not completely dead). Those that are abandoned or
+in other ways dormant are closed and sometimes added to `TODO` and
+`KNOWN_BUGS` instead.
 
- This way, we only have "active" issues open on GitHub. Irrelevant issues and
- pull requests will not distract developers or casual visitors.
+This way, we only have "active" issues open on GitHub. Irrelevant issues and
+pull requests do not distract developers or casual visitors.
diff --git a/third-party/curl/docs/CHECKSRC.md b/third-party/curl/docs/CHECKSRC.md
deleted file mode 100644
index 476df262a1..0000000000
--- a/third-party/curl/docs/CHECKSRC.md
+++ /dev/null
@@ -1,182 +0,0 @@
-# checksrc
-
-This is the tool we use within the curl project to scan C source code and
-check that it adheres to our [Source Code Style guide](CODE_STYLE.md).
-
-## Usage
-
-    checksrc.pl [options] [file1] [file2] ...
-
-## Command line options
-
-`-W[file]` skip that file and exclude it from being checked. Helpful
-when, for example, one of the files is generated.
-
-`-D[dir]` directory name to prepend to file names when accessing them.
-
-`-h` shows the help output, that also lists all recognized warnings
-
-## What does `checksrc` warn for?
-
-`checksrc` does not check and verify the code against the entire style guide.
-The script is an effort to detect the most common mistakes and syntax mistakes
-that contributors make before they get accustomed to our code style. Heck,
-many of us regulars do the mistakes too and this script helps us keep the code
-in shape.
-
-    checksrc.pl -h
-
-Lists how to use the script and it lists all existing warnings it has and
-problems it detects. At the time of this writing, the existing `checksrc`
-warnings are:
-
-- `ASSIGNWITHINCONDITION`: Assignment within a conditional expression. The
-  code style mandates the assignment to be done outside of it.
-
-- `ASTERISKNOSPACE`: A pointer was declared like `char* name` instead of the
-   more appropriate `char *name` style. The asterisk should sit next to the
-   name.
-
-- `ASTERISKSPACE`: A pointer was declared like `char * name` instead of the
-   more appropriate `char *name` style. The asterisk should sit right next to
-   the name without a space in between.
-
-- `BADCOMMAND`: There is a bad `checksrc` instruction in the code. See the
-   **Ignore certain warnings** section below for details.
-
-- `BANNEDFUNC`: A banned function was used. The functions sprintf, vsprintf,
-   strcat, strncat, gets are **never** allowed in curl source code.
-
-- `BRACEELSE`: '} else' on the same line. The else is supposed to be on the
-   following line.
-
-- `BRACEPOS`: wrong position for an open brace (`{`).
-
-- `BRACEWHILE`: more than once space between end brace and while keyword
-
-- `COMMANOSPACE`: a comma without following space
-
-- `COPYRIGHT`: the file is missing a copyright statement
-
-- `CPPCOMMENTS`: `//` comment detected, that is not C89 compliant
-
-- `DOBRACE`: only use one space after do before open brace
-
-- `EMPTYLINEBRACE`: found empty line before open brace
-
-- `EQUALSNOSPACE`: no space after `=` sign
-
-- `EQUALSNULL`: comparison with `== NULL` used in if/while. We use `!var`.
-
-- `EXCLAMATIONSPACE`: space found after exclamations mark
-
-- `FOPENMODE`: `fopen()` needs a macro for the mode string, use it
-
-- `INDENTATION`: detected a wrong start column for code. Note that this
-   warning only checks some specific places and will certainly miss many bad
-   indentations.
-
-- `LONGLINE`: A line is longer than 79 columns.
-
-- `MULTISPACE`: Multiple spaces were found where only one should be used.
-
-- `NOSPACEEQUALS`: An equals sign was found without preceding space. We prefer
-  `a = 2` and *not* `a=2`.
-
-- `NOTEQUALSZERO`: check found using `!= 0`. We use plain `if(var)`.
-
-- `ONELINECONDITION`: do not put the conditional block on the same line as `if()`
-
-- `OPENCOMMENT`: File ended with a comment (`/*`) still "open".
-
-- `PARENBRACE`: `){` was used without sufficient space in between.
-
-- `RETURNNOSPACE`: `return` was used without space between the keyword and the
-   following value.
-
-- `SEMINOSPACE`: There was no space (or newline) following a semicolon.
-
-- `SIZEOFNOPAREN`: Found use of sizeof without parentheses. We prefer
-  `sizeof(int)` style.
-
-- `SNPRINTF` - Found use of `snprintf()`. Since we use an internal replacement
-   with a different return code etc, we prefer `msnprintf()`.
-
-- `SPACEAFTERPAREN`: there was a space after open parenthesis, `( text`.
-
-- `SPACEBEFORECLOSE`: there was a space before a close parenthesis, `text )`.
-
-- `SPACEBEFORECOMMA`: there was a space before a comma, `one , two`.
-
-- `SPACEBEFOREPAREN`: there was a space before an open parenthesis, `if (`,
-   where one was not expected
-
-- `SPACESEMICOLON`: there was a space before semicolon, ` ;`.
-
-- `TABS`: TAB characters are not allowed
-
-- `TRAILINGSPACE`: Trailing whitespace on the line
-
-- `TYPEDEFSTRUCT`: we frown upon (most) typedefed structs
-
-- `UNUSEDIGNORE`: a `checksrc` inlined warning ignore was asked for but not
-   used, that is an ignore that should be removed or changed to get used.
-
-### Extended warnings
-
-Some warnings are quite computationally expensive to perform, so they are
-turned off by default. To enable these warnings, place a `.checksrc` file in
-the directory where they should be activated with commands to enable the
-warnings you are interested in. The format of the file is to enable one
-warning per line like so: `enable <EXTENDEDWARNING>`
-
-Currently these are the extended warnings which can be enabled:
-
-- `COPYRIGHTYEAR`: the current changeset has not updated the copyright year in
-   the source file
-
-- `STRERROR`: use of banned function strerror()
-
-## Ignore certain warnings
-
-Due to the nature of the source code and the flaws of the `checksrc` tool,
-there is sometimes a need to ignore specific warnings. `checksrc` allows a few
-different ways to do this.
-
-### Inline ignore
-
-You can control what to ignore within a specific source file by providing
-instructions to `checksrc` in the source code itself. See examples below. The
-instruction can ask to ignore a specific warning a specific number of times or
-you ignore all of them until you mark the end of the ignored section.
-
-Inline ignores are only done for that single specific source code file.
-
-Example
-
-    /* !checksrc! disable LONGLINE all */
-
-This will ignore the warning for overly long lines until it is re-enabled with:
-
-    /* !checksrc! enable LONGLINE */
-
-If the enabling is not performed before the end of the file, it will be enabled
-automatically for the next file.
-
-You can also opt to ignore just N violations so that if you have a single long
-line you just cannot shorten and is agreed to be fine anyway:
-
-    /* !checksrc! disable LONGLINE 1 */
-
-... and the warning for long lines will be enabled again automatically after
-it has ignored that single warning. The number `1` can of course be changed to
-any other integer number. It can be used to make sure only the exact intended
-instances are ignored and nothing extra.
-
-### Directory wide ignore patterns
-
-This is a method we have transitioned away from. Use inline ignores as far as
-possible.
-
-Make a `checksrc.skip` file in the directory of the source code with the
-false positive, and include the full offending line into this file.
diff --git a/third-party/curl/docs/CIPHERS-TLS12.md b/third-party/curl/docs/CIPHERS-TLS12.md
new file mode 100644
index 0000000000..d67c62ba7e
--- /dev/null
+++ b/third-party/curl/docs/CIPHERS-TLS12.md
@@ -0,0 +1,336 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# TLS 1.2 cipher suites
+
+| Id     | IANA name                                     | OpenSSL name                       | RFC                |
+|--------|-----------------------------------------------|------------------------------------|--------------------|
+| 0x0001 | TLS_RSA_WITH_NULL_MD5                         | NULL-MD5                           | [RFC5246]          |
+| 0x0002 | TLS_RSA_WITH_NULL_SHA                         | NULL-SHA                           | [RFC5246]          |
+| 0x0003 | TLS_RSA_EXPORT_WITH_RC4_40_MD5                | EXP-RC4-MD5                        | [RFC4346][RFC6347] |
+| 0x0004 | TLS_RSA_WITH_RC4_128_MD5                      | RC4-MD5                            | [RFC5246][RFC6347] |
+| 0x0005 | TLS_RSA_WITH_RC4_128_SHA                      | RC4-SHA                            | [RFC5246][RFC6347] |
+| 0x0006 | TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5            | EXP-RC2-CBC-MD5                    | [RFC4346]          |
+| 0x0007 | TLS_RSA_WITH_IDEA_CBC_SHA                     | IDEA-CBC-SHA                       | [RFC8996]          |
+| 0x0008 | TLS_RSA_EXPORT_WITH_DES40_CBC_SHA             | EXP-DES-CBC-SHA                    | [RFC4346]          |
+| 0x0009 | TLS_RSA_WITH_DES_CBC_SHA                      | DES-CBC-SHA                        | [RFC8996]          |
+| 0x000A | TLS_RSA_WITH_3DES_EDE_CBC_SHA                 | DES-CBC3-SHA                       | [RFC5246]          |
+| 0x000B | TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA          | EXP-DH-DSS-DES-CBC-SHA             | [RFC4346]          |
+| 0x000C | TLS_DH_DSS_WITH_DES_CBC_SHA                   | DH-DSS-DES-CBC-SHA                 | [RFC8996]          |
+| 0x000D | TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA              | DH-DSS-DES-CBC3-SHA                | [RFC5246]          |
+| 0x000E | TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA          | EXP-DH-RSA-DES-CBC-SHA             | [RFC4346]          |
+| 0x000F | TLS_DH_RSA_WITH_DES_CBC_SHA                   | DH-RSA-DES-CBC-SHA                 | [RFC8996]          |
+| 0x0010 | TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA              | DH-RSA-DES-CBC3-SHA                | [RFC5246]          |
+| 0x0011 | TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA         | EXP-DHE-DSS-DES-CBC-SHA            | [RFC4346]          |
+| 0x0012 | TLS_DHE_DSS_WITH_DES_CBC_SHA                  | DHE-DSS-DES-CBC-SHA                | [RFC8996]          |
+| 0x0013 | TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA             | DHE-DSS-DES-CBC3-SHA               | [RFC5246]          |
+| 0x0014 | TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA         | EXP-DHE-RSA-DES-CBC-SHA            | [RFC4346]          |
+| 0x0015 | TLS_DHE_RSA_WITH_DES_CBC_SHA                  | DHE-RSA-DES-CBC-SHA                | [RFC8996]          |
+| 0x0016 | TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA             | DHE-RSA-DES-CBC3-SHA               | [RFC5246]          |
+| 0x0017 | TLS_DH_anon_EXPORT_WITH_RC4_40_MD5            | EXP-ADH-RC4-MD5                    | [RFC4346][RFC6347] |
+| 0x0018 | TLS_DH_anon_WITH_RC4_128_MD5                  | ADH-RC4-MD5                        | [RFC5246][RFC6347] |
+| 0x0019 | TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA         | EXP-ADH-DES-CBC-SHA                | [RFC4346]          |
+| 0x001A | TLS_DH_anon_WITH_DES_CBC_SHA                  | ADH-DES-CBC-SHA                    | [RFC8996]          |
+| 0x001B | TLS_DH_anon_WITH_3DES_EDE_CBC_SHA             | ADH-DES-CBC3-SHA                   | [RFC5246]          |
+| 0x001C |                                               | FZA-NULL-SHA                       |                    |
+| 0x001D |                                               | FZA-FZA-CBC-SHA                    |                    |
+| 0x001E | TLS_KRB5_WITH_DES_CBC_SHA                     | KRB5-DES-CBC-SHA                   | [RFC2712]          |
+| 0x001F | TLS_KRB5_WITH_3DES_EDE_CBC_SHA                | KRB5-DES-CBC3-SHA                  | [RFC2712]          |
+| 0x0020 | TLS_KRB5_WITH_RC4_128_SHA                     | KRB5-RC4-SHA                       | [RFC2712][RFC6347] |
+| 0x0021 | TLS_KRB5_WITH_IDEA_CBC_SHA                    | KRB5-IDEA-CBC-SHA                  | [RFC2712]          |
+| 0x0022 | TLS_KRB5_WITH_DES_CBC_MD5                     | KRB5-DES-CBC-MD5                   | [RFC2712]          |
+| 0x0023 | TLS_KRB5_WITH_3DES_EDE_CBC_MD5                | KRB5-DES-CBC3-MD5                  | [RFC2712]          |
+| 0x0024 | TLS_KRB5_WITH_RC4_128_MD5                     | KRB5-RC4-MD5                       | [RFC2712][RFC6347] |
+| 0x0025 | TLS_KRB5_WITH_IDEA_CBC_MD5                    | KRB5-IDEA-CBC-MD5                  | [RFC2712]          |
+| 0x0026 | TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA           | EXP-KRB5-DES-CBC-SHA               | [RFC2712]          |
+| 0x0027 | TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA           | EXP-KRB5-RC2-CBC-SHA               | [RFC2712]          |
+| 0x0028 | TLS_KRB5_EXPORT_WITH_RC4_40_SHA               | EXP-KRB5-RC4-SHA                   | [RFC2712][RFC6347] |
+| 0x0029 | TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5           | EXP-KRB5-DES-CBC-MD5               | [RFC2712]          |
+| 0x002A | TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5           | EXP-KRB5-RC2-CBC-MD5               | [RFC2712]          |
+| 0x002B | TLS_KRB5_EXPORT_WITH_RC4_40_MD5               | EXP-KRB5-RC4-MD5                   | [RFC2712][RFC6347] |
+| 0x002C | TLS_PSK_WITH_NULL_SHA                         | PSK-NULL-SHA                       | [RFC4785]          |
+| 0x002D | TLS_DHE_PSK_WITH_NULL_SHA                     | DHE-PSK-NULL-SHA                   | [RFC4785]          |
+| 0x002E | TLS_RSA_PSK_WITH_NULL_SHA                     | RSA-PSK-NULL-SHA                   | [RFC4785]          |
+| 0x002F | TLS_RSA_WITH_AES_128_CBC_SHA                  | AES128-SHA                         | [RFC5246]          |
+| 0x0030 | TLS_DH_DSS_WITH_AES_128_CBC_SHA               | DH-DSS-AES128-SHA                  | [RFC5246]          |
+| 0x0031 | TLS_DH_RSA_WITH_AES_128_CBC_SHA               | DH-RSA-AES128-SHA                  | [RFC5246]          |
+| 0x0032 | TLS_DHE_DSS_WITH_AES_128_CBC_SHA              | DHE-DSS-AES128-SHA                 | [RFC5246]          |
+| 0x0033 | TLS_DHE_RSA_WITH_AES_128_CBC_SHA              | DHE-RSA-AES128-SHA                 | [RFC5246]          |
+| 0x0034 | TLS_DH_anon_WITH_AES_128_CBC_SHA              | ADH-AES128-SHA                     | [RFC5246]          |
+| 0x0035 | TLS_RSA_WITH_AES_256_CBC_SHA                  | AES256-SHA                         | [RFC5246]          |
+| 0x0036 | TLS_DH_DSS_WITH_AES_256_CBC_SHA               | DH-DSS-AES256-SHA                  | [RFC5246]          |
+| 0x0037 | TLS_DH_RSA_WITH_AES_256_CBC_SHA               | DH-RSA-AES256-SHA                  | [RFC5246]          |
+| 0x0038 | TLS_DHE_DSS_WITH_AES_256_CBC_SHA              | DHE-DSS-AES256-SHA                 | [RFC5246]          |
+| 0x0039 | TLS_DHE_RSA_WITH_AES_256_CBC_SHA              | DHE-RSA-AES256-SHA                 | [RFC5246]          |
+| 0x003A | TLS_DH_anon_WITH_AES_256_CBC_SHA              | ADH-AES256-SHA                     | [RFC5246]          |
+| 0x003B | TLS_RSA_WITH_NULL_SHA256                      | NULL-SHA256                        | [RFC5246]          |
+| 0x003C | TLS_RSA_WITH_AES_128_CBC_SHA256               | AES128-SHA256                      | [RFC5246]          |
+| 0x003D | TLS_RSA_WITH_AES_256_CBC_SHA256               | AES256-SHA256                      | [RFC5246]          |
+| 0x003E | TLS_DH_DSS_WITH_AES_128_CBC_SHA256            | DH-DSS-AES128-SHA256               | [RFC5246]          |
+| 0x003F | TLS_DH_RSA_WITH_AES_128_CBC_SHA256            | DH-RSA-AES128-SHA256               | [RFC5246]          |
+| 0x0040 | TLS_DHE_DSS_WITH_AES_128_CBC_SHA256           | DHE-DSS-AES128-SHA256              | [RFC5246]          |
+| 0x0041 | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA             | CAMELLIA128-SHA                    | [RFC5932]          |
+| 0x0042 | TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA          | DH-DSS-CAMELLIA128-SHA             | [RFC5932]          |
+| 0x0043 | TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA          | DH-RSA-CAMELLIA128-SHA             | [RFC5932]          |
+| 0x0044 | TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA         | DHE-DSS-CAMELLIA128-SHA            | [RFC5932]          |
+| 0x0045 | TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA         | DHE-RSA-CAMELLIA128-SHA            | [RFC5932]          |
+| 0x0046 | TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA         | ADH-CAMELLIA128-SHA                | [RFC5932]          |
+| 0x0060 |                                               | EXP1024-RC4-MD5                    |                    |
+| 0x0061 |                                               | EXP1024-RC2-CBC-MD5                |                    |
+| 0x0062 |                                               | EXP1024-DES-CBC-SHA                |                    |
+| 0x0063 |                                               | EXP1024-DHE-DSS-DES-CBC-SHA        |                    |
+| 0x0064 |                                               | EXP1024-RC4-SHA                    |                    |
+| 0x0065 |                                               | EXP1024-DHE-DSS-RC4-SHA            |                    |
+| 0x0066 |                                               | DHE-DSS-RC4-SHA                    |                    |
+| 0x0067 | TLS_DHE_RSA_WITH_AES_128_CBC_SHA256           | DHE-RSA-AES128-SHA256              | [RFC5246]          |
+| 0x0068 | TLS_DH_DSS_WITH_AES_256_CBC_SHA256            | DH-DSS-AES256-SHA256               | [RFC5246]          |
+| 0x0069 | TLS_DH_RSA_WITH_AES_256_CBC_SHA256            | DH-RSA-AES256-SHA256               | [RFC5246]          |
+| 0x006A | TLS_DHE_DSS_WITH_AES_256_CBC_SHA256           | DHE-DSS-AES256-SHA256              | [RFC5246]          |
+| 0x006B | TLS_DHE_RSA_WITH_AES_256_CBC_SHA256           | DHE-RSA-AES256-SHA256              | [RFC5246]          |
+| 0x006C | TLS_DH_anon_WITH_AES_128_CBC_SHA256           | ADH-AES128-SHA256                  | [RFC5246]          |
+| 0x006D | TLS_DH_anon_WITH_AES_256_CBC_SHA256           | ADH-AES256-SHA256                  | [RFC5246]          |
+| 0x0080 |                                               | GOST94-GOST89-GOST89               |                    |
+| 0x0081 |                                               | GOST2001-GOST89-GOST89             |                    |
+| 0x0082 |                                               | GOST94-NULL-GOST94                 |                    |
+| 0x0083 |                                               | GOST2001-NULL-GOST94               |                    |
+| 0x0084 | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA             | CAMELLIA256-SHA                    | [RFC5932]          |
+| 0x0085 | TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA          | DH-DSS-CAMELLIA256-SHA             | [RFC5932]          |
+| 0x0086 | TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA          | DH-RSA-CAMELLIA256-SHA             | [RFC5932]          |
+| 0x0087 | TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA         | DHE-DSS-CAMELLIA256-SHA            | [RFC5932]          |
+| 0x0088 | TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA         | DHE-RSA-CAMELLIA256-SHA            | [RFC5932]          |
+| 0x0089 | TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA         | ADH-CAMELLIA256-SHA                | [RFC5932]          |
+| 0x008A | TLS_PSK_WITH_RC4_128_SHA                      | PSK-RC4-SHA                        | [RFC4279][RFC6347] |
+| 0x008B | TLS_PSK_WITH_3DES_EDE_CBC_SHA                 | PSK-3DES-EDE-CBC-SHA               | [RFC4279]          |
+| 0x008C | TLS_PSK_WITH_AES_128_CBC_SHA                  | PSK-AES128-CBC-SHA                 | [RFC4279]          |
+| 0x008D | TLS_PSK_WITH_AES_256_CBC_SHA                  | PSK-AES256-CBC-SHA                 | [RFC4279]          |
+| 0x008E | TLS_DHE_PSK_WITH_RC4_128_SHA                  | DHE-PSK-RC4-SHA                    | [RFC4279][RFC6347] |
+| 0x008F | TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA             | DHE-PSK-3DES-EDE-CBC-SHA           | [RFC4279]          |
+| 0x0090 | TLS_DHE_PSK_WITH_AES_128_CBC_SHA              | DHE-PSK-AES128-CBC-SHA             | [RFC4279]          |
+| 0x0091 | TLS_DHE_PSK_WITH_AES_256_CBC_SHA              | DHE-PSK-AES256-CBC-SHA             | [RFC4279]          |
+| 0x0092 | TLS_RSA_PSK_WITH_RC4_128_SHA                  | RSA-PSK-RC4-SHA                    | [RFC4279][RFC6347] |
+| 0x0093 | TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA             | RSA-PSK-3DES-EDE-CBC-SHA           | [RFC4279]          |
+| 0x0094 | TLS_RSA_PSK_WITH_AES_128_CBC_SHA              | RSA-PSK-AES128-CBC-SHA             | [RFC4279]          |
+| 0x0095 | TLS_RSA_PSK_WITH_AES_256_CBC_SHA              | RSA-PSK-AES256-CBC-SHA             | [RFC4279]          |
+| 0x0096 | TLS_RSA_WITH_SEED_CBC_SHA                     | SEED-SHA                           | [RFC4162]          |
+| 0x0097 | TLS_DH_DSS_WITH_SEED_CBC_SHA                  | DH-DSS-SEED-SHA                    | [RFC4162]          |
+| 0x0098 | TLS_DH_RSA_WITH_SEED_CBC_SHA                  | DH-RSA-SEED-SHA                    | [RFC4162]          |
+| 0x0099 | TLS_DHE_DSS_WITH_SEED_CBC_SHA                 | DHE-DSS-SEED-SHA                   | [RFC4162]          |
+| 0x009A | TLS_DHE_RSA_WITH_SEED_CBC_SHA                 | DHE-RSA-SEED-SHA                   | [RFC4162]          |
+| 0x009B | TLS_DH_anon_WITH_SEED_CBC_SHA                 | ADH-SEED-SHA                       | [RFC4162]          |
+| 0x009C | TLS_RSA_WITH_AES_128_GCM_SHA256               | AES128-GCM-SHA256                  | [RFC5288]          |
+| 0x009D | TLS_RSA_WITH_AES_256_GCM_SHA384               | AES256-GCM-SHA384                  | [RFC5288]          |
+| 0x009E | TLS_DHE_RSA_WITH_AES_128_GCM_SHA256           | DHE-RSA-AES128-GCM-SHA256          | [RFC5288]          |
+| 0x009F | TLS_DHE_RSA_WITH_AES_256_GCM_SHA384           | DHE-RSA-AES256-GCM-SHA384          | [RFC5288]          |
+| 0x00A0 | TLS_DH_RSA_WITH_AES_128_GCM_SHA256            | DH-RSA-AES128-GCM-SHA256           | [RFC5288]          |
+| 0x00A1 | TLS_DH_RSA_WITH_AES_256_GCM_SHA384            | DH-RSA-AES256-GCM-SHA384           | [RFC5288]          |
+| 0x00A2 | TLS_DHE_DSS_WITH_AES_128_GCM_SHA256           | DHE-DSS-AES128-GCM-SHA256          | [RFC5288]          |
+| 0x00A3 | TLS_DHE_DSS_WITH_AES_256_GCM_SHA384           | DHE-DSS-AES256-GCM-SHA384          | [RFC5288]          |
+| 0x00A4 | TLS_DH_DSS_WITH_AES_128_GCM_SHA256            | DH-DSS-AES128-GCM-SHA256           | [RFC5288]          |
+| 0x00A5 | TLS_DH_DSS_WITH_AES_256_GCM_SHA384            | DH-DSS-AES256-GCM-SHA384           | [RFC5288]          |
+| 0x00A6 | TLS_DH_anon_WITH_AES_128_GCM_SHA256           | ADH-AES128-GCM-SHA256              | [RFC5288]          |
+| 0x00A7 | TLS_DH_anon_WITH_AES_256_GCM_SHA384           | ADH-AES256-GCM-SHA384              | [RFC5288]          |
+| 0x00A8 | TLS_PSK_WITH_AES_128_GCM_SHA256               | PSK-AES128-GCM-SHA256              | [RFC5487]          |
+| 0x00A9 | TLS_PSK_WITH_AES_256_GCM_SHA384               | PSK-AES256-GCM-SHA384              | [RFC5487]          |
+| 0x00AA | TLS_DHE_PSK_WITH_AES_128_GCM_SHA256           | DHE-PSK-AES128-GCM-SHA256          | [RFC5487]          |
+| 0x00AB | TLS_DHE_PSK_WITH_AES_256_GCM_SHA384           | DHE-PSK-AES256-GCM-SHA384          | [RFC5487]          |
+| 0x00AC | TLS_RSA_PSK_WITH_AES_128_GCM_SHA256           | RSA-PSK-AES128-GCM-SHA256          | [RFC5487]          |
+| 0x00AD | TLS_RSA_PSK_WITH_AES_256_GCM_SHA384           | RSA-PSK-AES256-GCM-SHA384          | [RFC5487]          |
+| 0x00AE | TLS_PSK_WITH_AES_128_CBC_SHA256               | PSK-AES128-CBC-SHA256              | [RFC5487]          |
+| 0x00AF | TLS_PSK_WITH_AES_256_CBC_SHA384               | PSK-AES256-CBC-SHA384              | [RFC5487]          |
+| 0x00B0 | TLS_PSK_WITH_NULL_SHA256                      | PSK-NULL-SHA256                    | [RFC5487]          |
+| 0x00B1 | TLS_PSK_WITH_NULL_SHA384                      | PSK-NULL-SHA384                    | [RFC5487]          |
+| 0x00B2 | TLS_DHE_PSK_WITH_AES_128_CBC_SHA256           | DHE-PSK-AES128-CBC-SHA256          | [RFC5487]          |
+| 0x00B3 | TLS_DHE_PSK_WITH_AES_256_CBC_SHA384           | DHE-PSK-AES256-CBC-SHA384          | [RFC5487]          |
+| 0x00B4 | TLS_DHE_PSK_WITH_NULL_SHA256                  | DHE-PSK-NULL-SHA256                | [RFC5487]          |
+| 0x00B5 | TLS_DHE_PSK_WITH_NULL_SHA384                  | DHE-PSK-NULL-SHA384                | [RFC5487]          |
+| 0x00B6 | TLS_RSA_PSK_WITH_AES_128_CBC_SHA256           | RSA-PSK-AES128-CBC-SHA256          | [RFC5487]          |
+| 0x00B7 | TLS_RSA_PSK_WITH_AES_256_CBC_SHA384           | RSA-PSK-AES256-CBC-SHA384          | [RFC5487]          |
+| 0x00B8 | TLS_RSA_PSK_WITH_NULL_SHA256                  | RSA-PSK-NULL-SHA256                | [RFC5487]          |
+| 0x00B9 | TLS_RSA_PSK_WITH_NULL_SHA384                  | RSA-PSK-NULL-SHA384                | [RFC5487]          |
+| 0x00BA | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256          | CAMELLIA128-SHA256                 | [RFC5932]          |
+| 0x00BD | TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256      | DHE-DSS-CAMELLIA128-SHA256         | [RFC5932]          |
+| 0x00BE | TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256      | DHE-RSA-CAMELLIA128-SHA256         | [RFC5932]          |
+| 0x00BF | TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256      | ADH-CAMELLIA128-SHA256             | [RFC5932]          |
+| 0x00C0 | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256          | CAMELLIA256-SHA256                 | [RFC5932]          |
+| 0x00C3 | TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256      | DHE-DSS-CAMELLIA256-SHA256         | [RFC5932]          |
+| 0x00C4 | TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256      | DHE-RSA-CAMELLIA256-SHA256         | [RFC5932]          |
+| 0x00C5 | TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256      | ADH-CAMELLIA256-SHA256             | [RFC5932]          |
+| 0x00FF | TLS_EMPTY_RENEGOTIATION_INFO_SCSV             |                                    | [RFC5746]          |
+| 0x5600 | TLS_FALLBACK_SCSV                             |                                    | [RFC7507]          |
+| 0xC001 | TLS_ECDH_ECDSA_WITH_NULL_SHA                  | ECDH-ECDSA-NULL-SHA                | [RFC8422]          |
+| 0xC002 | TLS_ECDH_ECDSA_WITH_RC4_128_SHA               | ECDH-ECDSA-RC4-SHA                 | [RFC8422][RFC6347] |
+| 0xC003 | TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA          | ECDH-ECDSA-DES-CBC3-SHA            | [RFC8422]          |
+| 0xC004 | TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA           | ECDH-ECDSA-AES128-SHA              | [RFC8422]          |
+| 0xC005 | TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA           | ECDH-ECDSA-AES256-SHA              | [RFC8422]          |
+| 0xC006 | TLS_ECDHE_ECDSA_WITH_NULL_SHA                 | ECDHE-ECDSA-NULL-SHA               | [RFC8422]          |
+| 0xC007 | TLS_ECDHE_ECDSA_WITH_RC4_128_SHA              | ECDHE-ECDSA-RC4-SHA                | [RFC8422][RFC6347] |
+| 0xC008 | TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA         | ECDHE-ECDSA-DES-CBC3-SHA           | [RFC8422]          |
+| 0xC009 | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA          | ECDHE-ECDSA-AES128-SHA             | [RFC8422]          |
+| 0xC00A | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA          | ECDHE-ECDSA-AES256-SHA             | [RFC8422]          |
+| 0xC00B | TLS_ECDH_RSA_WITH_NULL_SHA                    | ECDH-RSA-NULL-SHA                  | [RFC8422]          |
+| 0xC00C | TLS_ECDH_RSA_WITH_RC4_128_SHA                 | ECDH-RSA-RC4-SHA                   | [RFC8422][RFC6347] |
+| 0xC00D | TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA            | ECDH-RSA-DES-CBC3-SHA              | [RFC8422]          |
+| 0xC00E | TLS_ECDH_RSA_WITH_AES_128_CBC_SHA             | ECDH-RSA-AES128-SHA                | [RFC8422]          |
+| 0xC00F | TLS_ECDH_RSA_WITH_AES_256_CBC_SHA             | ECDH-RSA-AES256-SHA                | [RFC8422]          |
+| 0xC010 | TLS_ECDHE_RSA_WITH_NULL_SHA                   | ECDHE-RSA-NULL-SHA                 | [RFC8422]          |
+| 0xC011 | TLS_ECDHE_RSA_WITH_RC4_128_SHA                | ECDHE-RSA-RC4-SHA                  | [RFC8422][RFC6347] |
+| 0xC012 | TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA           | ECDHE-RSA-DES-CBC3-SHA             | [RFC8422]          |
+| 0xC013 | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA            | ECDHE-RSA-AES128-SHA               | [RFC8422]          |
+| 0xC014 | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA            | ECDHE-RSA-AES256-SHA               | [RFC8422]          |
+| 0xC015 | TLS_ECDH_anon_WITH_NULL_SHA                   | AECDH-NULL-SHA                     | [RFC8422]          |
+| 0xC016 | TLS_ECDH_anon_WITH_RC4_128_SHA                | AECDH-RC4-SHA                      | [RFC8422][RFC6347] |
+| 0xC017 | TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA           | AECDH-DES-CBC3-SHA                 | [RFC8422]          |
+| 0xC018 | TLS_ECDH_anon_WITH_AES_128_CBC_SHA            | AECDH-AES128-SHA                   | [RFC8422]          |
+| 0xC019 | TLS_ECDH_anon_WITH_AES_256_CBC_SHA            | AECDH-AES256-SHA                   | [RFC8422]          |
+| 0xC01A | TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA             | SRP-3DES-EDE-CBC-SHA               | [RFC5054]          |
+| 0xC01B | TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA         | SRP-RSA-3DES-EDE-CBC-SHA           | [RFC5054]          |
+| 0xC01C | TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA         | SRP-DSS-3DES-EDE-CBC-SHA           | [RFC5054]          |
+| 0xC01D | TLS_SRP_SHA_WITH_AES_128_CBC_SHA              | SRP-AES-128-CBC-SHA                | [RFC5054]          |
+| 0xC01E | TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA          | SRP-RSA-AES-128-CBC-SHA            | [RFC5054]          |
+| 0xC01F | TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA          | SRP-DSS-AES-128-CBC-SHA            | [RFC5054]          |
+| 0xC020 | TLS_SRP_SHA_WITH_AES_256_CBC_SHA              | SRP-AES-256-CBC-SHA                | [RFC5054]          |
+| 0xC021 | TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA          | SRP-RSA-AES-256-CBC-SHA            | [RFC5054]          |
+| 0xC022 | TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA          | SRP-DSS-AES-256-CBC-SHA            | [RFC5054]          |
+| 0xC023 | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256       | ECDHE-ECDSA-AES128-SHA256          | [RFC5289]          |
+| 0xC024 | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384       | ECDHE-ECDSA-AES256-SHA384          | [RFC5289]          |
+| 0xC025 | TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256        | ECDH-ECDSA-AES128-SHA256           | [RFC5289]          |
+| 0xC026 | TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384        | ECDH-ECDSA-AES256-SHA384           | [RFC5289]          |
+| 0xC027 | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256         | ECDHE-RSA-AES128-SHA256            | [RFC5289]          |
+| 0xC028 | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384         | ECDHE-RSA-AES256-SHA384            | [RFC5289]          |
+| 0xC029 | TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256          | ECDH-RSA-AES128-SHA256             | [RFC5289]          |
+| 0xC02A | TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384          | ECDH-RSA-AES256-SHA384             | [RFC5289]          |
+| 0xC02B | TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256       | ECDHE-ECDSA-AES128-GCM-SHA256      | [RFC5289]          |
+| 0xC02C | TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384       | ECDHE-ECDSA-AES256-GCM-SHA384      | [RFC5289]          |
+| 0xC02D | TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256        | ECDH-ECDSA-AES128-GCM-SHA256       | [RFC5289]          |
+| 0xC02E | TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384        | ECDH-ECDSA-AES256-GCM-SHA384       | [RFC5289]          |
+| 0xC02F | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256         | ECDHE-RSA-AES128-GCM-SHA256        | [RFC5289]          |
+| 0xC030 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384         | ECDHE-RSA-AES256-GCM-SHA384        | [RFC5289]          |
+| 0xC031 | TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256          | ECDH-RSA-AES128-GCM-SHA256         | [RFC5289]          |
+| 0xC032 | TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384          | ECDH-RSA-AES256-GCM-SHA384         | [RFC5289]          |
+| 0xC033 | TLS_ECDHE_PSK_WITH_RC4_128_SHA                | ECDHE-PSK-RC4-SHA                  | [RFC5489][RFC6347] |
+| 0xC034 | TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA           | ECDHE-PSK-3DES-EDE-CBC-SHA         | [RFC5489]          |
+| 0xC035 | TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA            | ECDHE-PSK-AES128-CBC-SHA           | [RFC5489]          |
+| 0xC036 | TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA            | ECDHE-PSK-AES256-CBC-SHA           | [RFC5489]          |
+| 0xC037 | TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256         | ECDHE-PSK-AES128-CBC-SHA256        | [RFC5489]          |
+| 0xC038 | TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384         | ECDHE-PSK-AES256-CBC-SHA384        | [RFC5489]          |
+| 0xC039 | TLS_ECDHE_PSK_WITH_NULL_SHA                   | ECDHE-PSK-NULL-SHA                 | [RFC5489]          |
+| 0xC03A | TLS_ECDHE_PSK_WITH_NULL_SHA256                | ECDHE-PSK-NULL-SHA256              | [RFC5489]          |
+| 0xC03B | TLS_ECDHE_PSK_WITH_NULL_SHA384                | ECDHE-PSK-NULL-SHA384              | [RFC5489]          |
+| 0xC03C | TLS_RSA_WITH_ARIA_128_CBC_SHA256              | ARIA128-SHA256                     | [RFC6209]          |
+| 0xC03D | TLS_RSA_WITH_ARIA_256_CBC_SHA384              | ARIA256-SHA384                     | [RFC6209]          |
+| 0xC044 | TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256          | DHE-RSA-ARIA128-SHA256             | [RFC6209]          |
+| 0xC045 | TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384          | DHE-RSA-ARIA256-SHA384             | [RFC6209]          |
+| 0xC048 | TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256      | ECDHE-ECDSA-ARIA128-SHA256         | [RFC6209]          |
+| 0xC049 | TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384      | ECDHE-ECDSA-ARIA256-SHA384         | [RFC6209]          |
+| 0xC04A | TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256       | ECDH-ECDSA-ARIA128-SHA256          | [RFC6209]          |
+| 0xC04B | TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384       | ECDH-ECDSA-ARIA256-SHA384          | [RFC6209]          |
+| 0xC04C | TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256        | ECDHE-ARIA128-SHA256               | [RFC6209]          |
+| 0xC04D | TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384        | ECDHE-ARIA256-SHA384               | [RFC6209]          |
+| 0xC04E | TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256         | ECDH-ARIA128-SHA256                | [RFC6209]          |
+| 0xC04F | TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384         | ECDH-ARIA256-SHA384                | [RFC6209]          |
+| 0xC050 | TLS_RSA_WITH_ARIA_128_GCM_SHA256              | ARIA128-GCM-SHA256                 | [RFC6209]          |
+| 0xC051 | TLS_RSA_WITH_ARIA_256_GCM_SHA384              | ARIA256-GCM-SHA384                 | [RFC6209]          |
+| 0xC052 | TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256          | DHE-RSA-ARIA128-GCM-SHA256         | [RFC6209]          |
+| 0xC053 | TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384          | DHE-RSA-ARIA256-GCM-SHA384         | [RFC6209]          |
+| 0xC056 | TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256          | DHE-DSS-ARIA128-GCM-SHA256         | [RFC6209]          |
+| 0xC057 | TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384          | DHE-DSS-ARIA256-GCM-SHA384         | [RFC6209]          |
+| 0xC05C | TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256      | ECDHE-ECDSA-ARIA128-GCM-SHA256     | [RFC6209]          |
+| 0xC05D | TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384      | ECDHE-ECDSA-ARIA256-GCM-SHA384     | [RFC6209]          |
+| 0xC05E | TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256       | ECDH-ECDSA-ARIA128-GCM-SHA256      | [RFC6209]          |
+| 0xC05F | TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384       | ECDH-ECDSA-ARIA256-GCM-SHA384      | [RFC6209]          |
+| 0xC060 | TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256        | ECDHE-ARIA128-GCM-SHA256           | [RFC6209]          |
+| 0xC061 | TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384        | ECDHE-ARIA256-GCM-SHA384           | [RFC6209]          |
+| 0xC062 | TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256         | ECDH-ARIA128-GCM-SHA256            | [RFC6209]          |
+| 0xC063 | TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384         | ECDH-ARIA256-GCM-SHA384            | [RFC6209]          |
+| 0xC064 | TLS_PSK_WITH_ARIA_128_CBC_SHA256              | PSK-ARIA128-SHA256                 | [RFC6209]          |
+| 0xC065 | TLS_PSK_WITH_ARIA_256_CBC_SHA384              | PSK-ARIA256-SHA384                 | [RFC6209]          |
+| 0xC066 | TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256          | DHE-PSK-ARIA128-SHA256             | [RFC6209]          |
+| 0xC067 | TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384          | DHE-PSK-ARIA256-SHA384             | [RFC6209]          |
+| 0xC068 | TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256          | RSA-PSK-ARIA128-SHA256             | [RFC6209]          |
+| 0xC069 | TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384          | RSA-PSK-ARIA256-SHA384             | [RFC6209]          |
+| 0xC06A | TLS_PSK_WITH_ARIA_128_GCM_SHA256              | PSK-ARIA128-GCM-SHA256             | [RFC6209]          |
+| 0xC06B | TLS_PSK_WITH_ARIA_256_GCM_SHA384              | PSK-ARIA256-GCM-SHA384             | [RFC6209]          |
+| 0xC06C | TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256          | DHE-PSK-ARIA128-GCM-SHA256         | [RFC6209]          |
+| 0xC06D | TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384          | DHE-PSK-ARIA256-GCM-SHA384         | [RFC6209]          |
+| 0xC06E | TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256          | RSA-PSK-ARIA128-GCM-SHA256         | [RFC6209]          |
+| 0xC06F | TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384          | RSA-PSK-ARIA256-GCM-SHA384         | [RFC6209]          |
+| 0xC070 | TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256        | ECDHE-PSK-ARIA128-SHA256           | [RFC6209]          |
+| 0xC071 | TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384        | ECDHE-PSK-ARIA256-SHA384           | [RFC6209]          |
+| 0xC072 | TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256  | ECDHE-ECDSA-CAMELLIA128-SHA256     | [RFC6367]          |
+| 0xC073 | TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384  | ECDHE-ECDSA-CAMELLIA256-SHA384     | [RFC6367]          |
+| 0xC074 | TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256   | ECDH-ECDSA-CAMELLIA128-SHA256      | [RFC6367]          |
+| 0xC075 | TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384   | ECDH-ECDSA-CAMELLIA256-SHA384      | [RFC6367]          |
+| 0xC076 | TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256    | ECDHE-RSA-CAMELLIA128-SHA256       | [RFC6367]          |
+| 0xC077 | TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384    | ECDHE-RSA-CAMELLIA256-SHA384       | [RFC6367]          |
+| 0xC078 | TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256     | ECDH-CAMELLIA128-SHA256            | [RFC6367]          |
+| 0xC079 | TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384     | ECDH-CAMELLIA256-SHA384            | [RFC6367]          |
+| 0xC07A | TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256          | CAMELLIA128-GCM-SHA256             | [RFC6367]          |
+| 0xC07B | TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384          | CAMELLIA256-GCM-SHA384             | [RFC6367]          |
+| 0xC07C | TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256      | DHE-RSA-CAMELLIA128-GCM-SHA256     | [RFC6367]          |
+| 0xC07D | TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384      | DHE-RSA-CAMELLIA256-GCM-SHA384     | [RFC6367]          |
+| 0xC086 | TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256  | ECDHE-ECDSA-CAMELLIA128-GCM-SHA256 | [RFC6367]          |
+| 0xC087 | TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384  | ECDHE-ECDSA-CAMELLIA256-GCM-SHA384 | [RFC6367]          |
+| 0xC088 | TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256   | ECDH-ECDSA-CAMELLIA128-GCM-SHA256  | [RFC6367]          |
+| 0xC089 | TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384   | ECDH-ECDSA-CAMELLIA256-GCM-SHA384  | [RFC6367]          |
+| 0xC08A | TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256    | ECDHE-CAMELLIA128-GCM-SHA256       | [RFC6367]          |
+| 0xC08B | TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384    | ECDHE-CAMELLIA256-GCM-SHA384       | [RFC6367]          |
+| 0xC08C | TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256     | ECDH-CAMELLIA128-GCM-SHA256        | [RFC6367]          |
+| 0xC08D | TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384     | ECDH-CAMELLIA256-GCM-SHA384        | [RFC6367]          |
+| 0xC08E | TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256          | PSK-CAMELLIA128-GCM-SHA256         | [RFC6367]          |
+| 0xC08F | TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384          | PSK-CAMELLIA256-GCM-SHA384         | [RFC6367]          |
+| 0xC090 | TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256      | DHE-PSK-CAMELLIA128-GCM-SHA256     | [RFC6367]          |
+| 0xC091 | TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384      | DHE-PSK-CAMELLIA256-GCM-SHA384     | [RFC6367]          |
+| 0xC092 | TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256      | RSA-PSK-CAMELLIA128-GCM-SHA256     | [RFC6367]          |
+| 0xC093 | TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384      | RSA-PSK-CAMELLIA256-GCM-SHA384     | [RFC6367]          |
+| 0xC094 | TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256          | PSK-CAMELLIA128-SHA256             | [RFC6367]          |
+| 0xC095 | TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384          | PSK-CAMELLIA256-SHA384             | [RFC6367]          |
+| 0xC096 | TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256      | DHE-PSK-CAMELLIA128-SHA256         | [RFC6367]          |
+| 0xC097 | TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384      | DHE-PSK-CAMELLIA256-SHA384         | [RFC6367]          |
+| 0xC098 | TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256      | RSA-PSK-CAMELLIA128-SHA256         | [RFC6367]          |
+| 0xC099 | TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384      | RSA-PSK-CAMELLIA256-SHA384         | [RFC6367]          |
+| 0xC09A | TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256    | ECDHE-PSK-CAMELLIA128-SHA256       | [RFC6367]          |
+| 0xC09B | TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384    | ECDHE-PSK-CAMELLIA256-SHA384       | [RFC6367]          |
+| 0xC09C | TLS_RSA_WITH_AES_128_CCM                      | AES128-CCM                         | [RFC6655]          |
+| 0xC09D | TLS_RSA_WITH_AES_256_CCM                      | AES256-CCM                         | [RFC6655]          |
+| 0xC09E | TLS_DHE_RSA_WITH_AES_128_CCM                  | DHE-RSA-AES128-CCM                 | [RFC6655]          |
+| 0xC09F | TLS_DHE_RSA_WITH_AES_256_CCM                  | DHE-RSA-AES256-CCM                 | [RFC6655]          |
+| 0xC0A0 | TLS_RSA_WITH_AES_128_CCM_8                    | AES128-CCM8                        | [RFC6655]          |
+| 0xC0A1 | TLS_RSA_WITH_AES_256_CCM_8                    | AES256-CCM8                        | [RFC6655]          |
+| 0xC0A2 | TLS_DHE_RSA_WITH_AES_128_CCM_8                | DHE-RSA-AES128-CCM8                | [RFC6655]          |
+| 0xC0A3 | TLS_DHE_RSA_WITH_AES_256_CCM_8                | DHE-RSA-AES256-CCM8                | [RFC6655]          |
+| 0xC0A4 | TLS_PSK_WITH_AES_128_CCM                      | PSK-AES128-CCM                     | [RFC6655]          |
+| 0xC0A5 | TLS_PSK_WITH_AES_256_CCM                      | PSK-AES256-CCM                     | [RFC6655]          |
+| 0xC0A6 | TLS_DHE_PSK_WITH_AES_128_CCM                  | DHE-PSK-AES128-CCM                 | [RFC6655]          |
+| 0xC0A7 | TLS_DHE_PSK_WITH_AES_256_CCM                  | DHE-PSK-AES256-CCM                 | [RFC6655]          |
+| 0xC0A8 | TLS_PSK_WITH_AES_128_CCM_8                    | PSK-AES128-CCM8                    | [RFC6655]          |
+| 0xC0A9 | TLS_PSK_WITH_AES_256_CCM_8                    | PSK-AES256-CCM8                    | [RFC6655]          |
+| 0xC0AA | TLS_PSK_DHE_WITH_AES_128_CCM_8                | DHE-PSK-AES128-CCM8                | [RFC6655]          |
+| 0xC0AB | TLS_PSK_DHE_WITH_AES_256_CCM_8                | DHE-PSK-AES256-CCM8                | [RFC6655]          |
+| 0xC0AC | TLS_ECDHE_ECDSA_WITH_AES_128_CCM              | ECDHE-ECDSA-AES128-CCM             | [RFC7251]          |
+| 0xC0AD | TLS_ECDHE_ECDSA_WITH_AES_256_CCM              | ECDHE-ECDSA-AES256-CCM             | [RFC7251]          |
+| 0xC0AE | TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8            | ECDHE-ECDSA-AES128-CCM8            | [RFC7251]          |
+| 0xC0AF | TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8            | ECDHE-ECDSA-AES256-CCM8            | [RFC7251]          |
+| 0xC100 | TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC  | GOST2012-KUZNYECHIK-KUZNYECHIKOMAC | [RFC9189]          |
+| 0xC101 | TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC       | GOST2012-MAGMA-MAGMAOMAC           | [RFC9189]          |
+| 0xC102 | TLS_GOSTR341112_256_WITH_28147_CNT_IMIT       | IANA-GOST2012-GOST8912-GOST8912    | [RFC9189]          |
+| 0xCC13 |                                               | ECDHE-RSA-CHACHA20-POLY1305-OLD    |                    |
+| 0xCC14 |                                               | ECDHE-ECDSA-CHACHA20-POLY1305-OLD  |                    |
+| 0xCC15 |                                               | DHE-RSA-CHACHA20-POLY1305-OLD      |                    |
+| 0xCCA8 | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256   | ECDHE-RSA-CHACHA20-POLY1305        | [RFC7905]          |
+| 0xCCA9 | TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 | ECDHE-ECDSA-CHACHA20-POLY1305      | [RFC7905]          |
+| 0xCCAA | TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256     | DHE-RSA-CHACHA20-POLY1305          | [RFC7905]          |
+| 0xCCAB | TLS_PSK_WITH_CHACHA20_POLY1305_SHA256         | PSK-CHACHA20-POLY1305              | [RFC7905]          |
+| 0xCCAC | TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256   | ECDHE-PSK-CHACHA20-POLY1305        | [RFC7905]          |
+| 0xCCAD | TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256     | DHE-PSK-CHACHA20-POLY1305          | [RFC7905]          |
+| 0xCCAE | TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256     | RSA-PSK-CHACHA20-POLY1305          | [RFC7905]          |
+| 0xD001 | TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256         | ECDHE-PSK-AES128-GCM-SHA256        | [RFC8442]          |
+| 0xE011 |                                               | ECDHE-ECDSA-SM4-CBC-SM3            |                    |
+| 0xE051 |                                               | ECDHE-ECDSA-SM4-GCM-SM3            |                    |
+| 0xE052 |                                               | ECDHE-ECDSA-SM4-CCM-SM3            |                    |
+| 0xFF00 |                                               | GOST-MD5                           |                    |
+| 0xFF01 |                                               | GOST-GOST94                        |                    |
+| 0xFF02 |                                               | GOST-GOST89MAC                     |                    |
+| 0xFF03 |                                               | GOST-GOST89STREAM                  |                    |
diff --git a/third-party/curl/docs/CIPHERS.md b/third-party/curl/docs/CIPHERS.md
index 27de940363..0b70bda7d9 100644
--- a/third-party/curl/docs/CIPHERS.md
+++ b/third-party/curl/docs/CIPHERS.md
@@ -1,427 +1,279 @@
-# Ciphers
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
 
-With curl's options
-[`CURLOPT_SSL_CIPHER_LIST`](https://curl.se/libcurl/c/CURLOPT_SSL_CIPHER_LIST.html)
-and
-[`--ciphers`](https://curl.se/docs/manpage.html#--ciphers)
-users can control which ciphers to consider when negotiating TLS connections.
+SPDX-License-Identifier: curl
+-->
 
-TLS 1.3 ciphers are supported since curl 7.61 for OpenSSL 1.1.1+, and since
-curl 7.85 for Schannel with options
-[`CURLOPT_TLS13_CIPHERS`](https://curl.se/libcurl/c/CURLOPT_TLS13_CIPHERS.html)
-and
+## curl cipher options
+
+A TLS handshake involves many parameters which take part in the negotiation
+between client and server in order to agree on the TLS version and set of
+algorithms to use for a connection.
+
+What has become known as a "cipher" or better "cipher suite" in TLS
+are names for specific combinations of
+[key exchange](https://en.wikipedia.org/wiki/Key_exchange),
+[bulk encryption](https://en.wikipedia.org/wiki/Link_encryption),
+[message authentication code](https://en.wikipedia.org/wiki/Message_authentication_code)
+and with TLSv1.3 the
+[authenticated encryption](https://en.wikipedia.org/wiki/Authenticated_encryption).
+In addition, there are other parameters that influence the TLS handshake, like
+[DHE](https://en.wikipedia.org/wiki/Diffie%e2%80%93Hellman_key_exchange) "groups"
+and [ECDHE](https://en.wikipedia.org/wiki/Elliptic-curve_Diffie%e2%80%93Hellman)
+with its "curves".
+
+### History
+
+curl's way of letting users configure these settings closely followed OpenSSL
+in its API. TLS learned new parameters, OpenSSL added new API functions and
+curl added command line options.
+
+Several other TLS backends followed the OpenSSL approach, more or less closely,
+and curl maps the command line options to these TLS backends. Some TLS
+backends do not support all of it and command line options are either
+ignored or lead to an error.
+
+Many examples below show the OpenSSL-like use of these options. GnuTLS
+however chose a different approach. These are described in a separate
+section further below.
+
+## ciphers, the OpenSSL way
+
+With curl's option
 [`--tls13-ciphers`](https://curl.se/docs/manpage.html#--tls13-ciphers)
-. If you are using a different SSL backend you can try setting TLS 1.3 cipher
-suites by using the respective regular cipher option.
+or
+[`CURLOPT_TLS13_CIPHERS`](https://curl.se/libcurl/c/CURLOPT_TLS13_CIPHERS.html)
+users can control which cipher suites to consider when negotiating TLS 1.3
+connections. With option
+[`--ciphers`](https://curl.se/docs/manpage.html#--ciphers)
+or
+[`CURLOPT_SSL_CIPHER_LIST`](https://curl.se/libcurl/c/CURLOPT_SSL_CIPHER_LIST.html)
+users can control which cipher suites to consider when negotiating
+TLS 1.2 (1.1, 1.0) connections.
 
-The names of the known ciphers differ depending on which TLS backend that
-libcurl was built to use. This is an attempt to list known cipher names.
+By default, curl may negotiate TLS 1.3 and TLS 1.2 connections, so the cipher
+suites considered when negotiating a TLS connection are a union of the TLS 1.3
+and TLS 1.2 cipher suites. If you want curl to consider only TLS 1.3 cipher
+suites for the connection, you have to set the minimum TLS version to 1.3 by
+using [`--tlsv1.3`](https://curl.se/docs/manpage.html#--tlsv13)
+or [`CURLOPT_SSLVERSION`](https://curl.se/libcurl/c/CURLOPT_SSLVERSION.html)
+with `CURL_SSLVERSION_TLSv1_3`.
 
-## OpenSSL
+Both the TLS 1.3 and TLS 1.2 cipher options expect a list of cipher suites
+separated by colons (`:`). This list is parsed opportunistically, cipher suites
+that are not recognized or implemented are ignored. As long as there is at
+least one recognized cipher suite in the list, the list is considered valid.
 
-(based on [OpenSSL docs](https://www.openssl.org/docs/manmaster/man1/openssl-ciphers.html))
-
-When specifying multiple cipher names, separate them with colon (`:`).
-
-### SSL3 cipher suites
-
-`NULL-MD5`
-`NULL-SHA`
-`RC4-MD5`
-`RC4-SHA`
-`IDEA-CBC-SHA`
-`DES-CBC3-SHA`
-`DH-DSS-DES-CBC3-SHA`
-`DH-RSA-DES-CBC3-SHA`
-`DHE-DSS-DES-CBC3-SHA`
-`DHE-RSA-DES-CBC3-SHA`
-`ADH-RC4-MD5`
-`ADH-DES-CBC3-SHA`
-
-### TLS v1.0 cipher suites
-
-`NULL-MD5`
-`NULL-SHA`
-`RC4-MD5`
-`RC4-SHA`
-`IDEA-CBC-SHA`
-`DES-CBC3-SHA`
-`DHE-DSS-DES-CBC3-SHA`
-`DHE-RSA-DES-CBC3-SHA`
-`ADH-RC4-MD5`
-`ADH-DES-CBC3-SHA`
-
-### AES cipher suites from RFC 3268, extending TLS v1.0
-
-`AES128-SHA`
-`AES256-SHA`
-`DH-DSS-AES128-SHA`
-`DH-DSS-AES256-SHA`
-`DH-RSA-AES128-SHA`
-`DH-RSA-AES256-SHA`
-`DHE-DSS-AES128-SHA`
-`DHE-DSS-AES256-SHA`
-`DHE-RSA-AES128-SHA`
-`DHE-RSA-AES256-SHA`
-`ADH-AES128-SHA`
-`ADH-AES256-SHA`
-
-### SEED cipher suites from RFC 4162, extending TLS v1.0
-
-`SEED-SHA`
-`DH-DSS-SEED-SHA`
-`DH-RSA-SEED-SHA`
-`DHE-DSS-SEED-SHA`
-`DHE-RSA-SEED-SHA`
-`ADH-SEED-SHA`
-
-### GOST cipher suites, extending TLS v1.0
-
-`GOST94-GOST89-GOST89`
-`GOST2001-GOST89-GOST89`
-`GOST94-NULL-GOST94`
-`GOST2001-NULL-GOST94`
-
-### Elliptic curve cipher suites
-
-`ECDHE-RSA-NULL-SHA`
-`ECDHE-RSA-RC4-SHA`
-`ECDHE-RSA-DES-CBC3-SHA`
-`ECDHE-RSA-AES128-SHA`
-`ECDHE-RSA-AES256-SHA`
-`ECDHE-ECDSA-NULL-SHA`
-`ECDHE-ECDSA-RC4-SHA`
-`ECDHE-ECDSA-DES-CBC3-SHA`
-`ECDHE-ECDSA-AES128-SHA`
-`ECDHE-ECDSA-AES256-SHA`
-`AECDH-NULL-SHA`
-`AECDH-RC4-SHA`
-`AECDH-DES-CBC3-SHA`
-`AECDH-AES128-SHA`
-`AECDH-AES256-SHA`
-
-### TLS v1.2 cipher suites
-
-`NULL-SHA256`
-`AES128-SHA256`
-`AES256-SHA256`
-`AES128-GCM-SHA256`
-`AES256-GCM-SHA384`
-`DH-RSA-AES128-SHA256`
-`DH-RSA-AES256-SHA256`
-`DH-RSA-AES128-GCM-SHA256`
-`DH-RSA-AES256-GCM-SHA384`
-`DH-DSS-AES128-SHA256`
-`DH-DSS-AES256-SHA256`
-`DH-DSS-AES128-GCM-SHA256`
-`DH-DSS-AES256-GCM-SHA384`
-`DHE-RSA-AES128-SHA256`
-`DHE-RSA-AES256-SHA256`
-`DHE-RSA-AES128-GCM-SHA256`
-`DHE-RSA-AES256-GCM-SHA384`
-`DHE-DSS-AES128-SHA256`
-`DHE-DSS-AES256-SHA256`
-`DHE-DSS-AES128-GCM-SHA256`
-`DHE-DSS-AES256-GCM-SHA384`
-`ECDHE-RSA-AES128-SHA256`
-`ECDHE-RSA-AES256-SHA384`
-`ECDHE-RSA-AES128-GCM-SHA256`
-`ECDHE-RSA-AES256-GCM-SHA384`
-`ECDHE-ECDSA-AES128-SHA256`
-`ECDHE-ECDSA-AES256-SHA384`
-`ECDHE-ECDSA-AES128-GCM-SHA256`
-`ECDHE-ECDSA-AES256-GCM-SHA384`
-`ADH-AES128-SHA256`
-`ADH-AES256-SHA256`
-`ADH-AES128-GCM-SHA256`
-`ADH-AES256-GCM-SHA384`
-`AES128-CCM`
-`AES256-CCM`
-`DHE-RSA-AES128-CCM`
-`DHE-RSA-AES256-CCM`
-`AES128-CCM8`
-`AES256-CCM8`
-`DHE-RSA-AES128-CCM8`
-`DHE-RSA-AES256-CCM8`
-`ECDHE-ECDSA-AES128-CCM`
-`ECDHE-ECDSA-AES256-CCM`
-`ECDHE-ECDSA-AES128-CCM8`
-`ECDHE-ECDSA-AES256-CCM8`
-
-### Camellia HMAC-Based cipher suites from RFC 6367, extending TLS v1.2
-
-`ECDHE-ECDSA-CAMELLIA128-SHA256`
-`ECDHE-ECDSA-CAMELLIA256-SHA384`
-`ECDHE-RSA-CAMELLIA128-SHA256`
-`ECDHE-RSA-CAMELLIA256-SHA384`
+For both the TLS 1.3 and TLS 1.2 cipher options, the order in which the
+cipher suites are specified determine the preference of them. When negotiating
+a TLS connection the server picks a cipher suite from the intersection of the
+cipher suites supported by the server and the cipher suites sent by curl. If
+the server is configured to honor the client's cipher preference, the first
+common cipher suite in the list sent by curl is chosen.
 
 ### TLS 1.3 cipher suites
 
-(Note these ciphers are set with `CURLOPT_TLS13_CIPHERS` and `--tls13-ciphers`)
+Setting TLS 1.3 cipher suites is supported by curl with
+OpenSSL (1.1.1+, curl 7.61.0+), LibreSSL (3.4.1+, curl 8.3.0+),
+wolfSSL (curl 8.10.0+) and mbedTLS (3.6.0+, curl 8.10.0+).
 
-`TLS_AES_256_GCM_SHA384`
-`TLS_CHACHA20_POLY1305_SHA256`
-`TLS_AES_128_GCM_SHA256`
-`TLS_AES_128_CCM_8_SHA256`
-`TLS_AES_128_CCM_SHA256`
+The list of cipher suites that can be used for the `--tls13-ciphers` option:
 
-## WolfSSL
+```
+TLS_AES_128_GCM_SHA256
+TLS_AES_256_GCM_SHA384
+TLS_CHACHA20_POLY1305_SHA256
+TLS_AES_128_CCM_SHA256
+TLS_AES_128_CCM_8_SHA256
+```
 
-`RC4-SHA`,
-`RC4-MD5`,
-`DES-CBC3-SHA`,
-`AES128-SHA`,
-`AES256-SHA`,
-`NULL-SHA`,
-`NULL-SHA256`,
-`DHE-RSA-AES128-SHA`,
-`DHE-RSA-AES256-SHA`,
-`DHE-PSK-AES256-GCM-SHA384`,
-`DHE-PSK-AES128-GCM-SHA256`,
-`PSK-AES256-GCM-SHA384`,
-`PSK-AES128-GCM-SHA256`,
-`DHE-PSK-AES256-CBC-SHA384`,
-`DHE-PSK-AES128-CBC-SHA256`,
-`PSK-AES256-CBC-SHA384`,
-`PSK-AES128-CBC-SHA256`,
-`PSK-AES128-CBC-SHA`,
-`PSK-AES256-CBC-SHA`,
-`DHE-PSK-AES128-CCM`,
-`DHE-PSK-AES256-CCM`,
-`PSK-AES128-CCM`,
-`PSK-AES256-CCM`,
-`PSK-AES128-CCM-8`,
-`PSK-AES256-CCM-8`,
-`DHE-PSK-NULL-SHA384`,
-`DHE-PSK-NULL-SHA256`,
-`PSK-NULL-SHA384`,
-`PSK-NULL-SHA256`,
-`PSK-NULL-SHA`,
-`HC128-MD5`,
-`HC128-SHA`,
-`HC128-B2B256`,
-`AES128-B2B256`,
-`AES256-B2B256`,
-`RABBIT-SHA`,
-`NTRU-RC4-SHA`,
-`NTRU-DES-CBC3-SHA`,
-`NTRU-AES128-SHA`,
-`NTRU-AES256-SHA`,
-`AES128-CCM-8`,
-`AES256-CCM-8`,
-`ECDHE-ECDSA-AES128-CCM`,
-`ECDHE-ECDSA-AES128-CCM-8`,
-`ECDHE-ECDSA-AES256-CCM-8`,
-`ECDHE-RSA-AES128-SHA`,
-`ECDHE-RSA-AES256-SHA`,
-`ECDHE-ECDSA-AES128-SHA`,
-`ECDHE-ECDSA-AES256-SHA`,
-`ECDHE-RSA-RC4-SHA`,
-`ECDHE-RSA-DES-CBC3-SHA`,
-`ECDHE-ECDSA-RC4-SHA`,
-`ECDHE-ECDSA-DES-CBC3-SHA`,
-`AES128-SHA256`,
-`AES256-SHA256`,
-`DHE-RSA-AES128-SHA256`,
-`DHE-RSA-AES256-SHA256`,
-`ECDH-RSA-AES128-SHA`,
-`ECDH-RSA-AES256-SHA`,
-`ECDH-ECDSA-AES128-SHA`,
-`ECDH-ECDSA-AES256-SHA`,
-`ECDH-RSA-RC4-SHA`,
-`ECDH-RSA-DES-CBC3-SHA`,
-`ECDH-ECDSA-RC4-SHA`,
-`ECDH-ECDSA-DES-CBC3-SHA`,
-`AES128-GCM-SHA256`,
-`AES256-GCM-SHA384`,
-`DHE-RSA-AES128-GCM-SHA256`,
-`DHE-RSA-AES256-GCM-SHA384`,
-`ECDHE-RSA-AES128-GCM-SHA256`,
-`ECDHE-RSA-AES256-GCM-SHA384`,
-`ECDHE-ECDSA-AES128-GCM-SHA256`,
-`ECDHE-ECDSA-AES256-GCM-SHA384`,
-`ECDH-RSA-AES128-GCM-SHA256`,
-`ECDH-RSA-AES256-GCM-SHA384`,
-`ECDH-ECDSA-AES128-GCM-SHA256`,
-`ECDH-ECDSA-AES256-GCM-SHA384`,
-`CAMELLIA128-SHA`,
-`DHE-RSA-CAMELLIA128-SHA`,
-`CAMELLIA256-SHA`,
-`DHE-RSA-CAMELLIA256-SHA`,
-`CAMELLIA128-SHA256`,
-`DHE-RSA-CAMELLIA128-SHA256`,
-`CAMELLIA256-SHA256`,
-`DHE-RSA-CAMELLIA256-SHA256`,
-`ECDHE-RSA-AES128-SHA256`,
-`ECDHE-ECDSA-AES128-SHA256`,
-`ECDH-RSA-AES128-SHA256`,
-`ECDH-ECDSA-AES128-SHA256`,
-`ECDHE-RSA-AES256-SHA384`,
-`ECDHE-ECDSA-AES256-SHA384`,
-`ECDH-RSA-AES256-SHA384`,
-`ECDH-ECDSA-AES256-SHA384`,
-`ECDHE-RSA-CHACHA20-POLY1305`,
-`ECDHE-ECDSA-CHACHA20-POLY1305`,
-`DHE-RSA-CHACHA20-POLY1305`,
-`ECDHE-RSA-CHACHA20-POLY1305-OLD`,
-`ECDHE-ECDSA-CHACHA20-POLY1305-OLD`,
-`DHE-RSA-CHACHA20-POLY1305-OLD`,
-`ADH-AES128-SHA`,
-`QSH`,
-`RENEGOTIATION-INFO`,
-`IDEA-CBC-SHA`,
-`ECDHE-ECDSA-NULL-SHA`,
-`ECDHE-PSK-NULL-SHA256`,
-`ECDHE-PSK-AES128-CBC-SHA256`,
-`PSK-CHACHA20-POLY1305`,
-`ECDHE-PSK-CHACHA20-POLY1305`,
-`DHE-PSK-CHACHA20-POLY1305`,
-`EDH-RSA-DES-CBC3-SHA`,
+#### wolfSSL notes
 
-## Schannel
+In addition to above list the following cipher suites can be used:
+`TLS_SM4_GCM_SM3` `TLS_SM4_CCM_SM3` `TLS_SHA256_SHA256` `TLS_SHA384_SHA384`.
+Usage of these cipher suites is not recommended. (The last two cipher suites
+are NULL ciphers, offering no encryption whatsoever.)
 
-Schannel allows the enabling and disabling of encryption algorithms, but not
-specific cipher suites, prior to TLS 1.3. The algorithms are
-[defined](https://docs.microsoft.com/windows/desktop/SecCrypto/alg-id) by
-Microsoft.
+### TLS 1.2 (1.1, 1.0) cipher suites
 
-The algorithms below are for TLS 1.2 and earlier. TLS 1.3 is covered in the
-next section.
+Setting TLS 1.2 cipher suites is supported by curl with AWS-LC, BoringSSL,
+LibreSSL, mbedTLS (curl 8.8.0+), OpenSSL, wolfSSL (curl 7.53.0+). Schannel
+does not support setting cipher suites directly, but does support setting
+algorithms (curl 7.61.0+), see Schannel notes below.
 
-There is also the case that the selected algorithm is not supported by the
-protocol or does not match the ciphers offered by the server during the SSL
-negotiation. In this case curl will return error
-`CURLE_SSL_CONNECT_ERROR (35) SEC_E_ALGORITHM_MISMATCH`
-and the request will fail.
+For TLS 1.2 cipher suites there are multiple naming schemes, the two most used
+are with OpenSSL names (e.g. `ECDHE-RSA-AES128-GCM-SHA256`) and IANA names
+(e.g. `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`). IANA names of TLS 1.2 cipher
+suites look similar to TLS 1.3 cipher suite names, to distinguish them note
+that TLS 1.2 names contain `_WITH_`, while TLS 1.3 names do not. When setting
+TLS 1.2 cipher suites with curl it is recommended that you use OpenSSL names
+as these are most widely recognized by the supported SSL backends.
 
-`CALG_MD2`,
-`CALG_MD4`,
-`CALG_MD5`,
-`CALG_SHA`,
-`CALG_SHA1`,
-`CALG_MAC`,
-`CALG_RSA_SIGN`,
-`CALG_DSS_SIGN`,
-`CALG_NO_SIGN`,
-`CALG_RSA_KEYX`,
-`CALG_DES`,
-`CALG_3DES_112`,
-`CALG_3DES`,
-`CALG_DESX`,
-`CALG_RC2`,
-`CALG_RC4`,
-`CALG_SEAL`,
-`CALG_DH_SF`,
-`CALG_DH_EPHEM`,
-`CALG_AGREEDKEY_ANY`,
-`CALG_HUGHES_MD5`,
-`CALG_SKIPJACK`,
-`CALG_TEK`,
-`CALG_CYLINK_MEK`,
-`CALG_SSL3_SHAMD5`,
-`CALG_SSL3_MASTER`,
-`CALG_SCHANNEL_MASTER_HASH`,
-`CALG_SCHANNEL_MAC_KEY`,
-`CALG_SCHANNEL_ENC_KEY`,
-`CALG_PCT1_MASTER`,
-`CALG_SSL2_MASTER`,
-`CALG_TLS1_MASTER`,
-`CALG_RC5`,
-`CALG_HMAC`,
-`CALG_TLS1PRF`,
-`CALG_HASH_REPLACE_OWF`,
-`CALG_AES_128`,
-`CALG_AES_192`,
-`CALG_AES_256`,
-`CALG_AES`,
-`CALG_SHA_256`,
-`CALG_SHA_384`,
-`CALG_SHA_512`,
-`CALG_ECDH`,
-`CALG_ECMQV`,
-`CALG_ECDSA`,
-`CALG_ECDH_EPHEM`,
+The complete list of cipher suites that may be considered for the `--ciphers`
+option is extensive, it consists of more than 300 ciphers suites. Nowadays,
+most of them are discouraged, and support for a lot of them has been removed
+from the various SSL backends, if ever implemented at all.
 
-As of curl 7.77.0, you can also pass `SCH_USE_STRONG_CRYPTO` as a cipher name
-to [constrain the set of available ciphers as specified in the Schannel
-documentation](https://docs.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-server-2022).
-Note that the supported ciphers in this case follow the OS version, so if you
-are running an outdated OS you might still be supporting weak ciphers.
+A shortened list (based on [recommendations by
+Mozilla](https://wiki.mozilla.org/Security/Server_Side_TLS)) of cipher suites,
+which are (mostly) supported by all SSL backends, that can be used for the
+`--ciphers` option:
 
-### TLS 1.3 cipher suites
+```
+ECDHE-ECDSA-AES128-GCM-SHA256
+ECDHE-RSA-AES128-GCM-SHA256
+ECDHE-ECDSA-AES256-GCM-SHA384
+ECDHE-RSA-AES256-GCM-SHA384
+ECDHE-ECDSA-CHACHA20-POLY1305
+ECDHE-RSA-CHACHA20-POLY1305
+DHE-RSA-AES128-GCM-SHA256
+DHE-RSA-AES256-GCM-SHA384
+DHE-RSA-CHACHA20-POLY1305
+ECDHE-ECDSA-AES128-SHA256
+ECDHE-RSA-AES128-SHA256
+ECDHE-ECDSA-AES128-SHA
+ECDHE-RSA-AES128-SHA
+ECDHE-ECDSA-AES256-SHA384
+ECDHE-RSA-AES256-SHA384
+ECDHE-ECDSA-AES256-SHA
+ECDHE-RSA-AES256-SHA
+DHE-RSA-AES128-SHA256
+DHE-RSA-AES256-SHA256
+AES128-GCM-SHA256
+AES256-GCM-SHA384
+AES128-SHA256
+AES256-SHA256
+AES128-SHA
+AES256-SHA
+DES-CBC3-SHA
+```
 
-You can set TLS 1.3 ciphers for Schannel by using `CURLOPT_TLS13_CIPHERS` or
-`--tls13-ciphers` with the names below.
+See this [list](https://github.com/curl/curl/blob/master/docs/CIPHERS-TLS12.md)
+for a complete list of TLS 1.2 cipher suites.
 
-If TLS 1.3 cipher suites are set then libcurl will add or restrict Schannel TLS
-1.3 algorithms automatically. Essentially, libcurl is emulating support for
-individual TLS 1.3 cipher suites since Schannel does not support it directly.
+#### OpenSSL notes
 
-`TLS_AES_256_GCM_SHA384`
-`TLS_AES_128_GCM_SHA256`
-`TLS_CHACHA20_POLY1305_SHA256`
-`TLS_AES_128_CCM_8_SHA256`
-`TLS_AES_128_CCM_SHA256`
+In addition to specifying a list of cipher suites, OpenSSL also accepts a
+format with specific cipher strings (like `TLSv1.2`, `AESGCM`, `CHACHA20`) and
+`!`, `-` and `+` operators. Refer to the
+[OpenSSL cipher documentation](https://docs.openssl.org/master/man1/openssl-ciphers/#cipher-list-format)
+for further information on that format.
 
-Note if you set TLS 1.3 ciphers without also setting the minimum TLS version to
-1.3 then it's possible Schannel may negotiate an earlier TLS version and cipher
-suite if your libcurl and OS settings allow it. You can set the minimum TLS
-version by using `CURLOPT_SSLVERSION` or `--tlsv1.3`.
+#### Schannel notes
 
-## BearSSL
+Schannel does not support setting individual TLS 1.2 cipher suites directly.
+It only allows the enabling and disabling of encryption algorithms. These are
+in the form of `CALG_xxx`, see the [Schannel `ALG_ID`
+documentation](https://learn.microsoft.com/windows/win32/seccrypto/alg-id)
+for a list of these algorithms. Also, (since curl 7.77.0)
+`SCH_USE_STRONG_CRYPTO` can be given to pass that flag to Schannel, lookup the
+[documentation for the Windows version in
+use](https://learn.microsoft.com/windows/win32/secauthn/cipher-suites-in-schannel)
+to see how that affects the cipher suite selection. When not specifying the
+`--ciphers` and `--tls13-ciphers` options curl passes this flag by default.
 
-BearSSL ciphers can be specified by either the OpenSSL name (`ECDHE-RSA-AES128-GCM-SHA256`) or the IANA name (`TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`).
+### Examples
 
-Since BearSSL 0.1:
+```sh
+curl \
+  --tls13-ciphers TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 \
+  --ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:\
+ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305 \
+  https://example.com/
+```
 
-`DES-CBC3-SHA`
-`AES128-SHA`
-`AES256-SHA`
-`AES128-SHA256`
-`AES256-SHA256`
-`AES128-GCM-SHA256`
-`AES256-GCM-SHA384`
-`ECDH-ECDSA-DES-CBC3-SHA`
-`ECDH-ECDSA-AES128-SHA`
-`ECDH-ECDSA-AES256-SHA`
-`ECDHE-ECDSA-DES-CBC3-SHA`
-`ECDHE-ECDSA-AES128-SHA`
-`ECDHE-ECDSA-AES256-SHA`
-`ECDH-RSA-DES-CBC3-SHA`
-`ECDH-RSA-AES128-SHA`
-`ECDH-RSA-AES256-SHA`
-`ECDHE-RSA-DES-CBC3-SHA`
-`ECDHE-RSA-AES128-SHA`
-`ECDHE-RSA-AES256-SHA`
-`ECDHE-ECDSA-AES128-SHA256`
-`ECDHE-ECDSA-AES256-SHA384`
-`ECDH-ECDSA-AES128-SHA256`
-`ECDH-ECDSA-AES256-SHA384`
-`ECDHE-RSA-AES128-SHA256`
-`ECDHE-RSA-AES256-SHA384`
-`ECDH-RSA-AES128-SHA256`
-`ECDH-RSA-AES256-SHA384`
-`ECDHE-ECDSA-AES128-GCM-SHA256`
-`ECDHE-ECDSA-AES256-GCM-SHA384`
-`ECDH-ECDSA-AES128-GCM-SHA256`
-`ECDH-ECDSA-AES256-GCM-SHA384`
-`ECDHE-RSA-AES128-GCM-SHA256`
-`ECDHE-RSA-AES256-GCM-SHA384`
-`ECDH-RSA-AES128-GCM-SHA256`
-`ECDH-RSA-AES256-GCM-SHA384`
+Restrict ciphers to `aes128-gcm` and `chacha20`. Works with OpenSSL, LibreSSL,
+mbedTLS and wolfSSL.
 
-Since BearSSL 0.2:
+```sh
+curl \
+  --tlsv1.3 \
+  --tls-max 1.3 \
+  --tls13-ciphers TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 \
+  https://example.com/
+```
 
-`ECDHE-RSA-CHACHA20-POLY1305`
-`ECDHE-ECDSA-CHACHA20-POLY1305`
+Restrict to only TLS 1.3 with `aes128-gcm` and `chacha20` ciphers. Works with
+OpenSSL, LibreSSL, mbedTLS and wolfSSL.
 
-Since BearSSL 0.6:
+```sh
+curl \
+  --ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:\
+ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305 \
+  https://example.com/
+```
 
-`AES128-CCM`
-`AES256-CCM`
-`AES128-CCM8`
-`AES256-CCM8`
-`ECDHE-ECDSA-AES128-CCM`
-`ECDHE-ECDSA-AES256-CCM`
-`ECDHE-ECDSA-AES128-CCM8`
-`ECDHE-ECDSA-AES256-CCM8`
+Restrict TLS 1.2 ciphers to `aes128-gcm` and `chacha20`, use default TLS 1.3
+ciphers (if TLS 1.3 is available). Works with OpenSSL, LibreSSL, BoringSSL,
+mbedTLS and wolfSSL.
+
+## ciphers, the GnuTLS way
+
+With GnuTLS, curl allows configuration of all TLS parameters via option
+[`--ciphers`](https://curl.se/docs/manpage.html#--ciphers)
+or
+[`CURLOPT_SSL_CIPHER_LIST`](https://curl.se/libcurl/c/CURLOPT_SSL_CIPHER_LIST.html)
+only. The option
+[`--tls13-ciphers`](https://curl.se/docs/manpage.html#--tls13-ciphers)
+or
+[`CURLOPT_TLS13_CIPHERS`](https://curl.se/libcurl/c/CURLOPT_TLS13_CIPHERS.html)
+is being ignored.
+
+`--ciphers` is used to set the GnuTLS **priority string** in
+the following way:
+
+* When the set string starts with '+', '-' or '!' it is *appended* to the
+  priority string libcurl itself generates (separated by ':'). This initial
+  priority depends other settings such as CURLOPT_SSLVERSION(3),
+  CURLOPT_TLSAUTH_USERNAME(3) (for SRP) or if HTTP/3 (QUIC)
+  is being negotiated.
+* Otherwise, the set string fully *replaces* the libcurl generated one. While
+  giving full control to the application, the set priority needs to
+  provide for everything the transfer may need to negotiate. Example: if
+  the set priority only allows TLSv1.2, all HTTP/3 attempts fail.
+
+Users may specify via `--ciphers` anything that GnuTLS supports: ciphers,
+key exchange, MAC, compression, TLS versions, signature algorithms, groups,
+elliptic curves, certificate types. In addition, GnuTLS has a variety of
+other keywords that tweak its operations. Applications or a system
+may define new alias names for priority strings that can then be used here.
+
+Since the order of items in priority strings is significant, it makes no
+sense for curl to puzzle other SSL options somehow together. `--ciphers`
+is the single way to change priority.
+
+### Examples
+
+```sh
+curl \
+  --ciphers '-CIPHER_ALL:+AES-128-GCM:+CHACHA20-POLY1305' \
+  https://example.com/
+```
+
+Restrict ciphers to `aes128-gcm` and `chacha20` in GnuTLS.
+
+```sh
+curl \
+  --ciphers 'NORMAL:-VERS-ALL:+TLS1.3:-AES-256-GCM' \
+  https://example.com/
+```
+
+Restrict to only TLS 1.3 without the `aes256-gcm` cipher.
+
+```sh
+curl \
+  --ciphers 'NORMAL:-VERS-ALL:+TLS1.2:-CIPHER_ALL:+CAMELLIA-128-GCM' \
+  https://example.com/
+```
+
+Restrict to only TLS 1.2 with the `CAMELLIA-128-GCM` cipher.
+
+## Further reading
+
+- [GnuTLS Priority Strings](https://gnutls.org/manual/html_node/Priority-Strings.html)
+- [IANA cipher suites list](https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4)
+- [mbedTLS cipher suites reference](https://mbed-tls.readthedocs.io/projects/api/en/development/api/file/ssl__ciphersuites_8h/)
+- [OpenSSL cipher suite names documentation](https://docs.openssl.org/master/man1/openssl-ciphers/#cipher-suite-names)
+- [Schannel cipher suites documentation](https://learn.microsoft.com/windows/win32/secauthn/cipher-suites-in-schannel)
+- [Wikipedia cipher suite article](https://en.wikipedia.org/wiki/Cipher_suite)
+- [wolfSSL cipher support documentation](https://www.wolfssl.com/documentation/manuals/wolfssl/chapter04.html#cipher-support)
diff --git a/third-party/curl/docs/CMakeLists.txt b/third-party/curl/docs/CMakeLists.txt
index dd2c6dc74e..9c02530193 100644
--- a/third-party/curl/docs/CMakeLists.txt
+++ b/third-party/curl/docs/CMakeLists.txt
@@ -21,6 +21,31 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-#add_subdirectory(examples)
-add_subdirectory(libcurl)
-add_subdirectory(cmdline-opts)
+
+if(BUILD_LIBCURL_DOCS)
+  add_subdirectory(libcurl)
+endif()
+if(ENABLE_CURL_MANUAL AND BUILD_CURL_EXE)
+  add_subdirectory(cmdline-opts)
+endif()
+
+if(BUILD_MISC_DOCS)
+  set(_man_targets "curl-config" "mk-ca-bundle")
+  if(BUILD_CURL_EXE)
+    list(APPEND _man_targets "wcurl")
+  endif()
+
+  foreach(_man_misc IN LISTS _man_targets)
+    set(_man_target "${CMAKE_CURRENT_BINARY_DIR}/${_man_misc}.1")
+    add_custom_command(OUTPUT "${_man_target}"
+      WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+      COMMAND "${PERL_EXECUTABLE}" "${PROJECT_SOURCE_DIR}/scripts/cd2nroff" "${_man_misc}.md" > "${_man_target}"
+      DEPENDS "${PROJECT_SOURCE_DIR}/scripts/cd2nroff" "${_man_misc}.md"
+      VERBATIM
+    )
+    add_custom_target("curl-generate-${_man_misc}.1" ALL DEPENDS "${_man_target}")
+    if(NOT CURL_DISABLE_INSTALL AND NOT _man_misc STREQUAL "mk-ca-bundle")
+      install(FILES "${_man_target}" DESTINATION "${CMAKE_INSTALL_MANDIR}/man1")
+    endif()
+  endforeach()
+endif()
diff --git a/third-party/curl/docs/CODE_OF_CONDUCT.md b/third-party/curl/docs/CODE_OF_CONDUCT.md
index 1f71c387bd..f42fd493d0 100644
--- a/third-party/curl/docs/CODE_OF_CONDUCT.md
+++ b/third-party/curl/docs/CODE_OF_CONDUCT.md
@@ -1,5 +1,10 @@
-Contributor Code of Conduct
-===========================
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# Contributor Code of Conduct
 
 As contributors and maintainers of this project, we pledge to respect all
 people who contribute through reporting issues, posting feature requests,
@@ -27,6 +32,7 @@ Instances of abusive, harassing, or otherwise unacceptable behavior may be
 reported by opening an issue or contacting one or more of the project
 maintainers.
 
-This Code of Conduct is adapted from the [Contributor
-Covenant](https://contributor-covenant.org/), version 1.1.0, available at
+This Code of Conduct is adapted from the
+[Contributor Covenant](https://contributor-covenant.org/), version 1.1.0,
+available at
 [https://contributor-covenant.org/version/1/1/0/](https://contributor-covenant.org/version/1/1/0/)
diff --git a/third-party/curl/docs/CODE_REVIEW.md b/third-party/curl/docs/CODE_REVIEW.md
index 0776d30a08..a80d2eec3c 100644
--- a/third-party/curl/docs/CODE_REVIEW.md
+++ b/third-party/curl/docs/CODE_REVIEW.md
@@ -1,3 +1,9 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # How to do code reviews for curl
 
 Anyone and everyone is encouraged and welcome to review code submissions in
@@ -135,13 +141,13 @@ data. Where it comes from and where it goes.
 `size_t` is not a fixed size. `time_t` can be signed or unsigned and have
 different sizes. Relying on variable sizes is a red flag.
 
-Also remember that endianness and >= 32 bit accesses to unaligned addresses
+Also remember that endianness and >= 32-bit accesses to unaligned addresses
 are problematic areas.
 
 ## Integer overflows
 
-Be careful about integer overflows. Some variable types can be either 32 bit
-or 64 bit. Integer overflows must be detected and acted on *before* they
+Be careful about integer overflows. Some variable types can be either 32-bit
+or 64-bit. Integer overflows must be detected and acted on *before* they
 happen.
 
 ## Dangerous use of functions
@@ -150,19 +156,20 @@ Maybe use of `realloc()` should rather use the dynbuf functions?
 
 Do not allow new code that grows buffers without using dynbuf.
 
-Use of C functions that rely on a terminating zero must only be used on data
-that really do have a null-terminating zero.
+Use of C functions that rely on a null-terminator must only be used on data
+that really do have a null-terminator (`\0` byte).
 
 ## Dangerous "data styles"
 
-Make extra precautions and verify that memory buffers that need a terminating
-zero always have exactly that. Buffers *without* a null-terminator must not be
-used as input to string functions.
+Make extra precautions and verify that memory buffers that need
+null-terminator always have exactly that. Buffers *without* a null-terminator
+must not be used as input to string functions.
 
 # Commit messages
 
 Tightly coupled with a code review is making sure that the commit message is
 good. It is the responsibility of the person who merges the code to make sure
 that the commit message follows our standard (detailed in the
-[CONTRIBUTE](CONTRIBUTE.md) document). This includes making sure the PR
-identifies related issues and giving credit to reporters and helpers.
+[CONTRIBUTE](https://curl.se/dev/contribute.html) document). This includes
+making sure the PR identifies related issues and giving credit to reporters
+and helpers.
diff --git a/third-party/curl/docs/CONNECTION-FILTERS.md b/third-party/curl/docs/CONNECTION-FILTERS.md
deleted file mode 100644
index c4b11dbb01..0000000000
--- a/third-party/curl/docs/CONNECTION-FILTERS.md
+++ /dev/null
@@ -1,127 +0,0 @@
-# curl connection filters
-
-Connection filters is a design in the internals of curl, not visible in its public API. They were added
-in curl v7.xx.x. This document describes the concepts, its high level implementation and the motivations.
-
-## Filters
-
-A "connection filter" is a piece of code that is responsible for handling a range of operations
-of curl's connections: reading, writing, waiting on external events, connecting and closing down - to name the most important ones.
-
-The most important feat of connection filters is that they can be stacked on top of each other (or "chained" if you prefer that metaphor). In the common scenario that you want to retrieve a `https:` url with curl, you need 2 basic things to send the request and get the response: a TCP connection, represented by a `socket` and a SSL instance en- and decrypt over that socket. You write your request to the SSL instance, which encrypts and writes that data to the socket, which then sends the bytes over the network.
-
-With connection filters, curl's internal setup will look something like this (cf for connection filter):
-
-```
-Curl_easy *data         connectdata *conn        cf-ssl        cf-socket
-+----------------+      +-----------------+      +-------+     +--------+
-|https://curl.se/|----> | properties      |----> | keys  |---> | socket |--> OS --> network
-+----------------+      +-----------------+      +-------+     +--------+
-
- Curl_write(data, buffer)
-  --> Curl_cfilter_write(data, data->conn, buffer)
-       ---> conn->filter->write(conn->filter, data, buffer)
-```
-
-While connection filters all do different things, they look the same from the "outside". The code in `data` and `conn` does not really know **which** filters are installed. `conn` just writes into the first filter, whatever that is.
-
-Same is true for filters. Each filter has a pointer to the `next` filter. When SSL has encrypted the data, it does not write to a socket, it writes to the next filter. If that is indeed a socket, or a file, or an HTTP/2 connection is of no concern to the SSL filter.
-
-And this allows the stacking, as in:
-
-```
-Direct:
-  http://localhost/      conn -> cf-socket
-  https://curl.se/       conn -> cf-ssl -> cf-socket
-Via http proxy tunnel:
-  http://localhost/      conn -> cf-http-proxy -> cf-socket
-  https://curl.se/       conn -> cf-ssl -> cf-http-proxy -> cf-socket
-Via https proxy tunnel:
-  http://localhost/      conn -> cf-http-proxy -> cf-ssl -> cf-socket
-  https://curl.se/       conn -> cf-ssl -> cf-http-proxy -> cf-ssl -> cf-socket
-Via http proxy tunnel via SOCKS proxy:
-  http://localhost/      conn -> cf-http-proxy -> cf-socks -> cf-socket
-```
-
-### Connecting/Closing
-
-Before `Curl_easy` can send the request, the connection needs to be established. This means that all connection filters have done, whatever they need to do: waiting for the socket to be connected, doing the TLS handshake, performing the HTTP tunnel request, etc. This has to be done in reverse order: the last filter has to do its connect first, then the one above can start, etc.
-
-Each filter does in principle the following:
-
-```
-static CURLcode
-myfilter_cf_connect(struct Curl_cfilter *cf,
-                    struct Curl_easy *data,
-                    bool *done)
-{
-  CURLcode result;
-
-  if(cf->connected) {            /* we and all below are done */
-    *done = TRUE;
-    return CURLE_OK;
-  }
-                                 /* Let the filters below connect */
-  result = cf->next->cft->connect(cf->next, data, blocking, done);
-  if(result || !*done)
-    return result;               /* below errored/not finished yet */
-
-  /* MYFILTER CONNECT THINGS */  /* below connected, do out thing */
-  *done = cf->connected = TRUE;  /* done, remember, return */
-  return CURLE_OK;
-}
-```
-
-Closing a connection then works similar. The `conn` tells the first filter to close. Contrary to connecting,
-the filter does its own things first, before telling the next filter to close.
-
-### Efficiency
-
-There are two things curl is concerned about: efficient memory use and fast transfers.
-
-The memory footprint of a filter is relatively small:
-
-```
-struct Curl_cfilter {
-  const struct Curl_cftype *cft; /* the type providing implementation */
-  struct Curl_cfilter *next;     /* next filter in chain */
-  void *ctx;                     /* filter type specific settings */
-  struct connectdata *conn;      /* the connection this filter belongs to */
-  int sockindex;                 /* TODO: like to get rid off this */
-  BIT(connected);                /* != 0 iff this filter is connected */
-};
-```
-The filter type `cft` is a singleton, one static struct for each type of filter. The `ctx` is where a filter will hold its specific data. That varies by filter type. An http-proxy filter will keep the ongoing state of the CONNECT here, but free it after its has been established. The SSL filter will keep the `SSL*` (if OpenSSL is used) here until the connection is closed. So, this varies.
-
-`conn` is a reference to the connection this filter belongs to, so nothing extra besides the pointer itself.
-
-Several things, that before were kept in `struct connectdata`, will now go into the `filter->ctx` *when needed*. So, the memory footprint for connections that do *not* use an http proxy, or socks, or https will be lower.
-
-As to transfer efficiency, writing and reading through a filter comes at near zero cost *if the filter does not transform the data*. An http proxy or socks filter, once it is connected, will just pass the calls through. Those filters implementations will look like this:
-
-```
-ssize_t  Curl_cf_def_send(struct Curl_cfilter *cf, struct Curl_easy *data,
-                          const void *buf, size_t len, CURLcode *err)
-{
-  return cf->next->cft->do_send(cf->next, data, buf, len, err);
-}
-```
-The `recv` implementation is equivalent.
-
-## Filter Types
-
-The (currently) existing filter types are: SOCKET, SOCKET-ACCEPT, SSL, HTTP-PROXY and SOCKS-PROXY. Vital to establishing and read/writing a connection. But filters are also a good way to implement tasks for *managing* a connection:
-
-* **Statistics**: a filter that counts the number of bytes sent/received. Place one in front of SOCKET and one higher up and get the number of raw and "easy" bytes transferred. They may track the speed as well, or number of partial writes, etc.
-* **Timeout**: enforce timeouts, e.g. fail if a connection cannot be established in a certain amount of time.
-* **Progress**: report progress on a connection.
-* **Pacing**: limit read/write rates.
-* **Testing**: simulate network condition or failures.
-
-As you see, filters are a good way to add functionality to curl's internal handling of transfers without impact on other code.
-
-## Easy Filters?
-
-Some things that curl needs to manage are not directly tied to a specific connection but the property of the `Curl_easy` handle, e.g. a particular transfer. When using HTTP/2 or HTTP/3, many transfers can use the same connection. If one wants to monitor of the transfer itself or restricting its speed alone, a connection filter is not the right place to do this.
-
-So we might add "easy filters" one day. Who knows?
diff --git a/third-party/curl/docs/CONTRIBUTE.md b/third-party/curl/docs/CONTRIBUTE.md
index 72d3190019..f9b473c09a 100644
--- a/third-party/curl/docs/CONTRIBUTE.md
+++ b/third-party/curl/docs/CONTRIBUTE.md
@@ -1,3 +1,9 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # Contributing to the curl project
 
 This document is intended to offer guidelines on how to best contribute to the
@@ -18,7 +24,7 @@ Before posting to one of the curl mailing lists, please read up on the
 We also hang out on IRC in #curl on libera.chat
 
 If you are at all interested in the code side of things, consider clicking
-'watch' on the [curl repo on GitHub](https://github.com/curl/curl) to be
+'watch' on the [curl repository on GitHub](https://github.com/curl/curl) to be
 notified of pull requests and new issues posted there.
 
 ## License and copyright
@@ -35,14 +41,14 @@ must use "GPL compatible" licenses (as we want to allow users to use libcurl
 properly in GPL licensed environments).
 
 When changing existing source code, you do not alter the copyright of the
-original file(s). The copyright will still be owned by the original creator(s)
-or those who have been assigned copyright by the original author(s).
+original file(s). The copyright is still owned by the original creator(s) or
+those who have been assigned copyright by the original author(s).
 
 By submitting a patch to the curl project, you are assumed to have the right
 to the code and to be allowed by your employer or whatever to hand over that
-patch/code to us. We will credit you for your changes as far as possible, to
-give credit but also to keep a trace back to who made what changes. Please
-always provide us with your full real name when contributing,
+patch/code to us. We credit you for your changes as far as possible, to give
+credit but also to keep a trace back to who made what changes. Please always
+provide us with your full real name when contributing.
 
 ## What To Read
 
@@ -50,10 +56,10 @@ Source code, the man pages, the [INTERNALS
 document](https://curl.se/dev/internals.html),
 [TODO](https://curl.se/docs/todo.html),
 [KNOWN_BUGS](https://curl.se/docs/knownbugs.html) and the [most recent
-changes](https://curl.se/dev/sourceactivity.html) in git. Just lurking on
-the [curl-library mailing
-list](https://curl.se/mail/list.cgi?list=curl-library) will give you a
-lot of insights on what's going on right now. Asking there is a good idea too.
+changes](https://curl.se/dev/sourceactivity.html) in git. Lurking on the
+[curl-library mailing list](https://curl.se/mail/list.cgi?list=curl-library)
+gives you a lot of insights on what's going on right now. Asking there is a
+good idea too.
 
 ## Write a good patch
 
@@ -77,11 +83,11 @@ fix one bug at a time and send them as separate patches.
 
 ### Write Separate Changes
 
-It is annoying when you get a huge patch from someone that is said to fix 511
-odd problems, but discussions and opinions do not agree with 510 of them - or
-509 of them were already fixed in a different way. Then the person merging
-this change needs to extract the single interesting patch from somewhere
-within the huge pile of source, and that creates a lot of extra work.
+It is annoying when you get a huge patch from someone that is said to fix 11
+odd problems, but discussions and opinions do not agree with 10 of them - or 9
+of them were already fixed in a different way. Then the person merging this
+change needs to extract the single interesting patch from somewhere within the
+huge pile of source, and that creates a lot of extra work.
 
 Preferably, each fix that corrects a problem should be in its own patch/commit
 with its own description/commit message stating exactly what they correct so
@@ -96,57 +102,58 @@ and regression in the future.
 Please try to get the latest available sources to make your patches against.
 It makes the lives of the developers so much easier. The best is if you get
 the most up-to-date sources from the git repository, but the latest release
-archive is quite OK as well.
+archive is OK as well.
 
 ### Documentation
 
 Writing docs is dead boring and one of the big problems with many open source
-projects. But someone's gotta do it. It makes things a lot easier if you
-submit a small description of your fix or your new features with every
-contribution so that it can be swiftly added to the package documentation.
+projects but someone's gotta do it. It makes things a lot easier if you submit
+a small description of your fix or your new features with every contribution
+so that it can be swiftly added to the package documentation.
 
-The documentation is always made in man pages (nroff formatted) or plain
-ASCII files. All HTML files on the website and in the release archives are
-generated from the nroff/ASCII versions.
+Documentation is mostly provided as man pages or plain ASCII files. The
+man pages are rendered from their source files that are usually written using
+markdown. Most HTML files on the website and in the release archives are
+generated from corresponding markdown and ASCII files.
 
 ### Test Cases
 
 Since the introduction of the test suite, we can quickly verify that the main
 features are working as they are supposed to. To maintain this situation and
-improve it, all new features and functions that are added need to be tested
-in the test suite. Every feature that is added should get at least one valid
-test case that verifies that it works as documented. If every submitter also
-posts a few test cases, it will not end up as a heavy burden on a single person!
+improve it, all new features and functions that are added need to be tested in
+the test suite. Every feature that is added should get at least one valid test
+case that verifies that it works as documented. If every submitter also posts
+a few test cases, it does not end up a heavy burden on a single person.
 
 If you do not have test cases or perhaps you have done something that is hard
 to write tests for, do explain exactly how you have otherwise tested and
 verified your changes.
 
-## Submit Your Changes
+# Submit Your Changes
 
-### How to get your changes into the main sources
+## Get your changes merged
 
 Ideally you file a [pull request on
 GitHub](https://github.com/curl/curl/pulls), but you can also send your plain
 patch to [the curl-library mailing
 list](https://curl.se/mail/list.cgi?list=curl-library).
 
-If you opt to post a patch on the mailing list, chances are someone will
-convert it into a pull request for you, to have the CI jobs verify it proper
-before it can be merged. Be prepared that some feedback on the proposed change
-might then come on GitHub.
+If you opt to post a patch on the mailing list, chances are someone converts
+it into a pull request for you, to have the CI jobs verify it proper before it
+can be merged. Be prepared that some feedback on the proposed change might
+then come on GitHub.
 
-Your change will be reviewed and discussed and you will be expected to correct
-flaws pointed out and update accordingly, or the change risks stalling and
-eventually just getting deleted without action. As a submitter of a change,
-you are the owner of that change until it has been merged.
+As your changes are reviewed and discussed, you are expected to address any
+flaws pointed out and update accordingly. Otherwise your changes risk stalling
+and eventually being deleted without action. As a submitter of a change, you
+are the owner of that change until it has been merged.
 
 Respond on the list or on GitHub about the change and answer questions and/or
-fix nits/flaws. This is important. We will take lack of replies as a sign that
-you are not anxious to get your patch accepted and we tend to simply drop such
+fix nits/flaws. This is important. We take lack of replies as a sign that you
+are not anxious to get your patch accepted and we tend to drop such
 changes.
 
-### About pull requests
+## About pull requests
 
 With GitHub it is easy to send a [pull
 request](https://github.com/curl/curl/pulls) to the curl project to have
@@ -157,13 +164,13 @@ git commit that is easy to merge and they are easy to track and not that easy
 to lose in the flood of many emails, like they sometimes do on the mailing
 lists.
 
-Every pull request submitted will automatically be tested in several different
+Every pull request submitted is automatically tested in several different
 ways. [See the CI document for more
-information](https://github.com/curl/curl/blob/master/tests/CI.md).
+information](https://github.com/curl/curl/blob/master/docs/tests/CI.md).
 
 Sometimes the tests fail due to a dependency service temporarily being offline
-or otherwise unavailable, e.g. package downloads. In this case you can just
-try to update your pull requests to rerun the tests later as described below.
+or otherwise unavailable, e.g. package downloads. In this case you can try to
+update your pull requests to rerun the tests later as described below.
 
 You can update your pull requests by pushing new commits or force-pushing
 changes to existing commits. Force-pushing an amended commit without any
@@ -178,7 +185,23 @@ checks and qualifications this pull request must also receive more "votes" of
 user support. More signs that people want this to happen. It could be in the
 form of messages saying so, or thumbs-up reactions on GitHub.
 
-### Making quality changes
+## When the pull request is approved
+
+If it does not seem to get approved when you think it is ready - feel free to
+ask for approval.
+
+Once your pull request has been approved it can be merged by a maintainer.
+
+For new features, or changes, we require that the *feature window* is open for
+the pull request to be merged. This is typically a three week period that
+starts ten days after a previous release. New features submitted as pull
+requests while the window is closed have to wait until it opens to get
+merged.
+
+If time passes without your approved pull request gets merged: feel free to
+ask what more you can do to make it happen.
+
+## Making quality changes
 
 Make the patch against as recent source versions as possible.
 
@@ -186,131 +209,161 @@ If you have followed the tips in this document and your patch still has not
 been incorporated or responded to after some weeks, consider resubmitting it
 to the list or better yet: change it to a pull request.
 
-### Commit messages
+## Commit messages
 
-A short guide to how to write git commit messages in the curl project.
+How to write git commit messages in the curl project.
 
     ---- start ----
     [area]: [short line describing the main effect]
            -- empty line --
     [full description, no wider than 72 columns that describes as much as
     possible as to why this change is made, and possibly what things
-    it fixes and everything else that is related, with unwieldy URLs replaced
-    with references like [0], [1], etc.]
-           -- empty line --
-    [[0] URL - Reference to a URL in the description, almost like Markdown;
-        the last numbered reference is followed by an -- empty line -- ]
-    [Follow-up to {shorthash} - if this fixes or continues a previous commit;
-        add a Ref: that commit's PR or issue if it's not a small, obvious fix;
-        followed by an -- empty line -- ]
-    [Bug: URL to the source of the report or more related discussion; use Fixes
-        for GitHub issues instead when that is appropriate]
-    [Approved-by: John Doe - credit someone who approved the PR; if you are
-        committing this for someone else using --author=... you do not need this
-        as you are implicitly approving it by committing]
-    [Authored-by: John Doe - credit the original author of the code; only use
-        this if you cannot use "git commit --author=..."]
-    [Signed-off-by: John Doe - we do not use this, but do not bother removing it]
-    [whatever-else-by: credit all helpers, finders, doers; try to use one of
-        the following keywords if at all possible, for consistency:
-        Acked-by:, Assisted-by:, Co-authored-by:, Found-by:, Reported-by:,
-        Reviewed-by:, Suggested-by:, Tested-by:]
-    [Ref: #1234 - if this is related to a GitHub issue or PR, possibly one that
-                  has already been closed]
-    [Ref: URL to more information about the commit; use Bug: instead for
-        a reference to a bug on another bug tracker]
-    [Fixes #1234 - if this closes a GitHub issue; GitHub will actually
-        close the issue once this commit is merged]
-    [Closes #1234 - if this closes a GitHub PR; GitHub will actually
-        close the PR once this commit is merged]
-    ---- stop ----
+    it fixes and everything else that is related,
+    -- end --
 
-The first line is a succinct description of the change:
+The first line is a succinct description of the change and should ideally work
+as a single line in the RELEASE NOTES.
 
- - use the imperative, present tense: "change" not "changed" nor "changes"
- - do not capitalize the first letter
- - no period (.) at the end
+- use the imperative, present tense: **change** not "changed" nor "changes"
+- do not capitalize the first letter
+- no period (.) at the end
 
 The `[area]` in the first line can be `http2`, `cookies`, `openssl` or
 similar. There is no fixed list to select from but using the same "area" as
 other related changes could make sense.
 
-Do not forget to use commit --author=... if you commit someone else's work, and
-make sure that you have your own user and email setup correctly in git before
-you commit.
+## Commit message keywords
+
+Use the following ways to improve the message and provide pointers to related
+work.
+
+- `Follow-up to {shorthash}` - if this fixes or continues a previous commit;
+  add a `Ref:` that commit's PR or issue if it is not a small, obvious fix;
+  followed by an empty line
+
+- `Bug: URL` to the source of the report or more related discussion; use
+  `Fixes` for GitHub issues instead when that is appropriate.
+
+- `Approved-by: John Doe` - credit someone who approved the PR.
+
+- `Authored-by: John Doe` - credit the original author of the code; only use
+  this if you cannot use `git commit --author=...`.
+
+- `Signed-off-by: John Doe` - we do not use this, but do not bother removing
+  it.
+
+- `whatever-else-by:` credit all helpers, finders, doers; try to use one of
+  the following keywords if at all possible, for consistency: `Acked-by:`,
+  `Assisted-by:`, `Co-authored-by:`, `Found-by:`, `Reported-by:`,
+  `Reviewed-by:`, `Suggested-by:`, `Tested-by:`.
+
+- `Ref: #1234` - if this is related to a GitHub issue or PR, possibly one that
+  has already been closed.
+
+- `Ref: URL` to more information about the commit; use `Bug:` instead for a
+  reference to a bug on another bug tracker.
+
+- `Fixes #1234` - if this fixes a GitHub issue; GitHub closes the issue once
+  this commit is merged.
+
+- `Closes #1234` - if this merges a GitHub PR; GitHub closes the PR once this
+  commit is merged.
+
+Do not forget to use commit with `--author` if you commit someone else's work,
+and make sure that you have your own user and email setup correctly in git
+before you commit.
 
 Add whichever header lines as appropriate, with one line per person if more
-than one person was involved. There is no need to credit yourself unless you are
-using --author=... which hides your identity. Do not include people's e-mail
+than one person was involved. There is no need to credit yourself unless you
+are using `--author` which hides your identity. Do not include people's email
 addresses in headers to avoid spam, unless they are already public from a
 previous commit; saying `{userid} on github` is OK.
 
-### Write Access to git Repository
+## Push Access
 
 If you are a frequent contributor, you may be given push access to the git
-repository and then you will be able to push your changes straight into the git
-repo instead of sending changes as pull requests or by mail as patches.
+repository and then you are able to push your changes straight into the git
+repository instead of sending changes as pull requests or by mail as patches.
 
-Just ask if this is what you would want. You will be required to have posted
-several high quality patches first, before you can be granted push access.
+Feel free to ask for this, if this is what you want. You are required to have
+posted several high quality patches first, before you can be granted push
+access.
 
-### How To Make a Patch with git
+## Useful resources
 
-You need to first checkout the repository:
+- [Webinar on getting code into curl](https://youtu.be/QmZ3W1d6LQI)
 
-    git clone https://github.com/curl/curl.git
+# Update copyright and license information
 
-You then proceed and edit all the files you like and you commit them to your
-local repository:
-
-    git commit [file]
-
-As usual, group your commits so that you commit all changes at once that
-constitute a logical change.
-
-Once you have done all your commits and you are happy with what you see, you
-can make patches out of your changes that are suitable for mailing:
-
-    git format-patch remotes/origin/master
-
-This creates files in your local directory named `NNNN-[name].patch` for each
-commit.
-
-Now send those patches off to the curl-library list. You can of course opt to
-do that with the 'git send-email' command.
-
-### How To Make a Patch without git
-
-Keep a copy of the unmodified curl sources. Make your changes in a separate
-source tree. When you think you have something that you want to offer the
-curl community, use GNU diff to generate patches.
-
-If you have modified a single file, try something like:
-
-    diff -u unmodified-file.c my-changed-one.c > my-fixes.diff
-
-If you have modified several files, possibly in different directories, you
-can use diff recursively:
-
-    diff -ur curl-original-dir curl-modified-sources-dir > my-fixes.diff
-
-The GNU diff and GNU patch tools exist for virtually all platforms, including
-all kinds of Unixes and Windows.
-
-### Useful resources
- - [Webinar on getting code into cURL](https://www.youtube.com/watch?v=QmZ3W1d6LQI)
-
-## Update copyright and license information
-
-There is a CI job called **REUSE compliance / check** that will run on every
-pull request and commit to verify that the *REUSE state* of all files are
-still fine.
+There is a CI job called **REUSE compliance / check** that runs on every pull
+request and commit to verify that the *REUSE state* of all files are still
+fine.
 
 This means that all files need to have their license and copyright information
 clearly stated. Ideally by having the standard curl source code header, with
-the SPDX-License-Identifier included. If the header does not work, you can use a
-smaller header or add the information for a specific file to the `.reuse/dep5`
-file.
+the `SPDX-License-Identifier` included. If the header does not work, you can
+use a smaller header or add the information for a specific file to the
+`REUSE.toml` file.
 
 You can manually verify the copyright and compliance status by running the
-`./scripts/copyright.pl` script in the root of the git repository.
+[REUSE helper tool](https://github.com/fsfe/reuse-tool): `reuse lint`
+
+# On AI use in curl
+
+Guidelines for AI use when contributing to curl.
+
+## For security reports and other issues
+
+If you asked an AI tool to find problems in curl, you **must** make sure to
+reveal this fact in your report.
+
+You must also double-check the findings carefully before reporting them to us
+to validate that the issues are indeed existing and working exactly as the AI
+says. AI-based tools frequently generate inaccurate or fabricated results.
+
+Further: it is *rarely* a good idea to copy and paste an AI generated report
+to the project. Those generated reports typically are too wordy and rarely to
+the point (in addition to the common fabricated details). If you actually find
+a problem with an AI and you have verified it yourself to be true: write the
+report yourself and explain the problem as you have learned it. This makes
+sure the AI-generated inaccuracies and invented issues are filtered out early
+before they waste more people's time.
+
+As we take security reports seriously, we investigate each report with
+priority. This work is both time and energy consuming and pulls us away from
+doing other meaningful work. Fake and otherwise made up security problems
+effectively prevent us from doing real project work and make us waste time and
+resources.
+
+We ban users immediately who submit made up fake reports to the project.
+
+## For pull requests
+
+When contributing content to the curl project, you give us permission to use
+it as-is and you must make sure you are allowed to distribute it to us. By
+submitting a change to us, you agree that the changes can and should be
+adopted by curl and get redistributed under the curl license. Authors should
+be explicitly aware that the burden is on them to ensure no unlicensed code is
+submitted to the project.
+
+This is independent if AI is used or not.
+
+When contributing a pull request you should of course always make sure that
+the proposal is good quality and a best effort that follows our guidelines. A
+basic rule of thumb is that if someone can spot that the contribution was made
+with the help of AI, you have more work to do.
+
+We can accept code written with the help of AI into the project, but the code
+must still follow coding standards, be written clearly, be documented, feature
+test cases and adhere to all the normal requirements we have.
+
+## For translation
+
+Translation services help users write reports, texts and documentation in
+non-native languages and we encourage and welcome such contributors and
+contributions.
+
+As AI-based translation tools sometimes have a way to make the output sound a
+little robotic and add an "AI tone" to the text, you may want to consider
+mentioning that you used such a tool. Failing to do so risks that maintainers
+wrongly dismiss translated texts as AI slop.
diff --git a/third-party/curl/docs/CURL-DISABLE.md b/third-party/curl/docs/CURL-DISABLE.md
index 7978ed2125..a6a1ea1661 100644
--- a/third-party/curl/docs/CURL-DISABLE.md
+++ b/third-party/curl/docs/CURL-DISABLE.md
@@ -1,3 +1,9 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # Code defines to disable features and protocols
 
 ## `CURL_DISABLE_ALTSVC`
@@ -34,7 +40,11 @@ Disable support for the negotiate authentication methods.
 
 ## `CURL_DISABLE_AWS`
 
-Disable **AWS-SIG4** support.
+Disable **aws-sigv4** support.
+
+## `CURL_DISABLE_CA_SEARCH`
+
+Disable unsafe CA bundle search in PATH on Windows.
 
 ## `CURL_DISABLE_DICT`
 
@@ -58,8 +68,8 @@ Disable the FTP (and FTPS) protocol
 
 ## `CURL_DISABLE_GETOPTIONS`
 
-Disable the `curl_easy_options` API calls that lets users get information
-about existing options to `curl_easy_setopt`.
+Disable the `curl_easy_options()` API calls that lets users get information
+about existing options to `curl_easy_setopt()`.
 
 ## `CURL_DISABLE_GOPHER`
 
@@ -110,10 +120,6 @@ Disable MQTT support.
 
 Disable the netrc parser.
 
-## `CURL_DISABLE_NTLM`
-
-Disable support for NTLM.
-
 ## `CURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG`
 
 Disable the auto load config support in the OpenSSL backend.
@@ -134,17 +140,26 @@ Disable the built-in progress meter
 
 Disable support for proxies
 
+## `CURL_DISABLE_IPFS`
+
+Disable the IPFS/IPNS protocols. This affects the curl tool only, where
+IPFS/IPNS protocol support is implemented.
+
 ## `CURL_DISABLE_RTSP`
 
 Disable the RTSP protocol.
 
+## `CURL_DISABLE_SHA512_256`
+
+Disable the SHA-512/256 hash algorithm.
+
 ## `CURL_DISABLE_SHUFFLE_DNS`
 
 Disable the shuffle DNS feature
 
-## `CURL_DISABLE_SMB`
+## `CURL_ENABLE_SMB`
 
-Disable the SMB(S) protocols
+Enable the SMB(S) protocols
 
 ## `CURL_DISABLE_SMTP`
 
@@ -163,6 +178,16 @@ Disable the TELNET protocol
 
 Disable the TFTP protocol
 
+## `CURL_DISABLE_TYPECHECK`
+
+Disable `curl_easy_setopt()`/`curl_easy_getinfo()` type checking.
+
+Useful to improve build performance for the `tests/libtest` test tool.
+
 ## `CURL_DISABLE_VERBOSE_STRINGS`
 
 Disable verbose strings and error messages.
+
+## `CURL_DISABLE_WEBSOCKETS`
+
+Disable the WebSocket protocols.
diff --git a/third-party/curl/docs/CURLDOWN.md b/third-party/curl/docs/CURLDOWN.md
new file mode 100644
index 0000000000..c804eae746
--- /dev/null
+++ b/third-party/curl/docs/CURLDOWN.md
@@ -0,0 +1,165 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# curldown
+
+A markdown-like syntax for libcurl man pages.
+
+## Purpose
+
+A text format for writing libcurl documentation in the shape of man pages.
+
+Make it easier for users to contribute and write documentation. A format that
+is easier on the eye in its source format.
+
+Make it harder to do syntactical mistakes.
+
+Use a format that allows creating man pages that end up looking exactly like
+the man pages did when we wrote them in nroff format.
+
+Take advantage of the fact that people these days are accustomed to markdown
+by using a markdown-like syntax.
+
+This allows us to fix issues in the nroff format easier since now we generate
+them. For example: escaping minus to prevent them from being turned into
+Unicode by man.
+
+Generate nroff output that looks (next to) *identical* to the previous files,
+so that the look, existing test cases, HTML conversions, existing
+infrastructure etc remain mostly intact.
+
+Contains meta-data in a structured way to allow better output (for example the
+see also information) and general awareness of what the file is about.
+
+## File extension
+
+Since curldown looks similar to markdown, we use `.md` extensions on the
+files.
+
+## Conversion
+
+Convert **from curldown to nroff** with `cd2nroff`. Generates nroff man pages.
+
+Convert **from nroff to curldown** with `nroff2cd`. This is only meant to be
+used for the initial conversion to curldown and should ideally never be needed
+again.
+
+Convert, check or clean up an existing curldown to nicer, better, cleaner
+curldown with **cd2cd**.
+
+Mass-convert all curldown files to nroff in specified directories with
+`cdall`:
+
+    cdall [dir1] [dir2] [dir3] ..
+
+## Known issues
+
+The `cd2nroff` tool does not yet handle *italics* or **bold** where the start
+and the end markers are used on separate lines.
+
+The `nroff2cd` tool generates code style quotes for all `.fi` sections since
+the nroff format does not carry a distinction.
+
+# Format
+
+Each curldown starts with a header with meta-data:
+
+    ---
+    c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+    SPDX-License-Identifier: curl
+    Title: CURLOPT_AWS_SIGV4
+    Section: 3
+    Source: libcurl
+    Protocol:
+      - HTTP
+    See-also:
+      - CURLOPT_HEADEROPT (3)
+      - CURLOPT_HTTPAUTH (3)
+    TLS-backend:
+      - [name]
+    Added-in: [version or "n/a"]
+    ---
+
+All curldown files *must* have all the headers present and at least one
+`See-also:` entry specified.
+
+If the man page is for section 3 (library related). The `Protocol` list must
+contain at least one protocol, which can be `*` if the option is virtually for
+everything. If `*` is used, it must be the only listed protocol. Recognized
+protocols are either URL schemes (in uppercase), `TLS` or `TCP`.
+
+If the `Protocol` list contains `TLS`, then there must also be a `TLS-backend`
+list, specifying `All` or a list of what TLS backends that work with this
+option. The available TLS backends are:
+
+- `GnuTLS`
+- `mbedTLS`
+- `OpenSSL` (also covers AmiSSL, AWS-LC, BoringSSL, LibreSSL and quictls)
+- `rustls`
+- `Schannel`
+- `wolfSSL`
+- `All`: all TLS backends
+
+Following the header in the file, is the manual page using markdown-like
+syntax:
+
+~~~
+    # NAME
+    a page - this is a page describing something
+
+    # SYNOPSIS
+    ~~~c
+    #include <curl/curl.h>
+
+    CURLcode curl_easy_setopt(CURL *handle, CURLOPT_AWS_SIGV4, char *param);
+    ~~~
+~~~
+
+Quoted source code should start with `~~~c` and end with `~~~` while regular
+quotes can start with `~~~` or be indented with 4 spaces.
+
+Headers at top-level `#` get converted to `.SH`.
+
+`nroff2cd` supports the `##` next level header which gets converted to `.IP`.
+
+Write bold words or phrases within `**` like:
+
+    This is a **bold** word.
+
+Write italics like:
+
+    This is *italics*.
+
+Due to how man pages do not support backticks especially formatted, such
+occurrences in the source are instead using italics in the generated output:
+
+    This `word` appears in italics.
+
+When generating the nroff output, the tooling removes superfluous newlines,
+meaning they can be used freely in the source file to make the text more
+readable.
+
+To make sure curldown documents render correctly as markdown, all literal
+occurrences of `<` or `>` need to be escaped by a leading backslash.
+
+## Generating contents
+
+`# %PROTOCOLS%` - inserts a **PROTOCOLS** section based on the metadata
+provided in the header.
+
+`# %AVAILABILITY%` - inserts an **AVAILABILITY** section based on the metadata
+provided in the header.
+
+## Symbols
+
+All mentioned curl symbols that have their own man pages, like
+`curl_easy_perform(3)` are automatically rendered using italics in the output
+without having to enclose it with asterisks. This helps ensuring that they get
+converted to links properly later in the HTML version on the website, as
+converted with `roffit`. This makes the curldown text easier to read even when
+mentioning many curl symbols.
+
+This auto-linking works for patterns matching `(lib|)curl[^ ]*(3)`.
diff --git a/third-party/curl/docs/DEPRECATE.md b/third-party/curl/docs/DEPRECATE.md
index 5ea36eb57f..fe00189182 100644
--- a/third-party/curl/docs/DEPRECATE.md
+++ b/third-party/curl/docs/DEPRECATE.md
@@ -1,3 +1,9 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # Items to be removed from future curl releases
 
 If any of these deprecated features is a cause for concern for you, please
@@ -6,43 +12,74 @@ email the
 as soon as possible and explain to us why this is a problem for you and
 how your use case cannot be satisfied properly using a workaround.
 
-## mingw v1
+## TLS-SRP Authentication
 
-We remove support for building curl with the original legacy mingw version 1
-in September 2023.
+Transport Layer Security Secure Remote Password is a TLS feature that does not
+work with TLS 1.3 or QUIC and is virtually unused by curl users and in
+general.
 
-During the deprecation period you can enable the support with the configure
-option `--with-mingw1-deprecated`.
+TLS-SRP support gets removed in August 2026.
 
-mingw version 1 is old and deprecated software. There are much better and
-still support build environments to use to build curl and other software. For
-example [MinGW-w64](https://www.mingw-w64.org/).
+## drop SMB support
 
-## space-separated `NOPROXY` patterns
+The SMB protocol has weak security and is rarely used these days.
 
-When specifying patterns/domain names for curl that should *not* go through a
-proxy, the curl tool features the `--noproxy` command line option and the
-library supports the `NO_PROXY` environment variable and the `CURLOPT_NOPROXY`
-libcurl option.
+SMB support gets removed in September 2026.
 
-They all set the same list of patterns. This list is documented to be a set of
-**comma-separated** names, but can also be provided separated with just
-space. The ability to just use spaces for this has never been documented but
-some users may still have come to rely on this.
+## drop NTLM support
 
-Several other tools and utilities also parse the `NO_PROXY` environment
-variable but do not consider a space to be a valid separator. Using spaces for
-separator is probably less portable and might cause more friction than commas
-do. Users should use commas for this for greater portability.
+The NTLM authentication method has weak security and is rarely used these
+days. It has been deprecated by Microsoft and does not work over HTTP/2 or
+HTTP/3.
 
-curl will remove the support for space-separated names in July 2024.
+NTLM support gets removed in September 2026
 
-## past removals
+## Local crypto implementations
 
- - Pipelining
- - axTLS
- - PolarSSL
- - NPN
- - Support for systems without 64 bit data types
- - NSS
- - gskit
+Since the dawn of time, curl bundles code for a few crypto and hash algorithms
+in order to enable functionality for builds without TLS libraries. This list
+includes MD4, MD5, SHA256, SHA256_512 and perhaps something more.
+
+Meanwhile, curl is almost always built to use a TLS/crypto library which for
+sure has better maintained and better performing versions of these algorithms.
+
+Also, the local curl implementations are not as widely tested since curl
+builds without TLS are rare.
+
+Since these implementations are going away, a good idea is to verify ahead of
+time that builds using your preferred TLS library use the crypto functions
+provided by that library and are not bundled by curl.
+
+The removal of local crypto functions subsequently disables some functions in
+future curl versions when built without TLS support. For example Digest.
+
+Local crypto gets removed in October 2026.
+
+## Past removals
+
+- axTLS (removed in 7.63.0)
+- Pipelining (removed in 7.65.0)
+- PolarSSL (removed in 7.69.0)
+- NPN (removed in 7.86.0)
+- Support for systems without 64-bit data types (removed in 8.0.0)
+- NSS (removed in 8.3.0)
+- gskit (removed in 8.3.0)
+- MinGW v1 (removed in 8.4.0)
+- NTLM_WB (removed in 8.8.0)
+- space-separated `NOPROXY` patterns (removed in 8.9.0)
+- hyper (removed in 8.12.0)
+- Support for Visual Studio 2005 and older (removed in 8.13.0)
+- Secure Transport (removed in 8.15.0)
+- BearSSL (removed in 8.15.0)
+- msh3 (removed in 8.16.0)
+- winbuild build system (removed in 8.17.0)
+- Windows CE (removed in 8.18.0)
+- Support for Visual Studio 2008 (removed in 8.18.0)
+- OpenSSL 1.1.1 and older (removed in 8.18.0)
+- Support for Windows XP (removed in 8.19.0)
+- OpenSSL-QUIC (removed in 8.19.0)
+- CMake 3.17 and older (removed in 8.20.0)
+- RTMP (removed in 8.20.0)
+- SMB (became opt-in in 8.20.0)
+- NTLM (became opt-in in 8.20.0)
+- c-ares < 1.16.0 (removed in 8.20.0)
diff --git a/third-party/curl/docs/DISTROS.md b/third-party/curl/docs/DISTROS.md
new file mode 100644
index 0000000000..3a433445da
--- /dev/null
+++ b/third-party/curl/docs/DISTROS.md
@@ -0,0 +1,304 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# curl distros
+
+<!-- markdown-link-check-disable -->
+
+Lots of organizations distribute curl packages to end users. This is a
+collection of pointers to where to learn more about curl on and with each
+distro. Those marked *Rolling Release* typically run the latest version of curl
+and are therefore less likely to have back-ported patches to older versions.
+
+We discuss curl distro issues, patches and collaboration on the [curl-distros
+mailing list](https://lists.haxx.se/listinfo/curl-distros) ([list
+archives](https://curl.se/mail/list.cgi?list=curl-distros)).
+
+## AlmaLinux
+
+- curl package source and patches: https://git.almalinux.org/rpms/curl/
+- curl issues: https://bugs.almalinux.org/view_all_bug_page.php click Category and choose curl
+- curl security: https://errata.almalinux.org/ search for curl
+
+## Alpine Linux
+
+- curl: https://pkgs.alpinelinux.org/package/edge/main/x86_64/curl
+- curl issues: https://gitlab.alpinelinux.org/alpine/aports/-/issues
+- curl security: https://security.alpinelinux.org/srcpkg/curl
+- curl package source and patches: https://gitlab.alpinelinux.org/alpine/aports/-/tree/master/main/curl
+
+## Alt Linux
+
+- curl: https://packages.altlinux.org/en/search/?q=curl
+- curl issues: https://packages.altlinux.org/en/sisyphus/srpms/curl/issues/
+- curl patches: https://git.altlinux.org/gears/c/curl.git?p=curl.git;a=tree;f=.gear
+
+## Arch Linux
+
+*Rolling Release*
+
+- curl: https://archlinux.org/packages/core/x86_64/curl/
+- curl issues: https://gitlab.archlinux.org/archlinux/packaging/packages/curl/-/issues
+- curl security: https://security.archlinux.org/package/curl
+- curl wiki: https://wiki.archlinux.org/title/CURL
+
+## Buildroot
+
+*Rolling Release*
+
+- curl package source and patches: **missing URL**
+- curl issues: **missing URL**
+
+## Chimera
+
+- curl package source and patches: https://github.com/chimera-linux/cports/tree/master/main/curl
+
+## Clear Linux
+
+*Rolling Release*
+
+- curl: https://github.com/clearlinux-pkgs/curl
+- curl issues: https://github.com/clearlinux/distribution/issues
+
+## Conary
+
+- curl: https://github.com/conan-io/conan-center-index/tree/master/recipes/libcurl
+- curl issues: https://github.com/conan-io/conan-center-index/issues
+- curl patches: https://github.com/conan-io/conan-center-index/tree/master/recipes/libcurl (in `all/patches/*`, if any)
+
+## conda-forge
+
+- curl: https://github.com/conda-forge/curl-feedstock
+- curl issues: https://github.com/conda-forge/curl-feedstock/issues
+
+## CRUX
+
+- curl: https://crux.nu/portdb/?a=search&q=curl
+- curl issues: https://git.crux.nu/ports/core/issues/?type=all&state=open&q=curl
+
+## curl-for-win
+
+(this is the official curl binaries for Windows shipped by the curl project)
+
+*Rolling Release*
+
+- curl: https://curl.se/windows/
+- curl patches: https://github.com/curl/curl-for-win/blob/main/curl.patch (if any)
+- build-specific issues: https://github.com/curl/curl-for-win/issues
+
+Issues and patches for this are managed in the main curl project.
+
+## Cygwin
+
+- curl: https://cygwin.com/cgit/cygwin-packages/curl/tree/curl.cygport
+- curl patches: https://cygwin.com/cgit/cygwin-packages/curl/tree
+- curl issues: https://inbox.sourceware.org/cygwin/?q=s%3Acurl
+
+## Cygwin (cross mingw64)
+
+- mingw64-x86_64-curl: https://cygwin.com/cgit/cygwin-packages/mingw64-x86_64-curl/tree/mingw64-x86_64-curl.cygport
+- mingw64-x86_64-curl patches: https://cygwin.com/cgit/cygwin-packages/mingw64-x86_64-curl/tree
+- mingw64-x86_64-curl issues: https://inbox.sourceware.org/cygwin/?q=s%3Amingw64-x86_64-curl
+
+## Debian
+
+- curl: https://tracker.debian.org/pkg/curl
+- curl issues: https://bugs.debian.org/cgi-bin/pkgreport.cgi?pkg=curl
+- curl patches: https://udd.debian.org/patches.cgi?src=curl
+- curl patches: https://salsa.debian.org/debian/curl (in debian/* branches, inside the folder debian/patches)
+
+## Fedora
+
+- curl: https://src.fedoraproject.org/rpms/curl
+- curl issues: [bugzilla](https://bugzilla.redhat.com/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&classification=Fedora&product=Fedora&product=Fedora%20EPEL&component=curl)
+- curl patches: [list of patches in package git](https://src.fedoraproject.org/rpms/curl/tree/rawhide)
+
+## FreeBSD
+
+- curl: https://cgit.freebsd.org/ports/tree/ftp/curl
+- curl patches: https://cgit.freebsd.org/ports/tree/ftp/curl
+- curl issues: https://bugs.freebsd.org/bugzilla/buglist.cgi?bug_status=__open__&order=Importance&product=Ports%20%26%20Packages&query_format=advanced&short_desc=curl&short_desc_type=allwordssubstr
+
+## Gentoo Linux
+
+*Rolling Release*
+
+- curl: https://packages.gentoo.org/packages/net-misc/curl
+- curl issues: https://bugs.gentoo.org/buglist.cgi?quicksearch=net-misc/curl
+- curl package sources and patches: https://gitweb.gentoo.org/repo/gentoo.git/tree/net-misc/curl/
+
+## GNU Guix
+
+*Rolling Release*
+
+- curl: https://git.savannah.gnu.org/gitweb/?p=guix.git;a=blob;f=gnu/packages/curl.scm;hb=HEAD
+- curl issues: https://issues.guix.gnu.org/search?query=curl
+
+## Haiku
+
+- curl: https://github.com/haikuports/haikuports/tree/master/net-misc/curl
+- curl issues: https://github.com/haikuports/haikuports/issues
+- curl patches: https://github.com/haikuports/haikuports/tree/master/net-misc/curl/patches (if any)
+
+## Homebrew
+
+*Rolling Release*
+
+- curl: https://formulae.brew.sh/formula/curl
+
+Homebrew's policy is that all patches and issues should be submitted upstream
+unless it is specific to Homebrew's way of packaging software.
+
+## LibreELEC
+
+- curl: https://github.com/LibreELEC/LibreELEC.tv/blob/master/packages/web/curl/
+- curl issues: https://github.com/LibreELEC/LibreELEC.tv/issues?q=is%3Aissue%20state%3Aopen%20curl
+- curl patches: https://github.com/LibreELEC/LibreELEC.tv/blob/master/packages/web/curl/patches/
+
+## MacPorts
+
+*Rolling Release*
+
+- curl: https://github.com/macports/macports-ports/tree/master/net/curl
+- curl issues: https://trac.macports.org/query?0_port=curl&0_port_mode=%7E&0_status=%21closed
+- curl patches: https://github.com/macports/macports-ports/tree/master/net/curl/files
+
+## Mageia
+
+- curl: https://svnweb.mageia.org/packages/cauldron/curl/current/SPECS/curl.spec?view=markup
+- curl issues: https://bugs.mageia.org/buglist.cgi?bug_status=NEW&bug_status=UNCONFIRMED&bug_status=NEEDINFO&bug_status=UPSTREAM&bug_status=ASSIGNED&component=RPM%20Packages&f1=cf_rpmpkg&list_id=176576&o1=casesubstring&product=Mageia&query_format=advanced&v1=curl
+- curl patches: https://svnweb.mageia.org/packages/cauldron/curl/current/SOURCES/
+- curl patches in stable distro releases: https://svnweb.mageia.org/packages/updates/9/curl/current/SOURCES/
+- curl security: https://advisories.mageia.org/src_curl.html
+
+## MSYS2
+
+*Rolling Release*
+
+- curl: https://github.com/msys2/MSYS2-packages/tree/master/curl
+- curl issues: https://github.com/msys2/MSYS2-packages/issues
+- curl patches: https://github.com/msys2/MSYS2-packages/tree/master/curl (`*.patch`)
+
+## MSYS2 (mingw-w64)
+
+*Rolling Release*
+
+- curl: https://github.com/msys2/MINGW-packages/tree/master/mingw-w64-curl
+- curl issues: https://github.com/msys2/MINGW-packages/issues
+- curl patches: https://github.com/msys2/MINGW-packages/tree/master/mingw-w64-curl (`*.patch`)
+
+## Muldersoft
+
+*Rolling Release*
+
+- curl: https://github.com/lordmulder/curl-build-win32
+- curl issues: https://github.com/lordmulder/curl-build-win32/issues
+- curl patches: https://github.com/lordmulder/curl-build-win32/tree/master/patch
+
+## NixOS
+
+- curl: https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/by-name/cu/curlMinimal/package.nix
+- curl issues: https://github.com/NixOS/nixpkgs
+
+nixpkgs is the package repository used by the NixOS Linux distribution, but
+can also be used on other distributions
+
+## OmniOS
+
+- curl: https://github.com/omniosorg/omnios-build/tree/master/build/curl
+- curl issues: https://github.com/omniosorg/omnios-build/issues
+- curl patches: https://github.com/omniosorg/omnios-build/tree/master/build/curl/patches
+
+## OpenIndiana
+
+- curl: https://github.com/OpenIndiana/oi-userland/tree/oi/hipster/components/web/curl
+- curl issues: https://www.illumos.org/projects/openindiana/issues
+- curl patches: https://github.com/OpenIndiana/oi-userland/tree/oi/hipster/components/web/curl/patches
+
+## OpenSUSE
+
+- curl source and patches: https://build.opensuse.org/package/show/openSUSE%3AFactory/curl
+
+## Oracle Solaris
+
+- curl: https://github.com/oracle/solaris-userland/tree/master/components/curl
+- curl issues: https://support.oracle.com/ (requires support contract)
+- curl patches: https://github.com/oracle/solaris-userland/tree/master/components/curl/patches
+
+## OpenBSD
+
+- curl: https://github.com/openbsd/ports/tree/master/net/curl
+- curl issues: https://www.openbsd.org/mail.html (ports mailing list)
+- curl patches: https://github.com/openbsd/ports/tree/master/net/curl/patches
+
+## OpenEmbedded / Yocto Project
+
+*Rolling Release*
+
+- curl: https://layers.openembedded.org/layerindex/recipe/5765/
+- curl issues: https://bugzilla.yoctoproject.org/
+- curl patches: https://git.openembedded.org/openembedded-core/tree/meta/recipes-support/curl
+
+## PLD Linux
+
+- curl package source and patches: https://github.com/pld-linux/curl
+- curl issues: https://bugs.launchpad.net/pld-linux?field.searchtext=curl&search=Search&field.status%3Alist=NEW&field.status%3Alist=INCOMPLETE_WITH_RESPONSE&field.status%3Alist=INCOMPLETE_WITHOUT_RESPONSE&field.status%3Alist=CONFIRMED&field.status%3Alist=TRIAGED&field.status%3Alist=INPROGRESS&field.status%3Alist=FIXCOMMITTED&field.assignee=&field.bug_reporter=&field.omit_dupes=on&field.has_patch=&field.has_no_package=
+
+## pkgsrc
+
+- curl: https://github.com/NetBSD/pkgsrc/tree/trunk/www/curl
+- curl issues: https://github.com/NetBSD/pkgsrc/issues
+- curl patches: https://github.com/NetBSD/pkgsrc/tree/trunk/www/curl/patches
+
+## Red Hat Enterprise Linux / CentOS Stream
+
+- curl: https://kojihub.stream.centos.org/koji/packageinfo?packageID=217
+- curl issues: https://issues.redhat.com/secure/CreateIssueDetails!init.jspa?pid=12332745&issuetype=1&components=12377466&priority=10300
+- curl patches: https://gitlab.com/redhat/centos-stream/rpms/curl
+
+## Rocky Linux
+
+- curl: https://git.rockylinux.org/staging/rpms/curl/-/blob/r9/SPECS/curl.spec
+- curl issues: https://bugs.rockylinux.org/
+- curl patches: https://git.rockylinux.org/staging/rpms/curl/-/tree/r9/SOURCES
+
+## SerenityOS
+
+- curl: https://github.com/SerenityOS/serenity/tree/master/Ports/curl
+- curl issues: https://github.com/SerenityOS/serenity/issues?q=label%3Aports
+- curl patches: https://github.com/SerenityOS/serenity/tree/master/Ports/curl/patches
+
+## SmartOS
+
+- curl: https://github.com/TritonDataCenter/illumos-extra/tree/master/curl
+- curl issues: https://github.com/TritonDataCenter/illumos-extra/issues
+- curl patches: https://github.com/TritonDataCenter/illumos-extra/tree/master/curl/Patches
+
+## SPACK
+
+- curl package source and patches: https://github.com/spack/spack/tree/develop/var/spack/repos/builtin/packages/curl
+
+## vcpkg
+
+*Rolling Release*
+
+- curl: https://github.com/microsoft/vcpkg/tree/master/ports/curl
+- curl issues: https://github.com/microsoft/vcpkg/issues
+- curl patches: https://github.com/microsoft/vcpkg/tree/master/ports/curl (`*.patch`)
+
+## Void Linux
+
+*Rolling Release*
+
+- curl: https://github.com/void-linux/void-packages/tree/master/srcpkgs/curl
+- curl issues: https://github.com/void-linux/void-packages/issues
+- curl patches: https://github.com/void-linux/void-packages/tree/master/srcpkgs/curl/patches
+
+## Wolfi
+
+*Rolling Release*
+
+- curl: https://github.com/wolfi-dev/os/blob/main/curl.yaml
diff --git a/third-party/curl/docs/DYNBUF.md b/third-party/curl/docs/DYNBUF.md
deleted file mode 100644
index c3a4b76679..0000000000
--- a/third-party/curl/docs/DYNBUF.md
+++ /dev/null
@@ -1,128 +0,0 @@
-# dynbuf
-
-This is the internal module for creating and handling "dynamic buffers". This
-means buffers that can be appended to, dynamically and grow to adapt.
-
-There will always be a terminating zero put at the end of the dynamic buffer.
-
-The `struct dynbuf` is used to hold data for each instance of a dynamic
-buffer. The members of that struct **MUST NOT** be accessed or modified
-without using the dedicated dynbuf API.
-
-## `Curl_dyn_init`
-
-```c
-void Curl_dyn_init(struct dynbuf *s, size_t toobig);
-```
-
-This initializes a struct to use for dynbuf and it cannot fail. The `toobig`
-value **must** be set to the maximum size we allow this buffer instance to
-grow to. The functions below will return `CURLE_OUT_OF_MEMORY` when hitting
-this limit.
-
-## `Curl_dyn_free`
-
-```c
-void Curl_dyn_free(struct dynbuf *s);
-```
-
-Free the associated memory and clean up. After a free, the `dynbuf` struct can
-be reused to start appending new data to.
-
-## `Curl_dyn_addn`
-
-```c
-CURLcode Curl_dyn_addn(struct dynbuf *s, const void *mem, size_t len);
-```
-
-Append arbitrary data of a given length to the end of the buffer.
-
-If this function fails it calls `Curl_dyn_free` on `dynbuf`.
-
-## `Curl_dyn_add`
-
-```c
-CURLcode Curl_dyn_add(struct dynbuf *s, const char *str);
-```
-
-Append a C string to the end of the buffer.
-
-If this function fails it calls `Curl_dyn_free` on `dynbuf`.
-
-## `Curl_dyn_addf`
-
-```c
-CURLcode Curl_dyn_addf(struct dynbuf *s, const char *fmt, ...);
-```
-
-Append a `printf()`-style string to the end of the buffer.
-
-If this function fails it calls `Curl_dyn_free` on `dynbuf`.
-
-## `Curl_dyn_vaddf`
-
-```c
-CURLcode Curl_dyn_vaddf(struct dynbuf *s, const char *fmt, va_list ap);
-```
-
-Append a `vprintf()`-style string to the end of the buffer.
-
-If this function fails it calls `Curl_dyn_free` on `dynbuf`.
-
-## `Curl_dyn_reset`
-
-```c
-void Curl_dyn_reset(struct dynbuf *s);
-```
-
-Reset the buffer length, but leave the allocation.
-
-## `Curl_dyn_tail`
-
-```c
-CURLcode Curl_dyn_tail(struct dynbuf *s, size_t length);
-```
-
-Keep `length` bytes of the buffer tail (the last `length` bytes of the
-buffer). The rest of the buffer is dropped. The specified `length` must not be
-larger than the buffer length. To instead keep the leading part, see
-`Curl_dyn_setlen()`.
-
-## `Curl_dyn_ptr`
-
-```c
-char *Curl_dyn_ptr(const struct dynbuf *s);
-```
-
-Returns a `char *` to the buffer if it has a length, otherwise may return
-NULL. Since the buffer may be reallocated, this pointer should not be trusted
-or used anymore after the next buffer manipulation call.
-
-## `Curl_dyn_uptr`
-
-```c
-unsigned char *Curl_dyn_uptr(const struct dynbuf *s);
-```
-
-Returns an `unsigned char *` to the buffer if it has a length, otherwise may
-return NULL. Since the buffer may be reallocated, this pointer should not be
-trusted or used anymore after the next buffer manipulation call.
-
-## `Curl_dyn_len`
-
-```c
-size_t Curl_dyn_len(const struct dynbuf *s);
-```
-
-Returns the length of the buffer in bytes. Does not include the terminating
-zero byte.
-
-## `Curl_dyn_setlen`
-
-```c
-CURLcode Curl_dyn_setlen(struct dynbuf *s, size_t len);
-```
-
-Sets the new shorter length of the buffer in number of bytes. Keeps the
-leftmost set number of bytes, discards the rest. To instead keep the tail part
-of the buffer, see `Curl_dyn_tail()`.
diff --git a/third-party/curl/docs/EARLY-RELEASE.md b/third-party/curl/docs/EARLY-RELEASE.md
index 6d5a5e25b4..8ec74c3e20 100644
--- a/third-party/curl/docs/EARLY-RELEASE.md
+++ b/third-party/curl/docs/EARLY-RELEASE.md
@@ -1,3 +1,9 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # How to determine if an early patch release is warranted
 
 In the curl project we do releases every 8 weeks. Unless we break the cycle
@@ -21,14 +27,14 @@ in the git master branch.
 An early patch release means that we ship a new, complete and full release
 called `major.minor.patch` where the `patch` part is increased by one since
 the previous release. A curl release is a curl release. There is no small or
-big and we never release just a patch. There is only "release".
+big and we never ship stand-alone separate patches. There is only "release".
 
 ## Questions to ask
 
- - Is there a security advisory rated high or critical?
- - Is there a data corruption bug?
- - Did the bug cause an API/ABI breakage?
- - Will the problem annoy a significant share of the user population?
+- Is there a security advisory rated high or critical?
+- Is there a data corruption bug?
+- Did the bug cause an API/ABI breakage?
+- Does the problem annoy a significant share of the user population?
 
 If the answer is yes to one or more of the above, an early release might be
 warranted.
@@ -36,25 +42,25 @@ warranted.
 More questions to ask ourselves when doing the assessment if the answers to
 the three ones above are all 'no'.
 
- - Does the bug cause curl to prematurely terminate?
- - How common is the affected buggy option/feature/protocol/platform to get
-   used?
- - How large is the estimated impacted user base?
- - Does the bug block something crucial for applications or other adoption of
-   curl "out there" ?
- - Does the bug cause problems for curl developers or others on "the curl
-   team" ?
- - Is the bug limited to the curl tool only? That might have a smaller impact
-   than a bug also present in libcurl.
- - Is there a (decent) workaround?
- - Is it a regression? Is the bug introduced in this release?
- - Can the bug be fixed "easily" by applying a patch?
- - Does the bug break the build? Most users do not build curl themselves.
- - How long is it until the already scheduled next release?
- - Can affected users safely rather revert to a former release until the next
-   scheduled release?
- - Is it a performance regression with no functionality side-effects? If so it
-   has to be substantial.
+- Does the bug cause curl to prematurely terminate?
+- How common is the affected buggy option/feature/protocol/platform to get
+  used?
+- How large is the estimated impacted user base?
+- Does the bug block something crucial for applications or other adoption of
+  curl "out there" ?
+- Does the bug cause problems for curl developers or others on "the curl
+  team" ?
+- Is the bug limited to the curl tool only? That might have a smaller impact
+  than a bug also present in libcurl.
+- Is there a (decent) workaround?
+- Is it a regression? Is the bug introduced in this release?
+- Can the bug be fixed "easily" by applying a patch?
+- Does the bug break the build? Most users do not build curl themselves.
+- How long is it until the already scheduled next release?
+- Can affected users safely rather revert to a former release until the next
+  scheduled release?
+- Is it a performance regression with no functionality side-effects? If so it
+  has to be substantial.
 
 ## If an early release is deemed necessary
 
diff --git a/third-party/curl/docs/ECH.md b/third-party/curl/docs/ECH.md
new file mode 100644
index 0000000000..8a0153209d
--- /dev/null
+++ b/third-party/curl/docs/ECH.md
@@ -0,0 +1,492 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# Building curl with HTTPS-RR and ECH support
+
+We have added support for ECH to curl. It can use HTTPS RRs published in the
+DNS if curl uses DoH, or else can accept the relevant ECHConfigList values
+from the command line. This works with AWS-LC, BoringSSL, OpenSSL, Rustls or
+wolfSSL as the TLS provider.
+
+This feature is EXPERIMENTAL. DO NOT USE IN PRODUCTION.
+
+This should however provide enough of a proof-of-concept to prompt an informed
+discussion about a good path forward for ECH support in curl.
+
+## OpenSSL Build
+
+To build OpenSSL 4.0.0+:
+
+```sh
+cd $HOME/code
+git clone --depth 1 --branch openssl-4.0.0 https://github.com/openssl/openssl
+cd openssl
+./config --libdir=lib --prefix=$HOME/code/openssl-local-inst
+...stuff...
+make -j8
+...more stuff...
+make install_sw
+...a little bit of stuff...
+```
+
+To build curl ECH-enabled, making use of the above:
+
+```sh
+cd $HOME/code
+git clone --depth 1 https://github.com/curl/curl
+cd curl
+autoreconf -fi
+LDFLAGS="-Wl,-rpath,$HOME/code/openssl-local-inst/lib/" ./configure --with-ssl=$HOME/code/openssl-local-inst --enable-ech
+...lots of output...
+WARNING: ECH is enabled but marked EXPERIMENTAL...
+make
+...lots more output...
+```
+
+If you do not get that WARNING at the end of the `configure` command, then
+ECH is not enabled, so go back some steps and re-do whatever needs re-doing:-)
+If you want to debug curl then you should add `--enable-debug` to the
+`configure` command.
+
+In a recent (2024-05-20) build on one machine, configure failed to find the
+ECH-enabled SSL library, apparently due to the existence of
+`$HOME/code/openssl-local-inst/lib/pkgconfig` as a directory containing
+various settings. Deleting that directory worked around the problem but may
+not be the best solution.
+
+## Using ECH and DoH
+
+curl supports using DoH for A/AAAA lookups so it was relatively easy to add
+retrieval of HTTPS RRs in that situation. To use ECH and DoH together:
+
+```sh
+cd $HOME/code/curl
+LD_LIBRARY_PATH=$HOME/code/openssl ./src/curl --ech true --doh-url https://one.one.one.one/dns-query https://defo.ie/ech-check.php
+...
+SSL_ECH_STATUS: success <img src="greentick-small.png" alt="good" /> <br/>
+...
+```
+
+The output snippet above is within the HTML for the webpage, when things work.
+
+The above works for these test sites:
+
+```sh
+https://defo.ie/ech-check.php
+https://crypto.cloudflare.com/cdn-cgi/trace
+https://tls-ech.dev/
+```
+
+The list above has 4 different server technologies, implemented by 3 different
+parties, and includes a case (the port 8414 server) where HelloRetryRequest
+(HRR) is forced.
+
+We currently support the following new curl command line arguments/options:
+
+- `--ech <config>` - the `config` value can be one of:
+    - `false` says to not attempt ECH
+    - `true` says to attempt ECH, if possible
+    - `grease` if attempting ECH is not possible, then send a GREASE ECH extension
+    - `hard` hard-fail the connection if ECH cannot be attempted
+    - `ecl:<b64value>` a base64 encoded ECHConfigList, rather than one accessed from the DNS
+    - `pn:<name>` override the `public_name` from an ECHConfigList
+
+Note that in the above "attempt ECH" means the client emitting a TLS
+ClientHello with a "real" ECH extension, but that does not mean that the
+relevant server can succeed in decrypting, as things can fail for other
+reasons.
+
+## Supplying an ECHConfigList on the command line
+
+To supply the ECHConfigList on the command line, you might need a bit of
+cut-and-paste, e.g.:
+
+```sh
+dig +short https defo.ie
+1 . ipv4hint=213.108.108.101 ech=AED+DQA8PAAgACD8WhlS7VwEt5bf3lekhHvXrQBGDrZh03n/LsNtAodbUAAEAAEAAQANY292ZXIuZGVmby5pZQAA
+  ipv6hint=2a00:c6c0:0:116:5::10
+```
+
+Then paste the base64 encoded ECHConfigList onto the curl command line:
+
+```sh
+LD_LIBRARY_PATH=$HOME/code/openssl ./src/curl --ech ecl:AED+DQA8PAAgACD8WhlS7VwEt5bf3lekhHvXrQBGDrZh03n/LsNtAodbUAAEAAEAAQANY292ZXIuZGVmby5pZQAA \
+  https://defo.ie/ech-check.php
+...
+SSL_ECH_STATUS: success <img src="greentick-small.png" alt="good" /> <br/>
+...
+```
+
+The output snippet above is within the HTML for the webpage.
+
+If you paste in the wrong ECHConfigList (it changes hourly for `defo.ie`) you
+should get an error like this:
+
+```sh
+LD_LIBRARY_PATH=$HOME/code/openssl ./src/curl -vvv --ech ecl:AED+DQA8yAAgACDRMQo+qYNsNRNj+vfuQfFIkrrUFmM4vogucxKj/4nzYgAEAAEAAQANY292ZXIuZGVmby5pZQAA \
+  https://defo.ie/ech-check.php
+...
+* OpenSSL/3.3.0: error:0A00054B:SSL routines::ech required
+...
+```
+
+There is a reason to want this command line option - for use before publishing
+an ECHConfigList in the DNS as per the Internet-draft [A well-known URI for
+publishing ECHConfigList values](https://datatracker.ietf.org/doc/html/draft-ietf-tls-wkech/).
+
+If you do use a wrong ECHConfigList value, then the server might return a
+good value, via the `retry_configs` mechanism. You can see that value in
+the verbose output, e.g.:
+
+```sh
+LD_LIBRARY_PATH=$HOME/code/openssl ./src/curl -vvv --ech ecl:AED+DQA8yAAgACDRMQo+qYNsNRNj+vfuQfFIkrrUFmM4vogucxKj/4nzYgAEAAEAAQANY292ZXIuZGVmby5pZQAA \
+  https://defo.ie/ech-check.php
+...
+* ECH: retry_configs AQD+DQA8DAAgACBvYqJy+Hgk33wh/ZLBzKSPgwxeop7gvojQzfASq7zeZQAEAAEAAQANY292ZXIuZGVmby5pZQAA/g0APEMAIAAgXkT5r4cYs8z19q5rdittyIX
+  8gfQ3ENW4wj1fVoiJZBoABAABAAEADWNvdmVyLmRlZm8uaWUAAP4NADw2ACAAINXSE9EdXzEQIJZA7vpwCIQsWqsFohZARXChgPsnfI1kAAQAAQABAA1jb3Zlci5kZWZvLmllAAD+DQA8c
+  QAgACASeiD5F+UoSnVoHvA2l1EifUVMFtbVZ76xwDqmMPraHQAEAAEAAQANY292ZXIuZGVmby5pZQAA
+* ECH: retry_configs for defo.ie from cover.defo.ie, 319
+...
+```
+
+At that point, you could copy the base64 encoded value above and try again.
+For now, this only works for the OpenSSL and AWS-LC/BoringSSL builds.
+
+## Default settings
+
+curl has various ways to configure default settings, e.g. in `$HOME/.curlrc`,
+so one can set the DoH URL and enable ECH that way:
+
+```sh
+cat ~/.curlrc
+doh-url=https://one.one.one.one/dns-query
+silent
+ech=true
+```
+
+Note that when you use the system's curl command (rather than our ECH-enabled
+build), it is liable to warn that `ech` is an unknown option. If that is an
+issue (e.g. if some script re-directs stdout and stderr somewhere) then adding
+the `silent` line above seems to be a good enough fix. (Though of
+course, yet another script could depend on non-silent behavior, so you may have
+to figure out what you prefer yourself.) That seems to have changed with the
+latest build, previously `silent=TRUE` was what I used in `~/.curlrc` but
+now that seems to cause a problem, so that the following line(s) are ignored.
+
+If you want to always use our OpenSSL build you can set `LD_LIBRARY_PATH`
+in the environment:
+
+```sh
+export LD_LIBRARY_PATH=$HOME/code/openssl
+```
+
+When you do the above, there can be a mismatch between OpenSSL versions
+for applications that check that. A `git push` for example fails so you
+should unset `LD_LIBRARY_PATH` before doing that or use a different shell.
+
+```sh
+git push
+OpenSSL version mismatch. Built against 30000080, you have 30200000
+...
+```
+
+With all that setup as above the command line gets simpler:
+
+```sh
+./src/curl https://defo.ie/ech-check.php
+...
+SSL_ECH_STATUS: success <img src="greentick-small.png" alt="good" /> <br/>
+...
+```
+
+The `--ech true` option is opportunistic, so tries to do ECH but does not fail if
+the client for example cannot find any ECHConfig values. The `--ech hard`
+option hard-fails if there is no ECHConfig found in DNS, so for now, that is not
+a good option to set as a default. Once ECH has really been attempted by
+the client, if decryption on the server side fails, then curl fails.
+
+## Code changes for ECH support when using DoH
+
+Code changes are `#ifdef` protected via `USE_ECH` or `USE_HTTPSRR`:
+
+- `USE_HTTPSRR` is used for HTTPS RR retrieval code that could be generically
+  used should non-ECH uses for HTTPS RRs be identified, e.g. use of ALPN values
+  or IP address hints.
+
+- `USE_ECH` protects ECH specific code.
+
+There are various obvious code blocks for handling the new command line
+arguments which are not described here, but should be fairly clear.
+
+As shown in the `configure` usage above, there are `configure.ac` changes
+that allow separately dis/enabling `USE_HTTPSRR` and `USE_ECH`. If `USE_ECH`
+is enabled, then `USE_HTTPSRR` is forced. In both cases `CURL_DISABLE_DOH`
+must not be enabled. (There may be some configuration conflicts available for the
+determined :-)
+
+The main functional change, as you would expect, is in `lib/vtls/openssl.c`
+where an ECHConfig, if available from command line or DNS cache, is fed into
+the OpenSSL library via the new APIs implemented in our OpenSSL fork for that
+purpose. This code also implements the opportunistic (`--ech true`) or hard-fail
+(`--ech hard`) logic.
+
+Other than that, the main additions are in `lib/doh.c`
+where we reuse `dohprobe()` to retrieve an HTTPS RR value for the target
+domain. If such a value is found, that is stored using a new `doh_store_https()`
+function in a new field in the `dohentry` structure.
+
+The qname for the DoH query is modified if the port number is not 443, as
+defined in the SVCB specification.
+
+When the DoH process has worked, `Curl_doh_take_result()` now also returns
+the relevant HTTPS RR value data in the `Curl_dns_entry` structure.
+That is later accessed when the TLS session is being established, if ECH is
+enabled (from `lib/vtls/openssl.c` as described above).
+
+## Limitations
+
+Things that need fixing, but that can probably be ignored for the
+moment:
+
+- We could easily add code to make use of an `alpn=` value found in an HTTPS
+  RR, passing that on to OpenSSL for use as the "inner" ALPN value, but have
+  yet to do that.
+
+Current limitations (more interesting than the above):
+
+- Only the first HTTPS RR value retrieved is actually processed as described
+  above, that could be extended in future, though picking the "right" HTTPS RR
+  could be non-trivial if multiple RRs are published - matching IP address
+  hints versus A/AAAA values might be a good basis for that. Last I checked
+  though, browsers supporting ECH did not handle multiple HTTPS RRs well, though
+  that needs re-checking as it has been a while.
+
+- It is unclear how one should handle any IP address hints found in an HTTPS RR.
+  It may be that a bit of consideration of how "multi-CDN" deployments might
+  emerge would provide good answers there, but for now, it is not clear how best
+  curl might handle those values when present in the DNS.
+
+- The SVCB/HTTPS RR specification supports a new "CNAME at apex" indirection
+  ("aliasMode") - the current code takes no account of that at all. One could
+  envisage implementing the equivalent of following CNAMEs in such cases, but
+  it is not clear if that'd be a good plan. (As of now, chrome browsers do not
+  seem to have any support for that "aliasMode" and we have not checked Firefox
+  for that recently.)
+
+- We have not investigated what related changes or additions might be needed
+  for applications using libcurl, as opposed to use of curl as a command line
+  tool.
+
+- We have not yet implemented tests as part of the usual curl test harness as
+  doing so would seem to require re-implementing an ECH-enabled server as part
+  of the curl test harness. For now, we have a `./tests/ech_test.sh` script
+  that attempts ECH with various test servers and with many combinations of the
+  allowed command line options. While that is a useful test and has find
+  issues, it is not comprehensive and we are not (as yet) sure what would be
+  the right level of coverage. When running that script you should not have a
+  `$HOME/.curlrc` file that affects ECH or some of the negative tests could
+  produce spurious failures.
+
+## Building with cmake
+
+To build with cmake, assuming our ECH-enabled OpenSSL is as before:
+
+```sh
+cd $HOME/code
+git clone --depth 1 https://github.com/curl/curl
+cd curl
+mkdir build
+cd build
+cmake -DOPENSSL_ROOT_DIR=$HOME/code/openssl -DUSE_ECH=1 ..
+...
+make
+...
+[100%] Built target curl
+```
+
+The binary produced by the cmake build does not need any ECH-specific
+`LD_LIBRARY_PATH` setting.
+
+## BoringSSL build
+
+BoringSSL is also supported by curl and also supports ECH, so to build
+with that, instead of our ECH-enabled OpenSSL:
+
+```sh
+cd $HOME/code
+git clone --depth 1 https://boringssl.googlesource.com/boringssl
+cd boringssl
+cmake -DCMAKE_INSTALL_PREFIX:PATH=$HOME/code/boringssl/inst -DBUILD_SHARED_LIBS=1
+make
+...
+make install
+```
+
+Then:
+
+```sh
+cd $HOME/code
+git clone --depth 1 https://github.com/curl/curl
+cd curl
+autoreconf -fi
+LDFLAGS="-Wl,-rpath,$HOME/code/boringssl/inst/lib" ./configure --with-ssl=$HOME/code/boringssl/inst --enable-ech
+...lots of output...
+WARNING: ECH HTTPSRR enabled but marked EXPERIMENTAL. Use with caution.
+make
+```
+
+The AWS-LC/BoringSSL APIs are fairly similar to those in our ECH-enabled
+OpenSSL fork, so code changes are also in `lib/vtls/openssl.c`, protected
+via `#ifdef OPENSSL_IS_BORINGSSL` and are mostly obvious API variations.
+
+The AWS-LC/BoringSSL APIs however do not support the `--ech pn:` command
+line variant as of now.
+
+## wolfSSL build
+
+wolfSSL also supports ECH and can be used by curl, so here's how:
+
+```sh
+cd $HOME/code
+git clone --depth 1 https://github.com/wolfSSL/wolfssl
+cd wolfssl
+./autogen.sh
+./configure --prefix=$HOME/code/wolfssl/inst --enable-ech --enable-debug --enable-opensslextra
+make
+make install
+```
+
+The install prefix (`inst`) in the above causes wolfSSL to be installed there
+and we seem to need that for the curl configure command to work out. The
+`--enable-opensslextra` turns out (after much faffing about;-) to be
+important or else we get build problems with curl below.
+
+```sh
+cd $HOME/code
+git clone --depth 1 https://github.com/curl/curl
+cd curl
+autoreconf -fi
+./configure --with-wolfssl=$HOME/code/wolfssl/inst --enable-ech
+make
+```
+
+There are some known issues with the ECH implementation in wolfSSL:
+
+- The main issue is that the client currently handles HelloRetryRequest
+  incorrectly. [HRR issue](https://github.com/wolfSSL/wolfssl/issues/6802).)
+  The HRR issue means that the client does not work for
+  [this ECH test web site](https://tls-ech.dev/) and any other similarly
+  configured sites.
+- There is also an issue related to so-called middlebox compatibility mode.
+  [middlebox compatibility issue](https://github.com/wolfSSL/wolfssl/issues/6774)
+
+### Code changes to support wolfSSL
+
+There are what seem like oddball differences:
+
+- The DoH URL in`$HOME/.curlrc` can use `1.1.1.1` for OpenSSL but has to be
+  `one.one.one.one` for wolfSSL. The latter works for both, so OK, we us that.
+- There seems to be some difference in CA databases too - the wolfSSL version
+  does not like `defo.ie`, whereas the system and OpenSSL ones do. We can
+  ignore that for our purposes via `--insecure`/`-k` but would need to fix
+  for a real setup. (Browsers do like those certificates though.)
+
+Then there are some functional code changes:
+
+- tweak to `configure.ac` to check if wolfSSL has ECH or not
+- added code to `lib/vtls/wolfssl.c` mirroring what's done in the
+  OpenSSL equivalent above.
+- wolfSSL does not support `--ech false` or the `--ech pn:` command line
+  argument.
+
+The lack of support for `--ech false` is because wolfSSL has decided to
+always at least GREASE if built to support ECH. In other words, GREASE is
+a compile time choice for wolfSSL, but a runtime choice for OpenSSL or
+AWS-LC/BoringSSL. (Both are reasonable.)
+
+## Additional notes
+
+### Supporting ECH without DoH
+
+All of the above only applies if DoH is being used. There should be a use-case
+for ECH when DoH is not used by curl - if a system stub resolver supports DoT
+or DoH, then, considering only ECH and the network threat model, it would make
+sense for curl to support ECH without curl itself using DoH. The author for
+example uses a combination of stubby+unbound as the system resolver listening
+on localhost:53, so would fit this use-case. That said, it is unclear if this
+is a niche that is worth trying to address. (The author is happy to let curl
+use DoH to talk to the same public recursive that stubby might use:-)
+
+Assuming for the moment this is a use-case we would like to support, then if
+DoH is not being used by curl, it is not clear at this time how to provide
+support for ECH. One option would seem to be to extend the `c-ares` library
+to support HTTPS RRs, but in that case it is not now clear whether such
+changes would be attractive to the `c-ares` maintainers, nor whether the
+"tag=value" extensibility inherent in the HTTPS/SVCB specification is a good
+match for the `c-ares` approach of defining structures specific to decoded
+answers for each supported RRtype. We are also not sure how many downstream
+curl deployments actually make use of the `c-ares` library, which would
+affect the utility of such changes. Another option might be to consider using
+some other generic DNS library that does support HTTPS RRs, but it is unclear
+if such a library could or would be used by all or almost all curl builds and
+downstream releases of curl.
+
+Our current conclusion is that doing the above is likely best left until we
+have some experience with the "using DoH" approach, so we are going to punt on
+this for now.
+
+### Localhost testing
+
+It can be useful to be able to run against a localhost OpenSSL `s_server`
+for testing. We have published instructions for such
+[localhost tests](https://github.com/defo-project/ech-dev-utils/blob/main/howtos/localhost-tests.md)
+in another repository. Once you have that set up, you can start a server
+and then run curl against that:
+
+```sh
+cd $HOME/code/ech-dev-utils
+./scripts/echsvr.sh -d
+...
+```
+
+The `echsvr.sh` script supports many ECH-related options. Use `echsvr.sh -h`
+for details.
+
+In another window:
+
+```sh
+cd $HOME/code/curl/
+./src/curl -vvv --insecure --connect-to foo.example.com:8443:localhost:8443 \
+  --ech ecl:AD7+DQA6uwAgACBix2B78sX+EQhEbxMspDOc8Z3xVS5aQpYP0Cxpc2AWPAAEAAEAAQALZXhhbXBsZS5jb20AAA==
+```
+
+### Automated use of `retry_configs` not supported so far...
+
+As of now we have not added support for using `retry_config` handling in the
+application - for a command line tool, one can use `dig` (or `kdig`) to
+get the HTTPS RR and pass the ECHConfigList from that on the command line, if
+needed, or one can access the value from command line output in verbose more
+and then reuse that in another invocation.
+
+Both our OpenSSL fork and AWS-LC/BoringSSL have APIs for both controlling GREASE
+and accessing and logging `retry_configs`, it seems wolfSSL has neither.
+
+### Testing ECH
+
+We have yet to add a robust test setup for ECH as that requires an ECH-enabled
+test server.
+
+We have added two basic tests though, aiming to ensure that the client sends a
+GREASE or real ECH extension when requested, and reacts correctly to the
+failure of ECH in the latter case. (Given that `stunnel` has no ECH support.)
+
+As with other similar tests, those tests require the `stunnel` tool be
+installed. On Ubuntu `sudo apt install stunnel4` achieves that.
+
+The test cases are:
+
+- data/test4000: GREASE ECH, expected result: connection succeeds
+- data/test4001: real ECH, connection fails with error 101 (ECH required)
diff --git a/third-party/curl/docs/EXPERIMENTAL.md b/third-party/curl/docs/EXPERIMENTAL.md
index 6b7145df68..9e39a9b36c 100644
--- a/third-party/curl/docs/EXPERIMENTAL.md
+++ b/third-party/curl/docs/EXPERIMENTAL.md
@@ -1,3 +1,9 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # Experimental
 
 Some features and functionality in curl and libcurl are considered
@@ -8,17 +14,94 @@ Experimental support in curl means:
 1. Experimental features are provided to allow users to try them out and
    provide feedback on functionality and API etc before they ship and get
    "carved in stone".
-2. You must enable the feature when invoking configure as otherwise curl will
-   not be built with the feature present.
+2. You must enable the feature when invoking configure as otherwise curl is
+   not built with the feature present.
 3. We strongly advise against using this feature in production.
 4. **We reserve the right to change behavior** of the feature without sticking
    to our API/ABI rules as we do for regular features, as long as it is marked
    experimental.
 5. Experimental features are clearly marked so in documentation. Beware.
 
+## Graduation
+
+1. Each experimental feature should have a set of documented requirements of
+   what is needed for that feature to graduate. Graduation means being removed
+   from the list of experiments.
+2. An experiment should NOT graduate if it needs test cases to be disabled,
+   unless they are for minor features that are clearly documented as not
+   provided by the experiment and then the disabling should be managed inside
+   each affected test case.
+
 ## Experimental features right now
 
- - The Hyper HTTP backend
- - HTTP/3 support and options
- - The rustls backend
- - WebSocket
+###  HTTP/3 support (non-ngtcp2 backends)
+
+Graduation requirements:
+
+- The used libraries should be considered out-of-beta with a reasonable
+  expectation of a stable API going forward.
+
+- Using HTTP/3 with the given build should perform without risking busy-loops
+
+### HTTP/3 proxy and CONNECT-UDP support
+
+Support for HTTP/3 proxy and CONNECT-UDP tunneling is experimental and
+requires an explicit build-time opt-in (`--enable-proxy-http3` for
+autotools, `-DUSE_PROXY_HTTP3=ON` for CMake).
+
+Graduation requirements:
+
+- implementation stability over time with no known severe regressions
+
+### The Quiche backend
+
+Graduation requirements:
+
+- the library needs to consider itself non-beta.
+- a reasonable expectation of a stable API going forward.
+
+### The Rustls backend
+
+Graduation requirements:
+
+- a reasonable expectation of a stable API going forward.
+
+## ECH
+
+Use of the HTTPS resource record and Encrypted Client Hello (ECH) when using
+DoH
+
+Graduation requirements:
+
+- ECH support exists in at least one widely used TLS library apart from
+  BoringSSL and wolfSSL.
+
+- feedback from users saying that ECH works for their use cases
+
+- it has been given time to mature, so no earlier than April 2025 (twelve
+  months after being added here)
+
+## SSL session import/export
+
+Import/Export of SSL sessions tickets in libcurl and curl command line
+option '--ssl-session <filename>' for faster TLS handshakes and use
+of TLSv1.3/QUIC Early Data (0-RTT).
+
+Graduation requirements:
+
+- the implementation is considered safe
+
+- feedback from users saying that session export works for their use cases
+
+## HTTPS RR
+
+HTTPS records support is a requirement for ECH but is provided as a
+stand-alone feature that is itself considered EXPERIMENTAL.
+
+Graduation requirements:
+
+- HTTPS records work for DoH, c-ares and the threaded resolver
+
+- HTTPS records can control ALPN and port number, at least
+
+- There are options to control HTTPS use
diff --git a/third-party/curl/docs/FAQ b/third-party/curl/docs/FAQ
deleted file mode 100644
index 78a238832a..0000000000
--- a/third-party/curl/docs/FAQ
+++ /dev/null
@@ -1,1544 +0,0 @@
-                                  _   _ ____  _
-                              ___| | | |  _ \| |
-                             / __| | | | |_) | |
-                            | (__| |_| |  _ <| |___
-                             \___|\___/|_| \_\_____|
-
-FAQ
-
- 1. Philosophy
-  1.1 What is cURL?
-  1.2 What is libcurl?
-  1.3 What is curl not?
-  1.4 When will you make curl do XXXX ?
-  1.5 Who makes curl?
-  1.6 What do you get for making curl?
-  1.7 What about CURL from curl.com?
-  1.8 I have a problem, who do I mail?
-  1.9 Where do I buy commercial support for curl?
-  1.10 How many are using curl?
-  1.11 Why do you not update ca-bundle.crt
-  1.12 I have a problem, who can I chat with?
-  1.13 curl's ECCN number?
-  1.14 How do I submit my patch?
-  1.15 How do I port libcurl to my OS?
-
- 2. Install Related Problems
-  2.1 configure fails when using static libraries
-  2.2 Does curl work/build with other SSL libraries?
-  2.4 Does curl support SOCKS (RFC 1928) ?
-
- 3. Usage Problems
-  3.1 curl: (1) SSL is disabled, https: not supported
-  3.2 How do I tell curl to resume a transfer?
-  3.3 Why does my posting using -F not work?
-  3.4 How do I tell curl to run custom FTP commands?
-  3.5 How can I disable the Accept: */* header?
-  3.6 Does curl support ASP, XML, XHTML or HTML version Y?
-  3.7 Can I use curl to delete/rename a file through FTP?
-  3.8 How do I tell curl to follow HTTP redirects?
-  3.9 How do I use curl in my favorite programming language?
-  3.10 What about SOAP, WebDAV, XML-RPC or similar protocols over HTTP?
-  3.11 How do I POST with a different Content-Type?
-  3.12 Why do FTP-specific features over HTTP proxy fail?
-  3.13 Why do my single/double quotes fail?
-  3.14 Does curl support JavaScript or PAC (automated proxy config)?
-  3.15 Can I do recursive fetches with curl?
-  3.16 What certificates do I need when I use SSL?
-  3.17 How do I list the root directory of an FTP server?
-  3.18 Can I use curl to send a POST/PUT and not wait for a response?
-  3.19 How do I get HTTP from a host using a specific IP address?
-  3.20 How to SFTP from my user's home directory?
-  3.21 Protocol xxx not supported or disabled in libcurl
-  3.22 curl -X gives me HTTP problems
-
- 4. Running Problems
-  4.2 Why do I get problems when I use & or % in the URL?
-  4.3 How can I use {, }, [ or ] to specify multiple URLs?
-  4.4 Why do I get downloaded data even though the web page does not exist?
-  4.5 Why do I get return code XXX from an HTTP server?
-   4.5.1 "400 Bad Request"
-   4.5.2 "401 Unauthorized"
-   4.5.3 "403 Forbidden"
-   4.5.4 "404 Not Found"
-   4.5.5 "405 Method Not Allowed"
-   4.5.6 "301 Moved Permanently"
-  4.6 Can you tell me what error code 142 means?
-  4.7 How do I keep user names and passwords secret in curl command lines?
-  4.8 I found a bug
-  4.9 curl cannot authenticate to a server that requires NTLM?
-  4.10 My HTTP request using HEAD, PUT or DELETE does not work
-  4.11 Why do my HTTP range requests return the full document?
-  4.12 Why do I get "certificate verify failed" ?
-  4.13 Why is curl -R on Windows one hour off?
-  4.14 Redirects work in browser but not with curl
-  4.15 FTPS does not work
-  4.16 My HTTP POST or PUT requests are slow
-  4.17 Non-functional connect timeouts on Windows
-  4.18 file:// URLs containing drive letters (Windows, NetWare)
-  4.19 Why does not curl return an error when the network cable is unplugged?
-  4.20 curl does not return error for HTTP non-200 responses
-
- 5. libcurl Issues
-  5.1 Is libcurl thread-safe?
-  5.2 How can I receive all data into a large memory chunk?
-  5.3 How do I fetch multiple files with libcurl?
-  5.4 Does libcurl do Winsock initialization on win32 systems?
-  5.5 Does CURLOPT_WRITEDATA and CURLOPT_READDATA work on win32 ?
-  5.6 What about Keep-Alive or persistent connections?
-  5.7 Link errors when building libcurl on Windows
-  5.8 libcurl.so.X: open failed: No such file or directory
-  5.9 How does libcurl resolve host names?
-  5.10 How do I prevent libcurl from writing the response to stdout?
-  5.11 How do I make libcurl not receive the whole HTTP response?
-  5.12 Can I make libcurl fake or hide my real IP address?
-  5.13 How do I stop an ongoing transfer?
-  5.14 Using C++ non-static functions for callbacks?
-  5.15 How do I get an FTP directory listing?
-  5.16 I want a different time-out
-  5.17 Can I write a server with libcurl?
-  5.18 Does libcurl use threads?
-
- 6. License Issues
-  6.1 I have a GPL program, can I use the libcurl library?
-  6.2 I have a closed-source program, can I use the libcurl library?
-  6.3 I have a BSD licensed program, can I use the libcurl library?
-  6.4 I have a program that uses LGPL libraries, can I use libcurl?
-  6.5 Can I modify curl/libcurl for my program and keep the changes secret?
-  6.6 Can you please change the curl/libcurl license to XXXX?
-  6.7 What are my obligations when using libcurl in my commercial apps?
-
- 7. PHP/CURL Issues
-  7.1 What is PHP/CURL?
-  7.2 Who wrote PHP/CURL?
-  7.3 Can I perform multiple requests using the same handle?
-  7.4 Does PHP/CURL have dependencies?
-
- 8. Development
-  8.1 Why does curl use C89?
-  8.2 Will curl be rewritten?
-
-==============================================================================
-
-1. Philosophy
-
-  1.1 What is cURL?
-
-  cURL is the name of the project. The name is a play on 'Client for URLs',
-  originally with URL spelled in uppercase to make it obvious it deals with
-  URLs. The fact it can also be read as 'see URL' also helped, it works as
-  an abbreviation for "Client URL Request Library" or why not the recursive
-  version: "curl URL Request Library".
-
-  The cURL project produces two products:
-
-  libcurl
-
-    A client-side URL transfer library, supporting DICT, FILE, FTP, FTPS,
-    GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S,
-    RTMP, RTMPS, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS
-    and WSS.
-
-    libcurl supports HTTPS certificates, HTTP POST, HTTP PUT, FTP uploading,
-    Kerberos, SPNEGO, HTTP form based upload, proxies, cookies, user+password
-    authentication, file transfer resume, http proxy tunneling and more.
-
-    libcurl is highly portable, it builds and works identically on numerous
-    platforms, including Solaris, NetBSD, FreeBSD, OpenBSD, Darwin, HP-UX,
-    IRIX, AIX, Tru64, Linux, UnixWare, HURD, Windows, Amiga, OS/2, macOS,
-    Ultrix, QNX, OpenVMS, RISC OS, Novell NetWare, DOS, Symbian, OSF, Android,
-    Minix, IBM TPF and more...
-
-    libcurl is free, thread-safe, IPv6 compatible, feature rich, well
-    supported and fast.
-
-  curl
-
-    A command line tool for getting or sending data using URL syntax.
-
-    Since curl uses libcurl, curl supports the same wide range of common
-    Internet protocols that libcurl does.
-
-  We pronounce curl with an initial k sound. It rhymes with words like girl
-  and earl. This is a short WAV file to help you:
-
-     https://media.merriam-webster.com/soundc11/c/curl0001.wav
-
-  There are numerous sub-projects and related projects that also use the word
-  curl in the project names in various combinations, but you should take
-  notice that this FAQ is directed at the command-line tool named curl (and
-  libcurl the library), and may therefore not be valid for other curl-related
-  projects. (There is however a small section for the PHP/CURL in this FAQ.)
-
-  1.2 What is libcurl?
-
-  libcurl is a reliable and portable library for doing Internet data transfers
-  using one or more of its supported Internet protocols.
-
-  You can use libcurl freely in your application, be it open source,
-  commercial or closed-source.
-
-  libcurl is most probably the most portable, most powerful and most often
-  used C-based multi-platform file transfer library on this planet - be it
-  open source or commercial.
-
-  1.3 What is curl not?
-
-  curl is not a wget clone. That is a common misconception. Never, during
-  curl's development, have we intended curl to replace wget or compete on its
-  market. curl is targeted at single-shot file transfers.
-
-  curl is not a website mirroring program. If you want to use curl to mirror
-  something: fine, go ahead and write a script that wraps around curl or use
-  libcurl to make it reality.
-
-  curl is not an FTP site mirroring program. Sure, get and send FTP with curl
-  but if you want systematic and sequential behavior you should write a
-  script (or write a new program that interfaces libcurl) and do it.
-
-  curl is not a PHP tool, even though it works perfectly well when used from
-  or with PHP (when using the PHP/CURL module).
-
-  curl is not a program for a single operating system. curl exists, compiles,
-  builds and runs under a wide range of operating systems, including all
-  modern Unixes (and a bunch of older ones too), Windows, Amiga, OS/2, macOS,
-  QNX etc.
-
-  1.4 When will you make curl do XXXX ?
-
-  We love suggestions of what to change in order to make curl and libcurl
-  better. We do however believe in a few rules when it comes to the future of
-  curl:
-
-  curl -- the command line tool -- is to remain a non-graphical command line
-  tool. If you want GUIs or fancy scripting capabilities, you should look for
-  another tool that uses libcurl.
-
-  We do not add things to curl that other small and available tools already do
-  well at the side. curl's output can be piped into another program or
-  redirected to another file for the next program to interpret.
-
-  We focus on protocol related issues and improvements. If you want to do more
-  magic with the supported protocols than curl currently does, chances are
-  good we will agree. If you want to add more protocols, we may agree.
-
-  If you want someone else to do all the work while you wait for us to
-  implement it for you, that is not a friendly attitude. We spend a
-  considerable time already on maintaining and developing curl. In order to
-  get more out of us, you should consider trading in some of your time and
-  effort in return. Simply go to the GitHub repository which resides at
-  https://github.com/curl/curl, fork the project, and create pull requests
-  with your proposed changes.
-
-  If you write the code, chances are better that it will get into curl faster.
-
-  1.5 Who makes curl?
-
-  curl and libcurl are not made by any single individual. Daniel Stenberg is
-  project leader and main developer, but other persons' submissions are
-  important and crucial. Anyone can contribute and post their changes and
-  improvements and have them inserted in the main sources (of course on the
-  condition that developers agree that the fixes are good).
-
-  The full list of all contributors is found in the docs/THANKS file.
-
-  curl is developed by a community, with Daniel at the wheel.
-
-  1.6 What do you get for making curl?
-
-  Project cURL is entirely free and open. We do this voluntarily, mostly in
-  our spare time. Companies may pay individual developers to work on curl.
-  This is not controlled by nor supervised in any way by the curl project.
-
-  We get help from companies. Haxx provides website, bandwidth, mailing lists
-  etc, GitHub hosts the primary git repository and other services like the bug
-  tracker at https://github.com/curl/curl. Also again, some companies have
-  sponsored certain parts of the development in the past and I hope some will
-  continue to do so in the future.
-
-  If you want to support our project, consider a donation or a banner-program
-  or even better: by helping us with coding, documenting or testing etc.
-
-  See also: https://curl.se/sponsors.html
-
-  1.7 What about CURL from curl.com?
-
-  During the summer of 2001, curl.com was busy advertising their client-side
-  programming language for the web, named CURL.
-
-  We are in no way associated with curl.com or their CURL programming
-  language.
-
-  Our project name curl has been in effective use since 1998. We were not the
-  first computer related project to use the name "curl" and do not claim any
-  rights to the name.
-
-  We recognize that we will be living in parallel with curl.com and wish them
-  every success.
-
-  1.8 I have a problem, who do I mail?
-
-  Please do not mail any single individual unless you really need to. Keep
-  curl-related questions on a suitable mailing list. All available mailing
-  lists are listed in the MANUAL document and online at
-  https://curl.se/mail/
-
-  Keeping curl-related questions and discussions on mailing lists allows
-  others to join in and help, to share their ideas, to contribute their
-  suggestions and to spread their wisdom. Keeping discussions on public mailing
-  lists also allows for others to learn from this (both current and future
-  users thanks to the web based archives of the mailing lists), thus saving us
-  from having to repeat ourselves even more. Thanks for respecting this.
-
-  If you have found or simply suspect a security problem in curl or libcurl,
-  submit all the details at https://hackerone.one/curl. On there we keep the
-  issue private while we investigate, confirm it, work and validate a fix and
-  agree on a time schedule for publication etc. That way we produce a fix in a
-  timely manner before the flaw is announced to the world, reducing the impact
-  the problem risks having on existing users.
-
-  Security issues can also be taking to the curl security team by emailing
-  security at curl.se (closed list of receivers, mails are not disclosed).
-
-  1.9 Where do I buy commercial support for curl?
-
-  curl is fully open source. It means you can hire any skilled engineer to fix
-  your curl-related problems.
-
-  We list available alternatives on the curl website:
-  https://curl.se/support.html
-
-  1.10 How many are using curl?
-
-  It is impossible to tell.
-
-  We do not know how many users that knowingly have installed and use curl.
-
-  We do not know how many users that use curl without knowing that they are in
-  fact using it.
-
-  We do not know how many users that downloaded or installed curl and then
-  never use it.
-
-  In 2020, we estimate that curl runs in roughly ten billion installations
-  world wide.
-
-  1.11 Why do you not update ca-bundle.crt
-
-  In the cURL project we have decided not to attempt to keep this file updated
-  (or even present) since deciding what to add to a ca cert bundle is an
-  undertaking we have not been ready to accept, and the one we can get from
-  Mozilla is perfectly fine so there is no need to duplicate that work.
-
-  Today, with many services performed over HTTPS, every operating system
-  should come with a default ca cert bundle that can be deemed somewhat
-  trustworthy and that collection (if reasonably updated) should be deemed to
-  be a lot better than a private curl version.
-
-  If you want the most recent collection of ca certs that Mozilla Firefox
-  uses, we recommend that you extract the collection yourself from Mozilla
-  Firefox (by running 'make ca-bundle), or by using our online service setup
-  for this purpose: https://curl.se/docs/caextract.html
-
-  1.12 I have a problem who, can I chat with?
-
-  There is a bunch of friendly people hanging out in the #curl channel on the
-  IRC network libera.chat. If you are polite and nice, chances are good that
-  you can get -- or provide -- help instantly.
-
-  1.13 curl's ECCN number?
-
-  The US government restricts exports of software that contains or uses
-  cryptography. When doing so, the Export Control Classification Number (ECCN)
-  is used to identify the level of export control etc.
-
-  Apache Software Foundation gives a good explanation of ECCNs at
-  https://www.apache.org/dev/crypto.html
-
-  We believe curl's number might be ECCN 5D002, another possibility is
-  5D992. It seems necessary to write them (the authority that administers ECCN
-  numbers), asking to confirm.
-
-  Comprehensible explanations of the meaning of such numbers and how to obtain
-  them (resp.) are here
-
-  https://www.bis.doc.gov/licensing/exportingbasics.htm
-  https://www.bis.doc.gov/licensing/do_i_needaneccn.html
-
-  An incomprehensible description of the two numbers above is here
-  https://www.bis.doc.gov/index.php/documents/new-encryption/1653-ccl5-pt2-3
-
-  1.14 How do I submit my patch?
-
-  We strongly encourage you to submit changes and improvements directly as
-  "pull requests" on GitHub: https://github.com/curl/curl/pulls
-
-  If you for any reason cannot or will not deal with GitHub, send your patch to
-  the curl-library mailing list. We are many subscribers there and there are
-  lots of people who can review patches, comment on them and "receive" them
-  properly.
-
-  Lots of more details are found in the CONTRIBUTE.md and INTERNALS.md
-  documents.
-
-  1.15 How do I port libcurl to my OS?
-
-  Here's a rough step-by-step:
-
-  1. copy a suitable lib/config-*.h file as a start to lib/config-[youros].h
-
-  2. edit lib/config-[youros].h to match your OS and setup
-
-  3. edit lib/curl_setup.h to include config-[youros].h when your OS is
-     detected by the preprocessor, in the style others already exist
-
-  4. compile lib/*.c and make them into a library
-
-
-2. Install Related Problems
-
-  2.1 configure fails when using static libraries
-
-  You may find that configure fails to properly detect the entire dependency
-  chain of libraries when you provide static versions of the libraries that
-  configure checks for.
-
-  The reason why static libraries is much harder to deal with is that for them
-  we do not get any help but the script itself must know or check what more
-  libraries that are needed (with shared libraries, that dependency "chain" is
-  handled automatically). This is a error-prone process and one that also
-  tends to vary over time depending on the release versions of the involved
-  components and may also differ between operating systems.
-
-  For that reason, configure does few attempts to actually figure this out and
-  you are instead encouraged to set LIBS and LDFLAGS accordingly when you
-  invoke configure, and point out the needed libraries and set the necessary
-  flags yourself.
-
-  2.2 Does curl work with other SSL libraries?
-
-  curl has been written to use a generic SSL function layer internally, and
-  that SSL functionality can then be provided by one out of many different SSL
-  backends.
-
-  curl can be built to use one of the following SSL alternatives: OpenSSL,
-  libressl, BoringSSL, AWS-LC, GnuTLS, wolfSSL, mbedTLS, Secure Transport
-  (native iOS/OS X), Schannel (native Windows), BearSSL or Rustls. They all
-  have their pros and cons, and we try to maintain a comparison of them here:
-  https://curl.se/docs/ssl-compared.html
-
-  2.4 Does curl support SOCKS (RFC 1928) ?
-
-  Yes, SOCKS 4 and 5 are supported.
-
-3. Usage problems
-
-  3.1 curl: (1) SSL is disabled, https: not supported
-
-  If you get this output when trying to get anything from an https:// server,
-  it means that the instance of curl/libcurl that you are using was built
-  without support for this protocol.
-
-  This could have happened if the configure script that was run at build time
-  could not find all libs and include files curl requires for SSL to work. If
-  the configure script fails to find them, curl is simply built without SSL
-  support.
-
-  To get the https:// support into a curl that was previously built but that
-  reports that https:// is not supported, you should dig through the document
-  and logs and check out why the configure script does not find the SSL libs
-  and/or include files.
-
-  Also, check out the other paragraph in this FAQ labeled "configure does not
-  find OpenSSL even when it is installed".
-
-  3.2 How do I tell curl to resume a transfer?
-
-  curl supports resumed transfers both ways on both FTP and HTTP.
-  Try the -C option.
-
-  3.3 Why does my posting using -F not work?
-
-  You cannot arbitrarily use -F or -d, the choice between -F or -d depends on
-  the HTTP operation you need curl to do and what the web server that will
-  receive your post expects.
-
-  If the form you are trying to submit uses the type 'multipart/form-data',
-  then and only then you must use the -F type. In all the most common cases,
-  you should use -d which then causes a posting with the type
-  'application/x-www-form-urlencoded'.
-
-  This is described in some detail in the MANUAL and TheArtOfHttpScripting
-  documents, and if you do not understand it the first time, read it again
-  before you post questions about this to the mailing list. Also, try reading
-  through the mailing list archives for old postings and questions regarding
-  this.
-
-  3.4 How do I tell curl to run custom FTP commands?
-
-  You can tell curl to perform optional commands both before and/or after a
-  file transfer. Study the -Q/--quote option.
-
-  Since curl is used for file transfers, you do not normally use curl to
-  perform FTP commands without transferring anything. Therefore you must
-  always specify a URL to transfer to/from even when doing custom FTP
-  commands, or use -I which implies the "no body" option sent to libcurl.
-
-  3.5 How can I disable the Accept: */* header?
-
-  You can change all internally generated headers by adding a replacement with
-  the -H/--header option. By adding a header with empty contents you safely
-  disable that one. Use -H "Accept:" to disable that specific header.
-
-  3.6 Does curl support ASP, XML, XHTML or HTML version Y?
-
-  To curl, all contents are alike. It does not matter how the page was
-  generated. It may be ASP, PHP, Perl, shell-script, SSI or plain HTML
-  files. There is no difference to curl and it does not even know what kind of
-  language that generated the page.
-
-  See also item 3.14 regarding JavaScript.
-
-  3.7 Can I use curl to delete/rename a file through FTP?
-
-  Yes. You specify custom FTP commands with -Q/--quote.
-
-  One example would be to delete a file after you have downloaded it:
-
-     curl -O ftp://download.com/coolfile -Q '-DELE coolfile'
-
-  or rename a file after upload:
-
-     curl -T infile ftp://upload.com/dir/ -Q "-RNFR infile" -Q "-RNTO newname"
-
-  3.8 How do I tell curl to follow HTTP redirects?
-
-  curl does not follow so-called redirects by default. The Location: header
-  that informs the client about this is only interpreted if you are using the
-  -L/--location option. As in:
-
-     curl -L http://redirector.com
-
-  Not all redirects are HTTP ones, see 4.14
-
-  3.9 How do I use curl in my favorite programming language?
-
-  Many programming languages have interfaces/bindings that allow you to use
-  curl without having to use the command line tool. If you are fluent in such
-  a language, you may prefer to use one of these interfaces instead.
-
-  Find out more about which languages that support curl directly, and how to
-  install and use them, in the libcurl section of the curl website:
-  https://curl.se/libcurl/
-
-  All the various bindings to libcurl are made by other projects and people,
-  outside of the cURL project. The cURL project itself only produces libcurl
-  with its plain C API. If you do not find anywhere else to ask you can ask
-  about bindings on the curl-library list too, but be prepared that people on
-  that list may not know anything about bindings.
-
-  In December 2021, there were interfaces available for the following
-  languages: Ada95, Basic, C, C++, Ch, Cocoa, D, Delphi, Dylan, Eiffel,
-  Euphoria, Falcon, Ferite, Gambas, glib/GTK+, Go, Guile, Harbour, Haskell,
-  Java, Julia, Lisp, Lua, Mono, .NET, node.js, Object-Pascal, OCaml, Pascal,
-  Perl, PHP, PostgreSQL, Python, R, Rexx, Ring, RPG, Ruby, Rust, Scheme,
-  Scilab, S-Lang, Smalltalk, SP-Forth, SPL, Tcl, Visual Basic, Visual FoxPro,
-  Q, wxwidgets, XBLite and Xoho. By the time you read this, additional ones
-  may have appeared.
-
-  3.10 What about SOAP, WebDAV, XML-RPC or similar protocols over HTTP?
-
-  curl adheres to the HTTP spec, which basically means you can play with *any*
-  protocol that is built on top of HTTP. Protocols such as SOAP, WEBDAV and
-  XML-RPC are all such ones. You can use -X to set custom requests and -H to
-  set custom headers (or replace internally generated ones).
-
-  Using libcurl is of course just as good and you would just use the proper
-  library options to do the same.
-
-  3.11 How do I POST with a different Content-Type?
-
-  You can always replace the internally generated headers with -H/--header.
-  To make a simple HTTP POST with text/xml as content-type, do something like:
-
-        curl -d "datatopost" -H "Content-Type: text/xml" [URL]
-
-  3.12 Why do FTP-specific features over HTTP proxy fail?
-
-  Because when you use an HTTP proxy, the protocol spoken on the network will
-  be HTTP, even if you specify an FTP URL. This effectively means that you
-  normally cannot use FTP-specific features such as FTP upload and FTP quote
-  etc.
-
-  There is one exception to this rule, and that is if you can "tunnel through"
-  the given HTTP proxy. Proxy tunneling is enabled with a special option (-p)
-  and is generally not available as proxy admins usually disable tunneling to
-  ports other than 443 (which is used for HTTPS access through proxies).
-
-  3.13 Why do my single/double quotes fail?
-
-  To specify a command line option that includes spaces, you might need to
-  put the entire option within quotes. Like in:
-
-   curl -d " with spaces " url.com
-
-  or perhaps
-
-   curl -d ' with spaces ' url.com
-
-  Exactly what kind of quotes and how to do this is entirely up to the shell
-  or command line interpreter that you are using. For most unix shells, you
-  can more or less pick either single (') or double (") quotes. For
-  Windows/DOS command prompts you must use double (") quotes, and if the
-  option string contains inner double quotes you can escape them with a
-  backslash.
-
-  For Windows powershell the arguments are not always passed on as expected
-  because curl is not a powershell script. You may or may not be able to use
-  single quotes. To escape inner double quotes seems to require a
-  backslash-backtick escape sequence and the outer quotes as double quotes.
-
-  Please study the documentation for your particular environment. Examples in
-  the curl docs will use a mix of both of these as shown above. You must
-  adjust them to work in your environment.
-
-  Remember that curl works and runs on more operating systems than most single
-  individuals have ever tried.
-
-  3.14 Does curl support JavaScript or PAC (automated proxy config)?
-
-  Many web pages do magic stuff using embedded JavaScript. curl and libcurl
-  have no built-in support for that, so it will be treated just like any other
-  contents.
-
-  .pac files are a Netscape invention and are sometimes used by organizations
-  to allow them to differentiate which proxies to use. The .pac contents is
-  just a JavaScript program that gets invoked by the browser and that returns
-  the name of the proxy to connect to. Since curl does not support JavaScript,
-  it cannot support .pac proxy configuration either.
-
-  Some workarounds usually suggested to overcome this JavaScript dependency:
-
-  Depending on the JavaScript complexity, write up a script that translates it
-  to another language and execute that.
-
-  Read the JavaScript code and rewrite the same logic in another language.
-
-  Implement a JavaScript interpreter, people have successfully used the
-  Mozilla JavaScript engine in the past.
-
-  Ask your admins to stop this, for a static proxy setup or similar.
-
-  3.15 Can I do recursive fetches with curl?
-
-  No. curl itself has no code that performs recursive operations, such as
-  those performed by wget and similar tools.
-
-  There exists wrapper scripts with that functionality (for example the
-  curlmirror perl script), and you can write programs based on libcurl to do
-  it, but the command line tool curl itself cannot.
-
-  3.16 What certificates do I need when I use SSL?
-
-  There are three different kinds of "certificates" to keep track of when we
-  talk about using SSL-based protocols (HTTPS or FTPS) using curl or libcurl.
-
-  CLIENT CERTIFICATE
-
-  The server you communicate with may require that you can provide this in
-  order to prove that you actually are who you claim to be. If the server
-  does not require this, you do not need a client certificate.
-
-  A client certificate is always used together with a private key, and the
-  private key has a pass phrase that protects it.
-
-  SERVER CERTIFICATE
-
-  The server you communicate with has a server certificate. You can and should
-  verify this certificate to make sure that you are truly talking to the real
-  server and not a server impersonating it.
-
-  CERTIFICATE AUTHORITY CERTIFICATE ("CA cert")
-
-  You often have several CA certs in a CA cert bundle that can be used to
-  verify a server certificate that was signed by one of the authorities in the
-  bundle. curl does not come with a CA cert bundle but most curl installs
-  provide one. You can also override the default.
-
-  The server certificate verification process is made by using a Certificate
-  Authority certificate ("CA cert") that was used to sign the server
-  certificate. Server certificate verification is enabled by default in curl
-  and libcurl and is often the reason for problems as explained in FAQ entry
-  4.12 and the SSLCERTS document
-  (https://curl.se/docs/sslcerts.html). Server certificates that are
-  "self-signed" or otherwise signed by a CA that you do not have a CA cert
-  for, cannot be verified. If the verification during a connect fails, you are
-  refused access. You then need to explicitly disable the verification to
-  connect to the server.
-
-  3.17 How do I list the root directory of an FTP server?
-
-  There are two ways. The way defined in the RFC is to use an encoded slash
-  in the first path part. List the "/tmp" directory like this:
-
-     curl ftp://ftp.sunet.se/%2ftmp/
-
-  or the not-quite-kosher-but-more-readable way, by simply starting the path
-  section of the URL with a slash:
-
-     curl ftp://ftp.sunet.se//tmp/
-
-  3.18 Can I use curl to send a POST/PUT and not wait for a response?
-
-  No.
-
-  You can easily write your own program using libcurl to do such stunts.
-
-  3.19 How do I get HTTP from a host using a specific IP address?
-
-  For example, you may be trying out a website installation that is not yet in
-  the DNS. Or you have a site using multiple IP addresses for a given host
-  name and you want to address a specific one out of the set.
-
-  Set a custom Host: header that identifies the server name you want to reach
-  but use the target IP address in the URL:
-
-    curl --header "Host: www.example.com" http://127.0.0.1/
-
-  You can also opt to add faked host name entries to curl with the --resolve
-  option. That has the added benefit that things like redirects will also work
-  properly. The above operation would instead be done as:
-
-    curl --resolve www.example.com:80:127.0.0.1 http://www.example.com/
-
-  3.20 How to SFTP from my user's home directory?
-
-  Contrary to how FTP works, SFTP and SCP URLs specify the exact directory to
-  work with. It means that if you do not specify that you want the user's home
-  directory, you get the actual root directory.
-
-  To specify a file in your user's home directory, you need to use the correct
-  URL syntax which for SFTP might look similar to:
-
-    curl -O -u user:password sftp://example.com/~/file.txt
-
-  and for SCP it is just a different protocol prefix:
-
-    curl -O -u user:password scp://example.com/~/file.txt
-
-  3.21 Protocol xxx not supported or disabled in libcurl
-
-  When passing on a URL to curl to use, it may respond that the particular
-  protocol is not supported or disabled. The particular way this error message
-  is phrased is because curl does not make a distinction internally of whether
-  a particular protocol is not supported (i.e. never got any code added that
-  knows how to speak that protocol) or if it was explicitly disabled. curl can
-  be built to only support a given set of protocols, and the rest would then
-  be disabled or not supported.
-
-  Note that this error will also occur if you pass a wrongly spelled protocol
-  part as in "htpt://example.com" or as in the less evident case if you prefix
-  the protocol part with a space as in " http://example.com/".
-
-  3.22 curl -X gives me HTTP problems
-
-  In normal circumstances, -X should hardly ever be used.
-
-  By default you use curl without explicitly saying which request method to
-  use when the URL identifies an HTTP transfer. If you just pass in a URL like
-  "curl http://example.com" it will use GET. If you use -d or -F curl will use
-  POST, -I will cause a HEAD and -T will make it a PUT.
-
-  If for whatever reason you are not happy with these default choices that curl
-  does for you, you can override those request methods by specifying -X
-  [WHATEVER]. This way you can for example send a DELETE by doing "curl -X
-  DELETE [URL]".
-
-  It is thus pointless to do "curl -XGET [URL]" as GET would be used
-  anyway. In the same vein it is pointless to do "curl -X POST -d data
-  [URL]"... But you can make a fun and somewhat rare request that sends a
-  request-body in a GET request with something like "curl -X GET -d data
-  [URL]"
-
-  Note that -X does not actually change curl's behavior as it only modifies the
-  actual string sent in the request, but that may of course trigger a
-  different set of events.
-
-  Accordingly, by using -XPOST on a command line that for example would follow
-  a 303 redirect, you will effectively prevent curl from behaving
-  correctly. Be aware.
-
-
-4. Running Problems
-
-  4.2 Why do I get problems when I use & or % in the URL?
-
-  In general Unix shells, the & symbol is treated specially and when used, it
-  runs the specified command in the background. To safely send the & as a part
-  of a URL, you should quote the entire URL by using single (') or double (")
-  quotes around it. Similar problems can also occur on some shells with other
-  characters, including ?*!$~(){}<>\|;`. When in doubt, quote the URL.
-
-  An example that would invoke a remote CGI that uses &-symbols could be:
-
-     curl 'http://www.altavista.com/cgi-bin/query?text=yes&q=curl'
-
-  In Windows, the standard DOS shell treats the percent sign specially and you
-  need to use TWO percent signs for each single one you want to use in the
-  URL.
-
-  If you want a literal percent sign to be part of the data you pass in a POST
-  using -d/--data you must encode it as '%25' (which then also needs the
-  percent sign doubled on Windows machines).
-
-  4.3 How can I use {, }, [ or ] to specify multiple URLs?
-
-  Because those letters have a special meaning to the shell, to be used in
-  a URL specified to curl you must quote them.
-
-  An example that downloads two URLs (sequentially) would be:
-
-    curl '{curl,www}.haxx.se'
-
-  To be able to use those characters as actual parts of the URL (without using
-  them for the curl URL "globbing" system), use the -g/--globoff option:
-
-    curl -g 'www.site.com/weirdname[].html'
-
-  4.4 Why do I get downloaded data even though the web page does not exist?
-
-  curl asks remote servers for the page you specify. If the page does not exist
-  at the server, the HTTP protocol defines how the server should respond and
-  that means that headers and a "page" will be returned. That is simply how
-  HTTP works.
-
-  By using the --fail option you can tell curl explicitly to not get any data
-  if the HTTP return code does not say success.
-
-  4.5 Why do I get return code XXX from an HTTP server?
-
-  RFC 2616 clearly explains the return codes. This is a short transcript. Go
-  read the RFC for exact details:
-
-    4.5.1 "400 Bad Request"
-
-    The request could not be understood by the server due to malformed
-    syntax. The client SHOULD NOT repeat the request without modifications.
-
-    4.5.2 "401 Unauthorized"
-
-    The request requires user authentication.
-
-    4.5.3 "403 Forbidden"
-
-    The server understood the request, but is refusing to fulfill it.
-    Authorization will not help and the request SHOULD NOT be repeated.
-
-    4.5.4 "404 Not Found"
-
-    The server has not found anything matching the Request-URI. No indication
-    is given as to whether the condition is temporary or permanent.
-
-    4.5.5 "405 Method Not Allowed"
-
-    The method specified in the Request-Line is not allowed for the resource
-    identified by the Request-URI. The response MUST include an Allow header
-    containing a list of valid methods for the requested resource.
-
-    4.5.6 "301 Moved Permanently"
-
-    If you get this return code and an HTML output similar to this:
-
-       <H1>Moved Permanently</H1> The document has moved <A
-       HREF="http://same_url_now_with_a_trailing_slash/">here</A>.
-
-    it might be because you requested a directory URL but without the trailing
-    slash. Try the same operation again _with_ the trailing URL, or use the
-    -L/--location option to follow the redirection.
-
-  4.6 Can you tell me what error code 142 means?
-
-  All curl error codes are described at the end of the man page, in the
-  section called "EXIT CODES".
-
-  Error codes that are larger than the highest documented error code means
-  that curl has exited due to a crash. This is a serious error, and we
-  appreciate a detailed bug report from you that describes how we could go
-  ahead and repeat this.
-
-  4.7 How do I keep user names and passwords secret in curl command lines?
-
-  This problem has two sides:
-
-  The first part is to avoid having clear-text passwords in the command line
-  so that they do not appear in 'ps' outputs and similar. That is easily
-  avoided by using the "-K" option to tell curl to read parameters from a file
-  or stdin to which you can pass the secret info. curl itself will also
-  attempt to "hide" the given password by blanking out the option - this
-  does not work on all platforms.
-
-  To keep the passwords in your account secret from the rest of the world is
-  not a task that curl addresses. You could of course encrypt them somehow to
-  at least hide them from being read by human eyes, but that is not what
-  anyone would call security.
-
-  Also note that regular HTTP (using Basic authentication) and FTP passwords
-  are sent as cleartext across the network. All it takes for anyone to fetch
-  them is to listen on the network. Eavesdropping is easy. Use more secure
-  authentication methods (like Digest, Negotiate or even NTLM) or consider the
-  SSL-based alternatives HTTPS and FTPS.
-
-  4.8 I found a bug
-
-  It is not a bug if the behavior is documented. Read the docs first.
-  Especially check out the KNOWN_BUGS file, it may be a documented bug.
-
-  If it is a problem with a binary you have downloaded or a package for your
-  particular platform, try contacting the person who built the package/archive
-  you have.
-
-  If there is a bug, read the BUGS document first. Then report it as described
-  in there.
-
-  4.9 curl cannot authenticate to a server that requires NTLM?
-
-  NTLM support requires OpenSSL, GnuTLS, mbedTLS, Secure Transport, or
-  Microsoft Windows libraries at build-time to provide this functionality.
-
-  4.10 My HTTP request using HEAD, PUT or DELETE does not work
-
-  Many web servers allow or demand that the administrator configures the
-  server properly for these requests to work on the web server.
-
-  Some servers seem to support HEAD only on certain kinds of URLs.
-
-  To fully grasp this, try the documentation for the particular server
-  software you are trying to interact with. This is not anything curl can do
-  anything about.
-
-  4.11 Why do my HTTP range requests return the full document?
-
-  Because the range may not be supported by the server, or the server may
-  choose to ignore it and return the full document anyway.
-
-  4.12 Why do I get "certificate verify failed" ?
-
-  When you invoke curl and get an error 60 error back it means that curl
-  could not verify that the server's certificate was good. curl verifies the
-  certificate using the CA cert bundle and verifying for which names the
-  certificate has been granted.
-
-  To completely disable the certificate verification, use -k. This does
-  however enable man-in-the-middle attacks and makes the transfer INSECURE.
-  We strongly advise against doing this for more than experiments.
-
-  If you get this failure with a CA cert bundle installed and used, the
-  server's certificate might not be signed by one of the CA's in your CA
-  store. It might for example be self-signed. You then correct this problem by
-  obtaining a valid CA cert for the server. Or again, decrease the security by
-  disabling this check.
-
-  At times, you find that the verification works in your favorite browser but
-  fails in curl. When this happens, the reason is usually that the server
-  sends an incomplete cert chain. The server is mandated to send all
-  "intermediate certificates" but does not. This typically works with browsers
-  anyway since they A) cache such certs and B) supports AIA which downloads
-  such missing certificates on demand. This is a server misconfiguration. A
-  good way to figure out if this is the case it to use the SSL Labs server
-  test and check the certificate chain: https://www.ssllabs.com/ssltest/
-
-  Details are also in the SSLCERTS.md document, found online here:
-  https://curl.se/docs/sslcerts.html
-
-  4.13 Why is curl -R on Windows one hour off?
-
-  Since curl 7.53.0 this issue should be fixed as long as curl was built with
-  any modern compiler that allows for a 64-bit curl_off_t type. For older
-  compilers or prior curl versions it may set a time that appears one hour off.
-  This happens due to a flaw in how Windows stores and uses file modification
-  times and it is not easily worked around. For more details read this:
-  https://www.codeproject.com/Articles/1144/Beating-the-Daylight-Savings-Time-bug-and-getting
-
-  4.14 Redirects work in browser but not with curl
-
-  curl supports HTTP redirects well (see item 3.8). Browsers generally support
-  at least two other ways to perform redirects that curl does not:
-
-  Meta tags. You can write an HTML tag that will cause the browser to redirect
-  to another given URL after a certain time.
-
-  JavaScript. You can write a JavaScript program embedded in an HTML page that
-  redirects the browser to another given URL.
-
-  There is no way to make curl follow these redirects. You must either
-  manually figure out what the page is set to do, or write a script that parses
-  the results and fetches the new URL.
-
-  4.15 FTPS does not work
-
-  curl supports FTPS (sometimes known as FTP-SSL) both implicit and explicit
-  mode.
-
-  When a URL is used that starts with FTPS://, curl assumes implicit SSL on
-  the control connection and will therefore immediately connect and try to
-  speak SSL. FTPS:// connections default to port 990.
-
-  To use explicit FTPS, you use an FTP:// URL and the --ftp-ssl option (or one
-  of its related flavors). This is the most common method, and the one
-  mandated by RFC 4217. This kind of connection will then of course use the
-  standard FTP port 21 by default.
-
-  4.16 My HTTP POST or PUT requests are slow
-
-  libcurl makes all POST and PUT requests (except for requests with a small
-  request body) use the "Expect: 100-continue" header. This header allows the
-  server to deny the operation early so that libcurl can bail out before having
-  to send any data. This is useful in authentication cases and others.
-
-  However, many servers do not implement the Expect: stuff properly and if the
-  server does not respond (positively) within 1 second libcurl will continue
-  and send off the data anyway.
-
-  You can disable libcurl's use of the Expect: header the same way you disable
-  any header, using -H / CURLOPT_HTTPHEADER, or by forcing it to use HTTP 1.0.
-
-  4.17 Non-functional connect timeouts
-
-  In most Windows setups having a timeout longer than 21 seconds make no
-  difference, as it will only send 3 TCP SYN packets and no more. The second
-  packet sent three seconds after the first and the third six seconds after
-  the second. No more than three packets are sent, no matter how long the
-  timeout is set.
-
-  See option TcpMaxConnectRetransmissions on this page:
-  https://support.microsoft.com/en-us/kb/175523/en-us
-
-  Also, even on non-Windows systems there may run a firewall or anti-virus
-  software or similar that accepts the connection but does not actually do
-  anything else. This will make (lib)curl to consider the connection connected
-  and thus the connect timeout will not trigger.
-
-  4.18 file:// URLs containing drive letters (Windows, NetWare)
-
-  When using curl to try to download a local file, one might use a URL
-  in this format:
-
-  file://D:/blah.txt
-
-  you will find that even if D:\blah.txt does exist, curl returns a 'file
-  not found' error.
-
-  According to RFC 1738 (https://www.ietf.org/rfc/rfc1738.txt),
-  file:// URLs must contain a host component, but it is ignored by
-  most implementations. In the above example, 'D:' is treated as the
-  host component, and is taken away. Thus, curl tries to open '/blah.txt'.
-  If your system is installed to drive C:, that will resolve to 'C:\blah.txt',
-  and if that does not exist you will get the not found error.
-
-  To fix this problem, use file:// URLs with *three* leading slashes:
-
-  file:///D:/blah.txt
-
-  Alternatively, if it makes more sense, specify 'localhost' as the host
-  component:
-
-  file://localhost/D:/blah.txt
-
-  In either case, curl should now be looking for the correct file.
-
-  4.19 Why does not curl return an error when the network cable is unplugged?
-
-  Unplugging a cable is not an error situation. The TCP/IP protocol stack
-  was designed to be fault tolerant, so even though there may be a physical
-  break somewhere the connection should not be affected, just possibly
-  delayed. Eventually, the physical break will be fixed or the data will be
-  re-routed around the physical problem through another path.
-
-  In such cases, the TCP/IP stack is responsible for detecting when the
-  network connection is irrevocably lost. Since with some protocols it is
-  perfectly legal for the client to wait indefinitely for data, the stack may
-  never report a problem, and even when it does, it can take up to 20 minutes
-  for it to detect an issue. The curl option --keepalive-time enables
-  keep-alive support in the TCP/IP stack which makes it periodically probe the
-  connection to make sure it is still available to send data. That should
-  reliably detect any TCP/IP network failure.
-
-  TCP keep alive will not detect the network going down before the TCP/IP
-  connection is established (e.g. during a DNS lookup) or using protocols that
-  do not use TCP. To handle those situations, curl offers a number of timeouts
-  on its own. --speed-limit/--speed-time will abort if the data transfer rate
-  falls too low, and --connect-timeout and --max-time can be used to put an
-  overall timeout on the connection phase or the entire transfer.
-
-  A libcurl-using application running in a known physical environment (e.g.
-  an embedded device with only a single network connection) may want to act
-  immediately if its lone network connection goes down. That can be achieved
-  by having the application monitor the network connection on its own using an
-  OS-specific mechanism, then signaling libcurl to abort (see also item 5.13).
-
-  4.20 curl does not return error for HTTP non-200 responses
-
-  Correct. Unless you use -f (--fail).
-
-  When doing HTTP transfers, curl will perform exactly what you are asking it
-  to do and if successful it will not return an error. You can use curl to
-  test your web server's "file not found" page (that gets 404 back), you can
-  use it to check your authentication protected web pages (that gets a 401
-  back) and so on.
-
-  The specific HTTP response code does not constitute a problem or error for
-  curl. It simply sends and delivers HTTP as you asked and if that worked,
-  everything is fine and dandy. The response code is generally providing more
-  higher level error information that curl does not care about. The error was
-  not in the HTTP transfer.
-
-  If you want your command line to treat error codes in the 400 and up range
-  as errors and thus return a non-zero value and possibly show an error
-  message, curl has a dedicated option for that: -f (CURLOPT_FAILONERROR in
-  libcurl speak).
-
-  You can also use the -w option and the variable %{response_code} to extract
-  the exact response code that was returned in the response.
-
-5. libcurl Issues
-
-  5.1 Is libcurl thread-safe?
-
-  Yes.
-
-  We have written the libcurl code specifically adjusted for multi-threaded
-  programs. libcurl will use thread-safe functions instead of non-safe ones if
-  your system has such. Note that you must never share the same handle in
-  multiple threads.
-
-  There may be some exceptions to thread safety depending on how libcurl was
-  built. Please review the guidelines for thread safety to learn more:
-  https://curl.se/libcurl/c/threadsafe.html
-
-  5.2 How can I receive all data into a large memory chunk?
-
-  [ See also the examples/getinmemory.c source ]
-
-  You are in full control of the callback function that gets called every time
-  there is data received from the remote server. You can make that callback do
-  whatever you want. You do not have to write the received data to a file.
-
-  One solution to this problem could be to have a pointer to a struct that you
-  pass to the callback function. You set the pointer using the
-  CURLOPT_WRITEDATA option. Then that pointer will be passed to the callback
-  instead of a FILE * to a file:
-
-        /* imaginary struct */
-        struct MemoryStruct {
-          char *memory;
-          size_t size;
-        };
-
-        /* imaginary callback function */
-        size_t
-        WriteMemoryCallback(void *ptr, size_t size, size_t nmemb, void *data)
-        {
-          size_t realsize = size * nmemb;
-          struct MemoryStruct *mem = (struct MemoryStruct *)data;
-
-          mem->memory = (char *)realloc(mem->memory, mem->size + realsize + 1);
-          if (mem->memory) {
-            memcpy(&(mem->memory[mem->size]), ptr, realsize);
-            mem->size += realsize;
-            mem->memory[mem->size] = 0;
-          }
-          return realsize;
-        }
-
-  5.3 How do I fetch multiple files with libcurl?
-
-  libcurl has excellent support for transferring multiple files. You should
-  just repeatedly set new URLs with curl_easy_setopt() and then transfer it
-  with curl_easy_perform(). The handle you get from curl_easy_init() is not
-  only reusable, but you are even encouraged to reuse it if you can, as that
-  will enable libcurl to use persistent connections.
-
-  5.4 Does libcurl do Winsock initialization on win32 systems?
-
-  Yes, if told to in the curl_global_init() call.
-
-  5.5 Does CURLOPT_WRITEDATA and CURLOPT_READDATA work on win32 ?
-
-  Yes, but you cannot open a FILE * and pass the pointer to a DLL and have
-  that DLL use the FILE * (as the DLL and the client application cannot access
-  each others' variable memory areas). If you set CURLOPT_WRITEDATA you must
-  also use CURLOPT_WRITEFUNCTION as well to set a function that writes the
-  file, even if that simply writes the data to the specified FILE *.
-  Similarly, if you use CURLOPT_READDATA you must also specify
-  CURLOPT_READFUNCTION.
-
-  5.6 What about Keep-Alive or persistent connections?
-
-  curl and libcurl have excellent support for persistent connections when
-  transferring several files from the same server.  curl will attempt to reuse
-  connections for all URLs specified on the same command line/config file, and
-  libcurl will reuse connections for all transfers that are made using the
-  same libcurl handle.
-
-  When you use the easy interface the connection cache is kept within the easy
-  handle. If you instead use the multi interface, the connection cache will be
-  kept within the multi handle and will be shared among all the easy handles
-  that are used within the same multi handle.
-
-  5.7 Link errors when building libcurl on Windows
-
-  You need to make sure that your project, and all the libraries (both static
-  and dynamic) that it links against, are compiled/linked against the same run
-  time library.
-
-  This is determined by the /MD, /ML, /MT (and their corresponding /M?d)
-  options to the command line compiler. /MD (linking against MSVCRT dll) seems
-  to be the most commonly used option.
-
-  When building an application that uses the static libcurl library, you must
-  add -DCURL_STATICLIB to your CFLAGS. Otherwise the linker will look for
-  dynamic import symbols. If you are using Visual Studio, you need to instead
-  add CURL_STATICLIB in the "Preprocessor Definitions" section.
-
-  If you get a linker error like "unknown symbol __imp__curl_easy_init ..." you
-  have linked against the wrong (static) library. If you want to use the
-  libcurl.dll and import lib, you do not need any extra CFLAGS, but use one of
-  the import libraries below. These are the libraries produced by the various
-  lib/Makefile.* files:
-
-       Target:          static lib.   import lib for libcurl*.dll.
-       -----------------------------------------------------------
-       MinGW:           libcurl.a     libcurldll.a
-       MSVC (release):  libcurl.lib   libcurl_imp.lib
-       MSVC (debug):    libcurld.lib  libcurld_imp.lib
-       Borland:         libcurl.lib   libcurl_imp.lib
-
-  5.8 libcurl.so.X: open failed: No such file or directory
-
-  This is an error message you might get when you try to run a program linked
-  with a shared version of libcurl and your runtime linker (ld.so) could not
-  find the shared library named libcurl.so.X. (Where X is the number of the
-  current libcurl ABI, typically 3 or 4).
-
-  You need to make sure that ld.so finds libcurl.so.X. You can do that
-  multiple ways, and it differs somewhat between different operating systems.
-  They are usually:
-
-  * Add an option to the linker command line that specify the hard-coded path
-    the runtime linker should check for the lib (usually -R)
-
-  * Set an environment variable (LD_LIBRARY_PATH for example) where ld.so
-    should check for libs
-
-  * Adjust the system's config to check for libs in the directory where you have
-    put the library (like Linux's /etc/ld.so.conf)
-
-  'man ld.so' and 'man ld' will tell you more details
-
-  5.9 How does libcurl resolve host names?
-
-  libcurl supports a large number of name resolve functions. One of them is
-  picked at build-time and will be used unconditionally. Thus, if you want to
-  change name resolver function you must rebuild libcurl and tell it to use a
-  different function.
-
-  - The non-IPv6 resolver that can use one of four different host name resolve
-  calls (depending on what your system supports):
-
-      A - gethostbyname()
-      B - gethostbyname_r() with 3 arguments
-      C - gethostbyname_r() with 5 arguments
-      D - gethostbyname_r() with 6 arguments
-
-  - The IPv6-resolver that uses getaddrinfo()
-
-  - The c-ares based name resolver that uses the c-ares library for resolves.
-    Using this offers asynchronous name resolves.
-
-  - The threaded resolver (default option on Windows). It uses:
-
-      A - gethostbyname() on plain IPv4 hosts
-      B - getaddrinfo() on IPv6 enabled hosts
-
-  Also note that libcurl never resolves or reverse-lookups addresses given as
-  pure numbers, such as 127.0.0.1 or ::1.
-
-  5.10 How do I prevent libcurl from writing the response to stdout?
-
-  libcurl provides a default built-in write function that writes received data
-  to stdout. Set the CURLOPT_WRITEFUNCTION to receive the data, or possibly
-  set CURLOPT_WRITEDATA to a different FILE * handle.
-
-  5.11 How do I make libcurl not receive the whole HTTP response?
-
-  You make the write callback (or progress callback) return an error and
-  libcurl will then abort the transfer.
-
-  5.12 Can I make libcurl fake or hide my real IP address?
-
-  No. libcurl operates on a higher level. Besides, faking IP address would
-  imply sending IP packets with a made-up source address, and then you normally
-  get a problem with receiving the packet sent back as they would then not be
-  routed to you.
-
-  If you use a proxy to access remote sites, the sites will not see your local
-  IP address but instead the address of the proxy.
-
-  Also note that on many networks NATs or other IP-munging techniques are used
-  that makes you see and use a different IP address locally than what the
-  remote server will see you coming from. You may also consider using
-  https://www.torproject.org/ .
-
-  5.13 How do I stop an ongoing transfer?
-
-  With the easy interface you make sure to return the correct error code from
-  one of the callbacks, but none of them are instant. There is no function you
-  can call from another thread or similar that will stop it immediately.
-  Instead, you need to make sure that one of the callbacks you use returns an
-  appropriate value that will stop the transfer. Suitable callbacks that you
-  can do this with include the progress callback, the read callback and the
-  write callback.
-
-  If you are using the multi interface, you can also stop a transfer by
-  removing the particular easy handle from the multi stack at any moment you
-  think the transfer is done or when you wish to abort the transfer.
-
-  5.14 Using C++ non-static functions for callbacks?
-
-  libcurl is a C library, it does not know anything about C++ member functions.
-
-  You can overcome this "limitation" with relative ease using a static
-  member function that is passed a pointer to the class:
-
-     // f is the pointer to your object.
-     static size_t YourClass::func(void *buffer, size_t sz, size_t n, void *f)
-     {
-       // Call non-static member function.
-       static_cast<YourClass*>(f)->nonStaticFunction();
-     }
-
-     // This is how you pass pointer to the static function:
-     curl_easy_setopt(hcurl, CURLOPT_WRITEFUNCTION, YourClass::func);
-     curl_easy_setopt(hcurl, CURLOPT_WRITEDATA, this);
-
-  5.15 How do I get an FTP directory listing?
-
-  If you end the FTP URL you request with a slash, libcurl will provide you
-  with a directory listing of that given directory. You can also set
-  CURLOPT_CUSTOMREQUEST to alter what exact listing command libcurl would use
-  to list the files.
-
-  The follow-up question tends to be how is a program supposed to parse the
-  directory listing. How does it know what's a file and what's a directory and
-  what's a symlink etc. If the FTP server supports the MLSD command then it
-  will return data in a machine-readable format that can be parsed for type.
-  The types are specified by RFC 3659 section 7.5.1. If MLSD is not supported
-  then you have to work with what you are given. The LIST output format is
-  entirely at the server's own liking and the NLST output does not reveal any
-  types and in many cases does not even include all the directory entries.
-  Also, both LIST and NLST tend to hide unix-style hidden files (those that
-  start with a dot) by default so you need to do "LIST -a" or similar to see
-  them.
-
-  Example - List only directories.
-  ftp.funet.fi supports MLSD and ftp.kernel.org does not:
-
-     curl -s ftp.funet.fi/pub/ -X MLSD | \
-       perl -lne 'print if s/(?:^|;)type=dir;[^ ]+ (.+)$/$1/'
-
-     curl -s ftp.kernel.org/pub/linux/kernel/ | \
-       perl -lne 'print if s/^d[-rwx]{9}(?: +[^ ]+){7} (.+)$/$1/'
-
-  If you need to parse LIST output in libcurl one such existing
-  list parser is available at https://cr.yp.to/ftpparse.html  Versions of
-  libcurl since 7.21.0 also provide the ability to specify a wildcard to
-  download multiple files from one FTP directory.
-
-  5.16 I want a different time-out
-
-  Sometimes users realize that CURLOPT_TIMEOUT and CURLOPT_CONNECTIMEOUT are
-  not sufficiently advanced or flexible to cover all the various use cases and
-  scenarios applications end up with.
-
-  libcurl offers many more ways to time-out operations. A common alternative
-  is to use the CURLOPT_LOW_SPEED_LIMIT and CURLOPT_LOW_SPEED_TIME options to
-  specify the lowest possible speed to accept before to consider the transfer
-  timed out.
-
-  The most flexible way is by writing your own time-out logic and using
-  CURLOPT_XFERINFOFUNCTION (perhaps in combination with other callbacks) and
-  use that to figure out exactly when the right condition is met when the
-  transfer should get stopped.
-
-  5.17 Can I write a server with libcurl?
-
-  No. libcurl offers no functions or building blocks to build any kind of
-  Internet protocol server. libcurl is only a client-side library. For server
-  libraries, you need to continue your search elsewhere but there exist many
-  good open source ones out there for most protocols you could want a server
-  for. There are also really good stand-alone servers that have been tested
-  and proven for many years. There is no need for you to reinvent them.
-
-  5.18 Does libcurl use threads?
-
-  Put simply: no, libcurl will execute in the same thread you call it in. All
-  callbacks will be called in the same thread as the one you call libcurl in.
-
-  If you want to avoid your thread to be blocked by the libcurl call, you make
-  sure you use the non-blocking multi API which will do transfers
-  asynchronously - still in the same single thread.
-
-  libcurl will potentially internally use threads for name resolving, if it
-  was built to work like that, but in those cases it will create the child
-  threads by itself and they will only be used and then killed internally by
-  libcurl and never exposed to the outside.
-
-6. License Issues
-
-  curl and libcurl are released under a MIT/X derivative license. The license
-  is liberal and should not impose a problem for your project. This section is
-  just a brief summary for the cases we get the most questions. (Parts of this
-  section was much enhanced by Bjorn Reese.)
-
-  We are not lawyers and this is not legal advice. You should probably consult
-  one if you want true and accurate legal insights without our prejudice. Note
-  especially that this section concerns the libcurl license only; compiling in
-  features of libcurl that depend on other libraries (e.g. OpenSSL) may affect
-  the licensing obligations of your application.
-
-  6.1 I have a GPL program, can I use the libcurl library?
-
-  Yes
-
-  Since libcurl may be distributed under the MIT/X derivative license, it can
-  be used together with GPL in any software.
-
-  6.2 I have a closed-source program, can I use the libcurl library?
-
-  Yes
-
-  libcurl does not put any restrictions on the program that uses the library.
-
-  6.3 I have a BSD licensed program, can I use the libcurl library?
-
-  Yes
-
-  libcurl does not put any restrictions on the program that uses the library.
-
-  6.4 I have a program that uses LGPL libraries, can I use libcurl?
-
-  Yes
-
-  The LGPL license does not clash with other licenses.
-
-  6.5 Can I modify curl/libcurl for my program and keep the changes secret?
-
-  Yes
-
-  The MIT/X derivative license practically allows you to do almost anything
-  with the sources, on the condition that the copyright texts in the sources
-  are left intact.
-
-  6.6 Can you please change the curl/libcurl license to XXXX?
-
-  No.
-
-  We have carefully picked this license after years of development and
-  discussions and a large amount of people have contributed with source code
-  knowing that this is the license we use. This license puts the restrictions
-  we want on curl/libcurl and it does not spread to other programs or
-  libraries that use it. It should be possible for everyone to use libcurl or
-  curl in their projects, no matter what license they already have in use.
-
-  6.7 What are my obligations when using libcurl in my commercial apps?
-
-  Next to none. All you need to adhere to is the MIT-style license (stated in
-  the COPYING file) which basically says you have to include the copyright
-  notice in "all copies" and that you may not use the copyright holder's name
-  when promoting your software.
-
-  You do not have to release any of your source code.
-
-  You do not have to reveal or make public any changes to the libcurl source
-  code.
-
-  You do not have to broadcast to the world that you are using libcurl within
-  your app.
-
-  All we ask is that you disclose "the copyright notice and this permission
-  notice" somewhere. Most probably like in the documentation or in the section
-  where other third party dependencies already are mentioned and acknowledged.
-
-  As can be seen here: https://curl.se/docs/companies.html and elsewhere,
-  more and more companies are discovering the power of libcurl and take
-  advantage of it even in commercial environments.
-
-
-7. PHP/CURL Issues
-
-  7.1 What is PHP/CURL?
-
-  The module for PHP that makes it possible for PHP programs to access curl-
-  functions from within PHP.
-
-  In the cURL project we call this module PHP/CURL to differentiate it from
-  curl the command line tool and libcurl the library. The PHP team however
-  does not refer to it like this (for unknown reasons). They call it plain
-  CURL (often using all caps) or sometimes ext/curl, but both cause much
-  confusion to users which in turn gives us a higher question load.
-
-  7.2 Who wrote PHP/CURL?
-
-  PHP/CURL was initially written by Sterling Hughes.
-
-  7.3 Can I perform multiple requests using the same handle?
-
-  Yes - at least in PHP version 4.3.8 and later (this has been known to not
-  work in earlier versions, but the exact version when it started to work is
-  unknown to me).
-
-  After a transfer, you just set new options in the handle and make another
-  transfer. This will make libcurl reuse the same connection if it can.
-
-  7.4 Does PHP/CURL have dependencies?
-
-  PHP/CURL is a module that comes with the regular PHP package. It depends on
-  and uses libcurl, so you need to have libcurl installed properly before
-  PHP/CURL can be used.
-
-8. Development
-
- 8.1 Why does curl use C89?
-
- As with everything in curl, there is a history and we keep using what we have
- used before until someone brings up the subject and argues for and works on
- changing it.
-
- We started out using C89 in the 1990s because that was the only way to write
- a truly portable C program and have it run as widely as possible. C89 was for
- a long time even necessary to make things work on otherwise considered modern
- platforms such as Windows. Today, we do not really know how many users that
- still require the use of a C89 compiler.
-
- We will continue to use C89 for as long as nobody brings up a strong enough
- reason for us to change our minds. The core developers of the project do not
- feel restricted by this and we are not convinced that going C99 will offer us
- enough of a benefit to warrant the risk of cutting off a share of users.
-
- 8.2 Will curl be rewritten?
-
- In one go: no. Little by little over time? Maybe.
-
- Over the years, new languages and clever operating environments come and go.
- Every now and then the urge apparently arises to request that we rewrite curl
- in another language.
-
- Some the most important properties in curl are maintaining the API and ABI
- for libcurl and keeping the behavior for the command line tool. As long as we
- can do that, everything else is up for discussion. To maintain the ABI, we
- probably have to maintain a certain amount of code in C, and to remain rock
- stable, we will never risk anything by rewriting a lot of things in one go.
- That said, we can certainly offer more and more optional backends written in
- other languages, as long as those backends can be plugged in at build-time.
- Backends can be written in any language, but should probably provide APIs
- usable from C to ease integration and transition.
diff --git a/third-party/curl/docs/FAQ.md b/third-party/curl/docs/FAQ.md
new file mode 100644
index 0000000000..6cdf97d327
--- /dev/null
+++ b/third-party/curl/docs/FAQ.md
@@ -0,0 +1,1427 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# Frequently Asked Questions
+
+# Philosophy
+
+## What is curl?
+
+curl is the name of the project. The name is a play on *Client for URLs*,
+originally with URL spelled in uppercase to make it obvious it deals with
+URLs. The fact it can also be read as *see URL* also helped, it works as an
+abbreviation for *Client URL Request Library* or why not the recursive
+version: *curl URL Request Library*.
+
+The curl project produces two products:
+
+### libcurl
+
+A client-side URL transfer library, supporting DICT, FILE, FTP, FTPS, GOPHER,
+GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, MQTTS, POP3, POP3S,
+RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS.
+
+libcurl supports HTTPS certificates, HTTP POST, HTTP PUT, FTP uploading,
+Kerberos, SPNEGO, HTTP form based upload, proxies, cookies, user+password
+authentication, file transfer resume, http proxy tunneling and more.
+
+libcurl is highly portable, it builds and works identically on numerous
+platforms. The [internals document](https://curl.se/docs/install.html#Ports)
+lists more than 110 operating systems and 28 CPU architectures on which curl
+has been reported to run.
+
+libcurl is free, thread-safe, IPv6 compatible, feature-rich, well supported
+and fast.
+
+### curl
+
+A command line tool for getting or sending data using URL syntax.
+
+Since curl uses libcurl, curl supports the same wide range of common Internet
+protocols that libcurl does.
+
+We pronounce curl with an initial k sound. It rhymes with words like girl and
+earl. [This is a short WAV
+file](https://media.merriam-webster.com/soundc11/c/curl0001.wav) to help you.
+
+There are numerous sub-projects and related projects that also use the word
+curl in the project names in various combinations, but you should take notice
+that this FAQ is directed at the command-line tool named curl (and libcurl the
+library), and may therefore not be valid for other curl-related projects.
+(There is however a small section for the PHP/CURL in this FAQ.)
+
+## What is libcurl?
+
+libcurl is a reliable and portable library for doing Internet data transfers
+using one or more of its supported Internet protocols.
+
+You can use libcurl freely in your application, be it open source, commercial
+or closed-source.
+
+libcurl is most probably the most portable, most powerful and most often used
+C-based multi-platform file transfer library on this planet - be it open
+source or commercial.
+
+## What is curl not?
+
+curl is not a Wget clone. That is a common misconception. Never, during curl's
+development, have we intended curl to replace Wget or compete on its market.
+curl is targeted at single-shot file transfers.
+
+curl is not a website mirroring program. If you want to use curl to mirror
+something: fine, go ahead and write a script that wraps around curl or use
+libcurl to make it reality.
+
+curl is not an FTP site mirroring program. Sure, get and send FTP with curl
+but if you want systematic and sequential behavior you should write a script
+(or write a new program that interfaces libcurl) and do it.
+
+curl is not a PHP tool, even though it works perfectly well when used from or
+with PHP (when using the PHP/CURL module).
+
+curl is not a program for a single operating system. curl exists, compiles,
+builds and runs under a wide range of operating systems, including all modern
+Unixes (and a bunch of older ones too), Windows, Amiga, OS/2, macOS, QNX etc.
+
+## When would you make curl do ... ?
+
+We love suggestions of what to change in order to make curl and libcurl
+better. We do however believe in a few rules when it comes to the future of
+curl:
+
+curl the command line tool is to remain a non-graphical command line tool. If
+you want GUIs or fancy scripting capabilities, you should look for another
+tool that uses libcurl.
+
+We do not add things to curl that other small and available tools already do
+well at the side. curl's output can be piped into another program or
+redirected to another file for the next program to interpret.
+
+We focus on protocol related issues and improvements. If you want to do more
+with the supported protocols than curl currently does, chances are good we
+would agree. If you want to add more protocols, we may agree.
+
+If you want someone else to do all the work while you wait for us to implement
+it for you, that is not a friendly attitude. We spend a considerable time
+already on maintaining and developing curl. In order to get more out of us,
+you should consider trading in some of your time and effort in return. Go to
+the [GitHub repository](https://github.com/curl/curl), fork the project,
+and create pull requests with your proposed changes.
+
+If you write the code, chances are better that it gets into curl faster.
+
+## Who makes curl?
+
+curl and libcurl are not made by any single individual. Daniel Stenberg is
+project leader and main developer, but other persons' submissions are
+important and crucial. Anyone can contribute and post their changes and
+improvements and have them inserted in the main sources (of course on the
+condition that developers agree that the fixes are good).
+
+The full list of all contributors is found in the
+[docs/THANKS](https://curl.se/docs/thanks.html) file.
+
+curl is developed by a community, with Daniel at the wheel.
+
+## What do you get for making curl?
+
+Project curl is entirely free and open. We do this voluntarily, mostly in our
+spare time. Companies may pay individual developers to work on curl. This is
+not controlled by nor supervised in any way by the curl project.
+
+We get help from companies. Haxx provides website, bandwidth, mailing lists
+etc, GitHub hosts [the primary git repository](https://github.com/curl/curl)
+and other services like the bug tracker. Also again, some companies have
+sponsored certain parts of the development in the past and I hope some
+continue to do so in the future.
+
+If you want to [support our project](https://curl.se/sponsors.html), consider
+a donation or a banner-program or even better: by helping us with coding,
+documenting or testing etc.
+
+## What about CURL from curl.com?
+
+During the summer of 2001, curl.com was busy advertising their client-side
+programming language for the web, named CURL.
+
+We are in no way associated with curl.com or their CURL programming language.
+
+Our project name curl has been in effective use since 1998. We were not the
+first computer related project to use the name *curl* and do not claim any
+rights to the name.
+
+We recognize that we are living in parallel with curl.com and wish them
+every success.
+
+## I have a problem, who do I mail?
+
+Please do not mail any single individual unless you really need to. Keep
+curl-related questions on a suitable mailing list. All available mailing lists
+are listed [online](https://curl.se/mail/).
+
+Keeping curl-related questions and discussions on mailing lists allows others
+to join in and help, to share their ideas, to contribute their suggestions and
+to spread their wisdom. Keeping discussions on public mailing lists also
+allows for others to learn from this (both current and future users thanks to
+the web based archives of the mailing lists), thus saving us from having to
+repeat ourselves even more. Thanks for respecting this.
+
+If you have found or suspect a security problem in curl or libcurl,
+[submit all the details to us](https://curl.se/dev/vuln-disclosure.html). We
+keep the issue private while we investigate, confirm it, work and validate a
+fix and agree on a time schedule for publication etc. That way we produce a
+fix in a timely manner before the flaw is announced to the world, reducing the
+impact the problem risks having on existing users.
+
+Security issues can also be taken to the curl security team by emailing
+security at curl.se (closed list of receivers, mails are not disclosed).
+
+## Where do I buy commercial support for curl?
+
+curl is fully open source. It means you can hire any skilled engineer to fix
+your curl-related problems.
+
+We list [available alternatives](https://curl.se/support.html).
+
+## How many are using curl?
+
+It is impossible to tell.
+
+We do not know how many users that knowingly have installed and use curl.
+
+We do not know how many users that use curl without knowing that they are in
+fact using it.
+
+We do not know how many users that downloaded or installed curl and then never
+use it.
+
+In 2025, we estimate that curl runs in roughly thirty billion installations
+world wide.
+
+## Why do you not update ca-bundle.crt
+
+In the curl project we have decided not to attempt to keep this file updated
+(or even present) since deciding what to add to a CA cert bundle is an
+undertaking we have not been ready to accept, and the one we can get from
+Mozilla is perfectly fine so there is no need to duplicate that work.
+
+Today, with many services performed over HTTPS, every operating system should
+come with a default CA cert bundle that can be deemed somewhat trustworthy and
+that collection (if reasonably updated) should be deemed to be a lot better
+than a private curl version.
+
+If you want the most recent collection of CA certs that Mozilla Firefox uses,
+we recommend using our online [CA certificate
+service](https://curl.se/docs/caextract.html) setup for this purpose.
+
+## I have a problem, who can I chat with?
+
+There is a bunch of friendly people hanging out in the #curl channel on the
+IRC network libera.chat. If you are polite and nice, chances are good that you
+can get -- or provide -- help instantly.
+
+## curl's ECCN number?
+
+The US government restricts exports of software that contains or uses
+cryptography. When doing so, the Export Control Classification Number (ECCN)
+is used to identify the level of export control etc.
+
+Apache Software Foundation has [a good explanation of
+ECCN](https://www.apache.org/dev/crypto.html).
+
+We believe curl's number might be ECCN 5D002, another possibility is 5D992. It
+seems necessary to write them (the authority that administers ECCN numbers),
+asking to confirm.
+
+Comprehensible explanations of the meaning of such numbers and how to obtain
+them (resp.) are [here](https://www.bis.gov/licensing/classify-your-item)
+and [here](https://www.bis.gov/licensing/classify-your-item/publicly-available-classification-information).
+
+An incomprehensible description of the two numbers above is available on
+[bis.doc.gov](https://www.bis.doc.gov/index.php/documents/new-encryption/1653-ccl5-pt2-3)
+
+## How do I submit my patch?
+
+We strongly encourage you to submit changes and improvements directly as [pull
+requests on GitHub](https://github.com/curl/curl/pulls).
+
+If you cannot or choose not to engage with GitHub, send your patch
+to the curl-library mailing list. We are many subscribers there and there are
+lots of people who can review patches, comment on them and receive them
+properly.
+
+Many more details are found in the
+[contribute](https://curl.se/dev/contribute.html) and
+[internals](https://curl.se/dev/internals.html)
+documents.
+
+## How do I port libcurl to my OS?
+
+Here's a rough step-by-step:
+
+1. copy a suitable `lib/config-*.h` file as a start to `lib/config-[youros].h`
+2. edit `lib/config-[youros].h` to match your OS and setup
+3. edit `lib/curl_setup.h` to include `config-[youros].h` when your OS is
+   detected by the preprocessor, in the style others already exist
+4. compile `lib/*.c` and make them into a library
+
+# Install
+
+## configure fails when using static libraries
+
+You may find that configure fails to properly detect the entire dependency
+chain of libraries when you provide static versions of the libraries that
+configure checks for.
+
+The reason why static libraries are much harder to deal with is that for them
+we do not get any help but the script itself must know or check what more
+libraries that are needed (with shared libraries, that dependency chain is
+handled automatically). This is an error-prone process and one that also tends
+to vary over time depending on the release versions of the involved components
+and may also differ between operating systems.
+
+For that reason, configure does few attempts to actually figure this out and
+you are instead encouraged to set `LIBS` and `LDFLAGS` accordingly when you invoke
+configure, and point out the needed libraries and set the necessary flags
+yourself.
+
+## Does curl work with other SSL libraries?
+
+curl has been written to use a generic SSL function layer internally, and
+that SSL functionality can then be provided by one out of many different SSL
+backends.
+
+curl can be built to use one of the following SSL alternatives: AWS-LC,
+BoringSSL, GnuTLS, LibreSSL, OpenSSL, mbedTLS, Rustls, Schannel (native
+Windows), or wolfSSL. They all have their pros and cons, and we maintain
+[a TLS library comparison](https://curl.se/docs/ssl-compared.html).
+
+## How do I upgrade curl.exe in Windows?
+
+The curl tool that is shipped as an integrated component of Windows 10 and
+Windows 11 is managed by Microsoft. If you were to delete the file or replace
+it with a newer version downloaded from [the curl
+website](https://curl.se/windows/), then Windows Update ceases to work on
+your system.
+
+There is no way to independently force an upgrade of the curl.exe that is part
+of Windows other than through the regular Windows update process. There is
+also nothing the curl project itself can do about this, since this is managed
+and controlled entirely by Microsoft as owners of the operating system.
+
+You can always download and install [the latest version of curl for
+Windows](https://curl.se/windows/) into a separate location.
+
+## Does curl support SOCKS (RFC 1928) ?
+
+Yes, SOCKS 4 and 5 are supported.
+
+# Usage
+
+## curl: (1) SSL is disabled, https: not supported
+
+If you get this output when trying to get anything from an HTTPS server, it
+means that the instance of curl/libcurl that you are using was built without
+support for this protocol.
+
+This could have happened if the configure script that was run at build time
+could not find all libs and include files curl requires for SSL to work. If
+the configure script fails to find them, curl is built without SSL
+support.
+
+To get HTTPS support into a curl that was previously built but that reports
+that HTTPS is not supported, you should dig through the document and logs and
+check out why the configure script does not find the SSL libs and/or include
+files.
+
+## How do I tell curl to resume a transfer?
+
+curl supports resumed transfers both ways on both FTP and HTTP. Try the `-C`
+option.
+
+## Why does my posting using -F not work?
+
+You cannot arbitrarily use `-F` or `-d`, the choice between `-F` or `-d`
+depends on the HTTP operation you need curl to do and what the web server that
+receives your post expects.
+
+If the form you are trying to submit uses the type 'multipart/form-data',
+then and only then you must use the -F type. In all the most common cases,
+you should use `-d` which then causes a posting with the type
+`application/x-www-form-urlencoded`.
+
+This is described in some detail in the
+[Manual](https://curl.se/docs/tutorial.html) and [The Art Of HTTP
+Scripting](https://curl.se/docs/httpscripting.html) documents, and if you do
+not understand it the first time, read it again before you post questions
+about this to the mailing list. Also, try reading through the mailing list
+archives for old postings and questions regarding this.
+
+## How do I tell curl to run custom FTP commands?
+
+You can tell curl to perform optional commands both before and/or after a file
+transfer. Study the `-Q`/`--quote` option.
+
+Since curl is used for file transfers, you do not normally use curl to perform
+FTP commands without transferring anything. Therefore you must always specify
+a URL to transfer to/from even when doing custom FTP commands, or use `-I`
+which implies the *no body* option sent to libcurl.
+
+## How can I disable the Accept: header?
+
+You can change this and all internally generated headers by adding a
+replacement with the `-H`/`--header` option. By adding a header with empty
+contents you safely disable that one. Use `-H Accept:` to disable that
+specific header.
+
+## Does curl support ASP, XML, XHTML or HTML version Y?
+
+To curl, all contents are alike. It does not matter how the page was
+generated. It may be ASP, PHP, Perl, shell-script, SSI or plain HTML
+files. There is no difference to curl and it does not even know what kind of
+language that generated the page.
+
+See also the separate question about JavaScript.
+
+## Can I use curl to delete/rename a file through FTP?
+
+Yes. You specify custom FTP commands with `-Q`/`--quote`.
+
+One example would be to delete a file after you have downloaded it:
+
+    curl -O ftp://example.com/coolfile -Q '-DELE coolfile'
+
+or rename a file after upload:
+
+    curl -T infile ftp://example.com/dir/ -Q "-RNFR infile" -Q "-RNTO newname"
+
+## How do I tell curl to follow HTTP redirects?
+
+curl does not follow so-called redirects by default. The `Location:` header that
+informs the client about this is only interpreted if you are using the
+`-L`/`--location` option. As in:
+
+    curl -L https://example.com
+
+Not all redirects are HTTP ones. See [Redirects work in browser but not with
+curl](#redirects-work-in-browser-but-not-with-curl)
+
+## How do I use curl in my favorite programming language?
+
+Many programming languages have interfaces and bindings that allow you to use
+curl without having to use the command line tool. If you are fluent in such a
+language, you may prefer to use one of these interfaces instead.
+
+Find out more about which languages that support curl directly, and how to
+install and use them, in the [libcurl section of the curl
+website](https://curl.se/libcurl/).
+
+All the various bindings to libcurl are made by other projects and people,
+outside of the curl project. The curl project itself only produces libcurl
+with its plain C API. If you do not find anywhere else to ask you can ask
+about bindings on the curl-library list too, but be prepared that people on
+that list may not know anything about bindings.
+
+In December 2025 there were around **60** different [interfaces
+available](https://curl.se/libcurl/bindings.html) for almost any language you
+can imagine.
+
+## What about SOAP, WebDAV, XML-RPC or similar protocols over HTTP?
+
+curl adheres to the HTTP spec, which means you can play with *any* protocol
+that is built on top of HTTP. Protocols such as SOAP, WebDAV and XML-RPC are
+all such ones. You can use `-X` to set custom requests and -H to set custom
+headers (or replace internally generated ones).
+
+Using libcurl of course also works and you would use the proper library
+options to do the same.
+
+## How do I POST with a different Content-Type?
+
+You can always replace the internally generated headers with `-H`/`--header`.
+To make a simple HTTP POST with `text/xml` as content-type, do something like:
+
+    curl -d "datatopost" -H "Content-Type: text/xml" [URL]
+
+## Why do FTP-specific features over HTTP proxy fail?
+
+Because when you use an HTTP proxy, the protocol spoken on the network is
+HTTP, even if you specify an FTP URL. This effectively means that you normally
+cannot use FTP-specific features such as FTP upload and FTP quote etc.
+
+There is one exception to this rule, and that is if you can *tunnel through*
+the given HTTP proxy. Proxy tunneling is enabled with a special option (`-p`)
+and is generally not available as proxy admins usually disable tunneling to
+ports other than 443 (which is used for HTTPS access through proxies).
+
+## Why do my single/double quotes fail?
+
+To specify a command line option that includes spaces, you might need to put
+the entire option within quotes. Like in:
+
+    curl -d " with spaces " example.com
+
+or perhaps
+
+    curl -d ' with spaces ' example.com
+
+Exactly what kind of quotes and how to do this is entirely up to the shell or
+command line interpreter that you are using. For most Unix shells, you can
+more or less pick either single (`'`) or double (`"`) quotes. For Windows/DOS
+command prompts you must use double (") quotes, and if the option string
+contains inner double quotes you can escape them with a backslash.
+
+For Windows PowerShell the arguments are not always passed on as expected
+because curl is not a PowerShell script. You may or may not be able to use
+single quotes. To escape inner double quotes seems to require a
+backslash-backtick escape sequence and the outer quotes as double quotes.
+
+Please study the documentation for your particular environment. Examples in
+the curl docs use a mix of both of these as shown above. You must adjust them
+to work in your environment.
+
+Remember that curl works and runs on more operating systems than most single
+individuals have ever tried.
+
+## Does curl support JavaScript or PAC (automated proxy config)?
+
+Many webpages do stuff using embedded JavaScript. curl and libcurl have
+no built-in support for that, so it is treated like any other contents.
+
+`.pac` files are a Netscape invention and are sometimes used by organizations
+to allow them to differentiate which proxies to use. The `.pac` contents is a
+JavaScript program that gets invoked by the browser and that returns the name
+of the proxy to connect to. Since curl does not support JavaScript, it cannot
+support .pac proxy configuration either.
+
+Some workarounds usually suggested to overcome this JavaScript dependency:
+
+Depending on the JavaScript complexity, write up a script that translates it
+to another language and execute that.
+
+Read the JavaScript code and rewrite the same logic in another language.
+
+Implement a JavaScript interpreter, people have successfully used the
+Mozilla JavaScript engine in the past.
+
+Ask your admins to stop this, for a static proxy setup or similar.
+
+## Can I do recursive fetches with curl?
+
+No. curl itself has no code that performs recursive operations, such as those
+performed by Wget and similar tools.
+
+There exists curl using scripts with that functionality, and you can write
+programs based on libcurl to do it, but the command line tool curl itself
+cannot.
+
+## What certificates do I need when I use SSL?
+
+There are three different kinds of certificates to keep track of when we talk
+about using SSL-based protocols (HTTPS or FTPS) using curl or libcurl.
+
+### Client certificate
+
+The server you communicate with may require that you can provide this in
+order to prove that you actually are who you claim to be. If the server
+does not require this, you do not need a client certificate.
+
+A client certificate is always used together with a private key, and the
+private key has a passphrase that protects it.
+
+### Server certificate
+
+The server you communicate with has a server certificate. You can and should
+verify this certificate to make sure that you are truly talking to the real
+server and not a server impersonating it.
+
+Servers often also provide an intermediate certificate. It acts as a bridge
+between a website's SSL certificate and a Certificate Authority's (CA) root
+certificate, creating a "chain of trust".
+
+### Certificate Authority Certificate ("CA cert")
+
+You often have several CA certs in a CA cert bundle that can be used to verify
+a server certificate that was signed by one of the authorities in the bundle.
+curl does not come with a CA cert bundle but most curl installs provide one.
+You can also override the default.
+
+Server certificate verification is enabled by default in curl and libcurl.
+Server certificates that are *self-signed* or otherwise signed by a CA that
+you do not have a CA cert for, cannot be verified. If the verification during
+a connect fails, you are refused access. You then might have to explicitly
+disable the verification to connect to the server.
+
+## How do I list the root directory of an FTP server?
+
+There are two ways. The way defined in the RFC is to use an encoded slash in
+the first path part. List the `/tmp` directory like this:
+
+    curl ftp://ftp.example.com/%2ftmp/
+
+The second way is non-standard but more readable; start the path section of the
+URL with a slash:
+
+    curl ftp://ftp.example.com//tmp/
+
+## Can I use curl to send a POST/PUT and not wait for a response?
+
+No.
+
+You can easily write your own program using libcurl to do such stunts.
+
+## How do I get HTTP from a host using a specific IP address?
+
+For example, you may be trying out a website installation that is not yet in
+the DNS. Or you have a site using multiple IP addresses for a given host
+name and you want to address a specific one out of the set.
+
+Set a custom `Host:` header that identifies the server name you want to reach
+but use the target IP address in the URL:
+
+    curl --header "Host: www.example.com" https://somewhere.example/
+
+You can also opt to add faked hostname entries to curl with the --resolve
+option. That has the added benefit to make things like redirects also work
+properly. The above operation would instead be done as:
+
+    curl --resolve www.example.com:80:127.0.0.1 https://www.example.com/
+
+## How to SFTP from my user's home directory?
+
+Contrary to how FTP works, SFTP and SCP URLs specify the exact directory to
+work with. It means that if you do not specify that you want the user's home
+directory, you get the actual root directory.
+
+To specify a file in your user's home directory, you need to use the correct
+URL syntax which for SFTP might look similar to:
+
+    curl -O -u user:password sftp://example.com/~/file.txt
+
+and for SCP it is a different protocol prefix:
+
+    curl -O -u user:password scp://example.com/~/file.txt
+
+## Protocol xxx not supported or disabled in libcurl
+
+When passing on a URL to curl to use, it may respond that the particular
+protocol is not supported or disabled. The particular way this error message
+is phrased is because curl does not make a distinction internally of whether a
+particular protocol is not supported (i.e. never got any code added that knows
+how to speak that protocol) or if it was explicitly disabled. curl can be
+built to only support a given set of protocols, and the rest would then be
+disabled or not supported.
+
+Note that this error also occurs if you pass a wrongly spelled protocol part
+as in `htpts://example.com` or as in the less evident case if you prefix
+the protocol part with a space as in `" https://example.com/"`.
+
+## curl `-X` gives me HTTP problems
+
+In normal circumstances, `-X` should hardly ever be used.
+
+By default you use curl without explicitly saying which request method to use
+when the URL identifies an HTTP transfer. If you pass in a URL like `curl
+https://example.com` it uses GET. If you use `-d` or `-F`, curl uses POST,
+`-I` causes a HEAD and `-T` makes it a PUT.
+
+If for whatever reason you are not happy with these default choices that curl
+does for you, you can override those request methods by specifying `-X
+[WHATEVER]`. This way you can for example send a DELETE by doing
+`curl -X DELETE [URL]`.
+
+It is thus pointless to do `curl -XGET [URL]` as GET would be used anyway. In
+the same vein it is pointless to do `curl -X POST -d data [URL]`. You can make
+a fun and somewhat rare request that sends a request-body in a GET request
+with something like `curl -X GET -d data [URL]`.
+
+Note that `-X` does not actually change curl's behavior as it only modifies
+the actual string sent in the request, but that may of course trigger a
+different set of events.
+
+Accordingly, by using `-XPOST` on a command line that for example would follow
+a 303 redirect, you effectively prevent curl from behaving correctly. Be aware.
+
+# Running
+
+## Why do I get problems when I use & or % in the URL?
+
+In general Unix shells, the & symbol is treated specially and when used, it
+runs the specified command in the background. To safely send the & as a part
+of a URL, you should quote the entire URL by using single (`'`) or double
+(`"`) quotes around it. Similar problems can also occur on some shells with
+other characters, including ?*!$~(){}<>\|;`. When in doubt, quote the URL.
+
+An example that would invoke a remote CGI that uses &-symbols could be:
+
+    curl 'https://www.example.com/cgi-bin/query?text=yes&q=curl'
+
+In Windows, the standard DOS shell treats the percent sign specially and you
+need to use TWO percent signs for each single one you want to use in the URL.
+
+If you want a literal percent sign to be part of the data you pass in a POST
+using `-d`/`--data` you must encode it as `%25` (which then also needs the
+percent sign doubled on Windows machines).
+
+## How can I use {, }, [ or ] to specify multiple URLs?
+
+Because those letters have a special meaning to the shell, to be used in a URL
+specified to curl you must quote them.
+
+An example that downloads two URLs (sequentially) would be:
+
+    curl '{curl,www}.haxx.se'
+
+To be able to use those characters as actual parts of the URL (without using
+them for the curl URL *globbing* system), use the `-g`/`--globoff` option:
+
+    curl -g 'www.example.com/weirdname[].html'
+
+## Why do I get downloaded data even though the webpage does not exist?
+
+curl asks remote servers for the page you specify. If the page does not exist
+at the server, the HTTP protocol defines how the server should respond and
+that means that headers and a page get returned. That is how HTTP works.
+
+By using the `--fail` option you can tell curl explicitly to not get any data
+if the HTTP return code does not say success.
+
+## Why do I get return code XXX from an HTTP server?
+
+RFC 2616 clearly explains the return codes. This is a short transcript. Go
+read the RFC for exact details:
+
+### 400 Bad Request
+
+The request could not be understood by the server due to malformed
+syntax. The client SHOULD NOT repeat the request without modifications.
+
+### 401 Unauthorized
+
+The request requires user authentication.
+
+### 403 Forbidden
+
+The server understood the request, but is refusing to fulfill it.
+Authorization cannot help and the request SHOULD NOT be repeated.
+
+### 404 Not Found
+
+The server has not found anything matching the Request-URI. No indication is
+given as to whether the condition is temporary or permanent.
+
+### 405 Method Not Allowed
+
+The method specified in the Request-Line is not allowed for the resource
+identified by the Request-URI. The response MUST include an `Allow:` header
+containing a list of valid methods for the requested resource.
+
+### 301 Moved Permanently
+
+If you get this return code and an HTML output similar to this:
+
+    <H1>Moved Permanently</H1> The document has moved <A
+    HREF="https://same_url_now_with_a_trailing_slash.example/">here</A>.
+
+it might be because you requested a directory URL but without the trailing
+slash. Try the same operation again _with_ the trailing URL, or use the
+`-L`/`--location` option to follow the redirection.
+
+## Can you tell me what error code 142 means?
+
+All curl error codes are described at the end of the man page, in the section
+called **EXIT CODES**.
+
+Error codes that are larger than the highest documented error code means that
+curl has exited due to a crash. This is a serious error, and we appreciate a
+detailed bug report from you that describes how we could go ahead and repeat
+this.
+
+## How do I keep usernames and passwords secret in curl command lines?
+
+This problem has two sides:
+
+The first part is to avoid having clear-text passwords in the command line so
+that they do not appear in *ps* outputs and similar. That is easily avoided by
+using the `-K` option to tell curl to read parameters from a file or stdin to
+which you can pass the secret info. curl itself also attempts to hide the given
+password by blanking out the option - this does not work on all platforms.
+
+To keep the passwords in your account secret from the rest of the world is
+not a task that curl addresses. You could of course encrypt them somehow to
+at least hide them from being read by human eyes, but that is not what
+anyone would call security.
+
+Also note that regular HTTP (using Basic authentication) and FTP passwords are
+sent as cleartext across the network. All it takes for anyone to fetch them is
+to listen on the network. Eavesdropping is easy. Use more secure
+authentication methods (like Digest, Negotiate or even NTLM) or consider the
+SSL-based alternatives HTTPS and FTPS.
+
+## I found a bug
+
+It is not a bug if the behavior is documented. Read the docs first. Especially
+check out the KNOWN_BUGS file, it may be a documented bug.
+
+If it is a problem with a binary you have downloaded or a package for your
+particular platform, try contacting the person who built the package/archive
+you have.
+
+If there is a bug, read the BUGS document first. Then report it as described
+in there.
+
+## curl cannot authenticate to a server that requires NTLM?
+
+NTLM support requires OpenSSL, GnuTLS, mbedTLS or Microsoft Windows libraries
+at build-time to provide this functionality.
+
+## My HTTP request using HEAD, PUT or DELETE does not work
+
+Many web servers allow or demand that the administrator configures the server
+properly for these requests to work on the web server.
+
+Some servers seem to support HEAD only on certain kinds of URLs.
+
+To fully grasp this, try the documentation for the particular server software
+you are trying to interact with. This is not anything curl can do anything
+about.
+
+## Why do my HTTP range requests return the full document?
+
+Because the range may not be supported by the server, or the server may choose
+to ignore it and return the full document anyway.
+
+## Why do I get "certificate verify failed" ?
+
+When you invoke curl and get an error 60 error back it means that curl could
+not verify that the server's certificate was good. curl verifies the
+certificate using the CA cert bundle and verifying for which names the
+certificate has been granted.
+
+To completely disable the certificate verification, use `-k`. This does
+however enable man-in-the-middle attacks and makes the transfer **insecure**.
+We strongly advise against doing this for more than experiments.
+
+If you get this failure with a CA cert bundle installed and used, the server's
+certificate might not be signed by one of the certificate authorities in your
+CA store. It might for example be self-signed. You then correct this problem
+by obtaining a valid CA cert for the server. Or again, decrease the security
+by disabling this check.
+
+At times, you find that the verification works in your favorite browser but
+fails in curl. When this happens, the reason is usually that the server sends
+an incomplete cert chain. The server is mandated to send all *intermediate
+certificates* but does not. This typically works with browsers anyway since
+they A) cache such certs and B) supports AIA which downloads such missing
+certificates on demand. This is a bad server configuration. A good way to
+figure out if this is the case it to use [the SSL Labs
+server](https://www.ssllabs.com/ssltest/) test and check the certificate
+chain.
+
+Details are also in [the SSL certificates
+document](https://curl.se/docs/sslcerts.html).
+
+## Why is curl -R on Windows one hour off?
+
+Since curl 7.53.0 this issue should be fixed as long as curl was built with
+any modern compiler that allows for a 64-bit curl_off_t type. For older
+compilers or prior curl versions it may set a time that appears one hour off.
+This happens due to a flaw in how Windows stores and uses file modification
+times and it is not easily worked around. For more details
+[read this](https://web.archive.org/web/20050715084352/codeproject.com/datetime/dstbugs.asp).
+
+## Redirects work in browser but not with curl
+
+curl supports HTTP redirects well (see a previous question above). Browsers
+generally support at least two other ways to perform redirects that curl does
+not:
+
+Meta tags. You can write an HTML tag that causes the browser to redirect
+to another given URL after a certain time.
+
+JavaScript. You can write a JavaScript program embedded in an HTML page that
+redirects the browser to another given URL.
+
+There is no way to make curl follow these redirects. You must either manually
+figure out what the page is set to do, or write a script that parses the
+results and fetches the new URL.
+
+## FTPS does not work
+
+curl supports FTPS (sometimes known as FTP-SSL) both implicit and explicit
+mode.
+
+When a URL is used that starts with `ftps://`, curl assumes implicit SSL on
+the control connection and therefore immediately connects and tries to speak
+SSL. `ftps://` connections default to port 990.
+
+To use explicit FTPS, you use an `ftp://` URL and the `--ssl-reqd` option (or
+one of its related flavors). This is the most common method, and the one
+mandated by RFC 4217. This kind of connection then of course uses the standard
+FTP port 21 by default.
+
+## My HTTP POST or PUT requests are slow
+
+libcurl makes all POST and PUT requests (except for requests with a small
+request body) use the `Expect: 100-continue` header. This header allows the
+server to deny the operation early so that libcurl can bail out before having
+to send any data. This is useful in authentication cases and others.
+
+Many servers do not implement the `Expect:` stuff properly and if the server
+does not respond (positively) within 1 second libcurl continues and sends
+off the data anyway.
+
+You can disable libcurl's use of the `Expect:` header the same way you disable
+any header, using `-H` / `CURLOPT_HTTPHEADER`, or by forcing it to use HTTP
+1.0.
+
+## Non-functional connect timeouts
+
+In most Windows setups having a timeout longer than 21 seconds makes no
+difference, as it only sends 3 TCP SYN packets and no more. The second
+packet sent three seconds after the first and the third six seconds after
+the second. No more than three packets are sent, no matter how long the
+timeout is set.
+
+See Windows option `TcpMaxConnectRetransmissions` for more.
+
+Also, even on non-Windows systems there may run a firewall or anti-virus
+software or similar that accepts the connection but does not actually do
+anything else. This makes (lib)curl to consider the connection connected
+and thus the connect timeout does not trigger.
+
+## `file://` URLs containing drive letters (Windows, NetWare)
+
+When using curl to try to download a local file, one might use a URL in this
+format:
+
+    file://D:/blah.txt
+
+you find that even if `D:\blah.txt` does exist, curl returns a 'file not
+found' error.
+
+According to [RFC 1738](https://datatracker.ietf.org/doc/html/rfc1738),
+`file://` URLs must contain a host component, but it is ignored by most
+implementations. In the above example, `D:` is treated as the host component,
+and is taken away. Thus, curl tries to open `/blah.txt`. If your system is
+installed to drive C:, that resolves to `C:\blah.txt`, and if that does
+not exist you get the not found error.
+
+To fix this problem, use `file://` URLs with *three* leading slashes:
+
+    file:///D:/blah.txt
+
+Alternatively, if it makes more sense, specify `localhost` as the host
+component:
+
+    file://localhost/D:/blah.txt
+
+In either case, curl should now be looking for the correct file.
+
+## Why does not curl return an error when the network cable is unplugged?
+
+Unplugging a cable is not an error situation. The TCP/IP protocol stack was
+designed to be fault tolerant, so even though there may be a physical break
+somewhere the connection should not be affected, but possibly delayed.
+Eventually, the physical break gets fixed or the data re-routed around
+the physical problem through another path.
+
+In such cases, the TCP/IP stack is responsible for detecting when the network
+connection is irrevocably lost. Since with some protocols it is perfectly
+legal for the client to wait indefinitely for data, the stack may never report
+a problem, and even when it does, it can take up to 20 minutes for it to
+detect an issue. The curl option `--keepalive-time` enables keep-alive support
+in the TCP/IP stack which makes it periodically probe the connection to make
+sure it is still available to send data. That should reliably detect any
+TCP/IP network failure.
+
+TCP keep alive does not detect the network going down before the TCP/IP
+connection is established (e.g. during a DNS lookup) or using protocols that
+do not use TCP. To handle those situations, curl offers a number of timeouts
+on its own. `--speed-limit`/`--speed-time` aborts if the data transfer rate
+falls too low, and `--connect-timeout` and `--max-time` can be used to put
+an overall timeout on the connection phase or the entire transfer.
+
+A libcurl-using application running in a known physical environment (e.g. an
+embedded device with only a single network connection) may want to act
+immediately if its lone network connection goes down. That can be achieved by
+having the application monitor the network connection on its own using an
+OS-specific mechanism, then signaling libcurl to abort.
+
+## curl does not return error for HTTP non-200 responses
+
+Correct. Unless you use `-f` (`--fail`) or `--fail-with-body`.
+
+When doing HTTP transfers, curl performs exactly what you are asking it to
+do and if successful it does not return an error. You can use curl to test
+your web server's "file not found" page (that gets 404 back), you can use it
+to check your authentication protected webpages (that gets a 401 back) and so
+on.
+
+The specific HTTP response code does not constitute a problem or error for
+curl. It sends and delivers HTTP as you asked and if that worked,
+everything is fine and dandy. The response code is generally providing more
+higher level error information that curl does not care about. The error was
+not in the HTTP transfer.
+
+If you want your command line to treat error codes in the 400 and up range as
+errors and thus return a non-zero value and possibly show an error message,
+curl has a dedicated option for that: `-f` (`CURLOPT_FAILONERROR` in libcurl
+speak).
+
+You can also use the `-w` option and the variable `%{response_code}` to
+extract the exact response code that was returned in the response.
+
+# libcurl
+
+## Is libcurl thread-safe?
+
+Yes.
+
+We have written the libcurl code specifically adjusted for multi-threaded
+programs. libcurl uses thread-safe functions instead of non-safe ones if your
+system has such. Note that you must never share the same handle in multiple
+threads.
+
+There may be some exceptions to thread-safety depending on how libcurl was
+built. Please review [the guidelines for thread
+safety](https://curl.se/libcurl/c/threadsafe.html) to learn more.
+
+## How can I receive all data into a large memory chunk?
+
+(See the [get in memory](https://curl.se/libcurl/c/getinmemory.html) example.)
+
+You are in full control of the callback function that gets called every time
+there is data received from the remote server. You can make that callback do
+whatever you want. You do not have to write the received data to a file.
+
+One solution to this problem could be to have a pointer to a struct that you
+pass to the callback function. You set the pointer using the CURLOPT_WRITEDATA
+option. Then that pointer is passed to the callback instead of a FILE *
+to a file:
+
+~~~c
+/* store data this struct */
+struct MemoryStruct {
+  char *memory;
+  size_t size;
+};
+
+/* imaginary callback function */
+size_t
+WriteMemoryCallback(void *ptr, size_t size, size_t nmemb, void *data)
+{
+  size_t realsize = size * nmemb;
+  struct MemoryStruct *mem = (struct MemoryStruct *)data;
+
+  mem->memory = realloc(mem->memory, mem->size + realsize + 1);
+  if(mem->memory) {
+    memcpy(&(mem->memory[mem->size]), ptr, realsize);
+    mem->size += realsize;
+    mem->memory[mem->size] = 0;
+  }
+  return realsize;
+}
+~~~
+
+## How do I fetch multiple files with libcurl?
+
+libcurl has excellent support for transferring multiple files. You should
+repeatedly set new URLs with `curl_easy_setopt()` and then transfer it with
+`curl_easy_perform()`. The handle you get from curl_easy_init() is not only
+reusable, but you are even encouraged to reuse it if you can, as that
+enables libcurl to use persistent connections.
+
+## Does libcurl do Winsock initialization on Win32 systems?
+
+Yes, if told to in the `curl_global_init()` call.
+
+## Does CURLOPT_WRITEDATA and CURLOPT_READDATA work on Win32 ?
+
+Yes, but you cannot open a FILE * and pass the pointer to a DLL and have that
+DLL use the FILE * (as the DLL and the client application cannot access each
+others' variable memory areas). If you set `CURLOPT_WRITEDATA` you must also use
+`CURLOPT_WRITEFUNCTION` as well to set a function that writes the file, even if
+all it does is write the data to the specified FILE *. Similarly, if you use
+`CURLOPT_READDATA` you must also specify `CURLOPT_READFUNCTION`.
+
+## What about Keep-Alive or persistent connections?
+
+curl and libcurl have excellent support for persistent connections when
+transferring several files from the same server. curl attempts to reuse
+connections for all URLs specified on the same command line/config file, and
+libcurl reuses connections for all transfers that are made using the same
+libcurl handle.
+
+When you use the easy interface the connection cache is kept within the easy
+handle. If you instead use the multi interface, the connection cache is kept
+within the multi handle and shared among all the easy handles that are used
+within the same multi handle.
+
+## Link errors when building libcurl on Windows
+
+You need to make sure that your project, and all the libraries (both static
+and dynamic) that it links against, are compiled/linked against the same run
+time library.
+
+This is determined by the `/MD`, `/ML`, `/MT` (and their corresponding `/M?d`)
+options to the command line compiler. `/MD` (linking against `MSVCRT.dll`)
+seems to be the most commonly used option.
+
+When building an application that uses the static libcurl library, you must
+add `-DCURL_STATICLIB` to your `CFLAGS`. Otherwise the linker looks for
+dynamic import symbols. If you are using Visual Studio, you need to instead
+add `CURL_STATICLIB` in the "Preprocessor Definitions" section.
+
+If you get a linker error like `unknown symbol __imp__curl_easy_init ...` you
+have linked against the wrong (static) library. If you want to use the
+libcurl.dll and import lib, you do not need any extra `CFLAGS`, but use one of
+the import libraries below. These are the libraries produced by the various
+lib/Makefile.* files:
+
+| Target         | static lib     | import lib for DLL |
+|----------------|----------------|--------------------|
+| MinGW          | `libcurl.a`    | `libcurldll.a`     |
+| MSVC (release) | `libcurl.lib`  | `libcurl_imp.lib`  |
+| MSVC (debug)   | `libcurld.lib` | `libcurld_imp.lib` |
+
+## libcurl.so.X: open failed: No such file or directory
+
+This is an error message you might get when you try to run a program linked
+with a shared version of libcurl and your runtime linker (`ld.so`) could not
+find the shared library named `libcurl.so.X`. (Where X is the number of the
+current libcurl ABI, typically 3 or 4).
+
+You need to make sure that `ld.so` finds `libcurl.so.X`. You can do that
+multiple ways, and it differs somewhat between different operating systems.
+They are usually:
+
+* Add an option to the linker command line that specify the hard-coded path
+  the runtime linker should check for the lib (usually `-R`)
+* Set an environment variable (`LD_LIBRARY_PATH` for example) where `ld.so`
+  should check for libs
+* Adjust the system's config to check for libs in the directory where you have
+  put the library (like Linux's `/etc/ld.so.conf`)
+
+`man ld.so` and `man ld` tells you more details
+
+## How does libcurl resolve hostnames?
+
+libcurl supports a large number of name resolve functions. One of them is
+picked at build-time and used unconditionally. Thus, if you want to change
+name resolver function you must rebuild libcurl and tell it to use
+a different function.
+
+### The non-IPv6 resolver
+
+The non-IPv6 resolver that can use one of four different hostname resolve
+calls depending on what your system supports:
+
+1. gethostbyname()
+2. gethostbyname_r() with 3 arguments
+3. gethostbyname_r() with 5 arguments
+4. gethostbyname_r() with 6 arguments
+
+### The IPv6 resolver
+
+Uses getaddrinfo()
+
+### The cares resolver
+
+The c-ares based name resolver that uses the c-ares library for resolves.
+Using this offers asynchronous name resolves.
+
+## The threaded resolver
+
+It uses the IPv6 or the non-IPv6 resolver solution in a temporary thread.
+
+## How do I prevent libcurl from writing the response to stdout?
+
+libcurl provides a default built-in write function that writes received data
+to stdout. Set the `CURLOPT_WRITEFUNCTION` to receive the data, or possibly
+set `CURLOPT_WRITEDATA` to a different FILE * handle.
+
+## How do I make libcurl not receive the whole HTTP response?
+
+You make the write callback (or progress callback) return an error and libcurl
+then aborts the transfer.
+
+## Can I make libcurl fake or hide my real IP address?
+
+No. libcurl operates on a higher level. Besides, faking IP address would
+imply sending IP packets with a made-up source address, and then you normally
+get a problem with receiving the packet sent back as they would then not be
+routed to you.
+
+If you use a proxy to access remote sites, the sites do not see your local
+IP address but instead the address of the proxy.
+
+Also note that on many networks NATs or other IP-munging techniques are used
+that makes you see and use a different IP address locally than what the remote
+server is seeing you coming from. You may also consider using
+[Tor](https://www.torproject.org/).
+
+## How do I stop an ongoing transfer?
+
+With the easy interface you make sure to return the correct error code from
+one of the callbacks, but none of them are instant. There is no function you
+can call from another thread or similar that stops it immediately.
+Instead, you need to make sure that one of the callbacks you use returns an
+appropriate value that stops the transfer. Suitable callbacks that you can
+do this with include the progress callback, the read callback and the write
+callback.
+
+If you are using the multi interface, you can also stop a transfer by removing
+the particular easy handle from the multi stack at any moment you think the
+transfer is done or when you wish to abort the transfer.
+
+## Using C++ non-static functions for callbacks?
+
+libcurl is a C library, it does not know anything about C++ member functions.
+
+You can overcome this limitation with relative ease using a static member
+function that is passed a pointer to the class:
+
+~~~c++
+// f is the pointer to your object.
+static size_t YourClass::func(char *buffer, size_t sz, size_t n, void *f)
+{
+  // Call non-static member function.
+  static_cast<YourClass*>(f)->nonStaticFunction();
+}
+
+// This is how you pass pointer to the static function:
+curl_easy_setopt(hcurl, CURLOPT_WRITEFUNCTION, YourClass::func);
+curl_easy_setopt(hcurl, CURLOPT_WRITEDATA, this);
+~~~
+
+## How do I get an FTP directory listing?
+
+If you end the FTP URL you request with a slash, libcurl provides you with
+a directory listing of that given directory. You can also set
+`CURLOPT_CUSTOMREQUEST` to alter what exact listing command libcurl would use
+to list the files.
+
+The follow-up question tends to be how is a program supposed to parse the
+directory listing. How does it know what's a file and what's a directory and
+what's a symlink etc. If the FTP server supports the `MLSD` command then it
+returns data in a machine-readable format that can be parsed for type. The
+types are specified by RFC 3659 section 7.5.1. If `MLSD` is not supported then
+you have to work with what you are given. The `LIST` output format is entirely
+at the server's own liking and the `NLST` output does not reveal any types and
+in many cases does not even include all the directory entries. Also, both
+`LIST` and `NLST` tend to hide Unix-style hidden files (those that start with
+a dot) by default so you need to do `LIST -a` or similar to see them.
+
+Example - List only directories. `ftp.funet.fi` supports `MLSD` and
+`ftp.kernel.org` does not:
+
+    curl -s ftp.funet.fi/pub/ -X MLSD | \
+      perl -lne 'print if s/(?:^|;)type=dir;[^ ]+ (.+)$/$1/'
+
+    curl -s ftp.kernel.org/pub/linux/kernel/ | \
+      perl -lne 'print if s/^d[-rwx]{9}(?: +[^ ]+){7} (.+)$/$1/'
+
+If you need to parse LIST output, libcurl provides the ability to specify a
+wildcard to download multiple files from an FTP directory.
+
+## I want a different time-out
+
+Sometimes users realize that `CURLOPT_TIMEOUT` and `CURLOPT_CONNECTIMEOUT` are
+not sufficiently advanced or flexible to cover all the various use cases and
+scenarios applications end up with.
+
+libcurl offers many more ways to time-out operations. A common alternative is
+to use the `CURLOPT_LOW_SPEED_LIMIT` and `CURLOPT_LOW_SPEED_TIME` options to
+specify the lowest possible speed to accept before to consider the transfer
+timed out.
+
+The most flexible way is by writing your own time-out logic and using
+`CURLOPT_XFERINFOFUNCTION` (perhaps in combination with other callbacks) and
+use that to figure out exactly when the right condition is met when the
+transfer should get stopped.
+
+## Can I write a server with libcurl?
+
+No. libcurl offers no functions or building blocks to build any kind of
+Internet protocol server. libcurl is only a client-side library. For server
+libraries, you need to continue your search elsewhere but there exist many
+good open source ones out there for most protocols you could want a server
+for. There are also really good stand-alone servers that have been tested and
+proven for many years. There is no need for you to reinvent them.
+
+## Does libcurl use threads?
+
+No, libcurl executes in the same thread you call it in. All callbacks are
+called in the same thread as the one you call libcurl in.
+
+If you want to avoid your thread to be blocked by the libcurl call, you make
+sure you use the non-blocking multi API which does transfers
+asynchronously - still in the same single thread.
+
+libcurl does potentially internally use threads for name resolving, if it was
+built to work like that, but in those cases it creates the child threads by
+itself and they are only used and then killed internally by libcurl and never
+exposed to the outside.
+
+# License
+
+curl and libcurl are released under an MIT/X derivative license. The license
+is liberal and should not impose a problem for your project. This section is a
+brief summary for the cases we get the most questions.
+
+We are not lawyers and this is not legal advice. You should probably consult
+one if you want true and accurate legal insights without our prejudice. Note
+especially that this section concerns the libcurl license only; compiling in
+features of libcurl that depend on other libraries (e.g. OpenSSL) may affect
+the licensing obligations of your application.
+
+## I have a GPL program, can I use the libcurl library?
+
+Yes
+
+Since libcurl may be distributed under the MIT/X derivative license, it can be
+used together with GPL in any software.
+
+## I have a closed-source program, can I use the libcurl library?
+
+Yes
+
+libcurl does not put any restrictions on the program that uses the library.
+
+## I have a BSD licensed program, can I use the libcurl library?
+
+Yes
+
+libcurl does not put any restrictions on the program that uses the library.
+
+## I have a program that uses LGPL libraries, can I use libcurl?
+
+Yes
+
+The LGPL license does not clash with other licenses.
+
+## Can I modify curl/libcurl for my program and keep the changes secret?
+
+Yes
+
+The MIT/X derivative license practically allows you to do almost anything with
+the sources, on the condition that the copyright texts in the sources are left
+intact.
+
+## Can you please change the curl/libcurl license?
+
+No.
+
+We have carefully picked this license after years of development and
+discussions and a large amount of people have contributed with source code
+knowing that this is the license we use. This license puts the restrictions we
+want on curl/libcurl and it does not spread to other programs or libraries
+that use it. It should be possible for everyone to use libcurl or curl in
+their projects, no matter what license they already have in use.
+
+## What are my obligations when using libcurl in my commercial apps?
+
+Next to none. All you need to adhere to is the MIT-style license (stated in
+the COPYING file) which says you have to include the copyright notice in *all
+copies* and that you may not use the copyright holder's name when promoting
+your software.
+
+You do not have to release any of your source code.
+
+You do not have to reveal or make public any changes to the libcurl source
+code.
+
+You do not have to broadcast to the world that you are using libcurl within
+your app.
+
+All we ask is that you disclose *the copyright notice and this permission
+notice* somewhere. Most probably like in the documentation or in the section
+where other third party dependencies already are mentioned and acknowledged.
+
+As can be seen [here](https://curl.se/docs/companies.html) and elsewhere, more
+and more companies are discovering the power of libcurl and take advantage of
+it even in commercial environments.
+
+## What license does curl use exactly?
+
+curl is released under an [MIT derivative
+license](https://curl.se/docs/copyright.html). It is similar but not identical
+to the MIT license.
+
+The difference is considered big enough to make SPDX list it under its own
+identifier: [curl](https://spdx.org/licenses/curl.html).
+
+The changes done to the license that make it uniquely curl were tiny and
+well-intended, but the reasons for them have been forgotten and we strongly
+discourage others from doing the same thing.
+
+# PHP/CURL
+
+## What is PHP/CURL?
+
+The module for PHP that makes it possible for PHP programs to access curl
+functions from within PHP.
+
+In the curl project we call this module PHP/CURL to differentiate it from curl
+the command line tool and libcurl the library. The PHP team however does not
+refer to it like this (for unknown reasons). They call it plain CURL (often
+using all caps) or sometimes ext/curl, but both cause much confusion to users
+which in turn gives us a higher question load.
+
+## Who wrote PHP/CURL?
+
+PHP/CURL was initially written by Sterling Hughes.
+
+## Can I perform multiple requests using the same handle?
+
+Yes.
+
+After a transfer, you set new options in the handle and make another transfer.
+This makes libcurl reuse the same connection if it can.
+
+## Does PHP/CURL have dependencies?
+
+PHP/CURL is a module that comes with the regular PHP package. It depends on
+and uses libcurl, so you need to have libcurl installed properly before
+PHP/CURL can be used.
+
+# Development
+
+## Why does curl use C89?
+
+As with everything in curl, there is a history and we keep using what we have
+used before until someone brings up the subject and argues for and works on
+changing it.
+
+We started out using C89 in the 1990s because that was the only way to write a
+truly portable C program and have it run as widely as possible. C89 was for a
+long time even necessary to make things work on otherwise considered modern
+platforms such as Windows. Today, we do not really know how many users that
+still require the use of a C89 compiler.
+
+We continue to use C89 for as long as nobody brings up a strong enough reason
+for us to change our minds. The core developers of the project do not feel
+restricted by this and we are not convinced that going C99 offers us enough
+of a benefit to warrant the risk of cutting off a share of users.
+
+## Would curl be rewritten?
+
+In one go: no. Little by little over time? Sure.
+
+Over the years, new languages and clever operating environments come and go.
+Every now and then the urge apparently arises to request that we rewrite curl
+in another language.
+
+Some the most important properties in curl are maintaining the API and ABI for
+libcurl and keeping the behavior for the command line tool. As long as we can
+do that, everything else is up for discussion. To maintain the ABI, we
+probably have to maintain a certain amount of code in C, and to remain rock
+stable, we never risk anything by rewriting a lot of things in one go.
+That said, we can certainly offer more and more optional backends written in
+other languages, as long as those backends can be plugged in at build-time.
+Backends can be written in any language, but should probably provide APIs
+usable from C to ease integration and transition.
diff --git a/third-party/curl/docs/FEATURES.md b/third-party/curl/docs/FEATURES.md
index 9f763d3a70..a7f1845056 100644
--- a/third-party/curl/docs/FEATURES.md
+++ b/third-party/curl/docs/FEATURES.md
@@ -1,219 +1,249 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # Features -- what curl can do
 
 ## curl tool
 
- - config file support
- - multiple URLs in a single command line
- - range "globbing" support: [0-13], {one,two,three}
- - multiple file upload on a single command line
- - custom maximum transfer rate
- - redirect stderr
- - parallel transfers
+- config file support
+- multiple URLs in a single command line
+- range "globbing" support: [0-13], {one,two,three}
+- multiple file upload on a single command line
+- redirect stderr
+- parallel transfers
 
 ## libcurl
 
- - full URL syntax with no length limit
- - custom maximum download time
- - custom least download speed acceptable
- - custom output result after completion
- - guesses protocol from host name unless specified
- - uses .netrc
- - progress bar with time statistics while downloading
- - "standard" proxy environment variables support
- - compiles on win32 (reported builds on 70+ operating systems)
- - selectable network interface for outgoing traffic
- - IPv6 support on Unix and Windows
- - happy eyeballs dual-stack connects
- - persistent connections
- - SOCKS 4 + 5 support, with or without local name resolving
- - supports user name and password in proxy environment variables
- - operations through HTTP proxy "tunnel" (using CONNECT)
- - replaceable memory functions (malloc, free, realloc, etc)
- - asynchronous name resolving (6)
- - both a push and a pull style interface
- - international domain names (10)
+- URL RFC 3986 syntax
+- custom maximum download time
+- custom lowest download speed acceptable
+- custom output result after completion
+- guesses protocol from hostname unless specified
+- supports .netrc
+- progress bar with time statistics while downloading
+- standard proxy environment variables support
+- have run on 101 operating systems and 28 CPU architectures
+- selectable network interface for outgoing traffic
+- IPv6 support on Unix and Windows
+- happy eyeballs dual-stack IPv4 + IPv6 connects
+- persistent connections
+- SOCKS 4 + 5 support, with or without local name resolving
+- *pre-proxy* support, for *proxy chaining*
+- supports username and password in proxy environment variables
+- operations through HTTP proxy "tunnel" (using CONNECT)
+- replaceable memory functions (malloc, free, realloc, etc)
+- asynchronous name resolving
+- both a push and a pull style interface
+- international domain names (IDN)
+- transfer rate limiting
+- stable API and ABI
+- TCP keep alive
+- TCP Fast Open
+- DNS cache (that can be shared between transfers)
+- non-blocking single-threaded parallel transfers
+- Unix domain sockets to server or proxy
+- DNS-over-HTTPS
+- uses non-blocking name resolves
+- selectable name resolver backend
+
+## URL API
+
+- parses RFC 3986 URLs
+- generates URLs from individual components
+- manages "redirects"
+
+## Header API
+
+- easy access to HTTP response headers, from all contexts
+- named headers
+- iterate over headers
+
+## TLS
+
+- selectable TLS backend(s)
+- TLS False Start
+- TLS version control
+- TLS session resumption
+- key pinning
+- mutual authentication
+- Use dedicated CA cert bundle
+- Use OS-provided CA store
+- separate TLS options for HTTPS proxy
 
 ## HTTP
 
- - HTTP/0.9 responses are optionally accepted
- - HTTP/1.0
- - HTTP/1.1
- - HTTP/2, including multiplexing and server push (5)
- - GET
- - PUT
- - HEAD
- - POST
- - multipart formpost (RFC 1867-style)
- - authentication: Basic, Digest, NTLM (9) and Negotiate (SPNEGO) (3)
-   to server and proxy
- - resume (both GET and PUT)
- - follow redirects
- - maximum amount of redirects to follow
- - custom HTTP request
- - cookie get/send fully parsed
- - reads/writes the Netscape cookie file format
- - custom headers (replace/remove internally generated headers)
- - custom user-agent string
- - custom referrer string
- - range
- - proxy authentication
- - time conditions
- - via HTTP proxy, HTTPS proxy or SOCKS proxy
- - retrieve file modification date
- - Content-Encoding support for deflate and gzip
- - "Transfer-Encoding: chunked" support in uploads
- - automatic data compression (11)
+- HTTP/0.9 responses are optionally accepted
+- HTTP/1.0
+- HTTP/1.1
+- HTTP/2, including multiplexing and server push
+- GET
+- PUT
+- HEAD
+- POST
+- multipart formpost (RFC 1867-style)
+- authentication: Basic, Digest, NTLM (9) and Negotiate (SPNEGO)
+  to server and proxy
+- resume transfers
+- follow redirects
+- maximum amount of redirects to follow
+- custom HTTP request
+- cookie get/send fully parsed
+- reads/writes the Netscape cookie file format
+- custom headers (replace/remove internally generated headers)
+- custom user-agent string
+- custom referrer string
+- range
+- proxy authentication
+- time conditions
+- via HTTP proxy, HTTPS proxy or SOCKS proxy
+- HTTP/2 or HTTP/1.1 to HTTPS proxy
+- retrieve file modification date
+- Content-Encoding support for deflate, gzip, brotli and zstd
+- "Transfer-Encoding: chunked" support in uploads
+- HSTS
+- alt-svc
+- ETags
+- HTTP/1.1 trailers, both sending and getting
 
-## HTTPS (1)
+## HTTPS
 
- - (all the HTTP features)
- - HTTP/3 experimental support
- - using client certificates
- - verify server certificate
- - via HTTP proxy, HTTPS proxy or SOCKS proxy
- - select desired encryption
- - select usage of a specific SSL version
+- HTTP/3
+- using client certificates
+- verify server certificate
+- via HTTP proxy, HTTPS proxy or SOCKS proxy
+- select desired encryption
+- select usage of a specific TLS version
+- ECH
 
 ## FTP
 
- - download
- - authentication
- - Kerberos 5 (12)
- - active/passive using PORT, EPRT, PASV or EPSV
- - single file size information (compare to HTTP HEAD)
- - 'type=' URL support
- - dir listing
- - dir listing names-only
- - upload
- - upload append
- - upload via http-proxy as HTTP PUT
- - download resume
- - upload resume
- - custom ftp commands (before and/or after the transfer)
- - simple "range" support
- - via HTTP proxy, HTTPS proxy or SOCKS proxy
- - all operations can be tunneled through proxy
- - customizable to retrieve file modification date
- - no dir depth limit
+- download
+- authentication
+- Kerberos 5
+- active/passive using PORT, EPRT, PASV or EPSV
+- single file size information (compare to HTTP HEAD)
+- 'type=' URL support
+- directory listing
+- directory listing names-only
+- upload
+- upload append
+- upload via http-proxy as HTTP PUT
+- download resume
+- upload resume
+- custom ftp commands (before and/or after the transfer)
+- simple "range" support
+- via HTTP proxy, HTTPS proxy or SOCKS proxy
+- all operations can be tunneled through proxy
+- customizable to retrieve file modification date
+- no directory depth limit
 
-## FTPS (1)
+## FTPS
 
- - implicit `ftps://` support that use SSL on both connections
- - explicit "AUTH TLS" and "AUTH SSL" usage to "upgrade" plain `ftp://`
-   connection to use SSL for both or one of the connections
+- implicit `ftps://` support that use SSL on both connections
+- explicit "AUTH TLS" and "AUTH SSL" usage to "upgrade" plain `ftp://`
+  connection to use SSL for both or one of the connections
 
-## SCP (8)
+## SSH (both SCP and SFTP)
 
- - both password and public key auth
+- selectable SSH backend
+- known hosts support
+- public key fingerprinting
+- both password and public key auth
 
-## SFTP (7)
+## SFTP
 
- - both password and public key auth
- - with custom commands sent before/after the transfer
+- both password and public key auth
+- with custom commands sent before/after the transfer
+- directory listing
 
 ## TFTP
 
- - download
- - upload
+- download
+- upload
 
 ## TELNET
 
- - connection negotiation
- - custom telnet options
- - stdin/stdout I/O
+- connection negotiation
+- custom telnet options
+- stdin/stdout I/O
 
-## LDAP (2)
+## LDAP
 
- - full LDAP URL support
+- full LDAP URL support
 
 ## DICT
 
- - extended DICT URL support
+- extended DICT URL support
 
 ## FILE
 
- - URL support
- - upload
- - resume
+- URL support
+- upload
+- resume
 
 ## SMB
 
- - SMBv1 over TCP and SSL
- - download
- - upload
- - authentication with NTLMv1
+- SMBv1 over TCP and SSL
+- download
+- upload
+- authentication with NTLMv1
 
 ## SMTP
 
- - authentication: Plain, Login, CRAM-MD5, Digest-MD5, NTLM (9), Kerberos 5
-   (4) and External.
- - send emails
- - mail from support
- - mail size support
- - mail auth support for trusted server-to-server relaying
- - multiple recipients
- - via http-proxy
+- authentication: Plain, Login, CRAM-MD5, Digest-MD5, NTLM, Kerberos 5 and
+  External
+- send emails
+- mail from support
+- mail size support
+- mail auth support for trusted server-to-server relaying
+- multiple recipients
+- via http-proxy
 
-## SMTPS (1)
+## SMTPS
 
- - implicit `smtps://` support
- - explicit "STARTTLS" usage to "upgrade" plain `smtp://` connections to use SSL
- - via http-proxy
+- implicit `smtps://` support
+- explicit "STARTTLS" usage to "upgrade" plain `smtp://` connections to use SSL
+- via http-proxy
 
 ## POP3
 
- - authentication: Clear Text, APOP and SASL
- - SASL based authentication: Plain, Login, CRAM-MD5, Digest-MD5, NTLM (9),
-   Kerberos 5 (4) and External.
- - list emails
- - retrieve emails
- - enhanced command support for: CAPA, DELE, TOP, STAT, UIDL and NOOP via
-   custom requests
- - via http-proxy
+- authentication: Clear Text, APOP and SASL
+- SASL based authentication: Plain, Login, CRAM-MD5, Digest-MD5, NTLM,
+  Kerberos 5 and External
+- list emails
+- retrieve emails
+- enhanced command support for: CAPA, DELE, TOP, STAT, UIDL and NOOP via
+  custom requests
+- via http-proxy
 
-## POP3S (1)
+## POP3S
 
- - implicit `pop3s://` support
- - explicit `STLS` usage to "upgrade" plain `pop3://` connections to use SSL
- - via http-proxy
+- implicit `pop3s://` support
+- explicit `STLS` usage to "upgrade" plain `pop3://` connections to use SSL
+- via http-proxy
 
 ## IMAP
 
- - authentication: Clear Text and SASL
- - SASL based authentication: Plain, Login, CRAM-MD5, Digest-MD5, NTLM (9),
-   Kerberos 5 (4) and External.
- - list the folders of a mailbox
- - select a mailbox with support for verifying the `UIDVALIDITY`
- - fetch emails with support for specifying the UID and SECTION
- - upload emails via the append command
- - enhanced command support for: EXAMINE, CREATE, DELETE, RENAME, STATUS,
-   STORE, COPY and UID via custom requests
- - via http-proxy
+- authentication: Clear Text and SASL
+- SASL based authentication: Plain, Login, CRAM-MD5, Digest-MD5, NTLM,
+  Kerberos 5 and External
+- list the folders of a mailbox
+- select a mailbox with support for verifying the `UIDVALIDITY`
+- fetch emails with support for specifying the UID and SECTION
+- upload emails via the append command
+- enhanced command support for: EXAMINE, CREATE, DELETE, RENAME, STATUS,
+  STORE, COPY and UID via custom requests
+- via http-proxy
 
-## IMAPS (1)
+## IMAPS
 
- - implicit `imaps://` support
- - explicit "STARTTLS" usage to "upgrade" plain `imap://` connections to use SSL
- - via http-proxy
+- implicit `imaps://` support
+- explicit "STARTTLS" usage to "upgrade" plain `imap://` connections to use SSL
+- via http-proxy
 
 ## MQTT
 
- - Subscribe to and publish topics using URL scheme `mqtt://broker/topic`
-
-## Footnotes
-
-  1. requires a TLS library
-  2. requires OpenLDAP or WinLDAP
-  3. requires a GSS-API implementation (such as Heimdal or MIT Kerberos) or
-     SSPI (native Windows)
-  4. requires a GSS-API implementation, however, only Windows SSPI is
-     currently supported
-  5. requires nghttp2
-  6. requires c-ares
-  7. requires libssh2, libssh or wolfSSH
-  8. requires libssh2 or libssh
-  9. requires OpenSSL, GnuTLS, mbedTLS, Secure Transport or SSPI
-     (native Windows)
-  10. requires libidn2 or Windows
-  11. requires libz, brotli and/or zstd
-  12. requires a GSS-API implementation (such as Heimdal or MIT Kerberos)
+- Subscribe to and publish topics using URL scheme `mqtt://broker/topic`
diff --git a/third-party/curl/docs/GOVERNANCE.md b/third-party/curl/docs/GOVERNANCE.md
index dd09de4563..bae06009b9 100644
--- a/third-party/curl/docs/GOVERNANCE.md
+++ b/third-party/curl/docs/GOVERNANCE.md
@@ -1,3 +1,9 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # Decision making in the curl project
 
 A rough guide to how we make decisions and who does what.
@@ -10,13 +16,12 @@ BDFL (Benevolent Dictator For Life) style project.
 
 This setup has been used due to convenience and the fact that it has worked
 fine this far. It is not because someone thinks of it as a superior project
-leadership model. It will also only continue working as long as Daniel manages
-to listen in to what the project and the general user population wants and
-expects from us.
+leadership model. It also only works as long as Daniel manages to listen in to
+what the project and the general user population wants and expects from us.
 
 ## Legal entity
 
-There is no legal entity. The curl project is just a bunch of people scattered
+There is no legal entity. The curl project is a bunch of people scattered
 around the globe with the common goal to produce source code that creates
 great products. We are not part of any umbrella organization and we are not
 located in any specific country. We are totally independent.
@@ -29,21 +34,20 @@ that wrote those parts of the code.
 The curl project is not a democracy, but everyone is entitled to state their
 opinion and may argue for their sake within the community.
 
-All and any changes that have been done or will be done are eligible to bring
-up for discussion, to object to or to praise. Ideally, we find consensus for
-the appropriate way forward in any given situation or challenge.
+All and any changes that have been done or are done are eligible to bring up
+for discussion, to object to or to praise. Ideally, we find consensus for the
+appropriate way forward in any given situation or challenge.
 
 If there is no obvious consensus, a maintainer who's knowledgeable in the
-specific area will take an "executive" decision that they think is the right
-for the project.
+specific area takes an "executive" decision that they think is the right for
+the project.
 
 ## Donations
 
 Donating plain money to curl is best done to curl's [Open Collective
 fund](https://opencollective.com/curl). Open Collective is a US based
-non-profit organization that holds on to funds for us. This fund is then used
-for paying the curl security bug bounties, to reimburse project related
-expenses etc.
+non-profit organization that holds on to funds for us. This fund is used to
+reimburse and pay for project related expenses etc.
 
 Donations to the project can also come in the form of server hosting, providing
 services and paying for people to work on curl related code etc. Usually, such
@@ -57,7 +61,7 @@ they can be mentioned on the Sponsors page on the curl website.
 The curl project does not do or offer commercial support. It only hosts
 mailing lists, runs bug trackers etc to facilitate communication and work.
 
-However, Daniel works for wolfSSL and we offer commercial curl support there.
+Daniel works for wolfSSL, which offers commercial curl support.
 
 # Key roles
 
@@ -81,17 +85,17 @@ curl source code repository. Committers are recorded as `Author` in git.
 A maintainer in the curl project is an individual who has been given
 permissions to push commits to one of the git repositories.
 
-Maintainers are free to push commits to the repositories at their own will.
+Maintainers are free to push commits to the repositories at they see fit.
 Maintainers are however expected to listen to feedback from users and any
 change that is non-trivial in size or nature *should* be brought to the
 project as a Pull-Request (PR) to allow others to comment/object before merge.
 
 ## Former maintainers
 
-A maintainer who stops being active in the project will at some point get
-their push permissions removed. We do this for security reasons but also to
-make sure that we always have the list of maintainers as "the team that push
-stuff to curl".
+A maintainer who stops being active in the project gets their push permissions
+removed at some point. We do this for security reasons but also to make sure
+that we always have the list of maintainers as "the team that push stuff to
+curl".
 
 Getting push permissions removed is not a punishment. Everyone who ever worked
 on maintaining curl is considered a hero, for all time hereafter.
@@ -100,13 +104,29 @@ on maintaining curl is considered a hero, for all time hereafter.
 
 We have a security team. That is the team of people who are subscribed to the
 curl-security mailing list; the receivers of security reports from users and
-developers. This list of people will vary over time but should be skilled
+developers. This list of people varies over time but they are all skilled
 developers familiar with the curl project.
 
 The security team works best when it consists of a small set of active
 persons. We invite new members when the team seems to need it, and we also
 expect to retire security team members as they "drift off" from the project or
-just find themselves unable to perform their duties there.
+find themselves unable to perform their duties there.
+
+## Core team
+
+There is a curl core team. It currently has the same set of members as the
+security team. It can also be reached on the security email address.
+
+The core team nominates and invites new members to the team when it sees fit.
+There is no open member voting or formal ways to be a candidate. Active
+participants in the curl project who want to join the core team can ask to
+join.
+
+The core team is a board of advisors. It deals with project management
+subjects that need confidentiality or for other reasons cannot be dealt with
+and discussed in the open (for example reports of code of conduct violations).
+Project matters should always as far as possible be discussed on open mailing
+lists.
 
 ## Server admins
 
@@ -172,11 +192,25 @@ different individuals and over time.
 If you think you can help making the project better by shouldering some
 maintaining responsibilities, then please get in touch.
 
-You will be expected to be familiar with the curl project and its ways of
-working. You need to have gotten a few quality patches merged as a proof of
-this.
+You are expected to be familiar with the curl project and its ways of working.
+You need to have gotten a few quality patches merged as a proof of this.
 
 ### Stop being a maintainer
 
 If you (appear to) not be active in the project anymore, you may be removed as
-a maintainer. Thank you for your service!
+a maintainer. Thank you for your service.
+
+# Post-Daniel BDFL
+
+At the point in a future when Daniel steps away from the project and stops
+being the project lead, there is reason to reconsider how to keep driving the
+project forward. Countries, companies and organizations have a single
+president or CEO for a reason; having a single leader that responsibly can
+take quick daily decisions is efficient. Without Daniel as BDFL, either
+someone else needs to step up and become president, or the project needs to
+adopt a council-driven process. Maybe both? Maybe vote a new project leader
+for one year or a few years at a time?
+
+Deciding the replacement person and governance is a subject for the curl core
+team to vote on. When that happens, this section of this document should also
+get updated.
diff --git a/third-party/curl/docs/HELP-US.md b/third-party/curl/docs/HELP-US.md
index 90c9724b21..e676dcf08f 100644
--- a/third-party/curl/docs/HELP-US.md
+++ b/third-party/curl/docs/HELP-US.md
@@ -1,3 +1,9 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # How to get started helping out in the curl project
 
 We are always in need of more help. If you are new to the project and are
@@ -27,12 +33,12 @@ If you are looking for a smaller or simpler task in the project to help out
 with as an entry-point into the project, perhaps because you are a newcomer or
 even maybe not a terribly experienced developer, here's our advice:
 
- - Read through this document to get a grasp on a general approach to use
- - Consider adding a test case for something not currently tested (correctly)
- - Consider updating or adding documentation
- - One way to get started gently in the project, is to participate in an
-   existing issue/PR and help out by reproducing the issue, review the code in
-   the PR etc.
+- Read through this document to get a grasp on a general approach to use
+- Consider adding a test case for something not currently tested (correctly)
+- Consider updating or adding documentation
+- One way to get started gently in the project, is to participate in an
+  existing issue/PR and help out by reproducing the issue, review the code in
+  the PR etc.
 
 ## Help wanted
 
@@ -40,8 +46,8 @@ In the issue tracker we occasionally mark bugs with [help
 wanted](https://github.com/curl/curl/labels/help%20wanted), as a sign that the
 bug is acknowledged to exist and that there is nobody known to work on this
 issue for the moment. Those are bugs that are fine to "grab" and provide a
-pull request for. The complexity level of these will of course vary, so pick
-one that piques your interest.
+pull request for. The complexity level of these of course varies, so pick one
+that piques your interest.
 
 ## Work on known bugs
 
@@ -77,13 +83,12 @@ brainstorming on specific ways to do the implementation etc.
 
 You can also come up with a completely new thing you think we should do. Or
 not do. Or fix. Or add to the project. You then either bring it to the mailing
-list first to see if people will shoot down the idea at once, or you bring a
-first draft of the idea as a pull request and take the discussion there around
-the specific implementation. Either way is fine.
+list first to see if people shoot down the idea at once, or you bring a first
+draft of the idea as a pull request and take the discussion there around the
+specific implementation. Either way is fine.
 
 ## CONTRIBUTE
 
-We offer [guidelines](https://curl.se/dev/contribute.html) that are
-suitable to be familiar with before you decide to contribute to curl. If
-you are used to open source development, you will probably not find many
-surprises there.
+We offer [guidelines](https://curl.se/dev/contribute.html) that are suitable
+to be familiar with before you decide to contribute to curl. If you are used
+to open source development, you probably do not find many surprises there.
diff --git a/third-party/curl/docs/HISTORY.md b/third-party/curl/docs/HISTORY.md
index f39c45ea12..3723052f9e 100644
--- a/third-party/curl/docs/HISTORY.md
+++ b/third-party/curl/docs/HISTORY.md
@@ -1,25 +1,28 @@
-How curl Became Like This
-=========================
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# How curl Became Like This
 
 Towards the end of 1996, Daniel Stenberg was spending time writing an IRC bot
 for an Amiga related channel on EFnet. He then came up with the idea to make
-currency-exchange calculations available to Internet Relay Chat (IRC)
-users. All the necessary data were published on the Web; he just needed to
-automate their retrieval.
+currency-exchange calculations available to Internet Relay Chat (IRC) users.
+All the necessary data were published on the Web; he only needed to automate
+their retrieval.
 
-1996
-----
+## 1996
 
 On November 11, 1996 the Brazilian developer Rafael Sagula wrote and released
 HttpGet version 0.1.
 
 Daniel extended this existing command-line open-source tool. After a few minor
-adjustments, it did just what he needed. The first release with Daniel's
-additions was 0.2, released on December 17, 1996. Daniel quickly became the
-new maintainer of the project.
+adjustments, it did what he needed. The first release with Daniel's additions
+was 0.2, released on December 17, 1996. Daniel quickly became the new
+maintainer of the project.
 
-1997
-----
+## 1997
 
 HttpGet 0.3 was released in January 1997 and now it accepted HTTP URLs on the
 command line.
@@ -37,8 +40,7 @@ November 24 1997: Version 3.1 added FTP upload support.
 
 Version 3.5 added support for HTTP POST.
 
-1998
-----
+## 1998
 
 February 4: urlget 3.10
 
@@ -65,14 +67,14 @@ code, we switched over to the MPL license to restrict the effects of
 "copyleft".
 
 November: configure script and reported successful compiles on several
-major operating systems. The never-quite-understood -F option was added and
-curl could now simulate quite a lot of a browser. TELNET support was added.
+major operating systems. The often-misunderstood -F option was added, and
+curl could now simulate significant browser functionality. TELNET support was
+added.
 
-Curl 5 was released in December 1998 and introduced the first ever curl man
+curl 5 was released in December 1998 and introduced the first ever curl man
 page. People started making Linux RPM packages out of it.
 
-1999
-----
+## 1999
 
 January: DICT support added.
 
@@ -80,16 +82,15 @@ OpenSSL took over and SSLeay was abandoned.
 
 May: first Debian package.
 
-August: LDAP:// and FILE:// support added. The curl website gets 1300 visits
-weekly. Moved site to curl.haxx.nu.
+August: `ldap://` and `file://` support added. The curl website gets 1300
+visits weekly. Moved site to curl.haxx.nu.
 
 September: Released curl 6.0. 15000 lines of code.
 
 December 28: added the project on Sourceforge and started using its services
 for managing the project.
 
-2000
-----
+## 2000
 
 Spring: major internal overhaul to provide a suitable library interface.
 The first non-beta release was named 7.1 and arrived in August. This offered
@@ -111,8 +112,7 @@ September: kerberos4 support was added.
 November: started the work on a test suite for curl. It was later re-written
 from scratch again. The libcurl major SONAME number was set to 1.
 
-2001
-----
+## 2001
 
 January: Daniel released curl 7.5.2 under a new license again: MIT (or
 MPL). The MIT license is extremely liberal and can be combined with GPL
@@ -124,7 +124,7 @@ deemed "GPL incompatible".)
 March 22: curl supports HTTP 1.1 starting with the release of 7.7. This
 also introduced libcurl's ability to do persistent connections. 24000 lines of
 code. The libcurl major SONAME number was bumped to 2 due to this overhaul.
-The first experimental ftps:// support was added.
+The first experimental `ftps://` support was added.
 
 August: The curl website gets 8000 visits weekly. Curl Corporation contacted
 Daniel to discuss "the name issue". After Daniel's reply, they have never
@@ -138,8 +138,7 @@ September 25: curl (7.7.2) is bundled in Mac OS X (10.1) for the first time. It
 already becoming more and more of a standard utility of Linux distributions
 and a regular in the BSD ports collections.
 
-2002
-----
+## 2002
 
 June: the curl website gets 13000 visits weekly. curl and libcurl is
 35000 lines of code. Reported successful compiles on more than 40 combinations
@@ -155,8 +154,7 @@ only.
 
 Starting with 7.10, curl verifies SSL server certificates by default.
 
-2003
-----
+## 2003
 
 January: Started working on the distributed curl tests. The autobuilds.
 
@@ -171,8 +169,7 @@ to the website. Five official web mirrors.
 
 December: full-fledged SSL for FTP is supported.
 
-2004
-----
+## 2004
 
 January: curl 7.11.0 introduced large file support.
 
@@ -181,7 +178,7 @@ June: curl 7.12.0 introduced IDN support. 10 official web mirrors.
 This release bumped the major SONAME to 3 due to the removal of the
 `curl_formparse()` function
 
-August: Curl and libcurl 7.12.1
+August: curl and libcurl 7.12.1
 
     Public curl release number:                82
     Releases counted from the beginning:      109
@@ -191,8 +188,7 @@ August: Curl and libcurl 7.12.1
     Amount of public website mirrors:          12
     Number of known libcurl bindings:          26
 
-2005
-----
+## 2005
 
 April: GnuTLS can now optionally be used for the secure layer when curl is
 built.
@@ -205,8 +201,7 @@ More than 100,000 unique visitors of the curl website. 25 mirrors.
 
 December: security vulnerability: libcurl URL Buffer Overflow
 
-2006
-----
+## 2006
 
 January: We dropped support for Gopher. We found bugs in the implementation
 that turned out to have been introduced years ago, so with the conclusion that
@@ -217,17 +212,18 @@ March: security vulnerability: libcurl TFTP Packet Buffer Overflow
 September: The major SONAME number for libcurl was bumped to 4 due to the
 removal of ftp third party transfer support.
 
+October: we started to offer the Mozilla CA cert bundle as a PEM file on the
+curl website.
+
 November: Added SCP and SFTP support
 
-2007
-----
+## 2007
 
 February: Added support for the Mozilla NSS library to do the SSL/TLS stuff
 
 July: security vulnerability: libcurl GnuTLS insufficient cert verification
 
-2008
-----
+## 2008
 
 November:
 
@@ -237,10 +233,9 @@ November:
     Known libcurl bindings:        37
     Contributors:                 683
 
- 145,000 unique visitors. >100 GB downloaded.
+145,000 unique visitors. >100 GB downloaded.
 
-2009
-----
+## 2009
 
 March: security vulnerability: libcurl Arbitrary File Access
 
@@ -250,8 +245,7 @@ August: security vulnerability: libcurl embedded zero in cert name
 
 December: Added support for IMAP, POP3 and SMTP
 
-2010
-----
+## 2010
 
 January: Added support for RTSP
 
@@ -273,154 +267,153 @@ August:
     Known libcurl bindings:        39
     Contributors:                 808
 
- Gopher support added (re-added actually, see January 2006)
+Gopher support added (re-added actually, see January 2006)
 
-2011
-----
+## 2011
 
 February: added support for the axTLS backend
 
-April: added the cyassl backend (later renamed to WolfSSL)
+April: added the cyassl backend (later renamed to wolfSSL)
 
-2012
-----
+## 2012
 
- July: Added support for Schannel (native Windows TLS backend) and Darwin SSL
- (Native Mac OS X and iOS TLS backend).
+July: Added support for Schannel (native Windows TLS backend) and Darwin SSL
+(Native Mac OS X and iOS TLS backend).
 
- Supports Metalink
+Supports Metalink
 
- October: SSH-agent support.
+October: SSH-agent support.
 
-2013
-----
+## 2013
 
- February: Cleaned up internals to always uses the "multi" non-blocking
- approach internally and only expose the blocking API with a wrapper.
+February: Cleaned up internals to always uses the "multi" non-blocking
+approach internally and only expose the blocking API with a wrapper.
 
- September: First small steps on supporting HTTP/2 with nghttp2.
+September: First small steps on supporting HTTP/2 with nghttp2.
 
- October: Removed krb4 support.
+October: Removed krb4 support.
 
- December: Happy eyeballs.
+December: Happy eyeballs.
 
-2014
-----
+## 2014
 
- March: first real release supporting HTTP/2
+March: first real release supporting HTTP/2
 
- September: Website had 245,000 unique visitors and served 236GB data
+September: Website had 245,000 unique visitors and served 236GB data
 
- SMB and SMBS support
+SMB and SMBS support
 
-2015
-----
+## 2015
 
- June: support for multiplexing with HTTP/2
+June: support for multiplexing with HTTP/2
 
- August: support for HTTP/2 server push
+August: support for HTTP/2 server push
 
- December: Public Suffix List
+September: started "everything curl". A separate stand-alone book documenting
+curl and related info in perhaps a more tutorial style rather than a
+reference,
 
-2016
-----
+December: Public Suffix List
 
- January: the curl tool defaults to HTTP/2 for HTTPS URLs
+## 2016
 
- December: curl 7.52.0 introduced support for HTTPS-proxy!
+January: the curl tool defaults to HTTP/2 for HTTPS URLs
 
- First TLS 1.3 support
+June 26: Rafael Sagula, author of the original httpget tool in 1996 died.
 
-2017
-----
+December: curl 7.52.0 introduced support for HTTPS-proxy
 
- July: OSS-Fuzz started fuzzing libcurl
+First TLS 1.3 support
 
- September: Added Multi-SSL support
+## 2017
 
- The website serves 3100 GB/month
+May: Fastly starts hosting the curl website
 
-    Public curl releases:         169
-    Command line options:         211
-    curl_easy_setopt() options:   249
-    Public functions in libcurl:  74
-    Contributors:                 1609
+July: OSS-Fuzz started fuzzing libcurl
 
- October: SSLKEYLOGFILE support, new MIME API
+September: Added MultiSSL support
 
- October: Daniel received the Polhem Prize for his work on curl
+The website serves 3100 GB/month
 
- November: brotli
+   Public curl releases:         169
+   Command line options:         211
+   curl_easy_setopt() options:   249
+   Public functions in libcurl:  74
+   Contributors:                 1609
 
-2018
-----
+October: SSLKEYLOGFILE support, new MIME API
 
- January: new SSH backend powered by libssh
+October: Daniel received the Polhem Prize for his work on curl
 
- March: starting with the 1803 release of Windows 10, curl is shipped bundled
- with Microsoft's operating system.
+November: brotli
 
- July: curl shows headers using bold type face
+## 2018
 
- October: added DNS-over-HTTPS (DoH) and the URL API
+January: new SSH backend powered by libssh
 
- MesaLink is a new supported TLS backend
+March: starting with the 1803 release of Windows 10, curl is shipped bundled
+with Microsoft's operating system.
 
- libcurl now does HTTP/2 (and multiplexing) by default on HTTPS URLs
+July: curl shows headers using bold type face
 
- curl and libcurl are installed in an estimated 5 *billion* instances
- world-wide.
+October: added DNS-over-HTTPS (DoH) and the URL API
 
- October 31: Curl and libcurl 7.62.0
+MesaLink is a new supported TLS backend
 
-    Public curl releases:         177
-    Command line options:         219
-    curl_easy_setopt() options:   261
-    Public functions in libcurl:  80
-    Contributors:                 1808
+libcurl now does HTTP/2 (and multiplexing) by default on HTTPS URLs
 
- December: removed axTLS support
+curl and libcurl are installed in an estimated 5 *billion* instances
+world-wide.
 
-2019
-----
+October 31: curl and libcurl 7.62.0
 
- March: added experimental alt-svc support
+   Public curl releases:         177
+   Command line options:         219
+   curl_easy_setopt() options:   261
+   Public functions in libcurl:  80
+   Contributors:                 1808
 
- August: the first HTTP/3 requests with curl.
+December: removed axTLS support
 
- September: 7.66.0 is released and the tool offers parallel downloads
+## 2019
 
-2020
-----
+January: Daniel started working full-time on curl, employed by wolfSSL
 
- curl and libcurl are installed in an estimated 10 *billion* instances
- world-wide.
+March: added experimental alt-svc support
 
- January: added BearSSL support
+August: the first HTTP/3 requests with curl.
 
- March: removed support for PolarSSL, added wolfSSH support
+September: 7.66.0 is released and the tool offers parallel downloads
 
- April: experimental MQTT support
+## 2020
 
- August: zstd support
+curl and libcurl are installed in an estimated 10 *billion* instances
+world-wide.
 
- November: the website moves to curl.se. The website serves 10TB data monthly.
+January: added BearSSL support
 
- December: alt-svc support
+March: removed support for PolarSSL, added wolfSSH support. Created the first
+dashboard on the website.
 
-2021
-----
+April: experimental MQTT support
 
- February 3: curl 7.75.0 ships with support for Hyper as an HTTP backend
+August: zstd support
 
- March 31: curl 7.76.0 ships with support for rustls
+November: the website moves to curl.se. The website serves 10TB data monthly.
 
- July: HSTS is supported
+December: alt-svc support
 
-2022
-----
+## 2021
 
- March: added --json, removed mesalink support
+February 3: curl 7.75.0 ships with support for Hyper as an HTTP backend
+
+March 31: curl 7.76.0 ships with support for Rustls
+
+July: HSTS is supported
+
+## 2022
+
+March: added --json, removed mesalink support
 
     Public curl releases:         206
     Command line options:         245
@@ -428,10 +421,79 @@ April: added the cyassl backend (later renamed to WolfSSL)
     Public functions in libcurl:  86
     Contributors:                 2601
 
- The curl.se website serves 16,500 GB/month over 462M requests, the
- official docker image has been pulled 4,098,015,431 times.
+The curl.se website serves 16,500 GB/month over 462M requests, the
+official docker image has been pulled 4,098,015,431 times.
 
-2023
-----
+April: added support for msh3 as another HTTP/3 backend
+
+October: initial WebSocket support
+
+## 2023
+
+March: remove support for curl_off_t < 8 bytes
+
+March 31: we started working on a new command line tool for URL parsing and
+manipulations: trurl.
+
+May: added support for HTTP/2 over HTTPS proxy. Refuse to resolve .onion. The
+curl GitHub repository reaches 30,000 stars.
 
 August: Dropped support for the NSS library
+
+September: added "variable" support in the command line tool. Dropped support
+for the gskit TLS library.
+
+October: added support for IPFS via HTTP gateway
+
+December: HTTP/3 support with ngtcp2 is no longer experimental
+
+## 2024
+
+January: switched to "curldown" for all documentation
+
+April 24: the curl container has been pulled more than six billion times
+
+May: experimental support for ECH, dropped NTLM_WB
+
+August 9: we adopted the wcurl tool into the curl organization
+
+September 11: --help [option]
+
+November 6: TLS 1.3 early data, WebSocket is official
+
+December 21: dropped hyper
+
+## 2025
+
+February 5: first 0RTT for QUIC, SSL session import/export
+
+February: experimental HTTPS RR support
+
+February 22: The website served 62.95 TB/month; 12.43 billion requests. The
+docker image has been pulled 6373501745 times.
+
+June: we removed support for BearSSL, Secure Transport and msh3
+
+October: Daniel gets awarded a gold medal by the Swedish Royal Academy of
+Engineering Sciences for his work on curl.
+
+We counted curl having been installed on 110 operating systems and 28 CPU
+architectures.
+
+November:
+
+    Public curl releases:         271
+    Command line options:         273
+    curl_easy_setopt() options:   308
+    Public functions in libcurl:  100
+    Contributors:                 3534
+
+We drop support for krb-ftp, Heimdal, wolfSSH and the winbuild build system.
+
+Add support for Apple SecTrust, native CA certs on Apple systems.
+
+December 15: the website served 78 TB over the last month.
+
+## 2026
+
+April: removed support for RTMP
diff --git a/third-party/curl/docs/HSTS.md b/third-party/curl/docs/HSTS.md
index e541024936..c6d872077b 100644
--- a/third-party/curl/docs/HSTS.md
+++ b/third-party/curl/docs/HSTS.md
@@ -1,3 +1,9 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # HSTS support
 
 HTTP Strict-Transport-Security. Added as experimental in curl
@@ -10,19 +16,22 @@ HTTP Strict-Transport-Security. Added as experimental in curl
 ## Behavior
 
 libcurl features an in-memory cache for HSTS hosts, so that subsequent
-HTTP-only requests to a host name present in the cache will get internally
+HTTP-only requests to a hostname present in the cache gets internally
 "redirected" to the HTTPS version.
 
+Since curl 8.20.0, libcurl keeps no more than the most recently added 10,000
+unique HSTS hostnames.
+
 ## `curl_easy_setopt()` options:
 
- - `CURLOPT_HSTS_CTRL` - enable HSTS for this easy handle
- - `CURLOPT_HSTS` - specify file name where to store the HSTS cache on close
+- `CURLOPT_HSTS_CTRL` - enable HSTS for this easy handle
+- `CURLOPT_HSTS` - specify filename where to store the HSTS cache on close
   (and possibly read from at startup)
 
 ## curl command line options
 
- - `--hsts [filename]` - enable HSTS, use the file as HSTS cache. If filename
-   is `""` (no length) then no file will be used, only in-memory cache.
+- `--hsts [filename]` - enable HSTS, use the file as HSTS cache. If filename
+  is `""` (no length) then no file is used, only in-memory cache.
 
 ## HSTS cache file format
 
@@ -30,13 +39,13 @@ Lines starting with `#` are ignored.
 
 For each hsts entry:
 
-    [host name] "YYYYMMDD HH:MM:SS"
+    [hostname] "YYYYMMDD HH:MM:SS"
 
-The `[host name]` is dot-prefixed if it includes subdomains.
+The `[hostname]` is dot-prefixed if it includes subdomains.
 
 The time stamp is when the entry expires.
 
 ## Possible future additions
 
- - `CURLOPT_HSTS_PRELOAD` - provide a set of HSTS host names to load first
- - ability to save to something else than a file
+- `CURLOPT_HSTS_PRELOAD` - provide a set of HSTS hostnames to load first
+- ability to save to something else than a file
diff --git a/third-party/curl/docs/HTTP-COOKIES.md b/third-party/curl/docs/HTTP-COOKIES.md
index d6fd87d205..2a32aae605 100644
--- a/third-party/curl/docs/HTTP-COOKIES.md
+++ b/third-party/curl/docs/HTTP-COOKIES.md
@@ -1,147 +1,171 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # HTTP Cookies
 
 ## Cookie overview
 
-  Cookies are `name=contents` pairs that an HTTP server tells the client to
-  hold and then the client sends back those to the server on subsequent
-  requests to the same domains and paths for which the cookies were set.
+Cookies are `name=contents` pairs that an HTTP server tells the client to
+hold and then the client sends back those to the server on subsequent
+requests to the same domains and paths for which the cookies were set.
 
-  Cookies are either "session cookies" which typically are forgotten when the
-  session is over which is often translated to equal when browser quits, or
-  the cookies are not session cookies they have expiration dates after which
-  the client will throw them away.
+Cookies are either "session cookies" which typically are forgotten when the
+session is over which is often translated to equal when browser quits, or
+the cookies are not session cookies they have expiration dates after which
+the client throws them away.
 
-  Cookies are set to the client with the Set-Cookie: header and are sent to
-  servers with the Cookie: header.
+Cookies are set to the client with the Set-Cookie: header and are sent to
+servers with the Cookie: header.
 
-  For a long time, the only spec explaining how to use cookies was the
-  original [Netscape spec from 1994](https://curl.se/rfc/cookie_spec.html).
+For a long time, the only spec explaining how to use cookies was the
+original [Netscape spec from 1994](https://curl.se/rfc/cookie_spec.html).
 
-  In 2011, [RFC 6265](https://www.ietf.org/rfc/rfc6265.txt) was finally
-  published and details how cookies work within HTTP. In 2016, an update which
-  added support for prefixes was
-  [proposed](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-cookie-prefixes-00),
-  and in 2017, another update was
-  [drafted](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-cookie-alone-01)
-  to deprecate modification of 'secure' cookies from non-secure origins. Both
-  of these drafts have been incorporated into a proposal to
-  [replace](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-11)
-  RFC 6265. Cookie prefixes and secure cookie modification protection has been
-  implemented by curl.
+In 2011, [RFC 6265](https://datatracker.ietf.org/doc/html/rfc6265) was finally
+published and details how cookies work within HTTP. In 2016, an update which
+added support for prefixes was
+[proposed](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-cookie-prefixes-00),
+and in 2017, another update was
+[drafted](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-cookie-alone-01)
+to deprecate modification of 'secure' cookies from non-secure origins. Both
+of these drafts have been incorporated into a proposal to
+[replace](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-11)
+RFC 6265. Cookie prefixes and secure cookie modification protection has been
+implemented by curl.
 
-  curl considers `http://localhost` to be a *secure context*, meaning that it
-  will allow and use cookies marked with the `secure` keyword even when done
-  over plain HTTP for this host. curl does this to match how popular browsers
-  work with secure cookies.
+curl considers `http://localhost` to be a *secure context*, meaning that it
+allows and uses cookies marked with the `secure` keyword even when done over
+plain HTTP for this host. curl does this to match how popular browsers work
+with secure cookies.
+
+## Super cookies
+
+A single cookie can be set for a domain that matches multiple hosts. Like if
+set for `example.com` it gets sent to both `aa.example.com` as well as
+`bb.example.com`.
+
+A challenge with this concept is that there are certain domains for which
+cookies should not be allowed at all, because they are *Public
+Suffixes*. Similarly, a client never accepts cookies set directly for the
+top-level domain like for example `.com`. Cookies set for *too broad*
+domains are generally referred to as *super cookies*.
+
+If curl is built with PSL (**Public Suffix List**) support, it detects and
+discards cookies that are specified for such suffix domains that should not
+be allowed to have cookies.
+
+if curl is *not* built with PSL support, it has no ability to stop super
+cookies.
 
 ## Cookies saved to disk
 
-  Netscape once created a file format for storing cookies on disk so that they
-  would survive browser restarts. curl adopted that file format to allow
-  sharing the cookies with browsers, only to see browsers move away from that
-  format. Modern browsers no longer use it, while curl still does.
+Netscape once created a file format for storing cookies on disk so that they
+would survive browser restarts. curl adopted that file format to allow
+sharing the cookies with browsers, only to see browsers move away from that
+format. Modern browsers no longer use it, while curl still does.
 
-  The Netscape cookie file format stores one cookie per physical line in the
-  file with a bunch of associated meta data, each field separated with
-  TAB. That file is called the cookie jar in curl terminology.
+The Netscape cookie file format stores one cookie per physical line in the
+file with a bunch of associated meta data, each field separated with
+TAB. That file is called the cookie jar in curl terminology.
 
-  When libcurl saves a cookie jar, it creates a file header of its own in
-  which there is a URL mention that will link to the web version of this
-  document.
+When libcurl saves a cookie jar, it creates a file header of its own in
+which there is a URL mention that links to the web version of this document.
 
 ## Cookie file format
 
-  The cookie file format is text based and stores one cookie per line. Lines
-  that start with `#` are treated as comments. An exception is lines that
-  start with `#HttpOnly_`, which is a prefix for cookies that have the
-  `HttpOnly` attribute set.
+The cookie file format is text based and stores one cookie per line. Lines
+that start with `#` are treated as comments. An exception is lines that
+start with `#HttpOnly_`, which is a prefix for cookies that have the
+`HttpOnly` attribute set.
 
-  Each line that specifies a single cookie consists of seven text fields
-  separated with TAB characters. A valid line must end with a newline
-  character.
+Each line that specifies a single cookie consists of seven text fields
+separated with TAB characters. A valid line must end with a newline
+character.
 
 ### Fields in the file
 
-  Field number, what type and example data and the meaning of it:
+Field number, what type and example data and the meaning of it:
 
-  0. string `example.com` - the domain name
-  1. boolean `FALSE` - include subdomains
-  2. string `/foobar/` - path
-  3. boolean `TRUE` - send/receive over HTTPS only
-  4. number `1462299217` - expires at - seconds since Jan 1st 1970, or 0
-  5. string `person` - name of the cookie
-  6. string `daniel` - value of the cookie
+0. string `example.com` - the domain name
+1. boolean `FALSE` - include subdomains
+2. string `/foobar/` - path
+3. boolean `TRUE` - send/receive over HTTPS only
+4. number `1462299217` - expires at - seconds since Jan 1st 1970, or 0
+5. string `person` - name of the cookie
+6. string `daniel` - value of the cookie
 
 ## Cookies with curl the command line tool
 
-  curl has a full cookie "engine" built in. If you just activate it, you can
-  have curl receive and send cookies exactly as mandated in the specs.
+curl has a full cookie "engine" built in. If you activate it, you can have
+curl receive and send cookies exactly as mandated in the specs.
 
-  Command line options:
+Command line options:
 
-  `-b, --cookie`
+[`-b, --cookie`](https://curl.se/docs/manpage.html#-b)
 
-  tell curl a file to read cookies from and start the cookie engine, or if it
-  is not a file it will pass on the given string. `-b name=var` works and so
-  does `-b cookiefile`.
+tell curl a file to read cookies from and start the cookie engine, or if it
+is not a file it passes on the given string. `-b name=var` works and so does
+`-b cookiefile`.
 
-  `-j, --junk-session-cookies`
+[`-j, --junk-session-cookies`](https://curl.se/docs/manpage.html#-j)
 
-  when used in combination with -b, it will skip all "session cookies" on load
-  so as to appear to start a new cookie session.
+when used in combination with -b, it skips all "session cookies" on load so
+as to appear to start a new cookie session.
 
-  `-c, --cookie-jar`
+[`-c, --cookie-jar`](https://curl.se/docs/manpage.html#-c)
 
-  tell curl to start the cookie engine and write cookies to the given file
-  after the request(s)
+tell curl to start the cookie engine and write cookies to the given file
+after the request(s)
 
 ## Cookies with libcurl
 
-  libcurl offers several ways to enable and interface the cookie engine. These
-  options are the ones provided by the native API. libcurl bindings may offer
-  access to them using other means.
+libcurl offers several ways to enable and interface the cookie engine. These
+options are the ones provided by the native API. libcurl bindings may offer
+access to them using other means.
 
-  `CURLOPT_COOKIE`
+[`CURLOPT_COOKIE`](https://curl.se/libcurl/c/CURLOPT_COOKIE.html)
 
-  Is used when you want to specify the exact contents of a cookie header to
-  send to the server.
+Is used when you want to specify the exact contents of a cookie header to
+send to the server.
 
-  `CURLOPT_COOKIEFILE`
+[`CURLOPT_COOKIEFILE`](https://curl.se/libcurl/c/CURLOPT_COOKIEFILE.html)
 
-  Tell libcurl to activate the cookie engine, and to read the initial set of
-  cookies from the given file. Read-only.
+Tell libcurl to activate the cookie engine, and to read the initial set of
+cookies from the given file. Read-only.
 
-  `CURLOPT_COOKIEJAR`
+[`CURLOPT_COOKIEJAR`](https://curl.se/libcurl/c/CURLOPT_COOKIEJAR.html)
 
-  Tell libcurl to activate the cookie engine, and when the easy handle is
-  closed save all known cookies to the given cookie jar file. Write-only.
+Tell libcurl to activate the cookie engine, and when the easy handle is
+closed save all known cookies to the given cookie jar file. Write-only.
 
-  `CURLOPT_COOKIELIST`
+[`CURLOPT_COOKIELIST`](https://curl.se/libcurl/c/CURLOPT_COOKIELIST.html)
 
-  Provide detailed information about a single cookie to add to the internal
-  storage of cookies. Pass in the cookie as an HTTP header with all the
-  details set, or pass in a line from a Netscape cookie file. This option can
-  also be used to flush the cookies etc.
+Provide detailed information about a single cookie to add to the internal
+storage of cookies. Pass in the cookie as an HTTP header with all the
+details set, or pass in a line from a Netscape cookie file. This option can
+also be used to flush the cookies etc.
 
-  `CURLOPT_COOKIESESSION`
+[`CURLOPT_COOKIESESSION`](https://curl.se/libcurl/c/CURLOPT_COOKIESESSION.html)
 
-  Tell libcurl to ignore all cookies it is about to load that are session
-  cookies.
+Tell libcurl to ignore all cookies it is about to load that are session
+cookies.
 
-  `CURLINFO_COOKIELIST`
+[`CURLINFO_COOKIELIST`](https://curl.se/libcurl/c/CURLINFO_COOKIELIST.html)
 
-  Extract cookie information from the internal cookie storage as a linked
-  list.
+Extract cookie information from the internal cookie storage as a linked
+list.
 
 ## Cookies with JavaScript
 
-  These days a lot of the web is built up by JavaScript. The web browser loads
-  complete programs that render the page you see. These JavaScript programs
-  can also set and access cookies.
+These days a lot of the web is built up by JavaScript. The web browser loads
+complete programs that render the page you see. These JavaScript programs
+can also set and access cookies.
 
-  Since curl and libcurl are plain HTTP clients without any knowledge of or
-  capability to handle JavaScript, such cookies will not be detected or used.
+Since curl and libcurl are plain HTTP clients without any knowledge of or
+capability to handle JavaScript, such cookies are not detected or used.
 
-  Often, if you want to mimic what a browser does on such websites, you can
-  record web browser HTTP traffic when using such a site and then repeat the
-  cookie operations using curl or libcurl.
+Often, if you want to mimic what a browser does on such websites, you can
+record web browser HTTP traffic when using such a site and then repeat the
+cookie operations using curl or libcurl.
diff --git a/third-party/curl/docs/HTTP2.md b/third-party/curl/docs/HTTP2.md
deleted file mode 100644
index 5b4028349c..0000000000
--- a/third-party/curl/docs/HTTP2.md
+++ /dev/null
@@ -1,102 +0,0 @@
-HTTP/2 with curl
-================
-
-[HTTP/2 Spec](https://www.rfc-editor.org/rfc/rfc7540.txt)
-[http2 explained](https://daniel.haxx.se/http2/)
-
-Build prerequisites
--------------------
-  - nghttp2
-  - OpenSSL, libressl, BoringSSL, GnuTLS, mbedTLS, wolfSSL or Schannel
-    with a new enough version.
-
-[nghttp2](https://nghttp2.org/)
--------------------------------
-
-libcurl uses this 3rd party library for the low level protocol handling
-parts. The reason for this is that HTTP/2 is much more complex at that layer
-than HTTP/1.1 (which we implement on our own) and that nghttp2 is an already
-existing and well functional library.
-
-We require at least version 1.12.0.
-
-Over an http:// URL
--------------------
-
-If `CURLOPT_HTTP_VERSION` is set to `CURL_HTTP_VERSION_2_0`, libcurl will
-include an upgrade header in the initial request to the host to allow
-upgrading to HTTP/2.
-
-Possibly we can later introduce an option that will cause libcurl to fail if
-not possible to upgrade. Possibly we introduce an option that makes libcurl
-use HTTP/2 at once over http://
-
-Over an https:// URL
---------------------
-
-If `CURLOPT_HTTP_VERSION` is set to `CURL_HTTP_VERSION_2_0`, libcurl will use
-ALPN to negotiate which protocol to continue with. Possibly introduce an
-option that will cause libcurl to fail if not possible to use HTTP/2.
-
-`CURL_HTTP_VERSION_2TLS` was added in 7.47.0 as a way to ask libcurl to prefer
-HTTP/2 for HTTPS but stick to 1.1 by default for plain old HTTP connections.
-
-ALPN is the TLS extension that HTTP/2 is expected to use.
-
-`CURLOPT_SSL_ENABLE_ALPN` is offered to allow applications to explicitly
-disable ALPN.
-
-Multiplexing
-------------
-
-Starting in 7.43.0, libcurl fully supports HTTP/2 multiplexing, which is the
-term for doing multiple independent transfers over the same physical TCP
-connection.
-
-To take advantage of multiplexing, you need to use the multi interface and set
-`CURLMOPT_PIPELINING` to `CURLPIPE_MULTIPLEX`. With that bit set, libcurl will
-attempt to reuse existing HTTP/2 connections and just add a new stream over
-that when doing subsequent parallel requests.
-
-While libcurl sets up a connection to an HTTP server there is a period during
-which it does not know if it can pipeline or do multiplexing and if you add
-new transfers in that period, libcurl will default to start new connections
-for those transfers. With the new option `CURLOPT_PIPEWAIT` (added in 7.43.0),
-you can ask that a transfer should rather wait and see in case there is a
-connection for the same host in progress that might end up being possible to
-multiplex on. It favors keeping the number of connections low to the cost of
-slightly longer time to first byte transferred.
-
-Applications
-------------
-
-We hide HTTP/2's binary nature and convert received HTTP/2 traffic to headers
-in HTTP 1.1 style. This allows applications to work unmodified.
-
-curl tool
----------
-
-curl offers the `--http2` command line option to enable use of HTTP/2.
-
-curl offers the `--http2-prior-knowledge` command line option to enable use of
-HTTP/2 without HTTP/1.1 Upgrade.
-
-Since 7.47.0, the curl tool enables HTTP/2 by default for HTTPS connections.
-
-curl tool limitations
----------------------
-
-The command line tool does not support HTTP/2 server push. It supports
-multiplexing when the parallel transfer option is used.
-
-HTTP Alternative Services
--------------------------
-
-Alt-Svc is an extension with a corresponding frame (ALTSVC) in HTTP/2 that
-tells the client about an alternative "route" to the same content for the same
-origin server that you get the response from. A browser or long-living client
-can use that hint to create a new connection asynchronously. For libcurl, we
-may introduce a way to bring such clues to the application and/or let a
-subsequent request use the alternate route automatically.
-
-[Detailed in RFC 7838](https://datatracker.ietf.org/doc/html/rfc7838)
diff --git a/third-party/curl/docs/HTTP3.md b/third-party/curl/docs/HTTP3.md
index 48e27d3191..74254233b2 100644
--- a/third-party/curl/docs/HTTP3.md
+++ b/third-party/curl/docs/HTTP3.md
@@ -1,3 +1,9 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # HTTP3 (and QUIC)
 
 ## Resources
@@ -9,268 +15,253 @@ book describing the protocols involved.
 
 ## QUIC libraries
 
-QUIC libraries we are experimenting with:
+QUIC libraries we are using:
 
 [ngtcp2](https://github.com/ngtcp2/ngtcp2)
 
-[quiche](https://github.com/cloudflare/quiche)
-
-[msh3](https://github.com/nibanks/msh3) (with [msquic](https://github.com/microsoft/msquic))
+[quiche](https://github.com/cloudflare/quiche) - **EXPERIMENTAL**
 
 ## Experimental
 
-HTTP/3 and QUIC support in curl is considered **EXPERIMENTAL** until further
-notice. It needs to be enabled at build-time.
+HTTP/3 support using *quiche* in curl is considered **EXPERIMENTAL** until
+further notice. Only the *ngtcp2* backend is not experimental.
 
-Further development and tweaking of the HTTP/3 support in curl will happen in
-the master branch using pull-requests, just like ordinary changes.
+Further development and tweaking of the HTTP/3 support in curl happens in the
+master branch using pull-requests like ordinary changes.
 
 To fix before we remove the experimental label:
 
- - the used QUIC library needs to consider itself non-beta
- - it's fine to "leave" individual backends as experimental if necessary
+- the used QUIC library needs to consider itself non-beta
+- it is fine to "leave" individual backends as experimental if necessary
 
 # ngtcp2 version
 
-Building curl with ngtcp2 involves 3 components: `ngtcp2` itself, `nghttp3` and a QUIC supporting TLS library. The supported TLS libraries are covered below.
+Building curl with ngtcp2 involves 3 components: `ngtcp2` itself, `nghttp3`
+and a QUIC supporting TLS library. The supported TLS libraries are covered
+below.
 
-For now, `ngtcp2` and `nghttp3` are still *experimental* which means their evolution bring breaking changes. Therefore, the proper version of both libraries need to be used when building curl. These are
+While any version of `ngtcp2` and `nghttp3` from v1.0.0 on are expected to
+work, using the latest versions often brings functional and performance
+improvements.
 
- * `ngtcp2`: v0.19.1
- * `nghttp3`: v0.15.0
+The build examples use `$NGHTTP3_VERSION` and `$NGTCP2_VERSION` as
+placeholders for the version you build.
 
-## Build with OpenSSL
+## Build with OpenSSL or fork
 
-Build (patched) OpenSSL
+OpenSSL v3.5.0+ requires *ngtcp2* v1.12.0+. Earlier versions do not work.
 
-     % git clone --depth 1 -b openssl-3.0.10+quic https://github.com/quictls/openssl
+Build OpenSSL (v3.5.0+) or fork AWS-LC, BoringSSL, LibreSSL or quictls:
+
+     # Instructions for OpenSSL v3.5.0+
+     % git clone --depth 1 --branch openssl-$OPENSSL_VERSION https://github.com/openssl/openssl
      % cd openssl
-     % ./config enable-tls1_3 --prefix=<somewhere1>
+     % ./config --prefix=/path/to/openssl --libdir=lib
      % make
      % make install
 
-Build nghttp3
+Build nghttp3:
 
      % cd ..
-     % git clone -b v0.15.0 https://github.com/ngtcp2/nghttp3
+     % git clone --depth 1 --branch $NGHTTP3_VERSION https://github.com/ngtcp2/nghttp3
      % cd nghttp3
+     % git submodule update --init
      % autoreconf -fi
-     % ./configure --prefix=<somewhere2> --enable-lib-only
+     % ./configure --prefix=/path/to/nghttp3 --enable-lib-only
      % make
      % make install
 
-Build ngtcp2
+Build ngtcp2:
 
      % cd ..
-     % git clone -b v0.19.1 https://github.com/ngtcp2/ngtcp2
+     % git clone --depth 1 --branch $NGTCP2_VERSION https://github.com/ngtcp2/ngtcp2
      % cd ngtcp2
      % autoreconf -fi
-     % ./configure PKG_CONFIG_PATH=<somewhere1>/lib/pkgconfig:<somewhere2>/lib/pkgconfig LDFLAGS="-Wl,-rpath,<somewhere1>/lib" --prefix=<somewhere3> --enable-lib-only
+     # Change --with-openssl to --with-boringssl for AWS-LC and BoringSSL
+     % ./configure PKG_CONFIG_PATH=/path/to/openssl/lib/pkgconfig:/path/to/nghttp3/lib/pkgconfig LDFLAGS="-Wl,-rpath,/path/to/openssl/lib" \
+       --prefix=/path/to/ngtcp2 --enable-lib-only --with-openssl
      % make
      % make install
 
-Build curl
+Build curl (with autotools):
 
      % cd ..
-     % git clone https://github.com/curl/curl
+     % git clone --depth 1 https://github.com/curl/curl
      % cd curl
      % autoreconf -fi
-     % LDFLAGS="-Wl,-rpath,<somewhere1>/lib" ./configure --with-openssl=<somewhere1> --with-nghttp3=<somewhere2> --with-ngtcp2=<somewhere3>
+     % ./configure PKG_CONFIG_PATH=/path/to/openssl/lib/pkgconfig LDFLAGS="-Wl,-rpath,/path/to/openssl/lib" \
+       --with-openssl=/path/to/openssl --with-ngtcp2=/path/to/ngtcp2 --with-nghttp3=/path/to/nghttp3
      % make
      % make install
 
-For OpenSSL 3.0.0 or later builds on Linux for x86_64 architecture, substitute all occurrences of "/lib" with "/lib64"
+Build curl (with CMake):
+
+     % cd ..
+     % git clone --depth 1 https://github.com/curl/curl
+     % cd curl
+     % PKG_CONFIG_PATH=/path/to/openssl/lib/pkgconfig:/path/to/ngtcp2/lib/pkgconfig:/path/to/nghttp3/lib/pkgconfig cmake -B bld \
+       -DOPENSSL_ROOT_DIR=/path/to/openssl -DUSE_NGTCP2=ON
+     % cmake --build bld
 
 ## Build with GnuTLS
 
-Build GnuTLS
+Build GnuTLS:
 
-     % git clone --depth 1 https://gitlab.com/gnutls/gnutls.git
+     % git clone --depth 1 https://gitlab.com/gnutls/gnutls
      % cd gnutls
      % ./bootstrap
-     % ./configure --prefix=<somewhere1>
+     % ./configure --prefix=/path/to/gnutls
      % make
      % make install
 
-Build nghttp3
+Build nghttp3:
 
      % cd ..
-     % git clone -b v0.15.0 https://github.com/ngtcp2/nghttp3
+     % git clone --depth 1 --branch $NGHTTP3_VERSION https://github.com/ngtcp2/nghttp3
      % cd nghttp3
+     % git submodule update --init
      % autoreconf -fi
-     % ./configure --prefix=<somewhere2> --enable-lib-only
+     % ./configure --prefix=/path/to/nghttp3 --enable-lib-only
      % make
      % make install
 
-Build ngtcp2
+Build ngtcp2:
 
      % cd ..
-     % git clone -b v0.19.1 https://github.com/ngtcp2/ngtcp2
+     % git clone --depth 1 --branch $NGTCP2_VERSION https://github.com/ngtcp2/ngtcp2
      % cd ngtcp2
      % autoreconf -fi
-     % ./configure PKG_CONFIG_PATH=<somewhere1>/lib/pkgconfig:<somewhere2>/lib/pkgconfig LDFLAGS="-Wl,-rpath,<somewhere1>/lib" --prefix=<somewhere3> --enable-lib-only --with-gnutls
+     % ./configure PKG_CONFIG_PATH=/path/to/gnutls/lib/pkgconfig:/path/to/nghttp3/lib/pkgconfig LDFLAGS="-Wl,-rpath,/path/to/gnutls/lib" \
+       --prefix=/path/to/ngtcp2 --enable-lib-only --with-gnutls
      % make
      % make install
 
-Build curl
+Build curl (with autotools):
 
      % cd ..
-     % git clone https://github.com/curl/curl
+     % git clone --depth 1 https://github.com/curl/curl
      % cd curl
      % autoreconf -fi
-     % ./configure --with-gnutls=<somewhere1> --with-nghttp3=<somewhere2> --with-ngtcp2=<somewhere3>
+     % ./configure PKG_CONFIG_PATH=/path/to/gnutls/lib/pkgconfig --with-gnutls=/path/to/gnutls --with-ngtcp2=/path/to/ngtcp2 --with-nghttp3=/path/to/nghttp3
      % make
      % make install
 
+Build curl (with CMake):
+
+     % cd ..
+     % git clone --depth 1 https://github.com/curl/curl
+     % cd curl
+     % PKG_CONFIG_PATH=/path/to/gnutls/lib/pkgconfig:/path/to/ngtcp2/lib/pkgconfig:/path/to/nghttp3/lib/pkgconfig cmake -B bld -DCURL_USE_GNUTLS=ON -DUSE_NGTCP2=ON
+     % cmake --build bld
+
 ## Build with wolfSSL
 
-Build wolfSSL
+Build wolfSSL:
 
-     % git clone https://github.com/wolfSSL/wolfssl.git
+     % git clone --depth 1 https://github.com/wolfSSL/wolfssl
      % cd wolfssl
      % autoreconf -fi
-     % ./configure --prefix=<somewhere1> --enable-quic --enable-session-ticket --enable-earlydata --enable-psk --enable-harden --enable-altcertchains
+     % ./configure --prefix=/path/to/wolfssl --enable-quic --enable-session-ticket --enable-earlydata --enable-psk --enable-harden --enable-altcertchains
      % make
      % make install
 
-Build nghttp3
+Build nghttp3:
 
      % cd ..
-     % git clone -b v0.15.0 https://github.com/ngtcp2/nghttp3
+     % git clone --depth 1 --branch $NGHTTP3_VERSION https://github.com/ngtcp2/nghttp3
      % cd nghttp3
+     % git submodule update --init
      % autoreconf -fi
-     % ./configure --prefix=<somewhere2> --enable-lib-only
+     % ./configure --prefix=/path/to/nghttp3 --enable-lib-only
      % make
      % make install
 
-Build ngtcp2
+Build ngtcp2:
 
      % cd ..
-     % git clone -b v0.19.1 https://github.com/ngtcp2/ngtcp2
+     % git clone --depth 1 --branch $NGTCP2_VERSION https://github.com/ngtcp2/ngtcp2
      % cd ngtcp2
      % autoreconf -fi
-     % ./configure PKG_CONFIG_PATH=<somewhere1>/lib/pkgconfig:<somewhere2>/lib/pkgconfig LDFLAGS="-Wl,-rpath,<somewhere1>/lib" --prefix=<somewhere3> --enable-lib-only --with-wolfssl
+     % ./configure PKG_CONFIG_PATH=/path/to/wolfssl/lib/pkgconfig:/path/to/nghttp3/lib/pkgconfig LDFLAGS="-Wl,-rpath,/path/to/wolfssl/lib" \
+       --prefix=/path/to/ngtcp2 --enable-lib-only --with-wolfssl
      % make
      % make install
 
-Build curl
+Build curl (with autotools):
 
      % cd ..
-     % git clone https://github.com/curl/curl
+     % git clone --depth 1 https://github.com/curl/curl
      % cd curl
      % autoreconf -fi
-     % ./configure --with-wolfssl=<somewhere1> --with-nghttp3=<somewhere2> --with-ngtcp2=<somewhere3>
+     % ./configure PKG_CONFIG_PATH=/path/to/wolfssl/lib/pkgconfig --with-wolfssl=/path/to/wolfssl --with-ngtcp2=/path/to/ngtcp2 --with-nghttp3=/path/to/nghttp3
      % make
      % make install
 
+Build curl (with CMake):
+
+     % cd ..
+     % git clone --depth 1 https://github.com/curl/curl
+     % cd curl
+     % PKG_CONFIG_PATH=/path/to/wolfssl/lib/pkgconfig:/path/to/ngtcp2/lib/pkgconfig:/path/to/nghttp3/lib/pkgconfig cmake -B bld -DCURL_USE_WOLFSSL=ON -DUSE_NGTCP2=ON
+     % cmake --build bld
+
 # quiche version
 
-Since the quiche build manages its dependencies, curl can be built against the latest version. You are *probably* able to build against their main branch, but in case of problems, we recommend their latest release tag.
+quiche support is **EXPERIMENTAL**
 
-## build
+Since the quiche build manages its dependencies, curl can be built against the
+latest version. You are *probably* able to build against their main branch,
+but in case of problems, we recommend their latest release tag.
 
-Build quiche and BoringSSL:
+## Build
 
-     % git clone --recursive https://github.com/cloudflare/quiche
+Build quiche and BoringSSL (described here for quiche v0.29.1, the locations
+where BoringSSL is to be found vary with version):
+
+     % git clone --depth 1 --branch 0.29.1 --recursive https://github.com/cloudflare/quiche
      % cd quiche
      % cargo build --package quiche --release --features ffi,pkg-config-meta,qlog
-     % mkdir quiche/deps/boringssl/src/lib
-     % ln -vnf $(find target/release -name libcrypto.a -o -name libssl.a) quiche/deps/boringssl/src/lib/
+     % ln -s libquiche.so target/release/libquiche.so.0
+     % mkdir -p boringssl/lib
+     % find target/release \( -name libcrypto.a -o -name libssl.a \) -exec ln -vnf -- '{}' boringssl/lib \;
+     % find target/release/build/boring-sys-*/out/boringssl/src -maxdepth 1 \( -name include \) -exec ln -vsf -- '../{}' boringssl \;
 
 Build curl:
 
      % cd ..
-     % git clone https://github.com/curl/curl
+     % git clone --depth 1 https://github.com/curl/curl
      % cd curl
      % autoreconf -fi
-     % ./configure LDFLAGS="-Wl,-rpath,$PWD/../quiche/target/release" --with-openssl=$PWD/../quiche/quiche/deps/boringssl/src --with-quiche=$PWD/../quiche/target/release
+     % ./configure --with-openssl=$PWD/../quiche/boringssl \
+                   --with-quiche=$PWD/../quiche/target/release
      % make
      % make install
 
- If `make install` results in `Permission denied` error, you will need to prepend it with `sudo`.
-
-# msh3 (msquic) version
-
-**Note**: The msquic HTTP/3 backend is immature and is not properly functional
-one as of September 2023. Feel free to help us test it and improve it, but
-there is no point in filing bugs about it just yet.
-
-## Build Linux (with quictls fork of OpenSSL)
-
-Build msh3:
-
-     % git clone -b v0.6.0 --depth 1 --recursive https://github.com/nibanks/msh3
-     % cd msh3 && mkdir build && cd build
-     % cmake -G 'Unix Makefiles' -DCMAKE_BUILD_TYPE=RelWithDebInfo ..
-     % cmake --build .
-     % cmake --install .
-
-Build curl:
-
-     % git clone https://github.com/curl/curl
-     % cd curl
-     % autoreconf -fi
-     % ./configure LDFLAGS="-Wl,-rpath,/usr/local/lib" --with-msh3=/usr/local --with-openssl
-     % make
-     % make install
-
-Run from `/usr/local/bin/curl`.
-
-## Build Windows
-
-Build msh3:
-
-     % git clone -b v0.6.0 --depth 1 --recursive https://github.com/nibanks/msh3
-     % cd msh3 && mkdir build && cd build
-     % cmake -G 'Visual Studio 17 2022' -DCMAKE_BUILD_TYPE=RelWithDebInfo ..
-     % cmake --build . --config Release
-     % cmake --install . --config Release
-
-**Note** - On Windows, Schannel will be used for TLS support by default. If
-you with to use (the quictls fork of) OpenSSL, specify the
-`-DQUIC_TLS=openssl` option to the generate command above. Also note that
-OpenSSL brings with it an additional set of build dependencies not specified
-here.
-
-Build curl (in [Visual Studio Command
-prompt](../winbuild/README.md#open-a-command-prompt)):
-
-     % git clone https://github.com/curl/curl
-     % cd curl/winbuild
-     % nmake /f Makefile.vc mode=dll WITH_MSH3=dll MSH3_PATH="C:/Program Files/msh3" MACHINE=x64
-
-**Note** - If you encounter a build error with `tool_hugehelp.c` being
-missing, rename `tool_hugehelp.c.cvs` in the same directory to
-`tool_hugehelp.c` and then run `nmake` again.
-
-Run in the `C:/Program Files/msh3/lib` directory, copy `curl.exe` to that
-directory, or copy `msquic.dll` and `msh3.dll` from that directory to the
-`curl.exe` directory. For example:
-
-     % C:\Program Files\msh3\lib> F:\curl\builds\libcurl-vc-x64-release-dll-ipv6-sspi-schannel-msh3\bin\curl.exe --http3 https://www.google.com
+If `make install` results in `Permission denied` error, you need to prepend
+it with `sudo`.
 
 # `--http3`
 
 Use only HTTP/3:
 
-    curl --http3-only https://nghttp2.org:4433/
+     % curl --http3-only https://example.org:4433/
 
 Use HTTP/3 with fallback to HTTP/2 or HTTP/1.1 (see "HTTPS eyeballing" below):
 
-    curl --http3 https://nghttp2.org:4433/
+     % curl --http3 https://example.org:4433/
 
 Upgrade via Alt-Svc:
 
-    curl --alt-svc altsvc.cache https://quic.aiortc.org/
+     % curl --alt-svc altsvc.cache https://curl.se/
 
 See this [list of public HTTP/3 servers](https://bagder.github.io/HTTP3-test/)
 
 ### HTTPS eyeballing
 
-With option `--http3` curl will attempt earlier HTTP versions as well should
-the connect attempt via HTTP/3 not succeed "fast enough". This strategy is
-similar to IPv4/6 happy eyeballing where the alternate address family is used
-in parallel after a short delay.
+With option `--http3` curl attempts earlier HTTP versions as well should the
+connect attempt via HTTP/3 fail "fast enough". This strategy is similar
+to IPv4/6 happy eyeballing where the alternate address family is used in
+parallel after a short delay.
 
 The IPv4/6 eyeballing has a default of 200ms and you may override that via
 `--happy-eyeballs-timeout-ms value`. Since HTTP/3 is still relatively new, we
@@ -283,25 +274,26 @@ or HTTP/1.1. At half of that value - currently - is the **soft** timeout. The
 soft timeout fires, when there has been **no data at all** seen from the
 server on the HTTP/3 connection.
 
-So, without you specifying anything, the hard timeout is 200ms and the soft is 100ms:
+Without you specifying anything, the hard timeout is 200ms and the soft is
+100ms:
 
- * Ideally, the whole QUIC handshake happens and curl has an HTTP/3 connection
-   in less than 100ms.
- * When QUIC is not supported (or UDP does not work for this network path), no
-   reply is seen and the HTTP/2 TLS+TCP connection starts 100ms later.
- * In the worst case, UDP replies start before 100ms, but drag on. This will
-   start the TLS+TCP connection after 200ms.
- * When the QUIC handshake fails, the TLS+TCP connection is attempted right
-   away. For example, when the QUIC server presents the wrong certificate.
+* Ideally, the whole QUIC handshake happens and curl has an HTTP/3 connection
+  in less than 100ms.
+* When QUIC is not supported (or UDP does not work for this network path), no
+  reply is seen and the HTTP/2 TLS+TCP connection starts 100ms later.
+* In the worst case, UDP replies start before 100ms, but drag on. This starts
+  the TLS+TCP connection after 200ms.
+* When the QUIC handshake fails, the TLS+TCP connection is attempted right
+  away. For example, when the QUIC server presents the wrong certificate.
 
 The whole transfer only fails, when **both** QUIC and TLS+TCP fail to
 handshake or time out.
 
 Note that all this happens in addition to IP version happy eyeballing. If the
-name resolution for the server gives more than one IP address, curl will try
-all those until one succeeds - just as with all other protocols. And if those
-IP addresses contain both IPv6 and IPv4, those attempts will happen, delayed,
-in parallel (the actual eyeballing).
+name resolution for the server gives more than one IP address, curl tries all
+those until one succeeds - as with all other protocols. If those IP addresses
+contain both IPv6 and IPv4, those attempts happen, delayed, in parallel (the
+actual eyeballing).
 
 ## Known Bugs
 
@@ -316,10 +308,9 @@ development and experimenting.
 
 An existing local HTTP/1.1 server that hosts files. Preferably also a few huge
 ones. You can easily create huge local files like `truncate -s=8G 8GB` - they
-are huge but do not occupy that much space on disk since they are just big
-holes.
+are huge but do not occupy that much space on disk since they are big holes.
 
-In a Debian setup you can install **apache2**. It runs on port 80 and has a
+In a Debian setup you can install apache2. It runs on port 80 and has a
 document root in `/var/www/html`. Download the 8GB file from apache with `curl
 localhost/8GB -o dev/null`
 
@@ -332,29 +323,31 @@ You can select either or both of these server solutions.
 
 ### nghttpx
 
-Get, build and install **quictls**, **nghttp3** and **ngtcp2** as described
+Get, build and install quictls, nghttp3 and ngtcp2 as described
 above.
 
-Get, build and install **nghttp2**:
+Get, build and install nghttp2:
 
-    git clone https://github.com/nghttp2/nghttp2.git
-    cd nghttp2
-    autoreconf -fi
-    PKG_CONFIG_PATH=$PKG_CONFIG_PATH:/home/daniel/build-quictls/lib/pkgconfig:/home/daniel/build-nghttp3/lib/pkgconfig:/home/daniel/build-ngtcp2/lib/pkgconfig  LDFLAGS=-L/home/daniel/build-quictls/lib CFLAGS=-I/home/daniel/build-quictls/include ./configure --enable-maintainer-mode --prefix=/home/daniel/build-nghttp2 --disable-shared --enable-app --enable-http3 --without-jemalloc --without-libxml2 --without-systemd
-    make && make install
+     % git clone --depth 1 https://github.com/nghttp2/nghttp2
+     % cd nghttp2
+     % autoreconf -fi
+     % PKG_CONFIG_PATH=$PKG_CONFIG_PATH:/path/to/quictls/lib/pkgconfig:/path/to/nghttp3/lib/pkgconfig:/path/to/ngtcp2/lib/pkgconfig \
+       LDFLAGS=-L/path/to/quictls/lib CFLAGS=-I/path/to/quictls/include ./configure --enable-maintainer-mode \
+       --prefix=/path/to/nghttp2 --disable-shared --enable-app --enable-http3 --without-jemalloc --without-libxml2 --without-systemd
+     % make && make install
 
 Run the local h3 server on port 9443, make it proxy all traffic through to
-HTTP/1 on localhost port 80. For local toying, we can just use the test cert
-that exists in curl's test dir.
+HTTP/1 on localhost port 80. For local toying, we can use the test cert that
+exists in curl's test dir.
 
-    CERT=$CURLSRC/tests/stunnel.pem
-    $HOME/bin/nghttpx $CERT $CERT --backend=localhost,80 \
-      --frontend="localhost,9443;quic"
+     % CERT=/path/to/stunnel.pem
+     % $HOME/bin/nghttpx $CERT $CERT --backend=localhost,80 \
+       --frontend="localhost,9443;quic"
 
 ### Caddy
 
-[Install Caddy](https://caddyserver.com/docs/install). For easiest use, the binary
-should be either in your PATH or your current directory.
+[Install Caddy](https://caddyserver.com/docs/install). For easiest use, the
+binary should be either in your PATH or your current directory.
 
 Create a `Caddyfile` with the following content:
 ~~~
@@ -365,9 +358,11 @@ localhost:7443 {
 
 Then run Caddy:
 
-    ./caddy start
+     % ./caddy start
 
-Making requests to `https://localhost:7443` should tell you which protocol is being used.
+Making requests to `https://localhost:7443` should tell you which protocol is
+being used.
 
-You can change the hard-coded response to something more useful by replacing `respond`
-with `reverse_proxy` or `file_server`, for example: `reverse_proxy localhost:80`
+You can change the hard-coded response to something more useful by replacing
+`respond` with `reverse_proxy` or `file_server`, for example: `reverse_proxy
+localhost:80`
diff --git a/third-party/curl/docs/HTTPSRR.md b/third-party/curl/docs/HTTPSRR.md
new file mode 100644
index 0000000000..fbdebc7fde
--- /dev/null
+++ b/third-party/curl/docs/HTTPSRR.md
@@ -0,0 +1,100 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# HTTPS RR
+
+[RFC 9460](https://datatracker.ietf.org/doc/html/rfc9460) documents the HTTPS
+DNS Resource Record.
+
+curl features **experimental** support for HTTPS RR.
+
+- The ALPN list from the record is parsed and used
+- The ECH field is stored - and used if ECH is enabled in the build
+- The port number is not used (Firefox supports it, Chrome does not)
+- The target name is not used
+- The IP addresses (`Ipv6hints`, `Ipv4hints`) from the HTTPS RR are not used
+- It only supports a single HTTPS RR per hostname
+- Hostnames without A/AAAA records but *with* HTTPS RR fails
+- consider service profiles where the RR provides different addresses for TCP
+  vs QUIC etc
+
+`HTTPSRR` is listed as a feature in the `curl -V` output if curl contains
+HTTPS RR support. If c-ares is not included in the build, the HTTPS RR support
+is limited to DoH.
+
+`asyn-rr` is listed as a feature in the `curl -V` output if c-ares is used for
+additional resolves in addition to a "normal" resolve done with the threaded
+resolver.
+
+The data extracted from the HTTPS RR is stored in the in-memory DNS cache to
+be reused on subsequent uses of the same hostnames.
+
+## limitations
+
+We have decided to work on the HTTPS RR support by following what seems to be
+(widely) used, and wait with implementing the details of the record
+that do not seem to be deployed. HTTPS RR is a DNS field with many odd corners
+and complexities and we might as well avoid them if no one seems to want them.
+
+## build
+
+    ./configure --enable-httpsrr
+
+or
+
+    cmake -DUSE_HTTPSRR=ON
+
+## ALPN
+
+The list of ALPN IDs is parsed but may not be completely respected because of
+what the HTTP version preference is set to, which is a problem we are working
+on. Also, getting an `HTTP/1.1` ALPN in the HTTPS RR field for an `http://`
+transfer should imply switching to HTTPS, HSTS style. Which curl currently
+does not.
+
+## DoH
+
+When HTTPS RR is enabled in the curl build, The DoH code asks for an HTTPS
+record in addition to the A and AAAA records, and if an HTTPS RR answer is
+returned, curl parses it and stores the retrieved information.
+
+## Non-DoH
+
+If DoH is not used for name resolving in an HTTPS RR enabled build, we must
+provide the ability using the regular resolver backends. We use the c-ares DNS
+library for the HTTPS RR lookup. Version 1.28.0 or later.
+
+### c-ares
+
+If curl is built to use the c-ares library for name resolves, an HTTPS RR
+enabled build makes a request for the HTTPS RR in addition to the regular
+lookup.
+
+### Threaded resolver
+
+When built to use the threaded resolver, which is the default, an HTTPS RR
+build still needs a c-ares installation provided so that a separate request
+for the HTTPS record can be done in parallel to the regular getaddrinfo()
+call.
+
+This is done by specifying both c-ares and threaded resolver to configure:
+
+    ./configure --enable-ares=... --enable-threaded-resolver
+
+or to cmake:
+
+    cmake -DENABLE_ARES=ON -DENABLE_THREADED_RESOLVER=ON
+
+Because the HTTPS record is handled separately from the A/AAAA record
+retrieval, by a separate library, there is a small risk for discrepancies.
+
+When building curl using the threaded resolver with HTTPS RR support (using
+c-ares), the `curl -V` output looks exactly like a c-ares resolver build.
+
+## HTTPS RR Options
+
+Because curl is a low level transfer tool for which users sometimes want
+detailed control, we need to offer options to control HTTPS RR use.
diff --git a/third-party/curl/docs/HYPER.md b/third-party/curl/docs/HYPER.md
deleted file mode 100644
index 1c3b0dded4..0000000000
--- a/third-party/curl/docs/HYPER.md
+++ /dev/null
@@ -1,69 +0,0 @@
-# Hyper
-
-Hyper is a separate HTTP library written in Rust. curl can be told to use this
-library as a backend to deal with HTTP.
-
-## Experimental!
-
-Hyper support in curl is considered **EXPERIMENTAL** until further notice. It
-needs to be explicitly enabled at build-time.
-
-Further development and tweaking of the Hyper backend support in curl will
-happen in the master branch using pull-requests, just like ordinary
-changes.
-
-## Hyper version
-
-The C API for Hyper is brand new and is still under development.
-
-## build curl with hyper
-
-Using Rust 1.64.0 or later, build hyper and enable its C API like this:
-
-     % git clone https://github.com/hyperium/hyper
-     % cd hyper
-     % RUSTFLAGS="--cfg hyper_unstable_ffi" cargo rustc --features client,http1,http2,ffi --crate-type cdylib
-
-Also, `--release` can be added for a release (optimized) build.
-
-Build curl to use hyper's C API:
-
-     % git clone https://github.com/curl/curl
-     % cd curl
-     % autoreconf -fi
-     % ./configure LDFLAGS="-Wl,-rpath,<hyper-dir>/target/debug -Wl,-rpath,<hyper-dir>/target/release" --with-openssl --with-hyper=<hyper-dir>
-     % make
-
-# using Hyper internally
-
-Hyper is a low level HTTP transport library. curl itself provides all HTTP
-headers and Hyper provides all received headers back to curl.
-
-Therefore, most of the "header logic" in curl as in responding to and acting
-on specific input and output headers are done the same way in curl code.
-
-The API in Hyper delivers received HTTP headers as (cleaned up) name=value
-pairs, making it impossible for curl to know the exact byte representation
-over the wire with Hyper.
-
-## Limitations
-
-The hyper backend does not support
-
-- `CURLOPT_IGNORE_CONTENT_LENGTH`
-- `--raw` and disabling `CURLOPT_HTTP_TRANSFER_DECODING`
-- RTSP
-- hyper is much stricter about what HTTP header contents it allows
-- leading whitespace in first HTTP/1 response header
-- HTTP/0.9
-- HTTP/2 upgrade using HTTP:// URLs. Aka 'h2c'
-
-## Remaining issues
-
-This backend is still not feature complete with the native backend. Areas that
-still need attention and verification include:
-
-- multiplexed HTTP/2
-- h2 Upgrade:
-- receiving HTTP/1 trailers
-- sending HTTP/1 trailers
diff --git a/third-party/curl/docs/INFRASTRUCTURE.md b/third-party/curl/docs/INFRASTRUCTURE.md
new file mode 100644
index 0000000000..a4f8b58433
--- /dev/null
+++ b/third-party/curl/docs/INFRASTRUCTURE.md
@@ -0,0 +1,201 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# Infrastructure in the curl project
+
+Overview of infrastructure we maintain, host and run in the project for the
+project.
+
+## git repository
+
+Since 2010, the main curl git repository has been hosted by GitHub, available
+at https://github.com/curl/curl.
+
+We also use the issue tracker, pull requests and discussions on GitHub.
+
+curl has an "enterprise account" on GitHub and is an "organization" on the
+site.
+
+We accept sponsorship via GitHub Sponsors.
+
+## CI services
+
+For every pull request and git push to the master repository, a number of
+build and testing jobs are run on a set of different CI services. The exact
+services vary over time. GitHub Actions and AppVeyor are the primary ones
+these days.
+
+## Test Clutch
+
+A [Test Clutch](https://github.com/dfandrich/testclutch) instance generates
+regular reports on curl CI test results at https://testclutch.curl.se/ as well
+as writing comments on curl pull requests whose tests have failed. The jobs
+are hosted on a Virtuozzo Application Platform PaaS instance and is managed by
+Dan Fandrich. The configuration code is available and managed at
+https://github.com/dfandrich/testclutch-curl-web
+
+## Autobuilds
+
+The curl autobuild system is a set of scripts that build and test curl and
+send all output logs back to the autobuild server. The results are
+continuously collected and visualized on the curl website at
+<https://curl.se/dev/builds.html>.
+
+The autobuild system and server is maintained by Daniel Stenberg.
+
+## OSS-Fuzz
+
+Google runs the [OSS-Fuzz](https://google.github.io/oss-fuzz/) project which
+also runs fuzzing on curl code, non-stop, in their infrastructure and they
+send us emails in the rare instances they actually find something.
+
+OSS-Fuzz notifies those that are members in the "curl team". Any curl
+maintainer who wants to is welcome to participate. It requires a Google
+account.
+
+## Coverity
+
+We regularly run our code through the [Coverity static code
+analyzer](https://scan.coverity.com/) thanks to them offering this service to
+us free of charge.
+
+## CodeSonar
+
+[CodeSonar](https://www.adacore.com/codesonar) analyzes the curl
+source code daily and emails Daniel Stenberg whenever it finds suspected
+problems in the source code. I hope and expect that we can invite other
+maintainers to access these reports soon.
+
+## Domain names
+
+The project runs services and website using a few different curl related
+domain names, including `curl.se` and `curl.dev`. Daniel Stenberg owns these
+domain names.
+
+Until a few years ago, the curl website was present at `curl.haxx.se`. The
+`haxx.se` domain is owned by Haxx AB, administered by Daniel Stenberg. The
+curl.haxx.se name is meant to keep working and be redirecting to curl.se for
+the foreseeable future.
+
+## Websites
+
+The main curl website at `curl.se` is maintained by curl maintainers and the
+content is available and managed at https://github.com/curl/curl-www. The site
+updates from git and runs make every 20 minutes. Any change pushed to git can
+thus take up to 20 minutes until it takes effect on the origin server.
+
+The content on `curl.dev` is available and managed at
+https://github.com/curl/curl.dev/
+
+The content on `everything-curl.dev` is available and managed at
+https://github.com/curl/everything-curl/
+
+The machine hosting the website contents for these three sites is owned by
+Haxx AB and is primarily managed by Daniel Stenberg (co-owner of the Haxx
+company). The machine is physically located in Sweden.
+
+curl release tarballs are hosted on https://curl.se/download.html. They are
+uploaded there at release-time by the release manager.
+
+curl-for-win downloads are hosted on https://curl.se/windows/ and are uploaded
+to the server by Viktor Szakats.
+
+curl-for-QNX downloads are hosted on <https://curl.se/qnx/> and are uploaded
+to the server by Daniel Stenberg.
+
+Daily release tarball-like snapshots are generated automatically and are
+provided for download at <https://curl.se/snapshots/>.
+
+CA certificate bundles are extracted from the Firefox source code, hosted by
+Mozilla and converted to PEM file format and is offered for download. The
+conversion checks for updates daily. The bundle is provided for download at
+<https://curl.se/docs/caextract.html>.
+
+There is an automated "download check bot" that runs twice daily to scan for
+available curl downloads to populate the curl download page appropriately with
+the correct updated information. The bot uses URLs and patterns for all
+download packages and is maintained in a database, maintained by Daniel
+Stenberg and Dan Fandrich.
+
+The TLS certificate for the origin curl web server is automatically updated
+from Let's Encrypt.
+
+## CDN
+
+Fastly runs the Content Delivery Network (CDN) that fronts all the curl
+websites. The CDN caches content that it gets from the origin server.
+Recently, roughly 99.99% of web requests are satisfied by the CDN without
+having to reach the origin.
+
+The CDN caches different content at different lengths depending on the
+content-type. The caching thus adds to the time for a change to have an effect
+on the site from the moment it gets pushed to the git repository.
+
+Using this setup, we provide four IPv4 addresses and eight IPv6 addresses for
+anycast access to the site. Should be snappy from virtually everywhere across
+the globe.
+
+The CDN servers support HTTP/1, HTTP/2 and HTTP/3. They set HSTS for a year.
+The `http://` version of the site redirects to `https://`.
+
+Fastly manages the TLS certificates from Let's Encrypt for the servers they
+run on the behalf of curl.
+
+## Containers
+
+The curl project offer container builds of curl. The source repository for
+them is located at <https://github.com/curl/curl-container>.
+
+Container images are hosted at <https://quay.io/repository/curl/curl> and
+<https://hub.docker.com/r/curlimages/curl>
+
+## DNS
+
+The primary domain name, `curl.se` is managed by Kirei and is offered over
+fault-tolerant anycast servers. High availability and fast access for
+everyone.
+
+The actual physical DNS files and origin bind instance is managed by Daniel
+Stenberg.
+
+## Mailing lists
+
+The curl related mailing lists are hosted by Haxx AB on `lists.haxx.se` and
+are maintained by Daniel Stenberg. This includes the mailman2 and Postfix
+instances used for this.
+
+## Email
+
+We use a few rare additional curl related email aliases in the curl domains.
+They go through the mail server `mail.haxx.se` maintained by Daniel Stenberg
+
+## Open Collective
+
+We use [Open Collective](https://opencollective.com/curl) as our "fiscal
+host". All money sent to and received by the curl project is managed by Open
+Collective.
+
+## Merchandise
+
+We have stickers, coffee mugs and coasters. They are managed by Daniel who
+sits on the inventory. The best way to get your hands on curl merchandise is
+to attend events where Daniel is physically.
+
+## Chat
+
+Some curl developers, maintainers, users and enthusiasts use IRC for real-time
+chat about curl and related topics. This done in the `#curl` channel on the
+`libra.chat` IRC network. **Daniel Stenberg** (`bagder`) is registered owner
+of the channel. We do not run any IRC servers or services ourselves.
+
+`curelbot` is a service in the channel that shows details about GitHub issues
+and pull requests when publicly mentioned using #[number]. The bot is run by
+user `TheAssassin`.
+
+There is a Matrix bridge to the IRC channel called `matrix.curl.se`. The
+bridge is setup and run by **Sergio Durigan Junior** and **Daniel Stenberg**.
+
+[curl online chat documentation](https://curl.se/docs/irc.html)
diff --git a/third-party/curl/docs/INSTALL-CMAKE.md b/third-party/curl/docs/INSTALL-CMAKE.md
new file mode 100644
index 0000000000..64975ab630
--- /dev/null
+++ b/third-party/curl/docs/INSTALL-CMAKE.md
@@ -0,0 +1,612 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# Building with CMake
+
+This document describes how to configure, build and install curl and libcurl
+from source code using the CMake build tool. To build with CMake, you of
+course first have to install CMake. The minimum required version of CMake is
+specified in the file `CMakeLists.txt` found in the top of the curl source
+tree. Once the correct version of CMake is installed you can follow the
+instructions below for the platform you are building on.
+
+CMake builds can be configured either from the command line, or from one of
+CMake's GUIs.
+
+# Configuring
+
+A CMake configuration of curl is similar to the autotools build of curl.
+It consists of the following steps after you have unpacked the source.
+
+We recommend building with CMake on Windows. For instructions on migrating
+from the `projects/Windows` Visual Studio solution files, see
+[this section](#migrating-from-visual-studio-ide-project-files).
+
+## Using `cmake`
+
+You can configure for in source tree builds or for a build tree
+that is apart from the source tree.
+
+- Build in the source tree.
+
+      $ cmake -B .
+
+- Build in a separate directory (parallel to the curl source tree in this
+  example). The build directory is created for you. This is recommended over
+  building in the source tree to separate source and build artifacts.
+
+      $ cmake -B ../curl-build
+
+For the full list of CMake build configuration variables see
+[the corresponding section](#cmake-build-options).
+
+### Build system generator selection
+
+You can override CMake's default by using `-G <generator-name>`. For example
+on Windows with multiple build systems if you have MinGW-w64 then you could use
+`-G "MinGW Makefiles"`.
+[List of generator names](https://cmake.org/cmake/help/latest/manual/cmake-generators.7.html).
+
+## Using `ccmake`
+
+CMake comes with a curses based interface called `ccmake`. To run `ccmake`
+on a curl use the instructions for the command line cmake, but substitute
+`ccmake` for `cmake`.
+
+This brings up a curses interface with instructions on the bottom of the
+screen. You can press the "c" key to configure the project, and the "g" key to
+generate the project. After the project is generated, you can run make.
+
+## Using `cmake-gui`
+
+CMake also comes with a Qt based GUI called `cmake-gui`. To configure with
+`cmake-gui`, you run `cmake-gui` and follow these steps:
+
+1. Fill in the "Where is the source code" combo box with the path to
+   the curl source tree.
+2. Fill in the "Where to build the binaries" combo box with the path to
+   the directory for your build tree, ideally this should not be the same
+   as the source tree, but a parallel directory called curl-build or
+   something similar.
+3. Once the source and binary directories are specified, press the
+   "Configure" button.
+4. Select the native build tool that you want to use.
+5. At this point you can change any of the options presented in the GUI.
+   Once you have selected all the options you want, click the "Generate"
+   button.
+
+# Building
+
+Build (you have to specify the build directory).
+
+    $ cmake --build ../curl-build
+
+## Static builds
+
+The CMake build setup is primarily done to work with shared/dynamic third
+party dependencies. When linking with shared libraries, the dependency "chain"
+is handled automatically by the library loader - on all modern systems.
+
+If you instead link with a static library, you need to provide all the
+dependency libraries already at the link command line.
+
+Figuring out all the dependency libraries for a given library is hard, as it
+might involve figuring out the dependencies of the dependencies and they vary
+between platforms and can change between versions.
+
+When using static dependencies, the build scripts mostly assume that you, the
+user, provide all the necessary additional dependency libraries as additional
+arguments in the build.
+
+Building statically is not for the faint of heart.
+
+# Testing
+
+(The test suite does not yet work with the cmake build)
+
+# Installing
+
+Install to default location (you have to specify the build directory).
+
+    $ cmake --install ../curl-build
+
+Do not use `--prefix` to change the installation prefix as the output produced
+by the `curl-config` script is determined at CMake configure time. If you want
+to set a custom install prefix for curl, set
+[`CMAKE_INSTALL_PREFIX`](https://cmake.org/cmake/help/latest/variable/CMAKE_INSTALL_PREFIX.html)
+when configuring the CMake build.
+
+# CMake usage
+
+This section describes how to locate and use curl/libcurl from CMake-based
+projects.
+
+## Using `find_package`
+
+To locate libcurl from CMake, one can use the standard
+[`find_package`](https://cmake.org/cmake/help/latest/command/find_package.html)
+command in the typical fashion:
+
+```cmake
+find_package(CURL 8.12.0 REQUIRED)  # FATAL_ERROR if CURL is not found
+```
+
+This invokes the CMake-provided
+[FindCURL](https://cmake.org/cmake/help/latest/module/FindCURL.html) find module,
+which first performs a search using the `find_package`
+[config mode](https://cmake.org/cmake/help/latest/command/find_package.html#config-mode-search-procedure).
+This is supported by the `CURLConfig.cmake` CMake config script which is
+available if the given CURL was built and installed using CMake.
+
+### Detecting CURL features/protocols
+
+Since version 8.12.0, `CURLConfig.cmake` publishes the supported CURL features
+and protocols (see [release notes](https://curl.se/ch/8.12.0.html)). These can
+be specified using the `find_package` keywords `COMPONENTS` and
+`OPTIONAL_COMPONENTS`, with protocols in all caps, e.g. `HTTPS`, `LDAP`, while
+features should be in their original sentence case, e.g. `AsynchDNS`,
+`UnixSockets`. If any of the `COMPONENTS` are missing, then CURL is considered
+as *not* found.
+
+Here is an example of using `COMPONENTS` and `OPTIONAL_COMPONENTS` in
+`find_package` with CURL:
+
+```cmake
+# CURL_FOUND is FALSE if no HTTPS but brotli and zstd can be missing
+find_package(CURL 8.12.0 COMPONENTS HTTPS OPTIONAL_COMPONENTS brotli zstd)
+```
+
+One can also check the defined `CURL_SUPPORTS_<feature-or-protocol>` variables
+if a particular feature/protocol is supported. For example:
+
+```cmake
+# check HTTPS
+if(CURL_SUPPORTS_HTTPS)
+  message(STATUS "CURL supports HTTPS")
+else()
+  message(STATUS "CURL does NOT support HTTPS")
+endif()
+```
+
+### Linking against libcurl
+
+To link a CMake target against libcurl one can use
+[`target_link_libraries`](https://cmake.org/cmake/help/latest/command/target_link_libraries.html)
+as usual:
+
+```cmake
+target_link_libraries(my_target PRIVATE CURL::libcurl)
+```
+
+# CMake build options
+
+- `BUILD_CURL_EXE`:                         Build curl executable. Default: `ON`
+- `BUILD_EXAMPLES`:                         Build libcurl examples. Default: `ON`
+- `BUILD_LIBCURL_DOCS`:                     Build libcurl man pages. Default: `ON`
+- `BUILD_MISC_DOCS`:                        Build misc man pages (e.g. `curl-config` and `mk-ca-bundle`). Default: `ON`
+- `BUILD_SHARED_LIBS`:                      Build shared libraries. Default: `ON` (if target platform supports shared libs, otherwise `OFF`)
+- `BUILD_STATIC_CURL`:                      Build curl executable with static libcurl. Default: `OFF` (turns to `ON`, when building static libcurl only)
+- `BUILD_STATIC_LIBS`:                      Build static libraries. Default: `OFF` (turns to `ON` if `BUILD_SHARED_LIBS` is `OFF`)
+- `BUILD_TESTING`:                          Build tests. Default: `ON`
+- `CURL_BUILD_EVERYTHING`:                  Build optional build targets (examples, tests) by default. Default: `OFF`
+                                            Set `QUICK` to build examples quickly with the `curl-examples-build` target (for build tests).
+                                            Set `NOEXAMPLES` to not build examples.
+- `CURL_CLANG_TIDY`:                        Run the build through `clang-tidy`. Default: `OFF`
+                                            If enabled, it implies `CURL_DISABLE_TYPECHECK=ON` and force-disables unity mode
+                                            for libcurl and the curl tool.
+- `CURL_CLANG_TIDYFLAGS`:                   Custom options to pass to `clang-tidy`. Default: (empty)
+- `CURL_CODE_COVERAGE`:                     Enable code coverage build options. Default: `OFF`
+- `CURL_COMPLETION_FISH`:                   Install fish completions. Default: `OFF`
+- `CURL_COMPLETION_FISH_DIR`:               Custom fish completion install directory.
+- `CURL_COMPLETION_ZSH`:                    Install zsh completions. Default: `OFF`
+- `CURL_COMPLETION_ZSH_DIR`:                Custom zsh completion install directory.
+- `CURL_DEFAULT_SSL_BACKEND`:               Override default TLS backend in MultiSSL builds.
+                                            Accepted values in order of default priority:
+                                            `wolfssl`, `gnutls`, `mbedtls`, `openssl`, `schannel`, `rustls`
+- `CURL_DROP_UNUSED`:                       Drop unused code and data from built binaries. Default: `OFF`
+- `CURL_ENABLE_EXPORT_TARGET`:              Enable CMake export target. Default: `ON`
+- `CURL_GCC_ANALYZER`:                      Enable GCC `--analyzer` option. Default: `OFF`
+- `CURL_HIDDEN_SYMBOLS`:                    Hide libcurl internal symbols (=hide all symbols that are not officially external). Default: `ON`
+- `CURL_LIBCURL_SOVERSION`:                 Enable libcurl SOVERSION. Default: `ON` for supported platforms
+- `CURL_LIBCURL_VERSIONED_SYMBOLS`:         Enable libcurl versioned symbols. Default: `OFF`
+- `CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX`:  Override default versioned symbol prefix. Default: `<TLS-BACKEND>_` or `MULTISSL_`
+- `CURL_LINT`:                              Run lint checks while building. Default: `OFF`
+- `CURL_LTO`:                               Enable compiler Link Time Optimizations. Default: `OFF`
+- `CURL_PATCHSTAMP`:                        Set security patch string for `curl -V`/`curl --version` output.
+- `CURL_STATIC_CRT`:                        Build libcurl with static CRT with MSVC (`/MT`) (requires UCRT, static libcurl or no curl executable). Default: `OFF`
+- `CURL_TARGET_WINDOWS_VERSION`:            Minimum target Windows version as hex string, e.g. `0x0a00` for Windows 10.
+- `CURL_WERROR`:                            Turn compiler warnings into errors. Default: `OFF`
+- `ENABLE_CURL_MANUAL`:                     Build the man page for curl and enable its `-M`/`--manual` option. Default: `ON`
+- `ENABLE_DEBUG`:                           Enable curl debug features (for developing curl itself). Default: `OFF`
+- `IMPORT_LIB_SUFFIX`:                      Import library suffix. Default: `_imp` for MSVC-like toolchains, otherwise empty.
+- `LIBCURL_OUTPUT_NAME`:                    Basename of the curl library. Default: `libcurl`
+- `PICKY_COMPILER`:                         Enable picky compiler options. Default: `ON`
+- `SHARE_LIB_OBJECT`:                       Build shared and static libcurl in a single pass (requires CMake 3.12 or newer). Default: `ON` for Windows
+- `STATIC_LIB_SUFFIX`:                      Static library suffix. Default: (empty)
+
+## Root CA options
+
+- `CURL_CA_BUNDLE`:                         Absolute path to the CA bundle. Set `none` to disable or `auto` for auto-detection. Default: `auto`
+- `CURL_CA_EMBED`:                          Absolute path to the CA bundle to embed in the curl tool. Default: (disabled)
+- `CURL_CA_FALLBACK`:                       Use built-in CA store of OpenSSL. Default: `OFF`
+- `CURL_CA_NATIVE`:                         Use native CA store. Default: `OFF`
+                                            Supported by GnuTLS, OpenSSL (including forks) on Windows, wolfSSL.
+- `CURL_CA_PATH`:                           Absolute path to a directory containing CA certificates stored individually.
+                                            Set `none` to disable or `auto` for auto-detection. Default: `auto`
+- `CURL_CA_SEARCH_SAFE`:                    Enable safe CA bundle search (within the curl tool directory) on Windows. Default: `OFF`
+- `USE_APPLE_SECTRUST`:                     Use Apple OS-native certificate verification. Default: `OFF`
+
+## Enabling features
+
+- `CURL_ENABLE_NTLM`:                       Enable NTLM support. Default: `OFF`
+- `CURL_ENABLE_SMB`:                        Enable SMB. Default: `OFF`
+- `CURL_ENABLE_SSL`:                        Enable SSL support. Default: `ON`
+- `CURL_WINDOWS_SSPI`:                      Enable SSPI on Windows. Default: =`CURL_USE_SCHANNEL`
+- `ENABLE_IPV6`:                            Enable IPv6 support. Default: `ON` if target supports IPv6.
+- `ENABLE_THREADED_RESOLVER`:               Enable threaded DNS lookup. Default: `ON` if c-ares is not enabled and target supports threading.
+- `ENABLE_UNICODE`:                         Use the Unicode version of the Windows API functions. Default: `OFF`
+- `ENABLE_UNIX_SOCKETS`:                    Enable Unix domain sockets support. Default: `ON`
+- `USE_APPLE_IDN`:                          Use Apple built-in IDN support. Default: `OFF`
+- `USE_ECH`:                                Enable ECH support (experimental). Default: `OFF`
+- `USE_HTTPSRR`:                            Enable HTTPS RR support (experimental). Default: `OFF`
+- `USE_PROXY_HTTP3`:                        Enable HTTP/3 proxy support (experimental). Default: `OFF`
+- `USE_SSLS_EXPORT`:                        Enable SSL session import/export (experimental). Default: `OFF`
+- `USE_WIN32_IDN`:                          Use WinIDN for IDN support. Default: `OFF`
+- `USE_WIN32_LDAP`:                         Use Windows LDAP implementation. Default: `ON`
+
+## Disabling features
+
+- `CURL_DISABLE_ALTSVC`:                    Disable alt-svc support. Default: `OFF`
+- `CURL_DISABLE_AWS`:                       Disable **aws-sigv4**. Default: `OFF`
+- `CURL_DISABLE_BASIC_AUTH`:                Disable Basic authentication. Default: `OFF`
+- `CURL_DISABLE_BEARER_AUTH`:               Disable Bearer authentication. Default: `OFF`
+- `CURL_DISABLE_BINDLOCAL`:                 Disable local binding support. Default: `OFF`
+- `CURL_DISABLE_CA_SEARCH`:                 Disable unsafe CA bundle search in PATH on Windows. Default: `OFF` (turns to `ON`, when `CURL_CA_NATIVE=ON`)
+- `CURL_DISABLE_COOKIES`:                   Disable cookies support. Default: `OFF`
+- `CURL_DISABLE_DICT`:                      Disable DICT. Default: `OFF`
+- `CURL_DISABLE_DIGEST_AUTH`:               Disable Digest authentication. Default: `OFF`
+- `CURL_DISABLE_DOH`:                       Disable DNS-over-HTTPS. Default: `OFF`
+- `CURL_DISABLE_FILE`:                      Disable FILE. Default: `OFF`
+- `CURL_DISABLE_FORM_API`:                  Disable **form-api**. Default: =`CURL_DISABLE_MIME`
+- `CURL_DISABLE_FTP`:                       Disable FTP. Default: `OFF`
+- `CURL_DISABLE_GETOPTIONS`:                Disable `curl_easy_options` API for existing options to `curl_easy_setopt`. Default: `OFF`
+- `CURL_DISABLE_GOPHER`:                    Disable Gopher. Default: `OFF`
+- `CURL_DISABLE_HEADERS_API`:               Disable **headers-api** support. Default: `OFF`
+- `CURL_DISABLE_HSTS`:                      Disable HSTS support. Default: `OFF`
+- `CURL_DISABLE_HTTP`:                      Disable HTTP. Default: `OFF`
+- `CURL_DISABLE_HTTP_AUTH`:                 Disable all HTTP authentication methods. Default: `OFF`
+- `CURL_DISABLE_IMAP`:                      Disable IMAP. Default: `OFF`
+- `CURL_DISABLE_INSTALL`:                   Disable installation targets. Default: `OFF`
+- `CURL_DISABLE_IPFS`:                      Disable IPFS. Default: `OFF`
+- `CURL_DISABLE_KERBEROS_AUTH`:             Disable Kerberos authentication. Default: `OFF`
+- `CURL_DISABLE_LDAP`:                      Disable LDAP. Default: `OFF`
+- `CURL_DISABLE_LDAPS`:                     Disable LDAPS. Default: =`CURL_DISABLE_LDAP`
+- `CURL_DISABLE_LIBCURL_OPTION`:            Disable `--libcurl` option from the curl tool. Default: `OFF`
+- `CURL_DISABLE_MIME`:                      Disable MIME support. Default: `OFF`
+- `CURL_DISABLE_MQTT`:                      Disable MQTT. Default: `OFF`
+- `CURL_DISABLE_NEGOTIATE_AUTH`:            Disable negotiate authentication. Default: `OFF`
+- `CURL_DISABLE_NETRC`:                     Disable netrc parser. Default: `OFF`
+- `CURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG`:  Disable automatic loading of OpenSSL configuration. Default: `OFF`
+- `CURL_DISABLE_PARSEDATE`:                 Disable date parsing. Default: `OFF`
+- `CURL_DISABLE_POP3`:                      Disable POP3. Default: `OFF`
+- `CURL_DISABLE_PROGRESS_METER`:            Disable built-in progress meter. Default: `OFF`
+- `CURL_DISABLE_PROXY`:                     Disable proxy support. Default: `OFF`
+- `CURL_DISABLE_RTSP`:                      Disable RTSP. Default: `OFF`
+- `CURL_DISABLE_SHA512_256`:                Disable SHA-512/256 hash algorithm. Default: `OFF`
+- `CURL_DISABLE_SHUFFLE_DNS`:               Disable shuffle DNS feature. Default: `OFF`
+- `CURL_DISABLE_SMTP`:                      Disable SMTP. Default: `OFF`
+- `CURL_DISABLE_SOCKETPAIR`:                Disable use of socketpair for curl_multi_poll(). Default: `OFF`
+- `CURL_DISABLE_SRP`:                       Disable TLS-SRP support. Default: `OFF`
+- `CURL_DISABLE_TELNET`:                    Disable Telnet. Default: `OFF`
+- `CURL_DISABLE_TFTP`:                      Disable TFTP. Default: `OFF`
+- `CURL_DISABLE_TYPECHECK`:                 Disable curl_easy_setopt()/curl_easy_getinfo() type checking. Default: `OFF`
+- `CURL_DISABLE_VERBOSE_STRINGS`:           Disable verbose strings. Default: `OFF`
+- `CURL_DISABLE_WEBSOCKETS`:                Disable WebSocket. Default: `OFF`
+- `HTTP_ONLY`:                              Disable all protocols except HTTP (This overrides all `CURL_DISABLE_*` options). Default: `OFF`
+
+## Environment
+
+- `CI`:                                     Assume running under CI if set.
+- `CURL_BUILDINFO`:                         Print `buildinfo.txt` if set.
+- `CURL_CI`:                                Assume running under CI if set.
+
+## Environment (via CMake)
+
+- `CC`:                                     Set C compiler. Alternative to `CMAKE_C_COMPILER` option.
+- `CFLAGS`:                                 Pass custom C compiler flags. Alternative to `CMAKE_C_FLAGS` option.
+- `CMAKE_GENERATOR`:                        Alternative to `-G` command-line option.
+- `DESTDIR`:                                Set install destination directory.
+- `LDFLAGS`:                                Pass custom linker flags.
+
+Details via CMake
+[envvars](https://cmake.org/cmake/help/latest/manual/cmake-env-variables.7.html).
+
+## CMake options
+
+- `CMAKE_BUILD_TYPE`:                       (see CMake)
+- `CMAKE_DEBUG_POSTFIX`:                    Default: `-d`
+- `CMAKE_IMPORT_LIBRARY_SUFFIX`             (see CMake)
+- `CMAKE_INSTALL_BINDIR`                    (see CMake)
+- `CMAKE_INSTALL_INCLUDEDIR`                (see CMake)
+- `CMAKE_INSTALL_LIBDIR`                    (see CMake)
+- `CMAKE_INSTALL_PREFIX`                    (see CMake)
+- `CMAKE_STATIC_LIBRARY_SUFFIX`             (see CMake)
+- `CMAKE_UNITY_BUILD_BATCH_SIZE`:           Set the number of sources in a "unity" unit. Default: `0` (all)
+- `CMAKE_UNITY_BUILD`:                      Enable "unity" (aka "jumbo") builds. Default: `OFF`
+
+Details via CMake
+[variables](https://cmake.org/cmake/help/latest/manual/cmake-variables.7.html) and
+[install directories](https://cmake.org/cmake/help/latest/module/GNUInstallDirs.html).
+
+## Dependencies
+
+- `CURL_BROTLI`:                            Use brotli (`ON`, `OFF` or `AUTO`). Default: `AUTO`
+- `CURL_USE_CMAKECONFIG`:                   Enable detecting dependencies via CMake Config.
+                                            Default: `ON` for MSVC (except under vcpkg), if not cross-compiling. (experimental)
+- `CURL_USE_GNUTLS`:                        Enable GnuTLS for SSL/TLS. Default: `OFF`
+- `CURL_USE_GSASL`:                         Use libgsasl. Default: `OFF`
+- `CURL_USE_GSSAPI`:                        Use GSSAPI implementation. Default: `OFF`
+- `CURL_USE_LIBBACKTRACE`:                  Use [libbacktrace](https://github.com/ianlancetaylor/libbacktrace).
+                                            Requires debug-enabled build and DWARF debug information. Default: `OFF`
+- `CURL_USE_LIBPSL`:                        Use libpsl. Default: `ON`
+- `CURL_USE_LIBSSH2`:                       Use libssh2. Default: `ON`
+- `CURL_USE_LIBSSH`:                        Use libssh. Default: `OFF`
+- `CURL_USE_LIBUV`:                         Use libuv for event-based tests. Default: `OFF`
+- `CURL_USE_MBEDTLS`:                       Enable mbedTLS for SSL/TLS. Default: `OFF`
+- `CURL_USE_OPENSSL`:                       Enable OpenSSL for SSL/TLS. Default: `ON` if no other TLS backend was enabled.
+- `CURL_USE_PKGCONFIG`:                     Enable `pkg-config` to detect dependencies.
+                                            Default: `ON` for Unix (except Android, Apple devices), vcpkg, MinGW if not cross-compiling.
+- `CURL_USE_RUSTLS`:                        Enable Rustls for SSL/TLS (experimental). Default: `OFF`
+- `CURL_USE_SCHANNEL`:                      Enable Windows native SSL/TLS (Schannel). Default: `OFF`
+- `CURL_USE_WOLFSSL`:                       Enable wolfSSL for SSL/TLS. Default: `OFF`
+- `CURL_ZLIB`:                              Use zlib (`ON`, `OFF` or `AUTO`). Default: `AUTO`
+- `CURL_ZSTD`:                              Use zstd (`ON`, `OFF` or `AUTO`). Default: `AUTO`
+- `ENABLE_ARES`:                            Enable c-ares support. Default: `OFF`
+- `USE_LIBIDN2`:                            Use libidn2 for IDN support. Default: `ON`
+- `USE_NGHTTP2`:                            Use nghttp2 library. Default: `ON`
+- `USE_NGTCP2`:                             Use ngtcp2 and nghttp3 libraries for HTTP/3 support. Default: `OFF`
+- `USE_QUICHE`:                             Use quiche library for HTTP/3 support (experimental). Default: `OFF`
+
+## Dependency options (via CMake)
+
+- `OPENSSL_ROOT_DIR`:                       Absolute path to the root installation of OpenSSL (and forks).
+- `OPENSSL_INCLUDE_DIR`:                    Absolute path to OpenSSL include directory.
+- `OPENSSL_SSL_LIBRARY`:                    Absolute path to `ssl` library.
+                                            With MSVC, CMake uses variables `SSL_EAY_DEBUG`/`SSL_EAY_RELEASE` instead.
+- `OPENSSL_CRYPTO_LIBRARY`:                 Absolute path to `crypto` library.
+                                            With MSVC, CMake uses variables `LIB_EAY_DEBUG`/`LIB_EAY_RELEASE` instead.
+- `OPENSSL_USE_STATIC_LIBS`:                Look for static OpenSSL libraries.
+- `ZLIB_INCLUDE_DIR`:                       Absolute path to zlib include directory.
+- `ZLIB_LIBRARY`:                           Absolute path to `zlib` library.
+- `ZLIB_USE_STATIC_LIBS`:                   Look for static `zlib` library (requires CMake v3.24).
+- `<PackageName>_DIR`:                      Absolute path to `<PackageName>` CMake Config directory where `*.cmake` files reside.
+                                            Used when `CURL_USE_CMAKECONFIG` is enabled.
+                                            `<PackageName>` may be:
+                                            `c-ares`, `Libssh2`, `MbedTLS`, `NGHTTP2`, `NGHTTP3`,
+                                            `NGTCP2` for 1.19.0+ (with non-fork OpenSSL only),
+                                            `wolfssl` for 5.2.1+, `Zstd` for 1.4.5+.
+
+## Dependency options (tools)
+
+- `CLANG_TIDY`:                             Absolute path to `clang-tidy` tool used with `CURL_CLANG_TIDY=ON`. Default: search for `clang-tidy`
+- `PERL_EXECUTABLE`:                        Absolute path to Perl binary used throughout the build and tests. Default: auto-detect
+
+## Dependency options (libraries)
+
+- `AMISSL_INCLUDE_DIR`:                     Absolute path to AmiSSL include directory.
+- `AMISSL_STUBS_LIBRARY`:                   Absolute path to `amisslstubs` library.
+- `AMISSL_AUTO_LIBRARY`:                    Absolute path to `amisslauto` library.
+- `BORINGSSL_VERSION`:                      Set BoringSSL version for `curl -V`/`curl --version` output.
+- `BROTLI_INCLUDE_DIR`:                     Absolute path to brotli include directory.
+- `BROTLICOMMON_LIBRARY`:                   Absolute path to `brotlicommon` library.
+- `BROTLIDEC_LIBRARY`:                      Absolute path to `brotlidec` library.
+- `BROTLI_USE_STATIC_LIBS`:                 Configure for static brotli libraries. (experimental)
+- `CARES_INCLUDE_DIR`:                      Absolute path to c-ares include directory.
+- `CARES_LIBRARY`:                          Absolute path to `cares` library.
+- `CARES_USE_STATIC_LIBS`:                  Configure for static c-ares libraries. (experimental)
+- `DL_LIBRARY`:                             Absolute path to `dl` library. (for Rustls)
+- `GNUTLS_INCLUDE_DIR`:                     Absolute path to GnuTLS include directory.
+- `GNUTLS_LIBRARY`:                         Absolute path to `gnutls` library.
+- `GSS_ROOT_DIR`:                           Absolute path to the root installation of GSS. (also supported as environment)
+- `LDAP_INCLUDE_DIR`:                       Absolute path to LDAP include directory.
+- `LDAP_LIBRARY`:                           Absolute path to `ldap` library.
+- `LDAP_LBER_LIBRARY`:                      Absolute path to `lber` library.
+- `LIBBACKTRACE_INCLUDE_DIR`:               Absolute path to libbacktrace include directory (https://github.com/ianlancetaylor/libbacktrace).
+- `LIBBACKTRACE_LIBRARY`:                   Absolute path to `libbacktrace` library.
+- `LIBGSASL_INCLUDE_DIR`:                   Absolute path to libgsasl include directory.
+- `LIBGSASL_LIBRARY`:                       Absolute path to `libgsasl` library.
+- `LIBIDN2_INCLUDE_DIR`:                    Absolute path to libidn2 include directory.
+- `LIBIDN2_LIBRARY`:                        Absolute path to `libidn2` library.
+- `LIBPSL_INCLUDE_DIR`:                     Absolute path to libpsl include directory.
+- `LIBPSL_LIBRARY`:                         Absolute path to `libpsl` library.
+- `LIBSSH_INCLUDE_DIR`:                     Absolute path to libssh include directory.
+- `LIBSSH_LIBRARY`:                         Absolute path to `libssh` library.
+- `LIBSSH_USE_STATIC_LIBS`:                 Configure for static libssh libraries. (experimental)
+- `LIBSSH2_INCLUDE_DIR`:                    Absolute path to libssh2 include directory.
+- `LIBSSH2_LIBRARY`:                        Absolute path to `libssh2` library.
+- `LIBSSH2_USE_STATIC_LIBS`:                Configure for static libssh2 libraries. (experimental)
+- `LIBUV_INCLUDE_DIR`:                      Absolute path to libuv include directory.
+- `LIBUV_LIBRARY`:                          Absolute path to `libuv` library.
+- `MATH_LIBRARY`:                           Absolute path to `m` library. (for Rustls, wolfSSL)
+- `MBEDTLS_INCLUDE_DIR`:                    Absolute path to mbedTLS include directory.
+- `MBEDTLS_LIBRARY`:                        Absolute path to `mbedtls` library.
+- `MBEDX509_LIBRARY`:                       Absolute path to `mbedx509` library.
+- `MBEDCRYPTO_LIBRARY`:                     Absolute path to `mbedcrypto` library.
+- `MBEDTLS_USE_STATIC_LIBS`:                Configure for static mbedTLS libraries. (experimental)
+- `NGHTTP2_INCLUDE_DIR`:                    Absolute path to nghttp2 include directory.
+- `NGHTTP2_LIBRARY`:                        Absolute path to `nghttp2` library.
+- `NGHTTP2_USE_STATIC_LIBS`:                Configure for static nghttp2 libraries. (experimental)
+- `NGHTTP3_INCLUDE_DIR`:                    Absolute path to nghttp3 include directory.
+- `NGHTTP3_LIBRARY`:                        Absolute path to `nghttp3` library.
+- `NGHTTP3_USE_STATIC_LIBS`:                Configure for static nghttp3 libraries. (experimental)
+- `NGTCP2_INCLUDE_DIR`:                     Absolute path to ngtcp2 include directory.
+- `NGTCP2_LIBRARY`:                         Absolute path to `ngtcp2` library.
+- `NGTCP2_CRYPTO_BORINGSSL_LIBRARY`:        Absolute path to `ngtcp2_crypto_boringssl` library. (also for AWS-LC)
+- `NGTCP2_CRYPTO_GNUTLS_LIBRARY`:           Absolute path to `ngtcp2_crypto_gnutls` library.
+- `NGTCP2_CRYPTO_LIBRESSL_LIBRARY`:         Absolute path to `ngtcp2_crypto_libressl` library. (requires ngtcp2 1.15.0+)
+- `NGTCP2_CRYPTO_OSSL_LIBRARY`:             Absolute path to `ngtcp2_crypto_ossl` library.
+- `NGTCP2_CRYPTO_QUICTLS_LIBRARY`:          Absolute path to `ngtcp2_crypto_quictls` library. (also for LibreSSL with ngtcp2 <1.15.0)
+- `NGTCP2_CRYPTO_WOLFSSL_LIBRARY`:          Absolute path to `ngtcp2_crypto_wolfssl` library.
+- `NGTCP2_USE_STATIC_LIBS`:                 Configure for static ngtcp2 libraries. (experimental)
+- `NETTLE_INCLUDE_DIR`:                     Absolute path to nettle include directory.
+- `NETTLE_LIBRARY`:                         Absolute path to `nettle` library.
+- `PTHREAD_LIBRARY`:                        Absolute path to `pthread` library. (for Rustls)
+- `QUICHE_INCLUDE_DIR`:                     Absolute path to quiche include directory.
+- `QUICHE_LIBRARY`:                         Absolute path to `quiche` library.
+- `RUSTLS_INCLUDE_DIR`:                     Absolute path to Rustls include directory.
+- `RUSTLS_LIBRARY`:                         Absolute path to `rustls` library.
+- `WATT_ROOT`:                              Absolute path to the root installation of Watt-32.
+- `WOLFSSL_INCLUDE_DIR`:                    Absolute path to wolfSSL include directory.
+- `WOLFSSL_LIBRARY`:                        Absolute path to `wolfssl` library.
+- `ZSTD_INCLUDE_DIR`:                       Absolute path to zstd include directory.
+- `ZSTD_LIBRARY`:                           Absolute path to `zstd` library.
+- `ZSTD_USE_STATIC_LIBS`:                   Configure for static zstd libraries. (experimental)
+
+Examples:
+
+- `-DLIBPSL_INCLUDE_DIR=/path/to/libpl/include`,
+  which directory contains `libpsl.h`.
+  No ending slash or backslash is necessary.
+
+- `-DNGHTTP3_INCLUDE_DIR=/path/to/libnghttp3/include`,
+  which directory contains an `nghttp3` subdirectory with `.h` files in it.
+
+- `-DLIBPSL_LIBRARY=/path/to/libpsl/lib/libpsl.a`
+  Always a single library, with its complete filename, as-is on the file system.
+
+- `-DOPENSSL_ROOT_DIR=/path/to/openssl`,
+  which directory (typically) contains `include` and `lib` subdirectories.
+  No ending slash or backslash is necessary.
+
+## Dependency options (Apple frameworks)
+
+- `COREFOUNDATION_FRAMEWORK`:               Absolute path to `CoreFoundation` framework. (for IPv6 non-c-ares, SecTrust, wolfSSL)
+- `CORESERVICES_FRAMEWORK`:                 Absolute path to `CoreServices` framework. (for IPv6 non-c-ares, SecTrust)
+- `FOUNDATION_FRAMEWORK`:                   Absolute path to `Foundation` framework. (for Rustls)
+- `SECURITY_FRAMEWORK`:                     Absolute path to `Security` framework. (for Rustls, SecTrust, wolfSSL)
+- `SYSTEMCONFIGURATION_FRAMEWORK`:          Absolute path to `SystemConfiguration` framework. (for IPv6 non-c-ares)
+
+## Test tools
+
+- `APXS`:                                   Absolute path. Default: search for `apxs`
+- `CADDY`:                                  Absolute path. Default: search for `caddy`
+- `H2O`:                                    Absolute path. Default: search for `h2o`
+- `HTTPD_NGHTTPX`:                          Absolute path. Default: search for `nghttpx`
+- `HTTPD`:                                  Absolute path. Default: search for `apache2`
+- `DANTED`:                                 Absolute path. Default: search for `danted`
+- `TEST_NGHTTPX`:                           Absolute path. Default: search for `nghttpx`
+- `VSFTPD`:                                 Absolute path. Default: search for `vsftpd`
+- `SSHD`:                                   Absolute path. Default: search for `sshd`
+- `SFTPD`:                                  Absolute path. Default: search for `sftp-server`
+
+## Feature detection variables
+
+By default the curl CMake build script detects the version of some dependencies
+using `check_symbol_exists()`. Those checks do not work in the case that both
+CURL and its dependency are included as sub-projects in a larger build using
+`FetchContent`. To support that case, additional variables may be defined by
+the parent project, ideally in the "extra" find package redirect file:
+<https://cmake.org/cmake/help/latest/module/FetchContent.html#integrating-with-find-package>
+
+Available variables:
+
+- `HAVE_DES_ECB_ENCRYPT`:                   `DES_ecb_encrypt` present in OpenSSL (or fork).
+- `HAVE_GNUTLS_SRP`:                        `gnutls_srp_verifier` present in GnuTLS.
+- `HAVE_LDAP_INIT_FD`:                      `ldap_init_fd` present in LDAP library.
+- `HAVE_LDAP_URL_PARSE`:                    `ldap_url_parse` present in LDAP library.
+- `HAVE_MBEDTLS_DES_CRYPT_ECB`:             `mbedtls_des_crypt_ecb` present in mbedTLS <4.
+- `HAVE_OPENSSL_SRP`:                       `SSL_CTX_set_srp_username` present in OpenSSL (or fork).
+- `HAVE_QUICHE_CONN_SET_QLOG_FD`:           `quiche_conn_set_qlog_fd` present in quiche.
+- `HAVE_RUSTLS_SUPPORTED_HPKE`:             `rustls_supported_hpke` present in Rustls (unused if Rustls is detected via `pkg-config`).
+- `HAVE_SSL_SET0_WBIO`:                     `SSL_set0_wbio` present in OpenSSL (or fork).
+- `HAVE_SSL_SET1_ECH_CONFIG_LIST`:          `SSL_set1_ech_config_list` present in OpenSSL (or fork).
+- `HAVE_SSL_SET_QUIC_TLS_CBS`:              `SSL_set_quic_tls_cbs` in OpenSSL.
+- `HAVE_SSL_SET_QUIC_USE_LEGACY_CODEPOINT`: `SSL_set_quic_use_legacy_codepoint` in OpenSSL fork.
+- `HAVE_WOLFSSL_BIO_NEW`:                   `wolfSSL_BIO_new` present in wolfSSL.
+- `HAVE_WOLFSSL_BIO_SET_SHUTDOWN`:          `wolfSSL_BIO_set_shutdown` present in wolfSSL.
+- `HAVE_WOLFSSL_CTX_GENERATEECHCONFIG`:     `wolfSSL_CTX_GenerateEchConfig` present in wolfSSL.
+- `HAVE_WOLFSSL_GET_PEER_CERTIFICATE`:      `wolfSSL_get_peer_certificate` present in wolfSSL.
+- `HAVE_WOLFSSL_SET_QUIC_USE_LEGACY_CODEPOINT`:
+                                            `wolfSSL_set_quic_use_legacy_codepoint` present in wolfSSL.
+- `HAVE_WOLFSSL_USEALPN`:                   `wolfSSL_UseALPN` present in wolfSSL.
+- `HAVE_WC_DES_ECBENCRYPT`:                 `wc_Des_EcbEncrypt` present in wolfSSL.
+
+For each of the above variables, if the variable is *defined* (either to `ON`
+or `OFF`), the symbol detection is skipped. If the variable is *not defined*,
+the feature detection is performed.
+
+Note: These variables are internal and subject to change.
+
+## Useful build targets
+
+- `testdeps`:               Build test dependencies (test binaries, test certificates).
+                            Test certificates: `build-certs` (clean with `clean-certs`)
+- `tests`:                  Run tests (`runtests.pl`). Customize via the `TFLAGS` environment variable, e.g. `TFLAGS=1621`.
+                            Other flavors: `test-am`, `test-ci`, `test-event`, `test-full`, `test-nonflaky`, `test-quiet`, `test-torture`
+- `tt`:                     Build test binaries (servers, tools).
+                            Individual targets: `curlinfo`, `libtests`, `servers`, `tunits`, `units`
+- `curl-pytest`:            Run tests (pytest).
+                            Other flavor: `curl-test-ci`
+- `curl-examples`:          Build examples
+                            Individual targets: `curl-example-<name>`,
+                            where <name> is the .c filename without extension.
+- `curl-examples-build`:    Build examples quickly but without the ability to run them. (for build tests)
+- `curl-man`:               Build man pages. (built by default unless disabled)
+- `curl`:                   Build curl tool.
+- `curl_uninstall`:         Uninstall curl.
+- `curl-completion-fish`:   Build shell completions for fish. (built by default if enabled)
+- `curl-completion-zsh`:    Build shell completions for zsh. (built by default if enabled)
+- `curl-ca-bundle`:         Build the CA bundle via `scripts/mk-ca-bundle.pl`.
+- `curl-ca-firefox`:        Build the CA bundle via `scripts/firefox-db2pem.sh`.
+- `curl-lint`:              Run lint checks.
+- `curl-listcats`:          Generate help category constants for `src/tool_help.h` from documentation.
+- `curl-listhelp`:          Generate `src/tool_listhelp.c` from documentation.
+- `curl-optiontable`:       Generate `lib/easyoptions.c` from documentation.
+
+# Migrating from Visual Studio IDE Project Files
+
+We recommend using CMake to build curl with MSVC.
+
+The project build files reside in project/Windows/VC\* for VS2010, VS2012 and
+VS2013.
+
+These CMake Visual Studio generators require CMake v3.24 or older. You can
+download them from <https://cmake.org/files/v3.24/>.
+
+You can also use `-G "NMake Makefiles"`, which is supported by all CMake
+versions.
+
+Configuration element             | Equivalent CMake options
+:-------------------------------- | :--------------------------------
+`VC10`                            | `-G "Visual Studio 10 2010"`
+`VC11`                            | `-G "Visual Studio 11 2012"`
+`VC12`                            | `-G "Visual Studio 12 2013"`
+`x64`                             | `-A x64`
+`Win32`                           | `-A Win32`
+`DLL`                             | `BUILD_SHARED_LIBS=ON`, `BUILD_STATIC_LIBS=OFF`, (default)
+`LIB`                             | `BUILD_SHARED_LIBS=OFF`, `BUILD_STATIC_LIBS=ON`
+`Debug`                           | `CMAKE_BUILD_TYPE=Debug` (`-G "NMake Makefiles"` only)
+`Release`                         | `CMAKE_BUILD_TYPE=Release` (`-G "NMake Makefiles"` only)
+`DLL Windows SSPI`                | `CURL_USE_SCHANNEL=ON` (with SSPI enabled by default)
+`DLL OpenSSL`                     | `CURL_USE_OPENSSL=ON`, optional: `OPENSSL_ROOT_DIR`, `OPENSSL_USE_STATIC_LIBS=ON`
+`DLL libssh2`                     | `CURL_USE_LIBSSH2=ON`, optional: `LIBSSH2_INCLUDE_DIR`, `LIBSSH2_LIBRARY`
+`DLL WinIDN`                      | `USE_WIN32_IDN=ON`
+
+For example these commands:
+
+    > cd projects/Windows
+    > ./generate.bat VC12
+    > msbuild "-property:Configuration=DLL Debug - DLL Windows SSPI - DLL WinIDN" VC12/curl-all.sln
+
+translate to:
+
+    > cmake . -G "Visual Studio 12 2013" -A x64 -DCURL_USE_SCHANNEL=ON -DUSE_WIN32_IDN=ON -DCURL_USE_LIBPSL=OFF
+    > cmake --build . --config Debug --parallel
+
+We do *not* specify `-DCMAKE_BUILD_TYPE=Debug` here as we might do for the
+`"NMake Makefiles"` generator because the Visual Studio generators are
+[multi-config generators](https://cmake.org/cmake/help/latest/prop_gbl/GENERATOR_IS_MULTI_CONFIG.html)
+and therefore ignore the value of `CMAKE_BUILD_TYPE`.
diff --git a/third-party/curl/docs/INSTALL.cmake b/third-party/curl/docs/INSTALL.cmake
deleted file mode 100644
index 4e7f706a96..0000000000
--- a/third-party/curl/docs/INSTALL.cmake
+++ /dev/null
@@ -1,89 +0,0 @@
-                                  _   _ ____  _
-                              ___| | | |  _ \| |
-                             / __| | | | |_) | |
-                            | (__| |_| |  _ <| |___
-                             \___|\___/|_| \_\_____|
-
-                                How To Compile with CMake
-
-Building with CMake
-==========================
-   This document describes how to compile, build and install curl and libcurl
-   from source code using the CMake build tool. To build with CMake, you will
-   of course have to first install CMake.  The minimum required version of
-   CMake is specified in the file CMakeLists.txt found in the top of the curl
-   source tree. Once the correct version of CMake is installed you can follow
-   the instructions below for the platform you are building on.
-
-   CMake builds can be configured either from the command line, or from one
-   of CMake's GUI's.
-
-Current flaws in the curl CMake build
-=====================================
-
-   Missing features in the cmake build:
-
-   - Builds libcurl without large file support
-   - Does not support all SSL libraries (only OpenSSL, Schannel,
-     Secure Transport, and mbedTLS, WolfSSL)
-   - Does not allow different resolver backends (no c-ares build support)
-   - No RTMP support built
-   - Does not allow build curl and libcurl debug enabled
-   - Does not allow a custom CA bundle path
-   - Does not allow you to disable specific protocols from the build
-   - Does not find or use krb4 or GSS
-   - Rebuilds test files too eagerly, but still cannot run the tests
-   - Does not detect the correct strerror_r flavor when cross-compiling (issue #1123)
-
-
-Command Line CMake
-==================
-   A CMake build of curl is similar to the autotools build of curl. It
-   consists of the following steps after you have unpacked the source.
-
-    1. Create an out of source build tree parallel to the curl source
-       tree and change into that directory
-
-    $ mkdir curl-build
-    $ cd curl-build
-
-    2. Run CMake from the build tree, giving it the path to the top of
-       the curl source tree.  CMake will pick a compiler for you. If you
-       want to specify the compile, you can set the CC environment
-       variable prior to running CMake.
-
-    $ cmake ../curl
-    $ make
-
-    3. Install to default location:
-
-    $ make install
-
-    (The test suite does not work with the cmake build)
-
-ccmake
-=========
-     CMake comes with a curses based interface called ccmake.  To run ccmake on
-     a curl use the instructions for the command line cmake, but substitute
-     ccmake ../curl for cmake ../curl.  This will bring up a curses interface
-     with instructions on the bottom of the screen. You can press the "c" key
-     to configure the project, and the "g" key to generate the project. After
-     the project is generated, you can run make.
-
-cmake-gui
-=========
-     CMake also comes with a Qt based GUI called cmake-gui. To configure with
-     cmake-gui, you run cmake-gui and follow these steps:
-        1. Fill in the "Where is the source code" combo box with the path to
-        the curl source tree.
-        2. Fill in the "Where to build the binaries" combo box with the path
-        to the directory for your build tree, ideally this should not be the
-        same as the source tree, but a parallel directory called curl-build or
-        something similar.
-        3. Once the source and binary directories are specified, press the
-        "Configure" button.
-        4. Select the native build tool that you want to use.
-        5. At this point you can change any of the options presented in the
-        GUI.  Once you have selected all the options you want, click the
-        "Generate" button.
-        6. Run the native build tool that you used CMake to generate.
diff --git a/third-party/curl/docs/INSTALL.md b/third-party/curl/docs/INSTALL.md
index 28ad553048..467aa64c05 100644
--- a/third-party/curl/docs/INSTALL.md
+++ b/third-party/curl/docs/INSTALL.md
@@ -1,17 +1,24 @@
-# how to install curl and libcurl
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# How to install curl and libcurl
 
 ## Installing Binary Packages
 
 Lots of people download binary distributions of curl and libcurl. This
 document does not describe how to install curl or libcurl using such a binary
 package. This document describes how to compile, build and install curl and
-libcurl from source code.
+libcurl from [source code](https://curl.se/download.html).
 
 ## Building using vcpkg
 
-You can download and install curl and libcurl using the [vcpkg](https://github.com/Microsoft/vcpkg/) dependency manager:
+You can download and install curl and libcurl using
+the [vcpkg](https://github.com/Microsoft/vcpkg) dependency manager:
 
-    git clone https://github.com/Microsoft/vcpkg.git
+    git clone --depth 1 https://github.com/Microsoft/vcpkg
     cd vcpkg
     ./bootstrap-vcpkg.sh
     ./vcpkg integrate install
@@ -24,8 +31,8 @@ or pull request](https://github.com/Microsoft/vcpkg) on the vcpkg repository.
 ## Building from git
 
 If you get your code off a git repository instead of a release tarball, see
-the `GIT-INFO` file in the root directory for specific instructions on how to
-proceed.
+the [GIT-INFO.md](https://github.com/curl/curl/blob/master/GIT-INFO.md) file in
+the root directory for specific instructions on how to proceed.
 
 # Unix
 
@@ -39,6 +46,9 @@ unpacked the source archive):
 
 (Adjust the configure line accordingly to use the TLS library you want.)
 
+By default curl builds with libpsl (Public Suffix List) support. If libpsl is
+not available on your system, install it or disable it with `--without-libpsl`.
+
 You probably need to be root when doing the last command.
 
 Get a full listing of all available configure options by invoking it like:
@@ -58,10 +68,9 @@ your own home directory:
     make
     make install
 
-The configure script always tries to find a working SSL library unless
-explicitly told not to. If you have OpenSSL installed in the default search
-path for your compiler/linker, you do not need to do anything special. If you
-have OpenSSL installed in `/usr/local/ssl`, you can run configure like:
+The configure script requires you to select a TLS backend explicitly unless
+you disable TLS with `--without-ssl`. If you have OpenSSL installed in the
+default search path for your compiler/linker, you can run configure like:
 
     ./configure --with-openssl
 
@@ -84,7 +93,7 @@ header files somewhere else, you have to set the `LDFLAGS` and `CPPFLAGS`
 environment variables prior to running configure. Something like this should
 work:
 
-    CPPFLAGS="-I/path/to/ssl/include" LDFLAGS="-L/path/to/ssl/lib" ./configure
+    CPPFLAGS="-I/path/to/ssl/include" LDFLAGS="-L/path/to/ssl/lib" ./configure --with-openssl
 
 If you have shared SSL libs installed in a directory where your runtime
 linker does not find them (which usually causes configure failures), you can
@@ -110,10 +119,10 @@ Figuring out all the dependency libraries for a given library is hard, as it
 might involve figuring out the dependencies of the dependencies and they vary
 between platforms and change between versions.
 
-When using static dependencies, the build scripts will mostly assume that you,
-the user, will provide all the necessary additional dependency libraries as
-additional arguments in the build. With configure, by setting `LIBS` or
-`LDFLAGS` on the command line.
+When using static dependencies, the build scripts mostly assume that you, the
+user, provide all the necessary additional dependency libraries as additional
+arguments in the build. With configure, by setting `LIBS` or `LDFLAGS` on the
+command line.
 
 Building statically is not for the faint of heart.
 
@@ -123,32 +132,63 @@ If you are a curl developer and use gcc, you might want to enable more debug
 options with the `--enable-debug` option.
 
 curl can be built to use a whole range of libraries to provide various useful
-services, and configure will try to auto-detect a decent default. But if you
-want to alter it, you can select how to deal with each individual library.
+services, and configure tries to auto-detect a decent default. If you want to
+alter it, you can select how to deal with each individual library.
+
+To debug the build itself, you can set the environment variable
+`CURL_TRACE_PKG_CONFIG` to a non-empty value to enable detailed trace
+information and verbose errors from `pkg-config` module detection invocations.
 
 ## Select TLS backend
 
 These options are provided to select the TLS backend to use.
 
- - AmiSSL: `--with-amissl`
- - BearSSL: `--with-bearssl`
- - GnuTLS: `--with-gnutls`.
- - mbedTLS: `--with-mbedtls`
- - OpenSSL: `--with-openssl` (also for BoringSSL, AWS-LC, libressl, and quictls)
- - rustls: `--with-rustls`
- - Schannel: `--with-schannel`
- - Secure Transport: `--with-secure-transport`
- - wolfSSL: `--with-wolfssl`
+- AmiSSL: `--with-amissl`
+- GnuTLS: `--with-gnutls`.
+- mbedTLS: `--with-mbedtls`
+- OpenSSL: `--with-openssl` (also for AWS-LC, BoringSSL, LibreSSL, and quictls)
+- Rustls: `--with-rustls`
+- Schannel: `--with-schannel`
+- wolfSSL: `--with-wolfssl`
 
 You can build curl with *multiple* TLS backends at your choice, but some TLS
 backends cannot be combined: if you build with an OpenSSL fork (or wolfSSL),
-you cannot add another OpenSSL fork (or wolfSSL) simply because they have
+you cannot add another OpenSSL fork (or wolfSSL) because they have
 conflicting identical symbol names.
 
 When you build with multiple TLS backends, you can select the active one at
-run-time when curl starts up.
+runtime when curl starts up.
 
-## configure finding libs in wrong directory
+### Selecting TLS Trust Anchors Defaults
+
+Verifying a server certificate established a chain of trust that needs to
+start somewhere. Those "root" certificates make the set of Trust Anchors.
+
+While the build system tries to find good defaults on the platform you
+use, you may specify these explicitly. The following options are provided:
+
+- `--with-ca-bundle=FILE`: the file that libcurl loads default root
+  certificates from.
+- `--with-ca-path=DIRECTORY`: a directory in which root certificates files
+  are found.
+- `--with-ca-embed=FILE`: a file read *at build time* and added to `libcurl`.
+- `--with-ca-fallback`: an OpenSSL specific option for delegating default
+  trust anchor selection to what OpenSSL thinks is best, *if* there are
+  no other certificates configured by the application.
+- `--with-apple-sectrust`: use the system "SecTrust" service on Apple
+  operating systems for verification. (Added in 8.17.0)
+
+## MultiSSL and HTTP/3
+
+HTTP/3 needs QUIC and QUIC needs TLS. Building libcurl with HTTP/3 and QUIC
+support is not compatible with the MultiSSL feature: they are mutually
+exclusive. If you need MultiSSL in your build, you cannot have HTTP/3 support
+and vice versa.
+
+libcurl can only use a single TLS library with QUIC and that *same* TLS
+library needs to be used for the other TLS using protocols.
+
+## Configure finding libs in wrong directory
 
 When the configure script checks for third-party libraries, it adds those
 directories to the `LDFLAGS` variable and then tries linking to see if it
@@ -162,106 +202,175 @@ library check.
 
 # Windows
 
+Building for Windows Vista/Server 2008 is required as a minimum.
+
+You can build curl with:
+
+- Microsoft Visual Studio 2010 v10.0 or later (`_MSC_VER >= 1600`)
+- MinGW-w64 3.0 or later (`__MINGW64_VERSION_MAJOR >= 3`)
+
 ## Building Windows DLLs and C runtime (CRT) linkage issues
 
- As a general rule, building a DLL with static CRT linkage is highly
- discouraged, and intermixing CRTs in the same app is something to avoid at
- any cost.
+As a general rule, building a DLL with static CRT linkage is highly
+discouraged, and intermixing CRTs in the same app is something to avoid at
+any cost.
 
- Reading and comprehending Microsoft Knowledge Base articles KB94248 and
- KB140584 is a must for any Windows developer. Especially important is full
- understanding if you are not going to follow the advice given above.
+Reading and comprehending Microsoft Knowledge Base articles KB94248 and
+KB140584 is a must for any Windows developer. Especially important is full
+understanding if you are not going to follow the advice given above.
 
- - [How To Use the C Run-Time](https://support.microsoft.com/help/94248/how-to-use-the-c-run-time)
- - [Run-Time Library Compiler Options](https://docs.microsoft.com/cpp/build/reference/md-mt-ld-use-run-time-library)
- - [Potential Errors Passing CRT Objects Across DLL Boundaries](https://docs.microsoft.com/cpp/c-runtime-library/potential-errors-passing-crt-objects-across-dll-boundaries)
+- [How To Use the C Runtime](https://learn.microsoft.com/troubleshoot/developer/visualstudio/cpp/libraries/use-c-run-time)
+- [Runtime Library Compiler Options](https://learn.microsoft.com/cpp/build/reference/md-mt-ld-use-run-time-library)
+- [Potential Errors Passing CRT Objects
+  Across DLL Boundaries](https://learn.microsoft.com/cpp/c-runtime-library/potential-errors-passing-crt-objects-across-dll-boundaries)
 
 If your app is misbehaving in some strange way, or it is suffering from memory
 corruption, before asking for further help, please try first to rebuild every
 single library your app uses as well as your app using the debug
 multi-threaded dynamic C runtime.
 
- If you get linkage errors read section 5.7 of the FAQ document.
-
-## MinGW32
-
-Make sure that MinGW32's bin directory is in the search path, for example:
-
-```cmd
-set PATH=c:\mingw32\bin;%PATH%
-```
-
-then run `mingw32-make mingw32` in the root dir. There are other
-make targets available to build libcurl with more features, use:
-
- - `mingw32-make mingw32-zlib` to build with Zlib support;
- - `mingw32-make mingw32-ssl-zlib` to build with SSL and Zlib enabled;
- - `mingw32-make mingw32-ssh2-ssl-zlib` to build with SSH2, SSL, Zlib;
- - `mingw32-make mingw32-ssh2-ssl-sspi-zlib` to build with SSH2, SSL, Zlib
-   and SSPI support.
-
-If you have any problems linking libraries or finding header files, be sure
-to verify that the provided `Makefile.mk` files use the proper paths, and
-adjust as necessary. It is also possible to override these paths with
-environment variables, for example:
-
-```cmd
-set ZLIB_PATH=c:\zlib-1.2.12
-set OPENSSL_PATH=c:\openssl-3.0.5
-set LIBSSH2_PATH=c:\libssh2-1.10.0
-```
-
-It is also possible to build with other LDAP installations than MS LDAP;
-currently it is possible to build with native Win32 OpenLDAP, or with the
-*Novell CLDAP* SDK. If you want to use these you need to set these vars:
-
-```cmd
-set CPPFLAGS=-Ic:/openldap/include -DCURL_HAS_OPENLDAP_LDAPSDK
-set LDFLAGS=-Lc:/openldap/lib
-set LIBS=-lldap -llber
-```
-
-or for using the Novell SDK:
-
-```cmd
-set CPPFLAGS=-Ic:/openldapsdk/inc -DCURL_HAS_NOVELL_LDAPSDK
-set LDFLAGS=-Lc:/openldapsdk/lib/mscvc
-set LIBS=-lldapsdk -lldapssl -lldapx
-```
-
-If you want to enable LDAPS support then append `-ldaps` to the make target.
+If you get linkage errors read section 5.7 of the FAQ document.
 
 ## Cygwin
 
-Almost identical to the Unix installation. Run the configure script in the
-curl source tree root with `sh configure`. Make sure you have the `sh`
-executable in `/bin/` or you will see the configure fail toward the end.
+Almost identical to the Unix installation. Download the `curl` source code,
+then essentially run the configure script in the curl source tree root with
+`sh configure`, then run `make`.
 
-Run `make`
+To expand on building with Cygwin first ensure it is in your path, and
+there are no conflicting tools (*i.e. Chocolatey with sed package*). If so
+move Cygwin ahead of any items in your path that would conflict with
+Cygwin commands, making sure you have the `sh` executable in `/bin/` or
+you see the configure fail toward the end.
+
+Download the setup installer from [Cygwin](https://cygwin.com/) to begin.
+Additional Cygwin packages are needed for the install. For more on
+installing packages visit
+[Cygwin Setup](https://cygwin.com/faq/faq.html#faq.setup.cli).
+
+Either run `setup-x86_64.exe`, then search and select packages individually,
+or try:
+
+    setup-x86_64.exe --no-admin -q -I -P binutils,gcc-core,libpsl-devel,libtool,perl,make
+
+Expand the below details to show the list of required packages for a
+successful Cygwin install:
+
+<details>
+    <summary>Package List</summary>
+
+```
+binutils
+gcc-core
+libpsl-devel
+libtool
+perl
+make
+```
+
+</details>
+
+Once all the packages have been installed, begin the process of installing
+curl from the source code:
+
+<details>
+    <summary>configure_options</summary>
+
+```
+--with-gnutls
+--with-mbedtls
+--with-openssl (also works for OpenSSL forks)
+--with-rustls
+--with-wolfssl
+--without-ssl
+```
+
+</details>
+
+1. `sh configure <configure_options>`
+2. `make`
+
+> [!Note]
+> If an error occurs during the installation, then try:
+
+- Use `cmake` to configure and/or build
+- Use `ninja` to build (***much** faster*)
+- Reinstalling the required Cygwin packages from the list above without
+  passing `-I` to `setup-x86_64`
+- Temporarily move Cygwin to the top of your path
+- Install all of the Cygwin build packages using
+  `setup-x86_64 --build-depends curl`
 
 ## MS-DOS
 
-Requires DJGPP in the search path and pointing to the Watt-32 stack via
-`WATT_PATH=c:/djgpp/net/watt`.
+You can use either autotools or cmake:
 
-Run `make -f Makefile.dist djgpp` in the root curl dir.
+```sh
+./configure \
+  CC=/path/to/djgpp/bin/i586-pc-msdosdjgpp-gcc \
+  AR=/path/to/djgpp/bin/i586-pc-msdosdjgpp-ar \
+  RANLIB=/path/to/djgpp/bin/i586-pc-msdosdjgpp-ranlib \
+  WATT_ROOT=/path/to/djgpp/net/watt \
+  --host=i586-pc-msdosdjgpp \
+  --with-openssl=/path/to/djgpp \
+  --with-zlib=/path/to/djgpp \
+  --without-libpsl \
+  --disable-shared
+```
 
-For build configuration options, please see the MinGW32 section.
+```sh
+cmake . \
+  -DCMAKE_SYSTEM_NAME=DOS \
+  -DCMAKE_C_COMPILER_TARGET=i586-pc-msdosdjgpp \
+  -DCMAKE_C_COMPILER=/path/to/djgpp/bin/i586-pc-msdosdjgpp-gcc \
+  -DWATT_ROOT=/path/to/djgpp/net/watt \
+  -DOPENSSL_INCLUDE_DIR=/path/to/djgpp/include \
+  -DOPENSSL_SSL_LIBRARY=/path/to/djgpp/lib/libssl.a \
+  -DOPENSSL_CRYPTO_LIBRARY=/path/to/djgpp/lib/libcrypto.a \
+  -DZLIB_INCLUDE_DIR=/path/to/djgpp/include \
+  -DZLIB_LIBRARY=/path/to/djgpp/lib/libz.a \
+  -DCURL_USE_LIBPSL=OFF
+```
 
 Notes:
 
- - DJGPP 2.04 beta has a `sscanf()` bug so the URL parsing is not done
-   properly. Use DJGPP 2.03 until they fix it.
+- Requires DJGPP 2.04 or upper.
 
- - Compile Watt-32 (and OpenSSL) with the same version of DJGPP. Otherwise
-   things go wrong because things like FS-extensions and `errno` values have
-   been changed between releases.
+- Compile Watt-32 (and OpenSSL) with the same version of DJGPP. Otherwise
+  things go wrong because things like FS-extensions and `errno` values have
+  been changed between releases.
 
 ## AmigaOS
 
-Run `make -f Makefile.dist amiga` in the root curl dir.
+You can use either autotools or cmake:
 
-For build configuration options, please see the MinGW32 section.
+```sh
+./configure \
+  CC=/opt/amiga/bin/m68k-amigaos-gcc \
+  AR=/opt/amiga/bin/m68k-amigaos-ar \
+  RANLIB=/opt/amiga/bin/m68k-amigaos-ranlib \
+  --host=m68k-amigaos \
+  --with-amissl \
+  CFLAGS='-O0 -msoft-float -mcrt=clib2' \
+  CPPFLAGS=-I/path/to/AmiSSL/Developer/include \
+  LDFLAGS=-L/path/to/AmiSSL/Developer/lib/AmigaOS3 \
+  LIBS='-lnet -lm -latomic' \
+  --without-libpsl \
+  --disable-shared
+```
+
+```sh
+cmake . \
+  -DAMIGA=1 \
+  -DCMAKE_SYSTEM_NAME=Generic \
+  -DCMAKE_C_COMPILER_TARGET=m68k-unknown-amigaos \
+  -DCMAKE_C_COMPILER=/opt/amiga/bin/m68k-amigaos-gcc \
+  -DCMAKE_C_FLAGS='-O0 -msoft-float -mcrt=clib2' \
+  -DAMISSL_INCLUDE_DIR=/path/to/AmiSSL/Developer/include \
+  -DAMISSL_STUBS_LIBRARY=/path/to/AmiSSL/Developer/lib/AmigaOS3/libamisslstubs.a \
+  -DAMISSL_AUTO_LIBRARY=/path/to/AmiSSL/Developer/lib/AmigaOS3/libamisslauto.a \
+  -DCURL_USE_LIBPSL=OFF
+```
 
 ## Disabling Specific Protocols in Windows builds
 
@@ -270,29 +379,28 @@ environment, therefore, you cannot use the various disable-protocol options of
 the configure utility on this platform.
 
 You can use specific defines to disable specific protocols and features. See
-[CURL-DISABLE](CURL-DISABLE.md) for the full list.
+[CURL-DISABLE](https://github.com/curl/curl/blob/master/docs/CURL-DISABLE.md)
+for the full list.
 
 If you want to set any of these defines you have the following options:
 
- - Modify `lib/config-win32.h`
- - Modify `lib/curl_setup.h`
- - Modify `winbuild/Makefile.vc`
- - Modify the "Preprocessor Definitions" in the libcurl project
+- Modify `lib/config-win32.h`
+- Modify `lib/curl_setup.h`
+- Modify the "Preprocessor Definitions" in the libcurl project
 
 Note: The pre-processor settings can be found using the Visual Studio IDE
 under "Project -> Properties -> Configuration Properties -> C/C++ ->
 Preprocessor".
 
-## Using BSD-style lwIP instead of Winsock TCP/IP stack in Win32 builds
+## Using BSD-style lwIP instead of Winsock TCP/IP stack in Windows builds
 
 In order to compile libcurl and curl using BSD-style lwIP TCP/IP stack it is
 necessary to make the definition of the preprocessor symbol `USE_LWIPSOCK`
 visible to libcurl and curl compilation processes. To set this definition you
 have the following alternatives:
 
- - Modify `lib/config-win32.h` and `src/config-win32.h`
- - Modify `winbuild/Makefile.vc`
- - Modify the "Preprocessor Definitions" in the libcurl project
+- Modify `lib/config-win32.h`
+- Modify the "Preprocessor Definitions" in the libcurl project
 
 Note: The pre-processor settings can be found using the Visual Studio IDE
 under "Project -> Properties -> Configuration Properties -> C/C++ ->
@@ -313,96 +421,52 @@ might yet need some additional adjustment.
 ## Important static libcurl usage note
 
 When building an application that uses the static libcurl library on Windows,
-you must add `-DCURL_STATICLIB` to your `CFLAGS`. Otherwise the linker will
-look for dynamic import symbols.
+you must add `-DCURL_STATICLIB` to your `CFLAGS`. Otherwise the linker looks
+for dynamic import symbols.
 
 ## Legacy Windows and SSL
 
-Schannel (from Windows SSPI), is the native SSL library in Windows. However,
-Schannel in Windows <= XP is unable to connect to servers that
-no longer support the legacy handshakes and algorithms used by those
-versions. If you will be using curl in one of those earlier versions of
-Windows you should choose another SSL backend such as OpenSSL.
-
-# Apple Platforms (macOS, iOS, tvOS, watchOS, and their simulator counterparts)
-
-On modern Apple operating systems, curl can be built to use Apple's SSL/TLS
-implementation, Secure Transport, instead of OpenSSL. To build with Secure
-Transport for SSL/TLS, use the configure option `--with-secure-transport`.
-
-When Secure Transport is in use, the curl options `--cacert` and `--capath`
-and their libcurl equivalents, will be ignored, because Secure Transport uses
-the certificates stored in the Keychain to evaluate whether or not to trust
-the server. This, of course, includes the root certificates that ship with the
-OS. The `--cert` and `--engine` options, and their libcurl equivalents, are
-currently unimplemented in curl with Secure Transport.
-
-In general, a curl build for an Apple `ARCH/SDK/DEPLOYMENT_TARGET` combination
-can be taken by providing appropriate values for `ARCH`, `SDK`, `DEPLOYMENT_TARGET`
-below and running the commands:
-
-```bash
-# Set these three according to your needs
-export ARCH=x86_64
-export SDK=macosx
-export DEPLOYMENT_TARGET=10.8
-
-export CFLAGS="-arch $ARCH -isysroot $(xcrun -sdk $SDK --show-sdk-path) -m$SDK-version-min=$DEPLOYMENT_TARGET"
-./configure --host=$ARCH-apple-darwin --prefix $(pwd)/artifacts --with-secure-transport
-make -j8
-make install
-```
-
-Above will build curl for macOS platform with `x86_64` architecture and `10.8` as deployment target.
-
-Here is an example for iOS device:
-
-```bash
-export ARCH=arm64
-export SDK=iphoneos
-export DEPLOYMENT_TARGET=11.0
-
-export CFLAGS="-arch $ARCH -isysroot $(xcrun -sdk $SDK --show-sdk-path) -m$SDK-version-min=$DEPLOYMENT_TARGET"
-./configure --host=$ARCH-apple-darwin --prefix $(pwd)/artifacts --with-secure-transport
-make -j8
-make install
-```
-
-Another example for watchOS simulator for macs with Apple Silicon:
-
-```bash
-export ARCH=arm64
-export SDK=watchsimulator
-export DEPLOYMENT_TARGET=5.0
-
-export CFLAGS="-arch $ARCH -isysroot $(xcrun -sdk $SDK --show-sdk-path) -m$SDK-version-min=$DEPLOYMENT_TARGET"
-./configure --host=$ARCH-apple-darwin --prefix $(pwd)/artifacts --with-secure-transport
-make -j8
-make install
-```
-
-In all above, the built libraries and executables can be found in the
-`artifacts` folder.
+Schannel (from Windows SSPI), is the native SSL library in Windows. Schannel
+in Windows <= XP is unable to connect to servers that no longer support the
+legacy handshakes and algorithms used by those versions. If you are using curl
+in one of those earlier versions of Windows you should choose another SSL
+backend such as OpenSSL.
 
 # Android
 
-When building curl for Android it's recommended to use a Linux/macOS environment
-since using curl's `configure` script is the easiest way to build curl
-for Android. Before you can build curl for Android, you need to install the
-Android NDK first. This can be done using the SDK Manager that is part of
-Android Studio. Once you have installed the Android NDK, you need to figure out
-where it has been installed and then set up some environment variables before
-launching `configure`. On macOS, those variables could look like this to compile
-for `aarch64` and API level 29:
+When building curl for Android you can either use CMake or `configure`.
 
-```bash
+Before you can build curl for Android, you need to install the Android NDK
+first. This can be done using the SDK Manager that is part of Android Studio.
+Once you have installed the Android NDK, you need to figure out where it has
+been installed and then set up some environment variables before launching
+the build.
+
+Examples to compile for `aarch64` and API level 29:
+
+with CMake, where `ANDROID_NDK_HOME` points into your NDK:
+
+```sh
+cmake . \
+  -DANDROID_ABI=arm64-v8a \
+  -DANDROID_PLATFORM=android-29 \
+  -DCMAKE_TOOLCHAIN_FILE="$ANDROID_NDK_HOME/build/cmake/android.toolchain.cmake" \
+  -DCURL_ENABLE_SSL=OFF \
+  -DCURL_USE_LIBPSL=OFF
+```
+
+with `configure`, on macOS:
+
+```sh
 export ANDROID_NDK_HOME=~/Library/Android/sdk/ndk/25.1.8937393 # Point into your NDK.
-export HOST_TAG=darwin-x86_64 # Same tag for Apple Silicon. Other OS values here: https://developer.android.com/ndk/guides/other_build_systems#overview
+# Same tag for Apple Silicon. Other OS values here:
+#   https://developer.android.com/ndk/guides/other_build_systems#overview
+export HOST_TAG=darwin-x86_64
 export TOOLCHAIN=$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/$HOST_TAG
 export AR=$TOOLCHAIN/bin/llvm-ar
 export AS=$TOOLCHAIN/bin/llvm-as
-export CC=$TOOLCHAIN/bin/aarch64-linux-android21-clang
-export CXX=$TOOLCHAIN/bin/aarch64-linux-android21-clang++
+export CC=$TOOLCHAIN/bin/aarch64-linux-android29-clang
+export CXX=$TOOLCHAIN/bin/aarch64-linux-android29-clang++
 export LD=$TOOLCHAIN/bin/ld
 export RANLIB=$TOOLCHAIN/bin/llvm-ranlib
 export STRIP=$TOOLCHAIN/bin/llvm-strip
@@ -413,16 +477,18 @@ to adjust those variables accordingly. After that you can build curl like this:
 
     ./configure --host aarch64-linux-android --with-pic --disable-shared
 
-Note that this will not give you SSL/TLS support. If you need SSL/TLS, you have
-to build curl against a SSL/TLS layer, e.g. OpenSSL, because it's impossible for
-curl to access Android's native SSL/TLS layer. To build curl for Android using
-OpenSSL, follow the OpenSSL build instructions and then install `libssl.a` and
-`libcrypto.a` to `$TOOLCHAIN/sysroot/usr/lib` and copy `include/openssl` to
-`$TOOLCHAIN/sysroot/usr/include`. Now you can build curl for Android using
-OpenSSL like this:
+Note that this does not give you SSL/TLS support. If you need SSL/TLS, you
+have to build curl with an SSL/TLS library, e.g. OpenSSL, because it is
+impossible for curl to access Android's native SSL/TLS layer. To build curl
+for Android using OpenSSL, follow the OpenSSL build instructions and then
+install `libssl.a` and `libcrypto.a` to `$TOOLCHAIN/sysroot/usr/lib` and copy
+`include/openssl` to `$TOOLCHAIN/sysroot/usr/include`. Now you can build curl
+for Android using OpenSSL like this:
 
-```bash
-LIBS="-lssl -lcrypto -lc++" # For OpenSSL/BoringSSL. In general, you will need to the SSL/TLS layer's transitive dependencies if you are linking statically.
+```sh
+# For BoringSSL/OpenSSL. In general, you need to the SSL/TLS layer's transitive
+# dependencies if you are linking statically.
+LIBS='-lssl -lcrypto -lc++'
 ./configure --host aarch64-linux-android --with-pic --disable-shared --with-openssl="$TOOLCHAIN/sysroot/usr"
 ```
 
@@ -432,22 +498,22 @@ For IBM i (formerly OS/400), you can use curl in two different ways:
 
 - Natively, running in the **ILE**. The obvious use is being able to call curl
   from ILE C or RPG applications.
-  - You will need to build this from source. See `packages/OS400/README` for
-    the ILE specific build instructions.
-- In the **PASE** environment, which runs AIX programs. curl will be built as
-  it would be on AIX.
-  - IBM provides builds of curl in their Yum repository for PASE software.
-  - To build from source, follow the Unix instructions.
+- You need to build this from source. See `projects/OS400/README` for the ILE
+  specific build instructions.
+- In the **PASE** environment, which runs AIX programs. curl is built as it
+  would be on AIX.
+- IBM provides builds of curl in their Yum repository for PASE software.
+- To build from source, follow the Unix instructions.
 
 There are some additional limitations and quirks with curl on this platform;
 they affect both environments.
 
 ## Multi-threading notes
 
-By default, jobs in IBM i will not start with threading enabled. (Exceptions
+By default, jobs in IBM i does not start with threading enabled. (Exceptions
 include interactive PASE sessions started by `QP2TERM` or SSH.) If you use
 curl in an environment without threading when options like asynchronous DNS
-were enabled, you will get messages like:
+were enabled, you get messages like:
 
 ```
 getaddrinfo() thread failed to start
@@ -471,9 +537,7 @@ configure with any options you need. Be sure and specify the `--host` and
 of cross-compiling for the IBM 405GP PowerPC processor using the toolchain on
 Linux.
 
-```bash
-#! /bin/sh
-
+```sh
 export PATH=$PATH:/opt/hardhat/devkit/ppc/405/bin
 export CPPFLAGS="-I/opt/hardhat/devkit/ppc/405/target/usr/include"
 export AR=ppc_405-ar
@@ -483,18 +547,16 @@ export RANLIB=ppc_405-ranlib
 export CC=ppc_405-gcc
 export NM=ppc_405-nm
 
-./configure --target=powerpc-hardhat-linux
-    --host=powerpc-hardhat-linux
-    --build=i586-pc-linux-gnu
-    --prefix=/opt/hardhat/devkit/ppc/405/target/usr/local
-    --exec-prefix=/usr/local
+./configure \
+  --target=powerpc-hardhat-linux
+  --host=powerpc-hardhat-linux
+  --build=i586-pc-linux-gnu
+  --prefix=/opt/hardhat/devkit/ppc/405/target/usr/local
+  --exec-prefix=/usr/local
 ```
 
-You may also need to provide a parameter like `--with-random=/dev/urandom` to
-configure as it cannot detect the presence of a random number generating
-device for a target system. The `--prefix` parameter specifies where curl
-will be installed. If `configure` completes successfully, do `make` and `make
-install` as usual.
+The `--prefix` parameter specifies where curl gets installed. If `configure`
+completes successfully, do `make` and `make install` as usual.
 
 In some cases, you may be able to simplify the above commands to as little as:
 
@@ -506,10 +568,16 @@ There are a number of configure options that can be used to reduce the size of
 libcurl for embedded applications where binary size is an important factor.
 First, be sure to set the `CFLAGS` variable when configuring with any relevant
 compiler optimization flags to reduce the size of the binary. For gcc, this
-would mean at minimum the -Os option, and potentially the `-march=X`,
-`-mdynamic-no-pic` and `-flto` options as well, e.g.
+would mean at minimum the `-Os` option, and others like the following that
+may be relevant in some environments: `-march=X`, `-mthumb`, `-m32`,
+`-mdynamic-no-pic`, `-flto`, `-fdata-sections`, `-ffunction-sections`,
+`-fno-unwind-tables`, `-fno-asynchronous-unwind-tables`,
+`-fno-record-gcc-switches`, `-fsection-anchors`, `-fno-plt`,
+`-Wl,--gc-sections`, `-Wl,-dead_strip` (Apple), `-Wl,-Bsymbolic`, `-Wl,-s`
 
-    ./configure CFLAGS='-Os' LDFLAGS='-Wl,-Bsymbolic'...
+For example, this is how to combine a few of these options:
+
+    ./configure CC=gcc CFLAGS='-Os -ffunction-sections' LDFLAGS='-Wl,--gc-sections'...
 
 Note that newer compilers often produce smaller code than older versions
 due to improved optimization.
@@ -517,101 +585,100 @@ due to improved optimization.
 Be sure to specify as many `--disable-` and `--without-` flags on the
 configure command-line as you can to disable all the libcurl features that you
 know your application is not going to need. Besides specifying the
-`--disable-PROTOCOL` flags for all the types of URLs your application will not
+`--disable-PROTOCOL` flags for all the types of URLs your application do not
 use, here are some other flags that can reduce the size of the library by
-disabling support for some feature:
+disabling support for some features (run `./configure --help` to see them all):
 
- - `--disable-alt-svc` (HTTP Alt-Svc)
- - `--disable-ares` (the C-ARES DNS library)
- - `--disable-cookies` (HTTP cookies)
- - `--disable-crypto-auth` (cryptographic authentication)
- - `--disable-dateparse` (date parsing for time conditionals)
- - `--disable-dnsshuffle` (internal server load spreading)
- - `--disable-doh` (DNS-over-HTTP)
- - `--disable-get-easy-options` (lookup easy options at runtime)
- - `--disable-hsts` (HTTP Strict Transport Security)
- - `--disable-http-auth` (all HTTP authentication)
- - `--disable-ipv6` (IPv6)
- - `--disable-libcurl-option` (--libcurl C code generation support)
- - `--disable-manual` (built-in documentation)
- - `--disable-netrc`  (.netrc file)
- - `--disable-ntlm-wb` (NTLM WinBind)
- - `--disable-progress-meter` (graphical progress meter in library)
- - `--disable-proxy` (HTTP and SOCKS proxies)
- - `--disable-pthreads` (multi-threading)
- - `--disable-socketpair` (socketpair for asynchronous name resolving)
- - `--disable-threaded-resolver`  (threaded name resolver)
- - `--disable-tls-srp` (Secure Remote Password authentication for TLS)
- - `--disable-unix-sockets` (UNIX sockets)
- - `--disable-verbose` (eliminates debugging strings and error code strings)
- - `--disable-versioned-symbols` (versioned symbols)
- - `--enable-symbol-hiding` (eliminates unneeded symbols in the shared library)
- - `--without-brotli` (Brotli on-the-fly decompression)
- - `--without-libpsl` (Public Suffix List in cookies)
- - `--without-nghttp2` (HTTP/2 using nghttp2)
- - `--without-ngtcp2` (HTTP/2 using ngtcp2)
- - `--without-zstd` (Zstd on-the-fly decompression)
- - `--without-libidn2` (internationalized domain names)
- - `--without-librtmp` (RTMP)
- - `--without-ssl` (SSL/TLS)
- - `--without-zlib` (on-the-fly decompression)
-
-The GNU compiler and linker have a number of options that can reduce the
-size of the libcurl dynamic libraries on some platforms even further.
-Specify them by providing appropriate `CFLAGS` and `LDFLAGS` variables on
-the configure command-line, e.g.
-
-    CFLAGS="-Os -ffunction-sections -fdata-sections
-            -fno-unwind-tables -fno-asynchronous-unwind-tables -flto"
-    LDFLAGS="-Wl,-s -Wl,-Bsymbolic -Wl,--gc-sections"
+- `--disable-aws` (cryptographic authentication)
+- `--disable-basic-auth` (cryptographic authentication)
+- `--disable-bearer-auth` (cryptographic authentication)
+- `--disable-digest-auth` (cryptographic authentication)
+- `--disable-http-auth` (all HTTP authentication)
+- `--disable-kerberos-auth` (cryptographic authentication)
+- `--disable-negotiate-auth` (cryptographic authentication)
+- `--disable-ntlm` (NTLM authentication)
+- `--disable-alt-svc` (HTTP Alt-Svc)
+- `--disable-ares` (the C-ARES DNS library)
+- `--disable-cookies` (HTTP cookies)
+- `--disable-dateparse` (date parsing for time conditionals)
+- `--disable-dnsshuffle` (internal server load spreading)
+- `--disable-doh` (DNS-over-HTTP)
+- `--disable-form-api` (POST form API)
+- `--disable-get-easy-options` (lookup easy options at runtime)
+- `--disable-headers-api` (API to access headers)
+- `--disable-hsts` (HTTP Strict Transport Security)
+- `--disable-ipv6` (IPv6)
+- `--disable-libcurl-option` (--libcurl C code generation support)
+- `--disable-manual` (--manual built-in documentation)
+- `--disable-mime` (MIME API)
+- `--disable-netrc` (.netrc file)
+- `--disable-progress-meter` (graphical progress meter in library)
+- `--disable-proxy` (HTTP and SOCKS proxies)
+- `--disable-socketpair` (socketpair for asynchronous name resolving)
+- `--disable-threaded-resolver` (threaded name resolver)
+- `--disable-tls-srp` (Secure Remote Password authentication for TLS)
+- `--disable-unix-sockets` (Unix sockets)
+- `--disable-verbose` (eliminates debugging strings and error code strings)
+- `--disable-versioned-symbols` (versioned symbols)
+- `--enable-symbol-hiding` (eliminates unneeded symbols in the shared library)
+- `--without-brotli` (Brotli on-the-fly decompression)
+- `--without-libpsl` (Public Suffix List in cookies)
+- `--without-nghttp2` (HTTP/2 using nghttp2)
+- `--without-ngtcp2` (HTTP/2 using ngtcp2)
+- `--without-zstd` (Zstd on-the-fly decompression)
+- `--without-libidn2` (internationalized domain names)
+- `--without-ssl` (SSL/TLS)
+- `--without-zlib` (gzip/deflate on-the-fly decompression)
 
 Be sure also to strip debugging symbols from your binaries after compiling
-using 'strip' (or the appropriate variant if cross-compiling). If space is
-really tight, you may be able to remove some unneeded sections of the shared
-library using the -R option to objcopy (e.g. the .comment section).
+using 'strip' or an option like `-s`. If space is really tight, you may be able
+to gain a few bytes by removing some unneeded sections of the shared library
+using the -R option to objcopy (e.g. the .comment section).
 
 Using these techniques it is possible to create a basic HTTP-only libcurl
-shared library for i386 Linux platforms that is only 133 KiB in size
-(as of libcurl version 7.80.0, using gcc 11.2.0).
+shared library for i386 Linux platforms that is only 137 KiB in size
+(as of libcurl version 8.13.0, using gcc 14.2.0).
 
-You may find that statically linking libcurl to your application will result
-in a lower total size than dynamically linking.
+You may find that statically linking libcurl to your application results in a
+lower total size than dynamically linking.
 
-Note that the curl test harness can detect the use of some, but not all, of
-the `--disable` statements suggested above. Use will cause tests relying on
-those features to fail. The test harness can be manually forced to skip the
+The curl test harness can detect the use of some, but not all, of the
+`--disable` statements suggested above. Use of these can cause tests relying
+on those features to fail. The test harness can be manually forced to skip the
 relevant tests by specifying certain key words on the `runtests.pl` command
 line. Following is a list of appropriate key words for those configure options
 that are not automatically detected:
 
- - `--disable-cookies`          !cookies
- - `--disable-dateparse`        !RETRY-AFTER !`CURLOPT_TIMECONDITION` !`CURLINFO_FILETIME` !`If-Modified-Since` !`curl_getdate` !`-z`
- - `--disable-libcurl-option`   !`--libcurl`
- - `--disable-verbose`          !verbose\ logs
+- `--disable-cookies`          !cookies
+- `--disable-dateparse`        !RETRY-AFTER !`CURLOPT_TIMECONDITION` !`CURLINFO_FILETIME` !`If-Modified-Since` !`curl_getdate` !`-z`
+- `--disable-libcurl-option`   !`--libcurl`
+- `--disable-verbose`          !verbose\ logs
 
-# PORTS
+# Ports
 
 This is a probably incomplete list of known CPU architectures and operating
 systems that curl has been compiled for. If you know a system curl compiles
-and runs on, that is not listed, please let us know!
+and runs on, that is not listed, please let us know.
 
-## 92 Operating Systems
+## 108 Operating Systems
 
-    AIX, AmigaOS, Android, Aros, BeOS, Blackberry 10, Blackberry Tablet OS,
-    Cell OS, Chrome OS, Cisco IOS, Cygwin, DG/UX, Dragonfly BSD, DR DOS, eCOS,
-    FreeBSD, FreeDOS, FreeRTOS, Fuchsia, Garmin OS, Genode, Haiku, HardenedBSD,
-    HP-UX, Hurd, Illumos, Integrity, iOS, ipadOS, IRIX, Linux, Lua RTOS,
-    Mac OS 9, macOS, Mbed, Micrium, MINIX, MorphOS, MPE/iX, MS-DOS, NCR MP-RAS,
-    NetBSD, Netware, Nintendo Switch, NonStop OS, NuttX, Omni OS, OpenBSD,
-    OpenStep, Orbis OS, OS/2, OS/400, OS21, Plan 9, PlayStation Portable, QNX,
-    Qubes OS, ReactOS, Redox, RICS OS, RTEMS, Sailfish OS, SCO Unix, Serenity,
-    SINIX-Z, Solaris, SunOS, Syllable OS, Symbian, Tizen, TPF, Tru64, tvOS,
-    ucLinux, Ultrix, UNICOS, UnixWare, VMS, vxWorks, watchOS, WebOS,
-    Wii system software, Windows, Windows CE, Xbox System, Xenix, Zephyr,
-    z/OS, z/TPF, z/VM, z/VSE
+    AIX, AmigaOS, Android, ArcaOS, Aros, Atari FreeMiNT, Azure Sphere, BeOS,
+    Blackberry 10, Blackberry Tablet OS, Cell OS, Cesium, CheriBSD, Chrome OS,
+    Cisco IOS, DG/UX, DR DOS, Dragonfly BSD, eCOS, FreeBSD, FreeDOS, FreeRTOS,
+    Fuchsia, Garmin OS, Genode, Haiku, HardenedBSD, HP-UX, Hurd, IBM I,
+    illumos, Integrity, iOS, ipadOS, IRIX, KasperskyOS, Linux, Lua RTOS,
+    Mac OS 9, macOS, Maemo, Mbed, Meego, Micrium, MINIX, Minoca, Moblin,
+    MorphOS, MPE/iX, MS-DOS, NCR MP-RAS, NetBSD, Netware, NextStep,
+    Nintendo 3DS, Nintendo Switch, NonStop OS, NuttX, OpenBSD, OpenStep,
+    Orbis OS, OS/2, OS21, PikeOS, Plan 9, PlayStation Portable, QNX, Qubes OS,
+    ReactOS, Redox, RISC OS, ROS, RTEMS, Sailfish OS, SCO Unix, Serenity,
+    SINIX-Z, SkyOS, SmartOS, Solaris, Sortix, SunOS, Syllable OS, Symbian,
+    Tizen, TPF, Tru64, tvOS, ucLinux, Ultrix, UNICOS, UnixWare, visionOS, VMS,
+    vxWorks, watchOS, Wear OS, WebOS, Wii System Software, Wii U, Windows,
+    Xbox System, Xenix, z/OS, z/TPF, z/VM, z/VSE, Zephyr
 
-## 26 CPU Architectures
+## 28 CPU Architectures
 
-    Alpha, ARC, ARM, AVR32, CompactRISC, Elbrus, ETRAX, HP-PA, Itanium,
+    Alpha, ARC, ARM, AVR32, C-SKY, CompactRISC, Elbrus, ETRAX, HP-PA, Itanium,
     LoongArch, m68k, m88k, MicroBlaze, MIPS, Nios, OpenRISC, POWER, PowerPC,
-    RISC-V, s390, SH4, SPARC, Tilera, VAX, x86, Xtensa
+    RISC-V, s390, SH4, SPARC, Tilera, VAX, x86, Xtensa, z/arch
diff --git a/third-party/curl/docs/INTERNALS.md b/third-party/curl/docs/INTERNALS.md
index d7513a8ff3..ff59f733e0 100644
--- a/third-party/curl/docs/INTERNALS.md
+++ b/third-party/curl/docs/INTERNALS.md
@@ -1,3 +1,9 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # curl internals
 
 The canonical libcurl internals documentation is now in the [everything
@@ -6,51 +12,61 @@ versions of libs and build tools.
 
 ## Portability
 
- We write curl and libcurl to compile with C89 compilers on 32-bit and up
- machines. Most of libcurl assumes more or less POSIX compliance but that is
- not a requirement.
+We write curl and libcurl to compile with C89 compilers on 32-bit and up
+machines. Most of libcurl assumes more or less POSIX compliance but that is
+not a requirement. The compiler must support a 64-bit integer type as well as
+supply a stdint.h header file that defines C99-style fixed-width integer types
+like uint32_t.
 
- We write libcurl to build and work with lots of third party tools, and we
- want it to remain functional and buildable with these and later versions
- (older versions may still work but is not what we work hard to maintain):
+We write libcurl to build and work with lots of third party tools, and we
+want it to remain functional and buildable with these and later versions
+(older versions may still work but is not what we work hard to maintain):
 
 ## Dependencies
 
- We aim to support these or later versions.
+We aim to support these or later versions:
 
- - OpenSSL      0.9.7
- - GnuTLS       3.1.10
- - zlib         1.1.4
- - libssh2      1.0
- - c-ares       1.16.0
- - libidn2      2.0.0
- - wolfSSL      2.0.0
- - OpenLDAP     2.0
- - MIT Kerberos 1.2.4
- - Heimdal      ?
- - nghttp2      1.15.0
- - WinSock      2.2 (on Windows 95+ and Windows CE .NET 4.1+)
+- brotli       1.0.0 (2017-09-21)
+- c-ares       1.16.0 (2020-03-13)
+- GnuTLS       3.6.5 (2018-12-01)
+- libidn2      2.0.0 (2017-03-29)
+- libgsasl     1.6.0 (2010-12-14)
+- libpsl       0.16.0 (2016-12-10)
+- LibreSSL     2.9.1 (2019-04-21)
+- libssh       0.9.0 (2019-06-28)
+- libssh2      1.9.0 (2019-06-20)
+- mbedTLS      3.2.0 (2022-07-11)
+- MIT Kerberos 1.3 (2003-07-31)
+- nghttp2      1.15.0 (2016-09-25)
+- nghttp3      1.0.0 (2023-10-15)
+- ngtcp2       1.0.0 (2023-10-15), with OpenSSL 3.5.0+: 1.12.0 (2025-04-16)
+- OpenLDAP     2.0 (2000-08-01)
+- OpenSSL      3.0.0 (2021-09-07)
+- Windows      Vista 6.0 (2006-11-08 - 2012-04-10)
+- wolfSSL      5.0.0 (2021-11-01)
+- zlib         1.2.5.2 (2011-12-11)
+- zstd         1.0 (2016-08-31)
 
 ## Build tools
 
- When writing code (mostly for generating stuff included in release tarballs)
- we use a few "build tools" and we make sure that we remain functional with
- these versions:
+When writing code (mostly for generating stuff included in release tarballs)
+we use a few "build tools" and we make sure that we remain functional with
+these or later versions:
 
- - GNU Libtool  1.4.2
- - GNU Autoconf 2.59
- - GNU Automake 1.7
- - GNU M4       1.4
- - perl         5.6
- - roffit       0.5
- - nroff        any version that supports `-man [in] [out]`
- - cmake        3.7
+- clang-tidy     17.0.0 (2023-09-19), recommended: 19.1.0 (2024-09-17)
+- cmake          3.18 (2020-07-15)
+- GNU autoconf   2.59 (2003-11-06)
+- GNU automake   1.7 (2002-09-25)
+- GNU libtool    1.4.2 (2001-09-11)
+- GNU m4         1.4 (2007-09-21)
+- mingw-w64      3.0 (2013-09-20)
+- perl           5.8 (2002-07-19), on Windows: 5.22 (2015-06-01)
+- Visual Studio  2010 10.0 (2010-04-12 - 2020-07-14)
 
-Library Symbols
-===============
+## Library Symbols
 
- All symbols used internally in libcurl must use a `Curl_` prefix if they are
- used in more than a single file. Single-file symbols must be made static.
- Public ("exported") symbols must use a `curl_` prefix. Public API functions
- are marked with `CURL_EXTERN` in the public header files so that all others
- can be hidden on platforms where this is possible.
+All symbols used internally in libcurl must use a `Curl_` prefix if they are
+used in more than a single file. Single-file symbols must be made static.
+Public ("exported") symbols must use a `curl_` prefix. Public API functions
+are marked with `CURL_EXTERN` in the public header files so that all others
+can be hidden on platforms where this is possible.
diff --git a/third-party/curl/docs/IPFS.md b/third-party/curl/docs/IPFS.md
new file mode 100644
index 0000000000..2cf64543b9
--- /dev/null
+++ b/third-party/curl/docs/IPFS.md
@@ -0,0 +1,150 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# IPFS
+
+For an overview about IPFS, visit the [IPFS project site](https://ipfs.tech/).
+
+In IPFS there are two protocols. IPFS and IPNS (their workings are explained
+in detail [here](https://docs.ipfs.tech/concepts/)). The ideal way to access
+data on the IPFS network is through those protocols. For example to access
+the Big Buck Bunny video the ideal way to access it is like:
+`ipfs://bafybeigagd5nmnn2iys2f3doro7ydrevyr2mzarwidgadawmamiteydbzi`
+
+## IPFS Gateways
+
+IPFS Gateway acts as a bridge between traditional HTTP clients and IPFS.
+IPFS Gateway specifications of HTTP semantics can be found
+[here](https://specs.ipfs.tech/http-gateways/).
+
+### Deserialized responses
+
+By default, a gateway acts as a bridge between traditional HTTP clients and
+IPFS and performs necessary hash verification and deserialization. Through such
+gateway, users can download files, directories, and other content-addressed
+data stored with IPFS or IPNS as if they were stored in a traditional web
+server.
+
+### Verifiable responses
+
+By explicitly requesting
+[application/vnd.ipld.raw](https://www.iana.org/assignments/media-types/application/vnd.ipld.raw) or
+[application/vnd.ipld.car](https://www.iana.org/assignments/media-types/application/vnd.ipld.car)
+responses, by means defined in
+[Trustless Gateway Specification](https://specs.ipfs.tech/http-gateways/trustless-gateway/),
+the user is able to fetch raw content-addressed data and
+[perform hash verification themselves](https://docs.ipfs.tech/reference/http/gateway/#trustless-verifiable-retrieval).
+
+This enables users to use untrusted, public gateways without worrying they
+might return invalid/malicious bytes.
+
+## IPFS and IPNS protocol handling
+
+There are various ways to access data from the IPFS network. One such way is
+through the concept of public
+"[gateways](https://docs.ipfs.tech/concepts/ipfs-gateway/#overview)". The
+short version is that entities can offer gateway services. An example here
+that is hosted by Protocol Labs (who also makes IPFS) is `dweb.link` and
+`ipfs.io`. Both sites expose gateway functionality. Getting a file through
+`ipfs.io` looks like this:
+`https://ipfs.io/ipfs/bafybeigagd5nmnn2iys2f3doro7ydrevyr2mzarwidgadawmamiteydbzi`
+
+If you were to be [running your own IPFS
+node](https://docs.ipfs.tech/how-to/command-line-quick-start/) then you, by
+default, also have a [local gateway](https://specs.ipfs.tech/http-gateways/)
+running. In its default configuration the earlier example would then also work
+in this link:
+
+`http://127.0.0.1:8080/ipfs/bafybeigagd5nmnn2iys2f3doro7ydrevyr2mzarwidgadawmamiteydbzi`
+
+## curl handling of the IPFS protocols
+
+The IPFS integration in curl hides this gateway logic for you. Instead of
+providing a full URL to a file on IPFS like this:
+
+```sh
+curl http://127.0.0.1:8080/ipfs/bafybeigagd5nmnn2iys2f3doro7ydrevyr2mzarwidgadawmamiteydbzi
+```
+
+You can provide it with the IPFS protocol instead:
+```sh
+curl ipfs://bafybeigagd5nmnn2iys2f3doro7ydrevyr2mzarwidgadawmamiteydbzi
+```
+
+With the IPFS protocol way of asking a file, curl still needs to know the
+gateway. curl essentially rewrites the IPFS based URL to a gateway URL.
+
+### IPFS_GATEWAY environment variable
+
+If the `IPFS_GATEWAY` environment variable is found, its value is used as
+gateway.
+
+### Automatic gateway detection
+
+When you provide no additional details to curl then it:
+
+1. First looks for the `IPFS_GATEWAY` environment variable and use that if it
+   is set.
+2. Looks for the file: `~/.ipfs/gateway`. If it can find that file then it
+   means that you have a local gateway running and that file contains the URL
+   to your local gateway.
+
+If curl fails, you are presented with an error message and a link to this page
+to the option most applicable to solving the issue.
+
+### `--ipfs-gateway` argument
+
+You can also provide a `--ipfs-gateway` argument to curl. This overrules any
+other gateway setting. curl does not fallback to the other options if the
+provided gateway did not work.
+
+## Gateway redirects
+
+A gateway could redirect to another place. For example, `dweb.link` redirects
+[path based](https://docs.ipfs.tech/how-to/address-ipfs-on-web/#path-gateway)
+requests to [subdomain
+based](https://docs.ipfs.tech/how-to/address-ipfs-on-web/#subdomain-gateway)
+ones. A request using:
+
+    curl ipfs://bafybeigagd5nmnn2iys2f3doro7ydrevyr2mzarwidgadawmamiteydbzi --ipfs-gateway https://dweb.link
+
+Which would be translated to:
+
+    https://dweb.link/ipfs/bafybeigagd5nmnn2iys2f3doro7ydrevyr2mzarwidgadawmamiteydbzi
+
+redirects to:
+
+    https://bafybeigagd5nmnn2iys2f3doro7ydrevyr2mzarwidgadawmamiteydbzi.ipfs.dweb.link
+
+If you trust this behavior from your gateway of choice then passing the `-L`
+option follows the redirect.
+
+## Error messages and hints
+
+Depending on the arguments, curl could present the user with an error.
+
+### Gateway file and environment variable
+
+curl tried to look for the file: `~/.ipfs/gateway` but could not find it. It
+also tried to look for the `IPFS_GATEWAY` environment variable but could not
+find that either. This happens when no extra arguments are passed to curl and
+letting it try to figure it out [automatically](#automatic-gateway-detection).
+
+Any IPFS implementation that has gateway support should expose its URL in
+`~/.ipfs/gateway`. If you are already running a gateway, make sure it exposes
+the file where curl expects to find it.
+
+Alternatively you could set the `IPFS_GATEWAY` environment variable or pass
+the `--ipfs-gateway` flag to the curl command.
+
+### Malformed gateway URL
+
+The command executed evaluates in an invalid URL. This could be anywhere in
+the URL, but a likely point is a wrong gateway URL.
+
+Inspect the URL set via the `IPFS_GATEWAY` environment variable or passed with
+the `--ipfs-gateway` flag. Alternatively opt to go for the
+[automatic](#automatic-gateway-detection) gateway detection.
diff --git a/third-party/curl/docs/KNOWN_BUGS b/third-party/curl/docs/KNOWN_BUGS
deleted file mode 100644
index 395426b4dd..0000000000
--- a/third-party/curl/docs/KNOWN_BUGS
+++ /dev/null
@@ -1,625 +0,0 @@
-                                  _   _ ____  _
-                              ___| | | |  _ \| |
-                             / __| | | | |_) | |
-                            | (__| |_| |  _ <| |___
-                             \___|\___/|_| \_\_____|
-
-                                  Known Bugs
-
-These are problems and bugs known to exist at the time of this release. Feel
-free to join in and help us correct one or more of these. Also be sure to
-check the changelog of the current development status, as one or more of these
-problems may have been fixed or changed somewhat since this was written.
-
- 1. HTTP
- 1.1 hyper memory-leaks
- 1.2 hyper is slow
- 1.5 Expect-100 meets 417
-
- 2. TLS
- 2.3 Unable to use PKCS12 certificate with Secure Transport
- 2.4 Secure Transport will not import PKCS#12 client certificates without a password
- 2.5 Client cert handling with Issuer DN differs between backends
- 2.7 Client cert (MTLS) issues with Schannel
- 2.11 Schannel TLS 1.2 handshake bug in old Windows versions
- 2.12 FTPS with Schannel times out file list operation
- 2.13 CURLOPT_CERTINFO results in CURLE_OUT_OF_MEMORY with Schannel
-
- 3. Email protocols
- 3.1 IMAP SEARCH ALL truncated response
- 3.2 No disconnect command
- 3.3 POP3 expects "CRLF.CRLF" eob for some single-line responses
- 3.4 AUTH PLAIN for SMTP is not working on all servers
- 3.5 APOP authentication fails on POP3
-
- 4. Command line
-
- 5. Build and portability issues
- 5.1 OS400 port requires deprecated IBM library
- 5.2 curl-config --libs contains private details
- 5.3 building for old macOS fails with gcc
- 5.5 cannot handle Unicode arguments in non-Unicode builds on Windows
- 5.6 cygwin: make install installs curl-config.1 twice
- 5.9 Utilize Requires.private directives in libcurl.pc
- 5.11 configure --with-gssapi with Heimdal is ignored on macOS
- 5.12 flaky CI builds
- 5.13 long paths are not fully supported on Windows
- 5.14 Windows Unicode builds use homedir in current locale
-
- 6. Authentication
- 6.1 NTLM authentication and unicode
- 6.2 MIT Kerberos for Windows build
- 6.3 NTLM in system context uses wrong name
- 6.5 NTLM does not support password with § character
- 6.6 libcurl can fail to try alternatives with --proxy-any
- 6.7 Do not clear digest for single realm
- 6.9 SHA-256 digest not supported in Windows SSPI builds
- 6.10 curl never completes Negotiate over HTTP
- 6.11 Negotiate on Windows fails
- 6.12 cannot use Secure Transport with Crypto Token Kit
- 6.13 Negotiate against Hadoop HDFS
-
- 7. FTP
- 7.3 FTP with NOBODY and FAILONERROR
- 7.4 FTP with ACCT
- 7.11 FTPS upload data loss with TLS 1.3
- 7.12 FTPS directory listing hangs on Windows with Schannel
-
- 9. SFTP and SCP
- 9.1 SFTP does not do CURLOPT_POSTQUOTE correct
- 9.2 wolfssh: publickey auth does not work
- 9.3 Remote recursive folder creation with SFTP
- 9.4 libssh blocking and infinite loop problem
- 9.5 cygwin: "WARNING: UNPROTECTED PRIVATE KEY FILE!"
-
- 10. SOCKS
- 10.3 FTPS over SOCKS
-
- 11. Internals
- 11.2 error buffer not set if connection to multiple addresses fails
- 11.4 HTTP test server 'connection-monitor' problems
- 11.5 Connection information when using TCP Fast Open
-
- 12. LDAP
- 12.1 OpenLDAP hangs after returning results
- 12.2 LDAP on Windows does authentication wrong?
- 12.3 LDAP on Windows does not work
- 12.4 LDAPS requests to ActiveDirectory server hang
-
- 13. TCP/IP
- 13.2 Trying local ports fails on Windows
-
- 15. CMake
- 15.1 cmake outputs: no version information available
- 15.2 support build with GnuTLS
- 15.3 unusable tool_hugehelp.c with MinGW
- 15.4 build docs/curl.1
- 15.6 uses -lpthread instead of Threads::Threads
- 15.7 generated .pc file contains strange entries
- 15.8 libcurl.pc uses absolute library paths
- 15.11 ExternalProject_Add does not set CURL_CA_PATH
- 15.13 CMake build with MIT Kerberos does not work
-
- 16. aws-sigv4
- 16.1 aws-sigv4 does not sign requests with * correctly
- 16.2 aws-sigv4 does not sign requests with valueless queries correctly
- 16.3 aws-sigv4 is missing the amz-content-sha256 header
- 16.4 aws-sigv4 does not sort query string parameters before signing
- 16.5 aws-sigv4 does not sign requests with empty URL query correctly
- 16.6 aws-sigv4 does not behave well with AWS VPC Lattice
-
- 17. HTTP/2
- 17.2 HTTP/2 frames while in the connection pool kill reuse
- 17.3 ENHANCE_YOUR_CALM causes infinite retries
-
- 18. HTTP/3
- 18.1 connection migration does not work
-
-==============================================================================
-
-1. HTTP
-
-1.2 hyper is slow
-
- When curl is built to use hyper for HTTP, it is unnecessary slow.
-
- https://github.com/curl/curl/issues/11203
-
-1.5 Expect-100 meets 417
-
- If an upload using Expect: 100-continue receives an HTTP 417 response, it
- ought to be automatically resent without the Expect:. A workaround is for
- the client application to redo the transfer after disabling Expect:.
- https://curl.se/mail/archive-2008-02/0043.html
-
-2. TLS
-
-2.3 Unable to use PKCS12 certificate with Secure Transport
-
- See https://github.com/curl/curl/issues/5403
-
-2.4 Secure Transport will not import PKCS#12 client certificates without a password
-
- libcurl calls SecPKCS12Import with the PKCS#12 client certificate, but that
- function rejects certificates that do not have a password.
- https://github.com/curl/curl/issues/1308
-
-2.5 Client cert handling with Issuer DN differs between backends
-
- When the specified client certificate does not match any of the
- server-specified DNs, the OpenSSL and GnuTLS backends behave differently.
- The github discussion may contain a solution.
-
- See https://github.com/curl/curl/issues/1411
-
-2.7 Client cert (MTLS) issues with Schannel
-
- See https://github.com/curl/curl/issues/3145
-
-2.11 Schannel TLS 1.2 handshake bug in old Windows versions
-
- In old versions of Windows such as 7 and 8.1 the Schannel TLS 1.2 handshake
- implementation likely has a bug that can rarely cause the key exchange to
- fail, resulting in error SEC_E_BUFFER_TOO_SMALL or SEC_E_MESSAGE_ALTERED.
-
- https://github.com/curl/curl/issues/5488
-
-2.12 FTPS with Schannel times out file list operation
-
- "Instead of the command completing, it just sits there until the timeout
- expires." - the same command line seems to work with other TLS backends and
- other operating systems. See https://github.com/curl/curl/issues/5284.
-
-2.13 CURLOPT_CERTINFO results in CURLE_OUT_OF_MEMORY with Schannel
-
- https://github.com/curl/curl/issues/8741
-
-3. Email protocols
-
-3.1 IMAP SEARCH ALL truncated response
-
- IMAP "SEARCH ALL" truncates output on large boxes. "A quick search of the
- code reveals that pingpong.c contains some truncation code, at line 408, when
- it deems the server response to be too large truncating it to 40 characters"
- https://curl.se/bug/view.cgi?id=1366
-
-3.2 No disconnect command
-
- The disconnect commands (LOGOUT and QUIT) may not be sent by IMAP, POP3 and
- SMTP if a failure occurs during the authentication phase of a connection.
-
-3.3 POP3 expects "CRLF.CRLF" eob for some single-line responses
-
- You have to tell libcurl not to expect a body, when dealing with one line
- response commands. Please see the POP3 examples and test cases which show
- this for the NOOP and DELE commands. https://curl.se/bug/?i=740
-
-3.4 AUTH PLAIN for SMTP is not working on all servers
-
- Specifying "--login-options AUTH=PLAIN" on the command line does not seem to
- work correctly.
-
- See https://github.com/curl/curl/issues/4080
-
-3.5 APOP authentication fails on POP3
-
- See https://github.com/curl/curl/issues/10073
-
-4. Command line
-
-5. Build and portability issues
-
-5.1 OS400 port requires deprecated IBM library
-
- curl for OS400 requires QADRT to build, which provides ASCII wrappers for
- libc/POSIX functions in the ILE, but IBM no longer supports or even offers
- this library to download.
-
- See https://github.com/curl/curl/issues/5176
-
-5.2 curl-config --libs contains private details
-
- "curl-config --libs" will include details set in LDFLAGS when configure is
- run that might be needed only for building libcurl. Further, curl-config
- --cflags suffers from the same effects with CFLAGS/CPPFLAGS.
-
-5.3 building for old macOS fails with gcc
-
- Building curl for certain old macOS versions fails when gcc is used. We
- command using clang in those cases.
-
- See https://github.com/curl/curl/issues/11441
-
-5.5 cannot handle Unicode arguments in non-Unicode builds on Windows
-
- If a URL or filename cannot be encoded using the user's current codepage then
- it can only be encoded properly in the Unicode character set. Windows uses
- UTF-16 encoding for Unicode and stores it in wide characters, however curl
- and libcurl are not equipped for that at the moment except when built with
- _UNICODE and UNICODE defined. And, except for Cygwin, Windows cannot use UTF-8
- as a locale.
-
-  https://curl.se/bug/?i=345
-  https://curl.se/bug/?i=731
-  https://curl.se/bug/?i=3747
-
-5.6 cygwin: make install installs curl-config.1 twice
-
- https://github.com/curl/curl/issues/8839
-
-5.9 Utilize Requires.private directives in libcurl.pc
-
- https://github.com/curl/curl/issues/864
-
-5.11 configure --with-gssapi with Heimdal is ignored on macOS
-
- ... unless you also pass --with-gssapi-libs
-
- https://github.com/curl/curl/issues/3841
-
-5.12 flaky CI builds
-
- We run many CI builds for each commit and PR on github, and especially a
- number of the Windows builds are flaky. This means that we rarely get all CI
- builds go green and complete without errors. This is unfortunate as it makes
- us sometimes miss actual build problems and it is surprising to newcomers to
- the project who (rightfully) do not expect this.
-
- See https://github.com/curl/curl/issues/6972
-
-5.13 long paths are not fully supported on Windows
-
- curl on Windows cannot access long paths (paths longer than 260 characters).
- However, as a workaround, the Windows path prefix \\?\ which disables all path
- interpretation may work to allow curl to access the path. For example:
- \\?\c:\longpath.
-
- See https://github.com/curl/curl/issues/8361
-
-5.14 Windows Unicode builds use homedir in current locale
-
- The Windows Unicode builds of curl use the current locale, but expect Unicode
- UTF-8 encoded paths for internal use such as open, access and stat. The user's
- home directory is retrieved via curl_getenv in the current locale and not as
- UTF-8 encoded Unicode.
-
- See https://github.com/curl/curl/pull/7252 and
-     https://github.com/curl/curl/pull/7281
-
-6. Authentication
-
-6.1 NTLM authentication and unicode
-
- NTLM authentication involving unicode user name or password only works
- properly if built with UNICODE defined together with the Schannel
- backend. The original problem was mentioned in:
- https://curl.se/mail/lib-2009-10/0024.html
- https://curl.se/bug/view.cgi?id=896
-
- The Schannel version verified to work as mentioned in
- https://curl.se/mail/lib-2012-07/0073.html
-
-6.2 MIT Kerberos for Windows build
-
- libcurl fails to build with MIT Kerberos for Windows (KfW) due to KfW's
- library header files exporting symbols/macros that should be kept private to
- the KfW library. See ticket #5601 at https://krbdev.mit.edu/rt/
-
-6.3 NTLM in system context uses wrong name
-
- NTLM authentication using SSPI (on Windows) when (lib)curl is running in
- "system context" will make it use wrong(?) user name - at least when compared
- to what winhttp does. See https://curl.se/bug/view.cgi?id=535
-
-6.5 NTLM does not support password with § character
-
- https://github.com/curl/curl/issues/2120
-
-6.6 libcurl can fail to try alternatives with --proxy-any
-
- When connecting via a proxy using --proxy-any, a failure to establish an
- authentication will cause libcurl to abort trying other options if the
- failed method has a higher preference than the alternatives. As an example,
- --proxy-any against a proxy which advertise Negotiate and NTLM, but which
- fails to set up Kerberos authentication will not proceed to try authentication
- using NTLM.
-
- https://github.com/curl/curl/issues/876
-
-6.7 Do not clear digest for single realm
-
- https://github.com/curl/curl/issues/3267
-
-6.9 SHA-256 digest not supported in Windows SSPI builds
-
- Windows builds of curl that have SSPI enabled use the native Windows API calls
- to create authentication strings. The call to InitializeSecurityContext fails
- with SEC_E_QOP_NOT_SUPPORTED which causes curl to fail with CURLE_AUTH_ERROR.
-
- Microsoft does not document supported digest algorithms and that SEC_E error
- code is not a documented error for InitializeSecurityContext (digest).
-
- https://github.com/curl/curl/issues/6302
-
-6.10 curl never completes Negotiate over HTTP
-
- Apparently it is not working correctly...?
-
- See https://github.com/curl/curl/issues/5235
-
-6.11 Negotiate on Windows fails
-
- When using --negotiate (or NTLM) with curl on Windows, SSL/TLS handshake
- fails despite having a valid kerberos ticket cached. Works without any issue
- in Unix/Linux.
-
- https://github.com/curl/curl/issues/5881
-
-6.12 cannot use Secure Transport with Crypto Token Kit
-
- https://github.com/curl/curl/issues/7048
-
-6.13 Negotiate authentication against Hadoop HDFS
-
- https://github.com/curl/curl/issues/8264
-
-7. FTP
-
-7.3 FTP with NOBODY and FAILONERROR
-
- It seems sensible to be able to use CURLOPT_NOBODY and CURLOPT_FAILONERROR
- with FTP to detect if a file exists or not, but it is not working:
- https://curl.se/mail/lib-2008-07/0295.html
-
-7.4 FTP with ACCT
-
- When doing an operation over FTP that requires the ACCT command (but not when
- logging in), the operation will fail since libcurl does not detect this and
- thus fails to issue the correct command:
- https://curl.se/bug/view.cgi?id=635
-
-7.11 FTPS upload data loss with TLS 1.3
-
- During FTPS upload curl does not attempt to read TLS handshake messages sent
- after the initial handshake. OpenSSL servers running TLS 1.3 may send such a
- message. When curl closes the upload connection if unread data has been
- received (such as a TLS handshake message) then the TCP protocol sends an
- RST to the server, which may cause the server to discard or truncate the
- upload if it has not read all sent data yet, and then return an error to curl
- on the control channel connection.
-
- Since 7.78.0 this is mostly fixed. curl will do a single read before closing
- TLS connections (which causes the TLS library to read handshake messages),
- however there is still possibility of an RST if more messages need to be read
- or a message arrives after the read but before close (network race condition).
-
- https://github.com/curl/curl/issues/6149
-
-7.12 FTPS directory listing hangs on Windows with Schannel
-
- https://github.com/curl/curl/issues/9161
-
-9. SFTP and SCP
-
-9.1 SFTP does not do CURLOPT_POSTQUOTE correct
-
- When libcurl sends CURLOPT_POSTQUOTE commands when connected to a SFTP server
- using the multi interface, the commands are not being sent correctly and
- instead the connection is "cancelled" (the operation is considered done)
- prematurely. There is a half-baked (busy-looping) patch provided in the bug
- report but it cannot be accepted as-is. See
- https://curl.se/bug/view.cgi?id=748
-
-9.2 wolfssh: publickey auth does not work
-
- When building curl to use the wolfSSH backend for SFTP, the publickey
- authentication does not work. This is simply functionality not written for curl
- yet, the necessary API for make this work is provided by wolfSSH.
-
- See https://github.com/curl/curl/issues/4820
-
-9.3 Remote recursive folder creation with SFTP
-
- On this servers, the curl fails to create directories on the remote server
- even when the CURLOPT_FTP_CREATE_MISSING_DIRS option is set.
-
- See https://github.com/curl/curl/issues/5204
-
-9.4 libssh blocking and infinite loop problem
-
- In the SSH_SFTP_INIT state for libssh, the ssh session working mode is set to
- blocking mode. If the network is suddenly disconnected during sftp
- transmission, curl will be stuck, even if curl is configured with a timeout.
-
- https://github.com/curl/curl/issues/8632
-
-9.5 cygwin: "WARNING: UNPROTECTED PRIVATE KEY FILE!"
-
- Running SCP and SFTP tests on cygwin makes this warning message appear.
-
- https://github.com/curl/curl/issues/11244
-
-10. SOCKS
-
-10.3 FTPS over SOCKS
-
- libcurl does not support FTPS over a SOCKS proxy.
-
-
-11. Internals
-
-11.2 error buffer not set if connection to multiple addresses fails
-
- If you ask libcurl to resolve a hostname like example.com to IPv6 addresses
- only. But you only have IPv4 connectivity. libcurl will correctly fail with
- CURLE_COULDNT_CONNECT. But the error buffer set by CURLOPT_ERRORBUFFER
- remains empty. Issue: https://github.com/curl/curl/issues/544
-
-11.4 HTTP test server 'connection-monitor' problems
-
- The 'connection-monitor' feature of the sws HTTP test server does not work
- properly if some tests are run in unexpected order. Like 1509 and then 1525.
-
- See https://github.com/curl/curl/issues/868
-
-11.5 Connection information when using TCP Fast Open
-
- CURLINFO_LOCAL_PORT (and possibly a few other) fails when TCP Fast Open is
- enabled.
-
- See https://github.com/curl/curl/issues/1332 and
- https://github.com/curl/curl/issues/4296
-
-12. LDAP
-
-12.1 OpenLDAP hangs after returning results
-
- By configuration defaults, OpenLDAP automatically chase referrals on
- secondary socket descriptors. The OpenLDAP backend is asynchronous and thus
- should monitor all socket descriptors involved. Currently, these secondary
- descriptors are not monitored, causing OpenLDAP library to never receive
- data from them.
-
- As a temporary workaround, disable referrals chasing by configuration.
-
- The fix is not easy: proper automatic referrals chasing requires a
- synchronous bind callback and monitoring an arbitrary number of socket
- descriptors for a single easy handle (currently limited to 5).
-
- Generic LDAP is synchronous: OK.
-
- See https://github.com/curl/curl/issues/622 and
-     https://curl.se/mail/lib-2016-01/0101.html
-
-12.2 LDAP on Windows does authentication wrong?
-
- https://github.com/curl/curl/issues/3116
-
-12.3 LDAP on Windows does not work
-
- A simple curl command line getting "ldap://ldap.forumsys.com" returns an
- error that says "no memory" !
-
- https://github.com/curl/curl/issues/4261
-
-12.4 LDAPS requests to ActiveDirectory server hang
-
- https://github.com/curl/curl/issues/9580
-
-13. TCP/IP
-
-13.2 Trying local ports fails on Windows
-
- This makes '--local-port [range]' to not work since curl cannot properly
- detect if a port is already in use, so it will try the first port, use that and
- then subsequently fail anyway if that was actually in use.
-
- https://github.com/curl/curl/issues/8112
-
-15. CMake
-
-15.1 cmake outputs: no version information available
-
- Something in the SONAME generation seems to be wrong in the cmake build.
-
- https://github.com/curl/curl/issues/11158
-
-15.2 support build with GnuTLS
-
-15.3 unusable tool_hugehelp.c with MinGW
-
- see https://github.com/curl/curl/issues/3125
-
-15.4 build docs/curl.1
-
- The cmake build does not create the docs/curl.1 file and therefore must rely on
- it being there already. This makes the --manual option not work and test
- cases like 1139 cannot function.
-
-15.6 uses -lpthread instead of Threads::Threads
-
- See https://github.com/curl/curl/issues/6166
-
-15.7 generated .pc file contains strange entries
-
- The Libs.private field of the generated .pc file contains -lgcc -lgcc_s -lc
- -lgcc -lgcc_s
-
- See https://github.com/curl/curl/issues/6167
-
-15.8 libcurl.pc uses absolute library paths
-
- The libcurl.pc file generated by cmake contains things like Libs.private:
- /usr/lib64/libssl.so /usr/lib64/libcrypto.so /usr/lib64/libz.so. The
- autotools equivalent would say Libs.private: -lssl -lcrypto -lz
-
- See https://github.com/curl/curl/issues/6169
-
-15.11 ExternalProject_Add does not set CURL_CA_PATH
-
- CURL_CA_BUNDLE and CURL_CA_PATH are not set properly when cmake's
- ExternalProject_Add is used to build curl as a dependency.
-
- See https://github.com/curl/curl/issues/6313
-
-15.13 CMake build with MIT Kerberos does not work
-
- Minimum CMake version was bumped in curl 7.71.0 (#5358) Since CMake 3.2
- try_compile started respecting the CMAKE_EXE_FLAGS. The code dealing with
- MIT Kerberos detection sets few variables to potentially weird mix of space,
- and ;-separated flags. It had to blow up at some point. All the CMake checks
- that involve compilation are doomed from that point, the configured tree
- cannot be built.
-
- https://github.com/curl/curl/issues/6904
-
-16. aws-sigv4
-
-16.1 aws-sigv4 does not sign requests with * correctly
-
- https://github.com/curl/curl/issues/7559
-
-16.2 aws-sigv4 does not sign requests with valueless queries correctly
-
- https://github.com/curl/curl/issues/8107
-
-16.3 aws-sigv4 is missing the amz-content-sha256 header
-
- https://github.com/curl/curl/issues/8810
-
-16.4 aws-sigv4 does not sort query string parameters before signing
-
- https://github.com/curl/curl/issues/9717
-
-16.5 aws-sigv4 does not sign requests with empty URL query correctly
-
- https://github.com/curl/curl/issues/10129
-
-16.6 aws-sigv4 does not behave well with AWS VPC Lattice
-
- https://github.com/curl/curl/issues/11007
-
-17. HTTP/2
-
-17.2 HTTP/2 frames while in the connection pool kill reuse
-
- If the server sends HTTP/2 frames (like for example an HTTP/2 PING frame) to
- curl while the connection is held in curl's connection pool, the socket will
- be found readable when considered for reuse and that makes curl think it is
- dead and then it will be closed and a new connection gets created instead.
-
- This is *best* fixed by adding monitoring to connections while they are kept
- in the pool so that pings can be responded to appropriately.
-
-17.3 ENHANCE_YOUR_CALM causes infinite retries
-
- Infinite retries with 2 parallel requests on one connection receiving GOAWAY
- with ENHANCE_YOUR_CALM error code.
-
- See https://github.com/curl/curl/issues/5119
-
-18. HTTP/3
-
-18.1 connection migration does not work
-
- https://github.com/curl/curl/issues/7695
diff --git a/third-party/curl/docs/KNOWN_BUGS.md b/third-party/curl/docs/KNOWN_BUGS.md
new file mode 100644
index 0000000000..359c2fab99
--- /dev/null
+++ b/third-party/curl/docs/KNOWN_BUGS.md
@@ -0,0 +1,548 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# Known bugs intro
+
+These are problems and bugs known to exist at the time of this release. Feel
+free to join in and help us correct one or more of these. Also be sure to
+check the changelog of the current development status, as one or more of these
+problems may have been fixed or changed somewhat since this was written.
+
+# TLS
+
+## IMAPS connection fails with Rustls error
+
+[curl issue 10457](https://github.com/curl/curl/issues/10457)
+
+## Access violation sending client cert with Schannel
+
+When using Schannel to do client certs, curl sets `PKCS12_NO_PERSIST_KEY` to
+avoid leaking the private key into the filesystem. Unfortunately that flag
+instead seems to trigger a crash.
+
+See [curl issue 17626](https://github.com/curl/curl/issues/17626)
+
+## Client cert (MTLS) issues with Schannel
+
+See [curl issue 3145](https://github.com/curl/curl/issues/3145)
+
+## Schannel TLS 1.2 handshake bug in old Windows versions
+
+In old versions of Windows such as 7 and 8.1 the Schannel TLS 1.2 handshake
+implementation likely has a bug that can rarely cause the key exchange to
+fail, resulting in error SEC_E_BUFFER_TOO_SMALL or SEC_E_MESSAGE_ALTERED.
+
+[curl issue 5488](https://github.com/curl/curl/issues/5488)
+
+## mbedTLS and CURLE_AGAIN handling
+
+[curl issue 15801](https://github.com/curl/curl/issues/15801)
+
+## Native CA roots incomplete on Windows with OpenSSL (or fork)
+
+Certain Windows installations may be missing CA roots.
+
+[curl issue 20897](https://github.com/curl/curl/issues/20897)
+[curl issue 12303](https://github.com/curl/curl/issues/12303)
+
+## ECH not working through Proxy Tunnels
+
+[curl issue 22043](https://github.com/curl/curl/issues/22043)
+
+# Email protocols
+
+## IMAP `SEARCH ALL` truncated response
+
+IMAP `SEARCH ALL` truncates output on large boxes. "A quick search of the code
+reveals that `pingpong.c` contains some truncation code, at line 408, when it
+deems the server response to be too large truncating it to 40 characters"
+
+https://curl.se/bug/view.cgi?id=1366
+
+## No disconnect command
+
+The disconnect commands (`LOGOUT` and `QUIT`) may not be sent by IMAP, POP3
+and SMTP if a failure occurs during the authentication phase of a connection.
+
+## `AUTH PLAIN` for SMTP is not working on all servers
+
+Specifying `--login-options AUTH=PLAIN` on the command line does not seem to
+work correctly.
+
+See [curl issue 4080](https://github.com/curl/curl/issues/4080)
+
+## `APOP` authentication fails on POP3
+
+See [curl issue 10073](https://github.com/curl/curl/issues/10073)
+
+## POP3 issue when reading small chunks
+
+    CURL_DBG_SOCK_RMAX=4 ./runtests.pl -v 982
+
+See [curl issue 12063](https://github.com/curl/curl/issues/12063)
+
+# Command line
+
+## `-T /dev/stdin` may upload with an incorrect content length
+
+`-T` stats the path to figure out its size in bytes to use it as
+`Content-Length` if it is a regular file.
+
+The problem with that is that on BSD and some other UNIX systems (not Linux),
+open(path) may not give you a file descriptor with a 0 offset from the start
+of the file.
+
+See [curl issue 12177](https://github.com/curl/curl/issues/12177)
+
+## `-T -` always uploads chunked
+
+When the `<` shell operator is used. curl should realize that stdin is a
+regular file in this case, and that it can do a non-chunked upload, like it
+would do if you used `-T` file.
+
+See [curl issue 12171](https://github.com/curl/curl/issues/12171)
+
+## Windows stdin relay accepts unauthenticated local connections
+
+curl features a Windows-only stdin relay in `src/tool_doswin.c` that creates a
+loopback TCP listener and spawns a thread to accept the first incoming
+connection, then forwards stdin to it. There is no authentication or peer
+validation on the accepted socket. A local attacker can race to connect to the
+ephemeral loopback port (discoverable via local port enumeration/scan) before
+curl connects, causing the thread to send stdin/upload data to the attacker or
+to disrupt the transfer.
+
+The function should verify the client-side with a random number similar to the
+socketpair emulation function in libcurl. It cannot verify the source address
+and port since there is this widespread habit on Windows to run tools that
+MITM even local TCP connections for security.
+
+# Build and portability issues
+
+## OS400 port requires deprecated IBM library
+
+curl for OS400 requires `QADRT` to build, which provides ASCII wrappers for
+libc/POSIX functions in the ILE, but IBM no longer supports or even offers
+this library to download.
+
+See [curl issue 5176](https://github.com/curl/curl/issues/5176)
+
+## `curl-config --libs` contains private details
+
+`curl-config --libs` include details set in `LDFLAGS` when configure is run
+that might be needed only for building libcurl. Further, `curl-config
+--cflags` suffers from the same effects with `CFLAGS`/`CPPFLAGS`.
+
+## `LDFLAGS` passed too late making libs linked incorrectly
+
+Compiling latest curl on HP-UX and linking against a custom OpenSSL (which is
+on the default loader/linker path), fails because the generated Makefile has
+`LDFLAGS` passed on after `LIBS`.
+
+See [curl issue 14893](https://github.com/curl/curl/issues/14893)
+
+## Cygwin: make install installs curl-config.1 twice
+
+[curl issue 8839](https://github.com/curl/curl/issues/8839)
+
+## flaky CI builds
+
+We run many CI builds for each commit and PR on GitHub, and especially a
+number of the Windows builds are flaky. This means that we rarely get all CI
+builds go green and complete without errors. This is unfortunate as it makes
+us sometimes miss actual build problems and it is surprising to newcomers to
+the project who (rightfully) do not expect this.
+
+See [curl issue 6972](https://github.com/curl/curl/issues/6972)
+
+## long paths are not fully supported on Windows
+
+curl on Windows cannot access long paths (paths longer than 260 characters).
+As a workaround, the Windows path prefix `\\?\` which disables all path
+interpretation may work to allow curl to access the path. For example:
+`\\?\c:\longpath`.
+
+See [curl issue 8361](https://github.com/curl/curl/issues/8361)
+
+## Unicode on Windows
+
+Passing in a Unicode filename with -o:
+
+[curl issue 11461](https://github.com/curl/curl/issues/11461)
+
+Passing in Unicode character with -d:
+
+[curl issue 12231](https://github.com/curl/curl/issues/12231)
+
+Windows Unicode builds use the home directory in current locale.
+
+The Windows Unicode builds of curl use the current locale, but expect Unicode
+UTF-8 encoded paths for internal use such as open, access and stat. The user's
+home directory is retrieved via curl_getenv in the current locale and not as
+UTF-8 encoded Unicode.
+
+See [curl pull request 7252](https://github.com/curl/curl/pull/7252) and [curl pull request 7281](https://github.com/curl/curl/pull/7281)
+
+Cannot handle Unicode arguments in non-Unicode builds on Windows
+
+If a URL or filename cannot be encoded using the user's current code page then
+it can only be encoded properly in the Unicode character set. Windows uses
+UTF-16 encoding for Unicode and stores it in wide characters, however curl and
+libcurl are not equipped for that at the moment except when built with
+_UNICODE and UNICODE defined. Except for Cygwin, Windows cannot use UTF-8 as a
+locale.
+
+https://curl.se/bug/?i=345
+https://curl.se/bug/?i=731
+https://curl.se/bug/?i=3747
+
+NTLM authentication and Unicode
+
+NTLM authentication involving Unicode username or password only works properly
+if built with UNICODE defined together with the Schannel backend. The original
+problem was mentioned in: https://curl.se/mail/lib-2009-10/0024.html and
+https://curl.se/bug/view.cgi?id=896
+
+The Schannel version verified to work as mentioned in
+https://curl.se/mail/lib-2012-07/0073.html
+
+# Authentication
+
+## `--aws-sigv4` does not handle multipart/form-data correctly
+
+[curl issue 13351](https://github.com/curl/curl/issues/13351)
+
+## Digest `auth-int` for PUT/POST
+
+We do not support auth-int for Digest using PUT or POST
+
+## Digest does not care for `domain`
+
+libcurl ignores the `domain` directive in Digest authentication challenges
+(`WWW-Authenticate:`). RFC 7616 defines it as a quoted, space-separated list
+of URIs that define the protection space.
+
+## MIT Kerberos for Windows build
+
+libcurl fails to build with MIT Kerberos for Windows (`KfW`) due to its
+library header files exporting symbols/macros that should be kept private to
+the library.
+
+## NTLM in system context uses wrong name
+
+NTLM authentication using SSPI (on Windows) when (lib)curl is running in
+"system context" makes it use wrong(?) username - at least when compared to
+what `winhttp` does. See https://curl.se/bug/view.cgi?id=535
+
+## NTLM does not support password with Unicode 'SECTION SIGN' character
+
+Code point: U+00A7
+
+https://en.wikipedia.org/wiki/Section_sign
+[curl issue 2120](https://github.com/curl/curl/issues/2120)
+
+## libcurl can fail to try alternatives with `--proxy-any`
+
+When connecting via a proxy using `--proxy-any`, a failure to establish an
+authentication causes libcurl to abort trying other options if the failed
+method has a higher preference than the alternatives. As an example,
+`--proxy-any` against a proxy which advertise Negotiate and NTLM, but which
+fails to set up Kerberos authentication does not proceed to try authentication
+using NTLM.
+
+[curl issue 876](https://github.com/curl/curl/issues/876)
+
+## Do not clear digest for single realm
+
+[curl issue 3267](https://github.com/curl/curl/issues/3267)
+
+## SHA-256 digest not supported in Windows SSPI builds
+
+Windows builds of curl that have SSPI enabled use the native Windows API calls
+to create authentication strings. The call to `InitializeSecurityContext` fails
+with `SEC_E_QOP_NOT_SUPPORTED` which causes curl to fail with
+`CURLE_AUTH_ERROR`.
+
+Microsoft does not document supported digest algorithms and that `SEC_E` error
+code is not a documented error for `InitializeSecurityContext` (digest).
+
+[curl issue 6302](https://github.com/curl/curl/issues/6302)
+
+## curl never completes Negotiate over HTTP
+
+Apparently it is not working correctly...?
+
+See [curl issue 5235](https://github.com/curl/curl/issues/5235)
+
+## Negotiate on Windows fails
+
+When using `--negotiate` (or NTLM) with curl on Windows, SSL/TLS handshake
+fails despite having a valid kerberos ticket cached. Works without any issue
+in Unix/Linux.
+
+[curl issue 5881](https://github.com/curl/curl/issues/5881)
+
+## Negotiate authentication against Hadoop
+
+[curl issue 8264](https://github.com/curl/curl/issues/8264)
+
+# FTP
+
+## FTP with ACCT
+
+When doing an operation over FTP that requires the `ACCT` command (but not when
+logging in), the operation fails since libcurl does not detect this and thus
+fails to issue the correct command: https://curl.se/bug/view.cgi?id=635
+
+## FTPS server compatibility on Windows with Schannel
+
+FTPS is not widely used with the Schannel TLS backend and so there may be more
+bugs compared to other TLS backends such as OpenSSL. In the past users have
+reported hanging and failed connections. It is likely some changes to curl
+since then fixed the issues. None of the reported issues can be reproduced any
+longer.
+
+If you encounter an issue connecting to your server via FTPS with the latest
+curl and Schannel then please search for open issues or file a new issue.
+
+# SFTP and SCP
+
+## SFTP does not do `CURLOPT_POSTQUOTE` correct
+
+When libcurl sends `CURLOPT_POSTQUOTE` commands when connected to an SFTP
+server using the multi interface, the commands are not being sent correctly
+and instead the connection is canceled (the operation is considered done)
+prematurely. There is a half-baked (busy-looping) patch provided in the bug
+report but it cannot be accepted as-is. See
+https://curl.se/bug/view.cgi?id=748
+
+## Remote recursive folder creation with SFTP
+
+On this servers, the curl fails to create directories on the remote server
+even when the `CURLOPT_FTP_CREATE_MISSING_DIRS` option is set.
+
+See [curl issue 5204](https://github.com/curl/curl/issues/5204)
+
+## libssh blocking and infinite loop problem
+
+In the `SSH_SFTP_INIT` state for libssh, the ssh session working mode is set
+to blocking mode. If the network is suddenly disconnected during sftp
+transmission, curl is stuck, even if curl is configured with a timeout.
+
+[curl issue 8632](https://github.com/curl/curl/issues/8632)
+
+## Cygwin: "WARNING: UNPROTECTED PRIVATE KEY FILE!"
+
+Running SCP and SFTP tests on Cygwin makes this warning message appear.
+
+[curl issue 11244](https://github.com/curl/curl/issues/11244)
+
+# Connection
+
+## `--interface` with link-scoped IPv6 address
+
+When you give the `--interface` option telling curl to use a specific
+interface for its outgoing traffic in combination with an IPv6 address in the
+URL that uses a link-local scope, curl might pick the wrong address from the
+named interface and the subsequent transfer fails.
+
+Example command line:
+
+    curl --interface eth0 'http://[fe80:928d:xxff:fexx:xxxx]/'
+
+The fact that the given IP address is link-scoped should probably be used as
+input to somehow make curl make a better choice for this.
+
+[curl issue 14782](https://github.com/curl/curl/issues/14782)
+
+## Does not acknowledge getaddrinfo sorting policy
+
+Even if a user edits `/etc/gai.conf` to prefer IPv4, curl still prefers and
+tries IPv6 addresses first.
+
+[curl issue 16718](https://github.com/curl/curl/issues/16718)
+
+## SOCKS-SSPI discards the security context
+
+After a successful SSPI/GSS-API exchange, the function queries and logs the
+authenticated username and reports the supported data-protection level, but
+then immediately deletes the negotiated SSPI security context and frees the
+credentials before returning. The negotiated context is not stored on the
+connection and is therefore never used to protect later SOCKS5 traffic.
+
+## cannot use absolute Unix domain filename for SOCKS on Windows
+
+curl supports using a Unix domain socket path for speaking SOCKS to a proxy,
+by providing a filename in the URL used for `-x` (`CURLOPT_PROXY`), but that
+path cannot be a proper absolute Windows path with a drive letter etc.
+
+A solution for this probably requires that we add and provide a
+`--unix-socket` (`CURLOPT_UNIX_SOCKET_PATH`) option alternative for proxy
+communication.
+
+See [curl issue 19825](https://github.com/curl/curl/issues/19825)
+
+# Internals
+
+## GSSAPI library name + version is missing in `curl_version_info()`
+
+The struct needs to be expanded and code added to store this info.
+
+See [curl issue 13492](https://github.com/curl/curl/issues/13492)
+
+## error buffer not set if connection to multiple addresses fails
+
+If you ask libcurl to resolve a hostname like example.com to IPv6 addresses
+when you only have IPv4 connectivity. libcurl fails with
+`CURLE_COULDNT_CONNECT`, but the error buffer set by `CURLOPT_ERRORBUFFER`
+remains empty. Issue: [curl issue 544](https://github.com/curl/curl/issues/544)
+
+## HTTP test server 'connection-monitor' problems
+
+The `connection-monitor` feature of the HTTP test server does not work
+properly if some tests are run in unexpected order. Like 1509 and then 1525.
+
+See [curl issue 868](https://github.com/curl/curl/issues/868)
+
+## Connection information when using TCP Fast Open
+
+`CURLINFO_LOCAL_PORT` (and possibly a few other) fails when TCP Fast Open is
+enabled.
+
+See [curl issue 1332](https://github.com/curl/curl/issues/1332) and
+[curl issue 4296](https://github.com/curl/curl/issues/4296)
+
+## test cases sometimes timeout
+
+Occasionally, one of the tests timeouts. Inexplicably.
+
+See [curl issue 13350](https://github.com/curl/curl/issues/13350)
+
+## `CURLOPT_CONNECT_TO` does not work for HTTPS proxy
+
+It is unclear if the same option should even cover the proxy connection or if
+it requires a separate option.
+
+See [curl issue 14481](https://github.com/curl/curl/issues/14481)
+
+## WinIDN test failures
+
+Test 165 disabled when built with WinIDN.
+
+## setting a disabled option should return `CURLE_NOT_BUILT_IN`
+
+When curl has been built with specific features or protocols disabled, setting
+such options with `curl_easy_setopt()` should rather return
+`CURLE_NOT_BUILT_IN` instead of `CURLE_UNKNOWN_OPTION` to signal the
+difference to the application
+
+See [curl issue 15472](https://github.com/curl/curl/issues/15472)
+
+# LDAP
+
+## OpenLDAP hangs after returning results
+
+By configuration defaults, OpenLDAP automatically chase referrals on secondary
+socket descriptors. The OpenLDAP backend is asynchronous and thus should
+monitor all socket descriptors involved. Currently, these secondary
+descriptors are not monitored, causing OpenLDAP library to never receive data
+from them.
+
+As a temporary workaround, disable referrals chasing by configuration.
+
+The fix is not easy: proper automatic referrals chasing requires a synchronous
+bind callback and monitoring an arbitrary number of socket descriptors for a
+single easy handle (currently limited to 5).
+
+Generic LDAP is synchronous: OK.
+
+See [curl issue 622](https://github.com/curl/curl/issues/622) and
+https://curl.se/mail/lib-2016-01/0101.html
+
+## LDAP on Windows does authentication wrong?
+
+[curl issue 3116](https://github.com/curl/curl/issues/3116)
+
+## LDAP on Windows does not work
+
+A simple curl command line getting `ldap://ldap.forumsys.com` returns an error
+that says `no memory` !
+
+[curl issue 4261](https://github.com/curl/curl/issues/4261)
+
+## LDAPS requests to Active Directory server hang
+
+[curl issue 9580](https://github.com/curl/curl/issues/9580)
+
+# TCP/IP
+
+## telnet code does not handle partial writes properly
+
+It probably does not happen too easily because of how slow and infrequent
+sends are normally performed.
+
+## Trying local ports fails on Windows
+
+This makes `--local-port [range]` to not work since curl cannot properly
+detect if a port is already in use, so it tries the first port, uses that and
+then subsequently fails anyway if that was actually in use.
+
+[curl issue 8112](https://github.com/curl/curl/issues/8112)
+
+# HTTP/2
+
+## HTTP/2 prior knowledge over proxy
+
+[curl issue 12641](https://github.com/curl/curl/issues/12641)
+
+## HTTP/2 frames while in the connection pool kill reuse
+
+If the server sends HTTP/2 frames (like for example an HTTP/2 PING frame) to
+curl while the connection is held in curl's connection pool, the socket is
+found readable when considered for reuse and that makes curl think it is dead
+and then it is closed and a new connection gets created instead.
+
+This is *best* fixed by adding monitoring to connections while they are kept
+in the pool so that pings can be responded to appropriately.
+
+## `ENHANCE_YOUR_CALM` causes infinite retries
+
+Infinite retries with 2 parallel requests on one connection receiving `GOAWAY`
+with `ENHANCE_YOUR_CALM` error code.
+
+See [curl issue 5119](https://github.com/curl/curl/issues/5119)
+
+## HTTP/2 + TLS spends a lot of time in recv
+
+It has been observed that by making the speed limit less accurate we could
+improve this performance. (by reverting
+[db5c9f4f9e0779](https://github.com/curl/curl/commit/db5c9f4f9e0779b49624752b135281a0717b277b))
+Can we find a golden middle ground?
+
+See https://curl.se/mail/lib-2024-05/0026.html and
+[curl issue 13416](https://github.com/curl/curl/issues/13416)
+
+# HTTP/3
+
+## connection migration does not work
+
+[curl issue 7695](https://github.com/curl/curl/issues/7695)
+
+## quiche: QUIC connection is draining
+
+The transfer ends with error "QUIC connection is draining".
+
+[curl issue 12037](https://github.com/curl/curl/issues/12037)
+
+# RTSP
+
+## Some methods do not support response bodies
+
+The RTSP implementation is written to assume that a number of RTSP methods
+always get responses without bodies, even though there seems to be no
+indication in the RFC that this is always the case.
+
+[curl issue 12414](https://github.com/curl/curl/issues/12414)
diff --git a/third-party/curl/docs/KNOWN_RISKS.md b/third-party/curl/docs/KNOWN_RISKS.md
new file mode 100644
index 0000000000..82125f0c66
--- /dev/null
+++ b/third-party/curl/docs/KNOWN_RISKS.md
@@ -0,0 +1,149 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# Known Risks
+
+This is an incomplete list of known risks when running and using curl and
+libcurl.
+
+# Risks
+
+## Insecure transfers
+
+When using curl to perform transfers with protocols that are insecure or the
+server identity is unverified, everything that is sent and received can be
+intercepted by eavesdroppers and the servers can easily be spoofed by
+impostors.
+
+## Untrusted input
+
+You should **never** run curl command lines or use curl config files provided
+to you from untrusted sources.
+
+curl can do a lot of things, and you should only ask it do things you want and
+deem correct.
+
+Even accepting only the URL part without careful vetting might make curl do
+things you do not like. Like accessing internal hosts, like connecting to
+rogue servers that redirect to even weirder places, like using ports or
+protocols that play tricks on you.
+
+## Command line misuse
+
+The command line tool and its options should be used and be expected to work
+as documented. Relying on undocumented functions or side-effects is unreliable
+as they may cause problems or get changed behavior between releases.
+
+For several command line options, you can confuse either curl or the involved
+server endpoint by using characters or byte sequences for the option that are
+not expected. For example, adding line feeds and/or carriage returns to inputs
+can produce unexpected, invalid, or insecure results.
+
+## API misuse
+
+Applications using the libcurl API in a way that is not documented to work or
+even documented to not work, is unsafe and might cause security problems. We
+only guarantee secure and proper functionality when the APIs are used as
+documented.
+
+## Local attackers already present
+
+When there is a local attacker present locally, curl cannot prevent such an
+adversary to use curl's full potential. Possibly in malicious ways.
+
+## Remote attackers already present
+
+When there is a remote attacker already present in the server, curl cannot
+protect its operations against mischief. For example, if an attacker manages
+to insert a symlink in your remote upload directory the upload may cause
+havoc. Maybe the attacker makes certain responses come back with unexpected
+content.
+
+## Debug & Experiments
+
+We encourage users to test curl experiments and use debug code, but only in
+controlled environments and setups - never in production.
+
+Using debug builds and experimental curl features in production is a security
+risk. Do not do that.
+
+The same applies to scripts and software which are not installed by default
+through the make install rule: they are not intended or made for production
+use.
+
+## URL inconsistencies
+
+URL parser inconsistencies between browsers and curl are expected and are not
+considered security vulnerabilities. The WHATWG URL Specification and RFC
+3986+ (the plus meaning that it is an extended version) [are not completely
+interoperable](https://github.com/bagder/docs/blob/master/URL-interop.md).
+
+You must never expect two independent URL parsers to treat every URL
+identically.
+
+## Visible command line arguments
+
+The curl command blanks the contents of a number of command line arguments to
+prevent them from appearing in process listings. It does not blank all
+arguments, even though some that are not blanked might contain sensitive data.
+
+- not all systems allow the arguments to be blanked in the first place
+- since curl blanks the argument itself they are readable for a short moment
+  no matter what
+- virtually every argument can contain sensitive data, depending on use
+- blanking all arguments would make it impractical for users to differentiate
+  curl command lines in process listings
+
+## HTTP headers in redirects
+
+It is powerful to provide a set of custom headers to curl. Beware that when
+asking curl to follow HTTP redirects, it also sends those headers to the new
+URL which might be a different server. That might do another redirect etc.
+
+curl makes some limited attempts to not leak credentials this way when set
+using the standard curl options, but when you pass on custom headers curl
+cannot know what headers or details in those headers are sensitive.
+
+## Verbose logs
+
+When asked to provide verbose output and trace logging, curl may output and
+show details that are private and sensitive. Like for example raw credentials
+or the password weakly disguised using base64 encoding.
+
+## Terminal output and escape sequences
+
+Content that is transferred from a server and gets displayed in a terminal by
+curl may contain escape sequences or use other tricks to fool the user. Escape
+sequences, moving cursor, changing color etc, is also frequently used for
+good. To reduce the risk of getting fooled, save files and browse them after
+download using a display method that minimizes risks.
+
+## Legacy dependencies
+
+Every curl build is made to use a range of third party libraries. Each third
+party library also needs to be safe and secure for the entire operation to be
+risk-free.
+
+Relying on legacy dependencies is a risk.
+
+## Weak algorithms
+
+curl supports several cryptographic algorithms that are considered weak, like
+DES and MD5. These algorithms are still in use because some protocols and
+transfer options require use of them. For example NTLM or legacy HTTP Digest
+authentication.
+
+curl users should consider switching to servers and options that use modern
+and secure algorithms.
+
+## Compression bombs
+
+When asking curl or libcurl to automatically decompress data on arrival, there
+is a risk that the size of the output from the decompression process ends up
+many times larger than the input data size.
+
+Since curl 8.20.0, users can mitigate this risk by setting the max filesize
+option that also covers the decompressed size.
diff --git a/third-party/curl/docs/MAIL-ETIQUETTE b/third-party/curl/docs/MAIL-ETIQUETTE
deleted file mode 100644
index 2dcf9cb896..0000000000
--- a/third-party/curl/docs/MAIL-ETIQUETTE
+++ /dev/null
@@ -1,285 +0,0 @@
-                                  _   _ ____  _
-                              ___| | | |  _ \| |
-                             / __| | | | |_) | |
-                            | (__| |_| |  _ <| |___
-                             \___|\___/|_| \_\_____|
-
-MAIL ETIQUETTE
-
- 1. About the lists
-  1.1 Mailing Lists
-  1.2 Netiquette
-  1.3 Do Not Mail a Single Individual
-  1.4 Subscription Required
-  1.5 Moderation of new posters
-  1.6 Handling trolls and spam
-  1.7 How to unsubscribe
-  1.8 I posted, now what?
-  1.9 Your emails are public
-
- 2. Sending mail
-  2.1 Reply or New Mail
-  2.2 Reply to the List
-  2.3 Use a Sensible Subject
-  2.4 Do Not Top-Post
-  2.5 HTML is not for mails
-  2.6 Quoting
-  2.7 Digest
-  2.8 Please Tell Us How You Solved The Problem
-
-==============================================================================
-
-1. About the lists
-
-  1.1 Mailing Lists
-
-  The mailing lists we have are all listed and described at
-  https://curl.se/mail/
-
-  Each mailing list is targeted to a specific set of users and subjects,
-  please use the one or the ones that suit you the most.
-
-  Each mailing list has hundreds up to thousands of readers, meaning that each
-  mail sent will be received and read by a large number of people. People
-  from various cultures, regions, religions and continents.
-
-  1.2 Netiquette
-
-  Netiquette is a common term for how to behave on the Internet. Of course, in
-  each particular group and subculture there will be differences in what is
-  acceptable and what is considered good manners.
-
-  This document outlines what we in the curl project consider to be good
-  etiquette, and primarily this focus on how to behave on and how to use our
-  mailing lists.
-
-  1.3 Do Not Mail a Single Individual
-
-  Many people send one question to one person. One person gets many mails, and
-  there is only one person who can give you a reply. The question may be
-  something that other people would also like to ask. These other people have
-  no way to read the reply, but to ask the one person the question. The one
-  person consequently gets overloaded with mail.
-
-  If you really want to contact an individual and perhaps pay for his or her
-  services, by all means go ahead, but if it's just another curl question,
-  take it to a suitable list instead.
-
-  1.4 Subscription Required
-
-  All curl mailing lists require that you are subscribed to allow a mail to go
-  through to all the subscribers.
-
-  If you post without being subscribed (or from a different mail address than
-  the one you are subscribed with), your mail will simply be silently
-  discarded. You have to subscribe first, then post.
-
-  The reason for this unfortunate and strict subscription policy is of course
-  to stop spam from pestering the lists.
-
-  1.5 Moderation of new posters
-
-  Several of the curl mailing lists automatically make all posts from new
-  subscribers be moderated. This means that after you have subscribed and
-  sent your first mail to a list, that mail will not be let through to the
-  list until a mailing list administrator has verified that it is OK and
-  permits it to get posted.
-
-  Once a first post has been made that proves the sender is actually talking
-  about curl-related subjects, the moderation "flag" will be switched off and
-  future posts will go through without being moderated.
-
-  The reason for this moderation policy is that we do suffer from spammers who
-  actually subscribe and send spam to our lists.
-
-  1.6 Handling trolls and spam
-
-  Despite our good intentions and hard work to keep spam off the lists and to
-  maintain a friendly and positive atmosphere, there will be times when spam
-  and or trolls get through.
-
-  Troll - "someone who posts inflammatory, extraneous, or off-topic messages
-  in an online community"
-
-  Spam - "use of electronic messaging systems to send unsolicited bulk
-  messages"
-
-  No matter what, we NEVER EVER respond to trolls or spammers on the list. If
-  you believe the list admin should do something in particular, contact them
-  off-list. The subject will be taken care of as much as possible to prevent
-  repeated offenses, but responding on the list to such messages never leads to
-  anything good and only puts the light even more on the offender: which was
-  the entire purpose of it getting sent to the list in the first place.
-
-  Do not feed the trolls.
-
-  1.7 How to unsubscribe
-
-  You can unsubscribe the same way you subscribed in the first place. You go
-  to the page for the particular mailing list you are subscribed to and you enter
-  your email address and password and press the unsubscribe button.
-
-  Also, the instructions to unsubscribe are included in the headers of every
-  mail that is sent out to all curl related mailing lists and there is a footer
-  in each mail that links to the "admin" page on which you can unsubscribe and
-  change other options.
-
-  You NEVER EVER email the mailing list requesting someone else to take you off
-  the list.
-
-  1.8 I posted, now what?
-
-  If you are not subscribed with the same email address that you used to send
-  the email, your post will just be silently discarded.
-
-  If you posted for the first time to the mailing list, you first need to wait
-  for an administrator to allow your email to go through (moderated). This
-  normally happens quickly but in case we are asleep, you may have to wait a
-  few hours.
-
-  Once your email goes through it is sent out to several hundred or even
-  thousands of recipients. Your email may cover an area that not that many
-  people know about or are interested in. Or possibly the person who knows
-  about it is on vacation or under a heavy work load right now. You may have
-  to wait for a response and you should not expect to get a response at all.
-  Ideally, you get an answer within a couple of days.
-
-  You do yourself and all of us a service when you include as many details as
-  possible already in your first email. Mention your operating system and
-  environment. Tell us which curl version you are using and tell us what you
-  did, what happened and what you expected would happen. Preferably, show us
-  what you did with details enough to allow others to help point out the
-  problem or repeat the steps in their locations.
-
-  Failing to include details will only delay responses and make people respond
-  and ask for more details and you will have to send a follow-up email that
-  includes them.
-
-  Expect the responses to primarily help YOU debug the issue, or ask YOU
-  questions that can lead you or others towards a solution or explanation to
-  whatever you experience.
-
-  If you are a repeat offender to the guidelines outlined in this document,
-  chances are that people will ignore you at will and your chances to get
-  responses in the future will greatly diminish.
-
-  1.9 Your emails are public
-
-  Your email, its contents and all its headers and the details in those
-  headers will be received by every subscriber of the mailing list that you
-  send your email to.
-
-  Your email as sent to a curl mailing list will end up in mail archives, on
-  the curl website and elsewhere, for others to see and read. Today and in
-  the future. In addition to the archives, the mail is sent out to thousands
-  of individuals. There is no way to undo a sent email.
-
-  When sending emails to a curl mailing list, do not include sensitive
-  information such as user names and passwords; use fake ones, temporary ones
-  or just remove them completely from the mail. Note that this includes base64
-  encoded HTTP Basic auth headers.
-
-  This public nature of the curl mailing lists makes automatically inserted mail
-  footers about mails being "private" or "only meant for the recipient" or
-  similar even more silly than usual. Because they are absolutely not private
-  when sent to a public mailing list.
-
-
-2. Sending mail
-
-  2.1 Reply or New Mail
-
-  Please do not reply to an existing message as a short-cut to post a message
-  to the lists.
-
-  Many mail programs and web archivers use information within mails to keep
-  them together as "threads", as collections of posts that discuss a certain
-  subject. If you do not intend to reply on the same or similar subject, do not
-  just hit reply on an existing mail and change the subject, create a new mail.
-
-  2.2 Reply to the List
-
-  When replying to a message from the list, make sure that you do "group
-  reply" or "reply to all", and not just reply to the author of the single
-  mail you reply to.
-
-  We are actively discouraging replying back to the single person by setting
-  the Reply-To: field in outgoing mails back to the mailing list address,
-  making it harder for people to mail the author directly, if only by mistake.
-
-  2.3 Use a Sensible Subject
-
-  Please use a subject of the mail that makes sense and that is related to the
-  contents of your mail. It makes it a lot easier to find your mail afterwards
-  and it makes it easier to track mail threads and topics.
-
-  2.4 Do Not Top-Post
-
-  If you reply to a message, do not use top-posting. Top-posting is when you
-  write the new text at the top of a mail and you insert the previous quoted
-  mail conversation below. It forces users to read the mail in a backwards
-  order to properly understand it.
-
-  This is why top posting is so bad (in top posting order):
-
-      A: Because it messes up the order in which people normally read text.
-      Q: Why is top-posting such a bad thing?
-      A: Top-posting.
-      Q: What is the most annoying thing in email?
-
-  Apart from the screwed up read order (especially when mixed together in a
-  thread when someone responds using the mandated bottom-posting style), it
-  also makes it impossible to quote only parts of the original mail.
-
-  When you reply to a mail. You let the mail client insert the previous mail
-  quoted. Then you put the cursor on the first line of the mail and you move
-  down through the mail, deleting all parts of the quotes that do not add
-  context for your comments. When you want to add a comment you do so, inline,
-  right after the quotes that relate to your comment. Then you continue
-  downwards again.
-
-  When most of the quotes have been removed and you have added your own words,
-  you are done.
-
-  2.5 HTML is not for mails
-
-  Please switch off those HTML encoded messages. You can mail all those funny
-  mails to your friends. We speak plain text mails.
-
-  2.6 Quoting
-
-  Quote as little as possible. Just enough to provide the context you cannot
-  leave out. A lengthy description can be found here:
-
-      https://www.netmeister.org/news/learn2quote.html
-
-  2.7 Digest
-
-  We allow subscribers to subscribe to the "digest" version of the mailing
-  lists. A digest is a collection of mails lumped together in one single mail.
-
-  Should you decide to reply to a mail sent out as a digest, there are two
-  things you MUST consider if you really really cannot subscribe normally
-  instead:
-
-  Cut off all mails and chatter that is not related to the mail you want to
-  reply to.
-
-  Change the subject name to something sensible and related to the subject,
-  preferably even the actual subject of the single mail you wanted to reply to
-
-  2.8 Please Tell Us How You Solved The Problem
-
-  Many people mail questions to the list, people spend some of their time and
-  make an effort in providing good answers to these questions.
-
-  If you are the one who asks, please consider responding once more in case
-  one of the hints was what solved your problems. The guys who write answers
-  feel good to know that they provided a good answer and that you fixed the
-  problem. Far too often, the person who asked the question is never heard from
-  again, and we never get to know if they are gone because the problem was
-  solved or perhaps because the problem was unsolvable.
-
-  Getting the solution posted also helps other users that experience the same
-  problem(s). They get to see (possibly in the web archives) that the
-  suggested fixes actually have helped at least one person.
diff --git a/third-party/curl/docs/MAIL-ETIQUETTE.md b/third-party/curl/docs/MAIL-ETIQUETTE.md
new file mode 100644
index 0000000000..9c2527d04d
--- /dev/null
+++ b/third-party/curl/docs/MAIL-ETIQUETTE.md
@@ -0,0 +1,257 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# Mail etiquette
+
+## About the lists
+
+### Mailing Lists
+
+The mailing lists we have are all listed and described on the [curl
+website](https://curl.se/mail/).
+
+Each mailing list is targeted to a specific set of users and subjects, please
+use the one or the ones that suit you the most.
+
+Each mailing list has hundreds up to thousands of readers, meaning that each
+mail sent is received and read by a large number of people. People from
+various cultures, regions, religions and continents.
+
+### Netiquette
+
+Netiquette is a common term for how to behave on the Internet. Of course, in
+each particular group and subculture there are differences in what is
+acceptable and what is considered good manners.
+
+This document outlines what we in the curl project consider to be good
+etiquette, and primarily this focus on how to behave on and how to use our
+mailing lists.
+
+### Do Not Mail a Single Individual
+
+Many people send one question to one person. One person gets many mails, and
+there is only one person who can give you a reply. The question may be
+something that other people would also like to ask. These other people have no
+way to read the reply, but to ask the one person the question. The one person
+consequently gets overloaded with mail.
+
+If you really want to contact an individual and perhaps pay for his or her
+services, by all means go ahead, but if it is another curl question, take it
+to a suitable list instead.
+
+### Subscription Required
+
+All curl mailing lists require that you are subscribed to allow a mail to go
+through to all the subscribers.
+
+If you post without being subscribed (or from a different mail address than
+the one you are subscribed with), your mail is silently discarded. You
+have to subscribe first, then post.
+
+The reason for this unfortunate and strict subscription policy is of course to
+stop spam from pestering the lists.
+
+### Moderation of new posters
+
+Several of the curl mailing lists automatically make all posts from new
+subscribers be moderated. After you have subscribed and sent your first mail
+to a list, that mail is not let through to the list until a mailing list
+administrator has verified that it is OK and permits it to get posted.
+
+Once a first post has been made that proves the sender is actually talking
+about curl-related subjects, the moderation "flag" is switched off and future
+posts go through without being moderated.
+
+The reason for this moderation policy is that we do suffer from spammers who
+actually subscribe and send spam to our lists.
+
+### Handling trolls and spam
+
+Despite our good intentions and hard work to keep spam off the lists and to
+maintain a friendly and positive atmosphere, there are times when spam and or
+trolls get through.
+
+Troll - "someone who posts inflammatory, extraneous, or off-topic messages in
+an online community"
+
+Spam - "use of electronic messaging systems to send unsolicited bulk messages"
+
+No matter what, we NEVER EVER respond to trolls or spammers on the list. If
+you believe the list admin should do something in particular, contact them
+off-list. The subject is taken care of as much as possible to prevent repeated
+offenses, but responding on the list to such messages never leads to anything
+good and only puts the light even more on the offender: which was the entire
+purpose of it getting sent to the list in the first place.
+
+Do not feed the trolls.
+
+### How to unsubscribe
+
+You can unsubscribe the same way you subscribed in the first place. You go to
+the page for the particular mailing list you are subscribed to and you enter
+your email address and password and press the unsubscribe button.
+
+Also, the instructions to unsubscribe are included in the headers of every
+mail that is sent out to all curl related mailing lists and there is a footer
+in each mail that links to the "admin" page on which you can unsubscribe and
+change other options.
+
+You NEVER EVER email the mailing list requesting someone else to take you off
+the list.
+
+### I posted, now what?
+
+If you are not subscribed with the same email address that you used to send
+the email, your post is silently discarded.
+
+If you posted for the first time to the mailing list, you first need to wait
+for an administrator to allow your email to go through (moderated). This
+normally happens quickly but in case we are asleep, you may have to wait a few
+hours.
+
+Once your email goes through it is sent out to several hundred or even
+thousands of recipients. Your email may cover an area that not that many
+people know about or are interested in. Or possibly the person who knows about
+it is on vacation or under a heavy work load right now. You may have to wait
+for a response and you should not expect to get a response at all. Ideally,
+you get an answer within a couple of days.
+
+You do yourself and all of us a service when you include as many details as
+possible already in your first email. Mention your operating system and
+environment. Tell us which curl version you are using and tell us what you
+did, what happened and what you expected would happen. Preferably, show us
+what you did with details enough to allow others to help point out the problem
+or repeat the steps in their locations.
+
+Failing to include details only delays responses and make people respond and
+ask for more details and you have to send follow-up emails that include them.
+
+Expect the responses to primarily help YOU debug the issue, or ask YOU
+questions that can lead you or others towards a solution or explanation to
+whatever you experience.
+
+If you are a repeat offender to the guidelines outlined in this document,
+chances are that people ignore you and your chances to get responses in the
+future greatly diminish.
+
+### Your emails are public
+
+Your email, its contents and all its headers and the details in those headers
+are received by every subscriber of the mailing list that you send your email
+to.
+
+Your email as sent to a curl mailing list ends up in mail archives, on the
+curl website and elsewhere, for others to see and read. Today and in the
+future. In addition to the archives, the mail is sent out to thousands of
+individuals. There is no way to undo a sent email.
+
+When sending emails to a curl mailing list, do not include sensitive
+information such as usernames and passwords; use fake ones, temporary ones or
+remove them completely from the mail. Note that this includes base64 encoded
+HTTP Basic auth headers.
+
+This public nature of the curl mailing lists makes automatically inserted mail
+footers about mails being "private" or "only meant for the recipient" or
+similar even more silly than usual. Because they are absolutely not private
+when sent to a public mailing list.
+
+## Sending mail
+
+### Reply or New Mail
+
+Please do not reply to an existing message as a short-cut to post a message to
+the lists.
+
+Many mail programs and web archivers use information within mails to keep them
+together as "threads", as collections of posts that discuss a certain subject.
+If you do not intend to reply on the same or similar subject, do not hit reply
+on an existing mail and change the subject, create a new mail.
+
+### Reply to the List
+
+When replying to a message from the list, make sure that you do "group reply"
+or "reply to all", and not reply to the author of the single mail you reply
+to.
+
+We are actively discouraging replying to the single person by setting the
+correct field in outgoing mails back asking for replies to get sent to the
+mailing list address, making it harder for people to reply to the author only
+by mistake.
+
+### Use a Sensible Subject
+
+Please use a subject of the mail that makes sense and that is related to the
+contents of your mail. It makes it a lot easier to find your mail afterwards
+and it makes it easier to track mail threads and topics.
+
+### Do Not Top-Post
+
+If you reply to a message, do not use top-posting. Top-posting is when you
+write the new text at the top of a mail and you insert the previous quoted
+mail conversation below. It forces users to read the mail in a backwards order
+to properly understand it.
+
+This is why top posting is so bad (in top posting order):
+
+    A: Because it messes up the order in which people normally read text.
+    Q: Why is top-posting such a bad thing?
+    A: Top-posting.
+    Q: What is the most annoying thing in email?
+
+Apart from the screwed up read order (especially when mixed together in a
+thread when someone responds using the mandated bottom-posting style), it also
+makes it impossible to quote only parts of the original mail.
+
+When you reply to a mail. You let the mail client insert the previous mail
+quoted. Then you put the cursor on the first line of the mail and you move
+down through the mail, deleting all parts of the quotes that do not add
+context for your comments. When you want to add a comment you do so, inline,
+right after the quotes that relate to your comment. Then you continue
+downwards again.
+
+When most of the quotes have been removed and you have added your own words,
+you are done.
+
+### HTML is not for mails
+
+Please switch off those HTML encoded messages. You can mail all those funny
+mails to your friends. We speak plain text mails.
+
+### Quoting
+
+Quote as little as possible. Enough to provide the context you cannot leave
+out.
+
+### Digest
+
+We allow subscribers to subscribe to the "digest" version of the mailing
+lists. A digest is a collection of mails lumped together in one single mail.
+
+Should you decide to reply to a mail sent out as a digest, there are two
+things you MUST consider if you really, really cannot subscribe normally
+instead:
+
+Cut off all mails and chatter that is not related to the mail you want to
+reply to.
+
+Change the subject name to something sensible and related to the subject,
+preferably even the actual subject of the single mail you wanted to reply to
+
+### Please Tell Us How You Solved The Problem
+
+Many people mail questions to the list, people spend some of their time and
+make an effort in providing good answers to these questions.
+
+If you are the one who asks, please consider responding once more in case one
+of the hints was what solved your problems. The guys who write answers feel
+good to know that they provided a good answer and that you fixed the problem.
+Far too often, the person who asked the question is never heard from again,
+and we never get to know if they are gone because the problem was solved or
+perhaps because the problem was unsolvable.
+
+Getting the solution posted also helps other users that experience the same
+problem(s). They get to see (possibly in the web archives) that the suggested
+fixes actually have helped at least one person.
diff --git a/third-party/curl/docs/MANUAL.md b/third-party/curl/docs/MANUAL.md
index 9c1b291f05..fb62f64ba2 100644
--- a/third-party/curl/docs/MANUAL.md
+++ b/third-party/curl/docs/MANUAL.md
@@ -1,3 +1,9 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # curl tutorial
 
 ## Simple Usage
@@ -8,35 +14,35 @@ Get the main page from a web-server:
 
 Get a README file from an FTP server:
 
-    curl ftp://ftp.funet.fi/README
+    curl ftp://ftp.example.com/README
 
-Get a web page from a server using port 8000:
+Get a webpage from a server using port 8000:
 
-    curl http://www.weirdserver.com:8000/
+    curl http://www.example.com:8000/
 
 Get a directory listing of an FTP site:
 
-    curl ftp://ftp.funet.fi
+    curl ftp://ftp.example.com/
 
 Get the all terms matching curl from a dictionary:
 
-    curl dict://dict.org/m:curl
+    curl dict://dict.example.com/m:curl
 
 Get the definition of curl from a dictionary:
 
-    curl dict://dict.org/d:curl
+    curl dict://dict.example.com/d:curl
 
 Fetch two documents at once:
 
-    curl ftp://ftp.funet.fi/ http://www.weirdserver.com:8000/
+    curl ftp://ftp.example.com/ https://www.example.com:8000/
 
 Get a file off an FTPS server:
 
-    curl ftps://files.are.secure.com/secrets.txt
+    curl ftps://files.are.example.com/secrets.txt
 
 or use the more appropriate FTPS way to get the same file:
 
-    curl --ftp-ssl ftp://files.are.secure.com/secrets.txt
+    curl --ssl-reqd ftp://files.are.example.com/secrets.txt
 
 Get a file from an SSH server using SFTP:
 
@@ -63,15 +69,14 @@ Get a file from an SMB server:
 
 ## Download to a File
 
-Get a web page and store in a local file with a specific name:
+Get a webpage and store in a local file with a specific name:
 
-    curl -o thatpage.html http://www.example.com/
+    curl -o thatpage.html https://www.example.com/
 
-Get a web page and store in a local file, make the local file get the name of
-the remote document (if no file name part is specified in the URL, this will
-fail):
+Get a webpage and store in a local file, make the local file get the name of
+the remote document (if no filename part is specified in the URL, this fails):
 
-    curl -O http://www.example.com/index.html
+    curl -O https://www.example.com/index.html
 
 Fetch two files and store them with their remote names:
 
@@ -83,19 +88,19 @@ Fetch two files and store them with their remote names:
 
 To ftp files using name and password, include them in the URL like:
 
-    curl ftp://name:passwd@machine.domain:port/full/path/to/file
+    curl ftp://name:passwd@ftp.server.example:port/full/path/to/file
 
 or specify them with the `-u` flag like
 
-    curl -u name:passwd ftp://machine.domain:port/full/path/to/file
+    curl -u name:passwd ftp://ftp.server.example:port/full/path/to/file
 
 ### FTPS
 
-It is just like for FTP, but you may also want to specify and use SSL-specific
-options for certificates etc.
+It is like FTP, but you may also want to specify and use SSL-specific options
+for certificates etc.
 
-Note that using `FTPS://` as prefix is the *implicit* way as described in the
-standards while the recommended *explicit* way is done by using `FTP://` and
+Note that using `ftps://` as prefix is the *implicit* way as described in the
+standards while the recommended *explicit* way is done by using `ftp://` and
 the `--ssl-reqd` option.
 
 ### SFTP / SCP
@@ -104,20 +109,20 @@ This is similar to FTP, but you can use the `--key` option to specify a
 private key to use instead of a password. Note that the private key may itself
 be protected by a password that is unrelated to the login password of the
 remote system; this password is specified using the `--pass` option.
-Typically, curl will automatically extract the public key from the private key
+Typically, curl automatically extracts the public key from the private key
 file, but in cases where curl does not have the proper library support, a
 matching public key file must be specified using the `--pubkey` option.
 
 ### HTTP
 
-Curl also supports user and password in HTTP URLs, thus you can pick a file
+curl also supports user and password in HTTP(S) URLs. You can download a file
 like:
 
-    curl http://name:passwd@machine.domain/full/path/to/file
+    curl https://name:passwd@http.server.example/full/path/to/file
 
 or specify user and password separately like in
 
-    curl -u name:passwd http://machine.domain/full/path/to/file
+    curl -u name:passwd https://http.server.example/full/path/to/file
 
 HTTP offers many different methods of authentication and curl supports
 several: Basic, Digest, NTLM and Negotiate (SPNEGO). Without telling which
@@ -126,7 +131,7 @@ secure ones out of the ones that the server accepts for the given URL, by
 using `--anyauth`.
 
 **Note**! According to the URL specification, HTTP URLs can not contain a user
-and password, so that style will not work when using curl via a proxy, even
+and password, so that style does not work when using curl via a proxy, even
 though curl allows it at other times. When using a proxy, you _must_ use the
 `-u` style for user and password.
 
@@ -144,28 +149,28 @@ servers.
 
 Get an ftp file using an HTTP proxy named my-proxy that uses port 888:
 
-    curl -x my-proxy:888 ftp://ftp.leachsite.com/README
+    curl -x my-proxy:888 ftp://ftp.example.com/README
 
-Get a file from an HTTP server that requires user and password, using the
+Get a file from an HTTPS server that requires user and password, using the
 same proxy as above:
 
-    curl -u user:passwd -x my-proxy:888 http://www.get.this/
+    curl -u user:passwd -x my-proxy:888 https://www.example.com/
 
 Some proxies require special authentication. Specify by using -U as above:
 
-    curl -U user:passwd -x my-proxy:888 http://www.get.this/
+    curl -U user:passwd -x my-proxy:888 https://www.example.com/
 
 A comma-separated list of hosts and domains which do not use the proxy can be
 specified as:
 
-    curl --noproxy localhost,get.this -x my-proxy:888 http://www.get.this/
+    curl --noproxy example.com -x my-proxy:888 https://www.example.com/
 
 If the proxy is specified with `--proxy1.0` instead of `--proxy` or `-x`, then
-curl will use HTTP/1.0 instead of HTTP/1.1 for any `CONNECT` attempts.
+curl uses HTTP/1.0 instead of HTTP/1.1 for any `CONNECT` attempts.
 
 curl also supports SOCKS4 and SOCKS5 proxies with `--socks4` and `--socks5`.
 
-See also the environment variables Curl supports that offer further proxy
+See also the environment variables curl supports that offer further proxy
 control.
 
 Most FTP proxy servers are set up to appear as a normal FTP server from the
@@ -174,43 +179,43 @@ curl supports the `-u`, `-Q` and `--ftp-account` options that can be used to
 set up transfers through many FTP proxies. For example, a file can be uploaded
 to a remote FTP server using a Blue Coat FTP proxy with the options:
 
-    curl -u "username@ftp.server Proxy-Username:Remote-Pass"
+    curl -u "username@ftp.server.example Proxy-Username:Remote-Pass"
       --ftp-account Proxy-Password --upload-file local-file
-      ftp://my-ftp.proxy.server:21/remote/upload/path/
+      ftp://my-ftp.proxy.example:21/remote/upload/path/
 
 See the manual for your FTP proxy to determine the form it expects to set up
 transfers, and curl's `-v` option to see exactly what curl is sending.
 
 ## Piping
 
-Get a key file and add it with `apt-key` (when on a system that uses `apt` for
-package management):
+Get a key file and install it as a trusted one (when on a system that uses
+`apt` for package management):
 
-    curl -L https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add -
+    curl -L https://apt.example.org/llvm-snapshot.gpg.key | sudo tee
+      /etc/apt/trusted.gpg.d/llvm-snapshot.asc >/dev/null
 
-The '|' pipes the output to STDIN. `-` tells `apt-key` that the key file
-should be read from STDIN.
+The '|' pipes the output to stdin. `tee` reads from stdin.
 
 ## Ranges
 
 HTTP 1.1 introduced byte-ranges. Using this, a client can request to get only
-one or more sub-parts of a specified document. Curl supports this with the
+one or more sub-parts of a specified document. curl supports this with the
 `-r` flag.
 
 Get the first 100 bytes of a document:
 
-    curl -r 0-99 http://www.get.this/
+    curl -r 0-99 https://www.example.com/
 
 Get the last 500 bytes of a document:
 
-    curl -r -500 http://www.get.this/
+    curl -r -500 https://www.example.com/
 
-Curl also supports simple ranges for FTP files as well. Then you can only
+curl also supports simple ranges for FTP files as well. Then you can only
 specify start and stop position.
 
 Get the first 100 bytes of a document using FTP:
 
-    curl -r 0-99 ftp://www.get.this/README
+    curl -r 0-99 ftp://www.example.com/README
 
 ## Uploading
 
@@ -218,26 +223,26 @@ Get the first 100 bytes of a document using FTP:
 
 Upload all data on stdin to a specified server:
 
-    curl -T - ftp://ftp.upload.com/myfile
+    curl -T - ftp://ftp.example.com/myfile
 
 Upload data from a specified file, login with user and password:
 
-    curl -T uploadfile -u user:passwd ftp://ftp.upload.com/myfile
+    curl -T uploadfile -u user:passwd ftp://ftp.example.com/myfile
 
-Upload a local file to the remote site, and use the local file name at the
+Upload a local file to the remote site, and use the local filename at the
 remote site too:
 
-    curl -T uploadfile -u user:passwd ftp://ftp.upload.com/
+    curl -T uploadfile -u user:passwd ftp://ftp.example.com/
 
 Upload a local file to get appended to the remote file:
 
-    curl -T localfile -a ftp://ftp.upload.com/remotefile
+    curl -T localfile -a ftp://ftp.example.com/remotefile
 
-Curl also supports ftp upload through a proxy, but only if the proxy is
+curl also supports ftp upload through a proxy, but only if the proxy is
 configured to allow that kind of tunneling. If it does, you can run curl in a
 fashion similar to:
 
-    curl --proxytunnel -x proxy:port -T localfile ftp.upload.com
+    curl --proxytunnel -x proxy:port -T localfile ftp.example.com
 
 ### SMB / SMBS
 
@@ -246,9 +251,9 @@ fashion similar to:
 
 ### HTTP
 
-Upload all data on stdin to a specified HTTP site:
+Upload all data on stdin to a specified HTTPS site:
 
-    curl -T - http://www.upload.com/myfile
+    curl -T - https://www.example.com/myfile
 
 Note that the HTTP server must have been configured to accept PUT before this
 can be done successfully.
@@ -257,20 +262,19 @@ For other ways to do HTTP data upload, see the POST section below.
 
 ## Verbose / Debug
 
-If curl fails where it is not supposed to, if the servers do not let you in, if
-you cannot understand the responses: use the `-v` flag to get verbose
-fetching. Curl will output lots of info and what it sends and receives in
-order to let the user see all client-server interaction (but it will not show you
-the actual data).
+If curl fails where it is not supposed to, if the servers do not let you in,
+if you cannot understand the responses: use the `-v` flag to get verbose
+fetching. curl outputs lots of info and what it sends and receives in order to
+let the user see all client-server interaction (but it does not show you the
+actual data).
 
-    curl -v ftp://ftp.upload.com/
+    curl -v ftp://ftp.example.com/
 
 To get even more details and information on what curl does, try using the
-`--trace` or `--trace-ascii` options with a given file name to log to, like
+`--trace` or `--trace-ascii` options with a given filename to log to, like
 this:
 
-    curl --trace trace.txt www.haxx.se
-
+    curl --trace my-trace.txt www.haxx.se
 
 ## Detailed Information
 
@@ -281,9 +285,9 @@ info on a single file for HTTP and FTP. The HTTP information is a lot more
 extensive.
 
 For HTTP, you can get the header information (the same as `-I` would show)
-shown before the data by using `-i`/`--include`. Curl understands the
+shown before the data by using `-i`/`--include`. curl understands the
 `-D`/`--dump-header` option when getting files from both FTP and HTTP, and it
-will then store the headers in the specified file.
+then stores the headers in the specified file.
 
 Store the HTTP headers in a separate file (headers.txt in the example):
 
@@ -300,11 +304,12 @@ The post data must be urlencoded.
 
 Post a simple `name` and `phone` guestbook.
 
-    curl -d "name=Rafael%20Sagula&phone=3320780" http://www.where.com/guest.cgi
+    curl -d "name=Rafael%20Sagula&phone=3320780" https://www.example.com/guest.cgi
 
 Or automatically [URL encode the data](https://everything.curl.dev/http/post/url-encode).
 
-    curl --data-urlencode "name=Rafael Sagula&phone=3320780" http://www.where.com/guest.cgi
+    curl --data-urlencode "name=Rafael Sagula&phone=3320780"
+      https://www.example.com/guest.cgi
 
 How to post a form with curl, lesson #1:
 
@@ -323,23 +328,23 @@ of the letter's ASCII code.
 
 Example:
 
-(page located at `http://www.formpost.com/getthis/`)
+(say if `https://example.com` had the following html)
 
 ```html
 <form action="post.cgi" method="post">
-<input name=user size=10>
-<input name=pass type=password size=10>
-<input name=id type=hidden value="blablabla">
-<input name=ding value="submit">
+  <input name=user size=10>
+  <input name=pass type=password size=10>
+  <input name=id type=hidden value="blablabla">
+  <input name=ding value="submit">
 </form>
 ```
 
 We want to enter user `foobar` with password `12345`.
 
-To post to this, you enter a curl command line like:
+To post to this, you would enter a curl command line like:
 
     curl -d "user=foobar&pass=12345&id=blablabla&ding=submit"
-      http://www.formpost.com/getthis/post.cgi
+      https://example.com/post.cgi
 
 While `-d` uses the application/x-www-form-urlencoded mime-type, generally
 understood by CGI's and similar, curl also supports the more capable
@@ -348,20 +353,20 @@ multipart/form-data type. This latter type supports things like file upload.
 `-F` accepts parameters like `-F "name=contents"`. If you want the contents to
 be read from a file, use `@filename` as contents. When specifying a file, you
 can also specify the file content type by appending `;type=<mime type>` to the
-file name. You can also post the contents of several files in one field.  For
+filename. You can also post the contents of several files in one field.  For
 example, the field name `coolfiles` is used to send three files, with
 different content types using the following syntax:
 
     curl -F "coolfiles=@fil1.gif;type=image/gif,fil2.txt,fil3.html"
-      http://www.post.com/postit.cgi
+      https://www.example.com/postit.cgi
 
-If the content-type is not specified, curl will try to guess from the file
+If the content-type is not specified, curl tries to guess from the file
 extension (it only knows a few), or use the previously specified type (from an
-earlier file if several files are specified in a list) or else it will use the
+earlier file if several files are specified in a list) or else it uses the
 default type `application/octet-stream`.
 
 Emulate a fill-in form with `-F`. Let's say you fill in three fields in a
-form. One field is a file name which to post, one field is your name and one
+form. One field is a filename which to post, one field is your name and one
 field is a file description. We want to post the file we have written named
 `cooltext.txt`. To let curl do the posting of this data instead of your
 favorite browser, you have to read the HTML source of the form page and find
@@ -370,7 +375,7 @@ the names of the input fields. In our example, the input field names are
 
     curl -F "file=@cooltext.txt" -F "yourname=Daniel"
       -F "filedescription=Cool text file with cool text inside"
-      http://www.post.com/postit.cgi
+      https://www.example.com/postit.cgi
 
 To send two files in one post you can do it in two ways:
 
@@ -396,18 +401,18 @@ used on the command line. It is especially useful to fool or trick stupid
 servers or CGI scripts that rely on that information being available or
 contain certain data.
 
-    curl -e www.coolsite.com http://www.showme.com/
+    curl -e www.example.org https://www.example.com/
 
 ## User Agent
 
 An HTTP request has the option to include information about the browser that
-generated the request. Curl allows it to be specified on the command line. It
+generated the request. curl allows it to be specified on the command line. It
 is especially useful to fool or trick stupid servers or CGI scripts that only
 accept certain browsers.
 
 Example:
 
-    curl -A 'Mozilla/3.0 (Win95; I)' http://www.nationsbank.com/
+    curl -A 'Mozilla/3.0 (Win95; I)' https://www.bank.example.com/
 
 Other common strings:
 
@@ -448,9 +453,9 @@ path beginning with `/foo`.
 
 Example, get a page that wants my name passed in a cookie:
 
-    curl -b "name=Daniel" www.sillypage.com
+    curl -b "name=Daniel" www.example.com
 
-Curl also has the ability to use previously received cookies in following
+curl also has the ability to use previously received cookies in following
 sessions. If you get cookies from a server and store them in a file in a
 manner similar to:
 
@@ -476,11 +481,11 @@ non-existing file to trigger the cookie awareness like:
     curl -L -b empty.txt www.example.com
 
 The file to read cookies from must be formatted using plain HTTP headers OR as
-Netscape's cookie file. Curl will determine what kind it is based on the file
-contents. In the above command, curl will parse the header and store the
-cookies received from www.example.com. curl will send to the server the stored
-cookies which match the request as it follows the location. The file
-`empty.txt` may be a nonexistent file.
+Netscape's cookie file. curl determines what kind it is based on the file
+contents. In the above command, curl parses the header and store the cookies
+received from www.example.com. curl sends the stored cookies which match the
+request to the server as it follows the location. The file `empty.txt` may be
+a nonexistent file.
 
 To read and write cookies from a Netscape cookie file, you can set both `-b`
 and `-c` to use the same file:
@@ -498,26 +503,26 @@ happening. The different fields in the output have the following meaning:
 
 From left-to-right:
 
- - `%`           - percentage completed of the whole transfer
- - `Total`       - total size of the whole expected transfer
- - `%`           - percentage completed of the download
- - `Received`    - currently downloaded amount of bytes
- - `%`           - percentage completed of the upload
- - `Xferd`       - currently uploaded amount of bytes
- - `Average Speed Dload` - the average transfer speed of the download
- - `Average Speed Upload` - the average transfer speed of the upload
- - `Time Total`  - expected time to complete the operation
- - `Time Current` - time passed since the invoke
- - `Time Left`   - expected time left to completion
- - `Curr.Speed`  - the average transfer speed the last 5 seconds (the first
+- `%`            - percentage completed of the whole transfer
+- `Total`        - total size of the whole expected transfer
+- `%`            - percentage completed of the download
+- `Received`     - currently downloaded amount of bytes
+- `%`            - percentage completed of the upload
+- `Xferd`        - currently uploaded amount of bytes
+- `Average Speed Dload` - the average transfer speed of the download
+- `Average Speed Upload` - the average transfer speed of the upload
+- `Time Total`   - expected time to complete the operation
+- `Time Current` - time passed since the invoke
+- `Time Left`    - expected time left to completion
+- `Curr.Speed`   - the average transfer speed the last 5 seconds (the first
                    5 seconds of a transfer is based on less time of course.)
 
-The `-#` option will display a totally different progress bar that does not
-need much explanation!
+The `-#` option displays a totally different progress bar that does not need
+much explanation!
 
 ## Speed Limit
 
-Curl allows the user to set the transfer speed conditions that must be met to
+curl allows the user to set the transfer speed conditions that must be met to
 let the transfer keep going. By using the switch `-y` and `-Y` you can make
 curl abort transfers if the transfer speed is below the specified lowest limit
 for a specified time.
@@ -525,12 +530,12 @@ for a specified time.
 To have curl abort the download if the speed is slower than 3000 bytes per
 second for 1 minute, run:
 
-    curl -Y 3000 -y 60 www.far-away-site.com
+    curl -Y 3000 -y 60 www.far-away.example.com
 
 This can be used in combination with the overall time limit, so that the above
 operation must be completed in whole within 30 minutes:
 
-    curl -m 1800 -Y 3000 -y 60 www.far-away-site.com
+    curl -m 1800 -Y 3000 -y 60 www.far-away.example.com
 
 Forcing curl not to transfer data faster than a given rate is also possible,
 which might be useful if you are using a limited bandwidth connection and you
@@ -539,25 +544,25 @@ do not want your transfer to use all of it (sometimes referred to as
 
 Make curl transfer data no faster than 10 kilobytes per second:
 
-    curl --limit-rate 10K www.far-away-site.com
+    curl --limit-rate 10K www.far-away.example.com
 
 or
 
-    curl --limit-rate 10240 www.far-away-site.com
+    curl --limit-rate 10240 www.far-away.example.com
 
 Or prevent curl from uploading data faster than 1 megabyte per second:
 
-    curl -T upload --limit-rate 1M ftp://uploadshereplease.com
+    curl -T upload --limit-rate 1M ftp://uploads.example.com
 
 When using the `--limit-rate` option, the transfer rate is regulated on a
-per-second basis, which will cause the total transfer speed to become lower
-than the given number. Sometimes of course substantially lower, if your
-transfer stalls during periods.
+per-second basis, which causes the total transfer speed to become lower than
+the given number. Sometimes of course substantially lower, if your transfer
+stalls during periods.
 
 ## Config File
 
-Curl automatically tries to read the `.curlrc` file (or `_curlrc` file on
-Microsoft Windows systems) from the user's home dir on startup.
+curl automatically tries to read the `.curlrc` file (or `_curlrc` file on
+Microsoft Windows systems) from the user's home directory on startup.
 
 The config file could be made up with normal command line switches, but you
 can also specify the long options without the dashes to make it more
@@ -576,7 +581,7 @@ Example, set default time out and proxy in a config file:
     # We want a 30 minute timeout:
     -m 1800
     # ... and we use a proxy for all accesses:
-    proxy = proxy.our.domain.com:8080
+    proxy = proxy.our.domain.example.com:8080
 
 Whitespaces ARE significant at the end of lines, but all whitespace leading
 up to the first characters of each line are ignored.
@@ -584,31 +589,31 @@ up to the first characters of each line are ignored.
 Prevent curl from reading the default file by using -q as the first command
 line parameter, like:
 
-    curl -q www.thatsite.com
+    curl -q www.example.org
 
 Force curl to get and display a local help page in case it is invoked without
 URL by making a config file similar to:
 
-    # default url to get
-    url = "http://help.with.curl.com/curlhelp.html"
+    # default URL to get
+    url = "https://help.with.curl.example.com/curlhelp.html"
 
 You can specify another config file to be read by using the `-K`/`--config`
-flag. If you set config file name to `-` it will read the config from stdin,
-which can be handy if you want to hide options from being visible in process
-tables etc:
+flag. If you set config filename to `-` it reads the config from stdin, which
+can be handy if you want to hide options from being visible in process tables
+etc:
 
-    echo "user = user:passwd" | curl -K - http://that.secret.site.com
+    echo "user = user:passwd" | curl -K - https://that.secret.example.com
 
 ## Extra Headers
 
 When using curl in your own programs, you may end up needing to pass on your
-own custom headers when getting a web page. You can do this by using the `-H`
+own custom headers when getting a webpage. You can do this by using the `-H`
 flag.
 
 Example, send the header `X-you-and-me: yes` to the server when getting a
 page:
 
-    curl -H "X-you-and-me: yes" www.love.com
+    curl -H "X-you-and-me: yes" love.example.com
 
 This can also be useful in case you want curl to send a different text in a
 header than it normally does. The `-H` header you specify then replaces the
@@ -616,7 +621,7 @@ header curl would normally send. If you replace an internal header with an
 empty one, you prevent that header from being sent. To prevent the `Host:`
 header from being used:
 
-    curl -H "Host:" www.server.com
+    curl -H "Host:" server.example.com
 
 ## FTP and Path Names
 
@@ -624,14 +629,14 @@ Do note that when getting files with a `ftp://` URL, the given path is
 relative to the directory you enter. To get the file `README` from your home
 directory at your ftp site, do:
 
-    curl ftp://user:passwd@my.site.com/README
+    curl ftp://user:passwd@my.example.com/README
 
 If you want the README file from the root directory of that same site, you
-need to specify the absolute file name:
+need to specify the absolute filename:
 
-    curl ftp://user:passwd@my.site.com//README
+    curl ftp://user:passwd@my.example.com//README
 
-(I.e with an extra slash in front of the file name.)
+(I.e with an extra slash in front of the filename.)
 
 ## SFTP and SCP and Path Names
 
@@ -652,10 +657,10 @@ to open another port and await another connection performed by the
 client. This is good if the client is behind a firewall that does not allow
 incoming connections.
 
-    curl ftp.download.com
+    curl ftp.example.com
 
 If the server, for example, is behind a firewall that does not allow
-connections on ports other than 21 (or if it just does not support the `PASV`
+connections on ports other than 21 (or if it does not support the `PASV`
 command), the other way to do it is to use the `PORT` command and instruct the
 server to connect to the client on the given IP number and port (as parameters
 to the PORT command).
@@ -664,26 +669,26 @@ The `-P` flag to curl supports a few different options. Your machine may have
 several IP-addresses and/or network interfaces and curl allows you to select
 which of them to use. Default address can also be used:
 
-    curl -P - ftp.download.com
+    curl -P - ftp.example.com
 
 Download with `PORT` but use the IP address of our `le0` interface (this does
 not work on Windows):
 
-    curl -P le0 ftp.download.com
+    curl -P le0 ftp.example.com
 
 Download with `PORT` but use 192.168.0.10 as our IP address to use:
 
-    curl -P 192.168.0.10 ftp.download.com
+    curl -P 192.168.0.10 ftp.example.com
 
 ## Network Interface
 
-Get a web page from a server using a specified port for the interface:
+Get a webpage from a server using a specified port for the interface:
 
-    curl --interface eth0:1 http://www.example.com/
+    curl --interface eth0:1 https://www.example.com/
 
 or
 
-    curl --interface 192.168.1.10 http://www.example.com/
+    curl --interface 192.168.1.10 https://www.example.com/
 
 ## HTTPS
 
@@ -693,7 +698,7 @@ using the HTTPS protocol.
 
 Example:
 
-    curl https://www.secure-site.com
+    curl https://secure.example.com
 
 curl is also capable of using client certificates to get/post files from sites
 that require valid certificates. The only drawback is that the certificate
@@ -706,18 +711,18 @@ formatted certificates to PEM formatted ones.
 Example on how to automatically retrieve a document using a certificate with a
 personal password:
 
-    curl -E /path/to/cert.pem:password https://secure.site.com/
+    curl -E /path/to/cert.pem:password https://secure.example.com/
 
-If you neglect to specify the password on the command line, you will be
-prompted for the correct password before any data can be received.
+If you neglect to specify the password on the command line, you are prompted
+for the correct password before any data can be received.
 
 Many older HTTPS servers have problems with specific SSL or TLS versions,
 which newer versions of OpenSSL etc use, therefore it is sometimes useful to
 specify what TLS version curl should use.:
 
-    curl --tlv1.0 https://secure.site.com/
+    curl --tlv1.0 https://secure.example.com/
 
-Otherwise, curl will attempt to use a sensible TLS default version.
+Otherwise, curl attempts to use a sensible TLS default version.
 
 ## Resuming File Transfers
 
@@ -726,15 +731,15 @@ resume on HTTP(S) downloads as well as FTP uploads and downloads.
 
 Continue downloading a document:
 
-    curl -C - -o file ftp://ftp.server.com/path/file
+    curl -C - -o file ftp://ftp.example.com/path/file
 
 Continue uploading a document:
 
-    curl -C - -T file ftp://ftp.server.com/path/file
+    curl -C - -T file ftp://ftp.example.com/path/file
 
 Continue downloading a document from a web server
 
-    curl -C - -o file http://www.server.com/
+    curl -C - -o file https://www.example.com/
 
 ## Time Conditions
 
@@ -745,17 +750,17 @@ them with the `-z`/`--time-cond` flag.
 For example, you can easily make a download that only gets performed if the
 remote file is newer than a local copy. It would be made like:
 
-    curl -z local.html http://remote.server.com/remote.html
+    curl -z local.html https://remote.example.com/remote.html
 
 Or you can download a file only if the local file is newer than the remote
 one. Do this by prepending the date string with a `-`, as in:
 
-    curl -z -local.html http://remote.server.com/remote.html
+    curl -z -local.html https://remote.example.com/remote.html
 
 You can specify a plain text date as condition. Tell curl to only download the
 file if it was updated since January 12, 2012:
 
-    curl -z "Jan 12 2012" http://remote.server.com/remote.html
+    curl -z "Jan 12 2012" https://remote.example.com/remote.html
 
 curl accepts a wide range of date formats. You always make the date check the
 other way around by prepending it with a dash (`-`).
@@ -784,11 +789,11 @@ Authentication support is still missing
 ## LDAP
 
 If you have installed the OpenLDAP library, curl can take advantage of it and
-offer `ldap://` support. On Windows, curl will use WinLDAP from Platform SDK
-by default.
+offer `ldap://` support. On Windows, curl uses WinLDAP from Platform SDK by
+default.
 
-Default protocol version used by curl is LDAP version 3. Version 2 will be
-used as a fallback mechanism in case version 3 fails to connect.
+Default protocol version used by curl is LDAP version 3. Version 2 is used as
+a fallback mechanism in case version 3 fails to connect.
 
 LDAP is a complex thing and writing an LDAP query is not an easy
 task. Familiarize yourself with the exact syntax description elsewhere. One
@@ -798,25 +803,25 @@ Format](https://curl.se/rfc/rfc2255.txt)
 To show you an example, this is how to get all people from an LDAP server that
 has a certain subdomain in their email address:
 
-    curl -B "ldap://ldap.frontec.se/o=frontec??sub?mail=*sth.frontec.se"
+    curl -B "ldap://ldap.example.com/o=frontec??sub?mail=*sth.example.com"
 
 You also can use authentication when accessing LDAP catalog:
 
-    curl -u user:passwd "ldap://ldap.frontec.se/o=frontec??sub?mail=*"
-    curl "ldap://user:passwd@ldap.frontec.se/o=frontec??sub?mail=*"
+    curl -u user:passwd "ldap://ldap.example.com/o=frontec??sub?mail=*"
+    curl "ldap://user:passwd@ldap.example.com/o=frontec??sub?mail=*"
 
-By default, if user and password are provided, OpenLDAP/WinLDAP will use basic
+By default, if user and password are provided, OpenLDAP/WinLDAP uses basic
 authentication. On Windows you can control this behavior by providing one of
 `--basic`, `--ntlm` or `--digest` option in curl command line
 
-    curl --ntlm "ldap://user:passwd@ldap.frontec.se/o=frontec??sub?mail=*"
+    curl --ntlm "ldap://user:passwd@ldap.example.com/o=frontec??sub?mail=*"
 
-On Windows, if no user/password specified, auto-negotiation mechanism will be
-used with current logon credentials (SSPI/SPNEGO).
+On Windows, if no user/password specified, auto-negotiation mechanism is used
+with current logon credentials (SSPI/SPNEGO).
 
 ## Environment Variables
 
-Curl reads and understands the following environment variables:
+curl reads and understands the following proxy related environment variables:
 
     http_proxy, HTTPS_PROXY, FTP_PROXY
 
@@ -825,17 +830,17 @@ with
 
     ALL_PROXY
 
-A comma-separated list of host names that should not go through any proxy is
+A comma-separated list of hostnames that should not go through any proxy is
 set in (only an asterisk, `*` matches all hosts)
 
     NO_PROXY
 
-If the host name matches one of these strings, or the host is within the
-domain of one of these strings, transactions with that node will not be done
-over proxy. When a domain is used, it needs to start with a period. A user can
+If the hostname matches one of these strings, or the host is within the domain
+of one of these strings, transactions with that node is not done over the
+proxy. When a domain is used, it needs to start with a period. A user can
 specify that both www.example.com and foo.example.com should not use a proxy
 by setting `NO_PROXY` to `.example.com`. By including the full name you can
-exclude specific host names, so to make `www.example.com` not use a proxy but
+exclude specific hostnames, so to make `www.example.com` not use a proxy but
 still have `foo.example.com` do it, set `NO_PROXY` to `www.example.com`.
 
 The usage of the `-x`/`--proxy` flag overrides the environment variables.
@@ -846,12 +851,12 @@ Unix introduced the `.netrc` concept a long time ago. It is a way for a user
 to specify name and password for commonly visited FTP sites in a file so that
 you do not have to type them in each time you visit those sites. You realize
 this is a big security risk if someone else gets hold of your passwords,
-therefore most Unix programs will not read this file unless it is only readable
+therefore most Unix programs do not read this file unless it is only readable
 by yourself (curl does not care though).
 
-Curl supports `.netrc` files if told to (using the `-n`/`--netrc` and
-`--netrc-optional` options). This is not restricted to just FTP, so curl can
-use it for all protocols where authentication is used.
+curl supports `.netrc` files if told to (using the `-n`/`--netrc` and
+`--netrc-optional` options). This is not restricted to FTP, so curl can use it
+for all protocols where authentication is used.
 
 A simple `.netrc` file could look something like:
 
@@ -866,31 +871,31 @@ information from the previous transfer you want to extract.
 To display the amount of bytes downloaded together with some text and an
 ending newline:
 
-    curl -w 'We downloaded %{size_download} bytes\n' www.download.com
+    curl -w 'We downloaded %{size_download} bytes\n' www.example.com
 
 ## Kerberos FTP Transfer
 
-Curl supports kerberos4 and kerberos5/GSSAPI for FTP transfers. You need the
+curl supports kerberos4 and kerberos5/GSSAPI for FTP transfers. You need the
 kerberos package installed and used at curl build time for it to be available.
 
 First, get the krb-ticket the normal way, like with the `kinit`/`kauth` tool.
 Then use curl in way similar to:
 
-    curl --krb private ftp://krb4site.com -u username:fakepwd
+    curl --krb private ftp://krb4site.example.com -u username:fakepwd
 
-There is no use for a password on the `-u` switch, but a blank one will make
-curl ask for one and you already entered the real password to `kinit`/`kauth`.
+There is no use for a password on the `-u` switch, but a blank one makes curl
+ask for one and you already entered the real password to `kinit`/`kauth`.
 
 ## TELNET
 
-The curl telnet support is basic and easy to use. Curl passes all data passed
+The curl telnet support is basic and easy to use. curl passes all data passed
 to it on stdin to the remote server. Connect to a remote telnet server using a
 command line similar to:
 
-    curl telnet://remote.server.com
+    curl telnet://remote.example.com
 
-And enter the data to pass to the server on stdin. The result will be sent to
-stdout or to the file you specify with `-o`.
+Enter the data to pass to the server on stdin. The result is sent to stdout or
+to the file you specify with `-o`.
 
 You might want the `-N`/`--no-buffer` option to switch off the buffered output
 for slow connections or similar.
@@ -898,12 +903,12 @@ for slow connections or similar.
 Pass options to the telnet protocol negotiation, by using the `-t` option. To
 tell the server we use a vt100 terminal, try something like:
 
-    curl -tTTYPE=vt100 telnet://remote.server.com
+    curl -tTTYPE=vt100 telnet://remote.example.com
 
 Other interesting options for it `-t` include:
 
- - `XDISPLOC=<X display>` Sets the X display location.
- - `NEW_ENV=<var,val>` Sets an environment variable.
+- `XDISPLOC=<X display>` Sets the X display location.
+- `NEW_ENV=<var,val>` Sets an environment variable.
 
 NOTE: The telnet protocol does not specify any way to login with a specified
 user and password so curl cannot do that automatically. To do that, you need to
@@ -912,47 +917,46 @@ accordingly.
 
 ## Persistent Connections
 
-Specifying multiple files on a single command line will make curl transfer all
-of them, one after the other in the specified order.
+Specifying multiple files on a single command line makes curl transfer all of
+them, one after the other in the specified order.
 
-libcurl will attempt to use persistent connections for the transfers so that
-the second transfer to the same host can use the same connection that was
-already initiated and was left open in the previous transfer. This greatly
-decreases connection time for all but the first transfer and it makes a far
-better use of the network.
+libcurl attempts to use persistent connections for the transfers so that the
+second transfer to the same host can use the same connection that was already
+initiated and was left open in the previous transfer. This greatly decreases
+connection time for all but the first transfer and it makes a far better use
+of the network.
 
 Note that curl cannot use persistent connections for transfers that are used
 in subsequent curl invokes. Try to stuff as many URLs as possible on the same
-command line if they are using the same host, as that will make the transfers
+command line if they are using the same host, as that makes the transfers
 faster. If you use an HTTP proxy for file transfers, practically all transfers
-will be persistent.
+are persistent.
 
 ## Multiple Transfers With A Single Command Line
 
 As is mentioned above, you can download multiple files with one command line
-by simply adding more URLs. If you want those to get saved to a local file
-instead of just printed to stdout, you need to add one save option for each
-URL you specify. Note that this also goes for the `-O` option (but not
+by adding more URLs. If you want those to get saved to a local file
+instead of printed to stdout, you need to add one save option for each URL you
+specify. Note that this also goes for the `-O` option (but not
 `--remote-name-all`).
 
 For example: get two files and use `-O` for the first and a custom file
 name for the second:
 
-    curl -O http://url.com/file.txt ftp://ftp.com/moo.exe -o moo.jpg
+    curl -O https://example.com/file.txt ftp://example.com/moo.exe -o moo.jpg
 
 You can also upload multiple files in a similar fashion:
 
-    curl -T local1 ftp://ftp.com/moo.exe -T local2 ftp://ftp.com/moo2.txt
+    curl -T local1 ftp://example.com/moo.exe -T local2 ftp://example.com/moo2.txt
 
 ## IPv6
 
-curl will connect to a server with IPv6 when a host lookup returns an IPv6
-address and fall back to IPv4 if the connection fails. The `--ipv4` and
-`--ipv6` options can specify which address to use when both are
-available. IPv6 addresses can also be specified directly in URLs using the
-syntax:
+curl connects to a server with IPv6 when a host lookup returns an IPv6 address
+and fall back to IPv4 if the connection fails. The `--ipv4` and `--ipv6`
+options can specify which address to use when both are available. IPv6
+addresses can also be specified directly in URLs using the syntax:
 
-    http://[2001:1890:1112:1::20]/overview.html
+    https://[2001:1890:1112:1::20]/overview.html
 
 When this style is used, the `-g` option must be given to stop curl from
 interpreting the square brackets as special globbing characters. Link local
diff --git a/third-party/curl/docs/MQTT.md b/third-party/curl/docs/MQTT.md
deleted file mode 100644
index 0f034f72e4..0000000000
--- a/third-party/curl/docs/MQTT.md
+++ /dev/null
@@ -1,27 +0,0 @@
-# MQTT in curl
-
-## Usage
-
-A plain "GET" subscribes to the topic and prints all published messages.
-Doing a "POST" publishes the post data to the topic and exits.
-
-Example subscribe:
-
-    curl mqtt://host/home/bedroom/temp
-
-Example publish:
-
-    curl -d 75 mqtt://host/home/bedroom/dimmer
-
-## What does curl deliver as a response to a subscribe
-
-It outputs two bytes topic length (MSB | LSB), the topic followed by the
-payload.
-
-## Caveats
-
-Remaining limitations:
- - Only QoS level 0 is implemented for publish
- - No way to set retain flag for publish
- - No TLS (mqtts) support
- - Naive EAGAIN handling will not handle split messages
diff --git a/third-party/curl/docs/Makefile.am b/third-party/curl/docs/Makefile.am
index 4220f121b6..fdc4511b5c 100644
--- a/third-party/curl/docs/Makefile.am
+++ b/third-party/curl/docs/Makefile.am
@@ -24,111 +24,133 @@
 
 AUTOMAKE_OPTIONS = foreign no-dependencies
 
-# EXTRA_DIST breaks with $(abs_builddir) so build it using this variable
-# but distribute it (using the relative file name) in the next variable
-man_MANS = $(abs_builddir)/curl.1
-noinst_man_MANS = curl.1 mk-ca-bundle.1
-dist_man_MANS = curl-config.1
-GENHTMLPAGES = curl.html curl-config.html mk-ca-bundle.html
-PDFPAGES = curl.pdf curl-config.pdf mk-ca-bundle.pdf
-MANDISTPAGES = curl.1.dist curl-config.1.dist
+if BUILD_DOCS
+# if we disable man page building, ignore these
+MK_CA_DOCS = mk-ca-bundle.1
+CURLCONF_DOCS = curl-config.1
+man_MANS = curl-config.1 wcurl.1
+endif
 
-HTMLPAGES = $(GENHTMLPAGES)
+CURLPAGES = curl-config.md mk-ca-bundle.md wcurl.md runtests.md testcurl.md
 
-# Build targets in this file (.) before cmdline-opts to ensure that
-# the curl.1 rule below runs first
-SUBDIRS = . cmdline-opts
-DIST_SUBDIRS = $(SUBDIRS) examples libcurl
+SUBDIRS = . cmdline-opts libcurl
+DIST_SUBDIRS = $(SUBDIRS) examples
 
-CLEANFILES = $(GENHTMLPAGES) $(PDFPAGES) $(MANDISTPAGES) curl.1
+if BUILD_DOCS
+CLEANFILES = $(MK_CA_DOCS) $(man_MANS)
+endif
 
-EXTRA_DIST =                                    \
- $(noinst_man_MANS)                             \
- ALTSVC.md                                      \
- BINDINGS.md                                    \
- BUFREF.md                                      \
- BUG-BOUNTY.md                                  \
- BUGS.md                                        \
- CHECKSRC.md                                    \
- CIPHERS.md                                     \
- CMakeLists.txt                                 \
- CODE_OF_CONDUCT.md                             \
- CODE_REVIEW.md                                 \
- CODE_STYLE.md                                  \
- CONNECTION-FILTERS.md                          \
- CONTRIBUTE.md                                  \
- CURL-DISABLE.md                                \
- DEPRECATE.md                                   \
- DYNBUF.md                                      \
- EARLY-RELEASE.md                               \
- EXPERIMENTAL.md                                \
- FAQ                                            \
- FEATURES.md                                    \
- GOVERNANCE.md                                  \
- HELP-US.md                                     \
- HISTORY.md                                     \
- HSTS.md                                        \
- HTTP-COOKIES.md                                \
- HTTP2.md                                       \
- HTTP3.md                                       \
- HYPER.md                                       \
- INSTALL                                        \
- INSTALL.cmake                                  \
- INSTALL.md                                     \
- INTERNALS.md                                   \
- KNOWN_BUGS                                     \
- MAIL-ETIQUETTE                                 \
- MQTT.md                                        \
- NEW-PROTOCOL.md                                \
- options-in-versions                            \
- PARALLEL-TRANSFERS.md                          \
- README.md                                      \
- RELEASE-PROCEDURE.md                           \
- RUSTLS.md                                      \
- ROADMAP.md                                     \
- SECURITY-ADVISORY.md                           \
- SECURITY-PROCESS.md                            \
- SSL-PROBLEMS.md                                \
- SSLCERTS.md                                    \
- THANKS                                         \
- TODO                                           \
- TheArtOfHttpScripting.md                       \
- URL-SYNTAX.md                                  \
- VERSIONS.md                                    \
- WEBSOCKET.md
+TESTDOCS =                                       \
+  tests/FILEFORMAT.md                            \
+  tests/HTTP.md                                  \
+  tests/TEST-SUITE.md
 
-MAN2HTML= roffit $< >$@
+INTERNALDOCS =                                   \
+  internals/BUFQ.md                              \
+  internals/BUFREF.md                            \
+  internals/CHECKSRC.md                          \
+  internals/CLIENT-READERS.md                    \
+  internals/CLIENT-WRITERS.md                    \
+  internals/CODE_STYLE.md                        \
+  internals/CONNECTION-FILTERS.md                \
+  internals/CREDENTIALS.md                       \
+  internals/CURLX.md                             \
+  internals/DYNBUF.md                            \
+  internals/HASH.md                              \
+  internals/LLIST.md                             \
+  internals/MID.md                               \
+  internals/MQTT.md                              \
+  internals/MULTI-EV.md                          \
+  internals/NEW-PROTOCOL.md                      \
+  internals/PEERS.md                             \
+  internals/PORTING.md                           \
+  internals/RATELIMITS.md                        \
+  internals/README.md                            \
+  internals/SCORECARD.md                         \
+  internals/SPLAY.md                             \
+  internals/STRPARSE.md                          \
+  internals/THRDPOOL-AND-QUEUE.md                \
+  internals/TIME-KEEPING.md                      \
+  internals/TLS-SESSIONS.md                      \
+  internals/UINT_SETS.md                         \
+  internals/WEBSOCKET.md
 
-SUFFIXES = .1 .html .pdf
+EXTRA_DIST =                                     \
+  $(CURLPAGES)                                   \
+  $(INTERNALDOCS)                                \
+  $(TESTDOCS)                                    \
+  ALTSVC.md                                      \
+  BINDINGS.md                                    \
+  BUG-BOUNTY.md                                  \
+  BUGS.md                                        \
+  CIPHERS.md                                     \
+  CIPHERS-TLS12.md                               \
+  CMakeLists.txt                                 \
+  CODE_OF_CONDUCT.md                             \
+  CODE_REVIEW.md                                 \
+  CONTRIBUTE.md                                  \
+  CURL-DISABLE.md                                \
+  CURLDOWN.md                                    \
+  DEPRECATE.md                                   \
+  DISTROS.md                                     \
+  EARLY-RELEASE.md                               \
+  ECH.md                                         \
+  EXPERIMENTAL.md                                \
+  FAQ.md                                         \
+  FEATURES.md                                    \
+  GOVERNANCE.md                                  \
+  HELP-US.md                                     \
+  HISTORY.md                                     \
+  HSTS.md                                        \
+  HTTP-COOKIES.md                                \
+  HTTP3.md                                       \
+  HTTPSRR.md                                     \
+  INFRASTRUCTURE.md                              \
+  INSTALL                                        \
+  INSTALL-CMAKE.md                               \
+  INSTALL.md                                     \
+  INTERNALS.md                                   \
+  IPFS.md                                        \
+  KNOWN_BUGS.md                                  \
+  KNOWN_RISKS.md                                 \
+  MAIL-ETIQUETTE.md                              \
+  MANUAL.md                                      \
+  options-in-versions                            \
+  README.md                                      \
+  RELEASE-PROCEDURE.md                           \
+  RUSTLS.md                                      \
+  ROADMAP.md                                     \
+  SECURITY-ADVISORY.md                           \
+  SPONSORS.md                                    \
+  SSL-PROBLEMS.md                                \
+  SSLCERTS.md                                    \
+  THANKS                                         \
+  TODO.md                                        \
+  TheArtOfHttpScripting.md                       \
+  URL-SYNTAX.md                                  \
+  VERIFY.md                                      \
+  VERSIONS.md                                    \
+  VULN-DISCLOSURE-POLICY.md
 
-# $(abs_builddir) is to disable VPATH when searching for this file, which
-# would otherwise find the copy in $(srcdir) which breaks the $(HUGE)
-# rule in src/Makefile.am in out-of-tree builds that references the file in the
-# build directory.
-#
-# First, seed the used copy of curl.1 with the prebuilt copy (in an out-of-tree
-# build), then run make recursively to rebuild it only if its dependencies
-# have changed.
-$(abs_builddir)/curl.1:
-	if test "$(top_builddir)x" != "$(top_srcdir)x" -a -e "$(srcdir)/curl.1"; then \
-		$(INSTALL_DATA) "$(srcdir)/curl.1" $@; fi
-	cd cmdline-opts && $(MAKE)
+CD2NROFF = $(top_srcdir)/scripts/cd2nroff $< >$@
 
-html: $(HTMLPAGES)
-	cd libcurl && $(MAKE) html
+CD2 = $(CD2_$(V))
+CD2_0 = @echo "  RENDER " $@;
+CD2_1 =
+CD2_ = $(CD2_0)
 
-pdf: $(PDFPAGES)
-	cd libcurl && $(MAKE) pdf
+SUFFIXES = .1 .md
 
-.1.html:
-	$(MAN2HTML)
+all: $(MK_CA_DOCS) $(CURLCONF_DOCS)
 
-.1.pdf:
-	@(foo=`echo $@ | sed -e 's/\.[0-9]$$//g'`; \
-	groff -Tps -man $< >$$foo.ps; \
-	ps2pdf $$foo.ps $@; \
-	rm $$foo.ps; \
-	echo "converted $< to $@")
+.md.1:
+	$(CD2)$(CD2NROFF)
+
+curl-config.1: curl-config.md
+
+mk-ca-bundle.1: mk-ca-bundle.md
+
+wcurl.1: wcurl.md
 
 distclean:
 	rm -f $(CLEANFILES)
diff --git a/third-party/curl/docs/PARALLEL-TRANSFERS.md b/third-party/curl/docs/PARALLEL-TRANSFERS.md
deleted file mode 100644
index 337fab5faa..0000000000
--- a/third-party/curl/docs/PARALLEL-TRANSFERS.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# Parallel transfers
-
-curl 7.66.0 introduced support for doing multiple transfers simultaneously; in
-parallel.
-
-## -Z, --parallel
-
-When this command line option is used, curl will perform the transfers given
-to it at the same time. It will do up to `--parallel-max` concurrent
-transfers, with a default value of 50.
-
-## Progress meter
-
-The progress meter that is displayed when doing parallel transfers is
-completely different than the regular one used for each single transfer.
-
-  It shows:
-
- o percent download (if known, which means *all* transfers need to have a
-   known size)
- o percent upload (if known, with the same caveat as for download)
- o total amount of downloaded data
- o total amount of uploaded data
- o number of transfers to perform
- o number of concurrent transfers being transferred right now
- o number of transfers queued up waiting to start
- o total time all transfers are expected to take (if sizes are known)
- o current time the transfers have spent so far
- o estimated time left (if sizes are known)
- o current transfer speed (the faster of upload/download speeds measured over
-   the last few seconds)
-
-Example:
-
-    DL% UL%  Dled  Uled  Xfers  Live   Qd Total     Current  Left    Speed
-    72  --  37.9G     0   101    30    23  0:00:55  0:00:34  0:00:22 2752M
-
-## Behavior differences
-
-Connections are shared fine between different easy handles, but the
-"authentication contexts" are not. So for example doing HTTP Digest auth with
-one handle for a particular transfer and then continue on with another handle
-that reuses the same connection, the second handle cannot send the necessary
-Authorization header at once since the context is only kept in the original
-easy handle.
-
-To fix this, the authorization state could be made possible to share with the
-share API as well, as a context per origin + path (realm?) basically.
-
-Visible in test 153, 1412 and more.
diff --git a/third-party/curl/docs/README.md b/third-party/curl/docs/README.md
index b72d8bc454..22d96ea9bd 100644
--- a/third-party/curl/docs/README.md
+++ b/third-party/curl/docs/README.md
@@ -1,10 +1,16 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 ![curl logo](https://curl.se/logo/curl-logo.svg)
 
 # Documentation
 
-you will find a mix of various documentation in this directory and
-subdirectories, using several different formats. Some of them are not ideal
-for reading directly in your browser.
+You find a mix of various documentation in this directory and subdirectories,
+using several different formats. Some of them are not ideal for reading
+directly in your browser.
 
 If you would rather see the rendered version of the documentation, check out the
 curl website's [documentation section](https://curl.se/docs/) for
diff --git a/third-party/curl/docs/RELEASE-PROCEDURE.md b/third-party/curl/docs/RELEASE-PROCEDURE.md
index 4ff8fcc516..e62a90cbd7 100644
--- a/third-party/curl/docs/RELEASE-PROCEDURE.md
+++ b/third-party/curl/docs/RELEASE-PROCEDURE.md
@@ -1,25 +1,26 @@
-curl release procedure - how to do a release
-============================================
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
 
-in the source code repo
------------------------
+SPDX-License-Identifier: curl
+-->
 
-- run `./scripts/copyright.pl` and correct possible omissions
+# curl release procedure - how to do a release
+
+## in the source code repo
 
 - edit `RELEASE-NOTES` to be accurate
 
 - update `docs/THANKS`
 
+- update the "past releases" section in `docs/VERSIONS.md`
+
 - make sure all relevant changes are committed on the master branch
 
 - tag the git repo in this style: `git tag -a curl-7_34_0`. -a annotates the
   tag and we use underscores instead of dots in the version number. Make sure
   the tag is GPG signed (using -s).
 
-- run `./maketgz 7.34.0` to build the release tarballs. It is important that
-  you run this on a machine with the correct set of autotools etc installed
-  as this is what then will be shipped and used by most users on \*nix like
-  systems.
+- run `./scripts/dmaketgz 7.34.0` to build the release tarballs.
 
 - push the git commits and the new tag
 
@@ -27,13 +28,10 @@ in the source code repo
 
 - upload the 8 resulting files to the primary download directory
 
-in the curl-www repo
---------------------
+## in the curl-www repo
 
 - edit `Makefile` (version number and date),
 
-- edit `_newslog.html` (announce the new release) and
-
 - edit `_changes.html` (insert changes+bugfixes from RELEASE-NOTES)
 
 - commit all local changes
@@ -44,27 +42,26 @@ in the curl-www repo
 
   (the website then updates its contents automatically)
 
-on GitHub
----------
+## on GitHub
 
 - edit the newly made release tag so that it is listed as the latest release
 
-inform
-------
+## inform
 
 - send an email to curl-users, curl-announce and curl-library. Insert the
   RELEASE-NOTES into the mail.
 
-celebrate
----------
+- if there are any advisories associated with the release, send each markdown
+  file to the above lists as well as to `oss-security@lists.openwall.com`
+  (unless the problem is unique to the non-open operating systems)
+
+## celebrate
 
 - suitable beverage intake is encouraged for the festivities
 
-curl release scheduling
-=======================
+# curl release scheduling
 
-Release Cycle
--------------
+## Release Cycle
 
 We normally do releases every 8 weeks on Wednesdays. If important problems
 arise, we can insert releases outside the schedule or we can move the release
@@ -89,8 +86,31 @@ of common public holidays or when the lead release manager is unavailable, the
 release date can be moved forwards or backwards a full week. This is then
 advertised well in advance.
 
-Critical problems
------------------
+# Release Candidates
+
+We ship release candidate tarballs on three occasions in preparation for the
+pending release:
+
+- Release candidate one (**rc1**) ships the same Saturday the feature freeze
+  starts. Twenty-five days before the release. Tagged like `rc-7_34_0-1`.
+
+- Release candidate two (**rc2**) ships nine days later, sixteen days before
+  the release. On a Monday. Tagged like `rc-7_34_0-2`.
+
+- Release candidate three (**rc3**) ships nine days later, seven days before
+  the release. On a Wednesday. Tagged like `rc-7_34_0-3`.
+
+Release candidate tarballs are ephemeral and each such tarball is only kept
+around for a few weeks. They are provided on their dedicated webpage at:
+https://curl.se/rc/
+
+The git tags for release candidate are temporary and remain set only for a
+limited period of time.
+
+**Do not use release candidates in production**. They are work in progress.
+Use them for testing and verification only. Use actual releases in production.
+
+# Critical problems
 
 We can break the release cycle and do a patch release at any point if a
 critical enough problem is reported. There is no exact definition of how to
@@ -101,17 +121,13 @@ qualify.
 If you think an issue qualifies, bring it to the curl-library mailing list and
 push for it.
 
-Coming dates
-------------
+# Coming dates
 
-Based on the description above, here are some planned release dates (at the
-time of this writing):
+Based on the description above, here are some planned future release dates:
 
-- July 19, 2023
-- September 13, 2023
-- November 8, 2023
-- January 3, 2024
-- February 28, 2024
-- April 24, 2024
-- June 19, 2024
-- August 14, 2024
+- June 24, 2026
+- September 2, 2026
+- October 28, 2026
+- December 23, 2026
+- February 17, 2027
+- April 14, 2027
diff --git a/third-party/curl/docs/ROADMAP.md b/third-party/curl/docs/ROADMAP.md
index 4642938348..abf306b335 100644
--- a/third-party/curl/docs/ROADMAP.md
+++ b/third-party/curl/docs/ROADMAP.md
@@ -1,24 +1,17 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # curl the next few years - perhaps
 
 Roadmap of things Daniel Stenberg wants to work on next. It is intended to
 serve as a guideline for others for information, feedback and possible
 participation.
 
-## "Complete" the HTTP/3 support
+## WebSocket
 
-curl has experimental support for HTTP/3 since a good while back. There are
-some functionality missing and once the final specs are published we want to
-eventually remove the "experimental" label from this functionality.
+Agree that it is a good enough API and remove the EXPERIMENTAL label.
 
-## HTTPS DNS records
-
-As a DNS version of alt-svc and also a pre-requisite for ECH (see below).
-
-See: https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-svcb-https-02
-
-## ECH (Encrypted Client Hello - formerly known as ESNI)
-
- See Daniel's post on [Support of Encrypted
- SNI](https://curl.se/mail/lib-2019-03/0000.html) on the mailing list.
-
- Initial work exists in [PR 4011](https://github.com/curl/curl/pull/4011)
+##
diff --git a/third-party/curl/docs/RUSTLS.md b/third-party/curl/docs/RUSTLS.md
index 7a0d806b62..ed032f7fb6 100644
--- a/third-party/curl/docs/RUSTLS.md
+++ b/third-party/curl/docs/RUSTLS.md
@@ -1,26 +1,85 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # Rustls
 
-[Rustls is a TLS backend written in Rust](https://docs.rs/rustls/). Curl can
+[Rustls is a TLS backend written in Rust](https://docs.rs/rustls/). curl can
 be built to use it as an alternative to OpenSSL or other TLS backends. We use
-the [rustls-ffi C bindings](https://github.com/rustls/rustls-ffi/). This
-version of curl depends on version v0.10.0 of rustls-ffi.
+the [rustls-ffi C bindings](https://github.com/rustls/rustls-ffi). This
+version of curl is compatible with `rustls-ffi` v0.15.x.
 
-# Building with rustls
+## Getting rustls-ffi
 
-First, [install Rust](https://rustup.rs/).
+To build `curl` with `rustls` support you need to have `rustls-ffi` available first.
+There are three options for this:
 
-Next, check out, build, and install the appropriate version of rustls-ffi:
+1. Install it from your package manager, if available.
+2. Download pre-built binaries.
+3. Build it from source.
 
-    % cargo install cbindgen
-    % git clone https://github.com/rustls/rustls-ffi -b v0.10.0
-    % cd rustls-ffi
+### Installing rustls-ffi from a package manager
+
+See the [rustls-ffi README] for packaging status. Availability and details for installation
+differ between distributions.
+
+Once installed, build `curl` using `--with-rustls`.
+
+    % git clone --depth 1 https://github.com/curl/curl
+    % cd curl
+    % autoreconf -fi
+    % ./configure --with-rustls
     % make
-    % make DESTDIR=${HOME}/rustls-ffi-built/ install
 
-Now configure and build curl with rustls:
+[rustls-ffi README]: https://github.com/rustls/rustls-ffi?tab=readme-ov-file
 
-    % git clone https://github.com/curl/curl
+### Downloading pre-built rustls-ffi binaries
+
+Pre-built binaries are available on the [releases page] on GitHub for releases since 0.15.0.
+Download the appropriate archive for your platform and extract it to a directory of your choice
+(e.g. `${HOME}/rustls-ffi-built`).
+
+Once downloaded, build `curl` using `--with-rustls` and the path to the extracted binaries.
+
+    % git clone --depth 1 https://github.com/curl/curl
     % cd curl
     % autoreconf -fi
     % ./configure --with-rustls=${HOME}/rustls-ffi-built
     % make
+
+[releases page]: https://github.com/rustls/rustls-ffi/releases
+
+### Building rustls-ffi from source
+
+Building `rustls-ffi` from source requires both a rust compiler, and the [cargo-c] cargo plugin.
+
+To install a Rust compiler, use [rustup] or your package manager to install
+the **1.73** or newer toolchain.
+
+To install `cargo-c`, use your [package manager][cargo-c pkg], download
+[a pre-built archive][cargo-c prebuilt], or build it from source with `cargo install cargo-c`.
+
+Next, check out, build, and install the appropriate version of `rustls-ffi` using `cargo`:
+
+    % git clone --depth 1 --branch v0.15.3 https://github.com/rustls/rustls-ffi
+    % cd rustls-ffi
+    % cargo capi install --release --prefix=${HOME}/rustls-ffi-built
+
+Now configure and build `curl` using `--with-rustls`:
+
+    % git clone --depth 1 https://github.com/curl/curl
+    % cd curl
+    % autoreconf -fi
+    % ./configure --with-rustls=${HOME}/rustls-ffi-built
+    % make
+
+See the [rustls-ffi README][cryptography provider] for more information on cryptography providers and
+their build/platform requirements.
+
+[cargo-c]: https://github.com/lu-zero/cargo-c
+[rustup]: https://rustup.rs/
+[cargo-c pkg]: https://github.com/lu-zero/cargo-c?tab=readme-ov-file#availability
+[cargo-c prebuilt]: https://github.com/lu-zero/cargo-c/releases
+[cryptography provider]: https://github.com/cpu/rustls-ffi?tab=readme-ov-file#cryptography-provider
diff --git a/third-party/curl/docs/SECURITY-ADVISORY.md b/third-party/curl/docs/SECURITY-ADVISORY.md
index 0ddc38b90d..34c342509d 100644
--- a/third-party/curl/docs/SECURITY-ADVISORY.md
+++ b/third-party/curl/docs/SECURITY-ADVISORY.md
@@ -1,10 +1,19 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # Anatomy of a curl security advisory
 
-As described in the [Security Process](https://curl.se/dev/secprocess.html)
-document, when a security vulnerability has been reported to the project and
-confirmed, we author an advisory document for the issue. It should ideally
-be written in cooperation with the reporter to make sure all the angles and
-details of the problem are gathered and described correctly and succinctly.
+As described in the [vulnerability disclosure
+policy](https://curl.se/dev/vuln-disclosure.html), when a vulnerability has
+been reported to the project and and it has been confirmed by the team, we
+author an advisory document for the issue.
+
+<p> This advisory document should ideally be written in cooperation with the
+reporter to make sure all the angles and details of the problem are gathered
+and described correctly and succinctly.
 
 ## New document
 
@@ -25,17 +34,26 @@ in the same directory. It holds a large array with all published curl
 vulnerabilities. All fields should be filled in accordingly, separated by a
 pipe character (`|`).
 
-The eleven fields for each CVE in `vuln.pm` are, in order:
+The fields for every CVE in `vuln.pm` are, in order:
 
- HTML page name, first vulnerable version, last vulnerable version, name of
- the issue, CVE Id, announce date (`YYYYMMDD`), report to the project date
- (`YYYYMMDD`), CWE, awarded reward amount (USD), area (single word), C-issue
- (`-` if not a C issue at all, `OVERFLOW` , `OVERREAD`, `DOUBLE_FREE`,
- `USE_AFTER_FREE`, `NULL_MISTAKE`, `UNINIT`)
+1. HTML page name
+2. first vulnerable version
+3. last vulnerable version
+4. name of the issue
+5. CVE Id
+6. announce date (`YYYYMMDD`)
+7. report to the project date (`YYYYMMDD`)
+8. CWE
+9. awarded reward amount (USD)
+10. area (single word)
+11. C-issue (`-` if not a C issue at all, `OVERFLOW` , `OVERREAD`, `DOUBLE_FREE`, `USE_AFTER_FREE`, `NULL_MISTAKE`, `UNINIT`, `BAD_FREE`)
+12. affected components: `both`, `lib` or `tool`
+13. severity: `low`, `medium`, `high` or `critical`
+14. URL to the initial report (often on HackerOne)
 
 ### `Makefile`
 
-The new CVE web page file name needs to be added in the `Makefile`'s `CVELIST`
+The new CVE webpage filename needs to be added in the `Makefile`'s `CVELIST`
 macro.
 
 When the markdown is in place and the `Makefile` and `vuln.pm` are updated,
@@ -44,12 +62,12 @@ generated automatically using those files.
 
 ## Document format
 
-The easy way is to start with a recent previously published advisory and just
-blank out old texts and save it using a new name. Save the subtitles and
-general layout.
+The easy way is to start with a recent previously published advisory and blank
+out old texts and save it using a new name. Save the subtitles and general
+layout.
 
-Some details and metadata will be extracted from this document so it is
-important to stick to the existing format.
+Some details and metadata are extracted from this document so it is important
+to stick to the existing format.
 
 The first list must be the title of the issue.
 
diff --git a/third-party/curl/docs/SECURITY-PROCESS.md b/third-party/curl/docs/SECURITY-PROCESS.md
deleted file mode 100644
index a4cda248cf..0000000000
--- a/third-party/curl/docs/SECURITY-PROCESS.md
+++ /dev/null
@@ -1,285 +0,0 @@
-# curl security process
-
-This document describes how security vulnerabilities should be handled in the
-curl project.
-
-## Publishing Information
-
-All known and public curl or libcurl related vulnerabilities are listed on
-[the curl website security page](https://curl.se/docs/security.html).
-
-Security vulnerabilities **should not** be entered in the project's public bug
-tracker.
-
-## Vulnerability Handling
-
-The typical process for handling a new security vulnerability is as follows.
-
-No information should be made public about a vulnerability until it is
-formally announced at the end of this process. That means, for example, that a
-bug tracker entry must NOT be created to track the issue since that will make
-the issue public and it should not be discussed on any of the project's public
-mailing lists. Messages associated with any commits should not make any
-reference to the security nature of the commit if done prior to the public
-announcement.
-
-- The person discovering the issue, the reporter, reports the vulnerability on
-  [HackerOne](https://hackerone.com/curl). Issues filed there reach a handful
-  of selected and trusted people.
-
-- Messages that do not relate to the reporting or managing of an undisclosed
-  security vulnerability in curl or libcurl are ignored and no further action
-  is required.
-
-- A person in the security team responds to the original report to acknowledge
-  that a human has seen the report.
-
-- The security team investigates the report and either rejects it or accepts
-  it. See below for examples of problems that are not considered
-  vulnerabilities.
-
-- If the report is rejected, the team writes to the reporter to explain why.
-
-- If the report is accepted, the team writes to the reporter to let them
-  know it is accepted and that they are working on a fix.
-
-- The security team discusses the problem, works out a fix, considers the
-  impact of the problem and suggests a release schedule. This discussion
-  should involve the reporter as much as possible.
-
-- The release of the information should be "as soon as possible" and is most
-  often synchronized with an upcoming release that contains the fix. If the
-  reporter, or anyone else involved, thinks the next planned release is too
-  far away, then a separate earlier release should be considered.
-
-- Write a security advisory draft about the problem that explains what the
-  problem is, its impact, which versions it affects, solutions or workarounds,
-  when the release is out and make sure to credit all contributors properly.
-  Figure out the CWE (Common Weakness Enumeration) number for the flaw. See
-  [SECURITY-ADVISORY](https://curl.se/dev/advisory.html) for help on creating
-  the advisory.
-
-- Request a CVE number from
-  [HackerOne](https://docs.hackerone.com/programs/cve-requests.html)
-
-- Update the "security advisory" with the CVE number.
-
-- The security team commits the fix in a private branch. The commit message
-  should ideally contain the CVE number. If the severity level of the issue is
-  set to Low or Medium, the fix is allowed to get merged into the master
-  repository via a normal PR - but without mentioning it being a security
-  vulnerability.
-
-- The monetary reward part of the bug-bounty is managed by the Internet Bug
-  Bounty team and the reporter is asked to request the reward from them after
-  the issue has been completely handled and published by curl.
-
-- No more than 10 days before release, inform
-  [distros@openwall](https://oss-security.openwall.org/wiki/mailing-lists/distros)
-  to prepare them about the upcoming public security vulnerability
-  announcement - attach the advisory draft for information with CVE and
-  current patch. 'distros' does not accept an embargo longer than 14 days and
-  they do not care for Windows-specific flaws.
-
-- No more than 48 hours before the release, the private branch is merged into
-  the master branch and pushed. Once pushed, the information is accessible to
-  the public and the actual release should follow suit immediately afterwards.
-  The time between the push and the release is used for final tests and
-  reviews.
-
-- The project team creates a release that includes the fix.
-
-- The project team announces the release and the vulnerability to the world in
-  the same manner we always announce releases. It gets sent to the
-  curl-announce, curl-library and curl-users mailing lists.
-
-- The security web page on the website should get the new vulnerability
-  mentioned.
-
-## security (at curl dot se)
-
-This is a private mailing list for discussions on and about curl security
-issues.
-
-Who is on this list? There are a couple of criteria you must meet, and then we
-might ask you to join the list or you can ask to join it. It really is not a
-formal process. We basically only require that you have a long-term presence
-in the curl project and you have shown an understanding for the project and
-its way of working. You must have been around for a good while and you should
-have no plans of vanishing in the near future.
-
-We do not make the list of participants public mostly because it tends to vary
-somewhat over time and a list somewhere will only risk getting outdated.
-
-## Publishing Security Advisories
-
-1. Write up the security advisory, using markdown syntax. Use the same
-   subtitles as last time to maintain consistency.
-
-2. Name the advisory file after the allocated CVE id.
-
-3. Add a line on the top of the array in `curl-www/docs/vuln.pm`.
-
-4. Put the new advisory markdown file in the `curl-www/docs/` directory. Add it
-   to the git repository.
-
-5. Run `make` in your local web checkout and verify that things look fine.
-
-6. On security advisory release day, push the changes on the curl-www
-   repository's remote master branch.
-
-## HackerOne
-
-Request the issue to be disclosed. If there are sensitive details present in
-the report and discussion, those should be redacted from the disclosure. The
-default policy is to disclose as much as possible as soon as the vulnerability
-has been published.
-
-## Bug Bounty
-
-See [BUG-BOUNTY](https://curl.se/docs/bugbounty.html) for details on the
-bug bounty program.
-
-# Severity levels
-
-The curl project's security team rates security problems using four severity
-levels depending how serious we consider the problem to be. We use **Low**,
-**Medium**, **High** and **Critical**. We refrain from using numerical scoring
-of vulnerabilities.
-
-When deciding severity level on a particular issue, we take all the factors
-into account: attack vector, attack complexity, required privileges, necessary
-build configuration, protocols involved, platform specifics and also what
-effects a possible exploit or trigger of the issue can lead do, including
-confidentiality, integrity or availability problems.
-
-## Low
-
-This is a security problem that is truly hard or unlikely to exploit or
-trigger. Due to timing, platform requirements or the fact that options or
-protocols involved are rare etc. [Past
-example](https://curl.se/docs/CVE-2022-43552.html)
-
-## Medium
-
-This is a security problem that is less hard than **Low** to exploit or
-trigger. Less strict timing, wider platforms availability or involving more
-widely used options or protocols. A problem that usually needs something else
-to also happen to become serious. [Past
-example](https://curl.se/docs/CVE-2022-32206.html)
-
-## High
-
-This issue in itself a serious problem with real world impact. Flaws that can
-easily compromise the confidentiality, integrity or availability of resources.
-Exploiting or triggering this problem is not hard. [Past
-example](https://curl.se/docs/CVE-2019-3822.html)
-
-## Critical
-
-Easily exploitable by a remote unauthenticated attacker and lead to system
-compromise (arbitrary code execution) without requiring user interaction, with
-a common configuration on a popular platform. This issue has few restrictions
-and requirements and can be exploited easily using most curl configurations.
-[Past example](https://curl.se/docs/CVE-2000-0973.html)
-
-# Not security issues
-
-This is an incomplete list of issues that are not considered vulnerabilities.
-
-## Small memory leaks
-
-We do not consider a small memory leak a security problem; even if the amount
-of allocated memory grows by a small amount every now and then. Long-living
-applications and services already need to have counter-measures and deal with
-growing memory usage, be it leaks or just increased use. A small memory or
-resource leak is then expected to *not* cause a security problem.
-
-Of course there can be a discussion if a leak is small or not. A large leak
-can be considered a security problem due to the DOS risk. If leaked memory
-contains sensitive data it might also qualify as a security problem.
-
-## Never-ending transfers
-
-We do not consider flaws that cause a transfer to never end to be a security
-problem. There are already several benign and likely reasons for transfers to
-stall and never end, so applications that cannot deal with never-ending
-transfers already need to have counter-measures established.
-
-If the problem avoids the regular counter-measures when it causes a never-
-ending transfer, it might be a security problem.
-
-## Not practically possible
-
-If the flaw or vulnerability cannot practically get executed on existing
-hardware it is not a security problem.
-
-## API misuse
-
-If a reported issue only triggers by an application using the API in a way
-that is not documented to work or even documented to not work, it is probably
-not going to be considered a security problem. We only guarantee secure and
-proper functionality when the APIs are used as expected and documented.
-
-There can be a discussion about what the documentation actually means and how
-to interpret the text, which might end up with us still agreeing that it is a
-security problem.
-
-## Local attackers already present
-
-When an issue can only be attacked or misused by an attacker present on the
-local system or network, the bar is raised. If a local user wrongfully has
-elevated rights on your system enough to attack curl, they can probably
-already do much worse harm and the problem is not really in curl.
-
-## Experiments
-
-Vulnerabilities in features which are off by default (in the build) and
-documented as experimental, are not eligible for a reward and we do not
-consider them security problems.
-
-## URL inconsistencies
-
-URL parser inconsistencies between browsers and curl are expected and are not
-considered security vulnerabilities. The WHATWG URL Specification and RFC
-3986+ (the plus meaning that it is an extended version) [are not completely
-interoperable](https://github.com/bagder/docs/blob/master/URL-interop.md).
-
-Obvious parser bugs can still be vulnerabilities of course.
-
-## Visible command line arguments
-
-The curl command blanks the contents of a number of command line arguments to
-prevent them from appearing in process listings. It does not blank all
-arguments even if some of them that are not blanked might contain sensitive
-data. We consider this functionality a best-effort and omissions are not
-security vulnerabilities.
-
- - not all systems allow the arguments to be blanked in the first place
- - since curl blanks the argument itself they will be readable for a short
-   moment no matter what
- - virtually every argument can contain sensitive data, depending on use
- - blanking all arguments would make it impractical for users to differentiate
-   curl command lines in process listings
-
-## Busy-loops
-
-Busy-loops that consume 100% CPU time but eventually end (perhaps due to a set
-timeout value or otherwise) are not considered security problems. Applications
-are supposed to already handle situations when the transfer loop legitimately
-consumes 100% CPU time, so while a prolonged such busy-loop is a nasty bug, we
-do not consider it a security problem.
-
-## Saving files
-
-curl cannot protect against attacks where an attacker has write access to the
-same directory where curl is directed to save files.
-
-## Tricking a user to run a command line
-
-A creative, misleading or funny looking command line is not a security
-problem. The curl command line tool takes options and URLs on the command line
-and if an attacker can trick the user to run a specifically crafted curl
-command line, all bets are off. Such an attacker can just as well have the
-user run a much worse command that can do something fatal (like
-`sudo rm -rf /`).
diff --git a/third-party/curl/docs/SPONSORS.md b/third-party/curl/docs/SPONSORS.md
new file mode 100644
index 0000000000..dc9d26fe6b
--- /dev/null
+++ b/third-party/curl/docs/SPONSORS.md
@@ -0,0 +1,55 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# curl sponsors
+
+A sponsor is someone who donates money or resources to the curl project for no
+specific service in return.
+
+curl accepts donations via [GitHub sponsors](https://github.com/sponsors/curl)
+and [Open Collective](https://opencollective.com/curl).
+
+An even better way to contribute to the project might be to pay an engineer or
+two to spend work hours on curl related tasks.
+
+We promise to use donated funds for things and activities that we believe are
+beneficial for the project and its development. That includes but is not
+limited to developer conferences, infrastructure, development, services and
+hardware.
+
+Recurring donations above a certain amount of money puts the sponsor at a
+named sponsor level: **Silver**, **Gold**, **Platinum** or **Top**.
+
+Sponsors on a named level can provide their logo image and preferred URL and
+get recognition on the curl website's [sponsor
+page](https://curl.se/sponsors.html), assuming they meet the project's
+standards and requirements.
+
+- **Silver Sponsor** at least 100 USD/month
+- **Gold Sponsor** at least 500 USD/month
+- **Platinum Sponsor** at least 1000 USD/month
+- **Top Sponsor** outstanding extra valuable help
+
+## Sponsor requirements
+
+A named level sponsor is entitled a logo and link on the curl website assuming
+the company, brand and link are not deemed unsuitable. The curl team reserves
+the right to make that decision at its own discretion.
+
+Sponsors may be denied a website presence for example if involved with drugs,
+gambling, pornography, social media manipulation etc.
+
+## Past Sponsors
+
+Sponsors that stop paying are considered *Past Sponsors* and are not displayed
+on the sponsor page anymore. We thank you for your contributions.
+
+## Donations
+
+Please note that sponsorship and donations are exactly that: donations to the
+curl project. They are used to help and further the project as the project
+leadership deems best. No goods or services are expected or promised in
+return. Requests for refunds for such purposes are rejected.
diff --git a/third-party/curl/docs/SSL-PROBLEMS.md b/third-party/curl/docs/SSL-PROBLEMS.md
index afe42506c6..4809f84a97 100644
--- a/third-party/curl/docs/SSL-PROBLEMS.md
+++ b/third-party/curl/docs/SSL-PROBLEMS.md
@@ -1,97 +1,97 @@
-                                  _   _ ____  _
-                              ___| | | |  _ \| |
-                             / __| | | | |_) | |
-                            | (__| |_| |  _ <| |___
-                             \___|\___/|_| \_\_____|
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
 
 # SSL problems
 
-  First, let's establish that we often refer to TLS and SSL interchangeably as
-  SSL here. The current protocol is called TLS, it was called SSL a long time
-  ago.
+First, let's establish that we often refer to TLS and SSL interchangeably as
+SSL here. The current protocol is called TLS, it was called SSL a long time
+ago.
 
-  There are several known reasons why a connection that involves SSL might
-  fail. This is a document that attempts to detail the most common ones and
-  how to mitigate them.
+There are several known reasons why a connection that involves SSL might
+fail. This is a document that attempts to detail the most common ones and
+how to mitigate them.
 
 ## CA certs
 
-  CA certs are used to digitally verify the server's certificate. You need a
-  "ca bundle" for this. See lots of more details on this in the `SSLCERTS`
-  document.
+CA certs are used to digitally verify the server's certificate. You need a
+"ca bundle" for this. See lots of more details on this in the `SSLCERTS`
+document.
 
 ## CA bundle missing intermediate certificates
 
-  When using said CA bundle to verify a server cert, you will experience
-  problems if your CA store does not contain the certificates for the
-  intermediates if the server does not provide them.
+When using said CA bundle to verify a server cert, you may experience
+problems if your CA store does not contain the certificates for the
+intermediates if the server does not provide them.
 
-  The TLS protocol mandates that the intermediate certificates are sent in the
-  handshake, but as browsers have ways to survive or work around such
-  omissions, missing intermediates in TLS handshakes still happen that
-  browser-users will not notice.
+The TLS protocol mandates that the intermediate certificates are sent in the
+handshake, but as browsers have ways to survive or work around such
+omissions, missing intermediates in TLS handshakes still happen that browser
+users do not notice.
 
-  Browsers work around this problem in two ways: they cache intermediate
-  certificates from previous transfers and some implement the TLS "AIA"
-  extension that lets the client explicitly download such certificates on
-  demand.
+Browsers work around this problem in two ways: they cache intermediate
+certificates from previous transfers and some implement the TLS "AIA"
+extension that lets the client explicitly download such certificates on
+demand.
 
 ## Protocol version
 
-  Some broken servers fail to support the protocol negotiation properly that
-  SSL servers are supposed to handle. This may cause the connection to fail
-  completely. Sometimes you may need to explicitly select a SSL version to use
-  when connecting to make the connection succeed.
+Some broken servers fail to support the protocol negotiation properly that
+SSL servers are supposed to handle. This may cause the connection to fail
+completely. Sometimes you may need to explicitly select an SSL version to
+use when connecting to make the connection succeed.
 
-  An additional complication can be that modern SSL libraries sometimes are
-  built with support for older SSL and TLS versions disabled!
+An additional complication can be that modern SSL libraries sometimes are
+built with support for older SSL and TLS versions disabled.
 
-  All versions of SSL and the TLS versions before 1.2 are considered insecure
-  and should be avoided. Use TLS 1.2 or later.
+All versions of SSL and the TLS versions before 1.2 are considered insecure
+and should be avoided. Use TLS 1.2 or later.
 
 ## Ciphers
 
-  Clients give servers a list of ciphers to select from. If the list does not
-  include any ciphers the server wants/can use, the connection handshake
-  fails.
+Clients give servers a list of ciphers to select from. If the list does not
+include any ciphers the server wants/can use, the connection handshake
+fails.
 
-  curl has recently disabled the user of a whole bunch of seriously insecure
-  ciphers from its default set (slightly depending on SSL backend in use).
+curl has recently disabled the user of a whole bunch of seriously insecure
+ciphers from its default set (slightly depending on SSL backend in use).
 
-  You may have to explicitly provide an alternative list of ciphers for curl
-  to use to allow the server to use a weak cipher for you.
+You may have to explicitly provide an alternative list of ciphers for curl
+to use to allow the server to use a weak cipher for you.
 
-  Note that these weak ciphers are identified as flawed. For example, this
-  includes symmetric ciphers with less than 128 bit keys and RC4.
+Note that these weak ciphers are identified as flawed. For example, this
+includes symmetric ciphers with less than 128-bit keys and RC4.
 
-  Schannel in Windows XP is not able to connect to servers that no longer
-  support the legacy handshakes and algorithms used by those versions, so we
-  advise against building curl to use Schannel on really old Windows versions.
+Schannel in Windows XP is not able to connect to servers that no longer
+support the legacy handshakes and algorithms used by those versions, so we
+advise against building curl to use Schannel on really old Windows versions.
 
-  Reference: [Prohibiting RC4 Cipher
-  Suites](https://datatracker.ietf.org/doc/html/draft-popov-tls-prohibiting-rc4-01)
+Reference: [Prohibiting RC4 Cipher
+Suites](https://datatracker.ietf.org/doc/html/draft-popov-tls-prohibiting-rc4-01)
 
 ## Allow BEAST
 
-  BEAST is the name of a TLS 1.0 attack that surfaced 2011. When adding means
-  to mitigate this attack, it turned out that some broken servers out there in
-  the wild did not work properly with the BEAST mitigation in place.
+BEAST is the name of a TLS 1.0 attack that surfaced 2011. When adding means
+to mitigate this attack, it turned out that some broken servers out there in
+the wild did not work properly with the BEAST mitigation in place.
 
-  To make such broken servers work, the --ssl-allow-beast option was
-  introduced. Exactly as it sounds, it re-introduces the BEAST vulnerability
-  but on the other hand it allows curl to connect to that kind of strange
-  servers.
+To make such broken servers work, the --ssl-allow-beast option was
+introduced. Exactly as it sounds, it re-introduces the BEAST vulnerability
+but on the other hand it allows curl to connect to that kind of strange
+servers.
 
 ## Disabling certificate revocation checks
 
-  Some SSL backends may do certificate revocation checks (CRL, OCSP, etc)
-  depending on the OS or build configuration. The --ssl-no-revoke option was
-  introduced in 7.44.0 to disable revocation checking but currently is only
-  supported for Schannel (the native Windows SSL library), with an exception
-  in the case of Windows' Untrusted Publishers block list which it seems cannot
-  be bypassed. This option may have broader support to accommodate other SSL
-  backends in the future.
+Some SSL backends may do certificate revocation checks (CRL, OCSP, etc)
+depending on the OS or build configuration. The --ssl-no-revoke option was
+introduced in 7.44.0 to disable revocation checking but currently is only
+supported for Schannel (the native Windows SSL library), with an exception
+in the case of Windows' Untrusted Publishers block list which it seems cannot
+be bypassed. This option may have broader support to accommodate other SSL
+backends in the future.
 
-  References:
+References:
 
-  https://curl.se/docs/ssl-compared.html
+https://curl.se/docs/ssl-compared.html
diff --git a/third-party/curl/docs/SSLCERTS.md b/third-party/curl/docs/SSLCERTS.md
index 4094e2fec6..d5110e18f0 100644
--- a/third-party/curl/docs/SSLCERTS.md
+++ b/third-party/curl/docs/SSLCERTS.md
@@ -1,155 +1,159 @@
-SSL Certificate Verification
-============================
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
 
-SSL is TLS
-----------
+SPDX-License-Identifier: curl
+-->
 
-SSL is the old name. It is called TLS these days.
+# TLS Certificate Verification
 
-Native SSL
-----------
+## Native vs file based
 
-If libcurl was built with Schannel or Secure Transport support (the native SSL
-libraries included in Windows and Mac OS X), then this does not apply to
-you. Scroll down for details on how the OS-native engines handle SSL
-certificates. If you are not sure, then run "curl -V" and read the results. If
-the version string says `Schannel` in it, then it was built with Schannel
-support.
+If curl was built with Schannel support, then curl uses the Windows native CA
+store for verification. On Apple operating systems, it is possible to use Apple's
+"SecTrust" services for certain TLS backends, details below.
+All other TLS libraries use a file based CA store by
+default.
 
-It is about trust
------------------
+## Verification
 
-This system is about trust. In your local CA certificate store you have certs
-from *trusted* Certificate Authorities that you then can use to verify that
-the server certificates you see are valid. They are signed by one of the
-certificate authorities you trust.
+Every trusted server certificate is digitally signed by a Certificate
+Authority, a CA.
 
-Which certificate authorities do you trust? You can decide to trust the same
-set of companies your operating system trusts, or the set one of the known
-browsers trust. That is basically trust via someone else you trust. You should
-just be aware that modern operating systems and browsers are setup to trust
-*hundreds* of companies and in recent years several certificate authorities
-have been found untrustworthy.
+In your local CA store you have a collection of certificates from *trusted*
+certificate authorities that TLS clients like curl use to verify servers.
 
-Certificate Verification
-------------------------
-
-libcurl performs peer SSL certificate verification by default. This is done
-by using a CA certificate store that the SSL library can use to make sure the
-peer's server certificate is valid.
+curl does certificate verification by default. This is done by verifying the
+signature and making sure the certificate was crafted for the server name
+provided in the URL.
 
 If you communicate with HTTPS, FTPS or other TLS-using servers using
-certificates in the CA store, you can be sure that the remote server really is
-the one it claims to be.
+certificates signed by a CA whose certificate is present in the store, you can
+be sure that the remote server really is the one it claims to be.
 
-If the remote server uses a self-signed certificate, if you do not install a CA
-cert store, if the server uses a certificate signed by a CA that is not
+If the remote server uses a self-signed certificate, if you do not install a
+CA cert store, if the server uses a certificate signed by a CA that is not
 included in the store you use or if the remote host is an impostor
-impersonating your favorite site, and you want to transfer files from this
-server, do one of the following:
+impersonating your favorite site, the certificate check fails and reports an
+error.
 
- 1. Tell libcurl to *not* verify the peer. With libcurl you disable this with
-    `curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, FALSE);`
+If you think it wrongly failed the verification, consider one of the following
+sections.
 
-    With the curl command line tool, you disable this with `-k`/`--insecure`.
+### Skip verification
 
- 2. Get a CA certificate that can verify the remote server and use the proper
-    option to point out this CA cert for verification when connecting. For
-    libcurl hackers: `curl_easy_setopt(curl, CURLOPT_CAINFO, cacert);`
+Tell curl to *not* verify the peer with `-k`/`--insecure`.
 
-    With the curl command line tool: `--cacert [file]`
+We **strongly** recommend this is avoided and that even if you end up doing
+this for experimentation or development, **never** skip verification in
+production.
 
- 3. Add the CA cert for your server to the existing default CA certificate
-    store. The default CA certificate store can be changed at compile time with
-    the following configure options:
+### Use a custom CA store
 
-    `--with-ca-bundle=FILE`: use the specified file as the CA certificate
-    store. CA certificates need to be concatenated in PEM format into this
-    file.
+Get a CA certificate that can verify the remote server and use the proper
+option to point out this CA cert for verification when connecting - for this
+specific transfer only.
 
-    `--with-ca-path=PATH`: use the specified path as CA certificate store. CA
-    certificates need to be stored as individual PEM files in this directory.
-    You may need to run c_rehash after adding files there.
+With the curl command line tool: `--cacert [file]`
 
-    If neither of the two options is specified, configure will try to
-    auto-detect a setting. It's also possible to explicitly not set any
-    default store but rely on the built in default the crypto library may
-    provide instead. You can achieve that by passing both
-    `--without-ca-bundle` and `--without-ca-path` to the configure script.
+If you use the curl command line tool without a native CA store, then you can
+specify your own CA cert file by setting the environment variable
+`CURL_CA_BUNDLE` to the path of your choice. `SSL_CERT_FILE` and `SSL_CERT_DIR`
+are also supported.
 
-    If you use Internet Explorer, this is one way to get extract the CA cert
-    for a particular server:
+If you are using the curl command line tool on Windows, curl searches for a CA
+cert file named `curl-ca-bundle.crt` in these directories and in this order:
+  1. application's directory
+  2. current working directory
+  3. Windows System directory (e.g. C:\Windows\System32)
+  4. Windows Directory (e.g. C:\Windows)
+  5. all directories along %PATH%
 
-     - View the certificate by double-clicking the padlock
-     - Find out where the CA certificate is kept (Certificate>
-       Authority Information Access>URL)
-     - Get a copy of the crt file using curl
-     - Convert it from crt to PEM using the OpenSSL tool:
-       `openssl x509 -inform DES -in yourdownloaded.crt -out outcert.pem -text`
-     - Add the `outcert.pem` to the CA certificate store or use it stand-alone
-       as described below.
+curl 8.11.0 added a build-time option to disable this search behavior, and
+another option to restrict search to the application's directory.
 
-    If you use the `openssl` tool, this is one way to get extract the CA cert
-    for a particular server:
+curl 8.19.0 added a build-time option to enable Native CA by default on
+Windows. This build-time option by default also disables searching for
+a `curl-ca-bundle.crt` on disk.
 
-     - `openssl s_client -showcerts -servername server -connect server:443 > cacert.pem`
-     - type "quit", followed by the "ENTER" key
-     - The certificate will have "BEGIN CERTIFICATE" and "END CERTIFICATE"
-       markers.
-     - If you want to see the data in the certificate, you can do: `openssl
-       x509 -inform PEM -in certfile -text -out certdata` where `certfile` is
-       the cert you extracted from logfile. Look in `certdata`.
-     - If you want to trust the certificate, you can add it to your CA
-       certificate store or use it stand-alone as described. Just remember that
-       the security is no better than the way you obtained the certificate.
+### Use the native store
 
- 4. If you are using the curl command line tool, you can specify your own CA
-    cert file by setting the environment variable `CURL_CA_BUNDLE` to the path
-    of your choice.
+In several environments, in particular on Microsoft and Apple operating
+systems, you can ask curl to use the system's native CA store when verifying
+the certificate. Depending on how curl was built, this may already be the
+default.
 
-    If you are using the curl command line tool on Windows, curl will search
-    for a CA cert file named "curl-ca-bundle.crt" in these directories and in
-    this order:
-      1. application's directory
-      2. current working directory
-      3. Windows System directory (e.g. C:\windows\system32)
-      4. Windows Directory (e.g. C:\windows)
-      5. all directories along %PATH%
+With the curl command line tool: `--ca-native`.
 
- 5. Get a better/different/newer CA cert bundle! One option is to extract the
-    one a recent Firefox browser uses by running 'make ca-bundle' in the curl
-    build tree root, or possibly download a version that was generated this
-    way for you: [CA Extract](https://curl.se/docs/caextract.html)
+### Modify the CA store
 
-Neglecting to use one of the above methods when dealing with a server using a
-certificate that is not signed by one of the certificates in the installed CA
-certificate store, will cause SSL to report an error ("certificate verify
-failed") during the handshake and SSL will then refuse further communication
-with that server.
+Add the CA cert for your server to the existing default CA certificate store.
 
-Certificate Verification with Schannel and Secure Transport
------------------------------------------------------------
+Usually you can figure out the path to the local CA store by looking at the
+verbose output that `curl -v` shows when you connect to an HTTPS site.
 
-If libcurl was built with Schannel (Microsoft's native TLS engine) or Secure
-Transport (Apple's native TLS engine) support, then libcurl will still perform
-peer certificate verification, but instead of using a CA cert bundle, it will
-use the certificates that are built into the OS. These are the same
-certificates that appear in the Internet Options control panel (under Windows)
-or Keychain Access application (under OS X). Any custom security rules for
-certificates will be honored.
+### Change curl's default CA store
 
-Schannel will run CRL checks on certificates unless peer verification is
-disabled. Secure Transport on iOS will run OCSP checks on certificates unless
-peer verification is disabled. Secure Transport on OS X will run either OCSP
-or CRL checks on certificates if those features are enabled, and this behavior
-can be adjusted in the preferences of Keychain Access.
+The default CA certificate store curl uses is set at build time. When you
+build curl you can point out your preferred path.
 
-HTTPS proxy
------------
+### Extract CA cert from a server
 
-Since version 7.52.0, curl can do HTTPS to the proxy separately from the
-connection to the server. This TLS connection is handled separately from the
-server connection so instead of `--insecure` and `--cacert` to control the
+    curl -w %{certs} https://example.com > cacert.pem
+
+The certificate has `BEGIN CERTIFICATE` and `END CERTIFICATE` markers.
+
+### Get the Mozilla CA store
+
+Download a version of the Firefox CA store converted to PEM format on the [CA
+Extract](https://curl.se/docs/caextract.html) page. It always features the
+latest Firefox bundle.
+
+## Native CA store
+
+### Windows + Schannel
+
+If curl was built with Schannel, then curl uses the certificates that are
+built into the OS. These are the same certificates that appear in the
+Internet Options control panel (under Windows).
+Any custom security rules for certificates are honored.
+
+Schannel runs CRL checks on certificates unless peer verification is disabled.
+
+### Apple + OpenSSL/GnuTLS
+
+When curl is built with Apple SecTrust enabled and uses an OpenSSL compatible
+TLS backend or GnuTLS, the default verification is handled by that Apple
+service. As in:
+
+    curl https://example.com
+
+You may still provide your own certificates on the command line, such as:
+
+    curl --cacert mycerts.pem https://example.com
+
+In this situation, Apple SecTrust is **not** used and verification is done
+**only** with the trust anchors found in `mycerts.pem`. If you want **both**
+Apple SecTrust and your own file to be considered, use:
+
+    curl --ca-native --cacert mycerts.pem https://example.com
+
+#### Other Combinations
+
+How well the use of native CA stores work in all other combinations depends
+on the TLS backend and the OS. Many TLS backends offer functionality to access
+the native CA on a range of operating systems. Some provide this only on specific
+configurations.
+
+Specific support in curl exists for Windows and OpenSSL compatible TLS backends.
+It tries to load the certificates from the Windows "CA" and "ROOT" stores for
+transfers requesting the native CA. Due to Window's delayed population of those
+stores, this might not always find all certificates.
+
+## HTTPS proxy
+
+curl can do HTTPS to the proxy separately from the connection to the server.
+This TLS connection is handled and verified separately from the server
+connection so instead of `--insecure` and `--cacert` to control the
 certificate verification, you use `--proxy-insecure` and `--proxy-cacert`.
 With these options, you make sure that the TLS connection and the trust of the
 proxy can be kept totally separate from the TLS connection to the server.
diff --git a/third-party/curl/docs/THANKS b/third-party/curl/docs/THANKS
index a8a4d6a1b5..a70bf7527d 100644
--- a/third-party/curl/docs/THANKS
+++ b/third-party/curl/docs/THANKS
@@ -6,22 +6,29 @@
 
 0xee on github
 0xflotus on github
+0xN3R3K3
+11soda11
 12932 on github
 1337vt on github
 1ocalhost on github
 3dyd on github
 3eka on github
+4lan.m
+5533asdg on github
 8U61ife on github
+9cel
 a1346054 on github
 Aaro Koskinen
 Aaron Oneal
 Aaron Orenstein
 Aaron Scarisbrick
 aasivov on github
+Abdullah Alyan
 Abhinav Singh
+Abhinav Singhal
 Abram Pousada
 accountantM on github
-AceCrow on Github
+AceCrow on github
 ad0p on github
 Adam Averay
 Adam Barclay
@@ -34,63 +41,63 @@ Adam Marcionek
 Adam Piggott
 Adam Rosenfield
 Adam Sampson
+adamse on github
 Adam Tkac
+ad-chaos on github
+Aditya Garg
+�dler Jonas Gross
 Adnan Khan
 adnn on github
 Adrian Burcea
+Adriano Meirelles
 Adrian Peniak
 Adrian Schuur
-Adriano Meirelles
+Ady Elouej
+afengsoft on github
 afrind on github
 Aftab Alam
+Ahmad Gani
 ahodesuka on github
+aisle-research-bot
 ajak in #curl
 Ajit Dhumale
+A Johnston
+Akhilesh Nema
 Akhil Kedia
 Aki Koskinen
+Aki Sakurai
 Akos Pasztory
 Akshay Vernekar
 Alain Danteny
 Alain Miniussi
+Alan Coopersmith
+Alan De Smet
 Alan Jenkins
 Alan Pinstein
 Albert Chin-A-Young
 Albert Choy
+Alberto Leiva Popper
 Albin Vass
+albrechtd on github
 Alejandro Alvarez Ayllon
 Alejandro Colomar
 Alejandro R. Sedeño
 Aleksandar Milivojevic
 Aleksander Mazur
 Aleksandr Krotov
+Aleksandr Sergeev
+Aleksei Bavshin
 Aleksey Tulinov
+alervd on github
 Ales Mlakar
 Ales Novak
 Alessandro Ghedini
 Alessandro Vesely
 Alex aka WindEagle
-Alex Baines
-Alex Bligh
-Alex Chan
-Alex Crichton
-Alex Fishman
-Alex Gaynor
-Alex Grebenschikov
-Alex Gruz
-Alex Kiernan
-Alex Konev
-Alex Malinovich
-Alex Mayorga
-Alex McLellan
-Alex Neblett
-Alex Nichols
-Alex Potapenko
-Alex Rousskov
-Alex Samorukov
-Alex Suykov
-Alex Vinnik
-Alex Xu
+Alexander Bartel
+Alexander Batischev
 Alexander Beedie
+Alexander Blach
 Alexander Chuykov
 Alexander Dyagilev
 Alexander Elgert
@@ -102,6 +109,7 @@ Alexander Krasnostavsky
 Alexander Lazic
 Alexander Pepper
 Alexander Peslyak
+Alexander Shtuchkin
 Alexander Sinditskiy
 Alexander Traud
 Alexander V. Tikhonov
@@ -109,28 +117,63 @@ Alexander Zhuravlev
 Alexandre Bury
 Alexandre Ferrieux
 Alexandre Pion
+Alex Baines
+Alex Bligh
+Alex Bozarth
+Alex Chan
+Alex Crichton
 Alexey Borzov
 Alexey Eremikhin
+Alexey Larikov
 Alexey Melnichuk
 Alexey Pesternikov
 Alexey Savchuk
 Alexey Simak
 Alexey Zakhlestin
+Alex Fishman
+Alex Gaynor
+Alex Grebenschikov
+Alex Gruz
+Alex Hamilton
 Alexis Carvalho
 Alexis La Goutte
+Alexis Savin
 Alexis Vachette
+Alex Kiernan
+Alex Klyubin
+Alex Konev
+Alex Malinovich
+Alex Mayorga
+Alex McLellan
+Alex Neblett
+Alex Nichols
+Alex Potapenko
+Alex Rousskov
+Alex Samorukov
+Alex Snast
+Alex Suykov
+Alex Vinnik
+Alex Xu
 Alfonso Martone
 Alfred Gebert
+alhudz
+Alice Lee Poetics
+alienowo on hackerone
 Ali Khodkar
-Ali Utku Selen
 ALittleDruid on github
+Ali Utku Selen
 Allen Pulsifer
 Alois Klink
 Alona Rossen
 Amaury Denoyelle
+ambikeesshh
+Ameda Amahru
 amishmm on github
+amitbidlan
 Amit Katyal
+Ammar Faizi
 Amol Pattekar
+am-perip on hackerone
 Amr Shahin
 Anatol Belski
 Anatoli Tubman
@@ -138,18 +181,17 @@ Anders Bakken
 Anders Berg
 Anders Gustafsson
 Anders Havn
-Anders Roxell
 Anderson Sasaki
 Anderson Toshiyuki Sasaki
+Anders Roxell
 Andi Jahja
-Andre Guibert de Bruet
-Andre Heinecke
 Andrea Pappacoda
 Andreas Damm
 Andreas Falkenhahn
 Andreas Farber
 Andreas Fischer
 Andreas Huebner
+Andreas Kiefer
 Andreas Kostyrka
 Andreas Malzahn
 Andreas Ntaflos
@@ -160,11 +202,16 @@ Andreas Schneider
 Andreas Schuldei
 Andreas Sommer
 Andreas Streichardt
+Andreas Westin
 Andreas Wurf
+Andre Guibert de Bruet
+Andre Heinecke
 Andrei Benea
 Andrei Bica
 Andrei Cipu
+Andrei Florea
 Andrei Karas
+Andrei Korshikov
 Andrei Kurushin
 Andrei Neculau
 Andrei Rybak
@@ -172,6 +219,9 @@ Andrei Sedoi
 Andrei Valeriu BICA
 Andrei Virtosu
 Andrej E Baranov
+Andrés García
+Andrew
+Andrew Ayer
 Andrew Barnert
 Andrew Barnes
 Andrew Benham
@@ -181,10 +231,15 @@ Andrew de los Reyes
 Andrew Francis
 Andrew Fuller
 Andrew Ishchuk
+Andrew Kaster
+Andrew Kirillov
 Andrew Krieger
 Andrew Kurushin
+Andrew Kvalheim
 Andrew Lambert
 Andrew Moise
+Andrew Nesbitt
+Andrew Olsen
 Andrew Potter
 Andrew Robbins
 Andrew Wansink
@@ -193,16 +248,22 @@ Andrey Gursky
 Andrey Labunets
 Andrii Moiseiev
 Andrius Merkys
-Andrés García
+Andriy Druk
 Andy Alt
 Andy Cedilnik
 Andy Fiddaman
+Andy Pan
+Andy Reitz
 Andy Serpa
 Andy Stamp
 Andy Tsouladze
+And-yW on github
 Angus Mackay
 anio on github
+annalee
+Anna Liberty
 anon00000000 on github
+anonymous237 on hackerone
 anshnd on github
 Anssi Kolehmainen
 Antarpreet Singh
@@ -214,28 +275,39 @@ Anthony Hu
 Anthony Ramine
 Anthony Shaw
 Antoine Aubert
+Antoine Bollengier
 Antoine Calando
 Antoine du Hamel
 Antoine Pietri
 Antoine Pitrou
 Anton Bychkov
 Anton Gerasimov
+Antonio Larrosa
+Antoni Villalonga
 Anton Kalmykov
 Anton Malov
-Anton Yabchinskiy
-Antoni Villalonga
-Antonio Larrosa
 Antony74 on github
+Anton Yabchinskiy
 Antti Hätälä
+antypanty on hackerone
+Anubhav Rai
 apparentorder on github
 April King
+Aquila Macedo
 arainchik on github
 Archangel_SDY on github
+Arian van Putten
+Aritra Basu
+Arjan van de Ven
 Arkadiusz Miskiewicz
+Arkadi Vainbrand
+arlt on github
 Armel Asselin
 Arnaud Compan
 Arnaud Ebalard
 Arnaud Rebillout
+Arnav Purushotam
+Arnav-Purushotam-CUBoulder
 Arne Soete
 Aron Bergman
 Aron Rotteveel
@@ -246,16 +318,22 @@ Arve Knudsen
 Arvid Norberg
 arvids-kokins-bidstack on github
 asavah on github
+Asger Hautop Drewsen
 Ashish Shukla
 Ashwin Metpalli
-Ask Bjørn Hansen
 Askar Safin
+Ask Bjørn Hansen
 AtariDreams on github
 Ates Goral
 atjg on github
+Augment code
 Augustus Saunders
+Aurélien Pierre
 Austin Green
+Austin Moore
+av223119 on github
 Avery Fay
+awesomekosm on github
 awesomenode on github
 Axel Chong
 Axel Morawietz
@@ -263,40 +341,44 @@ Axel Tillequin
 Ayesh Karunaratne
 Ayoub Boudhar
 Ayushman Singh Chauhan
+azraelxuemo on hackerone
 b9a1 on github
 Bachue Zhou
 Baitinq on github
 Balaji Parasuram
-Balaji S Rao
 Balaji Salunke
+Balaji S Rao
 Balakrishnan Balasubramanian
 Balazs Kovacsics
-balikalina on Github
+balikalina on github
 Balint Szilakszi
+BANADDA
+baranyaib90 on github
 Barry Abrahamson
 Barry Pollard
+Bartel Sielski
+Bartosz Ruszczak
 Bart Whiteley
 Baruch Siach
 Bas Mevissen
-Bas van Schaik
+Bastian Jesuiter
 Bastian Krause
 Bastien Bouclet
 Basuke Suzuki
+Bas van Schaik
 baumanj on github
+BazaarAcc32 on github
 bdry on github
 beckenc on github
+behindtheblackwall on hackerone
+Ben
+Benau on github
+Ben Bodenmiller
 Ben Boeckel
+Benbuck Nason
 Ben Darnell
 Ben Fritz
 Ben Greear
-Ben Kohler
-Ben Madsen
-Ben Noordhuis
-Ben Van Hof
-Ben Voris
-Ben Winslow
-Benau on github
-Benbuck Nason
 Benjamin Gerard
 Benjamin Gilbert
 Benjamin Johnson
@@ -305,9 +387,16 @@ Benjamin Loison
 Benjamin Riefenstahl
 Benjamin Ritcey
 Benjamin Sergeant
-Benoit Neil
+Ben Kohler
+Ben Madsen
+Ben Noordhuis
+Benoit Neil (Sukender)
 Benoit Pierre
 Benoit Sigoure
+Ben Van Hof
+Ben Voris
+Ben Winslow
+Ben Zanin
 Bernard Leak
 Bernard Spil
 Bernat Mut
@@ -316,21 +405,26 @@ Bernhard Iselborn
 Bernhard M. Wiedemann
 Bernhard Reutner-Fischer
 Bernhard Walle
+Berthin Torres Callañaupa
 Bert Huijben
 Bertrand Demiddelaer
 Bertrand Simonnet
 beslick5 on github
 Bevan Weiss
+Bhanu Prakash
 Bill Doyle
 Bill Egert
 Bill Hoffman
+billionai on github
 Bill Middlecamp
+Bill Mill
 Bill Nagel
 Bill Pyne
-billionai on github
+Billy O'Neal
 Billyzou0741326 on github
 Bin Lan
 Bin Meng
+bird on github
 Biswapriyo Nath
 Bjarni Ingi Gislason
 Bjoern Franke
@@ -338,112 +432,150 @@ Bjoern Sikora
 Bjorn Augustsson
 Bjorn Reese
 Björn Stenberg
+black-desk on github
+BlackFuffey on github
 Blaise Potard
 Blake Burkhart
+blankie
 bnfp on github
+bo0tzz on github
 Bo Anderson
+bobmitchell1956 on github
+BobodevMm on github
 Bob Relyea
 Bob Richmond
 Bob Schader
-bobmitchell1956 on github
 Bodo Bergmann
 Bogdan Nicula
+BohwaZ
+boilingoden
+boingball
 Boris Kuschel
 Boris Okunskiy
 Boris Rasin
 Boris Verkhovskiy
 Brad Burdick
 Brad Fitzpatrick
+Bradford Bruce
 Brad Forschinger
 Brad Harder
 Brad Hards
+Brad House
 Brad King
 Brad Spencer
-Bradford Bruce
 bramus on github
 Brandon Casey
 Brandon Dong
 Brandon Wang
 BratSinot on github
+Brendan Dolan-Gavitt
 Brendan Jurd
+Brendon Smith
+Brennan Kinney
 Brent Beardsley
+Brett Buddin
 Brian Akins
 Brian Bergeron
 Brian Carpenter
 Brian Chaplin
 Brian Childs
 Brian Chrisman
+Brian Chrzanowski
+Brian Clemens
 Brian Dessent
 Brian E. Gallew
 Brian Green
+Brian Harris
 Brian Inglis
 Brian J. Murrell
 Brian Lund
+brian m. carlson
 Brian Nixon
 Brian Prodoehl
 Brian R Duffy
 Brian Ulm
 Brock Noland
-Bru Rom
 Bruce Mitchener
 Bruce Stephens
+bruce.yoon
 BrumBrum on hackerone
 Bruno Baguette
 Bruno de Carvalho
 Bruno Grasselli
 Bruno Henrique Batista Cruz da Silva
 Bruno Thomsen
+Bru Rom
 Bryan Henderson
 Bryan Kemp
 bsammon on github
 bsergean on github
+bsr13 on hackerone
+bttrfl on github
+bubbleguuum on github
 Bubu on github
 buzo-ffm on github
 bxac on github
 Bylon2 on github
 Byrial Jensen
+ByteRay on hackerone
+Cajus Pollmeier
 Caleb Raitto
+calm329
+calvin2021y on github
 Calvin Buckley
+Calvin Ruocco
 Cameron Blomquist
 Cameron Cawley
 Cameron Kaiser
 Cameron MacMinn
 Cameron Will
 Camille Moncelier
-Cao ZhenXiang
 Caolan McNamara
+Caolán McNamara
+Cao ZhenXiang
 Captain Basil
 Carie Pointer
-Carl Zogheib
 Carlo Alberto
+Carlo Cabrera
 Carlo Cannas
 Carlo Marcelo Arenas Belón
+Carlos Carrillo
+Carlos Henrique Lima Melara
+Carlos ORyan
 Carlo Teubner
 Carlo Wood
-Carlos ORyan
+Carl Zogheib
 Carsten Lange
 Casey Bodley
 Casey O'Donnell
 Catalin Patulea
+Catena cyber
 causal-agent on github
 cbartl on github
 cclauss on github
+Cédric Connes
+Cédric Deltheil
 Cering on github
 Cesar Eduardo Barros
+Ch40zz on github
 Chad Monroe
 Chandrakant Bagul
+Chara White
 Charles Cazabon
 Charles Kerr
 Charles Romestant
+Charlie C
+chemodax
 Chen Prog
+chensong1211 on github
 Cherish98 on github
 Chester Liu
 Chih-Chung Chang
 Chih-Hsuan Yen
 Chilledheart on github
 Chloe Kudryavtsev
-Chris "Bob Bob"
 Chris Araman
+Chris "Bob Bob"
 Chris Carlmar
 Chris Combes
 Chris Conlon
@@ -455,123 +587,149 @@ Chris Maltby
 Chris Mumford
 Chris Paulson-Ellis
 Chris Roberts
+Chris Sauer
 Chris Smowton
+Chris Stubbs
+Chris Swan
 Chris Talbot
-Chris Young
 Christian Fillion
 Christian Grothoff
+Christian Hägele
 Christian Heimes
 Christian Hesse
-Christian Hägele
+Christian Heusel
 Christian Krause
 Christian Kurz
 Christian Robottom Reis
 Christian Schmitz
+Christian Schmitza
 Christian Stewart
 Christian Vogt
 Christian Weisgerber
-Christoph Krey
-Christoph M. Becker
-Christoph Reiter
 Christophe Demory
 Christophe Dervieux
 Christophe Legry
+Christopher Boyd
 Christopher Conroy
+Christopher Dannemiller
 Christopher Degawa
 Christopher Head
 Christopher Palow
-Christopher R. Palmer
 Christopher Reid
+Christopher R. Palmer
 Christopher Sauer
 Christopher Stone
+Christopher Wellons
+Christoph Jabs
+Christoph Krey
+Christoph M. Becker
+Christoph Reiter
+Chris Webb
+Chris Young
+chrizilla on github
+chrysos349 on github
 Chungtsun Li
 Ciprian Badescu
 civodul on github
 Claes Jakobsson
 Clarence Gardner
 Claudio Neves
+claudiusaiz on github
 clbr on github
 Clemens Gruber
+Clément Notin
 Cliff Crosland
 Clifford Wolf
 Clint Clayton
 Cloudogu Siebels
-Clément Notin
+CMD
 cmfrolick on github
+co-authors in libssh2
 codesniffer13 on github
 Cody Jones
 Cody Mack
 COFFEETALES on github
 coinhubs on github
 Colby Ranger
+Cole Helbling
+Cole Leavitt
 Colin Blair
 Colin Cross
 Colin Hogben
 Colin Leroy
+Colin Leroy-Mira
 Colin O'Dell
 Colin Watson
-Colm Buckley
 Colman Mbuya
+Colm Buckley
+Colton Willey
 Constantine Sapuntzakis
+consulion on github
+cooldadpresident on github
 coralw on github
+Corinna Brandt
 correctmost on github
 Cory Benfield
 Cory Nelson
 Costya Shulyupin
-Craig A West
 Craig Andrews
+Craig A West
 Craig Davison
 Craig de Stigter
 Craig Markwardt
+crawfordxx
 crazydef on github
 Cris Bailiff
 Cristian Greco
 Cristian Morales Vega
 Cristian Rodríguez
+CueXXIII on github
+curl.stunt430
 Curt Bogmine
+Cutiapreta on hackerone
 Cynthia Coan
 Cyril B
 Cyrill Osterwalder
-Cédric Connes
-Cédric Deltheil
-D. Flinkmann
+d1r3ct0r
 d4d on hackerone
 d912e3 on github
-Da-Yoon Chung
 daboul on github
 Dag Ekengren
+Dag-Erling Smørgrav
+Dagfinn Ilmari Mannsåker
+Dag Haavi Finstad
 Dagobert Michelsen
+dahmono on github
 Daiki Ueno
 Dair Grant
+Dalei
 Dambaev Alexander
 Damian Dixon
 Damien Adant
 Damien Vielpeau
 Damien Walsh
+Dan Arnfield
 Dan Becker
 Dan Cristian
 Dan Donahue
 Dan Fandrich
-Dan Frandrich
-Dan Johnson
-Dan Kenigsberg
-Dan Locks
-Dan McNulty
-Dan Nelson
-Dan Petitt
-Dan Torop
-Dan Zitter
 Daniel at touchtunes
+Dániel Bakai
 Daniel Bankhead
 Daniel Black
+Daniel Böhmer
 Daniel Carpenter
 Daniel Cater
+Daniel Díaz
 Daniel Egger
+Daniel Engberg
 Daniel Faust
+Daniel Fosco
 Daniel Gustafsson
 Daniel Hallberg
 Daniel Hwang
 Daniel Jeliński
+Daniel J. H.
 Daniel Johnson
 Daniel Kahn Gillmor
 Daniel Katz
@@ -580,33 +738,56 @@ Daniel Kure�ka
 Daniel Lee Hwang
 Daniel Lublin
 Daniel Marjamäki
+Daniel McCarney
 Daniel Melani
 Daniel Mentz
+Daniel Pouzzner
 Daniel Romero
+Daniel Santos
 Daniel Schauenberg
+Daniel Schulte
 Daniel Seither
 Daniel Shahaf
 Daniel Silverstone
 Daniel Steinberg
 Daniel Stenberg
+Daniel Szmulewicz
+Daniel Terhorst-North
 Daniel Theron
 Daniel Valenzuela
+Daniel Wade
 Daniel Woelfel
+Daniil Gentili
+Dan Johnson
+Dan Kenigsberg
+Dan Locks
+Dan McDonald
+Dan McNulty
+Dan Nelson
+Dan Petitt
+Dan Rosser
+Dan Torop
+Dan Zitter
 Daphne Luong
+Darío Hereñú
 Dario Nieuwenhuis
+Dario Vinella
 Dario Weißer
+Darren Banfi
 Darryl House
 Darshan Mody
-Darío Hereñú
 dasimx on github
+DasKutti on github
 Dave Cottlehuber
 Dave Dribin
 Dave Halbakken
 Dave Hamilton
 Dave May
+Dave Nicolson
 Dave Reisner
 Dave Thompson
 Dave Vasilevsky
+Dave Walker
 Davey Shafik
 David Bau
 David Benjamin
@@ -618,19 +799,23 @@ David Carlier
 David Cohen
 David Cook
 David Demelier
-David E. Narváez
 David Earl
+Davide Cassioli
+davidedec on github
+Davide Masserut
+David E. Narváez
 David Eriksson
 David Garske
 David Goerger
 David Houlder
 David Hu
 David Hull
-David J Meyer
 David James
+David J Meyer
 David Kalnischkies
 David Kierznowski
 David Kimdon
+David Korczynski
 David L.
 David Lang
 David LeBlanc
@@ -643,22 +828,31 @@ David Phillips
 David Rosenstrauch
 David Ryskalczyk
 David Sanderson
+David Sardari
 David Schweikert
 David Shaw
 David Strauss
+David Suter
 David Tarendash
 David Thiel
 David Walser
 David Woodhouse
 David Wright
 David Yan
-Davide Cassioli
-Davide Masserut
-davidedec on github
+David Zhuang
+daviey on hackerone
+Da-Yoon Chung
+dbalsom
 dbrowndan on github
+dEajL3kA
 dEajL3kA on github
 Deal(一线�)
+defnull
 dekerser on github
+deliciouslytyped on github
+delogicsreal on github
+Demi Marie Obenour
+denandz on github
 dengjfzh on github
 Dengminwen
 Denis Baru�ić
@@ -667,13 +861,22 @@ Denis Feklushkin
 Denis Goleshchikhin
 Denis Laxalde
 Denis Ollier
+Deniz Parlak
+Deniz Sökmen
 Dennis Clarke
 Dennis Felsing
+dependabot[bot]
 Derek Higgins
+Derek Huang
 Derzsi Dániel
 Desmond O. Chang
 destman on github
 Detlef Schmier
+Devdatta Talele
+devgs on github
+Dexter Gerig
+dfdity on github
+D. Flinkmann
 Dheeraj Sangamkar
 Didier Brisebourg
 Diego Bes
@@ -689,14 +892,17 @@ Dimitrios Apostolou
 Dimitrios Siganos
 Dimitris Sarris
 Dinar
+Diogo Correia
 Diogo Teles Sant'Anna
 Dion Williams
+Dio Putra
 Dirk Eddelbuettel
 Dirk Feytons
+Dirk Hünniger
+Dirkjan Bussink
 Dirk Manske
 Dirk Rosenkranz
 Dirk Wetter
-Dirkjan Bussink
 Diven Qi
 divinity76 on github
 Divy Le Ray
@@ -717,21 +923,27 @@ Dmitry Mikhirev
 Dmitry Popov
 Dmitry Rechkin
 Dmitry S. Baikov
+Dmitry Tretyakov
 Dmitry Wagin
 dnivras on github
+dogma
+DoI
 Dolbneff A.V
-Domen Kožar
 Domenico Andreoli
+Domen Kožar
 Dominick Meglio
 Dominik Hölzl
 Dominik Klemba
+Dominik PiÄ…tkowski
 Dominik Thalhammer
+Dominik Tomecki
 Dominique Leuenberger
-Don J Olmstead
 Dongliang Mu
+Donguk Kim
+Don J Olmstead
+Dorian Craps
 Doron Behar
 Doug Kaufman
-Doug Porter
 Douglas Creager
 Douglas E. Wegscheid
 Douglas Kilpatrick
@@ -739,6 +951,7 @@ Douglas Mencken
 Douglas R. Horner
 Douglas R. Reno
 Douglas Steinwand
+Doug Porter
 Dov Murik
 dpull on github
 Drake Arconis
@@ -747,14 +960,17 @@ Duane Cathey
 Duncan Mac-Vicar Prett
 Duncan Wilcox
 Dustin Boswell
-Dustin Howett
+Dustin L. Howett
 Dusty Mabe
 Duy Phan Thanh
 Dwarakanath Yadavalli
+dwickr
+Dwij Mehta
+dyingc on github
+Dylam De La Torre
 Dylan Anthony
 Dylan Ellicott
 Dylan Salisbury
-Dániel Bakai
 eaglegai on github
 Early Ehlinger
 Earnestly on github
@@ -762,94 +978,123 @@ Eason-Yu on github
 Ebe Janchivdorj
 ebejan on github
 Ebenezer Ikonne
-Ed Morley
 ed0d2b2ce19451f2
 Eddie Lumpkin
 Edgaras Janušauskas
 Edin Kadribasic
+edmcln on github
 Edmond Yu
+Ed Morley
 Edoardo Lolletti
 Eduard Bloch
+Eduard Strehlau
 Edward Kimmel
 Edward Rudd
 Edward Sheldrake
 Edward Thomson
+Edwin Török
 Eelco Dolstra
 Eetu Ojanen
+eeverettrbx on github
 Egon Eckert
 Egor Pugin
 Ehren Bendler
 Eldar Zaitov
 elelel on github
 elephoenix on github
-Eli Schwartz
 Elia Tufarolo
+Eli Schwartz
+Elise Vance
+Elliot Killick
 Elliot Saba
+Elliott Balsley
 Ellis Pritchard
 Elmira A Semenova
 Elms
 Eloy Degen
 elsamuko on github
+elvinasp on github
 emanruse on github
 Emanuele Bovisio
 Emanuele Torre
+Emanuel Komínek
+Emanuel Krollmann
 Emil Engler
-Emil Lerner
-Emil Romanus
-Emil Österlund
 Emiliano Ida
 Emilio Cobos �lvarez
 Emilio López
+Emilio Pozuelo Monfort
+Emil Lerner
+Emil Österlund
+Emil Romanus
 Emmanuel Tychon
+Emre Çalışkan
+Enno Boland
 Enrico Scholz
 Enrik Berkhan
+enWILLYado on github
+epicmkirzinger on github
 eppesuig
 Eramoto Masaya
+Ercan Ermis
 Eric Cooper
 Eric Curtin
 Eric Gallager
 Eric Hu
+Eric Knibbe
+Erick Nuwendam
 Eric Landes
 Eric Lavigne
 Eric Lubin
 Eric Melville
 Eric Mertens
+Eric Murphy
 Eric Musser
+Eric Norris
+Érico Nogueira
+Érico Nogueira Rolim
 Eric Rautman
 Eric Rescorla
 Eric Ridge
 Eric Rosenquist
-Eric S. Raymond
 Eric Sauvageau
+Eric S. Raymond
 Eric Thelin
 Eric Vergnaud
 Eric Vigeant
 Eric Wong
 Eric Wu
 Eric Young
-Erick Nuwendam
 Erik Jacobsen
 Erik Janssen
 Erik Johansson
 Erik Minekus
 Erik Olsson
+Erik Schnetter
 Erik Stenlund
 Ernest Beinrohr
 Ernst Sjöstrand
 Erwan Legrand
 Erwin Authried
 Esdras de Morais da Silva
+Eshan Kelkar
 Estanislau Augé-Pujadas
+Ethan Alker
+Ethan Everett
 Ethan Glasser Camp
+Ethan Wilkes
 Etienne Simard
 Eugene Kotlyarov
-Evan Jordan
+Eunsoo Kim
 Evangelos Foutras
+Evan Jordan
 Even Rouault
+evergarden1123 on hackerone
 Evert Pot
 Evgeny Grin (Karlson2k)
 Evgeny Turnaev
 eXeC64 on github
+extrimexxx on github
 Eygene Ryabinkin
 Eylem Ugurel
 Fabian Fischer
@@ -857,20 +1102,27 @@ Fabian Frank
 Fabian Hiernaux
 Fabian Keil
 Fabian Ruff
+Fabian Vogt
 Fabian Yamaguchi
 Fabrice Fontaine
+Fabrício Canedo
 Fabrizio Ammollo
 Fahim Chandurwala
 Faizur Rahman
+Faraz Fallahi
+farazrbx on github
 Farzin on github
 Fata Nugraha
 Fawad Mirza
+Fay Stegerman
 FC Stegerman
+Fd929c2CE5fA on github
 fds242 on github
 Federico Bianchi
 Federico Pellegrin
 Fedor Karpelevitch
 Fedor Korotkov
+feelingseas on github
 FeignClaims on github
 Feist Josselin
 Felipe Gasper
@@ -880,12 +1132,21 @@ Felix von Leitner
 Felix Yan
 Feng Tu
 Fernando Muñoz
+ffath-vo on github
+Filipe Casal
 Filip Lundgren
 Filip Salomonsson
 finkjsc on github
+Fiona Klute
 Firefox OS
+Fizn-Ahmd on github
+fjaell on github
 Flameborn on github
+Flavio Amieiro
 Flavio Medeiros
+Florian Eckert
+Florian Friedrich
+Florian Imdahl
 Florian Kohnhäuser
 Florian Pritz
 Florian Schoppmann
@@ -897,8 +1158,12 @@ Francisco Moraes
 Francisco Munoz
 Francisco Olarte
 Francisco Sedano
+François Charlier
+François Michel
 Francois Petitjean
+François Rigault
 Francois Rivard
+Frank Buss
 Frank Denis
 Frank Gevaerts
 Frank Hempel
@@ -908,28 +1173,33 @@ Frank Meier
 Frank Ticheler
 Frank Van Uffelen
 František Ku�era
-François Charlier
-François Michel
-François Rigault
 Frazer Smith
-Fred Machado
-Fred New
-Fred Noz
-Fred Stluka
 Frederic Lepied
 Frederik B
 Frederik Wedel-Heinen
+Fred Machado
+Fred New
+Fred Noz
 Fredrik Thulin
+Fred Stluka
 FuccDucc on github
 Fujii Hironori
 fullincome on github
 fundawang on github
+fuzzard
+Gabe
 Gabriel Corona
 Gabriel Kuri
+Gabriel Marin
 Gabriel Simmer
 Gabriel Sjoberg
+Gaelan Steele
+Gaël Portay
+galen11 on github
 Gambit Communications
 Ganesh Kamath
+Ganesh Viswanathan
+Gao Liyou
 gaoxingwang on github
 Garrett Holmstrom
 Garrett Squire
@@ -940,17 +1210,17 @@ Gautam Mani
 Gavin Wong
 Gavrie Philipson
 Gaz Iqbal
-Gaël Portay
 gclinch on github
 Gealber Morales
 Geeknik Labs
 Geoff Beier
 Georeth Zhou
+George Liu
 Georg Horn
 Georg Huettenegger
 Georg Lippitsch
+Georg Schulz-Allgaier
 Georg Wicherski
-George Liu
 Gerd v. Egidy
 Gergely Nagy
 Gerhard Herre
@@ -960,11 +1230,11 @@ Gerrit Renker
 Ghennadi Procopciuc
 Giancarlo Formicuccia
 Giaslas Georgios
-Gil Weber
 Gilad
 Gilbert Ramirez Jr.
 Gilles Blanc
 Gilles Vollant
+Gil Weber
 Giorgos Oikonomou
 Gisle Vanem
 git-bruh on github
@@ -972,116 +1242,153 @@ GitYuanQu on github
 Giuseppe Attardi
 Giuseppe D'Ambrosio
 Giuseppe Persico
+gkarracer on github
 Gleb Ivanovsky
 Glen A Johnson Jr.
 Glen Nakamura
-Glen Scott
 Glenn de boer
 Glenn Sheridan
 Glenn Strauss
+Glen Scott
 godmar on github
 Godwin Stewart
+Gökhan Şengün
+Gonçalo Carvalho
+Google Big Sleep
 Google Inc.
 Gordon Marler
+Gordon Parke
 Gorilla Maguila
 Goro FUJI
+Götz Babin-Ebell
 Gou Lingfeng
 Graham Campbell
+Graham Christensen
 Grant Erickson
 Grant Pannell
+graywolf on github
 Greg Hewgill
+Greg Hudson
+Greg Kroah-Hartman
 Greg Morse
 Greg Onufer
-Greg Pratt
-Greg Rowe
-Greg Zavertnik
 Gregor Jasny
 Gregory Jefferis
 Gregory Muchka
 Gregory Nicholls
 Gregory Panakkal
 Gregory Szorc
+Greg Pratt
+Greg Rowe
+Greg Zavertnik
 Griffin Downs
 Grigory Entin
 Grisha Levit
+Gruber Glass
+Guancheng Li
+Guannan Wang
+gudyuu on hackerone
 Guenole Bescon
 Guido Berhoerster
+Guilherme Puida
 Guillaume Algis
 Guillaume Arluison
 guitared on github
 Gunamoi Software
+Gunni on github
 Gunter Knauf
 guoxinvmware on github
 Gustaf Hui
 Gustavo Grieco
+Gusted
 Guy Poizat
 GwanYeong Kim
-Gwen Shapira
 Gwenole Beauchesne
-Gökhan Şengün
-Götz Babin-Ebell
+Gwen Shapira
 h1zzz on github
 H3RSKO on github
 Hagai Auro
 Haibo Huang
+Hakan Sunay Halil
 Hamish Mackenzie
+hammlee96 on github
 hamstergene on github
-Han Han
-Han Qiao
+Hamza Bensliman
 Hang Kin Lau
 Hang Su
+Han Han
 Hannah Schierling
 Hannes Magnusson
 Hanno Böck
 Hanno Kranzhoff
-Hans Steegers
+Han Qiao
+Hans-Christian Egtvedt
 Hans-Christian Noren Egtvedt
 Hans-Jurgen May
+Hans Steegers
 Hao Wu
 Hardeep Singh
 Haris Okanovic
+Harmen Stoppels
 Harold Stuart
+Harry Mallon
 Harry Sarson
 Harry Sintonen
 Harshal Pradhan
 Hauke Duden
+Haydar Alaidrus
 Hayden Roche
-He Qin
 Heikki Korpela
 Heinrich Ko
 Heinrich Schaefer
 Helge Klein
+Helmut Grohne
 Helmut K. C. Tessarek
 Helwing Lutz
+Hem Parekh
 Hendrik Visage
 Henning Schild
 Henri Gomez
 Henrik Gaßmann
 Henrik Holst
+henrikjehgmti on github
 Henrik Storner
+Henrique Pereira
 Henry Ludemann
 Henry Roeland
+He Qin
+herbenderbler on github
+herdiyanitdev on hackerone
+Hermes Zhang
 Herve Amblard
 HexTheDragon
+hgdagon on github
 Hide Ishikawa
 Hidemoto Nakada
 highmtworks on github
+hiimmat on github
 Himanshu Gupta
 Hind Montassif
 Hiroki Kurosawa
 Hirotaka Tagawa
 Ho-chi Chen
 Hoi-Ho Chan
+Hongfei Li
 Hongli Lai
 Hongyi Zhao
 Howard Blaise
 Howard Chu
 hsiao yi
+HsiehYuho on github
+htasta
 htasta on github
+huanghuihui0904
 Hubert Kario
 Hugh Macdonald
 Hugo van Kemenade
 humbleacolyte
+Hunt Darlener
+Huseyin Tintas
 Huzaifa Sidhpurwala
 huzunhao on github
 hydra3333 on github
@@ -1096,7 +1403,12 @@ Ian Lynagh
 Ian Spence
 Ian Turner
 Ian Wilkes
+iAroc on github
+IcedCoffeee on github
+iconoclasthero
+icy17 on github
 Ignacio Vazquez-Abrams
+Ignat Loskutov
 Igor Franchuk
 Igor Khristophorov
 Igor Makarov
@@ -1115,13 +1427,15 @@ Ilmari Lauhakangas
 Ilya Kosarev
 imilli on github
 Immanuel Gregoire
-ImpatientHippo on GitHub
+ImpatientHippo on github
 Inca R
 infinnovation-dev on github
 Ingmar Runge
 Ingo Ralf Blum
 Ingo Wilken
 Inho Oh
+Int64x86 on github
+IoannisGS on github
 IonuÈ›-Francisc Oancea
 Irfan Adilovic
 Ironbars13 on github
@@ -1129,19 +1443,26 @@ Irving Wolfe
 Isaac Boukris
 Isaiah Norton
 Ishan SinghLevett
+İsmail Dönmez
+Itay Bookstein
 Ithubg on github
+Ivan
 Ivan Avdeev
-Ivan Tsybulin
+ivanfywang
+Ivan Kuchin
 IvanoG on github
+Ivan Tsybulin
 Ivo Bellin Salarin
 iz8mbw on github
-J. Bromley
-Jack Boos Yu
-Jack Zhang
+Izan on hackerone
+Jacek Migacz
 Jackarain on github
 JackBoosY on github
+Jack Boos Yu
 Jacky Lam
+Jack Zhang
 Jacob Barthelmeh
+Jacob Champion
 Jacob Hoffman-Andrews
 Jacob Mealey
 Jacob Meuser
@@ -1150,11 +1471,15 @@ Jacob Tolar
 Jactry Zeng
 Jad Chamcham
 Jaime Fullaondo
+Jake Yuesong Li
 jakirkham on github
 Jakob Hirsch
 Jakub Bochenski
+Jakub Jelen
+Jakub Stasiak
 Jakub Wilk
 Jakub Zakrzewski
+James Abbatiello
 James Atwill
 James Brown
 James Bursa
@@ -1176,22 +1501,25 @@ Jamie Lokier
 Jamie Newton
 Jamie Wilkinson
 Jan Alexander Steffens
+JanB on github
 Jan Chren
+janedenone on github
 Jan Ehrhardt
 Jan Engelhardt
 Jan Koen Annot
+janko-js on github
 Jan Kunder
 Jan Macku
 Jan Mazur
+Janne Blomqvist
+Janne Johansson
+János Fekete
+Jan-Piet Mens
 Jan Schaumann
 Jan Schmidt
 Jan Van Boghout
 Jan Venekamp
 Jan Verbeek
-Jan-Piet Mens
-JanB on github
-Janne Blomqvist
-Janne Johansson
 Jared Jennings
 Jared Lundell
 Jari Aalto
@@ -1199,11 +1527,13 @@ Jari Sundell
 jasal82 on github
 Jason Baietto
 Jason Glasgow
+Jason Hood
 Jason Juang
 Jason Lee
 Jason Liu
 Jason McDonald
 Jason S. Priebe
+Jason Stangroome
 Javier Barroso
 Javier Blazquez
 Javier G. Sogo
@@ -1212,15 +1542,19 @@ Javier Sixto
 Jay Austin
 Jay Dommaschk
 Jayesh A Shah
+Jay Guerette
+Jay Wu
 Jaz Fresh
 JazJas on github
 jbgoog on github
-Jean Fabrice
-Jean Gressmann
-Jean Jacques Drouin
+J. Bromley
+Jean-Christophe Amiel
 Jean-Claude Chauve
+Jean Fabrice
 Jean-Francois Bertrand
 Jean-Francois Durand
+Jean Gressmann
+Jean Jacques Drouin
 Jean-Louis Lemaire
 Jean-Marc Ranger
 Jean-Noël Rouvignac
@@ -1228,6 +1562,7 @@ Jean-Philippe Barrette-LaPierre
 Jean-Philippe Menil
 Jeff Connelly
 Jeff Hodges
+jeffhuang
 Jeff Johnson
 Jeff King
 Jeff Lawson
@@ -1235,27 +1570,33 @@ Jeff Luszcz
 Jeff Mears
 Jeff Phillips
 Jeff Pohlmeyer
-Jeff Weber
 Jeffrey Tolar
 Jeffrey Walton
 jeffrson on github
+Jeff Weber
+Jelle Raaijmakers
 Jelle van der Waa
 Jenny Heino
 Jens Finkhaeuser
 Jens Rantil
 Jens Schleusener
 Jeremie Rapin
+Jeremy Drake
 Jeremy Falcon
 Jeremy Friesner
 Jeremy Huddleston
 Jeremy Lainé
 Jeremy Lin
 Jeremy Maitin-Shepard
+Jeremy Nicoll
 Jeremy Pearson
+Jérémy Rabasco
+Jérémy Rocher
 Jeremy Tan
 Jeremy Thibault
 Jeroen Koekkoek
 Jeroen Ooms
+Jérôme Leclercq
 Jerome Mao
 Jerome Muffat-Meridol
 Jerome Robert
@@ -1268,46 +1609,70 @@ Jesper Jensen
 Jesse Chisholm
 Jesse Noller
 Jesse Tan
+Jess Lowe
+Jesus Malo Poyatos
 jethrogb on github
+jhauga
 jhoyla on github
+Jiacai Liu
+Jiang Wenjian
+Jiashuo Liang
+Jiawen Geng
+Jicea
 Jie He
+Jiehong on github
 Jilayne Lovejoy
 Jim Beveridge
 Jim Drash
 Jim Freeman
-Jim Fuller
 Jim Hollinger
 Jim King
 Jim Meyering
 Jimmy Gaussen
+Jimmy Sjölund
+Jiří Bok
 Jiri Dvorak
 Jiri Hruska
 Jiri Jaburek
-Jishan Shaikh
 Jiří Malák
+Jiri Stary
+Jishan Shaikh
+Jiwoo Park
+Jixinqi
+Jiyong Yang
+jjchuck on hackerone
+jkamp-aws on github
+jmaggard10 on github
 jmdavitt on github
 jnbr on github
 Jocelyn Jaubert
 Jochem Broekhoff
+Jochen Sprickerhof
+Joe Birr-Pixton
+Joe Cise
 Joe Halpin
-Joe Malicki
-Joe Mason
+JoelAtWisetech on github
 Joel Chen
 Joel Depooter
 Joel Jakobsson
 Joel Teichroeb
+Joe Malicki
+Joe Mason
 joey-l-us on github
 Jofell Gallardo
 Johan Anderson
+Johan Eliasson
 Johan Lantz
-Johan Nilsson
-Johan van Selst
 Johann150 on github
 Johannes Bauer
 Johannes Ernst
 Johannes G. Kristinsson
 Johannes Lesr
 Johannes Schindelin
+Johannes Schlatow
+Johan Nilsson
+Johann Sebastian Schicho
+Johan van Selst
 John A. Bristor
 John Bampton
 John Bradshaw
@@ -1320,10 +1685,10 @@ John Dennis
 John Dunn
 John E. Malmberg
 John Gardiner Myers
-John H. Ayad
 John Hascall
 John Haugabook
 John Hawthorn
+John H. Ayad
 John Janssen
 John Joseph Bachir
 John Kelly
@@ -1332,10 +1697,13 @@ John Lask
 John Levon
 John Lightsey
 John Marino
+John-Mark Bell
 John Marshall
 John McGowan
+Johnny Luong
 John P. McCaskey
 John Porter
+John Rodriguez
 John Schroeder
 John Sherrill
 John Simpson
@@ -1346,13 +1714,31 @@ John Walker
 John Wanghui
 John Weismiller
 John Wilkinson
-John-Mark Bell
-Johnny Luong
 Jojojov on github
+Jonas Bülow
+Jonas Forsman
+Jonas Haag
+Jonas Minnberg
+Jonas Schnelli
+Jonas 'Sortie' Termansen
+Jonas Vautherin
+Jonatan Lander
+Jonatan Vela
+Jonathan Cardoso Machado
+Jonathan Hseu
+Jonathan Matthews
+Jonathan Moerman
+Jonathan Nieder
+Jonathan Perkin
+Jonathan Rosa
+Jonathan Watt
+Jonathan Wernberg
 Jon DeVree
+Jongki Suwandi
 Jon Grubbs
 Jon Johnson Jr
 Jon Nelson
+jonny112 on github
 Jon Rumsey
 Jon Sargeant
 Jon Seymour
@@ -1361,45 +1747,37 @@ Jon Torrey
 Jon Travis
 Jon Turner
 Jon Wilkes
-Jonas Bülow
-Jonas Forsman
-Jonas Haag
-Jonas Minnberg
-Jonas Schnelli
-Jonas Vautherin
-Jonatan Lander
-Jonatan Vela
-Jonathan Cardoso Machado
-Jonathan Hseu
-Jonathan Moerman
-Jonathan Nieder
-Jonathan Watt
-Jonathan Wernberg
-Jongki Suwandi
-jonny112 on github
 Joombalaya on github
 Joonas Kuorilehto
 Jordan Brown
+Jörg Mueller-Tolk
+Jörn Hartroth
 Jose Alf
-Jose Kahan
+Josef Cejka
 Josef Wolf
+José Joaquín Atria
+Jose Kahan
+Joseph Birr-Pixton
 Joseph Chen
 Joseph Tharayil
 Josh Bialkowski
 Josh Brobst
+joshhe on github
+Joshix-1 on github
 Josh Kapell
 Josh McCullough
 Josh Soref
-joshhe on github
 Joshua Kwan
+Joshua Rogers
 Joshua Root
 Joshua Swink
+Joshua Vandaële
 Josie Huddleston
 Josip Medved
 Josue Andrade Gomes
-José Joaquín Atria
 Jozef Kralik
 Juan Barreto
+Juan Belón
 Juan Cruz Viotti
 Juan F. Codagnone
 Juan Ignacio Hervás
@@ -1408,6 +1786,7 @@ Judson Bishop
 Juergen Hoetzel
 Juergen Wilke
 Jukka Pihl
+Julian K.
 Julian Montes
 Julian Noble
 Julian Ospald
@@ -1417,12 +1796,14 @@ Julian Z
 Julien Chaffraix
 Julien Nabet
 Julien Royer
-Jun Tseng
-Jun-ichiro itojun Hagino
-Jun-ya Kato
+Juliusz Sosinowicz
 jungle-boogie on github
 Junho Choi
+Jun-ichiro itojun Hagino
 junsik on github
+Jun Tseng
+Jun-ya Kato
+Jürgen Gmach
 Jurij Smakov
 jurisuk on github
 Juro Bystricky
@@ -1433,42 +1814,46 @@ Justin Ehlert
 Justin Fletcher
 Justin Karneges
 Justin Maggard
+Justin Steventon
 jveazey on github
 jvreelanda on github
 jvvprasad78 on github
 jzinn on github
-János Fekete
-Jérémy Rabasco
-Jérémy Rocher
-Jörg Mueller-Tolk
-Jörn Hartroth
-Jürgen Gmach
-K. R. Walker
 ka7 on github
+Kadambini Nema
 Kael1117 on github
 Kai Engert
+Kailun Qin
 Kai Noda
 Kai Pastor
 Kai Sommerfeld
 Kai-Uwe Rommel
+Kaixuan Li
 Kalle Vahlman
+kalvdans on github
 Kamil Dudka
 Kane York
-Kang Lin
 Kang-Jin Lee
+Kang Lin
 Kantanat Wannapaka
+kapsiR on github
+Kareem
 Kari Pahula
 Karl Chen
 Karl Moerder
 Karol Pietrzak
-Karthikdasari0423
+Kartatz on github
+Karthik Das
+Karthik Dasari
 Karthikdasari0423 on github
 Kartik Mahajan
 Kaspar Brand
 Katie Wang
 Katsuhiko YOSHIDA
+kayrus on github
 Kazuho Oku
 kchow-FTNT on github
+Keerthi Timmaraju
 Kees Cook
 Kees Dekker
 Keitagit-kun on github
@@ -1478,17 +1863,18 @@ Keith Mok
 Kelly Kaoudis
 Ken Brown
 Ken Hirsch
-Ken Rastatter
 Kenneth Davidson
 Kenneth Myhra
 Kenny To
+Keno Fischer
+Ken Rastatter
 Kent Boortz
 Kerem Kat
 Keshav Krity
-Kev Jackson
 Kevin Adler
 Kevin Baughman
 Kevin Burke
+Kevin Daudt
 Kevin Fisk
 Kevin Ji
 Kevin Lussier
@@ -1497,15 +1883,22 @@ Kevin Reed
 Kevin Roth
 Kevin Ryan
 Kevin Smith
+Kevin Sun
 Kevin Ushey
+Kev Jackson
 Kim Minjoong
+Kimmo Kinnunen
 Kim Rinnewitz
 Kim Vandry
-Kimmo Kinnunen
+kirbyn17 on hackerone
 Kirill Efimov
 Kirill Marchuk
+Kirill Obukhov
+kit-ty-kate on github
 Kjell Ericson
 Kjetil Jacobsen
+kkalganov on github
+kkmuffme on github
 Klaus Crusius
 Klaus Stein
 Klevtsov Vadim
@@ -1515,32 +1908,41 @@ Koichi Shiraishi
 kokke on github
 Konstantin Isakov
 Konstantin Kushnir
+Konstantin Kuzov
+Konstantin Vlasov
 KotlinIsland on github
 kotori���
+koujaz on github
 kouzhudong on github
 Kovalkov Dmitrii
+kpcyrd on github
 kreshano on github
-Kris Kennaway
 Krishnendu Majumdar
+Kris Kennaway
 Krister Johansen
 Kristian Gunstone
 Kristian Köhntopp
 Kristian Mide
 Kristiyan Tsaklev
 Kristoffer Gleditsch
+kriztalz
+K. R. Walker
+Kuan-Wei Chiu
+kuchara on github
 Kunal Chandarana
 Kunal Ekawde
+kupavcevdenis on github
 Kurt Fankhauser
 Kushal Das
 Kvarec Lezki
 kwind on github
 Kwon-Young Choi
 Kyle Abramowitz
+kyled-dell on github
 Kyle Edwards
 Kyle J. McKay
 Kyle L. Huff
 Kyle Sallee
-kyled-dell on github
 Kyohei Kadota
 Kyselgov E.N
 l00p3r on Hackerone
@@ -1554,37 +1956,48 @@ Larry Lin
 Larry Stefani
 Larry Stone
 Lars Buitinck
+Lars Francke
 Lars Gustafsson
 Lars J. Aas
 Lars Johannesen
+Lars Karlitski
+Lars Kellogg-Stedman
 Lars Nilsson
 Lars Torben Wilson
+Lau
 Laurent Bonnans
 Laurent Dufresne
+Laurențiu Nicola
 Laurent Rabret
-Lauri Kasanen
 Laurie Clark-Michalek
+Lauri Kasanen
 Lawrence Gripper
 Lawrence Matthews
 Lawrence Wagerfield
 Leah Neukirchen
+Lealem Amedie
 Leandro Coutinho
+Lee Li
+LeeRiva
 Legoff Vincent
 Lehel Bernadt
 Leif W
 Leigh Purdie
 Leith Bade
+Lenaic Lefever
 Len Krause
 Len Marinaccio
-Lenaic Lefever
 Lenny Rachitsky
-Leo Neat
-Leon Breedt
-Leon Winter
 Leonardo Rosati
 Leonardo Taccari
+Leon Breedt
+Leo Neat
+Leon Timmermans
+Leon Winter
 Leszek Kubik
-Li Xinwei
+letshack9707 on hackerone
+lf- on github
+lg_oled77c5pua on hackerone
 Liam Healy
 Liam Warfield
 LigH-de on github
@@ -1595,6 +2008,7 @@ Linas Vepstas
 Lindley French
 Ling Thio
 Linos Giannopoulos
+Lin Sun
 Linus Lewandowski
 Linus Nielsen Feltzing
 Linus Nordberg
@@ -1602,23 +2016,35 @@ Lior Kaplan
 Lisa Xu
 Litter White
 Liviu Chircu
+Li Xinwei
 Liza Alenchery
 lizhuang0630 on github
+lkordos on github
 lllaffer on github
 Lloyd Fournier
 Lluís Batlle i Rossell
 locpyl-tidnyd on github
 Loganaden Velvindron
+Logan Buth
 Loic Dachary
+Loïc Yhuel
+lolbinarycat on github
+lomberd2 on github
+LoRd_MuldeR
 Loren Kirkby
 Lorenzo Miniero
+Louis Solofrizzo
+lRoccoon on github
 Luan Cestari
+Luật Nguyễn
 Luca Altea
 Luca Boccassi
+Luca Kellermann
 Luca Niccoli
 Lucas Adamski
 Lucas Clemente Vella
 Lucas Holt
+Lucas Nussbaum
 Lucas Pardue
 Lucas Servén Marín
 Lucas Severo
@@ -1628,66 +2054,81 @@ Ludovico Cavedon
 Ludwig Nussel
 Lukas Ruzicka
 Lukas Tribus
+Lukáš Zaoral
 Lukasz Czekierda
+�ukasz Domeradzki
 lukaszgn on github
 Luke Amery
 Luke Call
 Luke Dashjr
 Luke Granger-Brown
+Luke Hamburg
+Luke Wilde
 luminixinc on github
 Luo Jinghua
 Luong Dinh Dung
 Luz Paz
-Luật Nguyễn
 lwthiker on github
 Lyman Epp
 Lyndon Hill
-M.R.T on github
+M42kL33 on hackerone
+m777m0 on hackerone
+Maarten Billemont
 Maciej Domanski
 Maciej Karpiuk
 Maciej Puzio
 Maciej W. Rozycki
+MacKenzie
 madblobfish on github
+madoe on github
 MaeIsBad on github
+magisterquis on hackerone
 Mahmoud Samir Fayed
-Maks Naumov
 Maksim Arhipov
 Maksim Kuzevanov
-Maksim Sciepanienka
+Maksim Åšciepanienka
 Maksim Stsepanenka
+Maks Naumov
+Maksymilian Arciemowicz
 Malik Idrees Hasan Khan
 Mamoru Tasaka
 Mamta Upadhyay
 Mandy Wu
 Manfred Schwarb
+Manuel Einfalt
 Manuel Massing
+Manuel Strehl
 Manuj Bhatia
 Marc Aldorasi
+Marc-Antoine Perennou
 Marc Boucher
 Marc Deslauriers
 Marc Doughty
-Marc Hesse
-Marc Hörsken
-Marc Kleine-Budde
-Marc Renault
-Marc Schlatter
-Marc-Antoine Perennou
-marc-groundctl on github
 Marcel Hernandez
-Marcel Raad
-Marcel Roelofs
+Marcel Lang
 Marcelo Echeverria
 Marcelo Juchem
+Marcel Raad
+Marcel Roelofs
+marc-groundctl on github
+Marc Hesse
+Marc Hörsken
 Marcin Adamski
 Marcin Gryszkalis
 Marcin Konicki
+Marcin Rataj
+Marc Kleine-Budde
 Marco Deckel
 Marco G. Salvagno
 Marco Kamner
 Marco Maggi
 Marcos Diazr
+marcos-ng on github
+Marc Renault
+Marc Schlatter
 Marcus Hoffmann
 Marcus Klein
+Marcus Müller
 Marcus Sundberg
 Marcus T
 Marcus Webster
@@ -1695,25 +2136,29 @@ Margu
 Marian Klymov
 Marin Hannache
 Mario Schroeder
+Marius Albrecht
+Marius Kleidl
 Mark Brand
 Mark Butler
 Mark Davies
 Mark Dodgson
+Mark Esler
 Mark Gaiser
 Mark Hamilton
+Mark Huang
 Mark Incley
 Mark Itzcovitz
 Mark Karpeles
 Mark Lentczner
 Mark Nottingham
+Mark Phillips
 Mark Roszko
 Mark Salisbury
 Mark Seuffert
+Mark Sinkovics
 Mark Snelling
 Mark Swaanenburg
 Mark Tully
-Mark W. Eichin
-Mark Wotton
 Markus Duft
 Markus Elfring
 Markus Koetter
@@ -1721,11 +2166,15 @@ Markus Moeller
 Markus Oberhumer
 Markus Olsson
 Markus Sommer
+Markus Unterwaditzer
 Markus Westerlind
+Mark W. Eichin
+Mark Wotton
 Maros Priputen
 Marquis de Muesli
 marski on github
 Martijn Koster
+Martin Ã…gren
 Martin Ankerl
 Martin Bašti
 Martin C. Martin
@@ -1733,17 +2182,22 @@ Martin D'Aloia
 Martin Dorey
 Martin Drasar
 Martin Dreher
+Martin Dürrmeier
+martinevsky
 Martin Frodl
 Martin Galvan
 Martin Gartner
 Martin Hager
 Martin Halle
+Martin Harrigan
 Martin Hedenfalk
 Martin Howarth
 Martin Jansen
 Martin Kammerhofer
 Martin Kepplinger
 Martin Lemke
+Martin Peck
+Martin Schmatz
 Martin Skinner
 Martin Staael
 Martin Storsjö
@@ -1751,38 +2205,35 @@ Martin Strunz
 Martin V
 Martin Vejnár
 Martin Waleczek
-Martin Ã…gren
+Martxel
 Marty Kuhrt
 Maruko
+Marwan Yassini
 Masaya Suzuki
 masbug on github
 Massimiliano Fantuzzi
 Massimiliano Ziccardi
 Massimo Callegari
-Master Inspire
 MasterInQuestion on github
+Master Inspire
 Mateusz Loskot
+Mathesh V
 Mathew Benson
 Mathias Axelsson
+Mathias Fuchs
 Mathias Gumz
 Mathieu Carbonneaux
+Mathieu Garaud
 Mathieu Legare
 Matias N. Goldberg
 Mats Lidell
 Mats Lindestam
 Matt Arsenault
-Matt Ford
-Matt Holt
-Matt Jolly
-Matt Kraai
-Matt McClure
-Matt Veenstra
-Matt Witherspoon
-Matt Wixson
 Matteo Baccan
 Matteo Bignotti
 Matteo Bignottignotti
 Matteo Rocco
+Matt Ford
 Matthew Blain
 Matthew Clarke
 Matthew Hall
@@ -1792,13 +2243,31 @@ Matthew Whitehead
 Matthias Bolte
 Matthias Gatto
 Matthias Naegler
+Matthieu Baerts
+Matt Holt
 Mattias Fornander
+Matt Jolly
+Matt Kraai
+Matt McClure
+Matt Veenstra
+Matt Witherspoon
+Matt Wixson
 Matus Uzak
+mauke
 Maurice Barnum
+Maurício Meneghini Fauth
+Mauricio Scheffer
 Mauro Iorio
 Mauro Rappa
-Maurício Meneghini Fauth
 Max Dymond
+Max Eliaser
+Max Faxälv
+Maxim Dzhura
+Maxime Larocque
+Maxime Legros
+Maxim Ivanov
+Maxim Perenesenko
+Maxim Prohorov
 Max Katsev
 Max Kellermann
 Max Khon
@@ -1806,22 +2275,20 @@ Max Mehl
 Max Peal
 Max Savenkov
 Max Zettlmeißl
-Maxim Ivanov
-Maxim Perenesenko
-Maxim Prohorov
-Maxime Larocque
-Maxime Legros
 mbeifuss on github
 mccormickt12 on github
 Median Median Stride
+Megamouse on github
 mehatzri on github
 Mehmet Bozkurt
+Mehtab Zafar
 Mekonikum
 Melissa Mears
 Melroy van den Berg
+Mel Zuser
 Mert Yazıcıoğlu
 Mettgut Jamalla
-Micah Snyder)
+Micah Snyder
 Michael Afanasiev
 Michael Anti
 Michael Baentsch
@@ -1838,6 +2305,7 @@ Michael Forney
 Michael Gmelin
 Michael Goffioul
 Michael Heimpold
+Michael Hendricks
 Michael Hordijk
 Michael Jahn
 Michael Jerris
@@ -1845,9 +2313,10 @@ Michael Kalinin
 Michael Kaufmann
 Michael Kilburn
 Michael Kolechkin
-Michael Kujawa
 Michael König
+Michael Kujawa
 Michael Lee
+Michael Litwak
 Michael Maltese
 Michael Mealling
 Michael Mueller
@@ -1856,6 +2325,7 @@ Michael O'Farrell
 Michael Olbrich
 Michael Osipov
 Michael Schmid
+Michael Schuster
 Michael Smith
 Michael Stapelberg
 Michael Steuer
@@ -1863,24 +2333,25 @@ Michael Stillwell
 Michael Trebilcock
 Michael Vittiglio
 Michael Wallner
-Michal Bonino
-Michal Marek
-Michal Rus
-Michal Trybus
-Michal ÄŒaplygin
 Michał Antoniak
+Michal Bonino
+Michal ÄŒaplygin
 Michał Fita
 Michał Górny
 Michał Janiszewski
 Michał Kowalczyk
+Michal Marek
 Michał Petryka
 Michał Piechowski
-Michel Promonet
+Michal Rus
+Michal Trybus
 Michele Bini
+Michel Promonet
 Miguel Angel
 Miguel Diaz
 migueljcrum on github
 Mihai Ionescu
+mik
 Mikael Johansson
 Mikael Sennerholm
 Mikalai Ananenka
@@ -1895,6 +2366,7 @@ Mike Giancola
 Mike Hasselberg
 Mike Henshaw
 Mike Hommey
+Mike-menny on github
 Mike Mio
 Mike Norton
 Mike Power
@@ -1903,12 +2375,14 @@ Mike Revi
 Mike Tzou
 Mikhail Kuznetsov
 Miklos Nemeth
+Milon Renatus
 Miloš Ljumović
 Mingliang Zhu
 Mingtao Yang
 Miroslav Franc
 Miroslav Spousta
 Mischa Salle
+Mitchell Blank Jr
 Mitz Wark
 mkzero on github
 modbw on github
@@ -1917,20 +2391,31 @@ Mohamed Lrhazi
 Mohamed Osama
 Mohammad AlSaleh
 Mohammad Hasbini
+Mohammadreza Hendiani
 Mohammed Naser
+Mohammed Sadiq
 Mohun Biswas
 momala454 on github
 Momoka Yamamoto
 MonkeybreadSoftware on github
+Montg0mery on github
 moohoorama on github
+Morgan Willcock
+Moritz
+Moritz Buhl
+Moritz Knüsel
 Morten Minde Neergaard
 Mostyn Bramley-Moore
 Moti Avrahami
 MrdUkk on github
 MrSorcus on github
+M.R.T on github
+mschroeder-fzj on github
+Muhamad Arga Reksapati
 Muhammad Herdiansyah
 Muhammad Hussein Ammari
 Muhammed Yavuz Nuzumlalı
+mulan_dh on hackerone
 Murugan Balraj
 musvaage on github
 Muz Dima
@@ -1938,18 +2423,24 @@ Myk Taylor
 n0name321 on github
 Nach M. S.
 Nagai H
-Nao Yonashiro
+nait-furry
 naost3rn on github
+Nao Yonashiro
+Natanael Copa
 Nate Prewitt
-Nathan Coulter
-Nathan Moinvaziri
-Nathan O'Sullivan
 Nathanael Nerode
+Nathan Coulter
 Nathaniel J. Smith
 Nathaniel R. Lewis
 Nathaniel Waisbrot
+Nathan-M-code on github
+Nathan Moinvaziri
+Nathan O'Sullivan
+Natris on github
+na-trium-144 on github
 Naveen Chandran
 Naveen Noel
+ncaklovic on github
 Neal McBurnett
 Neal Poole
 nedres on github
@@ -1958,16 +2449,24 @@ Nehal J Wani
 neheb on github
 Neil Bowers
 Neil Dunbar
+Neil Horman
+Neil Johari
 Neil Kolban
 Neil Spring
+NeimadTL
+nekopsykose on github
+Nemos2024 on github
+netspacer.research
 neutric on github
+nevakrien on github
 nevv on HackerOne/curl
+newfunction
+newfunction on hackerone
+Ngoc Hieu
 Niall McGee
 Niall O'Reilly
-niallor on github
 nian6324 on github
 nianxuejie on github
-Nic Roets
 Nicholas Maniscalco
 Nicholas Nethercote
 Nick Banks
@@ -1975,58 +2474,74 @@ Nick Coghlan
 Nick Draffen
 Nick Gimbrone
 Nick Humfrey
-Nick Miyake
-Nick Zitzmann
-nick-telia on github
+Nick Korepanov
 Nicklas Avén
-Nico Baggus
+Nick Miyake
+nick-telia on github
+Nick Zitzmann
 nico-abram on github
+Nico Baggus
 Nicolas Berloquin
 Nicolas Croiset
+Nicolas F.
 Nicolas François
+Nicolas George
 Nicolas Grekas
 Nicolas Guillier
 Nicolas Morey-Chaisemartin
 Nicolas Noben
-Nicolas Sterchele
 Nicolás Ojeda Bär
+Nicolás San Martín
+Nicolas Sterchele
+Nico Rieck
+Nic Roets
 Niels Martignène
 Niels van Tongeren
+Nigel Brittain
 Nikita Schmidt
+Nikita Taranov
 Nikitinskit Dmitriy
 Niklas Angebrand
 Niklas Hambüchen
 Nikolai Kondrashov
 Nikos Mavrogiannopoulos
 Nikos Tsipinakis
+Nils Goroll
 nimaje on github
 niner on github
 Ning Dong
-Nir Soffer
+NINIKA
+Niracler Li
 Niranjan Hasabnis
+Nir Azkiel
+Nir Soffer
 Nis Jorgensen
+nitrogene on github
 nk
 Noam Moshe
 nobedee on github
 NobodyXu on github
 Nobuhiro Ban
 Nodak Sodak
+nono303 on github
 nopjmp on github
 Norbert Frese
 Norbert Kett
-Norbert Novotny
 norbertmm on github
+Norbert Novotny
 nosajsnikta on github
-NTMan on Github
+NTMan on github
+Nuno Goncalves
 Nuru on github
 Octavio Schroeder
 odek86 on github
 Ofer
+ohyeaah on github
 Okhin Vasilij
-Ola Mork
 Olaf Flebbe
 Olaf Hering
 Olaf Stüben
+Ola Mork
 Oleg Jukovec
 Oleg Pudeyev
 Oleguer Llopart
@@ -2037,18 +2552,23 @@ Oliver Chang
 Oliver Gondža
 Oliver Graute
 Oliver Kuckertz
+oliverpool on github
 Oliver Roberts
 Oliver Schindler
 Oliver Urbann
-oliverpool on github
 Olivier Berger
+Olivier Bonaventure
 Olivier Brunel
 Omar Ramadan
 omau on github
+Omdahake on github
+Ondřej Hlavatý
 Ondřej Kolá�ek
 opensignature on github
 opensslonzos-github on github
+Ophir Lojkine
 Orange Tsai
+oreadvanthink on github
 Oren Souroujon
 Oren Tirosh
 Orgad Shaneh
@@ -2057,27 +2577,32 @@ orycho on github
 osabc on github
 Osaila on github
 Osama Albahrani
+Osama Hamad
 Oscar Koeroo
 Oscar Norlander
 Oskar Liljeblad
 Oskar Sigvardsson
+Otis Cui Lei
 Oumph on github
+Outvi V
 ovidiu-benea on github
-P R Schaffner
+Oxan van Leeuwen
+Ozan Cansel
 Pablo Busse
 Palo Markovic
 pandada8 on github
 Paolo Mossino
 Paolo Piacentini
+parasol-aser
 Paras Sethia
 parazyd on github
 Pascal Gaudette
 Pascal Terjan
 Pasha Kuznetsov
 Pasi Karkkainen
-Pat Ray
 patelvivekv1993 on github
 patnyb on github
+Pat Ray
 Patrice Guerin
 Patricia Muscalu
 Patrick Bihan-Faou
@@ -2088,12 +2613,15 @@ Patrick Rapin
 Patrick Schlangen
 Patrick Scott
 Patrick Smith
+Patrick Steinhardt
+Patrick Stoeckle
 Patrick Watson
 Patrik Thunstrom
 Pau Garcia i Quiles
 Paul B. Omta
 Paul Donohue
 Paul Dreik
+Paul Gilmartin
 Paul Groke
 Paul Harrington
 Paul Harris
@@ -2106,18 +2634,20 @@ Paul Marquis
 Paul Moore
 Paul Nolan
 Paul Oliver
+Paulo Roberto Tomasi
 Paul Querna
 Paul Saab
 Paul Seligman
 Paul Vixie
 Paul Wise
-Paulo Roberto Tomasi
 Pavel Cenek
 Pavel Gushchin
 Pavel Kalyugin
+Pavel Kropachev
 Pavel Löbl
 Pavel Mayorov
 Pavel Orehov
+Pavel P
 Pavel Pavlov
 Pavel Raiskup
 Pavel Rochnyak
@@ -2127,17 +2657,24 @@ Pawel A. Gajda
 Pawel Kierski
 Paweł Kowalski
 Paweł Wegner
+Paweł Witas
+PBudmark on github
 Pedro Henrique
 Pedro Larroy
 Pedro Monreal
 Pedro Neves
+pelioro on hackerone
 pendrek at hackerone
 Peng Li
 Peng-Yu Chen
+pennae on github
+penpal
 Per Jensen
 Per Lundberg
 Per Malmberg
 Per Nilsson
+Petar Popovic
+Pete Cordell
 Pete Lomax
 Peter Bray
 Peter Forret
@@ -2146,11 +2683,16 @@ Peter Gal
 Peter Goodman
 Peter Heuchert
 Peter Hjalmarsson
-Peter Korsgaard
+PÄ“teris Caune
+Peteris Krumins
+Peter Kokot
 Peter Körner
+Peter Korsgaard
+Peter Krefting
 Peter Lamare
 Peter Lamberg
 Peter Laser
+Peter Marko
 Peter O'Gorman
 Peter Pentchev
 Peter Piekarski
@@ -2165,44 +2707,52 @@ Peter Verhas
 Peter Wang
 Peter Wu
 Peter Wullinger
-Peteris Krumins
 Petr Bahula
 Petr Novak
 Petr Pisar
-Petr Voytsik
 Petr Å tetiar
+Petr Voytsik
 Phil Blundell
 Phil Crump
 Phil E. Taylor
-Phil Karn
-Phil Lisiecki
-Phil Pellouchoud
 Philip Chan
 Philip Craig
 Philip Gladstone
+Philip H.
 Philip Heiduck
 Philip Langdale
-Philip Prindeville
-Philip Sanetra
-Philipp Engel
-Philipp Klaus Krause
-Philipp Waehnert
+Philippe Antoine
 Philippe Antoine on HackerOne
 Philippe Hameau
 Philippe Marguinaud
+Philipp Engel
 Philippe Raoult
 Philippe Vaucher
+Philipp Klaus Krause
+Philip Prindeville
+Philipp Waehnert
+Philip Sanetra
+Phil Karn
+Phil Lisiecki
+Phil Pellouchoud
 Pierre
 Pierre Brico
 Pierre Chapuis
+Pierre-Etienne Meunier
 Pierre Joye
 Pierre Yager
 Pierre Ynard
 Pierre-Yves Bigourdan
 Pierrick Charron
+Pino Toscano
 Piotr Dobrogost
 Piotr Komborski
+Piotr Nakraszewicz
+PleaseJustDont
+plv1313 on github
 Po-Chuan Hsieh
+Pocs Norbert
+pojomi
 Pontakorn Prasertsuk
 Pontus Lundkvist
 Pooyan McSporran
@@ -2214,58 +2764,76 @@ Prithvi MK
 privetryan on github
 Priyanka Shah
 ProceduralMan on github
+programmerlexi on github
+promptfuzz_ on hackerone
 Pronyushkin Petr
+prpr19xx on github
+P R Schaffner
 Przemysław Tomaszewski
 pszemus on github
 pszlazak on github
 puckipedia on github
 Puneet Pawaia
+qhill
+qhill on github
 qiandu2006 on github
+Qriist on github
+Quac Tran
 Quagmire
 Quanah Gibson-Mount
 Quentin Balland
 Quinn Slack
-r-a-sattarov on github
-R. Dennis Steed
 Radek Brich
 Radek Zajic
 Radoslav Georgiev
 Radu Hociung
 Radu Simionescu
-Rafa Muyo
 Rafael Antonio
-Rafael Sagula
-Rafayel Mkrtchyan
 Rafaël Carré
+Rafael Sagula
 Rafał Mikrut
+Rafa Muyo
+Rafayel Mkrtchyan
+Rahul Krishna M
 Rainer Canavan
 Rainer Jung
 Rainer Koenig
 Rainer Müller
+RainRat
 Raito Bezarius
 Rajesh Naganathan
 Rajkumar Mandal
+Ralf A. Timmermann
+ralfjunker on github
 Ralf S. Engelschall
 Ralph Beckmann
 Ralph Langendam
 Ralph Mitchell
+Ralph Sennhauser
+Ramiro Garcia
 Ram Krushna Mishra
+rampageX on github
 ramsay-jones on github
-Ran Mozes
 RanBarLavie on github
 Randall S. Becker
 Randolf J
 Randy Armstrong
 Randy McMurchy
+Ran Mozes
 Raphael Gozzo
+r-a-sattarov on github
 Rasmus Melchior Jacobsen
+Rasmus Thomsen
 Raul Onitza-Klugman
 Ravi Pratap
 Ray Dassen
+Raymond Steen
 Ray Pekowski
 Ray Satiro
 Razvan Cojocaru
+Razvan Pricope
 rcombs on github
+R. Dennis Steed
 Red Hat Product Security
 Reed Loden
 Reinhard Max
@@ -2274,6 +2842,7 @@ RekGRpth on github
 Remco van Hooff
 Remi Gacogne
 Remo E
+Rémy Léone
 Renato Botelho
 Renaud Allard
 Renaud Chaillat
@@ -2282,20 +2851,19 @@ Renaud Guillard
 Renaud Lehoux
 Rene Bernhardt
 Rene Rebe
+renjian on hackerone
+renovate[bot]
+renovate[bot]
+RepoRascal on hackerone
 Reuven Wachtfogel
+RevaliQaQ on github
 Reza Arbab
 Rianov Viacheslav
+riastradh on github
 Ricardo Cadime
 Ricardo Gomes
-Ricardo M. Correia
 Ricardo Martins
-Rich Burridge
-Rich FitzJohn
-Rich Gray
-Rich Mirch
-Rich Rauenzahn
-Rich Salz
-Rich Turner
+Ricardo M. Correia
 Richard Adams
 Richard Alcock
 Richard Archer
@@ -2308,68 +2876,88 @@ Richard Gorton
 Richard Gray
 Richard Hosking
 Richard Hsu
+Richard Levitte
 Richard Marion
 Richard Michael
 Richard Moore
 Richard Prescott
 Richard Silverman
+Richard Tollerton
 Richard van den Berg
-Richard W.M. Jones
 Richard Whitehouse
+Richard W.M. Jones
+Rich Burridge
+Rich FitzJohn
+Rich Gray
+Rich Mirch
+Rich Rauenzahn
+Rich Salz
+Rich Turner
 Richy Kim
 Rici Lake
+Rickard Hallerbäck
 Rick Deist
+Ricki Hirner
 Rick Jones
 Rick Lane
 Rick Richardson
 Rick Welykochy
-Rickard Hallerbäck
-Ricki Hirner
 Ricky Leverence
 Ricky-Tigg on github
-Rider Linden
 RiderALT on github
+Rider Linden
 Rikard Falkeborn
+rilysh
+Rinku Das
+rinsuki on github
 rl1987 on github
+rmg-x on github
+rm-rmonaghan on github
 Rob Boeckermann
+RobBotic1 on github
+Robby Simpson
 Rob Cotrone
 Rob Crittenden
 Rob Davies
 Rob de Wit
-Rob Jones
-Rob Sanders
-Rob Stanzel
-Rob Ward
-RobBotic1 on github
-Robby Simpson
 Robert A. Monat
 Robert B. Harris
 Robert Brose
 Robert Charles Muir
-Robert D. Young
 Robert Dunaj
+Robert D. Young
 Robert Foreman
 Robert Iakobashvili
 Robert Kolcun
 Robert Linden
+Robert Maynard
+Robert Moreton
+Roberto Hidalgo
 Robert Olson
 Robert Prag
 Robert Ronto
 Robert Schumann
+Robert Simpson
+Robert Southee
 Robert Weaver
 Robert Wruck
+Robert W. Van Kirk
 Robin A. Meade
 Robin Cornelius
 Robin Douine
 Robin Johnson
 Robin Kay
 Robin Marx
+Rob Jones
+Rob Sanders
 Robson Braga Araujo
-Rod Widdowson
+Rob Stanzel
+Rob Ward
 Rodger Combs
 Rodney Simmons
 Rodric Glaser
 Rodrigo Silva
+Rod Widdowson
 Roger Leigh
 Roger Orr
 Roger Young
@@ -2385,12 +2973,14 @@ Romain Geissler
 romamik om github
 Roman Koifman
 Roman Mamedov
+Roman Zharkov
 Romulo A. Ceccon
+Ronald Crane
+Ronan Pigott
 Ron Eldor
+Ronnie Mose
 Ron Parker
 Ron Zapp
-Ronan Pigott
-Ronnie Mose
 Rosen Penev
 Rosimildo da Silva
 Ross Burton
@@ -2398,6 +2988,8 @@ roughtex on github
 Roy Bellingan
 Roy Li
 Roy Shan
+RubisetCie on github
+Rudi Heitbaum
 Rui LIU
 Rui Pinheiro
 Rune Kleveland
@@ -2406,36 +2998,42 @@ Ruslan Gazizov
 Rutger Broekhoff
 Rutger Hofman
 Ruurd Beerstra
-RuurdBeerstra on github
 rwmjones on github
 Ryan Beck-Buysse
 Ryan Braud
+ryancaicse on github
+Ryan Carsten Schmidt
 Ryan Chan
+Ryan Hooper
 Ryan Mast
 Ryan Nelson
 Ryan Schmidt
 Ryan Scott
 Ryan Sleevi
 Ryan Winograd
-ryancaicse on github
 Ryuichi KAWAMATA
 rzrymiak on github
-Rémy Léone
-S. Moonesamy
+s0urc3_ on hackerone
+saimen
 Sai Ram Kunala
+Sakthi SK
 Salah-Eddin Shaban
 Saleem Abdulrasool
 SaltyMilk
 Salvador Dávila
 Salvatore Sorrentino
+Samanta Navarro
 Sam Deane
 Sam Hurst
+Sam James
+Sam Jessup
+sammydono on github
+Sampo Kellomaki
 Sam Roth
 Sam Schanken
-Samanta Navarro
-Sampo Kellomaki
 Samuel Chiang
 Samuel Díaz García
+Samuel Dionne-Riel
 Samuel Henrique
 Samuel Listopad
 Samuel Marks
@@ -2446,24 +3044,37 @@ SandakovMM on github
 Sander Gates
 Sandor Feldi
 Sandro Jaeckel
+Sanjay Pujare
 Santhana Todatry
 Santino Keupp
 Saqib Ali
 Sara Golemon
+Sarah Gooding
 Saran Neti
+Sascha Frinken
 Sascha Swiercy
 Sascha Zengler
 Satadru Pramanik
 Satana de Sant'Ana
+Saud Alshareef
 Saul good
+saurabhsingh-dev on github
 Saurav Babu
 sayrer on github
+sbernatsky on github
 SBKarr on github
+SC404
+Scarlett McAllister
+Schrijvers Luc
 Scott Bailey
 Scott Barrett
+Scott Boudreaux
 Scott Cantor
 Scott Davis
 Scott McCreary
+Scott Mutter
+Scott Talbert
+sd0 on hackerone
 Sean Boudreau
 Sean Burford
 Sean MacLennan
@@ -2471,11 +3082,17 @@ Sean McArthur
 Sean Miller
 Sean Molenaar
 Sebastiaan van Erk
+Sebastian Andersson
+Sebastian Carlos
 Sebastian Haglund
 Sebastian Mundry
+Sebastian Neubauer
 Sebastian Pohlschmidt
 Sebastian Rasmussen
 Sebastian Sterk
+Sebastian Walz
+Sébastien Helleu
+Sébastien Willemijns
 selmelc on hackerone
 SendSonS on github
 Senthil Raja Velu
@@ -2484,7 +3101,9 @@ Sergei Nikulov
 Sergey
 Sergey Alirzaev
 Sergey Bronnikov
+Sergey Fedorov
 Sergey Fionov
+Sergey Katsubo
 Sergey Markelov
 Sergey Ogryzkov
 Sergey Ryabinin
@@ -2494,17 +3113,19 @@ Sergii Pylypenko
 Sergio Ballestrero
 Sergio Barresi
 Sergio Borghese
+Sergio Correia
 Sergio Durigan Junior
-Sergio Mijatovic
 Sergio-IME on github
+Sergio Mijatovic
 sergio-nsk on github
 Serj Kalichev
+Sertonix
 SerusDev on github
 Seshubabu Pasam
 Seth Mos
 Sevan Janiyan
+sfan5 on github
 Sgharat on github
-Sh Diao
 Shachaf Ben-Kiki
 ShadowZzj on github
 Shailesh Kapse
@@ -2517,9 +3138,11 @@ Shaun Jackman
 Shaun Mirani
 Shawn Landden
 Shawn Poulson
+Sh Diao
 Sheshadri.V
 Shikha Sharma
 Shine Fan
+Shintomon Mathew
 Shiraz Kanga
 shithappens2016 on github
 Shlomi Fish
@@ -2527,28 +3150,42 @@ Shmulik Regev
 Shohei Maeda
 Siddhartha Prakash Jain
 siddharthchhabrap on github
+sideshowbarker on github
 Sidney San Martín
 Siegfried Gyuricsko
 silveja1 on github
 Simon Berger
 Simon Chalifoux
+Simon Dalvai
 Simon Dick
 Simon H.
 Simon Josefsson
+Simon K
 Simon Legner
 Simon Liu
 Simon Warta
 simplerobot on github
+Sinkevich Artem
 Siva Sivaraman
+Slaven Rezić
 SLDiggie on github
 Smackd0wn on github
+S. Moonesamy
 smuellerDD on github
 sn on hackerone
 sofaboss on github
+Sohom Datta
+Sollace on github
 Somnath Kundu
 Song Ma
+Song X. Gao
 Sonia Subramanian
+Sören Tempel
+sourceturner
+southernedge on github
 Spacen Jasset
+spectreglobalsec on hackerone
+Spenser Black
 Spezifant on github
 Spiridonoff A.V
 Spoon Man
@@ -2556,12 +3193,16 @@ Spork Schivago
 ssdbest on github
 sspiri on github
 sstruchtrup on github
+st751228051 on github
 Stadler Stephan
 Stan Hu
-Stan van de Burgt
+Stanislav Fort
 Stanislav Ivochkin
+Stanislav Lange
+Stanislav Osipov
 Stanislav Zidek
 Stanley Wucw
+Stan van de Burgt
 Stathis Kapnidis
 Stav Nir
 steelman on github
@@ -2574,49 +3215,55 @@ Stefan Huber
 Stefan Kanthak
 Stefan Karpinski
 Stefan Krause
+Štefan Kremeň
 Stefan Neis
+Stefano Simonelli
 Stefan Strogin
 Stefan Talpalaru
 Stefan Teleman
 Stefan Tomanek
 Stefan Ulrich
 Stefan Yohansson
-Stefano Simonelli
+Steffen Kieß
 Steinar H. Gunderson
 steini2000 on github
 Stepan Broz
 Stepan Efremov
 Stephan Bergmann
+Stephane Pellegrino
 Stephan Guilloux
 Stephan Lagerholm
 Stephan Mühlstrasser
+stephannn on github
 Stephan Szabo
-Stephane Pellegrino
 Stephen Boost
 Stephen Brokenshire
 Stephen Collyer
+Stephen Farrell
 Stephen Kick
 Stephen M. Coakley
 Stephen More
 Stephen Toub
 Sterling Hughes
 Steve Green
-Steve H Truong
 Steve Havelka
 Steve Herrell
 Steve Holme
+Steve H Truong
 Steve Lhomme
 Steve Little
 Steve Marx
-Steve Oliphant
-Steve Roskowski
-Steve Walch
+Steven Allen
 Steven Bazyl
 Steven G. Johnson
 Steven Gu
 Steven M. Schweda
+stevenpackardblp on github
 Steven Parkes
 Steven Penny
+Steve Oliphant
+Steve Roskowski
+Steve Walch
 Stewart Gebbie
 Stian Soiland-Reyes
 Stoned Elipot
@@ -2625,9 +3272,12 @@ Stuart Henderson
 Sukanya Hanumanthu
 SumatraPeter on github
 Sune Ahlgren
+Sunny
 Sunny Bean
 Sunny Purushe
+sunriseL
 SuperIlu on github
+SuperStormer on github
 Sven Anders
 Sven Blumenstein
 Sven Neuhaus
@@ -2637,46 +3287,62 @@ swalkaus at yahoo.com
 sylgal on github
 Sylvestre Ledru
 Symeon Paraschoudis
-Sébastien Helleu
-Sébastien Willemijns
-T. Bharath
-T. Yamada
 T200proX7 on github
 Tadej Vengust
 Tae Hyoung Ahn
 Taiyu Len
+Tal Regev
+Tamás Bálint Misius
+Tamir Duberstein
 Taneli Vähäkangas
 Tanguy Fautre
 Taras Kushnir
 tarek112 on github
+Tatsuhiko Miyagawa
 Tatsuhiro Tsujikawa
 tawmoto on github
+T. Bharath
 tbugfinder on github
 Ted Lyngmo
 Teemu Yli-Elsila
+Teh Kok How
 Temprimus
+Tenant HellTower
+Terence Eden
+Terrance Wong
 Terri Oda
 Terry Wu
+Tetetest
 thanhchungbtc on github
-The Infinnovation team
 TheAssassin on github
+TheBitBrine
+The Infinnovation team
 TheKnarf on github
+Theo
+Theo Buehler
+Theodore A. Roth
 Theodore Dubois
 therealhirudo on github
 Thiago Suchorski
+Thibault de Villèle
+thisisgk on github
 tholin on github
+Thomas
+Thomas1664 on github
 Thomas Bouzerar
 Thomas Braun
 Thomas Danielsson
+Thomas Ferguson
 Thomas Gamper
 Thomas Glanzmann
 Thomas Guillem
 Thomas J. Moore
 Thomas Klausner
-Thomas L. Shinnick
 Thomas Lopatic
+Thomas L. Shinnick
 Thomas M. DuBuisson
 Thomas Petazzoni
+Thomas Pyle
 Thomas Ruecker
 Thomas Schwinge
 Thomas Taylor
@@ -2684,41 +3350,54 @@ Thomas Tonino
 Thomas van Hesteren
 Thomas Vegas
 Thomas Weißschuh
-Thomas1664 on github
 Thorsten Klein
 Thorsten Schöning
+Tianyi Song
 Tiit Pikma
 Till Maas
+Till Wegmüller
 Tim Ansell
 Tim Baker
 Tim Bartley
+Tim Becker
 Tim Chen
 Tim Costello
+Tim Friedrich Brüggemann
 Tim Harder
 Tim Heckman
+Tim Hill
+Tim Martin
 Tim Mcdonough
+Timmy Schierling
 Tim Newsome
+Timo Lange
+Tim Omta
+Timo Sirainen
+Timotej Lazar
+Timothe Litt
+Timothy Gu
+Timothy Polich
+Timo Tijhof
 Tim Rühsen
 Tim Sedlmeyer
 Tim Sneddon
 Tim Stack
 Tim Starling
 Tim Tassonis
-Tim Verhoeven
-Timmy Schierling
-Timo Lange
-Timo Sirainen
-Timotej Lazar
-Timothe Litt
-Timothy Gu
-Timothy Polich
 Timur Artikov
+Tim Verhoeven
+Tim Yuer
 Tinus van den Berg
+tinyboxvk
+tiymat
 TJ Saunders
 Tk Xiong
+tkzv on github
 tlahn on github
 tmkk on github
 Tobias Blomberg
+Tobias Bora
+Tobias Frauenschläger
 Tobias Gabriel
 Tobias Hieta
 Tobias Hintze
@@ -2730,12 +3409,27 @@ Tobias Nyholm
 Tobias Rundström
 Tobias Schaefer
 Tobias Stoeckmann
+Tobias Wendorff
+Tobias Zimmermann
 Toby Peterson
 Todd A Ouska
+Todd Gamblin
 Todd Kaufmann
 Todd Kulesza
 Todd Short
 Todd Vierling
+Tomas Berger
+Tomas Hoger
+Tomas Jakobsson
+Tomáš Malý
+Tomas Mlcoch
+Tomas Mraz
+Tomas Pospisek
+Tomas Szepe
+Tomas Tomecek
+Tomas Volf
+Tomasz Kojm
+Tomasz Lacki
 Tom Benoist
 Tom Donovan
 Tom Eccles
@@ -2744,87 +3438,99 @@ Tom Grace
 Tom Greenslade
 Tom Lee
 Tom Mattison
-Tom Moers
-Tom Mueller
-Tom Regner
-Tom Seddon
-Tom Sparrow
-Tom van der Woerdt
-Tom Wright
-Tom Zerucha
-Tomas Berger
-Tomas Hoger
-Tomas Jakobsson
-Tomas Mlcoch
-Tomas Mraz
-Tomas Pospisek
-Tomas Szepe
-Tomas Tomecek
-Tomasz Kojm
-Tomasz Lacki
 Tommie Gannert
 tommink[at]post.pl
+Tom Moers
+Tom Mueller
+tommy
 Tommy Chiang
 Tommy Odom
 Tommy Petty
 Tommy Tam
-Ton Voon
+Tom Regner
+Tom Seddon
+Tom Sparrow
+Tom St Denis
+Tom van der Woerdt
+Tom Wright
+tomy2105 on github
+Tom Zerucha
 Toni Moreno
+Ton Voon
 Tony Kelman
-tonystz on Github
+tonystz on github
+Toon Claes
 Toon Verwaest
 Tor Arntsen
 Torben Dannhauer
+Torben Dury
+Török Edwin
 Torsten Foertsch
 Toshio Kuratomi
 Toshiyuki Maezawa
 tpaukrt on github
 Traian Nicolescu
 Trail of Bits
+tranzystorekk on github
 Travis Burtrum
+Travis Lane
 Travis Obenhaus
+Tristan Perrault
 Trivikram Kamat
 Troels Walsted Hansen
 Troy Engel
 trrui-huawei
+Trumeet on github
+trxvorr
+Trzik on github
 Tseng Jun
 Tuomas Siipola
 Tuomo Rinne
 Tupone Alfredo
+Turiiya
+T. Yamada
 Tyler Hall
-Török Edwin
 u20221022 on github
 Ulf Härnhammar
 Ulf Samuelsson
 Ulrich Doehner
 Ulrich Telle
 Ulrich Zadow
-UnicornZhang on Github
+UnicornZhang on github
 updatede on github
 UrsusArctos on github
 User Sg
 ustcqidi on github
 Vadim Grinshpun
+Vaibhav Kumar
 Valentin David
+Valentín Gutiérrez
 Valentin Richter
 Valentyn Korniienko
-Valentín Gutiérrez
+Valerie Snyder
 Valerii Zapodovnikov
 vanillajonathan on github
 Varnavas Papaioannou
 Vasiliy Faronov
+Vasiliy-Kkk
 Vasiliy Ulyanov
 Vasily Lobaskin
 Vasy Okhin
+vectorqueue on hackerone
+vegagent on hackerone
 Venkat Akella
 Venkataramana Mokkapati
+Venkat Krishna R
 Vicente Garcia
+Victor Kislov
 Victor Magierski
 Victor Snezhko
-Victor Vieux
 VictorVG on github
+Victor Vieux
 Vijay Panghal
 Vikram Saxena
+Viktor Dukhovni
+Viktor Petersson
 Viktor Szakats
 Vilhelm Prytz
 Ville Skyttä
@@ -2836,39 +3542,48 @@ Vincent Le Normand
 Vincent Penquerc'h
 Vincent Sanders
 Vincent Torri
+violet12331 on hackerone
 violetlige on github
 vitaha85 on github
 Vitaly Varyvdin
+Vítor Galvão
 vl409 on github
 Vlad Grachov
-Vlad Ureche
 Vladimir Grishchenko
 Vladimir Kotal
 Vladimir Lazarenko
+Vladimír Marek
 Vladimir Panteleev
 Vladimir Varlamov
+Vladislavs Sokurenko
+Vlad Ureche
 Vlastimil Ov�á�ík
 vlkl-sap on github
 vlubart on github
 Vojtech Janota
-Vojtech Minarik
 Vojtěch Král
+Vojtech Minarik
 Volker Schmid
+Vollstrecker on github
 Vsevolod Novikov
 vshmuk on hackerone
-vvb2060
+vulnerabilityspotter on hackerone
+Vulpes Vulpes
+vuonganh1993 on github
 vvb2060 on github
 Vyron Tsingaras
-Vítor Galvão
-W. Mark Kubacki
+w0x42 on hackerone
 Waldek Kozba
+Waldemar Kornewald
 Walter J. Mack
+WangDaLei on github
 wangzhikun
 Ward Willats
 Warren Menzer
 Wayne Haigh
 Wei Chong Tan
 Wenchao Li
+Weng Xuetian
 Wenxiang Qian
 Werner Koch
 Werner Stolz
@@ -2876,107 +3591,147 @@ Wes Hinsley
 wesinator on github
 Wesley Laxton
 Wesley Miaw
+Wesley Moore
 Wez Furlong
 Wham Bang
 Wilfredo Sanchez
 Wilhelm von Thiele
+Will Cosgrove
 Will Dietz
-Will Roberts
 Willem Hoek
 Willem Sparreboom
-William A. Rowe Jr
 William Ahern
+William A. Rowe Jr
 William Desportes
 William Tang
+Will Roberts
+Winni Neessen
+W. Mark Kubacki
 wmsch on github
 wncboy on github
 Wojciech Zwiefka
+wolfsage on hackerone
 Wolf Vollprecht
 Wouter Van Rooy
+wulin-nudt on github
 Wu Yongzheng
 Wu Zheng
+wxiaoguang on github
 Wyatt O'Day
 Wyatt OʼDay
+Wyuer on github
+x1sc0 on github
 x2018 on github
 Xavier Bouchoux
+XCas13
+xfangfang
 XhmikosR on github
 XhstormR on github
-Xiang Xiao
+xiadnoring on github
 Xiangbin Li
 xianghongai on github
+Xiang Xiao
+xiaofeng
 Xiaoke Wang
 Xiaoyin Liu
+Xì Gà
+Xi Ruoyao
+xkilua on hackerone
 XmiliaH on github
+xmoezzz on github
 xnynx on github
 xtonik on github
 xwxbug on github
-Xì Gà
+x-xiang on github
+XYenon
 Yaakov Selkowitz
+Yadhu Krishna M
 Yair Lenga
+Yalguun Tumenkhuu
 Yang Tse
 Yaobin Wen
+yaoy6 on github
 Yarram Sunil
 Yasuharu Yamada
 Yasuhiro Matsumoto
 Yechiel Kalmenson
+Yedaya Katsman
 Yehezkel Horowitz
 Yehoshua Hershberg
 ygthien on github
+Yifei Kong
+Yihang Zhou
 Yi Huang
 Yiming Jing
 Yingwei Liu
+Yiwei Hou
 yiyuaner on github
 Ymir1711 on github
 Yonggang Luo
 Yongkang Huang
+Yoshimasa Ohno
+Yoshiro Yoneya
 Younes El-karama
 youngchopin on github
 Yousuke Kimoto
-Yu Xin
+Yuhao Jiang
 Yukihiro Kawada
 Yun SangHo
-Yuri Slobodyanyuk
 Yurii Rashkovskii
+Yuri Slobodyanyuk
 Yuriy Chernyshov
 Yuriy Sosov
 yushicheng7788 on github
 Yusuke Nakamura
+Yu Xin
+Yuyi Wang
 Yves Arrouye
 Yves Lejeune
 YX Hao
-z2-2z on github
-z2_ on hackerone
+z2_
 Zachary Seguin
+Zartaj Majeed
 Zdenek Pavlas
 Zekun Ni
 zelinchen on github
+zengwei
+zengwei2000
 Zenju on github
 Zero King
 Zespre Schmidt
-Zhang Xiuhua
 zhanghu on xiaomi
-Zhao Yisha
+Zhang Wen
+Zhang Xiuhua
+zhanhb on github
+Zhanpeng Liu
+Zhaoming Luo
 Zhaoyang Wu
+Zhao Yisha
+zhengqwe on github
 Zhibiao Wu
+Zhicheng Chen
 zhihaoy on github
 Zhouyihai Ding
 ZimCodes on github
+zjyhjqs
 zloi-user on github
+zmcx16 on github
 Zmey Petroff
+zopsicle on github
 Zvi Har'El
 zzq1015 on github
-�dler Jonas Gross
-Érico Nogueira
-Érico Nogueira Rolim
-İsmail Dönmez
-�ukasz Domeradzki
-Štefan Kremeň
 Бори� Верхов�кий
+Йоте
 Коваленко �натолий Викторович
+наб
 �икита Дорохин
 ウ�ん
 �确定
 加藤�之
+包布�
+�宫雪�
 左潇峰
+�四
 梦终无痕
 �丹尼 Dan Jacobson
+罗�辉
diff --git a/third-party/curl/docs/THANKS-filter b/third-party/curl/docs/THANKS-filter
index 99eacfced5..f9e7e1c8d2 100644
--- a/third-party/curl/docs/THANKS-filter
+++ b/third-party/curl/docs/THANKS-filter
@@ -25,7 +25,7 @@
 # This is a list of names we have recorded that already are thanked
 # appropriately in THANKS. This list contains variations of their names and
 # their "canonical" name. This file is used for scripting purposes to avoid
-# duplicate entries and will not be included in release tarballs.
+# duplicate entries and is not included in release tarballs.
 # When removing dupes that are not identical names from THANKS, add a line
 # here!
 #
@@ -133,6 +133,33 @@ s/ *via curl-library *//
 s/Evgeny Grin$/Evgeny Grin (Karlson2k)/
 s/Karlson2k on github/Evgeny Grin (Karlson2k)/
 s/Dan Frandrich/Dan Fandrich/
+s/Dan Fandrich\./Dan Fandrich/
 s/GitHub$//
 s/pszlazak$/pszlazak on github/
 s/Randall$/Randall S. Becker/
+s/talregev on github/Tal Regev/
+s/daniel-j-h/Daniel J. H./
+s/hongfei.li/Hongfei Li/
+s/z2_ on hackerone/z2_/
+s/z2-2z on github/z2_/
+s/janedenone on hackerone/janedenone on github/
+s/Benjamin Riefenstahl Mecom/Benjamin Riefenstahl/
+s/Micah Snyder)/Micah Snyder/
+s/\#14922//
+s/vvb2060\z/vvb2060 on github/
+s/kartatz\z/Kartatz on github/i
+s/Karthikdasari0423\z/Karthikdasari0423 on github/
+s/niallor on github/Niall O'Reilly/
+s/RuurdBeerstra on github/Ruurd Beerstra/
+s/Smackd0wn\z/Smackd0wn on github/
+s/Testclutch//
+s/edmcln\z/edmcln on github/
+s/andrewkirillov-ibm/Andrew Kirillov/
+s/\(.*\) via #[0-9]*//
+s/jethrogb$/jethrogb on github/
+s/on github/on github/i
+s/Maksim Sciepanienka/Maksim Åšciepanienka/
+s/Qriist.*/Qriist on github/
+s/Viktor Szakatas/Viktor Szakats/
+s/Val S\./Valerie Snyder/
+s/Andrew Nesbit$/Andrew Nesbitt/
diff --git a/third-party/curl/docs/TODO b/third-party/curl/docs/TODO
deleted file mode 100644
index a8e090c168..0000000000
--- a/third-party/curl/docs/TODO
+++ /dev/null
@@ -1,1385 +0,0 @@
-                                  _   _ ____  _
-                              ___| | | |  _ \| |
-                             / __| | | | |_) | |
-                            | (__| |_| |  _ <| |___
-                             \___|\___/|_| \_\_____|
-
-                Things that could be nice to do in the future
-
- Things to do in project curl. Please tell us what you think, contribute and
- send us patches that improve things.
-
- Be aware that these are things that we could do, or have once been considered
- things we could do. If you want to work on any of these areas, please
- consider bringing it up for discussions first on the mailing list so that we
- all agree it is still a good idea for the project.
-
- All bugs documented in the KNOWN_BUGS document are subject for fixing.
-
- 1. libcurl
- 1.1 TFO support on Windows
- 1.2 Consult %APPDATA% also for .netrc
- 1.3 struct lifreq
- 1.4 alt-svc sharing
- 1.5 get rid of PATH_MAX
- 1.6 native IDN support on macOS
- 1.8 CURLOPT_RESOLVE for any port number
- 1.9 Cache negative name resolves
- 1.10 auto-detect proxy
- 1.11 minimize dependencies with dynamically loaded modules
- 1.12 updated DNS server while running
- 1.13 c-ares and CURLOPT_OPENSOCKETFUNCTION
- 1.15 Monitor connections in the connection pool
- 1.16 Try to URL encode given URL
- 1.17 Add support for IRIs
- 1.18 try next proxy if one does not work
- 1.19 provide timing info for each redirect
- 1.20 SRV and URI DNS records
- 1.21 netrc caching and sharing
- 1.22 CURLINFO_PAUSE_STATE
- 1.23 Offer API to flush the connection pool
- 1.25 Expose tried IP addresses that failed
- 1.28 FD_CLOEXEC
- 1.29 WebSocket read callback
- 1.30 config file parsing
- 1.31 erase secrets from heap/stack after use
- 1.32 add asynch getaddrinfo support
- 1.33 make DoH inherit more transfer properties
-
- 2. libcurl - multi interface
- 2.1 More non-blocking
- 2.2 Better support for same name resolves
- 2.3 Non-blocking curl_multi_remove_handle()
- 2.4 Split connect and authentication process
- 2.5 Edge-triggered sockets should work
- 2.6 multi upkeep
- 2.7 Virtual external sockets
- 2.8 dynamically decide to use socketpair
-
- 3. Documentation
- 3.1 Improve documentation about fork safety
- 3.2 Provide cmake config-file
-
- 4. FTP
- 4.1 HOST
- 4.2 Alter passive/active on failure and retry
- 4.3 Earlier bad letter detection
- 4.4 Support CURLOPT_PREQUOTE for dir listings too
- 4.5 ASCII support
- 4.6 GSSAPI via Windows SSPI
- 4.7 STAT for LIST without data connection
- 4.8 Passive transfer could try other IP addresses
-
- 5. HTTP
- 5.1 Provide the error body from a CONNECT response
- 5.2 Obey Retry-After in redirects
- 5.3 Rearrange request header order
- 5.4 Allow SAN names in HTTP/2 server push
- 5.5 auth= in URLs
- 5.6 alt-svc should fallback if alt-svc does not work
- 5.7 Require HTTP version X or higher
-
- 6. TELNET
- 6.1 ditch stdin
- 6.2 ditch telnet-specific select
- 6.3 feature negotiation debug data
- 6.4 exit immediately upon connection if stdin is /dev/null
-
- 7. SMTP
- 7.1 Passing NOTIFY option to CURLOPT_MAIL_RCPT
- 7.2 Enhanced capability support
- 7.3 Add CURLOPT_MAIL_CLIENT option
-
- 8. POP3
- 8.2 Enhanced capability support
-
- 9. IMAP
- 9.1 Enhanced capability support
-
- 10. LDAP
- 10.1 SASL based authentication mechanisms
- 10.2 CURLOPT_SSL_CTX_FUNCTION for LDAPS
- 10.3 Paged searches on LDAP server
- 10.4 Certificate-Based Authentication
-
- 11. SMB
- 11.1 File listing support
- 11.2 Honor file timestamps
- 11.3 Use NTLMv2
- 11.4 Create remote directories
-
- 12. FILE
- 12.1 Directory listing for FILE:
-
- 13. TLS
- 13.1 TLS-PSK with OpenSSL
- 13.2 Provide mutex locking API
- 13.3 Defeat TLS fingerprinting
- 13.4 Cache/share OpenSSL contexts
- 13.5 Export session ids
- 13.6 Provide callback for cert verification
- 13.7 Less memory massaging with Schannel
- 13.8 Support DANE
- 13.9 TLS record padding
- 13.10 Support Authority Information Access certificate extension (AIA)
- 13.12 Reduce CA certificate bundle reparsing
- 13.13 Make sure we forbid TLS 1.3 post-handshake authentication
- 13.14 Support the clienthello extension
-
- 14. GnuTLS
- 14.2 check connection
-
- 15. Schannel
- 15.1 Extend support for client certificate authentication
- 15.2 Extend support for the --ciphers option
- 15.4 Add option to allow abrupt server closure
-
- 16. SASL
- 16.1 Other authentication mechanisms
- 16.2 Add QOP support to GSSAPI authentication
-
- 17. SSH protocols
- 17.1 Multiplexing
- 17.2 Handle growing SFTP files
- 17.3 Read keys from ~/.ssh/id_ecdsa, id_ed25519
- 17.4 Support CURLOPT_PREQUOTE
- 17.5 SSH over HTTPS proxy with more backends
- 17.6 SFTP with SCP://
-
- 18. Command line tool
- 18.1 sync
- 18.2 glob posts
- 18.4 --proxycommand
- 18.5 UTF-8 filenames in Content-Disposition
- 18.6 Option to make -Z merge lined based outputs on stdout
- 18.8 Consider convenience options for JSON and XML?
- 18.9 Choose the name of file in braces for complex URLs
- 18.10 improve how curl works in a windows console window
- 18.11 Windows: set attribute 'archive' for completed downloads
- 18.12 keep running, read instructions from pipe/socket
- 18.13 Ratelimit or wait between serial requests
- 18.14 --dry-run
- 18.15 --retry should resume
- 18.16 send only part of --data
- 18.17 consider file name from the redirected URL with -O ?
- 18.18 retry on network is unreachable
- 18.19 expand ~/ in config files
- 18.20 host name sections in config files
- 18.21 retry on the redirected-to URL
- 18.23 Set the modification date on an uploaded file
- 18.24 Use multiple parallel transfers for a single download
- 18.25 Prevent terminal injection when writing to terminal
- 18.26 Custom progress meter update interval
- 18.27 -J and -O with %-encoded file names
- 18.28 -J with -C -
- 18.29 --retry and transfer timeouts
-
- 19. Build
- 19.1 roffit
- 19.2 Enable PIE and RELRO by default
- 19.3 Do not use GNU libtool on OpenBSD
- 19.4 Package curl for Windows in a signed installer
- 19.5 make configure use --cache-file more and better
- 19.6 build curl with Windows Unicode support
-
- 20. Test suite
- 20.1 SSL tunnel
- 20.2 nicer lacking perl message
- 20.3 more protocols supported
- 20.4 more platforms supported
- 20.5 Add support for concurrent connections
- 20.6 Use the RFC 6265 test suite
- 20.7 Support LD_PRELOAD on macOS
- 20.8 Run web-platform-tests URL tests
-
- 21. MQTT
- 21.1 Support rate-limiting
-
-==============================================================================
-
-1. libcurl
-
-1.1 TFO support on Windows
-
- libcurl supports the CURLOPT_TCP_FASTOPEN option since 7.49.0 for Linux and
- Mac OS. Windows supports TCP Fast Open starting with Windows 10, version 1607
- and we should add support for it.
-
- TCP Fast Open is supported on several platforms but not on Windows. Work on
- this was once started but never finished.
-
- See https://github.com/curl/curl/pull/3378
-
-1.2 Consult %APPDATA% also for .netrc
-
- %APPDATA%\.netrc is not considered when running on Windows. should not it?
-
- See https://github.com/curl/curl/issues/4016
-
-1.3 struct lifreq
-
- Use 'struct lifreq' and SIOCGLIFADDR instead of 'struct ifreq' and
- SIOCGIFADDR on newer Solaris versions as they claim the latter is obsolete.
- To support IPv6 interface addresses for network interfaces properly.
-
-1.4 Better and more sharing
-
- The share interface could benefit from allowing the alt-svc cache to be
- possible to share between easy handles.
-
- See https://github.com/curl/curl/issues/4476
-
- The share interface offers CURL_LOCK_DATA_CONNECT to have multiple easy
- handle share a connection cache, but due to how connections are used they are
- still not thread-safe when used shared.
-
- See https://github.com/curl/curl/issues/4915 and lib1541.c
-
- The share interface offers CURL_LOCK_DATA_HSTS to have multiple easy handle
- share a HSTS cache, but this is not thread-safe.
-
-1.5 get rid of PATH_MAX
-
- Having code use and rely on PATH_MAX is not nice:
- https://insanecoding.blogspot.com/2007/11/pathmax-simply-isnt.html
-
- Currently the libssh2 SSH based code uses it, but to remove PATH_MAX from
- there we need libssh2 to properly tell us when we pass in a too small buffer
- and its current API (as of libssh2 1.2.7) does not.
-
-1.6 native IDN support on macOS
-
- On recent macOS versions, the getaddrinfo() function itself has built-in IDN
- support. By setting the AI_CANONNAME flag, the function will return the
- encoded name in the ai_canonname struct field in the returned information.
- This could be used by curl on macOS when built without a separate IDN library
- and an IDN host name is used in a URL.
-
- See initial work in https://github.com/curl/curl/pull/5371
-
-1.8 CURLOPT_RESOLVE for any port number
-
- This option allows applications to set a replacement IP address for a given
- host + port pair. Consider making support for providing a replacement address
- for the host name on all port numbers.
-
- See https://github.com/curl/curl/issues/1264
-
-1.9 Cache negative name resolves
-
- A name resolve that has failed is likely to fail when made again within a
- short period of time. Currently we only cache positive responses.
-
-1.10 auto-detect proxy
-
- libcurl could be made to detect the system proxy setup automatically and use
- that. On Windows, macOS and Linux desktops for example.
-
- The pull-request to use libproxy for this was deferred due to doubts on the
- reliability of the dependency and how to use it:
- https://github.com/curl/curl/pull/977
-
- libdetectproxy is a (C++) library for detecting the proxy on Windows
- https://github.com/paulharris/libdetectproxy
-
-1.11 minimize dependencies with dynamically loaded modules
-
- We can create a system with loadable modules/plug-ins, where these modules
- would be the ones that link to 3rd party libs. That would allow us to avoid
- having to load ALL dependencies since only the necessary ones for this
- app/invoke/used protocols would be necessary to load. See
- https://github.com/curl/curl/issues/349
-
-1.12 updated DNS server while running
-
- If /etc/resolv.conf gets updated while a program using libcurl is running, it
- is may cause name resolves to fail unless res_init() is called. We should
- consider calling res_init() + retry once unconditionally on all name resolve
- failures to mitigate against this. Firefox works like that. Note that Windows
- does not have res_init() or an alternative.
-
- https://github.com/curl/curl/issues/2251
-
-1.13 c-ares and CURLOPT_OPENSOCKETFUNCTION
-
- curl will create most sockets via the CURLOPT_OPENSOCKETFUNCTION callback and
- close them with the CURLOPT_CLOSESOCKETFUNCTION callback. However, c-ares
- does not use those functions and instead opens and closes the sockets
- itself. This means that when curl passes the c-ares socket to the
- CURLMOPT_SOCKETFUNCTION it is not owned by the application like other sockets.
-
- See https://github.com/curl/curl/issues/2734
-
-1.15 Monitor connections in the connection pool
-
- libcurl's connection cache or pool holds a number of open connections for the
- purpose of possible subsequent connection reuse. It may contain a few up to a
- significant amount of connections. Currently, libcurl leaves all connections
- as they are and first when a connection is iterated over for matching or
- reuse purpose it is verified that it is still alive.
-
- Those connections may get closed by the server side for idleness or they may
- get an HTTP/2 ping from the peer to verify that they are still alive. By
- adding monitoring of the connections while in the pool, libcurl can detect
- dead connections (and close them) better and earlier, and it can handle
- HTTP/2 pings to keep such ones alive even when not actively doing transfers
- on them.
-
-1.16 Try to URL encode given URL
-
- Given a URL that for example contains spaces, libcurl could have an option
- that would try somewhat harder than it does now and convert spaces to %20 and
- perhaps URL encoded byte values over 128 etc (basically do what the redirect
- following code already does).
-
- https://github.com/curl/curl/issues/514
-
-1.17 Add support for IRIs
-
- IRIs (RFC 3987) allow localized, non-ascii, names in the URL. To properly
- support this, curl/libcurl would need to translate/encode the given input
- from the input string encoding into percent encoded output "over the wire".
-
- To make that work smoothly for curl users even on Windows, curl would
- probably need to be able to convert from several input encodings.
-
-1.18 try next proxy if one does not work
-
- Allow an application to specify a list of proxies to try, and failing to
- connect to the first go on and try the next instead until the list is
- exhausted. Browsers support this feature at least when they specify proxies
- using PACs.
-
- https://github.com/curl/curl/issues/896
-
-1.19 provide timing info for each redirect
-
- curl and libcurl provide timing information via a set of different
- time-stamps (CURLINFO_*_TIME). When curl is following redirects, those
- returned time value are the accumulated sums. An improvement could be to
- offer separate timings for each redirect.
-
- https://github.com/curl/curl/issues/6743
-
-1.20 SRV and URI DNS records
-
- Offer support for resolving SRV and URI DNS records for libcurl to know which
- server to connect to for various protocols (including HTTP).
-
-1.21 netrc caching and sharing
-
- The netrc file is read and parsed each time a connection is setup, which
- means that if a transfer needs multiple connections for authentication or
- redirects, the file might be reread (and parsed) multiple times. This makes
- it impossible to provide the file as a pipe.
-
-1.22 CURLINFO_PAUSE_STATE
-
- Return information about the transfer's current pause state, in both
- directions. https://github.com/curl/curl/issues/2588
-
-1.23 Offer API to flush the connection pool
-
- Sometimes applications want to flush all the existing connections kept alive.
- An API could allow a forced flush or just a forced loop that would properly
- close all connections that have been closed by the server already.
-
-1.25 Expose tried IP addresses that failed
-
- When libcurl fails to connect to a host, it could offer the application the
- addresses that were used in the attempt. Source + dest IP, source + dest port
- and protocol (UDP or TCP) for each failure. Possibly as a callback. Perhaps
- also provide "reason".
-
- https://github.com/curl/curl/issues/2126
-
-1.28 FD_CLOEXEC
-
- It sets the close-on-exec flag for the file descriptor, which causes the file
- descriptor to be automatically (and atomically) closed when any of the
- exec-family functions succeed. Should probably be set by default?
-
- https://github.com/curl/curl/issues/2252
-
-1.29 WebSocket read callback
-
- Call the read callback once the connection is established to allow sending
- the first message in the connection.
-
- https://github.com/curl/curl/issues/11402
-
-1.30 config file parsing
-
- Consider providing an API, possibly in a separate companion library, for
- parsing a config file like curl's -K/--config option to allow applications to
- get the same ability to read curl options from files.
-
- See https://github.com/curl/curl/issues/3698
-
-1.31 erase secrets from heap/stack after use
-
- Introducing a concept and system to erase secrets from memory after use, it
- could help mitigate and lessen the impact of (future) security problems etc.
- However: most secrets are passed to libcurl as clear text from the
- application and then clearing them within the library adds nothing...
-
- https://github.com/curl/curl/issues/7268
-
-1.32 add asynch getaddrinfo support
-
- Use getaddrinfo_a() to provide an asynch name resolver backend to libcurl
- that does not use threads and does not depend on c-ares. The getaddrinfo_a
- function is (probably?) glibc specific but that is a widely used libc among
- our users.
-
- https://github.com/curl/curl/pull/6746
-
-1.33 make DoH inherit more transfer properties
-
- Some options are not inherited because they are not relevant for the DoH SSL
- connections, or inheriting the option may result in unexpected behavior. For
- example the user's debug function callback is not inherited because it would
- be unexpected for internal handles (ie DoH handles) to be passed to that
- callback.
-
- If an option is not inherited then it is not possible to set it separately
- for DoH without a DoH-specific option. For example:
- CURLOPT_DOH_SSL_VERIFYHOST, CURLOPT_DOH_SSL_VERIFYPEER and
- CURLOPT_DOH_SSL_VERIFYSTATUS.
-
- See https://github.com/curl/curl/issues/6605
-
-2. libcurl - multi interface
-
-2.1 More non-blocking
-
- Make sure we do not ever loop because of non-blocking sockets returning
- EWOULDBLOCK or similar. Blocking cases include:
-
- - Name resolves on non-windows unless c-ares or the threaded resolver is used.
-
- - The threaded resolver may block on cleanup:
- https://github.com/curl/curl/issues/4852
-
- - file:// transfers
-
- - TELNET transfers
-
- - GSSAPI authentication for FTP transfers
-
- - The "DONE" operation (post transfer protocol-specific actions) for the
- protocols SFTP, SMTP, FTP. Fixing multi_done() for this is a worthy task.
-
- - curl_multi_remove_handle for any of the above. See section 2.3.
-
-2.2 Better support for same name resolves
-
- If a name resolve has been initiated for name NN and a second easy handle
- wants to resolve that name as well, make it wait for the first resolve to end
- up in the cache instead of doing a second separate resolve. This is
- especially needed when adding many simultaneous handles using the same host
- name when the DNS resolver can get flooded.
-
-2.3 Non-blocking curl_multi_remove_handle()
-
- The multi interface has a few API calls that assume a blocking behavior, like
- add_handle() and remove_handle() which limits what we can do internally. The
- multi API need to be moved even more into a single function that "drives"
- everything in a non-blocking manner and signals when something is done. A
- remove or add would then only ask for the action to get started and then
- multi_perform() etc still be called until the add/remove is completed.
-
-2.4 Split connect and authentication process
-
- The multi interface treats the authentication process as part of the connect
- phase. As such any failures during authentication will not trigger the relevant
- QUIT or LOGOFF for protocols such as IMAP, POP3 and SMTP.
-
-2.5 Edge-triggered sockets should work
-
- The multi_socket API should work with edge-triggered socket events. One of
- the internal actions that need to be improved for this to work perfectly is
- the 'maxloops' handling in transfer.c:readwrite_data().
-
-2.6 multi upkeep
-
- In libcurl 7.62.0 we introduced curl_easy_upkeep. It unfortunately only works
- on easy handles. We should introduces a version of that for the multi handle,
- and also consider doing "upkeep" automatically on connections in the
- connection pool when the multi handle is in used.
-
- See https://github.com/curl/curl/issues/3199
-
-2.7 Virtual external sockets
-
- libcurl performs operations on the given file descriptor that presumes it is
- a socket and an application cannot replace them at the moment. Allowing an
- application to fully replace those would allow a larger degree of freedom and
- flexibility.
-
- See https://github.com/curl/curl/issues/5835
-
-2.8 dynamically decide to use socketpair
-
- For users who do not use curl_multi_wait() or do not care for
- curl_multi_wakeup(), we could introduce a way to make libcurl NOT
- create a socketpair in the multi handle.
-
- See https://github.com/curl/curl/issues/4829
-
-3. Documentation
-
-3.1 Improve documentation about fork safety
-
- See https://github.com/curl/curl/issues/6968
-
-3.2 Provide cmake config-file
-
- A config-file package is a set of files provided by us to allow applications
- to write cmake scripts to find and use libcurl easier. See
- https://github.com/curl/curl/issues/885
-
-4. FTP
-
-4.1 HOST
-
- HOST is a command for a client to tell which host name to use, to offer FTP
- servers named-based virtual hosting:
-
- https://datatracker.ietf.org/doc/html/rfc7151
-
-4.2 Alter passive/active on failure and retry
-
- When trying to connect passively to a server which only supports active
- connections, libcurl returns CURLE_FTP_WEIRD_PASV_REPLY and closes the
- connection. There could be a way to fallback to an active connection (and
- vice versa). https://curl.se/bug/feature.cgi?id=1754793
-
-4.3 Earlier bad letter detection
-
- Make the detection of (bad) %0d and %0a codes in FTP URL parts earlier in the
- process to avoid doing a resolve and connect in vain.
-
-4.4 Support CURLOPT_PREQUOTE for dir listings too
-
- The lack of support is mostly an oversight and requires the FTP state machine
- to get updated to get fixed.
-
- https://github.com/curl/curl/issues/8602
-
-4.5 ASCII support
-
- FTP ASCII transfers do not follow RFC 959. They do not convert the data
- accordingly.
-
-4.6 GSSAPI via Windows SSPI
-
- In addition to currently supporting the SASL GSSAPI mechanism (Kerberos V5)
- via third-party GSS-API libraries, such as Heimdal or MIT Kerberos, also add
- support for GSSAPI authentication via Windows SSPI.
-
-4.7 STAT for LIST without data connection
-
- Some FTP servers allow STAT for listing directories instead of using LIST,
- and the response is then sent over the control connection instead of as the
- otherwise usedw data connection: https://www.nsftools.com/tips/RawFTP.htm#STAT
-
- This is not detailed in any FTP specification.
-
-4.8 Passive transfer could try other IP addresses
-
- When doing FTP operations through a proxy at localhost, the reported spotted
- that curl only tried to connect once to the proxy, while it had multiple
- addresses and a failed connect on one address should make it try the next.
-
- After switching to passive mode (EPSV), curl could try all IP addresses for
- "localhost". Currently it tries ::1, but it should also try 127.0.0.1.
-
- See https://github.com/curl/curl/issues/1508
-
-5. HTTP
-
-5.1 Provide the error body from a CONNECT response
-
- When curl receives a body response from a CONNECT request to a proxy, it will
- always just read and ignore it. It would make some users happy if curl
- instead optionally would be able to make that responsible available. Via a new
- callback? Through some other means?
-
- See https://github.com/curl/curl/issues/9513
-
-5.2 Obey Retry-After in redirects
-
- The Retry-After is said to dicate "the minimum time that the user agent is
- asked to wait before issuing the redirected request" and libcurl does not
- obey this.
-
- See https://github.com/curl/curl/issues/11447
-
-5.3 Rearrange request header order
-
- Server implementors often make an effort to detect browser and to reject
- clients it can detect to not match. One of the last details we cannot yet
- control in libcurl's HTTP requests, which also can be exploited to detect
- that libcurl is in fact used even when it tries to impersonate a browser, is
- the order of the request headers. I propose that we introduce a new option in
- which you give headers a value, and then when the HTTP request is built it
- sorts the headers based on that number. We could then have internally created
- headers use a default value so only headers that need to be moved have to be
- specified.
-
-5.4 Allow SAN names in HTTP/2 server push
-
- curl only allows HTTP/2 push promise if the provided :authority header value
- exactly matches the host name given in the URL. It could be extended to allow
- any name that would match the Subject Alternative Names in the server's TLS
- certificate.
-
- See https://github.com/curl/curl/pull/3581
-
-5.5 auth= in URLs
-
- Add the ability to specify the preferred authentication mechanism to use by
- using ;auth=<mech> in the login part of the URL.
-
- For example:
-
- http://test:pass;auth=NTLM@example.com would be equivalent to specifying
- --user test:pass;auth=NTLM or --user test:pass --ntlm from the command line.
-
- Additionally this should be implemented for proxy base URLs as well.
-
-5.6 alt-svc should fallback if alt-svc does not work
-
- The alt-svc: header provides a set of alternative services for curl to use
- instead of the original. If the first attempted one fails, it should try the
- next etc and if all alternatives fail go back to the original.
-
- See https://github.com/curl/curl/issues/4908
-
-5.7 Require HTTP version X or higher
-
- curl and libcurl provide options for trying higher HTTP versions (for example
- HTTP/2) but then still allows the server to pick version 1.1. We could
- consider adding a way to require a minimum version.
-
- See https://github.com/curl/curl/issues/7980
-
-6. TELNET
-
-6.1 ditch stdin
-
- Reading input (to send to the remote server) on stdin is a crappy solution
- for library purposes. We need to invent a good way for the application to be
- able to provide the data to send.
-
-6.2 ditch telnet-specific select
-
- Move the telnet support's network select() loop go away and merge the code
- into the main transfer loop. Until this is done, the multi interface will not
- work for telnet.
-
-6.3 feature negotiation debug data
-
- Add telnet feature negotiation data to the debug callback as header data.
-
-6.4 exit immediately upon connection if stdin is /dev/null
-
- If it did, curl could be used to probe if there is an server there listening
- on a specific port. That is, the following command would exit immediately
- after the connection is established with exit code 0:
-
-    curl -s --connect-timeout 2 telnet://example.com:80 </dev/null
-
-7. SMTP
-
-7.1 Passing NOTIFY option to CURLOPT_MAIL_RCPT
-
- Is there a way to pass the NOTIFY option to the CURLOPT_MAIL_RCPT option ?  I
- set a string that already contains a bracket. For instance something like
- that: curl_slist_append( recipients, "<foo@bar> NOTIFY=SUCCESS,FAILURE" );
-
- https://github.com/curl/curl/issues/8232
-
-7.2 Enhanced capability support
-
- Add the ability, for an application that uses libcurl, to obtain the list of
- capabilities returned from the EHLO command.
-
-7.3 Add CURLOPT_MAIL_CLIENT option
-
- Rather than use the URL to specify the mail client string to present in the
- HELO and EHLO commands, libcurl should support a new CURLOPT specifically for
- specifying this data as the URL is non-standard and to be honest a bit of a
- hack ;-)
-
- Please see the following thread for more information:
- https://curl.se/mail/lib-2012-05/0178.html
-
-
-8. POP3
-
-8.2 Enhanced capability support
-
- Add the ability, for an application that uses libcurl, to obtain the list of
- capabilities returned from the CAPA command.
-
-9. IMAP
-
-9.1 Enhanced capability support
-
- Add the ability, for an application that uses libcurl, to obtain the list of
- capabilities returned from the CAPABILITY command.
-
-10. LDAP
-
-10.1 SASL based authentication mechanisms
-
- Currently the LDAP module only supports ldap_simple_bind_s() in order to bind
- to an LDAP server. However, this function sends username and password details
- using the simple authentication mechanism (as clear text). However, it should
- be possible to use ldap_bind_s() instead specifying the security context
- information ourselves.
-
-10.2 CURLOPT_SSL_CTX_FUNCTION for LDAPS
-
- CURLOPT_SSL_CTX_FUNCTION works perfectly for HTTPS and email protocols, but
- it has no effect for LDAPS connections.
-
- https://github.com/curl/curl/issues/4108
-
-10.3 Paged searches on LDAP server
-
- https://github.com/curl/curl/issues/4452
-
-10.4 Certificate-Based Authentication
-
- LDAPS not possible with MAC and Windows with Certificate-Based Authentication
-
- https://github.com/curl/curl/issues/9641
-
-11. SMB
-
-11.1 File listing support
-
- Add support for listing the contents of a SMB share. The output should
- probably be the same as/similar to FTP.
-
-11.2 Honor file timestamps
-
- The timestamp of the transferred file should reflect that of the original
- file.
-
-11.3 Use NTLMv2
-
- Currently the SMB authentication uses NTLMv1.
-
-11.4 Create remote directories
-
- Support for creating remote directories when uploading a file to a directory
- that does not exist on the server, just like --ftp-create-dirs.
-
-
-12. FILE
-
-12.1 Directory listing for FILE:
-
- Add support for listing the contents of a directory accessed with FILE. The
- output should probably be the same as/similar to FTP.
-
-
-13. TLS
-
-13.1 TLS-PSK with OpenSSL
-
- Transport Layer Security pre-shared key ciphersuites (TLS-PSK) is a set of
- cryptographic protocols that provide secure communication based on pre-shared
- keys (PSKs). These pre-shared keys are symmetric keys shared in advance among
- the communicating parties.
-
- https://github.com/curl/curl/issues/5081
-
-13.2 Provide mutex locking API
-
- Provide a libcurl API for setting mutex callbacks in the underlying SSL
- library, so that the same application code can use mutex-locking
- independently of OpenSSL or GnutTLS being used.
-
-13.3 Defeat TLS fingerprinting
-
- By changing the order of TLS extensions provided in the TLS handshake, it is
- sometimes possible to circumvent TLS fingerprinting by servers. The TLS
- extension order is of course not the only way to fingerprint a client.
-
- See https://github.com/curl/curl/issues/8119
-
-13.4 Cache/share OpenSSL contexts
-
- "Look at SSL cafile - quick traces look to me like these are done on every
- request as well, when they should only be necessary once per SSL context (or
- once per handle)". The major improvement we can rather easily do is to make
- sure we do not create and kill a new SSL "context" for every request, but
- instead make one for every connection and reuse that SSL context in the same
- style connections are reused. It will make us use slightly more memory but it
- will libcurl do less creations and deletions of SSL contexts.
-
- Technically, the "caching" is probably best implemented by getting added to
- the share interface so that easy handles who want to and can reuse the
- context specify that by sharing with the right properties set.
-
- https://github.com/curl/curl/issues/1110
-
-13.5 Export session ids
-
- Add an interface to libcurl that enables "session IDs" to get
- exported/imported. Cris Bailiff said: "OpenSSL has functions which can
- serialise the current SSL state to a buffer of your choice, and recover/reset
- the state from such a buffer at a later date - this is used by mod_ssl for
- apache to implement and SSL session ID cache".
-
-13.6 Provide callback for cert verification
-
- OpenSSL supports a callback for customised verification of the peer
- certificate, but this does not seem to be exposed in the libcurl APIs. Could
- it be? There is so much that could be done if it were.
-
-13.7 Less memory massaging with Schannel
-
- The Schannel backend does a lot of custom memory management we would rather
- avoid: the repeated alloc + free in sends and the custom memory + realloc
- system for encrypted and decrypted data. That should be avoided and reduced
- for 1) efficiency and 2) safety.
-
-13.8 Support DANE
-
- DNS-Based Authentication of Named Entities (DANE) is a way to provide SSL
- keys and certs over DNS using DNSSEC as an alternative to the CA model.
- https://www.rfc-editor.org/rfc/rfc6698.txt
-
- An initial patch was posted by Suresh Krishnaswamy on March 7th 2013
- (https://curl.se/mail/lib-2013-03/0075.html) but it was a too simple
- approach. See Daniel's comments:
- https://curl.se/mail/lib-2013-03/0103.html . libunbound may be the
- correct library to base this development on.
-
- Björn Stenberg wrote a separate initial take on DANE that was never
- completed.
-
-13.9 TLS record padding
-
- TLS (1.3) offers optional record padding and OpenSSL provides an API for it.
- I could make sense for libcurl to offer this ability to applications to make
- traffic patterns harder to figure out by network traffic observers.
-
- See https://github.com/curl/curl/issues/5398
-
-13.10 Support Authority Information Access certificate extension (AIA)
-
- AIA can provide various things like CRLs but more importantly information
- about intermediate CA certificates that can allow validation path to be
- fulfilled when the HTTPS server does not itself provide them.
-
- Since AIA is about downloading certs on demand to complete a TLS handshake,
- it is probably a bit tricky to get done right.
-
- See https://github.com/curl/curl/issues/2793
-
-13.12 Reduce CA certificate bundle reparsing
-
- When using the OpenSSL backend, curl will load and reparse the CA bundle at
- the creation of the "SSL context" when it sets up a connection to do a TLS
- handshake. A more effective way would be to somehow cache the CA bundle to
- avoid it having to be repeatedly reloaded and reparsed.
-
- See https://github.com/curl/curl/issues/9379
-
-13.13 Make sure we forbid TLS 1.3 post-handshake authentication
-
- RFC 8740 explains how using HTTP/2 must forbid the use of TLS 1.3
- post-handshake authentication. We should make sure to live up to that.
-
- See https://github.com/curl/curl/issues/5396
-
-13.14 Support the clienthello extension
-
- Certain stupid networks and middle boxes have a problem with SSL handshake
- packets that are within a certain size range because how that sets some bits
- that previously (in older TLS version) were not set. The clienthello
- extension adds padding to avoid that size range.
-
- https://datatracker.ietf.org/doc/html/rfc7685
- https://github.com/curl/curl/issues/2299
-
-14. GnuTLS
-
-14.2 check connection
-
- Add a way to check if the connection seems to be alive, to correspond to the
- SSL_peak() way we use with OpenSSL.
-
-15. Schannel
-
-15.1 Extend support for client certificate authentication
-
- The existing support for the -E/--cert and --key options could be
- extended by supplying a custom certificate and key in PEM format, see:
- - Getting a Certificate for Schannel
-   https://msdn.microsoft.com/en-us/library/windows/desktop/aa375447.aspx
-
-15.2 Extend support for the --ciphers option
-
- The existing support for the --ciphers option could be extended
- by mapping the OpenSSL/GnuTLS cipher suites to the Schannel APIs, see
- - Specifying Schannel Ciphers and Cipher Strengths
-   https://msdn.microsoft.com/en-us/library/windows/desktop/aa380161.aspx
-
-15.4 Add option to allow abrupt server closure
-
- libcurl w/schannel will error without a known termination point from the
- server (such as length of transfer, or SSL "close notify" alert) to prevent
- against a truncation attack. Really old servers may neglect to send any
- termination point. An option could be added to ignore such abrupt closures.
-
- https://github.com/curl/curl/issues/4427
-
-16. SASL
-
-16.1 Other authentication mechanisms
-
- Add support for other authentication mechanisms such as OLP,
- GSS-SPNEGO and others.
-
-16.2 Add QOP support to GSSAPI authentication
-
- Currently the GSSAPI authentication only supports the default QOP of auth
- (Authentication), whilst Kerberos V5 supports both auth-int (Authentication
- with integrity protection) and auth-conf (Authentication with integrity and
- privacy protection).
-
-
-17. SSH protocols
-
-17.1 Multiplexing
-
- SSH is a perfectly fine multiplexed protocols which would allow libcurl to do
- multiple parallel transfers from the same host using the same connection,
- much in the same spirit as HTTP/2 does. libcurl however does not take
- advantage of that ability but will instead always create a new connection for
- new transfers even if an existing connection already exists to the host.
-
- To fix this, libcurl would have to detect an existing connection and "attach"
- the new transfer to the existing one.
-
-17.2 Handle growing SFTP files
-
- The SFTP code in libcurl checks the file size *before* a transfer starts and
- then proceeds to transfer exactly that amount of data. If the remote file
- grows while the transfer is in progress libcurl will not notice and will not
- adapt. The OpenSSH SFTP command line tool does and libcurl could also just
- attempt to download more to see if there is more to get...
-
- https://github.com/curl/curl/issues/4344
-
-17.3 Read keys from ~/.ssh/id_ecdsa, id_ed25519
-
- The libssh2 backend in curl is limited to only reading keys from id_rsa and
- id_dsa, which makes it fail connecting to servers that use more modern key
- types.
-
- https://github.com/curl/curl/issues/8586
-
-17.4 Support CURLOPT_PREQUOTE
-
- The two other QUOTE options are supported for SFTP, but this was left out for
- unknown reasons.
-
-17.5 SSH over HTTPS proxy with more backends
-
- The SSH based protocols SFTP and SCP did not work over HTTPS proxy at
- all until PR https://github.com/curl/curl/pull/6021 brought the
- functionality with the libssh2 backend. Presumably, this support
- can/could be added for the other backends as well.
-
-17.6 SFTP with SCP://
-
- OpenSSH 9 switched their 'scp' tool to speak SFTP under the hood. Going
- forward it might be worth having curl or libcurl attempt SFTP if SCP fails to
- follow suite.
-
-18. Command line tool
-
-18.1 sync
-
- "curl --sync http://example.com/feed[1-100].rss" or
- "curl --sync http://example.net/{index,calendar,history}.html"
-
- Downloads a range or set of URLs using the remote name, but only if the
- remote file is newer than the local file. A Last-Modified HTTP date header
- should also be used to set the mod date on the downloaded file.
-
-18.2 glob posts
-
- Globbing support for -d and -F, as in 'curl -d "name=foo[0-9]" URL'.
- This is easily scripted though.
-
-18.4 --proxycommand
-
- Allow the user to make curl run a command and use its stdio to make requests
- and not do any network connection by itself. Example:
-
-   curl --proxycommand 'ssh pi@raspberrypi.local -W 10.1.1.75 80' \
-        http://some/otherwise/unavailable/service.php
-
- See https://github.com/curl/curl/issues/4941
-
-18.5 UTF-8 filenames in Content-Disposition
-
- RFC 6266 documents how UTF-8 names can be passed to a client in the
- Content-Disposition header, and curl does not support this.
-
- https://github.com/curl/curl/issues/1888
-
-18.6 Option to make -Z merge lined based outputs on stdout
-
- When a user requests multiple lined based files using -Z and sends them to
- stdout, curl will not "merge" and send complete lines fine but may send
- partial lines from several sources.
-
- https://github.com/curl/curl/issues/5175
-
-18.8 Consider convenience options for JSON and XML?
-
- Could we add `--xml` or `--json` to add headers needed to call rest API:
-
- `--xml` adds -H 'Content-Type: application/xml' -H "Accept: application/xml" and
- `--json` adds -H 'Content-Type: application/json' -H "Accept: application/json"
-
- Setting Content-Type when doing a GET or any other method without a body
- would be a bit strange I think - so maybe only add CT for requests with body?
- Maybe plain `--xml` and ` --json` are a bit too brief and generic. Maybe
- `--http-json` etc?
-
- See https://github.com/curl/curl/issues/5203
-
-18.9 Choose the name of file in braces for complex URLs
-
- When using braces to download a list of URLs and you use complicated names
- in the list of alternatives, it could be handy to allow curl to use other
- names when saving.
-
- Consider a way to offer that. Possibly like
- {partURL1:name1,partURL2:name2,partURL3:name3} where the name following the
- colon is the output name.
-
- See https://github.com/curl/curl/issues/221
-
-18.10 improve how curl works in a windows console window
-
- If you pull the scrollbar when transferring with curl in a Windows console
- window, the transfer is interrupted and can get disconnected. This can
- probably be improved. See https://github.com/curl/curl/issues/322
-
-18.11 Windows: set attribute 'archive' for completed downloads
-
- The archive bit (FILE_ATTRIBUTE_ARCHIVE, 0x20) separates files that shall be
- backed up from those that are either not ready or have not changed.
-
- Downloads in progress are neither ready to be backed up, nor should they be
- opened by a different process. Only after a download has been completed it's
- sensible to include it in any integer snapshot or backup of the system.
-
- See https://github.com/curl/curl/issues/3354
-
-18.12 keep running, read instructions from pipe/socket
-
- Provide an option that makes curl not exit after the last URL (or even work
- without a given URL), and then make it read instructions passed on a pipe or
- over a socket to make further instructions so that a second subsequent curl
- invoke can talk to the still running instance and ask for transfers to get
- done, and thus maintain its connection pool, DNS cache and more.
-
-18.13 Ratelimit or wait between serial requests
-
- Consider a command line option that can make curl do multiple serial requests
- slow, potentially with a (random) wait between transfers. There is also a
- proposed set of standard HTTP headers to let servers let the client adapt to
- its rate limits:
- https://www.ietf.org/id/draft-polli-ratelimit-headers-02.html
-
- See https://github.com/curl/curl/issues/5406
-
-18.14 --dry-run
-
- A command line option that makes curl show exactly what it would do and send
- if it would run for real.
-
- See https://github.com/curl/curl/issues/5426
-
-18.15 --retry should resume
-
- When --retry is used and curl actually retries transfer, it should use the
- already transferred data and do a resumed transfer for the rest (when
- possible) so that it does not have to transfer the same data again that was
- already transferred before the retry.
-
- See https://github.com/curl/curl/issues/1084
-
-18.16 send only part of --data
-
- When the user only wants to send a small piece of the data provided with
- --data or --data-binary, like when that data is a huge file, consider a way
- to specify that curl should only send a piece of that. One suggested syntax
- would be: "--data-binary @largefile.zip!1073741823-2147483647".
-
- See https://github.com/curl/curl/issues/1200
-
-18.17 consider file name from the redirected URL with -O ?
-
- When a user gives a URL and uses -O, and curl follows a redirect to a new
- URL, the file name is not extracted and used from the newly redirected-to URL
- even if the new URL may have a much more sensible file name.
-
- This is clearly documented and helps for security since there is no surprise
- to users which file name that might get overwritten. But maybe a new option
- could allow for this or maybe -J should imply such a treatment as well as -J
- already allows for the server to decide what file name to use so it already
- provides the "may overwrite any file" risk.
-
- This is extra tricky if the original URL has no file name part at all since
- then the current code path will error out with an error message, and we cannot
- *know* already at that point if curl will be redirected to a URL that has a
- file name...
-
- See https://github.com/curl/curl/issues/1241
-
-18.18 retry on network is unreachable
-
- The --retry option retries transfers on "transient failures". We later added
- --retry-connrefused to also retry for "connection refused" errors.
-
- Suggestions have been brought to also allow retry on "network is unreachable"
- errors and while totally reasonable, maybe we should consider a way to make
- this more configurable than to add a new option for every new error people
- want to retry for?
-
- https://github.com/curl/curl/issues/1603
-
-18.19 expand ~/ in config files
-
- For example .curlrc could benefit from being able to do this.
-
- See https://github.com/curl/curl/issues/2317
-
-18.20 host name sections in config files
-
- config files would be more powerful if they could set different
- configurations depending on used URLs, host name or possibly origin. Then a
- default .curlrc could a specific user-agent only when doing requests against
- a certain site.
-
-18.21 retry on the redirected-to URL
-
- When curl is told to --retry a failed transfer and follows redirects, it
- might get an HTTP 429 response from the redirected-to URL and not the
- original one, which then could make curl decide to rather retry the transfer
- on that URL only instead of the original operation to the original URL.
-
- Perhaps extra emphasized if the original transfer is a large POST that
- redirects to a separate GET, and that GET is what gets the 529
-
- See https://github.com/curl/curl/issues/5462
-
-18.23 Set the modification date on an uploaded file
-
- For SFTP and possibly FTP, curl could offer an option to set the
- modification time for the uploaded file.
-
- See https://github.com/curl/curl/issues/5768
-
-18.24 Use multiple parallel transfers for a single download
-
- To enhance transfer speed, downloading a single URL can be split up into
- multiple separate range downloads that get combined into a single final
- result.
-
- An ideal implementation would not use a specified number of parallel
- transfers, but curl could:
- - First start getting the full file as transfer A
- - If after N seconds have passed and the transfer is expected to continue for
-   M seconds or more, add a new transfer (B) that asks for the second half of
-   A's content (and stop A at the middle).
- - If splitting up the work improves the transfer rate, it could then be done
-   again. Then again, etc up to a limit.
-
- This way, if transfer B fails (because Range: is not supported) it will let
- transfer A remain the single one. N and M could be set to some sensible
- defaults.
-
- See https://github.com/curl/curl/issues/5774
-
-18.25 Prevent terminal injection when writing to terminal
-
- curl could offer an option to make escape sequence either non-functional or
- avoid cursor moves or similar to reduce the risk of a user getting tricked by
- clever tricks.
-
- See https://github.com/curl/curl/issues/6150
-
-18.26 Custom progress meter update interval
-
- Users who are for example doing large downloads in CI or remote setups might
- want the occasional progress meter update to see that the transfer is
- progressing and has not stuck, but they may not appreciate the
- many-times-a-second frequency curl can end up doing it with now.
-
-18.27 -J and -O with %-encoded file names
-
- -J/--remote-header-name does not decode %-encoded file names. RFC 6266 details
- how it should be done. The can of worm is basically that we have no charset
- handling in curl and ascii >=128 is a challenge for us. Not to mention that
- decoding also means that we need to check for nastiness that is attempted,
- like "../" sequences and the like. Probably everything to the left of any
- embedded slashes should be cut off.
- https://curl.se/bug/view.cgi?id=1294
-
- -O also does not decode %-encoded names, and while it has even less
- information about the charset involved the process is similar to the -J case.
-
- Note that we will not add decoding to -O without the user asking for it with
- some other means as well, since -O has always been documented to use the name
- exactly as specified in the URL.
-
-18.28 -J with -C -
-
- When using -J (with -O), automatically resumed downloading together with "-C
- -" fails. Without -J the same command line works. This happens because the
- resume logic is worked out before the target file name (and thus its
- pre-transfer size) has been figured out. This can be improved.
-
- https://curl.se/bug/view.cgi?id=1169
-
-18.29 --retry and transfer timeouts
-
- If using --retry and the transfer timeouts (possibly due to using -m or
- -y/-Y) the next attempt does not resume the transfer properly from what was
- downloaded in the previous attempt but will truncate and restart at the
- original position where it was at before the previous failed attempt. See
- https://curl.se/mail/lib-2008-01/0080.html and Mandriva bug report
- https://qa.mandriva.com/show_bug.cgi?id=22565
-
-
-
-19. Build
-
-19.1 roffit
-
- Consider extending 'roffit' to produce decent ASCII output, and use that
- instead of (g)nroff when building src/tool_hugehelp.c
-
-19.2 Enable PIE and RELRO by default
-
- Especially when having programs that execute curl via the command line, PIE
- renders the exploitation of memory corruption vulnerabilities a lot more
- difficult. This can be attributed to the additional information leaks being
- required to conduct a successful attack. RELRO, on the other hand, masks
- different binary sections like the GOT as read-only and thus kills a handful
- of techniques that come in handy when attackers are able to arbitrarily
- overwrite memory. A few tests showed that enabling these features had close
- to no impact, neither on the performance nor on the general functionality of
- curl.
-
-19.3 Do not use GNU libtool on OpenBSD
- When compiling curl on OpenBSD with "--enable-debug" it will give linking
- errors when you use GNU libtool. This can be fixed by using the libtool
- provided by OpenBSD itself. However for this the user always needs to invoke
- make with "LIBTOOL=/usr/bin/libtool". It would be nice if the script could
- have some magic to detect if this system is an OpenBSD host and then use the
- OpenBSD libtool instead.
-
- See https://github.com/curl/curl/issues/5862
-
-19.4 Package curl for Windows in a signed installer
-
- See https://github.com/curl/curl/issues/5424
-
-19.5 make configure use --cache-file more and better
-
- The configure script can be improved to cache more values so that repeated
- invokes run much faster.
-
- See https://github.com/curl/curl/issues/7753
-
-19.6 build curl with Windows Unicode support
-
- The user wants an easier way to tell autotools to build curl with Windows
- Unicode support, like ./configure --enable-windows-unicode
-
- See https://github.com/curl/curl/issues/7229
-
-20. Test suite
-
-20.1 SSL tunnel
-
- Make our own version of stunnel for simple port forwarding to enable HTTPS
- and FTP-SSL tests without the stunnel dependency, and it could allow us to
- provide test tools built with either OpenSSL or GnuTLS
-
-20.2 nicer lacking perl message
-
- If perl was not found by the configure script, do not attempt to run the tests
- but explain something nice why it does not.
-
-20.3 more protocols supported
-
- Extend the test suite to include more protocols. The telnet could just do FTP
- or http operations (for which we have test servers).
-
-20.4 more platforms supported
-
- Make the test suite work on more platforms. OpenBSD and Mac OS. Remove
- fork()s and it should become even more portable.
-
-20.5 Add support for concurrent connections
-
- Tests 836, 882 and 938 were designed to verify that separate connections are
- not used when using different login credentials in protocols that should not
- reuse a connection under such circumstances.
-
- Unfortunately, ftpserver.pl does not appear to support multiple concurrent
- connections. The read while() loop seems to loop until it receives a
- disconnect from the client, where it then enters the waiting for connections
- loop. When the client opens a second connection to the server, the first
- connection has not been dropped (unless it has been forced - which we
- should not do in these tests) and thus the wait for connections loop is never
- entered to receive the second connection.
-
-20.6 Use the RFC 6265 test suite
-
- A test suite made for HTTP cookies (RFC 6265) by Adam Barth is available at
- https://github.com/abarth/http-state/tree/master/tests
-
- It'd be really awesome if someone would write a script/setup that would run
- curl with that test suite and detect deviances. Ideally, that would even be
- incorporated into our regular test suite.
-
-20.7 Support LD_PRELOAD on macOS
-
- LD_RELOAD does not work on macOS, but there are tests which require it to run
- properly. Look into making the preload support in runtests.pl portable such
- that it uses DYLD_INSERT_LIBRARIES on macOS.
-
-20.8 Run web-platform-tests URL tests
-
- Run web-platform-tests URL tests and compare results with browsers on wpt.fyi
-
- It would help us find issues to fix and help us document where our parser
- differs from the WHATWG URL spec parsers.
-
- See https://github.com/curl/curl/issues/4477
-
-21. MQTT
-
-21.1 Support rate-limiting
-
- The rate-limiting logic is done in the PERFORMING state in multi.c but MQTT
- is not (yet) implemented to use that.
diff --git a/third-party/curl/docs/TODO.md b/third-party/curl/docs/TODO.md
new file mode 100644
index 0000000000..15d6c02ba0
--- /dev/null
+++ b/third-party/curl/docs/TODO.md
@@ -0,0 +1,1032 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# TODO intro
+
+Things to do in project curl. Please tell us what you think, contribute and
+send us patches that improve things.
+
+Be aware that these are things that we could do, or have once been considered
+things we could do. If you want to work on any of these areas, please consider
+bringing it up for discussions first on the mailing list so that we all agree
+it is still a good idea for the project.
+
+All bugs documented in the [known_bugs
+document](https://curl.se/docs/knownbugs.html) are subject for fixing.
+
+# libcurl
+
+## Consult `%APPDATA%` also for `.netrc`
+
+`%APPDATA%\.netrc` is not considered when running on Windows. Should it not?
+
+See [curl issue 4016](https://github.com/curl/curl/issues/4016)
+
+## `struct lifreq`
+
+Use `struct lifreq` and `SIOCGLIFADDR` instead of `struct ifreq` and
+`SIOCGIFADDR` on newer Solaris versions as they claim the latter is obsolete.
+To support IPv6 interface addresses for network interfaces properly.
+
+## alt-svc sharing
+
+The share interface could benefit from allowing the alt-svc cache to be
+possible to share between easy handles.
+
+See [curl issue 4476](https://github.com/curl/curl/issues/4476)
+
+The share interface offers CURL_LOCK_DATA_CONNECT to have multiple easy
+handle share a connection cache, but due to how connections are used they are
+still not thread-safe when used shared.
+
+See [curl issue 4915](https://github.com/curl/curl/issues/4915) and lib1541.c
+
+The share interface offers CURL_LOCK_DATA_HSTS to have multiple easy handle
+share an HSTS cache, but this is not thread-safe.
+
+## thread-safe sharing
+
+Using the share interface users can share some data between easy handles but
+several of the sharing options are documented as not safe and supported to
+share between multiple concurrent threads. Fixing this would enable more users
+to share data in more powerful ways.
+
+## updated DNS server while running
+
+If `/etc/resolv.conf` gets updated while a program using libcurl is running, it
+is may cause name resolves to fail unless `res_init()` is called. We should
+consider calling `res_init()` + retry once unconditionally on all name resolve
+failures to mitigate against this. Firefox works like that. Note that Windows
+does not have `res_init()` or an alternative.
+
+[curl issue 2251](https://github.com/curl/curl/issues/2251)
+
+## c-ares and CURLOPT_OPENSOCKETFUNCTION
+
+curl creates most sockets via the CURLOPT_OPENSOCKETFUNCTION callback and
+close them with the CURLOPT_CLOSESOCKETFUNCTION callback. c-ares does not use
+those functions and instead opens and closes the sockets itself. This means
+that when curl passes the c-ares socket to the CURLMOPT_SOCKETFUNCTION it is
+not owned by the application like other sockets.
+
+See [curl issue 2734](https://github.com/curl/curl/issues/2734)
+
+## Monitor connections in the connection pool
+
+libcurl's connection cache or pool holds a number of open connections for the
+purpose of possible subsequent connection reuse. It may contain a few up to a
+significant amount of connections. Currently, libcurl leaves all connections
+as they are and first when a connection is iterated over for matching or reuse
+purpose it is verified that it is still alive.
+
+Those connections may get closed by the server side for idleness or they may
+get an HTTP/2 ping from the peer to verify that they are still alive. By
+adding monitoring of the connections while in the pool, libcurl can detect
+dead connections (and close them) better and earlier, and it can handle HTTP/2
+pings to keep such ones alive even when not actively doing transfers on them.
+
+## Try to URL encode given URL
+
+Given a URL that for example contains spaces, libcurl could have an option
+that would try somewhat harder than it does now and convert spaces to %20 and
+perhaps URL encoded byte values over 128 etc (do what the redirect following
+code already does).
+
+[curl issue 514](https://github.com/curl/curl/issues/514)
+
+## Add support for IRIs
+
+IRIs (RFC 3987) allow localized, non-ASCII, names in the URL. To properly
+support this, curl/libcurl would need to translate/encode the given input
+from the input string encoding into percent encoded output "over the wire".
+
+To make that work smoothly for curl users even on Windows, curl would probably
+need to be able to convert from several input encodings.
+
+## try next proxy if one does not work
+
+Allow an application to specify a list of proxies to try, and failing to
+connect to the first go on and try the next instead until the list is
+exhausted. Browsers support this feature at least when they specify proxies
+using `PAC`.
+
+[curl issue 896](https://github.com/curl/curl/issues/896)
+
+## provide timing info for each redirect
+
+curl and libcurl provide timing information via a set of different time-stamps
+(CURLINFO_*_TIME). When curl is following redirects, those returned time value
+are the accumulated sums. An improvement could be to offer separate timings
+for each redirect.
+
+[curl issue 6743](https://github.com/curl/curl/issues/6743)
+
+## CURLINFO_PAUSE_STATE
+
+Return information about the transfer's current pause state, in both
+directions. See [curl issue 2588](https://github.com/curl/curl/issues/2588)
+
+## Expose tried IP addresses that failed
+
+When libcurl fails to connect to a host, it could offer the application the
+addresses that were used in the attempt. Source + destination IP, source +
+destination port and protocol (UDP or TCP) for each failure. Possibly as a
+callback. Perhaps also provide reason.
+
+[curl issue 2126](https://github.com/curl/curl/issues/2126)
+
+## erase secrets from heap/stack after use
+
+Introducing a concept and system to erase secrets from memory after use, it
+could help mitigate and lessen the impact of (future) security problems etc.
+However: most secrets are passed to libcurl as clear text from the application
+and then clearing them within the library adds nothing...
+
+[curl issue 7268](https://github.com/curl/curl/issues/7268)
+
+## make DoH inherit more transfer properties
+
+Some options are not inherited because they are not relevant for the DoH SSL
+connections, or inheriting the option may result in unexpected behavior. For
+example the user's debug function callback is not inherited because it would
+be unexpected for internal handles (i.e DoH handles) to be passed to that
+callback.
+
+If an option is not inherited then it is not possible to set it separately
+for DoH without a DoH-specific option. For example:
+`CURLOPT_DOH_SSL_VERIFYHOST`, `CURLOPT_DOH_SSL_VERIFYPEER` and
+`CURLOPT_DOH_SSL_VERIFYSTATUS`.
+
+See [curl issue 6605](https://github.com/curl/curl/issues/6605)
+
+# libcurl - multi interface
+
+## More non-blocking
+
+Make sure we do not ever loop because of non-blocking sockets returning
+`EWOULDBLOCK` or similar. Blocking cases include:
+
+- Name resolves on non-Windows unless c-ares or the threaded resolver is used.
+- The threaded resolver may block on cleanup:
+  [curl issue 4852](https://github.com/curl/curl/issues/4852)
+- `file://` transfers
+- TELNET transfers
+- GSSAPI authentication for FTP transfers
+- The "DONE" operation (post transfer protocol-specific actions) for the
+protocols SFTP, SMTP, FTP. Fixing `multi_done()` for this is a worthy task.
+- `curl_multi_remove_handle()` for any of the above.
+- Calling `curl_ws_send()` from a callback
+
+## Better support for same name resolves
+
+If a name resolve has been initiated for a given name and a second easy handle
+wants to resolve that same name as well, make it wait for the first resolve to
+end up in the cache instead of doing a second separate resolve. This is
+especially needed when adding many simultaneous handles using the same
+hostname when the DNS resolver can get flooded.
+
+## Non-blocking `curl_multi_remove_handle()`
+
+The multi interface has a few API calls that assume a blocking behavior, like
+`add_handle()` and `remove_handle()` which limits what we can do internally.
+The multi API need to be moved even more into a single function that "drives"
+everything in a non-blocking manner and signals when something is done. A
+remove or add would then only ask for the action to get started and then
+`multi_perform()` etc still be called until the add/remove is completed.
+
+## Split connect and authentication process
+
+The multi interface treats the authentication process as part of the connect
+phase. As such any failures during authentication does not trigger the
+relevant QUIT or LOGOFF for protocols such as IMAP, POP3 and SMTP.
+
+## Edge-triggered sockets should work
+
+The multi_socket API should work with edge-triggered socket events. One of the
+internal actions that need to be improved for this to work perfectly is the
+`maxloops` handling in `transfer.c:readwrite_data()`.
+
+## multi upkeep
+
+In libcurl 7.62.0 we introduced `curl_easy_upkeep`. It unfortunately only
+works on easy handles. We should introduces a version of that for the multi
+handle, and also consider doing `upkeep` automatically on connections in the
+connection pool when the multi handle is in used.
+
+See [curl issue 3199](https://github.com/curl/curl/issues/3199)
+
+## Virtual external sockets
+
+libcurl performs operations on the given file descriptor that presumes it is a
+socket and an application cannot replace them at the moment. Allowing an
+application to fully replace those would allow a larger degree of freedom and
+flexibility.
+
+See [curl issue 5835](https://github.com/curl/curl/issues/5835)
+
+## dynamically decide to use socketpair
+
+For users who do not use `curl_multi_wait()` or do not care for
+`curl_multi_wakeup()`, we could introduce a way to make libcurl NOT create a
+socketpair in the multi handle.
+
+See [curl issue 4829](https://github.com/curl/curl/issues/4829)
+
+# Documentation
+
+## Improve documentation about fork safety
+
+See [curl issue 6968](https://github.com/curl/curl/issues/6968)
+
+# FTP
+
+## A fixed directory listing format
+
+Since listing the contents of a remove directory with FTP is returning the
+list in a format and style the server likes without any established or even
+defacto standard existing, it would be a feature to users if curl could parse
+the directory listing and output a general curl format that is fixed and the
+same, independent of the server's choice. This would allow users to better and
+more reliably extract information about remote content via FTP directory
+listings.
+
+## GSSAPI via Windows SSPI
+
+In addition to currently supporting the SASL GSSAPI mechanism (Kerberos V5)
+via third-party GSS-API libraries, such as MIT Kerberos, also add support for
+GSSAPI authentication via Windows SSPI.
+
+## STAT for LIST without data connection
+
+Some FTP servers allow STAT for listing directories instead of using LIST, and
+the response is then sent over the control connection instead of as the
+otherwise used data connection.
+
+This is not detailed in any FTP specification.
+
+## Passive transfer could try other IP addresses
+
+When doing FTP operations through a proxy at localhost, the reported spotted
+that curl only tried to connect once to the proxy, while it had multiple
+addresses and a failed connect on one address should make it try the next.
+
+After switching to passive mode (EPSV), curl could try all IP addresses for
+`localhost`. Currently it tries `::1`, but it should also try `127.0.0.1`.
+
+See [curl issue 1508](https://github.com/curl/curl/issues/1508)
+
+# HTTP
+
+## Provide the error body from a CONNECT response
+
+When curl receives a body response from a CONNECT request to a proxy, it
+always reads and ignores it. It would make some users happy if curl instead
+optionally would be able to make that responsible available. Via a new
+callback? Through some other means?
+
+See [curl issue 9513](https://github.com/curl/curl/issues/9513)
+
+## Obey `Retry-After` in redirects
+
+The `Retry-After` response header is said to dictate "the minimum time that
+the user agent is asked to wait before issuing the redirected request" and
+libcurl does not obey this.
+
+See [curl issue 11447](https://github.com/curl/curl/issues/11447)
+
+## Rearrange request header order
+
+Server implementers often make an effort to detect browser and to reject
+clients it can detect to not match. One of the last details we cannot yet
+control in libcurl's HTTP requests, which also can be exploited to detect that
+libcurl is in fact used even when it tries to impersonate a browser, is the
+order of the request headers. I propose that we introduce a new option in
+which you give headers a value, and then when the HTTP request is built it
+sorts the headers based on that number. We could then have internally created
+headers use a default value so only headers that need to be moved have to be
+specified.
+
+## Allow SAN names in HTTP/2 server push
+
+curl only allows HTTP/2 push promise if the provided :authority header value
+exactly matches the hostname given in the URL. It could be extended to allow
+any name that would match the Subject Alternative Names in the server's TLS
+certificate.
+
+See [curl pull request 3581](https://github.com/curl/curl/pull/3581)
+
+## `auth=` in URLs
+
+Add the ability to specify the preferred authentication mechanism to use by
+using `;auth=<mech>` in the login part of the URL.
+
+For example:
+
+`http://test:pass;auth=NTLM@example.com` would be equivalent to specifying
+`--user test:pass;auth=NTLM` or `--user test:pass --ntlm` from the command
+line.
+
+Additionally this should be implemented for proxy base URLs as well.
+
+## Require HTTP version X or higher
+
+curl and libcurl provide options for trying higher HTTP versions (for example
+HTTP/2) but then still allows the server to pick version 1.1. We could
+consider adding a way to require a minimum version.
+
+See [curl issue 7980](https://github.com/curl/curl/issues/7980)
+
+# TELNET
+
+## ditch stdin
+
+Reading input (to send to the remote server) on stdin is a crappy solution for
+library purposes. We need to invent a good way for the application to be able
+to provide the data to send.
+
+## ditch telnet-specific select
+
+Move the telnet support's network `select()` loop go away and merge the code
+into the main transfer loop. Until this is done, the multi interface does not
+work for telnet.
+
+## feature negotiation debug data
+
+Add telnet feature negotiation data to the debug callback as header data.
+
+## exit immediately upon connection if stdin is /dev/null
+
+If it did, curl could be used to probe if there is an server there listening
+on a specific port. That is, the following command would exit immediately
+after the connection is established with exit code 0:
+
+    curl -s --connect-timeout 2 telnet://example.com:80 </dev/null
+
+# SMTP
+
+## Pass NOTIFY option to CURLOPT_MAIL_RCPT
+
+Is there a way to pass the NOTIFY option to the CURLOPT_MAIL_RCPT option ? I
+set a string that already contains a bracket. For instance something like
+that: `curl_slist_append(recipients, "<foo@bar> NOTIFY=SUCCESS,FAILURE");`.
+
+[curl issue 8232](https://github.com/curl/curl/issues/8232)
+
+## Enhanced capability support
+
+Add the ability, for an application that uses libcurl, to obtain the list of
+capabilities returned from the EHLO command.
+
+## Add `CURLOPT_MAIL_CLIENT` option
+
+Rather than use the URL to specify the mail client string to present in the
+`HELO` and `EHLO` commands, libcurl should support a new `CURLOPT`
+specifically for specifying this data as the URL is non-standard and to be
+honest a bit of a hack.
+
+Please see the following thread for more information:
+https://curl.se/mail/lib-2012-05/0178.html
+
+# POP3
+
+## Enhanced capability support
+
+Add the ability, for an application that uses libcurl, to obtain the list of
+capabilities returned from the CAPA command.
+
+# IMAP
+
+## Enhanced capability support
+
+Add the ability, for an application that uses libcurl, to obtain the list of
+capabilities returned from the CAPABILITY command.
+
+# LDAP
+
+## SASL based authentication mechanisms
+
+Currently the LDAP module only supports `ldap_simple_bind_s()` in order to
+bind to an LDAP server. This function sends username and password details
+using the simple authentication mechanism (as clear text). It should be
+possible to use `ldap_bind_s()` instead specifying the security context
+information ourselves.
+
+## `CURLOPT_SSL_CTX_FUNCTION` for LDAPS
+
+`CURLOPT_SSL_CTX_FUNCTION` works perfectly for HTTPS and email protocols, but
+it has no effect for LDAPS connections.
+
+[curl issue 4108](https://github.com/curl/curl/issues/4108)
+
+## Paged searches on LDAP server
+
+[curl issue 4452](https://github.com/curl/curl/issues/4452)
+
+## Certificate-Based Authentication
+
+LDAPS not possible with macOS and Windows with Certificate-Based Authentication
+
+[curl issue 9641](https://github.com/curl/curl/issues/9641)
+
+# SMB
+
+## Support modern versions
+
+curl only supports version 1, which barely anyone is using anymore.
+
+## File listing support
+
+Add support for listing the contents of an SMB share. The output should
+probably be the same as/similar to FTP.
+
+## Honor file timestamps
+
+The timestamp of the transferred file should reflect that of the original
+file.
+
+## Use NTLMv2
+
+Currently the SMB authentication uses NTLMv1.
+
+## Create remote directories
+
+Support for creating remote directories when uploading a file to a directory
+that does not exist on the server, like `--ftp-create-dirs`.
+
+# FILE
+
+## Directory listing on non-POSIX
+
+Listing the contents of a directory accessed with FILE only works on platforms
+with `opendir()`. Support could be added for more systems, like Windows.
+
+# TLS
+
+## `TLS-PSK` with OpenSSL
+
+Transport Layer Security pre-shared key cipher suites (`TLS-PSK`) is a set of
+cryptographic protocols that provide secure communication based on pre-shared
+keys (`PSK`). These pre-shared keys are symmetric keys shared in advance among
+the communicating parties.
+
+[curl issue 5081](https://github.com/curl/curl/issues/5081)
+
+## TLS channel binding
+
+TLS 1.2 and 1.3 provide the ability to extract some secret data from the TLS
+connection and use it in the client request (usually in some sort of
+authentication) to ensure that the data sent is bound to the specific TLS
+connection and cannot be successfully intercepted by a proxy. This
+functionality can be used in a standard authentication mechanism such as
+GSS-API or SCRAM, or in custom approaches like custom HTTP Authentication
+headers.
+
+For TLS 1.2, the binding type is usually `tls-unique`, and for TLS 1.3 it is
+`tls-exporter`.
+
+- https://datatracker.ietf.org/doc/html/rfc5929
+- https://datatracker.ietf.org/doc/html/rfc9266
+- [curl issue 9226](https://github.com/curl/curl/issues/9226)
+
+## Defeat TLS fingerprinting
+
+By changing the order of TLS extensions provided in the TLS handshake, it is
+sometimes possible to circumvent TLS fingerprinting by servers. The TLS
+extension order is of course not the only way to fingerprint a client.
+
+## Consider OCSP stapling by default
+
+Treat a negative response a reason for aborting the connection. Since OCSP
+stapling is presumed to get used much less in the future when Let's Encrypt
+drops the OCSP support, the benefit of this might however be limited.
+
+[curl issue 15483](https://github.com/curl/curl/issues/15483)
+
+## Provide callback for cert verification
+
+OpenSSL supports a callback for customized verification of the peer
+certificate, but this does not seem to be exposed in the libcurl APIs. Could
+it be? There is so much that could be done if it were.
+
+## Less memory massaging with Schannel
+
+The Schannel backend does a lot of custom memory management we would rather
+avoid: the repeated allocation + free in sends and the custom memory + realloc
+system for encrypted and decrypted data. That should be avoided and reduced
+for 1) efficiency and 2) safety.
+
+## Support DANE
+
+[DNS-Based Authentication of Named Entities
+(DANE)](https://datatracker.ietf.org/doc/html/rfc6698) is a way to provide
+SSL keys and certs over DNS using DNSSEC as an alternative to the CA model.
+
+A patch was posted on March 7 2013
+(https://curl.se/mail/lib-2013-03/0075.html) but it was a too simple approach.
+See Daniel's comments: https://curl.se/mail/lib-2013-03/0103.html
+
+Björn Stenberg once wrote a separate initial take on DANE that was never
+completed.
+
+## TLS record padding
+
+TLS (1.3) offers optional record padding and OpenSSL provides an API for it. I
+could make sense for libcurl to offer this ability to applications to make
+traffic patterns harder to figure out by network traffic observers.
+
+See [curl issue 5398](https://github.com/curl/curl/issues/5398)
+
+## Support Authority Information Access certificate extension (AIA)
+
+AIA can provide various things like certificate revocation lists but more
+importantly information about intermediate CA certificates that can allow
+validation path to be fulfilled when the HTTPS server does not itself provide
+them.
+
+Since AIA is about downloading certs on demand to complete a TLS handshake, it
+is probably a bit tricky to get done right and a serious privacy leak.
+
+See [curl issue 2793](https://github.com/curl/curl/issues/2793)
+
+## Some TLS options are not offered for HTTPS proxies
+
+Some TLS related options to the command line tool and libcurl are only
+provided for the server and not for HTTPS proxies. `--proxy-tls-max`,
+`--proxy-tlsv1.3`, `--proxy-curves` and a few more. For more Documentation on
+this see: https://curl.se/libcurl/c/tls-options.html
+
+[curl issue 12286](https://github.com/curl/curl/issues/12286)
+
+## Make sure we forbid TLS 1.3 post-handshake authentication
+
+RFC 8740 explains how using HTTP/2 must forbid the use of TLS 1.3
+post-handshake authentication. We should make sure to live up to that.
+
+See [curl issue 5396](https://github.com/curl/curl/issues/5396)
+
+## Support the `clienthello` extension
+
+Certain stupid networks and middle boxes have a problem with SSL handshake
+packets that are within a certain size range because how that sets some bits
+that previously (in older TLS version) were not set. The `clienthello`
+extension adds padding to avoid that size range.
+
+- https://datatracker.ietf.org/doc/html/rfc7685
+- [curl issue 2299](https://github.com/curl/curl/issues/2299)
+
+## Share the CA cache
+
+For TLS backends that supports CA caching, it makes sense to allow the share
+object to be used to store the CA cache as well via the share API. Would allow
+multiple easy handles to reuse the CA cache and save themselves from a lot of
+extra processing overhead.
+
+## Add missing features to TLS backends
+
+The feature matrix at https://curl.se/libcurl/c/tls-options.html shows which
+features are supported by which TLS backends, and thus also where there are
+feature gaps.
+
+# Proxy
+
+## Retry SOCKS handshake on address type not supported
+
+When curl resolves a hostname, it might get a mix of IPv6 and IPv4 returned.
+curl might then use an IPv6 address with a SOCKS5 proxy, which - if it does
+not support IPv6 - returns "Address type not supported" and curl exits with
+that error.
+
+Perhaps it is preferred if curl would in this situation instead first retry
+the SOCKS handshake again for this case and then use one of the IPv4 addresses
+for the target host.
+
+See [curl issue 17222](https://github.com/curl/curl/issues/17222)
+
+# Schannel
+
+## Extend support for client certificate authentication
+
+The existing support for the `-E`/`--cert` and `--key` options could be
+extended by supplying a custom certificate and key in PEM format, see:
+[Getting a Certificate for
+Schannel](https://learn.microsoft.com/windows/win32/secauthn/getting-a-certificate-for-schannel)
+
+## Extend support for the `--ciphers` option
+
+The existing support for the `--ciphers` option could be extended by mapping
+the OpenSSL/GnuTLS cipher suites to the Schannel APIs, see [Specifying
+Schannel Ciphers and Cipher
+Strengths](https://learn.microsoft.com/windows/win32/secauthn/specifying-schannel-ciphers-and-cipher-strengths).
+
+## Add option to allow abrupt server closure
+
+libcurl with Schannel errors without a known termination point from the server
+(such as length of transfer, or SSL "close notify" alert) to prevent against a
+truncation attack. Really old servers may neglect to send any termination
+point. An option could be added to ignore such abrupt closures.
+
+[curl issue 4427](https://github.com/curl/curl/issues/4427)
+
+# SASL
+
+## Other authentication mechanisms
+
+Add support for other authentication mechanisms such as `OLP`, `GSS-SPNEGO`
+and others.
+
+## Add `QOP` support to GSSAPI authentication
+
+Currently the GSSAPI authentication only supports the default `QOP` of auth
+(Authentication), whilst Kerberos V5 supports both `auth-int` (Authentication
+with integrity protection) and `auth-conf` (Authentication with integrity and
+privacy protection).
+
+# SSH protocols
+
+## Multiplexing
+
+SSH is a perfectly fine multiplexed protocols which would allow libcurl to do
+multiple parallel transfers from the same host using the same connection, much
+in the same spirit as HTTP/2 does. libcurl however does not take advantage of
+that ability but does instead always create a new connection for new transfers
+even if an existing connection already exists to the host.
+
+To fix this, libcurl would have to detect an existing connection and "attach"
+the new transfer to the existing one.
+
+## Handle growing SFTP files
+
+The SFTP code in libcurl checks the file size *before* a transfer starts and
+then proceeds to transfer exactly that amount of data. If the remote file
+grows while the transfer is in progress libcurl does not notice and does not
+adapt. The OpenSSH SFTP command line tool does and libcurl could also attempt
+to download more to see if there is more to get...
+
+[curl issue 4344](https://github.com/curl/curl/issues/4344)
+
+## Read keys from `~/.ssh/id_ecdsa`, `id_ed25519`
+
+The libssh2 backend in curl is limited to only reading keys from `id_rsa` and
+`id_dsa`, which makes it fail connecting to servers that use more modern key
+types.
+
+[curl issue 8586](https://github.com/curl/curl/issues/8586)
+
+## Support `CURLOPT_PREQUOTE`
+
+The two other `QUOTE` options are supported for SFTP, but this was left out
+for unknown reasons.
+
+## SSH over HTTPS proxy for libssh
+
+The SSH based protocols SFTP and SCP did not work over HTTPS proxy at all
+until [curl pull request 6021](https://github.com/curl/curl/pull/6021) brought
+the functionality with the libssh2 backend. Presumably, this support can/could
+be added for the libssh backend as well.
+
+## SFTP with `scp://`
+
+OpenSSH 9 switched their `scp` tool to speak SFTP under the hood. Going
+forward it might be worth having curl or libcurl attempt SFTP if SCP fails to
+follow suite.
+
+# Command line tool
+
+## multi-threading
+
+When asked to do transfers in parallel, the curl tool could be extended to use
+a number of independent worker threads. This would allow faster transfers in
+situations where curl becomes CPU bound.
+
+Ideally, curl would (with permission) fire up new threads on demand when it
+deems that it might be helpful. Perhaps, if it has more transfers to add and
+the existing transfers make the CPU busy enough and there are more cores
+available.
+
+## sync
+
+`curl --sync http://example.com/feed[1-100].rss` or
+`curl --sync http://example.net/{index,calendar,history}.html`
+
+Downloads a range or set of URLs using the remote name, but only if the remote
+file is newer than the local file. A `Last-Modified` HTTP date header should
+also be used to set the mod date on the downloaded file.
+
+## glob posts
+
+Globbing support for `-d` and `-F`, as in `curl -d "name=foo[0-9]" URL`. This
+is easily scripted though.
+
+## `--proxycommand`
+
+Allow the user to make curl run a command and use its stdio to make requests
+and not do any network connection by itself. Example:
+
+    curl --proxycommand 'ssh pi@raspberrypi.local -W 10.1.1.75 80' \
+      http://some/otherwise/unavailable/service.php
+
+See [curl issue 4941](https://github.com/curl/curl/issues/4941)
+
+## UTF-8 filenames in Content-Disposition
+
+RFC 6266 documents how UTF-8 names can be passed to a client in the
+`Content-Disposition` header, and curl does not support this.
+
+[curl issue 1888](https://github.com/curl/curl/issues/1888)
+
+## Option to make `-Z` merge lined based outputs on stdout
+
+When a user requests multiple lined based files using `-Z` and sends them to
+stdout, curl does not *merge* and send complete lines fine but may send
+partial lines from several sources.
+
+[curl issue 5175](https://github.com/curl/curl/issues/5175)
+
+## specify which response codes that make `-f`/`--fail` return error
+
+Allows a user to better specify exactly which error code(s) that are fine and
+which are errors for their specific uses cases
+
+## Choose the name of file in braces for complex URLs
+
+When using braces to download a list of URLs and you use complicated names
+in the list of alternatives, it could be handy to allow curl to use other
+names when saving.
+
+Consider a way to offer that. Possibly like
+`{partURL1:name1,partURL2:name2,partURL3:name3}` where the name following the
+colon is the output name.
+
+See [curl issue 221](https://github.com/curl/curl/issues/221)
+
+## improve how curl works in a Windows console window
+
+If you pull the scroll bar when transferring with curl in a Windows console
+window, the transfer is interrupted and can get disconnected. This can
+probably be improved. See [curl issue 322](https://github.com/curl/curl/issues/322)
+
+## Windows: set attribute 'archive' for completed downloads
+
+The archive bit (`FILE_ATTRIBUTE_ARCHIVE, 0x20`) separates files that shall be
+backed up from those that are either not ready or have not changed.
+
+Downloads in progress are neither ready to be backed up, nor should they be
+opened by a different process. Only after a download has been completed it is
+sensible to include it in any integer snapshot or backup of the system.
+
+See [curl issue 3354](https://github.com/curl/curl/issues/3354)
+
+## keep running, read instructions from pipe/socket
+
+Provide an option that makes curl not exit after the last URL (or even work
+without a given URL), and then make it read instructions passed on a pipe or
+over a socket to make further instructions so that a second subsequent curl
+invoke can talk to the still running instance and ask for transfers to get
+done, and thus maintain its connection pool, DNS cache and more.
+
+## Acknowledge `Ratelimit` headers
+
+Consider a command line option that can make curl do multiple serial requests
+while acknowledging server specified [rate
+limits](https://datatracker.ietf.org/doc/html/draft-ietf-httpapi-ratelimit-headers/).
+
+See [curl issue 5406](https://github.com/curl/curl/issues/5406)
+
+## `--dry-run`
+
+A command line option that makes curl show exactly what it would do and send
+if it would run for real.
+
+See [curl issue 5426](https://github.com/curl/curl/issues/5426)
+
+## `--retry` should resume
+
+When `--retry` is used and curl actually retries transfer, it should use the
+already transferred data and do a resumed transfer for the rest (when
+possible) so that it does not have to transfer the same data again that was
+already transferred before the retry.
+
+See [curl issue 1084](https://github.com/curl/curl/issues/1084)
+
+## retry on network is unreachable
+
+The `--retry` option retries transfers on *transient failures*. We later added
+`--retry-connrefused` to also retry for *connection refused* errors.
+
+Suggestions have been brought to also allow retry on *network is unreachable*
+errors and while totally reasonable, maybe we should consider a way to make
+this more configurable than to add a new option for every new error people
+want to retry for?
+
+[curl issue 1603](https://github.com/curl/curl/issues/1603)
+
+## hostname sections in config files
+
+config files would be more powerful if they could set different configurations
+depending on used URLs, hostname or possibly origin. Then a default `.curlrc`
+could a specific user-agent only when doing requests against a certain site.
+
+## retry on the redirected-to URL
+
+When curl is told to `--retry` a failed transfer and follows redirects, it
+might get an HTTP 429 response from the redirected-to URL and not the original
+one, which then could make curl decide to rather retry the transfer on that
+URL only instead of the original operation to the original URL.
+
+Perhaps extra emphasized if the original transfer is a large POST that
+redirects to a separate GET, and that GET is what gets the 529
+
+See [curl issue 5462](https://github.com/curl/curl/issues/5462)
+
+## Set the modification date on an uploaded file
+
+For SFTP and possibly FTP, curl could offer an option to set the modification
+time for the uploaded file.
+
+See [curl issue 5768](https://github.com/curl/curl/issues/5768)
+
+## Use multiple parallel transfers for a single download
+
+To enhance transfer speed, downloading a single URL can be split up into
+multiple separate range downloads that get combined into a single final
+result.
+
+An ideal implementation would not use a specified number of parallel
+transfers, but curl could:
+- First start getting the full file as transfer A
+- If after N seconds have passed and the transfer is expected to continue for
+  M seconds or more, add a new transfer (B) that asks for the second half of
+  A's content (and stop A at the middle).
+- If splitting up the work improves the transfer rate, it could then be done
+  again. Then again, etc up to a limit.
+
+This way, if transfer B fails (because Range: is not supported) it lets
+transfer A remain the single one. N and M could be set to some sensible
+defaults.
+
+See [curl issue 5774](https://github.com/curl/curl/issues/5774)
+
+## Prevent terminal injection when writing to terminal
+
+curl could offer an option to make escape sequence either non-functional or
+avoid cursor moves or similar to reduce the risk of a user getting tricked by
+clever tricks.
+
+See [curl issue 6150](https://github.com/curl/curl/issues/6150)
+
+## `-J` and `-O` with %-encoded filenames
+
+`-J`/`--remote-header-name` does not decode %-encoded filenames. RFC 6266
+details how it should be done. The can of worm is that we have no charset
+handling in curl and ASCII >=128 is a challenge for us. Not to mention that
+decoding also means that we need to check for nastiness that is attempted,
+like `../` sequences and the like. Probably everything to the left of any
+embedded slashes should be cut off. See https://curl.se/bug/view.cgi?id=1294
+
+`-O` also does not decode %-encoded names, and while it has even less
+information about the charset involved the process is similar to the `-J`
+case.
+
+Note that we do not decode `-O` without the user asking for it with some other
+means, since `-O` has always been documented to use the name exactly as
+specified in the URL.
+
+## `-J` with `-C -`
+
+When using `-J` (with `-O`), automatically resumed downloading together with
+`-C -` fails. Without `-J` the same command line works. This happens because
+the resume logic is worked out before the target filename (and thus its
+pre-transfer size) has been figured out. This can be improved.
+
+https://curl.se/bug/view.cgi?id=1169
+
+## `--retry` and transfer timeouts
+
+If using `--retry` and the transfer timeouts (possibly due to using -m or
+`-y`/`-Y`) the next attempt does not resume the transfer properly from what
+was downloaded in the previous attempt but truncates and restarts at the
+original position where it was at before the previous failed attempt. See
+https://curl.se/mail/lib-2008-01/0080.html
+
+# Build
+
+## Enable `PIE` and `RELRO` by default
+
+Especially when having programs that execute curl via the command line, `PIE`
+renders the exploitation of memory corruption vulnerabilities a lot more
+difficult. This can be attributed to the additional information leaks being
+required to conduct a successful attack. `RELRO`, on the other hand, masks
+different binary sections like the `GOT` as read-only and thus kills a handful
+of techniques that come in handy when attackers are able to arbitrarily
+overwrite memory. A few tests showed that enabling these features had close to
+no impact, neither on the performance nor on the general functionality of
+curl.
+
+## Do not use GNU libtool on OpenBSD
+
+When compiling curl on OpenBSD with `--enable-debug` it gives linking errors
+when you use GNU libtool. This can be fixed by using the libtool provided by
+OpenBSD itself. However for this the user always needs to invoke make with
+`LIBTOOL=/usr/bin/libtool`. It would be nice if the script could have some
+logic to detect if this system is an OpenBSD host and then use the OpenBSD
+libtool instead.
+
+See [curl issue 5862](https://github.com/curl/curl/issues/5862)
+
+## Package curl for Windows in a signed installer
+
+See [curl issue 5424](https://github.com/curl/curl/issues/5424)
+
+## make configure use `--cache-file` more and better
+
+The configure script can be improved to cache more values so that repeated
+invokes run much faster.
+
+See [curl issue 7753](https://github.com/curl/curl/issues/7753)
+
+# Test suite
+
+## SSL tunnel
+
+Make our own version of stunnel for simple port forwarding to enable HTTPS and
+FTP-SSL tests without the stunnel dependency, and it could allow us to provide
+test tools built with either OpenSSL or GnuTLS
+
+## more protocols supported
+
+Extend the test suite to include more protocols. The telnet could do FTP or
+http operations (for which we have test servers).
+
+## more platforms supported
+
+Make the test suite work on more platforms. OpenBSD and macOS. Remove fork()s
+and it should become even more portable.
+
+## write an SMB test server to replace impacket
+
+This would allow us to run SMB tests on more platforms and do better and more
+covering tests.
+
+See [curl issue 15697](https://github.com/curl/curl/issues/15697)
+
+## Use the RFC 6265 test suite
+
+A test suite made for HTTP cookies (RFC 6265) by Adam Barth [is
+available](https://github.com/abarth/http-state/tree/master/tests).
+
+It would be good if someone would write a script/setup that would run curl
+with that test suite and detect deviance. Ideally, that would even be
+incorporated into our regular test suite.
+
+## Run web-platform-tests URL tests
+
+Run web-platform-tests URL tests and compare results with browsers on
+`wpt.fyi`.
+
+It would help us find issues to fix and help us document where our parser
+differs from the WHATWG URL spec parsers.
+
+See [curl issue 4477](https://github.com/curl/curl/issues/4477)
+
+# MQTT
+
+## Support rate-limiting
+
+The rate-limiting logic is done in the PERFORMING state in multi.c but MQTT is
+not (yet) implemented to use that.
+
+## Support MQTTS
+
+## Handle network blocks
+
+Running test suite with `CURL_DBG_SOCK_WBLOCK=90 ./runtests.pl -a mqtt` makes
+several MQTT test cases fail where they should not.
+
+## large payloads
+
+libcurl unnecessarily allocates heap memory to hold the entire payload to get
+sent, when the data is already perfectly accessible where it is when
+`CURLOPT_POSTFIELDS` is used. This is highly inefficient for larger payloads.
+Additionally, libcurl does not support using the read callback for sending
+MQTT which is yet another way to avoid having to hold large payload in memory.
+
+# TFTP
+
+## TFTP does not convert LF to CRLF for `mode=netascii`
+
+RFC 3617 defines that an TFTP transfer can be done using `netascii` mode. curl
+does not support extracting that mode from the URL nor does it treat such
+transfers specifically. It should probably do LF to CRLF translations for
+them.
+
+See [curl issue 12655](https://github.com/curl/curl/issues/12655)
+
+# Gopher
+
+## Handle network blocks
+
+Running test suite with `CURL_DBG_SOCK_WBLOCK=90 ./runtests.pl -a 1200 to
+1300` makes several Gopher test cases fail where they should not.
diff --git a/third-party/curl/docs/TheArtOfHttpScripting.md b/third-party/curl/docs/TheArtOfHttpScripting.md
index 2973a36cd2..541cb4c2ff 100644
--- a/third-party/curl/docs/TheArtOfHttpScripting.md
+++ b/third-party/curl/docs/TheArtOfHttpScripting.md
@@ -1,238 +1,240 @@
-# The Art Of Scripting HTTP Requests Using Curl
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# The Art Of Scripting HTTP Requests Using curl
 
 ## Background
 
- This document assumes that you are familiar with HTML and general networking.
+This document assumes that you are familiar with HTML and general networking.
 
- The increasing amount of applications moving to the web has made "HTTP
- Scripting" more frequently requested and wanted. To be able to automatically
- extract information from the web, to fake users, to post or upload data to
- web servers are all important tasks today.
+The increasing amount of applications moving to the web has made "HTTP
+Scripting" more frequently requested and wanted. To be able to automatically
+extract information from the web, to fake users, to post or upload data to
+web servers are all important tasks today.
 
- Curl is a command line tool for doing all sorts of URL manipulations and
- transfers, but this particular document will focus on how to use it when
- doing HTTP requests for fun and profit. This documents assumes that you know
- how to invoke `curl --help` or `curl --manual` to get basic information about
- it.
+curl is a command line tool for doing all sorts of URL manipulations and
+transfers, but this particular document focuses on how to use it when doing
+HTTP requests for fun and profit. This documents assumes that you know how to
+invoke `curl --help` or `curl --manual` to get basic information about it.
 
- Curl is not written to do everything for you. It makes the requests, it gets
- the data, it sends data and it retrieves the information. You probably need
- to glue everything together using some kind of script language or repeated
- manual invokes.
+curl is not written to do everything for you. It makes the requests, it gets
+the data, it sends data and it retrieves the information. You probably need
+to glue everything together using some kind of script language or repeated
+manual invokes.
 
 ## The HTTP Protocol
 
- HTTP is the protocol used to fetch data from web servers. It is a simple
- protocol that is built upon TCP/IP. The protocol also allows information to
- get sent to the server from the client using a few different methods, as will
- be shown here.
+HTTP is the protocol used to fetch data from web servers. It is a simple
+protocol that is built upon TCP/IP. The protocol also allows information to
+get sent to the server from the client using a few different methods, as is
+shown here.
 
- HTTP is plain ASCII text lines being sent by the client to a server to
- request a particular action, and then the server replies a few text lines
- before the actual requested content is sent to the client.
+HTTP is plain ASCII text lines being sent by the client to a server to
+request a particular action, and then the server replies a few text lines
+before the actual requested content is sent to the client.
 
- The client, curl, sends an HTTP request. The request contains a method (like
- GET, POST, HEAD etc), a number of request headers and sometimes a request
- body. The HTTP server responds with a status line (indicating if things went
- well), response headers and most often also a response body. The "body" part
- is the plain data you requested, like the actual HTML or the image etc.
+The client, curl, sends an HTTP request. The request contains a method (like
+GET, POST, HEAD etc), a number of request headers and sometimes a request
+body. The HTTP server responds with a status line (indicating if things went
+well), response headers and most often also a response body. The "body" part
+is the plain data you requested, like the actual HTML or the image etc.
 
 ## See the Protocol
 
- Using curl's option [`--verbose`](https://curl.se/docs/manpage.html#-v)
- (`-v` as a short option) will display what kind of commands curl sends to the
- server, as well as a few other informational texts.
+Using curl's option [`--verbose`](https://curl.se/docs/manpage.html#-v) (`-v`
+as a short option) displays what kind of commands curl sends to the server,
+as well as a few other informational texts.
 
- `--verbose` is the single most useful option when it comes to debug or even
- understand the curl<->server interaction.
+`--verbose` is the single most useful option when it comes to debug or even
+understand the curl<->server interaction.
 
- Sometimes even `--verbose` is not enough. Then
- [`--trace`](https://curl.se/docs/manpage.html#-trace) and
- [`--trace-ascii`](https://curl.se/docs/manpage.html#--trace-ascii)
- offer even more details as they show **everything** curl sends and
- receives. Use it like this:
+Sometimes even `--verbose` is not enough. Then
+[`--trace`](https://curl.se/docs/manpage.html#-trace) and
+[`--trace-ascii`](https://curl.se/docs/manpage.html#--trace-ascii)
+offer even more details as they show **everything** curl sends and
+receives. Use it like this:
 
-    curl --trace-ascii debugdump.txt http://www.example.com/
+    curl --trace-ascii debugdump.txt https://www.example.com/
 
 ## See the Timing
 
- Many times you may wonder what exactly is taking all the time, or you just
- want to know the amount of milliseconds between two points in a transfer. For
- those, and other similar situations, the
- [`--trace-time`](https://curl.se/docs/manpage.html#--trace-time) option
- is what you need. It will prepend the time to each trace output line:
+Many times you may wonder what exactly is taking all the time, or you want to
+know the amount of milliseconds between two points in a transfer. For those,
+and other similar situations, the
+[`--trace-time`](https://curl.se/docs/manpage.html#--trace-time) option is
+what you need. It prepends the time to each trace output line:
 
-    curl --trace-ascii d.txt --trace-time http://example.com/
+    curl --trace-ascii d.txt --trace-time https://example.com/
 
 ## See which Transfer
 
- When doing parallel transfers, it is relevant to see which transfer is
- doing what. When response headers are received (and logged) you need to
- know which transfer these are for.
- [`--trace-ids`](https://curl.se/docs/manpage.html#--trace-ids) option
- is what you need. It will prepend the transfer and connection identifier
- to each trace output line:
+When doing parallel transfers, it is relevant to see which transfer is doing
+what. When response headers are received (and logged) you need to know which
+transfer these are for.
+[`--trace-ids`](https://curl.se/docs/manpage.html#--trace-ids) option is what
+you need. It prepends the transfer and connection identifier to each trace
+output line:
 
-    curl --trace-ascii d.txt --trace-ids http://example.com/
+    curl --trace-ascii d.txt --trace-ids https://example.com/
 
 ## See the Response
 
- By default curl sends the response to stdout. You need to redirect it
- somewhere to avoid that, most often that is done with `-o` or `-O`.
+By default curl sends the response to stdout. You need to redirect it
+somewhere to avoid that, most often that is done with `-o` or `-O`.
 
 # URL
 
 ## Spec
 
- The Uniform Resource Locator format is how you specify the address of a
- particular resource on the Internet. You know these, you have seen URLs like
- https://curl.se or https://example.com a million times. RFC 3986 is the
- canonical spec. And yeah, the formal name is not URL, it is URI.
+The Uniform Resource Locator format is how you specify the address of a
+particular resource on the Internet. You know these, you have seen URLs like
+https://curl.se/ or https://example.com/ a million times. RFC 3986 is the
+canonical spec. The formal name is not URL, it is **URI**.
 
 ## Host
 
- The host name is usually resolved using DNS or your /etc/hosts file to an IP
- address and that is what curl will communicate with. Alternatively you specify
- the IP address directly in the URL instead of a name.
+The hostname is usually resolved using DNS or your /etc/hosts file to an IP
+address and that is what curl communicates with. Alternatively you specify
+the IP address directly in the URL instead of a name.
 
- For development and other trying out situations, you can point to a different
- IP address for a host name than what would otherwise be used, by using curl's
- [`--resolve`](https://curl.se/docs/manpage.html#--resolve) option:
+For development and other trying out situations, you can point to a different
+IP address for a hostname than what would otherwise be used, by using curl's
+[`--resolve`](https://curl.se/docs/manpage.html#--resolve) option:
 
-    curl --resolve www.example.org:80:127.0.0.1 http://www.example.org/
+    curl --resolve www.example.org:80:127.0.0.1 https://www.example.org/
 
 ## Port number
 
- Each protocol curl supports operates on a default port number, be it over TCP
- or in some cases UDP. Normally you do not have to take that into
- consideration, but at times you run test servers on other ports or
- similar. Then you can specify the port number in the URL with a colon and a
- number immediately following the host name. Like when doing HTTP to port
- 1234:
+Each protocol curl supports operates on a default port number, be it over TCP
+or in some cases UDP. Normally you do not have to take that into
+consideration, but at times you run test servers on other ports or
+similar. Then you can specify the port number in the URL with a colon and a
+number immediately following the hostname. Like when doing HTTP to port
+1234:
 
-    curl http://www.example.org:1234/
+    curl https://www.example.org:1234/
 
- The port number you specify in the URL is the number that the server uses to
- offer its services. Sometimes you may use a proxy, and then you may
- need to specify that proxy's port number separately from what curl needs to
- connect to the server. Like when using an HTTP proxy on port 4321:
+The port number you specify in the URL is the number that the server uses to
+offer its services. Sometimes you may use a proxy, and then you may
+need to specify that proxy's port number separately from what curl needs to
+connect to the server. Like when using an HTTP proxy on port 4321:
 
-    curl --proxy http://proxy.example.org:4321 http://remote.example.org/
+    curl --proxy http://proxy.example.org:4321 https://remote.example.org/
 
-## User name and password
+## Username and password
 
- Some services are setup to require HTTP authentication and then you need to
- provide name and password which is then transferred to the remote site in
- various ways depending on the exact authentication protocol used.
+Some services are setup to require HTTP authentication and then you need to
+provide name and password which is then transferred to the remote site in
+various ways depending on the exact authentication protocol used.
 
- You can opt to either insert the user and password in the URL or you can
- provide them separately:
+You can opt to either insert the user and password in the URL or you can
+provide them separately:
 
-    curl http://user:password@example.org/
+    curl https://user:password@example.org/
 
- or
+or
 
-    curl -u user:password http://example.org/
+    curl -u user:password https://example.org/
 
- You need to pay attention that this kind of HTTP authentication is not what
- is usually done and requested by user-oriented websites these days. They tend
- to use forms and cookies instead.
+You need to pay attention that this kind of HTTP authentication is not what
+is usually done and requested by user-oriented websites these days. They tend
+to use forms and cookies instead.
 
 ## Path part
 
- The path part is just sent off to the server to request that it sends back
- the associated response. The path is what is to the right side of the slash
- that follows the host name and possibly port number.
+The path part is sent off to the server to request that it sends back the
+associated response. The path is what is to the right side of the slash that
+follows the hostname and possibly port number.
 
 # Fetch a page
 
 ## GET
 
- The simplest and most common request/operation made using HTTP is to GET a
- URL. The URL could itself refer to a web page, an image or a file. The client
- issues a GET request to the server and receives the document it asked for.
- If you issue the command line
+The simplest and most common request/operation made using HTTP is to GET a
+URL. The URL could itself refer to a webpage, an image or a file. The client
+issues a GET request to the server and receives the document it asked for.
+If you issue the command line
 
-    curl https://curl.se
+    curl https://curl.se/
 
- you get a web page returned in your terminal window. The entire HTML document
- that that URL holds.
+you get a webpage returned in your terminal window. The entire HTML document
+this URL identifies.
 
- All HTTP replies contain a set of response headers that are normally hidden,
- use curl's [`--include`](https://curl.se/docs/manpage.html#-i) (`-i`)
- option to display them as well as the rest of the document.
+All HTTP replies contain a set of response headers that are normally hidden,
+use curl's [`--include`](https://curl.se/docs/manpage.html#-i) (`-i`)
+option to display them as well as the rest of the document.
 
 ## HEAD
 
- You can ask the remote server for ONLY the headers by using the
- [`--head`](https://curl.se/docs/manpage.html#-I) (`-I`) option which
- will make curl issue a HEAD request. In some special cases servers deny the
- HEAD method while others still work, which is a particular kind of annoyance.
+You can ask the remote server for ONLY the headers by using the
+[`--head`](https://curl.se/docs/manpage.html#-I) (`-I`) option which makes
+curl issue a HEAD request. In some special cases servers deny the HEAD method
+while others still work, which is a particular kind of annoyance.
 
- The HEAD method is defined and made so that the server returns the headers
- exactly the way it would do for a GET, but without a body. It means that you
- may see a `Content-Length:` in the response headers, but there must not be an
- actual body in the HEAD response.
+The HEAD method is defined and made so that the server returns the headers
+exactly the way it would do for a GET, but without a body. It means that you
+may see a `Content-Length:` in the response headers, but there must not be an
+actual body in the HEAD response.
 
 ## Multiple URLs in a single command line
 
- A single curl command line may involve one or many URLs. The most common case
- is probably to just use one, but you can specify any amount of URLs. Yes
- any. No limits. You will then get requests repeated over and over for all the
- given URLs.
+A single curl command line may involve one or many URLs. The most common case
+is probably to use one, but you can specify any amount of URLs. Yes any. No
+limits. You then get requests repeated over and over for all the given URLs.
 
- Example, send two GET requests:
+Example, send two GET requests:
 
-    curl http://url1.example.com http://url2.example.com
+    curl https://url1.example.com https://url2.example.com
 
- If you use [`--data`](https://curl.se/docs/manpage.html#-d) to POST to
- the URL, using multiple URLs means that you send that same POST to all the
- given URLs.
+If you use [`--data`](https://curl.se/docs/manpage.html#-d) to POST to
+the URL, using multiple URLs means that you send that same POST to all the
+given URLs.
 
- Example, send two POSTs:
-
-    curl --data name=curl http://url1.example.com http://url2.example.com
+Example, send two POSTs:
 
+    curl --data name=curl https://url1.example.com https://url2.example.com
 
 ## Multiple HTTP methods in a single command line
 
- Sometimes you need to operate on several URLs in a single command line and do
- different HTTP methods on each. For this, you will enjoy the
- [`--next`](https://curl.se/docs/manpage.html#-:) option. It is basically
- a separator that separates a bunch of options from the next. All the URLs
- before `--next` will get the same method and will get all the POST data
- merged into one.
+Sometimes you need to operate on several URLs in a single command line and do
+different HTTP methods on each. For this, you might enjoy the
+[`--next`](https://curl.se/docs/manpage.html#-:) option. It is a separator
+that separates a bunch of options from the next. All the URLs before `--next`
+get the same method and get all the POST data merged into one.
 
- When curl reaches the `--next` on the command line, it will sort of reset the
- method and the POST data and allow a new set.
+When curl reaches the `--next` on the command line, it resets the method and
+the POST data and allow a new set.
 
- Perhaps this is best shown with a few examples. To send first a HEAD and then
- a GET:
+Perhaps this is best shown with a few examples. To send first a HEAD and then
+a GET:
 
-    curl -I http://example.com --next http://example.com
+    curl -I https://example.com --next https://example.com
 
- To first send a POST and then a GET:
+To first send a POST and then a GET:
 
-    curl -d score=10 http://example.com/post.cgi --next http://example.com/results.html
+    curl -d score=10 https://example.com/post.cgi --next https://example.com/results.html
 
 # HTML forms
 
 ## Forms explained
 
- Forms are the general way a website can present an HTML page with fields for
- the user to enter data in, and then press some kind of 'OK' or 'Submit'
- button to get that data sent to the server. The server then typically uses
- the posted data to decide how to act. Like using the entered words to search
- in a database, or to add the info in a bug tracking system, display the
- entered address on a map or using the info as a login-prompt verifying that
- the user is allowed to see what it is about to see.
+Forms are the general way a website can present an HTML page with fields for
+the user to enter data in, and then press some kind of 'OK' or 'Submit'
+button to get that data sent to the server. The server then typically uses
+the posted data to decide how to act. Like using the entered words to search
+in a database, or to add the info in a bug tracking system, display the
+entered address on a map or using the info as a login-prompt verifying that
+the user is allowed to see what it is about to see.
 
- Of course there has to be some kind of program on the server end to receive
- the data you send. You cannot just invent something out of the air.
+Of course there has to be some kind of program on the server end to receive
+the data you send. You cannot invent something out of the air.
 
 ## GET
 
- A GET-form uses the method GET, as specified in HTML like:
+A GET-form uses the method GET, as specified in HTML like:
 
 ```html
 <form method="GET" action="junk.cgi">
@@ -241,36 +243,35 @@
 </form>
 ```
 
- In your favorite browser, this form will appear with a text box to fill in
- and a press-button labeled "OK". If you fill in '1905' and press the OK
- button, your browser will then create a new URL to get for you. The URL will
- get `junk.cgi?birthyear=1905&press=OK` appended to the path part of the
- previous URL.
+In your favorite browser, this form appears with a text box to fill in and a
+press-button labeled "OK". If you fill in '1905' and press the OK button,
+your browser then creates a new URL to get for you. The URL gets
+`junk.cgi?birthyear=1905&press=OK` appended to the path part of the previous
+URL.
 
- If the original form was seen on the page `www.example.com/when/birth.html`,
- the second page you will get will become
- `www.example.com/when/junk.cgi?birthyear=1905&press=OK`.
+If the original form was seen on the page `www.example.com/when/birth.html`,
+the second page you get becomes
+`www.example.com/when/junk.cgi?birthyear=1905&press=OK`.
 
- Most search engines work this way.
+Most search engines work this way.
 
- To make curl do the GET form post for you, just enter the expected created
- URL:
+To make curl do the GET form post for you, enter the expected created URL:
 
-    curl "http://www.example.com/when/junk.cgi?birthyear=1905&press=OK"
+    curl "https://www.example.com/when/junk.cgi?birthyear=1905&press=OK"
 
 ## POST
 
- The GET method makes all input field names get displayed in the URL field of
- your browser. That is generally a good thing when you want to be able to
- bookmark that page with your given data, but it is an obvious disadvantage if
- you entered secret information in one of the fields or if there are a large
- amount of fields creating a long and unreadable URL.
+The GET method makes all input field names get displayed in the URL field of
+your browser. That is generally a good thing when you want to be able to
+bookmark that page with your given data, but it is an obvious disadvantage if
+you entered secret information in one of the fields or if there are a large
+amount of fields creating a long and unreadable URL.
 
- The HTTP protocol then offers the POST method. This way the client sends the
- data separated from the URL and thus you will not see any of it in the URL
- address field.
+The HTTP protocol then offers the POST method. This way the client sends the
+data separated from the URL and thus you do not see any of it in the URL
+address field.
 
- The form would look similar to the previous one:
+The form would look similar to the previous one:
 
 ```html
 <form method="POST" action="junk.cgi">
@@ -279,59 +280,56 @@
 </form>
 ```
 
- And to use curl to post this form with the same data filled in as before, we
- could do it like:
+To use curl to post this form with the same data filled in as before, we
+could do it like:
 
-    curl --data "birthyear=1905&press=%20OK%20" http://www.example.com/when/junk.cgi
+    curl --data "birthyear=1905&press=%20OK%20" https://www.example.com/when/junk.cgi
 
- This kind of POST will use the Content-Type
- `application/x-www-form-urlencoded` and is the most widely used POST kind.
+This kind of POST uses the Content-Type `application/x-www-form-urlencoded`
+and is the most widely used POST kind.
 
- The data you send to the server MUST already be properly encoded, curl will
- not do that for you. For example, if you want the data to contain a space,
- you need to replace that space with `%20`, etc. Failing to comply with this will
- most likely cause your data to be received wrongly and messed up.
+The data you send to the server MUST already be properly encoded, curl does
+not do that for you. For example, if you want the data to contain a space,
+you need to replace that space with `%20`, etc. Failing to comply with this
+most likely causes your data to be received wrongly and messed up.
 
- Recent curl versions can in fact url-encode POST data for you, like this:
+Recent curl versions can in fact URL encode POST data for you, like this:
 
-    curl --data-urlencode "name=I am Daniel" http://www.example.com
+    curl --data-urlencode "name=I am Daniel" https://www.example.com
 
- If you repeat `--data` several times on the command line, curl will
- concatenate all the given data pieces - and put a `&` symbol between each
- data segment.
+If you repeat `--data` several times on the command line, curl concatenates
+all the given data pieces - and put a `&` symbol between each data segment.
 
 ## File Upload POST
 
- Back in late 1995 they defined an additional way to post data over HTTP. It
- is documented in the RFC 1867, why this method sometimes is referred to as
- RFC 1867-posting.
+Back in late 1995 they defined an additional way to post data over HTTP. It
+is documented in the RFC 1867, why this method sometimes is referred to as
+RFC 1867-posting.
 
- This method is mainly designed to better support file uploads. A form that
- allows a user to upload a file could be written like this in HTML:
+This method is mainly designed to better support file uploads. A form that
+allows a user to upload a file could be written like this in HTML:
 
-```html
-<form method="POST" enctype='multipart/form-data' action="upload.cgi">
-  <input type=file name=upload>
-  <input type=submit name=press value="OK">
-</form>
-```
+    <form method="POST" enctype='multipart/form-data' action="upload.cgi">
+      <input name=upload type=file>
+      <input type=submit name=press value="OK">
+    </form>
 
- This clearly shows that the Content-Type about to be sent is
- `multipart/form-data`.
+This clearly shows that the Content-Type about to be sent is
+`multipart/form-data`.
 
- To post to a form like this with curl, you enter a command line like:
+To post to a form like this with curl, you enter a command line like:
 
     curl --form upload=@localfilename --form press=OK [URL]
 
 ## Hidden Fields
 
- A common way for HTML based applications to pass state information between
- pages is to add hidden fields to the forms. Hidden fields are already filled
- in, they are not displayed to the user and they get passed along just as all
- the other fields.
+A common way for HTML based applications to pass state information between
+pages is to add hidden fields to the forms. Hidden fields are already filled
+in, they are not displayed to the user and they get passed along as all the
+other fields.
 
- A similar example form with one visible field, one hidden field and one
- submit button could look like:
+A similar example form with one visible field, one hidden field and one
+submit button could look like:
 
 ```html
 <form method="POST" action="foobar.cgi">
@@ -341,124 +339,126 @@
 </form>
 ```
 
- To POST this with curl, you will not have to think about if the fields are
- hidden or not. To curl they are all the same:
+To POST this with curl, you do not have to think about if the fields are
+hidden or not. To curl they are all the same:
 
     curl --data "birthyear=1905&press=OK&person=daniel" [URL]
 
 ## Figure Out What A POST Looks Like
 
- When you are about to fill in a form and send it to a server by using curl
- instead of a browser, you are of course interested in sending a POST exactly
- the way your browser does.
+When you are about to fill in a form and send it to a server by using curl
+instead of a browser, you are of course interested in sending a POST exactly
+the way your browser does.
 
- An easy way to get to see this, is to save the HTML page with the form on
- your local disk, modify the 'method' to a GET, and press the submit button
- (you could also change the action URL if you want to).
+An easy way to get to see this, is to save the HTML page with the form on
+your local disk, modify the 'method' to a GET, and press the submit button
+(you could also change the action URL if you want to).
 
- You will then clearly see the data get appended to the URL, separated with a
- `?`-letter as GET forms are supposed to.
+You then clearly see the data get appended to the URL, separated with a
+`?`-letter as GET forms are supposed to.
 
 # HTTP upload
 
 ## PUT
 
- Perhaps the best way to upload data to an HTTP server is to use PUT. Then
- again, this of course requires that someone put a program or script on the
- server end that knows how to receive an HTTP PUT stream.
+Perhaps the best way to upload data to an HTTP server is to use PUT. Then
+again, this of course requires that someone put a program or script on the
+server end that knows how to receive an HTTP PUT stream.
 
- Put a file to an HTTP server with curl:
+Put a file to an HTTP server with curl:
 
-    curl --upload-file uploadfile http://www.example.com/receive.cgi
+    curl --upload-file uploadfile https://www.example.com/receive.cgi
 
 # HTTP Authentication
 
 ## Basic Authentication
 
- HTTP Authentication is the ability to tell the server your username and
- password so that it can verify that you are allowed to do the request you are
- doing. The Basic authentication used in HTTP (which is the type curl uses by
- default) is **plain text** based, which means it sends username and password
- only slightly obfuscated, but still fully readable by anyone that sniffs on
- the network between you and the remote server.
+HTTP Authentication is the ability to tell the server your username and
+password so that it can verify that you are allowed to do the request you are
+doing. The Basic authentication used in HTTP (which is the type curl uses by
+default) is **plain text** based, which means it sends username and password
+only slightly obfuscated, but still fully readable by anyone that sniffs on
+the network between you and the remote server.
 
- To tell curl to use a user and password for authentication:
+To tell curl to use a user and password for authentication:
 
-    curl --user name:password http://www.example.com
+    curl --user myname:password https://www.example.com
 
 ## Other Authentication
 
- The site might require a different authentication method (check the headers
- returned by the server), and then
- [`--ntlm`](https://curl.se/docs/manpage.html#--ntlm),
- [`--digest`](https://curl.se/docs/manpage.html#--digest),
- [`--negotiate`](https://curl.se/docs/manpage.html#--negotiate) or even
- [`--anyauth`](https://curl.se/docs/manpage.html#--anyauth) might be
- options that suit you.
+The site might require a different authentication method (check the headers
+returned by the server), and then
+[`--ntlm`](https://curl.se/docs/manpage.html#--ntlm),
+[`--digest`](https://curl.se/docs/manpage.html#--digest),
+[`--negotiate`](https://curl.se/docs/manpage.html#--negotiate) or even
+[`--anyauth`](https://curl.se/docs/manpage.html#--anyauth) might be
+options that suit you.
 
 ## Proxy Authentication
 
- Sometimes your HTTP access is only available through the use of an HTTP
- proxy. This seems to be especially common at various companies. An HTTP proxy
- may require its own user and password to allow the client to get through to
- the Internet. To specify those with curl, run something like:
+Sometimes your HTTP access is only available through the use of an HTTP
+proxy. This seems to be especially common at various companies. An HTTP proxy
+may require its own user and password to allow the client to get through to
+the Internet. To specify those with curl, run something like:
 
     curl --proxy-user proxyuser:proxypassword curl.se
 
- If your proxy requires the authentication to be done using the NTLM method,
- use [`--proxy-ntlm`](https://curl.se/docs/manpage.html#--proxy-ntlm), if
- it requires Digest use
- [`--proxy-digest`](https://curl.se/docs/manpage.html#--proxy-digest).
+If your proxy requires the authentication to be done using the NTLM method,
+use [`--proxy-ntlm`](https://curl.se/docs/manpage.html#--proxy-ntlm), if
+it requires Digest use
+[`--proxy-digest`](https://curl.se/docs/manpage.html#--proxy-digest).
 
- If you use any one of these user+password options but leave out the password
- part, curl will prompt for the password interactively.
+If you use any one of these user+password options but leave out the password
+part, curl prompts for the password interactively.
 
 ## Hiding credentials
 
- Do note that when a program is run, its parameters might be possible to see
- when listing the running processes of the system. Thus, other users may be
- able to watch your passwords if you pass them as plain command line
- options. There are ways to circumvent this.
+Do note that when a program is run, its parameters might be possible to see
+when listing the running processes of the system. Thus, other users may be
+able to watch your passwords if you pass them as plain command line
+options. There are ways to circumvent this.
 
- It is worth noting that while this is how HTTP Authentication works, many
- websites will not use this concept when they provide logins etc. See the Web
- Login chapter further below for more details on that.
+It is worth noting that while this is how HTTP Authentication works, many
+websites do not use this concept when they provide logins etc. See the Web
+Login chapter further below for more details on that.
 
 # More HTTP Headers
 
 ## Referer
 
- An HTTP request may include a 'referer' field (yes it is misspelled), which
- can be used to tell from which URL the client got to this particular
- resource. Some programs/scripts check the referer field of requests to verify
- that this was not arriving from an external site or an unknown page. While
- this is a stupid way to check something so easily forged, many scripts still
- do it. Using curl, you can put anything you want in the referer-field and
- thus more easily be able to fool the server into serving your request.
+An HTTP request may include a 'referer' field (yes it is misspelled), which
+can be used to tell from which URL the client got to this particular
+resource. Some programs/scripts check the referer field of requests to verify
+that this was not arriving from an external site or an unknown page. While
+this is a stupid way to check something so easily forged, many scripts still
+do it. Using curl, you can put anything you want in the referer-field and
+thus more easily be able to fool the server into serving your request.
 
- Use curl to set the referer field with:
+Use curl to set the referer field with:
 
-    curl --referer http://www.example.come http://www.example.com
+    curl --referer https://www.example.come https://www.example.com
 
 ## User Agent
 
- Similar to the referer field, all HTTP requests may set the User-Agent
- field. It names what user agent (client) that is being used. Many
- applications use this information to decide how to display pages. Silly web
- programmers try to make different pages for users of different browsers to
- make them look the best possible for their particular browsers. They usually
- also do different kinds of JavaScript etc.
+Similar to the referer field, all HTTP requests may set the User-Agent
+field. It names what user agent (client) that is being used. Many
+applications use this information to decide how to display pages. Silly web
+programmers try to make different pages for users of different browsers to
+make them look the best possible for their particular browsers. They usually
+also do different kinds of JavaScript etc.
 
- At times, you will see that getting a page with curl will not return the same
- page that you see when getting the page with your browser. Then you know it
- is time to set the User Agent field to fool the server into thinking you are
- one of those browsers.
+At times, you may learn that getting a page with curl does not return the
+same page that you see when getting the page with your browser. Then you know
+it is time to set the User Agent field to fool the server into thinking you
+are one of those browsers.
 
- To make curl look like Internet Explorer 5 on a Windows 2000 box:
+By default, curl uses curl/VERSION, such as User-Agent: curl/8.11.0.
+
+To make curl look like Internet Explorer 5 on a Windows 2000 box:
 
     curl --user-agent "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" [URL]
 
- Or why not look like you are using Netscape 4.73 on an old Linux box:
+Or why not look like you are using Netscape 4.73 on an old Linux box:
 
     curl --user-agent "Mozilla/4.73 [en] (X11; U; Linux 2.2.15 i686)" [URL]
 
@@ -466,139 +466,136 @@
 
 ## Location header
 
- When a resource is requested from a server, the reply from the server may
- include a hint about where the browser should go next to find this page, or a
- new page keeping newly generated output. The header that tells the browser to
- redirect is `Location:`.
+When a resource is requested from a server, the reply from the server may
+include a hint about where the browser should go next to find this page, or a
+new page keeping newly generated output. The header that tells the browser to
+redirect is `Location:`.
 
- Curl does not follow `Location:` headers by default, but will simply display
- such pages in the same manner it displays all HTTP replies. It does however
- feature an option that will make it attempt to follow the `Location:`
- pointers.
+curl does not follow `Location:` headers by default, but displays such
+pages in the same manner it displays all HTTP replies. It does however
+feature an option that makes it attempt to follow the `Location:` pointers.
 
- To tell curl to follow a Location:
+To tell curl to follow a Location:
 
-    curl --location http://www.example.com
+    curl --location https://www.example.com
 
- If you use curl to POST to a site that immediately redirects you to another
- page, you can safely use
- [`--location`](https://curl.se/docs/manpage.html#-L) (`-L`) and
- `--data`/`--form` together. Curl will only use POST in the first request, and
- then revert to GET in the following operations.
+If you use curl to POST to a site that immediately redirects you to another
+page, you can safely use [`--location`](https://curl.se/docs/manpage.html#-L)
+(`-L`) and `--data`/`--form` together. curl only uses POST in the first
+request, and then revert to GET in the following operations.
 
 ## Other redirects
 
- Browsers typically support at least two other ways of redirects that curl
- does not: first the html may contain a meta refresh tag that asks the browser
- to load a specific URL after a set number of seconds, or it may use
- JavaScript to do it.
+Browsers typically support at least two other ways of redirects that curl
+does not: first the html may contain a meta refresh tag that asks the browser
+to load a specific URL after a set number of seconds, or it may use
+JavaScript to do it.
 
 # Cookies
 
 ## Cookie Basics
 
- The way the web browsers do "client side state control" is by using
- cookies. Cookies are just names with associated contents. The cookies are
- sent to the client by the server. The server tells the client for what path
- and host name it wants the cookie sent back, and it also sends an expiration
- date and a few more properties.
+The way the web browsers do "client side state control" is by using cookies.
+Cookies are names with associated contents. The cookies are sent to the client
+by the server. The server tells the client for what path and hostname it wants
+the cookie sent back, and it also sends an expiration date and a few more
+properties.
 
- When a client communicates with a server with a name and path as previously
- specified in a received cookie, the client sends back the cookies and their
- contents to the server, unless of course they are expired.
+When a client communicates with a server with a name and path as previously
+specified in a received cookie, the client sends back the cookies and their
+contents to the server, unless of course they are expired.
 
- Many applications and servers use this method to connect a series of requests
- into a single logical session. To be able to use curl in such occasions, we
- must be able to record and send back cookies the way the web application
- expects them. The same way browsers deal with them.
+Many applications and servers use this method to connect a series of requests
+into a single logical session. To be able to use curl in such occasions, we
+must be able to record and send back cookies the way the web application
+expects them. The same way browsers deal with them.
 
 ## Cookie options
 
- The simplest way to send a few cookies to the server when getting a page with
- curl is to add them on the command line like:
+The simplest way to send a few cookies to the server when getting a page with
+curl is to add them on the command line like:
 
-    curl --cookie "name=Daniel" http://www.example.com
+    curl --cookie "name=Daniel" https://www.example.com
 
- Cookies are sent as common HTTP headers. This is practical as it allows curl
- to record cookies simply by recording headers. Record cookies with curl by
- using the [`--dump-header`](https://curl.se/docs/manpage.html#-D) (`-D`)
- option like:
+Cookies are sent as common HTTP headers. This is practical as it allows curl
+to record cookies by recording headers. Record cookies with curl by
+using the [`--dump-header`](https://curl.se/docs/manpage.html#-D) (`-D`)
+option like:
 
-    curl --dump-header headers_and_cookies http://www.example.com
+    curl --dump-header headers_and_cookies https://www.example.com
 
- (Take note that the
- [`--cookie-jar`](https://curl.se/docs/manpage.html#-c) option described
- below is a better way to store cookies.)
+(Take note that the
+[`--cookie-jar`](https://curl.se/docs/manpage.html#-c) option described
+below is a better way to store cookies.)
 
- Curl has a full blown cookie parsing engine built-in that comes in use if you
- want to reconnect to a server and use cookies that were stored from a
- previous connection (or hand-crafted manually to fool the server into
- believing you had a previous connection). To use previously stored cookies,
- you run curl like:
+curl has a full blown cookie parsing engine built-in that comes in use if you
+want to reconnect to a server and use cookies that were stored from a
+previous connection (or hand-crafted manually to fool the server into
+believing you had a previous connection). To use previously stored cookies,
+you run curl like:
 
-    curl --cookie stored_cookies_in_file http://www.example.com
+    curl --cookie stored_cookies_in_file https://www.example.com
 
- Curl's "cookie engine" gets enabled when you use the
- [`--cookie`](https://curl.se/docs/manpage.html#-b) option. If you only
- want curl to understand received cookies, use `--cookie` with a file that
- does not exist. Example, if you want to let curl understand cookies from a
- page and follow a location (and thus possibly send back cookies it received),
- you can invoke it like:
+curl's "cookie engine" gets enabled when you use the
+[`--cookie`](https://curl.se/docs/manpage.html#-b) option. If you only
+want curl to understand received cookies, use `--cookie` with a file that
+does not exist. Example, if you want to let curl understand cookies from a
+page and follow a location (and thus possibly send back cookies it received),
+you can invoke it like:
 
-    curl --cookie nada --location http://www.example.com
+    curl --cookie nada --location https://www.example.com
 
- Curl has the ability to read and write cookie files that use the same file
- format that Netscape and Mozilla once used. It is a convenient way to share
- cookies between scripts or invokes. The `--cookie` (`-b`) switch
- automatically detects if a given file is such a cookie file and parses it,
- and by using the `--cookie-jar` (`-c`) option you will make curl write a new
- cookie file at the end of an operation:
+curl has the ability to read and write cookie files that use the same file
+format that Netscape and Mozilla once used. It is a convenient way to share
+cookies between scripts or invokes. The `--cookie` (`-b`) switch
+automatically detects if a given file is such a cookie file and parses it,
+and by using the `--cookie-jar` (`-c`) option you make curl write a new
+cookie file at the end of an operation:
 
     curl --cookie cookies.txt --cookie-jar newcookies.txt \
-    http://www.example.com
+      https://www.example.com
 
 # HTTPS
 
 ## HTTPS is HTTP secure
 
- There are a few ways to do secure HTTP transfers. By far the most common
- protocol for doing this is what is generally known as HTTPS, HTTP over
- SSL. SSL encrypts all the data that is sent and received over the network and
- thus makes it harder for attackers to spy on sensitive information.
+There are a few ways to do secure HTTP transfers. By far the most common
+protocol for doing this is what is generally known as HTTPS, HTTP over
+SSL. SSL encrypts all the data that is sent and received over the network and
+thus makes it harder for attackers to spy on sensitive information.
 
- SSL (or TLS as the current version of the standard is called) offers a set of
- advanced features to do secure transfers over HTTP.
+SSL (or TLS as the current version of the standard is called) offers a set of
+advanced features to do secure transfers over HTTP.
 
- Curl supports encrypted fetches when built to use a TLS library and it can be
- built to use one out of a fairly large set of libraries - `curl -V` will show
- which one your curl was built to use (if any!). To get a page from an HTTPS
- server, simply run curl like:
+curl supports encrypted fetches when built to use a TLS library and it can be
+built to use one out of a fairly large set of libraries - `curl -V` shows
+which one your curl was built to use (if any). To get a page from an HTTPS
+server, run curl like:
 
     curl https://secure.example.com
 
 ## Certificates
 
- In the HTTPS world, you use certificates to validate that you are the one
- you claim to be, as an addition to normal passwords. Curl supports client-
- side certificates. All certificates are locked with a pass phrase, which you
- need to enter before the certificate can be used by curl. The pass phrase
- can be specified on the command line or if not, entered interactively when
- curl queries for it. Use a certificate with curl on an HTTPS server like:
+In the HTTPS world, you use certificates to validate that you are the one you
+claim to be, as an addition to normal passwords. curl supports client- side
+certificates. All certificates are locked with a passphrase, which you need
+to enter before the certificate can be used by curl. The passphrase can be
+specified on the command line or if not, entered interactively when curl
+queries for it. Use a certificate with curl on an HTTPS server like:
 
     curl --cert mycert.pem https://secure.example.com
 
- curl also tries to verify that the server is who it claims to be, by
- verifying the server's certificate against a locally stored CA cert
- bundle. Failing the verification will cause curl to deny the connection. You
- must then use [`--insecure`](https://curl.se/docs/manpage.html#-k)
- (`-k`) in case you want to tell curl to ignore that the server cannot be
- verified.
+curl also tries to verify that the server is who it claims to be, by
+verifying the server's certificate against a locally stored CA cert bundle.
+Failing the verification causes curl to deny the connection. You must then
+use [`--insecure`](https://curl.se/docs/manpage.html#-k) (`-k`) in case you
+want to tell curl to ignore that the server cannot be verified.
 
- More about server certificate verification and ca cert bundles can be read in
- the [`SSLCERTS` document](https://curl.se/docs/sslcerts.html).
+More about server certificate verification and CA cert bundles can be read in
+the [`SSLCERTS` document](https://curl.se/docs/sslcerts.html).
 
- At times you may end up with your own CA cert store and then you can tell
- curl to use that to verify the server's certificate:
+At times you may end up with your own CA cert store and then you can tell
+curl to use that to verify the server's certificate:
 
     curl --cacert ca-bundle.pem https://example.com/
 
@@ -606,107 +603,106 @@
 
 ## Modify method and headers
 
- Doing fancy stuff, you may need to add or change elements of a single curl
- request.
+Doing fancy stuff, you may need to add or change elements of a single curl
+request.
 
- For example, you can change the POST method to `PROPFIND` and send the data
- as `Content-Type: text/xml` (instead of the default `Content-Type`) like
- this:
+For example, you can change the POST method to `PROPFIND` and send the data
+as `Content-Type: text/xml` (instead of the default `Content-Type`) like
+this:
 
     curl --data "<xml>" --header "Content-Type: text/xml" \
       --request PROPFIND example.com
 
- You can delete a default header by providing one without content. Like you
- can ruin the request by chopping off the `Host:` header:
+You can delete a default header by providing one without content. Like you
+can ruin the request by chopping off the `Host:` header:
 
-    curl --header "Host:" http://www.example.com
+    curl --header "Host:" https://www.example.com
 
- You can add headers the same way. Your server may want a `Destination:`
- header, and you can add it:
+You can add headers the same way. Your server may want a `Destination:`
+header, and you can add it:
 
-    curl --header "Destination: http://nowhere" http://example.com
+    curl --header "Destination: nowhere" https://example.com
 
 ## More on changed methods
 
- It should be noted that curl selects which methods to use on its own
- depending on what action to ask for. `-d` will do POST, `-I` will do HEAD and
- so on. If you use the
- [`--request`](https://curl.se/docs/manpage.html#-X) / `-X` option you
- can change the method keyword curl selects, but you will not modify curl's
- behavior. This means that if you for example use -d "data" to do a POST, you
- can modify the method to a `PROPFIND` with `-X` and curl will still think it
- sends a POST . You can change the normal GET to a POST method by simply
- adding `-X POST` in a command line like:
+It should be noted that curl selects which methods to use on its own
+depending on what action to ask for. `-d` makes a POST, `-I` makes a HEAD and
+so on. If you use the [`--request`](https://curl.se/docs/manpage.html#-X) /
+`-X` option you can change the method keyword curl selects, but you do not
+modify curl's behavior. This means that if you for example use -d "data" to
+do a POST, you can modify the method to a `PROPFIND` with `-X` and curl still
+thinks it sends a POST. You can change the normal GET to a POST method by
+adding `-X POST` in a command line like:
 
-    curl -X POST http://example.org/
+    curl -X POST https://example.org/
 
- ... but curl will still think and act as if it sent a GET so it will not send
- any request body etc.
+curl however still acts as if it sent a GET so it does not send any request
+body etc.
 
 # Web Login
 
 ## Some login tricks
 
- While not strictly just HTTP related, it still causes a lot of people
- problems so here's the executive run-down of how the vast majority of all
- login forms work and how to login to them using curl.
+While not strictly HTTP related, it still causes a lot of people problems so
+here's the executive run-down of how the vast majority of all login forms work
+and how to login to them using curl.
 
- It can also be noted that to do this properly in an automated fashion, you
- will most certainly need to script things and do multiple curl invokes etc.
+It can also be noted that to do this properly in an automated fashion, you
+most certainly need to script things and do multiple curl invokes etc.
 
- First, servers mostly use cookies to track the logged-in status of the
- client, so you will need to capture the cookies you receive in the
- responses. Then, many sites also set a special cookie on the login page (to
- make sure you got there through their login page) so you should make a habit
- of first getting the login-form page to capture the cookies set there.
+First, servers mostly use cookies to track the logged-in status of the
+client, so you need to capture the cookies you receive in the responses.
+Then, many sites also set a special cookie on the login page (to make sure
+you got there through their login page) so you should make a habit of first
+getting the login-form page to capture the cookies set there.
 
- Some web-based login systems feature various amounts of JavaScript, and
- sometimes they use such code to set or modify cookie contents. Possibly they
- do that to prevent programmed logins, like this manual describes how to...
- Anyway, if reading the code is not enough to let you repeat the behavior
- manually, capturing the HTTP requests done by your browsers and analyzing the
- sent cookies is usually a working method to work out how to shortcut the
- JavaScript need.
+Some web-based login systems feature various amounts of JavaScript, and
+sometimes they use such code to set or modify cookie contents. Possibly they
+do that to prevent programmed logins, like this manual describes how to...
+Anyway, if reading the code is not enough to let you repeat the behavior
+manually, capturing the HTTP requests done by your browsers and analyzing the
+sent cookies is usually a working method to work out how to shortcut the
+JavaScript need.
 
- In the actual `<form>` tag for the login, lots of sites fill-in
- random/session or otherwise secretly generated hidden tags and you may need
- to first capture the HTML code for the login form and extract all the hidden
- fields to be able to do a proper login POST. Remember that the contents need
- to be URL encoded when sent in a normal POST.
+In the actual `<form>` tag for the login, lots of sites fill-in
+random/session or otherwise secretly generated hidden tags and you may need
+to first capture the HTML code for the login form and extract all the hidden
+fields to be able to do a proper login POST. Remember that the contents need
+to be URL encoded when sent in a normal POST.
 
 # Debug
 
 ## Some debug tricks
 
- Many times when you run curl on a site, you will notice that the site does not
- seem to respond the same way to your curl requests as it does to your
- browser's.
+Many times when you run curl on a site, you notice that the site does not
+seem to respond the same way to your curl requests as it does to your
+browser's.
 
- Then you need to start making your curl requests more similar to your
- browser's requests:
+Then you need to start making your curl requests more similar to your
+browser's requests:
 
- - Use the `--trace-ascii` option to store fully detailed logs of the requests
-   for easier analyzing and better understanding
+- Use the `--trace-ascii` option to store fully detailed logs of the requests
+  for easier analyzing and better understanding
 
- - Make sure you check for and use cookies when needed (both reading with
-   `--cookie` and writing with `--cookie-jar`)
+- Make sure you check for and use cookies when needed (both reading with
+  `--cookie` and writing with `--cookie-jar`)
 
- - Set user-agent (with [`-A`](https://curl.se/docs/manpage.html#-A)) to
-   one like a recent popular browser does
+- Set user-agent (with [`-A`](https://curl.se/docs/manpage.html#-A)) to
+  one like a recent popular browser does
 
- - Set referer (with [`-E`](https://curl.se/docs/manpage.html#-E)) like
-   it is set by the browser
+- Set referer (with [`-E`](https://curl.se/docs/manpage.html#-E)) like
+  it is set by the browser
 
- - If you use POST, make sure you send all the fields and in the same order as
-   the browser does it.
+- If you use POST, make sure you send all the fields and in the same order as
+  the browser does it.
 
 ## Check what the browsers do
 
- A good helper to make sure you do this right, is the web browsers' developers
- tools that let you view all headers you send and receive (even when using
- HTTPS).
+A good helper to make sure you do this right, is the web browsers' developers
+tools that let you view all headers you send and receive (even when using
+HTTPS).
 
- A more raw approach is to capture the HTTP traffic on the network with tools
- such as Wireshark or tcpdump and check what headers that were sent and
- received by the browser. (HTTPS forces you to use `SSLKEYLOGFILE` to do
- that.)
+A more raw approach is to capture the HTTP traffic on the network with tools
+such as Wireshark or tcpdump and check what headers that were sent and
+received by the browser. (HTTPS forces you to use `SSLKEYLOGFILE` to do
+that.)
diff --git a/third-party/curl/docs/URL-SYNTAX.md b/third-party/curl/docs/URL-SYNTAX.md
index ddd99454fb..219e84ee93 100644
--- a/third-party/curl/docs/URL-SYNTAX.md
+++ b/third-party/curl/docs/URL-SYNTAX.md
@@ -1,3 +1,9 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # URL syntax and their use in curl
 
 ## Specifications
@@ -5,9 +11,9 @@
 The official "URL syntax" is primarily defined in these two different
 specifications:
 
- - [RFC 3986](https://datatracker.ietf.org/doc/html/rfc3986) (although URL is called
-   "URI" in there)
- - [The WHATWG URL Specification](https://url.spec.whatwg.org/)
+- [RFC 3986](https://datatracker.ietf.org/doc/html/rfc3986) (although URL is
+  called "URI" in there)
+- [The WHATWG URL Specification](https://url.spec.whatwg.org/)
 
 RFC 3986 is the earlier one, and curl has always tried to adhere to that one
 (since it shipped in January 2005).
@@ -26,12 +32,12 @@ unlikely that multiple parsers treat URLs the same way.
 
 Due to the inherent differences between URL parser implementations, it is
 considered a security risk to mix different implementations and assume the
-same behavior!
+same behavior.
 
-For example, if you use one parser to check if a URL uses a good host name or
+For example, if you use one parser to check if a URL uses a good hostname or
 the correct auth field, and then pass on that same URL to a *second* parser,
-there will always be a risk it treats the same URL differently. There is no
-right and wrong in URL land, only differences of opinions.
+there is always a risk it treats the same URL differently. There is no right
+and wrong in URL land, only differences of opinions.
 
 libcurl offers a separate API to its URL parser for this reason, among others.
 
@@ -55,13 +61,13 @@ security concerns:
 ## "RFC 3986 plus"
 
 curl recognizes a URL syntax that we call "RFC 3986 plus". It is grounded on
-the well established RFC 3986 to make sure previously written command lines and
-curl using scripts will remain working.
+the well established RFC 3986 to make sure previously written command lines
+and curl using scripts remain working.
 
 curl's URL parser allows a few deviations from the spec in order to
 inter-operate better with URLs that appear in the wild.
 
-### spaces
+### Spaces
 
 A URL provided to curl cannot contain spaces. They need to be provided URL
 encoded to be accepted in a URL by curl.
@@ -71,12 +77,12 @@ client where a resource has been redirected to, sometimes contain spaces. This
 is a violation of RFC 3986 but is fine in the WHATWG spec. curl handles these
 by re-encoding them to `%20`.
 
-### non-ASCII
+### Non-ASCII
 
 Byte values in a provided URL that are outside of the printable ASCII range
 are percent-encoded by curl.
 
-### multiple slashes
+### Multiple slashes
 
 An absolute URL always starts with a "scheme" followed by a colon. For all the
 schemes curl supports, the colon must be followed by two slashes according to
@@ -92,18 +98,17 @@ curl supports "URLs" that do not start with a scheme. This is not supported by
 any of the specifications. This is a shortcut to entering URLs that was
 supported by browsers early on and has been mimicked by curl.
 
-Based on what the host name starts with, curl will "guess" what protocol to
-use:
+Based on what the hostname starts with, curl "guesses" what protocol to use:
 
- - `ftp.` means FTP
- - `dict.` means DICT
- - `ldap.` means LDAP
- - `imap.` means IMAP
- - `smtp.` means SMTP
- - `pop3.` means POP3
- - all other means HTTP
+- `ftp.` means FTP
+- `dict.` means DICT
+- `ldap.` means LDAP
+- `imap.` means IMAP
+- `smtp.` means SMTP
+- `pop3.` means POP3
+- all other means HTTP
 
-### globbing letters
+### Globbing letters
 
 The curl command line tool supports "globbing" of URLs. It means that you can
 create ranges and lists using `[N-M]` and `{one,two,three}` sequences. The
@@ -125,7 +130,7 @@ character or string.
 
 For example, this could look like:
 
-    http://user:password@www.example.com:80/index.html?foo=bar#top
+    https://user:password@www.example.com:80/index.html?foo=bar#top
 
 ## Scheme
 
@@ -136,9 +141,8 @@ curl supports the following schemes on URLs specified to transfer. They are
 matched case insensitively:
 
 `dict`, `file`, `ftp`, `ftps`, `gopher`, `gophers`, `http`, `https`, `imap`,
-`imaps`, `ldap`, `ldaps`, `mqtt`, `pop3`, `pop3s`, `rtmp`, `rtmpe`, `rtmps`,
-`rtmpt`, `rtmpte`, `rtmpts`, `rtsp`, `smb`, `smbs`, `smtp`, `smtps`, `telnet`,
-`tftp`
+`imaps`, `ldap`, `ldaps`, `mqtt`, `pop3`, `pop3s`, `rtsp`, `smb`, `smbs`,
+`smtp`, `smtps`, `telnet`, `tftp`
 
 When the URL is specified to identify a proxy, curl recognizes the following
 schemes:
@@ -147,10 +151,9 @@ schemes:
 
 ## Userinfo
 
-The userinfo field can be used to set user name and password for
-authentication purposes in this transfer. The use of this field is discouraged
-since it often means passing around the password in plain text and is thus a
-security risk.
+The userinfo field can be used to set username and password for authentication
+purposes in this transfer. The use of this field is discouraged since it often
+means passing around the password in plain text and is thus a security risk.
 
 URLs for IMAP, POP3 and SMTP also support *login options* as part of the
 userinfo field. They are provided as a semicolon after the password and then
@@ -164,13 +167,47 @@ local network name of the machine on your network or the IP address of the
 server or machine represented by either an IPv4 or IPv6 address (within
 brackets). For example:
 
-    http://www.example.com/
+    https://www.example.com/
 
-    http://hostname/
+    https://hostname.example/
 
-    http://192.168.0.1/
+    https://192.168.0.1/
 
-    http://[2001:1890:1112:1::20]/
+    https://[2001:1890:1112:1::20]/
+
+libcurl rejects hostnames with more than one trailing dot.
+
+### Numerical IPv4 addresses
+
+libcurl parses and normalizes everything that appears to be a numerical IPv4
+address. Including octal and hexadecimal formats and using one, two, three or
+four number groups.
+
+This normalizing is done so that curl can properly get documents from HTTP
+servers (with the correctly formatted address in the `Host:` header), so that
+IP based filtering for things like the `NO_PROXY` environment variable has a
+higher chance of working correctly, to increase the chances that two URLs can
+be compared and to allow users to extract and visualize the address in a readable
+way and to make sure libcurl works identically across different name resolver
+libraries and function calls.
+
+For a hostname that is only an IPv4 address with a trailing dot, the trailing
+dot is removed in the normalizing process.
+
+### Numerical IPv6 addresses
+
+libcurl allows a zone id to be provided with a numerical IPv6 address,
+separated with a percent character (`%`). The percent character may also be
+percent-encoded as `%25`. Like this:
+
+    http://[fe80::1%25eth0]/
+
+    http://[fe80::1%eth0]/
+
+### `IPvFuture`
+
+RFC 3986 documents a numerical IP address format called `IPvFuture`. libcurl
+does not recognize this format. Using it causes parse errors.
 
 ### "localhost"
 
@@ -184,15 +221,15 @@ machine.
 ### IDNA
 
 If curl was built with International Domain Name (IDN) support, it can also
-handle host names using non-ASCII characters.
+handle hostnames using non-ASCII characters.
 
 When built with libidn2, curl uses the IDNA 2008 standard. This is equivalent
 to the WHATWG URL spec, but differs from certain browsers that use IDNA 2003
 Transitional Processing. The two standards have a huge overlap but differ
-slightly, perhaps most famously in how they deal with the German "double s"
-(`ß`).
+slightly, perhaps most famously in how they deal with the
+[German "double s"](https://en.wikipedia.org/wiki/%c3%9f).
 
-When winidn is used, curl uses IDNA 2003 Transitional Processing, like the rest
+When WinIDN is used, curl uses IDNA 2003 Transitional Processing, like the rest
 of Windows.
 
 ## Port number
@@ -201,13 +238,20 @@ If there is a colon after the hostname, that should be followed by the port
 number to use. 1 - 65535. curl also supports a blank port number field - but
 only if the URL starts with a scheme.
 
-If the port number is not specified in the URL, curl will used a default port
-based on the provide scheme:
+If the port number is not specified in the URL, curl uses a default port
+number based on the provide scheme:
 
-DICT 2628, FTP 21, FTPS 990, GOPHER 70, GOPHERS 70, HTTP 80, HTTPS 443,
-IMAP 132, IMAPS 993, LDAP 369, LDAPS 636, MQTT 1883, POP3 110, POP3S 995,
-RTMP 1935, RTMPS 443, RTMPT 80, RTSP 554, SCP 22, SFTP 22, SMB 445, SMBS 445,
-SMTP 25, SMTPS 465, TELNET 23, TFTP 69
+DICT 2628, FTP 21, FTPS 990, GOPHER 70, GOPHERS 70, HTTP 80, HTTPS 443, IMAP
+143, IMAPS 993, LDAP 389, LDAPS 636, MQTT 1883, POP3 110, POP3S 995, RTSP 554,
+SCP 22, SFTP 22, SMB 445, SMBS 445, SMTP 25, SMTPS 465, TELNET 23, TFTP 69
+
+## Path
+
+By default, libcurl removes sequences of `/./` and `/../` from the path as per
+RFC 3986.
+
+libcurl might also normalize percent-encoded sequences to use uppercase
+hexadecimal letters.
 
 # Scheme specific behaviors
 
@@ -216,29 +260,29 @@ SMTP 25, SMTPS 465, TELNET 23, TFTP 69
 The path part of an FTP request specifies the file to retrieve and from which
 directory. If the file part is omitted then libcurl downloads the directory
 listing for the directory specified. If the directory is omitted then the
-directory listing for the root / home directory will be returned.
+directory listing for the root / home directory is returned.
 
 FTP servers typically put the user in its "home directory" after login, which
 then differs between users. To explicitly specify the root directory of an FTP
 server, start the path with double slash `//` or `/%2f` (2F is the hexadecimal
-value of the ascii code for the slash).
+value of the ASCII code for the slash).
 
 ## FILE
 
-When a `FILE://` URL is accessed on Windows systems, it can be crafted in a
+When a `file://` URL is accessed on Windows systems, it can be crafted in a
 way so that Windows attempts to connect to a (remote) machine when curl wants
 to read or write such a path.
 
 curl only allows the hostname part of a FILE URL to be one out of these three
 alternatives: `localhost`, `127.0.0.1` or blank ("", zero characters).
-Anything else will make curl fail to parse the URL.
+Anything else makes curl fail to parse the URL.
 
 ### Windows-specific FILE details
 
 curl accepts that the FILE URL's path starts with a "drive letter". That is a
 single letter `a` to `z` followed by a colon or a pipe character (`|`).
 
-The Windows operating system itself will convert some file accesses to perform
+The Windows operating system itself converts some file accesses to perform
 network accesses over SMB/CIFS, through several different file path patterns.
 This way, a `file://` URL passed to curl *might* be converted into a network
 access inadvertently and unknowingly to curl. This is a Windows feature curl
@@ -312,16 +356,16 @@ was specified in the URL. That was a bug fixed in 7.62.0, which added
 
 ## LDAP
 
-The path part of a LDAP request can be used to specify the: Distinguished
-Name, Attributes, Scope, Filter and Extension for a LDAP search. Each field is
-separated by a question mark and when that field is not required an empty
+The path part of an LDAP request can be used to specify the: Distinguished
+Name, Attributes, Scope, Filter and Extension for an LDAP search. Each field
+is separated by a question mark and when that field is not required an empty
 string with the question mark separator should be included.
 
 Search for the `DN` as `My Organization`:
 
     ldap://ldap.example.com/o=My%20Organization
 
-the same search but will only return `postalAddress` attributes:
+the same search but only return `postalAddress` attributes:
 
     ldap://ldap.example.com/o=My%20Organization?postalAddress
 
@@ -330,8 +374,8 @@ Search for an empty `DN` and request information about the
 
     ldap://ldap.example.com/?rootDomainNamingContext
 
-For more information about the individual components of a LDAP URL please
-see [RFC 4516](https://datatracker.ietf.org/doc/html/rfc4516).
+For more information about the individual components of an LDAP URL please see
+[RFC 4516](https://datatracker.ietf.org/doc/html/rfc4516).
 
 ## POP3
 
@@ -352,12 +396,12 @@ To specify a path relative to the user's home directory on the server, prepend
 The path part of an SFTP URL specifies the file to retrieve or upload. If the
 path ends with a slash (`/`) then a directory listing is returned instead of a
 file. If the path is omitted entirely then the directory listing for the root
-/ home directory will be returned.
+/ home directory is returned.
 
 ## SMB
-The path part of a SMB request specifies the file to retrieve and from what
+The path part of an SMB request specifies the file to retrieve and from what
 share and directory or the share to upload to and as such, may not be omitted.
-If the user name is embedded in the URL then it must contain the domain name
+If the username is embedded in the URL then it must contain the domain name
 and as such, the backslash must be URL encoded as %2f.
 
 When uploading to SMB, the size of the file needs to be known ahead of time,
@@ -367,25 +411,12 @@ curl supports SMB version 1 (only)
 
 ## SMTP
 
-The path part of a SMTP request specifies the host name to present during
-communication with the mail server. If the path is omitted, then libcurl will
-attempt to resolve the local computer's host name. However, this may not
-return the fully qualified domain name that is required by some mail servers
-and specifying this path allows you to set an alternative name, such as your
+The path part of an SMTP request specifies the hostname to present during
+communication with the mail server. If the path is omitted, then libcurl
+attempts to resolve the local computer's hostname. This may not return the
+fully qualified domain name that is required by some mail servers and
+specifying this path allows you to set an alternative name, such as your
 machine's fully qualified domain name, which you might have obtained from an
 external function such as gethostname or getaddrinfo.
 
 The default smtp port is 25. Some servers use port 587 as an alternative.
-
-## RTMP
-
-There is no official URL spec for RTMP so libcurl uses the URL syntax supported
-by the underlying librtmp library. It has a syntax where it wants a
-traditional URL, followed by a space and a series of space-separated
-`name=value` pairs.
-
-While space is not typically a "legal" letter, libcurl accepts them. When a
-user wants to pass in a `#` (hash) character it will be treated as a fragment
-and get cut off by libcurl if provided literally. You will instead have to
-escape it by providing it as backslash and its ASCII value in hexadecimal:
-`\23`.
diff --git a/third-party/curl/docs/VERIFY.md b/third-party/curl/docs/VERIFY.md
new file mode 100644
index 0000000000..c18b65a661
--- /dev/null
+++ b/third-party/curl/docs/VERIFY.md
@@ -0,0 +1,168 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# Verify
+
+Do not trust, verify!
+
+## Signed releases
+
+Every curl release is shipped as a set of tarballs. They all have the exact
+same content but use different archivers, visible by the different file
+extensions used.
+
+Each tarball is signed by the curl release manager Daniel. The digital
+signatures for each tarball are always provided. The digital signatures can be
+used to verify that the tarballs were produced by Daniel.
+
+If the curl website were breached and fake curl releases were
+provided, they could be detected using these signatures.
+
+Daniel's public GPG key: [27ED EAF2 2F3A BCEB 50DB 9A12 5CC9 08FD B71E 12C2](https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x27edeaf22f3abceb50db9a125cc908fdb71e12c2)
+
+## Reproducible releases
+
+The curl project ships *reproducible releases*. This means that everyone is
+able - and encouraged - to independently verify the contents of every curl
+release. Verify that it contains exactly the bits that are supposed to be in
+the release and nothing extra.
+
+The curl releases are generated using a Docker image to make it easy to get an
+identical setup. To verify an existing curl release, we provide a convenient
+script that generates a new curl release from source code and then compares
+this newly generated release tarball with the tarball file you downloaded from
+curl.se.
+
+For full verification, invoke the script inside an up-to-date curl source code
+git repository. Without a git repository present, it does a lighter check by
+rebuilding the release using the files in the tarball.
+
+Note: full verification mode checks out the release tag in your repository.
+Run it in a clean working tree (no local changes) or a dedicated clone.
+
+Invoke it like this:
+
+    git clone https://github.com/curl/curl
+    cd curl
+    mv [download-dir]/curl-8.19.0.tar.xz .
+    ./scripts/verify-release curl-8.19.0.tar.xz
+
+A successful check ends up with a final output similar to:
+
+    curl-8.19.0.tar.xz: OK
+
+By verifying the release tarballs, you verify that Daniel does not infect the
+release on purpose or involuntarily because of anything malicious running in
+his setup.
+
+### Verify the verify
+
+Of course you should not blindly trust the verification script. It is short
+and simple and should be quick to verify. Or you write your own script that
+you trust, to do the same job.
+
+## Source code
+
+How do you then verify that what is in git is fine to build a product from?
+
+In the curl project we verify the source code in multiple ways, and one way to
+gain trust is to verify and review our testing procedures.
+
+- we have a consistent code style (invalid style causes errors)
+
+- we ban and avoid a number of "sensitive" and "hard-to-use" C functions (use
+  of such functions causes errors)
+
+- we have a ceiling for complexity in functions to keep them easy to follow,
+  read and understand (failing to do so causes errors)
+
+- we review all pull requests before merging, both with humans and with bots.
+  We link back commits to their origin pull requests in commit messages.
+
+- we ban use of "binary blobs" in git to not provide means for malicious
+  actors to bundle encrypted payloads (trying to include a blob causes errors)
+
+- every single file in the git repository has a clear copyright and license
+  statement. Complete knowledge and tracking of provenience.
+
+- we actively avoid base64 encoded chunks as they too could function as ways
+  to obfuscate malicious contents
+
+- we forbid and prevent git force push on the master branch. History cannot be
+  rewritten.
+
+- we ban most uses of UTF-8 in code and documentation to avoid easily mixed
+  up Unicode characters that look like other characters. (adding Unicode
+  characters causes errors)
+
+- we document everything to make it clear how things are supposed to work. No
+  surprises. Lots of documentation is tested and verified in addition to
+  spellchecks and consistent wording.
+
+- we have thousands of tests and we add test cases for (ideally) every
+  functionality. Finding "white spots" and adding coverage is a top priority.
+  curl runs on countless operating systems, CPU architectures and you can
+  build curl in billions of different configuration setups: not every
+  combination is practically possible to test
+
+- we build curl and run tests in over two hundred CI jobs that are run for
+  every commit and every PR. We do not merge commits that have unexplained
+  test failures.
+
+- we run all tests as "torture tests", where each test case is rerun to have
+  every invoked fallible function call fail once each, to make sure curl
+  never leaks memory or crashes due to this.
+
+- we build curl in CI with the most picky compiler options enabled and we
+  never allow compiler warnings to linger. We always use `-Werror` that
+  converts warnings to errors and fail the builds.
+
+- we run all tests using valgrind and several combinations of sanitizers to
+  find and reduce the risk for memory problems, undefined behavior and
+  similar
+
+- we keep running static code analyzers on the code, both traditional ones
+  (clang-tidy, CodeSonar, Coverity) but also new generation AI powered ones
+  like Zeropath and Codex Security.
+
+- we run fuzzing on curl: non-stop as part of Google's OSS-Fuzz project, but
+  also briefly as part of the CI setup for every commit and PR
+
+- we make sure that the CI jobs we have for curl never "write back" to curl.
+  They access the source repository read-only and even if they would be
+  breached, they cannot infect or taint source code.
+
+- we run `zizmor` and other code analyzer tools on the CI job config scripts
+  to reduce the risk of us running or using insecure CI jobs.
+
+- we do reproducible releases to allow anyone to verify that the contents is
+  untainted
+
+- we digitally sign releases, git tags and git commits
+
+- there is a git backup on [codeberg](https://codeberg.org/curl/) for enhanced
+  resilience to infrastructure disturbance
+
+- we are committed to always fix reported vulnerabilities in the following
+  release. Security problems never linger around once they have been
+  reported.
+
+- we document everything and every detail about all curl vulnerabilities ever
+  reported
+
+- our code has been audited several times by external security experts, and
+  the few issues that have been detected in those were immediately addressed
+
+- Strong two-factor authentication on GitHub is mandatory for all committers
+
+- our commitment to never breaking ABI or API allows all users to easily
+  upgrade to new releases. This enables users to run recent security-fixed
+  versions instead of legacy insecure versions.
+
+- we have a vulnerability disclosure program that allows researchers to submit
+  suspected vulnerabilities in a private and secure fashion, so that we can
+  work on fixing curl and announcing the flaw in a responsible manner to
+  minimize risks for users.
diff --git a/third-party/curl/docs/VERSIONS.md b/third-party/curl/docs/VERSIONS.md
index 0ec9cd518a..5db6a51a76 100644
--- a/third-party/curl/docs/VERSIONS.md
+++ b/third-party/curl/docs/VERSIONS.md
@@ -1,57 +1,346 @@
-Version Numbers and Releases
-============================
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
 
- Curl is not only curl. Curl is also libcurl. They are actually individually
- versioned, but they usually follow each other closely.
+SPDX-License-Identifier: curl
+-->
 
- The version numbering is always built up using the same system:
+# Version Numbers and Releases
 
-        X.Y.Z
+The command line tool curl and the library libcurl are individually
+versioned, but they usually follow each other closely.
 
-  - X is main version number
-  - Y is release number
-  - Z is patch number
+The version numbering is always built up using the same system:
+
+       X.Y.Z
+
+- X is main version number
+- Y is release number
+- Z is patch number
 
 ## Bumping numbers
 
- One of these numbers will get bumped in each new release. The numbers to the
- right of a bumped number will be reset to zero.
+One of these numbers get bumped in each new release. The numbers to the right
+of a bumped number are reset to zero.
 
- The main version number will get bumped when *really* big, world colliding
- changes are made. The release number is bumped when changes are performed or
- things/features are added. The patch number is bumped when the changes are
- mere bugfixes.
+The main version number is bumped when *really* big, world colliding changes
+are made. The release number is bumped when changes are performed or
+things/features are added. The patch number is bumped when the changes are
+mere bugfixes.
 
- It means that after release 1.2.3, we can release 2.0.0 if something really
- big has been made, 1.3.0 if not that big changes were made or 1.2.4 if only
- bugs were fixed.
+It means that after release 1.2.3, we can release 2.0.0 if something really
+big has been made, 1.3.0 if not that big changes were made or 1.2.4 if only
+bugs were fixed.
 
- Bumping, as in increasing the number with 1, is unconditionally only
- affecting one of the numbers (except the ones to the right of it, that may be
- set to zero). 1 becomes 2, 3 becomes 4, 9 becomes 10, 88 becomes 89 and 99
- becomes 100. So, after 1.2.9 comes 1.2.10. After 3.99.3, 3.100.0 might come.
+Bumping, as in increasing the number with 1, is unconditionally only affecting
+one of the numbers (except the ones to the right of it, that may be set to
+zero). 1 becomes 2, 3 becomes 4, 9 becomes 10, 88 becomes 89 and 99
+becomes 100. After 1.2.9 comes 1.2.10. After 3.99.3, 3.100.0 might come.
 
- All original curl source release archives are named according to the libcurl
- version (not according to the curl client version that, as said before, might
- differ).
+All original curl source release archives are named according to the libcurl
+version (not according to the curl client version that, as said before, might
+differ).
 
- As a service to any application that might want to support new libcurl
- features while still being able to build with older versions, all releases
- have the libcurl version stored in the `curl/curlver.h` file using a static
- numbering scheme that can be used for comparison. The version number is
- defined as:
+As a service to any application that might want to support new libcurl
+features while still being able to build with older versions, all releases
+have the libcurl version stored in the `curl/curlver.h` file using a static
+numbering scheme that can be used for comparison. The version number is
+defined as:
 
 ```c
 #define LIBCURL_VERSION_NUM 0xXXYYZZ
 ```
 
- Where `XX`, `YY` and `ZZ` are the main version, release and patch numbers in
- hexadecimal. All three number fields are always represented using two digits
- (eight bits each). 1.2 would appear as "0x010200" while version 9.11.7
- appears as `0x090b07`.
+Where `XX`, `YY` and `ZZ` are the main version, release and patch numbers in
+hexadecimal. All three number fields are always represented using two digits
+(eight bits each). 1.2 would appear as "0x010200" while version 9.11.7
+appears as `0x090b07`.
 
- This 6-digit hexadecimal number is always a greater number in a more recent
- release. It makes comparisons with greater than and less than work.
+This 6-digit hexadecimal number is always a greater number in a more recent
+release. It makes comparisons with greater than and less than work.
 
- This number is also available as three separate defines:
- `LIBCURL_VERSION_MAJOR`, `LIBCURL_VERSION_MINOR` and `LIBCURL_VERSION_PATCH`.
+This number is also available as three separate defines:
+`LIBCURL_VERSION_MAJOR`, `LIBCURL_VERSION_MINOR` and `LIBCURL_VERSION_PATCH`.
+
+## Past releases
+
+This is a list of all public releases with their version numbers and release
+dates. The tool was called `httpget` before 2.0, `urlget` before 4.0 then
+`curl` since 4.0. `libcurl` and `curl` are always released in sync, using the
+same version numbers.
+
+- 8.22.0: pending
+- 8.21.0: June 24 2026
+- 8.20.0: April 29 2026
+- 8.19.0: March 11 2026
+- 8.18.0: January 7 2026
+- 8.17.0: November 5 2025
+- 8.16.0: September 10 2025
+- 8.15.0: July 16 2025
+- 8.14.1: June 4 2025
+- 8.14.0: May 28 2025
+- 8.13.0: April 2 2025
+- 8.12.1: February 13 2025
+- 8.12.0: February 5 2025
+- 8.11.1: December 11 2024
+- 8.11.0: November 6 2024
+- 8.10.1: September 18 2024
+- 8.10.0: September 11 2024
+- 8.9.1: July 31 2024
+- 8.9.0: July 24 2024
+- 8.8.0: May 22 2024
+- 8.7.1: March 27 2024
+- 8.7.0: March 27 2024
+- 8.6.0: January 31 2024
+- 8.5.0: December 6 2023
+- 8.4.0: October 11 2023
+- 8.3.0: September 13 2023
+- 8.2.1: July 26 2023
+- 8.2.0: July 19 2023
+- 8.1.2: May 30 2023
+- 8.1.1: May 23 2023
+- 8.1.0: May 17 2023
+- 8.0.1: March 20 2023
+- 8.0.0: March 20 2023
+- 7.88.1: February 20 2023
+- 7.88.0: February 15 2023
+- 7.87.0: December 21 2022
+- 7.86.0: October 26 2022
+- 7.85.0: August 31 2022
+- 7.84.0: June 27 2022
+- 7.83.1: May 11 2022
+- 7.83.0: April 27 2022
+- 7.82.0: March 5 2022
+- 7.81.0: January 5 2022
+- 7.80.0: November 10 2021
+- 7.79.1: September 22 2021
+- 7.79.0: September 15 2021
+- 7.78.0: July 21 2021
+- 7.77.0: May 26 2021
+- 7.76.1: April 14 2021
+- 7.76.0: March 31 2021
+- 7.75.0: February 3 2021
+- 7.74.0: December 9 2020
+- 7.73.0: October 14 2020
+- 7.72.0: August 19 2020
+- 7.71.1: July 1 2020
+- 7.71.0: June 24 2020
+- 7.70.0: April 29 2020
+- 7.69.1: March 11 2020
+- 7.69.0: March 4 2020
+- 7.68.0: January 8 2020
+- 7.67.0: November 6 2019
+- 7.66.0: September 11 2019
+- 7.65.3: July 19 2019
+- 7.65.2: July 17 2019
+- 7.65.1: June 5 2019
+- 7.65.0: May 22 2019
+- 7.64.1: March 27 2019
+- 7.64.0: February 6 2019
+- 7.63.0: December 12 2018
+- 7.62.0: October 31 2018
+- 7.61.1: September 5 2018
+- 7.61.0: July 11 2018
+- 7.60.0: May 16 2018
+- 7.59.0: March 14 2018
+- 7.58.0: January 24 2018
+- 7.57.0: November 29 2017
+- 7.56.1: October 23 2017
+- 7.56.0: October 4 2017
+- 7.55.1: August 14 2017
+- 7.55.0: August 9 2017
+- 7.54.1: June 14 2017
+- 7.54.0: April 19 2017
+- 7.53.1: February 24 2017
+- 7.53.0: February 22 2017
+- 7.52.1: December 23 2016
+- 7.52.0: December 21 2016
+- 7.51.0: November 2 2016
+- 7.50.3: September 14 2016
+- 7.50.2: September 7 2016
+- 7.50.1: August 3 2016
+- 7.50.0: July 21 2016
+- 7.49.1: May 30 2016
+- 7.49.0: May 18 2016
+- 7.48.0: March 23 2016
+- 7.47.1: February 8 2016
+- 7.47.0: January 27 2016
+- 7.46.0: December 2 2015
+- 7.45.0: October 7 2015
+- 7.44.0: August 12 2015
+- 7.43.0: June 17 2015
+- 7.42.1: April 29 2015
+- 7.42.0: April 22 2015
+- 7.41.0: February 25 2015
+- 7.40.0: January 8 2015
+- 7.39.0: November 5 2014
+- 7.38.0: September 10 2014
+- 7.37.1: July 16 2014
+- 7.37.0: May 21 2014
+- 7.36.0: March 26 2014
+- 7.35.0: January 29 2014
+- 7.34.0: December 17 2013
+- 7.33.0: October 14 2013
+- 7.32.0: August 12 2013
+- 7.31.0: June 22 2013
+- 7.30.0: April 12 2013
+- 7.29.0: February 6 2013
+- 7.28.1: November 20 2012
+- 7.28.0: October 10 2012
+- 7.27.0: July 27 2012
+- 7.26.0: May 24 2012
+- 7.25.0: March 22 2012
+- 7.24.0: January 24 2012
+- 7.23.1: November 17 2011
+- 7.23.0: November 15 2011
+- 7.22.0: September 13 2011
+- 7.21.7: June 23 2011
+- 7.21.6: April 22 2011
+- 7.21.5: April 17 2011
+- 7.21.4: February 17 2011
+- 7.21.3: December 15 2010
+- 7.21.2: October 13 2010
+- 7.21.1: August 11 2010
+- 7.21.0: June 16 2010
+- 7.20.1: April 14 2010
+- 7.20.0: February 9 2010
+- 7.19.7: November 4 2009
+- 7.19.6: August 12 2009
+- 7.19.5: May 18 2009
+- 7.19.4: March 3 2009
+- 7.19.3: January 19 2009
+- 7.19.2: November 13 2008
+- 7.19.1: November 5 2008
+- 7.19.0: September 1 2008
+- 7.18.2: June 4 2008
+- 7.18.1: March 30 2008
+- 7.18.0: January 28 2008
+- 7.17.1: October 29 2007
+- 7.17.0: September 13 2007
+- 7.16.4: July 10 2007
+- 7.16.3: June 25 2007
+- 7.16.2: April 11 2007
+- 7.16.1: January 29 2007
+- 7.16.0: October 30 2006
+- 7.15.5: August 7 2006
+- 7.15.4: June 12 2006
+- 7.15.3: March 20 2006
+- 7.15.2: February 27 2006
+- 7.15.1: December 7 2005
+- 7.15.0: October 13 2005
+- 7.14.1: September 1 2005
+- 7.14.0: May 16 2005
+- 7.13.2: April 4 2005
+- 7.13.1: March 4 2005
+- 7.13.0: February 1 2005
+- 7.12.3: December 20 2004
+- 7.12.2: October 18 2004
+- 7.12.1: August 10 2004
+- 7.12.0: June 2 2004
+- 7.11.2: April 26 2004
+- 7.11.1: March 19 2004
+- 7.11.0: January 22 2004
+- 7.10.8: November 1 2003
+- 7.10.7: August 15 2003
+- 7.10.6: July 28 2003
+- 7.10.5: May 19 2003
+- 7.10.4: April 2 2003
+- 7.10.3: January 14 2003
+- 7.10.2: November 18 2002
+- 7.10.1: October 11 2002
+- 7.10: October 1 2002
+- 7.9.8: June 13 2002
+- 7.9.7: May 10 2002
+- 7.9.6: April 14 2002
+- 7.9.5: March 7 2002
+- 7.9.4: March 4 2002
+- 7.9.3: January 23 2002
+- 7.9.2: December 5 2001
+- 7.9.1: November 4 2001
+- 7.9: September 23 2001
+- 7.8.1: August 20 2001
+- 7.8: June 7 2001
+- 7.7.3: May 4 2001
+- 7.7.2: April 22 2001
+- 7.7.1: April 3 2001
+- 7.7: March 22 2001
+- 7.6.1: February 9 2001
+- 7.6: January 26 2001
+- 7.5.2: January 4 2001
+- 7.5.1: December 11 2000
+- 7.5: December 1 2000
+- 7.4.2: November 15 2000
+- 7.4.1: October 16 2000
+- 7.4: October 16 2000
+- 7.3: September 28 2000
+- 7.2.1: August 31 2000
+- 7.2: August 30 2000
+- 7.1.1: August 21 2000
+- 7.1: August 7 2000
+- 6.5.2: March 21 2000
+- 6.5.1: March 20 2000
+- 6.5: March 13 2000
+- 6.4: January 17 2000
+- 6.3.1: November 23 1999
+- 6.3: November 10 1999
+- 6.2: October 21 1999
+- 6.1: October 17 1999
+- 6.0: September 13 1999
+- 5.11: August 25 1999
+- 5.10: August 13 1999
+- 5.9.1: July 30 1999
+- 5.9: May 22 1999
+- 5.8: May 5 1999
+- 5.7.1: April 23 1999
+- 5.7: April 20 1999
+- 5.5.1: January 27 1999
+- 5.5: January 15 1999
+- 5.4: January 7 1999
+- 5.3: December 21 1998
+- 5.2.1: December 14 1998
+- 5.2: December 14 1998
+- 5.0: December 1 1998
+- 4.10: October 26 1998
+- 4.9: October 7 1998
+- 4.8.4: September 20 1998
+- 4.8.3: September 7 1998
+- 4.8.2: August 14 1998
+- 4.8.1: August 7 1998
+- 4.8: July 30 1998
+- 4.7: July 20 1998
+- 4.6: July 3 1998
+- 4.5.1: June 12 1998
+- 4.5: May 30 1998
+- 4.4: May 13 1998
+- 4.3: April 30 1998
+- 4.2: April 15 1998
+- 4.1: April 3 1998
+- 4.0: March 20 1998
+- 3.12: March 14 1998
+- 3.11: February 9 1998
+- 3.10: February 4 1998
+- 3.9: February 4 1998
+- 3.7: January 15 1998
+- 3.6: January 1 1998
+- 3.5: December 15 1997
+- 3.2: December 1 1997
+- 3.1: November 24 1997
+- 3.0: November 1 1997
+- 2.9: October 15 1997
+- 2.8: October 1 1997
+- 2.7: September 20 1997
+- 2.6: September 10 1997
+- 2.5: September 1 1997
+- 2.4: August 27 1997
+- 2.3: August 21 1997
+- 2.2: August 14 1997
+- 2.1: August 10 1997
+- 2.0: August 1 1997
+- 1.5: July 21 1997
+- 1.4: July 15 1997
+- 1.3: June 1 1997
+- 1.2: May 1 1997
+- 1.1: April 20 1997
+- 1.0: April 8 1997
+- 0.3: February 1 1997
+- 0.2: December 17 1996
+- 0.1: November 11 1996
diff --git a/third-party/curl/docs/VULN-DISCLOSURE-POLICY.md b/third-party/curl/docs/VULN-DISCLOSURE-POLICY.md
new file mode 100644
index 0000000000..a115ee1716
--- /dev/null
+++ b/third-party/curl/docs/VULN-DISCLOSURE-POLICY.md
@@ -0,0 +1,484 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# curl vulnerability disclosure policy
+
+This document describes how security vulnerabilities are handled in the curl
+project.
+
+There is no bug bounty and the curl project never offers rewards for reported
+vulnerabilities.
+
+## Publishing Information
+
+All known and public curl or libcurl related vulnerabilities are listed on
+[the curl website security page](https://curl.se/docs/security.html).
+
+Security vulnerabilities **should not** be entered in the project's public bug
+tracker.
+
+## Vulnerability Handling
+
+The typical process for handling a new security vulnerability is as follows.
+
+No information should be made public about a vulnerability until it is
+formally announced at the end of this process. That means, for example, that a
+bug tracker entry must NOT be created to track the issue since that makes the
+issue public and it should not be discussed on any of the project's public
+mailing lists. Messages associated with any commits should not make any
+reference to the security nature of the commit if done prior to the public
+announcement.
+
+- The person discovering the issue, the reporter, reports the vulnerability on
+  [HackerOne](https://hackerone.com/curl). Issues filed there reach a handful
+  of selected and trusted people.
+
+- When communicating in the curl project, please explain your issues or
+  improvements briefly and clearly in your own human voice. Do not lazily
+  paste massive, AI-generated explanations; as a contributor doing this
+  infrequently, it is your responsibility to invest a few extra minutes into
+  making your message digestible. The maintainers review submissions
+  constantly, and clear writing reduces their daily burden and friction.
+
+- The curl project cannot handle vulnerability reports sent to us over email.
+  We lose track of the reports. We cannot easily disclose them. Please do not
+  send us reports over email.
+
+- Messages that do not relate to the reporting or managing of an undisclosed
+  security vulnerability in curl or libcurl are ignored and no further action
+  is required.
+
+- A person in the security team responds to the original report to acknowledge
+  that a human has seen the report.
+
+- The security team investigates the report and either rejects it or accepts
+  it. See below for examples of problems that are not considered
+  vulnerabilities.
+
+- If the report is rejected, the team writes to the reporter to explain why.
+
+- If the report is accepted, the team writes to the reporter to let them
+  know it is accepted and that they are working on a fix.
+
+- The security team discusses the problem, works out a fix, considers the
+  impact of the problem and suggests a release schedule. This discussion
+  should involve the reporter as much as possible.
+
+- The release of the information should be "as soon as possible" and is most
+  often synchronized with an upcoming release that contains the fix. If the
+  reporter, or anyone else involved, thinks the next planned release is too
+  far away, then a separate earlier release should be considered.
+
+- Write a security advisory draft about the problem that explains what the
+  problem is, its impact, which versions it affects, solutions or workarounds,
+  when the release is out and make sure to credit all contributors properly.
+  Figure out the CWE (Common Weakness Enumeration) number for the flaw. See
+  [SECURITY-ADVISORY](https://curl.se/dev/advisory.html) for help on creating
+  the advisory.
+
+- Request a CVE Id for the issue. curl is a CNA (CVE Numbering Authority) and
+  can request its own numbers.
+
+- Update the "security advisory" with the CVE number.
+
+- The security team commits the fix in a private branch. The commit message
+  should ideally contain the CVE number. If the severity level of the issue is
+  set to Low or Medium, the fix is allowed to get merged into the master
+  repository via a normal PR - but without mentioning it being a security
+  vulnerability.
+
+- No more than seven days before release, inform
+  [distros@openwall](https://oss-security.openwall.org/wiki/mailing-lists/distros)
+  to prepare them about the upcoming public security vulnerability
+  announcement - attach the advisory draft for information with CVE and
+  current patch. 'distros' does not accept an embargo longer than 7 days and
+  they do not care for Windows-specific flaws.
+
+- No more than 48 hours before the release, the private branch is merged into
+  the master branch and pushed. Once pushed, the information is accessible to
+  the public and the actual release should follow suit immediately afterwards.
+  The time between the push and the release is used for final tests and
+  reviews.
+
+- The project team creates a release that includes the fix.
+
+- The project team announces the release and the vulnerability to the world in
+  the same manner we always announce releases. It gets sent to the
+  curl-announce, curl-library and curl-users mailing lists.
+
+- The security webpage on the website should get the new vulnerability
+  mentioned.
+
+## security (at curl dot se)
+
+This is a private mailing list for discussions on and about curl security
+issues.
+
+Who is on this list? There are a couple of criteria you must meet, and then we
+might ask you to join the list or you can ask to join it. It really is not a
+formal process. We only require that you have a long-term presence in the curl
+project and you have shown an understanding for the project and its way of
+working. You must have been around for a good while and you should have no
+plans of vanishing in the near future.
+
+We do not make the list of participants public mostly because it tends to vary
+somewhat over time and a list somewhere only risks getting outdated.
+
+## Publishing Security Advisories
+
+1. Write up the security advisory, using markdown syntax. Use the same
+   subtitles as last time to maintain consistency.
+
+2. Name the advisory file after the allocated CVE id.
+
+3. Add a line on the top of the array in `curl-www/docs/vuln.pm`.
+
+4. Put the new advisory markdown file in the `curl-www/docs/` directory. Add it
+   to the git repository.
+
+5. Run `make` in your local web checkout and verify that things look fine.
+
+6. On security advisory release day, push the changes on the curl-www
+   repository's remote master branch.
+
+## Disclose the report
+
+Request the issue to be disclosed. If there are sensitive details present in
+the report and discussion, those should be redacted from the disclosure. The
+default policy is to disclose as much as possible as soon as the vulnerability
+has been published.
+
+*All* reports submitted to the project, valid or not, should be disclosed and
+made public.
+
+# Severity levels
+
+The curl project's security team rates security problems using four severity
+levels depending on how serious we consider the problem to be. We use **Low**,
+**Medium**, **High** and **Critical**. We refrain from using numerical scoring
+of vulnerabilities.
+
+We do not support CVSS as a method to grade security vulnerabilities, so we do
+not set them for CVE records published by the curl project. We believe CVSS is
+a broken system that often does not properly evaluate to suitable severity
+levels that reflect all dimensions and factors involved. Other organizations
+however set and provide CVSS scores for curl vulnerabilities. You need to
+decide for yourself if you believe they know enough about the subjects
+involved to make reasonable assessments. Deciding between four different
+severity levels is hard enough for us.
+
+When deciding severity level on a particular issue, we take all the factors
+into account: attack vector, attack complexity, required privileges, necessary
+build configuration, protocols involved, platform specifics and also what
+effects a possible exploit or trigger of the issue can lead to, including
+confidentiality, integrity or availability problems.
+
+## Low
+
+This is a security problem that is truly hard or unlikely to exploit or
+trigger. Due to timing, platform requirements or the fact that options or
+protocols involved are rare etc. [Past
+example](https://curl.se/docs/CVE-2022-43552.html)
+
+## Medium
+
+This is a security problem that is less hard than **Low** to exploit or
+trigger. Less strict timing, wider platform availability or involving more
+widely used options or protocols. A problem that usually needs something else
+to also happen to become serious. [Past
+example](https://curl.se/docs/CVE-2022-32206.html)
+
+## High
+
+This issue is in itself a serious problem with real world impact. Flaws that
+can easily compromise the confidentiality, integrity or availability of
+resources. Exploiting or triggering this problem is not hard. [Past
+example](https://curl.se/docs/CVE-2019-3822.html)
+
+## Critical
+
+Easily exploitable by a remote unauthenticated attacker and lead to system
+compromise (arbitrary code execution) without requiring user interaction, with
+a common configuration on a popular platform. This issue has few restrictions
+and requirements and can be exploited easily using most curl configurations.
+[Past example](https://curl.se/docs/CVE-2000-0973.html)
+
+# Not security issues
+
+This is an incomplete list of issues that are not considered vulnerabilities.
+
+## Small memory leaks
+
+We do not consider a small memory leak a security problem; even if the amount
+of allocated memory grows by a small amount every now and then. Long-living
+applications and services already need to have countermeasures and deal with
+growing memory usage, be it leaks or increased use. A small memory or resource
+leak is then expected to *not* cause a security problem.
+
+Of course there can be a discussion if a leak is small or not. A large leak
+can be considered a security problem due to the DOS risk. If leaked memory
+contains sensitive data it might also qualify as a security problem.
+
+## Never-ending transfers
+
+We do not consider flaws that cause a transfer to never end to be a security
+problem. There are already several benign and likely reasons for transfers to
+stall and never end, so applications that cannot deal with never-ending
+transfers already need to have counter-measures established.
+
+Well-known attacks, like
+[Slowloris](https://en.wikipedia.org/wiki/Slowloris_(cyber_attack)), that send
+partial requests are usually not considered a flaw. If the problem bypasses
+the regular counter-measures and it causes a never-ending transfer, it might
+be a security problem.
+
+## Not practically possible
+
+If the flaw or vulnerability cannot practically get executed on existing
+hardware it is not a security problem.
+
+## API misuse
+
+If a reported issue only triggers by an application using the API in a way
+that is not documented to work or even documented to not work, it is probably
+not going to be considered a security problem. We only guarantee secure and
+proper functionality when the APIs are used as expected and documented.
+
+There can be a discussion about what the documentation actually means and how
+to interpret the text, which might end up with us still agreeing that it is a
+security problem.
+
+## Local attackers already present
+
+When an issue can only be attacked or misused by an attacker present on the
+local system or network, the bar is raised. If a local user wrongfully has
+elevated rights on your system enough to attack curl, they can probably
+already do much worse harm and the problem is not really in curl.
+
+## Debug & Experiments
+
+Vulnerabilities in features which are off by default (in the build) and
+documented as experimental, or exist only in debug mode, are not considered
+security problems.
+
+The same applies to scripts and software which are not installed by default
+through the make install rule.
+
+## Test code
+
+curl has an extensive test suite with lots of code written specifically to
+exercise and verify curl, libcurl and specific internal functions. The test
+code and its associated test servers are *not* intended for production use.
+They are not secure, you should not assume otherwise and must not report about
+security problems in those.
+
+## URL inconsistencies
+
+URL parser inconsistencies between browsers and curl are expected and are not
+considered security vulnerabilities. The WHATWG URL Specification and RFC
+3986+ (the plus meaning that it is an extended version) [are not completely
+interoperable](https://github.com/bagder/docs/blob/master/URL-interop.md).
+
+Obvious parser bugs can still be vulnerabilities of course.
+
+## Visible command line arguments
+
+The curl command blanks the contents of a number of command line arguments to
+prevent them from appearing in process listings. It does not blank all
+arguments, even though some that are not blanked might contain sensitive
+data. We consider this functionality a best-effort and omissions are not
+security vulnerabilities.
+
+- not all systems allow the arguments to be blanked in the first place
+- since curl blanks the argument itself they are readable for a short moment
+  no matter what
+- virtually every argument can contain sensitive data, depending on use
+- blanking all arguments would make it impractical for users to differentiate
+  curl command lines in process listings
+
+## Busy-loops
+
+Busy-loops that consume 100% CPU time but eventually end (perhaps due to a set
+timeout value or otherwise) are not considered security problems. Applications
+are supposed to already handle situations when the transfer loop legitimately
+consumes 100% CPU time, so while a prolonged such busy-loop is a nasty bug, we
+do not consider it a security problem.
+
+## Saving files
+
+curl cannot protect against attacks where an attacker has write access to the
+same directory where curl is directed to save files.
+
+## Tricking a user to run a command line
+
+A creative, misleading or funny looking command line is not a security
+problem. The curl command line tool takes options and URLs on the command line
+and if an attacker can trick the user to run a specifically crafted curl
+command line, all bets are off. Such an attacker can already have the user run
+a much worse command that can do something fatal (like `sudo rm -rf /`).
+
+## Terminal output and escape sequences
+
+Content that is transferred from a server and gets displayed in a terminal by
+curl may contain escape sequences or use other tricks to fool the user. This
+is curl working as designed and is not a curl security problem. Escape
+sequences, moving cursor, changing color etc, is also frequently used for
+good. To reduce the risk of getting fooled, save files and browse them after
+download using a display method that minimizes risks.
+
+## NULL dereferences and crashes
+
+If a malicious server can trigger a NULL dereference in curl or otherwise
+cause curl to crash (and nothing worse), chances are big that we do not
+consider that a security problem.
+
+Malicious servers can already cause considerable harm and denial of service
+like scenarios without having to trigger such code paths. For example by
+stalling, being terribly slow or by delivering enormous amounts of data.
+Additionally, applications are expected to handle "normal" crashes without
+that being the end of the world.
+
+There need to be more and special circumstances to treat such problems as
+security issues.
+
+## Legacy dependencies
+
+Problems that can be triggered only by the use of a *legacy dependency* are
+not considered security problems.
+
+A *legacy dependency* is here defined as:
+
+- the legacy version was released over ten years ago AND
+
+- the legacy version is no longer in use by any existing still supported
+  operating system or distribution AND
+
+- there are modern versions of equivalent or better functionality offered and
+  in common use
+
+## weak algorithms required for functionality
+
+curl supports several algorithms that are considered weak, like DES and MD5.
+These algorithms are still not curl security vulnerabilities or security
+problems as they are only used when the users explicitly ask for their use by
+using the protocols or options that require the use of those algorithms.
+
+When servers upgrade to use secure alternatives, curl users should use those
+options/protocols.
+
+## CRLF in data
+
+curl makes barely any claims of *cleaning* input or rejecting invalid data. A
+user that uses a curl feature can send in *creative* sequences that include
+carriage-return (CR) or line-feed (LF) characters.
+
+Therefore, we reject the idea of *CRLF injection* as a security problem. It is
+a *feature* that users can send creative byte sequences. If users do not want
+to send such octets, they are in control and should avoid sending such bytes
+to curl.
+
+For example, a user might pass in a username that looks like
+`Mr[CR][LF]Smith`. It may cause some minor havoc in the protocol handling,
+depending on what protocol is used.
+
+## Non-released code
+
+Only curl releases are ever considered *secure*. Between releases, we are
+under development and then we may have code present in the git repository that
+is insecure, but without those flaws being considered as vulnerabilities.
+Another reason we strongly suggest you only use curl release versions in
+production.
+
+Unreleased code may also contain fixes to problems that were present in the
+most recent release.
+
+# curl major incident response
+
+Vulnerability disclosure manages the full life cycle of a vulnerability
+affecting curl - where the **curl-security** team privately engages with
+reporters coordinating on embargo and eventual release of security fixes.
+
+For most vulnerabilities (even critical vulnerabilities) this is the
+normal _'mode'_ of incident response.
+
+A **major incident** is defined as something that has much larger scope and
+impact on users and developers of curl.
+
+A major incident usually encompasses one or more of the following:
+* broad and deep impact on developers, distros and users
+* high visibility
+* remote code execution
+* exploit readily available
+* critical curl infrastructure compromised
+* time sensitive
+* premature disclosure (e.g. embargo broken)
+
+A major incident is declared only when it is deemed that the normal
+vulnerability disclosure process is not sufficient.
+
+The curl **major incident** process is as follows:
+
+## Major incident begins
+
+Only a member of the **curl-security** team can declare a **major incident**
+via any or all of the following communication channels:
+
+* **irc**: channel #curl on the network [Libera.Chat](https://libera.chat/)
+* **mailing-lists**:
+  * curl-announce
+  * curl-users
+  * curl-distros
+* **website**: [curl.se](https://curl.se/)
+
+This declaration may also be transmitted via other channels, though the
+above are considered official channels.
+
+The veracity of such a communication can be verified by consulting two
+or more **curl-security** team members.
+
+This announcement nominates, from **curl-security** team, the following
+roles:
+
+* **incident lead** - Coordinates technical efforts
+* **communication lead** - Single point of public contact
+
+It is likely that our
+[BDFL](https://en.wikipedia.org/wiki/Benevolent_dictator_for_life) occupies
+one of these roles, though this plan does not depend on it.
+
+A declaration may also contain more detailed information but as we honor
+embargoes and vulnerability disclosure throughout this process, it may also
+contain a brief notification that a **major incident** is occurring.
+
+## Major incident ongoing
+
+During the incident - all press, media, legal or commercial entities should
+contact communication lead (security@curl.se).
+
+Existing **curl-security** team internal communication channels are used
+for all internal communication.
+
+Existing vulnerability disclosure process are followed for any embargoes
+and fixes.
+
+Where possible, public communications are provided:
+* regular communication from communication lead (for example daily update)
+* asynchronous communication from incident lead
+
+* Delivered to the aforementioned curl communication channels.
+
+A log is kept of all external and internal communication.
+
+Once fixes have been released we may provide a more detailed postmortem and
+overall timeline of events.
+
+## Major incident ends
+
+Both the incident and communication leads declare when a **major incident**
+has finished.
+
+Any notices are removed and a return to normal vulnerability disclosure
+process.
diff --git a/third-party/curl/docs/cmdline-opts/.gitignore b/third-party/curl/docs/cmdline-opts/.gitignore
new file mode 100644
index 0000000000..8d42e2c53d
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/.gitignore
@@ -0,0 +1,5 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+curl.txt
diff --git a/third-party/curl/docs/cmdline-opts/CMakeLists.txt b/third-party/curl/docs/cmdline-opts/CMakeLists.txt
index 3dd8be49b1..83949969ae 100644
--- a/third-party/curl/docs/cmdline-opts/CMakeLists.txt
+++ b/third-party/curl/docs/cmdline-opts/CMakeLists.txt
@@ -21,15 +21,38 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-set(MANPAGE "${CURL_BINARY_DIR}/docs/curl.1")
-
-# Load DPAGES and OTHERPAGES from shared file
-transform_makefile_inc("Makefile.inc" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
+# Get SUPPORT, DPAGES variables
+curl_transform_makefile_inc("Makefile.inc" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
 include("${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
 
-add_custom_command(OUTPUT "${MANPAGE}"
-  COMMAND "${PERL_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/gen.pl" mainpage "${CMAKE_CURRENT_SOURCE_DIR}" > "${MANPAGE}"
-  DEPENDS ${DPAGES} ${OTHERPAGES}
+add_custom_command(OUTPUT "${CURL_MANPAGE}" "${CURL_ASCIIPAGE}"
+  WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+  COMMAND "${PERL_EXECUTABLE}" "${PROJECT_SOURCE_DIR}/scripts/managen" mainpage ${DPAGES} > "${CURL_MANPAGE}"
+  COMMAND "${PERL_EXECUTABLE}" "${PROJECT_SOURCE_DIR}/scripts/managen" ascii ${DPAGES} > "${CURL_ASCIIPAGE}"
+  DEPENDS "${PROJECT_SOURCE_DIR}/scripts/managen" ${DPAGES} ${SUPPORT}
+    "${CMAKE_CURRENT_SOURCE_DIR}/Makefile.inc"
+    "${CMAKE_CURRENT_SOURCE_DIR}/mainpage.idx"
   VERBATIM
 )
-add_custom_target(generate-curl.1 DEPENDS "${MANPAGE}")
+
+add_custom_target(generate-curl.1 ALL DEPENDS "${CURL_MANPAGE}")
+
+if(NOT CURL_DISABLE_INSTALL)
+  install(FILES "${CURL_MANPAGE}" DESTINATION "${CMAKE_INSTALL_MANDIR}/man1")
+endif()
+
+if(PERL_EXECUTABLE)
+  add_custom_target(curl-listhelp
+    WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+    COMMENT "Generating src/tool_listhelp.c" VERBATIM USES_TERMINAL
+    COMMAND "${PERL_EXECUTABLE}" "${PROJECT_SOURCE_DIR}/scripts/managen" -d "${CMAKE_CURRENT_SOURCE_DIR}" listhelp ${DPAGES}
+      > "${PROJECT_SOURCE_DIR}/src/tool_listhelp.c"
+    DEPENDS "${PROJECT_SOURCE_DIR}/scripts/managen" ${DPAGES}
+  )
+  add_custom_target(curl-listcats
+    WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+    COMMENT "Generating help category constants for src/tool_help.h" VERBATIM USES_TERMINAL
+    COMMAND "${PERL_EXECUTABLE}" "${PROJECT_SOURCE_DIR}/scripts/managen" listcats ${DPAGES}
+    DEPENDS "${PROJECT_SOURCE_DIR}/scripts/managen" ${DPAGES}
+  )
+endif()
diff --git a/third-party/curl/docs/cmdline-opts/MANPAGE.md b/third-party/curl/docs/cmdline-opts/MANPAGE.md
index 6de32dab94..1e4facd954 100644
--- a/third-party/curl/docs/cmdline-opts/MANPAGE.md
+++ b/third-party/curl/docs/cmdline-opts/MANPAGE.md
@@ -6,37 +6,53 @@
 
 # curl man page generator
 
-This is the curl man page generator. It generates a single nroff man page
+`managen` is the curl man page generator. It generates a single nroff man page
 output from the set of sources files in this directory.
 
-There is one source file for each supported command line option. The output
-gets `page-header` prepended and `page-footer` appended. The format is
-described below.
+The `mainpage.idx` file lists all files that are rendered in that order to
+produce the output. The special `%options` keyword inserts all command line
+options documented.
+
+The `%options` documentation is created with one source file for each
+supported command line option.
+
+The documentation file format is described below. It is meant to look similar
+to markdown which is why it uses `.md` file extensions.
 
 ## Option files
 
 Each command line option is described in a file named `<long name>.d`, where
-option name is written without any prefixing dashes. Like the file name for
-the -v, --verbose option is named `verbose.d`.
+option name is written without any prefixing dashes. Like the filename for the
+`-v, --verbose` option is named `verbose.d`.
 
-Each file has a set of meta-data and a body of text.
+Each file has a set of meta-data in the top of the file, followed by a body of
+text.
+
+The documentation files that do not document options have no meta-data part.
+
+A line that starts with `<!--` is a comment. It should also end with `-->`.
 
 ### Meta-data
 
+    --- (start of meta-data)
     Added: (version number in which this was added)
     Arg: (the argument the option takes)
     c: (copyright line)
-    Example: (example command line, without "curl" and can use `$URL`)
+    Example:
+      - (an example command line, without "curl" and can use `$URL`)
+      - (another example)
     Experimental: yes (if so)
     Help: (short text for the --help output for this option)
     Long: (long form name, without dashes)
     Magic: (description of "magic" options)
-    Multi: single/append/boolean/mutex/custom (if used more than once)
+    Multi: single/append/boolean/mutex/custom/per-URL (if used more than once)
     Mutexed: (space separated list of options this overrides, no dashes)
     Protocols: (space separated list for which protocols this option works)
     Requires: (space separated list of features this requires, no dashes)
     Scope: global (if the option is global)
-    See-also: (space separated list of related options, no dashes)
+    See-also:
+      - (a related option, no dashes)
+      - (another related option, no dashes)
     Short: (single letter, without dash)
     SPDX-License-Identifier: curl
     Tags: (space separated list)
@@ -54,20 +70,97 @@ Text written within `*asterisks*` is shown using italics. Text within two
 Text that is prefixed with a space is treated like an "example" and gets
 output in monospace.
 
-## Header and footer
+Within the body, describe a list of items like this:
 
-`page-header` is the file that is output before the generated options output
-for the master man page.
+    ## item 1
+    description
 
-`page-footer` is appended after all the individual options.
+    ## item 2
+    second description
+
+The list is automatically terminated at end of file, or you can do it
+explicitly with an empty "header":
+
+    ##
+
+Angle brackets (`<>`) need to be escaped when used in text like `\<` and
+`\>`. This, to ensure that the text renders nicely as markdown.
+
+### Headers
+
+The `#` header can be used by non-option files and it produces a
+`.SH` output.
+
+If the `#` header is used for a command line option file, that header is
+ignored in the generated output. It can still serve a purpose in the
+source file as it helps the user identify what option the file is for.
+
+### Variables
+
+There are three different "variables" that can be used when creating the
+output. They need to be written within backticks in the source file (to escape
+getting spellchecked by CI jobs): `%DATE`, `%VERSION` and `%GLOBALS`.
+
+During rendering, the generator expands them as follows:
+
+- `%VERSION` -- replaced with the curl version string read from
+  `include/curl/curlver.h` (e.g. `8.12.0`). Can be overridden by setting
+  the `CURL_MAKETGZ_VERSION` environment variable.
+- `%DATE` -- replaced with the current date in `YYYY-MM-DD` format, or
+  the date derived from `SOURCE_DATE_EPOCH` if that environment variable
+  is set (for reproducible builds).
+- `%GLOBALS` -- replaced with a comma-separated list of all command line
+  options that have `Scope: global` in their meta-data.
 
 ## Generate
 
-`./gen.pl mainpage`
+`managen mainpage [list of markdown option file names]`
 
 This command outputs a single huge nroff file, meant to become `curl.1`. The
 full curl man page.
 
-`./gen.pl listhelp`
+`managen ascii [list of markdown option file names]`
+
+This command outputs a single text file, meant to become `curl.txt`. The full
+curl man page in text format, used to build `tool_hugehelp.c`.
+
+`managen listhelp`
 
 Generates a full `curl --help` output for all known command line options.
+
+## Generating the man page
+
+The `curl.1` man page is generated from the source files in this directory
+using the `managen` Perl script located in `scripts/managen`. The build
+system runs this automatically, but it can also be invoked manually.
+
+### Prerequisites
+
+The generator requires Perl. The version string is read from
+`include/curl/curlver.h` (or from the `CURL_MAKETGZ_VERSION` environment
+variable if set). The date defaults to the current date unless
+`SOURCE_DATE_EPOCH` is set.
+
+### Manual invocation
+
+From the `docs/cmdline-opts` directory, run:
+
+    cd docs/cmdline-opts
+    perl ../../scripts/managen -I ../../include mainpage ./*.md > curl.1
+
+This produces the complete `curl.1` nroff man page. To produce a plain-text
+version instead, replace `mainpage` with `ascii`:
+
+    perl ../../scripts/managen -I ../../include ascii ./*.md > curl.txt
+
+The `-d` flag specifies the directory containing `mainpage.idx` and the
+`.md` option files. The `-I` flag specifies the include directory root
+used to locate `curl/curlver.h` for the version string.
+
+### How it works
+
+The generator reads `mainpage.idx`, which lists the documentation source
+files in their intended order. Each line names one `.md` file to render.
+When the generator encounters the `%options` keyword in `mainpage.idx`,
+it inserts the documentation for every command line option (one `.md` file
+per option), sorted alphabetically by long option name.
diff --git a/third-party/curl/docs/cmdline-opts/Makefile.am b/third-party/curl/docs/cmdline-opts/Makefile.am
index 5a8996bc22..019dd57b8a 100644
--- a/third-party/curl/docs/cmdline-opts/Makefile.am
+++ b/third-party/curl/docs/cmdline-opts/Makefile.am
@@ -24,18 +24,41 @@
 
 AUTOMAKE_OPTIONS = foreign no-dependencies
 
-MANPAGE = $(top_builddir)/docs/curl.1
+MANPAGE = curl.1
+ASCIIPAGE = curl.txt
 
+# Get SUPPORT, DPAGES variables
 include Makefile.inc
 
-EXTRA_DIST = $(DPAGES) MANPAGE.md gen.pl $(OTHERPAGES) CMakeLists.txt
+EXTRA_DIST = $(DPAGES) MANPAGE.md $(SUPPORT) CMakeLists.txt mainpage.idx
 
 GEN = $(GN_$(V))
 GN_0 = @echo "  GENERATE" $@;
 GN_1 =
 GN_ = $(GN_0)
 
-all: $(MANPAGE)
+MANAGEN=$(top_srcdir)/scripts/managen
+MAXLINE=$(top_srcdir)/scripts/maxline
 
-$(MANPAGE): $(DPAGES) $(OTHERPAGES) Makefile.inc gen.pl
-	$(GEN)(rm -f $(MANPAGE) && cd $(srcdir) && @PERL@ ./gen.pl mainpage $(DPAGES) > $(builddir)/manpage.tmp && mv $(builddir)/manpage.tmp $(MANPAGE))
+# Maximum number of columns accepted in the ASCII version of the man page
+INCDIR=$(top_srcdir)/include
+
+if BUILD_DOCS
+CLEANFILES = $(MANPAGE) $(ASCIIPAGE)
+man_MANS = $(MANPAGE)
+
+all: $(MANPAGE) $(ASCIIPAGE)
+
+endif
+
+$(MANPAGE): $(DPAGES) $(SUPPORT) mainpage.idx Makefile.inc $(MANAGEN)
+	$(GEN)(rm -f $(MANPAGE) && @PERL@ $(MANAGEN) -d $(srcdir) -I $(INCDIR) mainpage $(DPAGES) > manpage.tmp.$$$$ && mv manpage.tmp.$$$$ $(MANPAGE))
+
+$(ASCIIPAGE): $(DPAGES) $(SUPPORT) mainpage.idx Makefile.inc $(MANAGEN)
+	$(GEN)(rm -f $(ASCIIPAGE) && @PERL@ $(MANAGEN) -d $(srcdir) -I $(INCDIR) ascii $(DPAGES) > asciipage.tmp.$$$$ && mv asciipage.tmp.$$$$ $(ASCIIPAGE))
+
+listhelp:
+	$(MANAGEN) -d $(srcdir) listhelp $(DPAGES) > $(top_builddir)/src/tool_listhelp.c
+
+listcats:
+	@$(MANAGEN) listcats $(DPAGES)
diff --git a/third-party/curl/docs/cmdline-opts/Makefile.inc b/third-party/curl/docs/cmdline-opts/Makefile.inc
index fa4cbe59f0..f8fd01ccd6 100644
--- a/third-party/curl/docs/cmdline-opts/Makefile.inc
+++ b/third-party/curl/docs/cmdline-opts/Makefile.inc
@@ -21,265 +21,301 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Shared between Makefile.am and CMakeLists.txt
+# Shared between CMakeLists.txt and Makefile.am
+
+SUPPORT = \
+  _AUTHORS.md \
+  _BUGS.md \
+  _DESCRIPTION.md \
+  _ENVIRONMENT.md \
+  _EXITCODES.md \
+  _FILES.md \
+  _GLOBBING.md \
+  _NAME.md \
+  _OPTIONS.md \
+  _OUTPUT.md \
+  _PROGRESS.md \
+  _PROTOCOLS.md \
+  _PROXYPREFIX.md \
+  _SEEALSO.md \
+  _SYNOPSIS.md \
+  _URL.md \
+  _VARIABLES.md \
+  _VERSION.md \
+  _WWW.md
 
 DPAGES = \
-  abstract-unix-socket.d \
-  alt-svc.d \
-  anyauth.d \
-  append.d \
-  aws-sigv4.d \
-  basic.d \
-  ca-native.d \
-  cacert.d \
-  capath.d \
-  cert-status.d \
-  cert-type.d \
-  cert.d \
-  ciphers.d \
-  compressed-ssh.d \
-  compressed.d \
-  config.d \
-  connect-timeout.d \
-  connect-to.d \
-  continue-at.d \
-  cookie-jar.d \
-  cookie.d \
-  create-dirs.d \
-  create-file-mode.d \
-  crlf.d \
-  crlfile.d \
-  curves.d \
-  data-ascii.d \
-  data-binary.d \
-  data-raw.d \
-  data-urlencode.d \
-  data.d \
-  delegation.d \
-  digest.d \
-  disable-eprt.d \
-  disable-epsv.d \
-  disable.d \
-  disallow-username-in-url.d \
-  dns-interface.d \
-  dns-ipv4-addr.d \
-  dns-ipv6-addr.d \
-  dns-servers.d \
-  doh-cert-status.d \
-  doh-insecure.d \
-  doh-url.d \
-  dump-header.d \
-  egd-file.d \
-  engine.d \
-  etag-compare.d \
-  etag-save.d \
-  expect100-timeout.d \
-  fail-early.d \
-  fail-with-body.d \
-  fail.d \
-  false-start.d \
-  form-escape.d \
-  form-string.d \
-  form.d \
-  ftp-account.d \
-  ftp-alternative-to-user.d \
-  ftp-create-dirs.d \
-  ftp-method.d \
-  ftp-pasv.d \
-  ftp-port.d \
-  ftp-pret.d \
-  ftp-skip-pasv-ip.d \
-  ftp-ssl-ccc-mode.d \
-  ftp-ssl-ccc.d \
-  ftp-ssl-control.d \
-  get.d \
-  globoff.d \
-  happy-eyeballs-timeout-ms.d \
-  haproxy-protocol.d \
-  haproxy-clientip.d \
-  head.d \
-  header.d \
-  help.d \
-  hostpubmd5.d \
-  hostpubsha256.d \
-  hsts.d \
-  http0.9.d \
-  http1.0.d \
-  http1.1.d \
-  http2-prior-knowledge.d \
-  http2.d \
-  http3.d \
-  http3-only.d \
-  ignore-content-length.d \
-  include.d \
-  insecure.d \
-  interface.d \
-  ipv4.d \
-  ipv6.d \
-  json.d \
-  junk-session-cookies.d \
-  keepalive-time.d \
-  key-type.d \
-  key.d \
-  krb.d \
-  libcurl.d \
-  limit-rate.d \
-  list-only.d \
-  local-port.d \
-  location-trusted.d \
-  location.d \
-  login-options.d \
-  mail-auth.d \
-  mail-from.d \
-  mail-rcpt-allowfails.d \
-  mail-rcpt.d \
-  manual.d \
-  max-filesize.d \
-  max-redirs.d \
-  max-time.d \
-  metalink.d \
-  negotiate.d \
-  netrc-file.d \
-  netrc-optional.d \
-  netrc.d \
-  next.d \
-  no-alpn.d \
-  no-buffer.d \
-  no-clobber.d \
-  no-keepalive.d \
-  no-npn.d \
-  no-progress-meter.d \
-  no-sessionid.d \
-  noproxy.d \
-  ntlm-wb.d \
-  ntlm.d \
-  oauth2-bearer.d \
-  output-dir.d \
-  output.d \
-  parallel-immediate.d \
-  parallel-max.d \
-  parallel.d \
-  pass.d \
-  path-as-is.d \
-  pinnedpubkey.d \
-  post301.d \
-  post302.d \
-  post303.d \
-  preproxy.d \
-  progress-bar.d \
-  proto-default.d \
-  proto-redir.d \
-  proto.d \
-  proxy-anyauth.d \
-  proxy-basic.d \
-  proxy-ca-native.d \
-  proxy-cacert.d \
-  proxy-capath.d \
-  proxy-cert-type.d \
-  proxy-cert.d \
-  proxy-ciphers.d \
-  proxy-crlfile.d \
-  proxy-digest.d \
-  proxy-header.d \
-  proxy-http2.d \
-  proxy-insecure.d \
-  proxy-key-type.d \
-  proxy-key.d \
-  proxy-negotiate.d \
-  proxy-ntlm.d \
-  proxy-pass.d \
-  proxy-pinnedpubkey.d \
-  proxy-service-name.d \
-  proxy-ssl-allow-beast.d \
-  proxy-ssl-auto-client-cert.d \
-  proxy-tls13-ciphers.d \
-  proxy-tlsauthtype.d \
-  proxy-tlspassword.d \
-  proxy-tlsuser.d \
-  proxy-tlsv1.d \
-  proxy-user.d \
-  proxy.d \
-  proxy1.0.d \
-  proxytunnel.d \
-  pubkey.d \
-  quote.d \
-  random-file.d \
-  range.d \
-  rate.d \
-  raw.d \
-  referer.d \
-  remote-header-name.d \
-  remote-name-all.d \
-  remote-name.d \
-  remote-time.d \
-  remove-on-error.d \
-  request-target.d \
-  request.d \
-  resolve.d \
-  retry-all-errors.d \
-  retry-connrefused.d \
-  retry-delay.d \
-  retry-max-time.d \
-  retry.d \
-  sasl-authzid.d \
-  sasl-ir.d \
-  service-name.d \
-  show-error.d \
-  silent.d \
-  socks4.d \
-  socks4a.d \
-  socks5-basic.d \
-  socks5-gssapi-nec.d \
-  socks5-gssapi-service.d \
-  socks5-gssapi.d \
-  socks5-hostname.d \
-  socks5.d \
-  speed-limit.d \
-  speed-time.d \
-  ssl-allow-beast.d \
-  ssl-auto-client-cert.d \
-  ssl-no-revoke.d \
-  ssl-reqd.d \
-  ssl-revoke-best-effort.d \
-  ssl.d \
-  sslv2.d \
-  sslv3.d \
-  stderr.d \
-  styled-output.d \
-  suppress-connect-headers.d \
-  tcp-fastopen.d \
-  tcp-nodelay.d \
-  telnet-option.d \
-  tftp-blksize.d \
-  tftp-no-options.d \
-  time-cond.d \
-  tls-max.d \
-  tls13-ciphers.d \
-  tlsauthtype.d \
-  tlspassword.d \
-  tlsuser.d \
-  tlsv1.0.d \
-  tlsv1.1.d \
-  tlsv1.2.d \
-  tlsv1.3.d \
-  tlsv1.d \
-  tr-encoding.d \
-  trace-ascii.d \
-  trace-config.d \
-  trace-ids.d \
-  trace-time.d \
-  trace.d \
-  unix-socket.d \
-  upload-file.d \
-  url.d \
-  url-query.d \
-  use-ascii.d \
-  user-agent.d \
-  user.d \
-  variable.d \
-  verbose.d \
-  version.d \
-  write-out.d \
-  xattr.d
-
-OTHERPAGES = page-footer page-header
+  abstract-unix-socket.md \
+  alt-svc.md \
+  anyauth.md \
+  append.md \
+  aws-sigv4.md \
+  basic.md \
+  ca-native.md \
+  cacert.md \
+  capath.md \
+  cert-status.md \
+  cert-type.md \
+  cert.md \
+  ciphers.md \
+  compressed-ssh.md \
+  compressed.md \
+  config.md \
+  connect-timeout.md \
+  connect-to.md \
+  continue-at.md \
+  cookie-jar.md \
+  cookie.md \
+  create-dirs.md \
+  create-file-mode.md \
+  crlf.md \
+  crlfile.md \
+  curves.md \
+  data-ascii.md \
+  data-binary.md \
+  data-raw.md \
+  data-urlencode.md \
+  data.md \
+  delegation.md \
+  digest.md \
+  disable-eprt.md \
+  disable-epsv.md \
+  disable.md \
+  disallow-username-in-url.md \
+  dns-interface.md \
+  dns-ipv4-addr.md \
+  dns-ipv6-addr.md \
+  dns-servers.md \
+  doh-cert-status.md \
+  doh-insecure.md \
+  doh-url.md \
+  dump-ca-embed.md \
+  dump-header.md \
+  ech.md \
+  egd-file.md \
+  engine.md \
+  etag-compare.md \
+  etag-save.md \
+  expect100-timeout.md \
+  fail-early.md \
+  fail-with-body.md \
+  fail.md \
+  false-start.md \
+  follow.md \
+  form-escape.md \
+  form-string.md \
+  form.md \
+  ftp-account.md \
+  ftp-alternative-to-user.md \
+  ftp-create-dirs.md \
+  ftp-method.md \
+  ftp-pasv.md \
+  ftp-port.md \
+  ftp-pret.md \
+  ftp-skip-pasv-ip.md \
+  ftp-ssl-ccc-mode.md \
+  ftp-ssl-ccc.md \
+  ftp-ssl-control.md \
+  get.md \
+  globoff.md \
+  happy-eyeballs-timeout-ms.md \
+  haproxy-protocol.md \
+  haproxy-clientip.md \
+  head.md \
+  header.md \
+  help.md \
+  hostpubmd5.md \
+  hostpubsha256.md \
+  hsts.md \
+  http0.9.md \
+  http1.0.md \
+  http1.1.md \
+  http2-prior-knowledge.md \
+  http2.md \
+  http3.md \
+  http3-only.md \
+  ignore-content-length.md \
+  insecure.md \
+  interface.md \
+  ip-tos.md \
+  ipfs-gateway.md \
+  ipv4.md \
+  ipv6.md \
+  json.md \
+  junk-session-cookies.md \
+  keepalive-cnt.md \
+  keepalive-time.md \
+  key-type.md \
+  key.md \
+  knownhosts.md \
+  krb.md \
+  libcurl.md \
+  limit-rate.md \
+  list-only.md \
+  local-port.md \
+  location-trusted.md \
+  location.md \
+  login-options.md \
+  mail-auth.md \
+  mail-from.md \
+  mail-rcpt-allowfails.md \
+  mail-rcpt.md \
+  manual.md \
+  max-filesize.md \
+  max-redirs.md \
+  max-time.md \
+  metalink.md \
+  mptcp.md \
+  negotiate.md \
+  netrc-file.md \
+  netrc-optional.md \
+  netrc.md \
+  next.md \
+  no-alpn.md \
+  no-buffer.md \
+  no-clobber.md \
+  no-keepalive.md \
+  no-npn.md \
+  no-progress-meter.md \
+  no-sessionid.md \
+  noproxy.md \
+  ntlm-wb.md \
+  ntlm.md \
+  oauth2-bearer.md \
+  output-dir.md \
+  out-null.md \
+  output.md \
+  parallel-immediate.md \
+  parallel-max-host.md \
+  parallel-max.md \
+  parallel.md \
+  pass.md \
+  path-as-is.md \
+  pinnedpubkey.md \
+  post301.md \
+  post302.md \
+  post303.md \
+  preproxy.md \
+  progress-bar.md \
+  proto-default.md \
+  proto-redir.md \
+  proto.md \
+  proxy-anyauth.md \
+  proxy-basic.md \
+  proxy-ca-native.md \
+  proxy-cacert.md \
+  proxy-capath.md \
+  proxy-cert-type.md \
+  proxy-cert.md \
+  proxy-ciphers.md \
+  proxy-crlfile.md \
+  proxy-digest.md \
+  proxy-header.md \
+  proxy-http2.md \
+  proxy-http3.md \
+  proxy-insecure.md \
+  proxy-key-type.md \
+  proxy-key.md \
+  proxy-negotiate.md \
+  proxy-ntlm.md \
+  proxy-pass.md \
+  proxy-pinnedpubkey.md \
+  proxy-service-name.md \
+  proxy-ssl-allow-beast.md \
+  proxy-ssl-auto-client-cert.md \
+  proxy-tls13-ciphers.md \
+  proxy-tlsauthtype.md \
+  proxy-tlspassword.md \
+  proxy-tlsuser.md \
+  proxy-tlsv1.md \
+  proxy-user.md \
+  proxy.md \
+  proxy1.0.md \
+  proxytunnel.md \
+  pubkey.md \
+  quote.md \
+  random-file.md \
+  range.md \
+  rate.md \
+  raw.md \
+  referer.md \
+  remote-header-name.md \
+  remote-name-all.md \
+  remote-name.md \
+  remote-time.md \
+  remove-on-error.md \
+  request-target.md \
+  request.md \
+  resolve.md \
+  retry-all-errors.md \
+  retry-connrefused.md \
+  retry-delay.md \
+  retry-max-time.md \
+  retry.md \
+  sasl-authzid.md \
+  sasl-ir.md \
+  service-name.md \
+  show-error.md \
+  show-headers.md \
+  silent.md \
+  sigalgs.md \
+  skip-existing.md \
+  socks4.md \
+  socks4a.md \
+  socks5-basic.md \
+  socks5-gssapi-nec.md \
+  socks5-gssapi-service.md \
+  socks5-gssapi.md \
+  socks5-hostname.md \
+  socks5.md \
+  speed-limit.md \
+  speed-time.md \
+  ssl-allow-beast.md \
+  ssl-auto-client-cert.md \
+  ssl-no-revoke.md \
+  ssl-reqd.md \
+  ssl-revoke-best-effort.md \
+  ssl-sessions.md \
+  ssl.md \
+  sslv2.md \
+  sslv3.md \
+  stderr.md \
+  styled-output.md \
+  suppress-connect-headers.md \
+  tcp-fastopen.md \
+  tcp-nodelay.md \
+  telnet-option.md \
+  tftp-blksize.md \
+  tftp-no-options.md \
+  time-cond.md \
+  tls-earlydata.md \
+  tls-max.md \
+  tls13-ciphers.md \
+  tlsauthtype.md \
+  tlspassword.md \
+  tlsuser.md \
+  tlsv1.0.md \
+  tlsv1.1.md \
+  tlsv1.2.md \
+  tlsv1.3.md \
+  tlsv1.md \
+  tr-encoding.md \
+  trace-ascii.md \
+  trace-config.md \
+  trace-ids.md \
+  trace-time.md \
+  trace.md \
+  unix-socket.md \
+  upload-file.md \
+  upload-flags.md \
+  url.md \
+  url-query.md \
+  use-ascii.md \
+  user-agent.md \
+  user.md \
+  variable.md \
+  verbose.md \
+  version.md \
+  vlan-priority.md \
+  write-out.md \
+  xattr.md
diff --git a/third-party/curl/docs/cmdline-opts/_AUTHORS.md b/third-party/curl/docs/cmdline-opts/_AUTHORS.md
new file mode 100644
index 0000000000..0c9bfb9538
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/_AUTHORS.md
@@ -0,0 +1,5 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# AUTHORS
+Daniel Stenberg is the main author, but the whole list of contributors is
+found in the separate THANKS file.
diff --git a/third-party/curl/docs/cmdline-opts/_BUGS.md b/third-party/curl/docs/cmdline-opts/_BUGS.md
new file mode 100644
index 0000000000..45630d4352
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/_BUGS.md
@@ -0,0 +1,5 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# BUGS
+If you experience any problems with curl, submit an issue in the project's bug
+tracker on GitHub: https://github.com/curl/curl/issues
diff --git a/third-party/curl/docs/cmdline-opts/_DESCRIPTION.md b/third-party/curl/docs/cmdline-opts/_DESCRIPTION.md
new file mode 100644
index 0000000000..bb21f0ba32
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/_DESCRIPTION.md
@@ -0,0 +1,11 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# DESCRIPTION
+
+**curl** is a tool for transferring data from or to a server using URLs. It
+supports these protocols: DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS,
+IMAP, IMAPS, LDAP, LDAPS, MQTT, MQTTS, POP3, POP3S, RTSP, SCP, SFTP, SMB,
+SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS.
+
+curl is powered by libcurl for all transfer-related features. See
+*libcurl(3)* for details.
diff --git a/third-party/curl/docs/cmdline-opts/_ENVIRONMENT.md b/third-party/curl/docs/cmdline-opts/_ENVIRONMENT.md
new file mode 100644
index 0000000000..a3c13ae0c0
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/_ENVIRONMENT.md
@@ -0,0 +1,120 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# ENVIRONMENT
+The environment variables can be specified in lower case or upper case. The
+lower case version has precedence. `http_proxy` is an exception as it is only
+available in lower case. (Note that some systems, like Windows, do not
+differentiate between environment variables using different case.)
+
+Using an environment variable to set the proxy has the same effect as using
+the --proxy option.
+
+## `http_proxy [protocol://]<host>[:port]`
+Sets the proxy server to use for HTTP.
+
+## `HTTPS_PROXY [protocol://]<host>[:port]`
+Sets the proxy server to use for HTTPS.
+
+## `[url-protocol]_PROXY [protocol://]<host>[:port]`
+Sets the proxy server to use for [url-protocol], where the protocol is a
+protocol that curl supports and as specified in a URL. FTP, FTPS, POP3, IMAP,
+SMTP, LDAP, etc.
+
+## `ALL_PROXY [protocol://]<host>[:port]`
+Sets the proxy server to use if no protocol-specific proxy is set.
+
+## `NO_PROXY <comma-separated list of hosts/domains>`
+list of hostnames that should not go through any proxy. If set to an asterisk
+'*' only, it matches all hosts. Each name in this list is matched as either a
+domain name which contains the hostname, or the hostname itself.
+
+This environment variable disables use of the proxy even when specified with
+the --proxy option. That is
+
+    NO_PROXY=direct.example.com curl -x http://proxy.example.com
+    https://direct.example.com
+
+accesses the target URL directly, and
+
+    NO_PROXY=direct.example.com curl -x http://proxy.example.com
+    https://somewhere.example.com
+
+accesses the target URL through the proxy.
+
+The list of hostnames can also include numerical IP addresses, and IPv6
+versions should then be given without enclosing brackets.
+
+IP addresses can be specified using CIDR notation: an appended slash and
+number specifies the number of "network bits" out of the address to use in the
+comparison (added in 7.86.0). For example "192.168.0.0/16" would match all
+addresses starting with "192.168".
+
+## `APPDATA <directory>`
+On Windows, this variable is used when trying to find the home directory. If
+the primary home variables are all unset.
+
+## `COLUMNS <terminal width>`
+If set, the specified number of characters is used as the terminal width when
+the alternative progress-bar is shown. If not set, curl tries to figure it out
+using other ways.
+
+## `CURL_CA_BUNDLE <file>`
+If set, it is used as the --cacert value. This environment variable is ignored
+if Schannel is used as the TLS backend.
+
+## `CURL_HOME <directory>`
+If set, is the first variable curl checks when trying to find its home
+directory. If not set, it continues to check *XDG_CONFIG_HOME*
+
+## `CURL_SSL_BACKEND <TLS backend>`
+If curl was built with support for "MultiSSL", meaning that it has built-in
+support for more than one TLS backend, this environment variable can be set to
+the case insensitive name of the particular backend to use when curl is
+invoked. Setting a name that is not a built-in alternative makes curl stay
+with the default.
+
+SSL backend names (case-insensitive): **gnutls**, **mbedtls**, **openssl**,
+**rustls**, **schannel**, **wolfssl**
+
+## `HOME <directory>`
+If set, this is used to find the home directory when that is needed. Like when
+looking for the default .curlrc. *CURL_HOME* and *XDG_CONFIG_HOME*
+have preference.
+
+## `NETRC <path>`
+If set, this is used to find the `.netrc` file. It overrides all other netrc
+file location mechanisms and should be set to the full file path.
+(Added in curl 8.16.0)
+
+## `QLOGDIR <directory>`
+If curl was built with HTTP/3 support, setting this environment variable to a
+local directory makes curl produce **qlogs** in that directory, using file
+names named after the destination connection id (in hex). Do note that these
+files can become rather large. Works with the ngtcp2 and quiche QUIC backends.
+
+## `SHELL`
+Used on VMS when trying to detect if using a **DCL** or a **Unix** shell.
+
+## `SSL_CERT_DIR <directory>`
+If set, it is used as the --capath value. This environment variable is ignored
+if Schannel is used as the TLS backend.
+
+## `SSL_CERT_FILE <path>`
+If set, it is used as the --cacert value. This environment variable is ignored
+if Schannel is used as the TLS backend.
+
+## `SSLKEYLOGFILE <path>`
+If you set this environment variable to a filename, curl stores TLS secrets
+from its connections in that file when invoked to enable you to analyze the
+TLS traffic in real time using network analyzing tools such as Wireshark. This
+works with the following TLS backends: OpenSSL, LibreSSL (TLS 1.2 max),
+BoringSSL, GnuTLS, wolfSSL and Rustls.
+
+## `USERPROFILE <directory>`
+On Windows, this variable is used when trying to find the home directory. If
+the other, primary, variables are all unset. If set, curl uses the path
+**"$USERPROFILE\Application Data"**.
+
+## `XDG_CONFIG_HOME <directory>`
+If *CURL_HOME* is not set, this variable is checked when looking for a
+default .curlrc file.
diff --git a/third-party/curl/docs/cmdline-opts/_EXITCODES.md b/third-party/curl/docs/cmdline-opts/_EXITCODES.md
new file mode 100644
index 0000000000..333e198d7c
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/_EXITCODES.md
@@ -0,0 +1,203 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# EXIT CODES
+There are a bunch of different error codes and their corresponding error
+messages that may appear under error conditions. At the time of this writing,
+the exit codes are:
+## 0
+Success. The operation completed successfully according to the instructions.
+## 1
+Unsupported protocol. This build of curl has no support for this protocol.
+## 2
+Failed to initialize.
+## 3
+URL malformed. The syntax was not correct.
+## 4
+A feature or option that was needed to perform the desired request was not
+enabled or was explicitly disabled at build-time. To make curl able to do
+this, you probably need another build of libcurl.
+## 5
+Could not resolve proxy. The given proxy host could not be resolved.
+## 6
+Could not resolve host. The given remote host could not be resolved.
+## 7
+Failed to connect to host.
+## 8
+Weird server reply. The server sent data curl could not parse.
+## 9
+FTP access denied. The server denied login or denied access to the particular
+resource or directory you wanted to reach. Most often you tried to change to a
+directory that does not exist on the server.
+## 10
+FTP accept failed. While waiting for the server to connect back when an active
+FTP session is used, an error code was sent over the control connection or
+similar.
+## 11
+FTP weird PASS reply. curl could not parse the reply sent to the PASS request.
+## 12
+During an active FTP session while waiting for the server to connect back to
+curl, the timeout expired.
+## 13
+FTP weird PASV reply, curl could not parse the reply sent to the PASV request.
+## 14
+FTP weird 227 format. curl could not parse the 227-line the server sent.
+## 15
+FTP cannot use host. Could not resolve the host IP we got in the 227-line.
+## 16
+HTTP/2 error. A problem was detected in the HTTP2 framing layer. This is
+somewhat generic and can be one out of several problems, see the error message
+for details.
+## 17
+FTP could not set binary. Could not change transfer method to binary.
+## 18
+Partial file. Only a part of the file was transferred.
+## 19
+FTP could not download/access the given file, the RETR (or similar) command
+failed.
+## 21
+FTP quote error. A quote command returned error from the server.
+## 22
+HTTP page not retrieved. The requested URL was not found or returned another
+error with the HTTP error code being 400 or above. This return code only
+appears if --fail is used.
+## 23
+Write error. curl could not write data to a local file system or similar.
+## 25
+Failed starting the upload. For FTP, the server typically denied the STOR
+command.
+## 26
+Read error. Various reading problems.
+## 27
+Out of memory. A memory allocation request failed.
+## 28
+Operation timeout. The specified time-out period was reached according to the
+conditions.
+## 30
+FTP PORT failed. The PORT command failed. Not all FTP servers support the PORT
+command, try doing a transfer using PASV instead.
+## 31
+FTP could not use REST. The REST command failed. This command is used for
+resumed FTP transfers.
+## 33
+HTTP range error. The range "command" did not work.
+## 34
+HTTP post error. Internal post-request generation error.
+## 35
+SSL connect error. The SSL handshaking failed.
+## 36
+Bad download resume. Could not continue an earlier aborted download.
+## 37
+FILE could not read file. Failed to open the file. Permissions?
+## 38
+LDAP cannot bind. LDAP bind operation failed.
+## 39
+LDAP search failed.
+## 41
+Function not found. A required LDAP function was not found.
+## 42
+Aborted by callback. An application told curl to abort the operation.
+## 43
+Internal error. A function was called with a bad parameter.
+## 45
+Interface error. A specified outgoing interface could not be used.
+## 47
+Too many redirects. When following redirects, curl hit the maximum amount.
+## 48
+Unknown option specified to libcurl. This indicates that you passed a weird
+option to curl that was passed on to libcurl and rejected. Read up in the
+manual.
+## 49
+Malformed telnet option.
+## 52
+The server did not reply anything, which here is considered an error.
+## 53
+SSL crypto engine not found.
+## 54
+Cannot set SSL crypto engine as default.
+## 55
+Failed sending network data.
+## 56
+Failure in receiving network data.
+## 58
+Problem with the local certificate.
+## 59
+Could not use specified SSL cipher.
+## 60
+Peer certificate cannot be authenticated with known CA certificates.
+## 61
+Unrecognized transfer encoding.
+## 63
+Maximum file size exceeded.
+## 64
+Requested FTP SSL level failed.
+## 65
+Sending the data requires a rewind that failed.
+## 66
+Failed to initialize SSL Engine.
+## 67
+The username, password, or similar was not accepted and curl failed to log in.
+## 68
+File not found on TFTP server.
+## 69
+Permission problem on TFTP server.
+## 70
+Out of disk space on TFTP server.
+## 71
+Illegal TFTP operation.
+## 72
+Unknown TFTP transfer ID.
+## 73
+File already exists (TFTP).
+## 74
+No such user (TFTP).
+## 77
+Problem reading the SSL CA cert (path? access rights?).
+## 78
+The resource referenced in the URL does not exist.
+## 79
+An unspecified error occurred during the SSH session.
+## 80
+Failed to shut down the SSL connection.
+## 82
+Could not load CRL file, missing or wrong format (added in 7.19.0).
+## 83
+Issuer check failed (added in 7.19.0).
+## 84
+The FTP PRET command failed.
+## 85
+Mismatch of RTSP CSeq numbers.
+## 86
+Mismatch of RTSP Session Identifiers.
+## 87
+Unable to parse FTP file list.
+## 88
+FTP chunk callback reported error.
+## 89
+No connection available, the session is queued.
+## 90
+SSL public key does not match pinned public key.
+## 91
+Invalid SSL certificate status.
+## 92
+Stream error in HTTP/2 framing layer.
+## 93
+An API function was called from inside a callback.
+## 94
+An authentication function returned an error.
+## 95
+A problem was detected in the HTTP/3 layer. This is somewhat generic and can
+be one out of several problems, see the error message for details.
+## 96
+QUIC connection error. This error may be caused by an SSL library error. QUIC
+is the protocol used for HTTP/3 transfers.
+## 97
+Proxy handshake error.
+## 98
+A client-side certificate is required to complete the TLS handshake.
+## 99
+Poll or select returned fatal error.
+## 100
+A value or data field grew larger than allowed.
+## XX
+More error codes might appear here in future releases. The existing ones are
+meant to never change.
diff --git a/third-party/curl/docs/cmdline-opts/_FILES.md b/third-party/curl/docs/cmdline-opts/_FILES.md
new file mode 100644
index 0000000000..8c5d3faa7b
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/_FILES.md
@@ -0,0 +1,6 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# FILES
+*~/.curlrc*
+
+Default config file, see --config for details.
diff --git a/third-party/curl/docs/cmdline-opts/_GLOBBING.md b/third-party/curl/docs/cmdline-opts/_GLOBBING.md
new file mode 100644
index 0000000000..b801adb4d1
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/_GLOBBING.md
@@ -0,0 +1,55 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# GLOBBING
+You can specify multiple URLs or parts of URLs by writing lists within braces
+or ranges within brackets. We call this "globbing".
+
+Provide a list with three different names like this:
+
+    https://fun.example/{one,two,three}.jpg
+
+    sftp://{one,two,three}.example/README
+
+Do sequences of alphanumeric series by using [] as in:
+
+    ftp://ftp.example.com/file[1-100].txt
+
+With leading zeroes:
+
+    ftp://ftp.example.com/file[001-100].txt
+
+With letters through the alphabet:
+
+    ftp://ftp.example.com/file[a-z].txt
+
+Nested sequences are not supported, but you can use several ones next to each
+other:
+
+    https://example.com/archive[1996-1999]/vol[1-4]/part{a,b,c}.html
+
+You can specify a step counter for the ranges to get every Nth number or
+letter:
+
+    https://example.com/file[1-100:10].txt
+
+    https://example.com/file[a-z:2].txt
+
+When using [] or {} sequences when invoked from a command line prompt, you
+probably have to put the full URL within double quotes to avoid the shell from
+interfering with it. This also goes for other characters treated special, like
+for example '&', '?' and '*'.
+
+The separate globbing components can be referenced in the --output option to
+allow pieces to be reused in the target filename.
+
+Starting in curl 8.21.0, the separate globbing parts can be named and
+referenced by their names. The case sensitive alphanumeric name is set
+enclosed within angle brackets after the opening character. Examples:
+
+    https://fun.example/{<number>one,two,three}.jpg
+
+    ftp://ftp.example.com/file[<range>1-100].txt
+
+Setting the same glob name twice is an error.
+
+Switch off globbing with --globoff.
diff --git a/third-party/curl/docs/cmdline-opts/_NAME.md b/third-party/curl/docs/cmdline-opts/_NAME.md
new file mode 100644
index 0000000000..b0d8916144
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/_NAME.md
@@ -0,0 +1,4 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# NAME
+curl - transfer a URL
diff --git a/third-party/curl/docs/cmdline-opts/_OPTIONS.md b/third-party/curl/docs/cmdline-opts/_OPTIONS.md
new file mode 100644
index 0000000000..9155d857ec
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/_OPTIONS.md
@@ -0,0 +1,39 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# OPTIONS
+
+Options start with one or two dashes. Many of the options require an
+additional value next to them. If provided text does not start with a dash, it
+is presumed to be and treated as a URL.
+
+The short "single-dash" form of the options, -d for example, may be used with
+or without a space between it and its value, although a space is a recommended
+separator. The long double-dash form, --data for example, requires a space
+between it and its value.
+
+Short version options that do not need any additional values can be used
+immediately next to each other, like for example you can specify all the
+options *-O*, *-L* and *-v* at once as *-OLv*.
+
+In general, all boolean options are enabled with --**option** and yet again
+disabled with --**no-**option. That is, you use the same option name but
+prefix it with `no-`. In this list we mostly show the --**option** version of
+them.
+
+When --next is used, it resets the parser state and you start again with a
+clean option state, except for the options that are global. Global options
+retain their values and meaning even after --next.
+
+If the long option name ends with an equals sign (`=`), the argument is the
+text following on its right side. (Added in 8.16.0)
+
+The first argument that is exactly two dashes (`--`), marks the end of
+options; any argument after the end of options is interpreted as a URL
+argument even if it starts with a dash.
+
+curl does little to no verification of the contents of command line arguments.
+Passing in "creative octets" like newlines might trigger unexpected results.
+
+The following options are global: `%GLOBALS`.
+
+# ALL OPTIONS
diff --git a/third-party/curl/docs/cmdline-opts/_OUTPUT.md b/third-party/curl/docs/cmdline-opts/_OUTPUT.md
new file mode 100644
index 0000000000..32a5457afc
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/_OUTPUT.md
@@ -0,0 +1,11 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# OUTPUT
+If not told otherwise, curl writes the received data to stdout. It can be
+instructed to instead save that data into a local file, using the --output or
+--remote-name options. If curl is given multiple URLs to transfer on the
+command line, it similarly needs multiple options for where to save them.
+
+curl does not parse or otherwise "understand" the content it gets or writes as
+output. It does no encoding or decoding, unless explicitly asked to with
+dedicated command line options.
diff --git a/third-party/curl/docs/cmdline-opts/_PROGRESS.md b/third-party/curl/docs/cmdline-opts/_PROGRESS.md
new file mode 100644
index 0000000000..a506d041dc
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/_PROGRESS.md
@@ -0,0 +1,26 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# PROGRESS METER
+
+curl normally displays a progress meter during operations, indicating the
+amount of transferred data, transfer speeds and estimated time left, etc. The
+progress meter displays the transfer rate in bytes per second. The used
+suffixes (`k` for kilo, `M` for mega, `G` for giga, `T` for tera, `P` for peta
+and `E` for exa) are 1024 based. For example 1k is 1024 bytes. 1M is 1048576
+bytes. Strictly speaking this makes the units kibibyte and mebibyte etc.
+
+curl displays this data to the terminal by default, so if you invoke curl to
+do an operation and it is about to write data to the terminal, it *disables*
+the progress meter as otherwise it would mess up the output mixing progress
+meter and response data.
+
+If you want a progress meter for HTTP POST or PUT requests, you need to
+redirect the response output to a file, using shell redirect (\>), --output or
+similar.
+
+This does not apply to FTP upload as that operation does not spit out any
+response data to the terminal.
+
+If you prefer a progress bar instead of the regular meter, --progress-bar is
+your friend. You can also disable the progress meter completely with the
+--silent option.
diff --git a/third-party/curl/docs/cmdline-opts/_PROTOCOLS.md b/third-party/curl/docs/cmdline-opts/_PROTOCOLS.md
new file mode 100644
index 0000000000..6b1918a9b2
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/_PROTOCOLS.md
@@ -0,0 +1,50 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# PROTOCOLS
+curl supports numerous protocols, or put in URL terms: schemes. Your
+particular build may not support them all.
+## DICT
+Lets you lookup words using online dictionaries.
+## FILE
+Read or write local files. curl does not support accessing `file://` URL
+remotely, but when running on Microsoft Windows using the native UNC approach
+works. Only absolute paths.
+## FTP(S)
+curl supports the File Transfer Protocol with a lot of tweaks and levers. With
+or without using TLS.
+## GOPHER(S)
+Retrieve files.
+## HTTP(S)
+curl supports HTTP with numerous options and variations. It can speak HTTP
+version 0.9, 1.0, 1.1, 2 and 3 depending on build options and the correct
+command line options.
+## IMAP(S)
+Using the mail reading protocol, curl can download emails for you. With or
+without using TLS.
+## LDAP(S)
+curl can do directory lookups for you, with or without TLS.
+## MQTT
+curl supports MQTT version 3. Downloading over MQTT equals subscribing to a
+topic while uploading/posting equals publishing on a topic. MQTT over TLS is not
+supported (yet).
+## POP3(S)
+Downloading from a pop3 server means getting an email. With or without using
+TLS.
+## RTSP
+curl supports RTSP 1.0 downloads.
+## SCP
+curl supports SSH version 2 scp transfers.
+## SFTP
+curl supports SFTP (draft 5) done over SSH version 2.
+## SMB(S)
+curl supports SMB version 1 for upload and download.
+## SMTP(S)
+Uploading contents to an SMTP server means sending an email. With or without
+TLS.
+## TELNET
+Fetching a telnet URL starts an interactive session where it sends what it
+reads on stdin and outputs what the server sends it.
+## TFTP
+curl can do TFTP downloads and uploads.
+## WS(S)
+WebSocket done over HTTP/1. WSS implies that it works over HTTPS.
diff --git a/third-party/curl/docs/cmdline-opts/_PROXYPREFIX.md b/third-party/curl/docs/cmdline-opts/_PROXYPREFIX.md
new file mode 100644
index 0000000000..0c106306d8
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/_PROXYPREFIX.md
@@ -0,0 +1,22 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# PROXY PROTOCOL PREFIXES
+The proxy string may be specified with a `protocol://` prefix to specify
+alternative proxy protocols. (Added in 7.21.7)
+
+If no protocol is specified in the proxy string or if the string does not
+match a supported one, the proxy is treated as an HTTP proxy.
+
+The supported proxy protocol prefixes are as follows:
+## `http://`
+Makes it use it as an HTTP proxy. The default if no scheme prefix is used.
+## `https://`
+Makes it treated as an **HTTPS** proxy.
+## `socks4://`
+Makes it the equivalent of --socks4
+## `socks4a://`
+Makes it the equivalent of --socks4a
+## `socks5://`
+Makes it the equivalent of --socks5
+## `socks5h://`
+Makes it the equivalent of --socks5-hostname
diff --git a/third-party/curl/docs/cmdline-opts/_SEEALSO.md b/third-party/curl/docs/cmdline-opts/_SEEALSO.md
new file mode 100644
index 0000000000..aa1b25984b
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/_SEEALSO.md
@@ -0,0 +1,5 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# SEE ALSO
+
+**ftp(1)**, **wget(1)**
diff --git a/third-party/curl/docs/cmdline-opts/_SYNOPSIS.md b/third-party/curl/docs/cmdline-opts/_SYNOPSIS.md
new file mode 100644
index 0000000000..3815877448
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/_SYNOPSIS.md
@@ -0,0 +1,5 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# SYNOPSIS
+
+**curl [options / URLs]**
diff --git a/third-party/curl/docs/cmdline-opts/_URL.md b/third-party/curl/docs/cmdline-opts/_URL.md
new file mode 100644
index 0000000000..700e711359
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/_URL.md
@@ -0,0 +1,24 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# URL
+The URL syntax is protocol-dependent. You can find a detailed description in
+RFC 3986.
+
+If you provide a URL without a leading `protocol://` scheme, curl guesses
+what protocol you want. It then defaults to HTTP but assumes others based on
+often-used hostname prefixes. For example, for hostnames starting with `ftp.`
+curl assumes you want FTP.
+
+You can specify any amount of URLs on the command line. They are fetched in a
+sequential manner in the specified order unless you use --parallel. You can
+specify command line options and URLs mixed and in any order on the command
+line.
+
+curl attempts to reuse connections when doing multiple transfers, so that
+getting many files from the same server do not use multiple connects and setup
+handshakes. This improves speed. Connection reuse can only be done for URLs
+specified for a single command line invocation and cannot be performed between
+separate curl runs.
+
+Everything provided on the command line that is not a command line option or
+its argument, curl assumes is a URL and treats it as such.
diff --git a/third-party/curl/docs/cmdline-opts/_VARIABLES.md b/third-party/curl/docs/cmdline-opts/_VARIABLES.md
new file mode 100644
index 0000000000..834fc5ef28
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/_VARIABLES.md
@@ -0,0 +1,43 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# VARIABLES
+curl supports command line variables (added in 8.3.0). Set variables with
+--variable name=content or --variable name@file (where `file` can be stdin if
+set to a single dash (-)).
+
+Variable contents can be expanded in option parameters using `{{name}}` if the
+option name is prefixed with `--expand-`. This gets the contents of the
+variable `name` inserted, or a blank if the name does not exist as a
+variable. Insert `{{` verbatim in the string by prefixing it with a backslash,
+like `\{{`.
+
+You can access and expand environment variables by importing them with
+`--variable %name`. This imports the variable called `name` but exits with an
+error if that environment variable is not already set. To provide a default
+value in case it is not already set, use `--variable %name=content` or
+`--variable %name@content`.
+
+Example: get the USER environment variable and expand into the URL, fail if
+USER is not set:
+
+    --variable '%USER'
+    --expand-url = "https://example.com/api/{{USER}}/method"
+
+When expanding variables, curl supports a set of functions that can make the
+variable contents more convenient to use. It can trim leading and trailing
+white space with `trim`, output the contents as a JSON quoted string with
+`json`, URL encode the string with `url`, base64 encode it with `b64` and
+base64 decode it with `64dec`. To apply functions to a variable expansion, add
+them colon separated to the right side of the variable. Variable content
+holding null bytes that are not encoded when expanded causes an error.
+
+Example: get the contents of a file called $HOME/.secret into a variable
+called "fix". Make sure that the content is trimmed and percent-encoded when
+sent as POST data:
+
+    --variable %HOME
+    --expand-variable fix@{{HOME}}/.secret
+    --expand-data "{{fix:trim:url}}"
+    https://example.com/
+
+Command line variables and expansions were added in 8.3.0.
diff --git a/third-party/curl/docs/cmdline-opts/_VERSION.md b/third-party/curl/docs/cmdline-opts/_VERSION.md
new file mode 100644
index 0000000000..e0228fe9cd
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/_VERSION.md
@@ -0,0 +1,15 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# VERSION
+
+This man page describes curl `%VERSION`. If you use a later version, chances
+are this man page does not fully document it. If you use an earlier version,
+this document tries to include version information about which specific
+version that introduced changes.
+
+You can always learn which the latest curl version is by running
+
+    curl https://curl.se/info
+
+The online version of this man page is always showing the latest incarnation:
+https://curl.se/docs/manpage.html
diff --git a/third-party/curl/docs/cmdline-opts/_WWW.md b/third-party/curl/docs/cmdline-opts/_WWW.md
new file mode 100644
index 0000000000..8656e9ee8c
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/_WWW.md
@@ -0,0 +1,4 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# WWW
+https://curl.se/
diff --git a/third-party/curl/docs/cmdline-opts/abstract-unix-socket.d b/third-party/curl/docs/cmdline-opts/abstract-unix-socket.d
deleted file mode 100644
index 5c2fd4a476..0000000000
--- a/third-party/curl/docs/cmdline-opts/abstract-unix-socket.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: abstract-unix-socket
-Arg: <path>
-Help: Connect via abstract Unix domain socket
-Added: 7.53.0
-Protocols: HTTP
-Category: connection
-See-also: unix-socket
-Example: --abstract-unix-socket socketpath $URL
-Multi: single
----
-Connect through an abstract Unix domain socket, instead of using the network.
-Note: netstat shows the path of an abstract socket prefixed with '@', however
-the <path> argument should not have this leading character.
diff --git a/third-party/curl/docs/cmdline-opts/abstract-unix-socket.md b/third-party/curl/docs/cmdline-opts/abstract-unix-socket.md
new file mode 100644
index 0000000000..b1b6100e16
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/abstract-unix-socket.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: abstract-unix-socket
+Arg: <path>
+Help: Connect via abstract Unix domain socket
+Added: 7.53.0
+Protocols: HTTP
+Category: connection
+Multi: single
+See-also:
+  - unix-socket
+Example:
+  - --abstract-unix-socket socketpath $URL
+---
+
+# `--abstract-unix-socket`
+
+Connect to the server through an abstract Unix domain socket, instead of using
+the network. Note: netstat shows the path of an abstract socket prefixed with
+`@`, however the \<path\> argument should not have this leading character.
diff --git a/third-party/curl/docs/cmdline-opts/alt-svc.d b/third-party/curl/docs/cmdline-opts/alt-svc.d
deleted file mode 100644
index 276ac1b669..0000000000
--- a/third-party/curl/docs/cmdline-opts/alt-svc.d
+++ /dev/null
@@ -1,21 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: alt-svc
-Arg: <file name>
-Protocols: HTTPS
-Help: Enable alt-svc with this cache file
-Added: 7.64.1
-Category: http
-See-also: resolve connect-to
-Example: --alt-svc svc.txt $URL
-Multi: append
----
-This option enables the alt-svc parser in curl. If the file name points to an
-existing alt-svc cache file, that gets used. After a completed transfer, the
-cache is saved to the file name again if it has been modified.
-
-Specify a "" file name (zero length) to avoid loading/saving and make curl
-just handle the cache in memory.
-
-If this option is used several times, curl loads contents from all the
-files but the last one is used for saving.
diff --git a/third-party/curl/docs/cmdline-opts/alt-svc.md b/third-party/curl/docs/cmdline-opts/alt-svc.md
new file mode 100644
index 0000000000..fe2e8736fa
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/alt-svc.md
@@ -0,0 +1,31 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: alt-svc
+Arg: <filename>
+Protocols: HTTPS
+Help: Enable alt-svc with this cache file
+Added: 7.64.1
+Category: http
+Multi: append
+See-also:
+  - resolve
+  - connect-to
+Example:
+  - --alt-svc svc.txt $URL
+---
+
+# `--alt-svc`
+
+Enable the alt-svc parser. If the filename points to an existing alt-svc cache
+file, that gets used. After a completed transfer, the cache is saved to the
+filename again if it has been modified.
+
+Specify a "" filename (zero length) to avoid loading/saving and make curl
+handle the cache in memory.
+
+You may want to restrict your umask to prevent other users on the same system
+to access the created file.
+
+If this option is used several times, curl loads contents from all the
+files but the last one is used for saving.
diff --git a/third-party/curl/docs/cmdline-opts/anyauth.d b/third-party/curl/docs/cmdline-opts/anyauth.d
deleted file mode 100644
index 2498bdcd84..0000000000
--- a/third-party/curl/docs/cmdline-opts/anyauth.d
+++ /dev/null
@@ -1,22 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: anyauth
-Help: Pick any authentication method
-Protocols: HTTP
-See-also: proxy-anyauth basic digest
-Category: http proxy auth
-Example: --anyauth --user me:pwd $URL
-Added: 7.10.6
-Multi: mutex
----
-Tells curl to figure out authentication method by itself, and use the most
-secure one the remote site claims to support. This is done by first doing a
-request and checking the response-headers, thus possibly inducing an extra
-network round-trip. This is used instead of setting a specific authentication
-method, which you can do with --basic, --digest, --ntlm, and --negotiate.
-
-Using --anyauth is not recommended if you do uploads from stdin, since it may
-require data to be sent twice and then the client must be able to rewind. If
-the need should arise when uploading from stdin, the upload operation fails.
-
-Used together with --user.
diff --git a/third-party/curl/docs/cmdline-opts/anyauth.md b/third-party/curl/docs/cmdline-opts/anyauth.md
new file mode 100644
index 0000000000..2afde38224
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/anyauth.md
@@ -0,0 +1,30 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: anyauth
+Help: Pick any authentication method
+Protocols: HTTP
+Category: http proxy auth
+Added: 7.10.6
+Multi: custom
+See-also:
+  - proxy-anyauth
+  - basic
+  - digest
+Example:
+  - --anyauth --user me:pwd $URL
+---
+
+# `--anyauth`
+
+Figure out authentication method automatically, and use the most secure one
+the remote site claims to support. This is done by first doing a request and
+checking the response-headers, thus possibly inducing an extra network
+round-trip. This option is used instead of setting a specific authentication
+method, which you can do with --basic, --digest, --ntlm, and --negotiate.
+
+Using --anyauth is not recommended if you do uploads from stdin, since it may
+require data to be sent twice and then the client must be able to rewind. If
+the need should arise when uploading from stdin, the upload operation fails.
+
+Used together with --user.
diff --git a/third-party/curl/docs/cmdline-opts/append.d b/third-party/curl/docs/cmdline-opts/append.d
deleted file mode 100644
index 7561c951c5..0000000000
--- a/third-party/curl/docs/cmdline-opts/append.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Short: a
-Long: append
-Help: Append to target file when uploading
-Protocols: FTP SFTP
-Category: ftp sftp
-See-also: range continue-at
-Example: --upload-file local --append ftp://example.com/
-Added: 4.8
-Multi: boolean
----
-When used in an upload, this option makes curl append to the target file
-instead of overwriting it. If the remote file does not exist, it is
-created. Note that this flag is ignored by some SFTP servers (including
-OpenSSH).
diff --git a/third-party/curl/docs/cmdline-opts/append.md b/third-party/curl/docs/cmdline-opts/append.md
new file mode 100644
index 0000000000..3d0030d6a7
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/append.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Short: a
+Long: append
+Help: Append to target file when uploading
+Protocols: FTP SFTP
+Category: ftp sftp
+Added: 4.8
+Multi: boolean
+See-also:
+  - range
+  - continue-at
+Example:
+  - --upload-file local --append ftp://example.com/
+---
+
+# `--append`
+
+When used in an upload, this option makes curl append to the target file
+instead of overwriting it. If the remote file does not exist, it is
+created. Note that this flag is ignored by some SFTP servers (including
+OpenSSH).
diff --git a/third-party/curl/docs/cmdline-opts/aws-sigv4.d b/third-party/curl/docs/cmdline-opts/aws-sigv4.d
deleted file mode 100644
index b771eee6a9..0000000000
--- a/third-party/curl/docs/cmdline-opts/aws-sigv4.d
+++ /dev/null
@@ -1,22 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: aws-sigv4
-Arg: <provider1[:provider2[:region[:service]]]>
-Help: Use AWS V4 signature authentication
-Category: auth http
-Added: 7.75.0
-See-also: basic user
-Example: --aws-sigv4 "aws:amz:us-east-2:es" --user "key:secret" $URL
-Multi: single
----
-Use AWS V4 signature authentication in the transfer.
-
-The provider argument is a string that is used by the algorithm when creating
-outgoing authentication headers.
-
-The region argument is a string that points to a geographic area of
-a resources collection (region-code) when the region name is omitted from
-the endpoint.
-
-The service argument is a string that points to a function provided by a cloud
-(service-code) when the service name is omitted from the endpoint.
diff --git a/third-party/curl/docs/cmdline-opts/aws-sigv4.md b/third-party/curl/docs/cmdline-opts/aws-sigv4.md
new file mode 100644
index 0000000000..517cc1c5b0
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/aws-sigv4.md
@@ -0,0 +1,30 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: aws-sigv4
+Protocols: HTTP
+Arg: <provider1[:prvdr2[:reg[:srv]]]>
+Help: AWS V4 signature auth
+Category: auth http
+Added: 7.75.0
+Multi: single
+See-also:
+  - basic
+  - user
+Example:
+  - --aws-sigv4 "aws:amz:us-east-2:es" --user "key:secret" $URL
+---
+
+# `--aws-sigv4`
+
+Use AWS V4 signature authentication in the transfer.
+
+The provider argument is a string that is used by the algorithm when creating
+outgoing authentication headers.
+
+The region argument is a string that points to a geographic area of
+a resources collection (region-code) when the region name is omitted from
+the endpoint.
+
+The service argument is a string that points to a function provided by a cloud
+(service-code) when the service name is omitted from the endpoint.
diff --git a/third-party/curl/docs/cmdline-opts/basic.d b/third-party/curl/docs/cmdline-opts/basic.d
deleted file mode 100644
index cb0642620e..0000000000
--- a/third-party/curl/docs/cmdline-opts/basic.d
+++ /dev/null
@@ -1,17 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: basic
-Help: Use HTTP Basic Authentication
-See-also: proxy-basic
-Protocols: HTTP
-Category: auth
-Example: -u name:password --basic $URL
-Added: 7.10.6
-Multi: mutex
----
-Tells curl to use HTTP Basic authentication with the remote host. This is the
-default and this option is usually pointless, unless you use it to override a
-previously set option that sets a different authentication method (such as
---ntlm, --digest, or --negotiate).
-
-Used together with --user.
diff --git a/third-party/curl/docs/cmdline-opts/basic.md b/third-party/curl/docs/cmdline-opts/basic.md
new file mode 100644
index 0000000000..1c372fbc71
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/basic.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: basic
+Help: HTTP Basic Authentication
+Protocols: HTTP
+Category: auth
+Added: 7.10.6
+Multi: boolean
+See-also:
+  - proxy-basic
+Example:
+  - -u name:password --basic $URL
+---
+
+# `--basic`
+
+Use HTTP Basic authentication with the remote host. This method is the default
+and this option is usually pointless, unless you use it to override a
+previously set option that sets a different authentication method (such as
+--ntlm, --digest, or --negotiate).
+
+Used together with --user.
diff --git a/third-party/curl/docs/cmdline-opts/ca-native.d b/third-party/curl/docs/cmdline-opts/ca-native.d
deleted file mode 100644
index 51e36918aa..0000000000
--- a/third-party/curl/docs/cmdline-opts/ca-native.d
+++ /dev/null
@@ -1,21 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ca-native
-Help: Use CA certificates from the native OS
-Protocols: TLS
-Category: tls
-See-also: cacert capath insecure
-Example: --ca-native $URL
-Added: 8.2.0
-Multi: boolean
----
-Tells curl to use the CA store from the native operating system to verify the
-peer. By default, curl otherwise uses a CA store provided in a single file or
-directory, but when using this option it interfaces the operating system's
-own vault.
-
-This option only works for curl on Windows when built to use OpenSSL. When
-curl on Windows is built to use Schannel, this feature is implied and curl
-then only uses the native CA store.
-
-curl built with wolfSSL also supports this option (added in 8.3.0).
diff --git a/third-party/curl/docs/cmdline-opts/ca-native.md b/third-party/curl/docs/cmdline-opts/ca-native.md
new file mode 100644
index 0000000000..67fdf8c3ac
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ca-native.md
@@ -0,0 +1,44 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ca-native
+Help: Load CA certs from the OS
+Protocols: TLS
+Category: tls
+Added: 8.2.0
+Multi: boolean
+See-also:
+  - cacert
+  - capath
+  - dump-ca-embed
+  - insecure
+  - proxy-ca-native
+Example:
+  - --ca-native $URL
+---
+
+# `--ca-native`
+
+Use the operating system's native CA store for certificate verification.
+
+This option is independent of other CA certificate locations set at run time or
+build time. Those locations are searched in addition to the native CA store.
+
+This option works with OpenSSL and its forks (BoringSSL, LibreSSL, etc) on
+Windows (Added in 7.71.0) and on Apple OS when libcurl is built with
+Apple SecTrust enabled. (Added in 8.17.0)
+
+This option works with wolfSSL on Windows, Linux (Debian, Ubuntu, Gentoo,
+Fedora, RHEL), macOS, Android and iOS. (Added in 8.3.0)
+
+This option works with GnuTLS (Added in 8.5.0) and also uses Apple
+SecTrust when libcurl is built with it. (Added in 8.17.0)
+
+This option works with Rustls on Windows, macOS, Android and iOS. On Linux it
+is equivalent to using the Mozilla CA certificate bundle. When used with Rustls
+_only_ the native CA store is consulted, not other locations set at run time or
+build time. (Added in 8.13.0)
+
+This option currently has no effect for Schannel. This is the native TLS
+library from Microsoft, that by default uses the native CA store for
+verification unless overridden by a CA certificate location setting.
diff --git a/third-party/curl/docs/cmdline-opts/cacert.d b/third-party/curl/docs/cmdline-opts/cacert.d
deleted file mode 100644
index 5e4e74901e..0000000000
--- a/third-party/curl/docs/cmdline-opts/cacert.d
+++ /dev/null
@@ -1,35 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: cacert
-Arg: <file>
-Help: CA certificate to verify peer against
-Protocols: TLS
-Category: tls
-See-also: capath insecure
-Example: --cacert CA-file.txt $URL
-Added: 7.5
-Multi: single
----
-Tells curl to use the specified certificate file to verify the peer. The file
-may contain multiple CA certificates. The certificate(s) must be in PEM
-format. Normally curl is built to use a default file for this, so this option
-is typically used to alter that default file.
-
-curl recognizes the environment variable named 'CURL_CA_BUNDLE' if it is
-set, and uses the given path as a path to a CA cert bundle. This option
-overrides that variable.
-
-The windows version of curl automatically looks for a CA certs file named
-'curl-ca-bundle.crt', either in the same directory as curl.exe, or in the
-Current Working Directory, or in any folder along your PATH.
-
-(iOS and macOS only) If curl is built against Secure Transport, then this
-option is supported for backward compatibility with other SSL engines, but it
-should not be set. If the option is not set, then curl uses the certificates
-in the system and user Keychain to verify the peer, which is the preferred
-method of verifying the peer's certificate chain.
-
-(Schannel only) This option is supported for Schannel in Windows 7 or later
-(added in 7.60.0). This option is supported for backward compatibility with
-other SSL engines; instead it is recommended to use Windows' store of root
-certificates (the default for Schannel).
diff --git a/third-party/curl/docs/cmdline-opts/cacert.md b/third-party/curl/docs/cmdline-opts/cacert.md
new file mode 100644
index 0000000000..ae9be3824b
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/cacert.md
@@ -0,0 +1,40 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: cacert
+Arg: <file>
+Help: CA certificate to verify peer against
+Protocols: TLS
+Category: tls
+Added: 7.5
+Multi: single
+See-also:
+  - capath
+  - dump-ca-embed
+  - insecure
+Example:
+  - --cacert CA-file.txt $URL
+---
+
+# `--cacert`
+
+Use the specified certificate file to verify the peer. The file may contain
+multiple CA certificates. The certificate(s) must be in PEM format. Normally
+curl is built to use a default file for this, so this option is typically used
+to alter that default file.
+
+curl recognizes the environment variable named 'CURL_CA_BUNDLE' if it is set
+and the TLS backend is not Schannel, and uses the given path as a path to a CA
+cert bundle. This option overrides that variable.
+
+(Windows) curl automatically looks for a CA certs file named
+'curl-ca-bundle.crt', either in the same directory as curl.exe, or in the
+Current Working Directory, or in any folder along your PATH.
+
+curl 8.11.0 added a build-time option to disable this search behavior, and
+another option to restrict search to the application's directory.
+
+(Schannel) This option is supported for Schannel in Windows 7 or later (added
+in 7.60.0). This option is supported for backward compatibility with other SSL
+engines; instead it is recommended to use Windows' store of root certificates
+(the default for Schannel).
diff --git a/third-party/curl/docs/cmdline-opts/capath.d b/third-party/curl/docs/cmdline-opts/capath.d
deleted file mode 100644
index 75e9f2e400..0000000000
--- a/third-party/curl/docs/cmdline-opts/capath.d
+++ /dev/null
@@ -1,21 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: capath
-Arg: <dir>
-Help: CA directory to verify peer against
-Protocols: TLS
-Category: tls
-See-also: cacert insecure
-Example: --capath /local/directory $URL
-Added: 7.9.8
-Multi: single
----
-Tells curl to use the specified certificate directory to verify the
-peer. Multiple paths can be provided by separating them with ":" (e.g.
-"path1:path2:path3"). The certificates must be in PEM format, and if curl is
-built against OpenSSL, the directory must have been processed using the
-c_rehash utility supplied with OpenSSL. Using --capath can allow
-OpenSSL-powered curl to make SSL-connections much more efficiently than using
---cacert if the --cacert file contains many CA certificates.
-
-If this option is set, the default capath value is ignored.
diff --git a/third-party/curl/docs/cmdline-opts/capath.md b/third-party/curl/docs/cmdline-opts/capath.md
new file mode 100644
index 0000000000..68bc86fbbc
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/capath.md
@@ -0,0 +1,31 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: capath
+Arg: <dir>
+Help: CA directory to verify peer against
+Protocols: TLS
+Category: tls
+Added: 7.9.8
+Multi: single
+See-also:
+  - cacert
+  - dump-ca-embed
+  - insecure
+Example:
+  - --capath /local/directory $URL
+---
+
+# `--capath`
+
+Use the specified certificate directory to verify the peer. If curl is built against
+OpenSSL, multiple paths can be provided by separating them with the appropriate platform-specific
+separator (e.g. `path1:path2:path3` on Unix-style platforms for `path1;path2;path3` on Windows).
+
+The certificates must be in PEM format, and if curl is built against OpenSSL, the
+directory must have been processed using the c_rehash utility supplied with
+OpenSSL. Using --capath can allow OpenSSL-powered curl to make SSL-connections
+much more efficiently than using --cacert if the --cacert file contains many
+CA certificates.
+
+If this option is set, the default capath value is ignored.
diff --git a/third-party/curl/docs/cmdline-opts/cert-status.d b/third-party/curl/docs/cmdline-opts/cert-status.d
deleted file mode 100644
index e2d1d7aa24..0000000000
--- a/third-party/curl/docs/cmdline-opts/cert-status.d
+++ /dev/null
@@ -1,19 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: cert-status
-Protocols: TLS
-Added: 7.41.0
-Help: Verify the status of the server cert via OCSP-staple
-Category: tls
-See-also: pinnedpubkey
-Example: --cert-status $URL
-Multi: boolean
----
-Tells curl to verify the status of the server certificate by using the
-Certificate Status Request (aka. OCSP stapling) TLS extension.
-
-If this option is enabled and the server sends an invalid (e.g. expired)
-response, if the response suggests that the server certificate has been
-revoked, or no response at all is received, the verification fails.
-
-This is currently only implemented in the OpenSSL and GnuTLS backends.
diff --git a/third-party/curl/docs/cmdline-opts/cert-status.md b/third-party/curl/docs/cmdline-opts/cert-status.md
new file mode 100644
index 0000000000..8b6e57b9ed
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/cert-status.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: cert-status
+Protocols: TLS
+Added: 7.41.0
+Help: Verify server cert status OCSP-staple
+Category: tls
+Multi: boolean
+See-also:
+  - pinnedpubkey
+Example:
+  - --cert-status $URL
+---
+
+# `--cert-status`
+
+Verify the status of the server certificate by using the Certificate Status
+Request (aka. OCSP stapling) TLS extension.
+
+If this option is enabled and the server sends an invalid (e.g. expired)
+response, if the response suggests that the server certificate has been
+revoked, or no response at all is received, the verification fails.
+
+This support is currently only implemented in the OpenSSL and GnuTLS backends.
diff --git a/third-party/curl/docs/cmdline-opts/cert-type.d b/third-party/curl/docs/cmdline-opts/cert-type.d
deleted file mode 100644
index cf9f17b7d5..0000000000
--- a/third-party/curl/docs/cmdline-opts/cert-type.d
+++ /dev/null
@@ -1,18 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: cert-type
-Protocols: TLS
-Arg: <type>
-Help: Certificate type (DER/PEM/ENG/P12)
-See-also: cert key key-type
-Category: tls
-Example: --cert-type PEM --cert file $URL
-Added: 7.9.3
-Multi: single
----
-Tells curl what type the provided client certificate is using. PEM, DER, ENG
-and P12 are recognized types.
-
-The default type depends on the TLS backend and is usually PEM, however for
-Secure Transport and Schannel it is P12. If --cert is a pkcs11: URI then ENG is
-the default type.
diff --git a/third-party/curl/docs/cmdline-opts/cert-type.md b/third-party/curl/docs/cmdline-opts/cert-type.md
new file mode 100644
index 0000000000..a96587ff63
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/cert-type.md
@@ -0,0 +1,26 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: cert-type
+Protocols: TLS
+Arg: <type>
+Help: Certificate type (DER/PEM/ENG/PROV/P12)
+Category: tls
+Added: 7.9.3
+Multi: single
+See-also:
+  - cert
+  - key
+  - key-type
+Example:
+  - --cert-type PEM --cert file $URL
+---
+
+# `--cert-type`
+
+Set type of the provided client certificate. PEM, DER, ENG, PROV and P12 are
+recognized types.
+
+The default type depends on the TLS backend and is usually PEM. For Schannel
+it is P12. If --cert is a pkcs11: URI then ENG or PROV is the default type
+(depending on OpenSSL version).
diff --git a/third-party/curl/docs/cmdline-opts/cert.d b/third-party/curl/docs/cmdline-opts/cert.d
deleted file mode 100644
index 56d0df7fdf..0000000000
--- a/third-party/curl/docs/cmdline-opts/cert.d
+++ /dev/null
@@ -1,49 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Short: E
-Long: cert
-Arg: <certificate[:password]>
-Help: Client certificate file and password
-Protocols: TLS
-See-also: cert-type key key-type
-Category: tls
-Example: --cert certfile --key keyfile $URL
-Added: 5.0
-Multi: single
----
-Tells curl to use the specified client certificate file when getting a file
-with HTTPS, FTPS or another SSL-based protocol. The certificate must be in
-PKCS#12 format if using Secure Transport, or PEM format if using any other
-engine. If the optional password is not specified, it is queried for on
-the terminal. Note that this option assumes a certificate file that is the
-private key and the client certificate concatenated. See --cert and --key to
-specify them independently.
-
-In the <certificate> portion of the argument, you must escape the character ":"
-as "\\:" so that it is not recognized as the password delimiter. Similarly, you
-must escape the character "\\" as "\\\\" so that it is not recognized as an
-escape character.
-
-If curl is built against OpenSSL library, and the engine pkcs11 is available,
-then a PKCS#11 URI (RFC 7512) can be used to specify a certificate located in
-a PKCS#11 device. A string beginning with "pkcs11:" is interpreted as a
-PKCS#11 URI. If a PKCS#11 URI is provided, then the --engine option is set as
-"pkcs11" if none was provided and the --cert-type option is set as "ENG" if
-none was provided.
-
-(iOS and macOS only) If curl is built against Secure Transport, then the
-certificate string can either be the name of a certificate/private key in the
-system or user keychain, or the path to a PKCS#12-encoded certificate and
-private key. If you want to use a file from the current directory, please
-precede it with "./" prefix, in order to avoid confusion with a nickname.
-
-(Schannel only) Client certificates must be specified by a path
-expression to a certificate store. (Loading *PFX* is not supported; you can
-import it to a store first). You can use
-"<store location>\\<store name>\\<thumbprint>" to refer to a certificate
-in the system certificates store, for example,
-*"CurrentUser\\MY\\934a7ac6f8a5d579285a74fa61e19f23ddfe8d7a"*. Thumbprint is
-usually a SHA-1 hex string which you can see in certificate details. Following
-store locations are supported: *CurrentUser*, *LocalMachine*, *CurrentService*,
-*Services*, *CurrentUserGroupPolicy*, *LocalMachineGroupPolicy* and
-*LocalMachineEnterprise*.
diff --git a/third-party/curl/docs/cmdline-opts/cert.md b/third-party/curl/docs/cmdline-opts/cert.md
new file mode 100644
index 0000000000..2bc3d8fa29
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/cert.md
@@ -0,0 +1,53 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Short: E
+Long: cert
+Arg: <certificate[:password]>
+Help: Client certificate file and password
+Protocols: TLS
+Category: tls
+Added: 5.0
+Multi: single
+See-also:
+  - cert-type
+  - key
+  - key-type
+Example:
+  - --cert certfile --key keyfile $URL
+---
+
+# `--cert`
+
+Use the specified client certificate file when getting a file with HTTPS, FTPS
+or another SSL-based protocol. The certificate must be PEM format. If the
+optional password is not specified, it is queried for on the terminal. Note
+that this option assumes a certificate file that is the private key and the
+client certificate concatenated. See --cert and --key to specify them
+independently.
+
+In the \<certificate\> portion of the argument, you must escape the character
+`:` as `\:` so that it is not recognized as the password delimiter. Similarly,
+you must escape the double quote character as \" so that it is not recognized
+as an escape character.
+
+If curl is built against OpenSSL, and the engine pkcs11 or pkcs11
+provider is available, then a PKCS#11 URI (RFC 7512) can be used to specify a
+certificate located in a PKCS#11 device. A string beginning with `pkcs11:` is
+interpreted as a PKCS#11 URI. If a PKCS#11 URI is provided, then the --engine
+option is set as `pkcs11` if none was provided and the --cert-type option is
+set as `ENG` or `PROV` if none was provided (depending on OpenSSL version).
+
+If curl is built against GnuTLS, a PKCS#11 URI can be used to specify
+a certificate located in a PKCS#11 device. A string beginning with `pkcs11:`
+is interpreted as a PKCS#11 URI.
+
+(Schannel) Client certificates must be specified by a path expression to a
+certificate store. (Loading *PFX* is not supported; you can import it to a
+store first). You can use "\<store location\>\\<store name\>\\<thumbprint\>"
+to refer to a certificate in the system certificates store, for example,
+*"CurrentUser\MY\934a7ac6f8a5d579285a74fa61e19f23ddfe8d7a"*. Thumbprint is
+usually a SHA-1 hex string which you can see in certificate details. Following
+store locations are supported: *CurrentUser*, *LocalMachine*,
+*CurrentService*, *Services*, *CurrentUserGroupPolicy*,
+*LocalMachineGroupPolicy* and *LocalMachineEnterprise*.
diff --git a/third-party/curl/docs/cmdline-opts/ciphers.d b/third-party/curl/docs/cmdline-opts/ciphers.d
deleted file mode 100644
index a30902bdb8..0000000000
--- a/third-party/curl/docs/cmdline-opts/ciphers.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ciphers
-Arg: <list of ciphers>
-Help: SSL ciphers to use
-Protocols: TLS
-Category: tls
-See-also: tlsv1.3 tls13-ciphers proxy-ciphers
-Example: --ciphers ECDHE-ECDSA-AES256-CCM8 $URL
-Added: 7.9
-Multi: single
----
-Specifies which ciphers to use in the connection. The list of ciphers must
-specify valid ciphers. Read up on SSL cipher list details on this URL:
-
-https://curl.se/docs/ssl-ciphers.html
diff --git a/third-party/curl/docs/cmdline-opts/ciphers.md b/third-party/curl/docs/cmdline-opts/ciphers.md
new file mode 100644
index 0000000000..14f0425dbf
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ciphers.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ciphers
+Arg: <list>
+Help: TLS 1.2 (1.1, 1.0) ciphers to use
+Protocols: TLS
+Category: tls
+Added: 7.9
+Multi: single
+See-also:
+  - tls13-ciphers
+  - proxy-ciphers
+  - curves
+Example:
+  - --ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256 $URL
+---
+
+# `--ciphers`
+
+Specify which cipher suites to use in the connection if it negotiates TLS 1.2
+(1.1, 1.0). The list of ciphers suites must specify valid ciphers. Read up on
+cipher suite details on this URL:
+
+https://curl.se/docs/ssl-ciphers.html
diff --git a/third-party/curl/docs/cmdline-opts/compressed-ssh.d b/third-party/curl/docs/cmdline-opts/compressed-ssh.d
deleted file mode 100644
index 897395677b..0000000000
--- a/third-party/curl/docs/cmdline-opts/compressed-ssh.d
+++ /dev/null
@@ -1,13 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: compressed-ssh
-Help: Enable SSH compression
-Protocols: SCP SFTP
-Added: 7.56.0
-Category: scp ssh
-See-also: compressed
-Example: --compressed-ssh sftp://example.com/
-Multi: boolean
----
-Enables built-in SSH compression.
-This is a request, not an order; the server may or may not do it.
diff --git a/third-party/curl/docs/cmdline-opts/compressed-ssh.md b/third-party/curl/docs/cmdline-opts/compressed-ssh.md
new file mode 100644
index 0000000000..07d3981b48
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/compressed-ssh.md
@@ -0,0 +1,20 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: compressed-ssh
+Help: Enable SSH compression
+Protocols: SCP SFTP
+Added: 7.56.0
+Category: scp ssh
+Multi: boolean
+See-also:
+  - compressed
+Example:
+  - --compressed-ssh sftp://example.com/
+---
+
+# `--compressed-ssh`
+
+Enable SSH compression. This is a request, not an order; the server may or may
+not do it. This allows the data to be sent compressed over the wire, and
+automatically decompressed in the receiving end, to save bandwidth.
diff --git a/third-party/curl/docs/cmdline-opts/compressed.d b/third-party/curl/docs/cmdline-opts/compressed.d
deleted file mode 100644
index bb1d3baa74..0000000000
--- a/third-party/curl/docs/cmdline-opts/compressed.d
+++ /dev/null
@@ -1,21 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: compressed
-Help: Request compressed response
-Protocols: HTTP
-Category: http
-Example: --compressed $URL
-See-also: compressed-ssh
-Added: 7.10
-Multi: boolean
----
-Request a compressed response using one of the algorithms curl supports, and
-automatically decompress the content.
-
-Response headers are not modified when saved, so if they are "interpreted"
-separately again at a later point they might appear to be saying that the
-content is (still) compressed; while in fact it has already been decompressed.
-
-If this option is used and the server sends an unsupported encoding, curl
-reports an error. This is a request, not an order; the server may or may not
-deliver data compressed.
diff --git a/third-party/curl/docs/cmdline-opts/compressed.md b/third-party/curl/docs/cmdline-opts/compressed.md
new file mode 100644
index 0000000000..712f93df19
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/compressed.md
@@ -0,0 +1,32 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: compressed
+Help: Request compressed response
+Protocols: HTTP
+Category: http
+Added: 7.10
+Multi: boolean
+See-also:
+  - compressed-ssh
+Example:
+  - --compressed $URL
+---
+
+# `--compressed`
+
+Request a compressed response using one of the algorithms curl supports, and
+automatically decompress the content.
+
+Response headers are not modified when saved, so if they are "interpreted"
+separately again at a later point they might appear to be saying that the
+content is (still) compressed; while in fact it has already been decompressed.
+
+If this option is used and the server sends an unsupported encoding, curl
+reports an error. This is a request, not an order; the server may or may not
+deliver data compressed.
+
+**WARNING**: when decompressing data, even tiny transfers might be expanded
+and generate a huge amount of bytes. You might want to limit using this option
+to only known and trusted sites using secure protocols, perhaps in combination
+with --max-filesize.
diff --git a/third-party/curl/docs/cmdline-opts/config.d b/third-party/curl/docs/cmdline-opts/config.d
deleted file mode 100644
index c22a827f61..0000000000
--- a/third-party/curl/docs/cmdline-opts/config.d
+++ /dev/null
@@ -1,77 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: config
-Arg: <file>
-Help: Read config from a file
-Short: K
-Category: curl
-Example: --config file.txt $URL
-Added: 4.10
-See-also: disable
-Multi: append
----
-Specify a text file to read curl arguments from. The command line arguments
-found in the text file are used as if they were provided on the command
-line.
-
-Options and their parameters must be specified on the same line in the file,
-separated by whitespace, colon, or the equals sign. Long option names can
-optionally be given in the config file without the initial double dashes and
-if so, the colon or equals characters can be used as separators. If the option
-is specified with one or two dashes, there can be no colon or equals character
-between the option and its parameter.
-
-If the parameter contains whitespace or starts with a colon (:) or equals sign
-(=), it must be specified enclosed within double quotes (\&"). Within double
-quotes the following escape sequences are available: \\\\, \\", \\t, \\n, \\r
-and \\v. A backslash preceding any other letter is ignored.
-
-If the first non-blank column of a config line is a '#' character, that line
-is treated as a comment.
-
-Only write one option per physical line in the config file. A single line is
-required to be no more than 10 megabytes (since 8.2.0).
-
-Specify the filename to --config as '-' to make curl read the file from stdin.
-
-Note that to be able to specify a URL in the config file, you need to specify
-it using the --url option, and not by simply writing the URL on its own
-line. So, it could look similar to this:
-
-url = "https://curl.se/docs/"
-
- # --- Example file ---
- # this is a comment
- url = "example.com"
- output = "curlhere.html"
- user-agent = "superagent/1.0"
-
- # and fetch another URL too
- url = "example.com/docs/manpage.html"
- -O
- referer = "http://nowhereatall.example.com/"
- # --- End of example file ---
-
-When curl is invoked, it (unless --disable is used) checks for a default
-config file and uses it if found, even when --config is used. The default
-config file is checked for in the following places in this order:
-
-1) **"$CURL_HOME/.curlrc"**
-
-2) **"$XDG_CONFIG_HOME/curlrc"** (Added in 7.73.0)
-
-3) **"$HOME/.curlrc"**
-
-4) Windows: **"%USERPROFILE%\\.curlrc"**
-
-5) Windows: **"%APPDATA%\\.curlrc"**
-
-6) Windows: **"%USERPROFILE%\\Application Data\\.curlrc"**
-
-7) Non-Windows: use getpwuid to find the home directory
-
-8) On Windows, if it finds no *.curlrc* file in the sequence described above, it
-checks for one in the same dir the curl executable is placed.
-
-On Windows two filenames are checked per location: *.curlrc* and *_curlrc*,
-preferring the former. Older versions on Windows checked for *_curlrc* only.
diff --git a/third-party/curl/docs/cmdline-opts/config.md b/third-party/curl/docs/cmdline-opts/config.md
new file mode 100644
index 0000000000..637918df75
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/config.md
@@ -0,0 +1,84 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: config
+Arg: <file>
+Help: Read config from a file
+Short: K
+Category: curl
+Added: 4.10
+Multi: append
+See-also:
+  - disable
+Example:
+  - --config file.txt $URL
+---
+
+# `--config`
+
+Specify a text file to read curl arguments from. The command line arguments
+found in the text file are used as if they were provided on the command
+line.
+
+Options and their parameters must be specified on the same line in the file,
+separated by whitespace, colon, or the equals sign. Long option names can
+optionally be given in the config file without the initial double dashes and
+if so, the colon or equals characters can be used as separators. If the option
+is specified with one or two dashes, there can be no colon or equals character
+between the option and its parameter.
+
+If the parameter contains whitespace or starts with a colon (:) or equals sign
+(=), it must be specified enclosed within double quotes ("like this"). Within
+double quotes the following escape sequences are available: \\, \", \t, \n, \r
+and \v. A backslash preceding any other letter is ignored.
+
+If the first non-blank column of a config line is a '#' character, that line
+is treated as a comment.
+
+Only write one option per physical line in the config file. A single line is
+required to be no more than 10 megabytes (since 8.2.0).
+
+Specify the filename to --config as minus "-" to make curl read the file from
+stdin.
+
+Note that to be able to specify a URL in the config file, you need to specify
+it using the --url option, and not by writing the URL on its own line.
+It could look similar to this:
+
+    url = "https://curl.se/docs/"
+
+    # --- Example file ---
+    # this is a comment
+    url = "example.com"
+    output = "curlhere.html"
+    user-agent = "superagent/1.0"
+
+    # and fetch another URL too
+    url = "example.com/docs/manpage.html"
+    -O
+    referer = "http://nowhereatall.example.com/"
+    # --- End of example file ---
+
+When curl is invoked, it (unless --disable is used) checks for a default
+config file and uses it if found, even when --config is used. The default
+config file is checked for in the following places in this order:
+
+1) **"$CURL_HOME/.curlrc"**
+
+2) **"$XDG_CONFIG_HOME/curlrc"** (Added in 7.73.0)
+
+3) **"$HOME/.curlrc"**
+
+4) Windows: **"%USERPROFILE%\.curlrc"**
+
+5) Windows: **"%APPDATA%\.curlrc"**
+
+6) Windows: **"%USERPROFILE%\Application Data\.curlrc"**
+
+7) Non-Windows: use getpwuid to find the home directory
+
+8) On Windows, if it finds no *.curlrc* file in the sequence described above, it
+checks for one in the same directory the curl executable is placed.
+
+On Windows two filenames are checked per location: *.curlrc* and *_curlrc*,
+preferring the former. Older versions on Windows checked for *_curlrc* only.
diff --git a/third-party/curl/docs/cmdline-opts/connect-timeout.d b/third-party/curl/docs/cmdline-opts/connect-timeout.d
deleted file mode 100644
index b3d19b3c33..0000000000
--- a/third-party/curl/docs/cmdline-opts/connect-timeout.d
+++ /dev/null
@@ -1,22 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: connect-timeout
-Arg: <fractional seconds>
-Help: Maximum time allowed for connection
-See-also: max-time
-Category: connection
-Example: --connect-timeout 20 $URL
-Example: --connect-timeout 3.14 $URL
-Added: 7.7
-Multi: single
----
-Maximum time in seconds that you allow curl's connection to take.  This only
-limits the connection phase, so if curl connects within the given period it
-continues - if not it exits.
-
-This option accepts decimal values (added in 7.32.0). The decimal value needs
-to be provided using a dot (.) as decimal separator - not the local version
-even if it might be using another separator.
-
-The connection phase is considered complete when the DNS lookup and requested
-TCP, TLS or QUIC handshakes are done.
diff --git a/third-party/curl/docs/cmdline-opts/connect-timeout.md b/third-party/curl/docs/cmdline-opts/connect-timeout.md
new file mode 100644
index 0000000000..dc5f927040
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/connect-timeout.md
@@ -0,0 +1,28 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: connect-timeout
+Arg: <seconds>
+Help: Maximum time allowed to connect
+Category: connection timeout
+Added: 7.7
+Multi: single
+See-also:
+  - max-time
+Example:
+  - --connect-timeout 20 $URL
+  - --connect-timeout 3.14 $URL
+---
+
+# `--connect-timeout`
+
+Maximum time in seconds that you allow curl's connection to take. This only
+limits the connection phase, so if curl connects within the given period it
+continues - if not it exits.
+
+This option accepts decimal values (added in 7.32.0). The decimal value needs
+to be provided using a dot (.) as decimal separator - not the local version
+even if it might be using another separator.
+
+The connection phase is considered complete when the DNS lookup and requested
+TCP, TLS or QUIC handshakes are done.
diff --git a/third-party/curl/docs/cmdline-opts/connect-to.d b/third-party/curl/docs/cmdline-opts/connect-to.d
deleted file mode 100644
index 95fab91121..0000000000
--- a/third-party/curl/docs/cmdline-opts/connect-to.d
+++ /dev/null
@@ -1,24 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: connect-to
-Arg: <HOST1:PORT1:HOST2:PORT2>
-Help: Connect to host
-Added: 7.49.0
-See-also: resolve header
-Category: connection
-Example: --connect-to example.com:443:example.net:8443 $URL
-Multi: append
----
-
-For a request to the given HOST1:PORT1 pair, connect to HOST2:PORT2 instead.
-This option is suitable to direct requests at a specific server, e.g. at a
-specific cluster node in a cluster of servers. This option is only used to
-establish the network connection. It does NOT affect the hostname/port that is
-used for TLS/SSL (e.g. SNI, certificate verification) or for the application
-protocols. "HOST1" and "PORT1" may be the empty string, meaning "any
-host/port". "HOST2" and "PORT2" may also be the empty string, meaning "use the
-request's original host/port".
-
-A "host" specified to this option is compared as a string, so it needs to
-match the name used in request URL. It can be either numerical such as
-"127.0.0.1" or the full host name such as "example.org".
diff --git a/third-party/curl/docs/cmdline-opts/connect-to.md b/third-party/curl/docs/cmdline-opts/connect-to.md
new file mode 100644
index 0000000000..c7378318e2
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/connect-to.md
@@ -0,0 +1,40 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: connect-to
+Arg: <HOST1:PORT1:HOST2:PORT2>
+Help: Connect to host2 instead of host1
+Added: 7.49.0
+Category: connection dns
+Multi: append
+See-also:
+  - resolve
+  - header
+Example:
+  - --connect-to example.com:443:example.net:8443 $URL
+---
+
+# `--connect-to`
+
+For a request intended for the `HOST1:PORT1` pair, connect to `HOST2:PORT2`
+instead. This option is only used to establish the network connection. It does
+NOT affect the hostname/port number that is used for TLS/SSL (e.g. SNI,
+certificate verification) or for the application protocols.
+
+`HOST1` and `PORT1` may be empty strings, meaning any host or any port number.
+`HOST2` and `PORT2` may also be empty strings, meaning use the request's
+original hostname and port number.
+
+A hostname specified to this option is compared as a string, so it needs to
+match the name used in the request URL. It can be either numerical such as
+`127.0.0.1` or the full hostname such as `example.org`.
+
+Example: redirect connects from the example.com hostname to 127.0.0.1
+independently of port number:
+
+    curl --connect-to example.com::127.0.0.1: https://example.com/
+
+Example: redirect connects from all hostnames to 127.0.0.1 independently of
+port number:
+
+    curl --connect-to ::127.0.0.1: http://example.com/
diff --git a/third-party/curl/docs/cmdline-opts/continue-at.d b/third-party/curl/docs/cmdline-opts/continue-at.d
deleted file mode 100644
index a4fc1a9695..0000000000
--- a/third-party/curl/docs/cmdline-opts/continue-at.d
+++ /dev/null
@@ -1,20 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Short: C
-Long: continue-at
-Arg: <offset>
-Help: Resumed transfer offset
-See-also: range
-Category: connection
-Example: -C - $URL
-Example: -C 400 $URL
-Added: 4.8
-Multi: single
----
-Continue/Resume a previous file transfer at the given offset. The given offset
-is the exact number of bytes that are skipped, counting from the beginning
-of the source file before it is transferred to the destination. If used with
-uploads, the FTP server command SIZE is not used by curl.
-
-Use "-C -" to tell curl to automatically find out where/how to resume the
-transfer. It then uses the given output/input files to figure that out.
diff --git a/third-party/curl/docs/cmdline-opts/continue-at.md b/third-party/curl/docs/cmdline-opts/continue-at.md
new file mode 100644
index 0000000000..67a1376093
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/continue-at.md
@@ -0,0 +1,37 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Short: C
+Long: continue-at
+Arg: <offset>
+Help: Resumed transfer offset
+Category: connection
+Added: 4.8
+Multi: single
+See-also:
+  - range
+Example:
+  - -C - $URL
+  - -C 400 $URL
+---
+
+# `--continue-at`
+
+Resume a previous transfer from the given byte offset. The given offset is the
+exact number of bytes that are skipped, counting from the beginning of the
+source file before it is transferred to the destination. If used with uploads,
+the FTP server command SIZE is not used by curl.
+
+Use "-C -" to instruct curl to automatically find out where/how to resume the
+transfer. It then uses the given output/input files to figure that out.
+
+When using this option for HTTP uploads using POST or PUT, functionality is
+not guaranteed. The HTTP protocol has no standard interoperable resume upload
+and curl uses a set of headers for this purpose that once proved working for
+some servers and have been left for those who find that useful.
+
+This command line option is mutually exclusive with --range: you can only use
+one of them for a single transfer.
+
+The --no-clobber and --remove-on-error options cannot be used together with
+--continue-at.
diff --git a/third-party/curl/docs/cmdline-opts/cookie-jar.d b/third-party/curl/docs/cmdline-opts/cookie-jar.d
deleted file mode 100644
index 28738cac94..0000000000
--- a/third-party/curl/docs/cmdline-opts/cookie-jar.d
+++ /dev/null
@@ -1,31 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Short: c
-Long: cookie-jar
-Arg: <filename>
-Protocols: HTTP
-Help: Write cookies to <filename> after operation
-Category: http
-Example: -c store-here.txt $URL
-Example: -c store-here.txt -b read-these $URL
-Added: 7.9
-See-also: cookie
-Multi: single
----
-Specify to which file you want curl to write all cookies after a completed
-operation. Curl writes all cookies from its in-memory cookie storage to the
-given file at the end of operations. If no cookies are known, no data is
-written. The file is created using the Netscape cookie file format. If you set
-the file name to a single dash, "-", the cookies are written to stdout.
-
-The file specified with --cookie-jar is only used for output. No cookies are
-read from the file. To read cookies, use the --cookie option. Both options
-can specify the same file.
-
-This command line option activates the cookie engine that makes curl record
-and use cookies. The --cookie option also activates it.
-
-If the cookie jar cannot be created or written to, the whole curl operation
-does not fail or even report an error clearly. Using --verbose gets a warning
-displayed, but that is the only visible feedback you get about this possibly
-lethal situation.
diff --git a/third-party/curl/docs/cmdline-opts/cookie-jar.md b/third-party/curl/docs/cmdline-opts/cookie-jar.md
new file mode 100644
index 0000000000..de09fd5274
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/cookie-jar.md
@@ -0,0 +1,42 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Short: c
+Long: cookie-jar
+Arg: <filename>
+Protocols: HTTP
+Help: Save cookies to <filename> after operation
+Category: http
+Added: 7.9
+Multi: single
+See-also:
+  - cookie
+  - junk-session-cookies
+Example:
+  - -c store-here.txt $URL
+  - -c store-here.txt -b read-these $URL
+---
+
+# `--cookie-jar`
+
+Specify to which file you want curl to write all cookies after a completed
+operation. curl writes all cookies from its in-memory cookie storage to the
+given file at the end of operations. Even if no cookies are known, a file is
+created so that it removes any formerly existing cookies from the file. The
+file uses the Netscape cookie file format. If you set the filename to a single
+minus, "-", the cookies are written to stdout.
+
+The file specified with --cookie-jar is only used for output. No cookies are
+read from the file. To read cookies, use the --cookie option. Both options
+can specify the same file.
+
+This command line option activates the cookie engine that makes curl record
+and use cookies. The --cookie option also activates it.
+
+If the cookie jar cannot be created or written to, the whole curl operation
+does not fail or even report an error clearly. Using --verbose gets a warning
+displayed, but that is the only visible feedback you get about this possibly
+lethal situation.
+
+You may want to restrict your umask to prevent other users on the same system
+to access the created file.
diff --git a/third-party/curl/docs/cmdline-opts/cookie.d b/third-party/curl/docs/cmdline-opts/cookie.d
deleted file mode 100644
index 0f858d6613..0000000000
--- a/third-party/curl/docs/cmdline-opts/cookie.d
+++ /dev/null
@@ -1,42 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Short: b
-Long: cookie
-Arg: <data|filename>
-Protocols: HTTP
-Help: Send cookies from string/file
-Category: http
-Example: -b cookiefile $URL
-Example: -b cookiefile -c cookiefile $URL
-See-also: cookie-jar junk-session-cookies
-Added: 4.9
-Multi: append
----
-Pass the data to the HTTP server in the Cookie header. It is supposedly the
-data previously received from the server in a "Set-Cookie:" line. The data
-should be in the format "NAME1=VALUE1; NAME2=VALUE2". This makes curl use the
-cookie header with this content explicitly in all outgoing request(s). If
-multiple requests are done due to authentication, followed redirects or
-similar, they all get this cookie passed on.
-
-If no '=' symbol is used in the argument, it is instead treated as a filename
-to read previously stored cookie from. This option also activates the cookie
-engine which makes curl record incoming cookies, which may be handy if you are
-using this in combination with the --location option or do multiple URL
-transfers on the same invoke. If the file name is exactly a minus ("-"), curl
-instead reads the contents from stdin.
-
-The file format of the file to read cookies from should be plain HTTP headers
-(Set-Cookie style) or the Netscape/Mozilla cookie file format.
-
-The file specified with --cookie is only used as input. No cookies are written
-to the file. To store cookies, use the --cookie-jar option.
-
-If you use the Set-Cookie file format and do not specify a domain then the
-cookie is not sent since the domain never matches. To address this, set a
-domain in Set-Cookie line (doing that includes subdomains) or preferably: use
-the Netscape format.
-
-Users often want to both read cookies from a file and write updated cookies
-back to a file, so using both --cookie and --cookie-jar in the same command
-line is common.
diff --git a/third-party/curl/docs/cmdline-opts/cookie.md b/third-party/curl/docs/cmdline-opts/cookie.md
new file mode 100644
index 0000000000..30288fbcba
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/cookie.md
@@ -0,0 +1,63 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Short: b
+Long: cookie
+Arg: <data|filename>
+Protocols: HTTP
+Help: Send cookies from string/load from file
+Category: http
+Added: 4.9
+Multi: append
+See-also:
+  - cookie-jar
+  - junk-session-cookies
+Example:
+  - -b "" $URL
+  - -b cookiefile $URL
+  - -b cookiefile -c cookiefile $URL
+  - -b name=Jane $URL
+---
+
+# `--cookie`
+
+This option has two slightly separate cookie sending functions.
+
+Either: pass the exact data to send to the HTTP server in the Cookie header.
+It is supposedly data previously received from the server in a `Set-Cookie:`
+line. The data should be in the format `NAME1=VALUE1; NAME2=VALUE2`. When
+given a set of specific cookies, curl populates its cookie header with this
+content explicitly in all outgoing request(s). If multiple requests are done
+due to authentication, followed redirects or similar, they all get this cookie
+header passed on.
+
+Or: If no `=` symbol is used in the argument, it is instead treated as a
+filename to read previously stored cookie from. This option also activates the
+cookie engine which makes curl record incoming cookies, which may be handy if
+you are using this in combination with the --location option or do multiple
+URL transfers on the same invoke.
+
+If the filename is a single minus ("-"), curl reads the contents from stdin.
+If the filename is an empty string ("") and is the only cookie input, curl
+activates the cookie engine without any cookies.
+
+The file format of the file to read cookies from should be plain HTTP headers
+(Set-Cookie style) or the Netscape/Mozilla cookie file format.
+
+The file specified with --cookie is only used as input. No cookies are written
+to that file. To store cookies, use the --cookie-jar option.
+
+If you use the Set-Cookie file format and do not specify a domain then the
+cookie is not sent since the domain never matches. To address this, set a
+domain in Set-Cookie line (doing that includes subdomains) or preferably: use
+the Netscape format.
+
+Users often want to both read cookies from a file and write updated cookies
+back to a file, so using both --cookie and --cookie-jar in the same command
+line is common. curl ignores filenames specified with --cookie which do not
+exist or point to a directory.
+
+If curl is built with PSL (**Public Suffix List**) support, it detects and
+discards cookies that are specified for such suffix domains that should not be
+allowed to have cookies. If curl is *not* built with PSL support, it has no
+ability to stop super cookies.
diff --git a/third-party/curl/docs/cmdline-opts/create-dirs.d b/third-party/curl/docs/cmdline-opts/create-dirs.d
deleted file mode 100644
index f137e7d10d..0000000000
--- a/third-party/curl/docs/cmdline-opts/create-dirs.d
+++ /dev/null
@@ -1,19 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: create-dirs
-Help: Create necessary local directory hierarchy
-Category: curl
-Example: --create-dirs --output local/dir/file $URL
-Added: 7.10.3
-See-also: ftp-create-dirs output-dir
-Multi: boolean
----
-When used in conjunction with the --output option, curl creates the necessary
-local directory hierarchy as needed. This option creates the directories
-mentioned with the --output option, nothing else. If the --output file name
-uses no directory, or if the directories it mentions already exist, no
-directories are created.
-
-Created directories are made with mode 0750 on unix style file systems.
-
-To create remote directories when using FTP or SFTP, try --ftp-create-dirs.
diff --git a/third-party/curl/docs/cmdline-opts/create-dirs.md b/third-party/curl/docs/cmdline-opts/create-dirs.md
new file mode 100644
index 0000000000..89d24f76b5
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/create-dirs.md
@@ -0,0 +1,26 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: create-dirs
+Help: Create necessary local directory hierarchy
+Category: output
+Added: 7.10.3
+Multi: boolean
+See-also:
+  - ftp-create-dirs
+  - output-dir
+Example:
+  - --create-dirs --output local/dir/file $URL
+---
+
+# `--create-dirs`
+
+When used in conjunction with the --output option, curl creates the necessary
+local directory hierarchy as needed. This option creates the directories
+mentioned with the --output option combined with the path possibly set with
+--output-dir. If the combined output filename uses no directory, or if the
+directories it mentions already exist, no directories are created.
+
+Created directories are made with mode 0750 on Unix-style file systems.
+
+To create remote directories when using FTP or SFTP, try --ftp-create-dirs.
diff --git a/third-party/curl/docs/cmdline-opts/create-file-mode.d b/third-party/curl/docs/cmdline-opts/create-file-mode.d
deleted file mode 100644
index c0ebc08d44..0000000000
--- a/third-party/curl/docs/cmdline-opts/create-file-mode.d
+++ /dev/null
@@ -1,17 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: create-file-mode
-Arg: <mode>
-Help: File mode for created files
-Protocols: SFTP SCP FILE
-Category: sftp scp file upload
-See-also: ftp-create-dirs
-Added: 7.75.0
-Example: --create-file-mode 0777 -T localfile sftp://example.com/new
-Multi: single
----
-When curl is used to create files remotely using one of the supported
-protocols, this option allows the user to set which 'mode' to set on the file
-at creation time, instead of the default 0644.
-
-This option takes an octal number as argument.
diff --git a/third-party/curl/docs/cmdline-opts/create-file-mode.md b/third-party/curl/docs/cmdline-opts/create-file-mode.md
new file mode 100644
index 0000000000..c6467d15a4
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/create-file-mode.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: create-file-mode
+Arg: <mode>
+Help: File mode for created files
+Protocols: SFTP SCP FILE
+Category: sftp scp file upload
+Added: 7.75.0
+Multi: single
+See-also:
+  - ftp-create-dirs
+Example:
+  - --create-file-mode 0777 -T localfile sftp://example.com/new
+---
+
+# `--create-file-mode`
+
+When curl is used to create files remotely using one of the supported
+protocols, this option allows the user to set which 'mode' to set on the file
+at creation time, instead of the default 0644.
+
+This option takes an octal number as argument.
diff --git a/third-party/curl/docs/cmdline-opts/crlf.d b/third-party/curl/docs/cmdline-opts/crlf.d
deleted file mode 100644
index ea7fb1526a..0000000000
--- a/third-party/curl/docs/cmdline-opts/crlf.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: crlf
-Help: Convert LF to CRLF in upload
-Protocols: FTP SMTP
-Category: ftp smtp
-Example: --crlf -T file ftp://example.com/
-Added: 5.7
-See-also: use-ascii
-Multi: boolean
----
-Convert line feeds to carriage return plus line feeds in upload. Useful for
-**MVS (OS/390)**.
-
-(SMTP added in 7.40.0)
diff --git a/third-party/curl/docs/cmdline-opts/crlf.md b/third-party/curl/docs/cmdline-opts/crlf.md
new file mode 100644
index 0000000000..c36884113d
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/crlf.md
@@ -0,0 +1,19 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: crlf
+Help: Convert LF to CRLF in upload
+Protocols: FTP SMTP
+Category: ftp smtp
+Added: 5.7
+Multi: boolean
+See-also:
+  - use-ascii
+Example:
+  - --crlf -T file ftp://example.com/
+---
+
+# `--crlf`
+
+Convert line feeds to carriage return plus line feeds in upload. Useful for
+**MVS (OS/390)**.
diff --git a/third-party/curl/docs/cmdline-opts/crlfile.d b/third-party/curl/docs/cmdline-opts/crlfile.d
deleted file mode 100644
index da0d239bad..0000000000
--- a/third-party/curl/docs/cmdline-opts/crlfile.d
+++ /dev/null
@@ -1,14 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: crlfile
-Arg: <file>
-Protocols: TLS
-Help: Use this CRL list
-Added: 7.19.7
-Category: tls
-Example: --crlfile rejects.txt $URL
-See-also: cacert capath
-Multi: single
----
-Provide a file using PEM format with a Certificate Revocation List that may
-specify peer certificates that are to be considered revoked.
diff --git a/third-party/curl/docs/cmdline-opts/crlfile.md b/third-party/curl/docs/cmdline-opts/crlfile.md
new file mode 100644
index 0000000000..a762af09f1
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/crlfile.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: crlfile
+Arg: <file>
+Protocols: TLS
+Help: Certificate Revocation list
+Added: 7.19.7
+Category: tls
+Multi: single
+See-also:
+  - cacert
+  - capath
+Example:
+  - --crlfile rejects.txt $URL
+---
+
+# `--crlfile`
+
+Provide a file using PEM format with a Certificate Revocation List that may
+specify peer certificates that are to be considered revoked.
diff --git a/third-party/curl/docs/cmdline-opts/curves.d b/third-party/curl/docs/cmdline-opts/curves.d
deleted file mode 100644
index 58d472d20d..0000000000
--- a/third-party/curl/docs/cmdline-opts/curves.d
+++ /dev/null
@@ -1,22 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: curves
-Arg: <algorithm list>
-Help: (EC) TLS key exchange algorithm(s) to request
-Protocols: TLS
-Added: 7.73.0
-Category: tls
-Example: --curves X25519 $URL
-See-also: ciphers
-Multi: single
----
-Tells curl to request specific curves to use during SSL session establishment
-according to RFC 8422, 5.1.  Multiple algorithms can be provided by separating
-them with ":" (e.g.  "X25519:P-521").  The parameter is available identically
-in the "openssl s_client/s_server" utilities.
-
---curves allows a OpenSSL powered curl to make SSL-connections with exactly
-the (EC) curve requested by the client, avoiding nontransparent client/server
-negotiations.
-
-If this option is set, the default curves list built into OpenSSL are ignored.
diff --git a/third-party/curl/docs/cmdline-opts/curves.md b/third-party/curl/docs/cmdline-opts/curves.md
new file mode 100644
index 0000000000..9473aeaa7a
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/curves.md
@@ -0,0 +1,28 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: curves
+Arg: <list>
+Help: (EC) TLS key exchange algorithms to request
+Protocols: TLS
+Added: 7.73.0
+Category: tls
+Multi: single
+See-also:
+  - ciphers
+Example:
+  - --curves X25519 $URL
+---
+
+# `--curves`
+
+Set specific curves to use during SSL session establishment according to RFC
+8422, 5.1. Multiple algorithms can be provided by separating them with `:`
+(e.g. `X25519:P-521`). The parameter is available identically in the OpenSSL
+`s_client` and `s_server` utilities.
+
+--curves allows a OpenSSL powered curl to make SSL-connections with exactly
+the (EC) curve requested by the client, avoiding nontransparent client/server
+negotiations.
+
+If this option is set, the default curves list built into OpenSSL are ignored.
diff --git a/third-party/curl/docs/cmdline-opts/data-ascii.d b/third-party/curl/docs/cmdline-opts/data-ascii.d
deleted file mode 100644
index 5c7840bbc4..0000000000
--- a/third-party/curl/docs/cmdline-opts/data-ascii.d
+++ /dev/null
@@ -1,13 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: data-ascii
-Arg: <data>
-Help: HTTP POST ASCII data
-Protocols: HTTP
-Category: http post upload
-Example: --data-ascii @file $URL
-Added: 7.2
-See-also: data-binary data-raw data-urlencode
-Multi: append
----
-This is just an alias for --data.
diff --git a/third-party/curl/docs/cmdline-opts/data-ascii.md b/third-party/curl/docs/cmdline-opts/data-ascii.md
new file mode 100644
index 0000000000..c1d9d75bbd
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/data-ascii.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: data-ascii
+Arg: <data>
+Help: HTTP POST ASCII data
+Protocols: HTTP
+Category: http post upload
+Added: 7.2
+Multi: append
+See-also:
+  - data-binary
+  - data-raw
+  - data-urlencode
+Example:
+  - --data-ascii @file $URL
+---
+
+# `--data-ascii`
+
+This option is an alias for --data.
diff --git a/third-party/curl/docs/cmdline-opts/data-binary.d b/third-party/curl/docs/cmdline-opts/data-binary.d
deleted file mode 100644
index 2cedda97b0..0000000000
--- a/third-party/curl/docs/cmdline-opts/data-binary.d
+++ /dev/null
@@ -1,25 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: data-binary
-Arg: <data>
-Help: HTTP POST binary data
-Protocols: HTTP
-Category: http post upload
-Example: --data-binary @filename $URL
-Added: 7.2
-See-also: data-ascii
-Multi: append
----
-This posts data exactly as specified with no extra processing whatsoever.
-
-If you start the data with the letter @, the rest should be a filename. Data
-is posted in a similar manner as --data does, except that newlines and
-carriage returns are preserved and conversions are never done.
-
-Like --data the default content-type sent to the server is
-application/x-www-form-urlencoded. If you want the data to be treated as
-arbitrary binary data by the server then set the content-type to octet-stream:
--H "Content-Type: application/octet-stream".
-
-If this option is used several times, the ones following the first append
-data as described in --data.
diff --git a/third-party/curl/docs/cmdline-opts/data-binary.md b/third-party/curl/docs/cmdline-opts/data-binary.md
new file mode 100644
index 0000000000..4c5e4da8d1
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/data-binary.md
@@ -0,0 +1,32 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: data-binary
+Arg: <data>
+Help: HTTP POST binary data
+Protocols: HTTP
+Category: http post upload
+Added: 7.2
+Multi: append
+See-also:
+  - data-ascii
+Example:
+  - --data-binary @filename $URL
+---
+
+# `--data-binary`
+
+Post data exactly as specified with no extra processing whatsoever.
+
+If you start the data with the letter @, the rest should be a filename.
+`@-` makes curl read the data from stdin. Data is posted in a similar
+manner as --data does, except that newlines and carriage returns are
+preserved and conversions are never done.
+
+Like --data the default content-type sent to the server is
+application/x-www-form-urlencoded. If you want the data to be treated as
+arbitrary binary data by the server then set the content-type to octet-stream:
+-H "Content-Type: application/octet-stream".
+
+If this option is used several times, the ones following the first append
+data as described in --data.
diff --git a/third-party/curl/docs/cmdline-opts/data-raw.d b/third-party/curl/docs/cmdline-opts/data-raw.d
deleted file mode 100644
index e6a5a5b2b9..0000000000
--- a/third-party/curl/docs/cmdline-opts/data-raw.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: data-raw
-Arg: <data>
-Protocols: HTTP
-Help: HTTP POST data, '@' allowed
-Added: 7.43.0
-See-also: data
-Category: http post upload
-Example: --data-raw "hello" $URL
-Example: --data-raw "@at@at@" $URL
-Multi: append
----
-This posts data similarly to --data but without the special
-interpretation of the @ character.
diff --git a/third-party/curl/docs/cmdline-opts/data-raw.md b/third-party/curl/docs/cmdline-opts/data-raw.md
new file mode 100644
index 0000000000..1033678bde
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/data-raw.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: data-raw
+Arg: <data>
+Protocols: HTTP
+Help: HTTP POST data, '@' allowed
+Added: 7.43.0
+Category: http post upload
+Multi: append
+See-also:
+  - data
+Example:
+  - --data-raw "hello" $URL
+  - --data-raw "@at@at@" $URL
+---
+
+# `--data-raw`
+
+Post data similarly to --data but without the special interpretation of the @
+character.
diff --git a/third-party/curl/docs/cmdline-opts/data-urlencode.d b/third-party/curl/docs/cmdline-opts/data-urlencode.d
deleted file mode 100644
index 3c436b26b1..0000000000
--- a/third-party/curl/docs/cmdline-opts/data-urlencode.d
+++ /dev/null
@@ -1,42 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: data-urlencode
-Arg: <data>
-Help: HTTP POST data URL encoded
-Protocols: HTTP
-See-also: data data-raw
-Added: 7.18.0
-Category: http post upload
-Example: --data-urlencode name=val $URL
-Example: --data-urlencode =encodethis $URL
-Example: --data-urlencode name@file $URL
-Example: --data-urlencode @fileonly $URL
-Multi: append
----
-This posts data, similar to the other --data options with the exception
-that this performs URL-encoding.
-
-To be CGI-compliant, the <data> part should begin with a *name* followed
-by a separator and a content specification. The <data> part can be passed to
-curl using one of the following syntaxes:
-.RS
-.IP "content"
-This makes curl URL-encode the content and pass that on. Just be careful
-so that the content does not contain any = or @ symbols, as that makes
-the syntax match one of the other cases below!
-.IP "=content"
-This makes curl URL-encode the content and pass that on. The preceding =
-symbol is not included in the data.
-.IP "name=content"
-This makes curl URL-encode the content part and pass that on. Note that
-the name part is expected to be URL-encoded already.
-.IP "@filename"
-This makes curl load data from the given file (including any newlines),
-URL-encode that data and pass it on in the POST.
-.IP "name@filename"
-This makes curl load data from the given file (including any newlines),
-URL-encode that data and pass it on in the POST. The name part gets an equal
-sign appended, resulting in *name=urlencoded-file-content*. Note that the
-name is expected to be URL-encoded already.
-.RE
-.IP
diff --git a/third-party/curl/docs/cmdline-opts/data-urlencode.md b/third-party/curl/docs/cmdline-opts/data-urlencode.md
new file mode 100644
index 0000000000..36fdf3df2f
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/data-urlencode.md
@@ -0,0 +1,51 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: data-urlencode
+Arg: <data>
+Help: HTTP POST data URL encoded
+Protocols: HTTP
+Added: 7.18.0
+Category: http post upload
+Multi: append
+See-also:
+  - data
+  - data-raw
+Example:
+  - --data-urlencode name=val $URL
+  - --data-urlencode =encodethis $URL
+  - --data-urlencode name@file $URL
+  - --data-urlencode @fileonly $URL
+---
+
+# `--data-urlencode`
+
+Post data, similar to the other --data options with the exception that this
+performs URL-encoding.
+
+To be CGI-compliant, the \<data\> part should begin with a *name* followed by
+a separator and a content specification. The \<data\> part can be passed to
+curl using one of the following syntaxes:
+
+## content
+URL-encode the content and pass that on. Be careful so that the content does
+not contain any `=` or `@` symbols, as that makes the syntax match one of the
+other cases below.
+
+## =content
+URL-encode the content and pass that on. The preceding `=` symbol is not
+included in the data.
+
+## name=content
+URL-encode the content part and pass that on. Note that the name part is
+expected to be URL-encoded already.
+
+## @filename
+load data from the given file (including any newlines), URL-encode that data
+and pass it on in the POST. Using `@-` makes curl read the data from stdin.
+
+## name@filename
+load data from the given file (including any newlines), URL-encode that data
+and pass it on in the POST. The name part gets an equal sign appended,
+resulting in *name=urlencoded-file-content*. Note that the name is expected to
+be URL-encoded already.
diff --git a/third-party/curl/docs/cmdline-opts/data.d b/third-party/curl/docs/cmdline-opts/data.d
deleted file mode 100644
index f1d67b9506..0000000000
--- a/third-party/curl/docs/cmdline-opts/data.d
+++ /dev/null
@@ -1,41 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: data
-Short: d
-Arg: <data>
-Help: HTTP POST data
-Protocols: HTTP MQTT
-See-also: data-binary data-urlencode data-raw
-Mutexed: form head upload-file
-Category: important http post upload
-Example: -d "name=curl" $URL
-Example: -d "name=curl" -d "tool=cmdline" $URL
-Example: -d @filename $URL
-Added: 4.0
-Multi: append
----
-Sends the specified data in a POST request to the HTTP server, in the same way
-that a browser does when a user has filled in an HTML form and presses the
-submit button. This makes curl pass the data to the server using the
-content-type application/x-www-form-urlencoded. Compare to --form.
-
---data-raw is almost the same but does not have a special interpretation of
-the @ character. To post data purely binary, you should instead use the
---data-binary option. To URL-encode the value of a form field you may use
---data-urlencode.
-
-If any of these options is used more than once on the same command line, the
-data pieces specified are merged with a separating &-symbol. Thus, using
-'-d name=daniel -d skill=lousy' would generate a post chunk that looks like
-'name=daniel&skill=lousy'.
-
-If you start the data with the letter @, the rest should be a file name to
-read the data from, or - if you want curl to read the data from stdin. Posting
-data from a file named 'foobar' would thus be done with --data @foobar. When
---data is told to read from a file like that, carriage returns and newlines
-are stripped out. If you do not want the @ character to have a special
-interpretation use --data-raw instead.
-
-The data for this option is passed on to the server exactly as provided on the
-command line. curl does not convert, change or improve it. It is up to the
-user to provide the data in the correct form.
diff --git a/third-party/curl/docs/cmdline-opts/data.md b/third-party/curl/docs/cmdline-opts/data.md
new file mode 100644
index 0000000000..d95b023953
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/data.md
@@ -0,0 +1,49 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: data
+Short: d
+Arg: <data>
+Help: HTTP POST data
+Protocols: HTTP MQTT
+Mutexed: form head upload-file
+Category: important http post upload
+Added: 4.0
+Multi: append
+See-also:
+  - data-binary
+  - data-urlencode
+  - data-raw
+Example:
+  - -d "name=curl" $URL
+  - -d "name=curl" -d "tool=cmdline" $URL
+  - -d @filename $URL
+---
+
+# `--data`
+
+Send the specified data in a POST request to the HTTP server, in the same way
+that a browser does when a user has filled in an HTML form and presses the
+submit button. This option makes curl pass the data to the server using the
+content-type application/x-www-form-urlencoded. Compared to --form.
+
+--data-raw is almost the same but does not have a special interpretation of
+the @ character. To post data purely binary, you should instead use the
+--data-binary option. To URL-encode the value of a form field you may use
+--data-urlencode.
+
+If any of these options is used more than once on the same command line, the
+data pieces specified are merged with a separating &-symbol. Thus, using
+'-d name=daniel -d skill=lousy' would generate a post chunk that looks like
+'name=daniel&skill=lousy'.
+
+If you start the data with the letter @, the rest should be a filename to read
+the data from, or - if you want curl to read the data from stdin. Posting data
+from a file named 'foobar' would thus be done with --data @foobar. When --data
+is told to read from a file like that, carriage returns, newlines and null
+bytes are stripped out. If you do not want the @ character to have a special
+interpretation use --data-raw instead.
+
+The data for this option is passed on to the server exactly as provided on the
+command line. curl does not convert, change or improve it. It is up to the
+user to provide the data in the correct form.
diff --git a/third-party/curl/docs/cmdline-opts/delegation.d b/third-party/curl/docs/cmdline-opts/delegation.d
deleted file mode 100644
index 7941849347..0000000000
--- a/third-party/curl/docs/cmdline-opts/delegation.d
+++ /dev/null
@@ -1,24 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: delegation
-Arg: <LEVEL>
-Help: GSS-API delegation permission
-Protocols: GSS/kerberos
-Category: auth
-Example: --delegation "none" $URL
-Added: 7.22.0
-See-also: insecure ssl
-Multi: single
----
-Set LEVEL to tell the server what it is allowed to delegate when it
-comes to user credentials.
-.RS
-.IP "none"
-Do not allow any delegation.
-.IP "policy"
-Delegates if and only if the OK-AS-DELEGATE flag is set in the Kerberos
-service ticket, which is a matter of realm policy.
-.IP "always"
-Unconditionally allow the server to delegate.
-.RE
-.IP
diff --git a/third-party/curl/docs/cmdline-opts/delegation.md b/third-party/curl/docs/cmdline-opts/delegation.md
new file mode 100644
index 0000000000..c874a2b59d
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/delegation.md
@@ -0,0 +1,30 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: delegation
+Arg: <LEVEL>
+Help: GSS-API delegation permission
+Protocols: GSS/kerberos
+Category: auth
+Added: 7.22.0
+Multi: single
+See-also:
+  - insecure
+  - ssl
+Example:
+  - --delegation "none" $URL
+---
+
+# `--delegation`
+
+Set LEVEL what curl is allowed to delegate when it comes to user credentials.
+
+## none
+Do not allow any delegation.
+
+## policy
+Delegates if and only if the OK-AS-DELEGATE flag is set in the Kerberos
+service ticket, which is a matter of realm policy.
+
+## always
+Unconditionally allow the server to delegate.
diff --git a/third-party/curl/docs/cmdline-opts/digest.d b/third-party/curl/docs/cmdline-opts/digest.d
deleted file mode 100644
index f2ee551c5e..0000000000
--- a/third-party/curl/docs/cmdline-opts/digest.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: digest
-Help: Use HTTP Digest Authentication
-Protocols: HTTP
-Mutexed: basic ntlm negotiate
-See-also: user proxy-digest anyauth
-Category: proxy auth http
-Example: -u name:password --digest $URL
-Added: 7.10.6
-Multi: boolean
----
-Enables HTTP Digest authentication. This is an authentication scheme that
-prevents the password from being sent over the wire in clear text. Use this in
-combination with the normal --user option to set user name and password.
diff --git a/third-party/curl/docs/cmdline-opts/digest.md b/third-party/curl/docs/cmdline-opts/digest.md
new file mode 100644
index 0000000000..c67d7894c8
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/digest.md
@@ -0,0 +1,22 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: digest
+Help: HTTP Digest Authentication
+Protocols: HTTP
+Category: proxy auth http
+Added: 7.10.6
+Multi: boolean
+See-also:
+  - user
+  - proxy-digest
+  - anyauth
+Example:
+  - -u name:password --digest $URL
+---
+
+# `--digest`
+
+Enable HTTP Digest authentication. This authentication scheme avoids sending
+the password over the wire in clear text. Use this in combination with the
+normal --user option to set username and password.
diff --git a/third-party/curl/docs/cmdline-opts/disable-eprt.d b/third-party/curl/docs/cmdline-opts/disable-eprt.d
deleted file mode 100644
index b6d382bafa..0000000000
--- a/third-party/curl/docs/cmdline-opts/disable-eprt.d
+++ /dev/null
@@ -1,25 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: disable-eprt
-Help: Inhibit using EPRT or LPRT
-Protocols: FTP
-Category: ftp
-Example: --disable-eprt ftp://example.com/
-Added: 7.10.5
-See-also: disable-epsv ftp-port
-Multi: boolean
----
-Tell curl to disable the use of the EPRT and LPRT commands when doing active
-FTP transfers. Curl normally first attempts to use EPRT before using PORT, but
-with this option, it uses PORT right away. EPRT is an extension to the
-original FTP protocol, and does not work on all servers, but enables more
-functionality in a better way than the traditional PORT command.
-
---eprt can be used to explicitly enable EPRT again and --no-eprt is an alias
-for --disable-eprt.
-
-If the server is accessed using IPv6, this option has no effect as EPRT is
-necessary then.
-
-Disabling EPRT only changes the active behavior. If you want to switch to
-passive mode you need to not use --ftp-port or force it with --ftp-pasv.
diff --git a/third-party/curl/docs/cmdline-opts/disable-eprt.md b/third-party/curl/docs/cmdline-opts/disable-eprt.md
new file mode 100644
index 0000000000..768b689c13
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/disable-eprt.md
@@ -0,0 +1,32 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: disable-eprt
+Help: Inhibit using EPRT or LPRT
+Protocols: FTP
+Category: ftp
+Added: 7.10.5
+Multi: boolean
+See-also:
+  - disable-epsv
+  - ftp-port
+Example:
+  - --disable-eprt ftp://example.com/
+---
+
+# `--disable-eprt`
+
+Disable the use of the EPRT and LPRT commands when doing active FTP transfers.
+curl normally first attempts to use EPRT before using PORT, but with this
+option, it uses PORT right away. EPRT is an extension to the original FTP
+protocol, and does not work on all servers, but enables more functionality in
+a better way than the traditional PORT command.
+
+--eprt can be used to explicitly enable EPRT again and --no-eprt is an alias
+for --disable-eprt.
+
+If the server is accessed using IPv6, this option has no effect as EPRT is
+necessary then.
+
+Disabling EPRT only changes the active behavior. If you want to switch to
+passive mode you need to not use --ftp-port or force it with --ftp-pasv.
diff --git a/third-party/curl/docs/cmdline-opts/disable-epsv.d b/third-party/curl/docs/cmdline-opts/disable-epsv.d
deleted file mode 100644
index f02df763da..0000000000
--- a/third-party/curl/docs/cmdline-opts/disable-epsv.d
+++ /dev/null
@@ -1,23 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: disable-epsv
-Help: Inhibit using EPSV
-Protocols: FTP
-Category: ftp
-Example: --disable-epsv ftp://example.com/
-Added: 7.9.2
-See-also: disable-eprt ftp-port
-Multi: boolean
----
-Tell curl to disable the use of the EPSV command when doing passive FTP
-transfers. Curl normally first attempts to use EPSV before PASV, but with this
-option, it does not try EPSV.
-
---epsv can be used to explicitly enable EPSV again and --no-epsv is an alias
-for --disable-epsv.
-
-If the server is an IPv6 host, this option has no effect as EPSV is necessary
-then.
-
-Disabling EPSV only changes the passive behavior. If you want to switch to
-active mode you need to use --ftp-port.
diff --git a/third-party/curl/docs/cmdline-opts/disable-epsv.md b/third-party/curl/docs/cmdline-opts/disable-epsv.md
new file mode 100644
index 0000000000..d13e076907
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/disable-epsv.md
@@ -0,0 +1,30 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: disable-epsv
+Help: Inhibit using EPSV
+Protocols: FTP
+Category: ftp
+Added: 7.9.2
+Multi: boolean
+See-also:
+  - disable-eprt
+  - ftp-port
+Example:
+  - --disable-epsv ftp://example.com/
+---
+
+# `--disable-epsv`
+
+Disable the use of the EPSV command when doing passive FTP transfers. curl
+normally first attempts to use EPSV before PASV, but with this option, it does
+not try EPSV.
+
+--epsv can be used to explicitly enable EPSV again and --no-epsv is an alias
+for --disable-epsv.
+
+If the server is an IPv6 host, this option has no effect as EPSV is necessary
+then.
+
+Disabling EPSV only changes the passive behavior. If you want to switch to
+active mode you need to use --ftp-port.
diff --git a/third-party/curl/docs/cmdline-opts/disable.d b/third-party/curl/docs/cmdline-opts/disable.d
deleted file mode 100644
index 979c039915..0000000000
--- a/third-party/curl/docs/cmdline-opts/disable.d
+++ /dev/null
@@ -1,17 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: disable
-Short: q
-Help: Disable .curlrc
-Category: curl
-Example: -q $URL
-Added: 5.0
-See-also: config
-Multi: boolean
----
-If used as the **first** parameter on the command line, the *curlrc* config
-file is not read or used. See the --config for details on the default config
-file search path.
-
-Prior to 7.50.0 curl supported the short option name *q* but not the long
-option name *disable*.
diff --git a/third-party/curl/docs/cmdline-opts/disable.md b/third-party/curl/docs/cmdline-opts/disable.md
new file mode 100644
index 0000000000..1370b91d7b
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/disable.md
@@ -0,0 +1,20 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: disable
+Short: q
+Help: Disable .curlrc
+Category: curl
+Added: 5.0
+Multi: boolean
+See-also:
+  - config
+Example:
+  - -q $URL
+---
+
+# `--disable`
+
+If used as the **first** parameter on the command line, the *curlrc* config
+file is not read or used. See the --config for details on the default config
+file search path.
diff --git a/third-party/curl/docs/cmdline-opts/disallow-username-in-url.d b/third-party/curl/docs/cmdline-opts/disallow-username-in-url.d
deleted file mode 100644
index d0537db97a..0000000000
--- a/third-party/curl/docs/cmdline-opts/disallow-username-in-url.d
+++ /dev/null
@@ -1,13 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: disallow-username-in-url
-Help: Disallow username in URL
-Protocols: HTTP
-Added: 7.61.0
-See-also: proto
-Category: curl http
-Example: --disallow-username-in-url $URL
-Multi: boolean
----
-This tells curl to exit if passed a URL containing a username. This is probably
-most useful when the URL is being provided at runtime or similar.
diff --git a/third-party/curl/docs/cmdline-opts/disallow-username-in-url.md b/third-party/curl/docs/cmdline-opts/disallow-username-in-url.md
new file mode 100644
index 0000000000..0507f531cc
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/disallow-username-in-url.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: disallow-username-in-url
+Help: Disallow username in URL
+Added: 7.61.0
+Category: curl
+Multi: boolean
+See-also:
+  - proto
+Example:
+  - --disallow-username-in-url $URL
+---
+
+# `--disallow-username-in-url`
+
+Exit with error if passed a URL containing a username. Probably most useful
+when the URL is being provided at runtime or similar.
+
+Accepting and using credentials in a URL is normally considered a security
+hazard as they are easily leaked that way.
diff --git a/third-party/curl/docs/cmdline-opts/dns-interface.d b/third-party/curl/docs/cmdline-opts/dns-interface.d
deleted file mode 100644
index fd924b897a..0000000000
--- a/third-party/curl/docs/cmdline-opts/dns-interface.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: dns-interface
-Arg: <interface>
-Help: Interface to use for DNS requests
-Protocols: DNS
-See-also: dns-ipv4-addr dns-ipv6-addr
-Added: 7.33.0
-Requires: c-ares
-Category: dns
-Example: --dns-interface eth0 $URL
-Multi: single
----
-Tell curl to send outgoing DNS requests through <interface>. This option is a
-counterpart to --interface (which does not affect DNS). The supplied string
-must be an interface name (not an address).
diff --git a/third-party/curl/docs/cmdline-opts/dns-interface.md b/third-party/curl/docs/cmdline-opts/dns-interface.md
new file mode 100644
index 0000000000..aee7400bc5
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/dns-interface.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: dns-interface
+Arg: <interface>
+Help: Interface to use for DNS requests
+Protocols: DNS
+Added: 7.33.0
+Requires: c-ares
+Category: dns
+Multi: single
+See-also:
+  - dns-ipv4-addr
+  - dns-ipv6-addr
+Example:
+  - --dns-interface eth0 $URL
+---
+
+# `--dns-interface`
+
+Send outgoing DNS requests through the given interface. This option is a
+counterpart to --interface (which does not affect DNS). The supplied string
+must be an interface name (not an address).
diff --git a/third-party/curl/docs/cmdline-opts/dns-ipv4-addr.d b/third-party/curl/docs/cmdline-opts/dns-ipv4-addr.d
deleted file mode 100644
index 5930557397..0000000000
--- a/third-party/curl/docs/cmdline-opts/dns-ipv4-addr.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: dns-ipv4-addr
-Arg: <address>
-Help: IPv4 address to use for DNS requests
-Protocols: DNS
-See-also: dns-interface dns-ipv6-addr
-Added: 7.33.0
-Requires: c-ares
-Category: dns
-Example: --dns-ipv4-addr 10.1.2.3 $URL
-Multi: single
----
-Tell curl to bind to a specific IP address when making IPv4 DNS requests, so
-that the DNS requests originate from this address. The argument should be a
-single IPv4 address.
diff --git a/third-party/curl/docs/cmdline-opts/dns-ipv4-addr.md b/third-party/curl/docs/cmdline-opts/dns-ipv4-addr.md
new file mode 100644
index 0000000000..4a43cb1d90
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/dns-ipv4-addr.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: dns-ipv4-addr
+Arg: <address>
+Help: IPv4 address to use for DNS requests
+Protocols: DNS
+Added: 7.33.0
+Requires: c-ares
+Category: dns
+Multi: single
+See-also:
+  - dns-interface
+  - dns-ipv6-addr
+Example:
+  - --dns-ipv4-addr 10.1.2.3 $URL
+---
+
+# `--dns-ipv4-addr`
+
+Bind to a specific IP address when making IPv4 DNS requests, so that the DNS
+requests originate from this address. The argument should be a single IPv4
+address.
diff --git a/third-party/curl/docs/cmdline-opts/dns-ipv6-addr.d b/third-party/curl/docs/cmdline-opts/dns-ipv6-addr.d
deleted file mode 100644
index a76120cdc1..0000000000
--- a/third-party/curl/docs/cmdline-opts/dns-ipv6-addr.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: dns-ipv6-addr
-Arg: <address>
-Help: IPv6 address to use for DNS requests
-Protocols: DNS
-See-also: dns-interface dns-ipv4-addr
-Added: 7.33.0
-Requires: c-ares
-Category: dns
-Example: --dns-ipv6-addr 2a04:4e42::561 $URL
-Multi: single
----
-Tell curl to bind to a specific IP address when making IPv6 DNS requests, so
-that the DNS requests originate from this address. The argument should be a
-single IPv6 address.
diff --git a/third-party/curl/docs/cmdline-opts/dns-ipv6-addr.md b/third-party/curl/docs/cmdline-opts/dns-ipv6-addr.md
new file mode 100644
index 0000000000..7112311767
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/dns-ipv6-addr.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: dns-ipv6-addr
+Arg: <address>
+Help: IPv6 address to use for DNS requests
+Protocols: DNS
+Added: 7.33.0
+Requires: c-ares
+Category: dns
+Multi: single
+See-also:
+  - dns-interface
+  - dns-ipv4-addr
+Example:
+  - --dns-ipv6-addr 2a04:4e42::561 $URL
+---
+
+# `--dns-ipv6-addr`
+
+Bind to a specific IP address when making IPv6 DNS requests, so that the DNS
+requests originate from this address. The argument should be a single IPv6
+address.
diff --git a/third-party/curl/docs/cmdline-opts/dns-servers.d b/third-party/curl/docs/cmdline-opts/dns-servers.d
deleted file mode 100644
index bec23a3c35..0000000000
--- a/third-party/curl/docs/cmdline-opts/dns-servers.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: dns-servers
-Arg: <addresses>
-Help: DNS server addrs to use
-Requires: c-ares
-Added: 7.33.0
-Category: dns
-Example: --dns-servers 192.168.0.1,192.168.0.2 $URL
-See-also: dns-interface dns-ipv4-addr
-Multi: single
----
-Set the list of DNS servers to be used instead of the system default.
-The list of IP addresses should be separated with commas. Port numbers
-may also optionally be given as *:<port-number>* after each IP
-address.
diff --git a/third-party/curl/docs/cmdline-opts/dns-servers.md b/third-party/curl/docs/cmdline-opts/dns-servers.md
new file mode 100644
index 0000000000..bf6ba3fe93
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/dns-servers.md
@@ -0,0 +1,24 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: dns-servers
+Arg: <addresses>
+Help: DNS server addrs to use
+Protocols: DNS
+Requires: c-ares
+Added: 7.33.0
+Category: dns
+Multi: single
+See-also:
+  - dns-interface
+  - dns-ipv4-addr
+Example:
+  - --dns-servers 192.168.0.1,192.168.0.2 $URL
+  - --dns-servers 10.0.0.1:53 $URL
+---
+
+# `--dns-servers`
+
+Set the list of DNS servers to be used instead of the system default. The list
+of IP addresses should be separated with commas. Port numbers may also
+optionally be given, appended to the IP address separated with a colon.
diff --git a/third-party/curl/docs/cmdline-opts/doh-cert-status.d b/third-party/curl/docs/cmdline-opts/doh-cert-status.d
deleted file mode 100644
index 37ae0f8274..0000000000
--- a/third-party/curl/docs/cmdline-opts/doh-cert-status.d
+++ /dev/null
@@ -1,11 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: doh-cert-status
-Help: Verify the status of the DoH server cert via OCSP-staple
-Added: 7.76.0
-Category: dns tls
-Example: --doh-cert-status --doh-url https://doh.example $URL
-See-also: doh-insecure
-Multi: boolean
----
-Same as --cert-status but used for DoH (DNS-over-HTTPS).
diff --git a/third-party/curl/docs/cmdline-opts/doh-cert-status.md b/third-party/curl/docs/cmdline-opts/doh-cert-status.md
new file mode 100644
index 0000000000..445eb3dcd0
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/doh-cert-status.md
@@ -0,0 +1,27 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: doh-cert-status
+Help: Verify DoH server cert status OCSP-staple
+Added: 7.76.0
+Category: dns tls
+Protocols: DNS
+Multi: boolean
+See-also:
+  - doh-insecure
+Example:
+  - --doh-cert-status --doh-url https://doh.example $URL
+---
+
+# `--doh-cert-status`
+
+Same as --cert-status but used for DoH (DNS-over-HTTPS).
+
+Verify the status of the DoH servers' certificate by using the Certificate
+Status Request (aka. OCSP stapling) TLS extension.
+
+If this option is enabled and the DoH server sends an invalid (e.g. expired)
+response, if the response suggests that the server certificate has been
+revoked, or no response at all is received, the verification fails.
+
+This support is currently only implemented in the OpenSSL and GnuTLS backends.
diff --git a/third-party/curl/docs/cmdline-opts/doh-insecure.d b/third-party/curl/docs/cmdline-opts/doh-insecure.d
deleted file mode 100644
index dcc65fb6c9..0000000000
--- a/third-party/curl/docs/cmdline-opts/doh-insecure.d
+++ /dev/null
@@ -1,11 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: doh-insecure
-Help: Allow insecure DoH server connections
-Added: 7.76.0
-Category: dns tls
-Example: --doh-insecure --doh-url https://doh.example $URL
-See-also: doh-url
-Multi: boolean
----
-Same as --insecure but used for DoH (DNS-over-HTTPS).
diff --git a/third-party/curl/docs/cmdline-opts/doh-insecure.md b/third-party/curl/docs/cmdline-opts/doh-insecure.md
new file mode 100644
index 0000000000..ee1602a242
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/doh-insecure.md
@@ -0,0 +1,28 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: doh-insecure
+Help: Allow insecure DoH server connections
+Added: 7.76.0
+Category: dns tls
+Protocols: DNS
+Multi: boolean
+See-also:
+  - doh-url
+  - insecure
+  - proxy-insecure
+Example:
+  - --doh-insecure --doh-url https://doh.example $URL
+---
+
+# `--doh-insecure`
+
+By default, every connection curl makes to a DoH server is verified to be
+secure before the transfer takes place. This option tells curl to skip the
+verification step and proceed without checking.
+
+**WARNING**: using this option makes the DoH transfer and name resolution
+insecure.
+
+This option is equivalent to --insecure and --proxy-insecure but used for DoH
+(DNS-over-HTTPS) only.
diff --git a/third-party/curl/docs/cmdline-opts/doh-url.d b/third-party/curl/docs/cmdline-opts/doh-url.d
deleted file mode 100644
index 6d0dd1605e..0000000000
--- a/third-party/curl/docs/cmdline-opts/doh-url.d
+++ /dev/null
@@ -1,21 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: doh-url
-Arg: <URL>
-Help: Resolve host names over DoH
-Added: 7.62.0
-Category: dns
-Example: --doh-url https://doh.example $URL
-See-also: doh-insecure
-Multi: single
----
-Specifies which DNS-over-HTTPS (DoH) server to use to resolve hostnames,
-instead of using the default name resolver mechanism. The URL must be HTTPS.
-
-Some SSL options that you set for your transfer also applies to DoH since the
-name lookups take place over SSL. However, the certificate verification
-settings are not inherited but are controlled separately via --doh-insecure
-and --doh-cert-status.
-
-This option is unset if an empty string "" is used as the URL.
-(Added in 7.85.0)
diff --git a/third-party/curl/docs/cmdline-opts/doh-url.md b/third-party/curl/docs/cmdline-opts/doh-url.md
new file mode 100644
index 0000000000..3d146a789c
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/doh-url.md
@@ -0,0 +1,31 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: doh-url
+Arg: <URL>
+Help: Resolve hostnames over DoH
+Added: 7.62.0
+Category: dns
+Protocols: DNS
+Multi: single
+See-also:
+  - doh-insecure
+Example:
+  - --doh-url https://doh.example $URL
+  - --doh-url https://doh.example --resolve doh.example:443:192.0.2.1 $URL
+---
+
+# `--doh-url`
+
+Specify which DNS-over-HTTPS (DoH) server to use to resolve hostnames, instead
+of using the default name resolver mechanism. The URL must be HTTPS.
+
+Some SSL options that you set for your transfer also apply to DoH since the
+name lookups take place over SSL. The certificate verification settings are
+not inherited but are controlled separately via --doh-insecure and
+--doh-cert-status.
+
+By default, DoH is bypassed when initially looking up DNS records of the DoH server. You can specify the IP address(es) of the DoH server with --resolve to avoid this.
+
+This option is unset if an empty string "" is used as the URL.
+(Added in 7.85.0)
diff --git a/third-party/curl/docs/cmdline-opts/dump-ca-embed.md b/third-party/curl/docs/cmdline-opts/dump-ca-embed.md
new file mode 100644
index 0000000000..2ad123014b
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/dump-ca-embed.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: dump-ca-embed
+Help: Write the embedded CA bundle to standard output
+Protocols: TLS
+Category: http proxy tls
+Added: 8.10.0
+Multi: boolean
+See-also:
+  - ca-native
+  - cacert
+  - capath
+  - proxy-ca-native
+  - proxy-cacert
+  - proxy-capath
+Example:
+  - --dump-ca-embed
+---
+
+# `--dump-ca-embed`
+
+Write the CA bundle embedded in curl to standard output, then quit.
+
+If curl was not built with a default CA bundle embedded, the output is empty.
diff --git a/third-party/curl/docs/cmdline-opts/dump-header.d b/third-party/curl/docs/cmdline-opts/dump-header.d
deleted file mode 100644
index 42a79e7ddf..0000000000
--- a/third-party/curl/docs/cmdline-opts/dump-header.d
+++ /dev/null
@@ -1,21 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: dump-header
-Short: D
-Arg: <filename>
-Help: Write the received headers to <filename>
-Protocols: HTTP FTP
-See-also: output
-Category: http ftp
-Example: --dump-header store.txt $URL
-Added: 5.7
-Multi: single
----
-Write the received protocol headers to the specified file. If no headers are
-received, the use of this option creates an empty file.
-
-When used in FTP, the FTP server response lines are considered being "headers"
-and thus are saved there.
-
-Having multiple transfers in one set of operations (i.e. the URLs in one
---next clause), appends them to the same file, separated by a blank line.
diff --git a/third-party/curl/docs/cmdline-opts/dump-header.md b/third-party/curl/docs/cmdline-opts/dump-header.md
new file mode 100644
index 0000000000..bdb0e874e3
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/dump-header.md
@@ -0,0 +1,35 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: dump-header
+Short: D
+Arg: <filename>
+Help: Write the received headers to <filename>
+Protocols: HTTP FTP
+Category: http ftp
+Added: 5.7
+Multi: single
+See-also:
+  - output
+Example:
+  - --dump-header store.txt $URL
+  - --dump-header - $URL -o save
+---
+
+# `--dump-header`
+
+Write the received protocol headers to the specified file. If no headers are
+received, the use of this option creates an empty file. Specify `-` as
+filename (a single minus) to have it written to stdout.
+
+Starting in curl 8.10.0, specify `%` (a single percent sign) as filename
+writes the output to stderr.
+
+When used in FTP, the FTP server response lines are considered being "headers"
+and thus are saved there.
+
+Starting in curl 8.11.0, using the --create-dirs option can also create
+missing directory components for the path provided in --dump-header.
+
+Having multiple transfers in one set of operations (i.e. the URLs in one
+--next clause), appends them to the same file, separated by a blank line.
diff --git a/third-party/curl/docs/cmdline-opts/ech.md b/third-party/curl/docs/cmdline-opts/ech.md
new file mode 100644
index 0000000000..3d8f3873af
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ech.md
@@ -0,0 +1,52 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ech
+Arg: <config>
+Help: Configure ECH
+Added: 8.8.0
+Category: tls
+Protocols: HTTPS
+Multi: single
+See-also:
+  - doh-url
+Example:
+  - --ech true $URL
+---
+
+# `--ech`
+
+Specify how to do ECH (Encrypted Client Hello).
+
+The values allowed for \<config\> can be:
+
+## `false`
+
+Do not attempt ECH. The is the default.
+
+## `grease`
+
+Send a GREASE ECH extension
+
+## `true`
+
+Attempt ECH if possible, but do not fail if ECH is not attempted.
+(The connection fails if ECH is attempted but fails.)
+
+## `hard`
+
+Attempt ECH and fail if that is not possible. ECH only works with TLS 1.3 and
+also requires using DoH or providing an ECHConfigList on the command line.
+
+## `ecl:<b64val>`
+
+A base64 encoded ECHConfigList that is used for ECH.
+
+## `pn:<name>`
+
+A name to use to over-ride the `public_name` field of an ECHConfigList (only
+available with OpenSSL TLS support)
+
+##
+
+Most ECH related errors cause error *CURLE_ECH_REQUIRED* (101).
diff --git a/third-party/curl/docs/cmdline-opts/egd-file.d b/third-party/curl/docs/cmdline-opts/egd-file.d
deleted file mode 100644
index 4543ecf15e..0000000000
--- a/third-party/curl/docs/cmdline-opts/egd-file.d
+++ /dev/null
@@ -1,17 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: egd-file
-Arg: <file>
-Help: EGD socket path for random data
-Protocols: TLS
-See-also: random-file
-Category: tls
-Example: --egd-file /random/here $URL
-Added: 7.7
-Multi: single
----
-Deprecated option (added in 7.84.0). Prior to that it only had an effect on
-curl if built to use old versions of OpenSSL.
-
-Specify the path name to the Entropy Gathering Daemon socket. The socket is
-used to seed the random engine for SSL connections.
diff --git a/third-party/curl/docs/cmdline-opts/egd-file.md b/third-party/curl/docs/cmdline-opts/egd-file.md
new file mode 100644
index 0000000000..ef16b99648
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/egd-file.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: egd-file
+Arg: <file>
+Help: EGD socket path for random data
+Protocols: TLS
+Category: deprecated
+Added: 7.7
+Multi: single
+See-also:
+  - random-file
+Example:
+  - --egd-file /random/here $URL
+---
+
+# `--egd-file`
+
+Deprecated option (added in 7.84.0). Prior to that it only had an effect on
+curl if built to use old versions of OpenSSL.
+
+Specify the path name to the Entropy Gathering Daemon socket. The socket is
+used to seed the random engine for SSL connections.
diff --git a/third-party/curl/docs/cmdline-opts/engine.d b/third-party/curl/docs/cmdline-opts/engine.d
deleted file mode 100644
index 1ebc779c0d..0000000000
--- a/third-party/curl/docs/cmdline-opts/engine.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: engine
-Arg: <name>
-Help: Crypto engine to use
-Protocols: TLS
-Category: tls
-Example: --engine flavor $URL
-Added: 7.9.3
-See-also: ciphers curves
-Multi: single
----
-Select the OpenSSL crypto engine to use for cipher operations. Use --engine
-list to print a list of build-time supported engines. Note that not all (and
-possibly none) of the engines may be available at runtime.
diff --git a/third-party/curl/docs/cmdline-opts/engine.md b/third-party/curl/docs/cmdline-opts/engine.md
new file mode 100644
index 0000000000..cde6949b86
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/engine.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: engine
+Arg: <name>
+Help: Crypto engine to use
+Protocols: TLS
+Category: tls
+Added: 7.9.3
+Multi: single
+See-also:
+  - ciphers
+  - curves
+Example:
+  - --engine flavor $URL
+---
+
+# `--engine`
+
+Select the OpenSSL crypto engine to use for cipher operations. Use `--engine
+list` to print a list of build-time supported engines. Note that not all (and
+possibly none) of the engines may be available at runtime.
+
+The OpenSSL concept "engines" has been superseded by "providers" in OpenSSL 3,
+and this option should work fine to specify such as well.
diff --git a/third-party/curl/docs/cmdline-opts/etag-compare.d b/third-party/curl/docs/cmdline-opts/etag-compare.d
deleted file mode 100644
index d3c48d17a6..0000000000
--- a/third-party/curl/docs/cmdline-opts/etag-compare.d
+++ /dev/null
@@ -1,23 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: etag-compare
-Arg: <file>
-Help: Pass an ETag from a file as a custom header
-Protocols: HTTP
-Added: 7.68.0
-Category: http
-Example: --etag-compare etag.txt $URL
-See-also: etag-save time-cond
-Multi: single
----
-This option makes a conditional HTTP request for the specific ETag read
-from the given file by sending a custom If-None-Match header using the
-stored ETag.
-
-For correct results, make sure that the specified file contains only a
-single line with the desired ETag. An empty file is parsed as an empty
-ETag.
-
-Use the option --etag-save to first save the ETag from a response, and
-then use this option to compare against the saved ETag in a subsequent
-request.
diff --git a/third-party/curl/docs/cmdline-opts/etag-compare.md b/third-party/curl/docs/cmdline-opts/etag-compare.md
new file mode 100644
index 0000000000..64ab80cd12
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/etag-compare.md
@@ -0,0 +1,30 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: etag-compare
+Arg: <file>
+Help: Load ETag from file
+Protocols: HTTP
+Added: 7.68.0
+Category: http
+Multi: single
+See-also:
+  - etag-save
+  - time-cond
+Example:
+  - --etag-compare etag.txt $URL
+---
+
+# `--etag-compare`
+
+Make a conditional HTTP request for the specific ETag read from the given file
+by sending a custom If-None-Match header using the stored ETag.
+
+For correct results, make sure that the specified file contains only a single
+line with the desired ETag. A non-existing or empty file is treated as an
+empty ETag.
+
+Use the option --etag-save to first save the ETag from a response, and then
+use this option to compare against the saved ETag in a subsequent request.
+
+Use this option with a single URL only.
diff --git a/third-party/curl/docs/cmdline-opts/etag-save.d b/third-party/curl/docs/cmdline-opts/etag-save.d
deleted file mode 100644
index 6295a9e311..0000000000
--- a/third-party/curl/docs/cmdline-opts/etag-save.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: etag-save
-Arg: <file>
-Help: Parse ETag from a request and save it to a file
-Protocols: HTTP
-Added: 7.68.0
-Category: http
-Example: --etag-save storetag.txt $URL
-See-also: etag-compare
-Multi: single
----
-This option saves an HTTP ETag to the specified file. An ETag is a
-caching related header, usually returned in a response.
-
-If no ETag is sent by the server, an empty file is created.
diff --git a/third-party/curl/docs/cmdline-opts/etag-save.md b/third-party/curl/docs/cmdline-opts/etag-save.md
new file mode 100644
index 0000000000..137a4d5a55
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/etag-save.md
@@ -0,0 +1,30 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: etag-save
+Arg: <file>
+Help: Parse incoming ETag and save to a file
+Protocols: HTTP
+Added: 7.68.0
+Category: http
+Multi: single
+See-also:
+  - etag-compare
+Example:
+  - --etag-save storetag.txt $URL
+---
+
+# `--etag-save`
+
+Save an HTTP ETag to the specified file. An ETag is a caching related header,
+usually returned in a response. Use this option with a single URL only.
+
+If no ETag is sent by the server, an empty file is created.
+
+In many situations you want to use an existing etag in the request to avoid
+downloading the same resource again but also save the new etag if it has
+indeed changed, by using both etag options --etag-save and --etag-compare with
+the same filename, in the same command line.
+
+Starting in curl 8.12.0, using the --create-dirs option can also create
+missing directory components for the path provided in --etag-save.
diff --git a/third-party/curl/docs/cmdline-opts/expect100-timeout.d b/third-party/curl/docs/cmdline-opts/expect100-timeout.d
deleted file mode 100644
index f9a119bd97..0000000000
--- a/third-party/curl/docs/cmdline-opts/expect100-timeout.d
+++ /dev/null
@@ -1,19 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: expect100-timeout
-Arg: <seconds>
-Help: How long to wait for 100-continue
-Protocols: HTTP
-Added: 7.47.0
-See-also: connect-timeout
-Category: http
-Example: --expect100-timeout 2.5 -T file $URL
-Multi: single
----
-Maximum time in seconds that you allow curl to wait for a 100-continue
-response when curl emits an Expects: 100-continue header in its request. By
-default curl waits one second. This option accepts decimal values! When
-curl stops waiting, it continues as if the response has been received.
-
-The decimal value needs to provided using a dot (.) as decimal separator - not
-the local version even if it might be using another separator.
diff --git a/third-party/curl/docs/cmdline-opts/expect100-timeout.md b/third-party/curl/docs/cmdline-opts/expect100-timeout.md
new file mode 100644
index 0000000000..80cf4eba61
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/expect100-timeout.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: expect100-timeout
+Arg: <seconds>
+Help: How long to wait for 100-continue
+Protocols: HTTP
+Added: 7.47.0
+Category: http timeout
+Multi: single
+See-also:
+  - connect-timeout
+Example:
+  - --expect100-timeout 2.5 -T file $URL
+---
+
+# `--expect100-timeout`
+
+Maximum time in seconds that you allow curl to wait for a 100-continue
+response when curl emits an Expects: 100-continue header in its request. By
+default curl waits one second. This option accepts decimal values. When curl
+stops waiting, it continues as if a response was received.
+
+The decimal value needs to be provided using a dot (`.`) as decimal separator -
+not the local version even if it might be using another separator.
diff --git a/third-party/curl/docs/cmdline-opts/fail-early.d b/third-party/curl/docs/cmdline-opts/fail-early.d
deleted file mode 100644
index 36b3309996..0000000000
--- a/third-party/curl/docs/cmdline-opts/fail-early.d
+++ /dev/null
@@ -1,25 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: fail-early
-Help: Fail on first transfer error, do not continue
-Added: 7.52.0
-Category: curl
-Example: --fail-early $URL https://two.example
-See-also: fail fail-with-body
-Multi: boolean
-Scope: global
----
-Fail and exit on the first detected transfer error.
-
-When curl is used to do multiple transfers on the command line, it attempts to
-operate on each given URL, one by one. By default, it ignores errors if there
-are more URLs given and the last URL's success determines the error code curl
-returns. So early failures are "hidden" by subsequent successful transfers.
-
-Using this option, curl instead returns an error on the first transfer that
-fails, independent of the amount of URLs that are given on the command
-line. This way, no transfer failures go undetected by scripts and similar.
-
-This option does not imply --fail, which causes transfers to fail due to the
-server's HTTP status code. You can combine the two options, however note --fail
-is not global and is therefore contained by --next.
diff --git a/third-party/curl/docs/cmdline-opts/fail-early.md b/third-party/curl/docs/cmdline-opts/fail-early.md
new file mode 100644
index 0000000000..67edbf919e
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/fail-early.md
@@ -0,0 +1,32 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: fail-early
+Help: Fail on first transfer error
+Added: 7.52.0
+Category: curl global
+Multi: boolean
+Scope: global
+See-also:
+  - fail
+  - fail-with-body
+Example:
+  - --fail-early $URL https://two.example
+---
+
+# `--fail-early`
+
+Fail and exit on the first detected transfer error.
+
+When curl is used to do multiple transfers on the command line, it attempts to
+operate on each given URL, one by one. By default, it ignores errors if there
+are more URLs given and the last URL's success determines the error code curl
+returns. Early failures are "hidden" by subsequent successful transfers.
+
+Using this option, curl instead returns an error on the first transfer that
+fails, independent of the amount of URLs that are given on the command
+line. This way, no transfer failures go undetected by scripts and similar.
+
+This option does not imply --fail, which causes transfers to fail due to the
+server's HTTP status code. You can combine the two options, however note --fail
+is not global and is therefore contained by --next.
diff --git a/third-party/curl/docs/cmdline-opts/fail-with-body.d b/third-party/curl/docs/cmdline-opts/fail-with-body.d
deleted file mode 100644
index dddb86e229..0000000000
--- a/third-party/curl/docs/cmdline-opts/fail-with-body.d
+++ /dev/null
@@ -1,20 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: fail-with-body
-Protocols: HTTP
-Help: Fail on HTTP errors but save the body
-Category: http output
-Added: 7.76.0
-See-also: fail fail-early
-Mutexed: fail
-Example: --fail-with-body $URL
-Multi: boolean
----
-Return an error on server errors where the HTTP response code is 400 or
-greater). In normal cases when an HTTP server fails to deliver a document, it
-returns an HTML document stating so (which often also describes why and
-more). This flag allows curl to output and save that content but also to
-return error 22.
-
-This is an alternative option to --fail which makes curl fail for the same
-circumstances but without saving the content.
diff --git a/third-party/curl/docs/cmdline-opts/fail-with-body.md b/third-party/curl/docs/cmdline-opts/fail-with-body.md
new file mode 100644
index 0000000000..670959ba9b
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/fail-with-body.md
@@ -0,0 +1,27 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: fail-with-body
+Protocols: HTTP
+Help: Fail on HTTP errors but save the body
+Category: http output
+Added: 7.76.0
+Mutexed: fail
+Multi: boolean
+See-also:
+  - fail
+  - fail-early
+Example:
+  - --fail-with-body $URL
+---
+
+# `--fail-with-body`
+
+Return an error on server errors where the HTTP response code is 400 or
+greater). In normal cases when an HTTP server fails to deliver a document, it
+returns an HTML document stating so (which often also describes why and more).
+This option allows curl to output and save that content but also to return
+error 22.
+
+This is an alternative option to --fail which makes curl fail for the same
+circumstances but without saving the content.
diff --git a/third-party/curl/docs/cmdline-opts/fail.d b/third-party/curl/docs/cmdline-opts/fail.d
deleted file mode 100644
index 8196a908de..0000000000
--- a/third-party/curl/docs/cmdline-opts/fail.d
+++ /dev/null
@@ -1,22 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: fail
-Short: f
-Protocols: HTTP
-Help: Fail fast with no output on HTTP errors
-See-also: fail-with-body fail-early
-Category: important http
-Example: --fail $URL
-Mutexed: fail-with-body
-Added: 4.0
-Multi: boolean
----
-Fail fast with no output at all on server errors. This is useful to enable
-scripts and users to better deal with failed attempts. In normal cases when an
-HTTP server fails to deliver a document, it returns an HTML document stating
-so (which often also describes why and more). This flag prevents curl from
-outputting that and return error 22.
-
-This method is not fail-safe and there are occasions where non-successful
-response codes slip through, especially when authentication is involved
-(response codes 401 and 407).
diff --git a/third-party/curl/docs/cmdline-opts/fail.md b/third-party/curl/docs/cmdline-opts/fail.md
new file mode 100644
index 0000000000..0c8db1367b
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/fail.md
@@ -0,0 +1,35 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: fail
+Short: f
+Protocols: HTTP
+Help: Fail fast with no output on HTTP errors
+Category: important http
+Mutexed: fail-with-body
+Added: 4.0
+Multi: boolean
+See-also:
+  - fail-with-body
+  - fail-early
+Example:
+  - --fail $URL
+---
+
+# `--fail`
+
+Fail with error code 22 and with no response body output at all for HTTP
+transfers returning HTTP response codes at 400 or greater.
+
+In normal cases when an HTTP server fails to deliver a document, it returns a
+body of text stating so (which often also describes why and more) and a 4xx
+HTTP response code. This command line option prevents curl from outputting
+that data and instead returns error 22 early. By default, curl does not
+consider HTTP response codes to indicate failure.
+
+To get both the error code and also save the content, use --fail-with-body
+instead.
+
+This method is not fail-safe and there are occasions where non-successful
+response codes slip through, especially when authentication is involved
+(response codes 401 and 407).
diff --git a/third-party/curl/docs/cmdline-opts/false-start.d b/third-party/curl/docs/cmdline-opts/false-start.d
deleted file mode 100644
index 73240492b9..0000000000
--- a/third-party/curl/docs/cmdline-opts/false-start.d
+++ /dev/null
@@ -1,18 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: false-start
-Help: Enable TLS False Start
-Protocols: TLS
-Added: 7.42.0
-Category: tls
-Example: --false-start $URL
-See-also: tcp-fastopen
-Multi: boolean
----
-Tells curl to use false start during the TLS handshake. False start is a mode
-where a TLS client starts sending application data before verifying the
-server's Finished message, thus saving a round trip when performing a full
-handshake.
-
-This is currently only implemented in the Secure Transport (on iOS 7.0 or
-later, or OS X 10.9 or later) backend.
diff --git a/third-party/curl/docs/cmdline-opts/false-start.md b/third-party/curl/docs/cmdline-opts/false-start.md
new file mode 100644
index 0000000000..7c8c976698
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/false-start.md
@@ -0,0 +1,22 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: false-start
+Help: Enable TLS False Start
+Protocols: TLS
+Added: 7.42.0
+Category: deprecated
+Multi: boolean
+See-also:
+  - tcp-fastopen
+Example:
+  - --false-start $URL
+---
+
+# `--false-start`
+
+No TLS backend currently supports this feature.
+
+Use false start during the TLS handshake. False start is a mode where a TLS
+client starts sending application data before verifying the server's Finished
+message, thus saving a round trip when performing a full handshake.
diff --git a/third-party/curl/docs/cmdline-opts/follow.md b/third-party/curl/docs/cmdline-opts/follow.md
new file mode 100644
index 0000000000..b34e30c693
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/follow.md
@@ -0,0 +1,33 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: follow
+Help: Follow redirects per spec
+Category: http
+Protocols: HTTP
+Added: 8.16.0
+Multi: boolean
+See-also:
+  - request
+  - location
+  - proto-redir
+  - max-redirs
+Example:
+  - -X POST --follow $URL
+---
+
+# `--follow`
+
+Instructs curl to follow HTTP redirects and to do the custom request method
+set with --request when following redirects as the HTTP specification says.
+
+The method string set with --request is used in subsequent requests for the
+status codes 307 or 308, but may be reset to GET for 301, 302 and 303.
+
+This is subtly different than --location, as that option always sets the custom
+method in all subsequent requests independent of response code.
+
+Restrict which protocols a redirect is accepted to follow with --proto-redir.
+
+When --netrc is used in combination with this option, credentials for the
+followed-to hosts may also be selected from that file.
diff --git a/third-party/curl/docs/cmdline-opts/form-escape.d b/third-party/curl/docs/cmdline-opts/form-escape.d
deleted file mode 100644
index 304bfe8149..0000000000
--- a/third-party/curl/docs/cmdline-opts/form-escape.d
+++ /dev/null
@@ -1,13 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: form-escape
-Help: Escape multipart form field/file names using backslash
-Protocols: HTTP
-See-also: form
-Added: 7.81.0
-Category: http upload
-Example: --form-escape -F 'field\\name=curl' -F 'file=@load"this' $URL
-Multi: single
----
-Tells curl to pass on names of multipart form fields and files using
-backslash-escaping instead of percent-encoding.
diff --git a/third-party/curl/docs/cmdline-opts/form-escape.md b/third-party/curl/docs/cmdline-opts/form-escape.md
new file mode 100644
index 0000000000..7cf1cb7403
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/form-escape.md
@@ -0,0 +1,19 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: form-escape
+Help: Escape form fields using backslash
+Protocols: HTTP IMAP SMTP
+Added: 7.81.0
+Category: http upload post
+Multi: single
+See-also:
+  - form
+Example:
+  - --form-escape -F 'field\name=curl' -F 'file=@load"this' $URL
+---
+
+# `--form-escape`
+
+Pass on names of multipart form fields and files using backslash-escaping
+instead of percent-encoding.
diff --git a/third-party/curl/docs/cmdline-opts/form-string.d b/third-party/curl/docs/cmdline-opts/form-string.d
deleted file mode 100644
index 6d7a500a44..0000000000
--- a/third-party/curl/docs/cmdline-opts/form-string.d
+++ /dev/null
@@ -1,17 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: form-string
-Help: Specify multipart MIME data
-Protocols: HTTP SMTP IMAP
-Arg: <name=string>
-See-also: form
-Category: http upload
-Example: --form-string "data" $URL
-Added: 7.13.2
-Multi: append
----
-Similar to --form except that the value string for the named parameter is used
-literally. Leading '@' and '<' characters, and the ';type=' string in
-the value have no special meaning. Use this in preference to --form if
-there is any possibility that the string value may accidentally trigger the
-'@' or '<' features of --form.
diff --git a/third-party/curl/docs/cmdline-opts/form-string.md b/third-party/curl/docs/cmdline-opts/form-string.md
new file mode 100644
index 0000000000..e58ad625d9
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/form-string.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: form-string
+Help: Specify multipart MIME data
+Protocols: HTTP SMTP IMAP
+Arg: <name=string>
+Category: http upload post smtp imap
+Added: 7.13.2
+Multi: append
+See-also:
+  - form
+Example:
+  - --form-string "name=data" $URL
+---
+
+# `--form-string`
+
+Similar to --form except that the value string for the named parameter is used
+literally. Leading @ and \< characters, and the `;type=` string in the value
+have no special meaning. Use this in preference to --form if there is any
+possibility that the string value may accidentally trigger the @ or \<
+features of --form.
diff --git a/third-party/curl/docs/cmdline-opts/form.d b/third-party/curl/docs/cmdline-opts/form.d
deleted file mode 100644
index e53e93ae0d..0000000000
--- a/third-party/curl/docs/cmdline-opts/form.d
+++ /dev/null
@@ -1,134 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: form
-Short: F
-Arg: <name=content>
-Help: Specify multipart MIME data
-Protocols: HTTP SMTP IMAP
-Mutexed: data head upload-file
-Category: http upload
-Example: --form "name=curl" --form "file=@loadthis" $URL
-Added: 5.0
-See-also: data form-string form-escape
-Multi: append
----
-For HTTP protocol family, this lets curl emulate a filled-in form in which a
-user has pressed the submit button. This causes curl to POST data using the
-Content-Type multipart/form-data according to RFC 2388.
-
-For SMTP and IMAP protocols, this is the means to compose a multipart mail
-message to transmit.
-
-This enables uploading of binary files etc. To force the 'content' part to be
-a file, prefix the file name with an @ sign. To just get the content part from
-a file, prefix the file name with the symbol <. The difference between @ and <
-is then that @ makes a file get attached in the post as a file upload, while
-the < makes a text field and just get the contents for that text field from a
-file.
-
-Tell curl to read content from stdin instead of a file by using - as
-filename. This goes for both @ and < constructs. When stdin is used, the
-contents is buffered in memory first by curl to determine its size and allow a
-possible resend. Defining a part's data from a named non-regular file (such as
-a named pipe or similar) is not subject to buffering and is instead read at
-transmission time; since the full size is unknown before the transfer starts,
-such data is sent as chunks by HTTP and rejected by IMAP.
-
-Example: send an image to an HTTP server, where 'profile' is the name of the
-form-field to which the file **portrait.jpg** is the input:
-
- curl -F profile=@portrait.jpg https://example.com/upload.cgi
-
-Example: send your name and shoe size in two text fields to the server:
-
- curl -F name=John -F shoesize=11 https://example.com/
-
-Example: send your essay in a text field to the server. Send it as a plain
-text field, but get the contents for it from a local file:
-
- curl -F "story=<hugefile.txt" https://example.com/
-
-You can also tell curl what Content-Type to use by using 'type=', in a manner
-similar to:
-
- curl -F "web=@index.html;type=text/html" example.com
-
-or
-
- curl -F "name=daniel;type=text/foo" example.com
-
-You can also explicitly change the name field of a file upload part by setting
-filename=, like this:
-
- curl -F "file=@localfile;filename=nameinpost" example.com
-
-If filename/path contains ',' or ';', it must be quoted by double-quotes like:
-
- curl -F "file=@\\"local,file\\";filename=\\"name;in;post\\"" example.com
-
-or
-
- curl -F 'file=@"local,file";filename="name;in;post"' example.com
-
-Note that if a filename/path is quoted by double-quotes, any double-quote
-or backslash within the filename must be escaped by backslash.
-
-Quoting must also be applied to non-file data if it contains semicolons,
-leading/trailing spaces or leading double quotes:
-
- curl -F 'colors="red; green; blue";type=text/x-myapp' example.com
-
-You can add custom headers to the field by setting headers=, like
-
-  curl -F "submit=OK;headers=\\"X-submit-type: OK\\"" example.com
-
-or
-
-  curl -F "submit=OK;headers=@headerfile" example.com
-
-The headers= keyword may appear more that once and above notes about quoting
-apply. When headers are read from a file, Empty lines and lines starting
-with '#' are comments and ignored; each header can be folded by splitting
-between two words and starting the continuation line with a space; embedded
-carriage-returns and trailing spaces are stripped.
-Here is an example of a header file contents:
-
-  # This file contain two headers.
-  X-header-1: this is a header
-
-  # The following header is folded.
-  X-header-2: this is
-   another header
-
-To support sending multipart mail messages, the syntax is extended as follows:
-.br
-- name can be omitted: the equal sign is the first character of the argument,
-.br
-- if data starts with '(', this signals to start a new multipart: it can be
-followed by a content type specification.
-.br
-- a multipart can be terminated with a '=)' argument.
-
-Example: the following command sends an SMTP mime email consisting in an
-inline part in two alternative formats: plain text and HTML. It attaches a
-text file:
-
- curl -F '=(;type=multipart/alternative' \\
-      -F '=plain text message' \\
-      -F '= <body>HTML message</body>;type=text/html' \\
-      -F '=)' -F '=@textfile.txt' ...  smtp://example.com
-
-Data can be encoded for transfer using encoder=. Available encodings are
-*binary* and *8bit* that do nothing else than adding the corresponding
-Content-Transfer-Encoding header, *7bit* that only rejects 8-bit characters
-with a transfer error, *quoted-printable* and *base64* that encodes data
-according to the corresponding schemes, limiting lines length to 76
-characters.
-
-Example: send multipart mail with a quoted-printable text message and a
-base64 attached file:
-
- curl -F '=text message;encoder=quoted-printable' \\
-      -F '=@localfile;encoder=base64' ... smtp://example.com
-
-See further examples and details in the MANUAL.
diff --git a/third-party/curl/docs/cmdline-opts/form.md b/third-party/curl/docs/cmdline-opts/form.md
new file mode 100644
index 0000000000..87b019604f
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/form.md
@@ -0,0 +1,143 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: form
+Short: F
+Arg: <name=content>
+Help: Specify multipart MIME data
+Protocols: HTTP SMTP IMAP
+Mutexed: data head upload-file
+Category: http upload post imap smtp
+Added: 5.0
+Multi: append
+See-also:
+  - data
+  - form-string
+  - form-escape
+Example:
+  - --form "name=curl" --form "file=@loadthis" $URL
+---
+
+# `--form`
+
+For the HTTP protocol family, emulate a filled-in form in which a user has
+pressed the submit button. This makes curl POST data using the Content-Type
+multipart/form-data according to RFC 2388.
+
+For SMTP and IMAP protocols, this composes a multipart mail message to
+transmit.
+
+This enables uploading of binary files etc. To force the 'content' part to be
+a file, prefix the filename with an @ sign. To get the content part from a
+file, prefix the filename with the symbol \<. The difference between @ and \<
+is then that @ makes a file get attached in the post as a file upload, while
+the \< makes a text field and gets the contents for that text field from a
+file.
+
+Read content from stdin instead of a file by using a single "-" as filename.
+This goes for both @ and \< constructs. When stdin is used, the contents is
+buffered in memory first by curl to determine its size and allow a possible
+resend. Defining a part's data from a named non-regular file (such as a named
+pipe or similar) is not subject to buffering and is instead read at
+transmission time; since the full size is unknown before the transfer starts,
+such data is sent as chunks by HTTP and rejected by IMAP.
+
+Example: send an image to an HTTP server, where 'profile' is the name of the
+form-field to which the file **portrait.jpg** is the input:
+
+    curl -F profile=@portrait.jpg https://example.com/upload.cgi
+
+Example: send your name and shoe size in two text fields to the server:
+
+    curl -F name=John -F shoesize=11 https://example.com/
+
+Example: send your essay in a text field to the server. Send it as a plain
+text field, but get the contents for it from a local file:
+
+    curl -F "story=<hugefile.txt" https://example.com/
+
+You can also instruct curl what Content-Type to use by using `type=`, in a
+manner similar to:
+
+    curl -F "web=@index.html;type=text/html" example.com
+
+or
+
+    curl -F "name=daniel;type=text/foo" example.com
+
+You can also explicitly change the name field of a file upload part by setting
+filename=, like this:
+
+    curl -F "file=@localfile;filename=nameinpost" example.com
+
+If filename/path contains ',' or ';', it must be quoted by double-quotes like:
+
+    curl -F "file=@\"local,file\";filename=\"name;in;post\"" \
+        https://example.com
+
+or
+
+    curl -F 'file=@"local,file";filename="name;in;post"' \
+        https://example.com
+
+Note that if a filename/path is quoted by double-quotes, any double-quote
+or backslash within the filename must be escaped by backslash.
+
+Quoting must also be applied to non-file data if it contains semicolons,
+leading/trailing spaces or leading double quotes:
+
+    curl -F 'colors="red; green; blue";type=text/x-myapp' \
+       https://example.com
+
+You can add custom headers to the field by setting headers=, like
+
+    curl -F "submit=OK;headers=\"X-submit-type: OK\"" example.com
+
+or
+
+    curl -F "submit=OK;headers=@headerfile" example.com
+
+The headers= keyword may appear more than once and above notes about quoting
+apply. When headers are read from a file, empty lines and lines starting
+with '#' are ignored; each header can be folded by splitting
+between two words and starting the continuation line with a space; embedded
+carriage-returns and trailing spaces are stripped.
+Here is an example of a header file contents:
+
+    # This file contains two headers.
+    X-header-1: this is a header
+
+    # The following header is folded.
+    X-header-2: this is
+     another header
+
+To support sending multipart mail messages, the syntax is extended as follows:
+
+- name can be omitted: the equal sign is the first character of the argument,
+
+- if data starts with '(', this signals to start a new multipart: it can be
+followed by a content type specification.
+
+- a multipart can be terminated with a '=)' argument.
+
+Example: the following command sends an SMTP mime email consisting in an
+inline part in two alternative formats: plain text and HTML. It attaches a
+text file:
+
+    curl -F '=(;type=multipart/alternative' \
+         -F '=plain text message' \
+         -F '= <body>HTML message</body>;type=text/html' \
+         -F '=)' -F '=@textfile.txt' ... smtp://example.com
+
+Data can be encoded for transfer using encoder=. Available encodings are
+*binary* and *8bit* that do nothing else than adding the corresponding
+Content-Transfer-Encoding header, *7bit* that only rejects 8-bit characters
+with a transfer error, *quoted-printable* and *base64* that encodes data
+according to the corresponding schemes, limiting lines length to 76
+characters.
+
+Example: send multipart mail with a quoted-printable text message and a
+base64 attached file:
+
+    curl -F '=text message;encoder=quoted-printable' \
+         -F '=@localfile;encoder=base64' ... smtp://example.com
diff --git a/third-party/curl/docs/cmdline-opts/ftp-account.d b/third-party/curl/docs/cmdline-opts/ftp-account.d
deleted file mode 100644
index eb669c5628..0000000000
--- a/third-party/curl/docs/cmdline-opts/ftp-account.d
+++ /dev/null
@@ -1,14 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ftp-account
-Arg: <data>
-Help: Account data string
-Protocols: FTP
-Added: 7.13.0
-Category: ftp auth
-Example: --ftp-account "mr.robot" ftp://example.com/
-See-also: user
-Multi: single
----
-When an FTP server asks for "account data" after user name and password has
-been provided, this data is sent off using the ACCT command.
diff --git a/third-party/curl/docs/cmdline-opts/ftp-account.md b/third-party/curl/docs/cmdline-opts/ftp-account.md
new file mode 100644
index 0000000000..e275349dee
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ftp-account.md
@@ -0,0 +1,20 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ftp-account
+Arg: <data>
+Help: Account data string
+Protocols: FTP
+Added: 7.13.0
+Category: ftp auth
+Multi: single
+See-also:
+  - user
+Example:
+  - --ftp-account "mr.robot" ftp://example.com/
+---
+
+# `--ftp-account`
+
+When an FTP server asks for "account data" after username and password has
+been provided, this data is sent off using the ACCT command.
diff --git a/third-party/curl/docs/cmdline-opts/ftp-alternative-to-user.d b/third-party/curl/docs/cmdline-opts/ftp-alternative-to-user.d
deleted file mode 100644
index f030bcf598..0000000000
--- a/third-party/curl/docs/cmdline-opts/ftp-alternative-to-user.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ftp-alternative-to-user
-Arg: <command>
-Help: String to replace USER [name]
-Protocols: FTP
-Added: 7.15.5
-Category: ftp
-Example: --ftp-alternative-to-user "U53r" ftp://example.com
-See-also: ftp-account user
-Multi: single
----
-If authenticating with the USER and PASS commands fails, send this command.
-When connecting to Tumbleweed's Secure Transport server over FTPS using a
-client certificate, using "SITE AUTH" tells the server to retrieve the
-username from the certificate.
diff --git a/third-party/curl/docs/cmdline-opts/ftp-alternative-to-user.md b/third-party/curl/docs/cmdline-opts/ftp-alternative-to-user.md
new file mode 100644
index 0000000000..9bd3686001
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ftp-alternative-to-user.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ftp-alternative-to-user
+Arg: <command>
+Help: String to replace USER [name]
+Protocols: FTP
+Added: 7.15.5
+Category: ftp
+Multi: single
+See-also:
+  - ftp-account
+  - user
+Example:
+  - --ftp-alternative-to-user "U53r" ftp://example.com
+---
+
+# `--ftp-alternative-to-user`
+
+If authenticating with the USER and PASS commands fails, send this command.
+When connecting to Tumbleweed's Secure Transport server over FTPS using a
+client certificate, using "SITE AUTH" tells the server to retrieve the
+username from the certificate.
diff --git a/third-party/curl/docs/cmdline-opts/ftp-create-dirs.d b/third-party/curl/docs/cmdline-opts/ftp-create-dirs.d
deleted file mode 100644
index 7c64f0e21c..0000000000
--- a/third-party/curl/docs/cmdline-opts/ftp-create-dirs.d
+++ /dev/null
@@ -1,14 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ftp-create-dirs
-Protocols: FTP SFTP
-Help: Create the remote dirs if not present
-See-also: create-dirs
-Category: ftp sftp curl
-Example: --ftp-create-dirs -T file ftp://example.com/remote/path/file
-Added: 7.10.7
-Multi: boolean
----
-When an FTP or SFTP URL/operation uses a path that does not currently exist on
-the server, the standard behavior of curl is to fail. Using this option, curl
-instead attempts to create missing directories.
diff --git a/third-party/curl/docs/cmdline-opts/ftp-create-dirs.md b/third-party/curl/docs/cmdline-opts/ftp-create-dirs.md
new file mode 100644
index 0000000000..3e851ccae9
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ftp-create-dirs.md
@@ -0,0 +1,20 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ftp-create-dirs
+Protocols: FTP SFTP
+Help: Create the remote dirs if not present
+Category: ftp sftp
+Added: 7.10.7
+Multi: boolean
+See-also:
+  - create-dirs
+Example:
+  - --ftp-create-dirs -T file ftp://example.com/remote/path/file
+---
+
+# `--ftp-create-dirs`
+
+When an FTP or SFTP URL/operation uses a path that does not currently exist on
+the server, the standard behavior of curl is to fail. Using this option, curl
+instead attempts to create missing directories.
diff --git a/third-party/curl/docs/cmdline-opts/ftp-method.d b/third-party/curl/docs/cmdline-opts/ftp-method.d
deleted file mode 100644
index 8061d2b682..0000000000
--- a/third-party/curl/docs/cmdline-opts/ftp-method.d
+++ /dev/null
@@ -1,30 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ftp-method
-Arg: <method>
-Help: Control CWD usage
-Protocols: FTP
-Added: 7.15.1
-Category: ftp
-Example: --ftp-method multicwd ftp://example.com/dir1/dir2/file
-Example: --ftp-method nocwd ftp://example.com/dir1/dir2/file
-Example: --ftp-method singlecwd ftp://example.com/dir1/dir2/file
-See-also: list-only
-Multi: single
----
-Control what method curl should use to reach a file on an FTP(S)
-server. The method argument should be one of the following alternatives:
-.RS
-.IP multicwd
-curl does a single CWD operation for each path part in the given URL. For deep
-hierarchies this means many commands. This is how RFC 1738 says it should
-be done. This is the default but the slowest behavior.
-.IP nocwd
-curl does no CWD at all. curl does SIZE, RETR, STOR etc and give a full
-path to the server for all these commands. This is the fastest behavior.
-.IP singlecwd
-curl does one CWD with the full target directory and then operates on the file
-"normally" (like in the multicwd case). This is somewhat more standards
-compliant than 'nocwd' but without the full penalty of 'multicwd'.
-.RE
-.IP
diff --git a/third-party/curl/docs/cmdline-opts/ftp-method.md b/third-party/curl/docs/cmdline-opts/ftp-method.md
new file mode 100644
index 0000000000..d2bff21d59
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ftp-method.md
@@ -0,0 +1,36 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ftp-method
+Arg: <method>
+Help: Control CWD usage
+Protocols: FTP
+Added: 7.15.1
+Category: ftp
+Multi: single
+See-also:
+  - list-only
+Example:
+  - --ftp-method multicwd ftp://example.com/dir1/dir2/file
+  - --ftp-method nocwd ftp://example.com/dir1/dir2/file
+  - --ftp-method singlecwd ftp://example.com/dir1/dir2/file
+---
+
+# `--ftp-method`
+
+Control what method curl should use to reach a file on an FTP(S)
+server. The method argument should be one of the following alternatives:
+
+## multicwd
+Do a single CWD operation for each path part in the given URL. For deep
+hierarchies this means many commands. This is how RFC 1738 says it should be
+done. This is the default but the slowest behavior.
+
+## nocwd
+Do no CWD at all. curl does SIZE, RETR, STOR etc and gives the full path to
+the server for each of these commands. This is the fastest behavior.
+
+## singlecwd
+Do one CWD with the full target directory and then operate on the file
+"normally" (like in the multicwd case). This is somewhat more standards
+compliant than `nocwd` but without the full penalty of `multicwd`.
diff --git a/third-party/curl/docs/cmdline-opts/ftp-pasv.d b/third-party/curl/docs/cmdline-opts/ftp-pasv.d
deleted file mode 100644
index c43bf2beea..0000000000
--- a/third-party/curl/docs/cmdline-opts/ftp-pasv.d
+++ /dev/null
@@ -1,20 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ftp-pasv
-Help: Use PASV/EPSV instead of PORT
-Protocols: FTP
-Added: 7.11.0
-See-also: disable-epsv
-Category: ftp
-Example: --ftp-pasv ftp://example.com/
-Multi: boolean
----
-Use passive mode for the data connection. Passive is the internal default
-behavior, but using this option can be used to override a previous --ftp-port
-option.
-
-Reversing an enforced passive really is not doable but you must then instead
-enforce the correct --ftp-port again.
-
-Passive mode means that curl tries the EPSV command first and then PASV,
-unless --disable-epsv is used.
diff --git a/third-party/curl/docs/cmdline-opts/ftp-pasv.md b/third-party/curl/docs/cmdline-opts/ftp-pasv.md
new file mode 100644
index 0000000000..02deee30de
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ftp-pasv.md
@@ -0,0 +1,27 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ftp-pasv
+Help: Send PASV/EPSV instead of PORT
+Protocols: FTP
+Added: 7.11.0
+Category: ftp
+Multi: mutex
+Mutexed: ftp-port
+See-also:
+  - disable-epsv
+Example:
+  - --ftp-pasv ftp://example.com/
+---
+
+# `--ftp-pasv`
+
+Use passive mode for the data connection. Passive is the internal default
+behavior, but using this option can be used to override a previous --ftp-port
+option.
+
+Reversing an enforced passive really is not doable but you must then instead
+enforce the correct --ftp-port again.
+
+Passive mode means that curl tries the EPSV command first and then PASV,
+unless --disable-epsv is used.
diff --git a/third-party/curl/docs/cmdline-opts/ftp-port.d b/third-party/curl/docs/cmdline-opts/ftp-port.d
deleted file mode 100644
index e1f4a1dba7..0000000000
--- a/third-party/curl/docs/cmdline-opts/ftp-port.d
+++ /dev/null
@@ -1,41 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ftp-port
-Arg: <address>
-Help: Use PORT instead of PASV
-Short: P
-Protocols: FTP
-See-also: ftp-pasv disable-eprt
-Category: ftp
-Example: -P - ftp:/example.com
-Example: -P eth0 ftp:/example.com
-Example: -P 192.168.0.2 ftp:/example.com
-Added: 4.0
-Multi: single
----
-Reverses the default initiator/listener roles when connecting with FTP. This
-option makes curl use active mode. curl then tells the server to connect back
-to the client's specified address and port, while passive mode asks the server
-to setup an IP address and port for it to connect to. <address> should be one
-of:
-.RS
-.IP interface
-e.g. "eth0" to specify which interface's IP address you want to use (Unix only)
-.IP "IP address"
-e.g. "192.168.10.1" to specify the exact IP address
-.IP "host name"
-e.g. "my.host.domain" to specify the machine
-.IP "-"
-make curl pick the same IP address that is already used for the control
-connection
-.RE
-.IP
-
-Disable the use of PORT with --ftp-pasv. Disable the attempt to use the EPRT
-command instead of PORT by using --disable-eprt. EPRT is really PORT++.
-
-You can also append ":[start]-[end]\&" to the right of the address, to tell
-curl what TCP port range to use. That means you specify a port range, from a
-lower to a higher number. A single number works as well, but do note that it
-increases the risk of failure since the port may not be available.
-(Added in 7.19.5)
diff --git a/third-party/curl/docs/cmdline-opts/ftp-port.md b/third-party/curl/docs/cmdline-opts/ftp-port.md
new file mode 100644
index 0000000000..28cc34ba2f
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ftp-port.md
@@ -0,0 +1,51 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ftp-port
+Arg: <address>
+Help: Send PORT instead of PASV
+Short: P
+Protocols: FTP
+Category: ftp
+Added: 4.0
+Multi: single
+See-also:
+  - ftp-pasv
+  - disable-eprt
+Example:
+  - -P - ftp:/example.com
+  - -P eth0 ftp:/example.com
+  - -P 192.168.0.2 ftp:/example.com
+---
+
+# `--ftp-port`
+
+Reverse the default initiator/listener roles when connecting with FTP. This
+option makes curl use active mode. curl then commands the server to connect
+back to the client's specified address and port, while passive mode asks the
+server to setup an IP address and port for it to connect to. \<address\>
+should be one of:
+
+## interface
+e.g. **eth0** to specify which interface's IP address you want to use (Unix only)
+
+## IP address
+e.g. **192.168.10.1** to specify the exact IP address
+
+## hostname
+e.g. **my.host.domain** to specify the machine
+
+## -
+make curl pick the same IP address that is already used for the control
+connection. This is the recommended choice.
+
+##
+
+Disable the use of PORT with --ftp-pasv. Disable the attempt to use the EPRT
+command instead of PORT by using --disable-eprt. EPRT is really PORT++.
+
+You can also append ":[start]-[end]" to the right of the address, to tell
+curl what TCP port range to use. That means you specify a port range, from a
+lower to a higher number. A single number works as well, but do note that it
+increases the risk of failure since the port may not be available.
+(Added in 7.19.5)
diff --git a/third-party/curl/docs/cmdline-opts/ftp-pret.d b/third-party/curl/docs/cmdline-opts/ftp-pret.d
deleted file mode 100644
index 4bea99e6d8..0000000000
--- a/third-party/curl/docs/cmdline-opts/ftp-pret.d
+++ /dev/null
@@ -1,14 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ftp-pret
-Help: Send PRET before PASV
-Protocols: FTP
-Added: 7.20.0
-Category: ftp
-Example: --ftp-pret ftp://example.com/
-See-also: ftp-port ftp-pasv
-Multi: boolean
----
-Tell curl to send a PRET command before PASV (and EPSV). Certain FTP servers,
-mainly drftpd, require this non-standard command for directory listings as
-well as up and downloads in PASV mode.
diff --git a/third-party/curl/docs/cmdline-opts/ftp-pret.md b/third-party/curl/docs/cmdline-opts/ftp-pret.md
new file mode 100644
index 0000000000..48c48e3e77
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ftp-pret.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ftp-pret
+Help: Send PRET before PASV
+Protocols: FTP
+Added: 7.20.0
+Category: ftp
+Multi: boolean
+See-also:
+  - ftp-port
+  - ftp-pasv
+Example:
+  - --ftp-pret ftp://example.com/
+---
+
+# `--ftp-pret`
+
+Send a PRET command before PASV (and EPSV). Certain FTP servers, mainly
+drftpd, require this non-standard command for directory listings as well as up
+and downloads in PASV mode.
diff --git a/third-party/curl/docs/cmdline-opts/ftp-skip-pasv-ip.d b/third-party/curl/docs/cmdline-opts/ftp-skip-pasv-ip.d
deleted file mode 100644
index 3af9c6de4f..0000000000
--- a/third-party/curl/docs/cmdline-opts/ftp-skip-pasv-ip.d
+++ /dev/null
@@ -1,18 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ftp-skip-pasv-ip
-Help: Skip the IP address for PASV
-Protocols: FTP
-Added: 7.14.2
-See-also: ftp-pasv
-Category: ftp
-Example: --ftp-skip-pasv-ip ftp://example.com/
-Multi: boolean
----
-Tell curl to not use the IP address the server suggests in its response to
-curl's PASV command when curl connects the data connection. Instead curl
-reuses the same IP address it already uses for the control connection.
-
-This option is enabled by default (added in 7.74.0).
-
-This option has no effect if PORT, EPRT or EPSV is used instead of PASV.
diff --git a/third-party/curl/docs/cmdline-opts/ftp-skip-pasv-ip.md b/third-party/curl/docs/cmdline-opts/ftp-skip-pasv-ip.md
new file mode 100644
index 0000000000..37905e63b1
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ftp-skip-pasv-ip.md
@@ -0,0 +1,24 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ftp-skip-pasv-ip
+Help: Skip the IP address for PASV
+Protocols: FTP
+Added: 7.15.0
+Category: ftp
+Multi: boolean
+See-also:
+  - ftp-pasv
+Example:
+  - --ftp-skip-pasv-ip ftp://example.com/
+---
+
+# `--ftp-skip-pasv-ip`
+
+Do not use the IP address the server suggests in its response to curl's PASV
+command when curl connects the data connection. Instead curl reuses the same
+IP address it already uses for the control connection.
+
+This option is enabled by default (added in 7.74.0).
+
+This option has no effect if PORT, EPRT or EPSV is used instead of PASV.
diff --git a/third-party/curl/docs/cmdline-opts/ftp-ssl-ccc-mode.d b/third-party/curl/docs/cmdline-opts/ftp-ssl-ccc-mode.d
deleted file mode 100644
index ae9af9429d..0000000000
--- a/third-party/curl/docs/cmdline-opts/ftp-ssl-ccc-mode.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ftp-ssl-ccc-mode
-Arg: <active/passive>
-Help: Set CCC mode
-Protocols: FTP
-Added: 7.16.2
-See-also: ftp-ssl-ccc
-Category: ftp tls
-Example: --ftp-ssl-ccc-mode active --ftp-ssl-ccc ftps://example.com/
-Multi: boolean
----
-Sets the CCC mode. The passive mode does not initiate the shutdown, but
-instead waits for the server to do it, and does not reply to the shutdown from
-the server. The active mode initiates the shutdown and waits for a reply from
-the server.
diff --git a/third-party/curl/docs/cmdline-opts/ftp-ssl-ccc-mode.md b/third-party/curl/docs/cmdline-opts/ftp-ssl-ccc-mode.md
new file mode 100644
index 0000000000..3e9eb725c6
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ftp-ssl-ccc-mode.md
@@ -0,0 +1,22 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ftp-ssl-ccc-mode
+Arg: <active/passive>
+Help: Set CCC mode
+Protocols: FTP
+Added: 7.16.2
+Category: ftp tls
+Multi: boolean
+See-also:
+  - ftp-ssl-ccc
+Example:
+  - --ftp-ssl-ccc-mode active --ftp-ssl-ccc ftps://example.com/
+---
+
+# `--ftp-ssl-ccc-mode`
+
+Set the CCC mode. The passive mode does not initiate the shutdown, but instead
+waits for the server to do it, and does not reply to the shutdown from the
+server. The active mode initiates the shutdown and waits for a reply from the
+server.
diff --git a/third-party/curl/docs/cmdline-opts/ftp-ssl-ccc.d b/third-party/curl/docs/cmdline-opts/ftp-ssl-ccc.d
deleted file mode 100644
index 33ae83b1c9..0000000000
--- a/third-party/curl/docs/cmdline-opts/ftp-ssl-ccc.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ftp-ssl-ccc
-Help: Send CCC after authenticating
-Protocols: FTP
-See-also: ssl ftp-ssl-ccc-mode
-Added: 7.16.1
-Category: ftp tls
-Example: --ftp-ssl-ccc ftps://example.com/
-Multi: boolean
----
-Use CCC (Clear Command Channel) Shuts down the SSL/TLS layer after
-authenticating. The rest of the control channel communication is be
-unencrypted. This allows NAT routers to follow the FTP transaction. The
-default mode is passive.
diff --git a/third-party/curl/docs/cmdline-opts/ftp-ssl-ccc.md b/third-party/curl/docs/cmdline-opts/ftp-ssl-ccc.md
new file mode 100644
index 0000000000..40666646e9
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ftp-ssl-ccc.md
@@ -0,0 +1,22 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ftp-ssl-ccc
+Help: Send CCC after authenticating
+Protocols: FTP
+Added: 7.16.1
+Category: ftp tls
+Multi: boolean
+See-also:
+  - ssl
+  - ftp-ssl-ccc-mode
+Example:
+  - --ftp-ssl-ccc ftps://example.com/
+---
+
+# `--ftp-ssl-ccc`
+
+Use CCC (Clear Command Channel) Shuts down the SSL/TLS layer after
+authenticating. The rest of the control channel communication is
+unencrypted. This allows NAT routers to follow the FTP transaction. The
+default mode is passive.
diff --git a/third-party/curl/docs/cmdline-opts/ftp-ssl-control.d b/third-party/curl/docs/cmdline-opts/ftp-ssl-control.d
deleted file mode 100644
index b895779271..0000000000
--- a/third-party/curl/docs/cmdline-opts/ftp-ssl-control.d
+++ /dev/null
@@ -1,14 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ftp-ssl-control
-Help: Require SSL/TLS for FTP login, clear for transfer
-Protocols: FTP
-Added: 7.16.0
-Category: ftp tls
-Example: --ftp-ssl-control ftp://example.com
-See-also: ssl
-Multi: boolean
----
-Require SSL/TLS for the FTP login, clear for transfer.  Allows secure
-authentication, but non-encrypted data transfers for efficiency.  Fails the
-transfer if the server does not support SSL/TLS.
diff --git a/third-party/curl/docs/cmdline-opts/ftp-ssl-control.md b/third-party/curl/docs/cmdline-opts/ftp-ssl-control.md
new file mode 100644
index 0000000000..fa85de24f1
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ftp-ssl-control.md
@@ -0,0 +1,22 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ftp-ssl-control
+Help: Require TLS for login, clear for transfer
+Protocols: FTP
+Added: 7.16.0
+Category: ftp tls
+Multi: boolean
+See-also:
+  - ssl
+Example:
+  - --ftp-ssl-control ftp://example.com
+---
+
+# `--ftp-ssl-control`
+
+Require SSL/TLS for the FTP login, clear for transfer. Allows secure
+authentication, but non-encrypted data transfers for efficiency. Fails the
+transfer if the server does not support SSL/TLS.
+
+If set, this option overrides --ssl.
diff --git a/third-party/curl/docs/cmdline-opts/gen.pl b/third-party/curl/docs/cmdline-opts/gen.pl
deleted file mode 100644
index 8b9b98bb2d..0000000000
--- a/third-party/curl/docs/cmdline-opts/gen.pl
+++ /dev/null
@@ -1,744 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-=begin comment
-
-This script generates the manpage.
-
-Example: gen.pl <command> [files] > curl.1
-
-Dev notes:
-
-We open *input* files in :crlf translation (a no-op on many platforms) in
-case we have CRLF line endings in Windows but a perl that defaults to LF.
-Unfortunately it seems some perls like msysgit cannot handle a global input-only
-:crlf so it has to be specified on each file open for text input.
-
-=end comment
-=cut
-
-my %optshort;
-my %optlong;
-my %helplong;
-my %arglong;
-my %redirlong;
-my %protolong;
-my %catlong;
-
-use POSIX qw(strftime);
-my $date = strftime "%B %d %Y", localtime;
-my $year = strftime "%Y", localtime;
-my $version = "unknown";
-my $globals;
-
-open(INC, "<../../include/curl/curlver.h");
-while(<INC>) {
-    if($_ =~ /^#define LIBCURL_VERSION \"([0-9.]*)/) {
-        $version = $1;
-        last;
-    }
-}
-close(INC);
-
-# get the long name version, return the man page string
-sub manpageify {
-    my ($k)=@_;
-    my $l;
-    my $klong = $k;
-    # quote "bare" minuses in the long name
-    $klong =~ s/-/\\-/g;
-    if($optlong{$k} ne "") {
-        # both short + long
-        $l = "\\fI-".$optlong{$k}.", \\-\\-$klong\\fP";
-    }
-    else {
-        # only long
-        $l = "\\fI\\-\\-$klong\\fP";
-    }
-    return $l;
-}
-
-sub printdesc {
-    my @desc = @_;
-    my $exam = 0;
-    for my $d (@desc) {
-        if($d =~ /\(Added in ([0-9.]+)\)/i) {
-            my $ver = $1;
-            if(too_old($ver)) {
-                $d =~ s/ *\(Added in $ver\)//gi;
-            }
-        }
-        if($d !~ /^.\\"/) {
-            # **bold**
-            $d =~ s/\*\*([^ ]*)\*\*/\\fB$1\\fP/g;
-            # *italics*
-            $d =~ s/\*([^ ]*)\*/\\fI$1\\fP/g;
-        }
-        if(!$exam && ($d =~ /^ /)) {
-            # start of example
-            $exam = 1;
-            print ".nf\n"; # no-fill
-        }
-        elsif($exam && ($d !~ /^ /)) {
-            # end of example
-            $exam = 0;
-            print ".fi\n"; # fill-in
-        }
-        # skip lines starting with space (examples)
-        if($d =~ /^[^ ]/ && $d =~ /--/) {
-            # scan for options in longest-names first order
-            for my $k (sort {length($b) <=> length($a)} keys %optlong) {
-                # --tlsv1 is complicated since --tlsv1.2 etc are also
-                # acceptable options!
-                if(($k eq "tlsv1") && ($d =~ /--tlsv1\.[0-9]\\f/)) {
-                    next;
-                }
-                my $l = manpageify($k);
-                $d =~ s/\-\-$k([^a-z0-9-])/$l$1/g;
-            }
-        }
-        # quote minuses in the output
-        $d =~ s/([^\\])-/$1\\-/g;
-        # replace single quotes
-        $d =~ s/\'/\\(aq/g;
-        # handle double quotes first on the line
-        $d =~ s/^(\s*)\"/$1\\(dq/;
-        print $d;
-    }
-    if($exam) {
-        print ".fi\n"; # fill-in
-    }
-}
-
-sub seealso {
-    my($standalone, $data)=@_;
-    if($standalone) {
-        return sprintf
-            ".SH \"SEE ALSO\"\n$data\n";
-    }
-    else {
-        return "See also $data. ";
-    }
-}
-
-sub overrides {
-    my ($standalone, $data)=@_;
-    if($standalone) {
-        return ".SH \"OVERRIDES\"\n$data\n";
-    }
-    else {
-        return $data;
-    }
-}
-
-sub protocols {
-    my ($standalone, $data)=@_;
-    if($standalone) {
-        return ".SH \"PROTOCOLS\"\n$data\n";
-    }
-    else {
-        return "($data) ";
-    }
-}
-
-sub too_old {
-    my ($version)=@_;
-    my $a = 999999;
-    if($version =~ /^(\d+)\.(\d+)\.(\d+)/) {
-        $a = $1 * 1000 + $2 * 10 + $3;
-    }
-    elsif($version =~ /^(\d+)\.(\d+)/) {
-        $a = $1 * 1000 + $2 * 10;
-    }
-    if($a < 7500) {
-        # we consider everything before 7.50.0 to be too old to mention
-        # specific changes for
-        return 1;
-    }
-    return 0;
-}
-
-sub added {
-    my ($standalone, $data)=@_;
-    if(too_old($data)) {
-        # do not mention ancient additions
-        return "";
-    }
-    if($standalone) {
-        return ".SH \"ADDED\"\nAdded in curl version $data\n";
-    }
-    else {
-        return "Added in $data. ";
-    }
-}
-
-sub single {
-    my ($f, $standalone)=@_;
-    open(F, "<:crlf", "$f") ||
-        return 1;
-    my $short;
-    my $long;
-    my $tags;
-    my $added;
-    my $protocols;
-    my $arg;
-    my $mutexed;
-    my $requires;
-    my $category;
-    my $seealso;
-    my $copyright;
-    my $spdx;
-    my @examples; # there can be more than one
-    my $magic; # cmdline special option
-    my $line;
-    my $multi;
-    my $scope;
-    my $experimental;
-    while(<F>) {
-        $line++;
-        if(/^Short: *(.)/i) {
-            $short=$1;
-        }
-        elsif(/^Long: *(.*)/i) {
-            $long=$1;
-        }
-        elsif(/^Added: *(.*)/i) {
-            $added=$1;
-        }
-        elsif(/^Tags: *(.*)/i) {
-            $tags=$1;
-        }
-        elsif(/^Arg: *(.*)/i) {
-            $arg=$1;
-        }
-        elsif(/^Magic: *(.*)/i) {
-            $magic=$1;
-        }
-        elsif(/^Mutexed: *(.*)/i) {
-            $mutexed=$1;
-        }
-        elsif(/^Protocols: *(.*)/i) {
-            $protocols=$1;
-        }
-        elsif(/^See-also: *(.*)/i) {
-            if($seealso) {
-                print STDERR "ERROR: duplicated See-also in $f\n";
-                return 1;
-            }
-            $seealso=$1;
-        }
-        elsif(/^Requires: *(.*)/i) {
-            $requires=$1;
-        }
-        elsif(/^Category: *(.*)/i) {
-            $category=$1;
-        }
-        elsif(/^Example: *(.*)/i) {
-            push @examples, $1;
-        }
-        elsif(/^Multi: *(.*)/i) {
-            $multi=$1;
-        }
-        elsif(/^Scope: *(.*)/i) {
-            $scope=$1;
-        }
-        elsif(/^Experimental: yes/i) {
-            $experimental=1;
-        }
-        elsif(/^C: (.*)/i) {
-            $copyright=$1;
-        }
-        elsif(/^SPDX-License-Identifier: (.*)/i) {
-            $spdx=$1;
-        }
-        elsif(/^Help: *(.*)/i) {
-            ;
-        }
-        elsif(/^---/) {
-            if(!$long) {
-                print STDERR "ERROR: no 'Long:' in $f\n";
-                return 1;
-            }
-            if(!$category) {
-                print STDERR "ERROR: no 'Category:' in $f\n";
-                return 2;
-            }
-            if(!$examples[0]) {
-                print STDERR "$f:$line:1:ERROR: no 'Example:' present\n";
-                return 2;
-            }
-            if(!$added) {
-                print STDERR "$f:$line:1:ERROR: no 'Added:' version present\n";
-                return 2;
-            }
-            if(!$seealso) {
-                print STDERR "$f:$line:1:ERROR: no 'See-also:' field present\n";
-                return 2;
-            }
-            if(!$copyright) {
-                print STDERR "$f:$line:1:ERROR: no 'C:' field present\n";
-                return 2;
-            }
-            if(!$spdx) {
-                print STDERR "$f:$line:1:ERROR: no 'SPDX-License-Identifier:' field present\n";
-                return 2;
-            }
-            last;
-        }
-        else {
-            chomp;
-            print STDERR "WARN: unrecognized line in $f, ignoring:\n:'$_';"
-        }
-    }
-    my @desc;
-    while(<F>) {
-        push @desc, $_;
-    }
-    close(F);
-    my $opt;
-
-    if(defined($short) && $long) {
-        $opt = "-$short, --$long";
-    }
-    elsif($short && !$long) {
-        $opt = "-$short";
-    }
-    elsif($long && !$short) {
-        $opt = "--$long";
-    }
-
-    if($arg) {
-        $opt .= " $arg";
-    }
-
-    # quote "bare" minuses in opt
-    $opt =~ s/-/\\-/g;
-    if($standalone) {
-        print ".TH curl 1 \"30 Nov 2016\" \"curl 7.52.0\" \"curl manual\"\n";
-        print ".SH OPTION\n";
-        print "curl $opt\n";
-    }
-    else {
-        print ".IP \"$opt\"\n";
-    }
-    if($protocols) {
-        print protocols($standalone, $protocols);
-    }
-
-    if($standalone) {
-        print ".SH DESCRIPTION\n";
-    }
-
-    if($experimental) {
-        print "**WARNING**: this option is experimental. Do not use in production.\n\n";
-    }
-
-    printdesc(@desc);
-    undef @desc;
-
-    if($scope) {
-        if($scope eq "global") {
-            print "\nThis option is global and does not need to be specified for each use of --next.\n";
-        }
-        else {
-            print STDERR "$f:$line:1:ERROR: unrecognized scope: '$scope'\n";
-            return 2;
-        }
-    }
-
-    my @extra;
-    if($multi eq "single") {
-        push @extra, "\nIf --$long is provided several times, the last set ".
-            "value is used.\n";
-    }
-    elsif($multi eq "append") {
-        push @extra, "\n--$long can be used several times in a command line\n";
-    }
-    elsif($multi eq "boolean") {
-        my $rev = "no-$long";
-        # for options that start with "no-" the reverse is then without
-        # the no- prefix
-        if($long =~ /^no-/) {
-            $rev = $long;
-            $rev =~ s/^no-//;
-        }
-        push @extra,
-            "\nProviding --$long multiple times has no extra effect.\n".
-            "Disable it again with \\-\\-$rev.\n";
-    }
-    elsif($multi eq "mutex") {
-        push @extra,
-            "\nProviding --$long multiple times has no extra effect.\n";
-    }
-    elsif($multi eq "custom") {
-        ; # left for the text to describe
-    }
-    else {
-        print STDERR "$f:$line:1:ERROR: unrecognized Multi: '$multi'\n";
-        return 2;
-    }
-
-    printdesc(@extra);
-
-    my @foot;
-    if($seealso) {
-        my @m=split(/ /, $seealso);
-        my $mstr;
-        my $and = 0;
-        my $num = scalar(@m);
-        if($num > 2) {
-            # use commas up to this point
-            $and = $num - 1;
-        }
-        my $i = 0;
-        for my $k (@m) {
-            if(!$helplong{$k}) {
-                print STDERR "$f:$line:1:WARN: see-also a non-existing option: $k\n";
-            }
-            my $l = manpageify($k);
-            my $sep = " and";
-            if($and && ($i < $and)) {
-                $sep = ",";
-            }
-            $mstr .= sprintf "%s$l", $mstr?"$sep ":"";
-            $i++;
-        }
-        push @foot, seealso($standalone, $mstr);
-    }
-
-    if($requires) {
-        my $l = manpageify($long);
-        push @foot, "$l requires that the underlying libcurl".
-            " was built to support $requires. ";
-    }
-    if($mutexed) {
-        my @m=split(/ /, $mutexed);
-        my $mstr;
-        for my $k (@m) {
-            if(!$helplong{$k}) {
-                print STDERR "WARN: $f mutexes a non-existing option: $k\n";
-            }
-            my $l = manpageify($k);
-            $mstr .= sprintf "%s$l", $mstr?" and ":"";
-        }
-        push @foot, overrides($standalone,
-                              "This option is mutually exclusive to $mstr. ");
-    }
-    if($examples[0]) {
-        my $s ="";
-        $s="s" if($examples[1]);
-        print "\nExample$s:\n.nf\n";
-        foreach my $e (@examples) {
-            $e =~ s!\$URL!https://example.com!g;
-            $e =~ s/-/\\-/g;
-            $e =~ s/\'/\\(aq/g;
-            print " curl $e\n";
-        }
-        print ".fi\n";
-    }
-    if($added) {
-        push @foot, added($standalone, $added);
-    }
-    if($foot[0]) {
-        print "\n";
-        my $f = join("", @foot);
-        $f =~ s/ +\z//; # remove trailing space
-        print "$f\n";
-    }
-    return 0;
-}
-
-sub getshortlong {
-    my ($f)=@_;
-    open(F, "<:crlf", "$f");
-    my $short;
-    my $long;
-    my $help;
-    my $arg;
-    my $protocols;
-    my $category;
-    while(<F>) {
-        if(/^Short: (.)/i) {
-            $short=$1;
-        }
-        elsif(/^Long: (.*)/i) {
-            $long=$1;
-        }
-        elsif(/^Help: (.*)/i) {
-            $help=$1;
-        }
-        elsif(/^Arg: (.*)/i) {
-            $arg=$1;
-        }
-        elsif(/^Protocols: (.*)/i) {
-            $protocols=$1;
-        }
-        elsif(/^Category: (.*)/i) {
-            $category=$1;
-        }
-        elsif(/^---/) {
-            last;
-        }
-    }
-    close(F);
-    if($short) {
-        $optshort{$short}=$long;
-    }
-    if($long) {
-        $optlong{$long}=$short;
-        $helplong{$long}=$help;
-        $arglong{$long}=$arg;
-        $protolong{$long}=$protocols;
-        $catlong{$long}=$category;
-    }
-}
-
-sub indexoptions {
-    my (@files) = @_;
-    foreach my $f (@files) {
-        getshortlong($f);
-    }
-}
-
-sub header {
-    my ($f)=@_;
-    open(F, "<:crlf", "$f");
-    my @d;
-    while(<F>) {
-        s/%DATE/$date/g;
-        s/%VERSION/$version/g;
-        s/%GLOBALS/$globals/g;
-        push @d, $_;
-    }
-    close(F);
-    printdesc(@d);
-}
-
-sub listhelp {
-    print <<HEAD
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \\| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \\___|\\___/|_| \\_\\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel\@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "tool_setup.h"
-#include "tool_help.h"
-
-/*
- * DO NOT edit tool_listhelp.c manually.
- * This source file is generated with the following command:
-
-  cd \$srcroot/docs/cmdline-opts
-  ./gen.pl listhelp *.d > \$srcroot/src/tool_listhelp.c
- */
-
-const struct helptxt helptext[] = {
-HEAD
-        ;
-    foreach my $f (sort keys %helplong) {
-        my $long = $f;
-        my $short = $optlong{$long};
-        my @categories = split ' ', $catlong{$long};
-        my $bitmask = ' ';
-        my $opt;
-
-        if(defined($short) && $long) {
-            $opt = "-$short, --$long";
-        }
-        elsif($long && !$short) {
-            $opt = "    --$long";
-        }
-        for my $i (0 .. $#categories) {
-            $bitmask .= 'CURLHELP_' . uc $categories[$i];
-            # If not last element, append |
-            if($i < $#categories) {
-                $bitmask .= ' | ';
-            }
-        }
-        $bitmask =~ s/(?=.{76}).{1,76}\|/$&\n  /g;
-        my $arg = $arglong{$long};
-        if($arg) {
-            $opt .= " $arg";
-        }
-        my $desc = $helplong{$f};
-        $desc =~ s/\"/\\\"/g; # escape double quotes
-
-        my $line = sprintf "  {\"%s\",\n   \"%s\",\n  %s},\n", $opt, $desc, $bitmask;
-
-        if(length($opt) > 78) {
-            print STDERR "WARN: the --$long name is too long\n";
-        }
-        elsif(length($desc) > 78) {
-            print STDERR "WARN: the --$long description is too long\n";
-        }
-        print $line;
-    }
-    print <<FOOT
-  { NULL, NULL, CURLHELP_HIDDEN }
-};
-FOOT
-        ;
-}
-
-sub listcats {
-    my %allcats;
-    foreach my $f (sort keys %helplong) {
-        my @categories = split ' ', $catlong{$f};
-        foreach (@categories) {
-            $allcats{$_} = undef;
-        }
-    }
-    my @categories;
-    foreach my $key (keys %allcats) {
-        push @categories, $key;
-    }
-    @categories = sort @categories;
-    unshift @categories, 'hidden';
-    for my $i (0..$#categories) {
-        print '#define ' . 'CURLHELP_' . uc($categories[$i]) . ' ' . "1u << " . $i . "u\n";
-    }
-}
-
-sub listglobals {
-    my (@files) = @_;
-    my @globalopts;
-
-    # Find all global options and output them
-    foreach my $f (sort @files) {
-        open(F, "<:crlf", "$f") ||
-            next;
-        my $long;
-        while(<F>) {
-            if(/^Long: *(.*)/i) {
-                $long=$1;
-            }
-            elsif(/^Scope: global/i) {
-                push @globalopts, $long;
-                last;
-            }
-            elsif(/^---/) {
-                last;
-            }
-        }
-        close(F);
-    }
-    return $ret if($ret);
-    for my $e (0 .. $#globalopts) {
-        $globals .= sprintf "%s--%s",  $e?($globalopts[$e+1] ? ", " : " and "):"",
-            $globalopts[$e],;
-    }
-}
-
-sub mainpage {
-    my (@files) = @_;
-    my $ret;
-    # show the page header
-    header("page-header");
-
-    # output docs for all options
-    foreach my $f (sort @files) {
-        $ret += single($f, 0);
-    }
-
-    if(!$ret) {
-        header("page-footer");
-    }
-    exit $ret if($ret);
-}
-
-sub showonly {
-    my ($f) = @_;
-    if(single($f, 1)) {
-        print STDERR "$f: failed\n";
-    }
-}
-
-sub showprotocols {
-    my %prots;
-    foreach my $f (keys %optlong) {
-        my @p = split(/ /, $protolong{$f});
-        for my $p (@p) {
-            $prots{$p}++;
-        }
-    }
-    for(sort keys %prots) {
-        printf "$_ (%d options)\n", $prots{$_};
-    }
-}
-
-sub getargs {
-    my ($f, @s) = @_;
-    if($f eq "mainpage") {
-        listglobals(@s);
-        mainpage(@s);
-        return;
-    }
-    elsif($f eq "listhelp") {
-        listhelp();
-        return;
-    }
-    elsif($f eq "single") {
-        showonly($s[0]);
-        return;
-    }
-    elsif($f eq "protos") {
-        showprotocols();
-        return;
-    }
-    elsif($f eq "listcats") {
-        listcats();
-        return;
-    }
-
-    print "Usage: gen.pl <mainpage/listhelp/single FILE/protos/listcats> [files]\n";
-}
-
-#------------------------------------------------------------------------
-
-my $cmd = shift @ARGV;
-my @files = @ARGV; # the rest are the files
-
-# learn all existing options
-indexoptions(@files);
-
-getargs($cmd, @files);
diff --git a/third-party/curl/docs/cmdline-opts/get.d b/third-party/curl/docs/cmdline-opts/get.d
deleted file mode 100644
index 2e03a255bc..0000000000
--- a/third-party/curl/docs/cmdline-opts/get.d
+++ /dev/null
@@ -1,20 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: get
-Short: G
-Help: Put the post data in the URL and use GET
-Category: http upload
-Example: --get $URL
-Example: --get -d "tool=curl" -d "age=old" $URL
-Example: --get -I -d "tool=curl" $URL
-Added: 7.8.1
-See-also: data request
-Multi: boolean
----
-When used, this option makes all data specified with --data, --data-binary
-or --data-urlencode to be used in an HTTP GET request instead of the POST
-request that otherwise would be used. The data is appended to the URL
-with a '?' separator.
-
-If used in combination with --head, the POST data is instead appended to the
-URL with a HEAD request.
diff --git a/third-party/curl/docs/cmdline-opts/get.md b/third-party/curl/docs/cmdline-opts/get.md
new file mode 100644
index 0000000000..ac0560ab69
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/get.md
@@ -0,0 +1,28 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: get
+Short: G
+Help: Put the post data in the URL and use GET
+Protocols: HTTP
+Category: http
+Added: 7.8.1
+Multi: boolean
+See-also:
+  - data
+  - request
+Example:
+  - --get $URL
+  - --get -d "tool=curl" -d "age=old" $URL
+  - --get -I -d "tool=curl" $URL
+---
+
+# `--get`
+
+When used, this option makes all data specified with --data, --data-binary or
+--data-urlencode to be used in an HTTP GET request instead of the POST request
+that otherwise would be used. curl appends the provided data to the URL as a
+query string.
+
+If used in combination with --head, the POST data is instead appended to the
+URL with a HEAD request.
diff --git a/third-party/curl/docs/cmdline-opts/globoff.d b/third-party/curl/docs/cmdline-opts/globoff.d
deleted file mode 100644
index 53bed6ec84..0000000000
--- a/third-party/curl/docs/cmdline-opts/globoff.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: globoff
-Short: g
-Help: Disable URL sequences and ranges using {} and []
-Category: curl
-Example: -g "https://example.com/{[]}}}}"
-Added: 7.6
-See-also: config disable
-Multi: boolean
----
-This option switches off the "URL globbing parser". When you set this option,
-you can specify URLs that contain the letters {}[] without having curl itself
-interpret them. Note that these letters are not normal legal URL contents but
-they should be encoded according to the URI standard.
diff --git a/third-party/curl/docs/cmdline-opts/globoff.md b/third-party/curl/docs/cmdline-opts/globoff.md
new file mode 100644
index 0000000000..5ef4b2ae88
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/globoff.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: globoff
+Short: g
+Help: Disable URL globbing with {} and []
+Category: curl
+Added: 7.6
+Multi: boolean
+See-also:
+  - config
+  - disable
+Example:
+  - -g "https://example.com/{[]}}}}"
+---
+
+# `--globoff`
+
+Switch off the URL globbing function. When you set this option, you can
+specify URLs that contain the letters {}[] without having curl itself
+interpret them. Note that these letters are not normal legal URL contents but
+they should be encoded according to the URI standard.
+
+curl detects numerical IPv6 addresses when used in URLs and excludes them from
+the treatment, so they can still be used without having to disable globbing.
diff --git a/third-party/curl/docs/cmdline-opts/happy-eyeballs-timeout-ms.d b/third-party/curl/docs/cmdline-opts/happy-eyeballs-timeout-ms.d
deleted file mode 100644
index 29114e209a..0000000000
--- a/third-party/curl/docs/cmdline-opts/happy-eyeballs-timeout-ms.d
+++ /dev/null
@@ -1,21 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: happy-eyeballs-timeout-ms
-Arg: <milliseconds>
-Help: Time for IPv6 before trying IPv4
-Added: 7.59.0
-Category: connection
-Example: --happy-eyeballs-timeout-ms 500 $URL
-See-also: max-time connect-timeout
-Multi: single
----
-Happy Eyeballs is an algorithm that attempts to connect to both IPv4 and IPv6
-addresses for dual-stack hosts, giving IPv6 a head-start of the specified
-number of milliseconds. If the IPv6 address cannot be connected to within that
-time, then a connection attempt is made to the IPv4 address in parallel. The
-first connection to be established is the one that is used.
-
-The range of suggested useful values is limited. Happy Eyeballs RFC 6555 says
-"It is RECOMMENDED that connection attempts be paced 150-250 ms apart to
-balance human factors against network load." libcurl currently defaults to
-200 ms. Firefox and Chrome currently default to 300 ms.
diff --git a/third-party/curl/docs/cmdline-opts/happy-eyeballs-timeout-ms.md b/third-party/curl/docs/cmdline-opts/happy-eyeballs-timeout-ms.md
new file mode 100644
index 0000000000..f1abb37725
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/happy-eyeballs-timeout-ms.md
@@ -0,0 +1,30 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: happy-eyeballs-timeout-ms
+Arg: <ms>
+Help: Time for IPv6 before IPv4
+Added: 7.59.0
+Category: connection timeout
+Multi: single
+See-also:
+  - max-time
+  - connect-timeout
+Example:
+  - --happy-eyeballs-timeout-ms 500 $URL
+---
+
+# `--happy-eyeballs-timeout-ms`
+
+Set the timeout for Happy Eyeballs.
+
+Happy Eyeballs is an algorithm that attempts to connect to both IPv4 and IPv6
+addresses for dual-stack hosts, giving IPv6 a head-start of the specified
+number of milliseconds. If the IPv6 address cannot be connected to within that
+time, then a connection attempt is made to the IPv4 address in parallel. The
+first connection to be established is the one that is used.
+
+The range of suggested useful values is limited. Happy Eyeballs RFC 6555 says
+"It is RECOMMENDED that connection attempts be paced 150-250 ms apart to
+balance human factors against network load." libcurl currently defaults to
+200 ms. Firefox and Chrome currently default to 300 ms.
diff --git a/third-party/curl/docs/cmdline-opts/haproxy-clientip.d b/third-party/curl/docs/cmdline-opts/haproxy-clientip.d
deleted file mode 100644
index 25cb7e6236..0000000000
--- a/third-party/curl/docs/cmdline-opts/haproxy-clientip.d
+++ /dev/null
@@ -1,29 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: haproxy-clientip
-Help: Sets client IP in HAProxy PROXY protocol v1 header
-Protocols: HTTP
-Added: 8.2.0
-Category: http proxy
-Example: --haproxy-clientip $IP
-See-also: proxy
-Multi: single
----
-Sets a client IP in HAProxy PROXY protocol v1 header at the beginning of the
-connection.
-
-For valid requests, IPv4 addresses must be indicated as a series of exactly
-4 integers in the range [0..255] inclusive written in decimal representation
-separated by exactly one dot between each other. Heading zeroes are not
-permitted in front of numbers in order to avoid any possible confusion
-with octal numbers. IPv6 addresses must be indicated as series of 4 hexadecimal
-digits (upper or lower case) delimited by colons between each other, with the
-acceptance of one double colon sequence to replace the largest acceptable range
-of consecutive zeroes. The total number of decoded bits must exactly be 128.
-
-Otherwise, any string can be accepted for the client IP and get sent.
-
-It replaces --haproxy-protocol if used, it is not necessary to specify both flags.
-
-This option is primarily useful when sending test requests to
-verify a service is working as intended.
diff --git a/third-party/curl/docs/cmdline-opts/haproxy-clientip.md b/third-party/curl/docs/cmdline-opts/haproxy-clientip.md
new file mode 100644
index 0000000000..4bbf26ecce
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/haproxy-clientip.md
@@ -0,0 +1,33 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: haproxy-clientip
+Arg: <ip>
+Help: Set address in HAProxy PROXY
+Protocols: HTTP
+Added: 8.2.0
+Category: http proxy
+Multi: single
+See-also:
+  - proxy
+Example:
+  - --haproxy-clientip $IP
+---
+
+# `--haproxy-clientip`
+
+Set a client IP in HAProxy PROXY protocol v1 header at the beginning of the
+connection.
+
+For valid requests, IPv4 addresses must be indicated as a series of exactly
+4 integers in the range [0..255] inclusive written in decimal representation
+separated by exactly one dot between each other. Heading zeroes are not
+permitted in front of numbers in order to avoid any possible confusion
+with octal numbers. IPv6 addresses must be indicated as series of 4 hexadecimal
+digits (upper or lower case) delimited by colons between each other, with the
+acceptance of one double colon sequence to replace the largest acceptable range
+of consecutive zeroes. The total number of decoded bits must be exactly 128.
+
+Otherwise, any string can be accepted for the client IP and get sent.
+
+It replaces --haproxy-protocol if used, it is not necessary to specify both flags.
diff --git a/third-party/curl/docs/cmdline-opts/haproxy-protocol.d b/third-party/curl/docs/cmdline-opts/haproxy-protocol.d
deleted file mode 100644
index 34119062e4..0000000000
--- a/third-party/curl/docs/cmdline-opts/haproxy-protocol.d
+++ /dev/null
@@ -1,17 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: haproxy-protocol
-Help: Send HAProxy PROXY protocol v1 header
-Protocols: HTTP
-Added: 7.60.0
-Category: http proxy
-Example: --haproxy-protocol $URL
-See-also: proxy
-Multi: boolean
----
-Send a HAProxy PROXY protocol v1 header at the beginning of the
-connection. This is used by some load balancers and reverse proxies to
-indicate the client's true IP address and port.
-
-This option is primarily useful when sending test requests to a service that
-expects this header.
diff --git a/third-party/curl/docs/cmdline-opts/haproxy-protocol.md b/third-party/curl/docs/cmdline-opts/haproxy-protocol.md
new file mode 100644
index 0000000000..26456c80bf
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/haproxy-protocol.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: haproxy-protocol
+Help: Send HAProxy PROXY protocol v1 header
+Protocols: HTTP
+Added: 7.60.0
+Category: http proxy
+Multi: boolean
+See-also:
+  - proxy
+Example:
+  - --haproxy-protocol $URL
+---
+
+# `--haproxy-protocol`
+
+Send a HAProxy PROXY protocol v1 header at the beginning of the connection.
+This is used by some load balancers and reverse proxies to indicate the
+client's true IP address and port.
+
+This option is primarily useful when sending test requests to a service that
+expects this header.
diff --git a/third-party/curl/docs/cmdline-opts/head.d b/third-party/curl/docs/cmdline-opts/head.d
deleted file mode 100644
index bb748b72ef..0000000000
--- a/third-party/curl/docs/cmdline-opts/head.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: head
-Short: I
-Help: Show document info only
-Protocols: HTTP FTP FILE
-Category: http ftp file
-Example: -I $URL
-Added: 4.0
-See-also: get verbose trace-ascii
-Multi: boolean
----
-Fetch the headers only! HTTP-servers feature the command HEAD which this uses
-to get nothing but the header of a document. When used on an FTP or FILE file,
-curl displays the file size and last modification time only.
diff --git a/third-party/curl/docs/cmdline-opts/head.md b/third-party/curl/docs/cmdline-opts/head.md
new file mode 100644
index 0000000000..7e005c7254
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/head.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: head
+Short: I
+Help: Show document info only
+Protocols: HTTP FTP FILE
+Category: important http ftp file
+Added: 4.0
+Multi: boolean
+See-also:
+  - get
+  - verbose
+  - trace-ascii
+Example:
+  - -I $URL
+---
+
+# `--head`
+
+Fetch the headers only. HTTP-servers feature the command HEAD which this uses
+to get nothing but the header of a document. When used on an FTP or FILE URL,
+curl displays the file size and last modification time only.
diff --git a/third-party/curl/docs/cmdline-opts/header.d b/third-party/curl/docs/cmdline-opts/header.d
deleted file mode 100644
index f5b7685524..0000000000
--- a/third-party/curl/docs/cmdline-opts/header.d
+++ /dev/null
@@ -1,56 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: header
-Short: H
-Arg: <header/@file>
-Help: Pass custom header(s) to server
-Protocols: HTTP IMAP SMTP
-Category: http imap smtp
-See-also: user-agent referer
-Example: -H "X-First-Name: Joe" $URL
-Example: -H "User-Agent: yes-please/2000" $URL
-Example: -H "Host:" $URL
-Example: -H @headers.txt $URL
-Added: 5.0
-Multi: append
----
-Extra header to include in information sent. When used within an HTTP request,
-it is added to the regular request headers.
-
-For an IMAP or SMTP MIME uploaded mail built with --form options, it is
-prepended to the resulting MIME document, effectively including it at the mail
-global level. It does not affect raw uploaded mails (Added in 7.56.0).
-
-You may specify any number of extra headers. Note that if you should add a
-custom header that has the same name as one of the internal ones curl would
-use, your externally set header is used instead of the internal one. This
-allows you to make even trickier stuff than curl would normally do. You should
-not replace internally set headers without knowing perfectly well what you are
-doing. Remove an internal header by giving a replacement without content on
-the right side of the colon, as in: -H "Host:". If you send the custom header
-with no-value then its header must be terminated with a semicolon, such as \-H
-"X-Custom-Header;" to send "X-Custom-Header:".
-
-curl makes sure that each header you add/replace is sent with the proper
-end-of-line marker, you should thus **not** add that as a part of the header
-content: do not add newlines or carriage returns, they only mess things up for
-you.
-
-This option can take an argument in @filename style, which then adds a header
-for each line in the input file. Using @- makes curl read the header file from
-stdin. Added in 7.55.0.
-
-Please note that most anti-spam utilities check the presence and value of
-several MIME mail headers: these are "From:", "To:", "Date:" and "Subject:"
-among others and should be added with this option.
-
-You need --proxy-header to send custom headers intended for an HTTP
-proxy. Added in 7.37.0.
-
-Passing on a "Transfer-Encoding: chunked" header when doing an HTTP request
-with a request body, makes curl send the data using chunked encoding.
-
-**WARNING**: headers set with this option are set in all HTTP requests - even
-after redirects are followed, like when told with --location. This can lead to
-the header being sent to other hosts than the original host, so sensitive
-headers should be used with caution combined with following redirects.
diff --git a/third-party/curl/docs/cmdline-opts/header.md b/third-party/curl/docs/cmdline-opts/header.md
new file mode 100644
index 0000000000..9e1f2029e0
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/header.md
@@ -0,0 +1,69 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: header
+Short: H
+Arg: <header/@file>
+Help: Pass custom header(s) to server
+Protocols: HTTP IMAP SMTP
+Category: important http imap smtp
+Added: 5.0
+Multi: append
+See-also:
+  - user-agent
+  - referer
+  - proxy-header
+Example:
+  - -H "X-First-Name: Joe" $URL
+  - -H "User-Agent: yes-please/2000" $URL
+  - -H "Host:" $URL
+  - -H @headers.txt $URL
+---
+
+# `--header`
+
+Extra header to include in information sent. When used within an HTTP request,
+it is added to the regular request headers.
+
+For an IMAP or SMTP MIME uploaded mail built with --form options, it is
+prepended to the resulting MIME document, effectively including it at the mail
+global level. It does not affect raw uploaded mails (Added in 7.56.0).
+
+You may specify any number of extra headers. Note that if you should add a
+custom header that has the same name as one of the internal ones curl would
+use, your externally set header is used instead of the internal one. This
+allows you to make even trickier stuff than curl would normally do. You should
+not replace internally set headers without knowing perfectly well what you are
+doing. Remove an internal header by giving a replacement without content on
+the right side of the colon, as in: -H `Host:`. If you send the custom header
+with no-value then its header must be terminated with a semicolon, such as -H
+`X-Custom-Header;` to send `X-Custom-Header:`.
+
+curl makes sure that each header you add/replace is sent with the proper
+end-of-line marker, you should thus **not** add that as a part of the header
+content: do not add newlines or carriage returns, they only mess things up for
+you. curl passes on the verbatim string you give it without any filter or
+other safe guards. That includes white space and control characters.
+
+This option can take an argument in @filename style, which then adds a header
+for each line in the input file. Using @- makes curl read the header file from
+stdin. (Added in 7.55.0)
+
+Please note that most anti-spam utilities check the presence and value of
+several MIME mail headers: these are `From:`, `To:`, `Date:` and `Subject:`
+among others and should be added with this option.
+
+You need --proxy-header to send custom headers intended for an HTTP proxy.
+(Added in 7.37.0)
+
+Passing on a `Transfer-Encoding: chunked` header when doing an HTTP request
+with a request body, makes curl send the data using chunked encoding.
+
+**WARNING**: headers set with this option are set in all HTTP requests - even
+after redirects are followed, like when told with --location. This can lead to
+the header being sent to other hosts than the original host, so sensitive
+headers should be used with caution combined with following redirects.
+
+`Authorization:` and `Cookie:` headers are explicitly *not* passed on in HTTP
+requests when following redirects to other origins, unless --location-trusted
+is used.
diff --git a/third-party/curl/docs/cmdline-opts/help.d b/third-party/curl/docs/cmdline-opts/help.d
deleted file mode 100644
index f8675e4842..0000000000
--- a/third-party/curl/docs/cmdline-opts/help.d
+++ /dev/null
@@ -1,21 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: help
-Arg: <category>
-Short: h
-Help: Get help for commands
-Category: important curl
-Example: --help all
-Added: 4.0
-See-also: verbose
-Multi: custom
----
-Usage help. This lists all curl command line options within the given
-**category**.
-
-If no argument is provided, curl displays only the most important command line
-arguments.
-
-For category **all**, curl displays help for all options.
-
-If **category** is specified, curl displays all available help categories.
diff --git a/third-party/curl/docs/cmdline-opts/help.md b/third-party/curl/docs/cmdline-opts/help.md
new file mode 100644
index 0000000000..122c55cd43
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/help.md
@@ -0,0 +1,39 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: help
+Arg: <subject>
+Short: h
+Help: Get help for commands
+Category: important curl
+Added: 4.0
+Multi: custom
+See-also:
+  - verbose
+Example:
+  - --help all
+  - --help --insecure
+  - --help -f
+---
+
+# `--help`
+
+Usage help. Provide help for the subject given as an optional argument.
+
+If no argument is provided, curl displays the most important command line
+arguments.
+
+The argument can either be a **category** or a **command line option**. When a
+category is provided, curl shows all command line options within the given
+category. Specify category `all` to list all available options.
+
+If `category` is specified, curl displays all available help categories.
+
+If the provided subject is instead an existing command line option, specified
+either in its short form with a single dash and a single letter, or in the
+long form with two dashes and a longer name, curl displays a help text for
+that option in the terminal.
+
+The help output is extensive for some options.
+
+If the provided command line option is not known, curl says so.
diff --git a/third-party/curl/docs/cmdline-opts/hostpubmd5.d b/third-party/curl/docs/cmdline-opts/hostpubmd5.d
deleted file mode 100644
index e9db23db08..0000000000
--- a/third-party/curl/docs/cmdline-opts/hostpubmd5.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: hostpubmd5
-Arg: <md5>
-Help: Acceptable MD5 hash of the host public key
-Protocols: SFTP SCP
-Added: 7.17.1
-Category: sftp scp
-Example: --hostpubmd5 e5c1c49020640a5ab0f2034854c321a8 sftp://example.com/
-See-also: hostpubsha256
-Multi: single
----
-Pass a string containing 32 hexadecimal digits. The string should
-be the 128 bit MD5 checksum of the remote host's public key, curl refuses
-the connection with the host unless the md5sums match.
diff --git a/third-party/curl/docs/cmdline-opts/hostpubmd5.md b/third-party/curl/docs/cmdline-opts/hostpubmd5.md
new file mode 100644
index 0000000000..5d480a5bcd
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/hostpubmd5.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: hostpubmd5
+Arg: <md5>
+Help: Acceptable MD5 hash of host public key
+Protocols: SFTP SCP
+Added: 7.17.1
+Category: sftp scp ssh
+Multi: single
+See-also:
+  - hostpubsha256
+Example:
+  - --hostpubmd5 e5c1c49020640a5ab0f2034854c321a8 sftp://example.com/
+---
+
+# `--hostpubmd5`
+
+Pass a string containing 32 hexadecimal digits. The string should be the 128
+bit **MD5** checksum of the remote host's public key, curl refuses the
+connection with the host unless the checksums match.
diff --git a/third-party/curl/docs/cmdline-opts/hostpubsha256.d b/third-party/curl/docs/cmdline-opts/hostpubsha256.d
deleted file mode 100644
index b33f338bdd..0000000000
--- a/third-party/curl/docs/cmdline-opts/hostpubsha256.d
+++ /dev/null
@@ -1,17 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: hostpubsha256
-Arg: <sha256>
-Help: Acceptable SHA256 hash of the host public key
-Protocols: SFTP SCP
-Added: 7.80.0
-Category: sftp scp
-Example: --hostpubsha256 NDVkMTQxMGQ1ODdmMjQ3MjczYjAyOTY5MmRkMjVmNDQ= sftp://example.com/
-See-also: hostpubmd5
-Multi: single
----
-Pass a string containing a Base64-encoded SHA256 hash of the remote host's
-public key. Curl refuses the connection with the host unless the hashes match.
-
-This feature requires libcurl to be built with libssh2 and does not work with
-other SSH backends.
diff --git a/third-party/curl/docs/cmdline-opts/hostpubsha256.md b/third-party/curl/docs/cmdline-opts/hostpubsha256.md
new file mode 100644
index 0000000000..a92dbe5d7c
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/hostpubsha256.md
@@ -0,0 +1,20 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: hostpubsha256
+Arg: <sha256>
+Help: Acceptable SHA256 hash of host public key
+Protocols: SFTP SCP
+Added: 7.80.0
+Category: sftp scp ssh
+Multi: single
+See-also:
+  - hostpubmd5
+Example:
+  - --hostpubsha256 NDVkMTQxMGQ1ODdmMjQ3MjczYjAyOTY5MmRkMjVmNDQ= sftp://example.com/
+---
+
+# `--hostpubsha256`
+
+Pass a string containing a Base64-encoded SHA256 hash of the remote host's
+public key. curl refuses the connection with the host unless the hashes match.
diff --git a/third-party/curl/docs/cmdline-opts/hsts.d b/third-party/curl/docs/cmdline-opts/hsts.d
deleted file mode 100644
index e30d3b419d..0000000000
--- a/third-party/curl/docs/cmdline-opts/hsts.d
+++ /dev/null
@@ -1,26 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: hsts
-Arg: <file name>
-Protocols: HTTPS
-Help: Enable HSTS with this cache file
-Added: 7.74.0
-Category: http
-Example: --hsts cache.txt $URL
-See-also: proto
-Multi: append
----
-This option enables HSTS for the transfer. If the file name points to an
-existing HSTS cache file, that is used. After a completed transfer, the
-cache is saved to the file name again if it has been modified.
-
-If curl is told to use HTTP:// for a transfer involving a host name that
-exists in the HSTS cache, it upgrades the transfer to use HTTPS. Each HSTS
-cache entry has an individual life time after which the upgrade is no longer
-performed.
-
-Specify a "" file name (zero length) to avoid loading/saving and make curl
-just handle HSTS in memory.
-
-If this option is used several times, curl loads contents from all the
-files but the last one is used for saving.
diff --git a/third-party/curl/docs/cmdline-opts/hsts.md b/third-party/curl/docs/cmdline-opts/hsts.md
new file mode 100644
index 0000000000..7653c65cd5
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/hsts.md
@@ -0,0 +1,40 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: hsts
+Arg: <filename>
+Protocols: HTTPS
+Help: Enable HSTS with this cache file
+Added: 7.74.0
+Category: http
+Multi: append
+See-also:
+  - proto
+Example:
+  - --hsts cache.txt $URL
+---
+
+# `--hsts`
+
+Enable HSTS for the transfer. If the filename points to an existing HSTS cache
+file, that is used. After a completed transfer, the cache is saved to the
+filename again if it has been modified. If you run multiple curl invokes at
+the same time using the same HSTS cache file, they might interfere with each
+other in possibly undesired ways.
+
+If curl is told to use `http://` for a transfer involving a hostname that
+exists in the HSTS cache, it upgrades the transfer to use HTTPS. Each HSTS
+cache entry has an individual lifetime after which the upgrade is no longer
+performed.
+
+Specify a "" filename (zero length) to avoid loading/saving and make curl
+handle HSTS in memory.
+
+You may want to restrict your umask to prevent other users on the same system
+to access the created file.
+
+If this option is used several times, curl loads contents from all the
+files but the last one is used for saving.
+
+Since curl 8.20.0, curl keeps no more than the most recently added 10,000
+unique HSTS hostnames.
diff --git a/third-party/curl/docs/cmdline-opts/http0.9.d b/third-party/curl/docs/cmdline-opts/http0.9.d
deleted file mode 100644
index 3dd14a05ce..0000000000
--- a/third-party/curl/docs/cmdline-opts/http0.9.d
+++ /dev/null
@@ -1,19 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: http0.9
-Tags: Versions
-Protocols: HTTP
-Help: Allow HTTP 0.9 responses
-Category: http
-Example: --http0.9 $URL
-Added: 7.64.0
-See-also: http1.1 http2 http3
-Multi: boolean
----
-Tells curl to be fine with HTTP version 0.9 response.
-
-HTTP/0.9 is a response without headers and therefore you can also connect with
-this to non-HTTP servers and still get a response since curl simply
-transparently downgrades - if allowed.
-
-HTTP/0.9 is disabled by default (added in 7.66.0)
diff --git a/third-party/curl/docs/cmdline-opts/http0.9.md b/third-party/curl/docs/cmdline-opts/http0.9.md
new file mode 100644
index 0000000000..65be14491c
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/http0.9.md
@@ -0,0 +1,27 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: http0.9
+Tags: Versions
+Protocols: HTTP
+Help: Allow HTTP/0.9 responses
+Category: http
+Added: 7.64.0
+Multi: boolean
+See-also:
+  - http1.1
+  - http2
+  - http3
+Example:
+  - --http0.9 $URL
+---
+
+# `--http0.9`
+
+Accept an HTTP version 0.9 response.
+
+HTTP/0.9 is a response without headers and therefore you can also connect with
+this to non-HTTP servers and still get a response since curl
+transparently downgrades - if allowed.
+
+HTTP/0.9 is disabled by default (added in 7.66.0)
diff --git a/third-party/curl/docs/cmdline-opts/http1.0.d b/third-party/curl/docs/cmdline-opts/http1.0.d
deleted file mode 100644
index c5f4de872e..0000000000
--- a/third-party/curl/docs/cmdline-opts/http1.0.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Short: 0
-Long: http1.0
-Tags: Versions
-Protocols: HTTP
-Added: 7.9.1
-Mutexed: http1.1 http2 http2-prior-knowledge http3
-Help: Use HTTP 1.0
-Category: http
-Example: --http1.0 $URL
-See-also: http0.9 http1.1
-Multi: mutex
----
-Tells curl to use HTTP version 1.0 instead of using its internally preferred
-HTTP version.
diff --git a/third-party/curl/docs/cmdline-opts/http1.0.md b/third-party/curl/docs/cmdline-opts/http1.0.md
new file mode 100644
index 0000000000..0252f05230
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/http1.0.md
@@ -0,0 +1,22 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Short: 0
+Long: http1.0
+Tags: Versions
+Protocols: HTTP
+Added: 7.9.1
+Mutexed: http1.1 http2 http2-prior-knowledge http3
+Help: Use HTTP/1.0
+Category: http
+Multi: mutex
+See-also:
+  - http0.9
+  - http1.1
+Example:
+  - --http1.0 $URL
+---
+
+# `--http1.0`
+
+Use HTTP version 1.0 instead of using its internally preferred HTTP version.
diff --git a/third-party/curl/docs/cmdline-opts/http1.1.d b/third-party/curl/docs/cmdline-opts/http1.1.d
deleted file mode 100644
index 3057aed36d..0000000000
--- a/third-party/curl/docs/cmdline-opts/http1.1.d
+++ /dev/null
@@ -1,14 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: http1.1
-Tags: Versions
-Protocols: HTTP
-Added: 7.33.0
-Mutexed: http1.0 http2 http2-prior-knowledge http3
-Help: Use HTTP 1.1
-Category: http
-Example: --http1.1 $URL
-See-also: http1.0 http0.9
-Multi: mutex
----
-Tells curl to use HTTP version 1.1.
diff --git a/third-party/curl/docs/cmdline-opts/http1.1.md b/third-party/curl/docs/cmdline-opts/http1.1.md
new file mode 100644
index 0000000000..3d241e5c59
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/http1.1.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: http1.1
+Tags: Versions
+Protocols: HTTP
+Added: 7.33.0
+Mutexed: http1.0 http2 http2-prior-knowledge http3
+Help: Use HTTP/1.1
+Category: http
+Multi: mutex
+See-also:
+  - http1.0
+  - http0.9
+Example:
+  - --http1.1 $URL
+---
+
+# `--http1.1`
+
+Use HTTP version 1.1. This is the default with `http://` URLs.
diff --git a/third-party/curl/docs/cmdline-opts/http2-prior-knowledge.d b/third-party/curl/docs/cmdline-opts/http2-prior-knowledge.d
deleted file mode 100644
index 7d7cabfd86..0000000000
--- a/third-party/curl/docs/cmdline-opts/http2-prior-knowledge.d
+++ /dev/null
@@ -1,18 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: http2-prior-knowledge
-Tags: Versions
-Protocols: HTTP
-Added: 7.49.0
-Mutexed: http1.1 http1.0 http2 http3
-Requires: HTTP/2
-Help: Use HTTP 2 without HTTP/1.1 Upgrade
-Category: http
-Example: --http2-prior-knowledge $URL
-See-also: http2 http3
-Multi: boolean
----
-Tells curl to issue its non-TLS HTTP requests using HTTP/2 without HTTP/1.1
-Upgrade. It requires prior knowledge that the server supports HTTP/2 straight
-away. HTTPS requests still do HTTP/2 the standard way with negotiated protocol
-version in the TLS handshake.
diff --git a/third-party/curl/docs/cmdline-opts/http2-prior-knowledge.md b/third-party/curl/docs/cmdline-opts/http2-prior-knowledge.md
new file mode 100644
index 0000000000..6351e06a79
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/http2-prior-knowledge.md
@@ -0,0 +1,29 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: http2-prior-knowledge
+Tags: Versions
+Protocols: HTTP
+Added: 7.49.0
+Mutexed: http1.1 http1.0 http2 http3
+Requires: HTTP/2
+Help: Use HTTP/2 without HTTP/1.1 Upgrade
+Category: http
+Multi: boolean
+See-also:
+  - http2
+  - http3
+Example:
+  - --http2-prior-knowledge $URL
+---
+
+# `--http2-prior-knowledge`
+
+Issue a non-TLS HTTP request using HTTP/2 directly without HTTP/1.1 Upgrade.
+It requires prior knowledge that the server supports HTTP/2 straight away.
+HTTPS requests still do HTTP/2 the standard way with negotiated protocol
+versions in the TLS handshake.
+
+Since 8.10.0 if this option is set for an HTTPS request then the application
+layer protocol version (ALPN) offered to the server is only HTTP/2. Prior to
+that both HTTP/1.1 and HTTP/2 were offered.
diff --git a/third-party/curl/docs/cmdline-opts/http2.d b/third-party/curl/docs/cmdline-opts/http2.d
deleted file mode 100644
index af5f3c4f5a..0000000000
--- a/third-party/curl/docs/cmdline-opts/http2.d
+++ /dev/null
@@ -1,25 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: http2
-Tags: Versions
-Protocols: HTTP
-Added: 7.33.0
-Mutexed: http1.1 http1.0 http2-prior-knowledge http3
-Requires: HTTP/2
-Help: Use HTTP/2
-See-also: http1.1 http3 no-alpn
-Category: http
-Example: --http2 $URL
-Multi: mutex
----
-Tells curl to use HTTP version 2.
-
-For HTTPS, this means curl negotiates HTTP/2 in the TLS handshake. curl does
-this by default.
-
-For HTTP, this means curl attempts to upgrade the request to HTTP/2 using the
-Upgrade: request header.
-
-When curl uses HTTP/2 over HTTPS, it does not itself insist on TLS 1.2 or
-higher even though that is required by the specification. A user can add this
-version requirement with --tlsv1.2.
diff --git a/third-party/curl/docs/cmdline-opts/http2.md b/third-party/curl/docs/cmdline-opts/http2.md
new file mode 100644
index 0000000000..f5180be2b5
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/http2.md
@@ -0,0 +1,34 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: http2
+Tags: Versions
+Protocols: HTTP
+Added: 7.33.0
+Mutexed: http1.1 http1.0 http2-prior-knowledge http3
+Requires: HTTP/2
+Help: Use HTTP/2
+Category: http
+Multi: mutex
+See-also:
+  - http1.1
+  - http3
+  - no-alpn
+  - proxy-http2
+Example:
+  - --http2 $URL
+---
+
+# `--http2`
+
+Use HTTP/2.
+
+For HTTPS, this means curl negotiates HTTP/2 in the TLS handshake. curl does
+this by default.
+
+For HTTP, this means curl attempts to upgrade the request to HTTP/2 using the
+Upgrade: request header.
+
+When curl uses HTTP/2 over HTTPS, it does not itself insist on TLS 1.2 or
+higher even though that is required by the specification. A user can add this
+version requirement with --tlsv1.2.
diff --git a/third-party/curl/docs/cmdline-opts/http3-only.d b/third-party/curl/docs/cmdline-opts/http3-only.d
deleted file mode 100644
index c3f0f31aa1..0000000000
--- a/third-party/curl/docs/cmdline-opts/http3-only.d
+++ /dev/null
@@ -1,25 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: http3-only
-Tags: Versions
-Protocols: HTTP
-Added: 7.88.0
-Mutexed: http1.1 http1.0 http2 http2-prior-knowledge http3
-Requires: HTTP/3
-Help: Use HTTP v3 only
-See-also: http1.1 http2 http3
-Category: http
-Example: --http3-only $URL
-Multi: mutex
-Experimental: yes
----
-Instructs curl to use HTTP/3 to the host in the URL, with no fallback to
-earlier HTTP versions. HTTP/3 can only be used for HTTPS and not for HTTP
-URLs. For HTTP, this option triggers an error.
-
-This option allows a user to avoid using the Alt-Svc method of upgrading to
-HTTP/3 when you know that the target speaks HTTP/3 on the given host and port.
-
-This option makes curl fail if a QUIC connection cannot be established, it
-does not attempt any other HTTP versions on its own. Use --http3 for similar
-functionality *with* a fallback.
diff --git a/third-party/curl/docs/cmdline-opts/http3-only.md b/third-party/curl/docs/cmdline-opts/http3-only.md
new file mode 100644
index 0000000000..400ac19ac2
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/http3-only.md
@@ -0,0 +1,32 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: http3-only
+Tags: Versions
+Protocols: HTTP
+Added: 7.88.0
+Mutexed: http1.1 http1.0 http2 http2-prior-knowledge http3
+Requires: HTTP/3
+Help: Use HTTP/3 only
+Category: http
+Multi: mutex
+See-also:
+  - http1.1
+  - http2
+  - http3
+Example:
+  - --http3-only $URL
+---
+
+# `--http3-only`
+
+Instruct curl to use HTTP/3 to the host in the URL, with no fallback to
+earlier HTTP versions. HTTP/3 can only be used for HTTPS and not for HTTP
+URLs. For HTTP, this option triggers an error.
+
+This option allows a user to avoid using the Alt-Svc method of upgrading to
+HTTP/3 when you know that the target speaks HTTP/3 on the given host and port.
+
+This option makes curl fail if a QUIC connection cannot be established, it
+does not attempt any other HTTP versions on its own. Use --http3 for similar
+functionality *with* a fallback.
diff --git a/third-party/curl/docs/cmdline-opts/http3.d b/third-party/curl/docs/cmdline-opts/http3.d
deleted file mode 100644
index a8258c4d31..0000000000
--- a/third-party/curl/docs/cmdline-opts/http3.d
+++ /dev/null
@@ -1,27 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: http3
-Tags: Versions
-Protocols: HTTP
-Added: 7.66.0
-Mutexed: http1.1 http1.0 http2 http2-prior-knowledge http3-only
-Requires: HTTP/3
-Help: Use HTTP v3
-See-also: http1.1 http2
-Category: http
-Example: --http3 $URL
-Multi: mutex
-Experimental: yes
----
-Tells curl to try HTTP/3 to the host in the URL, but fallback to earlier
-HTTP versions if the HTTP/3 connection establishment fails. HTTP/3 is only
-available for HTTPS and not for HTTP URLs.
-
-This option allows a user to avoid using the Alt-Svc method of upgrading to
-HTTP/3 when you know that the target speaks HTTP/3 on the given host and port.
-
-When asked to use HTTP/3, curl issues a separate attempt to use older HTTP
-versions with a slight delay, so if the HTTP/3 transfer fails or is slow, curl
-still tries to proceed with an older HTTP version.
-
-Use --http3-only for similar functionality *without* a fallback.
diff --git a/third-party/curl/docs/cmdline-opts/http3.md b/third-party/curl/docs/cmdline-opts/http3.md
new file mode 100644
index 0000000000..e4dfeef075
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/http3.md
@@ -0,0 +1,37 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: http3
+Tags: Versions
+Protocols: HTTP
+Added: 7.66.0
+Mutexed: http1.1 http1.0 http2 http2-prior-knowledge http3-only
+Requires: HTTP/3
+Help: Use HTTP/3
+Category: http
+Multi: mutex
+See-also:
+  - http1.1
+  - http2
+Example:
+  - --http3 $URL
+---
+
+# `--http3`
+
+Attempt HTTP/3 to the host in the URL, but fallback to earlier HTTP versions
+if the HTTP/3 connection establishment fails or is slow. HTTP/3 is only
+available for HTTPS and not for HTTP URLs.
+
+This option allows a user to avoid using the Alt-Svc method of upgrading to
+HTTP/3 when you know or suspect that the target speaks HTTP/3 on the given
+host and port.
+
+When asked to use HTTP/3, curl issues a separate attempt to use older HTTP
+versions with a slight delay, so if the HTTP/3 transfer fails or is slow, curl
+still tries to proceed with an older HTTP version. The fallback performs the
+regular negotiation between HTTP/1 and HTTP/2.
+
+Use --http3-only for similar functionality *without* a fallback.
+
+curl cannot do HTTP/3 over any proxy.
diff --git a/third-party/curl/docs/cmdline-opts/ignore-content-length.d b/third-party/curl/docs/cmdline-opts/ignore-content-length.d
deleted file mode 100644
index 505c04c18b..0000000000
--- a/third-party/curl/docs/cmdline-opts/ignore-content-length.d
+++ /dev/null
@@ -1,19 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ignore-content-length
-Help: Ignore the size of the remote resource
-Protocols: FTP HTTP
-Category: http ftp
-Example: --ignore-content-length $URL
-Added: 7.14.1
-See-also: ftp-skip-pasv-ip
-Multi: boolean
----
-For HTTP, Ignore the Content-Length header. This is particularly useful for
-servers running Apache 1.x, which reports incorrect Content-Length for
-files larger than 2 gigabytes.
-
-For FTP, this makes curl skip the SIZE command to figure out the size before
-downloading a file (added in 7.46.0).
-
-This option does not work for HTTP if libcurl was built to use hyper.
diff --git a/third-party/curl/docs/cmdline-opts/ignore-content-length.md b/third-party/curl/docs/cmdline-opts/ignore-content-length.md
new file mode 100644
index 0000000000..01ff43b06e
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ignore-content-length.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ignore-content-length
+Help: Ignore the size of the remote resource
+Protocols: FTP HTTP
+Category: http ftp
+Added: 7.14.1
+Multi: boolean
+See-also:
+  - ftp-skip-pasv-ip
+Example:
+  - --ignore-content-length $URL
+---
+
+# `--ignore-content-length`
+
+For HTTP, ignore the Content-Length header. This is particularly useful for
+servers running Apache 1.x, which reports incorrect Content-Length for files
+larger than 2 gigabytes.
+
+For FTP, this makes curl skip the SIZE command to figure out the size before
+downloading a file (added in 7.46.0).
diff --git a/third-party/curl/docs/cmdline-opts/include.d b/third-party/curl/docs/cmdline-opts/include.d
deleted file mode 100644
index ce7b9d87b4..0000000000
--- a/third-party/curl/docs/cmdline-opts/include.d
+++ /dev/null
@@ -1,19 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: include
-Short: i
-Help: Include protocol response headers in the output
-See-also: verbose
-Category: important verbose
-Example: -i $URL
-Added: 4.8
-Multi: boolean
----
-Include the HTTP response headers in the output. The HTTP response headers can
-include things like server name, cookies, date of the document, HTTP version
-and more...
-
-To view the request headers, consider the --verbose option.
-
-Prior to 7.75.0 curl did not print the headers if --fail was used in
-combination with this option and there was error reported by server.
diff --git a/third-party/curl/docs/cmdline-opts/insecure.d b/third-party/curl/docs/cmdline-opts/insecure.d
deleted file mode 100644
index e48d500029..0000000000
--- a/third-party/curl/docs/cmdline-opts/insecure.d
+++ /dev/null
@@ -1,33 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: insecure
-Short: k
-Help: Allow insecure server connections
-Protocols: TLS SFTP SCP
-See-also: proxy-insecure cacert capath
-Category: tls sftp scp
-Example: --insecure $URL
-Added: 7.10
-Multi: boolean
----
-By default, every secure connection curl makes is verified to be secure before
-the transfer takes place. This option makes curl skip the verification step
-and proceed without checking.
-
-When this option is not used for protocols using TLS, curl verifies the
-server's TLS certificate before it continues: that the certificate contains
-the right name which matches the host name used in the URL and that the
-certificate has been signed by a CA certificate present in the cert store.
-See this online resource for further details:
- https://curl.se/docs/sslcerts.html
-
-For SFTP and SCP, this option makes curl skip the *known_hosts* verification.
-*known_hosts* is a file normally stored in the user's home directory in the
-".ssh" subdirectory, which contains host names and their public keys.
-
-**WARNING**: using this option makes the transfer insecure.
-
-When curl uses secure protocols it trusts responses and allows for example
-HSTS and Alt-Svc information to be stored and used subsequently. Using
---insecure can make curl trust and use such information from malicious
-servers.
diff --git a/third-party/curl/docs/cmdline-opts/insecure.md b/third-party/curl/docs/cmdline-opts/insecure.md
new file mode 100644
index 0000000000..6b7009f251
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/insecure.md
@@ -0,0 +1,41 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: insecure
+Short: k
+Help: Allow insecure server connections
+Protocols: TLS SFTP SCP
+Category: tls sftp scp ssh
+Added: 7.10
+Multi: boolean
+See-also:
+  - proxy-insecure
+  - cacert
+  - capath
+Example:
+  - --insecure $URL
+---
+
+# `--insecure`
+
+By default, every secure connection curl makes is verified to be secure before
+the transfer takes place. This option makes curl skip the verification step
+and proceed without checking.
+
+When this option is not used for protocols using TLS, curl verifies the
+server's TLS certificate before it continues: that the certificate contains
+the right name which matches the hostname used in the URL and that the
+certificate has been signed by a CA certificate present in the cert store. See
+this online resource for further details:
+**https://curl.se/docs/sslcerts.html**
+
+For SFTP and SCP, this option makes curl skip the *known_hosts* verification.
+*known_hosts* is a file normally stored in the user's home directory in the
+".ssh" subdirectory, which contains hostnames and their public keys.
+
+**WARNING**: using this option makes the transfer insecure.
+
+When curl uses secure protocols it trusts responses and allows for example
+HSTS and Alt-Svc information to be stored and used subsequently. Using
+--insecure can make curl trust and use such information from malicious
+servers.
diff --git a/third-party/curl/docs/cmdline-opts/interface.d b/third-party/curl/docs/cmdline-opts/interface.d
deleted file mode 100644
index 026ceaef5a..0000000000
--- a/third-party/curl/docs/cmdline-opts/interface.d
+++ /dev/null
@@ -1,19 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: interface
-Arg: <name>
-Help: Use network INTERFACE (or address)
-See-also: dns-interface
-Category: connection
-Example: --interface eth0 $URL
-Added: 7.3
-Multi: single
----
-Perform an operation using a specified interface. You can enter interface
-name, IP address or host name. An example could look like:
-
- curl --interface eth0:1 https://www.example.com/
-
-On Linux it can be used to specify a **VRF**, but the binary needs to either
-have **CAP_NET_RAW** or to be run as root. More information about Linux
-**VRF**: https://www.kernel.org/doc/Documentation/networking/vrf.txt
diff --git a/third-party/curl/docs/cmdline-opts/interface.md b/third-party/curl/docs/cmdline-opts/interface.md
new file mode 100644
index 0000000000..1609cc35d3
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/interface.md
@@ -0,0 +1,51 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: interface
+Arg: <name>
+Help: Use network interface
+Category: connection
+Added: 7.3
+Multi: single
+See-also:
+  - dns-interface
+Example:
+  - --interface eth0 $URL
+  - --interface "host!10.0.0.1" $URL
+  - --interface "if!enp3s0" $URL
+---
+
+# `--interface`
+
+Perform the operation using a specified interface. You can enter interface
+name, IP address or hostname. If you prefer to be specific, you can use the
+following special syntax:
+
+## `if!<name>`
+
+Interface name. If the provided name does not match an existing interface,
+curl returns with error 45.
+
+## `host!<name>`
+
+IP address or hostname.
+
+## `ifhost!<interface>!<host>`
+
+Interface name and IP address or hostname. This syntax requires libcurl 8.9.0
+or later.
+
+If the provided name does not match an existing interface, curl returns with
+error 45.
+
+##
+
+curl does not support using network interface names for this option on
+Windows.
+
+That name resolve operation if a hostname is provided does **not** use
+DNS-over-HTTPS even if --doh-url is set.
+
+On Linux this option can be used to specify a **VRF** (Virtual Routing and
+Forwarding) device, but the binary then needs to either have the
+**CAP_NET_RAW** capability set or to be run as root.
diff --git a/third-party/curl/docs/cmdline-opts/ip-tos.md b/third-party/curl/docs/cmdline-opts/ip-tos.md
new file mode 100644
index 0000000000..f5ef589e23
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ip-tos.md
@@ -0,0 +1,26 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ip-tos
+Arg: <string>
+Help: Set IP Type of Service or Traffic Class
+Added: 8.9.0
+Category: connection
+Multi: single
+See-also:
+  - tcp-nodelay
+  - vlan-priority
+Example:
+  - --ip-tos CS5 $URL
+---
+
+# `--ip-tos`
+
+Set Type of Service (TOS) for IPv4 or Traffic Class for IPv6.
+
+The values allowed for \<string\> can be a numeric value between 1 and 255
+or one of the following:
+
+CS0, CS1, CS2, CS3, CS4, CS5, CS6, CS7, AF11, AF12, AF13, AF21, AF22, AF23,
+AF31, AF32, AF33, AF41, AF42, AF43, EF, VOICE-ADMIT, ECT1, ECT0, CE, LE,
+LOWCOST, LOWDELAY, THROUGHPUT, RELIABILITY, MINCOST
diff --git a/third-party/curl/docs/cmdline-opts/ipfs-gateway.md b/third-party/curl/docs/cmdline-opts/ipfs-gateway.md
new file mode 100644
index 0000000000..16e197fcfe
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ipfs-gateway.md
@@ -0,0 +1,40 @@
+---
+c: Copyright (C) Mark Gaiser, <markg85@gmail.com>
+SPDX-License-Identifier: curl
+Long: ipfs-gateway
+Arg: <URL>
+Help: Gateway for IPFS
+Protocols: IPFS
+Added: 8.4.0
+Category: curl
+Multi: single
+See-also:
+  - help
+  - manual
+Example:
+  - --ipfs-gateway $URL ipfs://
+---
+
+# `--ipfs-gateway`
+
+Specify which gateway to use for IPFS and IPNS URLs. Not specifying this
+instead makes curl check if the IPFS_GATEWAY environment variable is set, or
+if a `~/.ipfs/gateway` file holding the gateway URL exists.
+
+If you run a local IPFS node, this gateway is by default available under
+`http://localhost:8080`. A full example URL would look like:
+
+    curl --ipfs-gateway http://localhost:8080 \
+       ipfs://bafybeigagd5nmnn2iys2f3
+
+There are many public IPFS gateways. See for example:
+https://ipfs.github.io/public-gateway-checker/
+
+If you opt to go for a remote gateway you need to be aware that you completely
+trust the gateway. This might be fine in local gateways that you host
+yourself. With remote gateways there could potentially be malicious actors
+returning you data that does not match the request you made, inspect or even
+interfere with the request. You may not notice this when using curl. A
+mitigation could be to go for a "trustless" gateway. This means you locally
+verify the data. Consult the docs page on trusted vs trustless:
+https://docs.ipfs.tech/reference/http/gateway/#trusted-vs-trustless
diff --git a/third-party/curl/docs/cmdline-opts/ipv4.d b/third-party/curl/docs/cmdline-opts/ipv4.d
deleted file mode 100644
index 60690bedcf..0000000000
--- a/third-party/curl/docs/cmdline-opts/ipv4.d
+++ /dev/null
@@ -1,17 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Short: 4
-Long: ipv4
-Tags: Versions
-Protocols:
-Added: 7.10.8
-Mutexed: ipv6
-Requires:
-See-also: http1.1 http2
-Help: Resolve names to IPv4 addresses
-Category: connection dns
-Example: --ipv4 $URL
-Multi: mutex
----
-This option tells curl to use IPv4 addresses only when resolving host names,
-and not for example try IPv6.
diff --git a/third-party/curl/docs/cmdline-opts/ipv4.md b/third-party/curl/docs/cmdline-opts/ipv4.md
new file mode 100644
index 0000000000..d7d571d5bd
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ipv4.md
@@ -0,0 +1,24 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Short: 4
+Long: ipv4
+Tags: Versions
+Protocols:
+Added: 7.10.8
+Mutexed: ipv6
+Requires:
+Help: Resolve names to IPv4 addresses
+Category: connection dns
+Multi: mutex
+See-also:
+  - http1.1
+  - http2
+Example:
+  - --ipv4 $URL
+---
+
+# `--ipv4`
+
+Request only IPv4 addresses when resolving hostnames, and not for example any
+IPv6.
diff --git a/third-party/curl/docs/cmdline-opts/ipv6.d b/third-party/curl/docs/cmdline-opts/ipv6.d
deleted file mode 100644
index 24ce201a2e..0000000000
--- a/third-party/curl/docs/cmdline-opts/ipv6.d
+++ /dev/null
@@ -1,17 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Short: 6
-Long: ipv6
-Tags: Versions
-Protocols:
-Added: 7.10.8
-Mutexed: ipv4
-Requires:
-See-also: http1.1 http2
-Help: Resolve names to IPv6 addresses
-Category: connection dns
-Example: --ipv6 $URL
-Multi: mutex
----
-This option tells curl to use IPv6 addresses only when resolving host names,
-and not for example try IPv4.
diff --git a/third-party/curl/docs/cmdline-opts/ipv6.md b/third-party/curl/docs/cmdline-opts/ipv6.md
new file mode 100644
index 0000000000..c2f1398774
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ipv6.md
@@ -0,0 +1,28 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Short: 6
+Long: ipv6
+Tags: Versions
+Protocols:
+Added: 7.10.8
+Mutexed: ipv4
+Requires:
+Help: Resolve names to IPv6 addresses
+Category: connection dns
+Multi: mutex
+See-also:
+  - http1.1
+  - http2
+Example:
+  - --ipv6 $URL
+---
+
+# `--ipv6`
+
+Request only IPv6 addresses when resolving hostnames, and not for example any
+IPv4.
+
+Your resolver may still respond to an IPv6-only resolve request by returning
+IPv6 addresses that contain "mapped" IPv4 addresses for compatibility purposes.
+macOS is known to do this.
diff --git a/third-party/curl/docs/cmdline-opts/json.d b/third-party/curl/docs/cmdline-opts/json.d
deleted file mode 100644
index aa3b49de2f..0000000000
--- a/third-party/curl/docs/cmdline-opts/json.d
+++ /dev/null
@@ -1,35 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: json
-Arg: <data>
-Help: HTTP POST JSON
-Protocols: HTTP
-See-also: data-binary data-raw
-Mutexed: form head upload-file
-Category: http post upload
-Example: --json '{ "drink": "coffe" }' $URL
-Example: --json '{ "drink":' --json ' "coffe" }' $URL
-Example: --json @prepared $URL
-Example: --json @- $URL < json.txt
-Added: 7.82.0
-Multi: append
----
-Sends the specified JSON data in a POST request to the HTTP server. --json
-works as a shortcut for passing on these three options:
-
- --data [arg]
- --header "Content-Type: application/json"
- --header "Accept: application/json"
-
-There is **no verification** that the passed in data is actual JSON or that
-the syntax is correct.
-
-If you start the data with the letter @, the rest should be a file name to
-read the data from, or a single dash (-) if you want curl to read the data
-from stdin. Posting data from a file named 'foobar' would thus be done with
---json @foobar and to instead read the data from stdin, use --json @-.
-
-If this option is used more than once on the same command line, the additional
-data pieces are concatenated to the previous before sending.
-
-The headers this option sets can be overridden with --header as usual.
diff --git a/third-party/curl/docs/cmdline-opts/json.md b/third-party/curl/docs/cmdline-opts/json.md
new file mode 100644
index 0000000000..3f1a9a1b74
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/json.md
@@ -0,0 +1,42 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: json
+Arg: <data>
+Help: HTTP POST JSON
+Protocols: HTTP
+Mutexed: form head upload-file
+Category: http post upload
+Added: 7.82.0
+Multi: append
+See-also:
+  - data-binary
+  - data-raw
+Example:
+  - --json '{ "drink": "coffee" }' $URL
+  - --json '{ "drink":' --json ' "coffee" }' $URL
+  - --json @prepared $URL
+  - --json @- $URL < json.txt
+---
+
+# `--json`
+
+Send the specified JSON data in a POST request to the HTTP server. --json
+works as a shortcut for passing on these three options:
+
+    --data-binary [arg]
+    --header "Content-Type: application/json"
+    --header "Accept: application/json"
+
+There is **no verification** that the passed in data is actual JSON or that
+the syntax is correct.
+
+If you start the data with the letter @, the rest should be a filename to read
+the data from, or a single dash (-) if you want curl to read the data from
+stdin. Posting data from a file named 'foobar' would thus be done with --json
+@foobar and to instead read the data from stdin, use --json @-.
+
+If this option is used more than once on the same command line, the additional
+data pieces are concatenated to the previous before sending.
+
+The headers this option sets can be overridden with --header as usual.
diff --git a/third-party/curl/docs/cmdline-opts/junk-session-cookies.d b/third-party/curl/docs/cmdline-opts/junk-session-cookies.d
deleted file mode 100644
index daea7840ad..0000000000
--- a/third-party/curl/docs/cmdline-opts/junk-session-cookies.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: junk-session-cookies
-Short: j
-Help: Ignore session cookies read from file
-Protocols: HTTP
-See-also: cookie cookie-jar
-Category: http
-Example: --junk-session-cookies -b cookies.txt $URL
-Added: 7.9.7
-Multi: boolean
----
-When curl is told to read cookies from a given file, this option makes it
-discard all "session cookies". This has the same effect as if a new session is
-started. Typical browsers discard session cookies when they are closed down.
diff --git a/third-party/curl/docs/cmdline-opts/junk-session-cookies.md b/third-party/curl/docs/cmdline-opts/junk-session-cookies.md
new file mode 100644
index 0000000000..668dfce2d6
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/junk-session-cookies.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: junk-session-cookies
+Short: j
+Help: Ignore session cookies read from file
+Protocols: HTTP
+Category: http
+Added: 7.9.7
+Multi: boolean
+See-also:
+  - cookie
+  - cookie-jar
+Example:
+  - --junk-session-cookies -b cookies.txt $URL
+---
+
+# `--junk-session-cookies`
+
+When curl is told to read cookies from a given file, this option makes it
+discard all session cookies. This has the same effect as if a new session is
+started. Typical browsers discard session cookies when they are closed down.
+
+Session cookies are cookies without a set expiry time. They are meant to only
+last for "a session".
diff --git a/third-party/curl/docs/cmdline-opts/keepalive-cnt.md b/third-party/curl/docs/cmdline-opts/keepalive-cnt.md
new file mode 100644
index 0000000000..e56c976eca
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/keepalive-cnt.md
@@ -0,0 +1,27 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: keepalive-cnt
+Arg: <integer>
+Help: Maximum number of keepalive probes
+Added: 8.9.0
+Category: connection
+Multi: single
+See-also:
+  - keepalive-time
+  - no-keepalive
+Example:
+  - --keepalive-cnt 3 $URL
+---
+
+# `--keepalive-cnt`
+
+Set the maximum number of keepalive probes TCP should send but get no response
+before dropping the connection. This option is usually used in conjunction
+with --keepalive-time.
+
+This option is supported on Linux, *BSD/macOS, Windows \>=10.0.16299, Solaris
+11.4, and recent AIX, HP-UX and more. This option has no effect if
+--no-keepalive is used.
+
+If unspecified, the option defaults to 9.
diff --git a/third-party/curl/docs/cmdline-opts/keepalive-time.d b/third-party/curl/docs/cmdline-opts/keepalive-time.d
deleted file mode 100644
index 5e284774df..0000000000
--- a/third-party/curl/docs/cmdline-opts/keepalive-time.d
+++ /dev/null
@@ -1,21 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: keepalive-time
-Arg: <seconds>
-Help: Interval time for keepalive probes
-Added: 7.18.0
-Category: connection
-Example: --keepalive-time 20 $URL
-See-also: no-keepalive max-time
-Multi: single
----
-This option sets the time a connection needs to remain idle before sending
-keepalive probes and the time between individual keepalive probes. It is
-currently effective on operating systems offering the TCP_KEEPIDLE and
-TCP_KEEPINTVL socket options (meaning Linux, recent AIX, HP-UX and more).
-Keepalives are used by the TCP stack to detect broken networks on idle
-connections. The number of missed keepalive probes before declaring the
-connection down is OS dependent and is commonly 9 or 10. This option has no
-effect if --no-keepalive is used.
-
-If unspecified, the option defaults to 60 seconds.
diff --git a/third-party/curl/docs/cmdline-opts/keepalive-time.md b/third-party/curl/docs/cmdline-opts/keepalive-time.md
new file mode 100644
index 0000000000..4b10ff6f45
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/keepalive-time.md
@@ -0,0 +1,30 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: keepalive-time
+Arg: <seconds>
+Help: Interval time for keepalive probes
+Added: 7.18.0
+Category: connection timeout
+Multi: single
+See-also:
+  - no-keepalive
+  - keepalive-cnt
+  - max-time
+Example:
+  - --keepalive-time 20 $URL
+---
+
+# `--keepalive-time`
+
+Set the time a connection needs to remain idle before sending keepalive probes
+and the time between individual keepalive probes. It is currently effective on
+operating systems offering the `TCP_KEEPIDLE` and `TCP_KEEPINTVL` socket
+options (meaning Linux, *BSD/macOS, Windows, Solaris, and recent AIX, HP-UX and more).
+Keepalive is used by the TCP stack to detect broken networks on idle connections.
+The number of missed keepalive probes before declaring the connection down is OS
+dependent and is commonly 8 (*BSD/macOS/AIX), 9 (Linux/AIX) or 5/10 (Windows), and
+this number can be changed by specifying the curl option `keepalive-cnt`.
+Note that this option has no effect if --no-keepalive is used.
+
+If unspecified, the option defaults to 60 seconds.
diff --git a/third-party/curl/docs/cmdline-opts/key-type.d b/third-party/curl/docs/cmdline-opts/key-type.d
deleted file mode 100644
index 22339b4c90..0000000000
--- a/third-party/curl/docs/cmdline-opts/key-type.d
+++ /dev/null
@@ -1,14 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: key-type
-Arg: <type>
-Help: Private key file type (DER/PEM/ENG)
-Protocols: TLS
-Category: tls
-Example: --key-type DER --key here $URL
-Added: 7.9.3
-See-also: key
-Multi: single
----
-Private key file type. Specify which type your --key provided private key
-is. DER, PEM, and ENG are supported. If not specified, PEM is assumed.
diff --git a/third-party/curl/docs/cmdline-opts/key-type.md b/third-party/curl/docs/cmdline-opts/key-type.md
new file mode 100644
index 0000000000..4128bfeafc
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/key-type.md
@@ -0,0 +1,20 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: key-type
+Arg: <type>
+Help: Private key file type (DER/PEM/ENG)
+Protocols: TLS
+Category: tls
+Added: 7.9.3
+Multi: single
+See-also:
+  - key
+Example:
+  - --key-type DER --key here $URL
+---
+
+# `--key-type`
+
+Private key file type. Specify which type your --key provided private key
+is. DER, PEM, and ENG are supported. If not specified, PEM is assumed.
diff --git a/third-party/curl/docs/cmdline-opts/key.d b/third-party/curl/docs/cmdline-opts/key.d
deleted file mode 100644
index 4236218c9d..0000000000
--- a/third-party/curl/docs/cmdline-opts/key.d
+++ /dev/null
@@ -1,27 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: key
-Arg: <key>
-Protocols: TLS SSH
-Help: Private key file name
-Category: tls ssh
-Example: --cert certificate --key here $URL
-Added: 7.9.3
-See-also: key-type cert
-Multi: single
----
-Private key file name. Allows you to provide your private key in this separate
-file. For SSH, if not specified, curl tries the following candidates in order:
-'~/.ssh/id_rsa', '~/.ssh/id_dsa', './id_rsa', './id_dsa'.
-
-If curl is built against OpenSSL library, and the engine pkcs11 is available,
-then a PKCS#11 URI (RFC 7512) can be used to specify a private key located in
-a PKCS#11 device. A string beginning with "pkcs11:" is interpreted as a
-PKCS#11 URI. If a PKCS#11 URI is provided, then the --engine option is set as
-"pkcs11" if none was provided and the --key-type option is set as "ENG" if
-none was provided.
-
-If curl is built against Secure Transport or Schannel then this option is
-ignored for TLS protocols (HTTPS, etc). Those backends expect the private key
-to be already present in the keychain or PKCS#12 file containing the
-certificate.
diff --git a/third-party/curl/docs/cmdline-opts/key.md b/third-party/curl/docs/cmdline-opts/key.md
new file mode 100644
index 0000000000..cc4bc73fa5
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/key.md
@@ -0,0 +1,33 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: key
+Arg: <key>
+Protocols: TLS SCP SFTP
+Help: Private key filename
+Category: tls ssh
+Added: 7.9.3
+Multi: single
+See-also:
+  - key-type
+  - cert
+Example:
+  - --cert certificate --key here $URL
+---
+
+# `--key`
+
+Private key filename. Allows you to provide your private key in this separate
+file. For SSH, if not specified, curl tries the following candidates in order:
+`~/.ssh/id_rsa`, `~/.ssh/id_dsa`, `./id_rsa`, `./id_dsa`.
+
+If curl is built against OpenSSL library, and the engine pkcs11 or pkcs11
+provider is available, then a PKCS#11 URI (RFC 7512) can be used to specify a
+private key located in a PKCS#11 device. A string beginning with `pkcs11:` is
+interpreted as a PKCS#11 URI. If a PKCS#11 URI is provided, then the --engine
+option is set as `pkcs11` if none was provided and the --key-type option is
+set as `ENG` or `PROV` if none was provided (depending on OpenSSL version).
+
+If curl is built against Schannel then this option is ignored for TLS
+protocols (HTTPS, etc). That backend expects the private key to be already
+present in the keychain or PKCS#12 file containing the certificate.
diff --git a/third-party/curl/docs/cmdline-opts/knownhosts.md b/third-party/curl/docs/cmdline-opts/knownhosts.md
new file mode 100644
index 0000000000..4b6386dd24
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/knownhosts.md
@@ -0,0 +1,31 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: knownhosts
+Arg: <file>
+Protocols: SCP SFTP
+Help: Specify knownhosts path
+Category: ssh
+Added: 8.17.0
+Multi: single
+See-also:
+  - hostpubsha256
+  - hostpubmd5
+  - insecure
+  - key
+Example:
+  - --knownhosts filename --key here $URL
+---
+
+# `--knownhosts`
+
+When doing SCP and SFTP transfers, curl automatically checks a database
+containing identification for all hosts it has ever been used with to verify
+that the host it connects to is the same as previously. Host keys are stored
+in such a known hosts file. curl uses the ~/.ssh/known_hosts in the user's
+home directory by default.
+
+This option lets a user specify a specific file to check the host against.
+
+The known hosts check can be disabled with --insecure, but that makes the
+transfer insecure and is strongly discouraged.
diff --git a/third-party/curl/docs/cmdline-opts/krb.d b/third-party/curl/docs/cmdline-opts/krb.d
deleted file mode 100644
index 42aa67ada4..0000000000
--- a/third-party/curl/docs/cmdline-opts/krb.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: krb
-Arg: <level>
-Help: Enable Kerberos with security <level>
-Protocols: FTP
-Requires: Kerberos
-Category: ftp
-Example: --krb clear ftp://example.com/
-Added: 7.3
-See-also: delegation ssl
-Multi: single
----
-Enable Kerberos authentication and use. The level must be entered and should
-be one of 'clear', 'safe', 'confidential', or 'private'. Should you use a
-level that is not one of these, 'private' is used.
diff --git a/third-party/curl/docs/cmdline-opts/krb.md b/third-party/curl/docs/cmdline-opts/krb.md
new file mode 100644
index 0000000000..6d47a76d6e
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/krb.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: krb
+Arg: <level>
+Help: Enable Kerberos with security <level>
+Protocols: FTP
+Requires: Kerberos
+Category: deprecated
+Added: 7.3
+Multi: single
+See-also:
+  - delegation
+  - ssl
+Example:
+  - --krb clear ftp://example.com/
+---
+
+# `--krb`
+
+Deprecated option (added in 8.17.0). It has no function anymore.
+
+Enable Kerberos authentication and use. The level must be entered and should
+be one of `clear`, `safe`, `confidential`, or `private`. Should you use a
+level that is not one of these, `private` is used.
diff --git a/third-party/curl/docs/cmdline-opts/libcurl.d b/third-party/curl/docs/cmdline-opts/libcurl.d
deleted file mode 100644
index 52e252f3b9..0000000000
--- a/third-party/curl/docs/cmdline-opts/libcurl.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: libcurl
-Arg: <file>
-Help: Dump libcurl equivalent code of this command line
-Added: 7.16.1
-Category: curl
-Example: --libcurl client.c $URL
-See-also: verbose
-Multi: single
-Scope: global
----
-Append this option to any ordinary curl command line, and you get
-libcurl-using C source code written to the file that does the equivalent of
-what your command-line operation does!
diff --git a/third-party/curl/docs/cmdline-opts/libcurl.md b/third-party/curl/docs/cmdline-opts/libcurl.md
new file mode 100644
index 0000000000..e37e5aa0fa
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/libcurl.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: libcurl
+Arg: <file>
+Help: Generate libcurl code for this command line
+Added: 7.16.1
+Category: curl global
+Multi: single
+Scope: global
+See-also:
+  - verbose
+Example:
+  - --libcurl client.c $URL
+---
+
+# `--libcurl`
+
+Append this option to any ordinary curl command line, and you get
+libcurl-using C source code written to the file that does the equivalent of
+what your command-line operation does.
diff --git a/third-party/curl/docs/cmdline-opts/limit-rate.d b/third-party/curl/docs/cmdline-opts/limit-rate.d
deleted file mode 100644
index 43ebf2c233..0000000000
--- a/third-party/curl/docs/cmdline-opts/limit-rate.d
+++ /dev/null
@@ -1,29 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: limit-rate
-Arg: <speed>
-Help: Limit transfer speed to RATE
-Category: connection
-Example: --limit-rate 100K $URL
-Example: --limit-rate 1000 $URL
-Example: --limit-rate 10M $URL
-Added: 7.10
-See-also: rate speed-limit speed-time
-Multi: single
----
-Specify the maximum transfer rate you want curl to use - for both downloads
-and uploads. This feature is useful if you have a limited pipe and you would like
-your transfer not to use your entire bandwidth. To make it slower than it
-otherwise would be.
-
-The given speed is measured in bytes/second, unless a suffix is appended.
-Appending 'k' or 'K' counts the number as kilobytes, 'm' or 'M' makes it
-megabytes, while 'g' or 'G' makes it gigabytes. The suffixes (k, M, G, T, P)
-are 1024 based. For example 1k is 1024. Examples: 200K, 3m and 1G.
-
-The rate limiting logic works on averaging the transfer speed to no more than
-the set threshold over a period of multiple seconds.
-
-If you also use the --speed-limit option, that option takes precedence and
-might cripple the rate-limiting slightly, to help keeping the speed-limit
-logic working.
diff --git a/third-party/curl/docs/cmdline-opts/limit-rate.md b/third-party/curl/docs/cmdline-opts/limit-rate.md
new file mode 100644
index 0000000000..88f62709b0
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/limit-rate.md
@@ -0,0 +1,42 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: limit-rate
+Arg: <speed>
+Help: Limit transfer speed to RATE
+Category: connection
+Added: 7.10
+Multi: single
+See-also:
+  - rate
+  - speed-limit
+  - speed-time
+Example:
+  - --limit-rate 123.45K $URL
+  - --limit-rate 1000 $URL
+  - --limit-rate 10M $URL
+  - --limit-rate 200K --max-time 60 $URL
+---
+
+# `--limit-rate`
+
+Specify the maximum transfer rate you want curl to use - for both downloads
+and uploads. This feature is useful if you have a limited pipe and you would
+like your transfer not to use your entire bandwidth. To make it slower than it
+otherwise would be.
+
+The given speed is measured in bytes/second, unless a suffix is appended.
+Appending 'k' or 'K' counts the number as kilobytes, 'm' or 'M' makes it
+megabytes etc. The supported suffixes (k, M, G, T, P) are 1024-based. For
+example 1k is 1024. Examples: 200K, 3m and 1G.
+
+The rate limiting logic works on averaging the transfer speed to no more than
+the set threshold over a period of multiple seconds.
+
+If you also use the --speed-limit option, that option takes precedence and
+might cripple the rate-limiting slightly, to help keep the speed-limit
+logic working.
+
+Starting in curl 8.19.0, the rate can be specified using a fraction as in
+`2.5M` for two and a half megabytes per second. It only works with a period
+(`.`) delimiter, independent of what your locale might prefer.
diff --git a/third-party/curl/docs/cmdline-opts/list-only.d b/third-party/curl/docs/cmdline-opts/list-only.d
deleted file mode 100644
index dcfbf2ccc9..0000000000
--- a/third-party/curl/docs/cmdline-opts/list-only.d
+++ /dev/null
@@ -1,36 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: list-only
-Short: l
-Protocols: FTP POP3 SFTP
-Help: List only mode
-Added: 4.0
-Category: ftp pop3 sftp
-Example: --list-only ftp://example.com/dir/
-See-also: quote request
-Multi: boolean
----
-(FTP)
-When listing an FTP directory, this switch forces a name-only view. This is
-especially useful if the user wants to machine-parse the contents of an FTP
-directory since the normal directory view does not use a standard look or
-format. When used like this, the option causes an NLST command to be sent to
-the server instead of LIST.
-
-Note: Some FTP servers list only files in their response to NLST; they do not
-include sub-directories and symbolic links.
-
-(SFTP)
-When listing an SFTP directory, this switch forces a name-only view, one per line.
-This is especially useful if the user wants to machine-parse the contents of an
-SFTP directory since the normal directory view provides more information than just
-file names.
-
-(POP3)
-When retrieving a specific email from POP3, this switch forces a LIST command
-to be performed instead of RETR. This is particularly useful if the user wants
-to see if a specific message-id exists on the server and what size it is.
-
-Note: When combined with --request, this option can be used to send a UIDL
-command instead, so the user may use the email's unique identifier rather than
-its message-id to make the request.
diff --git a/third-party/curl/docs/cmdline-opts/list-only.md b/third-party/curl/docs/cmdline-opts/list-only.md
new file mode 100644
index 0000000000..36d6321039
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/list-only.md
@@ -0,0 +1,43 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: list-only
+Short: l
+Protocols: FTP POP3 SFTP FILE
+Help: List only mode
+Added: 4.0
+Category: ftp pop3 sftp file
+Multi: boolean
+See-also:
+  - quote
+  - request
+Example:
+  - --list-only ftp://example.com/dir/
+---
+
+# `--list-only`
+
+When listing an FTP directory, force a name-only view. Maybe particularly
+useful if the user wants to machine-parse the contents of an FTP directory
+since the normal directory view does not use a standard look or format. When
+used like this, the option causes an NLST command to be sent to the server
+instead of LIST.
+
+Note: Some FTP servers list only files in their response to NLST; they do not
+include subdirectories and symbolic links.
+
+When listing an SFTP directory, this switch forces a name-only view, one per
+line. This is especially useful if the user wants to machine-parse the
+contents of an SFTP directory since the normal directory view provides more
+information than filenames.
+
+When retrieving a specific email from POP3, this switch forces a LIST command
+to be performed instead of RETR. This is particularly useful if the user wants
+to see if a specific message-id exists on the server and what size it is.
+
+For FILE, this option has no effect yet as directories are always listed in
+this mode.
+
+Note: When combined with --request, this option can be used to send a UIDL
+command instead, so the user may use the email's unique identifier rather than
+its message-id to make the request.
diff --git a/third-party/curl/docs/cmdline-opts/local-port.d b/third-party/curl/docs/cmdline-opts/local-port.d
deleted file mode 100644
index d6949b7ee3..0000000000
--- a/third-party/curl/docs/cmdline-opts/local-port.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: local-port
-Arg: <num/range>
-Help: Force use of RANGE for local port numbers
-Added: 7.15.2
-Category: connection
-Example: --local-port 1000-3000 $URL
-See-also: globoff
-Multi: single
----
-Set a preferred single number or range (FROM-TO) of local port numbers to use
-for the connection(s).  Note that port numbers by nature are a scarce resource
-so setting this range to something too narrow might cause unnecessary
-connection setup failures.
diff --git a/third-party/curl/docs/cmdline-opts/local-port.md b/third-party/curl/docs/cmdline-opts/local-port.md
new file mode 100644
index 0000000000..b8c0d3fda1
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/local-port.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: local-port
+Arg: <range>
+Help: Use a local port number within RANGE
+Added: 7.15.2
+Category: connection
+Multi: single
+See-also:
+  - globoff
+Example:
+  - --local-port 1000-3000 $URL
+---
+
+# `--local-port`
+
+Set a preferred single number or range (FROM-TO) of local port numbers to use
+for the connection(s). Note that port numbers by nature are a scarce resource
+so setting this range to something too narrow might cause unnecessary
+connection setup failures.
diff --git a/third-party/curl/docs/cmdline-opts/location-trusted.d b/third-party/curl/docs/cmdline-opts/location-trusted.d
deleted file mode 100644
index 9f83d0ef0e..0000000000
--- a/third-party/curl/docs/cmdline-opts/location-trusted.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: location-trusted
-Help: Like --location, and send auth to other hosts
-Protocols: HTTP
-See-also: user
-Category: http auth
-Example: --location-trusted -u user:password $URL
-Added: 7.10.4
-Multi: boolean
----
-Like --location, but allows sending the name + password to all hosts that the
-site may redirect to. This may or may not introduce a security breach if the
-site redirects you to a site to which you send your authentication info
-(which is plaintext in the case of HTTP Basic authentication).
diff --git a/third-party/curl/docs/cmdline-opts/location-trusted.md b/third-party/curl/docs/cmdline-opts/location-trusted.md
new file mode 100644
index 0000000000..7d9810802c
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/location-trusted.md
@@ -0,0 +1,27 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: location-trusted
+Help: As --location, but send secrets to other hosts
+Protocols: HTTP
+Category: http auth
+Added: 7.10.4
+Multi: boolean
+See-also:
+  - user
+  - follow
+Example:
+  - --location-trusted -u user:password $URL
+  - --location-trusted -H "Cookie: session=abc" $URL
+---
+
+# `--location-trusted`
+
+Instruct curl to follow HTTP redirects like --location, but permit curl to
+send credentials and other secrets along to other hosts than the initial one.
+
+This may or may not introduce a security breach if the site redirects you to a
+site to which you send this sensitive data to. Another host means that one or
+more of hostname, protocol scheme or port number changed.
+
+This option also allows curl to pass long cookies set explicitly with --header.
diff --git a/third-party/curl/docs/cmdline-opts/location.d b/third-party/curl/docs/cmdline-opts/location.d
deleted file mode 100644
index 9a99a05133..0000000000
--- a/third-party/curl/docs/cmdline-opts/location.d
+++ /dev/null
@@ -1,33 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: location
-Short: L
-Help: Follow redirects
-Protocols: HTTP
-Category: http
-Example: -L $URL
-Added: 4.9
-See-also: resolve alt-svc
-Multi: boolean
----
-If the server reports that the requested page has moved to a different
-location (indicated with a Location: header and a 3XX response code), this
-option makes curl redo the request on the new place. If used together with
---include or --head, headers from all requested pages are shown.
-
-When authentication is used, curl only sends its credentials to the initial
-host. If a redirect takes curl to a different host, it does not get the
-user+password pass on. See also --location-trusted on how to change this.
-
-Limit the amount of redirects to follow by using the --max-redirs option.
-
-When curl follows a redirect and if the request is a POST, it sends the
-following request with a GET if the HTTP response was 301, 302, or 303. If the
-response code was any other 3xx code, curl resends the following request using
-the same unmodified method.
-
-You can tell curl to not change POST requests to GET after a 30x response by
-using the dedicated options for that: --post301, --post302 and --post303.
-
-The method set with --request overrides the method curl would otherwise select
-to use.
diff --git a/third-party/curl/docs/cmdline-opts/location.md b/third-party/curl/docs/cmdline-opts/location.md
new file mode 100644
index 0000000000..4ea115a634
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/location.md
@@ -0,0 +1,48 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: location
+Short: L
+Help: Follow redirects
+Protocols: HTTP
+Category: http
+Added: 4.9
+Multi: boolean
+See-also:
+  - resolve
+  - alt-svc
+  - follow
+  - proto-redir
+  - max-redirs
+Example:
+  - -L $URL
+---
+
+# `--location`
+
+If the server reports that the requested page has moved to a different
+location (indicated with a Location: header and a 3XX response code), this
+option makes curl redo the request to the new place. If used together with
+--show-headers or --head, headers from all requested pages are shown.
+
+When authentication is provided on the command line (for example --user or
+--oauth2-bearer), or when sending a cookie with `-H Cookie:`, curl only sends
+its credentials to the initial host. If a redirect takes curl to a different
+host, it does not get the credentials passed on. See --location-trusted on how
+to change this. When --netrc is used in combination with this option,
+credentials for the followed-to hosts may also be selected from that file.
+
+Limit the amount of redirects to follow by using the --max-redirs option.
+
+When curl follows a redirect and if the request is a POST, it sends the
+following request with a GET if the HTTP response was 301, 302, or 303. If the
+response code was any other 3xx code, curl resends the following request using
+the same unmodified method.
+
+You can tell curl to not change POST requests to GET after a 30x response by
+using the dedicated options for that: --post301, --post302 and --post303.
+
+The method set with --request overrides the method curl would otherwise select
+to use.
+
+Restrict which protocols a redirect is accepted to follow with --proto-redir.
diff --git a/third-party/curl/docs/cmdline-opts/login-options.d b/third-party/curl/docs/cmdline-opts/login-options.d
deleted file mode 100644
index c67be90f87..0000000000
--- a/third-party/curl/docs/cmdline-opts/login-options.d
+++ /dev/null
@@ -1,25 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: login-options
-Arg: <options>
-Protocols: IMAP LDAP POP3 SMTP
-Help: Server login options
-Added: 7.34.0
-Category: imap pop3 smtp auth
-Example: --login-options 'AUTH=*' imap://example.com
-See-also: user
-Multi: single
----
-Specify the login options to use during server authentication.
-
-You can use login options to specify protocol specific options that may be
-used during authentication. At present only IMAP, POP3 and SMTP support login
-options. For more information about login options please see RFC 2384,
-RFC 5092 and the IETF draft
-https://datatracker.ietf.org/doc/html/draft-earhart-url-smtp-00.
-
-Since 8.2.0, IMAP supports the login option "AUTH=+LOGIN". With this option,
-curl uses the plain (not SASL) LOGIN IMAP command even if the server
-advertises SASL authentication. Care should be taken in using this option, as
-it sends your password over the network in plain text. This does not work if
-the IMAP server disables the plain LOGIN (e.g. to prevent password snooping).
diff --git a/third-party/curl/docs/cmdline-opts/login-options.md b/third-party/curl/docs/cmdline-opts/login-options.md
new file mode 100644
index 0000000000..fc8292a2b9
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/login-options.md
@@ -0,0 +1,32 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: login-options
+Arg: <options>
+Protocols: IMAP LDAP POP3 SMTP
+Help: Server login options
+Added: 7.34.0
+Category: imap pop3 smtp auth ldap
+Multi: single
+See-also:
+  - user
+Example:
+  - --login-options 'AUTH=*' imap://example.com
+---
+
+# `--login-options`
+
+Specify the login options to use during server authentication.
+
+You can use login options to specify protocol specific options that may be
+used during authentication. At present only IMAP, POP3 and SMTP support login
+options. For more information about login options please see RFC 2384,
+RFC 5092 and the IETF draft
+https://datatracker.ietf.org/doc/html/draft-earhart-url-smtp-00
+
+Since 8.2.0, IMAP supports the login option `AUTH=+LOGIN`. With this option,
+curl uses the plain (not SASL) `LOGIN IMAP` command even if the server
+advertises SASL authentication. Care should be taken in using this option, as
+it sends your password over the network in plain text. This does not work if
+the IMAP server disables the plain `LOGIN` (e.g. to prevent password
+snooping).
diff --git a/third-party/curl/docs/cmdline-opts/mail-auth.d b/third-party/curl/docs/cmdline-opts/mail-auth.d
deleted file mode 100644
index 45ceebd99f..0000000000
--- a/third-party/curl/docs/cmdline-opts/mail-auth.d
+++ /dev/null
@@ -1,14 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: mail-auth
-Arg: <address>
-Protocols: SMTP
-Help: Originator address of the original email
-Added: 7.25.0
-See-also: mail-rcpt mail-from
-Category: smtp
-Example: --mail-auth user@example.come -T mail smtp://example.com/
-Multi: single
----
-Specify a single address. This is used to specify the authentication address
-(identity) of a submitted message that is being relayed to another server.
diff --git a/third-party/curl/docs/cmdline-opts/mail-auth.md b/third-party/curl/docs/cmdline-opts/mail-auth.md
new file mode 100644
index 0000000000..deabb38b97
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/mail-auth.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: mail-auth
+Arg: <address>
+Protocols: SMTP
+Help: Originator address of the original email
+Added: 7.25.0
+Category: smtp
+Multi: single
+See-also:
+  - mail-rcpt
+  - mail-from
+Example:
+  - --mail-auth user@example.com -T mail smtp://example.com/
+---
+
+# `--mail-auth`
+
+Specify a single address. This is used to specify the authentication address
+(identity) of a submitted message that is being relayed to another server.
diff --git a/third-party/curl/docs/cmdline-opts/mail-from.d b/third-party/curl/docs/cmdline-opts/mail-from.d
deleted file mode 100644
index 0729e841a9..0000000000
--- a/third-party/curl/docs/cmdline-opts/mail-from.d
+++ /dev/null
@@ -1,13 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: mail-from
-Arg: <address>
-Help: Mail from this address
-Protocols: SMTP
-Added: 7.20.0
-See-also: mail-rcpt mail-auth
-Category: smtp
-Example: --mail-from user@example.com -T mail smtp://example.com/
-Multi: single
----
-Specify a single address that the given mail should get sent from.
diff --git a/third-party/curl/docs/cmdline-opts/mail-from.md b/third-party/curl/docs/cmdline-opts/mail-from.md
new file mode 100644
index 0000000000..96b062501b
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/mail-from.md
@@ -0,0 +1,20 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: mail-from
+Arg: <address>
+Help: Mail from this address
+Protocols: SMTP
+Added: 7.20.0
+Category: smtp
+Multi: single
+See-also:
+  - mail-rcpt
+  - mail-auth
+Example:
+  - --mail-from user@example.com -T mail smtp://example.com/
+---
+
+# `--mail-from`
+
+Specify a single address that the given mail should get sent from.
diff --git a/third-party/curl/docs/cmdline-opts/mail-rcpt-allowfails.d b/third-party/curl/docs/cmdline-opts/mail-rcpt-allowfails.d
deleted file mode 100644
index d2a5f39d3b..0000000000
--- a/third-party/curl/docs/cmdline-opts/mail-rcpt-allowfails.d
+++ /dev/null
@@ -1,22 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: mail-rcpt-allowfails
-Help: Allow RCPT TO command to fail for some recipients
-Protocols: SMTP
-Added: 7.69.0
-Category: smtp
-Example: --mail-rcpt-allowfails --mail-rcpt dest@example.com smtp://example.com
-See-also: mail-rcpt
-Multi: boolean
----
-When sending data to multiple recipients, by default curl aborts SMTP
-conversation if at least one of the recipients causes RCPT TO command to
-return an error.
-
-The default behavior can be changed by passing --mail-rcpt-allowfails
-command-line option which makes curl ignore errors and proceed with the
-remaining valid recipients.
-
-If all recipients trigger RCPT TO failures and this flag is specified, curl
-still aborts the SMTP conversation and returns the error received from to the
-last RCPT TO command.
diff --git a/third-party/curl/docs/cmdline-opts/mail-rcpt-allowfails.md b/third-party/curl/docs/cmdline-opts/mail-rcpt-allowfails.md
new file mode 100644
index 0000000000..a82948bbc4
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/mail-rcpt-allowfails.md
@@ -0,0 +1,28 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: mail-rcpt-allowfails
+Help: Allow RCPT TO command to fail
+Protocols: SMTP
+Added: 7.69.0
+Category: smtp
+Multi: boolean
+See-also:
+  - mail-rcpt
+Example:
+  - --mail-rcpt-allowfails --mail-rcpt dest@example.com smtp://example.com
+---
+
+# `--mail-rcpt-allowfails`
+
+When sending data to multiple recipients, by default curl aborts SMTP
+conversation if at least one of the recipients causes RCPT TO command to
+return an error.
+
+The default behavior can be changed by passing --mail-rcpt-allowfails
+command-line option which makes curl ignore errors and proceed with the
+remaining valid recipients.
+
+If all recipients trigger RCPT TO failures and this flag is specified, curl
+still aborts the SMTP conversation and returns the error received from to the
+last RCPT TO command.
diff --git a/third-party/curl/docs/cmdline-opts/mail-rcpt.d b/third-party/curl/docs/cmdline-opts/mail-rcpt.d
deleted file mode 100644
index a4b16c4f7b..0000000000
--- a/third-party/curl/docs/cmdline-opts/mail-rcpt.d
+++ /dev/null
@@ -1,22 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: mail-rcpt
-Arg: <address>
-Help: Mail to this address
-Protocols: SMTP
-Added: 7.20.0
-Category: smtp
-Example: --mail-rcpt user@example.net smtp://example.com
-See-also: mail-rcpt-allowfails
-Multi: append
----
-Specify a single email address, user name or mailing list name. Repeat this
-option several times to send to multiple recipients.
-
-When performing an address verification (**VRFY** command), the recipient should be
-specified as the user name or user name and domain (as per Section 3.5 of
-RFC 5321). (Added in 7.34.0)
-
-When performing a mailing list expand (EXPN command), the recipient should be
-specified using the mailing list name, such as "Friends" or "London-Office".
-(Added in 7.34.0)
diff --git a/third-party/curl/docs/cmdline-opts/mail-rcpt.md b/third-party/curl/docs/cmdline-opts/mail-rcpt.md
new file mode 100644
index 0000000000..bd787c2fa0
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/mail-rcpt.md
@@ -0,0 +1,28 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: mail-rcpt
+Arg: <address>
+Help: Mail to this address
+Protocols: SMTP
+Added: 7.20.0
+Category: smtp
+Multi: append
+See-also:
+  - mail-rcpt-allowfails
+Example:
+  - --mail-rcpt user@example.net smtp://example.com
+---
+
+# `--mail-rcpt`
+
+Specify a single email address, username or mailing list name. Repeat this
+option several times to send to multiple recipients.
+
+When performing an address verification (**VRFY** command), the recipient
+should be specified as the username or username and domain (as per Section 3.5
+of RFC 5321). (Added in 7.34.0)
+
+When performing a mailing list expand (EXPN command), the recipient should be
+specified using the mailing list name, such as "Friends" or "London-Office".
+(Added in 7.34.0)
diff --git a/third-party/curl/docs/cmdline-opts/mainpage.idx b/third-party/curl/docs/cmdline-opts/mainpage.idx
new file mode 100644
index 0000000000..8496ee46dc
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/mainpage.idx
@@ -0,0 +1,43 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+_NAME.md
+_SYNOPSIS.md
+_DESCRIPTION.md
+_URL.md
+_GLOBBING.md
+_VARIABLES.md
+_OUTPUT.md
+_PROTOCOLS.md
+_PROGRESS.md
+_VERSION.md
+_OPTIONS.md
+%options
+_FILES.md
+_ENVIRONMENT.md
+_PROXYPREFIX.md
+_EXITCODES.md
+_BUGS.md
+_AUTHORS.md
+_WWW.md
+_SEEALSO.md
diff --git a/third-party/curl/docs/cmdline-opts/manual.d b/third-party/curl/docs/cmdline-opts/manual.d
deleted file mode 100644
index 9ee4d075ad..0000000000
--- a/third-party/curl/docs/cmdline-opts/manual.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: manual
-Short: M
-Help: Display the full manual
-Category: curl
-Example: --manual
-Added: 5.2
-See-also: verbose libcurl trace
-Multi: custom
----
-Manual. Display the huge help text.
diff --git a/third-party/curl/docs/cmdline-opts/manual.md b/third-party/curl/docs/cmdline-opts/manual.md
new file mode 100644
index 0000000000..bf44f3b8ad
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/manual.md
@@ -0,0 +1,20 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: manual
+Short: M
+Help: Display the full manual
+Category: curl
+Added: 5.2
+Multi: custom
+See-also:
+  - verbose
+  - libcurl
+  - trace
+Example:
+  - --manual
+---
+
+# `--manual`
+
+Manual. Display the huge help text.
diff --git a/third-party/curl/docs/cmdline-opts/max-filesize.d b/third-party/curl/docs/cmdline-opts/max-filesize.d
deleted file mode 100644
index ada730d926..0000000000
--- a/third-party/curl/docs/cmdline-opts/max-filesize.d
+++ /dev/null
@@ -1,23 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: max-filesize
-Arg: <bytes>
-Help: Maximum file size to download
-Protocols: FTP HTTP MQTT
-See-also: limit-rate
-Category: connection
-Example: --max-filesize 100K $URL
-Added: 7.10.8
-Multi: single
----
-Specify the maximum size (in bytes) of a file to download. If the file
-requested is larger than this value, the transfer does not start and curl
-returns with exit code 63.
-
-A size modifier may be used. For example, Appending 'k' or 'K' counts the
-number as kilobytes, 'm' or 'M' makes it megabytes, while 'g' or 'G' makes it
-gigabytes. Examples: 200K, 3m and 1G. (Added in 7.58.0)
-
-**NOTE**: The file size is not always known prior to download, and for such
-files this option has no effect even if the file transfer ends up being larger
-than this given limit.
diff --git a/third-party/curl/docs/cmdline-opts/max-filesize.md b/third-party/curl/docs/cmdline-opts/max-filesize.md
new file mode 100644
index 0000000000..02b2293c56
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/max-filesize.md
@@ -0,0 +1,42 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: max-filesize
+Arg: <bytes>
+Help: Maximum file size to download
+Protocols: FTP HTTP MQTT
+Category: connection
+Added: 7.10.8
+Multi: single
+See-also:
+  - limit-rate
+Example:
+  - --max-filesize 100K $URL
+  - --max-filesize 2.6M $URL
+---
+
+# `--max-filesize`
+
+When set to a non-zero value, it specifies the maximum size (in bytes) of a
+file to download. If the file requested is larger than this value, the
+transfer does not start and curl returns with exit code 63.
+
+Setting the maximum value to zero disables the limit.
+
+A unit suffix letter can be used. Appending 'k' or 'K' counts the number as
+kilobytes, 'm' or 'M' makes it megabytes etc. The supported suffixes (k, M, G,
+T, P) are 1024-based. Examples: 200K, 3m and 1G. (Added in 7.58.0)
+
+**NOTE**: before curl 8.4.0, when the file size is not known prior to
+download, for such files this option has no effect even if the file transfer
+ends up being larger than this given limit.
+
+Starting with curl 8.4.0, this option aborts the transfer if it reaches the
+threshold during transfer.
+
+Starting in curl 8.19.0, the maximum size can be specified using a fraction as
+in `2.5M` for two and a half megabytes. It only works with a period (`.`)
+delimiter, independent of what your locale might prefer.
+
+Since 8.20.0, this option also stops ongoing transfers that would reach this
+threshold due to automatic decompression using --compressed.
diff --git a/third-party/curl/docs/cmdline-opts/max-redirs.d b/third-party/curl/docs/cmdline-opts/max-redirs.d
deleted file mode 100644
index 31ce98ea5e..0000000000
--- a/third-party/curl/docs/cmdline-opts/max-redirs.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: max-redirs
-Arg: <num>
-Help: Maximum number of redirects allowed
-Protocols: HTTP
-Category: http
-Example: --max-redirs 3 --location $URL
-Added: 7.5
-See-also: location
-Multi: single
----
-Set maximum number of redirections to follow. When --location is used, to
-prevent curl from following too many redirects, by default, the limit is
-set to 50 redirects. Set this option to -1 to make it unlimited.
diff --git a/third-party/curl/docs/cmdline-opts/max-redirs.md b/third-party/curl/docs/cmdline-opts/max-redirs.md
new file mode 100644
index 0000000000..02bdfaa7fb
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/max-redirs.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: max-redirs
+Arg: <num>
+Help: Maximum number of redirects allowed
+Protocols: HTTP
+Category: http
+Added: 7.5
+Multi: single
+See-also:
+  - location
+  - follow
+Example:
+  - --max-redirs 3 --location $URL
+---
+
+# `--max-redirs`
+
+Set the maximum number of redirections to follow. When --location or --follow
+are used, this option prevents curl from following too many redirects. By
+default the limit is set to 50 redirects. Set this option to -1 to make it
+unlimited.
diff --git a/third-party/curl/docs/cmdline-opts/max-time.d b/third-party/curl/docs/cmdline-opts/max-time.d
deleted file mode 100644
index 0d5747b26f..0000000000
--- a/third-party/curl/docs/cmdline-opts/max-time.d
+++ /dev/null
@@ -1,23 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: max-time
-Short: m
-Arg: <fractional seconds>
-Help: Maximum time allowed for transfer
-See-also: connect-timeout retry-max-time
-Category: connection
-Example: --max-time 10 $URL
-Example: --max-time 2.92 $URL
-Added: 4.0
-Multi: single
----
-Maximum time in seconds that you allow each transfer to take.  This is useful
-for preventing your batch jobs from hanging for hours due to slow networks or
-links going down. This option accepts decimal values (added in 7.32.0).
-
-If you enable retrying the transfer (--retry) then the maximum time counter is
-reset each time the transfer is retried. You can use --retry-max-time to limit
-the retry time.
-
-The decimal value needs to provided using a dot (.) as decimal separator - not
-the local version even if it might be using another separator.
diff --git a/third-party/curl/docs/cmdline-opts/max-time.md b/third-party/curl/docs/cmdline-opts/max-time.md
new file mode 100644
index 0000000000..2475dd1986
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/max-time.md
@@ -0,0 +1,30 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: max-time
+Short: m
+Arg: <seconds>
+Help: Maximum time allowed for transfer
+Category: connection timeout
+Added: 4.0
+Multi: single
+See-also:
+  - connect-timeout
+  - retry-max-time
+Example:
+  - --max-time 10 $URL
+  - --max-time 2.92 $URL
+---
+
+# `--max-time`
+
+Set the maximum time in seconds that you allow each transfer to take. Prevents
+your batch jobs from hanging for hours due to slow networks or links going
+down. This option accepts decimal values (added in 7.32.0).
+
+If you enable retrying the transfer (--retry) then the maximum time counter is
+reset each time the transfer is retried. You can use --retry-max-time to limit
+the retry time.
+
+The decimal value needs to be provided using a dot (.) as decimal separator -
+not the local version even if it might be using another separator.
diff --git a/third-party/curl/docs/cmdline-opts/metalink.d b/third-party/curl/docs/cmdline-opts/metalink.d
deleted file mode 100644
index 88f012176e..0000000000
--- a/third-party/curl/docs/cmdline-opts/metalink.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: metalink
-Help: Process given URLs as metalink XML file
-Added: 7.27.0
-Category: misc
-Example: --metalink file $URL
-See-also: parallel
-Multi: single
----
-This option was previously used to specify a Metalink resource. Metalink
-support is disabled in curl for security reasons (added in 7.78.0).
diff --git a/third-party/curl/docs/cmdline-opts/metalink.md b/third-party/curl/docs/cmdline-opts/metalink.md
new file mode 100644
index 0000000000..d3d3e25746
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/metalink.md
@@ -0,0 +1,18 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: metalink
+Help: Process given URLs as metalink XML file
+Added: 7.27.0
+Category: deprecated
+Multi: single
+See-also:
+  - parallel
+Example:
+  - --metalink file $URL
+---
+
+# `--metalink`
+
+This option was previously used to specify a Metalink resource. Metalink
+support is disabled in curl for security reasons (added in 7.78.0).
diff --git a/third-party/curl/docs/cmdline-opts/mptcp.md b/third-party/curl/docs/cmdline-opts/mptcp.md
new file mode 100644
index 0000000000..4a1bb65c06
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/mptcp.md
@@ -0,0 +1,31 @@
+---
+c: Copyright (C) Dorian Craps, <dorian.craps@student.vinci.be>
+SPDX-License-Identifier: curl
+Long: mptcp
+Added: 8.9.0
+Help: Enable Multipath TCP
+Category: connection
+Multi: boolean
+See-also:
+  - tcp-fastopen
+Example:
+  - --mptcp $URL
+---
+
+# `--mptcp`
+
+Enable the use of Multipath TCP (MPTCP) for connections. MPTCP is an extension
+to the standard TCP that allows multiple TCP streams over different network
+paths between the same source and destination. This can enhance bandwidth and
+improve reliability by using multiple paths simultaneously.
+
+MPTCP is beneficial in networks where multiple paths exist between clients and
+servers, such as mobile networks where a device may switch between WiFi and
+cellular data or in wired networks with multiple Internet Service Providers.
+
+This option is currently only supported on Linux starting from kernel 5.6. Only
+TCP connections are modified, hence this option does not affect HTTP/3 (QUIC)
+or UDP connections.
+
+The server curl connects to must also support MPTCP. If not, the connection
+seamlessly falls back to TCP.
diff --git a/third-party/curl/docs/cmdline-opts/negotiate.d b/third-party/curl/docs/cmdline-opts/negotiate.d
deleted file mode 100644
index f1dd34dbaf..0000000000
--- a/third-party/curl/docs/cmdline-opts/negotiate.d
+++ /dev/null
@@ -1,19 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: negotiate
-Help: Use HTTP Negotiate (SPNEGO) authentication
-Protocols: HTTP
-See-also: basic ntlm anyauth proxy-negotiate
-Category: auth http
-Example: --negotiate -u : $URL
-Added: 7.10.6
-Multi: mutex
----
-Enables Negotiate (SPNEGO) authentication.
-
-This option requires a library built with GSS-API or SSPI support. Use
---version to see if your curl supports GSS-API/SSPI or SPNEGO.
-
-When using this option, you must also provide a fake --user option to activate
-the authentication code properly. Sending a '-u :' is enough as the user name
-and password from the --user option are not actually used.
diff --git a/third-party/curl/docs/cmdline-opts/negotiate.md b/third-party/curl/docs/cmdline-opts/negotiate.md
new file mode 100644
index 0000000000..b7982d7c48
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/negotiate.md
@@ -0,0 +1,28 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: negotiate
+Help: Use HTTP Negotiate (SPNEGO) authentication
+Protocols: HTTP
+Category: auth http
+Added: 7.10.6
+Multi: boolean
+See-also:
+  - basic
+  - ntlm
+  - anyauth
+  - proxy-negotiate
+Example:
+  - --negotiate -u : $URL
+---
+
+# `--negotiate`
+
+Enable Negotiate (SPNEGO) authentication.
+
+This option requires a library built with GSS-API or SSPI support. Use
+--version to see if your curl supports GSS-API/SSPI or SPNEGO.
+
+When using this option, you must also provide a fake --user option to activate
+the authentication code properly. Sending a '-u :' is enough as the username
+and password from the --user option are not actually used.
diff --git a/third-party/curl/docs/cmdline-opts/netrc-file.d b/third-party/curl/docs/cmdline-opts/netrc-file.d
deleted file mode 100644
index 7b1a214da2..0000000000
--- a/third-party/curl/docs/cmdline-opts/netrc-file.d
+++ /dev/null
@@ -1,17 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: netrc-file
-Help: Specify FILE for netrc
-Arg: <filename>
-Added: 7.21.5
-Mutexed: netrc
-Category: curl
-Example: --netrc-file netrc $URL
-See-also: netrc user config
-Multi: single
----
-This option is similar to --netrc, except that you provide the path (absolute
-or relative) to the netrc file that curl should use. You can only specify one
-netrc file per invocation.
-
-It abides by --netrc-optional if specified.
diff --git a/third-party/curl/docs/cmdline-opts/netrc-file.md b/third-party/curl/docs/cmdline-opts/netrc-file.md
new file mode 100644
index 0000000000..3df72ce145
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/netrc-file.md
@@ -0,0 +1,24 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: netrc-file
+Help: Specify FILE for netrc
+Arg: <filename>
+Added: 7.21.5
+Mutexed: netrc
+Category: auth
+Multi: single
+See-also:
+  - netrc
+  - user
+  - config
+Example:
+  - --netrc-file netrc $URL
+---
+
+# `--netrc-file`
+
+Set the netrc file to use. Similar to --netrc, except that you also provide
+the path (absolute or relative).
+
+It abides by --netrc-optional if specified.
diff --git a/third-party/curl/docs/cmdline-opts/netrc-optional.d b/third-party/curl/docs/cmdline-opts/netrc-optional.d
deleted file mode 100644
index a7759640f9..0000000000
--- a/third-party/curl/docs/cmdline-opts/netrc-optional.d
+++ /dev/null
@@ -1,13 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: netrc-optional
-Help: Use either .netrc or URL
-Mutexed: netrc
-See-also: netrc-file
-Category: curl
-Example: --netrc-optional $URL
-Added: 7.9.8
-Multi: boolean
----
-Similar to --netrc, but this option makes the .netrc usage **optional**
-and not mandatory as the --netrc option does.
diff --git a/third-party/curl/docs/cmdline-opts/netrc-optional.md b/third-party/curl/docs/cmdline-opts/netrc-optional.md
new file mode 100644
index 0000000000..9b9c068c88
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/netrc-optional.md
@@ -0,0 +1,19 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: netrc-optional
+Help: Use either .netrc or URL
+Mutexed: netrc
+Category: auth
+Added: 7.9.8
+Multi: boolean
+See-also:
+  - netrc-file
+Example:
+  - --netrc-optional $URL
+---
+
+# `--netrc-optional`
+
+Similar to --netrc, but this option makes the .netrc usage **optional**
+and not mandatory as the --netrc option does.
diff --git a/third-party/curl/docs/cmdline-opts/netrc.d b/third-party/curl/docs/cmdline-opts/netrc.d
deleted file mode 100644
index 46e8778fa0..0000000000
--- a/third-party/curl/docs/cmdline-opts/netrc.d
+++ /dev/null
@@ -1,27 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: netrc
-Short: n
-Help: Must read .netrc for user name and password
-Category: curl
-Example: --netrc $URL
-Added: 4.6
-See-also: netrc-file config user
-Mutexed: netrc-file netrc-optional
-Multi: boolean
----
-Makes curl scan the *.netrc* (*_netrc* on Windows) file in the user's home
-directory for login name and password. This is typically used for FTP on
-Unix. If used with HTTP, curl enables user authentication. See *netrc(5)* and
-*ftp(1)* for details on the file format. Curl does not complain if that file
-does not have the right permissions (it should be neither world- nor
-group-readable). The environment variable "HOME" is used to find the home
-directory.
-
-A quick and simple example of how to setup a *.netrc* to allow curl to FTP to
-the machine host.domain.com with user name 'myself' and password 'secret'
-could look similar to:
-
- machine host.domain.com
- login myself
- password secret
diff --git a/third-party/curl/docs/cmdline-opts/netrc.md b/third-party/curl/docs/cmdline-opts/netrc.md
new file mode 100644
index 0000000000..03a7ed6e5d
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/netrc.md
@@ -0,0 +1,52 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: netrc
+Short: n
+Help: Must read .netrc for username and password
+Category: auth
+Added: 4.6
+Mutexed: netrc-file netrc-optional
+Multi: boolean
+See-also:
+  - netrc-file
+  - config
+  - user
+Example:
+  - --netrc $URL
+---
+
+# `--netrc`
+
+Make curl scan the *.netrc* file in the user's home directory for login name
+and password. This is typically used for FTP on Unix. If used with HTTP, curl
+enables user authentication. See *netrc(5)* and *ftp(1)* for details on the
+file format. curl does not complain if that file does not have the right
+permissions (it should be neither world- nor group-readable). The environment
+variable `HOME` is used to find the home directory. If the `NETRC` environment
+variable is set, that filename is used as the netrc file. (Added in 8.16.0)
+
+If --netrc-file is used, that overrides all other ways to figure out the file.
+
+The netrc file provides credentials for a hostname independent of which
+protocol and port number that are used.
+
+On Windows two filenames in the home directory are checked: *.netrc* and
+*_netrc*, preferring the former. Older versions on Windows checked for
+*_netrc* only.
+
+A quick and simple example of how to setup a *.netrc* to allow curl to access
+the machine host.example.com with username `myself` and password `secret`
+could look similar to:
+
+    machine host.example.com
+    login myself
+    password secret
+
+curl also supports the `default` keyword. This is the same as machine name
+except that default matches any name. There can be only one `default` token,
+and it must be after all machine tokens.
+
+When providing a username in the URL and a *.netrc* file, curl looks for the
+password for that specific user for the given host if such an entry appears in
+the file before a "generic" `machine` entry without `login` specified.
diff --git a/third-party/curl/docs/cmdline-opts/next.d b/third-party/curl/docs/cmdline-opts/next.d
deleted file mode 100644
index 93c9c45b38..0000000000
--- a/third-party/curl/docs/cmdline-opts/next.d
+++ /dev/null
@@ -1,27 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Short: :
-Long: next
-Tags:
-Protocols:
-Added: 7.36.0
-Magic: divider
-Help: Make next URL use its separate set of options
-Category: curl
-Example: $URL --next -d postthis www2.example.com
-Example: -I $URL --next https://example.net/
-See-also: parallel config
-Multi: append
----
-Tells curl to use a separate operation for the following URL and associated
-options. This allows you to send several URL requests, each with their own
-specific options, for example, such as different user names or custom requests
-for each.
-
---next resets all local options and only global ones have their values survive
-over to the operation following the --next instruction. Global options include
---verbose, --trace, --trace-ascii and --fail-early.
-
-For example, you can do both a GET and a POST in a single command line:
-
- curl www1.example.com --next -d postthis www2.example.com
diff --git a/third-party/curl/docs/cmdline-opts/next.md b/third-party/curl/docs/cmdline-opts/next.md
new file mode 100644
index 0000000000..cb67e907f4
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/next.md
@@ -0,0 +1,33 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Short: :
+Long: next
+Tags:
+Protocols:
+Added: 7.36.0
+Magic: divider
+Help: Make next URL use separate options
+Category: curl
+Multi: append
+See-also:
+  - parallel
+  - config
+Example:
+  - $URL --next -d postthis www2.example.com
+  - -I $URL --next https://example.net/
+---
+
+# `--next`
+
+Use a separate operation for the following URL and associated options. This
+allows you to send several URL requests, each with their own specific options,
+for example, such as different usernames or custom requests for each.
+
+--next resets all local options and only global ones have their values survive
+over to the operation following the --next instruction. Global options include
+--verbose, --trace, --trace-ascii and --fail-early.
+
+For example, you can do both a GET and a POST in a single command line:
+
+    curl www1.example.com --next -d postthis www2.example.com
diff --git a/third-party/curl/docs/cmdline-opts/no-alpn.d b/third-party/curl/docs/cmdline-opts/no-alpn.d
deleted file mode 100644
index 102f2990e5..0000000000
--- a/third-party/curl/docs/cmdline-opts/no-alpn.d
+++ /dev/null
@@ -1,19 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: no-alpn
-Tags: HTTP/2
-Protocols: HTTPS
-Added: 7.36.0
-See-also: no-npn http2
-Requires: TLS
-Help: Disable the ALPN TLS extension
-Category: tls http
-Example: --no-alpn $URL
-Multi: boolean
----
-Disable the ALPN TLS extension. ALPN is enabled by default if libcurl was built
-with an SSL library that supports ALPN. ALPN is used by a libcurl that supports
-HTTP/2 to negotiate HTTP/2 support with the server during https sessions.
-
-Note that this is the negated option name documented. You can use --alpn to
-enable ALPN.
diff --git a/third-party/curl/docs/cmdline-opts/no-alpn.md b/third-party/curl/docs/cmdline-opts/no-alpn.md
new file mode 100644
index 0000000000..4752948787
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/no-alpn.md
@@ -0,0 +1,26 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: no-alpn
+Tags: HTTP/2
+Protocols: HTTPS
+Added: 7.36.0
+Requires: TLS
+Help: Disable the ALPN TLS extension
+Category: tls http
+Multi: boolean
+See-also:
+  - no-npn
+  - http2
+Example:
+  - --no-alpn $URL
+---
+
+# `--no-alpn`
+
+Disable the ALPN TLS extension. ALPN is enabled by default if libcurl was built
+with an SSL library that supports ALPN. ALPN is used by a libcurl that supports
+HTTP/2 to negotiate HTTP/2 support with the server during https sessions.
+
+Note that this is the negated option name documented. You can use --alpn to
+enable ALPN.
diff --git a/third-party/curl/docs/cmdline-opts/no-buffer.d b/third-party/curl/docs/cmdline-opts/no-buffer.d
deleted file mode 100644
index 33f6fbc5bf..0000000000
--- a/third-party/curl/docs/cmdline-opts/no-buffer.d
+++ /dev/null
@@ -1,18 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: no-buffer
-Short: N
-Help: Disable buffering of the output stream
-Category: curl
-Example: --no-buffer $URL
-Added: 6.5
-See-also: progress-bar
-Multi: boolean
----
-Disables the buffering of the output stream. In normal work situations, curl
-uses a standard buffered output stream that has the effect that it outputs the
-data in chunks, not necessarily exactly when the data arrives. Using this
-option disables that buffering.
-
-Note that this is the negated option name documented. You can use --buffer to
-enable buffering again.
diff --git a/third-party/curl/docs/cmdline-opts/no-buffer.md b/third-party/curl/docs/cmdline-opts/no-buffer.md
new file mode 100644
index 0000000000..442beb0b3c
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/no-buffer.md
@@ -0,0 +1,24 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: no-buffer
+Short: N
+Help: Disable buffering of the output stream
+Category: output
+Added: 6.5
+Multi: boolean
+See-also:
+  - progress-bar
+Example:
+  - --no-buffer $URL
+---
+
+# `--no-buffer`
+
+Disable the buffering of the output stream. In normal work situations, curl
+uses a standard buffered output stream that has the effect that it outputs the
+data in chunks, not necessarily exactly when the data arrives. Using this
+option disables that buffering.
+
+Note that this is the negated option name documented. You can use --buffer to
+enable buffering again.
diff --git a/third-party/curl/docs/cmdline-opts/no-clobber.d b/third-party/curl/docs/cmdline-opts/no-clobber.d
deleted file mode 100644
index 9325558da6..0000000000
--- a/third-party/curl/docs/cmdline-opts/no-clobber.d
+++ /dev/null
@@ -1,19 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: no-clobber
-Help: Do not overwrite files that already exist
-Category: curl output
-Added: 7.83.0
-See-also: output remote-name
-Example: --no-clobber --output local/dir/file $URL
-Multi: boolean
----
-When used in conjunction with the --output, --remote-header-name,
---remote-name, or --remote-name-all options, curl avoids overwriting files
-that already exist. Instead, a dot and a number gets appended to the name of
-the file that would be created, up to filename.100 after which it does not
-create any file.
-
-Note that this is the negated option name documented.  You can thus use
---clobber to enforce the clobbering, even if --remote-header-name is
-specified.
diff --git a/third-party/curl/docs/cmdline-opts/no-clobber.md b/third-party/curl/docs/cmdline-opts/no-clobber.md
new file mode 100644
index 0000000000..02a74b25e4
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/no-clobber.md
@@ -0,0 +1,28 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: no-clobber
+Help: Do not overwrite files that already exist
+Category: output
+Added: 7.83.0
+Multi: boolean
+See-also:
+  - output
+  - remote-name
+Example:
+  - --no-clobber --output local/dir/file $URL
+---
+
+# `--no-clobber`
+
+When used in conjunction with the --output, --remote-header-name,
+--remote-name, or --remote-name-all options, curl avoids overwriting files
+that already exist. Instead, a dot and a number gets appended to the name of
+the file that would be created, up to filename.100 after which it does not
+create any file.
+
+Note that this is the negated option name documented. You can thus use
+--clobber to enforce the clobbering, even if --remote-header-name is
+specified.
+
+The --continue-at option cannot be used together with --no-clobber.
diff --git a/third-party/curl/docs/cmdline-opts/no-keepalive.d b/third-party/curl/docs/cmdline-opts/no-keepalive.d
deleted file mode 100644
index 0aeaef8d53..0000000000
--- a/third-party/curl/docs/cmdline-opts/no-keepalive.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: no-keepalive
-Help: Disable TCP keepalive on the connection
-Category: connection
-Example: --no-keepalive $URL
-Added: 7.18.0
-See-also: keepalive-time
-Multi: boolean
----
-Disables the use of keepalive messages on the TCP connection. curl otherwise
-enables them by default.
-
-Note that this is the negated option name documented. You can thus use
---keepalive to enforce keepalive.
diff --git a/third-party/curl/docs/cmdline-opts/no-keepalive.md b/third-party/curl/docs/cmdline-opts/no-keepalive.md
new file mode 100644
index 0000000000..99dd0329db
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/no-keepalive.md
@@ -0,0 +1,22 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: no-keepalive
+Help: Disable TCP keepalive on the connection
+Category: connection
+Added: 7.18.0
+Multi: boolean
+See-also:
+  - keepalive-time
+  - keepalive-cnt
+Example:
+  - --no-keepalive $URL
+---
+
+# `--no-keepalive`
+
+Disable the use of keepalive messages on the TCP connection. curl otherwise
+enables them by default.
+
+Note that this is the negated option name documented. You can thus use
+--keepalive to enforce keepalive.
diff --git a/third-party/curl/docs/cmdline-opts/no-npn.d b/third-party/curl/docs/cmdline-opts/no-npn.d
deleted file mode 100644
index cd0e5e2af5..0000000000
--- a/third-party/curl/docs/cmdline-opts/no-npn.d
+++ /dev/null
@@ -1,19 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: no-npn
-Tags: Versions HTTP/2
-Protocols: HTTPS
-Added: 7.36.0
-Mutexed:
-See-also: no-alpn http2
-Requires: TLS
-Help: Disable the NPN TLS extension
-Category: tls http
-Example: --no-npn $URL
-Multi: boolean
----
-curl never uses NPN, this option has no effect (added in 7.86.0).
-
-Disable the NPN TLS extension. NPN is enabled by default if libcurl was built
-with an SSL library that supports NPN. NPN is used by a libcurl that supports
-HTTP/2 to negotiate HTTP/2 support with the server during https sessions.
diff --git a/third-party/curl/docs/cmdline-opts/no-npn.md b/third-party/curl/docs/cmdline-opts/no-npn.md
new file mode 100644
index 0000000000..dbb69e91bb
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/no-npn.md
@@ -0,0 +1,26 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: no-npn
+Tags: Versions HTTP/2
+Protocols: HTTPS
+Added: 7.36.0
+Mutexed:
+Requires: TLS
+Help: Disable the NPN TLS extension
+Category: deprecated
+Multi: boolean
+See-also:
+  - no-alpn
+  - http2
+Example:
+  - --no-npn $URL
+---
+
+# `--no-npn`
+
+curl never uses NPN, this option has no effect (added in 7.86.0).
+
+Disable the NPN TLS extension. NPN is enabled by default if libcurl was built
+with an SSL library that supports NPN. NPN is used by a libcurl that supports
+HTTP/2 to negotiate HTTP/2 support with the server during https sessions.
diff --git a/third-party/curl/docs/cmdline-opts/no-progress-meter.d b/third-party/curl/docs/cmdline-opts/no-progress-meter.d
deleted file mode 100644
index 820557d9d5..0000000000
--- a/third-party/curl/docs/cmdline-opts/no-progress-meter.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: no-progress-meter
-Help: Do not show the progress meter
-See-also: verbose silent
-Added: 7.67.0
-Category: verbose
-Example: --no-progress-meter -o store $URL
-Multi: boolean
----
-Option to switch off the progress meter output without muting or otherwise
-affecting warning and informational messages like --silent does.
-
-Note that this is the negated option name documented. You can thus use
---progress-meter to enable the progress meter again.
diff --git a/third-party/curl/docs/cmdline-opts/no-progress-meter.md b/third-party/curl/docs/cmdline-opts/no-progress-meter.md
new file mode 100644
index 0000000000..72ec993762
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/no-progress-meter.md
@@ -0,0 +1,22 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: no-progress-meter
+Help: Do not show the progress meter
+Added: 7.67.0
+Category: verbose
+Multi: boolean
+See-also:
+  - verbose
+  - silent
+Example:
+  - --no-progress-meter -o store $URL
+---
+
+# `--no-progress-meter`
+
+Option to switch off the progress meter output without muting or otherwise
+affecting warning and informational messages like --silent does.
+
+Note that this is the negated option name documented. You can thus use
+--progress-meter to enable the progress meter again.
diff --git a/third-party/curl/docs/cmdline-opts/no-sessionid.d b/third-party/curl/docs/cmdline-opts/no-sessionid.d
deleted file mode 100644
index 9699f46bc9..0000000000
--- a/third-party/curl/docs/cmdline-opts/no-sessionid.d
+++ /dev/null
@@ -1,19 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: no-sessionid
-Help: Disable SSL session-ID reusing
-Protocols: TLS
-Added: 7.16.0
-Category: tls
-Example: --no-sessionid $URL
-See-also: insecure
-Multi: boolean
----
-Disable curl's use of SSL session-ID caching. By default all transfers are
-done using the cache. Note that while nothing should ever get hurt by
-attempting to reuse SSL session-IDs, there seem to be broken SSL
-implementations in the wild that may require you to disable this in order for
-you to succeed.
-
-Note that this is the negated option name documented. You can thus use
---sessionid to enforce session-ID caching.
diff --git a/third-party/curl/docs/cmdline-opts/no-sessionid.md b/third-party/curl/docs/cmdline-opts/no-sessionid.md
new file mode 100644
index 0000000000..08ba990bee
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/no-sessionid.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: no-sessionid
+Help: Disable SSL session-ID reusing
+Protocols: TLS
+Added: 7.16.0
+Category: tls
+Multi: boolean
+See-also:
+  - insecure
+Example:
+  - --no-sessionid $URL
+---
+
+# `--no-sessionid`
+
+Disable curl's use of SSL session-ID caching. By default all transfers are
+done using the cache. Note that while nothing should ever get hurt by
+attempting to reuse SSL session-IDs, there seem to be broken SSL
+implementations in the wild that may require you to disable this in order for
+you to succeed.
+
+Note that this is the negated option name documented. You can thus use
+--sessionid to enforce session-ID caching.
diff --git a/third-party/curl/docs/cmdline-opts/noproxy.d b/third-party/curl/docs/cmdline-opts/noproxy.d
deleted file mode 100644
index 001c109b69..0000000000
--- a/third-party/curl/docs/cmdline-opts/noproxy.d
+++ /dev/null
@@ -1,27 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: noproxy
-Arg: <no-proxy-list>
-Help: List of hosts which do not use proxy
-Added: 7.19.4
-Category: proxy
-Example: --noproxy "www.example" $URL
-See-also: proxy
-Multi: single
----
-Comma-separated list of hosts for which not to use a proxy, if one is
-specified. The only wildcard is a single * character, which matches all hosts,
-and effectively disables the proxy. Each name in this list is matched as
-either a domain which contains the hostname, or the hostname itself. For
-example, local.com would match local.com, local.com:80, and www.local.com, but
-not www.notlocal.com.
-
-This option overrides the environment variables that disable the proxy
-('no_proxy' and 'NO_PROXY') (added in 7.53.0). If there is an environment
-variable disabling a proxy, you can set the no proxy list to "" to override
-it.
-
-IP addresses specified to this option can be provided using CIDR notation
-(added in 7.86.0): an appended slash and number specifies the number of
-"network bits" out of the address to use in the comparison. For example
-"192.168.0.0/16" would match all addresses starting with "192.168".
diff --git a/third-party/curl/docs/cmdline-opts/noproxy.md b/third-party/curl/docs/cmdline-opts/noproxy.md
new file mode 100644
index 0000000000..10b74ecbf4
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/noproxy.md
@@ -0,0 +1,36 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: noproxy
+Arg: <no-proxy-list>
+Help: List of hosts which do not use proxy
+Added: 7.19.4
+Category: proxy
+Multi: single
+See-also:
+  - proxy
+Example:
+  - --noproxy "www.example" $URL
+---
+
+# `--noproxy`
+
+Comma-separated list of hosts for which not to use a proxy, if one is
+specified. The only wildcard is a single `*` character, which matches all
+hosts, and effectively disables the proxy. Each name in this list is matched
+as either a domain which contains the hostname, or the hostname itself. For
+example, `local.com` would match `local.com`, `local.com:80`, and
+`www.local.com`, but not `www.notlocal.com`.
+
+To use international hostnames in this list, add the punycode version of the
+hostname.
+
+This option overrides the environment variables that disable the proxy
+(`no_proxy` and `NO_PROXY`) (added in 7.53.0). If there is an environment
+variable disabling a proxy, you can set the no proxy list to "" to override
+it.
+
+IP addresses specified to this option can be provided using CIDR notation
+(added in 7.86.0): an appended slash and number specifies the number of
+network bits out of the address to use in the comparison. For example
+`192.168.0.0/16` would match all addresses starting with `192.168`.
diff --git a/third-party/curl/docs/cmdline-opts/ntlm-wb.d b/third-party/curl/docs/cmdline-opts/ntlm-wb.d
deleted file mode 100644
index 4a32252936..0000000000
--- a/third-party/curl/docs/cmdline-opts/ntlm-wb.d
+++ /dev/null
@@ -1,13 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ntlm-wb
-Help: Use HTTP NTLM authentication with winbind
-Protocols: HTTP
-See-also: ntlm proxy-ntlm
-Category: auth http
-Example: --ntlm-wb -u user:password $URL
-Added: 7.22.0
-Multi: mutex
----
-Enables NTLM much in the style --ntlm does, but hand over the authentication
-to the separate binary ntlmauth application that is executed when needed.
diff --git a/third-party/curl/docs/cmdline-opts/ntlm-wb.md b/third-party/curl/docs/cmdline-opts/ntlm-wb.md
new file mode 100644
index 0000000000..3a1d35cb16
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ntlm-wb.md
@@ -0,0 +1,22 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ntlm-wb
+Help: HTTP NTLM authentication with winbind
+Protocols: HTTP
+Category: deprecated
+Added: 7.22.0
+Multi: mutex
+See-also:
+  - ntlm
+  - proxy-ntlm
+Example:
+  - --ntlm-wb -u user:password $URL
+---
+
+# `--ntlm-wb`
+
+Deprecated option (added in 8.8.0).
+
+Enabled NTLM much in the style --ntlm does, but handed over the authentication
+to a separate executable that was executed when needed.
diff --git a/third-party/curl/docs/cmdline-opts/ntlm.d b/third-party/curl/docs/cmdline-opts/ntlm.d
deleted file mode 100644
index cc98c51e34..0000000000
--- a/third-party/curl/docs/cmdline-opts/ntlm.d
+++ /dev/null
@@ -1,22 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ntlm
-Help: Use HTTP NTLM authentication
-Mutexed: basic negotiate digest anyauth
-See-also: proxy-ntlm
-Protocols: HTTP
-Requires: TLS
-Category: auth http
-Example: --ntlm -u user:password $URL
-Added: 7.10.6
-Multi: mutex
----
-Enables NTLM authentication. The NTLM authentication method was designed by
-Microsoft and is used by IIS web servers. It is a proprietary protocol,
-reverse-engineered by clever people and implemented in curl based on their
-efforts. This kind of behavior should not be endorsed, you should encourage
-everyone who uses NTLM to switch to a public and documented authentication
-method instead, such as Digest.
-
-If you want to enable NTLM for your proxy authentication, then use
---proxy-ntlm.
diff --git a/third-party/curl/docs/cmdline-opts/ntlm.md b/third-party/curl/docs/cmdline-opts/ntlm.md
new file mode 100644
index 0000000000..6850e115ae
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ntlm.md
@@ -0,0 +1,27 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ntlm
+Help: HTTP NTLM authentication
+Protocols: HTTP
+Requires: TLS
+Category: auth http
+Added: 7.10.6
+Multi: boolean
+See-also:
+  - proxy-ntlm
+Example:
+  - --ntlm -u user:password $URL
+---
+
+# `--ntlm`
+
+Use NTLM authentication. The NTLM authentication method was designed by
+Microsoft and is used by IIS web servers. It is a proprietary protocol,
+reverse-engineered by clever people and implemented in curl based on their
+efforts. This kind of behavior should not be endorsed, you should encourage
+everyone who uses NTLM to switch to a public and documented authentication
+method instead, such as Digest.
+
+If you want to enable NTLM for your proxy authentication, then use
+--proxy-ntlm.
diff --git a/third-party/curl/docs/cmdline-opts/oauth2-bearer.d b/third-party/curl/docs/cmdline-opts/oauth2-bearer.d
deleted file mode 100644
index 6f35147840..0000000000
--- a/third-party/curl/docs/cmdline-opts/oauth2-bearer.d
+++ /dev/null
@@ -1,17 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: oauth2-bearer
-Help: OAuth 2 Bearer Token
-Arg: <token>
-Protocols: IMAP LDAP POP3 SMTP HTTP
-Category: auth
-Example: --oauth2-bearer "mF_9.B5f-4.1JqM" $URL
-Added: 7.33.0
-See-also: basic ntlm digest
-Multi: single
----
-Specify the Bearer Token for OAUTH 2.0 server authentication. The Bearer Token
-is used in conjunction with the user name which can be specified as part of
-the --url or --user options.
-
-The Bearer Token and user name are formatted according to RFC 6750.
diff --git a/third-party/curl/docs/cmdline-opts/oauth2-bearer.md b/third-party/curl/docs/cmdline-opts/oauth2-bearer.md
new file mode 100644
index 0000000000..b66477fc70
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/oauth2-bearer.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: oauth2-bearer
+Help: OAuth 2 Bearer Token
+Arg: <token>
+Protocols: IMAP LDAP POP3 SMTP HTTP
+Category: auth imap pop3 smtp ldap
+Added: 7.33.0
+Multi: single
+See-also:
+  - basic
+  - ntlm
+  - digest
+Example:
+  - --oauth2-bearer "mF_9.B5f-4.1JqM" $URL
+---
+
+# `--oauth2-bearer`
+
+Specify the Bearer Token for OAUTH 2.0 server authentication. The Bearer Token
+is used in conjunction with the username which can be specified as part of the
+--url or --user options.
+
+The Bearer Token and username are formatted according to RFC 6750.
diff --git a/third-party/curl/docs/cmdline-opts/out-null.md b/third-party/curl/docs/cmdline-opts/out-null.md
new file mode 100644
index 0000000000..cca193e3af
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/out-null.md
@@ -0,0 +1,26 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: out-null
+Help: Discard response data into the void
+Category: output
+Added: 8.16.0
+Multi: per-URL
+See-also:
+  - output
+  - remote-name
+  - remote-name-all
+  - remote-header-name
+Example:
+  - "https://example.com" --out-null
+---
+
+# `--out-null`
+
+Discard all response output of a transfer silently. This is the more
+efficient and portable version of
+
+    curl https://host.example -o /dev/null
+
+The transfer is done in full, all data is received and checked, but
+the bytes are not written anywhere.
diff --git a/third-party/curl/docs/cmdline-opts/output-dir.d b/third-party/curl/docs/cmdline-opts/output-dir.d
deleted file mode 100644
index 803b2948bb..0000000000
--- a/third-party/curl/docs/cmdline-opts/output-dir.d
+++ /dev/null
@@ -1,19 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: output-dir
-Arg: <dir>
-Help: Directory to save files in
-Added: 7.73.0
-See-also: remote-name remote-header-name
-Category: curl
-Example: --output-dir "tmp" -O $URL
-Multi: single
----
-This option specifies the directory in which files should be stored, when
---remote-name or --output are used.
-
-The given output directory is used for all URLs and output options on the
-command line, up until the first --next.
-
-If the specified target directory does not exist, the operation fails unless
---create-dirs is also used.
diff --git a/third-party/curl/docs/cmdline-opts/output-dir.md b/third-party/curl/docs/cmdline-opts/output-dir.md
new file mode 100644
index 0000000000..468ecc8a11
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/output-dir.md
@@ -0,0 +1,26 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: output-dir
+Arg: <dir>
+Help: Directory to save files in
+Added: 7.73.0
+Category: output
+Multi: single
+See-also:
+  - remote-name
+  - remote-header-name
+Example:
+  - --output-dir "tmp" -O $URL
+---
+
+# `--output-dir`
+
+Specify the directory in which files should be stored, when --remote-name or
+--output are used.
+
+The given output directory is used for all URLs and output options on the
+command line, up until the first --next.
+
+If the specified target directory does not exist, the operation fails unless
+--create-dirs is also used.
diff --git a/third-party/curl/docs/cmdline-opts/output.d b/third-party/curl/docs/cmdline-opts/output.d
deleted file mode 100644
index 067151091d..0000000000
--- a/third-party/curl/docs/cmdline-opts/output.d
+++ /dev/null
@@ -1,49 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: output
-Arg: <file>
-Short: o
-Help: Write to file instead of stdout
-See-also: remote-name remote-name-all remote-header-name
-Category: important curl
-Example: -o file $URL
-Example: "http://{one,two}.example.com" -o "file_#1.txt"
-Example: "http://{site,host}.host[1-5].com" -o "#1_#2"
-Example: -o file $URL -o file2 https://example.net
-Added: 4.0
-Multi: append
----
-Write output to <file> instead of stdout. If you are using {} or [] to fetch
-multiple documents, you should quote the URL and you can use '#' followed by a
-number in the <file> specifier. That variable is replaced with the current
-string for the URL being fetched. Like in:
-
- curl "http://{one,two}.example.com" -o "file_#1.txt"
-
-or use several variables like:
-
- curl "http://{site,host}.host[1-5].com" -o "#1_#2"
-
-You may use this option as many times as the number of URLs you have. For
-example, if you specify two URLs on the same command line, you can use it like
-this:
-
- curl -o aa example.com -o bb example.net
-
-and the order of the -o options and the URLs does not matter, just that the
-first -o is for the first URL and so on, so the above command line can also be
-written as
-
- curl example.com example.net -o aa -o bb
-
-See also the --create-dirs option to create the local directories
-dynamically. Specifying the output as '-' (a single dash) passes the output to
-stdout.
-
-To suppress response bodies, you can redirect output to /dev/null:
-
- curl example.com -o /dev/null
-
-Or for Windows:
-
- curl example.com -o nul
diff --git a/third-party/curl/docs/cmdline-opts/output.md b/third-party/curl/docs/cmdline-opts/output.md
new file mode 100644
index 0000000000..b2d196d038
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/output.md
@@ -0,0 +1,90 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: output
+Arg: <file>
+Short: o
+Help: Write to file instead of stdout
+Category: important output
+Added: 4.0
+Multi: per-URL
+See-also:
+  - out-null
+  - remote-name
+  - remote-name-all
+  - remote-header-name
+  - compressed
+Example:
+  - -o file $URL
+  - "http://{one,two}.example.com" -o "file_#1.txt"
+  - "http://{site,host}.host[1-5].example" -o "#1_#2"
+  - -o file $URL -o file2 https://example.net
+---
+
+# `--output`
+
+Write output to the given file instead of stdout. If you are using globbing in
+the URL to fetch multiple documents, you should quote the URL and you can use
+`#` followed by a number in the filename. That variable gets replaced with the
+current glob text. Like in:
+
+    curl "http://{one,two}.example.com" -o "file_#1.txt"
+
+or use several variables like:
+
+    curl "http://{site,host}.host[1-5].example" -o "#1_#2"
+
+You may use this option as many times as the number of URLs you have. For
+example, if you specify two URLs on the same command line, you can use it like
+this:
+
+    curl -o aa example.com -o bb example.net
+
+and the order of the -o options and the URLs does not matter, only that the
+first -o is for the first URL and so on, so the above command line can also be
+written as
+
+    curl example.com example.net -o aa -o bb
+
+See also the --create-dirs option to create the local directories
+dynamically. Specifying the output as '-' (a single dash) passes the output to
+stdout.
+
+To suppress response bodies, you can redirect output to /dev/null:
+
+    curl example.com -o /dev/null
+
+Or for Windows:
+
+    curl example.com -o nul
+
+Or, even more efficient and portable, use
+
+    curl example.com --out-null
+
+Specify the filename as single minus to force the output to stdout, to
+override curl's internal binary output in terminal prevention:
+
+    curl https://example.com/jpeg -o -
+
+Note that the binary output may be caused by the response being compressed, in
+which case you may want to use the --compressed option.
+
+Since curl 8.21.0, the separate globbing parts can be named and referenced by
+their names. The case sensitive alphanumeric name is set enclosed within angle
+brackets after the opening character. Examples:
+
+    curl "https://fun.example/{<num>one,two}.jpg" -o "save-#<num>"
+
+    curl "ftp://ftp.example/file[<range>1-100].txt" \
+      -o "save-#<range>.txt"
+
+Referencing a named glob that is not set, causes an error.
+
+Since curl 8.21.0, you can use parts of the upload filename when it uses
+globbing by setting a glob name and referencing it the same way you reference
+named URL globs. For example, if you upload three files to a single fixed HTTP
+URL and want to save the corresponding responses in separate files:
+
+    curl -T 'file{<num>1,2,3}' \
+      https://upload.example/ -o 'response-#<num>'
diff --git a/third-party/curl/docs/cmdline-opts/page-footer b/third-party/curl/docs/cmdline-opts/page-footer
deleted file mode 100644
index beae49ac12..0000000000
--- a/third-party/curl/docs/cmdline-opts/page-footer
+++ /dev/null
@@ -1,322 +0,0 @@
-.SH FILES
-.I ~/.curlrc
-.RS
-Default config file, see --config for details.
-.SH ENVIRONMENT
-The environment variables can be specified in lower case or upper case. The
-lower case version has precedence. http_proxy is an exception as it is only
-available in lower case.
-
-Using an environment variable to set the proxy has the same effect as using
-the --proxy option.
-
-.IP "http_proxy [protocol://]<host>[:port]"
-Sets the proxy server to use for HTTP.
-.IP "HTTPS_PROXY [protocol://]<host>[:port]"
-Sets the proxy server to use for HTTPS.
-.IP "[url-protocol]_PROXY [protocol://]<host>[:port]"
-Sets the proxy server to use for [url-protocol], where the protocol is a
-protocol that curl supports and as specified in a URL. FTP, FTPS, POP3, IMAP,
-SMTP, LDAP, etc.
-.IP "ALL_PROXY [protocol://]<host>[:port]"
-Sets the proxy server to use if no protocol-specific proxy is set.
-.IP "NO_PROXY <comma-separated list of hosts/domains>"
-list of host names that should not go through any proxy. If set to an asterisk
-'*' only, it matches all hosts. Each name in this list is matched as either
-a domain name which contains the hostname, or the hostname itself.
-
-This environment variable disables use of the proxy even when specified with
-the --proxy option. That is
-.B NO_PROXY=direct.example.com curl -x http://proxy.example.com
-.B http://direct.example.com
-accesses the target URL directly, and
-.B NO_PROXY=direct.example.com curl -x http://proxy.example.com
-.B http://somewhere.example.com
-accesses the target URL through the proxy.
-
-The list of host names can also be include numerical IP addresses, and IPv6
-versions should then be given without enclosing brackets.
-
-IP addresses can be specified using CIDR notation: an appended slash and
-number specifies the number of "network bits" out of the address to use in the
-comparison (added in 7.86.0). For example "192.168.0.0/16" would match all
-addresses starting with "192.168".
-.IP "APPDATA <dir>"
-On Windows, this variable is used when trying to find the home directory. If
-the primary home variable are all unset.
-.IP "COLUMNS <terminal width>"
-If set, the specified number of characters is used as the terminal width when
-the alternative progress-bar is shown. If not set, curl tries to figure it out
-using other ways.
-.IP "CURL_CA_BUNDLE <file>"
-If set, it is used as the --cacert value.
-.IP "CURL_HOME <dir>"
-If set, is the first variable curl checks when trying to find its home
-directory. If not set, it continues to check *XDG_CONFIG_HOME*
-.IP "CURL_SSL_BACKEND <TLS backend>"
-If curl was built with support for "MultiSSL", meaning that it has built-in
-support for more than one TLS backend, this environment variable can be set to
-the case insensitive name of the particular backend to use when curl is
-invoked. Setting a name that is not a built-in alternative makes curl stay
-with the default.
-
-SSL backend names (case-insensitive): **bearssl**, **gnutls**, **mbedtls**,
-**openssl**, **rustls**, **schannel**, **secure-transport**, **wolfssl**
-.IP "HOME <dir>"
-If set, this is used to find the home directory when that is needed. Like when
-looking for the default .curlrc. *CURL_HOME* and *XDG_CONFIG_HOME*
-have preference.
-.IP "QLOGDIR <directory name>"
-If curl was built with HTTP/3 support, setting this environment variable to a
-local directory makes curl produce **qlogs** in that directory, using file
-names named after the destination connection id (in hex). Do note that these
-files can become rather large. Works with the ngtcp2 and quiche QUIC backends.
-.IP SHELL
-Used on VMS when trying to detect if using a **DCL** or a **unix** shell.
-.IP "SSL_CERT_DIR <dir>"
-If set, it is used as the --capath value.
-.IP "SSL_CERT_FILE <path>"
-If set, it is used as the --cacert value.
-.IP "SSLKEYLOGFILE <file name>"
-If you set this environment variable to a file name, curl stores TLS secrets
-from its connections in that file when invoked to enable you to analyze the
-TLS traffic in real time using network analyzing tools such as Wireshark. This
-works with the following TLS backends: OpenSSL, libressl, BoringSSL, GnuTLS
-and wolfSSL.
-.IP "USERPROFILE <dir>"
-On Windows, this variable is used when trying to find the home directory. If
-the other, primary, variable are all unset. If set, curl uses the path
-**"$USERPROFILE\\Application Data"**.
-.IP "XDG_CONFIG_HOME <dir>"
-If *CURL_HOME* is not set, this variable is checked when looking for a
-default .curlrc file.
-.SH "PROXY PROTOCOL PREFIXES"
-The proxy string may be specified with a protocol:// prefix to specify
-alternative proxy protocols. (Added in 7.21.7)
-
-If no protocol is specified in the proxy string or if the string does not
-match a supported one, the proxy is treated as an HTTP proxy.
-
-The supported proxy protocol prefixes are as follows:
-.IP "http://"
-Makes it use it as an HTTP proxy. The default if no scheme prefix is used.
-.IP "https://"
-Makes it treated as an **HTTPS** proxy.
-.IP "socks4://"
-Makes it the equivalent of --socks4
-.IP "socks4a://"
-Makes it the equivalent of --socks4a
-.IP "socks5://"
-Makes it the equivalent of --socks5
-.IP "socks5h://"
-Makes it the equivalent of --socks5-hostname
-.SH EXIT CODES
-There are a bunch of different error codes and their corresponding error
-messages that may appear under error conditions. At the time of this writing,
-the exit codes are:
-.IP 0
-Success. The operation completed successfully according to the instructions.
-.IP 1
-Unsupported protocol. This build of curl has no support for this protocol.
-.IP 2
-Failed to initialize.
-.IP 3
-URL malformed. The syntax was not correct.
-.IP 4
-A feature or option that was needed to perform the desired request was not
-enabled or was explicitly disabled at build-time. To make curl able to do
-this, you probably need another build of libcurl.
-.IP 5
-Could not resolve proxy. The given proxy host could not be resolved.
-.IP 6
-Could not resolve host. The given remote host could not be resolved.
-.IP 7
-Failed to connect to host.
-.IP 8
-Weird server reply. The server sent data curl could not parse.
-.IP 9
-FTP access denied. The server denied login or denied access to the particular
-resource or directory you wanted to reach. Most often you tried to change to a
-directory that does not exist on the server.
-.IP 10
-FTP accept failed. While waiting for the server to connect back when an active
-FTP session is used, an error code was sent over the control connection or
-similar.
-.IP 11
-FTP weird PASS reply. Curl could not parse the reply sent to the PASS request.
-.IP 12
-During an active FTP session while waiting for the server to connect back to
-curl, the timeout expired.
-.IP 13
-FTP weird PASV reply, Curl could not parse the reply sent to the PASV request.
-.IP 14
-FTP weird 227 format. Curl could not parse the 227-line the server sent.
-.IP 15
-FTP cannot use host. Could not resolve the host IP we got in the 227-line.
-.IP 16
-HTTP/2 error. A problem was detected in the HTTP2 framing layer. This is
-somewhat generic and can be one out of several problems, see the error message
-for details.
-.IP 17
-FTP could not set binary. Could not change transfer method to binary.
-.IP 18
-Partial file. Only a part of the file was transferred.
-.IP 19
-FTP could not download/access the given file, the RETR (or similar) command
-failed.
-.IP 21
-FTP quote error. A quote command returned error from the server.
-.IP 22
-HTTP page not retrieved. The requested URL was not found or returned another
-error with the HTTP error code being 400 or above. This return code only
-appears if --fail is used.
-.IP 23
-Write error. Curl could not write data to a local filesystem or similar.
-.IP 25
-FTP could not STOR file. The server denied the STOR operation, used for FTP
-uploading.
-.IP 26
-Read error. Various reading problems.
-.IP 27
-Out of memory. A memory allocation request failed.
-.IP 28
-Operation timeout. The specified time-out period was reached according to the
-conditions.
-.IP 30
-FTP PORT failed. The PORT command failed. Not all FTP servers support the PORT
-command, try doing a transfer using PASV instead!
-.IP 31
-FTP could not use REST. The REST command failed. This command is used for
-resumed FTP transfers.
-.IP 33
-HTTP range error. The range "command" did not work.
-.IP 34
-HTTP post error. Internal post-request generation error.
-.IP 35
-SSL connect error. The SSL handshaking failed.
-.IP 36
-Bad download resume. Could not continue an earlier aborted download.
-.IP 37
-FILE could not read file. Failed to open the file. Permissions?
-.IP 38
-LDAP cannot bind. LDAP bind operation failed.
-.IP 39
-LDAP search failed.
-.IP 41
-Function not found. A required LDAP function was not found.
-.IP 42
-Aborted by callback. An application told curl to abort the operation.
-.IP 43
-Internal error. A function was called with a bad parameter.
-.IP 45
-Interface error. A specified outgoing interface could not be used.
-.IP 47
-Too many redirects. When following redirects, curl hit the maximum amount.
-.IP 48
-Unknown option specified to libcurl. This indicates that you passed a weird
-option to curl that was passed on to libcurl and rejected. Read up in the
-manual!
-.IP 49
-Malformed telnet option.
-.IP 52
-The server did not reply anything, which here is considered an error.
-.IP 53
-SSL crypto engine not found.
-.IP 54
-Cannot set SSL crypto engine as default.
-.IP 55
-Failed sending network data.
-.IP 56
-Failure in receiving network data.
-.IP 58
-Problem with the local certificate.
-.IP 59
-Could not use specified SSL cipher.
-.IP 60
-Peer certificate cannot be authenticated with known CA certificates.
-.IP 61
-Unrecognized transfer encoding.
-.IP 63
-Maximum file size exceeded.
-.IP 64
-Requested FTP SSL level failed.
-.IP 65
-Sending the data requires a rewind that failed.
-.IP 66
-Failed to initialize SSL Engine.
-.IP 67
-The user name, password, or similar was not accepted and curl failed to log in.
-.IP 68
-File not found on TFTP server.
-.IP 69
-Permission problem on TFTP server.
-.IP 70
-Out of disk space on TFTP server.
-.IP 71
-Illegal TFTP operation.
-.IP 72
-Unknown TFTP transfer ID.
-.IP 73
-File already exists (TFTP).
-.IP 74
-No such user (TFTP).
-.IP 77
-Problem reading the SSL CA cert (path? access rights?).
-.IP 78
-The resource referenced in the URL does not exist.
-.IP 79
-An unspecified error occurred during the SSH session.
-.IP 80
-Failed to shut down the SSL connection.
-.IP 82
-Could not load CRL file, missing or wrong format (added in 7.19.0).
-.IP 83
-Issuer check failed (added in 7.19.0).
-.IP 84
-The FTP PRET command failed.
-.IP 85
-Mismatch of RTSP CSeq numbers.
-.IP 86
-Mismatch of RTSP Session Identifiers.
-.IP 87
-Unable to parse FTP file list.
-.IP 88
-FTP chunk callback reported error.
-.IP 89
-No connection available, the session is queued.
-.IP 90
-SSL public key does not matched pinned public key.
-.IP 91
-Invalid SSL certificate status.
-.IP 92
-Stream error in HTTP/2 framing layer.
-.IP 93
-An API function was called from inside a callback.
-.IP 94
-An authentication function returned an error.
-.IP 95
-A problem was detected in the HTTP/3 layer. This is somewhat generic and can
-be one out of several problems, see the error message for details.
-.IP 96
-QUIC connection error. This error may be caused by an SSL library error. QUIC
-is the protocol used for HTTP/3 transfers.
-.IP 97
-Proxy handshake error.
-.IP 98
-A client-side certificate is required to complete the TLS handshake.
-.IP 99
-Poll or select returned fatal error.
-.IP XX
-More error codes might appear here in future releases. The existing ones are
-meant to never change.
-.SH BUGS
-If you experience any problems with curl, submit an issue in the project's bug
-tracker on GitHub: https://github.com/curl/curl/issues
-.SH AUTHORS / CONTRIBUTORS
-Daniel Stenberg is the main author, but the whole list of contributors is
-found in the separate THANKS file.
-.SH WWW
-https://curl.se
-.SH "SEE ALSO"
-.BR ftp (1),
-.BR wget (1)
diff --git a/third-party/curl/docs/cmdline-opts/page-header b/third-party/curl/docs/cmdline-opts/page-header
deleted file mode 100644
index 7d14f4c452..0000000000
--- a/third-party/curl/docs/cmdline-opts/page-header
+++ /dev/null
@@ -1,258 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.\" DO NOT EDIT. Generated by the curl project gen.pl man page generator.
-.\"
-.TH curl 1 "%DATE" "curl %VERSION" "curl Manual"
-.SH NAME
-curl \- transfer a URL
-.SH SYNOPSIS
-.B curl [options / URLs]
-.SH DESCRIPTION
-**curl** is a tool for transferring data from or to a server using URLs. It
-supports these protocols: DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS,
-IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, RTMP, RTMPS, RTSP, SCP, SFTP,
-SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS.
-
-curl is powered by libcurl for all transfer-related features. See
-*libcurl(3)* for details.
-.SH URL
-The URL syntax is protocol-dependent. You find a detailed description in
-RFC 3986.
-
-If you provide a URL without a leading **protocol://** scheme, curl guesses
-what protocol you want. It then defaults to HTTP but assumes others based on
-often-used host name prefixes. For example, for host names starting with
-"ftp." curl assumes you want FTP.
-
-You can specify any amount of URLs on the command line. They are fetched in a
-sequential manner in the specified order unless you use --parallel. You can
-specify command line options and URLs mixed and in any order on the command
-line.
-
-curl attempts to reuse connections when doing multiple transfers, so that
-getting many files from the same server do not use multiple connects and setup
-handshakes. This improves speed. Connection reuse can only be done for URLs
-specified for a single command line invocation and cannot be performed between
-separate curl runs.
-
-Provide an IPv6 zone id in the URL with an escaped percentage sign. Like in
-
-  "http://[fe80::3%25eth0]/"
-
-Everything provided on the command line that is not a command line option or
-its argument, curl assumes is a URL and treats it as such.
-.SH GLOBBING
-You can specify multiple URLs or parts of URLs by writing lists within braces
-or ranges within brackets. We call this "globbing".
-
-Provide a list with three different names like this:
-
-  "http://site.{one,two,three}.com"
-
-or you can get sequences of alphanumeric series by using [] as in:
-
-  "ftp://ftp.example.com/file[1-100].txt"
-
-  "ftp://ftp.example.com/file[001-100].txt"    (with leading zeros)
-
-  "ftp://ftp.example.com/file[a-z].txt"
-
-Nested sequences are not supported, but you can use several ones next to each
-other:
-
-  "http://example.com/archive[1996-1999]/vol[1-4]/part{a,b,c}.html"
-
-You can specify a step counter for the ranges to get every Nth number or
-letter:
-
-  "http://example.com/file[1-100:10].txt"
-
-  "http://example.com/file[a-z:2].txt"
-
-When using [] or {} sequences when invoked from a command line prompt, you
-probably have to put the full URL within double quotes to avoid the shell from
-interfering with it. This also goes for other characters treated special, like
-for example '&', '?' and '*'.
-
-Switch off globbing with --globoff.
-.SH VARIABLES
-curl supports command line variables (added in 8.3.0). Set variables with
---variable name=content or --variable name@file (where "file" can be stdin if
-set to a single dash (-)).
-
-Variable contents can expanded in option parameters using "{{name}}" (without
-the quotes) if the option name is prefixed with "--expand-". This gets the
-contents of the variable "name" inserted, or a blank if the name does not
-exist as a variable. Insert "{{" verbatim in the string by prefixing it with a
-backslash, like "\\{{".
-
-You an access and expand environment variables by first importing them. You
-can select to either require the environment variable to be set or you can
-provide a default value in case it is not already set. Plain --variable %name
-imports the variable called 'name' but exits with an error if that environment
-variable is not already set. To provide a default value if it is not set, use
---variable %name=content or --variable %name@content.
-
-Example. Get the USER environment variable into the URL, fail if USER is not
-set:
-
- --variable '%USER'
- --expand-url = "https://example.com/api/{{USER}}/method"
-
-When expanding variables, curl supports a set of functions that can make the
-variable contents more convenient to use. It can trim leading and trailing
-white space with *trim*, it can output the contents as a JSON quoted string
-with *json*, URL encode the string with *url* or base64 encode it with
-*b64*. You apply function to a variable expansion, add them colon separated to
-the right side of the variable. Variable content holding null bytes that are
-not encoded when expanded cause error.
-
-Example: get the contents of a file called $HOME/.secret into a variable
-called "fix". Make sure that the content is trimmed and percent-encoded sent
-as POST data:
-
-  --variable %HOME
-  --expand-variable fix@{{HOME}}/.secret
-  --expand-data "{{fix:trim:url}}"
-  https://example.com/
-
-Command line variables and expansions were added in in 8.3.0.
-.SH OUTPUT
-If not told otherwise, curl writes the received data to stdout. It can be
-instructed to instead save that data into a local file, using the --output or
---remote-name options. If curl is given multiple URLs to transfer on the
-command line, it similarly needs multiple options for where to save them.
-
-curl does not parse or otherwise "understand" the content it gets or writes as
-output. It does no encoding or decoding, unless explicitly asked to with
-dedicated command line options.
-.SH PROTOCOLS
-curl supports numerous protocols, or put in URL terms: schemes. Your
-particular build may not support them all.
-.IP DICT
-Lets you lookup words using online dictionaries.
-.IP FILE
-Read or write local files. curl does not support accessing file:// URL
-remotely, but when running on Microsoft Windows using the native UNC approach
-works.
-.IP FTP(S)
-curl supports the File Transfer Protocol with a lot of tweaks and levers. With
-or without using TLS.
-.IP GOPHER(S)
-Retrieve files.
-.IP HTTP(S)
-curl supports HTTP with numerous options and variations. It can speak HTTP
-version 0.9, 1.0, 1.1, 2 and 3 depending on build options and the correct
-command line options.
-.IP IMAP(S)
-Using the mail reading protocol, curl can "download" emails for you. With or
-without using TLS.
-.IP LDAP(S)
-curl can do directory lookups for you, with or without TLS.
-.IP MQTT
-curl supports MQTT version 3. Downloading over MQTT equals "subscribe" to a
-topic while uploading/posting equals "publish" on a topic. MQTT over TLS is
-not supported (yet).
-.IP POP3(S)
-Downloading from a pop3 server means getting a mail. With or without using
-TLS.
-.IP RTMP(S)
-The **Realtime Messaging Protocol** is primarily used to serve streaming media
-and curl can download it.
-.IP RTSP
-curl supports RTSP 1.0 downloads.
-.IP SCP
-curl supports SSH version 2 scp transfers.
-.IP SFTP
-curl supports SFTP (draft 5) done over SSH version 2.
-.IP SMB(S)
-curl supports SMB version 1 for upload and download.
-.IP SMTP(S)
-Uploading contents to an SMTP server means sending an email. With or without
-TLS.
-.IP TELNET
-Telling curl to fetch a telnet URL starts an interactive session where it
-sends what it reads on stdin and outputs what the server sends it.
-.IP TFTP
-curl can do TFTP downloads and uploads.
-.SH "PROGRESS METER"
-curl normally displays a progress meter during operations, indicating the
-amount of transferred data, transfer speeds and estimated time left, etc. The
-progress meter displays the transfer rate in bytes per second. The suffixes
-(k, M, G, T, P) are 1024 based. For example 1k is 1024 bytes. 1M is 1048576
-bytes.
-
-curl displays this data to the terminal by default, so if you invoke curl to
-do an operation and it is about to write data to the terminal, it
-*disables* the progress meter as otherwise it would mess up the output
-mixing progress meter and response data.
-
-If you want a progress meter for HTTP POST or PUT requests, you need to
-redirect the response output to a file, using shell redirect (>), --output or
-similar.
-
-This does not apply to FTP upload as that operation does not spit out any
-response data to the terminal.
-
-If you prefer a progress "bar" instead of the regular meter, --progress-bar is
-your friend. You can also disable the progress meter completely with the
---silent option.
-.SH VERSION
-This man page describes curl %VERSION. If you use a later version, chances are
-this man page does not fully document it. If you use an earlier version, this
-document tries to include version information about which specific version
-that introduced changes.
-
-You can always learn which the latest curl version is by running
-
-  curl https://curl.se/info
-
-The online version of this man page is always showing the latest incarnation:
-https://curl.se/docs/manpage.html
-.SH OPTIONS
-Options start with one or two dashes. Many of the options require an
-additional value next to them. If provided text does not start with a dash, it
-is presumed to be and treated as a URL.
-
-The short "single-dash" form of the options, -d for example, may be used with
-or without a space between it and its value, although a space is a recommended
-separator. The long "double-dash" form, --data for example, requires a space
-between it and its value.
-
-Short version options that do not need any additional values can be used
-immediately next to each other, like for example you can specify all the
-options *-O*, *-L* and *-v* at once as *-OLv*.
-
-In general, all boolean options are enabled with --**option** and yet again
-disabled with --**no-**option. That is, you use the same option name but
-prefix it with "no-". However, in this list we mostly only list and show the
-*--option* version of them.
-
-When --next is used, it resets the parser state and you start again with a
-clean option state, except for the options that are "global". Global options
-retain their values and meaning even after --next.
-
-The following options are global:
-%GLOBALS.
diff --git a/third-party/curl/docs/cmdline-opts/parallel-immediate.d b/third-party/curl/docs/cmdline-opts/parallel-immediate.d
deleted file mode 100644
index b534dd5122..0000000000
--- a/third-party/curl/docs/cmdline-opts/parallel-immediate.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: parallel-immediate
-Help: Do not wait for multiplexing (with --parallel)
-Added: 7.68.0
-See-also: parallel parallel-max
-Category: connection curl
-Example: --parallel-immediate -Z $URL -o file1 $URL -o file2
-Multi: boolean
-Scope: global
----
-When doing parallel transfers, this option instructs curl that it should
-rather prefer opening up more connections in parallel at once rather than
-waiting to see if new transfers can be added as multiplexed streams on another
-connection.
diff --git a/third-party/curl/docs/cmdline-opts/parallel-immediate.md b/third-party/curl/docs/cmdline-opts/parallel-immediate.md
new file mode 100644
index 0000000000..4d7a3ad516
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/parallel-immediate.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: parallel-immediate
+Help: Do not wait for multiplexing
+Added: 7.68.0
+Category: connection curl global
+Multi: boolean
+Scope: global
+See-also:
+  - parallel
+  - parallel-max
+Example:
+  - --parallel-immediate -Z $URL -o file1 $URL -o file2
+---
+
+# `--parallel-immediate`
+
+When doing parallel transfers, this option instructs curl to prefer opening up
+more connections in parallel at once rather than waiting to see if new
+transfers can be added as multiplexed streams on another connection.
+
+By default, without this option set, curl prefers to wait a little and
+multiplex new transfers over existing connections. It keeps the number of
+connections low at the expense of risking a slightly slower transfer startup.
diff --git a/third-party/curl/docs/cmdline-opts/parallel-max-host.md b/third-party/curl/docs/cmdline-opts/parallel-max-host.md
new file mode 100644
index 0000000000..a21c9acddd
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/parallel-max-host.md
@@ -0,0 +1,28 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: parallel-max-host
+Arg: <num>
+Help: Maximum connections to a single host
+Added: 8.16.0
+Category: connection curl global
+Multi: single
+Scope: global
+See-also:
+  - parallel
+  - parallel-max
+Example:
+  - --parallel-max-host 5 -Z $URL ftp://example.com/
+---
+
+# `--parallel-max-host`
+
+When asked to do parallel transfers, using --parallel, this option controls
+the maximum amount of concurrent connections curl is allowed to do to the same
+protocol + hostname + port number target.
+
+The limit is enforced by libcurl and queued "internally", which means that
+transfers that are waiting for an available connection still look like started
+transfers in the progress meter.
+
+The default is 0 (unlimited). 65535 is the largest supported value.
diff --git a/third-party/curl/docs/cmdline-opts/parallel-max.d b/third-party/curl/docs/cmdline-opts/parallel-max.d
deleted file mode 100644
index cc6d32d182..0000000000
--- a/third-party/curl/docs/cmdline-opts/parallel-max.d
+++ /dev/null
@@ -1,18 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: parallel-max
-Arg: <num>
-Help: Maximum concurrency for parallel transfers
-Added: 7.66.0
-See-also: parallel
-Category: connection curl
-Example: --parallel-max 100 -Z $URL ftp://example.com/
-Multi: single
----
-When asked to do parallel transfers, using --parallel, this option controls
-the maximum amount of transfers to do simultaneously.
-
-This option is global and does not need to be specified for each use of
---next.
-
-The default is 50.
diff --git a/third-party/curl/docs/cmdline-opts/parallel-max.md b/third-party/curl/docs/cmdline-opts/parallel-max.md
new file mode 100644
index 0000000000..a487f4cc9e
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/parallel-max.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: parallel-max
+Arg: <num>
+Help: Maximum concurrency for parallel transfers
+Added: 7.66.0
+Category: connection curl global
+Multi: single
+Scope: global
+See-also:
+  - parallel
+  - parallel-max-host
+Example:
+  - --parallel-max 100 -Z $URL ftp://example.com/
+---
+
+# `--parallel-max`
+
+When asked to do parallel transfers, using --parallel, this option controls
+the maximum amount of transfers to do simultaneously.
+
+The default is 50. 65535 is the largest supported value.
diff --git a/third-party/curl/docs/cmdline-opts/parallel.d b/third-party/curl/docs/cmdline-opts/parallel.d
deleted file mode 100644
index 4f698f8b3a..0000000000
--- a/third-party/curl/docs/cmdline-opts/parallel.d
+++ /dev/null
@@ -1,14 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Short: Z
-Long: parallel
-Help: Perform transfers in parallel
-Added: 7.66.0
-Category: connection curl
-Example: --parallel $URL -o file1 $URL -o file2
-See-also: next verbose
-Multi: boolean
-Scope: global
----
-Makes curl perform its transfers in parallel as compared to the regular serial
-manner.
diff --git a/third-party/curl/docs/cmdline-opts/parallel.md b/third-party/curl/docs/cmdline-opts/parallel.md
new file mode 100644
index 0000000000..907ab8cb85
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/parallel.md
@@ -0,0 +1,32 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Short: Z
+Long: parallel
+Help: Perform transfers in parallel
+Added: 7.66.0
+Category: connection curl global
+Multi: boolean
+Scope: global
+See-also:
+  - next
+  - verbose
+  - parallel-max
+  - parallel-immediate
+Example:
+  - --parallel $URL -o file1 $URL -o file2
+---
+
+# `--parallel`
+
+Make curl perform all transfers in parallel as compared to the regular serial
+manner. Parallel transfer means that curl runs up to N concurrent transfers
+simultaneously and if there are more than N transfers to handle, it starts new
+ones when earlier transfers finish.
+
+With parallel transfers, the progress meter output is different from when
+doing serial transfers, as it then displays the transfer status for multiple
+transfers in a single line.
+
+The maximum amount of concurrent transfers is set with --parallel-max and it
+defaults to 50.
diff --git a/third-party/curl/docs/cmdline-opts/pass.d b/third-party/curl/docs/cmdline-opts/pass.d
deleted file mode 100644
index 2c0a2bef62..0000000000
--- a/third-party/curl/docs/cmdline-opts/pass.d
+++ /dev/null
@@ -1,13 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: pass
-Arg: <phrase>
-Help: Pass phrase for the private key
-Protocols: SSH TLS
-Category: ssh tls auth
-Example: --pass secret --key file $URL
-Added: 7.9.3
-See-also: key user
-Multi: single
----
-Passphrase for the private key.
diff --git a/third-party/curl/docs/cmdline-opts/pass.md b/third-party/curl/docs/cmdline-opts/pass.md
new file mode 100644
index 0000000000..79c2f8738a
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/pass.md
@@ -0,0 +1,20 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: pass
+Arg: <phrase>
+Help: Passphrase for the private key
+Protocols: TLS SCP SFTP
+Category: ssh tls auth
+Added: 7.9.3
+Multi: single
+See-also:
+  - key
+  - user
+Example:
+  - --pass secret --key file $URL
+---
+
+# `--pass`
+
+Passphrase for the private key used for SSH or TLS.
diff --git a/third-party/curl/docs/cmdline-opts/path-as-is.d b/third-party/curl/docs/cmdline-opts/path-as-is.d
deleted file mode 100644
index 9897d882f6..0000000000
--- a/third-party/curl/docs/cmdline-opts/path-as-is.d
+++ /dev/null
@@ -1,13 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: path-as-is
-Help: Do not squash .. sequences in URL path
-Added: 7.42.0
-Category: curl
-Example: --path-as-is https://example.com/../../etc/passwd
-See-also: request-target
-Multi: boolean
----
-Tell curl to not handle sequences of /../ or /./ in the given URL
-path. Normally curl squashes or merges them according to standards but with
-this option set you tell it not to do that.
diff --git a/third-party/curl/docs/cmdline-opts/path-as-is.md b/third-party/curl/docs/cmdline-opts/path-as-is.md
new file mode 100644
index 0000000000..f3a60cff24
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/path-as-is.md
@@ -0,0 +1,19 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: path-as-is
+Help: Do not squash .. sequences in URL path
+Added: 7.42.0
+Category: curl
+Multi: boolean
+See-also:
+  - request-target
+Example:
+  - --path-as-is https://example.com/../../etc/passwd
+---
+
+# `--path-as-is`
+
+Do not handle sequences of /../ or /./ in the given URL path. Normally curl
+squashes or merges them according to standards but with this option set you
+tell it not to do that.
diff --git a/third-party/curl/docs/cmdline-opts/pinnedpubkey.d b/third-party/curl/docs/cmdline-opts/pinnedpubkey.d
deleted file mode 100644
index 48b96dfc5a..0000000000
--- a/third-party/curl/docs/cmdline-opts/pinnedpubkey.d
+++ /dev/null
@@ -1,32 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: pinnedpubkey
-Arg: <hashes>
-Help: FILE/HASHES Public key to verify peer against
-Protocols: TLS
-Category: tls
-Example: --pinnedpubkey keyfile $URL
-Example: --pinnedpubkey 'sha256//ce118b51897f4452dc' $URL
-Added: 7.39.0
-See-also: hostpubsha256
-Multi: single
----
-Tells curl to use the specified public key file (or hashes) to verify the
-peer. This can be a path to a file which contains a single public key in PEM
-or DER format, or any number of base64 encoded sha256 hashes preceded by
-'sha256//' and separated by ';'.
-
-When negotiating a TLS or SSL connection, the server sends a certificate
-indicating its identity. A public key is extracted from this certificate and
-if it does not exactly match the public key provided to this option, curl
-aborts the connection before sending or receiving any data.
-
-PEM/DER support:
-
-OpenSSL and GnuTLS (added in 7.39.0), wolfSSL (added in 7.43.0), mbedTLS (added in 7.47.0)
-
-sha256 support:
-
-OpenSSL, GnuTLS and wolfSSL (added in 7.44.0), mbedTLS (added in 7.47.0)
-
-Other SSL backends not supported.
diff --git a/third-party/curl/docs/cmdline-opts/pinnedpubkey.md b/third-party/curl/docs/cmdline-opts/pinnedpubkey.md
new file mode 100644
index 0000000000..ff7c42b39d
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/pinnedpubkey.md
@@ -0,0 +1,43 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: pinnedpubkey
+Arg: <hashes>
+Help: Public key to verify peer against
+Protocols: TLS
+Category: tls
+Added: 7.39.0
+Multi: single
+See-also:
+  - hostpubsha256
+Example:
+  - --pinnedpubkey keyfile $URL
+  - --pinnedpubkey 'sha256//ce118b51897f4452dc' $URL
+---
+
+# `--pinnedpubkey`
+
+Use the specified public key file (or hashes) to verify the peer. This can be
+a path to a file which contains a single public key in PEM or DER format, or
+any number of base64 encoded sha256 hashes preceded by 'sha256//' and
+separated by ';'.
+
+When negotiating a TLS or SSL connection, the server sends a certificate
+indicating its identity. A public key is extracted from this certificate and
+if it does not exactly match the public key provided to this option, curl
+aborts the connection before sending or receiving any data.
+
+This option is independent of option --insecure. If you use both options
+together then the peer is still verified by public key.
+
+PEM/DER support:
+
+OpenSSL and GnuTLS (added in 7.39.0), wolfSSL (added in 7.43.0),
+mbedTLS (added in 7.47.0), Schannel (added in 7.58.1)
+
+sha256 support:
+
+OpenSSL, GnuTLS and wolfSSL (added in 7.44.0), mbedTLS (added in 7.47.0),
+Schannel (added in 7.58.1)
+
+Other SSL backends not supported.
diff --git a/third-party/curl/docs/cmdline-opts/post301.d b/third-party/curl/docs/cmdline-opts/post301.d
deleted file mode 100644
index d067fc8cc0..0000000000
--- a/third-party/curl/docs/cmdline-opts/post301.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: post301
-Help: Do not switch to GET after following a 301
-Protocols: HTTP
-See-also: post302 post303 location
-Added: 7.17.1
-Category: http post
-Example: --post301 --location -d "data" $URL
-Multi: boolean
----
-Tells curl to respect RFC 7231/6.4.2 and not convert POST requests into GET
-requests when following a 301 redirection. The non-RFC behavior is ubiquitous
-in web browsers, so curl does the conversion by default to maintain
-consistency. However, a server may require a POST to remain a POST after such
-a redirection. This option is meaningful only when using --location.
diff --git a/third-party/curl/docs/cmdline-opts/post301.md b/third-party/curl/docs/cmdline-opts/post301.md
new file mode 100644
index 0000000000..3bcded869f
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/post301.md
@@ -0,0 +1,24 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: post301
+Help: Do not switch to GET after a 301 redirect
+Protocols: HTTP
+Added: 7.17.1
+Category: http post
+Multi: boolean
+See-also:
+  - post302
+  - post303
+  - location
+Example:
+  - --post301 --location -d "data" $URL
+---
+
+# `--post301`
+
+Respect RFC 7231/6.4.2 and do not convert POST requests into GET requests when
+following a 301 redirect. The non-RFC behavior is ubiquitous in web browsers,
+so curl does the conversion by default to maintain consistency. A server may
+require a POST to remain a POST after such a redirection. This option is
+meaningful only when using --location.
diff --git a/third-party/curl/docs/cmdline-opts/post302.d b/third-party/curl/docs/cmdline-opts/post302.d
deleted file mode 100644
index b7190ce0fb..0000000000
--- a/third-party/curl/docs/cmdline-opts/post302.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: post302
-Help: Do not switch to GET after following a 302
-Protocols: HTTP
-See-also: post301 post303 location
-Added: 7.19.1
-Category: http post
-Example: --post302 --location -d "data" $URL
-Multi: boolean
----
-Tells curl to respect RFC 7231/6.4.3 and not convert POST requests into GET
-requests when following a 302 redirection. The non-RFC behavior is ubiquitous
-in web browsers, so curl does the conversion by default to maintain
-consistency. However, a server may require a POST to remain a POST after such
-a redirection. This option is meaningful only when using --location.
diff --git a/third-party/curl/docs/cmdline-opts/post302.md b/third-party/curl/docs/cmdline-opts/post302.md
new file mode 100644
index 0000000000..bcb35fc5df
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/post302.md
@@ -0,0 +1,24 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: post302
+Help: Do not switch to GET after a 302 redirect
+Protocols: HTTP
+Added: 7.19.1
+Category: http post
+Multi: boolean
+See-also:
+  - post301
+  - post303
+  - location
+Example:
+  - --post302 --location -d "data" $URL
+---
+
+# `--post302`
+
+Respect RFC 7231/6.4.3 and do not convert POST requests into GET requests when
+following a 302 redirect. The non-RFC behavior is ubiquitous in web browsers,
+so curl does the conversion by default to maintain consistency. A server may
+require a POST to remain a POST after such a redirection. This option is
+meaningful only when using --location.
diff --git a/third-party/curl/docs/cmdline-opts/post303.d b/third-party/curl/docs/cmdline-opts/post303.d
deleted file mode 100644
index 52d440c453..0000000000
--- a/third-party/curl/docs/cmdline-opts/post303.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: post303
-Help: Do not switch to GET after following a 303
-Protocols: HTTP
-See-also: post302 post301 location
-Added: 7.26.0
-Category: http post
-Example: --post303 --location -d "data" $URL
-Multi: boolean
----
-Tells curl to violate RFC 7231/6.4.4 and not convert POST requests into GET
-requests when following 303 redirections. A server may require a POST to
-remain a POST after a 303 redirection. This option is meaningful only when
-using --location.
diff --git a/third-party/curl/docs/cmdline-opts/post303.md b/third-party/curl/docs/cmdline-opts/post303.md
new file mode 100644
index 0000000000..63dc0d7956
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/post303.md
@@ -0,0 +1,22 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: post303
+Help: Do not switch to GET after a 303 redirect
+Protocols: HTTP
+Added: 7.26.0
+Category: http post
+Multi: boolean
+See-also:
+  - post302
+  - post301
+  - location
+Example:
+  - --post303 --location -d "data" $URL
+---
+
+# `--post303`
+
+Violate RFC 7231/6.4.4 and do not convert POST requests into GET requests when
+following 303 redirect. A server may require a POST to remain a POST after a
+303 redirection. This option is meaningful only when using --location.
diff --git a/third-party/curl/docs/cmdline-opts/preproxy.d b/third-party/curl/docs/cmdline-opts/preproxy.d
deleted file mode 100644
index b55c1d47a2..0000000000
--- a/third-party/curl/docs/cmdline-opts/preproxy.d
+++ /dev/null
@@ -1,26 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: preproxy
-Arg: [protocol://]host[:port]
-Help: Use this proxy first
-Added: 7.52.0
-Category: proxy
-Example: --preproxy socks5://proxy.example -x http://http.example $URL
-See-also: proxy socks5
-Multi: single
----
-Use the specified SOCKS proxy before connecting to an HTTP or HTTPS --proxy. In
-such a case curl first connects to the SOCKS proxy and then connects (through
-SOCKS) to the HTTP or HTTPS proxy. Hence pre proxy.
-
-The pre proxy string should be specified with a protocol:// prefix to specify
-alternative proxy protocols. Use socks4://, socks4a://, socks5:// or
-socks5h:// to request the specific SOCKS version to be used. No protocol
-specified makes curl default to SOCKS4.
-
-If the port number is not specified in the proxy string, it is assumed to be
-1080.
-
-User and password that might be provided in the proxy string are URL decoded
-by curl. This allows you to pass in special characters such as @ by using %40
-or pass in a colon with %3a.
diff --git a/third-party/curl/docs/cmdline-opts/preproxy.md b/third-party/curl/docs/cmdline-opts/preproxy.md
new file mode 100644
index 0000000000..a108d9f094
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/preproxy.md
@@ -0,0 +1,33 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: preproxy
+Arg: <[protocol://]host[:port]>
+Help: Use this proxy first
+Added: 7.52.0
+Category: proxy
+Multi: single
+See-also:
+  - proxy
+  - socks5
+Example:
+  - --preproxy socks5://proxy.example -x http://http.example $URL
+---
+
+# `--preproxy`
+
+Use the specified SOCKS proxy before connecting to an HTTP or HTTPS --proxy. In
+such a case curl first connects to the SOCKS proxy and then connects (through
+SOCKS) to the HTTP or HTTPS proxy. Hence pre proxy.
+
+The pre proxy string should be specified with a `protocol://` prefix to specify
+alternative proxy protocols. Use `socks4://`, `socks4a://`, `socks5://` or
+`socks5h://` to request the specific SOCKS version to be used. No protocol
+specified makes curl default to SOCKS4.
+
+If the port number is not specified in the proxy string, it is assumed to be
+1080.
+
+User and password that might be provided in the proxy string are URL decoded
+by curl. This allows you to pass in special characters such as @ by using %40
+or pass in a colon with %3a.
diff --git a/third-party/curl/docs/cmdline-opts/progress-bar.d b/third-party/curl/docs/cmdline-opts/progress-bar.d
deleted file mode 100644
index fee170979d..0000000000
--- a/third-party/curl/docs/cmdline-opts/progress-bar.d
+++ /dev/null
@@ -1,20 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Short: #
-Long: progress-bar
-Help: Display transfer progress as a bar
-Category: verbose
-Example: -# -O $URL
-Added: 5.10
-See-also: styled-output
-Multi: boolean
-Scope: global
----
-Make curl display transfer progress as a simple progress bar instead of the
-standard, more informational, meter.
-
-This progress bar draws a single line of '#' characters across the screen and
-shows a percentage if the transfer size is known. For transfers without a
-known size, there is a space ship (-=o=-) that moves back and forth but only
-while data is being transferred, with a set of flying hash sign symbols on
-top.
diff --git a/third-party/curl/docs/cmdline-opts/progress-bar.md b/third-party/curl/docs/cmdline-opts/progress-bar.md
new file mode 100644
index 0000000000..6f08d7f7c7
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/progress-bar.md
@@ -0,0 +1,26 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Short: #
+Long: progress-bar
+Help: Display transfer progress as a bar
+Category: verbose global
+Added: 5.10
+Multi: boolean
+Scope: global
+See-also:
+  - styled-output
+Example:
+  - -# -O $URL
+---
+
+# `--progress-bar`
+
+Make curl display transfer progress as a simple progress bar instead of the
+standard, more informational, meter.
+
+This progress bar draws a single line of '#' characters across the screen and
+shows a percentage if the transfer size is known. For transfers without a
+known size, there is a space ship (-=o=-) that moves back and forth but only
+while data is being transferred, with a set of flying hash sign symbols on
+top.
diff --git a/third-party/curl/docs/cmdline-opts/proto-default.d b/third-party/curl/docs/cmdline-opts/proto-default.d
deleted file mode 100644
index d5b4bcd10d..0000000000
--- a/third-party/curl/docs/cmdline-opts/proto-default.d
+++ /dev/null
@@ -1,20 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proto-default
-Help: Use PROTOCOL for any URL missing a scheme
-Arg: <protocol>
-Added: 7.45.0
-Category: connection curl
-Example: --proto-default https ftp.example.com
-See-also: proto proto-redir
-Multi: single
----
-Tells curl to use *protocol* for any URL missing a scheme name.
-
-An unknown or unsupported protocol causes error
-*CURLE_UNSUPPORTED_PROTOCOL* (1).
-
-This option does not change the default proxy protocol (http).
-
-Without this option set, curl guesses protocol based on the host name, see
---url for details.
diff --git a/third-party/curl/docs/cmdline-opts/proto-default.md b/third-party/curl/docs/cmdline-opts/proto-default.md
new file mode 100644
index 0000000000..903fac73a5
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proto-default.md
@@ -0,0 +1,30 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proto-default
+Help: Use PROTOCOL for any URL missing a scheme
+Arg: <protocol>
+Added: 7.45.0
+Category: connection curl
+Multi: single
+See-also:
+  - proto
+  - proto-redir
+Example:
+  - --proto-default https ftp.example.com
+---
+
+# `--proto-default`
+
+Use *protocol* for any provided URL missing a scheme. The case-insensitive
+name should be given without any `://` suffix.
+
+An unknown or unsupported protocol causes error *CURLE_UNSUPPORTED_PROTOCOL*.
+
+This option does not change the default proxy protocol (http).
+
+Without this option set, curl guesses protocol based on the hostname, see
+--url for details.
+
+The default protocol cannot be set to `ipfs` or `ipns`. Those schemes need to
+be used explicitly in the URL.
diff --git a/third-party/curl/docs/cmdline-opts/proto-redir.d b/third-party/curl/docs/cmdline-opts/proto-redir.d
deleted file mode 100644
index dec8716144..0000000000
--- a/third-party/curl/docs/cmdline-opts/proto-redir.d
+++ /dev/null
@@ -1,22 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proto-redir
-Arg: <protocols>
-Help: Enable/disable PROTOCOLS on redirect
-Added: 7.20.2
-Category: connection curl
-Example: --proto-redir =http,https $URL
-See-also: proto
-Multi: single
----
-Tells curl to limit what protocols it may use on redirect. Protocols denied by
---proto are not overridden by this option. See --proto for how protocols are
-represented.
-
-Example, allow only HTTP and HTTPS on redirect:
-
- curl --proto-redir -all,http,https http://example.com
-
-By default curl only allows HTTP, HTTPS, FTP and FTPS on redirects (added in
-7.65.2). Specifying *all* or *+all* enables all protocols on redirects, which
-is not good for security.
diff --git a/third-party/curl/docs/cmdline-opts/proto-redir.md b/third-party/curl/docs/cmdline-opts/proto-redir.md
new file mode 100644
index 0000000000..1f75bfdfd6
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proto-redir.md
@@ -0,0 +1,28 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proto-redir
+Arg: <protocols>
+Help: Enable/disable PROTOCOLS on redirect
+Added: 7.21.0
+Category: connection curl
+Multi: single
+See-also:
+  - proto
+  - follow
+Example:
+  - --proto-redir =http,https --follow $URL
+---
+
+# `--proto-redir`
+
+Limit what protocols to allow on redirects. Protocols denied by --proto are
+not overridden by this option. See --proto for how protocols are represented.
+
+Example, allow only HTTP and HTTPS on redirect:
+
+    curl --proto-redir -all,http,https --follow http://example.com
+
+By default curl only allows HTTP, HTTPS, FTP and FTPS on redirects
+(added in 7.65.2). Specifying *all* or *+all* enables all protocols on
+redirects, which is not good for security.
diff --git a/third-party/curl/docs/cmdline-opts/proto.d b/third-party/curl/docs/cmdline-opts/proto.d
deleted file mode 100644
index ac024bf428..0000000000
--- a/third-party/curl/docs/cmdline-opts/proto.d
+++ /dev/null
@@ -1,48 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proto
-Arg: <protocols>
-Help: Enable/disable PROTOCOLS
-See-also: proto-redir proto-default
-Added: 7.20.2
-Category: connection curl
-Example: --proto =http,https,sftp $URL
-Multi: single
----
-Tells curl to limit what protocols it may use for transfers. Protocols are
-evaluated left to right, are comma separated, and are each a protocol name or
-'all', optionally prefixed by zero or more modifiers. Available modifiers are:
-.RS
-.TP 3
-.B +
-Permit this protocol in addition to protocols already permitted (this is
-the default if no modifier is used).
-.TP
-.B -
-Deny this protocol, removing it from the list of protocols already permitted.
-.TP
-.B =
-Permit only this protocol (ignoring the list already permitted), though
-subject to later modification by subsequent entries in the comma separated
-list.
-.RE
-.IP
-For example:
-.RS
-.TP 15
-.B --proto -ftps
-uses the default protocols, but disables ftps
-.TP
-.B  --proto -all,https,+http
-only enables http and https
-.TP
-.B --proto =http,https
-also only enables http and https
-.RE
-.IP
-Unknown and disabled protocols produce a warning. This allows scripts to
-safely rely on being able to disable potentially dangerous protocols, without
-relying upon support for that protocol being built into curl to avoid an error.
-
-This option can be used multiple times, in which case the effect is the same
-as concatenating the protocols into one instance of the option.
diff --git a/third-party/curl/docs/cmdline-opts/proto.md b/third-party/curl/docs/cmdline-opts/proto.md
new file mode 100644
index 0000000000..cf288d4565
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proto.md
@@ -0,0 +1,48 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proto
+Arg: <protocols>
+Help: Enable/disable PROTOCOLS
+Added: 7.21.0
+Category: connection curl
+Multi: single
+See-also:
+  - proto-redir
+  - proto-default
+Example:
+  - --proto =http,https,sftp $URL
+---
+
+# `--proto`
+
+Limit what protocols to allow for transfers. Protocols are evaluated left to
+right, are comma separated, and are each a protocol name or 'all', optionally
+prefixed by zero or more modifiers. Available modifiers are:
+
+## +
+Permit this protocol in addition to protocols already permitted (this is
+the default if no modifier is used).
+
+## -
+Deny this protocol, removing it from the list of protocols already permitted.
+
+## =
+Permit only this protocol (ignoring the list already permitted), though
+subject to later modification by subsequent entries in the comma separated
+list.
+
+##
+
+For example: --proto -ftps uses the default protocols, but disables ftps
+
+--proto -all,https,+http only enables http and https
+
+--proto =http,https also only enables http and https
+
+Unknown and disabled protocols produce a warning. This allows scripts to
+safely rely on being able to disable potentially dangerous protocols, without
+relying upon support for that protocol being built into curl to avoid an error.
+
+This option can be used multiple times, in which case the effect is the same
+as concatenating the protocols into one instance of the option.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-anyauth.d b/third-party/curl/docs/cmdline-opts/proxy-anyauth.d
deleted file mode 100644
index fa460876ef..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-anyauth.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-anyauth
-Help: Pick any proxy authentication method
-Added: 7.13.2
-See-also: proxy proxy-basic proxy-digest
-Category: proxy auth
-Example: --proxy-anyauth --proxy-user user:passwd -x proxy $URL
-Multi: mutex
----
-Tells curl to pick a suitable authentication method when communicating with
-the given HTTP proxy. This might cause an extra request/response round-trip.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-anyauth.md b/third-party/curl/docs/cmdline-opts/proxy-anyauth.md
new file mode 100644
index 0000000000..bb59b21e8f
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-anyauth.md
@@ -0,0 +1,20 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-anyauth
+Help: Pick any proxy authentication method
+Added: 7.13.2
+Category: proxy auth
+Multi: custom
+See-also:
+  - proxy
+  - proxy-basic
+  - proxy-digest
+Example:
+  - --proxy-anyauth --proxy-user user:passwd -x proxy $URL
+---
+
+# `--proxy-anyauth`
+
+Automatically pick a suitable authentication method when communicating with
+the given HTTP proxy. This might cause an extra request/response round-trip.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-basic.d b/third-party/curl/docs/cmdline-opts/proxy-basic.d
deleted file mode 100644
index ff56631f77..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-basic.d
+++ /dev/null
@@ -1,13 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-basic
-Help: Use Basic authentication on the proxy
-See-also: proxy proxy-anyauth proxy-digest
-Category: proxy auth
-Example: --proxy-basic --proxy-user user:passwd -x proxy $URL
-Added: 7.12.0
-Multi: mutex
----
-Tells curl to use HTTP Basic authentication when communicating with the given
-proxy. Use --basic for enabling HTTP Basic with a remote host. Basic is the
-default authentication method curl uses with proxies.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-basic.md b/third-party/curl/docs/cmdline-opts/proxy-basic.md
new file mode 100644
index 0000000000..732ea1f45c
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-basic.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-basic
+Help: Use Basic authentication on the proxy
+Category: proxy auth
+Added: 7.12.0
+Multi: boolean
+See-also:
+  - proxy
+  - proxy-anyauth
+  - proxy-digest
+Example:
+  - --proxy-basic --proxy-user user:passwd -x proxy $URL
+---
+
+# `--proxy-basic`
+
+Use HTTP Basic authentication when communicating with the given proxy. Use
+--basic for enabling HTTP Basic with a remote host. Basic is the default
+authentication method curl uses with proxies.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-ca-native.d b/third-party/curl/docs/cmdline-opts/proxy-ca-native.d
deleted file mode 100644
index aab4fcabc2..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-ca-native.d
+++ /dev/null
@@ -1,21 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-ca-native
-Help: Use CA certificates from the native OS for proxy
-Protocols: TLS
-Category: tls
-See-also: cacert capath insecure
-Example: --ca-native $URL
-Added: 8.2.0
-Multi: boolean
----
-Tells curl to use the CA store from the native operating system to verify the
-HTTPS proxy. By default, curl uses a CA store provided in a single file or
-directory, but when using this option it interfaces the operating system's own
-vault.
-
-This option only works for curl on Windows when built to use OpenSSL. When
-curl on Windows is built to use Schannel, this feature is implied and curl
-then only uses the native CA store.
-
-curl built with wolfSSL also supports this option (added in 8.3.0).
diff --git a/third-party/curl/docs/cmdline-opts/proxy-ca-native.md b/third-party/curl/docs/cmdline-opts/proxy-ca-native.md
new file mode 100644
index 0000000000..0252e993fc
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-ca-native.md
@@ -0,0 +1,30 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-ca-native
+Help: Load CA certs from the OS to verify proxy
+Protocols: TLS
+Category: tls
+Added: 8.2.0
+Multi: boolean
+See-also:
+  - ca-native
+  - cacert
+  - capath
+  - dump-ca-embed
+  - insecure
+Example:
+  - --proxy-ca-native $URL
+---
+
+# `--proxy-ca-native`
+
+Use the operating system's native CA store for certificate verification of the
+HTTPS proxy.
+
+This option is independent of other HTTPS proxy CA certificate locations set at
+run time or build time. Those locations are searched in addition to the native
+CA store.
+
+Equivalent to --ca-native but used in HTTPS proxy context. Refer to --ca-native
+for TLS backend limitations.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-cacert.d b/third-party/curl/docs/cmdline-opts/proxy-cacert.d
deleted file mode 100644
index 45dc3f301b..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-cacert.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-cacert
-Help: CA certificate to verify peer against for proxy
-Arg: <file>
-Added: 7.52.0
-See-also: proxy-capath cacert capath proxy
-Category: proxy tls
-Example: --proxy-cacert CA-file.txt -x https://proxy $URL
-Multi: single
----
-Same as --cacert but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-cacert.md b/third-party/curl/docs/cmdline-opts/proxy-cacert.md
new file mode 100644
index 0000000000..0b2405d1c9
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-cacert.md
@@ -0,0 +1,28 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-cacert
+Help: CA certificates to verify proxy against
+Arg: <file>
+Added: 7.52.0
+Category: proxy tls
+Multi: single
+See-also:
+  - proxy-capath
+  - cacert
+  - capath
+  - dump-ca-embed
+  - proxy
+Example:
+  - --proxy-cacert CA-file.txt -x https://proxy.example $URL
+---
+
+# `--proxy-cacert`
+
+Use the specified certificate file to verify the HTTPS proxy. The file may
+contain multiple CA certificates. The certificate(s) must be in PEM format.
+
+This allows you to use a different trust for the proxy compared to the remote
+server connected to via the proxy.
+
+Equivalent to --cacert but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-capath.d b/third-party/curl/docs/cmdline-opts/proxy-capath.d
deleted file mode 100644
index 309f9408a8..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-capath.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-capath
-Help: CA directory to verify peer against for proxy
-Arg: <dir>
-Added: 7.52.0
-See-also: proxy-cacert proxy capath
-Category: proxy tls
-Example: --proxy-capath /local/directory -x https://proxy $URL
-Multi: single
----
-Same as --capath but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-capath.md b/third-party/curl/docs/cmdline-opts/proxy-capath.md
new file mode 100644
index 0000000000..344756a43e
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-capath.md
@@ -0,0 +1,31 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-capath
+Help: CA directory to verify proxy against
+Arg: <dir>
+Added: 7.52.0
+Category: proxy tls
+Multi: single
+See-also:
+  - proxy-cacert
+  - proxy
+  - capath
+  - dump-ca-embed
+Example:
+  - --proxy-capath /local/directory -x https://proxy.example $URL
+---
+
+# `--proxy-capath`
+
+Same as --capath but used in HTTPS proxy context.
+
+Use the specified certificate directory to verify the proxy. Multiple paths
+can be provided by separating them with colon (`:`) (e.g. `path1:path2:path3`). The
+certificates must be in PEM format, and if curl is built against OpenSSL, the
+directory must have been processed using the c_rehash utility supplied with
+OpenSSL. Using --proxy-capath can allow OpenSSL-powered curl to make
+SSL-connections much more efficiently than using --proxy-cacert if the
+--proxy-cacert file contains many CA certificates.
+
+If this option is set, the default capath value is ignored.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-cert-type.d b/third-party/curl/docs/cmdline-opts/proxy-cert-type.d
deleted file mode 100644
index 4ab38f5a80..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-cert-type.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-cert-type
-Arg: <type>
-Added: 7.52.0
-Help: Client certificate type for HTTPS proxy
-Category: proxy tls
-Example: --proxy-cert-type PEM --proxy-cert file -x https://proxy $URL
-See-also: proxy-cert
-Multi: single
----
-Same as --cert-type but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-cert-type.md b/third-party/curl/docs/cmdline-opts/proxy-cert-type.md
new file mode 100644
index 0000000000..3dcd2017c4
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-cert-type.md
@@ -0,0 +1,26 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-cert-type
+Arg: <type>
+Added: 7.52.0
+Help: Client certificate type for HTTPS proxy
+Category: proxy tls
+Multi: single
+See-also:
+  - proxy-cert
+  - proxy-key
+Example:
+  - --proxy-cert-type PEM --proxy-cert file -x https://proxy.example $URL
+---
+
+# `--proxy-cert-type`
+
+Set type of the provided client certificate when using HTTPS proxy. PEM, DER,
+ENG, PROV and P12 are recognized types.
+
+The default type depends on the TLS backend and is usually PEM. For Schannel
+it is P12. If --proxy-cert is a pkcs11: URI then ENG or PROV is the default
+type (depending on OpenSSL version).
+
+Equivalent to --cert-type but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-cert.d b/third-party/curl/docs/cmdline-opts/proxy-cert.d
deleted file mode 100644
index 2a869deb02..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-cert.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-cert
-Arg: <cert[:passwd]>
-Help: Set client certificate for proxy
-Added: 7.52.0
-Category: proxy tls
-Example: --proxy-cert file -x https://proxy $URL
-See-also: proxy-cert-type
-Multi: single
----
-Same as --cert but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-cert.md b/third-party/curl/docs/cmdline-opts/proxy-cert.md
new file mode 100644
index 0000000000..929791e3a1
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-cert.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-cert
+Arg: <cert[:passwd]>
+Help: Set client certificate for proxy
+Added: 7.52.0
+Category: proxy tls
+Multi: single
+See-also:
+  - proxy
+  - proxy-key
+  - proxy-cert-type
+Example:
+  - --proxy-cert file -x https://proxy.example $URL
+---
+
+# `--proxy-cert`
+
+Use the specified client certificate file when communicating with an HTTPS
+proxy. The certificate must be PEM format. If the optional password is not
+specified, it is queried for on the terminal. Use --proxy-key to provide the
+private key.
+
+This option is the equivalent to --cert but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-ciphers.d b/third-party/curl/docs/cmdline-opts/proxy-ciphers.d
deleted file mode 100644
index 5879f397e1..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-ciphers.d
+++ /dev/null
@@ -1,18 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-ciphers
-Arg: <list>
-Help: SSL ciphers to use for proxy
-Added: 7.52.0
-Category: proxy tls
-Example: --proxy-ciphers ECDHE-ECDSA-AES256-CCM8 -x https://proxy $URL
-See-also: ciphers curves proxy
-Multi: single
----
-Same as --ciphers but used in HTTPS proxy context.
-
-Specifies which ciphers to use in the connection to the HTTPS proxy. The list
-of ciphers must specify valid ciphers. Read up on SSL cipher list details on
-this URL:
-
-https://curl.se/docs/ssl-ciphers.html
diff --git a/third-party/curl/docs/cmdline-opts/proxy-ciphers.md b/third-party/curl/docs/cmdline-opts/proxy-ciphers.md
new file mode 100644
index 0000000000..4cb85e1e67
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-ciphers.md
@@ -0,0 +1,27 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-ciphers
+Arg: <list>
+Help: TLS 1.2 (1.1, 1.0) ciphers to use for proxy
+Protocols: TLS
+Added: 7.52.0
+Category: proxy tls
+Multi: single
+See-also:
+  - proxy-tls13-ciphers
+  - ciphers
+  - proxy
+Example:
+  - --proxy-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256 -x https://proxy.example $URL
+---
+
+# `--proxy-ciphers`
+
+Same as --ciphers but used in HTTPS proxy context.
+
+Specify which cipher suites to use in the connection to your HTTPS proxy when
+it negotiates TLS 1.2 (1.1, 1.0). The list of ciphers suites must specify
+valid ciphers. Read up on cipher suite details on this URL:
+
+https://curl.se/docs/ssl-ciphers.html
diff --git a/third-party/curl/docs/cmdline-opts/proxy-crlfile.d b/third-party/curl/docs/cmdline-opts/proxy-crlfile.d
deleted file mode 100644
index 1a8fdf25da..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-crlfile.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-crlfile
-Arg: <file>
-Help: Set a CRL list for proxy
-Added: 7.52.0
-Category: proxy tls
-Example: --proxy-crlfile rejects.txt -x https://proxy $URL
-See-also: crlfile proxy
-Multi: single
----
-Same as --crlfile but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-crlfile.md b/third-party/curl/docs/cmdline-opts/proxy-crlfile.md
new file mode 100644
index 0000000000..9f7d3304fa
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-crlfile.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-crlfile
+Arg: <file>
+Help: Set a CRL list for proxy
+Added: 7.52.0
+Category: proxy tls
+Multi: single
+See-also:
+  - crlfile
+  - proxy
+Example:
+  - --proxy-crlfile rejects.txt -x https://proxy.example $URL
+---
+
+# `--proxy-crlfile`
+
+Provide filename for a PEM formatted file with a Certificate Revocation List
+that specifies peer certificates that are considered revoked when
+communicating with an HTTPS proxy.
+
+Equivalent to --crlfile but only used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-digest.d b/third-party/curl/docs/cmdline-opts/proxy-digest.d
deleted file mode 100644
index c5cb19c48b..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-digest.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-digest
-Help: Use Digest authentication on the proxy
-See-also: proxy proxy-anyauth proxy-basic
-Category: proxy tls
-Example: --proxy-digest --proxy-user user:passwd -x proxy $URL
-Added: 7.12.0
-Multi: mutex
----
-Tells curl to use HTTP Digest authentication when communicating with the given
-proxy. Use --digest for enabling HTTP Digest with a remote host.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-digest.md b/third-party/curl/docs/cmdline-opts/proxy-digest.md
new file mode 100644
index 0000000000..08984dcb5f
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-digest.md
@@ -0,0 +1,20 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-digest
+Help: Digest auth with the proxy
+Category: proxy tls
+Added: 7.12.0
+Multi: boolean
+See-also:
+  - proxy
+  - proxy-anyauth
+  - proxy-basic
+Example:
+  - --proxy-digest --proxy-user user:passwd -x proxy $URL
+---
+
+# `--proxy-digest`
+
+Use HTTP Digest authentication when communicating with the given proxy. Use
+--digest for enabling HTTP Digest with a remote host.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-header.d b/third-party/curl/docs/cmdline-opts/proxy-header.d
deleted file mode 100644
index 06ae3bcbaa..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-header.d
+++ /dev/null
@@ -1,32 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-header
-Arg: <header/@file>
-Help: Pass custom header(s) to proxy
-Protocols: HTTP
-Added: 7.37.0
-Category: proxy
-Example: --proxy-header "X-First-Name: Joe" -x http://proxy $URL
-Example: --proxy-header "User-Agent: surprise" -x http://proxy $URL
-Example: --proxy-header "Host:" -x http://proxy $URL
-See-also: proxy
-Multi: append
----
-Extra header to include in the request when sending HTTP to a proxy. You may
-specify any number of extra headers. This is the equivalent option to --header
-but is for proxy communication only like in CONNECT requests when you want a
-separate header sent to the proxy to what is sent to the actual remote host.
-
-curl makes sure that each header you add/replace is sent with the proper
-end-of-line marker, you should thus **not** add that as a part of the header
-content: do not add newlines or carriage returns, they only mess things up for
-you.
-
-Headers specified with this option are not included in requests that curl
-knows are not be sent to a proxy.
-
-This option can take an argument in @filename style, which then adds a header
-for each line in the input file (added in 7.55.0). Using @- makes curl read
-the headers from stdin.
-
-This option can be used multiple times to add/replace/remove multiple headers.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-header.md b/third-party/curl/docs/cmdline-opts/proxy-header.md
new file mode 100644
index 0000000000..459eb462f6
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-header.md
@@ -0,0 +1,39 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-header
+Arg: <header/@file>
+Help: Pass custom header(s) to proxy
+Protocols: HTTP
+Added: 7.37.0
+Category: proxy
+Multi: append
+See-also:
+  - proxy
+  - header
+Example:
+  - --proxy-header "X-First-Name: Joe" -x http://proxy $URL
+  - --proxy-header "User-Agent: surprise" -x http://proxy $URL
+  - --proxy-header "Host:" -x http://proxy $URL
+---
+
+# `--proxy-header`
+
+Extra header to include in the request when sending HTTP to a proxy. You may
+specify any number of extra headers. This is the equivalent option to --header
+but is for proxy communication only like in CONNECT requests when you want a
+separate header sent to the proxy to what is sent to the actual remote host.
+
+curl makes sure that each header you add/replace is sent with the proper
+end-of-line marker, you should thus **not** add that as a part of the header
+content: do not add newlines or carriage returns, they only mess things up for
+you.
+
+Headers specified with this option are not included in requests that curl
+knows are not to be sent to a proxy.
+
+This option can take an argument in @filename style, which then adds a header
+for each line in the input file (added in 7.55.0). Using @- makes curl read
+the headers from stdin.
+
+This option can be used multiple times to add/replace/remove multiple headers.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-http2.d b/third-party/curl/docs/cmdline-opts/proxy-http2.d
deleted file mode 100644
index 58f55e74dd..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-http2.d
+++ /dev/null
@@ -1,18 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-http2
-Tags: Versions HTTP/2
-Protocols: HTTP
-Added: 8.1.0
-Mutexed:
-Requires: HTTP/2
-See-also: proxy
-Help: Use HTTP/2 with HTTPS proxy
-Category: http proxy
-Example: --proxy-http2 -x proxy $URL
-Multi: boolean
----
-Tells curl to try negotiate HTTP version 2 with an HTTPS proxy. The proxy might
-still only offer HTTP/1 and then curl sticks to using that version.
-
-This has no effect for any other kinds of proxies.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-http2.md b/third-party/curl/docs/cmdline-opts/proxy-http2.md
new file mode 100644
index 0000000000..a38da9e87e
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-http2.md
@@ -0,0 +1,26 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-http2
+Tags: Versions HTTP/2
+Protocols: HTTP
+Added: 8.1.0
+Mutexed: proxy-http3
+Requires: HTTP/2
+Help: Use HTTP/2 with HTTPS proxy
+Category: http proxy
+Multi: boolean
+See-also:
+  - proxy
+Example:
+  - --proxy-http2 -x proxy $URL
+---
+
+# `--proxy-http2`
+
+Negotiate HTTP/2 with an HTTPS proxy. The proxy might still only offer HTTP/1
+and then curl sticks to using that version.
+
+This has no effect for any other kinds of proxies.
+
+This option is mutually exclusive with `--proxy-http3`.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-http3.md b/third-party/curl/docs/cmdline-opts/proxy-http3.md
new file mode 100644
index 0000000000..6533b980b6
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-http3.md
@@ -0,0 +1,31 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-http3
+Tags: Versions HTTP/3
+Protocols: HTTP
+Added: 8.21.0
+Mutexed: proxy-http2
+Requires: HTTP/3
+Help: Use HTTP/3 with HTTPS proxy
+Category: http proxy
+Multi: boolean
+See-also:
+  - proxy
+  - proxy-http2
+Example:
+  - --proxy-http3 -x proxy $URL
+---
+
+# `--proxy-http3`
+
+Negotiate HTTP/3 with an HTTPS proxy.
+Fails to perform the transfer if the given proxy does not support HTTP/3.
+
+This has no effect for any other kinds of proxies.
+
+This option is mutually exclusive with `--proxy-http2`.
+
+This feature is experimental and requires a build with HTTP/3 proxy support
+enabled. For autotools builds, use `--enable-proxy-http3`. For CMake builds,
+use `-DUSE_PROXY_HTTP3=ON`.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-insecure.d b/third-party/curl/docs/cmdline-opts/proxy-insecure.d
deleted file mode 100644
index beb8c25317..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-insecure.d
+++ /dev/null
@@ -1,11 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-insecure
-Help: Do HTTPS proxy connections without verifying the proxy
-Added: 7.52.0
-Category: proxy tls
-Example: --proxy-insecure -x https://proxy $URL
-See-also: proxy insecure
-Multi: boolean
----
-Same as --insecure but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-insecure.md b/third-party/curl/docs/cmdline-opts/proxy-insecure.md
new file mode 100644
index 0000000000..0c2d8b99bc
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-insecure.md
@@ -0,0 +1,30 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-insecure
+Help: Skip HTTPS proxy cert verification
+Added: 7.52.0
+Category: proxy tls
+Multi: boolean
+See-also:
+  - proxy
+  - insecure
+Example:
+  - --proxy-insecure -x https://proxy.example $URL
+---
+
+# `--proxy-insecure`
+
+Same as --insecure but used in HTTPS proxy context.
+
+Every secure connection curl makes is verified to be secure before the
+transfer takes place. This option makes curl skip the verification step with a
+proxy and proceed without checking.
+
+When this option is not used for a proxy using HTTPS, curl verifies the
+proxy's TLS certificate before it continues: that the certificate contains the
+right name which matches the hostname and that the certificate has been signed
+by a CA certificate present in the cert store. See this online resource for
+further details: **https://curl.se/docs/sslcerts.html**
+
+**WARNING**: using this option makes the transfer to the proxy insecure.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-key-type.d b/third-party/curl/docs/cmdline-opts/proxy-key-type.d
deleted file mode 100644
index 3fd11f3a32..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-key-type.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-key-type
-Arg: <type>
-Help: Private key file type for proxy
-Added: 7.52.0
-Category: proxy tls
-Example: --proxy-key-type DER --proxy-key here -x https://proxy $URL
-See-also: proxy-key proxy
-Multi: single
----
-Same as --key-type but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-key-type.md b/third-party/curl/docs/cmdline-opts/proxy-key-type.md
new file mode 100644
index 0000000000..e455140016
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-key-type.md
@@ -0,0 +1,22 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-key-type
+Arg: <type>
+Help: Private key file type for proxy
+Added: 7.52.0
+Category: proxy tls
+Multi: single
+See-also:
+  - proxy-key
+  - proxy
+Example:
+  - --proxy-key-type DER --proxy-key here -x https://proxy.example $URL
+---
+
+# `--proxy-key-type`
+
+Specify the private key file type your --proxy-key provided private key uses.
+DER, PEM, and ENG are supported. If not specified, PEM is assumed.
+
+Equivalent to --key-type but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-key.d b/third-party/curl/docs/cmdline-opts/proxy-key.d
deleted file mode 100644
index 4bf2748a4e..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-key.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-key
-Help: Private key for HTTPS proxy
-Arg: <key>
-Category: proxy tls
-Example: --proxy-key here -x https://proxy $URL
-Added: 7.52.0
-See-also: proxy-key-type proxy
-Multi: single
----
-Same as --key but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-key.md b/third-party/curl/docs/cmdline-opts/proxy-key.md
new file mode 100644
index 0000000000..8ee78c46ea
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-key.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-key
+Help: Private key for HTTPS proxy
+Arg: <key>
+Category: proxy tls
+Added: 7.52.0
+Multi: single
+See-also:
+  - proxy-key-type
+  - proxy
+Example:
+  - --proxy-key here -x https://proxy.example $URL
+---
+
+# `--proxy-key`
+
+Specify the filename for your private key when using client certificates with
+your HTTPS proxy. This option is the equivalent to --key but used in HTTPS
+proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-negotiate.d b/third-party/curl/docs/cmdline-opts/proxy-negotiate.d
deleted file mode 100644
index 89b5c1bde3..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-negotiate.d
+++ /dev/null
@@ -1,13 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-negotiate
-Help: Use HTTP Negotiate (SPNEGO) authentication on the proxy
-Added: 7.17.1
-See-also: proxy-anyauth proxy-basic
-Category: proxy auth
-Example: --proxy-negotiate --proxy-user user:passwd -x proxy $URL
-Multi: mutex
----
-Tells curl to use HTTP Negotiate (SPNEGO) authentication when communicating
-with the given proxy. Use --negotiate for enabling HTTP Negotiate (SPNEGO)
-with a remote host.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-negotiate.md b/third-party/curl/docs/cmdline-opts/proxy-negotiate.md
new file mode 100644
index 0000000000..0285155c6a
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-negotiate.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-negotiate
+Help: HTTP Negotiate (SPNEGO) auth with the proxy
+Added: 7.17.1
+Category: proxy auth
+Multi: mutex
+See-also:
+  - proxy-anyauth
+  - proxy-basic
+  - proxy-service-name
+Example:
+  - --proxy-negotiate --proxy-user user:passwd -x proxy $URL
+---
+
+# `--proxy-negotiate`
+
+Use HTTP Negotiate (SPNEGO) authentication when communicating with the given
+proxy. Use --negotiate for enabling HTTP Negotiate (SPNEGO) with a remote
+host.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-ntlm.d b/third-party/curl/docs/cmdline-opts/proxy-ntlm.d
deleted file mode 100644
index f8481e5d6d..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-ntlm.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-ntlm
-Help: Use NTLM authentication on the proxy
-See-also: proxy-negotiate proxy-anyauth
-Category: proxy auth
-Example: --proxy-ntlm --proxy-user user:passwd -x http://proxy $URL
-Added: 7.10.7
-Multi: mutex
----
-Tells curl to use HTTP NTLM authentication when communicating with the given
-proxy. Use --ntlm for enabling NTLM with a remote host.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-ntlm.md b/third-party/curl/docs/cmdline-opts/proxy-ntlm.md
new file mode 100644
index 0000000000..a0b6a252d4
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-ntlm.md
@@ -0,0 +1,20 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-ntlm
+Help: NTLM authentication with the proxy
+Category: proxy auth
+Added: 7.10.7
+Multi: boolean
+See-also:
+  - proxy-negotiate
+  - proxy-anyauth
+  - proxy-user
+Example:
+  - --proxy-ntlm --proxy-user user:passwd -x http://proxy $URL
+---
+
+# `--proxy-ntlm`
+
+Use HTTP NTLM authentication when communicating with the given proxy. Use
+--ntlm for enabling NTLM with a remote host.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-pass.d b/third-party/curl/docs/cmdline-opts/proxy-pass.d
deleted file mode 100644
index 3071399519..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-pass.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-pass
-Arg: <phrase>
-Help: Pass phrase for the private key for HTTPS proxy
-Added: 7.52.0
-Category: proxy tls auth
-Example: --proxy-pass secret --proxy-key here -x https://proxy $URL
-See-also: proxy proxy-key
-Multi: single
----
-Same as --pass but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-pass.md b/third-party/curl/docs/cmdline-opts/proxy-pass.md
new file mode 100644
index 0000000000..1005d95d2f
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-pass.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-pass
+Arg: <phrase>
+Help: Passphrase for private key for HTTPS proxy
+Added: 7.52.0
+Category: proxy tls auth
+Multi: single
+See-also:
+  - proxy
+  - proxy-key
+Example:
+  - --proxy-pass secret --proxy-key here -x https://proxy.example $URL
+---
+
+# `--proxy-pass`
+
+Passphrase for the private key for HTTPS proxy client certificate.
+
+Equivalent to --pass but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-pinnedpubkey.d b/third-party/curl/docs/cmdline-opts/proxy-pinnedpubkey.d
deleted file mode 100644
index 7bf99d8c5b..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-pinnedpubkey.d
+++ /dev/null
@@ -1,22 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-pinnedpubkey
-Arg: <hashes>
-Help: FILE/HASHES public key to verify proxy with
-Protocols: TLS
-Category: proxy tls
-Example: --proxy-pinnedpubkey keyfile $URL
-Example: --proxy-pinnedpubkey 'sha256//ce118b51897f4452dc' $URL
-Added: 7.59.0
-See-also: pinnedpubkey proxy
-Multi: single
----
-Tells curl to use the specified public key file (or hashes) to verify the
-proxy. This can be a path to a file which contains a single public key in PEM
-or DER format, or any number of base64 encoded sha256 hashes preceded by
-'sha256//' and separated by ';'.
-
-When negotiating a TLS or SSL connection, the server sends a certificate
-indicating its identity. A public key is extracted from this certificate and
-if it does not exactly match the public key provided to this option, curl
-aborts the connection before sending or receiving any data.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-pinnedpubkey.md b/third-party/curl/docs/cmdline-opts/proxy-pinnedpubkey.md
new file mode 100644
index 0000000000..df0b0bb907
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-pinnedpubkey.md
@@ -0,0 +1,31 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-pinnedpubkey
+Arg: <hashes>
+Help: FILE/HASHES public key to verify proxy with
+Protocols: TLS
+Category: proxy tls
+Added: 7.59.0
+Multi: single
+See-also:
+  - pinnedpubkey
+  - proxy
+Example:
+  - --proxy-pinnedpubkey keyfile $URL
+  - --proxy-pinnedpubkey 'sha256//ce118b51897f4452dc' $URL
+---
+
+# `--proxy-pinnedpubkey`
+
+Use the specified public key file (or hashes) to verify the proxy. This can be
+a path to a file which contains a single public key in PEM or DER format, or
+any number of base64 encoded sha256 hashes preceded by 'sha256//' and
+separated by ';'.
+
+When negotiating a TLS or SSL connection, the server sends a certificate
+indicating its identity. A public key is extracted from this certificate and
+if it does not exactly match the public key provided to this option, curl
+aborts the connection before sending or receiving any data.
+
+Before curl 8.10.0 this option did not work due to a bug.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-service-name.d b/third-party/curl/docs/cmdline-opts/proxy-service-name.d
deleted file mode 100644
index 200973fb52..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-service-name.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-service-name
-Arg: <name>
-Help: SPNEGO proxy service name
-Added: 7.43.0
-Category: proxy tls
-Example: --proxy-service-name "shrubbery" -x proxy $URL
-See-also: service-name proxy
-Multi: single
----
-This option allows you to change the service name for proxy negotiation.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-service-name.md b/third-party/curl/docs/cmdline-opts/proxy-service-name.md
new file mode 100644
index 0000000000..b3d665d8b4
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-service-name.md
@@ -0,0 +1,20 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-service-name
+Arg: <name>
+Help: SPNEGO proxy service name
+Added: 7.43.0
+Category: proxy tls
+Multi: single
+See-also:
+  - service-name
+  - proxy
+  - proxy-negotiate
+Example:
+  - --proxy-service-name "shrubbery" -x proxy $URL
+---
+
+# `--proxy-service-name`
+
+Set the service name for SPNEGO when doing proxy authentication.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-ssl-allow-beast.d b/third-party/curl/docs/cmdline-opts/proxy-ssl-allow-beast.d
deleted file mode 100644
index 55ff62b46e..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-ssl-allow-beast.d
+++ /dev/null
@@ -1,11 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-ssl-allow-beast
-Help: Allow security flaw for interop for HTTPS proxy
-Added: 7.52.0
-Category: proxy tls
-Example: --proxy-ssl-allow-beast -x https://proxy $URL
-See-also: ssl-allow-beast proxy
-Multi: boolean
----
-Same as --ssl-allow-beast but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-ssl-allow-beast.md b/third-party/curl/docs/cmdline-opts/proxy-ssl-allow-beast.md
new file mode 100644
index 0000000000..909a7f026e
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-ssl-allow-beast.md
@@ -0,0 +1,29 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-ssl-allow-beast
+Help: Allow this security flaw for HTTPS proxy
+Added: 7.52.0
+Category: proxy tls
+Multi: boolean
+See-also:
+  - ssl-allow-beast
+  - proxy
+Example:
+  - --proxy-ssl-allow-beast -x https://proxy.example $URL
+---
+
+# `--proxy-ssl-allow-beast`
+
+Do not work around a security flaw in the TLS1.0 protocol known as BEAST when
+communicating to an HTTPS proxy. If this option is not used, the TLS layer may
+use workarounds known to cause interoperability problems with some older
+server implementations.
+
+This option only changes how curl does TLS 1.0 with an HTTPS proxy and has no
+effect on later TLS versions.
+
+**WARNING**: this option loosens the TLS security, and by using this flag you
+ask for exactly that.
+
+Equivalent to --ssl-allow-beast but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-ssl-auto-client-cert.d b/third-party/curl/docs/cmdline-opts/proxy-ssl-auto-client-cert.d
deleted file mode 100644
index ea0f0c04dd..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-ssl-auto-client-cert.d
+++ /dev/null
@@ -1,11 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-ssl-auto-client-cert
-Help: Use auto client certificate for proxy (Schannel)
-Added: 7.77.0
-Category: proxy tls
-Example: --proxy-ssl-auto-client-cert -x https://proxy $URL
-See-also: ssl-auto-client-cert proxy
-Multi: boolean
----
-Same as --ssl-auto-client-cert but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-ssl-auto-client-cert.md b/third-party/curl/docs/cmdline-opts/proxy-ssl-auto-client-cert.md
new file mode 100644
index 0000000000..e041b81523
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-ssl-auto-client-cert.md
@@ -0,0 +1,20 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-ssl-auto-client-cert
+Help: Auto client certificate for proxy
+Added: 7.77.0
+Category: proxy tls
+Multi: boolean
+See-also:
+  - ssl-auto-client-cert
+  - proxy
+Example:
+  - --proxy-ssl-auto-client-cert -x https://proxy.example $URL
+---
+
+# `--proxy-ssl-auto-client-cert`
+
+Same as --ssl-auto-client-cert but used in HTTPS proxy context.
+
+This is only supported by Schannel.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-tls13-ciphers.d b/third-party/curl/docs/cmdline-opts/proxy-tls13-ciphers.d
deleted file mode 100644
index f18c3d5c0c..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-tls13-ciphers.d
+++ /dev/null
@@ -1,21 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-tls13-ciphers
-Arg: <ciphersuite list>
-help: TLS 1.3 proxy cipher suites
-Protocols: TLS
-Category: proxy tls
-Example: --proxy-tls13-ciphers TLS_AES_128_GCM_SHA256 -x proxy $URL
-Added: 7.61.0
-See-also: tls13-ciphers curves proxy-ciphers
-Multi: single
----
-Specifies which cipher suites to use in the connection to your HTTPS proxy
-when it negotiates TLS 1.3. The list of ciphers suites must specify valid
-ciphers. Read up on TLS 1.3 cipher suite details on this URL:
-
-https://curl.se/docs/ssl-ciphers.html
-
-This option is currently used only when curl is built to use OpenSSL 1.1.1 or
-later. If you are using a different SSL backend you can try setting TLS 1.3
-cipher suites by using the --proxy-ciphers option.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-tls13-ciphers.md b/third-party/curl/docs/cmdline-opts/proxy-tls13-ciphers.md
new file mode 100644
index 0000000000..6fcf6d79dc
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-tls13-ciphers.md
@@ -0,0 +1,33 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-tls13-ciphers
+Arg: <list>
+Help: TLS 1.3 proxy cipher suites
+Protocols: TLS
+Category: proxy tls
+Added: 7.61.0
+Multi: single
+See-also:
+  - proxy-ciphers
+  - tls13-ciphers
+  - proxy
+Example:
+  - --proxy-tls13-ciphers TLS_AES_128_GCM_SHA256 -x proxy $URL
+---
+
+# `--proxy-tls13-ciphers`
+
+Same as --tls13-ciphers but used in HTTPS proxy context.
+
+Specify which cipher suites to use in the connection to your HTTPS proxy when
+it negotiates TLS 1.3. The list of ciphers suites must specify valid ciphers.
+Read up on TLS 1.3 cipher suite details on this URL:
+
+https://curl.se/docs/ssl-ciphers.html
+
+This option is used when curl is built to use OpenSSL 1.1.1 or later,
+Schannel, wolfSSL, or mbedTLS 3.6.0 or later.
+
+Before curl 8.10.0 with mbedTLS or wolfSSL, TLS 1.3 cipher suites were set
+by using the --proxy-ciphers option.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-tlsauthtype.d b/third-party/curl/docs/cmdline-opts/proxy-tlsauthtype.d
deleted file mode 100644
index f83153e7ba..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-tlsauthtype.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-tlsauthtype
-Arg: <type>
-Help: TLS authentication type for HTTPS proxy
-Added: 7.52.0
-Category: proxy tls auth
-Example: --proxy-tlsauthtype SRP -x https://proxy $URL
-See-also: proxy proxy-tlsuser
-Multi: single
----
-Same as --tlsauthtype but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-tlsauthtype.md b/third-party/curl/docs/cmdline-opts/proxy-tlsauthtype.md
new file mode 100644
index 0000000000..84becc149e
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-tlsauthtype.md
@@ -0,0 +1,24 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-tlsauthtype
+Arg: <type>
+Help: TLS authentication type for HTTPS proxy
+Added: 7.52.0
+Category: proxy tls auth
+Multi: single
+See-also:
+  - proxy
+  - proxy-tlsuser
+  - proxy-tlspassword
+Example:
+  - --proxy-tlsauthtype SRP -x https://proxy.example $URL
+---
+
+# `--proxy-tlsauthtype`
+
+Set TLS authentication type with HTTPS proxy. The only supported option is
+`SRP`, for TLS-SRP (RFC 5054). This option works only if the underlying
+libcurl is built with TLS-SRP support.
+
+Equivalent to --tlsauthtype but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-tlspassword.d b/third-party/curl/docs/cmdline-opts/proxy-tlspassword.d
deleted file mode 100644
index 7ec01401be..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-tlspassword.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-tlspassword
-Arg: <string>
-Help: TLS password for HTTPS proxy
-Added: 7.52.0
-Category: proxy tls auth
-Example: --proxy-tlspassword passwd -x https://proxy $URL
-See-also: proxy proxy-tlsuser
-Multi: single
----
-Same as --tlspassword but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-tlspassword.md b/third-party/curl/docs/cmdline-opts/proxy-tlspassword.md
new file mode 100644
index 0000000000..63c2521566
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-tlspassword.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-tlspassword
+Arg: <string>
+Help: TLS password for HTTPS proxy
+Added: 7.52.0
+Category: proxy tls auth
+Multi: single
+See-also:
+  - proxy
+  - proxy-tlsuser
+Example:
+  - --proxy-tlspassword passwd -x https://proxy.example $URL
+---
+
+# `--proxy-tlspassword`
+
+Set password to use with the TLS authentication method specified with
+--proxy-tlsauthtype when using HTTPS proxy. Requires that --proxy-tlsuser is
+set.
+
+This option does not work with TLS 1.3.
+
+Equivalent to --tlspassword but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-tlsuser.d b/third-party/curl/docs/cmdline-opts/proxy-tlsuser.d
deleted file mode 100644
index 17be7f7bae..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-tlsuser.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-tlsuser
-Arg: <name>
-Help: TLS username for HTTPS proxy
-Added: 7.52.0
-Category: proxy tls auth
-Example: --proxy-tlsuser smith -x https://proxy $URL
-See-also: proxy proxy-tlspassword
-Multi: single
----
-Same as --tlsuser but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-tlsuser.md b/third-party/curl/docs/cmdline-opts/proxy-tlsuser.md
new file mode 100644
index 0000000000..610a2169b8
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-tlsuser.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-tlsuser
+Arg: <name>
+Help: TLS username for HTTPS proxy
+Added: 7.52.0
+Category: proxy tls auth
+Multi: single
+See-also:
+  - proxy
+  - proxy-tlspassword
+Example:
+  - --proxy-tlsuser smith -x https://proxy.example $URL
+---
+
+# `--proxy-tlsuser`
+
+Set username for use for HTTPS proxy with the TLS authentication method
+specified with --proxy-tlsauthtype. Requires that --proxy-tlspassword also is
+set.
+
+This option does not work with TLS 1.3.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-tlsv1.d b/third-party/curl/docs/cmdline-opts/proxy-tlsv1.d
deleted file mode 100644
index c4345023ef..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-tlsv1.d
+++ /dev/null
@@ -1,11 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-tlsv1
-Help: Use TLSv1 for HTTPS proxy
-Added: 7.52.0
-Category: proxy tls auth
-Example: --proxy-tlsv1 -x https://proxy $URL
-See-also: proxy
-Multi: mutex
----
-Same as --tlsv1 but used in HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-tlsv1.md b/third-party/curl/docs/cmdline-opts/proxy-tlsv1.md
new file mode 100644
index 0000000000..20643fd82b
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-tlsv1.md
@@ -0,0 +1,20 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-tlsv1
+Help: TLSv1 for HTTPS proxy
+Added: 7.52.0
+Category: proxy tls auth
+Multi: mutex
+See-also:
+  - proxy
+Example:
+  - --proxy-tlsv1 -x https://proxy.example $URL
+---
+
+# `--proxy-tlsv1`
+
+Use at least TLS version 1.x when negotiating with an HTTPS proxy. That means
+TLS version 1.0 or higher
+
+Equivalent to --tlsv1 but for an HTTPS proxy context.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-user.d b/third-party/curl/docs/cmdline-opts/proxy-user.d
deleted file mode 100644
index df30de2d92..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy-user.d
+++ /dev/null
@@ -1,23 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy-user
-Short: U
-Arg: <user:password>
-Help: Proxy user and password
-Category: proxy auth
-Example: --proxy-user name:pwd -x proxy $URL
-Added: 4.0
-See-also: proxy-pass
-Multi: single
----
-Specify the user name and password to use for proxy authentication.
-
-If you use a Windows SSPI-enabled curl binary and do either Negotiate or NTLM
-authentication then you can tell curl to select the user name and password
-from your environment by specifying a single colon with this option: "-U :".
-
-On systems where it works, curl hides the given option argument from process
-listings. This is not enough to protect credentials from possibly getting seen
-by other users on the same system as they still are visible for a moment
-before cleared. Such sensitive data should be retrieved from a file instead or
-similar and never used in clear text in a command line.
diff --git a/third-party/curl/docs/cmdline-opts/proxy-user.md b/third-party/curl/docs/cmdline-opts/proxy-user.md
new file mode 100644
index 0000000000..e2508eda05
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy-user.md
@@ -0,0 +1,29 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-user
+Short: U
+Arg: <user:password>
+Help: Proxy user and password
+Category: proxy auth
+Added: 4.0
+Multi: single
+See-also:
+  - proxy-pass
+Example:
+  - --proxy-user smith:secret -x proxy $URL
+---
+
+# `--proxy-user`
+
+Specify the username and password to use for proxy authentication.
+
+If you use a Windows SSPI-enabled curl binary and do either Negotiate or NTLM
+authentication then you can tell curl to select the username and password from
+your environment by specifying a single colon with this option: "-U :".
+
+On systems where it works, curl hides the given option argument from process
+listings. This is not enough to protect credentials from possibly getting seen
+by other users on the same system as they still are visible for a moment
+before being cleared. Such sensitive data should be retrieved from a file instead or
+similar and never used in clear text in a command line.
diff --git a/third-party/curl/docs/cmdline-opts/proxy.d b/third-party/curl/docs/cmdline-opts/proxy.d
deleted file mode 100644
index b7d550a110..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy.d
+++ /dev/null
@@ -1,51 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy
-Short: x
-Arg: [protocol://]host[:port]
-Help: Use this proxy
-Category: proxy
-Example: --proxy http://proxy.example $URL
-Added: 4.0
-See-also: socks5 proxy-basic
-Multi: single
----
-Use the specified proxy.
-
-The proxy string can be specified with a protocol:// prefix. No protocol
-specified or http:// it is treated as an HTTP proxy. Use socks4://,
-socks4a://, socks5:// or socks5h:// to request a specific SOCKS version to be
-used.  (Added in 7.21.7)
-
-Unix domain sockets are supported for socks proxy. Set localhost for the host
-part. e.g. socks5h://localhost/path/to/socket.sock
-
-HTTPS proxy support works set with the https:// protocol prefix for OpenSSL
-and GnuTLS (added in 7.52.0). It also works for BearSSL, mbedTLS, rustls,
-Schannel, Secure Transport and wolfSSL (added in 7.87.0).
-
-Unrecognized and unsupported proxy protocols cause an error (added in 7.52.0).
-Ancient curl versions ignored unknown schemes and used http:// instead.
-
-If the port number is not specified in the proxy string, it is assumed to be
-1080.
-
-This option overrides existing environment variables that set the proxy to
-use. If there is an environment variable setting a proxy, you can set proxy to
-"" to override it.
-
-All operations that are performed over an HTTP proxy are transparently
-converted to HTTP. It means that certain protocol specific operations might
-not be available. This is not the case if you can tunnel through the proxy, as
-one with the --proxytunnel option.
-
-User and password that might be provided in the proxy string are URL decoded
-by curl. This allows you to pass in special characters such as @ by using %40
-or pass in a colon with %3a.
-
-The proxy host can be specified the same way as the proxy environment
-variables, including the protocol prefix (http://) and the embedded user +
-password.
-
-When a proxy is used, the active FTP mode as set with --ftp-port, cannot be
-used.
diff --git a/third-party/curl/docs/cmdline-opts/proxy.md b/third-party/curl/docs/cmdline-opts/proxy.md
new file mode 100644
index 0000000000..881f62d6a1
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy.md
@@ -0,0 +1,61 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy
+Short: x
+Arg: <[protocol://]host[:port]>
+Help: Use this proxy
+Category: proxy
+Added: 4.0
+Multi: single
+See-also:
+  - socks5
+  - proxy-basic
+Example:
+  - --proxy http://proxy.example $URL
+---
+
+# `--proxy`
+
+Use the specified proxy.
+
+The proxy string can be specified with a `protocol://` prefix. No protocol
+specified or http:// it is treated as an HTTP proxy. Use `socks4://`,
+`socks4a://`, `socks5://` or `socks5h://` to request a specific SOCKS version
+to be used. (Added in 7.21.7)
+
+Unix domain sockets are supported for socks proxy. Set localhost for the host
+part. e.g. socks5h://localhost/path/to/socket.sock
+
+HTTPS proxy support works with the `https://` protocol prefix for OpenSSL and
+GnuTLS (added in 7.52.0). It also works for mbedTLS, Rustls, Schannel and
+wolfSSL (added in 7.87.0).
+
+Unrecognized and unsupported proxy protocol schemes cause an error.
+
+If the port number is not specified in the proxy string, it is assumed to be
+1080.
+
+This option overrides existing environment variables that set the proxy to
+use. If there is an environment variable setting a proxy, you can set proxy to
+"" to override it.
+
+All operations that are performed over an HTTP proxy are transparently
+converted to HTTP. It means that certain protocol specific operations might
+not be available. This is not the case if you can tunnel through the proxy, as
+one with the --proxytunnel option.
+
+User and password that might be provided in the proxy string are URL decoded
+by curl. This allows you to pass in special characters such as @ by using %40
+or pass in a colon with %3a.
+
+The proxy host can be specified the same way as the proxy environment
+variables, including the protocol prefix (`http://`) and the embedded user +
+password.
+
+When a proxy is used, the active FTP mode as set with --ftp-port, cannot be
+used.
+
+Doing FTP over an HTTP proxy without --proxytunnel makes curl do HTTP with an
+FTP URL over the proxy. For such transfers, common FTP specific options do not
+work, including --ssl-reqd and --ftp-ssl-control.
diff --git a/third-party/curl/docs/cmdline-opts/proxy1.0.d b/third-party/curl/docs/cmdline-opts/proxy1.0.d
deleted file mode 100644
index 0657a9519d..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxy1.0.d
+++ /dev/null
@@ -1,17 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxy1.0
-Arg: <host[:port]>
-Help: Use HTTP/1.0 proxy on given port
-Category: proxy
-Example: --proxy1.0 -x http://proxy $URL
-Added: 7.19.4
-See-also: proxy socks5 preproxy
-Multi: mutex
----
-Use the specified HTTP 1.0 proxy. If the port number is not specified, it is
-assumed at port 1080.
-
-The only difference between this and the HTTP proxy option --proxy, is that
-attempts to use CONNECT through the proxy specifies an HTTP 1.0 protocol
-instead of the default HTTP 1.1.
diff --git a/third-party/curl/docs/cmdline-opts/proxy1.0.md b/third-party/curl/docs/cmdline-opts/proxy1.0.md
new file mode 100644
index 0000000000..4d3203a032
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxy1.0.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy1.0
+Arg: <host[:port]>
+Help: Use HTTP/1.0 proxy on given port
+Category: proxy
+Added: 7.19.4
+Multi: mutex
+See-also:
+  - proxy
+  - socks5
+  - preproxy
+Example:
+  - --proxy1.0 http://proxy $URL
+---
+
+# `--proxy1.0`
+
+Use the specified HTTP 1.0 proxy. If the port number is not specified, it is
+assumed at port 1080.
+
+The only difference between this and the HTTP proxy option --proxy, is that
+attempts to use CONNECT through the proxy specifies an HTTP 1.0 protocol
+instead of the default HTTP 1.1.
diff --git a/third-party/curl/docs/cmdline-opts/proxytunnel.d b/third-party/curl/docs/cmdline-opts/proxytunnel.d
deleted file mode 100644
index 51457870b2..0000000000
--- a/third-party/curl/docs/cmdline-opts/proxytunnel.d
+++ /dev/null
@@ -1,18 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: proxytunnel
-Short: p
-Help: Operate through an HTTP proxy tunnel (using CONNECT)
-See-also: proxy
-Category: proxy
-Example: --proxytunnel -x http://proxy $URL
-Added: 7.3
-Multi: boolean
----
-When an HTTP proxy is used --proxy, this option makes curl tunnel the traffic
-through the proxy. The tunnel approach is made with the HTTP proxy CONNECT
-request and requires that the proxy allows direct connect to the remote port
-number curl wants to tunnel through to.
-
-To suppress proxy CONNECT response headers when curl is set to output headers
-use --suppress-connect-headers.
diff --git a/third-party/curl/docs/cmdline-opts/proxytunnel.md b/third-party/curl/docs/cmdline-opts/proxytunnel.md
new file mode 100644
index 0000000000..fcec87480d
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/proxytunnel.md
@@ -0,0 +1,24 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxytunnel
+Short: p
+Help: HTTP proxy tunnel (using CONNECT)
+Category: proxy
+Added: 7.3
+Multi: boolean
+See-also:
+  - proxy
+Example:
+  - --proxytunnel -x http://proxy $URL
+---
+
+# `--proxytunnel`
+
+When an HTTP proxy is used --proxy, this option makes curl tunnel the traffic
+through the proxy. The tunnel approach is made with the HTTP proxy CONNECT
+request and requires that the proxy allows direct connection to the remote port
+number curl wants to tunnel through to.
+
+To suppress proxy CONNECT response headers when curl is set to output headers
+use --suppress-connect-headers.
diff --git a/third-party/curl/docs/cmdline-opts/pubkey.d b/third-party/curl/docs/cmdline-opts/pubkey.d
deleted file mode 100644
index b2f4b727b6..0000000000
--- a/third-party/curl/docs/cmdline-opts/pubkey.d
+++ /dev/null
@@ -1,19 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: pubkey
-Arg: <key>
-Protocols: SFTP SCP
-Help: SSH Public key file name
-Category: sftp scp auth
-Example: --pubkey file.pub sftp://example.com/
-Added: 7.16.2
-See-also: pass
-Multi: single
----
-Public key file name. Allows you to provide your public key in this separate
-file.
-
-curl attempts to automatically extract the public key from the private key
-file, so passing this option is generally not required. Note that this public
-key extraction requires libcurl to be linked against a copy of libssh2 1.2.8
-or higher that is itself linked against OpenSSL. (Added in 7.39.0.)
diff --git a/third-party/curl/docs/cmdline-opts/pubkey.md b/third-party/curl/docs/cmdline-opts/pubkey.md
new file mode 100644
index 0000000000..373d113c3f
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/pubkey.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: pubkey
+Arg: <key>
+Protocols: SFTP SCP
+Help: SSH Public key filename
+Category: sftp scp ssh auth
+Added: 7.16.2
+Multi: single
+See-also:
+  - pass
+Example:
+  - --pubkey file.pub sftp://example.com/
+---
+
+# `--pubkey`
+
+Public key filename. Allows you to provide your public key in this separate
+file.
+
+curl attempts to automatically extract the public key from the private key
+file, so passing this option is generally not required. Note that this public
+key extraction requires libcurl to be linked against a copy of libssh2 1.2.8
+or higher that is itself linked against OpenSSL. (Added in 7.39.0.)
diff --git a/third-party/curl/docs/cmdline-opts/quote.d b/third-party/curl/docs/cmdline-opts/quote.d
deleted file mode 100644
index 5008d49321..0000000000
--- a/third-party/curl/docs/cmdline-opts/quote.d
+++ /dev/null
@@ -1,87 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: quote
-Arg: <command>
-Short: Q
-Help: Send command(s) to server before transfer
-Protocols: FTP SFTP
-Category: ftp sftp
-Example: --quote "DELE file" ftp://example.com/foo
-Added: 5.3
-See-also: request
-Multi: append
----
-Send an arbitrary command to the remote FTP or SFTP server. Quote commands are
-sent BEFORE the transfer takes place (just after the initial **PWD** command
-in an FTP transfer, to be exact). To make commands take place after a
-successful transfer, prefix them with a dash '-'.
-
-(FTP only) To make commands be sent after curl has changed the working
-directory, just before the file transfer command(s), prefix the command with a
-'+'. This is not performed when a directory listing is performed.
-
-You may specify any number of commands.
-
-By default curl stops at first failure. To make curl continue even if the
-command fails, prefix the command with an asterisk (*). Otherwise, if the
-server returns failure for one of the commands, the entire operation is
-aborted.
-
-You must send syntactically correct FTP commands as RFC 959 defines to FTP
-servers, or one of the commands listed below to SFTP servers.
-
-SFTP is a binary protocol. Unlike for FTP, curl interprets SFTP quote commands
-itself before sending them to the server. File names may be quoted
-shell-style to embed spaces or special characters. Following is the list of
-all supported SFTP quote commands:
-.RS
-.TP
-**"atime date file"**
-The atime command sets the last access time of the file named by the file
-operand. The <date expression> can be all sorts of date strings, see the
-*curl_getdate(3)* man page for date expression details. (Added in 7.73.0)
-.TP
-**"chgrp group file"**
-The chgrp command sets the group ID of the file named by the file operand to
-the group ID specified by the group operand. The group operand is a decimal
-integer group ID.
-.TP
-**"chmod mode file"**
-The chmod command modifies the file mode bits of the specified file. The
-mode operand is an octal integer mode number.
-.TP
-**"chown user file"**
-The chown command sets the owner of the file named by the file operand to the
-user ID specified by the user operand. The user operand is a decimal
-integer user ID.
-.TP
-**"ln source_file target_file"**
-The ln and symlink commands create a symbolic link at the target_file location
-pointing to the source_file location.
-.TP
-**"mkdir directory_name"**
-The mkdir command creates the directory named by the directory_name operand.
-.TP
-**"mtime date file"**
-The mtime command sets the last modification time of the file named by the
-file operand. The <date expression> can be all sorts of date strings, see the
-*curl_getdate(3)* man page for date expression details. (Added in 7.73.0)
-.TP
-**"pwd"**
-The pwd command returns the absolute path name of the current working directory.
-.TP
-**"rename source target"**
-The rename command renames the file or directory named by the source
-operand to the destination path named by the target operand.
-.TP
-**"rm file"**
-The rm command removes the file specified by the file operand.
-.TP
-**"rmdir directory"**
-The rmdir command removes the directory entry specified by the directory
-operand, provided it is empty.
-.TP
-**"symlink source_file target_file"**
-See ln.
-.RE
-.IP
diff --git a/third-party/curl/docs/cmdline-opts/quote.md b/third-party/curl/docs/cmdline-opts/quote.md
new file mode 100644
index 0000000000..1ac2076b74
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/quote.md
@@ -0,0 +1,93 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: quote
+Arg: <command>
+Short: Q
+Help: Send command(s) to server before transfer
+Protocols: FTP SFTP
+Category: ftp sftp
+Added: 5.3
+Multi: append
+See-also:
+  - request
+Example:
+  - --quote "DELE file" ftp://example.com/foo
+---
+
+# `--quote`
+
+Send an arbitrary command to the remote FTP or SFTP server. Quote commands are
+sent BEFORE the transfer takes place (immediately after the initial **PWD**
+command in an FTP transfer, to be exact). To make commands take place after a
+successful transfer, prefix them with a dash '-'.
+
+(FTP only) To make commands be sent after curl has changed the working
+directory, immediately before the file transfer command(s), prefix the command
+with a '+'.
+
+You may specify any number of commands.
+
+By default curl stops at first failure. To make curl continue even if the
+command fails, prefix the command with an asterisk (*). Otherwise, if the
+server returns failure for one of the commands, the entire operation is
+aborted.
+
+You must send syntactically correct FTP commands as RFC 959 defines to FTP
+servers, or one of the commands listed below to SFTP servers.
+
+SFTP is a binary protocol. Unlike for FTP, curl interprets SFTP quote commands
+itself before sending them to the server. Filenames must be provided within
+double quotes to embed spaces, backslashes, quotes or double quotes. Within
+double quotes the following escape sequences are available for that purpose:
+\\, \", and \'.
+
+Following is the list of all supported SFTP quote commands:
+
+## atime date file
+The atime command sets the last access time of the file named by the file
+operand. The date expression can be all sorts of date strings, see the
+*curl_getdate(3)* man page for date expression details. (Added in 7.73.0)
+
+## chgrp group file
+The chgrp command sets the group ID of the file named by the file operand to
+the group ID specified by the group operand. The group operand is a decimal
+integer group ID.
+
+## chmod mode file
+The chmod command modifies the file mode bits of the specified file. The
+mode operand is an octal integer mode number.
+
+## chown user file
+The chown command sets the owner of the file named by the file operand to the
+user ID specified by the user operand. The user operand is a decimal
+integer user ID.
+
+## ln source_file target_file
+The ln and symlink commands create a symbolic link at the target_file location
+pointing to the source_file location.
+
+## mkdir directory_name
+The mkdir command creates the directory named by the directory_name operand.
+
+## mtime date file
+The mtime command sets the last modification time of the file named by the
+file operand. The date expression can be all sorts of date strings, see the
+*curl_getdate(3)* man page for date expression details. (Added in 7.73.0)
+
+## pwd
+The pwd command returns the absolute path name of the current working directory.
+
+## rename source target
+The rename command renames the file or directory named by the source
+operand to the destination path named by the target operand.
+
+## rm file
+The rm command removes the file specified by the file operand.
+
+## rmdir directory
+The rmdir command removes the directory entry specified by the directory
+operand, provided it is empty.
+
+## symlink source_file target_file
+See ln.
diff --git a/third-party/curl/docs/cmdline-opts/random-file.d b/third-party/curl/docs/cmdline-opts/random-file.d
deleted file mode 100644
index aa076de7fc..0000000000
--- a/third-party/curl/docs/cmdline-opts/random-file.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: random-file
-Arg: <file>
-Help: File for reading random data from
-Category: misc
-Example: --random-file rubbish $URL
-Added: 7.7
-See-also: egd-file
-Multi: single
----
-Deprecated option. This option is ignored (added in 7.84.0). Prior to that it
-only had an effect on curl if built to use old versions of OpenSSL.
-
-Specify the path name to file containing random data. The data may be used to
-seed the random engine for SSL connections.
diff --git a/third-party/curl/docs/cmdline-opts/random-file.md b/third-party/curl/docs/cmdline-opts/random-file.md
new file mode 100644
index 0000000000..e2c8624abf
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/random-file.md
@@ -0,0 +1,22 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: random-file
+Arg: <file>
+Help: File for reading random data from
+Category: deprecated
+Added: 7.7
+Multi: single
+See-also:
+  - egd-file
+Example:
+  - --random-file rubbish $URL
+---
+
+# `--random-file`
+
+Deprecated option. This option is ignored (added in 7.84.0). Prior to that it
+only had an effect on curl if built to use old versions of OpenSSL.
+
+Specify the path name to file containing random data. The data may be used to
+seed the random engine for SSL connections.
diff --git a/third-party/curl/docs/cmdline-opts/range.d b/third-party/curl/docs/cmdline-opts/range.d
deleted file mode 100644
index eba7220e1e..0000000000
--- a/third-party/curl/docs/cmdline-opts/range.d
+++ /dev/null
@@ -1,50 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: range
-Short: r
-Help: Retrieve only the bytes within RANGE
-Arg: <range>
-Protocols: HTTP FTP SFTP FILE
-Category: http ftp sftp file
-Example: --range 22-44 $URL
-Added: 4.0
-See-also: continue-at append
-Multi: single
----
-Retrieve a byte range (i.e. a partial document) from an HTTP/1.1, FTP or SFTP
-server or a local FILE. Ranges can be specified in a number of ways.
-.RS
-.TP 10
-.B 0-499
-specifies the first 500 bytes
-.TP
-.B 500-999
-specifies the second 500 bytes
-.TP
-.B -500
-specifies the last 500 bytes
-.TP
-.B 9500-
-specifies the bytes from offset 9500 and forward
-.TP
-.B 0-0,-1
-specifies the first and last byte only(*)(HTTP)
-.TP
-.B 100-199,500-599
-specifies two separate 100-byte ranges(*) (HTTP)
-.RE
-.IP
-(*) = NOTE that this causes the server to reply with a multipart response,
-which is returned as-is by curl! Parsing or otherwise transforming this
-response is the responsibility of the caller.
-
-Only digit characters (0-9) are valid in the 'start' and 'stop' fields of the
-'start-stop' range syntax. If a non-digit character is given in the range, the
-server's response is unspecified, depending on the server's configuration.
-
-Many HTTP/1.1 servers do not have this feature enabled, so that when you
-attempt to get a range, curl instead gets the whole document.
-
-FTP and SFTP range downloads only support the simple 'start-stop' syntax
-(optionally with one of the numbers omitted). FTP use depends on the extended
-FTP command SIZE.
diff --git a/third-party/curl/docs/cmdline-opts/range.md b/third-party/curl/docs/cmdline-opts/range.md
new file mode 100644
index 0000000000..ab1b126575
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/range.md
@@ -0,0 +1,66 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: range
+Short: r
+Help: Retrieve only the bytes within RANGE
+Arg: <range>
+Protocols: HTTP FTP SFTP FILE
+Category: http ftp sftp file
+Added: 4.0
+Multi: single
+See-also:
+  - continue-at
+  - append
+Example:
+  - --range 22-44 $URL
+---
+
+# `--range`
+
+Retrieve a byte range (i.e. a partial document) from an HTTP/1.1, FTP or SFTP
+server or a local FILE. Ranges can be specified in a number of ways.
+
+## 0-499
+specifies the first 500 bytes
+
+## 500-999
+specifies the second 500 bytes
+
+## -500
+specifies the last 500 bytes
+
+## 9500-
+specifies the bytes from offset 9500 and forward
+
+## 0-0,-1
+specifies the first and last byte only(*)(HTTP)
+
+## 100-199,500-599
+specifies two separate 100-byte ranges(*) (HTTP)
+
+##
+
+(*) = NOTE that if specifying multiple ranges and the server supports it then
+it replies with a multiple part response that curl returns as-is. It
+contains meta information in addition to the requested bytes. Parsing or
+otherwise transforming this response is the responsibility of the caller.
+
+Only digit characters (0-9) are valid in the 'start' and 'stop' fields of the
+'start-stop' range syntax. If a non-digit character is given in the range, the
+server's response is unspecified, depending on the server's configuration.
+
+Many HTTP/1.1 servers do not have this feature enabled, so that when you
+attempt to get a range, curl instead gets the whole document.
+
+FTP and SFTP range downloads only support the simple 'start-stop' syntax
+(optionally with one of the numbers omitted). FTP use depends on the extended
+FTP command SIZE.
+
+When using this option for HTTP uploads using POST or PUT, functionality is
+not guaranteed. The HTTP protocol has no standard interoperable resume upload
+and curl uses a set of headers for this purpose that once proved working for
+some servers and have been left for those who find that useful.
+
+This command line option is mutually exclusive with --continue-at: you can only
+use one of them for a single transfer.
diff --git a/third-party/curl/docs/cmdline-opts/rate.d b/third-party/curl/docs/cmdline-opts/rate.d
deleted file mode 100644
index d3cbd2849d..0000000000
--- a/third-party/curl/docs/cmdline-opts/rate.d
+++ /dev/null
@@ -1,35 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: rate
-Arg: <max request rate>
-Help: Request rate for serial transfers
-Category: connection
-Example: --rate 2/s $URL ...
-Example: --rate 3/h $URL ...
-Example: --rate 14/m $URL ...
-Added: 7.84.0
-See-also: limit-rate retry-delay
-Multi: single
-Scope: global
----
-Specify the maximum transfer frequency you allow curl to use - in number of
-transfer starts per time unit (sometimes called request rate). Without this
-option, curl starts the next transfer as fast as possible.
-
-If given several URLs and a transfer completes faster than the allowed rate,
-curl waits until the next transfer is started to maintain the requested
-rate. This option has no effect when --parallel is used.
-
-The request rate is provided as "N/U" where N is an integer number and U is a
-time unit. Supported units are 's' (second), 'm' (minute), 'h' (hour) and 'd'
-/(day, as in a 24 hour unit). The default time unit, if no "/U" is provided,
-is number of transfers per hour.
-
-If curl is told to allow 10 requests per minute, it does not start the next
-request until 6 seconds have elapsed since the previous transfer was started.
-
-This function uses millisecond resolution. If the allowed frequency is set
-more than 1000 per second, it instead runs unrestricted.
-
-When retrying transfers, enabled with --retry, the separate retry delay logic
-is used and not this setting.
diff --git a/third-party/curl/docs/cmdline-opts/rate.md b/third-party/curl/docs/cmdline-opts/rate.md
new file mode 100644
index 0000000000..d389da5747
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/rate.md
@@ -0,0 +1,46 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: rate
+Arg: <max request rate>
+Help: Request rate for serial transfers
+Category: connection global
+Added: 7.84.0
+Multi: single
+Scope: global
+See-also:
+  - limit-rate
+  - retry-delay
+Example:
+  - --rate 2/s $URL ...
+  - --rate 3/h $URL ...
+  - --rate 14/m $URL ...
+---
+
+# `--rate`
+
+Specify the maximum transfer frequency you allow curl to use - in number of
+transfer starts per time unit (sometimes called request rate). Without this
+option, curl starts the next transfer as fast as possible.
+
+If given several URLs and a transfer completes faster than the allowed rate,
+curl waits until the next transfer is started to maintain the requested
+rate. This option has no effect when --parallel is used.
+
+The request rate is provided as "N/U" where N is an integer number and U is a
+time unit. Supported units are 's' (second), 'm' (minute), 'h' (hour) and 'd'
+/(day, as in a 24 hour unit). The default time unit, if no "/U" is provided,
+is number of transfers per hour.
+
+If curl is told to allow 10 requests per minute, it does not start the next
+request until 6 seconds have elapsed since the previous transfer was started.
+
+This function uses millisecond resolution. If the allowed frequency is set
+more than 1000 per second, it instead runs unrestricted.
+
+When retrying transfers, enabled with --retry, the separate retry delay logic
+is used and not this setting.
+
+Starting in version 8.10.0, you can specify the number of time units in the rate
+expression. Make curl do no more than 5 transfers per 15 seconds with "5/15s"
+or limit it to 3 transfers per 4 hours with "3/4h". No spaces allowed.
diff --git a/third-party/curl/docs/cmdline-opts/raw.d b/third-party/curl/docs/cmdline-opts/raw.d
deleted file mode 100644
index 0523d62fab..0000000000
--- a/third-party/curl/docs/cmdline-opts/raw.d
+++ /dev/null
@@ -1,13 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: raw
-Help: Do HTTP "raw"; no transfer decoding
-Added: 7.16.2
-Protocols: HTTP
-Category: http
-Example: --raw $URL
-See-also: tr-encoding
-Multi: boolean
----
-When used, it disables all internal HTTP decoding of content or transfer
-encodings and instead makes them passed on unaltered, raw.
diff --git a/third-party/curl/docs/cmdline-opts/raw.md b/third-party/curl/docs/cmdline-opts/raw.md
new file mode 100644
index 0000000000..ca63dc318c
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/raw.md
@@ -0,0 +1,19 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: raw
+Help: Do HTTP raw; no transfer decoding
+Added: 7.16.2
+Protocols: HTTP
+Category: http
+Multi: boolean
+See-also:
+  - tr-encoding
+Example:
+  - --raw $URL
+---
+
+# `--raw`
+
+When used, it disables all internal HTTP decoding of content or transfer
+encodings and instead makes them passed on unaltered, raw.
diff --git a/third-party/curl/docs/cmdline-opts/referer.d b/third-party/curl/docs/cmdline-opts/referer.d
deleted file mode 100644
index 0609e8c997..0000000000
--- a/third-party/curl/docs/cmdline-opts/referer.d
+++ /dev/null
@@ -1,20 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: referer
-Short: e
-Arg: <URL>
-Protocols: HTTP
-Help: Referrer URL
-See-also: user-agent header
-Category: http
-Example: --referer "https://fake.example" $URL
-Example: --referer "https://fake.example;auto" -L $URL
-Example: --referer ";auto" -L $URL
-Added: 4.0
-Multi: single
----
-Sends the "Referrer Page" information to the HTTP server. This can also be set
-with the --header flag of course. When used with --location you can append
-";auto" to the --referer URL to make curl automatically set the previous URL
-when it follows a Location: header. The ";auto" string can be used alone,
-even if you do not set an initial --referer.
diff --git a/third-party/curl/docs/cmdline-opts/referer.md b/third-party/curl/docs/cmdline-opts/referer.md
new file mode 100644
index 0000000000..1fec248501
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/referer.md
@@ -0,0 +1,27 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: referer
+Short: e
+Arg: <URL>
+Protocols: HTTP
+Help: Referrer URL
+Category: http
+Added: 4.0
+Multi: single
+See-also:
+  - user-agent
+  - header
+Example:
+  - --referer "https://fake.example" $URL
+  - --referer "https://fake.example;auto" -L $URL
+  - --referer ";auto" -L $URL
+---
+
+# `--referer`
+
+Set the referrer URL in the HTTP request. This can also be set with the
+--header flag of course. When used with --location you can append `;auto`" to
+the --referer URL to make curl automatically set the previous URL when it
+follows a Location: header. The `;auto` string can be used alone, even if you
+do not set an initial --referer.
diff --git a/third-party/curl/docs/cmdline-opts/remote-header-name.d b/third-party/curl/docs/cmdline-opts/remote-header-name.d
deleted file mode 100644
index 917fe7abf2..0000000000
--- a/third-party/curl/docs/cmdline-opts/remote-header-name.d
+++ /dev/null
@@ -1,34 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: remote-header-name
-Short: J
-Protocols: HTTP
-Help: Use the header-provided filename
-Category: output
-Example: -OJ https://example.com/file
-Added: 7.20.0
-See-also: remote-name
-Multi: boolean
----
-This option tells the --remote-name option to use the server-specified
-Content-Disposition filename instead of extracting a filename from the URL. If
-the server-provided file name contains a path, that is stripped off before the
-file name is used.
-
-The file is saved in the current directory, or in the directory specified with
---output-dir.
-
-If the server specifies a file name and a file with that name already exists
-in the destination directory, it is not overwritten and an error occurs -
-unless you allow it by using the --clobber option. If the server does not
-specify a file name then this option has no effect.
-
-There is no attempt to decode %-sequences (yet) in the provided file name, so
-this option may provide you with rather unexpected file names.
-
-This feature uses the name from the "filename" field, it does not yet support
-the "filename*" field (filenames with explicit character sets).
-
-**WARNING**: Exercise judicious use of this option, especially on Windows. A
-rogue server could send you the name of a DLL or other file that could be
-loaded automatically by Windows or some third party software.
diff --git a/third-party/curl/docs/cmdline-opts/remote-header-name.md b/third-party/curl/docs/cmdline-opts/remote-header-name.md
new file mode 100644
index 0000000000..52ae98b01c
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/remote-header-name.md
@@ -0,0 +1,42 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: remote-header-name
+Short: J
+Protocols: HTTP
+Help: Use the header-provided filename
+Category: output
+Added: 7.20.0
+Multi: boolean
+See-also:
+  - remote-name
+Example:
+  - -OJ https://example.com/file
+---
+
+# `--remote-header-name`
+
+Tell the --remote-name option to use the server-specified Content-Disposition
+filename instead of extracting a filename from the URL. If the server-provided
+filename contains a path, that is stripped off before the filename is used.
+
+The file is saved in the current directory, or in the directory specified with
+--output-dir.
+
+If the server specifies a filename and a file with that name already exists in
+the destination directory, it is not overwritten and an error occurs - unless
+you allow it by using the --clobber option. If the server does not specify a
+filename then this option has no effect.
+
+There is no attempt to decode %-sequences (yet) in the provided filename, so
+this option may provide you with rather unexpected filenames.
+
+This feature uses the name from the `filename` field, it does not yet support
+the `filename*` field (filenames with explicit character sets).
+
+Starting in 8.19.0, curl falls back and uses the filename extracted from the
+last redirect header if no `Content-Disposition:` header provides a filename.
+
+**WARNING**: Exercise judicious use of this option, especially on Windows. A
+rogue server could send you the name of a DLL or other file that could be
+loaded automatically by Windows or some third party software.
diff --git a/third-party/curl/docs/cmdline-opts/remote-name-all.d b/third-party/curl/docs/cmdline-opts/remote-name-all.d
deleted file mode 100644
index 249c4e265f..0000000000
--- a/third-party/curl/docs/cmdline-opts/remote-name-all.d
+++ /dev/null
@@ -1,14 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: remote-name-all
-Help: Use the remote file name for all URLs
-Added: 7.19.0
-Category: output
-Example: --remote-name-all ftp://example.com/file1 ftp://example.com/file2
-See-also: remote-name
-Multi: boolean
----
-This option changes the default action for all given URLs to be dealt with as
-if --remote-name were used for each one. So if you want to disable that for a
-specific URL after --remote-name-all has been used, you must use "-o -" or
---no-remote-name.
diff --git a/third-party/curl/docs/cmdline-opts/remote-name-all.md b/third-party/curl/docs/cmdline-opts/remote-name-all.md
new file mode 100644
index 0000000000..92d348e27c
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/remote-name-all.md
@@ -0,0 +1,20 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: remote-name-all
+Help: Use the remote filename for all URLs
+Added: 7.19.0
+Category: output
+Multi: boolean
+See-also:
+  - remote-name
+Example:
+  - --remote-name-all ftp://example.com/file1 ftp://example.com/file2
+---
+
+# `--remote-name-all`
+
+Change the default action for all given URLs to be dealt with as if
+--remote-name were used for each one. If you want to disable that for a
+specific URL after --remote-name-all has been used, you must use "-o -" or
+--no-remote-name.
diff --git a/third-party/curl/docs/cmdline-opts/remote-name.d b/third-party/curl/docs/cmdline-opts/remote-name.d
deleted file mode 100644
index 215cf72deb..0000000000
--- a/third-party/curl/docs/cmdline-opts/remote-name.d
+++ /dev/null
@@ -1,28 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: remote-name
-Short: O
-Help: Write output to a file named as the remote file
-Category: important output
-Example: -O https://example.com/filename
-Added: 4.0
-See-also: remote-name-all output-dir remote-header-name
-Multi: append
----
-Write output to a local file named like the remote file we get. (Only the file
-part of the remote file is used, the path is cut off.)
-
-The file is saved in the current working directory. If you want the file saved
-in a different directory, make sure you change the current working directory
-before invoking curl with this option or use --output-dir.
-
-The remote file name to use for saving is extracted from the given URL,
-nothing else, and if it already exists it is overwritten. If you want the
-server to be able to choose the file name refer to --remote-header-name which
-can be used in addition to this option. If the server chooses a file name and
-that name already exists it is not overwritten.
-
-There is no URL decoding done on the file name. If it has %20 or other URL
-encoded parts of the name, they end up as-is as file name.
-
-You may use this option as many times as the number of URLs you have.
diff --git a/third-party/curl/docs/cmdline-opts/remote-name.md b/third-party/curl/docs/cmdline-opts/remote-name.md
new file mode 100644
index 0000000000..e39dd51aea
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/remote-name.md
@@ -0,0 +1,42 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: remote-name
+Short: O
+Help: Write output to file named as remote file
+Category: important output
+Added: 4.0
+Multi: per-URL
+See-also:
+  - remote-name-all
+  - output-dir
+  - remote-header-name
+Example:
+  - -O https://example.com/filename
+  - -O https://example.com/filename -O https://example.com/file2
+---
+
+# `--remote-name`
+
+Write output to a local file named like the remote file we get. (Only the file
+part of the remote file is used, the path is cut off.)
+
+The file is saved in the current working directory. If you want the file saved
+in a different directory, make sure you change the current working directory
+before invoking curl with this option or use --output-dir.
+
+The remote filename to use for saving is extracted from the given URL, nothing
+else, and if it already exists it is overwritten. If you want the server to be
+able to choose the filename refer to --remote-header-name which can be used in
+addition to this option. If the server chooses a filename and that name
+already exists it is not overwritten.
+
+There is no URL decoding done on the filename. If it has %20 or other URL
+encoded parts of the name, they end up as-is as filename.
+
+You may use this option as many times as the number of URLs you have.
+
+Before curl 8.10.0, curl returned an error if the URL ended with a slash,
+which means that there is no filename part in the URL. Starting in 8.10.0,
+curl sets the filename to the last directory part of the URL or if that also
+is missing to `curl_response` (without extension) for this situation.
diff --git a/third-party/curl/docs/cmdline-opts/remote-time.d b/third-party/curl/docs/cmdline-opts/remote-time.d
deleted file mode 100644
index 6dfb26c491..0000000000
--- a/third-party/curl/docs/cmdline-opts/remote-time.d
+++ /dev/null
@@ -1,14 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: remote-time
-Short: R
-Help: Set the remote file's time on the local output
-Category: output
-Example: --remote-time -o foo $URL
-Added: 7.9
-See-also: remote-name time-cond
-Multi: boolean
----
-Makes curl attempt to figure out the timestamp of the remote file that is
-getting downloaded, and if that is available make the local file get that same
-timestamp.
diff --git a/third-party/curl/docs/cmdline-opts/remote-time.md b/third-party/curl/docs/cmdline-opts/remote-time.md
new file mode 100644
index 0000000000..3f8c702b45
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/remote-time.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: remote-time
+Short: R
+Help: Set remote file's time on local output
+Category: output
+Added: 7.9
+Multi: boolean
+See-also:
+  - remote-name
+  - time-cond
+Example:
+  - --remote-time -o foo $URL
+---
+
+# `--remote-time`
+
+Make curl attempt to figure out the timestamp of the remote file that is
+getting downloaded, and if that is available make the local file get that same
+timestamp.
diff --git a/third-party/curl/docs/cmdline-opts/remove-on-error.d b/third-party/curl/docs/cmdline-opts/remove-on-error.d
deleted file mode 100644
index 50b7b1b65c..0000000000
--- a/third-party/curl/docs/cmdline-opts/remove-on-error.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: remove-on-error
-Help: Remove output file on errors
-See-also: fail
-Category: curl
-Example: --remove-on-error -o output $URL
-Added: 7.83.0
-Multi: boolean
----
-When curl returns an error when told to save output in a local file, this
-option removes that saved file before exiting. This prevents curl from
-leaving a partial file in the case of an error during transfer.
-
-If the output is not a file, this option has no effect.
diff --git a/third-party/curl/docs/cmdline-opts/remove-on-error.md b/third-party/curl/docs/cmdline-opts/remove-on-error.md
new file mode 100644
index 0000000000..ec7b88882b
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/remove-on-error.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: remove-on-error
+Help: Remove output file on errors
+Category: output
+Added: 7.83.0
+Multi: boolean
+See-also:
+  - fail
+Example:
+  - --remove-on-error -o output $URL
+---
+
+# `--remove-on-error`
+
+Remove the output file if an error occurs. If curl returns an error when told to
+save output in a local file. This prevents curl from leaving a partial file in
+the case of an error during transfer.
+
+If the output is not a regular file, this option has no effect.
+
+The --continue-at option cannot be used together with --remove-on-error.
diff --git a/third-party/curl/docs/cmdline-opts/request-target.d b/third-party/curl/docs/cmdline-opts/request-target.d
deleted file mode 100644
index 61ead5f2b0..0000000000
--- a/third-party/curl/docs/cmdline-opts/request-target.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: request-target
-Arg: <path>
-Help: Specify the target for this request
-Protocols: HTTP
-Added: 7.55.0
-Category: http
-Example: --request-target "*" -X OPTIONS $URL
-See-also: request
-Multi: single
----
-Tells curl to use an alternative "target" (path) instead of using the path as
-provided in the URL. Particularly useful when wanting to issue HTTP requests
-without leading slash or other data that does not follow the regular URL
-pattern, like "OPTIONS *".
diff --git a/third-party/curl/docs/cmdline-opts/request-target.md b/third-party/curl/docs/cmdline-opts/request-target.md
new file mode 100644
index 0000000000..c76b6b34de
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/request-target.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: request-target
+Arg: <path>
+Help: Specify the target for this request
+Protocols: HTTP
+Added: 7.55.0
+Category: http
+Multi: single
+See-also:
+  - request
+Example:
+  - --request-target "*" -X OPTIONS $URL
+---
+
+# `--request-target`
+
+Use an alternative target (path) instead of using the path as provided in the
+URL. Particularly useful when wanting to issue HTTP requests without leading
+slash or other data that does not follow the regular URL pattern, like
+"OPTIONS *".
+
+curl passes on the verbatim string you give it in the request without any
+filter or other safe guards. That includes white space and control characters.
diff --git a/third-party/curl/docs/cmdline-opts/request.d b/third-party/curl/docs/cmdline-opts/request.d
deleted file mode 100644
index 0020babf91..0000000000
--- a/third-party/curl/docs/cmdline-opts/request.d
+++ /dev/null
@@ -1,51 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: request
-Short: X
-Arg: <method>
-Help: Specify request method to use
-Category: connection
-Example: -X "DELETE" $URL
-Example: -X NLST ftp://example.com/
-Added: 6.0
-See-also: request-target
-Multi: single
----
-Change the method to use when starting the transfer.
-.RS
-.TP 15
-**HTTP**
-Specifies a custom request method to use when communicating with the HTTP
-server. The specified request method is used instead of the method otherwise
-used (which defaults to *GET*). Read the HTTP 1.1 specification for details
-and explanations. Common additional HTTP requests include *PUT* and *DELETE*,
-but related technologies like WebDAV offers *PROPFIND*, *COPY*, *MOVE* and
-more.
-
-Normally you do not need this option. All sorts of *GET*, *HEAD*, *POST* and
-*PUT* requests are rather invoked by using dedicated command line options.
-
-This option only changes the actual word used in the HTTP request, it does not
-alter the way curl behaves. So for example if you want to make a proper HEAD
-request, using -X HEAD does not suffice. You need to use the --head option.
-
-The method string you set with --request is used for all requests, which
-if you for example use --location may cause unintended side-effects when curl
-does not change request method according to the HTTP 30x response codes - and
-similar.
-.TP
-**FTP**
-Specifies a custom FTP command to use instead of *LIST* when doing file lists
-with FTP.
-.TP
-**POP3**
-Specifies a custom POP3 command to use instead of *LIST* or *RETR*.
-(Added in 7.26.0)
-.TP
-**IMAP**
-Specifies a custom IMAP command to use instead of *LIST*. (Added in 7.30.0)
-.TP
-**SMTP**
-Specifies a custom SMTP command to use instead of *HELP* or **VRFY**. (Added in 7.34.0)
-.RE
-.IP
diff --git a/third-party/curl/docs/cmdline-opts/request.md b/third-party/curl/docs/cmdline-opts/request.md
new file mode 100644
index 0000000000..2c9d7776e5
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/request.md
@@ -0,0 +1,58 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: request
+Short: X
+Arg: <method>
+Help: Specify request method to use
+Category: connection pop3 ftp imap smtp
+Added: 6.0
+Multi: single
+See-also:
+  - request-target
+  - follow
+Example:
+  - --request "DELETE" $URL
+  - -X NLST ftp://example.com/
+---
+
+# `--request`
+
+Change the method to use when starting the transfer.
+
+curl passes on the verbatim string you give it in the request without any
+filter or other safe guards. That includes white space and control characters.
+
+## HTTP
+Specifies a custom request method to use when communicating with the HTTP
+server. The specified request method is used instead of the method otherwise
+used (which defaults to *GET*). Read the HTTP 1.1 specification for details
+and explanations. Common additional HTTP requests include *PUT* and *DELETE*,
+while related technologies like WebDAV offers *PROPFIND*, *COPY*, *MOVE* and
+more.
+
+Normally you do not need this option. All sorts of *GET*, *HEAD*, *POST* and
+*PUT* requests are rather invoked by using dedicated command line options.
+
+This option only changes the actual word used in the HTTP request, it does not
+alter the way curl behaves. For example if you want to make a proper HEAD
+request, using -X HEAD does not suffice. You need to use the --head option.
+
+If --location is used, the method string you set with --request is used for
+all requests, which may cause unintended side-effects when curl does not
+change request method according to the HTTP 30x response codes - and similar.
+Consider using --follow instead in combination with --request.
+
+## FTP
+Specifies a custom FTP command to use instead of *LIST* when doing file lists
+with FTP.
+
+## POP3
+Specifies a custom POP3 command to use instead of *LIST* or *RETR*.
+(Added in 7.26.0)
+
+## IMAP
+Specifies a custom IMAP command to use instead of *LIST*. (Added in 7.30.0)
+
+## SMTP
+Specifies a custom SMTP command to use instead of *HELP* or **VRFY**. (Added in 7.34.0)
diff --git a/third-party/curl/docs/cmdline-opts/resolve.d b/third-party/curl/docs/cmdline-opts/resolve.d
deleted file mode 100644
index 31dd099a2f..0000000000
--- a/third-party/curl/docs/cmdline-opts/resolve.d
+++ /dev/null
@@ -1,41 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: resolve
-Arg: <[+]host:port:addr[,addr]...>
-Help: Resolve the host+port to this address
-Added: 7.21.3
-Category: connection dns
-Example: --resolve example.com:443:127.0.0.1 $URL
-See-also: connect-to alt-svc
-Multi: append
----
-Provide a custom address for a specific host and port pair. Using this, you
-can make the curl requests(s) use a specified address and prevent the
-otherwise normally resolved address to be used. Consider it a sort of
-/etc/hosts alternative provided on the command line. The port number should be
-the number used for the specific protocol the host is used for. It means
-you need several entries if you want to provide address for the same host but
-different ports.
-
-By specifying '*' as host you can tell curl to resolve any host and specific
-port pair to the specified address. Wildcard is resolved last so any --resolve
-with a specific host and port is used first.
-
-The provided address set by this option is used even if --ipv4 or --ipv6 is
-set to make curl use another IP version.
-
-By prefixing the host with a '+' you can make the entry time out after curl's
-default timeout (1 minute). Note that this only makes sense for long running
-parallel transfers with a lot of files. In such cases, if this option is used
-curl tries to resolve the host as it normally would once the timeout has
-expired.
-
-Support for providing the IP address within [brackets] was added in 7.57.0.
-
-Support for providing multiple IP addresses per entry was added in 7.59.0.
-
-Support for resolving with wildcard was added in 7.64.0.
-
-Support for the '+' prefix was was added in 7.75.0.
-
-This option can be used many times to add many host names to resolve.
diff --git a/third-party/curl/docs/cmdline-opts/resolve.md b/third-party/curl/docs/cmdline-opts/resolve.md
new file mode 100644
index 0000000000..18733df0c2
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/resolve.md
@@ -0,0 +1,50 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: resolve
+Arg: <[+]host:port:addr[,addr]...>
+Help: Resolve host+port to address
+Added: 7.21.3
+Category: connection dns
+Multi: append
+See-also:
+  - connect-to
+  - alt-svc
+Example:
+  - --resolve example.com:443:127.0.0.1 $URL
+  - --resolve example.com:443:[2001:db8::252f:efd6] $URL
+---
+
+# `--resolve`
+
+Provide a custom address for a specific host and port pair. Using this, you
+can make the curl requests(s) use a specified address and prevent the
+otherwise normally resolved address to be used. Consider it a sort of
+/etc/hosts alternative provided on the command line. The port number should be
+the number used for the specific protocol the host is used for. It means you
+need several entries if you want to provide addresses for the same host but
+different ports.
+
+By specifying `*` as host you can tell curl to resolve any host and specific
+port pair to the specified address. Wildcard is resolved last so any --resolve
+with a specific host and port is used first.
+
+The provided address set by this option is used even if --ipv4 or --ipv6 is
+set to make curl use another IP version.
+
+By prefixing the host with a '+' you can make the entry time out after curl's
+default timeout (1 minute). Note that this only makes sense for long running
+parallel transfers with a lot of files. In such cases, if this option is used
+curl tries to resolve the host as it normally would once the timeout has
+expired.
+
+Provide IPv6 addresses within [brackets].
+
+To redirect connects from a specific hostname or any hostname, independently
+of port number, consider the --connect-to option.
+
+Support for resolving with wildcard was added in 7.64.0.
+
+Support for the '+' prefix was added in 7.75.0.
+
+Support for specifying the host component as an IPv6 address was added in 8.13.0.
diff --git a/third-party/curl/docs/cmdline-opts/retry-all-errors.d b/third-party/curl/docs/cmdline-opts/retry-all-errors.d
deleted file mode 100644
index 1190d6a3ae..0000000000
--- a/third-party/curl/docs/cmdline-opts/retry-all-errors.d
+++ /dev/null
@@ -1,34 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: retry-all-errors
-Help: Retry all errors (use with --retry)
-Added: 7.71.0
-Category: curl
-Example: --retry 5 --retry-all-errors $URL
-See-also: retry
-Multi: boolean
----
-Retry on any error. This option is used together with --retry.
-
-This option is the "sledgehammer" of retrying. Do not use this option by
-default (for example in your **curlrc**), there may be unintended consequences
-such as sending or receiving duplicate data. Do not use with redirected input
-or output. You'd be much better off handling your unique problems in shell
-script. Please read the example below.
-
-**WARNING**: For server compatibility curl attempts to retry failed flaky
-transfers as close as possible to how they were started, but this is not
-possible with redirected input or output. For example, before retrying it
-removes output data from a failed partial transfer that was written to an
-output file. However this is not true of data redirected to a | pipe or >
-file, which are not reset. We strongly suggest you do not parse or record
-output via redirect in combination with this option, since you may receive
-duplicate data.
-
-By default curl does not return error for transfers with an HTTP response code
-that indicates an HTTP error, if the transfer was successful. For example, if
-a server replies 404 Not Found and the reply is fully received then that is
-not an error. When --retry is used then curl retries on some HTTP response
-codes that indicate transient HTTP errors, but that does not include most 4xx
-response codes such as 404. If you want to retry on all response codes that
-indicate HTTP errors (4xx and 5xx) then combine with --fail.
diff --git a/third-party/curl/docs/cmdline-opts/retry-all-errors.md b/third-party/curl/docs/cmdline-opts/retry-all-errors.md
new file mode 100644
index 0000000000..cb337f3f16
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/retry-all-errors.md
@@ -0,0 +1,40 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: retry-all-errors
+Help: Retry all errors (with --retry)
+Added: 7.71.0
+Category: curl
+Multi: boolean
+See-also:
+  - retry
+Example:
+  - --retry 5 --retry-all-errors $URL
+---
+
+# `--retry-all-errors`
+
+Retry on any error. This option is used together with --retry.
+
+This option is the "sledgehammer" of retrying. Do not use this option by
+default (for example in your **curlrc**), there may be unintended consequences
+such as sending or receiving duplicate data. Do not use with redirected input
+or output. You might be better off handling your unique problems in a shell
+script. Please read the example below.
+
+**WARNING**: For server compatibility curl attempts to retry failed flaky
+transfers as close as possible to how they were started, but this is not
+possible with redirected input or output. For example, before retrying it
+removes output data from a failed partial transfer that was written to an
+output file. However this is not true of data redirected to a | pipe or \>
+file, which are not reset. We strongly suggest you do not parse or record
+output via redirect in combination with this option, since you may receive
+duplicate data.
+
+By default curl does not return an error for transfers with an HTTP response code
+that indicates an HTTP error, if the transfer was successful. For example, if
+a server replies 404 Not Found and the reply is fully received then that is
+not an error. When --retry is used then curl retries on some HTTP response
+codes that indicate transient HTTP errors, but that does not include most 4xx
+response codes such as 404. If you want to retry on all response codes that
+indicate HTTP errors (4xx and 5xx) then combine with --fail.
diff --git a/third-party/curl/docs/cmdline-opts/retry-connrefused.d b/third-party/curl/docs/cmdline-opts/retry-connrefused.d
deleted file mode 100644
index a7b9643ce2..0000000000
--- a/third-party/curl/docs/cmdline-opts/retry-connrefused.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: retry-connrefused
-Help: Retry on connection refused (use with --retry)
-Added: 7.52.0
-Category: curl
-Example: --retry-connrefused --retry 7 $URL
-See-also: retry retry-all-errors
-Multi: boolean
----
-In addition to the other conditions, consider ECONNREFUSED as a transient
-error too for --retry. This option is used together with --retry.
diff --git a/third-party/curl/docs/cmdline-opts/retry-connrefused.md b/third-party/curl/docs/cmdline-opts/retry-connrefused.md
new file mode 100644
index 0000000000..c7f96a8fee
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/retry-connrefused.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: retry-connrefused
+Help: Retry on connection refused (with --retry)
+Added: 7.52.0
+Category: curl
+Multi: boolean
+See-also:
+  - retry
+  - retry-all-errors
+Example:
+  - --retry-connrefused --retry 7 $URL
+---
+
+# `--retry-connrefused`
+
+In addition to the other conditions, also consider ECONNREFUSED as a transient
+error for --retry. This option is used together with --retry. Normally, a
+refused connection is not considered a transient error and therefore would not
+otherwise trigger a retry.
diff --git a/third-party/curl/docs/cmdline-opts/retry-delay.d b/third-party/curl/docs/cmdline-opts/retry-delay.d
deleted file mode 100644
index 686a0d8ba4..0000000000
--- a/third-party/curl/docs/cmdline-opts/retry-delay.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: retry-delay
-Arg: <seconds>
-Help: Wait time between retries
-Added: 7.12.3
-Category: curl
-Example: --retry-delay 5 --retry 7 $URL
-See-also: retry
-Multi: single
----
-Make curl sleep this amount of time before each retry when a transfer has
-failed with a transient error (it changes the default backoff time algorithm
-between retries). This option is only interesting if --retry is also
-used. Setting this delay to zero makes curl use the default backoff time.
diff --git a/third-party/curl/docs/cmdline-opts/retry-delay.md b/third-party/curl/docs/cmdline-opts/retry-delay.md
new file mode 100644
index 0000000000..dbc78e00d8
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/retry-delay.md
@@ -0,0 +1,28 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: retry-delay
+Arg: <seconds>
+Help: Wait time between retries
+Added: 7.12.3
+Category: curl timeout
+Multi: single
+See-also:
+  - retry
+  - retry-max-time
+Example:
+  - --retry-delay 5 --retry 7 $URL
+---
+
+# `--retry-delay`
+
+Make curl sleep this amount of time before each retry when a transfer has
+failed with a transient error (it changes the default backoff time algorithm
+between retries). This option is only interesting if --retry is also
+used. Setting this delay to zero makes curl use the default backoff time.
+
+By default, curl uses an exponentially increasing timeout between retries.
+
+Starting in curl 8.16.0, this option accepts a time as decimal number for parts
+of seconds. The decimal value needs to be provided using a dot (.) as decimal
+separator - not the local version even if it might be using another separator.
diff --git a/third-party/curl/docs/cmdline-opts/retry-max-time.d b/third-party/curl/docs/cmdline-opts/retry-max-time.d
deleted file mode 100644
index de2aff9a80..0000000000
--- a/third-party/curl/docs/cmdline-opts/retry-max-time.d
+++ /dev/null
@@ -1,17 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: retry-max-time
-Arg: <seconds>
-Help: Retry only within this period
-Added: 7.12.3
-Category: curl
-Example: --retry-max-time 30 --retry 10 $URL
-See-also: retry
-Multi: single
----
-The retry timer is reset before the first transfer attempt. Retries are done
-as usual (see --retry) as long as the timer has not reached this given
-limit. Notice that if the timer has not reached the limit, the request is
-made and while performing, it may take longer than this given time period. To
-limit a single request's maximum time, use --max-time. Set this option to zero
-to not timeout retries.
diff --git a/third-party/curl/docs/cmdline-opts/retry-max-time.md b/third-party/curl/docs/cmdline-opts/retry-max-time.md
new file mode 100644
index 0000000000..45c141fb7f
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/retry-max-time.md
@@ -0,0 +1,38 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: retry-max-time
+Arg: <seconds>
+Help: Retry only within this period
+Added: 7.12.3
+Category: curl timeout
+Multi: single
+See-also:
+  - retry
+  - retry-delay
+Example:
+  - --retry-max-time 30 --retry 10 $URL
+---
+
+# `--retry-max-time`
+
+The retry timer is reset before the first transfer attempt. Retries are done
+as usual (see --retry) as long as the timer has not reached this given limit.
+Notice that if the timer has not reached the limit, the request is made and
+while performing, it may take longer than this given time period. To limit a
+single request's maximum time, use --max-time. Set this option to zero to not
+timeout retries.
+
+The retry timer starts immediately before the first transfer attempt and
+includes time spent sleeping between retries (such as delays defined by
+--retry-delay). Before each new retry is started, curl checks whether the
+elapsed time has reached the specified limit. If it has, no further retries are
+performed.
+
+A transfer that has already started is allowed to run to completion even if
+this makes the total wall clock time exceed the limit. Use --max-time to also
+cap the duration of each individual transfer attempt.
+
+Starting in curl 8.16.0, this option accepts a time as decimal number for parts
+of seconds. The decimal value needs to be provided using a dot (.) as decimal
+separator - not the local version even if it might be using another separator.
diff --git a/third-party/curl/docs/cmdline-opts/retry.d b/third-party/curl/docs/cmdline-opts/retry.d
deleted file mode 100644
index d49a0cdfb4..0000000000
--- a/third-party/curl/docs/cmdline-opts/retry.d
+++ /dev/null
@@ -1,25 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: retry
-Arg: <num>
-Added: 7.12.3
-Help: Retry request if transient problems occur
-Category: curl
-Example: --retry 7 $URL
-See-also: retry-max-time
-Multi: single
----
-If a transient error is returned when curl tries to perform a transfer, it
-retries this number of times before giving up. Setting the number to 0
-makes curl do no retries (which is the default). Transient error means either:
-a timeout, an FTP 4xx response code or an HTTP 408, 429, 500, 502, 503 or 504
-response code.
-
-When curl is about to retry a transfer, it first waits one second and then for
-all forthcoming retries it doubles the waiting time until it reaches 10
-minutes which then remains delay between the rest of the retries. By using
---retry-delay you disable this exponential backoff algorithm. See also
---retry-max-time to limit the total time allowed for retries.
-
-curl complies with the Retry-After: response header if one was present to know
-when to issue the next retry (added in 7.66.0).
diff --git a/third-party/curl/docs/cmdline-opts/retry.md b/third-party/curl/docs/cmdline-opts/retry.md
new file mode 100644
index 0000000000..4d9e83cd5f
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/retry.md
@@ -0,0 +1,34 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: retry
+Arg: <num>
+Added: 7.12.3
+Help: Retry request if transient problems occur
+Category: curl
+Multi: single
+See-also:
+  - retry-max-time
+  - retry-connrefused
+  - retry-delay
+Example:
+  - --retry 7 $URL
+---
+
+# `--retry`
+
+If a transient error is returned when curl tries to perform a transfer, it
+retries this number of times before giving up. Setting the number to 0 makes
+curl do no retries (which is the default). Transient error means either: a
+timeout, an FTP 4xx response code or an HTTP 408, 429, 500, 502, 503, 504, 522
+or 524 response code.
+
+When curl is about to retry a transfer, it first waits one second and then for
+all forthcoming retries it doubles the waiting time until it reaches 10
+minutes, which then remains the set fixed delay time between the rest of the
+retries. By using --retry-delay you disable this exponential backoff
+algorithm. See also --retry-max-time to limit the total time allowed for
+retries.
+
+curl complies with the Retry-After: response header if one was present to know
+when to issue the next retry (added in 7.66.0).
diff --git a/third-party/curl/docs/cmdline-opts/sasl-authzid.d b/third-party/curl/docs/cmdline-opts/sasl-authzid.d
deleted file mode 100644
index 872818df77..0000000000
--- a/third-party/curl/docs/cmdline-opts/sasl-authzid.d
+++ /dev/null
@@ -1,19 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: sasl-authzid
-Arg: <identity>
-Help: Identity for SASL PLAIN authentication
-Added: 7.66.0
-Category: auth
-Example: --sasl-authzid zid imap://example.com/
-See-also: login-options
-Multi: single
----
-Use this authorization identity (**authzid**), during SASL PLAIN
-authentication, in addition to the authentication identity (**authcid**) as
-specified by --user.
-
-If the option is not specified, the server derives the **authzid** from the
-**authcid**, but if specified, and depending on the server implementation, it
-may be used to access another user's inbox, that the user has been granted
-access to, or a shared mailbox for example.
diff --git a/third-party/curl/docs/cmdline-opts/sasl-authzid.md b/third-party/curl/docs/cmdline-opts/sasl-authzid.md
new file mode 100644
index 0000000000..4e92a20541
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/sasl-authzid.md
@@ -0,0 +1,26 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: sasl-authzid
+Arg: <identity>
+Help: Identity for SASL PLAIN authentication
+Protocols: LDAP IMAP POP3 SMTP
+Added: 7.66.0
+Category: auth
+Multi: single
+See-also:
+  - login-options
+Example:
+  - --sasl-authzid zid imap://example.com/
+---
+
+# `--sasl-authzid`
+
+Use this authorization identity (**authzid**), during SASL PLAIN
+authentication, in addition to the authentication identity (**authcid**) as
+specified by --user.
+
+If the option is not specified, the server derives the **authzid** from the
+**authcid**, but if specified, and depending on the server implementation, it
+may be used to access another user's inbox, that the user has been granted
+access to, or a shared mailbox for example.
diff --git a/third-party/curl/docs/cmdline-opts/sasl-ir.d b/third-party/curl/docs/cmdline-opts/sasl-ir.d
deleted file mode 100644
index 56f1ae8ad7..0000000000
--- a/third-party/curl/docs/cmdline-opts/sasl-ir.d
+++ /dev/null
@@ -1,11 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: sasl-ir
-Help: Enable initial response in SASL authentication
-Added: 7.31.0
-Category: auth
-Example: --sasl-ir imap://example.com/
-See-also: sasl-authzid
-Multi: boolean
----
-Enable initial response in SASL authentication.
diff --git a/third-party/curl/docs/cmdline-opts/sasl-ir.md b/third-party/curl/docs/cmdline-opts/sasl-ir.md
new file mode 100644
index 0000000000..206bf29317
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/sasl-ir.md
@@ -0,0 +1,20 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: sasl-ir
+Help: Initial response in SASL authentication
+Protocols: LDAP IMAP POP3 SMTP
+Added: 7.31.0
+Category: auth
+Multi: boolean
+See-also:
+  - sasl-authzid
+Example:
+  - --sasl-ir imap://example.com/
+---
+
+# `--sasl-ir`
+
+Enable initial response in SASL authentication. Such an "initial response" is
+a message sent by the client to the server after the client selects an
+authentication mechanism.
diff --git a/third-party/curl/docs/cmdline-opts/service-name.d b/third-party/curl/docs/cmdline-opts/service-name.d
deleted file mode 100644
index 54d7ebf7bc..0000000000
--- a/third-party/curl/docs/cmdline-opts/service-name.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: service-name
-Help: SPNEGO service name
-Arg: <name>
-Added: 7.43.0
-Category: misc
-Example: --service-name sockd/server $URL
-See-also: negotiate proxy-service-name
-Multi: single
----
-This option allows you to change the service name for SPNEGO.
diff --git a/third-party/curl/docs/cmdline-opts/service-name.md b/third-party/curl/docs/cmdline-opts/service-name.md
new file mode 100644
index 0000000000..f98409aa25
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/service-name.md
@@ -0,0 +1,19 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: service-name
+Help: SPNEGO service name
+Arg: <name>
+Added: 7.43.0
+Category: auth
+Multi: single
+See-also:
+  - negotiate
+  - proxy-service-name
+Example:
+  - --service-name sockd/server $URL
+---
+
+# `--service-name`
+
+Set the service name for SPNEGO.
diff --git a/third-party/curl/docs/cmdline-opts/show-error.d b/third-party/curl/docs/cmdline-opts/show-error.d
deleted file mode 100644
index f150287458..0000000000
--- a/third-party/curl/docs/cmdline-opts/show-error.d
+++ /dev/null
@@ -1,13 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: show-error
-Short: S
-Help: Show error even when -s is used
-See-also: no-progress-meter
-Category: curl
-Example: --show-error --silent $URL
-Added: 5.9
-Multi: boolean
-Scope: global
----
-When used with --silent, it makes curl show an error message if it fails.
diff --git a/third-party/curl/docs/cmdline-opts/show-error.md b/third-party/curl/docs/cmdline-opts/show-error.md
new file mode 100644
index 0000000000..aaf865bc0e
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/show-error.md
@@ -0,0 +1,19 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: show-error
+Short: S
+Help: Show error even when -s is used
+Category: curl global
+Added: 5.9
+Multi: boolean
+Scope: global
+See-also:
+  - no-progress-meter
+Example:
+  - --show-error --silent $URL
+---
+
+# `--show-error`
+
+When used with --silent, it makes curl show an error message if it fails.
diff --git a/third-party/curl/docs/cmdline-opts/show-headers.md b/third-party/curl/docs/cmdline-opts/show-headers.md
new file mode 100644
index 0000000000..40c5ae790b
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/show-headers.md
@@ -0,0 +1,39 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: show-headers
+Short: i
+Help: Show response headers in output
+Protocols: HTTP FTP
+Category: important verbose output
+Added: 4.8
+Multi: boolean
+See-also:
+  - verbose
+  - dump-header
+Example:
+  - -i $URL
+---
+
+# `--show-headers`
+
+Show response headers in the output. HTTP response headers can include things
+like server name, cookies, date of the document, HTTP version and more. With
+non-HTTP protocols, the "headers" are other server communication.
+
+This option makes the response headers get saved in the same stream/output as
+the data. --dump-header exists to save headers in a separate stream.
+
+When HTTP headers are output to a tty, curl may use escape codes to make the
+header field names appear in bold and URLs in `Location:` headers be
+especially marked as such. Disable the use of terminal escape codes with
+--no-styled-output. (This means using the --styled-output option with a
+`--no-` prefix to disable it.)
+
+To view the request headers, consider the --verbose option.
+
+Prior to 7.75.0 curl did not print the headers if --fail was used in
+combination with this option and there was an error reported by the server.
+
+This option was called --include before 8.10.0. The previous name remains
+functional.
diff --git a/third-party/curl/docs/cmdline-opts/sigalgs.md b/third-party/curl/docs/cmdline-opts/sigalgs.md
new file mode 100644
index 0000000000..537b34f3ad
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/sigalgs.md
@@ -0,0 +1,33 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: sigalgs
+Arg: <list>
+Help: TLS signature algorithms to use
+Protocols: TLS
+Added: 8.14.0
+Category: tls
+Multi: single
+See-also:
+  - ciphers
+Example:
+  - --sigalgs ecdsa_secp256r1_sha256 $URL
+---
+
+# `--sigalgs`
+
+Set specific signature algorithms to use during SSL session establishment according to RFC
+5246, 7.4.1.4.1.
+
+An algorithm can use either a signature algorithm and a hash algorithm pair separated by a
+`+` (e.g. `ECDSA+SHA224`), or its TLS 1.3 signature scheme name (e.g. `ed25519`).
+
+Multiple algorithms can be provided by separating them with `:`
+(e.g. `DSA+SHA256:rsa_pss_pss_sha256`). The parameter is available as `-sigalgs` in the
+OpenSSL `s_client` and `s_server` utilities.
+
+`--sigalgs` allows a OpenSSL powered curl to make SSL-connections with exactly
+the signature algorithms requested by the client, avoiding nontransparent client/server
+negotiations.
+
+If this option is set, the default signature algorithm list built into OpenSSL are ignored.
diff --git a/third-party/curl/docs/cmdline-opts/silent.d b/third-party/curl/docs/cmdline-opts/silent.d
deleted file mode 100644
index 74bb299cc2..0000000000
--- a/third-party/curl/docs/cmdline-opts/silent.d
+++ /dev/null
@@ -1,17 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: silent
-Short: s
-Help: Silent mode
-See-also: verbose stderr no-progress-meter
-Category: important verbose
-Example: -s $URL
-Added: 4.0
-Multi: boolean
----
-Silent or quiet mode. Do not show progress meter or error messages. Makes Curl
-mute. It still outputs the data you ask for, potentially even to the
-terminal/stdout unless you redirect it.
-
-Use --show-error in addition to this option to disable progress meter but
-still show error messages.
diff --git a/third-party/curl/docs/cmdline-opts/silent.md b/third-party/curl/docs/cmdline-opts/silent.md
new file mode 100644
index 0000000000..2498ca56f4
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/silent.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: silent
+Short: s
+Help: Silent mode
+Category: important verbose
+Added: 4.0
+Multi: boolean
+See-also:
+  - verbose
+  - stderr
+  - no-progress-meter
+Example:
+  - -s $URL
+---
+
+# `--silent`
+
+Silent or quiet mode. Do not show progress meter, warning messages or error
+messages. Makes curl mute. It still outputs the data you ask for, potentially
+even to the terminal/stdout unless you redirect it.
+
+Use --show-error in addition to this option to disable progress meter but
+still show error messages.
diff --git a/third-party/curl/docs/cmdline-opts/skip-existing.md b/third-party/curl/docs/cmdline-opts/skip-existing.md
new file mode 100644
index 0000000000..dbef2fae92
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/skip-existing.md
@@ -0,0 +1,22 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: skip-existing
+Help: Skip download if local file already exists
+Category: curl output
+Added: 8.10.0
+Multi: boolean
+See-also:
+  - output
+  - remote-name
+  - no-clobber
+Example:
+  - --skip-existing --output local/dir/file $URL
+---
+
+# `--skip-existing`
+
+If there is a local file present when a download is requested, the operation
+is skipped. Note that curl cannot know if the local file was previously
+downloaded fine, or if it is incomplete etc, it knows if there is a filename
+present in the file system or not and it skips the transfer if it is.
diff --git a/third-party/curl/docs/cmdline-opts/socks4.d b/third-party/curl/docs/cmdline-opts/socks4.d
deleted file mode 100644
index d8cf719aad..0000000000
--- a/third-party/curl/docs/cmdline-opts/socks4.d
+++ /dev/null
@@ -1,28 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: socks4
-Arg: <host[:port]>
-Help: SOCKS4 proxy on given host + port
-Added: 7.15.2
-Category: proxy
-Example: --socks4 hostname:4096 $URL
-See-also: socks4a socks5 socks5-hostname
-Multi: single
----
-Use the specified SOCKS4 proxy. If the port number is not specified, it is
-assumed at port 1080. Using this socket type make curl resolve the host name
-and passing the address on to the proxy.
-
-To specify proxy on a unix domain socket, use localhost for host, e.g.
-socks4://localhost/path/to/socket.sock
-
-This option overrides any previous use of --proxy, as they are mutually
-exclusive.
-
-This option is superfluous since you can specify a socks4 proxy with --proxy
-using a socks4:// protocol prefix. (Added in 7.21.7)
-
---preproxy can be used to specify a SOCKS proxy at the same time proxy is used
-with an HTTP/HTTPS proxy (added in 7.52.0). In such a case, curl first
-connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or
-HTTPS proxy.
diff --git a/third-party/curl/docs/cmdline-opts/socks4.md b/third-party/curl/docs/cmdline-opts/socks4.md
new file mode 100644
index 0000000000..9d1c5671c9
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/socks4.md
@@ -0,0 +1,38 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: socks4
+Arg: <host[:port]>
+Help: SOCKS4 proxy on given host + port
+Added: 7.15.2
+Category: proxy
+Multi: single
+Mutexed: proxy socks4a socks5 socks5-hostname
+See-also:
+  - socks4a
+  - socks5
+  - socks5-hostname
+Example:
+  - --socks4 hostname:4096 $URL
+---
+
+# `--socks4`
+
+Use the specified SOCKS4 proxy. If the port number is not specified, it is
+assumed at port 1080. Using this socket type makes curl resolve the hostname
+and pass the address on to the proxy.
+
+To specify the proxy on a Unix domain socket, use localhost for host and
+append the absolute path to the domain socket. For example:
+`socks4://localhost/path/to/socket.sock` (the scheme may be omitted).
+
+This option overrides any previous use of --proxy, as they are mutually
+exclusive.
+
+This option is superfluous since you can specify a socks4 proxy with --proxy
+using a `socks4://` protocol prefix. (Added in 7.21.7)
+
+--preproxy can be used to specify a SOCKS proxy at the same time proxy is used
+with an HTTP/HTTPS proxy (added in 7.52.0). In such a case, curl first
+connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or
+HTTPS proxy.
diff --git a/third-party/curl/docs/cmdline-opts/socks4a.d b/third-party/curl/docs/cmdline-opts/socks4a.d
deleted file mode 100644
index cbb62724cd..0000000000
--- a/third-party/curl/docs/cmdline-opts/socks4a.d
+++ /dev/null
@@ -1,27 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: socks4a
-Arg: <host[:port]>
-Help: SOCKS4a proxy on given host + port
-Added: 7.18.0
-Category: proxy
-Example: --socks4a hostname:4096 $URL
-See-also: socks4 socks5 socks5-hostname
-Multi: single
----
-Use the specified SOCKS4a proxy. If the port number is not specified, it is
-assumed at port 1080. This asks the proxy to resolve the host name.
-
-To specify proxy on a unix domain socket, use localhost for host, e.g.
-socks4a://localhost/path/to/socket.sock
-
-This option overrides any previous use of --proxy, as they are mutually
-exclusive.
-
-This option is superfluous since you can specify a socks4a proxy with --proxy
-using a socks4a:// protocol prefix. (Added in 7.21.7)
-
---preproxy can be used to specify a SOCKS proxy at the same time --proxy is
-used with an HTTP/HTTPS proxy (added in 7.52.0). In such a case, curl first
-connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or
-HTTPS proxy.
diff --git a/third-party/curl/docs/cmdline-opts/socks4a.md b/third-party/curl/docs/cmdline-opts/socks4a.md
new file mode 100644
index 0000000000..695e44cb2b
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/socks4a.md
@@ -0,0 +1,37 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: socks4a
+Arg: <host[:port]>
+Help: SOCKS4a proxy on given host + port
+Added: 7.18.0
+Category: proxy
+Multi: single
+Mutexed: proxy socks4 socks5 socks5-hostname
+See-also:
+  - socks4
+  - socks5
+  - socks5-hostname
+Example:
+  - --socks4a hostname:4096 $URL
+---
+
+# `--socks4a`
+
+Use the specified SOCKS4a proxy. If the port number is not specified, it is
+assumed at port 1080. This asks the proxy to resolve the hostname.
+
+To specify the proxy on a Unix domain socket, use localhost for host and
+append the absolute path to the domain socket. For example:
+`socks4a://localhost/path/to/socket.sock` (the scheme may be omitted).
+
+This option overrides any previous use of --proxy, as they are mutually
+exclusive.
+
+This option is superfluous since you can specify a socks4a proxy with --proxy
+using a `socks4a://` protocol prefix. (Added in 7.21.7)
+
+--preproxy can be used to specify a SOCKS proxy at the same time --proxy is
+used with an HTTP/HTTPS proxy (added in 7.52.0). In such a case, curl first
+connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or
+HTTPS proxy.
diff --git a/third-party/curl/docs/cmdline-opts/socks5-basic.d b/third-party/curl/docs/cmdline-opts/socks5-basic.d
deleted file mode 100644
index a16831be18..0000000000
--- a/third-party/curl/docs/cmdline-opts/socks5-basic.d
+++ /dev/null
@@ -1,13 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: socks5-basic
-Help: Enable username/password auth for SOCKS5 proxies
-Added: 7.55.0
-Category: proxy auth
-Example: --socks5-basic --socks5 hostname:4096 $URL
-See-also: socks5
-Multi: mutex
----
-Tells curl to use username/password authentication when connecting to a SOCKS5
-proxy.  The username/password authentication is enabled by default.  Use
---socks5-gssapi to force GSS-API authentication to SOCKS5 proxies.
diff --git a/third-party/curl/docs/cmdline-opts/socks5-basic.md b/third-party/curl/docs/cmdline-opts/socks5-basic.md
new file mode 100644
index 0000000000..dc2a5532f1
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/socks5-basic.md
@@ -0,0 +1,19 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: socks5-basic
+Help: Username/password auth for SOCKS5 proxies
+Added: 7.55.0
+Category: proxy auth
+Multi: mutex
+See-also:
+  - socks5
+Example:
+  - --socks5-basic --socks5 hostname:4096 $URL
+---
+
+# `--socks5-basic`
+
+Use username/password authentication when connecting to a SOCKS5 proxy. The
+username/password authentication is enabled by default. Use --socks5-gssapi to
+force GSS-API authentication to SOCKS5 proxies.
diff --git a/third-party/curl/docs/cmdline-opts/socks5-gssapi-nec.d b/third-party/curl/docs/cmdline-opts/socks5-gssapi-nec.d
deleted file mode 100644
index 957655a091..0000000000
--- a/third-party/curl/docs/cmdline-opts/socks5-gssapi-nec.d
+++ /dev/null
@@ -1,14 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: socks5-gssapi-nec
-Help: Compatibility with NEC SOCKS5 server
-Added: 7.19.4
-Category: proxy auth
-Example: --socks5-gssapi-nec --socks5 hostname:4096 $URL
-See-also: socks5
-Multi: boolean
----
-As part of the GSS-API negotiation a protection mode is negotiated. RFC 1961
-says in section 4.3/4.4 it should be protected, but the NEC reference
-implementation does not. The option --socks5-gssapi-nec allows the
-unprotected exchange of the protection mode negotiation.
diff --git a/third-party/curl/docs/cmdline-opts/socks5-gssapi-nec.md b/third-party/curl/docs/cmdline-opts/socks5-gssapi-nec.md
new file mode 100644
index 0000000000..9cd91b9615
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/socks5-gssapi-nec.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: socks5-gssapi-nec
+Help: Compatibility with NEC SOCKS5 server
+Added: 7.19.4
+Category: proxy auth
+Protocols: GSS/kerberos
+Multi: boolean
+See-also:
+  - socks5
+Example:
+  - --socks5-gssapi-nec --socks5 hostname:4096 $URL
+---
+
+# `--socks5-gssapi-nec`
+
+As part of the GSS-API negotiation a protection mode is negotiated. RFC 1961
+says in section 4.3/4.4 it should be protected, but the NEC reference
+implementation does not. The option --socks5-gssapi-nec allows the
+unprotected exchange of the protection mode negotiation.
diff --git a/third-party/curl/docs/cmdline-opts/socks5-gssapi-service.d b/third-party/curl/docs/cmdline-opts/socks5-gssapi-service.d
deleted file mode 100644
index 66c2f33a59..0000000000
--- a/third-party/curl/docs/cmdline-opts/socks5-gssapi-service.d
+++ /dev/null
@@ -1,13 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: socks5-gssapi-service
-Arg: <name>
-Help: SOCKS5 proxy service name for GSS-API
-Added: 7.19.4
-Category: proxy auth
-Example: --socks5-gssapi-service sockd --socks5 hostname:4096 $URL
-See-also: socks5
-Multi: single
----
-The default service name for a socks server is **rcmd/server-fqdn**. This option
-allows you to change it.
diff --git a/third-party/curl/docs/cmdline-opts/socks5-gssapi-service.md b/third-party/curl/docs/cmdline-opts/socks5-gssapi-service.md
new file mode 100644
index 0000000000..d847e65e24
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/socks5-gssapi-service.md
@@ -0,0 +1,18 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: socks5-gssapi-service
+Arg: <name>
+Help: SOCKS5 proxy service name for GSS-API
+Added: 7.19.4
+Category: proxy auth
+Multi: single
+See-also:
+  - socks5
+Example:
+  - --socks5-gssapi-service sockd --socks5 hostname:4096 $URL
+---
+
+# `--socks5-gssapi-service`
+
+Set the service name for a socks server. Default is **rcmd/server-fqdn**.
diff --git a/third-party/curl/docs/cmdline-opts/socks5-gssapi.d b/third-party/curl/docs/cmdline-opts/socks5-gssapi.d
deleted file mode 100644
index cec684f422..0000000000
--- a/third-party/curl/docs/cmdline-opts/socks5-gssapi.d
+++ /dev/null
@@ -1,14 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: socks5-gssapi
-Help: Enable GSS-API auth for SOCKS5 proxies
-Added: 7.55.0
-Category: proxy auth
-Example: --socks5-gssapi --socks5 hostname:4096 $URL
-See-also: socks5
-Multi: boolean
----
-Tells curl to use GSS-API authentication when connecting to a SOCKS5 proxy.
-The GSS-API authentication is enabled by default (if curl is compiled with
-GSS-API support).  Use --socks5-basic to force username/password authentication
-to SOCKS5 proxies.
diff --git a/third-party/curl/docs/cmdline-opts/socks5-gssapi.md b/third-party/curl/docs/cmdline-opts/socks5-gssapi.md
new file mode 100644
index 0000000000..b8520b22cc
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/socks5-gssapi.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: socks5-gssapi
+Help: Enable GSS-API auth for SOCKS5 proxies
+Added: 7.55.0
+Category: proxy auth
+Protocols: GSS/kerberos
+Multi: boolean
+See-also:
+  - socks5
+Example:
+  - --socks5-gssapi --socks5 hostname:4096 $URL
+---
+
+# `--socks5-gssapi`
+
+Use GSS-API authentication when connecting to a SOCKS5 proxy. The GSS-API
+authentication is enabled by default (if curl is compiled with GSS-API
+support). Use --socks5-basic to force username/password authentication to
+SOCKS5 proxies.
diff --git a/third-party/curl/docs/cmdline-opts/socks5-hostname.d b/third-party/curl/docs/cmdline-opts/socks5-hostname.d
deleted file mode 100644
index ee49ca6426..0000000000
--- a/third-party/curl/docs/cmdline-opts/socks5-hostname.d
+++ /dev/null
@@ -1,27 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: socks5-hostname
-Arg: <host[:port]>
-Help: SOCKS5 proxy, pass host name to proxy
-Added: 7.18.0
-Category: proxy
-Example: --socks5-hostname proxy.example:7000 $URL
-See-also: socks5 socks4a
-Multi: single
----
-Use the specified SOCKS5 proxy (and let the proxy resolve the host name). If
-the port number is not specified, it is assumed at port 1080.
-
-To specify proxy on a unix domain socket, use localhost for host, e.g.
-socks5h://localhost/path/to/socket.sock
-
-This option overrides any previous use of --proxy, as they are mutually
-exclusive.
-
-This option is superfluous since you can specify a socks5 hostname proxy with
---proxy using a socks5h:// protocol prefix. (Added in 7.21.7)
-
---preproxy can be used to specify a SOCKS proxy at the same time --proxy is
-used with an HTTP/HTTPS proxy (added in 7.52.0). In such a case, curl first
-connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or
-HTTPS proxy.
diff --git a/third-party/curl/docs/cmdline-opts/socks5-hostname.md b/third-party/curl/docs/cmdline-opts/socks5-hostname.md
new file mode 100644
index 0000000000..f8ee9fe137
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/socks5-hostname.md
@@ -0,0 +1,36 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: socks5-hostname
+Arg: <host[:port]>
+Help: SOCKS5 proxy, pass hostname to proxy
+Added: 7.18.0
+Category: proxy
+Multi: single
+Mutexed: proxy socks4 socks4a socks5
+See-also:
+  - socks5
+  - socks4a
+Example:
+  - --socks5-hostname proxy.example:7000 $URL
+---
+
+# `--socks5-hostname`
+
+Use the specified SOCKS5 proxy (and let the proxy resolve the hostname). If
+the port number is not specified, it is assumed at port 1080.
+
+To specify the proxy on a Unix domain socket, use localhost for host and
+append the absolute path to the domain socket. For example:
+`socks5h://localhost/path/to/socket.sock` (the scheme may be omitted).
+
+This option overrides any previous use of --proxy, as they are mutually
+exclusive.
+
+This option is superfluous since you can specify a socks5 hostname proxy with
+--proxy using a `socks5h://` protocol prefix. (Added in 7.21.7)
+
+--preproxy can be used to specify a SOCKS proxy at the same time --proxy is
+used with an HTTP/HTTPS proxy (added in 7.52.0). In such a case, curl first
+connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or
+HTTPS proxy.
diff --git a/third-party/curl/docs/cmdline-opts/socks5.d b/third-party/curl/docs/cmdline-opts/socks5.d
deleted file mode 100644
index 0e52166ea2..0000000000
--- a/third-party/curl/docs/cmdline-opts/socks5.d
+++ /dev/null
@@ -1,29 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: socks5
-Arg: <host[:port]>
-Help: SOCKS5 proxy on given host + port
-Added: 7.18.0
-Category: proxy
-Example: --socks5 proxy.example:7000 $URL
-See-also: socks5-hostname socks4a
-Multi: single
----
-Use the specified SOCKS5 proxy - but resolve the host name locally. If the
-port number is not specified, it is assumed at port 1080.
-
-To specify proxy on a unix domain socket, use localhost for host, e.g.
-socks5://localhost/path/to/socket.sock
-
-This option overrides any previous use of --proxy, as they are mutually
-exclusive.
-
-This option is superfluous since you can specify a socks5 proxy with --proxy
-using a socks5:// protocol prefix. (Added in 7.21.7)
-
---preproxy can be used to specify a SOCKS proxy at the same time --proxy is
-used with an HTTP/HTTPS proxy (added in 7.52.0). In such a case, curl first
-connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or
-HTTPS proxy.
-
-This option (as well as --socks4) does not work with IPV6, FTPS or LDAP.
diff --git a/third-party/curl/docs/cmdline-opts/socks5.md b/third-party/curl/docs/cmdline-opts/socks5.md
new file mode 100644
index 0000000000..b70e88f6fa
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/socks5.md
@@ -0,0 +1,39 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: socks5
+Arg: <host[:port]>
+Help: SOCKS5 proxy on given host + port
+Added: 7.18.0
+Category: proxy
+Multi: single
+See-also:
+  - socks5-hostname
+  - socks4a
+Mutexed: proxy socks4 socks4a socks5-hostname
+Example:
+  - --socks5 proxy.example:7000 $URL
+  - --socks5 localhost/path/unix-domain $URL
+---
+
+# `--socks5`
+
+Use the specified SOCKS5 proxy - but resolve the hostname locally. If the
+port number is not specified, it is assumed at port 1080.
+
+To specify the proxy on a Unix domain socket, use localhost for host and
+append the absolute path to the domain socket. For example:
+`socks5://localhost/path/to/socket.sock` (the scheme may be omitted).
+
+This option overrides any previous use of --proxy, as they are mutually
+exclusive.
+
+This option is superfluous since you can specify a socks5 proxy with --proxy
+using a `socks5://` protocol prefix. (Added in 7.21.7)
+
+--preproxy can be used to specify a SOCKS proxy at the same time --proxy is
+used with an HTTP/HTTPS proxy (added in 7.52.0). In such a case, curl first
+connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or
+HTTPS proxy.
+
+This option does not work with FTPS or LDAP.
diff --git a/third-party/curl/docs/cmdline-opts/speed-limit.d b/third-party/curl/docs/cmdline-opts/speed-limit.d
deleted file mode 100644
index dc9778db9b..0000000000
--- a/third-party/curl/docs/cmdline-opts/speed-limit.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: speed-limit
-Short: Y
-Arg: <speed>
-Help: Stop transfers slower than this
-Category: connection
-Example: --speed-limit 300 --speed-time 10 $URL
-Added: 4.7
-See-also: speed-time limit-rate max-time
-Multi: single
----
-If a transfer is slower than this given speed (in bytes per second) for
-speed-time seconds it gets aborted. speed-time is set with --speed-time and is
-30 if not set.
diff --git a/third-party/curl/docs/cmdline-opts/speed-limit.md b/third-party/curl/docs/cmdline-opts/speed-limit.md
new file mode 100644
index 0000000000..b95d6e7d49
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/speed-limit.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: speed-limit
+Short: Y
+Arg: <speed>
+Help: Stop transfers slower than this
+Category: connection
+Added: 4.7
+Multi: single
+See-also:
+  - speed-time
+  - limit-rate
+  - max-time
+Example:
+  - --speed-limit 300 --speed-time 10 $URL
+---
+
+# `--speed-limit`
+
+If a transfer is slower than this set speed (in bytes per second) for a given
+number of seconds, it gets aborted. The time period is set with --speed-time
+and is 30 seconds by default.
diff --git a/third-party/curl/docs/cmdline-opts/speed-time.d b/third-party/curl/docs/cmdline-opts/speed-time.d
deleted file mode 100644
index 4a8860660a..0000000000
--- a/third-party/curl/docs/cmdline-opts/speed-time.d
+++ /dev/null
@@ -1,18 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: speed-time
-Short: y
-Arg: <seconds>
-Help: Trigger 'speed-limit' abort after this time
-Category: connection
-Example: --speed-limit 300 --speed-time 10 $URL
-Added: 4.7
-See-also: speed-limit limit-rate
-Multi: single
----
-If a transfer runs slower than speed-limit bytes per second during a
-speed-time period, the transfer is aborted. If speed-time is used, the default
-speed-limit is 1 unless set with --speed-limit.
-
-This option controls transfers (in both directions) but does not affect slow
-connects etc. If this is a concern for you, try the --connect-timeout option.
diff --git a/third-party/curl/docs/cmdline-opts/speed-time.md b/third-party/curl/docs/cmdline-opts/speed-time.md
new file mode 100644
index 0000000000..f27702bec3
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/speed-time.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: speed-time
+Short: y
+Arg: <seconds>
+Help: Trigger 'speed-limit' abort after this time
+Category: connection timeout
+Added: 4.7
+Multi: single
+See-also:
+  - speed-limit
+  - limit-rate
+Example:
+  - --speed-limit 300 --speed-time 10 $URL
+---
+
+# `--speed-time`
+
+If a transfer runs slower than speed-limit bytes per second during a
+speed-time period, the transfer is aborted. If speed-time is used, the default
+speed-limit is 1 unless set with --speed-limit.
+
+This option controls transfers (in both directions) but does not affect slow
+connects etc. If this is a concern for you, try the --connect-timeout option.
diff --git a/third-party/curl/docs/cmdline-opts/ssl-allow-beast.d b/third-party/curl/docs/cmdline-opts/ssl-allow-beast.d
deleted file mode 100644
index 2547675d64..0000000000
--- a/third-party/curl/docs/cmdline-opts/ssl-allow-beast.d
+++ /dev/null
@@ -1,17 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ssl-allow-beast
-Help: Allow security flaw to improve interop
-Added: 7.25.0
-Category: tls
-Example: --ssl-allow-beast $URL
-See-also: proxy-ssl-allow-beast insecure
-Multi: boolean
----
-This option tells curl to not work around a security flaw in the SSL3 and
-TLS1.0 protocols known as BEAST.  If this option is not used, the SSL layer
-may use workarounds known to cause interoperability problems with some older
-SSL implementations.
-
-**WARNING**: this option loosens the SSL security, and by using this flag you
-ask for exactly that.
diff --git a/third-party/curl/docs/cmdline-opts/ssl-allow-beast.md b/third-party/curl/docs/cmdline-opts/ssl-allow-beast.md
new file mode 100644
index 0000000000..f9933b77af
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ssl-allow-beast.md
@@ -0,0 +1,27 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ssl-allow-beast
+Help: Allow security flaw to improve interop
+Protocols: TLS
+Added: 7.25.0
+Category: tls
+Multi: boolean
+See-also:
+  - proxy-ssl-allow-beast
+  - insecure
+Example:
+  - --ssl-allow-beast $URL
+---
+
+# `--ssl-allow-beast`
+
+Do not work around a security flaw in the TLS1.0 protocol known as BEAST. If
+this option is not used, the TLS layer may use workarounds known to cause
+interoperability problems with some older server implementations.
+
+This option only changes how curl does TLS 1.0 and has no effect on later TLS
+versions.
+
+**WARNING**: this option loosens the TLS security, and by using this flag you
+ask for exactly that.
diff --git a/third-party/curl/docs/cmdline-opts/ssl-auto-client-cert.d b/third-party/curl/docs/cmdline-opts/ssl-auto-client-cert.d
deleted file mode 100644
index 5328adea71..0000000000
--- a/third-party/curl/docs/cmdline-opts/ssl-auto-client-cert.d
+++ /dev/null
@@ -1,14 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ssl-auto-client-cert
-Help: Use auto client certificate (Schannel)
-Added: 7.77.0
-See-also: proxy-ssl-auto-client-cert
-Category: tls
-Example: --ssl-auto-client-cert $URL
-Multi: boolean
----
-(Schannel) Tell libcurl to automatically locate and use a client certificate
-for authentication, when requested by the server. Since the server can request
-any certificate that supports client authentication in the OS certificate
-store it could be a privacy violation and unexpected.
diff --git a/third-party/curl/docs/cmdline-opts/ssl-auto-client-cert.md b/third-party/curl/docs/cmdline-opts/ssl-auto-client-cert.md
new file mode 100644
index 0000000000..4f0be5bd7e
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ssl-auto-client-cert.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ssl-auto-client-cert
+Help: Use auto client certificate (Schannel)
+Added: 7.77.0
+Category: tls
+Protocols: TLS
+Multi: boolean
+See-also:
+  - proxy-ssl-auto-client-cert
+Example:
+  - --ssl-auto-client-cert $URL
+---
+
+# `--ssl-auto-client-cert`
+
+(Schannel) Automatically locate and use a client certificate for
+authentication, when requested by the server. Since the server can request any
+certificate that supports client authentication in the OS certificate store it
+could be a privacy violation and unexpected.
diff --git a/third-party/curl/docs/cmdline-opts/ssl-no-revoke.d b/third-party/curl/docs/cmdline-opts/ssl-no-revoke.d
deleted file mode 100644
index 37e91d9c20..0000000000
--- a/third-party/curl/docs/cmdline-opts/ssl-no-revoke.d
+++ /dev/null
@@ -1,13 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ssl-no-revoke
-Help: Disable cert revocation checks (Schannel)
-Added: 7.44.0
-Category: tls
-Example: --ssl-no-revoke $URL
-See-also: crlfile
-Multi: boolean
----
-(Schannel) This option tells curl to disable certificate revocation checks.
-WARNING: this option loosens the SSL security, and by using this flag you ask
-for exactly that.
diff --git a/third-party/curl/docs/cmdline-opts/ssl-no-revoke.md b/third-party/curl/docs/cmdline-opts/ssl-no-revoke.md
new file mode 100644
index 0000000000..16981f14d1
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ssl-no-revoke.md
@@ -0,0 +1,19 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ssl-no-revoke
+Help: Disable cert revocation checks (Schannel)
+Added: 7.44.0
+Protocols: TLS
+Category: tls
+Multi: boolean
+See-also:
+  - crlfile
+Example:
+  - --ssl-no-revoke $URL
+---
+
+# `--ssl-no-revoke`
+
+(Schannel) Disable certificate revocation checks. WARNING: this option loosens
+the SSL security, and by using this flag you ask for exactly that.
diff --git a/third-party/curl/docs/cmdline-opts/ssl-reqd.d b/third-party/curl/docs/cmdline-opts/ssl-reqd.d
deleted file mode 100644
index 8a5b8577e0..0000000000
--- a/third-party/curl/docs/cmdline-opts/ssl-reqd.d
+++ /dev/null
@@ -1,23 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ssl-reqd
-Help: Require SSL/TLS
-Protocols: FTP IMAP POP3 SMTP LDAP
-Added: 7.20.0
-Category: tls
-Example: --ssl-reqd ftp://example.com
-See-also: ssl insecure
-Multi: boolean
----
-Require SSL/TLS for the connection. Terminates the connection if the transfer
-cannot be upgraded to use SSL/TLS.
-
-This option is handled in LDAP (added in 7.81.0). It is fully supported by the
-OpenLDAP backend and rejected by the generic ldap backend if explicit TLS is
-required.
-
-This option is unnecessary if you use a URL scheme that in itself implies
-immediate and implicit use of TLS, like for FTPS, IMAPS, POP3S, SMTPS and
-LDAPS. Such a transfer always fails if the TLS handshake does not work.
-
-This option was formerly known as --ftp-ssl-reqd.
diff --git a/third-party/curl/docs/cmdline-opts/ssl-reqd.md b/third-party/curl/docs/cmdline-opts/ssl-reqd.md
new file mode 100644
index 0000000000..f21c145f59
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ssl-reqd.md
@@ -0,0 +1,31 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ssl-reqd
+Help: Require SSL/TLS
+Protocols: FTP IMAP POP3 SMTP LDAP
+Added: 7.20.0
+Category: tls imap pop3 smtp ldap
+Multi: boolean
+See-also:
+  - ssl
+  - insecure
+Example:
+  - --ssl-reqd ftp://example.com
+---
+
+# `--ssl-reqd`
+
+Require SSL/TLS for the connection - often referred to as STARTTLS or STLS
+because of the involved commands. Terminates the connection if the transfer
+cannot be upgraded to use SSL/TLS.
+
+This option is handled in LDAP (added in 7.81.0). It is fully supported by the
+OpenLDAP backend and rejected by the generic ldap backend if explicit TLS is
+required.
+
+This option is unnecessary if you use a URL scheme that in itself implies
+immediate and implicit use of TLS, like for FTPS, IMAPS, POP3S, SMTPS and
+LDAPS. Such a transfer always fails if the TLS handshake does not work.
+
+This option was formerly known as --ftp-ssl-reqd.
diff --git a/third-party/curl/docs/cmdline-opts/ssl-revoke-best-effort.d b/third-party/curl/docs/cmdline-opts/ssl-revoke-best-effort.d
deleted file mode 100644
index cb26d0b9a0..0000000000
--- a/third-party/curl/docs/cmdline-opts/ssl-revoke-best-effort.d
+++ /dev/null
@@ -1,13 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ssl-revoke-best-effort
-Help: Ignore missing/offline cert CRL dist points (Schannel)
-Added: 7.70.0
-Category: tls
-Example: --ssl-revoke-best-effort $URL
-See-also: crlfile insecure
-Multi: boolean
----
-(Schannel) This option tells curl to ignore certificate revocation checks when
-they failed due to missing/offline distribution points for the revocation check
-lists.
diff --git a/third-party/curl/docs/cmdline-opts/ssl-revoke-best-effort.md b/third-party/curl/docs/cmdline-opts/ssl-revoke-best-effort.md
new file mode 100644
index 0000000000..0257e05f47
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ssl-revoke-best-effort.md
@@ -0,0 +1,20 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ssl-revoke-best-effort
+Help: Ignore missing cert CRL dist points
+Added: 7.70.0
+Protocols: TLS
+Category: tls
+Multi: boolean
+See-also:
+  - crlfile
+  - insecure
+Example:
+  - --ssl-revoke-best-effort $URL
+---
+
+# `--ssl-revoke-best-effort`
+
+(Schannel) Ignore certificate revocation checks when they failed due to
+missing/offline distribution points for the revocation check lists.
diff --git a/third-party/curl/docs/cmdline-opts/ssl-sessions.md b/third-party/curl/docs/cmdline-opts/ssl-sessions.md
new file mode 100644
index 0000000000..33ef984a3e
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ssl-sessions.md
@@ -0,0 +1,39 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ssl-sessions
+Arg: <filename>
+Protocols: TLS
+Help: Load/save SSL session tickets from/to this file
+Added: 8.12.0
+Category: tls
+Multi: single
+Experimental: yes
+See-also:
+  - tls-earlydata
+Example:
+  - --ssl-sessions sessions.txt $URL
+---
+
+# `--ssl-sessions`
+
+Use the given file to load SSL session tickets into curl's cache before
+starting any transfers. At the end of a successful curl run, the cached
+SSL sessions tickets are saved to the file, replacing any previous content.
+
+The file does not have to exist, but curl reports an error if it is
+unable to create it. Unused loaded tickets are saved again, unless they
+get replaced or purged from the cache for space reasons.
+
+Using a session file allows `--tls-earlydata` to send the first request
+in "0-RTT" mode, should an SSL session with the feature be found. Note that
+a server may not support early data. Also note that early data does
+not provide forward secrecy, e.g. is not as secure.
+
+The SSL session tickets are stored as base64 encoded text, each ticket on
+its own line. The hostnames are cryptographically salted and hashed. While
+this prevents someone from easily seeing the hosts you contacted, they could
+still check if a specific hostname matches one of the values.
+
+This feature requires that the underlying libcurl was built with the
+experimental SSL session import/export feature (SSLS-EXPORT) enabled.
diff --git a/third-party/curl/docs/cmdline-opts/ssl.d b/third-party/curl/docs/cmdline-opts/ssl.d
deleted file mode 100644
index b8fd22a9ca..0000000000
--- a/third-party/curl/docs/cmdline-opts/ssl.d
+++ /dev/null
@@ -1,26 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: ssl
-Help: Try SSL/TLS
-Protocols: FTP IMAP POP3 SMTP LDAP
-Added: 7.20.0
-Category: tls
-Example: --ssl pop3://example.com/
-See-also: ssl-reqd insecure ciphers
-Multi: boolean
----
-Warning: this is considered an insecure option. Consider using --ssl-reqd
-instead to be sure curl upgrades to a secure connection.
-
-Try to use SSL/TLS for the connection. Reverts to a non-secure connection if
-the server does not support SSL/TLS. See also --ftp-ssl-control and --ssl-reqd
-for different levels of encryption required.
-
-This option is handled in LDAP (added in 7.81.0). It is fully supported by the
-OpenLDAP backend and ignored by the generic ldap backend.
-
-Please note that a server may close the connection if the negotiation does
-not succeed.
-
-This option was formerly known as --ftp-ssl (added in 7.11.0). That option
-name can still be used but might be removed in a future version.
diff --git a/third-party/curl/docs/cmdline-opts/ssl.md b/third-party/curl/docs/cmdline-opts/ssl.md
new file mode 100644
index 0000000000..b234585809
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/ssl.md
@@ -0,0 +1,36 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ssl
+Help: Try enabling TLS
+Protocols: FTP IMAP POP3 SMTP LDAP
+Added: 7.20.0
+Category: tls imap pop3 smtp ldap
+Multi: boolean
+See-also:
+  - ssl-reqd
+  - insecure
+  - ciphers
+Example:
+  - --ssl pop3://example.com/
+---
+
+# `--ssl`
+
+Warning: this is considered an insecure option. Consider using --ssl-reqd
+instead to be sure curl upgrades to a secure connection.
+
+Try to use SSL/TLS for the connection - often referred to as STARTTLS or STLS
+because of the involved commands. Reverts to a non-secure connection if the
+server does not support SSL/TLS. See also --ftp-ssl-control and --ssl-reqd for
+different levels of encryption required.
+
+This option is handled in LDAP (added in 7.81.0). It is fully supported by the
+OpenLDAP backend and ignored by the generic ldap backend.
+
+Please note that a server may close the connection if the negotiation fails.
+
+If set, this option overrides --ftp-ssl-control.
+
+This option was formerly known as --ftp-ssl (added in 7.11.0). That option
+name can still be used but might be removed in a future version.
diff --git a/third-party/curl/docs/cmdline-opts/sslv2.d b/third-party/curl/docs/cmdline-opts/sslv2.d
deleted file mode 100644
index 3ecf109a09..0000000000
--- a/third-party/curl/docs/cmdline-opts/sslv2.d
+++ /dev/null
@@ -1,17 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Short: 2
-Long: sslv2
-Tags: Versions
-Protocols: SSL
-Added: 5.9
-Mutexed: sslv3 tlsv1 tlsv1.1 tlsv1.2
-Requires: TLS
-See-also: http1.1 http2
-Help: Use SSLv2
-Category: tls
-Example: --sslv2 $URL
-Multi: mutex
----
-This option previously asked curl to use SSLv2, but is now ignored
-(added in 7.77.0). SSLv2 is widely considered insecure (see RFC 6176).
diff --git a/third-party/curl/docs/cmdline-opts/sslv2.md b/third-party/curl/docs/cmdline-opts/sslv2.md
new file mode 100644
index 0000000000..ea92a2cb46
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/sslv2.md
@@ -0,0 +1,24 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Short: 2
+Long: sslv2
+Tags: Versions
+Protocols: SSL
+Added: 5.9
+Mutexed: sslv3 tlsv1 tlsv1.1 tlsv1.2
+Requires: TLS
+Help: SSLv2
+Category: deprecated
+Multi: mutex
+See-also:
+  - http1.1
+  - http2
+Example:
+  - --sslv2 $URL
+---
+
+# `--sslv2`
+
+This option previously asked curl to use SSLv2, but is now ignored
+(added in 7.77.0). SSLv2 is widely considered insecure (see RFC 6176).
diff --git a/third-party/curl/docs/cmdline-opts/sslv3.d b/third-party/curl/docs/cmdline-opts/sslv3.d
deleted file mode 100644
index 409afc610f..0000000000
--- a/third-party/curl/docs/cmdline-opts/sslv3.d
+++ /dev/null
@@ -1,17 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Short: 3
-Long: sslv3
-Tags: Versions
-Protocols: SSL
-Added: 5.9
-Mutexed: sslv2 tlsv1 tlsv1.1 tlsv1.2
-Requires: TLS
-See-also: http1.1 http2
-Help: Use SSLv3
-Category: tls
-Example: --sslv3 $URL
-Multi: mutex
----
-This option previously asked curl to use SSLv3, but is now ignored
-(added in 7.77.0). SSLv3 is widely considered insecure (see RFC 7568).
diff --git a/third-party/curl/docs/cmdline-opts/sslv3.md b/third-party/curl/docs/cmdline-opts/sslv3.md
new file mode 100644
index 0000000000..f022124e10
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/sslv3.md
@@ -0,0 +1,24 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Short: 3
+Long: sslv3
+Tags: Versions
+Protocols: SSL
+Added: 5.9
+Mutexed: sslv2 tlsv1 tlsv1.1 tlsv1.2
+Requires: TLS
+Help: SSLv3
+Category: deprecated
+Multi: mutex
+See-also:
+  - http1.1
+  - http2
+Example:
+  - --sslv3 $URL
+---
+
+# `--sslv3`
+
+This option previously asked curl to use SSLv3, but is now ignored
+(added in 7.77.0). SSLv3 is widely considered insecure (see RFC 7568).
diff --git a/third-party/curl/docs/cmdline-opts/stderr.d b/third-party/curl/docs/cmdline-opts/stderr.d
deleted file mode 100644
index a80bf43d1c..0000000000
--- a/third-party/curl/docs/cmdline-opts/stderr.d
+++ /dev/null
@@ -1,14 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: stderr
-Arg: <file>
-Help: Where to redirect stderr
-See-also: verbose silent
-Category: verbose
-Example: --stderr output.txt $URL
-Added: 6.2
-Multi: single
-Scope: global
----
-Redirect all writes to stderr to the specified file instead. If the file name
-is a plain '-', it is instead written to stdout.
diff --git a/third-party/curl/docs/cmdline-opts/stderr.md b/third-party/curl/docs/cmdline-opts/stderr.md
new file mode 100644
index 0000000000..7030e557b0
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/stderr.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: stderr
+Arg: <file>
+Help: Where to redirect stderr
+Category: verbose global
+Added: 6.2
+Multi: single
+Scope: global
+See-also:
+  - verbose
+  - silent
+Example:
+  - --stderr output.txt $URL
+---
+
+# `--stderr`
+
+Redirect all writes to stderr to the specified file instead. If the filename
+is a plain '-', it is instead written to stdout.
diff --git a/third-party/curl/docs/cmdline-opts/styled-output.d b/third-party/curl/docs/cmdline-opts/styled-output.d
deleted file mode 100644
index 70e9da4e84..0000000000
--- a/third-party/curl/docs/cmdline-opts/styled-output.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: styled-output
-Help: Enable styled output for HTTP headers
-Added: 7.61.0
-Category: verbose
-Example: --styled-output -I $URL
-See-also: head verbose
-Multi: boolean
-Scope: global
----
-Enables the automatic use of bold font styles when writing HTTP headers to the
-terminal. Use --no-styled-output to switch them off.
-
-Styled output requires a terminal that supports bold fonts. This feature is
-not present on curl for Windows due to lack of this capability.
diff --git a/third-party/curl/docs/cmdline-opts/styled-output.md b/third-party/curl/docs/cmdline-opts/styled-output.md
new file mode 100644
index 0000000000..8193896c5d
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/styled-output.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: styled-output
+Help: Enable styled output for HTTP headers
+Added: 7.61.0
+Category: verbose global
+Multi: boolean
+Scope: global
+See-also:
+  - head
+  - verbose
+Example:
+  - --styled-output -I $URL
+---
+
+# `--styled-output`
+
+Enable automatic use of bold font styles when writing HTTP headers to the
+terminal. Use --no-styled-output to switch them off.
+
+Styled output requires a terminal that supports bold fonts. This feature is
+not present on curl for Windows due to lack of this capability.
diff --git a/third-party/curl/docs/cmdline-opts/suppress-connect-headers.d b/third-party/curl/docs/cmdline-opts/suppress-connect-headers.d
deleted file mode 100644
index ed38f36de8..0000000000
--- a/third-party/curl/docs/cmdline-opts/suppress-connect-headers.d
+++ /dev/null
@@ -1,14 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: suppress-connect-headers
-Help: Suppress proxy CONNECT response headers
-See-also: dump-header include proxytunnel
-Category: proxy
-Example: --suppress-connect-headers --include -x proxy $URL
-Added: 7.54.0
-Multi: boolean
----
-When --proxytunnel is used and a CONNECT request is made do not output proxy
-CONNECT response headers. This option is meant to be used with --dump-header or
---include which are used to show protocol headers in the output. It has no
-effect on debug options such as --verbose or --trace, or any statistics.
diff --git a/third-party/curl/docs/cmdline-opts/suppress-connect-headers.md b/third-party/curl/docs/cmdline-opts/suppress-connect-headers.md
new file mode 100644
index 0000000000..91d99775ca
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/suppress-connect-headers.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: suppress-connect-headers
+Help: Suppress proxy CONNECT response headers
+Category: proxy
+Added: 7.54.0
+Multi: boolean
+See-also:
+  - dump-header
+  - show-headers
+  - proxytunnel
+Example:
+  - --suppress-connect-headers --show-headers -x proxy $URL
+---
+
+# `--suppress-connect-headers`
+
+When --proxytunnel is used and a CONNECT request is made, do not output proxy
+CONNECT response headers. This option is meant to be used with --dump-header
+or --show-headers which are used to show protocol headers in the output. It
+has no effect on debug options such as --verbose or --trace, or any
+statistics.
diff --git a/third-party/curl/docs/cmdline-opts/tcp-fastopen.d b/third-party/curl/docs/cmdline-opts/tcp-fastopen.d
deleted file mode 100644
index bcf1edbff5..0000000000
--- a/third-party/curl/docs/cmdline-opts/tcp-fastopen.d
+++ /dev/null
@@ -1,14 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: tcp-fastopen
-Added: 7.49.0
-Help: Use TCP Fast Open
-Category: connection
-Example: --tcp-fastopen $URL
-See-also: false-start
-Multi: boolean
----
-
-Enable use of TCP Fast Open (RFC 7413). TCP Fast Open is a TCP extension that
-allows data to get sent earlier over the connection (before the final
-handshake ACK) if the client and server have been connected previously.
diff --git a/third-party/curl/docs/cmdline-opts/tcp-fastopen.md b/third-party/curl/docs/cmdline-opts/tcp-fastopen.md
new file mode 100644
index 0000000000..7a954d006a
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/tcp-fastopen.md
@@ -0,0 +1,19 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: tcp-fastopen
+Added: 7.49.0
+Help: Use TCP Fast Open
+Category: connection
+Multi: boolean
+See-also:
+  - false-start
+Example:
+  - --tcp-fastopen $URL
+---
+
+# `--tcp-fastopen`
+
+Enable use of TCP Fast Open (RFC 7413). TCP Fast Open is a TCP extension that
+allows data to be sent earlier over the connection (before the final
+handshake ACK) if the client and server have been connected previously.
diff --git a/third-party/curl/docs/cmdline-opts/tcp-nodelay.d b/third-party/curl/docs/cmdline-opts/tcp-nodelay.d
deleted file mode 100644
index 2bf51cb5f4..0000000000
--- a/third-party/curl/docs/cmdline-opts/tcp-nodelay.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: tcp-nodelay
-Help: Use the TCP_NODELAY option
-Added: 7.11.2
-Category: connection
-Example: --tcp-nodelay $URL
-See-also: no-buffer
-Multi: boolean
----
-Turn on the TCP_NODELAY option. See the *curl_easy_setopt(3)* man page for
-details about this option.
-
-curl sets this option by default and you need to explicitly switch it off if
-you do not want it on (added in 7.50.2).
diff --git a/third-party/curl/docs/cmdline-opts/tcp-nodelay.md b/third-party/curl/docs/cmdline-opts/tcp-nodelay.md
new file mode 100644
index 0000000000..605667181a
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/tcp-nodelay.md
@@ -0,0 +1,30 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: tcp-nodelay
+Help: Set TCP_NODELAY
+Added: 7.11.2
+Category: connection
+Multi: boolean
+See-also:
+  - no-buffer
+Example:
+  - --tcp-nodelay $URL
+---
+
+# `--tcp-nodelay`
+
+Turn on the TCP_NODELAY option.
+
+This option disables the Nagle algorithm on TCP connections. The purpose of
+this algorithm is to minimize the number of small packets on the network
+(where "small packets" means TCP segments less than the Maximum Segment Size
+for the network).
+
+Maximizing the amount of data sent per TCP segment is good because it
+amortizes the overhead of the send. In some cases small segments may need to
+be sent without delay. This is less efficient than sending larger amounts of
+data at a time, and can contribute to congestion on the network if overdone.
+
+curl sets this option by default and you need to explicitly switch it off if
+you do not want it on (added in 7.50.2).
diff --git a/third-party/curl/docs/cmdline-opts/telnet-option.d b/third-party/curl/docs/cmdline-opts/telnet-option.d
deleted file mode 100644
index 651ce4203e..0000000000
--- a/third-party/curl/docs/cmdline-opts/telnet-option.d
+++ /dev/null
@@ -1,23 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: telnet-option
-Short: t
-Arg: <opt=val>
-Help: Set telnet option
-Category: telnet
-Example: -t TTYPE=vt100 telnet://example.com/
-Added: 7.7
-See-also: config
-Multi: append
----
-Pass options to the telnet protocol. Supported options are:
-
-.RS
-.TP 15
-**TTYPE**=<term> Sets the terminal type.
-.TP
-**XDISPLOC**=<X display> Sets the X display location.
-.TP
-**NEW_ENV**=<var,val> Sets an environment variable.
-.RE
-.IP
diff --git a/third-party/curl/docs/cmdline-opts/telnet-option.md b/third-party/curl/docs/cmdline-opts/telnet-option.md
new file mode 100644
index 0000000000..ca82a4ceb8
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/telnet-option.md
@@ -0,0 +1,29 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: telnet-option
+Short: t
+Arg: <opt=val>
+Help: Set telnet option
+Category: telnet
+Protocols: TELNET
+Added: 7.7
+Multi: append
+See-also:
+  - config
+Example:
+  - -t TTYPE=vt100 telnet://example.com/
+---
+
+# `--telnet-option`
+
+Pass options to the telnet protocol. Supported options are:
+
+## `TTYPE=<term>`
+Sets the terminal type.
+
+## `XDISPLOC=<X display>`
+Sets the X display location.
+
+## `NEW_ENV=<var,val>`
+Sets an environment variable.
diff --git a/third-party/curl/docs/cmdline-opts/tftp-blksize.d b/third-party/curl/docs/cmdline-opts/tftp-blksize.d
deleted file mode 100644
index 76c7ee4b13..0000000000
--- a/third-party/curl/docs/cmdline-opts/tftp-blksize.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: tftp-blksize
-Arg: <value>
-Help: Set TFTP BLKSIZE option
-Protocols: TFTP
-Added: 7.20.0
-Category: tftp
-Example: --tftp-blksize 1024 tftp://example.com/file
-See-also: tftp-no-options
-Multi: single
----
-Set the TFTP **BLKSIZE** option (must be >512). This is the block size that
-curl tries to use when transferring data to or from a TFTP server. By
-default 512 bytes are used.
diff --git a/third-party/curl/docs/cmdline-opts/tftp-blksize.md b/third-party/curl/docs/cmdline-opts/tftp-blksize.md
new file mode 100644
index 0000000000..21d8476af0
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/tftp-blksize.md
@@ -0,0 +1,21 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: tftp-blksize
+Arg: <value>
+Help: Set TFTP BLKSIZE option
+Protocols: TFTP
+Added: 7.20.0
+Category: tftp
+Multi: single
+See-also:
+  - tftp-no-options
+Example:
+  - --tftp-blksize 1024 tftp://example.com/file
+---
+
+# `--tftp-blksize`
+
+Set the TFTP **BLKSIZE** option (must be 512 or larger). This is the block
+size that curl tries to use when transferring data to or from a TFTP
+server. By default 512 bytes are used.
diff --git a/third-party/curl/docs/cmdline-opts/tftp-no-options.d b/third-party/curl/docs/cmdline-opts/tftp-no-options.d
deleted file mode 100644
index 43b1c00c47..0000000000
--- a/third-party/curl/docs/cmdline-opts/tftp-no-options.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: tftp-no-options
-Help: Do not send any TFTP options
-Protocols: TFTP
-Added: 7.48.0
-Category: tftp
-Example: --tftp-no-options tftp://192.168.0.1/
-See-also: tftp-blksize
-Multi: boolean
----
-Tells curl not to send TFTP options requests.
-
-This option improves interop with some legacy servers that do not acknowledge
-or properly implement TFTP options. When this option is used --tftp-blksize is
-ignored.
diff --git a/third-party/curl/docs/cmdline-opts/tftp-no-options.md b/third-party/curl/docs/cmdline-opts/tftp-no-options.md
new file mode 100644
index 0000000000..27bbe55bba
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/tftp-no-options.md
@@ -0,0 +1,20 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: tftp-no-options
+Help: Do not send any TFTP options
+Protocols: TFTP
+Added: 7.48.0
+Category: tftp
+Multi: boolean
+See-also:
+  - tftp-blksize
+Example:
+  - --tftp-no-options tftp://192.168.0.1/
+---
+
+# `--tftp-no-options`
+
+Do not send TFTP options requests. This improves interop with some legacy
+servers that do not acknowledge or properly implement TFTP options. When this
+option is used --tftp-blksize is ignored.
diff --git a/third-party/curl/docs/cmdline-opts/time-cond.d b/third-party/curl/docs/cmdline-opts/time-cond.d
deleted file mode 100644
index c21ed2853b..0000000000
--- a/third-party/curl/docs/cmdline-opts/time-cond.d
+++ /dev/null
@@ -1,27 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: time-cond
-Short: z
-Arg: <time>
-Help: Transfer based on a time condition
-Protocols: HTTP FTP
-Category: http ftp
-Example: -z "Wed 01 Sep 2021 12:18:00" $URL
-Example: -z "-Wed 01 Sep 2021 12:18:00" $URL
-Example: -z file $URL
-Added: 5.8
-See-also: etag-compare remote-time
-Multi: single
----
-Request a file that has been modified later than the given time and date, or
-one that has been modified before that time. The <date expression> can be all
-sorts of date strings or if it does not match any internal ones, it is taken as
-a filename and tries to get the modification date (mtime) from <file>
-instead. See the *curl_getdate(3)* man pages for date expression details.
-
-Start the date expression with a dash (-) to make it request for a document
-that is older than the given date/time, default is a document that is newer
-than the specified date/time.
-
-If provided a non-existing file, curl outputs a warning about that fact and
-proceeds to do the transfer without a time condition.
diff --git a/third-party/curl/docs/cmdline-opts/time-cond.md b/third-party/curl/docs/cmdline-opts/time-cond.md
new file mode 100644
index 0000000000..d902dd49d1
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/time-cond.md
@@ -0,0 +1,34 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: time-cond
+Short: z
+Arg: <time>
+Help: Transfer based on a time condition
+Protocols: HTTP FTP
+Category: http ftp
+Added: 5.8
+Multi: single
+See-also:
+  - etag-compare
+  - remote-time
+Example:
+  - -z "Wed 01 Sep 2021 12:18:00" $URL
+  - -z "-Wed 01 Sep 2021 12:18:00" $URL
+  - -z file $URL
+---
+
+# `--time-cond`
+
+Request a file that has been modified later than the given time and date, or
+one that has been modified before that time. The date expression can be all
+sorts of date strings or if it does not match any internal ones, it is treated
+as a filename and curl tries to get the modification date (mtime) from that
+file instead. See the *curl_getdate(3)* man page for date expression details.
+
+Start the date expression with a dash (-) to make it request for a document
+that is older than the given date/time, default is a document that is newer
+than the specified date/time.
+
+If provided a non-existing file, curl outputs a warning about that fact and
+proceeds to do the transfer without a time condition.
diff --git a/third-party/curl/docs/cmdline-opts/tls-earlydata.md b/third-party/curl/docs/cmdline-opts/tls-earlydata.md
new file mode 100644
index 0000000000..22a7abd3c3
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/tls-earlydata.md
@@ -0,0 +1,46 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: tls-earlydata
+Help: Allow use of TLSv1.3 early data (0RTT)
+Protocols: TLS
+Added: 8.11.0
+Category: tls
+Multi: boolean
+See-also:
+  - tlsv1.3
+  - tls-max
+  - ssl-sessions
+Example:
+  - --tls-earlydata $URL
+---
+
+# `--tls-earlydata`
+
+Enable the use of TLSv1.3 early data, also known as '0RTT' where possible.
+This has security implications for the requests sent that way.
+
+This option can be used when curl is built to use GnuTLS, OpenSSL, quictls and
+wolfSSL as a TLS provider (but not AWS-LC, BoringSSL, or Rustls).
+
+If a server supports this TLSv1.3 feature, and to what extent, is announced
+as part of the TLS "session" sent back to curl. Until curl has seen such
+a session in a previous request, early data cannot be used.
+
+When a new connection is initiated with a known TLSv1.3 session, and that
+session announced early data support, the first request on this connection is
+sent *before* the TLS handshake is complete. While the early data is also
+encrypted, it is not protected against replays. An attacker can send
+your early data to the server again and the server would accept it.
+
+If your request contacts a public server and only retrieves a file, there
+may be no harm in that. If the first request orders a refrigerator
+for you, it is probably not a good idea to use early data for it. curl
+cannot deduce what the security implications of your requests actually
+are and make this decision for you.
+
+The amount of early data sent can be inspected by using the `--write-out`
+variable `tls_earlydata`.
+
+**WARNING**: this option has security implications. See above for more
+details.
diff --git a/third-party/curl/docs/cmdline-opts/tls-max.d b/third-party/curl/docs/cmdline-opts/tls-max.d
deleted file mode 100644
index 2d52c1039f..0000000000
--- a/third-party/curl/docs/cmdline-opts/tls-max.d
+++ /dev/null
@@ -1,34 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: tls-max
-Arg: <VERSION>
-Tags: Versions
-Protocols: TLS
-Added: 7.54.0
-Requires: TLS
-See-also: tlsv1.0 tlsv1.1 tlsv1.2 tlsv1.3
-Help: Set maximum allowed TLS version
-Category: tls
-Example: --tls-max 1.2 $URL
-Example: --tls-max 1.3 --tlsv1.2 $URL
-Multi: single
----
-VERSION defines maximum supported TLS version. The minimum acceptable version
-is set by tlsv1.0, tlsv1.1, tlsv1.2 or tlsv1.3.
-
-If the connection is done without TLS, this option has no effect. This
-includes QUIC-using (HTTP/3) transfers.
-
-.RS
-.IP "default"
-Use up to recommended TLS version.
-.IP "1.0"
-Use up to TLSv1.0.
-.IP "1.1"
-Use up to TLSv1.1.
-.IP "1.2"
-Use up to TLSv1.2.
-.IP "1.3"
-Use up to TLSv1.3.
-.RE
-.IP
diff --git a/third-party/curl/docs/cmdline-opts/tls-max.md b/third-party/curl/docs/cmdline-opts/tls-max.md
new file mode 100644
index 0000000000..e3a7460cbb
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/tls-max.md
@@ -0,0 +1,44 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: tls-max
+Arg: <VERSION>
+Tags: Versions
+Protocols: TLS
+Added: 7.54.0
+Requires: TLS
+Help: Maximum allowed TLS version
+Category: tls
+Multi: single
+See-also:
+  - tlsv1.0
+  - tlsv1.1
+  - tlsv1.2
+  - tlsv1.3
+Example:
+  - --tls-max 1.2 $URL
+  - --tls-max 1.3 --tlsv1.2 $URL
+---
+
+# `--tls-max`
+
+Set the maximum allowed TLS version. The minimum acceptable version is set by
+tlsv1.0, tlsv1.1, tlsv1.2 or tlsv1.3.
+
+If the connection is done without TLS, this option has no effect. This
+includes QUIC-using (HTTP/3) transfers.
+
+## default
+Use up to the recommended TLS version.
+
+## 1.0
+Use up to TLSv1.0.
+
+## 1.1
+Use up to TLSv1.1.
+
+## 1.2
+Use up to TLSv1.2.
+
+## 1.3
+Use up to TLSv1.3.
diff --git a/third-party/curl/docs/cmdline-opts/tls13-ciphers.d b/third-party/curl/docs/cmdline-opts/tls13-ciphers.d
deleted file mode 100644
index 34c607dd1b..0000000000
--- a/third-party/curl/docs/cmdline-opts/tls13-ciphers.d
+++ /dev/null
@@ -1,21 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: tls13-ciphers
-Arg: <ciphersuite list>
-help: TLS 1.3 cipher suites to use
-Protocols: TLS
-Category: tls
-Example: --tls13-ciphers TLS_AES_128_GCM_SHA256 $URL
-Added: 7.61.0
-See-also: ciphers curves proxy-tls13-ciphers
-Multi: single
----
-Specifies which cipher suites to use in the connection if it negotiates TLS
-1.3. The list of ciphers suites must specify valid ciphers. Read up on TLS 1.3
-cipher suite details on this URL:
-
-https://curl.se/docs/ssl-ciphers.html
-
-This option is currently used only when curl is built to use OpenSSL 1.1.1 or
-later, or Schannel. If you are using a different SSL backend you can try
-setting TLS 1.3 cipher suites by using the --ciphers option.
diff --git a/third-party/curl/docs/cmdline-opts/tls13-ciphers.md b/third-party/curl/docs/cmdline-opts/tls13-ciphers.md
new file mode 100644
index 0000000000..cae224eb17
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/tls13-ciphers.md
@@ -0,0 +1,31 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: tls13-ciphers
+Arg: <list>
+Help: TLS 1.3 cipher suites to use
+Protocols: TLS
+Category: tls
+Added: 7.61.0
+Multi: single
+See-also:
+  - ciphers
+  - proxy-tls13-ciphers
+  - curves
+Example:
+  - --tls13-ciphers TLS_AES_128_GCM_SHA256 $URL
+---
+
+# `--tls13-ciphers`
+
+Set which cipher suites to use in the connection if it negotiates TLS 1.3. The
+list of ciphers suites must specify valid ciphers. Read up on TLS 1.3 cipher
+suite details on this URL:
+
+https://curl.se/docs/ssl-ciphers.html
+
+This option is used when curl is built to use OpenSSL 1.1.1 or later,
+wolfSSL, or mbedTLS 3.6.0 or later.
+
+Before curl 8.10.0 with mbedTLS or wolfSSL, TLS 1.3 cipher suites were set
+by using the --ciphers option.
diff --git a/third-party/curl/docs/cmdline-opts/tlsauthtype.d b/third-party/curl/docs/cmdline-opts/tlsauthtype.d
deleted file mode 100644
index 7d3f7e5aac..0000000000
--- a/third-party/curl/docs/cmdline-opts/tlsauthtype.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: tlsauthtype
-Arg: <type>
-Help: TLS authentication type
-Added: 7.21.4
-Category: tls auth
-Example: --tlsauthtype SRP $URL
-See-also: tlsuser
-Multi: single
----
-Set TLS authentication type. Currently, the only supported option is "SRP",
-for TLS-SRP (RFC 5054). If --tlsuser and --tlspassword are specified but
---tlsauthtype is not, then this option defaults to "SRP". This option works
-only if the underlying libcurl is built with TLS-SRP support, which requires
-OpenSSL or GnuTLS with TLS-SRP support.
diff --git a/third-party/curl/docs/cmdline-opts/tlsauthtype.md b/third-party/curl/docs/cmdline-opts/tlsauthtype.md
new file mode 100644
index 0000000000..10eccb29ad
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/tlsauthtype.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: tlsauthtype
+Arg: <type>
+Help: TLS authentication type
+Protocols: TLS
+Added: 7.21.4
+Category: tls auth
+Multi: single
+See-also:
+  - tlsuser
+Example:
+  - --tlsauthtype SRP $URL
+---
+
+# `--tlsauthtype`
+
+Set TLS authentication type. Currently, the only supported option is `SRP`,
+for TLS-SRP (RFC 5054). If --tlsuser and --tlspassword are specified but
+--tlsauthtype is not, then this option defaults to `SRP`. This option works
+only if the underlying libcurl is built with TLS-SRP support, which requires
+OpenSSL or GnuTLS with TLS-SRP support.
diff --git a/third-party/curl/docs/cmdline-opts/tlspassword.d b/third-party/curl/docs/cmdline-opts/tlspassword.d
deleted file mode 100644
index 0513191ae9..0000000000
--- a/third-party/curl/docs/cmdline-opts/tlspassword.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: tlspassword
-Arg: <string>
-Help: TLS password
-Added: 7.21.4
-Category: tls auth
-Example: --tlspassword pwd --tlsuser user $URL
-See-also: tlsuser
-Multi: single
----
-Set password for use with the TLS authentication method specified with
---tlsauthtype. Requires that --tlsuser also be set.
-
-This option does not work with TLS 1.3.
diff --git a/third-party/curl/docs/cmdline-opts/tlspassword.md b/third-party/curl/docs/cmdline-opts/tlspassword.md
new file mode 100644
index 0000000000..6a1bb23a15
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/tlspassword.md
@@ -0,0 +1,22 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: tlspassword
+Arg: <string>
+Help: TLS password
+Added: 7.21.4
+Protocols: TLS
+Category: tls auth
+Multi: single
+See-also:
+  - tlsuser
+Example:
+  - --tlspassword pwd --tlsuser user $URL
+---
+
+# `--tlspassword`
+
+Set password to use with the TLS authentication method specified with
+--tlsauthtype. Requires that --tlsuser is set.
+
+This option does not work with TLS 1.3.
diff --git a/third-party/curl/docs/cmdline-opts/tlsuser.d b/third-party/curl/docs/cmdline-opts/tlsuser.d
deleted file mode 100644
index f87532a7c0..0000000000
--- a/third-party/curl/docs/cmdline-opts/tlsuser.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: tlsuser
-Arg: <name>
-Help: TLS user name
-Added: 7.21.4
-Category: tls auth
-Example: --tlspassword pwd --tlsuser user $URL
-See-also: tlspassword
-Multi: single
----
-Set username for use with the TLS authentication method specified with
---tlsauthtype. Requires that --tlspassword also is set.
-
-This option does not work with TLS 1.3.
diff --git a/third-party/curl/docs/cmdline-opts/tlsuser.md b/third-party/curl/docs/cmdline-opts/tlsuser.md
new file mode 100644
index 0000000000..7f4636fa0a
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/tlsuser.md
@@ -0,0 +1,22 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: tlsuser
+Arg: <name>
+Help: TLS username
+Added: 7.21.4
+Protocols: TLS
+Category: tls auth
+Multi: single
+See-also:
+  - tlspassword
+Example:
+  - --tlspassword pwd --tlsuser user $URL
+---
+
+# `--tlsuser`
+
+Set username for use with the TLS authentication method specified with
+--tlsauthtype. Requires that --tlspassword also is set.
+
+This option does not work with TLS 1.3.
diff --git a/third-party/curl/docs/cmdline-opts/tlsv1.0.d b/third-party/curl/docs/cmdline-opts/tlsv1.0.d
deleted file mode 100644
index 493c0c6530..0000000000
--- a/third-party/curl/docs/cmdline-opts/tlsv1.0.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: tlsv1.0
-Help: Use TLSv1.0 or greater
-Protocols: TLS
-Added: 7.34.0
-Category: tls
-Example: --tlsv1.0 $URL
-See-also: tlsv1.3
-Multi: mutex
----
-Forces curl to use TLS version 1.0 or later when connecting to a remote TLS server.
-
-In old versions of curl this option was documented to allow _only_ TLS 1.0.
-That behavior was inconsistent depending on the TLS library. Use --tls-max if
-you want to set a maximum TLS version.
diff --git a/third-party/curl/docs/cmdline-opts/tlsv1.0.md b/third-party/curl/docs/cmdline-opts/tlsv1.0.md
new file mode 100644
index 0000000000..59eaae26e9
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/tlsv1.0.md
@@ -0,0 +1,22 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: tlsv1.0
+Help: TLSv1.0 or greater
+Protocols: TLS
+Added: 7.34.0
+Category: tls
+Multi: mutex
+See-also:
+  - tlsv1.3
+Example:
+  - --tlsv1.0 $URL
+---
+
+# `--tlsv1.0`
+
+Force curl to use TLS version 1.0 or later when connecting to a remote TLS server.
+
+In old versions of curl this option was documented to allow _only_ TLS 1.0.
+That behavior was inconsistent depending on the TLS library. Use --tls-max if
+you want to set a maximum TLS version.
diff --git a/third-party/curl/docs/cmdline-opts/tlsv1.1.d b/third-party/curl/docs/cmdline-opts/tlsv1.1.d
deleted file mode 100644
index f8ecdf67ae..0000000000
--- a/third-party/curl/docs/cmdline-opts/tlsv1.1.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: tlsv1.1
-Help: Use TLSv1.1 or greater
-Protocols: TLS
-Added: 7.34.0
-Category: tls
-Example: --tlsv1.1 $URL
-See-also: tlsv1.3 tls-max
-Multi: mutex
----
-Forces curl to use TLS version 1.1 or later when connecting to a remote TLS server.
-
-In old versions of curl this option was documented to allow _only_ TLS 1.1.
-That behavior was inconsistent depending on the TLS library. Use --tls-max if
-you want to set a maximum TLS version.
diff --git a/third-party/curl/docs/cmdline-opts/tlsv1.1.md b/third-party/curl/docs/cmdline-opts/tlsv1.1.md
new file mode 100644
index 0000000000..5f5e7c765c
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/tlsv1.1.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: tlsv1.1
+Help: TLSv1.1 or greater
+Protocols: TLS
+Added: 7.34.0
+Category: tls
+Multi: mutex
+See-also:
+  - tlsv1.3
+  - tls-max
+Example:
+  - --tlsv1.1 $URL
+---
+
+# `--tlsv1.1`
+
+Force curl to use TLS version 1.1 or later when connecting to a remote TLS server.
+
+In old versions of curl this option was documented to allow _only_ TLS 1.1.
+That behavior was inconsistent depending on the TLS library. Use --tls-max if
+you want to set a maximum TLS version.
diff --git a/third-party/curl/docs/cmdline-opts/tlsv1.2.d b/third-party/curl/docs/cmdline-opts/tlsv1.2.d
deleted file mode 100644
index a9953604ef..0000000000
--- a/third-party/curl/docs/cmdline-opts/tlsv1.2.d
+++ /dev/null
@@ -1,16 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: tlsv1.2
-Help: Use TLSv1.2 or greater
-Protocols: TLS
-Added: 7.34.0
-Category: tls
-Example: --tlsv1.2 $URL
-See-also: tlsv1.3 tls-max
-Multi: mutex
----
-Forces curl to use TLS version 1.2 or later when connecting to a remote TLS server.
-
-In old versions of curl this option was documented to allow _only_ TLS 1.2.
-That behavior was inconsistent depending on the TLS library. Use --tls-max if
-you want to set a maximum TLS version.
diff --git a/third-party/curl/docs/cmdline-opts/tlsv1.2.md b/third-party/curl/docs/cmdline-opts/tlsv1.2.md
new file mode 100644
index 0000000000..bf38762be7
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/tlsv1.2.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: tlsv1.2
+Help: TLSv1.2 or greater
+Protocols: TLS
+Added: 7.34.0
+Category: tls
+Multi: mutex
+See-also:
+  - tlsv1.3
+  - tls-max
+Example:
+  - --tlsv1.2 $URL
+---
+
+# `--tlsv1.2`
+
+Force curl to use TLS version 1.2 or later when connecting to a remote TLS server.
+
+In old versions of curl this option was documented to allow _only_ TLS 1.2.
+That behavior was inconsistent depending on the TLS library. Use --tls-max if
+you want to set a maximum TLS version.
diff --git a/third-party/curl/docs/cmdline-opts/tlsv1.3.d b/third-party/curl/docs/cmdline-opts/tlsv1.3.d
deleted file mode 100644
index 5690aa113d..0000000000
--- a/third-party/curl/docs/cmdline-opts/tlsv1.3.d
+++ /dev/null
@@ -1,18 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: tlsv1.3
-Help: Use TLSv1.3 or greater
-Protocols: TLS
-Added: 7.52.0
-Category: tls
-Example: --tlsv1.3 $URL
-See-also: tlsv1.2 tls-max
-Multi: mutex
----
-Forces curl to use TLS version 1.3 or later when connecting to a remote TLS
-server.
-
-If the connection is done without TLS, this option has no effect. This
-includes QUIC-using (HTTP/3) transfers.
-
-Note that TLS 1.3 is not supported by all TLS backends.
diff --git a/third-party/curl/docs/cmdline-opts/tlsv1.3.md b/third-party/curl/docs/cmdline-opts/tlsv1.3.md
new file mode 100644
index 0000000000..6f14eccb5a
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/tlsv1.3.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: tlsv1.3
+Help: TLSv1.3 or greater
+Protocols: TLS
+Added: 7.52.0
+Category: tls
+Multi: mutex
+See-also:
+  - tlsv1.2
+  - tls-max
+Example:
+  - --tlsv1.3 $URL
+---
+
+# `--tlsv1.3`
+
+Force curl to use TLS version 1.3 or later when connecting to a remote TLS
+server.
+
+If the connection is done without TLS, this option has no effect. This
+includes QUIC-using (HTTP/3) transfers.
+
+Note that TLS 1.3 is not supported by all TLS backends.
diff --git a/third-party/curl/docs/cmdline-opts/tlsv1.d b/third-party/curl/docs/cmdline-opts/tlsv1.d
deleted file mode 100644
index 16aee71a30..0000000000
--- a/third-party/curl/docs/cmdline-opts/tlsv1.d
+++ /dev/null
@@ -1,17 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Short: 1
-Long: tlsv1
-Tags: Versions
-Protocols: TLS
-Added: 7.9.2
-Mutexed: tlsv1.1 tlsv1.2 tlsv1.3
-Requires: TLS
-See-also: http1.1 http2
-Help: Use TLSv1.0 or greater
-Category: tls
-Example: --tlsv1 $URL
-Multi: mutex
----
-Tells curl to use at least TLS version 1.x when negotiating with a remote TLS
-server. That means TLS version 1.0 or higher
diff --git a/third-party/curl/docs/cmdline-opts/tlsv1.md b/third-party/curl/docs/cmdline-opts/tlsv1.md
new file mode 100644
index 0000000000..c6fc9e9230
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/tlsv1.md
@@ -0,0 +1,24 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Short: 1
+Long: tlsv1
+Tags: Versions
+Protocols: TLS
+Added: 7.9.2
+Mutexed: tlsv1.1 tlsv1.2 tlsv1.3
+Requires: TLS
+Help: TLSv1.0 or greater
+Category: tls
+Multi: mutex
+See-also:
+  - http1.1
+  - http2
+Example:
+  - --tlsv1 $URL
+---
+
+# `--tlsv1`
+
+Use at least TLS version 1.x when negotiating with a remote TLS server. That
+means TLS version 1.0 or higher
diff --git a/third-party/curl/docs/cmdline-opts/tr-encoding.d b/third-party/curl/docs/cmdline-opts/tr-encoding.d
deleted file mode 100644
index 053e18ca10..0000000000
--- a/third-party/curl/docs/cmdline-opts/tr-encoding.d
+++ /dev/null
@@ -1,13 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: tr-encoding
-Added: 7.21.6
-Help: Request compressed transfer encoding
-Protocols: HTTP
-Category: http
-Example: --tr-encoding $URL
-See-also: compressed
-Multi: boolean
----
-Request a compressed Transfer-Encoding response using one of the algorithms
-curl supports, and uncompress the data while receiving it.
diff --git a/third-party/curl/docs/cmdline-opts/tr-encoding.md b/third-party/curl/docs/cmdline-opts/tr-encoding.md
new file mode 100644
index 0000000000..c364c07d4b
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/tr-encoding.md
@@ -0,0 +1,24 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: tr-encoding
+Added: 7.21.6
+Help: Request compressed transfer encoding
+Protocols: HTTP
+Category: http
+Multi: boolean
+See-also:
+  - compressed
+Example:
+  - --tr-encoding $URL
+---
+
+# `--tr-encoding`
+
+Request a compressed Transfer-Encoding response using one of the algorithms
+curl supports, and uncompress the data while receiving it.
+
+This method was once intended to be the way to do automatic data compression
+for HTTP but for all practical purposes using Content-Encoding as done with
+--compressed has superseded transfer encoding. The --tr-encoding option is
+therefore often not be one you want.
diff --git a/third-party/curl/docs/cmdline-opts/trace-ascii.d b/third-party/curl/docs/cmdline-opts/trace-ascii.d
deleted file mode 100644
index 2aebc28631..0000000000
--- a/third-party/curl/docs/cmdline-opts/trace-ascii.d
+++ /dev/null
@@ -1,24 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: trace-ascii
-Arg: <file>
-Help: Like --trace, but without hex output
-Mutexed: trace verbose
-Category: verbose
-Example: --trace-ascii log.txt $URL
-Added: 7.9.7
-See-also: verbose trace
-Multi: single
-Scope: global
----
-Enables a full trace dump of all incoming and outgoing data, including
-descriptive information, to the given output file. Use "-" as filename to have
-the output sent to stdout.
-
-This is similar to --trace, but leaves out the hex part and only shows the
-ASCII part of the dump. It makes smaller output that might be easier to read
-for untrained humans.
-
-Note that verbose output of curl activities and network traffic might contain
-sensitive data, including user names, credentials or secret data content. Be
-aware and be careful when sharing trace logs with others.
diff --git a/third-party/curl/docs/cmdline-opts/trace-ascii.md b/third-party/curl/docs/cmdline-opts/trace-ascii.md
new file mode 100644
index 0000000000..f46f0a6f35
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/trace-ascii.md
@@ -0,0 +1,31 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: trace-ascii
+Arg: <file>
+Help: Like --trace, but without hex output
+Mutexed: trace verbose
+Category: verbose global
+Added: 7.9.7
+Multi: single
+Scope: global
+See-also:
+  - verbose
+  - trace
+Example:
+  - --trace-ascii log.txt $URL
+---
+
+# `--trace-ascii`
+
+Save a full trace dump of all incoming and outgoing data, including
+descriptive information, in the given output file. Use `-` as filename to have
+the output sent to stdout. Use `%` as filename to send the output to stderr.
+
+This is similar to --trace, but leaves out the hex part and only shows the
+ASCII part of the dump. It makes smaller output that might be easier to read
+for untrained humans.
+
+Note that verbose output of curl activities and network traffic might contain
+sensitive data, including usernames, credentials or secret data content. Be
+aware and be careful when sharing trace logs with others.
diff --git a/third-party/curl/docs/cmdline-opts/trace-config.d b/third-party/curl/docs/cmdline-opts/trace-config.d
deleted file mode 100644
index 06d6d77b92..0000000000
--- a/third-party/curl/docs/cmdline-opts/trace-config.d
+++ /dev/null
@@ -1,21 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: trace-config
-Arg: <string>
-Help: enable
-Mutexed: trace verbose
-Category: verbose
-Example: --trace-config ids,http/2 $URL
-Added: 8.3.0
-See-also: verbose trace
-Multi: append
-Scope: global
----
-Set configuration for trace output. A comma-separated list of components where
-detailed output can be made available from. Names are case-insensitive.
-Specify 'all' to enable all trace components.
-
-In addition to trace component names, specify "ids" and "time" to
-avoid extra --trace-ids or --trace-time parameters.
-
-See the *curl_global_trace(3)* man page for more details.
diff --git a/third-party/curl/docs/cmdline-opts/trace-config.md b/third-party/curl/docs/cmdline-opts/trace-config.md
new file mode 100644
index 0000000000..2f095401d2
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/trace-config.md
@@ -0,0 +1,27 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: trace-config
+Arg: <string>
+Help: Details to log in trace/verbose output
+Category: verbose global
+Added: 8.3.0
+Multi: append
+Scope: global
+See-also:
+  - verbose
+  - trace
+Example:
+  - --trace-config ids,http/2 $URL
+---
+
+# `--trace-config`
+
+Set configuration for trace output. A comma-separated list of components where
+detailed output can be made available from. Names are case-insensitive.
+Specify 'all' to enable all trace components.
+
+In addition to trace component names, specify `ids` and `time` to avoid extra
+--trace-ids or --trace-time parameters.
+
+See the *curl_global_trace(3)* man page for more details.
diff --git a/third-party/curl/docs/cmdline-opts/trace-ids.d b/third-party/curl/docs/cmdline-opts/trace-ids.d
deleted file mode 100644
index 7b8ce6f70a..0000000000
--- a/third-party/curl/docs/cmdline-opts/trace-ids.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: trace-ids
-Help: Add transfer and connection identifiers to trace/verbose output
-Added: 8.2.0
-Category: verbose
-Example: --trace-ids --trace-ascii output $URL
-See-also: trace verbose
-Multi: boolean
-Scope: global
----
-Prepends the transfer and connection identifiers to each trace or verbose line that curl displays.
diff --git a/third-party/curl/docs/cmdline-opts/trace-ids.md b/third-party/curl/docs/cmdline-opts/trace-ids.md
new file mode 100644
index 0000000000..302631d844
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/trace-ids.md
@@ -0,0 +1,24 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: trace-ids
+Help: Transfer + connection ids in verbose output
+Added: 8.2.0
+Category: verbose global
+Multi: boolean
+Scope: global
+See-also:
+  - trace
+  - verbose
+Example:
+  - --trace-ids --trace-ascii output $URL
+---
+
+# `--trace-ids`
+
+Prepend the transfer and connection identifiers to each trace or verbose line
+that curl displays.
+
+The identifiers are unique numbers assigned to each connection and transfer to
+allow a user to better understand which transfer and connection each verbose
+output line refers to.
diff --git a/third-party/curl/docs/cmdline-opts/trace-time.d b/third-party/curl/docs/cmdline-opts/trace-time.d
deleted file mode 100644
index f40ee02d7c..0000000000
--- a/third-party/curl/docs/cmdline-opts/trace-time.d
+++ /dev/null
@@ -1,12 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: trace-time
-Help: Add time stamps to trace/verbose output
-Added: 7.14.0
-Category: verbose
-Example: --trace-time --trace-ascii output $URL
-See-also: trace verbose
-Multi: boolean
-Scope: global
----
-Prepends a time stamp to each trace or verbose line that curl displays.
diff --git a/third-party/curl/docs/cmdline-opts/trace-time.md b/third-party/curl/docs/cmdline-opts/trace-time.md
new file mode 100644
index 0000000000..baa7b8800f
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/trace-time.md
@@ -0,0 +1,19 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: trace-time
+Help: Add time stamps to trace/verbose output
+Added: 7.14.0
+Category: verbose global
+Multi: boolean
+Scope: global
+See-also:
+  - trace
+  - verbose
+Example:
+  - --trace-time --trace-ascii output $URL
+---
+
+# `--trace-time`
+
+Prepend a time stamp to each trace or verbose line that curl displays.
diff --git a/third-party/curl/docs/cmdline-opts/trace.d b/third-party/curl/docs/cmdline-opts/trace.d
deleted file mode 100644
index 35b2248e90..0000000000
--- a/third-party/curl/docs/cmdline-opts/trace.d
+++ /dev/null
@@ -1,21 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: trace
-Arg: <file>
-Help: Write a debug trace to FILE
-Mutexed: verbose trace-ascii
-Category: verbose
-Example: --trace log.txt $URL
-Added: 7.9.7
-See-also: trace-ascii trace-config trace-ids trace-time
-Multi: single
-Scope: global
----
-Enables a full trace dump of all incoming and outgoing data, including
-descriptive information, to the given output file. Use "-" as filename to have
-the output sent to stdout. Use "%" as filename to have the output sent to
-stderr.
-
-Note that verbose output of curl activities and network traffic might contain
-sensitive data, including user names, credentials or secret data content. Be
-aware and be careful when sharing trace logs with others.
diff --git a/third-party/curl/docs/cmdline-opts/trace.md b/third-party/curl/docs/cmdline-opts/trace.md
new file mode 100644
index 0000000000..875e756fd1
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/trace.md
@@ -0,0 +1,30 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: trace
+Arg: <file>
+Help: Write a debug trace to FILE
+Mutexed: verbose trace-ascii
+Category: verbose global
+Added: 7.9.7
+Multi: single
+Scope: global
+See-also:
+  - trace-ascii
+  - trace-config
+  - trace-ids
+  - trace-time
+Example:
+  - --trace log.txt $URL
+---
+
+# `--trace`
+
+Save a full trace dump of all incoming and outgoing data, including
+descriptive information, in the given output file. Use `-` as filename to have
+the output sent to stdout. Use `%` as filename to have the output sent to
+stderr.
+
+Note that verbose output of curl activities and network traffic might contain
+sensitive data, including usernames, credentials or secret data content. Be
+aware and be careful when sharing trace logs with others.
diff --git a/third-party/curl/docs/cmdline-opts/unix-socket.d b/third-party/curl/docs/cmdline-opts/unix-socket.d
deleted file mode 100644
index 5ea56ebf15..0000000000
--- a/third-party/curl/docs/cmdline-opts/unix-socket.d
+++ /dev/null
@@ -1,13 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: unix-socket
-Arg: <path>
-Help: Connect through this Unix domain socket
-Added: 7.40.0
-Protocols: HTTP
-Category: connection
-See-also: abstract-unix-socket
-Example: --unix-socket socket-path $URL
-Multi: single
----
-Connect through this Unix domain socket, instead of using the network.
diff --git a/third-party/curl/docs/cmdline-opts/unix-socket.md b/third-party/curl/docs/cmdline-opts/unix-socket.md
new file mode 100644
index 0000000000..34cc714f79
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/unix-socket.md
@@ -0,0 +1,22 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: unix-socket
+Arg: <path>
+Help: Connect through this Unix domain socket
+Added: 7.40.0
+Protocols: HTTP
+Category: connection
+Multi: single
+See-also:
+  - abstract-unix-socket
+Example:
+  - --unix-socket socket-path $URL
+---
+
+# `--unix-socket`
+
+Connect to the server through this Unix domain socket, instead of using the
+network.
+
+To connect to a proxy over Unix domain socket, see --proxy.
diff --git a/third-party/curl/docs/cmdline-opts/upload-file.d b/third-party/curl/docs/cmdline-opts/upload-file.d
deleted file mode 100644
index e89390ab8c..0000000000
--- a/third-party/curl/docs/cmdline-opts/upload-file.d
+++ /dev/null
@@ -1,37 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: upload-file
-Short: T
-Arg: <file>
-Help: Transfer local FILE to destination
-Category: important upload
-Example: -T file $URL
-Example: -T "img[1-1000].png" ftp://ftp.example.com/
-Example: --upload-file "{file1,file2}" $URL
-Added: 4.0
-See-also: get head
-Multi: append
----
-This transfers the specified local file to the remote URL.
-
-If there is no file part in the specified URL, curl appends the local file
-name to the end of the URL before the operation starts. You must use a
-trailing slash (/) on the last directory to prove to curl that there is no
-file name or curl thinks that your last directory name is the remote file name
-to use. If this is used on an HTTP(S) server, the PUT command is used.
-
-Use the file name "-" (a single dash) to use stdin instead of a given file.
-Alternately, the file name "." (a single period) may be specified instead of
-"-" to use stdin in non-blocking mode to allow reading server output while
-stdin is being uploaded.
-
-You can specify one --upload-file for each URL on the command line. Each
---upload-file + URL pair specifies what to upload and to where. curl also
-supports "globbing" of the --upload-file argument, meaning that you can upload
-multiple files to a single URL by using the same URL globbing style supported
-in the URL.
-
-When uploading to an SMTP server: the uploaded data is assumed to be RFC 5322
-formatted. It has to feature the necessary set of headers and mail body
-formatted correctly by the user as curl does not transcode nor encode it
-further in any way.
diff --git a/third-party/curl/docs/cmdline-opts/upload-file.md b/third-party/curl/docs/cmdline-opts/upload-file.md
new file mode 100644
index 0000000000..1988d8afb7
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/upload-file.md
@@ -0,0 +1,63 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: upload-file
+Short: T
+Arg: <file>
+Help: Transfer local FILE to destination
+Category: important upload
+Added: 4.0
+Multi: per-URL
+See-also:
+  - get
+  - head
+  - request
+  - data
+Example:
+  - -T file $URL
+  - -T "img[1-1000].png" ftp://ftp.example.com/
+  - --upload-file "{file1,file2}" $URL
+  - -T file -T file2 $URL $URL
+---
+
+# `--upload-file`
+
+Upload the specified local file to the remote URL.
+
+If there is no file part in the specified URL, curl appends the local file
+name to the end of the URL before the operation starts. You must use a
+trailing slash (`/`) on the last directory to prove to curl that there is no
+filename or curl thinks that your last directory name is the remote filename
+to use.
+
+When putting the local filename at the end of the URL, curl ignores what is on
+the left side of any slash (`/`) or backslash (`\\`) used in the filename and
+only appends what is on the right side of the rightmost such character.
+
+Use the filename `-` (a single dash) to use stdin instead of a given file.
+Alternately, the filename `.` (a single period) may be specified instead of
+`-` to use stdin in non-blocking mode to allow reading server output while
+stdin is being uploaded.
+
+If this option is used with an HTTP(S) URL, the PUT method is used.
+
+You can specify one --upload-file for each URL on the command line. Each
+--upload-file + URL pair specifies what to upload and to where. curl also
+supports globbing of the --upload-file argument, meaning that you can upload
+multiple files to a single URL by using the same URL globbing style supported
+in the URL. Example:
+
+    curl --upload-file 'file{1,2,3}' ftp://ftp.example/
+
+Since curl 8.21.0, you can use parts of the upload filename when it uses
+globbing by setting a glob name and referencing that in the same way you
+reference named URL globs. For example, if you upload three files to a single
+fixed HTTP URL and want to save the corresponding responses in separate files:
+
+    curl -T 'file{<num>1,2,3}' \
+      https://upload.example/ -o 'response-#<num>'
+
+When uploading to an SMTP server (aka "sending email"): the uploaded data is
+assumed to be RFC 5322 formatted. It has to feature the necessary set of
+headers and mail body formatted correctly by the user as curl does not
+transcode nor encode it further in any way.
diff --git a/third-party/curl/docs/cmdline-opts/upload-flags.md b/third-party/curl/docs/cmdline-opts/upload-flags.md
new file mode 100644
index 0000000000..6c014d0895
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/upload-flags.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: upload-flags
+Arg: <flags>
+Help: IMAP upload behavior
+Protocols: IMAP
+Category: curl output
+Added: 8.13.0
+Multi: single
+See-also:
+  - upload-file
+Example:
+  - --upload-flags Flagged,!Seen --upload-file local/dir/file $URL
+---
+
+# `--upload-flags`
+
+Specify additional behavior to apply to uploaded files. Flags are
+specified as either a single flag value or a comma-separated list
+of flag values. These values are case-sensitive and may be negated
+by prepending them with a '-' character. Currently the following
+flag values are accepted: answered, deleted, draft, flagged, and
+seen. The currently accepted flag values are used to set flags on
+IMAP uploads.
diff --git a/third-party/curl/docs/cmdline-opts/url-query.d b/third-party/curl/docs/cmdline-opts/url-query.d
deleted file mode 100644
index 29b31e3383..0000000000
--- a/third-party/curl/docs/cmdline-opts/url-query.d
+++ /dev/null
@@ -1,25 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: url-query
-Arg: <data>
-Help: Add a URL query part
-Protocols: all
-See-also: data-urlencode get
-Added: 7.87.0
-Category: http post upload
-Example: --url-query name=val $URL
-Example: --url-query =encodethis http://example.net/foo
-Example: --url-query name@file $URL
-Example: --url-query @fileonly $URL
-Example: --url-query "+name=%20foo" $URL
-Multi: append
----
-This option adds a piece of data, usually a name + value pair, to the end of
-the URL query part. The syntax is identical to that used for --data-urlencode
-with one extension:
-
-If the argument starts with a '+' (plus), the rest of the string is provided
-as-is unencoded.
-
-The query part of a URL is the one following the question mark on the right
-end.
diff --git a/third-party/curl/docs/cmdline-opts/url-query.md b/third-party/curl/docs/cmdline-opts/url-query.md
new file mode 100644
index 0000000000..3953eda4c7
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/url-query.md
@@ -0,0 +1,31 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: url-query
+Arg: <data>
+Help: Add a URL query part
+Added: 7.87.0
+Category: http post upload
+Multi: append
+See-also:
+  - data-urlencode
+  - get
+Example:
+  - --url-query name=val $URL
+  - --url-query =encodethis http://example.net/foo
+  - --url-query name@file $URL
+  - --url-query @fileonly $URL
+  - --url-query "+name=%20foo" $URL
+---
+
+# `--url-query`
+
+Add a piece of data, usually a name + value pair, to the end of the URL query
+part. The syntax is identical to that used for --data-urlencode with one
+extension:
+
+If the argument starts with a '+' (plus), the rest of the string is provided
+as-is unencoded.
+
+The query part of a URL is the one following the question mark on the right
+end.
diff --git a/third-party/curl/docs/cmdline-opts/url.d b/third-party/curl/docs/cmdline-opts/url.d
deleted file mode 100644
index fa0421e08b..0000000000
--- a/third-party/curl/docs/cmdline-opts/url.d
+++ /dev/null
@@ -1,26 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: url
-Arg: <url>
-Help: URL to work with
-Category: curl
-Example: --url $URL
-Added: 7.5
-See-also: next config
-Multi: append
----
-Specify a URL to fetch. This option is mostly handy when you want to specify
-URL(s) in a config file.
-
-If the given URL is missing a scheme name (such as "http://" or "ftp://" etc)
-then curl makes a guess based on the host. If the outermost subdomain name
-matches DICT, FTP, IMAP, LDAP, POP3 or SMTP then that protocol is used,
-otherwise HTTP is used. Guessing can be avoided by providing a full URL
-including the scheme, or disabled by setting a default protocol (added in
-7.45.0), see --proto-default for details.
-
-To control where this URL is written, use the --output or the --remote-name
-options.
-
-**WARNING**: On Windows, particular file:// accesses can be converted to
-network accesses by the operating system. Beware!
diff --git a/third-party/curl/docs/cmdline-opts/url.md b/third-party/curl/docs/cmdline-opts/url.md
new file mode 100644
index 0000000000..e569dad5ad
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/url.md
@@ -0,0 +1,49 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: url
+Arg: <url/file>
+Help: URL(s) to work with
+Category: curl
+Added: 7.5
+Multi: append
+See-also:
+  - next
+  - config
+  - path-as-is
+  - disallow-username-in-url
+Example:
+  - --url $URL
+  - --url @file
+---
+
+# `--url`
+
+Specify a URL to fetch or send data to.
+
+If the given URL is missing a scheme (such as `http://` or `ftp://` etc) curl
+guesses which scheme to use based on the hostname. If the outermost subdomain
+name matches DICT, FTP, IMAP, LDAP, POP3 or SMTP case insensitively, then that
+protocol is used, otherwise it assumes HTTP. Scheme guessing can be avoided by
+providing a full URL including the scheme, or disabled by setting a default
+protocol, see --proto-default for details.
+
+To control where the contents of a retrieved URL is written instead of the
+default stdout, use the --output or the --remote-name options. When retrieving
+multiple URLs in a single invoke, each provided URL needs its own dedicated
+destination option unless --remote-name-all is used.
+
+On Windows, `file://` accesses can be converted to network accesses by the
+operating system.
+
+Starting in curl 8.13.0, curl can be told to download URLs provided in a text
+file, one URL per line. It is done with `--url @filename`: so instead of a
+URL, you specify a filename prefixed with the `@` symbol. It can be told to
+load the list of URLs from stdin by providing an argument like `@-`.
+
+When downloading URLs given in a file, it implies using --remote-name for each
+provided URL. The URLs are full, there is no globbing applied or done on
+these. Features such as --skip-existing work fine in combination with this.
+
+Lines in the URL file that start with `#` are treated as comments and are
+skipped.
diff --git a/third-party/curl/docs/cmdline-opts/use-ascii.d b/third-party/curl/docs/cmdline-opts/use-ascii.d
deleted file mode 100644
index 772992c17b..0000000000
--- a/third-party/curl/docs/cmdline-opts/use-ascii.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Short: B
-Long: use-ascii
-Help: Use ASCII/text transfer
-Protocols: FTP LDAP
-Category: misc
-Example: -B ftp://example.com/README
-Added: 5.0
-See-also: crlf data-ascii
-Multi: boolean
----
-Enable ASCII transfer. For FTP, this can also be enforced by using a URL that
-ends with ";type=A". This option causes data sent to stdout to be in text mode
-for win32 systems.
diff --git a/third-party/curl/docs/cmdline-opts/use-ascii.md b/third-party/curl/docs/cmdline-opts/use-ascii.md
new file mode 100644
index 0000000000..4dba446ffe
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/use-ascii.md
@@ -0,0 +1,23 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Short: B
+Long: use-ascii
+Help: Use ASCII/text transfer
+Protocols: FTP LDAP TFTP
+Category: ftp output ldap tftp
+Added: 5.0
+Multi: boolean
+See-also:
+  - crlf
+  - data-ascii
+Example:
+  - -B ftp://example.com/README
+---
+
+# `--use-ascii`
+
+Enable ASCII transfer mode. For FTP, this can also be enforced by using a URL
+that ends with `;type=A`. For TFTP, this can also be enforced by using a URL
+that ends with `;mode=netascii`. This option causes data sent to stdout to be
+in text mode for Win32 systems.
diff --git a/third-party/curl/docs/cmdline-opts/user-agent.d b/third-party/curl/docs/cmdline-opts/user-agent.d
deleted file mode 100644
index 1681b7e8b6..0000000000
--- a/third-party/curl/docs/cmdline-opts/user-agent.d
+++ /dev/null
@@ -1,20 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Short: A
-Long: user-agent
-Arg: <name>
-Help: Send User-Agent <name> to server
-Protocols: HTTP
-Category: important http
-Example: -A "Agent 007" $URL
-Added: 4.5.1
-See-also: header proxy-header
-Multi: single
----
-Specify the User-Agent string to send to the HTTP server. To encode blanks in
-the string, surround the string with single quote marks. This header can also
-be set with the --header or the --proxy-header options.
-
-If you give an empty argument to --user-agent (""), it removes the header
-completely from the request. If you prefer a blank header, you can set it to a
-single space (" ").
diff --git a/third-party/curl/docs/cmdline-opts/user-agent.md b/third-party/curl/docs/cmdline-opts/user-agent.md
new file mode 100644
index 0000000000..d81b65d34f
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/user-agent.md
@@ -0,0 +1,29 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Short: A
+Long: user-agent
+Arg: <name>
+Help: Send User-Agent <name> to server
+Protocols: HTTP
+Category: important http
+Added: 4.5.1
+Multi: single
+See-also:
+  - header
+  - proxy-header
+Example:
+  - -A "Agent 007" $URL
+---
+
+# `--user-agent`
+
+Specify the User-Agent string to send to the HTTP server. To encode blanks in
+the string, surround the string with single or double quote marks. This header
+can also be set with the --header or the --proxy-header options.
+
+If you give an empty argument to --user-agent (""), it removes the header
+completely from the request. If you prefer a blank header, you can set it to a
+single space (" ").
+
+By default, curl uses curl/VERSION, such as User-Agent: curl/`%VERSION`.
diff --git a/third-party/curl/docs/cmdline-opts/user.d b/third-party/curl/docs/cmdline-opts/user.d
deleted file mode 100644
index f776ab7ae4..0000000000
--- a/third-party/curl/docs/cmdline-opts/user.d
+++ /dev/null
@@ -1,44 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: user
-Short: u
-Arg: <user:password>
-Help: Server user and password
-Category: important auth
-Example: -u user:secret $URL
-Added: 4.0
-See-also: netrc config
-Multi: single
----
-Specify the user name and password to use for server authentication. Overrides
---netrc and --netrc-optional.
-
-If you simply specify the user name, curl prompts for a password.
-
-The user name and passwords are split up on the first colon, which makes it
-impossible to use a colon in the user name with this option. The password can,
-still.
-
-On systems where it works, curl hides the given option argument from process
-listings. This is not enough to protect credentials from possibly getting seen
-by other users on the same system as they still are visible for a brief moment
-before cleared. Such sensitive data should be retrieved from a file instead or
-similar and never used in clear text in a command line.
-
-When using Kerberos V5 with a Windows based server you should include the
-Windows domain name in the user name, in order for the server to successfully
-obtain a Kerberos Ticket. If you do not, then the initial authentication
-handshake may fail.
-
-When using NTLM, the user name can be specified simply as the user name,
-without the domain, if there is a single domain and forest in your setup
-for example.
-
-To specify the domain name use either Down-Level Logon Name or UPN (User
-Principal Name) formats. For example, EXAMPLE\\user and user@example.com
-respectively.
-
-If you use a Windows SSPI-enabled curl binary and perform Kerberos V5,
-Negotiate, NTLM or Digest authentication then you can tell curl to select
-the user name and password from your environment by specifying a single colon
-with this option: "-u :".
diff --git a/third-party/curl/docs/cmdline-opts/user.md b/third-party/curl/docs/cmdline-opts/user.md
new file mode 100644
index 0000000000..d7600e0310
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/user.md
@@ -0,0 +1,50 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: user
+Short: u
+Arg: <user:password>
+Help: Server user and password
+Category: important auth
+Added: 4.0
+Multi: single
+See-also:
+  - netrc
+  - config
+Example:
+  - -u user:secret $URL
+---
+
+# `--user`
+
+Specify the username and password to use for server authentication. Overrides
+--netrc and --netrc-optional.
+
+If you specify only the username, curl prompts for a password.
+
+The username and passwords are split up on the first colon, which makes it
+impossible to use a colon in the username with this option. The password can,
+still.
+
+On systems where it works, curl hides the given option argument from process
+listings. This is not enough to protect credentials from possibly getting seen
+by other users on the same system as they still are visible for a moment
+before being cleared. Such sensitive data should be retrieved from a file
+instead or similar and never used in clear text in a command line.
+
+When using Kerberos V5 with a Windows based server you should include the
+Windows domain name in the username, in order for the server to successfully
+obtain a Kerberos Ticket. If you do not, then the initial authentication
+handshake may fail.
+
+When using NTLM, the username can be specified without the domain, if
+there is a single domain and forest in your setup for example.
+
+To specify the domain name use either Down-Level Logon Name or UPN (User
+Principal Name) formats. For example, EXAMPLE\user and user@example.com
+respectively.
+
+If you use a Windows SSPI-enabled curl binary and perform Kerberos V5,
+Negotiate, NTLM or Digest authentication then you can tell curl to select the
+username and password from your environment by specifying a single colon with
+this option: "-u :".
diff --git a/third-party/curl/docs/cmdline-opts/variable.d b/third-party/curl/docs/cmdline-opts/variable.d
deleted file mode 100644
index d7d773edab..0000000000
--- a/third-party/curl/docs/cmdline-opts/variable.d
+++ /dev/null
@@ -1,55 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: variable
-Arg: <[%]name=text/@file>
-Help: Set variable
-Category: curl
-Example: --variable name=smith $URL
-Added: 8.3.0
-See-also: config
-Multi: append
----
-Set a variable with "name=content" or "name@file" (where "file" can be stdin
-if set to a single dash (-)). The name is a case sensitive identifier that
-must consist of no other letters than a-z, A-Z, 0-9 or underscore. The
-specified content is then associated with this identifier.
-
-Setting the same variable name again overwrites the old contents with the new.
-
-The contents of a variable can be referenced in a later command line option
-when that option name is prefixed with "--expand-", and the name is used as
-"{{name}}" (without the quotes).
-
---variable can import environment variables into the name space. Opt to either
-require the environment variable to be set or provide a default value for the
-variable in case it is not already set.
-
---variable %name imports the variable called 'name' but exits with an error if
-that environment variable is not already set. To provide a default value if
-the environment variable is not set, use --variable %name=content or
---variable %name@content. Note that on some systems - but not all -
-environment variables are case insensitive.
-
-When expanding variables, curl supports a set of functions that can make the
-variable contents more convenient to use. You apply a function to a variable
-expansion by adding a colon and then list the desired functions in a
-comma-separated list that is evaluated in a left-to-right order. Variable
-content holding null bytes that are not encoded when expanded, causes an
-error.
-
-Available functions:
-.RS
-.TP 15
-**trim**
-removes all leading and trailing white space.
-.TP
-**json**
-outputs the content using JSON string quoting rules.
-.TP
-**url**
-shows the content URL (percent) encoded.
-.TP
-**b64**
-expands the variable base64 encoded
-.RE
-.IP
diff --git a/third-party/curl/docs/cmdline-opts/variable.md b/third-party/curl/docs/cmdline-opts/variable.md
new file mode 100644
index 0000000000..95affb263a
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/variable.md
@@ -0,0 +1,110 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: variable
+Arg: <[%]name=text/@file>
+Help: Set variable
+Category: curl
+Added: 8.3.0
+Multi: append
+See-also:
+  - config
+Example:
+  - --variable name=smith --expand-url "$URL/{{name}}"
+---
+
+# `--variable`
+
+Set a variable with `name=content` or `name@file` (where `file` can be stdin
+if set to a single dash (`-`)). The name is a case sensitive identifier that
+must consist of no other letters than a-z, A-Z, 0-9 or underscore. The
+specified content is then associated with this identifier.
+
+Setting the same variable name again overwrites the old contents with the new.
+
+The contents of a variable can be referenced in a later command line option
+when that option name is prefixed with `--expand-`, and the name is used as
+`{{name}}`.
+
+--variable can import environment variables into the name space. Opt to either
+require the environment variable to be set or provide a default value for the
+variable in case it is not already set.
+
+--variable %name imports the variable called `name` but exits with an error if
+that environment variable is not already set. To provide a default value if
+the environment variable is not set, use --variable %name=content or
+--variable %name@content. Note that on some systems - but not all -
+environment variables are case insensitive.
+
+Added in curl 8.12.0: you can get a byte range from the source by appending
+`[start-end]` to the variable name, where *start* and *end* are byte offsets
+to include from the contents. For example, asking for offset "2-10" means
+offset two to offset ten, inclusive, resulting in 9 bytes in total. `2-2`
+means a single byte at offset 2. Not providing a second number implies to the
+end of data. The start offset cannot be larger than the end offset. Asking for
+a range that is outside of the file size makes the variable contents empty.
+For example, getting the first one hundred bytes from a given file:
+
+    curl --variable "fraction[0-99]@filename"
+
+Given a byte range that has no data results in an empty string. Asking for a
+range that is larger than the content makes curl use the piece of the data
+that exists.
+
+To assign a variable using contents from another variable, use
+--expand-variable. Like for example assigning a new variable using contents
+from two other:
+
+    curl --expand-variable "user={{firstname}} {{lastname}}"
+
+When expanding variables, curl supports a set of functions that can make the
+variable contents more convenient to use. You apply a function to a variable
+expansion by adding a colon and then list the desired functions in a
+comma-separated list that is evaluated in a left-to-right order. Variable
+content holding null bytes that are not encoded when expanded causes an
+error.
+
+Available functions:
+
+## `trim`
+
+removes all leading and trailing white space.
+
+Example:
+
+    curl --expand-url https://example.com/{{var:trim}}
+
+## `json`
+
+outputs the content using JSON string quoting rules.
+
+Example:
+
+    curl --expand-data {{data:json}} https://example.com
+
+## `url`
+
+shows the content URL (percent) encoded.
+
+Example:
+
+    curl --expand-url https://example.com/{{path:url}}
+
+## `b64`
+
+expands the variable base64 encoded
+
+Example:
+
+    curl --expand-url https://example.com/{{var:b64}}
+
+## `64dec`
+
+decodes a base64 encoded character sequence. If the sequence is not possible
+to decode, it instead outputs `[64dec-fail]`
+
+Example:
+
+    curl --expand-url https://example.com/{{var:64dec}}
+
+(Added in 8.13.0)
diff --git a/third-party/curl/docs/cmdline-opts/verbose.d b/third-party/curl/docs/cmdline-opts/verbose.d
deleted file mode 100644
index c5661f86af..0000000000
--- a/third-party/curl/docs/cmdline-opts/verbose.d
+++ /dev/null
@@ -1,28 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Short: v
-Long: verbose
-Mutexed: trace trace-ascii
-Help: Make the operation more talkative
-See-also: include silent trace trace-ascii
-Category: important verbose
-Example: --verbose $URL
-Added: 4.0
-Multi: boolean
-Scope: global
----
-Makes curl verbose during the operation. Useful for debugging and seeing
-what's going on "under the hood". A line starting with '>' means "header data"
-sent by curl, '<' means "header data" received by curl that is hidden in
-normal cases, and a line starting with '*' means additional info provided by
-curl.
-
-If you only want HTTP headers in the output, --include or --dump-header might
-be more suitable options.
-
-If you think this option still does not give you enough details, consider using
---trace or --trace-ascii instead.
-
-Note that verbose output of curl activities and network traffic might contain
-sensitive data, including user names, credentials or secret data content. Be
-aware and be careful when sharing trace logs with others.
diff --git a/third-party/curl/docs/cmdline-opts/verbose.md b/third-party/curl/docs/cmdline-opts/verbose.md
new file mode 100644
index 0000000000..b5d6b57d64
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/verbose.md
@@ -0,0 +1,81 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Short: v
+Long: verbose
+Mutexed: trace trace-ascii
+Help: Make the operation more talkative
+Category: important verbose global
+Added: 4.0
+Multi: boolean
+Scope: global
+See-also:
+  - show-headers
+  - silent
+  - trace
+  - trace-ascii
+Example:
+  - --verbose $URL
+---
+
+# `--verbose`
+
+Make curl output verbose information during the operation. Useful for
+debugging and seeing what's going on under the hood. Verbose output lines are
+prefixed with letters:
+
+## >
+
+header sent by curl
+
+## <
+
+header received by curl
+
+## }
+
+data sent by curl
+
+## {
+
+data received by curl
+
+## *
+
+additional info provided by curl. Text that adds explanations what goes on and
+about choices curl does.
+
+##
+
+If you only want HTTP headers in the output, --show-headers or --dump-header
+might be more suitable options.
+
+Since curl 8.10, mentioning this option several times in the same argument
+increases the level of the trace output. As before, a single --verbose or
+--no-verbose reverts any additions by previous `-vv` again. This means that
+`-vv -v` is equivalent to a single -v. This avoids unwanted verbosity when the
+option is mentioned in the command line *and* curl config files.
+
+Using it twice, e.g. `-vv`, outputs time (--trace-time) and transfer ids
+(--trace-ids), as well as enabling tracing for all protocols (--trace-config
+protocol).
+
+Adding a third verbose outputs transfer content (--trace-ascii %) and enables
+tracing of more components (--trace-config read,write,ssl).
+
+A fourth time adds tracing of all network components. (--trace-config network).
+
+Any addition of the verbose option after that has no effect.
+
+If you think this option does not give you the right details, consider using
+--trace or --trace-ascii instead. Or use it only once and use --trace-config
+to trace the specific components you wish to see.
+
+Note that verbose output of curl activities and network traffic might contain
+sensitive data, including usernames, credentials or secret data content. Be
+aware and be careful when sharing trace logs with others.
+
+When the output contains protocol headers, those lines might include carriage
+return (ASCII code 13) characters, even on platforms that otherwise normally
+only use linefeed to signify line separations - as curl shows the exact
+contents arriving from the server.
diff --git a/third-party/curl/docs/cmdline-opts/version.d b/third-party/curl/docs/cmdline-opts/version.d
deleted file mode 100644
index 8d231ce0c3..0000000000
--- a/third-party/curl/docs/cmdline-opts/version.d
+++ /dev/null
@@ -1,88 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: version
-Short: V
-Help: Show version number and quit
-Category: important curl
-Example: --version
-Added: 4.0
-See-also: help manual
-Multi: custom
----
-Displays information about curl and the libcurl version it uses.
-
-The first line includes the full version of curl, libcurl and other 3rd party
-libraries linked with the executable.
-
-The second line (starts with "Release-Date:") shows the release date.
-
-The third line (starts with "Protocols:") shows all protocols that libcurl
-reports to support.
-
-The fourth line (starts with "Features:") shows specific features libcurl
-reports to offer. Available features include:
-.RS
-.IP "alt-svc"
-Support for the Alt-Svc: header is provided.
-.IP "AsynchDNS"
-This curl uses asynchronous name resolves. Asynchronous name resolves can be
-done using either the c-ares or the threaded resolver backends.
-.IP "brotli"
-Support for automatic brotli compression over HTTP(S).
-.IP "CharConv"
-curl was built with support for character set conversions (like EBCDIC)
-.IP "Debug"
-This curl uses a libcurl built with Debug. This enables more error-tracking
-and memory debugging etc. For curl-developers only!
-.IP "gsasl"
-The built-in SASL authentication includes extensions to support SCRAM because
-libcurl was built with libgsasl.
-.IP "GSS-API"
-GSS-API is supported.
-.IP "HSTS"
-HSTS support is present.
-.IP "HTTP2"
-HTTP/2 support has been built-in.
-.IP "HTTP3"
-HTTP/3 support has been built-in.
-.IP "HTTPS-proxy"
-This curl is built to support HTTPS proxy.
-.IP "IDN"
-This curl supports IDN - international domain names.
-.IP "IPv6"
-You can use IPv6 with this.
-.IP "Kerberos"
-Kerberos V5 authentication is supported.
-.IP "Largefile"
-This curl supports transfers of large files, files larger than 2GB.
-.IP "libz"
-Automatic decompression (via gzip, deflate) of compressed files over HTTP is
-supported.
-.IP "MultiSSL"
-This curl supports multiple TLS backends.
-.IP "NTLM"
-NTLM authentication is supported.
-.IP "NTLM_WB"
-NTLM delegation to winbind helper is supported.
-.IP "PSL"
-PSL is short for Public Suffix List and means that this curl has been built
-with knowledge about "public suffixes".
-.IP "SPNEGO"
-SPNEGO authentication is supported.
-.IP "SSL"
-SSL versions of various protocols are supported, such as HTTPS, FTPS, POP3S
-and so on.
-.IP "SSPI"
-SSPI is supported.
-.IP "TLS-SRP"
-SRP (Secure Remote Password) authentication is supported for TLS.
-.IP "TrackMemory"
-Debug memory tracking is supported.
-.IP "Unicode"
-Unicode support on Windows.
-.IP "UnixSockets"
-Unix sockets support is provided.
-.IP "zstd"
-Automatic decompression (via zstd) of compressed files over HTTP is supported.
-.RE
-.IP
diff --git a/third-party/curl/docs/cmdline-opts/version.md b/third-party/curl/docs/cmdline-opts/version.md
new file mode 100644
index 0000000000..35e9cf237a
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/version.md
@@ -0,0 +1,134 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: version
+Short: V
+Help: Show version number and quit
+Category: important curl
+Added: 4.0
+Multi: custom
+See-also:
+  - help
+  - manual
+Example:
+  - --version
+---
+
+# `--version`
+
+Display information about curl and the libcurl version it uses.
+
+The first line includes the full version of curl, libcurl and other 3rd party
+libraries linked with the executable.
+
+This line may contain one or more TLS libraries. curl can be built to support
+more than one TLS library which then makes curl - at start-up - select which
+particular backend to use for this invocation.
+
+If curl supports more than one TLS library like this, the ones that are *not*
+selected by default are listed within parentheses. Thus, if you do not specify
+which backend to use (with the `CURL_SSL_BACKEND` environment variable) the
+one listed without parentheses is used. Such builds also have `MultiSSL` set as
+a feature.
+
+The second line (starts with `Release-Date:`) shows the release date.
+
+The third line (starts with `Protocols:`) shows all protocols that libcurl
+reports to support.
+
+The fourth line (starts with `Features:`) shows specific features libcurl
+reports to offer. Available features include:
+
+## `alt-svc`
+Support for the Alt-Svc: header is provided.
+
+## `AsynchDNS`
+This curl uses asynchronous name resolves. Asynchronous name resolves can be
+done using either the c-ares or the threaded resolver backends.
+
+## `brotli`
+Support for automatic brotli compression over HTTP(S).
+
+## `CharConv`
+curl was built with support for character set conversions (like EBCDIC)
+
+## `Debug`
+This curl uses a libcurl built with Debug. This enables more error-tracking
+and memory debugging etc. For curl-developers only.
+
+## `ECH`
+ECH support is present.
+
+## `gsasl`
+The built-in SASL authentication includes extensions to support SCRAM because
+libcurl was built with libgsasl.
+
+## `GSS-API`
+GSS-API is supported.
+
+## `HSTS`
+HSTS support is present.
+
+## `HTTP2`
+HTTP/2 support has been built-in.
+
+## `HTTP3`
+HTTP/3 support has been built-in.
+
+## `HTTPS-proxy`
+This curl is built to support HTTPS proxy.
+
+## `IDN`
+This curl supports IDN - international domain names.
+
+## `IPv6`
+You can use IPv6 with this.
+
+## `Kerberos`
+Kerberos V5 authentication is supported.
+
+## `Largefile`
+This curl supports transfers of large files, files larger than 2GB.
+
+## `libz`
+Automatic decompression (via gzip, deflate) of compressed files over HTTP is
+supported.
+
+## `MultiSSL`
+This curl supports multiple TLS backends.
+
+## `NTLM`
+NTLM authentication is supported.
+
+## `NTLM_WB`
+NTLM delegation to winbind helper is supported.
+This feature was removed from curl in 8.8.0.
+
+## `PSL`
+PSL is short for Public Suffix List and means that this curl has been built
+with knowledge about "public suffixes".
+
+## `SPNEGO`
+SPNEGO authentication is supported.
+
+## `SSL`
+SSL versions of various protocols are supported, such as HTTPS, FTPS, POP3S
+and so on.
+
+## `SSLS-EXPORT`
+This build supports TLS session export/import, like with the --ssl-sessions.
+
+## `SSPI`
+SSPI is supported.
+
+## `TLS-SRP`
+SRP (Secure Remote Password) authentication is supported for TLS.
+
+## `Unicode`
+Unicode support on Windows.
+
+## `UnixSockets`
+Unix sockets support is provided.
+
+## `zstd`
+Automatic decompression (via zstd) of compressed files over HTTP is supported.
diff --git a/third-party/curl/docs/cmdline-opts/vlan-priority.md b/third-party/curl/docs/cmdline-opts/vlan-priority.md
new file mode 100644
index 0000000000..c49c659e5c
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/vlan-priority.md
@@ -0,0 +1,22 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: vlan-priority
+Arg: <priority>
+Help: Set VLAN priority
+Added: 8.9.0
+Category: connection
+Multi: single
+See-also:
+  - ip-tos
+Example:
+  - --vlan-priority 4 $URL
+---
+
+# `--vlan-priority`
+
+Set VLAN priority as defined in IEEE 802.1Q.
+
+This field is set on Ethernet level, and only works within a local network.
+
+The valid range for \<priority\> is 0 to 7.
diff --git a/third-party/curl/docs/cmdline-opts/write-out.d b/third-party/curl/docs/cmdline-opts/write-out.d
deleted file mode 100644
index b2ac2ec060..0000000000
--- a/third-party/curl/docs/cmdline-opts/write-out.d
+++ /dev/null
@@ -1,292 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: write-out
-Short: w
-Arg: <format>
-Help: Use output FORMAT after completion
-Category: verbose
-Example: -w '%{response_code}\\n' $URL
-Added: 6.5
-See-also: verbose head
-Multi: single
----
-Make curl display information on stdout after a completed transfer. The format
-is a string that may contain plain text mixed with any number of
-variables. The format can be specified as a literal "string", or you can have
-curl read the format from a file with "@filename" and to tell curl to read the
-format from stdin you write "@-".
-
-The variables present in the output format are substituted by the value or
-text that curl thinks fit, as described below. All variables are specified as
-%{variable_name} and to output a normal % you just write them as %%. You can
-output a newline by using \\n, a carriage return with \\r and a tab space with
-\\t.
-
-The output is by default written to standard output, but can be changed with
-%{stderr} and %output{}.
-
-Output HTTP headers from the most recent request by using *%header{name}*
-where *name* is the case insensitive name of the header (without the trailing
-colon). The header contents are exactly as sent over the network, with leading
-and trailing whitespace trimmed (added in 7.84.0).
-
-Select a specific target destination file to write the output to, by using
-*%output{name}* (added in curl 8.3.0) where *name* is the full file name. The
-output following that instruction is then written to that file. More than one
-*%output{}* instruction can be specified in the same write-out argument. If
-the file name cannot be created, curl leaves the output destination to the one
-used prior to the *%output{}* instruction. Use *%output{>>name}* to append
-data to an existing file.
-
-**NOTE:**
-In Windows the %-symbol is a special symbol used to expand environment
-variables. In batch files all occurrences of % must be doubled when using this
-option to properly escape. If this option is used at the command prompt then
-the % cannot be escaped and unintended expansion is possible.
-
-The variables available are:
-.RS
-.TP 15
-**certs**
-Output the certificate chain with details. Supported only by the OpenSSL,
-GnuTLS, Schannel and Secure Transport backends. (Added in 7.88.0)
-.TP
-**content_type**
-The Content-Type of the requested document, if there was any.
-.TP
-**errormsg**
-The error message. (Added in 7.75.0)
-.TP
-**exitcode**
-The numerical exit code of the transfer. (Added in 7.75.0)
-.TP
-**filename_effective**
-The ultimate filename that curl writes out to. This is only meaningful if curl
-is told to write to a file with the --remote-name or --output
-option. It's most useful in combination with the --remote-header-name
-option. (Added in 7.26.0)
-.TP
-**ftp_entry_path**
-The initial path curl ended up in when logging on to the remote FTP
-server. (Added in 7.15.4)
-.TP
-**header_json**
-A JSON object with all HTTP response headers from the recent transfer. Values
-are provided as arrays, since in the case of multiple headers there can be
-multiple values. (Added in 7.83.0)
-
-The header names provided in lowercase, listed in order of appearance over the
-wire. Except for duplicated headers. They are grouped on the first occurrence
-of that header, each value is presented in the JSON array.
-.TP
-**http_code**
-The numerical response code that was found in the last retrieved HTTP(S) or
-FTP(s) transfer.
-.TP
-**http_connect**
-The numerical code that was found in the last response (from a proxy) to a
-curl CONNECT request. (Added in 7.12.4)
-.TP
-**http_version**
-The http version that was effectively used. (Added in 7.50.0)
-.TP
-**json**
-A JSON object with all available keys.
-.TP
-**local_ip**
-The IP address of the local end of the most recently done connection - can be
-either IPv4 or IPv6. (Added in 7.29.0)
-.TP
-**local_port**
-The local port number of the most recently done connection. (Added in 7.29.0)
-.TP
-**method**
-The http method used in the most recent HTTP request. (Added in 7.72.0)
-.TP
-**num_certs**
-Number of server certificates received in the TLS handshake. Supported only by
-the OpenSSL, GnuTLS, Schannel and Secure Transport backends.
-(Added in 7.88.0)
-.TP
-**num_connects**
-Number of new connects made in the recent transfer. (Added in 7.12.3)
-.TP
-**num_headers**
-The number of response headers in the most recent request (restarted at each
-redirect). Note that the status line IS NOT a header. (Added in 7.73.0)
-.TP
-**num_redirects**
-Number of redirects that were followed in the request. (Added in 7.12.3)
-.TP
-**onerror**
-The rest of the output is only shown if the transfer returned a non-zero error.
-(Added in 7.75.0)
-.TP
-**proxy_ssl_verify_result**
-The result of the HTTPS proxy's SSL peer certificate verification that was
-requested. 0 means the verification was successful. (Added in 7.52.0)
-.TP
-**redirect_url**
-When an HTTP request was made without --location to follow redirects (or when
---max-redirs is met), this variable shows the actual URL a redirect
-*would* have gone to. (Added in 7.18.2)
-.TP
-**referer**
-The Referer: header, if there was any. (Added in 7.76.0)
-.TP
-**remote_ip**
-The remote IP address of the most recently done connection - can be either
-IPv4 or IPv6. (Added in 7.29.0)
-.TP
-**remote_port**
-The remote port number of the most recently done connection. (Added in 7.29.0)
-.TP
-**response_code**
-The numerical response code that was found in the last transfer (formerly
-known as "http_code"). (Added in 7.18.2)
-.TP
-**scheme**
-The URL scheme (sometimes called protocol) that was effectively used. (Added in 7.52.0)
-.TP
-**size_download**
-The total amount of bytes that were downloaded. This is the size of the
-body/data that was transferred, excluding headers.
-.TP
-**size_header**
-The total amount of bytes of the downloaded headers.
-.TP
-**size_request**
-The total amount of bytes that were sent in the HTTP request.
-.TP
-**size_upload**
-The total amount of bytes that were uploaded. This is the size of the
-body/data that was transferred, excluding headers.
-.TP
-**speed_download**
-The average download speed that curl measured for the complete download. Bytes
-per second.
-.TP
-**speed_upload**
-The average upload speed that curl measured for the complete upload. Bytes per
-second.
-.TP
-**ssl_verify_result**
-The result of the SSL peer certificate verification that was requested. 0
-means the verification was successful. (Added in 7.19.0)
-.TP
-**stderr**
-From this point on, the --write-out output is written to standard
-error. (Added in 7.63.0)
-.TP
-**stdout**
-From this point on, the --write-out output is written to standard output.
-This is the default, but can be used to switch back after switching to stderr.
-(Added in 7.63.0)
-.TP
-**time_appconnect**
-The time, in seconds, it took from the start until the SSL/SSH/etc
-connect/handshake to the remote host was completed. (Added in 7.19.0)
-.TP
-**time_connect**
-The time, in seconds, it took from the start until the TCP connect to the
-remote host (or proxy) was completed.
-.TP
-**time_namelookup**
-The time, in seconds, it took from the start until the name resolving was
-completed.
-.TP
-**time_pretransfer**
-The time, in seconds, it took from the start until the file transfer was just
-about to begin. This includes all pre-transfer commands and negotiations that
-are specific to the particular protocol(s) involved.
-.TP
-**time_redirect**
-The time, in seconds, it took for all redirection steps including name lookup,
-connect, pretransfer and transfer before the final transaction was
-started. time_redirect shows the complete execution time for multiple
-redirections. (Added in 7.12.3)
-.TP
-**time_starttransfer**
-The time, in seconds, it took from the start until the first byte is received.
-This includes time_pretransfer and also the time the server needed to calculate
-the result.
-.TP
-**time_total**
-The total time, in seconds, that the full operation lasted.
-.TP
-**url**
-The URL that was fetched. (Added in 7.75.0)
-.TP
-**url.scheme**
-The scheme part of the URL that was fetched. (Added in 8.1.0)
-.TP
-**url.user**
-The user part of the URL that was fetched. (Added in 8.1.0)
-.TP
-**url.password**
-The password part of the URL that was fetched. (Added in 8.1.0)
-.TP
-**url.options**
-The options part of the URL that was fetched. (Added in 8.1.0)
-.TP
-**url.host**
-The host part of the URL that was fetched. (Added in 8.1.0)
-.TP
-**url.port**
-The port number of the URL that was fetched. If no port number was specified,
-but the URL scheme is known, that scheme's default port number is
-shown. (Added in 8.1.0)
-.TP
-**url.path**
-The path part of the URL that was fetched. (Added in 8.1.0)
-.TP
-**url.query**
-The query part of the URL that was fetched. (Added in 8.1.0)
-.TP
-**url.fragment**
-The fragment part of the URL that was fetched. (Added in 8.1.0)
-.TP
-**url.zoneid**
-The zone id part of the URL that was fetched. (Added in 8.1.0)
-.TP
-**urle.scheme**
-The scheme part of the effective (last) URL that was fetched. (Added in 8.1.0)
-.TP
-**urle.user**
-The user part of the effective (last) URL that was fetched. (Added in 8.1.0)
-.TP
-**urle.password**
-The password part of the effective (last) URL that was fetched. (Added in 8.1.0)
-.TP
-**urle.options**
-The options part of the effective (last) URL that was fetched. (Added in 8.1.0)
-.TP
-**urle.host**
-The host part of the effective (last) URL that was fetched. (Added in 8.1.0)
-.TP
-**urle.port**
-The port number of the effective (last) URL that was fetched. If no port
-number was specified, but the URL scheme is known, that scheme's default port
-number is shown. (Added in 8.1.0)
-.TP
-**urle.path**
-The path part of the effective (last) URL that was fetched. (Added in 8.1.0)
-.TP
-**urle.query**
-The query part of the effective (last) URL that was fetched. (Added in 8.1.0)
-.TP
-**urle.fragment**
-The fragment part of the effective (last) URL that was fetched. (Added in 8.1.0)
-.TP
-**urle.zoneid**
-The zone id part of the effective (last) URL that was fetched. (Added in 8.1.0)
-.TP
-**urlnum**
-The URL index number of this transfer, 0-indexed. Unglobbed URLs share the
-same index number as the origin globbed URL. (Added in 7.75.0)
-.TP
-**url_effective**
-The URL that was fetched last. This is most meaningful if you have told curl
-to follow location: headers.
-.RE
-.IP
diff --git a/third-party/curl/docs/cmdline-opts/write-out.md b/third-party/curl/docs/cmdline-opts/write-out.md
new file mode 100644
index 0000000000..5cf9d91f87
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/write-out.md
@@ -0,0 +1,557 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: write-out
+Short: w
+Arg: <format>
+Help: Output FORMAT after completion
+Category: verbose
+Added: 6.5
+Multi: single
+See-also:
+  - verbose
+  - head
+Example:
+  - -w '%{response_code}\n' $URL
+---
+
+# `--write-out`
+
+Make curl display information on stdout after a completed transfer. The format
+is a string that may contain plain text mixed with any number of variables.
+The format can be specified as a literal "string", or you can have curl read
+the format from a file with "@filename" and to tell curl to read the format
+from stdin you write "@-".
+
+The variables present in the output format are substituted by the value or
+text that curl thinks fit, as described below. All variables are specified as
+%{variable_name} and to output a normal % you write them as %%. You can output
+a newline by using \n, a carriage return with \r and a tab space with \t.
+
+The output is by default written to standard output, but can be changed with
+%{stderr} and %output{}.
+
+Output HTTP header values from the transfer's most recent server response by
+using *%header{name}* where *name* is the case insensitive name of the header
+(without the trailing colon). The header contents are exactly as delivered over
+the network but with leading and trailing whitespace and newlines stripped off
+(added in 7.84.0).
+
+Select a specific target destination file to write the output to, by using
+*%output{name}* (added in curl 8.3.0) where *name* is the full filename. The
+output following that instruction is then written to that file. More than one
+*%output{}* instruction can be specified in the same write-out argument. If
+the filename cannot be created, curl leaves the output destination to the one
+used prior to the *%output{}* instruction. Use *%output{\>\>name}* to append
+data to an existing file.
+
+This output is done independently of if the file transfer was successful or
+not.
+
+If the specified action or output specified with this option fails in any way,
+it does not make curl return a (different) error.
+
+**NOTE:** On Windows, the %-symbol is a special symbol used to expand
+environment variables. In batch files, all occurrences of % must be doubled
+when using this option to properly escape. If this option is used at the
+command prompt then the % cannot be escaped and unintended expansion is
+possible.
+
+The variables available are:
+
+## `certs`
+Output the certificate chain with details. Supported only by the OpenSSL,
+GnuTLS, Schannel and Rustls backends. (Added in 7.88.0)
+
+## `conn_id`
+The connection identifier last used by the transfer. The connection id is
+unique number among all connections using the same connection cache.
+(Added in 8.2.0)
+
+## `content_type`
+The Content-Type of the requested document, if there was any.
+
+## `errormsg`
+The error message. (Added in 7.75.0)
+
+## `exitcode`
+The numerical exit code of the transfer. (Added in 7.75.0)
+
+## `filename_effective`
+The ultimate filename that curl writes out to. This is only meaningful if curl
+is told to write to a file with the --remote-name or --output option. It is
+most useful in combination with the --remote-header-name option.
+(Added in 7.26.0)
+
+## `ftp_entry_path`
+The initial path curl ended up in when logging on to the remote FTP
+server. (Added in 7.15.4)
+
+## `header{name}`
+The value of header `name` from the transfer's most recent server response.
+Unlike other variables, the variable name `header` is not in braces. For
+example `%header{date}`. Refer to --write-out remarks. (Added in 7.84.0)
+
+Starting with 8.17.0, output the contents of *all* header fields using a
+specific name - even for a whole redirect "chain" by appending
+`:all:[separator]` to the header name. The `[separator]` string (if not blank)
+is output between the headers if there are more than one. When more than one
+header is shown, they are output in the chronological order of appearance over
+the wire. To include a close brace (`}`) in the separator, escape it with a
+backslash: `\}`.
+
+## `header_json`
+A JSON object with all HTTP response headers from the recent transfer. Values
+are provided as arrays, since in the case of multiple headers there can be
+multiple values. (Added in 7.83.0)
+
+The header names provided in lowercase, listed in order of appearance over the
+wire. Except for duplicated headers. They are grouped on the first occurrence
+of that header, each value is presented in the JSON array.
+
+## `http_code`
+The numerical response code that was found in the last retrieved HTTP(S) or
+FTP(s) transfer.
+
+## `http_connect`
+The numerical code that was found in the last response (from a proxy) to a
+curl CONNECT request. (Added in 7.12.4)
+
+## `http_version`
+The http version that was effectively used. (Added in 7.50.0)
+
+## `json`
+A JSON object with all available keys except `header_json`. (Added in 7.70.0)
+
+## `local_ip`
+The IP address of the local end of the most recently done connection - can be
+either IPv4 or IPv6. (Added in 7.29.0)
+
+## `local_port`
+The local port number of the most recently done connection. (Added in 7.29.0)
+
+## `method`
+The http method used in the most recent HTTP request. (Added in 7.72.0)
+
+## `num_certs`
+Number of server certificates received in the TLS handshake. Supported only by
+the OpenSSL, GnuTLS, Schannel and Rustls backends. (Added in 7.88.0)
+
+## `num_connects`
+Number of new connects made in the recent transfer. (Added in 7.12.3)
+
+## `num_headers`
+The number of response headers in the most recent request (restarted at each
+redirect). Note that the status line IS NOT a header. (Added in 7.73.0)
+
+## `num_redirects`
+Number of redirects that were followed in the request. (Added in 7.12.3)
+
+## `num_retries`
+Number of retries actually performed when `--retry` has been used.
+(Added in 8.9.0)
+
+## `onerror`
+The rest of the output is only shown if the transfer returned a non-zero error.
+(Added in 7.75.0)
+
+## `output{filename}`
+From this point on, the --write-out output is written to the filename specified
+in braces. The filename can be prefixed with `>>` to append to the file. Unlike
+other variables, the variable name `output` is not in braces. For example
+`%output{>>stats.txt}`. Refer to --write-out remarks. (Added in 8.3.0)
+
+## `proxy_ssl_verify_result`
+The result of the HTTPS proxy's SSL peer certificate verification that was
+requested. 0 means the verification was successful. (Added in 7.52.0)
+
+## `proxy_used`
+Returns 1 if the previous transfer used a proxy, otherwise 0. Useful for
+example to determine if a `NOPROXY` pattern matched the hostname or not.
+(Added in 8.7.0)
+
+## `redirect_url`
+When an HTTP request was made without --location to follow redirects (or when
+--max-redirs is met), this variable shows the actual URL a redirect
+*would* have gone to. (Added in 7.18.2)
+
+## `referer`
+The Referer: header, if there was any. (Added in 7.76.0)
+
+## `remote_ip`
+The remote IP address of the most recently done connection - can be either
+IPv4 or IPv6. (Added in 7.29.0)
+
+## `remote_port`
+The remote port number of the most recently done connection. (Added in 7.29.0)
+
+## `response_code`
+The numerical response code that was found in the last transfer (formerly
+known as "http_code"). (Added in 7.18.2)
+
+## `scheme`
+The URL scheme (sometimes called protocol) that was effectively used. (Added in 7.52.0)
+
+## `size_delivered`
+The total amount of data that were saved or written to stdout. When
+--compressed is used, this is likely different than `size_download`. Includes
+the headers in the count if --include is used.
+
+## `size_download`
+The total amount of bytes that were downloaded. This is the size of the
+body/data that was transferred, excluding headers.
+
+## `size_header`
+The total amount of bytes of the downloaded headers, as represented in
+HTTP/1-style header format.
+
+## `size_request`
+The total amount of bytes that were sent in the HTTP request.
+
+## `size_upload`
+The total amount of bytes that were uploaded. This is the size of the
+body/data that was transferred, excluding headers.
+
+## `speed_download`
+The average download speed that curl measured for the complete download. Bytes
+per second.
+
+## `speed_upload`
+The average upload speed that curl measured for the complete upload. Bytes per
+second.
+
+## `ssl_verify_result`
+The result of the SSL peer certificate verification that was requested. 0
+means the verification was successful. (Added in 7.19.0)
+
+## `stderr`
+From this point on, the --write-out output is written to standard
+error. (Added in 7.63.0)
+
+## `stdout`
+From this point on, the --write-out output is written to standard output.
+This is the default, but can be used to switch back after switching to stderr.
+(Added in 7.63.0)
+
+## `time{format}`
+Output the current UTC time using `strftime()` format. See TIME OUTPUT FORMAT
+below for details. (Added in 8.16.0)
+
+## `time_appconnect`
+The time, in seconds, it took from the start until the SSL/SSH/etc
+connect/handshake to the remote host was completed. (Added in 7.19.0)
+
+## `time_connect`
+The time, in seconds, it took from the start until the TCP connect to the
+remote host (or proxy) was completed.
+
+## `time_namelookup`
+The time, in seconds, it took from the start until the name resolving was
+completed.
+
+## `time_posttransfer`
+The time, in seconds, it took from the start until the last byte is sent
+by libcurl. (Added in 8.10.0)
+
+## `time_pretransfer`
+The time, in seconds, it took from the start until immediately before the file
+transfer was about to begin. This includes all pre-transfer commands and
+negotiations that are specific to the particular protocol(s) involved.
+
+## `time_queue`
+The time, in seconds, the transfer was queued during its run. This adds
+the queue time for each redirect step that may have happened. Transfers
+may be queued for significant amounts of time when connection or parallel
+limits are in place. (Added in 8.12.0)
+
+## `time_redirect`
+The time, in seconds, it took for all redirection steps including name lookup,
+connect, pretransfer and transfer before the final transaction was
+started. `time_redirect` shows the complete execution time for multiple
+redirections. (Added in 7.12.3)
+
+## `time_starttransfer`
+The time, in seconds, it took from the start until the first byte was received.
+This includes time_pretransfer and also the time the server needed to calculate
+the result.
+
+## `time_total`
+The total time, in seconds, that the full operation lasted.
+
+## `tls_earlydata`
+The amount of bytes that were sent as TLSv1.3 early data. This is 0
+if this TLS feature was not used and negative if the data sent had
+been rejected by the server. The use of early data is enabled via
+the command line option `--tls-earlydata`. (Added in 8.13.0)
+
+## `url`
+The URL that was fetched. (Added in 7.75.0)
+
+## `url.scheme`
+The scheme part of the URL that was fetched. (Added in 8.1.0)
+
+## `url.user`
+The user part of the URL that was fetched. (Added in 8.1.0)
+
+## `url.password`
+The password part of the URL that was fetched. (Added in 8.1.0)
+
+## `url.options`
+The options part of the URL that was fetched. (Added in 8.1.0)
+
+## `url.host`
+The host part of the URL that was fetched. (Added in 8.1.0)
+
+## `url.port`
+The port number of the URL that was fetched. If no port number was specified
+and the URL scheme is known, that scheme's default port number is
+shown. (Added in 8.1.0)
+
+## `url.path`
+The path part of the URL that was fetched. (Added in 8.1.0)
+
+## `url.query`
+The query part of the URL that was fetched. (Added in 8.1.0)
+
+## `url.fragment`
+The fragment part of the URL that was fetched. (Added in 8.1.0)
+
+## `url.zoneid`
+The zone id part of the URL that was fetched. (Added in 8.1.0)
+
+## `urle.scheme`
+The scheme part of the effective (last) URL that was fetched. (Added in 8.1.0)
+
+## `urle.user`
+The user part of the effective (last) URL that was fetched. (Added in 8.1.0)
+
+## `urle.password`
+The password part of the effective (last) URL that was fetched. (Added in 8.1.0)
+
+## `urle.options`
+The options part of the effective (last) URL that was fetched. (Added in 8.1.0)
+
+## `urle.host`
+The host part of the effective (last) URL that was fetched. (Added in 8.1.0)
+
+## `urle.port`
+The port number of the effective (last) URL that was fetched. If no port
+number was specified, but the URL scheme is known, that scheme's default port
+number is shown. (Added in 8.1.0)
+
+## `urle.path`
+The path part of the effective (last) URL that was fetched. (Added in 8.1.0)
+
+## `urle.query`
+The query part of the effective (last) URL that was fetched. (Added in 8.1.0)
+
+## `urle.fragment`
+The fragment part of the effective (last) URL that was fetched. (Added in 8.1.0)
+
+## `urle.zoneid`
+The zone id part of the effective (last) URL that was fetched. (Added in 8.1.0)
+
+## `urlnum`
+The URL index number of this transfer, 0-indexed. Unglobbed URLs share the
+same index number as the origin globbed URL. (Added in 7.75.0)
+
+## `url_effective`
+The URL that was fetched last. This is most meaningful if you have told curl
+to follow location: headers.
+
+## `xfer_id`
+The numerical identifier of the last transfer done. -1 if no transfer has been
+started yet for the handle. The transfer id is unique among all transfers
+performed using the same connection cache.
+(Added in 8.2.0)
+
+##
+
+TIME OUTPUT FORMAT
+
+To show time with `%time{}` the characters within `{}` create a special format
+string that may contain special character sequences called conversion
+specifications. Each conversion specification starts with `%` and is followed
+by a character that instructs curl to output a particular time detail. All
+other characters used are displayed as-is.
+
+The following conversion specification are available:
+
+## `%a`
+
+The abbreviated name of the day of the week according to the current locale.
+
+## `%A`
+
+The full name of the day of the week according to the current locale.
+
+## `%b`
+
+The abbreviated month name according to the current locale.
+
+## `%B`
+
+The full month name according to the current locale.
+
+## `%c`
+
+The preferred date and time representation for the current locale. (In the
+POSIX locale this is equivalent to `%a %b %e %H:%M:%S %Y`.)
+
+## `%C`
+
+The century number (year/100) as a 2-digit integer.
+
+## `%d`
+
+The day of the month as a decimal number (range 01 to 31).
+
+## `%D`
+
+Equivalent to `%m/%d/%y`. In international contexts, this format is ambiguous
+and should be avoided.)
+
+## `%e`
+
+Like `%d`, the day of the month as a decimal number, but a leading zero is
+replaced by a space.
+
+## `%f`
+
+The number of microseconds elapsed of the current second. (This a curl special
+code and not a standard one.)
+
+## `%F`
+
+Equivalent to `%Y-%m-%d` (the ISO 8601 date format).
+
+## `%G`
+
+The ISO 8601 week-based year with century as a decimal number. The 4-digit
+year corresponding to the ISO week number (see `%V`). This has the same format
+and value as `%Y`, except that if the ISO week number belongs to the previous
+or next year, that year is used instead.
+
+## `%g`
+
+Like `%G`, but without century, that is, with a 2-digit year (00-99).
+
+## `%h`
+
+Equivalent to `%b`.
+
+## `%H`
+
+The hour as a decimal number using a 24-hour clock (range 00 to 23).
+
+## `%I`
+
+The hour as a decimal number using a 12-hour clock (range 01 to 12).
+
+## `%j`
+
+The day of the year as a decimal number (range 001 to 366).
+
+## `%k`
+
+The hour (24-hour clock) as a decimal number (range 0 to 23); single digits
+are preceded by a blank.
+
+## `%l`
+
+The hour (12-hour clock) as a decimal number (range 1 to 12); single digits
+are preceded by a blank.
+
+## `%m`
+
+The month as a decimal number (range 01 to 12).
+
+## `%M`
+
+The minute as a decimal number (range 00 to 59).
+
+## `%p`
+
+Either "AM" or "PM" according to the given time value, or the corresponding
+strings for the current locale. Noon is treated as "PM" and midnight as "AM".
+
+## `%P`
+
+Like `%p` but in lowercase: "am" or "pm" or a corresponding string for the
+current locale.
+
+## `%r`
+
+The time in am or pm notation.
+
+## `%R`
+
+The time in 24-hour notation (`%H:%M`). For a version including the seconds,
+see `%T` below.
+
+## `%s`
+
+The number of seconds since the Epoch, 1970-01-01 00:00:00 +0000 (UTC).
+
+## `%S`
+
+The second as a decimal number (range 00 to 60). (The range is up to 60 to
+allow for occasional leap seconds.) See `%f` for microseconds.
+
+## `%T`
+
+The time in 24-hour notation (`%H:%M:%S`).
+
+## `%u`
+
+The day of the week as a decimal, range 1 to 7, Monday being 1.
+
+## `%U`
+
+The week number of the current year as a decimal number, range 00 to 53,
+starting with the first Sunday as the first day of week 01. See also `%V` and
+`%W`.
+
+## `%V`
+
+The ISO 8601 week number (see NOTES) of the current year as a decimal number,
+range 01 to 53, where week 1 is the first week that has at least 4 days in the
+new year. See also `%U` and `%W`.
+
+## `%w`
+
+The day of the week as a decimal, range 0 to 6, Sunday being 0. See also `%u`.
+
+## `%W`
+
+The week number of the current year as a decimal number, range 00 to 53,
+starting with the first Monday as the first day of week 01.
+
+## `%x`
+
+The preferred date representation for the current locale without the time.
+
+## `%X`
+
+The preferred time representation for the current locale without the date.
+
+## `%y`
+
+The year as a decimal number without a century (range 00 to 99).
+
+## `%Y`
+
+The year as a decimal number including the century.
+
+## `%z`
+
+The `+hhmm` or `-hhmm` numeric timezone (that is, the hour and minute offset
+from UTC). As time is always UTC, this outputs `+0000`.
+
+## `%Z`
+
+The timezone name. For some reason `GMT`.
+
+## `%%`
+
+A literal `%` character.
diff --git a/third-party/curl/docs/cmdline-opts/xattr.d b/third-party/curl/docs/cmdline-opts/xattr.d
deleted file mode 100644
index 31bdb2d728..0000000000
--- a/third-party/curl/docs/cmdline-opts/xattr.d
+++ /dev/null
@@ -1,15 +0,0 @@
-c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-SPDX-License-Identifier: curl
-Long: xattr
-Help: Store metadata in extended file attributes
-Category: misc
-Example: --xattr -o storage $URL
-Added: 7.21.3
-See-also: remote-time write-out verbose
-Multi: boolean
----
-When saving output to a file, this option tells curl to store certain file
-metadata in extended file attributes. Currently, the URL is stored in the
-xdg.origin.url attribute and, for HTTP, the content type is stored in
-the mime_type attribute. If the file system does not support extended
-attributes, a warning is issued.
diff --git a/third-party/curl/docs/cmdline-opts/xattr.md b/third-party/curl/docs/cmdline-opts/xattr.md
new file mode 100644
index 0000000000..380cdbdfd3
--- /dev/null
+++ b/third-party/curl/docs/cmdline-opts/xattr.md
@@ -0,0 +1,25 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: xattr
+Help: Store metadata in extended file attributes
+Category: output
+Added: 7.21.3
+Multi: boolean
+See-also:
+  - remote-time
+  - write-out
+  - verbose
+Example:
+  - --xattr -o storage $URL
+---
+
+# `--xattr`
+
+Store metadata in the extended file attributes.
+
+When saving output to a file, tell curl to store file metadata in extended
+file attributes. Currently, `curl` is stored in the `creator` attribute,
+the URL is stored in the `xdg.origin.url` attribute and, for HTTP, the content
+type is stored in the `mime_type` attribute. If the file system does not
+support extended attributes, a warning is issued.
diff --git a/third-party/curl/docs/curl-config.1 b/third-party/curl/docs/curl-config.1
deleted file mode 100644
index 65cd2c9712..0000000000
--- a/third-party/curl/docs/curl-config.1
+++ /dev/null
@@ -1,105 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH curl-config 1 "25 Oct 2007" curl-config curl-config
-.SH NAME
-curl-config \- Get information about a libcurl installation
-.SH SYNOPSIS
-.B curl-config [options]
-.SH DESCRIPTION
-.B curl-config
-displays information about the curl and libcurl installation.
-.SH OPTIONS
-.IP "--ca"
-Displays the built-in path to the CA cert bundle this libcurl uses.
-.IP "--cc"
-Displays the compiler used to build libcurl.
-.IP "--cflags"
-Set of compiler options (CFLAGS) to use when compiling files that use
-libcurl. Currently that is only the include path to the curl include files.
-.IP "--checkfor [version]"
-Specify the oldest possible libcurl version string you want, and this
-script will return 0 if the current installation is new enough or it
-returns 1 and outputs a text saying that the current version is not new
-enough. (Added in 7.15.4)
-.IP "--configure"
-Displays the arguments given to configure when building curl.
-.IP "--feature"
-Lists what particular main features the installed libcurl was built with. At
-the time of writing, this list may include SSL, KRB4 or IPv6. Do not assume
-any particular order. The keywords will be separated by newlines. There may be
-none, one, or several keywords in the list.
-.IP "--help"
-Displays the available options.
-.IP "--libs"
-Shows the complete set of libs and other linker options you will need in order
-to link your application with libcurl.
-.IP "--prefix"
-This is the prefix used when libcurl was installed. Libcurl is then installed
-in $prefix/lib and its header files are installed in $prefix/include and so
-on. The prefix is set with "configure --prefix".
-.IP "--protocols"
-Lists what particular protocols the installed libcurl was built to support. At
-the time of writing, this list may include HTTP, HTTPS, FTP, FTPS, FILE,
-TELNET, LDAP, DICT and many more. Do not assume any particular order. The
-protocols will be listed using uppercase and are separated by newlines. There
-may be none, one, or several protocols in the list. (Added in 7.13.0)
-.IP "--ssl-backends"
-Lists the SSL backends that were enabled when libcurl was built. It might be
-no, one or several names. If more than one name, they will appear
-comma-separated. (Added in 7.58.0)
-.IP "--static-libs"
-Shows the complete set of libs and other linker options you will need in order
-to link your application with libcurl statically. (Added in 7.17.1)
-.IP "--version"
-Outputs version information about the installed libcurl.
-.IP "--vernum"
-Outputs version information about the installed libcurl, in numerical mode.
-This outputs the version number, in hexadecimal, with 8 bits for each part:
-major, minor, and patch. So that libcurl 7.7.4 would appear as 070704 and libcurl
-12.13.14 would appear as 0c0d0e... Note that the initial zero might be
-omitted. (This option was broken in the 7.15.0 release.)
-.SH "EXAMPLES"
-What linker options do I need when I link with libcurl?
-.nf
-  $ curl-config --libs
-.fi
-What compiler options do I need when I compile using libcurl functions?
-.nf
-  $ curl-config --cflags
-.fi
-How do I know if libcurl was built with SSL support?
-.nf
-  $ curl-config --feature | grep SSL
-.fi
-What's the installed libcurl version?
-.nf
-  $ curl-config --version
-.fi
-How do I build a single file with a one-line command?
-.nf
-  $ `curl-config --cc --cflags` -o example example.c `curl-config --libs`
-.fi
-.SH "SEE ALSO"
-.BR curl (1)
diff --git a/third-party/curl/docs/curl-config.md b/third-party/curl/docs/curl-config.md
new file mode 100644
index 0000000000..12ad245b79
--- /dev/null
+++ b/third-party/curl/docs/curl-config.md
@@ -0,0 +1,124 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl-config
+Section: 1
+Source: curl-config
+See-also:
+  - curl (1)
+Added-in: 7.7.2
+---
+
+# NAME
+
+curl-config - Get information about a libcurl installation
+
+# SYNOPSIS
+
+**curl-config [options]**
+
+# DESCRIPTION
+
+**curl-config**
+displays information about the curl and libcurl installation.
+
+# OPTIONS
+
+## `--ca`
+
+Displays the built-in path to the CA cert bundle this libcurl uses.
+
+## `--cc`
+
+Displays the compiler used to build libcurl.
+
+## `--cflags`
+
+Set of compiler options (CFLAGS) to use when compiling files that use
+libcurl. Currently that is only the include path to the curl include files.
+
+## `--checkfor [version]`
+
+Specify the oldest possible libcurl version string you want, and this script
+returns 0 if the current installation is new enough or it returns 1 and
+outputs a text saying that the current version is not new enough. (Added in
+7.15.4)
+
+## `--configure`
+
+Displays the arguments given to configure when building curl.
+
+## `--feature`
+
+Lists what particular main features the installed libcurl was built with. At
+the time of writing, this list may include SSL, KRB4 or IPv6. Do not assume
+any particular order. The keywords are separated by newlines. There may be
+none, one, or several keywords in the list.
+
+## `--help`
+
+Displays the available options.
+
+## `--libs`
+
+Shows the complete set of libs and other linker options you need in order to
+link your application with libcurl.
+
+## `--prefix`
+
+This is the prefix used when libcurl was installed. libcurl is then installed
+in $prefix/lib and its header files are installed in $prefix/include and so
+on. The prefix is set with `configure --prefix`.
+
+## `--protocols`
+
+Lists what particular protocols the installed libcurl was built to support. At
+the time of writing, this list may include HTTP, HTTPS, FTP, FTPS, FILE,
+TELNET, LDAP, DICT and many more. Do not assume any particular order. The
+protocols are listed using uppercase and are separated by newlines. There may
+be none, one, or several protocols in the list. (Added in 7.13.0)
+
+## `--ssl-backends`
+
+Lists the SSL backends that were enabled when libcurl was built. It might be
+no, one or several names. If more than one name, they appear comma-separated.
+(Added in 7.58.0)
+
+## `--static-libs`
+
+Shows the complete set of libs and other linker options you need in order to
+link your application with libcurl statically. (Added in 7.17.1)
+
+## `--version`
+
+Outputs version information about the installed libcurl.
+
+## `--vernum`
+
+Outputs version information about the installed libcurl, in numerical mode.
+This shows the version number, in hexadecimal, using 8 bits for each part:
+major, minor, and patch numbers. This makes libcurl 7.7.4 appear as 070704 and
+libcurl 12.13.14 appear as 0c0d0e... Note that the initial zero might be
+omitted. (This option was broken in the 7.15.0 release.)
+
+# EXAMPLES
+
+What linker options do I need when I link with libcurl?
+
+    $ curl-config --libs
+
+What compiler options do I need when I compile using libcurl functions?
+
+    $ curl-config --cflags
+
+How do I know if libcurl was built with SSL support?
+
+    $ curl-config --feature | grep SSL
+
+What's the installed libcurl version?
+
+    $ curl-config --version
+
+How do I build a single file with a one-line command?
+
+    $ `curl-config --cc --cflags` -o example source.c `curl-config --libs`
diff --git a/third-party/curl/docs/examples/.checksrc b/third-party/curl/docs/examples/.checksrc
index dea90aaa1d..6fbc5afcdc 100644
--- a/third-party/curl/docs/examples/.checksrc
+++ b/third-party/curl/docs/examples/.checksrc
@@ -1,3 +1,36 @@
-disable TYPEDEFSTRUCT
-disable SNPRINTF
-disable BANNEDFUNC
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+allowfunc atoi
+allowfunc atol
+allowfunc calloc
+allowfunc close
+allowfunc fclose
+allowfunc fdopen
+allowfunc fopen
+allowfunc fprintf
+allowfunc free
+allowfunc fstat
+allowfunc gmtime
+allowfunc localtime
+allowfunc malloc
+allowfunc open
+allowfunc printf
+allowfunc realloc
+allowfunc snprintf
+allowfunc socket
+allowfunc sscanf
+allowfunc strdup
+allowfunc strerror
+allowfunc vsnprintf
+
+# Use of curl printf functions is discouraged
+banfunc curl_maprintf
+banfunc curl_mfprintf
+banfunc curl_mprintf
+banfunc curl_msnprintf
+banfunc curl_mvaprintf
+banfunc curl_mvfprintf
+banfunc curl_mvprintf
+banfunc curl_mvsnprintf
diff --git a/third-party/curl/docs/examples/.gitignore b/third-party/curl/docs/examples/.gitignore
index f9a2c77976..c96ad91272 100644
--- a/third-party/curl/docs/examples/.gitignore
+++ b/third-party/curl/docs/examples/.gitignore
@@ -3,15 +3,23 @@
 # SPDX-License-Identifier: curl
 
 10-at-a-time
+address-scope
 altsvc
 anyauthput
+block_ip
+cacertinmem
 certinfo
 chkspeed
+connect-to
 cookie_interface
+crawler
 debug
+default-scheme
+ephiperfifo
+evhiperfifo
 externalsocket
 fileupload
-fopen
+ftp-delete
 ftp-wildcard
 ftpget
 ftpgetinfo
@@ -20,10 +28,16 @@ ftpsget
 ftpupload
 ftpuploadfrommem
 ftpuploadresume
-getreferrer
 getinfo
 getinmemory
 getredirect
+getreferrer
+ghiper
+headerapi
+hiperfifo
+hsts-preload
+htmltidy
+http-options
 http-post
 http2-download
 http2-pushinmemory
@@ -50,14 +64,22 @@ imap-search
 imap-ssl
 imap-store
 imap-tls
+interface
+ipv6
+keepalive
+localport
+log_failed_transfers
+maxconnects
 multi-app
 multi-debugcallback
 multi-double
+multi-event
 multi-formadd
 multi-legacy
-multi-poll
 multi-post
 multi-single
+multi-uv
+netrc
 parseurl
 persistent
 pop3-authzid
@@ -76,16 +98,20 @@ postinmemory
 postit2
 postit2-formadd
 progressfunc
+protofeats
+range
 resolve
-rtsp
+rtsp-options
 sendrecv
 sepheaders
+sessioninfo
 sftpget
 sftpuploadresume
 shared-connection-cache
 simple
 simplepost
 simplessl
+smooth-gtk-thread
 smtp-authzid
 smtp-expn
 smtp-mail
@@ -95,7 +121,13 @@ smtp-ssl
 smtp-tls
 smtp-vrfy
 sslbackend
-urlapi
+synctime
+threaded
+unixsocket
 url2file
+urlapi
 usercertinmem
+websocket
+websocket-cb
+websocket-updown
 xmlstream
diff --git a/third-party/curl/docs/examples/10-at-a-time.c b/third-party/curl/docs/examples/10-at-a-time.c
index b54a4410c0..d0982e0d41 100644
--- a/third-party/curl/docs/examples/10-at-a-time.c
+++ b/third-party/curl/docs/examples/10-at-a-time.c
@@ -25,131 +25,134 @@
  * Download many files in parallel, in the same thread.
  * </DESC>
  */
-
-#include <errno.h>
 #include <stdlib.h>
 #include <string.h>
-#ifndef WIN32
-#  include <unistd.h>
-#endif
+
 #include <curl/curl.h>
 
 static const char *urls[] = {
-  "https://www.microsoft.com",
-  "https://opensource.org",
-  "https://www.google.com",
-  "https://www.yahoo.com",
-  "https://www.ibm.com",
-  "https://www.mysql.com",
-  "https://www.oracle.com",
-  "https://www.ripe.net",
-  "https://www.iana.org",
-  "https://www.amazon.com",
-  "https://www.netcraft.com",
-  "https://www.heise.de",
-  "https://www.chip.de",
-  "https://www.ca.com",
-  "https://www.cnet.com",
-  "https://www.mozilla.org",
-  "https://www.cnn.com",
-  "https://www.wikipedia.org",
-  "https://www.dell.com",
-  "https://www.hp.com",
-  "https://www.cert.org",
-  "https://www.mit.edu",
-  "https://www.nist.gov",
-  "https://www.ebay.com",
-  "https://www.playstation.com",
-  "https://www.uefa.com",
-  "https://www.ieee.org",
-  "https://www.apple.com",
-  "https://www.symantec.com",
-  "https://www.zdnet.com",
-  "https://www.fujitsu.com/global/",
-  "https://www.supermicro.com",
-  "https://www.hotmail.com",
-  "https://www.ietf.org",
-  "https://www.bbc.co.uk",
-  "https://news.google.com",
-  "https://www.foxnews.com",
-  "https://www.msn.com",
-  "https://www.wired.com",
-  "https://www.sky.com",
-  "https://www.usatoday.com",
-  "https://www.cbs.com",
-  "https://www.nbc.com/",
-  "https://slashdot.org",
-  "https://www.informationweek.com",
-  "https://apache.org",
-  "https://www.un.org",
+  "https://01.example/",
+  "https://02.example/",
+  "https://03.example/",
+  "https://04.example/",
+  "https://05.example/",
+  "https://06.example/",
+  "https://07.example/",
+  "https://08.example/",
+  "https://09.example/",
+  "https://10.example/",
+  "https://11.example/",
+  "https://12.example/",
+  "https://13.example/",
+  "https://14.example/",
+  "https://15.example/",
+  "https://16.example/",
+  "https://17.example/",
+  "https://18.example/",
+  "https://19.example/",
+  "https://20.example/",
+  "https://21.example/",
+  "https://22.example/",
+  "https://23.example/",
+  "https://24.example/",
+  "https://25.example/",
+  "https://26.example/",
+  "https://27.example/",
+  "https://28.example/",
+  "https://29.example/",
+  "https://30.example/",
+  "https://31.example/",
+  "https://32.example/",
+  "https://33.example/",
+  "https://34.example/",
+  "https://35.example/",
+  "https://36.example/",
+  "https://37.example/",
+  "https://38.example/",
+  "https://39.example/",
+  "https://40.example/",
+  "https://41.example/",
+  "https://42.example/",
+  "https://43.example/",
+  "https://44.example/",
+  "https://45.example/",
+  "https://46.example/",
 };
 
-#define MAX_PARALLEL 10 /* number of simultaneous transfers */
-#define NUM_URLS sizeof(urls)/sizeof(char *)
+#define MAX_PARALLEL 10  /* number of simultaneous transfers */
+#define NUM_URLS     (sizeof(urls) / sizeof(char *))
 
 static size_t write_cb(char *data, size_t n, size_t l, void *userp)
 {
   /* take care of the data here, ignored in this example */
   (void)data;
   (void)userp;
-  return n*l;
+  return n * l;
 }
 
-static void add_transfer(CURLM *cm, int i, int *left)
+static void add_transfer(CURLM *multi, unsigned int i, int *left)
 {
-  CURL *eh = curl_easy_init();
-  curl_easy_setopt(eh, CURLOPT_WRITEFUNCTION, write_cb);
-  curl_easy_setopt(eh, CURLOPT_URL, urls[i]);
-  curl_easy_setopt(eh, CURLOPT_PRIVATE, urls[i]);
-  curl_multi_add_handle(cm, eh);
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
+    curl_easy_setopt(curl, CURLOPT_URL, urls[i]);
+    curl_easy_setopt(curl, CURLOPT_PRIVATE, urls[i]);
+    curl_multi_add_handle(multi, curl);
+  }
   (*left)++;
 }
 
 int main(void)
 {
-  CURLM *cm;
-  CURLMsg *msg;
-  unsigned int transfers = 0;
-  int msgs_left = -1;
-  int left = 0;
+  CURLM *multi;
 
-  curl_global_init(CURL_GLOBAL_ALL);
-  cm = curl_multi_init();
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  /* Limit the amount of simultaneous connections curl should allow: */
-  curl_multi_setopt(cm, CURLMOPT_MAXCONNECTS, (long)MAX_PARALLEL);
+  multi = curl_multi_init();
+  if(multi) {
+    CURLMsg *msg;
+    unsigned int transfers = 0;
+    int msgs_left = -1;
+    int left = 0;
 
-  for(transfers = 0; transfers < MAX_PARALLEL && transfers < NUM_URLS;
-      transfers++)
-    add_transfer(cm, transfers, &left);
+    /* Limit the amount of simultaneous connections curl should allow: */
+    curl_multi_setopt(multi, CURLMOPT_MAXCONNECTS, (long)MAX_PARALLEL);
 
-  do {
-    int still_alive = 1;
-    curl_multi_perform(cm, &still_alive);
+    for(transfers = 0; transfers < MAX_PARALLEL && transfers < NUM_URLS;
+        transfers++)
+      add_transfer(multi, transfers, &left);
 
-    while((msg = curl_multi_info_read(cm, &msgs_left))) {
-      if(msg->msg == CURLMSG_DONE) {
-        char *url;
-        CURL *e = msg->easy_handle;
-        curl_easy_getinfo(msg->easy_handle, CURLINFO_PRIVATE, &url);
-        fprintf(stderr, "R: %d - %s <%s>\n",
-                msg->data.result, curl_easy_strerror(msg->data.result), url);
-        curl_multi_remove_handle(cm, e);
-        curl_easy_cleanup(e);
-        left--;
+    do {
+      int still_alive = 1;
+      curl_multi_perform(multi, &still_alive);
+
+      /* !checksrc! disable EQUALSNULL 1 */
+      while((msg = curl_multi_info_read(multi, &msgs_left)) != NULL) {
+        if(msg->msg == CURLMSG_DONE) {
+          const char *url;
+          CURL *curl = msg->easy_handle;
+          curl_easy_getinfo(curl, CURLINFO_PRIVATE, &url);
+          fprintf(stderr, "R: %d - %s <%s>\n", (int)msg->data.result,
+                  curl_easy_strerror(msg->data.result), url);
+          curl_multi_remove_handle(multi, curl);
+          curl_easy_cleanup(curl);
+          left--;
+        }
+        else {
+          fprintf(stderr, "E: CURLMsg (%d)\n", (int)msg->msg);
+        }
+        if(transfers < NUM_URLS)
+          add_transfer(multi, transfers++, &left);
       }
-      else {
-        fprintf(stderr, "E: CURLMsg (%d)\n", msg->msg);
-      }
-      if(transfers < NUM_URLS)
-        add_transfer(cm, transfers++, &left);
-    }
-    if(left)
-      curl_multi_wait(cm, NULL, 0, 1000, NULL);
+      if(left)
+        curl_multi_wait(multi, NULL, 0, 1000, NULL);
 
-  } while(left);
+    } while(left);
 
-  curl_multi_cleanup(cm);
+    curl_multi_cleanup(multi);
+  }
   curl_global_cleanup();
 
   return EXIT_SUCCESS;
diff --git a/third-party/curl/docs/examples/CMakeLists.txt b/third-party/curl/docs/examples/CMakeLists.txt
new file mode 100644
index 0000000000..dc3313d6a2
--- /dev/null
+++ b/third-party/curl/docs/examples/CMakeLists.txt
@@ -0,0 +1,92 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+add_custom_target(curl-examples)
+
+# Get check_PROGRAMS, COMPLICATED_MAY_BUILD, COMPLICATED_EXAMPLES variables
+curl_transform_makefile_inc("Makefile.inc" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
+include("${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
+
+set(_with_deps "")
+set(_all_src "")
+set(_all_canary "")
+set(_all "all")
+foreach(_target IN LISTS COMPLICATED_MAY_BUILD check_PROGRAMS _all)  # keep 'COMPLICATED_MAY_BUILD' first, and '_all' last
+  # Strip .c suffix from COMPLICATED_MAY_BUILD items
+  if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.20)
+    cmake_path(GET _target STEM _target)
+  else()
+    get_filename_component(_target "${_target}" NAME_WE)
+  endif()
+  set(_more_libs "")
+  set(_target_name "curl-example-${_target}")
+  if(_target STREQUAL "all")
+    add_library(${_target_name} OBJECT EXCLUDE_FROM_ALL ${_all_src})
+    if(CMAKE_C_COMPILER_ID STREQUAL "MSVC")  # MSVC but exclude clang-cl
+      # CMake generates a static library for the OBJECT target. Silence these 'lib.exe' warnings:
+      # warning LNK4006: main already defined in ....obj; second definition ignored
+      # warning LNK4221: This object file does not define any previously undefined public symbols,
+      #                  [...] not be used by any link operation that consumes this library
+      set_target_properties(${_target_name} PROPERTIES STATIC_LIBRARY_OPTIONS "-ignore:4006;-ignore:4221")
+    endif()
+    if(_with_deps)
+      set(_more_libs ${CURL_LIBS})  # If any examples required dependencies, link them
+    endif()
+    add_custom_target(curl-examples-build)  # Special target to compile all tests quickly and build a single test to probe linkage
+    add_dependencies(curl-examples-build ${_target_name} ${_all_canary})  # Include a full build of a single test
+  else()
+    # Check if the example requires a build option. Then check if that build option is enabled.
+    # If it is, link all dependencies to the example.
+    set(_requires_regex "/\\* Requires: ([A-Z0-9_]+) \\*/")
+    file(STRINGS "${_target}.c" _req REGEX "${_requires_regex}")
+    string(REGEX REPLACE "${_requires_regex}" "\\1" _req "${_req}")
+    if(_req)
+      if(${${_req}})
+        string(APPEND _with_deps " ${_target}:${_req}")
+        set(_more_libs ${CURL_LIBS})
+      else()
+        continue()  # Option required, but not found
+      endif()
+    endif()
+    set(_all_canary ${_target_name})  # Save the last test for the curl-examples-build target
+    list(APPEND _all_src "${_target}.c")
+    add_executable(${_target_name} EXCLUDE_FROM_ALL "${_target}.c")
+    add_dependencies(curl-examples ${_target_name})
+  endif()
+  target_link_libraries(${_target_name} ${LIB_SELECTED} ${CURL_NETWORK_AND_TIME_LIBS} ${_more_libs})
+  target_compile_definitions(${_target_name} PRIVATE "CURL_NO_OLDIES" "$<$<BOOL:${WIN32}>:WIN32_LEAN_AND_MEAN>")
+  if(CURL_ANALYZER_CFLAGS)
+    set_property(TARGET ${_target_name} APPEND PROPERTY COMPILE_OPTIONS ${CURL_ANALYZER_CFLAGS})
+  endif()
+  set_target_properties(${_target_name} PROPERTIES OUTPUT_NAME "${_target}" PROJECT_LABEL "Example ${_target}" UNITY_BUILD OFF)
+endforeach()
+
+if(_with_deps)
+  message(STATUS "Enabled examples with dependencies:${_with_deps}")
+endif()
+
+if(CURL_BUILD_EVERYTHING STREQUAL "QUICK")
+  set_target_properties(curl-examples-build PROPERTIES EXCLUDE_FROM_ALL FALSE)
+elseif(CURL_BUILD_EVERYTHING AND NOT CURL_BUILD_EVERYTHING STREQUAL "NOEXAMPLES")
+  set_target_properties(curl-examples PROPERTIES EXCLUDE_FROM_ALL FALSE)
+endif()
diff --git a/third-party/curl/docs/examples/Makefile.am b/third-party/curl/docs/examples/Makefile.am
index 80ccc59251..0885b925c4 100644
--- a/third-party/curl/docs/examples/Makefile.am
+++ b/third-party/curl/docs/examples/Makefile.am
@@ -24,8 +24,8 @@
 
 AUTOMAKE_OPTIONS = foreign nostdinc
 
-EXTRA_DIST = README.md Makefile.example Makefile.inc Makefile.mk \
-  $(COMPLICATED_EXAMPLES) .checksrc
+EXTRA_DIST = CMakeLists.txt .checksrc README.md Makefile.example \
+  $(COMPLICATED_MAY_BUILD) $(COMPLICATED_EXAMPLES)
 
 # Specify our include paths here, and do it relative to $(top_srcdir) and
 # $(top_builddir), to ensure that these paths which belong to the library
@@ -34,32 +34,27 @@ EXTRA_DIST = README.md Makefile.example Makefile.inc Makefile.mk \
 #
 # $(top_srcdir)/include is for libcurl's external include files
 
-AM_CPPFLAGS = -I$(top_srcdir)/include   \
-              -DCURL_DISABLE_DEPRECATION
-
-LIBDIR = $(top_builddir)/lib
-
-# Avoid libcurl obsolete stuff
-AM_CPPFLAGS += -DCURL_NO_OLDIES
+AM_CPPFLAGS = -I$(top_srcdir)/include
 
 if USE_CPPFLAG_CURL_STATICLIB
 AM_CPPFLAGS += -DCURL_STATICLIB
 endif
+if DOING_NATIVE_WINDOWS
+AM_CPPFLAGS += -DWIN32_LEAN_AND_MEAN
+endif
+# Avoid libcurl obsolete stuff
+AM_CPPFLAGS += -DCURL_NO_OLDIES
 
 # Prevent LIBS from being used for all link targets
 LIBS = $(BLANK_AT_MAKETIME)
 
 # Dependencies
-if USE_EXPLICIT_LIB_DEPS
-LDADD = $(LIBDIR)/libcurl.la @LIBCURL_LIBS@
-else
-LDADD = $(LIBDIR)/libcurl.la
-endif
+LDADD = $(top_builddir)/lib/libcurl.la
 
 # This might hold -Werror
 CFLAGS += @CURL_CFLAG_EXTRAS@
 
-# Makefile.inc provides the check_PROGRAMS and COMPLICATED_EXAMPLES defines
+# Get check_PROGRAMS, COMPLICATED_MAY_BUILD, COMPLICATED_EXAMPLES variables
 include Makefile.inc
 
 all: $(check_PROGRAMS)
@@ -71,3 +66,10 @@ CS_ = $(CS_0)
 
 checksrc:
 	$(CHECKSRC)(@PERL@ $(top_srcdir)/scripts/checksrc.pl -D$(srcdir) $(srcdir)/*.c)
+
+if NOT_CURL_CI
+if DEBUGBUILD
+# for debug builds, we scan the sources on all regular make invokes
+all-local: checksrc
+endif
+endif
diff --git a/third-party/curl/docs/examples/Makefile.example b/third-party/curl/docs/examples/Makefile.example
index b10cdecf57..4031aa2e43 100644
--- a/third-party/curl/docs/examples/Makefile.example
+++ b/third-party/curl/docs/examples/Makefile.example
@@ -22,34 +22,29 @@
 #
 ###########################################################################
 
-# What to call the final executable
-TARGET = example
+SRC ?= https.c
 
-# Which object files that the executable consists of
-OBJS= ftpget.o
+# What to call the final executable
+TARGET ?= example
 
 # What compiler to use
-CC = gcc
+CC ?= gcc
 
-# Compiler flags, -g for debug, -c to make an object file
-CFLAGS = -c -g
+# Compiler flags, -g for debug
+CFLAGS ?= -g
 
-# This should point to a directory that holds libcurl, if it is not
-# in the system's standard lib dir
-# We also set a -L to include the directory where we have the openssl
-# libraries
-LDFLAGS = -L/home/dast/lib -L/usr/local/ssl/lib
+# This should point to a directory that holds libcurl, if it is not in the
+# system's standard lib dir
+# We also set a -L to include the directory where we have the OpenSSL libraries
+LDFLAGS ?= -L/usr/lib -L/usr/local/lib
 
-# We need -lcurl for the curl stuff
 # We need -lsocket and -lnsl when on Solaris
-# We need -lssl and -lcrypto when using libcurl with SSL support
+# We need -lssl and -lcrypto when using libcurl with TLS support
 # We need -lpthread for the pthread example
-LIBS = -lcurl -lsocket -lnsl -lssl -lcrypto
+LIBS ?= -lssl -lcrypto
+# We need -lcurl for the curl stuff
+LIBS := -lcurl $(LIBS)
 
 # Link the target with all objects and libraries
-$(TARGET) : $(OBJS)
-	$(CC)  -o $(TARGET) $(OBJS) $(LDFLAGS) $(LIBS)
-
-# Compile the source files into object files
-ftpget.o : ftpget.c
-	$(CC) $(CFLAGS) $<
+$(TARGET) : $(SRC)
+	$(CC) $< $(CFLAGS) $(LDFLAGS) $(LIBS) -o $(TARGET)
diff --git a/third-party/curl/docs/examples/Makefile.inc b/third-party/curl/docs/examples/Makefile.inc
index 60a006ca92..8c85fb8382 100644
--- a/third-party/curl/docs/examples/Makefile.inc
+++ b/third-party/curl/docs/examples/Makefile.inc
@@ -21,12 +21,15 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+# Shared between CMakeLists.txt and Makefile.am
 
 # These are all libcurl example programs to be test compiled
 check_PROGRAMS = \
   10-at-a-time \
+  address-scope \
   altsvc \
   anyauthput \
+  block_ip \
   certinfo \
   chkspeed \
   connect-to \
@@ -35,6 +38,7 @@ check_PROGRAMS = \
   default-scheme \
   externalsocket \
   fileupload \
+  ftp-delete \
   ftp-wildcard \
   ftpget \
   ftpgetinfo \
@@ -76,8 +80,12 @@ check_PROGRAMS = \
   imap-ssl \
   imap-store \
   imap-tls \
+  interface \
   ipv6 \
-  maxconnects  \
+  keepalive \
+  localport \
+  log_failed_transfers \
+  maxconnects \
   multi-app \
   multi-debugcallback \
   multi-double \
@@ -85,6 +93,7 @@ check_PROGRAMS = \
   multi-legacy \
   multi-post \
   multi-single \
+  netrc \
   parseurl \
   persistent \
   pop3-authzid \
@@ -104,7 +113,9 @@ check_PROGRAMS = \
   postit2-formadd \
   progressfunc \
   protofeats \
+  range \
   resolve \
+  rtsp-options \
   sendrecv \
   sepheaders \
   sftpget \
@@ -122,31 +133,34 @@ check_PROGRAMS = \
   smtp-tls \
   smtp-vrfy \
   sslbackend \
+  synctime \
   unixsocket \
   url2file \
   urlapi \
   websocket \
-  websocket-cb
+  websocket-cb \
+  websocket-updown
+
+# These examples require external dependencies that may be available during
+# the build.
+COMPLICATED_MAY_BUILD = \
+  cacertinmem.c \
+  multi-uv.c \
+  sessioninfo.c \
+  threaded.c \
+  usercertinmem.c
 
 # These examples require external dependencies that may not be commonly
 # available on POSIX systems, so do not bother attempting to compile them here.
 COMPLICATED_EXAMPLES = \
-  cacertinmem.c \
   crawler.c \
   ephiperfifo.c \
   evhiperfifo.c \
   ghiper.c \
   hiperfifo.c \
-  href_extractor.c \
   htmltidy.c \
   htmltitle.cpp \
   multi-event.c \
-  multi-uv.c \
-  multithread.c \
-  sessioninfo.c \
   smooth-gtk-thread.c \
-  synctime.c \
-  threaded-ssl.c \
-  usercertinmem.c \
   version-check.pl \
   xmlstream.c
diff --git a/third-party/curl/docs/examples/Makefile.mk b/third-party/curl/docs/examples/Makefile.mk
deleted file mode 100644
index 599acee0bc..0000000000
--- a/third-party/curl/docs/examples/Makefile.mk
+++ /dev/null
@@ -1,74 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-#***************************************************************************
-
-# Build libcurl via lib/Makefile.mk first.
-
-PROOT := ../..
-
-ifeq ($(findstring -static,$(CFG)),)
-  DYN := 1
-endif
-
-### Common
-
-include $(PROOT)/lib/Makefile.mk
-
-### Local
-
-CPPFLAGS += -DCURL_NO_OLDIES
-LDFLAGS  += -L$(PROOT)/lib
-LIBS     := -lcurl $(LIBS)
-
-ifdef DYN
-  curl_DEPENDENCIES += $(PROOT)/lib/libcurl.dll.a
-else
-  curl_DEPENDENCIES := $(PROOT)/lib/libcurl.a
-  ifdef WIN32
-    CPPFLAGS += -DCURL_STATICLIB
-    LDFLAGS += -static
-  endif
-endif
-
-ifdef WIN32
-  LIBS += -lws2_32
-endif
-
-### Sources and targets
-
-# Provides check_PROGRAMS
-include Makefile.inc
-
-ifdef WIN32
-check_PROGRAMS += synctime
-endif
-
-TARGETS := $(patsubst %,%$(BIN_EXT),$(strip $(check_PROGRAMS)))
-TOCLEAN := $(TARGETS)
-
-### Rules
-
-%$(BIN_EXT): %.c $(curl_DEPENDENCIES)
-	$(CC) $(CFLAGS) $(CPPFLAGS) $(LDFLAGS) $(CURL_LDFLAGS_BIN) $< -o $@ $(LIBS)
-
-all: $(TARGETS)
diff --git a/third-party/curl/docs/examples/README.md b/third-party/curl/docs/examples/README.md
index 3f95f03c00..06d07be0f3 100644
--- a/third-party/curl/docs/examples/README.md
+++ b/third-party/curl/docs/examples/README.md
@@ -16,17 +16,16 @@ them for submission in future packages and on the website.
 ## Building
 
 The `Makefile.example` is an example Makefile that could be used to build
-these examples. Just edit the file according to your system and requirements
-first.
+these examples. Edit the file according to your system and requirements first.
 
 Most examples should build fine using a command line like this:
 
-    `curl-config --cc --cflags --libs` -o example example.c
+    `curl-config --cc --cflags --libs` -o example-my example.c
 
 Some compilers do not like having the arguments in this order but instead
 want you do reorganize them like:
 
-    `curl-config --cc` -o example example.c `curl-config --cflags --libs`
+    `curl-config --cc` -o example-my example.c `curl-config --cflags --libs`
 
 **Please** do not use the `curl.se` site as a test target for your libcurl
 applications/experiments. Even if some of the examples use that site as a URL
diff --git a/third-party/curl/docs/examples/adddocsref.pl b/third-party/curl/docs/examples/adddocsref.pl
index 01be96a841..8c9d7f8c20 100644
--- a/third-party/curl/docs/examples/adddocsref.pl
+++ b/third-party/curl/docs/examples/adddocsref.pl
@@ -25,20 +25,25 @@
 
 # pass files as argument(s)
 
-my $docroot="https://curl.se/libcurl/c";
+use strict;
+use warnings;
 
-for $f (@ARGV) {
+use File::Copy;
+
+my $docroot = "https://curl.se/libcurl/c";
+
+for my $f (@ARGV) {
     open(NEW, ">$f.new");
     open(F, "<$f");
     while(<F>) {
         my $l = $_;
         if($l =~ /\/* $docroot/) {
-            # just ignore preciously added refs
+            # ignore previously added refs
         }
         elsif($l =~ /^( *).*curl_easy_setopt\([^,]*, *([^ ,]*) *,/) {
-            my ($prefix, $anc) = ($1, $2);
-            $anc =~ s/_//g;
-            print NEW "$prefix/* $docroot/curl_easy_setopt.html#$anc */\n";
+            my ($prefix, $anchor) = ($1, $2);
+            $anchor =~ s/_//g;
+            print NEW "$prefix/* $docroot/curl_easy_setopt.html#$anchor */\n";
             print NEW $l;
         }
         elsif($l =~ /^( *).*(curl_([^\(]*))\(/) {
@@ -53,6 +58,6 @@ for $f (@ARGV) {
     close(F);
     close(NEW);
 
-    system("mv $f $f.org");
-    system("mv $f.new $f");
+    move($f, "$f.org");
+    move("$f.new", $f);
 }
diff --git a/third-party/curl/docs/examples/address-scope.c b/third-party/curl/docs/examples/address-scope.c
new file mode 100644
index 0000000000..0cb9e0158d
--- /dev/null
+++ b/third-party/curl/docs/examples/address-scope.c
@@ -0,0 +1,69 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/* <DESC>
+ * HTTP GET to an IPv6 address with specific scope
+ * </DESC>
+ */
+#include <stdio.h>
+
+#include <curl/curl.h>
+
+#if !defined(_WIN32) && !defined(MSDOS) && !defined(__AMIGA__)
+#include <net/if.h>
+#endif
+
+int main(void)
+{
+#if !defined(_WIN32) && !defined(MSDOS) && !defined(__AMIGA__)
+  /* Windows/MS-DOS users need to find how to use if_nametoindex() */
+  CURL *curl;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
+  curl = curl_easy_init();
+  if(curl) {
+    long my_scope_id;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    my_scope_id = (long)if_nametoindex("eth0");
+    curl_easy_setopt(curl, CURLOPT_ADDRESS_SCOPE, my_scope_id);
+
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
+    /* Check for errors */
+    if(result != CURLE_OK)
+      fprintf(stderr, "curl_easy_perform() failed: %s\n",
+              curl_easy_strerror(result));
+
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+  curl_global_cleanup();
+  return (int)result;
+#else
+  return 0;
+#endif
+}
diff --git a/third-party/curl/docs/examples/altsvc.c b/third-party/curl/docs/examples/altsvc.c
index 28e9794e85..35fbc39a1a 100644
--- a/third-party/curl/docs/examples/altsvc.c
+++ b/third-party/curl/docs/examples/altsvc.c
@@ -26,12 +26,16 @@
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -41,18 +45,19 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_ALTSVC, "altsvc.txt");
 
     /* restrict which HTTP versions to use alternatives */
-    curl_easy_setopt(curl, CURLOPT_ALTSVC_CTRL, (long)
-                     CURLALTSVC_H1|CURLALTSVC_H2|CURLALTSVC_H3);
+    curl_easy_setopt(curl, CURLOPT_ALTSVC_CTRL,
+                     CURLALTSVC_H1 | CURLALTSVC_H2 | CURLALTSVC_H3);
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
-  return 0;
+  curl_global_cleanup();
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/anyauthput.c b/third-party/curl/docs/examples/anyauthput.c
index 8b979515a6..b1bd9f0fbf 100644
--- a/third-party/curl/docs/examples/anyauthput.c
+++ b/third-party/curl/docs/examples/anyauthput.c
@@ -26,6 +26,12 @@
  * one the server supports/wants.
  * </DESC>
  */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for fopen() */
+#endif
+#endif
+
 #include <stdio.h>
 #include <fcntl.h>
 #include <sys/types.h>
@@ -33,10 +39,12 @@
 
 #include <curl/curl.h>
 
-#ifdef WIN32
-#  define FILENO(fp) _fileno(fp)
-#else
-#  define FILENO(fp) fileno(fp)
+#ifdef _WIN32
+#undef stat
+#define stat _stati64
+#undef fstat
+#define fstat _fstati64
+#define fileno _fileno
 #endif
 
 #if LIBCURL_VERSION_NUM < 0x070c03
@@ -57,9 +65,9 @@
 /* seek callback function */
 static int my_seek(void *userp, curl_off_t offset, int origin)
 {
-  FILE *fp = (FILE *) userp;
+  FILE *fp = (FILE *)userp;
 
-  if(-1 == fseek(fp, (long) offset, origin))
+  if(fseek(fp, (long)offset, origin) == -1)
     /* could not seek */
     return CURL_SEEKFUNC_CANTSEEK;
 
@@ -67,30 +75,28 @@ static int my_seek(void *userp, curl_off_t offset, int origin)
 }
 
 /* read callback function, fread() look alike */
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *stream)
+static size_t read_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
-  ssize_t retcode;
-  unsigned long nread;
+  size_t nread;
 
-  retcode = fread(ptr, size, nmemb, stream);
+  nread = fread(ptr, size, nmemb, stream);
 
-  if(retcode > 0) {
-    nread = (unsigned long)retcode;
-    fprintf(stderr, "*** We read %lu bytes from file\n", nread);
+  if(nread > 0) {
+    fprintf(stderr, "*** We read %lu bytes from file\n", (unsigned long)nread);
   }
 
-  return retcode;
+  return nread;
 }
 
-int main(int argc, char **argv)
+int main(int argc, const char **argv)
 {
   CURL *curl;
-  CURLcode res;
+  CURLcode result;
   FILE *fp;
   struct stat file_info;
 
-  char *file;
-  char *url;
+  const char *file;
+  const char *url;
 
   if(argc < 3)
     return 1;
@@ -100,25 +106,35 @@ int main(int argc, char **argv)
 
   /* get the file size of the local file */
   fp = fopen(file, "rb");
-  fstat(FILENO(fp), &file_info);
+  if(!fp)
+    return 2;
 
-  /* In windows, this will init the winsock stuff */
-  curl_global_init(CURL_GLOBAL_ALL);
+  if(fstat(fileno(fp), &file_info)) {
+    fclose(fp);
+    return 1; /* cannot continue */
+  }
+
+  /* In Windows, this inits the Winsock stuff */
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK) {
+    fclose(fp);
+    return (int)result;
+  }
 
   /* get a curl handle */
   curl = curl_easy_init();
   if(curl) {
     /* we want to use our own read function */
-    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_callback);
+    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
 
     /* which file to upload */
-    curl_easy_setopt(curl, CURLOPT_READDATA, (void *) fp);
+    curl_easy_setopt(curl, CURLOPT_READDATA, (void *)fp);
 
     /* set the seek function */
     curl_easy_setopt(curl, CURLOPT_SEEKFUNCTION, my_seek);
 
     /* pass the file descriptor to the seek callback as well */
-    curl_easy_setopt(curl, CURLOPT_SEEKDATA, (void *) fp);
+    curl_easy_setopt(curl, CURLOPT_SEEKDATA, (void *)fp);
 
     /* enable "uploading" (which means PUT when doing HTTP) */
     curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
@@ -134,18 +150,18 @@ int main(int argc, char **argv)
 
     /* tell libcurl we can use "any" auth, which lets the lib pick one, but it
        also costs one extra round-trip and possibly sending of all the PUT
-       data twice!!! */
-    curl_easy_setopt(curl, CURLOPT_HTTPAUTH, (long)CURLAUTH_ANY);
+       data twice */
+    curl_easy_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_ANY);
 
-    /* set user name and password for the authentication */
+    /* set username and password for the authentication */
     curl_easy_setopt(curl, CURLOPT_USERPWD, "user:password");
 
     /* Now run off and do what you have been told! */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
@@ -153,5 +169,5 @@ int main(int argc, char **argv)
   fclose(fp); /* close the local file */
 
   curl_global_cleanup();
-  return 0;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/block_ip.c b/third-party/curl/docs/examples/block_ip.c
new file mode 100644
index 0000000000..675490701b
--- /dev/null
+++ b/third-party/curl/docs/examples/block_ip.c
@@ -0,0 +1,351 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/* <DESC>
+ * Show how CURLOPT_OPENSOCKETFUNCTION can be used to block IP addresses.
+ * </DESC>
+ */
+/* This is an advanced example that defines a whitelist or a blacklist to
+ * filter IP addresses.
+ */
+
+#ifdef __AMIGA__
+#include <stdio.h>
+int main(void)
+{
+  printf("Platform not supported.\n");
+  return 1;
+}
+#else
+
+#ifdef _WIN32  /* Requires Windows Vista+ */
+#include <winsock2.h>
+#include <ws2tcpip.h>
+#include <windows.h>
+#define strdup _strdup
+#else
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <curl/curl.h>
+
+#ifndef TRUE
+#define TRUE 1
+#endif
+
+#ifndef FALSE
+#define FALSE 0
+#endif
+
+struct ip {
+  /* The user-provided IP address or network (use CIDR) to filter */
+  char *str;
+  /* IP address family AF_INET (IPv4) or AF_INET6 (IPv6) */
+  int family;
+  /* IP in network byte format */
+  union netaddr {
+    struct in_addr ipv4;
+#ifdef AF_INET6
+    struct in6_addr ipv6;
+#endif
+  } netaddr;
+  /* IP bits to match against.
+   * This is equal to the CIDR notation or max bits if no CIDR.
+   * For example if ip->str is 127.0.0.0/8 then ip->maskbits is 8.
+   */
+  int maskbits;
+  struct ip *next;
+};
+
+enum connection_filter_t {
+  CONNECTION_FILTER_BLACKLIST,
+  CONNECTION_FILTER_WHITELIST
+};
+
+struct connection_filter {
+  struct ip *list;
+  enum connection_filter_t type;
+  int verbose;
+#ifdef AF_INET6
+  /* If the address being filtered is an IPv4-mapped IPv6 address then it is
+   * checked against IPv4 list entries as well, unless ipv6_v6only is set TRUE.
+   */
+  int ipv6_v6only;
+#endif
+};
+
+static struct ip *ip_list_append(struct ip *list, const char *data)
+{
+  struct ip *ip, *last;
+  char *cidr;
+
+  ip = calloc(1, sizeof(*ip));
+  if(!ip)
+    return NULL;
+
+  if(strchr(data, ':')) {
+#ifdef AF_INET6
+    ip->family = AF_INET6;
+#else
+    free(ip);
+    return NULL;
+#endif
+  }
+  else
+    ip->family = AF_INET;
+
+  ip->str = strdup(data);
+  if(!ip->str) {
+    free(ip);
+    return NULL;
+  }
+
+  /* determine the number of bits that this IP matches against */
+  cidr = strchr(ip->str, '/');
+  if(cidr) {
+    ip->maskbits = atoi(cidr + 1);
+    if(ip->maskbits <= 0 ||
+#ifdef AF_INET6
+       (ip->family == AF_INET6 && ip->maskbits > 128) ||
+#endif
+       (ip->family == AF_INET && ip->maskbits > 32)) {
+      free(ip->str);
+      free(ip);
+      return NULL;
+    }
+    /* ignore the CIDR notation when converting ip->str to ip->netaddr */
+    *cidr = '\0';
+  }
+  else if(ip->family == AF_INET)
+    ip->maskbits = 32;
+#ifdef AF_INET6
+  else if(ip->family == AF_INET6)
+    ip->maskbits = 128;
+#endif
+
+  if(inet_pton(ip->family, ip->str, &ip->netaddr) != 1) {
+    free(ip->str);
+    free(ip);
+    return NULL;
+  }
+
+  if(cidr)
+    *cidr = '/';
+
+  if(!list)
+    return ip;
+  for(last = list; last->next; last = last->next)
+    ;
+  last->next = ip;
+  return list;
+}
+
+static void ip_list_free_all(struct ip *list)
+{
+  struct ip *next;
+  while(list) {
+    next = list->next;
+    free(list->str);
+    free(list);
+    list = next;
+  }
+}
+
+static void free_connection_filter(struct connection_filter *filter)
+{
+  if(filter) {
+    ip_list_free_all(filter->list);
+    free(filter);
+  }
+}
+
+static int ip_match(struct ip *ip, void *netaddr)
+{
+  int bytes, tailbits;
+  const unsigned char *x, *y;
+
+  x = (const unsigned char *)&ip->netaddr;
+  y = (const unsigned char *)netaddr;
+
+  for(bytes = ip->maskbits / 8; bytes; --bytes) {
+    if(*x++ != *y++)
+      return FALSE;
+  }
+
+  tailbits = ip->maskbits % 8;
+  if(tailbits) {
+    unsigned char tailmask = (unsigned char)((0xFF << (8 - tailbits)) & 0xFF);
+    if((*x & tailmask) != (*y & tailmask))
+      return FALSE;
+  }
+
+  return TRUE;
+}
+
+#ifdef AF_INET6
+static int is_ipv4_mapped_ipv6_address(int family, void *netaddr)
+{
+  if(family == AF_INET6) {
+    int i;
+    const unsigned char *x = (const unsigned char *)netaddr;
+    for(i = 0; i < 12; ++i) {
+      if(x[i])
+        break;
+    }
+    /* support formats ::x.x.x.x (deprecated) and ::ffff:x.x.x.x */
+    if((i == 12 && (x[i] || x[i + 1] || x[i + 2] || x[i + 3])) ||
+       (i == 10 && (x[i] == 0xFF && x[i + 1] == 0xFF)))
+      return TRUE;
+  }
+
+  return FALSE;
+}
+#endif /* AF_INET6 */
+
+static curl_socket_t opensocket(void *clientp, curlsocktype purpose,
+                                struct curl_sockaddr *address)
+{
+  /* filter the address */
+  if(purpose == CURLSOCKTYPE_IPCXN) {
+    void *cinaddr = NULL;
+
+    if(address->family == AF_INET)
+      cinaddr = &((struct sockaddr_in *)(void *)&address->addr)->sin_addr;
+#ifdef AF_INET6
+    else if(address->family == AF_INET6)
+      cinaddr = &((struct sockaddr_in6 *)(void *)&address->addr)->sin6_addr;
+#endif
+
+    if(cinaddr) {
+      struct ip *ip;
+      struct connection_filter *filter = (struct connection_filter *)clientp;
+#ifdef AF_INET6
+      int mapped = !filter->ipv6_v6only &&
+                   is_ipv4_mapped_ipv6_address(address->family, cinaddr);
+#endif
+
+      for(ip = filter->list; ip; ip = ip->next) {
+        if(ip->family == address->family && ip_match(ip, cinaddr))
+          break;
+#ifdef AF_INET6
+        if(mapped && ip->family == AF_INET && address->family == AF_INET6 &&
+           ip_match(ip, (unsigned char *)cinaddr + 12))
+          break;
+#endif
+      }
+
+      if(ip && filter->type == CONNECTION_FILTER_BLACKLIST) {
+        if(filter->verbose) {
+          char buf[128] = { 0 };
+          inet_ntop(address->family, cinaddr, buf, sizeof(buf));
+          fprintf(stderr, "* Rejecting IP %s due to blacklist entry %s.\n",
+                  buf, ip->str);
+        }
+        return CURL_SOCKET_BAD;
+      }
+      else if(!ip && filter->type == CONNECTION_FILTER_WHITELIST) {
+        if(filter->verbose) {
+          char buf[128] = { 0 };
+          inet_ntop(address->family, cinaddr, buf, sizeof(buf));
+          fprintf(stderr,
+                  "* Rejecting IP %s due to missing whitelist entry.\n", buf);
+        }
+        return CURL_SOCKET_BAD;
+      }
+    }
+  }
+
+  return socket(address->family, address->socktype, address->protocol);
+}
+
+int main(void)
+{
+  CURL *curl;
+  CURLcode result;
+  struct connection_filter *filter;
+
+  filter = calloc(1, sizeof(*filter));
+  if(!filter)
+    return 1;
+
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK) {
+    free(filter);
+    return (int)result;
+  }
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_global_cleanup();
+    free(filter);
+    return 1;
+  }
+
+  /* Set the target URL */
+  curl_easy_setopt(curl, CURLOPT_URL, "http://localhost");
+
+  /* Define an IP connection filter.
+   * If an address has CIDR notation then it matches the network.
+   * For example 74.6.143.25/24 matches 74.6.143.0 - 74.6.143.255.
+   */
+  filter->type = CONNECTION_FILTER_BLACKLIST;
+  filter->list = ip_list_append(filter->list, "98.137.11.164");
+  filter->list = ip_list_append(filter->list, "127.0.0.0/8");
+#ifdef AF_INET6
+  filter->list = ip_list_append(filter->list, "::1");
+#endif
+
+  /* Set the socket function which does the filtering */
+  curl_easy_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, opensocket);
+  curl_easy_setopt(curl, CURLOPT_OPENSOCKETDATA, filter);
+
+  /* Verbose mode */
+  filter->verbose = TRUE;
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+  /* Perform the request */
+  result = curl_easy_perform(curl);
+
+  /* Check for errors */
+  if(result != CURLE_OK) {
+    fprintf(stderr, "curl_easy_perform() failed: %s\n",
+            curl_easy_strerror(result));
+  }
+
+  /* Clean up */
+  curl_easy_cleanup(curl);
+  free_connection_filter(filter);
+
+  /* Clean up libcurl */
+  curl_global_cleanup();
+
+  return 0;
+}
+#endif
diff --git a/third-party/curl/docs/examples/cacertinmem.c b/third-party/curl/docs/examples/cacertinmem.c
index 647b495b4c..2e43a783f5 100644
--- a/third-party/curl/docs/examples/cacertinmem.c
+++ b/third-party/curl/docs/examples/cacertinmem.c
@@ -26,81 +26,75 @@
  * </DESC>
  */
 
-#include <openssl/err.h>
+/* Requires: USE_OPENSSL */
+
 #include <openssl/ssl.h>
-#include <curl/curl.h>
+
 #include <stdio.h>
 
-static size_t writefunction(void *ptr, size_t size, size_t nmemb, void *stream)
+#include <curl/curl.h>
+
+#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
+typedef size_t ossl_valsize_t;
+#else
+typedef int ossl_valsize_t;
+#endif
+
+static size_t write_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
   fwrite(ptr, size, nmemb, (FILE *)stream);
-  return (nmemb*size);
+  return nmemb * size;
 }
 
-static CURLcode sslctx_function(CURL *curl, void *sslctx, void *parm)
+static CURLcode sslctx_function(CURL *curl, void *sslctx, void *pointer)
 {
-  CURLcode rv = CURLE_ABORTED_BY_CALLBACK;
-
   /** This example uses two (fake) certificates **/
+  /* replace the XXX with the actual CA certificates */
   static const char mypem[] =
     "-----BEGIN CERTIFICATE-----\n"
-    "MIIH0zCCBbugAwIBAgIIXsO3pkN/pOAwDQYJKoZIhvcNAQEFBQAwQjESMBAGA1UE\n"
-    "AwwJQUNDVlJBSVoxMRAwDgYDVQQLDAdQS0lBQ0NWMQ0wCwYDVQQKDARBQ0NWMQsw\n"
-    "CQYDVQQGEwJFUzAeFw0xMTA1MDUwOTM3MzdaFw0zMDEyMzEwOTM3MzdaMEIxEjAQ\n"
-    "BgNVBAMMCUFDQ1ZSQUlaMTEQMA4GA1UECwwHUEtJQUNDVjENMAsGA1UECgwEQUND\n"
-    "VjELMAkGA1UEBhMCRVMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCb\n"
-    "qau/YUqXry+XZpp0X9DZlv3P4uRm7x8fRzPCRKPfmt4ftVTdFXxpNRFvu8gMjmoY\n"
-    "HtiP2Ra8EEg2XPBjs5BaXCQ316PWywlxufEBcoSwfdtNgM3802/J+Nq2DoLSRYWo\n"
-    "G2ioPej0RGy9ocLLA76MPhMAhN9KSMDjIgro6TenGEyxCQ0jVn8ETdkXhBilyNpA\n"
-    "0KIV9VMJcRz/RROE5iZe+OCIHAr8Fraocwa48GOEAqDGWuzndN9wrqODJerWx5eH\n"
-    "k6fGioozl2A3ED6XPm4pFdahD9GILBKfb6qkxkLrQaLjlUPTAYVtjrs78yM2x/47\n"
-    "JyCpZET/LtZ1qmxNYEAZSUNUY9rizLpm5U9EelvZaoErQNV/+QEnWCzI7UiRfD+m\n"
-    "AM/EKXMRNt6GGT6d7hmKG9Ww7Y49nCrADdg9ZuM8Db3VlFzi4qc1GwQA9j9ajepD\n"
-    "vV+JHanBsMyZ4k0ACtrJJ1vnE5Bc5PUzolVt3OAJTS+xJlsndQAJxGJ3KQhfnlms\n"
-    "tn6tn1QwIgPBHnFk/vk4CpYY3QIUrCPLBhwepH2NDd4nQeit2hW3sCPdK6jT2iWH\n"
-    "7ehVRE2I9DZ+hJp4rPcOVkkO1jMl1oRQQmwgEh0q1b688nCBpHBgvgW1m54ERL5h\n"
-    "I6zppSSMEYCUWqKiuUnSwdzRp+0xESyeGabu4VXhwOrPDYTkF7eifKXeVSUG7szA\n"
-    "h1xA2syVP1XgNce4hL60Xc16gwFy7ofmXx2utYXGJt/mwZrpHgJHnyqobalbz+xF\n"
-    "d3+YJ5oyXSrjhO7FmGYvliAd3djDJ9ew+f7Zfc3Qn48LFFhRny+Lwzgt3uiP1o2H\n"
-    "pPVWQxaZLPSkVrQ0uGE3ycJYgBugl6H8WY3pEfbRD0tVNEYqi4Y7\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
     "-----END CERTIFICATE-----\n"
     "-----BEGIN CERTIFICATE-----\n"
-    "MIIFtTCCA52gAwIBAgIIYY3HhjsBggUwDQYJKoZIhvcNAQEFBQAwRDEWMBQGA1UE\n"
-    "AwwNQUNFRElDT00gUm9vdDEMMAoGA1UECwwDUEtJMQ8wDQYDVQQKDAZFRElDT00x\n"
-    "CzAJBgNVBAYTAkVTMB4XDTA4MDQxODE2MjQyMloXDTI4MDQxMzE2MjQyMlowRDEW\n"
-    "MBQGA1UEAwwNQUNFRElDT00gUm9vdDEMMAoGA1UECwwDUEtJMQ8wDQYDVQQKDAZF\n"
-    "RElDT00xCzAJBgNVBAYTAkVTMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC\n"
-    "AgEA/5KV4WgGdrQsyFhIyv2AVClVYyT/kGWbEHV7w2rbYgIB8hiGtXxaOLHkWLn7\n"
-    "09gtn70yN78sFW2+tfQh0hOR2QetAQXW8713zl9CgQr5auODAKgrLlUTY4HKRxx7\n"
-    "XBZXehuDYAQ6PmXDzQHe3qTWDLqO3tkE7hdWIpuPY/1NFgu3e3eM+SW10W2ZEi5P\n"
-    "gvoFNTPhNahXwOf9jU8/kzJPeGYDdwdY6ZXIfj7QeQCM8htRM5u8lOk6e25SLTKe\n"
-    "I6RF+7YuE7CLGLHdztUdp0J/Vb77W7tH1PwkzQSulgUV1qzOMPPKC8W64iLgpq0i\n"
-    "5ALudBF/TP94HTXa5gI06xgSYXcGCRZj6hitoocf8seACQl1ThCojz2GuHURwCRi\n"
-    "ipZ7SkXp7FnFvmuD5uHorLUwHv4FB4D54SMNUI8FmP8sX+g7tq3PgbUhh8oIKiMn\n"
-    "MCArz+2UW6yyetLHKKGKC5tNSixthT8Jcjxn4tncB7rrZXtaAWPWkFtPF2Y9fwsZ\n"
-    "o5NjEFIqnxQWWOLcpfShFosOkYuByptZ+thrkQdlVV9SH686+5DdaaVbnG0OLLb6\n"
-    "zqylfDJKZ0DcMDQj3dcEI2bw/FWAp/tmGYI1Z2JwOV5vx+qQQEQIHriy1tvuWacN\n"
-    "GHk0vFQYXlPKNFHtRQrmjseCNj6nOGOpMCwXEGCSn1WHElkQwg9naRHMTh5+Spqt\n"
-    "r0CodaxWkHS4oJyleW/c6RrIaQXpuvoDs3zk4E7Czp3otkYNbn5XOmeUwssfnHdK\n"
-    "Z05phkOTOPu220+DkdRgfks+KzgHVZhepA==\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
     "-----END CERTIFICATE-----\n";
 
-  BIO *cbio = BIO_new_mem_buf(mypem, sizeof(mypem));
-  X509_STORE  *cts = SSL_CTX_get_cert_store((SSL_CTX *)sslctx);
-  int i;
-  STACK_OF(X509_INFO) *inf;
-  (void)curl;
-  (void)parm;
+  CURLcode result = CURLE_ABORTED_BY_CALLBACK;
+  BIO *cbio = NULL;
+  X509_STORE *cts;
+  ossl_valsize_t i;
+  STACK_OF(X509_INFO) * inf;
 
-  if(!cts || !cbio) {
-    return rv;
+  (void)curl;
+  (void)pointer;
+
+  cts = SSL_CTX_get_cert_store((SSL_CTX *)sslctx);
+  if(!cts) {
+    printf("SSL_CTX_get_cert_store() failed\n");
+    goto out;
+  }
+
+  cbio = BIO_new_mem_buf(mypem, sizeof(mypem) - 1);
+  if(!cbio) {
+    printf("BIO_new_mem_buf() failed\n");
+    goto out;
   }
 
   inf = PEM_X509_INFO_read_bio(cbio, NULL, NULL, NULL);
-
   if(!inf) {
-    BIO_free(cbio);
-    return rv;
+    printf("PEM_X509_INFO_read_bio() failed\n");
+    goto out;
   }
 
   for(i = 0; i < sk_X509_INFO_num(inf); i++) {
@@ -113,71 +107,86 @@ static CURLcode sslctx_function(CURL *curl, void *sslctx, void *parm)
     }
   }
 
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wcast-function-type-strict"
+#endif
   sk_X509_INFO_pop_free(inf, X509_INFO_free);
-  BIO_free(cbio);
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic pop
+#endif
 
-  rv = CURLE_OK;
-  return rv;
+  result = CURLE_OK;
+
+out:
+
+  if(cbio)
+    BIO_free(cbio);
+
+  return result;
 }
 
 int main(void)
 {
-  CURL *ch;
-  CURLcode rv;
+  CURL *curl;
 
-  curl_global_init(CURL_GLOBAL_ALL);
-  ch = curl_easy_init();
-  curl_easy_setopt(ch, CURLOPT_VERBOSE, 0L);
-  curl_easy_setopt(ch, CURLOPT_HEADER, 0L);
-  curl_easy_setopt(ch, CURLOPT_NOPROGRESS, 1L);
-  curl_easy_setopt(ch, CURLOPT_NOSIGNAL, 1L);
-  curl_easy_setopt(ch, CURLOPT_WRITEFUNCTION, writefunction);
-  curl_easy_setopt(ch, CURLOPT_WRITEDATA, stdout);
-  curl_easy_setopt(ch, CURLOPT_HEADERFUNCTION, writefunction);
-  curl_easy_setopt(ch, CURLOPT_HEADERDATA, stderr);
-  curl_easy_setopt(ch, CURLOPT_SSLCERTTYPE, "PEM");
-  curl_easy_setopt(ch, CURLOPT_SSL_VERIFYPEER, 1L);
-  curl_easy_setopt(ch, CURLOPT_URL, "https://www.example.com/");
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  /* Turn off the default CA locations, otherwise libcurl will load CA
-   * certificates from the locations that were detected/specified at
-   * build-time
-   */
-  curl_easy_setopt(ch, CURLOPT_CAINFO, NULL);
-  curl_easy_setopt(ch, CURLOPT_CAPATH, NULL);
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 0L);
+    curl_easy_setopt(curl, CURLOPT_HEADER, 0L);
+    curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 1L);
+    curl_easy_setopt(curl, CURLOPT_NOSIGNAL, 1L);
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
+    curl_easy_setopt(curl, CURLOPT_WRITEDATA, stdout);
+    curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, write_cb);
+    curl_easy_setopt(curl, CURLOPT_HEADERDATA, stderr);
+    curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM");
+    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
+    curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");
 
-  /* first try: retrieve page without ca certificates -> should fail
-   * unless libcurl was built --with-ca-fallback enabled at build-time
-   */
-  rv = curl_easy_perform(ch);
-  if(rv == CURLE_OK)
-    printf("*** transfer succeeded ***\n");
-  else
-    printf("*** transfer failed ***\n");
+    /* Turn off the default CA locations, otherwise libcurl loads CA
+     * certificates from the locations that were detected/specified at
+     * build-time
+     */
+    curl_easy_setopt(curl, CURLOPT_CAINFO, NULL);
+    curl_easy_setopt(curl, CURLOPT_CAPATH, NULL);
 
-  /* use a fresh connection (optional)
-   * this option seriously impacts performance of multiple transfers but
-   * it is necessary order to demonstrate this example. recall that the
-   * ssl ctx callback is only called _before_ an SSL connection is
-   * established, therefore it will not affect existing verified SSL
-   * connections already in the connection cache associated with this
-   * handle. normally you would set the ssl ctx function before making
-   * any transfers, and not use this option.
-   */
-  curl_easy_setopt(ch, CURLOPT_FRESH_CONNECT, 1L);
+    /* first try: retrieve page without CA certificates -> should fail
+     * unless libcurl was built --with-ca-fallback enabled at build-time
+     */
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK)
+      printf("*** transfer succeeded ***\n");
+    else
+      printf("*** transfer failed ***\n");
 
-  /* second try: retrieve page using cacerts' certificate -> will succeed
-   * load the certificate by installing a function doing the necessary
-   * "modifications" to the SSL CONTEXT just before link init
-   */
-  curl_easy_setopt(ch, CURLOPT_SSL_CTX_FUNCTION, sslctx_function);
-  rv = curl_easy_perform(ch);
-  if(rv == CURLE_OK)
-    printf("*** transfer succeeded ***\n");
-  else
-    printf("*** transfer failed ***\n");
+    /* use a fresh connection (optional) this option seriously impacts
+     * performance of multiple transfers but it is necessary order to
+     * demonstrate this example. recall that the SSL ctx callback is only
+     * called _before_ an SSL connection is established, therefore it does not
+     * affect existing verified SSL connections already in the connection
+     * cache associated with this handle. normally you would set the SSL ctx
+     * function before making any transfers, and not use this option.
+     */
+    curl_easy_setopt(curl, CURLOPT_FRESH_CONNECT, 1L);
 
-  curl_easy_cleanup(ch);
+    /* second try: retrieve page using cacerts' certificate -> succeeds to
+     * load the certificate by installing a function doing the necessary
+     * "modifications" to the SSL CONTEXT before link init
+     */
+    curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, sslctx_function);
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK)
+      printf("*** transfer succeeded ***\n");
+    else
+      printf("*** transfer failed ***\n");
+
+    curl_easy_cleanup(curl);
+  }
   curl_global_cleanup();
-  return rv;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/certinfo.c b/third-party/curl/docs/examples/certinfo.c
index 795be6c3d1..4f07dbaa8f 100644
--- a/third-party/curl/docs/examples/certinfo.c
+++ b/third-party/curl/docs/examples/certinfo.c
@@ -29,7 +29,7 @@
 
 #include <curl/curl.h>
 
-static size_t wrfu(void *ptr,  size_t  size,  size_t  nmemb,  void *stream)
+static size_t write_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
   (void)stream;
   (void)ptr;
@@ -39,15 +39,17 @@ static size_t wrfu(void *ptr,  size_t  size,  size_t  nmemb,  void *stream)
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+  CURLcode result;
 
-  curl_global_init(CURL_GLOBAL_DEFAULT);
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
     curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");
 
-    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, wrfu);
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
 
     curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
     curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
@@ -55,14 +57,14 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 0L);
     curl_easy_setopt(curl, CURLOPT_CERTINFO, 1L);
 
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
-    if(!res) {
+    if(result == CURLE_OK) {
       struct curl_certinfo *certinfo;
 
-      res = curl_easy_getinfo(curl, CURLINFO_CERTINFO, &certinfo);
+      result = curl_easy_getinfo(curl, CURLINFO_CERTINFO, &certinfo);
 
-      if(!res && certinfo) {
+      if(!result && certinfo) {
         int i;
 
         printf("%d certs!\n", certinfo->num_of_certs);
@@ -72,10 +74,8 @@ int main(void)
 
           for(slist = certinfo->certinfo[i]; slist; slist = slist->next)
             printf("%s\n", slist->data);
-
         }
       }
-
     }
 
     curl_easy_cleanup(curl);
@@ -83,5 +83,5 @@ int main(void)
 
   curl_global_cleanup();
 
-  return 0;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/chkspeed.c b/third-party/curl/docs/examples/chkspeed.c
index 45765b988f..7010acc4ae 100644
--- a/third-party/curl/docs/examples/chkspeed.c
+++ b/third-party/curl/docs/examples/chkspeed.c
@@ -34,6 +34,11 @@
  * dd if=/dev/urandom of=file_1M.bin bs=1M count=1
  *
  */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for ctime() */
+#endif
+#endif
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -52,22 +57,22 @@
 
 #define CHKSPEED_VERSION "1.0"
 
-static size_t WriteCallback(void *ptr, size_t size, size_t nmemb, void *data)
+static size_t write_cb(char *ptr, size_t size, size_t nmemb, void *data)
 {
   /* we are not interested in the downloaded bytes itself,
      so we only return the size we would have saved ... */
-  (void)ptr;  /* unused */
-  (void)data; /* unused */
-  return (size_t)(size * nmemb);
+  (void)ptr;
+  (void)data;
+  return size * nmemb;
 }
 
-int main(int argc, char *argv[])
+int main(int argc, const char *argv[])
 {
-  CURL *curl_handle;
-  CURLcode res;
+  CURL *curl;
+  CURLcode result;
   int prtall = 0, prtsep = 0, prttime = 0;
   const char *url = URL_1M;
-  char *appname = argv[0];
+  const char *appname = argv[0];
 
   if(argc > 1) {
     /* parse input parameters */
@@ -79,12 +84,12 @@ int main(int argc, char *argv[])
           fprintf(stderr,
                   "\rUsage: %s [-m=1|2|5|10|20|50|100] [-t] [-x] [url]\n",
                   appname);
-          exit(1);
+          return 1;
         case 'v':
         case 'V':
           fprintf(stderr, "\r%s %s - %s\n",
                   appname, CHKSPEED_VERSION, curl_version());
-          exit(1);
+          return 1;
         case 'a':
         case 'A':
           prtall = 1;
@@ -100,7 +105,7 @@ int main(int argc, char *argv[])
         case 'm':
         case 'M':
           if(argv[0][2] == '=') {
-            long m = strtol((*argv) + 3, NULL, 10);
+            int m = atoi(*argv + 3);
             switch(m) {
             case 1:
               url = URL_1M;
@@ -126,15 +131,17 @@ int main(int argc, char *argv[])
             default:
               fprintf(stderr, "\r%s: invalid parameter %s\n",
                       appname, *argv + 3);
-              exit(1);
+              return 1;
             }
             break;
           }
-          /* FALLTHROUGH */
+          fprintf(stderr, "\r%s: invalid or unknown option %s\n",
+                  appname, *argv);
+          return 1;
         default:
           fprintf(stderr, "\r%s: invalid or unknown option %s\n",
                   appname, *argv);
-          exit(1);
+          return 1;
         }
       }
       else {
@@ -154,66 +161,77 @@ int main(int argc, char *argv[])
   }
 
   /* init libcurl */
-  curl_global_init(CURL_GLOBAL_ALL);
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   /* init the curl session */
-  curl_handle = curl_easy_init();
+  curl = curl_easy_init();
+  if(curl) {
 
-  /* specify URL to get */
-  curl_easy_setopt(curl_handle, CURLOPT_URL, url);
+    /* specify URL to get */
+    curl_easy_setopt(curl, CURLOPT_URL, url);
 
-  /* send all data to this function  */
-  curl_easy_setopt(curl_handle, CURLOPT_WRITEFUNCTION, WriteCallback);
+    /* send all data to this function */
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
 
-  /* some servers do not like requests that are made without a user-agent
-     field, so we provide one */
-  curl_easy_setopt(curl_handle, CURLOPT_USERAGENT,
-                   "libcurl-speedchecker/" CHKSPEED_VERSION);
+    /* some servers do not like requests that are made without a user-agent
+       field, so we provide one */
+    curl_easy_setopt(curl, CURLOPT_USERAGENT,
+                     "libcurl-speedchecker/" CHKSPEED_VERSION);
 
-  /* get it! */
-  res = curl_easy_perform(curl_handle);
+    /* get it! */
+    result = curl_easy_perform(curl);
 
-  if(CURLE_OK == res) {
-    curl_off_t val;
+    if(result == CURLE_OK) {
+      curl_off_t val;
 
-    /* check for bytes downloaded */
-    res = curl_easy_getinfo(curl_handle, CURLINFO_SIZE_DOWNLOAD_T, &val);
-    if((CURLE_OK == res) && (val>0))
-      printf("Data downloaded: %lu bytes.\n", (unsigned long)val);
+      /* check for bytes downloaded */
+      result = curl_easy_getinfo(curl, CURLINFO_SIZE_DOWNLOAD_T, &val);
+      if((result == CURLE_OK) && (val > 0))
+        printf("Data downloaded: %" CURL_FORMAT_CURL_OFF_T " bytes.\n", val);
 
-    /* check for total download time */
-    res = curl_easy_getinfo(curl_handle, CURLINFO_TOTAL_TIME_T, &val);
-    if((CURLE_OK == res) && (val>0))
-      printf("Total download time: %lu.%06lu sec.\n",
-             (unsigned long)(val / 1000000), (unsigned long)(val % 1000000));
+      /* check for total download time */
+      result = curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME_T, &val);
+      if((result == CURLE_OK) && (val > 0))
+        printf("Total download time: %" CURL_FORMAT_CURL_OFF_T
+               ".%06" CURL_FORMAT_CURL_OFF_T " sec.\n",
+               val / 1000000,
+               val % 1000000);
 
-    /* check for average download speed */
-    res = curl_easy_getinfo(curl_handle, CURLINFO_SPEED_DOWNLOAD_T, &val);
-    if((CURLE_OK == res) && (val>0))
-      printf("Average download speed: %lu kbyte/sec.\n",
-             (unsigned long)(val / 1024));
+      /* check for average download speed */
+      result = curl_easy_getinfo(curl, CURLINFO_SPEED_DOWNLOAD_T, &val);
+      if((result == CURLE_OK) && (val > 0))
+        printf("Average download speed: "
+               "%" CURL_FORMAT_CURL_OFF_T " kbyte/sec.\n",
+               val / 1024);
 
-    if(prtall) {
-      /* check for name resolution time */
-      res = curl_easy_getinfo(curl_handle, CURLINFO_NAMELOOKUP_TIME_T, &val);
-      if((CURLE_OK == res) && (val>0))
-        printf("Name lookup time: %lu.%06lu sec.\n",
-               (unsigned long)(val / 1000000), (unsigned long)(val % 1000000));
+      if(prtall) {
+        /* check for name resolution time */
+        result = curl_easy_getinfo(curl, CURLINFO_NAMELOOKUP_TIME_T, &val);
+        if((result == CURLE_OK) && (val > 0))
+          printf("Name lookup time: %" CURL_FORMAT_CURL_OFF_T
+                 ".%06" CURL_FORMAT_CURL_OFF_T " sec.\n",
+                 val / 1000000,
+                 val % 1000000);
 
-      /* check for connect time */
-      res = curl_easy_getinfo(curl_handle, CURLINFO_CONNECT_TIME_T, &val);
-      if((CURLE_OK == res) && (val>0))
-        printf("Connect time: %lu.%06lu sec.\n",
-               (unsigned long)(val / 1000000), (unsigned long)(val % 1000000));
+        /* check for connect time */
+        result = curl_easy_getinfo(curl, CURLINFO_CONNECT_TIME_T, &val);
+        if((result == CURLE_OK) && (val > 0))
+          printf("Connect time: %" CURL_FORMAT_CURL_OFF_T
+                 ".%06" CURL_FORMAT_CURL_OFF_T " sec.\n",
+                 val / 1000000,
+                 val % 1000000);
+      }
+    }
+    else {
+      fprintf(stderr, "Error while fetching '%s' : %s\n",
+              url, curl_easy_strerror(result));
     }
-  }
-  else {
-    fprintf(stderr, "Error while fetching '%s' : %s\n",
-            url, curl_easy_strerror(res));
-  }
 
-  /* cleanup curl stuff */
-  curl_easy_cleanup(curl_handle);
+    /* cleanup curl stuff */
+    curl_easy_cleanup(curl);
+  }
 
   /* we are done with libcurl, so clean it up */
   curl_global_cleanup();
diff --git a/third-party/curl/docs/examples/connect-to.c b/third-party/curl/docs/examples/connect-to.c
index fcdd2cc4ff..706e9882a0 100644
--- a/third-party/curl/docs/examples/connect-to.c
+++ b/third-party/curl/docs/examples/connect-to.c
@@ -22,27 +22,31 @@
  *
  ***************************************************************************/
 /* <DESC>
- * Use CURLOPT_CONNECT_TO to connect to "wrong" host name
+ * Use CURLOPT_CONNECT_TO to connect to "wrong" hostname
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 int main(void)
 {
+  struct curl_slist *host;
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   /*
     Each single string should be written using the format
     HOST:PORT:CONNECT-TO-HOST:CONNECT-TO-PORT where HOST is the host of the
-    request, PORT is the port of the request, CONNECT-TO-HOST is the host name
+    request, PORT is the port of the request, CONNECT-TO-HOST is the hostname
     to connect to, and CONNECT-TO-PORT is the port to connect to.
    */
-  /* instead of curl.se:443, it will resolve and use example.com:443 but in
-     other aspects work as if it still is curl.se */
-  struct curl_slist *host = curl_slist_append(NULL,
-                                              "curl.se:443:example.com:443");
+  /* instead of curl.se:443, it resolves and uses example.com:443 but in other
+     aspects work as if it still is curl.se */
+  host = curl_slist_append(NULL, "curl.se:443:example.com:443");
 
   curl = curl_easy_init();
   if(curl) {
@@ -50,15 +54,15 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
     curl_easy_setopt(curl, CURLOPT_URL, "https://curl.se/");
 
-    /* since this connects to the wrong host, checking the host name in the
-       server certificate will fail, so unless we disable the check libcurl
+    /* since this connects to the wrong host, checking the hostname in the
+       server certificate fails, so unless we disable the check libcurl
        returns CURLE_PEER_FAILED_VERIFICATION */
     curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
 
-    /* Letting the wrong host name in the certificate be okay, the transfer
-       goes through but will (most likely) cause a 404 or similar because it
-       sends an unknown name in the Host: header field */
-    res = curl_easy_perform(curl);
+    /* Letting the wrong hostname in the certificate be okay, the transfer
+       goes through but (most likely) causes a 404 or similar because it sends
+       an unknown name in the Host: header field */
+    result = curl_easy_perform(curl);
 
     /* always cleanup */
     curl_easy_cleanup(curl);
@@ -66,5 +70,7 @@ int main(void)
 
   curl_slist_free_all(host);
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/cookie_interface.c b/third-party/curl/docs/examples/cookie_interface.c
index 557b57dc2e..aa3ea1d013 100644
--- a/third-party/curl/docs/examples/cookie_interface.c
+++ b/third-party/curl/docs/examples/cookie_interface.c
@@ -25,29 +25,36 @@
  * Import and export cookies with COOKIELIST.
  * </DESC>
  */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for _snprintf() */
+#endif
+#endif
 
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
-#include <errno.h>
 #include <time.h>
 
 #include <curl/curl.h>
 
-static void
-print_cookies(CURL *curl)
+#if defined(_MSC_VER) && (_MSC_VER < 1900)
+#define snprintf _snprintf
+#endif
+
+static int print_cookies(CURL *curl)
 {
-  CURLcode res;
+  CURLcode result;
   struct curl_slist *cookies;
   struct curl_slist *nc;
   int i;
 
   printf("Cookies, curl knows:\n");
-  res = curl_easy_getinfo(curl, CURLINFO_COOKIELIST, &cookies);
-  if(res != CURLE_OK) {
-    fprintf(stderr, "Curl curl_easy_getinfo failed: %s\n",
-            curl_easy_strerror(res));
-    exit(1);
+  result = curl_easy_getinfo(curl, CURLINFO_COOKIELIST, &cookies);
+  if(result != CURLE_OK) {
+    fprintf(stderr, "curl curl_easy_getinfo failed: %s\n",
+            curl_easy_strerror(result));
+    return 1;
   }
   nc = cookies;
   i = 1;
@@ -60,15 +67,19 @@ print_cookies(CURL *curl)
     printf("(none)\n");
   }
   curl_slist_free_all(cookies);
+
+  return 0;
 }
 
-int
-main(void)
+int main(void)
 {
   CURL *curl;
-  CURLcode res;
+  CURLcode result;
+
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  curl_global_init(CURL_GLOBAL_ALL);
   curl = curl_easy_init();
   if(curl) {
     char nline[512];
@@ -76,9 +87,9 @@ main(void)
     curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
     curl_easy_setopt(curl, CURLOPT_COOKIEFILE, ""); /* start cookie engine */
-    res = curl_easy_perform(curl);
-    if(res != CURLE_OK) {
-      fprintf(stderr, "Curl perform failed: %s\n", curl_easy_strerror(res));
+    result = curl_easy_perform(curl);
+    if(result != CURLE_OK) {
+      fprintf(stderr, "curl perform failed: %s\n", curl_easy_strerror(result));
       return 1;
     }
 
@@ -91,49 +102,45 @@ main(void)
 
     printf("-----------------------------------------------\n"
            "Setting a cookie \"PREF\" via cookie interface:\n");
-#ifdef WIN32
-#define snprintf _snprintf
-#endif
     /* Netscape format cookie */
     snprintf(nline, sizeof(nline), "%s\t%s\t%s\t%s\t%.0f\t%s\t%s",
              ".example.com", "TRUE", "/", "FALSE",
              difftime(time(NULL) + 31337, (time_t)0),
-             "PREF", "hello example, i like you!");
-    res = curl_easy_setopt(curl, CURLOPT_COOKIELIST, nline);
-    if(res != CURLE_OK) {
-      fprintf(stderr, "Curl curl_easy_setopt failed: %s\n",
-              curl_easy_strerror(res));
+             "PREF", "hello example, I like you!");
+    result = curl_easy_setopt(curl, CURLOPT_COOKIELIST, nline);
+    if(result != CURLE_OK) {
+      fprintf(stderr, "curl curl_easy_setopt failed: %s\n",
+              curl_easy_strerror(result));
       return 1;
     }
 
     /* HTTP-header style cookie. If you use the Set-Cookie format and do not
-    specify a domain then the cookie is sent for any domain and will not be
-    modified, likely not what you intended. Starting in 7.43.0 any-domain
-    cookies will not be exported either. For more information refer to the
-    CURLOPT_COOKIELIST documentation.
+       specify a domain then the cookie is sent for any domain and is not
+       modified, likely not what you intended. For more information refer to
+       the CURLOPT_COOKIELIST documentation.
     */
     snprintf(nline, sizeof(nline),
       "Set-Cookie: OLD_PREF=3d141414bf4209321; "
       "expires=Sun, 17-Jan-2038 19:14:07 GMT; path=/; domain=.example.com");
-    res = curl_easy_setopt(curl, CURLOPT_COOKIELIST, nline);
-    if(res != CURLE_OK) {
-      fprintf(stderr, "Curl curl_easy_setopt failed: %s\n",
-              curl_easy_strerror(res));
+    result = curl_easy_setopt(curl, CURLOPT_COOKIELIST, nline);
+    if(result != CURLE_OK) {
+      fprintf(stderr, "curl curl_easy_setopt failed: %s\n",
+              curl_easy_strerror(result));
       return 1;
     }
 
     print_cookies(curl);
 
-    res = curl_easy_perform(curl);
-    if(res != CURLE_OK) {
-      fprintf(stderr, "Curl perform failed: %s\n", curl_easy_strerror(res));
+    result = curl_easy_perform(curl);
+    if(result != CURLE_OK) {
+      fprintf(stderr, "curl perform failed: %s\n", curl_easy_strerror(result));
       return 1;
     }
 
     curl_easy_cleanup(curl);
   }
   else {
-    fprintf(stderr, "Curl init failed!\n");
+    fprintf(stderr, "curl init failed!\n");
     return 1;
   }
 
diff --git a/third-party/curl/docs/examples/crawler.c b/third-party/curl/docs/examples/crawler.c
index 2ff4ae7145..21cdb5fcff 100644
--- a/third-party/curl/docs/examples/crawler.c
+++ b/third-party/curl/docs/examples/crawler.c
@@ -20,49 +20,52 @@
  *
  * SPDX-License-Identifier: curl
  *
- * To compile:
- *   gcc crawler.c $(pkg-config --cflags --libs libxml-2.0 libcurl)
- *
- */
+ ***************************************************************************/
 /* <DESC>
  * Web crawler based on curl and libxml2 to stress-test curl with
  * hundreds of concurrent connections to various servers.
  * </DESC>
  */
-
-/* Parameters */
-int max_con = 200;
-int max_total = 20000;
-int max_requests = 500;
-int max_link_per_page = 5;
-int follow_relative_links = 0;
-char *start_page = "https://www.reuters.com";
-
+/*
+ * To compile:
+ *   gcc crawler.c $(pkg-config --cflags --libs libxml-2.0 libcurl)
+ */
 #include <libxml/HTMLparser.h>
 #include <libxml/xpath.h>
 #include <libxml/uri.h>
-#include <curl/curl.h>
+
 #include <stdlib.h>
 #include <string.h>
 #include <math.h>
 #include <signal.h>
 
-int pending_interrupt = 0;
-void sighandler(int dummy)
+#include <curl/curl.h>
+
+/* Parameters */
+static int max_con = 200;
+static int max_total = 20000;
+static int max_requests = 500;
+static size_t max_link_per_page = 5;
+static int follow_relative_links = 0;
+static const char *start_page = "https://www.reuters.com/";
+
+static int pending_interrupt = 0;
+static void sighandler(int dummy)
 {
+  (void)dummy;
   pending_interrupt = 1;
 }
 
 /* resizable buffer */
-typedef struct {
+struct memory {
   char *buf;
   size_t size;
-} memory;
+};
 
-size_t grow_buffer(void *contents, size_t sz, size_t nmemb, void *ctx)
+static size_t write_cb(char *contents, size_t sz, size_t nmemb, void *ctx)
 {
   size_t realsize = sz * nmemb;
-  memory *mem = (memory*) ctx;
+  struct memory *mem = (struct memory *)ctx;
   char *ptr = realloc(mem->buf, mem->size + realsize);
   if(!ptr) {
     /* out of memory */
@@ -75,163 +78,184 @@ size_t grow_buffer(void *contents, size_t sz, size_t nmemb, void *ctx)
   return realsize;
 }
 
-CURL *make_handle(char *url)
+static CURL *make_handle(const char *url)
 {
-  CURL *handle = curl_easy_init();
+  CURL *curl = curl_easy_init();
+  struct memory *mem;
 
   /* Important: use HTTP2 over HTTPS */
-  curl_easy_setopt(handle, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2TLS);
-  curl_easy_setopt(handle, CURLOPT_URL, url);
+  curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2TLS);
+  curl_easy_setopt(curl, CURLOPT_URL, url);
 
   /* buffer body */
-  memory *mem = malloc(sizeof(memory));
+  mem = malloc(sizeof(*mem));
   mem->size = 0;
   mem->buf = malloc(1);
-  curl_easy_setopt(handle, CURLOPT_WRITEFUNCTION, grow_buffer);
-  curl_easy_setopt(handle, CURLOPT_WRITEDATA, mem);
-  curl_easy_setopt(handle, CURLOPT_PRIVATE, mem);
+  curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
+  curl_easy_setopt(curl, CURLOPT_WRITEDATA, mem);
+  curl_easy_setopt(curl, CURLOPT_PRIVATE, mem);
 
   /* For completeness */
-  curl_easy_setopt(handle, CURLOPT_ACCEPT_ENCODING, "");
-  curl_easy_setopt(handle, CURLOPT_TIMEOUT, 5L);
-  curl_easy_setopt(handle, CURLOPT_FOLLOWLOCATION, 1L);
+  curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, "");
+  curl_easy_setopt(curl, CURLOPT_TIMEOUT, 5L);
+  curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
   /* only allow redirects to HTTP and HTTPS URLs */
-  curl_easy_setopt(handle, CURLOPT_REDIR_PROTOCOLS_STR, "http,https");
-  curl_easy_setopt(handle, CURLOPT_AUTOREFERER, 1L);
-  curl_easy_setopt(handle, CURLOPT_MAXREDIRS, 10L);
+  curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS_STR, "http,https");
+  curl_easy_setopt(curl, CURLOPT_AUTOREFERER, 1L);
+  curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 10L);
   /* each transfer needs to be done within 20 seconds! */
-  curl_easy_setopt(handle, CURLOPT_TIMEOUT_MS, 20000L);
+  curl_easy_setopt(curl, CURLOPT_TIMEOUT_MS, 20000L);
   /* connect fast or fail */
-  curl_easy_setopt(handle, CURLOPT_CONNECTTIMEOUT_MS, 2000L);
+  curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT_MS, 2000L);
   /* skip files larger than a gigabyte */
-  curl_easy_setopt(handle, CURLOPT_MAXFILESIZE_LARGE,
-                   (curl_off_t)1024*1024*1024);
-  curl_easy_setopt(handle, CURLOPT_COOKIEFILE, "");
-  curl_easy_setopt(handle, CURLOPT_FILETIME, 1L);
-  curl_easy_setopt(handle, CURLOPT_USERAGENT, "mini crawler");
-  curl_easy_setopt(handle, CURLOPT_HTTPAUTH, CURLAUTH_ANY);
-  curl_easy_setopt(handle, CURLOPT_UNRESTRICTED_AUTH, 1L);
-  curl_easy_setopt(handle, CURLOPT_PROXYAUTH, CURLAUTH_ANY);
-  curl_easy_setopt(handle, CURLOPT_EXPECT_100_TIMEOUT_MS, 0L);
-  return handle;
+  curl_easy_setopt(curl, CURLOPT_MAXFILESIZE_LARGE,
+                   (curl_off_t)1024 * 1024 * 1024);
+  curl_easy_setopt(curl, CURLOPT_COOKIEFILE, "");
+  curl_easy_setopt(curl, CURLOPT_FILETIME, 1L);
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "mini crawler");
+  curl_easy_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_ANY);
+  curl_easy_setopt(curl, CURLOPT_UNRESTRICTED_AUTH, 1L);
+  curl_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_ANY);
+  curl_easy_setopt(curl, CURLOPT_EXPECT_100_TIMEOUT_MS, 0L);
+  return curl;
 }
 
 /* HREF finder implemented in libxml2 but could be any HTML parser */
-size_t follow_links(CURLM *multi_handle, memory *mem, char *url)
+static size_t follow_links(CURLM *multi, struct memory *mem, const char *url)
 {
-  int opts = HTML_PARSE_NOBLANKS | HTML_PARSE_NOERROR | \
-             HTML_PARSE_NOWARNING | HTML_PARSE_NONET;
-  htmlDocPtr doc = htmlReadMemory(mem->buf, mem->size, url, NULL, opts);
+  int opts = HTML_PARSE_NOBLANKS | HTML_PARSE_NOERROR | HTML_PARSE_NOWARNING |
+             HTML_PARSE_NONET;
+  htmlDocPtr doc = htmlReadMemory(mem->buf, (int)mem->size, url, NULL, opts);
+  size_t count;
+  int i;
+  xmlChar *xpath;
+  xmlNodeSetPtr nodeset;
+  xmlXPathContextPtr context;
+  xmlXPathObjectPtr object;
   if(!doc)
     return 0;
-  xmlChar *xpath = (xmlChar*) "//a/@href";
-  xmlXPathContextPtr context = xmlXPathNewContext(doc);
-  xmlXPathObjectPtr result = xmlXPathEvalExpression(xpath, context);
+  xpath = (xmlChar *)"//a/@href";
+  context = xmlXPathNewContext(doc);
+  object = xmlXPathEvalExpression(xpath, context);
   xmlXPathFreeContext(context);
-  if(!result)
+  if(!object)
     return 0;
-  xmlNodeSetPtr nodeset = result->nodesetval;
+  nodeset = object->nodesetval;
   if(xmlXPathNodeSetIsEmpty(nodeset)) {
-    xmlXPathFreeObject(result);
+    xmlXPathFreeObject(object);
     return 0;
   }
-  size_t count = 0;
-  int i;
+  count = 0;
   for(i = 0; i < nodeset->nodeNr; i++) {
     double r = rand();
-    int x = r * nodeset->nodeNr / RAND_MAX;
+    int x = (int)(r * nodeset->nodeNr / RAND_MAX);
     const xmlNode *node = nodeset->nodeTab[x]->xmlChildrenNode;
     xmlChar *href = xmlNodeListGetString(doc, node, 1);
+    char *link;
     if(follow_relative_links) {
       xmlChar *orig = href;
-      href = xmlBuildURI(href, (xmlChar *) url);
+      href = xmlBuildURI(href, (xmlChar *)url);
       xmlFree(orig);
     }
-    char *link = (char *) href;
+    link = (char *)href;
     if(!link || strlen(link) < 20)
       continue;
     if(!strncmp(link, "http://", 7) || !strncmp(link, "https://", 8)) {
-      curl_multi_add_handle(multi_handle, make_handle(link));
+      curl_multi_add_handle(multi, make_handle(link));
       if(count++ == max_link_per_page)
         break;
     }
     xmlFree(link);
   }
-  xmlXPathFreeObject(result);
+  xmlXPathFreeObject(object);
   return count;
 }
 
-int is_html(char *ctype)
+static int is_html(const char *ctype)
 {
-  return ctype != NULL && strlen(ctype) > 10 && strstr(ctype, "text/html");
+  return ctype && strlen(ctype) > 10 && strstr(ctype, "text/html");
 }
 
 int main(void)
 {
-  signal(SIGINT, sighandler);
-  LIBXML_TEST_VERSION;
-  curl_global_init(CURL_GLOBAL_DEFAULT);
-  CURLM *multi_handle = curl_multi_init();
-  curl_multi_setopt(multi_handle, CURLMOPT_MAX_TOTAL_CONNECTIONS, max_con);
-  curl_multi_setopt(multi_handle, CURLMOPT_MAX_HOST_CONNECTIONS, 6L);
+  CURLM *multi;
+  int msgs_left;
+  int pending;
+  int complete;
+  int still_running;
+  CURLcode result;
 
-  /* enables http/2 if available */
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
+  signal(SIGINT, sighandler);
+  LIBXML_TEST_VERSION
+  multi = curl_multi_init();
+  if(multi) {
+    curl_multi_setopt(multi, CURLMOPT_MAX_TOTAL_CONNECTIONS, max_con);
+    curl_multi_setopt(multi, CURLMOPT_MAX_HOST_CONNECTIONS, 6L);
+
+    /* enables http/2 if available */
 #ifdef CURLPIPE_MULTIPLEX
-  curl_multi_setopt(multi_handle, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
+    curl_multi_setopt(multi, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
 #endif
 
-  /* sets html start page */
-  curl_multi_add_handle(multi_handle, make_handle(start_page));
+    /* sets html start page */
+    curl_multi_add_handle(multi, make_handle(start_page));
 
-  int msgs_left;
-  int pending = 0;
-  int complete = 0;
-  int still_running = 1;
-  while(still_running && !pending_interrupt) {
-    int numfds;
-    curl_multi_wait(multi_handle, NULL, 0, 1000, &numfds);
-    curl_multi_perform(multi_handle, &still_running);
+    pending = 0;
+    complete = 0;
+    still_running = 1;
+    while(still_running && !pending_interrupt) {
+      int numfds;
+      CURLMsg *m;
 
-    /* See how the transfers went */
-    CURLMsg *m = NULL;
-    while((m = curl_multi_info_read(multi_handle, &msgs_left))) {
-      if(m->msg == CURLMSG_DONE) {
-        CURL *handle = m->easy_handle;
-        char *url;
-        memory *mem;
-        curl_easy_getinfo(handle, CURLINFO_PRIVATE, &mem);
-        curl_easy_getinfo(handle, CURLINFO_EFFECTIVE_URL, &url);
-        if(m->data.result == CURLE_OK) {
-          long res_status;
-          curl_easy_getinfo(handle, CURLINFO_RESPONSE_CODE, &res_status);
-          if(res_status == 200) {
-            char *ctype;
-            curl_easy_getinfo(handle, CURLINFO_CONTENT_TYPE, &ctype);
-            printf("[%d] HTTP 200 (%s): %s\n", complete, ctype, url);
-            if(is_html(ctype) && mem->size > 100) {
-              if(pending < max_requests && (complete + pending) < max_total) {
-                pending += follow_links(multi_handle, mem, url);
-                still_running = 1;
+      curl_multi_wait(multi, NULL, 0, 1000, &numfds);
+      curl_multi_perform(multi, &still_running);
+
+      /* See how the transfers went */
+      m = NULL;
+      while((m = curl_multi_info_read(multi, &msgs_left))) {
+        if(m->msg == CURLMSG_DONE) {
+          CURL *curl = m->easy_handle;
+          char *url;
+          struct memory *mem;
+          curl_easy_getinfo(curl, CURLINFO_PRIVATE, &mem);
+          curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_URL, &url);
+          if(m->data.result == CURLE_OK) {
+            long res_status;
+            curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &res_status);
+            if(res_status == 200) {
+              char *ctype;
+              curl_easy_getinfo(curl, CURLINFO_CONTENT_TYPE, &ctype);
+              printf("[%d] HTTP 200 (%s): %s\n", complete, ctype, url);
+              if(is_html(ctype) && mem->size > 100) {
+                if(pending < max_requests &&
+                   (complete + pending) < max_total) {
+                  pending += follow_links(multi, mem, url);
+                  still_running = 1;
+                }
               }
             }
+            else {
+              printf("[%d] HTTP %d: %s\n", complete, (int)res_status, url);
+            }
           }
           else {
-            printf("[%d] HTTP %d: %s\n", complete, (int) res_status, url);
+            printf("[%d] Connection failure: %s\n", complete, url);
           }
+          curl_multi_remove_handle(multi, curl);
+          curl_easy_cleanup(curl);
+          free(mem->buf);
+          free(mem);
+          complete++;
+          pending--;
         }
-        else {
-          printf("[%d] Connection failure: %s\n", complete, url);
-        }
-        curl_multi_remove_handle(multi_handle, handle);
-        curl_easy_cleanup(handle);
-        free(mem->buf);
-        free(mem);
-        complete++;
-        pending--;
       }
     }
+    curl_multi_cleanup(multi);
   }
-  curl_multi_cleanup(multi_handle);
   curl_global_cleanup();
   return 0;
 }
diff --git a/third-party/curl/docs/examples/debug.c b/third-party/curl/docs/examples/debug.c
index 684a183272..449cd1111b 100644
--- a/third-party/curl/docs/examples/debug.c
+++ b/third-party/curl/docs/examples/debug.c
@@ -26,16 +26,15 @@
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 struct data {
   char trace_ascii; /* 1 or 0 */
 };
 
-static
-void dump(const char *text,
-          FILE *stream, unsigned char *ptr, size_t size,
-          char nohex)
+static void dump(const char *text, const unsigned char *ptr,
+                 size_t size, char nohex)
 {
   size_t i;
   size_t c;
@@ -46,20 +45,20 @@ void dump(const char *text,
     /* without the hex output, we can fit more on screen */
     width = 0x40;
 
-  fprintf(stream, "%s, %10.10lu bytes (0x%8.8lx)\n",
+  fprintf(stderr, "%s, %lu bytes (0x%lx)\n",
           text, (unsigned long)size, (unsigned long)size);
 
-  for(i = 0; i<size; i += width) {
+  for(i = 0; i < size; i += width) {
 
-    fprintf(stream, "%4.4lx: ", (unsigned long)i);
+    fprintf(stderr, "%4.4lx: ", (unsigned long)i);
 
     if(!nohex) {
       /* hex not disabled, show it */
       for(c = 0; c < width; c++)
         if(i + c < size)
-          fprintf(stream, "%02x ", ptr[i + c]);
+          fprintf(stderr, "%02x ", ptr[i + c]);
         else
-          fputs("   ", stream);
+          fputs("   ", stderr);
     }
 
     for(c = 0; (c < width) && (i + c < size); c++) {
@@ -69,36 +68,30 @@ void dump(const char *text,
         i += (c + 2 - width);
         break;
       }
-      fprintf(stream, "%c",
-              (ptr[i + c] >= 0x20) && (ptr[i + c]<0x80)?ptr[i + c]:'.');
-      /* check again for 0D0A, to avoid an extra \n if it's at width */
+      fprintf(stderr, "%c",
+              (ptr[i + c] >= 0x20) && (ptr[i + c] < 0x80) ? ptr[i + c] : '.');
+      /* check again for 0D0A, to avoid an extra \n if it is at width */
       if(nohex && (i + c + 2 < size) && ptr[i + c + 1] == 0x0D &&
          ptr[i + c + 2] == 0x0A) {
         i += (c + 3 - width);
         break;
       }
     }
-    fputc('\n', stream); /* newline */
+    fputc('\n', stderr); /* newline */
   }
-  fflush(stream);
 }
 
-static
-int my_trace(CURL *handle, curl_infotype type,
-             char *data, size_t size,
-             void *userp)
+static int my_trace(CURL *curl, curl_infotype type,
+                    char *data, size_t size, void *userp)
 {
   struct data *config = (struct data *)userp;
   const char *text;
-  (void)handle; /* prevent compiler warning */
+  (void)curl;
 
   switch(type) {
   case CURLINFO_TEXT:
     fprintf(stderr, "== Info: %s", data);
-    /* FALLTHROUGH */
-  default: /* in case a new one is introduced to shock us */
     return 0;
-
   case CURLINFO_HEADER_OUT:
     text = "=> Send header";
     break;
@@ -117,19 +110,25 @@ int my_trace(CURL *handle, curl_infotype type,
   case CURLINFO_SSL_DATA_IN:
     text = "<= Recv SSL data";
     break;
+  default: /* in case a new one is introduced to shock us */
+    return 0;
   }
 
-  dump(text, stderr, (unsigned char *)data, size, config->trace_ascii);
+  dump(text, (const unsigned char *)data, size, config->trace_ascii);
   return 0;
 }
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+  CURLcode result;
   struct data config;
 
-  config.trace_ascii = 1; /* enable ascii tracing */
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
+  config.trace_ascii = 1; /* enable ASCII tracing */
 
   curl = curl_easy_init();
   if(curl) {
@@ -143,14 +142,15 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
 
     curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
-  return 0;
+  curl_global_cleanup();
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/default-scheme.c b/third-party/curl/docs/examples/default-scheme.c
index 525dcc3c32..198c9c8041 100644
--- a/third-party/curl/docs/examples/default-scheme.c
+++ b/third-party/curl/docs/examples/default-scheme.c
@@ -26,12 +26,17 @@
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+  CURLcode result;
+
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -43,15 +48,16 @@ int main(void)
 
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
-  return 0;
+  curl_global_cleanup();
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/ephiperfifo.c b/third-party/curl/docs/examples/ephiperfifo.c
index 0ce68de5dd..292bfc741e 100644
--- a/third-party/curl/docs/examples/ephiperfifo.c
+++ b/third-party/curl/docs/examples/ephiperfifo.c
@@ -22,7 +22,7 @@
  *
  ***************************************************************************/
 /* <DESC>
- * multi socket API usage with epoll and timerfd
+ * multi socket interface with epoll and timerfd
  * </DESC>
  */
 /* Example application source code using the multi socket interface to
@@ -32,33 +32,30 @@
  * but this uses epoll and timerfd instead of libevent.
  *
  * Written by Jeff Pohlmeyer, converted to use epoll by Josh Bialkowski
-
-Requires a linux system with epoll
-
-When running, the program creates the named pipe "hiper.fifo"
-
-Whenever there is input into the fifo, the program reads the input as a list
-of URL's and creates some new easy handles to fetch each URL via the
-curl_multi "hiper" API.
-
-
-Thus, you can try a single URL:
-  % echo http://www.yahoo.com > hiper.fifo
-
-Or a whole bunch of them:
-  % cat my-url-list > hiper.fifo
-
-The fifo buffer is handled almost instantly, so you can even add more URL's
-while the previous requests are still being downloaded.
-
-Note:
-  For the sake of simplicity, URL length is limited to 1023 char's !
-
-This is purely a demo app, all retrieved data is simply discarded by the write
-callback.
-
-*/
-
+ *
+ * Requires a Linux system with epoll
+ *
+ * When running, the program creates the named pipe "hiper.fifo"
+ *
+ * Whenever there is input into the fifo, the program reads the input as a list
+ * of URL's and creates some new easy handles to fetch each URL via the
+ * curl_multi "hiper" API.
+ *
+ * Thus, you can try a single URL:
+ *   % echo http://www.example.com > hiper.fifo
+ *
+ * Or a whole bunch of them:
+ *   % cat my-url-list > hiper.fifo
+ *
+ * The fifo buffer is handled almost instantly, so you can even add more URL's
+ * while the previous requests are still being downloaded.
+ *
+ * Note:
+ *   For the sake of simplicity, URL length is limited to 1023 chars.
+ *
+ * This is purely a demo app, all retrieved data is discarded by
+ * the write callback.
+ */
 #include <errno.h>
 #include <fcntl.h>
 #include <signal.h>
@@ -77,41 +74,32 @@ callback.
 
 #define MSG_OUT stdout /* Send info to stdout, change to stderr if you want */
 
-
 /* Global information, common to all connections */
-typedef struct _GlobalInfo
-{
+struct GlobalInfo {
   int epfd;    /* epoll filedescriptor */
   int tfd;     /* timer filedescriptor */
   int fifofd;  /* fifo filedescriptor */
   CURLM *multi;
   int still_running;
   FILE *input;
-} GlobalInfo;
-
+};
 
 /* Information associated with a specific easy handle */
-typedef struct _ConnInfo
-{
-  CURL *easy;
+struct ConnInfo {
+  CURL *curl;
   char *url;
-  GlobalInfo *global;
+  struct GlobalInfo *global;
   char error[CURL_ERROR_SIZE];
-} ConnInfo;
-
+};
 
 /* Information associated with a specific socket */
-typedef struct _SockInfo
-{
+struct SockInfo {
   curl_socket_t sockfd;
-  CURL *easy;
+  CURL *curl;
   int action;
   long timeout;
-  GlobalInfo *global;
-} SockInfo;
-
-#define mycase(code) \
-  case code: s = __STRING(code)
+  struct GlobalInfo *global;
+};
 
 /* Die if we get a bad CURLMcode somewhere */
 static void mcode_or_die(const char *where, CURLMcode code)
@@ -119,14 +107,29 @@ static void mcode_or_die(const char *where, CURLMcode code)
   if(CURLM_OK != code) {
     const char *s;
     switch(code) {
-      mycase(CURLM_BAD_HANDLE); break;
-      mycase(CURLM_BAD_EASY_HANDLE); break;
-      mycase(CURLM_OUT_OF_MEMORY); break;
-      mycase(CURLM_INTERNAL_ERROR); break;
-      mycase(CURLM_UNKNOWN_OPTION); break;
-      mycase(CURLM_LAST); break;
-      default: s = "CURLM_unknown"; break;
-      mycase(CURLM_BAD_SOCKET);
+    case CURLM_BAD_HANDLE:
+      s = "CURLM_BAD_HANDLE";
+      break;
+    case CURLM_BAD_EASY_HANDLE:
+      s = "CURLM_BAD_EASY_HANDLE";
+      break;
+    case CURLM_OUT_OF_MEMORY:
+      s = "CURLM_OUT_OF_MEMORY";
+      break;
+    case CURLM_INTERNAL_ERROR:
+      s = "CURLM_INTERNAL_ERROR";
+      break;
+    case CURLM_UNKNOWN_OPTION:
+      s = "CURLM_UNKNOWN_OPTION";
+      break;
+    case CURLM_LAST:
+      s = "CURLM_LAST";
+      break;
+    default:
+      s = "CURLM_unknown";
+      break;
+    case CURLM_BAD_SOCKET:
+      s = "CURLM_BAD_SOCKET";
       fprintf(MSG_OUT, "ERROR: %s returns %s\n", where, s);
       /* ignore this error */
       return;
@@ -136,15 +139,71 @@ static void mcode_or_die(const char *where, CURLMcode code)
   }
 }
 
-static void timer_cb(GlobalInfo* g, int revents);
+/* Check for completed transfers, and remove their easy handles */
+static void check_multi_info(struct GlobalInfo *g)
+{
+  char *eff_url;
+  CURLMsg *msg;
+  int msgs_left;
+  struct ConnInfo *conn;
 
-/* Update the timer after curl_multi library does it's thing. Curl will
- * inform us through this callback what it wants the new timeout to be,
+  fprintf(MSG_OUT, "REMAINING: %d\n", g->still_running);
+  while((msg = curl_multi_info_read(g->multi, &msgs_left))) {
+    if(msg->msg == CURLMSG_DONE) {
+      CURL *curl = msg->easy_handle;
+      CURLcode result = msg->data.result;
+      curl_easy_getinfo(curl, CURLINFO_PRIVATE, &conn);
+      curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_URL, &eff_url);
+      fprintf(MSG_OUT, "DONE: %s => (%d) %s\n", eff_url, result, conn->error);
+      curl_multi_remove_handle(g->multi, curl);
+      free(conn->url);
+      curl_easy_cleanup(curl);
+      free(conn);
+    }
+  }
+}
+
+/* Called by main loop when our timeout expires */
+static void timer_cb(struct GlobalInfo *g, int revents)
+{
+  CURLMcode mresult;
+  uint64_t count = 0;
+  ssize_t err = 0;
+
+  (void)revents;
+
+  err = read(g->tfd, &count, sizeof(uint64_t));
+  if(err == -1) {
+    /* Note that we may call the timer callback even if the timerfd is not
+     * readable. It is possible that there are multiple events stored in the
+     * epoll buffer (i.e. the timer may have fired multiple times). The event
+     * count is cleared after the first call so future events in the epoll
+     * buffer fails to read from the timer. */
+    if(errno == EAGAIN) {
+      fprintf(MSG_OUT, "EAGAIN on tfd %d\n", g->tfd);
+      return;
+    }
+  }
+  if(err != sizeof(uint64_t)) {
+    fprintf(stderr, "read(tfd) == %ld", err);
+    perror("read(tfd)");
+  }
+
+  mresult = curl_multi_socket_action(g->multi, CURL_SOCKET_TIMEOUT, 0,
+                                     &g->still_running);
+  mcode_or_die("timer_cb: curl_multi_socket_action", mresult);
+  check_multi_info(g);
+}
+
+/* Update the timer after curl_multi library does its thing. curl informs the
+ * application through this callback what it wants the new timeout to be,
  * after it does some work. */
-static int multi_timer_cb(CURLM *multi, long timeout_ms, GlobalInfo *g)
+static int multi_timer_cb(CURLM *multi, long timeout_ms, struct GlobalInfo *g)
 {
   struct itimerspec its;
 
+  (void)multi;
+
   fprintf(MSG_OUT, "multi_timer_cb: Setting timeout to %ld ms\n", timeout_ms);
 
   if(timeout_ms > 0) {
@@ -163,94 +222,35 @@ static int multi_timer_cb(CURLM *multi, long timeout_ms, GlobalInfo *g)
     its.it_value.tv_nsec = 1;
   }
   else {
-    memset(&its, 0, sizeof(struct itimerspec));
+    memset(&its, 0, sizeof(its));
   }
 
-  timerfd_settime(g->tfd, /* flags= */0, &its, NULL);
+  timerfd_settime(g->tfd, /* flags= */ 0, &its, NULL);
   return 0;
 }
 
-
-/* Check for completed transfers, and remove their easy handles */
-static void check_multi_info(GlobalInfo *g)
-{
-  char *eff_url;
-  CURLMsg *msg;
-  int msgs_left;
-  ConnInfo *conn;
-  CURL *easy;
-  CURLcode res;
-
-  fprintf(MSG_OUT, "REMAINING: %d\n", g->still_running);
-  while((msg = curl_multi_info_read(g->multi, &msgs_left))) {
-    if(msg->msg == CURLMSG_DONE) {
-      easy = msg->easy_handle;
-      res = msg->data.result;
-      curl_easy_getinfo(easy, CURLINFO_PRIVATE, &conn);
-      curl_easy_getinfo(easy, CURLINFO_EFFECTIVE_URL, &eff_url);
-      fprintf(MSG_OUT, "DONE: %s => (%d) %s\n", eff_url, res, conn->error);
-      curl_multi_remove_handle(g->multi, easy);
-      free(conn->url);
-      curl_easy_cleanup(easy);
-      free(conn);
-    }
-  }
-}
-
 /* Called by libevent when we get action on a multi socket filedescriptor */
-static void event_cb(GlobalInfo *g, int fd, int revents)
+static void event_cb(struct GlobalInfo *g, int fd, int revents)
 {
-  CURLMcode rc;
+  CURLMcode mresult;
   struct itimerspec its;
 
   int action = ((revents & EPOLLIN) ? CURL_CSELECT_IN : 0) |
                ((revents & EPOLLOUT) ? CURL_CSELECT_OUT : 0);
 
-  rc = curl_multi_socket_action(g->multi, fd, action, &g->still_running);
-  mcode_or_die("event_cb: curl_multi_socket_action", rc);
+  mresult = curl_multi_socket_action(g->multi, fd, action, &g->still_running);
+  mcode_or_die("event_cb: curl_multi_socket_action", mresult);
 
   check_multi_info(g);
   if(g->still_running <= 0) {
     fprintf(MSG_OUT, "last transfer done, kill timeout\n");
-    memset(&its, 0, sizeof(struct itimerspec));
+    memset(&its, 0, sizeof(its));
     timerfd_settime(g->tfd, 0, &its, NULL);
   }
 }
 
-/* Called by main loop when our timeout expires */
-static void timer_cb(GlobalInfo* g, int revents)
-{
-  CURLMcode rc;
-  uint64_t count = 0;
-  ssize_t err = 0;
-
-  err = read(g->tfd, &count, sizeof(uint64_t));
-  if(err == -1) {
-    /* Note that we may call the timer callback even if the timerfd is not
-     * readable. It's possible that there are multiple events stored in the
-     * epoll buffer (i.e. the timer may have fired multiple times). The
-     * event count is cleared after the first call so future events in the
-     * epoll buffer will fail to read from the timer. */
-    if(errno == EAGAIN) {
-      fprintf(MSG_OUT, "EAGAIN on tfd %d\n", g->tfd);
-      return;
-    }
-  }
-  if(err != sizeof(uint64_t)) {
-    fprintf(stderr, "read(tfd) == %ld", err);
-    perror("read(tfd)");
-  }
-
-  rc = curl_multi_socket_action(g->multi,
-                                  CURL_SOCKET_TIMEOUT, 0, &g->still_running);
-  mcode_or_die("timer_cb: curl_multi_socket_action", rc);
-  check_multi_info(g);
-}
-
-
-
 /* Clean up the SockInfo structure */
-static void remsock(SockInfo *f, GlobalInfo* g)
+static void remsock(struct SockInfo *f, struct GlobalInfo *g)
 {
   if(f) {
     if(f->sockfd) {
@@ -262,11 +262,9 @@ static void remsock(SockInfo *f, GlobalInfo* g)
   }
 }
 
-
-
 /* Assign information to a SockInfo structure */
-static void setsock(SockInfo *f, curl_socket_t s, CURL *e, int act,
-                    GlobalInfo *g)
+static void setsock(struct SockInfo *f, curl_socket_t s, CURL *e, int act,
+                    struct GlobalInfo *g)
 {
   struct epoll_event ev;
   int kind = ((act & CURL_POLL_IN) ? EPOLLIN : 0) |
@@ -280,7 +278,7 @@ static void setsock(SockInfo *f, curl_socket_t s, CURL *e, int act,
 
   f->sockfd = s;
   f->action = act;
-  f->easy = e;
+  f->curl = e;
 
   ev.events = kind;
   ev.data.fd = s;
@@ -289,27 +287,25 @@ static void setsock(SockInfo *f, curl_socket_t s, CURL *e, int act,
             s, strerror(errno));
 }
 
-
-
 /* Initialize a new SockInfo structure */
-static void addsock(curl_socket_t s, CURL *easy, int action, GlobalInfo *g)
+static void addsock(curl_socket_t s, CURL *curl, int action,
+                    struct GlobalInfo *g)
 {
-  SockInfo *fdp = (SockInfo*)calloc(1, sizeof(SockInfo));
+  struct SockInfo *fdp = calloc(1, sizeof(struct SockInfo));
 
   fdp->global = g;
-  setsock(fdp, s, easy, action, g);
+  setsock(fdp, s, curl, action, g);
   curl_multi_assign(g->multi, s, fdp);
 }
 
 /* CURLMOPT_SOCKETFUNCTION */
 static int sock_cb(CURL *e, curl_socket_t s, int what, void *cbp, void *sockp)
 {
-  GlobalInfo *g = (GlobalInfo*) cbp;
-  SockInfo *fdp = (SockInfo*) sockp;
-  const char *whatstr[]={ "none", "IN", "OUT", "INOUT", "REMOVE" };
+  struct GlobalInfo *g = (struct GlobalInfo *)cbp;
+  struct SockInfo *fdp = (struct SockInfo *)sockp;
+  const char *whatstr[] = { "none", "IN", "OUT", "INOUT", "REMOVE" };
 
-  fprintf(MSG_OUT,
-          "socket callback: s=%d e=%p what=%s ", s, e, whatstr[what]);
+  fprintf(MSG_OUT, "socket callback: s=%d e=%p what=%s ", s, e, whatstr[what]);
   if(what == CURL_POLL_REMOVE) {
     fprintf(MSG_OUT, "\n");
     remsock(fdp, g);
@@ -320,8 +316,7 @@ static int sock_cb(CURL *e, curl_socket_t s, int what, void *cbp, void *sockp)
       addsock(s, e, what, g);
     }
     else {
-      fprintf(MSG_OUT,
-              "Changing action from %s to %s\n",
+      fprintf(MSG_OUT, "Changing action from %s to %s\n",
               whatstr[fdp->action], whatstr[what]);
       setsock(fdp, s, e, what, g);
     }
@@ -329,22 +324,19 @@ static int sock_cb(CURL *e, curl_socket_t s, int what, void *cbp, void *sockp)
   return 0;
 }
 
-
-
 /* CURLOPT_WRITEFUNCTION */
-static size_t write_cb(void *ptr, size_t size, size_t nmemb, void *data)
+static size_t write_cb(char *ptr, size_t size, size_t nmemb, void *data)
 {
   (void)ptr;
   (void)data;
   return size * nmemb;
 }
 
-
 /* CURLOPT_PROGRESSFUNCTION */
 static int prog_cb(void *p, double dltotal, double dlnow, double ult,
                    double uln)
 {
-  ConnInfo *conn = (ConnInfo *)p;
+  struct ConnInfo *conn = (struct ConnInfo *)p;
   (void)ult;
   (void)uln;
 
@@ -352,55 +344,57 @@ static int prog_cb(void *p, double dltotal, double dlnow, double ult,
   return 0;
 }
 
-
 /* Create a new easy handle, and add it to the global curl_multi */
-static void new_conn(char *url, GlobalInfo *g)
+static void new_conn(const char *url, struct GlobalInfo *g)
 {
-  ConnInfo *conn;
-  CURLMcode rc;
+  struct ConnInfo *conn;
+  CURLMcode mresult;
 
-  conn = (ConnInfo*)calloc(1, sizeof(ConnInfo));
-  conn->error[0]='\0';
+  conn = calloc(1, sizeof(*conn));
+  conn->error[0] = '\0';
 
-  conn->easy = curl_easy_init();
-  if(!conn->easy) {
+  conn->curl = curl_easy_init();
+  if(!conn->curl) {
     fprintf(MSG_OUT, "curl_easy_init() failed, exiting!\n");
     exit(2);
   }
   conn->global = g;
   conn->url = strdup(url);
-  curl_easy_setopt(conn->easy, CURLOPT_URL, conn->url);
-  curl_easy_setopt(conn->easy, CURLOPT_WRITEFUNCTION, write_cb);
-  curl_easy_setopt(conn->easy, CURLOPT_WRITEDATA, conn);
-  curl_easy_setopt(conn->easy, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(conn->easy, CURLOPT_ERRORBUFFER, conn->error);
-  curl_easy_setopt(conn->easy, CURLOPT_PRIVATE, conn);
-  curl_easy_setopt(conn->easy, CURLOPT_NOPROGRESS, 0L);
-  curl_easy_setopt(conn->easy, CURLOPT_PROGRESSFUNCTION, prog_cb);
-  curl_easy_setopt(conn->easy, CURLOPT_PROGRESSDATA, conn);
-  curl_easy_setopt(conn->easy, CURLOPT_FOLLOWLOCATION, 1L);
-  curl_easy_setopt(conn->easy, CURLOPT_LOW_SPEED_TIME, 3L);
-  curl_easy_setopt(conn->easy, CURLOPT_LOW_SPEED_LIMIT, 10L);
-  fprintf(MSG_OUT,
-          "Adding easy %p to multi %p (%s)\n", conn->easy, g->multi, url);
-  rc = curl_multi_add_handle(g->multi, conn->easy);
-  mcode_or_die("new_conn: curl_multi_add_handle", rc);
+  curl_easy_setopt(conn->curl, CURLOPT_URL, conn->url);
+  curl_easy_setopt(conn->curl, CURLOPT_WRITEFUNCTION, write_cb);
+  curl_easy_setopt(conn->curl, CURLOPT_WRITEDATA, conn);
+  curl_easy_setopt(conn->curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(conn->curl, CURLOPT_ERRORBUFFER, conn->error);
+  curl_easy_setopt(conn->curl, CURLOPT_PRIVATE, conn);
+  curl_easy_setopt(conn->curl, CURLOPT_NOPROGRESS, 0L);
+  curl_easy_setopt(conn->curl, CURLOPT_PROGRESSFUNCTION, prog_cb);
+  curl_easy_setopt(conn->curl, CURLOPT_PROGRESSDATA, conn);
+  curl_easy_setopt(conn->curl, CURLOPT_FOLLOWLOCATION, 1L);
+  curl_easy_setopt(conn->curl, CURLOPT_LOW_SPEED_TIME, 3L);
+  curl_easy_setopt(conn->curl, CURLOPT_LOW_SPEED_LIMIT, 10L);
 
-  /* note that the add_handle() will set a time-out to trigger soon so that
-     the necessary socket_action() call will be called by this app */
+  fprintf(MSG_OUT, "Adding easy %p to multi %p (%s)\n",
+          conn->curl, g->multi, url);
+  mresult = curl_multi_add_handle(g->multi, conn->curl);
+  mcode_or_die("new_conn: curl_multi_add_handle", mresult);
+
+  /* note that add_handle() sets a timeout to trigger soon so that the
+     necessary socket_action() gets called */
 }
 
 /* This gets called whenever data is received from the fifo */
-static void fifo_cb(GlobalInfo* g, int revents)
+static void fifo_cb(struct GlobalInfo *g, int revents)
 {
   char s[1024];
   long int rv = 0;
   int n = 0;
 
+  (void)revents;
+
   do {
-    s[0]='\0';
+    s[0] = '\0';
     rv = fscanf(g->input, "%1023s%n", s, &n);
-    s[n]='\0';
+    s[n] = '\0';
     if(n && s[0]) {
       new_conn(s, g); /* if we read a URL, go get it! */
     }
@@ -410,30 +404,30 @@ static void fifo_cb(GlobalInfo* g, int revents)
 }
 
 /* Create a named pipe and tell libevent to monitor it */
-static const char *fifo = "hiper.fifo";
-static int init_fifo(GlobalInfo *g)
+static int init_fifo(struct GlobalInfo *g)
 {
   struct stat st;
+  static const char *fifo = "hiper.fifo";
   curl_socket_t sockfd;
   struct epoll_event epev;
 
   fprintf(MSG_OUT, "Creating named pipe \"%s\"\n", fifo);
-  if(lstat (fifo, &st) == 0) {
+  if(!lstat(fifo, &st)) {
     if((st.st_mode & S_IFMT) == S_IFREG) {
       errno = EEXIST;
       perror("lstat");
-      exit(1);
+      return 1;
     }
   }
   unlink(fifo);
-  if(mkfifo (fifo, 0600) == -1) {
+  if(mkfifo(fifo, 0600) == -1) {
     perror("mkfifo");
-    exit(1);
+    return 1;
   }
   sockfd = open(fifo, O_RDWR | O_NONBLOCK, 0);
   if(sockfd == -1) {
     perror("open");
-    exit(1);
+    return 1;
   }
 
   g->fifofd = sockfd;
@@ -447,14 +441,13 @@ static int init_fifo(GlobalInfo *g)
   return 0;
 }
 
-static void clean_fifo(GlobalInfo *g)
+static void clean_fifo(struct GlobalInfo *g)
 {
-    epoll_ctl(g->epfd, EPOLL_CTL_DEL, g->fifofd, NULL);
-    fclose(g->input);
-    unlink(fifo);
+  epoll_ctl(g->epfd, EPOLL_CTL_DEL, g->fifofd, NULL);
+  fclose(g->input);
+  unlink(fifo);
 }
 
-
 int g_should_exit_ = 0;
 
 void sigint_handler(int signo)
@@ -462,32 +455,37 @@ void sigint_handler(int signo)
   g_should_exit_ = 1;
 }
 
-int main(int argc, char **argv)
+int main(void)
 {
-  GlobalInfo g;
+  CURLcode result;
+  struct GlobalInfo g;
   struct itimerspec its;
   struct epoll_event ev;
   struct epoll_event events[10];
-  (void)argc;
-  (void)argv;
+
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   g_should_exit_ = 0;
   signal(SIGINT, sigint_handler);
 
-  memset(&g, 0, sizeof(GlobalInfo));
+  memset(&g, 0, sizeof(g));
   g.epfd = epoll_create1(EPOLL_CLOEXEC);
   if(g.epfd == -1) {
     perror("epoll_create1 failed");
-    exit(1);
+    curl_global_cleanup();
+    return 1;
   }
 
   g.tfd = timerfd_create(CLOCK_MONOTONIC, TFD_NONBLOCK | TFD_CLOEXEC);
   if(g.tfd == -1) {
     perror("timerfd_create failed");
-    exit(1);
+    curl_global_cleanup();
+    return 1;
   }
 
-  memset(&its, 0, sizeof(struct itimerspec));
+  memset(&its, 0, sizeof(its));
   its.it_interval.tv_sec = 0;
   its.it_value.tv_sec = 1;
   timerfd_settime(g.tfd, 0, &its, NULL);
@@ -496,7 +494,10 @@ int main(int argc, char **argv)
   ev.data.fd = g.tfd;
   epoll_ctl(g.epfd, EPOLL_CTL_ADD, g.tfd, &ev);
 
-  init_fifo(&g);
+  if(init_fifo(&g)) {
+    curl_global_cleanup();
+    return 1;
+  }
   g.multi = curl_multi_init();
 
   /* setup the generic multi interface options we want */
@@ -513,15 +514,17 @@ int main(int argc, char **argv)
   while(!g_should_exit_) {
     int idx;
     int err = epoll_wait(g.epfd, events,
-                         sizeof(events)/sizeof(struct epoll_event), 10000);
+                         sizeof(events) / sizeof(struct epoll_event), 10000);
     if(err == -1) {
+      /* !checksrc! disable ERRNOVAR 1 */
       if(errno == EINTR) {
         fprintf(MSG_OUT, "note: wait interrupted\n");
         continue;
       }
       else {
         perror("epoll_wait");
-        exit(1);
+        curl_global_cleanup();
+        return 1;
       }
     }
 
@@ -543,5 +546,6 @@ int main(int argc, char **argv)
 
   curl_multi_cleanup(g.multi);
   clean_fifo(&g);
+  curl_global_cleanup();
   return 0;
 }
diff --git a/third-party/curl/docs/examples/evhiperfifo.c b/third-party/curl/docs/examples/evhiperfifo.c
index 17bff2b65a..079eab1e8a 100644
--- a/third-party/curl/docs/examples/evhiperfifo.c
+++ b/third-party/curl/docs/examples/evhiperfifo.c
@@ -22,7 +22,7 @@
  *
  ***************************************************************************/
 /* <DESC>
- * multi socket interface together with libev
+ * multi socket interface with libev
  * </DESC>
  */
 /* Example application source code using the multi socket interface to
@@ -32,103 +32,78 @@
  * but this uses libev instead of libevent.
  *
  * Written by Jeff Pohlmeyer, converted to use libev by Markus Koetter
-
-Requires libev and a (POSIX?) system that has mkfifo().
-
-This is an adaptation of libcurl's "hipev.c" and libevent's "event-test.c"
-sample programs.
-
-When running, the program creates the named pipe "hiper.fifo"
-
-Whenever there is input into the fifo, the program reads the input as a list
-of URL's and creates some new easy handles to fetch each URL via the
-curl_multi "hiper" API.
-
-
-Thus, you can try a single URL:
-  % echo http://www.yahoo.com > hiper.fifo
-
-Or a whole bunch of them:
-  % cat my-url-list > hiper.fifo
-
-The fifo buffer is handled almost instantly, so you can even add more URL's
-while the previous requests are still being downloaded.
-
-Note:
-  For the sake of simplicity, URL length is limited to 1023 char's !
-
-This is purely a demo app, all retrieved data is simply discarded by the write
-callback.
-
-*/
-
+ *
+ * Requires libev and a (POSIX?) system that has mkfifo().
+ *
+ * This is an adaptation of libcurl's "hipev.c" and libevent's "event-test.c"
+ * sample programs.
+ *
+ * When running, the program creates the named pipe "hiper.fifo"
+ *
+ * Whenever there is input into the fifo, the program reads the input as a list
+ * of URL's and creates some new easy handles to fetch each URL via the
+ * curl_multi "hiper" API.
+ *
+ * Thus, you can try a single URL:
+ *   % echo http://www.example.com > hiper.fifo
+ *
+ * Or a whole bunch of them:
+ *   % cat my-url-list > hiper.fifo
+ *
+ * The fifo buffer is handled almost instantly, so you can even add more URL's
+ * while the previous requests are still being downloaded.
+ *
+ * Note:
+ *   For the sake of simplicity, URL length is limited to 1023 chars.
+ *
+ * This is purely a demo app, all retrieved data is discarded by
+ * the write callback.
+ */
+#include <errno.h>
+#include <fcntl.h>
 #include <stdio.h>
-#include <string.h>
 #include <stdlib.h>
+#include <string.h>
+#include <sys/poll.h>
+#include <sys/stat.h>
 #include <sys/time.h>
 #include <time.h>
 #include <unistd.h>
-#include <sys/poll.h>
-#include <curl/curl.h>
-#include <ev.h>
-#include <fcntl.h>
-#include <sys/stat.h>
-#include <errno.h>
 
-#define DPRINT(x...) printf(x)
+#include <ev.h>
+
+#include <curl/curl.h>
 
 #define MSG_OUT stdout /* Send info to stdout, change to stderr if you want */
 
-
 /* Global information, common to all connections */
-typedef struct _GlobalInfo
-{
+struct GlobalInfo {
   struct ev_loop *loop;
   struct ev_io fifo_event;
   struct ev_timer timer_event;
   CURLM *multi;
   int still_running;
   FILE *input;
-} GlobalInfo;
-
+};
 
 /* Information associated with a specific easy handle */
-typedef struct _ConnInfo
-{
-  CURL *easy;
+struct ConnInfo {
+  CURL *curl;
   char *url;
-  GlobalInfo *global;
+  struct GlobalInfo *global;
   char error[CURL_ERROR_SIZE];
-} ConnInfo;
-
+};
 
 /* Information associated with a specific socket */
-typedef struct _SockInfo
-{
+struct SockInfo {
   curl_socket_t sockfd;
-  CURL *easy;
+  CURL *curl;
   int action;
   long timeout;
   struct ev_io ev;
   int evset;
-  GlobalInfo *global;
-} SockInfo;
-
-static void timer_cb(EV_P_ struct ev_timer *w, int revents);
-
-/* Update the event timer after curl_multi library calls */
-static int multi_timer_cb(CURLM *multi, long timeout_ms, GlobalInfo *g)
-{
-  DPRINT("%s %li\n", __PRETTY_FUNCTION__,  timeout_ms);
-  ev_timer_stop(g->loop, &g->timer_event);
-  if(timeout_ms >= 0) {
-    /* -1 means delete, other values are timeout times in milliseconds */
-    double  t = timeout_ms / 1000;
-    ev_timer_init(&g->timer_event, timer_cb, t, 0.);
-    ev_timer_start(g->loop, &g->timer_event);
-  }
-  return 0;
-}
+  struct GlobalInfo *global;
+};
 
 /* Die if we get a bad CURLMcode somewhere */
 static void mcode_or_die(const char *where, CURLMcode code)
@@ -168,47 +143,76 @@ static void mcode_or_die(const char *where, CURLMcode code)
   }
 }
 
-
-
 /* Check for completed transfers, and remove their easy handles */
-static void check_multi_info(GlobalInfo *g)
+static void check_multi_info(struct GlobalInfo *g)
 {
   char *eff_url;
   CURLMsg *msg;
   int msgs_left;
-  ConnInfo *conn;
-  CURL *easy;
-  CURLcode res;
+  struct ConnInfo *conn;
 
   fprintf(MSG_OUT, "REMAINING: %d\n", g->still_running);
   while((msg = curl_multi_info_read(g->multi, &msgs_left))) {
     if(msg->msg == CURLMSG_DONE) {
-      easy = msg->easy_handle;
-      res = msg->data.result;
-      curl_easy_getinfo(easy, CURLINFO_PRIVATE, &conn);
-      curl_easy_getinfo(easy, CURLINFO_EFFECTIVE_URL, &eff_url);
-      fprintf(MSG_OUT, "DONE: %s => (%d) %s\n", eff_url, res, conn->error);
-      curl_multi_remove_handle(g->multi, easy);
+      CURL *curl = msg->easy_handle;
+      CURLcode result = msg->data.result;
+      curl_easy_getinfo(curl, CURLINFO_PRIVATE, &conn);
+      curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_URL, &eff_url);
+      fprintf(MSG_OUT, "DONE: %s => (%d) %s\n", eff_url, result, conn->error);
+      curl_multi_remove_handle(g->multi, curl);
       free(conn->url);
-      curl_easy_cleanup(easy);
+      curl_easy_cleanup(curl);
       free(conn);
     }
   }
 }
 
+/* Called by libevent when our timeout expires */
+static void timer_cb(EV_P_ struct ev_timer *w, int revents)
+{
+  CURLMcode mresult;
+  struct GlobalInfo *g;
 
+  printf("%s  w %p revents %d\n", __PRETTY_FUNCTION__, (void *)w, revents);
+
+  g = (struct GlobalInfo *)w->data;
+
+  mresult = curl_multi_socket_action(g->multi, CURL_SOCKET_TIMEOUT, 0,
+                                     &g->still_running);
+  mcode_or_die("timer_cb: curl_multi_socket_action", mresult);
+  check_multi_info(g);
+}
+
+/* Update the event timer after curl_multi library calls */
+static int multi_timer_cb(CURLM *multi, long timeout_ms, struct GlobalInfo *g)
+{
+  (void)multi;
+  printf("%s %li\n", __PRETTY_FUNCTION__, timeout_ms);
+  ev_timer_stop(g->loop, &g->timer_event);
+  if(timeout_ms >= 0) {
+    /* -1 means delete, other values are timeout times in milliseconds */
+    double t = timeout_ms / 1000;
+    ev_timer_init(&g->timer_event, timer_cb, t, 0.);
+    ev_timer_start(g->loop, &g->timer_event);
+  }
+  return 0;
+}
 
 /* Called by libevent when we get action on a multi socket */
 static void event_cb(EV_P_ struct ev_io *w, int revents)
 {
-  DPRINT("%s  w %p revents %i\n", __PRETTY_FUNCTION__, w, revents);
-  GlobalInfo *g = (GlobalInfo*) w->data;
-  CURLMcode rc;
+  CURLMcode mresult;
+  struct GlobalInfo *g;
 
   int action = ((revents & EV_READ) ? CURL_POLL_IN : 0) |
-    ((revents & EV_WRITE) ? CURL_POLL_OUT : 0);
-  rc = curl_multi_socket_action(g->multi, w->fd, action, &g->still_running);
-  mcode_or_die("event_cb: curl_multi_socket_action", rc);
+               ((revents & EV_WRITE) ? CURL_POLL_OUT : 0);
+
+  printf("%s  w %p revents %d\n", __PRETTY_FUNCTION__, (void *)w, revents);
+  g = (struct GlobalInfo *)w->data;
+
+  mresult = curl_multi_socket_action(g->multi, w->fd, action,
+                                     &g->still_running);
+  mcode_or_die("event_cb: curl_multi_socket_action", mresult);
   check_multi_info(g);
   if(g->still_running <= 0) {
     fprintf(MSG_OUT, "last transfer done, kill timeout\n");
@@ -216,22 +220,8 @@ static void event_cb(EV_P_ struct ev_io *w, int revents)
   }
 }
 
-/* Called by libevent when our timeout expires */
-static void timer_cb(EV_P_ struct ev_timer *w, int revents)
-{
-  DPRINT("%s  w %p revents %i\n", __PRETTY_FUNCTION__, w, revents);
-
-  GlobalInfo *g = (GlobalInfo *)w->data;
-  CURLMcode rc;
-
-  rc = curl_multi_socket_action(g->multi, CURL_SOCKET_TIMEOUT, 0,
-                                &g->still_running);
-  mcode_or_die("timer_cb: curl_multi_socket_action", rc);
-  check_multi_info(g);
-}
-
 /* Clean up the SockInfo structure */
-static void remsock(SockInfo *f, GlobalInfo *g)
+static void remsock(struct SockInfo *f, struct GlobalInfo *g)
 {
   printf("%s  \n", __PRETTY_FUNCTION__);
   if(f) {
@@ -241,20 +231,18 @@ static void remsock(SockInfo *f, GlobalInfo *g)
   }
 }
 
-
-
 /* Assign information to a SockInfo structure */
-static void setsock(SockInfo *f, curl_socket_t s, CURL *e, int act,
-                    GlobalInfo *g)
+static void setsock(struct SockInfo *f, curl_socket_t s, CURL *e, int act,
+                    struct GlobalInfo *g)
 {
-  printf("%s  \n", __PRETTY_FUNCTION__);
-
   int kind = ((act & CURL_POLL_IN) ? EV_READ : 0) |
              ((act & CURL_POLL_OUT) ? EV_WRITE : 0);
 
+  printf("%s  \n", __PRETTY_FUNCTION__);
+
   f->sockfd = s;
   f->action = act;
-  f->easy = e;
+  f->curl = e;
   if(f->evset)
     ev_io_stop(g->loop, &f->ev);
   ev_io_init(&f->ev, event_cb, f->sockfd, kind);
@@ -263,30 +251,28 @@ static void setsock(SockInfo *f, curl_socket_t s, CURL *e, int act,
   ev_io_start(g->loop, &f->ev);
 }
 
-
-
 /* Initialize a new SockInfo structure */
-static void addsock(curl_socket_t s, CURL *easy, int action, GlobalInfo *g)
+static void addsock(curl_socket_t s, CURL *curl, int action,
+                    struct GlobalInfo *g)
 {
-  SockInfo *fdp = calloc(1, sizeof(SockInfo));
+  struct SockInfo *fdp = calloc(1, sizeof(struct SockInfo));
 
   fdp->global = g;
-  setsock(fdp, s, easy, action, g);
+  setsock(fdp, s, curl, action, g);
   curl_multi_assign(g->multi, s, fdp);
 }
 
 /* CURLMOPT_SOCKETFUNCTION */
 static int sock_cb(CURL *e, curl_socket_t s, int what, void *cbp, void *sockp)
 {
-  DPRINT("%s e %p s %i what %i cbp %p sockp %p\n",
+  struct GlobalInfo *g = (struct GlobalInfo *)cbp;
+  struct SockInfo *fdp = (struct SockInfo *)sockp;
+  const char *whatstr[] = { "none", "IN", "OUT", "INOUT", "REMOVE" };
+
+  printf("%s e %p s %d what %d cbp %p sockp %p\n",
          __PRETTY_FUNCTION__, e, s, what, cbp, sockp);
 
-  GlobalInfo *g = (GlobalInfo*) cbp;
-  SockInfo *fdp = (SockInfo*) sockp;
-  const char *whatstr[]={ "none", "IN", "OUT", "INOUT", "REMOVE"};
-
-  fprintf(MSG_OUT,
-          "socket callback: s=%d e=%p what=%s ", s, e, whatstr[what]);
+  fprintf(MSG_OUT, "socket callback: s=%d e=%p what=%s ", s, e, whatstr[what]);
   if(what == CURL_POLL_REMOVE) {
     fprintf(MSG_OUT, "\n");
     remsock(fdp, g);
@@ -297,8 +283,7 @@ static int sock_cb(CURL *e, curl_socket_t s, int what, void *cbp, void *sockp)
       addsock(s, e, what, g);
     }
     else {
-      fprintf(MSG_OUT,
-              "Changing action from %s to %s\n",
+      fprintf(MSG_OUT, "Changing action from %s to %s\n",
               whatstr[fdp->action], whatstr[what]);
       setsock(fdp, s, e, what, g);
     }
@@ -306,66 +291,65 @@ static int sock_cb(CURL *e, curl_socket_t s, int what, void *cbp, void *sockp)
   return 0;
 }
 
-
 /* CURLOPT_WRITEFUNCTION */
-static size_t write_cb(void *ptr, size_t size, size_t nmemb, void *data)
+static size_t write_cb(char *ptr, size_t size, size_t nmemb, void *data)
 {
   size_t realsize = size * nmemb;
-  ConnInfo *conn = (ConnInfo*) data;
+  struct ConnInfo *conn = (struct ConnInfo *)data;
   (void)ptr;
   (void)conn;
   return realsize;
 }
 
-
-/* CURLOPT_PROGRESSFUNCTION */
-static int prog_cb(void *p, double dltotal, double dlnow, double ult,
-                   double uln)
+/* CURLOPT_XFERINFOFUNCTION */
+static int xferinfo_cb(void *p, curl_off_t dltotal, curl_off_t dlnow,
+                       curl_off_t ult, curl_off_t uln)
 {
-  ConnInfo *conn = (ConnInfo *)p;
+  struct ConnInfo *conn = (struct ConnInfo *)p;
   (void)ult;
   (void)uln;
 
-  fprintf(MSG_OUT, "Progress: %s (%g/%g)\n", conn->url, dlnow, dltotal);
+  fprintf(MSG_OUT, "Progress: %s (%" CURL_FORMAT_CURL_OFF_T "/"
+          "%" CURL_FORMAT_CURL_OFF_T ")\n",
+          conn->url, dlnow, dltotal);
   return 0;
 }
 
-
 /* Create a new easy handle, and add it to the global curl_multi */
-static void new_conn(char *url, GlobalInfo *g)
+static void new_conn(const char *url, struct GlobalInfo *g)
 {
-  ConnInfo *conn;
-  CURLMcode rc;
+  struct ConnInfo *conn;
+  CURLMcode mresult;
 
-  conn = calloc(1, sizeof(ConnInfo));
-  conn->error[0]='\0';
+  conn = calloc(1, sizeof(*conn));
+  conn->error[0] = '\0';
 
-  conn->easy = curl_easy_init();
-  if(!conn->easy) {
+  conn->curl = curl_easy_init();
+  if(!conn->curl) {
     fprintf(MSG_OUT, "curl_easy_init() failed, exiting!\n");
     exit(2);
   }
   conn->global = g;
   conn->url = strdup(url);
-  curl_easy_setopt(conn->easy, CURLOPT_URL, conn->url);
-  curl_easy_setopt(conn->easy, CURLOPT_WRITEFUNCTION, write_cb);
-  curl_easy_setopt(conn->easy, CURLOPT_WRITEDATA, conn);
-  curl_easy_setopt(conn->easy, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(conn->easy, CURLOPT_ERRORBUFFER, conn->error);
-  curl_easy_setopt(conn->easy, CURLOPT_PRIVATE, conn);
-  curl_easy_setopt(conn->easy, CURLOPT_NOPROGRESS, 0L);
-  curl_easy_setopt(conn->easy, CURLOPT_PROGRESSFUNCTION, prog_cb);
-  curl_easy_setopt(conn->easy, CURLOPT_PROGRESSDATA, conn);
-  curl_easy_setopt(conn->easy, CURLOPT_LOW_SPEED_TIME, 3L);
-  curl_easy_setopt(conn->easy, CURLOPT_LOW_SPEED_LIMIT, 10L);
+  curl_easy_setopt(conn->curl, CURLOPT_URL, conn->url);
+  curl_easy_setopt(conn->curl, CURLOPT_WRITEFUNCTION, write_cb);
+  curl_easy_setopt(conn->curl, CURLOPT_WRITEDATA, conn);
+  curl_easy_setopt(conn->curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(conn->curl, CURLOPT_ERRORBUFFER, conn->error);
+  curl_easy_setopt(conn->curl, CURLOPT_PRIVATE, conn);
+  curl_easy_setopt(conn->curl, CURLOPT_NOPROGRESS, 0L);
+  curl_easy_setopt(conn->curl, CURLOPT_XFERINFOFUNCTION, xferinfo_cb);
+  curl_easy_setopt(conn->curl, CURLOPT_PROGRESSDATA, conn);
+  curl_easy_setopt(conn->curl, CURLOPT_LOW_SPEED_TIME, 3L);
+  curl_easy_setopt(conn->curl, CURLOPT_LOW_SPEED_LIMIT, 10L);
 
-  fprintf(MSG_OUT,
-          "Adding easy %p to multi %p (%s)\n", conn->easy, g->multi, url);
-  rc = curl_multi_add_handle(g->multi, conn->easy);
-  mcode_or_die("new_conn: curl_multi_add_handle", rc);
+  fprintf(MSG_OUT, "Adding easy %p to multi %p (%s)\n",
+          conn->curl, g->multi, url);
+  mresult = curl_multi_add_handle(g->multi, conn->curl);
+  mcode_or_die("new_conn: curl_multi_add_handle", mresult);
 
-  /* note that the add_handle() will set a time-out to trigger soon so that
-     the necessary socket_action() call will be called by this app */
+  /* note that add_handle() sets a timeout to trigger soon so that the
+     necessary socket_action() gets called */
 }
 
 /* This gets called whenever data is received from the fifo */
@@ -374,14 +358,16 @@ static void fifo_cb(EV_P_ struct ev_io *w, int revents)
   char s[1024];
   long int rv = 0;
   int n = 0;
-  GlobalInfo *g = (GlobalInfo *)w->data;
+  struct GlobalInfo *g = (struct GlobalInfo *)w->data;
+
+  (void)revents;
 
   do {
-    s[0]='\0';
+    s[0] = '\0';
     rv = fscanf(g->input, "%1023s%n", s, &n);
-    s[n]='\0';
+    s[n] = '\0';
     if(n && s[0]) {
-      new_conn(s, g);  /* if we read a URL, go get it! */
+      new_conn(s, g); /* if we read a URL, go get it! */
     }
     else
       break;
@@ -389,48 +375,52 @@ static void fifo_cb(EV_P_ struct ev_io *w, int revents)
 }
 
 /* Create a named pipe and tell libevent to monitor it */
-static int init_fifo(GlobalInfo *g)
+static int init_fifo(struct GlobalInfo *g)
 {
   struct stat st;
   static const char *fifo = "hiper.fifo";
   curl_socket_t sockfd;
 
   fprintf(MSG_OUT, "Creating named pipe \"%s\"\n", fifo);
-  if(lstat (fifo, &st) == 0) {
+  if(!lstat(fifo, &st)) {
     if((st.st_mode & S_IFMT) == S_IFREG) {
       errno = EEXIST;
       perror("lstat");
-      exit(1);
+      return 1;
     }
   }
   unlink(fifo);
-  if(mkfifo (fifo, 0600) == -1) {
+  if(mkfifo(fifo, 0600) == -1) {
     perror("mkfifo");
-    exit(1);
+    return 1;
   }
   sockfd = open(fifo, O_RDWR | O_NONBLOCK, 0);
   if(sockfd == -1) {
     perror("open");
-    exit(1);
+    return 1;
   }
   g->input = fdopen(sockfd, "r");
 
   fprintf(MSG_OUT, "Now, pipe some URL's into > %s\n", fifo);
   ev_io_init(&g->fifo_event, fifo_cb, sockfd, EV_READ);
   ev_io_start(g->loop, &g->fifo_event);
-  return (0);
+  return 0;
 }
 
-int main(int argc, char **argv)
+int main(void)
 {
-  GlobalInfo g;
-  (void)argc;
-  (void)argv;
+  CURLcode result;
+  struct GlobalInfo g;
 
-  memset(&g, 0, sizeof(GlobalInfo));
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
+  memset(&g, 0, sizeof(g));
   g.loop = ev_default_loop(0);
 
-  init_fifo(&g);
+  if(init_fifo(&g))
+    return 1;
   g.multi = curl_multi_init();
 
   ev_timer_init(&g.timer_event, timer_cb, 0., 0.);
@@ -446,5 +436,6 @@ int main(int argc, char **argv)
 
   ev_loop(g.loop, 0);
   curl_multi_cleanup(g.multi);
+  curl_global_cleanup();
   return 0;
 }
diff --git a/third-party/curl/docs/examples/externalsocket.c b/third-party/curl/docs/examples/externalsocket.c
index 1c78c3db41..b07f48b447 100644
--- a/third-party/curl/docs/examples/externalsocket.c
+++ b/third-party/curl/docs/examples/externalsocket.c
@@ -25,35 +25,42 @@
  * Pass in a custom socket for libcurl to use.
  * </DESC>
  */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for strerror() */
+#endif
+#ifndef _WINSOCK_DEPRECATED_NO_WARNINGS
+#define _WINSOCK_DEPRECATED_NO_WARNINGS  /* for inet_addr() */
+#endif
+#endif
+
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
+
 #include <curl/curl.h>
 
-#ifdef WIN32
-#include <windows.h>
-#include <winsock2.h>
-#include <ws2tcpip.h>
+#ifdef _WIN32
 #define close closesocket
 #else
-#include <sys/types.h>        /*  socket types              */
-#include <sys/socket.h>       /*  socket definitions        */
+#include <sys/types.h>   /* socket types */
+#include <sys/socket.h>  /* socket definitions */
 #include <netinet/in.h>
-#include <arpa/inet.h>        /*  inet (3) functions         */
-#include <unistd.h>           /*  misc. Unix functions      */
+#include <arpa/inet.h>   /* inet (3) functions */
+#include <unistd.h>      /* misc. Unix functions */
 #endif
 
 #include <errno.h>
 
 /* The IP address and port number to connect to */
-#define IPADDR "127.0.0.1"
+#define IPADDR  "127.0.0.1"
 #define PORTNUM 80
 
 #ifndef INADDR_NONE
 #define INADDR_NONE 0xffffffff
 #endif
 
-static size_t write_data(void *ptr, size_t size, size_t nmemb, void *stream)
+static size_t write_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
   size_t written = fwrite(ptr, size, nmemb, (FILE *)stream);
   return written;
@@ -92,24 +99,19 @@ static int sockopt_callback(void *clientp, curl_socket_t curlfd,
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
-  struct sockaddr_in servaddr;  /*  socket address structure  */
+  CURLcode result;
+  struct sockaddr_in servaddr;  /* socket address structure */
   curl_socket_t sockfd;
 
-#ifdef WIN32
-  WSADATA wsaData;
-  int initwsa = WSAStartup(MAKEWORD(2, 2), &wsaData);
-  if(initwsa) {
-    printf("WSAStartup failed: %d\n", initwsa);
-    return 1;
-  }
-#endif
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
     /*
-     * Note that libcurl will internally think that you connect to the host
-     * and port that you specify in the URL option.
+     * Note that libcurl internally thinks that you connect to the host and
+     * port that you specify in the URL option.
      */
     curl_easy_setopt(curl, CURLOPT_URL, "http://99.99.99.99:9999");
 
@@ -122,7 +124,7 @@ int main(void)
 
     memset(&servaddr, 0, sizeof(servaddr));
     servaddr.sin_family = AF_INET;
-    servaddr.sin_port   = htons(PORTNUM);
+    servaddr.sin_port = htons(PORTNUM);
 
     servaddr.sin_addr.s_addr = inet_addr(IPADDR);
     if(INADDR_NONE == servaddr.sin_addr.s_addr) {
@@ -130,8 +132,7 @@ int main(void)
       return 2;
     }
 
-    if(connect(sockfd, (struct sockaddr *) &servaddr, sizeof(servaddr)) ==
-       -1) {
+    if(connect(sockfd, (struct sockaddr *)&servaddr, sizeof(servaddr)) == -1) {
       close(sockfd);
       printf("client error: connect: %s\n", strerror(errno));
       return 1;
@@ -140,8 +141,8 @@ int main(void)
     /* no progress meter please */
     curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 1L);
 
-    /* send all data to this function  */
-    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_data);
+    /* send all data to this function */
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
 
     /* call this function to get a socket */
     curl_easy_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, opensocket);
@@ -154,22 +155,21 @@ int main(void)
     /* call this function to set options for the socket */
     curl_easy_setopt(curl, CURLOPT_SOCKOPTFUNCTION, sockopt_callback);
 
-    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1);
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     curl_easy_cleanup(curl);
 
     close(sockfd);
 
-    if(res) {
-      printf("libcurl error: %d\n", res);
+    if(result != CURLE_OK) {
+      printf("libcurl error: %d\n", (int)result);
       return 4;
     }
   }
 
-#ifdef WIN32
-  WSACleanup();
-#endif
+  curl_global_cleanup();
+
   return 0;
 }
diff --git a/third-party/curl/docs/examples/fileupload.c b/third-party/curl/docs/examples/fileupload.c
index 9e3bd84f72..0c2b3a57af 100644
--- a/third-party/curl/docs/examples/fileupload.c
+++ b/third-party/curl/docs/examples/fileupload.c
@@ -25,26 +25,50 @@
  * Upload to a file:// URL
  * </DESC>
  */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for fopen() */
+#endif
+#endif
+
 #include <stdio.h>
-#include <curl/curl.h>
-#include <sys/stat.h>
 #include <fcntl.h>
+#include <sys/stat.h>
+
+#include <curl/curl.h>
+
+#ifdef _WIN32
+#undef stat
+#define stat _stati64
+#undef fstat
+#define fstat _fstati64
+#define fileno _fileno
+#endif
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+  CURLcode result;
   struct stat file_info;
   curl_off_t speed_upload, total_time;
   FILE *fd;
 
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
   fd = fopen("debugit", "rb"); /* open file to upload */
-  if(!fd)
+  if(!fd) {
+    curl_global_cleanup();
     return 1; /* cannot continue */
+  }
 
   /* to get the file size */
-  if(fstat(fileno(fd), &file_info) != 0)
+  if(fstat(fileno(fd), &file_info)) {
+    fclose(fd);
+    curl_global_cleanup();
     return 1; /* cannot continue */
+  }
 
   curl = curl_easy_init();
   if(curl) {
@@ -65,25 +89,28 @@ int main(void)
     /* enable verbose for easier tracing */
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK) {
+    if(result != CURLE_OK) {
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
     }
     else {
       /* now extract transfer info */
       curl_easy_getinfo(curl, CURLINFO_SPEED_UPLOAD_T, &speed_upload);
       curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME_T, &total_time);
 
-      fprintf(stderr, "Speed: %lu bytes/sec during %lu.%06lu seconds\n",
-              (unsigned long)speed_upload,
-              (unsigned long)(total_time / 1000000),
-              (unsigned long)(total_time % 1000000));
+      fprintf(stderr, "Speed: %" CURL_FORMAT_CURL_OFF_T " bytes/sec during "
+              "%" CURL_FORMAT_CURL_OFF_T
+              ".%06" CURL_FORMAT_CURL_OFF_T " seconds\n",
+              speed_upload,
+              total_time / 1000000,
+              total_time % 1000000);
     }
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
   fclose(fd);
+  curl_global_cleanup();
   return 0;
 }
diff --git a/third-party/curl/docs/examples/ftp-delete.c b/third-party/curl/docs/examples/ftp-delete.c
new file mode 100644
index 0000000000..c05f2f7a54
--- /dev/null
+++ b/third-party/curl/docs/examples/ftp-delete.c
@@ -0,0 +1,84 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/* <DESC>
+ * Delete a single file from an FTP server.
+ * </DESC>
+ */
+#include <stdio.h>
+
+#include <curl/curl.h>
+
+static size_t write_cb(char *buffer, size_t size, size_t nmemb, void *stream)
+{
+  (void)buffer;
+  (void)stream;
+  return size * nmemb;
+}
+
+int main(void)
+{
+  CURL *curl;
+  CURLcode result;
+  struct curl_slist *headerlist = NULL;
+
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
+  curl = curl_easy_init();
+  if(curl) {
+    /*
+     * You better replace the URL with one that works!
+     */
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://ftp.example.com/");
+    /* Define our callback to get called when there is data to be written */
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
+
+    /* Switch on full protocol/debug output */
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+    /* build a list of commands to pass to libcurl */
+    headerlist = curl_slist_append(headerlist, "DELE file-to-remove");
+
+    /* pass in list of FTP commands to run after the transfer */
+    curl_easy_setopt(curl, CURLOPT_POSTQUOTE, headerlist);
+
+    result = curl_easy_perform(curl);
+
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+
+    /* clean up the FTP commands list */
+    curl_slist_free_all(headerlist);
+
+    if(result != CURLE_OK) {
+      /* we failed */
+      fprintf(stderr, "curl told us %d\n", (int)result);
+    }
+  }
+
+  curl_global_cleanup();
+
+  return (int)result;
+}
diff --git a/third-party/curl/docs/examples/ftp-wildcard.c b/third-party/curl/docs/examples/ftp-wildcard.c
index f805432479..abde048e9d 100644
--- a/third-party/curl/docs/examples/ftp-wildcard.c
+++ b/third-party/curl/docs/examples/ftp-wildcard.c
@@ -25,78 +25,24 @@
  * FTP wildcard pattern matching
  * </DESC>
  */
-#include <curl/curl.h>
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for fopen() */
+#endif
+#endif
+
 #include <stdio.h>
 
+#include <curl/curl.h>
+
 struct callback_data {
   FILE *output;
 };
 
-static long file_is_coming(struct curl_fileinfo *finfo,
-                           struct callback_data *data,
-                           int remains);
-
-static long file_is_downloaded(struct callback_data *data);
-
-static size_t write_it(char *buff, size_t size, size_t nmemb,
-                       void *cb_data);
-
-int main(int argc, char **argv)
-{
-  /* curl easy handle */
-  CURL *handle;
-
-  /* help data */
-  struct callback_data data = { 0 };
-
-  /* global initialization */
-  int rc = curl_global_init(CURL_GLOBAL_ALL);
-  if(rc)
-    return rc;
-
-  /* initialization of easy handle */
-  handle = curl_easy_init();
-  if(!handle) {
-    curl_global_cleanup();
-    return CURLE_OUT_OF_MEMORY;
-  }
-
-  /* turn on wildcard matching */
-  curl_easy_setopt(handle, CURLOPT_WILDCARDMATCH, 1L);
-
-  /* callback is called before download of concrete file started */
-  curl_easy_setopt(handle, CURLOPT_CHUNK_BGN_FUNCTION, file_is_coming);
-
-  /* callback is called after data from the file have been transferred */
-  curl_easy_setopt(handle, CURLOPT_CHUNK_END_FUNCTION, file_is_downloaded);
-
-  /* this callback will write contents into files */
-  curl_easy_setopt(handle, CURLOPT_WRITEFUNCTION, write_it);
-
-  /* put transfer data into callbacks */
-  curl_easy_setopt(handle, CURLOPT_CHUNK_DATA, &data);
-  curl_easy_setopt(handle, CURLOPT_WRITEDATA, &data);
-
-  /* curl_easy_setopt(handle, CURLOPT_VERBOSE, 1L); */
-
-  /* set a URL containing wildcard pattern (only in the last part) */
-  if(argc == 2)
-    curl_easy_setopt(handle, CURLOPT_URL, argv[1]);
-  else
-    curl_easy_setopt(handle, CURLOPT_URL, "ftp://example.com/test/*");
-
-  /* and start transfer! */
-  rc = curl_easy_perform(handle);
-
-  curl_easy_cleanup(handle);
-  curl_global_cleanup();
-  return rc;
-}
-
-static long file_is_coming(struct curl_fileinfo *finfo,
-                           struct callback_data *data,
+static long file_is_coming(struct curl_fileinfo *finfo, void *input,
                            int remains)
 {
+  struct callback_data *data = input;
   printf("%3d %40s %10luB ", remains, finfo->filename,
          (unsigned long)finfo->size);
 
@@ -128,8 +74,9 @@ static long file_is_coming(struct curl_fileinfo *finfo,
   return CURL_CHUNK_BGN_FUNC_OK;
 }
 
-static long file_is_downloaded(struct callback_data *data)
+static long file_is_downloaded(void *input)
 {
+  struct callback_data *data = input;
   if(data->output) {
     printf("DOWNLOADED\n");
     fclose(data->output);
@@ -138,8 +85,7 @@ static long file_is_downloaded(struct callback_data *data)
   return CURL_CHUNK_END_FUNC_OK;
 }
 
-static size_t write_it(char *buff, size_t size, size_t nmemb,
-                       void *cb_data)
+static size_t write_cb(char *buff, size_t size, size_t nmemb, void *cb_data)
 {
   struct callback_data *data = cb_data;
   size_t written = 0;
@@ -150,3 +96,57 @@ static size_t write_it(char *buff, size_t size, size_t nmemb,
     written = fwrite(buff, size, nmemb, stdout);
   return written;
 }
+
+int main(int argc, const char **argv)
+{
+  /* curl easy handle */
+  CURL *curl;
+
+  /* help data */
+  struct callback_data data = { 0 };
+
+  /* global initialization */
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
+  /* initialization of easy handle */
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_global_cleanup();
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  /* turn on wildcard matching */
+  curl_easy_setopt(curl, CURLOPT_WILDCARDMATCH, 1L);
+
+  /* callback is called before download of concrete file started */
+  curl_easy_setopt(curl, CURLOPT_CHUNK_BGN_FUNCTION, file_is_coming);
+
+  /* callback is called after data from the file have been transferred */
+  curl_easy_setopt(curl, CURLOPT_CHUNK_END_FUNCTION, file_is_downloaded);
+
+  /* this callback writes contents into files */
+  curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
+
+  /* put transfer data into callbacks */
+  curl_easy_setopt(curl, CURLOPT_CHUNK_DATA, &data);
+  curl_easy_setopt(curl, CURLOPT_WRITEDATA, &data);
+
+#if 0
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+#endif
+
+  /* set a URL containing wildcard pattern (only in the last part) */
+  if(argc == 2)
+    curl_easy_setopt(curl, CURLOPT_URL, argv[1]);
+  else
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/test/*");
+
+  /* and start transfer! */
+  result = curl_easy_perform(curl);
+
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+  return (int)result;
+}
diff --git a/third-party/curl/docs/examples/ftpget.c b/third-party/curl/docs/examples/ftpget.c
index 94609fe0db..eec6c86348 100644
--- a/third-party/curl/docs/examples/ftpget.c
+++ b/third-party/curl/docs/examples/ftpget.c
@@ -21,43 +21,49 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include <stdio.h>
-
-#include <curl/curl.h>
-
 /* <DESC>
  * Get a single file from an FTP server.
  * </DESC>
  */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for fopen() */
+#endif
+#endif
+
+#include <stdio.h>
+
+#include <curl/curl.h>
 
 struct FtpFile {
   const char *filename;
   FILE *stream;
 };
 
-static size_t my_fwrite(void *buffer, size_t size, size_t nmemb, void *stream)
+static size_t write_cb(char *buffer, size_t size, size_t nmemb, void *stream)
 {
   struct FtpFile *out = (struct FtpFile *)stream;
   if(!out->stream) {
     /* open file for writing */
     out->stream = fopen(out->filename, "wb");
     if(!out->stream)
-      return -1; /* failure, cannot open file to write */
+      return 0; /* failure, cannot open file to write */
   }
   return fwrite(buffer, size, nmemb, out->stream);
 }
 
-
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+  CURLcode result;
   struct FtpFile ftpfile = {
     "curl.tar.gz", /* name to store the file as if successful */
     NULL
   };
 
-  curl_global_init(CURL_GLOBAL_DEFAULT);
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -67,21 +73,21 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_URL,
                      "ftp://ftp.example.com/curl/curl-7.9.2.tar.gz");
     /* Define our callback to get called when there is data to be written */
-    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, my_fwrite);
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
     /* Set a pointer to our struct to pass to the callback */
     curl_easy_setopt(curl, CURLOPT_WRITEDATA, &ftpfile);
 
     /* Switch on full protocol/debug output */
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* always cleanup */
     curl_easy_cleanup(curl);
 
-    if(CURLE_OK != res) {
+    if(result != CURLE_OK) {
       /* we failed */
-      fprintf(stderr, "curl told us %d\n", res);
+      fprintf(stderr, "curl told us %d\n", (int)result);
     }
   }
 
@@ -90,5 +96,5 @@ int main(void)
 
   curl_global_cleanup();
 
-  return 0;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/ftpgetinfo.c b/third-party/curl/docs/examples/ftpgetinfo.c
index be24fa71ef..d35cc47b56 100644
--- a/third-party/curl/docs/examples/ftpgetinfo.c
+++ b/third-party/curl/docs/examples/ftpgetinfo.c
@@ -21,15 +21,20 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include <stdio.h>
-#include <string.h>
-
-#include <curl/curl.h>
-
 /* <DESC>
  * Checks a single file's size and mtime from an FTP server.
  * </DESC>
  */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for ctime(), fopen() */
+#endif
+#endif
+
+#include <stdio.h>
+#include <string.h>
+
+#include <curl/curl.h>
 
 static size_t throw_away(void *ptr, size_t size, size_t nmemb, void *data)
 {
@@ -37,19 +42,22 @@ static size_t throw_away(void *ptr, size_t size, size_t nmemb, void *data)
   (void)data;
   /* we are not interested in the headers itself,
      so we only return the size we would have saved ... */
-  return (size_t)(size * nmemb);
+  return size * nmemb;
 }
 
 int main(void)
 {
-  char ftpurl[] = "ftp://ftp.example.com/gnu/binutils/binutils-2.19.1.tar.bz2";
+  static const char ftpurl[] =
+    "ftp://ftp.example.com/gnu/binutils/binutils-2.19.1.tar.bz2";
   CURL *curl;
-  CURLcode res;
+  CURLcode result;
   long filetime = -1;
   curl_off_t filesize = 0;
   const char *filename = strrchr(ftpurl, '/') + 1;
 
-  curl_global_init(CURL_GLOBAL_DEFAULT);
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -61,26 +69,28 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, throw_away);
     curl_easy_setopt(curl, CURLOPT_HEADER, 0L);
     /* Switch on full protocol/debug output */
-    /* curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); */
+#if 0
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+#endif
 
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
-    if(CURLE_OK == res) {
+    if(result == CURLE_OK) {
       /* https://curl.se/libcurl/c/curl_easy_getinfo.html */
-      res = curl_easy_getinfo(curl, CURLINFO_FILETIME, &filetime);
-      if((CURLE_OK == res) && (filetime >= 0)) {
+      result = curl_easy_getinfo(curl, CURLINFO_FILETIME, &filetime);
+      if((result == CURLE_OK) && (filetime >= 0)) {
         time_t file_time = (time_t)filetime;
         printf("filetime %s: %s", filename, ctime(&file_time));
       }
-      res = curl_easy_getinfo(curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD_T,
-                              &filesize);
-      if((CURLE_OK == res) && (filesize>0))
+      result = curl_easy_getinfo(curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD_T,
+                                 &filesize);
+      if((result == CURLE_OK) && (filesize > 0))
         printf("filesize %s: %" CURL_FORMAT_CURL_OFF_T " bytes\n",
                filename, filesize);
     }
     else {
       /* we failed */
-      fprintf(stderr, "curl told us %d\n", res);
+      fprintf(stderr, "curl told us %d\n", (int)result);
     }
 
     /* always cleanup */
@@ -89,5 +99,5 @@ int main(void)
 
   curl_global_cleanup();
 
-  return 0;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/ftpgetresp.c b/third-party/curl/docs/examples/ftpgetresp.c
index 238885dfec..8f888b470e 100644
--- a/third-party/curl/docs/examples/ftpgetresp.c
+++ b/third-party/curl/docs/examples/ftpgetresp.c
@@ -21,59 +21,79 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include <stdio.h>
-
-#include <curl/curl.h>
-
 /* <DESC>
  * Similar to ftpget.c but also stores the received response-lines
  * in a separate file using our own callback!
  * </DESC>
  */
-static size_t
-write_response(void *ptr, size_t size, size_t nmemb, void *data)
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for fopen() */
+#endif
+#endif
+
+#include <stdio.h>
+
+#include <curl/curl.h>
+
+static size_t write_response(void *ptr, size_t size, size_t nmemb, void *data)
 {
   FILE *writehere = (FILE *)data;
   return fwrite(ptr, size, nmemb, writehere);
 }
 
-#define FTPBODY "ftp-list"
+#define FTPBODY    "ftp-list"
 #define FTPHEADERS "ftp-responses"
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+  CURLcode result;
   FILE *ftpfile;
   FILE *respfile;
 
-  /* local file name to store the file as */
-  ftpfile = fopen(FTPBODY, "wb"); /* b is binary, needed on win32 */
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  /* local file name to store the FTP server's response lines in */
-  respfile = fopen(FTPHEADERS, "wb"); /* b is binary, needed on win32 */
+  /* local filename to store the file as */
+  ftpfile = fopen(FTPBODY, "wb"); /* b is binary, needed on Windows */
+  if(!ftpfile) {
+    curl_global_cleanup();
+    return 1;
+  }
+
+  /* local filename to store the FTP server's response lines in */
+  respfile = fopen(FTPHEADERS, "wb"); /* b is binary, needed on Windows */
+  if(!respfile) {
+    fclose(ftpfile);
+    curl_global_cleanup();
+    return 1;
+  }
 
   curl = curl_easy_init();
   if(curl) {
     /* Get a file listing from sunet */
     curl_easy_setopt(curl, CURLOPT_URL, "ftp://ftp.example.com/");
     curl_easy_setopt(curl, CURLOPT_WRITEDATA, ftpfile);
-    /* If you intend to use this on windows with a libcurl DLL, you must use
+    /* If you intend to use this on Windows with a libcurl DLL, you must use
        CURLOPT_WRITEFUNCTION as well */
     curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, write_response);
     curl_easy_setopt(curl, CURLOPT_HEADERDATA, respfile);
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  fclose(ftpfile); /* close the local file */
+  fclose(ftpfile);  /* close the local file */
   fclose(respfile); /* close the response file */
 
-  return 0;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/ftpsget.c b/third-party/curl/docs/examples/ftpsget.c
index dbe7d14bf7..44d8665325 100644
--- a/third-party/curl/docs/examples/ftpsget.c
+++ b/third-party/curl/docs/examples/ftpsget.c
@@ -21,57 +21,61 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
-#include <stdio.h>
-
-#include <curl/curl.h>
-
 /* <DESC>
  * Get a single file from an FTPS server.
  * </DESC>
  */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for fopen() */
+#endif
+#endif
+
+#include <stdio.h>
+
+#include <curl/curl.h>
 
 struct FtpFile {
   const char *filename;
   FILE *stream;
 };
 
-static size_t my_fwrite(void *buffer, size_t size, size_t nmemb,
-                        void *stream)
+static size_t write_cb(char *buffer, size_t size, size_t nmemb, void *stream)
 {
   struct FtpFile *out = (struct FtpFile *)stream;
   if(!out->stream) {
     /* open file for writing */
     out->stream = fopen(out->filename, "wb");
     if(!out->stream)
-      return -1; /* failure, cannot open file to write */
+      return 0; /* failure, cannot open file to write */
   }
   return fwrite(buffer, size, nmemb, out->stream);
 }
 
-
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+  CURLcode result;
   struct FtpFile ftpfile = {
     "yourfile.bin", /* name to store the file as if successful */
     NULL
   };
 
-  curl_global_init(CURL_GLOBAL_DEFAULT);
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
     /*
      * You better replace the URL with one that works! Note that we use an
-     * FTP:// URL with standard explicit FTPS. You can also do FTPS:// URLs if
+     * ftp:// URL with standard explicit FTPS. You can also do ftps:// URLs if
      * you want to do the rarer kind of transfers: implicit.
      */
     curl_easy_setopt(curl, CURLOPT_URL,
                      "ftp://user@server/home/user/file.txt");
     /* Define our callback to get called when there is data to be written */
-    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, my_fwrite);
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
     /* Set a pointer to our struct to pass to the callback */
     curl_easy_setopt(curl, CURLOPT_WRITEDATA, &ftpfile);
 
@@ -81,14 +85,14 @@ int main(void)
     /* Switch on full protocol/debug output */
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* always cleanup */
     curl_easy_cleanup(curl);
 
-    if(CURLE_OK != res) {
+    if(result != CURLE_OK) {
       /* we failed */
-      fprintf(stderr, "curl told us %d\n", res);
+      fprintf(stderr, "curl told us %d\n", (int)result);
     }
   }
 
@@ -97,5 +101,5 @@ int main(void)
 
   curl_global_cleanup();
 
-  return 0;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/ftpupload.c b/third-party/curl/docs/examples/ftpupload.c
index 00de126ead..07546f313e 100644
--- a/third-party/curl/docs/examples/ftpupload.c
+++ b/third-party/curl/docs/examples/ftpupload.c
@@ -21,36 +21,46 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+/* <DESC>
+ * Performs an FTP upload and renames the file after a successful transfer.
+ * </DESC>
+ */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for fopen(), strerror() */
+#endif
+#endif
+
 #include <stdio.h>
 #include <string.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+#include <sys/types.h>
 
 #include <curl/curl.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <errno.h>
-#ifdef WIN32
+
+#ifdef _WIN32
 #include <io.h>
+#undef stat
+#define stat _stati64
+#undef fstat
+#define fstat _fstati64
+#define fileno _fileno
 #else
 #include <unistd.h>
 #endif
 
-/* <DESC>
- * Performs an FTP upload and renames the file just after a successful
- * transfer.
- * </DESC>
- */
+#define LOCAL_FILE     "/tmp/uploadthis.txt"
+#define UPLOAD_FILE_AS "while-uploading.txt"
+#define REMOTE_URL     "ftp://example.com/" UPLOAD_FILE_AS
+#define RENAME_FILE_TO "renamed-and-fine.txt"
 
-#define LOCAL_FILE      "/tmp/uploadthis.txt"
-#define UPLOAD_FILE_AS  "while-uploading.txt"
-#define REMOTE_URL      "ftp://example.com/"  UPLOAD_FILE_AS
-#define RENAME_FILE_TO  "renamed-and-fine.txt"
-
-/* NOTE: if you want this example to work on Windows with libcurl as a
-   DLL, you MUST also provide a read callback with CURLOPT_READFUNCTION.
-   Failing to do so will give you a crash since a DLL may not use the
-   variable's memory when passed in to it from an app like this. */
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *stream)
+/* NOTE: if you want this example to work on Windows with libcurl as a DLL,
+   you MUST also provide a read callback with CURLOPT_READFUNCTION. Failing to
+   do so might give you a crash since a DLL may not use the variable's memory
+   when passed in to it from an app like this. */
+static size_t read_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
   unsigned long nread;
   /* in real-world cases, this would probably get this data differently
@@ -69,29 +79,37 @@ static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *stream)
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+  CURLcode result;
   FILE *hd_src;
   struct stat file_info;
-  unsigned long fsize;
+  curl_off_t fsize;
 
   struct curl_slist *headerlist = NULL;
-  static const char buf_1 [] = "RNFR " UPLOAD_FILE_AS;
-  static const char buf_2 [] = "RNTO " RENAME_FILE_TO;
+  static const char buf_1[] = "RNFR " UPLOAD_FILE_AS;
+  static const char buf_2[] = "RNTO " RENAME_FILE_TO;
 
-  /* get the file size of the local file */
-  if(stat(LOCAL_FILE, &file_info)) {
-    printf("Couldn't open '%s': %s\n", LOCAL_FILE, strerror(errno));
-    return 1;
-  }
-  fsize = (unsigned long)file_info.st_size;
-
-  printf("Local file size: %lu bytes.\n", fsize);
-
-  /* get a FILE * of the same file */
+  /* get a FILE * of the file */
   hd_src = fopen(LOCAL_FILE, "rb");
+  if(!hd_src) {
+    printf("Could not open '%s': %s\n", LOCAL_FILE, strerror(errno));
+    return 2;
+  }
 
-  /* In windows, this will init the winsock stuff */
-  curl_global_init(CURL_GLOBAL_ALL);
+  /* to get the file size */
+  if(fstat(fileno(hd_src), &file_info)) {
+    fclose(hd_src);
+    return 1; /* cannot continue */
+  }
+  fsize = file_info.st_size;
+
+  printf("Local file size: %" CURL_FORMAT_CURL_OFF_T " bytes.\n", fsize);
+
+  /* In Windows, this inits the Winsock stuff */
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK) {
+    fclose(hd_src);
+    return (int)result;
+  }
 
   /* get a curl handle */
   curl = curl_easy_init();
@@ -101,7 +119,7 @@ int main(void)
     headerlist = curl_slist_append(headerlist, buf_2);
 
     /* we want to use our own read function */
-    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_callback);
+    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
 
     /* enable uploading */
     curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
@@ -119,15 +137,14 @@ int main(void)
        option you MUST make sure that the type of the passed-in argument is a
        curl_off_t. If you use CURLOPT_INFILESIZE (without _LARGE) you must
        make sure that to pass in a type 'long' argument. */
-    curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE,
-                     (curl_off_t)fsize);
+    curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, fsize);
 
     /* Now run off and do what you have been told! */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* clean up the FTP commands list */
     curl_slist_free_all(headerlist);
@@ -138,5 +155,5 @@ int main(void)
   fclose(hd_src); /* close the local file */
 
   curl_global_cleanup();
-  return 0;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/ftpuploadfrommem.c b/third-party/curl/docs/examples/ftpuploadfrommem.c
index 9613cca262..db06edcd9f 100644
--- a/third-party/curl/docs/examples/ftpuploadfrommem.c
+++ b/third-party/curl/docs/examples/ftpuploadfrommem.c
@@ -27,11 +27,12 @@
  */
 #include <stdio.h>
 #include <string.h>
+
 #include <curl/curl.h>
 
-static const char data[]=
+static const char data[] =
   "Lorem ipsum dolor sit amet, consectetur adipiscing elit. "
-  "Nam rhoncus odio id venenatis volutpat. Vestibulum dapibus "
+  "___ rhoncus odio id venenatis volutpat. Vestibulum dapibus "
   "bibendum ullamcorper. Maecenas finibus elit augue, vel "
   "condimentum odio maximus nec. In hac habitasse platea dictumst. "
   "Vestibulum vel dolor et turpis rutrum finibus ac at nulla. "
@@ -45,10 +46,10 @@ struct WriteThis {
   size_t sizeleft;
 };
 
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
   struct WriteThis *upload = (struct WriteThis *)userp;
-  size_t max = size*nmemb;
+  size_t max = size * nmemb;
 
   if(max < 1)
     return 0;
@@ -63,25 +64,25 @@ static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
     return copylen;
   }
 
-  return 0;                          /* no more data left to deliver */
+  return 0;  /* no more data left to deliver */
 }
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+  CURLcode result;
 
   struct WriteThis upload;
 
   upload.readptr = data;
   upload.sizeleft = strlen(data);
 
-  /* In windows, this will init the winsock stuff */
-  res = curl_global_init(CURL_GLOBAL_DEFAULT);
+  /* In Windows, this inits the Winsock stuff */
+  result = curl_global_init(CURL_GLOBAL_DEFAULT);
   /* Check for errors */
-  if(res != CURLE_OK) {
+  if(result != CURLE_OK) {
     fprintf(stderr, "curl_global_init() failed: %s\n",
-            curl_easy_strerror(res));
+            curl_easy_strerror(result));
     return 1;
   }
 
@@ -99,7 +100,7 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
 
     /* we want to use our own read function */
-    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_callback);
+    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
 
     /* pointer to pass to our read function */
     curl_easy_setopt(curl, CURLOPT_READDATA, &upload);
@@ -111,16 +112,16 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE,
                      (curl_off_t)upload.sizeleft);
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
   curl_global_cleanup();
-  return 0;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/ftpuploadresume.c b/third-party/curl/docs/examples/ftpuploadresume.c
index 42d31a2bbf..e79bc791e2 100644
--- a/third-party/curl/docs/examples/ftpuploadresume.c
+++ b/third-party/curl/docs/examples/ftpuploadresume.c
@@ -25,9 +25,15 @@
  * Upload to FTP, resuming failed transfers. Active mode.
  * </DESC>
  */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for fopen(), sscanf() */
+#endif
+#endif
 
 #include <stdlib.h>
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* parse headers for Content-Length */
@@ -38,14 +44,14 @@ static size_t getcontentlengthfunc(void *ptr, size_t size, size_t nmemb,
   long len = 0;
 
   r = sscanf(ptr, "Content-Length: %ld\n", &len);
-  if(r)
-    *((long *) stream) = len;
+  if(r == 1)
+    *((long *)stream) = len;
 
   return size * nmemb;
 }
 
 /* discard downloaded data */
-static size_t discardfunc(void *ptr, size_t size, size_t nmemb, void *stream)
+static size_t write_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
   (void)ptr;
   (void)stream;
@@ -53,7 +59,7 @@ static size_t discardfunc(void *ptr, size_t size, size_t nmemb, void *stream)
 }
 
 /* read data to upload */
-static size_t readfunc(char *ptr, size_t size, size_t nmemb, void *stream)
+static size_t read_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
   FILE *f = stream;
   size_t n;
@@ -66,13 +72,12 @@ static size_t readfunc(char *ptr, size_t size, size_t nmemb, void *stream)
   return n;
 }
 
-
-static int upload(CURL *curlhandle, const char *remotepath,
+static int upload(CURL *curl, const char *remotepath,
                   const char *localpath, long timeout, long tries)
 {
   FILE *f;
   long uploaded_len = 0;
-  CURLcode r = CURLE_GOT_NOTHING;
+  CURLcode result = CURLE_GOT_NOTHING;
   int c;
 
   f = fopen(localpath, "rb");
@@ -81,86 +86,86 @@ static int upload(CURL *curlhandle, const char *remotepath,
     return 0;
   }
 
-  curl_easy_setopt(curlhandle, CURLOPT_UPLOAD, 1L);
+  curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
 
-  curl_easy_setopt(curlhandle, CURLOPT_URL, remotepath);
+  curl_easy_setopt(curl, CURLOPT_URL, remotepath);
 
   if(timeout)
-    curl_easy_setopt(curlhandle, CURLOPT_SERVER_RESPONSE_TIMEOUT, timeout);
+    curl_easy_setopt(curl, CURLOPT_SERVER_RESPONSE_TIMEOUT, timeout);
 
-  curl_easy_setopt(curlhandle, CURLOPT_HEADERFUNCTION, getcontentlengthfunc);
-  curl_easy_setopt(curlhandle, CURLOPT_HEADERDATA, &uploaded_len);
+  curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, getcontentlengthfunc);
+  curl_easy_setopt(curl, CURLOPT_HEADERDATA, &uploaded_len);
 
-  curl_easy_setopt(curlhandle, CURLOPT_WRITEFUNCTION, discardfunc);
+  curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
 
-  curl_easy_setopt(curlhandle, CURLOPT_READFUNCTION, readfunc);
-  curl_easy_setopt(curlhandle, CURLOPT_READDATA, f);
+  curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
+  curl_easy_setopt(curl, CURLOPT_READDATA, f);
 
   /* enable active mode */
-  curl_easy_setopt(curlhandle, CURLOPT_FTPPORT, "-");
+  curl_easy_setopt(curl, CURLOPT_FTPPORT, "-");
 
   /* allow the server no more than 7 seconds to connect back */
-  curl_easy_setopt(curlhandle, CURLOPT_ACCEPTTIMEOUT_MS, 7000L);
+  curl_easy_setopt(curl, CURLOPT_ACCEPTTIMEOUT_MS, 7000L);
 
-  curl_easy_setopt(curlhandle, CURLOPT_FTP_CREATE_MISSING_DIRS, 1L);
+  curl_easy_setopt(curl, CURLOPT_FTP_CREATE_MISSING_DIRS, 1L);
 
-  curl_easy_setopt(curlhandle, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  for(c = 0; (r != CURLE_OK) && (c < tries); c++) {
+  for(c = 0; (result != CURLE_OK) && (c < tries); c++) {
     /* are we resuming? */
     if(c) { /* yes */
       /* determine the length of the file already written */
 
       /*
-       * With NOBODY and NOHEADER, libcurl will issue a SIZE
-       * command, but the only way to retrieve the result is
-       * to parse the returned Content-Length header. Thus,
-       * getcontentlengthfunc(). We need discardfunc() above
-       * because HEADER will dump the headers to stdout
-       * without it.
+       * With NOBODY and NOHEADER, libcurl issues a SIZE command, but the only
+       * way to retrieve the result is to parse the returned Content-Length
+       * header. Thus, getcontentlengthfunc(). We need write_cb() above
+       * because HEADER dumps the headers to stdout without it.
        */
-      curl_easy_setopt(curlhandle, CURLOPT_NOBODY, 1L);
-      curl_easy_setopt(curlhandle, CURLOPT_HEADER, 1L);
+      curl_easy_setopt(curl, CURLOPT_NOBODY, 1L);
+      curl_easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-      r = curl_easy_perform(curlhandle);
-      if(r != CURLE_OK)
+      result = curl_easy_perform(curl);
+      if(result != CURLE_OK)
         continue;
 
-      curl_easy_setopt(curlhandle, CURLOPT_NOBODY, 0L);
-      curl_easy_setopt(curlhandle, CURLOPT_HEADER, 0L);
+      curl_easy_setopt(curl, CURLOPT_NOBODY, 0L);
+      curl_easy_setopt(curl, CURLOPT_HEADER, 0L);
 
       fseek(f, uploaded_len, SEEK_SET);
 
-      curl_easy_setopt(curlhandle, CURLOPT_APPEND, 1L);
+      curl_easy_setopt(curl, CURLOPT_APPEND, 1L);
     }
     else { /* no */
-      curl_easy_setopt(curlhandle, CURLOPT_APPEND, 0L);
+      curl_easy_setopt(curl, CURLOPT_APPEND, 0L);
     }
 
-    r = curl_easy_perform(curlhandle);
+    result = curl_easy_perform(curl);
   }
 
   fclose(f);
 
-  if(r == CURLE_OK)
+  if(result == CURLE_OK)
     return 1;
   else {
-    fprintf(stderr, "%s\n", curl_easy_strerror(r));
+    fprintf(stderr, "%s\n", curl_easy_strerror(result));
     return 0;
   }
 }
 
 int main(void)
 {
-  CURL *curlhandle = NULL;
+  CURL *curl = NULL;
 
-  curl_global_init(CURL_GLOBAL_ALL);
-  curlhandle = curl_easy_init();
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  upload(curlhandle, "ftp://user:pass@example.com/path/file", "C:\\file",
-         0, 3);
-
-  curl_easy_cleanup(curlhandle);
+  curl = curl_easy_init();
+  if(curl) {
+    upload(curl, "ftp://user:pass@example.com/path/file", "C:\\file", 0, 3);
+    curl_easy_cleanup(curl);
+  }
   curl_global_cleanup();
 
   return 0;
diff --git a/third-party/curl/docs/examples/getinfo.c b/third-party/curl/docs/examples/getinfo.c
index 9c178c2c8c..43a4eeb524 100644
--- a/third-party/curl/docs/examples/getinfo.c
+++ b/third-party/curl/docs/examples/getinfo.c
@@ -26,29 +26,34 @@
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
     curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
-    if(CURLE_OK == res) {
-      char *ct;
+    if(result == CURLE_OK) {
+      const char *ct;
       /* ask for the content-type */
-      res = curl_easy_getinfo(curl, CURLINFO_CONTENT_TYPE, &ct);
+      result = curl_easy_getinfo(curl, CURLINFO_CONTENT_TYPE, &ct);
 
-      if((CURLE_OK == res) && ct)
+      if((result == CURLE_OK) && ct)
         printf("We received Content-Type: %s\n", ct);
     }
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
-  return 0;
+  curl_global_cleanup();
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/getinmemory.c b/third-party/curl/docs/examples/getinmemory.c
index 8ec84142db..036953b50c 100644
--- a/third-party/curl/docs/examples/getinmemory.c
+++ b/third-party/curl/docs/examples/getinmemory.c
@@ -26,7 +26,6 @@
  * chunk of memory instead of storing it in a file.
  * </DESC>
  */
-
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -38,8 +37,7 @@ struct MemoryStruct {
   size_t size;
 };
 
-static size_t
-WriteMemoryCallback(void *contents, size_t size, size_t nmemb, void *userp)
+static size_t write_cb(char *contents, size_t size, size_t nmemb, void *userp)
 {
   size_t realsize = size * nmemb;
   struct MemoryStruct *mem = (struct MemoryStruct *)userp;
@@ -61,58 +59,62 @@ WriteMemoryCallback(void *contents, size_t size, size_t nmemb, void *userp)
 
 int main(void)
 {
-  CURL *curl_handle;
-  CURLcode res;
+  CURL *curl;
+  CURLcode result;
 
   struct MemoryStruct chunk;
 
-  chunk.memory = malloc(1);  /* will be grown as needed by the realloc above */
-  chunk.size = 0;    /* no data at this point */
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  curl_global_init(CURL_GLOBAL_ALL);
+  chunk.memory = malloc(1); /* grown as needed by the realloc above */
+  chunk.size = 0;           /* no data at this point */
 
   /* init the curl session */
-  curl_handle = curl_easy_init();
+  curl = curl_easy_init();
+  if(curl) {
 
-  /* specify URL to get */
-  curl_easy_setopt(curl_handle, CURLOPT_URL, "https://www.example.com/");
+    /* specify URL to get */
+    curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");
 
-  /* send all data to this function  */
-  curl_easy_setopt(curl_handle, CURLOPT_WRITEFUNCTION, WriteMemoryCallback);
+    /* send all data to this function */
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
 
-  /* we pass our 'chunk' struct to the callback function */
-  curl_easy_setopt(curl_handle, CURLOPT_WRITEDATA, (void *)&chunk);
+    /* we pass our 'chunk' struct to the callback function */
+    curl_easy_setopt(curl, CURLOPT_WRITEDATA, (void *)&chunk);
 
-  /* some servers do not like requests that are made without a user-agent
-     field, so we provide one */
-  curl_easy_setopt(curl_handle, CURLOPT_USERAGENT, "libcurl-agent/1.0");
+    /* some servers do not like requests that are made without a user-agent
+       field, so we provide one */
+    curl_easy_setopt(curl, CURLOPT_USERAGENT, "libcurl-agent/1.0");
 
-  /* get it! */
-  res = curl_easy_perform(curl_handle);
+    /* get it! */
+    result = curl_easy_perform(curl);
 
-  /* check for errors */
-  if(res != CURLE_OK) {
-    fprintf(stderr, "curl_easy_perform() failed: %s\n",
-            curl_easy_strerror(res));
+    /* check for errors */
+    if(result != CURLE_OK) {
+      fprintf(stderr, "curl_easy_perform() failed: %s\n",
+              curl_easy_strerror(result));
+    }
+    else {
+      /*
+       * Now, our chunk.memory points to a memory block that is chunk.size
+       * bytes big and contains the remote file.
+       *
+       * Do something nice with it!
+       */
+
+      printf("%lu bytes retrieved\n", (unsigned long)chunk.size);
+    }
+
+    /* cleanup curl stuff */
+    curl_easy_cleanup(curl);
   }
-  else {
-    /*
-     * Now, our chunk.memory points to a memory block that is chunk.size
-     * bytes big and contains the remote file.
-     *
-     * Do something nice with it!
-     */
-
-    printf("%lu bytes retrieved\n", (unsigned long)chunk.size);
-  }
-
-  /* cleanup curl stuff */
-  curl_easy_cleanup(curl_handle);
 
   free(chunk.memory);
 
   /* we are done with libcurl, so clean it up */
   curl_global_cleanup();
 
-  return 0;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/getredirect.c b/third-party/curl/docs/examples/getredirect.c
index 9163c9b079..e144e628e4 100644
--- a/third-party/curl/docs/examples/getredirect.c
+++ b/third-party/curl/docs/examples/getredirect.c
@@ -26,14 +26,17 @@
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
-  char *location;
-  long response_code;
+  CURLcode result;
+
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -41,23 +44,24 @@ int main(void)
 
     /* example.com is redirected, figure out the redirection! */
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
     else {
-      res = curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &response_code);
-      if((res == CURLE_OK) &&
-         ((response_code / 100) != 3)) {
+      long response_code;
+      result = curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &response_code);
+      if((result == CURLE_OK) && ((response_code / 100) != 3)) {
         /* a redirect implies a 3xx response code */
         fprintf(stderr, "Not a redirect.\n");
       }
       else {
-        res = curl_easy_getinfo(curl, CURLINFO_REDIRECT_URL, &location);
+        const char *location;
+        result = curl_easy_getinfo(curl, CURLINFO_REDIRECT_URL, &location);
 
-        if((res == CURLE_OK) && location) {
+        if((result == CURLE_OK) && location) {
           /* This is the new absolute URL that you could redirect to, even if
            * the Location: response header may have been a relative URL. */
           printf("Redirected to: %s\n", location);
@@ -68,5 +72,6 @@ int main(void)
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
-  return 0;
+  curl_global_cleanup();
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/getreferrer.c b/third-party/curl/docs/examples/getreferrer.c
index 6073f9fca4..b2220842ec 100644
--- a/third-party/curl/docs/examples/getreferrer.c
+++ b/third-party/curl/docs/examples/getreferrer.c
@@ -26,34 +26,38 @@
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 int main(void)
 {
   CURL *curl;
 
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
   curl = curl_easy_init();
   if(curl) {
-    CURLcode res;
-
     curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
     curl_easy_setopt(curl, CURLOPT_REFERER, "https://example.org/referrer");
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
     else {
-      char *hdr;
-      res = curl_easy_getinfo(curl, CURLINFO_REFERER, &hdr);
-      if((res == CURLE_OK) && hdr)
+      const char *hdr;
+      result = curl_easy_getinfo(curl, CURLINFO_REFERER, &hdr);
+      if((result == CURLE_OK) && hdr)
         printf("Referrer header: %s\n", hdr);
     }
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
+  curl_global_cleanup();
   return 0;
 }
diff --git a/third-party/curl/docs/examples/ghiper.c b/third-party/curl/docs/examples/ghiper.c
index 5a4f4a7057..fd6041761e 100644
--- a/third-party/curl/docs/examples/ghiper.c
+++ b/third-party/curl/docs/examples/ghiper.c
@@ -22,78 +22,78 @@
  *
  ***************************************************************************/
 /* <DESC>
- * multi socket API usage together with with glib2
+ * multi socket interface with glib2
  * </DESC>
  */
 /* Example application source code using the multi socket interface to
  * download many files at once.
  *
  * Written by Jeff Pohlmeyer
-
- Requires glib-2.x and a (POSIX?) system that has mkfifo().
-
- This is an adaptation of libcurl's "hipev.c" and libevent's "event-test.c"
- sample programs, adapted to use glib's g_io_channel in place of libevent.
-
- When running, the program creates the named pipe "hiper.fifo"
-
- Whenever there is input into the fifo, the program reads the input as a list
- of URL's and creates some new easy handles to fetch each URL via the
- curl_multi "hiper" API.
-
-
- Thus, you can try a single URL:
- % echo http://www.yahoo.com > hiper.fifo
-
- Or a whole bunch of them:
- % cat my-url-list > hiper.fifo
-
- The fifo buffer is handled almost instantly, so you can even add more URL's
- while the previous requests are still being downloaded.
-
- This is purely a demo app, all retrieved data is simply discarded by the write
- callback.
-
-*/
-
+ *
+ * Requires glib-2.x and a (POSIX?) system that has mkfifo().
+ *
+ * This is an adaptation of libcurl's "hipev.c" and libevent's "event-test.c"
+ * sample programs, adapted to use glib's g_io_channel in place of libevent.
+ *
+ * When running, the program creates the named pipe "hiper.fifo"
+ *
+ * Whenever there is input into the fifo, the program reads the input as a list
+ * of URL's and creates some new easy handles to fetch each URL via the
+ * curl_multi "hiper" API.
+ *
+ * Thus, you can try a single URL:
+ *   % echo http://www.example.com > hiper.fifo
+ *
+ * Or a whole bunch of them:
+ *   % cat my-url-list > hiper.fifo
+ *
+ * The fifo buffer is handled almost instantly, so you can even add more URL's
+ * while the previous requests are still being downloaded.
+ *
+ * This is purely a demo app, all retrieved data is discarded by
+ * the write callback.
+ *
+ */
 #include <glib.h>
-#include <sys/stat.h>
+
 #include <unistd.h>
 #include <fcntl.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <errno.h>
+#include <sys/stat.h>
+
 #include <curl/curl.h>
 
-#define MSG_OUT g_print   /* Change to "g_error" to write to stderr */
-#define SHOW_VERBOSE 0    /* Set to non-zero for libcurl messages */
-#define SHOW_PROGRESS 0   /* Set to non-zero to enable progress callback */
+#define MSG_OUT       g_print /* Change to "g_error" to write to stderr */
+#define SHOW_VERBOSE  0L      /* Set to non-zero for libcurl messages */
+#define SHOW_PROGRESS 0       /* Set to non-zero to enable progress callback */
 
 /* Global information, common to all connections */
-typedef struct _GlobalInfo {
+struct GlobalInfo {
   CURLM *multi;
   guint timer_event;
   int still_running;
-} GlobalInfo;
+};
 
 /* Information associated with a specific easy handle */
-typedef struct _ConnInfo {
-  CURL *easy;
+struct ConnInfo {
+  CURL *curl;
   char *url;
-  GlobalInfo *global;
+  struct GlobalInfo *global;
   char error[CURL_ERROR_SIZE];
-} ConnInfo;
+};
 
 /* Information associated with a specific socket */
-typedef struct _SockInfo {
+struct SockInfo {
   curl_socket_t sockfd;
-  CURL *easy;
+  CURL *curl;
   int action;
   long timeout;
   GIOChannel *ch;
   guint ev;
-  GlobalInfo *global;
-} SockInfo;
+  struct GlobalInfo *global;
+};
 
 /* Die if we get a bad CURLMcode somewhere */
 static void mcode_or_die(const char *where, CURLMcode code)
@@ -101,14 +101,27 @@ static void mcode_or_die(const char *where, CURLMcode code)
   if(CURLM_OK != code) {
     const char *s;
     switch(code) {
-    case     CURLM_BAD_HANDLE:         s = "CURLM_BAD_HANDLE";         break;
-    case     CURLM_BAD_EASY_HANDLE:    s = "CURLM_BAD_EASY_HANDLE";    break;
-    case     CURLM_OUT_OF_MEMORY:      s = "CURLM_OUT_OF_MEMORY";      break;
-    case     CURLM_INTERNAL_ERROR:     s = "CURLM_INTERNAL_ERROR";     break;
-    case     CURLM_BAD_SOCKET:         s = "CURLM_BAD_SOCKET";         break;
-    case     CURLM_UNKNOWN_OPTION:     s = "CURLM_UNKNOWN_OPTION";     break;
-    case     CURLM_LAST:               s = "CURLM_LAST";               break;
-    default: s = "CURLM_unknown";
+    case CURLM_BAD_HANDLE:
+      s = "CURLM_BAD_HANDLE";
+      break;
+    case CURLM_BAD_EASY_HANDLE:
+      s = "CURLM_BAD_EASY_HANDLE";
+      break;
+    case CURLM_OUT_OF_MEMORY:
+      s = "CURLM_OUT_OF_MEMORY";
+      break;
+    case CURLM_INTERNAL_ERROR:
+      s = "CURLM_INTERNAL_ERROR";
+      break;
+    case CURLM_BAD_SOCKET:
+      s = "CURLM_BAD_SOCKET";
+      break;
+    case CURLM_UNKNOWN_OPTION:
+      s = "CURLM_UNKNOWN_OPTION";
+      break;
+    default:
+      s = "CURLM_unknown";
+      break;
     }
     MSG_OUT("ERROR: %s returns %s\n", where, s);
     exit(code);
@@ -116,26 +129,24 @@ static void mcode_or_die(const char *where, CURLMcode code)
 }
 
 /* Check for completed transfers, and remove their easy handles */
-static void check_multi_info(GlobalInfo *g)
+static void check_multi_info(struct GlobalInfo *g)
 {
-  char *eff_url;
   CURLMsg *msg;
   int msgs_left;
-  ConnInfo *conn;
-  CURL *easy;
-  CURLcode res;
 
   MSG_OUT("REMAINING: %d\n", g->still_running);
   while((msg = curl_multi_info_read(g->multi, &msgs_left))) {
     if(msg->msg == CURLMSG_DONE) {
-      easy = msg->easy_handle;
-      res = msg->data.result;
-      curl_easy_getinfo(easy, CURLINFO_PRIVATE, &conn);
-      curl_easy_getinfo(easy, CURLINFO_EFFECTIVE_URL, &eff_url);
-      MSG_OUT("DONE: %s => (%d) %s\n", eff_url, res, conn->error);
-      curl_multi_remove_handle(g->multi, easy);
+      CURL *curl = msg->easy_handle;
+      CURLcode result = msg->data.result;
+      char *eff_url;
+      struct ConnInfo *conn;
+      curl_easy_getinfo(curl, CURLINFO_PRIVATE, &conn);
+      curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_URL, &eff_url);
+      MSG_OUT("DONE: %s => (%d) %s\n", eff_url, result, conn->error);
+      curl_multi_remove_handle(g->multi, curl);
       free(conn->url);
-      curl_easy_cleanup(easy);
+      curl_easy_cleanup(curl);
       free(conn);
     }
   }
@@ -144,12 +155,12 @@ static void check_multi_info(GlobalInfo *g)
 /* Called by glib when our timeout expires */
 static gboolean timer_cb(gpointer data)
 {
-  GlobalInfo *g = (GlobalInfo *)data;
-  CURLMcode rc;
+  struct GlobalInfo *g = (struct GlobalInfo *)data;
+  CURLMcode mresult;
 
-  rc = curl_multi_socket_action(g->multi,
-                                CURL_SOCKET_TIMEOUT, 0, &g->still_running);
-  mcode_or_die("timer_cb: curl_multi_socket_action", rc);
+  mresult = curl_multi_socket_action(g->multi, CURL_SOCKET_TIMEOUT, 0,
+                                     &g->still_running);
+  mcode_or_die("timer_cb: curl_multi_socket_action", mresult);
   check_multi_info(g);
   return FALSE;
 }
@@ -158,15 +169,15 @@ static gboolean timer_cb(gpointer data)
 static int update_timeout_cb(CURLM *multi, long timeout_ms, void *userp)
 {
   struct timeval timeout;
-  GlobalInfo *g = (GlobalInfo *)userp;
-  timeout.tv_sec = timeout_ms/1000;
-  timeout.tv_usec = (timeout_ms%1000)*1000;
+  struct GlobalInfo *g = (struct GlobalInfo *)userp;
+  timeout.tv_sec = timeout_ms / 1000;
+  timeout.tv_usec = (timeout_ms % 1000) * 1000;
 
   MSG_OUT("*** update_timeout_cb %ld => %ld:%ld ***\n",
           timeout_ms, timeout.tv_sec, timeout.tv_usec);
 
   /*
-   * if timeout_ms is -1, just delete the timer
+   * if timeout_ms is -1, delete the timer
    *
    * For other values of timeout_ms, this should set or *update* the timer to
    * the new value
@@ -179,16 +190,15 @@ static int update_timeout_cb(CURLM *multi, long timeout_ms, void *userp)
 /* Called by glib when we get action on a multi socket */
 static gboolean event_cb(GIOChannel *ch, GIOCondition condition, gpointer data)
 {
-  GlobalInfo *g = (GlobalInfo*) data;
-  CURLMcode rc;
+  struct GlobalInfo *g = (struct GlobalInfo *)data;
+  CURLMcode mresult;
   int fd = g_io_channel_unix_get_fd(ch);
 
-  int action =
-    ((condition & G_IO_IN) ? CURL_CSELECT_IN : 0) |
-    ((condition & G_IO_OUT) ? CURL_CSELECT_OUT : 0);
+  int action = ((condition & G_IO_IN) ? CURL_CSELECT_IN : 0) |
+               ((condition & G_IO_OUT) ? CURL_CSELECT_OUT : 0);
 
-  rc = curl_multi_socket_action(g->multi, fd, action, &g->still_running);
-  mcode_or_die("event_cb: curl_multi_socket_action", rc);
+  mresult = curl_multi_socket_action(g->multi, fd, action, &g->still_running);
+  mcode_or_die("event_cb: curl_multi_socket_action", mresult);
 
   check_multi_info(g);
   if(g->still_running) {
@@ -204,7 +214,7 @@ static gboolean event_cb(GIOChannel *ch, GIOCondition condition, gpointer data)
 }
 
 /* Clean up the SockInfo structure */
-static void remsock(SockInfo *f)
+static void remsock(struct SockInfo *f)
 {
   if(!f) {
     return;
@@ -216,16 +226,15 @@ static void remsock(SockInfo *f)
 }
 
 /* Assign information to a SockInfo structure */
-static void setsock(SockInfo *f, curl_socket_t s, CURL *e, int act,
-                    GlobalInfo *g)
+static void setsock(struct SockInfo *f, curl_socket_t s, CURL *e, int act,
+                    struct GlobalInfo *g)
 {
-  GIOCondition kind =
-    ((act & CURL_POLL_IN) ? G_IO_IN : 0) |
-    ((act & CURL_POLL_OUT) ? G_IO_OUT : 0);
+  GIOCondition kind = ((act & CURL_POLL_IN) ? G_IO_IN : 0) |
+                      ((act & CURL_POLL_OUT) ? G_IO_OUT : 0);
 
   f->sockfd = s;
   f->action = act;
-  f->easy = e;
+  f->curl = e;
   if(f->ev) {
     g_source_remove(f->ev);
   }
@@ -233,22 +242,23 @@ static void setsock(SockInfo *f, curl_socket_t s, CURL *e, int act,
 }
 
 /* Initialize a new SockInfo structure */
-static void addsock(curl_socket_t s, CURL *easy, int action, GlobalInfo *g)
+static void addsock(curl_socket_t s, CURL *curl, int action,
+                    struct GlobalInfo *g)
 {
-  SockInfo *fdp = g_malloc0(sizeof(SockInfo));
+  struct SockInfo *fdp = g_malloc0(sizeof(struct SockInfo));
 
   fdp->global = g;
   fdp->ch = g_io_channel_unix_new(s);
-  setsock(fdp, s, easy, action, g);
+  setsock(fdp, s, curl, action, g);
   curl_multi_assign(g->multi, s, fdp);
 }
 
 /* CURLMOPT_SOCKETFUNCTION */
 static int sock_cb(CURL *e, curl_socket_t s, int what, void *cbp, void *sockp)
 {
-  GlobalInfo *g = (GlobalInfo*) cbp;
-  SockInfo *fdp = (SockInfo*) sockp;
-  static const char *whatstr[]={ "none", "IN", "OUT", "INOUT", "REMOVE" };
+  struct GlobalInfo *g = (struct GlobalInfo *)cbp;
+  struct SockInfo *fdp = (struct SockInfo *)sockp;
+  static const char *whatstr[] = { "none", "IN", "OUT", "INOUT", "REMOVE" };
 
   MSG_OUT("socket callback: s=%d e=%p what=%s ", s, e, whatstr[what]);
   if(what == CURL_POLL_REMOVE) {
@@ -263,8 +273,7 @@ static int sock_cb(CURL *e, curl_socket_t s, int what, void *cbp, void *sockp)
       addsock(s, e, what, g);
     }
     else {
-      MSG_OUT(
-        "Changing action from %d to %d\n", fdp->action, what);
+      MSG_OUT("Changing action from %d to %d\n", fdp->action, what);
       setsock(fdp, s, e, what, g);
     }
   }
@@ -272,59 +281,63 @@ static int sock_cb(CURL *e, curl_socket_t s, int what, void *cbp, void *sockp)
 }
 
 /* CURLOPT_WRITEFUNCTION */
-static size_t write_cb(void *ptr, size_t size, size_t nmemb, void *data)
+static size_t write_cb(char *ptr, size_t size, size_t nmemb, void *data)
 {
   size_t realsize = size * nmemb;
-  ConnInfo *conn = (ConnInfo*) data;
+  struct ConnInfo *conn = (struct ConnInfo *)data;
   (void)ptr;
   (void)conn;
   return realsize;
 }
 
-/* CURLOPT_PROGRESSFUNCTION */
-static int prog_cb(void *p, double dltotal, double dlnow, double ult,
-                   double uln)
+/* CURLOPT_XFERINFOFUNCTION */
+static int xferinfo_cb(void *p, curl_off_t dltotal, curl_off_t dlnow,
+                       curl_off_t ult, curl_off_t uln)
 {
-  ConnInfo *conn = (ConnInfo *)p;
-  MSG_OUT("Progress: %s (%g/%g)\n", conn->url, dlnow, dltotal);
+  struct ConnInfo *conn = (struct ConnInfo *)p;
+  (void)ult;
+  (void)uln;
+
+  fprintf(MSG_OUT, "Progress: %s (%" CURL_FORMAT_CURL_OFF_T "/"
+          "%" CURL_FORMAT_CURL_OFF_T ")\n", conn->url, dlnow, dltotal);
   return 0;
 }
 
 /* Create a new easy handle, and add it to the global curl_multi */
-static void new_conn(char *url, GlobalInfo *g)
+static void new_conn(const char *url, struct GlobalInfo *g)
 {
-  ConnInfo *conn;
-  CURLMcode rc;
+  struct ConnInfo *conn;
+  CURLMcode mresult;
 
-  conn = g_malloc0(sizeof(ConnInfo));
-  conn->error[0]='\0';
-  conn->easy = curl_easy_init();
-  if(!conn->easy) {
+  conn = g_malloc0(sizeof(*conn));
+  conn->error[0] = '\0';
+  conn->curl = curl_easy_init();
+  if(!conn->curl) {
     MSG_OUT("curl_easy_init() failed, exiting!\n");
     exit(2);
   }
   conn->global = g;
   conn->url = g_strdup(url);
-  curl_easy_setopt(conn->easy, CURLOPT_URL, conn->url);
-  curl_easy_setopt(conn->easy, CURLOPT_WRITEFUNCTION, write_cb);
-  curl_easy_setopt(conn->easy, CURLOPT_WRITEDATA, &conn);
-  curl_easy_setopt(conn->easy, CURLOPT_VERBOSE, (long)SHOW_VERBOSE);
-  curl_easy_setopt(conn->easy, CURLOPT_ERRORBUFFER, conn->error);
-  curl_easy_setopt(conn->easy, CURLOPT_PRIVATE, conn);
-  curl_easy_setopt(conn->easy, CURLOPT_NOPROGRESS, SHOW_PROGRESS?0L:1L);
-  curl_easy_setopt(conn->easy, CURLOPT_PROGRESSFUNCTION, prog_cb);
-  curl_easy_setopt(conn->easy, CURLOPT_PROGRESSDATA, conn);
-  curl_easy_setopt(conn->easy, CURLOPT_FOLLOWLOCATION, 1L);
-  curl_easy_setopt(conn->easy, CURLOPT_CONNECTTIMEOUT, 30L);
-  curl_easy_setopt(conn->easy, CURLOPT_LOW_SPEED_LIMIT, 1L);
-  curl_easy_setopt(conn->easy, CURLOPT_LOW_SPEED_TIME, 30L);
+  curl_easy_setopt(conn->curl, CURLOPT_URL, conn->url);
+  curl_easy_setopt(conn->curl, CURLOPT_WRITEFUNCTION, write_cb);
+  curl_easy_setopt(conn->curl, CURLOPT_WRITEDATA, &conn);
+  curl_easy_setopt(conn->curl, CURLOPT_VERBOSE, SHOW_VERBOSE);
+  curl_easy_setopt(conn->curl, CURLOPT_ERRORBUFFER, conn->error);
+  curl_easy_setopt(conn->curl, CURLOPT_PRIVATE, conn);
+  curl_easy_setopt(conn->curl, CURLOPT_NOPROGRESS, SHOW_PROGRESS ? 0L : 1L);
+  curl_easy_setopt(conn->curl, CURLOPT_XFERINFOFUNCTION, xferinfo_cb);
+  curl_easy_setopt(conn->curl, CURLOPT_PROGRESSDATA, conn);
+  curl_easy_setopt(conn->curl, CURLOPT_FOLLOWLOCATION, 1L);
+  curl_easy_setopt(conn->curl, CURLOPT_CONNECTTIMEOUT, 30L);
+  curl_easy_setopt(conn->curl, CURLOPT_LOW_SPEED_LIMIT, 1L);
+  curl_easy_setopt(conn->curl, CURLOPT_LOW_SPEED_TIME, 30L);
 
-  MSG_OUT("Adding easy %p to multi %p (%s)\n", conn->easy, g->multi, url);
-  rc = curl_multi_add_handle(g->multi, conn->easy);
-  mcode_or_die("new_conn: curl_multi_add_handle", rc);
+  MSG_OUT("Adding easy %p to multi %p (%s)\n", conn->curl, g->multi, url);
+  mresult = curl_multi_add_handle(g->multi, conn->curl);
+  mcode_or_die("new_conn: curl_multi_add_handle", mresult);
 
-  /* note that the add_handle() will set a time-out to trigger soon so that
-     the necessary socket_action() call will be called by this app */
+  /* note that add_handle() sets a timeout to trigger soon so that the
+     necessary socket_action() gets called */
 }
 
 /* This gets called by glib whenever data is received from the fifo */
@@ -340,18 +353,18 @@ static gboolean fifo_cb(GIOChannel *ch, GIOCondition condition, gpointer data)
     rv = g_io_channel_read_line(ch, &buf, &len, &tp, &err);
     if(buf) {
       if(tp) {
-        buf[tp]='\0';
+        buf[tp] = '\0';
       }
-      new_conn(buf, (GlobalInfo*)data);
+      new_conn(buf, (struct GlobalInfo *)data);
       g_free(buf);
     }
     else {
       buf = g_malloc(BUF_SIZE + 1);
-      while(TRUE) {
-        buf[BUF_SIZE]='\0';
+      for(;;) {
+        buf[BUF_SIZE] = '\0';
         g_io_channel_read_chars(ch, buf, BUF_SIZE, &len, &err);
         if(len) {
-          buf[len]='\0';
+          buf[len] = '\0';
           if(all) {
             tmp = all;
             all = g_strdup_printf("%s%s", tmp, buf);
@@ -366,7 +379,7 @@ static gboolean fifo_cb(GIOChannel *ch, GIOCondition condition, gpointer data)
         }
       }
       if(all) {
-        new_conn(all, (GlobalInfo*)data);
+        new_conn(all, (struct GlobalInfo *)data);
         g_free(all);
       }
       g_free(buf);
@@ -386,53 +399,63 @@ int init_fifo(void)
   const char *fifo = "hiper.fifo";
   int socket;
 
-  if(lstat (fifo, &st) == 0) {
+  if(!lstat(fifo, &st)) {
     if((st.st_mode & S_IFMT) == S_IFREG) {
       errno = EEXIST;
       perror("lstat");
-      exit(1);
+      return CURL_SOCKET_BAD;
     }
   }
 
   unlink(fifo);
-  if(mkfifo (fifo, 0600) == -1) {
+  if(mkfifo(fifo, 0600) == -1) {
     perror("mkfifo");
-    exit(1);
+    return CURL_SOCKET_BAD;
   }
 
   socket = open(fifo, O_RDWR | O_NONBLOCK, 0);
 
-  if(socket == -1) {
+  if(socket == CURL_SOCKET_BAD) {
     perror("open");
-    exit(1);
+    return socket;
   }
   MSG_OUT("Now, pipe some URL's into > %s\n", fifo);
 
   return socket;
 }
 
-int main(int argc, char **argv)
+int main(void)
 {
-  GlobalInfo *g;
-  GMainLoop*gmain;
+  struct GlobalInfo *g = g_malloc0(sizeof(struct GlobalInfo));
+  GMainLoop *gmain;
   int fd;
-  GIOChannel* ch;
-  g = g_malloc0(sizeof(GlobalInfo));
+  GIOChannel *ch;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   fd = init_fifo();
+  if(fd == CURL_SOCKET_BAD) {
+    curl_global_cleanup();
+    return 1;
+  }
   ch = g_io_channel_unix_new(fd);
   g_io_add_watch(ch, G_IO_IN, fifo_cb, g);
   gmain = g_main_loop_new(NULL, FALSE);
   g->multi = curl_multi_init();
-  curl_multi_setopt(g->multi, CURLMOPT_SOCKETFUNCTION, sock_cb);
-  curl_multi_setopt(g->multi, CURLMOPT_SOCKETDATA, g);
-  curl_multi_setopt(g->multi, CURLMOPT_TIMERFUNCTION, update_timeout_cb);
-  curl_multi_setopt(g->multi, CURLMOPT_TIMERDATA, g);
+  if(g->multi) {
+    curl_multi_setopt(g->multi, CURLMOPT_SOCKETFUNCTION, sock_cb);
+    curl_multi_setopt(g->multi, CURLMOPT_SOCKETDATA, g);
+    curl_multi_setopt(g->multi, CURLMOPT_TIMERFUNCTION, update_timeout_cb);
+    curl_multi_setopt(g->multi, CURLMOPT_TIMERDATA, g);
 
-  /* we do not call any curl_multi_socket*() function yet as we have no handles
-     added! */
+    /* we do not call any curl_multi_socket*() function yet as we have no
+       handles added! */
 
-  g_main_loop_run(gmain);
-  curl_multi_cleanup(g->multi);
+    g_main_loop_run(gmain);
+    curl_multi_cleanup(g->multi);
+  }
+  curl_global_cleanup();
   return 0;
 }
diff --git a/third-party/curl/docs/examples/headerapi.c b/third-party/curl/docs/examples/headerapi.c
index 4df6cbd672..fed3af5b7b 100644
--- a/third-party/curl/docs/examples/headerapi.c
+++ b/third-party/curl/docs/examples/headerapi.c
@@ -26,6 +26,7 @@
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 static size_t write_cb(char *data, size_t n, size_t l, void *userp)
@@ -33,30 +34,33 @@ static size_t write_cb(char *data, size_t n, size_t l, void *userp)
   /* take care of the data here, ignored in this example */
   (void)data;
   (void)userp;
-  return n*l;
+  return n * l;
 }
 
 int main(void)
 {
   CURL *curl;
 
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
   curl = curl_easy_init();
   if(curl) {
-    CURLcode res;
     struct curl_header *header;
     curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
     /* example.com is redirected, so we tell libcurl to follow redirection */
     curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
 
-    /* this example just ignores the content */
+    /* this example ignores the content */
     curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     if(CURLHE_OK == curl_easy_header(curl, "Content-Type", 0, CURLH_HEADER,
                                      -1, &header))
@@ -69,13 +73,13 @@ int main(void)
       do {
         h = curl_easy_nextheader(curl, CURLH_HEADER, -1, prev);
         if(h)
-          printf(" %s: %s (%u)\n", h->name, h->value, (int)h->amount);
+          printf(" %s: %s (%u)\n", h->name, h->value, (unsigned int)h->amount);
         prev = h;
       } while(h);
-
     }
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
+  curl_global_cleanup();
   return 0;
 }
diff --git a/third-party/curl/docs/examples/hiperfifo.c b/third-party/curl/docs/examples/hiperfifo.c
index 9fba341bb6..96719530cf 100644
--- a/third-party/curl/docs/examples/hiperfifo.c
+++ b/third-party/curl/docs/examples/hiperfifo.c
@@ -22,64 +22,61 @@
  *
  ***************************************************************************/
 /* <DESC>
- * multi socket API usage with libevent 2
+ * multi socket interface with libevent 2
  * </DESC>
  */
 /* Example application source code using the multi socket interface to
-   download many files at once.
-
-Written by Jeff Pohlmeyer
-
-Requires libevent version 2 and a (POSIX?) system that has mkfifo().
-
-This is an adaptation of libcurl's "hipev.c" and libevent's "event-test.c"
-sample programs.
-
-When running, the program creates the named pipe "hiper.fifo"
-
-Whenever there is input into the fifo, the program reads the input as a list
-of URL's and creates some new easy handles to fetch each URL via the
-curl_multi "hiper" API.
-
-
-Thus, you can try a single URL:
-  % echo http://www.yahoo.com > hiper.fifo
-
-Or a whole bunch of them:
-  % cat my-url-list > hiper.fifo
-
-The fifo buffer is handled almost instantly, so you can even add more URL's
-while the previous requests are still being downloaded.
-
-Note:
-  For the sake of simplicity, URL length is limited to 1023 char's !
-
-This is purely a demo app, all retrieved data is simply discarded by the write
-callback.
-
-*/
-
+ * download many files at once.
+ *
+ * Written by Jeff Pohlmeyer
+ *
+ * Requires libevent version 2 and a (POSIX?) system that has mkfifo().
+ *
+ * This is an adaptation of libcurl's "hipev.c" and libevent's "event-test.c"
+ * sample programs.
+ *
+ * When running, the program creates the named pipe "hiper.fifo"
+ *
+ * Whenever there is input into the fifo, the program reads the input as a list
+ * of URL's and creates some new easy handles to fetch each URL via the
+ * curl_multi "hiper" API.
+ *
+ * Thus, you can try a single URL:
+ *   % echo http://www.example.com > hiper.fifo
+ *
+ * Or a whole bunch of them:
+ *   % cat my-url-list > hiper.fifo
+ *
+ * The fifo buffer is handled almost instantly, so you can even add more URL's
+ * while the previous requests are still being downloaded.
+ *
+ * Note:
+ *   For the sake of simplicity, URL length is limited to 1023 chars.
+ *
+ * This is purely a demo app, all retrieved data is discarded by
+ * the write callback.
+ */
+#include <errno.h>
+#include <fcntl.h>
 #include <stdio.h>
-#include <string.h>
 #include <stdlib.h>
+#include <string.h>
+#include <sys/cdefs.h>
+#include <sys/poll.h>
+#include <sys/stat.h>
 #include <sys/time.h>
 #include <time.h>
 #include <unistd.h>
-#include <sys/poll.h>
+
 #include <curl/curl.h>
+
 #include <event2/event.h>
 #include <event2/event_struct.h>
-#include <fcntl.h>
-#include <sys/stat.h>
-#include <errno.h>
-#include <sys/cdefs.h>
 
 #define MSG_OUT stdout /* Send info to stdout, change to stderr if you want */
 
-
 /* Global information, common to all connections */
-typedef struct _GlobalInfo
-{
+struct GlobalInfo {
   struct event_base *evbase;
   struct event fifo_event;
   struct event timer_event;
@@ -87,32 +84,25 @@ typedef struct _GlobalInfo
   int still_running;
   FILE *input;
   int stopped;
-} GlobalInfo;
-
+};
 
 /* Information associated with a specific easy handle */
-typedef struct _ConnInfo
-{
-  CURL *easy;
+struct ConnInfo {
+  CURL *curl;
   char *url;
-  GlobalInfo *global;
+  struct GlobalInfo *global;
   char error[CURL_ERROR_SIZE];
-} ConnInfo;
-
+};
 
 /* Information associated with a specific socket */
-typedef struct _SockInfo
-{
+struct SockInfo {
   curl_socket_t sockfd;
-  CURL *easy;
+  CURL *curl;
   int action;
   long timeout;
   struct event ev;
-  GlobalInfo *global;
-} SockInfo;
-
-#define mycase(code) \
-  case code: s = __STRING(code)
+  struct GlobalInfo *global;
+};
 
 /* Die if we get a bad CURLMcode somewhere */
 static void mcode_or_die(const char *where, CURLMcode code)
@@ -120,14 +110,29 @@ static void mcode_or_die(const char *where, CURLMcode code)
   if(CURLM_OK != code) {
     const char *s;
     switch(code) {
-      mycase(CURLM_BAD_HANDLE); break;
-      mycase(CURLM_BAD_EASY_HANDLE); break;
-      mycase(CURLM_OUT_OF_MEMORY); break;
-      mycase(CURLM_INTERNAL_ERROR); break;
-      mycase(CURLM_UNKNOWN_OPTION); break;
-      mycase(CURLM_LAST); break;
-      default: s = "CURLM_unknown"; break;
-      mycase(CURLM_BAD_SOCKET);
+    case CURLM_BAD_HANDLE:
+      s = "CURLM_BAD_HANDLE";
+      break;
+    case CURLM_BAD_EASY_HANDLE:
+      s = "CURLM_BAD_EASY_HANDLE";
+      break;
+    case CURLM_OUT_OF_MEMORY:
+      s = "CURLM_OUT_OF_MEMORY";
+      break;
+    case CURLM_INTERNAL_ERROR:
+      s = "CURLM_INTERNAL_ERROR";
+      break;
+    case CURLM_UNKNOWN_OPTION:
+      s = "CURLM_UNKNOWN_OPTION";
+      break;
+    case CURLM_LAST:
+      s = "CURLM_LAST";
+      break;
+    default:
+      s = "CURLM_unknown";
+      break;
+    case CURLM_BAD_SOCKET:
+      s = "CURLM_BAD_SOCKET";
       fprintf(MSG_OUT, "ERROR: %s returns %s\n", where, s);
       /* ignore this error */
       return;
@@ -137,19 +142,18 @@ static void mcode_or_die(const char *where, CURLMcode code)
   }
 }
 
-
 /* Update the event timer after curl_multi library calls */
-static int multi_timer_cb(CURLM *multi, long timeout_ms, GlobalInfo *g)
+static int multi_timer_cb(CURLM *multi, long timeout_ms, struct GlobalInfo *g)
 {
   struct timeval timeout;
   (void)multi;
 
-  timeout.tv_sec = timeout_ms/1000;
-  timeout.tv_usec = (timeout_ms%1000)*1000;
+  timeout.tv_sec = timeout_ms / 1000;
+  timeout.tv_usec = (timeout_ms % 1000) * 1000;
   fprintf(MSG_OUT, "multi_timer_cb: Setting timeout to %ld ms\n", timeout_ms);
 
   /*
-   * if timeout_ms is -1, just delete the timer
+   * if timeout_ms is -1, delete the timer
    *
    * For all other values of timeout_ms, this should set or *update* the timer
    * to the new value
@@ -161,28 +165,25 @@ static int multi_timer_cb(CURLM *multi, long timeout_ms, GlobalInfo *g)
   return 0;
 }
 
-
 /* Check for completed transfers, and remove their easy handles */
-static void check_multi_info(GlobalInfo *g)
+static void check_multi_info(struct GlobalInfo *g)
 {
   char *eff_url;
   CURLMsg *msg;
   int msgs_left;
-  ConnInfo *conn;
-  CURL *easy;
-  CURLcode res;
+  struct ConnInfo *conn;
 
   fprintf(MSG_OUT, "REMAINING: %d\n", g->still_running);
   while((msg = curl_multi_info_read(g->multi, &msgs_left))) {
     if(msg->msg == CURLMSG_DONE) {
-      easy = msg->easy_handle;
-      res = msg->data.result;
-      curl_easy_getinfo(easy, CURLINFO_PRIVATE, &conn);
-      curl_easy_getinfo(easy, CURLINFO_EFFECTIVE_URL, &eff_url);
-      fprintf(MSG_OUT, "DONE: %s => (%d) %s\n", eff_url, res, conn->error);
-      curl_multi_remove_handle(g->multi, easy);
+      CURL *curl = msg->easy_handle;
+      CURLcode result = msg->data.result;
+      curl_easy_getinfo(curl, CURLINFO_PRIVATE, &conn);
+      curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_URL, &eff_url);
+      fprintf(MSG_OUT, "DONE: %s => (%d) %s\n", eff_url, result, conn->error);
+      curl_multi_remove_handle(g->multi, curl);
       free(conn->url);
-      curl_easy_cleanup(easy);
+      curl_easy_cleanup(curl);
       free(conn);
     }
   }
@@ -190,20 +191,17 @@ static void check_multi_info(GlobalInfo *g)
     event_base_loopbreak(g->evbase);
 }
 
-
-
 /* Called by libevent when we get action on a multi socket */
 static void event_cb(int fd, short kind, void *userp)
 {
-  GlobalInfo *g = (GlobalInfo*) userp;
-  CURLMcode rc;
+  struct GlobalInfo *g = (struct GlobalInfo *)userp;
+  CURLMcode mresult;
 
-  int action =
-    ((kind & EV_READ) ? CURL_CSELECT_IN : 0) |
-    ((kind & EV_WRITE) ? CURL_CSELECT_OUT : 0);
+  int action = ((kind & EV_READ) ? CURL_CSELECT_IN : 0) |
+               ((kind & EV_WRITE) ? CURL_CSELECT_OUT : 0);
 
-  rc = curl_multi_socket_action(g->multi, fd, action, &g->still_running);
-  mcode_or_die("event_cb: curl_multi_socket_action", rc);
+  mresult = curl_multi_socket_action(g->multi, fd, action, &g->still_running);
+  mcode_or_die("event_cb: curl_multi_socket_action", mresult);
 
   check_multi_info(g);
   if(g->still_running <= 0) {
@@ -214,26 +212,22 @@ static void event_cb(int fd, short kind, void *userp)
   }
 }
 
-
-
 /* Called by libevent when our timeout expires */
 static void timer_cb(int fd, short kind, void *userp)
 {
-  GlobalInfo *g = (GlobalInfo *)userp;
-  CURLMcode rc;
+  struct GlobalInfo *g = (struct GlobalInfo *)userp;
+  CURLMcode mresult;
   (void)fd;
   (void)kind;
 
-  rc = curl_multi_socket_action(g->multi,
-                                  CURL_SOCKET_TIMEOUT, 0, &g->still_running);
-  mcode_or_die("timer_cb: curl_multi_socket_action", rc);
+  mresult = curl_multi_socket_action(g->multi, CURL_SOCKET_TIMEOUT, 0,
+                                     &g->still_running);
+  mcode_or_die("timer_cb: curl_multi_socket_action", mresult);
   check_multi_info(g);
 }
 
-
-
 /* Clean up the SockInfo structure */
-static void remsock(SockInfo *f)
+static void remsock(struct SockInfo *f)
 {
   if(f) {
     if(event_initialized(&f->ev)) {
@@ -243,47 +237,42 @@ static void remsock(SockInfo *f)
   }
 }
 
-
-
 /* Assign information to a SockInfo structure */
-static void setsock(SockInfo *f, curl_socket_t s, CURL *e, int act,
-                    GlobalInfo *g)
+static void setsock(struct SockInfo *f, curl_socket_t s, CURL *e, int act,
+                    struct GlobalInfo *g)
 {
-  int kind =
-     ((act & CURL_POLL_IN) ? EV_READ : 0) |
-     ((act & CURL_POLL_OUT) ? EV_WRITE : 0) | EV_PERSIST;
+  int kind = ((act & CURL_POLL_IN) ? EV_READ : 0) |
+             ((act & CURL_POLL_OUT) ? EV_WRITE : 0) | EV_PERSIST;
 
   f->sockfd = s;
   f->action = act;
-  f->easy = e;
+  f->curl = e;
   if(event_initialized(&f->ev)) {
     event_del(&f->ev);
   }
-  event_assign(&f->ev, g->evbase, f->sockfd, kind, event_cb, g);
+  event_assign(&f->ev, g->evbase, f->sockfd, (short)kind, event_cb, g);
   event_add(&f->ev, NULL);
 }
 
-
-
 /* Initialize a new SockInfo structure */
-static void addsock(curl_socket_t s, CURL *easy, int action, GlobalInfo *g)
+static void addsock(curl_socket_t s, CURL *curl, int action,
+                    struct GlobalInfo *g)
 {
-  SockInfo *fdp = calloc(1, sizeof(SockInfo));
+  struct SockInfo *fdp = calloc(1, sizeof(struct SockInfo));
 
   fdp->global = g;
-  setsock(fdp, s, easy, action, g);
+  setsock(fdp, s, curl, action, g);
   curl_multi_assign(g->multi, s, fdp);
 }
 
 /* CURLMOPT_SOCKETFUNCTION */
 static int sock_cb(CURL *e, curl_socket_t s, int what, void *cbp, void *sockp)
 {
-  GlobalInfo *g = (GlobalInfo*) cbp;
-  SockInfo *fdp = (SockInfo*) sockp;
-  const char *whatstr[]={ "none", "IN", "OUT", "INOUT", "REMOVE" };
+  struct GlobalInfo *g = (struct GlobalInfo *)cbp;
+  struct SockInfo *fdp = (struct SockInfo *)sockp;
+  const char *whatstr[] = { "none", "IN", "OUT", "INOUT", "REMOVE" };
 
-  fprintf(MSG_OUT,
-          "socket callback: s=%d e=%p what=%s ", s, e, whatstr[what]);
+  fprintf(MSG_OUT, "socket callback: s=%d e=%p what=%s ", s, e, whatstr[what]);
   if(what == CURL_POLL_REMOVE) {
     fprintf(MSG_OUT, "\n");
     remsock(fdp);
@@ -294,8 +283,7 @@ static int sock_cb(CURL *e, curl_socket_t s, int what, void *cbp, void *sockp)
       addsock(s, e, what, g);
     }
     else {
-      fprintf(MSG_OUT,
-              "Changing action from %s to %s\n",
+      fprintf(MSG_OUT, "Changing action from %s to %s\n",
               whatstr[fdp->action], whatstr[what]);
       setsock(fdp, s, e, what, g);
     }
@@ -303,63 +291,60 @@ static int sock_cb(CURL *e, curl_socket_t s, int what, void *cbp, void *sockp)
   return 0;
 }
 
-
-
 /* CURLOPT_WRITEFUNCTION */
-static size_t write_cb(void *ptr, size_t size, size_t nmemb, void *data)
+static size_t write_cb(char *ptr, size_t size, size_t nmemb, void *data)
 {
   (void)ptr;
   (void)data;
   return size * nmemb;
 }
 
-
 /* CURLOPT_PROGRESSFUNCTION */
-static int prog_cb(void *p, double dltotal, double dlnow, double ult,
-                   double uln)
+static int xferinfo_cb(void *p, curl_off_t dltotal, curl_off_t dlnow,
+                       curl_off_t ult, curl_off_t uln)
 {
-  ConnInfo *conn = (ConnInfo *)p;
+  struct ConnInfo *conn = (struct ConnInfo *)p;
   (void)ult;
   (void)uln;
 
-  fprintf(MSG_OUT, "Progress: %s (%g/%g)\n", conn->url, dlnow, dltotal);
+  fprintf(MSG_OUT, "Progress: %s (%" CURL_FORMAT_CURL_OFF_T "/"
+          "%" CURL_FORMAT_CURL_OFF_T ")\n", conn->url, dlnow, dltotal);
   return 0;
 }
 
-
 /* Create a new easy handle, and add it to the global curl_multi */
-static void new_conn(char *url, GlobalInfo *g)
+static void new_conn(const char *url, struct GlobalInfo *g)
 {
-  ConnInfo *conn;
-  CURLMcode rc;
+  struct ConnInfo *conn;
+  CURLMcode mresult;
 
-  conn = calloc(1, sizeof(ConnInfo));
-  conn->error[0]='\0';
+  conn = calloc(1, sizeof(*conn));
+  conn->error[0] = '\0';
 
-  conn->easy = curl_easy_init();
-  if(!conn->easy) {
+  conn->curl = curl_easy_init();
+  if(!conn->curl) {
     fprintf(MSG_OUT, "curl_easy_init() failed, exiting!\n");
     exit(2);
   }
   conn->global = g;
   conn->url = strdup(url);
-  curl_easy_setopt(conn->easy, CURLOPT_URL, conn->url);
-  curl_easy_setopt(conn->easy, CURLOPT_WRITEFUNCTION, write_cb);
-  curl_easy_setopt(conn->easy, CURLOPT_WRITEDATA, conn);
-  curl_easy_setopt(conn->easy, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(conn->easy, CURLOPT_ERRORBUFFER, conn->error);
-  curl_easy_setopt(conn->easy, CURLOPT_PRIVATE, conn);
-  curl_easy_setopt(conn->easy, CURLOPT_NOPROGRESS, 0L);
-  curl_easy_setopt(conn->easy, CURLOPT_PROGRESSFUNCTION, prog_cb);
-  curl_easy_setopt(conn->easy, CURLOPT_PROGRESSDATA, conn);
-  curl_easy_setopt(conn->easy, CURLOPT_FOLLOWLOCATION, 1L);
-  fprintf(MSG_OUT,
-          "Adding easy %p to multi %p (%s)\n", conn->easy, g->multi, url);
-  rc = curl_multi_add_handle(g->multi, conn->easy);
-  mcode_or_die("new_conn: curl_multi_add_handle", rc);
+  curl_easy_setopt(conn->curl, CURLOPT_URL, conn->url);
+  curl_easy_setopt(conn->curl, CURLOPT_WRITEFUNCTION, write_cb);
+  curl_easy_setopt(conn->curl, CURLOPT_WRITEDATA, conn);
+  curl_easy_setopt(conn->curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(conn->curl, CURLOPT_ERRORBUFFER, conn->error);
+  curl_easy_setopt(conn->curl, CURLOPT_PRIVATE, conn);
+  curl_easy_setopt(conn->curl, CURLOPT_NOPROGRESS, 0L);
+  curl_easy_setopt(conn->curl, CURLOPT_XFERINFOFUNCTION, xferinfo_cb);
+  curl_easy_setopt(conn->curl, CURLOPT_PROGRESSDATA, conn);
+  curl_easy_setopt(conn->curl, CURLOPT_FOLLOWLOCATION, 1L);
+  fprintf(MSG_OUT, "Adding easy %p to multi %p (%s)\n",
+          conn->curl, g->multi, url);
+  mresult = curl_multi_add_handle(g->multi, conn->curl);
+  mcode_or_die("new_conn: curl_multi_add_handle", mresult);
 
-  /* note that the add_handle() will set a time-out to trigger soon so that
-     the necessary socket_action() call will be called by this app */
+  /* note that the add_handle() sets a time-out to trigger soon so that
+     the necessary socket_action() gets called */
 }
 
 /* This gets called whenever data is received from the fifo */
@@ -368,14 +353,14 @@ static void fifo_cb(int fd, short event, void *arg)
   char s[1024];
   long int rv = 0;
   int n = 0;
-  GlobalInfo *g = (GlobalInfo *)arg;
+  struct GlobalInfo *g = (struct GlobalInfo *)arg;
   (void)fd;
   (void)event;
 
   do {
-    s[0]='\0';
+    s[0] = '\0';
     rv = fscanf(g->input, "%1023s%n", s, &n);
-    s[n]='\0';
+    s[n] = '\0';
     if(n && s[0]) {
       if(!strcmp(s, "stop")) {
         g->stopped = 1;
@@ -383,7 +368,7 @@ static void fifo_cb(int fd, short event, void *arg)
           event_base_loopbreak(g->evbase);
       }
       else
-        new_conn(s, arg);  /* if we read a URL, go get it! */
+        new_conn(s, arg); /* if we read a URL, go get it! */
     }
     else
       break;
@@ -392,54 +377,60 @@ static void fifo_cb(int fd, short event, void *arg)
 
 /* Create a named pipe and tell libevent to monitor it */
 static const char *fifo = "hiper.fifo";
-static int init_fifo(GlobalInfo *g)
+static int init_fifo(struct GlobalInfo *g)
 {
   struct stat st;
   curl_socket_t sockfd;
 
   fprintf(MSG_OUT, "Creating named pipe \"%s\"\n", fifo);
-  if(lstat (fifo, &st) == 0) {
+  if(!lstat(fifo, &st)) {
     if((st.st_mode & S_IFMT) == S_IFREG) {
       errno = EEXIST;
       perror("lstat");
-      exit(1);
+      return 1;
     }
   }
   unlink(fifo);
-  if(mkfifo (fifo, 0600) == -1) {
+  if(mkfifo(fifo, 0600) == -1) {
     perror("mkfifo");
-    exit(1);
+    return 1;
   }
   sockfd = open(fifo, O_RDWR | O_NONBLOCK, 0);
   if(sockfd == -1) {
     perror("open");
-    exit(1);
+    return 1;
   }
   g->input = fdopen(sockfd, "r");
 
   fprintf(MSG_OUT, "Now, pipe some URL's into > %s\n", fifo);
-  event_assign(&g->fifo_event, g->evbase, sockfd, EV_READ|EV_PERSIST,
+  event_assign(&g->fifo_event, g->evbase, sockfd, EV_READ | EV_PERSIST,
                fifo_cb, g);
   event_add(&g->fifo_event, NULL);
-  return (0);
+  return 0;
 }
 
-static void clean_fifo(GlobalInfo *g)
+static void clean_fifo(struct GlobalInfo *g)
 {
-    event_del(&g->fifo_event);
-    fclose(g->input);
-    unlink(fifo);
+  event_del(&g->fifo_event);
+  fclose(g->input);
+  unlink(fifo);
 }
 
-int main(int argc, char **argv)
+int main(void)
 {
-  GlobalInfo g;
-  (void)argc;
-  (void)argv;
+  CURLcode result;
+  struct GlobalInfo g;
 
-  memset(&g, 0, sizeof(GlobalInfo));
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
+  memset(&g, 0, sizeof(g));
   g.evbase = event_base_new();
-  init_fifo(&g);
+  if(init_fifo(&g)) {
+    curl_global_cleanup();
+    return 1;
+  }
   g.multi = curl_multi_init();
   evtimer_assign(&g.timer_event, g.evbase, timer_cb, &g);
 
@@ -454,11 +445,13 @@ int main(int argc, char **argv)
 
   event_base_dispatch(g.evbase);
 
-  /* this, of course, will not get called since only way to stop this program
-     is via ctrl-C, but it is here to show how cleanup /would/ be done. */
+  /* this, of course, does not get called since the only way to stop this
+     program is via ctrl-C, but it is here to show how cleanup /would/ be
+     done. */
   clean_fifo(&g);
   event_del(&g.timer_event);
   event_base_free(g.evbase);
   curl_multi_cleanup(g.multi);
+  curl_global_cleanup();
   return 0;
 }
diff --git a/third-party/curl/docs/examples/href_extractor.c b/third-party/curl/docs/examples/href_extractor.c
deleted file mode 100644
index 5c92b0c23f..0000000000
--- a/third-party/curl/docs/examples/href_extractor.c
+++ /dev/null
@@ -1,88 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-/* <DESC>
- * Uses the "Streaming HTML parser" to extract the href pieces in a streaming
- * manner from a downloaded HTML.
- * </DESC>
- */
-/*
- * The HTML parser is found at https://github.com/arjunc77/htmlstreamparser
- */
-
-#include <stdio.h>
-#include <curl/curl.h>
-#include <htmlstreamparser.h>
-
-
-static size_t write_callback(void *buffer, size_t size, size_t nmemb,
-                             void *hsp)
-{
-  size_t realsize = size * nmemb, p;
-  for(p = 0; p < realsize; p++) {
-    html_parser_char_parse(hsp, ((char *)buffer)[p]);
-    if(html_parser_cmp_tag(hsp, "a", 1))
-      if(html_parser_cmp_attr(hsp, "href", 4))
-        if(html_parser_is_in(hsp, HTML_VALUE_ENDED)) {
-          html_parser_val(hsp)[html_parser_val_length(hsp)] = '\0';
-          printf("%s\n", html_parser_val(hsp));
-        }
-  }
-  return realsize;
-}
-
-int main(int argc, char *argv[])
-{
-  char tag[1], attr[4], val[128];
-  CURL *curl;
-  HTMLSTREAMPARSER *hsp;
-
-  if(argc != 2) {
-    printf("Usage: %s URL\n", argv[0]);
-    return EXIT_FAILURE;
-  }
-
-  curl = curl_easy_init();
-
-  hsp = html_parser_init();
-
-  html_parser_set_tag_to_lower(hsp, 1);
-  html_parser_set_attr_to_lower(hsp, 1);
-  html_parser_set_tag_buffer(hsp, tag, sizeof(tag));
-  html_parser_set_attr_buffer(hsp, attr, sizeof(attr));
-  html_parser_set_val_buffer(hsp, val, sizeof(val)-1);
-
-  curl_easy_setopt(curl, CURLOPT_URL, argv[1]);
-  curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_callback);
-  curl_easy_setopt(curl, CURLOPT_WRITEDATA, hsp);
-  curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
-
-  curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-
-  html_parser_cleanup(hsp);
-
-  return EXIT_SUCCESS;
-}
diff --git a/third-party/curl/docs/examples/hsts-preload.c b/third-party/curl/docs/examples/hsts-preload.c
index ee4253533e..877e8eb73e 100644
--- a/third-party/curl/docs/examples/hsts-preload.c
+++ b/third-party/curl/docs/examples/hsts-preload.c
@@ -27,6 +27,7 @@
  */
 #include <stdio.h>
 #include <string.h>
+
 #include <curl/curl.h>
 
 struct entry {
@@ -44,22 +45,31 @@ struct state {
   int index;
 };
 
+static void strcopy(char *dest, size_t dsize, const char *src, size_t slen)
+{
+  if(slen < dsize) {
+    memcpy(dest, src, slen);
+    dest[slen] = 0;
+  }
+  else if(dsize)
+    dest[0] = 0;
+}
+
 /* "read" is from the point of the library, it wants data from us. One domain
    entry per invoke. */
-static CURLSTScode hstsread(CURL *easy, struct curl_hstsentry *e,
-                            void *userp)
+static CURLSTScode hstsread(CURL *curl, struct curl_hstsentry *e, void *userp)
 {
   const char *host;
   const char *expire;
   struct state *s = (struct state *)userp;
-  (void)easy;
+  (void)curl;
   host = preload_hosts[s->index].name;
   expire = preload_hosts[s->index++].exp;
 
-  if(host && (strlen(host) < e->namelen)) {
-    strcpy(e->name, host);
+  if(host) {
+    strcopy(e->name, e->namelen, host, strlen(host));
     e->includeSubDomains = 0;
-    strcpy(e->expire, expire);
+    strcopy(e->expire, sizeof(e->expire), expire, strlen(expire));
     fprintf(stderr, "HSTS preload '%s' until '%s'\n", host, expire);
   }
   else
@@ -67,10 +77,10 @@ static CURLSTScode hstsread(CURL *easy, struct curl_hstsentry *e,
   return CURLSTS_OK;
 }
 
-static CURLSTScode hstswrite(CURL *easy, struct curl_hstsentry *e,
+static CURLSTScode hstswrite(CURL *curl, struct curl_hstsentry *e,
                              struct curl_index *i, void *userp)
 {
-  (void)easy;
+  (void)curl;
   (void)userp; /* we have no custom input */
   printf("[%u/%u] %s %s\n", (unsigned int)i->index, (unsigned int)i->total,
          e->name, e->expire);
@@ -80,14 +90,17 @@ static CURLSTScode hstswrite(CURL *easy, struct curl_hstsentry *e,
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
-    struct state st = {0};
+    struct state st = { 0 };
 
     /* enable HSTS for this handle */
-    curl_easy_setopt(curl, CURLOPT_HSTS_CTRL, (long)CURLHSTS_ENABLE);
+    curl_easy_setopt(curl, CURLOPT_HSTS_CTRL, CURLHSTS_ENABLE);
 
     /* function to call at first to populate the cache before the transfer */
     curl_easy_setopt(curl, CURLOPT_HSTSREADFUNCTION, hstsread);
@@ -104,15 +117,16 @@ int main(void)
 
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
-  return 0;
+  curl_global_cleanup();
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/htmltidy.c b/third-party/curl/docs/examples/htmltidy.c
index cc6f63e1cc..2e2def59c3 100644
--- a/third-party/curl/docs/examples/htmltidy.c
+++ b/third-party/curl/docs/examples/htmltidy.c
@@ -28,14 +28,15 @@
 /*
  * LibTidy => https://www.html-tidy.org/
  */
-
 #include <stdio.h>
+
 #include <tidy/tidy.h>
 #include <tidy/tidybuffio.h>
+
 #include <curl/curl.h>
 
-/* curl write callback, to fill tidy's input buffer...  */
-uint write_cb(char *in, uint size, uint nmemb, TidyBuffer *out)
+/* curl write callback, to fill tidy's input buffer... */
+static uint write_cb(char *in, uint size, uint nmemb, TidyBuffer *out)
 {
   uint r;
   r = size * nmemb;
@@ -44,68 +45,76 @@ uint write_cb(char *in, uint size, uint nmemb, TidyBuffer *out)
 }
 
 /* Traverse the document tree */
-void dumpNode(TidyDoc doc, TidyNode tnod, int indent)
+static void dumpNode(TidyDoc doc, TidyNode tnod, int indent)
 {
   TidyNode child;
-  for(child = tidyGetChild(tnod); child; child = tidyGetNext(child) ) {
+  for(child = tidyGetChild(tnod); child; child = tidyGetNext(child)) {
     ctmbstr name = tidyNodeGetName(child);
     if(name) {
-      /* if it has a name, then it's an HTML tag ... */
+      /* if it has a name, then it is an HTML tag ... */
       TidyAttr attr;
       printf("%*.*s%s ", indent, indent, "<", name);
       /* walk the attribute list */
-      for(attr = tidyAttrFirst(child); attr; attr = tidyAttrNext(attr) ) {
+      for(attr = tidyAttrFirst(child); attr; attr = tidyAttrNext(attr)) {
         printf("%s", tidyAttrName(attr));
-        tidyAttrValue(attr)?printf("=\"%s\" ",
-                                   tidyAttrValue(attr)):printf(" ");
+        tidyAttrValue(attr) ? printf("=\"%s\" ",
+                                     tidyAttrValue(attr)) : printf(" ");
       }
       printf(">\n");
     }
     else {
-      /* if it does not have a name, then it's probably text, cdata, etc... */
+      /* if it does not have a name, then it is probably text, cdata, etc... */
       TidyBuffer buf;
       tidyBufInit(&buf);
       tidyNodeGetText(doc, child, &buf);
-      printf("%*.*s\n", indent, indent, buf.bp?(char *)buf.bp:"");
+      printf("%*.*s\n", indent, indent, buf.bp ? (char *)buf.bp : "");
       tidyBufFree(&buf);
     }
     dumpNode(doc, child, indent + 4); /* recursive */
   }
 }
 
-
-int main(int argc, char **argv)
+int main(int argc, const char **argv)
 {
-  if(argc == 2) {
-    CURL *curl;
-    char curl_errbuf[CURL_ERROR_SIZE];
-    TidyDoc tdoc;
-    TidyBuffer docbuf = {0};
-    TidyBuffer tidy_errbuf = {0};
-    int err;
+  CURL *curl;
+  char curl_errbuf[CURL_ERROR_SIZE];
+  TidyDoc tdoc;
+  TidyBuffer docbuf = { 0 };
+  TidyBuffer tidy_errbuf = { 0 };
+  CURLcode result;
 
-    curl = curl_easy_init();
+  if(argc != 2) {
+    printf("usage: %s <url>\n", argv[0]);
+    return 1;
+  }
+
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
+  tdoc = tidyCreate();
+  tidyOptSetBool(tdoc, TidyForceOutput, yes); /* try harder */
+  tidyOptSetInt(tdoc, TidyWrapLen, 4096);
+  tidySetErrorBuffer(tdoc, &tidy_errbuf);
+  tidyBufInit(&docbuf);
+
+  curl = curl_easy_init();
+  if(curl) {
     curl_easy_setopt(curl, CURLOPT_URL, argv[1]);
     curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, curl_errbuf);
     curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
     curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
 
-    tdoc = tidyCreate();
-    tidyOptSetBool(tdoc, TidyForceOutput, yes); /* try harder */
-    tidyOptSetInt(tdoc, TidyWrapLen, 4096);
-    tidySetErrorBuffer(tdoc, &tidy_errbuf);
-    tidyBufInit(&docbuf);
-
     curl_easy_setopt(curl, CURLOPT_WRITEDATA, &docbuf);
-    err = curl_easy_perform(curl);
-    if(!err) {
-      err = tidyParseBuffer(tdoc, &docbuf); /* parse the input */
-      if(err >= 0) {
-        err = tidyCleanAndRepair(tdoc); /* fix any problems */
-        if(err >= 0) {
-          err = tidyRunDiagnostics(tdoc); /* load tidy error buffer */
-          if(err >= 0) {
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      result = tidyParseBuffer(tdoc, &docbuf); /* parse the input */
+      if(result >= 0) {
+        result = tidyCleanAndRepair(tdoc); /* fix any problems */
+        if(result >= 0) {
+          result = tidyRunDiagnostics(tdoc); /* load tidy error buffer */
+          if(result >= 0) {
             dumpNode(tdoc, tidyGetRoot(tdoc), 0); /* walk the tree */
             fprintf(stderr, "%s\n", tidy_errbuf.bp); /* show errors */
           }
@@ -117,14 +126,13 @@ int main(int argc, char **argv)
 
     /* clean-up */
     curl_easy_cleanup(curl);
-    tidyBufFree(&docbuf);
-    tidyBufFree(&tidy_errbuf);
-    tidyRelease(tdoc);
-    return err;
-
   }
-  else
-    printf("usage: %s <url>\n", argv[0]);
 
-  return 0;
+  tidyBufFree(&docbuf);
+  tidyBufFree(&tidy_errbuf);
+  tidyRelease(tdoc);
+
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/htmltitle.cpp b/third-party/curl/docs/examples/htmltitle.cpp
index ee3e023a2c..cce6d16e11 100644
--- a/third-party/curl/docs/examples/htmltitle.cpp
+++ b/third-party/curl/docs/examples/htmltitle.cpp
@@ -22,107 +22,105 @@
  *
  ***************************************************************************/
 /* <DESC>
- * Get a web page, extract the title with libxml.
+ * Get a webpage, extract the title with libxml.
  * </DESC>
 
- Written by Lars Nilsson
+  Written by Lars Nilsson
 
- GNU C++ compile command line suggestion (edit paths accordingly):
+  GNU C++ compile command line suggestion (edit paths accordingly):
 
- g++ -Wall -I/opt/curl/include -I/opt/libxml/include/libxml2 htmltitle.cpp \
- -o htmltitle -L/opt/curl/lib -L/opt/libxml/lib -lcurl -lxml2
+  g++ -Wall -I/opt/curl/include -I/opt/libxml/include/libxml2 htmltitle.cpp \
+    -o htmltitle -L/opt/curl/lib -L/opt/libxml/lib -lcurl -lxml2
 */
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
 #include <string>
+
 #include <curl/curl.h>
+
 #include <libxml/HTMLparser.h>
 
 //
-//  Case-insensitive string comparison
+// Case-insensitive string comparison
 //
 
-#ifdef _MSC_VER
-#define COMPARE(a, b) (!_stricmp((a), (b)))
+#ifdef _WIN32
+#define COMPARE(a, b) (!_stricmp(a, b))
 #else
-#define COMPARE(a, b) (!strcasecmp((a), (b)))
+#define COMPARE(a, b) (!strcasecmp(a, b))
 #endif
 
 //
-//  libxml callback context structure
+// libxml callback context structure
 //
-
-struct Context
-{
-  Context(): addTitle(false) { }
+struct Context {
+  Context() : addTitle(false) {}
 
   bool addTitle;
   std::string title;
 };
 
 //
-//  libcurl variables for error strings and returned data
+// libcurl variables for error strings and returned data
 
 static char errorBuffer[CURL_ERROR_SIZE];
 static std::string buffer;
 
 //
-//  libcurl write callback function
+// libcurl write callback function
 //
-
-static int writer(char *data, size_t size, size_t nmemb,
-                  std::string *writerData)
+static size_t writer(char *data, size_t size, size_t nmemb,
+                     std::string *writerData)
 {
-  if(writerData == NULL)
+  if(!writerData)
     return 0;
 
-  writerData->append(data, size*nmemb);
+  writerData->append(data, size * nmemb);
 
   return size * nmemb;
 }
 
 //
-//  libcurl connection initialization
+// libcurl connection initialization
 //
-
-static bool init(CURL *&conn, char *url)
+static bool init(CURL *&curl, const char *url)
 {
-  CURLcode code;
+  CURLcode result;
 
-  conn = curl_easy_init();
+  curl = curl_easy_init();
 
-  if(conn == NULL) {
-    fprintf(stderr, "Failed to create CURL connection\n");
-    exit(EXIT_FAILURE);
-  }
-
-  code = curl_easy_setopt(conn, CURLOPT_ERRORBUFFER, errorBuffer);
-  if(code != CURLE_OK) {
-    fprintf(stderr, "Failed to set error buffer [%d]\n", code);
+  if(!curl) {
+    fprintf(stderr, "Failed to create CURL handle\n");
     return false;
   }
 
-  code = curl_easy_setopt(conn, CURLOPT_URL, url);
-  if(code != CURLE_OK) {
+  result = curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, errorBuffer);
+  if(result != CURLE_OK) {
+    fprintf(stderr, "Failed to set error buffer [%d]\n", result);
+    return false;
+  }
+
+  result = curl_easy_setopt(curl, CURLOPT_URL, url);
+  if(result != CURLE_OK) {
     fprintf(stderr, "Failed to set URL [%s]\n", errorBuffer);
     return false;
   }
 
-  code = curl_easy_setopt(conn, CURLOPT_FOLLOWLOCATION, 1L);
-  if(code != CURLE_OK) {
+  result = curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+  if(result != CURLE_OK) {
     fprintf(stderr, "Failed to set redirect option [%s]\n", errorBuffer);
     return false;
   }
 
-  code = curl_easy_setopt(conn, CURLOPT_WRITEFUNCTION, writer);
-  if(code != CURLE_OK) {
+  result = curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writer);
+  if(result != CURLE_OK) {
     fprintf(stderr, "Failed to set writer [%s]\n", errorBuffer);
     return false;
   }
 
-  code = curl_easy_setopt(conn, CURLOPT_WRITEDATA, &buffer);
-  if(code != CURLE_OK) {
+  result = curl_easy_setopt(curl, CURLOPT_WRITEDATA, &buffer);
+  if(result != CURLE_OK) {
     fprintf(stderr, "Failed to set write data [%s]\n", errorBuffer);
     return false;
   }
@@ -131,51 +129,48 @@ static bool init(CURL *&conn, char *url)
 }
 
 //
-//  libxml start element callback function
+// libxml start element callback function
 //
-
 static void StartElement(void *voidContext,
                          const xmlChar *name,
                          const xmlChar **attributes)
 {
   Context *context = static_cast<Context *>(voidContext);
 
-  if(COMPARE(reinterpret_cast<char *>(name), "TITLE")) {
+  if(COMPARE(reinterpret_cast<const char *>(name), "TITLE")) {
     context->title = "";
     context->addTitle = true;
   }
-  (void) attributes;
+  (void)attributes;
 }
 
 //
-//  libxml end element callback function
+// libxml end element callback function
 //
-
 static void EndElement(void *voidContext,
                        const xmlChar *name)
 {
   Context *context = static_cast<Context *>(voidContext);
 
-  if(COMPARE(reinterpret_cast<char *>(name), "TITLE"))
+  if(COMPARE(reinterpret_cast<const char *>(name), "TITLE"))
     context->addTitle = false;
 }
 
 //
-//  Text handling helper function
+// Text handling helper function
 //
-
 static void handleCharacters(Context *context,
                              const xmlChar *chars,
                              int length)
 {
   if(context->addTitle)
-    context->title.append(reinterpret_cast<char *>(chars), length);
+    context->title.append(reinterpret_cast<const char *>(chars),
+                          (unsigned long)length);
 }
 
 //
-//  libxml PCDATA callback function
+// libxml PCDATA callback function
 //
-
 static void Characters(void *voidContext,
                        const xmlChar *chars,
                        int length)
@@ -186,9 +181,8 @@ static void Characters(void *voidContext,
 }
 
 //
-//  libxml CDATA callback function
+// libxml CDATA callback function
 //
-
 static void cdata(void *voidContext,
                   const xmlChar *chars,
                   int length)
@@ -199,11 +193,9 @@ static void cdata(void *voidContext,
 }
 
 //
-//  libxml SAX callback structure
+// libxml SAX callback structure
 //
-
-static htmlSAXHandler saxHandler =
-{
+static htmlSAXHandler saxHandler = {
   NULL,
   NULL,
   NULL,
@@ -230,13 +222,17 @@ static htmlSAXHandler saxHandler =
   NULL,
   NULL,
   cdata,
+  NULL,
+  0,
+  0,
+  0,
+  0,
   NULL
 };
 
 //
-//  Parse given (assumed to be) HTML text and return the title
+// Parse given (assumed to be) HTML text and return the title
 //
-
 static void parseHtml(const std::string &html,
                       std::string &title)
 {
@@ -246,7 +242,7 @@ static void parseHtml(const std::string &html,
   ctxt = htmlCreatePushParserCtxt(&saxHandler, &context, "", 0, "",
                                   XML_CHAR_ENCODING_NONE);
 
-  htmlParseChunk(ctxt, html.c_str(), html.size(), 0);
+  htmlParseChunk(ctxt, html.c_str(), (int)html.size(), 0);
   htmlParseChunk(ctxt, "", 0, 1);
 
   htmlFreeParserCtxt(ctxt);
@@ -254,36 +250,39 @@ static void parseHtml(const std::string &html,
   title = context.title;
 }
 
-int main(int argc, char *argv[])
+int main(int argc, const char *argv[])
 {
-  CURL *conn = NULL;
-  CURLcode code;
+  CURL *curl = NULL;
+  CURLcode result;
   std::string title;
 
   // Ensure one argument is given
 
   if(argc != 2) {
     fprintf(stderr, "Usage: %s <url>\n", argv[0]);
-    exit(EXIT_FAILURE);
+    return EXIT_FAILURE;
   }
 
-  curl_global_init(CURL_GLOBAL_DEFAULT);
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  // Initialize CURL connection
+  // Initialize CURL handle
 
-  if(!init(conn, argv[1])) {
-    fprintf(stderr, "Connection initialization failed\n");
-    exit(EXIT_FAILURE);
+  if(!init(curl, argv[1])) {
+    fprintf(stderr, "Handle initialization failed\n");
+    curl_global_cleanup();
+    return EXIT_FAILURE;
   }
 
   // Retrieve content for the URL
 
-  code = curl_easy_perform(conn);
-  curl_easy_cleanup(conn);
+  result = curl_easy_perform(curl);
+  curl_easy_cleanup(curl);
 
-  if(code != CURLE_OK) {
+  if(result != CURLE_OK) {
     fprintf(stderr, "Failed to get '%s' [%s]\n", argv[1], errorBuffer);
-    exit(EXIT_FAILURE);
+    return EXIT_FAILURE;
   }
 
   // Parse the (assumed) HTML code
@@ -292,5 +291,5 @@ int main(int argc, char *argv[])
   // Display the extracted title
   printf("Title: %s\n", title.c_str());
 
-  return EXIT_SUCCESS;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/http-options.c b/third-party/curl/docs/examples/http-options.c
index 964e0ef374..16338441c7 100644
--- a/third-party/curl/docs/examples/http-options.c
+++ b/third-party/curl/docs/examples/http-options.c
@@ -26,12 +26,16 @@
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -42,18 +46,19 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_REQUEST_TARGET, "*");
 
     /* if this operation fails, allow risking a memory leak and do quick exit
-       from libcurl as this will exit() anyway */
+       from libcurl as this exits anyway */
     curl_easy_setopt(curl, CURLOPT_QUICK_EXIT, 1L);
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
+  curl_global_cleanup();
   return 0;
 }
diff --git a/third-party/curl/docs/examples/http-post.c b/third-party/curl/docs/examples/http-post.c
index 2cacefee47..04a755e4aa 100644
--- a/third-party/curl/docs/examples/http-post.c
+++ b/third-party/curl/docs/examples/http-post.c
@@ -26,36 +26,38 @@
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+  CURLcode result;
 
-  /* In windows, this will init the winsock stuff */
-  curl_global_init(CURL_GLOBAL_ALL);
+  /* In Windows, this inits the Winsock stuff */
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   /* get a curl handle */
   curl = curl_easy_init();
   if(curl) {
     /* First set the URL that is about to receive our POST. This URL can
-       just as well be an https:// URL if that is what should receive the
-       data. */
+       be an https:// URL if that is what should receive the data. */
     curl_easy_setopt(curl, CURLOPT_URL, "http://postit.example.com/moo.cgi");
     /* Now specify the POST data */
     curl_easy_setopt(curl, CURLOPT_POSTFIELDS, "name=daniel&project=curl");
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
   curl_global_cleanup();
-  return 0;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/http2-download.c b/third-party/curl/docs/examples/http2-download.c
index a2291a8c7f..3d612781bb 100644
--- a/third-party/curl/docs/examples/http2-download.c
+++ b/third-party/curl/docs/examples/http2-download.c
@@ -25,41 +25,41 @@
  * Multiplexed HTTP/2 downloads over a single connection
  * </DESC>
  */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for _snprintf(), fopen(), strerror() */
+#endif
+#endif
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
 
-/* somewhat unix-specific */
-#include <sys/time.h>
-#include <unistd.h>
-
-/* curl stuff */
 #include <curl/curl.h>
-#include <curl/mprintf.h>
 
 #ifndef CURLPIPE_MULTIPLEX
-/* This little trick will just make sure that we do not enable pipelining for
-   libcurls old enough to not have this symbol. It is _not_ defined to zero in
-   a recent libcurl header. */
-#define CURLPIPE_MULTIPLEX 0
+/* This little trick makes sure that we do not enable pipelining for libcurls
+   old enough to not have this symbol. It is _not_ defined to zero in a recent
+   libcurl header. */
+#define CURLPIPE_MULTIPLEX 0L
+#endif
+
+#if defined(_MSC_VER) && (_MSC_VER < 1900)
+#define snprintf _snprintf
 #endif
 
 struct transfer {
-  CURL *easy;
-  unsigned int num;
   FILE *out;
+  CURL *curl;
+  int num;
 };
 
-#define NUM_HANDLES 1000
-
-static
-void dump(const char *text, int num, unsigned char *ptr, size_t size,
-          char nohex)
+static void dump(const char *text, int num, const unsigned char *ptr,
+                 size_t size, char nohex)
 {
   size_t i;
   size_t c;
-
   unsigned int width = 0x10;
 
   if(nohex)
@@ -69,7 +69,7 @@ void dump(const char *text, int num, unsigned char *ptr, size_t size,
   fprintf(stderr, "%d %s, %lu bytes (0x%lx)\n",
           num, text, (unsigned long)size, (unsigned long)size);
 
-  for(i = 0; i<size; i += width) {
+  for(i = 0; i < size; i += width) {
 
     fprintf(stderr, "%4.4lx: ", (unsigned long)i);
 
@@ -90,8 +90,8 @@ void dump(const char *text, int num, unsigned char *ptr, size_t size,
         break;
       }
       fprintf(stderr, "%c",
-              (ptr[i + c] >= 0x20) && (ptr[i + c]<0x80)?ptr[i + c]:'.');
-      /* check again for 0D0A, to avoid an extra \n if it's at width */
+              (ptr[i + c] >= 0x20) && (ptr[i + c] < 0x80) ? ptr[i + c] : '.');
+      /* check again for 0D0A, to avoid an extra \n if it is at width */
       if(nohex && (i + c + 2 < size) && ptr[i + c + 1] == 0x0D &&
          ptr[i + c + 2] == 0x0A) {
         i += (c + 3 - width);
@@ -102,23 +102,18 @@ void dump(const char *text, int num, unsigned char *ptr, size_t size,
   }
 }
 
-static
-int my_trace(CURL *handle, curl_infotype type,
-             char *data, size_t size,
-             void *userp)
+static int my_trace(CURL *curl, curl_infotype type,
+                    char *data, size_t size, void *userp)
 {
   const char *text;
   struct transfer *t = (struct transfer *)userp;
-  unsigned int num = t->num;
-  (void)handle; /* prevent compiler warning */
+  int num = t->num;
+  (void)curl;
 
   switch(type) {
   case CURLINFO_TEXT:
-    fprintf(stderr, "== %u Info: %s", num, data);
-    /* FALLTHROUGH */
-  default: /* in case a new one is introduced to shock us */
+    fprintf(stderr, "== [%d] Info: %s", num, data);
     return 0;
-
   case CURLINFO_HEADER_OUT:
     text = "=> Send header";
     break;
@@ -137,99 +132,133 @@ int my_trace(CURL *handle, curl_infotype type,
   case CURLINFO_SSL_DATA_IN:
     text = "<= Recv SSL data";
     break;
+  default: /* in case a new one is introduced to shock us */
+    return 0;
   }
 
-  dump(text, num, (unsigned char *)data, size, 1);
+  dump(text, num, (const unsigned char *)data, size, 1);
   return 0;
 }
 
-static void setup(struct transfer *t, int num)
+static int setup(struct transfer *t, int num)
 {
   char filename[128];
-  CURL *hnd;
+  CURL *curl;
 
-  hnd = t->easy = curl_easy_init();
-
-  curl_msnprintf(filename, 128, "dl-%d", num);
+  curl = t->curl = NULL;
 
+  t->num = num;
+  snprintf(filename, sizeof(filename), "dl-%d", num);
   t->out = fopen(filename, "wb");
   if(!t->out) {
     fprintf(stderr, "error: could not open file %s for writing: %s\n",
             filename, strerror(errno));
-    exit(1);
+    return 1;
   }
 
-  /* write to this file */
-  curl_easy_setopt(hnd, CURLOPT_WRITEDATA, t->out);
+  curl = t->curl = curl_easy_init();
+  if(curl) {
 
-  /* set the same URL */
-  curl_easy_setopt(hnd, CURLOPT_URL, "https://localhost:8443/index.html");
+    /* write to this file */
+    curl_easy_setopt(curl, CURLOPT_WRITEDATA, t->out);
 
-  /* please be verbose */
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_DEBUGFUNCTION, my_trace);
-  curl_easy_setopt(hnd, CURLOPT_DEBUGDATA, t);
+    /* set the same URL */
+    curl_easy_setopt(curl, CURLOPT_URL, "https://localhost:8443/index.html");
 
-  /* enlarge the receive buffer for potentially higher transfer speeds */
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 100000L);
+    /* please be verbose */
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+    curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, my_trace);
+    curl_easy_setopt(curl, CURLOPT_DEBUGDATA, t);
 
-  /* HTTP/2 please */
-  curl_easy_setopt(hnd, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
+    /* enlarge the receive buffer for potentially higher transfer speeds */
+    curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 100000L);
 
-#if (CURLPIPE_MULTIPLEX > 0)
-  /* wait for pipe connection to confirm */
-  curl_easy_setopt(hnd, CURLOPT_PIPEWAIT, 1L);
+    /* HTTP/2 please */
+    curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
+
+#if CURLPIPE_MULTIPLEX > 0
+    /* wait for pipe connection to confirm */
+    curl_easy_setopt(curl, CURLOPT_PIPEWAIT, 1L);
 #endif
+  }
+  return 0;
 }
 
 /*
  * Download many transfers over HTTP/2, using the same connection!
  */
-int main(int argc, char **argv)
+int main(int argc, const char **argv)
 {
-  struct transfer trans[NUM_HANDLES];
-  CURLM *multi_handle;
+  CURLcode result;
+  struct transfer *trans;
+  CURLM *multi = NULL;
   int i;
   int still_running = 0; /* keep number of running handles */
   int num_transfers;
+
   if(argc > 1) {
     /* if given a number, do that many transfers */
     num_transfers = atoi(argv[1]);
-    if((num_transfers < 1) || (num_transfers > NUM_HANDLES))
+    if((num_transfers < 1) || (num_transfers > 1000))
       num_transfers = 3; /* a suitable low default */
   }
   else
-    num_transfers = 3; /* suitable default */
+    num_transfers = 3; /* a suitable low default */
 
-  /* init a multi stack */
-  multi_handle = curl_multi_init();
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  for(i = 0; i < num_transfers; i++) {
-    setup(&trans[i], i);
-
-    /* add the individual transfer */
-    curl_multi_add_handle(multi_handle, trans[i].easy);
+  trans = calloc(num_transfers, sizeof(*trans));
+  if(!trans) {
+    fprintf(stderr, "error allocating transfer structs\n");
+    goto error;
   }
 
-  curl_multi_setopt(multi_handle, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
+  /* init a multi stack */
+  multi = curl_multi_init();
+  if(!multi)
+    goto error;
+
+  for(i = 0; i < num_transfers; i++) {
+    if(setup(&trans[i], i)) {
+      goto error;
+    }
+
+    /* add the individual transfer */
+    curl_multi_add_handle(multi, trans[i].curl);
+  }
+
+  curl_multi_setopt(multi, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
 
   do {
-    CURLMcode mc = curl_multi_perform(multi_handle, &still_running);
+    CURLMcode mresult = curl_multi_perform(multi, &still_running);
 
     if(still_running)
       /* wait for activity, timeout or "nothing" */
-      mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL);
+      mresult = curl_multi_poll(multi, NULL, 0, 1000, NULL);
 
-    if(mc)
+    if(mresult)
       break;
+
   } while(still_running);
 
-  for(i = 0; i < num_transfers; i++) {
-    curl_multi_remove_handle(multi_handle, trans[i].easy);
-    curl_easy_cleanup(trans[i].easy);
+error:
+
+  if(multi) {
+    for(i = 0; i < num_transfers; i++) {
+      curl_multi_remove_handle(multi, trans[i].curl);
+      curl_easy_cleanup(trans[i].curl);
+
+      if(trans[i].out)
+        fclose(trans[i].out);
+    }
+    curl_multi_cleanup(multi);
   }
 
-  curl_multi_cleanup(multi_handle);
+  free(trans);
+
+  curl_global_cleanup();
 
   return 0;
 }
diff --git a/third-party/curl/docs/examples/http2-pushinmemory.c b/third-party/curl/docs/examples/http2-pushinmemory.c
index 74c64e0a69..09a8a8c671 100644
--- a/third-party/curl/docs/examples/http2-pushinmemory.c
+++ b/third-party/curl/docs/examples/http2-pushinmemory.c
@@ -29,11 +29,6 @@
 #include <stdlib.h>
 #include <string.h>
 
-/* somewhat unix-specific */
-#include <sys/time.h>
-#include <unistd.h>
-
-/* curl stuff */
 #include <curl/curl.h>
 
 struct Memory {
@@ -41,8 +36,7 @@ struct Memory {
   size_t size;
 };
 
-static size_t
-write_cb(void *contents, size_t size, size_t nmemb, void *userp)
+static size_t write_cb(char *contents, size_t size, size_t nmemb, void *userp)
 {
   size_t realsize = size * nmemb;
   struct Memory *mem = (struct Memory *)userp;
@@ -71,38 +65,38 @@ static void init_memory(struct Memory *chunk)
   chunk->size = 0;            /* no data at this point */
 }
 
-static void setup(CURL *hnd)
+static void setup(CURL *curl)
 {
   /* set the same URL */
-  curl_easy_setopt(hnd, CURLOPT_URL, "https://localhost:8443/index.html");
+  curl_easy_setopt(curl, CURLOPT_URL, "https://localhost:8443/index.html");
 
   /* HTTP/2 please */
-  curl_easy_setopt(hnd, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
+  curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
 
   /* we use a self-signed test server, skip verification during debugging */
-  curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYPEER, 0L);
-  curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYHOST, 0L);
+  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
 
-  /* write data to a struct  */
-  curl_easy_setopt(hnd, CURLOPT_WRITEFUNCTION, write_cb);
+  /* write data to a struct */
+  curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
   init_memory(&files[0]);
-  curl_easy_setopt(hnd, CURLOPT_WRITEDATA, &files[0]);
+  curl_easy_setopt(curl, CURLOPT_WRITEDATA, &files[0]);
 
   /* wait for pipe connection to confirm */
-  curl_easy_setopt(hnd, CURLOPT_PIPEWAIT, 1L);
+  curl_easy_setopt(curl, CURLOPT_PIPEWAIT, 1L);
 }
 
 /* called when there is an incoming push */
 static int server_push_callback(CURL *parent,
-                                CURL *easy,
+                                CURL *curl,
                                 size_t num_headers,
                                 struct curl_pushheaders *headers,
                                 void *userp)
 {
-  char *headp;
+  const char *headp;
   int *transfers = (int *)userp;
-  (void)parent; /* we have no use for this */
-  (void)num_headers; /* unused */
+  (void)parent;
+  (void)num_headers;
 
   if(pushindex == MAX_FILES)
     /* cannot fit anymore */
@@ -110,7 +104,7 @@ static int server_push_callback(CURL *parent,
 
   /* write to this buffer */
   init_memory(&files[pushindex]);
-  curl_easy_setopt(easy, CURLOPT_WRITEDATA, &files[pushindex]);
+  curl_easy_setopt(curl, CURLOPT_WRITEDATA, &files[pushindex]);
   pushindex++;
 
   headp = curl_pushheader_byname(headers, ":path");
@@ -121,45 +115,48 @@ static int server_push_callback(CURL *parent,
   return CURL_PUSH_OK;
 }
 
-
 /*
  * Download a file over HTTP/2, take care of server push.
  */
 int main(void)
 {
-  CURL *easy;
+  CURL *curl;
   CURLM *multi;
-  int still_running; /* keep number of running handles */
   int transfers = 1; /* we start with one */
   int i;
-  struct CURLMsg *m;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   /* init a multi stack */
   multi = curl_multi_init();
 
-  easy = curl_easy_init();
+  curl = curl_easy_init();
 
   /* set options */
-  setup(easy);
+  setup(curl);
 
   /* add the easy transfer */
-  curl_multi_add_handle(multi, easy);
+  curl_multi_add_handle(multi, curl);
 
   curl_multi_setopt(multi, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
   curl_multi_setopt(multi, CURLMOPT_PUSHFUNCTION, server_push_callback);
   curl_multi_setopt(multi, CURLMOPT_PUSHDATA, &transfers);
 
   while(transfers) {
+    struct CURLMsg *m;
+    int still_running; /* keep number of running handles */
     int rc;
-    CURLMcode mcode = curl_multi_perform(multi, &still_running);
-    if(mcode)
+
+    CURLMcode mresult = curl_multi_perform(multi, &still_running);
+    if(mresult)
       break;
 
-    mcode = curl_multi_wait(multi, NULL, 0, 1000, &rc);
-    if(mcode)
+    mresult = curl_multi_wait(multi, NULL, 0, 1000, &rc);
+    if(mresult)
       break;
 
-
     /*
      * When doing server push, libcurl itself created and added one or more
      * easy handles but *we* need to clean them up when they are done.
@@ -168,17 +165,16 @@ int main(void)
       int msgq = 0;
       m = curl_multi_info_read(multi, &msgq);
       if(m && (m->msg == CURLMSG_DONE)) {
-        CURL *e = m->easy_handle;
+        curl = m->easy_handle;
         transfers--;
-        curl_multi_remove_handle(multi, e);
-        curl_easy_cleanup(e);
+        curl_multi_remove_handle(multi, curl);
+        curl_easy_cleanup(curl);
       }
     } while(m);
-
   }
 
-
   curl_multi_cleanup(multi);
+  curl_global_cleanup();
 
   /* 'pushindex' is now the number of received transfers */
   for(i = 0; i < pushindex; i++) {
diff --git a/third-party/curl/docs/examples/http2-serverpush.c b/third-party/curl/docs/examples/http2-serverpush.c
index b5ebe2eb9a..e54675ceac 100644
--- a/third-party/curl/docs/examples/http2-serverpush.c
+++ b/third-party/curl/docs/examples/http2-serverpush.c
@@ -25,24 +25,30 @@
  * HTTP/2 server push
  * </DESC>
  */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for _snprintf(), fopen() */
+#endif
+#endif
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
-/* somewhat unix-specific */
-#include <sys/time.h>
-#include <unistd.h>
-
-/* curl stuff */
 #include <curl/curl.h>
 
 #ifndef CURLPIPE_MULTIPLEX
 #error "too old libcurl, cannot do HTTP/2 server push!"
 #endif
 
-static
-void dump(const char *text, unsigned char *ptr, size_t size,
-          char nohex)
+#if defined(_MSC_VER) && (_MSC_VER < 1900)
+#define snprintf _snprintf
+#endif
+
+static FILE *out_download;
+
+static void dump(const char *text, const unsigned char *ptr,
+                 size_t size, char nohex)
 {
   size_t i;
   size_t c;
@@ -56,7 +62,7 @@ void dump(const char *text, unsigned char *ptr, size_t size,
   fprintf(stderr, "%s, %lu bytes (0x%lx)\n",
           text, (unsigned long)size, (unsigned long)size);
 
-  for(i = 0; i<size; i += width) {
+  for(i = 0; i < size; i += width) {
 
     fprintf(stderr, "%4.4lx: ", (unsigned long)i);
 
@@ -77,8 +83,8 @@ void dump(const char *text, unsigned char *ptr, size_t size,
         break;
       }
       fprintf(stderr, "%c",
-              (ptr[i + c] >= 0x20) && (ptr[i + c]<0x80)?ptr[i + c]:'.');
-      /* check again for 0D0A, to avoid an extra \n if it's at width */
+              (ptr[i + c] >= 0x20) && (ptr[i + c] < 0x80) ? ptr[i + c] : '.');
+      /* check again for 0D0A, to avoid an extra \n if it is at width */
       if(nohex && (i + c + 2 < size) && ptr[i + c + 1] == 0x0D &&
          ptr[i + c + 2] == 0x0A) {
         i += (c + 3 - width);
@@ -89,21 +95,16 @@ void dump(const char *text, unsigned char *ptr, size_t size,
   }
 }
 
-static
-int my_trace(CURL *handle, curl_infotype type,
-             char *data, size_t size,
-             void *userp)
+static int my_trace(CURL *curl, curl_infotype type,
+                    char *data, size_t size, void *userp)
 {
   const char *text;
-  (void)handle; /* prevent compiler warning */
+  (void)curl;
   (void)userp;
   switch(type) {
   case CURLINFO_TEXT:
     fprintf(stderr, "== Info: %s", data);
-    /* FALLTHROUGH */
-  default: /* in case a new one is introduced to shock us */
     return 0;
-
   case CURLINFO_HEADER_OUT:
     text = "=> Send header";
     break;
@@ -122,78 +123,80 @@ int my_trace(CURL *handle, curl_infotype type,
   case CURLINFO_SSL_DATA_IN:
     text = "<= Recv SSL data";
     break;
+  default: /* in case a new one is introduced to shock us */
+    return 0;
   }
 
-  dump(text, (unsigned char *)data, size, 1);
+  dump(text, (const unsigned char *)data, size, 1);
   return 0;
 }
 
 #define OUTPUTFILE "dl"
 
-static int setup(CURL *hnd, const char *url)
+static int setup(CURL *curl, const char *url)
 {
-  FILE *out = fopen(OUTPUTFILE, "wb");
-  if(!out)
-    /* failed */
-    return 1;
-
-  /* write to this file */
-  curl_easy_setopt(hnd, CURLOPT_WRITEDATA, out);
+  out_download = fopen(OUTPUTFILE, "wb");
+  if(!out_download)
+    return 1; /* failed */
 
   /* set the same URL */
-  curl_easy_setopt(hnd, CURLOPT_URL, url);
-
-  /* please be verbose */
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_DEBUGFUNCTION, my_trace);
+  curl_easy_setopt(curl, CURLOPT_URL, url);
 
   /* HTTP/2 please */
-  curl_easy_setopt(hnd, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
+  curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
 
   /* we use a self-signed test server, skip verification during debugging */
-  curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYPEER, 0L);
-  curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYHOST, 0L);
+  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
 
-#if (CURLPIPE_MULTIPLEX > 0)
+  /* write to this file */
+  curl_easy_setopt(curl, CURLOPT_WRITEDATA, out_download);
+
+  /* please be verbose */
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, my_trace);
+
+#if CURLPIPE_MULTIPLEX > 0
   /* wait for pipe connection to confirm */
-  curl_easy_setopt(hnd, CURLOPT_PIPEWAIT, 1L);
+  curl_easy_setopt(curl, CURLOPT_PIPEWAIT, 1L);
 #endif
   return 0; /* all is good */
 }
 
+static FILE *out_push;
+
 /* called when there is an incoming push */
 static int server_push_callback(CURL *parent,
-                                CURL *easy,
+                                CURL *curl,
                                 size_t num_headers,
                                 struct curl_pushheaders *headers,
                                 void *userp)
 {
-  char *headp;
+  const char *headp;
   size_t i;
   int *transfers = (int *)userp;
   char filename[128];
-  FILE *out;
   static unsigned int count = 0;
 
-  (void)parent; /* we have no use for this */
+  (void)parent;
 
-  snprintf(filename, 128, "push%u", count++);
+  snprintf(filename, sizeof(filename), "push%u", count++);
 
   /* here's a new stream, save it in a new file for each new push */
-  out = fopen(filename, "wb");
-  if(!out) {
+  out_push = fopen(filename, "wb");
+  if(!out_push) {
     /* if we cannot save it, deny it */
     fprintf(stderr, "Failed to create output file for push\n");
     return CURL_PUSH_DENY;
   }
 
   /* write to this file */
-  curl_easy_setopt(easy, CURLOPT_WRITEDATA, out);
+  curl_easy_setopt(curl, CURLOPT_WRITEDATA, out_push);
 
   fprintf(stderr, "**** push callback approves stream %u, got %lu headers!\n",
           count, (unsigned long)num_headers);
 
-  for(i = 0; i<num_headers; i++) {
+  for(i = 0; i < num_headers; i++) {
     headp = curl_pushheader_bynum(headers, i);
     fprintf(stderr, "**** header %lu: %s\n", (unsigned long)i, headp);
   }
@@ -204,51 +207,58 @@ static int server_push_callback(CURL *parent,
   }
 
   (*transfers)++; /* one more */
+
   return CURL_PUSH_OK;
 }
 
-
 /*
  * Download a file over HTTP/2, take care of server push.
  */
-int main(int argc, char *argv[])
+int main(int argc, const char *argv[])
 {
-  CURL *easy;
-  CURLM *multi_handle;
+  CURLcode result;
+  CURL *curl;
+  CURLM *multi;
   int transfers = 1; /* we start with one */
-  struct CURLMsg *m;
   const char *url = "https://localhost:8443/index.html";
 
   if(argc == 2)
     url = argv[1];
 
-  /* init a multi stack */
-  multi_handle = curl_multi_init();
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  easy = curl_easy_init();
+  /* init a multi stack */
+  multi = curl_multi_init();
+  if(!multi)
+    goto error;
+
+  curl = curl_easy_init();
 
   /* set options */
-  if(setup(easy, url)) {
+  if(!curl || setup(curl, url)) {
     fprintf(stderr, "failed\n");
-    return 1;
+    goto error;
   }
 
-  /* add the easy transfer */
-  curl_multi_add_handle(multi_handle, easy);
+  curl_multi_setopt(multi, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
+  curl_multi_setopt(multi, CURLMOPT_PUSHFUNCTION, server_push_callback);
+  curl_multi_setopt(multi, CURLMOPT_PUSHDATA, &transfers);
 
-  curl_multi_setopt(multi_handle, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
-  curl_multi_setopt(multi_handle, CURLMOPT_PUSHFUNCTION, server_push_callback);
-  curl_multi_setopt(multi_handle, CURLMOPT_PUSHDATA, &transfers);
+  /* add the easy transfer */
+  curl_multi_add_handle(multi, curl);
 
   do {
+    struct CURLMsg *m;
     int still_running; /* keep number of running handles */
-    CURLMcode mc = curl_multi_perform(multi_handle, &still_running);
+    CURLMcode mresult = curl_multi_perform(multi, &still_running);
 
     if(still_running)
       /* wait for activity, timeout or "nothing" */
-      mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL);
+      mresult = curl_multi_poll(multi, NULL, 0, 1000, NULL);
 
-    if(mc)
+    if(mresult)
       break;
 
     /*
@@ -256,22 +266,29 @@ int main(int argc, char *argv[])
      * created and added one or more easy handles but we need to clean them up
      * when we are done.
      */
-
     do {
       int msgq = 0;
-      m = curl_multi_info_read(multi_handle, &msgq);
+      m = curl_multi_info_read(multi, &msgq);
       if(m && (m->msg == CURLMSG_DONE)) {
-        CURL *e = m->easy_handle;
+        curl = m->easy_handle;
         transfers--;
-        curl_multi_remove_handle(multi_handle, e);
-        curl_easy_cleanup(e);
+        curl_multi_remove_handle(multi, curl);
+        curl_easy_cleanup(curl);
       }
     } while(m);
 
   } while(transfers); /* as long as we have transfers going */
 
-  curl_multi_cleanup(multi_handle);
+error:
 
+  if(multi)
+    curl_multi_cleanup(multi);
+
+  curl_global_cleanup();
+
+  fclose(out_download);
+  if(out_push)
+    fclose(out_push);
 
   return 0;
 }
diff --git a/third-party/curl/docs/examples/http2-upload.c b/third-party/curl/docs/examples/http2-upload.c
index 5889d0c361..cad74afc50 100644
--- a/third-party/curl/docs/examples/http2-upload.c
+++ b/third-party/curl/docs/examples/http2-upload.c
@@ -25,6 +25,13 @@
  * Multiplexed HTTP/2 uploads over a single connection
  * </DESC>
  */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for _snprintf(), fopen(), localtime(),
+                                    strerror() */
+#endif
+#endif
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -32,33 +39,63 @@
 #include <sys/stat.h>
 #include <errno.h>
 
-/* somewhat unix-specific */
+/* somewhat Unix-specific */
+#ifndef _MSC_VER
 #include <sys/time.h>
 #include <unistd.h>
-
-/* curl stuff */
-#include <curl/curl.h>
-#include <curl/mprintf.h>
-
-#ifndef CURLPIPE_MULTIPLEX
-/* This little trick will just make sure that we do not enable pipelining for
-   libcurls old enough to not have this symbol. It is _not_ defined to zero in
-   a recent libcurl header. */
-#define CURLPIPE_MULTIPLEX 0
 #endif
 
-#define NUM_HANDLES 1000
+#include <curl/curl.h>
+
+#ifndef CURLPIPE_MULTIPLEX
+/* This little trick makes sure that we do not enable pipelining for libcurls
+   old enough to not have this symbol. It is _not_ defined to zero in a recent
+   libcurl header. */
+#define CURLPIPE_MULTIPLEX 0L
+#endif
+
+#ifdef _WIN32
+#undef stat
+#define stat _stati64
+#undef fstat
+#define fstat _fstati64
+#define fileno _fileno
+#endif
+
+#if defined(_MSC_VER) && (_MSC_VER < 1900)
+#define snprintf _snprintf
+#endif
+
+#ifdef _MSC_VER
+#define gettimeofday(a, b) my_gettimeofday(a, b)
+static int my_gettimeofday(struct timeval *tp, void *tzp)
+{
+  (void)tzp;
+  if(tp) {
+/* Offset between 1601-01-01 and 1970-01-01 in 100 nanosec units */
+#define WIN32_FT_OFFSET 116444736000000000
+    union {
+      CURL_TYPEOF_CURL_OFF_T ns100; /* time since 1 Jan 1601 in 100ns units */
+      FILETIME ft;
+    } _now;
+    GetSystemTimeAsFileTime(&_now.ft);
+    tp->tv_usec = (long)((_now.ns100 / 10) % 1000000);
+    tp->tv_sec = (long)((_now.ns100 - WIN32_FT_OFFSET) / 10000000);
+  }
+  return 0;
+}
+#endif
 
 struct input {
   FILE *in;
+  FILE *out;
   size_t bytes_read; /* count up */
-  CURL *hnd;
+  CURL *curl;
   int num;
 };
 
-static
-void dump(const char *text, int num, unsigned char *ptr, size_t size,
-          char nohex)
+static void dump(const char *text, int num, const unsigned char *ptr,
+                 size_t size, char nohex)
 {
   size_t i;
   size_t c;
@@ -71,7 +108,7 @@ void dump(const char *text, int num, unsigned char *ptr, size_t size,
   fprintf(stderr, "%d %s, %lu bytes (0x%lx)\n",
           num, text, (unsigned long)size, (unsigned long)size);
 
-  for(i = 0; i<size; i += width) {
+  for(i = 0; i < size; i += width) {
 
     fprintf(stderr, "%4.4lx: ", (unsigned long)i);
 
@@ -92,8 +129,8 @@ void dump(const char *text, int num, unsigned char *ptr, size_t size,
         break;
       }
       fprintf(stderr, "%c",
-              (ptr[i + c] >= 0x20) && (ptr[i + c]<0x80)?ptr[i + c]:'.');
-      /* check again for 0D0A, to avoid an extra \n if it's at width */
+              (ptr[i + c] >= 0x20) && (ptr[i + c] < 0x80) ? ptr[i + c] : '.');
+      /* check again for 0D0A, to avoid an extra \n if it is at width */
       if(nohex && (i + c + 2 < size) && ptr[i + c + 1] == 0x0D &&
          ptr[i + c + 2] == 0x0A) {
         i += (c + 3 - width);
@@ -104,10 +141,8 @@ void dump(const char *text, int num, unsigned char *ptr, size_t size,
   }
 }
 
-static
-int my_trace(CURL *handle, curl_infotype type,
-             char *data, size_t size,
-             void *userp)
+static int my_trace(CURL *curl, curl_infotype type,
+                    char *data, size_t size, void *userp)
 {
   char timebuf[60];
   const char *text;
@@ -118,7 +153,7 @@ int my_trace(CURL *handle, curl_infotype type,
   struct timeval tv;
   time_t secs;
   struct tm *now;
-  (void)handle; /* prevent compiler warning */
+  (void)curl;
 
   gettimeofday(&tv, NULL);
   if(!known_offset) {
@@ -126,17 +161,14 @@ int my_trace(CURL *handle, curl_infotype type,
     known_offset = 1;
   }
   secs = epoch_offset + tv.tv_sec;
-  now = localtime(&secs);  /* not thread safe but we do not care */
-  curl_msnprintf(timebuf, sizeof(timebuf), "%02d:%02d:%02d.%06ld",
-                 now->tm_hour, now->tm_min, now->tm_sec, (long)tv.tv_usec);
+  now = localtime(&secs);  /* not thread-safe but we do not care */
+  snprintf(timebuf, sizeof(timebuf), "%02d:%02d:%02d.%06ld",
+           now->tm_hour, now->tm_min, now->tm_sec, (long)tv.tv_usec);
 
   switch(type) {
   case CURLINFO_TEXT:
     fprintf(stderr, "%s [%d] Info: %s", timebuf, num, data);
-    /* FALLTHROUGH */
-  default: /* in case a new one is introduced to shock us */
     return 0;
-
   case CURLINFO_HEADER_OUT:
     text = "=> Send header";
     break;
@@ -155,13 +187,15 @@ int my_trace(CURL *handle, curl_infotype type,
   case CURLINFO_SSL_DATA_IN:
     text = "<= Recv SSL data";
     break;
+  default: /* in case a new one is introduced to shock us */
+    return 0;
   }
 
-  dump(text, num, (unsigned char *)data, size, 1);
+  dump(text, num, (const unsigned char *)data, size, 1);
   return 0;
 }
 
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
   struct input *i = userp;
   size_t retcode = fread(ptr, size, nmemb, i->in);
@@ -169,136 +203,171 @@ static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
   return retcode;
 }
 
-static void setup(struct input *i, int num, const char *upload)
+static int setup(struct input *t, int num, const char *upload)
 {
-  FILE *out;
-  char url[256];
+  char upload_url[256];
   char filename[128];
   struct stat file_info;
   curl_off_t uploadsize;
-  CURL *hnd;
+  CURL *curl;
 
-  hnd = i->hnd = curl_easy_init();
-  i->num = num;
-  curl_msnprintf(filename, 128, "dl-%d", num);
-  out = fopen(filename, "wb");
-  if(!out) {
+  curl = t->curl = NULL;
+
+  t->num = num;
+  snprintf(filename, sizeof(filename), "dl-%d", num);
+  t->out = fopen(filename, "wb");
+  if(!t->out) {
     fprintf(stderr, "error: could not open file %s for writing: %s\n", upload,
             strerror(errno));
-    exit(1);
+    return 1;
   }
 
-  curl_msnprintf(url, 256, "https://localhost:8443/upload-%d", num);
+  snprintf(upload_url, sizeof(upload_url), "https://localhost:8443/upload-%d",
+           num);
 
-  /* get the file size of the local file */
-  if(stat(upload, &file_info)) {
+  t->in = fopen(upload, "rb");
+  if(!t->in) {
+    fprintf(stderr, "error: could not open file %s for reading: %s\n", upload,
+            strerror(errno));
+    fclose(t->out);
+    t->out = NULL;
+    return 1;
+  }
+
+  if(fstat(fileno(t->in), &file_info)) {
     fprintf(stderr, "error: could not stat file %s: %s\n", upload,
             strerror(errno));
-    exit(1);
+    fclose(t->out);
+    t->out = NULL;
+    return 1;
   }
 
   uploadsize = file_info.st_size;
 
-  i->in = fopen(upload, "rb");
-  if(!i->in) {
-    fprintf(stderr, "error: could not open file %s for reading: %s\n", upload,
-            strerror(errno));
-    exit(1);
-  }
+  curl = t->curl = curl_easy_init();
+  if(curl) {
 
-  /* write to this file */
-  curl_easy_setopt(hnd, CURLOPT_WRITEDATA, out);
+    /* write to this file */
+    curl_easy_setopt(curl, CURLOPT_WRITEDATA, t->out);
 
-  /* we want to use our own read function */
-  curl_easy_setopt(hnd, CURLOPT_READFUNCTION, read_callback);
-  /* read from this file */
-  curl_easy_setopt(hnd, CURLOPT_READDATA, i);
-  /* provide the size of the upload */
-  curl_easy_setopt(hnd, CURLOPT_INFILESIZE_LARGE, uploadsize);
+    /* we want to use our own read function */
+    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
+    /* read from this file */
+    curl_easy_setopt(curl, CURLOPT_READDATA, t);
+    /* provide the size of the upload */
+    curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, uploadsize);
 
-  /* send in the URL to store the upload as */
-  curl_easy_setopt(hnd, CURLOPT_URL, url);
+    /* send in the URL to store the upload as */
+    curl_easy_setopt(curl, CURLOPT_URL, upload_url);
 
-  /* upload please */
-  curl_easy_setopt(hnd, CURLOPT_UPLOAD, 1L);
+    /* upload please */
+    curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
 
-  /* please be verbose */
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_DEBUGFUNCTION, my_trace);
-  curl_easy_setopt(hnd, CURLOPT_DEBUGDATA, i);
+    /* please be verbose */
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+    curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, my_trace);
+    curl_easy_setopt(curl, CURLOPT_DEBUGDATA, t);
 
-  /* HTTP/2 please */
-  curl_easy_setopt(hnd, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
+    /* HTTP/2 please */
+    curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
 
-  /* we use a self-signed test server, skip verification during debugging */
-  curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYPEER, 0L);
-  curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYHOST, 0L);
+    /* we use a self-signed test server, skip verification during debugging */
+    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
 
-#if (CURLPIPE_MULTIPLEX > 0)
-  /* wait for pipe connection to confirm */
-  curl_easy_setopt(hnd, CURLOPT_PIPEWAIT, 1L);
+#if CURLPIPE_MULTIPLEX > 0
+    /* wait for pipe connection to confirm */
+    curl_easy_setopt(curl, CURLOPT_PIPEWAIT, 1L);
 #endif
+  }
+  return 0;
 }
 
 /*
  * Upload all files over HTTP/2, using the same physical connection!
  */
-int main(int argc, char **argv)
+int main(int argc, const char **argv)
 {
-  struct input trans[NUM_HANDLES];
-  CURLM *multi_handle;
+  CURLcode result;
+  struct input *trans;
+  CURLM *multi = NULL;
   int i;
-  int still_running = 0; /* keep number of running handles */
   const char *filename = "index.html";
+  int still_running = 0; /* keep number of running handles */
   int num_transfers;
 
   if(argc > 1) {
     /* if given a number, do that many transfers */
     num_transfers = atoi(argv[1]);
-
-    if(!num_transfers || (num_transfers > NUM_HANDLES))
-      num_transfers = 3; /* a suitable low default */
+    if((num_transfers < 1) || (num_transfers > 1000))
+      num_transfers = 3;  /* a suitable low default */
 
     if(argc > 2)
-      /* if given a file name, upload this! */
+      /* if given a filename, upload this! */
       filename = argv[2];
   }
   else
-    num_transfers = 3;
+    num_transfers = 3;  /* a suitable low default */
 
-  /* init a multi stack */
-  multi_handle = curl_multi_init();
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  for(i = 0; i<num_transfers; i++) {
-    setup(&trans[i], i, filename);
-
-    /* add the individual transfer */
-    curl_multi_add_handle(multi_handle, trans[i].hnd);
+  trans = calloc(num_transfers, sizeof(*trans));
+  if(!trans) {
+    fprintf(stderr, "error allocating transfer structs\n");
+    goto error;
   }
 
-  curl_multi_setopt(multi_handle, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
+  /* init a multi stack */
+  multi = curl_multi_init();
+  if(!multi)
+    goto error;
+
+  for(i = 0; i < num_transfers; i++) {
+    if(setup(&trans[i], i, filename)) {
+      goto error;
+    }
+
+    /* add the individual transfer */
+    curl_multi_add_handle(multi, trans[i].curl);
+  }
+
+  curl_multi_setopt(multi, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
 
   /* We do HTTP/2 so let's stick to one connection per host */
-  curl_multi_setopt(multi_handle, CURLMOPT_MAX_HOST_CONNECTIONS, 1L);
+  curl_multi_setopt(multi, CURLMOPT_MAX_HOST_CONNECTIONS, 1L);
 
   do {
-    CURLMcode mc = curl_multi_perform(multi_handle, &still_running);
+    CURLMcode mresult = curl_multi_perform(multi, &still_running);
 
     if(still_running)
       /* wait for activity, timeout or "nothing" */
-      mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL);
+      mresult = curl_multi_poll(multi, NULL, 0, 1000, NULL);
 
-    if(mc)
+    if(mresult)
       break;
 
   } while(still_running);
 
-  curl_multi_cleanup(multi_handle);
+error:
 
-  for(i = 0; i<num_transfers; i++) {
-    curl_multi_remove_handle(multi_handle, trans[i].hnd);
-    curl_easy_cleanup(trans[i].hnd);
+  if(multi) {
+    for(i = 0; i < num_transfers; i++) {
+      curl_multi_remove_handle(multi, trans[i].curl);
+      curl_easy_cleanup(trans[i].curl);
+
+      if(trans[i].in)
+        fclose(trans[i].in);
+      if(trans[i].out)
+        fclose(trans[i].out);
+    }
+    curl_multi_cleanup(multi);
   }
 
+  free(trans);
+
+  curl_global_cleanup();
+
   return 0;
 }
diff --git a/third-party/curl/docs/examples/http3-present.c b/third-party/curl/docs/examples/http3-present.c
index 56ba0f5724..5de7d870f4 100644
--- a/third-party/curl/docs/examples/http3-present.c
+++ b/third-party/curl/docs/examples/http3-present.c
@@ -26,13 +26,16 @@
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 int main(void)
 {
   curl_version_info_data *ver;
 
-  curl_global_init(CURL_GLOBAL_ALL);
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   ver = curl_version_info(CURLVERSION_NOW);
   if(ver->features & CURL_VERSION_HTTP2)
diff --git a/third-party/curl/docs/examples/http3.c b/third-party/curl/docs/examples/http3.c
index 900e119208..7b52e43a9a 100644
--- a/third-party/curl/docs/examples/http3.c
+++ b/third-party/curl/docs/examples/http3.c
@@ -22,34 +22,38 @@
  *
  ***************************************************************************/
 /* <DESC>
- * Very simple HTTP/3 GET
+ * Simple HTTP/3 GET
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
     curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
 
     /* Use HTTP/3 but fallback to earlier HTTP if necessary */
-    curl_easy_setopt(curl, CURLOPT_HTTP_VERSION,
-                     (long)CURL_HTTP_VERSION_3);
+    curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_3);
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
+  curl_global_cleanup();
   return 0;
 }
diff --git a/third-party/curl/docs/examples/httpcustomheader.c b/third-party/curl/docs/examples/httpcustomheader.c
index a3881674c1..1d500b2352 100644
--- a/third-party/curl/docs/examples/httpcustomheader.c
+++ b/third-party/curl/docs/examples/httpcustomheader.c
@@ -26,12 +26,16 @@
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -56,11 +60,11 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_URL, "localhost");
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
@@ -68,5 +72,6 @@ int main(void)
     /* free the custom headers */
     curl_slist_free_all(chunk);
   }
-  return 0;
+  curl_global_cleanup();
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/httpput-postfields.c b/third-party/curl/docs/examples/httpput-postfields.c
index 98d7c3d742..602190d9f6 100644
--- a/third-party/curl/docs/examples/httpput-postfields.c
+++ b/third-party/curl/docs/examples/httpput-postfields.c
@@ -27,39 +27,41 @@
  */
 #include <stdio.h>
 #include <fcntl.h>
-#include <sys/stat.h>
+
 #include <curl/curl.h>
 
-static const char olivertwist[]=
+static const char olivertwist[] =
   "Among other public buildings in a certain town, which for many reasons "
-  "it will be prudent to refrain from mentioning, and to which I will assign "
+  "it is prudent to refrain from mentioning, and to which I assign "
   "no fictitious name, there is one anciently common to most towns, great or "
-  "small: to wit, a workhouse; and in this workhouse was born; on a day and "
+  "small: to ___, a workhouse; and in this workhouse was born; on a day and "
   "date which I need not trouble myself to repeat, inasmuch as it can be of "
   "no possible consequence to the reader, in this stage of the business at "
   "all events; the item of mortality whose name is prefixed";
 
 /* ... to the head of this chapter. String cut off to stick within the C90
-   509 byte limit. */
+   509-byte limit. */
 
 /*
  * This example shows an HTTP PUT operation that sends a fixed buffer with
  * CURLOPT_POSTFIELDS to the URL given as an argument.
  */
 
-int main(int argc, char **argv)
+int main(int argc, const char **argv)
 {
   CURL *curl;
-  CURLcode res;
-  char *url;
+  CURLcode result;
+  const char *url;
 
   if(argc < 2)
     return 1;
 
   url = argv[1];
 
-  /* In windows, this will init the winsock stuff */
-  curl_global_init(CURL_GLOBAL_ALL);
+  /* In Windows, this inits the Winsock stuff */
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   /* get a curl handle */
   curl = curl_easy_init();
@@ -87,11 +89,11 @@ int main(int argc, char **argv)
     curl_easy_setopt(curl, CURLOPT_URL, url);
 
     /* Now run off and do what you have been told! */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
@@ -101,5 +103,5 @@ int main(int argc, char **argv)
   }
 
   curl_global_cleanup();
-  return 0;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/httpput.c b/third-party/curl/docs/examples/httpput.c
index b9a6c87b74..fb33c8ac40 100644
--- a/third-party/curl/docs/examples/httpput.c
+++ b/third-party/curl/docs/examples/httpput.c
@@ -25,11 +25,26 @@
  * HTTP PUT with easy interface and read callback
  * </DESC>
  */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for fopen() */
+#endif
+#endif
+
 #include <stdio.h>
 #include <fcntl.h>
 #include <sys/stat.h>
+
 #include <curl/curl.h>
 
+#ifdef _WIN32
+#undef stat
+#define stat _stati64
+#undef fstat
+#define fstat _fstati64
+#define fileno _fileno
+#endif
+
 /*
  * This example shows an HTTP PUT operation. PUTs a file given as a command
  * line argument to the URL also given on the command line.
@@ -40,7 +55,7 @@
  * http://www.apacheweek.com/features/put
  */
 
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *stream)
+static size_t read_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
   size_t retcode;
   unsigned long nread;
@@ -58,15 +73,15 @@ static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *stream)
   return retcode;
 }
 
-int main(int argc, char **argv)
+int main(int argc, const char **argv)
 {
   CURL *curl;
-  CURLcode res;
-  FILE * hd_src;
+  CURLcode result;
+  FILE *hd_src;
   struct stat file_info;
 
-  char *file;
-  char *url;
+  const char *file;
+  const char *url;
 
   if(argc < 3)
     return 1;
@@ -74,22 +89,30 @@ int main(int argc, char **argv)
   file = argv[1];
   url = argv[2];
 
-  /* get the file size of the local file */
-  stat(file, &file_info);
-
-  /* get a FILE * of the same file, could also be made with
-     fdopen() from the previous descriptor, but hey this is just
-     an example! */
+  /* get a FILE * of the same file, could also be made with fdopen() from the
+     previous descriptor, but hey this is an example! */
   hd_src = fopen(file, "rb");
+  if(!hd_src)
+    return 2;
 
-  /* In windows, this will init the winsock stuff */
-  curl_global_init(CURL_GLOBAL_ALL);
+  /* get the file size of the local file */
+  if(fstat(fileno(hd_src), &file_info)) {
+    fclose(hd_src);
+    return 1; /* cannot continue */
+  }
+
+  /* In Windows, this inits the Winsock stuff */
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK) {
+    fclose(hd_src);
+    return (int)result;
+  }
 
   /* get a curl handle */
   curl = curl_easy_init();
   if(curl) {
     /* we want to use our own read function */
-    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_callback);
+    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
 
     /* enable uploading (implies PUT over HTTP) */
     curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
@@ -107,11 +130,11 @@ int main(int argc, char **argv)
                      (curl_off_t)file_info.st_size);
 
     /* Now run off and do what you have been told! */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
@@ -119,5 +142,5 @@ int main(int argc, char **argv)
   fclose(hd_src); /* close the local file */
 
   curl_global_cleanup();
-  return 0;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/https.c b/third-party/curl/docs/examples/https.c
index 2a34e37d83..5fefb5eea3 100644
--- a/third-party/curl/docs/examples/https.c
+++ b/third-party/curl/docs/examples/https.c
@@ -26,14 +26,16 @@
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
 
-  curl_global_init(CURL_GLOBAL_DEFAULT);
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -55,10 +57,10 @@ int main(void)
 
 #ifdef SKIP_HOSTNAME_VERIFICATION
     /*
-     * If the site you are connecting to uses a different host name that what
+     * If the site you are connecting to uses a different hostname than what
      * they have mentioned in their server certificate's commonName (or
-     * subjectAltName) fields, libcurl will refuse to connect. You can skip
-     * this check, but this will make the connection less secure.
+     * subjectAltName) fields, libcurl refuses to connect. You can skip this
+     * check, but it makes the connection insecure.
      */
     curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
 #endif
@@ -66,12 +68,12 @@ int main(void)
     /* cache the CA cert bundle in memory for a week */
     curl_easy_setopt(curl, CURLOPT_CA_CACHE_TIMEOUT, 604800L);
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
@@ -79,5 +81,5 @@ int main(void)
 
   curl_global_cleanup();
 
-  return 0;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/imap-append.c b/third-party/curl/docs/examples/imap-append.c
index 33566bb643..77cf2bc02a 100644
--- a/third-party/curl/docs/examples/imap-append.c
+++ b/third-party/curl/docs/examples/imap-append.c
@@ -21,14 +21,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Send email with IMAP
  * </DESC>
  */
-
 #include <stdio.h>
 #include <string.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to send mail using libcurl's IMAP
@@ -37,9 +36,9 @@
  * Note that this example requires libcurl 7.30.0 or above.
  */
 
-#define FROM    "<sender@example.org>"
-#define TO      "<addressee@example.net>"
-#define CC      "<info@example.org>"
+#define FROM "<sender@example.org>"
+#define TO   "<addressee@example.net>"
+#define CC   "<info@example.org>"
 
 static const char *payload_text =
   "Date: Mon, 29 Nov 2010 21:54:29 +1100\r\n"
@@ -59,13 +58,13 @@ struct upload_status {
   size_t bytes_read;
 };
 
-static size_t payload_source(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
   struct upload_status *upload_ctx = (struct upload_status *)userp;
   const char *data;
   size_t room = size * nmemb;
 
-  if((size == 0) || (nmemb == 0) || ((size*nmemb) < 1)) {
+  if((size == 0) || (nmemb == 0) || ((size * nmemb) < 1)) {
     return 0;
   }
 
@@ -75,7 +74,7 @@ static size_t payload_source(char *ptr, size_t size, size_t nmemb, void *userp)
     size_t len = strlen(data);
     if(room < len)
       len = room;
-    memcpy(ptr, data, len);
+    memcpy(ptr, data, len); /* NOLINT(bugprone-not-null-terminated-result) */
     upload_ctx->bytes_read += len;
 
     return len;
@@ -87,7 +86,10 @@ static size_t payload_source(char *ptr, size_t size, size_t nmemb, void *userp)
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -99,13 +101,13 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-    /* This will create a new message in folder "Sent". */
+    /* This creates a new message in folder "Sent". */
     curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com/Sent");
 
     /* In this case, we are using a callback function to specify the data. You
-     * could just use the CURLOPT_READDATA option to specify a FILE pointer to
-     * read from. */
-    curl_easy_setopt(curl, CURLOPT_READFUNCTION, payload_source);
+     * could use the CURLOPT_READDATA option to specify a FILE pointer to read
+     * from. */
+    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
     curl_easy_setopt(curl, CURLOPT_READDATA, &upload_ctx);
     curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
 
@@ -115,16 +117,18 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_INFILESIZE, infilesize);
 
     /* Perform the append */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/imap-authzid.c b/third-party/curl/docs/examples/imap-authzid.c
index af07320645..0130d4cf19 100644
--- a/third-party/curl/docs/examples/imap-authzid.c
+++ b/third-party/curl/docs/examples/imap-authzid.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Retrieve emails from a shared IMAP mailbox
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to fetch mail using libcurl's IMAP
@@ -39,7 +38,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -53,21 +55,23 @@ int main(void)
     /* Force PLAIN authentication */
     curl_easy_setopt(curl, CURLOPT_LOGIN_OPTIONS, "AUTH=PLAIN");
 
-    /* This will fetch message 1 from the user's inbox */
+    /* This fetches message 1 from the user's inbox */
     curl_easy_setopt(curl, CURLOPT_URL,
                      "imap://imap.example.com/INBOX/;UID=1");
 
     /* Perform the fetch */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/imap-copy.c b/third-party/curl/docs/examples/imap-copy.c
index 0920f09443..e19d4b480d 100644
--- a/third-party/curl/docs/examples/imap-copy.c
+++ b/third-party/curl/docs/examples/imap-copy.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Copy an email from one IMAP folder to another
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to copy a mail from one mailbox folder
@@ -39,7 +38,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -53,21 +55,23 @@ int main(void)
     /* Set the COPY command specifying the message ID and destination folder */
     curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "COPY 1 FOLDER");
 
-    /* Note that to perform a move operation you will need to perform the copy,
+    /* Note that to perform a move operation you need to perform the copy,
      * then mark the original mail as Deleted and EXPUNGE or CLOSE. Please see
      * imap-store.c for more information on deleting messages. */
 
     /* Perform the custom request */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/imap-create.c b/third-party/curl/docs/examples/imap-create.c
index 6a9b565345..0572171152 100644
--- a/third-party/curl/docs/examples/imap-create.c
+++ b/third-party/curl/docs/examples/imap-create.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Create a new IMAP folder
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to create a new mailbox folder using
@@ -39,7 +38,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -47,23 +49,25 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-    /* This is just the server URL */
+    /* This is the server URL */
     curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com");
 
     /* Set the CREATE command specifying the new folder name */
     curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "CREATE FOLDER");
 
     /* Perform the custom request */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/imap-delete.c b/third-party/curl/docs/examples/imap-delete.c
index e43ab2e982..16b7d53941 100644
--- a/third-party/curl/docs/examples/imap-delete.c
+++ b/third-party/curl/docs/examples/imap-delete.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Delete an IMAP folder
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to delete an existing mailbox folder
@@ -39,7 +38,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -47,23 +49,25 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-    /* This is just the server URL */
+    /* This is the server URL */
     curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com");
 
     /* Set the DELETE command specifying the existing folder */
     curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "DELETE FOLDER");
 
     /* Perform the custom request */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/imap-examine.c b/third-party/curl/docs/examples/imap-examine.c
index 34217bfa42..91903192b4 100644
--- a/third-party/curl/docs/examples/imap-examine.c
+++ b/third-party/curl/docs/examples/imap-examine.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Obtain information about an IMAP folder
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to obtain information about a mailbox
@@ -39,7 +38,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -47,23 +49,25 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-    /* This is just the server URL */
+    /* This is the server URL */
     curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com");
 
     /* Set the EXAMINE command specifying the mailbox folder */
     curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "EXAMINE OUTBOX");
 
     /* Perform the custom request */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/imap-fetch.c b/third-party/curl/docs/examples/imap-fetch.c
index 3361d7cfe5..c3d6af75c2 100644
--- a/third-party/curl/docs/examples/imap-fetch.c
+++ b/third-party/curl/docs/examples/imap-fetch.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Retrieve IMAP emails
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to fetch mail using libcurl's IMAP
@@ -39,7 +38,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -47,21 +49,23 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-    /* This will fetch message 1 from the user's inbox */
+    /* This fetches message 1 from the user's inbox */
     curl_easy_setopt(curl, CURLOPT_URL,
                      "imap://imap.example.com/INBOX/;UID=1");
 
     /* Perform the fetch */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/imap-list.c b/third-party/curl/docs/examples/imap-list.c
index 2f3780f2d0..1c1074f85b 100644
--- a/third-party/curl/docs/examples/imap-list.c
+++ b/third-party/curl/docs/examples/imap-list.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * List the folders within an IMAP mailbox
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to list the folders within an IMAP
@@ -39,7 +38,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -47,22 +49,24 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-    /* This will list the folders within the user's mailbox. If you want to
-     * list the folders within a specific folder, for example the inbox, then
+    /* This lists the folders within the user's mailbox. If you want to list
+     * the folders within a specific folder, for example the inbox, then
      * specify the folder as a path in the URL such as /INBOX */
     curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com");
 
     /* Perform the list */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/imap-lsub.c b/third-party/curl/docs/examples/imap-lsub.c
index cf45a5fc2d..123d9d35c5 100644
--- a/third-party/curl/docs/examples/imap-lsub.c
+++ b/third-party/curl/docs/examples/imap-lsub.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * List the subscribed IMAP folders
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to list the subscribed folders within
@@ -39,7 +38,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -47,7 +49,7 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-    /* This is just the server URL */
+    /* This is the server URL */
     curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com");
 
     /* Set the LSUB command. Note the syntax is similar to that of a LIST
@@ -55,16 +57,18 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "LSUB \"\" *");
 
     /* Perform the custom request */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/imap-multi.c b/third-party/curl/docs/examples/imap-multi.c
index 6a5f4b070f..192ba15cfd 100644
--- a/third-party/curl/docs/examples/imap-multi.c
+++ b/third-party/curl/docs/examples/imap-multi.c
@@ -21,14 +21,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Get IMAP email with the multi interface
  * </DESC>
  */
-
 #include <stdio.h>
 #include <string.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to fetch mail using libcurl's IMAP
@@ -39,44 +38,48 @@
 int main(void)
 {
   CURL *curl;
-  CURLM *mcurl;
-  int still_running = 1;
 
-  curl_global_init(CURL_GLOBAL_DEFAULT);
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
-  if(!curl)
-    return 1;
+  if(curl) {
+    CURLM *multi;
 
-  mcurl = curl_multi_init();
-  if(!mcurl)
-    return 2;
+    multi = curl_multi_init();
+    if(multi) {
+      int still_running = 1;
 
-  /* Set username and password */
-  curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
-  curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
+      /* Set username and password */
+      curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
+      curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-  /* This will fetch message 1 from the user's inbox */
-  curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com/INBOX/;UID=1");
+      /* This fetches message 1 from the user's inbox */
+      curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com/"
+                       "INBOX/;UID=1");
 
-  /* Tell the multi stack about our easy handle */
-  curl_multi_add_handle(mcurl, curl);
+      /* Tell the multi stack about our easy handle */
+      curl_multi_add_handle(multi, curl);
 
-  do {
-    CURLMcode mc = curl_multi_perform(mcurl, &still_running);
+      do {
+        CURLMcode mresult = curl_multi_perform(multi, &still_running);
 
-    if(still_running)
-      /* wait for activity, timeout or "nothing" */
-      mc = curl_multi_poll(mcurl, NULL, 0, 1000, NULL);
+        if(still_running)
+          /* wait for activity, timeout or "nothing" */
+          mresult = curl_multi_poll(multi, NULL, 0, 1000, NULL);
 
-    if(mc)
-      break;
-  } while(still_running);
+        if(mresult)
+          break;
+      } while(still_running);
+
+      /* Always cleanup */
+      curl_multi_remove_handle(multi, curl);
+      curl_multi_cleanup(multi);
+    }
+    curl_easy_cleanup(curl);
+  }
 
-  /* Always cleanup */
-  curl_multi_remove_handle(mcurl, curl);
-  curl_multi_cleanup(mcurl);
-  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
   return 0;
diff --git a/third-party/curl/docs/examples/imap-noop.c b/third-party/curl/docs/examples/imap-noop.c
index 9e5a3da2d5..5d8153e931 100644
--- a/third-party/curl/docs/examples/imap-noop.c
+++ b/third-party/curl/docs/examples/imap-noop.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Perform an IMAP noop
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to perform a noop using libcurl's IMAP
@@ -39,7 +38,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -47,23 +49,25 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-    /* This is just the server URL */
+    /* This is the server URL */
     curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com");
 
     /* Set the NOOP command */
     curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "NOOP");
 
     /* Perform the custom request */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/imap-search.c b/third-party/curl/docs/examples/imap-search.c
index 141b06f649..ae944bb9ec 100644
--- a/third-party/curl/docs/examples/imap-search.c
+++ b/third-party/curl/docs/examples/imap-search.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Search for new IMAP emails
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to search for new messages using
@@ -39,7 +38,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -54,20 +56,22 @@ int main(void)
      * this can contain a message sequence set and a number of search criteria
      * keywords including flags such as ANSWERED, DELETED, DRAFT, FLAGGED, NEW,
      * RECENT and SEEN. For more information about the search criteria please
-     * see RFC-3501 section 6.4.4.   */
+     * see RFC-3501 section 6.4.4. */
     curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "SEARCH NEW");
 
     /* Perform the custom request */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/imap-ssl.c b/third-party/curl/docs/examples/imap-ssl.c
index e920720c01..77a0880a32 100644
--- a/third-party/curl/docs/examples/imap-ssl.c
+++ b/third-party/curl/docs/examples/imap-ssl.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * IMAP with implicit SSL
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to fetch mail using libcurl's IMAP
@@ -40,7 +39,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -48,8 +50,8 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-    /* This will fetch message 1 from the user's inbox. Note the use of
-    * imaps:// rather than imap:// to request a SSL based connection. */
+    /* This fetches message 1 from the user's inbox. Note the use of
+     * imaps:// rather than imap:// to request an SSL based connection. */
     curl_easy_setopt(curl, CURLOPT_URL,
                      "imaps://imap.example.com/INBOX/;UID=1");
 
@@ -65,30 +67,32 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
 #endif
 
-    /* If the site you are connecting to uses a different host name that what
+    /* If the site you are connecting to uses a different hostname than what
      * they have mentioned in their server certificate's commonName (or
-     * subjectAltName) fields, libcurl will refuse to connect. You can skip
-     * this check, but this will make the connection less secure. */
+     * subjectAltName) fields, libcurl refuses to connect. You can skip this
+     * check, but it makes the connection insecure. */
 #ifdef SKIP_HOSTNAME_VERIFICATION
     curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
 #endif
 
-    /* Since the traffic will be encrypted, it is useful to turn on debug
+    /* Since the traffic is encrypted, it is useful to turn on debug
      * information within libcurl to see what is happening during the
      * transfer */
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
     /* Perform the fetch */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/imap-store.c b/third-party/curl/docs/examples/imap-store.c
index d04a6072cc..c1e9de9a91 100644
--- a/third-party/curl/docs/examples/imap-store.c
+++ b/third-party/curl/docs/examples/imap-store.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Modify the properties of an email over IMAP
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to modify an existing mail using
@@ -39,7 +38,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -56,29 +58,31 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "STORE 1 +Flags \\Deleted");
 
     /* Perform the custom request */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
     else {
       /* Set the EXPUNGE command, although you can use the CLOSE command if you
        * do not want to know the result of the STORE */
       curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "EXPUNGE");
 
       /* Perform the second custom request */
-      res = curl_easy_perform(curl);
+      result = curl_easy_perform(curl);
 
       /* Check for errors */
-      if(res != CURLE_OK)
+      if(result != CURLE_OK)
         fprintf(stderr, "curl_easy_perform() failed: %s\n",
-                curl_easy_strerror(res));
+                curl_easy_strerror(result));
     }
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/imap-tls.c b/third-party/curl/docs/examples/imap-tls.c
index d98f5ef9f9..486bc8c467 100644
--- a/third-party/curl/docs/examples/imap-tls.c
+++ b/third-party/curl/docs/examples/imap-tls.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * IMAP using TLS
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to fetch mail using libcurl's IMAP
@@ -40,7 +39,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -48,16 +50,16 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-    /* This will fetch message 1 from the user's inbox */
+    /* This fetches message 1 from the user's inbox */
     curl_easy_setopt(curl, CURLOPT_URL,
                      "imap://imap.example.com/INBOX/;UID=1");
 
-    /* In this example, we will start with a plain text connection, and upgrade
-     * to Transport Layer Security (TLS) using the STARTTLS command. Be careful
-     * of using CURLUSESSL_TRY here, because if TLS upgrade fails, the transfer
-     * will continue anyway - see the security discussion in the libcurl
+    /* In this example, we start with a plain text connection, and upgrade to
+     * Transport Layer Security (TLS) using the STARTTLS command. Be careful
+     * of using CURLUSESSL_TRY here, because if TLS upgrade fails, the
+     * transfer continues anyway - see the security discussion in the libcurl
      * tutorial for more details. */
-    curl_easy_setopt(curl, CURLOPT_USE_SSL, (long)CURLUSESSL_ALL);
+    curl_easy_setopt(curl, CURLOPT_USE_SSL, CURLUSESSL_ALL);
 
     /* If your server does not have a valid certificate, then you can disable
      * part of the Transport Layer Security protection by setting the
@@ -73,22 +75,24 @@ int main(void)
      * for more information. */
     curl_easy_setopt(curl, CURLOPT_CAINFO, "/path/to/certificate.pem");
 
-    /* Since the traffic will be encrypted, it is useful to turn on debug
+    /* Since the traffic is encrypted, it is useful to turn on debug
      * information within libcurl to see what is happening during the
      * transfer */
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
     /* Perform the fetch */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/interface.c b/third-party/curl/docs/examples/interface.c
new file mode 100644
index 0000000000..870f94057a
--- /dev/null
+++ b/third-party/curl/docs/examples/interface.c
@@ -0,0 +1,58 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/* <DESC>
+ * Use CURLOPT_INTERFACE to bind the outgoing socket to an interface
+ * </DESC>
+ */
+#include <stdio.h>
+
+#include <curl/curl.h>
+
+int main(void)
+{
+  CURL *curl;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
+  curl = curl_easy_init();
+  if(curl) {
+    /* The interface needs to be a local existing interface over which you can
+       connect to the host in the URL. It can also specify an IP address, but
+       that address needs to be assigned one of the local network
+       interfaces. */
+    curl_easy_setopt(curl, CURLOPT_INTERFACE, "enp3s0");
+    curl_easy_setopt(curl, CURLOPT_URL, "https://curl.se/");
+
+    result = curl_easy_perform(curl);
+
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+
+  curl_global_cleanup();
+
+  return (int)result;
+}
diff --git a/third-party/curl/docs/examples/ipv6.c b/third-party/curl/docs/examples/ipv6.c
index 49a44fa7ab..607d9d4096 100644
--- a/third-party/curl/docs/examples/ipv6.c
+++ b/third-party/curl/docs/examples/ipv6.c
@@ -22,41 +22,33 @@
  *
  ***************************************************************************/
 /* <DESC>
- * HTTP GET to an IPv6 address with specific scope
+ * HTTPS GET using IPv6 only
  * </DESC>
  */
 #include <stdio.h>
-#include <curl/curl.h>
 
-#ifndef WIN32
-#include <net/if.h>
-#endif
+#include <curl/curl.h>
 
 int main(void)
 {
-#ifndef WIN32
-  /* Windows users need to find how to use if_nametoindex() */
   CURL *curl;
-  CURLcode res;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
-    long my_scope_id;
-    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V6);
 
-    my_scope_id = if_nametoindex("eth0");
-    curl_easy_setopt(curl, CURLOPT_ADDRESS_SCOPE, my_scope_id);
+    curl_easy_setopt(curl, CURLOPT_URL, "https://curl.se/");
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
-    /* Check for errors */
-    if(res != CURLE_OK)
-      fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+    result = curl_easy_perform(curl);
 
-    /* always cleanup */
     curl_easy_cleanup(curl);
   }
-#endif
-  return 0;
+
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/keepalive.c b/third-party/curl/docs/examples/keepalive.c
new file mode 100644
index 0000000000..f6aa692897
--- /dev/null
+++ b/third-party/curl/docs/examples/keepalive.c
@@ -0,0 +1,64 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/* <DESC>
+ * Use the TCP keep-alive options
+ * </DESC>
+ */
+#include <stdio.h>
+
+#include <curl/curl.h>
+
+int main(void)
+{
+  CURL *curl;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
+  curl = curl_easy_init();
+  if(curl) {
+    /* enable TCP keep-alive for this transfer */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+
+    /* keep-alive idle time to 120 seconds */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPIDLE, 120L);
+
+    /* interval time between keep-alive probes: 60 seconds */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPINTVL, 60L);
+
+    /* maximum number of keep-alive probes: 3 */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPCNT, 3L);
+
+    curl_easy_setopt(curl, CURLOPT_URL, "https://curl.se/");
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+
+  curl_global_cleanup();
+
+  return (int)result;
+}
diff --git a/third-party/curl/docs/examples/localport.c b/third-party/curl/docs/examples/localport.c
new file mode 100644
index 0000000000..1027c4387f
--- /dev/null
+++ b/third-party/curl/docs/examples/localport.c
@@ -0,0 +1,59 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/* <DESC>
+ * Use CURLOPT_LOCALPORT to control local port number
+ * </DESC>
+ */
+#include <stdio.h>
+
+#include <curl/curl.h>
+
+int main(void)
+{
+  CURL *curl;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
+  curl = curl_easy_init();
+  if(curl) {
+    /* Try to use a local port number between 20000-20009 */
+    curl_easy_setopt(curl, CURLOPT_LOCALPORT, 20000L);
+    /* 10 means number of attempts, which starts with the number set in
+       CURLOPT_LOCALPORT. The lower value set, the smaller the chance it
+       works. */
+    curl_easy_setopt(curl, CURLOPT_LOCALPORTRANGE, 10L);
+    curl_easy_setopt(curl, CURLOPT_URL, "https://curl.se/");
+
+    result = curl_easy_perform(curl);
+
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+
+  curl_global_cleanup();
+
+  return (int)result;
+}
diff --git a/third-party/curl/docs/examples/log_failed_transfers.c b/third-party/curl/docs/examples/log_failed_transfers.c
new file mode 100644
index 0000000000..564735e30d
--- /dev/null
+++ b/third-party/curl/docs/examples/log_failed_transfers.c
@@ -0,0 +1,337 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/* <DESC>
+ * Save failed transfer verbose log to disk
+ * </DESC>
+ */
+/*
+ *
+ * This example demonstrates per-transfer verbose logging to memory.
+ * The transfer's log is written to disk only if the transfer fails.
+ *
+ */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for fopen(), strerror(), vsnprintf() */
+#endif
+#endif
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <limits.h>
+#include <string.h>
+
+#include <curl/curl.h>
+
+#ifdef _WIN32
+#include <windows.h>
+#define unlink _unlink
+#else
+#include <strings.h>
+#include <unistd.h>
+#endif
+
+struct mem {
+  /* 'buf' points to memory contents that is always null-terminated so that it
+     can be treated like a string if appropriate. 'recent' points to the most
+     recent data written to 'buf'. */
+  char *buf, *recent;
+  /* 'len' and 'allocsize' are the length and allocated size of 'buf' */
+  size_t len, allocsize;
+};
+
+struct transfer {
+  const char *url, *bodyfile, *logfile;
+  struct mem log;
+  FILE *bodyfp;
+  CURL *curl;
+};
+
+static void mem_reset(struct mem *mem)
+{
+  free(mem->buf);
+  mem->buf = NULL;
+  mem->recent = NULL;
+  mem->len = 0;
+  mem->allocsize = 0;
+}
+
+/* expand free buffer space to needed size. return -1 or 'needed'. */
+static int mem_need(struct mem *mem, size_t needed)
+{
+  char *newbuf;
+  size_t newsize;
+
+  if(needed > (unsigned)INT_MAX)
+    return -1;
+
+  if(needed <= (mem->allocsize - mem->len))
+    return (int)needed;
+
+  /* min 4k makes reallocations much less frequent when lengths are small */
+  newsize = needed < 4096 ? 4096 : needed;
+
+  newsize += mem->len;
+
+  if(newsize < mem->len || newsize > (unsigned)INT_MAX)
+    return -1;
+
+  newbuf = realloc(mem->buf, newsize);
+
+  if(!newbuf)
+    return -1;
+
+  if(mem->recent && mem->buf != newbuf)
+    mem->recent = newbuf + (mem->recent - mem->buf);
+
+  mem->buf = newbuf;
+  mem->allocsize = newsize;
+
+  return (int)needed;
+}
+
+static int mem_addn(struct mem *mem, const char *buf, size_t len)
+{
+  if(len + 1 < len || mem_need(mem, len + 1) < 0)
+    return -1;
+  mem->recent = mem->buf + mem->len;
+  memcpy(mem->recent, buf, len);
+  mem->len += len;
+  mem->buf[mem->len] = '\0';
+  return (int)len;
+}
+
+static int mem_add(struct mem *mem, const char *str)
+{
+  return mem_addn(mem, str, strlen(str));
+}
+
+#if defined(__GNUC__) || defined(__clang__)
+__attribute__((format(printf, 2, 3)))
+#endif
+static int mem_addf(struct mem *mem, const char *format, ...)
+{
+  int i, x;
+  va_list va;
+
+  /* we need about 100 chars or less to write 95% of lines */
+  x = 128;
+
+  /* first try: there is probably enough memory to write everything.
+     second try: there is definitely enough memory to write everything. */
+  for(i = 0; i < 2; ++i) {
+    if(x < 0 || mem_need(mem, (size_t)x + 1) < 0)
+      break;
+
+    va_start(va, format);
+    x = vsnprintf(mem->buf + mem->len, mem->allocsize - mem->len, format, va);
+    va_end(va);
+
+    if(x >= 0 && (size_t)x < (mem->allocsize - mem->len)) {
+      mem->recent = mem->buf + mem->len;
+      mem->len += (size_t)x;
+      return x;
+    }
+
+#ifdef _WIN32
+    /* Not all versions of Windows CRT vsnprintf are compliant with C99. Some
+       return -1 if buffer too small. Try _vscprintf to get the needed size. */
+    if(!i && x < 0) {
+      va_start(va, format);
+      x = _vscprintf(format, va);
+      va_end(va);
+    }
+#endif
+  }
+
+  if(mem->buf)
+    mem->buf[mem->len] = '\0';
+  return -1;
+}
+
+static int mydebug(CURL *curl, curl_infotype type,
+                   char *data, size_t size, void *userdata)
+{
+  struct transfer *t = (struct transfer *)userdata;
+  static const char s_infotype[CURLINFO_END][3] = {
+    "* ", "< ", "> ", "{ ", "} ", "{ ", "} " };
+
+  (void)curl;
+
+  switch(type) {
+  case CURLINFO_TEXT:
+  case CURLINFO_HEADER_OUT:
+  case CURLINFO_HEADER_IN:
+    /* mem_addn is faster than passing large data as %s to mem_addf */
+    mem_addn(&t->log, s_infotype[type], 2);
+    mem_addn(&t->log, data, size);
+    if(!size || data[size - 1] != '\n')
+      mem_add(&t->log, "\n");
+    break;
+  default:
+    break;
+  }
+
+  return 0;
+}
+
+static size_t write_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
+{
+  struct transfer *t = (struct transfer *)userdata;
+
+  return fwrite(ptr, size, nmemb, t->bodyfp);
+}
+
+int main(void)
+{
+  CURLcode result;
+  unsigned i;
+  int total_failed = 0;
+  char errbuf[CURL_ERROR_SIZE] = { 0, };
+  struct transfer transfer[2];
+
+  memset(transfer, 0, sizeof(transfer));
+
+  transfer[0].url = "https://httpbin.org/get";
+  transfer[0].bodyfile = "200.txt";
+  transfer[0].logfile = "200_transfer_log.txt";
+
+  transfer[1].url = "https://httpbin.org/status/400";
+  transfer[1].bodyfile = "400.txt";
+  transfer[1].logfile = "400_transfer_log.txt";
+
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK) {
+    fprintf(stderr, "curl_global_init failed\n");
+    return (int)result;
+  }
+
+  /* You could enable global tracing for extra verbosity when verbosity is
+     enabled for a transfer. */
+#if 0
+  curl_global_trace("all");
+#endif
+
+  for(i = 0; i < sizeof(transfer) / sizeof(transfer[0]); ++i) {
+    int failed = 0;
+    struct transfer *t = &transfer[i];
+
+    t->curl = curl_easy_init();
+
+    if(!t->curl) {
+      fprintf(stderr, "curl_easy_init failed\n");
+      curl_global_cleanup();
+      return 1;
+    }
+
+    curl_easy_setopt(t->curl, CURLOPT_URL, t->url);
+
+    /* Enable following redirects */
+    curl_easy_setopt(t->curl, CURLOPT_FOLLOWLOCATION, 1L);
+
+    /* Enable verbose logging to memory */
+    curl_easy_setopt(t->curl, CURLOPT_VERBOSE, 1L);
+    curl_easy_setopt(t->curl, CURLOPT_DEBUGFUNCTION, mydebug);
+    curl_easy_setopt(t->curl, CURLOPT_DEBUGDATA, t);
+
+    /* Enable writing the body to a file */
+    curl_easy_setopt(t->curl, CURLOPT_WRITEFUNCTION, write_cb);
+    curl_easy_setopt(t->curl, CURLOPT_WRITEDATA, t);
+
+    /* Enable immediate error on HTTP status codes >= 400 in most cases,
+       instead of downloading the body to a file */
+    curl_easy_setopt(t->curl, CURLOPT_FAILONERROR, 1L);
+
+    /* Enable detailed error messages */
+    curl_easy_setopt(t->curl, CURLOPT_ERRORBUFFER, errbuf);
+
+    mem_addf(&t->log, "Downloading %s to file %s\n", t->url, t->bodyfile);
+    printf("%s", t->log.recent);
+
+    /* Create the body file */
+    t->bodyfp = fopen(t->bodyfile, "wb");
+
+    if(t->bodyfp) {
+      /* Perform the transfer */
+      result = curl_easy_perform(t->curl);
+
+      /* Save the body file */
+      fclose(t->bodyfp);
+      t->bodyfp = NULL;
+
+      if(result == CURLE_OK) {
+        /* You could retrieve more information about the transfer here via
+           curl_easy_getinfo and mark the transfer as failed if needed. */
+        mem_addf(&t->log, "Transfer successful.\n");
+        fprintf(stderr, "%s", t->log.recent);
+        failed = 0;
+      }
+      else {
+        mem_addf(&t->log, "Transfer failed: (%d) %s\n", (int)result,
+                 (errbuf[0] ? errbuf : curl_easy_strerror(result)));
+        fprintf(stderr, "%s", t->log.recent);
+        failed = 1;
+      }
+    }
+    else {
+      mem_addf(&t->log, "Failed to create body output file %s: %s\n",
+               t->bodyfile, strerror(errno));
+      fprintf(stderr, "%s", t->log.recent);
+      failed = 1;
+    }
+
+    if(failed) {
+      FILE *fp = fopen(t->logfile, "wb");
+
+      if(fp && t->log.len == fwrite(t->log.buf, 1, t->log.len, fp))
+        fprintf(stderr, "Transfer log written to %s\n", t->logfile);
+      else {
+        fprintf(stderr, "Failed to write transfer log to %s: %s\n",
+                t->logfile, strerror(errno));
+      }
+
+      if(fp)
+        fclose(fp);
+
+      /* Depending on how the transfer failed a body file may or may not have
+         been written, and you may or may not want it. */
+      unlink(t->bodyfile);
+
+      ++total_failed;
+    }
+
+    mem_reset(&t->log);
+
+    curl_easy_cleanup(t->curl);
+
+    t->curl = NULL;
+
+    printf("\n");
+  }
+
+  curl_global_cleanup();
+
+  return total_failed ? 1 : 0;
+}
diff --git a/third-party/curl/docs/examples/maxconnects.c b/third-party/curl/docs/examples/maxconnects.c
index 84fefd7bc8..7ef29828ea 100644
--- a/third-party/curl/docs/examples/maxconnects.c
+++ b/third-party/curl/docs/examples/maxconnects.c
@@ -26,23 +26,28 @@
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
-    const char *urls[] = { "https://example.com",
-      "https://curl.se",
+    const char *urls[] = {
+      "https://example.com/",
+      "https://curl.se/",
       "https://www.example/",
       NULL /* end of list */
     };
     int i = 0;
 
-    /* Change the maximum number of persistent connection   */
+    /* Change the maximum number of persistent connection */
     curl_easy_setopt(curl, CURLOPT_MAXCONNECTS, 1L);
 
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
@@ -51,16 +56,19 @@ int main(void)
     while(urls[i]) {
       curl_easy_setopt(curl, CURLOPT_URL, urls[i]);
 
-      /* Perform the request, res will get the return code */
-      res = curl_easy_perform(curl);
+      /* Perform the request, result gets the return code */
+      result = curl_easy_perform(curl);
       /* Check for errors */
-      if(res != CURLE_OK)
+      if(result != CURLE_OK)
         fprintf(stderr, "curl_easy_perform() failed: %s\n",
-                curl_easy_strerror(res));
+                curl_easy_strerror(result));
       i++;
     }
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
+
+  curl_global_cleanup();
+
   return 0;
 }
diff --git a/third-party/curl/docs/examples/multi-app.c b/third-party/curl/docs/examples/multi-app.c
index 3dbc46483e..56509736e8 100644
--- a/third-party/curl/docs/examples/multi-app.c
+++ b/third-party/curl/docs/examples/multi-app.c
@@ -26,93 +26,102 @@
  * transfers in parallel.
  * </DESC>
  */
-
 #include <stdio.h>
 #include <string.h>
 
-/* somewhat unix-specific */
-#include <sys/time.h>
-#include <unistd.h>
-
-/* curl stuff */
 #include <curl/curl.h>
 
 /*
  * Download an HTTP file and upload an FTP file simultaneously.
  */
 
-#define HANDLECOUNT 2   /* Number of simultaneous transfers */
 #define HTTP_HANDLE 0   /* Index for the HTTP transfer */
-#define FTP_HANDLE 1    /* Index for the FTP transfer */
+#define FTP_HANDLE  1   /* Index for the FTP transfer */
+#define HANDLECOUNT 2   /* Number of simultaneous transfers */
 
 int main(void)
 {
-  CURL *handles[HANDLECOUNT];
-  CURLM *multi_handle;
+  CURL *curl[HANDLECOUNT];
+  CURLM *multi;
 
-  int still_running = 1; /* keep number of running handles */
   int i;
 
-  CURLMsg *msg; /* for picking up messages with the transfer status */
-  int msgs_left; /* how many messages are left */
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  /* Allocate one CURL handle per transfer */
-  for(i = 0; i<HANDLECOUNT; i++)
-    handles[i] = curl_easy_init();
+  /* Allocate one curl handle per transfer */
+  for(i = 0; i < HANDLECOUNT; i++)
+    curl[i] = curl_easy_init();
 
-  /* set the options (I left out a few, you will get the point anyway) */
-  curl_easy_setopt(handles[HTTP_HANDLE], CURLOPT_URL, "https://example.com");
+  /* set the options (I left out a few, you get the point anyway) */
+  curl_easy_setopt(curl[HTTP_HANDLE], CURLOPT_URL, "https://example.com");
 
-  curl_easy_setopt(handles[FTP_HANDLE], CURLOPT_URL, "ftp://example.com");
-  curl_easy_setopt(handles[FTP_HANDLE], CURLOPT_UPLOAD, 1L);
+  curl_easy_setopt(curl[FTP_HANDLE], CURLOPT_URL, "ftp://example.com");
+  curl_easy_setopt(curl[FTP_HANDLE], CURLOPT_UPLOAD, 1L);
 
   /* init a multi stack */
-  multi_handle = curl_multi_init();
+  multi = curl_multi_init();
+  if(multi) {
 
-  /* add the individual transfers */
-  for(i = 0; i<HANDLECOUNT; i++)
-    curl_multi_add_handle(multi_handle, handles[i]);
+    int still_running = 1; /* keep number of running handles */
 
-  while(still_running) {
-    CURLMcode mc = curl_multi_perform(multi_handle, &still_running);
+    CURLMsg *msg;  /* for picking up messages with the transfer status */
+    int msgs_left; /* how many messages are left */
 
-    if(still_running)
-      /* wait for activity, timeout or "nothing" */
-      mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL);
+    /* add the individual transfers */
+    for(i = 0; i < HANDLECOUNT; i++)
+      curl_multi_add_handle(multi, curl[i]);
 
-    if(mc)
-      break;
-  }
-  /* See how the transfers went */
-  while((msg = curl_multi_info_read(multi_handle, &msgs_left))) {
-    if(msg->msg == CURLMSG_DONE) {
-      int idx;
+    while(still_running) {
+      CURLMcode mresult = curl_multi_perform(multi, &still_running);
 
-      /* Find out which handle this message is about */
-      for(idx = 0; idx<HANDLECOUNT; idx++) {
-        int found = (msg->easy_handle == handles[idx]);
-        if(found)
+      if(still_running)
+        /* wait for activity, timeout or "nothing" */
+        mresult = curl_multi_poll(multi, NULL, 0, 1000, NULL);
+
+      if(mresult)
+        break;
+    }
+
+    /* See how the transfers went */
+    /* !checksrc! disable EQUALSNULL 1 */
+    while((msg = curl_multi_info_read(multi, &msgs_left)) != NULL) {
+      if(msg->msg == CURLMSG_DONE) {
+        int idx;
+
+        /* Find out which handle this message is about */
+        for(idx = 0; idx < HANDLECOUNT; idx++) {
+          int found = (msg->easy_handle == curl[idx]);
+          if(found)
+            break;
+        }
+
+        switch(idx) {
+        case HTTP_HANDLE:
+          printf("HTTP transfer completed with status %d\n",
+                 (int)msg->data.result);
           break;
-      }
-
-      switch(idx) {
-      case HTTP_HANDLE:
-        printf("HTTP transfer completed with status %d\n", msg->data.result);
-        break;
-      case FTP_HANDLE:
-        printf("FTP transfer completed with status %d\n", msg->data.result);
-        break;
+        case FTP_HANDLE:
+          printf("FTP transfer completed with status %d\n",
+                 (int)msg->data.result);
+          break;
+        }
       }
     }
+
+    /* remove the transfers */
+    for(i = 0; i < HANDLECOUNT; i++)
+      curl_multi_remove_handle(multi, curl[i]);
+
+    curl_multi_cleanup(multi);
   }
 
-  /* remove the transfers and cleanup the handles */
-  for(i = 0; i<HANDLECOUNT; i++) {
-    curl_multi_remove_handle(multi_handle, handles[i]);
-    curl_easy_cleanup(handles[i]);
-  }
+  /* Free the curl handles */
+  for(i = 0; i < HANDLECOUNT; i++)
+    curl_easy_cleanup(curl[i]);
 
-  curl_multi_cleanup(multi_handle);
+  curl_global_cleanup();
 
   return 0;
 }
diff --git a/third-party/curl/docs/examples/multi-debugcallback.c b/third-party/curl/docs/examples/multi-debugcallback.c
index 8bdb58800f..0885486ea9 100644
--- a/third-party/curl/docs/examples/multi-debugcallback.c
+++ b/third-party/curl/docs/examples/multi-debugcallback.c
@@ -25,20 +25,12 @@
  * multi interface and debug callback
  * </DESC>
  */
-
 #include <stdio.h>
 #include <string.h>
 
-/* somewhat unix-specific */
-#include <sys/time.h>
-#include <unistd.h>
-
-/* curl stuff */
 #include <curl/curl.h>
 
-#define TRUE 1
-
-static void dump(const char *text, FILE *stream, unsigned char *ptr,
+static void dump(const char *text, const unsigned char *ptr,
                  size_t size, char nohex)
 {
   size_t i;
@@ -50,20 +42,20 @@ static void dump(const char *text, FILE *stream, unsigned char *ptr,
     /* without the hex output, we can fit more on screen */
     width = 0x40;
 
-  fprintf(stream, "%s, %10.10lu bytes (0x%8.8lx)\n",
+  fprintf(stderr, "%s, %lu bytes (0x%lx)\n",
           text, (unsigned long)size, (unsigned long)size);
 
-  for(i = 0; i<size; i += width) {
+  for(i = 0; i < size; i += width) {
 
-    fprintf(stream, "%4.4lx: ", (unsigned long)i);
+    fprintf(stderr, "%4.4lx: ", (unsigned long)i);
 
     if(!nohex) {
       /* hex not disabled, show it */
       for(c = 0; c < width; c++)
         if(i + c < size)
-          fprintf(stream, "%02x ", ptr[i + c]);
+          fprintf(stderr, "%02x ", ptr[i + c]);
         else
-          fputs("   ", stream);
+          fputs("   ", stderr);
     }
 
     for(c = 0; (c < width) && (i + c < size); c++) {
@@ -73,37 +65,31 @@ static void dump(const char *text, FILE *stream, unsigned char *ptr,
         i += (c + 2 - width);
         break;
       }
-      fprintf(stream, "%c",
-              (ptr[i + c] >= 0x20) && (ptr[i + c]<0x80)?ptr[i + c]:'.');
-      /* check again for 0D0A, to avoid an extra \n if it's at width */
+      fprintf(stderr, "%c",
+              (ptr[i + c] >= 0x20) && (ptr[i + c] < 0x80) ? ptr[i + c] : '.');
+      /* check again for 0D0A, to avoid an extra \n if it is at width */
       if(nohex && (i + c + 2 < size) && ptr[i + c + 1] == 0x0D &&
          ptr[i + c + 2] == 0x0A) {
         i += (c + 3 - width);
         break;
       }
     }
-    fputc('\n', stream); /* newline */
+    fputc('\n', stderr); /* newline */
   }
-  fflush(stream);
 }
 
-static
-int my_trace(CURL *handle, curl_infotype type,
-             unsigned char *data, size_t size,
-             void *userp)
+static int my_trace(CURL *curl, curl_infotype type,
+                    char *data, size_t size, void *userp)
 {
   const char *text;
 
   (void)userp;
-  (void)handle; /* prevent compiler warning */
+  (void)curl;
 
   switch(type) {
   case CURLINFO_TEXT:
     fprintf(stderr, "== Info: %s", data);
-    /* FALLTHROUGH */
-  default: /* in case a new one is introduced to shock us */
     return 0;
-
   case CURLINFO_HEADER_OUT:
     text = "=> Send header";
     break;
@@ -116,51 +102,64 @@ int my_trace(CURL *handle, curl_infotype type,
   case CURLINFO_DATA_IN:
     text = "<= Recv data";
     break;
+  default: /* in case a new one is introduced to shock us */
+    return 0;
   }
 
-  dump(text, stderr, data, size, TRUE);
+  dump(text, (const unsigned char *)data, size, 1);
   return 0;
 }
 
 /*
- * Simply download an HTTP file.
+ * Download an HTTP file.
  */
 int main(void)
 {
-  CURL *http_handle;
-  CURLM *multi_handle;
+  CURL *curl;
 
-  int still_running = 0; /* keep number of running handles */
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  http_handle = curl_easy_init();
+  curl = curl_easy_init();
+  if(curl) {
 
-  /* set the options (I left out a few, you will get the point anyway) */
-  curl_easy_setopt(http_handle, CURLOPT_URL, "https://www.example.com/");
+    CURLM *multi;
 
-  curl_easy_setopt(http_handle, CURLOPT_DEBUGFUNCTION, my_trace);
-  curl_easy_setopt(http_handle, CURLOPT_VERBOSE, 1L);
+    /* set the options (I left out a few, you get the point anyway) */
+    curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");
 
-  /* init a multi stack */
-  multi_handle = curl_multi_init();
+    curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, my_trace);
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  /* add the individual transfers */
-  curl_multi_add_handle(multi_handle, http_handle);
+    /* init a multi stack */
+    multi = curl_multi_init();
+    if(multi) {
 
-  do {
-    CURLMcode mc = curl_multi_perform(multi_handle, &still_running);
+      int still_running = 0; /* keep number of running handles */
 
-    if(still_running)
-      /* wait for activity, timeout or "nothing" */
-      mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL);
+      /* add the individual transfers */
+      curl_multi_add_handle(multi, curl);
 
-    if(mc)
-      break;
+      do {
+        CURLMcode mresult = curl_multi_perform(multi, &still_running);
 
-  } while(still_running);
+        if(still_running)
+          /* wait for activity, timeout or "nothing" */
+          mresult = curl_multi_poll(multi, NULL, 0, 1000, NULL);
 
-  curl_multi_cleanup(multi_handle);
+        if(mresult)
+          break;
 
-  curl_easy_cleanup(http_handle);
+      } while(still_running);
+
+      curl_multi_cleanup(multi);
+    }
+
+    curl_easy_cleanup(curl);
+  }
+
+  curl_global_cleanup();
 
   return 0;
 }
diff --git a/third-party/curl/docs/examples/multi-double.c b/third-party/curl/docs/examples/multi-double.c
index 62295a92cf..987f1c0568 100644
--- a/third-party/curl/docs/examples/multi-double.c
+++ b/third-party/curl/docs/examples/multi-double.c
@@ -28,70 +28,78 @@
 #include <stdio.h>
 #include <string.h>
 
-/* somewhat unix-specific */
-#include <sys/time.h>
-#include <unistd.h>
-
-/* curl stuff */
 #include <curl/curl.h>
 
 /*
- * Simply download two HTTP files!
+ * Download two HTTP files!
  */
 int main(void)
 {
-  CURL *http_handle;
-  CURL *http_handle2;
-  CURLM *multi_handle;
+  CURL *curl;
+  CURL *curl2;
 
-  int still_running = 1; /* keep number of running handles */
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  http_handle = curl_easy_init();
-  http_handle2 = curl_easy_init();
+  curl = curl_easy_init();
+  curl2 = curl_easy_init();
 
-  /* set options */
-  curl_easy_setopt(http_handle, CURLOPT_URL, "https://www.example.com/");
+  if(curl && curl2) {
 
-  /* set options */
-  curl_easy_setopt(http_handle2, CURLOPT_URL, "http://localhost/");
+    CURLM *multi;
 
-  /* init a multi stack */
-  multi_handle = curl_multi_init();
+    /* set options */
+    curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");
 
-  /* add the individual transfers */
-  curl_multi_add_handle(multi_handle, http_handle);
-  curl_multi_add_handle(multi_handle, http_handle2);
+    /* set options */
+    curl_easy_setopt(curl2, CURLOPT_URL, "http://localhost/");
 
-  while(still_running) {
-    CURLMsg *msg;
-    int queued;
-    CURLMcode mc = curl_multi_perform(multi_handle, &still_running);
+    /* init a multi stack */
+    multi = curl_multi_init();
+    if(multi) {
 
-    if(still_running)
-      /* wait for activity, timeout or "nothing" */
-      mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL);
+      int still_running = 1; /* keep number of running handles */
 
-    if(mc)
-      break;
+      /* add the individual transfers */
+      curl_multi_add_handle(multi, curl);
+      curl_multi_add_handle(multi, curl2);
 
-    do {
-      msg = curl_multi_info_read(multi_handle, &queued);
-      if(msg) {
-        if(msg->msg == CURLMSG_DONE) {
-          /* a transfer ended */
-          fprintf(stderr, "Transfer completed\n");
-        }
+      while(still_running) {
+        CURLMsg *msg;
+        int queued;
+
+        CURLMcode mresult = curl_multi_perform(multi, &still_running);
+
+        if(still_running)
+          /* wait for activity, timeout or "nothing" */
+          mresult = curl_multi_poll(multi, NULL, 0, 1000, NULL);
+
+        if(mresult)
+          break;
+
+        do {
+          msg = curl_multi_info_read(multi, &queued);
+          if(msg) {
+            if(msg->msg == CURLMSG_DONE) {
+              /* a transfer ended */
+              fprintf(stderr, "Transfer completed\n");
+            }
+          }
+        } while(msg);
       }
-    } while(msg);
+
+      curl_multi_remove_handle(multi, curl);
+      curl_multi_remove_handle(multi, curl2);
+
+      curl_multi_cleanup(multi);
+    }
   }
 
-  curl_multi_remove_handle(multi_handle, http_handle);
-  curl_multi_remove_handle(multi_handle, http_handle2);
+  curl_easy_cleanup(curl);
+  curl_easy_cleanup(curl2);
 
-  curl_multi_cleanup(multi_handle);
-
-  curl_easy_cleanup(http_handle);
-  curl_easy_cleanup(http_handle2);
+  curl_global_cleanup();
 
   return 0;
 }
diff --git a/third-party/curl/docs/examples/multi-event.c b/third-party/curl/docs/examples/multi-event.c
index 5a24bb2037..58744b6e2e 100644
--- a/third-party/curl/docs/examples/multi-event.c
+++ b/third-party/curl/docs/examples/multi-event.c
@@ -21,94 +21,50 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * multi_socket API using libevent
  * </DESC>
  */
-
 #include <stdio.h>
 #include <stdlib.h>
+
 #include <event2/event.h>
+
 #include <curl/curl.h>
 
-struct event_base *base;
-CURLM *curl_handle;
-struct event *timeout;
+static struct event_base *base;
+static CURLM *multi;
+static struct event *timeout;
 
-typedef struct curl_context_s {
+struct curl_context {
   struct event *event;
   curl_socket_t sockfd;
-} curl_context_t;
-
-static void curl_perform(int fd, short event, void *arg);
-
-static curl_context_t *create_curl_context(curl_socket_t sockfd)
-{
-  curl_context_t *context;
-
-  context = (curl_context_t *) malloc(sizeof(*context));
-
-  context->sockfd = sockfd;
-
-  context->event = event_new(base, sockfd, 0, curl_perform, context);
-
-  return context;
-}
-
-static void destroy_curl_context(curl_context_t *context)
-{
-  event_del(context->event);
-  event_free(context->event);
-  free(context);
-}
-
-static void add_download(const char *url, int num)
-{
-  char filename[50];
-  FILE *file;
-  CURL *handle;
-
-  snprintf(filename, 50, "%d.download", num);
-
-  file = fopen(filename, "wb");
-  if(!file) {
-    fprintf(stderr, "Error opening %s\n", filename);
-    return;
-  }
-
-  handle = curl_easy_init();
-  curl_easy_setopt(handle, CURLOPT_WRITEDATA, file);
-  curl_easy_setopt(handle, CURLOPT_PRIVATE, file);
-  curl_easy_setopt(handle, CURLOPT_URL, url);
-  curl_multi_add_handle(curl_handle, handle);
-  fprintf(stderr, "Added download %s -> %s\n", url, filename);
-}
+};
 
 static void check_multi_info(void)
 {
   char *done_url;
   CURLMsg *message;
   int pending;
-  CURL *easy_handle;
+  CURL *curl;
   FILE *file;
 
-  while((message = curl_multi_info_read(curl_handle, &pending))) {
+  while((message = curl_multi_info_read(multi, &pending))) {
     switch(message->msg) {
     case CURLMSG_DONE:
       /* Do not use message data after calling curl_multi_remove_handle() and
          curl_easy_cleanup(). As per curl_multi_info_read() docs:
-         "WARNING: The data the returned pointer points to will not survive
+         "WARNING: The data the returned pointer points to does not survive
          calling curl_multi_cleanup, curl_multi_remove_handle or
          curl_easy_cleanup." */
-      easy_handle = message->easy_handle;
+      curl = message->easy_handle;
 
-      curl_easy_getinfo(easy_handle, CURLINFO_EFFECTIVE_URL, &done_url);
-      curl_easy_getinfo(easy_handle, CURLINFO_PRIVATE, &file);
+      curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_URL, &done_url);
+      curl_easy_getinfo(curl, CURLINFO_PRIVATE, &file);
       printf("%s DONE\n", done_url);
 
-      curl_multi_remove_handle(curl_handle, easy_handle);
-      curl_easy_cleanup(easy_handle);
+      curl_multi_remove_handle(multi, curl);
+      curl_easy_cleanup(curl);
       if(file) {
         fclose(file);
       }
@@ -125,39 +81,83 @@ static void curl_perform(int fd, short event, void *arg)
 {
   int running_handles;
   int flags = 0;
-  curl_context_t *context;
+  struct curl_context *context;
+
+  (void)fd;
 
   if(event & EV_READ)
     flags |= CURL_CSELECT_IN;
   if(event & EV_WRITE)
     flags |= CURL_CSELECT_OUT;
 
-  context = (curl_context_t *) arg;
+  context = (struct curl_context *)arg;
 
-  curl_multi_socket_action(curl_handle, context->sockfd, flags,
-                           &running_handles);
+  curl_multi_socket_action(multi, context->sockfd, flags, &running_handles);
 
   check_multi_info();
 }
 
+static struct curl_context *create_curl_context(curl_socket_t sockfd)
+{
+  struct curl_context *context = malloc(sizeof(*context));
+
+  context->sockfd = sockfd;
+
+  context->event = event_new(base, sockfd, 0, curl_perform, context);
+
+  return context;
+}
+
+static void destroy_curl_context(struct curl_context *context)
+{
+  event_del(context->event);
+  event_free(context->event);
+  free(context);
+}
+
+static void add_download(const char *url, int num)
+{
+  char filename[50];
+  FILE *file;
+  CURL *curl;
+
+  snprintf(filename, sizeof(filename), "%d.download", num);
+
+  file = fopen(filename, "wb");
+  if(!file) {
+    fprintf(stderr, "Error opening %s\n", filename);
+    return;
+  }
+
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_WRITEDATA, file);
+  curl_easy_setopt(curl, CURLOPT_PRIVATE, file);
+  curl_easy_setopt(curl, CURLOPT_URL, url);
+  curl_multi_add_handle(multi, curl);
+  fprintf(stderr, "Added download %s -> %s\n", url, filename);
+}
+
 static void on_timeout(evutil_socket_t fd, short events, void *arg)
 {
   int running_handles;
-  curl_multi_socket_action(curl_handle, CURL_SOCKET_TIMEOUT, 0,
-                           &running_handles);
+  (void)fd;
+  (void)events;
+  (void)arg;
+  curl_multi_socket_action(multi, CURL_SOCKET_TIMEOUT, 0, &running_handles);
   check_multi_info();
 }
 
 static int start_timeout(CURLM *multi, long timeout_ms, void *userp)
 {
+  (void)multi;
+  (void)userp;
   if(timeout_ms < 0) {
     evtimer_del(timeout);
   }
   else {
-    if(timeout_ms == 0)
-      timeout_ms = 1; /* 0 means directly call socket_action, but we will do it
-                         in a bit */
     struct timeval tv;
+    if(timeout_ms == 0)
+      timeout_ms = 1; /* 0 means call socket_action asap */
     tv.tv_sec = timeout_ms / 1000;
     tv.tv_usec = (timeout_ms % 1000) * 1000;
     evtimer_del(timeout);
@@ -166,20 +166,23 @@ static int start_timeout(CURLM *multi, long timeout_ms, void *userp)
   return 0;
 }
 
-static int handle_socket(CURL *easy, curl_socket_t s, int action, void *userp,
-                  void *socketp)
+static int handle_socket(CURL *curl, curl_socket_t s, int action, void *userp,
+                         void *socketp)
 {
-  curl_context_t *curl_context;
+  struct curl_context *curl_context;
   int events = 0;
 
+  (void)curl;
+  (void)userp;
+
   switch(action) {
   case CURL_POLL_IN:
   case CURL_POLL_OUT:
   case CURL_POLL_INOUT:
-    curl_context = socketp ?
-      (curl_context_t *) socketp : create_curl_context(s);
+    curl_context =
+      socketp ? (struct curl_context *)socketp : create_curl_context(s);
 
-    curl_multi_assign(curl_handle, s, (void *) curl_context);
+    curl_multi_assign(multi, s, (void *)curl_context);
 
     if(action != CURL_POLL_IN)
       events |= EV_WRITE;
@@ -189,16 +192,16 @@ static int handle_socket(CURL *easy, curl_socket_t s, int action, void *userp,
     events |= EV_PERSIST;
 
     event_del(curl_context->event);
-    event_assign(curl_context->event, base, curl_context->sockfd, events,
-      curl_perform, curl_context);
+    event_assign(curl_context->event, base, curl_context->sockfd,
+                 (short)events, curl_perform, curl_context);
     event_add(curl_context->event, NULL);
 
     break;
   case CURL_POLL_REMOVE:
     if(socketp) {
-      event_del(((curl_context_t*) socketp)->event);
-      destroy_curl_context((curl_context_t*) socketp);
-      curl_multi_assign(curl_handle, s, NULL);
+      event_del(((struct curl_context *)socketp)->event);
+      destroy_curl_context((struct curl_context *)socketp);
+      curl_multi_assign(multi, s, NULL);
     }
     break;
   default:
@@ -208,30 +211,35 @@ static int handle_socket(CURL *easy, curl_socket_t s, int action, void *userp,
   return 0;
 }
 
-int main(int argc, char **argv)
+int main(int argc, const char **argv)
 {
+  CURLcode result;
+
   if(argc <= 1)
     return 0;
 
-  if(curl_global_init(CURL_GLOBAL_ALL)) {
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK) {
     fprintf(stderr, "Could not init curl\n");
-    return 1;
+    return (int)result;
   }
 
   base = event_base_new();
   timeout = evtimer_new(base, on_timeout, NULL);
 
-  curl_handle = curl_multi_init();
-  curl_multi_setopt(curl_handle, CURLMOPT_SOCKETFUNCTION, handle_socket);
-  curl_multi_setopt(curl_handle, CURLMOPT_TIMERFUNCTION, start_timeout);
+  multi = curl_multi_init();
+  if(multi) {
+    curl_multi_setopt(multi, CURLMOPT_SOCKETFUNCTION, handle_socket);
+    curl_multi_setopt(multi, CURLMOPT_TIMERFUNCTION, start_timeout);
 
-  while(argc-- > 1) {
-    add_download(argv[argc], argc);
+    while(argc-- > 1) {
+      add_download(argv[argc], argc);
+    }
+
+    event_base_dispatch(base);
+
+    curl_multi_cleanup(multi);
   }
-
-  event_base_dispatch(base);
-
-  curl_multi_cleanup(curl_handle);
   event_free(timeout);
   event_base_free(base);
 
diff --git a/third-party/curl/docs/examples/multi-formadd.c b/third-party/curl/docs/examples/multi-formadd.c
index 801b61e6dd..8816d69171 100644
--- a/third-party/curl/docs/examples/multi-formadd.c
+++ b/third-party/curl/docs/examples/multi-formadd.c
@@ -25,15 +25,12 @@
  * using the multi interface to do a multipart formpost without blocking
  * </DESC>
  */
-
 /*
- * Warning: this example uses the deprecated form api. See "multi-post.c"
- *          for a similar example using the mime api.
+ * Warning: this example uses the deprecated form API. See "multi-post.c"
+ *          for a similar example using the mime API.
  */
-
 #include <stdio.h>
 #include <string.h>
-#include <sys/time.h>
 
 #include <curl/curl.h>
 
@@ -41,75 +38,92 @@ int main(void)
 {
   CURL *curl;
 
-  CURLM *multi_handle;
-  int still_running = 0;
-
   struct curl_httppost *formpost = NULL;
   struct curl_httppost *lastptr = NULL;
   struct curl_slist *headerlist = NULL;
   static const char buf[] = "Expect:";
 
-  /* Fill in the file upload field. This makes libcurl load data from
-     the given file name when curl_easy_perform() is called. */
-  curl_formadd(&formpost,
-               &lastptr,
-               CURLFORM_COPYNAME, "sendfile",
-               CURLFORM_FILE, "multi-formadd.c",
-               CURLFORM_END);
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  /* Fill in the filename field */
-  curl_formadd(&formpost,
-               &lastptr,
-               CURLFORM_COPYNAME, "filename",
-               CURLFORM_COPYCONTENTS, "multi-formadd.c",
-               CURLFORM_END);
+  CURL_IGNORE_DEPRECATION(
+    /* Fill in the file upload field. This makes libcurl load data from
+       the given filename when curl_easy_perform() is called. */
+    curl_formadd(&formpost,
+                 &lastptr,
+                 CURLFORM_COPYNAME, "sendfile",
+                 CURLFORM_FILE, "multi-formadd.c",
+                 CURLFORM_END);
 
-  /* Fill in the submit field too, even if this is rarely needed */
-  curl_formadd(&formpost,
-               &lastptr,
-               CURLFORM_COPYNAME, "submit",
-               CURLFORM_COPYCONTENTS, "send",
-               CURLFORM_END);
+    /* Fill in the filename field */
+    curl_formadd(&formpost,
+                 &lastptr,
+                 CURLFORM_COPYNAME, "filename",
+                 CURLFORM_COPYCONTENTS, "multi-formadd.c",
+                 CURLFORM_END);
 
-  curl = curl_easy_init();
-  multi_handle = curl_multi_init();
+    /* Fill in the submit field too, even if this is rarely needed */
+    curl_formadd(&formpost,
+                 &lastptr,
+                 CURLFORM_COPYNAME, "submit",
+                 CURLFORM_COPYCONTENTS, "send",
+                 CURLFORM_END);
+  )
 
   /* initialize custom header list (stating that Expect: 100-continue is not
      wanted */
   headerlist = curl_slist_append(headerlist, buf);
-  if(curl && multi_handle) {
 
-    /* what URL that receives this POST */
-    curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/upload.cgi");
-    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl = curl_easy_init();
+  if(curl) {
+    CURLM *multi;
 
-    curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headerlist);
-    curl_easy_setopt(curl, CURLOPT_HTTPPOST, formpost);
+    multi = curl_multi_init();
+    if(multi) {
 
-    curl_multi_add_handle(multi_handle, curl);
+      int still_running = 0;
 
-    do {
-      CURLMcode mc = curl_multi_perform(multi_handle, &still_running);
+      /* what URL that receives this POST */
+      curl_easy_setopt(curl, CURLOPT_URL,
+                       "https://www.example.com/upload.cgi");
+      curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-      if(still_running)
-        /* wait for activity, timeout or "nothing" */
-        mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL);
+      curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headerlist);
+      CURL_IGNORE_DEPRECATION(
+        curl_easy_setopt(curl, CURLOPT_HTTPPOST, formpost);
+      )
 
-      if(mc)
-        break;
+      curl_multi_add_handle(multi, curl);
 
-    } while(still_running);
+      do {
+        CURLMcode mresult = curl_multi_perform(multi, &still_running);
 
-    curl_multi_cleanup(multi_handle);
+        if(still_running)
+          /* wait for activity, timeout or "nothing" */
+          mresult = curl_multi_poll(multi, NULL, 0, 1000, NULL);
+
+        if(mresult)
+          break;
+
+      } while(still_running);
+
+      curl_multi_cleanup(multi);
+    }
 
     /* always cleanup */
     curl_easy_cleanup(curl);
+  }
 
+  CURL_IGNORE_DEPRECATION(
     /* then cleanup the formpost chain */
     curl_formfree(formpost);
+  )
+
+  /* free slist */
+  curl_slist_free_all(headerlist);
+
+  curl_global_cleanup();
 
-    /* free slist */
-    curl_slist_free_all(headerlist);
-  }
   return 0;
 }
diff --git a/third-party/curl/docs/examples/multi-legacy.c b/third-party/curl/docs/examples/multi-legacy.c
index f36139fe1d..bd23866d6f 100644
--- a/third-party/curl/docs/examples/multi-legacy.c
+++ b/third-party/curl/docs/examples/multi-legacy.c
@@ -26,154 +26,176 @@
  * transfers in parallel without curl_multi_wait/poll.
  * </DESC>
  */
-
 #include <stdio.h>
 #include <string.h>
 
-/* somewhat unix-specific */
+/* somewhat Unix-specific */
+#ifndef _WIN32
 #include <sys/time.h>
 #include <unistd.h>
+#endif
 
-/* curl stuff */
 #include <curl/curl.h>
 
 /*
  * Download an HTTP file and upload an FTP file simultaneously.
  */
 
-#define HANDLECOUNT 2   /* Number of simultaneous transfers */
-#define HTTP_HANDLE 0   /* Index for the HTTP transfer */
-#define FTP_HANDLE 1    /* Index for the FTP transfer */
+#define HTTP_HANDLE 0  /* Index for the HTTP transfer */
+#define FTP_HANDLE  1  /* Index for the FTP transfer */
+#define HANDLECOUNT 2  /* Number of simultaneous transfers */
 
 int main(void)
 {
-  CURL *handles[HANDLECOUNT];
-  CURLM *multi_handle;
+  CURL *curl[HANDLECOUNT];
+  CURLM *multi;
 
-  int still_running = 0; /* keep number of running handles */
   int i;
 
-  CURLMsg *msg; /* for picking up messages with the transfer status */
-  int msgs_left; /* how many messages are left */
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  /* Allocate one CURL handle per transfer */
-  for(i = 0; i<HANDLECOUNT; i++)
-    handles[i] = curl_easy_init();
+  /* Allocate one curl handle per transfer */
+  for(i = 0; i < HANDLECOUNT; i++)
+    curl[i] = curl_easy_init();
 
-  /* set the options (I left out a few, you will get the point anyway) */
-  curl_easy_setopt(handles[HTTP_HANDLE], CURLOPT_URL, "https://example.com");
+  /* set the options (I left out a few, you get the point anyway) */
+  curl_easy_setopt(curl[HTTP_HANDLE], CURLOPT_URL, "https://example.com");
 
-  curl_easy_setopt(handles[FTP_HANDLE], CURLOPT_URL, "ftp://example.com");
-  curl_easy_setopt(handles[FTP_HANDLE], CURLOPT_UPLOAD, 1L);
+  curl_easy_setopt(curl[FTP_HANDLE], CURLOPT_URL, "ftp://example.com");
+  curl_easy_setopt(curl[FTP_HANDLE], CURLOPT_UPLOAD, 1L);
 
   /* init a multi stack */
-  multi_handle = curl_multi_init();
+  multi = curl_multi_init();
+  if(multi) {
 
-  /* add the individual transfers */
-  for(i = 0; i<HANDLECOUNT; i++)
-    curl_multi_add_handle(multi_handle, handles[i]);
+    int still_running = 0; /* keep number of running handles */
 
-  /* we start some action by calling perform right away */
-  curl_multi_perform(multi_handle, &still_running);
+    CURLMsg *msg;  /* for picking up messages with the transfer status */
+    int msgs_left; /* how many messages are left */
 
-  while(still_running) {
-    struct timeval timeout;
-    int rc; /* select() return code */
-    CURLMcode mc; /* curl_multi_fdset() return code */
+    /* add the individual transfers */
+    for(i = 0; i < HANDLECOUNT; i++)
+      curl_multi_add_handle(multi, curl[i]);
 
-    fd_set fdread;
-    fd_set fdwrite;
-    fd_set fdexcep;
-    int maxfd = -1;
+    /* we start some action by calling perform right away */
+    curl_multi_perform(multi, &still_running);
 
-    long curl_timeo = -1;
+    while(still_running) {
 
-    FD_ZERO(&fdread);
-    FD_ZERO(&fdwrite);
-    FD_ZERO(&fdexcep);
+      struct timeval timeout;
+      int rc;       /* select() return code */
+      CURLMcode mresult; /* curl_multi_fdset() return code */
 
-    /* set a suitable timeout to play around with */
-    timeout.tv_sec = 1;
-    timeout.tv_usec = 0;
+      fd_set fdread;
+      fd_set fdwrite;
+      fd_set fdexcep;
+      int maxfd = -1;
 
-    curl_multi_timeout(multi_handle, &curl_timeo);
-    if(curl_timeo >= 0) {
-      timeout.tv_sec = curl_timeo / 1000;
-      if(timeout.tv_sec > 1)
-        timeout.tv_sec = 1;
-      else
-        timeout.tv_usec = (int)(curl_timeo % 1000) * 1000;
-    }
+      long curl_timeo = -1;
 
-    /* get file descriptors from the transfers */
-    mc = curl_multi_fdset(multi_handle, &fdread, &fdwrite, &fdexcep, &maxfd);
+      FD_ZERO(&fdread);
+      FD_ZERO(&fdwrite);
+      FD_ZERO(&fdexcep);
 
-    if(mc != CURLM_OK) {
-      fprintf(stderr, "curl_multi_fdset() failed, code %d.\n", mc);
-      break;
-    }
+      /* set a suitable timeout to play around with */
+      timeout.tv_sec = 1;
+      timeout.tv_usec = 0;
 
-    /* On success the value of maxfd is guaranteed to be >= -1. We call
-       select(maxfd + 1, ...); specially in case of (maxfd == -1) there are
-       no fds ready yet so we call select(0, ...) --or Sleep() on Windows--
-       to sleep 100ms, which is the minimum suggested value in the
-       curl_multi_fdset() doc. */
-
-    if(maxfd == -1) {
-#ifdef _WIN32
-      Sleep(100);
-      rc = 0;
+      curl_multi_timeout(multi, &curl_timeo);
+      if(curl_timeo >= 0) {
+#if defined(MSDOS) || defined(__AMIGA__)
+        timeout.tv_sec = (time_t)(curl_timeo / 1000);
 #else
-      /* Portable sleep for platforms other than Windows. */
-      struct timeval wait = { 0, 100 * 1000 }; /* 100ms */
-      rc = select(0, NULL, NULL, NULL, &wait);
+        timeout.tv_sec = curl_timeo / 1000;
 #endif
-    }
-    else {
-      /* Note that on some platforms 'timeout' may be modified by select().
-         If you need access to the original value save a copy beforehand. */
-      rc = select(maxfd + 1, &fdread, &fdwrite, &fdexcep, &timeout);
+        if(timeout.tv_sec > 1)
+          timeout.tv_sec = 1;
+        else
+#if defined(MSDOS) || defined(__AMIGA__)
+          timeout.tv_usec = (time_t)(curl_timeo % 1000) * 1000;
+#else
+          timeout.tv_usec = (int)(curl_timeo % 1000) * 1000;
+#endif
+      }
+
+      /* get file descriptors from the transfers */
+      mresult = curl_multi_fdset(multi, &fdread, &fdwrite, &fdexcep, &maxfd);
+
+      if(mresult != CURLM_OK) {
+        fprintf(stderr, "curl_multi_fdset() failed, code %d.\n", mresult);
+        break;
+      }
+
+      /* On success the value of maxfd is guaranteed to be >= -1. We call
+         select(maxfd + 1, ...); specially in case of (maxfd == -1) there are
+         no fds ready yet so we call select(0, ...) --or Sleep() on Windows--
+         to sleep 100ms, which is the minimum suggested value in the
+         curl_multi_fdset() doc. */
+
+      if(maxfd == -1) {
+#ifdef _WIN32
+        Sleep(100);
+        rc = 0;
+#else
+        /* Portable sleep for platforms other than Windows. */
+        struct timeval wait = { 0 };
+        wait.tv_usec = 100 * 1000; /* 100ms */
+        rc = select(0, NULL, NULL, NULL, &wait);
+#endif
+      }
+      else {
+        /* Note that on some platforms 'timeout' may be modified by select().
+           If you need access to the original value save a copy beforehand. */
+        rc = select(maxfd + 1, &fdread, &fdwrite, &fdexcep, &timeout);
+      }
+
+      switch(rc) {
+      case -1:
+        /* select error */
+        break;
+      case 0: /* timeout */
+      default: /* action */
+        curl_multi_perform(multi, &still_running);
+        break;
+      }
     }
 
-    switch(rc) {
-    case -1:
-      /* select error */
-      break;
-    case 0: /* timeout */
-    default: /* action */
-      curl_multi_perform(multi_handle, &still_running);
-      break;
-    }
-  }
+    /* See how the transfers went */
+    /* !checksrc! disable EQUALSNULL 1 */
+    while((msg = curl_multi_info_read(multi, &msgs_left)) != NULL) {
+      if(msg->msg == CURLMSG_DONE) {
+        int idx;
 
-  /* See how the transfers went */
-  while((msg = curl_multi_info_read(multi_handle, &msgs_left))) {
-    if(msg->msg == CURLMSG_DONE) {
-      int idx;
+        /* Find out which handle this message is about */
+        for(idx = 0; idx < HANDLECOUNT; idx++) {
+          int found = (msg->easy_handle == curl[idx]);
+          if(found)
+            break;
+        }
 
-      /* Find out which handle this message is about */
-      for(idx = 0; idx<HANDLECOUNT; idx++) {
-        int found = (msg->easy_handle == handles[idx]);
-        if(found)
+        switch(idx) {
+        case HTTP_HANDLE:
+          printf("HTTP transfer completed with status %d\n",
+                 (int)msg->data.result);
           break;
-      }
-
-      switch(idx) {
-      case HTTP_HANDLE:
-        printf("HTTP transfer completed with status %d\n", msg->data.result);
-        break;
-      case FTP_HANDLE:
-        printf("FTP transfer completed with status %d\n", msg->data.result);
-        break;
+        case FTP_HANDLE:
+          printf("FTP transfer completed with status %d\n",
+                 (int)msg->data.result);
+          break;
+        }
       }
     }
+
+    curl_multi_cleanup(multi);
   }
 
-  curl_multi_cleanup(multi_handle);
+  /* Free the curl handles */
+  for(i = 0; i < HANDLECOUNT; i++)
+    curl_easy_cleanup(curl[i]);
 
-  /* Free the CURL handles */
-  for(i = 0; i<HANDLECOUNT; i++)
-    curl_easy_cleanup(handles[i]);
+  curl_global_cleanup();
 
   return 0;
 }
diff --git a/third-party/curl/docs/examples/multi-post.c b/third-party/curl/docs/examples/multi-post.c
index 112f3c0cd6..b5d557ce8a 100644
--- a/third-party/curl/docs/examples/multi-post.c
+++ b/third-party/curl/docs/examples/multi-post.c
@@ -25,81 +25,89 @@
  * using the multi interface to do a multipart formpost without blocking
  * </DESC>
  */
-
 #include <stdio.h>
 #include <string.h>
-#include <sys/time.h>
 
 #include <curl/curl.h>
 
 int main(void)
 {
-  CURL *curl;
-
-  CURLM *multi_handle;
-  int still_running = 0;
-
   curl_mime *form = NULL;
   curl_mimepart *field = NULL;
   struct curl_slist *headerlist = NULL;
   static const char buf[] = "Expect:";
 
+  CURL *curl;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
   curl = curl_easy_init();
-  multi_handle = curl_multi_init();
+  if(curl) {
+    CURLM *multi;
 
-  if(curl && multi_handle) {
-    /* Create the form */
-    form = curl_mime_init(curl);
+    multi = curl_multi_init();
+    if(multi) {
+      int still_running = 0;
 
-    /* Fill in the file upload field */
-    field = curl_mime_addpart(form);
-    curl_mime_name(field, "sendfile");
-    curl_mime_filedata(field, "multi-post.c");
+      /* Create the form */
+      form = curl_mime_init(curl);
 
-    /* Fill in the filename field */
-    field = curl_mime_addpart(form);
-    curl_mime_name(field, "filename");
-    curl_mime_data(field, "multi-post.c", CURL_ZERO_TERMINATED);
+      /* Fill in the file upload field */
+      field = curl_mime_addpart(form);
+      curl_mime_name(field, "sendfile");
+      curl_mime_filedata(field, "multi-post.c");
 
-    /* Fill in the submit field too, even if this is rarely needed */
-    field = curl_mime_addpart(form);
-    curl_mime_name(field, "submit");
-    curl_mime_data(field, "send", CURL_ZERO_TERMINATED);
+      /* Fill in the filename field */
+      field = curl_mime_addpart(form);
+      curl_mime_name(field, "filename");
+      curl_mime_data(field, "multi-post.c", CURL_ZERO_TERMINATED);
 
-    /* initialize custom header list (stating that Expect: 100-continue is not
-       wanted */
-    headerlist = curl_slist_append(headerlist, buf);
+      /* Fill in the submit field too, even if this is rarely needed */
+      field = curl_mime_addpart(form);
+      curl_mime_name(field, "submit");
+      curl_mime_data(field, "send", CURL_ZERO_TERMINATED);
 
-    /* what URL that receives this POST */
-    curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/upload.cgi");
-    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+      /* initialize custom header list (stating that Expect: 100-continue is
+         not wanted */
+      headerlist = curl_slist_append(headerlist, buf);
 
-    curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headerlist);
-    curl_easy_setopt(curl, CURLOPT_MIMEPOST, form);
+      /* what URL that receives this POST */
+      curl_easy_setopt(curl, CURLOPT_URL,
+                       "https://www.example.com/upload.cgi");
+      curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-    curl_multi_add_handle(multi_handle, curl);
+      curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headerlist);
+      curl_easy_setopt(curl, CURLOPT_MIMEPOST, form);
 
-    do {
-      CURLMcode mc = curl_multi_perform(multi_handle, &still_running);
+      curl_multi_add_handle(multi, curl);
 
-      if(still_running)
-        /* wait for activity, timeout or "nothing" */
-        mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL);
+      do {
+        CURLMcode mresult = curl_multi_perform(multi, &still_running);
 
-      if(mc)
-        break;
-    } while(still_running);
+        if(still_running)
+          /* wait for activity, timeout or "nothing" */
+          mresult = curl_multi_poll(multi, NULL, 0, 1000, NULL);
 
-    curl_multi_cleanup(multi_handle);
+        if(mresult)
+          break;
+      } while(still_running);
+
+      curl_multi_cleanup(multi);
+    }
 
     /* always cleanup */
     curl_easy_cleanup(curl);
-
-    /* then cleanup the form */
-    curl_mime_free(form);
-
-    /* free slist */
-    curl_slist_free_all(headerlist);
   }
+
+  /* then cleanup the form */
+  curl_mime_free(form);
+
+  /* free slist */
+  curl_slist_free_all(headerlist);
+
+  curl_global_cleanup();
+
   return 0;
 }
diff --git a/third-party/curl/docs/examples/multi-single.c b/third-party/curl/docs/examples/multi-single.c
index c5933627ad..6329dd4d38 100644
--- a/third-party/curl/docs/examples/multi-single.c
+++ b/third-party/curl/docs/examples/multi-single.c
@@ -29,54 +29,57 @@
 #include <stdio.h>
 #include <string.h>
 
-/* somewhat unix-specific */
-#include <sys/time.h>
-#include <unistd.h>
-
-/* curl stuff */
 #include <curl/curl.h>
 
 /*
- * Simply download an HTTP file.
+ * Download an HTTP file.
  */
 int main(void)
 {
-  CURL *http_handle;
-  CURLM *multi_handle;
-  int still_running = 1; /* keep number of running handles */
+  CURL *curl;
 
-  curl_global_init(CURL_GLOBAL_DEFAULT);
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  http_handle = curl_easy_init();
+  curl = curl_easy_init();
+  if(curl) {
 
-  /* set the options (I left out a few, you will get the point anyway) */
-  curl_easy_setopt(http_handle, CURLOPT_URL, "https://www.example.com/");
+    CURLM *multi;
+    int still_running = 1; /* keep number of running handles */
 
-  /* init a multi stack */
-  multi_handle = curl_multi_init();
+    /* set the options (I left out a few, you get the point anyway) */
+    curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");
 
-  /* add the individual transfers */
-  curl_multi_add_handle(multi_handle, http_handle);
+    /* init a multi stack */
+    multi = curl_multi_init();
+    if(multi) {
 
-  do {
-    CURLMcode mc = curl_multi_perform(multi_handle, &still_running);
+      /* add the individual transfers */
+      curl_multi_add_handle(multi, curl);
 
-    if(!mc)
-      /* wait for activity, timeout or "nothing" */
-      mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL);
+      do {
+        CURLMcode mresult = curl_multi_perform(multi, &still_running);
 
-    if(mc) {
-      fprintf(stderr, "curl_multi_poll() failed, code %d.\n", (int)mc);
-      break;
+        if(!mresult)
+          /* wait for activity, timeout or "nothing" */
+          mresult = curl_multi_poll(multi, NULL, 0, 1000, NULL);
+
+        if(mresult) {
+          fprintf(stderr, "curl_multi_poll() failed, code %d.\n",
+                  (int)mresult);
+          break;
+        }
+
+      } while(still_running);
+
+      curl_multi_remove_handle(multi, curl);
+
+      curl_multi_cleanup(multi);
     }
 
-  } while(still_running);
-
-  curl_multi_remove_handle(multi_handle, http_handle);
-
-  curl_easy_cleanup(http_handle);
-
-  curl_multi_cleanup(multi_handle);
+    curl_easy_cleanup(curl);
+  }
 
   curl_global_cleanup();
 
diff --git a/third-party/curl/docs/examples/multi-uv.c b/third-party/curl/docs/examples/multi-uv.c
index 6581b9fa60..094df35105 100644
--- a/third-party/curl/docs/examples/multi-uv.c
+++ b/third-party/curl/docs/examples/multi-uv.c
@@ -21,42 +21,49 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * multi_socket API using libuv
  * </DESC>
  */
-/* Example application using the multi socket interface to download multiple
-   files in parallel, powered by libuv.
+/* Use the socket_action interface to download multiple files in parallel,
+ * powered by libuv.
+ *
+ * Requires libuv and (of course) libcurl.
+ *
+ * See https://docs.libuv.org/en/v1.x/index.html libuv API documentation
+ */
 
-   Requires libuv and (of course) libcurl.
-
-   See https://nikhilm.github.io/uvbook/ for more information on libuv.
-*/
+/* Requires: USE_LIBUV */
 
 #include <stdio.h>
 #include <stdlib.h>
+
 #include <uv.h>
+
 #include <curl/curl.h>
 
-uv_loop_t *loop;
-CURLM *curl_handle;
-uv_timer_t timeout;
+/* object to pass to the callbacks */
+struct datauv {
+  uv_timer_t timeout;
+  uv_loop_t *loop;
+  CURLM *multi;
+};
 
-typedef struct curl_context_s {
+struct curl_context {
   uv_poll_t poll_handle;
   curl_socket_t sockfd;
-} curl_context_t;
+  struct datauv *uv;
+};
 
-static curl_context_t *create_curl_context(curl_socket_t sockfd)
+static struct curl_context *create_curl_context(curl_socket_t sockfd,
+                                                struct datauv *uv)
 {
-  curl_context_t *context;
-
-  context = (curl_context_t *) malloc(sizeof(*context));
+  struct curl_context *context = malloc(sizeof(*context));
 
   context->sockfd = sockfd;
+  context->uv = uv;
 
-  uv_poll_init_socket(loop, &context->poll_handle, sockfd);
+  uv_poll_init_socket(uv->loop, &context->poll_handle, sockfd);
   context->poll_handle.data = context;
 
   return context;
@@ -64,22 +71,22 @@ static curl_context_t *create_curl_context(curl_socket_t sockfd)
 
 static void curl_close_cb(uv_handle_t *handle)
 {
-  curl_context_t *context = (curl_context_t *) handle->data;
+  struct curl_context *context = (struct curl_context *)handle->data;
   free(context);
 }
 
-static void destroy_curl_context(curl_context_t *context)
+static void destroy_curl_context(struct curl_context *context)
 {
-  uv_close((uv_handle_t *) &context->poll_handle, curl_close_cb);
+  uv_close((uv_handle_t *)&context->poll_handle, curl_close_cb);
 }
 
-static void add_download(const char *url, int num)
+static void add_download(const char *url, int num, CURLM *multi)
 {
   char filename[50];
   FILE *file;
-  CURL *handle;
+  CURL *curl;
 
-  snprintf(filename, 50, "%d.download", num);
+  snprintf(filename, sizeof(filename), "%d.download", num);
 
   file = fopen(filename, "wb");
   if(!file) {
@@ -87,38 +94,38 @@ static void add_download(const char *url, int num)
     return;
   }
 
-  handle = curl_easy_init();
-  curl_easy_setopt(handle, CURLOPT_WRITEDATA, file);
-  curl_easy_setopt(handle, CURLOPT_PRIVATE, file);
-  curl_easy_setopt(handle, CURLOPT_URL, url);
-  curl_multi_add_handle(curl_handle, handle);
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_WRITEDATA, file);
+  curl_easy_setopt(curl, CURLOPT_PRIVATE, file);
+  curl_easy_setopt(curl, CURLOPT_URL, url);
+  curl_multi_add_handle(multi, curl);
   fprintf(stderr, "Added download %s -> %s\n", url, filename);
 }
 
-static void check_multi_info(void)
+static void check_multi_info(struct datauv *uv)
 {
   char *done_url;
   CURLMsg *message;
   int pending;
-  CURL *easy_handle;
+  CURL *curl;
   FILE *file;
 
-  while((message = curl_multi_info_read(curl_handle, &pending))) {
+  while((message = curl_multi_info_read(uv->multi, &pending))) {
     switch(message->msg) {
     case CURLMSG_DONE:
       /* Do not use message data after calling curl_multi_remove_handle() and
          curl_easy_cleanup(). As per curl_multi_info_read() docs:
-         "WARNING: The data the returned pointer points to will not survive
+         "WARNING: The data the returned pointer points to does not survive
          calling curl_multi_cleanup, curl_multi_remove_handle or
          curl_easy_cleanup." */
-      easy_handle = message->easy_handle;
+      curl = message->easy_handle;
 
-      curl_easy_getinfo(easy_handle, CURLINFO_EFFECTIVE_URL, &done_url);
-      curl_easy_getinfo(easy_handle, CURLINFO_PRIVATE, &file);
+      curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_URL, &done_url);
+      curl_easy_getinfo(curl, CURLINFO_PRIVATE, &file);
       printf("%s DONE\n", done_url);
 
-      curl_multi_remove_handle(curl_handle, easy_handle);
-      curl_easy_cleanup(easy_handle);
+      curl_multi_remove_handle(uv->multi, curl);
+      curl_easy_cleanup(curl);
       if(file) {
         fclose(file);
       }
@@ -131,74 +138,84 @@ static void check_multi_info(void)
   }
 }
 
-static void curl_perform(uv_poll_t *req, int status, int events)
+/* callback from libuv on socket activity */
+static void on_uv_socket(uv_poll_t *req, int status, int events)
 {
   int running_handles;
   int flags = 0;
-  curl_context_t *context;
-
+  struct curl_context *context = (struct curl_context *)req->data;
+  (void)status;
   if(events & UV_READABLE)
     flags |= CURL_CSELECT_IN;
   if(events & UV_WRITABLE)
     flags |= CURL_CSELECT_OUT;
 
-  context = (curl_context_t *) req->data;
-
-  curl_multi_socket_action(curl_handle, context->sockfd, flags,
+  curl_multi_socket_action(context->uv->multi, context->sockfd, flags,
                            &running_handles);
-
-  check_multi_info();
+  check_multi_info(context->uv);
 }
 
-static void on_timeout(uv_timer_t *req)
+/* callback from libuv when timeout expires */
+static void on_uv_timeout(uv_timer_t *req)
 {
+  /* get the datauv struct from the timer handle */
+  struct datauv *uv = (struct datauv *)req;
   int running_handles;
-  curl_multi_socket_action(curl_handle, CURL_SOCKET_TIMEOUT, 0,
+
+  curl_multi_socket_action(uv->multi, CURL_SOCKET_TIMEOUT, 0,
                            &running_handles);
-  check_multi_info();
+
+  if(running_handles)
+    check_multi_info(uv);
 }
 
-static int start_timeout(CURLM *multi, long timeout_ms, void *userp)
+/* callback from libcurl to update the timeout expiry */
+static int cb_timeout(CURLM *multi, long timeout_ms, void *userp)
 {
-  if(timeout_ms < 0) {
-    uv_timer_stop(&timeout);
-  }
+  struct datauv *uv = (struct datauv *)userp;
+  (void)multi;
+  if(timeout_ms < 0)
+    uv_timer_stop(&uv->timeout);
   else {
     if(timeout_ms == 0)
-      timeout_ms = 1; /* 0 means directly call socket_action, but we will do it
-                         in a bit */
-    uv_timer_start(&timeout, on_timeout, timeout_ms, 0);
+      timeout_ms = 1; /* 0 means call curl_multi_socket_action asap but NOT
+                         within the callback itself */
+    uv_timer_start(&uv->timeout, on_uv_timeout, (uint64_t)timeout_ms,
+                   0); /* do not repeat */
   }
   return 0;
 }
 
-static int handle_socket(CURL *easy, curl_socket_t s, int action, void *userp,
-                  void *socketp)
+/* callback from libcurl to update socket activity to wait for */
+static int cb_socket(CURL *curl, curl_socket_t s, int action,
+                     void *userp, void *socketp)
 {
-  curl_context_t *curl_context;
+  struct datauv *uv = (struct datauv *)userp;
+  struct curl_context *curl_context;
   int events = 0;
+  (void)curl;
 
   switch(action) {
   case CURL_POLL_IN:
   case CURL_POLL_OUT:
   case CURL_POLL_INOUT:
-    curl_context = socketp ?
-      (curl_context_t *) socketp : create_curl_context(s);
+    curl_context =
+      socketp ? (struct curl_context *)socketp : create_curl_context(s, uv);
 
-    curl_multi_assign(curl_handle, s, (void *) curl_context);
+    curl_multi_assign(uv->multi, s, (void *)curl_context);
 
     if(action != CURL_POLL_IN)
       events |= UV_WRITABLE;
     if(action != CURL_POLL_OUT)
       events |= UV_READABLE;
 
-    uv_poll_start(&curl_context->poll_handle, events, curl_perform);
+    uv_poll_start(&curl_context->poll_handle, events, on_uv_socket);
     break;
   case CURL_POLL_REMOVE:
     if(socketp) {
-      uv_poll_stop(&((curl_context_t*)socketp)->poll_handle);
-      destroy_curl_context((curl_context_t*) socketp);
-      curl_multi_assign(curl_handle, s, NULL);
+      uv_poll_stop(&((struct curl_context *)socketp)->poll_handle);
+      destroy_curl_context((struct curl_context *)socketp);
+      curl_multi_assign(uv->multi, s, NULL);
     }
     break;
   default:
@@ -208,30 +225,40 @@ static int handle_socket(CURL *easy, curl_socket_t s, int action, void *userp,
   return 0;
 }
 
-int main(int argc, char **argv)
+int main(int argc, const char **argv)
 {
-  loop = uv_default_loop();
+  CURLcode result;
+  struct datauv uv = { 0 };
+  int running_handles;
 
   if(argc <= 1)
     return 0;
 
-  if(curl_global_init(CURL_GLOBAL_ALL)) {
-    fprintf(stderr, "Could not init curl\n");
-    return 1;
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
+  uv.loop = uv_default_loop();
+  uv_timer_init(uv.loop, &uv.timeout);
+
+  uv.multi = curl_multi_init();
+  if(uv.multi) {
+    curl_multi_setopt(uv.multi, CURLMOPT_SOCKETFUNCTION, cb_socket);
+    curl_multi_setopt(uv.multi, CURLMOPT_SOCKETDATA, &uv);
+    curl_multi_setopt(uv.multi, CURLMOPT_TIMERFUNCTION, cb_timeout);
+    curl_multi_setopt(uv.multi, CURLMOPT_TIMERDATA, &uv);
+
+    while(argc-- > 1) {
+      add_download(argv[argc], argc, uv.multi);
+    }
+
+    /* kickstart the thing */
+    curl_multi_socket_action(uv.multi, CURL_SOCKET_TIMEOUT, 0,
+                             &running_handles);
+    uv_run(uv.loop, UV_RUN_DEFAULT);
+    curl_multi_cleanup(uv.multi);
   }
-
-  uv_timer_init(loop, &timeout);
-
-  curl_handle = curl_multi_init();
-  curl_multi_setopt(curl_handle, CURLMOPT_SOCKETFUNCTION, handle_socket);
-  curl_multi_setopt(curl_handle, CURLMOPT_TIMERFUNCTION, start_timeout);
-
-  while(argc-- > 1) {
-    add_download(argv[argc], argc);
-  }
-
-  uv_run(loop, UV_RUN_DEFAULT);
-  curl_multi_cleanup(curl_handle);
+  curl_global_cleanup();
 
   return 0;
 }
diff --git a/third-party/curl/docs/examples/multithread.c b/third-party/curl/docs/examples/multithread.c
deleted file mode 100644
index cc4ce7c12c..0000000000
--- a/third-party/curl/docs/examples/multithread.c
+++ /dev/null
@@ -1,96 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-/* <DESC>
- * A multi-threaded program using pthreads to fetch several files at once
- * </DESC>
- */
-
-#include <stdio.h>
-#include <pthread.h>
-#include <curl/curl.h>
-
-#define NUMT 4
-
-/*
-  List of URLs to fetch.
-
-  If you intend to use a SSL-based protocol here you might need to setup TLS
-  library mutex callbacks as described here:
-
-  https://curl.se/libcurl/c/threadsafe.html
-
-*/
-const char * const urls[NUMT]= {
-  "https://curl.se/",
-  "ftp://example.com/",
-  "https://example.net/",
-  "www.example"
-};
-
-static void *pull_one_url(void *url)
-{
-  CURL *curl;
-
-  curl = curl_easy_init();
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  curl_easy_perform(curl); /* ignores error */
-  curl_easy_cleanup(curl);
-
-  return NULL;
-}
-
-
-/*
-   int pthread_create(pthread_t *new_thread_ID,
-   const pthread_attr_t *attr,
-   void * (*start_func)(void *), void *arg);
-*/
-
-int main(int argc, char **argv)
-{
-  pthread_t tid[NUMT];
-  int i;
-
-  /* Must initialize libcurl before any threads are started */
-  curl_global_init(CURL_GLOBAL_ALL);
-
-  for(i = 0; i< NUMT; i++) {
-    int error = pthread_create(&tid[i],
-                               NULL, /* default attributes please */
-                               pull_one_url,
-                               (void *)urls[i]);
-    if(0 != error)
-      fprintf(stderr, "Couldn't run thread number %d, errno %d\n", i, error);
-    else
-      fprintf(stderr, "Thread %d, gets %s\n", i, urls[i]);
-  }
-
-  /* now wait for all threads to terminate */
-  for(i = 0; i< NUMT; i++) {
-    pthread_join(tid[i], NULL);
-    fprintf(stderr, "Thread %d terminated\n", i);
-  }
-  curl_global_cleanup();
-  return 0;
-}
diff --git a/third-party/curl/docs/examples/netrc.c b/third-party/curl/docs/examples/netrc.c
new file mode 100644
index 0000000000..d862210445
--- /dev/null
+++ b/third-party/curl/docs/examples/netrc.c
@@ -0,0 +1,54 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/* <DESC>
+ * Use credentials from .netrc
+ * </DESC>
+ */
+#include <stdio.h>
+
+#include <curl/curl.h>
+
+int main(void)
+{
+  CURL *curl;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
+    curl_easy_setopt(curl, CURLOPT_NETRC_FILE, "/home/daniel/s3cr3ts.txt");
+    curl_easy_setopt(curl, CURLOPT_URL, "https://curl.se/");
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+
+  curl_global_cleanup();
+
+  return (int)result;
+}
diff --git a/third-party/curl/docs/examples/parseurl.c b/third-party/curl/docs/examples/parseurl.c
index 688336f025..f70df19bef 100644
--- a/third-party/curl/docs/examples/parseurl.c
+++ b/third-party/curl/docs/examples/parseurl.c
@@ -26,6 +26,7 @@
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 #if !CURL_AT_LEAST_VERSION(7, 62, 0)
@@ -48,10 +49,10 @@ int main(void)
   if(uc)
     goto fail;
 
-  /* extract host name from the parsed URL */
+  /* extract hostname from the parsed URL */
   uc = curl_url_get(h, CURLUPART_HOST, &host, 0);
   if(!uc) {
-    printf("Host name: %s\n", host);
+    printf("Hostname: %s\n", host);
     curl_free(host);
   }
 
@@ -75,6 +76,6 @@ int main(void)
   }
 
 fail:
-  curl_url_cleanup(h); /* free url handle */
+  curl_url_cleanup(h); /* free URL handle */
   return 0;
 }
diff --git a/third-party/curl/docs/examples/persistent.c b/third-party/curl/docs/examples/persistent.c
index 51bd8c352c..852f923dd1 100644
--- a/third-party/curl/docs/examples/persistent.c
+++ b/third-party/curl/docs/examples/persistent.c
@@ -26,15 +26,16 @@
  * </DESC>
  */
 #include <stdio.h>
-#include <unistd.h>
+
 #include <curl/curl.h>
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
 
-  curl_global_init(CURL_GLOBAL_ALL);
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -44,27 +45,29 @@ int main(void)
     /* get the first document */
     curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* get another document from the same server using the same
        connection */
     curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/docs/");
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return 0;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/pop3-authzid.c b/third-party/curl/docs/examples/pop3-authzid.c
index a948e95c63..3f40e78c71 100644
--- a/third-party/curl/docs/examples/pop3-authzid.c
+++ b/third-party/curl/docs/examples/pop3-authzid.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Retrieve emails from a shared POP3 mailbox
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to retrieve mail using libcurl's POP3
@@ -39,7 +38,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -53,20 +55,22 @@ int main(void)
     /* Force PLAIN authentication */
     curl_easy_setopt(curl, CURLOPT_LOGIN_OPTIONS, "AUTH=PLAIN");
 
-    /* This will retrieve message 1 from the user's mailbox */
+    /* This retrieves message 1 from the user's mailbox */
     curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com/1");
 
     /* Perform the retr */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/pop3-dele.c b/third-party/curl/docs/examples/pop3-dele.c
index fe3795c245..69ee1de992 100644
--- a/third-party/curl/docs/examples/pop3-dele.c
+++ b/third-party/curl/docs/examples/pop3-dele.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Delete POP3 emails
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to delete an existing mail using
@@ -39,7 +38,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -57,16 +59,18 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_NOBODY, 1L);
 
     /* Perform the custom request */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/pop3-list.c b/third-party/curl/docs/examples/pop3-list.c
index 2e8b3baee2..9a2693d3b1 100644
--- a/third-party/curl/docs/examples/pop3-list.c
+++ b/third-party/curl/docs/examples/pop3-list.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * List the contents of a POP3 mailbox
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example using libcurl's POP3 capabilities to list the
@@ -39,7 +38,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -47,20 +49,22 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-    /* This will list every message of the given mailbox */
+    /* This lists every message of the given mailbox */
     curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com");
 
     /* Perform the list */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/pop3-multi.c b/third-party/curl/docs/examples/pop3-multi.c
index b4fad19251..4e69172e4b 100644
--- a/third-party/curl/docs/examples/pop3-multi.c
+++ b/third-party/curl/docs/examples/pop3-multi.c
@@ -21,14 +21,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Get POP3 email using the multi interface
  * </DESC>
  */
-
 #include <stdio.h>
 #include <string.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to retrieve mail using libcurl's POP3
@@ -38,46 +37,50 @@
 
 int main(void)
 {
+  CURLcode result;
   CURL *curl;
-  CURLM *mcurl;
-  int still_running = 1;
 
-  curl_global_init(CURL_GLOBAL_DEFAULT);
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
-  if(!curl)
-    return 1;
+  if(curl) {
+    CURLM *multi;
 
-  mcurl = curl_multi_init();
-  if(!mcurl)
-    return 2;
+    multi = curl_multi_init();
+    if(multi) {
+      int still_running = 1;
 
-  /* Set username and password */
-  curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
-  curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
+      /* Set username and password */
+      curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
+      curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-  /* This will retrieve message 1 from the user's mailbox */
-  curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com/1");
+      /* This retrieves message 1 from the user's mailbox */
+      curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com/1");
 
-  /* Tell the multi stack about our easy handle */
-  curl_multi_add_handle(mcurl, curl);
+      /* Tell the multi stack about our easy handle */
+      curl_multi_add_handle(multi, curl);
 
-  do {
-    CURLMcode mc = curl_multi_perform(mcurl, &still_running);
+      do {
+        CURLMcode mresult = curl_multi_perform(multi, &still_running);
 
-    if(still_running)
-      /* wait for activity, timeout or "nothing" */
-      mc = curl_multi_poll(mcurl, NULL, 0, 1000, NULL);
+        if(still_running)
+          /* wait for activity, timeout or "nothing" */
+          mresult = curl_multi_poll(multi, NULL, 0, 1000, NULL);
 
-    if(mc)
-      break;
+        if(mresult)
+          break;
 
-  } while(still_running);
+      } while(still_running);
+
+      /* Always cleanup */
+      curl_multi_remove_handle(multi, curl);
+      curl_multi_cleanup(multi);
+    }
+    curl_easy_cleanup(curl);
+  }
 
-  /* Always cleanup */
-  curl_multi_remove_handle(mcurl, curl);
-  curl_multi_cleanup(mcurl);
-  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
   return 0;
diff --git a/third-party/curl/docs/examples/pop3-noop.c b/third-party/curl/docs/examples/pop3-noop.c
index 16181d2875..c8352df402 100644
--- a/third-party/curl/docs/examples/pop3-noop.c
+++ b/third-party/curl/docs/examples/pop3-noop.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Perform a POP3 noop
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to perform a noop using libcurl's POP3
@@ -39,7 +38,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -47,7 +49,7 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-    /* This is just the server URL */
+    /* This is the server URL */
     curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com");
 
     /* Set the NOOP command */
@@ -57,16 +59,18 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_NOBODY, 1L);
 
     /* Perform the custom request */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/pop3-retr.c b/third-party/curl/docs/examples/pop3-retr.c
index 4940e07812..c0c9e92791 100644
--- a/third-party/curl/docs/examples/pop3-retr.c
+++ b/third-party/curl/docs/examples/pop3-retr.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Retrieve POP3 email
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to retrieve mail using libcurl's POP3
@@ -39,7 +38,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -47,20 +49,22 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-    /* This will retrieve message 1 from the user's mailbox */
+    /* This retrieves message 1 from the user's mailbox */
     curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com/1");
 
     /* Perform the retr */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/pop3-ssl.c b/third-party/curl/docs/examples/pop3-ssl.c
index e72cf6f38d..221a0ab703 100644
--- a/third-party/curl/docs/examples/pop3-ssl.c
+++ b/third-party/curl/docs/examples/pop3-ssl.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Get POP3 email using implicit SSL
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to retrieve mail using libcurl's POP3
@@ -40,7 +39,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -48,8 +50,8 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-    /* This will retrieve message 1 from the user's mailbox. Note the use of
-     * pop3s:// rather than pop3:// to request a SSL based connection. */
+    /* This retrieves message 1 from the user's mailbox. Note the use of *
+       pop3s:// rather than pop3:// to request an SSL based connection. */
     curl_easy_setopt(curl, CURLOPT_URL, "pop3s://pop.example.com/1");
 
     /* If you want to connect to a site who is not using a certificate that is
@@ -64,30 +66,32 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
 #endif
 
-    /* If the site you are connecting to uses a different host name that what
+    /* If the site you are connecting to uses a different hostname than what
      * they have mentioned in their server certificate's commonName (or
-     * subjectAltName) fields, libcurl will refuse to connect. You can skip
-     * this check, but this will make the connection less secure. */
+     * subjectAltName) fields, libcurl refuses to connect. You can skip this
+     * check, but it makes the connection insecure. */
 #ifdef SKIP_HOSTNAME_VERIFICATION
     curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
 #endif
 
-    /* Since the traffic will be encrypted, it is useful to turn on debug
+    /* Since the traffic is encrypted, it is useful to turn on debug
      * information within libcurl to see what is happening during the
      * transfer */
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
     /* Perform the retr */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/pop3-stat.c b/third-party/curl/docs/examples/pop3-stat.c
index 419859bfa6..6c2d3646f4 100644
--- a/third-party/curl/docs/examples/pop3-stat.c
+++ b/third-party/curl/docs/examples/pop3-stat.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Obtain POP3 message statistics
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to obtain message statistics using
@@ -39,7 +38,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -47,7 +49,7 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-    /* This is just the server URL */
+    /* This is the server URL */
     curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com");
 
     /* Set the STAT command */
@@ -57,16 +59,18 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_NOBODY, 1L);
 
     /* Perform the custom request */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/pop3-tls.c b/third-party/curl/docs/examples/pop3-tls.c
index 04e6e3b71f..ce38d044f0 100644
--- a/third-party/curl/docs/examples/pop3-tls.c
+++ b/third-party/curl/docs/examples/pop3-tls.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * POP3 using TLS
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to retrieve mail using libcurl's POP3
@@ -40,7 +39,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -48,15 +50,15 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-    /* This will retrieve message 1 from the user's mailbox */
+    /* This retrieves message 1 from the user's mailbox */
     curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com/1");
 
-    /* In this example, we will start with a plain text connection, and upgrade
-     * to Transport Layer Security (TLS) using the STLS command. Be careful of
+    /* In this example, we start with a plain text connection, and upgrade to
+     * Transport Layer Security (TLS) using the STLS command. Be careful of
      * using CURLUSESSL_TRY here, because if TLS upgrade fails, the transfer
-     * will continue anyway - see the security discussion in the libcurl
-     * tutorial for more details. */
-    curl_easy_setopt(curl, CURLOPT_USE_SSL, (long)CURLUSESSL_ALL);
+     * continues anyway - see the security discussion in the libcurl tutorial
+     * for more details. */
+    curl_easy_setopt(curl, CURLOPT_USE_SSL, CURLUSESSL_ALL);
 
     /* If your server does not have a valid certificate, then you can disable
      * part of the Transport Layer Security protection by setting the
@@ -72,22 +74,24 @@ int main(void)
      * for more information. */
     curl_easy_setopt(curl, CURLOPT_CAINFO, "/path/to/certificate.pem");
 
-    /* Since the traffic will be encrypted, it is useful to turn on debug
+    /* Since the traffic is encrypted, it is useful to turn on debug
      * information within libcurl to see what is happening during the
      * transfer */
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
     /* Perform the retr */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/pop3-top.c b/third-party/curl/docs/examples/pop3-top.c
index 7ceba881b2..bb23eb99b9 100644
--- a/third-party/curl/docs/examples/pop3-top.c
+++ b/third-party/curl/docs/examples/pop3-top.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * POP3 example showing how to retrieve only the headers of an email
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to retrieve only the headers of a mail
@@ -39,7 +38,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -47,23 +49,25 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-    /* This is just the server URL */
+    /* This is the server URL */
     curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com");
 
     /* Set the TOP command for message 1 to only include the headers */
     curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "TOP 1 0");
 
     /* Perform the custom request */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/pop3-uidl.c b/third-party/curl/docs/examples/pop3-uidl.c
index 496e5b08d4..fb211093d8 100644
--- a/third-party/curl/docs/examples/pop3-uidl.c
+++ b/third-party/curl/docs/examples/pop3-uidl.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * List the contents of a POP3 mailbox by unique ID
  * </DESC>
  */
-
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example using libcurl's POP3 capabilities to list the
@@ -39,7 +38,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -47,23 +49,25 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
-    /* This is just the server URL */
+    /* This is the server URL */
     curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com");
 
     /* Set the UIDL command */
     curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "UIDL");
 
     /* Perform the custom request */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Always cleanup */
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/post-callback.c b/third-party/curl/docs/examples/post-callback.c
index a802c35825..729642cbce 100644
--- a/third-party/curl/docs/examples/post-callback.c
+++ b/third-party/curl/docs/examples/post-callback.c
@@ -27,15 +27,17 @@
  */
 #include <stdio.h>
 #include <string.h>
+
 #include <curl/curl.h>
 
 /* silly test data to POST */
-static const char data[]="Lorem ipsum dolor sit amet, consectetur adipiscing "
-  "elit. Sed vel urna neque. Ut quis leo metus. Quisque eleifend, ex at "
+static const char data[] =
+  "Lorem ipsum dolor sit amet, consectetur adipiscing elit. "
+  "Sed vel urna neque. Ut quis leo metus. Quisque eleifend, ex at "
   "laoreet rhoncus, odio ipsum semper metus, at tempus ante urna in mauris. "
-  "Suspendisse ornare tempor venenatis. Ut dui neque, pellentesque a varius "
+  "Suspendisse ornare tempor venenatis. Ut dui neque, pellentesque a ______ "
   "eget, mattis vitae ligula. Fusce ut pharetra est. Ut ullamcorper mi ac "
-  "sollicitudin semper. Praesent sit amet tellus varius, posuere nulla non, "
+  "sollicitudin semper. Praesent sit amet tellus ______, posuere nulla non, "
   "rhoncus ipsum.";
 
 struct WriteThis {
@@ -43,10 +45,10 @@ struct WriteThis {
   size_t sizeleft;
 };
 
-static size_t read_callback(char *dest, size_t size, size_t nmemb, void *userp)
+static size_t read_cb(char *dest, size_t size, size_t nmemb, void *userp)
 {
   struct WriteThis *wt = (struct WriteThis *)userp;
-  size_t buffer_size = size*nmemb;
+  size_t buffer_size = size * nmemb;
 
   if(wt->sizeleft) {
     /* copy as much as possible from the source to the destination */
@@ -60,26 +62,26 @@ static size_t read_callback(char *dest, size_t size, size_t nmemb, void *userp)
     return copy_this_much; /* we copied this many bytes */
   }
 
-  return 0; /* no more data left to deliver */
+  return 0;  /* no more data left to deliver */
 }
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+  CURLcode result;
 
   struct WriteThis wt;
 
   wt.readptr = data;
   wt.sizeleft = strlen(data);
 
-  /* In windows, this will init the winsock stuff */
-  res = curl_global_init(CURL_GLOBAL_DEFAULT);
+  /* In Windows, this inits the Winsock stuff */
+  result = curl_global_init(CURL_GLOBAL_DEFAULT);
   /* Check for errors */
-  if(res != CURLE_OK) {
+  if(result != CURLE_OK) {
     fprintf(stderr, "curl_global_init() failed: %s\n",
-            curl_easy_strerror(res));
-    return 1;
+            curl_easy_strerror(result));
+    return (int)result;
   }
 
   /* get a curl handle */
@@ -92,7 +94,7 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_POST, 1L);
 
     /* we want to use our own read function */
-    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_callback);
+    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
 
     /* pointer to pass to our read function */
     curl_easy_setopt(curl, CURLOPT_READDATA, &wt);
@@ -112,7 +114,7 @@ int main(void)
       struct curl_slist *chunk = NULL;
 
       chunk = curl_slist_append(chunk, "Transfer-Encoding: chunked");
-      res = curl_easy_setopt(curl, CURLOPT_HTTPHEADER, chunk);
+      result = curl_easy_setopt(curl, CURLOPT_HTTPHEADER, chunk);
       /* use curl_slist_free_all() after the *perform() call to free this
          list again */
     }
@@ -135,18 +137,18 @@ int main(void)
       struct curl_slist *chunk = NULL;
 
       chunk = curl_slist_append(chunk, "Expect:");
-      res = curl_easy_setopt(curl, CURLOPT_HTTPHEADER, chunk);
+      result = curl_easy_setopt(curl, CURLOPT_HTTPHEADER, chunk);
       /* use curl_slist_free_all() after the *perform() call to free this
          list again */
     }
 #endif
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
diff --git a/third-party/curl/docs/examples/postinmemory.c b/third-party/curl/docs/examples/postinmemory.c
index 1610ad5a51..c4d9abcc11 100644
--- a/third-party/curl/docs/examples/postinmemory.c
+++ b/third-party/curl/docs/examples/postinmemory.c
@@ -28,6 +28,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+
 #include <curl/curl.h>
 
 struct MemoryStruct {
@@ -35,8 +36,7 @@ struct MemoryStruct {
   size_t size;
 };
 
-static size_t
-WriteMemoryCallback(void *contents, size_t size, size_t nmemb, void *userp)
+static size_t write_cb(char *contents, size_t size, size_t nmemb, void *userp)
 {
   size_t realsize = size * nmemb;
   struct MemoryStruct *mem = (struct MemoryStruct *)userp;
@@ -59,20 +59,23 @@ WriteMemoryCallback(void *contents, size_t size, size_t nmemb, void *userp)
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+  CURLcode result;
   struct MemoryStruct chunk;
   static const char *postthis = "Field=1&Field=2&Field=3";
 
-  chunk.memory = malloc(1);  /* will be grown as needed by realloc above */
-  chunk.size = 0;    /* no data at this point */
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
+  chunk.memory = malloc(1);  /* grown as needed by realloc above */
+  chunk.size = 0;            /* no data at this point */
 
-  curl_global_init(CURL_GLOBAL_ALL);
   curl = curl_easy_init();
   if(curl) {
     curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.org/");
 
-    /* send all data to this function  */
-    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, WriteMemoryCallback);
+    /* send all data to this function */
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
 
     /* we pass our 'chunk' struct to the callback function */
     curl_easy_setopt(curl, CURLOPT_WRITEDATA, (void *)&chunk);
@@ -83,16 +86,15 @@ int main(void)
 
     curl_easy_setopt(curl, CURLOPT_POSTFIELDS, postthis);
 
-    /* if we do not provide POSTFIELDSIZE, libcurl will strlen() by
-       itself */
+    /* if we do not provide POSTFIELDSIZE, libcurl calls strlen() by itself */
     curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(postthis));
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK) {
+    if(result != CURLE_OK) {
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
     }
     else {
       /*
@@ -101,7 +103,7 @@ int main(void)
        *
        * Do something nice with it!
        */
-      printf("%s\n",chunk.memory);
+      printf("%s\n", chunk.memory);
     }
 
     /* always cleanup */
diff --git a/third-party/curl/docs/examples/postit2-formadd.c b/third-party/curl/docs/examples/postit2-formadd.c
index 27761fcda3..c760bcb0da 100644
--- a/third-party/curl/docs/examples/postit2-formadd.c
+++ b/third-party/curl/docs/examples/postit2-formadd.c
@@ -25,61 +25,62 @@
  * HTTP Multipart formpost with file upload and two additional parts.
  * </DESC>
  */
-
 /*
- * Example code that uploads a file name 'foo' to a remote script that accepts
+ * Example code that uploads a filename 'foo' to a remote script that accepts
  * "HTML form based" (as described in RFC 1738) uploads using HTTP POST.
  *
  * Warning: this example uses the deprecated form api. See "postit2.c"
  *          for a similar example using the mime api.
  *
- * The imaginary form we will fill in looks like:
+ * The imaginary form we fill in looks like:
  *
  * <form method="post" enctype="multipart/form-data" action="examplepost.cgi">
  * Enter file: <input type="file" name="sendfile" size="40">
- * Enter file name: <input type="text" name="filename" size="30">
+ * Enter filename: <input type="text" name="filename" size="30">
  * <input type="submit" value="send" name="submit">
  * </form>
  */
-
 #include <stdio.h>
 #include <string.h>
 
 #include <curl/curl.h>
 
-int main(int argc, char *argv[])
+int main(int argc, const char *argv[])
 {
   CURL *curl;
-  CURLcode res;
+  CURLcode result;
 
   struct curl_httppost *formpost = NULL;
   struct curl_httppost *lastptr = NULL;
   struct curl_slist *headerlist = NULL;
   static const char buf[] = "Expect:";
 
-  curl_global_init(CURL_GLOBAL_ALL);
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  /* Fill in the file upload field */
-  curl_formadd(&formpost,
-               &lastptr,
-               CURLFORM_COPYNAME, "sendfile",
-               CURLFORM_FILE, "postit2-formadd.c",
-               CURLFORM_END);
+  CURL_IGNORE_DEPRECATION(
+    /* Fill in the file upload field */
+    curl_formadd(&formpost,
+                 &lastptr,
+                 CURLFORM_COPYNAME, "sendfile",
+                 CURLFORM_FILE, "postit2-formadd.c",
+                 CURLFORM_END);
 
-  /* Fill in the filename field */
-  curl_formadd(&formpost,
-               &lastptr,
-               CURLFORM_COPYNAME, "filename",
-               CURLFORM_COPYCONTENTS, "postit2-formadd.c",
-               CURLFORM_END);
+    /* Fill in the filename field */
+    curl_formadd(&formpost,
+                 &lastptr,
+                 CURLFORM_COPYNAME, "filename",
+                 CURLFORM_COPYCONTENTS, "postit2-formadd.c",
+                 CURLFORM_END);
 
-
-  /* Fill in the submit field too, even if this is rarely needed */
-  curl_formadd(&formpost,
-               &lastptr,
-               CURLFORM_COPYNAME, "submit",
-               CURLFORM_COPYCONTENTS, "send",
-               CURLFORM_END);
+    /* Fill in the submit field too, even if this is rarely needed */
+    curl_formadd(&formpost,
+                 &lastptr,
+                 CURLFORM_COPYNAME, "submit",
+                 CURLFORM_COPYCONTENTS, "send",
+                 CURLFORM_END);
+  )
 
   curl = curl_easy_init();
   /* initialize custom header list (stating that Expect: 100-continue is not
@@ -91,22 +92,30 @@ int main(int argc, char *argv[])
     if((argc == 2) && (!strcmp(argv[1], "noexpectheader")))
       /* only disable 100-continue header if explicitly requested */
       curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headerlist);
-    curl_easy_setopt(curl, CURLOPT_HTTPPOST, formpost);
+    CURL_IGNORE_DEPRECATION(
+      curl_easy_setopt(curl, CURLOPT_HTTPPOST, formpost);
+    )
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
 
-    /* then cleanup the formpost chain */
-    curl_formfree(formpost);
+    CURL_IGNORE_DEPRECATION(
+      /* then cleanup the formpost chain */
+      curl_formfree(formpost);
+    )
+
     /* free slist */
     curl_slist_free_all(headerlist);
   }
+
+  curl_global_cleanup();
+
   return 0;
 }
diff --git a/third-party/curl/docs/examples/postit2.c b/third-party/curl/docs/examples/postit2.c
index a1fb12b0fc..0bc1e6a48f 100644
--- a/third-party/curl/docs/examples/postit2.c
+++ b/third-party/curl/docs/examples/postit2.c
@@ -25,38 +25,38 @@
  * HTTP Multipart formpost with file upload and two additional parts.
  * </DESC>
  */
-/* Example code that uploads a file name 'foo' to a remote script that accepts
+/* Example code that uploads a filename 'foo' to a remote script that accepts
  * "HTML form based" (as described in RFC 1738) uploads using HTTP POST.
  *
- * The imaginary form we will fill in looks like:
+ * The imaginary form we fill in looks like:
  *
  * <form method="post" enctype="multipart/form-data" action="examplepost.cgi">
  * Enter file: <input type="file" name="sendfile" size="40">
- * Enter file name: <input type="text" name="filename" size="30">
+ * Enter filename: <input type="text" name="filename" size="30">
  * <input type="submit" value="send" name="submit">
  * </form>
  *
  */
-
 #include <stdio.h>
 #include <string.h>
 
 #include <curl/curl.h>
 
-int main(int argc, char *argv[])
+int main(int argc, const char *argv[])
 {
   CURL *curl;
-  CURLcode res;
 
-  curl_mime *form = NULL;
-  curl_mimepart *field = NULL;
-  struct curl_slist *headerlist = NULL;
-  static const char buf[] = "Expect:";
-
-  curl_global_init(CURL_GLOBAL_ALL);
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
+    curl_mime *form = NULL;
+    curl_mimepart *field = NULL;
+    struct curl_slist *headerlist = NULL;
+    static const char buf[] = "Expect:";
+
     /* Create the form */
     form = curl_mime_init(curl);
 
@@ -85,12 +85,12 @@ int main(int argc, char *argv[])
       curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headerlist);
     curl_easy_setopt(curl, CURLOPT_MIMEPOST, form);
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
@@ -100,5 +100,8 @@ int main(int argc, char *argv[])
     /* free slist */
     curl_slist_free_all(headerlist);
   }
+
+  curl_global_cleanup();
+
   return 0;
 }
diff --git a/third-party/curl/docs/examples/progressfunc.c b/third-party/curl/docs/examples/progressfunc.c
index e164f03ca5..4138a6b63f 100644
--- a/third-party/curl/docs/examples/progressfunc.c
+++ b/third-party/curl/docs/examples/progressfunc.c
@@ -27,10 +27,11 @@
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
-#define MINIMAL_PROGRESS_FUNCTIONALITY_INTERVAL     3000000
-#define STOP_DOWNLOAD_AFTER_THIS_MANY_BYTES         6000
+#define MINIMAL_PROGRESS_FUNCTIONALITY_INTERVAL 3000000
+#define STOP_DOWNLOAD_AFTER_THIS_MANY_BYTES     6000
 
 struct myprogress {
   curl_off_t lastruntime; /* type depends on version, see above */
@@ -53,14 +54,19 @@ static int xferinfo(void *p,
      be used */
   if((curtime - myp->lastruntime) >= MINIMAL_PROGRESS_FUNCTIONALITY_INTERVAL) {
     myp->lastruntime = curtime;
-    fprintf(stderr, "TOTAL TIME: %lu.%06lu\r\n",
-            (unsigned long)(curtime / 1000000),
-            (unsigned long)(curtime % 1000000));
+    fprintf(stderr, "TOTAL TIME: %" CURL_FORMAT_CURL_OFF_T
+            ".%06" CURL_FORMAT_CURL_OFF_T "\r\n",
+            curtime / 1000000,
+            curtime % 1000000);
   }
 
-  fprintf(stderr, "UP: %lu of %lu  DOWN: %lu of %lu\r\n",
-          (unsigned long)ulnow, (unsigned long)ultotal,
-          (unsigned long)dlnow, (unsigned long)dltotal);
+  fprintf(stderr,
+          "UP: "
+          "%" CURL_FORMAT_CURL_OFF_T " of %" CURL_FORMAT_CURL_OFF_T "  "
+          "DOWN: "
+          "%" CURL_FORMAT_CURL_OFF_T " of %" CURL_FORMAT_CURL_OFF_T "\r\n",
+          ulnow, ultotal,
+          dlnow, dltotal);
 
   if(dlnow > STOP_DOWNLOAD_AFTER_THIS_MANY_BYTES)
     return 1;
@@ -70,11 +76,15 @@ static int xferinfo(void *p,
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
-  struct myprogress prog;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
+    struct myprogress prog;
+
     prog.lastruntime = 0;
     prog.curl = curl;
 
@@ -85,13 +95,14 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_XFERINFODATA, &prog);
 
     curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
-    if(res != CURLE_OK)
-      fprintf(stderr, "%s\n", curl_easy_strerror(res));
+    if(result != CURLE_OK)
+      fprintf(stderr, "%s\n", curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
-  return (int)res;
+  curl_global_cleanup();
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/protofeats.c b/third-party/curl/docs/examples/protofeats.c
index 3e762218ae..73cbf1c221 100644
--- a/third-party/curl/docs/examples/protofeats.c
+++ b/third-party/curl/docs/examples/protofeats.c
@@ -26,18 +26,21 @@
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
-#if !CURL_AT_LEAST_VERSION(7,87,0)
+#if !CURL_AT_LEAST_VERSION(7, 87, 0)
 #error "too old libcurl"
 #endif
 
 int main(void)
 {
   curl_version_info_data *ver;
-  const char *const *ptr;
+  const char * const *ptr;
 
-  curl_global_init(CURL_GLOBAL_ALL);
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   ver = curl_version_info(CURLVERSION_NOW);
   printf("Protocols:\n");
diff --git a/third-party/curl/docs/examples/range.c b/third-party/curl/docs/examples/range.c
new file mode 100644
index 0000000000..857ee92600
--- /dev/null
+++ b/third-party/curl/docs/examples/range.c
@@ -0,0 +1,50 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/* <DESC>
+ * GET a range only of an HTTP resource
+ * </DESC>
+ */
+#include <curl/curl.h>
+
+int main(void)
+{
+  CURL *curl;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_URL, "https://curl.se/");
+    curl_easy_setopt(curl, CURLOPT_RANGE, "200-999");
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+
+  curl_global_cleanup();
+
+  return (int)result;
+}
diff --git a/third-party/curl/docs/examples/resolve.c b/third-party/curl/docs/examples/resolve.c
index a16f459545..9c87bc0086 100644
--- a/third-party/curl/docs/examples/resolve.c
+++ b/third-party/curl/docs/examples/resolve.c
@@ -22,37 +22,42 @@
  *
  ***************************************************************************/
 /* <DESC>
- * Use CURLOPT_RESOLVE to feed custom IP addresses for given host name + port
+ * Use CURLOPT_RESOLVE to feed custom IP addresses for given hostname + port
  * number combinations.
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
 
   /* Each single name resolve string should be written using the format
-     HOST:PORT:ADDRESS where HOST is the name libcurl will try to resolve,
-     PORT is the port number of the service where libcurl wants to connect to
-     the HOST and ADDRESS is the numerical IP address
+     HOST:PORT:ADDRESS where HOST is the name libcurl tries to resolve, PORT
+     is the port number of the service where libcurl wants to connect to the
+     HOST and ADDRESS is the numerical IP address
    */
   struct curl_slist *host = curl_slist_append(NULL,
                                               "example.com:443:127.0.0.1");
 
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
   curl = curl_easy_init();
   if(curl) {
     curl_easy_setopt(curl, CURLOPT_RESOLVE, host);
     curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
 
   curl_slist_free_all(host);
+  curl_global_cleanup();
 
-  return (int)res;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/rtsp-options.c b/third-party/curl/docs/examples/rtsp-options.c
new file mode 100644
index 0000000000..c7800460b4
--- /dev/null
+++ b/third-party/curl/docs/examples/rtsp-options.c
@@ -0,0 +1,60 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/* <DESC>
+ * Simple RTSP request sending OPTIONS.
+ * </DESC>
+ */
+#include <stdio.h>
+
+#include <curl/curl.h>
+
+int main(void)
+{
+  CURL *curl;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_URL, "rtsp://example.com/");
+
+    curl_easy_setopt(curl, CURLOPT_RTSP_SESSION_ID, "12345");
+
+    curl_easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_OPTIONS);
+
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
+    /* Check for errors */
+    if(result != CURLE_OK)
+      fprintf(stderr, "curl_easy_perform() failed: %s\n",
+              curl_easy_strerror(result));
+
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+  curl_global_cleanup();
+  return 0;
+}
diff --git a/third-party/curl/docs/examples/sendrecv.c b/third-party/curl/docs/examples/sendrecv.c
index b935bee10c..a8d0697028 100644
--- a/third-party/curl/docs/examples/sendrecv.c
+++ b/third-party/curl/docs/examples/sendrecv.c
@@ -25,11 +25,21 @@
  * Demonstrate curl_easy_send() and curl_easy_recv() usage.
  * </DESC>
  */
-
 #include <stdio.h>
 #include <string.h>
+
 #include <curl/curl.h>
 
+/* Avoid warning in FD_SET() with pre-2020 Cygwin/MSYS releases:
+ * warning: conversion to 'long unsigned int' from 'curl_socket_t' {aka 'int'}
+ * may change the sign of the result [-Wsign-conversion]
+ */
+#ifdef __GNUC__  /* keep outside functions and without push/pop for GCC <4.6 */
+#pragma GCC diagnostic ignored "-Wsign-conversion"
+#elif defined(_MSC_VER)
+#pragma warning(disable:4127)  /* conditional expression is constant */
+#endif
+
 /* Auxiliary function that waits on the socket. */
 static int wait_on_socket(curl_socket_t sockfd, int for_recv, long timeout_ms)
 {
@@ -37,8 +47,13 @@ static int wait_on_socket(curl_socket_t sockfd, int for_recv, long timeout_ms)
   fd_set infd, outfd, errfd;
   int res;
 
+#if defined(MSDOS) || defined(__AMIGA__)
+  tv.tv_sec = (time_t)(timeout_ms / 1000);
+  tv.tv_usec = (time_t)(timeout_ms % 1000) * 1000;
+#else
   tv.tv_sec = timeout_ms / 1000;
   tv.tv_usec = (int)(timeout_ms % 1000) * 1000;
+#endif
 
   FD_ZERO(&infd);
   FD_ZERO(&outfd);
@@ -65,6 +80,10 @@ int main(void)
   const char *request = "GET / HTTP/1.0\r\nHost: example.com\r\n\r\n";
   size_t request_len = strlen(request);
 
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
   /* A general note of caution here: if you are using curl_easy_recv() or
      curl_easy_send() to implement HTTP or _any_ other protocol libcurl
      supports "natively", you are doing it wrong and you should stop.
@@ -75,26 +94,24 @@ int main(void)
 
   curl = curl_easy_init();
   if(curl) {
-    CURLcode res;
     curl_socket_t sockfd;
     size_t nsent_total = 0;
 
     curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
     /* Do not do the transfer - only connect to host */
     curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
-    if(res != CURLE_OK) {
-      printf("Error: %s\n", curl_easy_strerror(res));
+    if(result != CURLE_OK) {
+      printf("Error: %s\n", curl_easy_strerror(result));
       return 1;
     }
 
-    /* Extract the socket from the curl handle - we will need it for
-       waiting. */
-    res = curl_easy_getinfo(curl, CURLINFO_ACTIVESOCKET, &sockfd);
+    /* Extract the socket from the curl handle - we need it for waiting. */
+    result = curl_easy_getinfo(curl, CURLINFO_ACTIVESOCKET, &sockfd);
 
-    if(res != CURLE_OK) {
-      printf("Error: %s\n", curl_easy_strerror(res));
+    if(result != CURLE_OK) {
+      printf("Error: %s\n", curl_easy_strerror(result));
       return 1;
     }
 
@@ -107,18 +124,18 @@ int main(void)
       size_t nsent;
       do {
         nsent = 0;
-        res = curl_easy_send(curl, request + nsent_total,
-            request_len - nsent_total, &nsent);
+        result = curl_easy_send(curl, request + nsent_total,
+                                request_len - nsent_total, &nsent);
         nsent_total += nsent;
 
-        if(res == CURLE_AGAIN && !wait_on_socket(sockfd, 0, 60000L)) {
+        if(result == CURLE_AGAIN && !wait_on_socket(sockfd, 0, 60000L)) {
           printf("Error: timeout.\n");
           return 1;
         }
-      } while(res == CURLE_AGAIN);
+      } while(result == CURLE_AGAIN);
 
-      if(res != CURLE_OK) {
-        printf("Error: %s\n", curl_easy_strerror(res));
+      if(result != CURLE_OK) {
+        printf("Error: %s\n", curl_easy_strerror(result));
         return 1;
       }
 
@@ -134,16 +151,16 @@ int main(void)
       size_t nread;
       do {
         nread = 0;
-        res = curl_easy_recv(curl, buf, sizeof(buf), &nread);
+        result = curl_easy_recv(curl, buf, sizeof(buf), &nread);
 
-        if(res == CURLE_AGAIN && !wait_on_socket(sockfd, 1, 60000L)) {
+        if(result == CURLE_AGAIN && !wait_on_socket(sockfd, 1, 60000L)) {
           printf("Error: timeout.\n");
           return 1;
         }
-      } while(res == CURLE_AGAIN);
+      } while(result == CURLE_AGAIN);
 
-      if(res != CURLE_OK) {
-        printf("Error: %s\n", curl_easy_strerror(res));
+      if(result != CURLE_OK) {
+        printf("Error: %s\n", curl_easy_strerror(result));
         break;
       }
 
@@ -158,5 +175,6 @@ int main(void)
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
+  curl_global_cleanup();
   return 0;
 }
diff --git a/third-party/curl/docs/examples/sepheaders.c b/third-party/curl/docs/examples/sepheaders.c
index 0d090ed815..c9fee6c2ba 100644
--- a/third-party/curl/docs/examples/sepheaders.c
+++ b/third-party/curl/docs/examples/sepheaders.c
@@ -25,13 +25,18 @@
  * Simple HTTP GET that stores the headers in a separate file
  * </DESC>
  */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for fopen() */
+#endif
+#endif
+
 #include <stdio.h>
 #include <stdlib.h>
-#include <unistd.h>
 
 #include <curl/curl.h>
 
-static size_t write_data(void *ptr, size_t size, size_t nmemb, void *stream)
+static size_t write_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
   size_t written = fwrite(ptr, size, nmemb, (FILE *)stream);
   return written;
@@ -39,58 +44,66 @@ static size_t write_data(void *ptr, size_t size, size_t nmemb, void *stream)
 
 int main(void)
 {
-  CURL *curl_handle;
-  static const char *headerfilename = "head.out";
-  FILE *headerfile;
-  static const char *bodyfilename = "body.out";
-  FILE *bodyfile;
+  CURL *curl;
 
-  curl_global_init(CURL_GLOBAL_ALL);
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   /* init the curl session */
-  curl_handle = curl_easy_init();
+  curl = curl_easy_init();
+  if(curl) {
+    static const char *headerfilename = "head.out";
+    FILE *headerfile;
+    static const char *bodyfilename = "body.out";
+    FILE *bodyfile;
 
-  /* set URL to get */
-  curl_easy_setopt(curl_handle, CURLOPT_URL, "https://example.com");
+    /* set URL to get */
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
 
-  /* no progress meter please */
-  curl_easy_setopt(curl_handle, CURLOPT_NOPROGRESS, 1L);
+    /* no progress meter please */
+    curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 1L);
 
-  /* send all data to this function  */
-  curl_easy_setopt(curl_handle, CURLOPT_WRITEFUNCTION, write_data);
+    /* send all data to this function */
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
 
-  /* open the header file */
-  headerfile = fopen(headerfilename, "wb");
-  if(!headerfile) {
-    curl_easy_cleanup(curl_handle);
-    return -1;
-  }
+    /* open the header file */
+    headerfile = fopen(headerfilename, "wb");
+    if(!headerfile) {
+      curl_easy_cleanup(curl);
+      curl_global_cleanup();
+      return -1;
+    }
 
-  /* open the body file */
-  bodyfile = fopen(bodyfilename, "wb");
-  if(!bodyfile) {
-    curl_easy_cleanup(curl_handle);
+    /* open the body file */
+    bodyfile = fopen(bodyfilename, "wb");
+    if(!bodyfile) {
+      curl_easy_cleanup(curl);
+      fclose(headerfile);
+      curl_global_cleanup();
+      return -1;
+    }
+
+    /* we want the headers be written to this file handle */
+    curl_easy_setopt(curl, CURLOPT_HEADERDATA, headerfile);
+
+    /* we want the body be written to this file handle instead of stdout */
+    curl_easy_setopt(curl, CURLOPT_WRITEDATA, bodyfile);
+
+    /* get it! */
+    result = curl_easy_perform(curl);
+
+    /* close the header file */
     fclose(headerfile);
-    return -1;
+
+    /* close the body file */
+    fclose(bodyfile);
+
+    /* cleanup curl stuff */
+    curl_easy_cleanup(curl);
   }
 
-  /* we want the headers be written to this file handle */
-  curl_easy_setopt(curl_handle, CURLOPT_HEADERDATA, headerfile);
+  curl_global_cleanup();
 
-  /* we want the body be written to this file handle instead of stdout */
-  curl_easy_setopt(curl_handle, CURLOPT_WRITEDATA, bodyfile);
-
-  /* get it! */
-  curl_easy_perform(curl_handle);
-
-  /* close the header file */
-  fclose(headerfile);
-
-  /* close the body file */
-  fclose(bodyfile);
-
-  /* cleanup curl stuff */
-  curl_easy_cleanup(curl_handle);
-
-  return 0;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/sessioninfo.c b/third-party/curl/docs/examples/sessioninfo.c
index befb8f3c0b..b9150e72f5 100644
--- a/third-party/curl/docs/examples/sessioninfo.c
+++ b/third-party/curl/docs/examples/sessioninfo.c
@@ -29,32 +29,40 @@
 /* Note that this example currently requires curl to be linked against
    GnuTLS (and this program must also be linked against -lgnutls). */
 
+/* Requires: USE_GNUTLS */
+
+#ifndef CURL_DISABLE_DEPRECATION
+#define CURL_DISABLE_DEPRECATION
+#endif
+
 #include <stdio.h>
 
 #include <curl/curl.h>
+
 #include <gnutls/gnutls.h>
 #include <gnutls/x509.h>
 
 static CURL *curl;
 
-static size_t wrfu(void *ptr, size_t size, size_t nmemb, void *stream)
+static size_t write_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
   const struct curl_tlssessioninfo *info;
-  unsigned int cert_list_size;
-  const gnutls_datum_t *chainp;
-  CURLcode res;
+  CURLcode result;
 
   (void)stream;
   (void)ptr;
 
-  res = curl_easy_getinfo(curl, CURLINFO_TLS_SESSION, &info);
+  result = curl_easy_getinfo(curl, CURLINFO_TLS_SESSION, &info);
+
+  if(result == CURLE_OK) {
+    unsigned int cert_list_size;
+    const gnutls_datum_t *chainp;
 
-  if(!res) {
     switch(info->backend) {
     case CURLSSLBACKEND_GNUTLS:
       /* info->internals is now the gnutls_session_t */
       chainp = gnutls_certificate_get_peers(info->internals, &cert_list_size);
-      if((chainp) && (cert_list_size)) {
+      if(chainp && cert_list_size) {
         unsigned int i;
 
         for(i = 0; i < cert_list_size; i++) {
@@ -66,7 +74,8 @@ static size_t wrfu(void *ptr, size_t size, size_t nmemb, void *stream)
                gnutls_x509_crt_import(cert, &chainp[i], GNUTLS_X509_FMT_DER)) {
               if(GNUTLS_E_SUCCESS ==
                  gnutls_x509_crt_print(cert, GNUTLS_CRT_PRINT_FULL, &dn)) {
-                fprintf(stderr, "Certificate #%u: %.*s", i, dn.size, dn.data);
+                fprintf(stderr, "Certificate #%u: %.*s", i, (int)dn.size,
+                        dn.data);
 
                 gnutls_free(dn.data);
               }
@@ -88,25 +97,22 @@ static size_t wrfu(void *ptr, size_t size, size_t nmemb, void *stream)
 
 int main(void)
 {
-  curl_global_init(CURL_GLOBAL_DEFAULT);
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
     curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");
-
-    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, wrfu);
-
-    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
-    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
-
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 0L);
 
-    (void) curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     curl_easy_cleanup(curl);
   }
 
   curl_global_cleanup();
 
-  return 0;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/sftpget.c b/third-party/curl/docs/examples/sftpget.c
index 6f0cb2ad4f..a3da2d6721 100644
--- a/third-party/curl/docs/examples/sftpget.c
+++ b/third-party/curl/docs/examples/sftpget.c
@@ -25,6 +25,11 @@
  * Gets a file using an SFTP URL.
  * </DESC>
  */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for fopen() */
+#endif
+#endif
 
 #include <stdio.h>
 
@@ -34,10 +39,10 @@
 #undef DISABLE_SSH_AGENT
 
 /*
- * This is an example showing how to get a single file from an SFTP server.
- * It delays the actual destination file creation until the first write
- * callback so that it will not create an empty file in case the remote file
- * does not exist or something else fails.
+ * This is an example showing how to get a single file from an SFTP server. It
+ * delays the actual destination file creation until the first write callback
+ * so that it does not create an empty file in case the remote file does not
+ * exist or something else fails.
  */
 
 struct FtpFile {
@@ -45,30 +50,29 @@ struct FtpFile {
   FILE *stream;
 };
 
-static size_t my_fwrite(void *buffer, size_t size, size_t nmemb,
-                        void *stream)
+static size_t write_cb(char *buffer, size_t size, size_t nmemb, void *stream)
 {
   struct FtpFile *out = (struct FtpFile *)stream;
   if(!out->stream) {
     /* open file for writing */
     out->stream = fopen(out->filename, "wb");
     if(!out->stream)
-      return -1; /* failure, cannot open file to write */
+      return 0; /* failure, cannot open file to write */
   }
   return fwrite(buffer, size, nmemb, out->stream);
 }
 
-
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
   struct FtpFile ftpfile = {
     "yourfile.bin", /* name to store the file as if successful */
     NULL
   };
 
-  curl_global_init(CURL_GLOBAL_DEFAULT);
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -78,7 +82,7 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_URL,
                      "sftp://user@server/home/user/file.txt");
     /* Define our callback to get called when there is data to be written */
-    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, my_fwrite);
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
     /* Set a pointer to our struct to pass to the callback */
     curl_easy_setopt(curl, CURLOPT_WRITEDATA, &ftpfile);
 
@@ -92,14 +96,14 @@ int main(void)
     /* Switch on full protocol/debug output */
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* always cleanup */
     curl_easy_cleanup(curl);
 
-    if(CURLE_OK != res) {
+    if(result != CURLE_OK) {
       /* we failed */
-      fprintf(stderr, "curl told us %d\n", res);
+      fprintf(stderr, "curl told us %d\n", (int)result);
     }
   }
 
@@ -108,5 +112,5 @@ int main(void)
 
   curl_global_cleanup();
 
-  return 0;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/sftpuploadresume.c b/third-party/curl/docs/examples/sftpuploadresume.c
index aabe5c3953..153883640b 100644
--- a/third-party/curl/docs/examples/sftpuploadresume.c
+++ b/third-party/curl/docs/examples/sftpuploadresume.c
@@ -25,13 +25,19 @@
  * Upload to SFTP, resuming a previously aborted transfer.
  * </DESC>
  */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for fopen() */
+#endif
+#endif
 
 #include <stdlib.h>
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 /* read data to upload */
-static size_t readfunc(char *ptr, size_t size, size_t nmemb, void *stream)
+static size_t read_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
   FILE *f = (FILE *)stream;
   size_t n;
@@ -49,41 +55,42 @@ static size_t readfunc(char *ptr, size_t size, size_t nmemb, void *stream)
  */
 static curl_off_t sftpGetRemoteFileSize(const char *i_remoteFile)
 {
-  CURLcode result = CURLE_GOT_NOTHING;
   curl_off_t remoteFileSizeByte = -1;
-  CURL *curlHandlePtr = curl_easy_init();
+  CURL *curl = curl_easy_init();
 
-  curl_easy_setopt(curlHandlePtr, CURLOPT_VERBOSE, 1L);
+  if(curl) {
+    CURLcode result;
 
-  curl_easy_setopt(curlHandlePtr, CURLOPT_URL, i_remoteFile);
-  curl_easy_setopt(curlHandlePtr, CURLOPT_NOPROGRESS, 1);
-  curl_easy_setopt(curlHandlePtr, CURLOPT_NOBODY, 1);
-  curl_easy_setopt(curlHandlePtr, CURLOPT_HEADER, 1);
-  curl_easy_setopt(curlHandlePtr, CURLOPT_FILETIME, 1);
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  result = curl_easy_perform(curlHandlePtr);
-  if(CURLE_OK == result) {
-    result = curl_easy_getinfo(curlHandlePtr,
-                               CURLINFO_CONTENT_LENGTH_DOWNLOAD_T,
-                               &remoteFileSizeByte);
-    if(result)
-      return -1;
-    printf("filesize: %lu\n", (unsigned long)remoteFileSizeByte);
+    curl_easy_setopt(curl, CURLOPT_URL, i_remoteFile);
+    curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 1L);
+    curl_easy_setopt(curl, CURLOPT_NOBODY, 1L);
+    curl_easy_setopt(curl, CURLOPT_HEADER, 1L);
+    curl_easy_setopt(curl, CURLOPT_FILETIME, 1L);
+
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      result = curl_easy_getinfo(curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD_T,
+                                 &remoteFileSizeByte);
+      if(result != CURLE_OK)
+        return -1;
+      printf("filesize: %" CURL_FORMAT_CURL_OFF_T "\n", remoteFileSizeByte);
+    }
+    curl_easy_cleanup(curl);
   }
-  curl_easy_cleanup(curlHandlePtr);
 
   return remoteFileSizeByte;
 }
 
-
-static int sftpResumeUpload(CURL *curlhandle, const char *remotepath,
+static int sftpResumeUpload(CURL *curl, const char *remotepath,
                             const char *localpath)
 {
   FILE *f = NULL;
   CURLcode result = CURLE_GOT_NOTHING;
 
   curl_off_t remoteFileSizeByte = sftpGetRemoteFileSize(remotepath);
-  if(-1 == remoteFileSizeByte) {
+  if(remoteFileSizeByte == -1) {
     printf("Error reading the remote file size: unable to resume upload\n");
     return -1;
   }
@@ -94,18 +101,18 @@ static int sftpResumeUpload(CURL *curlhandle, const char *remotepath,
     return 0;
   }
 
-  curl_easy_setopt(curlhandle, CURLOPT_UPLOAD, 1L);
-  curl_easy_setopt(curlhandle, CURLOPT_URL, remotepath);
-  curl_easy_setopt(curlhandle, CURLOPT_READFUNCTION, readfunc);
-  curl_easy_setopt(curlhandle, CURLOPT_READDATA, f);
+  curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+  curl_easy_setopt(curl, CURLOPT_URL, remotepath);
+  curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
+  curl_easy_setopt(curl, CURLOPT_READDATA, f);
 
 #ifdef _WIN32
   _fseeki64(f, remoteFileSizeByte, SEEK_SET);
 #else
   fseek(f, (long)remoteFileSizeByte, SEEK_SET);
 #endif
-  curl_easy_setopt(curlhandle, CURLOPT_APPEND, 1L);
-  result = curl_easy_perform(curlhandle);
+  curl_easy_setopt(curl, CURLOPT_APPEND, 1L);
+  result = curl_easy_perform(curl);
 
   fclose(f);
 
@@ -119,18 +126,23 @@ static int sftpResumeUpload(CURL *curlhandle, const char *remotepath,
 
 int main(void)
 {
-  const char *remote = "sftp://user:pass@example.com/path/filename";
-  const char *filename = "filename";
-  CURL *curlhandle = NULL;
+  CURL *curl = NULL;
 
-  curl_global_init(CURL_GLOBAL_ALL);
-  curlhandle = curl_easy_init();
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  if(!sftpResumeUpload(curlhandle, remote, filename)) {
-    printf("resumed upload using curl %s failed\n", curl_version());
+  curl = curl_easy_init();
+  if(curl) {
+    const char *remote = "sftp://user:pass@example.com/path/filename";
+    const char *filename = "filename";
+
+    if(!sftpResumeUpload(curl, remote, filename)) {
+      printf("resumed upload using curl %s failed\n", curl_version());
+    }
+
+    curl_easy_cleanup(curl);
   }
-
-  curl_easy_cleanup(curlhandle);
   curl_global_cleanup();
 
   return 0;
diff --git a/third-party/curl/docs/examples/shared-connection-cache.c b/third-party/curl/docs/examples/shared-connection-cache.c
index 26bfb1a461..00ebc3b759 100644
--- a/third-party/curl/docs/examples/shared-connection-cache.c
+++ b/third-party/curl/docs/examples/shared-connection-cache.c
@@ -26,21 +26,22 @@
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
-static void my_lock(CURL *handle, curl_lock_data data,
-                    curl_lock_access laccess, void *useptr)
+static void my_lock(CURL *curl, curl_lock_data data, curl_lock_access laccess,
+                    void *useptr)
 {
-  (void)handle;
+  (void)curl;
   (void)data;
   (void)laccess;
   (void)useptr;
   fprintf(stderr, "-> Mutex lock\n");
 }
 
-static void my_unlock(CURL *handle, curl_lock_data data, void *useptr)
+static void my_unlock(CURL *curl, curl_lock_data data, void *useptr)
 {
-  (void)handle;
+  (void)curl;
   (void)data;
   (void)useptr;
   fprintf(stderr, "<- Mutex unlock\n");
@@ -51,31 +52,33 @@ int main(void)
   CURLSH *share;
   int i;
 
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
   share = curl_share_init();
   curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_CONNECT);
 
   curl_share_setopt(share, CURLSHOPT_LOCKFUNC, my_lock);
   curl_share_setopt(share, CURLSHOPT_UNLOCKFUNC, my_unlock);
 
-  /* Loop the transfer and cleanup the handle properly every lap. This will
-     still reuse connections since the pool is in the shared object! */
+  /* Loop the transfer and cleanup the handle properly every lap. This still
+     reuses connections since the pool is in the shared object! */
 
   for(i = 0; i < 3; i++) {
     CURL *curl = curl_easy_init();
     if(curl) {
-      CURLcode res;
-
       curl_easy_setopt(curl, CURLOPT_URL, "https://curl.se/");
 
       /* use the share object */
       curl_easy_setopt(curl, CURLOPT_SHARE, share);
 
-      /* Perform the request, res will get the return code */
-      res = curl_easy_perform(curl);
+      /* Perform the request, result gets the return code */
+      result = curl_easy_perform(curl);
       /* Check for errors */
-      if(res != CURLE_OK)
+      if(result != CURLE_OK)
         fprintf(stderr, "curl_easy_perform() failed: %s\n",
-                curl_easy_strerror(res));
+                curl_easy_strerror(result));
 
       /* always cleanup */
       curl_easy_cleanup(curl);
@@ -83,5 +86,6 @@ int main(void)
   }
 
   curl_share_cleanup(share);
-  return 0;
+  curl_global_cleanup();
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/simple.c b/third-party/curl/docs/examples/simple.c
index 8579b0ba54..b7b48d7777 100644
--- a/third-party/curl/docs/examples/simple.c
+++ b/third-party/curl/docs/examples/simple.c
@@ -22,16 +22,20 @@
  *
  ***************************************************************************/
 /* <DESC>
- * Very simple HTTP GET
+ * Simple HTTP GET
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -39,15 +43,16 @@ int main(void)
     /* example.com is redirected, so we tell libcurl to follow redirection */
     curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
+  curl_global_cleanup();
   return 0;
 }
diff --git a/third-party/curl/docs/examples/simplepost.c b/third-party/curl/docs/examples/simplepost.c
index 89435afa62..d2540151ce 100644
--- a/third-party/curl/docs/examples/simplepost.c
+++ b/third-party/curl/docs/examples/simplepost.c
@@ -22,38 +22,42 @@
  *
  ***************************************************************************/
 /* <DESC>
- * Very simple HTTP POST
+ * Simple HTTP POST
  * </DESC>
  */
 #include <stdio.h>
 #include <string.h>
+
 #include <curl/curl.h>
 
 int main(void)
 {
-  CURL *curl;
-  CURLcode res;
-
   static const char *postthis = "moo mooo moo moo";
 
+  CURL *curl;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
   curl = curl_easy_init();
   if(curl) {
     curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
     curl_easy_setopt(curl, CURLOPT_POSTFIELDS, postthis);
 
-    /* if we do not provide POSTFIELDSIZE, libcurl will strlen() by
-       itself */
+    /* if we do not provide POSTFIELDSIZE, libcurl calls strlen() by itself */
     curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(postthis));
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
-  return 0;
+  curl_global_cleanup();
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/simplessl.c b/third-party/curl/docs/examples/simplessl.c
index 1be805cc3b..43fe34cf3f 100644
--- a/third-party/curl/docs/examples/simplessl.c
+++ b/third-party/curl/docs/examples/simplessl.c
@@ -22,9 +22,15 @@
  *
  ***************************************************************************/
 /* <DESC>
- * Shows HTTPS usage with client certs and optional ssl engine use.
+ * Shows HTTPS usage with client certs and optional SSL engine use.
  * </DESC>
  */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for fopen() */
+#endif
+#endif
+
 #include <stdio.h>
 
 #include <curl/curl.h>
@@ -38,19 +44,14 @@
    3.2. set pEngine to the name of the crypto engine you use
    3.3. set pKeyName to the key identifier you want to use
    4.   if you do not use a crypto engine:
-   4.1. set pKeyName to the file name of your client key
+   4.1. set pKeyName to the filename of your client key
    4.2. if the format of the key file is DER, set pKeyType to "DER"
-
-   !! verify of the server certificate is not implemented here !!
-
-   **** This example only works with libcurl 7.9.3 and later! ****
-
 */
 
 int main(void)
 {
-  CURL *curl;
-  CURLcode res;
+  CURL *curl = NULL;
+  CURLcode result;
   FILE *headerfile;
   const char *pPassphrase = NULL;
 
@@ -61,83 +62,89 @@ int main(void)
   const char *pKeyName;
   const char *pKeyType;
 
-  const char *pEngine;
-
 #ifdef USE_ENGINE
-  pKeyName  = "rsa_test";
-  pKeyType  = "ENG";
-  pEngine   = "chil";            /* for nChiper HSM... */
+  pKeyName = "rsa_test";
+  pKeyType = "ENG";
 #else
-  pKeyName  = "testkey.pem";
-  pKeyType  = "PEM";
-  pEngine   = NULL;
+  pKeyName = "testkey.pem";
+  pKeyType = "PEM";
 #endif
 
-  headerfile = fopen(pHeaderFile, "wb");
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK) {
+    return (int)result;
+  }
 
-  curl_global_init(CURL_GLOBAL_DEFAULT);
+  headerfile = fopen(pHeaderFile, "wb");
+  if(!headerfile)
+    goto error;
 
   curl = curl_easy_init();
-  if(curl) {
-    /* what call to write: */
-    curl_easy_setopt(curl, CURLOPT_URL, "HTTPS://your.favourite.ssl.site");
-    curl_easy_setopt(curl, CURLOPT_HEADERDATA, headerfile);
+  if(!curl)
+    goto error;
 
-    do { /* dummy loop, just to break out from */
-      if(pEngine) {
-        /* use crypto engine */
-        if(curl_easy_setopt(curl, CURLOPT_SSLENGINE, pEngine) != CURLE_OK) {
-          /* load the crypto engine */
-          fprintf(stderr, "cannot set crypto engine\n");
-          break;
-        }
-        if(curl_easy_setopt(curl, CURLOPT_SSLENGINE_DEFAULT, 1L) != CURLE_OK) {
-          /* set the crypto engine as default */
-          /* only needed for the first time you load
-             a engine in a curl object... */
-          fprintf(stderr, "cannot set crypto engine as default\n");
-          break;
-        }
-      }
-      /* cert is stored PEM coded in file... */
-      /* since PEM is default, we needn't set it for PEM */
-      curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM");
+  /* what call to write: */
+  curl_easy_setopt(curl, CURLOPT_URL, "https://secure.site.example/");
+  curl_easy_setopt(curl, CURLOPT_HEADERDATA, headerfile);
 
-      /* set the cert for client authentication */
-      curl_easy_setopt(curl, CURLOPT_SSLCERT, pCertFile);
-
-      /* sorry, for engine we must set the passphrase
-         (if the key has one...) */
-      if(pPassphrase)
-        curl_easy_setopt(curl, CURLOPT_KEYPASSWD, pPassphrase);
-
-      /* if we use a key stored in a crypto engine,
-         we must set the key type to "ENG" */
-      curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, pKeyType);
-
-      /* set the private key (file or ID in engine) */
-      curl_easy_setopt(curl, CURLOPT_SSLKEY, pKeyName);
-
-      /* set the file with the certs vaildating the server */
-      curl_easy_setopt(curl, CURLOPT_CAINFO, pCACertFile);
-
-      /* disconnect if we cannot validate server's cert */
-      curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
-
-      /* Perform the request, res will get the return code */
-      res = curl_easy_perform(curl);
-      /* Check for errors */
-      if(res != CURLE_OK)
-        fprintf(stderr, "curl_easy_perform() failed: %s\n",
-                curl_easy_strerror(res));
-
-      /* we are done... */
-    } while(0);
-    /* always cleanup */
-    curl_easy_cleanup(curl);
+#ifdef USE_ENGINE
+  /* use crypto engine. nCipher HSM... */
+  if(curl_easy_setopt(curl, CURLOPT_SSLENGINE, "chil") != CURLE_OK) {
+    /* load the crypto engine */
+    fprintf(stderr, "cannot set crypto engine\n");
+    goto error;
   }
+  if(curl_easy_setopt(curl, CURLOPT_SSLENGINE_DEFAULT, 1L) != CURLE_OK) {
+    /* set the crypto engine as default */
+    /* only needed for the first time you load
+       an engine in a curl object... */
+    fprintf(stderr, "cannot set crypto engine as default\n");
+    goto error;
+  }
+#endif
+
+  /* cert is stored PEM coded in file... */
+  /* since PEM is default, we need not set it for PEM */
+  curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM");
+
+  /* set the cert for client authentication */
+  curl_easy_setopt(curl, CURLOPT_SSLCERT, pCertFile);
+
+  /* sorry, for engine we must set the passphrase
+     (if the key has one...) */
+  if(pPassphrase)
+    curl_easy_setopt(curl, CURLOPT_KEYPASSWD, pPassphrase);
+
+  /* if we use a key stored in a crypto engine,
+     we must set the key type to "ENG" */
+  curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, pKeyType);
+
+  /* set the private key (file or ID in engine) */
+  curl_easy_setopt(curl, CURLOPT_SSLKEY, pKeyName);
+
+  /* set the file with the certs validating the server */
+  curl_easy_setopt(curl, CURLOPT_CAINFO, pCACertFile);
+
+  /* disconnect if we cannot validate server's cert */
+  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
+
+  /* Perform the request, result gets the return code */
+  result = curl_easy_perform(curl);
+  /* Check for errors */
+  if(result != CURLE_OK)
+    fprintf(stderr, "curl_easy_perform() failed: %s\n",
+            curl_easy_strerror(result));
+
+error:
+
+  /* always cleanup */
+  if(curl)
+    curl_easy_cleanup(curl);
+
+  if(headerfile)
+    fclose(headerfile);
 
   curl_global_cleanup();
 
-  return 0;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/smooth-gtk-thread.c b/third-party/curl/docs/examples/smooth-gtk-thread.c
index 906660f999..82ce1a2256 100644
--- a/third-party/curl/docs/examples/smooth-gtk-thread.c
+++ b/third-party/curl/docs/examples/smooth-gtk-thread.c
@@ -22,8 +22,8 @@
  *
  ***************************************************************************/
 /* <DESC>
- * A multi threaded application that uses a progress bar to show
- * status.  It uses Gtk+ to make a smooth pulse.
+ * A multi-threaded application that uses a progress bar to show
+ * status. It uses Gtk+ to make a smooth pulse.
  * </DESC>
  */
 /*
@@ -34,7 +34,6 @@
  * gcc -ggdb `pkg-config --cflags  --libs gtk+-2.0` -lcurl -lssl -lcrypto
  *   -lgthread-2.0 -dl  smooth-gtk-thread.c -o smooth-gtk-thread
  */
-
 #include <stdio.h>
 #include <gtk/gtk.h>
 #include <glib.h>
@@ -45,10 +44,10 @@
 
 #define NUMT 4
 
-pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
-int j = 0;
-gint num_urls = 9; /* Just make sure this is less than urls[]*/
-const char * const urls[]= {
+static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
+static int j = 0;
+static gint num_urls = 9; /* make sure this is less than urls[] */
+static const char * const urls[] = {
   "90022",
   "90023",
   "90024",
@@ -60,38 +59,41 @@ const char * const urls[]= {
   "90030"
 };
 
-size_t write_file(void *ptr, size_t size, size_t nmemb, FILE *stream)
+static size_t write_cb(void *ptr, size_t size, size_t nmemb, FILE *stream)
 {
   return fwrite(ptr, size, nmemb, stream);
 }
 
-static void run_one(gchar *http, int j)
+static void run_one(const gchar *http, int j)
 {
-  FILE *outfile = fopen(urls[j], "wb");
   CURL *curl;
 
   curl = curl_easy_init();
   if(curl) {
     printf("j = %d\n", j);
 
-    /* Set the URL and transfer type */
-    curl_easy_setopt(curl, CURLOPT_URL, http);
+    FILE *outfile = fopen(urls[j], "wb");
+    if(outfile) {
+      /* Set the URL and transfer type */
+      curl_easy_setopt(curl, CURLOPT_URL, http);
 
-    /* Write to the file */
-    curl_easy_setopt(curl, CURLOPT_WRITEDATA, outfile);
-    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_file);
-    curl_easy_perform(curl);
+      /* Write to the file */
+      curl_easy_setopt(curl, CURLOPT_WRITEDATA, outfile);
+      curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
+      (void)curl_easy_perform(curl);
 
-    fclose(outfile);
+      fclose(outfile);
+    }
     curl_easy_cleanup(curl);
   }
 }
 
-void *pull_one_url(void *NaN)
+static void *pull_one_url(void *NaN)
 {
   /* protect the reading and increasing of 'j' with a mutex */
   pthread_mutex_lock(&lock);
   while(j < num_urls) {
+    gchar *http;
     int i = j;
     j++;
     pthread_mutex_unlock(&lock);
@@ -106,32 +108,31 @@ void *pull_one_url(void *NaN)
   return NULL;
 }
 
-
-gboolean pulse_bar(gpointer data)
+static gboolean pulse_bar(gpointer data)
 {
   gdk_threads_enter();
-  gtk_progress_bar_pulse(GTK_PROGRESS_BAR (data));
+  gtk_progress_bar_pulse(GTK_PROGRESS_BAR(data));
   gdk_threads_leave();
 
-  /* Return true so the function will be called again;
-   * returning false removes this timeout function.
+  /* Return true so the function is called again; returning false removes this
+   * timeout function.
    */
   return TRUE;
 }
 
-void *create_thread(void *progress_bar)
+static void *create_thread(void *progress_bar)
 {
   pthread_t tid[NUMT];
   int i;
 
-  /* Make sure I do not create more threads than urls. */
-  for(i = 0; i < NUMT && i < num_urls ; i++) {
+  /* Make sure I do not create more threads than URLs. */
+  for(i = 0; i < NUMT && i < num_urls; i++) {
     int error = pthread_create(&tid[i],
                                NULL, /* default attributes please */
                                pull_one_url,
                                NULL);
-    if(0 != error)
-      fprintf(stderr, "Couldn't run thread number %d, errno %d\n", i, error);
+    if(error)
+      fprintf(stderr, "Could not run thread number %d, errno %d\n", i, error);
     else
       fprintf(stderr, "Thread %d, gets %s\n", i, urls[i]);
   }
@@ -151,11 +152,11 @@ void *create_thread(void *progress_bar)
   gtk_widget_destroy(progress_bar);
 
   /* [Un]Comment this out to kill the program rather than pushing close. */
-  /* gtk_main_quit(); */
-
+#if 0
+  gtk_main_quit();
+#endif
 
   return NULL;
-
 }
 
 static gboolean cb_delete(GtkWidget *window, gpointer data)
@@ -164,12 +165,14 @@ static gboolean cb_delete(GtkWidget *window, gpointer data)
   return FALSE;
 }
 
-int main(int argc, char **argv)
+int main(int argc, const char **argv)
 {
   GtkWidget *top_window, *outside_frame, *inside_frame, *progress_bar;
 
   /* Must initialize libcurl before any threads are started */
-  curl_global_init(CURL_GLOBAL_ALL);
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   /* Init thread */
   g_thread_init(NULL);
@@ -194,7 +197,7 @@ int main(int argc, char **argv)
 
   /* Progress bar */
   progress_bar = gtk_progress_bar_new();
-  gtk_progress_bar_pulse(GTK_PROGRESS_BAR (progress_bar));
+  gtk_progress_bar_pulse(GTK_PROGRESS_BAR(progress_bar));
   /* Make uniform pulsing */
   gint pulse_ref = g_timeout_add(300, pulse_bar, progress_bar);
   g_object_set_data(G_OBJECT(progress_bar), "pulse_id",
@@ -204,15 +207,17 @@ int main(int argc, char **argv)
   gtk_widget_show_all(top_window);
   printf("gtk_widget_show_all\n");
 
-  g_signal_connect(G_OBJECT (top_window), "delete-event",
+  g_signal_connect(G_OBJECT(top_window), "delete-event",
                    G_CALLBACK(cb_delete), NULL);
 
-  if(!g_thread_create(&create_thread, progress_bar, FALSE, NULL) != 0)
+  if(!g_thread_create(&create_thread, progress_bar, FALSE, NULL))
     g_warning("cannot create the thread");
 
   gtk_main();
   gdk_threads_leave();
   printf("gdk_threads_leave\n");
 
+  curl_global_cleanup();
+
   return 0;
 }
diff --git a/third-party/curl/docs/examples/smtp-authzid.c b/third-party/curl/docs/examples/smtp-authzid.c
index dc24d7f4d5..fe91ba5e63 100644
--- a/third-party/curl/docs/examples/smtp-authzid.c
+++ b/third-party/curl/docs/examples/smtp-authzid.c
@@ -21,14 +21,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Send email on behalf of another user with SMTP
  * </DESC>
  */
-
 #include <stdio.h>
 #include <string.h>
+
 #include <curl/curl.h>
 
 /*
@@ -41,13 +40,13 @@
 /* The libcurl options want plain addresses, the viewable headers in the mail
  * can get a full name as well.
  */
-#define FROM_ADDR    "<ursel@example.org>"
-#define SENDER_ADDR  "<kurt@example.org>"
-#define TO_ADDR      "<addressee@example.net>"
+#define FROM_ADDR   "<ursel@example.org>"
+#define SENDER_ADDR "<kurt@example.org>"
+#define TO_ADDR     "<addressee@example.net>"
 
-#define FROM_MAIL    "Ursel " FROM_ADDR
-#define SENDER_MAIL  "Kurt " SENDER_ADDR
-#define TO_MAIL      "A Receiver " TO_ADDR
+#define FROM_MAIL   "Ursel " FROM_ADDR
+#define SENDER_MAIL "Kurt " SENDER_ADDR
+#define TO_MAIL     "A Receiver " TO_ADDR
 
 static const char *payload_text =
   "Date: Mon, 29 Nov 2010 21:54:29 +1100\r\n"
@@ -67,40 +66,41 @@ struct upload_status {
   size_t bytes_read;
 };
 
-static size_t payload_source(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
   struct upload_status *upload_ctx = (struct upload_status *)userp;
   const char *data;
   size_t room = size * nmemb;
+  size_t len;
 
-  if((size == 0) || (nmemb == 0) || ((size*nmemb) < 1)) {
+  if((size == 0) || (nmemb == 0) || ((size * nmemb) < 1)) {
     return 0;
   }
 
   data = &payload_text[upload_ctx->bytes_read];
 
-  if(data) {
-    size_t len = strlen(data);
-    if(room < len)
-      len = room;
-    memcpy(ptr, data, len);
-    upload_ctx->bytes_read += len;
+  len = strlen(data);
+  if(room < len)
+    len = room;
+  memcpy(ptr, data, len);
+  upload_ctx->bytes_read += len;
 
-    return len;
-  }
-
-  return 0;
+  return len;
 }
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
-  struct curl_slist *recipients = NULL;
-  struct upload_status upload_ctx = { 0 };
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
+    struct curl_slist *recipients = NULL;
+    struct upload_status upload_ctx = { 0 };
+
     /* This is the URL for your mailserver. In this example we connect to the
        smtp-submission port as we require an authenticated connection. */
     curl_easy_setopt(curl, CURLOPT_URL, "smtp://mail.example.com:587");
@@ -115,8 +115,8 @@ int main(void)
     /* Force PLAIN authentication */
     curl_easy_setopt(curl, CURLOPT_LOGIN_OPTIONS, "AUTH=PLAIN");
 
-    /* Note that this option is not strictly required, omitting it will result
-     * in libcurl sending the MAIL FROM command with empty sender data. All
+    /* Note that this option is not strictly required, omitting it results in
+     * libcurl sending the MAIL FROM command with empty sender data. All
      * autoresponses should have an empty reverse-path, and should be directed
      * to the address in the reverse-path which triggered them. Otherwise,
      * they could cause an endless loop. See RFC 5321 Section 4.5.5 for more
@@ -129,25 +129,25 @@ int main(void)
     recipients = curl_slist_append(recipients, TO_ADDR);
     curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients);
 
-    /* We are using a callback function to specify the payload (the headers and
-     * body of the message). You could just use the CURLOPT_READDATA option to
+    /* We are using a callback function to specify the payload (the headers
+     * and body of the message). You can use the CURLOPT_READDATA option to
      * specify a FILE pointer to read from. */
-    curl_easy_setopt(curl, CURLOPT_READFUNCTION, payload_source);
+    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
     curl_easy_setopt(curl, CURLOPT_READDATA, &upload_ctx);
     curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
 
     /* Send the message */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Free the list of recipients */
     curl_slist_free_all(recipients);
 
-    /* curl will not send the QUIT command until you call cleanup, so you
+    /* curl does not send the QUIT command until you call cleanup, so you
      * should be able to reuse this connection for additional messages
      * (setting CURLOPT_MAIL_FROM and CURLOPT_MAIL_RCPT as required, and
      * calling curl_easy_perform() again. It may not be a good idea to keep
@@ -158,5 +158,7 @@ int main(void)
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/smtp-expn.c b/third-party/curl/docs/examples/smtp-expn.c
index e61b6b4eee..25b560f3ec 100644
--- a/third-party/curl/docs/examples/smtp-expn.c
+++ b/third-party/curl/docs/examples/smtp-expn.c
@@ -21,14 +21,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Expand an SMTP email mailing list
  * </DESC>
  */
-
 #include <stdio.h>
 #include <string.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to expand an email mailing list.
@@ -42,15 +41,19 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
-  struct curl_slist *recipients = NULL;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
+    struct curl_slist *recipients = NULL;
+
     /* This is the URL for your mailserver */
     curl_easy_setopt(curl, CURLOPT_URL, "smtp://mail.example.com");
 
-    /* Note that the CURLOPT_MAIL_RCPT takes a list, not a char array  */
+    /* Note that the CURLOPT_MAIL_RCPT takes a list, not a char array */
     recipients = curl_slist_append(recipients, "Friends");
     curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients);
 
@@ -58,17 +61,17 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "EXPN");
 
     /* Perform the custom request */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Free the list of recipients */
     curl_slist_free_all(recipients);
 
-    /* curl will not send the QUIT command until you call cleanup, so you
+    /* curl does not send the QUIT command until you call cleanup, so you
      * should be able to reuse this connection for additional requests. It may
      * not be a good idea to keep the connection open for a long time though
      * (more than a few minutes may result in the server timing out the
@@ -77,5 +80,7 @@ int main(void)
     curl_easy_cleanup(curl);
   }
 
+  curl_global_cleanup();
+
   return 0;
 }
diff --git a/third-party/curl/docs/examples/smtp-mail.c b/third-party/curl/docs/examples/smtp-mail.c
index 742787824f..b1590fd3af 100644
--- a/third-party/curl/docs/examples/smtp-mail.c
+++ b/third-party/curl/docs/examples/smtp-mail.c
@@ -21,14 +21,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Send email with SMTP
  * </DESC>
  */
-
 #include <stdio.h>
 #include <string.h>
+
 #include <curl/curl.h>
 
 /*
@@ -38,9 +37,9 @@
 /* The libcurl options want plain addresses, the viewable headers in the mail
  * can get a full name as well.
  */
-#define FROM_ADDR    "<sender@example.org>"
-#define TO_ADDR      "<addressee@example.net>"
-#define CC_ADDR      "<info@example.org>"
+#define FROM_ADDR "<sender@example.org>"
+#define TO_ADDR   "<addressee@example.net>"
+#define CC_ADDR   "<info@example.org>"
 
 #define FROM_MAIL "Sender Person " FROM_ADDR
 #define TO_MAIL   "A Receiver " TO_ADDR
@@ -64,45 +63,46 @@ struct upload_status {
   size_t bytes_read;
 };
 
-static size_t payload_source(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
   struct upload_status *upload_ctx = (struct upload_status *)userp;
   const char *data;
   size_t room = size * nmemb;
+  size_t len;
 
-  if((size == 0) || (nmemb == 0) || ((size*nmemb) < 1)) {
+  if((size == 0) || (nmemb == 0) || ((size * nmemb) < 1)) {
     return 0;
   }
 
   data = &payload_text[upload_ctx->bytes_read];
 
-  if(data) {
-    size_t len = strlen(data);
-    if(room < len)
-      len = room;
-    memcpy(ptr, data, len);
-    upload_ctx->bytes_read += len;
+  len = strlen(data);
+  if(room < len)
+    len = room;
+  memcpy(ptr, data, len);
+  upload_ctx->bytes_read += len;
 
-    return len;
-  }
-
-  return 0;
+  return len;
 }
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
-  struct curl_slist *recipients = NULL;
-  struct upload_status upload_ctx = { 0 };
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
+    struct curl_slist *recipients = NULL;
+    struct upload_status upload_ctx = { 0 };
+
     /* This is the URL for your mailserver */
     curl_easy_setopt(curl, CURLOPT_URL, "smtp://mail.example.com");
 
-    /* Note that this option is not strictly required, omitting it will result
-     * in libcurl sending the MAIL FROM command with empty sender data. All
+    /* Note that this option is not strictly required, omitting it results in
+     * libcurl sending the MAIL FROM command with empty sender data. All
      * autoresponses should have an empty reverse-path, and should be directed
      * to the address in the reverse-path which triggered them. Otherwise,
      * they could cause an endless loop. See RFC 5321 Section 4.5.5 for more
@@ -117,25 +117,25 @@ int main(void)
     recipients = curl_slist_append(recipients, CC_ADDR);
     curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients);
 
-    /* We are using a callback function to specify the payload (the headers and
-     * body of the message). You could just use the CURLOPT_READDATA option to
+    /* We are using a callback function to specify the payload (the headers
+     * and body of the message). You can use the CURLOPT_READDATA option to
      * specify a FILE pointer to read from. */
-    curl_easy_setopt(curl, CURLOPT_READFUNCTION, payload_source);
+    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
     curl_easy_setopt(curl, CURLOPT_READDATA, &upload_ctx);
     curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
 
     /* Send the message */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Free the list of recipients */
     curl_slist_free_all(recipients);
 
-    /* curl will not send the QUIT command until you call cleanup, so you
+    /* curl does not send the QUIT command until you call cleanup, so you
      * should be able to reuse this connection for additional messages
      * (setting CURLOPT_MAIL_FROM and CURLOPT_MAIL_RCPT as required, and
      * calling curl_easy_perform() again. It may not be a good idea to keep
@@ -146,5 +146,7 @@ int main(void)
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/smtp-mime.c b/third-party/curl/docs/examples/smtp-mime.c
index 36703a1d82..0ddba4ebb7 100644
--- a/third-party/curl/docs/examples/smtp-mime.c
+++ b/third-party/curl/docs/examples/smtp-mime.c
@@ -21,14 +21,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Send SMTP mime emails
  * </DESC>
  */
-
 #include <stdio.h>
 #include <string.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to send mime mail using libcurl's SMTP
@@ -38,9 +37,9 @@
  * Note that this example requires libcurl 7.56.0 or above.
  */
 
-#define FROM    "<sender@example.org>"
-#define TO      "<addressee@example.net>"
-#define CC      "<info@example.org>"
+#define FROM "<sender@example.org>"
+#define TO   "<addressee@example.net>"
+#define CC   "<info@example.org>"
 
 static const char *headers_text[] = {
   "Date: Tue, 22 Aug 2017 14:08:43 +0100",
@@ -48,7 +47,7 @@ static const char *headers_text[] = {
   "From: " FROM " (Example User)",
   "Cc: " CC " (Another example User)",
   "Message-ID: <dcd7cb36-11db-487a-9f3a-e652a9458efd@"
-    "rfcpedant.example.org>",
+  "rfcpedant.example.org>",
   "Subject: example sending a MIME-formatted message",
   NULL
 };
@@ -67,11 +66,13 @@ static const char inline_html[] =
   "email viewers able to handle HTML.</p>"
   "</body></html>\r\n";
 
-
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -86,8 +87,8 @@ int main(void)
     /* This is the URL for your mailserver */
     curl_easy_setopt(curl, CURLOPT_URL, "smtp://mail.example.com");
 
-    /* Note that this option is not strictly required, omitting it will result
-     * in libcurl sending the MAIL FROM command with empty sender data. All
+    /* Note that this option is not strictly required, omitting it results in
+     * libcurl sending the MAIL FROM command with empty sender data. All
      * autoresponses should have an empty reverse-path, and should be directed
      * to the address in the reverse-path which triggered them. Otherwise,
      * they could cause an endless loop. See RFC 5321 Section 4.5.5 for more
@@ -139,18 +140,18 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_MIMEPOST, mime);
 
     /* Send the message */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Free lists. */
     curl_slist_free_all(recipients);
     curl_slist_free_all(headers);
 
-    /* curl will not send the QUIT command until you call cleanup, so you
+    /* curl does not send the QUIT command until you call cleanup, so you
      * should be able to reuse this connection for additional messages
      * (setting CURLOPT_MAIL_FROM and CURLOPT_MAIL_RCPT as required, and
      * calling curl_easy_perform() again. It may not be a good idea to keep
@@ -164,5 +165,7 @@ int main(void)
     curl_mime_free(mime);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/smtp-multi.c b/third-party/curl/docs/examples/smtp-multi.c
index e5bc4011c1..86545a1ef3 100644
--- a/third-party/curl/docs/examples/smtp-multi.c
+++ b/third-party/curl/docs/examples/smtp-multi.c
@@ -21,13 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Send SMTP email with the multi interface
  * </DESC>
  */
-
 #include <string.h>
+
 #include <curl/curl.h>
 
 /* This is an example showing how to send mail using libcurl's SMTP
@@ -35,9 +34,9 @@
  * libcurl's multi interface.
  */
 
-#define FROM_MAIL     "<sender@example.com>"
-#define TO_MAIL       "<recipient@example.com>"
-#define CC_MAIL       "<info@example.com>"
+#define FROM_MAIL "<sender@example.com>"
+#define TO_MAIL   "<recipient@example.com>"
+#define CC_MAIL   "<info@example.com>"
 
 static const char *payload_text =
   "Date: Mon, 29 Nov 2010 21:54:29 +1100\r\n"
@@ -57,96 +56,97 @@ struct upload_status {
   size_t bytes_read;
 };
 
-static size_t payload_source(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
   struct upload_status *upload_ctx = (struct upload_status *)userp;
   const char *data;
   size_t room = size * nmemb;
+  size_t len;
 
-  if((size == 0) || (nmemb == 0) || ((size*nmemb) < 1)) {
+  if((size == 0) || (nmemb == 0) || ((size * nmemb) < 1)) {
     return 0;
   }
 
   data = &payload_text[upload_ctx->bytes_read];
 
-  if(data) {
-    size_t len = strlen(data);
-    if(room < len)
-      len = room;
-    memcpy(ptr, data, len);
-    upload_ctx->bytes_read += len;
+  len = strlen(data);
+  if(room < len)
+    len = room;
+  memcpy(ptr, data, len);
+  upload_ctx->bytes_read += len;
 
-    return len;
-  }
-
-  return 0;
+  return len;
 }
 
 int main(void)
 {
   CURL *curl;
-  CURLM *mcurl;
-  int still_running = 1;
-  struct curl_slist *recipients = NULL;
-  struct upload_status upload_ctx = { 0 };
 
-  curl_global_init(CURL_GLOBAL_DEFAULT);
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
-  if(!curl)
-    return 1;
+  if(curl) {
+    CURLM *multi;
 
-  mcurl = curl_multi_init();
-  if(!mcurl)
-    return 2;
+    multi = curl_multi_init();
+    if(multi) {
+      int still_running = 1;
+      struct curl_slist *recipients = NULL;
+      struct upload_status upload_ctx = { 0 };
 
-  /* This is the URL for your mailserver */
-  curl_easy_setopt(curl, CURLOPT_URL, "smtp://mail.example.com");
+      /* This is the URL for your mailserver */
+      curl_easy_setopt(curl, CURLOPT_URL, "smtp://mail.example.com");
 
-  /* Note that this option is not strictly required, omitting it will result in
-   * libcurl sending the MAIL FROM command with empty sender data. All
-   * autoresponses should have an empty reverse-path, and should be directed
-   * to the address in the reverse-path which triggered them. Otherwise, they
-   * could cause an endless loop. See RFC 5321 Section 4.5.5 for more details.
-   */
-  curl_easy_setopt(curl, CURLOPT_MAIL_FROM, FROM_MAIL);
+      /* Note that this option is not strictly required, omitting it results
+       * in libcurl sending the MAIL FROM command with empty sender data. All
+       * autoresponses should have an empty reverse-path, and should be
+       * directed to the address in the reverse-path which triggered them.
+       * Otherwise, they could cause an endless loop. See RFC 5321 Section
+       * 4.5.5 for more details.
+       */
+      curl_easy_setopt(curl, CURLOPT_MAIL_FROM, FROM_MAIL);
 
-  /* Add two recipients, in this particular case they correspond to the
-   * To: and Cc: addressees in the header, but they could be any kind of
-   * recipient. */
-  recipients = curl_slist_append(recipients, TO_MAIL);
-  recipients = curl_slist_append(recipients, CC_MAIL);
-  curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients);
+      /* Add two recipients, in this particular case they correspond to the
+       * To: and Cc: addressees in the header, but they could be any kind of
+       * recipient. */
+      recipients = curl_slist_append(recipients, TO_MAIL);
+      recipients = curl_slist_append(recipients, CC_MAIL);
+      curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients);
 
-  /* We are using a callback function to specify the payload (the headers and
-   * body of the message). You could just use the CURLOPT_READDATA option to
-   * specify a FILE pointer to read from. */
-  curl_easy_setopt(curl, CURLOPT_READFUNCTION, payload_source);
-  curl_easy_setopt(curl, CURLOPT_READDATA, &upload_ctx);
-  curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+      /* We are using a callback function to specify the payload (the headers
+       * and body of the message). You can use the CURLOPT_READDATA option to
+       * specify a FILE pointer to read from. */
+      curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
+      curl_easy_setopt(curl, CURLOPT_READDATA, &upload_ctx);
+      curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
 
-  /* Tell the multi stack about our easy handle */
-  curl_multi_add_handle(mcurl, curl);
+      /* Tell the multi stack about our easy handle */
+      curl_multi_add_handle(multi, curl);
 
-  do {
-    CURLMcode mc = curl_multi_perform(mcurl, &still_running);
+      do {
+        CURLMcode mresult = curl_multi_perform(multi, &still_running);
 
-    if(still_running)
-      /* wait for activity, timeout or "nothing" */
-      mc = curl_multi_poll(mcurl, NULL, 0, 1000, NULL);
+        if(still_running)
+          /* wait for activity, timeout or "nothing" */
+          mresult = curl_multi_poll(multi, NULL, 0, 1000, NULL);
 
-    if(mc)
-      break;
+        if(mresult)
+          break;
 
-  } while(still_running);
+      } while(still_running);
 
-  /* Free the list of recipients */
-  curl_slist_free_all(recipients);
+      /* Free the list of recipients */
+      curl_slist_free_all(recipients);
+
+      /* Always cleanup */
+      curl_multi_remove_handle(multi, curl);
+      curl_multi_cleanup(multi);
+    }
+    curl_easy_cleanup(curl);
+  }
 
-  /* Always cleanup */
-  curl_multi_remove_handle(mcurl, curl);
-  curl_multi_cleanup(mcurl);
-  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
   return 0;
diff --git a/third-party/curl/docs/examples/smtp-ssl.c b/third-party/curl/docs/examples/smtp-ssl.c
index 89708408d7..9cac9ecd52 100644
--- a/third-party/curl/docs/examples/smtp-ssl.c
+++ b/third-party/curl/docs/examples/smtp-ssl.c
@@ -21,14 +21,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Send SMTP email using implicit SSL
  * </DESC>
  */
-
 #include <stdio.h>
 #include <string.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to send mail using libcurl's SMTP
@@ -39,9 +38,9 @@
  * Note that this example requires libcurl 7.20.0 or above.
  */
 
-#define FROM_MAIL     "<sender@example.com>"
-#define TO_MAIL       "<recipient@example.com>"
-#define CC_MAIL       "<info@example.com>"
+#define FROM_MAIL "<sender@example.com>"
+#define TO_MAIL   "<recipient@example.com>"
+#define CC_MAIL   "<info@example.com>"
 
 static const char *payload_text =
   "Date: Mon, 29 Nov 2010 21:54:29 +1100\r\n"
@@ -61,46 +60,47 @@ struct upload_status {
   size_t bytes_read;
 };
 
-static size_t payload_source(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
   struct upload_status *upload_ctx = (struct upload_status *)userp;
   const char *data;
   size_t room = size * nmemb;
+  size_t len;
 
-  if((size == 0) || (nmemb == 0) || ((size*nmemb) < 1)) {
+  if((size == 0) || (nmemb == 0) || ((size * nmemb) < 1)) {
     return 0;
   }
 
   data = &payload_text[upload_ctx->bytes_read];
 
-  if(data) {
-    size_t len = strlen(data);
-    if(room < len)
-      len = room;
-    memcpy(ptr, data, len);
-    upload_ctx->bytes_read += len;
+  len = strlen(data);
+  if(room < len)
+    len = room;
+  memcpy(ptr, data, len);
+  upload_ctx->bytes_read += len;
 
-    return len;
-  }
-
-  return 0;
+  return len;
 }
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
-  struct curl_slist *recipients = NULL;
-  struct upload_status upload_ctx = { 0 };
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
+    struct curl_slist *recipients = NULL;
+    struct upload_status upload_ctx = { 0 };
+
     /* Set username and password */
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
 
     /* This is the URL for your mailserver. Note the use of smtps:// rather
-     * than smtp:// to request a SSL based connection. */
+     * than smtp:// to request an SSL based connection. */
     curl_easy_setopt(curl, CURLOPT_URL, "smtps://mainserver.example.net");
 
     /* If you want to connect to a site who is not using a certificate that is
@@ -115,16 +115,16 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
 #endif
 
-    /* If the site you are connecting to uses a different host name that what
+    /* If the site you are connecting to uses a different hostname than what
      * they have mentioned in their server certificate's commonName (or
-     * subjectAltName) fields, libcurl will refuse to connect. You can skip
-     * this check, but this will make the connection less secure. */
+     * subjectAltName) fields, libcurl refuses to connect. You can skip this
+     * check, but it makes the connection insecure. */
 #ifdef SKIP_HOSTNAME_VERIFICATION
     curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
 #endif
 
-    /* Note that this option is not strictly required, omitting it will result
-     * in libcurl sending the MAIL FROM command with empty sender data. All
+    /* Note that this option is not strictly required, omitting it results in
+     * libcurl sending the MAIL FROM command with empty sender data. All
      * autoresponses should have an empty reverse-path, and should be directed
      * to the address in the reverse-path which triggered them. Otherwise,
      * they could cause an endless loop. See RFC 5321 Section 4.5.5 for more
@@ -139,25 +139,25 @@ int main(void)
     recipients = curl_slist_append(recipients, CC_MAIL);
     curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients);
 
-    /* We are using a callback function to specify the payload (the headers and
-     * body of the message). You could just use the CURLOPT_READDATA option to
+    /* We are using a callback function to specify the payload (the headers
+     * and body of the message). You can use the CURLOPT_READDATA option to
      * specify a FILE pointer to read from. */
-    curl_easy_setopt(curl, CURLOPT_READFUNCTION, payload_source);
+    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
     curl_easy_setopt(curl, CURLOPT_READDATA, &upload_ctx);
     curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
 
-    /* Since the traffic will be encrypted, it is useful to turn on debug
+    /* Since the traffic is encrypted, it is useful to turn on debug
      * information within libcurl to see what is happening during the
      * transfer */
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
     /* Send the message */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Free the list of recipients */
     curl_slist_free_all(recipients);
@@ -166,5 +166,7 @@ int main(void)
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/smtp-tls.c b/third-party/curl/docs/examples/smtp-tls.c
index 83aab69cbb..da452318a6 100644
--- a/third-party/curl/docs/examples/smtp-tls.c
+++ b/third-party/curl/docs/examples/smtp-tls.c
@@ -21,14 +21,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Send SMTP email using implicit TLS
  * </DESC>
  */
-
 #include <stdio.h>
 #include <string.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to send mail using libcurl's SMTP
@@ -39,9 +38,9 @@
  * Note that this example requires libcurl 7.20.0 or above.
  */
 
-#define FROM_MAIL     "<sender@example.com>"
-#define TO_MAIL       "<recipient@example.com>"
-#define CC_MAIL       "<info@example.com>"
+#define FROM_MAIL "<sender@example.com>"
+#define TO_MAIL   "<recipient@example.com>"
+#define CC_MAIL   "<info@example.com>"
 
 static const char *payload_text =
   "Date: Mon, 29 Nov 2010 21:54:29 +1100\r\n"
@@ -61,40 +60,41 @@ struct upload_status {
   size_t bytes_read;
 };
 
-static size_t payload_source(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
   struct upload_status *upload_ctx = (struct upload_status *)userp;
   const char *data;
   size_t room = size * nmemb;
+  size_t len;
 
-  if((size == 0) || (nmemb == 0) || ((size*nmemb) < 1)) {
+  if((size == 0) || (nmemb == 0) || ((size * nmemb) < 1)) {
     return 0;
   }
 
   data = &payload_text[upload_ctx->bytes_read];
 
-  if(data) {
-    size_t len = strlen(data);
-    if(room < len)
-      len = room;
-    memcpy(ptr, data, len);
-    upload_ctx->bytes_read += len;
+  len = strlen(data);
+  if(room < len)
+    len = room;
+  memcpy(ptr, data, len);
+  upload_ctx->bytes_read += len;
 
-    return len;
-  }
-
-  return 0;
+  return len;
 }
 
 int main(void)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
-  struct curl_slist *recipients = NULL;
-  struct upload_status upload_ctx = { 0 };
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
+    struct curl_slist *recipients = NULL;
+    struct upload_status upload_ctx = { 0 };
+
     /* Set username and password */
     curl_easy_setopt(curl, CURLOPT_USERNAME, "user");
     curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret");
@@ -105,12 +105,12 @@ int main(void)
      * matches your server configuration. */
     curl_easy_setopt(curl, CURLOPT_URL, "smtp://mainserver.example.net:587");
 
-    /* In this example, we will start with a plain text connection, and upgrade
-     * to Transport Layer Security (TLS) using the STARTTLS command. Be careful
-     * of using CURLUSESSL_TRY here, because if TLS upgrade fails, the transfer
-     * will continue anyway - see the security discussion in the libcurl
+    /* In this example, we start with a plain text connection, and upgrade to
+     * Transport Layer Security (TLS) using the STARTTLS command. Be careful
+     * of using CURLUSESSL_TRY here, because if TLS upgrade fails, the
+     * transfer continues anyway - see the security discussion in the libcurl
      * tutorial for more details. */
-    curl_easy_setopt(curl, CURLOPT_USE_SSL, (long)CURLUSESSL_ALL);
+    curl_easy_setopt(curl, CURLOPT_USE_SSL, CURLUSESSL_ALL);
 
     /* If your server does not have a valid certificate, then you can disable
      * part of the Transport Layer Security protection by setting the
@@ -125,8 +125,8 @@ int main(void)
      * for more information. */
     curl_easy_setopt(curl, CURLOPT_CAINFO, "/path/to/certificate.pem");
 
-    /* Note that this option is not strictly required, omitting it will result
-     * in libcurl sending the MAIL FROM command with empty sender data. All
+    /* Note that this option is not strictly required, omitting it results in
+     * libcurl sending the MAIL FROM command with empty sender data. All
      * autoresponses should have an empty reverse-path, and should be directed
      * to the address in the reverse-path which triggered them. Otherwise,
      * they could cause an endless loop. See RFC 5321 Section 4.5.5 for more
@@ -141,26 +141,26 @@ int main(void)
     recipients = curl_slist_append(recipients, CC_MAIL);
     curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients);
 
-    /* We are using a callback function to specify the payload (the headers and
-     * body of the message). You could just use the CURLOPT_READDATA option to
+    /* We are using a callback function to specify the payload (the headers
+     * and body of the message). You can use the CURLOPT_READDATA option to
      * specify a FILE pointer to read from. */
-    curl_easy_setopt(curl, CURLOPT_READFUNCTION, payload_source);
+    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
     curl_easy_setopt(curl, CURLOPT_READDATA, &upload_ctx);
     curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
 
-    /* Since the traffic will be encrypted, it is useful to turn on debug
+    /* Since the traffic is encrypted, it is useful to turn on debug
      * information within libcurl to see what is happening during the
      * transfer.
      */
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
     /* Send the message */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Free the list of recipients */
     curl_slist_free_all(recipients);
@@ -169,5 +169,7 @@ int main(void)
     curl_easy_cleanup(curl);
   }
 
-  return (int)res;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/smtp-vrfy.c b/third-party/curl/docs/examples/smtp-vrfy.c
index 70da41b065..65783d6903 100644
--- a/third-party/curl/docs/examples/smtp-vrfy.c
+++ b/third-party/curl/docs/examples/smtp-vrfy.c
@@ -21,14 +21,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* <DESC>
  * Verify an SMTP email address
  * </DESC>
  */
-
 #include <stdio.h>
 #include <string.h>
+
 #include <curl/curl.h>
 
 /* This is a simple example showing how to verify an email address from an
@@ -45,30 +44,34 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
-  struct curl_slist *recipients = NULL;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
+    struct curl_slist *recipients = NULL;
+
     /* This is the URL for your mailserver */
     curl_easy_setopt(curl, CURLOPT_URL, "smtp://mail.example.com");
 
-    /* Note that the CURLOPT_MAIL_RCPT takes a list, not a char array  */
+    /* Note that the CURLOPT_MAIL_RCPT takes a list, not a char array */
     recipients = curl_slist_append(recipients, "<recipient@example.com>");
     curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients);
 
     /* Perform the VRFY */
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
 
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* Free the list of recipients */
     curl_slist_free_all(recipients);
 
-    /* curl will not send the QUIT command until you call cleanup, so you
+    /* curl does not send the QUIT command until you call cleanup, so you
      * should be able to reuse this connection for additional requests. It may
      * not be a good idea to keep the connection open for a long time though
      * (more than a few minutes may result in the server timing out the
@@ -77,5 +80,7 @@ int main(void)
     curl_easy_cleanup(curl);
   }
 
-  return 0;
+  curl_global_cleanup();
+
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/sslbackend.c b/third-party/curl/docs/examples/sslbackend.c
index 76744730f2..20002c4f81 100644
--- a/third-party/curl/docs/examples/sslbackend.c
+++ b/third-party/curl/docs/examples/sslbackend.c
@@ -22,7 +22,7 @@
  *
  ***************************************************************************/
 /* <DESC>
- * Shows HTTPS usage with client certs and optional ssl engine use.
+ * Shows HTTPS usage with client certs and optional SSL engine use.
  * </DESC>
  */
 #include <assert.h>
@@ -38,9 +38,9 @@
  * SSL backend has to be configured).
  *
  *  **** This example only works with libcurl 7.56.0 and later! ****
-*/
+ */
 
-int main(int argc, char **argv)
+int main(int argc, const char **argv)
 {
   const char *name = argc > 1 ? argv[1] : "openssl";
   CURLsslset result;
@@ -49,12 +49,12 @@ int main(int argc, char **argv)
     const curl_ssl_backend **list;
     int i;
 
-    result = curl_global_sslset((curl_sslbackend)-1, NULL, &list);
+    result = curl_global_sslset(CURLSSLBACKEND_NONE, NULL, &list);
     assert(result == CURLSSLSET_UNKNOWN_BACKEND);
 
     for(i = 0; list[i]; i++)
       printf("SSL backend #%d: '%s' (ID: %d)\n",
-             i, list[i]->name, list[i]->id);
+             i, list[i]->name, (int)list[i]->id);
 
     return 0;
   }
@@ -64,7 +64,7 @@ int main(int argc, char **argv)
     result = curl_global_sslset((curl_sslbackend)id, NULL, NULL);
   }
   else
-    result = curl_global_sslset((curl_sslbackend)-1, name, NULL);
+    result = curl_global_sslset(CURLSSLBACKEND_NONE, name, NULL);
 
   if(result == CURLSSLSET_UNKNOWN_BACKEND) {
     fprintf(stderr, "Unknown SSL backend id: %s\n", name);
diff --git a/third-party/curl/docs/examples/synctime.c b/third-party/curl/docs/examples/synctime.c
index fcf25d9411..1157edbe3f 100644
--- a/third-party/curl/docs/examples/synctime.c
+++ b/third-party/curl/docs/examples/synctime.c
@@ -26,170 +26,153 @@
  * </DESC>
  */
 /* This example code only builds as-is on Windows.
- *
- * While Unix/Linux user, you do not need this software.
- * You can achieve the same result as synctime using curl, awk and date.
- * Set proxy as according to your network, but beware of proxy Cache-Control.
- *
- * To set your system clock, root access is required.
- * # date -s "`curl -sI https://nist.time.gov/timezone.cgi?UTC/s/0 \
- *        | awk -F': ' '/Date: / {print $2}'`"
- *
- * To view remote webserver date and time.
- * $ curl -sI https://nist.time.gov/timezone.cgi?UTC/s/0 \
- *        | awk -F': ' '/Date: / {print $2}'
  *
  * Synchronising your computer clock via Internet time server usually relies
  * on DAYTIME, TIME, or NTP protocols. These protocols provide good accurate
- * time synchronization but it does not work well through a
- * firewall/proxy. Some adjustment has to be made to the firewall/proxy for
- * these protocols to work properly.
+ * time synchronization but it does not work well through a firewall/proxy.
+ * Some adjustment has to be made to the firewall/proxy for these protocols to
+ * work properly.
  *
  * There is an indirect method. Since most webserver provide server time in
  * their HTTP header, therefore you could synchronise your computer clock
  * using HTTP protocol which has no problem with firewall/proxy.
  *
  * For this software to work, you should take note of these items.
- * 1. Your firewall/proxy must allow your computer to surf internet.
+ * 1. Your firewall/proxy must allow your computer to surf Internet.
  * 2. Webserver system time must in sync with the NTP time server,
  *    or at least provide an accurate time keeping.
  * 3. Webserver HTTP header does not provide the milliseconds units,
  *    so there is no way to get an accurate time.
  * 4. This software could only provide an accuracy of +- a few seconds,
  *    as Round-Trip delay time is not taken into consideration.
- *    Compensation of network, firewall/proxy delay cannot be simply divide
+ *    Compensation of network, firewall/proxy delay cannot be done by dividing
  *    the Round-Trip delay time by half.
- * 5. Win32 SetSystemTime() API will set your computer clock according to
+ * 5. Win32 SetSystemTime() API sets your computer clock according to
  *    GMT/UTC time. Therefore your computer timezone must be properly set.
  * 6. Webserver data should not be cached by the proxy server. Some
  *    webserver provide Cache-Control to prevent caching.
  *
- * References:
- * https://web.archive.org/web/20100228012139/ \
- *    tf.nist.gov/timefreq/service/its.htm
- * https://web.archive.org/web/20100409024302/ \
- *    tf.nist.gov/timefreq/service/firewall.htm
- *
  * Usage:
- * This software will synchronise your computer clock only when you issue
+ * This software synchronises your computer clock only when you issue
  * it with --synctime. By default, it only display the webserver's clock.
- *
- * Written by: Frank (contributed to libcurl)
- *
- * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
- * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
- *
- * IN NO EVENT SHALL THE AUTHOR OF THIS SOFTWARE BE LIABLE FOR
- * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
- * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
- * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
- * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
- * OF THIS SOFTWARE.
- *
  */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS /* for _snprintf(), fopen(), gmtime(),
+                                   localtime(), sscanf() */
+#endif
+#endif
 
 #include <stdio.h>
+#include <string.h>
 #include <time.h>
-#ifndef __CYGWIN__
-#include <winsock2.h>
-#include <windows.h>
-#endif
+
 #include <curl/curl.h>
 
+#ifdef _WIN32
+#if (defined(_WIN32_WINNT) && (_WIN32_WINNT >= 0x0602)) || \
+  defined(WINAPI_FAMILY)
+#  include <winapifamily.h>
+#  if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP) && \
+     !WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
+#    define CURL_WINDOWS_UWP
+#  endif
+#include <windows.h>
+#endif
+#endif
 
-#define MAX_STRING              256
-#define MAX_STRING1             MAX_STRING + 1
+#if defined(_MSC_VER) && (_MSC_VER < 1900)
+#define snprintf _snprintf
+#endif
 
 #define SYNCTIME_UA "synctime/1.0"
 
-typedef struct
-{
-  char http_proxy[MAX_STRING1];
-  char proxy_user[MAX_STRING1];
-  char timeserver[MAX_STRING1];
-} conf_t;
-
-const char DefaultTimeServer[3][MAX_STRING1] =
-{
-  "https://nist.time.gov/",
-  "https://www.google.com/"
+struct conf {
+  char http_proxy[256];
+  char proxy_user[256];
+  char timeserver[256];
 };
 
-const char *DayStr[] = {"Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"};
-const char *MthStr[] = {"Jan", "Feb", "Mar", "Apr", "May", "Jun",
-                        "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"};
+static int ShowAllHeader;
+static int AutoSyncTime;
+#if defined(_WIN32) && !defined(CURL_WINDOWS_UWP)
+static SYSTEMTIME SYSTime;
+static SYSTEMTIME LOCALTime;
 
-int  ShowAllHeader;
-int  AutoSyncTime;
-SYSTEMTIME SYSTime;
-SYSTEMTIME LOCALTime;
+static const char *DayStr[] = {
+  "Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"
+};
+static const char *MthStr[] = {
+  "Jan", "Feb", "Mar", "Apr", "May", "Jun",
+  "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"
+};
+#endif
 
-#define HTTP_COMMAND_HEAD       0
-#define HTTP_COMMAND_GET        1
-
-
-size_t SyncTime_CURL_WriteOutput(void *ptr, size_t size, size_t nmemb,
-                                 void *stream)
+static size_t write_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
   fwrite(ptr, size, nmemb, stream);
-  return (nmemb*size);
+  return nmemb * size;
 }
 
-size_t SyncTime_CURL_WriteHeader(void *ptr, size_t size, size_t nmemb,
-                                 void *stream)
+/* Remember: do not assume headers are passed on null-terminated! */
+static size_t SyncTime_CURL_WriteHeader(void *ptr, size_t size, size_t nmemb,
+                                        void *stream)
 {
-  char  TmpStr1[26], TmpStr2[26];
-
   (void)stream;
 
   if(ShowAllHeader == 1)
-    fprintf(stderr, "%s", (char *)(ptr));
+    fprintf(stderr, "%.*s", (int)nmemb, (char *)ptr);
 
-  if(strncmp((char *)(ptr), "Date:", 5) == 0) {
+  if((nmemb >= 5) && !strncmp((const char *)ptr, "Date:", 5)) {
     if(ShowAllHeader == 0)
-      fprintf(stderr, "HTTP Server. %s", (char *)(ptr));
+      fprintf(stderr, "HTTP Server. %.*s", (int)nmemb, (char *)ptr);
 
     if(AutoSyncTime == 1) {
+#if defined(_WIN32) && !defined(CURL_WINDOWS_UWP)
+      char TmpStr1[26], TmpStr2[26];
+      int RetVal = 0;
+      char *field = ptr;
       *TmpStr1 = 0;
       *TmpStr2 = 0;
-      if(strlen((char *)(ptr)) > 50) /* Can prevent buffer overflow to
-                                         TmpStr1 & 2? */
-        AutoSyncTime = 0;
-      else {
-        int RetVal = sscanf((char *)(ptr), "Date: %25s %hu %s %hu %hu:%hu:%hu",
-                            TmpStr1, &SYSTime.wDay, TmpStr2, &SYSTime.wYear,
-                            &SYSTime.wHour, &SYSTime.wMinute,
-                            &SYSTime.wSecond);
-
-        if(RetVal == 7) {
-          int i;
-          SYSTime.wMilliseconds = 500;    /* adjust to midpoint, 0.5 sec */
-          for(i = 0; i<12; i++) {
-            if(strcmp(MthStr[i], TmpStr2) == 0) {
-              SYSTime.wMonth = i + 1;
-              break;
-            }
-          }
-          AutoSyncTime = 3;       /* Computer clock will be adjusted */
-        }
-        else {
-          AutoSyncTime = 0;       /* Error in sscanf() fields conversion */
-        }
+      if(nmemb && (field[nmemb - 1] == '\n')) {
+        char header[100];
+        size_t len = nmemb < sizeof(header) ? nmemb : sizeof(header) - 1;
+        memcpy(header, field, len);
+        header[len] = 0; /* null-terminate local copy */
+        RetVal = sscanf(header, "Date: %25s %hu %25s %hu %hu:%hu:%hu",
+                        TmpStr1, &SYSTime.wDay, TmpStr2, &SYSTime.wYear,
+                        &SYSTime.wHour, &SYSTime.wMinute,
+                        &SYSTime.wSecond);
       }
+
+      if(RetVal == 7) {
+        int i;
+        SYSTime.wMilliseconds = 500;  /* adjust to midpoint, 0.5 sec */
+        for(i = 0; i < 12; i++) {
+          if(!strcmp(MthStr[i], TmpStr2)) {
+            SYSTime.wMonth = (WORD)(i + 1);
+            break;
+          }
+        }
+        AutoSyncTime = 3;  /* Computer clock is adjusted */
+      }
+      else {
+        AutoSyncTime = 0;  /* Error in sscanf() fields conversion */
+      }
+#endif
     }
   }
 
-  if(strncmp((char *)(ptr), "X-Cache: HIT", 12) == 0) {
+  if((nmemb >= 12) && !strncmp((const char *)ptr, "X-Cache: HIT", 12)) {
     fprintf(stderr, "ERROR: HTTP Server data is cached."
             " Server Date is no longer valid.\n");
     AutoSyncTime = 0;
   }
-  return (nmemb*size);
+  return nmemb * size;
 }
 
-void SyncTime_CURL_Init(CURL *curl, char *proxy_port,
-                        char *proxy_user_password)
+static void SyncTime_CURL_Init(CURL *curl, const char *proxy_port,
+                               const char *proxy_user_password)
 {
   if(strlen(proxy_port) > 0)
     curl_easy_setopt(curl, CURLOPT_PROXY, proxy_port);
@@ -197,39 +180,28 @@ void SyncTime_CURL_Init(CURL *curl, char *proxy_port,
   if(strlen(proxy_user_password) > 0)
     curl_easy_setopt(curl, CURLOPT_PROXYUSERPWD, proxy_user_password);
 
-#ifdef SYNCTIME_UA
   curl_easy_setopt(curl, CURLOPT_USERAGENT, SYNCTIME_UA);
-#endif
-  curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, SyncTime_CURL_WriteOutput);
+  curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
   curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, SyncTime_CURL_WriteHeader);
 }
 
-int SyncTime_CURL_Fetch(CURL *curl, char *URL_Str, char *OutFileName,
-                        int HttpGetBody)
+static CURLcode SyncTime_CURL_FetchHead(CURL *curl, const char *URL_Str)
 {
-  FILE *outfile;
-  CURLcode res;
-
-  outfile = NULL;
-  if(HttpGetBody == HTTP_COMMAND_HEAD)
-    curl_easy_setopt(curl, CURLOPT_NOBODY, 1L);
-  else {
-    outfile = fopen(OutFileName, "wb");
-    curl_easy_setopt(curl, CURLOPT_WRITEDATA, outfile);
-  }
+  CURLcode result;
 
+  curl_easy_setopt(curl, CURLOPT_NOBODY, 1L);
   curl_easy_setopt(curl, CURLOPT_URL, URL_Str);
-  res = curl_easy_perform(curl);
-  if(outfile)
-    fclose(outfile);
-  return res;  /* (CURLE_OK) */
+
+  result = curl_easy_perform(curl);
+
+  return result; /* CURLE_OK */
 }
 
-void showUsage(void)
+static void showUsage(void)
 {
-  fprintf(stderr, "SYNCTIME: Synchronising computer clock with time server"
+  fprintf(stderr, "synctime: Synchronising computer clock with time server"
           " using HTTP protocol.\n");
-  fprintf(stderr, "Usage   : SYNCTIME [Option]\n");
+  fprintf(stderr, "Usage   : synctime [Option]\n");
   fprintf(stderr, "Options :\n");
   fprintf(stderr, " --server=WEBSERVER        Use this time server instead"
           " of default.\n");
@@ -242,51 +214,44 @@ void showUsage(void)
           " port.\n");
   fprintf(stderr, " --help                    Print this help.\n");
   fprintf(stderr, "\n");
-  return;
 }
 
-int conf_init(conf_t *conf)
+int main(int argc, const char *argv[])
 {
-  int i;
+  CURLcode result;
+  CURL *curl;
+  struct conf conf;
+  int RetValue;
 
-  *conf->http_proxy       = 0;
-  for(i = 0; i<MAX_STRING1; i++)
-    conf->proxy_user[i]     = 0;    /* Clean up password from memory */
-  *conf->timeserver       = 0;
-  return 1;
-}
+  ShowAllHeader = 0;  /* Do not show HTTP Header */
+  AutoSyncTime = 0;   /* Do not synchronise computer clock */
+  RetValue = 0;       /* Successful Exit */
 
-int main(int argc, char *argv[])
-{
-  CURL    *curl;
-  conf_t  conf[1];
-  int     RetValue;
-
-  ShowAllHeader   = 0;    /* Do not show HTTP Header */
-  AutoSyncTime    = 0;    /* Do not synchronise computer clock */
-  RetValue        = 0;    /* Successful Exit */
-  conf_init(conf);
+  memset(&conf, 0, sizeof(conf));
 
   if(argc > 1) {
-    int OptionIndex = 0;
+    int OptionIndex = 1;
     while(OptionIndex < argc) {
-      if(strncmp(argv[OptionIndex], "--server=", 9) == 0)
-        snprintf(conf->timeserver, MAX_STRING, "%s", &argv[OptionIndex][9]);
+      if(!strncmp(argv[OptionIndex], "--server=", 9))
+        snprintf(conf.timeserver, sizeof(conf.timeserver) - 1, "%s",
+                 &argv[OptionIndex][9]);
 
-      if(strcmp(argv[OptionIndex], "--showall") == 0)
+      if(!strcmp(argv[OptionIndex], "--showall"))
         ShowAllHeader = 1;
 
-      if(strcmp(argv[OptionIndex], "--synctime") == 0)
+      if(!strcmp(argv[OptionIndex], "--synctime"))
         AutoSyncTime = 1;
 
-      if(strncmp(argv[OptionIndex], "--proxy-user=", 13) == 0)
-        snprintf(conf->proxy_user, MAX_STRING, "%s", &argv[OptionIndex][13]);
+      if(!strncmp(argv[OptionIndex], "--proxy-user=", 13))
+        snprintf(conf.proxy_user, sizeof(conf.proxy_user) - 1, "%s",
+                 &argv[OptionIndex][13]);
 
-      if(strncmp(argv[OptionIndex], "--proxy=", 8) == 0)
-        snprintf(conf->http_proxy, MAX_STRING, "%s", &argv[OptionIndex][8]);
+      if(!strncmp(argv[OptionIndex], "--proxy=", 8))
+        snprintf(conf.http_proxy, sizeof(conf.http_proxy) - 1, "%s",
+                 &argv[OptionIndex][8]);
 
-      if((strcmp(argv[OptionIndex], "--help") == 0) ||
-          (strcmp(argv[OptionIndex], "/?") == 0)) {
+      if(!strcmp(argv[OptionIndex], "--help") ||
+         !strcmp(argv[OptionIndex], "/?")) {
         showUsage();
         return 0;
       }
@@ -294,11 +259,15 @@ int main(int argc, char *argv[])
     }
   }
 
-  if(*conf->timeserver == 0)     /* Use default server for time information */
-    snprintf(conf->timeserver, MAX_STRING, "%s", DefaultTimeServer[0]);
+  if(*conf.timeserver == 0)  /* Use default server for time information */
+    snprintf(conf.timeserver, sizeof(conf.timeserver) - 1, "%s",
+             "https://www.ntp.org/");
 
   /* Init CURL before usage */
-  curl_global_init(CURL_GLOBAL_ALL);
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
   curl = curl_easy_init();
   if(curl) {
     struct tm *lt;
@@ -308,10 +277,10 @@ int main(int argc, char *argv[])
     time_t tt_gmt;
     double tzonediffFloat;
     int tzonediffWord;
-    char timeBuf[61];
+    char timeBuf[61] = "";
     char tzoneBuf[16];
 
-    SyncTime_CURL_Init(curl, conf->http_proxy, conf->proxy_user);
+    SyncTime_CURL_Init(curl, conf.http_proxy, conf.proxy_user);
 
     /* Calculating time diff between GMT and localtime */
     tt       = time(0);
@@ -320,35 +289,35 @@ int main(int argc, char *argv[])
     gmt      = gmtime(&tt);
     tt_gmt   = mktime(gmt);
     tzonediffFloat = difftime(tt_local, tt_gmt);
-    tzonediffWord  = (int)(tzonediffFloat/3600.0);
+    tzonediffWord = (int)(tzonediffFloat / 3600.0);
 
-    if((double)(tzonediffWord * 3600) == tzonediffFloat)
-      snprintf(tzoneBuf, 15, "%+03d'00'", tzonediffWord);
+    if(tzonediffWord == (int)(tzonediffFloat / 3600.0))
+      snprintf(tzoneBuf, sizeof(tzoneBuf), "%+03d'00'", tzonediffWord);
     else
-      snprintf(tzoneBuf, 15, "%+03d'30'", tzonediffWord);
+      snprintf(tzoneBuf, sizeof(tzoneBuf), "%+03d'30'", tzonediffWord);
 
+#if defined(_WIN32) && !defined(CURL_WINDOWS_UWP)
     /* Get current system time and local time */
     GetSystemTime(&SYSTime);
     GetLocalTime(&LOCALTime);
     snprintf(timeBuf, 60, "%s, %02d %s %04d %02d:%02d:%02d.%03d, ",
              DayStr[LOCALTime.wDayOfWeek], LOCALTime.wDay,
-             MthStr[LOCALTime.wMonth-1], LOCALTime.wYear,
-             LOCALTime.wHour, LOCALTime.wMinute, LOCALTime.wSecond,
-             LOCALTime.wMilliseconds);
+             MthStr[LOCALTime.wMonth - 1], LOCALTime.wYear, LOCALTime.wHour,
+             LOCALTime.wMinute, LOCALTime.wSecond, LOCALTime.wMilliseconds);
+#endif
 
-    fprintf(stderr, "Fetch: %s\n\n", conf->timeserver);
+    fprintf(stderr, "Fetch: %s\n\n", conf.timeserver);
     fprintf(stderr, "Before HTTP. Date: %s%s\n\n", timeBuf, tzoneBuf);
 
     /* HTTP HEAD command to the Webserver */
-    SyncTime_CURL_Fetch(curl, conf->timeserver, "index.htm",
-                        HTTP_COMMAND_HEAD);
+    SyncTime_CURL_FetchHead(curl, conf.timeserver);
 
+#if defined(_WIN32) && !defined(CURL_WINDOWS_UWP)
     GetLocalTime(&LOCALTime);
     snprintf(timeBuf, 60, "%s, %02d %s %04d %02d:%02d:%02d.%03d, ",
              DayStr[LOCALTime.wDayOfWeek], LOCALTime.wDay,
-             MthStr[LOCALTime.wMonth-1], LOCALTime.wYear,
-             LOCALTime.wHour, LOCALTime.wMinute, LOCALTime.wSecond,
-             LOCALTime.wMilliseconds);
+             MthStr[LOCALTime.wMonth - 1], LOCALTime.wYear, LOCALTime.wHour,
+             LOCALTime.wMinute, LOCALTime.wSecond, LOCALTime.wMilliseconds);
     fprintf(stderr, "\nAfter  HTTP. Date: %s%s\n", timeBuf, tzoneBuf);
 
     if(AutoSyncTime == 3) {
@@ -362,16 +331,20 @@ int main(int argc, char *argv[])
         GetLocalTime(&LOCALTime);
         snprintf(timeBuf, 60, "%s, %02d %s %04d %02d:%02d:%02d.%03d, ",
                  DayStr[LOCALTime.wDayOfWeek], LOCALTime.wDay,
-                 MthStr[LOCALTime.wMonth-1], LOCALTime.wYear,
+                 MthStr[LOCALTime.wMonth - 1], LOCALTime.wYear,
                  LOCALTime.wHour, LOCALTime.wMinute, LOCALTime.wSecond,
                  LOCALTime.wMilliseconds);
         fprintf(stderr, "\nNew System's Date: %s%s\n", timeBuf, tzoneBuf);
       }
     }
+#endif
 
     /* Cleanup before exit */
-    conf_init(conf);
+    memset(&conf, 0, sizeof(conf));
     curl_easy_cleanup(curl);
   }
+
+  curl_global_cleanup();
+
   return RetValue;
 }
diff --git a/third-party/curl/docs/examples/threaded-ssl.c b/third-party/curl/docs/examples/threaded-ssl.c
deleted file mode 100644
index f58e447412..0000000000
--- a/third-party/curl/docs/examples/threaded-ssl.c
+++ /dev/null
@@ -1,168 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-/* <DESC>
- * Show the required mutex callback setups for GnuTLS and OpenSSL when using
- * libcurl multi-threaded.
- * </DESC>
- */
-/* A multi-threaded example that uses pthreads and fetches 4 remote files at
- * once over HTTPS. The lock callbacks and stuff assume OpenSSL <1.1 or GnuTLS
- * (libgcrypt) so far.
- *
- * OpenSSL docs for this:
- *   https://www.openssl.org/docs/man1.0.2/man3/CRYPTO_num_locks.html
- * gcrypt docs for this:
- *   https://gnupg.org/documentation/manuals/gcrypt/Multi_002dThreading.html
- */
-
-#define USE_OPENSSL /* or USE_GNUTLS accordingly */
-
-#include <stdio.h>
-#include <pthread.h>
-#include <curl/curl.h>
-
-#define NUMT 4
-
-/* we have this global to let the callback get easy access to it */
-static pthread_mutex_t *lockarray;
-
-#ifdef USE_OPENSSL
-#include <openssl/crypto.h>
-static void lock_callback(int mode, int type, char *file, int line)
-{
-  (void)file;
-  (void)line;
-  if(mode & CRYPTO_LOCK) {
-    pthread_mutex_lock(&(lockarray[type]));
-  }
-  else {
-    pthread_mutex_unlock(&(lockarray[type]));
-  }
-}
-
-static unsigned long thread_id(void)
-{
-  unsigned long ret;
-
-  ret = (unsigned long)pthread_self();
-  return ret;
-}
-
-static void init_locks(void)
-{
-  int i;
-
-  lockarray = (pthread_mutex_t *)OPENSSL_malloc(CRYPTO_num_locks() *
-                                                sizeof(pthread_mutex_t));
-  for(i = 0; i<CRYPTO_num_locks(); i++) {
-    pthread_mutex_init(&(lockarray[i]), NULL);
-  }
-
-  CRYPTO_set_id_callback((unsigned long (*)())thread_id);
-  CRYPTO_set_locking_callback((void (*)())lock_callback);
-}
-
-static void kill_locks(void)
-{
-  int i;
-
-  CRYPTO_set_locking_callback(NULL);
-  for(i = 0; i<CRYPTO_num_locks(); i++)
-    pthread_mutex_destroy(&(lockarray[i]));
-
-  OPENSSL_free(lockarray);
-}
-#endif
-
-#ifdef USE_GNUTLS
-#include <gcrypt.h>
-#include <errno.h>
-
-GCRY_THREAD_OPTION_PTHREAD_IMPL;
-
-void init_locks(void)
-{
-  gcry_control(GCRYCTL_SET_THREAD_CBS);
-}
-
-#define kill_locks()
-#endif
-
-/* List of URLs to fetch.*/
-const char * const urls[]= {
-  "https://www.example.com/",
-  "https://www2.example.com/",
-  "https://www3.example.com/",
-  "https://www4.example.com/",
-};
-
-static void *pull_one_url(void *url)
-{
-  CURL *curl;
-
-  curl = curl_easy_init();
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  /* this example does not verify the server's certificate, which means we
-     might be downloading stuff from an impostor */
-  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
-  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
-  curl_easy_perform(curl); /* ignores error */
-  curl_easy_cleanup(curl);
-
-  return NULL;
-}
-
-int main(int argc, char **argv)
-{
-  pthread_t tid[NUMT];
-  int i;
-  (void)argc; /* we do not use any arguments in this example */
-  (void)argv;
-
-  /* Must initialize libcurl before any threads are started */
-  curl_global_init(CURL_GLOBAL_ALL);
-
-  init_locks();
-
-  for(i = 0; i< NUMT; i++) {
-    int error = pthread_create(&tid[i],
-                               NULL, /* default attributes please */
-                               pull_one_url,
-                               (void *)urls[i]);
-    if(0 != error)
-      fprintf(stderr, "Couldn't run thread number %d, errno %d\n", i, error);
-    else
-      fprintf(stderr, "Thread %d, gets %s\n", i, urls[i]);
-  }
-
-  /* now wait for all threads to terminate */
-  for(i = 0; i< NUMT; i++) {
-    pthread_join(tid[i], NULL);
-    fprintf(stderr, "Thread %d terminated\n", i);
-  }
-
-  kill_locks();
-
-  return 0;
-}
diff --git a/third-party/curl/docs/examples/threaded.c b/third-party/curl/docs/examples/threaded.c
new file mode 100644
index 0000000000..54b315bc57
--- /dev/null
+++ b/third-party/curl/docs/examples/threaded.c
@@ -0,0 +1,116 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/* <DESC>
+ * A multi-threaded program using pthreads to fetch several files at once
+ * </DESC>
+ */
+/* A multi-threaded example that uses pthreads and fetches 4 remote files at
+ * once over HTTPS.
+ *
+ * Recent versions of OpenSSL and GnuTLS are thread-safe by design, assuming
+ * support for the underlying OS threading API is built-in. Older revisions
+ * of this example demonstrated locking callbacks for the SSL library, which
+ * are no longer necessary. An older revision with callbacks can be found at
+ * https://github.com/curl/curl/blob/curl-7_88_1/docs/examples/threaded-ssl.c
+ */
+
+/* Requires: HAVE_THREADS_POSIX */
+/* Also requires TLS support to run */
+
+#include <stdio.h>
+
+#include <pthread.h>
+
+#include <curl/curl.h>
+
+#define NUMT 4
+
+/* List of URLs to fetch. */
+static const char * const urls[NUMT] = {
+  "https://curl.se/",
+  "ftp://example.com/",
+  "https://example.net/",
+  "www.example"
+};
+
+struct targ {
+  const char *url;
+};
+
+static void *pull_one_url(void *p)
+{
+  CURL *curl;
+
+  curl = curl_easy_init();
+  if(curl) {
+    struct targ *targ = p;
+    curl_easy_setopt(curl, CURLOPT_URL, targ->url);
+    (void)curl_easy_perform(curl); /* ignores error */
+    curl_easy_cleanup(curl);
+  }
+
+  return NULL;
+}
+
+/*
+   int pthread_create(pthread_t *new_thread_ID,
+                      const pthread_attr_t *attr,
+                      void * (*start_func)(void *), void *arg);
+*/
+
+int main(void)
+{
+  CURLcode result;
+  pthread_t tid[NUMT];
+  struct targ targs[NUMT];
+  int i;
+
+  /* Must initialize libcurl before any threads are started */
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
+  for(i = 0; i < NUMT; i++) {
+    int error;
+    targs[i].url = urls[i];
+    error = pthread_create(&tid[i],
+                           NULL, /* default attributes please */
+                           pull_one_url,
+                           (void *)&targs[i]);
+    if(error)
+      fprintf(stderr, "Could not run thread number %d, errno %d\n", i, error);
+    else
+      fprintf(stderr, "Thread %d, gets %s\n", i, urls[i]);
+  }
+
+  /* now wait for all threads to terminate */
+  for(i = 0; i < NUMT; i++) {
+    pthread_join(tid[i], NULL);
+    fprintf(stderr, "Thread %d terminated\n", i);
+  }
+
+  curl_global_cleanup();
+
+  return 0;
+}
diff --git a/third-party/curl/docs/examples/unixsocket.c b/third-party/curl/docs/examples/unixsocket.c
index 53c5fd2de8..4a8c34218e 100644
--- a/third-party/curl/docs/examples/unixsocket.c
+++ b/third-party/curl/docs/examples/unixsocket.c
@@ -22,16 +22,17 @@
  *
  ***************************************************************************/
 /* <DESC>
- * Access HTTP server over unix domain socket
+ * Access HTTP server over Unix domain socket
  * </DESC>
  */
 #include <stdio.h>
+
 #include <curl/curl.h>
 
 #ifdef USE_ABSTRACT
 /*
  * The abstract socket namespace is a nonportable Linux extension. The name
- * has no connection with filesystem pathnames.
+ * has no connection with file system pathnames.
  */
 #define ABSTRACT "http-unix-domain"
 #else
@@ -41,7 +42,10 @@
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
@@ -53,15 +57,16 @@ int main(void)
     curl_easy_setopt(curl, CURLOPT_UNIX_SOCKET_PATH, PATH);
 #endif
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
-  return 0;
+  curl_global_cleanup();
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/url2file.c b/third-party/curl/docs/examples/url2file.c
index f95d57464b..ce8805a40e 100644
--- a/third-party/curl/docs/examples/url2file.c
+++ b/third-party/curl/docs/examples/url2file.c
@@ -25,64 +25,77 @@
  * Download a given URL into a local file named page.out.
  * </DESC>
  */
+#ifdef _MSC_VER
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for fopen() */
+#endif
+#endif
+
 #include <stdio.h>
 #include <stdlib.h>
-#include <unistd.h>
 
 #include <curl/curl.h>
 
-static size_t write_data(void *ptr, size_t size, size_t nmemb, void *stream)
+static size_t write_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
   size_t written = fwrite(ptr, size, nmemb, (FILE *)stream);
   return written;
 }
 
-int main(int argc, char *argv[])
+int main(int argc, const char *argv[])
 {
-  CURL *curl_handle;
   static const char *pagefilename = "page.out";
-  FILE *pagefile;
+
+  CURLcode result;
+  CURL *curl;
 
   if(argc < 2) {
     printf("Usage: %s <URL>\n", argv[0]);
     return 1;
   }
 
-  curl_global_init(CURL_GLOBAL_ALL);
-
-  /* init the curl session */
-  curl_handle = curl_easy_init();
-
-  /* set URL to get here */
-  curl_easy_setopt(curl_handle, CURLOPT_URL, argv[1]);
-
-  /* Switch on full protocol/debug output while testing */
-  curl_easy_setopt(curl_handle, CURLOPT_VERBOSE, 1L);
-
-  /* disable progress meter, set to 0L to enable it */
-  curl_easy_setopt(curl_handle, CURLOPT_NOPROGRESS, 1L);
-
-  /* send all data to this function  */
-  curl_easy_setopt(curl_handle, CURLOPT_WRITEFUNCTION, write_data);
-
-  /* open the file */
-  pagefile = fopen(pagefilename, "wb");
-  if(pagefile) {
-
-    /* write the page body to this file handle */
-    curl_easy_setopt(curl_handle, CURLOPT_WRITEDATA, pagefile);
-
-    /* get it! */
-    curl_easy_perform(curl_handle);
-
-    /* close the header file */
-    fclose(pagefile);
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK) {
+    fprintf(stderr, "Could not init curl\n");
+    return (int)result;
   }
 
-  /* cleanup curl stuff */
-  curl_easy_cleanup(curl_handle);
+  /* init the curl session */
+  curl = curl_easy_init();
+  if(curl) {
+    FILE *pagefile;
+
+    /* set URL to get here */
+    curl_easy_setopt(curl, CURLOPT_URL, argv[1]);
+
+    /* Switch on full protocol/debug output while testing */
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+    /* disable progress meter, set to 0L to enable it */
+    curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 1L);
+
+    /* send all data to this function */
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
+
+    /* open the file */
+    pagefile = fopen(pagefilename, "wb");
+    if(pagefile) {
+
+      /* write the page body to this file handle */
+      curl_easy_setopt(curl, CURLOPT_WRITEDATA, pagefile);
+
+      /* get it! */
+      result = curl_easy_perform(curl);
+
+      /* close the header file */
+      fclose(pagefile);
+    }
+
+    /* cleanup curl stuff */
+    curl_easy_cleanup(curl);
+  }
 
   curl_global_cleanup();
 
-  return 0;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/urlapi.c b/third-party/curl/docs/examples/urlapi.c
index 2ed78eb11f..50175da76e 100644
--- a/third-party/curl/docs/examples/urlapi.c
+++ b/third-party/curl/docs/examples/urlapi.c
@@ -34,16 +34,15 @@
 
 int main(void)
 {
-  CURL *curl;
-  CURLcode res;
-
+  CURL *curl = NULL;
   CURLU *urlp;
   CURLUcode uc;
 
-  /* get a curl handle */
-  curl = curl_easy_init();
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  /* init Curl URL */
+  /* init curl URL */
   urlp = curl_url();
   uc = curl_url_set(urlp, CURLUPART_URL,
                     "http://example.com/path/index.html", 0);
@@ -53,6 +52,8 @@ int main(void)
     goto cleanup;
   }
 
+  /* get a curl handle */
+  curl = curl_easy_init();
   if(curl) {
     /* set urlp to use as working URL */
     curl_easy_setopt(curl, CURLOPT_CURLU, urlp);
@@ -61,17 +62,16 @@ int main(void)
     /* only allow HTTP, TFTP and SFTP */
     curl_easy_setopt(curl, CURLOPT_PROTOCOLS_STR, "http,tftp,sftp");
 
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
-
-    goto cleanup;
+              curl_easy_strerror(result));
   }
 
 cleanup:
   curl_url_cleanup(urlp);
   curl_easy_cleanup(curl);
-  return 0;
+  curl_global_cleanup();
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/usercertinmem.c b/third-party/curl/docs/examples/usercertinmem.c
index 12a2b7937b..3e7865780f 100644
--- a/third-party/curl/docs/examples/usercertinmem.c
+++ b/third-party/curl/docs/examples/usercertinmem.c
@@ -22,207 +22,174 @@
  *
  ***************************************************************************/
 /* <DESC>
- * Use an in-memory user certificate and RSA key and retrieve an https page.
+ * Use in-memory user certificate and private key and retrieve an HTTPS page.
  * </DESC>
  */
-/* Written by Ishan SinghLevett, based on Theo Borm's cacertinmem.c.
- * Note that to maintain simplicity this example does not use a CA certificate
- * for peer verification.  However, some form of peer verification
- * must be used in real circumstances when a secure connection is required.
+
+/* Written by Ishan SinghLevett, based on Theo Borm's cacertinmem.c. Note that
+ * to maintain simplicity this example does not use a CA certificate for peer
+ * verification. Some form of peer verification must be used in real
+ * circumstances when a secure connection is required.
  */
 
+/* Requires: USE_OPENSSL */
+
 #include <openssl/ssl.h>
-#include <openssl/x509.h>
-#include <openssl/pem.h>
-#include <curl/curl.h>
+
 #include <stdio.h>
 
-static size_t writefunction(void *ptr, size_t size, size_t nmemb, void *stream)
+#include <curl/curl.h>
+
+static size_t write_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
-  fwrite(ptr, size, nmemb, stream);
-  return (nmemb*size);
+  fwrite(ptr, size, nmemb, (FILE *)stream);
+  return nmemb * size;
 }
 
-static CURLcode sslctx_function(CURL *curl, void *sslctx, void *parm)
+static CURLcode sslctx_function(CURL *curl, void *sslctx, void *pointer)
 {
+  /** This example uses a (fake) certificate and private key **/
+  /* replace the XXX with the actual client/user certificate */
+  static const char mypem[] =
+    "-----BEGIN CERTIFICATE-----\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "-----END CERTIFICATE-----\n";
+
+  /* replace the XXX with the actual private key */
+  static const char mykey[] =
+    "-----BEGIN PRIVATE KEY-----\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "-----END PRIVATE KEY-----\n";
+
+  CURLcode result = CURLE_ABORTED_BY_CALLBACK;
   X509 *cert = NULL;
   BIO *bio = NULL;
   BIO *kbio = NULL;
-  RSA *rsa = NULL;
+  EVP_PKEY *pkey = NULL;
   int ret;
 
-  const char *mypem = /* www.cacert.org */
-    "-----BEGIN CERTIFICATE-----\n"\
-    "MIIHPTCCBSWgAwIBAgIBADANBgkqhkiG9w0BAQQFADB5MRAwDgYDVQQKEwdSb290\n"\
-    "IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNB\n"\
-    "IENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRA\n"\
-    "Y2FjZXJ0Lm9yZzAeFw0wMzAzMzAxMjI5NDlaFw0zMzAzMjkxMjI5NDlaMHkxEDAO\n"\
-    "BgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEi\n"\
-    "MCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJ\n"\
-    "ARYSc3VwcG9ydEBjYWNlcnQub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC\n"\
-    "CgKCAgEAziLA4kZ97DYoB1CW8qAzQIxL8TtmPzHlawI229Z89vGIj053NgVBlfkJ\n"\
-    "8BLPRoZzYLdufujAWGSuzbCtRRcMY/pnCujW0r8+55jE8Ez64AO7NV1sId6eINm6\n"\
-    "zWYyN3L69wj1x81YyY7nDl7qPv4coRQKFWyGhFtkZip6qUtTefWIonvuLwphK42y\n"\
-    "fk1WpRPs6tqSnqxEQR5YYGUFZvjARL3LlPdCfgv3ZWiYUQXw8wWRBB0bF4LsyFe7\n"\
-    "w2t6iPGwcswlWyCR7BYCEo8y6RcYSNDHBS4CMEK4JZwFaz+qOqfrU0j36NK2B5jc\n"\
-    "G8Y0f3/JHIJ6BVgrCFvzOKKrF11myZjXnhCLotLddJr3cQxyYN/Nb5gznZY0dj4k\n"\
-    "epKwDpUeb+agRThHqtdB7Uq3EvbXG4OKDy7YCbZZ16oE/9KTfWgu3YtLq1i6L43q\n"\
-    "laegw1SJpfvbi1EinbLDvhG+LJGGi5Z4rSDTii8aP8bQUWWHIbEZAWV/RRyH9XzQ\n"\
-    "QUxPKZgh/TMfdQwEUfoZd9vUFBzugcMd9Zi3aQaRIt0AUMyBMawSB3s42mhb5ivU\n"\
-    "fslfrejrckzzAeVLIL+aplfKkQABi6F1ITe1Yw1nPkZPcCBnzsXWWdsC4PDSy826\n"\
-    "YreQQejdIOQpvGQpQsgi3Hia/0PsmBsJUUtaWsJx8cTLc6nloQsCAwEAAaOCAc4w\n"\
-    "ggHKMB0GA1UdDgQWBBQWtTIb1Mfz4OaO873SsDrusjkY0TCBowYDVR0jBIGbMIGY\n"\
-    "gBQWtTIb1Mfz4OaO873SsDrusjkY0aF9pHsweTEQMA4GA1UEChMHUm9vdCBDQTEe\n"\
-    "MBwGA1UECxMVaHR0cDovL3d3dy5jYWNlcnQub3JnMSIwIAYDVQQDExlDQSBDZXJ0\n"\
-    "IFNpZ25pbmcgQXV0aG9yaXR5MSEwHwYJKoZIhvcNAQkBFhJzdXBwb3J0QGNhY2Vy\n"\
-    "dC5vcmeCAQAwDwYDVR0TAQH/BAUwAwEB/zAyBgNVHR8EKzApMCegJaAjhiFodHRw\n"\
-    "czovL3d3dy5jYWNlcnQub3JnL3Jldm9rZS5jcmwwMAYJYIZIAYb4QgEEBCMWIWh0\n"\
-    "dHBzOi8vd3d3LmNhY2VydC5vcmcvcmV2b2tlLmNybDA0BglghkgBhvhCAQgEJxYl\n"\
-    "aHR0cDovL3d3dy5jYWNlcnQub3JnL2luZGV4LnBocD9pZD0xMDBWBglghkgBhvhC\n"\
-    "AQ0ESRZHVG8gZ2V0IHlvdXIgb3duIGNlcnRpZmljYXRlIGZvciBGUkVFIGhlYWQg\n"\
-    "b3ZlciB0byBodHRwOi8vd3d3LmNhY2VydC5vcmcwDQYJKoZIhvcNAQEEBQADggIB\n"\
-    "ACjH7pyCArpcgBLKNQodgW+JapnM8mgPf6fhjViVPr3yBsOQWqy1YPaZQwGjiHCc\n"\
-    "nWKdpIevZ1gNMDY75q1I08t0AoZxPuIrA2jxNGJARjtT6ij0rPtmlVOKTV39O9lg\n"\
-    "18p5aTuxZZKmxoGCXJzN600BiqXfEVWqFcofN8CCmHBh22p8lqOOLlQ+TyGpkO/c\n"\
-    "gr/c6EWtTZBzCDyUZbAEmXZ/4rzCahWqlwQ3JNgelE5tDlG+1sSPypZt90Pf6DBl\n"\
-    "Jzt7u0NDY8RD97LsaMzhGY4i+5jhe1o+ATc7iwiwovOVThrLm82asduycPAtStvY\n"\
-    "sONvRUgzEv/+PDIqVPfE94rwiCPCR/5kenHA0R6mY7AHfqQv0wGP3J8rtsYIqQ+T\n"\
-    "SCX8Ev2fQtzzxD72V7DX3WnRBnc0CkvSyqD/HMaMyRa+xMwyN2hzXwj7UfdJUzYF\n"\
-    "CpUCTPJ5GhD22Dp1nPMd8aINcGeGG7MW9S/lpOt5hvk9C8JzC6WZrG/8Z7jlLwum\n"\
-    "GCSNe9FINSkYQKyTYOGWhlC0elnYjyELn8+CkcY7v2vcB5G5l1YjqrZslMZIBjzk\n"\
-    "zk6q5PYvCdxTby78dOs6Y5nCpqyJvKeyRKANihDjbPIky/qbn3BHLt4Ui9SyIAmW\n"\
-    "omTxJBzcoTWcFbLUvFUufQb1nA5V9FrWk9p2rSVzTMVD\n"\
-    "-----END CERTIFICATE-----\n";
-
-/* replace the XXX with the actual RSA key */
-  const char *mykey =
-    "-----BEGIN RSA PRIVATE KEY-----\n"\
-    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"\
-    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"\
-    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"\
-    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"\
-    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"\
-    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"\
-    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"\
-    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"\
-    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"\
-    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"\
-    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"\
-    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"\
-    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"\
-    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"\
-    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"\
-    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"\
-    "-----END RSA PRIVATE KEY-----\n";
-
-  (void)curl; /* avoid warnings */
-  (void)parm; /* avoid warnings */
+  (void)curl;
+  (void)pointer;
 
   /* get a BIO */
-  bio = BIO_new_mem_buf((char *)mypem, -1);
-
+  bio = BIO_new_mem_buf(mypem, sizeof(mypem) - 1);
   if(!bio) {
-    printf("BIO_new_mem_buf failed\n");
+    printf("BIO_new_mem_buf() failed\n");
+    goto out;
   }
 
   /* use it to read the PEM formatted certificate from memory into an X509
-   * structure that SSL can use
-   */
+     structure that SSL can use. */
   cert = PEM_read_bio_X509(bio, NULL, 0, NULL);
   if(!cert) {
-    printf("PEM_read_bio_X509 failed...\n");
+    printf("PEM_read_bio_X509() failed\n");
+    goto out;
   }
 
   /* tell SSL to use the X509 certificate */
-  ret = SSL_CTX_use_certificate((SSL_CTX*)sslctx, cert);
+  ret = SSL_CTX_use_certificate((SSL_CTX *)sslctx, cert);
   if(ret != 1) {
-    printf("Use certificate failed\n");
+    printf("SSL_CTX_use_certificate() failed\n");
+    goto out;
   }
 
-  /* create a bio for the RSA key */
-  kbio = BIO_new_mem_buf((char *)mykey, -1);
+  /* create a bio for the private key */
+  kbio = BIO_new_mem_buf(mykey, sizeof(mykey) - 1);
   if(!kbio) {
-    printf("BIO_new_mem_buf failed\n");
+    printf("BIO_new_mem_buf() failed\n");
+    goto out;
   }
 
-  /* read the key bio into an RSA object */
-  rsa = PEM_read_bio_RSAPrivateKey(kbio, NULL, 0, NULL);
-  if(!rsa) {
-    printf("Failed to create key bio\n");
+  pkey = PEM_read_bio_PrivateKey(kbio, NULL, NULL, NULL);
+  if(!pkey) {
+    printf("PEM_read_bio_PrivateKey() failed\n");
+    goto out;
   }
 
-  /* tell SSL to use the RSA key from memory */
-  ret = SSL_CTX_use_RSAPrivateKey((SSL_CTX*)sslctx, rsa);
+  /* tell SSL to use the private key from memory */
+  ret = SSL_CTX_use_PrivateKey((SSL_CTX *)sslctx, pkey);
   if(ret != 1) {
-    printf("Use Key failed\n");
+    printf("SSL_CTX_use_PrivateKey() failed\n");
+    goto out;
   }
 
-  /* free resources that have been allocated by openssl functions */
+  result = CURLE_OK;
+
+out:
+  /* free resources that have been allocated by OpenSSL functions */
   if(bio)
     BIO_free(bio);
 
   if(kbio)
     BIO_free(kbio);
 
-  if(rsa)
-    RSA_free(rsa);
+  if(pkey)
+    EVP_PKEY_free(pkey);
 
   if(cert)
     X509_free(cert);
 
   /* all set to go */
-  return CURLE_OK;
+  return result;
 }
 
 int main(void)
 {
-  CURL *ch;
-  CURLcode rv;
+  CURL *curl;
 
-  curl_global_init(CURL_GLOBAL_ALL);
-  ch = curl_easy_init();
-  curl_easy_setopt(ch, CURLOPT_VERBOSE, 0L);
-  curl_easy_setopt(ch, CURLOPT_HEADER, 0L);
-  curl_easy_setopt(ch, CURLOPT_NOPROGRESS, 1L);
-  curl_easy_setopt(ch, CURLOPT_NOSIGNAL, 1L);
-  curl_easy_setopt(ch, CURLOPT_WRITEFUNCTION, writefunction);
-  curl_easy_setopt(ch, CURLOPT_WRITEDATA, stdout);
-  curl_easy_setopt(ch, CURLOPT_HEADERFUNCTION, writefunction);
-  curl_easy_setopt(ch, CURLOPT_HEADERDATA, stderr);
-  curl_easy_setopt(ch, CURLOPT_SSLCERTTYPE, "PEM");
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
-  /* both VERIFYPEER and VERIFYHOST are set to 0 in this case because there is
-     no CA certificate */
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 0L);
+    curl_easy_setopt(curl, CURLOPT_HEADER, 0L);
+    curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 1L);
+    curl_easy_setopt(curl, CURLOPT_NOSIGNAL, 1L);
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
+    curl_easy_setopt(curl, CURLOPT_WRITEDATA, stdout);
+    curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, write_cb);
+    curl_easy_setopt(curl, CURLOPT_HEADERDATA, stderr);
+    curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM");
 
-  curl_easy_setopt(ch, CURLOPT_SSL_VERIFYPEER, 0L);
-  curl_easy_setopt(ch, CURLOPT_SSL_VERIFYHOST, 0L);
-  curl_easy_setopt(ch, CURLOPT_URL, "https://www.example.com/");
-  curl_easy_setopt(ch, CURLOPT_SSLKEYTYPE, "PEM");
+    /* both VERIFYPEER and VERIFYHOST are set to 0 in this case because there
+       is no CA certificate */
+    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
 
-  /* first try: retrieve page without user certificate and key -> will fail
-   */
-  rv = curl_easy_perform(ch);
-  if(rv == CURLE_OK) {
-    printf("*** transfer succeeded ***\n");
+    curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");
+    curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, "PEM");
+
+    /* first try: retrieve page without user certificate and key -> fails */
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK)
+      printf("*** transfer succeeded ***\n");
+    else
+      printf("*** transfer failed ***\n");
+
+    /* second try: retrieve page using user certificate and key -> succeeds to
+     * load the certificate and key by installing a function doing the
+     * necessary "modifications" to the SSL CONTEXT before link init
+     */
+    curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, sslctx_function);
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK)
+      printf("*** transfer succeeded ***\n");
+    else
+      printf("*** transfer failed ***\n");
+
+    curl_easy_cleanup(curl);
   }
-  else {
-    printf("*** transfer failed ***\n");
-  }
-
-  /* second try: retrieve page using user certificate and key -> will succeed
-   * load the certificate and key by installing a function doing the necessary
-   * "modifications" to the SSL CONTEXT just before link init
-   */
-  curl_easy_setopt(ch, CURLOPT_SSL_CTX_FUNCTION, sslctx_function);
-  rv = curl_easy_perform(ch);
-  if(rv == CURLE_OK) {
-    printf("*** transfer succeeded ***\n");
-  }
-  else {
-    printf("*** transfer failed ***\n");
-  }
-
-  curl_easy_cleanup(ch);
   curl_global_cleanup();
-  return rv;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/version-check.pl b/third-party/curl/docs/examples/version-check.pl
index 932d154bdb..125c3b5f7e 100644
--- a/third-party/curl/docs/examples/version-check.pl
+++ b/third-party/curl/docs/examples/version-check.pl
@@ -38,37 +38,39 @@
 #    version-check.pl [source file]
 #
 
-open(S, "<../libcurl/symbols-in-versions") || die;
+use strict;
+use warnings;
+
+open(S, "<../libcurl/symbols-in-versions") or die;
 
 my %doc;
 my %rem;
 while(<S>) {
     if(/(^CURL[^ \n]*) *(.*)/) {
-        my ($sym, $rest)=($1, $2);
-        my @a=split(/ +/, $rest);
+        my ($sym, $rest) = ($1, $2);
+        my @a = split(/ +/, $rest);
 
-        $doc{$sym}=$a[0]; # when it was introduced
+        $doc{$sym} = $a[0]; # when it was introduced
 
         if($a[2]) {
             # this symbol is documented to have been present the last time
             # in this release
-            $rem{$sym}=$a[2];
+            $rem{$sym} = $a[2];
         }
     }
-
 }
 
 close(S);
 
 sub age {
-    my ($ver)=@_;
+    my ($ver) = @_;
 
-    my @s=split(/\./, $ver);
-    return $s[0]*10000+$s[1]*100+$s[2];
+    my @s = split(/\./, $ver);
+    return $s[0]*10000+$s[1]*100+($s[2] || 0);
 }
 
 my %used;
-open(C, "<$ARGV[0]") || die;
+open(C, "<$ARGV[0]") or die;
 
 while(<C>) {
     if(/\W(CURL[_A-Z0-9v]+)\W/) {
diff --git a/third-party/curl/docs/examples/websocket-cb.c b/third-party/curl/docs/examples/websocket-cb.c
index 7adbf4489d..e73cc27a3f 100644
--- a/third-party/curl/docs/examples/websocket-cb.c
+++ b/third-party/curl/docs/examples/websocket-cb.c
@@ -28,13 +28,13 @@
 #include <stdio.h>
 #include <curl/curl.h>
 
-static size_t writecb(char *b, size_t size, size_t nitems, void *p)
+static size_t write_cb(char *b, size_t size, size_t nitems, void *p)
 {
-  CURL *easy = p;
+  CURL *curl = p;
   size_t i;
-  const struct curl_ws_frame *frame = curl_ws_meta(easy);
-  fprintf(stderr, "Type: %s\n", frame->flags & CURLWS_BINARY ?
-          "binary" : "text");
+  const struct curl_ws_frame *frame = curl_ws_meta(curl);
+  fprintf(stderr, "Type: %s\n",
+          frame->flags & CURLWS_BINARY ? "binary" : "text");
   fprintf(stderr, "Bytes: %u", (unsigned int)(nitems * size));
   for(i = 0; i < nitems; i++)
     fprintf(stderr, "%02x ", (unsigned char)b[i]);
@@ -44,25 +44,29 @@ static size_t writecb(char *b, size_t size, size_t nitems, void *p)
 int main(void)
 {
   CURL *curl;
-  CURLcode res;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
     curl_easy_setopt(curl, CURLOPT_URL, "wss://example.com");
 
-    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writecb);
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
     /* pass the easy handle to the callback */
     curl_easy_setopt(curl, CURLOPT_WRITEDATA, curl);
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
-  return 0;
+  curl_global_cleanup();
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/websocket-updown.c b/third-party/curl/docs/examples/websocket-updown.c
new file mode 100644
index 0000000000..85a7e74ea3
--- /dev/null
+++ b/third-party/curl/docs/examples/websocket-updown.c
@@ -0,0 +1,128 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/* <DESC>
+ * WebSocket download-only using write callback
+ * </DESC>
+ */
+#include <stdio.h>
+#include <string.h>
+
+#include <curl/curl.h>
+
+static size_t write_cb(char *b, size_t size, size_t nitems, void *p)
+{
+  CURL *curl = p;
+  size_t i;
+  unsigned int blen = (unsigned int)(nitems * size);
+  const struct curl_ws_frame *frame = curl_ws_meta(curl);
+  fprintf(stderr, "Type: %s\n",
+          frame->flags & CURLWS_BINARY ? "binary" : "text");
+  if(frame->flags & CURLWS_BINARY) {
+    fprintf(stderr, "Bytes: %u", blen);
+    for(i = 0; i < nitems; i++)
+      fprintf(stderr, "%02x ", (unsigned char)b[i]);
+    fprintf(stderr, "\n");
+  }
+  else
+    fprintf(stderr, "Text: %.*s\n", (int)blen, b);
+  return nitems;
+}
+
+struct read_ctx {
+  CURL *curl;
+  char buf[1024];
+  size_t blen;
+  size_t nsent;
+};
+
+static size_t read_cb(char *buf, size_t nitems, size_t buflen, void *p)
+{
+  struct read_ctx *ctx = p;
+  size_t len = nitems * buflen;
+  size_t left = ctx->blen - ctx->nsent;
+
+  if(!ctx->nsent) {
+    CURLcode result;
+    /* On first call, set the FRAME information to be used (it defaults to
+     * CURLWS_BINARY otherwise). */
+    result = curl_ws_start_frame(ctx->curl, CURLWS_TEXT,
+                                 (curl_off_t)ctx->blen);
+    if(result != CURLE_OK) {
+      fprintf(stderr, "error starting frame: %d\n", (int)result);
+      return CURL_READFUNC_ABORT;
+    }
+  }
+  fprintf(stderr, "read(len=%d, left=%d)\n", (int)len, (int)left);
+  if(left) {
+    if(left < len)
+      len = left;
+    memcpy(buf, ctx->buf + ctx->nsent, len);
+    ctx->nsent += len;
+    return len;
+  }
+  return 0;
+}
+
+int main(int argc, const char *argv[])
+{
+  CURL *curl;
+  struct read_ctx rctx;
+  const char *payload = "Hello, friend!";
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
+
+  memset(&rctx, 0, sizeof(rctx));
+
+  curl = curl_easy_init();
+  if(curl) {
+    if(argc == 2)
+      curl_easy_setopt(curl, CURLOPT_URL, argv[1]);
+    else
+      curl_easy_setopt(curl, CURLOPT_URL, "wss://example.com");
+
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
+    curl_easy_setopt(curl, CURLOPT_WRITEDATA, curl);
+    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
+    /* tell curl that we want to send the payload */
+    rctx.curl = curl;
+    rctx.blen = strlen(payload);
+    memcpy(rctx.buf, payload, rctx.blen);
+    curl_easy_setopt(curl, CURLOPT_READDATA, &rctx);
+    curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
+    /* Check for errors */
+    if(result != CURLE_OK)
+      fprintf(stderr, "curl_easy_perform() failed: %s\n",
+              curl_easy_strerror(result));
+
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+  curl_global_cleanup();
+  return (int)result;
+}
diff --git a/third-party/curl/docs/examples/websocket.c b/third-party/curl/docs/examples/websocket.c
index dbcd044f5a..953c2f358f 100644
--- a/third-party/curl/docs/examples/websocket.c
+++ b/third-party/curl/docs/examples/websocket.c
@@ -27,57 +27,87 @@
  */
 #include <stdio.h>
 #include <string.h>
+#ifdef _WIN32
+#include <winsock2.h>
+#include <windows.h>
+#define sleep(s) Sleep((DWORD)(s * 1000))
+#else
 #include <unistd.h>
+#endif
+
 #include <curl/curl.h>
 
-static int ping(CURL *curl, const char *send_payload)
+static CURLcode ping(CURL *curl, const char *send_payload)
 {
-  size_t sent;
-  CURLcode result =
-    curl_ws_send(curl, send_payload, strlen(send_payload), &sent, 0,
-                 CURLWS_PING);
-  return (int)result;
+  CURLcode result = CURLE_OK;
+  const char *buf = send_payload;
+  size_t sent, blen = strlen(send_payload);
+
+  while(blen) {
+    result = curl_ws_send(curl, buf, blen, &sent, 0, CURLWS_PING);
+    if(result == CURLE_OK) {
+      buf += sent; /* deduct what was sent */
+      blen -= sent;
+    }
+    else if(result == CURLE_AGAIN) { /* blocked on sending */
+      fprintf(stderr, "ws: sent PING blocked, waiting a second\n");
+      sleep(1); /* either select() on socket or max timeout would
+                   be good here. */
+    }
+    else /* real error sending */
+      break;
+  }
+  if(result == CURLE_OK)
+    fprintf(stderr, "ws: sent PING with payload\n");
+  return result;
 }
 
-static int recv_pong(CURL *curl, const char *expected_payload)
+static CURLcode recv_pong(CURL *curl, const char *expected_payload)
 {
-  size_t rlen;
+  size_t rlen = 0;
   const struct curl_ws_frame *meta;
   char buffer[256];
-  CURLcode result = curl_ws_recv(curl, buffer, sizeof(buffer), &rlen, &meta);
-  if(!result) {
+  CURLcode result;
+
+retry:
+  result = curl_ws_recv(curl, buffer, sizeof(buffer), &rlen, &meta);
+  if(result == CURLE_OK) {
+    /* on small PING content, this example assumes the complete
+     * PONG content arrives in one go. Larger frames arrive
+     * in chunks, however. */
     if(meta->flags & CURLWS_PONG) {
       int same = 0;
-      fprintf(stderr, "ws: got PONG back\n");
       if(rlen == strlen(expected_payload)) {
-        if(!memcmp(expected_payload, buffer, rlen)) {
-          fprintf(stderr, "ws: got the same payload back\n");
+        if(!memcmp(expected_payload, buffer, rlen))
           same = 1;
-        }
       }
-      if(!same)
-        fprintf(stderr, "ws: did NOT get the same payload back\n");
+      fprintf(stderr, "ws: received PONG with %s payload back\n",
+              same ? "same" : "different");
+    }
+    else if(meta->flags & CURLWS_TEXT) {
+      fprintf(stderr, "ws: received TEXT frame '%.*s'\n", (int)rlen, buffer);
+    }
+    else if(meta->flags & CURLWS_BINARY) {
+      fprintf(stderr, "ws: received BINARY frame of %u bytes\n",
+              (unsigned int)rlen);
     }
     else {
-      fprintf(stderr, "recv_pong: got %u bytes rflags %x\n", (int)rlen,
-              meta->flags);
+      /* some other frame arrived. */
+      fprintf(stderr, "ws: received frame of %u bytes rflags %x\n",
+              (unsigned int)rlen, (unsigned int)meta->flags);
+      goto retry;
     }
   }
-  fprintf(stderr, "ws: curl_ws_recv returned %u, received %u\n",
-          (unsigned int)result, (unsigned int)rlen);
-  return (int)result;
-}
-
-static int recv_any(CURL *curl)
-{
-  size_t rlen;
-  const struct curl_ws_frame *meta;
-  char buffer[256];
-  CURLcode result = curl_ws_recv(curl, buffer, sizeof(buffer), &rlen, &meta);
-  if(result)
-    return result;
-
-  return 0;
+  else if(result == CURLE_AGAIN) { /* blocked on receiving */
+    fprintf(stderr, "ws: PONG not there yet, waiting a second\n");
+    sleep(1); /* either select() on socket or max timeout would
+                 be good here. */
+    goto retry;
+  }
+  if(result != CURLE_OK)
+    fprintf(stderr, "ws: curl_ws_recv returned %u, received %u\n",
+            (unsigned int)result, (unsigned int)rlen);
+  return result;
 }
 
 /* close the connection */
@@ -87,45 +117,54 @@ static void websocket_close(CURL *curl)
   (void)curl_ws_send(curl, "", 0, &sent, 0, CURLWS_CLOSE);
 }
 
-static void websocket(CURL *curl)
+static CURLcode websocket(CURL *curl)
 {
+  CURLcode result;
   int i = 0;
   do {
-    recv_any(curl);
-    if(ping(curl, "foobar"))
-      return;
-    if(recv_pong(curl, "foobar")) {
-      return;
-    }
-    sleep(2);
+    result = ping(curl, "foobar");
+    if(result != CURLE_OK)
+      break;
+    result = recv_pong(curl, "foobar");
+    if(result != CURLE_OK)
+      break;
+    sleep(1);
   } while(i++ < 10);
   websocket_close(curl);
+  return result;
 }
 
-int main(void)
+int main(int argc, const char *argv[])
 {
   CURL *curl;
-  CURLcode res;
+
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   curl = curl_easy_init();
   if(curl) {
-    curl_easy_setopt(curl, CURLOPT_URL, "wss://example.com");
+    if(argc == 2)
+      curl_easy_setopt(curl, CURLOPT_URL, argv[1]);
+    else
+      curl_easy_setopt(curl, CURLOPT_URL, "wss://example.com");
 
     curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 2L); /* websocket style */
 
-    /* Perform the request, res will get the return code */
-    res = curl_easy_perform(curl);
+    /* Perform the request, result gets the return code */
+    result = curl_easy_perform(curl);
     /* Check for errors */
-    if(res != CURLE_OK)
+    if(result != CURLE_OK)
       fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
+              curl_easy_strerror(result));
     else {
       /* connected and ready */
-      websocket(curl);
+      result = websocket(curl);
     }
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
-  return 0;
+  curl_global_cleanup();
+  return (int)result;
 }
diff --git a/third-party/curl/docs/examples/xmlstream.c b/third-party/curl/docs/examples/xmlstream.c
index 76a8e48cce..2ad132f282 100644
--- a/third-party/curl/docs/examples/xmlstream.c
+++ b/third-party/curl/docs/examples/xmlstream.c
@@ -32,13 +32,12 @@
  * gcc -Wall -I/usr/local/include xmlstream.c -lcurl -lexpat -o xmlstream
  *
  */
-
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <assert.h>
 
 #include <expat.h>
+
 #include <curl/curl.h>
 
 struct MemoryStruct {
@@ -56,10 +55,13 @@ struct ParserStruct {
 static void startElement(void *userData, const XML_Char *name,
                          const XML_Char **atts)
 {
-  struct ParserStruct *state = (struct ParserStruct *) userData;
+  struct ParserStruct *state = (struct ParserStruct *)userData;
   state->tags++;
   state->depth++;
 
+  (void)name;
+  (void)atts;
+
   /* Get a clean slate for reading in character data. */
   free(state->characters.memory);
   state->characters.memory = NULL;
@@ -68,10 +70,10 @@ static void startElement(void *userData, const XML_Char *name,
 
 static void characterDataHandler(void *userData, const XML_Char *s, int len)
 {
-  struct ParserStruct *state = (struct ParserStruct *) userData;
+  struct ParserStruct *state = (struct ParserStruct *)userData;
   struct MemoryStruct *mem = &state->characters;
 
-  char *ptr = realloc(mem->memory, mem->size + len + 1);
+  char *ptr = realloc(mem->memory, mem->size + (unsigned long)len + 1);
   if(!ptr) {
     /* Out of memory. */
     fprintf(stderr, "Not enough memory (realloc returned NULL).\n");
@@ -81,28 +83,28 @@ static void characterDataHandler(void *userData, const XML_Char *s, int len)
 
   mem->memory = ptr;
   memcpy(&(mem->memory[mem->size]), s, len);
-  mem->size += len;
+  mem->size += (unsigned long)len;
   mem->memory[mem->size] = 0;
 }
 
 static void endElement(void *userData, const XML_Char *name)
 {
-  struct ParserStruct *state = (struct ParserStruct *) userData;
+  struct ParserStruct *state = (struct ParserStruct *)userData;
   state->depth--;
 
   printf("%5lu   %10lu   %s\n", state->depth, state->characters.size, name);
 }
 
-static size_t parseStreamCallback(void *contents, size_t length, size_t nmemb,
-                                  void *userp)
+static size_t write_cb(void *contents, size_t length, size_t nmemb,
+                       void *userp)
 {
-  XML_Parser parser = (XML_Parser) userp;
+  XML_Parser parser = (XML_Parser)userp;
   size_t real_size = length * nmemb;
-  struct ParserStruct *state = (struct ParserStruct *) XML_GetUserData(parser);
+  struct ParserStruct *state = (struct ParserStruct *)XML_GetUserData(parser);
 
   /* Only parse if we are not already in a failure state. */
-  if(state->ok && XML_Parse(parser, contents, real_size, 0) == 0) {
-    int error_code = XML_GetErrorCode(parser);
+  if(state->ok && XML_Parse(parser, contents, (int)real_size, 0) == 0) {
+    enum XML_Error error_code = XML_GetErrorCode(parser);
     fprintf(stderr, "Parsing response buffer of length %lu failed"
             " with error code %d (%s).\n",
             real_size, error_code, XML_ErrorString(error_code));
@@ -114,55 +116,62 @@ static size_t parseStreamCallback(void *contents, size_t length, size_t nmemb,
 
 int main(void)
 {
-  CURL *curl_handle;
-  CURLcode res;
-  XML_Parser parser;
-  struct ParserStruct state;
+  CURL *curl;
 
-  /* Initialize the state structure for parsing. */
-  memset(&state, 0, sizeof(struct ParserStruct));
-  state.ok = 1;
-
-  /* Initialize a namespace-aware parser. */
-  parser = XML_ParserCreateNS(NULL, '\0');
-  XML_SetUserData(parser, &state);
-  XML_SetElementHandler(parser, startElement, endElement);
-  XML_SetCharacterDataHandler(parser, characterDataHandler);
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return (int)result;
 
   /* Initialize a libcurl handle. */
-  curl_global_init(CURL_GLOBAL_DEFAULT);
-  curl_handle = curl_easy_init();
-  curl_easy_setopt(curl_handle, CURLOPT_URL,
-                   "https://www.w3schools.com/xml/simple.xml");
-  curl_easy_setopt(curl_handle, CURLOPT_WRITEFUNCTION, parseStreamCallback);
-  curl_easy_setopt(curl_handle, CURLOPT_WRITEDATA, (void *)parser);
+  curl = curl_easy_init();
+  if(curl) {
+    XML_Parser parser;
+    struct ParserStruct state;
 
-  printf("Depth   Characters   Closing Tag\n");
+    /* Initialize the state structure for parsing. */
+    memset(&state, 0, sizeof(state));
+    state.ok = 1;
 
-  /* Perform the request and any follow-up parsing. */
-  res = curl_easy_perform(curl_handle);
-  if(res != CURLE_OK) {
-    fprintf(stderr, "curl_easy_perform() failed: %s\n",
-            curl_easy_strerror(res));
-  }
-  else if(state.ok) {
-    /* Expat requires one final call to finalize parsing. */
-    if(XML_Parse(parser, NULL, 0, 1) == 0) {
-      int error_code = XML_GetErrorCode(parser);
-      fprintf(stderr, "Finalizing parsing failed with error code %d (%s).\n",
-              error_code, XML_ErrorString(error_code));
+    /* Initialize a namespace-aware parser. */
+    parser = XML_ParserCreateNS(NULL, '\0');
+    XML_SetUserData(parser, &state);
+    XML_SetElementHandler(parser, startElement, endElement);
+    XML_SetCharacterDataHandler(parser, characterDataHandler);
+
+    curl_easy_setopt(curl, CURLOPT_URL,
+                     "https://www.w3schools.com/xml/simple.xml");
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
+    curl_easy_setopt(curl, CURLOPT_WRITEDATA, (void *)parser);
+
+    printf("Depth   Characters   Closing Tag\n");
+
+    /* Perform the request and any follow-up parsing. */
+    result = curl_easy_perform(curl);
+    if(result != CURLE_OK) {
+      fprintf(stderr, "curl_easy_perform() failed: %s\n",
+              curl_easy_strerror(result));
     }
-    else {
-      printf("                     --------------\n");
-      printf("                     %lu tags total\n", state.tags);
+    else if(state.ok) {
+      /* Expat requiresult one final call to finalize parsing. */
+      if(XML_Parse(parser, NULL, 0, 1) == 0) {
+        enum XML_Error error_code = XML_GetErrorCode(parser);
+        fprintf(stderr, "Finalizing parsing failed with error code %d (%s).\n",
+                error_code, XML_ErrorString(error_code));
+      }
+      else {
+        printf("                     --------------\n");
+        printf("                     %lu tags total\n", state.tags);
+      }
     }
+
+    /* Clean up. */
+    free(state.characters.memory);
+    XML_ParserFree(parser);
+
+    curl_easy_cleanup(curl);
   }
 
-  /* Clean up. */
-  free(state.characters.memory);
-  XML_ParserFree(parser);
-  curl_easy_cleanup(curl_handle);
   curl_global_cleanup();
 
-  return 0;
+  return (int)result;
 }
diff --git a/third-party/curl/docs/internals/BUFQ.md b/third-party/curl/docs/internals/BUFQ.md
new file mode 100644
index 0000000000..a977fcc8bd
--- /dev/null
+++ b/third-party/curl/docs/internals/BUFQ.md
@@ -0,0 +1,184 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# bufq
+
+This is an internal module for managing I/O buffers. A `bufq` can be written
+to and read from. It manages read and write positions and has a maximum size.
+
+## read/write
+
+Its basic read/write functions have a similar signature and return code
+handling as many internal curl read and write ones.
+
+```c
+CURLcode Curl_bufq_write(struct bufq *q,
+                         const uint8_t *buf, size_t len,
+                         size_t *pnwritten);
+```
+
+- sets `pnwritten` to the length written into `q` or -1 on error.
+- writing to a full `q` sets `pnwritten` to -1 and returns CURLE_AGAIN
+
+```
+CURLcode Curl_bufq_read(struct bufq *q, uint8_t *buf, size_t len,
+                        size_t *pnread);
+```
+
+- sets `pnread` to the length read from `q` or -1 on error.
+- reading from an empty `q` sets `pnread` to -1 and returns CURLE_AGAIN
+
+To pass data into a `bufq` without an extra copy, read callbacks can be used.
+
+```c
+typedef CURLcode Curl_bufq_reader(void *reader_ctx,
+                                  uint8_t *buf, size_t len,
+                                  size_t *pnread);
+
+CURLcode Curl_bufq_slurp(struct bufq *q, Curl_bufq_reader *reader,
+                         void *reader_ctx, size_t *pnread);
+```
+
+`Curl_bufq_slurp()` invokes the given `reader` callback, passing it its own
+internal buffer memory to write to. It may invoke the `reader` several times,
+as long as it has space and while the `reader` always returns the length that
+was requested. There are variations of `slurp` that call the `reader` at most
+once or only read in a maximum amount of bytes.
+
+The analog mechanism for write out buffer data is:
+
+```c
+typedef CURLcode Curl_bufq_writer(void *writer_ctx,
+                                  const uint8_t *buf, size_t len,
+                                  size_t *pwritten);
+
+CURLcode Curl_bufq_pass(struct bufq *q, Curl_bufq_writer *writer,
+                        void *writer_ctx, size_t *pwritten);
+```
+
+`Curl_bufq_pass()` invokes the `writer`, passing its internal memory and
+remove the amount that `writer` reports.
+
+## peek and skip
+
+It is possible to get access to the memory of data stored in a `bufq` with:
+
+```c
+bool Curl_bufq_peek(struct bufq *q,
+                    const uint8_t **pbuf, size_t *plen);
+```
+
+On returning TRUE, `pbuf` points to internal memory with `plen` bytes that one
+may read. This is only valid until another operation on `bufq` is performed.
+
+Instead of reading `bufq` data, one may skip it:
+
+```c
+void Curl_bufq_skip(struct bufq *q, size_t amount);
+```
+
+This removes `amount` number of bytes from the `bufq`.
+
+## lifetime
+
+`bufq` is initialized and freed similar to the `dynbuf` module. Code using
+`bufq` holds a `struct bufq` somewhere. Before it uses it, it invokes:
+
+```c
+void Curl_bufq_init(struct bufq *q, size_t chunk_size, size_t max_chunks);
+```
+
+The `bufq` is told how many "chunks" of data it shall hold at maximum and how
+large those "chunks" should be. There are some variants of this, allowing for
+more options. How "chunks" are handled in a `bufq` is presented in the section
+about memory management.
+
+The user of the `bufq` has the responsibility to call:
+
+```c
+void Curl_bufq_free(struct bufq *q);
+```
+
+to free all resources held by `q`. It is possible to reset a `bufq` to empty via:
+
+```c
+void Curl_bufq_reset(struct bufq *q);
+```
+
+## memory management
+
+Internally, a `bufq` uses allocation of fixed size, e.g. the "chunk_size", up
+to a maximum number, e.g. "max_chunks". These chunks are allocated on demand,
+therefore writing to a `bufq` may return `CURLE_OUT_OF_MEMORY`. Once the max
+number of chunks are used, the `bufq` reports that it is "full".
+
+Each chunks has a `read` and `write` index. A `bufq` keeps its chunks in a
+list. Reading happens always at the head chunk, writing always goes to the
+tail chunk. When the head chunk becomes empty, it is removed. When the tail
+chunk becomes full, another chunk is added to the end of the list, becoming
+the new tail.
+
+Chunks that are no longer used are returned to a `spare` list by default. If
+the `bufq` is created with option `BUFQ_OPT_NO_SPARES` those chunks are freed
+right away.
+
+If a `bufq` is created with a `bufc_pool`, the no longer used chunks are
+returned to the pool. Also `bufq` asks the pool for a chunk when it needs one.
+More in section "pools".
+
+## empty, full and overflow
+
+One can ask about the state of a `bufq` with methods such as
+`Curl_bufq_is_empty(q)`, `Curl_bufq_is_full(q)`, etc. The amount of data held
+by a `bufq` is the sum of the data in all its chunks. This is what is reported
+by `Curl_bufq_len(q)`.
+
+Note that a `bufq` length and it being "full" are only loosely related. A
+simple example:
+
+* create a `bufq` with chunk_size=1000 and max_chunks=4.
+* write 4000 bytes to it, it reports "full"
+* read 1 bytes from it, it still reports "full"
+* read 999 more bytes from it, and it is no longer "full"
+
+The reason for this is that full really means: *bufq uses max_chunks and the
+last one cannot be written to*.
+
+When you read 1 byte from the head chunk in the example above, the head still
+hold 999 unread bytes. Only when those are also read, can the head chunk be
+removed and a new tail be added.
+
+There is another variation to this. If you initialized a `bufq` with option
+`BUFQ_OPT_SOFT_LIMIT`, it allows writes **beyond** the `max_chunks`. It
+reports **full**, but one can **still** write. This option is necessary, if
+partial writes need to be avoided. It means that you need other checks to keep
+the `bufq` from growing ever larger and larger.
+
+## pools
+
+A `struct bufc_pool` may be used to create chunks for a `bufq` and keep spare
+ones around. It is initialized and used via:
+
+```c
+void Curl_bufcp_init(struct bufc_pool *pool,
+                     size_t chunk_size, size_t spare_max);
+
+void Curl_bufq_initp(struct bufq *q, struct bufc_pool *pool,
+                     size_t max_chunks, int opts);
+```
+
+The pool gets the size and the mount of spares to keep. The `bufq` gets the
+pool and the `max_chunks`. It no longer needs to know the chunk sizes, as
+those are managed by the pool.
+
+A pool can be shared between many `bufq`s, as long as all of them operate in
+the same thread. In curl that would be true for all transfers using the same
+multi handle. The advantages of a pool are:
+
+* when all `bufq`s are empty, only memory for `max_spare` chunks in the pool
+  is used. Empty `bufq`s holds no memory.
+* the latest spare chunk is the first to be handed out again, no matter which
+  `bufq` needs it. This keeps the footprint of "recently used" memory smaller.
diff --git a/third-party/curl/docs/BUFREF.md b/third-party/curl/docs/internals/BUFREF.md
similarity index 75%
rename from third-party/curl/docs/BUFREF.md
rename to third-party/curl/docs/internals/BUFREF.md
index 14f41b38bd..09413dea03 100644
--- a/third-party/curl/docs/BUFREF.md
+++ b/third-party/curl/docs/internals/BUFREF.md
@@ -1,3 +1,9 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # bufref
 
 This is an internal module for handling buffer references. A referenced
@@ -44,15 +50,15 @@ void Curl_bufref_set(struct bufref *br, const void *buffer, size_t length,
 
 Releases the previously referenced buffer, then assigns the new `buffer` to
 the structure, associated with its `destructor` function. The latter can be
-specified as `NULL`: this will be the case when the referenced buffer is
-static.
+specified as `NULL`: this is the case when the referenced buffer is static.
 
 if `buffer` is NULL, `length` must be zero.
 
-## `memdup`
+## `memdup0`
 
 ```c
-CURLcode Curl_bufref_memdup(struct bufref *br, const void *data, size_t length);
+CURLcode Curl_bufref_memdup0(struct bufref *br, const void *data,
+                             size_t length);
 ```
 
 Releases the previously referenced buffer, then duplicates the `length`-byte
@@ -67,7 +73,15 @@ Returns `CURLE_OK` if successful, else `CURLE_OUT_OF_MEMORY`.
 ## `ptr`
 
 ```c
-const unsigned char *Curl_bufref_ptr(const struct bufref *br);
+const char *Curl_bufref_ptr(const struct bufref *br);
+```
+
+Returns a `const char *` to the referenced buffer.
+
+## `uptr`
+
+```c
+const unsigned char *Curl_bufref_uptr(const struct bufref *br);
 ```
 
 Returns a `const unsigned char *` to the referenced buffer.
@@ -79,3 +93,12 @@ size_t Curl_bufref_len(const struct bufref *br);
 ```
 
 Returns the stored length of the referenced buffer.
+
+## `dup`
+
+```c
+char *Curl_bufref_dup(const struct bufref *br);
+```
+
+Returns a strdup() version of the buffer. Note that this assumes that the
+bufref is null-terminated.
diff --git a/third-party/curl/docs/internals/CHECKSRC.md b/third-party/curl/docs/internals/CHECKSRC.md
new file mode 100644
index 0000000000..4719dd6ba6
--- /dev/null
+++ b/third-party/curl/docs/internals/CHECKSRC.md
@@ -0,0 +1,195 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# checksrc
+
+This is the tool we use within the curl project to scan C source code and
+check that it adheres to our [Source Code Style guide](CODE_STYLE.md).
+
+## Usage
+
+    checksrc.pl [options] [file1] [file2] ...
+
+## Command line options
+
+`-W[file]` skip that file and exclude it from being checked. Helpful
+when, for example, one of the files is generated.
+
+`-D[dir]` directory name to prepend to filenames when accessing them.
+
+`-h` shows the help output, that also lists all recognized warnings
+
+## What does `checksrc` warn for?
+
+`checksrc` does not check and verify the code against the entire style guide.
+The script is an effort to detect the most common mistakes and syntax mistakes
+that contributors make before they get accustomed to our code style. Heck,
+many of us regulars do the mistakes too and this script helps us keep the code
+in shape.
+
+    checksrc.pl -h
+
+Lists how to use the script and it lists all existing warnings it has and
+problems it detects. At the time of this writing, the existing `checksrc`
+warnings are:
+
+- `ASSIGNWITHINCONDITION`: Assignment within a conditional expression. The
+  code style mandates the assignment to be done outside of it.
+
+- `ASTERISKNOSPACE`: A pointer was declared like `char* name` instead of the
+  more appropriate `char *name` style. The asterisk should sit next to the
+  name.
+
+- `ASTERISKSPACE`: A pointer was declared like `char * name` instead of the
+  more appropriate `char *name` style. The asterisk should sit right next to
+  the name without a space in between.
+
+- `BADCOMMAND`: There is a bad `checksrc` instruction in the code. See the
+  **Ignore certain warnings** section below for details.
+
+- `BANNEDFUNC`: A banned function was used. The functions sprintf, vsprintf,
+  strcat, strncat, gets are **never** allowed in curl source code.
+
+- `BRACEELSE`: '} else' on the same line. The else is supposed to be on the
+  following line.
+
+- `BRACEPOS`: wrong position for an open brace (`{`).
+
+- `BRACEWHILE`: more than once space between end brace and while keyword
+
+- `COMMANOSPACE`: a comma without following space
+
+- `COPYRIGHT`: the file is missing a copyright statement
+
+- `CPPCOMMENTS`: `//` comment detected, that is not C89 compliant
+
+- `DOBRACE`: only use one space after do before open brace
+
+- `EMPTYLINEBRACE`: found empty line before open brace
+
+- `EQUALSNOSPACE`: no space after `=` sign
+
+- `EQUALSNULL`: comparison with `== NULL` used in if/while. We use `!var`.
+
+- `EXCLAMATIONSPACE`: space found after exclamations mark
+
+- `FOPENMODE`: `curlx_fopen()`, `curlx_freopen()` need a macro for the mode
+  string, use it
+
+- `INDENTATION`: detected a wrong start column for code. Note that this
+  warning only checks some specific places and can certainly miss many bad
+  indentations.
+
+- `LONGLINE`: A line is longer than 79 columns.
+
+- `MULTISPACE`: Multiple spaces were found where only one should be used.
+
+- `NOSPACEEQUALS`: An equals sign was found without preceding space. We prefer
+  `a = 2` and *not* `a=2`.
+
+- `NOTEQUALSZERO`: check found using `!= 0`. We use plain `if(var)`.
+
+- `ONELINECONDITION`: do not put the conditional block on the same line as `if()`
+
+- `OPENCOMMENT`: File ended with a comment (`/*`) still "open".
+
+- `PARENBRACE`: `){` was used without sufficient space in between.
+
+- `RETURNNOSPACE`: `return` was used without space between the keyword and the
+  following value.
+
+- `SEMINOSPACE`: There was no space (or newline) following a semicolon.
+
+- `SIZEOFNOPAREN`: Found use of sizeof without parentheses. We prefer
+  `sizeof(int)` style.
+
+- `SNPRINTF` - Found use of `snprintf()`. Since we use an internal replacement
+  with a different return code etc, we prefer `curl_msnprintf()`.
+
+- `SPACEAFTERPAREN`: there was a space after open parenthesis, `( text`.
+
+- `SPACEBEFORECLOSE`: there was a space before a close parenthesis, `text )`.
+
+- `SPACEBEFORECOMMA`: there was a space before a comma, `one , two`.
+
+- `SPACEBEFOREPAREN`: there was a space before an open parenthesis, `if (`,
+  where one was not expected
+
+- `SPACESEMICOLON`: there was a space before semicolon, ` ;`.
+
+- `TABS`: TAB characters are not allowed
+
+- `TRAILINGSPACE`: Trailing whitespace on the line
+
+- `TYPEDEFSTRUCT`: we frown upon (most) typedefed structs
+
+- `UNUSEDIGNORE`: a `checksrc` inlined warning ignore was asked for but not
+  used, that is an ignore that should be removed or changed to get used.
+
+- `USESAFEFREE`: there was a `curlx_free(var)` call made right before assigning
+  NULL to `var`. We prefer replacing that with `curlx_safefree()`, which is
+  doing these two operations in a single call.
+
+### Extended warnings
+
+Some warnings are computationally expensive to perform, so they are turned off
+by default. To enable these warnings, place a `.checksrc` file in the directory
+where they should be activated with commands to enable the warnings you are
+interested in. The format of the file is to enable one warning per line like
+so: `enable <EXTENDEDWARNING>`
+
+Currently these are the extended warnings which can be enabled:
+
+- `COPYRIGHTYEAR`: the current changeset has not updated the copyright year in
+  the source file
+
+- `STRERROR`: use of banned function strerror()
+
+- `STDERR`: use of banned variable `stderr`
+
+## Ignore certain warnings
+
+Due to the nature of the source code and the flaws of the `checksrc` tool,
+there is sometimes a need to ignore specific warnings. `checksrc` allows a few
+different ways to do this.
+
+### Inline ignore
+
+You can control what to ignore within a specific source file by providing
+instructions to `checksrc` in the source code itself. See examples below. The
+instruction can ask to ignore a specific warning a specific number of times or
+you ignore all of them until you mark the end of the ignored section.
+
+Inline ignores are only done for that single specific source code file.
+
+Example
+
+    /* !checksrc! disable LONGLINE all */
+
+This ignores the warning for overly long lines until it is re-enabled with:
+
+    /* !checksrc! enable LONGLINE */
+
+If the enabling is not performed before the end of the file, it is enabled
+again automatically for the next file.
+
+You can also opt to ignore N violations so that if you have a single long line
+you cannot shorten and is agreed to be fine anyway:
+
+    /* !checksrc! disable LONGLINE 1 */
+
+... and the warning for long lines is enabled again automatically after it has
+ignored that single warning. The number `1` can of course be changed to any
+other integer number. It can be used to make sure only the exact intended
+instances are ignored and nothing extra.
+
+### Directory wide ignore patterns
+
+This is a method we have transitioned away from. Use inline ignores as far as
+possible.
+
+Make a `checksrc.skip` file in the directory of the source code with the
+false positive, and include the full offending line into this file.
diff --git a/third-party/curl/docs/internals/CLIENT-READERS.md b/third-party/curl/docs/internals/CLIENT-READERS.md
new file mode 100644
index 0000000000..11cf86da68
--- /dev/null
+++ b/third-party/curl/docs/internals/CLIENT-READERS.md
@@ -0,0 +1,206 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# curl client readers
+
+Client readers is a design in the internals of libcurl, not visible in its
+public API. They were started in curl v8.7.0. This document describes
+the concepts, its high level implementation and the motivations.
+
+## Naming
+
+`libcurl` operates between clients and servers. A *client* is the application
+using libcurl, like the command line tool `curl` itself. Data to be uploaded
+to a server is **read** from the client and **sent** to the server, the servers
+response is **received** by `libcurl` and then **written** to the client.
+
+With this naming established, client readers are concerned with providing data
+from the application to the server. Applications register callbacks via
+`CURLOPT_READFUNCTION`, data via `CURLOPT_POSTFIELDS` and other options to be
+used by `libcurl` when the request is send.
+
+## Invoking
+
+The transfer loop that sends and receives, is using `Curl_client_read()` to get
+more data to send for a transfer. If no specific reader has been installed yet,
+the default one that uses `CURLOPT_READFUNCTION` is added. The prototype is
+
+```c
+CURLcode Curl_client_read(struct Curl_easy *data, char *buf, size_t blen,
+                          size_t *nread, bool *eos);
+```
+The arguments are the transfer to read for, a buffer to hold the read data, its
+length, the actual number of bytes placed into the buffer and the `eos` (*end of
+stream*) flag indicating that no more data is available. The `eos` flag may be
+set for a read amount, if that amount was the last. That way curl can avoid to
+read an additional time.
+
+The implementation of `Curl_client_read()` uses a chain of *client reader*
+instances to get the data. This is similar to the design of *client writers*.
+The chain of readers allows processing of the data to send.
+
+The definition of a reader is:
+
+```c
+struct Curl_crtype {
+  const char *name;        /* writer name. */
+  CURLcode (*do_init)(struct Curl_easy *data, struct Curl_creader *writer);
+  CURLcode (*do_read)(struct Curl_easy *data, struct Curl_creader *reader,
+                      char *buf, size_t blen, size_t *nread, bool *eos);
+  void (*do_close)(struct Curl_easy *data, struct Curl_creader *reader);
+  bool (*needs_rewind)(struct Curl_easy *data, struct Curl_creader *reader);
+  curl_off_t (*total_length)(struct Curl_easy *data,
+                             struct Curl_creader *reader);
+  CURLcode (*resume_from)(struct Curl_easy *data,
+                          struct Curl_creader *reader, curl_off_t offset);
+  CURLcode (*rewind)(struct Curl_easy *data, struct Curl_creader *reader);
+};
+
+struct Curl_creader {
+  const struct Curl_crtype *crt;  /* type implementation */
+  struct Curl_creader *next;  /* Downstream reader. */
+  Curl_creader_phase phase; /* phase at which it operates */
+};
+```
+
+`Curl_creader` is a reader instance with a `next` pointer to form the chain.
+It as a type `crt` which provides the implementation. The main callback is
+`do_read()` which provides the data to the caller. The others are for setup
+and tear down. `needs_rewind()` is explained further below.
+
+## Phases and Ordering
+
+Since client readers may transform the data being read through the chain,
+the order in which they are called is relevant for the outcome. When a reader
+is created, it gets the `phase` property in which it operates. Reader phases
+are defined like:
+
+```c
+typedef enum {
+  CURL_CR_NET,  /* data send to the network (connection filters) */
+  CURL_CR_TRANSFER_ENCODE, /* add transfer-encodings */
+  CURL_CR_PROTOCOL, /* before transfer, but after content decoding */
+  CURL_CR_CONTENT_ENCODE, /* add content-encodings */
+  CURL_CR_CLIENT  /* data read from client */
+} Curl_creader_phase;
+```
+
+If a reader for phase `PROTOCOL` is added to the chain, it is always added
+*after* any `NET` or `TRANSFER_ENCODE` readers and *before* and
+`CONTENT_ENCODE` and `CLIENT` readers. If there is already a reader for the
+same phase, the new reader is added before the existing one(s).
+
+### Example: `chunked` reader
+
+In `http_chunks.c` a client reader for chunked uploads is implemented. This
+one operates at phase `CURL_CR_TRANSFER_ENCODE`. Any data coming from the
+reader "below" has the HTTP/1.1 chunk handling applied and returned to the
+caller.
+
+When this reader sees an `eos` from below, it generates the terminal chunk,
+adding trailers if provided by the application. When that last chunk is fully
+returned, it also sets `eos` to the caller.
+
+### Example: `lineconv` reader
+
+In `sendf.c` a client reader that does line-end conversions is implemented. It
+operates at `CURL_CR_CONTENT_ENCODE` and converts any "\n" to "\r\n". This is
+used for FTP ASCII uploads or when the general `crlf` options has been set.
+
+### Example: `null` reader
+
+Implemented in `sendf.c` for phase `CURL_CR_CLIENT`, this reader has the
+simple job of providing transfer bytes of length 0 to the caller, immediately
+indicating an `eos`. This reader is installed by HTTP for all GET/HEAD
+requests and when authentication is being negotiated.
+
+### Example: `buf` reader
+
+Implemented in `sendf.c` for phase `CURL_CR_CLIENT`, this reader get a buffer
+pointer and a length and provides exactly these bytes. This one is used in
+HTTP for sending `postfields` provided by the application.
+
+## Request retries
+
+Sometimes it is necessary to send a request with client data again. Transfer
+handling can inquire via `Curl_client_read_needs_rewind()` if a rewind (e.g. a
+reset of the client data) is necessary. This asks all installed readers if
+they need it and give `FALSE` of none does.
+
+## Upload Size
+
+Many protocols need to know the amount of bytes delivered by the client
+readers in advance. They may invoke `Curl_creader_total_length(data)` to
+retrieve that. Not all reader chains know the exact value beforehand. In that
+case, the call returns `-1` for "unknown".
+
+Even if the length of the "raw" data is known, the length that is send may
+not. Example: with option `--crlf` the uploaded content undergoes line-end
+conversion. The line converting reader does not know in advance how many
+newlines it may encounter. Therefore it must return `-1` for any positive raw
+content length.
+
+In HTTP, once the correct client readers are installed, the protocol asks the
+readers for the total length. If that is known, it can set `Content-Length:`
+accordingly. If not, it may choose to add an HTTP "chunked" reader.
+
+In addition, there is `Curl_creader_client_length(data)` which gives the total
+length as reported by the reader in phase `CURL_CR_CLIENT` without asking
+other readers that may transform the raw data. This is useful in estimating
+the size of an upload. The HTTP protocol uses this to determine if `Expect:
+100-continue` shall be done.
+
+## Resuming
+
+Uploads can start at a specific offset, if so requested. The "resume from"
+that offset. This applies to the reader in phase `CURL_CR_CLIENT` that
+delivers the "raw" content. Resumption can fail if the installed reader does
+not support it or if the offset is too large.
+
+The total length reported by the reader changes when resuming. Example:
+resuming an upload of 100 bytes by 25 reports a total length of 75 afterwards.
+
+If `resume_from()` is invoked twice, it is additive. There is currently no way
+to undo a resume.
+
+## Rewinding
+
+When a request is retried, installed client readers are discarded and replaced
+by new ones. This works only if the new readers upload the same data. For many
+readers, this is not an issue. The "null" reader always does the same. Also
+the `buf` reader, initialized with the same buffer, does this.
+
+Readers operating on callbacks to the application need to "rewind" the
+underlying content. For example, when reading from a `FILE*`, the reader needs
+to `fseek()` to the beginning. The following methods are used:
+
+1. `Curl_creader_needs_rewind(data)`: tells if a rewind is necessary, given
+   the current state of the reader chain. If nothing really has been read so
+   far, this returns `FALSE`.
+2. `Curl_creader_will_rewind(data)`: tells if the reader chain rewinds at
+   the start of the next request.
+3. `Curl_creader_set_rewind(data, TRUE)`: marks the reader chain for rewinding
+   at the start of the next request.
+4. `Curl_client_start(data)`: tells the readers that a new request starts and
+   they need to rewind if requested.
+
+## Summary and Outlook
+
+By adding the client reader interface, any protocol can control how/if it wants
+the curl transfer to send bytes for a request. The transfer loop becomes then
+blissfully ignorant of the specifics.
+
+The protocols on the other hand no longer have to care to package data most
+efficiently. At any time, should more data be needed, it can be read from the
+client. This is used when sending HTTP requests headers to add as much request
+body data to the initial sending as there is room for.
+
+Future enhancements based on the client readers:
+* `expect-100` handling: place that into an HTTP specific reader at
+  `CURL_CR_PROTOCOL` and eliminate the checks in the generic transfer parts.
+* `eos forwarding`: transfer should forward an `eos` flag to the connection
+  filters. Filters like HTTP/2 and HTTP/3 can make use of that, terminating
+  streams early. This would also eliminate length checks in stream handling.
diff --git a/third-party/curl/docs/internals/CLIENT-WRITERS.md b/third-party/curl/docs/internals/CLIENT-WRITERS.md
new file mode 100644
index 0000000000..e00cd263be
--- /dev/null
+++ b/third-party/curl/docs/internals/CLIENT-WRITERS.md
@@ -0,0 +1,168 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# curl client writers
+
+Client writers is a design in the internals of libcurl, not visible in its
+public API. They were started in curl v8.5.0. This document describes the
+concepts, its high level implementation and the motivations.
+
+## Naming
+
+`libcurl` operates between clients and servers. A *client* is the application
+using libcurl, like the command line tool `curl` itself. Data to be uploaded
+to a server is **read** from the client and **send** to the server, the
+servers response is **received** by `libcurl` and then **written** to the
+client.
+
+With this naming established, client writers are concerned with writing
+responses from the server to the application. Applications register callbacks
+via `CURLOPT_WRITEFUNCTION` and `CURLOPT_HEADERFUNCTION` to be invoked by
+`libcurl` when the response is received.
+
+## Invoking
+
+All code in `libcurl` that handles response data is ultimately expected to
+forward this data via `Curl_client_write()` to the application. The exact
+prototype of this function is:
+
+```c
+CURLcode Curl_client_write(struct Curl_easy *data, int type, const char *buf, size_t blen);
+```
+
+The `type` argument specifies what the bytes in `buf` actually are.
+The following bits are defined:
+```c
+#define CLIENTWRITE_BODY    (1 << 0) /* non-meta information, BODY */
+#define CLIENTWRITE_INFO    (1 << 1) /* meta information, not a HEADER */
+#define CLIENTWRITE_HEADER  (1 << 2) /* meta information, HEADER */
+#define CLIENTWRITE_STATUS  (1 << 3) /* a special status HEADER */
+#define CLIENTWRITE_CONNECT (1 << 4) /* a CONNECT related HEADER */
+#define CLIENTWRITE_1XX     (1 << 5) /* a 1xx response related HEADER */
+#define CLIENTWRITE_TRAILER (1 << 6) /* a trailer HEADER */
+```
+
+The main types here are `CLIENTWRITE_BODY` and `CLIENTWRITE_HEADER`. They are
+mutually exclusive. The other bits are enhancements to `CLIENTWRITE_HEADER`
+to specify what the header is about. They are only used in HTTP and related
+protocols (RTSP and WebSocket).
+
+The implementation of `Curl_client_write()` uses a chain of *client writer*
+instances to process the call and make sure that the bytes reach the proper
+application callbacks. This is similar to the design of connection filters:
+client writers can be chained to process the bytes written through them. The
+definition is:
+
+```c
+struct Curl_cwtype {
+  const char *name;
+  CURLcode (*do_init)(struct Curl_easy *data,
+                      struct Curl_cwriter *writer);
+  CURLcode (*do_write)(struct Curl_easy *data,
+                       struct Curl_cwriter *writer, int type,
+                       const char *buf, size_t nbytes);
+  void (*do_close)(struct Curl_easy *data,
+                   struct Curl_cwriter *writer);
+};
+
+struct Curl_cwriter {
+  const struct Curl_cwtype *cwt;  /* type implementation */
+  struct Curl_cwriter *next;  /* Downstream writer. */
+  Curl_cwriter_phase phase; /* phase at which it operates */
+};
+```
+
+`Curl_cwriter` is a writer instance with a `next` pointer to form the chain.
+It has a type `cwt` which provides the implementation. The main callback is
+`do_write()` that processes the data and calls then the `next` writer. The
+others are for setup and tear down.
+
+## Phases and Ordering
+
+Since client writers may transform the bytes written through them, the order
+in which the are called is relevant for the outcome. When a writer is created,
+one property it gets is the `phase` in which it operates. Writer phases are
+defined like:
+
+```c
+typedef enum {
+  CURL_CW_RAW,  /* raw data written, before any decoding */
+  CURL_CW_TRANSFER_DECODE, /* remove transfer-encodings */
+  CURL_CW_PROTOCOL, /* after transfer, but before content decoding */
+  CURL_CW_CONTENT_DECODE, /* remove content-encodings */
+  CURL_CW_CLIENT  /* data written to client */
+} Curl_cwriter_phase;
+```
+
+If a writer for phase `PROTOCOL` is added to the chain, it is always added
+*after* any `RAW` or `TRANSFER_DECODE` and *before* any `CONTENT_DECODE` and
+`CLIENT` phase writer. If there is already a writer for the same phase
+present, the new writer is inserted before that one.
+
+All transfers have a chain of 3 writers by default. A specific protocol
+handler may alter that by adding additional writers. The 3 standard writers
+are (name, phase):
+
+1. `"raw", CURL_CW_RAW `: if the transfer is verbose, it forwards the body data
+   to the debug function.
+1. `"download", CURL_CW_PROTOCOL`: checks that protocol limits are kept and
+   updates progress counters. When a download has a known length, it checks
+   that it is not exceeded and errors otherwise.
+1. `"client", CURL_CW_CLIENT`: the main work horse. It invokes the application
+   callbacks or writes to the configured file handles. It chops large writes
+   into smaller parts, as documented for `CURLOPT_WRITEFUNCTION`. If also
+   handles *pausing* of transfers when the application callback returns
+   `CURL_WRITEFUNC_PAUSE`.
+
+With these writers always in place, libcurl's protocol handlers automatically
+have these implemented.
+
+## Enhanced Use
+
+HTTP is the protocol in curl that makes use of the client writer chain by
+adding writers to it. When the `libcurl` application set
+`CURLOPT_ACCEPT_ENCODING` (as `curl` does with `--compressed`), the server is
+offered an `Accept-Encoding` header with the algorithms supported. The server
+then may choose to send the response body compressed. For example using `gzip`
+or `brotli` or even both.
+
+In the server's response, if there is a `Content-Encoding` header listing the
+encoding applied. If supported by `libcurl` it then decompresses the content
+before writing it out to the client. How does it do that?
+
+The HTTP protocol adds client writers in phase `CURL_CW_CONTENT_DECODE` on
+seeing such a header. For each encoding listed, it adds the corresponding
+writer. The response from the server is then passed through
+`Curl_client_write()` to the writers that decode it. If several encodings had
+been applied the writer chain decodes them in the proper order.
+
+When the server provides a `Content-Length` header, that value applies to the
+*compressed* content. Length checks on the response bytes must happen *before*
+it gets decoded. That is why this check happens in phase `CURL_CW_PROTOCOL`
+which always is ordered before writers in phase `CURL_CW_CONTENT_DECODE`.
+
+What else?
+
+Well, HTTP servers may also apply a `Transfer-Encoding` to the body of a
+response. The most well-known one is `chunked`, but algorithms like `gzip` and
+friends could also be applied. The difference to content encodings is that
+decoding needs to happen *before* protocol checks, for example on length, are
+done.
+
+That is why transfer decoding writers are added for phase
+`CURL_CW_TRANSFER_DECODE`. Which makes their operation happen *before* phase
+`CURL_CW_PROTOCOL` where length may be checked.
+
+## Summary
+
+By adding the common behavior of all protocols into `Curl_client_write()` we
+make sure that they do apply everywhere. Protocol handler have less to worry
+about. Changes to default behavior can be done without affecting handler
+implementations.
+
+Having a writer chain as implementation allows protocol handlers with extra
+needs, like HTTP, to add to this for special behavior. The common way of
+writing the actual response data stays the same.
diff --git a/third-party/curl/docs/CODE_STYLE.md b/third-party/curl/docs/internals/CODE_STYLE.md
similarity index 75%
rename from third-party/curl/docs/CODE_STYLE.md
rename to third-party/curl/docs/internals/CODE_STYLE.md
index 9cdf0d17e4..31c333af82 100644
--- a/third-party/curl/docs/CODE_STYLE.md
+++ b/third-party/curl/docs/internals/CODE_STYLE.md
@@ -1,3 +1,9 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # curl C code style
 
 Source code that has a common style is easier to read than code that uses
@@ -13,19 +19,27 @@ Our C code has a few style rules. Most of them are verified and upheld by the
 by the build system when built after `./configure --enable-debug` has been
 used.
 
-It is normally not a problem for anyone to follow the guidelines, as you just
-need to copy the style already used in the source code and there are no
-particularly unusual rules in our set of rules.
+It is normally not a problem for anyone to follow the guidelines, copy
+the style already used in the source code and there are no particularly
+unusual rules in our set of rules.
 
 We also work hard on writing code that are warning-free on all the major
-platforms and in general on as many platforms as possible. Code that obviously
-will cause warnings will not be accepted as-is.
+platforms and in general on as many platforms as possible. Code that causes
+warnings is not accepted as-is.
+
+## Readability
+
+A primary characteristic for code is readability. The intent and meaning of
+the code should be visible to the reader. Being clear and unambiguous beats
+being clever and saving two lines of code. Write simple code. You and others
+who come back to this code over the coming decades want to be able to quickly
+understand it when debugging.
 
 ## Naming
 
 Try using a non-confusing naming scheme for your new functions and variable
 names. It does not necessarily have to mean that you should use the same as in
-other places of the code, just that the names should be logical,
+other places of the code, only that the names should be logical,
 understandable and be named according to what they are used for. File-local
 functions should be made static. We like lower case names.
 
@@ -218,10 +232,10 @@ int size = sizeof(int);
 
 Some statements cannot be completed on a single line because the line would be
 too long, the statement too hard to read, or due to other style guidelines
-above. In such a case the statement will span multiple lines.
+above. In such a case the statement spans multiple lines.
 
 If a continuation line is part of an expression or sub-expression then you
-should align on the appropriate column so that it's easy to tell what part of
+should align on the appropriate column so that it is easy to tell what part of
 the statement it is. Operators should not start continuation lines. In other
 cases follow the 2-space indent guideline. Here are some examples from
 libcurl:
@@ -239,7 +253,7 @@ If no parenthesis, use the default indent:
 
 ```c
 data->set.http_disable_hostname_check_before_authentication =
-  (0 != va_arg(param, long)) ? TRUE : FALSE;
+  va_arg(param, long) ? TRUE : FALSE;
 ```
 
 Function invoke with an open parenthesis:
@@ -265,7 +279,7 @@ DEBUGF(infof(data, "Curl_pp_readresp_ %d bytes of trailing "
 
 Use **#ifdef HAVE_FEATURE** to do conditional code. We avoid checking for
 particular operating systems or hardware in the #ifdef lines. The HAVE_FEATURE
-shall be generated by the configure script for unix-like systems and they are
+shall be generated by the configure script for Unix-like systems and they are
 hard-coded in the `config-[system].h` files for the others.
 
 We also encourage use of macros/functions that possibly are empty or defined
@@ -308,3 +322,101 @@ typedef struct {
 } something;
 something instance;
 ```
+
+## Banned functions
+
+To avoid footguns and unintended consequences we forbid the use of a number of
+C functions. The `checksrc` script finds and yells about them if used. This
+makes us write better code.
+
+This is the full list of functions generally banned.
+
+    _access
+    _fstati64
+    _lseeki64
+    _mbscat
+    _mbsncat
+    _open
+    _tcscat
+    _tcsdup
+    _tcsncat
+    _tcsncpy
+    _waccess
+    _wcscat
+    _wcsdup
+    _wcsncat
+    _wfopen
+    _wfreopen
+    _wopen
+    accept
+    accept4
+    access
+    aprintf
+    atoi
+    atol
+    calloc
+    close
+    CreateFile
+    CreateFileA
+    CreateFileW
+    fclose
+    fdopen
+    fopen
+    fprintf
+    free
+    freeaddrinfo
+    freopen
+    fstat
+    getaddrinfo
+    gets
+    gmtime
+    llseek
+    LoadLibrary
+    LoadLibraryA
+    LoadLibraryEx
+    LoadLibraryExA
+    LoadLibraryExW
+    LoadLibraryW
+    localtime
+    lseek
+    malloc
+    mbstowcs
+    MoveFileEx
+    MoveFileExA
+    MoveFileExW
+    msnprintf
+    mvsnprintf
+    open
+    printf
+    realloc
+    recv
+    rename
+    send
+    snprintf
+    socket
+    socketpair
+    sprintf
+    sscanf
+    stat
+    strcat
+    strcpy
+    strdup
+    strerror
+    strncat
+    strncpy
+    strtok
+    strtok_r
+    strtol
+    strtoul
+    vaprintf
+    vfprintf
+    vprintf
+    vsnprintf
+    vsprintf
+    wcscpy
+    wcsdup
+    wcsncpy
+    wcstombs
+    WSASocket
+    WSASocketA
+    WSASocketW
diff --git a/third-party/curl/docs/internals/CONNECTION-FILTERS.md b/third-party/curl/docs/internals/CONNECTION-FILTERS.md
new file mode 100644
index 0000000000..1a817a1567
--- /dev/null
+++ b/third-party/curl/docs/internals/CONNECTION-FILTERS.md
@@ -0,0 +1,343 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# curl connection filters
+
+Connection filters is a design in the internals of curl, not visible in its
+public API. They were added in curl v7.87.0. This document describes the
+concepts, its high level implementation and the motivations.
+
+## Filters
+
+A "connection filter" is a piece of code that is responsible for handling a
+range of operations of curl's connections: reading, writing, waiting on
+external events, connecting and closing down - to name the most important
+ones.
+
+The most important feat of connection filters is that they can be stacked on
+top of each other (or "chained" if you prefer that metaphor). In the common
+scenario that you want to retrieve a `https:` URL with curl, you need 2 basic
+things to send the request and get the response: a TCP connection, represented
+by a `socket` and an SSL instance en- and decrypt over that socket. You write
+your request to the SSL instance, which encrypts and writes that data to the
+socket, which then sends the bytes over the network.
+
+With connection filters, curl's internal setup looks something like this (cf
+for connection filter):
+
+```
+Curl_easy *data         connectdata *conn        cf-ssl        cf-socket
++----------------+      +-----------------+      +-------+     +--------+
+|https://curl.se/|----> | properties      |----> | keys  |---> | socket |--> OS --> network
++----------------+      +-----------------+      +-------+     +--------+
+
+Curl_write(data, buffer)
+  --> Curl_cfilter_write(data, data->conn, buffer)
+        --> conn->filter->write(conn->filter, data, buffer)
+```
+
+While connection filters all do different things, they look the same from the
+"outside". The code in `data` and `conn` does not really know **which**
+filters are installed. `conn` writes into the first filter, whatever that is.
+
+Same is true for filters. Each filter has a pointer to the `next` filter. When
+SSL has encrypted the data, it does not write to a socket, it writes to the
+next filter. If that is indeed a socket, or a file, or an HTTP/2 connection is
+of no concern to the SSL filter.
+
+This allows stacking, as in:
+
+```
+Direct:
+  http://localhost/      conn -> cf-socket
+  https://curl.se/       conn -> cf-ssl -> cf-socket
+Via http proxy tunnel:
+  http://localhost/      conn -> cf-http-proxy -> cf-socket
+  https://curl.se/       conn -> cf-ssl -> cf-http-proxy -> cf-socket
+Via https proxy tunnel:
+  http://localhost/      conn -> cf-http-proxy -> cf-ssl -> cf-socket
+  https://curl.se/       conn -> cf-ssl -> cf-http-proxy -> cf-ssl -> cf-socket
+Via http proxy tunnel via SOCKS proxy:
+  http://localhost/      conn -> cf-http-proxy -> cf-socks -> cf-socket
+```
+
+### Connecting/Closing
+
+Before `Curl_easy` can send the request, the connection needs to be
+established. This means that all connection filters have done, whatever they
+need to do: waiting for the socket to be connected, doing the TLS handshake,
+performing the HTTP tunnel request, etc. This has to be done in reverse order:
+the last filter has to do its connect first, then the one above can start,
+etc.
+
+Each filter does in principle the following:
+
+```c
+static CURLcode myfilter_cf_connect(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    bool *done)
+{
+  CURLcode result;
+
+  if(cf->connected) {            /* we and all below are done */
+    *done = TRUE;
+    return CURLE_OK;
+  }
+                                 /* Let the filters below connect */
+  result = cf->next->cft->connect(cf->next, data, blocking, done);
+  if(result || !*done)
+    return result;               /* below errored/not finished yet */
+
+  /* MYFILTER CONNECT THINGS */  /* below connected, do out thing */
+  *done = cf->connected = TRUE;  /* done, remember, return */
+  return CURLE_OK;
+}
+```
+
+Closing a connection then works similar. The `conn` tells the first filter to
+close. Contrary to connecting, the filter does its own things first, before
+telling the next filter to close.
+
+### Efficiency
+
+There are two things curl is concerned about: efficient memory use and fast
+transfers.
+
+The memory footprint of a filter is relatively small:
+
+```c
+struct Curl_cfilter {
+  const struct Curl_cftype *cft; /* the type providing implementation */
+  struct Curl_cfilter *next;     /* next filter in chain */
+  void *ctx;                     /* filter type specific settings */
+  struct connectdata *conn;      /* the connection this filter belongs to */
+  int sockindex;                 /* TODO: like to get rid off this */
+  BIT(connected);                /* != 0 iff this filter is connected */
+};
+```
+
+The filter type `cft` is a singleton, one static struct for each type of
+filter. The `ctx` is where a filter holds its specific data. That varies by
+filter type. An http-proxy filter keeps the ongoing state of the CONNECT here,
+free it after its has been established. The SSL filter keeps the `SSL*` (if
+OpenSSL is used) here until the connection is closed. This varies.
+
+`conn` is a reference to the connection this filter belongs to, so nothing
+extra besides the pointer itself.
+
+Several things, that before were kept in `struct connectdata`, now goes into
+the `filter->ctx` *when needed*. The memory footprint for connections that do
+*not* use an http proxy, or socks, or https is lower.
+
+As to transfer efficiency, writing and reading through a filter comes at near
+zero cost *if the filter does not transform the data*. An http proxy or socks
+filter, once it is connected, passes the calls through. Those filters
+implementations look like this:
+
+```c
+ssize_t Curl_cf_def_send(struct Curl_cfilter *cf, struct Curl_easy *data,
+                         const void *buf, size_t len, CURLcode *err)
+{
+  return cf->next->cft->do_send(cf->next, data, buf, len, err);
+}
+```
+
+The `recv` implementation is equivalent.
+
+## Filter Types
+
+The currently existing filter types (curl 8.5.0) are:
+
+* `TCP`, `UDP`, `UNIX`: filters that operate on a socket, providing raw I/O.
+* `SOCKET-ACCEPT`: special TCP socket that has a socket that has been
+  `accept()`ed in a `listen()`
+* `SSL`: filter that applies TLS en-/decryption and handshake. Manages the
+  underlying TLS backend implementation.
+* `HTTP-PROXY`, `H1-PROXY`, `H2-PROXY`, `H3-PROXY`: the first manages the
+   connection to an HTTP proxy server and uses the other depending on which
+   ALPN protocol has been negotiated.
+* `SOCKS-PROXY`: filter for the various SOCKS proxy protocol variations
+* `HAPROXY`: filter for the protocol of the same name, providing client IP
+  information to a server.
+* `HTTP/2`: filter for handling multiplexed transfers over an HTTP/2
+  connection
+* `HTTP/3`: filter for handling multiplexed transfers over an HTTP/3+QUIC
+  connection
+* `HAPPY-EYEBALLS`: meta filter that implements IPv4/IPv6 "happy eyeballs".
+  It creates up to 2 sub-filters that race each other for a connection.
+* `SETUP`: meta filter that manages the creation of sub-filter chains for a
+  specific transport (e.g. TCP or QUIC).
+* `HTTPS-CONNECT`: meta filter that races a TCP+TLS and a QUIC connection
+  against each other to determine if HTTP/1.1, HTTP/2 or HTTP/3 shall be used
+  for a transfer.
+
+Meta filters are combining other filters for a specific purpose, mostly during
+connection establishment. Other filters like `TCP`, `UDP` and `UNIX` are only
+to be found at the end of filter chains. SSL filters provide encryption, of
+course. Protocol filters change the bytes sent and received.
+
+## Filter Flags
+
+Filter types carry flags that inform what they do. These are (for now):
+
+* `CF_TYPE_IP_CONNECT`: this filter type talks directly to a server. This does
+  not have to be the server the transfer wants to talk to. For example when a
+  proxy server is used.
+* `CF_TYPE_SSL`: this filter type provides encryption.
+* `CF_TYPE_MULTIPLEX`: this filter type can manage multiple transfers in parallel.
+
+Filter types can combine these flags. For example, the HTTP/3 filter types
+have `CF_TYPE_IP_CONNECT`, `CF_TYPE_SSL` and `CF_TYPE_MULTIPLEX` set.
+
+Flags are useful to extrapolate properties of a connection. To check if a
+connection is encrypted, libcurl inspect the filter chain in place, top down,
+for `CF_TYPE_SSL`. If it finds `CF_TYPE_IP_CONNECT` before any `CF_TYPE_SSL`,
+the connection is not encrypted.
+
+For example, `conn1` is for a `http:` request using a tunnel through an HTTP/2
+`https:` proxy. `conn2` is a `https:` HTTP/2 connection to the same proxy.
+`conn3` uses HTTP/3 without proxy. The filter chains would look like this
+(simplified):
+
+```
+conn1 --> `HTTP-PROXY` --> `H2-PROXY` --> `SSL` --> `TCP`
+flags:                     `IP_CONNECT`   `SSL`     `IP_CONNECT`
+
+conn2 --> `HTTP/2` --> `SSL` --> `HTTP-PROXY` --> `H2-PROXY` --> `SSL` --> `TCP`
+flags:                 `SSL`                      `IP_CONNECT`   `SSL`     `IP_CONNECT`
+
+conn3 --> `HTTP/3`
+flags:    `SSL|IP_CONNECT`
+```
+
+Inspecting the filter chains, `conn1` is seen as unencrypted, since it
+contains an `IP_CONNECT` filter before any `SSL`. `conn2` is clearly encrypted
+as an `SSL` flagged filter is seen first. `conn3` is also encrypted as the
+`SSL` flag is checked before the presence of `IP_CONNECT`.
+
+Similar checks can determine if a connection is multiplexed or not.
+
+## Adding CONNECT-UDP support
+HTTP/3 on top of HTTP/1.1 (MASQUE CONNECT-UDP):
+```
+conn --> HTTP/3 --> CAPSULE --> HTTP-PROXY --> H1-PROXY --> SSL --> HAPPY-EYEBALLS --> TCP
+```
+
+HTTP/3 on top of HTTP/2 (MASQUE CONNECT-UDP):
+```
+conn --> HTTP/3 --> CAPSULE --> HTTP-PROXY --> H2-PROXY --> SSL --> HAPPY-EYEBALLS --> TCP
+```
+
+The CAPSULE filter handles RFC 9297 capsule protocol encapsulation and
+decapsulation of UDP datagrams. It is inserted automatically when the
+HTTP-PROXY filter completes a successful CONNECT-UDP tunnel.
+
+## Adding H3-PROXY support
+HTTP/1.1 on top of HTTP/3 (CONNECT over QUIC):
+```
+conn --> HTTP/1.1 --> SSL --> HTTP-PROXY --> H3-PROXY --> HAPPY-EYEBALLS --> UDP
+```
+
+HTTP/2 on top of HTTP/3 (CONNECT over QUIC):
+```
+conn --> HTTP/2 --> SSL --> HTTP-PROXY --> H3-PROXY --> HAPPY-EYEBALLS --> UDP
+```
+
+HTTP/3 on top of HTTP/3 (MASQUE CONNECT-UDP over QUIC):
+```
+conn --> HTTP/3 --> CAPSULE --> HTTP-PROXY --> H3-PROXY --> HAPPY-EYEBALLS --> UDP
+```
+
+## Filter Tracing
+
+Filters may make use of special trace macros like `CURL_TRC_CF(data, cf, msg,
+...)`. With `data` being the transfer and `cf` being the filter instance.
+These traces are normally not active and their execution is guarded so that
+they are cheap to ignore.
+
+Users of `curl` may activate them by adding the name of the filter type to the
+`--trace-config` argument. For example, in order to get more detailed tracing
+of an HTTP/2 request, invoke curl with:
+
+```sh
+> curl -v --trace-config ids,time,http/2 https://curl.se/
+```
+
+Which gives you trace output with time information, transfer+connection ids
+and details from the `HTTP/2` filter. Filter type names in the trace config
+are case insensitive. You may use `all` to enable tracing for all filter
+types. When using `libcurl` you may call `curl_global_trace(config_string)` at
+the start of your application to enable filter details.
+
+## Meta Filters
+
+Meta filters is a catch-all name for filter types that do not change the
+transfer data in any way but provide other important services to curl. In
+general, it is possible to do all sorts of silly things with them. One of the
+commonly used, important things is "eyeballing".
+
+The `HAPPY-EYEBALLS` filter is involved in the connect phase. Its job is to
+try the various IPv4 and IPv6 addresses that are known for a server. If only
+one address family is known (or configured), it tries the addresses one after
+the other with timeouts calculated from the amount of addresses and the
+overall connect timeout.
+
+When more than one address family is to be tried, it splits the address list
+into IPv4 and IPv6 and makes parallel attempts. The connection filter chain
+looks like this:
+
+```
+* create connection for http://curl.se/
+conn[curl.se] --> SETUP[TCP] --> HAPPY-EYEBALLS --> NULL
+* start connect
+conn[curl.se] --> SETUP[TCP] --> HAPPY-EYEBALLS --> NULL
+                                 - ballerv4 --> TCP[151.101.1.91]:443
+                                 - ballerv6 --> TCP[2a04:4e42:c00::347]:443
+* v6 answers, connected
+conn[curl.se] --> SETUP[TCP] --> HAPPY-EYEBALLS --> TCP[2a04:4e42:c00::347]:443
+* transfer
+```
+
+The modular design of connection filters and that we can plug them into each
+other is used to control the parallel attempts. When a `TCP` filter does not
+connect (in time), it is torn down and another one is created for the next
+address. This keeps the `TCP` filter simple.
+
+The `HAPPY-EYEBALLS` on the other hand stays focused on its side of the
+problem. We can use it also to make other type of connection by giving it
+another filter type to try to have happy eyeballing for QUIC:
+
+```
+* create connection for --http3-only https://curl.se/
+conn[curl.se] --> SETUP[QUIC] --> HAPPY-EYEBALLS --> NULL
+* start connect
+conn[curl.se] --> SETUP[QUIC] --> HAPPY-EYEBALLS --> NULL
+                                  - ballerv4 --> HTTP/3[151.101.1.91]:443
+                                  - ballerv6 --> HTTP/3[2a04:4e42:c00::347]:443
+* v6 answers, connected
+conn[curl.se] --> SETUP[QUIC] --> HAPPY-EYEBALLS --> HTTP/3[2a04:4e42:c00::347]:443
+* transfer
+```
+
+When we plug these two variants together, we get the `HTTPS-CONNECT` filter
+type that is used for `--http3` when **both** HTTP/3 and HTTP/2 or HTTP/1.1
+shall be attempted:
+
+```
+* create connection for --http3 https://curl.se/
+conn[curl.se] --> HTTPS-CONNECT --> NULL
+* start connect
+conn[curl.se] --> HTTPS-CONNECT --> NULL
+                  - SETUP[QUIC] --> HAPPY-EYEBALLS --> NULL
+                                    - ballerv4 --> HTTP/3[151.101.1.91]:443
+                                    - ballerv6 --> HTTP/3[2a04:4e42:c00::347]:443
+                  - SETUP[TCP]  --> HAPPY-EYEBALLS --> NULL
+                                    - ballerv4 --> TCP[151.101.1.91]:443
+                                    - ballerv6 --> TCP[2a04:4e42:c00::347]:443
+* v4 QUIC answers, connected
+conn[curl.se] --> HTTPS-CONNECT --> SETUP[QUIC] --> HAPPY-EYEBALLS --> HTTP/3[151.101.1.91]:443
+* transfer
+```
diff --git a/third-party/curl/docs/internals/CREDENTIALS.md b/third-party/curl/docs/internals/CREDENTIALS.md
new file mode 100644
index 0000000000..e5e409ed7b
--- /dev/null
+++ b/third-party/curl/docs/internals/CREDENTIALS.md
@@ -0,0 +1,76 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# curl `creds`
+
+Authorization credentials are kept in `struct Curl_creds`. This contains:
+
+* `user`: the username, maybe the empty string
+* `passwd`: the password, maybe the empty string
+* `sasl_authzid`: the SASL `authz` value, maybe the empty string
+* `oauth_bearer`: the OAUTH bearer token, maybe the empty string
+* `source`: where the credentials from
+* `refcount`: a reference counter to link/unlink `creds`
+
+A `creds` with all values empty is equivalent to NULL, e.g. no `creds`
+instance. With reference counting, `creds` can be linked in several places.
+
+Two `creds` are the same if all values are equal apart from `source`
+and `refcount`. The comparison of strings is done via `Curl_timestrcmp()`
+to prevent side channel attacks.
+
+## `creds` locations
+
+Credentials are kept in three places:
+
+* `data->state.creds`: the credentials to use for the transfer in talking
+  to the `origin` (see PEERS)
+* `conn->creds`: the credentials tied to a connection (more below)
+* `conn->*_proxy.creds`: credentials used to talk to the `conn->*_proxy.peer`
+
+### `data->state.creds`
+
+This `creds` instance is created when the transfer starts looking for a
+suitable connection. For an `easy_perform()` this may happen several times
+if, for example, http redirects are followed.
+
+When an `easy_perform()` starts, the transfer's `data->state.initial_origin`
+peer is cleared. When creating the connection, `data->state.origin` is
+calculated (e.g. who the request talks to). If `data->state.initial_origin`
+is not set, the first `data->state.origin` is linked there.
+Now `libcurl` knows where
+the transfer initially talked to on all possible subsequent requests.
+
+Credential information from `CURLOPT_*` settings is only applicable for the
+initial origin. Any followup request going to another origin must not
+use it. Therefore `data->state.creds` is *only* created from `CURLOPT_*`
+when current origin and initial origin match.
+
+Without credentials from `CURLOPT_*`, the URL is inspected for user and
+password and `netrc` is consulted as well (when built in).
+
+### `conn->creds`
+
+Once `data->state.creds` is known, the connection credentials are
+determined. For protocols that tie authorization to everything send
+on a connection (protocols without flag `PROTOPT_CREDSPERREQUEST`),
+`conn->creds` is linked to `data->state.creds`. Only connections
+carrying the same credentials may be reused.
+
+Protocol with flag `PROTOPT_CREDSPERREQUEST` leave `conn->creds` empty,
+as connections for such protocols may be reused with different
+credentials.
+
+That being said, there are authentication schemes like `NTLM` and
+`NEGOTIATE` that tie credentials to a connection. Those do set `conn->creds`
+once they start to operate, preventing connection reuse from then on
+for transfers with different credentials.
+
+### `conn->*_proxy.creds`
+
+Those are set during connection setup from the `CURLOPT_*` values. They
+do not require any "initial origin" handling as the origin of a proxy
+does not change for a transfer.
diff --git a/third-party/curl/docs/internals/CURLX.md b/third-party/curl/docs/internals/CURLX.md
new file mode 100644
index 0000000000..2d47d7b141
--- /dev/null
+++ b/third-party/curl/docs/internals/CURLX.md
@@ -0,0 +1,24 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# `curlx`
+
+Functions that are prefixed with `curlx_` are internal global functions that
+are written in a way to allow them to be "borrowed" and used outside of the
+library: in the curl tool and in the curl test suite.
+
+The `curlx` functions are not part of the libcurl API, but are stand-alone
+functions whose sources can be built and used outside of libcurl. There are
+not API or ABI guarantees. The functions are not written or meant to be used
+outside of the curl project.
+
+Only functions actually used by the library are provided here.
+
+## Ways to success
+
+- Do not use `struct Curl_easy` in these files
+- Do not use the printf defines in these files
+- Make them as stand-alone as possible
diff --git a/third-party/curl/docs/internals/DYNBUF.md b/third-party/curl/docs/internals/DYNBUF.md
new file mode 100644
index 0000000000..d28b02809d
--- /dev/null
+++ b/third-party/curl/docs/internals/DYNBUF.md
@@ -0,0 +1,145 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# dynbuf
+
+This is the internal module for creating and handling "dynamic buffers". This
+means buffers that can be appended to, dynamically and grow to adapt.
+
+There is always a null-terminator put at the end of the dynamic buffer.
+
+The `struct dynbuf` is used to hold data for each instance of a dynamic
+buffer. The members of that struct **MUST NOT** be accessed or modified
+without using the dedicated dynbuf API.
+
+## `curlx_dyn_init`
+
+```c
+void curlx_dyn_init(struct dynbuf *s, size_t toobig);
+```
+
+This initializes a struct to use for dynbuf and it cannot fail. The `toobig`
+value **must** be set to the maximum size we allow this buffer instance to
+grow to. The functions below return `CURLE_OUT_OF_MEMORY` when hitting this
+limit.
+
+## `curlx_dyn_free`
+
+```c
+void curlx_dyn_free(struct dynbuf *s);
+```
+
+Free the associated memory and clean up. After a free, the `dynbuf` struct can
+be reused to start appending new data to.
+
+## `curlx_dyn_addn`
+
+```c
+CURLcode curlx_dyn_addn(struct dynbuf *s, const void *mem, size_t len);
+```
+
+Append arbitrary data of a given length to the end of the buffer.
+
+If this function fails it calls `curlx_dyn_free` on `dynbuf`.
+
+## `curlx_dyn_add`
+
+```c
+CURLcode curlx_dyn_add(struct dynbuf *s, const char *str);
+```
+
+Append a C string to the end of the buffer.
+
+If this function fails it calls `curlx_dyn_free` on `dynbuf`.
+
+## `curlx_dyn_addf`
+
+```c
+CURLcode curlx_dyn_addf(struct dynbuf *s, const char *fmt, ...);
+```
+
+Append a `printf()`-style string to the end of the buffer.
+
+If this function fails it calls `curlx_dyn_free` on `dynbuf`.
+
+## `curlx_dyn_vaddf`
+
+```c
+CURLcode curlx_dyn_vaddf(struct dynbuf *s, const char *fmt, va_list ap);
+```
+
+Append a `vprintf()`-style string to the end of the buffer.
+
+If this function fails it calls `curlx_dyn_free` on `dynbuf`.
+
+## `curlx_dyn_reset`
+
+```c
+void curlx_dyn_reset(struct dynbuf *s);
+```
+
+Reset the buffer length, but leave the allocation.
+
+## `curlx_dyn_tail`
+
+```c
+CURLcode curlx_dyn_tail(struct dynbuf *s, size_t length);
+```
+
+Keep `length` bytes of the buffer tail (the last `length` bytes of the
+buffer). The rest of the buffer is dropped. The specified `length` must not be
+larger than the buffer length. To instead keep the leading part, see
+`curlx_dyn_setlen()`.
+
+## `curlx_dyn_ptr`
+
+```c
+char *curlx_dyn_ptr(const struct dynbuf *s);
+```
+
+Returns a `char *` to the buffer if it has a length, otherwise may return
+NULL. Since the buffer may be reallocated, this pointer should not be trusted
+or used anymore after the next buffer manipulation call.
+
+## `curlx_dyn_uptr`
+
+```c
+unsigned char *curlx_dyn_uptr(const struct dynbuf *s);
+```
+
+Returns an `unsigned char *` to the buffer if it has a length, otherwise may
+return NULL. Since the buffer may be reallocated, this pointer should not be
+trusted or used anymore after the next buffer manipulation call.
+
+## `curlx_dyn_len`
+
+```c
+size_t curlx_dyn_len(const struct dynbuf *s);
+```
+
+Returns the length of the buffer in bytes. Does not include the
+null-terminator byte.
+
+## `curlx_dyn_setlen`
+
+```c
+CURLcode curlx_dyn_setlen(struct dynbuf *s, size_t len);
+```
+
+Sets the new shorter length of the buffer in number of bytes. Keeps the
+leftmost set number of bytes, discards the rest. To instead keep the tail part
+of the buffer, see `curlx_dyn_tail()`.
+
+## `curlx_dyn_take`
+
+```c
+char *curlx_dyn_take(struct dynbuf *s, size_t *plen);
+```
+
+Transfers ownership of the internal buffer to the caller. The dynbuf
+resets to its initial state. The returned pointer may be `NULL` if the
+dynbuf never allocated memory. The returned length is the amount of
+data written to the buffer. The actual allocated memory might be larger.
diff --git a/third-party/curl/docs/internals/HASH.md b/third-party/curl/docs/internals/HASH.md
new file mode 100644
index 0000000000..9534eb7d1a
--- /dev/null
+++ b/third-party/curl/docs/internals/HASH.md
@@ -0,0 +1,151 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# `hash`
+
+    #include "hash.h"
+
+This is the internal module for doing hash tables. A hash table uses a hash
+function to compute an index. On each index there is a separate linked list of
+entries.
+
+Create a hash table. Add items. Retrieve items. Remove items. Destroy table.
+
+## `Curl_hash_init`
+
+~~~c
+void Curl_hash_init(struct Curl_hash *h,
+                    size_t slots,
+                    hash_function hfunc,
+                    comp_function comparator,
+                    Curl_hash_dtor dtor);
+~~~
+
+The call initializes a `struct Curl_hash`.
+
+- `slots` is the number of entries to create in the hash table. Larger is
+  better (faster lookups) but also uses more memory.
+- `hfunc` is a function pointer to a function that returns a `size_t` value as
+  a checksum for an entry in this hash table. Ideally, it returns a unique
+  value for every entry ever added to the hash table, but hash collisions are
+  handled.
+- `comparator` is a function pointer to a function that compares two hash
+  table entries. It should return non-zero if the compared items are
+  identical.
+- `dtor` is a function pointer to a destructor called when an entry is removed
+  from the table
+
+## `Curl_hash_add`
+
+~~~c
+void *
+Curl_hash_add(struct Curl_hash *h, void *key, size_t key_len, void *p)
+~~~
+
+This call adds an entry to the hash. `key` points to the hash key and
+`key_len` is the length of the hash key. `p` is a custom pointer.
+
+If there already was a match in the hash, that data is replaced with this new
+entry.
+
+This function also lazily allocates the table if needed, as it is not done in
+the `Curl_hash_init` function.
+
+Returns NULL on error, otherwise it returns a pointer to `p`.
+
+## `Curl_hash_add2`
+
+~~~c
+void *Curl_hash_add2(struct Curl_hash *h, void *key, size_t key_len, void *p,
+                     Curl_hash_elem_dtor dtor)
+~~~
+
+This works like `Curl_hash_add` but has an extra argument: `dtor`, which is a
+destructor call for this specific entry. When this entry is removed, this
+function is called instead of the function stored for the whole hash table.
+
+## `Curl_hash_delete`
+
+~~~c
+int Curl_hash_delete(struct Curl_hash *h, void *key, size_t key_len);
+~~~
+
+This function removes an entry from the hash table. If successful, it returns
+zero. If the entry was not found, it returns 1.
+
+## `Curl_hash_pick`
+
+~~~c
+void *Curl_hash_pick(struct Curl_hash *h, void *key, size_t key_len);
+~~~
+
+If there is an entry in the hash that matches the given `key` with size of
+`key_len`, that its custom pointer is returned. The pointer that was called
+`p` when the entry was added.
+
+It returns NULL if there is no matching entry in the hash.
+
+## `Curl_hash_destroy`
+
+~~~c
+void Curl_hash_destroy(struct Curl_hash *h);
+~~~
+
+This function destroys a hash and cleanups up all its related data. Calling it
+multiple times is fine.
+
+## `Curl_hash_clean`
+
+~~~c
+void Curl_hash_clean(struct Curl_hash *h);
+~~~
+
+This function removes all the entries in the given hash.
+
+## `Curl_hash_clean_with_criterium`
+
+~~~c
+void
+Curl_hash_clean_with_criterium(struct Curl_hash *h, void *user,
+                               int (*comp)(void *, void *))
+~~~
+
+This function removes all the entries in the given hash that matches the
+criterion. The provided `comp` function determines if the criteria is met by
+returning non-zero.
+
+## `Curl_hash_count`
+
+~~~c
+size_t Curl_hash_count(struct Curl_hash *h)
+~~~
+
+Returns the number of entries stored in the hash.
+
+## `Curl_hash_start_iterate`
+
+~~~c
+void Curl_hash_start_iterate(struct Curl_hash *hash,
+                             struct Curl_hash_iterator *iter):
+~~~
+
+This function initializes a `struct Curl_hash_iterator` that `iter` points to.
+It can then be used to iterate over all the entries in the hash.
+
+## `Curl_hash_next_element`
+
+~~~c
+struct Curl_hash_element *
+Curl_hash_next_element(struct Curl_hash_iterator *iter);
+~~~
+
+Given the iterator `iter`, this function returns a pointer to the next hash
+entry if there is one, or NULL if there is no more entries.
+
+Called repeatedly, it iterates over all the entries in the hash table.
+
+Note: it only guarantees functionality if the hash table remains untouched
+during its iteration.
diff --git a/third-party/curl/docs/internals/LLIST.md b/third-party/curl/docs/internals/LLIST.md
new file mode 100644
index 0000000000..b77e86598f
--- /dev/null
+++ b/third-party/curl/docs/internals/LLIST.md
@@ -0,0 +1,195 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# `llist` - linked lists
+
+    #include "llist.h"
+
+This is the internal module for linked lists. The API is designed to be
+flexible but also to avoid dynamic memory allocation.
+
+None of the involved structs should be accessed using struct fields (outside
+of `llist.c`). Use the functions.
+
+## Setup and shutdown
+
+`struct Curl_llist` is the struct holding a single linked list. It needs to be
+initialized with a call to `Curl_llist_init()` before it can be used
+
+To clean up a list, call `Curl_llist_destroy()`. Since the linked lists
+themselves do not allocate memory, it can also be fine to *not* clean up the
+list.
+
+## Add a node
+
+There are two functions for adding a node to a linked list:
+
+1. Add it last in the list with `Curl_llist_append`
+2. Add it after a specific existing node with `Curl_llist_insert_next`
+
+When a node is added to a list, it stores an associated custom pointer to
+anything you like and you provide a pointer to a `struct Curl_llist_node`
+struct in which it stores and updates pointers. If you intend to add the same
+struct to multiple lists concurrently, you need to have one `struct
+Curl_llist_node` for each list.
+
+Add a node to a list with `Curl_llist_append(list, elem, node)`. Where
+
+- `list`: points to a `struct Curl_llist`
+- `elem`: points to what you want added to the list
+- `node`: is a pointer to a `struct Curl_llist_node`. Data storage for this
+  node.
+
+Example: to add a `struct foobar` to a linked list. Add a node struct within
+it:
+
+    struct foobar {
+      char *random;
+      struct Curl_llist_node storage; /* can be anywhere in the struct */
+      char *data;
+    };
+
+    struct Curl_llist barlist; /* the list for foobar entries */
+    struct foobar entries[10];
+
+    Curl_llist_init(&barlist, NULL);
+
+    /* add the first struct to the list */
+    Curl_llist_append(&barlist, &entries[0], &entries[0].storage);
+
+See also `Curl_llist_insert_next`.
+
+## Remove a node
+
+Remove a node again from a list by calling `Curl_llist_remove()`. This
+destroys the node's `elem` (e.g. calling a registered free function).
+
+To remove a node without destroying its `elem`, use `Curl_node_take_elem()`
+which returns the `elem` pointer and removes the node from the list. The
+caller then owns this pointer and has to take care of it.
+
+## Iterate
+
+To iterate over a list: first get the head entry and then iterate over the
+nodes as long there is a next. Each node has an *element* associated with it,
+the custom pointer you stored there. Usually a struct pointer or similar.
+
+    struct Curl_llist_node *iter;
+
+    /* get the first entry of the 'barlist' */
+    iter = Curl_llist_head(&barlist);
+
+    while(iter) {
+      /* extract the element pointer from the node */
+      struct foobar *elem = Curl_node_elem(iter);
+
+      /* advance to the next node in the list */
+      iter = Curl_node_next(iter);
+    }
+
+# Function overview
+
+## `Curl_llist_init`
+
+~~~c
+void Curl_llist_init(struct Curl_llist *list, Curl_llist_dtor dtor);
+~~~
+
+Initializes the `list`. The argument `dtor` is NULL or a function pointer that
+gets called when list nodes are removed from this list.
+
+The function is infallible.
+
+~~~c
+typedef void (*Curl_llist_dtor)(void *user, void *elem);
+~~~
+
+`dtor` is called with two arguments: `user` and `elem`. The first being the
+`user` pointer passed in to `Curl_llist_remove()`or `Curl_llist_destroy()` and
+the second is the `elem` pointer associated with removed node. The pointer
+that `Curl_node_elem()` would have returned for that node.
+
+## `Curl_llist_destroy`
+
+~~~c
+void Curl_llist_destroy(struct Curl_llist *list, void *user);
+~~~
+
+This removes all nodes from the `list`. This leaves the list in a cleared
+state.
+
+The function is infallible.
+
+## `Curl_llist_append`
+
+~~~c
+void Curl_llist_append(struct Curl_llist *list,
+                       const void *elem, struct Curl_llist_node *node);
+~~~
+
+Adds `node` last in the `list` with a custom pointer to `elem`.
+
+The function is infallible.
+
+## `Curl_llist_insert_next`
+
+~~~c
+void Curl_llist_insert_next(struct Curl_llist *list,
+                            struct Curl_llist_node *node,
+                            const void *elem,
+                            struct Curl_llist_node *node);
+~~~
+
+Adds `node` to the `list` with a custom pointer to `elem` immediately after
+the previous list `node`.
+
+The function is infallible.
+
+## `Curl_llist_head`
+
+~~~c
+struct Curl_llist_node *Curl_llist_head(struct Curl_llist *list);
+~~~
+
+Returns a pointer to the first node of the `list`, or a NULL if empty.
+
+## `Curl_node_uremove`
+
+~~~c
+void Curl_node_uremove(struct Curl_llist_node *node, void *user);
+~~~
+
+Removes the `node` the list it was previously added to. Passes the `user`
+pointer to the list's destructor function if one was setup.
+
+The function is infallible.
+
+## `Curl_node_remove`
+
+~~~c
+void Curl_node_remove(struct Curl_llist_node *node);
+~~~
+
+Removes the `node` the list it was previously added to. Passes a NULL pointer
+to the list's destructor function if one was setup.
+
+The function is infallible.
+
+## `Curl_node_elem`
+
+~~~c
+void *Curl_node_elem(struct Curl_llist_node *node);
+~~~
+
+Given a list node, this function returns the associated element.
+
+## `Curl_node_next`
+
+~~~c
+struct Curl_llist_node *Curl_node_next(struct Curl_llist_node *node);
+~~~
+
+Given a list node, this function returns the next node in the list.
diff --git a/third-party/curl/docs/internals/MID.md b/third-party/curl/docs/internals/MID.md
new file mode 100644
index 0000000000..5f1105008d
--- /dev/null
+++ b/third-party/curl/docs/internals/MID.md
@@ -0,0 +1,72 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# Multi Identifiers (mid)
+
+All transfers (easy handles) added to a multi handle are assigned
+a unique identifier until they are removed again. The multi handle
+keeps a table `multi->xfers` that allow O(1) access to the easy
+handle by its `mid`.
+
+References to other easy handles *should* keep their `mid`s instead
+of a pointer (not all code has been converted as of now). This solves
+problems in easy and multi handle life cycle management as well as
+iterating over handles where operations may add/remove other handles.
+
+### Values and Lifetime
+
+An `mid` is an `unsigned int`. There are two reserved values:
+
+* `0`: is the `mid` of an internal "admin" handle. Multi and share handles
+  each have their own admin handle for maintenance operations, like
+  shutting down connections.
+* `UINT_MAX`: the "invalid" `mid`. Easy handles are initialized with
+  this value. They get it assigned again when removed from
+  a multi handle.
+
+This makes potential range of `mid`s from `1` to `UINT_MAX - 1` *inside the
+same multi handle at the same time*. The `multi->xfers` table reuses `mid`
+values from previous transfers that have been removed.
+
+`multi->xfers` is created with an initial capacity. At the time of this
+writing that is `16` for "multi_easy" handles (used in `curl_easy_perform()`
+and `512` for multi handles created with `curl_multi_init()`.
+
+The first added easy handle gets `mid == 1` assigned. The second one receives `2`,
+even when the first one has been removed already. Every added handle gets an
+`mid` one larger than the previously assigned one. Until the capacity of
+the table is reached and it starts looking for a free id at `1` again (`0`
+is always in the table).
+
+When adding a new handle, the multi checks the amount of free entries
+in the `multi->xfers` table. If that drops below a threshold (currently 25%),
+the table is resized. This serves two purposes: one, a previous `mid` is not
+reused immediately and second, table resizes are not needed that often.
+
+The table is implemented in `uint-table.[ch]`. More details in [`UINT_SETS`](UINT_SETS.md).
+
+### Tracking `mid`s
+
+There are several places where transfers need to be tracked:
+
+* the multi tracks `process`, `pending` and `msgsent` transfers. A transfer
+  is in at most one of these at a time.
+* connections track the transfers that are *attached* to them.
+* multi event handling tracks transfers interested in a specific socket.
+* DoH handles track the handle they perform lookups for (and vice versa).
+
+There are two bitset implemented for storing `mid`s: `uint_bset` and `uint_spbset`.
+The first is a bitset optimal for storing a large number of unsigned int values.
+The second one is a "sparse" variant good for storing a small set of numbers.
+More details about these in [`UINT_SETS`](UINT_SETS.md).
+
+A multi uses `uint_bset`s for `process`, `pending` and `msgsent`. Connections
+and sockets use the sparse variant as both often track only a single transfer
+and at most 100 on an HTTP/2 or HTTP/3 connection/socket.
+
+These sets allow safe iteration while being modified. This allows a multi
+to iterate over its "process" set while existing transfers are removed
+or new ones added.
diff --git a/third-party/curl/docs/internals/MQTT.md b/third-party/curl/docs/internals/MQTT.md
new file mode 100644
index 0000000000..8379130173
--- /dev/null
+++ b/third-party/curl/docs/internals/MQTT.md
@@ -0,0 +1,61 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# MQTT in curl
+
+## Usage
+
+A plain "GET" subscribes to the topic and prints all published messages.
+
+Doing a "POST" publishes the post data to the topic and exits.
+
+## TLS protection
+
+Use `mqtts://` to do MQTT over TLS: MQTTS.
+
+### Subscribing
+
+Command usage:
+
+    curl mqtt://host/topic
+
+Example subscribe:
+
+    curl mqtt://host.home/bedroom/temp
+
+This sends an MQTT SUBSCRIBE packet for the topic `bedroom/temp` and listen in
+for incoming PUBLISH packets.
+
+You can set the upkeep interval ms option to make curl send MQTT ping requests
+to the server at an internal, to prevent the connection to get closed because
+of idleness. You might then need to use the progress callback to cancel the
+operation.
+
+### Publishing
+
+Command usage:
+
+    curl -d payload mqtt://host/topic
+
+Example publish:
+
+    curl -d 75 mqtt://host.home/bedroom/dimmer
+
+This sends an MQTT PUBLISH packet to the topic `bedroom/dimmer` with the
+payload `75`.
+
+## What does curl deliver as a response to a subscribe
+
+Whenever a PUBLISH packet is received, curl outputs two bytes topic length
+(MSB | LSB), the topic followed by the payload.
+
+## Caveats
+
+Remaining limitations:
+
+- Only QoS level 0 is implemented for publish
+- No way to set retain flag for publish
+- Naive EAGAIN handling does not handle split messages
diff --git a/third-party/curl/docs/internals/MULTI-EV.md b/third-party/curl/docs/internals/MULTI-EV.md
new file mode 100644
index 0000000000..f5d2fa831c
--- /dev/null
+++ b/third-party/curl/docs/internals/MULTI-EV.md
@@ -0,0 +1,127 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# Multi Event Based
+
+A libcurl multi is operating "event based" when the application uses
+and event library like `libuv` to monitor the sockets and file descriptors
+libcurl uses to trigger transfer operations. How that works from the
+applications point of view is described in libcurl-multi(3).
+
+This documents is about the internal handling.
+
+## Source Locations
+
+All code related to event based handling is found in `lib/multi_ev.c`
+and `lib/multi_ev.h`. The header defines a set of internal functions
+and `struct curl_multi_ev` that is embedded in each multi handle.
+
+There is `Curl_multi_ev_init()` and `Curl_multi_ev_cleanup()` to manage
+the overall life cycle, call on creation and destruction of the multi
+handle.
+
+## Tracking Events
+
+First, the various functions in `lib/multi_ev.h` only ever really do
+something when the libcurl application has registered its callback
+in `multi->socket_cb`.
+
+This is important as this callback gets informed about *changes* to sockets.
+When a new socket is added, an existing is removed, or the `POLLIN/OUT`
+flags change, `multi->socket_cb` needs to be invoked. `multi_ev` has to
+track what it already reported to detect changes.
+
+Most applications are expected to go "event based" right from the start,
+but the libcurl API does not prohibit an application to start another
+way and then go for events later on, even in the middle of a transfer.
+
+### Transfer Events
+
+Most event that happen are in connection with a transfer. A transfer
+opens a connection, which opens a socket, and waits for this socket
+to become writable (`POLLOUT`) when using TCP, for example.
+
+The multi then calls `Curl_multi_ev_assess_xfer(multi, data)` to
+let the multi event code detect what sockets the transfer is interested in.
+If indeed a `multi->socket_cb` is set, the *current* transfer pollset is
+retrieved via `Curl_multi_getsock()`. This current pollset is then
+compared to the *previous* pollset. If relevant changes are detected,
+`multi->socket_cb` gets informed about those. These can be:
+
+ * a socket is in the current set, but not the previous one
+ * a socket was also in the previous one, but IN/OUT flags changed
+ * a socket in the previous one is no longer part of the current
+
+`multi_ev.c` keeps a `struct mev_sh_entry` for each sockets in a hash
+with the socket as key. It tracks in each entry which transfers are
+interested in this particular socket. How many transfer want to read
+and/or write and what the summarized `POLLIN/POLLOUT` action, that
+had been reported to `multi->socket_cb` was.
+
+This is necessary as a socket may be in use by several transfers
+at the same time (think HTTP/2 on the same connection). When a transfer
+is done and gets removed from the socket entry, it decrements
+the reader and/or writer count (depending on what it was last
+interested in). This *may* result in the entry's summarized action
+to change, or not.
+
+### Connection Events
+
+There are also events not connected to any transfer that need to be tracked.
+The multi connection cache, concerned with clean shutdowns of connections,
+is interested in socket events during the shutdown.
+
+To allow use of the libcurl infrastructure, the connection cache operates
+using an *internal* easy handle that is not a transfer as such. The
+internal handle is used for all connection shutdown operations, being tied
+to a particular connection only for a short time. This means tracking
+the last pollset for an internal handle is useless.
+
+Instead, the connection cache uses `Curl_multi_ev_assess_conn()` to have
+multi event handling check the connection and track a "last pollset"
+for the connection alone.
+
+## Event Processing
+
+When the libcurl application is informed by the event library that
+a particular socket has an event, it calls `curl_multi_socket_action()`
+to make libcurl react to it. This internally invokes
+`Curl_multi_ev_expire_xfers()` which expires all transfers that
+are interested in the given socket, so the multi handle runs them.
+
+In addition `Curl_multi_ev_expire_xfers()` returns a `bool` to let
+the multi know that connections are also interested in the socket, so
+the connection pool should be informed as well.
+
+## All Things Pass
+
+When a transfer is done, e.g. removed from its multi handle, the
+multi calls `Curl_multi_ev_xfer_done()`. This cleans up the pollset
+tracking for the transfer.
+
+When a connection is done, and before it is destroyed,
+`Curl_multi_ev_conn_done()` is called. This cleans up the pollset
+tracking for this connection.
+
+When a socket is about to be closed, `Curl_multi_ev_socket_done()`
+is called to cleanup the socket entry and all information kept there.
+
+These calls do not have to happen in any particular order. A transfer's
+socket may be around while the transfer is ongoing. Or it might disappear
+in the middle of things. Also, a transfer might be interested in several
+sockets at the same time (resolving, eye balling, ftp are all examples of
+those).
+
+### Come Again
+
+While transfer and connection identifiers are practically unique in a libcurl
+application, sockets are not. Operating systems are keen on reusing their
+resources, and the next socket may get the same identifier as a recently
+closed one with high likelihood.
+
+This means that multi event handling needs to be informed *before* a close,
+clean up all its tracking and be ready to see that same socket identifier
+again right after.
diff --git a/third-party/curl/docs/NEW-PROTOCOL.md b/third-party/curl/docs/internals/NEW-PROTOCOL.md
similarity index 75%
rename from third-party/curl/docs/NEW-PROTOCOL.md
rename to third-party/curl/docs/internals/NEW-PROTOCOL.md
index a8b227d3c0..832f8e843d 100644
--- a/third-party/curl/docs/NEW-PROTOCOL.md
+++ b/third-party/curl/docs/internals/NEW-PROTOCOL.md
@@ -1,3 +1,9 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
 # Adding a new protocol?
 
 Every once in a while, someone comes up with the idea of adding support for yet
@@ -7,16 +13,16 @@ protocols and it is the Internet transfer machine for the world.
 In the curl project we love protocols and we love supporting many protocols
 and doing it well.
 
-So how do you proceed to add a new protocol and what are the requirements?
+How do you proceed to add a new protocol and what are the requirements?
 
 ## No fixed set of requirements
 
 This document is an attempt to describe things to consider. There is no
 checklist of the twenty-seven things you need to cross off. We view the entire
-effort as a whole and then judge if it seems to be the right thing - for
-now. The more things that look right, fit our patterns and are done in ways
-that align with our thinking, the better are the chances that we will agree
-that supporting this protocol is a grand idea.
+effort as a whole and then judge if it seems to be the right thing - for now.
+The more things that look right, fit our patterns and are done in ways that
+align with our thinking, the better are the chances that we agree that
+supporting this protocol is a grand idea.
 
 ## Mutual benefit is preferred
 
@@ -51,9 +57,9 @@ There should be a documented URL format. If there is an RFC for it there is no
 question about it but the syntax does not have to be a published RFC. It could
 be enough if it is already in use by other implementations.
 
-If you make up the syntax just in order to be able to propose it to curl, then
-you are in a bad place. URLs are designed and defined for interoperability.
-There should at least be a good chance that other clients and servers can be
+If you make up the syntax in order to be able to propose it to curl, then you
+are in a bad place. URLs are designed and defined for interoperability. There
+should at least be a good chance that other clients and servers can be
 implemented supporting the same URL syntax and work the same or similar way.
 
 URLs work on registered 'schemes'. There is a register of [all officially
@@ -85,26 +91,26 @@ to curl and immediately once the code had been merged, the originator vanished
 from the face of the earth. That is fine, but we need to take the necessary
 precautions so when it happens we are still fine.
 
-Our test infrastructure is powerful enough to test just about every possible
-protocol - but it might require a bit of an effort to make it happen.
+Our test infrastructure is powerful enough to test almost every protocol - but
+it might require a bit of an effort to make it happen.
 
 ## Documentation
 
 We cannot assume that users are particularly familiar with details and
 peculiarities of the protocol. It needs documentation.
 
-Maybe it even needs some internal documentation so that the developers who
-will try to debug something five years from now can figure out functionality a
-little easier!
+Maybe it even needs some internal documentation so that the developers who try
+to debug something five years from now can figure out functionality a little
+easier.
 
 The protocol specification itself should be freely available without requiring
 a non-disclosure agreement or similar.
 
 ## Do not compare
 
-We are constantly raising the bar and we are constantly improving the
-project. A lot of things we did in the past would not be acceptable if done
-today. Therefore, you might be tempted to use shortcuts or "hacks" you can
-spot other - existing - protocol implementations have used, but there is
-nothing to gain from that. The bar has been raised. Former "cheats" will not be
-tolerated anymore.
+We are constantly raising the bar and we are constantly improving the project.
+A lot of things we did in the past would not be acceptable if done today.
+Therefore, you might be tempted to use shortcuts or "hacks" you can spot
+other - existing - protocol implementations have used, but there is nothing to
+gain from that. The bar has been raised. Former "cheats" may not tolerated
+anymore.
diff --git a/third-party/curl/docs/internals/PEERS.md b/third-party/curl/docs/internals/PEERS.md
new file mode 100644
index 0000000000..28d002a926
--- /dev/null
+++ b/third-party/curl/docs/internals/PEERS.md
@@ -0,0 +1,130 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# curl peers
+
+A `peer` in curl internals is represented by a `struct Curl_peer`. It has the following members:
+
+* `scheme`: a `struct Curl_scheme` of the URL schemes known to curl
+* `user_hostname`: the hostname as supplied by the user/application
+* `hostname`: a *normalized* version of `user_hostname`
+* `port`: the network port
+* `ipv6`: if `hostname` is an IPv6 address
+* `unix_socket`: if `hostname` is a path to a `unix domain socket`
+* `user_ipv6zone`: user supplied IPv6 zone name or `NULL`
+* `ipv6scope_id`: IPv6 address scope or 0
+* `abstract`: (if `unix_socket`) if the socket is abstract
+
+A peer, in short, is a communication endpoint.
+
+## peers and transfers
+
+The peer a transfer, e.g. easy handle, works against is determined at the
+start of each request. It is kept in `data->state.origin`. For the first
+request done in a `curl_easy_perform()` or equivalent, this origin is
+linked to `data->state.initial_origin`. This allows checks if properties
+of `data->set.*` should apply to a request or not.
+
+`data->state.origin` is relevant for cookie processing, signing requests
+and other request/response based processing.
+
+## peers and connections
+
+A network connection always goes *somewhere*. That *somewhere* is called
+the `origin` of the connection (e.g. the source of responses/downloads).
+It is kept in `conn->origin` and is always present in a connection.
+
+The `origin` is *logical* endpoint a connection talks to. In most
+configurations it is the same as `data->state.origin` (see proxies below).
+
+For most connections, the `origin` is connected to *directly*. It
+can be directed to another peer, however.
+
+### `connect-to`
+
+With the command line option `--connect-to` or the `libcurl` option
+`CURLOPT_CONNECT_TO`, a connection can be told to make the network connection
+to another endpoint *while keeping the `origin` unchanged*.
+
+This other endpoint is also a peer and is available as `conn->via_peer`.
+This may be a peer for a different hostname and port or it may be a
+`unix domain socket`.
+
+### proxies
+
+When a connection uses a proxy, the endpoint for contacting the proxy server
+is also represented as a peer and is kept at `conn->socks_proxy.peer` and/or
+`conn->http_proxy.peer`. `SOCKS` proxies always come first, so a connection
+might connect as:
+
+```
+1. curl -------------------------------------------> conn->origin
+2. curl -------------------------------------------> conn->via_peer (acting as conn->origin)
+3. curl --> socks_proxy.peer ----------------------> conn->via_peer/origin
+4. curl -----------------------> http_proxy.peer --> conn->via_peer/origin
+5. curl --> socks_proxy.peer --> http_proxy.peer --> conn->via_peer/origin
+```
+
+A `conn->(socks|http)_proxy.peer` is only ever present when the proxy
+is in use and `NULL` otherwise.
+
+SOCKS proxies are always used for tunneling, either to the origin or
+the HTTP proxy. They operate in a connection filter.
+
+HTTP proxies can operate in two modes: tunneling or forwarding. When tunneling,
+they also operate in a connection filter. In forwarding mode however, they
+become the `origin` the connection talks to.
+
+Therefore, connections that talk to a forwarding HTTP proxy have `conn->origin`
+set to `conn->http_proxy.peer` and `conn->bits.origin_is_proxy` is set.
+
+The connection filter `SETUP`, that assembles the filters for a connection,
+figures out which peer to pass to which filter in order to make it all work.
+The individual filters get passed a specific peer and do not need be concerned
+with the whole chain.
+
+For example, IP connection goes to `origin`(1), `via_peer`(2),
+`socks_proxy.peer`(3+5), `http_proxy.peer`(4) and that is the peer that gets
+passed to the `DNS` and `HAPPY-EYEBALLS` filters.
+
+### TLS
+
+TLS filters' task is to verify the peer they talk to (unless that is
+switched off). They either talk to the `conn->origin` or the
+`conn->http_proxy.peer` (`SOCKS` does not have TLS). The `conn->via_peer` is
+irrelevant. A `via_peer` endpoint needs to present a certificate matching
+`conn->origin` or the connect must fail.
+
+### `unix domain socket`s
+
+Peers that represent a `unix domain socket` may be used in two places:
+
+1. `via_peer`: curl can connect to an `origin` server via `unix domain socket`s.
+   This disables any proxy settings a transfer might carry.
+2. `socks_proxy.peer`: a `SOCKS` proxy may be contacted over a `unix domain
+   socket`.
+
+It is not supported to contact an http proxy over `unix domain socket`s.
+
+## peers and credentials
+
+There have been several vulnerabilities by leaking credentials in requests
+where they should not appear. In future work we plan to tie credentials to
+`peers` and use them only when their `peer` still matches the current
+connection use.
+
+## peers internals
+
+A `struct Curl_peer` is allocated with space of the `user_hostname`.
+Only when the user supplied value needs conversions (removing `[]` or
+IDN encoding) is `hostname` an extra allocation. This keeps the number
+of allocations the same as before.
+
+A `Curl_peer` is not expected to be modified after it has been created.
+However, each `Curl_peer` has a reference counter. Code needs to use
+`Curl_peer_link()` and `Curl_peer_unlink()` to keep/release references.
+This makes it safe and cheap to keep references to peers in connections
+and filters.
diff --git a/third-party/curl/docs/internals/PORTING.md b/third-party/curl/docs/internals/PORTING.md
new file mode 100644
index 0000000000..aa1aa7873a
--- /dev/null
+++ b/third-party/curl/docs/internals/PORTING.md
@@ -0,0 +1,47 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# porting libcurl
+
+The basic approach I use when porting libcurl to another OS when the existing
+configure or cmake build setups are not suitable.
+
+## Build
+
+Write a build script/Makefile that builds *all* C files under lib/. If
+possible, use the `lib/Makefile.inc` that lists all files in Makefile
+variables.
+
+In the Makefile, make sure you define what OS you build for: `-D[OPERATING
+SYSTEM]`, or similar. Perhaps the compiler in use already define a standard
+one? Then you might not need to define your own.
+
+## Add the new OS
+
+In the `lib/curl_config.h` header file, in the section for when `HAVE_CONFIG_H`
+is *not* defined (starting at around line 150), add a new conditional include
+in this style:
+
+~~~c
+#ifdef [OPERATING SYSTEM]
+#  include "config-operatingsystem.h"
+#endif
+~~~
+
+Create `lib/config-operatingsystem.h`. You might want to start with copying a
+another config-* file and then start trimming according to what your
+environment supports.
+
+## Build it
+
+When you run into compiler warnings or errors, the
+`lib/config-operatingsystem.h` file should be where you should focus your work
+and edits.
+
+A recommended approach is to define a lot of the `CURL_DISABLE_*` defines (see
+the [CURL-DISABLE](../CURL-DISABLE.md) document) initially to help narrow down
+the initial work as that can save you from having to give attention to areas of
+the code that you do not care for in your port.
diff --git a/third-party/curl/docs/internals/RATELIMITS.md b/third-party/curl/docs/internals/RATELIMITS.md
new file mode 100644
index 0000000000..af72211b78
--- /dev/null
+++ b/third-party/curl/docs/internals/RATELIMITS.md
@@ -0,0 +1,100 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# Rate Limiting Transfers
+
+Rate limiting a transfer means that no more than "n bytes per second"
+shall be sent or received. It can be set individually for both directions
+via `CURLOPT_MAX_RECV_SPEED_LARGE` and `CURLOPT_MAX_SEND_SPEED_LARGE`. These
+options may be adjusted for an ongoing transfer.
+
+### Implementation Base
+
+`ratelimit.[ch]` implements `struct Curl_rlimit` and functions to manage
+such limits. It has the following properties:
+
+* `rate_per_sec`: how many "tokens" can be used per second, 0 for infinite.
+* `tokens`: the currently available tokens to consume
+* `burst_per_sec`: an upper limit on tokens available
+* `ts`: the microsecond timestamp of the last tokens update
+* `spare_us`: elapsed microseconds that have not counted yet for a token update
+* `blocked`: if the limit is blocked
+
+Tokens can be *drained* from an `rlimit`. This reduces `tokens`, even to
+negative values. To enforce the limits, tokens should not be drained
+further when they reach 0, but such things may happen.
+
+An `rlimit`can be asked how long to wait until `tokens` are positive again.
+This is given in milliseconds. When token are available, this wait
+time is 0.
+
+Ideally a user of `rlimit` would consume the available tokens to 0, then
+get a wait times of 1000ms, after which the set rate of tokens has
+regenerated. Rinse and repeat.
+
+Should a user drain twice the amount of the rate, tokens are negative
+and the wait time is 2 seconds. The `spare_us` account for the
+time that has passed for the consumption. When a user takes 250ms to
+consume the rate, the wait time is then 750ms.
+
+When a user drains nothing for two seconds, the available tokens would
+grow to twice the rate, unless a burst rate is set.
+
+Finally, an `rlimit` may be set to `blocked` and later unblocked again.
+A blocked `rlimit` has no tokens available. This works also when the rate
+is unlimited (`rate_per_sec` set to 0).
+
+### Downloads
+
+`rlimit` is in `data->progress.dl.rlimit`. `setopt.c` initializes it whenever
+the application sets `CURLOPT_MAX_RECV_SPEED_LARGE`. This may be done
+in the middle of a transfer.
+
+`rlimit` tokens are drained in the "protocol" client writer. Checks for
+capacity depend on the protocol:
+
+* HTTP and other plain protocols: `transfer.c:sendrecv_dl()` reads only
+up to capacity.
+* HTTP/2: capacity is used to adjust a stream's window size. Since all
+streams start with `64kb`, `rlimit` takes a few seconds to take effect.
+* HTTP/3: ngtcp2 acknowledges stream data according to capacity. It
+keeps track of bytes not acknowledged yet. This has the same effect as HTTP/2
+window sizes.
+
+(The quiche API does not offer control of `ACK`s and `rlimits` for download
+do not work in that backend.)
+
+### Uploads
+
+`rlimit` is in `data->progress.ul.rlimit`. `setopt.c` initializes it whenever
+the application sets `CURLOPT_MAX_SEND_SPEED_LARGE`. This may be done
+in the middle of a transfer.
+
+The upload capacity is checked in `Curl_client_read()` and readers are
+only asked to read bytes up to the `rlimit` capacity. This limits upload
+of data for all protocols in the same way.
+
+### Pause/Unpause
+
+Pausing of up-/downloads sets the corresponding `rlimit` to blocked. Unpausing
+removes that block.
+
+### Suspending transfers
+
+While obeying the `rlimit` for up-/download leads to the desired transfer
+rates, the other issue that needs care is CPU consumption.
+
+`rlimits` are inspected when computing the "pollset" of a transfer. When
+a transfer wants to send, but not send tokens are available, the `POLLOUT`
+is removed from the pollset. Same for receiving.
+
+For a transfer that is, due to `rlimit`, not able to progress, the pollset
+is then empty. No socket events are monitored, no CPU activity
+happens. For paused transfers, this is sufficient.
+
+Draining `rlimit` happens when a transfer is in `PERFORM` state and
+exhausted limits cause the timer `TOOFAST` to be set. When the fires,
+the transfer runs again and `rlimit`s are re-evaluated.
diff --git a/third-party/curl/docs/internals/README.md b/third-party/curl/docs/internals/README.md
new file mode 100644
index 0000000000..289b360ad1
--- /dev/null
+++ b/third-party/curl/docs/internals/README.md
@@ -0,0 +1,12 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# Internals
+
+This directory contains documentation covering libcurl internals; APIs and
+concepts that are useful for contributors and maintainers.
+
+Public APIs are documented in the public documentation, not here.
diff --git a/third-party/curl/docs/internals/SCORECARD.md b/third-party/curl/docs/internals/SCORECARD.md
new file mode 100644
index 0000000000..049e1567b6
--- /dev/null
+++ b/third-party/curl/docs/internals/SCORECARD.md
@@ -0,0 +1,90 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# scorecard.py
+
+This is an internal script in `tests/http/scorecard.py` used for testing
+curl's performance in a set of cases. These are for exercising parts of
+curl/libcurl in a reproducible fashion to judge improvements or detect
+regressions. They are not intended to represent real world scenarios
+as such.
+
+This script is not part of any official interface and we may change it in
+the future according to the project's needs.
+
+## setup
+
+When you are able to run curl's `pytest` suite, scorecard should work for you
+as well. They start a local Apache httpd or Caddy server and invoke the
+locally build `src/curl` (by default).
+
+## invocation
+
+A typical invocation for measuring performance of HTTP/2 downloads would be:
+
+```sh
+curl> python3 tests/http/scorecard.py -d h2
+```
+
+and this prints a table with the results. The last argument is the protocol to
+test and it can be `h1`, `h2` or `h3`. You can add `--json` to get results in
+JSON instead of text.
+
+Help for all command line options are available via:
+
+```sh
+curl> python3 tests/http/scorecard.py -h
+```
+
+## scenarios
+
+Apart from `-d/--downloads` there is `-u/--uploads` and `-r/--requests`. These
+are run with a variation of resource sizes and parallelism by default. You can
+specify these in some way if you are interested in a particular case.
+
+For example, to run downloads of a 1 MB resource only, 100 times with at max 6
+parallel transfers, use:
+
+```sh
+curl> python3 tests/http/scorecard.py -d --download-sizes=1mb --download-count=100 --download-parallel=6 h2
+```
+
+Similar options are available for uploads and requests scenarios.
+
+## sockd
+
+If you have configured curl with `--with-test-danted=<danted-path>` for a
+`dante-server` installed on your system, you can provide the scorecard
+with arguments `--socks4` or `--socks5` to test performance with a SOCKS proxy
+involved. (Note: this does not work for HTTP/3)
+
+## flame graphs
+
+With the excellent [Flame Graph](https://github.com/brendangregg/FlameGraph)
+by Brendan Gregg, scorecard can turn `perf`/`dtrace` samples into an
+interactive SVG. Either clone the `Flamegraph` repository next to your `curl`
+project or set the environment variable `FLAMEGRAPH` to the location of your
+clone. Then run scorecard with the `--flame` option, like
+
+```sh
+curl> FLAMEGRAPH=/Users/sei/projects/FlameGraph python3 tests/http/scorecard.py \
+   -r --request-count=50000 --request-parallels=100 --samples=1 --flame h2
+```
+
+and the SVG of the run is in `tests/http/gen/curl/curl.flamegraph.svg`. You
+can open that in Firefox and zoom in/out of stacks of interest.
+
+The flame graph is about the last run of `curl`. That is why you should add
+scorecard arguments that restrict measurements to a single run.
+
+### Measures/Privileges
+
+The `--flame` option uses `perf` on linux and `dtrace` on macOS. Since both
+tools require special privileges, they are run via the `sudo` command by
+scorecard. This means you need to issue a `sudo` recently enough before
+running scorecard, so no new password check is needed.
+
+There is no support right now for measurements on other platforms.
diff --git a/third-party/curl/docs/internals/SPLAY.md b/third-party/curl/docs/internals/SPLAY.md
new file mode 100644
index 0000000000..29cf3858a6
--- /dev/null
+++ b/third-party/curl/docs/internals/SPLAY.md
@@ -0,0 +1,111 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# `splay`
+
+    #include "splay.h"
+
+This is an internal module for splay tree management. A splay tree is a binary
+search tree with the additional property that recently accessed elements are
+quick to access again. A self-balancing tree.
+
+Nodes are added to the tree, they are accessed and removed from the tree and
+it automatically rebalances itself in each operation.
+
+## libcurl use
+
+libcurl adds fixed timeout expiry timestamps to the splay tree, and is meant
+to scale up to holding a huge amount of pending timeouts with decent
+performance.
+
+The splay tree is used to:
+
+1. figure out the next timeout expiry value closest in time
+2. iterate over timeouts that already have expired
+
+This splay tree rebalances itself based on the time value.
+
+Each node in the splay tree points to a `struct Curl_easy`. Each `Curl_easy`
+struct is represented only once in the tree. To still allow each easy handle
+to have a large number of timeouts per handle, each handle has a sorted linked
+list of pending timeouts. Only the handle's timeout that is closest to expire
+is the timestamp used for the splay tree node.
+
+When a specific easy handle's timeout expires, the node gets removed from the
+splay tree and from the handle's linked list of timeouts. The next timeout for
+that handle is then first in line and becomes the new timeout value as the
+node is re-added to the splay.
+
+## `Curl_splay`
+
+~~~c
+struct Curl_tree *Curl_splay(struct curltime i, struct Curl_tree *t);
+~~~
+
+Rearranges the tree `t` after the provide time `i`.
+
+## `Curl_splayinsert`
+
+~~~c
+struct Curl_tree *Curl_splayinsert(struct curltime key,
+                                   struct Curl_tree *t,
+                                   struct Curl_tree *node);
+~~~
+
+This function inserts a new `node` in the tree, using the given `key`
+timestamp. The `node` struct has a field called `->payload` that can be set to
+point to anything. libcurl sets this to the `struct Curl_easy` handle that is
+associated with the timeout value set in `key`.
+
+The splay insert function does not allocate any memory, it assumes the caller
+has that arranged.
+
+It returns a pointer to the new tree root.
+
+## `Curl_splaygetbest`
+
+~~~c
+struct Curl_tree *Curl_splaygetbest(struct curltime key,
+                                    struct Curl_tree *tree,
+                                    struct Curl_tree **removed);
+~~~
+
+If there is a node in the `tree` that has a time value that is less than the
+provided `key`, this function removes that node from the tree and provides it
+in the `*removed` pointer (or NULL if there was no match).
+
+It returns a pointer to the new tree root.
+
+## `Curl_splayremove`
+
+~~~c
+int Curl_splayremove(struct Curl_tree *tree,
+                     struct Curl_tree *node,
+                     struct Curl_tree **newroot);
+~~~
+
+Removes a given `node` from a splay `tree`, and returns the `newroot`
+identifying the new tree root.
+
+Note that a clean tree without any nodes present implies a NULL pointer.
+
+## `Curl_splayset`
+
+~~~c
+void Curl_splayset(struct Curl_tree *node, void *payload);
+~~~
+
+Set a custom pointer to be stored in the splay node. This pointer is not used
+by the splay code itself and can be retrieved again with `Curl_splayget`.
+
+## `Curl_splayget`
+
+~~~c
+void *Curl_splayget(struct Curl_tree *node);
+~~~
+
+Get the custom pointer from the splay node that was previously set with
+`Curl_splayset`. If no pointer was set before, it returns NULL.
diff --git a/third-party/curl/docs/internals/STRPARSE.md b/third-party/curl/docs/internals/STRPARSE.md
new file mode 100644
index 0000000000..8d0e8ba515
--- /dev/null
+++ b/third-party/curl/docs/internals/STRPARSE.md
@@ -0,0 +1,230 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# String parsing with `strparse`
+
+The functions take input via a pointer to a pointer, which allows the
+functions to advance the pointer on success which then by extension allows
+"chaining" of functions like this example that gets a word, a space and then a
+second word:
+
+~~~c
+if(curlx_str_word(&line, &word1, MAX) ||
+   curlx_str_singlespace(&line) ||
+   curlx_str_word(&line, &word2, MAX))
+  fprintf(stderr, "ERROR\n");
+~~~
+
+The input pointer **must** point to a null-terminated buffer area or these
+functions risk continuing "off the edge".
+
+## Strings
+
+The functions that return string information does so by populating a
+`struct Curl_str`:
+
+~~~c
+struct Curl_str {
+  char *str;
+  size_t len;
+};
+~~~
+
+Access the struct fields with `curlx_str()` for the pointer and `curlx_strlen()`
+for the length rather than using the struct fields directly.
+
+## `curlx_str_init`
+
+~~~c
+void curlx_str_init(struct Curl_str *out)
+~~~
+
+This initiates a string struct. The parser functions that store info in
+strings always init the string themselves, so this stand-alone use is often
+not necessary.
+
+## `curlx_str_assign`
+
+~~~c
+void curlx_str_assign(struct Curl_str *out, const char *str, size_t len)
+~~~
+
+Set a pointer and associated length in the string struct.
+
+## `curlx_str_word`
+
+~~~c
+int curlx_str_word(char **linep, struct Curl_str *out, const size_t max);
+~~~
+
+Get a sequence of bytes until the first space or the end of the string. Return
+non-zero on error. There is no way to include a space in the word, no sort of
+escaping. The word must be at least one byte, otherwise it is considered an
+error.
+
+`max` is the longest accepted word, or it returns error.
+
+On a successful return, `linep` is updated to point to the byte immediately
+following the parsed word.
+
+## `curlx_str_until`
+
+~~~c
+int curlx_str_until(char **linep, struct Curl_str *out, const size_t max,
+                   char delim);
+~~~
+
+Like `curlx_str_word` but instead of parsing to space, it parses to a given
+custom delimiter non-zero byte `delim`.
+
+`max` is the longest accepted word, or it returns error.
+
+The parsed word must be at least one byte, otherwise it is considered an
+error.
+
+## `curlx_str_untilnl`
+
+~~~c
+int curlx_str_untilnl(char **linep, struct Curl_str *out, const size_t max);
+~~~
+
+Like `curlx_str_untilnl` but instead parses until it finds a "newline byte".
+That means either a CR (ASCII 13) or an LF (ASCII 10) octet.
+
+`max` is the longest accepted word, or it returns error.
+
+The parsed word must be at least one byte, otherwise it is considered an
+error.
+
+## `curlx_str_cspn`
+
+~~~c
+int curlx_str_cspn(const char **linep, struct Curl_str *out, const char *cspn);
+~~~
+
+Get a sequence of characters until one of the bytes in the `cspn` string
+matches. Similar to the `strcspn` function.
+
+## `curlx_str_quotedword`
+
+~~~c
+int curlx_str_quotedword(char **linep, struct Curl_str *out, const size_t max);
+~~~
+
+Get a "quoted" word. This means everything that is provided within a leading
+and an ending double quote character. No escaping possible.
+
+`max` is the longest accepted word, or it returns error.
+
+The parsed word must be at least one byte, otherwise it is considered an
+error.
+
+## `curlx_str_single`
+
+~~~c
+int curlx_str_single(char **linep, char byte);
+~~~
+
+Advance over a single character provided in `byte`. Return non-zero on error.
+
+## `curlx_str_singlespace`
+
+~~~c
+int curlx_str_singlespace(char **linep);
+~~~
+
+Advance over a single ASCII space. Return non-zero on error.
+
+## `curlx_str_passblanks`
+
+~~~c
+void curlx_str_passblanks(char **linep);
+~~~
+
+Advance over all spaces and tabs.
+
+## `curlx_str_trimblanks`
+
+~~~c
+void curlx_str_trimblanks(struct Curl_str *out);
+~~~
+
+Trim off blanks (spaces and tabs) from the start and the end of the given
+string.
+
+## `curlx_str_number`
+
+~~~c
+int curlx_str_number(char **linep, curl_size_t *nump, size_t max);
+~~~
+
+Get an unsigned decimal number not larger than `max`. Leading zeroes are
+swallowed. Return non-zero on error. Returns error if there was not a single
+digit.
+
+## `curlx_str_numblanks`
+
+~~~c
+int curlx_str_numblanks(char **linep, curl_size_t *nump);
+~~~
+
+Get an unsigned 63-bit decimal number. Leading blanks and zeroes are skipped.
+Returns non-zero on error. Returns error if there was not a single digit.
+
+## `curlx_str_hex`
+
+~~~c
+int curlx_str_hex(char **linep, curl_size_t *nump, size_t max);
+~~~
+
+Get an unsigned hexadecimal number not larger than `max`. Leading zeroes are
+swallowed. Return non-zero on error. Returns error if there was not a single
+digit. Does *not* handled `0x` prefix.
+
+## `curlx_str_octal`
+
+~~~c
+int curlx_str_octal(char **linep, curl_size_t *nump, size_t max);
+~~~
+
+Get an unsigned octal number not larger than `max`. Leading zeroes are
+swallowed. Return non-zero on error. Returns error if there was not a single
+digit.
+
+## `curlx_str_newline`
+
+~~~c
+int curlx_str_newline(char **linep);
+~~~
+
+Check for a single CR or LF. Return non-zero on error */
+
+## `curlx_str_casecompare`
+
+~~~c
+int curlx_str_casecompare(struct Curl_str *str, const char *check);
+~~~
+
+Returns true if the provided string in the `str` argument matches the `check`
+string case insensitively.
+
+## `curlx_str_cmp`
+
+~~~c
+int curlx_str_cmp(struct Curl_str *str, const char *check);
+~~~
+
+Returns true if the provided string in the `str` argument matches the `check`
+string case sensitively. This is *not* the same return code as `strcmp`.
+
+## `curlx_str_nudge`
+
+~~~c
+int curlx_str_nudge(struct Curl_str *str, size_t num);
+~~~
+
+Removes `num` bytes from the beginning (left) of the string kept in `str`. If
+`num` is larger than the string, it instead returns an error.
diff --git a/third-party/curl/docs/internals/THRDPOOL-AND-QUEUE.md b/third-party/curl/docs/internals/THRDPOOL-AND-QUEUE.md
new file mode 100644
index 0000000000..e55f8a2be3
--- /dev/null
+++ b/third-party/curl/docs/internals/THRDPOOL-AND-QUEUE.md
@@ -0,0 +1,112 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# Thread Pool and Queue
+
+The thread pool and queue manage asynchronous processing of "work items"
+to a user. The "work items" are opaque to the pool and queue, represented
+by a `void *`, handled via callback functions.
+
+Thread pool and queue are available with `pthreads` or native Win32
+builds.
+
+## `Curl_thrdpool`
+
+This data structure manages a pool of threads for asynchronous operations.
+
+### Properties
+
+A pool's properties are:
+
+- minimum number of threads running, default 0
+- maximum number of threads running
+- timeout for idle threads before they shut down
+
+The minimum number of threads is started at creation of the pool and
+kept always running. On demand, when more work is available but all
+existing threads are busy, it starts new threads, up to maximum.
+
+When work ceases, the threads "above" the minimum number exit again
+after the given idle time.
+
+### Operation
+
+The pool is created with providing three callback functions:
+
+- `take`: the pool calls this to take a new "work item" for processing. From
+   the pool's point of view, a work item is a `void *`. "take" is called from
+   the pool's threads. When getting anything besides `NULL`, the thread is
+   "busy". On getting `NULL`, the thread becomes idle.
+- `process`: called by a pool thread to process a work item. This can not
+   return any error. Any error handling must be done via properties in
+   the work item itself, opaque to the pool.
+- `return`: after processing, the work item is returned and the pool has
+   no longer have any memory of it.
+
+The pool only tries to "take" new work items when told to. Calling
+`Curl_thrdpool_signal(pool, n)` awakens up to `n`threads which then
+take new work items. This may cause new threads being started. The other
+time a pool thread "take"s work it when it has finished
+processing and returned another item.
+
+A thread pool can be destroyed via `Curl_thrdpool_destroy(pool, join)` where
+`join` determines if active threads shall be joined or detached.
+
+### Safety
+
+The thread pool operates use a mutex and condition variables to manage
+concurrency. All interactions and callback invocation are done under
+the pool's mutex lock, *except* the "process" callback which is invoked
+unlocked.
+
+To avoid deadlocks, no callback must invoked other pool functions. Also,
+any call of pool functions may result in callback invocations.
+
+The "work items", once "taken" by the pool, should not be referenced
+from any other place. Thread pools **always** invoke the "return"
+callback on a work item, even after the pool has been destroyed by
+detaching the threads.
+
+There is a `user_data` in the pool's creation that is passed to "take"
+and "return" callbacks. Once a pool is destroyed, this `user_data` is
+cleared and "return" callbacks always see a `NULL`. This way,
+the "return" callback may act on that fact.
+
+## `Curl_thrdq`
+
+A `thrdq` is a two-way queue with a thread pool. Users of a thread queue may
+"send" work items into the queue and "receive" processed items back.
+
+### Properties
+
+A queue's properties are:
+
+- The properties of the thread pool to create
+- the maximum length of the "send" queue, 0 for unlimited
+
+### Operation
+
+The queue is created with providing three callback functions:
+
+- `free`: called to free a work item that is in the queue but is
+  no longer returned (or processed). This happens when the queue is
+  destroyed or when work items are removed for other reasons.
+- `process`: process the item. Can not fail.
+- `event`: called when work items have been added to the "receive" list.
+
+Users of a thread queue call `Curl_thrdq_send()` to add a work item to
+the queue. Calling `Curl_thrdq_recv()` delivers processed items back.
+
+### Safety
+
+The thread queue operates use a mutex and condition variables to manage
+concurrency. All interactions and callback invocation are done under
+the queue's mutex lock, *except* the "process" callback which is invoked
+unlocked.
+
+Users of a thread queue should not hold any reference to work items sent
+into the queue. The provided "free" callback has to take care of any
+resources allocated by work items.
diff --git a/third-party/curl/docs/internals/TIME-KEEPING.md b/third-party/curl/docs/internals/TIME-KEEPING.md
new file mode 100644
index 0000000000..b43daae0be
--- /dev/null
+++ b/third-party/curl/docs/internals/TIME-KEEPING.md
@@ -0,0 +1,53 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# Keeping Time
+
+Transfers need the current time to handle timeouts and keep a record of
+events. The current time function is `curlx_now()` and it uses a **monotonic**
+clock on most platforms. This ensures that time only ever increases (the
+timestamps it gives are however not the "real" world clock).
+
+## Initial Approach (now historic)
+
+The loop processing functions called `curlx_now()` at the beginning and then
+passed a pointer to the `struct curltime now` to functions to save them the
+calls. Passing this pointer down to all functions possibly involved was not
+done as this pollutes the internal APIs.
+
+Some functions continued to call `curlx_now()` on their own while others used
+the passed pointer *to a timestamp in the past*. This led to a transfer
+experiencing *jumps* in time, reversing cause and effect. On fast systems,
+this was mostly not noticeable. On slow machines or in CI, this led to rare
+and annoying test failures.
+
+(Especially when we added assertions that the reported "timeline" of a
+transfer was in the correct order: *queue -> nameloopup -> connect ->
+appconnect ->...*.)
+
+## Revised Approach
+
+The strategy of handling transfer's time is now:
+
+* Keep a "now" timestamp in the multi handle. Keep a fallback "now" timestamp
+  in the easy handle.
+* Always use `Curl_pgrs_now(data)` to get the current time of a transfer.
+* Do not use `curlx_now()` directly for transfer handling (exceptions apply
+  for loops).
+
+This has the following advantages:
+
+* No need to pass a `struct curltime` around or pass a pointer to an outdated
+  timestamp to other functions.
+* No need to calculate the exact `now` until it is really used.
+* Passing a `const` pointer is better than struct passing. Updating and
+  passing a pointer to the same memory location for all transfers is even
+  better.
+
+Caveats:
+
+* do not store the pointer returned by `Curl_pgrs_now(data)` anywhere that
+  outlives the current code invocation.
diff --git a/third-party/curl/docs/internals/TLS-SESSIONS.md b/third-party/curl/docs/internals/TLS-SESSIONS.md
new file mode 100644
index 0000000000..c3bf7038b4
--- /dev/null
+++ b/third-party/curl/docs/internals/TLS-SESSIONS.md
@@ -0,0 +1,161 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# TLS Sessions and Tickets
+
+The TLS protocol offers methods of "resuming" a previous "session". A
+TLS "session" is a negotiated security context across a connection
+(which may be via TCP or UDP or other transports.)
+
+By "resuming", the TLS protocol means that the security context from
+before can be fully or partially resurrected when the TLS client presents
+the proper crypto stuff to the server. This saves on the amount of
+TLS packets that need to be sent back and forth, reducing amount
+of data and even latency. In the case of QUIC, resumption may send
+application data without having seen any reply from the server, hence
+this is named 0-RTT data.
+
+The exact mechanism of session tickets in TLSv1.2 (and earlier) and
+TLSv1.3 differs. TLSv1.2 tickets have several weaknesses (that can
+be exploited by attackers) which TLSv1.3 then fixed. See
+[Session Tickets in the real world](https://words.filippo.io/we-need-to-talk-about-session-tickets/)
+for an insight into this topic.
+
+These difference between TLS protocol versions are reflected in curl's
+handling of session tickets. More below.
+
+## curl's `ssl_peer_key`
+
+In order to find a ticket from a previous TLS session, curl
+needs a name for TLS sessions that uniquely identifies the peer
+it talks to.
+
+This name has to reflect also the various TLS parameters that can
+be configured in curl for a connection. We do not want to use
+a ticket from an different configuration. Example: when setting
+the maximum TLS version to 1.2, we do not want to reuse a ticket
+we got from a TLSv1.3 session, although we are talking to the
+same host.
+
+Internally, we call this name a `ssl_peer_key`. It is a printable
+string that carries hostname and port and any non-default TLS
+parameters involved in the connection.
+
+Examples:
+- `curl.se:443:CA-/etc/ssl/cert.pem:IMPL-GnuTLS/3.8.7` is a peer key for
+   a connection to `curl.se:443` using `/etc/ssl/cert.pem` as CA
+   trust anchors and GnuTLS/3.8.7 as TLS backend.
+- `curl.se:443:TLSVER-6-6:CA-/etc/ssl/cert.pem:IMPL-GnuTLS/3.8.7` is the
+   same as the previous, except it is configured to use TLSv1.2 as
+   min and max versions.
+
+Different configurations produce different keys which is what curl needs when
+handling SSL session tickets.
+
+One important thing: peer keys do not contain confidential information. If you
+configure a client certificate or SRP authentication with username/password,
+these are not part of the peer key.
+
+Peer keys carry the hostnames you use curl for. They *do* leak the privacy of
+your communication. We recommend to *not* persist peer keys for this reason.
+
+**Caveat**: The key may contain filenames or paths. It does not reflect the
+*contents* in the file system. If you change `/etc/ssl/cert.pem` and reuse
+a previous ticket, curl might trust a server which no longer has a root
+certificate in the file.
+
+## Session Cache Access
+
+#### Lookups
+
+When a new connection is being established, each SSL connection filter creates
+its own peer_key and calls into the cache. The cache then looks for a ticket
+with exactly this peer_key. Peer keys between proxy SSL filters and SSL
+filters talking through a tunnel differ, as they talk to different peers.
+
+If the connection filter wants to use a client certificate or SRP
+authentication, the cache checks those as well. If the cache peer carries
+client cert or SRP auth, the connection filter must have those with the same
+values (and vice versa).
+
+On a match, the connection filter gets the session ticket and feeds that to
+the TLS implementation which, on accepting it, tries to resume it for a
+shorter handshake. In addition, the filter gets the ALPN used before and the
+amount of 0-RTT data that the server announced to be willing to accept. The
+filter can then decide if it wants to attempt 0-RTT or not. (The ALPN is
+needed to know if the server speaks the protocol you want to send in 0-RTT. It
+makes no sense to send HTTP/2 requests to a server that only knows HTTP/1.1.)
+
+#### Updates
+
+When a new TLS session ticket is received by a filter, it adds it to the
+cache using its peer_key and SSL configuration. The cache looks for
+a matching entry and, should it find one, adds the ticket for this
+peer.
+
+### Put, Take and Return
+
+when a filter accesses the session cache, it *takes*
+a ticket from the cache, meaning a returned ticket is removed. The filter
+then configures its TLS backend and *returns* the ticket to the cache.
+
+The cache needs to treat tickets from TLSv1.2 and 1.3 differently. 1.2 tickets
+should be reused, but 1.3 tickets SHOULD NOT (RFC 8446). The session cache
+drops 1.3 tickets when they are returned after use, but keeps a 1.2
+ticket.
+
+When a ticket is *put* into the cache, there is also a difference. There
+can be several 1.3 tickets at the same time, but only a single 1.2 ticket.
+TLSv1.2 tickets replace any other. 1.3 tickets accumulate up to a max
+amount.
+
+By having a "put/take/return" we reflect the 1.3 use case nicely. Two
+concurrent connections do not reuse the same ticket.
+
+## Session Ticket Persistence
+
+#### Privacy and Security
+
+As mentioned above, SSL peer keys are not intended for storage in a file
+system. They clearly show which hosts the user talked to. This is not only
+privacy relevant, but also has security implications as an attacker might find
+worthy targets among your peer keys.
+
+Also, we do not recommend to persist TLSv1.2 tickets.
+
+### Salted Hashes
+
+The TLS session cache offers an alternative to storing peer keys:
+it provides a salted SHA256 hash of the peer key for import and export.
+
+#### Export
+
+The salt is generated randomly for each peer key on export. The SHA256 makes
+sure that the peer key cannot be reversed and that a slightly different key
+still produces a different result.
+
+This means an attacker cannot "grep" a session file for a particular entry,
+e.g. if they want to know if you accessed a specific host. They *can* however
+compute the SHA256 hashes for all salts in the file and find a specific entry.
+They *cannot* find a hostname they do not know. They would have to brute force
+by guessing.
+
+#### Import
+
+When session tickets are imported from a file, curl only gets the salted
+hashes. The imported tickets belong to an *unknown* peer key.
+
+When a connection filter tries to *take* a session ticket, it passes its peer
+key. This peer key initially does not match any tickets in the cache. The
+cache then checks all entries with unknown peer keys if the passed key matches
+their salted hash. If it does, the peer key is recovered and remembered at the
+cache entry.
+
+This is a performance penalty in the order of "unknown" peer keys which
+diminishes over time when keys are rediscovered. Note that this also works for
+putting a new ticket into the cache: when no present entry matches, a new one
+with peer key is created. This peer key then no longer bears the cost of hash
+computes.
diff --git a/third-party/curl/docs/internals/UINT_SETS.md b/third-party/curl/docs/internals/UINT_SETS.md
new file mode 100644
index 0000000000..963cc82d48
--- /dev/null
+++ b/third-party/curl/docs/internals/UINT_SETS.md
@@ -0,0 +1,137 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# `uint32_t` Sets
+
+The multi handle tracks added easy handles via an `uint32_t` it calls an
+`mid`. There are four data structures for `uint32_t` optimized for the multi
+use case.
+
+## `uint32_tbl`
+
+`uint32_table`, implemented in `uint-table.[ch]` manages an array of `void *`.
+The `uint32_t` is the index into this array. It is created with a *capacity*
+which can be *resized*. The table assigns the index when a `void *` is
+*added*. It keeps track of the last assigned index and uses the next available
+larger index for a subsequent add. Reaching *capacity* it wraps around.
+
+The table *can not* store `NULL` values. The largest possible index
+is `UINT32_MAX - 1`.
+
+The table is iterated over by asking for the *first* existing index, meaning
+the smallest number that has an entry, if the table is not empty. To get
+the *next* entry, one passes the index of the previous iteration step. It does
+not matter if the previous index is still in the table. Sample code for a table
+iteration would look like this:
+
+```c
+uint32_t int mid;
+void *entry;
+
+if(Curl_uint32_tbl_first(tbl, &mid, &entry)) {
+  do {
+     /* operate on entry with index mid */
+  }
+  while(Curl_uint_tbl_next(tbl, mid, &mid, &entry));
+}
+
+```
+
+This iteration has the following properties:
+
+* entries in the table can be added/removed safely.
+* all entries that are not removed during the iteration are visited.
+* the table may be resized to a larger capacity without affecting visited
+  entries.
+* entries added with a larger index than the current are visited.
+
+### Memory
+
+For storing 1000 entries, the table would allocate one block of 8KB on
+a 64-bit system, plus the 2 pointers and 3 `uint32_t` in its base `struct
+uint32_tbl`. A resize allocates a completely new pointer array, copy
+the existing entries and free the previous one.
+
+### Performance
+
+Lookups of entries are only an index into the array, O(1) with a tiny 1.
+Adding entries and iterations are more work:
+
+1. adding an entry means "find the first free index larger than the previous
+   assigned one". Worst case for this is a table with only a single free index
+   where `capacity - 1` checks on `NULL` values would be performed, O(N). If
+   the single free index is randomly distributed, this would be O(N/2).
+2. iterating a table scans for the first not `NULL` entry after the start
+   index. This makes a complete iteration O(N) work.
+
+In the multi use case, point 1 is remedied by growing the table so that a good
+chunk of free entries always exists.
+
+Point 2 is less of an issue for a multi, since it does not really matter when
+the number of transfer is relatively small. A multi managing a larger set
+needs to operate event based anyway and table iterations rarely are needed.
+
+For these reasons, the simple implementation was preferred. Should this become
+a concern, there are options like "free index lists" or, alternatively, an
+internal bitset that scans better.
+
+## `uint32_bset`
+
+A bitset for `uint32_t` values, allowing fast add/remove operations. It is
+initialized with a *capacity*, meaning it can store only the numbers in the
+range `[0, capacity-1]`. It can be *resized* and safely *iterated*.
+`uint32_bset` is designed to operate in combination with `uint_tbl`.
+
+The bitset keeps an array of `uint64_t`. The first array entry keeps the
+numbers 0 to 63, the second 64 to 127 and so on. A bitset with capacity 1024
+would therefore allocate an array of 16 64-bit values (128 bytes). Operations
+for an unsigned int divide it by 64 for the array index and then
+check/set/clear the bit of the remainder.
+
+Iterator works the same as with `uint32_tbl`: ask the bitset for the *first*
+number present and then use that to get the *next* higher number present. Like
+the table, this safe for adds/removes and growing the set while iterating.
+
+### Memory
+
+The set only needs 1 bit for each possible number.
+A bitset for 40000 transfers occupies 5KB of memory.
+
+## Performance
+
+Operations for add/remove/check are O(1). Iteration needs to scan for the next
+bit set. The number of scans is small (see memory footprint) and, for checking
+bits, many compilers offer primitives for special CPU instructions.
+
+## `uint32_spbset`
+
+While the memory footprint of `uint32_bset` is good, it still needs 5KB to
+store the single number 40000. This is not optimal when many are needed. For
+example, in event based processing, each socket needs to keep track of the
+transfers involved. There are many sockets potentially, but each one mostly
+tracks a single transfer or few (on HTTP/2 connection borderline up to 100).
+
+For such uses cases, the `uint32_spbset` is intended: track a small number of
+unsigned int, potentially rather "close" together. It keeps "chunks" with an
+offset and has no capacity limit.
+
+Example: adding the number 40000 to an empty sparse bitset would have one
+chunk with offset 39936, keeping track of the numbers 39936 to 40192 (a chunk
+has 4 64-bit values). The numbers in that range can be handled without further
+allocations.
+
+The worst case is then storing 100 numbers that lie in separate intervals.
+Then 100 chunks would need to be allocated and linked, resulting in overall 4
+KB of memory used.
+
+Iterating a sparse bitset works the same as for bitset and table.
+
+## `uint32_hash`
+
+At last, there are places in libcurl such as the HTTP/2 and HTTP/3 protocol
+implementations that need to store their own data related to a transfer.
+`uint32_hash` allows then to associate an unsigned int, e.g. the transfer's
+`mid`, to their own data.
diff --git a/third-party/curl/docs/WEBSOCKET.md b/third-party/curl/docs/internals/WEBSOCKET.md
similarity index 77%
rename from third-party/curl/docs/WEBSOCKET.md
rename to third-party/curl/docs/internals/WEBSOCKET.md
index ba84c2284f..b389475815 100644
--- a/third-party/curl/docs/WEBSOCKET.md
+++ b/third-party/curl/docs/internals/WEBSOCKET.md
@@ -13,8 +13,7 @@ using the `ws://` or `wss://` URL schemes. The latter one being the secure
 version done over HTTPS.
 
 When using `wss://` to do WebSocket over HTTPS, the standard TLS and HTTPS
-options will be acknowledged for the CA, verification of server certificate
-etc.
+options are acknowledged for the CA, verification of server certificate etc.
 
 WebSocket communication is done by upgrading a connection from either HTTP or
 HTTPS. When given a WebSocket URL to work with, libcurl considers it a
@@ -39,16 +38,17 @@ WebSocket with libcurl can be done two ways.
 
 The new options to `curl_easy_setopt()`:
 
- `CURLOPT_WS_OPTIONS` - to control specific behavior. `CURLWS_RAW_MODE` makes
- libcurl provide all WebSocket traffic raw in the callback.
+`CURLOPT_WS_OPTIONS` - to control specific behavior. `CURLWS_RAW_MODE` makes
+libcurl provide all WebSocket traffic raw in the callback. `CURLWS_NOAUTOPONG`
+disables automatic `PONG` replies.
 
 The new function calls:
 
- `curl_ws_recv()` - receive a WebSocket frame
+`curl_ws_recv()` - receive a WebSocket frame
 
- `curl_ws_send()` - send a WebSocket frame
+`curl_ws_send()` - send a WebSocket frame
 
- `curl_ws_meta()` - return WebSocket metadata within a write callback
+`curl_ws_meta()` - return WebSocket metadata within a write callback
 
 ## Max frame size
 
@@ -64,7 +64,7 @@ directions.
 
 If the given WebSocket URL (using `ws://` or `wss://`) fails to get upgraded
 via a 101 response code and instead gets another response code back from the
-HTTP server - the transfer will return `CURLE_HTTP_RETURNED_ERROR` for that
+HTTP server - the transfer returns `CURLE_HTTP_RETURNED_ERROR` for that
 transfer. Note then that even 2xx response codes are then considered error
 since it failed to provide a WebSocket transfer.
 
@@ -88,19 +88,18 @@ work has not been started.
 
 Ideas:
 
- - Read stdin and send off as messages. Consider newline as end of fragment.
-   (default to text? offer option to set binary)
- - Respond to PINGs automatically
- - Issue PINGs at some default interval (option to switch off/change interval?)
- - Allow `-d` to specify (initial) data to send (should the format allow for
-   multiple separate frames?)
- - Exit after N messages received, where N can be zero.
+- Read stdin and send off as messages. Consider newline as end of fragment.
+  (default to text? offer option to set binary)
+- Respond to PINGs automatically
+- Issue PINGs at some default interval (option to switch off/change interval?)
+- Allow `-d` to specify (initial) data to send (should the format allow for
+  multiple separate frames?)
+- Exit after N messages received, where N can be zero.
 
 ## Future work
 
 - Verify the Sec-WebSocket-Accept response. It requires a sha-1 function.
 - Verify Sec-WebSocket-Extensions and Sec-WebSocket-Protocol in the response
-- Make WebSocket work with hyper
 - Consider a `curl_ws_poll()`
 - Make sure WebSocket code paths are fuzzed
 - Add client-side PING interval
@@ -109,10 +108,9 @@ Ideas:
 
 ## Why not libWebSocket
 
-[libWebSocket](https://libWebSockets.org/) is said to be a solid, fast and
-efficient WebSocket library with a vast amount of users. My plan was
-originally to build upon it to skip having to implement the low level parts of
-WebSocket myself.
+libWebSocket is said to be a solid, fast and efficient WebSocket library with
+a vast amount of users. My plan was originally to build upon it to skip having
+to implement the low level parts of WebSocket myself.
 
 Here are the reasons why I have decided to move forward with WebSocket in
 curl **without using libWebSocket**:
diff --git a/third-party/curl/docs/libcurl/.gitignore b/third-party/curl/docs/libcurl/.gitignore
index fd35ad0fce..d520903f79 100644
--- a/third-party/curl/docs/libcurl/.gitignore
+++ b/third-party/curl/docs/libcurl/.gitignore
@@ -2,7 +2,4 @@
 #
 # SPDX-License-Identifier: curl
 
-*.html
-*.pdf
-*.3.dist
-libcurl-symbols.3
+libcurl-symbols.md
diff --git a/third-party/curl/docs/libcurl/ABI.md b/third-party/curl/docs/libcurl/ABI.md
index 408ea1094d..9cd2ad801b 100644
--- a/third-party/curl/docs/libcurl/ABI.md
+++ b/third-party/curl/docs/libcurl/ABI.md
@@ -4,65 +4,64 @@ Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
 SPDX-License-Identifier: curl
 -->
 
-ABI - Application Binary Interface
-==================================
+# ABI - Application Binary Interface
 
- "ABI" describes the low-level interface between an application program and a
- library. Calling conventions, function arguments, return values, struct
- sizes/defines and more.
+"ABI" describes the low-level interface between an application program and a
+library. Calling conventions, function arguments, return values, struct
+sizes/defines and more.
 
- [Wikipedia has a longer description](https://en.wikipedia.org/wiki/Application_binary_interface)
+[Wikipedia has a longer description](https://en.wikipedia.org/wiki/Application_binary_interface)
 
 ## Upgrades
 
- A libcurl upgrade does not break the ABI or change established and documented
- behavior. Your application can remain using libcurl just as before, only with
- fewer bugs and possibly with added new features.
+A libcurl upgrade does not break the ABI or change established and documented
+behavior. Your application can remain using libcurl like before, only with
+fewer bugs and possibly with added new features.
 
 ## Version Numbers
 
- In libcurl land, you cannot tell by the libcurl version number if that
- libcurl is binary compatible or not with another libcurl version. As a rule,
- we do not break the ABI so you can *always* upgrade to a later version without
- any loss or change in functionality.
+In libcurl land, you cannot tell by the libcurl version number if that
+libcurl is binary compatible or not with another libcurl version. As a rule,
+we do not break the ABI so you can *always* upgrade to a later version without
+any loss or change in functionality.
 
 ## SONAME Bumps
 
- Whenever there are changes done to the library that will cause an ABI
- breakage, that may require your application to get attention or possibly be
- changed to adhere to new things, we will bump the SONAME. Then the library
- will get a different output name and thus can in fact be installed in
- parallel with an older installed lib (on most systems). Thus, old
- applications built against the previous ABI version will remain working and
- using the older lib, while newer applications build and use the newer one.
+Whenever there are changes done to the library that causes an ABI breakage,
+that may require your application to get attention or possibly be changed to
+adhere to new things, we bump the SONAME. Then the library gets a different
+output name and thus can in fact be installed in parallel with an older
+installed lib (on most systems). Thus, old applications built against the
+previous ABI version remains working and using the older lib, while newer
+applications build and use the newer one.
 
- During the first seven years of libcurl releases, there have only been four
- ABI breakages.
+During the first seven years of libcurl releases, there have only been four
+ABI breakages.
 
- We are determined to bump the SONAME as rarely as possible. Ideally, we never
- do it again.
+We are determined to bump the SONAME as rarely as possible. Ideally, we never
+do it again.
 
 ## Downgrades
 
- Going to an older libcurl version from one you are currently using can be a
- tricky thing. Mostly we add features and options to newer libcurls as that
- will not break ABI or hamper existing applications. This has the implication
- that going backwards may get you in a situation where you pick a libcurl that
- does not support the options your application needs. Or possibly you even
- downgrade so far so you cross an ABI break border and thus a different
- SONAME, and then your application may need to adapt to the modified ABI.
+Going to an older libcurl version from one you are currently using can be a
+tricky thing. Mostly we add features and options to newer libcurls as that
+does not break ABI or hamper existing applications. This has the implication
+that going backwards may get you in a situation where you pick a libcurl that
+does not support the options your application needs. Or possibly you even
+downgrade so far so you cross an ABI break border and thus a different
+SONAME, and then your application may need to adapt to the modified ABI.
 
 ## History
 
- The previous major library SONAME number bumps (breaking backwards
- compatibility) happened the following times:
+The previous major library SONAME number bumps (breaking backwards
+compatibility) happened the following times:
 
- 0 - libcurl 7.1,   August 2000
+0 - libcurl 7.1,   August 2000
 
- 1 - libcurl 7.5    December 2000
+1 - libcurl 7.5    December 2000
 
- 2 - libcurl 7.7    March 2001
+2 - libcurl 7.7    March 2001
 
- 3 - libcurl 7.12.0 June 2004
+3 - libcurl 7.12.0 June 2004
 
- 4 - libcurl 7.16.0 October 2006
+4 - libcurl 7.16.0 October 2006
diff --git a/third-party/curl/docs/libcurl/CMakeLists.txt b/third-party/curl/docs/libcurl/CMakeLists.txt
index c83b5c91c4..bee1021f72 100644
--- a/third-party/curl/docs/libcurl/CMakeLists.txt
+++ b/third-party/curl/docs/libcurl/CMakeLists.txt
@@ -21,58 +21,67 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Load man_MANS from shared file
-transform_makefile_inc("Makefile.inc" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
+# Get man_MANS variable
+curl_transform_makefile_inc("Makefile.inc" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
 include("${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
 
-function(add_manual_pages _listname)
-  foreach(_file IN LISTS ${_listname})
-    if(_file STREQUAL "libcurl-symbols.3")
-      # Special case, an auto-generated file.
-      set(_srcfile "${CMAKE_CURRENT_BINARY_DIR}/${_file}")
-    else()
-      set(_srcfile "${CMAKE_CURRENT_SOURCE_DIR}/${_file}")
+# Generate man pages
+function(curl_add_manual_pages _listname)
+  # Maximum number of files per command to stay within shell/OS limits
+  if(CMAKE_HOST_UNIX)
+    set(_files_per_batch 10000)
+  else()  # e.g. Windows with cmd.exe and other obsolete/unidentified shells
+    set(_files_per_batch 200)
+  endif()
+  set(_file_count 0)
+  set(_rofffiles "")
+  set(_mdfiles "")
+  set(_eol "_EOL_")
+  foreach(_file IN LISTS ${_listname} _eol)
+    math(EXPR _file_count "${_file_count} + 1")
+    if(_file_count GREATER_EQUAL _files_per_batch OR _file STREQUAL "_EOL_")
+      add_custom_command(OUTPUT ${_rofffiles}
+        WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+        COMMAND "${PERL_EXECUTABLE}" "${PROJECT_SOURCE_DIR}/scripts/cd2nroff" -k -d "${CMAKE_CURRENT_BINARY_DIR}" ${_mdfiles}
+        DEPENDS "${PROJECT_SOURCE_DIR}/scripts/cd2nroff" ${_mdfiles}
+        VERBATIM
+      )
+      set(_file_count 0)
+      set(_rofffiles "")
+      set(_mdfiles "")
     endif()
 
-    string(REPLACE ".3" ".html" _htmlfile "${CMAKE_CURRENT_BINARY_DIR}/${_file}")
-    add_custom_command(OUTPUT "${_htmlfile}"
-      COMMAND roffit "--mandir=${CMAKE_CURRENT_SOURCE_DIR}" "${_srcfile}" > "${_htmlfile}"
-      DEPENDS "${_srcfile}"
-      VERBATIM
-    )
-
-    string(REPLACE ".3" ".pdf" _pdffile "${CMAKE_CURRENT_BINARY_DIR}/${_file}")
-    string(REPLACE ".3" ".ps" _psfile "${CMAKE_CURRENT_BINARY_DIR}/${_file}")
-    # XXX any reason why groff -Tpdf (for gropdf) is not used?
-    add_custom_command(OUTPUT "${_pdffile}"
-      COMMAND groff -Tps -man "${_srcfile}" > "${_psfile}"
-      COMMAND ps2pdf "${_psfile}" "${_pdffile}"
-      COMMAND "${CMAKE_COMMAND}" -E remove "${_psfile}"
-      DEPENDS "${_srcfile}"
-      #BYPRODUCTS "${_psfile}"
-      VERBATIM
-    )
-    # "BYPRODUCTS" for add_custom_command requires CMake 3.2. For now hope that
-    # the temporary files are removed (i.e. the command is not interrupted).
+    list(APPEND _rofffiles "${CMAKE_CURRENT_BINARY_DIR}/${_file}")
+    string(REPLACE ".3" ".md" _mdfile "${_file}")
+    if(_file STREQUAL "libcurl-symbols.3")  # Special case for auto-generated file
+      set(_mdfile "${CMAKE_CURRENT_BINARY_DIR}/${_mdfile}")
+    endif()
+    list(APPEND _mdfiles "${_mdfile}")
   endforeach()
+  unset(_rofffiles)
+  unset(_mdfiles)
 endfunction()
 
-add_custom_command(OUTPUT libcurl-symbols.3
+add_custom_command(OUTPUT "libcurl-symbols.md"
   COMMAND
     "${PERL_EXECUTABLE}"
     "${CMAKE_CURRENT_SOURCE_DIR}/mksymbolsmanpage.pl" <
-    "${CMAKE_CURRENT_SOURCE_DIR}/symbols-in-versions" > libcurl-symbols.3
+    "${CMAKE_CURRENT_SOURCE_DIR}/symbols-in-versions" > "libcurl-symbols.md"
   DEPENDS
-    "${CMAKE_CURRENT_SOURCE_DIR}/symbols-in-versions"
     "${CMAKE_CURRENT_SOURCE_DIR}/mksymbolsmanpage.pl"
+    "${CMAKE_CURRENT_SOURCE_DIR}/symbols-in-versions"
   VERBATIM
 )
 
-add_manual_pages(man_MANS)
-
-string(REPLACE ".3" ".html" HTMLPAGES "${man_MANS}")
-string(REPLACE ".3" ".pdf" PDFPAGES "${man_MANS}")
-add_custom_target(html DEPENDS ${HTMLPAGES})
-add_custom_target(pdf DEPENDS ${PDFPAGES})
+curl_add_manual_pages(man_MANS)
+add_custom_target(curl-man ALL DEPENDS ${man_MANS})
+if(NOT CURL_DISABLE_INSTALL)
+  set(_src "")
+  foreach(_file IN LISTS man_MANS)
+    list(APPEND _src "${CMAKE_CURRENT_BINARY_DIR}/${_file}")
+  endforeach()
+  install(FILES ${_src} DESTINATION "${CMAKE_INSTALL_MANDIR}/man3")
+  unset(_src)
+endif()
 
 add_subdirectory(opts)
diff --git a/third-party/curl/docs/libcurl/Makefile.am b/third-party/curl/docs/libcurl/Makefile.am
index 8d512a6c26..7b84ef44f8 100644
--- a/third-party/curl/docs/libcurl/Makefile.am
+++ b/third-party/curl/docs/libcurl/Makefile.am
@@ -26,55 +26,35 @@ AUTOMAKE_OPTIONS = foreign no-dependencies
 
 SUBDIRS = opts
 
+if BUILD_DOCS
+# Get man_MANS variable
 include Makefile.inc
 
-man_DISTMANS = $(man_MANS:.3=.3.dist)
-
-HTMLPAGES = $(man_MANS:.3=.html)
-
-PDFPAGES = $(man_MANS:.3=.pdf)
+CURLPAGES = $(man_MANS:.3=.md)
+endif
 
 m4macrodir = $(datadir)/aclocal
 dist_m4macro_DATA = libcurl.m4
 
-CLEANFILES = $(HTMLPAGES) $(PDFPAGES) $(TESTS) $(man_DISTMANS) \
-  libcurl-symbols.3
+CLEANFILES = $(man_MANS) libcurl-symbols.md
 
-EXTRA_DIST = $(man_MANS) ABI.md symbols-in-versions symbols.pl  \
+EXTRA_DIST = $(CURLPAGES) ABI.md symbols-in-versions symbols.pl  \
   mksymbolsmanpage.pl CMakeLists.txt
-MAN2HTML= roffit --mandir=. $< >$@
 
-SUFFIXES = .3 .html
+if BUILD_DOCS
 
-libcurl-symbols.3: $(srcdir)/symbols-in-versions $(srcdir)/mksymbolsmanpage.pl
-	perl $(srcdir)/mksymbolsmanpage.pl < $(srcdir)/symbols-in-versions > $@
+CD2NROFF = $(top_srcdir)/scripts/cd2nroff $< >$@
+CD2 = $(CD2_$(V))
+CD2_0 = @echo "  RENDER " $@;
+CD2_1 =
+CD2_ = $(CD2_0)
 
-html: $(HTMLPAGES)
-	cd opts && $(MAKE) html
+SUFFIXES = .3 .md
 
-.3.html:
-	$(MAN2HTML)
+libcurl-symbols.md: $(srcdir)/symbols-in-versions $(srcdir)/mksymbolsmanpage.pl
+	$(CD2)perl $(srcdir)/mksymbolsmanpage.pl < $(srcdir)/symbols-in-versions > $@
 
-pdf: $(PDFPAGES)
-	cd opts && $(MAKE) pdf
+.md.3:
+	$(CD2)$(CD2NROFF)
 
-.3.pdf:
-	@(foo=`echo $@ | sed -e 's/\.[0-9]$$//g'`; \
-	groff -Tps -man $< >$$foo.ps; \
-	ps2pdf $$foo.ps $@; \
-	rm $$foo.ps; \
-	echo "converted $< to $@")
-
-# Make sure each option man page is referenced in the main man page
-TESTS = check-easy check-multi
-LOG_COMPILER = $(PERL)
-# The test fails if the log file contains any text
-AM_LOG_FLAGS = -p -e 'die "$$_" if ($$_);'
-
-check-easy: $(srcdir)/curl_easy_setopt.3 $(srcdir)/opts/CURLOPT*.3
-	OPTS="$$(ls $(srcdir)/opts/CURLOPT*.3 | $(SED) -e 's,^.*/,,' -e 's,\.3$$,,')" && \
-	for opt in $$OPTS; do grep "^\.IP $$opt$$" $(srcdir)/curl_easy_setopt.3 >/dev/null || echo Missing $$opt; done > $@
-
-check-multi: $(srcdir)/curl_multi_setopt.3 $(srcdir)/opts/CURLMOPT*.3
-	OPTS="$$(ls $(srcdir)/opts/CURLMOPT*.3 | $(SED) -e 's,^.*/,,' -e 's,\.3$$,,')" && \
-	for opt in $$OPTS; do grep "^\.IP $$opt$$" $(srcdir)/curl_multi_setopt.3 >/dev/null || echo Missing $$opt; done > $@
+endif
diff --git a/third-party/curl/docs/libcurl/Makefile.inc b/third-party/curl/docs/libcurl/Makefile.inc
index e7e8280124..b75782d1ce 100644
--- a/third-party/curl/docs/libcurl/Makefile.inc
+++ b/third-party/curl/docs/libcurl/Makefile.inc
@@ -21,102 +21,110 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-
-# Shared between Makefile.am and CMakeLists.txt
+# Shared between CMakeLists.txt and Makefile.am
 
 man_MANS = \
- curl_easy_cleanup.3 \
- curl_easy_duphandle.3 \
- curl_easy_escape.3 \
- curl_easy_getinfo.3 \
- curl_easy_header.3 \
- curl_easy_init.3 \
- curl_easy_nextheader.3 \
- curl_easy_option_by_id.3 \
- curl_easy_option_by_name.3 \
- curl_easy_option_next.3 \
- curl_easy_pause.3 \
- curl_easy_perform.3 \
- curl_easy_recv.3 \
- curl_easy_reset.3 \
- curl_easy_send.3 \
- curl_easy_setopt.3 \
- curl_easy_strerror.3 \
- curl_easy_unescape.3 \
- curl_easy_upkeep.3 \
- curl_escape.3 \
- curl_formadd.3 \
- curl_formfree.3 \
- curl_formget.3 \
- curl_free.3 \
- curl_getdate.3 \
- curl_getenv.3 \
- curl_global_cleanup.3 \
- curl_global_init.3 \
- curl_global_init_mem.3 \
- curl_global_trace.3 \
- curl_global_sslset.3 \
- curl_mime_addpart.3 \
- curl_mime_data.3 \
- curl_mime_data_cb.3 \
- curl_mime_encoder.3 \
- curl_mime_filedata.3 \
- curl_mime_filename.3 \
- curl_mime_free.3 \
- curl_mime_headers.3 \
- curl_mime_init.3 \
- curl_mime_name.3 \
- curl_mime_subparts.3 \
- curl_mime_type.3 \
- curl_mprintf.3 \
- curl_multi_add_handle.3 \
- curl_multi_assign.3 \
- curl_multi_cleanup.3 \
- curl_multi_fdset.3 \
- curl_multi_info_read.3 \
- curl_multi_init.3 \
- curl_multi_perform.3 \
- curl_multi_poll.3 \
- curl_multi_remove_handle.3 \
- curl_multi_setopt.3 \
- curl_multi_socket.3 \
- curl_multi_socket_action.3 \
- curl_multi_socket_all.3 \
- curl_multi_strerror.3 \
- curl_multi_timeout.3 \
- curl_multi_wakeup.3 \
- curl_multi_wait.3 \
- curl_pushheader_bynum.3 \
- curl_pushheader_byname.3 \
- curl_share_cleanup.3 \
- curl_share_init.3 \
- curl_share_setopt.3 \
- curl_share_strerror.3 \
- curl_slist_append.3 \
- curl_slist_free_all.3 \
- curl_strequal.3 \
- curl_strnequal.3 \
- curl_unescape.3 \
- curl_url.3 \
- curl_url_cleanup.3 \
- curl_url_dup.3 \
- curl_url_get.3 \
- curl_url_set.3 \
- curl_url_strerror.3 \
- curl_version.3 \
- curl_version_info.3 \
- curl_ws_meta.3 \
- curl_ws_recv.3 \
- curl_ws_send.3 \
- libcurl-easy.3 \
- libcurl-env.3 \
- libcurl-errors.3 \
- libcurl-multi.3 \
- libcurl-security.3 \
- libcurl-share.3 \
- libcurl-symbols.3 \
- libcurl-thread.3 \
- libcurl-tutorial.3 \
- libcurl-url.3 \
- libcurl-ws.3 \
- libcurl.3
+  curl_easy_cleanup.3 \
+  curl_easy_duphandle.3 \
+  curl_easy_escape.3 \
+  curl_easy_getinfo.3 \
+  curl_easy_header.3 \
+  curl_easy_init.3 \
+  curl_easy_nextheader.3 \
+  curl_easy_option_by_id.3 \
+  curl_easy_option_by_name.3 \
+  curl_easy_option_next.3 \
+  curl_easy_pause.3 \
+  curl_easy_perform.3 \
+  curl_easy_recv.3 \
+  curl_easy_reset.3 \
+  curl_easy_send.3 \
+  curl_easy_setopt.3 \
+  curl_easy_ssls_export.3 \
+  curl_easy_ssls_import.3 \
+  curl_easy_strerror.3 \
+  curl_easy_unescape.3 \
+  curl_easy_upkeep.3 \
+  curl_escape.3 \
+  curl_formadd.3 \
+  curl_formfree.3 \
+  curl_formget.3 \
+  curl_free.3 \
+  curl_getdate.3 \
+  curl_getenv.3 \
+  curl_global_cleanup.3 \
+  curl_global_init.3 \
+  curl_global_init_mem.3 \
+  curl_global_sslset.3 \
+  curl_global_trace.3 \
+  curl_mime_addpart.3 \
+  curl_mime_data.3 \
+  curl_mime_data_cb.3 \
+  curl_mime_encoder.3 \
+  curl_mime_filedata.3 \
+  curl_mime_filename.3 \
+  curl_mime_free.3 \
+  curl_mime_headers.3 \
+  curl_mime_init.3 \
+  curl_mime_name.3 \
+  curl_mime_subparts.3 \
+  curl_mime_type.3 \
+  curl_mprintf.3 \
+  curl_multi_add_handle.3 \
+  curl_multi_assign.3 \
+  curl_multi_cleanup.3 \
+  curl_multi_fdset.3 \
+  curl_multi_get_handles.3 \
+  curl_multi_get_offt.3 \
+  curl_multi_info_read.3 \
+  curl_multi_init.3 \
+  curl_multi_notify_disable.3 \
+  curl_multi_notify_enable.3 \
+  curl_multi_perform.3 \
+  curl_multi_poll.3 \
+  curl_multi_remove_handle.3 \
+  curl_multi_setopt.3 \
+  curl_multi_socket.3 \
+  curl_multi_socket_action.3 \
+  curl_multi_socket_all.3 \
+  curl_multi_strerror.3 \
+  curl_multi_timeout.3 \
+  curl_multi_wait.3 \
+  curl_multi_waitfds.3 \
+  curl_multi_wakeup.3 \
+  curl_pushheader_byname.3 \
+  curl_pushheader_bynum.3 \
+  curl_share_cleanup.3 \
+  curl_share_init.3 \
+  curl_share_setopt.3 \
+  curl_share_strerror.3 \
+  curl_slist_append.3 \
+  curl_slist_free_all.3 \
+  curl_strequal.3 \
+  curl_strnequal.3 \
+  curl_unescape.3 \
+  curl_url.3 \
+  curl_url_cleanup.3 \
+  curl_url_dup.3 \
+  curl_url_get.3 \
+  curl_url_set.3 \
+  curl_url_strerror.3 \
+  curl_version.3 \
+  curl_version_info.3 \
+  curl_ws_meta.3 \
+  curl_ws_recv.3 \
+  curl_ws_send.3 \
+  curl_ws_start_frame.3 \
+  libcurl-easy.3 \
+  libcurl-env-dbg.3 \
+  libcurl-env.3 \
+  libcurl-errors.3 \
+  libcurl-multi.3 \
+  libcurl-security.3 \
+  libcurl-share.3 \
+  libcurl-symbols.3 \
+  libcurl-thread.3 \
+  libcurl-tutorial.3 \
+  libcurl-url.3 \
+  libcurl-ws.3 \
+  libcurl.3
diff --git a/third-party/curl/docs/libcurl/curl_easy_cleanup.3 b/third-party/curl/docs/libcurl/curl_easy_cleanup.3
deleted file mode 100644
index 251bc90d19..0000000000
--- a/third-party/curl/docs/libcurl/curl_easy_cleanup.3
+++ /dev/null
@@ -1,75 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH curl_easy_cleanup 3 "22 Aug 2007" "libcurl" "libcurl"
-.SH NAME
-curl_easy_cleanup - End a libcurl easy handle
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-void curl_easy_cleanup(CURL *handle);
-.fi
-.SH DESCRIPTION
-This function is the opposite of \fIcurl_easy_init(3)\fP. It closes down and
-frees all resources previously associated with this easy handle.
-
-This call closes all connections this handle has used and possibly has kept
-open until now unless the easy handle was attached to a multi handle while
-doing the transfers. Do not call this function if you intend to transfer more
-files, reusing handles is a key to good performance with libcurl.
-
-Occasionally you may get your progress callback or header callback called from
-within \fIcurl_easy_cleanup(3)\fP (if previously set for the handle using
-\fIcurl_easy_setopt(3)\fP). Like if libcurl decides to shut down the
-connection and the protocol is of a kind that requires a command/response
-sequence before disconnect. Examples of such protocols are FTP, POP3 and IMAP.
-
-Any use of the easy \fBhandle\fP after this function has been called and have
-returned, is illegal.
-
-To close an easy handle that has been used with the multi interface, make sure
-to first call \fIcurl_multi_remove_handle(3)\fP to remove it from the multi
-handle before it is closed.
-
-Passing in a NULL pointer in \fIhandle\fP makes this function return
-immediately with no action.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  res = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.1
-.SH RETURN VALUE
-None
-.SH "SEE ALSO"
-.BR curl_easy_init "(3), " curl_easy_duphandle "(3), "
-.BR curl_easy_reset "(3), "
-.BR curl_multi_cleanup "(3), " curl_multi_remove_handle "(3) "
diff --git a/third-party/curl/docs/libcurl/curl_easy_cleanup.md b/third-party/curl/docs/libcurl/curl_easy_cleanup.md
new file mode 100644
index 0000000000..bf9b18b363
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_cleanup.md
@@ -0,0 +1,79 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_cleanup
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_duphandle (3)
+  - curl_easy_init (3)
+  - curl_easy_reset (3)
+  - curl_multi_cleanup (3)
+  - curl_multi_remove_handle (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+curl_easy_cleanup - free an easy handle
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+void curl_easy_cleanup(CURL *handle);
+~~~
+
+# DESCRIPTION
+
+This function is the opposite of curl_easy_init(3). It closes down and frees
+all resources previously associated with this easy handle.
+
+This call closes all connections this handle has used and possibly has kept
+open until now unless the easy handle was attached to a multi handle while
+doing the transfers. Do not call this function if you intend to transfer more
+files, reusing handles is a key to good performance with libcurl.
+
+Occasionally you may get your progress callback or header callback called from
+within curl_easy_cleanup(3) (if previously set for the handle using
+curl_easy_setopt(3)). Like if libcurl decides to shut down the connection and
+the protocol is of a kind that requires a command/response sequence before
+disconnect. Examples of such protocols are FTP, POP3 and IMAP.
+
+Any use of the easy **handle** after this function has been called and have
+returned, is illegal.
+
+To close an easy handle that has been used with the multi interface, make sure
+to first call curl_multi_remove_handle(3) to remove it from the multi handle
+before it is closed.
+
+Passing in a NULL pointer in *handle* makes this function return immediately
+with no action.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result != CURLE_OK)
+      printf("error: %s\n", curl_easy_strerror(result));
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+None
diff --git a/third-party/curl/docs/libcurl/curl_easy_duphandle.3 b/third-party/curl/docs/libcurl/curl_easy_duphandle.3
deleted file mode 100644
index e9676488cf..0000000000
--- a/third-party/curl/docs/libcurl/curl_easy_duphandle.3
+++ /dev/null
@@ -1,70 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_easy_duphandle 3 "19 Sep 2014" "libcurl" "libcurl"
-.SH NAME
-curl_easy_duphandle - Clone a libcurl session handle
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURL *curl_easy_duphandle(CURL *handle);
-.fi
-.SH DESCRIPTION
-This function returns a new curl handle, a duplicate, using all the options
-previously set in the input curl \fIhandle\fP. Both handles can subsequently
-be used independently and they must both be freed with
-\fIcurl_easy_cleanup(3)\fP.
-
-Any options that the input handle has been told to point to (as opposed to
-copy) with previous calls to \fIcurl_easy_setopt(3)\fP, are pointed to by the
-new handle as well. You must therefore make sure to keep the data around until
-both handles have been cleaned up.
-
-The new handle does \fBnot\fP inherit any state information, no connections,
-no SSL sessions and no cookies. It also does not inherit any share object
-states or options (created as if \fICURLOPT_SHARE(3)\fP was set to NULL).
-
-In multi-threaded programs, this function must be called in a synchronous way,
-the input handle may not be in use when cloned.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-CURL *nother;
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  nother = curl_easy_duphandle(curl);
-  res = curl_easy_perform(nother);
-  curl_easy_cleanup(nother);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.9
-.SH RETURN VALUE
-If this function returns NULL, something went wrong and no valid handle was
-returned.
-.SH "SEE ALSO"
-.BR curl_easy_init "(3)," curl_easy_cleanup "(3)," curl_easy_reset "(3),"
-.BR curl_global_init "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_easy_duphandle.md b/third-party/curl/docs/libcurl/curl_easy_duphandle.md
new file mode 100644
index 0000000000..0de33496ca
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_duphandle.md
@@ -0,0 +1,77 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_duphandle
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_cleanup (3)
+  - curl_easy_init (3)
+  - curl_easy_reset (3)
+  - curl_global_init (3)
+Protocol:
+  - All
+Added-in: 7.9
+---
+
+# NAME
+
+curl_easy_duphandle - clone an easy handle
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURL *curl_easy_duphandle(CURL *handle);
+~~~
+
+# DESCRIPTION
+
+This function returns a new curl handle, a duplicate, using all the options
+previously set in the input curl *handle*. Both handles can subsequently be
+used independently and they must both be freed with curl_easy_cleanup(3).
+
+Any options that the input handle has been told to point to (as opposed to
+copy) with previous calls to curl_easy_setopt(3), are pointed to by the new
+handle as well. You must therefore make sure to keep the data around until
+both handles have been cleaned up.
+
+The new handle does **not** inherit any state information, no connections, no
+SSL sessions and no cookies. It also does not inherit any share object states
+or options (created as if CURLOPT_SHARE(3) was set to NULL).
+
+If the source handle has HSTS or alt-svc enabled, the duplicate gets data read
+from the main filename to populate the cache. For HSTS, any entries learned at
+runtime (E.g. `Strict-Transport-Security` response headers) are also copied to
+the duplicate handle.
+
+In multi-threaded programs, this function must be called in a synchronous way,
+the input handle may not be in use when cloned.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    CURL *nother;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    nother = curl_easy_duphandle(curl);
+    result = curl_easy_perform(nother);
+    curl_easy_cleanup(nother);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+If this function returns NULL, something went wrong and no valid handle was
+returned.
diff --git a/third-party/curl/docs/libcurl/curl_easy_escape.3 b/third-party/curl/docs/libcurl/curl_easy_escape.3
deleted file mode 100644
index cbae642dd5..0000000000
--- a/third-party/curl/docs/libcurl/curl_easy_escape.3
+++ /dev/null
@@ -1,75 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH curl_easy_escape 3 "7 April 2006" "libcurl" "libcurl"
-.SH NAME
-curl_easy_escape - URL encodes the given string
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-char *curl_easy_escape(CURL *curl, const char *string, int length);
-.fi
-.SH DESCRIPTION
-This function converts the given input \fIstring\fP to a URL encoded string
-and returns that as a new allocated string. All input characters that are not
-a-z, A-Z, 0-9, '-', '.', '_' or '~' are converted to their "URL escaped"
-version (\fB%NN\fP where \fBNN\fP is a two-digit hexadecimal number).
-
-If \fIlength\fP is set to 0 (zero), \fIcurl_easy_escape(3)\fP uses strlen() on
-the input \fIstring\fP to find out the size. This function does not accept
-input strings longer than \fBCURL_MAX_INPUT_LENGTH\fP (8 MB).
-
-Since 7.82.0, the \fBcurl\fP parameter is ignored. Prior to that there was
-per-handle character conversion support for some old operating systems such as
-TPF, but it was otherwise ignored.
-
-You must \fIcurl_free(3)\fP the returned string when you are done with it.
-.SH ENCODING
-libcurl is typically not aware of, nor does it care about, character
-encodings. \fIcurl_easy_escape(3)\fP encodes the data byte-by-byte into the
-URL encoded version without knowledge or care for what particular character
-encoding the application or the receiving server may assume that the data
-uses.
-
-The caller of \fIcurl_easy_escape(3)\fP must make sure that the data passed in
-to the function is encoded correctly.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  char *output = curl_easy_escape(curl, "data to convert", 15);
-  if(output) {
-    printf("Encoded: %s\\n", output);
-    curl_free(output);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.15.4 and replaces the old \fIcurl_escape(3)\fP function.
-.SH RETURN VALUE
-A pointer to a null-terminated string or NULL if it failed.
-.SH "SEE ALSO"
-.BR curl_easy_unescape "(3), " curl_free "(3), " RFC 3986
diff --git a/third-party/curl/docs/libcurl/curl_easy_escape.md b/third-party/curl/docs/libcurl/curl_easy_escape.md
new file mode 100644
index 0000000000..6ff7c5ac53
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_escape.md
@@ -0,0 +1,92 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_escape
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_unescape (3)
+  - curl_url_set (3)
+  - curl_url_get (3)
+Protocol:
+  - All
+Added-in: 7.15.4
+---
+
+# NAME
+
+curl_easy_escape - URL encode a string
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+char *curl_easy_escape(CURL *curl, const char *string, int length);
+~~~
+
+# DESCRIPTION
+
+This function converts the given input *string* to a URL encoded string and
+returns that as a new allocated string. All input characters that are not a-z,
+A-Z, 0-9, '-', '.', '_' or '~' are converted to their "URL escaped" version
+(**%NN** where **NN** is a two-digit hexadecimal number). Although not
+constrained by its type, the returned string may not be altered.
+
+If *length* is set to 0 (zero), curl_easy_escape(3) uses strlen() on the input
+*string* to find out the size.
+
+You must curl_free(3) the returned string when you are done with it.
+
+# ENCODING
+
+libcurl is typically not aware of, nor does it care about, character
+encodings. curl_easy_escape(3) encodes the data byte-by-byte into the
+URL encoded version without knowledge or care for what particular character
+encoding the application or the receiving server may assume that the data
+uses.
+
+The caller of curl_easy_escape(3) must make sure that the data passed in
+to the function is encoded correctly.
+
+# URLs
+
+URLs are by definition *URL encoded*. To create a proper URL from a set of
+components that may not be URL encoded already, you cannot URL encode the
+entire URL string with curl_easy_escape(3), because it then also converts
+colons, slashes and other symbols that you probably want untouched.
+
+To create a proper URL from strings that are not already URL encoded, we
+recommend using libcurl's URL API: set the pieces with curl_url_set(3) and get
+the final correct URL with curl_url_get(3).
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    char *output = curl_easy_escape(curl, "data to convert", 15);
+    if(output) {
+      printf("Encoded: %s\n", output);
+      curl_free(output);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+Since 7.82.0, the **curl** parameter is ignored. Prior to that there was
+per-handle character conversion support for some old operating systems such as
+TPF, but it was otherwise ignored.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+A pointer to a null-terminated string or NULL if it failed.
diff --git a/third-party/curl/docs/libcurl/curl_easy_getinfo.3 b/third-party/curl/docs/libcurl/curl_easy_getinfo.3
deleted file mode 100644
index 2553f16dec..0000000000
--- a/third-party/curl/docs/libcurl/curl_easy_getinfo.3
+++ /dev/null
@@ -1,325 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH curl_easy_getinfo 3 "11 Feb 2009" "libcurl" "libcurl"
-.SH NAME
-curl_easy_getinfo - extract information from a curl handle
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *curl, CURLINFO info, ... );
-.fi
-.SH DESCRIPTION
-Get the \fIinfo\fP kept in the \fIcurl\fP handle. The third argument
-\fBMUST\fP be pointing to the specific type of the used option which is
-documented in each man page of the \fIinfo\fP option. The data is stored
-accordingly and can be relied upon only if this function returns CURLE_OK. Use
-this function after a performed transfer if you want to get transfer related
-data.
-
-You should not free the memory returned by this function unless it is
-explicitly mentioned below.
-.SH AVAILABLE INFORMATION
-The following information can be extracted:
-.IP CURLINFO_EFFECTIVE_METHOD
-Last used HTTP method.
-See \fICURLINFO_EFFECTIVE_METHOD(3)\fP
-.IP CURLINFO_EFFECTIVE_URL
-Last used URL.
-See \fICURLINFO_EFFECTIVE_URL(3)\fP
-.IP CURLINFO_RESPONSE_CODE
-Last received response code.
-See \fICURLINFO_RESPONSE_CODE(3)\fP
-.IP CURLINFO_REFERER
-Referrer header.
-See \fICURLINFO_REFERER(3)\fP
-.IP CURLINFO_HTTP_CONNECTCODE
-Last proxy CONNECT response code.
-See \fICURLINFO_HTTP_CONNECTCODE(3)\fP
-.IP CURLINFO_HTTP_VERSION
-The http version used in the connection.
-See \fICURLINFO_HTTP_VERSION(3)\fP
-.IP CURLINFO_FILETIME
-Remote time of the retrieved document. See \fICURLINFO_FILETIME(3)\fP
-.IP CURLINFO_FILETIME_T
-Remote time of the retrieved document. See \fICURLINFO_FILETIME_T(3)\fP
-.IP CURLINFO_TOTAL_TIME
-Total time of previous transfer.
-See \fICURLINFO_TOTAL_TIME(3)\fP
-.IP CURLINFO_TOTAL_TIME_T
-Total time of previous transfer.
-See \fICURLINFO_TOTAL_TIME_T(3)\fP
-.IP CURLINFO_NAMELOOKUP_TIME
-Time from start until name resolving completed.
-See \fICURLINFO_NAMELOOKUP_TIME(3)\fP
-.IP CURLINFO_NAMELOOKUP_TIME_T
-Time from start until name resolving completed.
-See \fICURLINFO_NAMELOOKUP_TIME_T(3)\fP
-.IP CURLINFO_CONNECT_TIME
-Time from start until remote host or proxy completed.
-See \fICURLINFO_CONNECT_TIME(3)\fP
-.IP CURLINFO_CONNECT_TIME_T
-Time from start until remote host or proxy completed.
-See \fICURLINFO_CONNECT_TIME_T(3)\fP
-.IP CURLINFO_APPCONNECT_TIME
-Time from start until SSL/SSH handshake completed.
-See \fICURLINFO_APPCONNECT_TIME(3)\fP
-.IP CURLINFO_APPCONNECT_TIME_T
-Time from start until SSL/SSH handshake completed.
-See \fICURLINFO_APPCONNECT_TIME_T(3)\fP
-.IP CURLINFO_PRETRANSFER_TIME
-Time from start until just before the transfer begins.
-See \fICURLINFO_PRETRANSFER_TIME(3)\fP
-.IP CURLINFO_PRETRANSFER_TIME_T
-Time from start until just before the transfer begins.
-See \fICURLINFO_PRETRANSFER_TIME_T(3)\fP
-.IP CURLINFO_STARTTRANSFER_TIME
-Time from start until just when the first byte is received.
-See \fICURLINFO_STARTTRANSFER_TIME(3)\fP
-.IP CURLINFO_STARTTRANSFER_TIME_T
-Time from start until just when the first byte is received.
-See \fICURLINFO_STARTTRANSFER_TIME_T(3)\fP
-.IP CURLINFO_REDIRECT_TIME
-Time taken for all redirect steps before the final transfer.
-See \fICURLINFO_REDIRECT_TIME(3)\fP
-.IP CURLINFO_REDIRECT_TIME_T
-Time taken for all redirect steps before the final transfer.
-See \fICURLINFO_REDIRECT_TIME_T(3)\fP
-.IP CURLINFO_REDIRECT_COUNT
-Total number of redirects that were followed.
-See \fICURLINFO_REDIRECT_COUNT(3)\fP
-.IP CURLINFO_REDIRECT_URL
-URL a redirect would take you to, had you enabled redirects.
-See \fICURLINFO_REDIRECT_URL(3)\fP
-.IP CURLINFO_SIZE_UPLOAD
-(Deprecated) Number of bytes uploaded.
-See \fICURLINFO_SIZE_UPLOAD(3)\fP
-.IP CURLINFO_SIZE_UPLOAD_T
-Number of bytes uploaded.
-See \fICURLINFO_SIZE_UPLOAD_T(3)\fP
-.IP CURLINFO_SIZE_DOWNLOAD
-(Deprecated) Number of bytes downloaded.
-See \fICURLINFO_SIZE_DOWNLOAD(3)\fP
-.IP CURLINFO_SIZE_DOWNLOAD_T
-Number of bytes downloaded.
-See \fICURLINFO_SIZE_DOWNLOAD_T(3)\fP
-.IP CURLINFO_SPEED_DOWNLOAD
-(Deprecated) Average download speed.
-See \fICURLINFO_SPEED_DOWNLOAD(3)\fP
-.IP CURLINFO_SPEED_DOWNLOAD_T
-Average download speed.
-See \fICURLINFO_SPEED_DOWNLOAD_T(3)\fP
-.IP CURLINFO_SPEED_UPLOAD
-(Deprecated) Average upload speed.
-See \fICURLINFO_SPEED_UPLOAD(3)\fP
-.IP CURLINFO_SPEED_UPLOAD_T
-Average upload speed.
-See \fICURLINFO_SPEED_UPLOAD_T(3)\fP
-.IP CURLINFO_HEADER_SIZE
-Number of bytes of all headers received.
-See \fICURLINFO_HEADER_SIZE(3)\fP
-.IP CURLINFO_REQUEST_SIZE
-Number of bytes sent in the issued HTTP requests.
-See \fICURLINFO_REQUEST_SIZE(3)\fP
-.IP CURLINFO_SSL_VERIFYRESULT
-Certificate verification result.
-See \fICURLINFO_SSL_VERIFYRESULT(3)\fP
-.IP CURLINFO_PROXY_ERROR
-Detailed proxy error.
-See \fICURLINFO_PROXY_ERROR(3)\fP
-.IP CURLINFO_PROXY_SSL_VERIFYRESULT
-Proxy certificate verification result.
-See \fICURLINFO_PROXY_SSL_VERIFYRESULT(3)\fP
-.IP CURLINFO_SSL_ENGINES
-A list of OpenSSL crypto engines.
-See \fICURLINFO_SSL_ENGINES(3)\fP
-.IP CURLINFO_CONTENT_LENGTH_DOWNLOAD
-(Deprecated) Content length from the Content-Length header.
-See \fICURLINFO_CONTENT_LENGTH_DOWNLOAD(3)\fP
-.IP CURLINFO_CONTENT_LENGTH_DOWNLOAD_T
-Content length from the Content-Length header.
-See \fICURLINFO_CONTENT_LENGTH_DOWNLOAD_T(3)\fP
-.IP CURLINFO_CONTENT_LENGTH_UPLOAD
-(Deprecated) Upload size. See \fICURLINFO_CONTENT_LENGTH_UPLOAD(3)\fP
-.IP CURLINFO_CONTENT_LENGTH_UPLOAD_T
-Upload size. See \fICURLINFO_CONTENT_LENGTH_UPLOAD_T(3)\fP
-.IP CURLINFO_CONTENT_TYPE
-Content type from the Content-Type header.
-See \fICURLINFO_CONTENT_TYPE(3)\fP
-.IP CURLINFO_RETRY_AFTER
-The value from the Retry-After header.
-See \fICURLINFO_RETRY_AFTER(3)\fP
-.IP CURLINFO_PRIVATE
-User's private data pointer.
-See \fICURLINFO_PRIVATE(3)\fP
-.IP CURLINFO_HTTPAUTH_AVAIL
-Available HTTP authentication methods.
-See \fICURLINFO_HTTPAUTH_AVAIL(3)\fP
-.IP CURLINFO_PROXYAUTH_AVAIL
-Available HTTP proxy authentication methods.
-See \fICURLINFO_PROXYAUTH_AVAIL(3)\fP
-.IP CURLINFO_OS_ERRNO
-The errno from the last failure to connect.
-See \fICURLINFO_OS_ERRNO(3)\fP
-.IP CURLINFO_NUM_CONNECTS
-Number of new successful connections used for previous transfer.
-See \fICURLINFO_NUM_CONNECTS(3)\fP
-.IP CURLINFO_PRIMARY_IP
-IP address of the last connection.
-See \fICURLINFO_PRIMARY_IP(3)\fP
-.IP CURLINFO_PRIMARY_PORT
-Port of the last connection.
-See \fICURLINFO_PRIMARY_PORT(3)\fP
-.IP CURLINFO_LOCAL_IP
-Local-end IP address of last connection.
-See \fICURLINFO_LOCAL_IP(3)\fP
-.IP CURLINFO_LOCAL_PORT
-Local-end port of last connection.
-See \fICURLINFO_LOCAL_PORT(3)\fP
-.IP CURLINFO_COOKIELIST
-List of all known cookies.
-See \fICURLINFO_COOKIELIST(3)\fP
-.IP CURLINFO_LASTSOCKET
-(Deprecated) Last socket used.
-See \fICURLINFO_LASTSOCKET(3)\fP
-.IP CURLINFO_ACTIVESOCKET
-The session's active socket.
-See \fICURLINFO_ACTIVESOCKET(3)\fP
-.IP CURLINFO_FTP_ENTRY_PATH
-The entry path after logging in to an FTP server.
-See \fICURLINFO_FTP_ENTRY_PATH(3)\fP
-.IP CURLINFO_CAPATH
-Get the default value for \fICURLOPT_CAPATH(3)\fP.
-See \fICURLINFO_CAPATH(3)\fP
-.IP CURLINFO_CAINFO
-Get the default value for \fICURLOPT_CAINFO(3)\fP.
-See \fICURLINFO_CAINFO(3)\fP
-.IP CURLINFO_CERTINFO
-Certificate chain.
-See \fICURLINFO_CERTINFO(3)\fP
-.IP CURLINFO_TLS_SSL_PTR
-TLS session info that can be used for further processing.
-See \fICURLINFO_TLS_SSL_PTR(3)\fP
-.IP CURLINFO_TLS_SESSION
-TLS session info that can be used for further processing. See
-\fICURLINFO_TLS_SESSION(3)\fP. Deprecated option, use
-\fICURLINFO_TLS_SSL_PTR(3)\fP instead!
-.IP CURLINFO_CONDITION_UNMET
-Whether or not a time conditional was met or 304 HTTP response.
-See \fICURLINFO_CONDITION_UNMET(3)\fP
-.IP CURLINFO_RTSP_SESSION_ID
-RTSP session ID.
-See \fICURLINFO_RTSP_SESSION_ID(3)\fP
-.IP CURLINFO_RTSP_CLIENT_CSEQ
-The RTSP client CSeq that is expected next.
-See \fICURLINFO_RTSP_CLIENT_CSEQ(3)\fP
-.IP CURLINFO_RTSP_SERVER_CSEQ
-The RTSP server CSeq that is expected next.
-See \fICURLINFO_RTSP_SERVER_CSEQ(3)\fP
-.IP CURLINFO_RTSP_CSEQ_RECV
-RTSP CSeq last received.
-See \fICURLINFO_RTSP_CSEQ_RECV(3)\fP
-.IP CURLINFO_PROTOCOL
-(Deprecated) The protocol used for the connection. (Added in 7.52.0)
-See \fICURLINFO_PROTOCOL(3)\fP
-.IP CURLINFO_SCHEME
-The scheme used for the connection. (Added in 7.52.0)
-See \fICURLINFO_SCHEME(3)\fP
-.IP CURLINFO_CONN_ID
-The ID of the last connection used by the transfer. (Added in 8.2.0)
-See \fICURLINFO_CONN_ID(3)\fP
-.IP CURLINFO_XFER_ID
-The ID of the transfer. (Added in 8.2.0)
-See \fICURLINFO_XFER_ID(3)\fP
-.SH TIMES
-.nf
-An overview of the six time values available from curl_easy_getinfo()
-
-curl_easy_perform()
-    |
-    |--NAMELOOKUP
-    |--|--CONNECT
-    |--|--|--APPCONNECT
-    |--|--|--|--PRETRANSFER
-    |--|--|--|--|--STARTTRANSFER
-    |--|--|--|--|--|--TOTAL
-    |--|--|--|--|--|--REDIRECT
-.fi
-.IP NAMELOOKUP
-\fICURLINFO_NAMELOOKUP_TIME\fP and \fICURLINFO_NAMELOOKUP_TIME_T\fP.
-The time it took from the start until the name resolving was completed.
-.IP CONNECT
-\fICURLINFO_CONNECT_TIME\fP and \fICURLINFO_CONNECT_TIME_T\fP.
-The time it took from the start until the connect
-to the remote host (or proxy) was completed.
-.IP APPCONNECT
-\fICURLINFO_APPCONNECT_TIME\fP and \fICURLINFO_APPCONNECT_TIME_T\fP.
-The time it took from the start until the SSL
-connect/handshake with the remote host was completed. (Added in 7.19.0)
-The latter is the integer version (measuring microseconds).  (Added in 7.60.0)
-.IP PRETRANSFER
-\fICURLINFO_PRETRANSFER_TIME\fP and \fICURLINFO_PRETRANSFER_TIME_T\fP.
-The time it took from the start until the
-file transfer is just about to begin. This includes all pre-transfer commands
-and negotiations that are specific to the particular protocol(s) involved.
-.IP STARTTRANSFER
-\fICURLINFO_STARTTRANSFER_TIME\fP and \fICURLINFO_STARTTRANSFER_TIME_T\fP.
-The time it took from the start until the
-first byte is received by libcurl.
-.IP TOTAL
-\fICURLINFO_TOTAL_TIME\fP and \fICURLINFO_TOTAL_TIME_T\fP.
-Total time of the previous request.
-.IP REDIRECT
-\fICURLINFO_REDIRECT_TIME\fP and \fICURLINFO_REDIRECT_TIME_T\fP.
-The time it took for all redirection steps
-include name lookup, connect, pretransfer and transfer before final
-transaction was started. So, this is zero if no redirection took place.
-.SH EXAMPLE
-.nf
-  curl = curl_easy_init();
-  if(curl) {
-    curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");
-    res = curl_easy_perform(curl);
-
-    if(CURLE_OK == res) {
-      char *ct;
-      /* ask for the content-type */
-      res = curl_easy_getinfo(curl, CURLINFO_CONTENT_TYPE, &ct);
-
-      if((CURLE_OK == res) && ct)
-        printf("We received Content-Type: %s\\n", ct);
-    }
-
-    /* always cleanup */
-    curl_easy_cleanup(curl);
-  }
-.fi
-.SH AVAILABILITY
-Added in 7.4.1
-.SH RETURN VALUE
-If the operation was successful, CURLE_OK is returned. Otherwise an
-appropriate error code is returned.
-.SH "SEE ALSO"
-.BR curl_easy_setopt "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_easy_getinfo.md b/third-party/curl/docs/libcurl/curl_easy_getinfo.md
new file mode 100644
index 0000000000..6fc5555b38
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_getinfo.md
@@ -0,0 +1,447 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_getinfo
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.4.1
+---
+
+# NAME
+
+curl_easy_getinfo - extract information from a curl handle
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *curl, CURLINFO info, ...);
+~~~
+
+# DESCRIPTION
+
+Get the *info* kept in the *curl* handle. The third argument **MUST** be
+pointing to the specific type of the used option which is documented in each
+man page of the *info* option. The data is stored accordingly and can be
+relied upon only if this function returns CURLE_OK. Use this function after a
+performed transfer if you want to get transfer related data.
+
+You should not free the memory returned by this function unless it is
+explicitly mentioned below.
+
+# OPTIONS
+
+The following information can be extracted:
+
+## CURLINFO_ACTIVESOCKET
+
+The session's active socket. See CURLINFO_ACTIVESOCKET(3)
+
+## CURLINFO_APPCONNECT_TIME
+
+The time it took from the start until the SSL connect/handshake with the
+remote host was completed as a double in number of seconds.
+
+## CURLINFO_APPCONNECT_TIME_T
+
+The time it took from the start until the SSL connect/handshake with the
+remote host was completed in number of microseconds. (Added in 7.60.0) See
+CURLINFO_APPCONNECT_TIME_T(3)
+
+## CURLINFO_CAINFO
+
+Get the default value for CURLOPT_CAINFO(3). See CURLINFO_CAINFO(3)
+
+## CURLINFO_CAPATH
+
+Get the default value for CURLOPT_CAPATH(3). See CURLINFO_CAPATH(3)
+
+## CURLINFO_CERTINFO
+
+Certificate chain. See CURLINFO_CERTINFO(3)
+
+## CURLINFO_CONDITION_UNMET
+
+Whether or not a time conditional was met or 304 HTTP response.
+See CURLINFO_CONDITION_UNMET(3)
+
+## CURLINFO_CONNECT_TIME
+
+The time it took from the start until the connect to the remote host (or
+proxy) was completed. As a double. See CURLINFO_CONNECT_TIME(3)
+
+## CURLINFO_CONNECT_TIME_T
+
+The time it took from the start until the connect to the remote host (or
+proxy) was completed. In microseconds. See CURLINFO_CONNECT_TIME_T(3).
+
+## CURLINFO_CONN_ID
+
+The ID of the last connection used by the transfer. (Added in 8.2.0)
+See CURLINFO_CONN_ID(3)
+
+## CURLINFO_CONTENT_LENGTH_DOWNLOAD
+
+(**Deprecated**) Content length from the Content-Length header.
+See CURLINFO_CONTENT_LENGTH_DOWNLOAD(3)
+
+## CURLINFO_CONTENT_LENGTH_DOWNLOAD_T
+
+Content length from the Content-Length header.
+See CURLINFO_CONTENT_LENGTH_DOWNLOAD_T(3)
+
+## CURLINFO_CONTENT_LENGTH_UPLOAD
+
+(**Deprecated**) Upload size. See CURLINFO_CONTENT_LENGTH_UPLOAD(3)
+
+## CURLINFO_CONTENT_LENGTH_UPLOAD_T
+
+Upload size. See CURLINFO_CONTENT_LENGTH_UPLOAD_T(3)
+
+## CURLINFO_CONTENT_TYPE
+
+Content type from the `Content-Type:` header. We recommend using
+curl_easy_header(3) instead. See CURLINFO_CONTENT_TYPE(3)
+
+## CURLINFO_COOKIELIST
+
+List of all known cookies. See CURLINFO_COOKIELIST(3)
+
+## CURLINFO_EARLYDATA_SENT_T
+
+Amount of TLS early data sent (in number of bytes) when
+CURLSSLOPT_EARLYDATA is enabled.
+
+## CURLINFO_EFFECTIVE_METHOD
+
+Last used HTTP method. See CURLINFO_EFFECTIVE_METHOD(3)
+
+## CURLINFO_EFFECTIVE_URL
+
+Last used URL. See CURLINFO_EFFECTIVE_URL(3)
+
+## CURLINFO_FILETIME
+
+Remote time of the retrieved document. See CURLINFO_FILETIME(3)
+
+## CURLINFO_FILETIME_T
+
+Remote time of the retrieved document. See CURLINFO_FILETIME_T(3)
+
+## CURLINFO_FTP_ENTRY_PATH
+
+The entry path after logging in to an FTP server. See
+CURLINFO_FTP_ENTRY_PATH(3)
+
+## CURLINFO_HEADER_SIZE
+
+Number of bytes of all headers received. See CURLINFO_HEADER_SIZE(3)
+
+## CURLINFO_HTTPAUTH_AVAIL
+
+Available HTTP authentication methods. See CURLINFO_HTTPAUTH_AVAIL(3)
+
+## CURLINFO_HTTPAUTH_USED
+
+Used HTTP authentication method. See CURLINFO_HTTPAUTH_USED(3)
+
+## CURLINFO_HTTP_CONNECTCODE
+
+Last proxy CONNECT response code. See CURLINFO_HTTP_CONNECTCODE(3)
+
+## CURLINFO_HTTP_VERSION
+
+The http version used in the connection. See CURLINFO_HTTP_VERSION(3)
+
+## CURLINFO_LASTSOCKET
+
+(**Deprecated**) Last socket used. See CURLINFO_LASTSOCKET(3)
+
+## CURLINFO_LOCAL_IP
+
+Source IP address of the last connection. See CURLINFO_LOCAL_IP(3)
+
+## CURLINFO_LOCAL_PORT
+
+Source port number of the last connection. See CURLINFO_LOCAL_PORT(3)
+
+## CURLINFO_NAMELOOKUP_TIME
+
+Time from start until name resolving completed as a double. See
+CURLINFO_NAMELOOKUP_TIME(3)
+
+## CURLINFO_NAMELOOKUP_TIME_T
+
+Time from start until name resolving completed in number of microseconds. See
+CURLINFO_NAMELOOKUP_TIME_T(3)
+
+## CURLINFO_NUM_CONNECTS
+
+Number of new successful connections used for previous transfer.
+See CURLINFO_NUM_CONNECTS(3)
+
+## CURLINFO_OS_ERRNO
+
+The errno from the last failure to connect. See CURLINFO_OS_ERRNO(3)
+
+## CURLINFO_POSTTRANSFER_TIME_T
+
+The time it took from the start until the last byte is sent by libcurl.
+In microseconds. (Added in 8.10.0) See CURLINFO_POSTTRANSFER_TIME_T(3)
+
+## CURLINFO_PRETRANSFER_TIME
+
+The time it took from the start until the file transfer is about to begin.
+This includes all pre-transfer commands and negotiations that are specific to
+the particular protocol(s) involved. See CURLINFO_PRETRANSFER_TIME(3)
+
+## CURLINFO_PRETRANSFER_TIME_T
+
+The time it took from the start until the file transfer is about to begin.
+This includes all pre-transfer commands and negotiations that are specific to
+the particular protocol(s) involved. In microseconds. See
+CURLINFO_PRETRANSFER_TIME_T(3)
+
+## CURLINFO_PRIMARY_IP
+
+Destination IP address of the last connection. See CURLINFO_PRIMARY_IP(3)
+
+## CURLINFO_PRIMARY_PORT
+
+Destination port of the last connection. See CURLINFO_PRIMARY_PORT(3)
+
+## CURLINFO_PRIVATE
+
+User's private data pointer. See CURLINFO_PRIVATE(3)
+
+## CURLINFO_PROTOCOL
+
+(**Deprecated**) The protocol used for the connection. See
+CURLINFO_PROTOCOL(3)
+
+## CURLINFO_PROXYAUTH_AVAIL
+
+Available HTTP proxy authentication methods. See CURLINFO_PROXYAUTH_AVAIL(3)
+
+## CURLINFO_PROXYAUTH_USED
+
+Used HTTP proxy authentication methods. See CURLINFO_PROXYAUTH_USED(3)
+
+## CURLINFO_PROXY_ERROR
+
+Detailed proxy error. See CURLINFO_PROXY_ERROR(3)
+
+## CURLINFO_PROXY_SSL_VERIFYRESULT
+
+Proxy certificate verification result. See CURLINFO_PROXY_SSL_VERIFYRESULT(3)
+
+## CURLINFO_QUEUE_TIME_T
+
+The time during which the transfer was held in a waiting queue before it could
+start for real in number of microseconds. (Added in 8.6.0) See
+CURLINFO_QUEUE_TIME_T(3)
+
+## CURLINFO_REDIRECT_COUNT
+
+Total number of redirects that were followed. See CURLINFO_REDIRECT_COUNT(3)
+
+## CURLINFO_REDIRECT_TIME
+
+The time it took for all redirection steps include name lookup, connect,
+pretransfer and transfer before final transaction was started. This is zero if
+no redirection took place. As a double. See CURLINFO_REDIRECT_TIME(3)
+
+## CURLINFO_REDIRECT_TIME_T
+
+The time it took for all redirection steps include name lookup, connect,
+pretransfer and transfer before final transaction was started. This is zero if
+no redirection took place. In number of microseconds. See
+CURLINFO_REDIRECT_TIME_T(3)
+
+## CURLINFO_REDIRECT_URL
+
+URL a redirect would take you to, had you enabled redirects. See
+CURLINFO_REDIRECT_URL(3)
+
+## CURLINFO_REFERER
+
+Referrer header. See CURLINFO_REFERER(3)
+
+## CURLINFO_REQUEST_SIZE
+
+Number of bytes sent in the issued HTTP requests. See CURLINFO_REQUEST_SIZE(3)
+
+## CURLINFO_RESPONSE_CODE
+
+Last received response code. See CURLINFO_RESPONSE_CODE(3)
+
+## CURLINFO_RETRY_AFTER
+
+The value from the Retry-After header. See CURLINFO_RETRY_AFTER(3)
+
+## CURLINFO_RTSP_CLIENT_CSEQ
+
+The RTSP client CSeq that is expected next. See CURLINFO_RTSP_CLIENT_CSEQ(3)
+
+## CURLINFO_RTSP_CSEQ_RECV
+
+RTSP CSeq last received. See CURLINFO_RTSP_CSEQ_RECV(3)
+
+## CURLINFO_RTSP_SERVER_CSEQ
+
+The RTSP server CSeq that is expected next. See CURLINFO_RTSP_SERVER_CSEQ(3)
+
+## CURLINFO_RTSP_SESSION_ID
+
+RTSP session ID. See CURLINFO_RTSP_SESSION_ID(3)
+
+## CURLINFO_SCHEME
+
+The scheme used for the connection. See CURLINFO_SCHEME(3)
+
+## CURLINFO_SIZE_DELIVERED
+
+Number of bytes passed to the write callback. See CURLINFO_SIZE_DELIVERED(3)
+
+## CURLINFO_SIZE_DOWNLOAD
+
+(**Deprecated**) Number of bytes downloaded. See CURLINFO_SIZE_DOWNLOAD(3)
+
+## CURLINFO_SIZE_DOWNLOAD_T
+
+Number of bytes downloaded. See CURLINFO_SIZE_DOWNLOAD_T(3)
+
+## CURLINFO_SIZE_UPLOAD
+
+(**Deprecated**) Number of bytes uploaded. See CURLINFO_SIZE_UPLOAD(3)
+
+## CURLINFO_SIZE_UPLOAD_T
+
+Number of bytes uploaded. See CURLINFO_SIZE_UPLOAD_T(3)
+
+## CURLINFO_SPEED_DOWNLOAD
+
+(**Deprecated**) Average download speed. See CURLINFO_SPEED_DOWNLOAD(3)
+
+## CURLINFO_SPEED_DOWNLOAD_T
+
+Average download speed. See CURLINFO_SPEED_DOWNLOAD_T(3)
+
+## CURLINFO_SPEED_UPLOAD
+
+(**Deprecated**) Average upload speed. See CURLINFO_SPEED_UPLOAD(3)
+
+## CURLINFO_SPEED_UPLOAD_T
+
+Average upload speed in number of bytes per second. See
+CURLINFO_SPEED_UPLOAD_T(3)
+
+## CURLINFO_SSL_ENGINES
+
+A list of OpenSSL crypto engines. See CURLINFO_SSL_ENGINES(3)
+
+## CURLINFO_SSL_VERIFYRESULT
+
+Certificate verification result. See CURLINFO_SSL_VERIFYRESULT(3)
+
+## CURLINFO_STARTTRANSFER_TIME
+
+The time it took from the start until the first byte is received by libcurl.
+As a double. See CURLINFO_STARTTRANSFER_TIME(3)
+
+## CURLINFO_STARTTRANSFER_TIME_T
+
+The time it took from the start until the first byte is received by libcurl.
+In microseconds. See CURLINFO_STARTTRANSFER_TIME_T(3)
+
+## CURLINFO_TLS_SESSION
+
+(**Deprecated**) TLS session info that can be used for further processing. See
+CURLINFO_TLS_SESSION(3). Use CURLINFO_TLS_SSL_PTR(3) instead.
+
+## CURLINFO_TLS_SSL_PTR
+
+TLS session info that can be used for further processing. See
+CURLINFO_TLS_SSL_PTR(3)
+
+## CURLINFO_TOTAL_TIME
+
+Total time of previous transfer. See CURLINFO_TOTAL_TIME(3)
+
+## CURLINFO_TOTAL_TIME_T
+
+Total time of previous transfer. See CURLINFO_TOTAL_TIME_T(3)
+
+## CURLINFO_USED_PROXY
+
+Whether the proxy was used (Added in 8.7.0). See CURLINFO_USED_PROXY(3)
+
+## CURLINFO_XFER_ID
+
+The ID of the transfer. (Added in 8.2.0) See CURLINFO_XFER_ID(3)
+
+# TIMES
+
+An overview of the time values available from curl_easy_getinfo(3)
+
+    curl_easy_perform()
+        |
+        |--QUEUE
+        |--|--NAMELOOKUP
+        |--|--|--CONNECT
+        |--|--|--|--APPCONNECT
+        |--|--|--|--|--PRETRANSFER
+        |--|--|--|--|--|--POSTTRANSFER
+        |--|--|--|--|--|--|--STARTTRANSFER
+        |--|--|--|--|--|--|--|--TOTAL
+        |--|--|--|--|--|--|--|--REDIRECT
+
+CURLINFO_QUEUE_TIME_T(3), CURLINFO_NAMELOOKUP_TIME_T(3),
+CURLINFO_CONNECT_TIME_T(3), CURLINFO_APPCONNECT_TIME_T(3),
+CURLINFO_PRETRANSFER_TIME_T(3), CURLINFO_POSTTRANSFER_TIME_T(3),
+CURLINFO_STARTTRANSFER_TIME_T(3), CURLINFO_TOTAL_TIME_T(3),
+CURLINFO_REDIRECT_TIME_T(3)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      char *ct;
+      /* ask for the content-type */
+      result = curl_easy_getinfo(curl, CURLINFO_CONTENT_TYPE, &ct);
+
+      if((result == CURLE_OK) && ct)
+        printf("We received Content-Type: %s\n", ct);
+    }
+
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
diff --git a/third-party/curl/docs/libcurl/curl_easy_header.3 b/third-party/curl/docs/libcurl/curl_easy_header.3
deleted file mode 100644
index 55b9513ce9..0000000000
--- a/third-party/curl/docs/libcurl/curl_easy_header.3
+++ /dev/null
@@ -1,140 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_easy_header 3 "13 March 2022" "libcurl" "libcurl"
-.SH NAME
-curl_easy_header - get an HTTP header
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLHcode curl_easy_header(CURL *easy,
-                           const char *name,
-                           size_t index,
-                           unsigned int origin,
-                           int request,
-                           struct curl_header **hout);
-.SH DESCRIPTION
-\fIcurl_easy_header(3)\fP returns a pointer to a "curl_header" struct in
-\fBhout\fP with data for the HTTP response header \fIname\fP. The case
-insensitive null-terminated header name should be specified without colon.
-
-\fIindex\fP 0 means asking for the first instance of the header. If the
-returned header struct has \fBamount\fP set larger than 1, it means there are
-more instances of the same header name available to get. Asking for a too big
-index makes \fBCURLHE_BADINDEX\fP get returned.
-
-The \fIorigin\fP argument is for specifying which headers to receive, as a
-single HTTP transfer might provide headers from several different places and
-they may then have different importance to the user and headers using the same
-name might be used. The \fIorigin\fP is a bitmask for what header sources you
-want. See the descriptions below.
-
-The \fIrequest\fP argument tells libcurl from which request you want headers
-from. A single transfer might consist of a series of HTTP requests and this
-argument lets you specify which particular individual request you want the
-headers from. 0 being the first request and then the number increases for
-further redirects or when multi-state authentication is used. Passing in -1 is
-a shortcut to "the last" request in the series, independently of the actual
-amount of requests used.
-
-libcurl stores and provides the actually used "correct" headers. If for
-example two headers with the same name arrive and the latter overrides the
-former, then only the latter is provided. If the first header survives the
-second, then only the first one is provided. An application using this API
-does not have to bother about multiple headers used wrongly.
-
-The memory for the returned struct is associated with the easy handle and
-subsequent calls to \fIcurl_easy_header(3)\fP clobbers the struct used in the
-previous calls for the same easy handle. Applications need to copy the data if
-it wants to keep it around. The memory used for the struct gets freed with
-calling \fIcurl_easy_cleanup(3)\fP of the easy handle.
-
-The first line in an HTTP response is called the status line. It is not
-considered a header by this function. Headers are the "name: value" lines
-following the status.
-
-This function can be used before (all) headers have been received and is fine
-to call from within libcurl callbacks. It returns the state of the headers at
-the time it is called.
-.SH "The header struct"
-.nf
-struct curl_header {
-   char *name;
-   char *value;
-   size_t amount;
-   size_t index;
-   unsigned int origin;
-   void *anchor;
-};
-.fi
-
-The data \fBname\fP field points to, is the same as the requested name, but
-might have a different case.
-
-The data \fBvalue\fP field points to, comes exactly as delivered over the
-network but with leading and trailing whitespace and newlines stripped
-off. The `value` data is null-terminated. For legacy HTTP/1 "folded headers",
-this API provides the full single value in an unfolded manner with a single
-whitespace between the lines.
-
-\fBamount\fP is how many headers using this name that exist, within the origin
-and request scope asked for.
-
-\fBindex\fP is the zero based entry number of this particular header, which in
-case this header was used more than once in the requested scope can be larger
-than 0 but is always less than \fBamount\fP.
-
-The \fBorigin\fP field in the "curl_header" struct has one of the origin bits
-set, indicating where from the header originates. At the time of this writing,
-there are 5 bits with defined use. The undocumented 27 remaining bits are
-reserved for future use and must not be assumed to have any particular value.
-
-\fBanchor\fP is a private handle used by libcurl internals. Do not modify.
-.SH ORIGINS
-.IP CURLH_HEADER
-The header arrived as a header from the server.
-.IP CURLH_TRAILER
-The header arrived as a trailer. A header that arrives after the body.
-.IP CURLH_CONNECT
-The header arrived in a CONNECT response. A CONNECT request is being done to
-setup a transfer "through" an HTTP(S) proxy.
-.IP CURLH_1XX
-The header arrived in an HTTP 1xx response. A 1xx response is an "intermediate"
-response that might happen before the "real" response.
-.IP CURLH_PSEUDO
-The header is an HTTP/2 or HTTP/3 pseudo header
-.SH EXAMPLE
-.nf
-struct curl_header *type;
-CURLHcode h =
-  curl_easy_header(easy, "Content-Type", 0, CURLH_HEADER, -1, &type);
-.fi
-.SH AVAILABILITY
-Added in 7.83.0. Officially supported since 7.84.0.
-.SH RETURN VALUE
-This function returns a CURLHcode indicating success or error.
-.SH "SEE ALSO"
-.BR curl_easy_nextheader "(3), " curl_easy_perform "(3), "
-.BR CURLOPT_HEADERFUNCTION "(3), " CURLINFO_CONTENT_TYPE "(3), "
-.BR libcurl-errors "(3) "
diff --git a/third-party/curl/docs/libcurl/curl_easy_header.md b/third-party/curl/docs/libcurl/curl_easy_header.md
new file mode 100644
index 0000000000..1e48a728c2
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_header.md
@@ -0,0 +1,165 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_header
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CONTENT_TYPE (3)
+  - CURLOPT_HEADERFUNCTION (3)
+  - curl_easy_nextheader (3)
+  - curl_easy_perform (3)
+  - libcurl-errors (3)
+Protocol:
+  - HTTP
+Added-in: 7.83.0
+---
+
+# NAME
+
+curl_easy_header - get an HTTP header
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLHcode curl_easy_header(CURL *easy,
+                           const char *name,
+                           size_t nameindex,
+                           unsigned int origin,
+                           int request,
+                           struct curl_header **hout);
+~~~
+
+# DESCRIPTION
+
+curl_easy_header(3) returns a pointer to a "curl_header" struct in **hout**
+with data for the HTTP response header *name*. The case insensitive
+null-terminated header name should be specified without colon.
+
+*nameindex* 0 means asking for the first instance of the header. If the
+returned header struct has **amount** set larger than 1, it means there are
+more instances of the same header name available to get. Asking for a too big
+index makes **CURLHE_BADINDEX** get returned.
+
+The *origin* argument is for specifying which headers to receive, as a single
+HTTP transfer might provide headers from several different places and they may
+then have different importance to the user and headers using the same name
+might be used. The *origin* is a bitmask for what header sources you want. See
+the descriptions below.
+
+The *request* argument tells libcurl from which request you want headers
+from. A single transfer might consist of a series of HTTP requests and this
+argument lets you specify which particular individual request you want the
+headers from. 0 being the first request and then the number increases for
+further redirects or when multi-state authentication is used. Passing in -1 is
+a shortcut to "the last" request in the series, independently of the actual
+amount of requests used.
+
+libcurl stores and provides the actually used "correct" headers. If for
+example two headers with the same name arrive and the latter overrides the
+former, then only the latter is provided. If the first header survives the
+second, then only the first one is provided. An application using this API
+does not have to bother about multiple headers used wrongly.
+
+The memory for the returned struct is associated with the easy handle and
+subsequent calls to curl_easy_header(3) clobber the struct used in the
+previous calls for the same easy handle. The application needs to copy the data if
+it wants to keep it around. The memory used for the struct gets freed with
+calling curl_easy_cleanup(3) of the easy handle.
+
+The first line in an HTTP response is called the status line. It is not
+considered a header by this function. Headers are the "name: value" lines
+following the status.
+
+This function can be used before (all) headers have been received and is fine
+to call from within libcurl callbacks. It returns the state of the headers at
+the time it is called.
+
+# The header struct
+
+~~~c
+struct curl_header {
+  char *name;
+  char *value;
+  size_t amount;
+  size_t index;
+  unsigned int origin;
+  void *anchor;
+};
+~~~
+
+The data **name** field points to, is the same as the requested name, but
+might have a different case.
+
+The data **value** field points to, comes exactly as delivered over the
+network but with leading and trailing whitespace and newlines stripped
+off. The `value` data is null-terminated. For legacy HTTP/1 "folded headers",
+this API provides the full single value in an unfolded manner with a single
+whitespace between the lines.
+
+**amount** is how many headers using this name that exist, within the origin
+and request scope asked for.
+
+**index** is the zero based entry number of this particular header, which in
+case this header was used more than once in the requested scope can be larger
+than 0 but is always less than **amount**.
+
+The **origin** field in the "curl_header" struct has one of the origin bits
+set, indicating where from the header originates. At the time of this writing,
+there are 5 bits with defined use. The undocumented 27 remaining bits are
+reserved for future use and must not be assumed to have any particular value.
+
+**anchor** is a private handle used by libcurl internals. Do not modify.
+
+# ORIGINS
+
+## CURLH_HEADER
+
+The header arrived as a header from the server.
+
+## CURLH_TRAILER
+
+The header arrived as a trailer. A header that arrives after the body.
+
+## CURLH_CONNECT
+
+The header arrived in a CONNECT response. A CONNECT request is being done to
+setup a transfer "through" an HTTP(S) proxy.
+
+## CURLH_1XX
+
+The header arrived in an HTTP 1xx response. A 1xx response is an "intermediate"
+response that might happen before the "real" response.
+
+## CURLH_PSEUDO
+
+The header is an HTTP/2 or HTTP/3 pseudo header
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  struct curl_header *type;
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLHcode h;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_perform(curl);
+    h = curl_easy_header(curl, "Content-Type", 0, CURLH_HEADER, -1, &type);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLHcode indicating success or error. CURLHE_OK (0)
+means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/curl_easy_init.3 b/third-party/curl/docs/libcurl/curl_easy_init.3
deleted file mode 100644
index dc4487fe07..0000000000
--- a/third-party/curl/docs/libcurl/curl_easy_init.3
+++ /dev/null
@@ -1,76 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_easy_init 3 "4 March 2002" "libcurl" "libcurl"
-.SH NAME
-curl_easy_init - Start a libcurl easy session
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURL *curl_easy_init();
-.fi
-.SH DESCRIPTION
-This function allocates and returns a CURL easy handle. Such a handle is used
-as input to other functions in the easy interface. This call must have a
-corresponding call to \fIcurl_easy_cleanup(3)\fP when the operation is
-complete.
-
-The easy handle is used to hold and control a single network transfer. It is
-encouraged to reuse easy handles for repeated transfers.
-
-An alternative way to get a new easy handle is to duplicate an already
-existing one with \fIcurl_easy_duphandle(3)\fP, which has the upside that it
-gets all the options that were set in the source handle set in the new copy as
-well.
-
-If you did not already call \fIcurl_global_init(3)\fP before calling this
-function, \fIcurl_easy_init(3)\fP does it automatically. This may be lethal in
-multi-threaded cases, if \fIcurl_global_init(3)\fP is not thread-safe in your
-system, and it may then result in resource problems because there is no
-corresponding cleanup.
-
-You are strongly advised to not allow this automatic behavior, by calling
-\fIcurl_global_init(3)\fP yourself properly. See the description in
-\fBlibcurl\fP(3) of global environment requirements for details of how to use
-this function.
-
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  res = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-If this function returns NULL, something went wrong and you cannot use the
-other curl functions.
-.SH "SEE ALSO"
-.BR curl_easy_cleanup "(3), " curl_global_init "(3), " curl_easy_reset "(3), "
-.BR curl_easy_perform "(3), " curl_easy_duphandle "(3), "
-.BR curl_multi_init "(3), "
diff --git a/third-party/curl/docs/libcurl/curl_easy_init.md b/third-party/curl/docs/libcurl/curl_easy_init.md
new file mode 100644
index 0000000000..34dbc640b9
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_init.md
@@ -0,0 +1,76 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_init
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_cleanup (3)
+  - curl_easy_duphandle (3)
+  - curl_easy_perform (3)
+  - curl_easy_reset (3)
+  - curl_global_init (3)
+  - curl_multi_init (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+curl_easy_init - create an easy handle
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURL *curl_easy_init();
+~~~
+
+# DESCRIPTION
+
+This function allocates and returns an easy handle. Such a handle is used as
+input to other functions in the easy interface. This call must have a
+corresponding call to curl_easy_cleanup(3) when the operation is complete.
+
+The easy handle is used to hold and control a single network transfer. It is
+encouraged to reuse easy handles for repeated transfers.
+
+An alternative way to get a new easy handle is to duplicate an already
+existing one with curl_easy_duphandle(3), which has the upside that it gets
+all the options that were set in the source handle set in the new copy as
+well.
+
+If you did not already call curl_global_init(3) before calling this function,
+curl_easy_init(3) does it automatically. This can be lethal in multi-threaded
+cases for platforms where curl_global_init(3) is not thread-safe, and it may
+then result in resource problems because there is no corresponding cleanup.
+
+You are strongly advised to not allow this automatic behavior, by calling
+curl_global_init(3) yourself properly. See the description in libcurl(3) of
+global environment requirements for details of how to use this function.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+If this function returns NULL, something went wrong and you cannot use the
+other curl functions.
diff --git a/third-party/curl/docs/libcurl/curl_easy_nextheader.3 b/third-party/curl/docs/libcurl/curl_easy_nextheader.3
deleted file mode 100644
index 8f892f91b8..0000000000
--- a/third-party/curl/docs/libcurl/curl_easy_nextheader.3
+++ /dev/null
@@ -1,96 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_easy_nextheader 3 "13 March 2022" "libcurl" "libcurl"
-.SH NAME
-curl_easy_nextheader - get the next HTTP header
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-struct curl_header *curl_easy_nextheader(CURL *easy,
-                                         unsigned int origin,
-                                         int request,
-                                         struct curl_header *prev);
-.fi
-.SH DESCRIPTION
-This function lets an application iterate over all previously received HTTP
-headers.
-
-The \fIorigin\fP argument is for specifying which headers to receive, as a
-single HTTP transfer might provide headers from several different places and
-they may then have different importance to the user and headers using the same
-name might be used. The \fIorigin\fP is a bitmask for what header sources you
-want. See the \fIcurl_easy_header(3)\fP man page for the origin descriptions.
-
-The \fIrequest\fP argument tells libcurl from which request you want headers
-from. A single transfer might consist of a series of HTTP requests and this
-argument lets you specify which particular individual request you want the
-headers from. 0 being the first request and then the number increases for
-further redirects or when multi-state authentication is used. Passing in -1 is
-a shortcut to "the last" request in the series, independently of the actual
-amount of requests used.
-
-It is suggested that you pass in the same \fBorigin\fP and \fBrequest\fP when
-iterating over a range of headers as changing the value mid-loop might give
-you unexpected results.
-
-If \fIprev\fP is NULL, this function returns a pointer to the first header
-stored within the given scope (origin + request).
-
-If \fIprev\fP is a pointer to a previously returned header struct,
-\fIcurl_easy_nextheader(3)\fP returns a pointer the next header stored within
-the given scope. This way, an application can iterate over all available
-headers.
-
-The memory for the struct this points to, is owned and managed by libcurl and
-is associated with the easy handle. Applications must copy the data if they
-want it to survive subsequent API calls or the life-time of the easy handle.
-.SH EXAMPLE
-.nf
-struct curl_header *prev = NULL;
-struct curl_header *h;
-
-/* extract the normal headers from the first request */
-while((h = curl_easy_nextheader(easy, CURLH_HEADER, 0, prev))) {
-   printf("%s: %s\\n", h->name, h->value);
-   prev = h;
-}
-
-/* extract the normal headers + 1xx + trailers from the last request */
-unsigned int origin = CURLH_HEADER| CURLH_1XX | CURLH_TRAILER;
-while((h = curl_easy_nextheader(easy, origin, -1, prev))) {
-   printf("%s: %s\\n", h->name, h->value);
-   prev = h;
-}
-.fi
-.SH AVAILABILITY
-Added in 7.83.0. Officially supported since 7.84.0.
-.SH RETURN VALUE
-This function returns the next header, or NULL when there are no more
-(matching) headers or an error occurred.
-
-If this function returns NULL when \fIprev\fP was set to NULL, then there are
-no headers available within the scope to return.
-.SH "SEE ALSO"
-.BR curl_easy_header "(3), " curl_easy_perform "(3) "
diff --git a/third-party/curl/docs/libcurl/curl_easy_nextheader.md b/third-party/curl/docs/libcurl/curl_easy_nextheader.md
new file mode 100644
index 0000000000..42314996b9
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_nextheader.md
@@ -0,0 +1,107 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_nextheader
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_header (3)
+  - curl_easy_perform (3)
+Protocol:
+  - HTTP
+Added-in: 7.83.0
+---
+
+# NAME
+
+curl_easy_nextheader - get the next HTTP header
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+struct curl_header *curl_easy_nextheader(CURL *easy,
+                                         unsigned int origin,
+                                         int request,
+                                         struct curl_header *prev);
+~~~
+
+# DESCRIPTION
+
+This function lets an application iterate over all previously received HTTP
+headers.
+
+The *origin* argument is for specifying which headers to receive, as a single
+HTTP transfer might provide headers from several different places and they may
+then have different importance to the user and headers using the same name
+might be used. The *origin* is a bitmask for what header sources you want. See
+the curl_easy_header(3) man page for the origin descriptions.
+
+The *request* argument tells libcurl from which request you want headers
+from. A single transfer might consist of a series of HTTP requests and this
+argument lets you specify which particular individual request you want the
+headers from. 0 being the first request and then the number increases for
+further redirects or when multi-state authentication is used. Passing in -1 is
+a shortcut to "the last" request in the series, independently of the actual
+amount of requests used.
+
+It is suggested that you pass in the same **origin** and **request** when
+iterating over a range of headers as changing the value mid-loop might give
+you unexpected results.
+
+If *prev* is NULL, this function returns a pointer to the first header stored
+within the given scope (origin + request).
+
+If *prev* is a pointer to a previously returned header struct,
+curl_easy_nextheader(3) returns a pointer the next header stored within the
+given scope. This way, an application can iterate over all available headers.
+
+The memory for the struct this points to, is owned and managed by libcurl and
+is associated with the easy handle. Applications must copy the data if they
+want it to survive subsequent API calls or the life-time of the easy handle.
+
+The *prev* pointer is only valid until another transfer is done using the
+*easy* handle. Once a new transfer has started, a new *prev* must be retrieved
+by calling curl_easy_nextheader(3) again with NULL as the fourth argument.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  struct curl_header *prev = NULL;
+  struct curl_header *h;
+
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_perform(curl);
+
+    /* extract the normal headers from the first request */
+    while((h = curl_easy_nextheader(curl, CURLH_HEADER, 0, prev))) {
+      printf("%s: %s\n", h->name, h->value);
+      prev = h;
+    }
+
+    /* extract the normal headers + 1xx + trailers from the last request */
+    unsigned int origin = CURLH_HEADER | CURLH_1XX | CURLH_TRAILER;
+    while((h = curl_easy_nextheader(curl, origin, -1, prev))) {
+      printf("%s: %s\n", h->name, h->value);
+      prev = h;
+    }
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns the next header, or NULL when there are no more
+(matching) headers or an error occurred.
+
+If this function returns NULL when *prev* was set to NULL, then there are no
+headers available within the scope to return.
diff --git a/third-party/curl/docs/libcurl/curl_easy_option_by_id.3 b/third-party/curl/docs/libcurl/curl_easy_option_by_id.3
deleted file mode 100644
index 65be339a8c..0000000000
--- a/third-party/curl/docs/libcurl/curl_easy_option_by_id.3
+++ /dev/null
@@ -1,55 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_easy_option_by_id 3 "27 Aug 2020" "libcurl" "libcurl"
-.SH NAME
-curl_easy_option_by_id - find an easy setopt option by id
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-const struct curl_easyoption *curl_easy_option_by_id(CURLoption id);
-.fi
-.SH DESCRIPTION
-Given a \fICURLoption\fP \fBid\fP, this function returns a pointer to the
-\fIcurl_easyoption\fP struct, holding information about the
-\fIcurl_easy_setopt(3)\fP option using that id. The option id is the CURLOPT_
-prefix ones provided in the standard curl/curl.h header file. This function
-returns the non-alias version of the cases where there is an alias function as
-well.
-
-If libcurl has no option with the given id, this function returns NULL.
-.SH EXAMPLE
-.nf
-const struct curl_easyoption *opt = curl_easy_option_by_id(CURLOPT_URL);
-if(opt) {
-  printf("This option wants type %x\\n", opt->type);
-}
-.fi
-.SH AVAILABILITY
-This function was added in libcurl 7.73.0
-.SH RETURN VALUE
-A pointer to the \fIcurl_easyoption\fP struct for the option or NULL.
-.SH "SEE ALSO"
-.BR curl_easy_option_by_name "(3)," curl_easy_option_next "(3),"
-.BR curl_easy_setopt "(3),"
diff --git a/third-party/curl/docs/libcurl/curl_easy_option_by_id.md b/third-party/curl/docs/libcurl/curl_easy_option_by_id.md
new file mode 100644
index 0000000000..591d7c48e3
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_option_by_id.md
@@ -0,0 +1,56 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_option_by_id
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_option_by_name (3)
+  - curl_easy_option_next (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.73.0
+---
+
+# NAME
+
+curl_easy_option_by_id - find an easy setopt option by id
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+const struct curl_easyoption *curl_easy_option_by_id(CURLoption id);
+~~~
+
+# DESCRIPTION
+
+Given a *CURLoption* **id**, this function returns a pointer to the
+*curl_easyoption* struct, holding information about the curl_easy_setopt(3)
+option using that id. The option id is the `CURLOPT_` prefixed ones provided
+in the standard curl/curl.h header file. This function returns the non-alias
+version of the cases where there is an alias function as well.
+
+If libcurl has no option with the given id, this function returns NULL.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  const struct curl_easyoption *opt = curl_easy_option_by_id(CURLOPT_URL);
+  if(opt) {
+    printf("This option wants type %x\n", opt->type);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+A pointer to the *curl_easyoption* struct for the option or NULL.
diff --git a/third-party/curl/docs/libcurl/curl_easy_option_by_name.3 b/third-party/curl/docs/libcurl/curl_easy_option_by_name.3
deleted file mode 100644
index 031bab155a..0000000000
--- a/third-party/curl/docs/libcurl/curl_easy_option_by_name.3
+++ /dev/null
@@ -1,54 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_easy_option_by_name 3 "27 Aug 2020" "libcurl" "libcurl"
-.SH NAME
-curl_easy_option_by_name - find an easy setopt option by name
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-const struct curl_easyoption *curl_easy_option_by_name(const char *name);
-.fi
-.SH DESCRIPTION
-Given a \fBname\fP, this function returns a pointer to the
-\fIcurl_easyoption\fP struct, holding information about the
-\fIcurl_easy_setopt(3)\fP option using that name. The name should be specified
-without the "CURLOPT_" prefix and the name comparison is made case
-insensitive.
-
-If libcurl has no option with the given name, this function returns NULL.
-.SH EXAMPLE
-.nf
-const struct curl_easyoption *opt = curl_easy_option_by_name("URL");
-if(opt) {
-  printf("This option wants CURLoption %x\\n", (int)opt->id);
-}
-.fi
-.SH AVAILABILITY
-This function was added in libcurl 7.73.0
-.SH RETURN VALUE
-A pointer to the \fIcurl_easyoption\fP struct for the option or NULL.
-.SH "SEE ALSO"
-.BR curl_easy_option_next "(3)," curl_easy_option_by_id "(3),"
-.BR curl_easy_setopt "(3),"
diff --git a/third-party/curl/docs/libcurl/curl_easy_option_by_name.md b/third-party/curl/docs/libcurl/curl_easy_option_by_name.md
new file mode 100644
index 0000000000..12b4606307
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_option_by_name.md
@@ -0,0 +1,55 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_option_by_name
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_option_by_id (3)
+  - curl_easy_option_next (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.73.0
+---
+
+# NAME
+
+curl_easy_option_by_name - find an easy setopt option by name
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+const struct curl_easyoption *curl_easy_option_by_name(const char *name);
+~~~
+
+# DESCRIPTION
+
+Given a **name**, this function returns a pointer to the *curl_easyoption*
+struct, holding information about the curl_easy_setopt(3) option using that
+name. The name should be specified without the `CURLOPT_` prefix and the name
+comparison is made case insensitive.
+
+If libcurl has no option with the given name, this function returns NULL.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  const struct curl_easyoption *opt = curl_easy_option_by_name("URL");
+  if(opt) {
+    printf("This option wants CURLoption %x\n", (int)opt->id);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+A pointer to the *curl_easyoption* struct for the option or NULL.
diff --git a/third-party/curl/docs/libcurl/curl_easy_option_next.3 b/third-party/curl/docs/libcurl/curl_easy_option_next.3
deleted file mode 100644
index a3e122aba3..0000000000
--- a/third-party/curl/docs/libcurl/curl_easy_option_next.3
+++ /dev/null
@@ -1,86 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_easy_option_next 3 "27 Aug 2020" "libcurl" "libcurl"
-.SH NAME
-curl_easy_option_next - iterate over easy setopt options
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-typedef enum {
-  CURLOT_LONG,    /* long (a range of values) */
-  CURLOT_VALUES,  /*      (a defined set or bitmask) */
-  CURLOT_OFF_T,   /* curl_off_t (a range of values) */
-  CURLOT_OBJECT,  /* pointer (void *) */
-  CURLOT_STRING,  /*         (char * to null-terminated buffer) */
-  CURLOT_SLIST,   /*         (struct curl_slist *) */
-  CURLOT_CBPTR,   /*         (void * passed as-is to a callback) */
-  CURLOT_BLOB,    /* blob (struct curl_blob *) */
-  CURLOT_FUNCTION /* function pointer */
-} curl_easytype;
-
-/* The CURLOPTTYPE_* id ranges can still be used to figure out what type/size
-   to use for curl_easy_setopt() for the given id */
-struct curl_easyoption {
-  const char *name;
-  CURLoption id;
-  curl_easytype type;
-  unsigned int flags;
-};
-
-const struct curl_easyoption *
-curl_easy_option_next(const struct curl_easyoption *prev);
-.fi
-.SH DESCRIPTION
-This function returns a pointer to the first or the next \fIcurl_easyoption\fP
-struct, providing an ability to iterate over all known options for
-\fIcurl_easy_setopt(3)\fP in this instance of libcurl.
-
-Pass a \fBNULL\fP argument as \fBprev\fP to get the first option returned, or
-pass in the current option to get the next one returned. If there is no more
-option to return, \fIcurl_easy_option_next(3)\fP returns NULL.
-
-The options returned by this functions are the ones known to this libcurl and
-information about what argument type they want.
-
-If the \fBCURLOT_FLAG_ALIAS\fP bit is set in the flags field, it means the
-name is provided for backwards compatibility as an alias.
-.SH EXAMPLE
-.nf
-/* iterate over all available options */
-const struct curl_easyoption *opt;
-opt = curl_easy_option_by_next(NULL);
-while(opt) {
-  printf("Name: %s\\n", opt->name);
-  opt = curl_easy_option_by_next(opt);
-}
-.fi
-.SH AVAILABILITY
-This function was added in libcurl 7.73.0
-.SH RETURN VALUE
-A pointer to the \fIcurl_easyoption\fP struct for the next option or NULL if
-no more options.
-.SH "SEE ALSO"
-.BR curl_easy_option_by_name "(3)," curl_easy_option_by_id "(3),"
-.BR curl_easy_setopt "(3),"
diff --git a/third-party/curl/docs/libcurl/curl_easy_option_next.md b/third-party/curl/docs/libcurl/curl_easy_option_next.md
new file mode 100644
index 0000000000..836dee2d7e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_option_next.md
@@ -0,0 +1,92 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_option_next
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_option_by_id (3)
+  - curl_easy_option_by_name (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.73.0
+---
+
+# NAME
+
+curl_easy_option_next - iterate over easy setopt options
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+const struct curl_easyoption *
+curl_easy_option_next(const struct curl_easyoption *prev);
+~~~
+
+# DESCRIPTION
+
+This function returns a pointer to the first or the next *curl_easyoption*
+struct, providing an ability to iterate over all known options for
+curl_easy_setopt(3) in this instance of libcurl.
+
+Pass a **NULL** argument as **prev** to get the first option returned, or
+pass in the current option to get the next one returned. If there is no more
+option to return, curl_easy_option_next(3) returns NULL.
+
+The options returned by this functions are the ones known to this libcurl and
+information about what argument type they want.
+
+If the **CURLOT_FLAG_ALIAS** bit is set in the flags field, it means the
+name is provided for backwards compatibility as an alias.
+
+# struct
+
+~~~c
+typedef enum {
+  CURLOT_LONG,    /* long (a range of values) */
+  CURLOT_VALUES,  /*      (a defined set or bitmask) */
+  CURLOT_OFF_T,   /* curl_off_t (a range of values) */
+  CURLOT_OBJECT,  /* pointer (void *) */
+  CURLOT_STRING,  /*         (char * to null-terminated buffer) */
+  CURLOT_SLIST,   /*         (struct curl_slist *) */
+  CURLOT_CBPTR,   /*         (void * passed as-is to a callback) */
+  CURLOT_BLOB,    /* blob (struct curl_blob *) */
+  CURLOT_FUNCTION /* function pointer */
+} curl_easytype;
+
+/* The CURLOPTTYPE_* id ranges can still be used to figure out what type/size
+   to use for curl_easy_setopt() for the given id */
+struct curl_easyoption {
+  const char *name;
+  CURLoption id;
+  curl_easytype type;
+  unsigned int flags;
+};
+~~~
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  /* iterate over all available options */
+  const struct curl_easyoption *opt;
+  opt = curl_easy_option_next(NULL);
+  while(opt) {
+    printf("Name: %s\n", opt->name);
+    opt = curl_easy_option_next(opt);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+A pointer to the *curl_easyoption* struct for the next option or NULL if
+no more options.
diff --git a/third-party/curl/docs/libcurl/curl_easy_pause.3 b/third-party/curl/docs/libcurl/curl_easy_pause.3
deleted file mode 100644
index 62f1dba107..0000000000
--- a/third-party/curl/docs/libcurl/curl_easy_pause.3
+++ /dev/null
@@ -1,116 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_easy_pause 3 "17 Dec 2007" "libcurl" "libcurl"
-.SH NAME
-curl_easy_pause - pause and unpause a connection
-.SH SYNOPSIS
-.nf
-.B #include <curl/curl.h>
-
-.BI "CURLcode curl_easy_pause(CURL *"handle ", int "bitmask ");"
-.fi
-.SH DESCRIPTION
-Using this function, you can explicitly mark a running connection to get
-paused, and you can unpause a connection that was previously paused.
-
-A connection can be paused by using this function or by letting the read or
-the write callbacks return the proper magic return code
-(\fICURL_READFUNC_PAUSE\fP and \fICURL_WRITEFUNC_PAUSE\fP). A write callback
-that returns pause signals to the library that it could not take care of any
-data at all, and that data is then delivered again to the callback when the
-transfer is unpaused.
-
-While it may feel tempting, take care and notice that you cannot call this
-function from another thread. To unpause, you may for example call it from the
-progress callback (\fICURLOPT_PROGRESSFUNCTION(3)\fP).
-
-When this function is called to unpause receiving, the write callback might
-get called before this function returns to deliver cached content. When
-libcurl delivers such cached data to the write callback, it is delivered as
-fast as possible, which may overstep the boundary set in
-\fICURLOPT_MAX_RECV_SPEED_LARGE(3)\fP etc.
-
-The \fBhandle\fP argument identifies the transfer you want to pause or
-unpause.
-
-A paused transfer is excluded from low speed cancels via the
-\fICURLOPT_LOW_SPEED_LIMIT(3)\fP option and unpausing a transfer resets the
-time period required for the low speed limit to be met.
-
-The \fBbitmask\fP argument is a set of bits that sets the new state of the
-connection. The following bits can be used:
-.IP CURLPAUSE_RECV
-Pause receiving data. There is no data received on this connection until this
-function is called again without this bit set. Thus, the write callback
-(\fICURLOPT_WRITEFUNCTION(3)\fP) is not called.
-.IP CURLPAUSE_SEND
-Pause sending data. There is no data sent on this connection until this
-function is called again without this bit set. Thus, the read callback
-(\fICURLOPT_READFUNCTION(3)\fP) is not called.
-.IP CURLPAUSE_ALL
-Convenience define that pauses both directions.
-.IP CURLPAUSE_CONT
-Convenience define that unpauses both directions.
-.SH LIMITATIONS
-The pausing of transfers does not work with protocols that work without
-network connectivity, like FILE://. Trying to pause such a transfer, in any
-direction, might cause problems or error.
-.SH MULTIPLEXED
-When a connection is used multiplexed, like for HTTP/2, and one of the
-transfers over the connection is paused and the others continue flowing,
-libcurl might end up buffering contents for the paused transfer. It has to do
-this because it needs to drain the socket for the other transfers and the
-already announced window size for the paused transfer allows the server to
-continue sending data up to that window size amount. By default, libcurl
-announces a 32 megabyte window size, which thus can make libcurl end up
-buffering 32 megabyte of data for a paused stream.
-
-When such a paused stream is unpaused again, any buffered data is delivered
-first.
-.SH EXAMPLE
-.nf
-/* pause a transfer in both directions */
-curl_easy_pause(curl, CURL_READFUNC_PAUSE | CURL_WRITEFUNC_PAUSE);
-.fi
-.SH "MEMORY USE"
-When pausing a download transfer by returning the magic return code from a
-write callback, the read data is already in libcurl's internal buffers so it
-has to keep it in an allocated buffer until the receiving is again unpaused
-using this function.
-
-If the downloaded data is compressed and is asked to get uncompressed
-automatically on download, libcurl continues to uncompress the entire
-downloaded chunk and it caches the data uncompressed. This has the side-
-effect that if you download something that is compressed a lot, it can result
-in a large data amount needing to be allocated to save the data during the
-pause. consider not using paused receiving if you allow libcurl to uncompress
-data automatically.
-.SH AVAILABILITY
-Added in 7.18.0.
-.SH RETURN VALUE
-CURLE_OK (zero) means that the option was set properly, and a non-zero return
-code means something wrong occurred after the new state was set. See the
-\fIlibcurl-errors(3)\fP man page for the full list with descriptions.
-.SH "SEE ALSO"
-.BR curl_easy_cleanup "(3), " curl_easy_reset "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_easy_pause.md b/third-party/curl/docs/libcurl/curl_easy_pause.md
new file mode 100644
index 0000000000..4a37ed1c14
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_pause.md
@@ -0,0 +1,142 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_pause
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_cleanup (3)
+  - curl_easy_reset (3)
+Protocol:
+  - All
+Added-in: 7.18.0
+---
+
+# NAME
+
+curl_easy_pause - pause and unpause a connection
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_pause(CURL *handle, int action);
+~~~
+
+# DESCRIPTION
+
+Using this function, you can explicitly mark a running connection to get
+paused, and you can unpause a connection that was previously paused. Unlike
+most other libcurl functions, curl_easy_pause(3) can be used from within
+callbacks.
+
+A connection can be paused by using this function or by letting the read or
+the write callbacks return the proper return code (*CURL_READFUNC_PAUSE* and
+*CURL_WRITEFUNC_PAUSE*). A write callback that returns pause signals to the
+library that it could not take care of any data at all, and that data is then
+delivered again to the callback when the transfer is unpaused.
+
+While it may feel tempting, take care and notice that you cannot call this
+function from another thread. To unpause, you may for example call it from the
+progress callback (CURLOPT_PROGRESSFUNCTION(3)).
+
+When this function is called to unpause receiving, the write callback might
+get called before this function returns to deliver cached content. When
+libcurl delivers such cached data to the write callback, it is delivered as
+fast as possible, which may overstep the boundary set in
+CURLOPT_MAX_RECV_SPEED_LARGE(3) etc.
+
+The **handle** argument identifies the transfer you want to pause or
+unpause.
+
+A paused transfer is excluded from low speed cancels via the
+CURLOPT_LOW_SPEED_LIMIT(3) option and unpausing a transfer resets the
+time period required for the low speed limit to be met.
+
+The **action** argument is a set of bits that sets the new state of the
+connection. The following bits can be used:
+
+## CURLPAUSE_RECV
+
+Pause receiving data. There is no data received on this connection until this
+function is called again without this bit set. Thus, the write callback
+(CURLOPT_WRITEFUNCTION(3)) is not called.
+
+## CURLPAUSE_SEND
+
+Pause sending data. There is no data sent on this connection until this
+function is called again without this bit set. Thus, the read callback
+(CURLOPT_READFUNCTION(3)) is not called.
+
+## CURLPAUSE_ALL
+
+Convenience define that pauses both directions.
+
+## CURLPAUSE_CONT
+
+Convenience define that unpauses both directions.
+
+# LIMITATIONS
+
+The pausing of transfers does not work with protocols that work without
+network connectivity, like `file://`. Trying to pause such a transfer, in any
+direction, might cause problems or error.
+
+# MULTIPLEXED
+
+On multiplexed connections (HTTP/2 or HTTP/3), pausing an individual stream
+while others remain active forces libcurl to buffer up to 10 MB of data for
+the paused transfer. Because libcurl must continuously drain the shared socket
+to sustain active streams, and the default flow-control window allows the
+server to send up to 10 MB before halting, libcurl is forced to buffer the
+incoming bytes in memory.
+
+When such a paused stream is unpaused again, any buffered data is delivered
+first.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    /* pause a transfer in both directions */
+    curl_easy_pause(curl, CURLPAUSE_RECV | CURLPAUSE_SEND);
+  }
+}
+~~~
+
+# MEMORY USE
+
+When pausing a download transfer by returning the appropriate return code from
+a write callback, the read data is already in libcurl's internal buffers so it
+has to keep it in an allocated buffer until the receiving is again unpaused
+using this function.
+
+If the downloaded data is compressed and is asked to get uncompressed
+automatically on download, libcurl continues to uncompress the entire
+downloaded chunk and it caches the data uncompressed. This has the side-
+effect that if you download something that is compressed a lot, it can result
+in a large data amount needing to be allocated to save the data during the
+pause. Consider not using paused receiving if you allow libcurl to uncompress
+data automatically.
+
+If the download is done with HTTP/2 or HTTP/3, there is up to a stream window
+size worth of data that curl cannot stop but instead needs to cache while the
+transfer is paused. This means that if a window size of 64 MB is used, libcurl
+might end up having to cache 64 MB of data.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
diff --git a/third-party/curl/docs/libcurl/curl_easy_perform.3 b/third-party/curl/docs/libcurl/curl_easy_perform.3
deleted file mode 100644
index 923bfbdcc7..0000000000
--- a/third-party/curl/docs/libcurl/curl_easy_perform.3
+++ /dev/null
@@ -1,85 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_easy_perform 3 "5 Mar 2001" "libcurl" "libcurl"
-.SH NAME
-curl_easy_perform - perform a blocking file transfer
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_perform(CURL *easy_handle);
-.fi
-.SH DESCRIPTION
-\fIcurl_easy_perform(3)\fP performs a network transfer in a blocking manner
-and returns when done, or earlier if it fails. For non-blocking behavior, see
-\fIcurl_multi_perform(3)\fP.
-
-Invoke this function after \fIcurl_easy_init(3)\fP and all the
-\fIcurl_easy_setopt(3)\fP calls are made, and it performs the transfer as
-described in the options. It must be called with the same \fBeasy_handle\fP as
-input as the \fIcurl_easy_init(3)\fP call returned.
-
-You can do any amount of calls to \fIcurl_easy_perform(3)\fP while using the
-same \fBeasy_handle\fP. If you intend to transfer more than one file, you are
-even encouraged to do so. libcurl attempts to reuse existing connections for
-the following transfers, thus making the operations faster, less CPU intense
-and using less network resources. You probably want to use
-\fIcurl_easy_setopt(3)\fP between the invokes to set options for the following
-curl_easy_perform call.
-
-You must never call this function simultaneously from two places using the
-same \fBeasy_handle\fP. Let the function return first before invoking it
-another time. If you want parallel transfers, you must use several curl
-easy_handles.
-
-A network transfer moves data to a peer or from a peer. An application tells
-libcurl how to receive data by setting the \fICURLOPT_WRITEFUNCTION(3)\fP and
-\fICURLOPT_WRITEDATA(3)\fP options. To tell libcurl what data to send, there
-are a few more alternatives but two common ones are
-\fICURLOPT_READFUNCTION(3)\fP and \fICURLOPT_POSTFIELDS(3)\fP.
-
-While the \fBeasy_handle\fP is added to a multi handle, it cannot be used by
-\fIcurl_easy_perform(3)\fP.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  res = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-CURLE_OK (0) means everything was OK, non-zero means an error occurred as
-.I <curl/curl.h>
-defines - see \fIlibcurl-errors(3)\fP. If the \fICURLOPT_ERRORBUFFER(3)\fP was
-set with \fIcurl_easy_setopt(3)\fP there is a readable error message stored in
-the error buffer when non-zero is returned.
-.SH "SEE ALSO"
-.BR curl_easy_init "(3), " curl_easy_setopt "(3), "
-.BR curl_multi_add_handle "(3), " curl_multi_perform "(3), "
-.BR libcurl-errors "(3), "
diff --git a/third-party/curl/docs/libcurl/curl_easy_perform.md b/third-party/curl/docs/libcurl/curl_easy_perform.md
new file mode 100644
index 0000000000..cc61232f87
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_perform.md
@@ -0,0 +1,88 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_perform
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_init (3)
+  - curl_easy_setopt (3)
+  - curl_multi_add_handle (3)
+  - curl_multi_perform (3)
+  - libcurl-errors (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+curl_easy_perform - perform a blocking network transfer
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_perform(CURL *easy_handle);
+~~~
+
+# DESCRIPTION
+
+curl_easy_perform(3) performs a network transfer in a blocking manner and
+returns when done, or earlier if it fails. For non-blocking behavior, see
+curl_multi_perform(3).
+
+Invoke this function after curl_easy_init(3) and all the curl_easy_setopt(3)
+calls are made, and it performs the transfer as described in the options. It
+must be called with the same **easy_handle** as input as the curl_easy_init(3)
+call returned.
+
+You can do any amount of calls to curl_easy_perform(3) while using the same
+**easy_handle**. If you intend to transfer more than one file, you are even
+encouraged to do so. libcurl attempts to reuse existing connections for the
+following transfers, thus making the operations faster, less CPU intense and
+using less network resources. You probably want to use curl_easy_setopt(3)
+between the invokes to set options for the following curl_easy_perform(3)
+call.
+
+You must never call this function simultaneously from two places using the
+same **easy_handle**. Let the function return first before invoking it another
+time. If you want parallel transfers, you must use several curl easy_handles.
+
+A network transfer moves data to a peer or from a peer. An application tells
+libcurl how to receive data by setting the CURLOPT_WRITEFUNCTION(3) and
+CURLOPT_WRITEDATA(3) options. To tell libcurl what data to send, there are a
+few more alternatives but two common ones are CURLOPT_READFUNCTION(3) and
+CURLOPT_POSTFIELDS(3).
+
+While the **easy_handle** is added to a multi handle, it cannot be used by
+curl_easy_perform(3).
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
diff --git a/third-party/curl/docs/libcurl/curl_easy_recv.3 b/third-party/curl/docs/libcurl/curl_easy_recv.3
deleted file mode 100644
index 2f6a148c3d..0000000000
--- a/third-party/curl/docs/libcurl/curl_easy_recv.3
+++ /dev/null
@@ -1,97 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH curl_easy_recv 3 "29 April 2008" "libcurl" "libcurl"
-.SH NAME
-curl_easy_recv - receives raw data on an "easy" connection
-.SH SYNOPSIS
-.nf
-#include <curl/easy.h>
-
-CURLcode curl_easy_recv(CURL *curl, void *buffer, size_t buflen, size_t *n);
-.fi
-.SH DESCRIPTION
-This function receives raw data from the established connection. You may use
-it together with \fIcurl_easy_send(3)\fP to implement custom protocols using
-libcurl. This functionality can be particularly useful if you use proxies
-and/or SSL encryption: libcurl takes care of proxy negotiation and connection
-setup.
-
-\fBbuffer\fP is a pointer to your buffer memory that gets populated by the
-received data. \fBbuflen\fP is the maximum amount of data you can get in that
-buffer. The variable \fBn\fP points to receives the number of received bytes.
-
-To establish the connection, set \fICURLOPT_CONNECT_ONLY(3)\fP option before
-calling \fIcurl_easy_perform(3)\fP or \fIcurl_multi_perform(3)\fP. Note that
-\fIcurl_easy_recv(3)\fP does not work on connections that were created without
-this option.
-
-The call returns \fBCURLE_AGAIN\fP if there is no data to read - the socket is
-used in non-blocking mode internally. When \fBCURLE_AGAIN\fP is returned, use
-your operating system facilities like \fIselect(2)\fP to wait for data. The
-socket may be obtained using \fIcurl_easy_getinfo(3)\fP with
-\fICURLINFO_ACTIVESOCKET(3)\fP.
-
-Wait on the socket only if \fIcurl_easy_recv(3)\fP returns \fBCURLE_AGAIN\fP.
-The reason for this is libcurl or the SSL library may internally cache some
-data, therefore you should call \fIcurl_easy_recv(3)\fP until all data is
-read which would include any cached data.
-
-Furthermore if you wait on the socket and it tells you there is data to read,
-\fIcurl_easy_recv(3)\fP may return \fBCURLE_AGAIN\fP if the only data that was
-read was for internal SSL processing, and no other data is available.
-.SH EXAMPLE
-.nf
- curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
- /* Do not do the transfer - only connect to host */
- curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
- res = curl_easy_perform(curl);
-
- if(res == CURLE_OK) {
-   /* Extract the socket from the curl handle - we need it for waiting. */
-   res = curl_easy_getinfo(curl, CURLINFO_ACTIVESOCKET, &sockfd);
-
-   /* read data */
-   res = curl_easy_recv(curl, buf, sizeof(buf), &nread);
- }
-.fi
-.SH AVAILABILITY
-Added in 7.18.2.
-.SH RETURN VALUE
-On success, returns \fBCURLE_OK\fP, stores the received data into
-\fBbuffer\fP, and the number of bytes it actually read into \fB*n\fP.
-
-On failure, returns the appropriate error code.
-
-The function may return \fBCURLE_AGAIN\fP. In this case, use your operating
-system facilities to wait until data can be read, and retry.
-
-Reading exactly 0 bytes indicates a closed connection.
-
-If there is no socket available to use from the previous transfer, this function
-returns \fBCURLE_UNSUPPORTED_PROTOCOL\fP.
-.SH "SEE ALSO"
-.BR curl_easy_setopt "(3), " curl_easy_perform "(3), "
-.BR curl_easy_getinfo "(3), "
-.BR curl_easy_send "(3) "
diff --git a/third-party/curl/docs/libcurl/curl_easy_recv.md b/third-party/curl/docs/libcurl/curl_easy_recv.md
new file mode 100644
index 0000000000..aeb16c0ce5
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_recv.md
@@ -0,0 +1,106 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_recv
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_getinfo (3)
+  - curl_easy_perform (3)
+  - curl_easy_send (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.18.2
+---
+
+# NAME
+
+curl_easy_recv - receives raw data on an "easy" connection
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_recv(CURL *curl, void *buffer, size_t buflen, size_t *n);
+~~~
+
+# DESCRIPTION
+
+This function receives raw data from the established connection. You may use
+it together with curl_easy_send(3) to implement custom protocols using
+libcurl. This functionality can be particularly useful if you use proxies
+and/or SSL encryption: libcurl takes care of proxy negotiation and connection
+setup.
+
+**buffer** is a pointer to your buffer memory that gets populated by the
+received data. **buflen** is the maximum amount of data you can get in that
+buffer. The variable **n** points to receives the number of received bytes.
+
+To establish the connection, set CURLOPT_CONNECT_ONLY(3) option before
+calling curl_easy_perform(3) or curl_multi_perform(3). Note that
+curl_easy_recv(3) does not work on connections that were created without
+this option.
+
+The call returns **CURLE_AGAIN** if there is no data to read - the socket is
+used in non-blocking mode internally. When **CURLE_AGAIN** is returned, use
+your operating system facilities like *select(2)* to wait for data. The
+socket may be obtained using curl_easy_getinfo(3) with
+CURLINFO_ACTIVESOCKET(3).
+
+Wait on the socket only if curl_easy_recv(3) returns **CURLE_AGAIN**.
+The reason for this is libcurl or the SSL library may internally cache some
+data, therefore you should call curl_easy_recv(3) until all data is
+read which would include any cached data.
+
+Furthermore if you wait on the socket and it tells you there is data to read,
+curl_easy_recv(3) may return **CURLE_AGAIN** if the only data that was
+read was for internal SSL processing, and no other data is available.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    /* Do not do the transfer - only connect to host */
+    curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      char buf[256];
+      size_t nread;
+      curl_socket_t sockfd;
+
+      /* Extract the socket from the curl handle - we need it for waiting. */
+      result = curl_easy_getinfo(curl, CURLINFO_ACTIVESOCKET, &sockfd);
+
+      /* read data */
+      result = curl_easy_recv(curl, buf, sizeof(buf), &nread);
+    }
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+On success, returns **CURLE_OK**, stores the received data into
+**buffer**, and the number of bytes it actually read into ***n**.
+
+On failure, returns the appropriate error code.
+
+The function may return **CURLE_AGAIN**. In this case, use your operating
+system facilities to wait until data can be read, and retry.
+
+Reading exactly 0 bytes indicates a closed connection.
+
+If there is no socket available to use from the previous transfer, this
+function returns **CURLE_UNSUPPORTED_PROTOCOL**.
diff --git a/third-party/curl/docs/libcurl/curl_easy_reset.3 b/third-party/curl/docs/libcurl/curl_easy_reset.3
deleted file mode 100644
index f083bc46c8..0000000000
--- a/third-party/curl/docs/libcurl/curl_easy_reset.3
+++ /dev/null
@@ -1,55 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_easy_reset 3 "31 July 2004" "libcurl" "libcurl"
-.SH NAME
-curl_easy_reset - reset all options of a libcurl session handle
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-void curl_easy_reset(CURL *handle);
-.fi
-.SH DESCRIPTION
-Re-initializes all options previously set on a specified CURL handle to the
-default values. This puts back the handle to the same state as it was in when
-it was just created with \fIcurl_easy_init(3)\fP.
-
-It does not change the following information kept in the handle: live
-connections, the Session ID cache, the DNS cache, the cookies, the shares or
-the alt-svc cache.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-
-/* ... the handle is used and options are set ... */
-
-curl_easy_reset(curl);
-.fi
-.SH AVAILABILITY
-This function was added in libcurl 7.12.1
-.SH RETURN VALUE
-Nothing
-.SH "SEE ALSO"
-.BR curl_easy_init "(3)," curl_easy_cleanup "(3)," curl_easy_setopt "(3),"
-.BR curl_easy_duphandle "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_easy_reset.md b/third-party/curl/docs/libcurl/curl_easy_reset.md
new file mode 100644
index 0000000000..f27e86cbb6
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_reset.md
@@ -0,0 +1,59 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_reset
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_cleanup (3)
+  - curl_easy_duphandle (3)
+  - curl_easy_init (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.12.1
+---
+
+# NAME
+
+curl_easy_reset - reset all options of a libcurl session handle
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+void curl_easy_reset(CURL *handle);
+~~~
+
+# DESCRIPTION
+
+Re-initializes all options previously set on a specified curl handle to the
+default values. This puts back the handle to the same state as it was in when
+it was created with curl_easy_init(3).
+
+It does not change the following information kept in the handle: live
+connections, the Session ID cache, the DNS cache, the cookies, the shares or
+the alt-svc cache.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+
+    /* ... the handle is used and options are set ... */
+    curl_easy_reset(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+Nothing
diff --git a/third-party/curl/docs/libcurl/curl_easy_send.3 b/third-party/curl/docs/libcurl/curl_easy_send.3
deleted file mode 100644
index 467edc554f..0000000000
--- a/third-party/curl/docs/libcurl/curl_easy_send.3
+++ /dev/null
@@ -1,90 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH curl_easy_send 3 "29 April 2008" "libcurl" "libcurl"
-.SH NAME
-curl_easy_send - sends raw data over an "easy" connection
-.SH SYNOPSIS
-.nf
-#include <curl/easy.h>
-
-CURLcode curl_easy_send(CURL *curl, const void *buffer,
-                        size_t buflen, size_t *n);
-.fi
-.SH DESCRIPTION
-This function sends arbitrary data over the established connection. You may
-use it together with \fIcurl_easy_recv(3)\fP to implement custom protocols
-using libcurl. This functionality can be particularly useful if you use
-proxies and/or SSL encryption: libcurl takes care of proxy negotiation and
-connection setup.
-
-\fBbuffer\fP is a pointer to the data of length \fBbuflen\fP that you want
-sent. The variable \fBn\fP points to receives the number of sent bytes.
-
-To establish the connection, set \fICURLOPT_CONNECT_ONLY(3)\fP option before
-calling \fIcurl_easy_perform(3)\fP or \fIcurl_multi_perform(3)\fP. Note that
-\fIcurl_easy_send(3)\fP does not work on connections that were created without
-this option.
-
-The call returns \fBCURLE_AGAIN\fP if it's not possible to send data right now
-- the socket is used in non-blocking mode internally. When \fBCURLE_AGAIN\fP
-is returned, use your operating system facilities like \fIselect(2)\fP to wait
-until the socket is writable. The socket may be obtained using
-\fIcurl_easy_getinfo(3)\fP with \fICURLINFO_ACTIVESOCKET(3)\fP.
-
-Furthermore if you wait on the socket and it tells you it's writable,
-\fIcurl_easy_send(3)\fP may return \fBCURLE_AGAIN\fP if the only data that was
-sent was for internal SSL processing, and no other data could be sent.
-.SH EXAMPLE
-.nf
- curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
- /* Do not do the transfer - only connect to host */
- curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
- res = curl_easy_perform(curl);
-
- if(res == CURLE_OK) {
-   /* Extract the socket from the curl handle - we need it for waiting. */
-   res = curl_easy_getinfo(curl, CURLINFO_ACTIVESOCKET, &sockfd);
-
-   /* send data */
-   res = curl_easy_send(curl, "hello", 5, &sent);
- }
-.fi
-.SH AVAILABILITY
-Added in 7.18.2.
-.SH RETURN VALUE
-On success, returns \fBCURLE_OK\fP and stores the number of bytes actually
-sent into \fB*n\fP. Note that this may be less than the amount you wanted to
-send.
-
-On failure, returns the appropriate error code.
-
-This function may return \fBCURLE_AGAIN\fP. In this case, use your operating
-system facilities to wait until the socket is writable, and retry.
-
-If there is no socket available to use from the previous transfer, this function
-returns \fBCURLE_UNSUPPORTED_PROTOCOL\fP.
-.SH "SEE ALSO"
-.BR curl_easy_setopt "(3), " curl_easy_perform "(3), " curl_easy_getinfo "(3), "
-.BR curl_easy_recv "(3) "
diff --git a/third-party/curl/docs/libcurl/curl_easy_send.md b/third-party/curl/docs/libcurl/curl_easy_send.md
new file mode 100644
index 0000000000..016a6756a8
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_send.md
@@ -0,0 +1,98 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_send
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_getinfo (3)
+  - curl_easy_perform (3)
+  - curl_easy_recv (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.18.2
+---
+
+# NAME
+
+curl_easy_send - sends raw data over an "easy" connection
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_send(CURL *curl, const void *buffer,
+                        size_t buflen, size_t *n);
+~~~
+
+# DESCRIPTION
+
+This function sends arbitrary data over the established connection. You may
+use it together with curl_easy_recv(3) to implement custom protocols
+using libcurl. This functionality can be particularly useful if you use
+proxies and/or SSL encryption: libcurl takes care of proxy negotiation and
+connection setup.
+
+**buffer** is a pointer to the data of length **buflen** that you want
+sent. The variable **n** points to receives the number of sent bytes.
+
+To establish the connection, set CURLOPT_CONNECT_ONLY(3) option before
+calling curl_easy_perform(3) or curl_multi_perform(3). Note that
+curl_easy_send(3) does not work on connections that were created without
+this option.
+
+The call returns **CURLE_AGAIN** if it is not possible to send data right now
+- the socket is used in non-blocking mode internally. When **CURLE_AGAIN**
+is returned, use your operating system facilities like *select(2)* to wait
+until the socket is writable. The socket may be obtained using
+curl_easy_getinfo(3) with CURLINFO_ACTIVESOCKET(3).
+
+Furthermore if you wait on the socket and it tells you it is writable,
+curl_easy_send(3) may return **CURLE_AGAIN** if the only data that was sent
+was for internal SSL processing, and no other data could be sent.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    /* Do not do the transfer - only connect to host */
+    curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      curl_socket_t sockfd;
+      size_t sent;
+      /* Extract the socket from the curl handle - we need it for waiting. */
+      result = curl_easy_getinfo(curl, CURLINFO_ACTIVESOCKET, &sockfd);
+
+      /* send data */
+      result = curl_easy_send(curl, "hello", 5, &sent);
+    }
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+On success, returns **CURLE_OK** and stores the number of bytes actually
+sent into ***n**. Note that this may be less than the amount you wanted to
+send.
+
+On failure, returns the appropriate error code.
+
+This function may return **CURLE_AGAIN**. In this case, use your operating
+system facilities to wait until the socket is writable, and retry.
+
+If there is no socket available to use from the previous transfer, this
+function returns **CURLE_UNSUPPORTED_PROTOCOL**.
diff --git a/third-party/curl/docs/libcurl/curl_easy_setopt.3 b/third-party/curl/docs/libcurl/curl_easy_setopt.3
deleted file mode 100644
index 949af6d35b..0000000000
--- a/third-party/curl/docs/libcurl/curl_easy_setopt.3
+++ /dev/null
@@ -1,742 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH curl_easy_setopt 3 "25 Jun 2014" "libcurl" "libcurl"
-.SH NAME
-curl_easy_setopt \- set options for a curl easy handle
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLoption option, parameter);
-.fi
-.SH DESCRIPTION
-\fIcurl_easy_setopt(3)\fP is used to tell libcurl how to behave. By setting
-the appropriate options, the application can change libcurl's behavior. All
-options are set with an \fIoption\fP followed by a \fIparameter\fP. That
-parameter can be a \fBlong\fP, a \fBfunction pointer\fP, an \fBobject
-pointer\fP or a \fBcurl_off_t\fP, depending on what the specific option
-expects. Read this manual carefully as bad input values may cause libcurl to
-behave badly! You can only set one option in each function call. A typical
-application uses many \fIcurl_easy_setopt(3)\fP calls in the setup phase.
-
-Options set with this function call are valid for all forthcoming transfers
-performed using this \fIhandle\fP. The options are not in any way reset
-between transfers, so if you want subsequent transfers with different options,
-you must change them between the transfers. You can optionally reset all
-options back to internal default with \fIcurl_easy_reset(3)\fP.
-
-Strings passed to libcurl as 'char *' arguments, are copied by the library;
-the string storage associated to the pointer argument may be discarded or
-reused after \fIcurl_easy_setopt(3)\fP returns. The only exception to this
-rule is really \fICURLOPT_POSTFIELDS(3)\fP, but the alternative that copies
-the string \fICURLOPT_COPYPOSTFIELDS(3)\fP has some usage characteristics you
-need to read up on. This function does not accept input strings longer than
-\fBCURL_MAX_INPUT_LENGTH\fP (8 MB).
-
-The order in which the options are set does not matter.
-
-Before version 7.17.0, strings were not copied. Instead the user was forced
-keep them available until libcurl no longer needed them.
-
-The \fIhandle\fP is the return code from a \fIcurl_easy_init(3)\fP or
-\fIcurl_easy_duphandle(3)\fP call.
-.SH BEHAVIOR OPTIONS
-.IP CURLOPT_VERBOSE
-Display verbose information. See \fICURLOPT_VERBOSE(3)\fP
-.IP CURLOPT_HEADER
-Include the header in the body output. See \fICURLOPT_HEADER(3)\fP
-.IP CURLOPT_NOPROGRESS
-Shut off the progress meter. See \fICURLOPT_NOPROGRESS(3)\fP
-.IP CURLOPT_NOSIGNAL
-Do not install signal handlers. See \fICURLOPT_NOSIGNAL(3)\fP
-.IP CURLOPT_WILDCARDMATCH
-Transfer multiple files according to a file name pattern. See \fICURLOPT_WILDCARDMATCH(3)\fP
-.SH CALLBACK OPTIONS
-.IP CURLOPT_WRITEFUNCTION
-Callback for writing data. See \fICURLOPT_WRITEFUNCTION(3)\fP
-.IP CURLOPT_WRITEDATA
-Data pointer to pass to the write callback. See \fICURLOPT_WRITEDATA(3)\fP
-.IP CURLOPT_READFUNCTION
-Callback for reading data. See \fICURLOPT_READFUNCTION(3)\fP
-.IP CURLOPT_READDATA
-Data pointer to pass to the read callback. See \fICURLOPT_READDATA(3)\fP
-.IP CURLOPT_IOCTLFUNCTION
-\fBDeprecated option\fP Callback for I/O operations.
-See \fICURLOPT_IOCTLFUNCTION(3)\fP
-.IP CURLOPT_IOCTLDATA
-\fBDeprecated option\fP Data pointer to pass to the I/O callback.
-See \fICURLOPT_IOCTLDATA(3)\fP
-.IP CURLOPT_SEEKFUNCTION
-Callback for seek operations. See \fICURLOPT_SEEKFUNCTION(3)\fP
-.IP CURLOPT_SEEKDATA
-Data pointer to pass to the seek callback. See \fICURLOPT_SEEKDATA(3)\fP
-.IP CURLOPT_SOCKOPTFUNCTION
-Callback for sockopt operations. See \fICURLOPT_SOCKOPTFUNCTION(3)\fP
-.IP CURLOPT_SOCKOPTDATA
-Data pointer to pass to the sockopt callback. See \fICURLOPT_SOCKOPTDATA(3)\fP
-.IP CURLOPT_OPENSOCKETFUNCTION
-Callback for socket creation. See \fICURLOPT_OPENSOCKETFUNCTION(3)\fP
-.IP CURLOPT_OPENSOCKETDATA
-Data pointer to pass to the open socket callback. See \fICURLOPT_OPENSOCKETDATA(3)\fP
-.IP CURLOPT_CLOSESOCKETFUNCTION
-Callback for closing socket. See \fICURLOPT_CLOSESOCKETFUNCTION(3)\fP
-.IP CURLOPT_CLOSESOCKETDATA
-Data pointer to pass to the close socket callback. See \fICURLOPT_CLOSESOCKETDATA(3)\fP
-.IP CURLOPT_PROGRESSFUNCTION
-\fBOBSOLETE\fP callback for progress meter.
-See \fICURLOPT_PROGRESSFUNCTION(3)\fP
-.IP CURLOPT_PROGRESSDATA
-Data pointer to pass to the progress meter callback. See \fICURLOPT_PROGRESSDATA(3)\fP
-.IP CURLOPT_XFERINFOFUNCTION
-Callback for progress meter. See \fICURLOPT_XFERINFOFUNCTION(3)\fP
-.IP CURLOPT_XFERINFODATA
-Data pointer to pass to the progress meter callback. See \fICURLOPT_XFERINFODATA(3)\fP
-.IP CURLOPT_HEADERFUNCTION
-Callback for writing received headers. See \fICURLOPT_HEADERFUNCTION(3)\fP
-.IP CURLOPT_HEADERDATA
-Data pointer to pass to the header callback. See \fICURLOPT_HEADERDATA(3)\fP
-.IP CURLOPT_DEBUGFUNCTION
-Callback for debug information. See \fICURLOPT_DEBUGFUNCTION(3)\fP
-.IP CURLOPT_DEBUGDATA
-Data pointer to pass to the debug callback. See \fICURLOPT_DEBUGDATA(3)\fP
-.IP CURLOPT_SSL_CTX_FUNCTION
-Callback for SSL context logic. See \fICURLOPT_SSL_CTX_FUNCTION(3)\fP
-.IP CURLOPT_SSL_CTX_DATA
-Data pointer to pass to the SSL context callback. See \fICURLOPT_SSL_CTX_DATA(3)\fP
-.IP CURLOPT_CONV_TO_NETWORK_FUNCTION
-\fBOBSOLETE\fP Callback for code base conversion.
-See \fICURLOPT_CONV_TO_NETWORK_FUNCTION(3)\fP
-.IP CURLOPT_CONV_FROM_NETWORK_FUNCTION
-\fBOBSOLETE\fP Callback for code base conversion.
-See \fICURLOPT_CONV_FROM_NETWORK_FUNCTION(3)\fP
-.IP CURLOPT_CONV_FROM_UTF8_FUNCTION
-\fBOBSOLETE\fP Callback for code base conversion.
-See \fICURLOPT_CONV_FROM_UTF8_FUNCTION(3)\fP
-.IP CURLOPT_INTERLEAVEFUNCTION
-Callback for RTSP interleaved data. See \fICURLOPT_INTERLEAVEFUNCTION(3)\fP
-.IP CURLOPT_INTERLEAVEDATA
-Data pointer to pass to the RTSP interleave callback. See \fICURLOPT_INTERLEAVEDATA(3)\fP
-.IP CURLOPT_CHUNK_BGN_FUNCTION
-Callback for wildcard download start of chunk. See \fICURLOPT_CHUNK_BGN_FUNCTION(3)\fP
-.IP CURLOPT_CHUNK_END_FUNCTION
-Callback for wildcard download end of chunk. See \fICURLOPT_CHUNK_END_FUNCTION(3)\fP
-.IP CURLOPT_CHUNK_DATA
-Data pointer to pass to the chunk callbacks. See \fICURLOPT_CHUNK_DATA(3)\fP
-.IP CURLOPT_FNMATCH_FUNCTION
-Callback for wildcard matching. See \fICURLOPT_FNMATCH_FUNCTION(3)\fP
-.IP CURLOPT_FNMATCH_DATA
-Data pointer to pass to the wildcard matching callback. See \fICURLOPT_FNMATCH_DATA(3)\fP
-.IP CURLOPT_SUPPRESS_CONNECT_HEADERS
-Suppress proxy CONNECT response headers from user callbacks. See \fICURLOPT_SUPPRESS_CONNECT_HEADERS(3)\fP
-.IP CURLOPT_RESOLVER_START_FUNCTION
-Callback to be called before a new resolve request is started. See \fICURLOPT_RESOLVER_START_FUNCTION(3)\fP
-.IP CURLOPT_RESOLVER_START_DATA
-Data pointer to pass to resolver start callback. See \fICURLOPT_RESOLVER_START_DATA(3)\fP
-.IP CURLOPT_PREREQFUNCTION
-Callback to be called after a connection is established but before a request is made on that connection. See \fICURLOPT_PREREQFUNCTION(3)\fP
-.IP CURLOPT_PREREQDATA
-Data pointer to pass to the CURLOPT_PREREQFUNCTION callback. See \fICURLOPT_PREREQDATA(3)\fP
-.SH ERROR OPTIONS
-.IP CURLOPT_ERRORBUFFER
-Error message buffer. See \fICURLOPT_ERRORBUFFER(3)\fP
-.IP CURLOPT_STDERR
-stderr replacement stream. See \fICURLOPT_STDERR(3)\fP
-.IP CURLOPT_FAILONERROR
-Fail on HTTP 4xx errors. \fICURLOPT_FAILONERROR(3)\fP
-.IP CURLOPT_KEEP_SENDING_ON_ERROR
-Keep sending on HTTP >= 300 errors. \fICURLOPT_KEEP_SENDING_ON_ERROR(3)\fP
-.SH NETWORK OPTIONS
-.IP CURLOPT_URL
-URL to work on. See \fICURLOPT_URL(3)\fP
-.IP CURLOPT_PATH_AS_IS
-Disable squashing /../ and /./ sequences in the path. See \fICURLOPT_PATH_AS_IS(3)\fP
-.IP CURLOPT_PROTOCOLS
-\fBDeprecated option\fP Allowed protocols. See \fICURLOPT_PROTOCOLS(3)\fP
-.IP CURLOPT_PROTOCOLS_STR
-Allowed protocols. See \fICURLOPT_PROTOCOLS_STR(3)\fP
-.IP CURLOPT_REDIR_PROTOCOLS
-\fBDeprecated option\fP Protocols to allow redirects to. See
-\fICURLOPT_REDIR_PROTOCOLS(3)\fP
-.IP CURLOPT_REDIR_PROTOCOLS_STR
-Protocols to allow redirects to. See \fICURLOPT_REDIR_PROTOCOLS_STR(3)\fP
-.IP CURLOPT_DEFAULT_PROTOCOL
-Default protocol. See \fICURLOPT_DEFAULT_PROTOCOL(3)\fP
-.IP CURLOPT_PROXY
-Proxy to use. See \fICURLOPT_PROXY(3)\fP
-.IP CURLOPT_PRE_PROXY
-Socks proxy to use. See \fICURLOPT_PRE_PROXY(3)\fP
-.IP CURLOPT_PROXYPORT
-Proxy port to use. See \fICURLOPT_PROXYPORT(3)\fP
-.IP CURLOPT_PROXYTYPE
-Proxy type. See \fICURLOPT_PROXYTYPE(3)\fP
-.IP CURLOPT_NOPROXY
-Filter out hosts from proxy use. \fICURLOPT_NOPROXY(3)\fP
-.IP CURLOPT_HTTPPROXYTUNNEL
-Tunnel through the HTTP proxy. \fICURLOPT_HTTPPROXYTUNNEL(3)\fP
-.IP CURLOPT_CONNECT_TO
-Connect to a specific host and port. See \fICURLOPT_CONNECT_TO(3)\fP
-.IP CURLOPT_SOCKS5_AUTH
-Socks5 authentication methods. See \fICURLOPT_SOCKS5_AUTH(3)\fP
-.IP CURLOPT_SOCKS5_GSSAPI_SERVICE
-\fBDeprecated option\fP Socks5 GSSAPI service name.
-See \fICURLOPT_SOCKS5_GSSAPI_SERVICE(3)\fP
-.IP CURLOPT_SOCKS5_GSSAPI_NEC
-Socks5 GSSAPI NEC mode. See \fICURLOPT_SOCKS5_GSSAPI_NEC(3)\fP
-.IP CURLOPT_PROXY_SERVICE_NAME
-Proxy authentication service name. \fICURLOPT_PROXY_SERVICE_NAME(3)\fP
-.IP CURLOPT_HAPROXYPROTOCOL
-Send an HAProxy PROXY protocol v1 header. See \fICURLOPT_HAPROXYPROTOCOL(3)\fP
-.IP CURLOPT_HAPROXY_CLIENT_IP
-Spoof the client IP in an HAProxy PROXY protocol v1 header. See \fICURLOPT_HAPROXY_CLIENT_IP(3)\fP
-.IP CURLOPT_SERVICE_NAME
-Authentication service name. \fICURLOPT_SERVICE_NAME(3)\fP
-.IP CURLOPT_INTERFACE
-Bind connection locally to this. See \fICURLOPT_INTERFACE(3)\fP
-.IP CURLOPT_LOCALPORT
-Bind connection locally to this port. See \fICURLOPT_LOCALPORT(3)\fP
-.IP CURLOPT_LOCALPORTRANGE
-Bind connection locally to port range. See \fICURLOPT_LOCALPORTRANGE(3)\fP
-.IP CURLOPT_DNS_CACHE_TIMEOUT
-Timeout for DNS cache. See \fICURLOPT_DNS_CACHE_TIMEOUT(3)\fP
-.IP CURLOPT_DNS_USE_GLOBAL_CACHE
-\fBOBSOLETE\fP Enable global DNS cache.
-See \fICURLOPT_DNS_USE_GLOBAL_CACHE(3)\fP
-.IP CURLOPT_DOH_URL
-Use this DoH server for name resolves. See \fICURLOPT_DOH_URL(3)\fP
-.IP CURLOPT_BUFFERSIZE
-Ask for alternate buffer size. See \fICURLOPT_BUFFERSIZE(3)\fP
-.IP CURLOPT_PORT
-Port number to connect to. See \fICURLOPT_PORT(3)\fP
-.IP CURLOPT_TCP_FASTOPEN
-Enable TCP Fast Open. See \fICURLOPT_TCP_FASTOPEN(3)\fP
-.IP CURLOPT_TCP_NODELAY
-Disable the Nagle algorithm. See \fICURLOPT_TCP_NODELAY(3)\fP
-.IP CURLOPT_ADDRESS_SCOPE
-IPv6 scope for local addresses. See \fICURLOPT_ADDRESS_SCOPE(3)\fP
-.IP CURLOPT_TCP_KEEPALIVE
-Enable TCP keep-alive. See \fICURLOPT_TCP_KEEPALIVE(3)\fP
-.IP CURLOPT_TCP_KEEPIDLE
-Idle time before sending keep-alive. See \fICURLOPT_TCP_KEEPIDLE(3)\fP
-.IP CURLOPT_TCP_KEEPINTVL
-Interval between keep-alive probes. See \fICURLOPT_TCP_KEEPINTVL(3)\fP
-.IP CURLOPT_UNIX_SOCKET_PATH
-Path to a Unix domain socket. See \fICURLOPT_UNIX_SOCKET_PATH(3)\fP
-.IP CURLOPT_ABSTRACT_UNIX_SOCKET
-Path to an abstract Unix domain socket. See \fICURLOPT_ABSTRACT_UNIX_SOCKET(3)\fP
-.SH NAMES and PASSWORDS OPTIONS (Authentication)
-.IP CURLOPT_NETRC
-Enable .netrc parsing. See \fICURLOPT_NETRC(3)\fP
-.IP CURLOPT_NETRC_FILE
-\&.netrc file name. See \fICURLOPT_NETRC_FILE(3)\fP
-.IP CURLOPT_USERPWD
-User name and password. See \fICURLOPT_USERPWD(3)\fP
-.IP CURLOPT_PROXYUSERPWD
-Proxy user name and password. See \fICURLOPT_PROXYUSERPWD(3)\fP
-.IP CURLOPT_USERNAME
-User name. See \fICURLOPT_USERNAME(3)\fP
-.IP CURLOPT_PASSWORD
-Password. See \fICURLOPT_PASSWORD(3)\fP
-.IP CURLOPT_LOGIN_OPTIONS
-Login options. See \fICURLOPT_LOGIN_OPTIONS(3)\fP
-.IP CURLOPT_PROXYUSERNAME
-Proxy user name. See \fICURLOPT_PROXYUSERNAME(3)\fP
-.IP CURLOPT_PROXYPASSWORD
-Proxy password. See \fICURLOPT_PROXYPASSWORD(3)\fP
-.IP CURLOPT_HTTPAUTH
-HTTP server authentication methods. See \fICURLOPT_HTTPAUTH(3)\fP
-.IP CURLOPT_TLSAUTH_USERNAME
-TLS authentication user name. See \fICURLOPT_TLSAUTH_USERNAME(3)\fP
-.IP CURLOPT_PROXY_TLSAUTH_USERNAME
-Proxy TLS authentication user name. See \fICURLOPT_PROXY_TLSAUTH_USERNAME(3)\fP
-.IP CURLOPT_TLSAUTH_PASSWORD
-TLS authentication password. See \fICURLOPT_TLSAUTH_PASSWORD(3)\fP
-.IP CURLOPT_PROXY_TLSAUTH_PASSWORD
-Proxy TLS authentication password. See \fICURLOPT_PROXY_TLSAUTH_PASSWORD(3)\fP
-.IP CURLOPT_TLSAUTH_TYPE
-TLS authentication methods. See \fICURLOPT_TLSAUTH_TYPE(3)\fP
-.IP CURLOPT_PROXY_TLSAUTH_TYPE
-Proxy TLS authentication methods. See \fICURLOPT_PROXY_TLSAUTH_TYPE(3)\fP
-.IP CURLOPT_PROXYAUTH
-HTTP proxy authentication methods. See \fICURLOPT_PROXYAUTH(3)\fP
-.IP CURLOPT_SASL_AUTHZID
-SASL authorization identity (identity to act as). See \fICURLOPT_SASL_AUTHZID(3)\fP
-.IP CURLOPT_SASL_IR
-Enable SASL initial response. See \fICURLOPT_SASL_IR(3)\fP
-.IP CURLOPT_XOAUTH2_BEARER
-OAuth2 bearer token. See \fICURLOPT_XOAUTH2_BEARER(3)\fP
-.IP CURLOPT_DISALLOW_USERNAME_IN_URL
-Do not allow username in URL. See \fICURLOPT_DISALLOW_USERNAME_IN_URL(3)\fP
-.SH HTTP OPTIONS
-.IP CURLOPT_AUTOREFERER
-Automatically set Referer: header. See \fICURLOPT_AUTOREFERER(3)\fP
-.IP CURLOPT_ACCEPT_ENCODING
-Accept-Encoding and automatic decompressing data. See \fICURLOPT_ACCEPT_ENCODING(3)\fP
-.IP CURLOPT_TRANSFER_ENCODING
-Request Transfer-Encoding. See \fICURLOPT_TRANSFER_ENCODING(3)\fP
-.IP CURLOPT_FOLLOWLOCATION
-Follow HTTP redirects. See \fICURLOPT_FOLLOWLOCATION(3)\fP
-.IP CURLOPT_UNRESTRICTED_AUTH
-Do not restrict authentication to original host. \fICURLOPT_UNRESTRICTED_AUTH(3)\fP
-.IP CURLOPT_MAXREDIRS
-Maximum number of redirects to follow. See \fICURLOPT_MAXREDIRS(3)\fP
-.IP CURLOPT_POSTREDIR
-How to act on redirects after POST. See \fICURLOPT_POSTREDIR(3)\fP
-.IP CURLOPT_PUT
-\fBDeprecated option\fP Issue an HTTP PUT request. See \fICURLOPT_PUT(3)\fP
-.IP CURLOPT_POST
-Issue an HTTP POST request. See \fICURLOPT_POST(3)\fP
-.IP CURLOPT_POSTFIELDS
-Send a POST with this data. See \fICURLOPT_POSTFIELDS(3)\fP
-.IP CURLOPT_POSTFIELDSIZE
-The POST data is this big. See \fICURLOPT_POSTFIELDSIZE(3)\fP
-.IP CURLOPT_POSTFIELDSIZE_LARGE
-The POST data is this big. See \fICURLOPT_POSTFIELDSIZE_LARGE(3)\fP
-.IP CURLOPT_COPYPOSTFIELDS
-Send a POST with this data - and copy it. See \fICURLOPT_COPYPOSTFIELDS(3)\fP
-.IP CURLOPT_HTTPPOST
-\fBDeprecated option\fP Multipart formpost HTTP POST.
-See \fICURLOPT_HTTPPOST(3)\fP
-.IP CURLOPT_REFERER
-Referer: header. See \fICURLOPT_REFERER(3)\fP
-.IP CURLOPT_USERAGENT
-User-Agent: header. See \fICURLOPT_USERAGENT(3)\fP
-.IP CURLOPT_HTTPHEADER
-Custom HTTP headers. See \fICURLOPT_HTTPHEADER(3)\fP
-.IP CURLOPT_HEADEROPT
-Control custom headers. See \fICURLOPT_HEADEROPT(3)\fP
-.IP CURLOPT_PROXYHEADER
-Custom HTTP headers sent to proxy. See \fICURLOPT_PROXYHEADER(3)\fP
-.IP CURLOPT_HTTP200ALIASES
-Alternative versions of 200 OK. See \fICURLOPT_HTTP200ALIASES(3)\fP
-.IP CURLOPT_COOKIE
-Cookie(s) to send. See \fICURLOPT_COOKIE(3)\fP
-.IP CURLOPT_COOKIEFILE
-File to read cookies from. See \fICURLOPT_COOKIEFILE(3)\fP
-.IP CURLOPT_COOKIEJAR
-File to write cookies to. See \fICURLOPT_COOKIEJAR(3)\fP
-.IP CURLOPT_COOKIESESSION
-Start a new cookie session. See \fICURLOPT_COOKIESESSION(3)\fP
-.IP CURLOPT_COOKIELIST
-Add or control cookies. See \fICURLOPT_COOKIELIST(3)\fP
-.IP CURLOPT_ALTSVC
-Specify the Alt-Svc: cache file name. See \fICURLOPT_ALTSVC(3)\fP
-.IP CURLOPT_ALTSVC_CTRL
-Enable and configure Alt-Svc: treatment. See \fICURLOPT_ALTSVC_CTRL(3)\fP
-.IP CURLOPT_HSTS
-Set HSTS cache file. See \fICURLOPT_HSTS(3)\fP
-.IP CURLOPT_HSTS_CTRL
-Enable HSTS. See \fICURLOPT_HSTS_CTRL(3)\fP
-.IP CURLOPT_HSTSREADFUNCTION
-Set HSTS read callback. See \fICURLOPT_HSTSREADFUNCTION(3)\fP
-.IP CURLOPT_HSTSREADDATA
-Pass pointer to the HSTS read callback. See \fICURLOPT_HSTSREADDATA(3)\fP
-.IP CURLOPT_HSTSWRITEFUNCTION
-Set HSTS write callback. See \fICURLOPT_HSTSWRITEFUNCTION(3)\fP
-.IP CURLOPT_HSTSWRITEDATA
-Pass pointer to the HSTS write callback. See \fICURLOPT_HSTSWRITEDATA(3)\fP
-.IP CURLOPT_HTTPGET
-Do an HTTP GET request. See \fICURLOPT_HTTPGET(3)\fP
-.IP CURLOPT_REQUEST_TARGET
-Set the request target. \fICURLOPT_REQUEST_TARGET(3)\fP
-.IP CURLOPT_HTTP_VERSION
-HTTP version to use. \fICURLOPT_HTTP_VERSION(3)\fP
-.IP CURLOPT_HTTP09_ALLOWED
-Allow HTTP/0.9 responses. \fICURLOPT_HTTP09_ALLOWED(3)\fP
-.IP CURLOPT_IGNORE_CONTENT_LENGTH
-Ignore Content-Length. See \fICURLOPT_IGNORE_CONTENT_LENGTH(3)\fP
-.IP CURLOPT_HTTP_CONTENT_DECODING
-Disable Content decoding. See \fICURLOPT_HTTP_CONTENT_DECODING(3)\fP
-.IP CURLOPT_HTTP_TRANSFER_DECODING
-Disable Transfer decoding. See \fICURLOPT_HTTP_TRANSFER_DECODING(3)\fP
-.IP CURLOPT_EXPECT_100_TIMEOUT_MS
-100-continue timeout. See \fICURLOPT_EXPECT_100_TIMEOUT_MS(3)\fP
-.IP CURLOPT_TRAILERFUNCTION
-Set callback for sending trailing headers. See
-\fICURLOPT_TRAILERFUNCTION(3)\fP
-.IP CURLOPT_TRAILERDATA
-Custom pointer passed to the trailing headers callback. See
-\fICURLOPT_TRAILERDATA(3)\fP
-.IP CURLOPT_PIPEWAIT
-Wait on connection to pipeline on it. See \fICURLOPT_PIPEWAIT(3)\fP
-.IP CURLOPT_STREAM_DEPENDS
-This HTTP/2 stream depends on another. See \fICURLOPT_STREAM_DEPENDS(3)\fP
-.IP CURLOPT_STREAM_DEPENDS_E
-This HTTP/2 stream depends on another exclusively. See
-\fICURLOPT_STREAM_DEPENDS_E(3)\fP
-.IP CURLOPT_STREAM_WEIGHT
-Set this HTTP/2 stream's weight. See \fICURLOPT_STREAM_WEIGHT(3)\fP
-.SH SMTP OPTIONS
-.IP CURLOPT_MAIL_FROM
-Address of the sender. See \fICURLOPT_MAIL_FROM(3)\fP
-.IP CURLOPT_MAIL_RCPT
-Address of the recipients. See \fICURLOPT_MAIL_RCPT(3)\fP
-.IP CURLOPT_MAIL_AUTH
-Authentication address. See \fICURLOPT_MAIL_AUTH(3)\fP
-.IP CURLOPT_MAIL_RCPT_ALLOWFAILS
-Allow RCPT TO command to fail for some recipients. See
-\fICURLOPT_MAIL_RCPT_ALLOWFAILS(3)\fP
-.SH TFTP OPTIONS
-.IP CURLOPT_TFTP_BLKSIZE
-TFTP block size. See \fICURLOPT_TFTP_BLKSIZE(3)\fP
-.IP CURLOPT_TFTP_NO_OPTIONS
-Do not send TFTP options requests. See \fICURLOPT_TFTP_NO_OPTIONS(3)\fP
-.SH FTP OPTIONS
-.IP CURLOPT_FTPPORT
-Use active FTP. See \fICURLOPT_FTPPORT(3)\fP
-.IP CURLOPT_QUOTE
-Commands to run before transfer. See \fICURLOPT_QUOTE(3)\fP
-.IP CURLOPT_POSTQUOTE
-Commands to run after transfer. See \fICURLOPT_POSTQUOTE(3)\fP
-.IP CURLOPT_PREQUOTE
-Commands to run just before transfer. See \fICURLOPT_PREQUOTE(3)\fP
-.IP CURLOPT_APPEND
-Append to remote file. See \fICURLOPT_APPEND(3)\fP
-.IP CURLOPT_FTP_USE_EPRT
-Use EPRT. See \fICURLOPT_FTP_USE_EPRT(3)\fP
-.IP CURLOPT_FTP_USE_EPSV
-Use EPSV. See \fICURLOPT_FTP_USE_EPSV(3)\fP
-.IP CURLOPT_FTP_USE_PRET
-Use PRET. See \fICURLOPT_FTP_USE_PRET(3)\fP
-.IP CURLOPT_FTP_CREATE_MISSING_DIRS
-Create missing directories on the remote server. See \fICURLOPT_FTP_CREATE_MISSING_DIRS(3)\fP
-.IP CURLOPT_SERVER_RESPONSE_TIMEOUT
-Timeout for server responses. See \fICURLOPT_SERVER_RESPONSE_TIMEOUT(3)\fP
-.IP CURLOPT_FTP_ALTERNATIVE_TO_USER
-Alternative to USER. See \fICURLOPT_FTP_ALTERNATIVE_TO_USER(3)\fP
-.IP CURLOPT_FTP_SKIP_PASV_IP
-Ignore the IP address in the PASV response. See \fICURLOPT_FTP_SKIP_PASV_IP(3)\fP
-.IP CURLOPT_FTPSSLAUTH
-Control how to do TLS. See \fICURLOPT_FTPSSLAUTH(3)\fP
-.IP CURLOPT_FTP_SSL_CCC
-Back to non-TLS again after authentication. See \fICURLOPT_FTP_SSL_CCC(3)\fP
-.IP CURLOPT_FTP_ACCOUNT
-Send ACCT command. See \fICURLOPT_FTP_ACCOUNT(3)\fP
-.IP CURLOPT_FTP_FILEMETHOD
-Specify how to reach files. See \fICURLOPT_FTP_FILEMETHOD(3)\fP
-.SH RTSP OPTIONS
-.IP CURLOPT_RTSP_REQUEST
-RTSP request. See \fICURLOPT_RTSP_REQUEST(3)\fP
-.IP CURLOPT_RTSP_SESSION_ID
-RTSP session-id. See \fICURLOPT_RTSP_SESSION_ID(3)\fP
-.IP CURLOPT_RTSP_STREAM_URI
-RTSP stream URI. See \fICURLOPT_RTSP_STREAM_URI(3)\fP
-.IP CURLOPT_RTSP_TRANSPORT
-RTSP Transport: header. See \fICURLOPT_RTSP_TRANSPORT(3)\fP
-.IP CURLOPT_RTSP_CLIENT_CSEQ
-Client CSEQ number. See \fICURLOPT_RTSP_CLIENT_CSEQ(3)\fP
-.IP CURLOPT_RTSP_SERVER_CSEQ
-CSEQ number for RTSP Server->Client request. See \fICURLOPT_RTSP_SERVER_CSEQ(3)\fP
-.IP CURLOPT_AWS_SIGV4
-AWS HTTP V4 Signature. See \fICURLOPT_AWS_SIGV4(3)\fP
-.SH PROTOCOL OPTIONS
-.IP CURLOPT_TRANSFERTEXT
-Use text transfer. See \fICURLOPT_TRANSFERTEXT(3)\fP
-.IP CURLOPT_PROXY_TRANSFER_MODE
-Add transfer mode to URL over proxy. See \fICURLOPT_PROXY_TRANSFER_MODE(3)\fP
-.IP CURLOPT_CRLF
-Convert newlines. See \fICURLOPT_CRLF(3)\fP
-.IP CURLOPT_RANGE
-Range requests. See \fICURLOPT_RANGE(3)\fP
-.IP CURLOPT_RESUME_FROM
-Resume a transfer. See \fICURLOPT_RESUME_FROM(3)\fP
-.IP CURLOPT_RESUME_FROM_LARGE
-Resume a transfer. See \fICURLOPT_RESUME_FROM_LARGE(3)\fP
-.IP CURLOPT_CURLU
-Set URL to work on with a URL handle. See \fICURLOPT_CURLU(3)\fP
-.IP CURLOPT_CUSTOMREQUEST
-Custom request/method. See \fICURLOPT_CUSTOMREQUEST(3)\fP
-.IP CURLOPT_FILETIME
-Request file modification date and time. See \fICURLOPT_FILETIME(3)\fP
-.IP CURLOPT_DIRLISTONLY
-List only. See \fICURLOPT_DIRLISTONLY(3)\fP
-.IP CURLOPT_NOBODY
-Do not get the body contents. See \fICURLOPT_NOBODY(3)\fP
-.IP CURLOPT_INFILESIZE
-Size of file to send. \fICURLOPT_INFILESIZE(3)\fP
-.IP CURLOPT_INFILESIZE_LARGE
-Size of file to send. \fICURLOPT_INFILESIZE_LARGE(3)\fP
-.IP CURLOPT_UPLOAD
-Upload data. See \fICURLOPT_UPLOAD(3)\fP
-.IP CURLOPT_UPLOAD_BUFFERSIZE
-Set upload buffer size. See \fICURLOPT_UPLOAD_BUFFERSIZE(3)\fP
-.IP CURLOPT_MIMEPOST
-Post/send MIME data. See \fICURLOPT_MIMEPOST(3)\fP
-.IP CURLOPT_MIME_OPTIONS
-Set MIME option flags. See \fICURLOPT_MIME_OPTIONS(3)\fP
-.IP CURLOPT_MAXFILESIZE
-Maximum file size to get. See \fICURLOPT_MAXFILESIZE(3)\fP
-.IP CURLOPT_MAXFILESIZE_LARGE
-Maximum file size to get. See \fICURLOPT_MAXFILESIZE_LARGE(3)\fP
-.IP CURLOPT_TIMECONDITION
-Make a time conditional request. See \fICURLOPT_TIMECONDITION(3)\fP
-.IP CURLOPT_TIMEVALUE
-Time value for the time conditional request. See \fICURLOPT_TIMEVALUE(3)\fP
-.IP CURLOPT_TIMEVALUE_LARGE
-Time value for the time conditional request. See \fICURLOPT_TIMEVALUE_LARGE(3)\fP
-.SH CONNECTION OPTIONS
-.IP CURLOPT_TIMEOUT
-Timeout for the entire request. See \fICURLOPT_TIMEOUT(3)\fP
-.IP CURLOPT_TIMEOUT_MS
-Millisecond timeout for the entire request. See \fICURLOPT_TIMEOUT_MS(3)\fP
-.IP CURLOPT_LOW_SPEED_LIMIT
-Low speed limit to abort transfer. See \fICURLOPT_LOW_SPEED_LIMIT(3)\fP
-.IP CURLOPT_LOW_SPEED_TIME
-Time to be below the speed to trigger low speed abort. See \fICURLOPT_LOW_SPEED_TIME(3)\fP
-.IP CURLOPT_MAX_SEND_SPEED_LARGE
-Cap the upload speed to this. See \fICURLOPT_MAX_SEND_SPEED_LARGE(3)\fP
-.IP CURLOPT_MAX_RECV_SPEED_LARGE
-Cap the download speed to this. See \fICURLOPT_MAX_RECV_SPEED_LARGE(3)\fP
-.IP CURLOPT_MAXCONNECTS
-Maximum number of connections in the connection pool. See \fICURLOPT_MAXCONNECTS(3)\fP
-.IP CURLOPT_FRESH_CONNECT
-Use a new connection. \fICURLOPT_FRESH_CONNECT(3)\fP
-.IP CURLOPT_FORBID_REUSE
-Prevent subsequent connections from reusing this. See \fICURLOPT_FORBID_REUSE(3)\fP
-.IP CURLOPT_MAXAGE_CONN
-Limit the age (idle time) of connections for reuse. See \fICURLOPT_MAXAGE_CONN(3)\fP
-.IP CURLOPT_MAXLIFETIME_CONN
-Limit the age (since creation) of connections for reuse. See \fICURLOPT_MAXLIFETIME_CONN(3)\fP
-.IP CURLOPT_CONNECTTIMEOUT
-Timeout for the connection phase. See \fICURLOPT_CONNECTTIMEOUT(3)\fP
-.IP CURLOPT_CONNECTTIMEOUT_MS
-Millisecond timeout for the connection phase. See \fICURLOPT_CONNECTTIMEOUT_MS(3)\fP
-.IP CURLOPT_IPRESOLVE
-IP version to use. See \fICURLOPT_IPRESOLVE(3)\fP
-.IP CURLOPT_CONNECT_ONLY
-Only connect, nothing else. See \fICURLOPT_CONNECT_ONLY(3)\fP
-.IP CURLOPT_USE_SSL
-Use TLS/SSL. See \fICURLOPT_USE_SSL(3)\fP
-.IP CURLOPT_RESOLVE
-Provide fixed/fake name resolves. See \fICURLOPT_RESOLVE(3)\fP
-.IP CURLOPT_DNS_INTERFACE
-Bind name resolves to this interface. See \fICURLOPT_DNS_INTERFACE(3)\fP
-.IP CURLOPT_DNS_LOCAL_IP4
-Bind name resolves to this IP4 address. See \fICURLOPT_DNS_LOCAL_IP4(3)\fP
-.IP CURLOPT_DNS_LOCAL_IP6
-Bind name resolves to this IP6 address. See \fICURLOPT_DNS_LOCAL_IP6(3)\fP
-.IP CURLOPT_DNS_SERVERS
-Preferred DNS servers. See \fICURLOPT_DNS_SERVERS(3)\fP
-.IP CURLOPT_DNS_SHUFFLE_ADDRESSES
-Shuffle addresses before use. See \fICURLOPT_DNS_SHUFFLE_ADDRESSES(3)\fP
-.IP CURLOPT_ACCEPTTIMEOUT_MS
-Timeout for waiting for the server's connect back to be accepted. See \fICURLOPT_ACCEPTTIMEOUT_MS(3)\fP
-.IP CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS
-Timeout for happy eyeballs. See \fICURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS(3)\fP
-.IP CURLOPT_UPKEEP_INTERVAL_MS
-Sets the interval at which connection upkeep are performed. See
-\fICURLOPT_UPKEEP_INTERVAL_MS(3)\fP
-.SH SSL and SECURITY OPTIONS
-.IP CURLOPT_SSLCERT
-Client cert. See \fICURLOPT_SSLCERT(3)\fP
-.IP CURLOPT_SSLCERT_BLOB
-Client cert memory buffer. See \fICURLOPT_SSLCERT_BLOB(3)\fP
-.IP CURLOPT_PROXY_SSLCERT
-Proxy client cert. See \fICURLOPT_PROXY_SSLCERT(3)\fP
-.IP CURLOPT_PROXY_SSLCERT_BLOB
-Proxy client cert memory buffer. See \fICURLOPT_PROXY_SSLCERT_BLOB(3)\fP
-.IP CURLOPT_SSLCERTTYPE
-Client cert type. See \fICURLOPT_SSLCERTTYPE(3)\fP
-.IP CURLOPT_PROXY_SSLCERTTYPE
-Proxy client cert type. See \fICURLOPT_PROXY_SSLCERTTYPE(3)\fP
-.IP CURLOPT_SSLKEY
-Client key. See \fICURLOPT_SSLKEY(3)\fP
-.IP CURLOPT_SSLKEY_BLOB
-Client key memory buffer. See \fICURLOPT_SSLKEY_BLOB(3)\fP
-.IP CURLOPT_PROXY_SSLKEY
-Proxy client key. See \fICURLOPT_PROXY_SSLKEY(3)\fP
-.IP CURLOPT_PROXY_SSLKEY_BLOB
-Proxy client key. See \fICURLOPT_PROXY_SSLKEY_BLOB(3)\fP
-.IP CURLOPT_SSLKEYTYPE
-Client key type. See \fICURLOPT_SSLKEYTYPE(3)\fP
-.IP CURLOPT_PROXY_SSLKEYTYPE
-Proxy client key type. See \fICURLOPT_PROXY_SSLKEYTYPE(3)\fP
-.IP CURLOPT_KEYPASSWD
-Client key password. See \fICURLOPT_KEYPASSWD(3)\fP
-.IP CURLOPT_PROXY_KEYPASSWD
-Proxy client key password. See \fICURLOPT_PROXY_KEYPASSWD(3)\fP
-.IP CURLOPT_SSL_EC_CURVES
-Set key exchange curves. See \fICURLOPT_SSL_EC_CURVES(3)\fP
-.IP CURLOPT_SSL_ENABLE_ALPN
-Enable use of ALPN. See \fICURLOPT_SSL_ENABLE_ALPN(3)\fP
-.IP CURLOPT_SSL_ENABLE_NPN
-\fBOBSOLETE\fP Enable use of NPN. See \fICURLOPT_SSL_ENABLE_NPN(3)\fP
-.IP CURLOPT_SSLENGINE
-Use identifier with SSL engine. See \fICURLOPT_SSLENGINE(3)\fP
-.IP CURLOPT_SSLENGINE_DEFAULT
-Default SSL engine. See \fICURLOPT_SSLENGINE_DEFAULT(3)\fP
-.IP CURLOPT_SSL_FALSESTART
-Enable TLS False Start. See \fICURLOPT_SSL_FALSESTART(3)\fP
-.IP CURLOPT_SSLVERSION
-SSL version to use. See \fICURLOPT_SSLVERSION(3)\fP
-.IP CURLOPT_PROXY_SSLVERSION
-Proxy SSL version to use. See \fICURLOPT_PROXY_SSLVERSION(3)\fP
-.IP CURLOPT_SSL_VERIFYHOST
-Verify the host name in the SSL certificate. See \fICURLOPT_SSL_VERIFYHOST(3)\fP
-.IP CURLOPT_DOH_SSL_VERIFYHOST
-Verify the host name in the DoH (DNS-over-HTTPS) SSL certificate. See
-\fICURLOPT_DOH_SSL_VERIFYHOST(3)\fP
-.IP CURLOPT_PROXY_SSL_VERIFYHOST
-Verify the host name in the proxy SSL certificate. See \fICURLOPT_PROXY_SSL_VERIFYHOST(3)\fP
-.IP CURLOPT_SSL_VERIFYPEER
-Verify the SSL certificate. See \fICURLOPT_SSL_VERIFYPEER(3)\fP
-.IP CURLOPT_DOH_SSL_VERIFYPEER
-Verify the DoH (DNS-over-HTTPS) SSL certificate. See
-\fICURLOPT_DOH_SSL_VERIFYPEER(3)\fP
-.IP CURLOPT_PROXY_SSL_VERIFYPEER
-Verify the proxy SSL certificate. See \fICURLOPT_PROXY_SSL_VERIFYPEER(3)\fP
-.IP CURLOPT_SSL_VERIFYSTATUS
-Verify the SSL certificate's status. See \fICURLOPT_SSL_VERIFYSTATUS(3)\fP
-.IP CURLOPT_DOH_SSL_VERIFYSTATUS
-Verify the DoH (DNS-over-HTTPS) SSL certificate's status. See
-\fICURLOPT_DOH_SSL_VERIFYSTATUS(3)\fP
-.IP CURLOPT_CAINFO
-CA cert bundle. See \fICURLOPT_CAINFO(3)\fP
-.IP CURLOPT_CAINFO_BLOB
-CA cert bundle memory buffer. See \fICURLOPT_CAINFO_BLOB(3)\fP
-.IP CURLOPT_PROXY_CAINFO
-Proxy CA cert bundle. See \fICURLOPT_PROXY_CAINFO(3)\fP
-.IP CURLOPT_PROXY_CAINFO_BLOB
-Proxy CA cert bundle memory buffer. See \fICURLOPT_PROXY_CAINFO_BLOB(3)\fP
-.IP CURLOPT_ISSUERCERT
-Issuer certificate. See \fICURLOPT_ISSUERCERT(3)\fP
-.IP CURLOPT_ISSUERCERT_BLOB
-Issuer certificate memory buffer. See \fICURLOPT_ISSUERCERT_BLOB(3)\fP
-.IP CURLOPT_PROXY_ISSUERCERT
-Proxy issuer certificate. See \fICURLOPT_PROXY_ISSUERCERT(3)\fP
-.IP CURLOPT_PROXY_ISSUERCERT_BLOB
-Proxy issuer certificate memory buffer. See \fICURLOPT_PROXY_ISSUERCERT_BLOB(3)\fP
-.IP CURLOPT_CAPATH
-Path to CA cert bundle. See \fICURLOPT_CAPATH(3)\fP
-.IP CURLOPT_PROXY_CAPATH
-Path to proxy CA cert bundle. See \fICURLOPT_PROXY_CAPATH(3)\fP
-.IP CURLOPT_CRLFILE
-Certificate Revocation List. See \fICURLOPT_CRLFILE(3)\fP
-.IP CURLOPT_PROXY_CRLFILE
-Proxy Certificate Revocation List. See \fICURLOPT_PROXY_CRLFILE(3)\fP
-.IP CURLOPT_CA_CACHE_TIMEOUT
-Timeout for CA cache. See \fICURLOPT_CA_CACHE_TIMEOUT(3)\fP
-.IP CURLOPT_CERTINFO
-Extract certificate info. See \fICURLOPT_CERTINFO(3)\fP
-.IP CURLOPT_PINNEDPUBLICKEY
-Set pinned SSL public key . See \fICURLOPT_PINNEDPUBLICKEY(3)\fP
-.IP CURLOPT_PROXY_PINNEDPUBLICKEY
-Set the proxy's pinned SSL public key. See
-\fICURLOPT_PROXY_PINNEDPUBLICKEY(3)\fP
-.IP CURLOPT_RANDOM_FILE
-\fBOBSOLETE\fP Provide source for entropy random data.
-See \fICURLOPT_RANDOM_FILE(3)\fP
-.IP CURLOPT_EGDSOCKET
-\fBOBSOLETE\fP Identify EGD socket for entropy. See \fICURLOPT_EGDSOCKET(3)\fP
-.IP CURLOPT_SSL_CIPHER_LIST
-Ciphers to use. See \fICURLOPT_SSL_CIPHER_LIST(3)\fP
-.IP CURLOPT_PROXY_SSL_CIPHER_LIST
-Proxy ciphers to use. See \fICURLOPT_PROXY_SSL_CIPHER_LIST(3)\fP
-.IP CURLOPT_TLS13_CIPHERS
-TLS 1.3 cipher suites to use. See \fICURLOPT_TLS13_CIPHERS(3)\fP
-.IP CURLOPT_PROXY_TLS13_CIPHERS
-Proxy TLS 1.3 cipher suites to use. See \fICURLOPT_PROXY_TLS13_CIPHERS(3)\fP
-.IP CURLOPT_SSL_SESSIONID_CACHE
-Disable SSL session-id cache. See \fICURLOPT_SSL_SESSIONID_CACHE(3)\fP
-.IP CURLOPT_SSL_OPTIONS
-Control SSL behavior. See \fICURLOPT_SSL_OPTIONS(3)\fP
-.IP CURLOPT_PROXY_SSL_OPTIONS
-Control proxy SSL behavior. See \fICURLOPT_PROXY_SSL_OPTIONS(3)\fP
-.IP CURLOPT_KRBLEVEL
-Kerberos security level. See \fICURLOPT_KRBLEVEL(3)\fP
-.IP CURLOPT_GSSAPI_DELEGATION
-Disable GSS-API delegation. See \fICURLOPT_GSSAPI_DELEGATION(3)\fP
-.SH SSH OPTIONS
-.IP CURLOPT_SSH_AUTH_TYPES
-SSH authentication types. See \fICURLOPT_SSH_AUTH_TYPES(3)\fP
-.IP CURLOPT_SSH_COMPRESSION
-Enable SSH compression. See \fICURLOPT_SSH_COMPRESSION(3)\fP
-.IP CURLOPT_SSH_HOST_PUBLIC_KEY_MD5
-MD5 of host's public key. See \fICURLOPT_SSH_HOST_PUBLIC_KEY_MD5(3)\fP
-.IP CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256
-SHA256 of host's public key. See \fICURLOPT_SSH_HOST_PUBLIC_KEY_SHA256(3)\fP
-.IP CURLOPT_SSH_PUBLIC_KEYFILE
-File name of public key. See \fICURLOPT_SSH_PUBLIC_KEYFILE(3)\fP
-.IP CURLOPT_SSH_PRIVATE_KEYFILE
-File name of private key. See \fICURLOPT_SSH_PRIVATE_KEYFILE(3)\fP
-.IP CURLOPT_SSH_KNOWNHOSTS
-File name with known hosts. See \fICURLOPT_SSH_KNOWNHOSTS(3)\fP
-.IP CURLOPT_SSH_KEYFUNCTION
-Callback for known hosts handling. See \fICURLOPT_SSH_KEYFUNCTION(3)\fP
-.IP CURLOPT_SSH_KEYDATA
-Custom pointer to pass to ssh key callback. See \fICURLOPT_SSH_KEYDATA(3)\fP
-.IP CURLOPT_SSH_HOSTKEYFUNCTION
-Callback for checking host key handling. See \fICURLOPT_SSH_HOSTKEYFUNCTION(3)\fP
-.IP CURLOPT_SSH_HOSTKEYDATA
-Custom pointer to pass to ssh host key callback. See \fICURLOPT_SSH_HOSTKEYDATA(3)\fP
-.SH WEBSOCKET
-.IP CURLOPT_WS_OPTIONS
-Set WebSocket options. See \fICURLOPT_WS_OPTIONS(3)\fP
-.SH OTHER OPTIONS
-.IP CURLOPT_PRIVATE
-Private pointer to store. See \fICURLOPT_PRIVATE(3)\fP
-.IP CURLOPT_SHARE
-Share object to use. See \fICURLOPT_SHARE(3)\fP
-.IP CURLOPT_NEW_FILE_PERMS
-Mode for creating new remote files. See \fICURLOPT_NEW_FILE_PERMS(3)\fP
-.IP CURLOPT_NEW_DIRECTORY_PERMS
-Mode for creating new remote directories. See \fICURLOPT_NEW_DIRECTORY_PERMS(3)\fP
-.IP CURLOPT_QUICK_EXIT
-To be set by toplevel tools like "curl" to skip lengthy cleanups when they are about to call exit() anyway. See \fICURLOPT_QUICK_EXIT(3)\fP
-.SH TELNET OPTIONS
-.IP CURLOPT_TELNETOPTIONS
-TELNET options. See \fICURLOPT_TELNETOPTIONS(3)\fP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  res = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-\fICURLE_OK\fP (zero) means that the option was set properly, non-zero means an
-error occurred as \fI<curl/curl.h>\fP defines. See the \fIlibcurl-errors(3)\fP
-man page for the full list with descriptions.
-
-Strings passed on to libcurl must be shorter than 8000000 bytes, otherwise
-\fIcurl_easy_setopt(3)\fP returns \fBCURLE_BAD_FUNCTION_ARGUMENT\fP (added in
-7.65.0).
-
-\fBCURLE_BAD_FUNCTION_ARGUMENT\fP is returned when the argument to an option
-is invalid, like perhaps out of range.
-
-If you try to set an option that libcurl does not know about, perhaps because
-the library is too old to support it or the option was removed in a recent
-version, this function returns \fICURLE_UNKNOWN_OPTION\fP. If support for the
-option was disabled at compile-time, it returns \fICURLE_NOT_BUILT_IN\fP.
-.SH "SEE ALSO"
-.BR curl_easy_init "(3), " curl_easy_cleanup "(3), " curl_easy_reset "(3), "
-.BR curl_easy_getinfo "(3), " curl_multi_setopt "(3), "
-.BR curl_easy_option_next "(3), " curl_easy_option_by_name "(3), "
-.BR curl_easy_option_by_id "(3), "
diff --git a/third-party/curl/docs/libcurl/curl_easy_setopt.md b/third-party/curl/docs/libcurl/curl_easy_setopt.md
new file mode 100644
index 0000000000..5f75596cff
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_setopt.md
@@ -0,0 +1,1391 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_setopt
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_cleanup (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_init (3)
+  - curl_easy_option_by_id (3)
+  - curl_easy_option_by_name (3)
+  - curl_easy_option_next (3)
+  - curl_easy_reset (3)
+  - curl_multi_setopt (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+curl_easy_setopt - set options for a curl easy handle
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLoption option, parameter);
+~~~
+
+# DESCRIPTION
+
+curl_easy_setopt(3) is used to tell libcurl how to behave. By setting the
+appropriate options, the application can change libcurl's behavior. All
+options are set with an *option* followed by a *parameter*. That parameter can
+be a **long**, a **function pointer**, an **object pointer** or a
+**curl_off_t**, depending on what the specific option expects. Read this
+manual carefully as bad input values may cause libcurl to behave badly. You
+can only set one option in each function call. A typical application uses many
+curl_easy_setopt(3) calls in the setup phase.
+
+The *handle* argument is the return code from a curl_easy_init(3) or
+curl_easy_duphandle(3) call.
+
+Options set with this function call are sticky. They remain set for all
+forthcoming transfers performed using this *handle*. The options are not in
+any way reset between transfers, so if you want subsequent transfers with
+different options, you must change them between the transfers. You can
+optionally reset all options back to internal default with curl_easy_reset(3).
+
+Changing options with curl_easy_setopt(3) while a transfer is still in
+progress may cause undefined and undesired behavior.
+
+The order in which the options are set does not matter.
+
+# STRINGS
+
+Strings passed to libcurl as 'char *' arguments, are copied by the library;
+the string storage associated to the pointer argument may be discarded or
+reused after curl_easy_setopt(3) returns. The only exception to this rule is
+really CURLOPT_POSTFIELDS(3), but the alternative that copies the string
+CURLOPT_COPYPOSTFIELDS(3) has some usage characteristics you need to read up
+on.
+
+This function does not accept input strings longer than
+**CURL_MAX_INPUT_LENGTH** (8 MB).
+
+libcurl does little to no verification of the contents of provided strings.
+Passing in "creative octets" like newlines where they are not expected might
+trigger unexpected results.
+
+Before version 7.17.0, strings were not copied. Instead the user was forced
+to keep them available until libcurl no longer needed them.
+
+# OPTIONS
+
+## CURLOPT_ABSTRACT_UNIX_SOCKET
+
+Path to an abstract Unix domain socket. See CURLOPT_ABSTRACT_UNIX_SOCKET(3)
+
+## CURLOPT_ACCEPTTIMEOUT_MS
+
+Timeout for waiting for the server's connect back to be accepted. See
+CURLOPT_ACCEPTTIMEOUT_MS(3)
+
+## CURLOPT_ACCEPT_ENCODING
+
+Accept-Encoding and automatic decompressing data. See
+CURLOPT_ACCEPT_ENCODING(3)
+
+## CURLOPT_ADDRESS_SCOPE
+
+IPv6 scope for local addresses. See CURLOPT_ADDRESS_SCOPE(3)
+
+## CURLOPT_ALTSVC
+
+Specify the Alt-Svc: cache filename. See CURLOPT_ALTSVC(3)
+
+## CURLOPT_ALTSVC_CTRL
+
+Enable and configure Alt-Svc: treatment. See CURLOPT_ALTSVC_CTRL(3)
+
+## CURLOPT_APPEND
+
+Append to remote file. See CURLOPT_APPEND(3)
+
+## CURLOPT_AUTOREFERER
+
+Automatically set Referer: header. See CURLOPT_AUTOREFERER(3)
+
+## CURLOPT_AWS_SIGV4
+
+AWS HTTP V4 Signature. See CURLOPT_AWS_SIGV4(3)
+
+## CURLOPT_BUFFERSIZE
+
+Ask for alternate buffer size. See CURLOPT_BUFFERSIZE(3)
+
+## CURLOPT_CAINFO
+
+CA cert bundle. See CURLOPT_CAINFO(3)
+
+## CURLOPT_CAINFO_BLOB
+
+CA cert bundle memory buffer. See CURLOPT_CAINFO_BLOB(3)
+
+## CURLOPT_CAPATH
+
+Path to CA cert bundle. See CURLOPT_CAPATH(3)
+
+## CURLOPT_CA_CACHE_TIMEOUT
+
+Timeout for CA cache. See CURLOPT_CA_CACHE_TIMEOUT(3)
+
+## CURLOPT_CERTINFO
+
+Extract certificate info. See CURLOPT_CERTINFO(3)
+
+## CURLOPT_CHUNK_BGN_FUNCTION
+
+Callback for wildcard download start of chunk. See
+CURLOPT_CHUNK_BGN_FUNCTION(3)
+
+## CURLOPT_CHUNK_DATA
+
+Data pointer to pass to the chunk callbacks. See CURLOPT_CHUNK_DATA(3)
+
+## CURLOPT_CHUNK_END_FUNCTION
+
+Callback for wildcard download end of chunk. See CURLOPT_CHUNK_END_FUNCTION(3)
+
+## CURLOPT_CLOSESOCKETDATA
+
+Data pointer to pass to the close socket callback. See
+CURLOPT_CLOSESOCKETDATA(3)
+
+## CURLOPT_CLOSESOCKETFUNCTION
+
+Callback for closing socket. See CURLOPT_CLOSESOCKETFUNCTION(3)
+
+## CURLOPT_CONNECTTIMEOUT
+
+Timeout for the connection phase. See CURLOPT_CONNECTTIMEOUT(3)
+
+## CURLOPT_CONNECTTIMEOUT_MS
+
+Millisecond timeout for the connection phase. See CURLOPT_CONNECTTIMEOUT_MS(3)
+
+## CURLOPT_CONNECT_ONLY
+
+Only connect, nothing else. See CURLOPT_CONNECT_ONLY(3)
+
+## CURLOPT_CONNECT_TO
+
+Connect to a specific host and port. See CURLOPT_CONNECT_TO(3)
+
+## CURLOPT_CONV_FROM_NETWORK_FUNCTION
+
+**OBSOLETE** Callback for code base conversion.
+See CURLOPT_CONV_FROM_NETWORK_FUNCTION(3)
+
+## CURLOPT_CONV_FROM_UTF8_FUNCTION
+
+**OBSOLETE** Callback for code base conversion.
+See CURLOPT_CONV_FROM_UTF8_FUNCTION(3)
+
+## CURLOPT_CONV_TO_NETWORK_FUNCTION
+
+**OBSOLETE** Callback for code base conversion.
+See CURLOPT_CONV_TO_NETWORK_FUNCTION(3)
+
+## CURLOPT_COOKIE
+
+Cookie(s) to send. See CURLOPT_COOKIE(3)
+
+## CURLOPT_COOKIEFILE
+
+File to read cookies from. See CURLOPT_COOKIEFILE(3)
+
+## CURLOPT_COOKIEJAR
+
+File to write cookies to. See CURLOPT_COOKIEJAR(3)
+
+## CURLOPT_COOKIELIST
+
+Add or control cookies. See CURLOPT_COOKIELIST(3)
+
+## CURLOPT_COOKIESESSION
+
+Start a new cookie session. See CURLOPT_COOKIESESSION(3)
+
+## CURLOPT_COPYPOSTFIELDS
+
+Send a POST with this data - and copy it. See CURLOPT_COPYPOSTFIELDS(3)
+
+## CURLOPT_CRLF
+
+Convert newlines. See CURLOPT_CRLF(3)
+
+## CURLOPT_CRLFILE
+
+Certificate Revocation List. See CURLOPT_CRLFILE(3)
+
+## CURLOPT_CURLU
+
+Set URL to work on with a URL handle. See CURLOPT_CURLU(3)
+
+## CURLOPT_CUSTOMREQUEST
+
+Custom request/method. See CURLOPT_CUSTOMREQUEST(3)
+
+## CURLOPT_DEBUGDATA
+
+Data pointer to pass to the debug callback. See CURLOPT_DEBUGDATA(3)
+
+## CURLOPT_DEBUGFUNCTION
+
+Callback for debug information. See CURLOPT_DEBUGFUNCTION(3)
+
+## CURLOPT_DEFAULT_PROTOCOL
+
+Default protocol. See CURLOPT_DEFAULT_PROTOCOL(3)
+
+## CURLOPT_DIRLISTONLY
+
+List only. See CURLOPT_DIRLISTONLY(3)
+
+## CURLOPT_DISALLOW_USERNAME_IN_URL
+
+Do not allow username in URL. See CURLOPT_DISALLOW_USERNAME_IN_URL(3)
+
+## CURLOPT_DNS_CACHE_TIMEOUT
+
+Timeout for DNS cache. See CURLOPT_DNS_CACHE_TIMEOUT(3)
+
+## CURLOPT_DNS_INTERFACE
+
+Bind name resolves to this interface. See CURLOPT_DNS_INTERFACE(3)
+
+## CURLOPT_DNS_LOCAL_IP4
+
+Bind name resolves to this IP4 address. See CURLOPT_DNS_LOCAL_IP4(3)
+
+## CURLOPT_DNS_LOCAL_IP6
+
+Bind name resolves to this IP6 address. See CURLOPT_DNS_LOCAL_IP6(3)
+
+## CURLOPT_DNS_SERVERS
+
+Preferred DNS servers. See CURLOPT_DNS_SERVERS(3)
+
+## CURLOPT_DNS_SHUFFLE_ADDRESSES
+
+Shuffle addresses before use. See CURLOPT_DNS_SHUFFLE_ADDRESSES(3)
+
+## CURLOPT_DNS_USE_GLOBAL_CACHE
+
+**OBSOLETE** Enable global DNS cache. See CURLOPT_DNS_USE_GLOBAL_CACHE(3)
+
+## CURLOPT_DOH_SSL_VERIFYHOST
+
+Verify the hostname in the DoH (DNS-over-HTTPS) SSL certificate. See
+CURLOPT_DOH_SSL_VERIFYHOST(3)
+
+## CURLOPT_DOH_SSL_VERIFYPEER
+
+Verify the DoH (DNS-over-HTTPS) SSL certificate. See
+CURLOPT_DOH_SSL_VERIFYPEER(3)
+
+## CURLOPT_DOH_SSL_VERIFYSTATUS
+
+Verify the DoH (DNS-over-HTTPS) SSL certificate's status. See
+CURLOPT_DOH_SSL_VERIFYSTATUS(3)
+
+## CURLOPT_DOH_URL
+
+Use this DoH server for name resolves. See CURLOPT_DOH_URL(3)
+
+## CURLOPT_ECH
+
+Set the configuration for ECH. See CURLOPT_ECH(3)
+
+## CURLOPT_EGDSOCKET
+
+**OBSOLETE** Identify EGD socket for entropy. See CURLOPT_EGDSOCKET(3)
+
+## CURLOPT_ERRORBUFFER
+
+Error message buffer. See CURLOPT_ERRORBUFFER(3)
+
+## CURLOPT_EXPECT_100_TIMEOUT_MS
+
+100-continue timeout. See CURLOPT_EXPECT_100_TIMEOUT_MS(3)
+
+## CURLOPT_FAILONERROR
+
+Fail on HTTP 4xx errors. CURLOPT_FAILONERROR(3)
+
+## CURLOPT_FILETIME
+
+Request file modification date and time. See CURLOPT_FILETIME(3)
+
+## CURLOPT_FNMATCH_DATA
+
+Data pointer to pass to the wildcard matching callback. See
+CURLOPT_FNMATCH_DATA(3)
+
+## CURLOPT_FNMATCH_FUNCTION
+
+Callback for wildcard matching. See CURLOPT_FNMATCH_FUNCTION(3)
+
+## CURLOPT_FOLLOWLOCATION
+
+Follow HTTP redirects. See CURLOPT_FOLLOWLOCATION(3)
+
+## CURLOPT_FORBID_REUSE
+
+Prevent subsequent connections from reusing this. See CURLOPT_FORBID_REUSE(3)
+
+## CURLOPT_FRESH_CONNECT
+
+Use a new connection. CURLOPT_FRESH_CONNECT(3)
+
+## CURLOPT_FTPPORT
+
+Use active FTP. See CURLOPT_FTPPORT(3)
+
+## CURLOPT_FTPSSLAUTH
+
+Control how to do TLS. See CURLOPT_FTPSSLAUTH(3)
+
+## CURLOPT_FTP_ACCOUNT
+
+Send ACCT command. See CURLOPT_FTP_ACCOUNT(3)
+
+## CURLOPT_FTP_ALTERNATIVE_TO_USER
+
+Alternative to USER. See CURLOPT_FTP_ALTERNATIVE_TO_USER(3)
+
+## CURLOPT_FTP_CREATE_MISSING_DIRS
+
+Create missing directories on the remote server. See
+CURLOPT_FTP_CREATE_MISSING_DIRS(3)
+
+## CURLOPT_FTP_FILEMETHOD
+
+Specify how to reach files. See CURLOPT_FTP_FILEMETHOD(3)
+
+## CURLOPT_FTP_SKIP_PASV_IP
+
+Ignore the IP address in the PASV response. See CURLOPT_FTP_SKIP_PASV_IP(3)
+
+## CURLOPT_FTP_SSL_CCC
+
+Back to non-TLS again after authentication. See CURLOPT_FTP_SSL_CCC(3)
+
+## CURLOPT_FTP_USE_EPRT
+
+Use EPRT. See CURLOPT_FTP_USE_EPRT(3)
+
+## CURLOPT_FTP_USE_EPSV
+
+Use EPSV. See CURLOPT_FTP_USE_EPSV(3)
+
+## CURLOPT_FTP_USE_PRET
+
+Use PRET. See CURLOPT_FTP_USE_PRET(3)
+
+## CURLOPT_GSSAPI_DELEGATION
+
+Disable GSS-API delegation. See CURLOPT_GSSAPI_DELEGATION(3)
+
+## CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS
+
+Timeout for happy eyeballs. See CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS(3)
+
+## CURLOPT_HAPROXYPROTOCOL
+
+Send an HAProxy PROXY protocol v1 header. See CURLOPT_HAPROXYPROTOCOL(3)
+
+## CURLOPT_HAPROXY_CLIENT_IP
+
+Spoof the client IP in an HAProxy PROXY protocol v1 header. See
+CURLOPT_HAPROXY_CLIENT_IP(3)
+
+## CURLOPT_HEADER
+
+Include the header in the body output. See CURLOPT_HEADER(3)
+
+## CURLOPT_HEADERDATA
+
+Data pointer to pass to the header callback. See CURLOPT_HEADERDATA(3)
+
+## CURLOPT_HEADERFUNCTION
+
+Callback for writing received headers. See CURLOPT_HEADERFUNCTION(3)
+
+## CURLOPT_HEADEROPT
+
+Control custom headers. See CURLOPT_HEADEROPT(3)
+
+## CURLOPT_HSTS
+
+Set HSTS cache file. See CURLOPT_HSTS(3)
+
+## CURLOPT_HSTSREADDATA
+
+Pass pointer to the HSTS read callback. See CURLOPT_HSTSREADDATA(3)
+
+## CURLOPT_HSTSREADFUNCTION
+
+Set HSTS read callback. See CURLOPT_HSTSREADFUNCTION(3)
+
+## CURLOPT_HSTSWRITEDATA
+
+Pass pointer to the HSTS write callback. See CURLOPT_HSTSWRITEDATA(3)
+
+## CURLOPT_HSTSWRITEFUNCTION
+
+Set HSTS write callback. See CURLOPT_HSTSWRITEFUNCTION(3)
+
+## CURLOPT_HSTS_CTRL
+
+Enable HSTS. See CURLOPT_HSTS_CTRL(3)
+
+## CURLOPT_HTTP09_ALLOWED
+
+Allow HTTP/0.9 responses. CURLOPT_HTTP09_ALLOWED(3)
+
+## CURLOPT_HTTP200ALIASES
+
+Alternative versions of 200 OK. See CURLOPT_HTTP200ALIASES(3)
+
+## CURLOPT_HTTPAUTH
+
+HTTP server authentication methods. See CURLOPT_HTTPAUTH(3)
+
+## CURLOPT_HTTPGET
+
+Do an HTTP GET request. See CURLOPT_HTTPGET(3)
+
+## CURLOPT_HTTPHEADER
+
+Custom HTTP headers. See CURLOPT_HTTPHEADER(3)
+
+## CURLOPT_HTTPPOST
+
+**Deprecated option** Multipart formpost HTTP POST.
+See CURLOPT_HTTPPOST(3)
+
+## CURLOPT_HTTPPROXYTUNNEL
+
+Tunnel through the HTTP proxy. CURLOPT_HTTPPROXYTUNNEL(3)
+
+## CURLOPT_HTTP_CONTENT_DECODING
+
+Disable Content decoding. See CURLOPT_HTTP_CONTENT_DECODING(3)
+
+## CURLOPT_HTTP_TRANSFER_DECODING
+
+Disable Transfer decoding. See CURLOPT_HTTP_TRANSFER_DECODING(3)
+
+## CURLOPT_HTTP_VERSION
+
+HTTP version to use. CURLOPT_HTTP_VERSION(3)
+
+## CURLOPT_IGNORE_CONTENT_LENGTH
+
+Ignore Content-Length. See CURLOPT_IGNORE_CONTENT_LENGTH(3)
+
+## CURLOPT_INFILESIZE
+
+Size of file to send. CURLOPT_INFILESIZE(3)
+
+## CURLOPT_INFILESIZE_LARGE
+
+Size of file to send. CURLOPT_INFILESIZE_LARGE(3)
+
+## CURLOPT_INTERFACE
+
+Bind connection locally to this. See CURLOPT_INTERFACE(3)
+
+## CURLOPT_INTERLEAVEDATA
+
+Data pointer to pass to the RTSP interleave callback. See
+CURLOPT_INTERLEAVEDATA(3)
+
+## CURLOPT_INTERLEAVEFUNCTION
+
+Callback for RTSP interleaved data. See CURLOPT_INTERLEAVEFUNCTION(3)
+
+## CURLOPT_IOCTLDATA
+
+**Deprecated option** Data pointer to pass to the I/O callback.
+See CURLOPT_IOCTLDATA(3)
+
+## CURLOPT_IOCTLFUNCTION
+
+**Deprecated option** Callback for I/O operations.
+See CURLOPT_IOCTLFUNCTION(3)
+
+## CURLOPT_IPRESOLVE
+
+IP version to use. See CURLOPT_IPRESOLVE(3)
+
+## CURLOPT_ISSUERCERT
+
+Issuer certificate. See CURLOPT_ISSUERCERT(3)
+
+## CURLOPT_ISSUERCERT_BLOB
+
+Issuer certificate memory buffer. See CURLOPT_ISSUERCERT_BLOB(3)
+
+## CURLOPT_KEEP_SENDING_ON_ERROR
+
+Keep sending on HTTP \>= 300 errors. CURLOPT_KEEP_SENDING_ON_ERROR(3)
+
+## CURLOPT_KEYPASSWD
+
+Client key password. See CURLOPT_KEYPASSWD(3)
+
+## CURLOPT_KRBLEVEL
+
+**OBSOLETE**. Kerberos security level. See CURLOPT_KRBLEVEL(3)
+
+## CURLOPT_LOCALPORT
+
+Bind connection locally to this port. See CURLOPT_LOCALPORT(3)
+
+## CURLOPT_LOCALPORTRANGE
+
+Bind connection locally to port range. See CURLOPT_LOCALPORTRANGE(3)
+
+## CURLOPT_LOGIN_OPTIONS
+
+Login options. See CURLOPT_LOGIN_OPTIONS(3)
+
+## CURLOPT_LOW_SPEED_LIMIT
+
+Low speed limit to abort transfer. See CURLOPT_LOW_SPEED_LIMIT(3)
+
+## CURLOPT_LOW_SPEED_TIME
+
+Time to be below the speed to trigger low speed abort. See
+CURLOPT_LOW_SPEED_TIME(3)
+
+## CURLOPT_MAIL_AUTH
+
+Authentication address. See CURLOPT_MAIL_AUTH(3)
+
+## CURLOPT_MAIL_FROM
+
+Address of the sender. See CURLOPT_MAIL_FROM(3)
+
+## CURLOPT_MAIL_RCPT
+
+Address of the recipients. See CURLOPT_MAIL_RCPT(3)
+
+## CURLOPT_MAIL_RCPT_ALLOWFAILS
+
+Allow RCPT TO command to fail for some recipients. See
+CURLOPT_MAIL_RCPT_ALLOWFAILS(3)
+
+## CURLOPT_MAXAGE_CONN
+
+Limit the age (idle time) of connections for reuse. See CURLOPT_MAXAGE_CONN(3)
+
+## CURLOPT_MAXCONNECTS
+
+Maximum number of connections in the connection pool. See
+CURLOPT_MAXCONNECTS(3)
+
+## CURLOPT_MAXFILESIZE
+
+Maximum file size to get. See CURLOPT_MAXFILESIZE(3)
+
+## CURLOPT_MAXFILESIZE_LARGE
+
+Maximum file size to get. See CURLOPT_MAXFILESIZE_LARGE(3)
+
+## CURLOPT_MAXLIFETIME_CONN
+
+Limit the age (since creation) of connections for reuse. See
+CURLOPT_MAXLIFETIME_CONN(3)
+
+## CURLOPT_MAXREDIRS
+
+Maximum number of redirects to follow. See CURLOPT_MAXREDIRS(3)
+
+## CURLOPT_MAX_RECV_SPEED_LARGE
+
+Cap the download speed to this. See CURLOPT_MAX_RECV_SPEED_LARGE(3)
+
+## CURLOPT_MAX_SEND_SPEED_LARGE
+
+Cap the upload speed to this. See CURLOPT_MAX_SEND_SPEED_LARGE(3)
+
+## CURLOPT_MIMEPOST
+
+Post/send MIME data. See CURLOPT_MIMEPOST(3)
+
+## CURLOPT_MIME_OPTIONS
+
+Set MIME option flags. See CURLOPT_MIME_OPTIONS(3)
+
+## CURLOPT_NETRC
+
+Enable .netrc parsing. See CURLOPT_NETRC(3)
+
+## CURLOPT_NETRC_FILE
+
+.netrc filename. See CURLOPT_NETRC_FILE(3)
+
+## CURLOPT_NEW_DIRECTORY_PERMS
+
+Mode for creating new remote directories. See CURLOPT_NEW_DIRECTORY_PERMS(3)
+
+## CURLOPT_NEW_FILE_PERMS
+
+Mode for creating new remote files. See CURLOPT_NEW_FILE_PERMS(3)
+
+## CURLOPT_NOBODY
+
+Do not get the body contents. See CURLOPT_NOBODY(3)
+
+## CURLOPT_NOPROGRESS
+
+Shut off the progress meter. See CURLOPT_NOPROGRESS(3)
+
+## CURLOPT_NOPROXY
+
+Filter out hosts from proxy use. CURLOPT_NOPROXY(3)
+
+## CURLOPT_NOSIGNAL
+
+Do not install signal handlers. See CURLOPT_NOSIGNAL(3)
+
+## CURLOPT_OPENSOCKETDATA
+
+Data pointer to pass to the open socket callback. See CURLOPT_OPENSOCKETDATA(3)
+
+## CURLOPT_OPENSOCKETFUNCTION
+
+Callback for socket creation. See CURLOPT_OPENSOCKETFUNCTION(3)
+
+## CURLOPT_PASSWORD
+
+Password. See CURLOPT_PASSWORD(3)
+
+## CURLOPT_PATH_AS_IS
+
+Disable squashing /../ and /./ sequences in the path. See CURLOPT_PATH_AS_IS(3)
+
+## CURLOPT_PINNEDPUBLICKEY
+
+Set pinned SSL public key . See CURLOPT_PINNEDPUBLICKEY(3)
+
+## CURLOPT_PIPEWAIT
+
+Wait on connection to pipeline on it. See CURLOPT_PIPEWAIT(3)
+
+## CURLOPT_PORT
+
+Port number to connect to. See CURLOPT_PORT(3)
+
+## CURLOPT_POST
+
+Make an HTTP POST. See CURLOPT_POST(3)
+
+## CURLOPT_POSTFIELDS
+
+Send a POST with this data - does not copy it. See CURLOPT_POSTFIELDS(3)
+
+## CURLOPT_POSTFIELDSIZE
+
+The POST data is this big. See CURLOPT_POSTFIELDSIZE(3)
+
+## CURLOPT_POSTFIELDSIZE_LARGE
+
+The POST data is this big. See CURLOPT_POSTFIELDSIZE_LARGE(3)
+
+## CURLOPT_POSTQUOTE
+
+Commands to run after transfer. See CURLOPT_POSTQUOTE(3)
+
+## CURLOPT_POSTREDIR
+
+How to act on redirects after POST. See CURLOPT_POSTREDIR(3)
+
+## CURLOPT_PREQUOTE
+
+Commands to run immediately before transfer. See CURLOPT_PREQUOTE(3)
+
+## CURLOPT_PREREQDATA
+
+Data pointer to pass to the CURLOPT_PREREQFUNCTION callback. See
+CURLOPT_PREREQDATA(3)
+
+## CURLOPT_PREREQFUNCTION
+
+Callback to be called after a connection is established but before a request
+is made on that connection. See CURLOPT_PREREQFUNCTION(3)
+
+## CURLOPT_PRE_PROXY
+
+Socks proxy to use. See CURLOPT_PRE_PROXY(3)
+
+## CURLOPT_PRIVATE
+
+Private pointer to store. See CURLOPT_PRIVATE(3)
+
+## CURLOPT_PROGRESSDATA
+
+Data pointer to pass to the progress meter callback. See
+CURLOPT_PROGRESSDATA(3)
+
+## CURLOPT_PROGRESSFUNCTION
+
+**OBSOLETE** callback for progress meter. See CURLOPT_PROGRESSFUNCTION(3)
+
+## CURLOPT_PROTOCOLS
+
+**Deprecated option** Allowed protocols. See CURLOPT_PROTOCOLS(3)
+
+## CURLOPT_PROTOCOLS_STR
+
+Allowed protocols. See CURLOPT_PROTOCOLS_STR(3)
+
+## CURLOPT_PROXY
+
+Proxy to use. See CURLOPT_PROXY(3)
+
+## CURLOPT_PROXYAUTH
+
+HTTP proxy authentication methods. See CURLOPT_PROXYAUTH(3)
+
+## CURLOPT_PROXYHEADER
+
+Custom HTTP headers sent to proxy. See CURLOPT_PROXYHEADER(3)
+
+## CURLOPT_PROXYPASSWORD
+
+Proxy password. See CURLOPT_PROXYPASSWORD(3)
+
+## CURLOPT_PROXYPORT
+
+Proxy port to use. See CURLOPT_PROXYPORT(3)
+
+## CURLOPT_PROXYTYPE
+
+Proxy type. See CURLOPT_PROXYTYPE(3)
+
+## CURLOPT_PROXYUSERNAME
+Proxy username. See CURLOPT_PROXYUSERNAME(3)
+
+## CURLOPT_PROXYUSERPWD
+
+Proxy username and password. See CURLOPT_PROXYUSERPWD(3)
+
+## CURLOPT_PROXY_CAINFO
+
+Proxy CA cert bundle. See CURLOPT_PROXY_CAINFO(3)
+
+## CURLOPT_PROXY_CAINFO_BLOB
+
+Proxy CA cert bundle memory buffer. See CURLOPT_PROXY_CAINFO_BLOB(3)
+
+## CURLOPT_PROXY_CAPATH
+
+Path to proxy CA cert bundle. See CURLOPT_PROXY_CAPATH(3)
+
+## CURLOPT_PROXY_CRLFILE
+
+Proxy Certificate Revocation List. See CURLOPT_PROXY_CRLFILE(3)
+
+## CURLOPT_PROXY_ISSUERCERT
+
+Proxy issuer certificate. See CURLOPT_PROXY_ISSUERCERT(3)
+
+## CURLOPT_PROXY_ISSUERCERT_BLOB
+
+Proxy issuer certificate memory buffer. See CURLOPT_PROXY_ISSUERCERT_BLOB(3)
+
+## CURLOPT_PROXY_KEYPASSWD
+
+Proxy client key password. See CURLOPT_PROXY_KEYPASSWD(3)
+
+## CURLOPT_PROXY_PINNEDPUBLICKEY
+
+Set the proxy's pinned SSL public key. See
+CURLOPT_PROXY_PINNEDPUBLICKEY(3)
+
+## CURLOPT_PROXY_SERVICE_NAME
+
+Proxy authentication service name. CURLOPT_PROXY_SERVICE_NAME(3)
+
+## CURLOPT_PROXY_SSLCERT
+
+Proxy client cert. See CURLOPT_PROXY_SSLCERT(3)
+
+## CURLOPT_PROXY_SSLCERTTYPE
+
+Proxy client cert type. See CURLOPT_PROXY_SSLCERTTYPE(3)
+
+## CURLOPT_PROXY_SSLCERT_BLOB
+
+Proxy client cert memory buffer. See CURLOPT_PROXY_SSLCERT_BLOB(3)
+
+## CURLOPT_PROXY_SSLKEY
+
+Proxy client key. See CURLOPT_PROXY_SSLKEY(3)
+
+## CURLOPT_PROXY_SSLKEYTYPE
+
+Proxy client key type. See CURLOPT_PROXY_SSLKEYTYPE(3)
+
+## CURLOPT_PROXY_SSLKEY_BLOB
+
+Proxy client key. See CURLOPT_PROXY_SSLKEY_BLOB(3)
+
+## CURLOPT_PROXY_SSLVERSION
+
+Proxy SSL version to use. See CURLOPT_PROXY_SSLVERSION(3)
+
+## CURLOPT_PROXY_SSL_CIPHER_LIST
+
+Proxy ciphers to use. See CURLOPT_PROXY_SSL_CIPHER_LIST(3)
+
+## CURLOPT_PROXY_SSL_OPTIONS
+
+Control proxy SSL behavior. See CURLOPT_PROXY_SSL_OPTIONS(3)
+
+## CURLOPT_PROXY_SSL_VERIFYHOST
+
+Verify the hostname in the proxy SSL certificate. See
+CURLOPT_PROXY_SSL_VERIFYHOST(3)
+
+## CURLOPT_PROXY_SSL_VERIFYPEER
+
+Verify the proxy SSL certificate. See CURLOPT_PROXY_SSL_VERIFYPEER(3)
+
+## CURLOPT_PROXY_TLS13_CIPHERS
+
+Proxy TLS 1.3 cipher suites to use. See CURLOPT_PROXY_TLS13_CIPHERS(3)
+
+## CURLOPT_PROXY_TLSAUTH_PASSWORD
+
+Proxy TLS authentication password. See CURLOPT_PROXY_TLSAUTH_PASSWORD(3)
+
+## CURLOPT_PROXY_TLSAUTH_TYPE
+
+Proxy TLS authentication methods. See CURLOPT_PROXY_TLSAUTH_TYPE(3)
+
+## CURLOPT_PROXY_TLSAUTH_USERNAME
+
+Proxy TLS authentication username. See CURLOPT_PROXY_TLSAUTH_USERNAME(3)
+
+## CURLOPT_PROXY_TRANSFER_MODE
+
+Add transfer mode to URL over proxy. See CURLOPT_PROXY_TRANSFER_MODE(3)
+
+## CURLOPT_PUT
+
+**Deprecated option** Issue an HTTP PUT request. See CURLOPT_PUT(3)
+
+## CURLOPT_QUICK_EXIT
+
+To be set by toplevel tools like "curl" to skip lengthy cleanups when they are
+about to call exit() anyway. See CURLOPT_QUICK_EXIT(3)
+
+## CURLOPT_QUOTE
+
+Commands to run before transfer. See CURLOPT_QUOTE(3)
+
+## CURLOPT_RANDOM_FILE
+
+**OBSOLETE** Provide source for entropy random data.
+See CURLOPT_RANDOM_FILE(3)
+
+## CURLOPT_RANGE
+
+Range requests. See CURLOPT_RANGE(3)
+
+## CURLOPT_READDATA
+
+Data pointer to pass to the read callback. See CURLOPT_READDATA(3)
+
+## CURLOPT_READFUNCTION
+
+Callback for reading data. See CURLOPT_READFUNCTION(3)
+
+## CURLOPT_REDIR_PROTOCOLS
+
+**Deprecated option** Protocols to allow redirects to. See
+CURLOPT_REDIR_PROTOCOLS(3)
+
+## CURLOPT_REDIR_PROTOCOLS_STR
+
+Protocols to allow redirects to. See CURLOPT_REDIR_PROTOCOLS_STR(3)
+
+## CURLOPT_REFERER
+
+Referer: header. See CURLOPT_REFERER(3)
+
+## CURLOPT_REQUEST_TARGET
+
+Set the request target. CURLOPT_REQUEST_TARGET(3)
+
+## CURLOPT_RESOLVE
+
+Provide fixed/fake name resolves. See CURLOPT_RESOLVE(3)
+
+## CURLOPT_RESOLVER_START_DATA
+
+Data pointer to pass to resolver start callback. See
+CURLOPT_RESOLVER_START_DATA(3)
+
+## CURLOPT_RESOLVER_START_FUNCTION
+
+Callback to be called before a new resolve request is started. See
+CURLOPT_RESOLVER_START_FUNCTION(3)
+
+## CURLOPT_RESUME_FROM
+
+Resume a transfer. See CURLOPT_RESUME_FROM(3)
+
+## CURLOPT_RESUME_FROM_LARGE
+
+Resume a transfer. See CURLOPT_RESUME_FROM_LARGE(3)
+
+## CURLOPT_RTSP_CLIENT_CSEQ
+
+Client CSEQ number. See CURLOPT_RTSP_CLIENT_CSEQ(3)
+
+## CURLOPT_RTSP_REQUEST
+
+RTSP request. See CURLOPT_RTSP_REQUEST(3)
+
+## CURLOPT_RTSP_SERVER_CSEQ
+
+CSEQ number for RTSP Server-\>Client request. See CURLOPT_RTSP_SERVER_CSEQ(3)
+
+## CURLOPT_RTSP_SESSION_ID
+
+RTSP session-id. See CURLOPT_RTSP_SESSION_ID(3)
+
+## CURLOPT_RTSP_STREAM_URI
+
+RTSP stream URI. See CURLOPT_RTSP_STREAM_URI(3)
+
+## CURLOPT_RTSP_TRANSPORT
+
+RTSP Transport: header. See CURLOPT_RTSP_TRANSPORT(3)
+
+## CURLOPT_SASL_AUTHZID
+
+SASL authorization identity (identity to act as). See CURLOPT_SASL_AUTHZID(3)
+
+## CURLOPT_SASL_IR
+
+Enable SASL initial response. See CURLOPT_SASL_IR(3)
+
+## CURLOPT_SEEKDATA
+
+Data pointer to pass to the seek callback. See CURLOPT_SEEKDATA(3)
+
+## CURLOPT_SEEKFUNCTION
+
+Callback for seek operations. See CURLOPT_SEEKFUNCTION(3)
+
+## CURLOPT_SERVER_RESPONSE_TIMEOUT
+
+Timeout for server responses. See CURLOPT_SERVER_RESPONSE_TIMEOUT(3)
+
+## CURLOPT_SERVER_RESPONSE_TIMEOUT_MS
+
+Timeout for server responses. See CURLOPT_SERVER_RESPONSE_TIMEOUT_MS(3)
+
+## CURLOPT_SERVICE_NAME
+
+Authentication service name. CURLOPT_SERVICE_NAME(3)
+
+## CURLOPT_SHARE
+
+Share object to use. See CURLOPT_SHARE(3)
+
+## CURLOPT_SOCKOPTDATA
+
+Data pointer to pass to the sockopt callback. See CURLOPT_SOCKOPTDATA(3)
+
+## CURLOPT_SOCKOPTFUNCTION
+
+Callback for sockopt operations. See CURLOPT_SOCKOPTFUNCTION(3)
+
+## CURLOPT_SOCKS5_AUTH
+
+Socks5 authentication methods. See CURLOPT_SOCKS5_AUTH(3)
+
+## CURLOPT_SOCKS5_GSSAPI_NEC
+
+Socks5 GSSAPI NEC mode. See CURLOPT_SOCKS5_GSSAPI_NEC(3)
+
+## CURLOPT_SOCKS5_GSSAPI_SERVICE
+
+**Deprecated option** Socks5 GSSAPI service name.
+See CURLOPT_SOCKS5_GSSAPI_SERVICE(3)
+
+## CURLOPT_SSH_AUTH_TYPES
+
+SSH authentication types. See CURLOPT_SSH_AUTH_TYPES(3)
+
+## CURLOPT_SSH_COMPRESSION
+
+Enable SSH compression. See CURLOPT_SSH_COMPRESSION(3)
+
+## CURLOPT_SSH_HOSTKEYDATA
+
+Custom pointer to pass to ssh host key callback. See CURLOPT_SSH_HOSTKEYDATA(3)
+
+## CURLOPT_SSH_HOSTKEYFUNCTION
+
+Callback for checking host key handling. See CURLOPT_SSH_HOSTKEYFUNCTION(3)
+
+## CURLOPT_SSH_HOST_PUBLIC_KEY_MD5
+
+MD5 of host's public key. See CURLOPT_SSH_HOST_PUBLIC_KEY_MD5(3)
+
+## CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256
+
+SHA256 of host's public key. See CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256(3)
+
+## CURLOPT_SSH_KEYDATA
+
+Custom pointer to pass to ssh key callback. See CURLOPT_SSH_KEYDATA(3)
+
+## CURLOPT_SSH_KEYFUNCTION
+
+Callback for known hosts handling. See CURLOPT_SSH_KEYFUNCTION(3)
+
+## CURLOPT_SSH_KNOWNHOSTS
+
+Filename with known hosts. See CURLOPT_SSH_KNOWNHOSTS(3)
+
+## CURLOPT_SSH_PRIVATE_KEYFILE
+
+Filename of the private key. See CURLOPT_SSH_PRIVATE_KEYFILE(3)
+
+## CURLOPT_SSH_PUBLIC_KEYFILE
+
+Filename of the public key. See CURLOPT_SSH_PUBLIC_KEYFILE(3)
+
+## CURLOPT_SSLCERT
+
+Client cert. See CURLOPT_SSLCERT(3)
+
+## CURLOPT_SSLCERTTYPE
+
+Client cert type. See CURLOPT_SSLCERTTYPE(3)
+
+## CURLOPT_SSLCERT_BLOB
+
+Client cert memory buffer. See CURLOPT_SSLCERT_BLOB(3)
+
+## CURLOPT_SSLENGINE
+
+Use identifier with SSL engine. See CURLOPT_SSLENGINE(3)
+
+## CURLOPT_SSLENGINE_DEFAULT
+
+Default SSL engine. See CURLOPT_SSLENGINE_DEFAULT(3)
+
+## CURLOPT_SSLKEY
+
+Client key. See CURLOPT_SSLKEY(3)
+
+## CURLOPT_SSLKEYTYPE
+
+Client key type. See CURLOPT_SSLKEYTYPE(3)
+
+## CURLOPT_SSLKEY_BLOB
+
+Client key memory buffer. See CURLOPT_SSLKEY_BLOB(3)
+
+## CURLOPT_SSLVERSION
+
+SSL version to use. See CURLOPT_SSLVERSION(3)
+
+## CURLOPT_SSL_CIPHER_LIST
+
+Ciphers to use. See CURLOPT_SSL_CIPHER_LIST(3)
+
+## CURLOPT_SSL_CTX_DATA
+
+Data pointer to pass to the SSL context callback. See CURLOPT_SSL_CTX_DATA(3)
+
+## CURLOPT_SSL_CTX_FUNCTION
+
+Callback for SSL context logic. See CURLOPT_SSL_CTX_FUNCTION(3)
+
+## CURLOPT_SSL_EC_CURVES
+
+Set key exchange curves. See CURLOPT_SSL_EC_CURVES(3)
+
+## CURLOPT_SSL_ENABLE_ALPN
+
+Enable use of ALPN. See CURLOPT_SSL_ENABLE_ALPN(3)
+
+## CURLOPT_SSL_ENABLE_NPN
+
+**OBSOLETE** Enable use of NPN. See CURLOPT_SSL_ENABLE_NPN(3)
+
+## CURLOPT_SSL_FALSESTART
+
+**Deprecated option** Enable TLS False Start. See CURLOPT_SSL_FALSESTART(3)
+
+## CURLOPT_SSL_OPTIONS
+
+Control SSL behavior. See CURLOPT_SSL_OPTIONS(3)
+
+## CURLOPT_SSL_SESSIONID_CACHE
+
+Disable SSL session-id cache. See CURLOPT_SSL_SESSIONID_CACHE(3)
+
+## CURLOPT_SSL_SIGNATURE_ALGORITHMS
+
+TLS signature algorithms to use. See CURLOPT_SSL_SIGNATURE_ALGORITHMS(3)
+
+## CURLOPT_SSL_VERIFYHOST
+
+Verify the hostname in the SSL certificate. See CURLOPT_SSL_VERIFYHOST(3)
+
+## CURLOPT_SSL_VERIFYPEER
+
+Verify the SSL certificate. See CURLOPT_SSL_VERIFYPEER(3)
+
+## CURLOPT_SSL_VERIFYSTATUS
+
+Verify the SSL certificate's status. See CURLOPT_SSL_VERIFYSTATUS(3)
+
+## CURLOPT_STDERR
+
+Redirect stderr to another stream. See CURLOPT_STDERR(3)
+
+## CURLOPT_STREAM_DEPENDS
+
+**Deprecated option** This HTTP/2 stream depends on another. See
+CURLOPT_STREAM_DEPENDS(3)
+
+## CURLOPT_STREAM_DEPENDS_E
+
+**Deprecated option** This HTTP/2 stream depends on another exclusively. See
+CURLOPT_STREAM_DEPENDS_E(3)
+
+## CURLOPT_STREAM_WEIGHT
+
+Set this HTTP/2 stream's weight. See CURLOPT_STREAM_WEIGHT(3)
+
+## CURLOPT_SUPPRESS_CONNECT_HEADERS
+
+Suppress proxy CONNECT response headers from user callbacks. See
+CURLOPT_SUPPRESS_CONNECT_HEADERS(3)
+
+## CURLOPT_TCP_FASTOPEN
+
+Enable TCP Fast Open. See CURLOPT_TCP_FASTOPEN(3)
+
+## CURLOPT_TCP_KEEPALIVE
+
+Enable TCP keep-alive. See CURLOPT_TCP_KEEPALIVE(3)
+
+## CURLOPT_TCP_KEEPCNT
+
+Maximum number of keep-alive probes. See CURLOPT_TCP_KEEPCNT(3)
+
+## CURLOPT_TCP_KEEPIDLE
+
+Idle time before sending keep-alive. See CURLOPT_TCP_KEEPIDLE(3)
+
+## CURLOPT_TCP_KEEPINTVL
+
+Interval between keep-alive probes. See CURLOPT_TCP_KEEPINTVL(3)
+
+## CURLOPT_TCP_NODELAY
+
+Disable the Nagle algorithm. See CURLOPT_TCP_NODELAY(3)
+
+## CURLOPT_TELNETOPTIONS
+
+TELNET options. See CURLOPT_TELNETOPTIONS(3)
+
+## CURLOPT_TFTP_BLKSIZE
+
+TFTP block size. See CURLOPT_TFTP_BLKSIZE(3)
+
+## CURLOPT_TFTP_NO_OPTIONS
+
+Do not send TFTP options requests. See CURLOPT_TFTP_NO_OPTIONS(3)
+
+## CURLOPT_TIMECONDITION
+
+Make a time conditional request. See CURLOPT_TIMECONDITION(3)
+
+## CURLOPT_TIMEOUT
+
+Timeout for the entire request. See CURLOPT_TIMEOUT(3)
+
+## CURLOPT_TIMEOUT_MS
+
+Millisecond timeout for the entire request. See CURLOPT_TIMEOUT_MS(3)
+
+## CURLOPT_TIMEVALUE
+
+Time value for the time conditional request. See CURLOPT_TIMEVALUE(3)
+
+## CURLOPT_TIMEVALUE_LARGE
+
+Time value for the time conditional request. See CURLOPT_TIMEVALUE_LARGE(3)
+
+## CURLOPT_TLS13_CIPHERS
+
+TLS 1.3 cipher suites to use. See CURLOPT_TLS13_CIPHERS(3)
+
+## CURLOPT_TLSAUTH_PASSWORD
+
+TLS authentication password. See CURLOPT_TLSAUTH_PASSWORD(3)
+
+## CURLOPT_TLSAUTH_TYPE
+
+TLS authentication methods. See CURLOPT_TLSAUTH_TYPE(3)
+
+## CURLOPT_TLSAUTH_USERNAME
+
+TLS authentication username. See CURLOPT_TLSAUTH_USERNAME(3)
+
+## CURLOPT_TRAILERDATA
+
+Custom pointer passed to the trailing headers callback. See
+CURLOPT_TRAILERDATA(3)
+
+## CURLOPT_TRAILERFUNCTION
+
+Set callback for sending trailing headers. See
+CURLOPT_TRAILERFUNCTION(3)
+
+## CURLOPT_TRANSFERTEXT
+
+Use text transfer. See CURLOPT_TRANSFERTEXT(3)
+
+## CURLOPT_TRANSFER_ENCODING
+
+Request Transfer-Encoding. See CURLOPT_TRANSFER_ENCODING(3)
+
+## CURLOPT_UNIX_SOCKET_PATH
+
+Path to a Unix domain socket. See CURLOPT_UNIX_SOCKET_PATH(3)
+
+## CURLOPT_UNRESTRICTED_AUTH
+
+Do not restrict authentication to original host. CURLOPT_UNRESTRICTED_AUTH(3)
+
+## CURLOPT_UPKEEP_INTERVAL_MS
+
+Sets the interval at which connection upkeep are performed. See
+CURLOPT_UPKEEP_INTERVAL_MS(3)
+
+## CURLOPT_UPLOAD
+
+Upload data. See CURLOPT_UPLOAD(3)
+
+## CURLOPT_UPLOAD_BUFFERSIZE
+
+Set upload buffer size. See CURLOPT_UPLOAD_BUFFERSIZE(3)
+
+## CURLOPT_UPLOAD_FLAGS
+
+Set upload flags. See CURLOPT_UPLOAD_FLAGS(3)
+
+## CURLOPT_URL
+
+URL to work on. See CURLOPT_URL(3)
+
+## CURLOPT_USERAGENT
+
+User-Agent: header. See CURLOPT_USERAGENT(3)
+
+## CURLOPT_USERNAME
+
+Username. See CURLOPT_USERNAME(3)
+
+## CURLOPT_USERPWD
+
+Username and password. See CURLOPT_USERPWD(3)
+
+## CURLOPT_USE_SSL
+
+Use TLS/SSL. See CURLOPT_USE_SSL(3)
+
+## CURLOPT_VERBOSE
+
+Display verbose information. See CURLOPT_VERBOSE(3)
+
+## CURLOPT_WILDCARDMATCH
+
+Transfer multiple files according to a filename pattern. See
+CURLOPT_WILDCARDMATCH(3)
+
+## CURLOPT_WRITEDATA
+
+Data pointer to pass to the write callback. See CURLOPT_WRITEDATA(3)
+
+## CURLOPT_WRITEFUNCTION
+
+Callback for writing data. See CURLOPT_WRITEFUNCTION(3)
+
+## CURLOPT_WS_OPTIONS
+
+Set WebSocket options. See CURLOPT_WS_OPTIONS(3)
+
+## CURLOPT_XFERINFODATA
+
+Data pointer to pass to the progress meter callback. See
+CURLOPT_XFERINFODATA(3)
+
+## CURLOPT_XFERINFOFUNCTION
+
+Callback for progress meter. See CURLOPT_XFERINFOFUNCTION(3)
+
+## CURLOPT_XOAUTH2_BEARER
+
+OAuth2 bearer token. See CURLOPT_XOAUTH2_BEARER(3)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
+
+Strings passed on to libcurl must be shorter than 8000000 bytes, otherwise
+curl_easy_setopt(3) returns **CURLE_BAD_FUNCTION_ARGUMENT** (added in 7.65.0).
+
+**CURLE_BAD_FUNCTION_ARGUMENT** is returned when the argument to an option is
+invalid, like perhaps out of range.
+
+If you try to set an option that libcurl does not know about, perhaps because
+the library is too old to support it or the option was removed in a recent
+version, this function returns *CURLE_UNKNOWN_OPTION*. If support for the
+option was disabled at compile-time, it returns *CURLE_NOT_BUILT_IN*.
diff --git a/third-party/curl/docs/libcurl/curl_easy_ssls_export.md b/third-party/curl/docs/libcurl/curl_easy_ssls_export.md
new file mode 100644
index 0000000000..1eb634fb58
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_ssls_export.md
@@ -0,0 +1,175 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_ssls_export
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SHARE (3)
+  - curl_share_setopt (3)
+  - curl_easy_ssls_import (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - GnuTLS
+  - OpenSSL
+  - wolfSSL
+  - mbedTLS
+Added-in: 8.12.0
+---
+
+# NAME
+
+curl_easy_ssls_export - export SSL sessions
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+typedef CURLcode curl_ssls_export_function(CURL *handle,
+                                           void *userptr,
+                                           const char *session_key,
+                                           const unsigned char *shmac,
+                                           size_t shmac_len,
+                                           const unsigned char *sdata,
+                                           size_t sdata_len,
+                                           curl_off_t valid_until,
+                                           int ietf_tls_id,
+                                           const char *alpn,
+                                           size_t earlydata_max);
+
+CURLcode curl_easy_ssls_export(CURL *handle,
+                               curl_ssls_export_function *export_fn,
+                               void *userptr);
+~~~
+
+# DESCRIPTION
+
+This function iterates over all SSL session tickets that belong to the
+easy handle and invokes the **export_fn** callback on each of them, as
+long as the callback returns **CURLE_OK**.
+
+The callback may then store this information and use curl_easy_ssls_import(3)
+in another libcurl instance to add SSL session tickets again. Reuse of
+SSL session tickets may result in faster handshakes and some connections
+might be able to send request data in the initial packets (0-RTT).
+
+From all the parameters passed to the **export_fn** only two need to be
+persisted: either **session_key** or **shamc** and always **sdata**. All
+other parameters are informative, e.g. allow the callback to act only
+on specific session tickets.
+
+Note that SSL sessions that involve a client certificate or SRP
+username/password are not exported.
+
+# Export Function Parameter
+
+## Session Key
+
+This is a printable, null-terminated string that starts with **hostname:port**
+the session ticket is originating from and also contains all relevant SSL
+parameters used in the connection. The key also carries the name and version
+number of the TLS backend used.
+
+It is recommended to only persist **session_key** when it can be protected
+from outside access. Since the hostname appears in plain text, it would
+allow any third party to see how curl has been used for.
+
+## Salted Hash
+
+A binary blob of **shmac_len** bytes that contains a random salt and
+a cryptographic hash of the salt and **session_key**. The salt is generated
+for every session individually. Storing **shmac** is recommended when
+placing session tickets in a file, for example.
+
+A third party may brute-force known hostnames, but cannot "grep" for them.
+
+## Session Data
+
+A binary blob of **sdata_len** bytes, **sdata** contains all relevant
+SSL session ticket information for a later import - apart from **session_key**
+and **shmac**.
+
+## valid_until
+
+Seconds since EPOCH (1970-01-01) until the session ticket is considered
+valid.
+
+## TLS Version
+
+The IETF assigned number for the TLS version the session ticket originates
+from. This is **0x0304** for TLSv1.3, **0x0303** for 1.2, etc. Session
+tickets from version 1.3 have better security properties, so an export
+might store only those.
+
+## ALPN
+
+The ALPN protocol that had been negotiated with the host. This may be
+**NULL** if negotiation gave no result or had not been attempted.
+
+## Early Data
+
+The maximum amount of bytes the server supports to receive in early data
+(0-RTT). This is 0 unless the server explicitly indicates support.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+CURLcode my_export_cb(CURL *handle,
+                      void *userptr,
+                      const char *session_key,
+                      const unsigned char *shmac,
+                      size_t shmac_len,
+                      const unsigned char *sdata,
+                      size_t sdata_len,
+                      curl_off_t valid_until,
+                      int ietf_tls_id,
+                      const char *alpn,
+                      size_t earlydata_max)
+{
+  /* persist sdata */
+  return CURLE_OK;
+}
+
+int main(void)
+{
+  CURLSHcode sh;
+  CURLSH *share = curl_share_init();
+  CURLcode result;
+  CURL *curl;
+
+  sh = curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_SSL_SESSION);
+  if(sh)
+    printf("Error: %s\n", curl_share_strerror(sh));
+
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_SHARE, share);
+
+    /* run a transfer, all TLS sessions received are added to the share. */
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_perform(curl);
+
+    /* export the TLS sessions collected in the share */
+    result = curl_easy_ssls_export(curl, my_export_cb, NULL);
+
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+  curl_share_cleanup(share);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
diff --git a/third-party/curl/docs/libcurl/curl_easy_ssls_import.md b/third-party/curl/docs/libcurl/curl_easy_ssls_import.md
new file mode 100644
index 0000000000..178c10654c
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_ssls_import.md
@@ -0,0 +1,89 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_ssls_import
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SHARE (3)
+  - curl_share_setopt (3)
+  - curl_easy_ssls_export (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - GnuTLS
+  - OpenSSL
+  - wolfSSL
+  - mbedTLS
+Added-in: 8.12.0
+---
+
+# NAME
+
+curl_easy_ssls_import - import SSL sessions
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_ssls_import(CURL *handle,
+                               const char *session_key,
+                               const unsigned char *shmac, size_t shmac_len,
+                               const unsigned char *sdata, size_t sdata_len);
+~~~
+
+# DESCRIPTION
+
+This function imports a previously exported SSL session ticket. **sdata** and
+**sdata_len** must always be provided. If **session_key** is **NULL**, then
+**shmac** and **shmac_len** must be given as received during the export.
+See curl_easy_ssls_export(3) for a description of those.
+
+Import of session tickets from other curl versions may fail due to changes
+in the handling of **shmac** or **sdata**. A session ticket which has
+already expired is silently discarded.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLSHcode sh;
+  CURLSH *share = curl_share_init();
+  CURLcode result;
+  CURL *curl;
+
+  sh = curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_SSL_SESSION);
+  if(sh)
+    printf("Error: %s\n", curl_share_strerror(sh));
+
+  curl = curl_easy_init();
+  if(curl) {
+    extern unsigned char *shmac, *sdata;
+    size_t hlen = 4, slen = 5;
+
+    curl_easy_setopt(curl, CURLOPT_SHARE, share);
+
+    /* read shmac and sdata from storage */
+    result = curl_easy_ssls_import(curl, NULL, shmac, hlen, sdata, slen);
+
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+  curl_share_cleanup(share);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
diff --git a/third-party/curl/docs/libcurl/curl_easy_strerror.3 b/third-party/curl/docs/libcurl/curl_easy_strerror.3
deleted file mode 100644
index 1e2a844e09..0000000000
--- a/third-party/curl/docs/libcurl/curl_easy_strerror.3
+++ /dev/null
@@ -1,54 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_easy_strerror 3 "26 Apr 2004" "libcurl" "libcurl"
-.SH NAME
-curl_easy_strerror - return string describing error code
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-const char *curl_easy_strerror(CURLcode errornum);
-.fi
-.SH DESCRIPTION
-The \fIcurl_easy_strerror(3)\fP function returns a string describing the
-CURLcode error code passed in the argument \fIerrornum\fP.
-
-Typically applications also appreciate \fICURLOPT_ERRORBUFFER(3)\fP for more
-specific error descriptions generated at runtime.
-.SH EXAMPLE
-.nf
-  /* Perform the entire transfer */
-  res = curl_easy_perform(curl);
-  /* Check for errors */
-  if(res != CURLE_OK)
-    fprintf(stderr, "curl_easy_perform() failed: %s\\n",
-            curl_easy_strerror(res));
-.fi
-.SH AVAILABILITY
-This function was added in libcurl 7.12.0
-.SH RETURN VALUE
-A pointer to a null-terminated string.
-.SH "SEE ALSO"
-.BR libcurl-errors "(3), " curl_multi_strerror "(3), "
-.BR curl_share_strerror "(3), " curl_url_strerror "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_easy_strerror.md b/third-party/curl/docs/libcurl/curl_easy_strerror.md
new file mode 100644
index 0000000000..bec2bdc1a3
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_strerror.md
@@ -0,0 +1,62 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_strerror
+Section: 3
+Source: libcurl
+See-also:
+  - curl_multi_strerror (3)
+  - curl_share_strerror (3)
+  - curl_url_strerror (3)
+  - libcurl-errors (3)
+Protocol:
+  - All
+Added-in: 7.12.0
+---
+
+# NAME
+
+curl_easy_strerror - return string describing error code
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+const char *curl_easy_strerror(CURLcode errornum);
+~~~
+
+# DESCRIPTION
+
+The curl_easy_strerror(3) function returns a string describing the
+CURLcode error code passed in the argument *errornum*.
+
+Typically applications also appreciate CURLOPT_ERRORBUFFER(3) for more
+specific error descriptions generated at runtime.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    /* set options */
+    /* Perform the entire transfer */
+    result = curl_easy_perform(curl);
+    /* Check for errors */
+    if(result != CURLE_OK)
+      fprintf(stderr, "curl_easy_perform() failed: %s\n",
+              curl_easy_strerror(result));
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+A pointer to a null-terminated string.
diff --git a/third-party/curl/docs/libcurl/curl_easy_unescape.3 b/third-party/curl/docs/libcurl/curl_easy_unescape.3
deleted file mode 100644
index e948a9f303..0000000000
--- a/third-party/curl/docs/libcurl/curl_easy_unescape.3
+++ /dev/null
@@ -1,75 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH curl_easy_unescape 3 "7 April 2006" "libcurl" "libcurl"
-.SH NAME
-curl_easy_unescape - URL decodes the given string
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-char *curl_easy_unescape(CURL *curl, const char *input,
-                         int inlength, int *outlength);
-.fi
-.SH DESCRIPTION
-This function converts the URL encoded string \fBinput\fP to a "plain string"
-and returns that in an allocated memory area. All input characters that are URL
-encoded (%XX where XX is a two-digit hexadecimal number) are converted to their
-binary versions.
-
-If the \fBlength\fP argument is set to 0 (zero), \fIcurl_easy_unescape(3)\fP
-uses strlen() on \fBinput\fP to find out the size.
-
-If \fBoutlength\fP is non-NULL, the function writes the length of the returned
-string in the integer it points to. This allows proper handling even for
-strings containing %00. Since this is a pointer to an \fIint\fP type, it can
-only return a value up to \fIINT_MAX\fP so no longer string can be returned in
-this parameter.
-
-Since 7.82.0, the \fBcurl\fP parameter is ignored. Prior to that there was
-per-handle character conversion support for some old operating systems such as
-TPF, but it was otherwise ignored.
-
-You must \fIcurl_free(3)\fP the returned string when you are done with it.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  int decodelen;
-  char *decoded = curl_easy_unescape(curl, "%63%75%72%6c", 12, &decodelen);
-  if(decoded) {
-    /* do not assume printf() works on the decoded data! */
-    printf("Decoded: ");
-    /* ... */
-    curl_free(decoded);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.15.4 and replaces the old \fIcurl_unescape(3)\fP function.
-.SH RETURN VALUE
-A pointer to a null-terminated string or NULL if it failed.
-.SH "SEE ALSO"
-.BR curl_easy_escape "(3), " curl_free "(3)," RFC 3986
diff --git a/third-party/curl/docs/libcurl/curl_easy_unescape.md b/third-party/curl/docs/libcurl/curl_easy_unescape.md
new file mode 100644
index 0000000000..49e4c6bf26
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_unescape.md
@@ -0,0 +1,77 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_unescape
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_escape (3)
+  - curl_url_get (3)
+Protocol:
+  - All
+Added-in: 7.15.4
+---
+
+# NAME
+
+curl_easy_unescape - URL decode a string
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+char *curl_easy_unescape(CURL *curl, const char *input,
+                         int inlength, int *outlength);
+~~~
+
+# DESCRIPTION
+
+This function converts the URL encoded string **input** to a "plain string"
+and returns that in an allocated memory area. All input characters that are URL
+encoded (%XX where XX is a two-digit hexadecimal number) are converted to their
+binary versions. Although not constrained by its type, the returned data may
+not be altered.
+
+If the **length** argument is set to 0 (zero), curl_easy_unescape(3)
+uses strlen() on **input** to find out the size.
+
+If **outlength** is non-NULL, the function writes the length of the returned
+string in the integer it points to. This allows proper handling even for
+strings containing %00. Since this is a pointer to an *int* type, it can
+only return a value up to *INT_MAX* so no longer string can be returned in
+this parameter.
+
+Since 7.82.0, the **curl** parameter is ignored. Prior to that there was
+per-handle character conversion support for some old operating systems such as
+TPF, but it was otherwise ignored.
+
+You must curl_free(3) the returned string when you are done with it.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    int decodelen;
+    char *decoded = curl_easy_unescape(curl, "%63%75%72%6c", 12, &decodelen);
+    if(decoded) {
+      /* do not assume printf() works on the decoded data */
+      printf("Decoded: ");
+      /* ... */
+      curl_free(decoded);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+A pointer to a null-terminated string or NULL if it failed.
diff --git a/third-party/curl/docs/libcurl/curl_easy_upkeep.3 b/third-party/curl/docs/libcurl/curl_easy_upkeep.3
deleted file mode 100644
index ade0a5d463..0000000000
--- a/third-party/curl/docs/libcurl/curl_easy_upkeep.3
+++ /dev/null
@@ -1,81 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH curl_easy_upkeep 3 "31 Oct 2018" "libcurl" "libcurl"
-.SH NAME
-curl_easy_upkeep - Perform any connection upkeep checks.
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_upkeep(CURL *handle);
-.fi
-.SH DESCRIPTION
-
-Some protocols have "connection upkeep" mechanisms. These mechanisms usually
-send some traffic on existing connections in order to keep them alive; this
-can prevent connections from being closed due to overzealous firewalls, for
-example.
-
-Currently the only protocol with a connection upkeep mechanism is HTTP/2: when
-the connection upkeep interval is exceeded and \fIcurl_easy_upkeep(3)\fP
-is called, an HTTP/2 PING frame is sent on the connection.
-
-This function must be explicitly called in order to perform the upkeep work.
-The connection upkeep interval is set with
-\fICURLOPT_UPKEEP_INTERVAL_MS(3)\fP.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  /* Make a connection to an HTTP/2 server. */
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Set the interval to 30000ms / 30s */
-  curl_easy_setopt(curl, CURLOPT_UPKEEP_INTERVAL_MS, 30000L);
-
-  curl_easy_perform(curl);
-
-  /* Perform more work here. */
-
-  /* While the connection is being held open, curl_easy_upkeep() can be
-     called. If curl_easy_upkeep() is called and the time since the last
-     upkeep exceeds the interval, then an HTTP/2 PING is sent. */
-  curl_easy_upkeep(curl);
-
-  /* Perform more work here. */
-
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.62.0.
-.SH RETURN VALUE
-On success, returns \fBCURLE_OK\fP.
-
-On failure, returns the appropriate error code.
-.SH SEE ALSO
-.BR CURLOPT_TCP_KEEPALIVE "(3), "
-.BR CURLOPT_TCP_KEEPIDLE "(3), "
diff --git a/third-party/curl/docs/libcurl/curl_easy_upkeep.md b/third-party/curl/docs/libcurl/curl_easy_upkeep.md
new file mode 100644
index 0000000000..1aa448bee3
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_easy_upkeep.md
@@ -0,0 +1,90 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_easy_upkeep
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_TCP_KEEPALIVE (3)
+  - CURLOPT_TCP_KEEPIDLE (3)
+Protocol:
+  - All
+Added-in: 7.62.0
+---
+
+# NAME
+
+curl_easy_upkeep - keep existing connections alive
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_upkeep(CURL *handle);
+~~~
+
+# DESCRIPTION
+
+Some protocols have "connection upkeep" mechanisms. These mechanisms usually
+send some traffic on existing connections in order to keep them alive; this
+can prevent connections from being closed due to overzealous firewalls, for
+example.
+
+For HTTP/2 we have an upkeep mechanism: when
+the connection upkeep interval is exceeded and curl_easy_upkeep(3)
+is called, an HTTP/2 PING frame is sent on the connection.
+
+For MQTT the upkeep interval defines when to send ping requests to prevent the
+server from disconnecting.
+
+This function must be explicitly called in order to perform the upkeep work.
+The connection upkeep interval is set with
+CURLOPT_UPKEEP_INTERVAL_MS(3).
+
+If you call this function on an easy handle that uses a shared connection cache
+then upkeep is performed on the connections in that cache, even if those
+connections were never used by the easy handle. (Added in 8.10.0)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    /* Make a connection to an HTTP/2 server. */
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Set the interval to 30000ms / 30s */
+    curl_easy_setopt(curl, CURLOPT_UPKEEP_INTERVAL_MS, 30000L);
+
+    curl_easy_perform(curl);
+
+    /* Perform more work here. */
+
+    /* While the connection is being held open, curl_easy_upkeep() can be
+       called. If curl_easy_upkeep() is called and the time since the last
+       upkeep exceeds the interval, then an HTTP/2 PING is sent. */
+    curl_easy_upkeep(curl);
+
+    /* Perform more work here. */
+
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
diff --git a/third-party/curl/docs/libcurl/curl_escape.3 b/third-party/curl/docs/libcurl/curl_escape.3
deleted file mode 100644
index b749b5cf2f..0000000000
--- a/third-party/curl/docs/libcurl/curl_escape.3
+++ /dev/null
@@ -1,59 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_escape 3 "6 March 2002" "libcurl" "libcurl"
-.SH NAME
-curl_escape - URL encodes the given string
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-char *curl_escape(const char *string, int length);
-.fi
-.SH DESCRIPTION
-Obsolete function. Use \fIcurl_easy_escape(3)\fP instead!
-
-This function converts the given input \fBstring\fP to a URL encoded string
-and return that as a new allocated string. All input characters that are not
-a-z, A-Z or 0-9 are converted to their "URL escaped" version (\fB%NN\fP where
-\fBNN\fP is a two-digit hexadecimal number).
-
-If the \fBlength\fP argument is set to 0, \fIcurl_escape(3)\fP uses strlen()
-on \fBstring\fP to find out the size.
-
-You must \fIcurl_free(3)\fP the returned string when you are done with it.
-.SH EXAMPLE
-.nf
-char *output = curl_escape("data to convert", 15);
-if(output) {
-  printf("Encoded: %s\\n", output);
-  curl_free(output);
-}
-.fi
-.SH AVAILABILITY
-Since 7.15.4, \fIcurl_easy_escape(3)\fP should be used. This function might be
-removed in a future release.
-.SH RETURN VALUE
-A pointer to a null-terminated string or NULL if it failed.
-.SH "SEE ALSO"
-.BR curl_unescape "(3), " curl_free "(3), " RFC 2396
diff --git a/third-party/curl/docs/libcurl/curl_escape.md b/third-party/curl/docs/libcurl/curl_escape.md
new file mode 100644
index 0000000000..967d375a97
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_escape.md
@@ -0,0 +1,66 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_escape
+Section: 3
+Source: libcurl
+See-also:
+  - curl_free (3)
+  - curl_unescape (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+curl_escape - URL encode a string
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+char *curl_escape(const char *string, int length);
+~~~
+
+# DESCRIPTION
+
+Obsolete function. Use curl_easy_escape(3) instead.
+
+This function converts the given input **string** to a URL encoded string
+and return that as a new allocated string. All input characters that are not
+a-z, A-Z or 0-9 are converted to their "URL escaped" version (**%NN** where
+**NN** is a two-digit hexadecimal number). Although not constrained by its
+type, the returned string may not be altered.
+
+If the **length** argument is set to 0, curl_escape(3) uses strlen()
+on **string** to find out the size.
+
+You must curl_free(3) the returned string when you are done with it.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  char *output = curl_escape("data to convert", 15);
+  if(output) {
+    printf("Encoded: %s\n", output);
+    curl_free(output);
+  }
+}
+~~~
+
+# HISTORY
+
+Since 7.15.4, curl_easy_escape(3) should be used. This function might be
+removed in a future release.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+A pointer to a null-terminated string or NULL if it failed.
diff --git a/third-party/curl/docs/libcurl/curl_formadd.3 b/third-party/curl/docs/libcurl/curl_formadd.3
deleted file mode 100644
index f176a13c84..0000000000
--- a/third-party/curl/docs/libcurl/curl_formadd.3
+++ /dev/null
@@ -1,268 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_formadd 3 "24 June 2002" "libcurl" "libcurl"
-.SH NAME
-curl_formadd - add a section to a multipart form POST
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLFORMcode curl_formadd(struct curl_httppost **firstitem,
-                          struct curl_httppost **lastitem, ...);
-.fi
-.SH DESCRIPTION
-\fBThis function is deprecated.\fP Use \fIcurl_mime_init(3)\fP instead.
-
-curl_formadd() is used to append sections when building a multipart form
-post. Append one section at a time until you have added all the sections you
-want included and then you pass the \fIfirstitem\fP pointer as parameter to
-\fICURLOPT_HTTPPOST(3)\fP.  \fIlastitem\fP is set after each
-\fIcurl_formadd(3)\fP call and on repeated invokes it should be left as set to
-allow repeated invokes to find the end of the list faster.
-
-After the \fIlastitem\fP pointer follow the real arguments.
-
-The pointers \fIfirstitem\fP and \fIlastitem\fP should both be pointing to
-NULL in the first call to this function. All list-data is allocated by the
-function itself. You must call \fIcurl_formfree(3)\fP on the \fIfirstitem\fP
-after the form post has been done to free the resources.
-
-Using POST with HTTP 1.1 implies the use of a "Expect: 100-continue" header.
-You can disable this header with \fICURLOPT_HTTPHEADER(3)\fP as usual.
-
-First, there are some basics you need to understand about multipart form
-posts. Each part consists of at least a NAME and a CONTENTS part. If the part
-is made for file upload, there are also a stored CONTENT-TYPE and a FILENAME.
-Below, we discuss what options you use to set these properties in the parts
-you want to add to your post.
-
-The options listed first are for making normal parts. The options from
-\fICURLFORM_FILE\fP through \fICURLFORM_BUFFERLENGTH\fP are for file upload
-parts.
-.SH OPTIONS
-.IP CURLFORM_COPYNAME
-followed by a string which provides the \fIname\fP of this part. libcurl
-copies the string so your application does not need to keep it around after
-this function call. If the name is not null-terminated, you must set its
-length with \fBCURLFORM_NAMELENGTH\fP. The \fIname\fP is not allowed to
-contain zero-valued bytes. The copied data is freed by \fIcurl_formfree(3)\fP.
-.IP CURLFORM_PTRNAME
-followed by a string which provides the \fIname\fP of this part. libcurl uses
-the pointer and refer to the data in your application, so you must make sure
-it remains until curl no longer needs it. If the name is not null-terminated,
-you must set its length with \fBCURLFORM_NAMELENGTH\fP.  The \fIname\fP is not
-allowed to contain zero-valued bytes.
-.IP CURLFORM_COPYCONTENTS
-followed by a pointer to the contents of this part, the actual data to send
-away. libcurl copies the provided data, so your application does not need to
-keep it around after this function call. If the data is not null terminated,
-or if you would like it to contain zero bytes, you must set the length of the
-name with \fBCURLFORM_CONTENTSLENGTH\fP. The copied data is freed by
-\fIcurl_formfree(3)\fP.
-.IP CURLFORM_PTRCONTENTS
-followed by a pointer to the contents of this part, the actual data to send
-away. libcurl uses the pointer and refer to the data in your application, so
-you must make sure it remains until curl no longer needs it.  If the data is
-not null-terminated, or if you would like it to contain zero bytes, you must
-set its length with \fBCURLFORM_CONTENTSLENGTH\fP.
-.IP CURLFORM_CONTENTLEN
-followed by a curl_off_t value giving the length of the contents. Note that
-for \fICURLFORM_STREAM\fP contents, this option is mandatory.
-
-If you pass a 0 (zero) for this option, libcurl calls strlen() on the contents
-to figure out the size. If you really want to send a zero byte content then
-you must make sure strlen() on the data pointer returns zero.
-
-(Option added in 7.46.0)
-.IP CURLFORM_CONTENTSLENGTH
-(This option is deprecated. Use \fICURLFORM_CONTENTLEN\fP instead!)
-
-followed by a long giving the length of the contents. Note that for
-\fICURLFORM_STREAM\fP contents, this option is mandatory.
-
-If you pass a 0 (zero) for this option, libcurl calls strlen() on the contents
-to figure out the size. If you really want to send a zero byte content then
-you must make sure strlen() on the data pointer returns zero.
-.IP CURLFORM_FILECONTENT
-followed by a filename, causes that file to be read and its contents used
-as data in this part. This part does \fInot\fP automatically become a file
-upload part simply because its data was read from a file.
-
-The specified file needs to kept around until the associated transfer is done.
-.IP CURLFORM_FILE
-followed by a filename, makes this part a file upload part. It sets the
-\fIfilename\fP field to the basename of the provided filename, it reads the
-contents of the file and passes them as data and sets the content-type if the
-given file match one of the internally known file extensions. For
-\fBCURLFORM_FILE\fP the user may send one or more files in one part by
-providing multiple \fBCURLFORM_FILE\fP arguments each followed by the filename
-(and each \fICURLFORM_FILE\fP is allowed to have a
-\fICURLFORM_CONTENTTYPE\fP).
-
-The given upload file has to exist in its full in the file system already when
-the upload starts, as libcurl needs to read the correct file size beforehand.
-
-The specified file needs to kept around until the associated transfer is done.
-.IP CURLFORM_CONTENTTYPE
-is used in combination with \fICURLFORM_FILE\fP. Followed by a pointer to a
-string which provides the content-type for this part, possibly instead of an
-internally chosen one.
-.IP CURLFORM_FILENAME
-is used in combination with \fICURLFORM_FILE\fP. Followed by a pointer to a
-string, it tells libcurl to use the given string as the \fIfilename\fP in the
-file upload part instead of the actual file name.
-.IP CURLFORM_BUFFER
-is used for custom file upload parts without use of \fICURLFORM_FILE\fP. It
-tells libcurl that the file contents are already present in a buffer. The
-parameter is a string which provides the \fIfilename\fP field in the content
-header.
-.IP CURLFORM_BUFFERPTR
-is used in combination with \fICURLFORM_BUFFER\fP. The parameter is a pointer
-to the buffer to be uploaded. This buffer must not be freed until after
-\fIcurl_easy_cleanup(3)\fP is called. You must also use
-\fICURLFORM_BUFFERLENGTH\fP to set the number of bytes in the buffer.
-.IP CURLFORM_BUFFERLENGTH
-is used in combination with \fICURLFORM_BUFFER\fP. The parameter is a
-long which gives the length of the buffer.
-.IP CURLFORM_STREAM
-Tells libcurl to use the \fICURLOPT_READFUNCTION(3)\fP callback to get
-data. The parameter you pass to \fICURLFORM_STREAM\fP is the pointer passed on
-to the read callback's fourth argument. If you want the part to look like a
-file upload one, set the \fICURLFORM_FILENAME\fP parameter as well. Note that
-when using \fICURLFORM_STREAM\fP, \fICURLFORM_CONTENTSLENGTH\fP must also be
-set with the total expected length of the part unless the formpost is sent
-chunked encoded. (Option added in libcurl 7.18.2)
-.IP CURLFORM_ARRAY
-Another possibility to send options to curl_formadd() is the
-\fBCURLFORM_ARRAY\fP option, that passes a struct curl_forms array pointer as
-its value. Each curl_forms structure element has a \fICURLformoption\fP and a
-char pointer. The final element in the array must be a CURLFORM_END. All
-available options can be used in an array, except the CURLFORM_ARRAY option
-itself. The last argument in such an array must always be \fBCURLFORM_END\fP.
-.IP CURLFORM_CONTENTHEADER
-specifies extra headers for the form POST section. This takes a curl_slist
-prepared in the usual way using \fBcurl_slist_append\fP and appends the list
-of headers to those libcurl automatically generates. The list must exist while
-the POST occurs, if you free it before the post completes you may experience
-problems.
-
-When you have passed the \fIstruct curl_httppost\fP pointer to
-\fIcurl_easy_setopt(3)\fP (using the \fICURLOPT_HTTPPOST(3)\fP option), you
-must not free the list until after you have called \fIcurl_easy_cleanup(3)\fP
-for the curl handle.
-
-See example below.
-.SH EXAMPLE
-.nf
- struct curl_httppost *post = NULL;
- struct curl_httppost *last = NULL;
- char namebuffer[] = "name buffer";
- long namelength = strlen(namebuffer);
- char buffer[] = "test buffer";
- char htmlbuffer[] = "<HTML>test buffer</HTML>";
- long htmlbufferlength = strlen(htmlbuffer);
- struct curl_forms forms[3];
- char file1[] = "my-face.jpg";
- char file2[] = "your-face.jpg";
- /* add null character into htmlbuffer, to demonstrate that
-    transfers of buffers containing null characters actually work
- */
- htmlbuffer[8] = '\\0';
-
- /* Add simple name/content section */
- curl_formadd(&post, &last, CURLFORM_COPYNAME, "name",
-              CURLFORM_COPYCONTENTS, "content", CURLFORM_END);
-
- /* Add simple name/content/contenttype section */
- curl_formadd(&post, &last, CURLFORM_COPYNAME, "htmlcode",
-              CURLFORM_COPYCONTENTS, "<HTML></HTML>",
-              CURLFORM_CONTENTTYPE, "text/html", CURLFORM_END);
-
- /* Add name/ptrcontent section */
- curl_formadd(&post, &last, CURLFORM_COPYNAME, "name_for_ptrcontent",
-              CURLFORM_PTRCONTENTS, buffer, CURLFORM_END);
-
- /* Add ptrname/ptrcontent section */
- curl_formadd(&post, &last, CURLFORM_PTRNAME, namebuffer,
-              CURLFORM_PTRCONTENTS, buffer, CURLFORM_NAMELENGTH,
-              namelength, CURLFORM_END);
-
- /* Add name/ptrcontent/contenttype section */
- curl_formadd(&post, &last, CURLFORM_COPYNAME, "html_code_with_hole",
-              CURLFORM_PTRCONTENTS, htmlbuffer,
-              CURLFORM_CONTENTSLENGTH, htmlbufferlength,
-              CURLFORM_CONTENTTYPE, "text/html", CURLFORM_END);
-
- /* Add simple file section */
- curl_formadd(&post, &last, CURLFORM_COPYNAME, "picture",
-              CURLFORM_FILE, "my-face.jpg", CURLFORM_END);
-
- /* Add file/contenttype section */
- curl_formadd(&post, &last, CURLFORM_COPYNAME, "picture",
-              CURLFORM_FILE, "my-face.jpg",
-              CURLFORM_CONTENTTYPE, "image/jpeg", CURLFORM_END);
-
- /* Add two file section */
- curl_formadd(&post, &last, CURLFORM_COPYNAME, "pictures",
-              CURLFORM_FILE, "my-face.jpg",
-              CURLFORM_FILE, "your-face.jpg", CURLFORM_END);
-
- /* Add two file section using CURLFORM_ARRAY */
- forms[0].option = CURLFORM_FILE;
- forms[0].value  = file1;
- forms[1].option = CURLFORM_FILE;
- forms[1].value  = file2;
- forms[2].option  = CURLFORM_END;
-
- /* Add a buffer to upload */
- curl_formadd(&post, &last,
-              CURLFORM_COPYNAME, "name",
-              CURLFORM_BUFFER, "data",
-              CURLFORM_BUFFERPTR, record,
-              CURLFORM_BUFFERLENGTH, record_length,
-              CURLFORM_END);
-
- /* no option needed for the end marker */
- curl_formadd(&post, &last, CURLFORM_COPYNAME, "pictures",
-              CURLFORM_ARRAY, forms, CURLFORM_END);
- /* Add the content of a file as a normal post text value */
- curl_formadd(&post, &last, CURLFORM_COPYNAME, "filecontent",
-              CURLFORM_FILECONTENT, ".bashrc", CURLFORM_END);
- /* Set the form info */
- curl_easy_setopt(curl, CURLOPT_HTTPPOST, post);
-.SH AVAILABILITY
-Deprecated in 7.56.0. Before this release, field names were allowed to
-contain zero-valued bytes. The pseudo-filename "-" to read stdin is
-discouraged although still supported, but data is not read before being
-actually sent: the effective data size can then not be automatically
-determined, resulting in a chunked encoding transfer. Backslashes and
-double quotes in field and file names are now escaped before transmission.
-.SH RETURN VALUE
-0 means everything was OK, non-zero means an error occurred corresponding
-to a CURL_FORMADD_* constant defined in
-.I <curl/curl.h>
-.SH "SEE ALSO"
-.BR curl_easy_setopt "(3),"
-.BR curl_formfree "(3),"
-.BR curl_mime_init "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_formadd.md b/third-party/curl/docs/libcurl/curl_formadd.md
new file mode 100644
index 0000000000..f988e03876
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_formadd.md
@@ -0,0 +1,322 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_formadd
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_setopt (3)
+  - curl_formfree (3)
+  - curl_mime_init (3)
+Protocol:
+  - HTTP
+Added-in: 7.1
+---
+
+# NAME
+
+curl_formadd - add a section to a multipart form POST
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLFORMcode curl_formadd(struct curl_httppost **firstitem,
+                          struct curl_httppost **lastitem, ...);
+~~~
+
+# DESCRIPTION
+
+**This function is deprecated.** Use curl_mime_init(3) instead.
+
+curl_formadd() is used to append sections when building a multipart form
+post. Append one section at a time until you have added all the sections you
+want included and then you pass the *firstitem* pointer as parameter to
+CURLOPT_HTTPPOST(3). *lastitem* is set after each curl_formadd(3) call and
+on repeated invokes it should be left as set to allow repeated invokes to find
+the end of the list faster.
+
+After the *lastitem* pointer follow the real arguments.
+
+The pointers *firstitem* and *lastitem* should both be pointing to
+NULL in the first call to this function. All list-data is allocated by the
+function itself. You must call curl_formfree(3) on the *firstitem*
+after the form post has been done to free the resources.
+
+Using POST with HTTP 1.1 implies the use of a "Expect: 100-continue" header.
+You can disable this header with CURLOPT_HTTPHEADER(3) as usual.
+
+First, there are some basics you need to understand about multipart form
+posts. Each part consists of at least a NAME and a CONTENTS part. If the part
+is made for file upload, there are also a stored CONTENT-TYPE and a FILENAME.
+Below, we discuss what options you use to set these properties in the parts
+you want to add to your post.
+
+The options listed first are for making normal parts. The options from
+*CURLFORM_FILE* through *CURLFORM_BUFFERLENGTH* are for file upload
+parts.
+
+# OPTIONS
+
+## CURLFORM_COPYNAME
+
+followed by a string which provides the *name* of this part. libcurl
+copies the string so your application does not need to keep it around after
+this function call. If the name is not null-terminated, you must set its
+length with **CURLFORM_NAMELENGTH**. The *name* is not allowed to
+contain zero-valued bytes. The copied data is freed by curl_formfree(3).
+
+## CURLFORM_PTRNAME
+
+followed by a string which provides the *name* of this part. libcurl uses the
+pointer and refer to the data in your application, so you must make sure it
+remains until curl no longer needs it. If the name is not null-terminated, you
+must set its length with **CURLFORM_NAMELENGTH**. The *name* is not allowed to
+contain zero-valued bytes.
+
+## CURLFORM_COPYCONTENTS
+
+followed by a pointer to the contents of this part, the actual data to send
+away. libcurl copies the provided data, so your application does not need to
+keep it around after this function call. If the data is not null-terminated,
+or if you would like it to contain zero bytes, you must set the length of the
+name with **CURLFORM_CONTENTSLENGTH**. The copied data is freed by
+curl_formfree(3).
+
+## CURLFORM_PTRCONTENTS
+
+followed by a pointer to the contents of this part, the actual data to send
+away. libcurl uses the pointer and refer to the data in your application, so
+you must make sure it remains until curl no longer needs it. If the data is
+not null-terminated, or if you would like it to contain zero bytes, you must
+set its length with **CURLFORM_CONTENTSLENGTH**.
+
+## CURLFORM_CONTENTLEN
+
+followed by a curl_off_t value giving the length of the contents. Note that
+for *CURLFORM_STREAM* contents, this option is mandatory.
+
+If you pass a 0 (zero) for this option, libcurl calls strlen() on the contents
+to figure out the size. If you really want to send a zero byte content then
+you must make sure strlen() on the data pointer returns zero.
+
+## CURLFORM_CONTENTSLENGTH
+
+(This option is deprecated. Use *CURLFORM_CONTENTLEN* instead.)
+
+followed by a long giving the length of the contents. Note that for
+*CURLFORM_STREAM* contents, this option is mandatory.
+
+If you pass a 0 (zero) for this option, libcurl calls strlen() on the contents
+to figure out the size. If you really want to send a zero byte content then
+you must make sure strlen() on the data pointer returns zero.
+
+## CURLFORM_NAMELENGTH
+
+followed by a long giving the length of the name. Pass this option to set
+the length of *CURLFORM_COPYNAME* and *CURLFORM_PTRNAME* strings, if they are
+not null-terminated.
+
+## CURLFORM_FILECONTENT
+
+followed by a filename, causes that file to be read and its contents used
+as data in this part. This part does *not* automatically become a file
+upload part due to its data being read from a file.
+
+The specified file needs to kept around until the associated transfer is done.
+
+## CURLFORM_FILE
+
+followed by a filename, makes this part a file upload part. It sets the
+*filename* field to the basename of the provided filename, it reads the
+contents of the file and passes them as data and sets the content-type if the
+given file match one of the internally known file extensions. For
+**CURLFORM_FILE** the user may send one or more files in one part by
+providing multiple **CURLFORM_FILE** arguments each followed by the filename
+(and each *CURLFORM_FILE* is allowed to have a
+*CURLFORM_CONTENTTYPE*).
+
+The given upload file has to exist in its full in the file system already when
+the upload starts, as libcurl needs to read the correct file size beforehand.
+
+The specified file needs to kept around until the associated transfer is done.
+
+## CURLFORM_CONTENTTYPE
+
+is used in combination with *CURLFORM_FILE*. Followed by a pointer to a
+string which provides the content-type for this part, possibly instead of an
+internally chosen one.
+
+## CURLFORM_FILENAME
+
+is used in combination with *CURLFORM_FILE*. Followed by a pointer to a
+string, it tells libcurl to use the given string as the *filename* in the file
+upload part instead of the actual filename.
+
+## CURLFORM_BUFFER
+
+is used for custom file upload parts without use of *CURLFORM_FILE*. It
+tells libcurl that the file contents are already present in a buffer. The
+parameter is a string which provides the *filename* field in the content
+header.
+
+## CURLFORM_BUFFERPTR
+
+is used in combination with *CURLFORM_BUFFER*. The parameter is a pointer
+to the buffer to be uploaded. This buffer must not be freed until after
+curl_easy_cleanup(3) is called. You must also use
+*CURLFORM_BUFFERLENGTH* to set the number of bytes in the buffer.
+
+## CURLFORM_BUFFERLENGTH
+
+is used in combination with *CURLFORM_BUFFER*. The parameter is a
+long which gives the length of the buffer.
+
+## CURLFORM_STREAM
+
+Tells libcurl to use the CURLOPT_READFUNCTION(3) callback to get data. The
+parameter you pass to *CURLFORM_STREAM* is the pointer passed on to the read
+callback's fourth argument. If you want the part to look like a file upload
+one, set the *CURLFORM_FILENAME* parameter as well. Note that when using
+*CURLFORM_STREAM*, *CURLFORM_CONTENTSLENGTH* must also be set with the total
+expected length of the part unless the formpost is sent chunked encoded.
+
+## CURLFORM_ARRAY
+
+Another possibility to send options to curl_formadd() is the
+**CURLFORM_ARRAY** option, that passes a struct curl_forms array pointer as
+its value. Each curl_forms structure element has a *CURLformoption* and a
+char pointer. The final element in the array must be a CURLFORM_END. All
+available options can be used in an array, except the CURLFORM_ARRAY option
+itself. The last argument in such an array must always be **CURLFORM_END**.
+
+## CURLFORM_CONTENTHEADER
+
+specifies extra headers for the form POST section. This takes a curl_slist
+prepared in the usual way using **curl_slist_append** and appends the list
+of headers to those libcurl automatically generates. The list must exist while
+the POST occurs, if you free it before the post completes you may experience
+problems.
+
+When you have passed the *struct curl_httppost* pointer to
+curl_easy_setopt(3) (using the CURLOPT_HTTPPOST(3) option), you
+must not free the list until after you have called curl_easy_cleanup(3)
+for the curl handle.
+
+See example below.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <string.h> /* for strlen */
+
+static const char record[]="data in a buffer";
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    struct curl_httppost *post = NULL;
+    struct curl_httppost *last = NULL;
+    char namebuffer[] = "name buffer";
+    long namelength = strlen(namebuffer);
+    char buffer[] = "test buffer";
+    char htmlbuffer[] = "<HTML>test buffer</HTML>";
+    long htmlbufferlength = strlen(htmlbuffer);
+    struct curl_forms forms[3];
+    char file1[] = "my-face.jpg";
+    char file2[] = "your-face.jpg";
+    /* add null character into htmlbuffer, to demonstrate that
+       transfers of buffers containing null characters actually work
+     */
+    htmlbuffer[8] = '\0';
+
+    /* Add simple name/content section */
+    curl_formadd(&post, &last, CURLFORM_COPYNAME, "name",
+                 CURLFORM_COPYCONTENTS, "content", CURLFORM_END);
+
+    /* Add simple name/content/contenttype section */
+    curl_formadd(&post, &last, CURLFORM_COPYNAME, "htmlcode",
+                 CURLFORM_COPYCONTENTS, "<HTML></HTML>",
+                 CURLFORM_CONTENTTYPE, "text/html", CURLFORM_END);
+
+    /* Add name/ptrcontent section */
+    curl_formadd(&post, &last, CURLFORM_COPYNAME, "name_for_ptrcontent",
+                 CURLFORM_PTRCONTENTS, buffer, CURLFORM_END);
+
+    /* Add ptrname/ptrcontent section */
+    curl_formadd(&post, &last, CURLFORM_PTRNAME, namebuffer,
+                 CURLFORM_PTRCONTENTS, buffer, CURLFORM_NAMELENGTH,
+                 namelength, CURLFORM_END);
+
+    /* Add name/ptrcontent/contenttype section */
+    curl_formadd(&post, &last, CURLFORM_COPYNAME, "html_code_with_hole",
+                 CURLFORM_PTRCONTENTS, htmlbuffer,
+                 CURLFORM_CONTENTSLENGTH, htmlbufferlength,
+                 CURLFORM_CONTENTTYPE, "text/html", CURLFORM_END);
+
+    /* Add simple file section */
+    curl_formadd(&post, &last, CURLFORM_COPYNAME, "picture",
+                 CURLFORM_FILE, "my-face.jpg", CURLFORM_END);
+
+    /* Add file/contenttype section */
+    curl_formadd(&post, &last, CURLFORM_COPYNAME, "picture",
+                 CURLFORM_FILE, "my-face.jpg",
+                 CURLFORM_CONTENTTYPE, "image/jpeg", CURLFORM_END);
+
+    /* Add two file section */
+    curl_formadd(&post, &last, CURLFORM_COPYNAME, "pictures",
+                 CURLFORM_FILE, "my-face.jpg",
+                 CURLFORM_FILE, "your-face.jpg", CURLFORM_END);
+
+    /* Add two file section using CURLFORM_ARRAY */
+    forms[0].option = CURLFORM_FILE;
+    forms[0].value  = file1;
+    forms[1].option = CURLFORM_FILE;
+    forms[1].value  = file2;
+    forms[2].option  = CURLFORM_END;
+
+    /* Add a buffer to upload */
+    curl_formadd(&post, &last,
+                 CURLFORM_COPYNAME, "name",
+                 CURLFORM_BUFFER, "data",
+                 CURLFORM_BUFFERPTR, record,
+                 CURLFORM_BUFFERLENGTH, (long)sizeof(record),
+                 CURLFORM_END);
+
+    /* no option needed for the end marker */
+    curl_formadd(&post, &last, CURLFORM_COPYNAME, "pictures",
+                 CURLFORM_ARRAY, forms, CURLFORM_END);
+    /* Add the content of a file as a normal post text value */
+    curl_formadd(&post, &last, CURLFORM_COPYNAME, "filecontent",
+                 CURLFORM_FILECONTENT, ".bashrc", CURLFORM_END);
+    /* Set the form info */
+    curl_easy_setopt(curl, CURLOPT_HTTPPOST, post);
+
+    curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+
+    curl_formfree(post);
+  }
+}
+~~~
+
+# DEPRECATED
+
+Deprecated in 7.56.0. Before this release, field names were allowed to contain
+zero-valued bytes. The pseudo-filename "-" to read stdin is discouraged
+although still supported, but data is not read before being actually sent: the
+effective data size can then not be automatically determined, resulting in a
+chunked encoding transfer. Backslashes and double quotes in field and
+filenames are now escaped before transmission.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+0 means everything was OK, non-zero means an error occurred corresponding to a
+`CURL_FORMADD_*` constant defined in *\<curl/curl.h\>*.
diff --git a/third-party/curl/docs/libcurl/curl_formfree.3 b/third-party/curl/docs/libcurl/curl_formfree.3
deleted file mode 100644
index aa154a978f..0000000000
--- a/third-party/curl/docs/libcurl/curl_formfree.3
+++ /dev/null
@@ -1,70 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_formfree 3 "6 April 2001" "libcurl" "libcurl"
-.SH NAME
-curl_formfree - free a previously build multipart form post chain
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-void curl_formfree(struct curl_httppost *form);
-.fi
-.SH DESCRIPTION
-This function is deprecated. Do not use. See \fIcurl_mime_init(3)\fP instead!
-
-curl_formfree() is used to clean up data previously built/appended with
-\fIcurl_formadd(3)\fP. This must be called when the data has been used, which
-typically means after \fIcurl_easy_perform(3)\fP has been called.
-
-The pointer to free is the same pointer you passed to the
-\fICURLOPT_HTTPPOST(3)\fP option, which is the \fIfirstitem\fP pointer from
-the \fIcurl_formadd(3)\fP invoke(s).
-
-\fBform\fP is the pointer as returned from a previous call to
-\fIcurl_formadd(3)\fP and may be NULL.
-
-Passing in a NULL pointer in \fIform\fP makes this function return immediately
-with no action.
-.SH EXAMPLE
-.nf
-  /* Fill in a file upload field */
-  curl_formadd(&formpost,
-               &lastptr,
-               CURLFORM_COPYNAME, "file",
-               CURLFORM_FILE, "nice-image.jpg",
-               CURLFORM_END);
-
-  curl_easy_setopt(curl, CURLOPT_HTTPPOST, formpost);
-
-  curl_easy_perform(curl);
-
-  /* then cleanup the formpost chain */
-  curl_formfree(formpost);
-.fi
-.SH AVAILABILITY
-Deprecated in 7.56.0.
-.SH RETURN VALUE
-None
-.SH "SEE ALSO"
-.BR curl_formadd "(3), " curl_mime_init "(3), " curl_mime_free "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_formfree.md b/third-party/curl/docs/libcurl/curl_formfree.md
new file mode 100644
index 0000000000..d7b4e303d3
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_formfree.md
@@ -0,0 +1,83 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_formfree
+Section: 3
+Source: libcurl
+See-also:
+  - curl_formadd (3)
+  - curl_mime_free (3)
+  - curl_mime_init (3)
+Protocol:
+  - HTTP
+Added-in: 7.1
+---
+
+# NAME
+
+curl_formfree - free a previously build multipart form post chain
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+void curl_formfree(struct curl_httppost *form);
+~~~
+
+# DESCRIPTION
+
+This function is deprecated. Do not use. See curl_mime_init(3) instead.
+
+curl_formfree() is used to clean up data previously built/appended with
+curl_formadd(3). This must be called when the data has been used, which
+typically means after curl_easy_perform(3) has been called.
+
+The pointer to free is the same pointer you passed to the
+CURLOPT_HTTPPOST(3) option, which is the *firstitem* pointer from
+the curl_formadd(3) invoke(s).
+
+**form** is the pointer as returned from a previous call to
+curl_formadd(3) and may be NULL.
+
+Passing in a NULL pointer in *form* makes this function return immediately
+with no action.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    struct curl_httppost *formpost;
+    struct curl_httppost *lastptr;
+
+    /* Fill in a file upload field */
+    curl_formadd(&formpost,
+                 &lastptr,
+                 CURLFORM_COPYNAME, "file",
+                 CURLFORM_FILE, "nice-image.jpg",
+                 CURLFORM_END);
+
+    curl_easy_setopt(curl, CURLOPT_HTTPPOST, formpost);
+
+    curl_easy_perform(curl);
+
+    /* then cleanup the formpost chain */
+    curl_formfree(formpost);
+  }
+}
+~~~
+
+# DEPRECATED
+
+Deprecated in 7.56.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+None
diff --git a/third-party/curl/docs/libcurl/curl_formget.3 b/third-party/curl/docs/libcurl/curl_formget.3
deleted file mode 100644
index 87e2d8de3a..0000000000
--- a/third-party/curl/docs/libcurl/curl_formget.3
+++ /dev/null
@@ -1,73 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_formget 3 "20 June 2006" "libcurl" "libcurl"
-.SH NAME
-curl_formget - serialize a previously built multipart form POST chain
-.SH SYNOPSIS
-.nf
-.B #include <curl/curl.h>
-
-int curl_formget(struct curl_httppost * form, void *userp,
-                  curl_formget_callback append );
-.SH DESCRIPTION
-curl_formget() is used to serialize data previously built/appended with
-\fIcurl_formadd(3)\fP. Accepts a void pointer as second argument named
-\fIuserp\fP which is passed as the first argument to the curl_formget_callback
-function.
-
-.BI "typedef size_t (*curl_formget_callback)(void *" userp, " const char *" buf,
-.BI " size_t " len ");"
-
-The curl_formget_callback is invoked for each part of the HTTP POST chain. The
-character buffer passed to the callback must not be freed. The callback should
-return the buffer length passed to it on success.
-
-If the \fBCURLFORM_STREAM\fP option is used in the formpost, it prevents
-\fIcurl_formget(3)\fP from working until you have performed the actual HTTP
-request. This, because first then does libcurl known which actual read
-callback to use!
-.SH EXAMPLE
-.nf
- size_t print_httppost_callback(void *arg, const char *buf, size_t len)
- {
-   fwrite(buf, len, 1, stdout);
-   (*(size_t *) arg) += len;
-   return len;
- }
-
- size_t print_httppost(struct curl_httppost *post)
- {
-   size_t total_size = 0;
-   if(curl_formget(post, &total_size, print_httppost_callback)) {
-     return (size_t) -1;
-   }
-   return total_size;
- }
-.SH AVAILABILITY
-This function was added in libcurl 7.15.5. The form API is deprecated in
-libcurl 7.56.0.
-.SH RETURN VALUE
-0 means everything was OK, non-zero means an error occurred
-.SH "SEE ALSO"
-.BR curl_formadd "(3), " curl_mime_init "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_formget.md b/third-party/curl/docs/libcurl/curl_formget.md
new file mode 100644
index 0000000000..0da0150a90
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_formget.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_formget
+Section: 3
+Source: libcurl
+See-also:
+  - curl_formadd (3)
+  - curl_mime_init (3)
+Protocol:
+  - HTTP
+Added-in: 7.15.5
+---
+
+# NAME
+
+curl_formget - serialize a multipart form POST chain
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+int curl_formget(struct curl_httppost * form, void *userp,
+                 curl_formget_callback append);
+~~~
+
+# DESCRIPTION
+
+The form API (including this function) is deprecated since libcurl 7.56.0.
+
+curl_formget() serializes data previously built with curl_formadd(3). It
+accepts a void pointer as second argument named *userp* which is passed as the
+first argument to the curl_formget_callback function.
+
+~~~c
+typedef size_t (*curl_formget_callback)(void *userp, const char *buf,
+                                        size_t len);
+~~~
+
+The *curl_formget_callback* is invoked for each part of the HTTP POST chain.
+The character buffer passed to the callback must not be freed. The callback
+should return the buffer length passed to it on success.
+
+If the **CURLFORM_STREAM** option is used in the formpost, it prevents
+curl_formget(3) from working until you have performed the actual HTTP request.
+This, because first then does libcurl known which actual read callback to use.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+size_t print_httppost_callback(void *arg, const char *buf, size_t len)
+{
+  fwrite(buf, len, 1, stdout);
+  *((size_t *)arg) += len;
+  return len;
+}
+
+size_t print_httppost(struct curl_httppost *post)
+{
+  size_t total_size = 0;
+  if(curl_formget(post, &total_size, print_httppost_callback)) {
+    return (size_t)-1;
+  }
+  return total_size;
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+0 means everything was OK, non-zero means an error occurred
diff --git a/third-party/curl/docs/libcurl/curl_free.3 b/third-party/curl/docs/libcurl/curl_free.3
deleted file mode 100644
index 389d505395..0000000000
--- a/third-party/curl/docs/libcurl/curl_free.3
+++ /dev/null
@@ -1,53 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_free 3 "12 Aug 2003" "libcurl" "libcurl"
-.SH NAME
-curl_free - reclaim memory that has been obtained through a libcurl call
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-void curl_free(void *ptr);
-.fi
-.SH DESCRIPTION
-curl_free reclaims memory that has been obtained through a libcurl call. Use
-\fIcurl_free(3)\fP instead of free() to avoid anomalies that can result from
-differences in memory management between your application and libcurl.
-
-Passing in a NULL pointer in \fIptr\fP makes this function return immediately
-with no action.
-.SH EXAMPLE
-.nf
-  char *width = curl_getenv("COLUMNS");
-  if(width) {
-    /* it was set! */
-    curl_free(width);
-  }
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-None
-.SH "SEE ALSO"
-.BR curl_easy_unescape "(3), " curl_easy_escape "(3) "
diff --git a/third-party/curl/docs/libcurl/curl_free.md b/third-party/curl/docs/libcurl/curl_free.md
new file mode 100644
index 0000000000..c10ca28034
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_free.md
@@ -0,0 +1,55 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_free
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_escape (3)
+  - curl_easy_unescape (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+curl_free - reclaim memory that has been obtained through a libcurl call
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+void curl_free(void *ptr);
+~~~
+
+# DESCRIPTION
+
+curl_free reclaims memory that has been obtained through a libcurl call. Use
+curl_free(3) instead of free() to avoid anomalies that can result from
+differences in memory management between your application and libcurl.
+
+Passing in a NULL pointer in *ptr* makes this function return immediately
+with no action.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  char *width = curl_getenv("COLUMNS");
+  if(width) {
+    /* it was set */
+    curl_free(width);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+None
diff --git a/third-party/curl/docs/libcurl/curl_getdate.3 b/third-party/curl/docs/libcurl/curl_getdate.3
deleted file mode 100644
index d665f8801c..0000000000
--- a/third-party/curl/docs/libcurl/curl_getdate.3
+++ /dev/null
@@ -1,120 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-a.TH curl_getdate 3 "12 Aug 2005" "libcurl" "libcurl"
-.SH NAME
-curl_getdate - Convert a date string to number of seconds
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-time_t curl_getdate(char *datestring, time_t *now);
-.fi
-.SH DESCRIPTION
-\fIcurl_getdate(3)\fP returns the number of seconds since the Epoch, January
-1st 1970 00:00:00 in the UTC time zone, for the date and time that the
-\fIdatestring\fP parameter specifies. The \fInow\fP parameter is not used,
-pass a NULL there.
-
-This function works with valid dates and does not always detect and reject
-wrong dates, such as February 30.
-
-.SH PARSING DATES AND TIMES
-A "date" is a string containing several items separated by whitespace. The
-order of the items is immaterial. A date string may contain many flavors of
-items:
-.TP 0.8i
-.B calendar date items
-Can be specified several ways. Month names can only be three-letter English
-abbreviations, numbers can be zero-prefixed and the year may use 2 or 4
-digits.  Examples: 06 Nov 1994, 06-Nov-94 and Nov-94 6.
-.TP
-.B time of the day items
-This string specifies the time on a given day. You must specify it with 6
-digits with two colons: HH:MM:SS. If there is no time given in a provided date
-string, 00:00:00 is assumed. Example: 18:19:21.
-.TP
-.B time zone items
-Specifies international time zone. There are a few acronyms supported, but in
-general you should instead use the specific relative time compared to
-UTC. Supported formats include: -1200, MST, +0100.
-.TP
-.B day of the week items
-Specifies a day of the week. Days of the week may be spelled out in full
-(using English): `Sunday', `Monday', etc or they may be abbreviated to their
-first three letters. This is usually not info that adds anything.
-.TP
-.B pure numbers
-If a decimal number of the form YYYYMMDD appears, then YYYY is read as the
-year, MM as the month number and DD as the day of the month, for the specified
-calendar date.
-.SH EXAMPLE
-.nf
- time_t t;
- t = curl_getdate("Sun, 06 Nov 1994 08:49:37 GMT", NULL);
- t = curl_getdate("Sunday, 06-Nov-94 08:49:37 GMT", NULL);
- t = curl_getdate("Sun Nov  6 08:49:37 1994", NULL);
- t = curl_getdate("06 Nov 1994 08:49:37 GMT", NULL);
- t = curl_getdate("06-Nov-94 08:49:37 GMT", NULL);
- t = curl_getdate("Nov  6 08:49:37 1994", NULL);
- t = curl_getdate("06 Nov 1994 08:49:37", NULL);
- t = curl_getdate("06-Nov-94 08:49:37", NULL);
- t = curl_getdate("1994 Nov 6 08:49:37", NULL);
- t = curl_getdate("GMT 08:49:37 06-Nov-94 Sunday", NULL);
- t = curl_getdate("94 6 Nov 08:49:37", NULL);
- t = curl_getdate("1994 Nov 6", NULL);
- t = curl_getdate("06-Nov-94", NULL);
- t = curl_getdate("Sun Nov 6 94", NULL);
- t = curl_getdate("1994.Nov.6", NULL);
- t = curl_getdate("Sun/Nov/6/94/GMT", NULL);
- t = curl_getdate("Sun, 06 Nov 1994 08:49:37 CET", NULL);
- t = curl_getdate("06 Nov 1994 08:49:37 EST", NULL);
- t = curl_getdate("Sun, 12 Sep 2004 15:05:58 -0700", NULL);
- t = curl_getdate("Sat, 11 Sep 2004 21:32:11 +0200", NULL);
- t = curl_getdate("20040912 15:05:58 -0700", NULL);
- t = curl_getdate("20040911 +0200", NULL);
-.fi
-.SH STANDARDS
-This parser handles date formats specified in RFC 822 (including the update in
-RFC 1123) using time zone name or time zone delta and RFC 850 (obsoleted by
-RFC 1036) and ANSI C's \fIasctime()\fP format.
-
-These formats are the only ones RFC 7231 says HTTP applications may use.
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-This function returns -1 when it fails to parse the date string. Otherwise it
-returns the number of seconds as described.
-
-On systems with a signed 32 bit time_t: if the year is larger than 2037 or
-less than 1903, this function returns -1.
-
-On systems with an unsigned 32 bit time_t: if the year is larger than 2106 or
-less than 1970, this function returns -1.
-
-On systems with 64 bit time_t: if the year is less than 1583, this function
-returns -1. (The Gregorian calendar was first introduced 1582 so no "real"
-dates in this way of doing dates existed before then.)
-.SH "SEE ALSO"
-.BR curl_easy_escape "(3), " curl_easy_unescape "(3), "
-.BR CURLOPT_TIMECONDITION "(3), " CURLOPT_TIMEVALUE "(3) "
diff --git a/third-party/curl/docs/libcurl/curl_getdate.md b/third-party/curl/docs/libcurl/curl_getdate.md
new file mode 100644
index 0000000000..00b4f9b73e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_getdate.md
@@ -0,0 +1,134 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_getdate
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_TIMECONDITION (3)
+  - CURLOPT_TIMEVALUE (3)
+  - curl_easy_escape (3)
+  - curl_easy_unescape (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+curl_getdate - convert date string to number of seconds
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+time_t curl_getdate(const char *datestring, const time_t *now);
+~~~
+
+# DESCRIPTION
+
+curl_getdate(3) returns the number of seconds since the Epoch, January
+1st 1970 00:00:00 in the UTC time zone, for the date and time that the
+*datestring* parameter specifies. The *now* parameter is not used,
+pass a NULL there.
+
+This function works with valid dates and does not always detect and reject
+wrong dates, such as February 30.
+
+# PARSING DATES AND TIMES
+
+A "date" is a string containing several items separated by whitespace. The
+order of the items is immaterial. A date string may contain many flavors of
+items:
+
+## calendar date items
+
+Can be specified several ways. Month names can only be three-letter English
+abbreviations, numbers can be zero-prefixed and the year may use 2 or 4
+digits. Examples: 06 Nov 1994, 06-Nov-94 and Nov-94 6.
+
+If the year appears to be below 100 (two-digit), any year after 70 is assumed
+to be 1900 + the given year. All others are 2000 + the given year.
+
+## time of the day items
+
+This string specifies the time on a given day. You must specify it with 6
+digits with two colons: HH:MM:SS. If there is no time given in a provided date
+string, 00:00:00 is assumed. Example: 18:19:21.
+
+## time zone items
+
+Specifies international time zone. There are a few acronyms supported, but in
+general you should instead use the specific relative time compared to
+UTC. Supported formats include: -1200, MST, +0100.
+
+## day of the week items
+
+Specifies a day of the week. Days of the week may be spelled out in full
+(using English): 'Sunday', 'Monday', etc or they may be abbreviated to their
+first three letters. This is usually not info that adds anything.
+
+## pure numbers
+
+If a decimal number of the form YYYYMMDD appears, then YYYY is read as the
+year, MM as the month number and DD as the day of the month, for the specified
+calendar date.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  time_t t;
+  t = curl_getdate("Sun, 06 Nov 1994 08:49:37 GMT", NULL);
+  t = curl_getdate("Sunday, 06-Nov-94 08:49:37 GMT", NULL);
+  t = curl_getdate("Sun Nov  6 08:49:37 1994", NULL);
+  t = curl_getdate("06 Nov 1994 08:49:37 GMT", NULL);
+  t = curl_getdate("06-Nov-94 08:49:37 GMT", NULL);
+  t = curl_getdate("Nov  6 08:49:37 1994", NULL);
+  t = curl_getdate("06 Nov 1994 08:49:37", NULL);
+  t = curl_getdate("06-Nov-94 08:49:37", NULL);
+  t = curl_getdate("1994 Nov 6 08:49:37", NULL);
+  t = curl_getdate("GMT 08:49:37 06-Nov-94 Sunday", NULL);
+  t = curl_getdate("94 6 Nov 08:49:37", NULL);
+  t = curl_getdate("1994 Nov 6", NULL);
+  t = curl_getdate("06-Nov-94", NULL);
+  t = curl_getdate("Sun Nov 6 94", NULL);
+  t = curl_getdate("1994.Nov.6", NULL);
+  t = curl_getdate("Sun/Nov/6/94/GMT", NULL);
+  t = curl_getdate("Sun, 06 Nov 1994 08:49:37 CET", NULL);
+  t = curl_getdate("06 Nov 1994 08:49:37 EST", NULL);
+  t = curl_getdate("Sun, 12 Sep 2004 15:05:58 -0700", NULL);
+  t = curl_getdate("Sat, 11 Sep 2004 21:32:11 +0200", NULL);
+  t = curl_getdate("20040912 15:05:58 -0700", NULL);
+  t = curl_getdate("20040911 +0200", NULL);
+}
+~~~
+
+# STANDARDS
+
+This parser handles date formats specified in RFC 822 (including the update in
+RFC 1123) using time zone name or time zone delta and RFC 850 (obsoleted by
+RFC 1036) and ANSI C's *asctime()* format.
+
+These formats are the only ones RFC 7231 says HTTP applications may use.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns -1 when it fails to parse the date string. Otherwise it
+returns the number of seconds as described.
+
+On systems with a signed 32-bit time_t: if the year is larger than 2037 or
+less than 1903, this function returns -1.
+
+On systems with an unsigned 32-bit time_t: if the year is larger than 2106 or
+less than 1970, this function returns -1.
+
+On systems with 64-bit time_t: if the year is less than 1583, this function
+returns -1. (The Gregorian calendar was first introduced 1582 so no "real"
+dates in this way of doing dates existed before then.)
diff --git a/third-party/curl/docs/libcurl/curl_getenv.3 b/third-party/curl/docs/libcurl/curl_getenv.3
deleted file mode 100644
index 2813bc90a9..0000000000
--- a/third-party/curl/docs/libcurl/curl_getenv.3
+++ /dev/null
@@ -1,57 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_getenv 3 "30 April 2004" "libcurl" "libcurl"
-.SH NAME
-curl_getenv - return value for environment name
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-char *curl_getenv(const char *name);
-.fi
-.SH DESCRIPTION
-curl_getenv() is a portable wrapper for the getenv() function, meant to
-emulate its behavior and provide an identical interface for all operating
-systems libcurl builds on (including win32).
-
-You must \fIcurl_free(3)\fP the returned string when you are done with it.
-.SH EXAMPLE
-.nf
-  char *width = curl_getenv("COLUMNS");
-  if(width) {
-    /* it was set! */
-    curl_free(width);
-  }
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-A pointer to a null-terminated string or NULL if it failed to find the
-specified name.
-.SH NOTE
-Under unix operating systems, there is no point in returning an allocated
-memory, although other systems does not work properly if this is not done. The
-unix implementation thus suffers slightly from the drawbacks of other systems.
-.SH "SEE ALSO"
-.BR getenv "(3C), "
diff --git a/third-party/curl/docs/libcurl/curl_getenv.md b/third-party/curl/docs/libcurl/curl_getenv.md
new file mode 100644
index 0000000000..047c913f25
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_getenv.md
@@ -0,0 +1,61 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_getenv
+Section: 3
+Source: libcurl
+See-also:
+  - getenv (3C)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+curl_getenv - return value for environment name
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+char *curl_getenv(const char *name);
+~~~
+
+# DESCRIPTION
+
+curl_getenv() is a portable wrapper for the getenv() function, meant to
+emulate its behavior and provide an identical interface for all operating
+systems libcurl builds on (including Windows).
+
+You must curl_free(3) the returned string when you are done with it and,
+although not constrained by its type, it may not be altered.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  char *width = curl_getenv("COLUMNS");
+  if(width) {
+    /* it was set */
+    curl_free(width);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+A pointer to a null-terminated string or NULL if it failed to find the
+specified name.
+
+# NOTE
+
+Under Unix operating systems, there is no point in returning an allocated
+memory, although other systems does not work properly if this is not done. The
+Unix implementation thus suffers slightly from the drawbacks of other systems.
diff --git a/third-party/curl/docs/libcurl/curl_global_cleanup.3 b/third-party/curl/docs/libcurl/curl_global_cleanup.3
deleted file mode 100644
index 790ad862ad..0000000000
--- a/third-party/curl/docs/libcurl/curl_global_cleanup.3
+++ /dev/null
@@ -1,74 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_global_cleanup 3 "17 Feb 2006" "libcurl" "libcurl"
-.SH NAME
-curl_global_cleanup - global libcurl cleanup
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-void curl_global_cleanup(void);
-.fi
-.SH DESCRIPTION
-This function releases resources acquired by \fIcurl_global_init(3)\fP.
-
-You should call \fIcurl_global_cleanup(3)\fP once for each call you make to
-\fIcurl_global_init(3)\fP, after you are done using libcurl.
-
-This function is thread-safe since libcurl 7.84.0 if
-\fIcurl_version_info(3)\fP has the CURL_VERSION_THREADSAFE feature bit set
-(most platforms).
-
-If this is not thread-safe, you must not call this function when any other
-thread in the program (i.e. a thread sharing the same memory) is running.
-This does not just mean no other thread that is using libcurl. Because
-\fIcurl_global_cleanup(3)\fP calls functions of other libraries that are
-similarly thread unsafe, it could conflict with any other thread that uses
-these other libraries.
-
-See the description in \fIlibcurl(3)\fP of global environment requirements for
-details of how to use this function.
-.SH CAUTION
-\fIcurl_global_cleanup(3)\fP does not block waiting for any libcurl-created
-threads to terminate (such as threads used for name resolving). If a module
-containing libcurl is dynamically unloaded while libcurl-created threads are
-still running then your program may crash or other corruption may occur. We
-recommend you do not run libcurl from any module that may be unloaded
-dynamically. This behavior may be addressed in the future.
-.SH EXAMPLE
-.nf
- curl_global_init(CURL_GLOBAL_DEFAULT);
-
- /* use libcurl, then before exiting... */
-
- curl_global_cleanup();
-.fi
-.SH AVAILABILITY
-Added in 7.8
-.SH RETURN VALUE
-None
-.SH "SEE ALSO"
-.BR curl_global_init "(3), "
-.BR libcurl "(3), "
-.BR libcurl-thread "(3), "
diff --git a/third-party/curl/docs/libcurl/curl_global_cleanup.md b/third-party/curl/docs/libcurl/curl_global_cleanup.md
new file mode 100644
index 0000000000..e6f8e42fd7
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_global_cleanup.md
@@ -0,0 +1,82 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_global_cleanup
+Section: 3
+Source: libcurl
+See-also:
+  - curl_global_init (3)
+  - libcurl (3)
+  - libcurl-thread (3)
+Protocol:
+  - All
+Added-in: 7.8
+---
+
+# NAME
+
+curl_global_cleanup - global libcurl cleanup
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+void curl_global_cleanup(void);
+~~~
+
+# DESCRIPTION
+
+This function releases resources acquired by curl_global_init(3).
+
+You should call curl_global_cleanup(3) once for each call you make to
+curl_global_init(3), after you are done using libcurl.
+
+This function is thread-safe since libcurl 7.84.0 if
+curl_version_info(3) has the CURL_VERSION_THREADSAFE feature bit set
+(most platforms).
+
+If this is not thread-safe, you must not call this function when any other
+thread in the program (i.e. a thread sharing the same memory) is running. This
+does not only mean other threads that use libcurl. Because
+curl_global_cleanup(3) calls functions of other libraries that are similarly
+thread-unsafe, it could conflict with any other thread that uses these other
+libraries.
+
+See the description in libcurl(3) of global environment requirements for
+details of how to use this function.
+
+# CAUTION
+
+curl_global_cleanup(3) does not block waiting for any libcurl-created
+threads to terminate (such as threads used for name resolving). If a module
+containing libcurl is dynamically unloaded while libcurl-created threads are
+still running then your program may crash or other corruption may occur. We
+recommend you do not run libcurl from any module that may be unloaded
+dynamically. This behavior may be addressed in the future.
+
+libcurl may not be able to fully clean up after multi-threaded OpenSSL
+depending on how OpenSSL was built and loaded as a library. It is possible in
+some rare circumstances a memory leak could occur unless you implement your own
+OpenSSL thread cleanup. Refer to libcurl-thread(3).
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  curl_global_init(CURL_GLOBAL_DEFAULT);
+
+  /* use libcurl, then before exiting... */
+
+  curl_global_cleanup();
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+None
diff --git a/third-party/curl/docs/libcurl/curl_global_init.3 b/third-party/curl/docs/libcurl/curl_global_init.3
deleted file mode 100644
index 6686447a2a..0000000000
--- a/third-party/curl/docs/libcurl/curl_global_init.3
+++ /dev/null
@@ -1,121 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_global_init 3 "11 May 2004" "libcurl" "libcurl"
-.SH NAME
-curl_global_init - Global libcurl initialization
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_global_init(long flags);
-.fi
-.SH DESCRIPTION
-This function sets up the program environment that libcurl needs. Think of it
-as an extension of the library loader.
-
-This function must be called at least once within a program (a program is all
-the code that shares a memory space) before the program calls any other
-function in libcurl. The environment it sets up is constant for the life of
-the program and is the same for every program, so multiple calls have the same
-effect as one call.
-
-The flags option is a bit pattern that tells libcurl exactly what features to
-init, as described below. Set the desired bits by ORing the values together.
-In normal operation, you must specify CURL_GLOBAL_ALL. Do not use any other
-value unless you are familiar with it and mean to control internal operations
-of libcurl.
-
-This function is thread-safe since libcurl 7.84.0 if
-\fIcurl_version_info(3)\fP has the CURL_VERSION_THREADSAFE feature bit set
-(most platforms).
-
-If this is not thread-safe, you must not call this function when any other
-thread in the program (i.e. a thread sharing the same memory) is running.
-This does not just mean no other thread that is using libcurl. Because
-\fIcurl_global_init(3)\fP calls functions of other libraries that are
-similarly thread unsafe, it could conflict with any other thread that uses
-these other libraries.
-
-If you are initializing libcurl from a Windows DLL you should not initialize
-it from \fIDllMain\fP or a static initializer because Windows holds the loader
-lock during that time and it could cause a deadlock.
-
-See the description in \fIlibcurl(3)\fP of global environment requirements for
-details of how to use this function.
-.SH FLAGS
-.IP CURL_GLOBAL_ALL
-Initialize everything possible. This sets all known bits except
-\fBCURL_GLOBAL_ACK_EINTR\fP.
-
-.IP CURL_GLOBAL_SSL
-(This flag's presence or absence serves no meaning since 7.57.0. The
-description below is for older libcurl versions.)
-
-Initialize SSL.
-
-The implication here is that if this bit is not set, the initialization of the
-SSL layer needs to be done by the application or at least outside of
-libcurl. The exact procedure how to do SSL initialization depends on the TLS
-backend libcurl uses.
-
-Doing TLS based transfers without having the TLS layer initialized may lead to
-unexpected behaviors.
-.IP CURL_GLOBAL_WIN32
-Initialize the Win32 socket libraries.
-
-The implication here is that if this bit is not set, the initialization of
-winsock has to be done by the application or you risk getting undefined
-behaviors. This option exists for when the initialization is handled outside
-of libcurl so there is no need for libcurl to do it again.
-.IP CURL_GLOBAL_NOTHING
-Initialize nothing extra. This sets no bit.
-.IP CURL_GLOBAL_DEFAULT
-A sensible default. It initializes both SSL and Win32. Right now, this equals
-the functionality of the \fBCURL_GLOBAL_ALL\fP mask.
-.IP CURL_GLOBAL_ACK_EINTR
-This bit has no point since 7.69.0 but its behavior is instead the default.
-
-Before 7.69.0: when this flag is set, curl acknowledges EINTR condition when
-connecting or when waiting for data. Otherwise, curl waits until full timeout
-elapses. (Added in 7.30.0)
-.SH EXAMPLE
-.nf
- curl_global_init(CURL_GLOBAL_DEFAULT);
-
- /* use libcurl, then before exiting... */
-
- curl_global_cleanup();
-.fi
-.SH AVAILABILITY
-Added in 7.8
-.SH RETURN VALUE
-If this function returns non-zero, something went wrong and you cannot use the
-other curl functions.
-.SH "SEE ALSO"
-.BR curl_global_init_mem "(3), "
-.BR curl_global_cleanup "(3), "
-.BR curl_global_sslset "(3), "
-.BR curl_easy_init "(3), "
-.BR libcurl "(3), "
-.BR curl_global_trace "(3), "
diff --git a/third-party/curl/docs/libcurl/curl_global_init.md b/third-party/curl/docs/libcurl/curl_global_init.md
new file mode 100644
index 0000000000..c57daa534f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_global_init.md
@@ -0,0 +1,138 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_global_init
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_init (3)
+  - curl_global_cleanup (3)
+  - curl_global_init_mem (3)
+  - curl_global_sslset (3)
+  - curl_global_trace (3)
+  - libcurl (3)
+Protocol:
+  - All
+Added-in: 7.8
+---
+
+# NAME
+
+curl_global_init - global libcurl initialization
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_global_init(long flags);
+~~~
+
+# DESCRIPTION
+
+This function sets up the program environment that libcurl needs. Think of it
+as an extension of the library loader.
+
+This function must be called at least once within a program (a program is all
+the code that shares a memory space) before the program calls any other
+function in libcurl. The environment it sets up is constant for the life of
+the program and is the same for every program, so multiple calls have the same
+effect as one call.
+
+The flags option is a bit pattern that tells libcurl exactly what features to
+init, as described below. Set the desired bits by ORing the values together.
+In normal operation, you must specify CURL_GLOBAL_ALL. Do not use any other
+value unless you are familiar with it and mean to control internal operations
+of libcurl.
+
+This function is thread-safe on most platforms. Then curl_version_info(3) has
+the `threadsafe` feature set (added in 7.84.0).
+
+If this is not thread-safe (the bit mentioned above is not set), you must not
+call this function when any other thread in the program (i.e. a thread sharing
+the same memory) is running. This does not only mean other threads that use
+libcurl. Because curl_global_init(3) calls functions of other libraries that
+are similarly thread-unsafe, it could conflict with any other thread that uses
+these other libraries.
+
+If you are initializing libcurl from a Windows DLL you should not initialize
+it from *DllMain* or a static initializer because Windows holds the loader
+lock during that time and it could cause a deadlock.
+
+See the description in libcurl(3) of global environment requirements for
+details of how to use this function.
+
+# FLAGS
+
+## CURL_GLOBAL_ALL
+
+Initialize everything possible. This sets all known bits except
+**CURL_GLOBAL_ACK_EINTR**.
+
+## CURL_GLOBAL_SSL
+
+(This flag's presence or absence serves no meaning since 7.57.0. The
+description below is for older libcurl versions.)
+
+Initialize SSL.
+
+The implication here is that if this bit is not set, the initialization of the
+SSL layer needs to be done by the application or at least outside of
+libcurl. The exact procedure how to do SSL initialization depends on the TLS
+backend libcurl uses.
+
+Doing TLS based transfers without having the TLS layer initialized may lead to
+unexpected behaviors.
+
+## CURL_GLOBAL_WIN32
+
+Initialize the Win32 socket libraries.
+
+The implication here is that if this bit is not set, the initialization of
+Winsock has to be done by the application or you risk getting undefined
+behaviors. This option exists for when the initialization is handled outside
+of libcurl so there is no need for libcurl to do it again.
+
+## CURL_GLOBAL_NOTHING
+
+Initialize nothing extra. This sets no bit.
+
+## CURL_GLOBAL_DEFAULT
+
+A sensible default. It initializes both SSL and Win32. Right now, this equals
+the functionality of the **CURL_GLOBAL_ALL** mask.
+
+## CURL_GLOBAL_ACK_EINTR
+
+This bit has no point since 7.69.0 but its behavior is instead the default.
+
+Before 7.69.0: when this flag is set, curl acknowledges EINTR condition when
+connecting or when waiting for data. Otherwise, curl waits until full timeout
+elapses.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLcode result;
+
+  result = curl_global_init(CURL_GLOBAL_DEFAULT);
+
+  if(result == CURLE_OK) {
+
+    /* use libcurl, then before exiting... */
+
+    curl_global_cleanup();
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+If this function returns non-zero, something went wrong and you cannot use the
+other curl functions.
diff --git a/third-party/curl/docs/libcurl/curl_global_init_mem.3 b/third-party/curl/docs/libcurl/curl_global_init_mem.3
deleted file mode 100644
index 3e90840422..0000000000
--- a/third-party/curl/docs/libcurl/curl_global_init_mem.3
+++ /dev/null
@@ -1,79 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_global_init_mem 3 "10 May 2004" "libcurl" "libcurl"
-.SH NAME
-curl_global_init_mem - Global libcurl initialization with memory callbacks
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_global_init_mem(long flags,
-                              curl_malloc_callback m,
-                              curl_free_callback f,
-                              curl_realloc_callback r,
-                              curl_strdup_callback s,
-                              curl_calloc_callback c);
-.fi
-.SH DESCRIPTION
-This function works exactly as \fIcurl_global_init(3)\fP with one addition: it
-allows the application to set callbacks to replace the otherwise used internal
-memory functions.
-
-If you are using libcurl from multiple threads or libcurl was built with the
-threaded resolver option then the callback functions must be thread safe. The
-threaded resolver is a common build option to enable (and in some cases the
-default) so we strongly urge you to make your callback functions thread safe.
-
-All callback arguments must be set to valid function pointers. The
-prototypes for the given callbacks must match these:
-.IP "void *malloc_callback(size_t size);"
-To replace malloc()
-.IP "void free_callback(void *ptr);"
-To replace free()
-.IP "void *realloc_callback(void *ptr, size_t size);"
-To replace realloc()
-.IP "char *strdup_callback(const char *str);"
-To replace strdup()
-.IP "void *calloc_callback(size_t nmemb, size_t size);"
-To replace calloc()
-.PP
-This function is otherwise the same as \fIcurl_global_init(3)\fP, please refer
-to that man page for documentation.
-.SH CAUTION
-Manipulating these gives considerable powers to the application to severely
-screw things up for libcurl. Take care!
-.SH EXAMPLE
-.nf
- curl_global_init_mem(CURL_GLOBAL_DEFAULT, curl_malloc_cb,
-                      curl_free_cb, curl_realloc_cb,
-                      curl_strdup_cb, curl_calloc_cb);
-.fi
-.SH AVAILABILITY
-Added in 7.12.0
-.SH RETURN VALUE
-CURLE_OK (0) means everything was OK, non-zero means an error occurred as
-\fI<curl/curl.h>\fP defines - see \fIlibcurl-errors(3)\fP.
-.SH "SEE ALSO"
-.BR curl_global_init "(3), "
-.BR curl_global_cleanup "(3), "
diff --git a/third-party/curl/docs/libcurl/curl_global_init_mem.md b/third-party/curl/docs/libcurl/curl_global_init_mem.md
new file mode 100644
index 0000000000..a39471c729
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_global_init_mem.md
@@ -0,0 +1,111 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_global_init_mem
+Section: 3
+Source: libcurl
+See-also:
+  - curl_global_cleanup (3)
+  - curl_global_init (3)
+Protocol:
+  - All
+Added-in: 7.12.0
+---
+
+# NAME
+
+curl_global_init_mem - global libcurl initialization with memory callbacks
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_global_init_mem(long flags,
+                              curl_malloc_callback m,
+                              curl_free_callback f,
+                              curl_realloc_callback r,
+                              curl_strdup_callback s,
+                              curl_calloc_callback c);
+~~~
+
+# DESCRIPTION
+
+This function works exactly as curl_global_init(3) with one addition: it
+allows the application to set callbacks to replace the otherwise used internal
+memory functions.
+
+If you are using libcurl from multiple threads or libcurl was built with the
+threaded resolver option then the callback functions must be thread-safe. The
+threaded resolver is a common build option to enable (and in some cases the
+default) so we strongly urge you to make your callback functions thread-safe.
+
+All callback arguments must be set to valid function pointers. The
+prototypes for the given callbacks must match these:
+
+## `void *malloc_callback(size_t size);`
+
+To replace malloc()
+
+## `void free_callback(void *ptr);`
+
+To replace free()
+
+## `void *realloc_callback(void *ptr, size_t size);`
+
+To replace realloc()
+
+## `char *strdup_callback(const char *str);`
+
+To replace strdup()
+
+## `void *calloc_callback(size_t nmemb, size_t size);`
+
+To replace calloc()
+
+This function is otherwise the same as curl_global_init(3), please refer
+to that man page for documentation.
+
+# CAUTION
+
+Manipulating these gives considerable powers to the application to severely
+screw things up for libcurl. Take care.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+extern void *malloc_cb(size_t);
+extern void free_cb(void *);
+extern void *realloc_cb(void *, size_t);
+extern char *strdup_cb(const char *);
+extern void *calloc_cb(size_t, size_t);
+
+int main(void)
+{
+  CURLcode result;
+
+  result = curl_global_init_mem(CURL_GLOBAL_DEFAULT, malloc_cb,
+                                free_cb, realloc_cb,
+                                strdup_cb, calloc_cb);
+
+  if(result == CURLE_OK) {
+
+    /* use libcurl, then before exiting... */
+
+    curl_global_cleanup();
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
diff --git a/third-party/curl/docs/libcurl/curl_global_sslset.3 b/third-party/curl/docs/libcurl/curl_global_sslset.3
deleted file mode 100644
index b0ff930df2..0000000000
--- a/third-party/curl/docs/libcurl/curl_global_sslset.3
+++ /dev/null
@@ -1,132 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_global_sslset 3 "15 July 2017" "libcurl" "libcurl"
-.SH NAME
-curl_global_sslset - Select SSL backend to use with libcurl
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-typedef struct {
-  curl_sslbackend id;
-  const char *name;
-} curl_ssl_backend;
-
-typedef enum {
-  CURLSSLBACKEND_NONE = 0,
-  CURLSSLBACKEND_OPENSSL = 1, /* or one of its forks */
-  CURLSSLBACKEND_GNUTLS = 2,
-  CURLSSLBACKEND_NSS = 3,
-  CURLSSLBACKEND_GSKIT = 5, /* deprecated */
-  CURLSSLBACKEND_POLARSSL = 6, /* deprecated */
-  CURLSSLBACKEND_WOLFSSL = 7,
-  CURLSSLBACKEND_SCHANNEL = 8,
-  CURLSSLBACKEND_SECURETRANSPORT = 9,
-  CURLSSLBACKEND_AXTLS = 10, /* deprecated */
-  CURLSSLBACKEND_MBEDTLS = 11,
-  CURLSSLBACKEND_MESALINK = 12, /* deprecated */
-  CURLSSLBACKEND_BEARSSL = 13,
-  CURLSSLBACKEND_RUSTLS = 14
-} curl_sslbackend;
-
-CURLsslset curl_global_sslset(curl_sslbackend id,
-                              const char *name,
-                              curl_ssl_backend ***avail);
-.fi
-.SH DESCRIPTION
-This function configures at runtime which SSL backend to use with
-libcurl. This function can only be used to select an SSL backend once, and it
-must be called \fBbefore\fP \fIcurl_global_init(3)\fP.
-
-The backend can be identified by the \fIid\fP
-(e.g. \fBCURLSSLBACKEND_OPENSSL\fP). The backend can also be specified via the
-\fIname\fP parameter for a case insensitive match (passing -1 as \fIid\fP). If
-both \fIid\fP and \fIname\fP are specified, the \fIname\fP is ignored.
-
-If neither \fIid\fP nor \fPname\fP are specified, the function fails with
-\fBCURLSSLSET_UNKNOWN_BACKEND\fP and set the \fIavail\fP pointer to the
-NULL-terminated list of available backends. The available backends are those
-that this particular build of libcurl supports.
-
-Since libcurl 7.60.0, the \fIavail\fP pointer is always set to the list of
-alternatives if non-NULL.
-
-Upon success, the function returns \fBCURLSSLSET_OK\fP.
-
-If the specified SSL backend is not available, the function returns
-\fBCURLSSLSET_UNKNOWN_BACKEND\fP and sets the \fIavail\fP pointer to a
-NULL-terminated list of available SSL backends. In this case, you may call the
-function again to try to select a different backend.
-
-The SSL backend can be set only once. If it has already been set, a subsequent
-attempt to change it results in a \fBCURLSSLSET_TOO_LATE\fP getting returned.
-
-This function is thread-safe since libcurl 7.84.0 if
-\fIcurl_version_info(3)\fP has the CURL_VERSION_THREADSAFE feature bit set
-(most platforms).
-
-If this is not thread-safe, you must not call this function when any other
-thread in the program (i.e. a thread sharing the same memory) is running.
-This does not just mean no other thread that is using libcurl.
-.SH OpenSSL
-The name "OpenSSL" is used for all versions of OpenSSL and its associated
-forks/flavors in this function. OpenSSL, BoringSSL, libressl, quictls and
-AmiSSL are all supported by libcurl, but in the eyes of
-\fIcurl_global_sslset(3)\fP they are all just "OpenSSL". They all mostly
-provide the same API.
-
-\fIcurl_version_info(3)\fP can return more specific info about the exact
-OpenSSL flavor and version number is use.
-.SH EXAMPLE
-.nf
-  /* choose a specific backend */
-  curl_global_sslset(CURLSSLBACKEND_WOLFSSL, NULL, NULL);
-
-  /* list the available ones */
-  const curl_ssl_backend **list;
-  curl_global_sslset((curl_sslbackend)-1, NULL, &list);
-
-  for(i = 0; list[i]; i++)
-    printf("SSL backend #%d: '%s' (ID: %d)\\n",
-           i, list[i]->name, list[i]->id);
-.fi
-.SH AVAILABILITY
-This function was added in libcurl 7.56.0. Before this version, there was no
-support for choosing SSL backends at runtime.
-.SH RETURN VALUE
-If this function returns \fICURLSSLSET_OK\fP, the backend was successfully
-selected.
-
-If the chosen backend is unknown (or support for the chosen backend has not
-been compiled into libcurl), the function returns
-\fICURLSSLSET_UNKNOWN_BACKEND\fP.
-
-If the backend had been configured previously, or if \fIcurl_global_init(3)\fP
-has already been called, the function returns \fICURLSSLSET_TOO_LATE\fP.
-
-If this libcurl was built completely without SSL support, with no backends at
-all, this function returns \fICURLSSLSET_NO_BACKENDS\fP.
-.SH "SEE ALSO"
-.BR curl_global_init "(3), "
-.BR libcurl "(3) "
diff --git a/third-party/curl/docs/libcurl/curl_global_sslset.md b/third-party/curl/docs/libcurl/curl_global_sslset.md
new file mode 100644
index 0000000000..ccc7b7aa61
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_global_sslset.md
@@ -0,0 +1,141 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_global_sslset
+Section: 3
+Source: libcurl
+See-also:
+  - curl_global_init (3)
+  - libcurl (3)
+Protocol:
+  - All
+Added-in: 7.56.0
+---
+
+# NAME
+
+curl_global_sslset - select SSL backend to use
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLsslset curl_global_sslset(curl_sslbackend id,
+                              const char *name,
+                              const curl_ssl_backend ***avail);
+~~~
+
+# DESCRIPTION
+
+This function configures at runtime which SSL backend to use with
+libcurl. This function can only be used to select an SSL backend once, and it
+must be called **before** curl_global_init(3).
+
+The backend can be identified by the *id*
+(e.g. **CURLSSLBACKEND_OPENSSL**). The backend can also be specified via the
+*name* parameter for a case insensitive match (passing
+**CURLSSLBACKEND_NONE** as *id*). If both *id* and *name* are
+specified, the *name* is ignored.
+
+If neither *id* nor *name* are specified, the function fails with
+**CURLSSLSET_UNKNOWN_BACKEND** and set the *avail* pointer to the
+null-terminated list of available backends. The available backends are those
+that this particular build of libcurl supports.
+
+Since libcurl 7.60.0, the *avail* pointer is always set to the list of
+alternatives if non-NULL.
+
+Upon success, the function returns **CURLSSLSET_OK**.
+
+If the specified SSL backend is not available, the function returns
+**CURLSSLSET_UNKNOWN_BACKEND** and sets the *avail* pointer to a
+null-terminated list of available SSL backends. In this case, you may call the
+function again to try to select a different backend.
+
+The SSL backend can be set only once. If it has already been set, a subsequent
+attempt to change it results in a **CURLSSLSET_TOO_LATE** getting returned.
+
+This function is thread-safe since libcurl 7.84.0 if
+curl_version_info(3) has the CURL_VERSION_THREADSAFE feature bit set
+(most platforms).
+
+If this is not thread-safe, you must not call this function when any other
+thread in the program (i.e. a thread sharing the same memory) is running.
+This does not only mean no other thread that is using libcurl.
+
+# Names
+
+SSL backend names (case-insensitive): GnuTLS, mbedTLS, OpenSSL, Rustls,
+Schannel, wolfSSL
+
+The name "OpenSSL" is used for all versions of OpenSSL and its associated
+forks/flavors in this function. AmiSSL, AWS-LC, BoringSSL, LibreSSL, OpenSSL
+and quictls are all supported by libcurl, but in the eyes of
+curl_global_sslset(3) they are all called "OpenSSL". They all mostly provide
+the same API. curl_version_info(3) can return more specific info about the
+exact OpenSSL flavor and version number in use.
+
+# struct
+
+~~~c
+typedef struct {
+  curl_sslbackend id;
+  const char *name;
+} curl_ssl_backend;
+
+typedef enum {
+  CURLSSLBACKEND_NONE = 0,
+  CURLSSLBACKEND_OPENSSL = 1, /* or one of its forks */
+  CURLSSLBACKEND_GNUTLS = 2,
+  CURLSSLBACKEND_NSS = 3,
+  CURLSSLBACKEND_GSKIT = 5, /* deprecated */
+  CURLSSLBACKEND_POLARSSL = 6, /* deprecated */
+  CURLSSLBACKEND_WOLFSSL = 7,
+  CURLSSLBACKEND_SCHANNEL = 8,
+  CURLSSLBACKEND_SECURETRANSPORT = 9, /* deprecated */
+  CURLSSLBACKEND_AXTLS = 10, /* deprecated */
+  CURLSSLBACKEND_MBEDTLS = 11,
+  CURLSSLBACKEND_MESALINK = 12, /* deprecated */
+  CURLSSLBACKEND_BEARSSL = 13, /* deprecated */
+  CURLSSLBACKEND_RUSTLS = 14
+} curl_sslbackend;
+~~~
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  int i;
+  /* choose a specific backend */
+  curl_global_sslset(CURLSSLBACKEND_WOLFSSL, NULL, NULL);
+
+  /* list the available ones */
+  const curl_ssl_backend **list;
+  curl_global_sslset(CURLSSLBACKEND_NONE, NULL, &list);
+
+  for(i = 0; list[i]; i++)
+    printf("SSL backend #%d: '%s' (ID: %d)\n",
+           i, list[i]->name, list[i]->id);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+If this function returns *CURLSSLSET_OK*, the backend was successfully
+selected.
+
+If the chosen backend is unknown (or support for the chosen backend has not
+been compiled into libcurl), the function returns
+*CURLSSLSET_UNKNOWN_BACKEND*.
+
+If the backend had been configured previously, or if curl_global_init(3)
+has already been called, the function returns *CURLSSLSET_TOO_LATE*.
+
+If this libcurl was built completely without SSL support, with no backends at
+all, this function returns *CURLSSLSET_NO_BACKENDS*.
diff --git a/third-party/curl/docs/libcurl/curl_global_trace.3 b/third-party/curl/docs/libcurl/curl_global_trace.3
deleted file mode 100644
index c1cc1a3442..0000000000
--- a/third-party/curl/docs/libcurl/curl_global_trace.3
+++ /dev/null
@@ -1,118 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_global_trace 3 "01 August 2023" "libcurl" "libcurl"
-.SH NAME
-curl_global_trace - Global libcurl logging configuration
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_global_trace(const char *config);
-.fi
-.SH DESCRIPTION
-This function configures the logging behavior, allowing to make some
-parts of curl more verbose or silent than others.
-
-This function may be called during the initialization phase of a program. It
-does not have to be. It can be called several times even, possibly overwriting
-settings of previous calls.
-
-Calling this function after transfers have been started is undefined. On
-some platforms/architectures it might take effect, on others not.
-
-This function is thread-safe since libcurl 8.3.0 if
-\fIcurl_version_info(3)\fP has the CURL_VERSION_THREADSAFE feature bit set
-(most platforms).
-
-If this is not thread-safe, you must not call this function when any other
-thread in the program (i.e. a thread sharing the same memory) is running.
-This does not just mean no other thread that is using libcurl. Because
-\fIcurl_global_init(3)\fP may call functions of other libraries that are
-similarly thread unsafe, it could conflict with any other thread that uses
-these other libraries.
-
-If you are initializing libcurl from a Windows DLL you should not initialize
-it from \fIDllMain\fP or a static initializer because Windows holds the loader
-lock during that time and it could cause a deadlock.
-
-The \fIconfig\fP string is a list of comma-separated component names. Names
-are case-insensitive and unknown names are ignored. The special name "all"
-applies to all components. Names may be prefixed with '+' or '-' to enable
-or disable detailed logging for a component.
-
-The list of component names is not part of curl's public API. Names may be
-added or disappear in future versions of libcurl. Since unknown names are
-silently ignored, outdated log configurations does not cause errors when
-upgrading libcurl. Given that, some names can be expected to be fairly stable
-and are listed below for easy reference.
-
-Note that log configuration applies only to transfers where debug logging
-is enabled. See \fICURLOPT_VERBOSE(3)\fP or \fICURLOPT_DEBUGFUNCTION(3)\fP
-on how to control that.
-
-.SH TRACE COMPONENTS
-.IP tcp
-Tracing of TCP socket handling: connect, reads, writes.
-.IP ssl
-Tracing of SSL/TLS operations, whichever SSL backend is used in your build.
-.IP http/2
-Details about HTTP/2 handling: frames, events, I/O, etc.
-.IP http/3
-Details about HTTP/3 handling: connect, frames, events, I/O etc.
-.IP http-proxy
-Involved when transfers are tunneled through a HTTP proxy. "h1-proxy" or
-"h2-proxy" are also involved, depending on the HTTP version negotiated with
-the proxy.
-
-In order to find out all components involved in a transfer, run it with "all"
-configured. You can then see all names involved in your libcurl version in the
-trace.
-
-.SH EXAMPLE
-.nf
- /* log details of HTTP/2 and SSL handling */
- curl_global_trace("http/2,ssl");
-
- /* log all details, except SSL handling */
- curl_global_trace("all,-ssl");
-.fi
-
-Below is a trace sample where "http/2" was configured. The trace output
-of an enabled component appears at the beginning in brackets.
-.nf
-* [HTTP/2] [h2sid=1] cf_send(len=96) submit https://example.com/
-...
-* [HTTP/2] [h2sid=1] FRAME[HEADERS]
-* [HTTP/2] [h2sid=1] 249 header bytes
-...
-.fi
-
-.SH AVAILABILITY
-Added in 8.3
-.SH RETURN VALUE
-If this function returns non-zero, something went wrong and the configuration
-may not have any effects or may only been applied partially.
-.SH "SEE ALSO"
-.BR curl_global_init "(3), "
-.BR libcurl "(3) "
diff --git a/third-party/curl/docs/libcurl/curl_global_trace.md b/third-party/curl/docs/libcurl/curl_global_trace.md
new file mode 100644
index 0000000000..f78f2ca0b0
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_global_trace.md
@@ -0,0 +1,212 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_global_trace
+Section: 3
+Source: libcurl
+See-also:
+  - curl_global_init (3)
+  - libcurl (3)
+Protocol:
+  - All
+Added-in: 8.3.0
+---
+
+# NAME
+
+curl_global_trace - log configuration
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_global_trace(const char *config);
+~~~
+
+# DESCRIPTION
+
+This function configures the logging behavior to make some parts of curl more
+verbose or silent than others.
+
+This function may be called during the initialization phase of a program. It
+does not have to be. It can be called several times even, possibly overwriting
+settings of previous calls.
+
+Calling this function after transfers have been started is undefined. On some
+platforms/architectures it might take effect, on others not.
+
+This function is thread-safe since libcurl 8.3.0 if curl_version_info(3) has
+the CURL_VERSION_THREADSAFE feature bit set (most platforms).
+
+If this is not thread-safe, you must not call this function when any other
+thread in the program (i.e. a thread sharing the same memory) is running. This
+does not only mean no other thread that is using libcurl. Because
+curl_global_init(3) may call functions of other libraries that are similarly
+thread-unsafe, it could conflict with any other thread that uses these other
+libraries.
+
+If you are initializing libcurl from a Windows DLL you should not initialize
+it from *DllMain* or a static initializer because Windows holds the loader
+lock during that time and it could cause a deadlock.
+
+The *config* string is a list of comma-separated component names. Names are
+case-insensitive and unknown names are ignored. The special name "all" applies
+to all components. Names may be prefixed with '+' or '-' to enable or disable
+detailed logging for a component.
+
+The list of component names is not part of curl's public API. Names may be
+added or disappear in future versions of libcurl. Since unknown names are
+silently ignored, outdated log configurations does not cause errors when
+upgrading libcurl. Given that, some names can be expected to be fairly stable
+and are listed below for easy reference.
+
+Note that log configuration applies only to transfers where debug logging is
+enabled. See CURLOPT_VERBOSE(3) or CURLOPT_DEBUGFUNCTION(3) on how to control
+that.
+
+# TRACE COMPONENTS
+
+## `tcp`
+
+Tracing of TCP socket handling: connect, sends, receives.
+
+## `ssl`
+
+Tracing of SSL/TLS operations, whichever SSL backend is used in your build.
+
+## `ftp`
+
+Tracing of FTP operations when this protocol is enabled in your build.
+
+## `http/2`
+
+Details about HTTP/2 handling: frames, events, I/O, etc.
+
+## `http/3`
+
+Details about HTTP/3 handling: connect, frames, events, I/O etc.
+
+## `http-proxy`
+
+Involved when transfers are tunneled through an HTTP proxy. "h1-proxy" or
+"h2-proxy" are also involved, depending on the HTTP version negotiated with
+the proxy.
+
+In order to find out all components involved in a transfer, run it with "all"
+configured. You can then see all names involved in your libcurl version in the
+trace.
+
+## `dns`
+
+Tracing of DNS operations to resolve hostnames and HTTPS records.
+
+## `lib-ids`
+
+Adds transfer and connection identifiers as prefix to every call to
+CURLOPT_DEBUGFUNCTION(3). The format is `[n-m]` where `n` is the identifier
+of the transfer and `m` is the identifier of the connection. A literal `x`
+is used for internal transfers or when no connection is assigned.
+
+For example, `[5-x]` is the prefix for transfer 5 that has no
+connection. The command line tool `curl`uses the same format for its
+`--trace-ids` option.
+
+`lib-ids` is intended for libcurl applications that handle multiple
+transfers but have no own way to identify in trace output which transfer
+a trace event is connected to.
+
+## `doh`
+
+Former name for DNS-over-HTTP operations. Now an alias for `dns`.
+
+## `multi`
+
+Traces multi operations managing transfers' state changes and sockets poll
+states.
+
+## `read`
+
+Traces reading of upload data from the application in order to send it to the
+server.
+
+## `ssh`
+
+Tracing of SSH related protocols SCP and SFTP.
+
+## `ssls`
+
+Tracing of SSL Session handling, e.g. caching/import/export.
+
+## `smtp`
+
+Tracing of SMTP operations when this protocol is enabled in your build.
+
+## `threads`
+
+Tracing of thread queue and pools, used in threaded DNS resolving.
+
+## `timer`
+
+Tracing of timers set for transfers.
+
+## `write`
+
+Traces writing of download data, received from the server, to the application.
+
+## `ws`
+
+Tracing of WebSocket operations when this protocol is enabled in your build.
+
+# TRACE GROUPS
+
+Besides the specific component names there are the following group names
+defined:
+
+## `all`
+
+## `network`
+
+All components involved in bare network I/O, including the SSL layer.
+
+All components that your libcurl is built with.
+
+## `protocol`
+
+All components involved in transfer protocols, such as 'ftp' and 'http/2'.
+
+## `proxy`
+
+All components involved in use of proxies.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  /* log details of HTTP/2 and SSL handling */
+  curl_global_trace("http/2,ssl");
+
+  /* log all details, except SSL handling */
+  curl_global_trace("all,-ssl");
+}
+~~~
+
+Below is a trace sample where "http/2" was configured. The trace output
+of an enabled component appears at the beginning in brackets.
+~~~
+* [HTTP/2] [h2sid=1] cf_send(len=96) submit https://example.com/
+...
+* [HTTP/2] [h2sid=1] FRAME[HEADERS]
+* [HTTP/2] [h2sid=1] 249 header bytes
+...
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+If this function returns non-zero, something went wrong and the configuration
+may not have any effects or may only been applied partially.
diff --git a/third-party/curl/docs/libcurl/curl_mime_addpart.3 b/third-party/curl/docs/libcurl/curl_mime_addpart.3
deleted file mode 100644
index 50abf4a928..0000000000
--- a/third-party/curl/docs/libcurl/curl_mime_addpart.3
+++ /dev/null
@@ -1,69 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_mime_addpart 3 "22 August 2017" "libcurl" "libcurl"
-.SH NAME
-curl_mime_addpart - append a new empty part to a mime structure
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-curl_mimepart *curl_mime_addpart(curl_mime *mime);
-.fi
-.SH DESCRIPTION
-\fIcurl_mime_addpart(3)\fP creates and appends a new empty part to the given
-mime structure and returns a handle to it. The returned part handle can
-subsequently be populated using functions from the mime API.
-
-\fImime\fP is the handle of the mime structure in which the new part must be
-appended.
-.SH EXAMPLE
-.nf
- curl_mime *mime;
- curl_mimepart *part;
-
- /* create a mime handle */
- mime = curl_mime_init(easy);
-
- /* add a part */
- part = curl_mime_addpart(mime);
-
- /* continue and set name + data to the part */
- curl_mime_data(part, "This is the field data", CURL_ZERO_TERMINATED);
- curl_mime_name(part, "data");
-.fi
-.SH AVAILABILITY
-As long as at least one of HTTP, SMTP or IMAP is enabled. Added in 7.56.0.
-.SH RETURN VALUE
-A mime part structure handle, or NULL upon failure.
-.SH "SEE ALSO"
-.BR curl_mime_init "(3),"
-.BR curl_mime_name "(3),"
-.BR curl_mime_data "(3),"
-.BR curl_mime_data_cb "(3),"
-.BR curl_mime_filedata "(3),"
-.BR curl_mime_filename "(3),"
-.BR curl_mime_subparts "(3),"
-.BR curl_mime_type "(3),"
-.BR curl_mime_headers "(3),"
-.BR curl_mime_encoder "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_mime_addpart.md b/third-party/curl/docs/libcurl/curl_mime_addpart.md
new file mode 100644
index 0000000000..9a21295d57
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_mime_addpart.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_mime_addpart
+Section: 3
+Source: libcurl
+See-also:
+  - curl_mime_data (3)
+  - curl_mime_data_cb (3)
+  - curl_mime_encoder (3)
+  - curl_mime_filedata (3)
+  - curl_mime_filename (3)
+  - curl_mime_headers (3)
+  - curl_mime_init (3)
+  - curl_mime_name (3)
+  - curl_mime_subparts (3)
+  - curl_mime_type (3)
+Protocol:
+  - HTTP
+  - IMAP
+  - SMTP
+Added-in: 7.56.0
+---
+
+# NAME
+
+curl_mime_addpart - append a new empty part to a mime structure
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+curl_mimepart *curl_mime_addpart(curl_mime *mime);
+~~~
+
+# DESCRIPTION
+
+curl_mime_addpart(3) creates and appends a new empty part to the given
+mime structure and returns a handle to it. The returned part handle can
+subsequently be populated using functions from the mime API.
+
+*mime* is the handle of the mime structure in which the new part must be
+appended.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  curl_mime *mime;
+  curl_mimepart *part;
+
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    /* create a mime handle */
+    mime = curl_mime_init(curl);
+
+    /* add a part */
+    part = curl_mime_addpart(mime);
+
+    /* continue and set name + data to the part */
+    curl_mime_data(part, "This is the field data", CURL_ZERO_TERMINATED);
+    curl_mime_name(part, "data");
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+A mime part structure handle, or NULL upon failure.
diff --git a/third-party/curl/docs/libcurl/curl_mime_data.3 b/third-party/curl/docs/libcurl/curl_mime_data.3
deleted file mode 100644
index a418ffcdc0..0000000000
--- a/third-party/curl/docs/libcurl/curl_mime_data.3
+++ /dev/null
@@ -1,75 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_mime_data 3 "22 August 2017" "libcurl" "libcurl"
-.SH NAME
-curl_mime_data - set a mime part's body data from memory
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_mime_data(curl_mimepart *part, const char *data,
-                        size_t datasize);
-.fi
-.SH DESCRIPTION
-\fIcurl_mime_data(3)\fP sets a mime part's body content from memory data.
-
-\fIpart\fP is the mime part to assign contents to, created with
-\fIcurl_mime_addpart(3)\fP.
-
-\fIdata\fP points to the data that gets copied by this function. The storage
-may safely be reused after the call.
-
-\fIdatasize\fP is the number of bytes \fIdata\fP points to. It can be set to
-\fICURL_ZERO_TERMINATED\fP to indicate \fIdata\fP is a null-terminated
-character string.
-
-Setting a part's contents multiple times is valid: only the value set by the
-last call is retained. It is possible to unassign part's contents by setting
-\fIdata\fP to NULL.
-
-Setting large data is memory consuming: one might consider using
-\fIcurl_mime_data_cb(3)\fP in such a case.
-.SH EXAMPLE
-.nf
- curl_mime *mime;
- curl_mimepart *part;
-
- /* create a mime handle */
- mime = curl_mime_init(easy);
-
- /* add a part */
- part = curl_mime_addpart(mime);
-
- /* add data to the part  */
- curl_mime_data(part, "raw contents to send", CURL_ZERO_TERMINATED);
-.fi
-.SH AVAILABILITY
-As long as at least one of HTTP, SMTP or IMAP is enabled. Added in 7.56.0.
-.SH RETURN VALUE
-CURLE_OK or a CURL error code upon failure.
-.SH "SEE ALSO"
-.BR curl_mime_addpart "(3),"
-.BR curl_mime_data_cb "(3),"
-.BR curl_mime_name "(3),"
-.BR curl_mime_type "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_mime_data.md b/third-party/curl/docs/libcurl/curl_mime_data.md
new file mode 100644
index 0000000000..a03f6b555b
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_mime_data.md
@@ -0,0 +1,86 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_mime_data
+Section: 3
+Source: libcurl
+See-also:
+  - curl_mime_addpart (3)
+  - curl_mime_data_cb (3)
+  - curl_mime_name (3)
+  - curl_mime_type (3)
+Protocol:
+  - HTTP
+  - IMAP
+  - SMTP
+Added-in: 7.56.0
+---
+
+# NAME
+
+curl_mime_data - set a mime part's body data from memory
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_mime_data(curl_mimepart *part, const char *data,
+                        size_t datasize);
+~~~
+
+# DESCRIPTION
+
+curl_mime_data(3) sets a mime part's body content from memory data.
+
+*part* is the mime part to assign contents to, created with
+curl_mime_addpart(3).
+
+*data* points to the data that gets copied by this function. The storage
+may safely be reused after the call.
+
+*datasize* is the number of bytes *data* points to. It can be set to
+*CURL_ZERO_TERMINATED* to indicate *data* is a null-terminated
+character string.
+
+Setting a part's contents multiple times is valid: only the value set by the
+last call is retained. It is possible to unassign part's contents by setting
+*data* to NULL.
+
+Setting large data is memory consuming: one might consider using
+curl_mime_data_cb(3) in such a case.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  curl_mime *mime;
+  curl_mimepart *part;
+
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    /* create a mime handle */
+    mime = curl_mime_init(curl);
+
+    /* add a part */
+    part = curl_mime_addpart(mime);
+
+    /* add data to the part */
+    curl_mime_data(part, "raw contents to send", CURL_ZERO_TERMINATED);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
diff --git a/third-party/curl/docs/libcurl/curl_mime_data_cb.3 b/third-party/curl/docs/libcurl/curl_mime_data_cb.3
deleted file mode 100644
index c89c68442a..0000000000
--- a/third-party/curl/docs/libcurl/curl_mime_data_cb.3
+++ /dev/null
@@ -1,168 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_mime_data_cb 3 "22 August 2017" "libcurl" "libcurl"
-.SH NAME
-curl_mime_data_cb - set a callback-based data source for a mime part's body
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-size_t readfunc(char *buffer, size_t size, size_t nitems, void *arg);
-
-int seekfunc(void *arg, curl_off_t offset, int origin);
-
-void freefunc(void *arg);
-
-CURLcode curl_mime_data_cb(curl_mimepart *part, curl_off_t datasize,
-                           curl_read_callback readfunc,
-                           curl_seek_callback seekfunc,
-                           curl_free_callback freefunc, void *arg);
-.fi
-.SH DESCRIPTION
-\fIcurl_mime_data_cb(3)\fP sets the data source of a mime part's body content
-from a data read callback function.
-
-\fIpart\fP is the part's to assign contents to.
-
-\fIreadfunc\fP is a pointer to a data read callback function, with a signature
-as shown by the above prototype. It may not be set to NULL.
-
-\fIseekfunc\fP is a pointer to a seek callback function, with a signature as
-shown by the above prototype. This function is used when resending data (i.e.:
-after a redirect); this pointer may be set to NULL, in which case a resend
-might not be not possible.
-
-\fIfreefunc\fP is a pointer to a user resource freeing callback function, with
-a signature as shown by the above prototype. If no resource is to be freed, it
-may safely be set to NULL. This function is called upon mime structure
-freeing.
-
-\fIarg\fP is a user defined argument to callback functions.
-
-The read callback function gets called by libcurl as soon as it needs to
-read data in order to send it to the peer - like if you ask it to upload or
-post data to the server. The data area pointed at by the pointer \fIbuffer\fP
-should be filled up with at most \fIsize\fP multiplied with \fInitems\fP number
-of bytes by your function.
-
-Your read function must then return the actual number of bytes that it stored
-in that memory area. Returning 0 signals end-of-file to the library and cause
-it to stop the current transfer.
-
-If you stop the current transfer by returning 0 "pre-maturely" (i.e. before
-the server expected it, like when you have said you intend to upload N bytes
-and yet you upload less than N bytes), you may experience that the server
-"hangs" waiting for the rest of the data that does not come.
-
-The read callback may return \fICURL_READFUNC_ABORT\fP to stop the current
-operation immediately, resulting in a \fICURLE_ABORTED_BY_CALLBACK\fP error
-code from the transfer.
-
-The callback can return \fICURL_READFUNC_PAUSE\fP to cause reading from this
-connection to pause. See \fIcurl_easy_pause(3)\fP for further details.
-
-The seek function gets called by libcurl to rewind input stream data or to
-seek to a certain position. The function shall work like fseek(3) or lseek(3)
-and it gets SEEK_SET, SEEK_CUR or SEEK_END as argument for \fIorigin\fP,
-although libcurl currently only passes SEEK_SET.
-
-The callback function must return \fICURL_SEEKFUNC_OK\fP on success,
-\fICURL_SEEKFUNC_FAIL\fP to cause the upload operation to fail or
-\fICURL_SEEKFUNC_CANTSEEK\fP to indicate that while the seek failed, libcurl
-is free to work around the problem if possible. The latter can sometimes be
-done by instead reading from the input or similar.
-
-Care must be taken if the part is bound to a curl easy handle that is later
-duplicated: the \fIarg\fP pointer argument is also duplicated, resulting in
-the pointed item to be shared between the original and the copied handle. In
-particular, special attention should be given to the \fIfreefunc\fP procedure
-code since it then gets called twice with the same argument.
-.SH EXAMPLE
-Sending a huge data string causes the same amount of memory to be allocated:
-to avoid overhead resources consumption, one might want to use a callback
-source to avoid data duplication. In this case, original data must be retained
-until after the transfer terminates.
-.nf
-
-char hugedata[512000];
-
-struct ctl {
-  char *buffer;
-  curl_off_t size;
-  curl_off_t position;
-};
-
-size_t read_callback(char *buffer, size_t size, size_t nitems, void *arg)
-{
-  struct ctl *p = (struct ctl *) arg;
-  curl_off_t sz = p->size - p->position;
-
-  nitems *= size;
-  if(sz > nitems)
-    sz = nitems;
-  if(sz)
-    memcpy(buffer, p->buffer + p->position, sz);
-  p->position += sz;
-  return sz;
-}
-
-int seek_callback(void *arg, curl_off_t offset, int origin)
-{
-  struct ctl *p = (struct ctl *) arg;
-
-  switch(origin) {
-  case SEEK_END:
-    offset += p->size;
-    break;
-  case SEEK_CUR:
-    offset += p->position;
-    break;
-  }
-
-  if(offset < 0)
-    return CURL_SEEKFUNC_FAIL;
-  p->position = offset;
-  return CURL_SEEKFUNC_OK;
-}
-
- CURL *easy = curl_easy_init();
- curl_mime *mime = curl_mime_init(easy);
- curl_mimepart *part = curl_mime_addpart(mime);
- struct ctl hugectl;
-
- hugectl.buffer = hugedata;
- hugectl.size = sizeof hugedata;
- hugectl.position = 0;
- curl_mime_data_cb(part, hugectl.size, read_callback, seek_callback, NULL,
-                   &hugectl);
-
-.SH AVAILABILITY
-As long as at least one of HTTP, SMTP or IMAP is enabled. Added in 7.56.0.
-.SH RETURN VALUE
-CURLE_OK or a CURL error code upon failure.
-.SH "SEE ALSO"
-.BR curl_mime_addpart "(3),"
-.BR curl_mime_data "(3),"
-.BR curl_mime_name "(3),"
-.BR curl_easy_duphandle "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_mime_data_cb.md b/third-party/curl/docs/libcurl/curl_mime_data_cb.md
new file mode 100644
index 0000000000..199e4f7037
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_mime_data_cb.md
@@ -0,0 +1,180 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_mime_data_cb
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_duphandle (3)
+  - curl_mime_addpart (3)
+  - curl_mime_data (3)
+  - curl_mime_name (3)
+Protocol:
+  - HTTP
+  - IMAP
+  - SMTP
+Added-in: 7.56.0
+---
+
+# NAME
+
+curl_mime_data_cb - set a callback-based data source for a mime part's body
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+size_t readfunc(char *buffer, size_t size, size_t nitems, void *arg);
+
+int seekfunc(void *arg, curl_off_t offset, int origin);
+
+void freefunc(void *arg);
+
+CURLcode curl_mime_data_cb(curl_mimepart *part, curl_off_t datasize,
+                           curl_read_callback readfunc,
+                           curl_seek_callback seekfunc,
+                           curl_free_callback freefunc, void *arg);
+~~~
+
+# DESCRIPTION
+
+curl_mime_data_cb(3) sets the data source of a mime part's body content
+from a data read callback function.
+
+*part* is the part's to assign contents to.
+
+*datasize* is the number of bytes the read callback is expected to provide.
+
+*readfunc* is a pointer to a data read callback function, with a signature
+as shown by the above prototype. It may not be set to NULL.
+
+*seekfunc* is a pointer to a seek callback function, with a signature as
+shown by the above prototype. This function is used when resending data (i.e.:
+after a redirect); this pointer may be set to NULL, in which case a resend
+might not be not possible.
+
+*freefunc* is a pointer to a user resource freeing callback function, with
+a signature as shown by the above prototype. If no resource is to be freed, it
+may safely be set to NULL. This function is called upon mime structure
+freeing.
+
+*arg* is a user defined argument to callback functions.
+
+The read callback function gets called by libcurl as soon as it needs to
+read data in order to send it to the peer - like if you ask it to upload or
+post data to the server. The data area pointed at by the pointer *buffer*
+should be filled up with at most *size* multiplied with *nitems* number
+of bytes by your function.
+
+Your read function must then return the actual number of bytes that it stored
+in that memory area. Returning 0 signals end-of-file to the library and cause
+it to stop the current transfer.
+
+If you stop the current transfer by returning 0 "pre-maturely" (i.e. before
+the server expected it, like when you have said you intend to upload N bytes
+and yet you upload less than N bytes), you may experience that the server
+"hangs" waiting for the rest of the data that does not come.
+
+The read callback may return *CURL_READFUNC_ABORT* to stop the current
+operation immediately, resulting in a *CURLE_ABORTED_BY_CALLBACK* error
+code from the transfer.
+
+The callback can return *CURL_READFUNC_PAUSE* to cause reading from this
+connection to pause. See curl_easy_pause(3) for further details.
+
+The seek function gets called by libcurl to rewind input stream data or to
+seek to a certain position. The function shall work like fseek(3) or lseek(3)
+and it gets SEEK_SET, SEEK_CUR or SEEK_END as argument for *origin*,
+although libcurl currently only passes SEEK_SET.
+
+The callback function must return *CURL_SEEKFUNC_OK* on success,
+*CURL_SEEKFUNC_FAIL* to cause the upload operation to fail or
+*CURL_SEEKFUNC_CANTSEEK* to indicate that while the seek failed, libcurl
+is free to work around the problem if possible. The latter can sometimes be
+done by instead reading from the input or similar.
+
+Care must be taken if the part is bound to a curl easy handle that is later
+duplicated: the *arg* pointer argument is also duplicated, resulting in
+the pointed item to be shared between the original and the copied handle. In
+particular, special attention should be given to the *freefunc* procedure
+code since it then gets called twice with the same argument.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+Sending a huge data string causes the same amount of memory to be allocated:
+to avoid overhead resources consumption, one might want to use a callback
+source to avoid data duplication. In this case, original data must be retained
+until after the transfer terminates.
+~~~c
+#include <string.h> /* for memcpy */
+char hugedata[512000];
+
+struct ctl {
+  char *buffer;
+  curl_off_t size;
+  curl_off_t position;
+};
+
+size_t read_callback(char *buffer, size_t size, size_t nitems, void *arg)
+{
+  struct ctl *p = (struct ctl *)arg;
+  size_t sz = (size_t)(p->size - p->position);
+
+  nitems *= size;
+  if(sz > nitems)
+    sz = nitems;
+  if(sz)
+    memcpy(buffer, p->buffer + p->position, sz);
+  p->position += sz;
+  return sz;
+}
+
+int seek_callback(void *arg, curl_off_t offset, int origin)
+{
+  struct ctl *p = (struct ctl *) arg;
+
+  switch(origin) {
+  case SEEK_END:
+    offset += p->size;
+    break;
+  case SEEK_CUR:
+    offset += p->position;
+    break;
+  }
+
+  if(offset < 0)
+    return CURL_SEEKFUNC_FAIL;
+  p->position = offset;
+  return CURL_SEEKFUNC_OK;
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    curl_mime *mime = curl_mime_init(curl);
+    curl_mimepart *part = curl_mime_addpart(mime);
+    struct ctl hugectl;
+
+    hugectl.buffer = hugedata;
+    hugectl.size = sizeof(hugedata);
+    hugectl.position = 0;
+    curl_mime_data_cb(part, hugectl.size, read_callback,
+                      seek_callback, NULL, &hugectl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
diff --git a/third-party/curl/docs/libcurl/curl_mime_encoder.3 b/third-party/curl/docs/libcurl/curl_mime_encoder.3
deleted file mode 100644
index dfe388c435..0000000000
--- a/third-party/curl/docs/libcurl/curl_mime_encoder.3
+++ /dev/null
@@ -1,99 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_mime_encoder 3 "22 August 2017" "libcurl" "libcurl"
-.SH NAME
-curl_mime_encoder - set a mime part's encoder and content transfer encoding
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_mime_encoder(curl_mimepart *part, const char *encoding);
-.fi
-.SH DESCRIPTION
-curl_mime_encoder() requests a mime part's content to be encoded before being
-transmitted.
-
-\fIpart\fP is the part's handle to assign an encoder.
-\fIencoding\fP is a pointer to a null-terminated encoding scheme. It may be
-set to NULL to disable an encoder previously attached to the part. The encoding
-scheme storage may safely be reused after this function returns.
-
-Setting a part's encoder multiple times is valid: only the value set by the
-last call is retained.
-
-Upon multipart rendering, the part's content is encoded according to the
-pertaining scheme and a corresponding \fI"Content-Transfer-Encoding"\fP header
-is added to the part.
-
-Supported encoding schemes are:
-.br
-"\fIbinary\fP": the data is left unchanged, the header is added.
-.br
-"\fI8bit\fP": header added, no data change.
-.br
-"\fI7bit\fP": the data is unchanged, but is each byte is checked
-to be a 7-bit value; if not, a read error occurs.
-.br
-"\fIbase64\fP": Data is converted to base64 encoding, then split in
-CRLF-terminated lines of at most 76 characters.
-.br
-"\fIquoted-printable\fP": data is encoded in quoted printable lines of
-at most 76 characters. Since the resulting size of the final data cannot be
-determined prior to reading the original data, it is left as unknown, causing
-chunked transfer in HTTP. For the same reason, this encoder may not be used
-with IMAP. This encoder targets text data that is mostly ASCII and should
-not be used with other types of data.
-
-If the original data is already encoded in such a scheme, a custom
-\fIContent-Transfer-Encoding\fP header should be added with
-\fIcurl_mime_headers\fP() instead of setting a part encoder.
-
-Encoding should not be applied to multiparts, thus the use of this
-function on a part with content set with \fIcurl_mime_subparts\fP() is
-strongly discouraged.
-.SH EXAMPLE
-.nf
- curl_mime *mime;
- curl_mimepart *part;
-
- /* create a mime handle */
- mime = curl_mime_init(easy);
-
- /* add a part */
- part = curl_mime_addpart(mime);
-
- /* send a file */
- curl_mime_filedata(part, "image.png");
-
- /* encode file data in base64 for transfer */
- curl_mime_encoder(part, "base64");
-.fi
-.SH AVAILABILITY
-As long as at least one of HTTP, SMTP or IMAP is enabled. Added in 7.56.0.
-.SH RETURN VALUE
-CURLE_OK or a CURL error code upon failure.
-.SH "SEE ALSO"
-.BR curl_mime_addpart "(3),"
-.BR curl_mime_headers "(3),"
-.BR curl_mime_subparts "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_mime_encoder.md b/third-party/curl/docs/libcurl/curl_mime_encoder.md
new file mode 100644
index 0000000000..bb5990c7b8
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_mime_encoder.md
@@ -0,0 +1,110 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_mime_encoder
+Section: 3
+Source: libcurl
+See-also:
+  - curl_mime_addpart (3)
+  - curl_mime_headers (3)
+  - curl_mime_subparts (3)
+Protocol:
+  - HTTP
+  - IMAP
+  - SMTP
+Added-in: 7.56.0
+---
+
+# NAME
+
+curl_mime_encoder - set a mime part's encoder and content transfer encoding
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_mime_encoder(curl_mimepart *part, const char *encoding);
+~~~
+
+# DESCRIPTION
+
+curl_mime_encoder() requests a mime part's content to be encoded before being
+transmitted.
+
+*part* is the part's handle to assign an encoder.
+*encoding* is a pointer to a null-terminated encoding scheme. It may be
+set to NULL to disable an encoder previously attached to the part. The encoding
+scheme storage may safely be reused after this function returns.
+
+Setting a part's encoder multiple times is valid: only the value set by the
+last call is retained.
+
+Upon multipart rendering, the part's content is encoded according to the
+pertaining scheme and a corresponding *"Content-Transfer-Encoding"* header
+is added to the part.
+
+Supported encoding schemes are:
+
+"*binary*": the data is left unchanged, the header is added.
+
+"*8bit*": header added, no data change.
+
+"*7bit*": the data is unchanged, but is each byte is checked
+to be a 7-bit value; if not, a read error occurs.
+
+"*base64*": Data is converted to base64 encoding, then split in
+CRLF-terminated lines of at most 76 characters.
+
+"*quoted-printable*": data is encoded in quoted printable lines of
+at most 76 characters. Since the resulting size of the final data cannot be
+determined prior to reading the original data, it is left as unknown, causing
+chunked transfer in HTTP. For the same reason, this encoder may not be used
+with IMAP. This encoder targets text data that is mostly ASCII and should
+not be used with other types of data.
+
+If the original data is already encoded in such a scheme, a custom
+*Content-Transfer-Encoding* header should be added with
+curl_mime_headers(3) instead of setting a part encoder.
+
+Encoding should not be applied to multiparts, thus the use of this function on
+a part with content set with curl_mime_subparts(3) is strongly
+discouraged.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  curl_mime *mime;
+  curl_mimepart *part;
+
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    /* create a mime handle */
+    mime = curl_mime_init(curl);
+
+    /* add a part */
+    part = curl_mime_addpart(mime);
+
+    /* send a file */
+    curl_mime_filedata(part, "image.png");
+
+    /* encode file data in base64 for transfer */
+    curl_mime_encoder(part, "base64");
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
diff --git a/third-party/curl/docs/libcurl/curl_mime_filedata.3 b/third-party/curl/docs/libcurl/curl_mime_filedata.3
deleted file mode 100644
index 0559329925..0000000000
--- a/third-party/curl/docs/libcurl/curl_mime_filedata.3
+++ /dev/null
@@ -1,87 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_mime_filedata 3 "22 August 2017" "libcurl" "libcurl"
-.SH NAME
-curl_mime_filedata - set a mime part's body data from a file contents
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_mime_filedata(curl_mimepart *part,
-                            const char *filename);
-.fi
-.SH DESCRIPTION
-\fIcurl_mime_filedata(3)\fP sets a mime part's body content from the named
-file's contents. This is an alternative to \fIcurl_mime_data(3)\fP for setting
-data to a mime part.
-
-\fIpart\fP is the part's to assign contents to.
-
-\fIfilename\fP points to the null-terminated file's path name. The pointer can
-be NULL to detach the previous part contents settings. Filename storage can
-be safely be reused after this call.
-
-As a side effect, the part's remote file name is set to the base name of the
-given \fIfilename\fP if it is a valid named file. This can be undone or
-overridden by a subsequent call to \fIcurl_mime_filename(3)\fP.
-
-The contents of the file is read during the file transfer in a streaming
-manner to allow huge files to get transferred without using much memory. It
-therefore requires that the file is kept intact during the entire request.
-
-If the file size cannot be determined before actually reading it (such as for
-a character device or named pipe), the whole mime structure containing the
-part is transferred using chunks by HTTP but is rejected by IMAP.
-
-Setting a part's contents multiple times is valid: only the value set by the
-last call is retained.
-.SH EXAMPLE
-.nf
- curl_mime *mime;
- curl_mimepart *part;
-
- /* create a mime handle */
- mime = curl_mime_init(easy);
-
- /* add a part */
- part = curl_mime_addpart(mime);
-
- /* send data from this file */
- curl_mime_filedata(part, "image.png");
-
- /* set name */
- curl_mime_name(part, "data");
-.fi
-.SH AVAILABILITY
-As long as at least one of HTTP, SMTP or IMAP is enabled. Added in 7.56.0.
-.SH RETURN VALUE
-CURLE_OK or a CURL error code upon failure. CURLE_READ_ERROR is only an
-indication that the file is not yet readable: it can be safely ignored at
-this time, but the file must be made readable before the pertaining
-easy handle is performed.
-.SH "SEE ALSO"
-.BR curl_mime_addpart "(3),"
-.BR curl_mime_data "(3),"
-.BR curl_mime_filename "(3),"
-.BR curl_mime_name "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_mime_filedata.md b/third-party/curl/docs/libcurl/curl_mime_filedata.md
new file mode 100644
index 0000000000..30f380f405
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_mime_filedata.md
@@ -0,0 +1,99 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_mime_filedata
+Section: 3
+Source: libcurl
+See-also:
+  - curl_mime_addpart (3)
+  - curl_mime_data (3)
+  - curl_mime_filename (3)
+  - curl_mime_name (3)
+Protocol:
+  - HTTP
+  - IMAP
+  - SMTP
+Added-in: 7.56.0
+---
+
+# NAME
+
+curl_mime_filedata - set a mime part's body data from a file contents
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_mime_filedata(curl_mimepart *part,
+                            const char *filename);
+~~~
+
+# DESCRIPTION
+
+curl_mime_filedata(3) sets a mime part's body content from the named
+file's contents. This is an alternative to curl_mime_data(3) for setting
+data to a mime part.
+
+*part* is the part's to assign contents to.
+
+*filename* points to the null-terminated file's path name. The pointer can
+be NULL to detach the previous part contents settings. Filename storage can
+be safely be reused after this call.
+
+As a side effect, the part's remote filename is set to the base name of the
+given *filename* if it is a valid named file. This can be undone or
+overridden by a subsequent call to curl_mime_filename(3).
+
+The contents of the file is read during the file transfer in a streaming
+manner to allow huge files to get transferred without using much memory. It
+therefore requires that the file is kept intact during the entire request.
+
+If the file size cannot be determined before actually reading it (such as for
+a character device or named pipe), the whole mime structure containing the
+part is transferred using chunks by HTTP but is rejected by IMAP.
+
+Setting a part's contents multiple times is valid: only the value set by the
+last call is retained.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  curl_mime *mime;
+  curl_mimepart *part;
+
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    /* create a mime handle */
+    mime = curl_mime_init(curl);
+
+    /* add a part */
+    part = curl_mime_addpart(mime);
+
+    /* send data from this file */
+    curl_mime_filedata(part, "image.png");
+
+    /* set name */
+    curl_mime_name(part, "data");
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
+
+CURLE_READ_ERROR is only an indication that the file is not yet readable: it
+can be safely ignored at this time, but the file must be made readable before
+the pertaining easy handle is performed.
diff --git a/third-party/curl/docs/libcurl/curl_mime_filename.3 b/third-party/curl/docs/libcurl/curl_mime_filename.3
deleted file mode 100644
index 9d62bdf17a..0000000000
--- a/third-party/curl/docs/libcurl/curl_mime_filename.3
+++ /dev/null
@@ -1,75 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_mime_filename 3 "22 August 2017" "libcurl" "libcurl"
-.SH NAME
-curl_mime_filename - set a mime part's remote file name
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_mime_filename(curl_mimepart *part,
-                            const char *filename);
-.fi
-.SH DESCRIPTION
-\fIcurl_mime_filename(3)\fP sets a mime part's remote file name. When remote
-file name is set, content data is processed as a file, whatever is the part's
-content source. A part's remote file name is transmitted to the server in the
-associated Content-Disposition generated header.
-
-\fIpart\fP is the part's handle to assign the remote file name to.
-
-\fIfilename\fP points to the null-terminated file name string; it may be set
-to NULL to remove a previously attached remote file name.
-
-The remote file name string is copied into the part, thus the associated
-storage may safely be released or reused after call. Setting a part's file
-name multiple times is valid: only the value set by the last call is retained.
-.SH EXAMPLE
-.nf
- curl_mime *mime;
- curl_mimepart *part;
-
- /* create a mime handle */
- mime = curl_mime_init(easy);
-
- /* add a part */
- part = curl_mime_addpart(mime);
-
- /* send image data from memory */
- curl_mime_data(part, imagebuf, imagebuf_len);
-
- /* set a file name to make it look like a file upload */
- curl_mime_filename(part, "image.png");
-
- /* set name */
- curl_mime_name(part, "data");
-.fi
-.SH AVAILABILITY
-As long as at least one of HTTP, SMTP or IMAP is enabled. Added in 7.56.0.
-.SH RETURN VALUE
-CURLE_OK or a CURL error code upon failure.
-.SH "SEE ALSO"
-.BR curl_mime_addpart "(3),"
-.BR curl_mime_filedata "(3),"
-.BR curl_mime_data "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_mime_filename.md b/third-party/curl/docs/libcurl/curl_mime_filename.md
new file mode 100644
index 0000000000..d54f36032b
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_mime_filename.md
@@ -0,0 +1,89 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_mime_filename
+Section: 3
+Source: libcurl
+See-also:
+  - curl_mime_addpart (3)
+  - curl_mime_data (3)
+  - curl_mime_filedata (3)
+Protocol:
+  - HTTP
+  - IMAP
+  - SMTP
+Added-in: 7.56.0
+---
+
+# NAME
+
+curl_mime_filename - set a mime part's remote filename
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_mime_filename(curl_mimepart *part,
+                            const char *filename);
+~~~
+
+# DESCRIPTION
+
+curl_mime_filename(3) sets a mime part's remote filename. When remote
+filename is set, content data is processed as a file, whatever is the part's
+content source. A part's remote filename is transmitted to the server in the
+associated Content-Disposition generated header.
+
+*part* is the part's handle to assign the remote filename to.
+
+*filename* points to the null-terminated filename string; it may be set
+to NULL to remove a previously attached remote filename.
+
+The remote filename string is copied into the part, thus the associated
+storage may safely be released or reused after call. Setting a part's file
+name multiple times is valid: only the value set by the last call is retained.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+
+static char imagebuf[]="imagedata";
+
+int main(void)
+{
+  curl_mime *mime;
+  curl_mimepart *part;
+
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    /* create a mime handle */
+    mime = curl_mime_init(curl);
+
+    /* add a part */
+    part = curl_mime_addpart(mime);
+
+    /* send image data from memory */
+    curl_mime_data(part, imagebuf, sizeof(imagebuf));
+
+    /* set a filename to make it look like a file upload */
+    curl_mime_filename(part, "image.png");
+
+    /* set name */
+    curl_mime_name(part, "data");
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
diff --git a/third-party/curl/docs/libcurl/curl_mime_free.3 b/third-party/curl/docs/libcurl/curl_mime_free.3
deleted file mode 100644
index 039e9c9b2b..0000000000
--- a/third-party/curl/docs/libcurl/curl_mime_free.3
+++ /dev/null
@@ -1,63 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_mime_free 3 "22 August 2017" "libcurl" "libcurl"
-.SH NAME
-curl_mime_free - free a previously built mime structure
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-void curl_mime_free(curl_mime *mime);
-.fi
-.SH DESCRIPTION
-\fIcurl_mime_free(3)\fP is used to clean up data previously built/appended
-with \fIcurl_mime_addpart(3)\fP and other mime-handling functions. This must
-be called when the data has been used, which typically means after
-\fIcurl_easy_perform(3)\fP has been called.
-
-The handle to free is the one you passed to the \fICURLOPT_MIMEPOST(3)\fP
-option: attached sub part mime structures must not be explicitly freed as they
-are by the top structure freeing.
-
-\fBmime\fP is the handle as returned from a previous call to
-\fIcurl_mime_init(3)\fP and may be NULL.
-
-Passing in a NULL pointer in \fImime\fP makes this function return immediately
-with no action.
-.SH EXAMPLE
-.nf
-  /* Build the mime message. */
-  mime = curl_mime_init(curl);
-
-  /* ... */
-
-  /* Free multipart message. */
-  curl_mime_free(mime);
-.fi
-.SH AVAILABILITY
-As long as at least one of HTTP, SMTP or IMAP is enabled. Added in 7.56.0.
-.SH RETURN VALUE
-None
-.SH "SEE ALSO"
-.BR curl_mime_init "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_mime_free.md b/third-party/curl/docs/libcurl/curl_mime_free.md
new file mode 100644
index 0000000000..851b1c5218
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_mime_free.md
@@ -0,0 +1,70 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_mime_free
+Section: 3
+Source: libcurl
+See-also:
+  - curl_free (3)
+  - curl_mime_init (3)
+Protocol:
+  - HTTP
+  - IMAP
+  - SMTP
+Added-in: 7.56.0
+---
+
+# NAME
+
+curl_mime_free - free a previously built mime structure
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+void curl_mime_free(curl_mime *mime);
+~~~
+
+# DESCRIPTION
+
+curl_mime_free(3) is used to clean up data previously built/appended
+with curl_mime_addpart(3) and other mime-handling functions. This must
+be called when the data has been used, which typically means after
+curl_easy_perform(3) has been called.
+
+The handle to free is the one you passed to the CURLOPT_MIMEPOST(3)
+option: attached sub part mime structures must not be explicitly freed as they
+are by the top structure freeing.
+
+**mime** is the handle as returned from a previous call to
+curl_mime_init(3) and may be NULL.
+
+Passing in a NULL pointer in *mime* makes this function return immediately
+with no action.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    /* Build the mime message. */
+    curl_mime *mime = curl_mime_init(curl);
+
+    /* send off the transfer */
+
+    /* Free multipart message. */
+    curl_mime_free(mime);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+None
diff --git a/third-party/curl/docs/libcurl/curl_mime_headers.3 b/third-party/curl/docs/libcurl/curl_mime_headers.3
deleted file mode 100644
index 87df9dbb2c..0000000000
--- a/third-party/curl/docs/libcurl/curl_mime_headers.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_mime_headers 3 "22 August 2017" "libcurl" "libcurl"
-.SH NAME
-curl_mime_headers - set a mime part's custom headers
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_mime_headers(curl_mimepart *part,
-                           struct curl_slist *headers, int take_ownership);
-.fi
-.SH DESCRIPTION
-\fIcurl_mime_headers(3)\fP sets a mime part's custom headers.
-
-\fIpart\fP is the part's handle to assign the custom headers list to.
-
-\fIheaders\fP is the head of a list of custom headers; it may be set to NULL
-to remove a previously attached custom header list.
-
-\fItake_ownership\fP: when non-zero, causes the list to be freed upon
-replacement or mime structure deletion; in this case the list must not be
-freed explicitly.
-
-Setting a part's custom headers list multiple times is valid: only the value
-set by the last call is retained.
-.SH EXAMPLE
-.nf
- struct curl_slist *headers = NULL;
-
- headers = curl_slist_append(headers, "Custom-Header: mooo");
-
- /* use these headers, please take ownership */
- curl_mime_headers(part, headers, TRUE);
-
- /* pass on this data */
- curl_mime_data(part, "12345679", CURL_ZERO_TERMINATED);
-
- /* set name */
- curl_mime_name(part, "numbers");
-.fi
-.SH AVAILABILITY
-As long as at least one of HTTP, SMTP or IMAP is enabled. Added in 7.56.0.
-.SH RETURN VALUE
-CURLE_OK or a CURL error code upon failure.
-.SH "SEE ALSO"
-.BR curl_mime_addpart "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_mime_headers.md b/third-party/curl/docs/libcurl/curl_mime_headers.md
new file mode 100644
index 0000000000..8c7770bd1e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_mime_headers.md
@@ -0,0 +1,88 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_mime_headers
+Section: 3
+Source: libcurl
+See-also:
+  - curl_mime_addpart (3)
+  - curl_mime_name (3)
+Protocol:
+  - HTTP
+  - IMAP
+  - SMTP
+Added-in: 7.56.0
+---
+
+# NAME
+
+curl_mime_headers - set a mime part's custom headers
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_mime_headers(curl_mimepart *part,
+                           struct curl_slist *headers, int take_ownership);
+~~~
+
+# DESCRIPTION
+
+curl_mime_headers(3) sets a mime part's custom headers.
+
+*part* is the part's handle to assign the custom headers list to.
+
+*headers* is the head of a list of custom headers; it may be set to NULL
+to remove a previously attached custom header list.
+
+*take_ownership*: when non-zero, causes the list to be freed upon
+replacement or mime structure deletion; in this case the list must not be
+freed explicitly.
+
+Setting a part's custom headers list multiple times is valid: only the value
+set by the last call is retained.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  struct curl_slist *headers = NULL;
+  CURL *easy = curl_easy_init();
+  curl_mime *mime;
+  curl_mimepart *part;
+
+  headers = curl_slist_append(headers, "Custom-Header: mooo");
+
+  mime = curl_mime_init(easy);
+  part = curl_mime_addpart(mime);
+
+  /* use these headers in the part, takes ownership */
+  curl_mime_headers(part, headers, 1);
+
+  /* pass on this data */
+  curl_mime_data(part, "12345679", CURL_ZERO_TERMINATED);
+
+  /* set name */
+  curl_mime_name(part, "numbers");
+
+  /* Post and send it. */
+  curl_easy_setopt(easy, CURLOPT_MIMEPOST, mime);
+  curl_easy_setopt(easy, CURLOPT_URL, "https://example.com");
+  curl_easy_perform(easy);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
diff --git a/third-party/curl/docs/libcurl/curl_mime_init.3 b/third-party/curl/docs/libcurl/curl_mime_init.3
deleted file mode 100644
index 8ce74077f7..0000000000
--- a/third-party/curl/docs/libcurl/curl_mime_init.3
+++ /dev/null
@@ -1,73 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_mime_init 3 "22 August 2017" "libcurl" "libcurl"
-.SH NAME
-curl_mime_init - create a mime handle
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-curl_mime *curl_mime_init(CURL *easy_handle);
-.fi
-.SH DESCRIPTION
-\fIcurl_mime_init(3)\fP creates a handle to a new empty mime structure.
-This mime structure can be subsequently filled using the mime API, then
-attached to some easy handle using option \fICURLOPT_MIMEPOST(3)\fP within
-a \fIcurl_easy_setopt(3)\fP call or added as a multipart in another mime
-handle's part using \fIcurl_mime_subparts(3)\fP.
-
-\fIeasy_handle\fP is used for part separator randomization and error
-reporting. Since 7.87.0, it does not need to be the final target handle.
-
-Using a mime handle is the recommended way to post an HTTP form, format and
-send a multi-part email with SMTP or upload such an email to an IMAP server.
-.SH EXAMPLE
-.nf
- CURL *easy = curl_easy_init();
- curl_mime *mime;
- curl_mimepart *part;
-
- /* Build an HTTP form with a single field named "data", */
- mime = curl_mime_init(easy);
- part = curl_mime_addpart(mime);
- curl_mime_data(part, "This is the field data", CURL_ZERO_TERMINATED);
- curl_mime_name(part, "data");
-
- /* Post and send it. */
- curl_easy_setopt(easy, CURLOPT_MIMEPOST, mime);
- curl_easy_setopt(easy, CURLOPT_URL, "https://example.com");
- curl_easy_perform(easy);
-
- /* Clean-up. */
- curl_easy_cleanup(easy);
- curl_mime_free(mime);
-.SH AVAILABILITY
-As long as at least one of HTTP, SMTP or IMAP is enabled. Added in 7.56.0.
-.SH RETURN VALUE
-A mime struct handle, or NULL upon failure.
-.SH "SEE ALSO"
-.BR curl_mime_addpart "(3),"
-.BR curl_mime_subparts "(3),"
-.BR curl_mime_free "(3),"
-.BR CURLOPT_MIMEPOST "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_mime_init.md b/third-party/curl/docs/libcurl/curl_mime_init.md
new file mode 100644
index 0000000000..7d1513dfbb
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_mime_init.md
@@ -0,0 +1,77 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_mime_init
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_MIMEPOST (3)
+  - curl_mime_addpart (3)
+  - curl_mime_free (3)
+  - curl_mime_subparts (3)
+Protocol:
+  - HTTP
+  - IMAP
+  - SMTP
+Added-in: 7.56.0
+---
+
+# NAME
+
+curl_mime_init - create a mime handle
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+curl_mime *curl_mime_init(CURL *easy_handle);
+~~~
+
+# DESCRIPTION
+
+curl_mime_init(3) creates a handle to a new empty mime structure.
+This mime structure can be subsequently filled using the mime API, then
+attached to some easy handle using option CURLOPT_MIMEPOST(3) within
+a curl_easy_setopt(3) call or added as a multipart in another mime
+handle's part using curl_mime_subparts(3).
+
+*easy_handle* is used for part separator randomization and error
+reporting. Since 7.87.0, it does not need to be the final target handle.
+
+Using a mime handle is the recommended way to post an HTTP form, format and
+send a multi-part email with SMTP or upload such an email to an IMAP server.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *easy = curl_easy_init();
+  curl_mime *mime;
+  curl_mimepart *part;
+
+  /* Build an HTTP form with a single field named "data", */
+  mime = curl_mime_init(easy);
+  part = curl_mime_addpart(mime);
+  curl_mime_data(part, "This is the field data", CURL_ZERO_TERMINATED);
+  curl_mime_name(part, "data");
+
+  /* Post and send it. */
+  curl_easy_setopt(easy, CURLOPT_MIMEPOST, mime);
+  curl_easy_setopt(easy, CURLOPT_URL, "https://example.com");
+  curl_easy_perform(easy);
+
+  /* Clean-up. */
+  curl_easy_cleanup(easy);
+  curl_mime_free(mime);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+A mime struct handle, or NULL upon failure.
diff --git a/third-party/curl/docs/libcurl/curl_mime_name.3 b/third-party/curl/docs/libcurl/curl_mime_name.3
deleted file mode 100644
index fd9e3a09ec..0000000000
--- a/third-party/curl/docs/libcurl/curl_mime_name.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_mime_name 3 "22 August 2017" "libcurl" "libcurl"
-.SH NAME
-curl_mime_name - set a mime part's name
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_mime_name(curl_mimepart *part, const char *name);
-.fi
-.SH DESCRIPTION
-\fIcurl_mime_name(3)\fP sets a mime part's name. This is the way HTTP form
-fields are named.
-
-\fIpart\fP is the part's handle to assign a name to.
-
-\fIname\fP points to the null-terminated name string.
-
-The name string is copied into the part, thus the associated storage may
-safely be released or reused after call. Setting a part's name multiple times
-is valid: only the value set by the last call is retained. It is possible to
-reset the name of a part by setting \fIname\fP to NULL.
-.SH EXAMPLE
-.nf
- curl_mime *mime;
- curl_mimepart *part;
-
- /* create a mime handle */
- mime = curl_mime_init(easy);
-
- /* add a part */
- part = curl_mime_addpart(mime);
-
- /* give the part a name */
- curl_mime_name(part, "shoe_size");
-.fi
-.SH AVAILABILITY
-As long as at least one of HTTP, SMTP or IMAP is enabled. Added in 7.56.0.
-.SH RETURN VALUE
-CURLE_OK or a CURL error code upon failure.
-.SH "SEE ALSO"
-.BR curl_mime_addpart "(3),"
-.BR curl_mime_data "(3),"
-.BR curl_mime_type "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_mime_name.md b/third-party/curl/docs/libcurl/curl_mime_name.md
new file mode 100644
index 0000000000..4f198141b3
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_mime_name.md
@@ -0,0 +1,77 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_mime_name
+Section: 3
+Source: libcurl
+See-also:
+  - curl_mime_addpart (3)
+  - curl_mime_data (3)
+  - curl_mime_type (3)
+Protocol:
+  - HTTP
+  - IMAP
+  - SMTP
+Added-in: 7.56.0
+---
+
+# NAME
+
+curl_mime_name - set a mime part's name
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_mime_name(curl_mimepart *part, const char *name);
+~~~
+
+# DESCRIPTION
+
+curl_mime_name(3) sets a mime part's name. This is the way HTTP form
+fields are named.
+
+*part* is the part's handle to assign a name to.
+
+*name* points to the null-terminated name string.
+
+The name string is copied into the part, thus the associated storage may
+safely be released or reused after call. Setting a part's name multiple times
+is valid: only the value set by the last call is retained. It is possible to
+reset the name of a part by setting *name* to NULL.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  curl_mime *mime;
+  curl_mimepart *part;
+
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    /* create a mime handle */
+    mime = curl_mime_init(curl);
+
+    /* add a part */
+    part = curl_mime_addpart(mime);
+
+    /* give the part a name */
+    curl_mime_name(part, "shoe_size");
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
diff --git a/third-party/curl/docs/libcurl/curl_mime_subparts.3 b/third-party/curl/docs/libcurl/curl_mime_subparts.3
deleted file mode 100644
index e3f3a602b6..0000000000
--- a/third-party/curl/docs/libcurl/curl_mime_subparts.3
+++ /dev/null
@@ -1,75 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_mime_subparts 3 "22 August 2017" "libcurl" "libcurl"
-.SH NAME
-curl_mime_subparts - set sub-parts of a multipart mime part
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_mime_subparts(curl_mimepart *part, curl_mime *subparts);
-.fi
-.SH DESCRIPTION
-\fIcurl_mime_subparts(3)\fP sets a multipart mime part's content from a mime
-structure.
-
-\fIpart\fP is a handle to the multipart part.
-
-\fIsubparts\fP is a mime structure handle holding the sub-parts. After
-\fIcurl_mime_subparts\fP succeeds, the mime structure handle belongs to the
-multipart part and must not be freed explicitly. It may however be updated by
-subsequent calls to mime API functions.
-
-Setting a part's contents multiple times is valid: only the value set by the
-last call is retained. It is possible to unassign previous part's contents by
-setting \fIsubparts\fP to NULL.
-.SH EXAMPLE
-.nf
- /* The inline part is an alternative proposing the html and the text
-    versions of the email. */
- alt = curl_mime_init(curl);
-
- /* HTML message. */
- part = curl_mime_addpart(alt);
- curl_mime_data(part, inline_html, CURL_ZERO_TERMINATED);
- curl_mime_type(part, "text/html");
-
- /* Text message. */
- part = curl_mime_addpart(alt);
- curl_mime_data(part, inline_text, CURL_ZERO_TERMINATED);
-
- /* Create the inline part. */
- part = curl_mime_addpart(mime);
- curl_mime_subparts(part, alt);
- curl_mime_type(part, "multipart/alternative");
- slist = curl_slist_append(NULL, "Content-Disposition: inline");
- curl_mime_headers(part, slist, 1);
-.fi
-.SH AVAILABILITY
-As long as at least one of HTTP, SMTP or IMAP is enabled. Added in 7.56.0.
-.SH RETURN VALUE
-CURLE_OK or a CURL error code upon failure.
-.SH "SEE ALSO"
-.BR curl_mime_addpart "(3),"
-.BR curl_mime_init "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_mime_subparts.md b/third-party/curl/docs/libcurl/curl_mime_subparts.md
new file mode 100644
index 0000000000..3a8c18bd22
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_mime_subparts.md
@@ -0,0 +1,93 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_mime_subparts
+Section: 3
+Source: libcurl
+See-also:
+  - curl_mime_addpart (3)
+  - curl_mime_init (3)
+Protocol:
+  - HTTP
+  - IMAP
+  - SMTP
+Added-in: 7.56.0
+---
+
+# NAME
+
+curl_mime_subparts - set sub-parts of a multipart mime part
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_mime_subparts(curl_mimepart *part, curl_mime *subparts);
+~~~
+
+# DESCRIPTION
+
+curl_mime_subparts(3) sets a multipart mime part's content from a mime
+structure.
+
+*part* is a handle to the multipart part.
+
+*subparts* is a mime structure handle holding the sub-parts. After
+curl_mime_subparts(3) succeeds, the mime structure handle belongs to the
+multipart part and must not be freed explicitly. It may however be updated by
+subsequent calls to mime API functions.
+
+Setting a part's contents multiple times is valid: only the value set by the
+last call is retained. It is possible to unassign previous part's contents by
+setting *subparts* to NULL.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+
+static char *inline_html = "<title>example</title>";
+static char *inline_text = "once upon the time";
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    struct curl_slist *slist;
+
+    /* The inline part is an alternative proposing the html and the text
+       versions of the email. */
+    curl_mime *alt = curl_mime_init(curl);
+    curl_mimepart *part;
+
+    /* HTML message. */
+    part = curl_mime_addpart(alt);
+    curl_mime_data(part, inline_html, CURL_ZERO_TERMINATED);
+    curl_mime_type(part, "text/html");
+
+    /* Text message. */
+    part = curl_mime_addpart(alt);
+    curl_mime_data(part, inline_text, CURL_ZERO_TERMINATED);
+
+    /* Create the inline part. */
+    part = curl_mime_addpart(alt);
+    curl_mime_subparts(part, alt);
+    curl_mime_type(part, "multipart/alternative");
+    slist = curl_slist_append(NULL, "Content-Disposition: inline");
+    curl_mime_headers(part, slist, 1);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
diff --git a/third-party/curl/docs/libcurl/curl_mime_type.3 b/third-party/curl/docs/libcurl/curl_mime_type.3
deleted file mode 100644
index 83eb639b57..0000000000
--- a/third-party/curl/docs/libcurl/curl_mime_type.3
+++ /dev/null
@@ -1,85 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_mime_type 3 "22 August 2017" "libcurl" "libcurl"
-.SH NAME
-curl_mime_type - set a mime part's content type
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_mime_type(curl_mimepart *part, const char *mimetype);
-.fi
-.SH DESCRIPTION
-\fIcurl_mime_type(3)\fP sets a mime part's content type.
-
-\fIpart\fP is the part's handle to assign the content type to.
-
-\fImimetype\fP points to the null-terminated file mime type string; it may be
-set to NULL to remove a previously attached mime type.
-
-The mime type string is copied into the part, thus the associated storage may
-safely be released or reused after call. Setting a part's type multiple times
-is valid: only the value set by the last call is retained.
-
-In the absence of a mime type and if needed by the protocol specifications,
-a default mime type is determined by the context:
-.br
-- If set as a custom header, use this value.
-.br
-- application/form-data for an HTTP form post.
-.br
-- If a remote file name is set, the mime type is taken from the file name
-extension, or application/octet-stream by default.
-.br
-- For a multipart part, multipart/mixed.
-.br
-- text/plain in other cases.
-.SH EXAMPLE
-.nf
- curl_mime *mime;
- curl_mimepart *part;
-
- /* create a mime handle */
- mime = curl_mime_init(easy);
-
- /* add a part */
- part = curl_mime_addpart(mime);
-
- /* get data from this file */
- curl_mime_filedata(part, "image.png");
-
- /* content-type for this part */
- curl_mime_type(part, "image/png");
-
- /* set name */
- curl_mime_name(part, "image");
-.fi
-.SH AVAILABILITY
-As long as at least one of HTTP, SMTP or IMAP is enabled. Added in 7.56.0.
-.SH RETURN VALUE
-CURLE_OK or a CURL error code upon failure.
-.SH "SEE ALSO"
-.BR curl_mime_addpart "(3),"
-.BR curl_mime_name "(3),"
-.BR curl_mime_data "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_mime_type.md b/third-party/curl/docs/libcurl/curl_mime_type.md
new file mode 100644
index 0000000000..1e36052e1c
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_mime_type.md
@@ -0,0 +1,96 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_mime_type
+Section: 3
+Source: libcurl
+See-also:
+  - curl_mime_addpart (3)
+  - curl_mime_data (3)
+  - curl_mime_name (3)
+Protocol:
+  - HTTP
+  - IMAP
+  - SMTP
+Added-in: 7.56.0
+---
+
+# NAME
+
+curl_mime_type - set a mime part's content type
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_mime_type(curl_mimepart *part, const char *mimetype);
+~~~
+
+# DESCRIPTION
+
+curl_mime_type(3) sets a mime part's content type.
+
+*part* is the part's handle to assign the content type to.
+
+*mimetype* points to the null-terminated file mime type string; it may be
+set to NULL to remove a previously attached mime type.
+
+The mime type string is copied into the part, thus the associated storage may
+safely be released or reused after call. Setting a part's type multiple times
+is valid: only the value set by the last call is retained.
+
+In the absence of a mime type and if needed by the protocol specifications,
+a default mime type is determined by the context:
+
+- If set as a custom header, use this value.
+
+- application/form-data for an HTTP form post.
+
+- If a remote filename is set, the mime type is taken from the filename
+extension, or application/octet-stream by default.
+
+- For a multipart part, multipart/mixed.
+
+- text/plain in other cases.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  curl_mime *mime;
+  curl_mimepart *part;
+
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    /* create a mime handle */
+    mime = curl_mime_init(curl);
+
+    /* add a part */
+    part = curl_mime_addpart(mime);
+
+    /* get data from this file */
+    curl_mime_filedata(part, "image.png");
+
+    /* content-type for this part */
+    curl_mime_type(part, "image/png");
+
+    /* set name */
+    curl_mime_name(part, "image");
+}
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
diff --git a/third-party/curl/docs/libcurl/curl_mprintf.3 b/third-party/curl/docs/libcurl/curl_mprintf.3
deleted file mode 100644
index c7e0a35ddb..0000000000
--- a/third-party/curl/docs/libcurl/curl_mprintf.3
+++ /dev/null
@@ -1,254 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_printf 3 "30 April 2004" "libcurl" "libcurl"
-.SH NAME
-curl_maprintf, curl_mfprintf, curl_mprintf, curl_msnprintf, curl_msprintf
-curl_mvaprintf, curl_mvfprintf, curl_mvprintf, curl_mvsnprintf,
-curl_mvsprintf - formatted output conversion
-.SH SYNOPSIS
-.nf
-#include <curl/mprintf.h>
-
-int curl_mprintf(const char *format, ...);
-int curl_mfprintf(FILE *fd, const char *format, ...);
-int curl_msprintf(char *buffer, const char *format, ...);
-int curl_msnprintf(char *buffer, size_t maxlength, const char *format, ...);
-int curl_mvprintf(const char *format, va_list args);
-int curl_mvfprintf(FILE *fd, const char *format, va_list args);
-int curl_mvsprintf(char *buffer, const char *format, va_list args);
-int curl_mvsnprintf(char *buffer, size_t maxlength, const char *format,
-                    va_list args);
-char *curl_maprintf(const char *format , ...);
-char *curl_mvaprintf(const char *format, va_list args);
-.fi
-.SH DESCRIPTION
-These functions produce output according to the format string and given
-arguments. They are mostly clones of the well-known C-style functions but
-there are slight differences in behavior.
-
-We discourage users from using any of these functions in new applications.
-
-Functions in the curl_mprintf() family produce output according to a format as
-described below. The functions \fBcurl_mprintf()\fP and \fBcurl_mvprintf()\fP
-write output to stdout, the standard output stream; \fBcurl_mfprintf()\fP and
-\fBcurl_mvfprintf()\fP write output to the given output stream;
-\fBcurl_msprintf()\fP, \fBcurl_msnprintf()\fP, \fBcurl_mvsprintf()\fP, and
-\fBcurl_mvsnprintf()\fP write to the character string \fBbuffer\fP.
-
-The functions \fBcurl_msnprintf()\fP and \fBcurl_mvsnprintf()\fP write at most
-\fImaxlength\fP bytes (including the terminating null byte ('\\0')) to
-\fIbuffer\fP.
-
-The functions \fBcurl_mvprintf()\fP, \fBcurl_mvfprintf()\fP,
-\fBcurl_mvsprintf()\fP, \fBcurl_mvsnprintf()\fP are equivalent to the
-functions \fBcurl_mprintf()\fP, \fBcurl_mfprintf()\fP, \fBcurl_msprintf()\fP,
-\fBcurl_msnprintf()\fP, respectively, except that they are called with a
-\fIva_list\fP instead of a variable number of arguments. These functions do
-not call the \fIva_end\fP macro. Because they invoke the \fIva_arg\fP macro,
-the value of \fIap\fP is undefined after the call.
-
-The functions \fBcurl_maprintf()\fP and \fBcurl_mvaprintf()\fP return the
-output string as pointer to a newly allocated memory area. The returned string
-must be \fIcurl_free(3)\fPed by the receiver.
-
-All of these functions write the output under the control of a format string
-that specifies how subsequent arguments are converted for output.
-
-.SH FORMAT STRING
-The format string is composed of zero or more directives: ordinary characters
-(not %), which are copied unchanged to the output stream; and conversion
-specifications, each of which results in fetching zero or more subsequent
-arguments. Each conversion specification is introduced by the character %, and
-ends with a conversion specifier. In between there may be (in this order) zero
-or more \fIflags\fP, an optional minimum \fIfield width\fP, an optional
-\fIprecision\fP and an optional \fIlength modifier\fP.
-
-.SH "The $ modifier"
-The arguments must correspond properly with the conversion specifier. By
-default, the arguments are used in the order given, where each '*' (see Field
-width and Precision below) and each conversion specifier asks for the next
-argument (and it is an error if insufficiently many arguments are given). One
-can also specify explicitly which argument is taken, at each place where an
-argument is required, by writing "%m$" instead of '%' and "*m$" instead
-of '*', where the decimal integer m denotes the position in the argument list
-of the desired argument, indexed starting from 1. Thus,
-.nf
-    curl_mprintf("%*d", width, num);
-.fi
-and
-.nf
-    curl_mprintf("%2$*1$d", width, num);
-.fi
-are equivalent. The second style allows repeated references to the same
-argument.
-
-If the style using '$' is used, it must be used throughout for all conversions
-taking an argument and all width and precision arguments, but it may be mixed
-with "%%" formats, which do not consume an argument. There may be no gaps in
-the numbers of arguments specified using '$'; for example, if arguments 1 and
-3 are specified, argument 2 must also be specified somewhere in the format
-string.
-
-.SH "Flag characters"
-The character % is followed by zero or more of the following flags:
-.TP
-.B #
-The value should be converted to its "alternate form".
-.TP
-.B 0
-The value should be zero padded.
-.TP
-.B -
-The converted value is to be left adjusted on the field boundary.  (The
-default is right justification.)  The converted value is padded on the right
-with blanks, rather than on the left with blanks or zeros. A '-' overrides a
-\&'0' if both are given.
-.TP
-.B ' '
-(a space) A blank should be left before a positive number (or empty string)
-produced by a signed conversion.
-.TP
-.B +
-A sign (+ or -) should always be placed before a number produced by a signed
-conversion. By default, a sign is used only for negative numbers. A '+'
-overrides a space if both are used.
-.SH "Field width"
-An optional decimal digit string (with nonzero first digit) specifying a
-minimum field width. If the converted value has fewer characters than the
-field width, it gets padded with spaces on the left (or right, if the
-left-adjustment flag has been given). Instead of a decimal digit string one
-may write "*" or "*m$" (for some decimal integer m) to specify that the field
-width is given in the next argument, or in the \fIm-th\fP argument,
-respectively, which must be of type int. A negative field width is taken as
-a '-' flag followed by a positive field width. In no case does a nonexistent
-or small field width cause truncation of a field; if the result of a
-conversion is wider than the field width, the field is expanded to contain the
-conversion result.
-.SH "Precision"
-An optional precision in the form of a period ('.') followed by an optional
-decimal digit string. Instead of a decimal digit string one may write "*" or
-"*m$" (for some decimal integer m) to specify that the precision is given in
-the next argument, or in the \fIm-th\fP argument, respectively, which must be of
-type int. If the precision is given as just '.', the precision is taken to be
-zero. A negative precision is taken as if the precision were omitted. This
-gives the minimum number of digits to appear for \fBd\fP, \fBi\fP, \fBo\fP,
-\fBu\fP, \fBx\fP, and \fBX\fP conversions, the number of digits to appear
-after the radix character for \fBa\fP, \fBA\fP, \fBe\fP, \fBE\fP, \fBf\fP, and
-\fBF\fP conversions, the maximum number of significant digits for \fBg\fP and
-\fBG\fP conversions, or the maximum number of characters to be printed from a
-string for \fBs\fP and \fBS\fP conversions.
-.SH "Length modifier"
-.TP
-.B h
-A following integer conversion corresponds to a \fIshort\fP or \fIunsigned
-short\fP argument.
-.TP
-.B l
-(ell) A following integer conversion corresponds to a \fIlong\fP or
-\fIunsigned long\fP argument, or a following n conversion corresponds to a
-pointer to a long argument
-.TP
-.B ll
-(ell-ell). A following integer conversion corresponds to a \fIlong long\fP or
-\fIunsigned long long\fP argument, or a following n conversion corresponds to
-a pointer to a long long argument.
-.TP
-.B q
-A synonym for \fBll\fP.
-.TP
-.B L
-A following a, A, e, E, f, F, g, or G conversion corresponds to a long double
-argument.
-.TP
-.B z
-A following integer conversion corresponds to a \fIsize_t\fP or \fIssize_t\fP
-argument.
-.SH "Conversion specifiers"
-A character that specifies the type of conversion to be applied. The
-conversion specifiers and their meanings are:
-.TP
-.B d, i
-The int argument is converted to signed decimal notation. The precision, if
-any, gives the minimum number of digits that must appear; if the converted
-value requires fewer digits, it is padded on the left with zeros. The default
-precision is 1. When 0 is printed with an explicit precision 0, the output is
-empty.
-.TP
-.B o, u, x, X
-The unsigned int argument is converted to unsigned octal (o), unsigned decimal
-(u), or unsigned hexadecimal (\fBx\fP and \fBX\fP) notation. The letters
-\fIabcdef\fP are used for \fBx\fP conversions; the letters \fIABCDEF\fP are
-used for \fBX\fP conversions. The precision, if any, gives the minimum number
-of digits that must appear; if the converted value requires fewer digits, it
-is padded on the left with zeros. The default precision is 1. When 0 is
-printed with an explicit precision 0, the output is empty.
-.TP
-.B e, E
-The double argument is rounded and output in the style \fB"[-]d.ddde±dd"\fP
-.TP
-.B f, F
-The double argument is rounded and output to decimal notation in the style
-\fB"[-]ddd.ddd"\fP.
-.TP
-.B g, G
-The double argument is converted in style f or e.
-.TP
-.B c
-The int argument is converted to an unsigned char, and the resulting character
-is written.
-.TP
-.B s
-The \fIconst char *\fP argument is expected to be a pointer to an array of
-character type (pointer to a string). Characters from the array are written up
-to (but not including) a terminating null byte. If a precision is specified,
-no more than the number specified are written. If a precision is given, no
-null byte need be present; if the precision is not specified, or is greater
-than the size of the array, the array must contain a terminating null byte.
-.TP
-.B p
-The \fIvoid *\fP pointer argument is printed in hexadecimal.
-.TP
-.B n
-The number of characters written so far is stored into the integer pointed to
-by the corresponding argument.
-.TP
-.B %
-A '%' is written. No argument is converted.
-.SH EXAMPLE
-.nf
-  curl_mprintf("My name is %s\\n", name);
-  curl_mprintf("Pi is almost %f\\n", 25/8);
-.fi
-.SH AVAILABILITY
-These functions might be removed from the public libcurl API in the future. Do
-not use them in new programs or projects.
-.SH RETURN VALUE
-The \fBcurl_maprintf\fP and \fBcurl_mvaprintf\fP functions return a pointer to
-a newly allocated string, or NULL if it failed.
-
-All other functions return the number of characters actually printed
-(excluding the null byte used to end output to strings). Note that this
-sometimes differ from how the POSIX versions of these functions work.
-.SH "SEE ALSO"
-.BR printf "(3), " sprintf "(3), " fprintf "(3), " vprintf "(3) "
diff --git a/third-party/curl/docs/libcurl/curl_mprintf.md b/third-party/curl/docs/libcurl/curl_mprintf.md
new file mode 100644
index 0000000000..7c9def535c
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_mprintf.md
@@ -0,0 +1,290 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_printf
+Section: 3
+Source: libcurl
+See-also:
+  - fprintf (3)
+  - printf (3)
+  - sprintf (3)
+  - vprintf (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+curl_maprintf, curl_mfprintf, curl_mprintf, curl_msnprintf, curl_msprintf,
+curl_mvaprintf, curl_mvfprintf, curl_mvprintf, curl_mvsnprintf,
+curl_mvsprintf - formatted output conversion
+
+# SYNOPSIS
+
+~~~c
+#include <curl/mprintf.h>
+
+int curl_mprintf(const char *format, ...);
+int curl_mfprintf(FILE *fd, const char *format, ...);
+int curl_msprintf(char *buffer, const char *format, ...);
+int curl_msnprintf(char *buffer, size_t maxlength, const char *format, ...);
+int curl_mvprintf(const char *format, va_list args);
+int curl_mvfprintf(FILE *fd, const char *format, va_list args);
+int curl_mvsprintf(char *buffer, const char *format, va_list args);
+int curl_mvsnprintf(char *buffer, size_t maxlength, const char *format,
+                    va_list args);
+char *curl_maprintf(const char *format , ...);
+char *curl_mvaprintf(const char *format, va_list args);
+~~~
+
+# DESCRIPTION
+
+These functions produce output according to the format string and given
+arguments. They are mostly clones of the well-known C-style functions but
+there are slight differences in behavior.
+
+We discourage users from using any of these functions in new applications.
+
+Functions in the curl_mprintf() family produce output according to a format as
+described below. The functions **curl_mprintf()** and **curl_mvprintf()**
+write output to stdout, the standard output stream; **curl_mfprintf()** and
+**curl_mvfprintf()** write output to the given output stream;
+**curl_msprintf()**, **curl_msnprintf()**, **curl_mvsprintf()**, and
+**curl_mvsnprintf()** write to the character string **buffer**.
+
+The functions **curl_msnprintf()** and **curl_mvsnprintf()** write at most
+*maxlength* bytes (including the null-terminator byte ('0')) to
+*buffer*.
+
+The functions **curl_mvprintf()**, **curl_mvfprintf()**,
+**curl_mvsprintf()**, **curl_mvsnprintf()** are equivalent to the
+functions **curl_mprintf()**, **curl_mfprintf()**, **curl_msprintf()**,
+**curl_msnprintf()**, respectively, except that they are called with a
+*va_list* instead of a variable number of arguments. These functions do
+not call the *va_end* macro. Because they invoke the *va_arg* macro,
+the value of *ap* is undefined after the call.
+
+The functions **curl_maprintf()** and **curl_mvaprintf()** return the
+output string as pointer to a newly allocated memory area. The returned string
+may not be overwritten and must be curl_free(3)ed by the receiver.
+
+All of these functions write the output under the control of a format string
+that specifies how subsequent arguments are converted for output.
+
+# FORMAT STRING
+
+The format string is composed of zero or more directives: ordinary characters
+(not %), which are copied unchanged to the output stream; and conversion
+specifications, each of which results in fetching zero or more subsequent
+arguments. Each conversion specification is introduced by the character %, and
+ends with a conversion specifier. In between there may be (in this order) zero
+or more *flags*, an optional minimum *field width*, an optional
+*precision* and an optional *length modifier*.
+
+# The $ modifier
+
+The arguments must correspond properly with the conversion specifier. By
+default, the arguments are used in the order given, where each '*' (see Field
+width and Precision below) and each conversion specifier asks for the next
+argument (and it is an error if insufficiently many arguments are given). One
+can also specify explicitly which argument is taken, at each place where an
+argument is required, by writing "%m$" instead of '%' and "*m$" instead
+of '*', where the decimal integer m denotes the position in the argument list
+of the desired argument, indexed starting from 1. Thus,
+~~~c
+    curl_mprintf("%*d", width, num);
+~~~
+and
+~~~c
+    curl_mprintf("%2$*1$d", width, num);
+~~~
+are equivalent. The second style allows repeated references to the same
+argument.
+
+If the style using '$' is used, it must be used throughout for all conversions
+taking an argument and all width and precision arguments, but it may be mixed
+with "%%" formats, which do not consume an argument. There may be no gaps in
+the numbers of arguments specified using '$'; for example, if arguments 1 and
+3 are specified, argument 2 must also be specified somewhere in the format
+string.
+
+# Flag characters
+
+The character % is followed by zero or more of the following flags:
+
+## #
+
+The value should be converted to its "alternate form".
+
+## 0
+
+The value should be zero padded.
+
+## -
+
+The converted value is to be left adjusted on the field boundary. (The default
+is right justification.) The converted value is padded on the right with
+blanks, rather than on the left with blanks or zeros. A '-' overrides a &'0'
+if both are given.
+
+## (space)
+
+(a space: ' ') A blank should be left before a positive number (or empty
+string) produced by a signed conversion.
+
+## +
+
+A sign (+ or -) should always be placed before a number produced by a signed
+conversion. By default, a sign is used only for negative numbers. A '+'
+overrides a space if both are used.
+
+# Field width
+
+An optional decimal digit string (with nonzero first digit) specifying a
+minimum field width. If the converted value has fewer characters than the
+field width, it gets padded with spaces on the left (or right, if the
+left-adjustment flag has been given). Instead of a decimal digit string one
+may write "*" or "*m$" (for some decimal integer m) to specify that the field
+width is given in the next argument, or in the *m-th* argument,
+respectively, which must be of type int. A negative field width is taken as
+a '-' flag followed by a positive field width. In no case does a nonexistent
+or small field width cause truncation of a field; if the result of a
+conversion is wider than the field width, the field is expanded to contain the
+conversion result.
+
+# Precision
+
+An optional precision in the form of a period ('.') followed by an optional
+decimal digit string. Instead of a decimal digit string one may write "*" or
+"*m$" (for some decimal integer m) to specify that the precision is given in
+the next argument, or in the *m-th* argument, respectively, which must be of
+type int. If the precision is given as a single '.', the precision is taken to
+be zero. A negative precision is taken as if the precision were omitted. This
+gives the minimum number of digits to appear for **d**, **i**, **o**, **u**,
+**x**, and **X** conversions, the number of digits to appear after the radix
+character for **a**, **A**, **e**, **E**, **f**, and **F** conversions, the
+maximum number of significant digits for **g** and **G** conversions, or the
+maximum number of characters to be printed from a string for **s** and **S**
+conversions.
+
+# Length modifier
+
+## h
+
+A following integer conversion corresponds to a *short* or *unsigned short*
+argument.
+
+## l
+
+(ell) A following integer conversion corresponds to a *long* or
+*unsigned long* argument, or a following n conversion corresponds to a
+pointer to a long argument
+
+## ll
+
+(ell-ell). A following integer conversion corresponds to a *long long* or
+*unsigned long long* argument, or a following n conversion corresponds to
+a pointer to a *long long* argument.
+
+## q
+
+A synonym for **ll**.
+
+## L
+
+A following a, A, e, E, f, F, g, or G conversion corresponds to a long double
+argument.
+
+## z
+
+A following integer conversion corresponds to a *size_t* or *ssize_t*
+argument.
+
+# Conversion specifiers
+
+A character that specifies the type of conversion to be applied. The
+conversion specifiers and their meanings are:
+
+## d, i
+
+The int argument is converted to signed decimal notation. The precision, if
+any, gives the minimum number of digits that must appear; if the converted
+value requires fewer digits, it is padded on the left with zeros. The default
+precision is 1. When 0 is printed with an explicit precision 0, the output is
+empty.
+
+## o, u, x, X
+
+The unsigned int argument is converted to unsigned octal (o), unsigned decimal
+(u), or unsigned hexadecimal (**x** and **X**) notation. The letters
+*abcdef* are used for **x** conversions; the letters *ABCDEF* are
+used for **X** conversions. The precision, if any, gives the minimum number
+of digits that must appear; if the converted value requires fewer digits, it
+is padded on the left with zeros. The default precision is 1. When 0 is
+printed with an explicit precision 0, the output is empty.
+
+## e, E
+
+The double argument is rounded and output in the style **"[-]d.ddde{+|-}dd"**
+
+## f, F
+
+The double argument is rounded and output to decimal notation in the style
+**"[-]ddd.ddd"**.
+
+## g, G
+
+The double argument is converted in style f or e.
+
+## c
+
+The int argument is converted to an unsigned char, and the resulting character
+is written.
+
+## s
+
+The *const char ** argument is expected to be a pointer to an array of
+character type (pointer to a string). Characters from the array are written up
+to (but not including) a null-terminator byte. If a precision is specified,
+no more than the number specified are written. If a precision is given, no
+null byte need be present; if the precision is not specified, or is greater
+than the size of the array, the array must contain a null-terminator byte.
+
+## p
+
+The *void ** pointer argument is printed in hexadecimal.
+
+## n
+
+The number of characters written so far is stored into the integer pointed to
+by the corresponding argument.
+
+## %
+
+A '%' symbol is written. No argument is converted.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+const char *name = "John";
+
+int main(void)
+{
+  curl_mprintf("My name is %s\n", name);
+  curl_mprintf("Pi is almost %f\n", (double)25.0 / 8);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+The **curl_maprintf** and **curl_mvaprintf** functions return a pointer to
+a newly allocated string, or NULL if it failed.
+
+All other functions return the number of characters actually printed
+(excluding the null byte used to end output to strings). Note that this
+sometimes differ from how the POSIX versions of these functions work.
diff --git a/third-party/curl/docs/libcurl/curl_multi_add_handle.3 b/third-party/curl/docs/libcurl/curl_multi_add_handle.3
deleted file mode 100644
index fd778ad864..0000000000
--- a/third-party/curl/docs/libcurl/curl_multi_add_handle.3
+++ /dev/null
@@ -1,83 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_multi_add_handle 3 "4 March 2002" "libcurl" "libcurl"
-.SH NAME
-curl_multi_add_handle - add an easy handle to a multi session
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_add_handle(CURLM *multi_handle, CURL *easy_handle);
-.fi
-.SH DESCRIPTION
-Adds the \fIeasy handle\fP to the \fImulti_handle\fP.
-
-While an easy handle is added to a multi stack, you cannot and you must not
-use \fIcurl_easy_perform(3)\fP on that handle. After having removed the easy
-handle from the multi stack again, it is perfectly fine to use it with the
-easy interface again.
-
-If the easy handle is not set to use a shared (\fICURLOPT_SHARE(3)\fP) cache,
-it is made to use a DNS cache that is shared between all easy handles within
-the multi handle when \fIcurl_multi_add_handle(3)\fP is called.
-
-When an easy interface is added to a multi handle, it is set to use a shared
-connection cache owned by the multi handle. Removing and adding new easy
-handles does not affect the pool of connections or the ability to do
-connection reuse.
-
-If you have \fICURLMOPT_TIMERFUNCTION(3)\fP set in the multi handle (as you
-should if you are working event-based with \fIcurl_multi_socket_action(3)\fP
-and friends), that callback is called from within this function to ask for an
-updated timer so that your main event loop gets the activity on this handle to
-get started.
-
-The easy handle remains added to the multi handle until you remove it again
-with \fIcurl_multi_remove_handle(3)\fP - even when a transfer with that
-specific easy handle is completed.
-
-You should remove the easy handle from the multi stack before you terminate
-first the easy handle and then the multi handle:
-
-1 - \fIcurl_multi_remove_handle(3)\fP
-
-2 - \fIcurl_easy_cleanup(3)\fP
-
-3 - \fIcurl_multi_cleanup(3)\fP
-.SH EXAMPLE
-.nf
-  /* init a multi stack */
-  multi_handle = curl_multi_init();
-
-  /* add individual transfers */
-  curl_multi_add_handle(multi_handle, http_handle);
-  curl_multi_add_handle(multi_handle, http_handle2);
-.fi
-.SH AVAILABILITY
-Added in 7.9.6
-.SH RETURN VALUE
-CURLMcode type, general libcurl multi interface error code.
-.SH "SEE ALSO"
-.BR curl_multi_cleanup "(3)," curl_multi_init "(3), "
-.BR curl_multi_setopt "(3), " curl_multi_socket_action "(3) "
diff --git a/third-party/curl/docs/libcurl/curl_multi_add_handle.md b/third-party/curl/docs/libcurl/curl_multi_add_handle.md
new file mode 100644
index 0000000000..ac29b89abd
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_add_handle.md
@@ -0,0 +1,94 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_add_handle
+Section: 3
+Source: libcurl
+See-also:
+  - curl_multi_cleanup (3)
+  - curl_multi_get_handles (3)
+  - curl_multi_init (3)
+  - curl_multi_setopt (3)
+  - curl_multi_socket_action (3)
+Protocol:
+  - All
+Added-in: 7.9.6
+---
+
+# NAME
+
+curl_multi_add_handle - add an easy handle to a multi session
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_add_handle(CURLM *multi_handle, CURL *easy_handle);
+~~~
+
+# DESCRIPTION
+
+Adds the *easy handle* to the *multi_handle*.
+
+While an easy handle is added to a multi stack, you cannot and you must not
+use curl_easy_perform(3) on that handle. After having removed the easy
+handle from the multi stack again, it is perfectly fine to use it with the
+easy interface again.
+
+If the easy handle is not set to use a shared (CURLOPT_SHARE(3)) cache,
+it is made to use a DNS cache that is shared between all easy handles within
+the multi handle when curl_multi_add_handle(3) is called.
+
+When an easy interface is added to a multi handle, it is set to use a shared
+connection cache owned by the multi handle. Removing and adding new easy
+handles does not affect the pool of connections or the ability to do
+connection reuse.
+
+If you have CURLMOPT_TIMERFUNCTION(3) set in the multi handle (as you
+should if you are working event-based with curl_multi_socket_action(3)
+and friends), that callback is called from within this function to ask for an
+updated timer so that your main event loop gets the activity on this handle to
+get started.
+
+The easy handle remains added to the multi handle until you remove it again
+with curl_multi_remove_handle(3) - even when a transfer with that
+specific easy handle is completed.
+
+You should remove the easy handle from the multi stack before you terminate
+first the easy handle and then the multi handle:
+
+1 - curl_multi_remove_handle(3)
+
+2 - curl_easy_cleanup(3)
+
+3 - curl_multi_cleanup(3)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  /* init a multi stack */
+  CURLM *multi = curl_multi_init();
+
+  /* create two easy handles */
+  CURL *http_handle = curl_easy_init();
+  CURL *http_handle2 = curl_easy_init();
+
+  /* add individual transfers */
+  curl_multi_add_handle(multi, http_handle);
+  curl_multi_add_handle(multi, http_handle2);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/curl_multi_assign.3 b/third-party/curl/docs/libcurl/curl_multi_assign.3
deleted file mode 100644
index 352fb50376..0000000000
--- a/third-party/curl/docs/libcurl/curl_multi_assign.3
+++ /dev/null
@@ -1,74 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_multi_assign 3 "9 Jul 2006" "libcurl" "libcurl"
-.SH NAME
-curl_multi_assign \- set data to associate with an internal socket
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_assign(CURLM *multi_handle, curl_socket_t sockfd,
-                            void *sockptr);
-.fi
-.SH DESCRIPTION
-This function creates an association in the multi handle between the given
-socket and a private pointer of the application. This is designed for
-\fIcurl_multi_socket_action(3)\fP uses.
-
-When set, the \fIsockptr\fP pointer is passed to all future socket callbacks
-for the specific \fIsockfd\fP socket.
-
-If the given \fIsockfd\fP is not already in use by libcurl, this function
-returns an error.
-
-libcurl only keeps one single pointer associated with a socket, so calling
-this function several times for the same socket makes the last set pointer get
-used.
-
-The idea here being that this association (socket to private pointer) is
-something that just about every application that uses this API needs and then
-libcurl can just as well do it since it already has the necessary
-functionality.
-
-It is acceptable to call this function from your multi callback functions.
-.SH EXAMPLE
-.nf
- /* make our struct pointer associated with socket fd */
- mc = curl_multi_assign(multi_handle, fd, ourstructp);
-.fi
-.SH AVAILABILITY
-Added in 7.15.5
-.SH RETURN VALUE
-The standard CURLMcode for multi interface error codes.
-.SH TYPICAL USAGE
-In a typical application you allocate a struct or at least use some kind of
-semi-dynamic data for each socket that we must wait for action on when using
-the \fIcurl_multi_socket_action(3)\fP approach.
-
-When our socket-callback gets called by libcurl and we get to know about yet
-another socket to wait for, we can use \fIcurl_multi_assign(3)\fP to point out
-the particular data so that when we get updates about this same socket again,
-we do not have to find the struct associated with this socket by ourselves.
-.SH "SEE ALSO"
-.BR curl_multi_setopt "(3), " curl_multi_socket_action "(3) "
diff --git a/third-party/curl/docs/libcurl/curl_multi_assign.md b/third-party/curl/docs/libcurl/curl_multi_assign.md
new file mode 100644
index 0000000000..784f5ad9a9
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_assign.md
@@ -0,0 +1,84 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_assign
+Section: 3
+Source: libcurl
+See-also:
+  - curl_multi_setopt (3)
+  - curl_multi_socket_action (3)
+  - CURLMOPT_SOCKETFUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.15.5
+---
+
+# NAME
+
+curl_multi_assign - set data to associate with an internal socket
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_assign(CURLM *multi_handle, curl_socket_t sockfd,
+                            void *sockptr);
+~~~
+
+# DESCRIPTION
+
+This function creates an association in the multi handle between the given
+socket and a private pointer of the application. This is designed for
+curl_multi_socket_action(3) uses.
+
+When set, the *sockptr* pointer is passed to all future socket callbacks for
+the specific *sockfd* socket, until the socket stops being monitored
+(CURL_POLL_REMOVE is sent to the CURLMOPT_SOCKETFUNCTION(3) callback).
+
+If the given *sockfd* is not already in use by libcurl, this function returns
+an error.
+
+libcurl only keeps one single pointer associated with a socket, so calling
+this function several times for the same socket makes the last set pointer get
+used.
+
+It is acceptable to call this function from your multi callback functions.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *multi = curl_multi_init();
+  int private = 123;
+  curl_socket_t fd = 0; /* file descriptor to associate our data with */
+
+  /* make our struct pointer associated with socket fd */
+  CURLMcode mresult = curl_multi_assign(multi, fd, &private);
+  if(mresult)
+    printf("error: %s\n", curl_multi_strerror(mresult));
+}
+~~~
+
+# TYPICAL USAGE
+
+In a typical application you allocate a struct or at least use some kind of
+semi-dynamic data for each socket that we must wait for action on when using
+the curl_multi_socket_action(3) approach.
+
+When our socket-callback gets called by libcurl and we get to know about yet
+another socket to wait for, we can use curl_multi_assign(3) to point out the
+particular data so that when we get updates about this same socket again, we
+do not have to find the struct associated with this socket by ourselves.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/curl_multi_cleanup.3 b/third-party/curl/docs/libcurl/curl_multi_cleanup.3
deleted file mode 100644
index 81098f4ef8..0000000000
--- a/third-party/curl/docs/libcurl/curl_multi_cleanup.3
+++ /dev/null
@@ -1,62 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_multi_cleanup 3 "1 March 2002" "libcurl" "libcurl"
-.SH NAME
-curl_multi_cleanup - close down a multi session
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_cleanup(CURLM *multi_handle);
-.fi
-.SH DESCRIPTION
-Cleans up and removes a whole multi stack. It does not free or touch any
-individual easy handles in any way - they still need to be closed
-individually, using the usual \fIcurl_easy_cleanup(3)\fP way. The order of
-cleaning up should be:
-
-1 - \fIcurl_multi_remove_handle(3)\fP before any easy handles are cleaned up
-
-2 - \fIcurl_easy_cleanup(3)\fP can now be called independently since the easy
-handle is no longer connected to the multi handle
-
-3 - \fIcurl_multi_cleanup(3)\fP should be called when all easy handles are
-removed
-
-Passing in a NULL pointer in \fImulti_handle\fP makes this function return
-CURLM_BAD_HANDLE immediately with no other action.
-.SH EXAMPLE
-.nf
- /* when the multi transfer is done ... */
-
- /* remove all easy handles, then: */
- curl_multi_cleanup(multi_handle);
-.fi
-.SH AVAILABILITY
-Added in 7.9.6
-.SH RETURN VALUE
-CURLMcode type, general libcurl multi interface error code. On success,
-CURLM_OK is returned.
-.SH "SEE ALSO"
-.BR curl_multi_init "(3)," curl_easy_cleanup "(3)," curl_easy_init "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_multi_cleanup.md b/third-party/curl/docs/libcurl/curl_multi_cleanup.md
new file mode 100644
index 0000000000..1d4a1f81ff
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_cleanup.md
@@ -0,0 +1,76 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_cleanup
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_cleanup (3)
+  - curl_easy_init (3)
+  - curl_multi_get_handles (3)
+  - curl_multi_init (3)
+Protocol:
+  - All
+Added-in: 7.9.6
+---
+
+# NAME
+
+curl_multi_cleanup - close down a multi session
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_cleanup(CURLM *multi_handle);
+~~~
+
+# DESCRIPTION
+
+This function is the opposite of curl_multi_init(3). Cleans up and removes a
+whole multi stack. It does not free or touch any individual easy handles in
+any way - they still need to be closed individually, using the usual
+curl_easy_cleanup(3) way. The order of cleaning up should be:
+
+1 - curl_multi_remove_handle(3) before any easy handles are cleaned up
+
+2 - curl_easy_cleanup(3) can now be called independently since the easy
+handle is no longer connected to the multi handle
+
+3 - curl_multi_cleanup(3) should be called when all easy handles are
+removed
+
+When this function is called, remaining entries in the connection pool held by
+the multi handle are shut down, which might trigger calls to the
+CURLMOPT_SOCKETFUNCTION(3) callback.
+
+Passing in a NULL pointer in *multi_handle* makes this function return
+CURLM_BAD_HANDLE immediately with no other action.
+
+Any use of the **multi_handle** after this function has been called and have
+returned, is illegal.
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *multi = curl_multi_init();
+
+  /* when the multi transfer is done ... */
+
+  /* remove all easy handles, then: */
+  curl_multi_cleanup(multi);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/curl_multi_fdset.3 b/third-party/curl/docs/libcurl/curl_multi_fdset.3
deleted file mode 100644
index d6b8a311fe..0000000000
--- a/third-party/curl/docs/libcurl/curl_multi_fdset.3
+++ /dev/null
@@ -1,102 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_multi_fdset 3 "2 Jan 2006" "libcurl" "libcurl"
-.SH NAME
-curl_multi_fdset - extracts file descriptor information from a multi handle
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_fdset(CURLM *multi_handle,
-                           fd_set *read_fd_set,
-                           fd_set *write_fd_set,
-                           fd_set *exc_fd_set,
-                           int *max_fd);
-.ad
-.SH DESCRIPTION
-This function extracts file descriptor information from a given multi_handle.
-libcurl returns its \fIfd_set\fP sets. The application can use these to
-select() on, but be sure to \fIFD_ZERO\fP them before calling this function as
-\fIcurl_multi_fdset(3)\fP only adds its own descriptors, it does not zero or
-otherwise remove any others. The \fIcurl_multi_perform(3)\fP function should
-be called as soon as one of them is ready to be read from or written to.
-
-If the \fIread_fd_set\fP argument is not a null pointer, it points to an
-object of type \fBfd_set\fP that on returns specifies the file descriptors to
-be checked for being ready to read.
-
-If the \fIwrite_fd_set\fP argument is not a null pointer, it points to an
-object of type \fBfd_set\fP that on return specifies the file descriptors to
-be checked for being ready to write.
-
-If the \fIexc_fd_set\fP argument is not a null pointer, it points to an object
-of type \fBfd_set\fP that on return specifies the file descriptors to be
-checked for error conditions pending.
-
-If no file descriptors are set by libcurl, \fImax_fd\fP contain -1 when this
-function returns. Otherwise it contains the highest descriptor number libcurl
-set. When libcurl returns -1 in \fImax_fd\fP, it is because libcurl currently
-does something that is not possible for your application to monitor with a
-socket and unfortunately you can then not know exactly when the current action
-is completed using select(). You then need to wait a while before you proceed
-and call \fIcurl_multi_perform(3)\fP anyway. How long to wait? Unless
-\fIcurl_multi_timeout(3)\fP gives you a lower number, we suggest 100
-milliseconds or so, but you may want to test it out in your own particular
-conditions to find a suitable value.
-
-When doing select(), you should use \fIcurl_multi_timeout(3)\fP to figure out
-how long to wait for action. Call \fIcurl_multi_perform(3)\fP even if no
-activity has been seen on the \fBfd_sets\fP after the timeout expires as
-otherwise internal retries and timeouts may not work as you would think and
-want.
-
-If one of the sockets used by libcurl happens to be larger than what can be
-set in an \fBfd_set\fP, which on POSIX systems means that the file descriptor
-is larger than \fBFD_SETSIZE\fP, then libcurl tries to not set it. Setting a
-too large file descriptor in an \fBfd_set\fP implies an out of bounds write
-which can cause crashes, or worse. The effect of NOT storing it might possibly
-save you from the crash, but makes your program NOT wait for sockets it should
-wait for...
-.SH EXAMPLE
-.nf
- /* get file descriptors from the transfers */
- mc = curl_multi_fdset(multi_handle, &fdread, &fdwrite, &fdexcep, &maxfd);
-
- if(mc != CURLM_OK) {
-   fprintf(stderr, "curl_multi_fdset() failed, code %d.\\n", mc);
-   break;
- }
-
- /* wait for activity on one of the sockets */
- rc = select(maxfd + 1, &fdread, &fdwrite, &fdexcep, &timeout);
-.fi
-.SH AVAILABILITY
-Added in 7.9.6
-.SH RETURN VALUE
-\fBCURLMcode\fP type, general libcurl multi interface error code. See
-\fIlibcurl-errors(3)\fP
-.SH "SEE ALSO"
-.BR curl_multi_cleanup "(3), " curl_multi_init "(3), "
-.BR curl_multi_wait "(3), "
-.BR curl_multi_timeout "(3), " curl_multi_perform "(3), " select "(2) "
diff --git a/third-party/curl/docs/libcurl/curl_multi_fdset.md b/third-party/curl/docs/libcurl/curl_multi_fdset.md
new file mode 100644
index 0000000000..7ab65e424a
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_fdset.md
@@ -0,0 +1,129 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_fdset
+Section: 3
+Source: libcurl
+See-also:
+  - curl_multi_cleanup (3)
+  - curl_multi_init (3)
+  - curl_multi_perform (3)
+  - curl_multi_timeout (3)
+  - curl_multi_wait (3)
+  - curl_multi_waitfds (3)
+  - select (2)
+Protocol:
+  - All
+Added-in: 7.9.6
+---
+
+# NAME
+
+curl_multi_fdset - extract file descriptor information from a multi handle
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_fdset(CURLM *multi_handle,
+                           fd_set *read_fd_set,
+                           fd_set *write_fd_set,
+                           fd_set *exc_fd_set,
+                           int *max_fd);
+~~~
+
+# DESCRIPTION
+
+This function extracts file descriptor information from a given multi_handle.
+libcurl returns its *fd_set* sets. The application can use these to
+select() on, but be sure to *FD_ZERO* them before calling this function as
+curl_multi_fdset(3) only adds its own descriptors, it does not zero or
+otherwise remove any others. The curl_multi_perform(3) function should
+be called as soon as one of them is ready to be read from or written to.
+
+The *read_fd_set* argument should point to an object of type **fd_set**
+that on returns specifies the file descriptors to be checked for being ready
+to read.
+
+The *write_fd_set* argument should point to an object of type **fd_set**
+that on return specifies the file descriptors to be checked for being ready to
+write.
+
+The *exc_fd_set* argument should point to an object of type **fd_set**
+that on return specifies the file descriptors to be checked for error
+conditions.
+
+If no file descriptors are set by libcurl, *max_fd* contain -1 when this
+function returns. Otherwise it contains the highest descriptor number libcurl
+set. When libcurl returns -1 in *max_fd*, it is because libcurl currently
+does something that is not possible for your application to monitor with a
+socket and unfortunately you can then not know exactly when the current action
+is completed using select(). You then need to wait a while before you proceed
+and call curl_multi_perform(3) anyway. How long to wait? Unless
+curl_multi_timeout(3) gives you a lower number, we suggest 100
+milliseconds or so, but you may want to test it out in your own particular
+conditions to find a suitable value.
+
+When doing select(), you should use curl_multi_timeout(3) to figure out
+how long to wait for action. Call curl_multi_perform(3) even if no
+activity has been seen on the **fd_sets** after the timeout expires as
+otherwise internal retries and timeouts may not work as you would think and
+want.
+
+If one of the sockets used by libcurl happens to be larger than what can be
+set in an **fd_set**, which on POSIX systems means that the file descriptor
+is larger than **FD_SETSIZE**, then libcurl tries to not set it. Setting a
+too large file descriptor in an **fd_set** implies an out of bounds write
+which can cause crashes, or worse. The effect of NOT storing it might possibly
+save you from the crash, but makes your program NOT wait for sockets it should
+wait for...
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  fd_set fdread;
+  fd_set fdwrite;
+  fd_set fdexcep;
+  int maxfd;
+  int rc;
+  CURLMcode mresult;
+  struct timeval timeout = { 1, 0 };
+
+  CURLM *multi = curl_multi_init();
+
+  do {
+
+    /* call curl_multi_perform() */
+
+    FD_ZERO(&fdread);
+    FD_ZERO(&fdwrite);
+    FD_ZERO(&fdexcep);
+
+    /* get file descriptors from the transfers */
+    mresult = curl_multi_fdset(multi, &fdread, &fdwrite, &fdexcep, &maxfd);
+
+    if(mresult != CURLM_OK) {
+      fprintf(stderr, "curl_multi_fdset() failed, code %d.\n", mresult);
+      break;
+    }
+
+    /* wait for activity on one of the sockets */
+    rc = select(maxfd + 1, &fdread, &fdwrite, &fdexcep, &timeout);
+
+  } while(!mresult);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/curl_multi_get_handles.md b/third-party/curl/docs/libcurl/curl_multi_get_handles.md
new file mode 100644
index 0000000000..56da272b8a
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_get_handles.md
@@ -0,0 +1,81 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_get_handles
+Section: 3
+Source: libcurl
+See-also:
+  - curl_multi_add_handle (3)
+  - curl_multi_cleanup (3)
+  - curl_multi_init (3)
+  - curl_multi_remove_handle (3)
+Protocol:
+  - All
+Added-in: 8.4.0
+---
+
+# NAME
+
+curl_multi_get_handles - return all added easy handles
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURL **curl_multi_get_handles(CURLM *multi_handle);
+~~~
+
+# DESCRIPTION
+
+Returns an array with pointers to all added easy handles. The end of the list
+is marked with a NULL pointer.
+
+Even if there is not a single easy handle added, this still returns an array
+but with only a single NULL pointer entry.
+
+The returned array contains all the handles that are present at the time of
+the call. As soon as a handle has been removed from or a handle has been added
+to the multi handle after the handle array was returned, the two data points
+are out of sync.
+
+The order of the easy handles within the array is not guaranteed.
+
+The returned array may not be overwritten and must be freed with a call to
+curl_free(3) after use.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  /* init a multi stack */
+  CURLM *multi = curl_multi_init();
+  CURL *curl = curl_easy_init();
+
+  if(curl) {
+    /* add the transfer */
+    curl_multi_add_handle(multi, curl);
+
+    /* extract all added handles */
+    CURL **list = curl_multi_get_handles(multi);
+
+    if(list) {
+      int i;
+      /* remove all added handles */
+      for(i = 0; list[i]; i++) {
+        curl_multi_remove_handle(multi, list[i]);
+      }
+      curl_free(list);
+    }
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+Returns NULL on failure. Otherwise it returns a pointer to an allocated array.
diff --git a/third-party/curl/docs/libcurl/curl_multi_get_offt.md b/third-party/curl/docs/libcurl/curl_multi_get_offt.md
new file mode 100644
index 0000000000..875fa7e335
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_get_offt.md
@@ -0,0 +1,87 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_get_offt
+Section: 3
+Source: libcurl
+See-also:
+  - curl_multi_add_handle (3)
+  - curl_multi_remove_handle (3)
+Protocol:
+  - All
+Added-in: 8.16.0
+---
+
+# NAME
+
+curl_multi_get_offt - extract information from a multi handle
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_get_offt(CURLM *multi_handle,
+                              CURLMinfo_offt info,
+                              curl_off_t *pvalue);
+~~~
+
+# DESCRIPTION
+
+Get the *info* kept in the *multi* handle. If the *info* is not applicable,
+this function returns CURLM_UNKNOWN_OPTION.
+
+# OPTIONS
+
+The following information can be extracted:
+
+## CURLMINFO_XFERS_CURRENT
+
+See CURLMINFO_XFERS_CURRENT(3).
+
+## CURLMINFO_XFERS_RUNNING
+
+See CURLMINFO_XFERS_RUNNING(3).
+
+## CURLMINFO_XFERS_PENDING
+
+See CURLMINFO_XFERS_PENDING(3).
+
+## CURLMINFO_XFERS_DONE
+
+See CURLMINFO_XFERS_DONE(3).
+
+## CURLMINFO_XFERS_ADDED
+
+See CURLMINFO_XFERS_ADDED(3).
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  /* init a multi stack */
+  CURLM *multi = curl_multi_init();
+  CURL *curl = curl_easy_init();
+  curl_off_t n;
+
+  if(curl) {
+    /* add the transfer */
+    curl_multi_add_handle(multi, curl);
+
+    curl_multi_get_offt(multi, CURLMINFO_XFERS_ADDED, &n);
+    /* on successful add, n is 1 */
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred,
+see libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/curl_multi_info_read.3 b/third-party/curl/docs/libcurl/curl_multi_info_read.3
deleted file mode 100644
index d3212f5ab5..0000000000
--- a/third-party/curl/docs/libcurl/curl_multi_info_read.3
+++ /dev/null
@@ -1,98 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_multi_info_read 3 "18 Dec 2004" "libcurl" "libcurl"
-.SH NAME
-curl_multi_info_read - read multi stack information
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMsg *curl_multi_info_read(CURLM *multi_handle, int *msgs_in_queue);
-.fi
-.SH DESCRIPTION
-Ask the multi handle if there are any messages from the individual
-transfers. Messages may include information such as an error code from the
-transfer or just the fact that a transfer is completed. More details on these
-should be written down as well.
-
-Repeated calls to this function returns a new struct each time, until a NULL
-is returned as a signal that there is no more to get at this point. The
-integer pointed to with \fImsgs_in_queue\fP contains the number of remaining
-messages after this function was called.
-
-When you fetch a message using this function, it is removed from the internal
-queue so calling this function again does not return the same message
-again. It instead returns new messages at each new invoke until the queue is
-emptied.
-
-\fBWARNING:\fP The data the returned pointer points to does not survive
-calling \fIcurl_multi_cleanup(3)\fP, \fIcurl_multi_remove_handle(3)\fP or
-\fIcurl_easy_cleanup(3)\fP.
-
-The \fICURLMsg\fP struct is simple and only contains basic information. If
-more involved information is wanted, the particular "easy handle" is present
-in that struct and can be used in subsequent regular
-\fIcurl_easy_getinfo(3)\fP calls (or similar):
-
-.nf
- struct CURLMsg {
-   CURLMSG msg;       /* what this message means */
-   CURL *easy_handle; /* the handle it concerns */
-   union {
-     void *whatever;    /* message-specific data */
-     CURLcode result;   /* return code for transfer */
-   } data;
- };
-.fi
-When \fBmsg\fP is \fICURLMSG_DONE\fP, the message identifies a transfer that
-is done, and then \fBresult\fP contains the return code for the easy handle
-that just completed.
-
-At this point, there are no other \fBmsg\fP types defined.
-.SH EXAMPLE
-.nf
-struct CURLMsg *m;
-
-/* call curl_multi_perform or curl_multi_socket_action first, then loop
-   through and check if there are any transfers that have completed */
-
-do {
-  int msgq = 0;
-  m = curl_multi_info_read(multi_handle, &msgq);
-  if(m && (m->msg == CURLMSG_DONE)) {
-    CURL *e = m->easy_handle;
-    transfers--;
-    curl_multi_remove_handle(multi_handle, e);
-    curl_easy_cleanup(e);
-  }
-} while(m);
-.fi
-.SH AVAILABILITY
-Added in 7.9.6
-.SH RETURN VALUE
-A pointer to a filled-in struct, or NULL if it failed or ran out of
-structs. It also writes the number of messages left in the queue (after this
-read) in the integer the second argument points to.
-.SH "SEE ALSO"
-.BR curl_multi_cleanup "(3), " curl_multi_init "(3), " curl_multi_perform "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_multi_info_read.md b/third-party/curl/docs/libcurl/curl_multi_info_read.md
new file mode 100644
index 0000000000..35f96c2db7
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_info_read.md
@@ -0,0 +1,105 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_info_read
+Section: 3
+Source: libcurl
+See-also:
+  - curl_multi_cleanup (3)
+  - curl_multi_init (3)
+  - curl_multi_perform (3)
+Protocol:
+  - All
+Added-in: 7.9.6
+---
+
+# NAME
+
+curl_multi_info_read - read multi stack information
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMsg *curl_multi_info_read(CURLM *multi_handle, int *msgs_in_queue);
+~~~
+
+# DESCRIPTION
+
+Ask the multi handle if there are any messages from the individual transfers.
+Messages may include information such as an error code from the transfer or
+the fact that a transfer is completed. More details on these should be written
+down as well.
+
+Repeated calls to this function returns a new struct each time, until a NULL
+is returned as a signal that there is no more to get at this point. The
+integer pointed to with *msgs_in_queue* contains the number of remaining
+messages after this function was called.
+
+When you fetch a message using this function, it is removed from the internal
+queue so calling this function again does not return the same message
+again. It instead returns new messages at each new invoke until the queue is
+emptied.
+
+**WARNING:** The data the returned pointer points to does not survive
+calling curl_multi_cleanup(3), curl_multi_remove_handle(3) or
+curl_easy_cleanup(3).
+
+The *CURLMsg* struct is simple and only contains basic information. If
+more involved information is wanted, the particular "easy handle" is present
+in that struct and can be used in subsequent regular
+curl_easy_getinfo(3) calls (or similar):
+
+~~~c
+struct CURLMsg {
+  CURLMSG msg;       /* what this message means */
+  CURL *easy_handle; /* the handle it concerns */
+  union {
+    void *whatever;    /* message-specific data */
+    CURLcode result;   /* return code for transfer */
+  } data;
+};
+~~~
+When **msg** is *CURLMSG_DONE*, the message identifies a transfer that
+is done, and then **result** contains the return code for the easy handle
+that completed.
+
+At this point, there are no other **msg** types defined.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *multi = curl_multi_init();
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    struct CURLMsg *m;
+
+    /* call curl_multi_perform or curl_multi_socket_action first, then loop
+       through and check if there are any transfers that have completed */
+
+    do {
+      int msgq = 0;
+      m = curl_multi_info_read(multi, &msgq);
+      if(m && (m->msg == CURLMSG_DONE)) {
+        CURL *e = m->easy_handle;
+        /* m->data.result holds the error code for the transfer */
+        curl_multi_remove_handle(multi, e);
+        curl_easy_cleanup(e);
+      }
+    } while(m);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+A pointer to a filled-in struct, or NULL if it failed or ran out of structs.
+It also writes the number of messages left in the queue (after this read) in
+the integer the second argument points to.
diff --git a/third-party/curl/docs/libcurl/curl_multi_init.3 b/third-party/curl/docs/libcurl/curl_multi_init.3
deleted file mode 100644
index aa0ba3b661..0000000000
--- a/third-party/curl/docs/libcurl/curl_multi_init.3
+++ /dev/null
@@ -1,53 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_multi_init 3 "1 March 2002" "libcurl" "libcurl"
-.SH NAME
-curl_multi_init - create a multi handle
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLM *curl_multi_init();
-.fi
-.SH DESCRIPTION
-This function returns a pointer to a \fICURLM\fP handle to be used as input to
-all the other multi-functions, sometimes referred to as a multi handle in some
-places in the documentation. This init call MUST have a corresponding call to
-\fIcurl_multi_cleanup(3)\fP when the operation is complete.
-.SH EXAMPLE
-.nf
-/* init a multi stack */
-multi_handle = curl_multi_init();
-
-/* add individual transfers */
-curl_multi_add_handle(multi_handle, http_handle);
-curl_multi_add_handle(multi_handle, http_handle2);
-.fi
-.SH AVAILABILITY
-Added in 7.9.6
-.SH RETURN VALUE
-If this function returns NULL, something went wrong and you cannot use the
-other curl functions.
-.SH "SEE ALSO"
-.BR curl_multi_cleanup "(3)," curl_global_init "(3)," curl_easy_init "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_multi_init.md b/third-party/curl/docs/libcurl/curl_multi_init.md
new file mode 100644
index 0000000000..28c3d69c6b
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_init.md
@@ -0,0 +1,64 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_init
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_init (3)
+  - curl_global_init (3)
+  - curl_multi_add_handle (3)
+  - curl_multi_cleanup (3)
+  - curl_multi_get_handles (3)
+Protocol:
+  - All
+Added-in: 7.9.6
+---
+
+# NAME
+
+curl_multi_init - create a multi handle
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLM *curl_multi_init();
+~~~
+
+# DESCRIPTION
+
+This function returns a pointer to a *CURLM* handle to be used as input to
+all the other multi-functions, sometimes referred to as a multi handle in some
+places in the documentation. This init call MUST have a corresponding call to
+curl_multi_cleanup(3) when the operation is complete.
+
+By default, several caches are stored in and held by the multi handle: DNS
+cache, connection pool, TLS session ID cache and the TLS CA cert cache. All
+transfers using the same multi handle share these caches.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  /* init a multi stack */
+  CURLM *multi = curl_multi_init();
+  CURL *curl = curl_easy_init();
+  CURL *curl2 = curl_easy_init();
+
+  /* add individual transfers */
+  curl_multi_add_handle(multi, curl);
+  curl_multi_add_handle(multi, curl2);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+If this function returns NULL, something went wrong and you cannot use the
+other curl functions.
diff --git a/third-party/curl/docs/libcurl/curl_multi_notify_disable.md b/third-party/curl/docs/libcurl/curl_multi_notify_disable.md
new file mode 100644
index 0000000000..11113a5898
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_notify_disable.md
@@ -0,0 +1,66 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_notify_disable
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_NOTIFYFUNCTION (3)
+  - CURLMOPT_NOTIFYDATA (3)
+  - curl_multi_notify_enable (3)
+Protocol:
+  - All
+Added-in: 8.17.0
+---
+
+# NAME
+
+curl_multi_notify_disable - disable a notification type
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+CURLMcode curl_multi_notify_disable(CURLM *multi_handle,
+                                    unsigned int notification);
+~~~
+
+# DESCRIPTION
+
+Disables collecting the given notification type in the multi handle. A
+callback function installed via CURLMOPT_NOTIFYFUNCTION(3) is no longer
+called when this notification happens.
+
+Only when a notification callback is installed *and* a notification
+is enabled are these collected and dispatched to the callback.
+
+Several notification types can be enabled at the same time. Disabling
+an already disabled notification is not an error.
+
+A notification can be enabled again via curl_multi_notify_enable(3).
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  int rc;
+  CURLM *multi = curl_multi_init();
+
+  rc = curl_multi_notify_disable(multi, CURLMNOTIFY_INFO_READ);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
+
+The return code is for the whole multi stack. Problems still might have
+occurred on individual transfers even when one of these functions return OK.
diff --git a/third-party/curl/docs/libcurl/curl_multi_notify_enable.md b/third-party/curl/docs/libcurl/curl_multi_notify_enable.md
new file mode 100644
index 0000000000..4a0da77714
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_notify_enable.md
@@ -0,0 +1,66 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_notify_enable
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_NOTIFYFUNCTION (3)
+  - CURLMOPT_NOTIFYDATA (3)
+  - curl_multi_notify_disable (3)
+Protocol:
+  - All
+Added-in: 8.17.0
+---
+
+# NAME
+
+curl_multi_notify_enable - enable a notification type
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+CURLMcode curl_multi_notify_enable(CURLM *multi_handle,
+                                   unsigned int notification);
+~~~
+
+# DESCRIPTION
+
+Enables collecting the given notification type in the multi handle. A
+callback function installed via CURLMOPT_NOTIFYFUNCTION(3) is called
+when this notification happens.
+
+Only when a notification callback is installed *and* a notification
+is enabled are these collected and dispatched to the callback.
+
+Several notification types can be enabled at the same time. Enabling
+an already enabled notification is not an error.
+
+A notification can be disabled again via curl_multi_notify_disable(3).
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  int rc;
+  CURLM *multi = curl_multi_init();
+
+  rc = curl_multi_notify_enable(multi, CURLMNOTIFY_INFO_READ);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
+
+The return code is for the whole multi stack. Problems still might have
+occurred on individual transfers even when one of these functions return OK.
diff --git a/third-party/curl/docs/libcurl/curl_multi_perform.3 b/third-party/curl/docs/libcurl/curl_multi_perform.3
deleted file mode 100644
index 97471a4caf..0000000000
--- a/third-party/curl/docs/libcurl/curl_multi_perform.3
+++ /dev/null
@@ -1,99 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_multi_perform 3 "1 March 2002" "libcurl" "libcurl"
-.SH NAME
-curl_multi_perform - reads/writes available data from easy handles
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_perform(CURLM *multi_handle, int *running_handles);
-.fi
-.SH DESCRIPTION
-This function performs transfers on all the added handles that need attention
-in a non-blocking fashion. The easy handles have previously been added to the
-multi handle with \fIcurl_multi_add_handle(3)\fP.
-
-When an application has found out there is data available for the multi_handle
-or a timeout has elapsed, the application should call this function to
-read/write whatever there is to read or write right now etc.
-\fIcurl_multi_perform(3)\fP returns as soon as the reads/writes are done. This
-function does not require that there actually is any data available for
-reading or that data can be written, it can be called just in case. It stores
-the number of handles that still transfer data in the second argument's
-integer-pointer.
-
-If the amount of \fIrunning_handles\fP is changed from the previous call (or
-is less than the amount of easy handles you have added to the multi handle),
-you know that there is one or more transfers less "running". You can then call
-\fIcurl_multi_info_read(3)\fP to get information about each individual
-completed transfer, and that returned info includes CURLcode and more. If an
-added handle fails quickly, it may never be counted as a running_handle. You
-could use \fIcurl_multi_info_read(3)\fP to track actual status of the added
-handles in that case.
-
-When \fIrunning_handles\fP is set to zero (0) on the return of this function,
-there is no longer any transfers in progress.
-
-When this function returns error, the state of all transfers are uncertain and
-they cannot be continued. \fIcurl_multi_perform(3)\fP should not be called
-again on the same multi handle after an error has been returned, unless first
-removing all the handles and adding new ones.
-.SH EXAMPLE
-.nf
-int still_running;
-do {
-  CURLMcode mc = curl_multi_perform(multi_handle, &still_running);
-
-  if(!mc && still_running)
-    /* wait for activity, timeout or "nothing" */
-    mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL);
-
-  if(mc) {
-    fprintf(stderr, "curl_multi_poll() failed, code %d.\\n", (int)mc);
-    break;
-  }
-
-/* if there are still transfers, loop! */
-} while(still_running);
-.fi
-.SH AVAILABILITY
-Added in 7.9.6
-.SH RETURN VALUE
-CURLMcode type, general libcurl multi interface error code.
-
-This function returns errors regarding the whole multi stack. Problems on
-individual transfers may have occurred even when this function returns
-\fICURLM_OK\fP. Use \fIcurl_multi_info_read(3)\fP to figure out how individual
-transfers did.
-.SH "TYPICAL USAGE"
-Most applications use \fIcurl_multi_poll(3)\fP to make libcurl wait for
-activity on any of the ongoing transfers. As soon as one or more file
-descriptor has activity or the function times out, the application calls
-\fIcurl_multi_perform(3)\fP.
-.SH "SEE ALSO"
-.BR curl_multi_cleanup "(3), " curl_multi_init "(3), "
-.BR curl_multi_wait "(3), " curl_multi_add_handle "(3), "
-.BR curl_multi_fdset "(3), " curl_multi_info_read "(3), "
-.BR libcurl-errors "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_multi_perform.md b/third-party/curl/docs/libcurl/curl_multi_perform.md
new file mode 100644
index 0000000000..e0335d81a8
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_perform.md
@@ -0,0 +1,118 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_perform
+Section: 3
+Source: libcurl
+See-also:
+  - curl_multi_add_handle (3)
+  - curl_multi_cleanup (3)
+  - curl_multi_fdset (3)
+  - curl_multi_info_read (3)
+  - curl_multi_init (3)
+  - curl_multi_wait (3)
+  - libcurl-errors (3)
+Protocol:
+  - All
+Added-in: 7.9.6
+---
+
+# NAME
+
+curl_multi_perform - run all transfers until it would block
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_perform(CURLM *multi_handle, int *running_handles);
+~~~
+
+# DESCRIPTION
+
+This function performs transfers on all the added handles that need attention
+in a non-blocking fashion. The easy handles have previously been added to the
+multi handle with curl_multi_add_handle(3).
+
+When an application has found out there is data available for the multi_handle
+or a timeout has elapsed, the application should call this function to
+read/write whatever there is to read or write right now etc.
+curl_multi_perform(3) returns as soon as the reads/writes are done. This
+function does not require that there actually is any data available for
+reading or that data can be written, it can be called as a precaution. It
+stores the number of handles that still transfer data in the second argument's
+integer-pointer.
+
+If the amount of *running_handles* is changed from the previous call (or
+is less than the amount of easy handles you have added to the multi handle),
+you know that there is one or more transfers less "running". You can then call
+curl_multi_info_read(3) to get information about each individual
+completed transfer, and that returned info includes CURLcode and more. If an
+added handle fails quickly, it may never be counted as a running_handle. You
+could use curl_multi_info_read(3) to track actual status of the added
+handles in that case.
+
+When *running_handles* is set to zero (0) on the return of this function,
+there is no longer any transfers in progress.
+
+When this function returns error, the state of all transfers are uncertain and
+they cannot be continued. curl_multi_perform(3) should not be called
+again on the same multi handle after an error has been returned, unless first
+removing all the handles and adding new ones.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  int still_running;
+  CURLM *multi = curl_multi_init();
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    curl_multi_add_handle(multi, curl);
+    for(;;) {
+      CURLMcode mresult = curl_multi_perform(multi, &still_running);
+      if(mresult != CURLM_OK) {
+        fprintf(stderr, "curl_multi_perform() failed, code %d.\n",
+                (int)mresult);
+        break;
+      }
+
+      if(!still_running) {
+        break;
+      }
+
+      /* wait for activity, timeout or "nothing" */
+      mresult = curl_multi_poll(multi, NULL, 0, 1000, NULL);
+      if(mresult != CURLM_OK) {
+        fprintf(stderr, "curl_multi_poll() failed, code %d.\n", (int)mresult);
+        break;
+      }
+    } /* if there are still transfers, loop */
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
+
+This function returns errors regarding the whole multi stack. Problems on
+individual transfers may have occurred even when this function returns
+*CURLM_OK*. Use curl_multi_info_read(3) to figure out how individual transfers
+did.
+
+# TYPICAL USAGE
+
+Most applications use curl_multi_poll(3) to make libcurl wait for
+activity on any of the ongoing transfers. As soon as one or more file
+descriptor has activity or the function times out, the application calls
+curl_multi_perform(3).
diff --git a/third-party/curl/docs/libcurl/curl_multi_poll.3 b/third-party/curl/docs/libcurl/curl_multi_poll.3
deleted file mode 100644
index f515487ae4..0000000000
--- a/third-party/curl/docs/libcurl/curl_multi_poll.3
+++ /dev/null
@@ -1,119 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_multi_poll 3 "29 Jul 2019" "libcurl" "libcurl"
-.SH NAME
-curl_multi_poll - polls on all easy handles in a multi handle
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_poll(CURLM *multi_handle,
-                          struct curl_waitfd extra_fds[],
-                          unsigned int extra_nfds,
-                          int timeout_ms,
-                          int *numfds);
-.ad
-.SH DESCRIPTION
-\fIcurl_multi_poll(3)\fP polls all file descriptors used by the curl easy
-handles contained in the given multi handle set. It blocks until activity is
-detected on at least one of the handles or \fItimeout_ms\fP has passed.
-Alternatively, if the multi handle has a pending internal timeout that has a
-shorter expiry time than \fItimeout_ms\fP, that shorter time is used instead
-to make sure timeout accuracy is reasonably kept.
-
-The calling application may pass additional curl_waitfd structures which are
-similar to \fIpoll(2)\fP's \fIpollfd\fP structure to be waited on in the same
-call.
-
-On completion, if \fInumfds\fP is non-NULL, it gets populated with the total
-number of file descriptors on which interesting events occurred. This number
-can include both libcurl internal descriptors as well as descriptors provided
-in \fIextra_fds\fP.
-
-The \fIcurl_multi_wakeup(3)\fP function can be used from another thread to
-wake up this function and return faster. This is one of the details
-that makes this function different than \fIcurl_multi_wait(3)\fP which cannot
-be woken up this way.
-
-If no extra file descriptors are provided and libcurl has no file descriptor
-to offer to wait for, this function instead waits during \fItimeout_ms\fP
-milliseconds (or shorter if an internal timer indicates so). This is the other
-detail that makes this function different than \fIcurl_multi_wait(3)\fP.
-
-This function is encouraged to be used instead of select(3) when using the
-multi interface to allow applications to easier circumvent the common problem
-with 1024 maximum file descriptors.
-.SH curl_waitfd
-.nf
-struct curl_waitfd {
-  curl_socket_t fd;
-  short events;
-  short revents;
-};
-.fi
-.IP CURL_WAIT_POLLIN
-Bit flag to curl_waitfd.events indicating the socket should poll on read
-events such as new data received.
-.IP CURL_WAIT_POLLPRI
-Bit flag to curl_waitfd.events indicating the socket should poll on high
-priority read events such as out of band data.
-.IP CURL_WAIT_POLLOUT
-Bit flag to curl_waitfd.events indicating the socket should poll on write
-events such as the socket being clear to write without blocking.
-.SH EXAMPLE
-.nf
-CURL *easy_handle;
-CURLM *multi_handle;
-
-/* add the individual easy handle */
-curl_multi_add_handle(multi_handle, easy_handle);
-
-do {
-  CURLMcode mc;
-  int numfds;
-
-  mc = curl_multi_perform(multi_handle, &still_running);
-
-  if(mc == CURLM_OK) {
-    /* wait for activity or timeout */
-    mc = curl_multi_poll(multi_handle, NULL, 0, 1000, &numfds);
-  }
-
-  if(mc != CURLM_OK) {
-    fprintf(stderr, "curl_multi failed, code %d.\\n", mc);
-    break;
-  }
-
-} while(still_running);
-
-curl_multi_remove_handle(multi_handle, easy_handle);
-.fi
-.SH AVAILABILITY
-Added in 7.66.0.
-.SH RETURN VALUE
-CURLMcode type, general libcurl multi interface error code. See
-\fIlibcurl-errors(3)\fP
-.SH "SEE ALSO"
-.BR curl_multi_fdset "(3), " curl_multi_perform "(3), "
-.BR curl_multi_wait "(3), " curl_multi_wakeup "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_multi_poll.md b/third-party/curl/docs/libcurl/curl_multi_poll.md
new file mode 100644
index 0000000000..8c2488feb3
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_poll.md
@@ -0,0 +1,150 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_poll
+Section: 3
+Source: libcurl
+See-also:
+  - curl_multi_fdset (3)
+  - curl_multi_perform (3)
+  - curl_multi_wait (3)
+  - curl_multi_wakeup (3)
+Protocol:
+  - All
+Added-in: 7.66.0
+---
+
+# NAME
+
+curl_multi_poll - poll on all easy handles in a multi handle
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_poll(CURLM *multi_handle,
+                          struct curl_waitfd extra_fds[],
+                          unsigned int extra_nfds,
+                          int timeout_ms,
+                          int *numfds);
+~~~
+
+# DESCRIPTION
+
+curl_multi_poll(3) polls all file descriptors used by the curl easy
+handles contained in the given multi handle set. It blocks until activity is
+detected on at least one of the handles or *timeout_ms* has passed.
+Alternatively, if the multi handle has a pending internal timeout that has a
+shorter expiry time than *timeout_ms*, that shorter time is used instead
+to make sure timeout accuracy is reasonably kept.
+
+The calling application may pass additional curl_waitfd structures which are
+similar to *poll(2)*'s *pollfd* structure to be waited on in the same
+call.
+
+On completion, if *numfds* is non-NULL, it gets populated with the total
+number of file descriptors on which interesting events occurred. This number
+can include both libcurl internal descriptors as well as descriptors provided
+in *extra_fds*.
+
+The curl_multi_wakeup(3) function can be used from another thread to
+wake up this function and return faster. This is one of the details
+that makes this function different than curl_multi_wait(3) which cannot
+be woken up this way.
+
+If no extra file descriptors are provided and libcurl has no file descriptor
+to offer to wait for, this function instead waits during *timeout_ms*
+milliseconds (or shorter if an internal timer indicates so). This is the other
+detail that makes this function different than curl_multi_wait(3).
+
+This function is encouraged to be used instead of select(3) when using the
+multi interface to allow applications to easier circumvent the common problem
+with 1024 maximum file descriptors.
+
+# curl_waitfd
+
+~~~c
+struct curl_waitfd {
+  curl_socket_t fd;
+  short events;
+  short revents;
+};
+~~~
+
+## CURL_WAIT_POLLIN
+
+Bit flag to curl_waitfd.events indicating the socket should poll on read
+events such as new data received.
+
+## CURL_WAIT_POLLPRI
+
+Bit flag to curl_waitfd.events indicating the socket should poll on high
+priority read events such as out of band data.
+
+## CURL_WAIT_POLLOUT
+
+Bit flag to curl_waitfd.events indicating the socket should poll on write
+events such as the socket being clear to write without blocking.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+extern void handle_fd(int);
+
+int main(void)
+{
+  CURL *easy_handle;
+  CURLM *multi_handle;
+  int still_running = 0;
+  int myfd = 2; /* this is our own file descriptor */
+
+  multi_handle = curl_multi_init();
+  easy_handle = curl_easy_init();
+
+  /* add the individual easy handle */
+  curl_multi_add_handle(multi_handle, easy_handle);
+
+  do {
+    CURLMcode mresult;
+    int numfds;
+
+    mresult = curl_multi_perform(multi_handle, &still_running);
+
+    if(mresult == CURLM_OK) {
+      struct curl_waitfd myown;
+      myown.fd = myfd;
+      myown.events = CURL_WAIT_POLLIN; /* wait for input */
+      myown.revents = 0; /* clear it */
+
+      /* wait for activity on curl's descriptors or on our own,
+         or timeout */
+      mresult = curl_multi_poll(multi_handle, &myown, 1, 1000, &numfds);
+
+      if(myown.revents) {
+        /* did our descriptor receive an event? */
+        handle_fd(myfd);
+      }
+    }
+
+    if(mresult != CURLM_OK) {
+      fprintf(stderr, "curl_multi failed, code %d.\n", mresult);
+      break;
+    }
+
+  } while(still_running);
+
+  curl_multi_remove_handle(multi_handle, easy_handle);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/curl_multi_remove_handle.3 b/third-party/curl/docs/libcurl/curl_multi_remove_handle.3
deleted file mode 100644
index 7e129ce017..0000000000
--- a/third-party/curl/docs/libcurl/curl_multi_remove_handle.3
+++ /dev/null
@@ -1,71 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_multi_remove_handle 3 "6 March 2002" "libcurl" "libcurl"
-.SH NAME
-curl_multi_remove_handle - remove an easy handle from a multi session
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_remove_handle(CURLM *multi_handle, CURL *easy_handle);
-.fi
-.SH DESCRIPTION
-Removes a given \fIeasy_handle\fP from the \fImulti_handle\fP. This makes the
-specified easy handle be removed from this multi handle's control.
-
-When the easy handle has been removed from a multi stack, it is again
-perfectly legal to invoke \fIcurl_easy_perform(3)\fP on this easy handle.
-
-Removing an easy handle while being in use is perfectly legal and effectively
-halts the transfer in progress involving that easy handle. All other easy
-handles and transfers remain unaffected.
-
-It is fine to remove a handle at any time during a transfer, just not from
-within any libcurl callback function.
-
-Removing an easy handle from the multi handle before the corresponding
-transfer is complete might cause libcurl to close the connection - if the
-state of it and the internal protocol handler deem it necessary. Otherwise
-libcurl keeps the connection alive in the connection pool associated with the
-multi handle, ready to get reused for a future transfer using this multi
-handle.
-.SH EXAMPLE
-.nf
-/* when an easy handle has completed, remove it */
-msg = curl_multi_info_read(multi_handle, &queued);
-if(msg) {
-  if(msg->msg == CURLMSG_DONE) {
-    /* a transfer ended */
-    fprintf(stderr, "Transfer completed\\n");
-    curl_multi_remove_handle(multi_handle, msg->easy_handle);
-  }
-}
-.fi
-.SH AVAILABILITY
-Added in 7.9.6
-.SH RETURN VALUE
-CURLMcode type, general libcurl multi interface error code.
-.SH "SEE ALSO"
-.BR curl_multi_cleanup "(3)," curl_multi_init "(3), "
-.BR curl_multi_add_handle "(3) "
diff --git a/third-party/curl/docs/libcurl/curl_multi_remove_handle.md b/third-party/curl/docs/libcurl/curl_multi_remove_handle.md
new file mode 100644
index 0000000000..fed6439c44
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_remove_handle.md
@@ -0,0 +1,79 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_remove_handle
+Section: 3
+Source: libcurl
+See-also:
+  - curl_multi_add_handle (3)
+  - curl_multi_cleanup (3)
+  - curl_multi_init (3)
+Protocol:
+  - All
+Added-in: 7.9.6
+---
+
+# NAME
+
+curl_multi_remove_handle - remove an easy handle from a multi session
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_remove_handle(CURLM *multi_handle, CURL *easy_handle);
+~~~
+
+# DESCRIPTION
+
+Removes a given *easy_handle* from the *multi_handle*. This makes the
+specified easy handle be removed from this multi handle's control.
+
+When the easy handle has been removed from a multi stack, it is again
+perfectly legal to invoke curl_easy_perform(3) on this easy handle.
+
+Removing an easy handle while being in use is perfectly legal and effectively
+halts the transfer in progress involving that easy handle. All other easy
+handles and transfers remain unaffected.
+
+It is fine to remove a handle at any time during a transfer, but not from
+within any libcurl callback function.
+
+Removing an easy handle from the multi handle before the corresponding
+transfer is complete might cause libcurl to close the connection - if the
+state of it and the internal protocol handler deem it necessary. Otherwise
+libcurl keeps the connection alive in the connection pool associated with the
+multi handle, ready to get reused for a future transfer using this multi
+handle.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *multi = curl_multi_init();
+  int queued = 0;
+
+  /* when an easy handle has completed, remove it */
+  CURLMsg *msg = curl_multi_info_read(multi, &queued);
+  if(msg) {
+    if(msg->msg == CURLMSG_DONE) {
+      /* a transfer ended */
+      fprintf(stderr, "Transfer completed\n");
+      curl_multi_remove_handle(multi, msg->easy_handle);
+    }
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/curl_multi_setopt.3 b/third-party/curl/docs/libcurl/curl_multi_setopt.3
deleted file mode 100644
index dca0ee15a3..0000000000
--- a/third-party/curl/docs/libcurl/curl_multi_setopt.3
+++ /dev/null
@@ -1,89 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_multi_setopt 3 "4 Nov 2014" "libcurl" "libcurl"
-.SH NAME
-curl_multi_setopt \- set options for a curl multi handle
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_setopt(CURLM *multi_handle, CURLMoption option, param);
-.fi
-.SH DESCRIPTION
-\fIcurl_multi_setopt(3)\fP is used to tell a libcurl multi handle how to
-behave. By using the appropriate options to \fIcurl_multi_setopt(3)\fP, you
-can change libcurl's behavior when using that multi handle. All options are
-set with the \fIoption\fP followed by the parameter \fIparam\fP. That
-parameter can be a \fBlong\fP, a \fBfunction pointer\fP, an \fBobject
-pointer\fP or a \fBcurl_off_t\fP type, depending on what the specific option
-expects. Read this manual carefully as bad input values may cause libcurl to
-behave badly. You can only set one option in each function call.
-
-.SH OPTIONS
-.IP CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE
-See \fICURLMOPT_CHUNK_LENGTH_PENALTY_SIZE(3)\fP
-.IP CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE
-See \fICURLMOPT_CONTENT_LENGTH_PENALTY_SIZE(3)\fP
-.IP CURLMOPT_MAX_HOST_CONNECTIONS
-See \fICURLMOPT_MAX_HOST_CONNECTIONS(3)\fP
-.IP CURLMOPT_MAX_PIPELINE_LENGTH
-See \fICURLMOPT_MAX_PIPELINE_LENGTH(3)\fP
-.IP CURLMOPT_MAX_TOTAL_CONNECTIONS
-See \fICURLMOPT_MAX_TOTAL_CONNECTIONS(3)\fP
-.IP CURLMOPT_MAXCONNECTS
-See \fICURLMOPT_MAXCONNECTS(3)\fP
-.IP CURLMOPT_PIPELINING
-See \fICURLMOPT_PIPELINING(3)\fP
-.IP CURLMOPT_PIPELINING_SITE_BL
-See \fICURLMOPT_PIPELINING_SITE_BL(3)\fP
-.IP CURLMOPT_PIPELINING_SERVER_BL
-See \fICURLMOPT_PIPELINING_SERVER_BL(3)\fP
-.IP CURLMOPT_PUSHFUNCTION
-See \fICURLMOPT_PUSHFUNCTION(3)\fP
-.IP CURLMOPT_PUSHDATA
-See \fICURLMOPT_PUSHDATA(3)\fP
-.IP CURLMOPT_SOCKETFUNCTION
-See \fICURLMOPT_SOCKETFUNCTION(3)\fP
-.IP CURLMOPT_SOCKETDATA
-See \fICURLMOPT_SOCKETDATA(3)\fP
-.IP CURLMOPT_TIMERFUNCTION
-See \fICURLMOPT_TIMERFUNCTION(3)\fP
-.IP CURLMOPT_TIMERDATA
-See \fICURLMOPT_TIMERDATA(3)\fP
-.IP CURLMOPT_MAX_CONCURRENT_STREAMS
-See \fICURLMOPT_MAX_CONCURRENT_STREAMS(3)\fP
-.SH EXAMPLE
-.fi
-  /* Limit the amount of simultaneous connections curl should allow: */
-  curl_multi_setopt(handle, CURLMOPT_MAXCONNECTS, (long)MAX_PARALLEL);
-.nf
-.SH AVAILABILITY
-Added in 7.15.4
-.SH RETURN VALUE
-The standard CURLMcode for multi interface error codes. Note that it returns a
-CURLM_UNKNOWN_OPTION if you try setting an option that this version of libcurl
-does not know of.
-.SH "SEE ALSO"
-.BR curl_multi_cleanup "(3), " curl_multi_init "(3), "
-.BR curl_multi_socket "(3), " curl_multi_info_read "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_multi_setopt.md b/third-party/curl/docs/libcurl/curl_multi_setopt.md
new file mode 100644
index 0000000000..0bf7438cc8
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_setopt.md
@@ -0,0 +1,154 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_setopt
+Section: 3
+Source: libcurl
+See-also:
+  - curl_multi_cleanup (3)
+  - curl_multi_info_read (3)
+  - curl_multi_init (3)
+  - curl_multi_socket (3)
+Protocol:
+  - All
+Added-in: 7.15.4
+---
+
+# NAME
+
+curl_multi_setopt - set options for a curl multi handle
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_setopt(CURLM *multi, CURLMoption option, parameter);
+~~~
+
+# DESCRIPTION
+
+curl_multi_setopt(3) is used to tell a libcurl multi handle how to behave. By
+using the appropriate options to curl_multi_setopt(3), you can change
+libcurl's behavior when using that multi handle. All options are set with the
+*option* followed by the *parameter*. That parameter can be a **long**, a
+**function pointer**, an **object pointer** or a **curl_off_t** type,
+depending on what the specific option expects. Read this manual carefully as
+bad input values may cause libcurl to behave badly. You can only set one
+option in each function call.
+
+# OPTIONS
+
+## CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE
+
+**deprecated** See CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE(3)
+
+## CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE
+
+**deprecated** See CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE(3)
+
+## CURLMOPT_MAXCONNECTS
+
+Size of connection cache. See CURLMOPT_MAXCONNECTS(3)
+
+## CURLMOPT_MAX_CONCURRENT_STREAMS
+
+Max concurrent streams for http2. See CURLMOPT_MAX_CONCURRENT_STREAMS(3)
+
+## CURLMOPT_MAX_HOST_CONNECTIONS
+
+Max number of connections to a single host. See
+CURLMOPT_MAX_HOST_CONNECTIONS(3)
+
+## CURLMOPT_MAX_PIPELINE_LENGTH
+
+**deprecated**. See CURLMOPT_MAX_PIPELINE_LENGTH(3)
+
+## CURLMOPT_MAX_TOTAL_CONNECTIONS
+
+Max simultaneously open connections. See CURLMOPT_MAX_TOTAL_CONNECTIONS(3)
+
+## CURLMOPT_NETWORK_CHANGED
+
+Signal that the network has changed. See CURLMOPT_NETWORK_CHANGED(3)
+
+## CURLMOPT_NOTIFYDATA
+
+Custom pointer passed to the notify callback. See CURLMOPT_NOTIFYDATA(3)
+
+## CURLMOPT_NOTIFYFUNCTION
+
+Callback that receives notifications. See CURLMOPT_NOTIFYFUNCTION(3)
+
+## CURLMOPT_PIPELINING
+
+Enable HTTP multiplexing. See CURLMOPT_PIPELINING(3)
+
+## CURLMOPT_PIPELINING_SERVER_BL
+
+**deprecated**. See CURLMOPT_PIPELINING_SERVER_BL(3)
+
+## CURLMOPT_PIPELINING_SITE_BL
+
+**deprecated**. See CURLMOPT_PIPELINING_SITE_BL(3)
+
+## CURLMOPT_PUSHDATA
+
+Pointer to pass to push callback. See CURLMOPT_PUSHDATA(3)
+
+## CURLMOPT_PUSHFUNCTION
+
+Callback that approves or denies server pushes. See CURLMOPT_PUSHFUNCTION(3)
+
+## CURLMOPT_QUICK_EXIT
+
+Enable a quicker cleanup of the multi handle. See CURLMOPT_QUICK_EXIT(3)
+
+## CURLMOPT_RESOLVE_THREADS_MAX
+
+Max threads used for threaded DNS resolver. See CURLMOPT_RESOLVE_THREADS_MAX(3)
+
+## CURLMOPT_SOCKETDATA
+
+Custom pointer passed to the socket callback. See CURLMOPT_SOCKETDATA(3)
+
+## CURLMOPT_SOCKETFUNCTION
+
+Callback informed about what to wait for. See CURLMOPT_SOCKETFUNCTION(3)
+
+## CURLMOPT_TIMERDATA
+
+Custom pointer to pass to timer callback. See CURLMOPT_TIMERDATA(3)
+
+## CURLMOPT_TIMERFUNCTION
+
+Callback to receive timeout values. See CURLMOPT_TIMERFUNCTION(3)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+
+#define MAX_PARALLEL 45
+
+int main(void)
+{
+  CURLM *multi = curl_multi_init();
+
+  /* Limit the amount of simultaneous connections curl should allow: */
+  curl_multi_setopt(multi, CURLMOPT_MAXCONNECTS, (long)MAX_PARALLEL);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
+
+Note that it returns a CURLM_UNKNOWN_OPTION if you try setting an option that
+this version of libcurl does not know of.
diff --git a/third-party/curl/docs/libcurl/curl_multi_socket.3 b/third-party/curl/docs/libcurl/curl_multi_socket.3
deleted file mode 100644
index 3cfabe1726..0000000000
--- a/third-party/curl/docs/libcurl/curl_multi_socket.3
+++ /dev/null
@@ -1,92 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_multi_socket 3 "9 Jul 2006" "libcurl" "libcurl"
-.SH NAME
-curl_multi_socket \- reads/writes available data
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-CURLMcode curl_multi_socket(CURLM *multi_handle, curl_socket_t sockfd,
-                            int *running_handles);
-
-CURLMcode curl_multi_socket_all(CURLM *multi_handle,
-                                int *running_handles);
-.fi
-.SH DESCRIPTION
-These functions are deprecated. Do not use. See
-\fIcurl_multi_socket_action(3)\fP instead.
-
-At return, the integer \fBrunning_handles\fP points to contains the number of
-still running easy handles within the multi handle. When this number reaches
-zero, all transfers are complete/done. Note that when you call
-\fIcurl_multi_socket_action(3)\fP on a specific socket and the counter
-decreases by one, it DOES NOT necessarily mean that this exact socket/transfer
-is the one that completed. Use \fIcurl_multi_info_read(3)\fP to figure out
-which easy handle that completed.
-
-The \fIcurl_multi_socket_action(3)\fP functions inform the application about
-updates in the socket (file descriptor) status by doing none, one, or multiple
-calls to the socket callback function set with the
-\fICURLMOPT_SOCKETFUNCTION(3)\fP option to \fIcurl_multi_setopt(3)\fP. They
-update the status with changes since the previous time the callback was
-called.
-
-Get the timeout time by setting the \fICURLMOPT_TIMERFUNCTION(3)\fP option
-with \fIcurl_multi_setopt(3)\fP. Your application then gets called with
-information on how long to wait for socket actions at most before doing the
-timeout action: call the \fIcurl_multi_socket_action(3)\fP function with the
-\fBsockfd\fP argument set to CURL_SOCKET_TIMEOUT. You can also use the
-\fIcurl_multi_timeout(3)\fP function to poll the value at any given time, but
-for an event-based system using the callback is far better than relying on
-polling the timeout value.
-
-Usage of \fIcurl_multi_socket(3)\fP is deprecated, whereas the function is
-equivalent to \fIcurl_multi_socket_action(3)\fP with \fBev_bitmask\fP set to
-0.
-
-Force libcurl to (re-)check all its internal sockets and transfers instead of
-just a single one by calling \fIcurl_multi_socket_all(3)\fP. Note that there
-should not be any reason to use this function.
-.SH EXAMPLE
-.nf
-/* the event-library gets told when there activity on the socket 'fd',
-   which we translate to a call to curl_multi_socket_action() */
-int running;
-rc = curl_multi_socket(multi_handle, fd, &running);
-.fi
-.SH AVAILABILITY
-This function was added in libcurl 7.15.4, and is deemed stable since
-7.16.0.
-
-\fIcurl_multi_socket(3)\fP is deprecated, use
-\fIcurl_multi_socket_action(3)\fP instead!
-.SH "RETURN VALUE"
-CURLMcode type, general libcurl multi interface error code.
-
-The return code is for the whole multi stack. Problems still might have
-occurred on individual transfers even when one of these functions return OK.
-.SH "SEE ALSO"
-.BR curl_multi_cleanup "(3), " curl_multi_init "(3), "
-.BR curl_multi_fdset "(3), " curl_multi_info_read "(3), "
-.BR "the hiperfifo.c example"
diff --git a/third-party/curl/docs/libcurl/curl_multi_socket.md b/third-party/curl/docs/libcurl/curl_multi_socket.md
new file mode 100644
index 0000000000..f77bba8592
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_socket.md
@@ -0,0 +1,89 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_socket
+Section: 3
+Source: libcurl
+See-also:
+  - curl_multi_cleanup (3)
+  - curl_multi_fdset (3)
+  - curl_multi_info_read (3)
+  - curl_multi_init (3)
+  - the hiperfifo.c example
+Protocol:
+  - All
+Added-in: 7.15.4
+---
+
+# NAME
+
+curl_multi_socket - read/write available data
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+CURLMcode curl_multi_socket(CURLM *multi_handle, curl_socket_t sockfd,
+                            int *running_handles);
+~~~
+
+# DESCRIPTION
+
+This function is deprecated. Use curl_multi_socket_action(3) instead with
+**ev_bitmask** set to 0.
+
+At return, the integer **running_handles** points to contains the number of
+still running easy handles within the multi handle. When this number reaches
+zero, all transfers are complete/done. Note that when you call
+curl_multi_socket(3) on a specific socket and the counter decreases by one, it
+DOES NOT necessarily mean that this exact socket/transfer is the one that
+completed. Use curl_multi_info_read(3) to figure out which easy handle that
+completed.
+
+The curl_multi_socket(3) functions inform the application about updates in the
+socket (file descriptor) status by doing none, one, or multiple calls to the
+socket callback function set with the CURLMOPT_SOCKETFUNCTION(3) option to
+curl_multi_setopt(3). They update the status with changes since the previous
+time the callback was called.
+
+Get the timeout time by setting the CURLMOPT_TIMERFUNCTION(3) option with
+curl_multi_setopt(3). Your application then gets called with information on
+how long to wait for socket actions at most before doing the timeout action:
+call the curl_multi_socket_action(3) function with the **sockfd** argument set
+to CURL_SOCKET_TIMEOUT. You can also use the curl_multi_timeout(3) function to
+poll the value at any given time, but for an event-based system using the
+callback is far better than relying on polling the timeout value.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  /* the event-library gets told when there activity on the socket 'fd',
+     which we translate to a call to curl_multi_socket_action() */
+  int running;
+  int rc;
+  int fd = 2;
+  CURLM *multi = curl_multi_init();
+
+  rc = curl_multi_socket(multi, fd, &running);
+}
+~~~
+
+# DEPRECATED
+
+curl_multi_socket(3) is deprecated, use curl_multi_socket_action(3) instead.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
+
+The return code is for the whole multi stack. Problems still might have
+occurred on individual transfers even when one of these functions return OK.
diff --git a/third-party/curl/docs/libcurl/curl_multi_socket_action.3 b/third-party/curl/docs/libcurl/curl_multi_socket_action.3
deleted file mode 100644
index 54164c57f9..0000000000
--- a/third-party/curl/docs/libcurl/curl_multi_socket_action.3
+++ /dev/null
@@ -1,114 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_multi_socket_action 3 "9 Jul 2006" "libcurl" "libcurl"
-.SH NAME
-curl_multi_socket_action \- reads/writes available data given an action
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_socket_action(CURLM *multi_handle,
-                                   curl_socket_t sockfd,
-                                   int ev_bitmask,
-                                   int *running_handles);
-.fi
-.SH DESCRIPTION
-When the application has detected action on a socket handled by libcurl, it
-should call \fIcurl_multi_socket_action(3)\fP with the \fBsockfd\fP argument
-set to the socket with the action. When the events on a socket are known, they
-can be passed as an events bitmask \fBev_bitmask\fP by first setting
-\fBev_bitmask\fP to 0, and then adding using bitwise OR (|) any combination of
-events to be chosen from CURL_CSELECT_IN, CURL_CSELECT_OUT or
-CURL_CSELECT_ERR. When the events on a socket are unknown, pass 0 instead, and
-libcurl tests the descriptor internally. It is also permissible to pass
-CURL_SOCKET_TIMEOUT to the \fBsockfd\fP parameter in order to initiate the
-whole process or when a timeout occurs.
-
-At return, \fBrunning_handles\fP points to the number of running easy handles
-within the multi handle. When this number reaches zero, all transfers are
-complete/done. When you call \fIcurl_multi_socket_action(3)\fP on a specific
-socket and the counter decreases by one, it DOES NOT necessarily mean that
-this exact socket/transfer is the one that completed. Use
-\fIcurl_multi_info_read(3)\fP to figure out which easy handle that completed.
-
-The \fIcurl_multi_socket_action(3)\fP function informs the application about
-updates in the socket (file descriptor) status by doing none, one, or multiple
-calls to the socket callback function set with the
-\fICURLMOPT_SOCKETFUNCTION(3)\fP option to \fIcurl_multi_setopt(3)\fP. They
-update the status with changes since the previous time the callback was
-called.
-
-Get the timeout time by setting the \fICURLMOPT_TIMERFUNCTION(3)\fP option
-with \fIcurl_multi_setopt(3)\fP. Your application then gets called with
-information on how long to wait for socket actions at most before doing the
-timeout action: call the \fIcurl_multi_socket_action(3)\fP function with the
-\fBsockfd\fP argument set to CURL_SOCKET_TIMEOUT. You can also use the
-\fIcurl_multi_timeout(3)\fP function to poll the value at any given time, but
-for an event-based system using the callback is far better than relying on
-polling the timeout value.
-
-When this function returns error, the state of all transfers are uncertain and
-they cannot be continued. \fIcurl_multi_socket_action(3)\fP should not be
-called again on the same multi handle after an error has been returned, unless
-first removing all the handles and adding new ones.
-.SH "TYPICAL USAGE"
-1. Create a multi handle
-
-2. Set the socket callback with \fICURLMOPT_SOCKETFUNCTION(3)\fP
-
-3. Set the timeout callback with \fICURLMOPT_TIMERFUNCTION(3)\fP, to get to
-know what timeout value to use when waiting for socket activities.
-
-4. Add easy handles with curl_multi_add_handle()
-
-5. Provide some means to manage the sockets libcurl is using, so you can check
-them for activity. This can be done through your application code, or by way
-of an external library such as libevent or glib.
-
-6. Call curl_multi_socket_action(..., CURL_SOCKET_TIMEOUT, 0, ...)
-to kickstart everything. To get one or more callbacks called.
-
-7. Wait for activity on any of libcurl's sockets, use the timeout value your
-callback has been told.
-
-8, When activity is detected, call curl_multi_socket_action() for the
-socket(s) that got action. If no activity is detected and the timeout expires,
-call \fIcurl_multi_socket_action(3)\fP with \fICURL_SOCKET_TIMEOUT\fP.
-.SH EXAMPLE
-.nf
-/* the event-library gets told when there activity on the socket 'fd',
-   which we translate to a call to curl_multi_socket_action() */
-int running;
-rc = curl_multi_socket_action(multi_handle, fd, EVENT,
-                              &running);
-.fi
-.SH AVAILABILITY
-This function was added in libcurl 7.15.4, and is deemed stable since 7.16.0.
-.SH RETURN VALUE
-CURLMcode type, general libcurl multi interface error code. See
-\fIlibcurl-errors(3)\fP
-.SH "SEE ALSO"
-.BR curl_multi_cleanup "(3), " curl_multi_init "(3), "
-.BR curl_multi_fdset "(3), " curl_multi_info_read "(3), "
-.BR "the hiperfifo.c example"
diff --git a/third-party/curl/docs/libcurl/curl_multi_socket_action.md b/third-party/curl/docs/libcurl/curl_multi_socket_action.md
new file mode 100644
index 0000000000..4d690fd97d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_socket_action.md
@@ -0,0 +1,127 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_socket_action
+Section: 3
+Source: libcurl
+See-also:
+  - curl_multi_cleanup (3)
+  - curl_multi_fdset (3)
+  - curl_multi_info_read (3)
+  - curl_multi_init (3)
+  - the hiperfifo.c example
+Protocol:
+  - All
+Added-in: 7.16.3
+---
+
+# NAME
+
+curl_multi_socket_action - read/write available data given an action
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_socket_action(CURLM *multi_handle,
+                                   curl_socket_t sockfd,
+                                   int ev_bitmask,
+                                   int *running_handles);
+~~~
+
+# DESCRIPTION
+
+When the application has detected action on a socket handled by libcurl, it
+should call curl_multi_socket_action(3) with the **sockfd** argument
+set to the socket with the action. When the events on a socket are known, they
+can be passed as an events bitmask **ev_bitmask** by first setting
+**ev_bitmask** to 0, and then adding using bitwise OR (|) any combination of
+events to be chosen from CURL_CSELECT_IN, CURL_CSELECT_OUT or
+CURL_CSELECT_ERR. When the events on a socket are unknown, pass 0 instead, and
+libcurl tests the descriptor internally. It is also permissible to pass
+CURL_SOCKET_TIMEOUT to the **sockfd** parameter in order to initiate the
+whole process or when a timeout occurs.
+
+At return, **running_handles** points to the number of running easy handles
+within the multi handle. When this number reaches zero, all transfers are
+complete/done. When you call curl_multi_socket_action(3) on a specific
+socket and the counter decreases by one, it DOES NOT necessarily mean that
+this exact socket/transfer is the one that completed. Use
+curl_multi_info_read(3) to figure out which easy handle that completed.
+
+The curl_multi_socket_action(3) function informs the application about
+updates in the socket (file descriptor) status by doing none, one, or multiple
+calls to the socket callback function set with the
+CURLMOPT_SOCKETFUNCTION(3) option to curl_multi_setopt(3). They
+update the status with changes since the previous time the callback was
+called.
+
+Get the timeout time by setting the CURLMOPT_TIMERFUNCTION(3) option
+with curl_multi_setopt(3). Your application then gets called with
+information on how long to wait for socket actions at most before doing the
+timeout action: call the curl_multi_socket_action(3) function with the
+**sockfd** argument set to CURL_SOCKET_TIMEOUT. You can also use the
+curl_multi_timeout(3) function to poll the value at any given time, but
+for an event-based system using the callback is far better than relying on
+polling the timeout value.
+
+When this function returns error, the state of all transfers are uncertain and
+they cannot be continued. curl_multi_socket_action(3) should not be
+called again on the same multi handle after an error has been returned, unless
+first removing all the handles and adding new ones.
+
+# TYPICAL USAGE
+
+1. Create a multi handle
+
+2. Set the socket callback with CURLMOPT_SOCKETFUNCTION(3)
+
+3. Set the timeout callback with CURLMOPT_TIMERFUNCTION(3), to get to
+know what timeout value to use when waiting for socket activities.
+
+4. Add easy handles with curl_multi_add_handle()
+
+5. Provide some means to manage the sockets libcurl is using, so you can check
+them for activity. This can be done through your application code, or by way
+of an external library such as libevent or glib.
+
+6. Call curl_multi_socket_action(..., CURL_SOCKET_TIMEOUT, 0, ...)
+to kickstart everything. To get one or more callbacks called.
+
+7. Wait for activity on any of libcurl's sockets, use the timeout value your
+callback has been told.
+
+8. When activity is detected, call curl_multi_socket_action() for the
+socket(s) that got action. If no activity is detected and the timeout expires,
+call curl_multi_socket_action(3) with *CURL_SOCKET_TIMEOUT*.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  /* the event-library gets told when there is activity on the socket 'fd',
+     which we translate to a call to curl_multi_socket_action() */
+  int running = 0;
+  int fd = 3; /* the descriptor that had action */
+  int bitmask = 2; /* what activity that happened */
+
+  CURLM *multi = curl_multi_init();
+
+  CURLMcode mresult = curl_multi_socket_action(multi, fd, bitmask, &running);
+  if(mresult)
+    printf("error: %s\n", curl_multi_strerror(mresult));
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/curl_multi_socket_all.3 b/third-party/curl/docs/libcurl/curl_multi_socket_all.3
deleted file mode 100644
index 428dd06f96..0000000000
--- a/third-party/curl/docs/libcurl/curl_multi_socket_all.3
+++ /dev/null
@@ -1 +0,0 @@
-.so man3/curl_multi_socket.3
diff --git a/third-party/curl/docs/libcurl/curl_multi_socket_all.md b/third-party/curl/docs/libcurl/curl_multi_socket_all.md
new file mode 100644
index 0000000000..48fe980e71
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_socket_all.md
@@ -0,0 +1,69 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_socket_all
+Section: 3
+Source: libcurl
+See-also:
+  - curl_multi_cleanup (3)
+  - curl_multi_fdset (3)
+  - curl_multi_info_read (3)
+  - curl_multi_init (3)
+  - the hiperfifo.c example
+Protocol:
+  - All
+Added-in: 7.15.4
+---
+
+# NAME
+
+curl_multi_socket_all - reads/writes available data for all easy handles
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_socket_all(CURLM *multi_handle,
+                                int *running_handles);
+~~~
+
+# DESCRIPTION
+
+This function is deprecated for performance reasons but there are no plans to
+remove it from the API. Use curl_multi_socket_action(3) instead.
+
+At return, the integer **running_handles** points to contains the number of
+still running easy handles within the multi handle. When this number reaches
+zero, all transfers are complete/done.
+
+Force libcurl to (re-)check all its internal sockets and transfers instead of
+a single one by calling curl_multi_socket_all(3). Note that there should not
+be any reason to use this function.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  int running;
+  int rc;
+  CURLM *multi = curl_multi_init();
+
+  rc = curl_multi_socket_all(multi, &running);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
+
+The return code is for the whole multi stack. Problems still might have
+occurred on individual transfers even when one of these functions return OK.
diff --git a/third-party/curl/docs/libcurl/curl_multi_strerror.3 b/third-party/curl/docs/libcurl/curl_multi_strerror.3
deleted file mode 100644
index 9bc805f8fa..0000000000
--- a/third-party/curl/docs/libcurl/curl_multi_strerror.3
+++ /dev/null
@@ -1,48 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_multi_strerror 3 "26 Apr 2004" "libcurl" "libcurl"
-.SH NAME
-curl_multi_strerror - return string describing error code
-.SH SYNOPSIS
-.nf
-.B #include <curl/curl.h>
-.BI "const char *curl_multi_strerror(CURLMcode " errornum ");"
-.SH DESCRIPTION
-The curl_multi_strerror() function returns a string describing the
-\fICURLMcode\fP error code passed in the argument \fIerrornum\fP.
-.SH EXAMPLE
-.nf
-int still_running;
-
-CURLMcode mc = curl_multi_perform(multi_handle, &still_running);
-if(mc)
-  printf("error: %s\\n", curl_multi_strerror(mc));
-.fi
-.SH AVAILABILITY
-This function was added in libcurl 7.12.0
-.SH RETURN VALUE
-A pointer to a null-terminated string.
-.SH "SEE ALSO"
-.BR libcurl-errors "(3), " curl_easy_strerror "(3), "
-.BR curl_share_strerror "(3), " curl_url_strerror "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_multi_strerror.md b/third-party/curl/docs/libcurl/curl_multi_strerror.md
new file mode 100644
index 0000000000..39b5b2d524
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_strerror.md
@@ -0,0 +1,54 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_strerror
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_strerror (3)
+  - curl_share_strerror (3)
+  - curl_url_strerror (3)
+  - libcurl-errors (3)
+Protocol:
+  - All
+Added-in: 7.12.0
+---
+
+# NAME
+
+curl_multi_strerror - return string describing error code
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+const char *curl_multi_strerror(CURLMcode errornum);
+~~~
+
+# DESCRIPTION
+
+This function returns a string describing the *CURLMcode* error code
+passed in the argument *errornum*.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  int still_running;
+  CURLM *multi = curl_multi_init();
+
+  CURLMcode mresult = curl_multi_perform(multi, &still_running);
+  if(mresult)
+    printf("error: %s\n", curl_multi_strerror(mresult));
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+A pointer to a null-terminated string.
diff --git a/third-party/curl/docs/libcurl/curl_multi_timeout.3 b/third-party/curl/docs/libcurl/curl_multi_timeout.3
deleted file mode 100644
index 3931409d9b..0000000000
--- a/third-party/curl/docs/libcurl/curl_multi_timeout.3
+++ /dev/null
@@ -1,83 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_multi_timeout 3 "2 Jan 2006" "libcurl" "libcurl"
-.SH NAME
-curl_multi_timeout \- how long to wait for action before proceeding
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_timeout(CURLM *multi_handle, long *timeout);
-.fi
-.SH DESCRIPTION
-
-An application using the libcurl multi interface should call
-\fIcurl_multi_timeout(3)\fP to figure out how long it should wait for socket
-actions \- at most \- before proceeding.
-
-Proceeding means either doing the socket-style timeout action: call the
-\fIcurl_multi_socket_action(3)\fP function with the \fBsockfd\fP argument set
-to CURL_SOCKET_TIMEOUT, or call \fIcurl_multi_perform(3)\fP if you are using
-the simpler and older multi interface approach.
-
-The timeout value returned in the long \fBtimeout\fP points to, is in number
-of milliseconds at this moment. If 0, it means you should proceed immediately
-without waiting for anything. If it returns -1, there is no timeout at all set.
-
-An application that uses the multi_socket API SHOULD NOT use this function,
-but SHOULD instead use the \fICURLMOPT_TIMERFUNCTION(3)\fP option for proper
-and desired behavior.
-
-Note: if libcurl returns a -1 timeout here, it just means that libcurl
-currently has no stored timeout value. You must not wait too long (more than a
-few seconds perhaps) before you call curl_multi_perform() again.
-.SH EXAMPLE
-.nf
-struct timeval timeout;
-long timeo;
-
-curl_multi_timeout(multi_handle, &timeo);
-if(timeo < 0)
-  /* no set timeout, use a default */
-  timeo = 980;
-
-timeout.tv_sec = timeo / 1000;
-timeout.tv_usec = (timeo % 1000) * 1000;
-
-/* wait for activities no longer than the set timeout */
-select(maxfd+1, &fdread, &fdwrite, &fdexcep, &timeout);
-.fi
-.SH TYPICAL USAGE
-Call \fIcurl_multi_timeout(3)\fP, then wait for action on the sockets. Figure
-out which sockets to wait for by calling \fIcurl_multi_fdset(3)\fP.
-
-When there is activity or timeout, call \fIcurl_multi_perform(3)\fP and then
-loop - until all transfers are complete.
-.SH AVAILABILITY
-This function was added in libcurl 7.15.4.
-.SH RETURN VALUE
-The standard CURLMcode for multi interface error codes.
-.SH "SEE ALSO"
-.BR curl_multi_fdset "(3), " curl_multi_info_read "(3), "
-.BR curl_multi_socket "(3), " curl_multi_setopt "(3) "
diff --git a/third-party/curl/docs/libcurl/curl_multi_timeout.md b/third-party/curl/docs/libcurl/curl_multi_timeout.md
new file mode 100644
index 0000000000..a4a7fa66fa
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_timeout.md
@@ -0,0 +1,95 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_timeout
+Section: 3
+Source: libcurl
+See-also:
+  - curl_multi_fdset (3)
+  - curl_multi_info_read (3)
+  - curl_multi_setopt (3)
+  - curl_multi_socket (3)
+Protocol:
+  - All
+Added-in: 7.15.4
+---
+
+# NAME
+
+curl_multi_timeout - how long to wait for action before proceeding
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_timeout(CURLM *multi_handle, long *timeout);
+~~~
+
+# DESCRIPTION
+
+An application using the libcurl multi interface should call
+curl_multi_timeout(3) to figure out how long it should wait for socket
+actions - at most - before proceeding.
+
+Proceeding means either doing the socket-style timeout action: call the
+curl_multi_socket_action(3) function with the **sockfd** argument set
+to CURL_SOCKET_TIMEOUT, or call curl_multi_perform(3) if you are using
+the simpler and older multi interface approach.
+
+The timeout value returned in the long **timeout_ms** points to, is in number
+of milliseconds at this moment. If 0, it means you should proceed immediately
+without waiting for anything. If it returns -1, there is no timeout at all set.
+
+An application that uses the *multi_socket* API should not use this function.
+It should instead use the CURLMOPT_TIMERFUNCTION(3) option for proper and
+desired behavior.
+
+Note: if libcurl returns a -1 timeout here, it means that libcurl currently
+has no stored timeout value. You must not wait too long (more than a few
+seconds perhaps) before you call curl_multi_perform(3) again.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  struct timeval timeout;
+  long timeo;
+  fd_set fdread;
+  fd_set fdwrite;
+  fd_set fdexcep;
+  int maxfd = 2;
+  CURLM *multi = curl_multi_init();
+
+  curl_multi_timeout(multi, &timeo);
+  if(timeo < 0)
+    /* no set timeout, use a default */
+    timeo = 980;
+
+  timeout.tv_sec = timeo / 1000;
+  timeout.tv_usec = (timeo % 1000) * 1000;
+
+  /* wait for activities no longer than the set timeout */
+  select(maxfd + 1, &fdread, &fdwrite, &fdexcep, &timeout);
+}
+~~~
+
+# TYPICAL USAGE
+
+Call curl_multi_timeout(3), then wait for action on the sockets. Figure
+out which sockets to wait for by calling curl_multi_fdset(3).
+
+When there is activity or timeout, call curl_multi_perform(3) and then
+loop - until all transfers are complete.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/curl_multi_wait.3 b/third-party/curl/docs/libcurl/curl_multi_wait.3
deleted file mode 100644
index 7490cfd3b4..0000000000
--- a/third-party/curl/docs/libcurl/curl_multi_wait.3
+++ /dev/null
@@ -1,126 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_multi_wait 3 "12 Jul 2012" "libcurl" "libcurl"
-.SH NAME
-curl_multi_wait - polls on all easy handles in a multi handle
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_wait(CURLM *multi_handle,
-                          struct curl_waitfd extra_fds[],
-                          unsigned int extra_nfds,
-                          int timeout_ms,
-                          int *numfds);
-.ad
-.SH DESCRIPTION
-\fIcurl_multi_wait(3)\fP polls all file descriptors used by the curl easy
-handles contained in the given multi handle set. It blocks until activity is
-detected on at least one of the handles or \fItimeout_ms\fP has passed.
-Alternatively, if the multi handle has a pending internal timeout that has a
-shorter expiry time than \fItimeout_ms\fP, that shorter time is be used
-instead to make sure timeout accuracy is reasonably kept.
-
-The calling application may pass additional \fIcurl_waitfd\fP structures which
-are similar to \fIpoll(2)\fP's \fIpollfd\fP structure to be waited on in the
-same call.
-
-On completion, if \fInumfds\fP is non-NULL, it gets populated with the total
-number of file descriptors on which interesting events occurred. This number
-can include both libcurl internal descriptors as well as descriptors provided
-in \fIextra_fds\fP.
-
-If no extra file descriptors are provided and libcurl has no file descriptor
-to offer to wait for, this function returns immediately. (Consider using
-\fIcurl_multi_poll(3)\fP to avoid this behavior.)
-
-This function is encouraged to be used instead of select(3) when using the
-multi interface to allow applications to easier circumvent the common problem
-with 1024 maximum file descriptors.
-.SH curl_waitfd
-.nf
-struct curl_waitfd {
-  curl_socket_t fd;
-  short events;
-  short revents;
-};
-.fi
-.IP CURL_WAIT_POLLIN
-Bit flag to \fIcurl_waitfd.events\fP indicating the socket should poll on read
-events such as new data received.
-.IP CURL_WAIT_POLLPRI
-Bit flag to \fIcurl_waitfd.events\fP indicating the socket should poll on high
-priority read events such as out of band data.
-.IP CURL_WAIT_POLLOUT
-Bit flag to \fIcurl_waitfd.events\fP indicating the socket should poll on
-write events such as the socket being clear to write without blocking.
-.SH EXAMPLE
-.nf
-CURL *easy_handle;
-CURLM *multi_handle;
-
-/* add the individual easy handle */
-curl_multi_add_handle(multi_handle, easy_handle);
-
-do {
-  CURLMcode mc;
-  int numfds;
-
-  mc = curl_multi_perform(multi_handle, &still_running);
-
-  if(mc == CURLM_OK ) {
-    /* wait for activity, timeout or "nothing" */
-    mc = curl_multi_wait(multi_handle, NULL, 0, 1000, &numfds);
-  }
-
-  if(mc != CURLM_OK) {
-    fprintf(stderr, "curl_multi failed, code %d.\\n", mc);
-    break;
-  }
-
-  /* 'numfds' being zero means either a timeout or no file descriptors to
-     wait for. Try timeout on first occurrence, then assume no file
-     descriptors and no file descriptors to wait for means wait for 100
-     milliseconds. */
-
-  if(!numfds) {
-    repeats++; /* count number of repeated zero numfds */
-    if(repeats > 1) {
-      WAITMS(100); /* sleep 100 milliseconds */
-    }
-  }
-  else
-    repeats = 0;
-
-} while(still_running);
-
-curl_multi_remove_handle(multi_handle, easy_handle);
-.fi
-.SH AVAILABILITY
-This function was added in libcurl 7.28.0.
-.SH RETURN VALUE
-CURLMcode type, general libcurl multi interface error code. See
-\fIlibcurl-errors(3)\fP
-.SH "SEE ALSO"
-.BR curl_multi_fdset "(3), " curl_multi_perform "(3), " curl_multi_poll "(3), "
diff --git a/third-party/curl/docs/libcurl/curl_multi_wait.md b/third-party/curl/docs/libcurl/curl_multi_wait.md
new file mode 100644
index 0000000000..f9a7b7b644
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_wait.md
@@ -0,0 +1,128 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_wait
+Section: 3
+Source: libcurl
+See-also:
+  - curl_multi_fdset (3)
+  - curl_multi_perform (3)
+  - curl_multi_poll (3)
+Protocol:
+  - All
+Added-in: 7.28.0
+---
+
+# NAME
+
+curl_multi_wait - poll on all easy handles in a multi handle
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_wait(CURLM *multi_handle,
+                          struct curl_waitfd extra_fds[],
+                          unsigned int extra_nfds,
+                          int timeout_ms,
+                          int *numfds);
+~~~
+
+# DESCRIPTION
+
+curl_multi_wait(3) polls all file descriptors used by the curl easy
+handles contained in the given multi handle set. It blocks until activity is
+detected on at least one of the handles or *timeout_ms* has passed.
+Alternatively, if the multi handle has a pending internal timeout that has a
+shorter expiry time than *timeout_ms*, that shorter time is being used
+instead to make sure timeout accuracy is reasonably kept.
+
+The calling application may pass additional *curl_waitfd* structures which
+are similar to *poll(2)*'s *pollfd* structure to be waited on in the
+same call.
+
+On completion, if *numfds* is non-NULL, it gets populated with the total
+number of file descriptors on which interesting events occurred. This number
+can include both libcurl internal descriptors as well as descriptors provided
+in *extra_fds*.
+
+If no extra file descriptors are provided and libcurl has no file descriptor
+to offer to wait for, this function returns immediately. (Consider using
+curl_multi_poll(3) to avoid this behavior.)
+
+This function is encouraged to be used instead of select(3) when using the
+multi interface to allow applications to easier circumvent the common problem
+with 1024 maximum file descriptors.
+
+# curl_waitfd
+
+~~~c
+struct curl_waitfd {
+  curl_socket_t fd;
+  short events;
+  short revents;
+};
+~~~
+
+## CURL_WAIT_POLLIN
+
+Bit flag to *curl_waitfd.events* indicating the socket should poll on read
+events such as new data received.
+
+## CURL_WAIT_POLLPRI
+
+Bit flag to *curl_waitfd.events* indicating the socket should poll on high
+priority read events such as out of band data.
+
+## CURL_WAIT_POLLOUT
+
+Bit flag to *curl_waitfd.events* indicating the socket should poll on
+write events such as the socket being clear to write without blocking.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *easy;
+  CURLM *multi = curl_multi_init();
+  int still_running;
+
+  easy = curl_easy_init();
+
+  /* add the individual easy handle */
+  curl_multi_add_handle(multi, easy);
+
+  do {
+    CURLMcode mresult;
+    int numfds;
+
+    mresult = curl_multi_perform(multi, &still_running);
+
+    if(mresult == CURLM_OK) {
+      /* wait for activity, timeout or "nothing" */
+      mresult = curl_multi_wait(multi, NULL, 0, 1000, &numfds);
+    }
+
+    if(mresult != CURLM_OK) {
+      fprintf(stderr, "curl_multi failed, code %d.\n", mresult);
+      break;
+    }
+
+  } while(still_running);
+
+  curl_multi_remove_handle(multi, easy);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/curl_multi_waitfds.md b/third-party/curl/docs/libcurl/curl_multi_waitfds.md
new file mode 100644
index 0000000000..7a4dac894b
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_waitfds.md
@@ -0,0 +1,112 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_waitfds
+Section: 3
+Source: libcurl
+See-also:
+  - curl_multi_perform (3)
+  - curl_multi_poll (3)
+  - curl_multi_wait (3)
+  - curl_multi_fdset (3)
+Protocol:
+  - All
+Added-in: 8.8.0
+---
+
+# NAME
+
+curl_multi_waitfds - extract file descriptor information from a multi handle
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+#include <stdlib.h>
+
+CURLMcode curl_multi_waitfds(CURLM *multi,
+                             struct curl_waitfd *ufds,
+                             unsigned int size,
+                             unsigned int *fd_count);
+~~~
+
+# DESCRIPTION
+
+This function extracts *curl_waitfd* structures which are similar to
+*poll(2)*'s *pollfd* structure from a given multi_handle.
+
+These structures can be used for polling on multi_handle file descriptors in a
+fashion similar to curl_multi_poll(3). The curl_multi_perform(3)
+function should be called as soon as one of them is ready to be read from or
+written to.
+
+libcurl fills provided *ufds* array up to the *size*.
+If a number of descriptors used by the multi_handle is greater than the
+*size* parameter then libcurl returns CURLM_OUT_OF_MEMORY error.
+
+If the *fd_count* argument is not a null pointer, it points to a variable
+that on return specifies the number of descriptors used by the multi_handle to
+be checked for being ready to read or write.
+
+The client code can pass *size* equal to zero to get the number of the
+descriptors and allocate appropriate storage for them to be used in a
+subsequent function call. In this case, *fd_count* receives a number greater
+than or equal to the number of descriptors.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <stdlib.h>
+
+int main(void)
+{
+  CURLMcode mresult;
+  struct curl_waitfd *ufds;
+
+  CURLM *multi = curl_multi_init();
+
+  do {
+    /* call curl_multi_perform() */
+
+    /* get the count of file descriptors from the transfers */
+    unsigned int fd_count = 0;
+
+    mresult = curl_multi_waitfds(multi, NULL, 0, &fd_count);
+
+    if(mresult != CURLM_OK) {
+      fprintf(stderr, "curl_multi_waitfds() failed, code %d.\n", mresult);
+      break;
+    }
+
+    if(!fd_count)
+      continue; /* no descriptors yet */
+
+    /* allocate storage for our descriptors */
+    ufds = malloc(fd_count * sizeof(struct curl_waitfd));
+
+    /* get wait descriptors from the transfers and put them into array. */
+    mresult = curl_multi_waitfds(multi, ufds, fd_count, &fd_count);
+
+    if(mresult != CURLM_OK) {
+      fprintf(stderr, "curl_multi_waitfds() failed, code %d.\n", mresult);
+      free(ufds);
+      break;
+    }
+
+    /* Do polling on descriptors in ufds */
+
+    free(ufds);
+  } while(!mresult);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/curl_multi_wakeup.3 b/third-party/curl/docs/libcurl/curl_multi_wakeup.3
deleted file mode 100644
index c8dc5b7c60..0000000000
--- a/third-party/curl/docs/libcurl/curl_multi_wakeup.3
+++ /dev/null
@@ -1,88 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_multi_wakeup 3 "17 Nov 2019" "libcurl" "libcurl"
-.SH NAME
-curl_multi_wakeup - wakes up a sleeping curl_multi_poll call
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_wakeup(CURLM *multi_handle);
-.fi
-.SH DESCRIPTION
-This function can be called from any thread and it wakes up a sleeping
-\fIcurl_multi_poll(3)\fP call that is currently (or is about to be) waiting
-for activity or a timeout.
-
-If the function is called when there is no \fIcurl_multi_poll(3)\fP call, it
-causes the next call to return immediately.
-
-Calling this function only guarantees to wake up the current (or the next if
-there is no current) \fIcurl_multi_poll(3)\fP call, which means it is possible
-that multiple calls to this function wake up the same waiting operation.
-
-This function has no effect on \fIcurl_multi_wait(3)\fP calls.
-.SH EXAMPLE
-.nf
-CURL *easy_handle;
-CURLM *multi_handle;
-
-/* add the individual easy handle */
-curl_multi_add_handle(multi_handle, easy_handle);
-
-/* this is thread 1 */
-do {
-  CURLMcode mc;
-  int numfds;
-
-  mc = curl_multi_perform(multi_handle, &still_running);
-
-  if(mc == CURLM_OK) {
-    /* wait for activity, timeout or wakeup */
-    mc = curl_multi_poll(multi_handle, NULL, 0, 10000, &numfds);
-  }
-
-  if(time_to_die())
-    exit(1);
-
-} while(still_running);
-
-curl_multi_remove_handle(multi_handle, easy_handle);
-
-/* this is thread 2 */
-
-if(something makes us decide to stop thread 1) {
-
-  set_something_to_signal_thread_1_to_exit();
-
-  curl_multi_wakeup(multi_handle);
-}
-
-.fi
-.SH AVAILABILITY
-Added in 7.68.0
-.SH RETURN VALUE
-CURLMcode type, general libcurl multi interface error code.
-.SH "SEE ALSO"
-.BR curl_multi_poll "(3), " curl_multi_wait "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_multi_wakeup.md b/third-party/curl/docs/libcurl/curl_multi_wakeup.md
new file mode 100644
index 0000000000..d95f9eb6b8
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_multi_wakeup.md
@@ -0,0 +1,99 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_multi_wakeup
+Section: 3
+Source: libcurl
+See-also:
+  - curl_multi_poll (3)
+  - curl_multi_wait (3)
+Protocol:
+  - All
+Added-in: 7.68.0
+---
+
+# NAME
+
+curl_multi_wakeup - wake up a sleeping curl_multi_poll call
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_wakeup(CURLM *multi_handle);
+~~~
+
+# DESCRIPTION
+
+This function can be called from any thread and it wakes up a sleeping
+curl_multi_poll(3) call that is currently (or is about to be) waiting
+for activity or a timeout.
+
+If the function is called when there is no curl_multi_poll(3) call, it
+causes the next call to return immediately.
+
+Calling this function only guarantees to wake up the current (or the next if
+there is no current) curl_multi_poll(3) call, which means it is possible
+that multiple calls to this function wake up the same waiting operation.
+
+This function has no effect on curl_multi_wait(3) calls.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+extern int time_to_die(void);
+extern int set_something_to_signal_thread_1_to_exit(void);
+extern int decide_to_stop_thread1();
+
+int main(void)
+{
+  CURL *easy;
+  CURLM *multi = curl_multi_init();
+  int still_running;
+
+  easy = curl_easy_init();
+
+  /* add the individual easy handle */
+  curl_multi_add_handle(multi, easy);
+
+  /* this is thread 1 */
+  do {
+    CURLMcode mresult;
+    int numfds;
+
+    mresult = curl_multi_perform(multi, &still_running);
+
+    if(mresult == CURLM_OK) {
+      /* wait for activity, timeout or wakeup */
+      mresult = curl_multi_poll(multi, NULL, 0, 10000, &numfds);
+    }
+
+    if(time_to_die())
+      return 1;
+
+  } while(still_running);
+
+  curl_multi_remove_handle(multi, easy);
+
+  /* this is thread 2 */
+
+  if(decide_to_stop_thread1()) {
+
+    set_something_to_signal_thread_1_to_exit();
+
+    curl_multi_wakeup(multi);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/curl_pushheader_byname.3 b/third-party/curl/docs/libcurl/curl_pushheader_byname.3
deleted file mode 100644
index 2c4c56e542..0000000000
--- a/third-party/curl/docs/libcurl/curl_pushheader_byname.3
+++ /dev/null
@@ -1,80 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_pushheader_byname 3 "9 Jun 2023" "libcurl" "libcurl"
-.SH NAME
-curl_pushheader_byname - get a push header by name
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-char *curl_pushheader_byname(struct curl_pushheaders *h, const char *name);
-.fi
-.SH DESCRIPTION
-This is a function that is only functional within a
-\fICURLMOPT_PUSHFUNCTION(3)\fP callback. It makes no sense to try to use it
-elsewhere and it has no function then.
-
-It returns the value for the given header field name (or NULL) for the
-incoming server push request. This is a shortcut so that the application does
-not have to loop through all headers to find the one it is interested in. The
-data this function points to is freed when this callback returns. If more than
-one header field use the same name, this returns only the first one.
-
-.SH EXAMPLE
-.nf
-int curl_push_callback(CURL *parent,
-                       CURL *easy,
-                       size_t num_headers,
-                       struct curl_pushheaders *headers,
-                       void *clientp)
-{
-  char *headp;
-  int *transfers = (int *)clientp;
-  FILE *out;
-  headp = curl_pushheader_byname(headers, ":path");
-  if(headp && !strncmp(headp, "/push-", 6)) {
-    fprintf(stderr, "The PATH is %s\\n", headp);
-
-    /* save the push here */
-    out = fopen("pushed-stream", "wb");
-
-    /* write to this file */
-    curl_easy_setopt(easy, CURLOPT_WRITEDATA, out);
-
-    (*transfers)++; /* one more */
-
-    return CURL_PUSH_OK;
-  }
-  return CURL_PUSH_DENY;
-}
-
-curl_multi_setopt(multi, CURLMOPT_PUSHFUNCTION, curl_push_callback);
-curl_multi_setopt(multi, CURLMOPT_PUSHDATA, &counter);
-.fi
-.SH AVAILABILITY
-Added in 7.44.0
-.SH RETURN VALUE
-Returns a pointer to the header field content or NULL.
-.SH "SEE ALSO"
-.BR CURLMOPT_PUSHFUNCTION "(3)," curl_pushheader_bynum "(3), "
diff --git a/third-party/curl/docs/libcurl/curl_pushheader_byname.md b/third-party/curl/docs/libcurl/curl_pushheader_byname.md
new file mode 100644
index 0000000000..e2968fcd46
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_pushheader_byname.md
@@ -0,0 +1,86 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_pushheader_byname
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_PUSHFUNCTION (3)
+  - curl_pushheader_bynum (3)
+Protocol:
+  - HTTP
+Added-in: 7.44.0
+---
+
+# NAME
+
+curl_pushheader_byname - get a push header by name
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+char *curl_pushheader_byname(struct curl_pushheaders *h, const char *name);
+~~~
+
+# DESCRIPTION
+
+This is a function that is only functional within a
+CURLMOPT_PUSHFUNCTION(3) callback. It makes no sense to try to use it
+elsewhere and it has no function then.
+
+It returns the value for the given header field name (or NULL) for the
+incoming server push request. This is a shortcut so that the application does
+not have to loop through all headers to find the one it is interested in. The
+data this function points to is freed when this callback returns and,
+although not constrained by its type, may not be altered. If more than
+one header field use the same name, this returns only the first one.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <string.h> /* for strncmp */
+
+static int push_cb(CURL *parent,
+                   CURL *easy,
+                   size_t num_headers,
+                   struct curl_pushheaders *headers,
+                   void *clientp)
+{
+  char *headp;
+  int *transfers = (int *)clientp;
+  FILE *out;
+  headp = curl_pushheader_byname(headers, ":path");
+  if(headp && !strncmp(headp, "/push-", 6)) {
+    fprintf(stderr, "The PATH is %s\n", headp);
+
+    /* save the push here */
+    out = fopen("pushed-stream", "wb");
+
+    /* write to this file */
+    curl_easy_setopt(easy, CURLOPT_WRITEDATA, out);
+
+    (*transfers)++; /* one more */
+
+    return CURL_PUSH_OK;
+  }
+  return CURL_PUSH_DENY;
+}
+
+int main(void)
+{
+  int counter;
+  CURLM *multi = curl_multi_init();
+  curl_multi_setopt(multi, CURLMOPT_PUSHFUNCTION, push_cb);
+  curl_multi_setopt(multi, CURLMOPT_PUSHDATA, &counter);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+Returns a pointer to the header field content or NULL.
diff --git a/third-party/curl/docs/libcurl/curl_pushheader_bynum.3 b/third-party/curl/docs/libcurl/curl_pushheader_bynum.3
deleted file mode 100644
index 2eecb24292..0000000000
--- a/third-party/curl/docs/libcurl/curl_pushheader_bynum.3
+++ /dev/null
@@ -1,70 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_pushheader_bynum 3 "9 Jun 2023" "libcurl" "libcurl"
-.SH NAME
-curl_pushheader_bynum - get a push header by index
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-char *curl_pushheader_bynum(struct curl_pushheaders *h, size_t num);
-.fi
-.SH DESCRIPTION
-This is a function that is only functional within a
-\fICURLMOPT_PUSHFUNCTION(3)\fP callback. It makes no sense to try to use it
-elsewhere and it has no function then.
-
-It returns the value for the header field at the given index \fBnum\fP, for
-the incoming server push request or NULL. The data pointed to is freed by
-libcurl when this callback returns. The returned pointer points to a
-"name:value" string that gets freed when this callback returns.
-
-.SH EXAMPLE
-.nf
-/* output all the incoming push request headers */
-int curl_push_callback(CURL *parent,
-                       CURL *easy,
-                       size_t num_headers,
-                       struct curl_pushheaders *headers,
-                       void *clientp)
-{
-  sizt_t i = 0;
-  char *field;
-  do {
-     field = curl_pushheader_bynum(headers, i);
-     if(field)
-       fprintf(stderr, "Push header: %s\\n", field);
-     i++;
-  } while(field);
-  return CURL_PUSH_OK; /* permission granted */
-}
-
-curl_multi_setopt(multi, CURLMOPT_PUSHFUNCTION, curl_push_callback);
-.fi
-.SH AVAILABILITY
-Added in 7.44.0
-.SH RETURN VALUE
-Returns a pointer to the header field content or NULL.
-.SH "SEE ALSO"
-.BR CURLMOPT_PUSHFUNCTION "(3)," curl_pushheader_byname "(3),"
diff --git a/third-party/curl/docs/libcurl/curl_pushheader_bynum.md b/third-party/curl/docs/libcurl/curl_pushheader_bynum.md
new file mode 100644
index 0000000000..429710f001
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_pushheader_bynum.md
@@ -0,0 +1,73 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_pushheader_bynum
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_PUSHFUNCTION (3)
+  - curl_pushheader_byname (3)
+Protocol:
+  - HTTP
+Added-in: 7.44.0
+---
+
+# NAME
+
+curl_pushheader_bynum - get a push header by index
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+char *curl_pushheader_bynum(struct curl_pushheaders *h, size_t num);
+~~~
+
+# DESCRIPTION
+
+This is a function that is only functional within a
+CURLMOPT_PUSHFUNCTION(3) callback. It makes no sense to try to use it
+elsewhere and it has no function then.
+
+It returns the value for the header field at the given index **num**, for
+the incoming server push request or NULL. The data pointed to is freed by
+libcurl when this callback returns. The returned pointer points to a
+"name:value" string that gets freed when this callback returns; although
+not constrained by its type, this string may not be altered.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+/* output all the incoming push request headers */
+static int push_cb(CURL *parent,
+                   CURL *easy,
+                   size_t num_headers,
+                   struct curl_pushheaders *headers,
+                   void *clientp)
+{
+  int i = 0;
+  char *field;
+  do {
+    field = curl_pushheader_bynum(headers, i);
+    if(field)
+      fprintf(stderr, "Push header: %s\n", field);
+    i++;
+  } while(field);
+  return CURL_PUSH_OK; /* permission granted */
+}
+
+int main(void)
+{
+  CURLM *multi = curl_multi_init();
+  curl_multi_setopt(multi, CURLMOPT_PUSHFUNCTION, push_cb);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+Returns a pointer to the header field content or NULL.
diff --git a/third-party/curl/docs/libcurl/curl_share_cleanup.3 b/third-party/curl/docs/libcurl/curl_share_cleanup.3
deleted file mode 100644
index 48fd4293b2..0000000000
--- a/third-party/curl/docs/libcurl/curl_share_cleanup.3
+++ /dev/null
@@ -1,55 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_share_cleanup 3 "8 Aug 2003" "libcurl" "libcurl"
-.SH NAME
-curl_share_cleanup - Clean up a shared object
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLSHcode curl_share_cleanup(CURLSH *share_handle);
-.fi
-.SH DESCRIPTION
-This function deletes a shared object. The share handle cannot be used anymore
-when this function has been called.
-
-Passing in a NULL pointer in \fIshare_handle\fP makes this function return
-immediately with no action.
-.SH EXAMPLE
-.nf
-  CURLSHcode sh;
-  share = curl_share_init();
-  sh = curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_CONNECT);
-  /* use the share, then ... */
-  curl_share_cleanup(share);
-.fi
-.SH AVAILABILITY
-Added in 7.10
-.SH RETURN VALUE
-CURLSHE_OK (zero) means that the option was set properly, non-zero means an
-error occurred as \fI<curl/curl.h>\fP defines. See the \fIlibcurl-errors.3\fP
-man page for the full list with descriptions. If an error occurs, then the
-share object is not deleted.
-.SH "SEE ALSO"
-.BR curl_share_init "(3), " curl_share_setopt "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_share_cleanup.md b/third-party/curl/docs/libcurl/curl_share_cleanup.md
new file mode 100644
index 0000000000..e8390ff3d6
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_share_cleanup.md
@@ -0,0 +1,66 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_share_cleanup
+Section: 3
+Source: libcurl
+See-also:
+  - curl_share_init (3)
+  - curl_share_setopt (3)
+Protocol:
+  - All
+Added-in: 7.10
+---
+
+# NAME
+
+curl_share_cleanup - close a shared object
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLSHcode curl_share_cleanup(CURLSH *share_handle);
+~~~
+
+# DESCRIPTION
+
+This function deletes a shared object. The share handle cannot be used anymore
+when this function has been called. The share fails the call if it is
+still being used in any easy handle.
+
+Passing in a NULL pointer in *share_handle* makes this function return
+immediately with no action.
+
+Any use of the **share_handle** after this function has been called and have
+returned, is illegal.
+
+For applications that use a share in several threads, it is critical that
+the destruction of the share is only done when all other threads have stopped
+using it. While libcurl tracks how many easy handles are using a share,
+it can not observe how many pointers to the share the application has.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLSHcode sh;
+  CURLSH *share = curl_share_init();
+  sh = curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_CONNECT);
+  /* use the share, then ... */
+  curl_share_cleanup(share);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+CURLSHE_OK (zero) means that the option was set properly, non-zero means an
+error occurred as *\<curl/curl.h\>* defines. See the libcurl-errors(3) man
+page for the full list with descriptions. If an error occurs, then the share
+object is not deleted.
diff --git a/third-party/curl/docs/libcurl/curl_share_init.3 b/third-party/curl/docs/libcurl/curl_share_init.3
deleted file mode 100644
index 3ef4d4c9b0..0000000000
--- a/third-party/curl/docs/libcurl/curl_share_init.3
+++ /dev/null
@@ -1,57 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_share_init 3 "Aug 3, 2003" "libcurl" "libcurl"
-.SH NAME
-curl_share_init - Create a shared object
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLSH *curl_share_init();
-.fi
-.SH DESCRIPTION
-This function returns a pointer to a \fICURLSH\fP handle to be used as input
-to all the other share-functions, sometimes referred to as a share handle in
-some places in the documentation. This init call MUST have a corresponding
-call to \fIcurl_share_cleanup(3)\fP when all operations using the share are
-complete.
-
-This \fIshare handle\fP is what you pass to curl using the
-\fICURLOPT_SHARE(3)\fP option with \fIcurl_easy_setopt(3)\fP, to make that
-specific curl handle use the data in this share.
-.SH EXAMPLE
-.nf
-  CURLSHcode sh;
-  share = curl_share_init();
-  sh = curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_CONNECT);
-  if(sh)
-    printf("Error: %s\\n", curl_share_strerror(sh));
-.fi
-.SH AVAILABILITY
-Added in 7.10
-.SH RETURN VALUE
-If this function returns NULL, something went wrong (out of memory, etc.)
-and therefore the share object was not created.
-.SH "SEE ALSO"
-.BR curl_share_cleanup "(3), " curl_share_setopt "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_share_init.md b/third-party/curl/docs/libcurl/curl_share_init.md
new file mode 100644
index 0000000000..deb61733cc
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_share_init.md
@@ -0,0 +1,59 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_share_init
+Section: 3
+Source: libcurl
+See-also:
+  - curl_share_cleanup (3)
+  - curl_share_setopt (3)
+Protocol:
+  - All
+Added-in: 7.10
+---
+
+# NAME
+
+curl_share_init - create a share object
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLSH *curl_share_init();
+~~~
+
+# DESCRIPTION
+
+This function returns a pointer to a *CURLSH* handle to be used as input
+to all the other share-functions, sometimes referred to as a share handle in
+some places in the documentation. This init call MUST have a corresponding
+call to curl_share_cleanup(3) when all operations using the share are
+complete.
+
+This *share handle* is what you pass to curl using the
+CURLOPT_SHARE(3) option with curl_easy_setopt(3), to make that
+specific curl handle use the data in this share.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLSHcode sh;
+  CURLSH *share = curl_share_init();
+  sh = curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_CONNECT);
+  if(sh)
+    printf("Error: %s\n", curl_share_strerror(sh));
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+If this function returns NULL, something went wrong (out of memory, etc.)
+and therefore the share object was not created.
diff --git a/third-party/curl/docs/libcurl/curl_share_setopt.3 b/third-party/curl/docs/libcurl/curl_share_setopt.3
deleted file mode 100644
index 6f7af15de5..0000000000
--- a/third-party/curl/docs/libcurl/curl_share_setopt.3
+++ /dev/null
@@ -1,61 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_share_setopt 3 "8 Aug 2003" "libcurl" "libcurl"
-.SH NAME
-curl_share_setopt - Set options for a shared object
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLSHcode curl_share_setopt(CURLSH *share, CURLSHoption option, parameter);
-.fi
-.SH DESCRIPTION
-Set the \fIoption\fP to \fIparameter\fP for the given \fIshare\fP.
-.SH OPTIONS
-.IP CURLSHOPT_LOCKFUNC
-See \fICURLSHOPT_LOCKFUNC(3)\fP.
-.IP CURLSHOPT_UNLOCKFUNC
-See \fICURLSHOPT_UNLOCKFUNC(3)\fP.
-.IP CURLSHOPT_SHARE
-See \fICURLSHOPT_SHARE(3)\fP.
-.IP CURLSHOPT_UNSHARE
-See \fICURLSHOPT_UNSHARE(3)\fP.
-.IP CURLSHOPT_USERDATA
-See \fICURLSHOPT_USERDATA(3)\fP.
-.SH EXAMPLE
-.nf
-  CURLSHcode sh;
-  share = curl_share_init();
-  sh = curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_CONNECT);
-  if(sh)
-    printf("Error: %s\\n", curl_share_strerror(sh));
-.fi
-.SH AVAILABILITY
-Added in 7.10
-.SH RETURN VALUE
-CURLSHE_OK (zero) means that the option was set properly, non-zero means an
-error occurred as \fI<curl/curl.h>\fP defines. See the \fIlibcurl-errors.3\fP
-man page for the full list with descriptions.
-.SH "SEE ALSO"
-.BR curl_share_cleanup "(3), " curl_share_init "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_share_setopt.md b/third-party/curl/docs/libcurl/curl_share_setopt.md
new file mode 100644
index 0000000000..a15955e4c7
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_share_setopt.md
@@ -0,0 +1,74 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_share_setopt
+Section: 3
+Source: libcurl
+See-also:
+  - curl_share_cleanup (3)
+  - curl_share_init (3)
+Protocol:
+  - All
+Added-in: 7.10
+---
+
+# NAME
+
+curl_share_setopt - set options for a shared object
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLSHcode curl_share_setopt(CURLSH *share, CURLSHoption option, parameter);
+~~~
+
+# DESCRIPTION
+
+Set the *option* to *parameter* for the given *share*.
+
+# OPTIONS
+
+## CURLSHOPT_LOCKFUNC
+
+See CURLSHOPT_LOCKFUNC(3).
+
+## CURLSHOPT_UNLOCKFUNC
+
+See CURLSHOPT_UNLOCKFUNC(3).
+
+## CURLSHOPT_SHARE
+
+See CURLSHOPT_SHARE(3).
+
+## CURLSHOPT_UNSHARE
+
+See CURLSHOPT_UNSHARE(3).
+
+## CURLSHOPT_USERDATA
+
+See CURLSHOPT_USERDATA(3).
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLSHcode sh;
+  CURLSH *share = curl_share_init();
+  sh = curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_CONNECT);
+  if(sh)
+    printf("Error: %s\n", curl_share_strerror(sh));
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+CURLSHE_OK (zero) means that the option was set properly, non-zero means an
+error occurred as *\<curl/curl.h\>* defines. See the libcurl-errors(3) man
+page for the full list with descriptions.
diff --git a/third-party/curl/docs/libcurl/curl_share_strerror.3 b/third-party/curl/docs/libcurl/curl_share_strerror.3
deleted file mode 100644
index 0e3f1c99c3..0000000000
--- a/third-party/curl/docs/libcurl/curl_share_strerror.3
+++ /dev/null
@@ -1,48 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_share_strerror 3 "Apr 26, 2004" "libcurl" "libcurl"
-.SH NAME
-curl_share_strerror - return string describing error code
-.SH SYNOPSIS
-.nf
-.B #include <curl/curl.h>
-.BI "const char *curl_share_strerror(CURLSHcode " errornum ");"
-.SH DESCRIPTION
-The \fIcurl_share_strerror(3)\fP function returns a string describing the
-\fICURLSHcode\fP error code passed in the argument \fIerrornum\fP.
-.SH EXAMPLE
-.nf
-  CURLSHcode sh;
-  share = curl_share_init();
-  sh = curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_CONNECT);
-  if(sh)
-    printf("Error: %s\\n", curl_share_strerror(sh));
-.fi
-.SH AVAILABILITY
-This function was added in libcurl 7.12.0
-.SH RETURN VALUE
-A pointer to a null-terminated string.
-.SH "SEE ALSO"
-.BR libcurl-errors "(3), " curl_multi_strerror "(3), "
-.BR curl_easy_strerror "(3), " curl_url_strerror "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_share_strerror.md b/third-party/curl/docs/libcurl/curl_share_strerror.md
new file mode 100644
index 0000000000..9c45278f53
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_share_strerror.md
@@ -0,0 +1,53 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_share_strerror
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_strerror (3)
+  - curl_multi_strerror (3)
+  - curl_url_strerror (3)
+  - libcurl-errors (3)
+Protocol:
+  - All
+Added-in: 7.12.0
+---
+
+# NAME
+
+curl_share_strerror - return string describing error code
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+const char *curl_share_strerror(CURLSHcode errornum);
+~~~
+
+# DESCRIPTION
+
+The curl_share_strerror(3) function returns a string describing the
+*CURLSHcode* error code passed in the argument *errornum*.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLSHcode sh;
+  CURLSH *share = curl_share_init();
+  sh = curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_CONNECT);
+  if(sh)
+    printf("Error: %s\n", curl_share_strerror(sh));
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+A pointer to a null-terminated string.
diff --git a/third-party/curl/docs/libcurl/curl_slist_append.3 b/third-party/curl/docs/libcurl/curl_slist_append.3
deleted file mode 100644
index 807f02e0fd..0000000000
--- a/third-party/curl/docs/libcurl/curl_slist_append.3
+++ /dev/null
@@ -1,77 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_slist_append 3 "19 Jun 2003" "libcurl" "libcurl"
-.SH NAME
-curl_slist_append - add a string to an slist
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-struct curl_slist *curl_slist_append(struct curl_slist *list,
-                                     const char *string);
-.fi
-.SH DESCRIPTION
-\fIcurl_slist_append(3)\fP appends a string to a linked list of strings. The
-existing \fBlist\fP should be passed as the first argument and the new list is
-returned from this function. Pass in NULL in the \fBlist\fP argument to create
-a new list. The specified \fBstring\fP has been appended when this function
-returns. \fIcurl_slist_append(3)\fP copies the string.
-
-The list should be freed again (after usage) with
-\fIcurl_slist_free_all(3)\fP.
-.SH EXAMPLE
-.nf
-CURL *handle;
-struct curl_slist *slist=NULL;
-struct curl_slist *temp=NULL;
-
-slist = curl_slist_append(slist, "pragma:");
-
-if (slist == NULL)
-  return -1;
-
-temp = curl_slist_append(slist, "Accept:")
-
-if (temp == NULL) {
-  curl_slist_free_all(slist);
-  return -1;
-}
-
-slist = temp;
-
-curl_easy_setopt(handle, CURLOPT_HTTPHEADER, slist);
-
-curl_easy_perform(handle);
-
-curl_slist_free_all(slist); /* free the list again */
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-A null pointer is returned if anything went wrong, otherwise the new list
-pointer is returned. To avoid overwriting an existing non-empty list on
-failure, the new list should be returned to a temporary variable which can
-be tested for NULL before updating the original list pointer.
-.SH "SEE ALSO"
-.BR curl_slist_free_all "(3), "
diff --git a/third-party/curl/docs/libcurl/curl_slist_append.md b/third-party/curl/docs/libcurl/curl_slist_append.md
new file mode 100644
index 0000000000..3ebc19e354
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_slist_append.md
@@ -0,0 +1,79 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_slist_append
+Section: 3
+Source: libcurl
+See-also:
+  - curl_slist_free_all (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+curl_slist_append - add a string to an slist
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+struct curl_slist *curl_slist_append(struct curl_slist *list,
+                                     const char *string);
+~~~
+
+# DESCRIPTION
+
+curl_slist_append(3) appends a string to a linked list of strings. The
+existing **list** should be passed as the first argument and the new list is
+returned from this function. Pass in NULL in the **list** argument to create a
+new list. The specified **string** has been appended when this function
+returns. curl_slist_append(3) copies the string. The **string** argument must
+be a valid string pointer and cannot be NULL.
+
+The list should be freed (after usage) with curl_slist_free_all(3).
+Its nodes and pointed content may not be altered outside this function.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *handle = curl_easy_init();
+  struct curl_slist *slist = NULL;
+  struct curl_slist *temp = NULL;
+
+  slist = curl_slist_append(slist, "pragma:");
+
+  if(!slist)
+    return -1;
+
+  temp = curl_slist_append(slist, "Accept:");
+
+  if(!temp) {
+    curl_slist_free_all(slist);
+    return -1;
+  }
+
+  slist = temp;
+
+  curl_easy_setopt(handle, CURLOPT_HTTPHEADER, slist);
+
+  curl_easy_perform(handle);
+
+  curl_slist_free_all(slist); /* free the list again */
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+A null pointer is returned if anything went wrong, otherwise the new list
+pointer is returned. To avoid overwriting an existing non-empty list on
+failure, the new list should be returned to a temporary variable which can
+be tested for NULL before updating the original list pointer.
diff --git a/third-party/curl/docs/libcurl/curl_slist_free_all.3 b/third-party/curl/docs/libcurl/curl_slist_free_all.3
deleted file mode 100644
index 8cca7a160e..0000000000
--- a/third-party/curl/docs/libcurl/curl_slist_free_all.3
+++ /dev/null
@@ -1,60 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_slist_free_all 3 "5 March 2001" "libcurl" "libcurl"
-.SH NAME
-curl_slist_free_all - free an entire curl_slist list
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-void curl_slist_free_all(struct curl_slist *list);
-.fi
-.SH DESCRIPTION
-curl_slist_free_all() removes all traces of a previously built curl_slist
-linked list.
-
-Passing in a NULL pointer in \fIlist\fP makes this function return immediately
-with no action.
-.SH EXAMPLE
-.nf
-CURL *handle;
-struct curl_slist *slist=NULL;
-
-slist = curl_slist_append(slist, "X-libcurl: coolness");
-
-if (slist == NULL)
-  return -1;
-
-curl_easy_setopt(handle, CURLOPT_HTTPHEADER, slist);
-
-curl_easy_perform(handle);
-
-curl_slist_free_all(slist); /* free the list again */
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Nothing.
-.SH "SEE ALSO"
-.BR curl_slist_append "(3), "
diff --git a/third-party/curl/docs/libcurl/curl_slist_free_all.md b/third-party/curl/docs/libcurl/curl_slist_free_all.md
new file mode 100644
index 0000000000..d3e5e04a95
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_slist_free_all.md
@@ -0,0 +1,64 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_slist_free_all
+Section: 3
+Source: libcurl
+See-also:
+  - curl_slist_append (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+curl_slist_free_all - free an entire curl_slist list
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+void curl_slist_free_all(struct curl_slist *list);
+~~~
+
+# DESCRIPTION
+
+curl_slist_free_all() removes all traces of a previously built curl_slist
+linked list.
+
+Passing in a NULL pointer in *list* makes this function return immediately
+with no action.
+
+Any use of the **list** after this function has been called and have returned,
+is illegal.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *handle = curl_easy_init();
+  struct curl_slist *slist = NULL;
+
+  slist = curl_slist_append(slist, "X-libcurl: coolness");
+
+  if(!slist)
+    return -1;
+
+  curl_easy_setopt(handle, CURLOPT_HTTPHEADER, slist);
+
+  curl_easy_perform(handle);
+
+  curl_slist_free_all(slist); /* free the list again */
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+Nothing.
diff --git a/third-party/curl/docs/libcurl/curl_strequal.3 b/third-party/curl/docs/libcurl/curl_strequal.3
deleted file mode 100644
index c66c6529ae..0000000000
--- a/third-party/curl/docs/libcurl/curl_strequal.3
+++ /dev/null
@@ -1,59 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_strequal 3 "30 April 2004" "libcurl" "libcurl"
-.SH NAME
-curl_strequal, curl_strnequal - case insensitive string comparisons
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-int curl_strequal(char *str1, char *str2);
-int curl_strnequal(char *str1, char *str2, size_t length);
-.fi
-.SH DESCRIPTION
-The
-.B curl_strequal()
-function compares the two strings \fIstr1\fP and \fIstr2\fP, ignoring the case
-of the characters. It returns a non-zero (TRUE) integer if the strings are
-identical.
-.sp
-The \fBcurl_strnequal()\fP function is similar, except it only compares the
-first \fIlength\fP characters of \fIstr1\fP.
-.sp
-These functions are provided by libcurl to enable applications to compare
-strings in a truly portable manner. There are no standard portable case
-insensitive string comparison functions. These two work on all platforms.
-.SH EXAMPLE
-.nf
-if(curl_strequal(name, input))
-  printf("Name and input matches\\n");
-if(curl_strnequal(name, input, 5))
-  printf("Name and input matches in the 5 first bytes\\n");
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Non-zero if the strings are identical. Zero if they are not.
-.SH "SEE ALSO"
-.BR strcmp "(3), " strcasecmp "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_strequal.md b/third-party/curl/docs/libcurl/curl_strequal.md
new file mode 100644
index 0000000000..e7270d874e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_strequal.md
@@ -0,0 +1,59 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_strequal
+Section: 3
+Source: libcurl
+See-also:
+  - curl_strnequal (3)
+  - strcasecmp (3)
+  - strcmp (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+curl_strequal - compare two strings ignoring case
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+int curl_strequal(const char *str1, const char *str2);
+~~~
+
+# DESCRIPTION
+
+The curl_strequal(3) function compares the two strings *str1* and *str2*,
+ignoring the case of the characters. It returns a non-zero (TRUE) integer if
+the strings are identical.
+
+This function uses plain ASCII based comparisons completely disregarding the
+locale - contrary to how **strcasecmp** and other system case insensitive
+string comparisons usually work.
+
+This function is provided by libcurl to enable applications to compare strings
+in a truly portable manner. There are no standard portable case insensitive
+string comparison functions. This function works on all platforms.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(int argc, char **argv)
+{
+  const char *name = "compare";
+  if(curl_strequal(name, argv[1]))
+    printf("Name and input matches\n");
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+Non-zero if the strings are identical. Zero if they are not.
diff --git a/third-party/curl/docs/libcurl/curl_strnequal.3 b/third-party/curl/docs/libcurl/curl_strnequal.3
deleted file mode 100644
index ce41d3e41d..0000000000
--- a/third-party/curl/docs/libcurl/curl_strnequal.3
+++ /dev/null
@@ -1 +0,0 @@
-.so man3/curl_strequal.3
diff --git a/third-party/curl/docs/libcurl/curl_strnequal.md b/third-party/curl/docs/libcurl/curl_strnequal.md
new file mode 100644
index 0000000000..db42bcdf8e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_strnequal.md
@@ -0,0 +1,62 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_strnequal
+Section: 3
+Source: libcurl
+See-also:
+  - curl_strequal (3)
+  - strcasecmp (3)
+  - strcmp (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+curl_strnequal - compare two strings ignoring case
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+int curl_strnequal(const char *str1, const char *str2, size_t length);
+~~~
+
+# DESCRIPTION
+
+The curl_strnequal(3) function compares the two strings *str1* and *str2*,
+ignoring the case of the characters. It returns a non-zero (TRUE) integer if
+the strings are identical.
+
+This function compares no more than the first *length* bytes of *str1* and
+*str2*.
+
+This function uses plain ASCII based comparisons completely disregarding the
+locale - contrary to how **strcasecmp** and other system case insensitive
+string comparisons usually work.
+
+This function is provided by libcurl to enable applications to compare strings
+in a truly portable manner. There are no standard portable case insensitive
+string comparison functions. This function works on all platforms.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(int argc, char **argv)
+{
+  const char *name = "compare";
+  if(curl_strnequal(name, argv[1], 5))
+    printf("Name and input matches in the 5 first bytes\n");
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+Non-zero if the strings are identical. Zero if they are not.
diff --git a/third-party/curl/docs/libcurl/curl_unescape.3 b/third-party/curl/docs/libcurl/curl_unescape.3
deleted file mode 100644
index c63e221f41..0000000000
--- a/third-party/curl/docs/libcurl/curl_unescape.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_unescape 3 "22 March 2001" "libcurl" "libcurl"
-.SH NAME
-curl_unescape - URL decodes the given string
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-char *curl_unescape(const char *input, int length);
-.fi
-.SH DESCRIPTION
-Obsolete function. Use \fIcurl_easy_unescape(3)\fP instead!
-
-This function converts the URL encoded string \fBinput\fP to a "plain string"
-and return that as a new allocated string. All input characters that are URL
-encoded (%XX where XX is a two-digit hexadecimal number) are converted to
-their plain text versions.
-
-If the \fBlength\fP argument is set to 0, \fIcurl_unescape(3)\fP calls
-strlen() on \fBinput\fP to find out the size.
-
-You must \fIcurl_free(3)\fP the returned string when you are done with it.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  int decodelen;
-  char *decoded = curl_unescape("%63%75%72%6c", 12, &decodelen);
-  if(decoded) {
-    /* do not assume printf() works on the decoded data! */
-    printf("Decoded: ");
-    /* ... */
-    curl_free(decoded);
-  }
-}
-.fi
-.SH AVAILABILITY
-Since 7.15.4, \fIcurl_easy_unescape(3)\fP should be used. This function might
-be removed in a future release.
-.SH RETURN VALUE
-A pointer to a null-terminated string or NULL if it failed.
-.SH "SEE ALSO"
-.BR curl_easy_escape "(3)," curl_easy_unescape "(3)," curl_free "(3)," RFC 2396
diff --git a/third-party/curl/docs/libcurl/curl_unescape.md b/third-party/curl/docs/libcurl/curl_unescape.md
new file mode 100644
index 0000000000..453fd53145
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_unescape.md
@@ -0,0 +1,73 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_unescape
+Section: 3
+Source: libcurl
+See-also:
+  - RFC 2396
+  - curl_easy_escape (3)
+  - curl_easy_unescape (3)
+  - curl_free (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+curl_unescape - URL decode a string
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+char *curl_unescape(const char *input, int length);
+~~~
+
+# DESCRIPTION
+
+Deprecated. Use curl_easy_unescape(3) instead.
+
+This function converts the URL encoded string **input** to a "plain string"
+and return that as a new allocated string. All input characters that are URL
+encoded (%XX where XX is a two-digit hexadecimal number) are converted to
+their plain text versions. Although not constrained by its type, the returned
+data may not be altered.
+
+If the **length** argument is set to 0, curl_unescape(3) calls
+strlen() on **input** to find out the size.
+
+You must curl_free(3) the returned string when you are done with it.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    char *decoded = curl_unescape("%63%75%72%6c", 12);
+    if(decoded) {
+      /* do not assume printf() works on the decoded data */
+      printf("Decoded: ");
+      /* ... */
+      curl_free(decoded);
+    }
+  }
+}
+~~~
+
+# DEPRECATED
+
+Since 7.15.4, curl_easy_unescape(3) should be used. This function might
+be removed in a future release.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+A pointer to a null-terminated string or NULL if it failed.
diff --git a/third-party/curl/docs/libcurl/curl_url.3 b/third-party/curl/docs/libcurl/curl_url.3
deleted file mode 100644
index 52ec37362c..0000000000
--- a/third-party/curl/docs/libcurl/curl_url.3
+++ /dev/null
@@ -1,62 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_url 3 "6 Aug 2018" "libcurl" "libcurl"
-.SH NAME
-curl_url - returns a new URL handle
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLU *curl_url();
-.fi
-.SH DESCRIPTION
-This function allocates a URL object and returns a \fICURLU\fP handle for it,
-to be used as input to all other URL API functions.
-
-This is a handle to a URL object that holds or can hold URL components for a
-single URL. When the object is first created, there is of course no components
-stored. They are then set in the object with the \fIcurl_url_set(3)\fP
-function.
-.SH EXAMPLE
-.nf
-  CURLUcode rc;
-  CURLU *url = curl_url();
-  rc = curl_url_set(url, CURLUPART_URL, "https://example.com", 0);
-  if(!rc) {
-    char *scheme;
-    rc = curl_url_get(url, CURLUPART_SCHEME, &scheme, 0);
-    if(!rc) {
-      printf("the scheme is %s\\n", scheme);
-      curl_free(scheme);
-    }
-    curl_url_cleanup(url);
-  }
-.fi
-.SH AVAILABILITY
-Added in 7.62.0
-.SH RETURN VALUE
-Returns a \fBCURLU *\fP if successful, or NULL if out of memory.
-.SH "SEE ALSO"
-.BR curl_url_cleanup "(3), " curl_url_get "(3), " curl_url_set "(3), "
-.BR curl_url_dup "(3), " curl_url_strerror "(3), " CURLOPT_CURLU "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_url.md b/third-party/curl/docs/libcurl/curl_url.md
new file mode 100644
index 0000000000..8053e630b8
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_url.md
@@ -0,0 +1,70 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_url
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CURLU (3)
+  - curl_url_cleanup (3)
+  - curl_url_dup (3)
+  - curl_url_get (3)
+  - curl_url_set (3)
+  - curl_url_strerror (3)
+Protocol:
+  - All
+Added-in: 7.62.0
+---
+
+# NAME
+
+curl_url - create a URL handle
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLU *curl_url();
+~~~
+
+# DESCRIPTION
+
+This function allocates a URL object and returns a *CURLU* handle for it,
+to be used as input to all other URL API functions.
+
+This is a handle to a URL object that holds or can hold URL components for a
+single URL. When the object is first created, there is of course no components
+stored. They are then set in the object with the curl_url_set(3)
+function.
+
+The object must be destroyed with a call to curl_url_cleanup(3) when no
+longer needed.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLUcode rc;
+  CURLU *url = curl_url();
+  rc = curl_url_set(url, CURLUPART_URL, "https://example.com", 0);
+  if(!rc) {
+    char *scheme;
+    rc = curl_url_get(url, CURLUPART_SCHEME, &scheme, 0);
+    if(!rc) {
+      printf("the scheme is %s\n", scheme);
+      curl_free(scheme);
+    }
+    curl_url_cleanup(url);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+Returns a **CURLU *** if successful, or NULL if out of memory.
diff --git a/third-party/curl/docs/libcurl/curl_url_cleanup.3 b/third-party/curl/docs/libcurl/curl_url_cleanup.3
deleted file mode 100644
index f3c8dff822..0000000000
--- a/third-party/curl/docs/libcurl/curl_url_cleanup.3
+++ /dev/null
@@ -1,50 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_url_cleanup 3 "6 Aug 2018" "libcurl" "libcurl"
-.SH NAME
-curl_url_cleanup - free the URL handle
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-void curl_url_cleanup(CURLU *handle);
-.fi
-.SH DESCRIPTION
-Frees all the resources associated with the given \fICURLU\fP handle!
-
-Passing in a NULL pointer in \fIhandle\fP makes this function return
-immediately with no action.
-.SH EXAMPLE
-.nf
-  CURLU *url = curl_url();
-  curl_url_set(url, CURLUPART_URL, "https://example.com", 0);
-  curl_url_cleanup(url);
-.fi
-.SH AVAILABILITY
-Added in 7.62.0
-.SH RETURN VALUE
-none
-.SH "SEE ALSO"
-.BR curl_url_dup "(3), " curl_url "(3), " curl_url_set "(3), "
-.BR curl_url_get "(3), " CURLOPT_CURLU "(3), "
diff --git a/third-party/curl/docs/libcurl/curl_url_cleanup.md b/third-party/curl/docs/libcurl/curl_url_cleanup.md
new file mode 100644
index 0000000000..36455fc0be
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_url_cleanup.md
@@ -0,0 +1,57 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_url_cleanup
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CURLU (3)
+  - curl_url (3)
+  - curl_url_dup (3)
+  - curl_url_get (3)
+  - curl_url_set (3)
+Protocol:
+  - All
+Added-in: 7.62.0
+---
+
+# NAME
+
+curl_url_cleanup - free the URL handle
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+void curl_url_cleanup(CURLU *handle);
+~~~
+
+# DESCRIPTION
+
+Frees all the resources associated with the given *CURLU* handle.
+
+Passing in a NULL pointer in *handle* makes this function return
+immediately with no action.
+
+Any use of the **handle** after this function has been called and have
+returned, is illegal.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLU *url = curl_url();
+  curl_url_set(url, CURLUPART_URL, "https://example.com", 0);
+  curl_url_cleanup(url);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+none
diff --git a/third-party/curl/docs/libcurl/curl_url_dup.3 b/third-party/curl/docs/libcurl/curl_url_dup.3
deleted file mode 100644
index 57931cc8f5..0000000000
--- a/third-party/curl/docs/libcurl/curl_url_dup.3
+++ /dev/null
@@ -1,55 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_url_dup 3 "6 Aug 2018" "libcurl" "libcurl"
-.SH NAME
-curl_url_dup - duplicate a URL handle
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLU *curl_url_dup(CURLU *inhandle);
-.fi
-.SH DESCRIPTION
-Duplicates the URL object the input \fICURLU\fP \fIinhandle\fP identifies and
-returns a pointer to the copy as a new \fICURLU\fP handle. The new handle also
-needs to be freed with \fIcurl_url_cleanup(3)\fP.
-.SH EXAMPLE
-.nf
-  CURLUcode rc;
-  CURLU *url = curl_url();
-  CURLU *url2;
-  rc = curl_url_set(url, CURLUPART_URL, "https://example.com", 0);
-  if(!rc) {
-    url2 = curl_url_dup(url); /* clone it! */
-    curl_url_cleanup(url2);
-  }
-  curl_url_cleanup(url);
-.fi
-.SH AVAILABILITY
-Added in 7.62.0
-.SH RETURN VALUE
-Returns a new handle or NULL if out of memory.
-.SH "SEE ALSO"
-.BR curl_url_cleanup "(3), " curl_url "(3), " curl_url_set "(3), "
-.BR curl_url_get "(3), " CURLOPT_CURLU "(3), "
diff --git a/third-party/curl/docs/libcurl/curl_url_dup.md b/third-party/curl/docs/libcurl/curl_url_dup.md
new file mode 100644
index 0000000000..cfba5cc1b9
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_url_dup.md
@@ -0,0 +1,59 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_url_dup
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CURLU (3)
+  - curl_url (3)
+  - curl_url_cleanup (3)
+  - curl_url_get (3)
+  - curl_url_set (3)
+Protocol:
+  - All
+Added-in: 7.62.0
+---
+
+# NAME
+
+curl_url_dup - duplicate a URL handle
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLU *curl_url_dup(const CURLU *inhandle);
+~~~
+
+# DESCRIPTION
+
+Duplicates the URL object the input *CURLU* *inhandle* identifies and
+returns a pointer to the copy as a new *CURLU* handle. The new handle also
+needs to be freed with curl_url_cleanup(3).
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLUcode rc;
+  CURLU *url = curl_url();
+  CURLU *url2;
+  rc = curl_url_set(url, CURLUPART_URL, "https://example.com", 0);
+  if(!rc) {
+    url2 = curl_url_dup(url); /* clone it */
+    curl_url_cleanup(url2);
+  }
+  curl_url_cleanup(url);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+Returns a pointer to a new `CURLU` handle or NULL if out of memory.
diff --git a/third-party/curl/docs/libcurl/curl_url_get.3 b/third-party/curl/docs/libcurl/curl_url_get.3
deleted file mode 100644
index a07152db54..0000000000
--- a/third-party/curl/docs/libcurl/curl_url_get.3
+++ /dev/null
@@ -1,171 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_url_get 3 "6 Aug 2018" "libcurl" "libcurl"
-.SH NAME
-curl_url_get - extract a part from a URL
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLUcode curl_url_get(CURLU *url,
-                       CURLUPart part,
-                       char **content,
-                       unsigned int flags);
-.fi
-.SH DESCRIPTION
-Given a \fIurl\fP handle of a URL object, this function extracts an individual
-piece or the full URL from it.
-
-The \fIpart\fP argument specifies which part to extract (see list below) and
-\fIcontent\fP points to a 'char *' to get updated to point to a newly
-allocated string with the contents.
-
-The \fIflags\fP argument is a bitmask with individual features.
-
-The returned content pointer must be freed with \fIcurl_free(3)\fP after use.
-.SH FLAGS
-The flags argument is zero, one or more bits set in a bitmask.
-.IP CURLU_DEFAULT_PORT
-If the handle has no port stored, this option makes \fIcurl_url_get(3)\fP
-return the default port for the used scheme.
-.IP CURLU_DEFAULT_SCHEME
-If the handle has no scheme stored, this option makes \fIcurl_url_get(3)\fP
-return the default scheme instead of error.
-.IP CURLU_NO_DEFAULT_PORT
-Instructs \fIcurl_url_get(3)\fP to not return a port number if it matches the
-default port for the scheme.
-.IP CURLU_URLDECODE
-Asks \fIcurl_url_get(3)\fP to URL decode the contents before returning it. It
-does not decode the scheme, the port number or the full URL.
-
-The query component also gets plus-to-space conversion as a bonus when this
-bit is set.
-
-Note that this URL decoding is charset unaware and you get a zero terminated
-string back with data that could be intended for a particular encoding.
-
-If there are byte values lower than 32 in the decoded string, the get
-operation returns an error instead.
-.IP CURLU_URLENCODE
-If set, \fIcurl_url_get(3)\fP URL encodes the host name part when a full URL
-is retrieved. If not set (default), libcurl returns the URL with the host name
-"raw" to support IDN names to appear as-is. IDN host names are typically using
-non-ASCII bytes that otherwise gets percent-encoded.
-
-Note that even when not asking for URL encoding, the '%' (byte 37) is URL
-encoded to make sure the host name remains valid.
-.IP CURLU_PUNYCODE
-If set and \fICURLU_URLENCODE\fP is not set, and asked to retrieve the
-\fBCURLUPART_HOST\fP or \fBCURLUPART_URL\fP parts, libcurl returns the host
-name in its punycode version if it contains any non-ASCII octets (and is an
-IDN name).
-
-If libcurl is built without IDN capabilities, using this bit makes
-\fIcurl_url_get(3)\fP return \fICURLUE_LACKS_IDN\fP if the host name contains
-anything outside the ASCII range.
-
-(Added in curl 7.88.0)
-.IP CURLU_PUNY2IDN
-If set and asked to retrieve the \fBCURLUPART_HOST\fP or \fBCURLUPART_URL\fP
-parts, libcurl returns the host name in its IDN (International Domain Name)
-UTF-8 version if it otherwise is a punycode version. If the punycode name
-cannot be converted to IDN correctly, libcurl returns
-\fICURLUE_BAD_HOSTNAME\fP.
-
-If libcurl is built without IDN capabilities, using this bit makes
-\fIcurl_url_get(3)\fP return \fICURLUE_LACKS_IDN\fP if the host name is using
-punycode.
-
-(Added in curl 8.3.0)
-.SH PARTS
-.IP CURLUPART_URL
-When asked to return the full URL, \fIcurl_url_get(3)\fP returns a normalized
-and possibly cleaned up version using all available URL parts.
-
-We advise using the \fICURLU_PUNYCODE\fP option to get the URL as "normalized"
-as possible since IDN allows host names to be written in many different ways
-that still end up the same punycode version.
-.IP CURLUPART_SCHEME
-Scheme cannot be URL decoded on get.
-.IP CURLUPART_USER
-.IP CURLUPART_PASSWORD
-.IP CURLUPART_OPTIONS
-The options field is an optional field that might follow the password in the
-userinfo part. It is only recognized/used when parsing URLs for the following
-schemes: pop3, smtp and imap. The URL API still allows users to set and get
-this field independently of scheme when not parsing full URLs.
-.IP CURLUPART_HOST
-The host name. If it is an IPv6 numeric address, the zone id is not part of it
-but is provided separately in \fICURLUPART_ZONEID\fP. IPv6 numerical addresses
-are returned within brackets ([]).
-
-IPv6 names are normalized when set, which should make them as short as
-possible while maintaining correct syntax.
-.IP CURLUPART_ZONEID
-If the host name is a numeric IPv6 address, this field might also be set.
-.IP CURLUPART_PORT
-A port cannot be URL decoded on get. This number is returned in a string just
-like all other parts. That string is guaranteed to hold a valid port number in
-ASCII using base 10.
-.IP CURLUPART_PATH
-The \fIpart\fP is always at least a slash ('/') even if no path was supplied
-in the URL. A URL path always starts with a slash.
-.IP CURLUPART_QUERY
-The initial question mark that denotes the beginning of the query part is a
-delimiter only.  It is not part of the query contents.
-
-A not-present query returns \fIpart\fP set to NULL.
-A zero-length query returns \fIpart\fP as a zero-length string.
-
-The query part gets pluses converted to space when asked to URL decode on get
-with the CURLU_URLDECODE bit.
-.IP CURLUPART_FRAGMENT
-The initial hash sign that denotes the beginning of the fragment is a
-delimiter only. It is not part of the fragment contents.
-.SH EXAMPLE
-.nf
-  CURLUcode rc;
-  CURLU *url = curl_url();
-  rc = curl_url_set(url, CURLUPART_URL, "https://example.com", 0);
-  if(!rc) {
-    char *scheme;
-    rc = curl_url_get(url, CURLUPART_SCHEME, &scheme, 0);
-    if(!rc) {
-      printf("the scheme is %s\\n", scheme);
-      curl_free(scheme);
-    }
-    curl_url_cleanup(url);
-  }
-.fi
-.SH AVAILABILITY
-Added in 7.62.0. CURLUPART_ZONEID was added in 7.65.0.
-.SH RETURN VALUE
-Returns a CURLUcode error value, which is CURLUE_OK (0) if everything went
-fine. See the \fIlibcurl-errors(3)\fP man page for the full list with
-descriptions.
-
-If this function returns an error, no URL part is returned.
-.SH "SEE ALSO"
-.BR curl_url_cleanup "(3), " curl_url "(3), " curl_url_set "(3), "
-.BR curl_url_dup "(3), " curl_url_strerror "(3), " CURLOPT_CURLU "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_url_get.md b/third-party/curl/docs/libcurl/curl_url_get.md
new file mode 100644
index 0000000000..9916166f97
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_url_get.md
@@ -0,0 +1,249 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_url_get
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CURLU (3)
+  - curl_url (3)
+  - curl_url_cleanup (3)
+  - curl_url_dup (3)
+  - curl_url_set (3)
+  - curl_url_strerror (3)
+Protocol:
+  - All
+Added-in: 7.62.0
+---
+
+# NAME
+
+curl_url_get - extract a part from a URL
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLUcode curl_url_get(const CURLU *url,
+                       CURLUPart part,
+                       char **content,
+                       unsigned int flags);
+~~~
+
+# DESCRIPTION
+
+Given a *url* handle of a URL object, this function extracts an individual
+piece or the full URL from it.
+
+The *part* argument specifies which part to extract (see list below) and
+*content* points to a 'char *' to get updated to point to a newly
+allocated string with the contents.
+
+The *flags* argument is a bitmask with individual features.
+
+The returned content pointer must be freed with curl_free(3) after use.
+Although not constrained by its type, the pointed string may not be altered.
+
+# FLAGS
+
+The flags argument is zero, one or more bits set in a bitmask.
+
+## CURLU_DEFAULT_PORT
+
+If the handle has no port stored, this option makes curl_url_get(3)
+return the default port for the used scheme.
+
+## CURLU_DEFAULT_SCHEME
+
+If the handle has no scheme stored, this option makes curl_url_get(3)
+return the default scheme instead of error.
+
+## CURLU_NO_DEFAULT_PORT
+
+Instructs curl_url_get(3) to not return a port number if it matches the
+default port for the scheme.
+
+## CURLU_URLDECODE
+
+Asks curl_url_get(3) to URL decode the contents before returning it. It
+does not decode the scheme, the port number or the full URL.
+
+The query component also gets plus-to-space conversion as a bonus when this
+bit is set.
+
+Note that this URL decoding is charset unaware and you get a null-terminated
+string back with data that could be intended for a particular encoding.
+
+If there are byte values lower than 32 in the decoded string, the get
+operation returns an error instead.
+
+## CURLU_URLENCODE
+
+If set, curl_url_get(3) URL encodes the hostname part when a full URL is
+retrieved. If not set (default), libcurl returns the URL with the hostname raw
+to support IDN names to appear as-is. IDN hostnames are typically using
+non-ASCII bytes that otherwise gets percent-encoded.
+
+Note that even when not asking for URL encoding, the '%' (byte 37) is URL
+encoded to make sure the hostname remains valid.
+
+## CURLU_PUNYCODE
+
+If set and *CURLU_URLENCODE* is not set, and asked to retrieve the
+**CURLUPART_HOST** or **CURLUPART_URL** parts, libcurl returns the host
+name in its punycode version if it contains any non-ASCII octets (and is an
+IDN name).
+
+If libcurl is built without IDN capabilities, using this bit makes
+curl_url_get(3) return *CURLUE_LACKS_IDN* if the hostname contains
+anything outside the ASCII range.
+
+(Added in curl 7.88.0)
+
+## CURLU_PUNY2IDN
+
+If set and asked to retrieve the **CURLUPART_HOST** or **CURLUPART_URL**
+parts, libcurl returns the hostname in its IDN (International Domain Name)
+UTF-8 version if it otherwise is a punycode version. If the punycode name
+cannot be converted to IDN correctly, libcurl returns
+*CURLUE_BAD_HOSTNAME*.
+
+If libcurl is built without IDN capabilities, using this bit makes
+curl_url_get(3) return *CURLUE_LACKS_IDN* if the hostname is using
+punycode.
+
+(Added in curl 8.3.0)
+
+## CURLU_GET_EMPTY
+
+When this flag is used in curl_url_get(), it makes the function return empty
+query and fragments parts or when used in the full URL. By default, libcurl
+otherwise considers empty parts non-existing.
+
+An empty query part is one where this is nothing following the question mark
+(before the possible fragment). An empty fragments part is one where there is
+nothing following the hash sign.
+
+(Added in curl 8.8.0)
+
+## CURLU_NO_GUESS_SCHEME
+
+When this flag is used in curl_url_get(), it treats the scheme as non-existing
+if it was set as a result of a previous guess; when CURLU_GUESS_SCHEME was
+used parsing a URL.
+
+Using this flag when getting CURLUPART_SCHEME if the scheme was set as the
+result of a guess makes curl_url_get() return CURLUE_NO_SCHEME.
+
+Using this flag when getting CURLUPART_URL if the scheme was set as the result
+of a guess makes curl_url_get() return the full URL without the scheme
+component. Such a URL can then only be parsed with curl_url_set() if
+CURLU_GUESS_SCHEME is used.
+
+(Added in curl 8.9.0)
+
+# PARTS
+
+## CURLUPART_URL
+
+When asked to return the full URL, curl_url_get(3) returns a slightly cleaned
+up version of the complete URL using all available parts.
+
+We advise using the *CURLU_PUNYCODE* option to get the URL as "normalized" as
+possible since IDN allows hostnames to be written in many different ways that
+still end up the same punycode version.
+
+Zero-length queries and fragments are excluded from the URL unless
+CURLU_GET_EMPTY is set.
+
+## CURLUPART_SCHEME
+
+Scheme cannot be URL decoded on get.
+
+## CURLUPART_USER
+
+## CURLUPART_PASSWORD
+
+## CURLUPART_OPTIONS
+
+The options field is an optional field that might follow the password in the
+userinfo part. It is only recognized/used when parsing URLs for the following
+schemes: pop3, smtp and imap. The URL API still allows users to set and get
+this field independently of scheme when not parsing full URLs.
+
+## CURLUPART_HOST
+
+The hostname. If it is an IPv6 numeric address, the zone id is not part of it
+but is provided separately in *CURLUPART_ZONEID*. IPv6 numerical addresses
+are returned within brackets ([]).
+
+IPv6 names are normalized when set, which should make them as short as
+possible while maintaining correct syntax.
+
+## CURLUPART_ZONEID
+
+If the hostname is a numeric IPv6 address, this field might also be set.
+
+## CURLUPART_PORT
+
+A port cannot be URL decoded on get. This number is returned in a string like
+all other parts. That string is guaranteed to hold a valid port number in
+ASCII using base 10.
+
+## CURLUPART_PATH
+
+The *part* is always at least a slash ('/') even if no path was supplied
+in the URL. A URL path always starts with a slash.
+
+## CURLUPART_QUERY
+
+The initial question mark that denotes the beginning of the query part is a
+delimiter only. It is not part of the query contents.
+
+A not-present query returns *part* set to NULL.
+
+A zero-length query returns *part* as NULL unless CURLU_GET_EMPTY is set.
+
+The query part gets pluses converted to space when asked to URL decode on get
+with the CURLU_URLDECODE bit.
+
+## CURLUPART_FRAGMENT
+
+The initial hash sign that denotes the beginning of the fragment is a
+delimiter only. It is not part of the fragment contents.
+
+A not-present fragment returns *part* set to NULL.
+
+A zero-length fragment returns *part* as NULL unless CURLU_GET_EMPTY is set.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLUcode rc;
+  CURLU *url = curl_url();
+  rc = curl_url_set(url, CURLUPART_URL, "https://example.com", 0);
+  if(!rc) {
+    char *scheme;
+    rc = curl_url_get(url, CURLUPART_SCHEME, &scheme, 0);
+    if(!rc) {
+      printf("the scheme is %s\n", scheme);
+      curl_free(scheme);
+    }
+    curl_url_cleanup(url);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+Returns a CURLUcode error value, which is CURLUE_OK (0) if everything went
+fine. See the libcurl-errors(3) man page for the full list with descriptions.
+
+If this function returns an error, no URL part is returned.
diff --git a/third-party/curl/docs/libcurl/curl_url_set.3 b/third-party/curl/docs/libcurl/curl_url_set.3
deleted file mode 100644
index 638ba70447..0000000000
--- a/third-party/curl/docs/libcurl/curl_url_set.3
+++ /dev/null
@@ -1,205 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_url_set 3 "6 Aug 2018" "libcurl" "libcurl"
-.SH NAME
-curl_url_set - set a URL part
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLUcode curl_url_set(CURLU *url,
-                       CURLUPart part,
-                       const char *content,
-                       unsigned int flags);
-.fi
-.SH DESCRIPTION
-The \fIurl\fP handle to work on, passed in as the first argument, must be a
-handle previously created by \fIcurl_url(3)\fP or \fIcurl_url_dup(3)\fP.
-
-This function sets or updates individual URL components, or parts, held by the
-URL object the handle identifies.
-
-The \fIpart\fP argument should identify the particular URL part (see list
-below) to set or change, with \fIcontent\fP pointing to a null-terminated
-string with the new contents for that URL part. The contents should be in the
-form and encoding they would use in a URL: URL encoded.
-
-When setting part in the URL object that was previously already set, it
-replaces the data that was previously stored for that part with the new
-\fIcontent\fP.
-
-The caller does not have to keep \fIcontent\fP around after a successful call
-as this function copies the content.
-
-Setting a part to a NULL pointer removes that part's contents from the
-\fICURLU\fP handle.
-
-By default, this API only accepts URLs using schemes for protocols that are
-supported built-in. To make libcurl parse URLs generically even for schemes it
-does not know about, the \fBCURLU_NON_SUPPORT_SCHEME\fP flags bit must be
-set. Otherwise, this function returns \fICURLUE_UNSUPPORTED_SCHEME\fP for URL
-schemes it does not recognize.
-
-This function has an 8 MB maximum length limit for all provided input strings.
-In the real world, excessively long fields in URLs cause problems even if this
-API accepts them.
-
-When setting or updating contents of individual URL parts, this API might
-accept data that would not be otherwise possible to set in the string when it
-gets populated as a result of a full URL parse. Beware. If done so, extracting
-a full URL later on from such components might render an invalid URL.
-
-The \fIflags\fP argument is a bitmask with independent features.
-.SH PARTS
-.IP CURLUPART_URL
-Allows the full URL of the handle to be replaced. If the handle already is
-populated with a URL, the new URL can be relative to the previous.
-
-When successfully setting a new URL, relative or absolute, the handle contents
-is replaced with the components of the newly set URL.
-
-Pass a pointer to a null-terminated string to the \fIurl\fP parameter. The
-string must point to a correctly formatted "RFC 3986+" URL or be a NULL
-pointer.
-
-Unless \fICURLU_NO_AUTHORITY\fP is set, a blank host name is not allowed in
-the URL.
-.IP CURLUPART_SCHEME
-Scheme cannot be URL decoded on set. libcurl only accepts setting schemes up
-to 40 bytes long.
-.IP CURLUPART_USER
-.IP CURLUPART_PASSWORD
-.IP CURLUPART_OPTIONS
-The options field is an optional field that might follow the password in the
-userinfo part. It is only recognized/used when parsing URLs for the following
-schemes: pop3, smtp and imap. This function however allows users to
-independently set this field.
-.IP CURLUPART_HOST
-The host name. If it is International Domain Name (IDN) the string must then
-be encoded as your locale says or UTF-8 (when WinIDN is used). If it is a
-bracketed IPv6 numeric address it may contain a zone id (or you can use
-\fICURLUPART_ZONEID\fP).
-
-Unless \fICURLU_NO_AUTHORITY\fP is set, a blank host name is not allowed to set.
-.IP CURLUPART_ZONEID
-If the host name is a numeric IPv6 address, this field can also be set.
-.IP CURLUPART_PORT
-The port number cannot be URL encoded on set. The given port number is
-provided as a string and the decimal number in it must be between 0 and
-65535. Anything else returns an error.
-.IP CURLUPART_PATH
-If a path is set in the URL without a leading slash, a slash is prepended
-automatically.
-.IP CURLUPART_QUERY
-The query part gets spaces converted to pluses when asked to URL encode on set
-with the \fICURLU_URLENCODE\fP bit.
-
-If used together with the \fICURLU_APPENDQUERY\fP bit, the provided part is
-appended on the end of the existing query.
-
-The question mark in the URL is not part of the actual query contents.
-.IP CURLUPART_FRAGMENT
-The hash sign in the URL is not part of the actual fragment contents.
-.SH FLAGS
-The flags argument is zero, one or more bits set in a bitmask.
-.IP CURLU_APPENDQUERY
-Can be used when setting the \fICURLUPART_QUERY\fP component. The provided new
-part is then appended at the end of the existing query - and if the previous
-part did not end with an ampersand (&), an ampersand gets inserted before the
-new appended part.
-
-When \fICURLU_APPENDQUERY\fP is used together with \fICURLU_URLENCODE\fP, the
-first '=' symbol is not URL encoded.
-.IP CURLU_NON_SUPPORT_SCHEME
-If set, allows \fIcurl_url_set(3)\fP to set a non-supported scheme.
-.IP CURLU_URLENCODE
-When set, \fIcurl_url_set(3)\fP URL encodes the part on entry, except for
-scheme, port and URL.
-
-When setting the path component with URL encoding enabled, the slash character
-is be skipped.
-
-The query part gets space-to-plus conversion before the URL conversion.
-
-This URL encoding is charset unaware and converts the input in a byte-by-byte
-manner.
-.IP CURLU_DEFAULT_SCHEME
-If set, allows the URL to be set without a scheme and then sets that to the
-default scheme: HTTPS. Overrides the \fICURLU_GUESS_SCHEME\fP option if both
-are set.
-.IP CURLU_GUESS_SCHEME
-If set, allows the URL to be set without a scheme and it instead "guesses"
-which scheme that was intended based on the host name. If the outermost
-subdomain name matches DICT, FTP, IMAP, LDAP, POP3 or SMTP then that scheme
-is used, otherwise it picks HTTP. Conflicts with the
-\fICURLU_DEFAULT_SCHEME\fP option which takes precedence if both are set.
-.IP CURLU_NO_AUTHORITY
-If set, skips authority checks. The RFC allows individual schemes to omit the
-host part (normally the only mandatory part of the authority), but libcurl
-cannot know whether this is permitted for custom schemes. Specifying the flag
-permits empty authority sections, similar to how file scheme is handled.
-.IP CURLU_PATH_AS_IS
-When set for \fBCURLUPART_URL\fP, this skips the normalization of the
-path. That is the procedure where libcurl otherwise removes sequences of
-dot-slash and dot-dot etc. The same option used for transfers is called
-\fICURLOPT_PATH_AS_IS(3)\fP.
-.IP CURLU_ALLOW_SPACE
-If set, the URL parser allows space (ASCII 32) where possible. The URL syntax
-does normally not allow spaces anywhere, but they should be encoded as %20
-or '+'. When spaces are allowed, they are still not allowed in the scheme.
-When space is used and allowed in a URL, it is stored as-is unless
-\fICURLU_URLENCODE\fP is also set, which then makes libcurl URL encode the
-space before stored. This affects how the URL is constructed when
-\fIcurl_url_get(3)\fP is subsequently used to extract the full URL or
-individual parts. (Added in 7.78.0)
-.IP CURLU_DISALLOW_USER
-If set, the URL parser does not accept embedded credentials for the
-\fBCURLUPART_URL\fP, and instead returns \fBCURLUE_USER_NOT_ALLOWED\fP for
-such URLs.
-.SH EXAMPLE
-.nf
-  CURLUcode rc;
-  CURLU *url = curl_url();
-  rc = curl_url_set(url, CURLUPART_URL, "https://example.com", 0);
-  if(!rc) {
-    char *scheme;
-    /* change it to an FTP URL */
-    rc = curl_url_set(url, CURLUPART_SCHEME, "ftp", 0);
-  }
-  curl_url_cleanup(url);
-.fi
-.SH AVAILABILITY
-Added in 7.62.0. CURLUPART_ZONEID was added in 7.65.0.
-.SH RETURN VALUE
-Returns a \fICURLUcode\fP error value, which is CURLUE_OK (0) if everything
-went fine. See the \fIlibcurl-errors(3)\fP man page for the full list with
-descriptions.
-
-The input string passed to \fIcurl_url_set(3)\fP must be shorter than eight
-million bytes. Otherwise this function returns \fBCURLUE_MALFORMED_INPUT\fP.
-
-If this function returns an error, no URL part is set.
-.SH "SEE ALSO"
-.BR curl_url_cleanup "(3), " curl_url "(3), " curl_url_get "(3), "
-.BR curl_url_dup "(3), " curl_url_strerror "(3), " CURLOPT_CURLU "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_url_set.md b/third-party/curl/docs/libcurl/curl_url_set.md
new file mode 100644
index 0000000000..2fa31123f1
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_url_set.md
@@ -0,0 +1,280 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_url_set
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CURLU (3)
+  - curl_url (3)
+  - curl_url_cleanup (3)
+  - curl_url_dup (3)
+  - curl_url_get (3)
+  - curl_url_strerror (3)
+Protocol:
+  - All
+Added-in: 7.62.0
+---
+
+# NAME
+
+curl_url_set - set a URL part
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLUcode curl_url_set(CURLU *url,
+                       CURLUPart part,
+                       const char *content,
+                       unsigned int flags);
+~~~
+
+# DESCRIPTION
+
+The *url* handle to work on, passed in as the first argument, must be a
+handle previously created by curl_url(3) or curl_url_dup(3).
+
+This function sets or updates individual URL components, or parts, held by the
+URL object the handle identifies.
+
+The *part* argument should identify the particular URL part (see list below)
+to set or change, with *content* pointing to a null-terminated string with the
+new contents for that URL part. The contents should be in the form and
+encoding they would use in a URL: URL encoded.
+
+When setting a part in the URL object that was previously already set, it
+replaces the data that was previously stored for that part with the new
+*content*.
+
+The caller does not have to keep *content* around after a successful call
+as this function copies the content.
+
+Setting a part to a NULL pointer removes that part's contents from the *CURLU*
+handle.
+
+This function has an 8 MB maximum length limit for all provided input strings.
+In the real world, excessively long fields in URLs cause problems even if this
+function accepts them.
+
+When setting or updating contents of individual URL parts, curl_url_set(3)
+might accept data that would not be otherwise possible to set in the string
+when it gets populated as a result of a full URL parse. Beware. If done so,
+extracting a full URL later on from such components might render an invalid
+URL.
+
+The *flags* argument is a bitmask with independent features.
+
+# PARTS
+
+## CURLUPART_URL
+
+Allows the full URL of the handle to be replaced. If the handle already is
+populated with a URL, the new URL can be relative to the previous.
+
+When successfully setting a new URL, relative or absolute, the handle contents
+is replaced with the components of the newly set URL.
+
+Pass a pointer to a null-terminated string to the *url* parameter. The string
+must point to a correctly formatted "RFC 3986+" URL or be a NULL pointer. The
+URL parser only understands and parses the subset of URLS that are
+"hierarchical" and therefore contain a `://` separator - not the ones that are
+normally specified with only a colon separator.
+
+By default this API only parses URLs using schemes for protocols that are
+supported built-in. To make libcurl parse URLs generically even for schemes it
+does not know about, the **CURLU_NON_SUPPORT_SCHEME** flags bit must be set.
+Otherwise, this function returns *CURLUE_UNSUPPORTED_SCHEME* for URL schemes
+it does not recognize.
+
+Unless *CURLU_NO_AUTHORITY* is set, a blank hostname is not allowed in
+the URL.
+
+When a full URL is set (parsed), the hostname component is stored URL decoded.
+
+It is considered fine to set a blank URL ("") as a redirect, but not as a
+normal URL. Therefore, setting a "" URL works fine if the handle already holds
+a URL, otherwise it triggers an error.
+
+## CURLUPART_SCHEME
+
+Scheme cannot be URL decoded on set. libcurl only accepts setting schemes up
+to 40 bytes long.
+
+## CURLUPART_USER
+
+If only the user part is set and not the password, the URL is represented with
+a blank password.
+
+## CURLUPART_PASSWORD
+
+If only the password part is set and not the user, the URL is represented with
+a blank user.
+
+## CURLUPART_OPTIONS
+
+The options field is an optional field that might follow the password in the
+userinfo part. It is only recognized/used when parsing URLs for the following
+schemes: pop3, smtp and imap. This function however allows users to
+independently set this field.
+
+## CURLUPART_HOST
+
+The hostname. If it is International Domain Name (IDN) the string must then be
+encoded as your locale says or UTF-8 (when WinIDN is used). If it is a
+bracketed IPv6 numeric address it may contain a zone id (or you can use
+*CURLUPART_ZONEID*).
+
+Note that if you set an IPv6 address, it gets ruined and causes an error if
+you also set the CURLU_URLENCODE flag.
+
+Unless *CURLU_NO_AUTHORITY* is set, a blank hostname is not allowed to set.
+
+## CURLUPART_ZONEID
+
+If the hostname is a numeric IPv6 address, this field can also be set.
+
+## CURLUPART_PORT
+
+The port number cannot be URL encoded on set. The given port number is
+provided as a string and the decimal number in it must be between 0 and
+65535. Anything else returns an error.
+
+## CURLUPART_PATH
+
+If a path is set in the URL without a leading slash, a slash is prepended
+automatically.
+
+## CURLUPART_QUERY
+
+The query part gets spaces converted to pluses when asked to URL encode on set
+with the *CURLU_URLENCODE* bit.
+
+If used together with the *CURLU_APPENDQUERY* bit, the provided part is
+appended on the end of the existing query.
+
+The question mark in the URL is not part of the actual query contents.
+
+## CURLUPART_FRAGMENT
+
+The hash sign in the URL is not part of the actual fragment contents.
+
+# FLAGS
+
+The flags argument is zero, one or more bits set in a bitmask.
+
+## CURLU_APPENDQUERY
+
+Can be used when setting the *CURLUPART_QUERY* component. The provided new
+part is then appended at the end of the existing query - and if the previous
+part did not end with an ampersand (&), an ampersand gets inserted before the
+new appended part.
+
+When *CURLU_APPENDQUERY* is used together with *CURLU_URLENCODE*, the
+first '=' symbol is not URL encoded.
+
+## CURLU_NON_SUPPORT_SCHEME
+
+If set, allows curl_url_set(3) to set a non-supported scheme. It then of
+course cannot know if the provided scheme is a valid one or not.
+
+## CURLU_URLENCODE
+
+When set, curl_url_set(3) URL encodes the part on entry, except for
+**scheme**, **port** and **URL**.
+
+When setting the path component with URL encoding enabled, the following
+characters are left as-is if present:
+
+    ! $ & ' ( ) { } [ ] * + , ; = : @
+
+The query part gets space-to-plus converted before the URL conversion is
+applied.
+
+This URL encoding is charset unaware and converts the input in a byte-by-byte
+manner.
+
+## CURLU_DEFAULT_SCHEME
+
+If set, allows the URL to be set without a scheme and then sets that to the
+default scheme: HTTPS. Overrides the *CURLU_GUESS_SCHEME* option if both are
+set.
+
+## CURLU_GUESS_SCHEME
+
+If set, allows the URL to be set without a scheme and it instead "guesses"
+which scheme that was intended based on the hostname. If the outermost
+subdomain name matches DICT, FTP, IMAP, LDAP, POP3 or SMTP then that scheme is
+used, otherwise it picks HTTP. Conflicts with the *CURLU_DEFAULT_SCHEME*
+option which takes precedence if both are set.
+
+If guessing is not allowed and there is no default scheme set, trying to parse
+a URL without a scheme returns error.
+
+If the scheme ends up set as a result of guessing, i.e. it is not actually
+present in the parsed URL, it can later be figured out by using the
+**CURLU_NO_GUESS_SCHEME** flag when subsequently getting the URL or the scheme
+with curl_url_get(3).
+
+## CURLU_NO_AUTHORITY
+
+If set, skips authority checks. The RFC allows individual schemes to omit the
+host part (normally the only mandatory part of the authority), but libcurl
+cannot know whether this is permitted for custom schemes. Specifying the flag
+permits empty authority sections, similar to how file scheme is handled.
+
+## CURLU_PATH_AS_IS
+
+When set for **CURLUPART_URL**, this skips the normalization of the
+path. That is the procedure where libcurl otherwise removes sequences of
+dot-slash and dot-dot etc. The same option used for transfers is called
+CURLOPT_PATH_AS_IS(3).
+
+## CURLU_ALLOW_SPACE
+
+If set, the URL parser allows space (ASCII 32) where possible. The URL syntax
+does normally not allow spaces anywhere, but they should be encoded as %20
+or '+'. When spaces are allowed, they are still not allowed in the scheme.
+When space is used and allowed in a URL, it is stored as-is unless
+*CURLU_URLENCODE* is also set, which then makes libcurl URL encode the
+space before stored. This affects how the URL is constructed when
+curl_url_get(3) is subsequently used to extract the full URL or
+individual parts. (Added in 7.78.0)
+
+## CURLU_DISALLOW_USER
+
+If set, the URL parser does not accept embedded credentials for the
+**CURLUPART_URL**, and instead returns **CURLUE_USER_NOT_ALLOWED** for
+such URLs.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLUcode rc;
+  CURLU *url = curl_url();
+  rc = curl_url_set(url, CURLUPART_URL, "https://example.com", 0);
+  if(!rc) {
+    /* change it to an FTP URL */
+    rc = curl_url_set(url, CURLUPART_SCHEME, "ftp", 0);
+  }
+  curl_url_cleanup(url);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+Returns a *CURLUcode* error value, which is CURLUE_OK (0) if everything
+went fine. See the libcurl-errors(3) man page for the full list with
+descriptions.
+
+The input string passed to curl_url_set(3) must be shorter than eight
+million bytes. Otherwise this function returns **CURLUE_MALFORMED_INPUT**.
+
+If this function returns an error, no URL part is set.
diff --git a/third-party/curl/docs/libcurl/curl_url_strerror.3 b/third-party/curl/docs/libcurl/curl_url_strerror.3
deleted file mode 100644
index 269705ae32..0000000000
--- a/third-party/curl/docs/libcurl/curl_url_strerror.3
+++ /dev/null
@@ -1,51 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_url_strerror 3 "21 Aug 2021" "libcurl" "libcurl"
-.SH NAME
-curl_url_strerror - return string describing error code
-.SH SYNOPSIS
-.nf
-.B #include <curl/curl.h>
-.BI "const char *curl_url_strerror(CURLUcode " errornum ");"
-.SH DESCRIPTION
-The curl_url_strerror() function returns a string describing the CURLUcode
-error code passed in the argument \fIerrornum\fP.
-.SH EXAMPLE
-.nf
-  CURLUcode rc;
-  CURLU *url = curl_url();
-  rc = curl_url_set(url, CURLUPART_URL, "https://example.com", 0);
-  if(rc)
-    printf("URL error: %s\\n", curl_url_strerror(rc));
-  curl_url_cleanup(url);
-.fi
-
-.SH AVAILABILITY
-Added in 7.80.0
-.SH RETURN VALUE
-A pointer to a null-terminated string.
-.SH "SEE ALSO"
-.BR libcurl-errors "(3), " curl_url_get "(3), " curl_url_set "(3), "
-.BR curl_easy_strerror "(3), " curl_multi_strerror "(3), "
-.BR curl_share_strerror "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_url_strerror.md b/third-party/curl/docs/libcurl/curl_url_strerror.md
new file mode 100644
index 0000000000..33cdb148dd
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_url_strerror.md
@@ -0,0 +1,56 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_url_strerror
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_strerror (3)
+  - curl_multi_strerror (3)
+  - curl_share_strerror (3)
+  - curl_url_get (3)
+  - curl_url_set (3)
+  - libcurl-errors (3)
+Protocol:
+  - All
+Added-in: 7.80.0
+---
+
+# NAME
+
+curl_url_strerror - return string describing error code
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+const char *curl_url_strerror(CURLUcode errornum);
+~~~
+
+# DESCRIPTION
+
+This function returns a string describing the CURLUcode error code passed in
+the argument *errornum*.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLUcode rc;
+  CURLU *url = curl_url();
+  rc = curl_url_set(url, CURLUPART_URL, "https://example.com", 0);
+  if(rc)
+    printf("URL error: %s\n", curl_url_strerror(rc));
+  curl_url_cleanup(url);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+A pointer to a null-terminated string.
diff --git a/third-party/curl/docs/libcurl/curl_version.3 b/third-party/curl/docs/libcurl/curl_version.3
deleted file mode 100644
index ec4bd53ad4..0000000000
--- a/third-party/curl/docs/libcurl/curl_version.3
+++ /dev/null
@@ -1,49 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH curl_version 3 "5 March 2001" "libcurl" "libcurl"
-.SH NAME
-curl_version - returns the libcurl version string
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-char *curl_version();
-.fi
-.SH DESCRIPTION
-Returns a human readable string with the version number of libcurl and some of
-its important components (like OpenSSL version).
-
-We recommend using \fIcurl_version_info(3)\fP instead!
-.SH EXAMPLE
-.nf
-printf("libcurl version %s\\n", curl_version());
-.fi
-
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-A pointer to a null-terminated string. The string resides in a statically
-allocated buffer and must not be freed by the caller.
-.SH "SEE ALSO"
-.BR curl_version_info "(3)"
diff --git a/third-party/curl/docs/libcurl/curl_version.md b/third-party/curl/docs/libcurl/curl_version.md
new file mode 100644
index 0000000000..408684c443
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_version.md
@@ -0,0 +1,53 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_version
+Section: 3
+Source: libcurl
+See-also:
+  - curl_version_info (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+curl_version - returns the libcurl version string
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+char *curl_version();
+~~~
+
+# DESCRIPTION
+
+Returns a human readable string with the version number of libcurl and some of
+its important components (like OpenSSL version).
+
+For MultiSSL builds the string contains all SSL backend names and the inactive
+backend names are in parentheses. For example "(OpenSSL/3.0.8) Schannel" or
+"OpenSSL/3.0.8 (Schannel)".
+
+We recommend using curl_version_info(3) instead.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  printf("libcurl version %s\n", curl_version());
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+A pointer to a null-terminated string. The string resides in a statically
+allocated buffer and must not be freed by the caller.
diff --git a/third-party/curl/docs/libcurl/curl_version_info.3 b/third-party/curl/docs/libcurl/curl_version_info.3
deleted file mode 100644
index a0fb1932fd..0000000000
--- a/third-party/curl/docs/libcurl/curl_version_info.3
+++ /dev/null
@@ -1,320 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH curl_version_info 3 "2 Nov 2014" "libcurl" "libcurl"
-.SH NAME
-curl_version_info - returns runtime libcurl version info
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-curl_version_info_data *curl_version_info(CURLversion age);
-.fi
-.SH DESCRIPTION
-Returns a pointer to a filled in static struct with information about various
-features in the running version of libcurl. \fIage\fP should be set to the
-version of this functionality by the time you write your program. This way,
-libcurl always returns a proper struct that your program understands, while
-programs in the future might get a different struct. \fBCURLVERSION_NOW\fP is
-the most recent one for the library you have installed:
-.nf
-  data = curl_version_info(CURLVERSION_NOW);
-.fi
-Applications should use this information to judge if things are possible to do
-or not, instead of using compile-time checks, as dynamic/DLL libraries can be
-changed independent of applications.
-
-This function can alter the returned static data as long as
-\fIcurl_global_init\fP has not been called. It is therefore not thread-safe
-before libcurl initialization occurs.
-
-The curl_version_info_data struct looks like this
-
-.nf
-typedef struct {
-  CURLversion age;          /* see description below */
-
-  const char *version;      /* human readable string */
-  unsigned int version_num; /* numeric representation */
-  const char *host;         /* human readable string */
-  int features;             /* bitmask, see below */
-  char *ssl_version;        /* human readable string */
-  long ssl_version_num;     /* not used, always zero */
-  const char *libz_version; /* human readable string */
-  const char *const *protocols; /* protocols */
-
-  /* when 'age' is CURLVERSION_SECOND or higher, the members below exist */
-  const char *ares;         /* human readable string */
-  int ares_num;             /* number */
-
-  /* when 'age' is CURLVERSION_THIRD or higher, the members below exist */
-  const char *libidn;       /* human readable string */
-
-  /* when 'age' is CURLVERSION_FOURTH or higher (>= 7.16.1), the members
-     below exist */
-  int iconv_ver_num;       /* '_libiconv_version' if iconv support enabled */
-
-  const char *libssh_version; /* human readable string */
-
-  /* when 'age' is CURLVERSION_FIFTH or higher (>= 7.57.0), the members
-     below exist */
-  unsigned int brotli_ver_num; /* Numeric Brotli version
-                                  (MAJOR << 24) | (MINOR << 12) | PATCH */
-  const char *brotli_version; /* human readable string. */
-
-  /* when 'age' is CURLVERSION_SIXTH or higher (>= 7.66.0), the members
-     below exist */
-  unsigned int nghttp2_ver_num; /* Numeric nghttp2 version
-                                   (MAJOR << 16) | (MINOR << 8) | PATCH */
-  const char *nghttp2_version; /* human readable string. */
-
-  const char *quic_version;    /* human readable quic (+ HTTP/3) library +
-                                  version or NULL */
-
-  /* when 'age' is CURLVERSION_SEVENTH or higher (>= 7.70.0), the members
-     below exist */
-  const char *cainfo;          /* the built-in default CURLOPT_CAINFO, might
-                                  be NULL */
-  const char *capath;          /* the built-in default CURLOPT_CAPATH, might
-                                  be NULL */
-  /* when 'age' is CURLVERSION_EIGHTH or higher (>= 7.71.0), the members
-     below exist */
-  unsigned int zstd_ver_num; /* Numeric Zstd version
-                                  (MAJOR << 24) | (MINOR << 12) | PATCH */
-  const char *zstd_version; /* human readable string. */
-  /* when 'age' is CURLVERSION_NINTH or higher (>= 7.75.0), the members
-     below exist */
-  const char *hyper_version; /* human readable string. */
-  /* when 'age' is CURLVERSION_TENTH or higher (>= 7.77.0), the members
-     below exist */
-  const char *gsasl_version; /* human readable string. */
-  /* when 'age' is CURLVERSION_ELEVENTH or higher (>= 7.87.0), the members
-     below exist */
-  const char *const *feature_names; /* Feature names. */
-} curl_version_info_data;
-.fi
-
-\fIage\fP describes what the age of this struct is. The number depends on how
-new the libcurl you are using is. You are however guaranteed to get a struct
-that you have a matching struct for in the header, as you tell libcurl your
-"age" with the input argument.
-
-\fIversion\fP is just an ascii string for the libcurl version.
-
-\fIversion_num\fP is a 24 bit number created like this: <8 bits major number>
-| <8 bits minor number> | <8 bits patch number>. Version 7.9.8 is therefore
-returned as 0x070908.
-
-\fIhost\fP is an ascii string showing what host information that this libcurl
-was built for. As discovered by a configure script or set by the build
-environment.
-
-\fIfeatures\fP is a bit mask representing available features. It can
-have none, one or more bits set.
-The use of this field is deprecated: use \fIfeature_names\fP instead.
-The feature names description below lists the associated bits.
-
-\fIfeature_names\fP is a pointer to an array of string pointers, containing the
-names of the features that libcurl supports. The array is terminated by a NULL
-entry. Currently defined names are:
-.RS
-.IP """alt-svc"""
-\fIfeatures\fP mask bit: CURL_VERSION_ALTSVC
-.br
-HTTP Alt-Svc parsing and the associated options (Added in 7.64.1)
-.IP """AsynchDNS"""
-\fIfeatures\fP mask bit: CURL_VERSION_ASYNCHDNS
-.br
-libcurl was built with support for asynchronous name lookups, which allows
-more exact timeouts (even on Windows) and less blocking when using the multi
-interface. (added in 7.10.7)
-.IP """brotli"""
-\fIfeatures\fP mask bit: CURL_VERSION_BROTLI
-.br
-supports HTTP Brotli content encoding using libbrotlidec (Added in 7.57.0)
-.IP """Debug"""
-\fIfeatures\fP mask bit: CURL_VERSION_DEBUG
-.br
-libcurl was built with debug capabilities (added in 7.10.6)
-.IP """gsasl"""
-\fIfeatures\fP mask bit: CURL_VERSION_GSASL
-.br
-libcurl was built with libgsasl and thus with some extra SCRAM-SHA
-authentication methods. (added in 7.76.0)
-.IP """GSS-API"""
-\fIfeatures\fP mask bit: CURL_VERSION_GSSAPI
-.br
-libcurl was built with support for GSS-API. This makes libcurl use provided
-functions for Kerberos and SPNEGO authentication. It also allows libcurl
-to use the current user credentials without the app having to pass them on.
-(Added in 7.38.0)
-.IP """HSTS"""
-\fIfeatures\fP mask bit: CURL_VERSION_HSTS
-.br
-libcurl was built with support for HSTS (HTTP Strict Transport Security)
-(Added in 7.74.0)
-.IP """HTTP2"""
-\fIfeatures\fP mask bit: CURL_VERSION_HTTP2
-.br
-libcurl was built with support for HTTP2.
-(Added in 7.33.0)
-.IP """HTTP3"""
-\fIfeatures\fP mask bit: CURL_VERSION_HTTP3
-.br
-HTTP/3 and QUIC support are built-in (Added in 7.66.0)
-.IP """HTTPS-proxy"""
-\fIfeatures\fP mask bit: CURL_VERSION_HTTPS_PROXY
-.br
-libcurl was built with support for HTTPS-proxy.
-(Added in 7.52.0)
-.IP """IDN"""
-\fIfeatures\fP mask bit: CURL_VERSION_IDN
-.br
-libcurl was built with support for IDNA, domain names with international
-letters. (Added in 7.12.0)
-.IP """IPv6"""
-\fIfeatures\fP mask bit: CURL_VERSION_IPV6
-.br
-supports IPv6
-.IP """Kerberos"""
-\fIfeatures\fP mask bit: CURL_VERSION_KERBEROS5
-.br
-supports Kerberos V5 authentication for FTP, IMAP, LDAP, POP3, SMTP and
-SOCKSv5 proxy. (Added in 7.40.0)
-.IP """Largefile"""
-\fIfeatures\fP mask bit: CURL_VERSION_LARGEFILE
-.br
-libcurl was built with support for large files. (Added in 7.11.1)
-.IP """libz"""
-\fIfeatures\fP mask bit: CURL_VERSION_LIBZ
-.br
-supports HTTP deflate using libz (Added in 7.10)
-.IP """MultiSSL"""
-\fIfeatures\fP mask bit: CURL_VERSION_MULTI_SSL
-.br
-libcurl was built with multiple SSL backends. For details, see
-\fIcurl_global_sslset(3)\fP.
-(Added in 7.56.0)
-.IP """NTLM"""
-\fIfeatures\fP mask bit: CURL_VERSION_NTLM
-.br
-supports HTTP NTLM (added in 7.10.6)
-.IP """NTLM_WB"""
-\fIfeatures\fP mask bit: CURL_VERSION_NTLM_WB
-.br
-libcurl was built with support for NTLM delegation to a winbind helper.
-(Added in 7.22.0)
-.IP """PSL"""
-\fIfeatures\fP mask bit: CURL_VERSION_PSL
-.br
-libcurl was built with support for Mozilla's Public Suffix List. This makes
-libcurl ignore cookies with a domain that is on the list.
-(Added in 7.47.0)
-.IP """SPNEGO"""
-\fIfeatures\fP mask bit: CURL_VERSION_SPNEGO
-.br
-libcurl was built with support for SPNEGO authentication (Simple and Protected
-GSS-API Negotiation Mechanism, defined in RFC 2478.) (added in 7.10.8)
-.IP """SSL"""
-\fIfeatures\fP mask bit: CURL_VERSION_SSL
-.br
-supports SSL (HTTPS/FTPS) (Added in 7.10)
-.IP """SSPI"""
-\fIfeatures\fP mask bit: CURL_VERSION_SSPI
-.br
-libcurl was built with support for SSPI. This is only available on Windows and
-makes libcurl use Windows-provided functions for Kerberos, NTLM, SPNEGO and
-Digest authentication. It also allows libcurl to use the current user
-credentials without the app having to pass them on. (Added in 7.13.2)
-.IP """threadsafe"""
-\fIfeatures\fP mask bit: CURL_VERSION_THREADSAFE
-.br
-libcurl was built with thread-safety support (Atomic or SRWLOCK) to protect
-curl initialization. (Added in 7.84.0) See \fIlibcurl-thread(3)\fP
-.IP """TLS-SRP"""
-\fIfeatures\fP mask bit: CURL_VERSION_TLSAUTH_SRP
-.br
-libcurl was built with support for TLS-SRP (in one or more of the built-in TLS
-backends). (Added in 7.21.4)
-.IP """TrackMemory"""
-\fIfeatures\fP mask bit: CURL_VERSION_CURLDEBUG
-.br
-libcurl was built with memory tracking debug capabilities. This is mainly of
-interest for libcurl hackers. (added in 7.19.6)
-.IP """Unicode"""
-\fIfeatures\fP mask bit: CURL_VERSION_UNICODE
-.br
-libcurl was built with Unicode support on Windows. This makes non-ASCII
-characters work in filenames and options passed to libcurl. (Added in 7.72.0)
-.IP """UnixSockets"""
-\fIfeatures\fP mask bit: CURL_VERSION_UNIX_SOCKETS
-.br
-libcurl was built with support for Unix domain sockets.
-(Added in 7.40.0)
-.IP """zstd"""
-\fIfeatures\fP mask bit: CURL_VERSION_ZSTD
-.br
-supports HTTP zstd content encoding using zstd library (Added in 7.72.0)
-.IP none
-\fIfeatures\fP mask bit: CURL_VERSION_CONV
-.br
-libcurl was built with support for character conversions, as provided by the
-CURLOPT_CONV_* callbacks. Always 0 since 7.82.0. (Added in 7.15.4)
-.IP none
-\fIfeatures\fP mask bit: CURL_VERSION_GSSNEGOTIATE
-.br
-supports HTTP GSS-Negotiate (added in 7.10.6, deprecated in 7.38.0)
-.IP none
-\fIfeatures\fP mask bit: CURL_VERSION_KERBEROS4
-.br
-supports Kerberos V4 (when using FTP). Legacy bit. Deprecated since 7.33.0.
-.RE
-
-\fIssl_version\fP is an ASCII string for the TLS library name + version
-used. If libcurl has no SSL support, this is NULL. For example "Schannel",
-\&"Secure Transport" or "OpenSSL/1.1.0g".
-
-\fIssl_version_num\fP is always 0.
-
-\fIlibz_version\fP is an ASCII string (there is no numerical version). If
-libcurl has no libz support, this is NULL.
-
-\fIprotocols\fP is a pointer to an array of char * pointers, containing the
-names protocols that libcurl supports (using lowercase letters). The protocol
-names are the same as would be used in URLs. The array is terminated by a NULL
-entry.
-.SH EXAMPLE
-.nf
-curl_version_info_data *ver = curl_version_info(CURLVERSION_NOW);
-printf("libcurl version %u.%u.%u\\n",
-       (ver->version_num >> 16) & 0xff,
-       (ver->version_num >> 8) & 0xff,
-       ver->version_num & 0xff);
-.fi
-.SH AVAILABILITY
-Added in 7.10
-.SH RETURN VALUE
-A pointer to a curl_version_info_data struct.
-.SH "SEE ALSO"
-\fIcurl_version(3)\fP
diff --git a/third-party/curl/docs/libcurl/curl_version_info.md b/third-party/curl/docs/libcurl/curl_version_info.md
new file mode 100644
index 0000000000..5b18222169
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_version_info.md
@@ -0,0 +1,423 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_version_info
+Section: 3
+Source: libcurl
+See-also:
+  - curl_version (3)
+Protocol:
+  - All
+Added-in: 7.10
+---
+
+# NAME
+
+curl_version_info - returns runtime libcurl version info
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+curl_version_info_data *curl_version_info(CURLversion age);
+~~~
+
+# DESCRIPTION
+
+Returns a pointer to a filled in static struct with information about various
+features in the running version of libcurl. The input argument *age* has no
+use and we recommend you set it to `CURLVERSION_NOW`.
+
+This function may alter the returned static data as long as
+curl_global_init(3) has not been called. It is therefore not thread-safe
+before libcurl initialization occurs.
+
+The curl_version_info_data struct looks like this
+
+~~~c
+typedef struct {
+  CURLversion age;          /* see description below */
+
+  const char *version;      /* human readable string */
+  unsigned int version_num; /* numeric representation */
+  const char *host;         /* human readable string */
+  int features;             /* bitmask, see below */
+  char *ssl_version;        /* human readable string */
+  long ssl_version_num;     /* not used, always zero */
+  const char *libz_version; /* human readable string */
+  const char *const *protocols; /* protocols */
+
+  /* when 'age' is CURLVERSION_SECOND or higher, the members below exist */
+  const char *ares;         /* human readable string */
+  int ares_num;             /* number */
+
+  /* when 'age' is CURLVERSION_THIRD or higher, the members below exist */
+  const char *libidn;       /* human readable string */
+
+  /* when 'age' is CURLVERSION_FOURTH or higher (>= 7.16.1), the members
+     below exist */
+  int iconv_ver_num;       /* '_libiconv_version' if iconv support enabled */
+
+  const char *libssh_version; /* human readable string */
+
+  /* when 'age' is CURLVERSION_FIFTH or higher (>= 7.57.0), the members
+     below exist */
+  unsigned int brotli_ver_num; /* Numeric Brotli version
+                                  (MAJOR << 24) | (MINOR << 12) | PATCH */
+  const char *brotli_version; /* human readable string. */
+
+  /* when 'age' is CURLVERSION_SIXTH or higher (>= 7.66.0), the members
+     below exist */
+  unsigned int nghttp2_ver_num; /* Numeric nghttp2 version
+                                   (MAJOR << 16) | (MINOR << 8) | PATCH */
+  const char *nghttp2_version; /* human readable string. */
+
+  const char *quic_version;    /* human readable quic (+ HTTP/3) library +
+                                  version or NULL */
+
+  /* when 'age' is CURLVERSION_SEVENTH or higher (>= 7.70.0), the members
+     below exist */
+  const char *cainfo;          /* the built-in default CURLOPT_CAINFO, might
+                                  be NULL */
+  const char *capath;          /* the built-in default CURLOPT_CAPATH, might
+                                  be NULL */
+  /* when 'age' is CURLVERSION_EIGHTH or higher (>= 7.71.0), the members
+     below exist */
+  unsigned int zstd_ver_num; /* Numeric Zstd version
+                                  (MAJOR << 24) | (MINOR << 12) | PATCH */
+  const char *zstd_version; /* human readable string. */
+  /* when 'age' is CURLVERSION_NINTH or higher (>= 7.75.0), the members
+     below exist */
+  const char *hyper_version; /* human readable string. */
+  /* when 'age' is CURLVERSION_TENTH or higher (>= 7.77.0), the members
+     below exist */
+  const char *gsasl_version; /* human readable string. */
+  /* when 'age' is CURLVERSION_ELEVENTH or higher (>= 7.87.0), the members
+     below exist */
+  const char *const *feature_names; /* Feature names. */
+  /* when 'age' is CURLVERSION_TWELFTH or higher (>= 8.8.0), the members
+     below exist */
+  const char *const *rtmp_version; /* human readable string */
+} curl_version_info_data;
+~~~
+
+*age* describes what the age of this struct is. That number is different
+depending on how recent your libcurl is. The documentation above describes
+which struct fields that were added at which age. Trying to access a struct
+field that is newer than the age of your struct may cause undefined behavior
+and possibly crashes.
+
+*version* is an ASCII string for the libcurl version.
+
+*version_num* is a 24-bit number created like this: \<8 bits major number\> |
+\<8 bits minor number\> | \<8 bits patch number\>. Version 7.9.8 is therefore
+returned as 0x070908.
+
+*host* is an ASCII string showing what host information that this libcurl
+was built for. As discovered by a configure script or set by the build
+environment.
+
+*features* is a bit mask representing available features. It can have none,
+one or more bits set. The use of this field is deprecated: use
+*feature_names* instead. The feature names description below lists the
+associated bits.
+
+*feature_names* is a pointer to an array of string pointers, containing the
+names of the features that libcurl supports. The array is terminated by a NULL
+entry. See the list of features names below.
+
+*ssl_version* is an ASCII string for the TLS library name + version used. If
+libcurl has no SSL support, this is NULL. For example "Schannel", "Secure
+Transport" or "OpenSSL/1.1.0g". For MultiSSL builds the string contains all
+SSL backend names and the inactive backend names are in parentheses. For
+example "(OpenSSL/3.0.8) Schannel" or "OpenSSL/3.0.8 (Schannel)".
+
+*ssl_version_num* is always 0.
+
+*libz_version* is an ASCII string (there is no numerical version). If
+libcurl has no libz support, this is NULL.
+
+*protocols* is a pointer to an array of char * pointers, containing the
+names protocols that libcurl supports (using lowercase letters). The protocol
+names are the same as would be used in URLs. The array is terminated by a NULL
+entry.
+
+# FEATURES
+
+## `alt-svc`
+
+*features* mask bit: CURL_VERSION_ALTSVC
+
+HTTP Alt-Svc parsing and the associated options (Added in 7.64.1)
+
+## `AppleSecTrust`
+
+*features* mask bit: non-existent
+
+libcurl was built with support for Apple's SecTrust service to verify
+server certificates (Added in 8.17.0).
+
+## `AsynchDNS`
+
+*features* mask bit: CURL_VERSION_ASYNCHDNS
+
+libcurl was built with support for asynchronous name lookups, which allows
+more exact timeouts (even on Windows) and less blocking when using the multi
+interface.
+
+## `brotli`
+
+*features* mask bit: CURL_VERSION_BROTLI
+
+supports HTTP Brotli content encoding using libbrotlidec
+
+## `asyn-rr`
+
+*features* mask bit: non-existent
+
+libcurl was built to use c-ares for EXPERIMENTAL HTTPS resource record
+resolves, but uses the threaded resolver for "normal" resolves (Added in
+8.12.0)
+
+## `Debug`
+
+*features* mask bit: CURL_VERSION_DEBUG
+
+libcurl was built with debug capabilities
+
+## `ECH`
+
+*features* mask bit: non-existent
+
+libcurl was built with ECH support (experimental, added in 8.8.0)
+
+## `gsasl`
+
+*features* mask bit: CURL_VERSION_GSASL
+
+libcurl was built with libgsasl and thus with some extra SCRAM-SHA
+authentication methods. (added in 7.76.0)
+
+## `GSS-API`
+
+*features* mask bit: CURL_VERSION_GSSAPI
+
+libcurl was built with support for GSS-API. This makes libcurl use provided
+functions for Kerberos and SPNEGO authentication. It also allows libcurl
+to use the current user credentials without the app having to pass them on.
+
+## `HSTS`
+
+*features* mask bit: CURL_VERSION_HSTS
+
+libcurl was built with support for HSTS (HTTP Strict Transport Security)
+(Added in 7.74.0)
+
+## `HTTP2`
+
+*features* mask bit: CURL_VERSION_HTTP2
+
+libcurl was built with support for HTTP2.
+
+## `HTTP3`
+
+*features* mask bit: CURL_VERSION_HTTP3
+
+HTTP/3 and QUIC support are built-in (Added in 7.66.0)
+
+## `HTTPS-proxy`
+
+*features* mask bit: CURL_VERSION_HTTPS_PROXY
+
+libcurl was built with support for HTTPS-proxy.
+
+## `HTTPSRR`
+
+*features* mask bit: non-existent
+
+libcurl was built with EXPERIMENTAL support for HTTPS resource records (Added
+in 8.12.0)
+
+## `IDN`
+
+*features* mask bit: CURL_VERSION_IDN
+
+libcurl was built with support for IDNA, domain names with international
+letters.
+
+## `IPv6`
+
+*features* mask bit: CURL_VERSION_IPV6
+
+supports IPv6
+
+## `Kerberos`
+
+*features* mask bit: CURL_VERSION_KERBEROS5
+
+supports Kerberos V5 authentication for FTP, IMAP, LDAP, POP3, SMTP and
+SOCKSv5 proxy.
+
+## `Largefile`
+
+*features* mask bit: CURL_VERSION_LARGEFILE
+
+libcurl was built with support for large files.
+
+## `libz`
+
+*features* mask bit: CURL_VERSION_LIBZ
+
+supports HTTP deflate using libz
+
+## `MultiSSL`
+
+*features* mask bit: CURL_VERSION_MULTI_SSL
+
+libcurl was built with multiple SSL backends. For details, see
+curl_global_sslset(3).
+
+## `NativeCA`
+
+*features* mask bit: non-existent
+
+libcurl was built to enable native CA store, to verify server certificates
+(Added in 8.19.0).
+
+## `NTLM`
+
+*features* mask bit: CURL_VERSION_NTLM
+
+supports HTTP NTLM
+
+## `NTLM_WB`
+
+*features* mask bit: CURL_VERSION_NTLM_WB
+
+libcurl was built with support for NTLM delegation to a winbind helper. This
+feature was removed from curl in 8.8.0.
+
+## `proxy-HTTP3`
+
+*features* mask bit: non-existent
+
+libcurl was built with EXPERIMENTAL support for HTTP/3 proxy tunneling
+(Added in 8.21.0)
+
+## `PSL`
+
+*features* mask bit: CURL_VERSION_PSL
+
+libcurl was built with support for Mozilla's Public Suffix List. This makes
+libcurl ignore cookies with a domain that is on the list.
+
+## `SPNEGO`
+
+*features* mask bit: CURL_VERSION_SPNEGO
+
+libcurl was built with support for SPNEGO authentication (Simple and Protected
+GSS-API Negotiation Mechanism, defined in RFC 2478.)
+
+## `SSL`
+
+*features* mask bit: CURL_VERSION_SSL
+
+supports SSL (HTTPS/FTPS)
+
+## `SSLS-EXPORT`
+
+*features* mask bit: non-existent
+
+libcurl was built with SSL session import/export support
+(experimental, added in 8.12.0)
+
+## `SSPI`
+
+*features* mask bit: CURL_VERSION_SSPI
+
+libcurl was built with support for SSPI. This is only available on Windows and
+makes libcurl use Windows-provided functions for Kerberos, NTLM, SPNEGO and
+Digest authentication. It also allows libcurl to use the current user
+credentials without the app having to pass them on.
+
+## `threadsafe`
+
+*features* mask bit: CURL_VERSION_THREADSAFE
+
+libcurl was built with thread-safety support (Atomic or SRWLOCK) to protect
+curl initialization. (Added in 7.84.0) See libcurl-thread(3)
+
+## `TLS-SRP`
+
+*features* mask bit: CURL_VERSION_TLSAUTH_SRP
+
+libcurl was built with support for TLS-SRP (in one or more of the built-in TLS
+backends).
+
+## `Unicode`
+
+*features* mask bit: CURL_VERSION_UNICODE
+
+libcurl was built with Unicode support on Windows. This makes non-ASCII
+characters work in filenames and options passed to libcurl. (Added in 7.72.0)
+
+## `UnixSockets`
+
+*features* mask bit: CURL_VERSION_UNIX_SOCKETS
+
+libcurl was built with support for Unix domain sockets.
+
+## `zstd`
+
+*features* mask bit: CURL_VERSION_ZSTD
+
+supports HTTP zstd content encoding using zstd library (Added in 7.72.0)
+
+## no name
+
+*features* mask bit: CURL_VERSION_CONV
+
+libcurl was built with support for character conversions provided by
+callbacks. Always 0 since 7.82.0. Deprecated.
+
+## no name
+
+*features* mask bit: CURL_VERSION_CURLDEBUG
+
+libcurl was built with memory tracking debug capabilities. This is mainly of
+interest for libcurl hackers. Always the same as CURL_VERSION_DEBUG since
+8.19.0. Deprecated.
+
+## no name
+
+*features* mask bit: CURL_VERSION_GSSNEGOTIATE
+
+supports HTTP GSS-Negotiate. Deprecated.
+
+## no name
+
+*features* mask bit: CURL_VERSION_KERBEROS4
+
+supports Kerberos V4 (when using FTP). Legacy bit. Deprecated since 7.33.0.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  curl_version_info_data *ver = curl_version_info(CURLVERSION_NOW);
+  printf("libcurl version %u.%u.%u\n",
+         (ver->version_num >> 16) & 0xff,
+         (ver->version_num >> 8) & 0xff,
+         ver->version_num & 0xff);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+A pointer to a curl_version_info_data struct.
diff --git a/third-party/curl/docs/libcurl/curl_ws_meta.3 b/third-party/curl/docs/libcurl/curl_ws_meta.3
deleted file mode 100644
index c807812028..0000000000
--- a/third-party/curl/docs/libcurl/curl_ws_meta.3
+++ /dev/null
@@ -1,118 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH curl_ws_meta 3 "12 Jun 2022" "libcurl" "libcurl"
-.SH NAME
-curl_ws_meta - meta data WebSocket information
-.SH SYNOPSIS
-.nf
-#include <curl/easy.h>
-
-struct curl_ws_frame {
-  int age;              /* zero */
-  int flags;            /* See the CURLWS_* defines */
-  curl_off_t offset;    /* the offset of this data into the frame */
-  curl_off_t bytesleft; /* number of pending bytes left of the payload */
-};
-
-const struct curl_ws_frame *curl_ws_meta(CURL *curl);
-.fi
-.SH DESCRIPTION
-This function call is EXPERIMENTAL.
-
-When the write callback (\fICURLOPT_WRITEFUNCTION(3)\fP) is invoked on
-received WebSocket traffic, \fIcurl_ws_meta(3)\fP can be called from within
-the callback to provide additional information about the current frame.
-
-This function only works from within the callback, and only when receiving
-WebSocket data.
-
-This function requires an easy handle as input argument for libcurl to know
-what transfer the question is about, but as there is no such pointer provided
-to the callback by libcurl itself, applications that want to use
-\fIcurl_ws_meta(3)\fP need to pass it on to the callback on its own.
-
-.SH "struct fields"
-.IP age
-This field specify the age of this struct. It is always zero for now.
-.IP flags
-This is a bitmask with individual bits set that describes the WebSocket
-data. See the list below.
-.IP offset
-When this frame is a continuation of fragment data already delivered, this is
-the offset into the final fragment where this piece belongs.
-.IP bytesleft
-If this is not a complete fragment, the \fIbytesleft\fP field informs about
-how many additional bytes are expected to arrive before this fragment is
-complete.
-.SH FLAGS
-.IP CURLWS_TEXT
-The buffer contains text data. Note that this makes a difference to WebSocket
-but libcurl itself does not make any verification of the content or
-precautions that you actually receive valid UTF-8 content.
-.IP CURLWS_BINARY
-This is binary data.
-.IP CURLWS_CONT
-This is not the final fragment of the message, it implies that there is
-another fragment coming as part of the same message.
-.IP CURLWS_CLOSE
-This transfer is now closed.
-.IP CURLWS_PING
-This as an incoming ping message, that expects a pong response.
-.SH EXAMPLE
-.nf
-
-/* we pass a pointer to this struct to the callback */
-struct customdata {
-  CURL *easy;
-  void *ptr;
-};
-
-static size_t writecb(unsigned char *buffer,
-                      size_t size, size_t nitems, void *p)
-{
-  struct customdata *c = (struct customdata *)p;
-  const struct curl_ws_frame *m = curl_ws_meta(c->easy);
-
-  /* m->flags tells us about the traffic */
-}
-
-{
-  struct customdata custom;
-  custom.easy = easy;
-  custom.ptr = NULL;
-  curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writecb);
-  curl_easy_setopt(curl, CURLOPT_WRITEDATA, &custom);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.86.0.
-.SH RETURN VALUE
-This function returns a pointer to a \fIcurl_ws_frame\fP struct with read-only
-information that is valid for this specific callback invocation. If it cannot
-return this information, or if the function is called in the wrong context, it
-returns NULL.
-.SH "SEE ALSO"
-.BR curl_easy_setopt "(3), " curl_easy_getinfo "(3), "
-.BR curl_ws_send "(3), " curl_ws_recv "(3), " libcurl-ws "(3), "
diff --git a/third-party/curl/docs/libcurl/curl_ws_meta.md b/third-party/curl/docs/libcurl/curl_ws_meta.md
new file mode 100644
index 0000000000..978520afd8
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_ws_meta.md
@@ -0,0 +1,172 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_ws_meta
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+  - curl_ws_recv (3)
+  - curl_ws_send (3)
+  - libcurl-ws (3)
+Protocol:
+  - WS
+Added-in: 7.86.0
+---
+
+# NAME
+
+curl_ws_meta - meta data WebSocket information
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+const struct curl_ws_frame *curl_ws_meta(CURL *curl);
+~~~
+
+# DESCRIPTION
+
+When the write callback (CURLOPT_WRITEFUNCTION(3)) is invoked on
+received WebSocket traffic, curl_ws_meta(3) can be called from within
+the callback to provide additional information about the current frame.
+
+This function only works from within the callback, and only when receiving
+WebSocket data.
+
+This function requires an easy handle as input argument for libcurl to know
+what transfer the question is about, but as there is no such pointer provided
+to the callback by libcurl itself, applications that want to use
+curl_ws_meta(3) need to pass it on to the callback on its own.
+
+# struct curl_ws_frame
+
+~~~c
+struct curl_ws_frame {
+  int age;
+  int flags;
+  curl_off_t offset;
+  curl_off_t bytesleft;
+  size_t len;
+};
+~~~
+
+## `age`
+
+This field specify the age of this struct. It is always zero for now.
+
+## `flags`
+
+This is a bitmask with individual bits set that describes the WebSocket data.
+See the list below.
+
+## `offset`
+
+When this chunk is a continuation of frame data already delivered, this is
+the offset into the final frame data where this piece belongs to.
+
+## `bytesleft`
+
+If this is not a complete fragment, the *bytesleft* field informs about how
+many additional bytes are expected to arrive before this fragment is complete.
+
+## `len`
+
+The length of the current data chunk.
+
+# FLAGS
+
+The *message type* flags (CURLWS_TEXT/BINARY/CLOSE/PING/PONG) are mutually
+exclusive.
+
+## CURLWS_TEXT
+
+This is a message with text data. Note that this makes a difference to WebSocket
+but libcurl itself does not make any verification of the content or
+precautions that you actually receive valid UTF-8 content.
+
+## CURLWS_BINARY
+
+This is a message with binary data.
+
+## CURLWS_CLOSE
+
+This is a close message. No more data follows.
+
+It may contain a 2-byte unsigned integer in network byte order that indicates
+the close reason and may additionally contain up to 123 bytes of further
+textual payload for a total of at most 125 bytes. libcurl does not verify that
+the textual description is valid UTF-8.
+
+## CURLWS_PING
+
+This is a ping message. It may contain up to 125 bytes of payload text.
+libcurl does not verify that the payload is valid UTF-8.
+
+Upon receiving a ping message, libcurl automatically responds with a pong
+message unless the **CURLWS_NOAUTOPONG** or **CURLWS_RAW_MODE** bit of
+CURLOPT_WS_OPTIONS(3) is set.
+
+## CURLWS_PONG
+
+This is a pong message. It may contain up to 125 bytes of payload text.
+libcurl does not verify that the payload is valid UTF-8.
+
+## CURLWS_CONT
+
+Can only occur in conjunction with CURLWS_TEXT or CURLWS_BINARY.
+
+This is not the final fragment of the message, it implies that there is
+another fragment coming as part of the same message. The application must
+reassemble the fragments to receive the complete message.
+
+Only a single fragmented message can be transmitted at a time, but it may
+be interrupted by CURLWS_CLOSE, CURLWS_PING or CURLWS_PONG frames.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+
+/* we pass a pointer to this struct to the callback */
+struct customdata {
+  CURL *easy;
+  void *ptr;
+};
+
+static size_t writecb(char *buffer, size_t size, size_t nitems, void *p)
+{
+  struct customdata *c = (struct customdata *)p;
+  const struct curl_ws_frame *m = curl_ws_meta(c->easy);
+
+  printf("flags: %x\n", m->flags);
+  return 0;
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    struct customdata custom;
+    custom.easy = curl;
+    custom.ptr = NULL;
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writecb);
+    curl_easy_setopt(curl, CURLOPT_WRITEDATA, &custom);
+
+    curl_easy_perform(curl);
+  }
+  return 0;
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a pointer to a *curl_ws_frame* struct with read-only
+information that is valid for this specific callback invocation. If it cannot
+return this information, or if the function is called in the wrong context, it
+returns NULL.
diff --git a/third-party/curl/docs/libcurl/curl_ws_recv.3 b/third-party/curl/docs/libcurl/curl_ws_recv.3
deleted file mode 100644
index 4fc683add8..0000000000
--- a/third-party/curl/docs/libcurl/curl_ws_recv.3
+++ /dev/null
@@ -1,69 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH curl_ws_recv 3 "12 Jun 2022" "libcurl" "libcurl"
-.SH NAME
-curl_ws_recv - receive WebSocket data
-.SH SYNOPSIS
-.nf
-#include <curl/easy.h>
-
-CURLcode curl_ws_recv(CURL *curl, void *buffer, size_t buflen,
-                      size_t *recv, const struct curl_ws_frame **meta);
-.fi
-.SH DESCRIPTION
-This function call is EXPERIMENTAL.
-
-Retrieves as much as possible of a received WebSocket data fragment into the
-\fBbuffer\fP, but not more than \fBbuflen\fP bytes. \fIrecv\fP is set to the
-number of bytes actually stored.
-
-If there is more fragment data to deliver than what fits in the provided
-\fIbuffer\fP, libcurl returns a full buffer and the application needs to call
-this function again to continue draining the buffer.
-
-The \fImeta\fP pointer gets set to point to a \fIconst struct curl_ws_frame\fP
-that contains information about the received data. See the
-\fIcurl_ws_meta(3)\fP for details on that struct.
-.SH EXAMPLE
-.nf
-  size_t rlen;
-  const struct curl_ws_frame *meta;
-  char buffer[256];
-  CURLcode result = curl_ws_recv(curl, buffer, sizeof(buffer), &rlen, &meta);
-.fi
-.SH AVAILABILITY
-Added in 7.86.0.
-.SH RETURN VALUE
-Returns \fBCURLE_OK\fP if everything is okay, and a non-zero number for
-errors. Returns \fBCURLE_GOT_NOTHING\fP if the associated connection is
-closed.
-
-Instead of blocking, the function returns \fBCURLE_AGAIN\fP. The correct
-behavior is then to wait for the socket to signal readability before calling
-this function again.
-.SH "SEE ALSO"
-.BR curl_easy_setopt "(3), " curl_easy_perform "(3), "
-.BR curl_easy_getinfo "(3), "
-.BR curl_ws_send "(3), "  libcurl-ws "(3), "
diff --git a/third-party/curl/docs/libcurl/curl_ws_recv.md b/third-party/curl/docs/libcurl/curl_ws_recv.md
new file mode 100644
index 0000000000..0b56c578ba
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_ws_recv.md
@@ -0,0 +1,134 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_ws_recv
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_getinfo (3)
+  - curl_easy_perform (3)
+  - curl_easy_setopt (3)
+  - curl_ws_send (3)
+  - libcurl-ws (3)
+Protocol:
+  - WS
+Added-in: 7.86.0
+---
+
+# NAME
+
+curl_ws_recv - receive WebSocket data
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_ws_recv(CURL *curl, void *buffer, size_t buflen,
+                      size_t *recv, const struct curl_ws_frame **meta);
+~~~
+
+# DESCRIPTION
+
+Retrieves as much as possible of a received WebSocket frame into the *buffer*,
+but not more than *buflen* bytes. *recv* is set to the number of bytes
+actually stored.
+
+If the function call is successful, the *meta* pointer gets set to point to a
+*const struct curl_ws_frame* that contains information about the received
+data. That struct must not be freed and its contents must not be relied upon
+anymore once another WebSocket function is called. See curl_ws_meta(3) for
+more details on that struct.
+
+The application must check `meta->bytesleft` to determine whether the complete
+frame has been received. If more payload is pending, the application must call
+this function again with an updated *buffer* and *buflen* to resume receiving.
+This may for example happen when the data does not fit into the provided
+buffer or when not all frame data has been delivered over the network yet.
+
+If the application wants to read the metadata without consuming any payload,
+it may call this function with a *buflen* of zero. Setting *buffer* to a NULL
+pointer is permitted in this case. Note that frames without payload are
+consumed by this action.
+
+If the received message consists of multiple fragments, the *CURLWS_CONT* bit
+is set in all frames except the final one. The appropriate *CURLWS_TEXT* or
+*CURLWS_BINARY* flag is set in every frame, regardless whether it is the first
+fragment, an intermediate fragment or the final fragment. The application is
+responsible for reassembling fragmented messages. Special care must be taken
+to correctly handle control frames (i.e. CLOSE, PING and PONG) arriving in
+between consecutive fragments of a fragmented TEXT or BINARY message. See
+curl_ws_meta(3) for more details on *CURLWS_CONT*.
+
+The WebSocket protocol consists of *messages* that can be delivered over the
+wire as one or more *frames* - but since a frame can be too large to buffer in
+memory, libcurl may need to deliver partial frames to the application.
+Fragments, or chunks, of frames.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  char buffer[256];
+  size_t offset = 0;
+  CURLcode result = CURLE_OK;
+  CURL *curl = curl_easy_init();
+
+  curl_easy_setopt(curl, CURLOPT_URL, "wss://example.com/");
+  curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 2L);
+  /* start HTTPS connection and upgrade to WSS, then return control */
+  curl_easy_perform(curl);
+
+  /* Note: This example neglects fragmented messages.
+     (CURLWS_CONT bit) A real application must handle them
+     appropriately. */
+
+  while(!result) {
+    size_t recv;
+    const struct curl_ws_frame *meta;
+    result = curl_ws_recv(curl, buffer + offset,
+                          sizeof(buffer) - offset, &recv,
+                          &meta);
+    offset += recv;
+
+    if(result == CURLE_OK) {
+      if(meta->bytesleft == 0)
+        break; /* finished receiving */
+      if(meta->bytesleft > (curl_off_t)(sizeof(buffer) - offset))
+        result = CURLE_TOO_LARGE;
+    }
+
+    if(result == CURLE_AGAIN)
+      /* in real application: wait for socket here, e.g. using select() */
+      result = CURLE_OK;
+  }
+
+  curl_easy_cleanup(curl);
+  return (int)result;
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
+
+Returns **CURLE_GOT_NOTHING** if the associated connection is closed.
+
+Instead of blocking, the function returns **CURLE_AGAIN**. The correct
+behavior is then to wait for the socket to signal readability before calling
+this function again.
+
+Any other non-zero return value indicates an error. See the libcurl-errors(3)
+man page for the full list with descriptions.
+
+Returns **CURLE_GOT_NOTHING** if the associated connection is closed.
diff --git a/third-party/curl/docs/libcurl/curl_ws_send.3 b/third-party/curl/docs/libcurl/curl_ws_send.3
deleted file mode 100644
index 25b59e4575..0000000000
--- a/third-party/curl/docs/libcurl/curl_ws_send.3
+++ /dev/null
@@ -1,100 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH curl_ws_send 3 "12 Jun 2022" "libcurl" "libcurl"
-.SH NAME
-curl_ws_send - send WebSocket data
-.SH SYNOPSIS
-.nf
-#include <curl/easy.h>
-
-CURLcode curl_ws_send(CURL *curl, const void *buffer, size_t buflen,
-                      size_t *sent, curl_off_t fragsize,
-                      unsigned int flags);
-.fi
-.SH DESCRIPTION
-This function call is EXPERIMENTAL.
-
-Send the specific message fragment over an established WebSocket
-connection. The \fIbuffer\fP holds the data to send and it is \fIbuflen\fP
-number of payload bytes in that memory area.
-
-\fIsent\fP is returned as the number of payload bytes actually sent.
-
-To send a (huge) fragment using multiple calls with partial content per
-invoke, set the \fICURLWS_OFFSET\fP bit and the \fIfragsize\fP argument as the
-total expected size for the first part, then set the \fICURLWS_OFFSET\fP with
-a zero \fIfragsize\fP for the following parts.
-
-If not sending a partial fragment or if this is raw mode, \fIfragsize\fP
-should be set to zero.
-
-If \fBCURLWS_RAW_MODE\fP is enabled in \fICURLOPT_WS_OPTIONS(3)\fP, the
-\fBflags\fP argument should be set to 0.
-
-To send a message consisting of multiple frames, set the \fICURLWS_CONT\fP bit
-in all frames except the final one.
-.SH FLAGS
-.IP CURLWS_TEXT
-The buffer contains text data. Note that this makes a difference to WebSocket
-but libcurl itself does not make any verification of the content or
-precautions that you actually send valid UTF-8 content.
-.IP CURLWS_BINARY
-This is binary data.
-.IP CURLWS_CONT
-This is not the final fragment of the message, which implies that there is
-another fragment coming as part of the same message where this bit is not set.
-.IP CURLWS_CLOSE
-Close this transfer.
-.IP CURLWS_PING
-This is a ping.
-.IP CURLWS_PONG
-This is a pong.
-.IP CURLWS_OFFSET
-The provided data is only a partial fragment and there is more coming in a
-following call to \fIcurl_ws_send()\fP. When sending only a piece of the
-fragment like this, the \fIfragsize\fP must be provided with the total
-expected fragment size in the first call and it needs to be zero in subsequent
-calls.
-.SH EXAMPLE
-.nf
-int ping(CURL *curl, const char *send_payload)
-{
-  size_t sent;
-  CURLcode result =
-    curl_ws_send(curl, send_payload, strlen(send_payload), &sent, 0,
-                 CURLWS_PING);
-  return (int)result;
-}
-.fi
-.SH AVAILABILITY
-Added in 7.86.0.
-.SH RETURN VALUE
-\fICURLE_OK\fP (zero) means that the data was sent properly, non-zero means an
-error occurred as \fI<curl/curl.h>\fP defines. See the \fIlibcurl-errors(3)\fP
-man page for the full list with descriptions.
-.SH "SEE ALSO"
-.BR curl_easy_setopt "(3), " curl_easy_perform "(3), "
-.BR curl_easy_getinfo "(3), "
-.BR curl_ws_recv "(3), " libcurl-ws "(3), "
diff --git a/third-party/curl/docs/libcurl/curl_ws_send.md b/third-party/curl/docs/libcurl/curl_ws_send.md
new file mode 100644
index 0000000000..dc6e927ca8
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_ws_send.md
@@ -0,0 +1,137 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_ws_send
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_getinfo (3)
+  - curl_easy_perform (3)
+  - curl_easy_setopt (3)
+  - curl_ws_recv (3)
+  - curl_ws_start_frame (3)
+  - libcurl-ws (3)
+Protocol:
+  - WS
+Added-in: 7.86.0
+---
+
+# NAME
+
+curl_ws_send - send WebSocket data
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_ws_send(CURL *curl, const void *buffer, size_t buflen,
+                      size_t *sent, curl_off_t fragsize,
+                      unsigned int flags);
+~~~
+
+# DESCRIPTION
+
+Send the specific message chunk over an established WebSocket
+connection. *buffer* must point to a valid memory location containing
+(at least) *buflen* bytes of payload memory.
+
+*sent* is set to the number of payload bytes actually sent. If the return value
+is **CURLE_OK** but *sent* is less than the given *buflen*, libcurl was unable
+to consume the complete payload in a single call. In this case the application
+must call this function again until all payload is processed. *buffer* and
+*buflen* must be updated on every following invocation to only point to the
+remaining piece of the payload.
+
+*fragsize* should always be set to zero unless a (huge) frame shall be sent
+using multiple calls with partial content per call explicitly. In that
+case you must set the *CURLWS_OFFSET* bit and set the *fragsize* as documented
+in the section on *CURLWS_OFFSET* below.
+
+*flags* must contain at least one flag indicating the type of the message.
+To send a fragmented message consisting of multiple frames, additionally set
+the *CURLWS_CONT* bit in all frames except the final one. The appropriate
+message type bit should be set in every frame of a fragmented message without
+exemption. Omitting the message type for continuation frames of a fragmented
+message is only supported for backwards compatibility and highly discouraged.
+
+For more details on the supported flags see below and in curl_ws_meta(3).
+
+If *CURLWS_RAW_MODE* is enabled in CURLOPT_WS_OPTIONS(3), the
+*flags* argument should be set to 0.
+
+Warning: while it is possible to invoke this function from a callback,
+such a call is blocking in this situation, e.g. only returns after all data
+has been sent or an error is encountered.
+
+# FLAGS
+
+Supports all flags documented in curl_ws_meta(3) and additionally the following
+flags.
+
+## CURLWS_OFFSET
+
+The provided data is only a partial frame and there is more coming in a
+following call to *curl_ws_send()*. When sending only a piece of the
+frame like this, the *fragsize* must be provided with the total
+expected frame size in the first call and must be zero in all subsequent
+calls.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <string.h> /* for strlen */
+
+int main(void)
+{
+  const char *buffer = "PAYLOAD";
+  size_t offset = 0;
+  CURLcode result = CURLE_OK;
+  CURL *curl = curl_easy_init();
+
+  curl_easy_setopt(curl, CURLOPT_URL, "wss://example.com/");
+  curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 2L);
+  /* start HTTPS connection and upgrade to WSS, then return control */
+  curl_easy_perform(curl);
+
+  while(!result) {
+    size_t sent;
+    result = curl_ws_send(curl, buffer + offset,
+                          strlen(buffer) - offset, &sent,
+                          0, CURLWS_TEXT);
+    offset += sent;
+
+    if(result == CURLE_OK) {
+      if(offset == strlen(buffer))
+        break; /* finished sending */
+    }
+
+    if(result == CURLE_AGAIN)
+      /* in real application: wait for socket here, e.g. using select() */
+      result = CURLE_OK;
+  }
+
+  curl_easy_cleanup(curl);
+  return (int)result;
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
+
+Instead of blocking, the function returns **CURLE_AGAIN**. The correct
+behavior is then to wait for the socket to signal readability before calling
+this function again.
+
+Any other non-zero return value indicates an error. See the libcurl-errors(3)
+man page for the full list with descriptions.
diff --git a/third-party/curl/docs/libcurl/curl_ws_start_frame.md b/third-party/curl/docs/libcurl/curl_ws_start_frame.md
new file mode 100644
index 0000000000..e02487759c
--- /dev/null
+++ b/third-party/curl/docs/libcurl/curl_ws_start_frame.md
@@ -0,0 +1,150 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: curl_ws_start_frame
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_getinfo (3)
+  - curl_easy_perform (3)
+  - curl_easy_setopt (3)
+  - curl_ws_recv (3)
+  - libcurl-ws (3)
+Protocol:
+  - WS
+Added-in: 8.16.0
+---
+
+# NAME
+
+curl_ws_start_frame - start a new WebSocket frame
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_ws_start_frame(CURL *curl,
+                             unsigned int flags,
+                             curl_off_t frame_len);
+~~~
+
+# DESCRIPTION
+
+Add the WebSocket frame header for the given flags and length to
+the transfers send buffer for WebSocket encoded data. Intended for
+use in a CURLOPT_READFUNCTION(3) callback.
+
+When using a CURLOPT_READFUNCTION(3) in a WebSocket transfer, any
+data returned by that function is sent as a *CURLWS_BINARY* frame
+with the length being the amount of data read.
+
+To send larger frames or frames of a different type, call
+curl_ws_start_frame() from within the read function and then return
+the data belonging to the frame.
+
+The function fails, if a previous frame has not been completely read yet. Also
+it fails in *CURLWS_RAW_MODE*.
+
+The read function in libcurl usually treats a return value of 0 as the end of
+file indication and stops any further reads. This would prevent sending
+WebSocket frames of length 0.
+
+If the read function calls `curl_ws_start_frame()`, a return value of 0 is
+*not* treated as an end of file and libcurl calls the read function again.
+
+# FLAGS
+
+Supports all flags documented in curl_ws_meta(3).
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <string.h> /* for strlen */
+
+struct read_ctx {
+  CURL *easy;
+  char *message;
+  size_t msg_len;
+  size_t nsent;
+};
+
+static size_t readcb(char *buf, size_t nitems, size_t buflen, void *p)
+{
+  struct read_ctx *ctx = p;
+  size_t len = nitems * buflen;
+  size_t left = ctx->msg_len - ctx->nsent;
+
+  if(!ctx->nsent) {
+    CURLcode result;
+    /* Want to send TEXT frame. */
+    result = curl_ws_start_frame(ctx->easy, CURLWS_TEXT,
+                                 (curl_off_t)ctx->msg_len);
+    if(result != CURLE_OK) {
+      fprintf(stderr, "error starting frame: %d\n", result);
+      return CURL_READFUNC_ABORT;
+    }
+  }
+  if(left) {
+    if(left < len)
+      len = left;
+    memcpy(buf, ctx->message + ctx->nsent, len);
+    ctx->nsent += len;
+    return len;
+  }
+  return 0;
+}
+
+int main(void)
+{
+  CURL *easy;
+  struct read_ctx rctx;
+  CURLcode result;
+
+  easy = curl_easy_init();
+  if(!easy)
+    return 1;
+
+  curl_easy_setopt(easy, CURLOPT_URL, "wss://example.com");
+  curl_easy_setopt(easy, CURLOPT_READFUNCTION, readcb);
+  /* tell curl that we want to send the payload */
+  memset(&rctx, 0, sizeof(rctx));
+  rctx.easy = easy;
+  rctx.message = "Hello, friend!";
+  rctx.msg_len = strlen(rctx.message);
+  curl_easy_setopt(easy, CURLOPT_READDATA, &rctx);
+  curl_easy_setopt(easy, CURLOPT_UPLOAD, 1L);
+
+  /* Perform the request, result gets the return code */
+  result = curl_easy_perform(easy);
+  /* Check for errors */
+  if(result != CURLE_OK)
+    fprintf(stderr, "curl_easy_perform() failed: %s\n",
+            curl_easy_strerror(result));
+
+  /* always cleanup */
+  curl_easy_cleanup(easy);
+  return 0;
+}
+
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This function returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3). If CURLOPT_ERRORBUFFER(3) was set with curl_easy_setopt(3)
+there can be an error message stored in the error buffer when non-zero is
+returned.
+
+Instead of blocking, the function returns **CURLE_AGAIN**. The correct
+behavior is then to wait for the socket to signal readability before calling
+this function again.
+
+Any other non-zero return value indicates an error. See the libcurl-errors(3)
+man page for the full list with descriptions.
diff --git a/third-party/curl/docs/libcurl/libcurl-easy.3 b/third-party/curl/docs/libcurl/libcurl-easy.3
deleted file mode 100644
index 005aed7cd1..0000000000
--- a/third-party/curl/docs/libcurl/libcurl-easy.3
+++ /dev/null
@@ -1,61 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH libcurl 3 "19 Sep 2014" "libcurl" "libcurl"
-.SH NAME
-libcurl-easy \- easy interface overview
-.SH DESCRIPTION
-When using libcurl's "easy" interface you init your session and get a handle
-(often referred to as an "easy handle"), which you use as input to the easy
-interface functions you use. Use \fIcurl_easy_init(3)\fP to get the handle.
-
-You continue by setting all the options you want in the upcoming transfer, the
-most important among them is the URL itself (you cannot transfer anything
-without a specified URL as you may have figured out yourself). You might want
-to set some callbacks as well that are called from the library when data is
-available etc. \fIcurl_easy_setopt(3)\fP is used for all this.
-
-\fICURLOPT_URL(3)\fP is the only option you really must set, as otherwise
-there can be no transfer. Another commonly used option is
-\fICURLOPT_VERBOSE(3)\fP that helps you see what libcurl is doing under the
-hood, which is useful when debugging for example. The
-\fIcurl_easy_setopt(3)\fP man page has a full index of the almost 300
-available options.
-
-If you at any point would like to blank all previously set options for a
-single easy handle, you can call \fIcurl_easy_reset(3)\fP and you can also
-make a clone of an easy handle (with all its set options) using
-\fIcurl_easy_duphandle(3)\fP.
-
-When all is setup, you tell libcurl to perform the transfer using
-\fIcurl_easy_perform(3)\fP. It performs the entire transfer operation and does
-not return until it is done (successfully or not).
-
-After the transfer has been made, you can set new options and make another
-transfer, or if you are done, cleanup the session by calling
-\fIcurl_easy_cleanup(3)\fP. If you want persistent connections, you do not
-cleanup immediately, but instead run ahead and perform other transfers using
-the same easy handle.
-.SH "SEE ALSO"
-.BR curl_easy_init "(3)," curl_easy_cleanup "(3)," curl_easy_setopt "(3), "
-.BR libcurl-errors "(3), " libcurl-multi "(3), " libcurl "(3) "
diff --git a/third-party/curl/docs/libcurl/libcurl-easy.md b/third-party/curl/docs/libcurl/libcurl-easy.md
new file mode 100644
index 0000000000..fdbc755823
--- /dev/null
+++ b/third-party/curl/docs/libcurl/libcurl-easy.md
@@ -0,0 +1,54 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: libcurl-easy
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_cleanup (3)
+  - curl_easy_init (3)
+  - curl_easy_setopt (3)
+  - libcurl (3)
+  - libcurl-errors (3)
+  - libcurl-multi (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+libcurl-easy - easy interface overview
+
+# DESCRIPTION
+
+When using libcurl's "easy" interface you init your session and get a handle
+(often referred to as an "easy handle"), which you use as input to the easy
+interface functions you use. Use curl_easy_init(3) to get the handle.
+
+You continue by setting all the options you want in the upcoming transfer, the
+most important among them is the URL itself (you cannot transfer anything
+without a specified URL). You might want to set some callbacks as well that
+are called from the library when data is available etc. For example
+CURLOPT_WRITEFUNCTION(3). curl_easy_setopt(3) is used for all this.
+
+CURLOPT_URL(3) is the only option you really must set, as otherwise there can
+be no transfer. Another commonly used option is CURLOPT_VERBOSE(3) that helps
+you see what libcurl is doing under the hood, which is useful when debugging
+for example. The curl_easy_setopt(3) man page has a full index of the over 300
+available options.
+
+If you at any point would like to factory-reset all previously set options for
+a single easy handle, you can call curl_easy_reset(3). You can also make a
+clone of an easy handle (with all its set options) using
+curl_easy_duphandle(3).
+
+When all necessary options have been set on the handle, you tell libcurl to
+perform the transfer with curl_easy_perform(3). It performs the entire
+transfer operation and does not return until it is done (successfully or not).
+
+After the transfer has been made, you can set new options and make another
+transfer, or if you are done, cleanup the session by calling
+curl_easy_cleanup(3). If you want persistent connections, you do not cleanup
+immediately, but instead run ahead and perform other transfers using the same
+easy handle.
diff --git a/third-party/curl/docs/libcurl/libcurl-env-dbg.md b/third-party/curl/docs/libcurl/libcurl-env-dbg.md
new file mode 100644
index 0000000000..70d0f12c88
--- /dev/null
+++ b/third-party/curl/docs/libcurl/libcurl-env-dbg.md
@@ -0,0 +1,206 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: libcurl-env-dbg
+Section: 3
+Source: libcurl
+See-also:
+  - libcurl-env (3)
+Protocol:
+  - All
+Added-in: n/a
+---
+
+# NAME
+
+libcurl-env-dbg - environment variables libcurl DEBUGBUILD understands
+
+# DESCRIPTION
+
+This is a set of variables only recognized and used if libcurl was built
+"debug enabled", which should never be true for a library used in production.
+These variables are intended for internal use only, subject to change and have
+many effects on the behavior of libcurl. Refer to the source code to determine
+how exactly they are being used.
+
+## `CURL_ALTSVC_HTTP`
+
+Bypass the AltSvc HTTPS protocol restriction if this variable exists.
+
+## `CURL_DBG_SOCK_RBLOCK`
+
+The percentage of recv() calls that should be answered with an EAGAIN at
+random. For TCP/UNIX sockets.
+
+## `CURL_DBG_SOCK_RMAX`
+
+The maximum data that shall be received from the network in one recv() call.
+For TCP/UNIX sockets. This is applied to every recv.
+
+Example: **CURL_DBG_SOCK_RMAX=400** means recv buffer size is limited to a
+maximum of 400 bytes.
+
+## `CURL_DBG_SOCK_WBLOCK`
+
+The percentage of send() calls that should be answered with an EAGAIN at
+random. For TCP/UNIX sockets.
+
+## `CURL_DBG_SOCK_WPARTIAL`
+
+The percentage of data that shall be written to the network. For TCP/UNIX
+sockets. This is applied to every send.
+
+Example: **CURL_DBG_SOCK_WPARTIAL=80** means a send with 1000 bytes would
+only send 800.
+
+## `CURL_DBG_QUIC_WBLOCK`
+
+The percentage of send() calls that should be answered with EAGAIN at random.
+QUIC only.
+
+## `CURL_DBG_SOCK_FAIL_IPV6`
+
+Fail opening of sockets for the IPv6 address family.
+
+## `CURL_DEBUG`
+
+Trace logging behavior as an alternative to calling curl_global_trace(3).
+
+Example: **CURL_DEBUG=http/2** means trace details about HTTP/2 handling.
+
+In the curl command line tool, built with `--enable-debug`, this environment
+variable adds to arguments like `--verbose`, `-vvv`. At least a single `-v`
+is needed to make the run emit trace output, but when it does, the contents
+of `CURL_DEBUG` are added and can override existing options.
+
+Example: **CURL_DEBUG=tcp,-http/2 curl -vv url** means trace protocol details,
+triggered by `-vv`, add tracing of TCP in addition and remove tracing of
+HTTP/2.
+
+## `CURL_DEBUG_SIZE`
+
+Fake the size returned by CURLINFO_HEADER_SIZE and CURLINFO_REQUEST_SIZE.
+
+## `CURL_DNS_SERVER`
+
+When built with c-ares for name resolving, setting this environment variable
+to `[IP:port]` makes libcurl use that DNS server instead of the system
+default. This is used by the curl test suite.
+
+## `CURL_FTP_PWD_STOP`
+
+When set, the first transfer - when using ftp: - returns before sending
+the `PWD` command and stop any further progress. This is used to test
+an edge case
+
+## `CURL_GETHOSTNAME`
+
+Fake the local machine's unqualified hostname for NTLM and SMTP.
+
+## `CURL_HSTS_HTTP`
+
+Bypass the HSTS HTTPS protocol restriction if this variable exists.
+
+## `CURL_FORCETIME`
+
+A time of 0 is used for AWS signatures and NTLM if this variable exists.
+
+## `CURL_ENTROPY`
+
+A fixed faked value to use instead of a proper random number so that functions
+in libcurl that are otherwise getting random outputs can be tested for what
+they generate.
+
+## `CURL_SIGPIPE_DEBUG`
+
+When present, `curl` does not set `SIGPIPE` to ignore. This allows
+verification that `libcurl` does not cause `SIGPIPE` to be raised.
+
+## `CURL_SMALLREQSEND`
+
+An alternative size of HTTP data to be sent at a time only if smaller than the
+current.
+
+## `CURL_SMALLSENDS`
+
+An alternative size of socket data to be sent at a time only if smaller than
+the current.
+
+## `CURL_TIME`
+
+Fake Unix timestamp to use for AltSvc, HSTS and CURLINFO variables that are
+time related.
+
+This variable can also be used to fake the data returned by some CURLINFO
+variables that are not time-related (such as CURLINFO_LOCAL_PORT), and in that
+case the value is not a timestamp.
+
+## `CURL_TRACE`
+
+LDAP tracing is enabled if this variable exists and its value is 1 or greater.
+
+OpenLDAP tracing is separate. Refer to CURL_OPENLDAP_TRACE.
+
+## `CURL_OPENLDAP_TRACE`
+
+OpenLDAP tracing is enabled if this variable exists and its value is 1 or
+greater. There is a number of debug levels, refer to *openldap.c* comments.
+
+## `CURL_WS_CHUNK_SIZE`
+
+Used to influence the buffer chunk size used for WebSocket encoding and
+decoding.
+
+## `CURL_WS_CHUNK_EAGAIN`
+
+Used to simulate blocking sends after this chunk size for WebSocket
+connections.
+
+## `CURL_WS_FORCE_ZERO_MASK`
+
+Used to set the bitmask of all sent WebSocket frames to zero. The value of the
+environment variable does not matter.
+
+## `CURL_FORBID_REUSE`
+
+Used to set the CURLOPT_FORBID_REUSE flag on each transfer initiated
+by the curl command line tool. The value of the environment variable
+does not matter.
+
+## `CURL_GRACEFUL_SHUTDOWN`
+
+Make a blocking, graceful shutdown of all remaining connections when
+a multi handle is destroyed. This implicitly triggers for easy handles
+that are run via easy_perform. The value of the environment variable
+gives the shutdown timeout in milliseconds.
+
+## `CURL_DBG_RESOLV_MAX_THREADS`
+
+Overrides the maximum number of threads for resolver.
+
+## `CURL_DBG_RESOLV_DELAY`
+
+Makes ever threaded resolve experience an initial delay in milliseconds.
+
+## `CURL_DBG_RESOLV_FAIL_DELAY`
+
+With a threaded resolver, delay each lookup by the given milliseconds
+and give a negative answer.
+
+## `CURL_DBG_RESOLV_FAIL_IPV6`
+
+Make libcurl fail a resolve for IPv6 only.
+
+## `CURL_QUICK_EXIT`
+
+Make `curl` use the quick exit option, even when built in debug mode.
+
+## `CURL_DBG_AWAIT_HTTPSRR`
+
+When happy eyeballing for https: wait for the HTTPS-RR resolve
+answer to arrive before starting any connect attempt.
+
+## `CURL_DBG_NO_USE_SSL_ON_FIRST`
+
+When passing `--ssl-reqd`, clear it for the first URL in a curl command.
+This allows testing of connection reuse in mixed `STARTTLS` needs.
diff --git a/third-party/curl/docs/libcurl/libcurl-env.3 b/third-party/curl/docs/libcurl/libcurl-env.3
deleted file mode 100644
index de29f77b8b..0000000000
--- a/third-party/curl/docs/libcurl/libcurl-env.3
+++ /dev/null
@@ -1,99 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH libcurl-env 3 "20 January 2018" "libcurl" "libcurl"
-.SH NAME
-libcurl-env \- environment variables libcurl understands
-.SH DESCRIPTION
-libcurl reads and understands a set of environment variables that if set
-controls and changes behaviors. This is the full list of variables to set and
-description of what they do. Also note that curl, the command line tool,
-supports a set of additional environment variables independently of this.
-.IP "[scheme]_proxy"
-When libcurl is given a URL to use in a transfer, it first extracts the
-"scheme" part from the URL and checks if there is a given proxy set for that
-in its corresponding environment variable. A URL like "https://example.com"
-makes libcurl use the "http_proxy" variable, while a URL like
-"ftp://example.com" uses the "ftp_proxy" variable.
-
-These proxy variables are also checked for in their uppercase versions, except
-the "http_proxy" one which is only used lowercase. Note also that some systems
-actually have a case insensitive handling of environment variables and then of
-course "HTTP_PROXY" still works.
-.IP ALL_PROXY
-This is a setting to set proxy for all URLs, independently of what scheme is
-being used. Note that the scheme specific variables overrides this one if set.
-.IP CURL_SSL_BACKEND
-When libcurl is built to support multiple SSL backends, it selects a specific
-backend at first use. If no selection is done by the program using libcurl,
-this variable's selection is used. Setting a name that is not a built-in
-alternative makes libcurl stay with the default.
-
-SSL backend names (case-insensitive): BearSSL, GnuTLS, mbedTLS,
-nss, OpenSSL, rustls, Schannel, Secure-Transport, wolfSSL
-.IP HOME
-When the netrc feature is used (\fICURLOPT_NETRC(3)\fP), this variable is
-checked as the primary way to find the "current" home directory in which
-the .netrc file is likely to exist.
-.IP USERPROFILE
-When the netrc feature is used (\fICURLOPT_NETRC(3)\fP), this variable is
-checked as the secondary way to find the "current" home directory (on Windows
-only) in which the .netrc file is likely to exist.
-.IP LOGNAME
-User name to use when invoking the \fIntlm-wb\fP tool, if \fINTLMUSER\fP was
-not set.
-.IP NO_PROXY
-This has the same functionality as the \fICURLOPT_NOPROXY(3)\fP option: it
-gives libcurl a comma-separated list of host name patterns for which libcurl
-should not use a proxy.
-.IP NTLMUSER
-User name to use when invoking the \fIntlm-wb\fP tool.
-.IP SSLKEYLOGFILE
-When set and libcurl runs with a SSL backend that supports this feature,
-libcurl saves SSL secrets into the given file name. Using those SSL secrets,
-other tools (such as Wireshark) can decrypt the SSL communication and
-analyze/view the traffic.
-
-These secrets and this file might be sensitive. Users are advised to take
-precautions so that they are not stolen or otherwise inadvertently revealed.
-.IP USER
-User name to use when invoking the \fIntlm-wb\fP tool, if \fINTLMUSER\fP and
-\fILOGNAME\fP were not set.
-.SH "Debug Variables"
-There is a set of variables only recognized and used if libcurl was built
-"debug enabled", which should never be true for a library used in production.
-.IP "CURL_GETHOSTNAME"
-Debug-only variable.
-.IP "CURL_FORCETIME"
-Debug-only variable.
-.IP "CURL_ENTROPY"
-Debug-only variable. Used to set a fixed faked value to use instead of a
-proper random number so that functions in libcurl that are otherwise getting
-random outputs can be tested for what they generate.
-.IP "CURL_TRACE"
-Debug-only variable. Used for debugging the lib/ldap implementation.
-.IP "CURL_NTLM_WB_FILE"
-Debug-only variable. Used to set to a debug-version of the \fIntlm-wb\fP
-executable.
-.IP "CURL_OPENLDAP_TRACE"
-Debug-only variable. Used for debugging the OpenLDAP implementation.
diff --git a/third-party/curl/docs/libcurl/libcurl-env.md b/third-party/curl/docs/libcurl/libcurl-env.md
new file mode 100644
index 0000000000..5ce846df8a
--- /dev/null
+++ b/third-party/curl/docs/libcurl/libcurl-env.md
@@ -0,0 +1,93 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: libcurl-env
+Section: 3
+Source: libcurl
+See-also:
+  - libcurl-env-dbg (3)
+Protocol:
+  - All
+Added-in: n/a
+---
+
+# NAME
+
+libcurl-env - environment variables libcurl understands
+
+# DESCRIPTION
+
+libcurl reads and understands a set of environment variables that if set
+controls and changes behaviors. This is the full list of variables to set and
+description of what they do. Also note that curl, the command line tool,
+supports a set of additional environment variables independently of this.
+
+## `[scheme]_proxy`
+
+When libcurl is given a URL to use in a transfer, it first extracts the scheme
+part from the URL and checks if there is a given proxy set for that in its
+corresponding environment variable. A URL like https://example.com makes
+libcurl use the **http_proxy** variable, while a URL like ftp://example.com
+uses the **ftp_proxy** variable.
+
+These proxy variables are also checked for in their uppercase versions, except
+the **http_proxy** one which is only used lowercase. Note also that some
+systems (like Windows) have a case insensitive handling of environment
+variables and then of course **HTTP_PROXY** still works.
+
+An exception exists for the WebSocket **ws** and **wss** URL schemes, where
+libcurl first checks **ws_proxy** or **wss_proxy** but if they are not set, it
+falls back and tries the http and https versions instead if set.
+
+## `ALL_PROXY`
+
+This is a setting to set proxy for all URLs, independently of what scheme is
+being used. Note that the scheme specific variables overrides this one if set.
+
+## `CURL_SSL_BACKEND`
+
+When libcurl is built to support multiple SSL backends, it selects a specific
+backend at first use. If no selection is done by the program using libcurl,
+this variable's selection is used. Setting a name that is not a built-in
+alternative makes libcurl stay with the default.
+
+SSL backend names (case-insensitive): GnuTLS, mbedTLS, OpenSSL, Rustls,
+Schannel, wolfSSL
+
+## `HOME`
+
+When the netrc feature is used (CURLOPT_NETRC(3)), this variable is
+checked as the primary way to find the "current" home directory in which
+the .netrc file is likely to exist.
+
+## `USERPROFILE`
+
+When the netrc feature is used (CURLOPT_NETRC(3)), this variable is
+checked as the secondary way to find the "current" home directory (on Windows
+only) in which the .netrc file is likely to exist.
+
+## `NETRC`
+
+The filename used as netrc file when CURLOPT_NETRC(3) is used without
+CURLOPT_NETRC_FILE(3). (Added in 8.16.0)
+
+## `NO_PROXY`
+
+This has the same functionality as the CURLOPT_NOPROXY(3) option: it
+gives libcurl a comma-separated list of hostname patterns for which libcurl
+should not use a proxy.
+
+## `SSLKEYLOGFILE`
+
+When set and libcurl runs with an SSL backend that supports this feature,
+libcurl saves SSL secrets into the given filename. Using those SSL secrets,
+other tools (such as Wireshark) can decrypt the SSL communication and
+analyze/view the traffic.
+
+These secrets and this file might be sensitive. Users are advised to take
+precautions so that they are not stolen or otherwise inadvertently revealed.
+
+# Debug Variables
+
+Debug variables are intended for internal use and are documented in
+libcurl-env-dbg(3).
diff --git a/third-party/curl/docs/libcurl/libcurl-errors.3 b/third-party/curl/docs/libcurl/libcurl-errors.3
deleted file mode 100644
index 4ba3fc1e64..0000000000
--- a/third-party/curl/docs/libcurl/libcurl-errors.3
+++ /dev/null
@@ -1,438 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH libcurl-errors 3 "23 Nov 2021" "libcurl" "libcurl"
-.SH NAME
-libcurl-errors \- error codes in libcurl
-.SH DESCRIPTION
-This man page includes most, if not all, available error codes in libcurl.
-Why they occur and possibly what you can do to fix the problem are also included.
-.SH "CURLcode"
-Almost all "easy" interface functions return a CURLcode error code. No matter
-what, using the \fIcurl_easy_setopt(3)\fP option \fICURLOPT_ERRORBUFFER(3)\fP
-is a good idea as it gives you a human readable error string that may offer
-more details about the cause of the error than just the error code.
-\fIcurl_easy_strerror(3)\fP can be called to get an error string from a given
-CURLcode number.
-
-CURLcode is one of the following:
-.IP "CURLE_OK (0)"
-All fine. Proceed as usual.
-.IP "CURLE_UNSUPPORTED_PROTOCOL (1)"
-The URL you passed to libcurl used a protocol that this libcurl does not
-support. The support might be a compile-time option that you did not use, it
-can be a misspelled protocol string or just a protocol libcurl has no code
-for.
-.IP "CURLE_FAILED_INIT (2)"
-Early initialization code failed. This is likely to be an internal error or
-problem, or a resource problem where something fundamental could not get done
-at init time.
-.IP "CURLE_URL_MALFORMAT (3)"
-The URL was not properly formatted.
-.IP "CURLE_NOT_BUILT_IN (4)"
-A requested feature, protocol or option was not found built-in in this libcurl
-due to a build-time decision. This means that a feature or option was not
-enabled or explicitly disabled when libcurl was built and in order to get it
-to function you have to get a rebuilt libcurl.
-.IP "CURLE_COULDNT_RESOLVE_PROXY (5)"
-Could not resolve proxy. The given proxy host could not be resolved.
-.IP "CURLE_COULDNT_RESOLVE_HOST (6)"
-Could not resolve host. The given remote host was not resolved.
-.IP "CURLE_COULDNT_CONNECT (7)"
-Failed to connect() to host or proxy.
-.IP "CURLE_WEIRD_SERVER_REPLY (8)"
-The server sent data libcurl could not parse. This error code was known as
-\fICURLE_FTP_WEIRD_SERVER_REPLY\fP before 7.51.0.
-.IP "CURLE_REMOTE_ACCESS_DENIED (9)"
-We were denied access to the resource given in the URL. For FTP, this occurs
-while trying to change to the remote directory.
-.IP "CURLE_FTP_ACCEPT_FAILED (10)"
-While waiting for the server to connect back when an active FTP session is
-used, an error code was sent over the control connection or similar.
-.IP "CURLE_FTP_WEIRD_PASS_REPLY (11)"
-After having sent the FTP password to the server, libcurl expects a proper
-reply. This error code indicates that an unexpected code was returned.
-.IP "CURLE_FTP_ACCEPT_TIMEOUT (12)"
-During an active FTP session while waiting for the server to connect, the
-\fICURLOPT_ACCEPTTIMEOUT_MS(3)\fP (or the internal default) timeout expired.
-.IP "CURLE_FTP_WEIRD_PASV_REPLY (13)"
-libcurl failed to get a sensible result back from the server as a response to
-either a PASV or a EPSV command. The server is flawed.
-.IP "CURLE_FTP_WEIRD_227_FORMAT (14)"
-FTP servers return a 227-line as a response to a PASV command. If libcurl
-fails to parse that line, this return code is passed back.
-.IP "CURLE_FTP_CANT_GET_HOST (15)"
-An internal failure to lookup the host used for the new connection.
-.IP "CURLE_HTTP2 (16)"
-A problem was detected in the HTTP2 framing layer. This is somewhat generic
-and can be one out of several problems, see the error buffer for details.
-.IP "CURLE_FTP_COULDNT_SET_TYPE (17)"
-Received an error when trying to set the transfer mode to binary or ASCII.
-.IP "CURLE_PARTIAL_FILE (18)"
-A file transfer was shorter or larger than expected. This happens when the
-server first reports an expected transfer size, and then delivers data that
-does not match the previously given size.
-.IP "CURLE_FTP_COULDNT_RETR_FILE (19)"
-This was either a weird reply to a 'RETR' command or a zero byte transfer
-complete.
-.IP "Obsolete error (20)"
-Not used in modern versions.
-.IP "CURLE_QUOTE_ERROR (21)"
-When sending custom "QUOTE" commands to the remote server, one of the commands
-returned an error code that was 400 or higher (for FTP) or otherwise
-indicated unsuccessful completion of the command.
-.IP "CURLE_HTTP_RETURNED_ERROR (22)"
-This is returned if \fICURLOPT_FAILONERROR(3)\fP is set TRUE and the HTTP
-server returns an error code that is >= 400.
-.IP "CURLE_WRITE_ERROR (23)"
-An error occurred when writing received data to a local file, or an error was
-returned to libcurl from a write callback.
-.IP "Obsolete error (24)"
-Not used in modern versions.
-.IP "CURLE_UPLOAD_FAILED (25)"
-Failed starting the upload. For FTP, the server typically denied the STOR
-command. The error buffer usually contains the server's explanation for this.
-.IP "CURLE_READ_ERROR (26)"
-There was a problem reading a local file or an error returned by the read
-callback.
-.IP "CURLE_OUT_OF_MEMORY (27)"
-A memory allocation request failed. This is serious badness and
-things are severely screwed up if this ever occurs.
-.IP "CURLE_OPERATION_TIMEDOUT (28)"
-Operation timeout. The specified time-out period was reached according to the
-conditions.
-.IP "Obsolete error (29)"
-Not used in modern versions.
-.IP "CURLE_FTP_PORT_FAILED (30)"
-The FTP PORT command returned error. This mostly happens when you have not
-specified a good enough address for libcurl to use. See
-\fICURLOPT_FTPPORT(3)\fP.
-.IP "CURLE_FTP_COULDNT_USE_REST (31)"
-The FTP REST command returned error. This should never happen if the server is
-sane.
-.IP "Obsolete error (32)"
-Not used in modern versions.
-.IP "CURLE_RANGE_ERROR (33)"
-The server does not support or accept range requests.
-.IP "CURLE_HTTP_POST_ERROR (34)"
-This is an odd error that mainly occurs due to internal confusion.
-.IP "CURLE_SSL_CONNECT_ERROR (35)"
-A problem occurred somewhere in the SSL/TLS handshake. You really want the
-error buffer and read the message there as it pinpoints the problem slightly
-more. Could be certificates (file formats, paths, permissions), passwords, and
-others.
-.IP "CURLE_BAD_DOWNLOAD_RESUME (36)"
-The download could not be resumed because the specified offset was out of the
-file boundary.
-.IP "CURLE_FILE_COULDNT_READ_FILE (37)"
-A file given with FILE:// could not be opened. Most likely because the file
-path does not identify an existing file. Did you check file permissions?
-.IP "CURLE_LDAP_CANNOT_BIND (38)"
-LDAP cannot bind. LDAP bind operation failed.
-.IP "CURLE_LDAP_SEARCH_FAILED (39)"
-LDAP search failed.
-.IP "Obsolete error (40)"
-Not used in modern versions.
-.IP "CURLE_FUNCTION_NOT_FOUND (41)"
-Function not found. A required zlib function was not found.
-.IP "CURLE_ABORTED_BY_CALLBACK (42)"
-Aborted by callback. A callback returned "abort" to libcurl.
-.IP "CURLE_BAD_FUNCTION_ARGUMENT (43)"
-A function was called with a bad parameter.
-.IP "Obsolete error (44)"
-Not used in modern versions.
-.IP "CURLE_INTERFACE_FAILED (45)"
-Interface error. A specified outgoing interface could not be used. Set which
-interface to use for outgoing connections' source IP address with
-\fICURLOPT_INTERFACE(3)\fP.
-.IP "Obsolete error (46)"
-Not used in modern versions.
-.IP "CURLE_TOO_MANY_REDIRECTS (47)"
-Too many redirects. When following redirects, libcurl hit the maximum amount.
-Set your limit with \fICURLOPT_MAXREDIRS(3)\fP.
-.IP "CURLE_UNKNOWN_OPTION (48)"
-An option passed to libcurl is not recognized/known. Refer to the appropriate
-documentation. This is most likely a problem in the program that uses
-libcurl. The error buffer might contain more specific information about which
-exact option it concerns.
-.IP "CURLE_SETOPT_OPTION_SYNTAX (49)"
-An option passed in to a setopt was wrongly formatted. See error message for
-details about what option.
-.IP "Obsolete errors (50-51)"
-Not used in modern versions.
-.IP "CURLE_GOT_NOTHING (52)"
-Nothing was returned from the server, and under the circumstances, getting
-nothing is considered an error.
-.IP "CURLE_SSL_ENGINE_NOTFOUND (53)"
-The specified crypto engine was not found.
-.IP "CURLE_SSL_ENGINE_SETFAILED (54)"
-Failed setting the selected SSL crypto engine as default.
-.IP "CURLE_SEND_ERROR (55)"
-Failed sending network data.
-.IP "CURLE_RECV_ERROR (56)"
-Failure with receiving network data.
-.IP "Obsolete error (57)"
-Not used in modern versions.
-.IP "CURLE_SSL_CERTPROBLEM (58)"
-problem with the local client certificate.
-.IP "CURLE_SSL_CIPHER (59)"
-Could not use specified cipher.
-.IP "CURLE_PEER_FAILED_VERIFICATION (60)"
-The remote server's SSL certificate or SSH fingerprint was deemed not OK.
-This error code has been unified with CURLE_SSL_CACERT since 7.62.0. Its
-previous value was 51.
-.IP "CURLE_BAD_CONTENT_ENCODING (61)"
-Unrecognized transfer encoding.
-.IP "Obsolete error (62)"
-Not used in modern versions.
-.IP "CURLE_FILESIZE_EXCEEDED (63)"
-Maximum file size exceeded.
-.IP "CURLE_USE_SSL_FAILED (64)"
-Requested FTP SSL level failed.
-.IP "CURLE_SEND_FAIL_REWIND (65)"
-When doing a send operation curl had to rewind the data to retransmit, but the
-rewinding operation failed.
-.IP "CURLE_SSL_ENGINE_INITFAILED (66)"
-Initiating the SSL Engine failed.
-.IP "CURLE_LOGIN_DENIED (67)"
-The remote server denied curl to login (Added in 7.13.1)
-.IP "CURLE_TFTP_NOTFOUND (68)"
-File not found on TFTP server.
-.IP "CURLE_TFTP_PERM (69)"
-Permission problem on TFTP server.
-.IP "CURLE_REMOTE_DISK_FULL (70)"
-Out of disk space on the server.
-.IP "CURLE_TFTP_ILLEGAL (71)"
-Illegal TFTP operation.
-.IP "CURLE_TFTP_UNKNOWNID (72)"
-Unknown TFTP transfer ID.
-.IP "CURLE_REMOTE_FILE_EXISTS (73)"
-File already exists and is not overwritten.
-.IP "CURLE_TFTP_NOSUCHUSER (74)"
-This error should never be returned by a properly functioning TFTP server.
-.IP "Obsolete error (75-76)"
-Not used in modern versions.
-.IP "CURLE_SSL_CACERT_BADFILE (77)"
-Problem with reading the SSL CA cert (path? access rights?)
-.IP "CURLE_REMOTE_FILE_NOT_FOUND (78)"
-The resource referenced in the URL does not exist.
-.IP "CURLE_SSH (79)"
-An unspecified error occurred during the SSH session.
-.IP "CURLE_SSL_SHUTDOWN_FAILED (80)"
-Failed to shut down the SSL connection.
-.IP "CURLE_AGAIN (81)"
-Socket is not ready for send/recv wait till it's ready and try again. This
-return code is only returned from \fIcurl_easy_recv(3)\fP and
-\fIcurl_easy_send(3)\fP (Added in 7.18.2)
-.IP "CURLE_SSL_CRL_BADFILE (82)"
-Failed to load CRL file (Added in 7.19.0)
-.IP "CURLE_SSL_ISSUER_ERROR (83)"
-Issuer check failed (Added in 7.19.0)
-.IP "CURLE_FTP_PRET_FAILED (84)"
-The FTP server does not understand the PRET command at all or does not support
-the given argument. Be careful when using \fICURLOPT_CUSTOMREQUEST(3)\fP, a
-custom LIST command is sent with the PRET command before PASV as well. (Added
-in 7.20.0)
-.IP "CURLE_RTSP_CSEQ_ERROR (85)"
-Mismatch of RTSP CSeq numbers.
-.IP "CURLE_RTSP_SESSION_ERROR (86)"
-Mismatch of RTSP Session Identifiers.
-.IP "CURLE_FTP_BAD_FILE_LIST (87)"
-Unable to parse FTP file list (during FTP wildcard downloading).
-.IP "CURLE_CHUNK_FAILED (88)"
-Chunk callback reported error.
-.IP "CURLE_NO_CONNECTION_AVAILABLE (89)"
-(For internal use only, is never returned by libcurl) No connection available,
-the session is queued. (added in 7.30.0)
-.IP "CURLE_SSL_PINNEDPUBKEYNOTMATCH (90)"
-Failed to match the pinned key specified with \fICURLOPT_PINNEDPUBLICKEY(3)\fP.
-.IP "CURLE_SSL_INVALIDCERTSTATUS (91)"
-Status returned failure when asked with \fICURLOPT_SSL_VERIFYSTATUS(3)\fP.
-.IP "CURLE_HTTP2_STREAM (92)"
-Stream error in the HTTP/2 framing layer.
-.IP "CURLE_RECURSIVE_API_CALL (93)"
-An API function was called from inside a callback.
-.IP "CURLE_AUTH_ERROR (94)"
-An authentication function returned an error.
-.IP "CURLE_HTTP3 (95)"
-A problem was detected in the HTTP/3 layer. This is somewhat generic and can
-be one out of several problems, see the error buffer for details.
-.IP "CURLE_QUIC_CONNECT_ERROR (96)"
-QUIC connection error. This error may be caused by an SSL library error. QUIC
-is the protocol used for HTTP/3 transfers.
-.IP "CURLE_PROXY (97)"
-Proxy handshake error. \fICURLINFO_PROXY_ERROR(3)\fP provides extra details on
-the specific problem.
-.IP "CURLE_SSL_CLIENTCERT (98)"
-SSL Client Certificate required.
-.IP "CURLE_UNRECOVERABLE_POLL (99)"
-An internal call to poll() or select() returned error that is not recoverable.
-.IP "CURLE_OBSOLETE*"
-These error codes are never returned. They were used in an old libcurl version
-and are currently unused.
-.SH "CURLMcode"
-This is the generic return code used by functions in the libcurl multi
-interface. Also consider \fIcurl_multi_strerror(3)\fP.
-.IP "CURLM_CALL_MULTI_PERFORM (-1)"
-This is not really an error. It means you should call
-\fIcurl_multi_perform(3)\fP again without doing select() or similar in
-between. Before version 7.20.0 (released on February 9 2010) this could be returned by
-\fIcurl_multi_perform(3)\fP, but in later versions this return code is never
-used.
-.IP "CURLM_CALL_MULTI_SOCKET (-1)"
-An alias for \fICURLM_CALL_MULTI_PERFORM\fP. Never returned by modern libcurl
-versions.
-.IP "CURLM_OK (0)"
-Things are fine.
-.IP "CURLM_BAD_HANDLE (1)"
-The passed-in handle is not a valid \fICURLM\fP handle.
-.IP "CURLM_BAD_EASY_HANDLE (2)"
-An easy handle was not good/valid. It could mean that it is not an easy handle
-at all, or possibly that the handle already is in use by this or another multi
-handle.
-.IP "CURLM_OUT_OF_MEMORY (3)"
-You are doomed.
-.IP "CURLM_INTERNAL_ERROR (4)"
-This can only be returned if libcurl bugs. Please report it to us!
-.IP "CURLM_BAD_SOCKET (5)"
-The passed-in socket is not a valid one that libcurl already knows about.
-(Added in 7.15.4)
-.IP "CURLM_UNKNOWN_OPTION (6)"
-curl_multi_setopt() with unsupported option
-(Added in 7.15.4)
-.IP "CURLM_ADDED_ALREADY (7)"
-An easy handle already added to a multi handle was attempted to get added a
-second time. (Added in 7.32.1)
-.IP "CURLM_RECURSIVE_API_CALL (8)"
-An API function was called from inside a callback.
-.IP "CURLM_WAKEUP_FAILURE (9)"
-Wake up is unavailable or failed.
-.IP "CURLM_BAD_FUNCTION_ARGUMENT (10)"
-A function was called with a bad parameter.
-.IP "CURLM_ABORTED_BY_CALLBACK (11)"
-A multi handle callback returned error.
-.IP "CURLM_UNRECOVERABLE_POLL (12)"
-An internal call to poll() or select() returned error that is not recoverable.
-.SH "CURLSHcode"
-The "share" interface returns a \fBCURLSHcode\fP to indicate when an error has
-occurred. Also consider \fIcurl_share_strerror(3)\fP.
-.IP "CURLSHE_OK (0)"
-All fine. Proceed as usual.
-.IP "CURLSHE_BAD_OPTION (1)"
-An invalid option was passed to the function.
-.IP "CURLSHE_IN_USE (2)"
-The share object is currently in use.
-.IP "CURLSHE_INVALID (3)"
-An invalid share object was passed to the function.
-.IP "CURLSHE_NOMEM (4)"
-Not enough memory was available.
-(Added in 7.12.0)
-.IP "CURLSHE_NOT_BUILT_IN (5)"
-The requested sharing could not be done because the library you use do not have
-that particular feature enabled. (Added in 7.23.0)
-.SH "CURLUcode"
-The URL interface returns a \fICURLUcode\fP to indicate when an error has
-occurred. Also consider \fIcurl_url_strerror(3)\fP.
-.IP "CURLUE_OK (0)"
-All fine. Proceed as usual.
-.IP "CURLUE_BAD_HANDLE (1)"
-An invalid URL handle was passed as argument.
-.IP "CURLUE_BAD_PARTPOINTER (2)"
-An invalid 'part' argument was passed as argument.
-.IP "CURLUE_MALFORMED_INPUT (3)"
-A malformed input was passed to a URL API function.
-.IP "CURLUE_BAD_PORT_NUMBER (4)"
-The port number was not a decimal number between 0 and 65535.
-.IP "CURLUE_UNSUPPORTED_SCHEME (5)"
-This libcurl build does not support the given URL scheme.
-.IP "CURLUE_URLDECODE (6)"
-URL decode error, most likely because of rubbish in the input.
-.IP "CURLUE_OUT_OF_MEMORY (7)"
-A memory function failed.
-.IP "CURLUE_USER_NOT_ALLOWED (8)"
-Credentials was passed in the URL when prohibited.
-.IP "CURLUE_UNKNOWN_PART (9)"
-An unknown part ID was passed to a URL API function.
-.IP "CURLUE_NO_SCHEME (10)"
-There is no scheme part in the URL.
-.IP "CURLUE_NO_USER (11)"
-There is no user part in the URL.
-.IP "CURLUE_NO_PASSWORD (12)"
-There is no password part in the URL.
-.IP "CURLUE_NO_OPTIONS (13)"
-There is no options part in the URL.
-.IP "CURLUE_NO_HOST (14)"
-There is no host part in the URL.
-.IP "CURLUE_NO_PORT (15)"
-There is no port part in the URL.
-.IP "CURLUE_NO_QUERY (16)"
-There is no query part in the URL.
-.IP "CURLUE_NO_FRAGMENT (17)"
-There is no fragment part in the URL.
-.IP "CURLUE_NO_ZONEID (18)"
-There is no zone id set in the URL.
-.IP "CURLUE_BAD_FILE_URL (19)"
-The file:// URL is invalid.
-.IP "CURLUE_BAD_FRAGMENT (20)"
-The fragment part of the URL contained bad or invalid characters.
-.IP "CURLUE_BAD_HOSTNAME (21)"
-The hostname contained bad or invalid characters.
-.IP "CURLUE_BAD_IPV6 (22)"
-The IPv6 address hostname contained bad or invalid characters.
-.IP "CURLUE_BAD_LOGIN (23)"
-The login part of the URL contained bad or invalid characters.
-.IP "CURLUE_BAD_PASSWORD (24)"
-The password part of the URL contained bad or invalid characters.
-.IP "CURLUE_BAD_PATH (25)"
-The path part of the URL contained bad or invalid characters.
-.IP "CURLUE_BAD_QUERY (26)"
-The query part of the URL contained bad or invalid characters.
-.IP "CURLUE_BAD_SCHEME (27)"
-The scheme part of the URL contained bad or invalid characters.
-.IP "CURLUE_BAD_SLASHES (28)"
-The URL contained an invalid number of slashes.
-.IP "CURLUE_BAD_USER (29)"
-The user part of the URL contained bad or invalid characters.
-.SH "CURLHcode"
-The header interface returns a \fICURLHcode\fP to indicate when an error has
-occurred.
-.IP "CURLHE_BADINDEX (1)"
-There is no header with the requested index.
-.IP "CURLHE_MISSING (2)"
-No such header exists.
-.IP "CURLHE_NOHEADERS (3)"
-No headers at all have been recorded.
-.IP "CURLHE_NOREQUEST (4)"
-There was no such request number.
-.IP "CURLHE_OUT_OF_MEMORY (5)"
-Out of resources
-.IP "CURLHE_BAD_ARGUMENT (6)"
-One or more of the given arguments are bad.
-.IP "CURLHE_NOT_BUILT_IN (7)"
-HTTP support or the header API has been disabled in the build.
-.SH "SEE ALSO"
-.BR curl_easy_strerror "(3), " curl_multi_strerror "(3), "
-.BR curl_share_strerror "(3), " curl_url_strerror "(3), "
-.BR CURLOPT_ERRORBUFFER "(3), " CURLOPT_VERBOSE "(3), "
-.BR CURLOPT_DEBUGFUNCTION "(3)"
diff --git a/third-party/curl/docs/libcurl/libcurl-errors.md b/third-party/curl/docs/libcurl/libcurl-errors.md
new file mode 100644
index 0000000000..c658361a79
--- /dev/null
+++ b/third-party/curl/docs/libcurl/libcurl-errors.md
@@ -0,0 +1,762 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: libcurl-errors
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DEBUGFUNCTION (3)
+  - CURLOPT_ERRORBUFFER (3)
+  - CURLOPT_VERBOSE (3)
+  - curl_easy_strerror (3)
+  - curl_multi_strerror (3)
+  - curl_share_strerror (3)
+  - curl_url_strerror (3)
+Protocol:
+  - All
+Added-in: n/a
+---
+
+# NAME
+
+libcurl-errors - error codes in libcurl
+
+# DESCRIPTION
+
+This man page includes most, if not all, available error codes in libcurl.
+Why they occur and possibly what you can do to fix the problem are also included.
+
+# CURLcode
+
+Almost all "easy" interface functions return a CURLcode error code. No matter
+what, using the curl_easy_setopt(3) option CURLOPT_ERRORBUFFER(3) is a good
+idea as it gives you a human readable error string that may offer more details
+about the cause of the error than the error code alone. curl_easy_strerror(3)
+can be called to get an error string from a given CURLcode number.
+
+CURLcode is one of the following:
+
+## CURLE_OK (0)
+
+All fine. Proceed as usual.
+
+## CURLE_UNSUPPORTED_PROTOCOL (1)
+
+The URL you passed to libcurl used a protocol that this libcurl does not
+support. The support might be a compile-time option that you did not use, it
+can be a misspelled protocol string or a protocol libcurl has no code for.
+
+## CURLE_FAILED_INIT (2)
+
+Early initialization code failed. This is likely to be an internal error or
+problem, or a resource problem where something fundamental could not get done
+at init time.
+
+## CURLE_URL_MALFORMAT (3)
+
+The URL was not properly formatted.
+
+## CURLE_NOT_BUILT_IN (4)
+
+A requested feature, protocol or option was not found built into this libcurl
+due to a build-time decision. This means that a feature or option was not
+enabled or explicitly disabled when libcurl was built and in order to get it
+to function you have to get a rebuilt libcurl.
+
+## CURLE_COULDNT_RESOLVE_PROXY (5)
+
+Could not resolve proxy. The given proxy host could not be resolved.
+
+## CURLE_COULDNT_RESOLVE_HOST (6)
+
+Could not resolve host. The given remote host was not resolved.
+
+## CURLE_COULDNT_CONNECT (7)
+
+Failed to connect() to host or proxy.
+
+## CURLE_WEIRD_SERVER_REPLY (8)
+
+The server sent data libcurl could not parse. This error code was known as
+*CURLE_FTP_WEIRD_SERVER_REPLY* before 7.51.0.
+
+## CURLE_REMOTE_ACCESS_DENIED (9)
+
+We were denied access to the resource given in the URL. For FTP, this occurs
+while trying to change to the remote directory.
+
+## CURLE_FTP_ACCEPT_FAILED (10)
+
+While waiting for the server to connect back when an active FTP session is
+used, an error code was sent over the control connection or similar.
+
+## CURLE_FTP_WEIRD_PASS_REPLY (11)
+
+After having sent the FTP password to the server, libcurl expects a proper
+reply. This error code indicates that an unexpected code was returned.
+
+## CURLE_FTP_ACCEPT_TIMEOUT (12)
+
+During an active FTP session while waiting for the server to connect, the
+CURLOPT_ACCEPTTIMEOUT_MS(3) (or the internal default) timeout expired.
+
+## CURLE_FTP_WEIRD_PASV_REPLY (13)
+
+libcurl failed to get a sensible result back from the server as a response to
+either a PASV or an EPSV command. The server is flawed.
+
+## CURLE_FTP_WEIRD_227_FORMAT (14)
+
+FTP servers return a 227-line as a response to a PASV command. If libcurl
+fails to parse that line, this return code is passed back.
+
+## CURLE_FTP_CANT_GET_HOST (15)
+
+An internal failure to lookup the host used for the new connection.
+
+## CURLE_HTTP2 (16)
+
+A problem was detected in the HTTP2 framing layer. This is somewhat generic
+and can be one out of several problems, see the error buffer for details.
+
+## CURLE_FTP_COULDNT_SET_TYPE (17)
+
+Received an error when trying to set the transfer mode to binary or ASCII.
+
+## CURLE_PARTIAL_FILE (18)
+
+A file transfer was shorter or larger than expected. This happens when the
+server first reports an expected transfer size, and then delivers data that
+does not match the previously given size.
+
+## CURLE_FTP_COULDNT_RETR_FILE (19)
+
+This was either a weird reply to a 'RETR' command or a zero byte transfer
+complete.
+
+## Obsolete error (20)
+
+Not used in modern versions.
+
+## CURLE_QUOTE_ERROR (21)
+
+When sending custom "QUOTE" commands to the remote server, one of the commands
+returned an error code that was 400 or higher (for FTP) or otherwise
+indicated unsuccessful completion of the command.
+
+## CURLE_HTTP_RETURNED_ERROR (22)
+
+This is returned if CURLOPT_FAILONERROR(3) is set TRUE and the HTTP server
+returns an error code that is \>= 400.
+
+## CURLE_WRITE_ERROR (23)
+
+An error occurred when writing received data to a local file, or an error was
+returned to libcurl from a write callback.
+
+## Obsolete error (24)
+
+Not used in modern versions.
+
+## CURLE_UPLOAD_FAILED (25)
+
+Failed starting the upload. For FTP, the server typically denied the STOR
+command. The error buffer usually contains the server's explanation for this.
+
+## CURLE_READ_ERROR (26)
+
+There was a problem reading a local file or an error returned by the read
+callback.
+
+## CURLE_OUT_OF_MEMORY (27)
+
+A memory allocation request failed. This is serious badness and
+things are severely screwed up if this ever occurs.
+
+## CURLE_OPERATION_TIMEDOUT (28)
+
+Operation timeout. The specified time-out period was reached according to the
+conditions.
+
+## Obsolete error (29)
+
+Not used in modern versions.
+
+## CURLE_FTP_PORT_FAILED (30)
+
+The FTP PORT command returned error. This mostly happens when you have not
+specified a good enough address for libcurl to use. See
+CURLOPT_FTPPORT(3).
+
+## CURLE_FTP_COULDNT_USE_REST (31)
+
+The FTP REST command returned error. This should never happen if the server is
+sane.
+
+## Obsolete error (32)
+
+Not used in modern versions.
+
+## CURLE_RANGE_ERROR (33)
+
+The server does not support or accept range requests.
+
+## Obsolete error (34)
+
+Not used since 7.56.0.
+
+## CURLE_SSL_CONNECT_ERROR (35)
+
+A problem occurred somewhere in the SSL/TLS handshake. You really want the
+error buffer and read the message there as it pinpoints the problem slightly
+more. Could be certificates (file formats, paths, permissions), passwords, and
+others.
+
+## CURLE_BAD_DOWNLOAD_RESUME (36)
+
+The download could not be resumed because the specified offset was out of the
+file boundary.
+
+## CURLE_FILE_COULDNT_READ_FILE (37)
+
+A file given with `file://` could not be opened. Most likely because the file
+path does not identify an existing file. Did you check file permissions?
+
+## CURLE_LDAP_CANNOT_BIND (38)
+
+LDAP cannot bind. LDAP bind operation failed.
+
+## CURLE_LDAP_SEARCH_FAILED (39)
+
+LDAP search failed.
+
+## Obsolete error (40)
+
+Not used in modern versions.
+
+## Obsolete error (41)
+
+Not used since 7.53.0.
+
+## CURLE_ABORTED_BY_CALLBACK (42)
+
+Aborted by callback. A callback returned "abort" to libcurl.
+
+## CURLE_BAD_FUNCTION_ARGUMENT (43)
+
+A function was called with a bad parameter.
+
+## Obsolete error (44)
+
+Not used in modern versions.
+
+## CURLE_INTERFACE_FAILED (45)
+
+Interface error. A specified outgoing interface could not be used. Set which
+interface to use for outgoing connections' source IP address with
+CURLOPT_INTERFACE(3).
+
+## Obsolete error (46)
+
+Not used in modern versions.
+
+## CURLE_TOO_MANY_REDIRECTS (47)
+
+Too many redirects. When following redirects, libcurl hit the maximum amount.
+Set your limit with CURLOPT_MAXREDIRS(3).
+
+## CURLE_UNKNOWN_OPTION (48)
+
+An option passed to libcurl is not recognized/known. Refer to the appropriate
+documentation. This is most likely a problem in the program that uses
+libcurl. The error buffer might contain more specific information about which
+exact option it concerns.
+
+## CURLE_SETOPT_OPTION_SYNTAX (49)
+
+An option passed in to a setopt was wrongly formatted. See error message for
+details about what option.
+
+## Obsolete errors (50-51)
+
+Not used in modern versions.
+
+## CURLE_GOT_NOTHING (52)
+
+Nothing was returned from the server, and under the circumstances, getting
+nothing is considered an error.
+
+## CURLE_SSL_ENGINE_NOTFOUND (53)
+
+The specified crypto engine was not found.
+
+## CURLE_SSL_ENGINE_SETFAILED (54)
+
+Failed setting the selected SSL crypto engine as default.
+
+## CURLE_SEND_ERROR (55)
+
+Failed sending network data.
+
+## CURLE_RECV_ERROR (56)
+
+Failure with receiving network data.
+
+## Obsolete error (57)
+
+Not used in modern versions.
+
+## CURLE_SSL_CERTPROBLEM (58)
+
+problem with the local client certificate.
+
+## CURLE_SSL_CIPHER (59)
+
+Could not use specified cipher.
+
+## CURLE_PEER_FAILED_VERIFICATION (60)
+
+The remote server's SSL certificate or SSH fingerprint was deemed not OK.
+This error code has been unified with CURLE_SSL_CACERT since 7.62.0. Its
+previous value was 51.
+
+## CURLE_BAD_CONTENT_ENCODING (61)
+
+Unrecognized transfer encoding.
+
+## Obsolete error (62)
+
+Not used in modern versions.
+
+## CURLE_FILESIZE_EXCEEDED (63)
+
+Maximum file size exceeded.
+
+## CURLE_USE_SSL_FAILED (64)
+
+Requested FTP SSL level failed.
+
+## CURLE_SEND_FAIL_REWIND (65)
+
+When doing a send operation curl had to rewind the data to retransmit, but the
+rewinding operation failed.
+
+## CURLE_SSL_ENGINE_INITFAILED (66)
+
+Initiating the SSL Engine failed.
+
+## CURLE_LOGIN_DENIED (67)
+
+The remote server denied curl to login
+
+## CURLE_TFTP_NOTFOUND (68)
+
+File not found on TFTP server.
+
+## CURLE_TFTP_PERM (69)
+
+Permission problem on TFTP server.
+
+## CURLE_REMOTE_DISK_FULL (70)
+
+Out of disk space on the server.
+
+## CURLE_TFTP_ILLEGAL (71)
+
+Illegal TFTP operation.
+
+## CURLE_TFTP_UNKNOWNID (72)
+
+Unknown TFTP transfer ID.
+
+## CURLE_REMOTE_FILE_EXISTS (73)
+
+File already exists and is not overwritten.
+
+## CURLE_TFTP_NOSUCHUSER (74)
+
+This error should never be returned by a properly functioning TFTP server.
+
+## Obsolete error (75-76)
+
+Not used in modern versions.
+
+## CURLE_SSL_CACERT_BADFILE (77)
+
+Problem with reading the SSL CA cert (path? access rights?)
+
+## CURLE_REMOTE_FILE_NOT_FOUND (78)
+
+The resource referenced in the URL does not exist.
+
+## CURLE_SSH (79)
+
+An unspecified error occurred during the SSH session.
+
+## CURLE_SSL_SHUTDOWN_FAILED (80)
+
+Failed to shut down the SSL connection.
+
+## CURLE_AGAIN (81)
+
+Socket is not ready for send/recv. Wait until it is ready and try again. This
+return code is only returned from curl_easy_recv(3) and curl_easy_send(3)
+
+## CURLE_SSL_CRL_BADFILE (82)
+
+Failed to load CRL file
+
+## CURLE_SSL_ISSUER_ERROR (83)
+
+Issuer check failed
+
+## CURLE_FTP_PRET_FAILED (84)
+
+The FTP server does not understand the PRET command at all or does not support
+the given argument. Be careful when using CURLOPT_CUSTOMREQUEST(3), a
+custom LIST command is sent with the PRET command before PASV as well.
+
+## CURLE_RTSP_CSEQ_ERROR (85)
+
+Mismatch of RTSP CSeq numbers.
+
+## CURLE_RTSP_SESSION_ERROR (86)
+
+Mismatch of RTSP Session Identifiers.
+
+## CURLE_FTP_BAD_FILE_LIST (87)
+
+Unable to parse FTP file list (during FTP wildcard downloading).
+
+## CURLE_CHUNK_FAILED (88)
+
+Chunk callback reported error.
+
+## CURLE_NO_CONNECTION_AVAILABLE (89)
+
+(For internal use only, is never returned by libcurl) No connection available,
+the session is queued.
+
+## CURLE_SSL_PINNEDPUBKEYNOTMATCH (90)
+
+Failed to match the pinned key specified with CURLOPT_PINNEDPUBLICKEY(3).
+
+## CURLE_SSL_INVALIDCERTSTATUS (91)
+
+Status returned failure when asked with CURLOPT_SSL_VERIFYSTATUS(3).
+
+## CURLE_HTTP2_STREAM (92)
+
+Stream error in the HTTP/2 framing layer.
+
+## CURLE_RECURSIVE_API_CALL (93)
+
+An API function was called from inside a callback.
+
+## CURLE_AUTH_ERROR (94)
+
+An authentication function returned an error.
+
+## CURLE_HTTP3 (95)
+
+A problem was detected in the HTTP/3 layer. This is somewhat generic and can
+be one out of several problems, see the error buffer for details.
+
+## CURLE_QUIC_CONNECT_ERROR (96)
+
+QUIC connection error. This error may be caused by an SSL library error. QUIC
+is the protocol used for HTTP/3 transfers.
+
+## CURLE_PROXY (97)
+
+Proxy handshake error. CURLINFO_PROXY_ERROR(3) provides extra details on
+the specific problem.
+
+## CURLE_SSL_CLIENTCERT (98)
+
+SSL Client Certificate required.
+
+## CURLE_UNRECOVERABLE_POLL (99)
+
+An internal call to poll() or select() returned error that is not recoverable.
+
+## CURLE_TOO_LARGE (100)
+
+A value or data field grew larger than allowed.
+
+## CURLE_ECH_REQUIRED (101)
+
+ECH was attempted but failed.
+
+# CURLMcode
+
+This is the generic return code used by functions in the libcurl multi
+interface. Also consider curl_multi_strerror(3).
+
+## CURLM_CALL_MULTI_PERFORM (-1)
+
+This is not really an error. It means you should call
+curl_multi_perform(3) again without doing select() or similar in
+between. Before version 7.20.0 (released on February 9 2010) this could be returned by
+curl_multi_perform(3), but in later versions this return code is never
+used.
+
+## CURLM_CALL_MULTI_SOCKET (-1)
+
+An alias for *CURLM_CALL_MULTI_PERFORM*. Never returned by modern libcurl
+versions.
+
+## CURLM_OK (0)
+
+Things are fine.
+
+## CURLM_BAD_HANDLE (1)
+
+The passed-in handle is not a valid *CURLM* handle.
+
+## CURLM_BAD_EASY_HANDLE (2)
+
+An easy handle was not good/valid. It could mean that it is not an easy handle
+at all, or possibly that the handle already is in use by this or another multi
+handle.
+
+## CURLM_OUT_OF_MEMORY (3)
+
+You are doomed.
+
+## CURLM_INTERNAL_ERROR (4)
+
+This can only be returned if libcurl bugs. Please report it to us.
+
+## CURLM_BAD_SOCKET (5)
+
+The passed-in socket is not a valid one that libcurl already knows about.
+
+## CURLM_UNKNOWN_OPTION (6)
+
+curl_multi_setopt() with unsupported option
+
+## CURLM_ADDED_ALREADY (7)
+
+An easy handle already added to a multi handle was attempted to get added a
+second time.
+
+## CURLM_RECURSIVE_API_CALL (8)
+
+An API function was called from inside a callback.
+
+## CURLM_WAKEUP_FAILURE (9)
+
+Wake up is unavailable or failed.
+
+## CURLM_BAD_FUNCTION_ARGUMENT (10)
+
+A function was called with a bad parameter.
+
+## CURLM_ABORTED_BY_CALLBACK (11)
+
+A multi handle callback returned error.
+
+## CURLM_UNRECOVERABLE_POLL (12)
+
+An internal call to poll() or select() returned error that is not recoverable.
+
+# CURLSHcode
+
+The "share" interface returns a **CURLSHcode** to indicate when an error has
+occurred. Also consider curl_share_strerror(3).
+
+## CURLSHE_OK (0)
+
+All fine. Proceed as usual.
+
+## CURLSHE_BAD_OPTION (1)
+
+An invalid option was passed to the function.
+
+## CURLSHE_IN_USE (2)
+
+The share object is currently in use.
+
+## CURLSHE_INVALID (3)
+
+An invalid share object was passed to the function.
+
+## CURLSHE_NOMEM (4)
+
+Not enough memory was available.
+
+## CURLSHE_NOT_BUILT_IN (5)
+
+The requested sharing could not be done because the library you use do not have
+that particular feature enabled.
+
+# CURLUcode
+
+The URL interface returns a *CURLUcode* to indicate when an error has
+occurred. Also consider curl_url_strerror(3).
+
+## CURLUE_OK (0)
+
+All fine. Proceed as usual.
+
+## CURLUE_BAD_HANDLE (1)
+
+An invalid URL handle was passed as argument.
+
+## CURLUE_BAD_PARTPOINTER (2)
+
+An invalid 'part' argument was passed as argument.
+
+## CURLUE_MALFORMED_INPUT (3)
+
+A malformed input was passed to a URL API function.
+
+## CURLUE_BAD_PORT_NUMBER (4)
+
+The port number was not a decimal number between 0 and 65535.
+
+## CURLUE_UNSUPPORTED_SCHEME (5)
+
+This libcurl build does not support the given URL scheme.
+
+## CURLUE_URLDECODE (6)
+
+URL decode error, most likely because of rubbish in the input.
+
+## CURLUE_OUT_OF_MEMORY (7)
+
+A memory function failed.
+
+## CURLUE_USER_NOT_ALLOWED (8)
+
+Credentials was passed in the URL when prohibited.
+
+## CURLUE_UNKNOWN_PART (9)
+
+An unknown part ID was passed to a URL API function.
+
+## CURLUE_NO_SCHEME (10)
+
+There is no scheme part in the URL.
+
+## CURLUE_NO_USER (11)
+
+There is no user part in the URL.
+
+## CURLUE_NO_PASSWORD (12)
+
+There is no password part in the URL.
+
+## CURLUE_NO_OPTIONS (13)
+
+There is no options part in the URL.
+
+## CURLUE_NO_HOST (14)
+
+There is no host part in the URL.
+
+## CURLUE_NO_PORT (15)
+
+There is no port part in the URL.
+
+## CURLUE_NO_QUERY (16)
+
+There is no query part in the URL.
+
+## CURLUE_NO_FRAGMENT (17)
+
+There is no fragment part in the URL.
+
+## CURLUE_NO_ZONEID (18)
+
+There is no zone id set in the URL.
+
+## CURLUE_BAD_FILE_URL (19)
+
+The `file://` URL is invalid.
+
+## CURLUE_BAD_FRAGMENT (20)
+
+The fragment part of the URL contained bad or invalid characters.
+
+## CURLUE_BAD_HOSTNAME (21)
+
+The hostname contained bad or invalid characters.
+
+## CURLUE_BAD_IPV6 (22)
+
+The IPv6 address hostname contained bad or invalid characters.
+
+## CURLUE_BAD_LOGIN (23)
+
+The login part of the URL contained bad or invalid characters.
+
+## CURLUE_BAD_PASSWORD (24)
+
+The password part of the URL contained bad or invalid characters.
+
+## CURLUE_BAD_PATH (25)
+
+The path part of the URL contained bad or invalid characters.
+
+## CURLUE_BAD_QUERY (26)
+
+The query part of the URL contained bad or invalid characters.
+
+## CURLUE_BAD_SCHEME (27)
+
+The scheme part of the URL contained bad or invalid characters.
+
+## CURLUE_BAD_SLASHES (28)
+
+The URL contained an invalid number of slashes.
+
+## CURLUE_BAD_USER (29)
+
+The user part of the URL contained bad or invalid characters.
+
+## CURLUE_LACKS_IDN (30)
+
+libcurl lacks IDN support.
+
+## CURLUE_TOO_LARGE (31)
+
+A value or data field is larger than allowed.
+
+# CURLHcode
+
+The header interface returns a *CURLHcode* to indicate when an error has
+occurred.
+
+## CURLHE_OK (0)
+
+All fine. Proceed as usual.
+
+## CURLHE_BADINDEX (1)
+
+There is no header with the requested index.
+
+## CURLHE_MISSING (2)
+
+No such header exists.
+
+## CURLHE_NOHEADERS (3)
+
+No headers at all have been recorded.
+
+## CURLHE_NOREQUEST (4)
+
+There was no such request number.
+
+## CURLHE_OUT_OF_MEMORY (5)
+
+Out of resources
+
+## CURLHE_BAD_ARGUMENT (6)
+
+One or more of the given arguments are bad.
+
+## CURLHE_NOT_BUILT_IN (7)
+
+HTTP support or the header API has been disabled in the build.
diff --git a/third-party/curl/docs/libcurl/libcurl-multi.3 b/third-party/curl/docs/libcurl/libcurl-multi.3
deleted file mode 100644
index 24751bc9e0..0000000000
--- a/third-party/curl/docs/libcurl/libcurl-multi.3
+++ /dev/null
@@ -1,182 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH libcurl-multi 3 "19 Sep 2014" "libcurl" "libcurl"
-.SH NAME
-libcurl-multi \- how to use the multi interface
-.SH DESCRIPTION
-This is an overview on how to use the libcurl multi interface in your C
-programs. There are specific man pages for each function mentioned in
-here. There is also the \fIlibcurl-tutorial(3)\fP man page for a complete
-tutorial to programming with libcurl and the \fIlibcurl-easy(3)\fP man page
-for an overview of the libcurl easy interface.
-
-All functions in the multi interface are prefixed with curl_multi.
-.SH "OBJECTIVES"
-The multi interface offers several abilities that the easy interface does not.
-They are mainly:
-
-1. Enable a "pull" interface. The application that uses libcurl decides where
-and when to ask libcurl to get/send data.
-
-2. Enable multiple simultaneous transfers in the same thread without making it
-complicated for the application.
-
-3. Enable the application to wait for action on its own file descriptors and
-curl's file descriptors simultaneously.
-
-4. Enable event-based handling and scaling transfers up to and beyond
-thousands of parallel connections.
-.SH "ONE MULTI HANDLE MANY EASY HANDLES"
-To use the multi interface, you must first create a 'multi handle' with
-\fIcurl_multi_init(3)\fP. This handle is then used as input to all further
-curl_multi_* functions.
-
-With a multi handle and the multi interface you can do several simultaneous
-transfers in parallel. Each single transfer is built up around an easy
-handle. You create all the easy handles you need, and setup the appropriate
-options for each easy handle using \fIcurl_easy_setopt(3)\fP.
-
-There are two flavors of the multi interface, the select() oriented one and
-the event based one we call multi_socket. You benefit from reading through the
-description of both versions to fully understand how they work and
-differentiate. We start out with the select() oriented version.
-
-When an easy handle is setup and ready for transfer, then instead of using
-\fIcurl_easy_perform(3)\fP like when using the easy interface for transfers,
-you should add the easy handle to the multi handle with
-\fIcurl_multi_add_handle(3)\fP. You can add more easy handles to a multi
-handle at any point, even if other transfers are already running.
-
-Should you change your mind, the easy handle is again removed from the multi
-stack using \fIcurl_multi_remove_handle(3)\fP. Once removed from the multi
-handle, you can again use other easy interface functions like
-\fIcurl_easy_perform(3)\fP on the handle or whatever you think is
-necessary. You can remove handles at any point during transfers.
-
-Adding the easy handle to the multi handle does not start the transfer.
-Remember that one of the main ideas with this interface is to let your
-application drive. You drive the transfers by invoking
-\fIcurl_multi_perform(3)\fP. libcurl then transfers data if there is anything
-available to transfer. It uses the callbacks and everything else you have
-setup in the individual easy handles. It transfers data on all current
-transfers in the multi stack that are ready to transfer anything. It may be
-all, it may be none. When there is nothing more to do for now, it returns back
-to the calling application.
-
-Your application extracts info from libcurl about when it would like to get
-invoked to transfer data or do other work. The most convenient way is to use
-\fIcurl_multi_poll(3)\fP that helps you wait until the application should call
-libcurl again. The older API to accomplish the same thing is
-\fIcurl_multi_fdset(3)\fP that extracts \fIfd_sets\fP from libcurl to use in
-select() or poll() calls in order to get to know when the transfers in the
-multi stack might need attention. Both these APIs allow for your program to
-wait for input on your own private file descriptors at the same time.
-\fIcurl_multi_timeout(3)\fP also helps you with providing a suitable timeout
-period for your select() calls.
-
-\fIcurl_multi_perform(3)\fP stores the number of still running transfers in
-one of its input arguments, and by reading that you can figure out when all
-the transfers in the multi handles are done. 'done' does not mean
-successful. One or more of the transfers may have failed.
-
-To get information about completed transfers, to figure out success or not and
-similar, \fIcurl_multi_info_read(3)\fP should be called. It can return a
-message about a current or previous transfer. Repeated invokes of the function
-get more messages until the message queue is empty. The information you
-receive there includes an easy handle pointer which you may use to identify
-which easy handle the information regards.
-
-When a single transfer is completed, the easy handle is still left added to
-the multi stack. You need to first remove the easy handle with
-\fIcurl_multi_remove_handle(3)\fP and then close it with
-\fIcurl_easy_cleanup(3)\fP, or possibly set new options to it and add it again
-with \fIcurl_multi_add_handle(3)\fP to start another transfer.
-
-When all transfers in the multi stack are done, close the multi handle with
-\fIcurl_multi_cleanup(3)\fP. Be careful and please note that you \fBMUST\fP
-invoke separate \fIcurl_easy_cleanup(3)\fP calls for every single easy handle
-to clean them up properly.
-
-If you want to reuse an easy handle that was added to the multi handle for
-transfer, you must first remove it from the multi stack and then re-add it
-again (possibly after having altered some options at your own choice).
-.SH "MULTI_SOCKET"
-\fIcurl_multi_socket_action(3)\fP function offers a way for applications to
-not only avoid being forced to use select(), but it also offers a much more
-high-performance API that makes a significant difference for applications
-using large numbers of simultaneous connections.
-
-\fIcurl_multi_socket_action(3)\fP is then used instead of
-\fIcurl_multi_perform(3)\fP.
-
-When using this API, you add easy handles to the multi handle just as with the
-normal multi interface. Then you also set two callbacks with the
-\fICURLMOPT_SOCKETFUNCTION(3)\fP and \fICURLMOPT_TIMERFUNCTION(3)\fP options
-to \fIcurl_multi_setopt(3)\fP. They are two callback functions that libcurl
-calls with information about what sockets to wait for, and for what activity,
-and what the current timeout time is - if that expires libcurl should be
-notified.
-
-The multi_socket API is designed to inform your application about which
-sockets libcurl is currently using and for what activities (read and/or write)
-on those sockets your application is expected to wait for.
-
-Your application must make sure to receive all sockets informed about in the
-\fICURLMOPT_SOCKETFUNCTION(3)\fP callback and make sure it reacts on the given
-activity on them. When a socket has the given activity, you call
-\fIcurl_multi_socket_action(3)\fP specifying which socket and action there
-are.
-
-The \fICURLMOPT_TIMERFUNCTION(3)\fP callback is called to set a timeout. When
-that timeout expires, your application should call the
-\fIcurl_multi_socket_action(3)\fP function saying it was due to a timeout.
-
-This API is typically used with an event-driven underlying functionality (like
-libevent, libev, kqueue, epoll or similar) with which the application
-"subscribes" on socket changes. This allows applications and libcurl to much
-better scale upward and beyond thousands of simultaneous transfers without
-losing performance.
-
-When you have added your initial set of handles, you call
-\fIcurl_multi_socket_action(3)\fP with CURL_SOCKET_TIMEOUT set in the
-\fIsockfd\fP argument, and you get callbacks invoked that set you up and you
-then continue to call \fIcurl_multi_socket_action(3)\fP accordingly when you
-get activity on the sockets you have been asked to wait on, or if the timeout
-timer expires.
-
-You can poll \fIcurl_multi_info_read(3)\fP to see if any transfer has
-completed, as it then has a message saying so.
-.SH "BLOCKING"
-A few areas in the code are still using blocking code, even when used from the
-multi interface. While we certainly want and intend for these to get fixed in
-the future, you should be aware of the following current restrictions:
-
-.nf
- - Name resolves unless the c-ares or threaded-resolver backends are used
- - file:// transfers
- - TELNET transfers
-.fi
-.SH "SEE ALSO"
-.BR libcurl-errors "(3), " libcurl-easy "(3), " libcurl "(3) "
diff --git a/third-party/curl/docs/libcurl/libcurl-multi.md b/third-party/curl/docs/libcurl/libcurl-multi.md
new file mode 100644
index 0000000000..da1331fae8
--- /dev/null
+++ b/third-party/curl/docs/libcurl/libcurl-multi.md
@@ -0,0 +1,180 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: libcurl-multi
+Section: 3
+Source: libcurl
+See-also:
+  - libcurl (3)
+  - libcurl-easy (3)
+  - libcurl-errors (3)
+Protocol:
+  - All
+Added-in: 7.9.6
+---
+
+# NAME
+
+libcurl-multi - how to use the multi interface
+
+# DESCRIPTION
+
+This is an overview on how to use the libcurl multi interface in your C
+programs. There are specific man pages for each function mentioned in
+here. There is also the libcurl-tutorial(3) man page for a complete
+tutorial to programming with libcurl and the libcurl-easy(3) man page
+for an overview of the libcurl easy interface.
+
+All functions in the multi interface are prefixed with curl_multi.
+
+# OBJECTIVES
+
+The multi interface offers several abilities that the easy interface does not.
+They are mainly:
+
+1. Enable a "pull" interface. The application that uses libcurl decides where
+and when to ask libcurl to get/send data.
+
+2. Enable multiple simultaneous transfers in the same thread without making it
+complicated for the application.
+
+3. Enable the application to wait for action on its own file descriptors and
+curl's file descriptors simultaneously.
+
+4. Enable event-based handling and scaling transfers up to and beyond
+thousands of parallel connections.
+
+# ONE MULTI HANDLE MANY EASY HANDLES
+
+To use the multi interface, you must first create a 'multi handle' with
+curl_multi_init(3). This handle is then used as input to all further
+curl_multi_* functions.
+
+With a multi handle and the multi interface you can do several simultaneous
+transfers in parallel. Each single transfer is built up around an easy
+handle. You create all the easy handles you need, and setup the appropriate
+options for each easy handle using curl_easy_setopt(3).
+
+There are two flavors of the multi interface, the select() oriented one and
+the event based one we call multi_socket. You benefit from reading through the
+description of both versions to fully understand how they work and
+differentiate. We start out with the select() oriented version.
+
+When an easy handle is setup and ready for transfer, then instead of using
+curl_easy_perform(3) like when using the easy interface for transfers,
+you should add the easy handle to the multi handle with
+curl_multi_add_handle(3). You can add more easy handles to a multi
+handle at any point, even if other transfers are already running.
+
+Should you change your mind, the easy handle is again removed from the multi
+stack using curl_multi_remove_handle(3). Once removed from the multi
+handle, you can again use other easy interface functions like
+curl_easy_perform(3) on the handle or whatever you think is
+necessary. You can remove handles at any point during transfers.
+
+Adding the easy handle to the multi handle does not start the transfer.
+Remember that one of the main ideas with this interface is to let your
+application drive. You drive the transfers by invoking
+curl_multi_perform(3). libcurl then transfers data if there is anything
+available to transfer. It uses the callbacks and everything else you have
+setup in the individual easy handles. It transfers data on all current
+transfers in the multi stack that are ready to transfer anything. It may be
+all, it may be none. When there is nothing more to do for now, it returns back
+to the calling application.
+
+Your application extracts info from libcurl about when it would like to get
+invoked to transfer data or do other work. The most convenient way is to use
+curl_multi_poll(3) that helps you wait until the application should call
+libcurl again. The older API to accomplish the same thing is
+curl_multi_fdset(3) that extracts *fd_sets* from libcurl to use in
+select() or poll() calls in order to get to know when the transfers in the
+multi stack might need attention. Both these APIs allow for your program to
+wait for input on your own private file descriptors at the same time.
+curl_multi_timeout(3) also helps you with providing a suitable timeout
+period for your select() calls.
+
+curl_multi_perform(3) stores the number of still running transfers in
+one of its input arguments, and by reading that you can figure out when all
+the transfers in the multi handles are done. 'done' does not mean
+successful. One or more of the transfers may have failed.
+
+To get information about completed transfers, to figure out success or not and
+similar, curl_multi_info_read(3) should be called. It can return a
+message about a current or previous transfer. Repeated invokes of the function
+get more messages until the message queue is empty. The information you
+receive there includes an easy handle pointer which you may use to identify
+which easy handle the information regards.
+
+When a single transfer is completed, the easy handle is still left added to
+the multi stack. You need to first remove the easy handle with
+curl_multi_remove_handle(3) and then close it with
+curl_easy_cleanup(3), or possibly set new options to it and add it again
+with curl_multi_add_handle(3) to start another transfer.
+
+When all transfers in the multi stack are done, close the multi handle with
+curl_multi_cleanup(3). Be careful and please note that you **MUST**
+invoke separate curl_easy_cleanup(3) calls for every single easy handle
+to clean them up properly.
+
+If you want to reuse an easy handle that was added to the multi handle for
+transfer, you must first remove it from the multi stack and then re-add it
+again (possibly after having altered some options at your own choice).
+
+# MULTI_SOCKET
+
+curl_multi_socket_action(3) function offers a way for applications to
+not only avoid being forced to use select(), but it also offers a much more
+high-performance API that makes a significant difference for applications
+using large numbers of simultaneous connections.
+
+curl_multi_socket_action(3) is then used instead of
+curl_multi_perform(3).
+
+When using this API, you add easy handles to the multi handle like with the
+normal multi interface. Then you also set two callbacks with the
+CURLMOPT_SOCKETFUNCTION(3) and CURLMOPT_TIMERFUNCTION(3) options to
+curl_multi_setopt(3). They are two callback functions that libcurl calls with
+information about what sockets to wait for, and for what activity, and what
+the current timeout time is - if that expires libcurl should be notified.
+
+The multi_socket API is designed to inform your application about which
+sockets libcurl is currently using and for what activities (read and/or write)
+on those sockets your application is expected to wait for.
+
+Your application must make sure to receive all sockets informed about in the
+CURLMOPT_SOCKETFUNCTION(3) callback and make sure it reacts on the given
+activity on them. When a socket has the given activity, you call
+curl_multi_socket_action(3) specifying which socket and action there
+are.
+
+The CURLMOPT_TIMERFUNCTION(3) callback is called to set a timeout. When
+that timeout expires, your application should call the
+curl_multi_socket_action(3) function saying it was due to a timeout.
+
+This API is typically used with an event-driven underlying functionality (like
+libevent, libev, kqueue, epoll or similar) with which the application
+"subscribes" on socket changes. This allows applications and libcurl to much
+better scale upward and beyond thousands of simultaneous transfers without
+losing performance.
+
+When you have added your initial set of handles, you call
+curl_multi_socket_action(3) with CURL_SOCKET_TIMEOUT set in the
+*sockfd* argument, and you get callbacks invoked that set you up and you
+then continue to call curl_multi_socket_action(3) accordingly when you
+get activity on the sockets you have been asked to wait on, or if the timeout
+timer expires.
+
+You can poll curl_multi_info_read(3) to see if any transfer has
+completed, as it then has a message saying so. To know how many transfers are
+currently queued, running, pending or done, you can use the
+curl_multi_get_offt(3) function.
+
+# BLOCKING
+
+A few areas in the code are still using blocking code, even when used from the
+multi interface. While we certainly want and intend for these to get fixed in
+the future, you should be aware of the following current restrictions:
+
+- Name resolves unless the c-ares or threaded-resolver backends are used
+- `file://` transfers
+- TELNET transfers
diff --git a/third-party/curl/docs/libcurl/libcurl-security.3 b/third-party/curl/docs/libcurl/libcurl-security.3
deleted file mode 100644
index 0bc056c5fb..0000000000
--- a/third-party/curl/docs/libcurl/libcurl-security.3
+++ /dev/null
@@ -1,426 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH libcurl-security 3 "13 Feb 2018" "libcurl" "libcurl"
-.SH NAME
-libcurl-security \- security considerations when using libcurl
-.SH "Security"
-The libcurl project takes security seriously. The library is written with
-caution and precautions are taken to mitigate many kinds of risks encountered
-while operating with potentially malicious servers on the Internet. It is a
-powerful library, however, which allows application writers to make trade-offs
-between ease of writing and exposure to potential risky operations. If used
-the right way, you can use libcurl to transfer data pretty safely.
-
-Many applications are used in closed networks where users and servers can
-(possibly) be trusted, but many others are used on arbitrary servers and are
-fed input from potentially untrusted users. Following is a discussion about
-some risks in the ways in which applications commonly use libcurl and
-potential mitigations of those risks. It is not comprehensive, but shows
-classes of attacks that robust applications should consider. The Common
-Weakness Enumeration project at https://cwe.mitre.org/ is a good reference for
-many of these and similar types of weaknesses of which application writers
-should be aware.
-.SH "Command Lines"
-If you use a command line tool (such as curl) that uses libcurl, and you give
-options to the tool on the command line those options can get read by other
-users of your system when they use \fIps\fP or other tools to list currently
-running processes.
-
-To avoid these problems, never feed sensitive things to programs using command
-line options. Write them to a protected file and use the \-K option to avoid
-this.
-.SH ".netrc"
-\&.netrc is a pretty handy file/feature that allows you to login quickly and
-automatically to frequently visited sites. The file contains passwords in
-clear text and is a real security risk. In some cases, your .netrc is also
-stored in a home directory that is NFS mounted or used on another network
-based file system, so the clear text password flies through your network every
-time anyone reads that file.
-
-For applications that enable .netrc use, a user who manage to set the right
-URL might then be possible to pass on passwords.
-
-To avoid these problems, do not use .netrc files and never store passwords in
-plain text anywhere.
-.SH "Clear Text Passwords"
-Many of the protocols libcurl supports send name and password unencrypted as
-clear text (HTTP Basic authentication, FTP, TELNET etc). It is easy for anyone
-on your network or a network nearby yours to just fire up a network analyzer
-tool and eavesdrop on your passwords. do not let the fact that HTTP Basic uses
-base64 encoded passwords fool you. They may not look readable at a first
-glance, but they are easily "deciphered" by anyone within seconds.
-
-To avoid this problem, use an authentication mechanism or other protocol that
-does not let snoopers see your password: Digest, CRAM-MD5, Kerberos, SPNEGO or
-NTLM authentication. Or even better: use authenticated protocols that protect
-the entire connection and everything sent over it.
-.SH "Unauthenticated Connections"
-Protocols that do not have any form of cryptographic authentication cannot
-with any certainty know that they communicate with the right remote server.
-
-If your application is using a fixed scheme or fixed host name, it is not safe
-as long as the connection is unauthenticated. There can be a man-in-the-middle
-or in fact the whole server might have been replaced by an evil actor.
-
-Unauthenticated protocols are unsafe. The data that comes back to curl may
-have been injected by an attacker. The data that curl sends might be modified
-before it reaches the intended server. If it even reaches the intended server
-at all.
-
-Remedies:
-.IP "Restrict operations to authenticated transfers"
-Use authenticated protocols protected with HTTPS or SSH.
-.IP "Make sure the server's certificate etc is verified"
-Never ever switch off certificate verification.
-.SH "Redirects"
-The \fICURLOPT_FOLLOWLOCATION(3)\fP option automatically follows HTTP
-redirects sent by a remote server. These redirects can refer to any kind of
-URL, not just HTTP. libcurl restricts the protocols allowed to be used in
-redirects for security reasons: only HTTP, HTTPS, FTP and FTPS are
-enabled by default. Applications may opt to restrict that set further.
-
-A redirect to a file: URL would cause the libcurl to read (or write) arbitrary
-files from the local filesystem. If the application returns the data back to
-the user (as would happen in some kinds of CGI scripts), an attacker could
-leverage this to read otherwise forbidden data (e.g.
-\fBfile://localhost/etc/passwd\fP).
-
-If authentication credentials are stored in the ~/.netrc file, or Kerberos is
-in use, any other URL type (not just file:) that requires authentication is
-also at risk. A redirect such as ftp://some-internal-server/private-file would
-then return data even when the server is password protected.
-
-In the same way, if an unencrypted SSH private key has been configured for the
-user running the libcurl application, SCP: or SFTP: URLs could access password
-or private-key protected resources,
-e.g. \fBsftp://user@some-internal-server/etc/passwd\fP
-
-The \fICURLOPT_REDIR_PROTOCOLS(3)\fP and \fICURLOPT_NETRC(3)\fP options can be
-used to mitigate against this kind of attack.
-
-A redirect can also specify a location available only on the machine running
-libcurl, including servers hidden behind a firewall from the attacker.
-e.g. http://127.0.0.1/ or http://intranet/delete-stuff.cgi?delete=all or
-tftp://bootp-server/pc-config-data
-
-Applications can mitigate against this by disabling
-\fICURLOPT_FOLLOWLOCATION(3)\fP and handling redirects itself, sanitizing URLs
-as necessary. Alternately, an app could leave \fICURLOPT_FOLLOWLOCATION(3)\fP
-enabled but set \fICURLOPT_REDIR_PROTOCOLS(3)\fP and install a
-\fICURLOPT_OPENSOCKETFUNCTION(3)\fP or \fICURLOPT_PREREQFUNCTION(3)\fP callback
-function in which addresses are sanitized before use.
-.SH "CRLF in Headers"
-For all options in libcurl which specify headers, including but not limited to
-\fICURLOPT_HTTPHEADER(3)\fP, \fICURLOPT_PROXYHEADER(3)\fP,
-\fICURLOPT_COOKIE(3)\fP, \fICURLOPT_USERAGENT(3)\fP, \fICURLOPT_REFERER(3)\fP
-and \fICURLOPT_RANGE(3)\fP, libcurl sends the headers as-is and does not apply
-any special sanitation or normalization to them.
-
-If you allow untrusted user input into these options without sanitizing CRLF
-sequences in them, someone malicious may be able to modify the request in a
-way you did not intend such as injecting new headers.
-.SH "Local Resources"
-A user who can control the DNS server of a domain being passed in within a URL
-can change the address of the host to a local, private address which a
-server-side libcurl-using application could then use. e.g. the innocuous URL
-\fBhttp://fuzzybunnies.example.com/\fP could actually resolve to the IP
-address of a server behind a firewall, such as 127.0.0.1 or
-10.1.2.3. Applications can mitigate against this by setting a
-\fICURLOPT_OPENSOCKETFUNCTION(3)\fP or \fICURLOPT_PREREQFUNCTION(3)\fP and
-checking the address before a connection.
-
-All the malicious scenarios regarding redirected URLs apply just as well to
-non-redirected URLs, if the user is allowed to specify an arbitrary URL that
-could point to a private resource. For example, a web app providing a
-translation service might happily translate \fBfile://localhost/etc/passwd\fP
-and display the result. Applications can mitigate against this with the
-\fICURLOPT_PROTOCOLS(3)\fP option as well as by similar mitigation techniques
-for redirections.
-
-A malicious FTP server could in response to the PASV command return an IP
-address and port number for a server local to the app running libcurl but
-behind a firewall. Applications can mitigate against this by using the
-\fICURLOPT_FTP_SKIP_PASV_IP(3)\fP option or \fICURLOPT_FTPPORT(3)\fP.
-
-Local servers sometimes assume local access comes from friends and trusted
-users. An application that expects https://example.com/file_to_read that and
-instead gets http://192.168.0.1/my_router_config might print a file that would
-otherwise be protected by the firewall.
-
-Allowing your application to connect to local hosts, be it the same machine
-that runs the application or a machine on the same local network, might be
-possible to exploit by an attacker who then perhaps can "port-scan" the
-particular hosts - depending on how the application and servers acts.
-.SH "IPv4 Addresses"
-Some users might be tempted to filter access to local resources or similar
-based on numerical IPv4 addresses used in URLs. This is a bad and error-prone
-idea because of the many different ways a numerical IPv4 address can be
-specified and libcurl accepts: one to four dot-separated fields using one of
-or a mix of decimal, octal or hexadecimal encoding.
-.SH "IPv6 Addresses"
-libcurl handles IPv6 addresses transparently and just as easily as IPv4
-addresses. That means that a sanitizing function that filters out addresses
-like 127.0.0.1 is not sufficient - the equivalent IPv6 addresses \fB::1\fP,
-\fB::\fP, \fB0:00::0:1\fP, \fB::127.0.0.1\fP and \fB::ffff:7f00:1\fP supplied
-somehow by an attacker would all bypass a naive filter and could allow access
-to undesired local resources. IPv6 also has special address blocks like
-link-local and site-local that generally should not be accessed by a
-server-side libcurl-using application. A poorly configured firewall installed
-in a data center, organization or server may also be configured to limit IPv4
-connections but leave IPv6 connections wide open. In some cases, setting
-\fICURLOPT_IPRESOLVE(3)\fP to CURL_IPRESOLVE_V4 can be used to limit resolved
-addresses to IPv4 only and bypass these issues.
-.SH Uploads
-When uploading, a redirect can cause a local (or remote) file to be
-overwritten. Applications must not allow any unsanitized URL to be passed in
-for uploads. Also, \fICURLOPT_FOLLOWLOCATION(3)\fP should not be used on
-uploads. Instead, the applications should consider handling redirects itself,
-sanitizing each URL first.
-.SH Authentication
-Use of \fICURLOPT_UNRESTRICTED_AUTH(3)\fP could cause authentication
-information to be sent to an unknown second server. Applications can mitigate
-against this by disabling \fICURLOPT_FOLLOWLOCATION(3)\fP and handling
-redirects itself, sanitizing where necessary.
-
-Use of the CURLAUTH_ANY option to \fICURLOPT_HTTPAUTH(3)\fP could result in
-user name and password being sent in clear text to an HTTP server. Instead,
-use CURLAUTH_ANYSAFE which ensures that the password is encrypted over the
-network, or else fail the request.
-
-Use of the CURLUSESSL_TRY option to \fICURLOPT_USE_SSL(3)\fP could result in
-user name and password being sent in clear text to an FTP server. Instead,
-use CURLUSESSL_CONTROL to ensure that an encrypted connection is used or else
-fail the request.
-.SH Cookies
-If cookies are enabled and cached, then a user could craft a URL which
-performs some malicious action to a site whose authentication is already
-stored in a cookie. e.g. http://mail.example.com/delete-stuff.cgi?delete=all
-Applications can mitigate against this by disabling cookies or clearing them
-between requests.
-.SH "Dangerous SCP URLs"
-SCP URLs can contain raw commands within the scp: URL, which is a side effect
-of how the SCP protocol is designed. e.g.
-.nf
-  scp://user:pass@host/a;date >/tmp/test;
-.fi
-Applications must not allow unsanitized SCP: URLs to be passed in for
-downloads.
-.SH "file://"
-By default curl and libcurl support file:// URLs. Such a URL is always an
-access, or attempted access, to a local resource. If your application wants to
-avoid that, keep control of what URLs to use and/or prevent curl/libcurl from
-using the protocol.
-
-By default, libcurl prohibits redirects to file:// URLs.
-
-.SH "Warning: file:// on Windows"
-The Windows operating system tries automatically, and without any way for
-applications to disable it, to establish a connection to another host over the
-network and access it (over SMB or other protocols), if only the correct file
-path is accessed.
-
-When first realizing this, the curl team tried to filter out such attempts in
-order to protect applications for inadvertent probes of for example internal
-networks etc. This resulted in CVE-2019-15601 and the associated security fix.
-
-However, we have since been made aware of the fact that the previous fix was far
-from adequate as there are several other ways to accomplish more or less the
-same thing: accessing a remote host over the network instead of the local file
-system.
-
-The conclusion we have come to is that this is a weakness or feature in the
-Windows operating system itself, that we as an application cannot safely
-protect users against. It would just be a whack-a-mole race we do not want to
-participate in. There are too many ways to do it and there is no knob we can
-use to turn off the practice.
-
-If you use curl or libcurl on Windows (any version), disable the use of the
-FILE protocol in curl or be prepared that accesses to a range of "magic paths"
-potentially make your system access other hosts on your network. curl cannot
-protect you against this.
-.SH "What if the user can set the URL"
-Applications may find it tempting to let users set the URL that it can work
-on. That is probably fine, but opens up for mischief and trickery that you as
-an application author may want to address or take precautions against.
-
-If your curl-using script allow a custom URL do you also, perhaps
-unintentionally, allow the user to pass other options to the curl command line
-if creative use of special characters are applied?
-
-If the user can set the URL, the user can also specify the scheme part to
-other protocols that you did not intend for users to use and perhaps did not
-consider. curl supports over 20 different URL schemes. "http://" might be what
-you thought, "ftp://" or "imap://" might be what the user gives your
-application. Also, cross-protocol operations might be done by using a
-particular scheme in the URL but point to a server doing a different protocol
-on a non-standard port.
-
-Remedies:
-.IP "Use --proto"
-curl command lines can use \fI--proto\fP to limit what URL schemes it accepts
-.IP "Use CURLOPT_PROTOCOLS"
-libcurl programs can use \fICURLOPT_PROTOCOLS(3)\fP to limit what URL schemes it accepts
-.IP "consider not allowing the user to set the full URL"
-Maybe just let the user provide data for parts of it? Or maybe filter input to
-only allow specific choices?
-.SH "RFC 3986 vs WHATWG URL"
-curl supports URLs mostly according to how they are defined in RFC 3986, and
-has done so since the beginning.
-
-Web browsers mostly adhere to the WHATWG URL Specification.
-
-This deviance makes some URLs copied between browsers (or returned over HTTP
-for redirection) and curl not work the same way. It can also cause problems if
-an application parses URLs differently from libcurl and makes different
-assumptions about a link. This can mislead users into getting the wrong thing,
-connecting to the wrong host or otherwise not working identically.
-
-Within an application, this can be mitigated by always using the
-\fIcurl_url(3)\fP API to parse URLs, ensuring that they are parsed the same way
-as within libcurl itself.
-.SH "FTP uses two connections"
-When performing an FTP transfer, two TCP connections are used: one for setting
-up the transfer and one for the actual data.
-
-FTP is not only unauthenticated, but the setting up of the second transfer is
-also a weak spot. The second connection to use for data, is either setup with
-the PORT/EPRT command that makes the server connect back to the client on the
-given IP+PORT, or with PASV/EPSV that makes the server setup a port to listen
-to and tells the client to connect to a given IP+PORT.
-
-Again, unauthenticated means that the connection might be meddled with by a
-man-in-the-middle or that there is a malicious server pretending to be the
-right one.
-
-A malicious FTP server can respond to PASV commands with the IP+PORT of a
-totally different machine. Perhaps even a third party host, and when there are
-many clients trying to connect to that third party, it could create a
-Distributed Denial-Of-Service attack out of it. If the client makes an upload
-operation, it can make the client send the data to another site. If the
-attacker can affect what data the client uploads, it can be made to work as a
-HTTP request and then the client could be made to issue HTTP requests to third
-party hosts.
-
-An attacker that manages to control curl's command line options can tell curl
-to send an FTP PORT command to ask the server to connect to a third party host
-instead of back to curl.
-
-The fact that FTP uses two connections makes it vulnerable in a way that is
-hard to avoid.
-.SH "Denial of Service"
-A malicious server could cause libcurl to effectively hang by sending data
-slowly, or even no data at all but just keeping the TCP connection open. This
-could effectively result in a denial-of-service attack. The
-\fICURLOPT_TIMEOUT(3)\fP and/or \fICURLOPT_LOW_SPEED_LIMIT(3)\fP options can
-be used to mitigate against this.
-
-A malicious server could cause libcurl to download an infinite amount of data,
-potentially causing all of memory or disk to be filled. Setting the
-\fICURLOPT_MAXFILESIZE_LARGE(3)\fP option is not sufficient to guard against
-this. Instead, applications should monitor the amount of data received within
-the write or progress callback and abort once the limit is reached.
-
-A malicious HTTP server could cause an infinite redirection loop, causing a
-denial-of-service. This can be mitigated by using the
-\fICURLOPT_MAXREDIRS(3)\fP option.
-.SH "Arbitrary Headers"
-User-supplied data must be sanitized when used in options like
-\fICURLOPT_USERAGENT(3)\fP, \fICURLOPT_HTTPHEADER(3)\fP,
-\fICURLOPT_POSTFIELDS(3)\fP and others that are used to generate structured
-data. Characters like embedded carriage returns or ampersands could allow the
-user to create additional headers or fields that could cause malicious
-transactions.
-.SH "Server-supplied Names"
-A server can supply data which the application may, in some cases, use as a
-file name. The curl command-line tool does this with
-\fI--remote-header-name\fP, using the Content-disposition: header to generate
-a file name. An application could also use \fICURLINFO_EFFECTIVE_URL(3)\fP to
-generate a file name from a server-supplied redirect URL. Special care must be
-taken to sanitize such names to avoid the possibility of a malicious server
-supplying one like \fB"/etc/passwd"\fP, \fB"\\autoexec.bat"\fP, \fB"prn:"\fP
-or even \fB".bashrc"\fP.
-.SH "Server Certificates"
-A secure application should never use the \fICURLOPT_SSL_VERIFYPEER(3)\fP
-option to disable certificate validation. There are numerous attacks that are
-enabled by applications that fail to properly validate server TLS/SSL
-certificates, thus enabling a malicious server to spoof a legitimate
-one. HTTPS without validated certificates is potentially as insecure as a
-plain HTTP connection.
-.SH "Showing What You Do"
-Relatedly, be aware that in situations when you have problems with libcurl and
-ask someone for help, everything you reveal in order to get best possible help
-might also impose certain security related risks. Host names, user names,
-paths, operating system specifics, etc. (not to mention passwords of course)
-may in fact be used by intruders to gain additional information of a potential
-target.
-
-Be sure to limit access to application logs if they could hold private or
-security-related data. Besides the obvious candidates like user names and
-passwords, things like URLs, cookies or even file names could also hold
-sensitive data.
-
-To avoid this problem, you must of course use your common sense. Often, you
-can just edit out the sensitive data or just search/replace your true
-information with faked data.
-.SH "setuid applications using libcurl"
-libcurl-using applications that set the 'setuid' bit to run with elevated or
-modified rights also implicitly give that extra power to libcurl and this
-should only be done after careful considerations.
-
-Giving setuid powers to the application means that libcurl can save files using
-those new rights (if for example the `SSLKEYLOGFILE` environment variable is
-set). Also: if the application wants these powers to read or manage secrets
-that the user is otherwise not able to view (like credentials for a login
-etc), it should be noted that libcurl still might understand proxy environment
-variables that allow the user to redirect libcurl operations to use a proxy
-controlled by the user.
-.SH "File descriptors, fork and NTLM"
-An application that uses libcurl and invokes \fIfork()\fP gets all file
-descriptors duplicated in the child process, including the ones libcurl
-created.
-
-libcurl itself uses \fIfork()\fP and \fIexecl()\fP if told to use the
-\fBCURLAUTH_NTLM_WB\fP authentication method which then invokes the helper
-command in a child process with file descriptors duplicated. Make sure that
-only the trusted and reliable helper program is invoked!
-.SH "Secrets in memory"
-When applications pass user names, passwords or other sensitive data to
-libcurl to be used for upcoming transfers, those secrets are kept around as-is
-in memory. In many cases they are stored in the heap for as long as the handle
-itself for which the options are set.
-
-If an attacker can access the heap, like maybe by reading swap space or via a
-core dump file, such data might be accessible.
-
-Further, when eventually closing a handle and the secrets are no longer
-needed, libcurl does not explicitly clear memory before freeing it, so
-credentials may be left in freed data.
-.SH "Saving files"
-libcurl cannot protect against attacks where an attacker has write access to
-the same directory where libcurl is directed to save files.
-.SH "Report Security Problems"
-Should you detect or just suspect a security problem in libcurl or curl,
-contact the project curl security team immediately. See
-https://curl.se/dev/secprocess.html for details.
diff --git a/third-party/curl/docs/libcurl/libcurl-security.md b/third-party/curl/docs/libcurl/libcurl-security.md
new file mode 100644
index 0000000000..81b29cfd16
--- /dev/null
+++ b/third-party/curl/docs/libcurl/libcurl-security.md
@@ -0,0 +1,520 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: libcurl-security
+Section: 3
+Source: libcurl
+See-also:
+  - libcurl-thread (3)
+Protocol:
+  - All
+Added-in: n/a
+---
+<!-- markdown-link-check-disable -->
+# NAME
+
+libcurl-security - security considerations when using libcurl
+
+# Security
+
+The libcurl project takes security seriously. The library is written with
+caution and precautions are taken to mitigate many kinds of risks encountered
+while operating with potentially malicious servers on the Internet. It is a
+powerful library that allows application writers to make trade-offs between
+ease of writing and exposure to potential risky operations. If used the right
+way, you can use libcurl to transfer data pretty safely.
+
+Many applications are used in closed networks where users and servers can
+(possibly) be trusted, but many others are used on arbitrary servers and are
+fed input from potentially untrusted users. Following is a discussion about
+some risks in the ways in which applications commonly use libcurl and
+potential mitigations of those risks. It is not comprehensive, but shows
+classes of attacks that robust applications should consider. The Common
+Weakness Enumeration project at https://cwe.mitre.org/ is a good reference for
+many of these and similar types of weaknesses of which application writers
+should be aware.
+
+# Command Lines
+
+If you use a command line tool (such as curl) that uses libcurl, and you give
+options to the tool on the command line those options can get read by other
+users of your system when they use *ps* or other tools to list currently
+running processes.
+
+To avoid these problems, never feed sensitive things to programs using command
+line options. Write them to a protected file and use the -K option to avoid
+this.
+
+# .netrc
+
+.netrc is a pretty handy file/feature that allows you to login quickly and
+automatically to frequently visited sites. The file contains passwords in
+clear text and is a real security risk. In some cases, your .netrc is also
+stored in a home directory that is NFS mounted or used on another network
+based file system, so the clear text password flies through your network every
+time anyone reads that file.
+
+For applications that enable .netrc use, a user who manage to set the right
+URL might then be possible to pass on passwords.
+
+To avoid these problems, do not use .netrc files and never store passwords in
+plain text anywhere.
+
+# Clear Text Passwords
+
+Many of the protocols libcurl supports send name and password unencrypted as
+clear text (HTTP Basic authentication, FTP, TELNET etc). It is easy for anyone
+on your network or a network nearby yours to fire up a network analyzer tool
+and eavesdrop on your passwords. Do not let the fact that HTTP Basic uses
+base64 encoded passwords fool you. They may not look readable at a first
+glance, but they are easily "deciphered" by anyone within seconds.
+
+To avoid this problem, use an authentication mechanism or other protocol that
+does not let snoopers see your password: Digest, CRAM-MD5, Kerberos, SPNEGO or
+NTLM authentication. Or even better: use authenticated protocols that protect
+the entire connection and everything sent over it.
+
+# Unauthenticated Connections
+
+Protocols that do not have any form of cryptographic authentication cannot
+with any certainty know that they communicate with the right remote server.
+
+If your application is using a fixed scheme or fixed hostname, it is not safe
+as long as the connection is unauthenticated. There can be a man-in-the-middle
+or in fact the whole server might have been replaced by an evil actor.
+
+Unauthenticated protocols are unsafe. The data that comes back to curl may
+have been injected by an attacker. The data that curl sends might be modified
+before it reaches the intended server. If it even reaches the intended server
+at all.
+
+Remedies:
+
+## Restrict operations to authenticated transfers
+
+Use authenticated protocols protected with HTTPS or SSH.
+
+## Make sure the server's certificate etc is verified
+
+Never ever switch off certificate verification.
+
+# Certificates and Long-running Connections
+
+Certificate validation of encrypted connections is performed immediately after
+a connection is established. That connection could be used for many subsequent
+transfers, even if the certificate used for validation expires or is revoked,
+the local certificate bundle is changed in a way that would have caused that
+certificate to fail validation, the server changes its certificate to one
+that would have failed validation, or even if a completely different server is
+brought up under the same hostname. This could continue for many hours (or
+even years) after such a change occurs, which may not be desired behavior for
+some applications.
+
+Remedies:
+
+Use the CURLOPT_MAXLIFETIME_CONN(3) option to limit the amount of time that
+connections are used after they have been successfully validated. Further
+transfers require a new connection with validation performed again.
+
+# Redirects
+
+The CURLOPT_FOLLOWLOCATION(3) option automatically follows HTTP redirects sent
+by a remote server. These redirects can refer to any kind of URL, not only
+HTTP. libcurl restricts the protocols allowed to be used in redirects for
+security reasons: only HTTP, HTTPS, FTP and FTPS are enabled by default.
+Applications may opt to restrict that set further.
+
+A redirect to a file: URL would cause the libcurl to read (or write) arbitrary
+files from the local file system. If the application returns the data back to
+the user (as would happen in some kinds of CGI scripts), an attacker could
+leverage this to read otherwise forbidden data (e.g.
+**file://localhost/etc/passwd**).
+
+If authentication credentials are stored in the ~/.netrc file, or Kerberos is
+in use, any other URL type (except file:) that requires authentication is also
+at risk. A redirect such as **ftp://some-internal-server/private-file** would
+then return data even when the server is password protected.
+
+In the same way, if an unencrypted SSH private key has been configured for the
+user running the libcurl application, SCP: or SFTP: URLs could access password
+or private-key protected resources,
+e.g. **sftp://user@some-internal-server/etc/passwd**
+
+The CURLOPT_REDIR_PROTOCOLS_STR(3) and CURLOPT_NETRC(3) options can be
+used to mitigate against this kind of attack.
+
+A redirect can also specify a location available only on the machine running
+libcurl, including servers hidden behind a firewall from the attacker. E.g.
+**https://127.0.0.1/** or
+**https://intranet.example/delete-stuff.cgi?delete=all** or
+**tftp://bootp-server.example/pc-config-data**
+
+Applications can mitigate against this by disabling
+CURLOPT_FOLLOWLOCATION(3) and handling redirects itself, sanitizing URLs
+as necessary. Alternately, an app could leave CURLOPT_FOLLOWLOCATION(3)
+enabled but set CURLOPT_REDIR_PROTOCOLS_STR(3) and install a
+CURLOPT_OPENSOCKETFUNCTION(3) or CURLOPT_PREREQFUNCTION(3) callback
+function in which addresses are sanitized before use.
+
+# CRLF in Headers
+
+For all options in libcurl which specify headers, including but not limited to
+CURLOPT_HTTPHEADER(3), CURLOPT_PROXYHEADER(3),
+CURLOPT_COOKIE(3), CURLOPT_USERAGENT(3), CURLOPT_REFERER(3)
+and CURLOPT_RANGE(3), libcurl sends the headers as-is and does not apply
+any special sanitation or normalization to them.
+
+If you allow untrusted user input into these options without sanitizing CRLF
+sequences in them, someone malicious may be able to modify the request in a
+way you did not intend such as injecting new headers.
+
+# Local Resources
+
+A user who can control the DNS server of a domain being passed in within a URL
+can change the address of the host to a local, private address which a
+server-side libcurl-using application could then use. E.g. the innocuous URL
+**https://fuzzybunnies.example.com/** could actually resolve to the IP address
+of a server behind a firewall, such as 127.0.0.1 or 10.1.2.3. Applications can
+mitigate against this by setting a CURLOPT_OPENSOCKETFUNCTION(3) or
+CURLOPT_PREREQFUNCTION(3) and checking the address before a connection.
+
+All the malicious scenarios regarding redirected URLs apply equally to
+non-redirected URLs, if the user is allowed to specify an arbitrary URL that
+could point to a private resource. For example, a web app providing a
+translation service might happily translate **file://localhost/etc/passwd**
+and display the result. Applications can mitigate against this with the
+CURLOPT_PROTOCOLS_STR(3) option as well as by similar mitigation techniques
+for redirections.
+
+A malicious FTP server could in response to the PASV command return an IP
+address and port number for a server local to the app running libcurl but
+behind a firewall. Applications can mitigate against this by using the
+CURLOPT_FTP_SKIP_PASV_IP(3) option or CURLOPT_FTPPORT(3).
+
+Local servers sometimes assume local access comes from friends and trusted
+users. An application that expects https://example.com/file_to_read and
+instead gets http://192.168.0.1/my_router_config might print a file that would
+otherwise be protected by the firewall.
+
+Allowing your application to connect to local hosts, be it the same machine
+that runs the application or a machine on the same local network, might be
+possible to exploit by an attacker who then perhaps can "port-scan" the
+particular hosts - depending on how the application and servers acts.
+
+# IPv4 Addresses
+
+Some users might be tempted to filter access to local resources or similar
+based on numerical IPv4 addresses used in URLs. This is a bad and error-prone
+idea because of the many different ways a numerical IPv4 address can be
+specified and libcurl accepts: one to four dot-separated fields using one of
+or a mix of decimal, octal or hexadecimal encoding.
+
+# IPv6 Addresses
+
+libcurl handles IPv6 addresses transparently and as easily as IPv4 addresses.
+That means that a sanitizing function that filters out addresses like
+127.0.0.1 is not sufficient - the equivalent IPv6 addresses **::1**, **::**,
+**0:00::0:1**, **::127.0.0.1** and **::ffff:7f00:1** supplied somehow by an
+attacker would all bypass a naive filter and could allow access to undesired
+local resources. IPv6 also has special address blocks like link-local and
+site-local that generally should not be accessed by a server-side
+libcurl-using application. A poorly configured firewall installed in a data
+center, organization or server may also be configured to limit IPv4
+connections but leave IPv6 connections wide open. In some cases, setting
+CURLOPT_IPRESOLVE(3) to CURL_IPRESOLVE_V4 can be used to limit resolved
+addresses to IPv4 only and bypass these issues.
+
+# Uploads
+
+When uploading, a redirect can cause a local (or remote) file to be
+overwritten. Applications must not allow any unsanitized URL to be passed in
+for uploads. Also, CURLOPT_FOLLOWLOCATION(3) should not be used on
+uploads. Instead, the applications should consider handling redirects itself,
+sanitizing each URL first.
+
+# Authentication
+
+Use of CURLOPT_UNRESTRICTED_AUTH(3) could cause authentication
+information to be sent to an unknown second server. Applications can mitigate
+against this by disabling CURLOPT_FOLLOWLOCATION(3) and handling
+redirects itself, sanitizing where necessary.
+
+Use of the CURLAUTH_ANY option to CURLOPT_HTTPAUTH(3) could result in username
+and password being sent in clear text to an HTTP server. Instead, use
+CURLAUTH_ANYSAFE which ensures that the password is encrypted over the
+network, or else fail the request.
+
+Use of the CURLUSESSL_TRY option to CURLOPT_USE_SSL(3) could result in
+username and password being sent in clear text to an FTP server. Instead, use
+CURLUSESSL_CONTROL to ensure that an encrypted connection is used or else fail
+the request.
+
+# Cookies
+
+If cookies are enabled and cached, then a user could craft a URL which
+performs some malicious action to a site whose authentication is already
+stored in a cookie. E.g.
+**https://mail.example.com/delete-stuff.cgi?delete=all** Applications can
+mitigate against this by disabling cookies or clearing them between requests.
+
+# Dangerous SCP URLs
+
+SCP URLs can contain raw commands within the scp: URL, which is a side effect
+of how the SCP protocol is designed. E.g.
+~~~
+  scp://user:pass@host/a;date >/tmp/test;
+~~~
+Applications must not allow unsanitized SCP: URLs to be passed in for
+downloads.
+
+# `file://`
+
+By default curl and libcurl support `file://` URLs. Such a URL is always an
+access, or attempted access, to a local resource. If your application wants to
+avoid that, keep control of what URLs to use and/or prevent curl/libcurl from
+using the protocol.
+
+By default, libcurl prohibits redirects to `file://` URLs.
+
+# Warning: `file://` on Windows
+
+The Windows operating system tries automatically, and without any way for
+applications to disable it, to establish a connection to another host over the
+network and access it (over SMB or other protocols), if only the correct file
+path is accessed.
+
+When first realizing this, the curl team tried to filter out such attempts in
+order to protect applications for inadvertent probes of for example internal
+networks etc. This resulted in CVE-2019-15601 and the associated security fix.
+
+We have since been made aware of the fact that the previous fix was far from
+adequate as there are several other ways to accomplish more or less the same
+thing: accessing a remote host over the network instead of the local file
+system.
+
+The conclusion we have come to is that this is a weakness or feature in the
+Windows operating system itself, that we as an application cannot safely
+protect users against. It would make a whack-a-mole race we do not want to
+participate in. There are too many ways to do it and there is no knob we can
+use to turn off the practice.
+
+If you use curl or libcurl on Windows (any version), disable the use of the
+FILE protocol in curl or be prepared that accesses to a set of special paths
+potentially make your system access other hosts on your network. curl cannot
+protect you against this.
+
+# What if the user can set the URL
+
+Applications may find it tempting to let users set the URL that it can work
+on. That is probably fine, but opens up for mischief and trickery that you as
+an application author may want to address or take precautions against.
+
+If your curl-using script allow a custom URL do you also, perhaps
+unintentionally, allow the user to pass other options to the curl command line
+if creative use of special characters are applied?
+
+If the user can set the URL, the user can also specify the scheme part to
+other protocols that you did not intend for users to use and perhaps did not
+consider. curl supports over 27 different URL schemes. `https://` might be
+what you expect, `ftp://` or `imap://` might be what the user gives your
+application. Also, cross-protocol operations might be done by using a
+particular scheme in the URL but point to a server doing a different protocol
+on a non-standard port.
+
+Remedies:
+
+## Use --proto
+
+curl command lines can use *--proto* to limit what URL schemes it accepts
+
+## Use CURLOPT_PROTOCOLS_STR
+
+libcurl programs can use CURLOPT_PROTOCOLS_STR(3) to limit what URL schemes it accepts
+
+## consider not allowing the user to set the full URL
+
+Maybe let the user provide data for parts of it? Or maybe filter input to only
+allow specific choices? Remember that the naive approach of appending a
+user-specified string to a base URL could still allow unexpected results
+through use of characters like ../ or ? or Unicode characters or hiding
+characters using various escaping means.
+
+# RFC 3986 vs WHATWG URL
+
+curl supports URLs mostly according to how they are defined in RFC 3986, and
+has done so since the beginning.
+
+Web browsers mostly adhere to the WHATWG URL Specification.
+
+This deviance makes some URLs copied between browsers (or returned over HTTP
+for redirection) and curl not work the same way. It can also cause problems if
+an application parses URLs differently from libcurl and makes different
+assumptions about a link. This can mislead users into getting the wrong thing,
+connecting to the wrong host or otherwise not working identically.
+
+Within an application, this can be mitigated by always using the
+curl_url(3) API to parse URLs, ensuring that they are parsed the same way
+as within libcurl itself.
+
+# FTP uses two connections
+
+When performing an FTP transfer, two TCP connections are used: one for setting
+up the transfer and one for the actual data.
+
+FTP is not only unauthenticated, but the setting up of the second transfer is
+also a weak spot. The second connection to use for data, is either setup with
+the PORT/EPRT command that makes the server connect back to the client on the
+given IP+PORT, or with PASV/EPSV that makes the server setup a port to listen
+to and tells the client to connect to a given IP+PORT.
+
+Again, unauthenticated means that the connection might be meddled with by a
+man-in-the-middle or that there is a malicious server pretending to be the
+right one.
+
+A malicious FTP server can respond to PASV commands with the IP+PORT of a
+totally different machine. Perhaps even a third party host, and when there are
+many clients trying to connect to that third party, it could create a
+Distributed Denial-Of-Service attack out of it. If the client makes an upload
+operation, it can make the client send the data to another site. If the
+attacker can affect what data the client uploads, it can be made to work as a
+HTTP request and then the client could be made to issue HTTP requests to third
+party hosts.
+
+An attacker that manages to control curl's command line options can tell curl
+to send an FTP PORT command to ask the server to connect to a third party host
+instead of back to curl.
+
+The fact that FTP uses two connections makes it vulnerable in a way that is
+hard to avoid.
+
+# Active FTP passes on the local IP address
+
+If you use curl/libcurl to do *active* FTP transfers, curl passes on the
+address of your local IP interface to the remote server - even when for example
+using a SOCKS or HTTP proxy in between curl and the target server.
+
+# Denial of Service
+
+A malicious server could cause libcurl to effectively hang by sending data
+slowly, or even no data at all but keeping the TCP connection open. This could
+effectively result in a denial-of-service attack. The CURLOPT_TIMEOUT(3)
+and/or CURLOPT_LOW_SPEED_LIMIT(3) options can be used to mitigate against
+this.
+
+A malicious server could cause libcurl to download an infinite amount of data,
+potentially causing system resources to be exhausted resulting in a system or
+application crash. Setting the CURLOPT_MAXFILESIZE_LARGE(3) option is not
+sufficient to guard against this. Instead, applications should monitor the
+amount of data received within the write or progress callback and abort once
+the limit is reached.
+
+A malicious HTTP server could cause an infinite redirection loop, causing a
+denial-of-service. This can be mitigated by using the
+CURLOPT_MAXREDIRS(3) option.
+
+# Arbitrary Headers
+
+User-supplied data must be sanitized when used in options like
+CURLOPT_USERAGENT(3), CURLOPT_HTTPHEADER(3),
+CURLOPT_POSTFIELDS(3) and others that are used to generate structured
+data. Characters like embedded carriage returns or ampersands could allow the
+user to create additional headers or fields that could cause malicious
+transactions.
+
+# Server-supplied Names
+
+A server can supply data which the application may, in some cases, use as a
+filename. The curl command-line tool does this with *--remote-header-name*,
+using the Content-disposition: header to generate a filename. An application
+could also use CURLINFO_EFFECTIVE_URL(3) to generate a filename from a
+server-supplied redirect URL. Special care must be taken to sanitize such
+names to avoid the possibility of a malicious server supplying one like
+**"/etc/passwd"**, **"autoexec.bat"**, **"prn:"** or even **".bashrc"**.
+
+# Server Certificates
+
+A secure application should never use the CURLOPT_SSL_VERIFYPEER(3)
+option to disable certificate validation. There are numerous attacks that are
+enabled by applications that fail to properly validate server TLS/SSL
+certificates, thus enabling a malicious server to spoof a legitimate
+one. HTTPS without validated certificates is potentially as insecure as a
+plain HTTP connection.
+
+# Showing What You Do
+
+Relatedly, be aware that in situations when you have problems with libcurl and
+ask someone for help, everything you reveal in order to get best possible help
+might also impose certain security related risks. Hostnames, usernames, paths,
+operating system specifics, etc. (not to mention passwords of course) may in
+fact be used by intruders to gain additional information of a potential
+target.
+
+Be sure to limit access to application logs if they could hold private or
+security-related data. Besides the obvious candidates like usernames and
+passwords, things like URLs, cookies or even filenames could also hold
+sensitive data.
+
+To avoid this problem, you must of course use your common sense. Often, you
+can edit out the sensitive data or search/replace your true information with
+faked data.
+
+# setuid applications using libcurl
+
+libcurl-using applications that set the 'setuid' bit to run with elevated or
+modified rights also implicitly give that extra power to libcurl and this
+should only be done after careful considerations.
+
+Giving setuid powers to the application means that libcurl can save files using
+those new rights (if for example the `SSLKEYLOGFILE` environment variable is
+set). Also: if the application wants these powers to read or manage secrets
+that the user is otherwise not able to view (like credentials for a login
+etc), it should be noted that libcurl still might understand proxy environment
+variables that allow the user to redirect libcurl operations to use a proxy
+controlled by the user.
+
+# File descriptors, fork and NTLM
+
+An application that uses libcurl and invokes *fork()* gets all file
+descriptors duplicated in the child process, including the ones libcurl
+created.
+
+libcurl itself uses *fork()* and *execl()* if told to use the
+**CURLAUTH_NTLM_WB** authentication method which then invokes the helper
+command in a child process with file descriptors duplicated. Make sure that
+only the trusted and reliable helper program is invoked.
+
+This feature was removed from curl in 8.8.0.
+
+# Secrets in memory
+
+When applications pass usernames, passwords or other sensitive data to
+libcurl to be used for upcoming transfers, those secrets are kept around as-is
+in memory. In many cases they are stored in the heap for as long as the handle
+itself for which the options are set.
+
+If an attacker can access the heap, like maybe by reading swap space or via a
+core dump file, such data might be accessible.
+
+Further, when eventually closing a handle and the secrets are no longer
+needed, libcurl does not explicitly clear memory before freeing it, so
+credentials may be left in freed data.
+
+# Saving files
+
+libcurl cannot protect against attacks where an attacker has write access to
+the same directory where libcurl is directed to save files.
+
+# Cookies
+
+If libcurl is built with PSL (**Public Suffix List**) support, it detects and
+discards cookies that are specified for such suffix domains that should not be
+allowed to have cookies.
+
+if libcurl is *not* built with PSL support, it has no ability to stop super
+cookies.
+
+# Report Security Problems
+
+Should you detect or suspect a security problem in libcurl or curl, contact
+the project curl security team immediately. See
+https://curl.se/dev/secprocess.html for details.
diff --git a/third-party/curl/docs/libcurl/libcurl-share.3 b/third-party/curl/docs/libcurl/libcurl-share.3
deleted file mode 100644
index 8f40c3bfe7..0000000000
--- a/third-party/curl/docs/libcurl/libcurl-share.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH libcurl-share 3 "8 Aug 2003" "libcurl" "libcurl"
-.SH NAME
-libcurl-share \- how to use the share interface
-.SH DESCRIPTION
-This is an overview on how to use the libcurl share interface in your C
-programs. There are specific man pages for each function mentioned in
-here.
-
-All functions in the share interface are prefixed with curl_share.
-
-.SH "OBJECTIVES"
-The share interface was added to enable sharing of data between curl
-\&"handles".
-.SH "ONE SET OF DATA - MANY TRANSFERS"
-You can have multiple easy handles share data between them. Have them update
-and use the \fBsame\fP cookie database, DNS cache, TLS session cache and/or
-connection cache! This way, each single transfer takes advantage from data
-updates made by the other transfer(s).
-.SH "SHARE OBJECT"
-You create a shared object with \fIcurl_share_init(3)\fP. It returns a handle
-for a newly created one.
-
-You tell the shared object what data you want it to share by using
-\fIcurl_share_setopt(3)\fP.
-
-Since you can use this share from multiple threads, and libcurl has no
-internal thread synchronization, you must provide mutex callbacks if you are
-using this multi-threaded. You set lock and unlock functions with
-\fIcurl_share_setopt(3)\fP too.
-
-Then, you make an easy handle to use this share, you set the
-\fICURLOPT_SHARE(3)\fP option with \fIcurl_easy_setopt(3)\fP, and pass in
-share handle. You can make any number of easy handles share the same share
-handle.
-
-To make an easy handle stop using that particular share, you set
-\fICURLOPT_SHARE(3)\fP to NULL for that easy handle. To make a handle stop
-sharing a particular data, you can \fICURLSHOPT_UNSHARE\fP it.
-
-When you are done using the share, make sure that no easy handle is still using
-it, and call \fIcurl_share_cleanup(3)\fP on the handle.
-.SH "SEE ALSO"
-.BR curl_share_init "(3), " curl_share_setopt "(3), " curl_share_cleanup "(3)"
-.BR libcurl-errors "(3), " libcurl-easy "(3), " libcurl-multi "(3) "
diff --git a/third-party/curl/docs/libcurl/libcurl-share.md b/third-party/curl/docs/libcurl/libcurl-share.md
new file mode 100644
index 0000000000..040059313d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/libcurl-share.md
@@ -0,0 +1,65 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: libcurl-share
+Section: 3
+Source: libcurl
+See-also:
+  - curl_share_cleanup (3)
+  - curl_share_init (3)
+  - curl_share_setopt (3)
+  - libcurl-easy (3)
+  - libcurl-errors (3)
+  - libcurl-multi (3)
+Protocol:
+  - All
+Added-in: n/a
+---
+
+# NAME
+
+libcurl-share - how to use the share interface
+
+# DESCRIPTION
+
+This is an overview on how to use the libcurl share interface in your C
+programs. There are specific man pages for each function mentioned in
+here.
+
+All functions in the share interface are prefixed with curl_share.
+
+# OBJECTIVES
+
+The share interface was added to enable sharing of data between curl handles.
+
+# ONE SET OF DATA - MANY TRANSFERS
+
+You can have multiple easy handles share data between them. Have them update
+and use the **same** cookie database, DNS cache, TLS session cache and/or
+connection cache. This way, each single transfer takes advantage from data
+updates made by the other transfer(s).
+
+# SHARE OBJECT
+
+You create a shared object with curl_share_init(3). It returns a handle
+for a newly created one.
+
+You tell the shared object what data you want it to share by using
+curl_share_setopt(3).
+
+Since you can use this share from multiple threads, and libcurl has no
+internal thread synchronization, you must provide mutex callbacks if you are
+using this multi-threaded. You set lock and unlock functions with
+curl_share_setopt(3) too.
+
+Then, you make an easy handle to use this share, you set the
+CURLOPT_SHARE(3) option with curl_easy_setopt(3), and pass in
+share handle. You can make any number of easy handles share the same share
+handle.
+
+To make an easy handle stop using that particular share, you set
+CURLOPT_SHARE(3) to NULL for that easy handle. To make a handle stop
+sharing a particular data, you can CURLSHOPT_UNSHARE(3) it.
+
+When you are done using the share, make sure that no easy handle is still using
+it, and call curl_share_cleanup(3) on the handle.
diff --git a/third-party/curl/docs/libcurl/libcurl-thread.3 b/third-party/curl/docs/libcurl/libcurl-thread.3
deleted file mode 100644
index 00e7d69d49..0000000000
--- a/third-party/curl/docs/libcurl/libcurl-thread.3
+++ /dev/null
@@ -1,123 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH libcurl-thread 3 "13 Jul 2015" "libcurl" "libcurl"
-.SH NAME
-libcurl-thread \- libcurl thread safety
-.SH "Multi-threading with libcurl"
-libcurl is thread safe but has no internal thread synchronization. You may have
-to provide your own locking should you meet any of the thread safety exceptions
-below.
-
-.SH "Handles"
-You must \fBnever\fP share the same handle in multiple threads.  You can pass
-the handles around among threads, but you must never use a single handle from
-more than one thread at any given time.
-.SH "Shared objects"
-You can share certain data between multiple handles by using the share
-interface but you must provide your own locking and set
-\fIcurl_share_setopt(3)\fP CURLSHOPT_LOCKFUNC and CURLSHOPT_UNLOCKFUNC.
-
-Note that some items are specifically documented as not thread-safe in the
-share API (the connection pool and HSTS cache for example).
-.SH TLS
-If you are accessing HTTPS or FTPS URLs in a multi-threaded manner, you are
-then of course using the underlying SSL library multi-threaded and those libs
-might have their own requirements on this issue. You may need to provide one
-or two functions to allow it to function properly:
-.IP OpenSSL
-OpenSSL 1.1.0+ "can be safely used in multi-threaded applications provided that
-support for the underlying OS threading API is built-in." In that case the
-engine is used by libcurl in a way that is fully thread-safe.
-
-https://www.openssl.org/docs/man1.1.0/man3/CRYPTO_THREAD_run_once.html#DESCRIPTION
-
-OpenSSL <= 1.0.2 the user must set callbacks.
-
-https://www.openssl.org/docs/man1.0.2/man3/CRYPTO_set_locking_callback.html#DESCRIPTION
-
-https://curl.se/libcurl/c/opensslthreadlock.html
-
-.IP GnuTLS
-https://gnutls.org/manual/html_node/Thread-safety.html
-.IP NSS
-thread-safe already without anything required.
-.IP Secure-Transport
-The engine is used by libcurl in a way that is fully thread-safe.
-.IP Schannel
-The engine is used by libcurl in a way that is fully thread-safe.
-.IP wolfSSL
-The engine is used by libcurl in a way that is fully thread-safe.
-.IP BoringSSL
-The engine is used by libcurl in a way that is fully thread-safe.
-.IP AWS-LC
-The engine is used by libcurl in a way that is fully thread-safe.
-.SH "Signals"
-Signals are used for timing out name resolves (during DNS lookup) - when built
-without using either the c-ares or threaded resolver backends. On systems that
-have a signal concept.
-
-When using multiple threads you should set the \fICURLOPT_NOSIGNAL(3)\fP
-option to 1L for all handles. Everything works fine except that timeouts
-cannot be honored during DNS lookups - which you can work around by building
-libcurl with c-ares or threaded-resolver support. c-ares is a library that
-provides asynchronous name resolves. On some platforms, libcurl simply cannot
-function properly multi-threaded unless the \fICURLOPT_NOSIGNAL(3)\fP option
-is set.
-
-When \fICURLOPT_NOSIGNAL(3)\fP is set to 1L, your application needs to deal
-with the risk of a SIGPIPE (that at least the OpenSSL backend can
-trigger). Note that setting \fICURLOPT_NOSIGNAL(3)\fP to 0L does not work in a
-threaded situation as there is a race condition where libcurl risks restoring
-the former signal handler while another thread should still ignore it.
-.SH "Name resolving"
-The \fBgethostbyname\fP or \fBgetaddrinfo\fP and other name resolving system
-calls used by libcurl are provided by your operating system and must be thread
-safe. It is important that libcurl can find and use thread safe versions of
-these and other system calls, as otherwise it cannot function fully thread
-safe. Some operating systems are known to have faulty thread
-implementations. We have previously received problem reports on *BSD (at least
-in the past, they may be working fine these days). Some operating systems that
-are known to have solid and working thread support are Linux, Solaris and
-Windows.
-.SH "curl_global_* functions"
-These functions are thread-safe since libcurl 7.84.0 if
-\fIcurl_version_info(3)\fP has the \fBCURL_VERSION_THREADSAFE\fP feature bit
-set (most platforms).
-
-If these functions are not thread-safe and you are using libcurl with multiple
-threads it is especially important that before use you call
-\fIcurl_global_init(3)\fP or \fIcurl_global_init_mem(3)\fP to explicitly
-initialize the library and its dependents, rather than rely on the "lazy"
-fail-safe initialization that takes place the first time
-\fIcurl_easy_init(3)\fP is called. For an in-depth explanation refer to
-\fIlibcurl(3)\fP section \fBGLOBAL CONSTANTS\fP.
-.SH "Memory functions"
-These functions, provided either by your operating system or your own
-replacements, must be thread safe. You can use \fIcurl_global_init_mem(3)\fP
-to set your own replacement memory functions.
-.SH "Non-safe functions"
-\fICURLOPT_DNS_USE_GLOBAL_CACHE(3)\fP is not thread-safe.
-
-\fIcurl_version_info(3)\fP is not thread-safe before libcurl initialization.
diff --git a/third-party/curl/docs/libcurl/libcurl-thread.md b/third-party/curl/docs/libcurl/libcurl-thread.md
new file mode 100644
index 0000000000..9b26224ce6
--- /dev/null
+++ b/third-party/curl/docs/libcurl/libcurl-thread.md
@@ -0,0 +1,127 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: libcurl-thread
+Section: 3
+Source: libcurl
+See-also:
+  - libcurl-security (3)
+Protocol:
+  - All
+Added-in: n/a
+---
+
+# NAME
+
+libcurl-thread - libcurl thread-safety
+
+# Multi-threading with libcurl
+
+libcurl is thread-safe but has no internal thread synchronization. You may have
+to provide your own locking should you meet any of the thread-safety exceptions
+below.
+
+# Handles
+
+You must **never** share the same handle in multiple threads. You can pass the
+handles around among threads, but you must never use a single handle from more
+than one thread at any given time.
+
+# Shared objects
+
+You can share certain data between multiple handles by using the share
+interface but you must provide your own locking and set
+curl_share_setopt(3) CURLSHOPT_LOCKFUNC and CURLSHOPT_UNLOCKFUNC.
+
+Note that some items are specifically documented as not thread-safe in the
+share API (the connection pool and HSTS cache for example).
+
+# TLS
+
+All current TLS libraries libcurl supports are thread-safe.
+
+## OpenSSL
+
+OpenSSL 1.1.0+ can be safely used in multi-threaded applications provided that
+support for the underlying OS threading API is built-in. For older versions of
+OpenSSL, the user must set mutex callbacks.
+
+libcurl may not be able to fully clean up after multi-threaded OpenSSL
+depending on how OpenSSL was built and loaded as a library. It is possible in
+some rare circumstances a memory leak could occur unless you implement your own
+OpenSSL thread cleanup.
+
+For example, on Windows if both libcurl and OpenSSL are linked statically to a
+DLL or application then OpenSSL may leak memory unless the DLL or application
+calls OPENSSL_thread_stop() before each thread terminates. If OpenSSL is built
+as a DLL then it does this cleanup automatically and there is no leak. If
+libcurl is built as a DLL and OpenSSL is linked statically to it then libcurl
+does this cleanup automatically and there is no leak (added in libcurl 8.8.0).
+
+Please review the OpenSSL documentation for a full list of circumstances:
+https://docs.openssl.org/3.0/man3/OPENSSL_init_crypto/#notes
+
+## mbedTLS
+
+mbedTLS can be used safely in a multi-threaded environment provided that mbedTLS is
+compiled with MBEDTLS_THREADING_C enabled.
+
+https://mbed-tls.readthedocs.io/en/latest/kb/development/thread-safety-and-multi-threading
+
+# Signals
+
+Signals are used for timing out name resolves (during DNS lookup) - when built
+without using either the c-ares or threaded resolver backends. On systems that
+have a signal concept.
+
+When using multiple threads you should set the CURLOPT_NOSIGNAL(3)
+option to 1L for all handles. Everything works fine except that timeouts
+cannot be honored during DNS lookups - which you can work around by building
+libcurl with c-ares or threaded-resolver support. c-ares is a library that
+provides asynchronous name resolves. On some platforms, libcurl cannot
+function properly multi-threaded unless the CURLOPT_NOSIGNAL(3) option
+is set.
+
+When CURLOPT_NOSIGNAL(3) is set to 1L, your application needs to deal
+with the risk of a SIGPIPE (that at least the OpenSSL backend can
+trigger). Note that setting CURLOPT_NOSIGNAL(3) to 0L does not work in a
+threaded situation as there is a race condition where libcurl risks restoring
+the former signal handler while another thread should still ignore it.
+
+# Name resolving
+
+The **gethostbyname** or **getaddrinfo** and other name resolving system
+calls used by libcurl are provided by your operating system and must be
+thread-safe. It is important that libcurl can find and use thread-safe versions
+of these and other system calls, as otherwise it cannot function fully
+thread-safe. Some operating systems are known to have faulty thread
+implementations. We have previously received problem reports on *BSD (at least
+in the past, they may be working fine these days). Some operating systems that
+are known to have solid and working thread support are Linux, Solaris and
+Windows.
+
+# curl_global_* functions
+
+These functions are thread-safe since libcurl 7.84.0 if
+curl_version_info(3) has the **CURL_VERSION_THREADSAFE** feature bit
+set (most platforms).
+
+If these functions are not thread-safe and you are using libcurl with multiple
+threads it is especially important that before use you call
+curl_global_init(3) or curl_global_init_mem(3) to explicitly
+initialize the library and its dependents, rather than rely on the "lazy"
+fail-safe initialization that takes place the first time
+curl_easy_init(3) is called. For an in-depth explanation refer to
+libcurl(3) section **GLOBAL CONSTANTS**.
+
+# Memory functions
+
+These functions, provided either by your operating system or your own
+replacements, must be thread-safe. You can use curl_global_init_mem(3)
+to set your own replacement memory functions.
+
+# Non-safe functions
+
+CURLOPT_DNS_USE_GLOBAL_CACHE(3) is not thread-safe.
+
+curl_version_info(3) is not thread-safe before libcurl initialization.
diff --git a/third-party/curl/docs/libcurl/libcurl-tutorial.3 b/third-party/curl/docs/libcurl/libcurl-tutorial.3
deleted file mode 100644
index 9c9a4b65f1..0000000000
--- a/third-party/curl/docs/libcurl/libcurl-tutorial.3
+++ /dev/null
@@ -1,1394 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH libcurl-tutorial 3 "19 Sep 2014" "libcurl" "libcurl"
-.SH NAME
-libcurl-tutorial \- libcurl programming tutorial
-.SH "Objective"
-This document attempts to describe the general principles and some basic
-approaches to consider when programming with libcurl. The text focuses on the
-C interface but should apply fairly well on other language bindings as well as
-they usually follow the C API pretty closely.
-
-This document refers to 'the user' as the person writing the source code that
-uses libcurl. That would probably be you or someone in your position.  What is
-generally referred to as 'the program' is the collected source code that you
-write that is using libcurl for transfers. The program is outside libcurl and
-libcurl is outside of the program.
-
-To get more details on all options and functions described herein, please
-refer to their respective man pages.
-
-.SH "Building"
-There are many different ways to build C programs. This chapter assumes a Unix
-style build process. If you use a different build system, you can still read
-this to get general information that may apply to your environment as well.
-.IP "Compiling the Program"
-Your compiler needs to know where the libcurl headers are located. Therefore
-you must set your compiler's include path to point to the directory where you
-installed them. The 'curl-config'[3] tool can be used to get this information:
-.nf
-  $ curl-config --cflags
-.fi
-.IP "Linking the Program with libcurl"
-When having compiled the program, you need to link your object files to create
-a single executable. For that to succeed, you need to link with libcurl and
-possibly also with other libraries that libcurl itself depends on. Like the
-OpenSSL libraries, but even some standard OS libraries may be needed on the
-command line. To figure out which flags to use, once again the 'curl-config'
-tool comes to the rescue:
-.nf
-  $ curl-config --libs
-.fi
-.IP "SSL or Not"
-libcurl can be built and customized in many ways. One of the things that
-varies from different libraries and builds is the support for SSL-based
-transfers, like HTTPS and FTPS. If a supported SSL library was detected
-properly at build-time, libcurl is built with SSL support. To figure out if an
-installed libcurl has been built with SSL support enabled, use \&'curl-config'
-like this:
-.nf
-  $ curl-config --feature
-.fi
-And if SSL is supported, the keyword \fISSL\fP is written to stdout, possibly
-together with a other features that could be either on or off on for different
-libcurls.
-
-See also the "Features libcurl Provides" further down.
-.IP "autoconf macro"
-When you write your configure script to detect libcurl and setup variables
-accordingly, we offer a macro that probably does everything you need in this
-area. See docs/libcurl/libcurl.m4 file - it includes docs on how to use it.
-
-.SH "Portable Code in a Portable World"
-The people behind libcurl have put a considerable effort to make libcurl work
-on a large amount of different operating systems and environments.
-
-You program libcurl the same way on all platforms that libcurl runs on. There
-are only a few minor details that differ. If you just make sure to write your
-code portable enough, you can create a portable program. libcurl should not
-stop you from that.
-
-.SH "Global Preparation"
-The program must initialize some of the libcurl functionality globally. That
-means it should be done exactly once, no matter how many times you intend to
-use the library. Once for your program's entire life time. This is done using
-.nf
- curl_global_init()
-.fi
-and it takes one parameter which is a bit pattern that tells libcurl what to
-initialize. Using \fICURL_GLOBAL_ALL\fP makes it initialize all known internal
-sub modules, and might be a good default option. The current two bits that are
-specified are:
-.RS
-.IP "CURL_GLOBAL_WIN32"
-which only does anything on Windows machines. When used on a Windows machine,
-it makes libcurl initialize the win32 socket stuff. Without having that
-initialized properly, your program cannot use sockets properly. You should
-only do this once for each application, so if your program already does this
-or of another library in use does it, you should not tell libcurl to do this
-as well.
-.IP CURL_GLOBAL_SSL
-which only does anything on libcurls compiled and built SSL-enabled. On these
-systems, this makes libcurl initialize the SSL library properly for this
-application. This only needs to be done once for each application so if your
-program or another library already does this, this bit should not be needed.
-.RE
-
-libcurl has a default protection mechanism that detects if
-\fIcurl_global_init(3)\fP has not been called by the time
-\fIcurl_easy_perform(3)\fP is called and if that is the case, libcurl runs the
-function itself with a guessed bit pattern. Please note that depending solely
-on this is not considered nice nor good.
-
-When the program no longer uses libcurl, it should call
-\fIcurl_global_cleanup(3)\fP, which is the opposite of the init call. It
-performs the reversed operations to cleanup the resources the
-\fIcurl_global_init(3)\fP call initialized.
-
-Repeated calls to \fIcurl_global_init(3)\fP and \fIcurl_global_cleanup(3)\fP
-should be avoided. They should only be called once each.
-
-.SH "Features libcurl Provides"
-It is considered best-practice to determine libcurl features at runtime rather
-than at build-time (if possible of course). By calling
-\fIcurl_version_info(3)\fP and checking out the details of the returned
-struct, your program can figure out exactly what the currently running libcurl
-supports.
-
-.SH "Two Interfaces"
-libcurl first introduced the so called easy interface. All operations in the
-easy interface are prefixed with 'curl_easy'. The easy interface lets you do
-single transfers with a synchronous and blocking function call.
-
-libcurl also offers another interface that allows multiple simultaneous
-transfers in a single thread, the so called multi interface. More about that
-interface is detailed in a separate chapter further down. You still need to
-understand the easy interface first, so please continue reading for better
-understanding.
-.SH "Handle the Easy libcurl"
-To use the easy interface, you must first create yourself an easy handle. You
-need one handle for each easy session you want to perform. Basically, you
-should use one handle for every thread you plan to use for transferring. You
-must never share the same handle in multiple threads.
-
-Get an easy handle with
-.nf
- handle = curl_easy_init();
-.fi
-It returns an easy handle. Using that you proceed to the next step: setting
-up your preferred actions. A handle is just a logic entity for the upcoming
-transfer or series of transfers.
-
-You set properties and options for this handle using
-\fIcurl_easy_setopt(3)\fP. They control how the subsequent transfer or
-transfers using this handle are made. Options remain set in the handle until
-set again to something different. They are sticky. Multiple requests using the
-same handle use the same options.
-
-If you at any point would like to blank all previously set options for a
-single easy handle, you can call \fIcurl_easy_reset(3)\fP and you can also
-make a clone of an easy handle (with all its set options) using
-\fIcurl_easy_duphandle(3)\fP.
-
-Many of the options you set in libcurl are "strings", pointers to data
-terminated with a zero byte. When you set strings with
-\fIcurl_easy_setopt(3)\fP, libcurl makes its own copy so that they do not need
-to be kept around in your application after being set[4].
-
-One of the most basic properties to set in the handle is the URL. You set your
-preferred URL to transfer with \fICURLOPT_URL(3)\fP in a manner similar to:
-
-.nf
- curl_easy_setopt(handle, CURLOPT_URL, "http://domain.com/");
-.fi
-
-Let's assume for a while that you want to receive data as the URL identifies a
-remote resource you want to get here. Since you write a sort of application
-that needs this transfer, I assume that you would like to get the data passed
-to you directly instead of simply getting it passed to stdout. So, you write
-your own function that matches this prototype:
-.nf
- size_t write_data(void *buffer, size_t size, size_t nmemb, void *userp);
-.fi
-You tell libcurl to pass all data to this function by issuing a function
-similar to this:
-.nf
- curl_easy_setopt(handle, CURLOPT_WRITEFUNCTION, write_data);
-.fi
-You can control what data your callback function gets in the fourth argument
-by setting another property:
-.nf
- curl_easy_setopt(handle, CURLOPT_WRITEDATA, &internal_struct);
-.fi
-Using that property, you can easily pass local data between your application
-and the function that gets invoked by libcurl. libcurl itself does not touch
-the data you pass with \fICURLOPT_WRITEDATA(3)\fP.
-
-libcurl offers its own default internal callback that takes care of the data
-if you do not set the callback with \fICURLOPT_WRITEFUNCTION(3)\fP. It simply
-outputs the received data to stdout. You can have the default callback write
-the data to a different file handle by passing a 'FILE *' to a file opened for
-writing with the \fICURLOPT_WRITEDATA(3)\fP option.
-
-Now, we need to take a step back and take a deep breath. Here is one of those
-rare platform-dependent nitpicks. Did you spot it? On some platforms[2],
-libcurl is not able to operate on file handles opened by the
-program. Therefore, if you use the default callback and pass in an open file
-handle with \fICURLOPT_WRITEDATA(3)\fP, libcurl crashes. You should avoid this
-to make your program run fine virtually everywhere.
-
-(\fICURLOPT_WRITEDATA(3)\fP was formerly known as \fICURLOPT_FILE\fP. Both
-names still work and do the same thing).
-
-If you are using libcurl as a win32 DLL, you MUST use the
-\fICURLOPT_WRITEFUNCTION(3)\fP if you set \fICURLOPT_WRITEDATA(3)\fP - or
-experience crashes.
-
-There are of course many more options you can set, and we get back to a few of
-them later. Let's instead continue to the actual transfer:
-.nf
- success = curl_easy_perform(handle);
-.fi
-\fIcurl_easy_perform(3)\fP connects to the remote site, does the necessary
-commands and performs the transfer. Whenever it receives data, it calls the
-callback function we previously set. The function may get one byte at a time,
-or it may get many kilobytes at once. libcurl delivers as much as possible as
-often as possible. Your callback function should return the number of bytes it
-\&"took care of". If that is not the same amount of bytes that was passed to
-it, libcurl aborts the operation and returns with an error code.
-
-When the transfer is complete, the function returns a return code that informs
-you if it succeeded in its mission or not. If a return code is not enough for
-you, you can use the \fICURLOPT_ERRORBUFFER(3)\fP to point libcurl to a buffer
-of yours where it stores a human readable error message as well.
-
-If you then want to transfer another file, the handle is ready to be used
-again. It is even preferred and encouraged that you reuse an existing handle
-if you intend to make another transfer. libcurl then attempts to reuse a
-previous connection.
-
-For some protocols, downloading a file can involve a complicated process of
-logging in, setting the transfer mode, changing the current directory and
-finally transferring the file data. libcurl takes care of all that
-complication for you. Given simply the URL to a file, libcurl takes care of
-all the details needed to get the file moved from one machine to another.
-
-.SH "Multi-threading Issues"
-libcurl is thread safe but there are a few exceptions. Refer to
-\fIlibcurl-thread(3)\fP for more information.
-
-.SH "When It does not Work"
-There are times when the transfer fails for some reason. You might have set
-the wrong libcurl option or misunderstood what the libcurl option actually
-does, or the remote server might return non-standard replies that confuse the
-library which then confuses your program.
-
-There is one golden rule when these things occur: set the
-\fICURLOPT_VERBOSE(3)\fP option to 1. it causes the library to spew out the
-entire protocol details it sends, some internal info and some received
-protocol data as well (especially when using FTP). If you are using HTTP,
-adding the headers in the received output to study is also a clever way to get
-a better understanding why the server behaves the way it does. Include headers
-in the normal body output with \fICURLOPT_HEADER(3)\fP set 1.
-
-Of course, there are bugs left. We need to know about them to be able to fix
-them, so we are quite dependent on your bug reports. When you do report
-suspected bugs in libcurl, please include as many details as you possibly can:
-a protocol dump that \fICURLOPT_VERBOSE(3)\fP produces, library version, as
-much as possible of your code that uses libcurl, operating system name and
-version, compiler name and version etc.
-
-If \fICURLOPT_VERBOSE(3)\fP is not enough, you increase the level of debug
-data your application receive by using the \fICURLOPT_DEBUGFUNCTION(3)\fP.
-
-Getting some in-depth knowledge about the protocols involved is never wrong,
-and if you are trying to do funny things, you might understand libcurl and how
-to use it better if you study the appropriate RFC documents at least briefly.
-
-.SH "Upload Data to a Remote Site"
-libcurl tries to keep a protocol independent approach to most transfers, thus
-uploading to a remote FTP site is similar to uploading data to an HTTP server
-with a PUT request.
-
-Of course, first you either create an easy handle or you reuse one existing
-one. Then you set the URL to operate on just like before. This is the remote
-URL, that we now upload.
-
-Since we write an application, we most likely want libcurl to get the upload
-data by asking us for it. To make it do that, we set the read callback and the
-custom pointer libcurl passes to our read callback. The read callback should
-have a prototype similar to:
-.nf
- size_t function(char *bufptr, size_t size, size_t nitems, void *userp);
-.fi
-Where \fIbufptr\fP is the pointer to a buffer we fill in with data to upload
-and \fIsize*nitems\fP is the size of the buffer and therefore also the maximum
-amount of data we can return to libcurl in this call. The \fIuserp\fP pointer
-is the custom pointer we set to point to a struct of ours to pass private data
-between the application and the callback.
-.nf
- curl_easy_setopt(handle, CURLOPT_READFUNCTION, read_function);
-
- curl_easy_setopt(handle, CURLOPT_READDATA, &filedata);
-.fi
-Tell libcurl that we want to upload:
-.nf
- curl_easy_setopt(handle, CURLOPT_UPLOAD, 1L);
-.fi
-A few protocols do not behave properly when uploads are done without any prior
-knowledge of the expected file size. So, set the upload file size using the
-\fICURLOPT_INFILESIZE_LARGE(3)\fP for all known file sizes like this[1]:
-
-.nf
- /* in this example, file_size must be an curl_off_t variable */
- curl_easy_setopt(handle, CURLOPT_INFILESIZE_LARGE, file_size);
-.fi
-
-When you call \fIcurl_easy_perform(3)\fP this time, it performs all the
-necessary operations and when it has invoked the upload it calls your supplied
-callback to get the data to upload. The program should return as much data as
-possible in every invoke, as that is likely to make the upload perform as fast
-as possible. The callback should return the number of bytes it wrote in the
-buffer. Returning 0 signals the end of the upload.
-
-.SH "Passwords"
-Many protocols use or even require that user name and password are provided
-to be able to download or upload the data of your choice. libcurl offers
-several ways to specify them.
-
-Most protocols support that you specify the name and password in the URL
-itself. libcurl detects this and use them accordingly. This is written like
-this:
-.nf
- protocol://user:password@example.com/path/
-.fi
-If you need any odd letters in your user name or password, you should enter
-them URL encoded, as %XX where XX is a two-digit hexadecimal number.
-
-libcurl also provides options to set various passwords. The user name and
-password as shown embedded in the URL can instead get set with the
-\fICURLOPT_USERPWD(3)\fP option. The argument passed to libcurl should be a
-char * to a string in the format "user:password". In a manner like this:
-.nf
- curl_easy_setopt(handle, CURLOPT_USERPWD, "myname:thesecret");
-.fi
-Another case where name and password might be needed at times, is for those
-users who need to authenticate themselves to a proxy they use. libcurl offers
-another option for this, the \fICURLOPT_PROXYUSERPWD(3)\fP. It is used quite
-similar to the \fICURLOPT_USERPWD(3)\fP option like this:
-.nf
- curl_easy_setopt(handle, CURLOPT_PROXYUSERPWD, "myname:thesecret");
-.fi
-There is a long time Unix "standard" way of storing FTP user names and
-passwords, namely in the $HOME/.netrc file (on Windows, libcurl also checks
-the \fI%USERPROFILE% environment\fP variable if \fI%HOME%\fP is unset, and
-tries "_netrc" as name). The file should be made private so that only the user
-may read it (see also the "Security Considerations" chapter), as it might
-contain the password in plain text. libcurl has the ability to use this file
-to figure out what set of user name and password to use for a particular
-host. As an extension to the normal functionality, libcurl also supports this
-file for non-FTP protocols such as HTTP. To make curl use this file, use the
-\fICURLOPT_NETRC(3)\fP option:
-.nf
- curl_easy_setopt(handle, CURLOPT_NETRC, 1L);
-.fi
-And a basic example of how such a .netrc file may look like:
-
-.nf
- machine myhost.mydomain.com
- login userlogin
- password secretword
-.fi
-
-All these examples have been cases where the password has been optional, or
-at least you could leave it out and have libcurl attempt to do its job
-without it. There are times when the password is not optional, like when
-you are using an SSL private key for secure transfers.
-
-To pass the known private key password to libcurl:
-.nf
- curl_easy_setopt(handle, CURLOPT_KEYPASSWD, "keypassword");
-.fi
-.SH "HTTP Authentication"
-The previous chapter showed how to set user name and password for getting URLs
-that require authentication. When using the HTTP protocol, there are many
-different ways a client can provide those credentials to the server and you
-can control which way libcurl uses them. The default HTTP authentication
-method is called 'Basic', which is sending the name and password in clear-text
-in the HTTP request, base64-encoded. This is insecure.
-
-At the time of this writing, libcurl can be built to use: Basic, Digest, NTLM,
-Negotiate (SPNEGO). You can tell libcurl which one to use
-with \fICURLOPT_HTTPAUTH(3)\fP as in:
-.nf
- curl_easy_setopt(handle, CURLOPT_HTTPAUTH, CURLAUTH_DIGEST);
-.fi
-And when you send authentication to a proxy, you can also set authentication
-type the same way but instead with \fICURLOPT_PROXYAUTH(3)\fP:
-.nf
- curl_easy_setopt(handle, CURLOPT_PROXYAUTH, CURLAUTH_NTLM);
-.fi
-Both these options allow you to set multiple types (by ORing them together),
-to make libcurl pick the most secure one out of the types the server/proxy
-claims to support. This method does however add a round-trip since libcurl
-must first ask the server what it supports:
-.nf
- curl_easy_setopt(handle, CURLOPT_HTTPAUTH, CURLAUTH_DIGEST|CURLAUTH_BASIC);
-.fi
-For convenience, you can use the \fICURLAUTH_ANY\fP define (instead of a list
-with specific types) which allows libcurl to use whatever method it wants.
-
-When asking for multiple types, libcurl picks the available one it considers
-"best" in its own internal order of preference.
-
-.SH "HTTP POSTing"
-We get many questions regarding how to issue HTTP POSTs with libcurl the
-proper way. This chapter thus includes examples using both different versions
-of HTTP POST that libcurl supports.
-
-The first version is the simple POST, the most common version, that most HTML
-pages using the <form> tag uses. We provide a pointer to the data and tell
-libcurl to post it all to the remote site:
-
-.nf
-    char *data="name=daniel&project=curl";
-    curl_easy_setopt(handle, CURLOPT_POSTFIELDS, data);
-    curl_easy_setopt(handle, CURLOPT_URL, "http://posthere.com/");
-
-    curl_easy_perform(handle); /* post away! */
-.fi
-
-Simple enough, huh? Since you set the POST options with the
-\fICURLOPT_POSTFIELDS(3)\fP, this automatically switches the handle to use
-POST in the upcoming request.
-
-What if you want to post binary data that also requires you to set the
-Content-Type: header of the post? Well, binary posts prevent libcurl from being
-able to do strlen() on the data to figure out the size, so therefore we must
-tell libcurl the size of the post data. Setting headers in libcurl requests are
-done in a generic way, by building a list of our own headers and then passing
-that list to libcurl.
-
-.nf
- struct curl_slist *headers=NULL;
- headers = curl_slist_append(headers, "Content-Type: text/xml");
-
- /* post binary data */
- curl_easy_setopt(handle, CURLOPT_POSTFIELDS, binaryptr);
-
- /* set the size of the postfields data */
- curl_easy_setopt(handle, CURLOPT_POSTFIELDSIZE, 23L);
-
- /* pass our list of custom made headers */
- curl_easy_setopt(handle, CURLOPT_HTTPHEADER, headers);
-
- curl_easy_perform(handle); /* post away! */
-
- curl_slist_free_all(headers); /* free the header list */
-.fi
-
-While the simple examples above cover the majority of all cases where HTTP
-POST operations are required, they do not do multi-part formposts. Multi-part
-formposts were introduced as a better way to post (possibly large) binary data
-and were first documented in the RFC 1867 (updated in RFC 2388). they are
-called multi-part because they are built by a chain of parts, each part being
-a single unit of data. Each part has its own name and contents. You can in
-fact create and post a multi-part formpost with the regular libcurl POST
-support described above, but that would require that you build a formpost
-yourself and provide to libcurl. To make that easier, libcurl provides a MIME
-API consisting in several functions: using those, you can create and fill a
-multi-part form.  Function \fIcurl_mime_init(3)\fP creates a multi-part body;
-you can then append new parts to a multi-part body using
-\fIcurl_mime_addpart(3)\fP.  There are three possible data sources for a part:
-memory using \fIcurl_mime_data(3)\fP, file using \fIcurl_mime_filedata(3)\fP
-and user-defined data read callback using \fIcurl_mime_data_cb(3)\fP.
-\fIcurl_mime_name(3)\fP sets a part's (i.e.: form field) name, while
-\fIcurl_mime_filename(3)\fP fills in the remote file name. With
-\fIcurl_mime_type(3)\fP, you can tell the MIME type of a part,
-\fIcurl_mime_headers(3)\fP allows defining the part's headers. When a
-multi-part body is no longer needed, you can destroy it using
-\fIcurl_mime_free(3)\fP.
-
-The following example sets two simple text parts with plain textual contents,
-and then a file with binary contents and uploads the whole thing.
-
-.nf
- curl_mime *multipart = curl_mime_init(handle);
- curl_mimepart *part = curl_mime_addpart(multipart);
- curl_mime_name(part, "name");
- curl_mime_data(part, "daniel", CURL_ZERO_TERMINATED);
- part = curl_mime_addpart(multipart);
- curl_mime_name(part, "project");
- curl_mime_data(part, "curl", CURL_ZERO_TERMINATED);
- part = curl_mime_addpart(multipart);
- curl_mime_name(part, "logotype-image");
- curl_mime_filedata(part, "curl.png");
-
- /* Set the form info */
- curl_easy_setopt(handle, CURLOPT_MIMEPOST, multipart);
-
- curl_easy_perform(handle); /* post away! */
-
- /* free the post data again */
- curl_mime_free(multipart);
-.fi
-
-To post multiple files for a single form field, you must supply each file in
-a separate part, all with the same field name. Although function
-\fIcurl_mime_subparts(3)\fP implements nested multi-parts, this way of
-multiple files posting is deprecated by RFC 7578, chapter 4.3.
-
-To set the data source from an already opened FILE pointer, use:
-
-.nf
- curl_mime_data_cb(part, filesize, (curl_read_callback) fread,
-                   (curl_seek_callback) fseek, NULL, filepointer);
-.fi
-
-A deprecated \fIcurl_formadd(3)\fP function is still supported in libcurl.
-It should however not be used anymore for new designs and programs using it
-ought to be converted to the MIME API. It is however described here as an
-aid to conversion.
-
-Using \fIcurl_formadd\fP, you add parts to the form. When you are done adding
-parts, you post the whole form.
-
-The MIME API example above is expressed as follows using this function:
-
-.nf
- struct curl_httppost *post=NULL;
- struct curl_httppost *last=NULL;
- curl_formadd(&post, &last,
-              CURLFORM_COPYNAME, "name",
-              CURLFORM_COPYCONTENTS, "daniel", CURLFORM_END);
- curl_formadd(&post, &last,
-              CURLFORM_COPYNAME, "project",
-              CURLFORM_COPYCONTENTS, "curl", CURLFORM_END);
- curl_formadd(&post, &last,
-              CURLFORM_COPYNAME, "logotype-image",
-              CURLFORM_FILECONTENT, "curl.png", CURLFORM_END);
-
- /* Set the form info */
- curl_easy_setopt(handle, CURLOPT_HTTPPOST, post);
-
- curl_easy_perform(handle); /* post away! */
-
- /* free the post data again */
- curl_formfree(post);
-.fi
-
-Multipart formposts are chains of parts using MIME-style separators and
-headers. It means that each one of these separate parts get a few headers set
-that describe the individual content-type, size etc. To enable your
-application to handicraft this formpost even more, libcurl allows you to
-supply your own set of custom headers to such an individual form part. You can
-of course supply headers to as many parts as you like, but this little example
-shows how you set headers to one specific part when you add that to the post
-handle:
-
-.nf
- struct curl_slist *headers=NULL;
- headers = curl_slist_append(headers, "Content-Type: text/xml");
-
- curl_formadd(&post, &last,
-              CURLFORM_COPYNAME, "logotype-image",
-              CURLFORM_FILECONTENT, "curl.xml",
-              CURLFORM_CONTENTHEADER, headers,
-              CURLFORM_END);
-
- curl_easy_perform(handle); /* post away! */
-
- curl_formfree(post); /* free post */
- curl_slist_free_all(headers); /* free custom header list */
-.fi
-
-Since all options on an easy handle are "sticky", they remain the same until
-changed even if you do call \fIcurl_easy_perform(3)\fP, you may need to tell
-curl to go back to a plain GET request if you intend to do one as your next
-request. You force an easy handle to go back to GET by using the
-\fICURLOPT_HTTPGET(3)\fP option:
-.nf
- curl_easy_setopt(handle, CURLOPT_HTTPGET, 1L);
-.fi
-Just setting \fICURLOPT_POSTFIELDS(3)\fP to "" or NULL does *not* stop libcurl
-from doing a POST. It just makes it POST without any data to send!
-
-.SH "Converting from deprecated form API to MIME API"
-Four rules have to be respected in building the multi-part:
-.br
-- The easy handle must be created before building the multi-part.
-.br
-- The multi-part is always created by a call to curl_mime_init(handle).
-.br
-- Each part is created by a call to curl_mime_addpart(multipart).
-.br
-- When complete, the multi-part must be bound to the easy handle using
-\fICURLOPT_MIMEPOST(3)\fP instead of \fICURLOPT_HTTPPOST(3)\fP.
-
-Here are some example of \fIcurl_formadd\fP calls to MIME API sequences:
-
-.nf
- curl_formadd(&post, &last,
-              CURLFORM_COPYNAME, "id",
-              CURLFORM_COPYCONTENTS, "daniel", CURLFORM_END);
-              CURLFORM_CONTENTHEADER, headers,
-              CURLFORM_END);
-.fi
-becomes:
-.nf
- part = curl_mime_addpart(multipart);
- curl_mime_name(part, "id");
- curl_mime_data(part, "daniel", CURL_ZERO_TERMINATED);
- curl_mime_headers(part, headers, FALSE);
-.fi
-
-Setting the last \fIcurl_mime_headers\fP argument to TRUE would have caused
-the headers to be automatically released upon destroyed the multi-part, thus
-saving a clean-up call to \fIcurl_slist_free_all(3)\fP.
-
-.nf
- curl_formadd(&post, &last,
-              CURLFORM_PTRNAME, "logotype-image",
-              CURLFORM_FILECONTENT, "-",
-              CURLFORM_END);
-.fi
-becomes:
-.nf
- part = curl_mime_addpart(multipart);
- curl_mime_name(part, "logotype-image");
- curl_mime_data_cb(part, (curl_off_t) -1, fread, fseek, NULL, stdin);
-.fi
-
-\fIcurl_mime_name\fP always copies the field name. The special file name "-"
-is not supported by \fIcurl_mime_file\fP: to read an open file, use a callback
-source using fread(). The transfer is be chunk-encoded since the data size is
-unknown.
-
-.nf
- curl_formadd(&post, &last,
-              CURLFORM_COPYNAME, "datafile[]",
-              CURLFORM_FILE, "file1",
-              CURLFORM_FILE, "file2",
-              CURLFORM_END);
-.fi
-becomes:
-.nf
- part = curl_mime_addpart(multipart);
- curl_mime_name(part, "datafile[]");
- curl_mime_filedata(part, "file1");
- part = curl_mime_addpart(multipart);
- curl_mime_name(part, "datafile[]");
- curl_mime_filedata(part, "file2");
-.fi
-
-The deprecated multipart/mixed implementation of multiple files field is
-translated to two distinct parts with the same name.
-
-.nf
- curl_easy_setopt(handle, CURLOPT_READFUNCTION, myreadfunc);
- curl_formadd(&post, &last,
-              CURLFORM_COPYNAME, "stream",
-              CURLFORM_STREAM, arg,
-              CURLFORM_CONTENTLEN, (curl_off_t) datasize,
-              CURLFORM_FILENAME, "archive.zip",
-              CURLFORM_CONTENTTYPE, "application/zip",
-              CURLFORM_END);
-.fi
-becomes:
-.nf
- part = curl_mime_addpart(multipart);
- curl_mime_name(part, "stream");
- curl_mime_data_cb(part, (curl_off_t) datasize,
-                   myreadfunc, NULL, NULL, arg);
- curl_mime_filename(part, "archive.zip");
- curl_mime_type(part, "application/zip");
-.fi
-
-\fICURLOPT_READFUNCTION\fP callback is not used: it is replace by directly
-setting the part source data from the callback read function.
-
-.nf
- curl_formadd(&post, &last,
-              CURLFORM_COPYNAME, "memfile",
-              CURLFORM_BUFFER, "memfile.bin",
-              CURLFORM_BUFFERPTR, databuffer,
-              CURLFORM_BUFFERLENGTH, (long) sizeof databuffer,
-              CURLFORM_END);
-.fi
-becomes:
-.nf
- part = curl_mime_addpart(multipart);
- curl_mime_name(part, "memfile");
- curl_mime_data(part, databuffer, (curl_off_t) sizeof databuffer);
- curl_mime_filename(part, "memfile.bin");
-.fi
-
-\fIcurl_mime_data\fP always copies the initial data: data buffer is thus
-free for immediate reuse.
-
-.nf
- curl_formadd(&post, &last,
-              CURLFORM_COPYNAME, "message",
-              CURLFORM_FILECONTENT, "msg.txt",
-              CURLFORM_END);
-.fi
-becomes:
-.nf
- part = curl_mime_addpart(multipart);
- curl_mime_name(part, "message");
- curl_mime_filedata(part, "msg.txt");
- curl_mime_filename(part, NULL);
-.fi
-
-Use of \fIcurl_mime_filedata\fP sets the remote file name as a side effect: it
-is therefore necessary to clear it for \fICURLFORM_FILECONTENT\fP emulation.
-
-.SH "Showing Progress"
-
-For historical and traditional reasons, libcurl has a built-in progress meter
-that can be switched on and then makes it present a progress meter in your
-terminal.
-
-Switch on the progress meter by, oddly enough, setting
-\fICURLOPT_NOPROGRESS(3)\fP to zero. This option is set to 1 by default.
-
-For most applications however, the built-in progress meter is useless and what
-instead is interesting is the ability to specify a progress callback. The
-function pointer you pass to libcurl is then called on irregular intervals
-with information about the current transfer.
-
-Set the progress callback by using \fICURLOPT_PROGRESSFUNCTION(3)\fP. And pass
-a pointer to a function that matches this prototype:
-
-.nf
- int progress_callback(void *clientp,
-                       double dltotal,
-                       double dlnow,
-                       double ultotal,
-                       double ulnow);
-.fi
-
-If any of the input arguments is unknown, a 0 is provided. The first argument,
-the 'clientp' is the pointer you pass to libcurl with
-\fICURLOPT_PROGRESSDATA(3)\fP. libcurl does not touch it.
-
-.SH "libcurl with C++"
-
-There is basically only one thing to keep in mind when using C++ instead of C
-when interfacing libcurl:
-
-The callbacks CANNOT be non-static class member functions
-
-Example C++ code:
-
-.nf
-class AClass {
-    static size_t write_data(void *ptr, size_t size, size_t nmemb,
-                             void *ourpointer)
-    {
-      /* do what you want with the data */
-    }
- }
-.fi
-
-.SH "Proxies"
-
-What "proxy" means according to Merriam-Webster: "a person authorized to act
-for another" but also "the agency, function, or office of a deputy who acts as
-a substitute for another".
-
-Proxies are exceedingly common these days. Companies often only offer Internet
-access to employees through their proxies. Network clients or user-agents ask
-the proxy for documents, the proxy does the actual request and then it returns
-them.
-
-libcurl supports SOCKS and HTTP proxies. When a given URL is wanted, libcurl
-asks the proxy for it instead of trying to connect to the actual remote host
-identified in the URL.
-
-If you are using a SOCKS proxy, you may find that libcurl does not quite support
-all operations through it.
-
-For HTTP proxies: the fact that the proxy is an HTTP proxy puts certain
-restrictions on what can actually happen. A requested URL that might not be a
-HTTP URL is passed to the HTTP proxy to deliver back to libcurl. This happens
-transparently, and an application may not need to know. I say "may", because
-at times it is important to understand that all operations over an HTTP proxy
-use the HTTP protocol. For example, you cannot invoke your own custom FTP
-commands or even proper FTP directory listings.
-
-.IP "Proxy Options"
-
-To tell libcurl to use a proxy at a given port number:
-.nf
- curl_easy_setopt(handle, CURLOPT_PROXY, "proxy-host.com:8080");
-.fi
-Some proxies require user authentication before allowing a request, and you
-pass that information similar to this:
-.nf
- curl_easy_setopt(handle, CURLOPT_PROXYUSERPWD, "user:password");
-.fi
-If you want to, you can specify the host name only in the
-\fICURLOPT_PROXY(3)\fP option, and set the port number separately with
-\fICURLOPT_PROXYPORT(3)\fP.
-
-Tell libcurl what kind of proxy it is with \fICURLOPT_PROXYTYPE(3)\fP (if not,
-it defaults to assuming an HTTP proxy):
-.nf
- curl_easy_setopt(handle, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS4);
-.fi
-.IP "Environment Variables"
-
-libcurl automatically checks and uses a set of environment variables to know
-what proxies to use for certain protocols. The names of the variables are
-following an old tradition and are built up as "[protocol]_proxy" (note the
-lower casing). Which makes the variable \&'http_proxy' checked for a name of a
-proxy to use when the input URL is HTTP. Following the same rule, the variable
-named 'ftp_proxy' is checked for FTP URLs. Again, the proxies are always HTTP
-proxies, the different names of the variables simply allows different HTTP
-proxies to be used.
-
-The proxy environment variable contents should be in the format
-\&"[protocol://][user:password@]machine[:port]". Where the protocol:// part
-specifies which type of proxy it is, and the optional port number specifies on
-which port the proxy operates. If not specified, the internal default port
-number is used and that is most likely not the one you would like it to be.
-
-There are two special environment variables. 'all_proxy' is what sets proxy
-for any URL in case the protocol specific variable was not set, and
-\&'no_proxy' defines a list of hosts that should not use a proxy even though a
-variable may say so. If 'no_proxy' is a plain asterisk ("*") it matches all
-hosts.
-
-To explicitly disable libcurl's checking for and using the proxy environment
-variables, set the proxy name to "" - an empty string - with
-\fICURLOPT_PROXY(3)\fP.
-.IP "SSL and Proxies"
-
-SSL is for secure point-to-point connections. This involves strong encryption
-and similar things, which effectively makes it impossible for a proxy to
-operate as a "man in between" which the proxy's task is, as previously
-discussed. Instead, the only way to have SSL work over an HTTP proxy is to ask
-the proxy to tunnel everything through without being able to check or fiddle
-with the traffic.
-
-Opening an SSL connection over an HTTP proxy is therefore a matter of asking the
-proxy for a straight connection to the target host on a specified port. This
-is made with the HTTP request CONNECT. ("please dear proxy, connect me to that
-remote host").
-
-Because of the nature of this operation, where the proxy has no idea what kind
-of data that is passed in and out through this tunnel, this breaks some of the
-few advantages that come from using a proxy, such as caching. Many
-organizations prevent this kind of tunneling to other destination port numbers
-than 443 (which is the default HTTPS port number).
-
-.IP "Tunneling Through Proxy"
-As explained above, tunneling is required for SSL to work and often even
-restricted to the operation intended for SSL; HTTPS.
-
-This is however not the only time proxy-tunneling might offer benefits to
-you or your application.
-
-As tunneling opens a direct connection from your application to the remote
-machine, it suddenly also re-introduces the ability to do non-HTTP
-operations over an HTTP proxy. You can in fact use things such as FTP
-upload or FTP custom commands this way.
-
-Again, this is often prevented by the administrators of proxies and is
-rarely allowed.
-
-Tell libcurl to use proxy tunneling like this:
-.nf
- curl_easy_setopt(handle, CURLOPT_HTTPPROXYTUNNEL, 1L);
-.fi
-In fact, there might even be times when you want to do plain HTTP operations
-using a tunnel like this, as it then enables you to operate on the remote
-server instead of asking the proxy to do so. libcurl does not stand in the way
-for such innovative actions either!
-
-.IP "Proxy Auto-Config"
-
-Netscape first came up with this. It is basically a web page (usually using a
-\&.pac extension) with a JavaScript that when executed by the browser with the
-requested URL as input, returns information to the browser on how to connect
-to the URL. The returned information might be "DIRECT" (which means no proxy
-should be used), "PROXY host:port" (to tell the browser where the proxy for
-this particular URL is) or "SOCKS host:port" (to direct the browser to a SOCKS
-proxy).
-
-libcurl has no means to interpret or evaluate JavaScript and thus it does not
-support this. If you get yourself in a position where you face this nasty
-invention, the following advice have been mentioned and used in the past:
-
-- Depending on the JavaScript complexity, write up a script that translates it
-to another language and execute that.
-
-- Read the JavaScript code and rewrite the same logic in another language.
-
-- Implement a JavaScript interpreter; people have successfully used the
-Mozilla JavaScript engine in the past.
-
-- Ask your admins to stop this, for a static proxy setup or similar.
-
-.SH "Persistence Is The Way to Happiness"
-
-Re-cycling the same easy handle several times when doing multiple requests is
-the way to go.
-
-After each single \fIcurl_easy_perform(3)\fP operation, libcurl keeps the
-connection alive and open. A subsequent request using the same easy handle to
-the same host might just be able to use the already open connection! This
-reduces network impact a lot.
-
-Even if the connection is dropped, all connections involving SSL to the same
-host again, benefit from libcurl's session ID cache that drastically reduces
-re-connection time.
-
-FTP connections that are kept alive save a lot of time, as the command-
-response round-trips are skipped, and also you do not risk getting blocked
-without permission to login again like on many FTP servers only allowing N
-persons to be logged in at the same time.
-
-libcurl caches DNS name resolving results, to make lookups of a previously
-looked up name a lot faster.
-
-Other interesting details that improve performance for subsequent requests
-may also be added in the future.
-
-Each easy handle attempts to keep the last few connections alive for a while
-in case they are to be used again. You can set the size of this "cache" with
-the \fICURLOPT_MAXCONNECTS(3)\fP option. Default is 5. There is rarely any
-point in changing this value, and if you think of changing this it is often
-just a matter of thinking again.
-
-To force your upcoming request to not use an already existing connection, you
-can do that by setting \fICURLOPT_FRESH_CONNECT(3)\fP to 1. In a similar
-spirit, you can also forbid the upcoming request to be "lying" around and
-possibly get reused after the request by setting
-\fICURLOPT_FORBID_REUSE(3)\fP to 1.
-
-.SH "HTTP Headers Used by libcurl"
-When you use libcurl to do HTTP requests, it passes along a series of headers
-automatically. It might be good for you to know and understand these. You can
-replace or remove them by using the \fICURLOPT_HTTPHEADER(3)\fP option.
-
-.IP "Host"
-This header is required by HTTP 1.1 and even many 1.0 servers and should be
-the name of the server we want to talk to. This includes the port number if
-anything but default.
-
-.IP "Accept"
-\&"*/*".
-
-.IP "Expect"
-When doing POST requests, libcurl sets this header to \&"100-continue" to ask
-the server for an "OK" message before it proceeds with sending the data part
-of the post. If the posted data amount is deemed "small", libcurl does not use
-this header.
-
-.SH "Customizing Operations"
-There is an ongoing development today where more and more protocols are built
-upon HTTP for transport. This has obvious benefits as HTTP is a tested and
-reliable protocol that is widely deployed and has excellent proxy-support.
-
-When you use one of these protocols, and even when doing other kinds of
-programming you may need to change the traditional HTTP (or FTP or...)
-manners. You may need to change words, headers or various data.
-
-libcurl is your friend here too.
-
-.IP CUSTOMREQUEST
-If just changing the actual HTTP request keyword is what you want, like when
-GET, HEAD or POST is not good enough for you, \fICURLOPT_CUSTOMREQUEST(3)\fP
-is there for you. It is simple to use:
-.nf
- curl_easy_setopt(handle, CURLOPT_CUSTOMREQUEST, "MYOWNREQUEST");
-.fi
-When using the custom request, you change the request keyword of the actual
-request you are performing. Thus, by default you make a GET request but you can
-also make a POST operation (as described before) and then replace the POST
-keyword if you want to. you are the boss.
-
-.IP "Modify Headers"
-HTTP-like protocols pass a series of headers to the server when doing the
-request, and you are free to pass any amount of extra headers that you
-think fit. Adding headers is this easy:
-
-.nf
- struct curl_slist *headers=NULL; /* init to NULL is important */
-
- headers = curl_slist_append(headers, "Hey-server-hey: how are you?");
- headers = curl_slist_append(headers, "X-silly-content: yes");
-
- /* pass our list of custom made headers */
- curl_easy_setopt(handle, CURLOPT_HTTPHEADER, headers);
-
- curl_easy_perform(handle); /* transfer http */
-
- curl_slist_free_all(headers); /* free the header list */
-.fi
-
-\&... and if you think some of the internally generated headers, such as
-Accept: or Host: do not contain the data you want them to contain, you can
-replace them by simply setting them too:
-
-.nf
- headers = curl_slist_append(headers, "Accept: Agent-007");
- headers = curl_slist_append(headers, "Host: munged.host.line");
-.fi
-
-.IP "Delete Headers"
-If you replace an existing header with one with no contents, you prevent the
-header from being sent. For instance, if you want to completely prevent the
-\&"Accept:" header from being sent, you can disable it with code similar to
-this:
-
- headers = curl_slist_append(headers, "Accept:");
-
-Both replacing and canceling internal headers should be done with careful
-consideration and you should be aware that you may violate the HTTP protocol
-when doing so.
-
-.IP "Enforcing chunked transfer-encoding"
-
-By making sure a request uses the custom header "Transfer-Encoding: chunked"
-when doing a non-GET HTTP operation, libcurl switches over to "chunked"
-upload, even though the size of the data to upload might be known. By default,
-libcurl usually switches over to chunked upload automatically if the upload
-data size is unknown.
-
-.IP "HTTP Version"
-
-All HTTP requests includes the version number to tell the server which version
-we support. libcurl speaks HTTP 1.1 by default. Some old servers do not like
-getting 1.1-requests and when dealing with stubborn old things like that, you
-can tell libcurl to use 1.0 instead by doing something like this:
-
- curl_easy_setopt(handle, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_0);
-
-.IP "FTP Custom Commands"
-
-Not all protocols are HTTP-like, and thus the above may not help you when
-you want to make, for example, your FTP transfers to behave differently.
-
-Sending custom commands to an FTP server means that you need to send the
-commands exactly as the FTP server expects them (RFC 959 is a good guide
-here), and you can only use commands that work on the control-connection
-alone. All kinds of commands that require data interchange and thus need a
-data-connection must be left to libcurl's own judgment. Also be aware that
-libcurl does its best to change directory to the target directory before doing
-any transfer, so if you change directory (with CWD or similar) you might
-confuse libcurl and then it might not attempt to transfer the file in the
-correct remote directory.
-
-A little example that deletes a given file before an operation:
-
-.nf
- headers = curl_slist_append(headers, "DELE file-to-remove");
-
- /* pass the list of custom commands to the handle */
- curl_easy_setopt(handle, CURLOPT_QUOTE, headers);
-
- curl_easy_perform(handle); /* transfer ftp data! */
-
- curl_slist_free_all(headers); /* free the header list */
-.fi
-
-If you would instead want this operation (or chain of operations) to happen
-_after_ the data transfer took place the option to \fIcurl_easy_setopt(3)\fP
-would instead be called \fICURLOPT_POSTQUOTE(3)\fP and used the exact same
-way.
-
-The custom FTP commands are issued to the server in the same order they are
-added to the list, and if a command gets an error code returned back from the
-server, no more commands are issued and libcurl bails out with an error code
-(CURLE_QUOTE_ERROR). Note that if you use \fICURLOPT_QUOTE(3)\fP to send
-commands before a transfer, no transfer actually takes place when a quote
-command has failed.
-
-If you set the \fICURLOPT_HEADER(3)\fP to 1, you tell libcurl to get
-information about the target file and output "headers" about it. The headers
-are in "HTTP-style", looking like they do in HTTP.
-
-The option to enable headers or to run custom FTP commands may be useful to
-combine with \fICURLOPT_NOBODY(3)\fP. If this option is set, no actual file
-content transfer is performed.
-
-.IP "FTP Custom CUSTOMREQUEST"
-If you do want to list the contents of an FTP directory using your own defined
-FTP command, \fICURLOPT_CUSTOMREQUEST(3)\fP does just that. "NLST" is the
-default one for listing directories but you are free to pass in your idea of a
-good alternative.
-
-.SH "Cookies Without Chocolate Chips"
-In the HTTP sense, a cookie is a name with an associated value. A server sends
-the name and value to the client, and expects it to get sent back on every
-subsequent request to the server that matches the particular conditions
-set. The conditions include that the domain name and path match and that the
-cookie has not become too old.
-
-In real-world cases, servers send new cookies to replace existing ones to
-update them. Server use cookies to "track" users and to keep "sessions".
-
-Cookies are sent from server to clients with the header Set-Cookie: and
-they are sent from clients to servers with the Cookie: header.
-
-To just send whatever cookie you want to a server, you can use
-\fICURLOPT_COOKIE(3)\fP to set a cookie string like this:
-.nf
- curl_easy_setopt(handle, CURLOPT_COOKIE, "name1=var1; name2=var2;");
-.fi
-In many cases, that is not enough. You might want to dynamically save
-whatever cookies the remote server passes to you, and make sure those cookies
-are then used accordingly on later requests.
-
-One way to do this, is to save all headers you receive in a plain file and
-when you make a request, you tell libcurl to read the previous headers to
-figure out which cookies to use. Set the header file to read cookies from with
-\fICURLOPT_COOKIEFILE(3)\fP.
-
-The \fICURLOPT_COOKIEFILE(3)\fP option also automatically enables the cookie
-parser in libcurl. Until the cookie parser is enabled, libcurl does not parse
-or understand incoming cookies and they are just be ignored. However, when the
-parser is enabled the cookies are understood and the cookies are kept in
-memory and used properly in subsequent requests when the same handle is
-used. Many times this is enough, and you may not have to save the cookies to
-disk at all. Note that the file you specify to \fICURLOPT_COOKIEFILE(3)\fP
-does not have to exist to enable the parser, so a common way to just enable
-the parser and not read any cookies is to use the name of a file you know does
-not exist.
-
-If you would rather use existing cookies that you have previously received
-with your Netscape or Mozilla browsers, you can make libcurl use that cookie
-file as input. The \fICURLOPT_COOKIEFILE(3)\fP is used for that too, as
-libcurl automatically finds out what kind of file it is and acts accordingly.
-
-Perhaps the most advanced cookie operation libcurl offers, is saving the
-entire internal cookie state back into a Netscape/Mozilla formatted cookie
-file. We call that the cookie-jar. When you set a file name with
-\fICURLOPT_COOKIEJAR(3)\fP, that file name is created and all received cookies
-get stored in it when \fIcurl_easy_cleanup(3)\fP is called. This enables
-cookies to get passed on properly between multiple handles without any
-information getting lost.
-
-.SH "FTP Peculiarities We Need"
-
-FTP transfers use a second TCP/IP connection for the data transfer. This is
-usually a fact you can forget and ignore but at times this detail comes back
-to haunt you. libcurl offers several different ways to customize how the
-second connection is being made.
-
-libcurl can either connect to the server a second time or tell the server to
-connect back to it. The first option is the default and it is also what works
-best for all the people behind firewalls, NATs or IP-masquerading setups.
-libcurl then tells the server to open up a new port and wait for a second
-connection. This is by default attempted with EPSV first, and if that does not
-work it tries PASV instead. (EPSV is an extension to the original FTP spec
-and does not exist nor work on all FTP servers.)
-
-You can prevent libcurl from first trying the EPSV command by setting
-\fICURLOPT_FTP_USE_EPSV(3)\fP to zero.
-
-In some cases, you want to have the server connect back to you for the second
-connection. This might be when the server is perhaps behind a firewall or
-something and only allows connections on a single port. libcurl then informs
-the remote server which IP address and port number to connect to.  This is
-made with the \fICURLOPT_FTPPORT(3)\fP option. If you set it to "-", libcurl
-uses your system's "default IP address". If you want to use a particular IP,
-you can set the full IP address, a host name to resolve to an IP address or
-even a local network interface name that libcurl gets the IP address from.
-
-When doing the "PORT" approach, libcurl attempts to use the EPRT and the LPRT
-before trying PORT, as they work with more protocols. You can disable this
-behavior by setting \fICURLOPT_FTP_USE_EPRT(3)\fP to zero.
-
-.SH "MIME API revisited for SMTP and IMAP"
-In addition to support HTTP multi-part form fields, the MIME API can be used
-to build structured email messages and send them via SMTP or append such
-messages to IMAP directories.
-
-A structured email message may contain several parts: some are displayed
-inline by the MUA, some are attachments. Parts can also be structured as
-multi-part, for example to include another email message or to offer several
-text formats alternatives. This can be nested to any level.
-
-To build such a message, you prepare the nth-level multi-part and then include
-it as a source to the parent multi-part using function
-\fIcurl_mime_subparts(3)\fP. Once it has been
-bound to its parent multi-part, a nth-level multi-part belongs to it and
-should not be freed explicitly.
-
-Email messages data is not supposed to be non-ascii and line length is
-limited: fortunately, some transfer encodings are defined by the standards to
-support the transmission of such incompatible data. Function
-\fIcurl_mime_encoder(3)\fP tells a part that its source data must be encoded
-before being sent. It also generates the corresponding header for that part.
-If the part data you want to send is already encoded in such a scheme, do not
-use this function (this would over-encode it), but explicitly set the
-corresponding part header.
-
-Upon sending such a message, libcurl prepends it with the header list
-set with \fICURLOPT_HTTPHEADER(3)\fP, as zero level mime part headers.
-
-Here is an example building an email message with an inline plain/html text
-alternative and a file attachment encoded in base64:
-
-.nf
- curl_mime *message = curl_mime_init(handle);
-
- /* The inline part is an alternative proposing the html and the text
-    versions of the email. */
- curl_mime *alt = curl_mime_init(handle);
-
- /* HTML message. */
- curl_mimepart *part = curl_mime_addpart(alt);
- curl_mime_data(part, "<html><body><p>This is HTML</p></body></html>",
-                      CURL_ZERO_TERMINATED);
- curl_mime_type(part, "text/html");
-
- /* Text message. */
- part = curl_mime_addpart(alt);
- curl_mime_data(part, "This is plain text message",
-                      CURL_ZERO_TERMINATED);
-
- /* Create the inline part. */
- part = curl_mime_addpart(message);
- curl_mime_subparts(part, alt);
- curl_mime_type(part, "multipart/alternative");
- struct curl_slist *headers = curl_slist_append(NULL,
-                   "Content-Disposition: inline");
- curl_mime_headers(part, headers, TRUE);
-
- /* Add the attachment. */
- part = curl_mime_addpart(message);
- curl_mime_filedata(part, "manual.pdf");
- curl_mime_encoder(part, "base64");
-
- /* Build the mail headers. */
- headers = curl_slist_append(NULL, "From: me@example.com");
- headers = curl_slist_append(headers, "To: you@example.com");
-
- /* Set these into the easy handle. */
- curl_easy_setopt(handle, CURLOPT_HTTPHEADER, headers);
- curl_easy_setopt(handle, CURLOPT_MIMEPOST, mime);
-.fi
-
-It should be noted that appending a message to an IMAP directory requires
-the message size to be known prior upload. It is therefore not possible to
-include parts with unknown data size in this context.
-
-.SH "Headers Equal Fun"
-
-Some protocols provide "headers", meta-data separated from the normal
-data. These headers are by default not included in the normal data stream, but
-you can make them appear in the data stream by setting \fICURLOPT_HEADER(3)\fP
-to 1.
-
-What might be even more useful, is libcurl's ability to separate the headers
-from the data and thus make the callbacks differ. You can for example set a
-different pointer to pass to the ordinary write callback by setting
-\fICURLOPT_HEADERDATA(3)\fP.
-
-Or, you can set an entirely separate function to receive the headers, by using
-\fICURLOPT_HEADERFUNCTION(3)\fP.
-
-The headers are passed to the callback function one by one, and you can
-depend on that fact. It makes it easier for you to add custom header parsers
-etc.
-
-\&"Headers" for FTP transfers equal all the FTP server responses. They are not
-actually true headers, but in this case we pretend they are! ;-)
-
-.SH "Post Transfer Information"
-See \fIcurl_easy_getinfo(3)\fP.
-.SH "The multi Interface"
-The easy interface as described in detail in this document is a synchronous
-interface that transfers one file at a time and does not return until it is
-done.
-
-The multi interface, on the other hand, allows your program to transfer
-multiple files in both directions at the same time, without forcing you to use
-multiple threads. The name might make it seem that the multi interface is for
-multi-threaded programs, but the truth is almost the reverse. The multi
-interface allows a single-threaded application to perform the same kinds of
-multiple, simultaneous transfers that multi-threaded programs can perform. It
-allows many of the benefits of multi-threaded transfers without the complexity
-of managing and synchronizing many threads.
-
-To complicate matters somewhat more, there are even two versions of the multi
-interface. The event based one, also called multi_socket and the "normal one"
-designed for using with select(). See the libcurl-multi.3 man page for details
-on the multi_socket event based API, this description here is for the select()
-oriented one.
-
-To use this interface, you are better off if you first understand the basics
-of how to use the easy interface. The multi interface is simply a way to make
-multiple transfers at the same time by adding up multiple easy handles into
-a "multi stack".
-
-You create the easy handles you want, one for each concurrent transfer, and
-you set all the options just like you learned above, and then you create a
-multi handle with \fIcurl_multi_init(3)\fP and add all those easy handles to
-that multi handle with \fIcurl_multi_add_handle(3)\fP.
-
-When you have added the handles you have for the moment (you can still add new
-ones at any time), you start the transfers by calling
-\fIcurl_multi_perform(3)\fP.
-
-\fIcurl_multi_perform(3)\fP is asynchronous. It only performs what can be done
-now and then return control to your program. It is designed to never
-block. You need to keep calling the function until all transfers are
-completed.
-
-The best usage of this interface is when you do a select() on all possible
-file descriptors or sockets to know when to call libcurl again. This also
-makes it easy for you to wait and respond to actions on your own application's
-sockets/handles. You figure out what to select() for by using
-\fIcurl_multi_fdset(3)\fP, that fills in a set of \fIfd_set\fP variables for
-you with the particular file descriptors libcurl uses for the moment.
-
-When you then call select(), it returns when one of the file handles signal
-action and you then call \fIcurl_multi_perform(3)\fP to allow libcurl to do
-what it wants to do. Take note that libcurl does also feature some time-out
-code so we advise you to never use long timeouts on select() before you call
-\fIcurl_multi_perform(3)\fP again. \fIcurl_multi_timeout(3)\fP is provided to
-help you get a suitable timeout period.
-
-Another precaution you should use: always call \fIcurl_multi_fdset(3)\fP
-immediately before the select() call since the current set of file descriptors
-may change in any curl function invoke.
-
-If you want to stop the transfer of one of the easy handles in the stack, you
-can use \fIcurl_multi_remove_handle(3)\fP to remove individual easy
-handles. Remember that easy handles should be \fIcurl_easy_cleanup(3)\fPed.
-
-When a transfer within the multi stack has finished, the counter of running
-transfers (as filled in by \fIcurl_multi_perform(3)\fP) decreases. When the
-number reaches zero, all transfers are done.
-
-\fIcurl_multi_info_read(3)\fP can be used to get information about completed
-transfers. It then returns the CURLcode for each easy transfer, to allow you
-to figure out success on each individual transfer.
-
-.SH "SSL, Certificates and Other Tricks"
-
- [ seeding, passwords, keys, certificates, ENGINE, ca certs ]
-
-.SH "Sharing Data Between Easy Handles"
-You can share some data between easy handles when the easy interface is used,
-and some data is share automatically when you use the multi interface.
-
-When you add easy handles to a multi handle, these easy handles automatically
-share a lot of the data that otherwise would be kept on a per-easy handle
-basis when the easy interface is used.
-
-The DNS cache is shared between handles within a multi handle, making
-subsequent name resolving faster, and the connection pool that is kept to
-better allow persistent connections and connection reuse is also shared. If
-you are using the easy interface, you can still share these between specific
-easy handles by using the share interface, see \fIlibcurl-share(3)\fP.
-
-Some things are never shared automatically, not within multi handles, like for
-example cookies so the only way to share that is with the share interface.
-.SH "Footnotes"
-
-.IP "[1]"
-libcurl 7.10.3 and later have the ability to switch over to chunked
-Transfer-Encoding in cases where HTTP uploads are done with data of an unknown
-size.
-.IP "[2]"
-This happens on Windows machines when libcurl is built and used as a
-DLL. However, you can still do this on Windows if you link with a static
-library.
-.IP "[3]"
-The curl-config tool is generated at build-time (on Unix-like systems) and
-should be installed with the 'make install' or similar instruction that
-installs the library, header files, man pages etc.
-.IP "[4]"
-This behavior was different in versions before 7.17.0, where strings had to
-remain valid past the end of the \fIcurl_easy_setopt(3)\fP call.
-.SH "SEE ALSO"
-.BR libcurl-errors "(3), " libcurl-multi "(3), " libcurl-easy "(3) "
diff --git a/third-party/curl/docs/libcurl/libcurl-tutorial.md b/third-party/curl/docs/libcurl/libcurl-tutorial.md
new file mode 100644
index 0000000000..befcf77399
--- /dev/null
+++ b/third-party/curl/docs/libcurl/libcurl-tutorial.md
@@ -0,0 +1,1465 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: libcurl-tutorial
+Section: 3
+Source: libcurl
+See-also:
+  - libcurl-easy (3)
+  - libcurl-errors (3)
+  - libcurl-multi (3)
+  - libcurl-url (3)
+Protocol:
+  - All
+Added-in: n/a
+---
+
+# NAME
+
+libcurl-tutorial - libcurl programming tutorial
+
+# Objective
+
+This document attempts to describe the general principles and some basic
+approaches to consider when programming with libcurl. The text focuses on the
+C interface but should apply fairly well on other language bindings as well as
+they usually follow the C API pretty closely.
+
+This document refers to 'the user' as the person writing the source code that
+uses libcurl. That would probably be you or someone in your position. What is
+generally referred to as 'the program' is the collected source code that you
+write that is using libcurl for transfers. The program is outside libcurl and
+libcurl is outside of the program.
+
+To get more details on all options and functions described herein, please
+refer to their respective man pages.
+
+# Building
+
+There are many different ways to build C programs. This chapter assumes a Unix
+style build process. If you use a different build system, you can still read
+this to get general information that may apply to your environment as well.
+
+## Compiling the Program
+
+Your compiler needs to know where the libcurl headers are located. Therefore
+you must set your compiler's include path to point to the directory where you
+installed them. The 'curl-config'[3] tool can be used to get this information:
+~~~c
+    $ curl-config --cflags
+~~~
+
+## Linking the Program with libcurl
+
+When having compiled the program, you need to link your object files to create
+a single executable. For that to succeed, you need to link with libcurl and
+possibly also with other libraries that libcurl itself depends on. Like the
+OpenSSL libraries, but even some standard OS libraries may be needed on the
+command line. To figure out which flags to use, once again the 'curl-config'
+tool comes to the rescue:
+~~~c
+    $ curl-config --libs
+~~~
+
+## SSL or Not
+
+libcurl can be built and customized in many ways. One of the things that
+varies from different libraries and builds is the support for SSL-based
+transfers, like HTTPS and FTPS. If a supported SSL library was detected
+properly at build-time, libcurl is built with SSL support. To figure out if an
+installed libcurl has been built with SSL support enabled, use *curl-config*
+like this:
+
+~~~c
+    $ curl-config --feature
+~~~
+
+If SSL is supported, the keyword *SSL* is written to stdout, possibly together
+with a other features that could be either on or off on for different
+libcurls.
+
+See also the "Features libcurl Provides" further down.
+
+## autoconf macro
+
+When you write your configure script to detect libcurl and setup variables
+accordingly, we offer a macro that probably does everything you need in this
+area. See docs/libcurl/libcurl.m4 file - it includes docs on how to use it.
+
+# Portable Code in a Portable World
+
+The people behind libcurl have put a considerable effort to make libcurl work
+on a large amount of different operating systems and environments.
+
+You program libcurl the same way on all platforms that libcurl runs on. There
+are only a few minor details that differ. If you make sure to write your code
+portable enough, you can create a portable program. libcurl should not stop
+you from that.
+
+# Global Preparation
+
+The program must initialize some of the libcurl functionality globally. That
+means it should be done exactly once, no matter how many times you intend to
+use the library. Once for your program's entire life time. This is done using
+~~~c
+    curl_global_init()
+~~~
+and it takes one parameter which is a bit pattern that tells libcurl what to
+initialize. Using *CURL_GLOBAL_ALL* makes it initialize all known internal
+sub modules, and might be a good default option. The current two bits that are
+specified are:
+
+## CURL_GLOBAL_WIN32
+
+which only does anything on Windows machines. When used on a Windows machine,
+it makes libcurl initialize the Win32 socket stuff. Without having that
+initialized properly, your program cannot use sockets properly. You should
+only do this once for each application, so if your program already does this
+or of another library in use does it, you should not tell libcurl to do this
+as well.
+
+## CURL_GLOBAL_SSL
+
+which only does anything on libcurls compiled and built SSL-enabled. On these
+systems, this makes libcurl initialize the SSL library properly for this
+application. This only needs to be done once for each application so if your
+program or another library already does this, this bit should not be needed.
+
+libcurl has a default protection mechanism that detects if
+curl_global_init(3) has not been called by the time
+curl_easy_perform(3) is called and if that is the case, libcurl runs the
+function itself with a guessed bit pattern. Please note that depending solely
+on this is not considered nice nor good.
+
+When the program no longer uses libcurl, it should call
+curl_global_cleanup(3), which is the opposite of the init call. It
+performs the reversed operations to cleanup the resources the
+curl_global_init(3) call initialized.
+
+Repeated calls to curl_global_init(3) and curl_global_cleanup(3)
+should be avoided. They should only be called once each.
+
+# Features libcurl Provides
+
+It is considered best-practice to determine libcurl features at runtime rather
+than at build-time (if possible of course). By calling
+curl_version_info(3) and checking out the details of the returned
+struct, your program can figure out exactly what the currently running libcurl
+supports.
+
+# Two Interfaces
+
+libcurl first introduced the so called easy interface. All operations in the
+easy interface are prefixed with 'curl_easy'. The easy interface lets you do
+single transfers with a synchronous and blocking function call.
+
+libcurl also offers another interface that allows multiple simultaneous
+transfers in a single thread, the so called multi interface. More about that
+interface is detailed in a separate chapter further down. You still need to
+understand the easy interface first, so please continue reading for better
+understanding.
+
+# Handle the Easy libcurl
+
+To use the easy interface, you must first create yourself an easy handle. You
+need one handle for each easy session you want to perform. You should use one
+handle for every thread you plan to use for transferring. You must never share
+the same handle in multiple threads.
+
+Get an easy handle with
+~~~c
+    handle = curl_easy_init();
+~~~
+It returns an easy handle. Using that you proceed to the next step: setting
+up your preferred actions. A handle is a logic entity for the upcoming
+transfer or series of transfers.
+
+You set properties and options for this handle using
+curl_easy_setopt(3). They control how the subsequent transfer or
+transfers using this handle are made. Options remain set in the handle until
+set again to something different. They are sticky. Multiple requests using the
+same handle use the same options.
+
+If you at any point would like to blank all previously set options for a
+single easy handle, you can call curl_easy_reset(3) and you can also
+make a clone of an easy handle (with all its set options) using
+curl_easy_duphandle(3).
+
+Many of the options you set in libcurl are "strings", pointers to data
+terminated with a zero byte. When you set strings with
+curl_easy_setopt(3), libcurl makes its own copy so that they do not need
+to be kept around in your application after being set[4].
+
+One of the most basic properties to set in the handle is the URL. You set your
+preferred URL to transfer with CURLOPT_URL(3) in a manner similar to:
+
+~~~c
+    curl_easy_setopt(handle, CURLOPT_URL, "https://example.com/");
+~~~
+
+Let's assume for a while that you want to receive data as the URL identifies a
+remote resource you want to get here. Since you write a sort of application
+that needs this transfer, I assume that you would like to get the data passed
+to you directly instead of getting it passed to stdout. You write your
+own function that matches this prototype:
+~~~c
+    size_t write_data(char *buffer, size_t size, size_t nmemb, void *userp);
+~~~
+
+You tell libcurl to pass all data to this function by issuing a function
+similar to this:
+
+~~~c
+    curl_easy_setopt(handle, CURLOPT_WRITEFUNCTION, write_data);
+~~~
+
+You can control what data your callback function gets in the fourth argument
+by setting another property:
+
+~~~c
+    curl_easy_setopt(handle, CURLOPT_WRITEDATA, &internal_struct);
+~~~
+Using that property, you can easily pass local data between your application
+and the function that gets invoked by libcurl. libcurl itself does not touch
+the data you pass with CURLOPT_WRITEDATA(3).
+
+libcurl offers its own default internal callback that takes care of the data
+if you do not set the callback with CURLOPT_WRITEFUNCTION(3). It
+outputs the received data to stdout. You can have the default callback write
+the data to a different file handle by passing a 'FILE *' to a file opened for
+writing with the CURLOPT_WRITEDATA(3) option.
+
+Now, we need to take a step back and take a deep breath. Here is one of those
+rare platform-dependent nitpicks. Did you spot it? On some platforms[2],
+libcurl is not able to operate on file handles opened by the
+program. Therefore, if you use the default callback and pass in an open file
+handle with CURLOPT_WRITEDATA(3), libcurl crashes. You should avoid this
+to make your program run fine virtually everywhere.
+
+(CURLOPT_WRITEDATA(3) was formerly known as *CURLOPT_FILE*. Both names still
+work and do the same thing).
+
+If you are using libcurl as a Windows DLL, you MUST use the
+CURLOPT_WRITEFUNCTION(3) if you set CURLOPT_WRITEDATA(3) - or experience
+crashes.
+
+There are of course many more options you can set, and we get back to a few of
+them later. Let's instead continue to the actual transfer:
+
+~~~c
+    success = curl_easy_perform(handle);
+~~~
+
+curl_easy_perform(3) connects to the remote site, does the necessary commands
+and performs the transfer. Whenever it receives data, it calls the callback
+function we previously set. The function may get one byte at a time, or it may
+get many kilobytes at once. libcurl delivers as much as possible as often as
+possible. Your callback function should return the number of bytes it "took
+care of". If that is not the same amount of bytes that was passed to it,
+libcurl aborts the operation and returns with an error code.
+
+When the transfer is complete, the function returns a return code that informs
+you if it succeeded in its mission or not. If a return code is not enough for
+you, you can use the CURLOPT_ERRORBUFFER(3) to point libcurl to a buffer of
+yours where it stores a human readable error message as well.
+
+If you then want to transfer another file, the handle is ready to be used
+again. It is even preferred and encouraged that you reuse an existing handle
+if you intend to make another transfer. libcurl then attempts to reuse a
+previous connection.
+
+For some protocols, downloading a file can involve a complicated process of
+logging in, setting the transfer mode, changing the current directory and
+finally transferring the file data. libcurl takes care of all that
+complication for you. Given the URL to a file, libcurl takes care of
+all the details needed to get the file moved from one machine to another.
+
+# Multi-threading Issues
+
+libcurl is thread-safe but there are a few exceptions. Refer to
+libcurl-thread(3) for more information.
+
+# When It does not Work
+
+There are times when the transfer fails for some reason. You might have set
+the wrong libcurl option or misunderstood what the libcurl option actually
+does, or the remote server might return non-standard replies that confuse the
+library which then confuses your program.
+
+There is one golden rule when these things occur: set the
+CURLOPT_VERBOSE(3) option to 1. it causes the library to spew out the
+entire protocol details it sends, some internal info and some received
+protocol data as well (especially when using FTP). If you are using HTTP,
+adding the headers in the received output to study is also a clever way to get
+a better understanding why the server behaves the way it does. Include headers
+in the normal body output with CURLOPT_HEADER(3) set 1.
+
+Of course, there are bugs left. We need to know about them to be able to fix
+them, so we are dependent on your bug reports. When you do report suspected
+bugs in libcurl, please include as many details as you possibly can: a protocol
+dump that CURLOPT_VERBOSE(3) produces, library version, as much as possible of
+your code that uses libcurl, operating system name and version, compiler name
+and version etc.
+
+If CURLOPT_VERBOSE(3) is not enough, you increase the level of debug
+data your application receive by using the CURLOPT_DEBUGFUNCTION(3).
+
+Getting some in-depth knowledge about the protocols involved is never wrong,
+and if you are trying to do funny things, you might understand libcurl and how
+to use it better if you study the appropriate RFC documents at least briefly.
+
+# Upload Data to a Remote Site
+
+libcurl tries to keep a protocol independent approach to most transfers, thus
+uploading to a remote FTP site is similar to uploading data to an HTTP server
+with a PUT request.
+
+Of course, first you either create an easy handle or you reuse one existing
+one. Then you set the URL to operate on like before. This is the remote URL,
+that we now upload.
+
+Since we write an application, we most likely want libcurl to get the upload
+data by asking us for it. To make it do that, we set the read callback and the
+custom pointer libcurl passes to our read callback. The read callback should
+have a prototype similar to:
+~~~c
+    size_t function(char *bufptr, size_t size, size_t nitems, void *userp);
+~~~
+Where *bufptr* is the pointer to a buffer we fill in with data to upload
+and *nitems* is the size of the buffer and therefore also the maximum
+amount of data we can return to libcurl in this call. The *userp* pointer
+is the custom pointer we set to point to a struct of ours to pass private data
+between the application and the callback.
+~~~c
+    curl_easy_setopt(handle, CURLOPT_READFUNCTION, read_function);
+
+    curl_easy_setopt(handle, CURLOPT_READDATA, &filedata);
+~~~
+Tell libcurl that we want to upload:
+~~~c
+    curl_easy_setopt(handle, CURLOPT_UPLOAD, 1L);
+~~~
+A few protocols do not behave properly when uploads are done without any prior
+knowledge of the expected file size. Set the upload file size using the
+CURLOPT_INFILESIZE_LARGE(3) for all known file sizes like this[1]:
+
+~~~c
+    /* in this example, file_size must be an curl_off_t variable */
+    curl_easy_setopt(handle, CURLOPT_INFILESIZE_LARGE, file_size);
+~~~
+
+When you call curl_easy_perform(3) this time, it performs all the
+necessary operations and when it has invoked the upload it calls your supplied
+callback to get the data to upload. The program should return as much data as
+possible in every invoke, as that is likely to make the upload perform as fast
+as possible. The callback should return the number of bytes it wrote in the
+buffer. Returning 0 signals the end of the upload.
+
+# Passwords
+
+Many protocols use or even require that username and password are provided
+to be able to download or upload the data of your choice. libcurl offers
+several ways to specify them.
+
+Most protocols support that you specify the name and password in the URL
+itself. libcurl detects this and use them accordingly. This is written like
+this:
+~~~c
+    protocol://user:password@example.com/path/
+~~~
+If you need any odd letters in your username or password, you should enter
+them URL encoded, as %XX where XX is a two-digit hexadecimal number.
+
+libcurl also provides options to set various passwords. The username and
+password as shown embedded in the URL can instead get set with the
+CURLOPT_USERPWD(3) option. The argument passed to libcurl should be a
+`char *` to a string in the format `"user:password"`. In a manner like this:
+
+~~~c
+    curl_easy_setopt(handle, CURLOPT_USERPWD, "myname:thesecret");
+~~~
+
+Another case where name and password might be needed at times, is for those
+users who need to authenticate themselves to a proxy they use. libcurl offers
+another option for this, the CURLOPT_PROXYUSERPWD(3). Its use is similar to the
+CURLOPT_USERPWD(3) option, like this:
+
+~~~c
+    curl_easy_setopt(handle, CURLOPT_PROXYUSERPWD, "myname:thesecret");
+~~~
+
+There is a long time Unix "standard" way of storing FTP usernames and
+passwords, namely in the $HOME/.netrc file (on Windows, libcurl also checks
+the *%USERPROFILE% environment* variable if *%HOME%* is unset, and tries
+`_netrc` as name). The file should be made private so that only the user may
+read it (see also the "Security Considerations" chapter), as it might contain
+the password in plain text. libcurl has the ability to use this file to figure
+out what set of username and password to use for a particular host. As an
+extension to the normal functionality, libcurl also supports this file for
+non-FTP protocols such as HTTP. To make curl use this file, use the
+CURLOPT_NETRC(3) option:
+
+~~~c
+    curl_easy_setopt(handle, CURLOPT_NETRC, 1L);
+~~~
+
+A basic example of how such a .netrc file may look like:
+
+~~~c
+    machine myhost.mydomain.com
+    login userlogin
+    password secretword
+~~~
+
+All these examples have been cases where the password has been optional, or
+at least you could leave it out and have libcurl attempt to do its job
+without it. There are times when the password is not optional, like when
+you are using an SSL private key for secure transfers.
+
+To pass the known private key password to libcurl:
+~~~c
+    curl_easy_setopt(handle, CURLOPT_KEYPASSWD, "keypassword");
+~~~
+
+# HTTP Authentication
+
+The previous chapter showed how to set username and password for getting URLs
+that require authentication. When using the HTTP protocol, there are many
+different ways a client can provide those credentials to the server and you
+can control which way libcurl uses them. The default HTTP authentication
+method is called 'Basic', which is sending the name and password in clear-text
+in the HTTP request, base64-encoded. This is insecure.
+
+At the time of this writing, libcurl can be built to use: Basic, Digest, NTLM,
+Negotiate (SPNEGO). You can tell libcurl which one to use with
+CURLOPT_HTTPAUTH(3) as in:
+
+~~~c
+    curl_easy_setopt(handle, CURLOPT_HTTPAUTH, CURLAUTH_DIGEST);
+~~~
+
+When you send authentication to a proxy, you can also set authentication type
+the same way but instead with CURLOPT_PROXYAUTH(3):
+
+~~~c
+    curl_easy_setopt(handle, CURLOPT_PROXYAUTH, CURLAUTH_NTLM);
+~~~
+
+Both these options allow you to set multiple types (by ORing them together),
+to make libcurl pick the most secure one out of the types the server/proxy
+claims to support. This method does however add a round-trip since libcurl
+must first ask the server what it supports:
+
+~~~c
+    curl_easy_setopt(handle, CURLOPT_HTTPAUTH, CURLAUTH_DIGEST | CURLAUTH_BASIC);
+~~~
+
+For convenience, you can use the *CURLAUTH_ANY* define (instead of a list with
+specific types) which allows libcurl to use whatever method it wants.
+
+When asking for multiple types, libcurl picks the available one it considers
+"best" in its own internal order of preference.
+
+# HTTP POSTing
+
+We get many questions regarding how to issue HTTP POSTs with libcurl the
+proper way. This chapter thus includes examples using both different versions
+of HTTP POST that libcurl supports.
+
+The first version is the simple POST, the most common version, that most HTML
+pages using the \<form\> tag uses. We provide a pointer to the data and tell
+libcurl to post it all to the remote site:
+
+~~~c
+    char *data = "name=daniel&project=curl";
+    curl_easy_setopt(handle, CURLOPT_POSTFIELDS, data);
+    curl_easy_setopt(handle, CURLOPT_URL, "https://posthere.example/");
+
+    curl_easy_perform(handle); /* post away! */
+~~~
+
+Simple enough, huh? Since you set the POST options with the
+CURLOPT_POSTFIELDS(3), this automatically switches the handle to use
+POST in the upcoming request.
+
+What if you want to post binary data that also requires you to set the
+Content-Type: header of the post? Well, binary posts prevent libcurl from being
+able to do strlen() on the data to figure out the size, so therefore we must
+tell libcurl the size of the post data. Setting headers in libcurl requests are
+done in a generic way, by building a list of our own headers and then passing
+that list to libcurl.
+
+~~~c
+    struct curl_slist *headers = NULL;
+    headers = curl_slist_append(headers, "Content-Type: text/xml");
+
+    /* post binary data */
+    curl_easy_setopt(handle, CURLOPT_POSTFIELDS, binaryptr);
+
+    /* set the size of the postfields data */
+    curl_easy_setopt(handle, CURLOPT_POSTFIELDSIZE, 23L);
+
+    /* pass our list of custom made headers */
+    curl_easy_setopt(handle, CURLOPT_HTTPHEADER, headers);
+
+    curl_easy_perform(handle); /* post away! */
+
+    curl_slist_free_all(headers); /* free the header list */
+~~~
+
+While the simple examples above cover the majority of all cases where HTTP
+POST operations are required, they do not do multi-part formposts. Multi-part
+formposts were introduced as a better way to post (possibly large) binary data
+and were first documented in the RFC 1867 (updated in RFC 2388). They are
+called multi-part because they are built by a chain of parts, each part being
+a single unit of data. Each part has its own name and contents. You can in
+fact create and post a multi-part formpost with the regular libcurl POST
+support described above, but that would require that you build a formpost
+yourself and provide to libcurl.
+
+To make that easier, libcurl provides a MIME API consisting in several
+functions: using those, you can create and fill a multi-part form. Function
+curl_mime_init(3) creates a multi-part body; you can then append new parts
+to a multi-part body using curl_mime_addpart(3).
+
+There are three possible data sources for a part: memory using
+curl_mime_data(3), file using curl_mime_filedata(3) and user-defined data
+read callback using curl_mime_data_cb(3). curl_mime_name(3) sets a part's
+(i.e.: form field) name, while curl_mime_filename(3) fills in the remote
+filename. With curl_mime_type(3), you can tell the MIME type of a part,
+curl_mime_headers(3) allows defining the part's headers. When a multi-part
+body is no longer needed, you can destroy it using curl_mime_free(3).
+
+The following example sets two simple text parts with plain textual contents,
+and then a file with binary contents and uploads the whole thing.
+
+~~~c
+    curl_mime *multipart = curl_mime_init(handle);
+    curl_mimepart *part = curl_mime_addpart(multipart);
+    curl_mime_name(part, "name");
+    curl_mime_data(part, "daniel", CURL_ZERO_TERMINATED);
+    part = curl_mime_addpart(multipart);
+    curl_mime_name(part, "project");
+    curl_mime_data(part, "curl", CURL_ZERO_TERMINATED);
+    part = curl_mime_addpart(multipart);
+    curl_mime_name(part, "logotype-image");
+    curl_mime_filedata(part, "curl.png");
+
+    /* Set the form info */
+    curl_easy_setopt(handle, CURLOPT_MIMEPOST, multipart);
+
+    curl_easy_perform(handle); /* post away! */
+
+    /* free the post data again */
+    curl_mime_free(multipart);
+~~~
+
+To post multiple files for a single form field, you must supply each file in
+a separate part, all with the same field name. Although function
+curl_mime_subparts(3) implements nested multi-parts, this way of
+multiple files posting is deprecated by RFC 7578, chapter 4.3.
+
+To set the data source from an already opened FILE pointer, use:
+
+~~~c
+    curl_mime_data_cb(part, filesize, (curl_read_callback)fread,
+                      (curl_seek_callback)fseek, NULL, filepointer);
+~~~
+
+A deprecated curl_formadd(3) function is still supported in libcurl.
+It should however not be used anymore for new designs and programs using it
+ought to be converted to the MIME API. It is however described here as an
+aid to conversion.
+
+Using *curl_formadd*, you add parts to the form. When you are done adding
+parts, you post the whole form.
+
+The MIME API example above is expressed as follows using this function:
+
+~~~c
+    struct curl_httppost *post = NULL;
+    struct curl_httppost *last = NULL;
+    curl_formadd(&post, &last,
+                 CURLFORM_COPYNAME, "name",
+                 CURLFORM_COPYCONTENTS, "daniel", CURLFORM_END);
+    curl_formadd(&post, &last,
+                 CURLFORM_COPYNAME, "project",
+                 CURLFORM_COPYCONTENTS, "curl", CURLFORM_END);
+    curl_formadd(&post, &last,
+                 CURLFORM_COPYNAME, "logotype-image",
+                 CURLFORM_FILECONTENT, "curl.png", CURLFORM_END);
+
+    /* Set the form info */
+    curl_easy_setopt(handle, CURLOPT_HTTPPOST, post);
+
+    curl_easy_perform(handle); /* post away! */
+
+    /* free the post data again */
+    curl_formfree(post);
+~~~
+
+Multipart formposts are chains of parts using MIME-style separators and
+headers. It means that each one of these separate parts get a few headers set
+that describe the individual content-type, size etc. To enable your
+application to handicraft this formpost even more, libcurl allows you to
+supply your own set of custom headers to such an individual form part. You can
+of course supply headers to as many parts as you like, but this little example
+shows how you set headers to one specific part when you add that to the post
+handle:
+
+~~~c
+    struct curl_slist *headers = NULL;
+    headers = curl_slist_append(headers, "Content-Type: text/xml");
+
+    curl_formadd(&post, &last,
+                 CURLFORM_COPYNAME, "logotype-image",
+                 CURLFORM_FILECONTENT, "curl.xml",
+                 CURLFORM_CONTENTHEADER, headers,
+                 CURLFORM_END);
+
+    curl_easy_perform(handle); /* post away! */
+
+    curl_formfree(post); /* free post */
+    curl_slist_free_all(headers); /* free custom header list */
+~~~
+
+Since all options on an easy handle are "sticky", they remain the same until
+changed even if you do call curl_easy_perform(3), you may need to tell curl to
+go back to a plain GET request if you intend to do one as your next request.
+You force an easy handle to go back to GET by using the CURLOPT_HTTPGET(3)
+option:
+
+~~~c
+    curl_easy_setopt(handle, CURLOPT_HTTPGET, 1L);
+~~~
+
+Setting CURLOPT_POSTFIELDS(3) to "" or NULL does *not* stop libcurl from doing
+a POST. It makes it POST without any data to send!
+
+# Converting from deprecated form API to MIME API
+
+Four rules have to be respected in building the multi-part:
+
+- The easy handle must be created before building the multi-part.
+
+- The multi-part is always created by a call to curl_mime_init(handle).
+
+- Each part is created by a call to curl_mime_addpart(multipart).
+
+- When complete, the multi-part must be bound to the easy handle using
+CURLOPT_MIMEPOST(3) instead of CURLOPT_HTTPPOST(3).
+
+Here are some example of *curl_formadd* calls to MIME API sequences:
+
+~~~c
+    curl_formadd(&post, &last,
+                 CURLFORM_COPYNAME, "id",
+                 CURLFORM_COPYCONTENTS, "daniel", CURLFORM_END);
+                 CURLFORM_CONTENTHEADER, headers,
+                 CURLFORM_END);
+~~~
+becomes:
+~~~c
+    part = curl_mime_addpart(multipart);
+    curl_mime_name(part, "id");
+    curl_mime_data(part, "daniel", CURL_ZERO_TERMINATED);
+    curl_mime_headers(part, headers, FALSE);
+~~~
+
+Setting the last curl_mime_headers(3) argument to TRUE would have caused
+the headers to be automatically released upon destroyed the multi-part, thus
+saving a clean-up call to curl_slist_free_all(3).
+
+~~~c
+    curl_formadd(&post, &last,
+                 CURLFORM_PTRNAME, "logotype-image",
+                 CURLFORM_FILECONTENT, "-",
+                 CURLFORM_END);
+~~~
+becomes:
+~~~c
+    part = curl_mime_addpart(multipart);
+    curl_mime_name(part, "logotype-image");
+    curl_mime_data_cb(part, (curl_off_t)-1, fread, fseek, NULL, stdin);
+~~~
+
+curl_mime_name(3) always copies the field name. The special filename "-" is
+not supported by curl_mime_filename(3): to read an open file, use a callback
+source using fread(). The transfer is be chunk-encoded since the data size is
+unknown.
+
+~~~c
+    curl_formadd(&post, &last,
+                 CURLFORM_COPYNAME, "datafile[]",
+                 CURLFORM_FILE, "file1",
+                 CURLFORM_FILE, "file2",
+                 CURLFORM_END);
+~~~
+becomes:
+~~~c
+    part = curl_mime_addpart(multipart);
+    curl_mime_name(part, "datafile[]");
+    curl_mime_filedata(part, "file1");
+    part = curl_mime_addpart(multipart);
+    curl_mime_name(part, "datafile[]");
+    curl_mime_filedata(part, "file2");
+~~~
+
+The deprecated multipart/mixed implementation of multiple files field is
+translated to two distinct parts with the same name.
+
+~~~c
+    curl_easy_setopt(handle, CURLOPT_READFUNCTION, myreadfunc);
+    curl_formadd(&post, &last,
+                 CURLFORM_COPYNAME, "stream",
+                 CURLFORM_STREAM, arg,
+                 CURLFORM_CONTENTLEN, (curl_off_t)datasize,
+                 CURLFORM_FILENAME, "archive.zip",
+                 CURLFORM_CONTENTTYPE, "application/zip",
+                 CURLFORM_END);
+~~~
+becomes:
+~~~c
+    part = curl_mime_addpart(multipart);
+    curl_mime_name(part, "stream");
+    curl_mime_data_cb(part, (curl_off_t)datasize,
+                      myreadfunc, NULL, NULL, arg);
+    curl_mime_filename(part, "archive.zip");
+    curl_mime_type(part, "application/zip");
+~~~
+
+CURLOPT_READFUNCTION(3) callback is not used: it is replace by directly
+setting the part source data from the callback read function.
+
+~~~c
+    curl_formadd(&post, &last,
+                 CURLFORM_COPYNAME, "memfile",
+                 CURLFORM_BUFFER, "memfile.bin",
+                 CURLFORM_BUFFERPTR, databuffer,
+                 CURLFORM_BUFFERLENGTH, (long)sizeof(databuffer),
+                 CURLFORM_END);
+~~~
+becomes:
+~~~c
+    part = curl_mime_addpart(multipart);
+    curl_mime_name(part, "memfile");
+    curl_mime_data(part, databuffer, (curl_off_t)sizeof(databuffer));
+    curl_mime_filename(part, "memfile.bin");
+~~~
+
+curl_mime_data(3) always copies the initial data: data buffer is thus
+free for immediate reuse.
+
+~~~c
+    curl_formadd(&post, &last,
+                 CURLFORM_COPYNAME, "message",
+                 CURLFORM_FILECONTENT, "msg.txt",
+                 CURLFORM_END);
+~~~
+becomes:
+~~~c
+    part = curl_mime_addpart(multipart);
+    curl_mime_name(part, "message");
+    curl_mime_filedata(part, "msg.txt");
+    curl_mime_filename(part, NULL);
+~~~
+
+Use of curl_mime_filedata(3) sets the remote filename as a side effect: it is
+therefore necessary to clear it for *CURLFORM_FILECONTENT* emulation.
+
+# Showing Progress
+
+For historical and traditional reasons, libcurl has a built-in progress meter
+that can be switched on and then makes it present a progress meter in your
+terminal.
+
+Switch on the progress meter by, oddly enough, setting
+CURLOPT_NOPROGRESS(3) to zero. This option is set to 1 by default.
+
+For most applications, the built-in progress meter is useless and what instead
+is interesting is the ability to specify a progress callback. The function
+pointer you pass to libcurl is then called on irregular intervals with
+information about the current transfer.
+
+Set the progress callback by using CURLOPT_PROGRESSFUNCTION(3). Pass a pointer
+to a function that matches this prototype:
+
+~~~c
+    int progress_callback(void *clientp,
+                          double dltotal,
+                          double dlnow,
+                          double ultotal,
+                          double ulnow);
+~~~
+
+If any of the input arguments is unknown, a 0 is provided. The first argument,
+the 'clientp' is the pointer you pass to libcurl with
+CURLOPT_PROGRESSDATA(3). libcurl does not touch it.
+
+# libcurl with C++
+
+There is only one thing to keep in mind when using C++ instead of C when
+interfacing libcurl:
+
+The callbacks CANNOT be non-static class member functions
+
+Example C++ code:
+
+~~~c
+    class AClass {
+      static size_t write_data(char *ptr, size_t size, size_t nmemb,
+                               void *ourpointer)
+      {
+        /* do what you want with the data */
+      }
+    }
+~~~
+
+# Proxies
+
+What "proxy" means according to Merriam-Webster: "a person authorized to act
+for another" but also "the agency, function, or office of a deputy who acts as
+a substitute for another".
+
+Proxies are exceedingly common these days. Companies often only offer Internet
+access to employees through their proxies. Network clients or user-agents ask
+the proxy for documents, the proxy does the actual request and then it returns
+them.
+
+libcurl supports SOCKS and HTTP proxies. When a given URL is wanted, libcurl
+asks the proxy for it instead of trying to connect to the actual remote host
+identified in the URL.
+
+If you are using a SOCKS proxy, you may find that libcurl does not support all
+operations through it.
+
+For HTTP proxies: the fact that the proxy is an HTTP proxy puts certain
+restrictions on what can actually happen. A requested URL that might not be a
+HTTP URL is passed to the HTTP proxy to deliver back to libcurl. This happens
+transparently, and an application may not need to know. I say "may", because
+at times it is important to understand that all operations over an HTTP proxy
+use the HTTP protocol. For example, you cannot invoke your own custom FTP
+commands or even proper FTP directory listings.
+
+## Proxy Options
+
+To tell libcurl to use a proxy at a given port number:
+~~~c
+    curl_easy_setopt(handle, CURLOPT_PROXY, "proxy-host.com:8080");
+~~~
+Some proxies require user authentication before allowing a request, and you
+pass that information similar to this:
+~~~c
+    curl_easy_setopt(handle, CURLOPT_PROXYUSERPWD, "user:password");
+~~~
+If you want to, you can specify the hostname only in the
+CURLOPT_PROXY(3) option, and set the port number separately with
+CURLOPT_PROXYPORT(3).
+
+Tell libcurl what kind of proxy it is with CURLOPT_PROXYTYPE(3) (if not,
+it defaults to assuming an HTTP proxy):
+~~~c
+    curl_easy_setopt(handle, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS4);
+~~~
+
+## Environment Variables
+
+libcurl automatically checks and uses a set of environment variables to know
+what proxies to use for certain protocols. The names of the variables are
+following an old tradition and are built up as `[protocol]_proxy` (note the
+lower casing). Which makes the variable `http_proxy` checked for a name of a
+proxy to use when the input URL is HTTP. Following the same rule, the variable
+named `ftp_proxy` is checked for FTP URLs. Again, the proxies are always HTTP
+proxies, the different names of the variables allow different HTTP
+proxies to be used.
+
+The proxy environment variable contents should be in the format
+`[protocol://][user:password@]machine[:port]`. Where the `protocol://` part
+specifies which type of proxy it is, and the optional port number specifies on
+which port the proxy operates. If not specified, the internal default port
+number is used and that is most likely not the one you would like it to be.
+
+There are two special environment variables. `all_proxy` is what sets proxy
+for any URL in case the protocol specific variable was not set, and `no_proxy`
+defines a list of hosts that should not use a proxy even though a variable may
+say so. If `no_proxy` is a plain asterisk (`*`) it matches all hosts.
+
+To explicitly disable libcurl's checking for and using the proxy environment
+variables, set the proxy name to "" - an empty string - with
+CURLOPT_PROXY(3).
+
+## SSL and Proxies
+
+SSL is for secure point-to-point connections. This involves strong encryption
+and similar things, which effectively makes it impossible for a proxy to
+operate as a "man in between" which the proxy's task is, as previously
+discussed. Instead, the only way to have SSL work over an HTTP proxy is to ask
+the proxy to tunnel everything through without being able to check or fiddle
+with the traffic.
+
+Opening an SSL connection over an HTTP proxy is therefore a matter of asking the
+proxy for a straight connection to the target host on a specified port. This
+is made with the HTTP request CONNECT. ("please dear proxy, connect me to that
+remote host").
+
+Because of the nature of this operation, where the proxy has no idea what kind
+of data that is passed in and out through this tunnel, this breaks some of the
+few advantages that come from using a proxy, such as caching. Many
+organizations prevent this kind of tunneling to other destination port numbers
+than 443 (which is the default HTTPS port number).
+
+## Tunneling Through Proxy
+
+As explained above, tunneling is required for SSL to work and often even
+restricted to the operation intended for SSL; HTTPS.
+
+This is however not the only time proxy-tunneling might offer benefits to
+you or your application.
+
+As tunneling opens a direct connection from your application to the remote
+machine, it suddenly also re-introduces the ability to do non-HTTP
+operations over an HTTP proxy. You can in fact use things such as FTP
+upload or FTP custom commands this way.
+
+Again, this is often prevented by the administrators of proxies and is
+rarely allowed.
+
+Tell libcurl to use proxy tunneling like this:
+~~~c
+    curl_easy_setopt(handle, CURLOPT_HTTPPROXYTUNNEL, 1L);
+~~~
+In fact, there might even be times when you want to do plain HTTP operations
+using a tunnel like this, as it then enables you to operate on the remote
+server instead of asking the proxy to do so. libcurl does not stand in the way
+for such innovative actions either!
+
+## Proxy Auto-Config
+
+Netscape first came up with this. It is a webpage (usually using a .pac
+extension) with a JavaScript that when executed by the browser with the
+requested URL as input, returns information to the browser on how to connect
+to the URL. The returned information might be "DIRECT" (which means no proxy
+should be used), "PROXY host:port" (to tell the browser where the proxy for
+this particular URL is) or "SOCKS host:port" (to direct the browser to a SOCKS
+proxy).
+
+libcurl has no means to interpret or evaluate JavaScript and thus it does not
+support this. If you get yourself in a position where you face this nasty
+invention, the following advice have been mentioned and used in the past:
+
+- Depending on the JavaScript complexity, write up a script that translates it
+to another language and execute that.
+
+- Read the JavaScript code and rewrite the same logic in another language.
+
+- Implement a JavaScript interpreter; people have successfully used the
+Mozilla JavaScript engine in the past.
+
+- Ask your admins to stop this, for a static proxy setup or similar.
+
+# Persistence Is The Way to Happiness
+
+Re-cycling the same easy handle several times when doing multiple requests is
+the way to go.
+
+After each single curl_easy_perform(3) operation, libcurl keeps the connection
+alive and open. A subsequent request using the same easy handle to the same
+host might be able to reuse the already open connection! This reduces network
+impact a lot.
+
+Even if the connection is dropped, all connections involving SSL to the same
+host again, benefit from libcurl's session ID cache that drastically reduces
+re-connection time.
+
+FTP connections that are kept alive save a lot of time, as the command-
+response round-trips are skipped, and also you do not risk getting blocked
+without permission to login again like on many FTP servers only allowing N
+persons to be logged in at the same time.
+
+libcurl caches DNS name resolving results, to make lookups of a previously
+looked up name a lot faster.
+
+Other interesting details that improve performance for subsequent requests
+may also be added in the future.
+
+Each easy handle attempts to keep the last few connections alive for a while
+in case they are to be used again. You can set the size of this "cache" with
+the CURLOPT_MAXCONNECTS(3) option. Default is 5. There is rarely any point in
+changing this value, and if you think of changing this it is often a reason to
+think again.
+
+To force your upcoming request to not use an already existing connection, you
+can do that by setting CURLOPT_FRESH_CONNECT(3) to 1. In a similar
+spirit, you can also forbid the upcoming request to be "lying" around and
+possibly get reused after the request by setting
+CURLOPT_FORBID_REUSE(3) to 1.
+
+# HTTP Headers Used by libcurl
+
+When you use libcurl to do HTTP requests, it passes along a series of headers
+automatically. It might be good for you to know and understand these. You can
+replace or remove them by using the CURLOPT_HTTPHEADER(3) option.
+
+## Host
+
+This header is required by HTTP 1.1 and even many 1.0 servers and should be
+the name of the server we want to talk to. This includes the port number if
+anything but default.
+
+## Accept
+
+"*/*"
+
+## Expect
+
+When doing POST requests, libcurl sets this header to "100-continue" to ask
+the server for an "OK" message before it proceeds with sending the data part
+of the post. If the posted data amount is deemed "small", libcurl does not use
+this header.
+
+# Customizing Operations
+
+There is an ongoing development today where more and more protocols are built
+upon HTTP for transport. This has obvious benefits as HTTP is a tested and
+reliable protocol that is widely deployed and has excellent proxy-support.
+
+When you use one of these protocols, and even when doing other kinds of
+programming you may need to change the traditional HTTP (or FTP or...)
+manners. You may need to change words, headers or various data.
+
+libcurl is your friend here too.
+
+## CURLOPT_CUSTOMREQUEST
+
+If changing the actual HTTP request keyword is what you want, like when GET,
+HEAD or POST is not good enough for you, CURLOPT_CUSTOMREQUEST(3) is there for
+you. It is simple to use:
+
+~~~c
+    curl_easy_setopt(handle, CURLOPT_CUSTOMREQUEST, "MYOWNREQUEST");
+~~~
+
+When using the custom request, you change the request keyword of the actual
+request you are performing. Thus, by default you make a GET request but you
+can also make a POST operation (as described before) and then replace the POST
+keyword if you want to. You are the boss.
+
+## Modify Headers
+
+HTTP-like protocols pass a series of headers to the server when doing the
+request, and you are free to pass any amount of extra headers that you
+think fit. Adding headers is this easy:
+
+~~~c
+    struct curl_slist *headers = NULL; /* init to NULL is important */
+
+    headers = curl_slist_append(headers, "Hey-server-hey: how are you?");
+    headers = curl_slist_append(headers, "X-silly-content: yes");
+
+    /* pass our list of custom made headers */
+    curl_easy_setopt(handle, CURLOPT_HTTPHEADER, headers);
+
+    curl_easy_perform(handle); /* transfer http */
+
+    curl_slist_free_all(headers); /* free the header list */
+~~~
+
+... and if you think some of the internally generated headers, such as Accept:
+or Host: do not contain the data you want them to contain, you can replace
+them by setting them too:
+
+~~~c
+    headers = curl_slist_append(headers, "Accept: Agent-007");
+    headers = curl_slist_append(headers, "Host: munged.host.line");
+~~~
+
+## Delete Headers
+
+If you replace an existing header with one with no contents, you prevent the
+header from being sent. For instance, if you want to completely prevent the
+"Accept:" header from being sent, you can disable it with code similar to
+this:
+
+~~~c
+    headers = curl_slist_append(headers, "Accept:");
+~~~
+
+Both replacing and canceling internal headers should be done with careful
+consideration and you should be aware that you may violate the HTTP protocol
+when doing so.
+
+## Enforcing chunked transfer-encoding
+
+By making sure a request uses the custom header "Transfer-Encoding: chunked"
+when doing a non-GET HTTP operation, libcurl switches over to "chunked"
+upload, even though the size of the data to upload might be known. By default,
+libcurl usually switches over to chunked upload automatically if the upload
+data size is unknown.
+
+## HTTP Version
+
+All HTTP requests includes the version number to tell the server which version
+we support. libcurl speaks HTTP 1.1 by default. Some old servers do not like
+getting 1.1-requests and when dealing with stubborn old things like that, you
+can tell libcurl to use 1.0 instead by doing something like this:
+
+~~~c
+    curl_easy_setopt(handle, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_0);
+~~~
+
+## FTP Custom Commands
+
+Not all protocols are HTTP-like, and thus the above may not help you when
+you want to make, for example, your FTP transfers to behave differently.
+
+Sending custom commands to an FTP server means that you need to send the
+commands exactly as the FTP server expects them (RFC 959 is a good guide
+here), and you can only use commands that work on the control-connection
+alone. All kinds of commands that require data interchange and thus need a
+data-connection must be left to libcurl's own judgment. Also be aware that
+libcurl does its best to change directory to the target directory before doing
+any transfer, so if you change directory (with CWD or similar) you might
+confuse libcurl and then it might not attempt to transfer the file in the
+correct remote directory.
+
+A little example that deletes a given file before an operation:
+
+~~~c
+    headers = curl_slist_append(headers, "DELE file-to-remove");
+
+    /* pass the list of custom commands to the handle */
+    curl_easy_setopt(handle, CURLOPT_QUOTE, headers);
+
+    curl_easy_perform(handle); /* transfer ftp data! */
+
+    curl_slist_free_all(headers); /* free the header list */
+~~~
+
+If you would instead want this operation (or chain of operations) to happen
+_after_ the data transfer took place the option to curl_easy_setopt(3)
+would instead be called CURLOPT_POSTQUOTE(3) and used the exact same
+way.
+
+The custom FTP commands are issued to the server in the same order they are
+added to the list, and if a command gets an error code returned back from the
+server, no more commands are issued and libcurl bails out with an error code
+(CURLE_QUOTE_ERROR). Note that if you use CURLOPT_QUOTE(3) to send
+commands before a transfer, no transfer actually takes place when a quote
+command has failed.
+
+If you set the CURLOPT_HEADER(3) to 1, you tell libcurl to get
+information about the target file and output "headers" about it. The headers
+are in "HTTP-style", looking like they do in HTTP.
+
+The option to enable headers or to run custom FTP commands may be useful to
+combine with CURLOPT_NOBODY(3). If this option is set, no actual file
+content transfer is performed.
+
+## FTP Custom CURLOPT_CUSTOMREQUEST
+
+If you do want to list the contents of an FTP directory using your own defined
+FTP command, CURLOPT_CUSTOMREQUEST(3) does that. "NLST" is the default one for
+listing directories but you are free to pass in your idea of a good
+alternative.
+
+# Cookies Without Chocolate Chips
+
+In the HTTP sense, a cookie is a name with an associated value. A server sends
+the name and value to the client, and expects it to get sent back on every
+subsequent request to the server that matches the particular conditions set.
+The conditions include that the domain name and path match and that the cookie
+has not become too old.
+
+In real-world cases, servers send new cookies to replace existing ones to
+update them. Server use cookies to "track" users and to keep "sessions".
+
+Cookies are sent from server to clients with the header Set-Cookie: and
+they are sent from clients to servers with the Cookie: header.
+
+To send whatever cookie you want to a server, you can use CURLOPT_COOKIE(3) to
+set a cookie string like this:
+
+~~~c
+    curl_easy_setopt(handle, CURLOPT_COOKIE, "name1=var1; name2=var2;");
+~~~
+
+In many cases, that is not enough. You might want to dynamically save whatever
+cookies the remote server passes to you, and make sure those cookies are then
+used accordingly on later requests.
+
+One way to do this, is to save all headers you receive in a plain file and
+when you make a request, you tell libcurl to read the previous headers to
+figure out which cookies to use. Set the header file to read cookies from with
+CURLOPT_COOKIEFILE(3).
+
+The CURLOPT_COOKIEFILE(3) option also automatically enables the cookie parser
+in libcurl. Until the cookie parser is enabled, libcurl does not parse or
+understand incoming cookies and they are instead ignored. When the parser is
+enabled the cookies are understood and the cookies are kept in memory and used
+properly in subsequent requests when the same handle is used. Many times this
+is enough, and you may not have to save the cookies to disk at all. Note that
+the file you specify to CURLOPT_COOKIEFILE(3) does not have to exist to enable
+the parser, so a common way to enable the parser and not read any cookies is
+to use the name of a file you know does not exist.
+
+If you would rather use existing cookies that you have previously received
+with your Netscape or Mozilla browsers, you can make libcurl use that cookie
+file as input. The CURLOPT_COOKIEFILE(3) is used for that too, as
+libcurl automatically finds out what kind of file it is and acts accordingly.
+
+Perhaps the most advanced cookie operation libcurl offers, is saving the
+entire internal cookie state back into a Netscape/Mozilla formatted cookie
+file. We call that the cookie-jar. When you set a filename with
+CURLOPT_COOKIEJAR(3), that filename is created and all received cookies get
+stored in it when curl_easy_cleanup(3) is called. This enables cookies to get
+passed on properly between multiple handles without any information getting
+lost.
+
+# FTP Peculiarities We Need
+
+FTP transfers use a second TCP/IP connection for the data transfer. This is
+usually a fact you can forget and ignore but at times this detail comes back
+to haunt you. libcurl offers several different ways to customize how the
+second connection is being made.
+
+libcurl can either connect to the server a second time or tell the server to
+connect back to it. The first option is the default and it is also what works
+best for all the people behind firewalls, NATs or IP-masquerading setups.
+libcurl then tells the server to open up a new port and wait for a second
+connection. This is by default attempted with EPSV first, and if that does not
+work it tries PASV instead. (EPSV is an extension to the original FTP spec
+and does not exist nor work on all FTP servers.)
+
+You can prevent libcurl from first trying the EPSV command by setting
+CURLOPT_FTP_USE_EPSV(3) to zero.
+
+In some cases, you want to have the server connect back to you for the second
+connection. This might be when the server is perhaps behind a firewall or
+something and only allows connections on a single port. libcurl then informs
+the remote server which IP address and port number to connect to. This is made
+with the CURLOPT_FTPPORT(3) option. If you set it to "-", libcurl uses your
+system's "default IP address". If you want to use a particular IP, you can set
+the full IP address, a hostname to resolve to an IP address or even a local
+network interface name that libcurl gets the IP address from.
+
+When doing the "PORT" approach, libcurl attempts to use the EPRT and the LPRT
+before trying PORT, as they work with more protocols. You can disable this
+behavior by setting CURLOPT_FTP_USE_EPRT(3) to zero.
+
+# MIME API revisited for SMTP and IMAP
+
+In addition to support HTTP multi-part form fields, the MIME API can be used
+to build structured email messages and send them via SMTP or append such
+messages to IMAP directories.
+
+A structured email message may contain several parts: some are displayed
+inline by the MUA, some are attachments. Parts can also be structured as
+multi-part, for example to include another email message or to offer several
+text formats alternatives. This can be nested to any level.
+
+To build such a message, you prepare the nth-level multi-part and then include
+it as a source to the parent multi-part using function
+curl_mime_subparts(3). Once it has been
+bound to its parent multi-part, a nth-level multi-part belongs to it and
+should not be freed explicitly.
+
+Email messages data is not supposed to be non-ASCII and line length is
+limited: fortunately, some transfer encodings are defined by the standards to
+support the transmission of such incompatible data. Function
+curl_mime_encoder(3) tells a part that its source data must be encoded
+before being sent. It also generates the corresponding header for that part.
+If the part data you want to send is already encoded in such a scheme, do not
+use this function (this would over-encode it), but explicitly set the
+corresponding part header.
+
+Upon sending such a message, libcurl prepends it with the header list
+set with CURLOPT_HTTPHEADER(3), as zero level mime part headers.
+
+Here is an example building an email message with an inline plain/html text
+alternative and a file attachment encoded in base64:
+
+~~~c
+    curl_mime *message = curl_mime_init(handle);
+
+    /* The inline part is an alternative proposing the html and the text
+       versions of the email. */
+    curl_mime *alt = curl_mime_init(handle);
+
+    /* HTML message. */
+    curl_mimepart *part = curl_mime_addpart(alt);
+    curl_mime_data(part, "<html><body><p>This is HTML</p></body></html>",
+                         CURL_ZERO_TERMINATED);
+    curl_mime_type(part, "text/html");
+
+    /* Text message. */
+    part = curl_mime_addpart(alt);
+    curl_mime_data(part, "This is plain text message",
+                         CURL_ZERO_TERMINATED);
+
+    /* Create the inline part. */
+    part = curl_mime_addpart(message);
+    curl_mime_subparts(part, alt);
+    curl_mime_type(part, "multipart/alternative");
+    struct curl_slist *headers = curl_slist_append(NULL,
+                      "Content-Disposition: inline");
+    curl_mime_headers(part, headers, TRUE);
+
+    /* Add the attachment. */
+    part = curl_mime_addpart(message);
+    curl_mime_filedata(part, "manual.pdf");
+    curl_mime_encoder(part, "base64");
+
+    /* Build the mail headers. */
+    headers = curl_slist_append(NULL, "From: me@example.com");
+    headers = curl_slist_append(headers, "To: you@example.com");
+
+    /* Set these into the easy handle. */
+    curl_easy_setopt(handle, CURLOPT_HTTPHEADER, headers);
+    curl_easy_setopt(handle, CURLOPT_MIMEPOST, mime);
+~~~
+
+It should be noted that appending a message to an IMAP directory requires
+the message size to be known prior upload. It is therefore not possible to
+include parts with unknown data size in this context.
+
+# Headers Equal Fun
+
+Some protocols provide "headers", meta-data separated from the normal
+data. These headers are by default not included in the normal data stream, but
+you can make them appear in the data stream by setting CURLOPT_HEADER(3)
+to 1.
+
+What might be even more useful, is libcurl's ability to separate the headers
+from the data and thus make the callbacks differ. You can for example set a
+different pointer to pass to the ordinary write callback by setting
+CURLOPT_HEADERDATA(3).
+
+Or, you can set an entirely separate function to receive the headers, by using
+CURLOPT_HEADERFUNCTION(3).
+
+The headers are passed to the callback function one by one, and you can
+depend on that fact. It makes it easier for you to add custom header parsers
+etc.
+
+"Headers" for FTP transfers equal all the FTP server responses. They are not
+actually true headers, but in this case we pretend they are! ;-)
+
+# Post Transfer Information
+
+See curl_easy_getinfo(3).
+
+# The multi Interface
+
+The easy interface as described in detail in this document is a synchronous
+interface that transfers one file at a time and does not return until it is
+done.
+
+The multi interface, on the other hand, allows your program to transfer
+multiple files in both directions at the same time, without forcing you to use
+multiple threads. The name might make it seem that the multi interface is for
+multi-threaded programs, but the truth is almost the reverse. The multi
+interface allows a single-threaded application to perform the same kinds of
+multiple, simultaneous transfers that multi-threaded programs can perform. It
+allows many of the benefits of multi-threaded transfers without the complexity
+of managing and synchronizing many threads.
+
+To complicate matters somewhat more, there are even two versions of the multi
+interface. The event based one, also called multi_socket and the "normal one"
+designed for using with select(). See the libcurl-multi.3 man page for details
+on the multi_socket event based API, this description here is for the select()
+oriented one.
+
+To use this interface, you are better off if you first understand the basics
+of how to use the easy interface. The multi interface is a way to make
+multiple transfers at the same time by adding up multiple easy handles into
+a "multi stack".
+
+You create the easy handles you want, one for each concurrent transfer, and
+you set all the options like you learned above, and then you create a multi
+handle with curl_multi_init(3) and add all those easy handles to that multi
+handle with curl_multi_add_handle(3).
+
+When you have added the handles you have for the moment (you can still add new
+ones at any time), you start the transfers by calling
+curl_multi_perform(3).
+
+curl_multi_perform(3) is asynchronous. It only performs what can be done
+now and then return control to your program. It is designed to never
+block. You need to keep calling the function until all transfers are
+completed.
+
+The best usage of this interface is when you do a select() on all possible
+file descriptors or sockets to know when to call libcurl again. This also
+makes it easy for you to wait and respond to actions on your own application's
+sockets/handles. You figure out what to select() for by using
+curl_multi_fdset(3), that fills in a set of *fd_set* variables for
+you with the particular file descriptors libcurl uses for the moment.
+
+When you then call select(), it returns when one of the file handles signal
+action and you then call curl_multi_perform(3) to allow libcurl to do
+what it wants to do. Take note that libcurl does also feature some time-out
+code so we advise you to never use long timeouts on select() before you call
+curl_multi_perform(3) again. curl_multi_timeout(3) is provided to
+help you get a suitable timeout period.
+
+Another precaution you should use: always call curl_multi_fdset(3)
+immediately before the select() call since the current set of file descriptors
+may change in any curl function invoke.
+
+If you want to stop the transfer of one of the easy handles in the stack, you
+can use curl_multi_remove_handle(3) to remove individual easy
+handles. Remember that easy handles should be curl_easy_cleanup(3)ed.
+
+When a transfer within the multi stack has finished, the counter of running
+transfers (as filled in by curl_multi_perform(3)) decreases. When the
+number reaches zero, all transfers are done.
+
+curl_multi_info_read(3) can be used to get information about completed
+transfers. It then returns the CURLcode for each easy transfer, to allow you
+to figure out success on each individual transfer.
+
+# SSL, Certificates and Other Tricks
+
+[ seeding, passwords, keys, certificates, ENGINE, CA certs ]
+
+# Sharing Data Between Easy Handles
+
+You can share some data between easy handles when the easy interface is used,
+and some data is share automatically when you use the multi interface.
+
+When you add easy handles to a multi handle, these easy handles automatically
+share a lot of the data that otherwise would be kept on a per-easy handle
+basis when the easy interface is used.
+
+The DNS cache is shared between handles within a multi handle, making
+subsequent name resolving faster, and the connection pool that is kept to
+better allow persistent connections and connection reuse is also shared. If
+you are using the easy interface, you can still share these between specific
+easy handles by using the share interface, see libcurl-share(3).
+
+Some things are never shared automatically, not within multi handles, like for
+example cookies so the only way to share that is with the share interface.
+
+# Footnotes
+
+## [1]
+
+libcurl 7.10.3 and later have the ability to switch over to chunked
+Transfer-Encoding in cases where HTTP uploads are done with data of an unknown
+size.
+
+## [2]
+
+This happens on Windows machines when libcurl is built and used as a DLL. You
+can still do this on Windows if you link with a static library.
+
+## [3]
+
+The curl-config tool is generated at build-time (on Unix-like systems) and
+should be installed with the 'make install' or similar instruction that
+installs the library, header files, man pages etc.
+
+## [4]
+
+This behavior was different in versions before 7.17.0, where strings had to
+remain valid past the end of the curl_easy_setopt(3) call.
diff --git a/third-party/curl/docs/libcurl/libcurl-url.3 b/third-party/curl/docs/libcurl/libcurl-url.3
deleted file mode 100644
index 3dc3c661e5..0000000000
--- a/third-party/curl/docs/libcurl/libcurl-url.3
+++ /dev/null
@@ -1,147 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH libcurl 3 "10 Sep 2018" "libcurl" "libcurl"
-.SH NAME
-libcurl-url \- URL interface overview
-.SH DESCRIPTION
-The URL interface provides functions for parsing and generating URLs.
-.SH INCLUDE
-You still only include <curl/curl.h> in your code.
-.SH CREATE
-Create a handle that holds URL info and resources with \fIcurl_url(3)\fP:
-.nf
-  CURLU *h = curl_url();
-.fi
-.SH CLEANUP
-When done with it, clean it up with \fIcurl_url_cleanup(3)\fP
-.nf
-  curl_url_cleanup(h);
-.fi
-.SH DUPLICATE
-When you need a copy of a handle, just duplicate it with \fIcurl_url_dup(3)\fP:
-.nf
-  CURLU *nh = curl_url_dup(h);
-.fi
-.SH PARSING
-By setting a URL to the handle with \fIcurl_url_set(3)\fP, the URL is parsed
-and stored in the handle. If the URL is not syntactically correct it returns
-an error instead.
-.nf
-  rc = curl_url_set(h, CURLUPART_URL,
-                    "https://example.com:449/foo/bar?name=moo", 0);
-.fi
-
-The zero in the fourth argument is a bitmask for changing specific features.
-
-If successful, this stores the URL in its individual parts within the handle.
-.SH REDIRECT
-When a handle already contains info about a URL, setting a relative URL makes
-it "redirect" to that.
-.nf
-  rc = curl_url_set(h, CURLUPART_URL, "../test?another", 0);
-.fi
-.SH "GET URL"
-The \fBCURLU\fP handle represents a URL and you can easily extract that with
-\fIcurl_url_get(3)\fP:
-.nf
-  char *url;
-  rc = curl_url_get(h, CURLUPART_URL, &url, 0);
-  curl_free(url);
-.fi
-The zero in the fourth argument is a bitmask for changing specific features.
-.SH "GET PARTS"
-When a URL has been parsed or parts have been set, you can extract those
-pieces from the handle at any time.
-
-.nf
-  rc = curl_url_get(h, CURLUPART_FRAGMENT, &fragment, 0);
-  rc = curl_url_get(h, CURLUPART_HOST, &host, 0);
-  rc = curl_url_get(h, CURLUPART_PASSWORD, &password, 0);
-  rc = curl_url_get(h, CURLUPART_PATH, &path, 0);
-  rc = curl_url_get(h, CURLUPART_PORT, &port, 0);
-  rc = curl_url_get(h, CURLUPART_QUERY, &query, 0);
-  rc = curl_url_get(h, CURLUPART_SCHEME, &scheme, 0);
-  rc = curl_url_get(h, CURLUPART_USER, &user, 0);
-  rc = curl_url_get(h, CURLUPART_ZONEID, &zoneid, 0);
-.fi
-
-Extracted parts are not URL decoded unless the user also asks for it with the
-\fICURLU_URLDECODE\fP flag set in the fourth bitmask argument.
-
-Remember to free the returned string with \fIcurl_free(3)\fP when you are done
-with it!
-.SH "SET PARTS"
-A user set individual URL parts, either after having parsed a full URL or
-instead of parsing such.
-
-.nf
-  rc = curl_url_set(urlp, CURLUPART_FRAGMENT, "anchor", 0);
-  rc = curl_url_set(urlp, CURLUPART_HOST, "www.example.com", 0);
-  rc = curl_url_set(urlp, CURLUPART_PASSWORD, "doe", 0);
-  rc = curl_url_set(urlp, CURLUPART_PATH, "/index.html", 0);
-  rc = curl_url_set(urlp, CURLUPART_PORT, "443", 0);
-  rc = curl_url_set(urlp, CURLUPART_QUERY, "name=john", 0);
-  rc = curl_url_set(urlp, CURLUPART_SCHEME, "https", 0);
-  rc = curl_url_set(urlp, CURLUPART_USER, "john", 0);
-  rc = curl_url_set(urlp, CURLUPART_ZONEID, "eth0", 0);
-.fi
-
-Set parts are not URL encoded unless the user asks for it with the
-\fICURLU_URLENCODE\fP flag.
-.SH "CURLU_APPENDQUERY"
-An application can append a string to the right end of the query part with the
-\fICURLU_APPENDQUERY\fP flag to \fIcurl_url_set(3)\fP.
-
-Imagine a handle that holds the URL "https://example.com/?shoes=2". An
-application can then add the string "hat=1" to the query part like this:
-
-.nf
-  rc = curl_url_set(urlp, CURLUPART_QUERY, "hat=1", CURLU_APPENDQUERY);
-.fi
-
-It notices the lack of an ampersand (&) separator and injects one, and the
-handle's full URL then equals "https://example.com/?shoes=2&hat=1".
-
-The appended string can of course also get URL encoded on add, and if asked to
-URL encode, the encoding process skips the '=' character. For example, append
-"candy=N&N" to what we already have, and URL encode it to deal with the
-ampersand in the data:
-.nf
-  rc = curl_url_set(urlp, CURLUPART_QUERY, "candy=N&N",
-                    CURLU_APPENDQUERY | CURLU_URLENCODE);
-.fi
-
-Now the URL looks like
-.nf
-  https://example.com/?shoes=2&hat=1&candy=N%26N
-.fi
-.SH AVAILABILITY
-The URL API was introduced in libcurl 7.62.0.
-
-A URL with a literal IPv6 address can be parsed even when IPv6 support is not
-enabled.
-.SH "SEE ALSO"
-.BR curl_url "(3), " curl_url_cleanup "(3), " curl_url_get "(3), "
-.BR curl_url_dup "(3), " curl_url_set "(3), " curl_url_strerror "(3), "
-.BR CURLOPT_URL "(3)"
diff --git a/third-party/curl/docs/libcurl/libcurl-url.md b/third-party/curl/docs/libcurl/libcurl-url.md
new file mode 100644
index 0000000000..b39d0304d5
--- /dev/null
+++ b/third-party/curl/docs/libcurl/libcurl-url.md
@@ -0,0 +1,163 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: libcurl-url
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_URL (3)
+  - curl_url (3)
+  - curl_url_cleanup (3)
+  - curl_url_dup (3)
+  - curl_url_get (3)
+  - curl_url_set (3)
+  - curl_url_strerror (3)
+Protocol:
+  - All
+Added-in: 7.62.0
+---
+
+# NAME
+
+libcurl-url - URL interface overview
+
+# DESCRIPTION
+
+The URL interface provides functions for parsing and generating URLs.
+
+# INCLUDE
+
+You still only include \<curl/curl.h\> in your code.
+
+# CREATE
+
+Create a handle that holds URL info and resources with curl_url(3):
+~~~c
+  CURLU *h = curl_url();
+~~~
+
+# CLEANUP
+
+When done with it, clean it up with curl_url_cleanup(3)
+~~~c
+  curl_url_cleanup(h);
+~~~
+
+# DUPLICATE
+
+When you need a copy of a handle, duplicate it with curl_url_dup(3):
+~~~c
+  CURLU *nh = curl_url_dup(h);
+~~~
+
+# PARSING
+
+By setting a URL to the handle with curl_url_set(3), the URL is parsed
+and stored in the handle. If the URL is not syntactically correct it returns
+an error instead.
+~~~c
+  rc = curl_url_set(h, CURLUPART_URL,
+                    "https://example.com:449/foo/bar?name=moo", 0);
+~~~
+
+The zero in the fourth argument is a bitmask for changing specific features.
+
+If successful, this stores the URL in its individual parts within the handle.
+
+# REDIRECT
+
+When a handle already contains info about a URL, setting a relative URL makes
+it "redirect" to that.
+~~~c
+  rc = curl_url_set(h, CURLUPART_URL, "../test?another", 0);
+~~~
+
+# GET URL
+
+The **CURLU** handle represents a URL and you can easily extract that with
+curl_url_get(3):
+~~~c
+  char *url;
+  rc = curl_url_get(h, CURLUPART_URL, &url, 0);
+  curl_free(url);
+~~~
+The zero in the fourth argument is a bitmask for changing specific features.
+
+# GET PARTS
+
+When a URL has been parsed or parts have been set, you can extract those
+pieces from the handle at any time.
+
+~~~c
+  rc = curl_url_get(h, CURLUPART_FRAGMENT, &fragment, 0);
+  rc = curl_url_get(h, CURLUPART_HOST, &host, 0);
+  rc = curl_url_get(h, CURLUPART_PASSWORD, &password, 0);
+  rc = curl_url_get(h, CURLUPART_PATH, &path, 0);
+  rc = curl_url_get(h, CURLUPART_PORT, &port, 0);
+  rc = curl_url_get(h, CURLUPART_QUERY, &query, 0);
+  rc = curl_url_get(h, CURLUPART_SCHEME, &scheme, 0);
+  rc = curl_url_get(h, CURLUPART_USER, &user, 0);
+  rc = curl_url_get(h, CURLUPART_ZONEID, &zoneid, 0);
+~~~
+
+Extracted parts are not URL decoded unless the user also asks for it with the
+*CURLU_URLDECODE* flag set in the fourth bitmask argument.
+
+Remember to free the returned string with curl_free(3) when you are done
+with it.
+
+# SET PARTS
+
+A user set individual URL parts, either after having parsed a full URL or
+instead of parsing such.
+
+~~~c
+  rc = curl_url_set(urlp, CURLUPART_FRAGMENT, "anchor", 0);
+  rc = curl_url_set(urlp, CURLUPART_HOST, "www.example.com", 0);
+  rc = curl_url_set(urlp, CURLUPART_PASSWORD, "doe", 0);
+  rc = curl_url_set(urlp, CURLUPART_PATH, "/index.html", 0);
+  rc = curl_url_set(urlp, CURLUPART_PORT, "443", 0);
+  rc = curl_url_set(urlp, CURLUPART_QUERY, "name=john", 0);
+  rc = curl_url_set(urlp, CURLUPART_SCHEME, "https", 0);
+  rc = curl_url_set(urlp, CURLUPART_USER, "john", 0);
+  rc = curl_url_set(urlp, CURLUPART_ZONEID, "eth0", 0);
+~~~
+
+Set parts are not URL encoded unless the user asks for it with the
+*CURLU_URLENCODE* flag.
+
+# CURLU_APPENDQUERY
+
+An application can append a string to the right end of the query part with the
+*CURLU_APPENDQUERY* flag to curl_url_set(3).
+
+Imagine a handle that holds the URL "https://example.com/?shoes=2". An
+application can then add the string "hat=1" to the query part like this:
+
+~~~c
+  rc = curl_url_set(urlp, CURLUPART_QUERY, "hat=1", CURLU_APPENDQUERY);
+~~~
+
+It notices the lack of an ampersand (&) separator and injects one, and the
+handle's full URL then equals "https://example.com/?shoes=2&hat=1".
+
+The appended string can of course also get URL encoded on add, and if asked to
+URL encode, the encoding process skips the '=' character. For example, append
+"candy=N&N" to what we already have, and URL encode it to deal with the
+ampersand in the data:
+
+~~~c
+  rc = curl_url_set(urlp, CURLUPART_QUERY, "candy=N&N",
+                    CURLU_APPENDQUERY | CURLU_URLENCODE);
+~~~
+
+Now the URL looks like
+
+~~~c
+  https://example.com/?shoes=2&hat=1&candy=N%26N
+~~~
+
+# NOTES
+
+A URL with a literal IPv6 address can be parsed even when IPv6 support is not
+enabled.
diff --git a/third-party/curl/docs/libcurl/libcurl-ws.3 b/third-party/curl/docs/libcurl/libcurl-ws.3
deleted file mode 100644
index dd08f1e90d..0000000000
--- a/third-party/curl/docs/libcurl/libcurl-ws.3
+++ /dev/null
@@ -1,114 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH libcurl 3 "10 Sep 2018" "libcurl" "libcurl"
-.SH NAME
-libcurl-ws \- WebSocket interface overview
-.SH DESCRIPTION
-The WebSocket interface provides functions for receiving and sending WebSocket
-data.
-.SH INCLUDE
-You still only include <curl/curl.h> in your code.
-.SH SETUP
-WebSocket is also often known as \fIWebSockets\fP, in plural. It is done by
-upgrading a regular HTTP(S) GET request to a WebSocket connection.
-
-WebSocket is a TCP-like message-based communication protocol done over HTTP,
-specified in RFC 6455.
-
-To initiate a WebSocket session with libcurl, setup an easy handle to use a
-URL with a "WS://" or "WSS://" scheme. "WS" is for cleartext communication
-over HTTP and "WSS" is for doing WebSocket securely over HTTPS.
-
-A WebSocket request is done as an HTTP/1 GET request with an "Upgrade
-WebSocket" request header field. When the upgrade is accepted by the server,
-it responds with a 101 Switching and then the client can speak WebSocket with
-the server. The communication can happen in both directions at the same time.
-.SH MESSAGES
-WebSocket communication is message based. That means that both ends send and
-receive entire messages, not streams like TCP. A WebSocket message is sent
-over the wire in one or more frames. Each frame in a message can have a size
-up to 2^63 bytes.
-
-libcurl delivers WebSocket data as frame fragments. It might send a whole
-frame, but it might also deliver them in pieces depending on size and network
-patterns. It makes sure to provide the API user about the exact specifics
-about the fragment: type, offset, size and how much data there is pending to
-arrive for the same frame.
-
-A message has an unknown size until the last frame header for the message has
-been received since only frames have set sizes.
-.SH "Raw mode"
-libcurl can be told to speak WebSocket in "raw mode" by setting the
-\fBCURLWS_RAW_MODE\fP bit to the \fICURLOPT_WS_OPTIONS(3)\fP option.
-
-Raw WebSocket means that libcurl passes on the data from the network without
-parsing it leaving that entirely to the application. This mode assumes that
-the user of this knows WebSocket and can parse and figure out the data all by
-itself.
-
-This mode is intended for applications that already have a WebSocket
-parser/engine that want to switch over to use libcurl for enabling WebSocket,
-but keep parts of the existing software architecture.
-.SH PING
-WebSocket is designed to allow long-lived sessions and in order to keep the
-connections alive, both ends can send PING messages for the other end to
-respond with a PONG.
-
-libcurl automatically responds to server PING messages with a PONG. It does
-not send any PING messages automatically.
-.SH MODELS
-Because of the many different ways WebSocket can be used, which is much more
-flexible than limited to plain downloads or uploads, libcurl offers two
-different API models to use it:
-
-1. Using a write callback with \fICURLOPT_WRITEFUNCTION(3)\fP much like other
-downloads for when the traffic is download oriented.
-
-2. Using \fICURLOPT_CONNECT_ONLY(3)\fP and use the WebSocket recv/send
-functions.
-.SH "Callback model"
-When a write callback is set and a WebSocket transfer is performed, the
-callback is called to deliver all WebSocket data that arrives.
-
-The callback can then call \fIcurl_ws_meta(3)\fP to learn about the details of
-the incoming data fragment.
-.SH "CONNECT_ONLY model"
-By setting \fICURLOPT_CONNECT_ONLY(3)\fP to \fB2L\fP, the transfer only
-establishes and setups the WebSocket communication and then returns control
-back to the application.
-
-Once such a setup has been successfully performed, the application can proceed
-and use \fIcurl_ws_recv(3)\fP and \fIcurl_ws_send(3)\fP freely to exchange
-WebSocket messages with the server.
-.SH AVAILABILITY
-The WebSocket API was introduced as experimental in 7.86.0 and is still
-experimental today.
-
-It is only built-in if explicitly opted in at build time. We discourage use of
-the WebSocket API in production because of its experimental state. We might
-change API, ABI and behavior before this "goes live".
-.SH "SEE ALSO"
-.BR curl_ws_meta "(3), " curl_ws_recv "(3), " curl_ws_send "(3), "
-.BR curl_easy_init "(3), " CURLOPT_CONNECT_ONLY "(3), "
-.BR CURLOPT_WRITEFUNCTION "(3)" CURLOPT_WS_OPTIONS "(3), "
diff --git a/third-party/curl/docs/libcurl/libcurl-ws.md b/third-party/curl/docs/libcurl/libcurl-ws.md
new file mode 100644
index 0000000000..cce13abb24
--- /dev/null
+++ b/third-party/curl/docs/libcurl/libcurl-ws.md
@@ -0,0 +1,154 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: libcurl-ws
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CONNECT_ONLY (3)
+  - CURLOPT_WRITEFUNCTION (3)
+  - CURLOPT_WS_OPTIONS (3)
+  - curl_easy_init (3)
+  - curl_ws_meta (3)
+  - curl_ws_recv (3)
+  - curl_ws_send (3)
+Protocol:
+  - All
+Added-in: 7.86.0
+---
+
+# NAME
+
+libcurl-ws - WebSocket interface overview
+
+# DESCRIPTION
+
+The WebSocket interface provides functions for receiving and sending WebSocket
+data.
+
+# INCLUDE
+
+You still only include \<curl/curl.h\> in your code.
+
+# SETUP
+
+WebSocket is also often known as *WebSockets*, in plural. It is done by
+upgrading a regular HTTP(S) GET request to a WebSocket connection.
+
+WebSocket is a TCP-like message-based communication protocol done over HTTP,
+specified in RFC 6455.
+
+To initiate a WebSocket session with libcurl, setup an easy handle to use a
+URL with a `ws://` or `wss://` scheme. "WS" is for cleartext communication
+over HTTP and "WSS" is for doing WebSocket securely over HTTPS.
+
+A WebSocket request is done as an HTTP/1 GET request with an "Upgrade
+WebSocket" request header field. When the upgrade is accepted by the server,
+it responds with a 101 Switching and then the client can speak WebSocket with
+the server. The communication can happen in both directions at the same time.
+
+# EXTENSIONS
+
+The WebSocket protocol allows the client to request and negotiate *extensions*
+can add additional features and restrictions to the protocol.
+
+libcurl does not support the use of extensions and always sets up a connection
+without them.
+
+# MESSAGES
+
+WebSocket communication is message based. That means that both ends send and
+receive entire messages, not streams like TCP. A WebSocket message is sent
+over the wire in one or more frames. A message which is split into several
+frames is referred to as a *fragmented* message and the individual frames are
+called *fragments*. Each frame (or fragment) in a message can have a size of
+up to 2^63 bytes and declares the frame size in the header. The total size of
+a message that is fragmented into multiple frames is not limited by the
+protocol and the number of fragments is not known until the final fragment is
+received.
+
+Transmission of a frame must not be interrupted by any other data transfers and
+transmission of the different fragments of a message must not be interrupted by
+other user data frames. Control frames - PING, PONG and CLOSE - may be
+transmitted in between any other two frames, even in between two fragments of
+the same user data message. The control frames themselves on the other hand
+must never be fragmented and are limited to a size of 125 bytes.
+
+libcurl delivers WebSocket data as chunks of frames. It might deliver a whole
+frame as a single chunk, but it might also deliver it in several pieces
+depending on size and network patterns. See the individual API documentations
+for further information.
+
+# PING
+
+WebSocket is designed to allow long-lived sessions and in order to keep the
+connections alive, both ends can send PING messages for the other end to
+respond with a PONG. Both ends may also send unsolicited PONG messages as
+unidirectional heartbeat.
+
+libcurl automatically responds to server PING messages with a PONG that echoes
+the payload of the PING message. libcurl does neither send any PING messages
+nor any unsolicited PONG messages automatically. The automatic reply to PING
+messages can be disabled through CURLOPT_WS_OPTIONS(3).
+
+# MODELS
+
+Because of the many different ways WebSocket can be used, which is much more
+flexible than limited to plain downloads or uploads, libcurl offers two
+different API models to use it:
+
+1. CURLOPT_WRITEFUNCTION/CURLOPT_READFUNCTION model:
+Using a write callback with CURLOPT_WRITEFUNCTION(3) much like other
+downloads for when the traffic is download oriented.
+
+Using a read callback with CURLOPT_READFUNCTION(3) much like other
+uploads for sending WebSocket frames to the server.
+
+2. CURLOPT_CONNECT_ONLY model:
+Using curl_ws_recv(3) and curl_ws_send(3) functions.
+
+## CURLOPT_WRITEFUNCTION/CURLOPT_READFUNCTION MODEL
+
+CURLOPT_CONNECT_ONLY(3) must be unset or **0L** for this model to take effect.
+
+curl_easy_perform(3) establishes and sets up the WebSocket communication and
+then blocks for the whole duration of the connection. libcurl calls the
+callback configured in CURLOPT_WRITEFUNCTION(3), whenever an incoming chunk
+of WebSocket data is received. The callback is handed a pointer to the payload
+data as an argument and can call curl_ws_meta(3) to get relevant metadata.
+
+With libcurl 8.16.0 or later, sending of WebSocket frames via a
+CURLOPT_READFUNCTION(3) is supported. To use that on such a connection,
+register a callback via CURLOPT_READFUNCTION(3) and set CURLOPT_UPLOAD(3)
+as well. Once, the WebSocket connection is established, your callback is
+invoked to get data to send. That data is sent in a *CURLWS_BINARY* frame with
+length of exactly the data returned.
+
+To send other frame types or longer frames, use curl_ws_start_frame(3)
+in the read callback. See the *websocket-updown* example.
+
+When using curl_multi_perform(3) to drive transfers, more possibilities
+exist. The CURLOPT_READFUNCTION(3) may return *CURL_READFUNC_PAUSE* when
+it has no more data to send. Calling curl_easy_pause(3) afterwards
+resumes the upload and the read callback is invoked again.
+
+## CURLOPT_CONNECT_ONLY MODEL
+
+CURLOPT_CONNECT_ONLY(3) must be **2L** for this model to take effect.
+
+curl_easy_perform(3) only establishes and sets up the WebSocket communication
+and then returns control back to the application. The application can then use
+curl_ws_recv(3) and curl_ws_send(3) to exchange WebSocket messages with the
+server.
+
+# RAW MODE
+
+libcurl can be told to speak WebSocket in "raw mode" by setting the
+**CURLWS_RAW_MODE** bit of the CURLOPT_WS_OPTIONS(3) option.
+
+Raw WebSocket means that libcurl passes on the data from the network without
+parsing it, leaving that entirely to the application.
+
+This mode is intended for applications that already have a WebSocket
+parser/engine and want to switch over to use libcurl for enabling WebSocket,
+and keep parts of the existing software architecture.
diff --git a/third-party/curl/docs/libcurl/libcurl.3 b/third-party/curl/docs/libcurl/libcurl.3
deleted file mode 100644
index 1c17406633..0000000000
--- a/third-party/curl/docs/libcurl/libcurl.3
+++ /dev/null
@@ -1,228 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH libcurl 3 "March 19, 2002" "libcurl" "libcurl"
-.SH NAME
-libcurl \- client-side URL transfers
-.SH DESCRIPTION
-This is a short overview on how to use libcurl in your C programs. There are
-specific man pages for each function mentioned in here. See
-\fIlibcurl-easy(3)\fP, \fIlibcurl-multi(3)\fP, \fIlibcurl-share(3)\fP,
-\fIlibcurl-url(3)\fP, \fIlibcurl-ws(3)\fP and \fIlibcurl-tutorial(3)\fP for
-in-depth understanding on how to program with libcurl.
-
-There are many bindings available that bring libcurl access to your favorite
-language. Look elsewhere for documentation on those.
-.SH TRANSFERS
-To transfer files, you create an "easy handle" using \fIcurl_easy_init(3)\fP
-for a single individual transfer (in either direction). You then set your
-desired set of options in that handle with \fIcurl_easy_setopt(3)\fP. Options
-you set with \fIcurl_easy_setopt(3)\fP stick. They are then used for every
-repeated use of this handle until you either change the option, or you reset
-them all with \fIcurl_easy_reset(3)\fP.
-
-To actually transfer data you have the option of using the "easy" interface,
-or the "multi" interface.
-
-The easy interface is a synchronous interface with which you call
-\fIcurl_easy_perform(3)\fP and let it perform the transfer. When it is
-completed, the function returns and you can continue. More details are found in
-the \fIlibcurl-easy(3)\fP man page.
-
-The multi interface on the other hand is an asynchronous interface, that you
-call and that performs only a little piece of the transfer on each invoke. It
-is perfect if you want to do things while the transfer is in progress, or
-similar. The multi interface allows you to select() on libcurl action, and
-even to easily download multiple files simultaneously using a single
-thread. See further details in the \fIlibcurl-multi(3)\fP man page.
-
-.SH "SUPPORT INTERFACES"
-There is also a series of other helpful functions and interface families to
-use, including these:
-.RS
-.IP curl_version_info()
-gets detailed libcurl (and other used libraries) version info. See
-\fIcurl_version_info(3)\fP
-.IP curl_getdate()
-converts a date string to time_t. See \fIcurl_getdate(3)\fP
-.IP curl_easy_getinfo()
-get information about a performed transfer. See \fIcurl_easy_getinfo(3)\fP
-.IP curl_mime_addpart()
-helps building an HTTP form POST. See \fIcurl_mime_addpart(3)\fP
-.IP curl_slist_append()
-builds a linked list. See \fIcurl_slist_append(3)\fP
-.IP Sharing data between transfers
-You can have multiple easy handles share certain data, even if they are used
-in different threads. This magic is setup using the share interface, as
-described in the \fIlibcurl-share(3)\fP man page.
-.IP "URL Parsing"
-URL parsing and manipulations. See \fIlibcurl-url(3)\fP
-.IP "WebSocket communication"
-See \fIlibcurl-ws(3)\fP
-.RE
-
-.SH "LINKING WITH LIBCURL"
-On unix-like machines, there is a tool named curl-config that gets installed
-with the rest of the curl stuff when 'make install' is performed.
-
-curl-config is added to make it easier for applications to link with libcurl
-and developers to learn about libcurl and how to use it.
-
-Run 'curl-config --libs' to get the (additional) linker options you need to
-link with the particular version of libcurl you have installed. See the
-\fIcurl-config(1)\fP man page for further details.
-
-Unix-like operating system that ship libcurl as part of their distributions
-often do not provide the curl-config tool, but simply install the library and
-headers in the common path for this purpose.
-
-Many Linux and similar systems use pkg-config to provide build and link
-options about libraries and libcurl supports that as well.
-.SH "LIBCURL SYMBOL NAMES"
-All public functions in the libcurl interface are prefixed with 'curl_' (with
-a lowercase c). You can find other functions in the library source code, but
-other prefixes indicate that the functions are private and may change without
-further notice in the next release.
-
-Only use documented functions and functionality!
-.SH "PORTABILITY"
-libcurl works
-.B exactly
-the same, on any of the platforms it compiles and builds on.
-.SH "THREADS"
-libcurl is thread safe but there are a few exceptions. Refer to
-\fIlibcurl-thread(3)\fP for more information.
-
-.SH "PERSISTENT CONNECTIONS"
-Persistent connections means that libcurl can reuse the same connection for
-several transfers, if the conditions are right.
-
-libcurl always attempts to use persistent connections. Whenever you use
-\fIcurl_easy_perform(3)\fP or \fIcurl_multi_perform(3)\fP etc, libcurl
-attempts to use an existing connection to do the transfer, and if none exists
-it opens a new one that is subject for reuse on a possible following call to
-\fIcurl_easy_perform(3)\fP or \fIcurl_multi_perform(3)\fP.
-
-To allow libcurl to take full advantage of persistent connections, you should
-do as many of your file transfers as possible using the same handle.
-
-If you use the easy interface, and you call \fIcurl_easy_cleanup(3)\fP, all
-the possibly open connections held by libcurl are closed and forgotten.
-
-When you have created a multi handle and are using the multi interface, the
-connection pool is instead kept in the multi handle so closing and creating
-new easy handles to do transfers do not affect them. Instead all added easy
-handles can take advantage of the single shared pool.
-.SH "GLOBAL CONSTANTS"
-There are a variety of constants that libcurl uses, mainly through its
-internal use of other libraries, which are too complicated for the
-library loader to set up. Therefore, a program must call a library
-function after the program is loaded and running to finish setting up
-the library code. For example, when libcurl is built for SSL
-capability via the GNU TLS library, there is an elaborate tree inside
-that library that describes the SSL protocol.
-
-\fIcurl_global_init(3)\fP is the function that you must call. This may
-allocate resources (e.g. the memory for the GNU TLS tree mentioned above), so
-the companion function \fIcurl_global_cleanup(3)\fP releases them.
-
-If libcurl was compiled with support for multiple SSL backends, the function
-\fIcurl_global_sslset(3)\fP can be called before \fIcurl_global_init(3)\fP
-to select the active SSL backend.
-
-The global constant functions are thread-safe since libcurl 7.84.0 if
-\fIcurl_version_info(3)\fP has the CURL_VERSION_THREADSAFE feature bit set
-(most platforms). Read \fIlibcurl-thread(3)\fP for thread safety guidelines.
-
-If the global constant functions are \fInot thread safe\fP, then you must
-not call them when any other thread in the program is running. It
-is not good enough that no other thread is using libcurl at the time,
-because these functions internally call similar functions of other
-libraries, and those functions are similarly thread-unsafe. You cannot
-generally know what these libraries are, or whether other threads are
-using them.
-
-If the global constant functions are \fInot thread safe\fP, then the basic rule
-for constructing a program that uses libcurl is this: Call
-\fIcurl_global_init(3)\fP, with a \fICURL_GLOBAL_ALL\fP argument, immediately
-after the program starts, while it is still only one thread and before it uses
-libcurl at all. Call \fIcurl_global_cleanup(3)\fP immediately before the
-program exits, when the program is again only one thread and after its last
-use of libcurl.
-
-It is not actually required that the functions be called at the beginning
-and end of the program -- that is just usually the easiest way to do it.
-
-You can call both of these multiple times, as long as all calls meet
-these requirements and the number of calls to each is the same.
-
-The global constant situation merits special consideration when the
-code you are writing to use libcurl is not the main program, but rather
-a modular piece of a program, e.g. another library. As a module,
-your code does not know about other parts of the program -- it does not
-know whether they use libcurl or not. And its code does not necessarily
-run at the start and end of the whole program.
-
-A module like this must have global constant functions of its own, just like
-\fIcurl_global_init(3)\fP and \fIcurl_global_cleanup(3)\fP. The module thus
-has control at the beginning and end of the program and has a place to call
-the libcurl functions. If multiple modules in the program use libcurl, they
-all separately call the libcurl functions, and that is OK because only the
-first \fIcurl_global_init(3)\fP and the last \fIcurl_global_cleanup(3)\fP in a
-program change anything. (libcurl uses a reference count in static memory).
-
-In a C++ module, it is common to deal with the global constant situation by
-defining a special class that represents the global constant environment of
-the module. A program always has exactly one object of the class, in static
-storage. That way, the program automatically calls the constructor of the
-object as the program starts up and the destructor as it terminates. As the
-author of this libcurl-using module, you can make the constructor call
-\fIcurl_global_init(3)\fP and the destructor call \fIcurl_global_cleanup(3)\fP
-and satisfy libcurl's requirements without your user having to think about it.
-(Caveat: If you are initializing libcurl from a Windows DLL you should not
-initialize it from \fIDllMain\fP or a static initializer because Windows holds
-the loader lock during that time and it could cause a deadlock.)
-
-\fIcurl_global_init(3)\fP has an argument that tells what particular parts of
-the global constant environment to set up. In order to successfully use any
-value except \fICURL_GLOBAL_ALL\fP (which says to set up the whole thing), you
-must have specific knowledge of internal workings of libcurl and all other
-parts of the program of which it is part.
-
-A special part of the global constant environment is the identity of the
-memory allocator. \fIcurl_global_init(3)\fP selects the system default memory
-allocator, but you can use \fIcurl_global_init_mem(3)\fP to supply one of your
-own. However, there is no way to use \fIcurl_global_init_mem(3)\fP in a
-modular program -- all modules in the program that might use libcurl would
-have to agree on one allocator.
-
-There is a failsafe in libcurl that makes it usable in simple situations
-without you having to worry about the global constant environment at all:
-\fIcurl_easy_init(3)\fP sets up the environment itself if it has not been done
-yet. The resources it acquires to do so get released by the operating system
-automatically when the program exits.
-
-This failsafe feature exists mainly for backward compatibility because there
-was a time when the global functions did not exist. Because it is sufficient
-only in the simplest of programs, it is not recommended for any program to
-rely on it.
diff --git a/third-party/curl/docs/libcurl/libcurl.m4 b/third-party/curl/docs/libcurl/libcurl.m4
index e4a518b5ce..7f8211bc9a 100644
--- a/third-party/curl/docs/libcurl/libcurl.m4
+++ b/third-party/curl/docs/libcurl/libcurl.m4
@@ -20,9 +20,9 @@
 #
 # SPDX-License-Identifier: curl
 #
-###########################################################################
-# LIBCURL_CHECK_CONFIG ([DEFAULT-ACTION], [MINIMUM-VERSION],
-#                       [ACTION-IF-YES], [ACTION-IF-NO])
+#***************************************************************************
+# LIBCURL_CHECK_CONFIG([DEFAULT-ACTION], [MINIMUM-VERSION],
+#                      [ACTION-IF-YES], [ACTION-IF-NO])
 # ----------------------------------------------------------
 #      David Shaw <dshaw@jabberwocky.com>   May-09-2006
 #
@@ -41,12 +41,12 @@
 # values.  Other useful defines are LIBCURL_FEATURE_xxx where xxx are
 # the various features supported by libcurl, and LIBCURL_PROTOCOL_yyy
 # where yyy are the various protocols supported by libcurl.  Both xxx
-# and yyy are capitalized.  See the list of AH_TEMPLATEs at the top of
-# the macro for the complete list of possible defines.  Shell
+# and yyy are capitalized.  See the list of AH_TEMPLATE macros at the top
+# of the macro for the complete list of possible defines.  Shell
 # variables $libcurl_feature_xxx and $libcurl_protocol_yyy are also
 # defined to 'yes' for those features and protocols that were found.
 # Note that xxx and yyy keep the same capitalization as in the
-# curl-config list (e.g. it's "HTTP" and not "http").
+# curl-config list (e.g. it is "HTTP" and not "http").
 #
 # Users may override the detected values by doing something like:
 # LIBCURL="-lcurl" LIBCURL_CPPFLAGS="-I/usr/myinclude" ./configure
@@ -83,191 +83,190 @@ AC_DEFUN([LIBCURL_CHECK_CONFIG],
   AH_TEMPLATE([LIBCURL_PROTOCOL_SMTP],[Defined if libcurl supports SMTP])
 
   AC_ARG_WITH(libcurl,
-     AS_HELP_STRING([--with-libcurl=PREFIX],[look for the curl library in PREFIX/lib and headers in PREFIX/include]),
-     [_libcurl_with=$withval],[_libcurl_with=ifelse([$1],,[yes],[$1])])
+    AS_HELP_STRING([--with-libcurl=PREFIX],[look for the curl library in PREFIX/lib and headers in PREFIX/include]),
+    [_libcurl_with=$withval],[_libcurl_with=ifelse([$1],,[yes],[$1])])
 
-  if test "$_libcurl_with" != "no" ; then
+  if test "x$_libcurl_with" != "xno"; then
 
-     AC_PROG_AWK
+    AC_PROG_AWK
 
-     _libcurl_version_parse="eval $AWK '{split(\$NF,A,\".\"); X=256*256*A[[1]]+256*A[[2]]+A[[3]]; print X;}'"
+    _libcurl_version_parse="eval $AWK '{split(\$NF,A,\".\"); X=256*256*A[[1]]+256*A[[2]]+A[[3]]; print X;}'"
 
-     _libcurl_try_link=yes
+    _libcurl_try_link=yes
 
-     if test -d "$_libcurl_with" ; then
-        LIBCURL_CPPFLAGS="-I$withval/include"
-        _libcurl_ldflags="-L$withval/lib"
-        AC_PATH_PROG([_libcurl_config],[curl-config],[],
-                     ["$withval/bin"])
-     else
-        AC_PATH_PROG([_libcurl_config],[curl-config],[],[$PATH])
-     fi
+    if test -d "$_libcurl_with"; then
+      LIBCURL_CPPFLAGS="-I$withval/include"
+      _libcurl_ldflags="-L$withval/lib"
+      AC_PATH_PROG([_libcurl_config],[curl-config],[],["$withval/bin"])
+    else
+      AC_PATH_PROG([_libcurl_config],[curl-config],[],[$PATH])
+    fi
 
-     if test x$_libcurl_config != "x" ; then
-        AC_CACHE_CHECK([for the version of libcurl],
-           [libcurl_cv_lib_curl_version],
-           [libcurl_cv_lib_curl_version=`$_libcurl_config --version | $AWK '{print $[]2}'`])
+    if test -n "$_libcurl_config"; then
+      AC_CACHE_CHECK([for the version of libcurl],
+        [libcurl_cv_lib_curl_version],
+        [libcurl_cv_lib_curl_version=`$_libcurl_config --version | $AWK '{print $[]2}'`])
 
-        _libcurl_version=`echo $libcurl_cv_lib_curl_version | $_libcurl_version_parse`
-        _libcurl_wanted=`echo ifelse([$2],,[0],[$2]) | $_libcurl_version_parse`
+      _libcurl_version=`echo $libcurl_cv_lib_curl_version | $_libcurl_version_parse`
+      _libcurl_wanted=`echo ifelse([$2],,[0],[$2]) | $_libcurl_version_parse`
 
-        if test $_libcurl_wanted -gt 0 ; then
-           AC_CACHE_CHECK([for libcurl >= version $2],
-              [libcurl_cv_lib_version_ok],
-              [
-              if test $_libcurl_version -ge $_libcurl_wanted ; then
-                 libcurl_cv_lib_version_ok=yes
-              else
-                 libcurl_cv_lib_version_ok=no
-              fi
-              ])
+      if test "$_libcurl_wanted" -gt 0; then
+        AC_CACHE_CHECK([for libcurl >= version $2],
+          [libcurl_cv_lib_version_ok],
+          [
+          if test "$_libcurl_version" -ge "$_libcurl_wanted"; then
+            libcurl_cv_lib_version_ok=yes
+          else
+            libcurl_cv_lib_version_ok=no
+          fi
+          ])
+      fi
+
+      if test "$_libcurl_wanted" -eq 0 || test "$libcurl_cv_lib_version_ok" = "yes"; then
+        if test -z "$LIBCURL_CPPFLAGS"; then
+          LIBCURL_CPPFLAGS=`$_libcurl_config --cflags`
+        fi
+        if test -z "$LIBCURL"; then
+          LIBCURL=`$_libcurl_config --libs`
+
+          dnl This is so silly, but Apple actually has a bug in their
+          dnl curl-config script.  Fixed in Tiger, but there are still
+          dnl lots of Panther installs around.
+          case "${host}" in
+            powerpc-apple-darwin7*)
+              LIBCURL=`echo $LIBCURL | sed -e 's|-arch i386||g'`
+              ;;
+          esac
         fi
 
-        if test $_libcurl_wanted -eq 0 || test x$libcurl_cv_lib_version_ok = xyes ; then
-           if test x"$LIBCURL_CPPFLAGS" = "x" ; then
-              LIBCURL_CPPFLAGS=`$_libcurl_config --cflags`
-           fi
-           if test x"$LIBCURL" = "x" ; then
-              LIBCURL=`$_libcurl_config --libs`
+        dnl All curl-config scripts support --feature
+        _libcurl_features=`$_libcurl_config --feature`
 
-              # This is so silly, but Apple actually has a bug in their
-              # curl-config script.  Fixed in Tiger, but there are still
-              # lots of Panther installs around.
-              case "${host}" in
-                 powerpc-apple-darwin7*)
-                    LIBCURL=`echo $LIBCURL | sed -e 's|-arch i386||g'`
-                 ;;
-              esac
-           fi
+        dnl Is it modern enough to have --protocols? (7.12.4)
+        if test "$_libcurl_version" -ge 461828; then
+          _libcurl_protocols=`$_libcurl_config --protocols`
+        fi
+      else
+        _libcurl_try_link=no
+      fi
 
-           # All curl-config scripts support --feature
-           _libcurl_features=`$_libcurl_config --feature`
+      unset _libcurl_wanted
+    fi
 
-           # Is it modern enough to have --protocols? (7.12.4)
-           if test $_libcurl_version -ge 461828 ; then
-              _libcurl_protocols=`$_libcurl_config --protocols`
-           fi
-        else
-           _libcurl_try_link=no
+    if test "$_libcurl_try_link" = "yes"; then
+
+      dnl we did not find curl-config, so let's see if the user-supplied
+      dnl link line (or failing that, "-lcurl") is enough.
+      LIBCURL=${LIBCURL-"$_libcurl_ldflags -lcurl"}
+
+      AC_CACHE_CHECK([whether libcurl is usable],
+        [libcurl_cv_lib_curl_usable],
+        [
+        _libcurl_save_cppflags=$CPPFLAGS
+        CPPFLAGS="$LIBCURL_CPPFLAGS $CPPFLAGS"
+        _libcurl_save_libs=$LIBS
+        LIBS="$LIBCURL $LIBS"
+
+        AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <curl/curl.h>]],[[
+          /* Try to use a few common options to force a failure if we are
+             missing symbols or cannot link. */
+          int x;
+          curl_easy_setopt(NULL,CURLOPT_URL,NULL);
+          x=CURL_ERROR_SIZE;
+          x=CURLOPT_WRITEFUNCTION;
+          x=CURLOPT_WRITEDATA;
+          x=CURLOPT_ERRORBUFFER;
+          x=CURLOPT_STDERR;
+          x=CURLOPT_VERBOSE;
+          if(x) {;}
+        ]])],libcurl_cv_lib_curl_usable=yes,libcurl_cv_lib_curl_usable=no)
+
+        CPPFLAGS=$_libcurl_save_cppflags
+        LIBS=$_libcurl_save_libs
+        unset _libcurl_save_cppflags
+        unset _libcurl_save_libs
+        ])
+
+      if test "$libcurl_cv_lib_curl_usable" = "yes"; then
+
+        dnl Does curl_free() exist in this version of libcurl?
+        dnl If not, fake it with free()
+
+        _libcurl_save_cppflags=$CPPFLAGS
+        CPPFLAGS="$CPPFLAGS $LIBCURL_CPPFLAGS"
+        _libcurl_save_libs=$LIBS
+        LIBS="$LIBS $LIBCURL"
+
+        AC_CHECK_DECL([curl_free],[],
+          [AC_DEFINE([curl_free],[free],
+            [Define curl_free() as free() if our version of curl lacks curl_free.])],
+          [[#include <curl/curl.h>]])
+
+        CPPFLAGS=$_libcurl_save_cppflags
+        LIBS=$_libcurl_save_libs
+        unset _libcurl_save_cppflags
+        unset _libcurl_save_libs
+
+        AC_DEFINE(HAVE_LIBCURL,1,
+          [Define to 1 if you have a functional curl library.])
+        AC_SUBST(LIBCURL_CPPFLAGS)
+        AC_SUBST(LIBCURL)
+
+        for _libcurl_feature in $_libcurl_features; do
+          AC_DEFINE_UNQUOTED(AS_TR_CPP(libcurl_feature_$_libcurl_feature),[1])
+          eval AS_TR_SH(libcurl_feature_$_libcurl_feature)=yes
+        done
+
+        if test -z "$_libcurl_protocols"; then
+
+          dnl We do not have --protocols; assume that all
+          dnl protocols are available
+          _libcurl_protocols="HTTP FTP FILE TELNET LDAP DICT TFTP"
+
+          if test "$libcurl_feature_SSL" = "yes"; then
+            _libcurl_protocols="$_libcurl_protocols HTTPS"
+
+            dnl FTPS was not standards-compliant until version
+            dnl 7.11.0 (0x070b00 == 461568)
+            if test "$_libcurl_version" -ge 461568; then
+              _libcurl_protocols="$_libcurl_protocols FTPS"
+            fi
+          fi
+
+          dnl RTSP, IMAP, POP3 and SMTP were added in
+          dnl 7.20.0 (0x071400 == 463872)
+          if test "$_libcurl_version" -ge 463872; then
+            _libcurl_protocols="$_libcurl_protocols RTSP IMAP POP3 SMTP"
+          fi
         fi
 
-        unset _libcurl_wanted
-     fi
+        for _libcurl_protocol in $_libcurl_protocols; do
+          AC_DEFINE_UNQUOTED(AS_TR_CPP(libcurl_protocol_$_libcurl_protocol),[1])
+          eval AS_TR_SH(libcurl_protocol_$_libcurl_protocol)=yes
+        done
+      else
+        unset LIBCURL
+        unset LIBCURL_CPPFLAGS
+      fi
+    fi
 
-     if test $_libcurl_try_link = yes ; then
-
-        # we did not find curl-config, so let's see if the user-supplied
-        # link line (or failing that, "-lcurl") is enough.
-        LIBCURL=${LIBCURL-"$_libcurl_ldflags -lcurl"}
-
-        AC_CACHE_CHECK([whether libcurl is usable],
-           [libcurl_cv_lib_curl_usable],
-           [
-           _libcurl_save_cppflags=$CPPFLAGS
-           CPPFLAGS="$LIBCURL_CPPFLAGS $CPPFLAGS"
-           _libcurl_save_libs=$LIBS
-           LIBS="$LIBCURL $LIBS"
-
-           AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <curl/curl.h>]],[[
-/* Try and use a few common options to force a failure if we are
-   missing symbols or cannot link. */
-int x;
-curl_easy_setopt(NULL,CURLOPT_URL,NULL);
-x=CURL_ERROR_SIZE;
-x=CURLOPT_WRITEFUNCTION;
-x=CURLOPT_WRITEDATA;
-x=CURLOPT_ERRORBUFFER;
-x=CURLOPT_STDERR;
-x=CURLOPT_VERBOSE;
-if (x) {;}
-]])],libcurl_cv_lib_curl_usable=yes,libcurl_cv_lib_curl_usable=no)
-
-           CPPFLAGS=$_libcurl_save_cppflags
-           LIBS=$_libcurl_save_libs
-           unset _libcurl_save_cppflags
-           unset _libcurl_save_libs
-           ])
-
-        if test $libcurl_cv_lib_curl_usable = yes ; then
-
-           # Does curl_free() exist in this version of libcurl?
-           # If not, fake it with free()
-
-           _libcurl_save_cppflags=$CPPFLAGS
-           CPPFLAGS="$CPPFLAGS $LIBCURL_CPPFLAGS"
-           _libcurl_save_libs=$LIBS
-           LIBS="$LIBS $LIBCURL"
-
-           AC_CHECK_DECL([curl_free],[],
-              [AC_DEFINE([curl_free],[free],
-                [Define curl_free() as free() if our version of curl lacks curl_free.])],
-              [[#include <curl/curl.h>]])
-
-           CPPFLAGS=$_libcurl_save_cppflags
-           LIBS=$_libcurl_save_libs
-           unset _libcurl_save_cppflags
-           unset _libcurl_save_libs
-
-           AC_DEFINE(HAVE_LIBCURL,1,
-             [Define to 1 if you have a functional curl library.])
-           AC_SUBST(LIBCURL_CPPFLAGS)
-           AC_SUBST(LIBCURL)
-
-           for _libcurl_feature in $_libcurl_features ; do
-              AC_DEFINE_UNQUOTED(AS_TR_CPP(libcurl_feature_$_libcurl_feature),[1])
-              eval AS_TR_SH(libcurl_feature_$_libcurl_feature)=yes
-           done
-
-           if test "x$_libcurl_protocols" = "x" ; then
-
-              # We do not have --protocols, so just assume that all
-              # protocols are available
-              _libcurl_protocols="HTTP FTP FILE TELNET LDAP DICT TFTP"
-
-              if test x$libcurl_feature_SSL = xyes ; then
-                 _libcurl_protocols="$_libcurl_protocols HTTPS"
-
-                 # FTPS was not standards-compliant until version
-                 # 7.11.0 (0x070b00 == 461568)
-                 if test $_libcurl_version -ge 461568; then
-                    _libcurl_protocols="$_libcurl_protocols FTPS"
-                 fi
-              fi
-
-              # RTSP, IMAP, POP3 and SMTP were added in
-              # 7.20.0 (0x071400 == 463872)
-              if test $_libcurl_version -ge 463872; then
-                 _libcurl_protocols="$_libcurl_protocols RTSP IMAP POP3 SMTP"
-              fi
-           fi
-
-           for _libcurl_protocol in $_libcurl_protocols ; do
-              AC_DEFINE_UNQUOTED(AS_TR_CPP(libcurl_protocol_$_libcurl_protocol),[1])
-              eval AS_TR_SH(libcurl_protocol_$_libcurl_protocol)=yes
-           done
-        else
-           unset LIBCURL
-           unset LIBCURL_CPPFLAGS
-        fi
-     fi
-
-     unset _libcurl_try_link
-     unset _libcurl_version_parse
-     unset _libcurl_config
-     unset _libcurl_feature
-     unset _libcurl_features
-     unset _libcurl_protocol
-     unset _libcurl_protocols
-     unset _libcurl_version
-     unset _libcurl_ldflags
+    unset _libcurl_try_link
+    unset _libcurl_version_parse
+    unset _libcurl_config
+    unset _libcurl_feature
+    unset _libcurl_features
+    unset _libcurl_protocol
+    unset _libcurl_protocols
+    unset _libcurl_version
+    unset _libcurl_ldflags
   fi
 
-  if test x$_libcurl_with = xno || test x$libcurl_cv_lib_curl_usable != xyes ; then
-     # This is the IF-NO path
-     ifelse([$4],,:,[$4])
+  if test "x$_libcurl_with" = "xno" || test "$libcurl_cv_lib_curl_usable" != "yes"; then
+    dnl This is the IF-NO path
+    ifelse([$4],,:,[$4])
   else
-     # This is the IF-YES path
-     ifelse([$3],,:,[$3])
+    dnl This is the IF-YES path
+    ifelse([$3],,:,[$3])
   fi
 
   unset _libcurl_with
diff --git a/third-party/curl/docs/libcurl/libcurl.md b/third-party/curl/docs/libcurl/libcurl.md
new file mode 100644
index 0000000000..da61d4c5ea
--- /dev/null
+++ b/third-party/curl/docs/libcurl/libcurl.md
@@ -0,0 +1,250 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: libcurl
+Section: 3
+Source: libcurl
+See-also:
+  - libcurl-easy (3)
+  - libcurl-multi (3)
+  - libcurl-security (3)
+  - libcurl-thread (3)
+Protocol:
+  - All
+Added-in: n/a
+---
+
+# NAME
+
+libcurl - client-side URL transfers
+
+# DESCRIPTION
+
+This is a short overview on how to use libcurl in your C programs. There are
+specific man pages for each function mentioned in here. See
+libcurl-easy(3), libcurl-multi(3), libcurl-share(3),
+libcurl-url(3), libcurl-ws(3) and libcurl-tutorial(3) for
+in-depth understanding on how to program with libcurl.
+
+There are many bindings available that bring libcurl access to your favorite
+language. Look elsewhere for documentation on those.
+
+# TRANSFERS
+
+To transfer files, you create an "easy handle" using curl_easy_init(3)
+for a single individual transfer (in either direction). You then set your
+desired set of options in that handle with curl_easy_setopt(3). Options
+you set with curl_easy_setopt(3) stick. They are then used for every
+repeated use of this handle until you either change the option, or you reset
+them all with curl_easy_reset(3).
+
+To actually transfer data you have the option of using the "easy" interface,
+or the "multi" interface.
+
+The easy interface is a synchronous interface with which you call
+curl_easy_perform(3) and let it perform the transfer. When it is
+completed, the function returns and you can continue. More details are found in
+the libcurl-easy(3) man page.
+
+The multi interface on the other hand is an asynchronous interface, that you
+call and that performs only a little piece of the transfer on each invoke. It
+is perfect if you want to do things while the transfer is in progress, or
+similar. The multi interface allows you to select() on libcurl action, and
+even to easily download multiple files simultaneously using a single
+thread. See further details in the libcurl-multi(3) man page.
+
+# SUPPORT INTERFACES
+
+There is also a series of other helpful functions and interface families to
+use, including these:
+
+## curl_version_info()
+
+gets detailed libcurl (and other used libraries) version info. See
+curl_version_info(3)
+
+## curl_getdate()
+
+converts a date string to time_t. See curl_getdate(3)
+
+## curl_easy_getinfo()
+
+get information about a performed transfer. See curl_easy_getinfo(3)
+
+## curl_mime_addpart()
+
+helps building an HTTP form POST. See curl_mime_addpart(3)
+
+## curl_slist_append()
+
+builds a linked list. See curl_slist_append(3)
+
+## Sharing data between transfers
+
+You can have multiple easy handles share certain data, even if they are used
+in different threads. Set that up using the share interface, as described in
+the libcurl-share(3) man page.
+
+## URL Parsing
+
+URL parsing and manipulations. See libcurl-url(3)
+
+## WebSocket communication
+
+See libcurl-ws(3)
+
+# LINKING WITH LIBCURL
+
+On Unix-like machines, there is a tool named curl-config that gets installed
+with the rest of the curl stuff when 'make install' is performed.
+
+curl-config is added to make it easier for applications to link with libcurl
+and developers to learn about libcurl and how to use it.
+
+Run 'curl-config --libs' to get the (additional) linker options you need to
+link with the particular version of libcurl you have installed. See the
+*curl-config(1)* man page for further details.
+
+Unix-like operating system that ship libcurl as part of their distributions
+often do not provide the curl-config tool, but only install the library and
+headers in the common path for this purpose.
+
+Many Linux and similar systems use pkg-config to provide build and link
+options about libraries and libcurl supports that as well.
+
+# LIBCURL SYMBOL NAMES
+
+All public functions in the libcurl interface are prefixed with 'curl_' (with
+a lowercase c). You can find other functions in the library source code, but
+other prefixes indicate that the functions are private and may change without
+further notice in the next release.
+
+Only use documented functions and functionality.
+
+# PORTABILITY
+
+libcurl works
+**exactly**
+the same, on any of the platforms it compiles and builds on.
+
+# THREADS
+
+libcurl is thread-safe but there are a few exceptions. Refer to
+libcurl-thread(3) for more information.
+
+# PERSISTENT CONNECTIONS
+
+Persistent connections means that libcurl can reuse the same connection for
+several transfers, if the conditions are right.
+
+libcurl always attempts to use persistent connections. Whenever you use
+curl_easy_perform(3) or curl_multi_perform(3) etc, libcurl
+attempts to use an existing connection to do the transfer, and if none exists
+it opens a new one that is subject for reuse on a possible following call to
+curl_easy_perform(3) or curl_multi_perform(3).
+
+To allow libcurl to take full advantage of persistent connections, you should
+do as many of your file transfers as possible using the same handle.
+
+If you use the easy interface, and you call curl_easy_cleanup(3), all
+the possibly open connections held by libcurl are closed and forgotten.
+
+When you have created a multi handle and are using the multi interface, the
+connection pool is instead kept in the multi handle so closing and creating
+new easy handles to do transfers do not affect them. Instead all added easy
+handles can take advantage of the single shared pool.
+
+# GLOBAL CONSTANTS
+
+There are a variety of constants that libcurl uses, mainly through its
+internal use of other libraries, which are too complicated for the
+library loader to set up. Therefore, a program must call a library
+function after the program is loaded and running to finish setting up
+the library code. For example, when libcurl is built for SSL
+capability via the GNU TLS library, there is an elaborate tree inside
+that library that describes the SSL protocol.
+
+curl_global_init(3) is the function that you must call. This may
+allocate resources (e.g. the memory for the GNU TLS tree mentioned above), so
+the companion function curl_global_cleanup(3) releases them.
+
+If libcurl was compiled with support for multiple SSL backends, the function
+curl_global_sslset(3) can be called before curl_global_init(3)
+to select the active SSL backend.
+
+The global constant functions are thread-safe since libcurl 7.84.0 if
+curl_version_info(3) has the CURL_VERSION_THREADSAFE feature bit set
+(most platforms). Read libcurl-thread(3) for thread-safety guidelines.
+
+If the global constant functions are *not thread-safe*, then you must
+not call them when any other thread in the program is running. It
+is not good enough that no other thread is using libcurl at the time,
+because these functions internally call similar functions of other
+libraries, and those functions are similarly thread-unsafe. You cannot
+generally know what these libraries are, or whether other threads are
+using them.
+
+If the global constant functions are *not thread-safe*, then the basic rule
+for constructing a program that uses libcurl is this: Call
+curl_global_init(3), with a *CURL_GLOBAL_ALL* argument, immediately
+after the program starts, while it is still only one thread and before it uses
+libcurl at all. Call curl_global_cleanup(3) immediately before the
+program exits, when the program is again only one thread and after its last
+use of libcurl.
+
+It is not actually required that the functions be called at the beginning and
+end of the program -- that is usually the easiest way to do it.
+
+You can call both of these multiple times, as long as all calls meet
+these requirements and the number of calls to each is the same.
+
+The global constant situation merits special consideration when the code you
+are writing to use libcurl is not the main program, but rather a modular piece
+of a program, e.g. another library. As a module, your code does not know about
+other parts of the program -- it does not know whether they use libcurl or
+not. Its code does not necessarily run at the start and end of the whole
+program.
+
+A module like this must have global constant functions of its own, like
+curl_global_init(3) and curl_global_cleanup(3). The module thus has control at
+the beginning and end of the program and has a place to call the libcurl
+functions. If multiple modules in the program use libcurl, they all separately
+call the libcurl functions, and that is OK because only the first
+curl_global_init(3) and the last curl_global_cleanup(3) in a program change
+anything. (libcurl uses a reference count in static memory).
+
+In a C++ module, it is common to deal with the global constant situation by
+defining a special class that represents the global constant environment of
+the module. A program always has exactly one object of the class, in static
+storage. That way, the program automatically calls the constructor of the
+object as the program starts up and the destructor as it terminates. As the
+author of this libcurl-using module, you can make the constructor call
+curl_global_init(3) and the destructor call curl_global_cleanup(3)
+and satisfy libcurl's requirements without your user having to think about it.
+(Caveat: If you are initializing libcurl from a Windows DLL you should not
+initialize it from *DllMain* or a static initializer because Windows holds
+the loader lock during that time and it could cause a deadlock.)
+
+curl_global_init(3) has an argument that tells what particular parts of
+the global constant environment to set up. In order to successfully use any
+value except *CURL_GLOBAL_ALL* (which says to set up the whole thing), you
+must have specific knowledge of internal workings of libcurl and all other
+parts of the program of which it is part.
+
+A special part of the global constant environment is the identity of the
+memory allocator. curl_global_init(3) selects the system default memory
+allocator, but you can use curl_global_init_mem(3) to supply one of your own.
+There is no way to use curl_global_init_mem(3) in a modular program -- all
+modules in the program that might use libcurl would have to agree on one
+allocator.
+
+There is a failsafe in libcurl that makes it usable in simple situations
+without you having to worry about the global constant environment at all:
+curl_easy_init(3) sets up the environment itself if it has not been done
+yet. The resources it acquires to do so get released by the operating system
+automatically when the program exits.
+
+This failsafe feature exists mainly for backward compatibility because there
+was a time when the global functions did not exist. Because it is sufficient
+only in the simplest of programs, it is not recommended for any program to
+rely on it.
diff --git a/third-party/curl/docs/libcurl/mksymbolsmanpage.pl b/third-party/curl/docs/libcurl/mksymbolsmanpage.pl
index a8cb10d82a..9db028e7c4 100644
--- a/third-party/curl/docs/libcurl/mksymbolsmanpage.pl
+++ b/third-party/curl/docs/libcurl/mksymbolsmanpage.pl
@@ -22,41 +22,38 @@
 # * SPDX-License-Identifier: curl
 # *
 # ***************************************************************************
-
-my $version="7.41.0";
+use strict;
+use warnings;
 
 use POSIX qw(strftime);
-my $date = strftime "%b %e, %Y", localtime;
-my $year = strftime "%Y", localtime;
+my @ts;
+if(defined($ENV{SOURCE_DATE_EPOCH})) {
+    @ts = localtime($ENV{SOURCE_DATE_EPOCH});
+} else {
+    @ts = localtime;
+}
+my $date = strftime "%b %e, %Y", @ts;
+my $year = strftime "%Y", @ts;
 
 print <<HEADER
-.\\" **************************************************************************
-.\\" *                                  _   _ ____  _
-.\\" *  Project                     ___| | | |  _ \\| |
-.\\" *                             / __| | | | |_) | |
-.\\" *                            | (__| |_| |  _ <| |___
-.\\" *                             \\___|\\___/|_| \\_\\_____|
-.\\" *
-.\\" * Copyright (C) Daniel Stenberg, <daniel\@haxx.se>, et al.
-.\\" *
-.\\" * This software is licensed as described in the file COPYING, which
-.\\" * you should have received as part of this distribution. The terms
-.\\" * are also available at https://curl.se/docs/copyright.html.
-.\\" *
-.\\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\\" * copies of the Software, and permit persons to whom the Software is
-.\\" * furnished to do so, under the terms of the COPYING file.
-.\\" *
-.\\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\\" * KIND, either express or implied.
-.\\" *
-.\\" * SPDX-License-Identifier: curl
-.\\" *
-.\\" **************************************************************************
-.TH libcurl-symbols 3 "$date" "libcurl" "libcurl"
-.SH NAME
-libcurl-symbols \\- libcurl symbol version information
-.SH "libcurl symbols"
+---
+c: Copyright (C) Daniel Stenberg, <daniel\@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: libcurl-symbols
+Section: 3
+Source: libcurl
+Protocol:
+  - All
+See-also:
+  - libcurl (3)
+  - libcurl-easy (3)
+  - libcurl-multi (3)
+  - libcurl-security (3)
+  - libcurl-thread (3)
+Added-in: n/a
+---
+# libcurl symbols
+
 This man page details version information for public symbols provided in the
 libcurl header files. This lists the first version in which the symbol was
 introduced and for some symbols two additional information pieces:
@@ -66,15 +63,233 @@ since that version no new code should be written to use the symbol as it is
 marked for getting removed in a future.
 
 The last version that featured the specific symbol. Using the symbol in source
-code will make it no longer compile error-free after that specified version.
+code makes it no longer compile error-free after that specified version.
 
 This man page is automatically generated from the symbols-in-versions file.
 HEADER
     ;
 
+sub nameref {
+    my ($n) = @_;
+    if($n =~ /^CURLOPT_/) {
+        if($n eq "CURLOPT_RTSPHEADER") {
+            $n = "CURLOPT_HTTPHEADER";
+        }
+        elsif($n eq "CURLOPT_WRITEHEADER") {
+            $n = "CURLOPT_HEADERDATA";
+        }
+        elsif($n eq "CURLOPT_WRITEINFO") {
+            ; # now obsolete
+        }
+        else {
+            return "$n(3)";
+        }
+    }
+    elsif($n =~ /^CURLMOPT_/) {
+        return "$n(3)";
+    }
+    elsif($n =~ /^CURLINFO_/) {
+        my %infotypes = (
+            'CURLINFO_TEXT' => 1,
+            'CURLINFO_HEADER_IN' => 1,
+            'CURLINFO_HEADER_OUT' => 1,
+            'CURLINFO_DATA_IN' => 1,
+            'CURLINFO_DATA_OUT' => 1,
+            'CURLINFO_SSL_DATA_IN' => 1,
+            'CURLINFO_SSL_DATA_OUT' => 1,
+            );
+        if($infotypes{$n}) {
+            return "CURLOPT_DEBUGFUNCTION(3)";
+        }
+    }
+    elsif($n =~ /^CURLALTSVC_/) {
+        return "CURLOPT_ALTSVC_CTRL(3)";
+    }
+    elsif($n =~ /^CURLAUTH_/) {
+        return "CURLOPT_HTTPAUTH(3)";
+    }
+    elsif($n =~ /^CURLFORM_/) {
+        return "curl_formadd(3)";
+    }
+    elsif($n =~ /^CURLKH/) {
+        return "CURLOPT_SSH_KEYFUNCTION(3)";
+    }
+    elsif($n =~ /^CURLE_/) {
+        return "libcurl-errors(3)";
+    }
+    elsif($n =~ /^CURLM_/) {
+        return "libcurl-errors(3)";
+    }
+    elsif($n =~ /^CURLUE_/) {
+        return "libcurl-errors(3)";
+    }
+    elsif($n =~ /^CURLHE_/) {
+        return "libcurl-errors(3)";
+    }
+    elsif($n =~ /^CURLSHE_/) {
+        return "libcurl-errors(3)";
+    }
+    elsif($n =~ /^CURLPROTO_/) {
+        return "CURLINFO_PROTOCOL(3)";
+    }
+    elsif($n =~ /^CURLPX_/) {
+        return "CURLINFO_PROXY_ERROR(3)";
+    }
+    elsif($n =~ /^CURLPROXY_/) {
+        return "CURLOPT_PROXYTYPE(3)";
+    }
+    elsif($n =~ /^CURLSSLBACKEND_/) {
+        return "curl_global_sslset(3)";
+    }
+    elsif($n =~ /^CURLSSLOPT_/) {
+        return "CURLOPT_SSL_OPTIONS(3)";
+    }
+    elsif($n =~ /^CURLSSLSET_/) {
+        return "curl_global_sslset(3)";
+    }
+    elsif($n =~ /^CURLUPART_/) {
+        return "curl_url_get(3)";
+    }
+    elsif($n =~ /^CURLU_/) {
+        return "curl_url_get(3)";
+    }
+    elsif($n =~ /^CURLVERSION_/) {
+        return "curl_version_info(3)";
+    }
+    elsif($n =~ /^CURLSHOPT_/) {
+        if($n eq "CURLSHOPT_NONE") {
+            $n = "curl_share_setopt";
+        }
+        return "$n(3)";
+    }
+    elsif($n =~ /^CURLWS_/) {
+        return "curl_ws_send(3)";
+    }
+    elsif($n =~ /^CURL_FORMADD_/) {
+        return "curl_formadd(3)";
+    }
+    elsif($n =~ /^CURL_HTTPPOST_/) {
+        return "curl_formadd(3)";
+    }
+    elsif($n =~ /^CURL_GLOBAL_/) {
+        return "curl_global_init(3)";
+    }
+    elsif($n =~ /^CURL_HTTP_VERSION_/) {
+        return "CURLOPT_HTTP_VERSION(3)";
+    }
+    elsif($n =~ /^CURL_LOCK_/) {
+        return "CURLSHOPT_SHARE(3)";
+    }
+    elsif($n =~ /^CURL_SSLVERSION_/) {
+        return "CURLOPT_SSLVERSION(3)";
+    }
+    elsif($n =~ /^CURL_VERSION_/) {
+        return "curl_version_info(3)";
+    }
+    elsif($n =~ /^CURL_RTSPREQ_/) {
+        return "CURLOPT_RTSP_REQUEST(3)";
+    }
+    elsif($n =~ /^CURLH_/) {
+        return "curl_easy_header(3)";
+    }
+    elsif($n =~ /^CURL_TRAILERFUNC_/) {
+        return "CURLOPT_TRAILERFUNCTION(3)";
+    }
+    elsif($n =~ /^CURLOT_/) {
+        return "curl_easy_option_next(3)";
+    }
+    elsif($n =~ /^CURLFINFOFLAG_/) {
+        return "CURLOPT_CHUNK_BGN_FUNCTION(3)";
+    }
+    elsif($n =~ /^CURLFILETYPE_/) {
+        return "CURLOPT_CHUNK_BGN_FUNCTION(3)";
+    }
+    elsif($n =~ /^CURL_CHUNK_BGN_FUNC_/) {
+        return "CURLOPT_CHUNK_BGN_FUNCTION(3)";
+    }
+    elsif($n =~ /^CURL_CHUNK_END_FUNC_/) {
+        return "CURLOPT_CHUNK_END_FUNCTION(3)";
+    }
+    elsif($n =~ /^CURLSSH_AUTH_/) {
+        return "CURLOPT_SSH_AUTH_TYPES(3)";
+    }
+    elsif($n =~ /^CURL_POLL_/) {
+        return "CURLMOPT_SOCKETFUNCTION(3)";
+    }
+    elsif($n =~ /^CURLMSG_/) {
+        return "curl_multi_info_read(3)";
+    }
+    elsif($n =~ /^CURLFTPAUTH_/) {
+        return "CURLOPT_FTPSSLAUTH(3)";
+    }
+    elsif($n =~ /^CURLFTPMETHOD_/) {
+        return "CURLOPT_FTP_FILEMETHOD(3)";
+    }
+    elsif($n =~ /^CURLFTPSSL_/) {
+        return "CURLOPT_USE_SSL(3)";
+    }
+    elsif($n =~ /^CURLFTP_CREATE_/) {
+        return "CURLOPT_FTP_CREATE_MISSING_DIRS(3)";
+    }
+    elsif($n =~ /^CURLGSSAPI_DELEGATION_/) {
+        return "CURLOPT_GSSAPI_DELEGATION(3)";
+    }
+    elsif($n =~ /^CURLHEADER_/) {
+        return "CURLOPT_HEADEROPT(3)";
+    }
+    elsif($n =~ /^CURLHSTS_/) {
+        return "CURLOPT_HSTS_CTRL(3)";
+    }
+    elsif($n =~ /^CURLIOCMD_/) {
+        return "CURLOPT_IOCTLFUNCTION(3)";
+    }
+    elsif($n =~ /^CURLIOE_/) {
+        return "CURLOPT_IOCTLFUNCTION(3)";
+    }
+    elsif($n =~ /^CURLMIMEOPT_/) {
+        return "CURLOPT_MIME_OPTIONS(3)";
+    }
+    elsif($n =~ /^CURLPAUSE_/) {
+        return "curl_easy_pause(3)";
+    }
+    elsif($n =~ /^CURLPIPE_/) {
+        return "CURLMOPT_PIPELINING(3)";
+    }
+    elsif($n =~ /^CURLSOCKTYPE_/) {
+        return "CURLOPT_SOCKOPTFUNCTION(3)";
+    }
+    elsif($n =~ /^CURLSTS_/) {
+        return "CURLOPT_HSTSREADFUNCTION(3)";
+    }
+    elsif($n =~ /^CURLUSESSL_/) {
+        return "CURLOPT_USE_SSL(3)";
+    }
+    elsif($n =~ /^CURL_CSELECT_/) {
+        return "curl_multi_socket_action(3)";
+    }
+    elsif($n =~ /^CURL_FNMATCHFUNC_/) {
+        return "CURLOPT_FNMATCH_FUNCTION(3)";
+    }
+    elsif($n =~ /^CURL_HET_/) {
+        return "CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS(3)";
+    }
+    elsif($n =~ /^CURL_IPRESOLVE_/) {
+        return "CURLOPT_IPRESOLVE(3)";
+    }
+    elsif($n =~ /^CURL_SEEKFUNC_/) {
+        return "CURLOPT_SEEKFUNCTION(3)";
+    }
+    elsif($n =~ /^CURL_TIMECOND_/) {
+        return "CURLOPT_TIMECONDITION(3)";
+    }
+    elsif($n =~ /^CURL_REDIR_POST_/) {
+        return "CURLOPT_POSTREDIR(3)";
+    }
+}
+
 while(<STDIN>) {
     if($_ =~ /^(CURL[A-Z0-9_.]*) *(.*)/i) {
-        my ($symbol, $rest)=($1,$2);
+        my ($symbol, $rest) = ($1, $2);
         my ($intro, $dep, $rem);
         if($rest =~ s/^([0-9.]*) *//) {
            $intro = $1;
@@ -82,16 +297,20 @@ while(<STDIN>) {
         if($rest =~ s/^([0-9.]*) *//) {
            $dep = $1;
         }
-        if($rest =~ s/^([0-9.]*) *//) {
+        if($rest =~ s/^- *([0-9.]*)//) {
            $rem = $1;
         }
-        print ".IP $symbol\nIntroduced in $intro\n";
+        print "\n## $symbol\nIntroduced in $intro.";
         if($dep) {
-          print "Deprecated since $dep\n";
+            print " Deprecated since $dep.";
         }
         if($rem) {
-          print "Last used in $rem\n";
+            print " Last used in $rem.";
         }
+        my $see = $rem || $dep ? "" : nameref($symbol);
+        if($see) {
+            print " See $see.";
+        }
+        print "\n";
     }
-
 }
diff --git a/third-party/curl/docs/libcurl/opts/CMakeLists.txt b/third-party/curl/docs/libcurl/opts/CMakeLists.txt
index 152a08a351..f8b5aaa2de 100644
--- a/third-party/curl/docs/libcurl/opts/CMakeLists.txt
+++ b/third-party/curl/docs/libcurl/opts/CMakeLists.txt
@@ -21,15 +21,18 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Load man_MANS from shared file
-transform_makefile_inc("Makefile.inc" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
+# Get man_MANS variable
+curl_transform_makefile_inc("Makefile.inc" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
 include("${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
 
-add_manual_pages(man_MANS)
+curl_add_manual_pages(man_MANS)
+add_custom_target(curl-opts-man DEPENDS ${man_MANS})
+add_dependencies(curl-man curl-opts-man)
 
-string(REPLACE ".3" ".html" HTMLPAGES "${man_MANS}")
-string(REPLACE ".3" ".pdf" PDFPAGES "${man_MANS}")
-add_custom_target(opts-html DEPENDS ${HTMLPAGES})
-add_custom_target(opts-pdf DEPENDS ${PDFPAGES})
-add_dependencies(html opts-html)
-add_dependencies(pdf opts-pdf)
+if(NOT CURL_DISABLE_INSTALL)
+  set(_src "")
+  foreach(_file IN LISTS man_MANS)
+    list(APPEND _src "${CMAKE_CURRENT_BINARY_DIR}/${_file}")
+  endforeach()
+  install(FILES ${_src} DESTINATION "${CMAKE_INSTALL_MANDIR}/man3")
+endif()
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_ACTIVESOCKET.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_ACTIVESOCKET.3
deleted file mode 100644
index fc89a012d6..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_ACTIVESOCKET.3
+++ /dev/null
@@ -1,75 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_ACTIVESOCKET 3 "12 Sep 2015" "libcurl" "libcurl"
-.SH NAME
-CURLINFO_ACTIVESOCKET \- get the active socket
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_ACTIVESOCKET,
-                           curl_socket_t *socket);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a curl_socket_t to receive the most recently active socket
-used for the transfer connection by this curl session. If the socket is no
-longer valid, \fICURL_SOCKET_BAD\fP is returned. When you are finished working
-with the socket, you must call \fIcurl_easy_cleanup(3)\fP as usual on the easy
-handle and let libcurl close the socket and cleanup other resources associated
-with the handle. This option returns the active socket only after the transfer
-is complete, and is typically used in combination with
-\fICURLOPT_CONNECT_ONLY(3)\fP, which skips the transfer phase.
-
-\fICURLINFO_ACTIVESOCKET(3)\fP was added as a replacement for
-\fICURLINFO_LASTSOCKET(3)\fP since that one is not working on all platforms.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_socket_t sockfd;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Do not do the transfer - only connect to host */
-  curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
-  res = curl_easy_perform(curl);
-
-  /* Extract the socket from the curl handle */
-  res = curl_easy_getinfo(curl, CURLINFO_ACTIVESOCKET, &sockfd);
-
-  if(res != CURLE_OK) {
-    printf("Error: %s\\n", curl_easy_strerror(res));
-    return 1;
-  }
-}
-.fi
-.SH AVAILABILITY
-Added in 7.45.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_LASTSOCKET "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_ACTIVESOCKET.md b/third-party/curl/docs/libcurl/opts/CURLINFO_ACTIVESOCKET.md
new file mode 100644
index 0000000000..9dbf4f8573
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_ACTIVESOCKET.md
@@ -0,0 +1,84 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_ACTIVESOCKET
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_LASTSOCKET (3)
+  - CURLOPT_CONNECT_ONLY (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.45.0
+---
+
+# NAME
+
+CURLINFO_ACTIVESOCKET - active socket
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_ACTIVESOCKET,
+                           curl_socket_t *socket);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a curl_socket_t to receive the most recently active socket
+used for the transfer connection by this curl session. If the socket is no
+longer valid, *CURL_SOCKET_BAD* is returned. When you are finished working
+with the socket, you must call curl_easy_cleanup(3) as usual on the easy
+handle and let libcurl close the socket and cleanup other resources associated
+with the handle. This option returns the active socket only after the transfer
+is complete, and is typically used in combination with
+CURLOPT_CONNECT_ONLY(3), which skips the transfer phase.
+
+CURLINFO_ACTIVESOCKET(3) was added as a replacement for
+CURLINFO_LASTSOCKET(3) since that one is not working on all platforms.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_socket_t sockfd;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Do not do the transfer - only connect to host */
+    curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
+    result = curl_easy_perform(curl);
+    if(result != CURLE_OK) {
+      printf("Error: %s\n", curl_easy_strerror(result));
+      curl_easy_cleanup(curl);
+      return 1;
+    }
+
+    /* Extract the socket from the curl handle */
+    result = curl_easy_getinfo(curl, CURLINFO_ACTIVESOCKET, &sockfd);
+    if(!result && sockfd != CURL_SOCKET_BAD) {
+      /* operate on sockfd */
+    }
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_APPCONNECT_TIME.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_APPCONNECT_TIME.3
deleted file mode 100644
index f1281f4a96..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_APPCONNECT_TIME.3
+++ /dev/null
@@ -1,69 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_APPCONNECT_TIME 3 "28 Aug 2015" "libcurl" "libcurl"
-.SH NAME
-CURLINFO_APPCONNECT_TIME \- get the time until the SSL/SSH handshake is completed
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_APPCONNECT_TIME,
-                           double *timep);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a double to receive the time, in seconds, it took from the
-start until the SSL/SSH connect/handshake to the remote host was completed.
-This time is most often close to the \fICURLINFO_PRETRANSFER_TIME(3)\fP time,
-except for cases such as HTTP pipelining where the pretransfer time can be
-delayed due to waits in line for the pipeline and more.
-
-When a redirect is followed, the time from each request is added together.
-
-See also the TIMES overview in the \fIcurl_easy_getinfo(3)\fP man page.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  double connect;
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  res = curl_easy_perform(curl);
-  if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_APPCONNECT_TIME, &connect);
-    if(CURLE_OK == res) {
-      printf("Time: %.1f", connect);
-    }
-  }
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.19.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " CURLINFO_APPCONNECT_TIME_T "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_APPCONNECT_TIME.md b/third-party/curl/docs/libcurl/opts/CURLINFO_APPCONNECT_TIME.md
new file mode 100644
index 0000000000..bb137c120d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_APPCONNECT_TIME.md
@@ -0,0 +1,73 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_APPCONNECT_TIME
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_APPCONNECT_TIME_T (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.19.0
+---
+
+# NAME
+
+CURLINFO_APPCONNECT_TIME - time until the SSL/SSH handshake is completed
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_APPCONNECT_TIME,
+                           double *timep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a double to receive the time, in seconds, it took from the
+start until the SSL/SSH connect/handshake to the remote host was completed.
+This time is most often close to the CURLINFO_PRETRANSFER_TIME(3) time, except
+for cases such as HTTP multiplexing where the pretransfer time can be delayed
+due to waits in line for the stream and more.
+
+When a redirect is followed, the time from each request is added together.
+
+See also the TIMES overview in the curl_easy_getinfo(3) man page.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    double connect;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      result = curl_easy_getinfo(curl, CURLINFO_APPCONNECT_TIME, &connect);
+      if(result == CURLE_OK) {
+        printf("Time: %.1f", connect);
+      }
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_APPCONNECT_TIME_T.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_APPCONNECT_TIME_T.3
deleted file mode 100644
index 46ad3238ad..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_APPCONNECT_TIME_T.3
+++ /dev/null
@@ -1,71 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_APPCONNECT_TIME_T 3 "28 Apr 2018" "libcurl" "libcurl"
-.SH NAME
-CURLINFO_APPCONNECT_TIME_T \- time until the SSL/SSH handshake completed
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_APPCONNECT_TIME_T,
-                           curl_off_t *timep);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a curl_off_t to receive the time, in microseconds, it took
-from the start until the SSL/SSH connect/handshake to the remote host was
-completed. This time is most often close to the
-\fICURLINFO_PRETRANSFER_TIME_T(3)\fP time, except for cases such as HTTP
-pipelining where the pretransfer time can be delayed due to waits in line for
-the pipeline and more.
-
-When a redirect is followed, the time from each request is added together.
-
-See also the TIMES overview in the \fIcurl_easy_getinfo(3)\fP man page.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  curl_off_t connect;
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  res = curl_easy_perform(curl);
-  if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_APPCONNECT_TIME_T, &connect);
-    if(CURLE_OK == res) {
-      printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", connect / 1000000,
-             (long)(connect % 1000000));
-    }
-  }
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.61.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " CURLINFO_APPCONNECT_TIME "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_APPCONNECT_TIME_T.md b/third-party/curl/docs/libcurl/opts/CURLINFO_APPCONNECT_TIME_T.md
new file mode 100644
index 0000000000..4eb595b4d3
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_APPCONNECT_TIME_T.md
@@ -0,0 +1,74 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_APPCONNECT_TIME_T
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_APPCONNECT_TIME (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.61.0
+---
+
+# NAME
+
+CURLINFO_APPCONNECT_TIME_T - time until the SSL/SSH handshake completed
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_APPCONNECT_TIME_T,
+                           curl_off_t *timep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a curl_off_t to receive the time, in microseconds, it took
+from the start until the SSL/SSH connect/handshake to the remote host was
+completed. This time is most often close to the CURLINFO_PRETRANSFER_TIME_T(3)
+time, except for cases such as HTTP multiplexing where the pretransfer time
+can be delayed due to waits in line for the stream and more.
+
+When a redirect is followed, the time from each request is added together.
+
+See also the TIMES overview in the curl_easy_getinfo(3) man page.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_off_t connect;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      result = curl_easy_getinfo(curl, CURLINFO_APPCONNECT_TIME_T, &connect);
+      if(result == CURLE_OK) {
+        printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", connect / 1000000,
+               (long)(connect % 1000000));
+      }
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CAINFO.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_CAINFO.3
deleted file mode 100644
index a992bd366f..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_CAINFO.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_CAINFO 3 "20 May 2022" "libcurl" "libcurl"
-.SH NAME
-CURLINFO_CAINFO \- get the default built-in CA certificate path
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CAINFO, char **path);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a char pointer to receive the pointer to a null-terminated
-string holding the default built-in path used for the \fICURLOPT_CAINFO(3)\fP
-option unless set by the user.
-
-Note that in a situation where libcurl has been built to support multiple TLS
-libraries, this option might return a string even if the specific TLS library
-currently set to be used does not support \fICURLOPT_CAINFO(3)\fP.
-
-This is a path identifying a single file containing CA certificates.
-
-The \fBpath\fP pointer is set to NULL if there is no default path.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  char *cainfo = NULL;
-  curl_easy_getinfo(curl, CURLINFO_CAINFO, &cainfo);
-  if(cainfo)
-      printf("default ca info path: %s\\n", cainfo);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.84.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLINFO_CAPATH "(3), "
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CAINFO.md b/third-party/curl/docs/libcurl/opts/CURLINFO_CAINFO.md
new file mode 100644
index 0000000000..626abca19e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_CAINFO.md
@@ -0,0 +1,70 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_CAINFO
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CAPATH (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - All
+Added-in: 7.84.0
+---
+
+# NAME
+
+CURLINFO_CAINFO - default built-in CA certificate path
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CAINFO, char **path);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a char pointer to receive the pointer to a null-terminated
+string holding the default built-in path used for the CURLOPT_CAINFO(3)
+option unless set by the user.
+
+Note that in a situation where libcurl has been built to support multiple TLS
+libraries, this option might return a string even if the specific TLS library
+currently set to be used does not support CURLOPT_CAINFO(3).
+
+This is a path identifying a single file containing CA certificates.
+
+The **path** pointer is set to NULL if there is no default path.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    char *cainfo = NULL;
+    curl_easy_getinfo(curl, CURLINFO_CAINFO, &cainfo);
+    if(cainfo) {
+      printf("default CA info path: %s\n", cainfo);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CAPATH.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_CAPATH.3
deleted file mode 100644
index 1cc92a928d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_CAPATH.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_CAPATH 3 "20 May 2022" "libcurl" "libcurl"
-.SH NAME
-CURLINFO_CAPATH \- get the default built-in CA path string
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CAPATH, char **path);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a char pointer to receive the pointer to a null-terminated
-string holding the default built-in path used for the \fICURLOPT_CAPATH(3)\fP
-option unless set by the user.
-
-Note that in a situation where libcurl has been built to support multiple TLS
-libraries, this option might return a string even if the specific TLS library
-currently set to be used does not support \fICURLOPT_CAPATH(3)\fP.
-
-This is a path identifying a directory.
-
-The \fBpath\fP pointer is set to NULL if there is no default path.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  char *capath = NULL;
-  curl_easy_getinfo(curl, CURLINFO_CAPATH, &capath);
-  if(capath)
-      printf("default ca path: %s\\n", capath);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.84.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLINFO_CAINFO "(3), "
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CAPATH.md b/third-party/curl/docs/libcurl/opts/CURLINFO_CAPATH.md
new file mode 100644
index 0000000000..603634da8a
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_CAPATH.md
@@ -0,0 +1,73 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_CAPATH
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CAINFO (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+  - mbedTLS
+  - wolfSSL
+Added-in: 7.84.0
+---
+
+# NAME
+
+CURLINFO_CAPATH - default built-in CA path string
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CAPATH, char **path);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a char pointer to receive the pointer to a null-terminated
+string holding the default built-in path used for the CURLOPT_CAPATH(3)
+option unless set by the user.
+
+Note that in a situation where libcurl has been built to support multiple TLS
+libraries, this option might return a string even if the specific TLS library
+currently set to be used does not support CURLOPT_CAPATH(3).
+
+This is a path identifying a directory.
+
+The **path** pointer is set to NULL if there is no default path.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    char *capath = NULL;
+    curl_easy_getinfo(curl, CURLINFO_CAPATH, &capath);
+    if(capath) {
+      printf("default CA path: %s\n", capath);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CERTINFO.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_CERTINFO.3
deleted file mode 100644
index 706888a743..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_CERTINFO.3
+++ /dev/null
@@ -1,98 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_CERTINFO 3 "12 Sep 2015" "libcurl" "libcurl"
-.SH NAME
-CURLINFO_CERTINFO \- get the TLS certificate chain
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CERTINFO,
-                           struct curl_certinfo **chainp);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a \fIstruct curl_certinfo *\fP and it is set to point to a
-struct that holds info about the server's certificate chain, assuming you had
-\fICURLOPT_CERTINFO(3)\fP enabled when the request was made.
-
-.nf
-struct curl_certinfo {
-  int num_of_certs;
-  struct curl_slist **certinfo;
-};
-.fi
-
-The \fIcertinfo\fP struct member is an array of linked lists of certificate
-information. The \fInum_of_certs\fP struct member is the number of
-certificates which is the number of elements in the array. Each certificate's
-list has items with textual information in the format "name:content" such as
-\&"Subject:Foo", "Issuer:Bar", etc. The items in each list varies depending on
-the SSL backend and the certificate.
-.SH PROTOCOLS
-All TLS-based
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");
-
-  /* connect to any HTTPS site, trusted or not */
-  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
-  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
-
-  curl_easy_setopt(curl, CURLOPT_CERTINFO, 1L);
-
-  res = curl_easy_perform(curl);
-
-  if (!res) {
-    struct curl_certinfo *ci;
-    res = curl_easy_getinfo(curl, CURLINFO_CERTINFO, &ci);
-
-    if (!res) {
-      printf("%d certs!\\n", ci->num_of_certs);
-
-      for(i = 0; i < ci->num_of_certs; i++) {
-        struct curl_slist *slist;
-
-        for(slist = ci->certinfo[i]; slist; slist = slist->next)
-          printf("%s\\n", slist->data);
-      }
-    }
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-
-See also the \fIcertinfo.c\fP example.
-.SH AVAILABILITY
-This option is only working in libcurl built with OpenSSL, GnuTLS, Schannel or
-Secure Transport. GnuTLS support added in 7.42.0. Schannel support added in
-7.50.0. Secure Transport support added in 7.79.0.
-
-Added in 7.19.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CERTINFO.md b/third-party/curl/docs/libcurl/opts/CURLINFO_CERTINFO.md
new file mode 100644
index 0000000000..0882cbccd1
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_CERTINFO.md
@@ -0,0 +1,109 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_CERTINFO
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CAPATH (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+  - Schannel
+  - Rustls
+Added-in: 7.19.1
+---
+
+# NAME
+
+CURLINFO_CERTINFO - TLS certificate chain
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CERTINFO,
+                           struct curl_certinfo **chainp);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a *struct curl_certinfo ** and it is set to point to a
+struct that holds info about the server's certificate chain, assuming you had
+CURLOPT_CERTINFO(3) enabled when the request was made.
+
+~~~c
+struct curl_certinfo {
+  int num_of_certs;
+  struct curl_slist **certinfo;
+};
+~~~
+
+The *certinfo* struct member is an array of linked lists of certificate
+information. The *num_of_certs* struct member is the number of certificates
+which is the number of elements in the array. Each certificate's list has
+items with textual information in the format "name:content" such as
+"Subject:Foo", "Issuer:Bar", etc. The items in each list varies depending on
+the SSL backend and the certificate.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");
+
+    /* connect to any HTTPS site, trusted or not */
+    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
+
+    curl_easy_setopt(curl, CURLOPT_CERTINFO, 1L);
+
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      int i;
+      struct curl_certinfo *ci;
+      result = curl_easy_getinfo(curl, CURLINFO_CERTINFO, &ci);
+
+      if(result == CURLE_OK) {
+        printf("%d certs!\n", ci->num_of_certs);
+
+        for(i = 0; i < ci->num_of_certs; i++) {
+          struct curl_slist *slist;
+
+          for(slist = ci->certinfo[i]; slist; slist = slist->next)
+            printf("%s\n", slist->data);
+        }
+      }
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+See also the *certinfo.c* example.
+
+# HISTORY
+
+GnuTLS support added in 7.42.0. Schannel support added in 7.50.0. mbedTLS
+support added in 8.9.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CONDITION_UNMET.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_CONDITION_UNMET.3
deleted file mode 100644
index 28955185b0..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_CONDITION_UNMET.3
+++ /dev/null
@@ -1,76 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_CONDITION_UNMET 3 "1 Sep 2015" "libcurl" "libcurl"
-.SH NAME
-CURLINFO_CONDITION_UNMET \- get info on unmet time conditional or 304 HTTP response.
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONDITION_UNMET,
-                           long *unmet);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive the number 1 if the condition provided in
-the previous request did not match (see \fICURLOPT_TIMECONDITION(3)\fP). Alas,
-if this returns a 1 you know that the reason you did not get data in return is
-because it did not fulfill the condition. The long this argument points to
-gets a zero stored if the condition instead was met. This can also return 1 if
-the server responded with a 304 HTTP status code, for example after sending a
-custom "If-Match-*" header.
-.SH PROTOCOLS
-HTTP and some
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* January 1, 2020 is 1577833200 */
-  curl_easy_setopt(curl, CURLOPT_TIMEVALUE, 1577833200L);
-
-  /* If-Modified-Since the above time stamp */
-  curl_easy_setopt(curl, CURLOPT_TIMECONDITION,
-                   (long)CURL_TIMECOND_IFMODSINCE);
-
-  /* Perform the request */
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    /* check the time condition */
-    long unmet;
-    res = curl_easy_getinfo(curl, CURLINFO_CONDITION_UNMET, &unmet);
-    if(!res) {
-      printf("The time condition was %sfulfilled\\n", unmet?"NOT":"");
-    }
-  }
-}
-.fi
-.SH AVAILABILITY
-Added in 7.19.4
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CONDITION_UNMET.md b/third-party/curl/docs/libcurl/opts/CURLINFO_CONDITION_UNMET.md
new file mode 100644
index 0000000000..133070f5ad
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_CONDITION_UNMET.md
@@ -0,0 +1,81 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_CONDITION_UNMET
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_TIMECONDITION (3)
+  - CURLOPT_TIMEVALUE (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - HTTP
+Added-in: 7.19.4
+---
+
+# NAME
+
+CURLINFO_CONDITION_UNMET - unmet time conditional or 304 HTTP response
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONDITION_UNMET,
+                           long *unmet);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive the number 1 if the condition provided in
+the previous request did not match (see CURLOPT_TIMECONDITION(3)). Alas,
+if this returns a 1 you know that the reason you did not get data in return is
+because it did not fulfill the condition. The long this argument points to
+gets a zero stored if the condition instead was met. This can also return 1 if
+the server responded with a 304 HTTP status code, for example after sending a
+custom "If-Match-*" header.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* January 1, 2020 is 1577833200 */
+    curl_easy_setopt(curl, CURLOPT_TIMEVALUE, 1577833200L);
+
+    /* If-Modified-Since the above time stamp */
+    curl_easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE);
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      /* check the time condition */
+      long unmet;
+      result = curl_easy_getinfo(curl, CURLINFO_CONDITION_UNMET, &unmet);
+      if(result == CURLE_OK) {
+        printf("The time condition was %sfulfilled\n", unmet ? "NOT" : "");
+      }
+    }
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CONNECT_TIME.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_CONNECT_TIME.3
deleted file mode 100644
index 71d1b08764..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_CONNECT_TIME.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_CONNECT_TIME 3 "28 Aug 2015" "libcurl" "libcurl"
-.SH NAME
-CURLINFO_CONNECT_TIME \- get the time until connect
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONNECT_TIME, double *timep);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a double to receive the total time in seconds from the start
-until the connection to the remote host (or proxy) was completed.
-
-When a redirect is followed, the time from each request is added together.
-
-See also the TIMES overview in the \fIcurl_easy_getinfo(3)\fP man page.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  double connect;
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  res = curl_easy_perform(curl);
-  if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_CONNECT_TIME, &connect);
-    if(CURLE_OK == res) {
-      printf("Time: %.1f", connect);
-    }
-  }
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.4.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " CURLINFO_CONNECT_TIME_T "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CONNECT_TIME.md b/third-party/curl/docs/libcurl/opts/CURLINFO_CONNECT_TIME.md
new file mode 100644
index 0000000000..e5f260a64b
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_CONNECT_TIME.md
@@ -0,0 +1,69 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_CONNECT_TIME
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CONNECT_TIME_T (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.4.1
+---
+
+# NAME
+
+CURLINFO_CONNECT_TIME - time to connect
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONNECT_TIME, double *timep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a double to receive the total time in seconds from the start
+until the connection to the remote host (or proxy) was completed.
+
+When a redirect is followed, the time from each request is added together.
+
+See also the TIMES overview in the curl_easy_getinfo(3) man page.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    double connect;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      result = curl_easy_getinfo(curl, CURLINFO_CONNECT_TIME, &connect);
+      if(result == CURLE_OK) {
+        printf("Time: %.1f", connect);
+      }
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CONNECT_TIME_T.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_CONNECT_TIME_T.3
deleted file mode 100644
index c929ae82e1..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_CONNECT_TIME_T.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_CONNECT_TIME_T 3 "28 Apr 2018" "libcurl" "libcurl"
-.SH NAME
-CURLINFO_CONNECT_TIME_T \- get the time until connect
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONNECT_TIME_T,
-                           curl_off_t *timep);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a curl_off_t to receive the total time in microseconds from
-the start until the connection to the remote host (or proxy) was completed.
-
-When a redirect is followed, the time from each request is added together.
-
-See also the TIMES overview in the \fIcurl_easy_getinfo(3)\fP man page.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  curl_off_t connect;
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  res = curl_easy_perform(curl);
-  if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_CONNECT_TIME_T, &connect);
-    if(CURLE_OK == res) {
-      printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", connect / 1000000,
-             (long)(connect % 1000000));
-    }
-  }
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.61.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " CURLINFO_CONNECT_TIME "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CONNECT_TIME_T.md b/third-party/curl/docs/libcurl/opts/CURLINFO_CONNECT_TIME_T.md
new file mode 100644
index 0000000000..27d5ade44e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_CONNECT_TIME_T.md
@@ -0,0 +1,72 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_CONNECT_TIME_T
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CONNECT_TIME (3)
+  - CURLOPT_CONNECTTIMEOUT (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.61.0
+---
+
+# NAME
+
+CURLINFO_CONNECT_TIME_T - time to connect
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONNECT_TIME_T,
+                           curl_off_t *timep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a curl_off_t to receive the total time in microseconds from
+the start until the connection to the remote host (or proxy) was completed.
+
+When a redirect is followed, the time from each request is added together.
+
+See also the TIMES overview in the curl_easy_getinfo(3) man page.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_off_t connect;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      result = curl_easy_getinfo(curl, CURLINFO_CONNECT_TIME_T, &connect);
+      if(result == CURLE_OK) {
+        printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", connect / 1000000,
+               (long)(connect % 1000000));
+      }
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CONN_ID.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_CONN_ID.3
deleted file mode 100644
index f8e7a4651d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_CONN_ID.3
+++ /dev/null
@@ -1,69 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_CONN_ID 3 "07 June 2023" "libcurl" "libcurl"
-.SH NAME
-CURLINFO_CONN_ID \- get the ID of the last connection used by the handle
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONN_ID,
-                           curl_off_t *conn_id);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a \fIcurl_off_t\fP to receive the connection identifier last
-used by the handle. Stores -1 if there was no connection used.
-
-The connection id is unique among all connections using the same
-connection cache. This is implicitly the case for all connections in the
-same multi handle.
-
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Perform the request */
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    curl_off_t conn_id;
-    res = curl_easy_getinfo(curl, CURLINFO_CONN_ID, &conn_id);
-    if(!res) {
-      printf("Connection used: %" CURL_FORMAT_CURL_OFF_T "\\n", conn_id);
-    }
-  }
-}
-.fi
-.SH AVAILABILITY
-Added in 8.2.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_XFER_ID "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CONN_ID.md b/third-party/curl/docs/libcurl/opts/CURLINFO_CONN_ID.md
new file mode 100644
index 0000000000..3d111e6b62
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_CONN_ID.md
@@ -0,0 +1,72 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_CONN_ID
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_XFER_ID (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 8.2.0
+---
+
+# NAME
+
+CURLINFO_CONN_ID - ID of the last connection
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONN_ID,
+                           curl_off_t *conn_id);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a *curl_off_t* to receive the connection identifier last
+used by the handle. Stores -1 if there was no connection used.
+
+The connection id is unique among all connections using the same
+connection cache. This is implicitly the case for all connections in the
+same multi handle.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      curl_off_t conn_id;
+      result = curl_easy_getinfo(curl, CURLINFO_CONN_ID, &conn_id);
+      if(result == CURLE_OK) {
+        printf("Connection used: %" CURL_FORMAT_CURL_OFF_T "\n", conn_id);
+      }
+    }
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_DOWNLOAD.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_DOWNLOAD.3
deleted file mode 100644
index a4bb2743d3..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_DOWNLOAD.3
+++ /dev/null
@@ -1,69 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_CONTENT_LENGTH_DOWNLOAD 3 "1 Sep 2015" "libcurl" "libcurl"
-.SH NAME
-CURLINFO_CONTENT_LENGTH_DOWNLOAD \- get content-length of download
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONTENT_LENGTH_DOWNLOAD,
-                           double *content_length);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a double to receive the content-length of the download. This
-is the value read from the Content-Length: field. Since 7.19.4, this returns
--1 if the size is not known.
-
-\fICURLINFO_CONTENT_LENGTH_DOWNLOAD_T(3)\fP is a newer replacement that returns a more
-sensible variable type.
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Perform the request */
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    /* check the size */
-    double cl;
-    res = curl_easy_getinfo(curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD, &cl);
-    if(!res) {
-      printf("Size: %.0f\\n", cl);
-    }
-  }
-}
-.fi
-.SH AVAILABILITY
-Added in 7.6.1. Deprecated since 7.55.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_CONTENT_LENGTH_UPLOAD "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_DOWNLOAD.md b/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_DOWNLOAD.md
new file mode 100644
index 0000000000..7173f8effb
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_DOWNLOAD.md
@@ -0,0 +1,76 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_CONTENT_LENGTH_DOWNLOAD
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CONTENT_LENGTH_UPLOAD (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.6.1
+---
+
+# NAME
+
+CURLINFO_CONTENT_LENGTH_DOWNLOAD - content-length of download
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONTENT_LENGTH_DOWNLOAD,
+                           double *content_length);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a double to receive the content-length of the download. This
+is the value read from the Content-Length: field. This returns -1 if the size
+is not known.
+
+CURLINFO_CONTENT_LENGTH_DOWNLOAD_T(3) is a newer replacement that returns a more
+sensible variable type.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      /* check the size */
+      double cl;
+      result = curl_easy_getinfo(curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD, &cl);
+      if(result == CURLE_OK) {
+        printf("Size: %.0f\n", cl);
+      }
+    }
+  }
+}
+~~~
+
+# DEPRECATED
+
+Deprecated since 7.55.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_DOWNLOAD_T.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_DOWNLOAD_T.3
deleted file mode 100644
index 8b77ce59fd..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_DOWNLOAD_T.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_CONTENT_LENGTH_DOWNLOAD_T 3 "25 May 2017" "libcurl" "libcurl"
-.SH NAME
-CURLINFO_CONTENT_LENGTH_DOWNLOAD_T \- get content-length of download
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONTENT_LENGTH_DOWNLOAD_T,
-                           curl_off_t *content_length);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a \fIcurl_off_t\fP to receive the content-length of the
-download. This is the value read from the Content-Length: field. Stores -1 if
-the size is not known.
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Perform the request */
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    /* check the size */
-    curl_off_t cl;
-    res = curl_easy_getinfo(curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD_T, &cl);
-    if(!res) {
-      printf("Download size: %" CURL_FORMAT_CURL_OFF_T "\\n", cl);
-    }
-  }
-}
-.fi
-.SH AVAILABILITY
-Added in 7.55.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_CONTENT_LENGTH_UPLOAD_T "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_DOWNLOAD_T.md b/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_DOWNLOAD_T.md
new file mode 100644
index 0000000000..d0a95f6144
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_DOWNLOAD_T.md
@@ -0,0 +1,70 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_CONTENT_LENGTH_DOWNLOAD_T
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CONTENT_LENGTH_UPLOAD_T (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.55.0
+---
+
+# NAME
+
+CURLINFO_CONTENT_LENGTH_DOWNLOAD_T - content-length of download
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONTENT_LENGTH_DOWNLOAD_T,
+                           curl_off_t *content_length);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a *curl_off_t* to receive the content-length of the
+download. This is the value read from the Content-Length: field. Stores -1 if
+the size is not known.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      /* check the size */
+      curl_off_t cl;
+      result =
+        curl_easy_getinfo(curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD_T, &cl);
+      if(result == CURLE_OK) {
+        printf("Download size: %" CURL_FORMAT_CURL_OFF_T "\n", cl);
+      }
+    }
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_UPLOAD.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_UPLOAD.3
deleted file mode 100644
index 5237502ce2..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_UPLOAD.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_CONTENT_LENGTH_UPLOAD 3 "1 Sep 2015" "libcurl" "libcurl"
-.SH NAME
-CURLINFO_CONTENT_LENGTH_UPLOAD \- get the specified size of the upload
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONTENT_LENGTH_UPLOAD,
-                           double *content_length);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a double to receive the specified size of the upload.  Since
-7.19.4, this returns -1 if the size is not known.
-
-\fICURLINFO_CONTENT_LENGTH_UPLOAD_T(3)\fP is a newer replacement that returns a
-more sensible variable type.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Perform the upload */
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    /* check the size */
-    double cl;
-    res = curl_easy_getinfo(curl, CURLINFO_CONTENT_LENGTH_UPLOAD, &cl);
-    if(!res) {
-      printf("Size: %.0f\\n", cl);
-    }
-  }
-}
-.fi
-.SH AVAILABILITY
-Added in 7.6.1. Deprecated since 7.55.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_CONTENT_LENGTH_DOWNLOAD_T "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_UPLOAD.md b/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_UPLOAD.md
new file mode 100644
index 0000000000..6ccd47f1ad
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_UPLOAD.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_CONTENT_LENGTH_UPLOAD
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CONTENT_LENGTH_DOWNLOAD_T (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.6.1
+---
+
+# NAME
+
+CURLINFO_CONTENT_LENGTH_UPLOAD - specified size of the upload
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONTENT_LENGTH_UPLOAD,
+                           double *content_length);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a double to receive the specified size of the upload. Since
+7.19.4, this returns -1 if the size is not known.
+
+CURLINFO_CONTENT_LENGTH_UPLOAD_T(3) is a newer replacement that returns a
+more sensible variable type.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Perform the upload */
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      /* check the size */
+      double cl;
+      result = curl_easy_getinfo(curl, CURLINFO_CONTENT_LENGTH_UPLOAD, &cl);
+      if(result == CURLE_OK) {
+        printf("Size: %.0f\n", cl);
+      }
+    }
+  }
+}
+~~~
+
+# DEPRECATED
+
+Deprecated since 7.55.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_UPLOAD_T.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_UPLOAD_T.3
deleted file mode 100644
index 4df97eb0ea..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_UPLOAD_T.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_CONTENT_LENGTH_UPLOAD_T 3 "25 May 2017" "libcurl" "libcurl"
-.SH NAME
-CURLINFO_CONTENT_LENGTH_UPLOAD_T \- get the specified size of the upload
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONTENT_LENGTH_UPLOAD_T,
-                           curl_off_t *content_length);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a \fIcurl_off_t\fP to receive the specified size of the
-upload. Stores -1 if the size is not known.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Perform the upload */
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    /* check the size */
-    curl_off_t cl;
-    res = curl_easy_getinfo(curl, CURLINFO_CONTENT_LENGTH_UPLOAD_T, &cl);
-    if(!res) {
-      printf("Upload size: %" CURL_FORMAT_CURL_OFF_T "\\n", cl);
-    }
-  }
-}
-.fi
-.SH AVAILABILITY
-Added in 7.55.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_CONTENT_LENGTH_DOWNLOAD_T "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_UPLOAD_T.md b/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_UPLOAD_T.md
new file mode 100644
index 0000000000..7b5d058521
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_LENGTH_UPLOAD_T.md
@@ -0,0 +1,73 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_CONTENT_LENGTH_UPLOAD_T
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CONTENT_LENGTH_DOWNLOAD_T (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.55.0
+---
+
+# NAME
+
+CURLINFO_CONTENT_LENGTH_UPLOAD_T - specified size of the upload
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONTENT_LENGTH_UPLOAD_T,
+                           curl_off_t *content_length);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a *curl_off_t* to receive the specified size of the
+upload. Stores -1 if the size is not known.
+
+This is the size set by the client prior to the transfer start. The expected
+upload amount. Compare this with CURLINFO_SIZE_UPLOAD_T(3), which is the
+amount of data that was actually uploaded in the end. In many cases those two
+numbers are identical.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Perform the upload */
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      /* check the size */
+      curl_off_t cl;
+      result = curl_easy_getinfo(curl, CURLINFO_CONTENT_LENGTH_UPLOAD_T, &cl);
+      if(result == CURLE_OK) {
+        printf("Upload size: %" CURL_FORMAT_CURL_OFF_T "\n", cl);
+      }
+    }
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_TYPE.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_TYPE.3
deleted file mode 100644
index ebf9e4ff27..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_TYPE.3
+++ /dev/null
@@ -1,73 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_CONTENT_TYPE 3 "1 Sep 2015" "libcurl" "libcurl"
-.SH NAME
-CURLINFO_CONTENT_TYPE \- get Content-Type
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONTENT_TYPE, char **ct);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a char pointer to receive the content-type of the downloaded
-object. This is the value read from the Content-Type: field. If you get NULL,
-it means that the server did not send a valid Content-Type header or that the
-protocol used does not support this.
-
-The \fBct\fP pointer is set to NULL or pointing to private memory. You MUST
-NOT free it - it gets freed when you call \fIcurl_easy_cleanup(3)\fP on the
-corresponding CURL handle.
-
-The modern way to get this header from a response is to instead use the
-\fIcurl_easy_header(3)\fP function.
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    /* extract the content-type */
-    char *ct = NULL;
-    res = curl_easy_getinfo(curl, CURLINFO_CONTENT_TYPE, &ct);
-    if(!res && ct) {
-      printf("Content-Type: %s\\n", ct);
-    }
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.9.4
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLOPT_HEADERFUNCTION "(3), " curl_easy_header "(3) "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_TYPE.md b/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_TYPE.md
new file mode 100644
index 0000000000..13feaca953
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_CONTENT_TYPE.md
@@ -0,0 +1,77 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_CONTENT_TYPE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HEADERFUNCTION (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_header (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - HTTP
+Added-in: 7.9.4
+---
+
+# NAME
+
+CURLINFO_CONTENT_TYPE - Content-Type of response
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONTENT_TYPE, char **ct);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a char pointer to receive the content-type of the downloaded
+object. This is the value read from the Content-Type: field. If you get NULL,
+it means that the server did not send a valid Content-Type header or that the
+protocol used does not support this.
+
+The **ct** pointer is NULL or points to private memory. You **must not** free
+it. It gets freed automatically when you call curl_easy_cleanup(3) on the
+corresponding curl handle.
+
+The modern way to get this header from a response is to instead use the
+curl_easy_header(3) function.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      /* extract the content-type */
+      char *ct = NULL;
+      result = curl_easy_getinfo(curl, CURLINFO_CONTENT_TYPE, &ct);
+      if(!result && ct) {
+        printf("Content-Type: %s\n", ct);
+      }
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_COOKIELIST.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_COOKIELIST.3
deleted file mode 100644
index eed733e2d7..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_COOKIELIST.3
+++ /dev/null
@@ -1,81 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_COOKIELIST 3 "1 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_COOKIELIST \- get all known cookies
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_COOKIELIST,
-                           struct curl_slist **cookies);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a 'struct curl_slist *' to receive a linked-list of all
-cookies curl knows (expired ones, too). do not forget to call
-\fIcurl_slist_free_all(3)\fP on the list after it has been used.  If there are
-no cookies (cookies for the handle have not been enabled or simply none have
-been received) the 'struct curl_slist *' is made a NULL pointer.
-
-Since 7.43.0 cookies that were imported in the Set-Cookie format without a
-domain name are not exported by this option.
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* enable the cookie engine */
-  curl_easy_setopt(curl, CURLOPT_COOKIEFILE, "");
-
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    /* extract all known cookies */
-    struct curl_slist *cookies = NULL;
-    res = curl_easy_getinfo(curl, CURLINFO_COOKIELIST, &cookies);
-    if(!res && cookies) {
-      /* a linked list of cookies in cookie file format */
-      struct curl_slist *each = cookies;
-      while(each) {
-        printf("%s\\n", each->data);
-        each = each->next;
-      }
-      /* we must free these cookies when we are done */
-      curl_slist_free_all(cookies);
-    }
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.14.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLOPT_COOKIELIST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_COOKIELIST.md b/third-party/curl/docs/libcurl/opts/CURLINFO_COOKIELIST.md
new file mode 100644
index 0000000000..88cbd64c37
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_COOKIELIST.md
@@ -0,0 +1,84 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_COOKIELIST
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_COOKIELIST (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - HTTP
+Added-in: 7.14.1
+---
+
+# NAME
+
+CURLINFO_COOKIELIST - all known cookies
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_COOKIELIST,
+                           struct curl_slist **cookies);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a 'struct curl_slist *' to receive a linked-list of all
+cookies curl knows (expired ones, too). Do not forget to call
+curl_slist_free_all(3) on the list after it has been used. If there are no
+cookies (cookies for the handle have not been enabled or none have been
+received) the 'struct curl_slist *' is made a NULL pointer.
+
+Cookies that were imported in the Set-Cookie format without a domain name are
+not exported by this option.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* enable the cookie engine */
+    curl_easy_setopt(curl, CURLOPT_COOKIEFILE, "");
+
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      /* extract all known cookies */
+      struct curl_slist *cookies = NULL;
+      result = curl_easy_getinfo(curl, CURLINFO_COOKIELIST, &cookies);
+      if(!result && cookies) {
+        /* a linked list of cookies in cookie file format */
+        struct curl_slist *each = cookies;
+        while(each) {
+          printf("%s\n", each->data);
+          each = each->next;
+        }
+        /* we must free these cookies when we are done */
+        curl_slist_free_all(cookies);
+      }
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_EARLYDATA_SENT_T.md b/third-party/curl/docs/libcurl/opts/CURLINFO_EARLYDATA_SENT_T.md
new file mode 100644
index 0000000000..c326c31f45
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_EARLYDATA_SENT_T.md
@@ -0,0 +1,78 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_EARLYDATA_SENT_T
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - GnuTLS
+Added-in: 8.11.0
+---
+
+# NAME
+
+CURLINFO_EARLYDATA_SENT_T - number of bytes sent as TLS early data
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_EARLYDATA_SENT_T,
+                           curl_off_t *amount);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to an *curl_off_t* to receive the total amount of bytes that
+were sent to the server as TLSv1.3 early data. When no TLS early
+data is used, this reports 0.
+
+TLS early data is only attempted when CURLSSLOPT_EARLYDATA is set for the
+transfer. In addition, it is only used by libcurl when a TLS session exists
+that announces support.
+
+The amount is **negative** when the sent data was rejected
+by the server. TLS allows a server that announces support for early data to
+reject any attempt to use it at its own discretion. When for example 127
+bytes had been sent, but were rejected, it reports -127 as the amount "sent".
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      curl_off_t amount;
+      result = curl_easy_getinfo(curl, CURLINFO_EARLYDATA_SENT_T, &amount);
+      if(result == CURLE_OK) {
+        printf("TLS earlydata: %" CURL_FORMAT_CURL_OFF_T " bytes\n", amount);
+      }
+    }
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_EFFECTIVE_METHOD.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_EFFECTIVE_METHOD.3
deleted file mode 100644
index 125e078e35..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_EFFECTIVE_METHOD.3
+++ /dev/null
@@ -1,70 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_EFFECTIVE_METHOD 3 "28 Aug 2015" libcurl libcurl
-.SH NAME
-CURLINFO_EFFECTIVE_METHOD \- get the last used HTTP method
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_EFFECTIVE_METHOD,
-                           char **methodp);
-.fi
-.SH DESCRIPTION
-Pass in a pointer to a char pointer and get the last used effective HTTP
-method.
-
-In cases when you have asked libcurl to follow redirects, the method may not be
-the same method the first request would use.
-
-The \fBmethodp\fP pointer is NULL or points to private memory. You MUST NOT
-free - it gets freed when you call \fIcurl_easy_cleanup(3)\fP on the
-corresponding CURL handle.
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_POSTFIELDS, "data");
-  curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    char *method = NULL;
-    curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_METHOD, &method);
-    if(method)
-      printf("Redirected to method: %s\\n", method);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.72.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_EFFECTIVE_METHOD.md b/third-party/curl/docs/libcurl/opts/CURLINFO_EFFECTIVE_METHOD.md
new file mode 100644
index 0000000000..5a1fcdc3e4
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_EFFECTIVE_METHOD.md
@@ -0,0 +1,74 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_EFFECTIVE_METHOD
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CUSTOMREQUEST (3)
+  - CURLOPT_FOLLOWLOCATION (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - HTTP
+Added-in: 7.72.0
+---
+
+# NAME
+
+CURLINFO_EFFECTIVE_METHOD - last used HTTP request method
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_EFFECTIVE_METHOD,
+                           char **methodp);
+~~~
+
+# DESCRIPTION
+
+Pass in a pointer to a char pointer and get the last used effective HTTP
+method.
+
+In cases when you have asked libcurl to follow redirects, the method may not be
+the same method the first request would use.
+
+The **methodp** pointer is NULL or points to private memory. You
+**must not** free it. The memory gets freed automatically when you call
+curl_easy_cleanup(3) on the corresponding curl handle.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, "data");
+    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      char *method = NULL;
+      curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_METHOD, &method);
+      if(method)
+        printf("Redirected to method: %s\n", method);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_EFFECTIVE_URL.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_EFFECTIVE_URL.3
deleted file mode 100644
index 42f258e70f..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_EFFECTIVE_URL.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_EFFECTIVE_URL 3 "28 Aug 2015" libcurl libcurl
-.SH NAME
-CURLINFO_EFFECTIVE_URL \- get the last used URL
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_EFFECTIVE_URL, char **urlp);
-.fi
-.SH DESCRIPTION
-Pass in a pointer to a char pointer and get the last used effective URL.
-
-In cases when you have asked libcurl to follow redirects, it may not be the same
-value you set with \fICURLOPT_URL(3)\fP.
-
-The \fBurlp\fP pointer is NULL or points to private memory. You MUST NOT free
-- it gets freed when you call \fIcurl_easy_cleanup(3)\fP on the corresponding
-CURL handle.
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    char *url = NULL;
-    curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_URL, &url);
-    if(url)
-      printf("Redirect to: %s\\n", url);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.4
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_EFFECTIVE_URL.md b/third-party/curl/docs/libcurl/opts/CURLINFO_EFFECTIVE_URL.md
new file mode 100644
index 0000000000..f7adcd810b
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_EFFECTIVE_URL.md
@@ -0,0 +1,70 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_EFFECTIVE_URL
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_FOLLOWLOCATION (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - HTTP
+Added-in: 7.4
+---
+
+# NAME
+
+CURLINFO_EFFECTIVE_URL - last used URL
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_EFFECTIVE_URL, char **urlp);
+~~~
+
+# DESCRIPTION
+
+Pass in a pointer to a char pointer and get the last used effective URL.
+
+In cases when you have asked libcurl to follow redirects, it may not be the same
+value you set with CURLOPT_URL(3).
+
+The **urlp** pointer is NULL or points to private memory. You **must not**
+free it. It memory gets freed automatically when you call curl_easy_cleanup(3)
+on the corresponding curl handle.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      char *url = NULL;
+      curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_URL, &url);
+      if(url)
+        printf("Redirect to: %s\n", url);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_FILETIME.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_FILETIME.3
deleted file mode 100644
index 4aed79199d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_FILETIME.3
+++ /dev/null
@@ -1,73 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_FILETIME 3 "28 Aug 2015" libcurl libcurl
-.SH NAME
-CURLINFO_FILETIME \- get the remote time of the retrieved document
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_FILETIME, long *timep);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive the remote time of the retrieved document
-in number of seconds since January 1 1970 in the GMT/UTC time zone. If you get
--1, it can be because of many reasons (it might be unknown, the server might
-hide it or the server does not support the command that tells document time
-etc) and the time of the document is unknown.
-
-You must tell libcurl to collect this information before the transfer is made,
-by using the \fICURLOPT_FILETIME(3)\fP option to \fIcurl_easy_setopt(3)\fP or
-you this unconditionally gets a -1 back.
-
-Consider using \fICURLINFO_FILETIME_T(3)\fP to be able to extract dates beyond
-the year 2038 on systems using 32 bit longs (Windows).
-.SH PROTOCOLS
-HTTP(S), FTP(S), SFTP
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  /* Ask for filetime */
-  curl_easy_setopt(curl, CURLOPT_FILETIME, 1L);
-  res = curl_easy_perform(curl);
-  if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_FILETIME, &filetime);
-    if((CURLE_OK == res) && (filetime >= 0)) {
-      time_t file_time = (time_t)filetime;
-      printf("filetime %s: %s", filename, ctime(&file_time));
-    }
-  }
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.5
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_FILETIME.md b/third-party/curl/docs/libcurl/opts/CURLINFO_FILETIME.md
new file mode 100644
index 0000000000..f17716041f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_FILETIME.md
@@ -0,0 +1,79 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_FILETIME
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_FILETIME (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - HTTP
+  - FTP
+  - SFTP
+Added-in: 7.5
+---
+
+# NAME
+
+CURLINFO_FILETIME - remote time of the retrieved document
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_FILETIME, long *timep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive the remote time of the retrieved document
+in number of seconds since January 1 1970 in the GMT/UTC time zone. If you get
+-1, it can be because of many reasons (it might be unknown, the server might
+hide it or the server does not support the command that tells document time
+etc) and the time of the document is unknown.
+
+You must ask libcurl to collect this information before the transfer is made,
+by using the CURLOPT_FILETIME(3) option or you unconditionally get a -1 back.
+
+Consider CURLINFO_FILETIME_T(3) instead to be able to extract dates beyond the
+year 2038 on systems using 32-bit longs (Windows).
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    /* Ask for filetime */
+    curl_easy_setopt(curl, CURLOPT_FILETIME, 1L);
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      long filetime = 0;
+      result = curl_easy_getinfo(curl, CURLINFO_FILETIME, &filetime);
+      if((result == CURLE_OK) && (filetime != -1)) {
+        time_t file_time = (time_t)filetime;
+        printf("filetime: %s", ctime(&file_time));
+      }
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_FILETIME_T.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_FILETIME_T.3
deleted file mode 100644
index cb3b8641a9..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_FILETIME_T.3
+++ /dev/null
@@ -1,76 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_FILETIME 3 "25 Jan 2018" libcurl libcurl
-.SH NAME
-CURLINFO_FILETIME_T \- get the remote time of the retrieved document
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_FILETIME_T,
-                           curl_off_t *timep);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a curl_off_t to receive the remote time of the retrieved
-document in number of seconds since January 1 1970 in the GMT/UTC time
-zone. If you get -1, it can be because of many reasons (it might be unknown,
-the server might hide it or the server does not support the command that tells
-document time etc) and the time of the document is unknown.
-
-You must ask libcurl to collect this information before the transfer is made,
-by using the \fICURLOPT_FILETIME(3)\fP option to \fIcurl_easy_setopt(3)\fP or
-you unconditionally get a -1 back.
-
-This option is an alternative to \fICURLINFO_FILETIME(3)\fP to allow systems
-with 32 bit long variables to extract dates outside of the 32bit timestamp
-range.
-.SH PROTOCOLS
-HTTP(S), FTP(S), SFTP
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  /* Ask for filetime */
-  curl_easy_setopt(curl, CURLOPT_FILETIME, 1L);
-  res = curl_easy_perform(curl);
-  if(CURLE_OK == res) {
-    curl_off_t filetime;
-    res = curl_easy_getinfo(curl, CURLINFO_FILETIME_T, &filetime);
-    if((CURLE_OK == res) && (filetime >= 0)) {
-      time_t file_time = (time_t)filetime;
-      printf("filetime %s: %s", filename, ctime(&file_time));
-    }
-  }
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.59.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_FILETIME_T.md b/third-party/curl/docs/libcurl/opts/CURLINFO_FILETIME_T.md
new file mode 100644
index 0000000000..258576c68b
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_FILETIME_T.md
@@ -0,0 +1,80 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_FILETIME_T
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_FILETIME (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - HTTP
+  - FTP
+  - SFTP
+Added-in: 7.59.0
+---
+
+# NAME
+
+CURLINFO_FILETIME_T - remote time of the retrieved resource
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_FILETIME_T,
+                           curl_off_t *timep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a curl_off_t to receive the remote time of the retrieved
+document in number of seconds since January 1 1970 in the GMT/UTC time zone.
+If you get -1, it can be because of many reasons (it might be unknown, the
+server might hide it or the server does not support the command that tells
+document time etc) and the time of the document is unknown.
+
+You must ask libcurl to collect this information before the transfer is made,
+by using the CURLOPT_FILETIME(3) option or you unconditionally get a -1 back.
+
+This option is an alternative to CURLINFO_FILETIME(3) to allow systems with 32
+bit long variables to extract dates outside of the 32-bit timestamp range.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* Ask for filetime */
+    curl_easy_setopt(curl, CURLOPT_FILETIME, 1L);
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      curl_off_t filetime;
+      result = curl_easy_getinfo(curl, CURLINFO_FILETIME_T, &filetime);
+      if((result == CURLE_OK) && (filetime != -1)) {
+        time_t file_time = (time_t)filetime;
+        printf("filetime: %s", ctime(&file_time));
+      }
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_FTP_ENTRY_PATH.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_FTP_ENTRY_PATH.3
deleted file mode 100644
index f71b59f302..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_FTP_ENTRY_PATH.3
+++ /dev/null
@@ -1,69 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_FTP_ENTRY_PATH 3 "12 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_FTP_ENTRY_PATH \- get entry path in FTP server
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_FTP_ENTRY_PATH, char **path);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a char pointer to receive a pointer to a string holding the
-path of the entry path. That is the initial path libcurl ended up in when
-logging on to the remote FTP server. This stores a NULL as pointer if
-something is wrong.
-
-The \fBpath\fP pointer is NULL or points to private memory. You MUST NOT free
-- it gets freed when you call \fIcurl_easy_cleanup(3)\fP on the corresponding
-CURL handle.
-.SH PROTOCOLS
-FTP(S) and SFTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com");
-
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    /* extract the entry path */
-    char *ep = NULL;
-    res = curl_easy_getinfo(curl, CURLINFO_FTP_ENTRY_PATH, &ep);
-    if(!res && ep) {
-      printf("Entry path was: %s\\n", ep);
-    }
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.15.4. Works for SFTP since 7.21.4
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_FTP_ENTRY_PATH.md b/third-party/curl/docs/libcurl/opts/CURLINFO_FTP_ENTRY_PATH.md
new file mode 100644
index 0000000000..4efccececc
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_FTP_ENTRY_PATH.md
@@ -0,0 +1,77 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_FTP_ENTRY_PATH
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - FTP
+  - SFTP
+Added-in: 7.15.4
+---
+
+# NAME
+
+CURLINFO_FTP_ENTRY_PATH - entry path in FTP server
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_FTP_ENTRY_PATH, char **path);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a char pointer to receive a pointer to a string holding the
+path of the entry path. That is the initial path libcurl ended up in when
+logging on to the remote FTP or SFTP server. This stores a NULL as pointer if
+something is wrong.
+
+The **path** pointer is NULL or points to private memory. You **must not**
+free it. The memory gets freed automatically when you call
+curl_easy_cleanup(3) on the corresponding curl handle.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com");
+
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      /* extract the entry path */
+      char *ep = NULL;
+      result = curl_easy_getinfo(curl, CURLINFO_FTP_ENTRY_PATH, &ep);
+      if(!result && ep) {
+        printf("Entry path was: %s\n", ep);
+      }
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+Works for SFTP since 7.21.4
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_HEADER_SIZE.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_HEADER_SIZE.3
deleted file mode 100644
index 5423e62c71..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_HEADER_SIZE.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_HEADER_SIZE 3 "1 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_HEADER_SIZE \- get size of retrieved headers
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_HEADER_SIZE, long *sizep);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive the total size of all the headers
-received. Measured in number of bytes.
-
-The total includes the size of any received headers suppressed by
-\fICURLOPT_SUPPRESS_CONNECT_HEADERS(3)\fP.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    long size;
-    res = curl_easy_getinfo(curl, CURLINFO_HEADER_SIZE, &size);
-    if(!res)
-      printf("Header size: %ld bytes\\n", size);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.4.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_REQUEST_SIZE "(3), "
-.BR CURLINFO_SIZE_DOWNLOAD "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_HEADER_SIZE.md b/third-party/curl/docs/libcurl/opts/CURLINFO_HEADER_SIZE.md
new file mode 100644
index 0000000000..f0ce241e3f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_HEADER_SIZE.md
@@ -0,0 +1,71 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_HEADER_SIZE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_REQUEST_SIZE (3)
+  - CURLINFO_SIZE_DOWNLOAD (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.4.1
+---
+
+# NAME
+
+CURLINFO_HEADER_SIZE - size of response headers
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_HEADER_SIZE, long *sizep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive the total size of all the headers
+received, represented in HTTP/1-style header format. Measured in number of
+bytes.
+
+The total includes the size of any received headers suppressed by
+CURLOPT_SUPPRESS_CONNECT_HEADERS(3).
+
+The number of bytes transferred over the wire (or to the TLS backend) is
+different when using HTTP/2 or greater.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      long size;
+      result = curl_easy_getinfo(curl, CURLINFO_HEADER_SIZE, &size);
+      if(result == CURLE_OK)
+        printf("Header size: %ld bytes\n", size);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_HTTPAUTH_AVAIL.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_HTTPAUTH_AVAIL.3
deleted file mode 100644
index 6c8f8280c3..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_HTTPAUTH_AVAIL.3
+++ /dev/null
@@ -1,74 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_HTTPAUTH_AVAIL 3 "12 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_HTTPAUTH_AVAIL \- get available HTTP authentication methods
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_HTTPAUTH_AVAIL, long *authp);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive a bitmask indicating the authentication
-method(s) available according to the previous response. The meaning of the
-bits is explained in the \fICURLOPT_HTTPAUTH(3)\fP option for
-\fIcurl_easy_setopt(3)\fP.
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    /* extract the available authentication types */
-    long auth;
-    res = curl_easy_getinfo(curl, CURLINFO_HTTPAUTH_AVAIL, &auth);
-    if(!res) {
-      if(!auth)
-        printf("No auth available, perhaps no 401?\\n");
-      else {
-        printf("%s%s%s%s\\n",
-               auth & CURLAUTH_BASIC ? "Basic ":"",
-               auth & CURLAUTH_DIGEST ? "Digest ":"",
-               auth & CURLAUTH_NEGOTIATE ? "Negotiate ":"",
-               auth % CURLAUTH_NTLM ? "NTLM ":"");
-      }
-    }
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added RFC 2617 in 7.10.8
-Added RFC 7616 in 7.57.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_HTTPAUTH_AVAIL.md b/third-party/curl/docs/libcurl/opts/CURLINFO_HTTPAUTH_AVAIL.md
new file mode 100644
index 0000000000..2a65509ede
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_HTTPAUTH_AVAIL.md
@@ -0,0 +1,77 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_HTTPAUTH_AVAIL
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_PROXYAUTH_AVAIL (3)
+  - CURLOPT_HTTPAUTH (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - HTTP
+Added-in: 7.10.8
+---
+
+# NAME
+
+CURLINFO_HTTPAUTH_AVAIL - available HTTP authentication methods
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_HTTPAUTH_AVAIL, long *authp);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive a bitmask indicating the authentication
+method(s) available according to the previous response. The meaning of the
+bits is explained in the CURLOPT_HTTPAUTH(3) option for curl_easy_setopt(3).
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      /* extract the available authentication types */
+      long auth;
+      result = curl_easy_getinfo(curl, CURLINFO_HTTPAUTH_AVAIL, &auth);
+      if(result == CURLE_OK) {
+        if(!auth)
+          printf("No auth available, perhaps no 401?\n");
+        else {
+          printf("%s%s%s%s\n",
+                 auth & CURLAUTH_BASIC ? "Basic " : "",
+                 auth & CURLAUTH_DIGEST ? "Digest " : "",
+                 auth & CURLAUTH_NEGOTIATE ? "Negotiate " : "",
+                 auth % CURLAUTH_NTLM ? "NTLM " : "");
+        }
+      }
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_HTTPAUTH_USED.md b/third-party/curl/docs/libcurl/opts/CURLINFO_HTTPAUTH_USED.md
new file mode 100644
index 0000000000..99db88d3f3
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_HTTPAUTH_USED.md
@@ -0,0 +1,79 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_HTTPAUTH_USED
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_PROXYAUTH_USED (3)
+  - CURLINFO_HTTPAUTH_AVAIL (3)
+  - CURLOPT_HTTPAUTH (3)
+Protocol:
+  - HTTP
+Added-in: 8.12.0
+---
+
+# NAME
+
+CURLINFO_HTTPAUTH_USED - used HTTP authentication method
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_HTTPAUTH_USED, long *authp);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive a bitmask indicating the authentication
+method that was used in the previous HTTP request. The meaning of the possible
+bits is explained in the CURLOPT_HTTPAUTH(3) option for curl_easy_setopt(3).
+
+The returned value has zero or one bit set.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_BASIC | CURLAUTH_DIGEST);
+    curl_easy_setopt(curl, CURLOPT_USERNAME, "shrek");
+    curl_easy_setopt(curl, CURLOPT_PASSWORD, "swamp");
+
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      long auth;
+      result = curl_easy_getinfo(curl, CURLINFO_HTTPAUTH_USED, &auth);
+      if(result == CURLE_OK) {
+        if(!auth)
+          printf("No auth used\n");
+        else {
+          if(auth == CURLAUTH_DIGEST)
+            printf("Used Digest authentication\n");
+          else
+            printf("Used Basic authentication\n");
+        }
+      }
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_HTTP_CONNECTCODE.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_HTTP_CONNECTCODE.3
deleted file mode 100644
index 3622bffd9d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_HTTP_CONNECTCODE.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_HTTP_CONNECTCODE 3 "28 Aug 2015" libcurl libcurl
-.SH NAME
-CURLINFO_HTTP_CONNECTCODE \- get the CONNECT response code
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_HTTP_CONNECTCODE, long *p);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive the last received HTTP proxy response code
-to a CONNECT request. The returned value is zero if no such response code was
-available.
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* typically CONNECT is used to do HTTPS over HTTP proxies */
-  curl_easy_setopt(curl, CURLOPT_PROXY, "http://127.0.0.1");
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    long code;
-    res = curl_easy_getinfo(curl, CURLINFO_HTTP_CONNECTCODE, &code);
-    if(!res && code)
-      printf("The CONNECT response code: %03ld\\n", code);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.10.7
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLINFO_RESPONSE_CODE "(3), "
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_HTTP_CONNECTCODE.md b/third-party/curl/docs/libcurl/opts/CURLINFO_HTTP_CONNECTCODE.md
new file mode 100644
index 0000000000..2ded9a121b
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_HTTP_CONNECTCODE.md
@@ -0,0 +1,67 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_HTTP_CONNECTCODE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_RESPONSE_CODE (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - HTTP
+Added-in: 7.10.7
+---
+
+# NAME
+
+CURLINFO_HTTP_CONNECTCODE - CONNECT response code
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_HTTP_CONNECTCODE, long *p);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive the last received HTTP proxy response code
+to a CONNECT request. The returned value is zero if no such response code was
+available.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* typically CONNECT is used to do HTTPS over HTTP proxies */
+    curl_easy_setopt(curl, CURLOPT_PROXY, "http://127.0.0.1");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      long code;
+      result = curl_easy_getinfo(curl, CURLINFO_HTTP_CONNECTCODE, &code);
+      if(!result && code)
+        printf("The CONNECT response code: %03ld\n", code);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_HTTP_VERSION.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_HTTP_VERSION.3
deleted file mode 100644
index c32ff689c6..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_HTTP_VERSION.3
+++ /dev/null
@@ -1,61 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_HTTP_VERSION 3 "11 May 2016" libcurl libcurl
-.SH NAME
-CURLINFO_HTTP_VERSION \- get the http version used in the connection
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_HTTP_VERSION, long *p);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive the version used in the last http
-connection done using this handle. The returned value is
-CURL_HTTP_VERSION_1_0, CURL_HTTP_VERSION_1_1, CURL_HTTP_VERSION_2_0,
-CURL_HTTP_VERSION_3 or 0 if the version cannot be determined.
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    long http_version;
-    curl_easy_getinfo(curl, CURLINFO_HTTP_VERSION, &http_version);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.50.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLINFO_RESPONSE_CODE "(3), "
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_HTTP_VERSION.md b/third-party/curl/docs/libcurl/opts/CURLINFO_HTTP_VERSION.md
new file mode 100644
index 0000000000..0062a043d8
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_HTTP_VERSION.md
@@ -0,0 +1,63 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_HTTP_VERSION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_RESPONSE_CODE (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - HTTP
+Added-in: 7.50.0
+---
+
+# NAME
+
+CURLINFO_HTTP_VERSION - HTTP version used in the transfer
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_HTTP_VERSION, long *p);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive the version used in the last http transfer
+done using this handle. The returned value is CURL_HTTP_VERSION_1_0,
+CURL_HTTP_VERSION_1_1, CURL_HTTP_VERSION_2_0, CURL_HTTP_VERSION_3 or 0 if the
+version cannot be determined.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      long http_version;
+      curl_easy_getinfo(curl, CURLINFO_HTTP_VERSION, &http_version);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_LASTSOCKET.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_LASTSOCKET.3
deleted file mode 100644
index 855128989b..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_LASTSOCKET.3
+++ /dev/null
@@ -1,75 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_LASTSOCKET 3 "12 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_LASTSOCKET \- get the last socket used
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_LASTSOCKET, long *socket);
-.fi
-.SH DESCRIPTION
-Deprecated since 7.45.0. Use \fICURLINFO_ACTIVESOCKET(3)\fP instead.
-
-Pass a pointer to a long to receive the last socket used by this curl
-session. If the socket is no longer valid, -1 is returned. When you finish
-working with the socket, you must call curl_easy_cleanup() as usual and let
-libcurl close the socket and cleanup other resources associated with the
-handle. This is typically used in combination with
-\fICURLOPT_CONNECT_ONLY(3)\fP.
-
-NOTE: this API is deprecated since it is not working on win64 where the SOCKET
-type is 64 bits large while its 'long' is 32 bits. Use the
-\fICURLINFO_ACTIVESOCKET(3)\fP instead, if possible.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  long sockfd; /* does not work on win64! */
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Do not do the transfer - only connect to host */
-  curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
-  res = curl_easy_perform(curl);
-
-  /* Extract the socket from the curl handle */
-  res = curl_easy_getinfo(curl, CURLINFO_LASTSOCKET, &sockfd);
-
-  if(res != CURLE_OK) {
-    printf("Error: %s\\n", curl_easy_strerror(res));
-    return 1;
-  }
-}
-.fi
-.SH AVAILABILITY
-Added in 7.15.2
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_ACTIVESOCKET "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_LASTSOCKET.md b/third-party/curl/docs/libcurl/opts/CURLINFO_LASTSOCKET.md
new file mode 100644
index 0000000000..62bc425125
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_LASTSOCKET.md
@@ -0,0 +1,88 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_LASTSOCKET
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_ACTIVESOCKET (3)
+  - CURLOPT_CONNECT_ONLY (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.15.2
+---
+
+# NAME
+
+CURLINFO_LASTSOCKET - last socket used
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_LASTSOCKET, long *socket);
+~~~
+
+# DESCRIPTION
+
+Deprecated. Use CURLINFO_ACTIVESOCKET(3) instead.
+
+Pass a pointer to a long to receive the last socket used by this curl
+session. If the socket is no longer valid, -1 is returned. When you finish
+working with the socket, you must call curl_easy_cleanup(3) as usual and
+let libcurl close the socket and cleanup other resources associated with the
+handle. This is typically used in combination with
+CURLOPT_CONNECT_ONLY(3).
+
+NOTE: this API is deprecated since it is not working on win64 where the SOCKET
+type is 64 bits large while its 'long' is 32 bits. Use the
+CURLINFO_ACTIVESOCKET(3) instead, if possible.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    long sockfd; /* does not work on win64 */
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Do not do the transfer - only connect to host */
+    curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
+    result = curl_easy_perform(curl);
+    if(result != CURLE_OK) {
+      printf("Error: %s\n", curl_easy_strerror(result));
+      curl_easy_cleanup(curl);
+      return 1;
+    }
+
+    /* Extract the socket from the curl handle */
+    result = curl_easy_getinfo(curl, CURLINFO_LASTSOCKET, &sockfd);
+    if(!result && sockfd != -1) {
+      /* operate on sockfd */
+    }
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# DEPRECATED
+
+Deprecated since 7.45.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_LOCAL_IP.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_LOCAL_IP.3
deleted file mode 100644
index 8fc39dcc2e..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_LOCAL_IP.3
+++ /dev/null
@@ -1,71 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_LOCAL_IP 3 "12 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_LOCAL_IP \- get local IP address of last connection
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_LOCAL_IP, char **ip);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a char pointer to receive the pointer to a null-terminated
-string holding the IP address of the local end of most recent connection done
-with this \fBcurl\fP handle. This string may be IPv6 when that is
-enabled. Note that you get a pointer to a memory area that is reused at next
-request so you need to copy the string if you want to keep the information.
-
-The \fBip\fP pointer is NULL or points to private memory. You MUST NOT free -
-it gets freed when you call \fIcurl_easy_cleanup(3)\fP on the corresponding
-CURL handle.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-{
-  char *ip;
-
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Perform the transfer */
-  res = curl_easy_perform(curl);
-  /* Check for errors */
-  if((res == CURLE_OK) &&
-     !curl_easy_getinfo(curl, CURLINFO_LOCAL_IP, &ip) && ip) {
-    printf("Local IP: %s\\n", ip);
-  }
-
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.21.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_PRIMARY_IP "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_LOCAL_IP.md b/third-party/curl/docs/libcurl/opts/CURLINFO_LOCAL_IP.md
new file mode 100644
index 0000000000..270b7d5f26
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_LOCAL_IP.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_LOCAL_IP
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_LOCAL_PORT (3)
+  - CURLINFO_PRIMARY_IP (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - TCP
+  - QUIC
+Added-in: 7.21.0
+---
+
+# NAME
+
+CURLINFO_LOCAL_IP - local IP address of last connection
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_LOCAL_IP, char **ip);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a char pointer to receive the pointer to a null-terminated
+string holding the IP address of the local end of most recent connection done
+with this **curl** handle. This string may be IPv6 when that is enabled. Note
+that you get a pointer to a memory area that is reused at next request so you
+need to copy the string if you want to keep the information.
+
+The **ip** pointer is NULL or points to private memory. You **must not** free
+it. The memory gets freed automatically when you call curl_easy_cleanup(3) on
+the corresponding curl handle.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  char *ip;
+  CURLcode result;
+  CURL *curl = curl_easy_init();
+
+  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+  /* Perform the transfer */
+  result = curl_easy_perform(curl);
+  /* Check for errors */
+  if((result == CURLE_OK) &&
+     !curl_easy_getinfo(curl, CURLINFO_LOCAL_IP, &ip) && ip) {
+    printf("Local IP: %s\n", ip);
+  }
+
+  /* always cleanup */
+  curl_easy_cleanup(curl);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_LOCAL_PORT.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_LOCAL_PORT.3
deleted file mode 100644
index d849a0d32c..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_LOCAL_PORT.3
+++ /dev/null
@@ -1,69 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_LOCAL_PORT 3 "12 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_LOCAL_PORT \- get the latest local port number
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_LOCAL_PORT, long *portp);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive the local port number of the most recent
-connection done with this \fBcurl\fP handle.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-{
-  CURL *curl;
-  CURLcode res;
-
-  curl = curl_easy_init();
-  if(curl) {
-    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-    res = curl_easy_perform(curl);
-
-    if(CURLE_OK == res) {
-      long port;
-      res = curl_easy_getinfo(curl, CURLINFO_LOCAL_PORT, &port);
-
-      if(CURLE_OK == res) {
-        printf("We used local port: %ld\\n", port);
-      }
-    }
-    curl_easy_cleanup(curl);
-  }
-  return 0;
-}
-.fi
-.SH AVAILABILITY
-Added in 7.21.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_PRIMARY_PORT "(3), " CURLINFO_LOCAL_IP "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_LOCAL_PORT.md b/third-party/curl/docs/libcurl/opts/CURLINFO_LOCAL_PORT.md
new file mode 100644
index 0000000000..0860bfaf6d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_LOCAL_PORT.md
@@ -0,0 +1,77 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_LOCAL_PORT
+Section: 3
+Source: libcurl
+Protocol:
+  - TCP
+  - QUIC
+See-also:
+  - CURLINFO_LOCAL_IP (3)
+  - CURLINFO_PRIMARY_PORT (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Added-in: 7.21.0
+---
+
+# NAME
+
+CURLINFO_LOCAL_PORT - latest local port number
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_LOCAL_PORT, long *portp);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive the local port number of the most recent
+connection done with this **curl** handle.
+
+If the connection was done using QUIC, the port number is a UDP port number,
+otherwise it is a TCP port number.
+
+If no connection was established or if the protocol does not use ports, -1
+is returned.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl;
+  CURLcode result;
+
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      long port;
+      result = curl_easy_getinfo(curl, CURLINFO_LOCAL_PORT, &port);
+
+      if(result == CURLE_OK) {
+        printf("We used local port: %ld\n", port);
+      }
+    }
+    curl_easy_cleanup(curl);
+  }
+  return 0;
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_NAMELOOKUP_TIME.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_NAMELOOKUP_TIME.3
deleted file mode 100644
index d5a7fc7d3b..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_NAMELOOKUP_TIME.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_NAMELOOKUP_TIME 3 "28 Aug 2015" libcurl libcurl
-.SH NAME
-CURLINFO_NAMELOOKUP_TIME \- get the name lookup time
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_NAMELOOKUP_TIME,
-                           double *timep);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a double to receive the total time in seconds from the start
-until the name resolving was completed.
-
-When a redirect is followed, the time from each request is added together.
-
-See also the TIMES overview in the \fIcurl_easy_getinfo(3)\fP man page.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  double namelookup;
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  res = curl_easy_perform(curl);
-  if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_NAMELOOKUP_TIME, &namelookup);
-    if(CURLE_OK == res) {
-      printf("Time: %.1f", namelookup);
-    }
-  }
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.4.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " CURLINFO_NAMELOOKUP_TIME_T "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_NAMELOOKUP_TIME.md b/third-party/curl/docs/libcurl/opts/CURLINFO_NAMELOOKUP_TIME.md
new file mode 100644
index 0000000000..66e501942d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_NAMELOOKUP_TIME.md
@@ -0,0 +1,70 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_NAMELOOKUP_TIME
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_NAMELOOKUP_TIME_T (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.4.1
+---
+
+# NAME
+
+CURLINFO_NAMELOOKUP_TIME - name lookup time
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_NAMELOOKUP_TIME,
+                           double *timep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a double to receive the total time in seconds from the start
+until the name resolving was completed.
+
+When a redirect is followed, the time from each request is added together.
+
+See also the TIMES overview in the curl_easy_getinfo(3) man page.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    double namelookup;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      result = curl_easy_getinfo(curl, CURLINFO_NAMELOOKUP_TIME, &namelookup);
+      if(result == CURLE_OK) {
+        printf("Time: %.1f", namelookup);
+      }
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_NAMELOOKUP_TIME_T.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_NAMELOOKUP_TIME_T.3
deleted file mode 100644
index ecb884899d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_NAMELOOKUP_TIME_T.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_NAMELOOKUP_TIME_T 3 "28 Apr 2018" libcurl libcurl
-.SH NAME
-CURLINFO_NAMELOOKUP_TIME_T \- get the name lookup time in microseconds
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_NAMELOOKUP_TIME_T,
-                           curl_off_t *timep);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a curl_off_t to receive the total time in microseconds
-from the start until the name resolving was completed.
-
-When a redirect is followed, the time from each request is added together.
-
-See also the TIMES overview in the \fIcurl_easy_getinfo(3)\fP man page.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  curl_off_t namelookup;
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  res = curl_easy_perform(curl);
-  if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_NAMELOOKUP_TIME_T, &namelookup);
-    if(CURLE_OK == res) {
-      printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", namelookup / 1000000,
-             (long)(namelookup % 1000000));
-    }
-  }
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.61.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " CURLINFO_NAMELOOKUP_TIME "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_NAMELOOKUP_TIME_T.md b/third-party/curl/docs/libcurl/opts/CURLINFO_NAMELOOKUP_TIME_T.md
new file mode 100644
index 0000000000..1f75c07a61
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_NAMELOOKUP_TIME_T.md
@@ -0,0 +1,72 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_NAMELOOKUP_TIME_T
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_NAMELOOKUP_TIME (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.61.0
+---
+
+# NAME
+
+CURLINFO_NAMELOOKUP_TIME_T - name lookup time in microseconds
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_NAMELOOKUP_TIME_T,
+                           curl_off_t *timep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a curl_off_t to receive the total time in microseconds
+from the start until the name resolving was completed.
+
+When a redirect is followed, the time from each request is added together.
+
+See also the TIMES overview in the curl_easy_getinfo(3) man page.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_off_t namelookup;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      result = curl_easy_getinfo(curl, CURLINFO_NAMELOOKUP_TIME_T,
+                                 &namelookup);
+      if(result == CURLE_OK) {
+        printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", namelookup / 1000000,
+               (long)(namelookup % 1000000));
+      }
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_NUM_CONNECTS.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_NUM_CONNECTS.3
deleted file mode 100644
index b776e53de9..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_NUM_CONNECTS.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_NUM_CONNECTS 3 "12 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_NUM_CONNECTS \- get number of created connections
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_NUM_CONNECTS, long *nump);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive how many new connections libcurl had to
-create to achieve the previous transfer (only the successful connects are
-counted).  Combined with \fICURLINFO_REDIRECT_COUNT(3)\fP you are able to know
-how many times libcurl successfully reused existing connection(s) or not.  See
-the connection options of \fIcurl_easy_setopt(3)\fP to see how libcurl tries
-to make persistent connections to save time.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    long connects;
-    res = curl_easy_getinfo(curl, CURLINFO_NUM_CONNECTS, &connects);
-    if(res)
-      printf("It needed %d connects\\n", connects);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.12.3
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_NUM_CONNECTS.md b/third-party/curl/docs/libcurl/opts/CURLINFO_NUM_CONNECTS.md
new file mode 100644
index 0000000000..efb568ad77
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_NUM_CONNECTS.md
@@ -0,0 +1,67 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_NUM_CONNECTS
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.12.3
+---
+
+# NAME
+
+CURLINFO_NUM_CONNECTS - number of created connections
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_NUM_CONNECTS, long *nump);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive how many new connections libcurl had to
+create to achieve the previous transfer (only the successful connects are
+counted). Combined with CURLINFO_REDIRECT_COUNT(3) you are able to know how
+many times libcurl successfully reused existing connection(s) or not. See the
+connection options of curl_easy_setopt(3) to see how libcurl tries to make
+persistent connections to save time.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      long connects;
+      result = curl_easy_getinfo(curl, CURLINFO_NUM_CONNECTS, &connects);
+      if(result == CURLE_OK)
+        printf("It needed %ld connects\n", connects);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_OS_ERRNO.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_OS_ERRNO.3
deleted file mode 100644
index d61909adb9..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_OS_ERRNO.3
+++ /dev/null
@@ -1,62 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_OS_ERRNO 3 "1 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_OS_ERRNO \- get errno number from last connect failure
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_OS_ERRNO, long *errnop);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive the errno variable from a connect failure.
-Note that the value is only set on failure, it is not reset upon a successful
-operation. The number is OS and system specific.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  res = curl_easy_perform(curl);
-  if(res != CURLE_OK) {
-    long error;
-    res = curl_easy_getinfo(curl, CURLINFO_OS_ERRNO, &error);
-    if(res && error) {
-      printf("Errno: %ld\\n", error);
-    }
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.12.2
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_OS_ERRNO.md b/third-party/curl/docs/libcurl/opts/CURLINFO_OS_ERRNO.md
new file mode 100644
index 0000000000..f163a41819
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_OS_ERRNO.md
@@ -0,0 +1,72 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_OS_ERRNO
+Section: 3
+Source: libcurl
+See-also:
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.12.2
+---
+
+# NAME
+
+CURLINFO_OS_ERRNO - errno number from last connect failure
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_OS_ERRNO, long *errnop);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive the errno variable from a connect failure.
+Note that the value is only set on failure, it is not reset upon a successful
+operation. The number is OS and system specific.
+
+libcurl network-related errors that may have a saved errno are:
+CURLE_COULDNT_CONNECT, CURLE_FAILED_INIT, CURLE_INTERFACE_FAILED,
+CURLE_OPERATION_TIMEDOUT, CURLE_RECV_ERROR, CURLE_SEND_ERROR.
+
+Since 8.8.0 libcurl clears the easy handle's saved errno before performing the
+transfer. Prior versions did not clear the saved errno, which means if a saved
+errno is retrieved it could be from a previous transfer on the same handle.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result != CURLE_OK) {
+      long error;
+      result = curl_easy_getinfo(curl, CURLINFO_OS_ERRNO, &error);
+      if(!result && error) {
+        printf("Errno: %ld\n", error);
+      }
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_POSTTRANSFER_TIME_T.md b/third-party/curl/docs/libcurl/opts/CURLINFO_POSTTRANSFER_TIME_T.md
new file mode 100644
index 0000000000..ae2c864f05
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_POSTTRANSFER_TIME_T.md
@@ -0,0 +1,73 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_POSTTRANSFER_TIME_T
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_PRETRANSFER_TIME_T (3)
+  - CURLOPT_TIMEOUT (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 8.10.0
+---
+
+# NAME
+
+CURLINFO_POSTTRANSFER_TIME_T - time to last byte sent
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_POSTTRANSFER_TIME_T,
+                           curl_off_t *timep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a curl_off_t to receive the time, in microseconds,
+it took from the start until the last byte is sent by libcurl.
+
+When a redirect is followed, the time from each request is added together.
+
+See also the TIMES overview in the curl_easy_getinfo(3) man page.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      curl_off_t posttransfer;
+      result = curl_easy_getinfo(curl, CURLINFO_POSTTRANSFER_TIME_T,
+                              &posttransfer);
+      if(result == CURLE_OK) {
+        printf("Request sent after: %" CURL_FORMAT_CURL_OFF_T ".%06ld s",
+               posttransfer / 1000000, (long)(posttransfer % 1000000));
+      }
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_PRETRANSFER_TIME.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_PRETRANSFER_TIME.3
deleted file mode 100644
index f3bf36864e..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_PRETRANSFER_TIME.3
+++ /dev/null
@@ -1,70 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_PRETRANSFER_TIME 3 "28 Aug 2015" libcurl libcurl
-.SH NAME
-CURLINFO_PRETRANSFER_TIME \- get the time until the file transfer start
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PRETRANSFER_TIME,
-                           double *timep);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a double to receive the time, in seconds, it took from the
-start until the file transfer is just about to begin.
-
-This time-stamp includes all pre-transfer commands and negotiations that are
-specific to the particular protocol(s) involved. It includes the sending of
-the protocol- specific protocol instructions that triggers a transfer.
-
-When a redirect is followed, the time from each request is added together.
-
-See also the TIMES overview in the \fIcurl_easy_getinfo(3)\fP man page.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  double pretransfer;
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  res = curl_easy_perform(curl);
-  if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_PRETRANSFER_TIME, &pretransfer);
-    if(CURLE_OK == res) {
-      printf("Time: %.1f", pretransfer);
-    }
-  }
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.4.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " CURLINFO_PRETRANSFER_TIME_T "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_PRETRANSFER_TIME.md b/third-party/curl/docs/libcurl/opts/CURLINFO_PRETRANSFER_TIME.md
new file mode 100644
index 0000000000..5f6ade455c
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_PRETRANSFER_TIME.md
@@ -0,0 +1,76 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_PRETRANSFER_TIME
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CONNECT_TIME_T (3)
+  - CURLINFO_PRETRANSFER_TIME_T (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.4.1
+---
+
+# NAME
+
+CURLINFO_PRETRANSFER_TIME - time to transfer start
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PRETRANSFER_TIME,
+                           double *timep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a double to receive the time, in seconds, it took from the
+start until the file transfer is about to begin.
+
+This time-stamp includes all pre-transfer commands and negotiations that are
+specific to the particular protocol(s) involved. It includes the sending of
+the protocol-specific instructions that trigger a transfer.
+
+When a redirect is followed, the time from each request is added together.
+
+See also the TIMES overview in the curl_easy_getinfo(3) man page.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    double pretransfer;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      result = curl_easy_getinfo(curl, CURLINFO_PRETRANSFER_TIME,
+                                 &pretransfer);
+      if(result == CURLE_OK) {
+        printf("Time: %.1f", pretransfer);
+      }
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_PRETRANSFER_TIME_T.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_PRETRANSFER_TIME_T.3
deleted file mode 100644
index ad2fcc189a..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_PRETRANSFER_TIME_T.3
+++ /dev/null
@@ -1,71 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_PRETRANSFER_TIME_T 3 "28 Apr 2018" libcurl libcurl
-.SH NAME
-CURLINFO_PRETRANSFER_TIME_T \- get the time until the file transfer start
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PRETRANSFER_TIME_T,
-                           curl_off_t *timep);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a curl_off_t to receive the time, in microseconds,
-it took from the
-start until the file transfer is just about to begin. This includes all
-pre-transfer commands and negotiations that are specific to the particular
-protocol(s) involved. It does \fInot\fP involve the sending of the protocol-
-specific request that triggers a transfer.
-
-When a redirect is followed, the time from each request is added together.
-
-See also the TIMES overview in the \fIcurl_easy_getinfo(3)\fP man page.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  curl_off_t pretransfer;
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  res = curl_easy_perform(curl);
-  if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_PRETRANSFER_TIME_T, &pretransfer);
-    if(CURLE_OK == res) {
-      printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", pretransfer / 1000000,
-             (long)(pretransfer % 1000000));
-    }
-  }
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.61.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " CURLINFO_PRETRANSFER_TIME "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_PRETRANSFER_TIME_T.md b/third-party/curl/docs/libcurl/opts/CURLINFO_PRETRANSFER_TIME_T.md
new file mode 100644
index 0000000000..1cc300341e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_PRETRANSFER_TIME_T.md
@@ -0,0 +1,78 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_PRETRANSFER_TIME_T
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CONNECT_TIME (3)
+  - CURLINFO_PRETRANSFER_TIME_T (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.61.0
+---
+
+# NAME
+
+CURLINFO_PRETRANSFER_TIME_T - time to transfer start
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PRETRANSFER_TIME_T,
+                           curl_off_t *timep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a curl_off_t to receive the time, in microseconds, it took
+from the start until the file transfer is about to begin.
+
+This time-stamp includes all pre-transfer commands and negotiations that are
+specific to the particular protocol(s) involved. It includes the sending of
+the protocol-specific instructions that trigger a transfer.
+
+When a redirect is followed, the time from each request is added together.
+
+See also the TIMES overview in the curl_easy_getinfo(3) man page.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_off_t pretransfer;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      result = curl_easy_getinfo(curl, CURLINFO_PRETRANSFER_TIME_T,
+                                 &pretransfer);
+      if(result == CURLE_OK) {
+        printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld\n",
+               pretransfer / 1000000,
+               (long)(pretransfer % 1000000));
+      }
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_PRIMARY_IP.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_PRIMARY_IP.3
deleted file mode 100644
index 79391ae858..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_PRIMARY_IP.3
+++ /dev/null
@@ -1,71 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_PRIMARY_IP 3 "12 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_PRIMARY_IP \- get IP address of last connection
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PRIMARY_IP, char **ip);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a char pointer to receive the pointer to a null-terminated
-string holding the IP address of the most recent connection done with this
-\fBcurl\fP handle. This string may be IPv6 when that is enabled. Note that you
-get a pointer to a memory area that is reused at next request so you need to
-copy the string if you want to keep the information.
-
-The \fBip\fP pointer is NULL or points to private memory. You MUST NOT free -
-it gets freed when you call \fIcurl_easy_cleanup(3)\fP on the corresponding
-CURL handle.
-.SH PROTOCOLS
-All network based ones
-.SH EXAMPLE
-.nf
-{
-  char *ip;
-
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Perform the transfer */
-  res = curl_easy_perform(curl);
-  /* Check for errors */
-  if((res == CURLE_OK) &&
-     !curl_easy_getinfo(curl, CURLINFO_PRIMARY_IP, &ip) && ip) {
-    printf("IP: %s\\n", ip);
-  }
-
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.19.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_PRIMARY_PORT "(3), " CURLINFO_LOCAL_IP "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_PRIMARY_IP.md b/third-party/curl/docs/libcurl/opts/CURLINFO_PRIMARY_IP.md
new file mode 100644
index 0000000000..683d97de16
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_PRIMARY_IP.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_PRIMARY_IP
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_LOCAL_IP (3)
+  - CURLINFO_LOCAL_PORT (3)
+  - CURLINFO_PRIMARY_PORT (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.19.0
+---
+
+# NAME
+
+CURLINFO_PRIMARY_IP - IP address of last connection
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PRIMARY_IP, char **ip);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a char pointer to receive the pointer to a null-terminated
+string holding the IP address of the most recent connection done with this
+**curl** handle. This string may be IPv6 when that is enabled. Note that you
+get a pointer to a memory area that is reused at next request so you need to
+copy the string if you want to keep the information.
+
+The **ip** pointer is NULL or points to private memory. You **must not** free
+it. The memory gets freed automatically when you call curl_easy_cleanup(3) on
+the corresponding curl handle.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  char *ip;
+  CURLcode result;
+  CURL *curl = curl_easy_init();
+
+  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+  /* Perform the transfer */
+  result = curl_easy_perform(curl);
+  /* Check for errors */
+  if((result == CURLE_OK) &&
+     !curl_easy_getinfo(curl, CURLINFO_PRIMARY_IP, &ip) && ip) {
+    printf("IP: %s\n", ip);
+  }
+
+  /* always cleanup */
+  curl_easy_cleanup(curl);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_PRIMARY_PORT.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_PRIMARY_PORT.3
deleted file mode 100644
index 445a4f5265..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_PRIMARY_PORT.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_PRIMARY_PORT 3 "12 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_PRIMARY_PORT \- get the latest destination port number
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PRIMARY_PORT, long *portp);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive the destination port of the most recent
-connection done with this \fBcurl\fP handle.
-
-This is the destination port of the actual TCP or UDP connection libcurl used.
-If a proxy was used for the most recent transfer, this is the port number of
-the proxy, if no proxy was used it is the port number of the most recently
-accessed URL.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    long port;
-    res = curl_easy_getinfo(curl, CURLINFO_PRIMARY_PORT, &port);
-    if(!res)
-      printf("Connected to remote port: %ld\\n", port);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.21.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_PRIMARY_PORT.md b/third-party/curl/docs/libcurl/opts/CURLINFO_PRIMARY_PORT.md
new file mode 100644
index 0000000000..f8a2deee97
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_PRIMARY_PORT.md
@@ -0,0 +1,74 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_PRIMARY_PORT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_LOCAL_PORT (3)
+  - CURLINFO_PRIMARY_IP (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.21.0
+---
+
+# NAME
+
+CURLINFO_PRIMARY_PORT - last destination port number
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PRIMARY_PORT, long *portp);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive the destination port of the most recent
+connection done with this **curl** handle.
+
+This is the destination port of the actual TCP or UDP connection libcurl used.
+If a proxy was used for the most recent transfer, this is the port number of
+the proxy, if no proxy was used it is the port number of the most recently
+accessed URL.
+
+If the connection was done using QUIC, the port number is a UDP port number.
+
+If no connection was established or if the protocol does not use ports, -1
+is returned.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      long port;
+      result = curl_easy_getinfo(curl, CURLINFO_PRIMARY_PORT, &port);
+      if(result == CURLE_OK)
+        printf("Connected to remote port: %ld\n", port);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_PRIVATE.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_PRIVATE.3
deleted file mode 100644
index bfe2e09f4b..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_PRIVATE.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_PRIVATE 3 "1 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_PRIVATE \- get the private pointer
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PRIVATE, char **private);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a char pointer to receive the pointer to the private data
-associated with the curl handle (set with the \fICURLOPT_PRIVATE(3)\fP).
-Please note that for internal reasons, the value is returned as a char
-pointer, although effectively being a 'void *'.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  void *pointer = 0x2345454;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-
-  /* set the private pointer */
-  curl_easy_setopt(curl, CURLOPT_PRIVATE, pointer);
-  ret = curl_easy_perform(curl);
-
-  /* extract the private pointer again */
-  ret = curl_easy_getinfo(curl, CURLINFO_PRIVATE, &pointer);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.10.3
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLOPT_PRIVATE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_PRIVATE.md b/third-party/curl/docs/libcurl/opts/CURLINFO_PRIVATE.md
new file mode 100644
index 0000000000..f76b277a70
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_PRIVATE.md
@@ -0,0 +1,70 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_PRIVATE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PRIVATE (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.10.3
+---
+
+# NAME
+
+CURLINFO_PRIVATE - private pointer
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PRIVATE, char **private);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a char pointer to receive the pointer to the private data
+associated with the curl handle (set with the CURLOPT_PRIVATE(3)).
+Please note that for internal reasons, the value is returned as a char
+pointer, although effectively being a 'void *'.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    void *pointer = (void *)0x2345454;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+
+    /* set the private pointer */
+    curl_easy_setopt(curl, CURLOPT_PRIVATE, pointer);
+    result = curl_easy_perform(curl);
+
+    /* extract the private pointer again */
+    result = curl_easy_getinfo(curl, CURLINFO_PRIVATE, &pointer);
+
+    if(result != CURLE_OK)
+      printf("error: %s\n", curl_easy_strerror(result));
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_PROTOCOL.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_PROTOCOL.3
deleted file mode 100644
index 9a3bdc74fa..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_PROTOCOL.3
+++ /dev/null
@@ -1,72 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_PROTOCOL 3 "23 November 2016" libcurl libcurl
-.SH NAME
-CURLINFO_PROTOCOL \- get the protocol used in the connection
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PROTOCOL, long *p);
-.fi
-.SH DESCRIPTION
-This option is deprecated. We strongly recommend using
-\fICURLINFO_SCHEME(3)\fP instead, because this option cannot return all
-possible protocols!
-
-Pass a pointer to a long to receive the version used in the last http
-connection. The returned value is set to one of the CURLPROTO_* values:
-
-.nf
-CURLPROTO_DICT, CURLPROTO_FILE, CURLPROTO_FTP, CURLPROTO_FTPS,
-CURLPROTO_GOPHER, CURLPROTO_HTTP, CURLPROTO_HTTPS, CURLPROTO_IMAP,
-CURLPROTO_IMAPS, CURLPROTO_LDAP, CURLPROTO_LDAPS, CURLPROTO_POP3,
-CURLPROTO_POP3S, CURLPROTO_RTMP, CURLPROTO_RTMPE, CURLPROTO_RTMPS,
-CURLPROTO_RTMPT, CURLPROTO_RTMPTE, CURLPROTO_RTMPTS, CURLPROTO_RTSP,
-CURLPROTO_SCP, CURLPROTO_SFTP, CURLPROTO_SMB, CURLPROTO_SMBS, CURLPROTO_SMTP,
-CURLPROTO_SMTPS, CURLPROTO_TELNET, CURLPROTO_TFTP, CURLPROTO_MQTT
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    long protocol;
-    curl_easy_getinfo(curl, CURLINFO_PROTOCOL, &protocol);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0. Deprecated since 7.85.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLINFO_RESPONSE_CODE "(3), "
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_PROTOCOL.md b/third-party/curl/docs/libcurl/opts/CURLINFO_PROTOCOL.md
new file mode 100644
index 0000000000..3f9346fa04
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_PROTOCOL.md
@@ -0,0 +1,79 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_PROTOCOL
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_RESPONSE_CODE (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLINFO_PROTOCOL - URL scheme used in transfer
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PROTOCOL, long *p);
+~~~
+
+# DESCRIPTION
+
+This option is deprecated. We strongly recommend using CURLINFO_SCHEME(3)
+instead, because this option cannot return all possible schemes. The scheme
+might also sometimes be referred to as the protocol.
+
+Pass a pointer to a long to receive the scheme used in the last transfer. The
+returned value is set to one of these values:
+
+~~~c
+CURLPROTO_DICT, CURLPROTO_FILE, CURLPROTO_FTP, CURLPROTO_FTPS,
+CURLPROTO_GOPHER, CURLPROTO_HTTP, CURLPROTO_HTTPS, CURLPROTO_IMAP,
+CURLPROTO_IMAPS, CURLPROTO_LDAP, CURLPROTO_LDAPS, CURLPROTO_POP3,
+CURLPROTO_POP3S, CURLPROTO_RTMP, CURLPROTO_RTMPE, CURLPROTO_RTMPS,
+CURLPROTO_RTMPT, CURLPROTO_RTMPTE, CURLPROTO_RTMPTS, CURLPROTO_RTSP,
+CURLPROTO_SCP, CURLPROTO_SFTP, CURLPROTO_SMB, CURLPROTO_SMBS, CURLPROTO_SMTP,
+CURLPROTO_SMTPS, CURLPROTO_TELNET, CURLPROTO_TFTP, CURLPROTO_MQTT
+~~~
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      long scheme;
+      curl_easy_getinfo(curl, CURLINFO_PROTOCOL, &scheme);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# DEPRECATED
+
+Deprecated since 7.85.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_PROXYAUTH_AVAIL.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_PROXYAUTH_AVAIL.3
deleted file mode 100644
index a7f9097fb8..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_PROXYAUTH_AVAIL.3
+++ /dev/null
@@ -1,76 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_PROXYAUTH_AVAIL 3 "12 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_PROXYAUTH_AVAIL \- get available HTTP proxy authentication methods
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PROXYAUTH_AVAIL,
-                           long *authp);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive a bitmask indicating the authentication
-method(s) available according to the previous response. The meaning of the
-bits is explained in the \fICURLOPT_PROXYAUTH(3)\fP option for
-\fIcurl_easy_setopt(3)\fP.
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "http://127.0.0.1:80");
-
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    /* extract the available proxy authentication types */
-    long auth;
-    res = curl_easy_getinfo(curl, CURLINFO_PROXYAUTH_AVAIL, &auth);
-    if(!res) {
-      if(!auth)
-        printf("No proxy auth available, perhaps no 407?\\n");
-      else {
-        printf("%s%s%s%s\\n",
-               auth & CURLAUTH_BASIC ? "Basic ":"",
-               auth & CURLAUTH_DIGEST ? "Digest ":"",
-               auth & CURLAUTH_NEGOTIATE ? "Negotiate ":"",
-               auth % CURLAUTH_NTLM ? "NTLM ":"");
-      }
-    }
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added RFC 2617 in 7.10.8
-Added RFC 7616 in 7.57.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_PROXYAUTH_AVAIL.md b/third-party/curl/docs/libcurl/opts/CURLINFO_PROXYAUTH_AVAIL.md
new file mode 100644
index 0000000000..c5110ef377
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_PROXYAUTH_AVAIL.md
@@ -0,0 +1,78 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_PROXYAUTH_AVAIL
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_HTTPAUTH_AVAIL (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - HTTP
+Added-in: 7.10.8
+---
+
+# NAME
+
+CURLINFO_PROXYAUTH_AVAIL - HTTP proxy authentication methods
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PROXYAUTH_AVAIL,
+                           long *authp);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive a bitmask indicating the authentication
+method(s) available according to the previous response. The meaning of the
+bits is explained in the CURLOPT_PROXYAUTH(3) option for curl_easy_setopt(3).
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "http://127.0.0.1:80");
+
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      /* extract the available proxy authentication types */
+      long auth;
+      result = curl_easy_getinfo(curl, CURLINFO_PROXYAUTH_AVAIL, &auth);
+      if(result == CURLE_OK) {
+        if(!auth)
+          printf("No proxy auth available, perhaps no 407?\n");
+        else {
+          printf("%s%s%s%s\n",
+                 auth & CURLAUTH_BASIC ? "Basic " : "",
+                 auth & CURLAUTH_DIGEST ? "Digest " : "",
+                 auth & CURLAUTH_NEGOTIATE ? "Negotiate " : "",
+                 auth % CURLAUTH_NTLM ? "NTLM " : "");
+        }
+      }
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_PROXYAUTH_USED.md b/third-party/curl/docs/libcurl/opts/CURLINFO_PROXYAUTH_USED.md
new file mode 100644
index 0000000000..9c2ee5b15f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_PROXYAUTH_USED.md
@@ -0,0 +1,82 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_PROXYAUTH_USED
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_HTTPAUTH_USED (3)
+  - CURLINFO_PROXYAUTH_AVAIL (3)
+  - CURLOPT_HTTPAUTH (3)
+Protocol:
+  - HTTP
+Added-in: 8.12.0
+---
+
+# NAME
+
+CURLINFO_PROXYAUTH_USED - HTTP proxy authentication method
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PROXYAUTH_USED, long *authp);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive a bitmask indicating the authentication
+method that was used in the previous request done over an HTTP proxy. The
+meaning of the possible bits is explained in the CURLOPT_HTTPAUTH(3) option
+for curl_easy_setopt(3).
+
+The returned value has zero or one bit set.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "http://proxy.example");
+    curl_easy_setopt(curl, CURLOPT_PROXYAUTH,
+                     CURLAUTH_BASIC | CURLAUTH_DIGEST);
+    curl_easy_setopt(curl, CURLOPT_PROXYUSERNAME, "shrek");
+    curl_easy_setopt(curl, CURLOPT_PROXYPASSWORD, "swamp");
+
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      long auth;
+      result = curl_easy_getinfo(curl, CURLINFO_PROXYAUTH_USED, &auth);
+      if(result == CURLE_OK) {
+        if(!auth)
+          printf("No auth used\n");
+        else {
+          if(auth == CURLAUTH_DIGEST)
+            printf("Used Digest proxy authentication\n");
+          else
+            printf("Used Basic proxy authentication\n");
+        }
+      }
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_PROXY_ERROR.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_PROXY_ERROR.3
deleted file mode 100644
index fe322c9681..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_PROXY_ERROR.3
+++ /dev/null
@@ -1,104 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_PROXY_ERROR 3 "3 Aug 2020" libcurl libcurl
-.SH NAME
-CURLINFO_PROXY_ERROR \- get the detailed (SOCKS) proxy error
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-typedef enum {
-  CURLPX_OK,
-  CURLPX_BAD_ADDRESS_TYPE,
-  CURLPX_BAD_VERSION,
-  CURLPX_CLOSED,
-  CURLPX_GSSAPI,
-  CURLPX_GSSAPI_PERMSG,
-  CURLPX_GSSAPI_PROTECTION,
-  CURLPX_IDENTD,
-  CURLPX_IDENTD_DIFFER,
-  CURLPX_LONG_HOSTNAME,
-  CURLPX_LONG_PASSWD,
-  CURLPX_LONG_USER,
-  CURLPX_NO_AUTH,
-  CURLPX_RECV_ADDRESS,
-  CURLPX_RECV_AUTH,
-  CURLPX_RECV_CONNECT,
-  CURLPX_RECV_REQACK,
-  CURLPX_REPLY_ADDRESS_TYPE_NOT_SUPPORTED,
-  CURLPX_REPLY_COMMAND_NOT_SUPPORTED,
-  CURLPX_REPLY_CONNECTION_REFUSED,
-  CURLPX_REPLY_GENERAL_SERVER_FAILURE,
-  CURLPX_REPLY_HOST_UNREACHABLE,
-  CURLPX_REPLY_NETWORK_UNREACHABLE,
-  CURLPX_REPLY_NOT_ALLOWED,
-  CURLPX_REPLY_TTL_EXPIRED,
-  CURLPX_REPLY_UNASSIGNED,
-  CURLPX_REQUEST_FAILED,
-  CURLPX_RESOLVE_HOST,
-  CURLPX_SEND_AUTH,
-  CURLPX_SEND_CONNECT,
-  CURLPX_SEND_REQUEST,
-  CURLPX_UNKNOWN_FAIL,
-  CURLPX_UNKNOWN_MODE,
-  CURLPX_USER_REJECTED,
-  CURLPX_LAST /* never use */
-} CURLproxycode;
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PROXY_ERROR, long *detail);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive a detailed error code when the most recent
-transfer returned a \fBCURLE_PROXY\fP error. That error code matches the
-\fBCURLproxycode\fP set.
-
-The error code is zero (\fBCURLPX_OK\fP) if no response code was available.
-.SH PROTOCOLS
-All that can be done over SOCKS
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  curl_easy_setopt(curl, CURLOPT_PROXY, "socks5://127.0.0.1");
-  res = curl_easy_perform(curl);
-  if(res == CURLE_PROXY) {
-    long proxycode;
-    res = curl_easy_getinfo(curl, CURLINFO_PROXY_ERROR, &proxycode);
-    if(!res && proxycode)
-      printf("The detailed proxy error: %ld\\n", proxycode);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.73.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLINFO_RESPONSE_CODE "(3), " libcurl-errors "(3), "
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_PROXY_ERROR.md b/third-party/curl/docs/libcurl/opts/CURLINFO_PROXY_ERROR.md
new file mode 100644
index 0000000000..0c2dab38fd
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_PROXY_ERROR.md
@@ -0,0 +1,107 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_PROXY_ERROR
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_RESPONSE_CODE (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+  - libcurl-errors (3)
+Protocol:
+  - All
+Added-in: 7.73.0
+---
+
+# NAME
+
+CURLINFO_PROXY_ERROR - detailed (SOCKS) proxy error
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+typedef enum {
+  CURLPX_OK,
+  CURLPX_BAD_ADDRESS_TYPE,
+  CURLPX_BAD_VERSION,
+  CURLPX_CLOSED,
+  CURLPX_GSSAPI,
+  CURLPX_GSSAPI_PERMSG,
+  CURLPX_GSSAPI_PROTECTION,
+  CURLPX_IDENTD,
+  CURLPX_IDENTD_DIFFER,
+  CURLPX_LONG_HOSTNAME,
+  CURLPX_LONG_PASSWD,
+  CURLPX_LONG_USER,
+  CURLPX_NO_AUTH,
+  CURLPX_RECV_ADDRESS,
+  CURLPX_RECV_AUTH,
+  CURLPX_RECV_CONNECT,
+  CURLPX_RECV_REQACK,
+  CURLPX_REPLY_ADDRESS_TYPE_NOT_SUPPORTED,
+  CURLPX_REPLY_COMMAND_NOT_SUPPORTED,
+  CURLPX_REPLY_CONNECTION_REFUSED,
+  CURLPX_REPLY_GENERAL_SERVER_FAILURE,
+  CURLPX_REPLY_HOST_UNREACHABLE,
+  CURLPX_REPLY_NETWORK_UNREACHABLE,
+  CURLPX_REPLY_NOT_ALLOWED,
+  CURLPX_REPLY_TTL_EXPIRED,
+  CURLPX_REPLY_UNASSIGNED,
+  CURLPX_REQUEST_FAILED,
+  CURLPX_RESOLVE_HOST,
+  CURLPX_SEND_AUTH,
+  CURLPX_SEND_CONNECT,
+  CURLPX_SEND_REQUEST,
+  CURLPX_UNKNOWN_FAIL,
+  CURLPX_UNKNOWN_MODE,
+  CURLPX_USER_REJECTED,
+  CURLPX_LAST /* never use */
+} CURLproxycode;
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PROXY_ERROR, long *detail);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive a detailed error code when the most recent
+transfer returned a **CURLE_PROXY** error. That error code matches the
+**CURLproxycode** set.
+
+The error code is zero (**CURLPX_OK**) if no response code was available.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    curl_easy_setopt(curl, CURLOPT_PROXY, "socks5://127.0.0.1");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_PROXY) {
+      long proxycode;
+      result = curl_easy_getinfo(curl, CURLINFO_PROXY_ERROR, &proxycode);
+      if(!result && proxycode)
+        printf("The detailed proxy error: %ld\n", proxycode);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_PROXY_SSL_VERIFYRESULT.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_PROXY_SSL_VERIFYRESULT.3
deleted file mode 100644
index e7039d38da..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_PROXY_SSL_VERIFYRESULT.3
+++ /dev/null
@@ -1,62 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_PROXY_SSL_VERIFYRESULT 3 "16 Nov 2016" libcurl libcurl
-.SH NAME
-CURLINFO_PROXY_SSL_VERIFYRESULT \- get the result of the proxy certificate verification
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PROXY_SSL_VERIFYRESULT,
-                           long *result);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive the result of the certificate verification
-that was requested (using the \fICURLOPT_PROXY_SSL_VERIFYPEER(3)\fP
-option. This is only used for HTTPS proxies.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  long verifyresult;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy:443");
-  res = curl_easy_perform(curl);
-  curl_easy_getinfo(curl, CURLINFO_PROXY_SSL_VERIFYRESULT, &verifyresult);
-  printf("The peer verification said %s\\n", verifyresult?
-         "fine":"BAAAD");
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_SSL_VERIFYRESULT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_PROXY_SSL_VERIFYRESULT.md b/third-party/curl/docs/libcurl/opts/CURLINFO_PROXY_SSL_VERIFYRESULT.md
new file mode 100644
index 0000000000..f9cef23dac
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_PROXY_SSL_VERIFYRESULT.md
@@ -0,0 +1,80 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_PROXY_SSL_VERIFYRESULT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_SSL_VERIFYRESULT (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLINFO_PROXY_SSL_VERIFYRESULT - result of proxy certificate verification
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PROXY_SSL_VERIFYRESULT,
+                           long *result);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive the result of the certificate verification
+that was requested (using the CURLOPT_PROXY_SSL_VERIFYPEER(3)
+option. This is only used for HTTPS proxies.
+
+0 is a positive result. Non-zero is an error.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    long verifyresult;
+
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example:443");
+
+    result = curl_easy_perform(curl);
+    if(result != CURLE_OK) {
+      printf("error: %s\n", curl_easy_strerror(result));
+      curl_easy_cleanup(curl);
+      return 1;
+    }
+
+    result = curl_easy_getinfo(curl, CURLINFO_PROXY_SSL_VERIFYRESULT,
+                               &verifyresult);
+    if(result == CURLE_OK) {
+      printf("The peer verification said %s\n",
+             (verifyresult ? "bad" : "fine"));
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_QUEUE_TIME_T.md b/third-party/curl/docs/libcurl/opts/CURLINFO_QUEUE_TIME_T.md
new file mode 100644
index 0000000000..c84c6bc7d3
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_QUEUE_TIME_T.md
@@ -0,0 +1,72 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_QUEUE_TIME_T
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_STARTTRANSFER_TIME_T (3)
+  - CURLOPT_TIMEOUT (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 8.6.0
+---
+
+# NAME
+
+CURLINFO_QUEUE_TIME_T - time this transfer was queued
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_QUEUE_TIME_T,
+                           curl_off_t *timep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a curl_off_t to receive the time, in microseconds, this
+transfer was held in a waiting queue before it started "for real". A transfer
+might be put in a queue if after getting started, it cannot create a new
+connection etc due to set conditions and limits imposed by the application.
+
+See also the TIMES overview in the curl_easy_getinfo(3) man page.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_off_t queue;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      result = curl_easy_getinfo(curl, CURLINFO_QUEUE_TIME_T, &queue);
+      if(result == CURLE_OK) {
+        printf("Queued: %" CURL_FORMAT_CURL_OFF_T ".%06ld us", queue / 1000000,
+               (long)(queue % 1000000));
+      }
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_COUNT.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_COUNT.3
deleted file mode 100644
index 3fe3c7daa7..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_COUNT.3
+++ /dev/null
@@ -1,60 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_REDIRECT_COUNT 3 "28 Aug 2015" libcurl libcurl
-.SH NAME
-CURLINFO_REDIRECT_COUNT \- get the number of redirects
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_REDIRECT_COUNT,
-                           long *countp);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive the total number of redirections that were
-actually followed.
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    long redirects;
-    curl_easy_getinfo(curl, CURLINFO_REDIRECT_COUNT, &redirects);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.9.7
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_COUNT.md b/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_COUNT.md
new file mode 100644
index 0000000000..c4796e4c96
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_COUNT.md
@@ -0,0 +1,64 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_REDIRECT_COUNT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_REDIRECT_URL (3)
+  - CURLOPT_FOLLOWLOCATION (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.9.7
+---
+
+# NAME
+
+CURLINFO_REDIRECT_COUNT - number of redirects
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_REDIRECT_COUNT,
+                           long *countp);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive the total number of redirections that were
+actually followed.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      long redirects;
+      curl_easy_getinfo(curl, CURLINFO_REDIRECT_COUNT, &redirects);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_TIME.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_TIME.3
deleted file mode 100644
index d558e9aaac..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_TIME.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_REDIRECT_TIME 3 "28 Aug 2015" libcurl libcurl
-.SH NAME
-CURLINFO_REDIRECT_TIME \- get the time for all redirection steps
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_REDIRECT_TIME,
-                           double *timep);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a double to receive the total time, in seconds, it took for
-all redirection steps include name lookup, connect, pretransfer and transfer
-before final transaction was started. \fICURLINFO_REDIRECT_TIME(3)\fP contains
-the complete execution time for multiple redirections.
-
-See also the TIMES overview in the \fIcurl_easy_getinfo(3)\fP man page.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  double redirect;
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  res = curl_easy_perform(curl);
-  if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_REDIRECT_TIME, &redirect);
-    if(CURLE_OK == res) {
-      printf("Time: %.1f", redirect);
-    }
-  }
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.9.7
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " CURLINFO_REDIRECT_TIME_T "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_TIME.md b/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_TIME.md
new file mode 100644
index 0000000000..262bac52cf
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_TIME.md
@@ -0,0 +1,72 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_REDIRECT_TIME
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_REDIRECT_COUNT (3)
+  - CURLINFO_REDIRECT_TIME_T (3)
+  - CURLINFO_REDIRECT_URL (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - HTTP
+Added-in: 7.9.7
+---
+
+# NAME
+
+CURLINFO_REDIRECT_TIME - time for all redirection steps
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_REDIRECT_TIME,
+                           double *timep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a double to receive the total time, in seconds, it took for
+all redirection steps include name lookup, connect, pretransfer and transfer
+before final transaction was started. CURLINFO_REDIRECT_TIME(3) contains
+the complete execution time for multiple redirections.
+
+See also the TIMES overview in the curl_easy_getinfo(3) man page.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    double redirect;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      result = curl_easy_getinfo(curl, CURLINFO_REDIRECT_TIME, &redirect);
+      if(result == CURLE_OK) {
+        printf("Time: %.1f", redirect);
+      }
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_TIME_T.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_TIME_T.3
deleted file mode 100644
index 01d723cf0f..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_TIME_T.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_REDIRECT_TIME_T 3 "28 Apr 2018" libcurl libcurl
-.SH NAME
-CURLINFO_REDIRECT_TIME_T \- get the time for all redirection steps
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_REDIRECT_TIME_T,
-                           curl_off_t *timep);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a curl_off_t to receive the total time, in microseconds,
-it took for
-all redirection steps include name lookup, connect, pretransfer and transfer
-before final transaction was started. \fICURLINFO_REDIRECT_TIME_T\fP contains
-the complete execution time for multiple redirections.
-
-See also the TIMES overview in the \fIcurl_easy_getinfo(3)\fP man page.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  curl_off_t redirect;
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  res = curl_easy_perform(curl);
-  if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_REDIRECT_TIME_T, &redirect);
-    if(CURLE_OK == res) {
-      printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", redirect / 1000000,
-             (long)(redirect % 1000000));
-    }
-  }
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.61.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " CURLINFO_REDIRECT_TIME "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_TIME_T.md b/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_TIME_T.md
new file mode 100644
index 0000000000..84684893ca
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_TIME_T.md
@@ -0,0 +1,74 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_REDIRECT_TIME_T
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_REDIRECT_COUNT (3)
+  - CURLINFO_REDIRECT_TIME (3)
+  - CURLINFO_REDIRECT_URL (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - HTTP
+Added-in: 7.61.0
+---
+
+# NAME
+
+CURLINFO_REDIRECT_TIME_T - time for all redirection steps
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_REDIRECT_TIME_T,
+                           curl_off_t *timep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a curl_off_t to receive the total time, in microseconds, it
+took for all redirection steps include name lookup, connect, pretransfer and
+transfer before final transaction was started.
+CURLINFO_REDIRECT_TIME_T(3) holds the complete execution time for
+multiple redirections.
+
+See also the TIMES overview in the curl_easy_getinfo(3) man page.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_off_t redirect;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      result = curl_easy_getinfo(curl, CURLINFO_REDIRECT_TIME_T, &redirect);
+      if(result == CURLE_OK) {
+        printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", redirect / 1000000,
+               (long)(redirect % 1000000));
+      }
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_URL.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_URL.3
deleted file mode 100644
index 7acbe1d320..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_URL.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_REDIRECT_URL 3 "28 Aug 2015" libcurl libcurl
-.SH NAME
-CURLINFO_REDIRECT_URL \- get the URL a redirect would go to
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_REDIRECT_URL, char **urlp);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a char pointer to receive the URL a redirect \fIwould\fP
-take you to if you would enable \fICURLOPT_FOLLOWLOCATION(3)\fP. This can come
-handy if you think using the built-in libcurl redirect logic is not good enough
-for you but you would still prefer to avoid implementing all the magic of
-figuring out the new URL.
-
-This URL is also set if the \fICURLOPT_MAXREDIRS(3)\fP limit prevented a
-redirect to happen (since 7.54.1).
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    char *url = NULL;
-    curl_easy_getinfo(curl, CURLINFO_REDIRECT_URL, &url);
-    if(url)
-      printf("Redirect to: %s\\n", url);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.18.2
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_URL.md b/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_URL.md
new file mode 100644
index 0000000000..df3a320b92
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_REDIRECT_URL.md
@@ -0,0 +1,71 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_REDIRECT_URL
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_REDIRECT_COUNT (3)
+  - CURLINFO_REDIRECT_TIME_T (3)
+  - CURLOPT_FOLLOWLOCATION (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - HTTP
+Added-in: 7.18.2
+---
+
+# NAME
+
+CURLINFO_REDIRECT_URL - URL a redirect would go to
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_REDIRECT_URL, char **urlp);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a char pointer to receive the URL a redirect *would* take
+you to if you would enable CURLOPT_FOLLOWLOCATION(3). This can come handy if
+you think using the built-in libcurl redirect logic is not good enough for you
+but you would still prefer to avoid implementing all the logic of figuring out
+the new URL.
+
+This URL is also set if the CURLOPT_MAXREDIRS(3) limit prevented a redirect to
+happen.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      char *url = NULL;
+      curl_easy_getinfo(curl, CURLINFO_REDIRECT_URL, &url);
+      if(url)
+        printf("Redirect to: %s\n", url);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_REFERER.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_REFERER.3
deleted file mode 100644
index a0202caf0c..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_REFERER.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_REFERER 3 "11 Feb 2021" libcurl libcurl
-.SH NAME
-CURLINFO_REFERER \- get the referrer header
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_REFERER, char **hdrp);
-.fi
-.SH DESCRIPTION
-Pass in a pointer to a char pointer and get the referrer header.
-
-The \fBhdrp\fP pointer is NULL or points to private memory you MUST NOT free -
-it gets freed when you call \fIcurl_easy_cleanup(3)\fP on the corresponding
-CURL handle.
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_REFERER, "https://example.org/referrer");
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    char *hdr = NULL;
-    curl_easy_getinfo(curl, CURLINFO_REFERER, &hdr);
-    if(hdr)
-      printf("Referrer header: %s\\n", hdr);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.76.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLOPT_REFERER "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_REFERER.md b/third-party/curl/docs/libcurl/opts/CURLINFO_REFERER.md
new file mode 100644
index 0000000000..6542965fa9
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_REFERER.md
@@ -0,0 +1,69 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_REFERER
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_REFERER (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_header (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - HTTP
+Added-in: 7.76.0
+---
+
+# NAME
+
+CURLINFO_REFERER - used HTTP referrer request header
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_REFERER, char **hdrp);
+~~~
+
+# DESCRIPTION
+
+Pass in a pointer to a char pointer and get the referrer header used in the
+most recent request.
+
+The **hdrp** pointer is NULL or points to private memory. You **must not**
+free it. The memory gets freed automatically when you call
+curl_easy_cleanup(3) on the corresponding curl handle.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_REFERER, "https://example.org/referrer");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      char *hdr = NULL;
+      curl_easy_getinfo(curl, CURLINFO_REFERER, &hdr);
+      if(hdr)
+        printf("Referrer header: %s\n", hdr);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_REQUEST_SIZE.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_REQUEST_SIZE.3
deleted file mode 100644
index ce1282a8b0..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_REQUEST_SIZE.3
+++ /dev/null
@@ -1,63 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_REQUEST_SIZE 3 "1 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_REQUEST_SIZE \- get size of sent request
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_REQUEST_SIZE, long *sizep);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive the total size of the issued
-requests. This is so far only for HTTP requests. Note that this may be more
-than one request if \fICURLOPT_FOLLOWLOCATION(3)\fP is enabled.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    long req;
-    res = curl_easy_getinfo(curl, CURLINFO_REQUEST_SIZE, &req);
-    if(!res)
-      printf("Request size: %ld bytes\\n", req);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.4.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_HEADER_SIZE "(3), "
-.BR CURLINFO_SIZE_DOWNLOAD "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_REQUEST_SIZE.md b/third-party/curl/docs/libcurl/opts/CURLINFO_REQUEST_SIZE.md
new file mode 100644
index 0000000000..35f8aafd7d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_REQUEST_SIZE.md
@@ -0,0 +1,65 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_REQUEST_SIZE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_HEADER_SIZE (3)
+  - CURLINFO_SIZE_DOWNLOAD_T (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.4.1
+---
+
+# NAME
+
+CURLINFO_REQUEST_SIZE - size of sent request
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_REQUEST_SIZE, long *sizep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive the total size of the issued
+requests. This is so far only for HTTP requests. Note that this may be more
+than one request if CURLOPT_FOLLOWLOCATION(3) is enabled.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      long req;
+      result = curl_easy_getinfo(curl, CURLINFO_REQUEST_SIZE, &req);
+      if(result == CURLE_OK)
+        printf("Request size: %ld bytes\n", req);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_RESPONSE_CODE.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_RESPONSE_CODE.3
deleted file mode 100644
index f89df09cfa..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_RESPONSE_CODE.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_RESPONSE_CODE 3 "28 Aug 2015" libcurl libcurl
-.SH NAME
-CURLINFO_RESPONSE_CODE \- get the last response code
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_RESPONSE_CODE, long *codep);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive the last received HTTP, FTP, SMTP or LDAP
-(OpenLDAP only) response code. This option was previously known as
-CURLINFO_HTTP_CODE in libcurl 7.10.7 and earlier. The stored value is zero if
-no server response code has been received.
-
-Note that a proxy's CONNECT response should be read with
-\fICURLINFO_HTTP_CONNECTCODE(3)\fP and not this.
-.SH PROTOCOLS
-HTTP, FTP, SMTP and LDAP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    long response_code;
-    curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &response_code);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.10.8. CURLINFO_HTTP_CODE was added in 7.4.1.
-Support for SMTP responses added in 7.25.0, for OpenLDAP in 7.81.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_HTTP_CONNECTCODE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_RESPONSE_CODE.md b/third-party/curl/docs/libcurl/opts/CURLINFO_RESPONSE_CODE.md
new file mode 100644
index 0000000000..aeb8aeab8a
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_RESPONSE_CODE.md
@@ -0,0 +1,74 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_RESPONSE_CODE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_HTTP_CONNECTCODE (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - HTTP
+  - FTP
+  - SMTP
+  - LDAP
+Added-in: 7.10.8
+---
+
+# NAME
+
+CURLINFO_RESPONSE_CODE - last response code
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_RESPONSE_CODE, long *codep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive the last received HTTP, FTP, SMTP or LDAP
+(OpenLDAP only) response code. This option was previously known as
+CURLINFO_HTTP_CODE in libcurl 7.10.7 and earlier. The stored value is zero if
+no server response code has been received.
+
+Note that a proxy's CONNECT response should be read with
+CURLINFO_HTTP_CONNECTCODE(3) and not this.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      long response_code;
+      curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &response_code);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# NOTES
+
+The former name, CURLINFO_HTTP_CODE, was added in 7.4.1. Support for SMTP
+responses added in 7.25.0, for OpenLDAP in 7.81.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_RETRY_AFTER.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_RETRY_AFTER.3
deleted file mode 100644
index b2e66f04f0..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_RETRY_AFTER.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_RETRY_AFTER 3 "6 Aug 2019" libcurl libcurl
-.SH NAME
-CURLINFO_RETRY_AFTER \- returns the Retry-After retry delay
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_RETRY_AFTER,
-                           curl_off_t *retry);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a curl_off_t variable to receive the number of seconds the
-HTTP server suggests the client should wait until the next request is
-issued. The information from the "Retry-After:" header.
-
-While the HTTP header might contain a fixed date string, the
-\fICURLINFO_RETRY_AFTER(3)\fP always returns the number of seconds to wait -
-or zero if there was no header or the header could not be parsed.
-.SH DEFAULT
-Returns zero delay if there was no header.
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    curl_off_t wait = 0;
-    curl_easy_getinfo(curl, CURLINFO_RETRY_AFTER, &wait);
-    if(wait)
-      printf("Wait for %" CURL_FORMAT_CURL_OFF_T " seconds\\n", wait);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.66.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_STDERR "(3), " CURLOPT_HEADERFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_RETRY_AFTER.md b/third-party/curl/docs/libcurl/opts/CURLINFO_RETRY_AFTER.md
new file mode 100644
index 0000000000..3e36aa3d71
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_RETRY_AFTER.md
@@ -0,0 +1,78 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_RETRY_AFTER
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HEADERFUNCTION (3)
+  - CURLOPT_STDERR (3)
+  - curl_easy_header (3)
+Protocol:
+  - All
+Added-in: 7.66.0
+---
+
+# NAME
+
+CURLINFO_RETRY_AFTER - returns the Retry-After retry delay
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_RETRY_AFTER,
+                           curl_off_t *retry);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a curl_off_t variable to receive the number of seconds the
+HTTP server suggests the client should wait until the next request is
+issued. The information from the "Retry-After:" header.
+
+While the HTTP header might contain a fixed date string, the
+CURLINFO_RETRY_AFTER(3) always returns the number of seconds to wait -
+or zero if there was no header or the header could not be parsed.
+
+This option used to return a negative wait time if the server provided a date
+in the past. Since 8.12.0, a negative wait time is returned as zero. In any
+case we recommend checking that the wait time is within an acceptable range for
+your circumstance.
+
+# DEFAULT
+
+Zero if there was no header.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      curl_off_t wait = 0;
+      curl_easy_getinfo(curl, CURLINFO_RETRY_AFTER, &wait);
+      if(wait)
+        printf("Wait for %" CURL_FORMAT_CURL_OFF_T " seconds\n", wait);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_CLIENT_CSEQ.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_CLIENT_CSEQ.3
deleted file mode 100644
index cbc6df64c9..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_CLIENT_CSEQ.3
+++ /dev/null
@@ -1,59 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_RTSP_CLIENT_CSEQ 3 "1 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_RTSP_CLIENT_CSEQ \- get the next RTSP client CSeq
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_RTSP_CLIENT_CSEQ,
-                           long *cseq);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive the next CSeq that is expected to be used
-by the application.
-.SH PROTOCOLS
-RTSP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "rtsp://rtsp.example.com");
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    long cseq;
-    curl_easy_getinfo(curl, CURLINFO_RTSP_CLIENT_CSEQ, &cseq);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.20.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_CLIENT_CSEQ.md b/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_CLIENT_CSEQ.md
new file mode 100644
index 0000000000..a16b5a1ab6
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_CLIENT_CSEQ.md
@@ -0,0 +1,63 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_RTSP_CLIENT_CSEQ
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_RTSP_CSEQ_RECV (3)
+  - CURLINFO_RTSP_SERVER_CSEQ (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - RTSP
+Added-in: 7.20.0
+---
+
+# NAME
+
+CURLINFO_RTSP_CLIENT_CSEQ - next RTSP client CSeq
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_RTSP_CLIENT_CSEQ,
+                           long *cseq);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive the next CSeq that is expected to be used
+by the application.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "rtsp://rtsp.example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      long cseq;
+      curl_easy_getinfo(curl, CURLINFO_RTSP_CLIENT_CSEQ, &cseq);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_CSEQ_RECV.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_CSEQ_RECV.3
deleted file mode 100644
index 804c3f83e3..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_CSEQ_RECV.3
+++ /dev/null
@@ -1,60 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_RTSP_CSEQ_RECV 3 "12 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_RTSP_CSEQ_RECV \- get the recently received CSeq
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_RTSP_CSEQ_RECV, long *cseq);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive the most recently received CSeq from the
-server. If your application encounters a \fICURLE_RTSP_CSEQ_ERROR\fP then you
-may wish to troubleshoot and/or fix the CSeq mismatch by peeking at this
-value.
-.SH PROTOCOLS
-RTSP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "rtsp://rtsp.example.com");
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    long cseq;
-    curl_easy_getinfo(curl, CURLINFO_RTSP_CSEQ_RECV, &cseq);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.20.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_CSEQ_RECV.md b/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_CSEQ_RECV.md
new file mode 100644
index 0000000000..98cf8a29aa
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_CSEQ_RECV.md
@@ -0,0 +1,63 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_RTSP_CSEQ_RECV
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_RTSP_SERVER_CSEQ (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - RTSP
+Added-in: 7.20.0
+---
+
+# NAME
+
+CURLINFO_RTSP_CSEQ_RECV - last received RTSP CSeq
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_RTSP_CSEQ_RECV, long *cseq);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive the most recently received CSeq from the
+server. If your application encounters a *CURLE_RTSP_CSEQ_ERROR* then you
+may wish to troubleshoot and/or fix the CSeq mismatch by peeking at this
+value.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "rtsp://rtsp.example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      long cseq;
+      curl_easy_getinfo(curl, CURLINFO_RTSP_CSEQ_RECV, &cseq);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_SERVER_CSEQ.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_SERVER_CSEQ.3
deleted file mode 100644
index 1c0bde12b4..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_SERVER_CSEQ.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_RTSP_SERVER_CSEQ 3 "1 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_RTSP_SERVER_CSEQ \- get the next RTSP server CSeq
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_RTSP_SERVER_CSEQ,
-                           long *cseq);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive the next CSeq that is expected to be used
-by the application.
-
-Listening for server initiated requests is not implemented!
-
-Applications wishing to resume an RTSP session on another connection should
-retrieve this info before closing the active connection.
-.SH PROTOCOLS
-RTSP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "rtsp://rtsp.example.com");
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    long cseq;
-    curl_easy_getinfo(curl, CURLINFO_RTSP_SERVER_CSEQ, &cseq);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.20.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_SERVER_CSEQ.md b/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_SERVER_CSEQ.md
new file mode 100644
index 0000000000..d7fd2131e0
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_SERVER_CSEQ.md
@@ -0,0 +1,67 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_RTSP_SERVER_CSEQ
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_RTSP_CSEQ_RECV (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - RTSP
+Added-in: 7.20.0
+---
+
+# NAME
+
+CURLINFO_RTSP_SERVER_CSEQ - next RTSP server CSeq
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_RTSP_SERVER_CSEQ,
+                           long *cseq);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive the next CSeq that is expected to be used
+by the application.
+
+Listening for server initiated requests is not implemented.
+
+Applications wishing to resume an RTSP session on another connection should
+retrieve this info before closing the active connection.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "rtsp://rtsp.example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      long cseq;
+      curl_easy_getinfo(curl, CURLINFO_RTSP_SERVER_CSEQ, &cseq);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_SESSION_ID.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_SESSION_ID.3
deleted file mode 100644
index e14ab871db..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_SESSION_ID.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_RTSP_SESSION_ID 3 "12 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_RTSP_SESSION_ID \- get RTSP session ID
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_RTSP_SESSION_ID, char **id);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a char pointer to receive a pointer to a string holding the
-most recent RTSP Session ID.
-
-Applications wishing to resume an RTSP session on another connection should
-retrieve this info before closing the active connection.
-
-The \fBid\fP pointer is NULL or points to private memory. You MUST NOT free -
-it gets freed when you call \fIcurl_easy_cleanup(3)\fP on the corresponding
-CURL handle.
-.SH PROTOCOLS
-RTSP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "rtsp://rtsp.example.com");
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    char *id;
-    curl_easy_getinfo(curl, CURLINFO_RTSP_SESSION_ID, &id);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.20.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_SESSION_ID.md b/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_SESSION_ID.md
new file mode 100644
index 0000000000..4d75ef33e2
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_RTSP_SESSION_ID.md
@@ -0,0 +1,68 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_RTSP_SESSION_ID
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_RTSP_CSEQ_RECV (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - RTSP
+Added-in: 7.20.0
+---
+
+# NAME
+
+CURLINFO_RTSP_SESSION_ID - RTSP session ID
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_RTSP_SESSION_ID, char **id);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a char pointer to receive a pointer to a string holding the
+most recent RTSP Session ID.
+
+Applications wishing to resume an RTSP session on another connection should
+retrieve this info before closing the active connection.
+
+The **id** pointer is NULL or points to private memory. You **must not** free
+it. The memory gets freed automatically when you call curl_easy_cleanup(3) on
+the corresponding curl handle.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "rtsp://rtsp.example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      char *id;
+      curl_easy_getinfo(curl, CURLINFO_RTSP_SESSION_ID, &id);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SCHEME.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_SCHEME.3
deleted file mode 100644
index f5b7f94a3f..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_SCHEME.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_SCHEME 3 "23 November 2016" libcurl libcurl
-.SH NAME
-CURLINFO_SCHEME \- get the URL scheme (sometimes called protocol) used in the connection
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SCHEME, char **scheme);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a char pointer to receive the pointer to a null-terminated
-string holding the URL scheme used for the most recent connection done with
-this CURL \fBhandle\fP.
-
-The \fBscheme\fP pointer is NULL or points to private memory. You MUST NOT
-free - it gets freed when you call \fIcurl_easy_cleanup(3)\fP on the
-corresponding CURL handle.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    char *scheme = NULL;
-    curl_easy_getinfo(curl, CURLINFO_SCHEME, &scheme);
-    if(scheme)
-      printf("scheme: %s\\n", scheme); /* scheme: HTTP */
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLINFO_RESPONSE_CODE "(3), "
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SCHEME.md b/third-party/curl/docs/libcurl/opts/CURLINFO_SCHEME.md
new file mode 100644
index 0000000000..d453e2891d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_SCHEME.md
@@ -0,0 +1,74 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_SCHEME
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_EFFECTIVE_URL (3)
+  - CURLINFO_PROTOCOL (3)
+  - CURLINFO_RESPONSE_CODE (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLINFO_SCHEME - URL scheme used in transfer
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SCHEME, char **scheme);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a char pointer to receive the pointer to a null-terminated
+string holding the URL scheme used for the most recent transfer done with this
+CURL **handle**. The scheme might also sometimes be referred to as the
+protocol.
+
+The **scheme** pointer is NULL or points to private memory. You **must not**
+free it. The memory gets freed automatically when you call
+curl_easy_cleanup(3) on the corresponding curl handle.
+
+The returned scheme might be upper or lowercase. Do comparisons case
+insensitively.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      char *scheme = NULL;
+      curl_easy_getinfo(curl, CURLINFO_SCHEME, &scheme);
+      if(scheme)
+        printf("scheme: %s\n", scheme); /* scheme: HTTP */
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DELIVERED.md b/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DELIVERED.md
new file mode 100644
index 0000000000..db699c98a5
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DELIVERED.md
@@ -0,0 +1,78 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_SIZE_DELIVERED
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_SIZE_DOWNLOAD_T (3)
+  - CURLINFO_CONTENT_LENGTH_DOWNLOAD_T (3)
+  - CURLOPT_MAXFILESIZE (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 8.20.0
+---
+
+# NAME
+
+CURLINFO_SIZE_DELIVERED - number of delivered bytes
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SIZE_DELIVERED,
+                           curl_off_t *dlp);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a *curl_off_t* to receive the total amount of bytes that
+were passed on to the write callback in the download. The amount is only for
+the latest transfer and gets reset again for each new transfer. This counts
+actual payload data, what's also commonly called body. All meta and header
+data is excluded from this amount (unless CURLOPT_HEADER(3) is set).
+
+The delivered size may differ from the size retrieved with
+CURLINFO_SIZE_DOWNLOAD_T(3) when CURLOPT_ACCEPT_ENCODING(3) is used for
+automatic data decompression, as this is then the size of the uncompressed
+body while CURLINFO_SIZE_DOWNLOAD_T(3) returns the size of the download.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      /* check the size */
+      curl_off_t dl;
+      result = curl_easy_getinfo(curl, CURLINFO_SIZE_DELIVERED, &dl);
+      if(result == CURLE_OK) {
+        printf("Stored %" CURL_FORMAT_CURL_OFF_T " bytes\n", dl);
+      }
+    }
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DOWNLOAD.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DOWNLOAD.3
deleted file mode 100644
index 12d2661a1a..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DOWNLOAD.3
+++ /dev/null
@@ -1,71 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_SIZE_DOWNLOAD 3 "28 Aug 2015" libcurl libcurl
-.SH NAME
-CURLINFO_SIZE_DOWNLOAD \- get the number of downloaded bytes
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SIZE_DOWNLOAD, double *dlp);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a double to receive the total amount of bytes that were
-downloaded. The amount is only for the latest transfer and gets reset again
-for each new transfer. This counts actual payload data, what's also commonly
-called body. All meta and header data is excluded and not included in this
-number.
-
-\fICURLINFO_SIZE_DOWNLOAD_T(3)\fP is a newer replacement that returns a more
-sensible variable type.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Perform the request */
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    /* check the size */
-    double dl;
-    res = curl_easy_getinfo(curl, CURLINFO_SIZE_DOWNLOAD, &dl);
-    if(!res) {
-      printf("Downloaded %.0f bytes\\n", cl);
-    }
-  }
-}
-.fi
-.SH AVAILABILITY
-Added in 7.4.1. Deprecated since 7.55.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_SIZE_DOWNLOAD_T "(3), "
-.BR CURLINFO_SIZE_UPLOAD_T "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DOWNLOAD.md b/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DOWNLOAD.md
new file mode 100644
index 0000000000..85efc6e2ff
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DOWNLOAD.md
@@ -0,0 +1,79 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_SIZE_DOWNLOAD
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_SIZE_DOWNLOAD_T (3)
+  - CURLINFO_SIZE_UPLOAD_T (3)
+  - CURLOPT_MAXFILESIZE (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.4.1
+---
+
+# NAME
+
+CURLINFO_SIZE_DOWNLOAD - number of downloaded bytes
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SIZE_DOWNLOAD, double *dlp);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a double to receive the total amount of bytes that were
+downloaded. The amount is only for the latest transfer and gets reset again
+for each new transfer. This counts actual payload data, what's also commonly
+called body. All meta and header data is excluded and not included in this
+number.
+
+CURLINFO_SIZE_DOWNLOAD_T(3) is a newer replacement that returns a more
+sensible variable type.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      /* check the size */
+      double dl;
+      result = curl_easy_getinfo(curl, CURLINFO_SIZE_DOWNLOAD, &dl);
+      if(result == CURLE_OK) {
+        printf("Downloaded %.0f bytes\n", dl);
+      }
+    }
+  }
+}
+~~~
+
+# DEPRECATED
+
+Deprecated since 7.55.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DOWNLOAD_T.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DOWNLOAD_T.3
deleted file mode 100644
index 6df958edab..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DOWNLOAD_T.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_SIZE_DOWNLOAD_T 3 "25 May 2017" libcurl libcurl
-.SH NAME
-CURLINFO_SIZE_DOWNLOAD_T \- get the number of downloaded bytes
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SIZE_DOWNLOAD_T,
-                           curl_off_t *dlp);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a \fIcurl_off_t\fP to receive the total amount of bytes that
-were downloaded. The amount is only for the latest transfer and gets reset
-again for each new transfer. This counts actual payload data, what's also
-commonly called body. All meta and header data is excluded from this amount.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Perform the request */
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    /* check the size */
-    curl_off_t dl;
-    res = curl_easy_getinfo(curl, CURLINFO_SIZE_DOWNLOAD_T, &dl);
-    if(!res) {
-      printf("Downloaded %" CURL_FORMAT_CURL_OFF_T " bytes\\n", dl);
-    }
-  }
-}
-.fi
-.SH AVAILABILITY
-Added in 7.55.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_SIZE_DOWNLOAD "(3), "
-.BR CURLINFO_SIZE_UPLOAD_T "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DOWNLOAD_T.md b/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DOWNLOAD_T.md
new file mode 100644
index 0000000000..00a1d83d3d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_DOWNLOAD_T.md
@@ -0,0 +1,72 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_SIZE_DOWNLOAD_T
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_SIZE_DOWNLOAD (3)
+  - CURLINFO_SIZE_UPLOAD_T (3)
+  - CURLOPT_MAXFILESIZE (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.55.0
+---
+
+# NAME
+
+CURLINFO_SIZE_DOWNLOAD_T - number of downloaded bytes
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SIZE_DOWNLOAD_T,
+                           curl_off_t *dlp);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a *curl_off_t* to receive the total amount of bytes that
+were downloaded. The amount is only for the latest transfer and gets reset
+again for each new transfer. This counts actual payload data, what's also
+commonly called body. All meta and header data is excluded from this amount.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      /* check the size */
+      curl_off_t dl;
+      result = curl_easy_getinfo(curl, CURLINFO_SIZE_DOWNLOAD_T, &dl);
+      if(result == CURLE_OK) {
+        printf("Downloaded %" CURL_FORMAT_CURL_OFF_T " bytes\n", dl);
+      }
+    }
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_UPLOAD.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_UPLOAD.3
deleted file mode 100644
index 2d511caf17..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_UPLOAD.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_SIZE_UPLOAD 3 "28 Aug 2015" libcurl libcurl
-.SH NAME
-CURLINFO_SIZE_UPLOAD \- get the number of uploaded bytes
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SIZE_UPLOAD,
-                           double *uploadp);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a double to receive the total amount of bytes that were
-uploaded.
-
-\fICURLINFO_SIZE_UPLOAD_T(3)\fP is a newer replacement that returns a more
-sensible variable type.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Perform the request */
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    double ul;
-    res = curl_easy_getinfo(curl, CURLINFO_SIZE_UPLOAD, &ul);
-    if(!res) {
-      printf("Uploaded %.0f bytes\\n", ul);
-    }
-  }
-}
-.fi
-.SH AVAILABILITY
-Added in 7.4.1. Deprecated since 7.55.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_SIZE_DOWNLOAD_T "(3), " CURLINFO_SIZE_UPLOAD_T "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_UPLOAD.md b/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_UPLOAD.md
new file mode 100644
index 0000000000..4f25a4526a
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_UPLOAD.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_SIZE_UPLOAD
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_SIZE_DOWNLOAD_T (3)
+  - CURLINFO_SIZE_UPLOAD_T (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.4.1
+---
+
+# NAME
+
+CURLINFO_SIZE_UPLOAD - number of uploaded bytes
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SIZE_UPLOAD,
+                           double *uploadp);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a double to receive the total amount of bytes that were
+uploaded.
+
+CURLINFO_SIZE_UPLOAD_T(3) is a newer replacement that returns a more
+sensible variable type.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      double ul;
+      result = curl_easy_getinfo(curl, CURLINFO_SIZE_UPLOAD, &ul);
+      if(result == CURLE_OK) {
+        printf("Uploaded %.0f bytes\n", ul);
+      }
+    }
+  }
+}
+~~~
+
+# DEPRECATED
+
+Deprecated since 7.55.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_UPLOAD_T.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_UPLOAD_T.3
deleted file mode 100644
index 10d9156d99..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_UPLOAD_T.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_SIZE_UPLOAD_T 3 "25 May 2017" libcurl libcurl
-.SH NAME
-CURLINFO_SIZE_UPLOAD_T \- get the number of uploaded bytes
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SIZE_UPLOAD_T,
-                           curl_off_t *uploadp);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a \fIcurl_off_t\fP to receive the total amount of bytes that
-were uploaded.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Perform the request */
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    curl_off_t ul;
-    res = curl_easy_getinfo(curl, CURLINFO_SIZE_UPLOAD_T, &ul);
-    if(!res) {
-      printf("Uploaded %" CURL_FORMAT_CURL_OFF_T " bytes\\n", ul);
-    }
-  }
-}
-.fi
-.SH AVAILABILITY
-Added in 7.55.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_SIZE_DOWNLOAD_T "(3), " CURLINFO_SIZE_UPLOAD "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_UPLOAD_T.md b/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_UPLOAD_T.md
new file mode 100644
index 0000000000..c91e3e7c0d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_SIZE_UPLOAD_T.md
@@ -0,0 +1,68 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_SIZE_UPLOAD_T
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_SIZE_DOWNLOAD_T (3)
+  - CURLINFO_SIZE_UPLOAD (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.55.0
+---
+
+# NAME
+
+CURLINFO_SIZE_UPLOAD_T - number of uploaded bytes
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SIZE_UPLOAD_T,
+                           curl_off_t *uploadp);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a *curl_off_t* to receive the total amount of bytes that
+were uploaded.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      curl_off_t ul;
+      result = curl_easy_getinfo(curl, CURLINFO_SIZE_UPLOAD_T, &ul);
+      if(result == CURLE_OK) {
+        printf("Uploaded %" CURL_FORMAT_CURL_OFF_T " bytes\n", ul);
+      }
+    }
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_DOWNLOAD.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_DOWNLOAD.3
deleted file mode 100644
index e5a910ab2d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_DOWNLOAD.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_SPEED_DOWNLOAD 3 "28 Aug 2015" libcurl libcurl
-.SH NAME
-CURLINFO_SPEED_DOWNLOAD \- get download speed
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SPEED_DOWNLOAD,
-                           double *speed);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a double to receive the average download speed that curl
-measured for the complete download. Measured in bytes/second.
-
-\fICURLINFO_SPEED_DOWNLOAD_T(3)\fP is a newer replacement that returns a more
-sensible variable type.
-.SH PROTOCOLS
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Perform the request */
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    double speed;
-    res = curl_easy_getinfo(curl, CURLINFO_SPEED_DOWNLOAD, &speed);
-    if(!res) {
-      printf("Download speed %.0f bytes/sec\\n", speed);
-    }
-  }
-}
-.fi
-.SH AVAILABILITY
-Added in 7.4.1. Deprecated since 7.55.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_SPEED_UPLOAD "(3), "
-.BR CURLINFO_SIZE_UPLOAD_T "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_DOWNLOAD.md b/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_DOWNLOAD.md
new file mode 100644
index 0000000000..892f920d3b
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_DOWNLOAD.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_SPEED_DOWNLOAD
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_SIZE_UPLOAD_T (3)
+  - CURLINFO_SPEED_UPLOAD (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.4.1
+---
+
+# NAME
+
+CURLINFO_SPEED_DOWNLOAD - download speed
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SPEED_DOWNLOAD,
+                           double *speed);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a double to receive the average download speed that curl
+measured for the complete download. Measured in bytes/second.
+
+CURLINFO_SPEED_DOWNLOAD_T(3) is a newer replacement that returns a more
+sensible variable type.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      double speed;
+      result = curl_easy_getinfo(curl, CURLINFO_SPEED_DOWNLOAD, &speed);
+      if(result == CURLE_OK) {
+        printf("Download speed %.0f bytes/sec\n", speed);
+      }
+    }
+  }
+}
+~~~
+
+# DEPRECATED
+
+Deprecated since 7.55.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_DOWNLOAD_T.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_DOWNLOAD_T.3
deleted file mode 100644
index 78998f57ab..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_DOWNLOAD_T.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_SPEED_DOWNLOAD_T 3 "28 Aug 2015" libcurl libcurl
-.SH NAME
-CURLINFO_SPEED_DOWNLOAD_T \- get download speed
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SPEED_DOWNLOAD_T,
-                           curl_off_t *speed);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a \fIcurl_off_t\fP to receive the average download speed
-that curl measured for the complete download. Measured in bytes/second.
-.SH PROTOCOLS
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Perform the request */
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    curl_off_t speed;
-    res = curl_easy_getinfo(curl, CURLINFO_SPEED_DOWNLOAD_T, &speed);
-    if(!res) {
-      printf("Download speed %" CURL_FORMAT_CURL_OFF_T " bytes/sec\\n", speed);
-    }
-  }
-}
-.fi
-.SH AVAILABILITY
-Added in 7.55.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_SPEED_UPLOAD "(3), "
-.BR CURLINFO_SIZE_UPLOAD_T "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_DOWNLOAD_T.md b/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_DOWNLOAD_T.md
new file mode 100644
index 0000000000..94e5eea305
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_DOWNLOAD_T.md
@@ -0,0 +1,69 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_SPEED_DOWNLOAD_T
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_SIZE_UPLOAD_T (3)
+  - CURLINFO_SPEED_UPLOAD_T (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.55.0
+---
+
+# NAME
+
+CURLINFO_SPEED_DOWNLOAD_T - download speed
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SPEED_DOWNLOAD_T,
+                           curl_off_t *speed);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a *curl_off_t* to receive the average download speed
+that curl measured for the complete download. Measured in bytes/second.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      curl_off_t speed;
+      result = curl_easy_getinfo(curl, CURLINFO_SPEED_DOWNLOAD_T, &speed);
+      if(result == CURLE_OK) {
+        printf("Download speed %" CURL_FORMAT_CURL_OFF_T " bytes/sec\n",
+               speed);
+      }
+    }
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_UPLOAD.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_UPLOAD.3
deleted file mode 100644
index ff780ccc8e..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_UPLOAD.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_SPEED_UPLOAD 3 "28 Aug 2015" libcurl libcurl
-.SH NAME
-CURLINFO_SPEED_UPLOAD \- get upload speed
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SPEED_UPLOAD, double *speed);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a double to receive the average upload speed that curl
-measured for the complete upload. Measured in bytes/second.
-
-\fICURLINFO_SPEED_UPLOAD_T(3)\fP is a newer replacement that returns a more
-sensible variable type.
-.SH PROTOCOLS
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Perform the request */
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    double speed;
-    res = curl_easy_getinfo(curl, CURLINFO_SPEED_UPLOAD, &speed);
-    if(!res) {
-      printf("Upload speed %.0f bytes/sec\\n", speed);
-    }
-  }
-}
-.fi
-.SH AVAILABILITY
-Added in 7.4.1. Deprecated since 7.55.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_SPEED_DOWNLOAD "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_UPLOAD.md b/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_UPLOAD.md
new file mode 100644
index 0000000000..f2e1223675
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_UPLOAD.md
@@ -0,0 +1,73 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_SPEED_UPLOAD
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_SPEED_DOWNLOAD_T (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.4.1
+---
+
+# NAME
+
+CURLINFO_SPEED_UPLOAD - upload speed
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SPEED_UPLOAD, double *speed);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a double to receive the average upload speed that curl
+measured for the complete upload. Measured in bytes/second.
+
+CURLINFO_SPEED_UPLOAD_T(3) is a newer replacement that returns a more
+sensible variable type.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      double speed;
+      result = curl_easy_getinfo(curl, CURLINFO_SPEED_UPLOAD, &speed);
+      if(result == CURLE_OK) {
+        printf("Upload speed %.0f bytes/sec\n", speed);
+      }
+    }
+  }
+}
+~~~
+
+# DEPRECATED
+
+Deprecated since 7.55.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_UPLOAD_T.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_UPLOAD_T.3
deleted file mode 100644
index 1a057ae20f..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_UPLOAD_T.3
+++ /dev/null
@@ -1,63 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_SPEED_UPLOAD_T 3 "25 May 2017" libcurl libcurl
-.SH NAME
-CURLINFO_SPEED_UPLOAD_T \- get upload speed
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SPEED_UPLOAD_T,
-                           curl_off_t *speed);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a \fIcurl_off_t\fP to receive the average upload speed that
-curl measured for the complete upload. Measured in bytes/second.
-.SH PROTOCOLS
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Perform the request */
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    curl_off_t speed;
-    res = curl_easy_getinfo(curl, CURLINFO_SPEED_UPLOAD_T, &speed);
-    if(!res) {
-      printf("Upload speed %" CURL_FORMAT_CURL_OFF_T " bytes/sec\\n", speed);
-    }
-  }
-}
-.fi
-.SH AVAILABILITY
-Added in 7.55.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_SPEED_DOWNLOAD_T "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_UPLOAD_T.md b/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_UPLOAD_T.md
new file mode 100644
index 0000000000..b5165f4665
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_SPEED_UPLOAD_T.md
@@ -0,0 +1,67 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_SPEED_UPLOAD_T
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_SPEED_DOWNLOAD_T (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.55.0
+---
+
+# NAME
+
+CURLINFO_SPEED_UPLOAD_T - upload speed
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SPEED_UPLOAD_T,
+                           curl_off_t *speed);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a *curl_off_t* to receive the average upload speed that
+curl measured for the complete upload. Measured in bytes/second.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      curl_off_t speed;
+      result = curl_easy_getinfo(curl, CURLINFO_SPEED_UPLOAD_T, &speed);
+      if(result == CURLE_OK) {
+        printf("Upload speed %" CURL_FORMAT_CURL_OFF_T " bytes/sec\n", speed);
+      }
+    }
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SSL_ENGINES.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_SSL_ENGINES.3
deleted file mode 100644
index aedc7a4a22..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_SSL_ENGINES.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_SSL_ENGINES 3 "1 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_SSL_ENGINES \- get an slist of OpenSSL crypto-engines
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SSL_ENGINES,
-                           struct curl_slist **engine_list);
-.fi
-.SH DESCRIPTION
-Pass the address of a 'struct curl_slist *' to receive a linked-list of
-OpenSSL crypto-engines supported. Note that engines are normally implemented
-in separate dynamic libraries. Hence not all the returned engines may be
-available at runtime. \fBNOTE:\fP you must call \fIcurl_slist_free_all(3)\fP
-on the list pointer once you are done with it, as libcurl does not free this
-data for you.
-.SH PROTOCOLS
-All TLS based ones.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  struct curl_slist *engines;
-  res = curl_easy_getinfo(curl, CURLINFO_SSL_ENGINES, &engines);
-  if((res == CURLE_OK) && engines) {
-    /* we have a list, free it when done using it */
-    curl_slist_free_all(engines);
-  }
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.12.3. Available in OpenSSL builds with "engine" support.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SSL_ENGINES.md b/third-party/curl/docs/libcurl/opts/CURLINFO_SSL_ENGINES.md
new file mode 100644
index 0000000000..da9582c01c
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_SSL_ENGINES.md
@@ -0,0 +1,69 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_SSL_ENGINES
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSLENGINE (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+Added-in: 7.12.3
+---
+
+# NAME
+
+CURLINFO_SSL_ENGINES - an slist of OpenSSL crypto-engines
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SSL_ENGINES,
+                           struct curl_slist **engine_list);
+~~~
+
+# DESCRIPTION
+
+Pass the address of a 'struct curl_slist *' to receive a linked-list of
+OpenSSL crypto-engines supported. Note that engines are normally implemented
+in separate dynamic libraries. Hence not all the returned engines may be
+available at runtime. **NOTE:** you must call curl_slist_free_all(3)
+on the list pointer once you are done with it, as libcurl does not free this
+data for you.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    struct curl_slist *engines;
+    result = curl_easy_getinfo(curl, CURLINFO_SSL_ENGINES, &engines);
+    if((result == CURLE_OK) && engines) {
+      /* we have a list, free it when done using it */
+      curl_slist_free_all(engines);
+    }
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SSL_VERIFYRESULT.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_SSL_VERIFYRESULT.3
deleted file mode 100644
index 40ff2fb28a..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_SSL_VERIFYRESULT.3
+++ /dev/null
@@ -1,62 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_SSL_VERIFYRESULT 3 "1 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_SSL_VERIFYRESULT \- get the result of the certificate verification
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SSL_VERIFYRESULT,
-                           long *result);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a long to receive the result of the server SSL certificate
-verification that was requested (using the \fICURLOPT_SSL_VERIFYPEER(3)\fP
-option).
-
-0 is a positive result. Non-zero is an error.
-.SH PROTOCOLS
-All using TLS
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  long verifyresult;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  res = curl_easy_perform(curl);
-  curl_easy_getinfo(curl, CURLINFO_SSL_VERIFYRESULT, &verifyresult);
-  printf("The peer verification said %s\\n", verifyresult?
-         "BAAAD":"fine");
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.5. Only set by the OpenSSL/libressl/boringssl and GnuTLS backends.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_SSL_VERIFYRESULT.md b/third-party/curl/docs/libcurl/opts/CURLINFO_SSL_VERIFYRESULT.md
new file mode 100644
index 0000000000..af1f911a09
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_SSL_VERIFYRESULT.md
@@ -0,0 +1,79 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_SSL_VERIFYRESULT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_PROXY_SSL_VERIFYRESULT (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+Added-in: 7.5
+---
+
+# NAME
+
+CURLINFO_SSL_VERIFYRESULT - result of the certificate verification
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_SSL_VERIFYRESULT,
+                           long *result);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long to receive the result of the server SSL certificate
+verification that was requested (using the CURLOPT_SSL_VERIFYPEER(3)
+option).
+
+0 is a positive result. Non-zero is an error.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    long verifyresult;
+
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    result = curl_easy_perform(curl);
+    if(result != CURLE_OK) {
+      printf("error: %s\n", curl_easy_strerror(result));
+      curl_easy_cleanup(curl);
+      return 1;
+    }
+
+    result = curl_easy_getinfo(curl, CURLINFO_SSL_VERIFYRESULT,
+                               &verifyresult);
+    if(result == CURLE_OK) {
+      printf("The peer verification said %s\n",
+             (verifyresult ? "bad" : "fine"));
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_STARTTRANSFER_TIME.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_STARTTRANSFER_TIME.3
deleted file mode 100644
index e58b4965fb..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_STARTTRANSFER_TIME.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_STARTTRANSFER_TIME 3 "28 Aug 2015" libcurl libcurl
-.SH NAME
-CURLINFO_STARTTRANSFER_TIME \- get the time until the first byte is received
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_STARTTRANSFER_TIME,
-                           double *timep);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a double to receive the time, in seconds, it took from the
-start until the first byte is received by libcurl. This includes
-\fICURLINFO_PRETRANSFER_TIME(3)\fP and also the time the server needs to
-calculate the result.
-
-When a redirect is followed, the time from each request is added together.
-
-See also the TIMES overview in the \fIcurl_easy_getinfo(3)\fP man page.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  double start;
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  res = curl_easy_perform(curl);
-  if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_STARTTRANSFER_TIME, &start);
-    if(CURLE_OK == res) {
-      printf("Time: %.1f", start);
-    }
-  }
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.9.2
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " CURLINFO_STARTTRANSFER_TIME_T "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_STARTTRANSFER_TIME.md b/third-party/curl/docs/libcurl/opts/CURLINFO_STARTTRANSFER_TIME.md
new file mode 100644
index 0000000000..2424037ea1
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_STARTTRANSFER_TIME.md
@@ -0,0 +1,73 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_STARTTRANSFER_TIME
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_STARTTRANSFER_TIME_T (3)
+  - CURLOPT_TIMEOUT (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.9.2
+---
+
+# NAME
+
+CURLINFO_STARTTRANSFER_TIME - time to first byte received
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_STARTTRANSFER_TIME,
+                           double *timep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a double to receive the time, in seconds, it took from the
+start until the first byte is received by libcurl. This includes
+CURLINFO_PRETRANSFER_TIME(3) and also the time the server needs to
+calculate the result.
+
+When a redirect is followed, the time from each request is added together.
+
+See also the TIMES overview in the curl_easy_getinfo(3) man page.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    double start;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      result = curl_easy_getinfo(curl, CURLINFO_STARTTRANSFER_TIME, &start);
+      if(result == CURLE_OK) {
+        printf("Time: %.1f", start);
+      }
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_STARTTRANSFER_TIME_T.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_STARTTRANSFER_TIME_T.3
deleted file mode 100644
index ce1537a4de..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_STARTTRANSFER_TIME_T.3
+++ /dev/null
@@ -1,70 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_STARTTRANSFER_TIME_T 3 "28 Apr 2018" libcurl libcurl
-.SH NAME
-CURLINFO_STARTTRANSFER_TIME_T \- get the time until the first byte is received
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_STARTTRANSFER_TIME_T,
-                           curl_off_t *timep);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a curl_off_t to receive the time, in microseconds,
-it took from the
-start until the first byte is received by libcurl. This includes
-\fICURLINFO_PRETRANSFER_TIME_T(3)\fP and also the time the server needs to
-calculate the result.
-
-When a redirect is followed, the time from each request is added together.
-
-See also the TIMES overview in the \fIcurl_easy_getinfo(3)\fP man page.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  curl_off_t start;
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  res = curl_easy_perform(curl);
-  if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_STARTTRANSFER_TIME_T, &start);
-    if(CURLE_OK == res) {
-      printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", start / 1000000,
-             (long)(start % 1000000));
-    }
-  }
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.61.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " CURLINFO_STARTTRANSFER_TIME "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_STARTTRANSFER_TIME_T.md b/third-party/curl/docs/libcurl/opts/CURLINFO_STARTTRANSFER_TIME_T.md
new file mode 100644
index 0000000000..6cbd0c3d34
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_STARTTRANSFER_TIME_T.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_STARTTRANSFER_TIME_T
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_STARTTRANSFER_TIME (3)
+  - CURLOPT_TIMEOUT (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.61.0
+---
+
+# NAME
+
+CURLINFO_STARTTRANSFER_TIME_T - time to first byte received
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_STARTTRANSFER_TIME_T,
+                           curl_off_t *timep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a curl_off_t to receive the time, in microseconds,
+it took from the
+start until the first byte is received by libcurl. This includes
+CURLINFO_PRETRANSFER_TIME_T(3) and also the time the server needs to
+calculate the result.
+
+When a redirect is followed, the time from each request is added together.
+
+See also the TIMES overview in the curl_easy_getinfo(3) man page.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_off_t start;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      result = curl_easy_getinfo(curl, CURLINFO_STARTTRANSFER_TIME_T, &start);
+      if(result == CURLE_OK) {
+        printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", start / 1000000,
+               (long)(start % 1000000));
+      }
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_TLS_SESSION.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_TLS_SESSION.3
deleted file mode 100644
index df179e09a5..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_TLS_SESSION.3
+++ /dev/null
@@ -1,72 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_TLS_SESSION 3 "12 Sep 2015" libcurl libcurl
-.SH NAME
-CURLINFO_TLS_SESSION \- get TLS session info
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_TLS_SESSION,
-                           struct curl_tlssessioninfo **session);
-.SH DESCRIPTION
-\fBThis option has been superseded\fP by \fICURLINFO_TLS_SSL_PTR(3)\fP which
-was added in 7.48.0. The only reason you would use this option instead is if
-you could be using a version of libcurl earlier than 7.48.0.
-
-This option is exactly the same as \fICURLINFO_TLS_SSL_PTR(3)\fP except in the
-case of OpenSSL. If the session \fIbackend\fP is CURLSSLBACKEND_OPENSSL the
-session \fIinternals\fP pointer varies depending on the option:
-
-\fICURLINFO_TLS_SESSION(3)\fP OpenSSL session \fIinternals\fP is \fBSSL_CTX *\fP.
-
-\fICURLINFO_TLS_SSL_PTR(3)\fP OpenSSL session \fIinternals\fP is \fBSSL *\fP.
-
-You can obtain an \fBSSL_CTX\fP pointer from an SSL pointer using OpenSSL
-function \fISSL_get_SSL_CTX(3)\fP. Therefore unless you need compatibility
-with older versions of libcurl use \fICURLINFO_TLS_SSL_PTR(3)\fP. Refer to
-that document for more information.
-.SH PROTOCOLS
-All TLS-based
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  struct curl_tlssessioninfo *tls;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  res = curl_easy_perform(curl);
-  curl_easy_getinfo(curl, CURLINFO_TLS_SESSION, &tls);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.34.0. Deprecated since 7.48.0 and supported OpenSSL, GnuTLS, and
-NSS only up until this version was released.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_TLS_SSL_PTR "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_TLS_SESSION.md b/third-party/curl/docs/libcurl/opts/CURLINFO_TLS_SESSION.md
new file mode 100644
index 0000000000..cbbd5c0298
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_TLS_SESSION.md
@@ -0,0 +1,94 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_TLS_SESSION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_TLS_SSL_PTR (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+Added-in: 7.34.0
+---
+
+# NAME
+
+CURLINFO_TLS_SESSION - TLS session info
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_TLS_SESSION,
+                           struct curl_tlssessioninfo **session);
+~~~
+
+# DESCRIPTION
+
+**This option has been superseded** by CURLINFO_TLS_SSL_PTR(3).
+
+This option is exactly the same as CURLINFO_TLS_SSL_PTR(3) except in the case
+of OpenSSL and wolfSSL. If the session *backend* is CURLSSLBACKEND_OPENSSL the
+session *internals* pointer varies depending on the option:
+
+## OpenSSL
+
+CURLINFO_TLS_SESSION(3) OpenSSL session *internals* is **SSL_CTX ***.
+
+CURLINFO_TLS_SSL_PTR(3) OpenSSL session *internals* is **SSL ***.
+
+You can obtain an **SSL_CTX** pointer from an SSL pointer using OpenSSL
+function *SSL_get_SSL_CTX(3)*. Therefore unless you need compatibility
+with older versions of libcurl use CURLINFO_TLS_SSL_PTR(3). Refer to
+that document for more information.
+
+## wolfSSL
+
+CURLINFO_TLS_SESSION(3) wolfSSL session *internals* is **WOLFSSL_CTX ***.
+
+CURLINFO_TLS_SSL_PTR(3) wolfSSL session *internals* is **WOLFSSL ***.
+
+You can obtain an **WOLFSSL_CTX** pointer from an SSL pointer using wolfSSL
+function *wolfSSL_get_SSL_CTX(3)*. Therefore unless you need compatibility
+with older versions of libcurl use CURLINFO_TLS_SSL_PTR(3). Refer to
+that document for more information.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    struct curl_tlssessioninfo *tls;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result != CURLE_OK)
+      printf("error: %s\n", curl_easy_strerror(result));
+    curl_easy_getinfo(curl, CURLINFO_TLS_SESSION, &tls);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# DEPRECATED
+
+Deprecated since 7.48.0
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_TLS_SSL_PTR.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_TLS_SSL_PTR.3
deleted file mode 100644
index 21e481302e..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_TLS_SSL_PTR.3
+++ /dev/null
@@ -1,163 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_TLS_SSL_PTR 3 "23 Feb 2016" libcurl libcurl
-.SH NAME
-CURLINFO_TLS_SESSION, CURLINFO_TLS_SSL_PTR \- get TLS session info
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_TLS_SSL_PTR,
-                           struct curl_tlssessioninfo **session);
-
-/* if you need compatibility with libcurl < 7.48.0 use
-   CURLINFO_TLS_SESSION instead: */
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_TLS_SESSION,
-                           struct curl_tlssessioninfo **session);
-.SH DESCRIPTION
-Pass a pointer to a \fIstruct curl_tlssessioninfo *\fP.  The pointer is
-initialized to refer to a \fIstruct curl_tlssessioninfo *\fP that contains an
-enum indicating the SSL library used for the handshake and a pointer to the
-respective internal TLS session structure of this underlying SSL library.
-
-This option may be useful for example to extract certificate information in a
-format convenient for further processing, such as manual validation. Refer to
-the \fBLIMITATIONS\fP section.
-
-.nf
-struct curl_tlssessioninfo {
-  curl_sslbackend backend;
-  void *internals;
-};
-.fi
-
-The \fIbackend\fP struct member is one of the defines in the CURLSSLBACKEND_*
-series: CURLSSLBACKEND_NONE (when built without TLS support),
-CURLSSLBACKEND_WOLFSSL, CURLSSLBACKEND_SECURETRANSPORT, CURLSSLBACKEND_GNUTLS,
-CURLSSLBACKEND_MBEDTLS, CURLSSLBACKEND_NSS, CURLSSLBACKEND_OPENSSL,
-CURLSSLBACKEND_SCHANNEL or CURLSSLBACKEND_MESALINK. (Note that the OpenSSL
-forks are all reported as just OpenSSL here.)
-
-The \fIinternals\fP struct member points to a TLS library specific pointer for
-the active ("in use") SSL connection, with the following underlying types:
-.RS
-.IP GnuTLS
-\fBgnutls_session_t\fP
-.IP NSS
-\fBPRFileDesc *\fP
-.IP OpenSSL
-\fICURLINFO_TLS_SESSION(3)\fP: \fBSSL_CTX *\fP
-
-\fICURLINFO_TLS_SSL_PTR(3)\fP: \fBSSL *\fP
-.RE
-Since 7.48.0 the \fIinternals\fP member can point to these other SSL backends
-as well:
-.RS
-.IP mbedTLS
-\fBmbedTLS_ssl_context *\fP
-.IP "Secure Channel"
-\fBCtxtHandle *\fP
-.IP "Secure Transport"
-\fBSSLContext *\fP
-.IP "wolfSSL"
-\fBSSL *\fP
-.RE
-
-If the \fIinternals\fP pointer is NULL then either the SSL backend is not
-supported, an SSL session has not yet been established or the connection is no
-longer associated with the easy handle (e.g. curl_easy_perform has returned).
-.SH LIMITATIONS
-This option has some limitations that could make it unsafe when it comes to
-the manual verification of certificates.
-
-This option only retrieves the first in-use SSL session pointer for your easy
-handle, however your easy handle may have more than one in-use SSL session if
-using FTP over SSL. That is because the FTP protocol has a control channel and
-a data channel and one or both may be over SSL. Currently there is no way to
-retrieve a second in-use SSL session associated with an easy handle.
-
-This option has not been thoroughly tested with clear text protocols that can
-be upgraded/downgraded to/from SSL: FTP, SMTP, POP3, IMAP when used with
-\fICURLOPT_USE_SSL(3)\fP. Though you can to retrieve the SSL pointer, it's
-possible that before you can do that, data (including auth) may have already
-been sent over a connection after it was upgraded.
-
-Renegotiation. If unsafe renegotiation or renegotiation in a way that the
-certificate is allowed to change is allowed by your SSL library this may occur
-and the certificate may change, and data may continue to be sent or received
-after renegotiation but before you are able to get the (possibly) changed SSL
-pointer, with the (possibly) changed certificate information.
-
-Instead of using this option to poll for certificate changes use
-\fICURLOPT_SSL_CTX_FUNCTION(3)\fP to set a verification callback, if supported.
-That is safer and does not suffer from any of the problems above.
-
-How are you using this option? Are you affected by any of these limitations?
-Please let us know by making a comment at
-https://github.com/curl/curl/issues/685
-.SH PROTOCOLS
-All TLS-based
-.SH EXAMPLE
-.nf
-#include <curl/curl.h>
-#include <openssl/ssl.h>
-
-CURL *curl;
-static size_t wf(void *ptr, size_t size, size_t nmemb, void *stream)
-{
-  const struct curl_tlssessioninfo *info = NULL;
-  CURLcode res = curl_easy_getinfo(curl, CURLINFO_TLS_SSL_PTR, &info);
-  if(info && !res) {
-    if(CURLSSLBACKEND_OPENSSL == info->backend) {
-       printf("OpenSSL ver. %s\\n", SSL_get_version((SSL*)info->internals));
-    }
-  }
-  return size * nmemb;
-}
-
-int main(int argc, char** argv)
-{
-  CURLcode res;
-  curl = curl_easy_init();
-  if(curl) {
-    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, wf);
-    res = curl_easy_perform(curl);
-    curl_easy_cleanup(curl);
-  }
-  return res;
-}
-.fi
-.SH AVAILABILITY
-Added in 7.48.0.
-
-This option supersedes \fICURLINFO_TLS_SESSION(3)\fP which was added in 7.34.0.
-This option is exactly the same as that option except in the case of OpenSSL.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_TLS_SESSION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_TLS_SSL_PTR.md b/third-party/curl/docs/libcurl/opts/CURLINFO_TLS_SSL_PTR.md
new file mode 100644
index 0000000000..c79b5e7ebd
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_TLS_SSL_PTR.md
@@ -0,0 +1,171 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_TLS_SSL_PTR
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_TLS_SESSION (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - GnuTLS
+  - mbedTLS
+  - OpenSSL
+  - Schannel
+  - wolfSSL
+Added-in: 7.48.0
+---
+
+# NAME
+
+CURLINFO_TLS_SSL_PTR - TLS session info
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_TLS_SSL_PTR,
+                           struct curl_tlssessioninfo **session);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a *struct curl_tlssessioninfo **. The pointer is initialized
+to refer to a *struct curl_tlssessioninfo ** that contains an enum indicating
+the SSL library used for the handshake and a pointer to the respective
+internal TLS session structure of this underlying SSL library.
+
+This option may be useful for example to extract certificate information in a
+format convenient for further processing, such as manual validation. Refer to
+the **LIMITATIONS** section.
+
+~~~c
+struct curl_tlssessioninfo {
+  curl_sslbackend backend;
+  void *internals;
+};
+~~~
+
+The *backend* struct member is one of these defines: CURLSSLBACKEND_NONE (when
+built without TLS support), CURLSSLBACKEND_WOLFSSL,
+CURLSSLBACKEND_SECURETRANSPORT, CURLSSLBACKEND_GNUTLS, CURLSSLBACKEND_MBEDTLS,
+CURLSSLBACKEND_NSS, CURLSSLBACKEND_OPENSSL or CURLSSLBACKEND_SCHANNEL. (Note
+that the OpenSSL forks are all reported as OpenSSL here.)
+
+The *internals* struct member points to a TLS library specific pointer for
+the active ("in use") SSL connection, with the following underlying types:
+
+## GnuTLS
+
+**gnutls_session_t**
+
+## OpenSSL
+
+CURLINFO_TLS_SESSION(3): **SSL_CTX ***
+
+CURLINFO_TLS_SSL_PTR(3): **SSL ***
+
+## mbedTLS
+
+**mbedTLS_ssl_context ***
+
+## Secure Channel
+
+**CtxtHandle ***
+
+## wolfSSL
+
+**SSL ***
+
+##
+
+If the *internals* pointer is NULL then either the SSL backend is not
+supported, an SSL session has not yet been established or the connection is no
+longer associated with the easy handle (e.g. curl_easy_perform(3) has
+returned).
+
+# LIMITATIONS
+
+This option has some limitations that could make it unsafe when it comes to
+the manual verification of certificates.
+
+This option only retrieves the first in-use SSL session pointer for your easy
+handle, however your easy handle may have more than one in-use SSL session if
+using FTP over SSL. That is because the FTP protocol has a control channel and
+a data channel and one or both may be over SSL. Currently there is no way to
+retrieve a second in-use SSL session associated with an easy handle.
+
+This option has not been thoroughly tested with clear text protocols that can
+be upgraded/downgraded to/from SSL: FTP, SMTP, POP3, IMAP when used with
+CURLOPT_USE_SSL(3). Though you can to retrieve the SSL pointer, it is possible
+that before you can do that, data (including auth) may have already been sent
+over a connection after it was upgraded.
+
+Renegotiation. If unsafe renegotiation or renegotiation in a way that the
+certificate is allowed to change is allowed by your SSL library this may occur
+and the certificate may change, and data may continue to be sent or received
+after renegotiation but before you are able to get the (possibly) changed SSL
+pointer, with the (possibly) changed certificate information.
+
+Instead of using this option to poll for certificate changes use
+CURLOPT_SSL_CTX_FUNCTION(3) to set a verification callback, if supported.
+That is safer and does not suffer from any of the problems above.
+
+How are you using this option? Are you affected by any of these limitations?
+Please let us know by making a comment at
+https://github.com/curl/curl/issues/685
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <curl/curl.h>
+#include <openssl/ssl.h>
+
+CURL *curl;
+static size_t wf(char *ptr, size_t size, size_t nmemb, void *stream)
+{
+  const struct curl_tlssessioninfo *info = NULL;
+  CURLcode result = curl_easy_getinfo(curl, CURLINFO_TLS_SSL_PTR, &info);
+  if(info && !result) {
+    if(CURLSSLBACKEND_OPENSSL == info->backend) {
+      printf("OpenSSL ver. %s\n", SSL_get_version((SSL*)info->internals));
+    }
+  }
+  return size * nmemb;
+}
+
+int main(int argc, char **argv)
+{
+  CURLcode result;
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, wf);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+  return result;
+}
+~~~
+
+# HISTORY
+
+This option supersedes CURLINFO_TLS_SESSION(3) which was added in 7.34.0.
+This option is exactly the same as that option except in the case of OpenSSL.
+
+Non-OpenSSL support was added in 7.48.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_TOTAL_TIME.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_TOTAL_TIME.3
deleted file mode 100644
index a652d45b49..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_TOTAL_TIME.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_TOTAL_TIME 3 "28 Aug 2015" libcurl libcurl
-.SH NAME
-CURLINFO_TOTAL_TIME \- get total time of previous transfer
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_TOTAL_TIME, double *timep);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a double to receive the total time in seconds for the
-previous transfer, including name resolving, TCP connect etc. The double
-represents the time in seconds, including fractions.
-
-When a redirect is followed, the time from each request is added together.
-
-See also the TIMES overview in the \fIcurl_easy_getinfo(3)\fP man page.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  double total;
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  res = curl_easy_perform(curl);
-  if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME, &total);
-    if(CURLE_OK == res) {
-      printf("Time: %.1f", total);
-    }
-  }
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.4.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " CURLINFO_TOTAL_TIME_T "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_TOTAL_TIME.md b/third-party/curl/docs/libcurl/opts/CURLINFO_TOTAL_TIME.md
new file mode 100644
index 0000000000..ab21ec2f09
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_TOTAL_TIME.md
@@ -0,0 +1,71 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_TOTAL_TIME
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_TOTAL_TIME_T (3)
+  - CURLOPT_TIMEOUT (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.4.1
+---
+
+# NAME
+
+CURLINFO_TOTAL_TIME - total time of previous transfer
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_TOTAL_TIME, double *timep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a double to receive the total time in seconds for the
+previous transfer, including name resolving, TCP connect etc. The double
+represents the time in seconds, including fractions.
+
+When a redirect is followed, the time from each request is added together.
+
+See also the TIMES overview in the curl_easy_getinfo(3) man page.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    double total;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      result = curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME, &total);
+      if(result == CURLE_OK) {
+        printf("Time: %.1f", total);
+      }
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_TOTAL_TIME_T.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_TOTAL_TIME_T.3
deleted file mode 100644
index 29dbb0945d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_TOTAL_TIME_T.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_TOTAL_TIME_T 3 "28 Apr 2018" libcurl libcurl
-.SH NAME
-CURLINFO_TOTAL_TIME_T \- get total time of previous transfer in microseconds
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_TOTAL_TIME_T,
-                           curl_off_t *timep);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a curl_off_t to receive the total time in microseconds
-for the previous transfer, including name resolving, TCP connect etc.
-The curl_off_t represents the time in microseconds.
-
-When a redirect is followed, the time from each request is added together.
-
-See also the TIMES overview in the \fIcurl_easy_getinfo(3)\fP man page.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  curl_off_t total;
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  res = curl_easy_perform(curl);
-  if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME_T, &total);
-    if(CURLE_OK == res) {
-      printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", total / 1000000,
-             (long)(total % 1000000));
-    }
-  }
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.61.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " CURLINFO_TOTAL_TIME "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_TOTAL_TIME_T.md b/third-party/curl/docs/libcurl/opts/CURLINFO_TOTAL_TIME_T.md
new file mode 100644
index 0000000000..0487acf239
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_TOTAL_TIME_T.md
@@ -0,0 +1,72 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_TOTAL_TIME_T
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_TOTAL_TIME (3)
+  - CURLOPT_TIMEOUT (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 7.61.0
+---
+# NAME
+
+CURLINFO_TOTAL_TIME_T - total time of previous transfer
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_TOTAL_TIME_T,
+                           curl_off_t *timep);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a curl_off_t to receive the total time in microseconds
+for the previous transfer, including name resolving, TCP connect etc.
+The curl_off_t represents the time in microseconds.
+
+When a redirect is followed, the time from each request is added together.
+
+See also the TIMES overview in the curl_easy_getinfo(3) man page.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_off_t total;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      result = curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME_T, &total);
+      if(result == CURLE_OK) {
+        printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", total / 1000000,
+               (long)(total % 1000000));
+      }
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_USED_PROXY.md b/third-party/curl/docs/libcurl/opts/CURLINFO_USED_PROXY.md
new file mode 100644
index 0000000000..34abe2d608
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_USED_PROXY.md
@@ -0,0 +1,71 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_USED_PROXY
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_NOPROXY (3)
+  - CURLOPT_PROXY (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 8.7.0
+---
+
+# NAME
+
+CURLINFO_USED_PROXY - whether the transfer used a proxy
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_USED_PROXY,
+                           long *authp);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a long. It gets set to zero set if no proxy was used in the
+previous transfer or a non-zero value if a proxy was used.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(int argc, char *argv[])
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, argv[1]);
+    curl_easy_setopt(curl, CURLOPT_PROXY, "http://127.0.0.1:80");
+    curl_easy_setopt(curl, CURLOPT_NOPROXY, "example.com");
+
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      /* extract the available proxy authentication types */
+      long used;
+      result = curl_easy_getinfo(curl, CURLINFO_USED_PROXY, &used);
+      if(result == CURLE_OK) {
+        printf("The proxy was %sused\n", used ? "" : "NOT ");
+      }
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_XFER_ID.3 b/third-party/curl/docs/libcurl/opts/CURLINFO_XFER_ID.3
deleted file mode 100644
index 8040d49187..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLINFO_XFER_ID.3
+++ /dev/null
@@ -1,70 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLINFO_XFER_ID 3 "07 June 2023" "libcurl" "libcurl"
-.SH NAME
-CURLINFO_XFER_ID \- get the ID of a transfer
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_XFER_ID,
-                           curl_off_t *xfer_id);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a \fIcurl_off_t\fP to receive the identifier of the
-current/last transfer done with the handle. Stores -1 if no transfer
-has been started yet for the handle.
-
-The transfer id is unique among all transfers performed using the same
-connection cache. This is implicitly the case for all transfers in the
-same multi handle.
-
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Perform the request */
-  res = curl_easy_perform(curl);
-
-  if(!res) {
-    curl_off_t xfer_id;
-    res = curl_easy_getinfo(curl, CURLINFO_XFER_ID, &xfer_id);
-    if(!res) {
-      printf("Transfer ID: %" CURL_FORMAT_CURL_OFF_T "\\n", xfer_id);
-    }
-  }
-}
-.fi
-.SH AVAILABILITY
-Added in 8.2.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
-.BR CURLINFO_CONN_ID "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLINFO_XFER_ID.md b/third-party/curl/docs/libcurl/opts/CURLINFO_XFER_ID.md
new file mode 100644
index 0000000000..34557b7f29
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLINFO_XFER_ID.md
@@ -0,0 +1,72 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_XFER_ID
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CONN_ID (3)
+  - curl_easy_getinfo (3)
+  - curl_easy_setopt (3)
+Protocol:
+  - All
+Added-in: 8.2.0
+---
+
+# NAME
+
+CURLINFO_XFER_ID - ID of the transfer
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_XFER_ID,
+                           curl_off_t *xfer_id);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a *curl_off_t* to receive the identifier of the
+current/last transfer done with the handle. Stores -1 if no transfer
+has been started yet for the handle.
+
+The transfer id is unique among all transfers performed using the same
+connection cache. This is implicitly the case for all transfers in the
+same multi handle.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      curl_off_t xfer_id;
+      result = curl_easy_getinfo(curl, CURLINFO_XFER_ID, &xfer_id);
+      if(result == CURLE_OK) {
+        printf("Transfer ID: %" CURL_FORMAT_CURL_OFF_T "\n", xfer_id);
+      }
+    }
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_ADDED.md b/third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_ADDED.md
new file mode 100644
index 0000000000..c3869f649f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_ADDED.md
@@ -0,0 +1,63 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMINFO_XFERS_ADDED
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMINFO_XFERS_CURRENT (3)
+  - CURLMINFO_XFERS_RUNNING (3)
+  - CURLMINFO_XFERS_DONE (3)
+Protocol:
+  - All
+Added-in: 8.16.0
+---
+
+# NAME
+
+CURLMINFO_XFERS_ADDED - Cumulative number of all easy handles added
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_get_offt(CURLM *handle, CURLMINFO_XFERS_ADDED,
+                              curl_off_t *pvalue);
+~~~
+
+# DESCRIPTION
+
+The cumulative number of all easy handles added to the multi, ever. This
+includes internal handles added for tasks (like resolving via DoH, for
+example).
+
+For the current number of easy handles managed by the multi, use
+CURLMINFO_XFERS_CURRENT(3).
+
+# DEFAULT
+
+n/a
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *m = curl_multi_init();
+  curl_off_t value;
+
+  curl_multi_get_offt(m, CURLMINFO_XFERS_ADDED, &value);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_get_offt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_CURRENT.md b/third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_CURRENT.md
new file mode 100644
index 0000000000..2b29117e8a
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_CURRENT.md
@@ -0,0 +1,62 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMINFO_XFERS_CURRENT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMINFO_XFERS_RUNNING (3)
+  - CURLMINFO_XFERS_PENDING (3)
+Protocol:
+  - All
+Added-in: 8.16.0
+---
+
+# NAME
+
+CURLMINFO_XFERS_CURRENT - Number of easy handles currently added
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_get_offt(CURLM *handle, CURLMINFO_XFERS_CURRENT,
+                              curl_off_t *pvalue);
+~~~
+
+# DESCRIPTION
+
+Returns the number of easy handles currently added to the multi handle. This
+does not include already removed handles. It does include internal handles
+that get added for tasks (like resolving via DoH, for example).
+
+For the total number of easy handles ever added to the multi, see
+CURLMINFO_XFERS_ADDED(3).
+
+# DEFAULT
+
+n/a
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *m = curl_multi_init();
+  curl_off_t value;
+
+  curl_multi_get_offt(m, CURLMINFO_XFERS_CURRENT, &value);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_get_offt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_DONE.md b/third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_DONE.md
new file mode 100644
index 0000000000..6097d5f301
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_DONE.md
@@ -0,0 +1,58 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMINFO_XFERS_DONE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMINFO_XFERS_CURRENT (3)
+  - CURLMINFO_XFERS_RUNNING (3)
+Protocol:
+  - All
+Added-in: 8.16.0
+---
+
+# NAME
+
+CURLMINFO_XFERS_DONE - Number of finished unprocessed easy handles
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_get_offt(CURLM *handle, CURLMINFO_XFERS_DONE,
+                              curl_off_t *pvalue);
+~~~
+
+# DESCRIPTION
+
+The number of easy handles currently finished, but not yet processed via
+curl_multi_info_read(3).
+
+# DEFAULT
+
+n/a
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *m = curl_multi_init();
+  curl_off_t value;
+
+  curl_multi_get_offt(m, CURLMINFO_XFERS_DONE, &value);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_get_offt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_PENDING.md b/third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_PENDING.md
new file mode 100644
index 0000000000..acdc1f1c7f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_PENDING.md
@@ -0,0 +1,60 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMINFO_XFERS_PENDING
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMINFO_XFERS_CURRENT (3)
+  - CURLMINFO_XFERS_RUNNING (3)
+Protocol:
+  - All
+Added-in: 8.16.0
+---
+
+# NAME
+
+CURLMINFO_XFERS_PENDING - Number of easy handles waiting to start
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_get_offt(CURLM *handle, CURLMINFO_XFERS_PENDING,
+                              curl_off_t *pvalue);
+~~~
+
+# DESCRIPTION
+
+The number of current easy handles waiting to start. An added transfer might
+become pending for various reasons: a connection limit forces it to wait,
+resolving DNS is not finished or it is not clear if an existing, matching
+connection may allow multiplexing (HTTP/2 or HTTP/3).
+
+# DEFAULT
+
+n/a
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *m = curl_multi_init();
+  curl_off_t value;
+
+  curl_multi_get_offt(m, CURLMINFO_XFERS_PENDING, &value);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_get_offt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_RUNNING.md b/third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_RUNNING.md
new file mode 100644
index 0000000000..eeedb7518a
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMINFO_XFERS_RUNNING.md
@@ -0,0 +1,58 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMINFO_XFERS_RUNNING
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMINFO_XFERS_CURRENT (3)
+  - CURLMINFO_XFERS_PENDING (3)
+Protocol:
+  - All
+Added-in: 8.16.0
+---
+
+# NAME
+
+CURLMINFO_XFERS_RUNNING - Number of easy handles currently running
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_get_offt(CURLM *handle, CURLMINFO_XFERS_RUNNING,
+                              curl_off_t *pvalue);
+~~~
+
+# DESCRIPTION
+
+The number of easy handles currently running, e.g. where the transfer has
+started but not finished yet.
+
+# DEFAULT
+
+n/a
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *m = curl_multi_init();
+  curl_off_t value;
+
+  curl_multi_get_offt(m, CURLMINFO_XFERS_RUNNING, &value);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_get_offt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE.3 b/third-party/curl/docs/libcurl/opts/CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE.3
deleted file mode 100644
index 341b8cd48e..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE.3
+++ /dev/null
@@ -1,59 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE 3 "4 Nov 2014" libcurl libcurl
-.SH NAME
-CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE \- chunk length threshold for pipelining
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE,
-                            long size);
-.fi
-.SH DESCRIPTION
-No function since pipelining was removed in 7.62.0.
-
-Pass a long with a \fBsize\fP in bytes. If a transfer in a pipeline is
-currently processing a chunked (Transfer-encoding: chunked) request with a
-current chunk length larger than \fICURLMOPT_CHUNK_LENGTH_PENALTY_SIZE(3)\fP,
-that pipeline is not considered for additional requests, even if it is shorter
-than \fICURLMOPT_MAX_PIPELINE_LENGTH(3)\fP.
-.SH DEFAULT
-The default value is 0, which means that the penalization is inactive.
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURLM *m = curl_multi_init();
-long maxchunk = 10000;
-curl_multi_setopt(m, CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE, maxchunk);
-.fi
-.SH AVAILABILITY
-Added in 7.30.0
-.SH RETURN VALUE
-Returns CURLM_OK if the option is supported, and CURLM_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLMOPT_PIPELINING "(3), " CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE "(3), "
-.BR CURLMOPT_MAX_PIPELINE_LENGTH "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE.md
new file mode 100644
index 0000000000..0a2e258b4f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE.md
@@ -0,0 +1,63 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE (3)
+  - CURLMOPT_MAX_PIPELINE_LENGTH (3)
+  - CURLMOPT_PIPELINING (3)
+Protocol:
+  - HTTP
+Added-in: 7.30.0
+---
+
+# NAME
+
+CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE - chunk length threshold for pipelining
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE,
+                            long size);
+~~~
+
+# DESCRIPTION
+
+No function since pipelining was removed in 7.62.0.
+
+Pass a long with a **size** in bytes. If a transfer in a pipeline is
+currently processing a chunked (Transfer-encoding: chunked) request with a
+current chunk length larger than CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE(3),
+that pipeline is not considered for additional requests, even if it is shorter
+than CURLMOPT_MAX_PIPELINE_LENGTH(3).
+
+# DEFAULT
+
+0, which means that penalization is inactive.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *m = curl_multi_init();
+  long maxchunk = 10000;
+  curl_multi_setopt(m, CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE, maxchunk);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_setopt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE.3 b/third-party/curl/docs/libcurl/opts/CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE.3
deleted file mode 100644
index 194ae9aa37..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE.3
+++ /dev/null
@@ -1,58 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE 3 "4 Nov 2014" libcurl libcurl
-.SH NAME
-CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE \- size threshold for pipelining penalty
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE,
-                            long size);
-.fi
-.SH DESCRIPTION
-No function since pipelining was removed in 7.62.0.
-
-Pass a long with a \fBsize\fP in bytes. If a transfer in a pipeline is
-currently processing a request with a Content-Length larger than this
-\fICURLMOPT_CONTENT_LENGTH_PENALTY_SIZE(3)\fP, that pipeline is not considered
-for additional requests, even if it is shorter than
-\fICURLMOPT_MAX_PIPELINE_LENGTH(3)\fP.
-.SH DEFAULT
-The default value is 0, which means that the size penalization is inactive.
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURLM *m = curl_multi_init();
-long maxlength = 10000;
-curl_multi_setopt(m, CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE, maxlength);
-.fi
-.SH AVAILABILITY
-Added in 7.30.0
-.SH RETURN VALUE
-Returns CURLM_OK if the option is supported, and CURLM_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLMOPT_PIPELINING "(3), " CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE.md
new file mode 100644
index 0000000000..8f5f47f786
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE.md
@@ -0,0 +1,62 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE (3)
+  - CURLMOPT_PIPELINING (3)
+Protocol:
+  - HTTP
+Added-in: 7.30.0
+---
+
+# NAME
+
+CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE - size threshold for pipelining penalty
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE,
+                            long size);
+~~~
+
+# DESCRIPTION
+
+No function since pipelining was removed in 7.62.0.
+
+Pass a long with a **size** in bytes. If a transfer in a pipeline is
+currently processing a request with a Content-Length larger than this
+CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE(3), that pipeline is not considered
+for additional requests, even if it is shorter than
+CURLMOPT_MAX_PIPELINE_LENGTH(3).
+
+# DEFAULT
+
+0, which means that the size penalization is inactive.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *m = curl_multi_init();
+  long maxlength = 10000;
+  curl_multi_setopt(m, CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE, maxlength);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_setopt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_MAXCONNECTS.3 b/third-party/curl/docs/libcurl/opts/CURLMOPT_MAXCONNECTS.3
deleted file mode 100644
index dad2b4c779..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLMOPT_MAXCONNECTS.3
+++ /dev/null
@@ -1,69 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLMOPT_MAXCONNECTS 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLMOPT_MAXCONNECTS \- size of connection cache
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_MAXCONNECTS, long max);
-.fi
-.SH DESCRIPTION
-Pass a long indicating the \fBmax\fP. The set number is used as the maximum
-amount of simultaneously open connections that libcurl may keep in its
-connection cache after completed use. By default libcurl enlarges the size for
-each added easy handle to make it fit 4 times the number of added easy
-handles.
-
-By setting this option, you can prevent the cache size from growing beyond the
-limit set by you.
-
-When the cache is full, curl closes the oldest one in the cache to prevent the
-number of open connections from increasing.
-
-This option is for the multi handle's use only, when using the easy interface
-you should instead use the \fICURLOPT_MAXCONNECTS(3)\fP option.
-
-See \fICURLMOPT_MAX_TOTAL_CONNECTIONS(3)\fP for limiting the number of active
-connections.
-
-.SH DEFAULT
-See DESCRIPTION
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURLM *m = curl_multi_init();
-/* only keep 10 connections in the cache */
-curl_multi_setopt(m, CURLMOPT_MAXCONNECTS, 10L);
-.fi
-.SH AVAILABILITY
-Added in 7.16.3
-.SH RETURN VALUE
-Returns CURLM_OK if the option is supported, and CURLM_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLMOPT_MAX_HOST_CONNECTIONS "(3), "
-.BR CURLOPT_MAXCONNECTS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_MAXCONNECTS.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_MAXCONNECTS.md
new file mode 100644
index 0000000000..b02029b59f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_MAXCONNECTS.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_MAXCONNECTS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_MAX_HOST_CONNECTIONS (3)
+  - CURLOPT_MAXCONNECTS (3)
+Protocol:
+  - All
+Added-in: 7.16.3
+---
+
+# NAME
+
+CURLMOPT_MAXCONNECTS - size of connection cache
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_MAXCONNECTS, long max);
+~~~
+
+# DESCRIPTION
+
+Pass a long indicating the **max**, the maximum amount of connections that
+libcurl may keep alive in its connection cache after use. By default libcurl
+enlarges the size for each added easy handle to make it fit 4 times the number
+of added easy handles.
+
+By setting this option, you prevent the cache size from growing beyond the
+limit set by you.
+
+When the cache is full, curl closes the oldest connection present in the cache
+to prevent the number of connections from increasing.
+
+This option is for the multi handle's use only, when using the easy interface
+you should instead use the CURLOPT_MAXCONNECTS(3) option.
+
+See CURLMOPT_MAX_TOTAL_CONNECTIONS(3) for limiting the number of active
+connections.
+
+Changing this value when there are transfers in progress is possible, and the
+new value is then used the next time checks are performed. Lowering the value
+does not close down any active transfers, it prevents new ones from being
+made.
+
+# DEFAULT
+
+See DESCRIPTION
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *m = curl_multi_init();
+  /* only keep 10 connections in the cache */
+  curl_multi_setopt(m, CURLMOPT_MAXCONNECTS, 10L);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_setopt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_CONCURRENT_STREAMS.3 b/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_CONCURRENT_STREAMS.3
deleted file mode 100644
index e149c21b17..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_CONCURRENT_STREAMS.3
+++ /dev/null
@@ -1,57 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLMOPT_MAX_CONCURRENT_STREAMS 3 "06 Nov 2019" libcurl libcurl
-.SH NAME
-CURLMOPT_MAX_CONCURRENT_STREAMS \- max concurrent streams for http2
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_MAX_CONCURRENT_STREAMS,
-                            long max);
-.fi
-.SH DESCRIPTION
-Pass a long indicating the \fBmax\fP. The set number is used as the maximum
-number of concurrent streams for a connections that libcurl should support on
-connections done using HTTP/2.
-
-Valid values range from 1 to 2147483647 (2^31 - 1) and defaults to 100.  The
-value passed here would be honored based on other system resources properties.
-.SH DEFAULT
-100
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-  CURLM *m = curl_multi_init();
-  /* max concurrent streams 200 */
-  curl_multi_setopt(m, CURLMOPT_MAX_CONCURRENT_STREAMS, 200L);
-.fi
-.SH AVAILABILITY
-Added in 7.67.0
-.SH RETURN VALUE
-Returns CURLM_OK if the option is supported, and CURLM_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_MAXCONNECTS "(3), " CURLMOPT_MAXCONNECTS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_CONCURRENT_STREAMS.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_CONCURRENT_STREAMS.md
new file mode 100644
index 0000000000..5a810a731b
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_CONCURRENT_STREAMS.md
@@ -0,0 +1,61 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_MAX_CONCURRENT_STREAMS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_MAXCONNECTS (3)
+  - CURLOPT_MAXCONNECTS (3)
+Protocol:
+  - HTTP
+Added-in: 7.67.0
+---
+
+# NAME
+
+CURLMOPT_MAX_CONCURRENT_STREAMS - max concurrent streams for http2
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_MAX_CONCURRENT_STREAMS,
+                            long max);
+~~~
+
+# DESCRIPTION
+
+Pass a long indicating the **max**. The set number is used as the maximum
+number of concurrent streams libcurl should support on connections done using
+HTTP/2 or HTTP/3.
+
+Valid values range from 1 to 2147483647 (2^31 - 1) and defaults to 100. The
+value passed here would be honored based on other system resources properties.
+
+# DEFAULT
+
+100
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *m = curl_multi_init();
+  /* max concurrent streams 200 */
+  curl_multi_setopt(m, CURLMOPT_MAX_CONCURRENT_STREAMS, 200L);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_setopt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_HOST_CONNECTIONS.3 b/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_HOST_CONNECTIONS.3
deleted file mode 100644
index 16b30cd95e..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_HOST_CONNECTIONS.3
+++ /dev/null
@@ -1,70 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLMOPT_MAX_HOST_CONNECTIONS 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLMOPT_MAX_HOST_CONNECTIONS \- max number of connections to a single host
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_MAX_HOST_CONNECTIONS,
-                            long max);
-.fi
-.SH DESCRIPTION
-Pass a long to indicate \fBmax\fP. The set number is used as the maximum
-amount of simultaneously open connections to a single host (a host being the
-same as a host name + port number pair). For each new session to a host,
-libcurl might open a new connection up to the limit set by
-\fICURLMOPT_MAX_HOST_CONNECTIONS(3)\fP. When the limit is reached, new
-sessions are kept pending until a connection becomes available.
-
-The default \fBmax\fP value is 0, unlimited. This set limit is also used for
-proxy connections, and then the proxy is considered to be the host for which
-this limit counts.
-
-When more transfers are added to the multi handle than what can be performed
-due to the set limit, they are queued up waiting for their chance. When that
-happens, the \fICURLOPT_TIMEOUT_MS(3)\fP timeout is inclusive of the waiting
-time, meaning that if you set a too narrow timeout in such a case the transfer
-might never even start before it times out.
-
-Even in the queued up situation, the \fICURLOPT_CONNECTTIMEOUT_MS(3)\fP
-timeout is however treated as a per-connect timeout.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURLM *m = curl_multi_init();
-/* do no more than 2 connections per host */
-curl_multi_setopt(m, CURLMOPT_MAX_HOST_CONNECTIONS, 2L);
-.fi
-.SH AVAILABILITY
-Added in 7.30.0
-.SH RETURN VALUE
-Returns CURLM_OK if the option is supported, and CURLM_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLMOPT_MAXCONNECTS "(3), " CURLMOPT_MAX_TOTAL_CONNECTIONS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_HOST_CONNECTIONS.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_HOST_CONNECTIONS.md
new file mode 100644
index 0000000000..184830fd5d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_HOST_CONNECTIONS.md
@@ -0,0 +1,80 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_MAX_HOST_CONNECTIONS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_MAXCONNECTS (3)
+  - CURLMOPT_MAX_TOTAL_CONNECTIONS (3)
+Protocol:
+  - All
+Added-in: 7.30.0
+---
+
+# NAME
+
+CURLMOPT_MAX_HOST_CONNECTIONS - max number of connections to a single host
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_MAX_HOST_CONNECTIONS,
+                            long max);
+~~~
+
+# DESCRIPTION
+
+Pass a long to indicate **max**, the maximum amount of simultaneously open
+connections libcurl may hold a single host (a host being the same as a
+hostname + port number pair). For each new transfer to the same host, libcurl
+might open a new connection up to the limit set by
+CURLMOPT_MAX_HOST_CONNECTIONS(3). When the limit is reached, new sessions are
+kept pending until a connection becomes available.
+
+The default **max** value is 0, unlimited. This set limit is also used for
+proxy connections, and then the proxy is considered to be the host for which
+this limit counts.
+
+When more transfers are added to the multi handle than what can be performed
+due to the set limit, they are queued up waiting for their chance.
+
+While a transfer is queued up internally waiting for a connection, the
+CURLOPT_TIMEOUT_MS(3) timeout is counted inclusive of the waiting time,
+meaning that if you set a too narrow timeout the transfer might never even
+start before it times out. The CURLOPT_CONNECTTIMEOUT_MS(3) time is also
+similarly still treated as a per-connect timeout and might expire even before
+making a new connection is permitted.
+
+Changing this value while there are transfers in progress is possible. The new
+value is then used the next time checks are performed. Lowering the value does
+not close down any active transfers, it prevents new ones from being
+made.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *m = curl_multi_init();
+  /* do no more than 2 connections per host */
+  curl_multi_setopt(m, CURLMOPT_MAX_HOST_CONNECTIONS, 2L);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_setopt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_PIPELINE_LENGTH.3 b/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_PIPELINE_LENGTH.3
deleted file mode 100644
index 985ad060b5..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_PIPELINE_LENGTH.3
+++ /dev/null
@@ -1,62 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLMOPT_MAX_PIPELINE_LENGTH 3 "4 Nov 2014" libcurl libcurl
-.SH NAME
-CURLMOPT_MAX_PIPELINE_LENGTH \- maximum number of requests in a pipeline
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_MAX_PIPELINE_LENGTH,
-                            long max);
-.fi
-.SH DESCRIPTION
-No function since pipelining was removed in 7.62.0.
-
-Pass a long. The set \fBmax\fP number is used as the maximum amount of
-outstanding requests in an HTTP/1.1 pipeline. This option is only used for
-HTTP/1.1 pipelining, not for HTTP/2 multiplexing.
-
-When this limit is reached, libcurl creates another connection to the same
-host (see \fICURLMOPT_MAX_HOST_CONNECTIONS(3)\fP), or queue the request until
-one of the pipelines to the host is ready to accept a request.  Thus, the
-total number of requests in-flight is \fICURLMOPT_MAX_HOST_CONNECTIONS(3)\fP *
-\fICURLMOPT_MAX_PIPELINE_LENGTH(3)\fP.
-.SH DEFAULT
-5
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURLM *m = curl_multi_init();
-/* set a more conservative pipe length */
-curl_multi_setopt(m, CURLMOPT_MAX_PIPELINE_LENGTH, 3L);
-.fi
-.SH AVAILABILITY
-Added in 7.30.0
-.SH RETURN VALUE
-Returns CURLM_OK if the option is supported, and CURLM_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLMOPT_PIPELINING "(3), " CURLMOPT_MAX_HOST_CONNECTIONS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_PIPELINE_LENGTH.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_PIPELINE_LENGTH.md
new file mode 100644
index 0000000000..32d299f03d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_PIPELINE_LENGTH.md
@@ -0,0 +1,66 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_MAX_PIPELINE_LENGTH
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_MAX_HOST_CONNECTIONS (3)
+  - CURLMOPT_PIPELINING (3)
+Protocol:
+  - All
+Added-in: 7.30.0
+---
+
+# NAME
+
+CURLMOPT_MAX_PIPELINE_LENGTH - maximum number of requests in a pipeline
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_MAX_PIPELINE_LENGTH,
+                            long max);
+~~~
+
+# DESCRIPTION
+
+No function since pipelining was removed in 7.62.0.
+
+Pass a long. The set **max** number is used as the maximum amount of
+outstanding requests in an HTTP/1.1 pipeline. This option is only used for
+HTTP/1.1 pipelining, not for HTTP/2 multiplexing.
+
+When this limit is reached, libcurl creates another connection to the same
+host (see CURLMOPT_MAX_HOST_CONNECTIONS(3)), or queue the request until one
+    of the pipelines to the host is ready to accept a request. Thus, the total
+number of requests in-flight is CURLMOPT_MAX_HOST_CONNECTIONS(3) *
+CURLMOPT_MAX_PIPELINE_LENGTH(3).
+
+# DEFAULT
+
+5
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *m = curl_multi_init();
+  /* set a more conservative pipe length */
+  curl_multi_setopt(m, CURLMOPT_MAX_PIPELINE_LENGTH, 3L);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_setopt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_TOTAL_CONNECTIONS.3 b/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_TOTAL_CONNECTIONS.3
deleted file mode 100644
index dc815060b2..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_TOTAL_CONNECTIONS.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLMOPT_MAX_TOTAL_CONNECTIONS 3 "4 Nov 2014" libcurl libcurl
-.SH NAME
-CURLMOPT_MAX_TOTAL_CONNECTIONS \- max simultaneously open connections
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_MAX_TOTAL_CONNECTIONS,
-                            long amount);
-.fi
-.SH DESCRIPTION
-Pass a long for the \fBamount\fP. The set number is used as the maximum number
-of simultaneously open connections in total using this multi handle. For each
-new session, libcurl might open a new connection up to the limit set by
-\fICURLMOPT_MAX_TOTAL_CONNECTIONS(3)\fP. When the limit is reached, new
-sessions are held pending until there are available connections. If
-\fICURLMOPT_PIPELINING(3)\fP is enabled, libcurl can try multiplexing if the
-host is capable of it.
-
-When more transfers are added to the multi handle than what can be performed
-due to the set limit, they get queued up waiting for their chance. When that
-happens, the \fICURLOPT_TIMEOUT_MS(3)\fP timeout is counted inclusive of the
-waiting time, meaning that if you set a too narrow timeout in such a case the
-transfer might never even start before it times out.
-
-Even in the queued up situation, the \fICURLOPT_CONNECTTIMEOUT_MS(3)\fP
-timeout is however treated as a per-connect timeout.
-.SH DEFAULT
-The default value is 0, which means that there is no limit. It is then simply
-controlled by the number of easy handles added.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURLM *m = curl_multi_init();
-/* never do more than 15 connections */
-curl_multi_setopt(m, CURLMOPT_MAX_TOTAL_CONNECTIONS, 15L);
-.fi
-.SH AVAILABILITY
-Added in 7.30.0
-.SH RETURN VALUE
-Returns CURLM_OK if the option is supported, and CURLM_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLMOPT_MAXCONNECTS "(3), " CURLMOPT_MAX_HOST_CONNECTIONS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_TOTAL_CONNECTIONS.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_TOTAL_CONNECTIONS.md
new file mode 100644
index 0000000000..5a8811da86
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_MAX_TOTAL_CONNECTIONS.md
@@ -0,0 +1,77 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_MAX_TOTAL_CONNECTIONS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_MAXCONNECTS (3)
+  - CURLMOPT_MAX_HOST_CONNECTIONS (3)
+Protocol:
+  - All
+Added-in: 7.30.0
+---
+
+# NAME
+
+CURLMOPT_MAX_TOTAL_CONNECTIONS - max simultaneously open connections
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_MAX_TOTAL_CONNECTIONS,
+                            long amount);
+~~~
+
+# DESCRIPTION
+
+Pass a long for the **amount**. The set number is used as the maximum number
+of simultaneously open connections in total using this multi handle. For each
+new session, libcurl might open a new connection up to the limit set by
+CURLMOPT_MAX_TOTAL_CONNECTIONS(3). If CURLMOPT_PIPELINING(3) is enabled,
+libcurl can try multiplexing if the host is capable of it.
+
+When more transfers are added to the multi handle than what can be performed
+due to the set limit, they get queued up waiting for their chance.
+
+While a transfer is queued up internally waiting for a connection, the
+CURLOPT_TIMEOUT_MS(3) timeout is counted inclusive of the waiting time,
+meaning that if you set a too narrow timeout the transfer might never even
+start before it times out. The CURLOPT_CONNECTTIMEOUT_MS(3) time is also
+similarly still treated as a per-connect timeout and might expire even before
+making a new connection is permitted.
+
+Changing this value while there are transfers in progress is possible. The new
+value is then used the next time checks are performed. Lowering the value does
+not close down any active transfers, it prevents new ones from being
+made.
+
+# DEFAULT
+
+0, which means that there is no limit. It is then controlled by the
+number of easy handles added concurrently and how much multiplexing is being
+done.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *m = curl_multi_init();
+  /* never do more than 15 connections */
+  curl_multi_setopt(m, CURLMOPT_MAX_TOTAL_CONNECTIONS, 15L);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_setopt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_NETWORK_CHANGED.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_NETWORK_CHANGED.md
new file mode 100644
index 0000000000..a2a44c359d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_NETWORK_CHANGED.md
@@ -0,0 +1,83 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_NETWORK_CHANGED
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_FRESH_CONNECT (3)
+  - CURLOPT_FORBID_REUSE (3)
+Protocol:
+  - All
+Added-in: 8.16.0
+---
+
+# NAME
+
+CURLMOPT_NETWORK_CHANGED - signal network changed
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_NETWORK_CHANGED,
+                            long value);
+~~~
+
+# DESCRIPTION
+
+Pass a long with a bitmask to tell libcurl how the multi handle should react.
+The following values in the mask are defined. All bits not mentioned are
+reserved for future extensions.
+
+This option can be set at any time and repeatedly. Each call only affects the
+*currently* cached connections and DNS information. Any connection created or
+DNS information added afterwards is cached the usual way again. Phrasing it
+another way: the option is not persisted but setting it serves as a "trigger"
+to clear the caches.
+
+The call affects only the connection and DNS cache of the multi handle itself
+and not the ones owned by SHARE handles.
+
+## CURLMNWC_CLEAR_ALL
+
+Clear everything. (Added in 8.20.0)
+
+## CURLMNWC_CLEAR_CONNS
+
+No longer reuse any existing connection in the multi handle's connection
+cache. This closes all connections that are not in use. Ongoing transfers
+continue on the connections they operate on.
+
+## CURLMNWC_CLEAR_DNS
+
+Clear the multi handle's DNS cache. Ongoing transfers keep using their already
+resolved addresses, but future name resolutions are performed again.
+
+# DEFAULT
+
+0, which has no effect.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *m = curl_multi_init();
+  /* do transfers on the multi handle */
+  /* do not reuse existing connections */
+  curl_multi_setopt(m, CURLMOPT_NETWORK_CHANGED, CURLMNWC_CLEAR_CONNS);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_setopt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_NOTIFYDATA.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_NOTIFYDATA.md
new file mode 100644
index 0000000000..ad57cbea14
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_NOTIFYDATA.md
@@ -0,0 +1,72 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_NOTIFYDATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_NOTIFYFUNCTION (3)
+  - curl_multi_notify_disable (3)
+  - curl_multi_notify_enable (3)
+Protocol:
+  - All
+Added-in: 8.17.0
+---
+
+# NAME
+
+CURLMOPT_NOTIFYDATA - custom pointer passed to the notification callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_NOTIFYDATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+A data *pointer* to pass to the notification callback set with the
+CURLMOPT_NOTIFYFUNCTION(3) option.
+
+This pointer is not touched by libcurl but is only passed in as the
+notification callback's **clientp** argument.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct priv {
+  void *ours;
+};
+
+static void notify_cb(CURLM *multi, unsigned int notification,
+                      CURL *easy, void *notifyp)
+{
+  struct priv *p = notifyp;
+  printf("my ptr: %p\n", p->ours);
+  /* ... */
+}
+
+int main(void)
+{
+  struct priv setup;
+  CURLM *multi = curl_multi_init();
+  /* ... use socket callback and custom pointer */
+  curl_multi_setopt(multi, CURLMOPT_NOTIFYFUNCTION, notify_cb);
+  curl_multi_setopt(multi, CURLMOPT_NOTIFYDATA, &setup);
+  curl_multi_notify_enable(multi, CURLMNOTIFY_INFO_READ);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+Returns CURLM_OK.
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_NOTIFYFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_NOTIFYFUNCTION.md
new file mode 100644
index 0000000000..0e10aa9187
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_NOTIFYFUNCTION.md
@@ -0,0 +1,130 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_NOTIFYFUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_NOTIFYDATA (3)
+  - curl_multi_socket_action (3)
+  - curl_multi_notify_disable (3)
+  - curl_multi_notify_enable (3)
+Protocol:
+  - All
+Added-in: 8.17.0
+---
+
+# NAME
+
+CURLMOPT_NOTIFYFUNCTION - callback receiving notifications
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+void notify_callback(CURLM *multi,     /* multi handle */
+                     unsigned int notification, /* notification type */
+                     CURL *easy,       /* easy handle */
+                     void *notifyp);   /* private notify pointer */
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_NOTIFYFUNCTION, notify_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+When the multi handle processes transfers, changes can be observed
+by receiving notifications about them. This can eliminate the need to
+constantly interrogate the multi handle to observe such changes to
+act on them.
+
+Notifications are collected and dispatched to the application's callback
+function at an appropriate time.
+
+The notify callback is different from other callbacks in that it
+can use more libcurl API functions. Apart from curl_multi_perform(3),
+curl_multi_socket(3), curl_multi_socket_action(3), curl_multi_socket_all(3)
+and curl_multi_cleanup(3) it may call all other methods on the
+multi and easy handles. This includes adding and removing easy
+handles to/from the multi handle.
+
+This callback may get invoked at any time when interacting with libcurl.
+This may even happen after all transfers are done and *may also*
+happen *during* a call to curl_multi_cleanup(3) when cached connections
+are shut down.
+
+# CALLBACK ARGUMENTS
+
+*multi* identifies the multi handle that triggered the notification.
+
+**notification** is the type of notification, e.g. what happened. The
+following types are available right now. In the future, new ones might be
+added.
+
+## CURLMNOTIFY_INFO_READ
+
+When enabled via curl_multi_notify_enable(3), this informs the application
+that there are new messages to be processed via curl_multi_info_read(3).
+
+This notification happens whenever a message is added to an empty
+message stack in the multi handle and not for subsequent additions. The
+notification callback is then expected to read all available message,
+emptying the stack, so a subsequent addition triggers the notification
+again.
+
+The *easy* handle passed is an internal handle.
+
+## CURLMNOTIFY_EASY_DONE
+
+When enabled via curl_multi_notify_enable(3), this notification is triggered
+when an easy handle has finished. This happens both for successful and failed
+transfers.
+
+The *easy* handle passed is the transfer that is done. This *may* be
+an internal handle when DoH or other features are used.
+
+*easy* identifies the transfer involved. This may be one of the
+application's own easy handle or an internal handle.
+
+**notifyp** is set with CURLMOPT_NOTIFYDATA(3).
+
+# DEFAULT
+
+NULL (no callback)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct priv {
+  void *ours;
+};
+
+static void notify_cb(CURLM *multi, unsigned int notification,
+                      CURL *easy, void *notifyp)
+{
+  struct priv *p = notifyp;
+  printf("my ptr: %p\n", p->ours);
+  /* ... */
+}
+
+int main(void)
+{
+  struct priv setup;
+  CURLM *multi = curl_multi_init();
+  /* ... use socket callback and custom pointer */
+  curl_multi_setopt(multi, CURLMOPT_NOTIFYFUNCTION, notify_cb);
+  curl_multi_setopt(multi, CURLMOPT_NOTIFYDATA, &setup);
+  curl_multi_notify_enable(multi, CURLMNOTIFY_INFO_READ);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+Returns CURLM_OK.
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING.3 b/third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING.3
deleted file mode 100644
index 9733f253ed..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING.3
+++ /dev/null
@@ -1,71 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLMOPT_PIPELINING 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLMOPT_PIPELINING \- enable HTTP pipelining and multiplexing
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_PIPELINING, long bitmask);
-.fi
-.SH DESCRIPTION
-Pass in the correct value in the \fBbitmask\fP parameter to instruct libcurl
-to enable multiplexing for this multi handle.
-
-With multiplexing enabled, libcurl attempts to do multiple transfers over the
-same connection when doing parallel transfers to the same hosts.
-
-.IP CURLPIPE_NOTHING (0)
-Default, which means doing no attempts at multiplexing.
-.IP CURLPIPE_HTTP1 (1)
-This bit is deprecated and has no effect since version 7.62.0.
-.IP CURLPIPE_MULTIPLEX (2)
-If this bit is set, libcurl tries to multiplex the new transfer over an
-existing connection if possible. This requires HTTP/2 or HTTP/3.
-.SH DEFAULT
-Since 7.62.0, \fBCURLPIPE_MULTIPLEX\fP is enabled by default.
-
-Before that, default was \fBCURLPIPE_NOTHING\fP.
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURLM *m = curl_multi_init();
-/* try HTTP/2 multiplexing */
-curl_multi_setopt(m, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
-.fi
-.SH AVAILABILITY
-Added in 7.16.0. Multiplex support bit added in 7.43.0. HTTP/1 Pipelining
-support was disabled in 7.62.0.
-.SH RETURN VALUE
-Returns CURLM_OK if the option is supported, and CURLM_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLMOPT_MAX_PIPELINE_LENGTH "(3), "
-.BR CURLMOPT_PIPELINING_SITE_BL "(3), "
-.BR CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE "(3), "
-.BR CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE "(3), "
-.BR CURLMOPT_MAXCONNECTS "(3), "
-.BR CURLMOPT_MAX_HOST_CONNECTIONS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING.md
new file mode 100644
index 0000000000..93345f1f10
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING.md
@@ -0,0 +1,85 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_PIPELINING
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE (3)
+  - CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE (3)
+  - CURLMOPT_MAXCONNECTS (3)
+  - CURLMOPT_MAX_HOST_CONNECTIONS (3)
+  - CURLMOPT_MAX_PIPELINE_LENGTH (3)
+  - CURLMOPT_PIPELINING_SITE_BL (3)
+Protocol:
+  - HTTP
+Added-in: 7.16.0
+---
+
+# NAME
+
+CURLMOPT_PIPELINING - enable HTTP multiplexing
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_PIPELINING, long bitmask);
+~~~
+
+# DESCRIPTION
+
+Pass in the correct value in the **bitmask** parameter to instruct libcurl to
+enable multiplexing for this multi handle.
+
+With multiplexing enabled, libcurl attempts to do multiple transfers over the
+same connection when doing parallel transfers to the same hosts.
+
+## CURLPIPE_NOTHING (0)
+
+Make no attempts at multiplexing.
+
+## CURLPIPE_HTTP1 (1)
+
+This bit is deprecated and has no effect since version 7.62.0.
+
+## CURLPIPE_MULTIPLEX (2)
+
+If this bit is set, libcurl tries to multiplex the new transfer over an
+existing connection if possible. This requires HTTP/2 or HTTP/3.
+
+# DEFAULT
+
+**CURLPIPE_MULTIPLEX**
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *m = curl_multi_init();
+  /* try HTTP/2 multiplexing */
+  curl_multi_setopt(m, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
+}
+~~~
+
+# HISTORY
+
+The multiplex support bit was added in 7.43.0. HTTP/1 Pipelining support was
+disabled in 7.62.0.
+
+Since 7.62.0, **CURLPIPE_MULTIPLEX** is enabled by default.
+
+Before that, default was **CURLPIPE_NOTHING**.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_setopt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING_SERVER_BL.3 b/third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING_SERVER_BL.3
deleted file mode 100644
index f50efe8f72..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING_SERVER_BL.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLMOPT_PIPELINING_SERVER_BL 3 "4 Nov 2014" libcurl libcurl
-.SH NAME
-CURLMOPT_PIPELINING_SERVER_BL \- pipelining server block list
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_PIPELINING_SERVER_BL,
-                            char **servers);
-.fi
-.SH DESCRIPTION
-No function since pipelining was removed in 7.62.0.
-
-Pass a \fBservers\fP array of char *, ending with a NULL entry. This is a list
-of server types prefixes (in the Server: HTTP header) that are blocked from
-pipelining, i.e server types that are known to not support HTTP
-pipelining. The array is copied by libcurl.
-
-Note that the comparison matches if the Server: header begins with the string
-in the block list, i.e "Server: Ninja 1.2.3" and "Server: Ninja 1.4.0" can
-both be blocked by having "Ninja" in the list.
-
-Pass a NULL pointer to clear the block list.
-.SH DEFAULT
-The default value is NULL, which means that there is no block list.
-.SH PROTOCOLS
-.SH EXAMPLE
-.nf
-  char *server_block_list[] =
-  {
-    "Microsoft-IIS/6.0",
-    "nginx/0.8.54",
-    NULL
-  };
-
-  curl_multi_setopt(m, CURLMOPT_PIPELINING_SERVER_BL, server_block_list);
-.fi
-.SH AVAILABILITY
-Added in 7.30.0
-.SH RETURN VALUE
-Returns CURLM_OK if the option is supported, and CURLM_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLMOPT_PIPELINING "(3), " CURLMOPT_PIPELINING_SITE_BL "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING_SERVER_BL.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING_SERVER_BL.md
new file mode 100644
index 0000000000..6d3764ef90
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING_SERVER_BL.md
@@ -0,0 +1,72 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_PIPELINING_SERVER_BL
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_PIPELINING (3)
+  - CURLMOPT_PIPELINING_SITE_BL (3)
+Protocol:
+  - HTTP
+Added-in: 7.30.0
+---
+
+# NAME
+
+CURLMOPT_PIPELINING_SERVER_BL - pipelining server block list
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_PIPELINING_SERVER_BL,
+                            char **servers);
+~~~
+
+# DESCRIPTION
+
+No function since pipelining was removed in 7.62.0.
+
+Pass a **servers** array of char *, ending with a NULL entry. This is a list
+of server types prefixes (in the Server: HTTP header) that are blocked from
+pipelining, i.e server types that are known to not support HTTP
+pipelining. The array is copied by libcurl.
+
+Note that the comparison matches if the Server: header begins with the string
+in the block list, i.e "Server: Ninja 1.2.3" and "Server: Ninja 1.4.0" can
+both be blocked by having "Ninja" in the list.
+
+Pass a NULL pointer to clear the block list.
+
+# DEFAULT
+
+NULL, which means that there is no block list.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+static char *server_block_list[] =
+{
+  "Microsoft-IIS/6.0",
+  "nginx/0.8.54",
+  NULL
+};
+int main(void)
+{
+  CURLM *m = curl_multi_init();
+  curl_multi_setopt(m, CURLMOPT_PIPELINING_SERVER_BL, server_block_list);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_setopt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING_SITE_BL.3 b/third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING_SITE_BL.3
deleted file mode 100644
index 08b89690ce..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING_SITE_BL.3
+++ /dev/null
@@ -1,63 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLMOPT_PIPELINING_SITE_BL 3 "4 Nov 2014" libcurl libcurl
-.SH NAME
-CURLMOPT_PIPELINING_SITE_BL \- pipelining host block list
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_PIPELINING_SITE_BL,
-                            char **hosts);
-.fi
-.SH DESCRIPTION
-No function since pipelining was removed in 7.62.0.
-
-Pass a \fBhosts\fP array of char *, ending with a NULL entry. This is a list
-of sites that are blocked from pipelining, i.e sites that are known to not
-support HTTP pipelining. The array is copied by libcurl.
-
-Pass a NULL pointer to clear the block list.
-.SH DEFAULT
-The default value is NULL, which means that there is no block list.
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-  char *site_block_list[] =
-  {
-    "www.haxx.se",
-    "www.example.com:1234",
-    NULL
-  };
-
-  curl_multi_setopt(m, CURLMOPT_PIPELINING_SITE_BL, site_block_list);
-.fi
-.SH AVAILABILITY
-Added in 7.30.0
-.SH RETURN VALUE
-Returns CURLM_OK if the option is supported, and CURLM_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLMOPT_PIPELINING "(3), " CURLMOPT_PIPELINING_SERVER_BL "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING_SITE_BL.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING_SITE_BL.md
new file mode 100644
index 0000000000..19fd0fdba9
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_PIPELINING_SITE_BL.md
@@ -0,0 +1,68 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_PIPELINING_SITE_BL
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_PIPELINING (3)
+  - CURLMOPT_PIPELINING_SERVER_BL (3)
+Protocol:
+  - HTTP
+Added-in: 7.30.0
+---
+
+# NAME
+
+CURLMOPT_PIPELINING_SITE_BL - pipelining host block list
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_PIPELINING_SITE_BL,
+                            char **hosts);
+~~~
+
+# DESCRIPTION
+
+No function since pipelining was removed in 7.62.0.
+
+Pass a **hosts** array of char *, ending with a NULL entry. This is a list
+of sites that are blocked from pipelining, i.e sites that are known to not
+support HTTP pipelining. The array is copied by libcurl.
+
+Pass a NULL pointer to clear the block list.
+
+# DEFAULT
+
+NULL, which means that there is no block list.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+static char *site_block_list[] =
+{
+  "www.haxx.se",
+  "www.example.com:1234",
+  NULL
+};
+
+int main(void)
+{
+  CURLM *m = curl_multi_init();
+  curl_multi_setopt(m, CURLMOPT_PIPELINING_SITE_BL, site_block_list);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_setopt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_PUSHDATA.3 b/third-party/curl/docs/libcurl/opts/CURLMOPT_PUSHDATA.3
deleted file mode 100644
index cc20c7c26c..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLMOPT_PUSHDATA.3
+++ /dev/null
@@ -1,81 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLMOPT_PUSHDATA 3 "1 Jun 2015" libcurl libcurl
-.SH NAME
-CURLMOPT_PUSHDATA \- pointer to pass to push callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_PUSHDATA, void *pointer);
-.fi
-.SH DESCRIPTION
-Set a \fIpointer\fP to pass as the last argument to the
-\fICURLMOPT_PUSHFUNCTION(3)\fP callback. The pointer is not touched or used by
-libcurl itself, only passed on to the callback function.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-/* only allow pushes for file names starting with "push-" */
-int push_callback(CURL *parent,
-                  CURL *easy,
-                  size_t num_headers,
-                  struct curl_pushheaders *headers,
-                  void *clientp)
-{
-  char *headp;
-  int *transfers = (int *)clientp;
-  FILE *out;
-  headp = curl_pushheader_byname(headers, ":path");
-  if(headp && !strncmp(headp, "/push-", 6)) {
-    fprintf(stderr, "The PATH is %s\\n", headp);
-
-    /* save the push here */
-    out = fopen("pushed-stream", "wb");
-
-    /* write to this file */
-    curl_easy_setopt(easy, CURLOPT_WRITEDATA, out);
-
-    (*transfers)++; /* one more */
-
-    return CURL_PUSH_OK;
-  }
-  return CURL_PUSH_DENY;
-}
-
-curl_multi_setopt(multi, CURLMOPT_PUSHFUNCTION, push_callback);
-curl_multi_setopt(multi, CURLMOPT_PUSHDATA, &counter);
-.fi
-.SH AVAILABILITY
-Added in 7.44.0
-.SH RETURN VALUE
-Returns CURLM_OK if the option is supported, and CURLM_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLMOPT_PUSHFUNCTION "(3), " CURLMOPT_PIPELINING "(3), "
-.BR CURLOPT_PIPEWAIT "(3), "
-.BR RFC 7540
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_PUSHDATA.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_PUSHDATA.md
new file mode 100644
index 0000000000..f3383d3ece
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_PUSHDATA.md
@@ -0,0 +1,89 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_PUSHDATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_PIPELINING (3)
+  - CURLMOPT_PUSHFUNCTION (3)
+  - CURLOPT_PIPEWAIT (3)
+  - RFC 7540
+Protocol:
+  - HTTP
+Added-in: 7.44.0
+---
+
+# NAME
+
+CURLMOPT_PUSHDATA - pointer to pass to push callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_PUSHDATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+Set a *pointer* to pass as the last argument to the
+CURLMOPT_PUSHFUNCTION(3) callback. The pointer is not touched or used by
+libcurl itself, only passed on to the callback function.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <string.h>
+
+/* only allow pushes for filenames starting with "push-" */
+int push_callback(CURL *parent,
+                  CURL *easy,
+                  size_t num_headers,
+                  struct curl_pushheaders *headers,
+                  void *clientp)
+{
+  char *headp;
+  int *transfers = (int *)clientp;
+  FILE *out;
+  headp = curl_pushheader_byname(headers, ":path");
+  if(headp && !strncmp(headp, "/push-", 6)) {
+    fprintf(stderr, "The PATH is %s\n", headp);
+
+    /* save the push here */
+    out = fopen("pushed-stream", "wb");
+
+    /* write to this file */
+    curl_easy_setopt(easy, CURLOPT_WRITEDATA, out);
+
+    (*transfers)++; /* one more */
+
+    return CURL_PUSH_OK;
+  }
+  return CURL_PUSH_DENY;
+}
+
+int main(void)
+{
+  int counter;
+  CURLM *multi = curl_multi_init();
+  curl_multi_setopt(multi, CURLMOPT_PUSHFUNCTION, push_callback);
+  curl_multi_setopt(multi, CURLMOPT_PUSHDATA, &counter);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_setopt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_PUSHFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLMOPT_PUSHFUNCTION.3
deleted file mode 100644
index 1a292ad813..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLMOPT_PUSHFUNCTION.3
+++ /dev/null
@@ -1,130 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLMOPT_PUSHFUNCTION 3 "1 Jun 2015" libcurl libcurl
-.SH NAME
-CURLMOPT_PUSHFUNCTION \- callback that approves or denies server pushes
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-int curl_push_callback(CURL *parent,
-                       CURL *easy,
-                       size_t num_headers,
-                       struct curl_pushheaders *headers,
-                       void *clientp);
-
-CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_PUSHFUNCTION,
-                            curl_push_callback func);
-.fi
-.SH DESCRIPTION
-This callback gets called when a new HTTP/2 stream is being pushed by the
-server (using the PUSH_PROMISE frame). If no push callback is set, all offered
-pushes are denied automatically.
-.SH CALLBACK DESCRIPTION
-The callback gets its arguments like this:
-
-\fIparent\fP is the handle of the stream on which this push arrives. The new
-handle has been duplicated from the parent, meaning that it has gotten all its
-options inherited. It is then up to the application to alter any options if
-desired.
-
-\fIeasy\fP is a newly created handle that represents this upcoming transfer.
-
-\fInum_headers\fP is the number of name+value pairs that was received and can
-be accessed
-
-\fIheaders\fP is a handle used to access push headers using the accessor
-functions described below. This only accesses and provides the PUSH_PROMISE
-headers, the normal response headers are provided in the header callback as
-usual.
-
-\fIclientp\fP is the pointer set with \fICURLMOPT_PUSHDATA(3)\fP
-
-If the callback returns CURL_PUSH_OK, the new easy handle is added to the
-multi handle, the callback must not do that by itself.
-
-The callback can access PUSH_PROMISE headers with two accessor
-functions. These functions can only be used from within this callback and they
-can only access the PUSH_PROMISE headers: \fIcurl_pushheader_byname(3)\fP and
-\fIcurl_pushheader_bynum(3)\fP. The normal response headers are passed to the
-header callback for pushed streams just as for normal streams.
-
-The header fields can also be accessed with \fIcurl_easy_header(3)\fP,
-introduced in later libcurl versions.
-.SH CALLBACK RETURN VALUE
-.IP "CURL_PUSH_OK (0)"
-The application has accepted the stream and it can now start receiving data,
-the ownership of the CURL handle has been taken over by the application.
-.IP "CURL_PUSH_DENY (1)"
-The callback denies the stream and no data reaches the application, the easy
-handle is destroyed by libcurl.
-.IP "CURL_PUSH_ERROROUT (2)"
-Returning this code rejects the pushed stream and returns an error back on the
-parent stream making it get closed with an error. (Added in 7.72.0)
-.IP *
-All other return codes are reserved for future use.
-.SH DEFAULT
-NULL, no callback
-.SH PROTOCOLS
-HTTP(S) (HTTP/2 only)
-.SH EXAMPLE
-.nf
-/* only allow pushes for file names starting with "push-" */
-int push_callback(CURL *parent,
-                  CURL *easy,
-                  size_t num_headers,
-                  struct curl_pushheaders *headers,
-                  void *clientp)
-{
-  char *headp;
-  int *transfers = (int *)clientp;
-  FILE *out;
-  headp = curl_pushheader_byname(headers, ":path");
-  if(headp && !strncmp(headp, "/push-", 6)) {
-    fprintf(stderr, "The PATH is %s\\n", headp);
-
-    /* save the push here */
-    out = fopen("pushed-stream", "wb");
-
-    /* write to this file */
-    curl_easy_setopt(easy, CURLOPT_WRITEDATA, out);
-
-    (*transfers)++; /* one more */
-
-    return CURL_PUSH_OK;
-  }
-  return CURL_PUSH_DENY;
-}
-
-curl_multi_setopt(multi, CURLMOPT_PUSHFUNCTION, push_callback);
-curl_multi_setopt(multi, CURLMOPT_PUSHDATA, &counter);
-.fi
-.SH AVAILABILITY
-Added in 7.44.0
-.SH RETURN VALUE
-Returns CURLM_OK if the option is supported, and CURLM_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLMOPT_PUSHDATA "(3), " CURLMOPT_PIPELINING "(3), " CURLOPT_PIPEWAIT "(3), "
-.BR RFC 7540
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_PUSHFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_PUSHFUNCTION.md
new file mode 100644
index 0000000000..4bead2b94f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_PUSHFUNCTION.md
@@ -0,0 +1,150 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_PUSHFUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_PIPELINING (3)
+  - CURLMOPT_PUSHDATA (3)
+  - CURLOPT_PIPEWAIT (3)
+  - RFC 7540
+Protocol:
+  - HTTP
+Added-in: 7.44.0
+---
+
+# NAME
+
+CURLMOPT_PUSHFUNCTION - callback that approves or denies server pushes
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+int curl_push_callback(CURL *parent,
+                       CURL *easy,
+                       size_t num_headers,
+                       struct curl_pushheaders *headers,
+                       void *clientp);
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_PUSHFUNCTION,
+                            curl_push_callback func);
+~~~
+
+# DESCRIPTION
+
+This callback gets called when a new HTTP/2 stream is being pushed by the
+server (using the PUSH_PROMISE frame). If no push callback is set, all offered
+pushes are denied automatically.
+
+# CALLBACK DESCRIPTION
+
+The callback gets its arguments like this:
+
+*parent* is the handle of the stream on which this push arrives. The new
+handle has been duplicated from the parent, meaning that it has gotten all its
+options inherited. It is then up to the application to alter any options if
+desired.
+
+*easy* is a newly created handle that represents this upcoming transfer.
+
+*num_headers* is the number of name+value pairs that was received and can
+be accessed
+
+*headers* is a handle used to access push headers using the accessor
+functions described below. This only accesses and provides the PUSH_PROMISE
+headers, the normal response headers are provided in the header callback as
+usual.
+
+*clientp* is the pointer set with CURLMOPT_PUSHDATA(3)
+
+If the callback returns CURL_PUSH_OK, the new easy handle is added to the
+multi handle, the callback must not do that by itself.
+
+The callback can access PUSH_PROMISE headers with two accessor functions.
+These functions can only be used from within this callback and they can only
+access the PUSH_PROMISE headers: curl_pushheader_byname(3) and
+curl_pushheader_bynum(3). The normal response headers are passed to the header
+callback for pushed streams like for normal streams.
+
+The header fields can also be accessed with curl_easy_header(3),
+introduced in later libcurl versions.
+
+# CALLBACK RETURN VALUE
+
+## CURL_PUSH_OK (0)
+
+The application has accepted the stream and it can now start receiving data,
+the ownership of the curl handle has been taken over by the application.
+
+## CURL_PUSH_DENY (1)
+
+The callback denies the stream and no data reaches the application, the easy
+handle is destroyed by libcurl.
+
+## CURL_PUSH_ERROROUT (2)
+
+Returning this code rejects the pushed stream and returns an error back on the
+parent stream making it get closed with an error. (Added in 7.72.0)
+
+## *
+
+All other return codes are reserved for future use.
+
+# DEFAULT
+
+NULL, no callback
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <string.h>
+
+/* only allow pushes for filenames starting with "push-" */
+int push_callback(CURL *parent,
+                  CURL *easy,
+                  size_t num_headers,
+                  struct curl_pushheaders *headers,
+                  void *clientp)
+{
+  char *headp;
+  int *transfers = (int *)clientp;
+  FILE *out;
+  headp = curl_pushheader_byname(headers, ":path");
+  if(headp && !strncmp(headp, "/push-", 6)) {
+    fprintf(stderr, "The PATH is %s\n", headp);
+
+    /* save the push here */
+    out = fopen("pushed-stream", "wb");
+
+    /* write to this file */
+    curl_easy_setopt(easy, CURLOPT_WRITEDATA, out);
+
+    (*transfers)++; /* one more */
+
+    return CURL_PUSH_OK;
+  }
+  return CURL_PUSH_DENY;
+}
+
+int main(void)
+{
+  int counter;
+  CURLM *multi = curl_multi_init();
+  curl_multi_setopt(multi, CURLMOPT_PUSHFUNCTION, push_callback);
+  curl_multi_setopt(multi, CURLMOPT_PUSHDATA, &counter);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_setopt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_QUICK_EXIT.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_QUICK_EXIT.md
new file mode 100644
index 0000000000..f932208363
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_QUICK_EXIT.md
@@ -0,0 +1,60 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_QUICK_EXIT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_QUICK_EXIT (3)
+Protocol:
+  - All
+Added-in: 8.20.0
+---
+
+# NAME
+
+CURLOPT_QUICK_EXIT - allow libcurl to exit quickly
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_QUICK_EXIT,
+                            long value);
+~~~
+
+# DESCRIPTION
+
+Pass a long as a parameter, 1L meaning that when recovering from a timeout,
+libcurl should skip lengthy cleanups that are intended to avoid all kinds of
+leaks (threads etc.), as the caller program is about to call exit() anyway.
+This allows for a swift termination after a DNS timeout for example, by
+canceling and/or forgetting about a resolver thread, at the expense of a
+possible (though short-lived) leak of associated resources.
+
+# DEFAULT
+
+20.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *m = curl_multi_init();
+  /* do not join threads when cleaning up this multi handle */
+  curl_multi_setopt(m, CURLMOPT_QUICK_EXIT, 1L);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_setopt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_RESOLVE_THREADS_MAX.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_RESOLVE_THREADS_MAX.md
new file mode 100644
index 0000000000..593ff7fa02
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_RESOLVE_THREADS_MAX.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_RESOLVE_THREADS_MAX
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_IPRESOLVE (3)
+  - CURLOPT_RESOLVE (3)
+Protocol:
+  - All
+Added-in: 8.20.0
+---
+
+# NAME
+
+CURLMOPT_RESOLVE_THREADS_MAX - max threads for threaded DNS resolver
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_RESOLVE_THREADS_MAX,
+                            long amount);
+~~~
+
+# DESCRIPTION
+
+Pass a long for the **amount**. The set number is used as the maximum number
+of threads to be used for the threaded DNS resolver. It has to be a
+positive number in the range of 32 bits.
+
+When libcurl is built with a threaded resolver, which is the default on
+many systems, it uses a thread pool to lookup addresses and other
+properties of hostnames so other transfers are not blocked by this.
+
+Threads are started on demand to perform the resolving and shut down
+again after a period of inactivity. When the maximum number of threads
+is reached, outstanding resolves are held in a queue and served when
+a thread becomes available.
+
+The default maximum is expected to work fine for many situations. Application
+may override it using this option for the multi handle.
+
+Changing this value while there are resolves in progress is possible.
+Increasing the value takes effect right away. Lowering the value does
+not close down any resolves, but ends threads above the new maximum
+once the resolving is done.
+
+# DEFAULT
+
+20.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLM *m = curl_multi_init();
+  /* never use more than 5 threads for resolving */
+  curl_multi_setopt(m, CURLMOPT_RESOLVE_THREADS_MAX, 5L);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_setopt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_SOCKETDATA.3 b/third-party/curl/docs/libcurl/opts/CURLMOPT_SOCKETDATA.3
deleted file mode 100644
index 8239875746..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLMOPT_SOCKETDATA.3
+++ /dev/null
@@ -1,78 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLMOPT_SOCKETDATA 3 "3 Nov 2014" libcurl libcurl
-.SH NAME
-CURLMOPT_SOCKETDATA \- custom pointer passed to the socket callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_SOCKETDATA, void *pointer);
-.SH DESCRIPTION
-A data \fIpointer\fP to pass to the socket callback set with the
-\fICURLMOPT_SOCKETFUNCTION(3)\fP option.
-
-This pointer is not touched by libcurl but is only passed in as the socket
-callbacks's \fBclientp\fP argument.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-static int sock_cb(CURL *e, curl_socket_t s, int what, void *cbp, void *sockp)
-{
-  GlobalInfo *g = (GlobalInfo*) cbp;
-  SockInfo *fdp = (SockInfo*) sockp;
-
-  if(what == CURL_POLL_REMOVE) {
-    remsock(fdp);
-  }
-  else {
-    if(!fdp) {
-      addsock(s, e, what, g);
-    }
-    else {
-      setsock(fdp, s, e, what, g);
-    }
-  }
-  return 0;
-}
-
-main()
-{
-  GlobalInfo setup;
-  /* ... use socket callback and custom pointer */
-  curl_multi_setopt(multi, CURLMOPT_SOCKETFUNCTION, sock_cb);
-  curl_multi_setopt(multi, CURLMOPT_SOCKETDATA, &setup);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.15.4
-.SH RETURN VALUE
-Returns CURLM_OK.
-.SH "SEE ALSO"
-.BR CURLMOPT_SOCKETFUNCTION "(3), " curl_multi_socket_action "(3), "
-.BR CURLMOPT_TIMERFUNCTION "(3) "
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_SOCKETDATA.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_SOCKETDATA.md
new file mode 100644
index 0000000000..aade927a16
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_SOCKETDATA.md
@@ -0,0 +1,81 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_SOCKETDATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_SOCKETFUNCTION (3)
+  - CURLMOPT_TIMERFUNCTION (3)
+  - curl_multi_socket_action (3)
+Protocol:
+  - All
+Added-in: 7.15.4
+---
+
+# NAME
+
+CURLMOPT_SOCKETDATA - custom pointer passed to the socket callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_SOCKETDATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+A data *pointer* to pass to the socket callback set with the
+CURLMOPT_SOCKETFUNCTION(3) option.
+
+This pointer is not touched by libcurl but is only passed in as the socket
+callback's **clientp** argument.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct priv {
+  void *ours;
+};
+
+static int sock_cb(CURL *e, curl_socket_t s, int what, void *cbp, void *sockp)
+{
+  struct priv *p = sockp;
+  printf("my ptr: %p\n", p->ours);
+
+  if(what == CURL_POLL_REMOVE) {
+    /* remove the socket from our collection */
+  }
+  if(what & CURL_POLL_IN) {
+    /* wait for read on this socket */
+  }
+  if(what & CURL_POLL_OUT) {
+    /* wait for write on this socket */
+  }
+
+  return 0;
+}
+
+int main(void)
+{
+  struct priv setup;
+  CURLM *multi = curl_multi_init();
+  /* ... use socket callback and custom pointer */
+  curl_multi_setopt(multi, CURLMOPT_SOCKETFUNCTION, sock_cb);
+  curl_multi_setopt(multi, CURLMOPT_SOCKETDATA, &setup);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+Returns CURLM_OK.
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_SOCKETFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLMOPT_SOCKETFUNCTION.3
deleted file mode 100644
index fd75e9f7a1..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLMOPT_SOCKETFUNCTION.3
+++ /dev/null
@@ -1,121 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLMOPT_SOCKETFUNCTION 3 "3 Nov 2016" libcurl libcurl
-.SH NAME
-CURLMOPT_SOCKETFUNCTION \- callback informed about what to wait for
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-int socket_callback(CURL *easy,      /* easy handle */
-                    curl_socket_t s, /* socket */
-                    int what,        /* describes the socket */
-                    void *clientp,   /* private callback pointer */
-                    void *socketp);  /* private socket pointer */
-
-CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_SOCKETFUNCTION, socket_callback);
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-When the \fIcurl_multi_socket_action(3)\fP function is called, it uses this
-callback to inform the application about updates in the socket (file
-descriptor) status by doing none, one, or multiple calls to the
-\fBsocket_callback\fP. The callback function gets status updates with changes
-since the previous time the callback was called. If the given callback pointer
-is set to NULL, no callback is called.
-
-libcurl then expects the application to monitor the sockets for the specific
-activities and tell libcurl again when something happens on one of them. Tell
-libcurl by calling \fIcurl_multi_socket_action(3)\fP.
-.SH "CALLBACK ARGUMENTS"
-\fIeasy\fP identifies the specific transfer for which this update is related.
-
-\fIs\fP is the specific socket this function invocation concerns. If the
-\fBwhat\fP argument is not CURL_POLL_REMOVE then it holds information about
-what activity on this socket the application is supposed to
-monitor. Subsequent calls to this callback might update the \fBwhat\fP bits
-for a socket that is already monitored.
-
-The socket callback should return 0 on success, and -1 on error. If this
-callback returns error, \fBall\fP transfers currently in progress in this
-multi handle are aborted and made to fail.
-
-\fBclientp\fP is set with \fICURLMOPT_SOCKETDATA(3)\fP.
-
-\fBsocketp\fP is set with \fIcurl_multi_assign(3)\fP or NULL.
-
-The \fBwhat\fP parameter informs the callback on the status of the given
-socket. It can hold one of these values:
-.IP CURL_POLL_IN
-Wait for incoming data. For the socket to become readable.
-.IP CURL_POLL_OUT
-Wait for outgoing data. For the socket to become writable.
-.IP CURL_POLL_INOUT
-Wait for incoming and outgoing data. For the socket to become readable or
-writable.
-.IP CURL_POLL_REMOVE
-The specified socket/file descriptor is no longer used by libcurl for any
-active transfer. It might soon be added again.
-.SH DEFAULT
-NULL (no callback)
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-static int sock_cb(CURL *e, curl_socket_t s, int what, void *cbp, void *sockp)
-{
-  GlobalInfo *g = cbp;
-  SockInfo *fdp = sockp;
-
-  if(what == CURL_POLL_REMOVE) {
-    remsock(fdp);
-  }
-  else {
-    if(!fdp) {
-      addsock(s, e, what, g);
-    }
-    else {
-      setsock(fdp, s, e, what, g);
-    }
-  }
-  return 0;
-}
-
-main()
-{
-  GlobalInfo setup;
-  /* ... use socket callback and custom pointer */
-  curl_multi_setopt(multi, CURLMOPT_SOCKETFUNCTION, sock_cb);
-  curl_multi_setopt(multi, CURLMOPT_SOCKETDATA, &setup);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.15.4
-.SH RETURN VALUE
-Returns CURLM_OK.
-.SH "SEE ALSO"
-.BR CURLMOPT_SOCKETDATA "(3), " curl_multi_socket_action "(3), "
-.BR CURLMOPT_TIMERFUNCTION "(3) "
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_SOCKETFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_SOCKETFUNCTION.md
new file mode 100644
index 0000000000..2774ccbfc7
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_SOCKETFUNCTION.md
@@ -0,0 +1,156 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_SOCKETFUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_SOCKETDATA (3)
+  - CURLMOPT_TIMERFUNCTION (3)
+  - curl_multi_socket_action (3)
+Protocol:
+  - All
+Added-in: 7.15.4
+---
+
+# NAME
+
+CURLMOPT_SOCKETFUNCTION - callback informed about what to wait for
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+int socket_callback(CURL *easy,
+                    curl_socket_t socket,
+                    int what,
+                    void *clientp,
+                    void *socketp);
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_SOCKETFUNCTION,
+                            socket_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+When the curl_multi_socket_action(3) function is called, it uses this callback
+to inform the application about updates in the socket (file descriptor) status
+by doing none, one, or multiple calls to the **socket_callback**. The callback
+function gets status updates with changes since the previous time the callback
+was called. If the given callback pointer is set to NULL, no callback is
+called.
+
+libcurl then expects the application to monitor the sockets for the specific
+activities and tell libcurl again when something happens on one of them. Tell
+libcurl by calling curl_multi_socket_action(3).
+
+This callback may get invoked at any time when interacting with libcurl.
+This may even happen after all transfers are done and is *likely* to
+happen *during* a call to curl_multi_cleanup(3) when cached connections
+are shut down.
+
+libcurl may use a number of internal file descriptors for name resolving,
+Happy Eyeballs racing, internal communication and more, in addition to the
+main sockets used for network transfers. All of those file descriptors might
+get passed to this callback as "sockets".
+
+# CALLBACK ARGUMENTS
+
+**easy** identifies the specific transfer for which this update is related.
+Since this callback manages a whole multi handle, an application should not
+make assumptions about which particular handle that is passed here. It might
+even be an internal easy handle that the application did not add itself.
+
+**socket** is the specific socket this function invocation concerns. If the
+**what** argument is not CURL_POLL_REMOVE then it holds information about what
+activity on this socket the application is supposed to monitor. Subsequent
+calls to this callback might update the **what** bits for a socket that is
+already monitored.
+
+The socket callback should return 0 on success, and -1 on error. If this
+callback returns error, **all** transfers currently in progress in this
+multi handle are aborted and made to fail.
+
+**clientp** is set with CURLMOPT_SOCKETDATA(3).
+
+**socketp** is set with curl_multi_assign(3) or NULL.
+
+The **what** parameter informs the callback on the status of the given socket.
+It can hold one of these values:
+
+## CURL_POLL_IN
+
+Wait for incoming data. For the socket to become readable.
+
+## CURL_POLL_OUT
+
+Wait for outgoing data. For the socket to become writable.
+
+## CURL_POLL_INOUT
+
+Wait for incoming and outgoing data. For the socket to become readable or
+writable.
+
+## CURL_POLL_REMOVE
+
+The specified socket/file descriptor is no longer used by libcurl for any
+active transfer. It might soon be added again.
+
+When a socket is given a CURL_POLL_REMOVE value, it might be because libcurl
+is going to close it, but it might also mean that it does not need any more
+monitoring for the moment. An application cannot assume either. The same
+socket might appear soon in a call asking for monitoring again.
+
+A socket that is removed like this loses its assigned pointer as set with
+curl_multi_assign(3).
+
+# DEFAULT
+
+NULL (no callback)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct priv {
+  void *ours;
+};
+
+static int sock_cb(CURL *e, curl_socket_t s, int what, void *cbp, void *sockp)
+{
+  struct priv *p = cbp;
+  printf("our ptr: %p\n", p->ours);
+
+  if(what == CURL_POLL_REMOVE) {
+    /* remove the socket from our collection */
+  }
+  if(what & CURL_POLL_IN) {
+    /* wait for read on this socket */
+  }
+  if(what & CURL_POLL_OUT) {
+    /* wait for write on this socket */
+  }
+
+  return 0;
+}
+
+int main(void)
+{
+  struct priv setup;
+  CURLM *multi = curl_multi_init();
+  /* ... use socket callback and custom pointer */
+  curl_multi_setopt(multi, CURLMOPT_SOCKETFUNCTION, sock_cb);
+  curl_multi_setopt(multi, CURLMOPT_SOCKETDATA, &setup);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+Returns CURLM_OK.
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_TIMERDATA.3 b/third-party/curl/docs/libcurl/opts/CURLMOPT_TIMERDATA.3
deleted file mode 100644
index 7c5eef7c27..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLMOPT_TIMERDATA.3
+++ /dev/null
@@ -1,84 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLMOPT_TIMERDATA 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLMOPT_TIMERDATA \- custom pointer to pass to timer callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_TIMERDATA, void *pointer);
-.SH DESCRIPTION
-A data \fBpointer\fP to pass to the timer callback set with the
-\fICURLMOPT_TIMERFUNCTION(3)\fP option.
-
-This pointer is not touched by libcurl but is only be passed in to the timer
-callbacks's \fBclientp\fP argument.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-static gboolean timeout_cb(gpointer user_data)
-{
-  int running;
-  if(user_data) {
-    g_free(user_data);
-    curl_multi_setopt(curl_handle, CURLMOPT_TIMERDATA, NULL);
-  }
-  curl_multi_socket_action(multi, CURL_SOCKET_TIMEOUT, 0, &running);
-  return G_SOURCE_REMOVE;
-}
-
-static int timerfunc(CURLM *multi, long timeout_ms, void *clientp)
-{
-  guint *id = clientp;
-
-  if(id)
-    g_source_remove(*id);
-
-  /* -1 means we should just delete our timer. */
-  if(timeout_ms == -1) {
-    g_free(id);
-    id = NULL;
-  }
-  else {
-    if(!id)
-      id = g_new(guint, 1);
-    *id = g_timeout_add(timeout_ms, timeout_cb, id);
-  }
-  current_timer = id;
-  return 0;
-}
-
-curl_multi_setopt(multi, CURLMOPT_TIMERFUNCTION, timerfunc);
-.fi
-.SH AVAILABILITY
-Added in 7.16.0
-.SH RETURN VALUE
-Returns CURLM_OK if the option is supported, and CURLM_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLMOPT_TIMERFUNCTION "(3), " CURLMOPT_SOCKETFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_TIMERDATA.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_TIMERDATA.md
new file mode 100644
index 0000000000..7226bcb481
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_TIMERDATA.md
@@ -0,0 +1,78 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_TIMERDATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_SOCKETFUNCTION (3)
+  - CURLMOPT_TIMERFUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.16.0
+---
+
+# NAME
+
+CURLMOPT_TIMERDATA - custom pointer to pass to timer callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_TIMERDATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+A data **pointer** to pass to the timer callback set with the
+CURLMOPT_TIMERFUNCTION(3) option.
+
+This pointer is not touched by libcurl but is only be passed in to the timer
+callback's **clientp** argument.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct priv {
+  void *custom;
+};
+
+static int timerfunc(CURLM *multi, long timeout_ms, void *clientp)
+{
+  struct priv *mydata = clientp;
+  printf("our ptr: %p\n", mydata->custom);
+
+  if(timeout_ms >= 0) {
+    /* this is the new single timeout to wait for */
+  }
+  else {
+    /* delete the timeout, nothing to wait for now */
+  }
+  return 0;
+}
+
+int main(void)
+{
+  struct priv mydata;
+  CURLM *multi = curl_multi_init();
+  curl_multi_setopt(multi, CURLMOPT_TIMERFUNCTION, timerfunc);
+  curl_multi_setopt(multi, CURLMOPT_TIMERDATA, &mydata);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_setopt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_TIMERFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLMOPT_TIMERFUNCTION.3
deleted file mode 100644
index 425743a369..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLMOPT_TIMERFUNCTION.3
+++ /dev/null
@@ -1,112 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLMOPT_TIMERFUNCTION 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLMOPT_TIMERFUNCTION \- callback to receive timeout values
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-int timer_callback(CURLM *multi,    /* multi handle */
-                   long timeout_ms, /* timeout in number of ms */
-                   void *clientp);    /* private callback pointer */
-
-CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_TIMERFUNCTION, timer_callback);
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-Certain features, such as timeouts and retries, require you to call libcurl
-even when there is no activity on the file descriptors.
-
-Your callback function \fBtimer_callback\fP should install a non-repeating
-timer with an expire time of \fBtimeout_ms\fP milliseconds. When that timer
-fires, call either \fIcurl_multi_socket_action(3)\fP or
-\fIcurl_multi_perform(3)\fP, depending on which interface you use.
-
-A \fBtimeout_ms\fP value of -1 passed to this callback means you should delete
-the timer. All other values are valid expire times in number of milliseconds.
-
-The \fBtimer_callback\fP is called when the timeout expire time is changed.
-
-The \fBclientp\fP pointer is set with \fICURLMOPT_TIMERDATA(3)\fP.
-
-The timer callback should return 0 on success, and -1 on error. If this
-callback returns error, \fBall\fP transfers currently in progress in this
-multi handle are aborted and made to fail.
-
-This callback can be used instead of, or in addition to,
-\fIcurl_multi_timeout(3)\fP.
-
-\fBWARNING:\fP do not call libcurl directly from within the callback itself
-when the \fBtimeout_ms\fP value is zero, since it risks triggering an
-unpleasant recursive behavior that immediately calls another call to the
-callback with a zero timeout...
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-static gboolean timeout_cb(gpointer user_data)
-{
-  int running;
-  if(user_data) {
-    g_free(user_data);
-    curl_multi_setopt(curl_handle, CURLMOPT_TIMERDATA, NULL);
-  }
-  curl_multi_socket_action(multi, CURL_SOCKET_TIMEOUT, 0, &running);
-  return G_SOURCE_REMOVE;
-}
-
-static int timerfunc(CURLM *multi, long timeout_ms, void *clientp)
-{
-  guint *id = clientp;
-
-  if(id)
-    g_source_remove(*id);
-
-  /* -1 means we should just delete our timer. */
-  if(timeout_ms == -1) {
-    g_free(id);
-    id = NULL;
-  }
-  else {
-    if(!id)
-      id = g_new(guint, 1);
-    *id = g_timeout_add(timeout_ms, timeout_cb, id);
-  }
-  current_timer = id;
-  return 0;
-}
-
-curl_multi_setopt(multi, CURLMOPT_TIMERFUNCTION, timerfunc);
-.fi
-.SH AVAILABILITY
-Added in 7.16.0
-.SH RETURN VALUE
-Returns CURLM_OK if the option is supported, and CURLM_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLMOPT_TIMERDATA "(3), " CURLMOPT_SOCKETFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLMOPT_TIMERFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLMOPT_TIMERFUNCTION.md
new file mode 100644
index 0000000000..ac55fb351b
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLMOPT_TIMERFUNCTION.md
@@ -0,0 +1,111 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLMOPT_TIMERFUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_SOCKETFUNCTION (3)
+  - CURLMOPT_TIMERDATA (3)
+Protocol:
+  - All
+Added-in: 7.16.0
+---
+
+# NAME
+
+CURLMOPT_TIMERFUNCTION - callback to receive timeout values
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+int timer_callback(CURLM *multi,    /* multi handle */
+                   long timeout_ms, /* timeout in number of ms */
+                   void *clientp);  /* private callback pointer */
+
+CURLMcode curl_multi_setopt(CURLM *handle, CURLMOPT_TIMERFUNCTION, timer_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+Certain features, such as timeouts and retries, require you to call libcurl
+even when there is no activity on the file descriptors.
+
+Your callback function **timer_callback** should install a single
+non-repeating timer with an expire time of **timeout_ms** milliseconds. When
+that timer fires, call either curl_multi_socket_action(3) or
+curl_multi_perform(3), depending on which interface you use.
+
+If this callback is called when a timer is already running, this new expire
+time *replaces* the former timeout. The application should then effectively
+cancel the old timeout and set a new timeout using this new expire time.
+
+A **timeout_ms** value of -1 passed to this callback means you should delete
+the timer. All other values are valid expire times in number of milliseconds -
+including zero milliseconds.
+
+The **timer_callback** is called when the timeout expire time is changed.
+
+The **clientp** pointer is set with CURLMOPT_TIMERDATA(3).
+
+The timer callback should return 0 on success, and -1 on error. If this
+callback returns error, **all** transfers currently in progress in this multi
+handle are aborted and made to fail.
+
+This callback can be used instead of, or in addition to,
+curl_multi_timeout(3).
+
+**WARNING:** do not call libcurl directly from within the callback itself when
+the **timeout_ms** value is zero, since it risks triggering an unpleasant
+recursive behavior that immediately calls another call to the callback with a
+zero timeout...
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct priv {
+  void *custom;
+};
+
+static int timerfunc(CURLM *multi, long timeout_ms, void *clientp)
+{
+  struct priv *mydata = clientp;
+  printf("our ptr: %p\n", mydata->custom);
+
+  if(timeout_ms >= 0) {
+    /* this is the new single timeout to wait for, including zero */
+  }
+  else {
+    /* delete the timeout, nothing to wait for now */
+  }
+  return 0;
+}
+
+int main(void)
+{
+  struct priv mydata;
+  CURLM *multi = curl_multi_init();
+  curl_multi_setopt(multi, CURLMOPT_TIMERFUNCTION, timerfunc);
+  curl_multi_setopt(multi, CURLMOPT_TIMERDATA, &mydata);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_multi_setopt(3) returns a CURLMcode indicating success or error.
+
+CURLM_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_ABSTRACT_UNIX_SOCKET.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_ABSTRACT_UNIX_SOCKET.3
deleted file mode 100644
index b453931a60..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_ABSTRACT_UNIX_SOCKET.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_ABSTRACT_UNIX_SOCKET 3 "08 Jan 2017" libcurl libcurl
-.SH NAME
-CURLOPT_ABSTRACT_UNIX_SOCKET \- abstract Unix domain socket
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ABSTRACT_UNIX_SOCKET,
-                          char *path);
-.fi
-.SH DESCRIPTION
-Enables the use of an abstract Unix domain socket instead of establishing a
-TCP connection to a host. The parameter should be a char * to a
-null-terminated string holding the path of the socket. The path is set to
-\fIpath\fP prefixed by a NULL byte. This is the convention for abstract
-sockets, however it should be stressed that the path passed to this function
-should not contain a leading NULL byte.
-
-On non-supporting platforms, the abstract address is interpreted as an empty
-string and fails gracefully, generating a runtime error.
-
-This option shares the same semantics as \fICURLOPT_UNIX_SOCKET_PATH(3)\fP in
-which documentation more details can be found. Internally, these two options
-share the same storage and therefore only one of them can be set per handle.
-.SH DEFAULT
-Default is NULL.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-  curl_easy_setopt(curl_handle, CURLOPT_ABSTRACT_UNIX_SOCKET, "/tmp/foo.sock");
-  curl_easy_setopt(curl_handle, CURLOPT_URL, "http://localhost/");
-.fi
-
-.SH AVAILABILITY
-Added in 7.53.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_UNIX_SOCKET_PATH "(3), " unix "(7), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_ABSTRACT_UNIX_SOCKET.md b/third-party/curl/docs/libcurl/opts/CURLOPT_ABSTRACT_UNIX_SOCKET.md
new file mode 100644
index 0000000000..d13cf7c180
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_ABSTRACT_UNIX_SOCKET.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_ABSTRACT_UNIX_SOCKET
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_UNIX_SOCKET_PATH (3)
+  - unix (7)
+Protocol:
+  - All
+Added-in: 7.53.0
+---
+
+# NAME
+
+CURLOPT_ABSTRACT_UNIX_SOCKET - abstract Unix domain socket
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ABSTRACT_UNIX_SOCKET,
+                          char *path);
+~~~
+
+# DESCRIPTION
+
+Enables the use of an abstract Unix domain socket instead of establishing a
+TCP connection to a host. The parameter should be a char * to a
+null-terminated string holding the path of the socket. The path is set to
+*path* prefixed by a NULL byte. This is the convention for abstract
+sockets, however it should be stressed that the path passed to this function
+should not contain a leading NULL byte.
+
+On non-supporting platforms, the abstract address is interpreted as an empty
+string and fails gracefully, generating a runtime error.
+
+This option shares the same semantics as CURLOPT_UNIX_SOCKET_PATH(3) in
+which documentation more details can be found. Internally, these two options
+share the same storage and therefore only one of them can be set per handle.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_ABSTRACT_UNIX_SOCKET, "/tmp/foo.sock");
+    curl_easy_setopt(curl, CURLOPT_URL, "http://localhost/");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_ACCEPTTIMEOUT_MS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_ACCEPTTIMEOUT_MS.3
deleted file mode 100644
index 5efd09f724..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_ACCEPTTIMEOUT_MS.3
+++ /dev/null
@@ -1,58 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_ACCEPTTIMEOUT_MS 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_ACCEPTTIMEOUT_MS \- timeout waiting for FTP server to connect back
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ACCEPTTIMEOUT_MS, long ms);
-.fi
-.SH DESCRIPTION
-Pass a long telling libcurl the maximum number of milliseconds to wait for a
-server to connect back to libcurl when an active FTP connection is used.
-.SH DEFAULT
-60000 milliseconds
-.SH PROTOCOLS
-FTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/path/file");
-
-  /* wait no more than 5 seconds for FTP server responses */
-  curl_easy_setopt(curl, CURLOPT_ACCEPTTIMEOUT_MS, 5000L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.24.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_STDERR "(3), " CURLOPT_DEBUGFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_ACCEPTTIMEOUT_MS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_ACCEPTTIMEOUT_MS.md
new file mode 100644
index 0000000000..41e43df9e5
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_ACCEPTTIMEOUT_MS.md
@@ -0,0 +1,70 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_ACCEPTTIMEOUT_MS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CONNECTTIMEOUT_MS (3)
+  - CURLOPT_DEBUGFUNCTION (3)
+  - CURLOPT_STDERR (3)
+  - CURLOPT_FTPPORT (3)
+Protocol:
+  - FTP
+Added-in: 7.24.0
+---
+
+# NAME
+
+CURLOPT_ACCEPTTIMEOUT_MS - timeout waiting for FTP server to connect back
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ACCEPTTIMEOUT_MS, long ms);
+~~~
+
+# DESCRIPTION
+
+Pass a long telling libcurl the maximum number of milliseconds to wait for a
+server to connect back to libcurl when an active FTP connection is used. When
+active FTP is used, the client (libcurl) tells the server to do a TCP connect
+back to the client, instead of vice versa for passive FTP.
+
+This option has no purpose for passive FTP.
+
+# DEFAULT
+
+60000 milliseconds
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/path/file");
+
+    /* wait no more than 5 seconds for the FTP server to connect */
+    curl_easy_setopt(curl, CURLOPT_ACCEPTTIMEOUT_MS, 5000L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_ACCEPT_ENCODING.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_ACCEPT_ENCODING.3
deleted file mode 100644
index 9ade4bddd5..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_ACCEPT_ENCODING.3
+++ /dev/null
@@ -1,108 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_ACCEPT_ENCODING 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_ACCEPT_ENCODING \- automatic decompression of HTTP downloads
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ACCEPT_ENCODING, char *enc);
-.fi
-.SH DESCRIPTION
-Pass a char * argument specifying what encoding you would like.
-
-Sets the contents of the Accept-Encoding: header sent in an HTTP request, and
-enables decoding of a response when a Content-Encoding: header is received.
-
-libcurl potentially supports several different compressed encodings depending
-on what support that has been built-in.
-
-To aid applications not having to bother about what specific algorithms this
-particular libcurl build supports, libcurl allows a zero-length string to be
-set ("") to ask for an Accept-Encoding: header to be used that contains all
-built-in supported encodings.
-
-Alternatively, you can specify exactly the encoding or list of encodings you
-want in the response. The following encodings are supported: \fIidentity\fP,
-meaning non-compressed, \fIdeflate\fP which requests the server to compress
-its response using the zlib algorithm, \fIgzip\fP which requests the gzip
-algorithm, (since curl 7.57.0) \fIbr\fP which is brotli and (since curl
-7.72.0) \fIzstd\fP which is zstd. Provide them in the string as a
-comma-separated list of accepted encodings, like: \fB"br, gzip, deflate"\fP.
-
-Set \fICURLOPT_ACCEPT_ENCODING(3)\fP to NULL to explicitly disable it, which
-makes libcurl not send an Accept-Encoding: header and not decompress received
-contents automatically.
-
-You can also opt to just include the Accept-Encoding: header in your request
-with \fICURLOPT_HTTPHEADER(3)\fP but then there is no automatic decompressing
-when receiving data.
-
-This is a request, not an order; the server may or may not do it.  This option
-must be set (to any non-NULL value) or else any unsolicited encoding done by
-the server is ignored.
-
-Servers might respond with Content-Encoding even without getting a
-Accept-Encoding: in the request. Servers might respond with a different
-Content-Encoding than what was asked for in the request.
-
-The Content-Length: servers send for a compressed response is supposed to
-indicate the length of the compressed content so when auto decoding is enabled
-it may not match the sum of bytes reported by the write callbacks (although,
-sending the length of the non-compressed content is a common server mistake).
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* enable all supported built-in compressions */
-  curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, "");
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-This option was called CURLOPT_ENCODING before 7.21.6
-
-The specific libcurl you are using must have been built with zlib to be able to
-decompress gzip and deflate responses, with the brotli library to
-decompress brotli responses and with the zstd library to decompress zstd
-responses.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_TRANSFER_ENCODING "(3), " CURLOPT_HTTPHEADER "(3), "
-.BR CURLOPT_HTTP_CONTENT_DECODING "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_ACCEPT_ENCODING.md b/third-party/curl/docs/libcurl/opts/CURLOPT_ACCEPT_ENCODING.md
new file mode 100644
index 0000000000..61f28e6e61
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_ACCEPT_ENCODING.md
@@ -0,0 +1,129 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_ACCEPT_ENCODING
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HTTPHEADER (3)
+  - CURLOPT_HTTP_CONTENT_DECODING (3)
+  - CURLOPT_TRANSFER_ENCODING (3)
+Protocol:
+  - HTTP
+Added-in: 7.21.6
+---
+
+# NAME
+
+CURLOPT_ACCEPT_ENCODING - automatic decompression of HTTP downloads
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ACCEPT_ENCODING, char *enc);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer argument specifying what encoding you would like.
+
+Sets the contents of the `Accept-Encoding:` header sent in an HTTP request,
+and enables decoding of a response when a `Content-Encoding:` header is
+received.
+
+libcurl potentially supports several different compressed encodings depending
+on what support that has been built-in.
+
+To aid applications not having to bother about what specific algorithms this
+particular libcurl build supports, libcurl allows a zero-length string to be
+set ("") to ask for an `Accept-Encoding:` header to be used that contains all
+built-in supported encodings.
+
+Alternatively, you can specify exactly the encoding or list of encodings you
+want in the response. The following encodings are supported: *identity*,
+meaning non-compressed, *deflate* which requests the server to compress its
+response using the zlib algorithm, *gzip* which requests the gzip algorithm,
+(since curl 7.57.0) *br* which is brotli and (since curl 7.72.0) *zstd* which
+is zstd. Provide them in the string as a comma-separated list of accepted
+encodings, like: **"br, gzip, deflate"**.
+
+Set CURLOPT_ACCEPT_ENCODING(3) to NULL to explicitly disable it, which makes
+libcurl not send an `Accept-Encoding:` header and not decompress received
+contents automatically.
+
+You can also opt to include the `Accept-Encoding:` header in your request with
+CURLOPT_HTTPHEADER(3) but then there is no automatic decompressing when
+receiving data.
+
+Setting this option is a request, not an order; the server may or may not do
+it. It must be set (to any non-NULL value) or else any encoding done by the
+server is ignored.
+
+Servers might respond with `Content-Encoding:` even without getting a
+`Accept-Encoding:` in the request. Servers might respond with a different
+content encoding than what was asked for in the request.
+
+The `Content-Length:` header field servers send for a compressed response is
+supposed to indicate the length of the compressed content so when auto
+decoding is enabled it may not match the sum of bytes reported by the write
+callbacks (although, sending the length of the non-compressed content is a
+common server mistake).
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones.
+
+**WARNING:** when decompressing data, even tiny transfers might be expanded
+and generate a huge amount of bytes. You might want to limit using this option
+to only known and trusted sites using secure protocols, perhaps in combination
+with CURLOPT_MAXFILESIZE_LARGE(3).
+
+# HISTORY
+
+This option was called CURLOPT_ENCODING before 7.21.6
+
+# NOTES
+
+The specific libcurl you are using must have been built with zlib to be able to
+decompress gzip and deflate responses, with the brotli library to
+decompress brotli responses and with the zstd library to decompress zstd
+responses.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* enable all supported built-in compressions */
+    curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, "");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_ADDRESS_SCOPE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_ADDRESS_SCOPE.3
deleted file mode 100644
index e6a2226528..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_ADDRESS_SCOPE.3
+++ /dev/null
@@ -1,59 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_ADDRESS_SCOPE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_ADDRESS_SCOPE \- scope id for IPv6 addresses
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ADDRESS_SCOPE, long scope);
-.fi
-.SH DESCRIPTION
-Pass a long specifying the scope id value to use when connecting to IPv6 addresses.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-All, when using IPv6
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  long my_scope_id;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  my_scope_id = if_nametoindex("eth0");
-  curl_easy_setopt(curl, CURLOPT_ADDRESS_SCOPE, my_scope_id);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.19.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-Returns CURLE_BAD_FUNCTION_ARGUMENT if set to a negative value.
-.SH "SEE ALSO"
-.BR CURLOPT_STDERR "(3), " CURLOPT_DEBUGFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_ADDRESS_SCOPE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_ADDRESS_SCOPE.md
new file mode 100644
index 0000000000..e2880478fb
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_ADDRESS_SCOPE.md
@@ -0,0 +1,65 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_ADDRESS_SCOPE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DEBUGFUNCTION (3)
+  - CURLOPT_STDERR (3)
+Protocol:
+  - All
+Added-in: 7.19.0
+---
+
+# NAME
+
+CURLOPT_ADDRESS_SCOPE - scope id for IPv6 addresses
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ADDRESS_SCOPE, long scope);
+~~~
+
+# DESCRIPTION
+
+Pass a long specifying the scope id value to use when connecting to IPv6 addresses.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <net/if.h> /* for if_nametoindex() */
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    long my_scope_id;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    my_scope_id = if_nametoindex("eth0");
+    curl_easy_setopt(curl, CURLOPT_ADDRESS_SCOPE, my_scope_id);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
+Returns CURLE_BAD_FUNCTION_ARGUMENT if set to a negative value.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_ALTSVC.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_ALTSVC.3
deleted file mode 100644
index 4f57ce12a8..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_ALTSVC.3
+++ /dev/null
@@ -1,89 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_ALTSVC 3 "5 Feb 2019" libcurl libcurl
-.SH NAME
-CURLOPT_ALTSVC \- alt-svc cache file name
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ALTSVC, char *filename);
-.fi
-.SH DESCRIPTION
-Pass in a pointer to a \fIfilename\fP to instruct libcurl to use that file as
-the Alt-Svc cache to read existing cache contents from and possibly also write
-it back to after a transfer, unless \fBCURLALTSVC_READONLYFILE\fP is set in
-\fICURLOPT_ALTSVC_CTRL(3)\fP.
-
-Specify a blank file name ("") to make libcurl not load from a file at all.
-.SH DEFAULT
-NULL. The alt-svc cache is not read nor written to file.
-.SH PROTOCOLS
-HTTPS
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_ALTSVC_CTRL, CURLALTSVC_H1);
-  curl_easy_setopt(curl, CURLOPT_ALTSVC, "altsvc-cache.txt");
-  curl_easy_perform(curl);
-}
-.fi
-.SH "FILE FORMAT"
-A text based file with one line per alt-svc entry and each line consists of
-nine space-separated fields.
-
-An example line could look like
-
- h2 www.example 8443 h3 second.example 443 "20190808 06:18:37" 1 0
-
-The fields of that line are:
-
-.IP h2
-ALPN id for the source origin
-.IP www.example
-Host name for the source origin
-.IP 8443
-Port number for the source origin
-.IP h3
-ALPN id for the destination host
-.IP second.example
-Host name for the destination host
-.IP 443
-Port number for the destination host
-.IP 2019*
-Expiration date and time of this entry within double quotes. The date format
-is "YYYYMMDD HH:MM:SS" and the time zone is GMT.
-.IP 1
-Boolean (1 or 0) if "persist" was set for this entry
-.IP 0
-Integer priority value (not currently used)
-.SH AVAILABILITY
-Added in 7.64.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_ALTSVC_CTRL "(3), " CURLOPT_CONNECT_TO "(3), " CURLOPT_RESOLVE "(3), "
-.BR CURLOPT_COOKIEFILE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_ALTSVC.md b/third-party/curl/docs/libcurl/opts/CURLOPT_ALTSVC.md
new file mode 100644
index 0000000000..c4058a4039
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_ALTSVC.md
@@ -0,0 +1,136 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_ALTSVC
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_ALTSVC_CTRL (3)
+  - CURLOPT_CONNECT_TO (3)
+  - CURLOPT_COOKIEFILE (3)
+  - CURLOPT_RESOLVE (3)
+Protocol:
+  - HTTP
+Added-in: 7.64.1
+---
+<!-- markdown-link-check-disable -->
+# NAME
+
+CURLOPT_ALTSVC - alt-svc cache filename
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ALTSVC, char *filename);
+~~~
+
+# DESCRIPTION
+
+Pass in a pointer to a *filename* to instruct libcurl to use that file as
+the Alt-Svc cache to read existing cache contents from and possibly also write
+it back to after a transfer, unless **CURLALTSVC_READONLYFILE** is set in
+CURLOPT_ALTSVC_CTRL(3).
+
+Specify a blank filename ("") to make libcurl not load from a file at all.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# SECURITY CONCERNS
+
+libcurl cannot fully protect against attacks where an attacker has write
+access to the same directory where it is directed to save files. This is
+particularly sensitive if you save files using elevated privileges.
+
+libcurl creates the file to store the alt-svc cache in using default file
+permissions, meaning that on *nix systems you may need to restrict your umask
+to prevent other users on the same system to access the file.
+
+# DEFAULT
+
+NULL. The alt-svc cache is not read nor written to file.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_ALTSVC_CTRL, CURLALTSVC_H1);
+    curl_easy_setopt(curl, CURLOPT_ALTSVC, "altsvc-cache.txt");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURLALTSVC_*** macros became `long` types in 8.16.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# FILE FORMAT
+
+A text based file with one line per alt-svc entry and each line consists of
+nine space-separated fields.
+
+An example line could look like
+
+    h2 www.example.com 8443 h3 second.example.com 443 "20190808 06:18:37" 1 0
+
+The fields of that line are:
+
+## h2
+
+ALPN id for the source origin
+
+## www.example.comp
+
+Hostname for the source origin
+
+## 8443
+
+Port number for the source origin
+
+## h3
+
+ALPN id for the destination host
+
+## second.example.com
+
+Hostname for the destination host
+
+## 443
+
+Port number for the destination host
+
+## 2019*
+
+Expiration date and time of this entry within double quotes. The date format
+is "YYYYMMDD HH:MM:SS" and the time zone is GMT.
+
+## 1
+
+Boolean (1 or 0) if "persist" was set for this entry
+
+## 0
+
+Integer priority value (not currently used)
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_ALTSVC_CTRL.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_ALTSVC_CTRL.3
deleted file mode 100644
index c77b4101a5..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_ALTSVC_CTRL.3
+++ /dev/null
@@ -1,86 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_ALTSVC_CTRL 3 "5 Feb 2019" libcurl libcurl
-.SH NAME
-CURLOPT_ALTSVC_CTRL \- control alt-svc behavior
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-#define CURLALTSVC_READONLYFILE (1<<2)
-#define CURLALTSVC_H1           (1<<3)
-#define CURLALTSVC_H2           (1<<4)
-#define CURLALTSVC_H3           (1<<5)
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ALTSVC_CTRL, long bitmask);
-.fi
-.SH DESCRIPTION
-Populate the long \fIbitmask\fP with the correct set of features to instruct
-libcurl how to handle Alt-Svc for the transfers using this handle.
-
-libcurl only accepts Alt-Svc headers over a secure transport, meaning
-HTTPS. It also only completes a request to an alternative origin if that
-origin is properly hosted over HTTPS. These requirements are there to make
-sure both the source and the destination are legitimate.
-
-Alternative services are only used when setting up new connections. If there
-exists an existing connection to the host in the connection pool, then that is
-preferred.
-
-Setting any bit enables the alt-svc engine.
-.IP "CURLALTSVC_READONLYFILE"
-Do not write the alt-svc cache back to the file specified with
-\fICURLOPT_ALTSVC(3)\fP even if it gets updated. By default a file specified
-with that option is read and written to as deemed necessary.
-.IP "CURLALTSVC_H1"
-Accept alternative services offered over HTTP/1.1.
-.IP "CURLALTSVC_H2"
-Accept alternative services offered over HTTP/2. This is only used if libcurl
-was also built to actually support HTTP/2, otherwise this bit is ignored.
-.IP "CURLALTSVC_H3"
-Accept alternative services offered over HTTP/3. This is only used if libcurl
-was also built to actually support HTTP/3, otherwise this bit is ignored.
-.SH DEFAULT
-Alt-Svc handling is disabled by default. If \fICURLOPT_ALTSVC(3)\fP is set,
-\fICURLOPT_ALTSVC_CTRL(3)\fP has a default value corresponding to
-CURLALTSVC_H1 | CURLALTSVC_H2 | CURLALTSVC_H3 - the HTTP/2 and HTTP/3 bits are
-only set if libcurl was built with support for those versions.
-.SH PROTOCOLS
-HTTPS
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_ALTSVC_CTRL, (long)CURLALTSVC_H1);
-  curl_easy_setopt(curl, CURLOPT_ALTSVC, "altsvc-cache.txt");
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.64.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_ALTSVC "(3), " CURLOPT_CONNECT_TO "(3), " CURLOPT_RESOLVE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_ALTSVC_CTRL.md b/third-party/curl/docs/libcurl/opts/CURLOPT_ALTSVC_CTRL.md
new file mode 100644
index 0000000000..22dac41c85
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_ALTSVC_CTRL.md
@@ -0,0 +1,108 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_ALTSVC_CTRL
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_ALTSVC (3)
+  - CURLOPT_CONNECT_TO (3)
+  - CURLOPT_RESOLVE (3)
+Protocol:
+  - HTTP
+Added-in: 7.64.1
+---
+
+# NAME
+
+CURLOPT_ALTSVC_CTRL - control alt-svc behavior
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+#define CURLALTSVC_READONLYFILE (1L << 2)
+#define CURLALTSVC_H1           (1L << 3)
+#define CURLALTSVC_H2           (1L << 4)
+#define CURLALTSVC_H3           (1L << 5)
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ALTSVC_CTRL, long bitmask);
+~~~
+
+# DESCRIPTION
+
+Populate the long *bitmask* with the correct set of features to instruct
+libcurl how to handle Alt-Svc for the transfers using this handle.
+
+libcurl only accepts Alt-Svc headers over HTTPS. It also only completes a
+request to an alternative origin if that origin is properly hosted over HTTPS.
+These requirements are there to make sure both the source and the destination
+are legitimate.
+
+Alternative services are only used when setting up new connections. If there
+exists an existing connection to the host in the connection pool, then that is
+preferred.
+
+If CURLOPT_ALTSVC(3) is set, CURLOPT_ALTSVC_CTRL(3) gets a default value
+corresponding to CURLALTSVC_H1 | CURLALTSVC_H2 | CURLALTSVC_H3 - the HTTP/2
+and HTTP/3 bits are only set if libcurl was built with support for those
+versions.
+
+Setting any bit enables the alt-svc engine.
+
+## CURLALTSVC_READONLYFILE
+
+Do not write the alt-svc cache back to the file specified with
+CURLOPT_ALTSVC(3) even if it gets updated. By default a file specified
+with that option is read and written to as deemed necessary.
+
+## CURLALTSVC_H1
+
+Accept alternative services offered over HTTP/1.1.
+
+## CURLALTSVC_H2
+
+Accept alternative services offered over HTTP/2. This is only used if libcurl
+was also built to actually support HTTP/2, otherwise this bit is ignored.
+
+## CURLALTSVC_H3
+
+Accept alternative services offered over HTTP/3. This is only used if libcurl
+was also built to actually support HTTP/3, otherwise this bit is ignored.
+
+# DEFAULT
+
+0 - Alt-Svc handling is disabled
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_ALTSVC_CTRL, CURLALTSVC_H1);
+    curl_easy_setopt(curl, CURLOPT_ALTSVC, "altsvc-cache.txt");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURLALTSVC_*** macros became `long` types in 8.16.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_APPEND.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_APPEND.3
deleted file mode 100644
index 4e8d1705d0..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_APPEND.3
+++ /dev/null
@@ -1,59 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_APPEND 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_APPEND \- append to the remote file
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_APPEND, long append);
-.fi
-.SH DESCRIPTION
-A long parameter set to 1 tells the library to append to the remote file
-instead of overwrite it. This is only useful when uploading to an FTP site.
-.SH DEFAULT
-0 (disabled)
-.SH PROTOCOLS
-FTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/dir/to/newfile");
-  curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
-  curl_easy_setopt(curl, CURLOPT_APPEND, 1L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-This option was known as CURLOPT_FTPAPPEND up to 7.16.4
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_DIRLISTONLY "(3), " CURLOPT_RESUME_FROM "(3), "
-.BR CURLOPT_UPLOAD "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_APPEND.md b/third-party/curl/docs/libcurl/opts/CURLOPT_APPEND.md
new file mode 100644
index 0000000000..ff20406c51
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_APPEND.md
@@ -0,0 +1,69 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_APPEND
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DIRLISTONLY (3)
+  - CURLOPT_RESUME_FROM (3)
+  - CURLOPT_UPLOAD (3)
+Protocol:
+  - FTP
+  - SFTP
+Added-in: 7.17.0
+---
+
+# NAME
+
+CURLOPT_APPEND - append to the remote file
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_APPEND, long append);
+~~~
+
+# DESCRIPTION
+
+A long parameter set to 1 tells the library to append to the remote file
+instead of overwrite it. This is only useful when uploading to an FTP site.
+
+# DEFAULT
+
+0 (disabled)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/dir/to/newfile");
+    curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+    curl_easy_setopt(curl, CURLOPT_APPEND, 1L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+This option was known as CURLOPT_FTPAPPEND up to 7.16.4
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_AUTOREFERER.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_AUTOREFERER.3
deleted file mode 100644
index 14f1e07b37..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_AUTOREFERER.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_AUTOREFERER 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_AUTOREFERER \- automatically update the referer header
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_AUTOREFERER, long autorefer);
-.fi
-.SH DESCRIPTION
-Pass a long parameter set to 1 to enable this. When enabled, libcurl
-automatically sets the Referer: header field in HTTP requests to the full URL
-when it follows a Location: redirect to a new destination.
-
-The automatic referer is set to the full previous URL even when redirects are
-done cross-origin or following redirects to insecure protocols. This is
-considered a minor privacy leak by some.
-.SH DEFAULT
-0, disabled
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-
-  /* follow redirects */
-  curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
-
-  /* set Referer: automatically when following redirects */
-  curl_easy_setopt(curl, CURLOPT_AUTOREFERER, 1L);
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Along with HTTP
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_REFERER "(3), " CURLOPT_FOLLOWLOCATION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_AUTOREFERER.md b/third-party/curl/docs/libcurl/opts/CURLOPT_AUTOREFERER.md
new file mode 100644
index 0000000000..8bc75d4666
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_AUTOREFERER.md
@@ -0,0 +1,79 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_AUTOREFERER
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_EFFECTIVE_URL (3)
+  - CURLINFO_REDIRECT_URL (3)
+  - CURLINFO_REFERER (3)
+  - CURLOPT_FOLLOWLOCATION (3)
+  - CURLOPT_REFERER (3)
+Protocol:
+  - HTTP
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_AUTOREFERER - automatically update the referer header
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_AUTOREFERER, long autorefer);
+~~~
+
+# DESCRIPTION
+
+Pass a long parameter set to 1 to enable this. When enabled, libcurl
+automatically sets the Referer: header field in HTTP requests to the full URL
+when it follows a Location: redirect to a new destination.
+
+The automatic referer is set to the full previous URL even when redirects are
+done cross-origin or following redirects to insecure protocols. This is
+considered a minor privacy leak by some.
+
+With CURLINFO_REFERER(3), applications can extract the actually used
+referer header after the transfer.
+
+# DEFAULT
+
+0, disabled
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+
+    /* follow redirects */
+    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+
+    /* set Referer: automatically when following redirects */
+    curl_easy_setopt(curl, CURLOPT_AUTOREFERER, 1L);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_AWS_SIGV4.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_AWS_SIGV4.3
deleted file mode 100644
index fbe4fe8eb7..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_AWS_SIGV4.3
+++ /dev/null
@@ -1,105 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.haxx.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_AWS_SIGV4 3 "03 Jun 2020" libcurl libcurl
-.SH NAME
-CURLOPT_AWS_SIGV4 \- V4 signature
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_AWS_SIGV4, char *param);
-.fi
-.SH DESCRIPTION
-Provides AWS V4 signature authentication on HTTP(S) header.
-.PP
-Pass a char * that is the collection of specific arguments are used for
-creating outgoing authentication headers.  The format of the \fIparam\fP
-option is:
-.IP provider1[:provider2[:region[:service]]]
-.IP provider1,\ provider2
-The providers arguments are used for generating some authentication parameters
-such as "Algorithm", "date", "request type" and "signed headers".
-.IP region
-The argument is a geographic area of a resources collection.
-It is extracted from the host name specified in the URL if omitted.
-.IP service
-The argument is a function provided by a cloud.
-It is extracted from the host name specified in the URL if omitted.
-.PP
-NOTE: This call set \fICURLOPT_HTTPAUTH(3)\fP to CURLAUTH_AWS_SIGV4.
-Calling \fICURLOPT_HTTPAUTH(3)\fP with CURLAUTH_AWS_SIGV4 is the same
-as calling this with \fB"aws:amz"\fP in parameter.
-.PP
-Example with "Test:Try", when curl uses the algorithm, it generates
-\fB"TEST-HMAC-SHA256"\fP for "Algorithm", \fB"x-try-date"\fP and
-\fB"X-Try-Date"\fP for "date", \fB"test4_request"\fP for "request type",
-\fB"SignedHeaders=content-type;host;x-try-date"\fP for "signed headers"
-.PP
-If you use just "test", instead of "test:try", test is used for every
-generated string.
-.SH DEFAULT
-By default, the value of this parameter is NULL.
-Calling \fICURLOPT_HTTPAUTH(3)\fP with CURLAUTH_AWS_SIGV4 is the same
-as calling this with \fB"aws:amz"\fP in parameter.
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL,
-                  "https://service.region.example.com/uri");
-  curl_easy_setopt(c, CURLOPT_AWS_SIGV4, "provider1:provider2");
-
-  /* service and region can also be set in CURLOPT_AWS_SIGV4 */
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/uri");
-  curl_easy_setopt(c, CURLOPT_AWS_SIGV4,
-                   "provider1:provider2:region:service");
-
-  curl_easy_setopt(c, CURLOPT_USERPWD, "MY_ACCESS_KEY:MY_SECRET_KEY");
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.75.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH NOTES
-This option overrides the other auth types you might have set in
-\fICURLOPT_HTTPAUTH(3)\fP which should be highlighted as this makes this auth
-method special.  This method cannot be combined with other auth types.
-.PP
-A sha256 checksum of the request payload is used as input to the signature
-calculation.  For POST requests, this is a checksum of the provided
-\fICURLOPT_POSTFIELDS(3)\fP.  Otherwise, it's the checksum of an empty buffer.
-For requests like PUT, you can provide your own checksum in an HTTP header named
-\fBx-provider2-content-sha256\fP.
-.PP
-For \fBaws:s3\fP, a \fBx-amz-content-sha256\fP header is added to every request
-if not already present. For s3 requests with unknown payload, this header takes
-the special value "UNSIGNED-PAYLOAD".
-.SH "SEE ALSO"
-.BR CURLOPT_HEADEROPT "(3), " CURLOPT_HTTPHEADER "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_AWS_SIGV4.md b/third-party/curl/docs/libcurl/opts/CURLOPT_AWS_SIGV4.md
new file mode 100644
index 0000000000..2f17a201c3
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_AWS_SIGV4.md
@@ -0,0 +1,131 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_AWS_SIGV4
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HEADEROPT (3)
+  - CURLOPT_HTTPAUTH (3)
+  - CURLOPT_HTTPHEADER (3)
+  - CURLOPT_PROXYAUTH (3)
+Protocol:
+  - HTTP
+Added-in: 7.75.0
+---
+
+# NAME
+
+CURLOPT_AWS_SIGV4 - V4 signature
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_AWS_SIGV4, char *param);
+~~~
+
+# DESCRIPTION
+
+Provides AWS V4 signature authentication on HTTP(S) header.
+
+Pass a char pointer that is the collection of specific arguments are used for
+creating outgoing authentication headers. The format of the *param* option
+is:
+
+## provider1[:provider2[:region[:service]]]
+
+## provider1, provider2
+
+The providers arguments are used for generating some authentication parameters
+such as "Algorithm", "date", "request type" and "signed headers".
+
+## region
+
+The argument is a geographic area of a resources collection.
+It is extracted from the hostname specified in the URL if omitted.
+
+## service
+
+The argument is a function provided by a cloud. It is extracted from the
+hostname specified in the URL if omitted.
+
+##
+
+NOTE: This call set CURLOPT_HTTPAUTH(3) to CURLAUTH_AWS_SIGV4. Calling
+CURLOPT_HTTPAUTH(3) with CURLAUTH_AWS_SIGV4 is the same as calling this with
+**"aws:amz"** in parameter.
+
+Example with "Test:Try", when curl uses the algorithm, it generates
+**"TEST-HMAC-SHA256"** for "Algorithm", **"x-try-date"** and **"X-Try-Date"**
+for "date", **"test4_request"** for "request type",
+**"SignedHeaders=content-type;host;x-try-date"** for "signed headers"
+
+If you use "test", instead of "test:try", test is used for every generated
+string.
+
+Setting CURLOPT_HTTPAUTH(3) with the CURLAUTH_AWS_SIGV4 bit set is the same as
+setting this option with a **"aws:amz"** parameter.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL,
+                    "https://service.region.example.com/uri");
+    curl_easy_setopt(curl, CURLOPT_AWS_SIGV4, "provider1:provider2");
+
+    /* service and region can also be set in CURLOPT_AWS_SIGV4 */
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/uri");
+    curl_easy_setopt(curl, CURLOPT_AWS_SIGV4,
+                     "provider1:provider2:region:service");
+
+    curl_easy_setopt(curl, CURLOPT_USERPWD, "MY_ACCESS_KEY:MY_SECRET_KEY");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# NOTES
+
+This option overrides the other auth types you might have set in
+CURLOPT_HTTPAUTH(3) which should be highlighted as this makes this auth method
+special. This method cannot be combined with other auth types.
+
+A sha256 checksum of the request payload is used as input to the signature
+calculation. For POST requests, this is a checksum of the provided
+CURLOPT_POSTFIELDS(3). Otherwise, it is the checksum of an empty buffer. For
+requests like PUT, you can provide your own checksum in an HTTP header named
+**x-provider2-content-sha256**.
+
+For **aws:s3**, a **x-amz-content-sha256** header is added to every request if
+not already present. For s3 requests with unknown payload, this header takes
+the special value "UNSIGNED-PAYLOAD".
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_BUFFERSIZE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_BUFFERSIZE.3
deleted file mode 100644
index d2c9165a02..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_BUFFERSIZE.3
+++ /dev/null
@@ -1,75 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_BUFFERSIZE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_BUFFERSIZE \- receive buffer size
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_BUFFERSIZE, long size);
-.fi
-.SH DESCRIPTION
-Pass a long specifying your preferred \fIsize\fP (in bytes) for the receive
-buffer in libcurl.  The main point of this would be that the write callback
-gets called more often and with smaller chunks. Secondly, for some protocols,
-there is a benefit of having a larger buffer for performance.
-
-This is just treated as a request, not an order. You cannot be guaranteed to
-actually get the given size.
-
-This buffer size is by default \fICURL_MAX_WRITE_SIZE\fP (16kB). The maximum
-buffer size allowed to be set is \fICURL_MAX_READ_SIZE\fP (10MB). The minimum
-buffer size allowed to be set is 1024.
-
-DO NOT set this option on a handle that is currently used for an active
-transfer as that may lead to unintended consequences.
-
-The maximum size was 512kB until 7.88.0.
-.SH DEFAULT
-CURL_MAX_WRITE_SIZE (16kB)
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/foo.bin");
-
-  /* ask libcurl to allocate a larger receive buffer */
-  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 120000L);
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.10.  Growing the buffer was added in 7.53.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_MAX_RECV_SPEED_LARGE "(3), " CURLOPT_WRITEFUNCTION "(3), "
-.BR CURLOPT_UPLOAD_BUFFERSIZE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_BUFFERSIZE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_BUFFERSIZE.md
new file mode 100644
index 0000000000..e517a30bc4
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_BUFFERSIZE.md
@@ -0,0 +1,86 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_BUFFERSIZE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_MAXFILESIZE (3)
+  - CURLOPT_MAX_RECV_SPEED_LARGE (3)
+  - CURLOPT_UPLOAD_BUFFERSIZE (3)
+  - CURLOPT_WRITEFUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.10
+---
+
+# NAME
+
+CURLOPT_BUFFERSIZE - receive buffer size
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_BUFFERSIZE, long size);
+~~~
+
+# DESCRIPTION
+
+Pass a long specifying your preferred *size* (in bytes) for the receive buffer
+in libcurl. The main point of this would be that the write callback gets
+called more often and with smaller chunks. Secondly, for some protocols, there
+is a benefit of having a larger buffer for performance.
+
+This is treated as a request, not an order. You cannot be guaranteed to
+actually get the given size.
+
+This buffer size is by default *CURL_MAX_WRITE_SIZE* (16kB). The maximum
+buffer size allowed to be set is *CURL_MAX_READ_SIZE* (10MB). The minimum
+buffer size allowed to be set is 1024.
+
+DO NOT set this option on a handle that is currently used for an active
+transfer as that may lead to unintended consequences.
+
+The maximum size was 512kB until 7.88.0.
+
+Starting in libcurl 8.7.0, there is a single transfer buffer allocated per
+multi handle. This buffer is used by all easy handles added to a multi handle
+no matter how many parallel transfers there are. The buffer remains allocated
+as long as there are active transfers.
+
+# DEFAULT
+
+CURL_MAX_WRITE_SIZE (16kB)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/foo.bin");
+
+    /* ask libcurl to allocate a larger receive buffer */
+    curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 120000L);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CAINFO.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CAINFO.3
deleted file mode 100644
index c57994aa85..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CAINFO.3
+++ /dev/null
@@ -1,83 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CAINFO 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_CAINFO \- path to Certificate Authority (CA) bundle
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CAINFO, char *path);
-.fi
-.SH DESCRIPTION
-Pass a char * to a null-terminated string naming a file holding one or more
-certificates to verify the peer with.
-
-If \fICURLOPT_SSL_VERIFYPEER(3)\fP is zero and you avoid verifying the
-server's certificate, \fICURLOPT_CAINFO(3)\fP need not even indicate an
-accessible file.
-
-This option is by default set to the system path where libcurl's CA
-certificate bundle is assumed to be stored, as established at build time.
-
-(iOS and macOS) When curl uses Secure Transport this option is supported. If
-the option is not set, then curl uses the certificates in the system and user
-Keychain to verify the peer.
-
-(Schannel) This option is supported for Schannel in Windows 7 or later but we
-recommend not using it until Windows 8 since it works better starting then.
-If the option is not set, then curl uses the certificates in the Windows'
-store of root certificates (the default for Schannel).
-
-The application does not have to keep the string around after setting this
-option.
-
-The default value for this can be figured out with \fICURLINFO_CAINFO(3)\fP.
-.SH DEFAULT
-Built-in system specific. When curl is built with Secure Transport or
-Schannel, this option is not set by default.
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_CAINFO, "/etc/certs/cabundle.pem");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-For the SSL engines that do not support certificate files the
-\fICURLOPT_CAINFO(3)\fP option is ignored. Schannel support added in libcurl
-7.60.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_CAINFO_BLOB "(3), " CURLOPT_CAPATH "(3), "
-.BR CURLOPT_SSL_VERIFYPEER "(3), " CURLOPT_SSL_VERIFYHOST "(3), "
-.BR CURLINFO_CAINFO "(3), " CURLOPT_CA_CACHE_TIMEOUT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CAINFO.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CAINFO.md
new file mode 100644
index 0000000000..8618367728
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CAINFO.md
@@ -0,0 +1,92 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CAINFO
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CAINFO (3)
+  - CURLOPT_CAINFO_BLOB (3)
+  - CURLOPT_CAPATH (3)
+  - CURLOPT_CA_CACHE_TIMEOUT (3)
+  - CURLOPT_SSL_VERIFYHOST (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - All
+Added-in: 7.4.2
+---
+
+# NAME
+
+CURLOPT_CAINFO - path to Certificate Authority (CA) bundle
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CAINFO, char *path);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer to a null-terminated string naming a file holding one or
+more certificates to verify the peer with.
+
+If CURLOPT_SSL_VERIFYPEER(3) is zero and you avoid verifying the
+server's certificate, CURLOPT_CAINFO(3) need not even indicate an
+accessible file.
+
+This option is by default set to the system path where libcurl's CA
+certificate bundle is assumed to be stored, as established at build time.
+
+(Schannel) This option is supported for Schannel in Windows 7 or later but we
+recommend not using it until Windows 8 since it works better starting then.
+If the option is not set, then curl uses the certificates in the Windows'
+store of root certificates (the default for Schannel).
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+The default value for this can be figured out with CURLINFO_CAINFO(3).
+
+# DEFAULT
+
+Built-in system specific. When curl is built with Schannel, this option is not
+set by default.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_CAINFO, "/etc/certs/cabundle.pem");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+Schannel support added in libcurl 7.60.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CAINFO_BLOB.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CAINFO_BLOB.3
deleted file mode 100644
index 620aa4c55d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CAINFO_BLOB.3
+++ /dev/null
@@ -1,73 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CAINFO_BLOB 3 "31 March 2021" libcurl libcurl
-.SH NAME
-CURLOPT_CAINFO_BLOB \- Certificate Authority (CA) bundle in PEM format
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CAINFO_BLOB,
-                          struct curl_blob *stblob);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a curl_blob structure, which contains information (pointer
-and size) about a memory block with binary data of PEM encoded content holding
-one or more certificates to verify the HTTPS server with.
-
-If \fICURLOPT_SSL_VERIFYPEER(3)\fP is zero and you avoid verifying the
-server's certificate, \fICURLOPT_CAINFO_BLOB(3)\fP is not needed.
-
-This option overrides \fICURLOPT_CAINFO(3)\fP.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-char *strpem; /* strpem must point to a PEM string */
-CURL *curl = curl_easy_init();
-if(curl) {
-  struct curl_blob blob;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  blob.data = strpem;
-  blob.len = strlen(strpem);
-  blob.flags = CURL_BLOB_COPY;
-  curl_easy_setopt(curl, CURLOPT_CAINFO_BLOB, &blob);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.77.0.
-
-This option is supported by the BearSSL (since 7.79.0), mbedTLS (since 7.81.0),
-rustls (since 7.82.0), wolfSSL (since 8.2.0), OpenSSL, Secure Transport and Schannel backends.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_CAINFO "(3), " CURLOPT_CAPATH "(3), "
-.BR CURLOPT_SSL_VERIFYPEER "(3), " CURLOPT_SSL_VERIFYHOST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CAINFO_BLOB.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CAINFO_BLOB.md
new file mode 100644
index 0000000000..ffced772b4
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CAINFO_BLOB.md
@@ -0,0 +1,93 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CAINFO_BLOB
+Section: 3
+Source: libcurl
+Protocol:
+  - TLS
+See-also:
+  - CURLOPT_CAINFO (3)
+  - CURLOPT_CAPATH (3)
+  - CURLOPT_SSL_VERIFYHOST (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+  - mbedTLS
+  - Rustls
+  - wolfSSL
+  - Schannel
+Added-in: 7.77.0
+---
+
+# NAME
+
+CURLOPT_CAINFO_BLOB - Certificate Authority (CA) bundle in PEM format
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CAINFO_BLOB,
+                          struct curl_blob *stblob);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a curl_blob structure, which contains information (pointer
+and size) about a memory block with binary data of PEM encoded content holding
+one or more certificates to verify the HTTPS server with.
+
+If the blob is initialized with the flags member of struct curl_blob set to
+CURL_BLOB_COPY, the application does not have to keep the buffer around after
+setting this.
+
+If CURLOPT_SSL_VERIFYPEER(3) is zero and you avoid verifying the
+server's certificate, CURLOPT_CAINFO_BLOB(3) is not needed.
+
+This option overrides CURLOPT_CAINFO(3).
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <string.h>
+
+int main(void)
+{
+  char *strpem = "PEMDATA"; /* strpem must point to a PEM string */
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    struct curl_blob blob;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    blob.data = strpem;
+    blob.len = strlen(strpem);
+    blob.flags = CURL_BLOB_COPY;
+    curl_easy_setopt(curl, CURLOPT_CAINFO_BLOB, &blob);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+This option is supported by the mbedTLS (since 7.81.0), Rustls (since 7.82.0),
+wolfSSL (since 8.2.0), GnuTLS (since 8.18.0), OpenSSL and Schannel backends.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CAPATH.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CAPATH.3
deleted file mode 100644
index 488164826a..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CAPATH.3
+++ /dev/null
@@ -1,76 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CAPATH 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_CAPATH \- directory holding CA certificates
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CAPATH, char *capath);
-.fi
-.SH DESCRIPTION
-Pass a char * to a null-terminated string naming a directory holding multiple
-CA certificates to verify the peer with. If libcurl is built against OpenSSL,
-the certificate directory must be prepared using the OpenSSL c_rehash utility.
-This makes sense only when used in combination with the
-\fICURLOPT_SSL_VERIFYPEER(3)\fP option.
-
-The \fICURLOPT_CAPATH(3)\fP function apparently does not work in Windows due
-to some limitation in OpenSSL.
-
-The application does not have to keep the string around after setting this
-option.
-
-The default value for this can be figured out with \fICURLINFO_CAPATH(3)\fP.
-.SH DEFAULT
-A default path detected at build time.
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_CAPATH, "/etc/cert-dir");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-This option is supported by the OpenSSL, GnuTLS and mbedTLS (since 7.56.0)
-backends.
-.SH RETURN VALUE
-CURLE_OK if supported; or an error such as:
-
-CURLE_NOT_BUILT_IN - Not supported by the SSL backend
-
-CURLE_UNKNOWN_OPTION
-
-CURLE_OUT_OF_MEMORY
-.SH "SEE ALSO"
-.BR CURLOPT_CAINFO "(3), "
-.BR CURLOPT_STDERR "(3), " CURLOPT_DEBUGFUNCTION "(3), "
-.BR CURLINFO_CAPATH "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CAPATH.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CAPATH.md
new file mode 100644
index 0000000000..b82b40fe8e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CAPATH.md
@@ -0,0 +1,85 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CAPATH
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CAPATH (3)
+  - CURLOPT_CAINFO (3)
+  - CURLOPT_DEBUGFUNCTION (3)
+  - CURLOPT_STDERR (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+  - mbedTLS
+  - wolfSSL
+Added-in: 7.9.8
+---
+
+# NAME
+
+CURLOPT_CAPATH - directory holding CA certificates
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CAPATH, char *capath);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer to a null-terminated string naming a directory holding
+multiple CA certificates to verify the peer with. If libcurl is built against
+OpenSSL, the certificate directory must be prepared using the OpenSSL c_rehash
+utility. This makes sense only when used in combination with the
+CURLOPT_SSL_VERIFYPEER(3) option.
+
+The CURLOPT_CAPATH(3) function apparently does not work in Windows due
+to some limitation in OpenSSL.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+The default value for this can be figured out with CURLINFO_CAPATH(3).
+
+# DEFAULT
+
+A path detected at build time.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_CAPATH, "/etc/cert-dir");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+CURLE_OK if supported; or an error such as:
+
+CURLE_NOT_BUILT_IN - Not supported by the SSL backend
+
+CURLE_UNKNOWN_OPTION
+
+CURLE_OUT_OF_MEMORY
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CA_CACHE_TIMEOUT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CA_CACHE_TIMEOUT.3
deleted file mode 100644
index d0246b5c74..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CA_CACHE_TIMEOUT.3
+++ /dev/null
@@ -1,78 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CA_CACHE_TIMEOUT 3 "21 Dec 2022" libcurl libcurl
-.SH NAME
-CURLOPT_CA_CACHE_TIMEOUT \- life-time for cached certificate stores
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CA_CACHE_TIMEOUT, long age);
-.fi
-.SH DESCRIPTION
-Pass a long, this sets the timeout in seconds. This tells libcurl the maximum
-time any cached certificate store it has in memory may be kept and reused for
-new connections. Once the timeout has expired, a subsequent fetch requiring a
-certificate has to reload it.
-
-Building a certificate store from a \fICURLOPT_CAINFO\fP file is a slow
-operation so curl may cache the generated certificate store internally to speed
-up future connections.
-
-Set to zero to completely disable caching, or set to -1 to retain the cached
-store remain forever. By default, libcurl caches this info for 24 hours.
-.SH DEFAULT
-86400 (24 hours)
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-
-  /* only reuse certificate stores for a short time */
-  curl_easy_setopt(curl, CURLOPT_CA_CACHE_TIMEOUT, 60L);
-
-  ret = curl_easy_perform(curl);
-
-  /* in this second request, the cache is not used if more than
-     sixty seconds passed since the previous connection */
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-This option was added in curl 7.87.0.
-
-Currently the only SSL backend to implement this certificate store caching
-functionality is the OpenSSL (and forks) backend.
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_CAINFO "(3), "
-.BR CURLOPT_CAINFO_BLOB "(3), " CURLOPT_CAPATH "(3), "
-.BR CURLOPT_SSL_VERIFYPEER "(3), " CURLOPT_SSL_VERIFYHOST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CA_CACHE_TIMEOUT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CA_CACHE_TIMEOUT.md
new file mode 100644
index 0000000000..af677d8b14
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CA_CACHE_TIMEOUT.md
@@ -0,0 +1,92 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CA_CACHE_TIMEOUT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CAINFO (3)
+  - CURLOPT_CAINFO_BLOB (3)
+  - CURLOPT_CAPATH (3)
+  - CURLOPT_SSL_VERIFYHOST (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - GnuTLS
+  - OpenSSL
+  - Schannel
+  - wolfSSL
+Added-in: 7.87.0
+---
+
+# NAME
+
+CURLOPT_CA_CACHE_TIMEOUT - life-time for cached certificate stores
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CA_CACHE_TIMEOUT, long age);
+~~~
+
+# DESCRIPTION
+
+Pass a long, this sets the timeout in seconds. This tells libcurl the maximum
+time any cached CA certificate store it has in memory may be kept and reused
+for new connections. Once the timeout has expired, a subsequent fetch
+requiring a CA certificate has to reload it.
+
+Building a CA certificate store from a CURLOPT_CAINFO(3) file is a slow
+operation so curl may cache the generated certificate store internally to
+speed up future connections.
+
+Set the timeout to zero to completely disable caching, or set to -1 to retain
+the cached store remain forever. By default, libcurl caches this info for 24
+hours.
+
+# DEFAULT
+
+86400 (24 hours)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+
+    /* only reuse certificate stores for a short time */
+    curl_easy_setopt(curl, CURLOPT_CA_CACHE_TIMEOUT, 60L);
+
+    result = curl_easy_perform(curl);
+
+    /* in this second request, the cache is not used if more than
+       sixty seconds passed since the previous connection */
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+This option is supported by OpenSSL and its forks (since 7.87.0), Schannel
+(since 8.5.0), wolfSSL (since 8.9.0) and GnuTLS (since 8.9.0).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CERTINFO.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CERTINFO.3
deleted file mode 100644
index a55b754178..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CERTINFO.3
+++ /dev/null
@@ -1,83 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CERTINFO 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_CERTINFO \- request SSL certificate information
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CERTINFO, long certinfo);
-.fi
-.SH DESCRIPTION
-Pass a long set to 1 to enable libcurl's certificate chain info gatherer. With
-this enabled, libcurl extracts lots of information and data about the
-certificates in the certificate chain used in the SSL connection. This data
-may then be retrieved after a transfer using \fIcurl_easy_getinfo(3)\fP and
-its option \fICURLINFO_CERTINFO(3)\fP.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-All TLS-based
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");
-
-  /* connect to any HTTPS site, trusted or not */
-  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
-  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
-
-  curl_easy_setopt(curl, CURLOPT_CERTINFO, 1L);
-
-  res = curl_easy_perform(curl);
-
-  if (!res) {
-    struct curl_certinfo *ci;
-    res = curl_easy_getinfo(curl, CURLINFO_CERTINFO, &ci);
-
-    if (!res) {
-      printf("%d certs!\\n", ci->num_of_certs);
-
-      for(i = 0; i < ci->num_of_certs; i++) {
-        struct curl_slist *slist;
-
-        for(slist = ci->certinfo[i]; slist; slist = slist->next)
-          printf("%s\\n", slist->data);
-      }
-    }
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-This option is supported by the OpenSSL, GnuTLS, Schannel and Secure
-Transport backends. Schannel support added in 7.50.0. Secure Transport support
-added in 7.79.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_CAINFO "(3), " CURLOPT_SSL_VERIFYPEER "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CERTINFO.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CERTINFO.md
new file mode 100644
index 0000000000..fdaa0d2132
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CERTINFO.md
@@ -0,0 +1,99 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CERTINFO
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CAINFO (3)
+  - CURLINFO_CAPATH (3)
+  - CURLINFO_CERTINFO (3)
+  - CURLOPT_CAINFO (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+  - Schannel
+  - Rustls
+Added-in: 7.19.1
+---
+
+# NAME
+
+CURLOPT_CERTINFO - request SSL certificate information
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CERTINFO, long certinfo);
+~~~
+
+# DESCRIPTION
+
+Pass a long set to 1 to enable libcurl's certificate chain info gatherer. With
+this enabled, libcurl extracts lots of information and data about the
+certificates in the certificate chain used in the SSL connection. This data
+may then be retrieved after a transfer using curl_easy_getinfo(3) and
+its option CURLINFO_CERTINFO(3).
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");
+
+    /* connect to any HTTPS site, trusted or not */
+    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
+
+    curl_easy_setopt(curl, CURLOPT_CERTINFO, 1L);
+
+    result = curl_easy_perform(curl);
+
+    if(result == CURLE_OK) {
+      struct curl_certinfo *ci;
+      result = curl_easy_getinfo(curl, CURLINFO_CERTINFO, &ci);
+
+      if(result == CURLE_OK) {
+        int i;
+        printf("%d certs!\n", ci->num_of_certs);
+
+        for(i = 0; i < ci->num_of_certs; i++) {
+          struct curl_slist *slist;
+
+          for(slist = ci->certinfo[i]; slist; slist = slist->next)
+            printf("%s\n", slist->data);
+        }
+      }
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+Schannel support added in 7.50.0. mbedTLS support added in 8.9.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_BGN_FUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_BGN_FUNCTION.3
deleted file mode 100644
index bd7cfb45b0..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_BGN_FUNCTION.3
+++ /dev/null
@@ -1,143 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CHUNK_BGN_FUNCTION 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_CHUNK_BGN_FUNCTION \- callback before a transfer with FTP wildcard match
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-struct curl_fileinfo {
-  char *filename;
-  curlfiletype filetype;
-  time_t time;   /* always zero! */
-  unsigned int perm;
-  int uid;
-  int gid;
-  curl_off_t size;
-  long int hardlinks;
-
-  struct {
-    /* If some of these fields is not NULL, it is a pointer to b_data. */
-    char *time;
-    char *perm;
-    char *user;
-    char *group;
-    char *target; /* pointer to the target filename of a symlink */
-  } strings;
-
-  unsigned int flags;
-
-  /* used internally */
-  char *b_data;
-  size_t b_size;
-  size_t b_used;
-};
-
-long chunk_bgn_callback(const void *transfer_info, void *ptr,
-                        int remains);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CHUNK_BGN_FUNCTION,
-                          chunk_bgn_callback);
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-This callback function gets called by libcurl before a part of the stream is
-going to be transferred (if the transfer supports chunks).
-
-The \fItransfer_info\fP pointer points to a \fBcurl_fileinfo\fP struct with
-details about the file that is about to get transferred.
-
-This callback makes sense only when using the \fICURLOPT_WILDCARDMATCH(3)\fP
-option for now.
-
-The target of transfer_info parameter is a "feature depended" structure. For
-the FTP wildcard download, the target is \fBcurl_fileinfo\fP structure (see
-\fIcurl/curl.h\fP).  The parameter \fIptr\fP is a pointer given by
-\fICURLOPT_CHUNK_DATA(3)\fP. The parameter remains contains number of chunks
-remaining per the transfer. If the feature is not available, the parameter has
-zero value.
-
-Return \fICURL_CHUNK_BGN_FUNC_OK\fP if everything is fine,
-\fICURL_CHUNK_BGN_FUNC_SKIP\fP if you want to skip the concrete chunk or
-\fICURL_CHUNK_BGN_FUNC_FAIL\fP to tell libcurl to stop if some error occurred.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-FTP
-.SH EXAMPLE
-.nf
-static long file_is_coming(struct curl_fileinfo *finfo,
-                           struct callback_data *data,
-                           int remains)
-{
-  printf("%3d %40s %10luB ", remains, finfo->filename,
-         (unsigned long)finfo->size);
-
-  switch(finfo->filetype) {
-  case CURLFILETYPE_DIRECTORY:
-    printf(" DIR\\n");
-    break;
-  case CURLFILETYPE_FILE:
-    printf("FILE ");
-    break;
-  default:
-    printf("OTHER\\n");
-    break;
-  }
-
-  if(finfo->filetype == CURLFILETYPE_FILE) {
-    /* do not transfer files >= 50B */
-    if(finfo->size > 50) {
-      printf("SKIPPED\\n");
-      return CURL_CHUNK_BGN_FUNC_SKIP;
-    }
-
-    data->output = fopen(finfo->filename, "wb");
-    if(!data->output) {
-      return CURL_CHUNK_BGN_FUNC_FAIL;
-    }
-  }
-
-  return CURL_CHUNK_BGN_FUNC_OK;
-}
-
-int main()
-{
-  /* data for callback */
-  struct callback_data callback_info;
-
-  /* callback is called before download of concrete file started */
-  curl_easy_setopt(curl, CURLOPT_CHUNK_BGN_FUNCTION, file_is_coming);
-  curl_easy_setopt(curl, CURLOPT_CHUNK_DATA, &callback_info);
-}
-.fi
-.SH AVAILABILITY
-This was added in 7.21.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_CHUNK_END_FUNCTION "(3), " CURLOPT_WILDCARDMATCH "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_BGN_FUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_BGN_FUNCTION.md
new file mode 100644
index 0000000000..c04ebe3051
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_BGN_FUNCTION.md
@@ -0,0 +1,155 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CHUNK_BGN_FUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CHUNK_END_FUNCTION (3)
+  - CURLOPT_WILDCARDMATCH (3)
+Protocol:
+  - FTP
+Added-in: 7.21.0
+---
+
+# NAME
+
+CURLOPT_CHUNK_BGN_FUNCTION - callback before a transfer with FTP wildcard match
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+struct curl_fileinfo {
+  char *filename;
+  curlfiletype filetype;
+  time_t time;   /* always zero */
+  unsigned int perm;
+  int uid;
+  int gid;
+  curl_off_t size;
+  long int hardlinks;
+
+  struct {
+    /* If some of these fields is not NULL, it is a pointer to b_data. */
+    char *time;
+    char *perm;
+    char *user;
+    char *group;
+    char *target; /* pointer to the target filename of a symlink, only
+                     available for CURLFILETYPE_SYMLINK */
+  } strings;
+
+  unsigned int flags;
+
+  /* used internally */
+  char *b_data;
+  size_t b_size;
+  size_t b_used;
+};
+
+long chunk_bgn_callback(const void *transfer_info, void *ptr,
+                        int remains);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CHUNK_BGN_FUNCTION,
+                          chunk_bgn_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+This callback function gets called by libcurl before a part of the stream is
+going to be transferred (if the transfer supports chunks).
+
+The *transfer_info* pointer points to a **curl_fileinfo** struct with
+details about the file that is about to get transferred.
+
+This callback makes sense only when using the CURLOPT_WILDCARDMATCH(3)
+option for now.
+
+The target of transfer_info parameter is a "feature depended" structure. For
+the FTP wildcard download, the target is **curl_fileinfo** structure (see
+*curl/curl.h*). The parameter *ptr* is a pointer given by
+CURLOPT_CHUNK_DATA(3). The parameter remains contains number of chunks
+remaining per the transfer. If the feature is not available, the parameter has
+zero value.
+
+Return *CURL_CHUNK_BGN_FUNC_OK* if everything is fine,
+*CURL_CHUNK_BGN_FUNC_SKIP* if you want to skip the concrete chunk or
+*CURL_CHUNK_BGN_FUNC_FAIL* to tell libcurl to stop if some error occurred.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <stdio.h>
+
+struct callback_data {
+  FILE *output;
+};
+
+static long file_is_coming(struct curl_fileinfo *finfo,
+                           void *ptr,
+                           int remains)
+{
+  struct callback_data *data = ptr;
+  printf("%3d %40s %10luB ", remains, finfo->filename,
+         (unsigned long)finfo->size);
+
+  switch(finfo->filetype) {
+  case CURLFILETYPE_DIRECTORY:
+    printf(" DIR\n");
+    break;
+  case CURLFILETYPE_FILE:
+    printf("FILE ");
+    break;
+  default:
+    printf("OTHER\n");
+    break;
+  }
+
+  if(finfo->filetype == CURLFILETYPE_FILE) {
+    /* do not transfer files >= 50B */
+    if(finfo->size > 50) {
+      printf("SKIPPED\n");
+      return CURL_CHUNK_BGN_FUNC_SKIP;
+    }
+
+    data->output = fopen(finfo->filename, "wb");
+    if(!data->output) {
+      return CURL_CHUNK_BGN_FUNC_FAIL;
+    }
+  }
+
+  return CURL_CHUNK_BGN_FUNC_OK;
+}
+
+int main()
+{
+  /* data for callback */
+  struct callback_data callback_info;
+
+  CURL *curl = curl_easy_init();
+
+  /* callback is called before download of concrete file started */
+  curl_easy_setopt(curl, CURLOPT_CHUNK_BGN_FUNCTION, file_is_coming);
+  curl_easy_setopt(curl, CURLOPT_CHUNK_DATA, &callback_info);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_DATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_DATA.3
deleted file mode 100644
index aa4eb1d271..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_DATA.3
+++ /dev/null
@@ -1,94 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CHUNK_DATA 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_CHUNK_DATA \- pointer passed to the FTP chunk callbacks
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CHUNK_DATA, void *pointer);
-.fi
-.SH DESCRIPTION
-Pass a \fIpointer\fP that is untouched by libcurl and passed as the ptr
-argument to the \fICURLOPT_CHUNK_BGN_FUNCTION(3)\fP and
-\fICURLOPT_CHUNK_END_FUNCTION(3)\fP.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-FTP
-.SH EXAMPLE
-.nf
-static long file_is_coming(struct curl_fileinfo *finfo,
-                           struct callback_data *data,
-                           int remains)
-{
-  printf("%3d %40s %10luB ", remains, finfo->filename,
-         (unsigned long)finfo->size);
-
-  switch(finfo->filetype) {
-  case CURLFILETYPE_DIRECTORY:
-    printf(" DIR\\n");
-    break;
-  case CURLFILETYPE_FILE:
-    printf("FILE ");
-    break;
-  default:
-    printf("OTHER\\n");
-    break;
-  }
-
-  if(finfo->filetype == CURLFILETYPE_FILE) {
-    /* do not transfer files >= 50B */
-    if(finfo->size > 50) {
-      printf("SKIPPED\\n");
-      return CURL_CHUNK_BGN_FUNC_SKIP;
-    }
-
-    data->output = fopen(finfo->filename, "wb");
-    if(!data->output) {
-      return CURL_CHUNK_BGN_FUNC_FAIL;
-    }
-  }
-
-  return CURL_CHUNK_BGN_FUNC_OK;
-}
-
-int main()
-{
-  /* data for callback */
-  struct callback_data callback_info;
-
-  /* callback is called before download of concrete file started */
-  curl_easy_setopt(curl, CURLOPT_CHUNK_BGN_FUNCTION, file_is_coming);
-  curl_easy_setopt(curl, CURLOPT_CHUNK_DATA, &callback_info);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.21.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_CHUNK_BGN_FUNCTION "(3), " CURLOPT_WILDCARDMATCH "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_DATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_DATA.md
new file mode 100644
index 0000000000..fb1877e491
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_DATA.md
@@ -0,0 +1,104 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CHUNK_DATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CHUNK_BGN_FUNCTION (3)
+  - CURLOPT_WILDCARDMATCH (3)
+Protocol:
+  - FTP
+Added-in: 7.21.0
+---
+
+# NAME
+
+CURLOPT_CHUNK_DATA - pointer passed to the FTP chunk callbacks
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CHUNK_DATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+Pass a *pointer* that is untouched by libcurl and passed as the ptr
+argument to the CURLOPT_CHUNK_BGN_FUNCTION(3) and
+CURLOPT_CHUNK_END_FUNCTION(3).
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <stdio.h>
+
+struct callback_data {
+  FILE *output;
+};
+
+static long file_is_coming(struct curl_fileinfo *finfo,
+                           void *ptr,
+                           int remains)
+{
+  struct callback_data *data = ptr;
+  printf("%3d %40s %10luB ", remains, finfo->filename,
+         (unsigned long)finfo->size);
+
+  switch(finfo->filetype) {
+  case CURLFILETYPE_DIRECTORY:
+    printf(" DIR\n");
+    break;
+  case CURLFILETYPE_FILE:
+    printf("FILE ");
+    break;
+  default:
+    printf("OTHER\n");
+    break;
+  }
+
+  if(finfo->filetype == CURLFILETYPE_FILE) {
+    /* do not transfer files >= 50B */
+    if(finfo->size > 50) {
+      printf("SKIPPED\n");
+      return CURL_CHUNK_BGN_FUNC_SKIP;
+    }
+
+    data->output = fopen(finfo->filename, "wb");
+    if(!data->output) {
+      return CURL_CHUNK_BGN_FUNC_FAIL;
+    }
+  }
+
+  return CURL_CHUNK_BGN_FUNC_OK;
+}
+
+int main()
+{
+  /* data for callback */
+  struct callback_data callback_info;
+
+  CURL *curl = curl_easy_init();
+
+  /* callback is called before download of concrete file started */
+  curl_easy_setopt(curl, CURLOPT_CHUNK_BGN_FUNCTION, file_is_coming);
+  curl_easy_setopt(curl, CURLOPT_CHUNK_DATA, &callback_info);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_END_FUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_END_FUNCTION.3
deleted file mode 100644
index ea2b25b91c..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_END_FUNCTION.3
+++ /dev/null
@@ -1,73 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CHUNK_END_FUNCTION 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_CHUNK_END_FUNCTION \- callback after a transfer with FTP wildcard match
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-long chunk_end_callback(void *ptr);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CHUNK_END_FUNCTION,
-                          chunk_end_callback);
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-This function gets called by libcurl as soon as a part of the stream has been
-transferred (or skipped).
-
-Return \fICURL_CHUNK_END_FUNC_OK\fP if everything is fine or
-\fBCURL_CHUNK_END_FUNC_FAIL\fP to tell the lib to stop if some error occurred.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-FTP
-.SH EXAMPLE
-.nf
-static long file_is_downloaded(struct callback_data *data)
-{
-  if(data->output) {
-    fclose(data->output);
-    data->output = 0x0;
-  }
-  return CURL_CHUNK_END_FUNC_OK;
-}
-
-int main()
-{
-  /* data for callback */
-  struct callback_data callback_info;
-  curl_easy_setopt(curl, CURLOPT_CHUNK_END_FUNCTION, file_is_downloaded);
-  curl_easy_setopt(curl, CURLOPT_CHUNK_DATA, &callback_info);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.21.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_WILDCARDMATCH "(3), " CURLOPT_CHUNK_BGN_FUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_END_FUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_END_FUNCTION.md
new file mode 100644
index 0000000000..82bf9ad5ba
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CHUNK_END_FUNCTION.md
@@ -0,0 +1,85 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CHUNK_END_FUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CHUNK_BGN_FUNCTION (3)
+  - CURLOPT_WILDCARDMATCH (3)
+Protocol:
+  - FTP
+Added-in: 7.21.0
+---
+
+# NAME
+
+CURLOPT_CHUNK_END_FUNCTION - callback after a transfer with FTP wildcard match
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+long chunk_end_callback(void *ptr);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CHUNK_END_FUNCTION,
+                          chunk_end_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+This function gets called by libcurl as soon as a part of the stream has been
+transferred (or skipped).
+
+Return *CURL_CHUNK_END_FUNC_OK* if everything is fine or
+**CURL_CHUNK_END_FUNC_FAIL** to tell the lib to stop if some error occurred.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <stdio.h>
+
+struct callback_data {
+  FILE *output;
+};
+
+static long file_is_downloaded(void *ptr)
+{
+  struct callback_data *data = ptr;
+  if(data->output) {
+    fclose(data->output);
+    data->output = 0x0;
+  }
+  return CURL_CHUNK_END_FUNC_OK;
+}
+
+int main()
+{
+  /* data for callback */
+  struct callback_data callback_info;
+
+  CURL *curl = curl_easy_init();
+
+  curl_easy_setopt(curl, CURLOPT_CHUNK_END_FUNCTION, file_is_downloaded);
+  curl_easy_setopt(curl, CURLOPT_CHUNK_DATA, &callback_info);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CLOSESOCKETDATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CLOSESOCKETDATA.3
deleted file mode 100644
index 1a8b321db9..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CLOSESOCKETDATA.3
+++ /dev/null
@@ -1,60 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CLOSESOCKETDATA 3 "16 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_CLOSESOCKETDATA \- pointer passed to the socket close callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CLOSESOCKETDATA,
-                          void *pointer);
-.fi
-.SH DESCRIPTION
-Pass a \fIpointer\fP that remains untouched by libcurl and passed as the first
-argument in the closesocket callback set with
-\fICURLOPT_CLOSESOCKETFUNCTION(3)\fP.
-.SH DEFAULT
-The default value of this parameter is NULL.
-.SH PROTOCOLS
-All except file:
-.SH EXAMPLE
-.nf
-static int closesocket(void *clientp, curl_socket_t item)
-{
-  printf("libcurl wants to close %d now\\n", (int)item);
-  return 0;
-}
-
-/* call this function to close sockets */
-curl_easy_setopt(curl, CURLOPT_CLOSESOCKETFUNCTION, closesocket);
-curl_easy_setopt(curl, CURLOPT_CLOSESOCKETDATA, &sockfd);
-.fi
-.SH AVAILABILITY
-Added in 7.21.7
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_CLOSESOCKETFUNCTION "(3), " CURLOPT_OPENSOCKETFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CLOSESOCKETDATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CLOSESOCKETDATA.md
new file mode 100644
index 0000000000..4fc4a9f8d8
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CLOSESOCKETDATA.md
@@ -0,0 +1,84 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CLOSESOCKETDATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CLOSESOCKETFUNCTION (3)
+  - CURLOPT_OPENSOCKETFUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.21.7
+---
+
+# NAME
+
+CURLOPT_CLOSESOCKETDATA - pointer passed to the socket close callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CLOSESOCKETDATA,
+                          void *pointer);
+~~~
+
+# DESCRIPTION
+
+Pass a *pointer* that remains untouched by libcurl and passed as the first
+argument in the closesocket callback set with
+CURLOPT_CLOSESOCKETFUNCTION(3).
+
+Note that when using multi/share handles, your callback may get invoked even
+after the easy handle has been cleaned up. The callback and data is
+inherited by a new connection and that connection may live longer
+than the transfer itself in the multi/share handle's connection cache.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct priv {
+  void *custom;
+};
+
+static int closesocket(void *clientp, curl_socket_t item)
+{
+  struct priv *my = clientp;
+  printf("our ptr: %p\n", my->custom);
+
+  printf("libcurl wants to close %d now\n", (int)item);
+  return 0;
+}
+
+int main(void)
+{
+  struct priv myown;
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    /* call this function to close sockets */
+    curl_easy_setopt(curl, CURLOPT_CLOSESOCKETFUNCTION, closesocket);
+    curl_easy_setopt(curl, CURLOPT_CLOSESOCKETDATA, &myown);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CLOSESOCKETFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CLOSESOCKETFUNCTION.3
deleted file mode 100644
index e6bce8c609..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CLOSESOCKETFUNCTION.3
+++ /dev/null
@@ -1,71 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CLOSESOCKETFUNCTION 3 "16 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_CLOSESOCKETFUNCTION \- callback to socket close replacement
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-int closesocket_callback(void *clientp, curl_socket_t item);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CLOSESOCKETFUNCTION,
-                          closesocket_callback);
-.fi
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-This callback function gets called by libcurl instead of the \fIclose(3)\fP or
-\fIclosesocket(3)\fP call when sockets are closed (not for any other file
-descriptors). This is pretty much the reverse to the
-\fICURLOPT_OPENSOCKETFUNCTION(3)\fP option. Return 0 to signal success and 1
-if there was an error.
-
-The \fIclientp\fP pointer is set with
-\fICURLOPT_CLOSESOCKETDATA(3)\fP. \fIitem\fP is the socket libcurl wants to be
-closed.
-.SH DEFAULT
-By default libcurl uses the standard socket close function.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-static int closesocket(void *clientp, curl_socket_t item)
-{
-  printf("libcurl wants to close %d now\\n", (int)item);
-  return 0;
-}
-
-/* call this function to close sockets */
-curl_easy_setopt(curl, CURLOPT_CLOSESOCKETFUNCTION, closesocket);
-curl_easy_setopt(curl, CURLOPT_CLOSESOCKETDATA, &sockfd);
-.fi
-.SH AVAILABILITY
-Added in 7.21.7
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_CLOSESOCKETDATA "(3), " CURLOPT_OPENSOCKETFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CLOSESOCKETFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CLOSESOCKETFUNCTION.md
new file mode 100644
index 0000000000..0dc9bb4c61
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CLOSESOCKETFUNCTION.md
@@ -0,0 +1,95 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CLOSESOCKETFUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CLOSESOCKETDATA (3)
+  - CURLOPT_OPENSOCKETFUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.21.7
+---
+
+# NAME
+
+CURLOPT_CLOSESOCKETFUNCTION - callback to socket close replacement
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+int closesocket_callback(void *clientp, curl_socket_t item);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CLOSESOCKETFUNCTION,
+                          closesocket_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+This callback function gets called by libcurl instead of the *close(3)* or
+*closesocket(3)* call when sockets are closed (not for any other file
+descriptors). This is pretty much the reverse to the
+CURLOPT_OPENSOCKETFUNCTION(3) option. Return 0 to signal success and 1
+if there was an error.
+
+The *clientp* pointer is set with
+CURLOPT_CLOSESOCKETDATA(3). *item* is the socket libcurl wants to be
+closed.
+
+Note that when using multi/share handles, your callback may get invoked even
+after the easy handle has been cleaned up. The callback and data is
+inherited by a new connection and that connection may live longer
+than the transfer itself in the multi/share handle's connection cache.
+
+# DEFAULT
+
+Use the standard socket close function.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct priv {
+  void *custom;
+};
+
+static int closesocket(void *clientp, curl_socket_t item)
+{
+  struct priv *my = clientp;
+  printf("our ptr: %p\n", my->custom);
+
+  printf("libcurl wants to close %d now\n", (int)item);
+  return 0;
+}
+
+int main(void)
+{
+  struct priv myown;
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    /* call this function to close sockets */
+    curl_easy_setopt(curl, CURLOPT_CLOSESOCKETFUNCTION, closesocket);
+    curl_easy_setopt(curl, CURLOPT_CLOSESOCKETDATA, &myown);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECTTIMEOUT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECTTIMEOUT.3
deleted file mode 100644
index 4a72310b22..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECTTIMEOUT.3
+++ /dev/null
@@ -1,86 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CONNECTTIMEOUT 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_CONNECTTIMEOUT \- timeout for the connect phase
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CONNECTTIMEOUT, long timeout);
-.fi
-.SH DESCRIPTION
-Pass a long. It should contain the maximum time in seconds that you allow the
-connection phase to the server to take. This timeout only limits the
-connection phase, it has no impact once it has connected. Set to zero to
-switch to the default built-in connection timeout - 300 seconds. See also the
-\fICURLOPT_TIMEOUT(3)\fP option.
-
-\fICURLOPT_CONNECTTIMEOUT_MS(3)\fP is the same function but set in milliseconds.
-
-If both \fICURLOPT_CONNECTTIMEOUT(3)\fP and \fICURLOPT_CONNECTTIMEOUT_MS(3)\fP
-are set, the value set last is used.
-
-The "connection phase" is considered complete when the requested TCP, TLS or
-QUIC handshakes are done.
-
-The connection timeout set with \fICURLOPT_CONNECTTIMEOUT(3)\fP is included in
-the general all-covering \fICURLOPT_TIMEOUT(3)\fP.
-
-With \fICURLOPT_CONNECTTIMEOUT(3)\fP set to 3 and \fICURLOPT_TIMEOUT(3)\fP set
-to 5, the operation can never last longer than 5 seconds, and the connection
-phase cannot last longer than 3 seconds.
-
-With \fICURLOPT_CONNECTTIMEOUT(3)\fP set to 4 and \fICURLOPT_TIMEOUT(3)\fP set
-to 2, the operation can never last longer than 2 seconds. Including the
-connection phase.
-
-This option may cause libcurl to use the SIGALRM signal to timeout system
-calls on builds not using asynch DNS. In unix-like systems, this might cause
-signals to be used unless \fICURLOPT_NOSIGNAL(3)\fP is set.
-.SH DEFAULT
-300
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* complete connection within 10 seconds */
-  curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 10L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK. Returns CURLE_BAD_FUNCTION_ARGUMENT if set to a negative
-value or a value that when converted to milliseconds is too large.
-.SH "SEE ALSO"
-.BR CURLOPT_CONNECTTIMEOUT_MS "(3), "
-.BR CURLOPT_TIMEOUT "(3), " CURLOPT_LOW_SPEED_LIMIT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECTTIMEOUT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECTTIMEOUT.md
new file mode 100644
index 0000000000..65a98b315d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECTTIMEOUT.md
@@ -0,0 +1,91 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CONNECTTIMEOUT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_LOW_SPEED_LIMIT (3)
+  - CURLOPT_MAX_RECV_SPEED_LARGE (3)
+  - CURLOPT_TIMEOUT (3)
+Protocol:
+  - All
+Added-in: 7.7
+---
+
+# NAME
+
+CURLOPT_CONNECTTIMEOUT - timeout for the connect phase
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CONNECTTIMEOUT, long timeout);
+~~~
+
+# DESCRIPTION
+
+Pass a long. It sets the maximum time in seconds that you allow the connection
+phase to take. This timeout only limits the connection phase, it has no impact
+once libcurl has connected. The connection phase includes the name resolve
+(DNS) and all protocol handshakes and negotiations until there is an
+established connection with the remote side.
+
+Set this option to zero to switch to the default built-in connection timeout -
+300 seconds. See also the CURLOPT_TIMEOUT(3) option.
+
+CURLOPT_CONNECTTIMEOUT_MS(3) is the same function but set in milliseconds.
+
+If both CURLOPT_CONNECTTIMEOUT(3) and CURLOPT_CONNECTTIMEOUT_MS(3)
+are set, the value set last is used.
+
+The connection timeout is included in the general all-covering
+CURLOPT_TIMEOUT(3):
+
+With CURLOPT_CONNECTTIMEOUT(3) set to 3 and CURLOPT_TIMEOUT(3) set
+to 5, the operation can never last longer than 5 seconds, and the connection
+phase cannot last longer than 3 seconds.
+
+With CURLOPT_CONNECTTIMEOUT(3) set to 4 and CURLOPT_TIMEOUT(3) set
+to 2, the operation can never last longer than 2 seconds. Including the
+connection phase.
+
+This option may cause libcurl to use the SIGALRM signal to timeout system
+calls on builds not using asynch DNS. In Unix-like systems, this might cause
+signals to be used unless CURLOPT_NOSIGNAL(3) is set.
+
+# DEFAULT
+
+300
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* complete connection within 10 seconds */
+    curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 10L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECTTIMEOUT_MS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECTTIMEOUT_MS.3
deleted file mode 100644
index ffe3f66ce7..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECTTIMEOUT_MS.3
+++ /dev/null
@@ -1,62 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CONNECTTIMEOUT_MS 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_CONNECTTIMEOUT_MS \- timeout for the connect phase
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CONNECTTIMEOUT_MS,
-                          long timeout);
-.fi
-.SH DESCRIPTION
-Pass a long. It should contain the maximum time in milliseconds that you allow
-the connection phase to the server to take.
-
-See \fICURLOPT_CONNECTTIMEOUT(3)\fP for details.
-.SH DEFAULT
-300000
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* complete connection within 10000 milliseconds */
-  curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT_MS, 10000L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_CONNECTTIMEOUT "(3), "
-.BR CURLOPT_TIMEOUT "(3), " CURLOPT_LOW_SPEED_LIMIT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECTTIMEOUT_MS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECTTIMEOUT_MS.md
new file mode 100644
index 0000000000..e619e94507
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECTTIMEOUT_MS.md
@@ -0,0 +1,92 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CONNECTTIMEOUT_MS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_LOW_SPEED_LIMIT (3)
+  - CURLOPT_MAX_RECV_SPEED_LARGE (3)
+  - CURLOPT_TIMEOUT_MS (3)
+Protocol:
+  - All
+Added-in: 7.16.2
+---
+
+# NAME
+
+CURLOPT_CONNECTTIMEOUT_MS - timeout for the connect phase
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CONNECTTIMEOUT_MS,
+                          long timeout);
+~~~
+
+# DESCRIPTION
+
+Pass a long. It sets the maximum time in milliseconds that you allow the
+connection phase to take. This timeout only limits the connection phase, it
+has no impact once libcurl has connected. The connection phase includes the
+name resolve (DNS) and all protocol handshakes and negotiations until there is
+an established connection with the remote side.
+
+Set this option to zero to switch to the default built-in connection timeout -
+300 seconds. See also the CURLOPT_TIMEOUT_MS(3) option.
+
+CURLOPT_CONNECTTIMEOUT(3) is the same function but set in seconds.
+
+If both CURLOPT_CONNECTTIMEOUT(3) and CURLOPT_CONNECTTIMEOUT_MS(3) are set,
+the value set last is used.
+
+The connection timeout is included in the general all-covering
+CURLOPT_TIMEOUT_MS(3):
+
+With CURLOPT_CONNECTTIMEOUT_MS(3) set to 3000 and CURLOPT_TIMEOUT_MS(3) set to
+5000, the operation can never last longer than 5000 milliseconds, and the
+connection phase cannot last longer than 3000 milliseconds.
+
+With CURLOPT_CONNECTTIMEOUT_MS(3) set to 4000 and CURLOPT_TIMEOUT_MS(3) set to
+2000, the operation can never last longer than 2000 milliseconds. Including
+the connection phase.
+
+This option may cause libcurl to use the SIGALRM signal to timeout system
+calls on builds not using asynch DNS. In Unix-like systems, this might cause
+signals to be used unless CURLOPT_NOSIGNAL(3) is set.
+
+# DEFAULT
+
+300000
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* complete connection within 10000 milliseconds */
+    curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT_MS, 10000L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECT_ONLY.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECT_ONLY.3
deleted file mode 100644
index b138944354..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECT_ONLY.3
+++ /dev/null
@@ -1,80 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CONNECT_ONLY 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_CONNECT_ONLY \- stop when connected to target server
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CONNECT_ONLY, long only);
-.fi
-.SH DESCRIPTION
-Pass a long. If the parameter equals 1, it tells the library to perform all
-the required proxy authentication and connection setup, but no data transfer,
-and then return.
-
-The option can be used to simply test a connection to a server, but is more
-useful when used with the \fICURLINFO_ACTIVESOCKET(3)\fP option to
-\fIcurl_easy_getinfo(3)\fP as the library can set up the connection and then
-the application can obtain the most recently used socket for special data
-transfers.
-
-Since 7.86.0, this option can be set to '2' and if HTTP or WebSocket are used,
-libcurl performs the request and reads all response headers before handing
-over control to the application.
-
-Transfers marked connect only do not reuse any existing connections and
-connections marked connect only are not allowed to get reused.
-
-If the connect only transfer is done using the multi interface, the particular
-easy handle must remain added to the multi handle for as long as the
-application wants to use it. Once it has been removed with
-\fIcurl_multi_remove_handle(3)\fP, \fIcurl_easy_send(3)\fP and
-\fIcurl_easy_recv(3)\fP do not function.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-HTTP, SMTP, POP3 and IMAP. For WS and WSS starting in 7.86.0.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
-  ret = curl_easy_perform(curl);
-  if(ret == CURLE_OK) {
-    /* only connected! */
-  }
-}
-.fi
-.SH AVAILABILITY
-Added in 7.15.2
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_VERBOSE "(3), " CURLOPT_HTTPPROXYTUNNEL  "(3), "
-.BR curl_easy_recv "(3), " curl_easy_send "(3) "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECT_ONLY.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECT_ONLY.md
new file mode 100644
index 0000000000..19154bc844
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECT_ONLY.md
@@ -0,0 +1,89 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CONNECT_ONLY
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HTTPPROXYTUNNEL (3)
+  - CURLOPT_VERBOSE (3)
+  - curl_easy_recv (3)
+  - curl_easy_send (3)
+Protocol:
+  - All
+Added-in: 7.15.2
+---
+
+# NAME
+
+CURLOPT_CONNECT_ONLY - stop when connected to target server
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CONNECT_ONLY, long only);
+~~~
+
+# DESCRIPTION
+
+Pass a long. If the parameter equals 1, it tells the library to perform all
+the required proxy authentication and connection setup, but no data transfer,
+and then return.
+
+The option can be used to test a connection to a server, but is more
+useful when used with the CURLINFO_ACTIVESOCKET(3) option to
+curl_easy_getinfo(3) as the library can set up the connection and then
+the application can obtain the most recently used socket for special data
+transfers.
+
+This option can be set to '2' and if WebSocket is used, libcurl performs the
+request and reads all response headers before handing over control to the
+application. For other protocols the behavior of '2' is undefined.
+
+Transfers marked connect only do not reuse any existing connections and
+connections marked connect only are not allowed to get reused.
+
+If the connect only transfer is done using the multi interface, the particular
+easy handle must remain added to the multi handle for as long as the
+application wants to use it. Once it has been removed with
+curl_multi_remove_handle(3), curl_easy_send(3) and
+curl_easy_recv(3) do not function.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      /* only connected */
+    }
+  }
+}
+~~~
+
+# HISTORY
+
+WS and WSS support added in 7.86.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECT_TO.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECT_TO.3
deleted file mode 100644
index 6bab8e3892..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECT_TO.3
+++ /dev/null
@@ -1,113 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CONNECT_TO 3 "10 April 2016" libcurl libcurl
-.SH NAME
-CURLOPT_CONNECT_TO \- connect to a specific host and port instead of the URL's host and port
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CONNECT_TO,
-                          struct curl_slist *connect_to);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a linked list of strings with "connect to" information to
-use for establishing network connections with this handle. The linked list
-should be a fully valid list of \fBstruct curl_slist\fP structs properly
-filled in. Use \fIcurl_slist_append(3)\fP to create the list and
-\fIcurl_slist_free_all(3)\fP to clean up an entire list.
-
-Each single string should be written using the format
-HOST:PORT:CONNECT-TO-HOST:CONNECT-TO-PORT where HOST is the host of the
-request, PORT is the port of the request, CONNECT-TO-HOST is the host name to
-connect to, and CONNECT-TO-PORT is the port to connect to.
-
-The first string that matches the request's host and port is used.
-
-Dotted numerical IP addresses are supported for HOST and CONNECT-TO-HOST.
-A numerical IPv6 address must be written within [brackets].
-
-Any of the four values may be empty. When the HOST or PORT is empty, the host
-or port always match (the request's host or port is ignored). When
-CONNECT-TO-HOST or CONNECT-TO-PORT is empty, the "connect to" feature is
-disabled for the host or port, and the request's host or port are used to
-establish the network connection.
-
-This option is suitable to direct the request at a specific server, e.g. at a
-specific cluster node in a cluster of servers.
-
-The "connect to" host and port are only used to establish the network
-connection. They do NOT affect the host and port that are used for TLS/SSL
-(e.g. SNI, certificate verification) or for the application protocols.
-
-In contrast to \fICURLOPT_RESOLVE(3)\fP, the option
-\fICURLOPT_CONNECT_TO(3)\fP does not pre-populate the DNS cache and therefore
-it does not affect future transfers of other easy handles that have been added
-to the same multi handle.
-
-The "connect to" host and port are ignored if they are equal to the host and
-the port in the request URL, because connecting to the host and the port in
-the request URL is the default behavior.
-
-If an HTTP proxy is used for a request having a special "connect to" host or
-port, and the "connect to" host or port differs from the request's host and
-port, the HTTP proxy is automatically switched to tunnel mode for this
-specific request. This is necessary because it is not possible to connect to a
-specific host or port in normal (non-tunnel) mode.
-
-When this option is passed to \fIcurl_easy_setopt(3)\fP, libcurl does not copy
-the list so you \fBmust\fP keep it around until you no longer use this
-\fIhandle\fP for a transfer before you call \fIcurl_slist_free_all(3)\fP on
-the list.
-
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl;
-struct curl_slist *connect_to = NULL;
-connect_to = curl_slist_append(NULL, "example.com::server1.example.com:");
-
-curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  curl_easy_perform(curl);
-
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-
-curl_slist_free_all(connect_to);
-.fi
-.SH AVAILABILITY
-Added in 7.49.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_URL "(3), " CURLOPT_RESOLVE "(3), " CURLOPT_FOLLOWLOCATION "(3), " CURLOPT_HTTPPROXYTUNNEL  "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECT_TO.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECT_TO.md
new file mode 100644
index 0000000000..68bc1b6ad4
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CONNECT_TO.md
@@ -0,0 +1,120 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CONNECT_TO
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_FOLLOWLOCATION (3)
+  - CURLOPT_HTTPPROXYTUNNEL (3)
+  - CURLOPT_RESOLVE (3)
+  - CURLOPT_URL (3)
+Protocol:
+  - All
+Added-in: 7.49.0
+---
+
+# NAME
+
+CURLOPT_CONNECT_TO - connect to another host and port instead
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CONNECT_TO,
+                          struct curl_slist *connect_to);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a linked list of strings with "connect to" information to
+use for establishing network connections with this handle. The linked list
+should be a fully valid list of **struct curl_slist** structs properly filled
+in. Use curl_slist_append(3) to create the list and curl_slist_free_all(3) to
+clean up an entire list.
+
+Each single string should be written using the format
+HOST:PORT:CONNECT-TO-HOST:CONNECT-TO-PORT where HOST is the host of the
+request, PORT is the port of the request, CONNECT-TO-HOST is the hostname to
+connect to, and CONNECT-TO-PORT is the port to connect to.
+
+The first string that matches the request's host and port is used.
+
+Dotted numerical IP addresses are supported for HOST and CONNECT-TO-HOST.
+A numerical IPv6 address must be written within [brackets].
+
+Any of the four values may be empty. When the HOST or PORT is empty, the host
+or port always match (the request's host or port is ignored). When
+CONNECT-TO-HOST or CONNECT-TO-PORT is empty, the "connect to" feature is
+disabled for the host or port, and the request's host or port are used to
+establish the network connection.
+
+This option is suitable to direct the request at a specific server, e.g. at a
+specific cluster node in a cluster of servers.
+
+The "connect to" host and port are only used to establish the network
+connection. They do NOT affect the host and port that are used for TLS/SSL
+(e.g. SNI, certificate verification) or for the application protocols.
+
+In contrast to CURLOPT_RESOLVE(3), the option CURLOPT_CONNECT_TO(3) does not
+pre-populate the DNS cache and therefore it does not affect future transfers
+of other easy handles that have been added to the same multi handle.
+
+The "connect to" host and port are ignored if they are equal to the host and
+the port in the request URL, because connecting to the host and the port in
+the request URL is the default behavior.
+
+If an HTTP proxy is used for a request having a special "connect to" host or
+port, and the "connect to" host or port differs from the request's host and
+port, the HTTP proxy is automatically switched to tunnel mode for this
+specific request. This is necessary because it is not possible to connect to a
+specific host or port in normal (non-tunnel) mode.
+
+When this option is passed to curl_easy_setopt(3), libcurl does not copy the
+list so you **must** keep it around until you no longer use this *handle* for
+a transfer before you call curl_slist_free_all(3) on the list.
+
+Using this option multiple times makes the last set list override the previous
+ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl;
+  struct curl_slist *connect_to = NULL;
+  connect_to = curl_slist_append(NULL, "example.com::server1.example.com:");
+
+  curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    result = curl_easy_perform(curl);
+
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+
+  curl_slist_free_all(connect_to);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CONV_FROM_NETWORK_FUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CONV_FROM_NETWORK_FUNCTION.3
deleted file mode 100644
index 120c6d7aa0..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CONV_FROM_NETWORK_FUNCTION.3
+++ /dev/null
@@ -1,105 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CONV_FROM_NETWORK_FUNCTION 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_CONV_FROM_NETWORK_FUNCTION \- convert data from network to host encoding
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode conv_callback(char *ptr, size_t length);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CONV_FROM_NETWORK_FUNCTION,
-                          conv_callback);
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-Applies to non-ASCII platforms. \fIcurl_version_info(3)\fP returns the
-\fBCURL_VERSION_CONV\fP feature bit set if this option is provided.
-
-The data to be converted is in a buffer pointed to by the \fIptr\fP parameter.
-The amount of data to convert is indicated by the \fIlength\fP parameter.  The
-converted data overlays the input data in the buffer pointed to by the ptr
-parameter. \fICURLE_OK\fP must be returned upon successful conversion.  A
-CURLcode return value defined by curl.h, such as \fICURLE_CONV_FAILED\fP,
-should be returned if an error was encountered.
-
-\fBCURLOPT_CONV_FROM_NETWORK_FUNCTION\fP converts to host encoding from the
-network encoding.  It is used when commands or ASCII data are received over
-the network.
-
-If you set a callback pointer to NULL, or do not set it at all, the built-in
-libcurl iconv functions are used. If HAVE_ICONV was not defined when libcurl
-was built, and no callback has been established, the conversion returns the
-\fBCURLE_CONV_REQD\fP error code.
-
-If \fBHAVE_ICONV\fP is defined, \fBCURL_ICONV_CODESET_OF_HOST\fP must also be
-defined. For example:
-
- \&#define CURL_ICONV_CODESET_OF_HOST "IBM-1047"
-
-The iconv code in libcurl defaults the network and UTF8 codeset names as
-follows:
-
- \&#define CURL_ICONV_CODESET_OF_NETWORK "ISO8859-1"
-
- \&#define CURL_ICONV_CODESET_FOR_UTF8   "UTF-8"
-
-You need to override these definitions if they are different on your system.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-FTP, SMTP, IMAP, POP3
-.SH EXAMPLE
-.nf
-static CURLcode my_conv_from_ascii_to_ebcdic(char *buffer, size_t length)
-{
-  char *tempptrin, *tempptrout;
-  size_t bytes = length;
-  int rc;
-  tempptrin = tempptrout = buffer;
-  rc = platform_a2e(&tempptrin, &bytes, &tempptrout, &bytes);
-  if(rc == PLATFORM_CONV_OK) {
-    return CURLE_OK;
-  }
-  else {
-    return CURLE_CONV_FAILED;
-  }
-}
-
-/* use platform-specific functions for codeset conversions */
-curl_easy_setopt(curl, CURLOPT_CONV_FROM_NETWORK_FUNCTION,
-                 my_conv_from_ascii_to_ebcdic);
-.fi
-.SH AVAILABILITY
-Not available and deprecated since 7.82.0.
-
-Available only if \fBCURL_DOES_CONVERSIONS\fP was defined when libcurl was
-built.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_CONV_TO_NETWORK_FUNCTION "(3), " CURLOPT_CONV_FROM_UTF8_FUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CONV_FROM_NETWORK_FUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CONV_FROM_NETWORK_FUNCTION.md
new file mode 100644
index 0000000000..04e1f45ba3
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CONV_FROM_NETWORK_FUNCTION.md
@@ -0,0 +1,120 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CONV_FROM_NETWORK_FUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CONV_FROM_UTF8_FUNCTION (3)
+  - CURLOPT_CONV_TO_NETWORK_FUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.15.4
+---
+
+# NAME
+
+CURLOPT_CONV_FROM_NETWORK_FUNCTION - convert data from network to host encoding
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode conv_callback(char *ptr, size_t length);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CONV_FROM_NETWORK_FUNCTION,
+                          conv_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+Applies to non-ASCII platforms. curl_version_info(3) returns the
+**CURL_VERSION_CONV** feature bit set if this option is provided.
+
+The data to be converted is in a buffer pointed to by the *ptr* parameter.
+The amount of data to convert is indicated by the *length* parameter. The
+converted data overlays the input data in the buffer pointed to by the ptr
+parameter. *CURLE_OK* must be returned upon successful conversion. A
+CURLcode return value defined by curl.h, such as *CURLE_CONV_FAILED*,
+should be returned if an error was encountered.
+
+CURLOPT_CONV_FROM_NETWORK_FUNCTION(3) converts to host encoding from the
+network encoding. It is used when commands or ASCII data are received over the
+network.
+
+If you set a callback pointer to NULL, or do not set it at all, the built-in
+libcurl iconv functions are used. If HAVE_ICONV was not defined when libcurl
+was built, and no callback has been established, the conversion returns the
+**CURLE_CONV_REQD** error code.
+
+If **HAVE_ICONV** is defined, **CURL_ICONV_CODESET_OF_HOST** must also be
+defined. For example:
+
+~~~c
+#define CURL_ICONV_CODESET_OF_HOST "IBM-1047"
+~~~
+
+The iconv code in libcurl defaults the network and UTF8 codeset names as
+follows:
+
+~~~
+#define CURL_ICONV_CODESET_OF_NETWORK "ISO8859-1"
+
+#define CURL_ICONV_CODESET_FOR_UTF8  "UTF-8"
+~~~
+
+You need to override these definitions if they are different on your system.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+static CURLcode my_conv_from_ascii_to_ebcdic(char *buffer, size_t length)
+{
+  int rc = 0;
+
+  /* in-place convert 'buffer' from ASCII to EBCDIC */
+
+  if(rc == 0) {
+    /* success */
+    return CURLE_OK;
+  }
+  else {
+    return CURLE_CONV_FAILED;
+  }
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+
+  /* use platform-specific functions for codeset conversions */
+  curl_easy_setopt(curl, CURLOPT_CONV_FROM_NETWORK_FUNCTION,
+                   my_conv_from_ascii_to_ebcdic);
+}
+~~~
+
+# DEPRECATED
+
+Not available and deprecated since 7.82.0.
+
+Available only if **CURL_DOES_CONVERSIONS** was defined when libcurl was
+built.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CONV_FROM_UTF8_FUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CONV_FROM_UTF8_FUNCTION.3
deleted file mode 100644
index 891ddd8bf8..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CONV_FROM_UTF8_FUNCTION.3
+++ /dev/null
@@ -1,103 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CONV_FROM_UTF8_FUNCTION 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_CONV_FROM_UTF8_FUNCTION \- convert data from UTF8 to host encoding
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode conv_callback(char *ptr, size_t length);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CONV_FROM_UTF8_FUNCTION,
-                          conv_callback);
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-Applies to non-ASCII platforms. \fIcurl_version_info(3)\fP returns the
-CURL_VERSION_CONV feature bit set if this option is provided.
-
-The data to be converted is in a buffer pointed to by the \fIptr\fP parameter.
-The amount of data to convert is indicated by the \fIlength\fP parameter.  The
-converted data overlays the input data in the buffer pointed to by the ptr
-parameter. \fICURLE_OK\fP must be returned upon successful conversion.  A
-CURLcode return value defined by curl.h, such as \fICURLE_CONV_FAILED\fP,
-should be returned if an error was encountered.
-
-\fBCURLOPT_CONV_FROM_UTF8_FUNCTION\fP converts to host encoding from UTF8
-encoding. It is required only for SSL processing.
-
-If you set a callback pointer to NULL, or do not set it at all, the built-in
-libcurl iconv functions are used. If HAVE_ICONV was not defined when libcurl
-was built, and no callback has been established, the conversion returns the
-CURLE_CONV_REQD error code.
-
-If HAVE_ICONV is defined, CURL_ICONV_CODESET_OF_HOST must also be defined.
-For example:
-
- \&#define CURL_ICONV_CODESET_OF_HOST "IBM-1047"
-
-The iconv code in libcurl defaults the network and UTF8 codeset names as
-follows:
-
- \&#define CURL_ICONV_CODESET_OF_NETWORK "ISO8859-1"
-
- \&#define CURL_ICONV_CODESET_FOR_UTF8   "UTF-8"
-
-You need to override these definitions if they are different on your system.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-TLS-based protocols.
-.SH EXAMPLE
-.nf
-static CURLcode my_conv_from_utf8_to_ebcdic(char *buffer, size_t length)
-{
-  char *tempptrin, *tempptrout;
-  size_t bytes = length;
-  int rc;
-  tempptrin = tempptrout = buffer;
-  rc = platform_u2e(&tempptrin, &bytes, &tempptrout, &bytes);
-  if(rc == PLATFORM_CONV_OK) {
-    return CURLE_OK;
-  }
-  else {
-    return CURLE_CONV_FAILED;
-  }
-}
-
-curl_easy_setopt(curl, CURLOPT_CONV_FROM_UTF8_FUNCTION,
-                 my_conv_from_utf8_to_ebcdic);
-.fi
-.SH AVAILABILITY
-Not available and deprecated since 7.82.0.
-
-Available only if \fBCURL_DOES_CONVERSIONS\fP was defined when libcurl was
-built.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_CONV_TO_NETWORK_FUNCTION "(3), " CURLOPT_CONV_FROM_NETWORK_FUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CONV_FROM_UTF8_FUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CONV_FROM_UTF8_FUNCTION.md
new file mode 100644
index 0000000000..cb8fd354c7
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CONV_FROM_UTF8_FUNCTION.md
@@ -0,0 +1,113 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CONV_FROM_UTF8_FUNCTION
+Section: 3
+Source: libcurl
+Protocol:
+  - All
+See-also:
+  - CURLOPT_CONV_FROM_NETWORK_FUNCTION (3)
+  - CURLOPT_CONV_TO_NETWORK_FUNCTION (3)
+Added-in: 7.15.4
+---
+
+# NAME
+
+CURLOPT_CONV_FROM_UTF8_FUNCTION - convert data from UTF8 to host encoding
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode conv_callback(char *ptr, size_t length);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CONV_FROM_UTF8_FUNCTION,
+                          conv_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+Applies to non-ASCII platforms. curl_version_info(3) returns the
+CURL_VERSION_CONV feature bit set if this option is provided.
+
+The data to be converted is in a buffer pointed to by the *ptr* parameter.
+The amount of data to convert is indicated by the *length* parameter. The
+converted data overlays the input data in the buffer pointed to by the ptr
+parameter. *CURLE_OK* must be returned upon successful conversion. A
+CURLcode return value defined by curl.h, such as *CURLE_CONV_FAILED*,
+should be returned if an error was encountered.
+
+CURLOPT_CONV_FROM_UTF8_FUNCTION(3) converts to host encoding from UTF8
+encoding. It is required only for SSL processing.
+
+If you set a callback pointer to NULL, or do not set it at all, the built-in
+libcurl iconv functions are used. If HAVE_ICONV was not defined when libcurl
+was built, and no callback has been established, the conversion returns the
+CURLE_CONV_REQD error code.
+
+If HAVE_ICONV is defined, CURL_ICONV_CODESET_OF_HOST must also be defined.
+For example:
+~~~c
+#define CURL_ICONV_CODESET_OF_HOST "IBM-1047"
+~~~
+
+The iconv code in libcurl defaults the network and UTF8 codeset names as
+follows:
+~~~c
+#define CURL_ICONV_CODESET_OF_NETWORK "ISO8859-1"
+
+#define CURL_ICONV_CODESET_FOR_UTF8   "UTF-8"
+~~~
+
+You need to override these definitions if they are different on your system.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+static CURLcode my_conv_from_utf8_to_ebcdic(char *buffer, size_t length)
+{
+  int rc = 0;
+  /* in-place convert 'buffer' from UTF-8 to EBCDIC */
+  if(rc == 0) {
+    /* success */
+    return CURLE_OK;
+  }
+  else {
+    return CURLE_CONV_FAILED;
+  }
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_CONV_FROM_UTF8_FUNCTION,
+                   my_conv_from_utf8_to_ebcdic);
+}
+~~~
+
+# DEPRECATED
+
+Not available and deprecated since 7.82.0.
+
+Available only if **CURL_DOES_CONVERSIONS** was defined when libcurl was
+built.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CONV_TO_NETWORK_FUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CONV_TO_NETWORK_FUNCTION.3
deleted file mode 100644
index 30d280d411..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CONV_TO_NETWORK_FUNCTION.3
+++ /dev/null
@@ -1,104 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CONV_TO_NETWORK_FUNCTION 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_CONV_TO_NETWORK_FUNCTION \- convert data to network from host encoding
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode conv_callback(char *ptr, size_t length);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CONV_TO_NETWORK_FUNCTION,
-                          conv_callback);
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-Applies to non-ASCII platforms. \fIcurl_version_info(3)\fP returns the
-CURL_VERSION_CONV feature bit set if this option is provided.
-
-The data to be converted is in a buffer pointed to by the \fIptr\fP parameter.
-The amount of data to convert is indicated by the \fIlength\fP parameter.  The
-converted data overlays the input data in the buffer pointed to by the ptr
-parameter. \fICURLE_OK\fP must be returned upon successful conversion.  A
-CURLcode return value defined by curl.h, such as \fICURLE_CONV_FAILED\fP,
-should be returned if an error was encountered.
-
-\fBCURLOPT_CONV_TO_NETWORK_FUNCTION\fP converts from host encoding to the
-network encoding.  It is used when commands or ASCII data are sent over the
-network.
-
-If you set a callback pointer to NULL, or do not set it at all, the built-in
-libcurl iconv functions are used. If HAVE_ICONV was not defined when libcurl
-was built, and no callback has been established, the conversion returns the
-CURLE_CONV_REQD error code.
-
-If HAVE_ICONV is defined, CURL_ICONV_CODESET_OF_HOST must also be defined.
-For example:
-
- \&#define CURL_ICONV_CODESET_OF_HOST "IBM-1047"
-
-The iconv code in libcurl defaults the network and UTF8 codeset names as
-follows:
-
- \&#define CURL_ICONV_CODESET_OF_NETWORK "ISO8859-1"
-
- \&#define CURL_ICONV_CODESET_FOR_UTF8   "UTF-8"
-
-You need to override these definitions if they are different on your system.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-FTP, SMTP, IMAP, POP3
-.SH EXAMPLE
-.nf
-static CURLcode my_conv_from_ebcdic_to_ascii(char *buffer, size_t length)
-{
-  char *tempptrin, *tempptrout;
-  size_t bytes = length;
-  int rc;
-  tempptrin = tempptrout = buffer;
-  rc = platform_e2a(&tempptrin, &bytes, &tempptrout, &bytes);
-  if(rc == PLATFORM_CONV_OK) {
-    return CURLE_OK;
-  }
-  else {
-    return CURLE_CONV_FAILED;
-  }
-}
-
-curl_easy_setopt(curl, CURLOPT_CONV_TO_NETWORK_FUNCTION,
-                 my_conv_from_ebcdic_to_ascii);
-.fi
-.SH AVAILABILITY
-Not available and deprecated since 7.82.0.
-
-Available only if \fBCURL_DOES_CONVERSIONS\fP was defined when libcurl was
-built.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_CONV_FROM_NETWORK_FUNCTION "(3), " CURLOPT_CONV_FROM_UTF8_FUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CONV_TO_NETWORK_FUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CONV_TO_NETWORK_FUNCTION.md
new file mode 100644
index 0000000000..d0c88ea2b6
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CONV_TO_NETWORK_FUNCTION.md
@@ -0,0 +1,116 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CONV_TO_NETWORK_FUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CONV_FROM_NETWORK_FUNCTION (3)
+  - CURLOPT_CONV_FROM_UTF8_FUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.15.4
+---
+
+# NAME
+
+CURLOPT_CONV_TO_NETWORK_FUNCTION - convert data to network from host encoding
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode conv_callback(char *ptr, size_t length);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CONV_TO_NETWORK_FUNCTION,
+                          conv_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+Applies to non-ASCII platforms. curl_version_info(3) returns the
+CURL_VERSION_CONV feature bit set if this option is provided.
+
+The data to be converted is in a buffer pointed to by the *ptr* parameter.
+The amount of data to convert is indicated by the *length* parameter. The
+converted data overlays the input data in the buffer pointed to by the ptr
+parameter. *CURLE_OK* must be returned upon successful conversion. A CURLcode
+return value defined by curl.h, such as *CURLE_CONV_FAILED*, should be
+returned if an error was encountered.
+
+CURLOPT_CONV_TO_NETWORK_FUNCTION(3) converts from host encoding to the
+network encoding. It is used when commands or ASCII data are sent over the
+network.
+
+If you set a callback pointer to NULL, or do not set it at all, the built-in
+libcurl iconv functions are used. If HAVE_ICONV was not defined when libcurl
+was built, and no callback has been established, the conversion returns the
+CURLE_CONV_REQD error code.
+
+If HAVE_ICONV is defined, CURL_ICONV_CODESET_OF_HOST must also be defined.
+For example:
+~~~c
+define CURL_ICONV_CODESET_OF_HOST "IBM-1047"
+~~~
+
+The iconv code in libcurl defaults the network and UTF8 codeset names as
+follows:
+
+~~~c
+#define CURL_ICONV_CODESET_OF_NETWORK "ISO8859-1"
+
+#define CURL_ICONV_CODESET_FOR_UTF8   "UTF-8"
+~~~
+
+You need to override these definitions if they are different on your system.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+static CURLcode my_conv_from_ebcdic_to_ascii(char *buffer, size_t length)
+{
+  int rc = 0;
+  /* in-place convert 'buffer' from EBCDIC to ASCII */
+  if(rc == 0) {
+    /* success */
+    return CURLE_OK;
+  }
+  else {
+    return CURLE_CONV_FAILED;
+  }
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+
+  curl_easy_setopt(curl, CURLOPT_CONV_TO_NETWORK_FUNCTION,
+                   my_conv_from_ebcdic_to_ascii);
+}
+~~~
+
+# DEPRECATED
+
+Not available and deprecated since 7.82.0.
+
+Available only if **CURL_DOES_CONVERSIONS** was defined when libcurl was
+built.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIE.3
deleted file mode 100644
index 6a14c1e6fc..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIE.3
+++ /dev/null
@@ -1,87 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_COOKIE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_COOKIE \- HTTP Cookie header
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_COOKIE, char *cookie);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter. It is used to set one
-or more cookies in the HTTP request. The format of the string should be
-NAME=CONTENTS, where NAME is the cookie name and CONTENTS is what the cookie
-should contain.
-
-To set multiple cookies, set them all using a single option concatenated like
-this: "name1=content1; name2=content2;" etc.
-
-This option sets the cookie header explicitly in the outgoing request(s). If
-multiple requests are done due to authentication, followed redirections or
-similar, they all get this cookie passed on.
-
-The cookies set by this option are separate from the internal cookie storage
-held by the cookie engine and they are not be modified by it. If you enable
-the cookie engine and either you have imported a cookie of the same name
-(e.g. 'foo') or the server has set one, it has no effect on the cookies you
-set here.  A request to the server sends both the 'foo' held by the cookie
-engine and the 'foo' held by this option. To set a cookie that is instead held
-by the cookie engine and can be modified by the server use
-\fICURLOPT_COOKIELIST(3)\fP.
-
-Using this option multiple times makes the last set string override the
-previous ones.
-
-This option does not enable the cookie engine. Use \fICURLOPT_COOKIEFILE(3)\fP
-or \fICURLOPT_COOKIEJAR(3)\fP to enable parsing and sending cookies
-automatically.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL, no cookies
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  curl_easy_setopt(curl, CURLOPT_COOKIE, "tool=curl; fun=yes;");
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-If HTTP is enabled
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is enabled, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_COOKIEFILE "(3), " CURLOPT_COOKIEJAR "(3), "  CURLOPT_COOKIELIST "(3), "
-.BR CURLOPT_HTTPHEADER "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIE.md
new file mode 100644
index 0000000000..4c47c1fdaf
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIE.md
@@ -0,0 +1,97 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_COOKIE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_COOKIELIST (3)
+  - CURLOPT_COOKIEFILE (3)
+  - CURLOPT_COOKIEJAR (3)
+  - CURLOPT_COOKIELIST (3)
+  - CURLOPT_HTTPHEADER (3)
+Protocol:
+  - HTTP
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_COOKIE - HTTP Cookie header
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_COOKIE, char *cookie);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter. It is used to set one
+or more cookies in the HTTP request. The format of the string should be
+NAME=CONTENTS, where NAME is the cookie name and CONTENTS is what the cookie
+should contain.
+
+To set multiple cookies, set them all using a single option concatenated like
+this: "name1=content1; name2=content2;" etc. libcurl does not syntax check the
+data but assumes the application gives it what it needs to send.
+
+This option sets the cookie header explicitly in the outgoing request(s). If
+multiple requests are done due to authentication, followed redirections or
+similar, they all get this cookie passed on.
+
+The cookies set by this option are separate from the internal cookie storage
+held by the cookie engine and they are not be modified by it. If you enable
+the cookie engine and either you have imported a cookie of the same name (e.g.
+'foo') or the server has set one, it has no effect on the cookies you set
+here. A request to the server sends both the 'foo' held by the cookie engine
+and the 'foo' held by this option. To set a cookie that is instead held by the
+cookie engine and can be modified by the server use CURLOPT_COOKIELIST(3).
+
+Since this custom cookie is appended to the Cookie: header in addition to any
+cookies set by the cookie engine, there is a risk that the header ends up too
+long and thereby getting the entire request rejected by the server.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+This option does not enable the cookie engine. Use CURLOPT_COOKIEFILE(3) or
+CURLOPT_COOKIEJAR(3) to enable parsing and sending cookies automatically.
+
+# DEFAULT
+
+NULL, no cookies
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    curl_easy_setopt(curl, CURLOPT_COOKIE, "tool=curl; fun=yes;");
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIEFILE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIEFILE.3
deleted file mode 100644
index 8a56ff44a1..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIEFILE.3
+++ /dev/null
@@ -1,95 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_COOKIEFILE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_COOKIEFILE \- file name to read cookies from
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_COOKIEFILE, char *filename);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter. It should point to
-the file name of your file holding cookie data to read. The cookie data can be
-in either the old Netscape / Mozilla cookie data format or just regular HTTP
-headers (Set-Cookie style) dumped to a file.
-
-It also enables the cookie engine, making libcurl parse and send cookies on
-subsequent requests with this handle.
-
-By passing the empty string ("") to this option, you enable the cookie engine
-without reading any initial cookies. If you tell libcurl the file name is "-"
-(just a single minus sign), libcurl instead reads from stdin.
-
-This option only \fBreads\fP cookies. To make libcurl write cookies to file,
-see \fICURLOPT_COOKIEJAR(3)\fP.
-
-If you read cookies from a plain HTTP headers file and it does not specify a
-domain in the Set-Cookie line, then the cookie is not sent since the cookie
-domain cannot match the target URL's. To address this, set a domain in
-Set-Cookie line (doing that includes subdomains) or preferably: use the
-Netscape format.
-
-If you use this option multiple times, you add more files to read cookies
-from.
-
-The application does not have to keep the string around after setting this
-option.
-
-Setting this option to NULL (since 7.77.0) explicitly disables the cookie
-engine and clears the list of files to read cookies from.
-.SH SECURITY
-This document previously mentioned how specifying a non-existing file can also
-enable the cookie engine. While true, we strongly advise against using that
-method as it is too hard to be sure that files that stay that way in the long
-run.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-
-  /* get cookies from an existing file */
-  curl_easy_setopt(curl, CURLOPT_COOKIEFILE, "/tmp/cookies.txt");
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH "Cookie file format"
-The cookie file format and general cookie concepts in curl are described
-online here: https://curl.se/docs/http-cookies.html
-.SH AVAILABILITY
-As long as HTTP is supported
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_COOKIE "(3), " CURLOPT_COOKIEJAR "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIEFILE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIEFILE.md
new file mode 100644
index 0000000000..bf2d374464
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIEFILE.md
@@ -0,0 +1,108 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_COOKIEFILE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_COOKIE (3)
+  - CURLOPT_COOKIEJAR (3)
+  - CURLOPT_COOKIESESSION (3)
+Protocol:
+  - HTTP
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_COOKIEFILE - filename to read cookies from
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_COOKIEFILE, char *filename);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter. It should point to
+the filename of your file holding cookie data to read. The cookie data can be
+in either the old Netscape / Mozilla cookie data format or regular HTTP
+headers (Set-Cookie style) dumped to a file.
+
+It also enables the cookie engine, making libcurl parse and send cookies on
+subsequent requests with this handle.
+
+By passing the empty string ("") to this option, you enable the cookie engine
+without reading any initial cookies. If you tell libcurl the filename is "-"
+(a single minus sign), libcurl instead reads from stdin.
+
+This option only **reads** cookies. To make libcurl write cookies to file,
+see CURLOPT_COOKIEJAR(3).
+
+If you read cookies from a plain HTTP headers file and it does not specify a
+domain in the Set-Cookie line, then the cookie is not sent since the cookie
+domain cannot match the target URL's. To address this, set a domain in
+Set-Cookie line (doing that includes subdomains) or preferably: use the
+Netscape format.
+
+The application does not have to keep the string around after setting this
+option.
+
+If you use this option multiple times, you add more files to read cookies
+from. Setting this option to NULL disables the cookie engine and clears the
+list of files to read cookies from.
+
+The cookies are loaded from the specified file(s) when the transfer starts,
+not when this option is set.
+
+libcurl ignores filenames which do not exist or point to a directory.
+
+# SECURITY CONCERNS
+
+This document previously mentioned how specifying a non-existing file can also
+enable the cookie engine. While true, we strongly advise against using that
+method as it is too hard to be sure that files that stay that way in the long
+run.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+
+    /* get cookies from an existing file */
+    curl_easy_setopt(curl, CURLOPT_COOKIEFILE, "/tmp/cookies.txt");
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# Cookie file format
+
+The cookie file format and general cookie concepts in curl are described
+online here: https://curl.se/docs/http-cookies.html
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIEJAR.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIEJAR.3
deleted file mode 100644
index c0d21a1df7..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIEJAR.3
+++ /dev/null
@@ -1,83 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_COOKIEJAR 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_COOKIEJAR \- file name to store cookies to
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_COOKIEJAR, char *filename);
-.fi
-.SH DESCRIPTION
-Pass a \fIfilename\fP as a char *, null-terminated. This makes libcurl write
-all internally known cookies to the specified file when
-\fIcurl_easy_cleanup(3)\fP is called. If no cookies are kept in memory at that
-time, no file is created. Specify "-" as filename to instead have the cookies
-written to stdout. Using this option also enables cookies for this session, so
-if you for example follow a redirect it makes matching cookies get sent
-accordingly.
-
-Note that libcurl does not read any cookies from the cookie jar specified with
-this option. To read cookies from a file, use \fICURLOPT_COOKIEFILE(3)\fP.
-
-If the cookie jar file cannot be created or written to (when the
-\fIcurl_easy_cleanup(3)\fP is called), libcurl does not and cannot report an
-error for this. Using \fICURLOPT_VERBOSE(3)\fP or
-\fICURLOPT_DEBUGFUNCTION(3)\fP displays a warning, but that is the only
-visible feedback you get about this possibly lethal situation.
-
-Cookies are imported in the Set-Cookie format without a domain name are not
-exported by this option.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-
-  /* export cookies to this file when closing the handle */
-  curl_easy_setopt(curl, CURLOPT_COOKIEJAR, "/tmp/cookies.txt");
-
-  ret = curl_easy_perform(curl);
-
-  /* close the handle, write the cookies! */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Along with HTTP
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_COOKIEFILE "(3), " CURLOPT_COOKIE "(3), "
-.BR CURLOPT_COOKIELIST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIEJAR.md b/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIEJAR.md
new file mode 100644
index 0000000000..ac3a7074d0
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIEJAR.md
@@ -0,0 +1,99 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_COOKIEJAR
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_COOKIE (3)
+  - CURLOPT_COOKIEFILE (3)
+  - CURLOPT_COOKIELIST (3)
+Protocol:
+  - HTTP
+Added-in: 7.9
+---
+
+# NAME
+
+CURLOPT_COOKIEJAR - filename to store cookies to
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_COOKIEJAR, char *filename);
+~~~
+
+# DESCRIPTION
+
+Pass a *filename* as a char *, null-terminated. This makes libcurl write all
+internally known cookies to the specified file when curl_easy_cleanup(3) is
+called. If no cookies are kept in memory at that time, no file is created.
+Specify "-" as filename to instead have the cookies written to stdout. Using
+this option also enables cookies for this session, so if you for example
+follow a redirect it makes matching cookies get sent accordingly.
+
+Note that libcurl does not read any cookies from the cookie jar specified with
+this option. To read cookies from a file, use CURLOPT_COOKIEFILE(3).
+
+If the cookie jar file cannot be created or written to (when the
+curl_easy_cleanup(3) is called), libcurl does not and cannot report an error
+for this. Using CURLOPT_VERBOSE(3) or CURLOPT_DEBUGFUNCTION(3) displays a
+warning, but that is the only visible feedback you get about this possibly
+lethal situation.
+
+Cookies are imported in the Set-Cookie format without a domain name are not
+exported by this option.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# SECURITY CONCERNS
+
+libcurl cannot fully protect against attacks where an attacker has write
+access to the same directory where it is directed to save files. This is
+particularly sensitive if you save files using elevated privileges.
+
+libcurl creates the file to store cookies using default file permissions,
+meaning that on *nix systems you may need to restrict your umask to prevent
+other users on the same system to access the file.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+
+    /* export cookies to this file when closing the handle */
+    curl_easy_setopt(curl, CURLOPT_COOKIEJAR, "/tmp/cookies.txt");
+
+    result = curl_easy_perform(curl);
+
+    /* close the handle, write the cookies */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIELIST.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIELIST.3
deleted file mode 100644
index 51951fb8cf..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIELIST.3
+++ /dev/null
@@ -1,123 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_COOKIELIST 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_COOKIELIST \- add to or manipulate cookies held in memory
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_COOKIELIST,
-                          char *cookie);
-.SH DESCRIPTION
-Pass a char * to a \fIcookie\fP string.
-
-Such a cookie can be either a single line in Netscape / Mozilla format or just
-regular HTTP-style header (Set-Cookie: ...) format. This option also enables
-the cookie engine. This adds that single cookie to the internal cookie store.
-
-We strongly advice against loading cookies from a HTTP header file, as that is
-an inferior data exchange format.
-
-Exercise caution if you are using this option and multiple transfers may
-occur. If you use the Set-Cookie format and the string does not specify a
-domain, then the cookie is sent for any domain (even after redirects are
-followed) and cannot be modified by a server-set cookie. If a server sets a
-cookie of the same name (or maybe you have imported one) then both are sent on
-future transfers to that server, likely not what you intended. To address
-these issues set a domain in Set-Cookie (doing that includes subdomains) or
-much better: use the Netscape file format.
-
-Additionally, there are commands available that perform actions if you pass in
-these exact strings:
-.IP ALL
-erases all cookies held in memory
-
-.IP SESS
-erases all session cookies held in memory
-
-.IP FLUSH
-writes all known cookies to the file specified by \fICURLOPT_COOKIEJAR(3)\fP
-
-.IP RELOAD
-loads all cookies from the files specified by \fICURLOPT_COOKIEFILE(3)\fP
-
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-/* an inline import of a cookie in Netscape format. */
-
-#define SEP  "\\t"  /* Tab separates the fields */
-
-char *my_cookie =
-  "example.com"    /* Hostname */
-  SEP "FALSE"      /* Include subdomains */
-  SEP "/"          /* Path */
-  SEP "FALSE"      /* Secure */
-  SEP "0"          /* Expiry in epoch time format. 0 == Session */
-  SEP "foo"        /* Name */
-  SEP "bar";       /* Value */
-
-/* my_cookie is imported immediately via CURLOPT_COOKIELIST. */
-curl_easy_setopt(curl, CURLOPT_COOKIELIST, my_cookie);
-
-/* The list of cookies in cookies.txt are not be imported until right
-   before a transfer is performed. Cookies in the list that have the same
-   hostname, path and name as in my_cookie are skipped. That is because
-   libcurl has already imported my_cookie and it's considered a "live"
-   cookie. A live cookie is not replaced by one read from a file.
-*/
-curl_easy_setopt(curl, CURLOPT_COOKIEFILE, "cookies.txt");  /* import */
-
-/* Cookies are exported after curl_easy_cleanup is called. The server
-   may have added, deleted or modified cookies by then. The cookies that
-   were skipped on import are not exported.
-*/
-curl_easy_setopt(curl, CURLOPT_COOKIEJAR, "cookies.txt");  /* export */
-
-curl_easy_perform(curl);  /* cookies imported from cookies.txt */
-
-curl_easy_cleanup(curl);  /* cookies exported to cookies.txt */
-.fi
-.SH "Cookie file format"
-The cookie file format and general cookie concepts in curl are described
-online here: https://curl.se/docs/http-cookies.html
-.SH AVAILABILITY
-\fBALL\fP was added in 7.14.1
-
-\fBSESS\fP was added in 7.15.4
-
-\fBFLUSH\fP was added in 7.17.1
-
-\fBRELOAD\fP was added in 7.39.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_COOKIEFILE "(3), " CURLOPT_COOKIEJAR "(3), " CURLOPT_COOKIE "(3), "
-.BR CURLINFO_COOKIELIST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIELIST.md b/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIELIST.md
new file mode 100644
index 0000000000..ae7d650db3
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIELIST.md
@@ -0,0 +1,142 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_COOKIELIST
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_COOKIELIST (3)
+  - CURLOPT_COOKIE (3)
+  - CURLOPT_COOKIEFILE (3)
+  - CURLOPT_COOKIEJAR (3)
+Protocol:
+  - HTTP
+Added-in: 7.14.1
+---
+
+# NAME
+
+CURLOPT_COOKIELIST - add to or manipulate cookies held in memory
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_COOKIELIST,
+                          char *cookie);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer to a *cookie* string.
+
+Such a cookie can be either a single line in Netscape / Mozilla format or
+regular HTTP-style header (`Set-Cookie:`) format. This option also enables the
+cookie engine. This adds that single cookie to the internal cookie store.
+
+We strongly advice against loading cookies from an HTTP header file, as that
+is an inferior data exchange format.
+
+Exercise caution if you are using this option and multiple transfers may
+occur. If you use the `Set-Cookie` format and the string does not specify a
+domain, then the cookie is sent for any domain (even after redirects are
+followed) and cannot be modified by a server-set cookie. If a server sets a
+cookie of the same name (or maybe you have imported one) then both are sent on
+future transfers to that server, likely not what you intended. To address
+these issues set a domain in `Set-Cookie` (doing that includes subdomains) or
+much better: use the Netscape file format.
+
+Additionally, there are commands available that perform actions if you pass in
+these exact strings:
+
+## `ALL`
+
+erases all cookies held in memory
+
+## `SESS`
+
+erases all session cookies held in memory
+
+## `FLUSH`
+
+writes all known cookies to the file specified by CURLOPT_COOKIEJAR(3)
+
+## `RELOAD`
+
+loads all cookies from the files specified by CURLOPT_COOKIEFILE(3)
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+/* an inline import of a cookie in Netscape format. */
+
+#define SEP "\t"  /* Tab separates the fields */
+
+int main(void)
+{
+  const char *my_cookie =
+    "example.com"    /* Hostname */
+    SEP "FALSE"      /* Include subdomains */
+    SEP "/"          /* Path */
+    SEP "FALSE"      /* Secure */
+    SEP "0"          /* Expiry in epoch time format. 0 == Session */
+    SEP "foo"        /* Name */
+    SEP "bar";       /* Value */
+
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    /* my_cookie is imported immediately via CURLOPT_COOKIELIST. */
+    curl_easy_setopt(curl, CURLOPT_COOKIELIST, my_cookie);
+
+    /* The list of cookies in cookies.txt are not be imported until right
+       before a transfer is performed. Cookies in the list that have the same
+       hostname, path and name as in my_cookie are skipped. That is because
+       libcurl has already imported my_cookie and it is considered a "live"
+       cookie. A live cookie is not replaced by one read from a file.
+    */
+    curl_easy_setopt(curl, CURLOPT_COOKIEFILE, "cookies.txt");  /* import */
+
+    /* Cookies are exported after curl_easy_cleanup is called. The server
+       may have added, deleted or modified cookies by then. The cookies that
+       were skipped on import are not exported.
+    */
+    curl_easy_setopt(curl, CURLOPT_COOKIEJAR, "cookies.txt");  /* export */
+
+    result = curl_easy_perform(curl); /* cookies imported from cookies.txt */
+
+    curl_easy_cleanup(curl);  /* cookies exported to cookies.txt */
+  }
+}
+~~~
+
+# Cookie file format
+
+The cookie file format and general cookie concepts in curl are described
+online here: https://curl.se/docs/http-cookies.html
+
+# HISTORY
+
+**ALL** was added in 7.14.1
+
+**SESS** was added in 7.15.4
+
+**FLUSH** was added in 7.17.1
+
+**RELOAD** was added in 7.39.0
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIESESSION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIESESSION.3
deleted file mode 100644
index 90019acba1..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIESESSION.3
+++ /dev/null
@@ -1,71 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_COOKIESESSION 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_COOKIESESSION \- start a new cookie session
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_COOKIESESSION, long init);
-.fi
-.SH DESCRIPTION
-Pass a long set to 1 to mark this as a new cookie "session". It forces libcurl
-to ignore all cookies it is about to load that are "session cookies" from the
-previous session. By default, libcurl always loads all cookies, independent if
-they are session cookies or not. Session cookies are cookies without expiry
-date and they are meant to be alive and existing for this "session" only.
-
-A "session" is usually defined in browser land for as long as you have your
-browser up, more or less. libcurl needs the application to use this option to
-tell it when a new session starts, otherwise it assumes everything is still in
-the same session.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-
-  /* new "session", do not load session cookies */
-  curl_easy_setopt(curl, CURLOPT_COOKIESESSION, 1L);
-
-  /* get the (non session) cookies from this file */
-  curl_easy_setopt(curl, CURLOPT_COOKIEFILE, "/tmp/cookies.txt");
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Along with HTTP
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_COOKIEFILE "(3), " CURLOPT_COOKIE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIESESSION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIESESSION.md
new file mode 100644
index 0000000000..920b4b59fe
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_COOKIESESSION.md
@@ -0,0 +1,77 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_COOKIESESSION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_COOKIE (3)
+  - CURLOPT_COOKIEFILE (3)
+  - CURLOPT_COOKIEJAR (3)
+Protocol:
+  - HTTP
+Added-in: 7.9.7
+---
+
+# NAME
+
+CURLOPT_COOKIESESSION - start a new cookie session
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_COOKIESESSION, long init);
+~~~
+
+# DESCRIPTION
+
+Pass a long set to 1 to mark this as a new cookie "session". It forces libcurl
+to ignore all cookies it is about to load that are "session cookies" from the
+previous session. By default, libcurl always loads all cookies, independent if
+they are session cookies or not. Session cookies are cookies without expiry
+date and they are meant to be alive and existing for this "session" only.
+
+A "session" is usually defined in browser land for as long as you have your
+browser up, more or less. libcurl needs the application to use this option to
+tell it when a new session starts, otherwise it assumes everything is still in
+the same session.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+
+    /* new "session", do not load session cookies */
+    curl_easy_setopt(curl, CURLOPT_COOKIESESSION, 1L);
+
+    /* get the (non session) cookies from this file */
+    curl_easy_setopt(curl, CURLOPT_COOKIEFILE, "/tmp/cookies.txt");
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_COPYPOSTFIELDS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_COPYPOSTFIELDS.3
deleted file mode 100644
index 203326b962..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_COPYPOSTFIELDS.3
+++ /dev/null
@@ -1,74 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_COPYPOSTFIELDS 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_COPYPOSTFIELDS \- have libcurl copy data to POST
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_COPYPOSTFIELDS, char *data);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter, which should be the full \fIdata\fP to post in a
-HTTP POST operation. It behaves as the \fICURLOPT_POSTFIELDS(3)\fP option, but
-the original data is instead copied by the library, allowing the application
-to overwrite the original data after setting this option.
-
-Because data are copied, care must be taken when using this option in
-conjunction with \fICURLOPT_POSTFIELDSIZE(3)\fP or
-\fICURLOPT_POSTFIELDSIZE_LARGE(3)\fP: If the size has not been set prior to
-\fICURLOPT_COPYPOSTFIELDS(3)\fP, the data is assumed to be a null-terminated
-string; else the stored size informs the library about the byte count to
-copy. In any case, the size must not be changed after
-\fICURLOPT_COPYPOSTFIELDS(3)\fP, unless another \fICURLOPT_POSTFIELDS(3)\fP or
-\fICURLOPT_COPYPOSTFIELDS(3)\fP option is issued.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  char local_buffer[1024]="data to send";
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* size of the data to copy from the buffer and send in the request */
-  curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, 12L);
-
-  /* send data from the local stack */
-  curl_easy_setopt(curl, CURLOPT_COPYPOSTFIELDS, local_buffer);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.17.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_POSTFIELDS "(3), " CURLOPT_POSTFIELDSIZE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_COPYPOSTFIELDS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_COPYPOSTFIELDS.md
new file mode 100644
index 0000000000..d7613f1247
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_COPYPOSTFIELDS.md
@@ -0,0 +1,88 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_COPYPOSTFIELDS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_MIMEPOST (3)
+  - CURLOPT_POSTFIELDS (3)
+  - CURLOPT_POSTFIELDSIZE (3)
+  - CURLOPT_UPLOAD (3)
+Protocol:
+  - HTTP
+  - MQTT
+  - RTSP
+Added-in: 7.17.1
+---
+
+# NAME
+
+CURLOPT_COPYPOSTFIELDS - have libcurl copy data to POST
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_COPYPOSTFIELDS, char *data);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter, which should be the full *data* to post in a
+HTTP POST operation. It behaves as the CURLOPT_POSTFIELDS(3) option, but the
+original data is instead copied by the library, allowing the application to
+overwrite the original data after setting this option.
+
+Because data is copied, care must be taken when using this option in
+conjunction with CURLOPT_POSTFIELDSIZE(3) or CURLOPT_POSTFIELDSIZE_LARGE(3).
+If the size has not been set prior to CURLOPT_COPYPOSTFIELDS(3), the data is
+assumed to be a null-terminated string; else the stored size informs the
+library about the byte count to copy. In any case, the size must not be
+changed after CURLOPT_COPYPOSTFIELDS(3), unless another CURLOPT_POSTFIELDS(3)
+or CURLOPT_COPYPOSTFIELDS(3) option is set.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    char local_buffer[1024]="data to send";
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* size of the data to copy from the buffer and send in the request */
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, 12L);
+
+    /* send data from the local stack */
+    curl_easy_setopt(curl, CURLOPT_COPYPOSTFIELDS, local_buffer);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CRLF.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CRLF.3
deleted file mode 100644
index 5e8fedb41f..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CRLF.3
+++ /dev/null
@@ -1,60 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CRLF 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_CRLF \- CRLF conversion
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CRLF, long conv);
-.fi
-.SH DESCRIPTION
-Pass a long. If the value is set to 1 (one), libcurl converts Unix newlines to
-CRLF newlines on transfers. Disable this option again by setting the value to
-0 (zero).
-
-This is a legacy option of questionable use.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/");
-  curl_easy_setopt(curl, CURLOPT_CRLF, 1L);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-SMTP since 7.40.0, other protocols since they were introduced
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_CONV_FROM_NETWORK_FUNCTION "(3), " CURLOPT_CONV_TO_NETWORK_FUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CRLF.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CRLF.md
new file mode 100644
index 0000000000..4ce1a165c1
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CRLF.md
@@ -0,0 +1,64 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CRLF
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CONV_FROM_NETWORK_FUNCTION (3)
+  - CURLOPT_CONV_TO_NETWORK_FUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_CRLF - CRLF conversion
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CRLF, long conv);
+~~~
+
+# DESCRIPTION
+
+Pass a long. If the value is set to 1 (one), libcurl converts Unix newlines to
+CRLF newlines on transfers. Disable this option again by setting the value to
+0 (zero).
+
+This is a legacy option of questionable use.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/");
+    curl_easy_setopt(curl, CURLOPT_CRLF, 1L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CRLFILE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CRLFILE.3
deleted file mode 100644
index ac215cb3fa..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CRLFILE.3
+++ /dev/null
@@ -1,79 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CRLFILE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_CRLFILE \- Certificate Revocation List file
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CRLFILE, char *file);
-.fi
-.SH DESCRIPTION
-Pass a char * to a null-terminated string naming a \fIfile\fP with the
-concatenation of CRL (in PEM format) to use in the certificate validation that
-occurs during the SSL exchange.
-
-When curl is built to use GnuTLS, there is no way to influence the use of CRL
-passed to help in the verification process.
-
-When libcurl is built with OpenSSL support, X509_V_FLAG_CRL_CHECK and
-X509_V_FLAG_CRL_CHECK_ALL are both set, requiring CRL check against all the
-elements of the certificate chain if a CRL file is passed. Also note that
-\fICURLOPT_CRLFILE(3)\fP implies \fBCURLSSLOPT_NO_PARTIALCHAIN\fP (see
-\fICURLOPT_SSL_OPTIONS(3)\fP) since curl 7.71.0 due to an OpenSSL bug.
-
-This option makes sense only when used in combination with the
-\fICURLOPT_SSL_VERIFYPEER(3)\fP option.
-
-A specific error code (\fICURLE_SSL_CRL_BADFILE\fP) is defined with the
-option. It is returned when the SSL exchange fails because the CRL file cannot
-be loaded.  A failure in certificate verification due to a revocation
-information found in the CRL does not trigger this specific error.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS-based protocols
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_CRLFILE, "/etc/certs/crl.pem");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.19.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_SSL_VERIFYPEER "(3), " CURLOPT_SSL_VERIFYHOST "(3), "
-.BR CURLOPT_PROXY_CRLFILE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CRLFILE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CRLFILE.md
new file mode 100644
index 0000000000..62f5651090
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CRLFILE.md
@@ -0,0 +1,91 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CRLFILE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_CRLFILE (3)
+  - CURLOPT_SSL_VERIFYHOST (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - GnuTLS
+  - mbedTLS
+  - OpenSSL
+  - Rustls
+Added-in: 7.19.0
+---
+
+# NAME
+
+CURLOPT_CRLFILE - Certificate Revocation List file
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CRLFILE, char *file);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer to a null-terminated string naming a *file* with the
+concatenation of CRL (in PEM format) to use in the certificate validation that
+occurs during the SSL exchange.
+
+When curl is built to use GnuTLS, there is no way to influence the use of CRL
+passed to help in the verification process.
+
+When libcurl is built with OpenSSL support, X509_V_FLAG_CRL_CHECK and
+X509_V_FLAG_CRL_CHECK_ALL are both set, requiring CRL check against all the
+elements of the certificate chain if a CRL file is passed. Also note that
+CURLOPT_CRLFILE(3) implies **CURLSSLOPT_NO_PARTIALCHAIN** (see
+CURLOPT_SSL_OPTIONS(3)) since curl 7.71.0 due to an OpenSSL bug.
+
+This option makes sense only when used in combination with the
+CURLOPT_SSL_VERIFYPEER(3) option.
+
+A specific error code (*CURLE_SSL_CRL_BADFILE*) is defined with the option. It
+is returned when the SSL exchange fails because the CRL file cannot be loaded.
+A failure in certificate verification due to a revocation information found in
+the CRL does not trigger this specific error.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_CRLFILE, "/etc/certs/crl.pem");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CURLU.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CURLU.3
deleted file mode 100644
index 0e4d9acb69..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CURLU.3
+++ /dev/null
@@ -1,74 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CURLU 3 "28 Oct 2018" libcurl libcurl
-.SH NAME
-CURLOPT_CURLU \- URL in URL handle format
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CURLU, CURLU *pointer);
-.fi
-.SH DESCRIPTION
-Pass in a pointer to the \fIURL\fP handle to work with. The parameter should
-be a \fICURLU *\fP. Setting \fICURLOPT_CURLU(3)\fP explicitly overrides
-\fICURLOPT_URL(3)\fP.
-
-\fICURLOPT_URL(3)\fP or \fICURLOPT_CURLU(3)\fP \fBmust\fP be set before a
-transfer is started.
-
-libcurl uses this handle and its contents read-only and does not change its
-contents. An application can update the contents of the URL handle after a
-transfer is done and if the same handle is used in a subsequent request the
-updated contents is used.
-.SH DEFAULT
-The default value of this parameter is NULL.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *handle = curl_easy_init();
-CURLU *urlp = curl_url();
-int res = 0;
-if(curl) {
-
-  res = curl_url_set(urlp, CURLUPART_URL, "https://example.com", 0);
-
-  curl_easy_setopt(handle, CURLOPT_CURLU, urlp);
-
-  ret = curl_easy_perform(handle);
-
-  curl_url_cleanup(urlp);
-  curl_easy_cleanup(handle);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.63.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_URL "(3), "
-.BR curl_url "(3), " curl_url_get "(3), " curl_url_set "(3), "
-.BR curl_url_dup "(3), " curl_url_cleanup "(3), " curl_url_strerror "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CURLU.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CURLU.md
new file mode 100644
index 0000000000..f9207b85db
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CURLU.md
@@ -0,0 +1,81 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CURLU
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_URL (3)
+  - curl_url (3)
+  - curl_url_cleanup (3)
+  - curl_url_dup (3)
+  - curl_url_get (3)
+  - curl_url_set (3)
+  - curl_url_strerror (3)
+Protocol:
+  - All
+Added-in: 7.63.0
+---
+
+# NAME
+
+CURLOPT_CURLU - URL in URL handle format
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CURLU, CURLU *pointer);
+~~~
+
+# DESCRIPTION
+
+Pass in a pointer to the *URL* handle to work with. The parameter should be a
+*CURLU pointer*. Setting CURLOPT_CURLU(3) explicitly overrides
+CURLOPT_URL(3).
+
+CURLOPT_URL(3) or CURLOPT_CURLU(3) **must** be set before a
+transfer is started.
+
+libcurl uses this handle and its contents read-only and does not change its
+contents. An application can update the contents of the URL handle after a
+transfer is done and if the same handle is used in a subsequent request the
+updated contents is used.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  CURLU *urlp = curl_url();
+  if(curl) {
+    CURLcode result;
+    CURLUcode ret;
+    ret = curl_url_set(urlp, CURLUPART_URL, "https://example.com", 0);
+
+    curl_easy_setopt(curl, CURLOPT_CURLU, urlp);
+
+    result = curl_easy_perform(curl);
+
+    curl_url_cleanup(urlp);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CUSTOMREQUEST.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_CUSTOMREQUEST.3
deleted file mode 100644
index 06cd5fed01..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_CUSTOMREQUEST.3
+++ /dev/null
@@ -1,115 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_CUSTOMREQUEST 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_CUSTOMREQUEST \- custom request method
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CUSTOMREQUEST, char *method);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter.
-
-When you change the request \fImethod\fP by setting
-\fICURLOPT_CUSTOMREQUEST(3)\fP to something, you do not actually change how
-libcurl behaves or acts in regards to the particular request method, it only
-changes the actual string sent in the request.
-
-Restore to the internal default by setting this to NULL.
-
-This option can be used to specify the request:
-.IP HTTP
-Instead of GET or HEAD when performing HTTP based requests. This is
-particularly useful, for example, for performing an HTTP DELETE request.
-
-For example:
-
-When you tell libcurl to do a HEAD request, but then specify a GET though a
-custom request libcurl still acts as if it sent a HEAD. To switch to a proper
-HEAD use \fICURLOPT_NOBODY(3)\fP, to switch to a proper POST use
-\fICURLOPT_POST(3)\fP or \fICURLOPT_POSTFIELDS(3)\fP and to switch to a proper
-GET use \fICURLOPT_HTTPGET(3)\fP.
-
-Many people have wrongly used this option to replace the entire request with
-their own, including multiple headers and POST contents. While that might work
-in many cases, it might cause libcurl to send invalid requests and it could
-possibly confuse the remote server badly. Use \fICURLOPT_POST(3)\fP and
-\fICURLOPT_POSTFIELDS(3)\fP to set POST data. Use \fICURLOPT_HTTPHEADER(3)\fP
-to replace or extend the set of headers sent by libcurl. Use
-\fICURLOPT_HTTP_VERSION(3)\fP to change HTTP version.
-
-.IP FTP
-Instead of LIST and NLST when performing FTP directory listings.
-.IP IMAP
-Instead of LIST when issuing IMAP based requests.
-.IP POP3
-Instead of LIST and RETR when issuing POP3 based requests.
-
-For example:
-
-When you tell libcurl to use a custom request it behaves like a LIST or RETR
-command was sent where it expects data to be returned by the server. As such
-\fICURLOPT_NOBODY(3)\fP should be used when specifying commands such as
-\fBDELE\fP and \fBNOOP\fP for example.
-.IP SMTP
-Instead of a \fBHELP\fP or \fBVRFY\fP when issuing SMTP based requests.
-
-For example:
-
-Normally a multi line response is returned which can be used, in conjunction
-with \fICURLOPT_MAIL_RCPT(3)\fP, to specify an EXPN request. If the
-\fICURLOPT_NOBODY(3)\fP option is specified then the request can be used to
-issue \fBNOOP\fP and \fBRSET\fP commands.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP, FTP, IMAP, POP3 and SMTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-
-  /* DELETE the given path */
-  curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "DELETE");
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-IMAP is supported since 7.30.0, POP3 since 7.26.0 and SMTP since 7.34.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_HTTPHEADER "(3), " CURLOPT_NOBODY "(3), "
-.BR CURLOPT_REQUEST_TARGET "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_CUSTOMREQUEST.md b/third-party/curl/docs/libcurl/opts/CURLOPT_CUSTOMREQUEST.md
new file mode 100644
index 0000000000..9928eef9d6
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_CUSTOMREQUEST.md
@@ -0,0 +1,142 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_CUSTOMREQUEST
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_EFFECTIVE_METHOD (3)
+  - CURLOPT_HTTPHEADER (3)
+  - CURLOPT_NOBODY (3)
+  - CURLOPT_REQUEST_TARGET (3)
+Protocol:
+  - HTTP
+  - FTP
+  - IMAP
+  - POP3
+  - SMTP
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_CUSTOMREQUEST - custom request method
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CUSTOMREQUEST, char *method);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter.
+
+When changing the request *method* by setting CURLOPT_CUSTOMREQUEST(3), you do
+not actually change how libcurl behaves or acts: you only change the actual
+string sent in the request.
+
+libcurl passes on the verbatim string in its request without any filter or
+other safe guards. That includes white space and control characters.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Restore to the internal default by setting this to NULL.
+
+This option can be used to specify the request:
+
+## HTTP
+
+Instead of GET or HEAD when performing HTTP based requests. This is
+particularly useful, for example, for performing an HTTP DELETE request.
+
+For example:
+
+When you tell libcurl to do a HEAD request, but then specify a GET though a
+custom request libcurl still acts as if it sent a HEAD. To switch to a proper
+HEAD use CURLOPT_NOBODY(3), to switch to a proper POST use
+CURLOPT_POST(3) or CURLOPT_POSTFIELDS(3) and to switch to a proper
+GET use CURLOPT_HTTPGET(3).
+
+Many people have wrongly used this option to replace the entire request with
+their own, including multiple headers and POST contents. While that might work
+in many cases, it might cause libcurl to send invalid requests and it could
+possibly confuse the remote server badly. Use CURLOPT_POST(3) and
+CURLOPT_POSTFIELDS(3) to set POST data. Use CURLOPT_HTTPHEADER(3) to replace
+or extend the set of headers sent by libcurl. Use CURLOPT_HTTP_VERSION(3) to
+change the HTTP version.
+
+When this option is used together with CURLOPT_FOLLOWLOCATION(3), the custom
+set method overrides the method libcurl could otherwise change to for the
+subsequent requests. You can fine-tune that decision by using the
+CURLFOLLOW_OBEYCODE bit to CURLOPT_FOLLOWLOCATION(3) to make redirects adhere
+to the redirect response code as the protocol instructs.
+
+## FTP
+
+Instead of LIST and NLST when performing FTP directory listings.
+
+## IMAP
+
+Instead of LIST when issuing IMAP based requests.
+
+## POP3
+
+Instead of LIST and RETR when issuing POP3 based requests.
+
+For example:
+
+When you tell libcurl to use a custom request it behaves like a LIST or RETR
+command was sent where it expects data to be returned by the server. As such
+CURLOPT_NOBODY(3) should be used when specifying commands such as
+**DELE** and **NOOP** for example.
+
+## SMTP
+
+Instead of a **HELP** or **VRFY** when issuing SMTP based requests.
+
+For example:
+
+Normally a multi line response is returned which can be used, in conjunction
+with CURLOPT_MAIL_RCPT(3), to specify an EXPN request. If the
+CURLOPT_NOBODY(3) option is specified then the request can be used to
+issue **NOOP** and **RSET** commands.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+
+    /* DELETE the given path */
+    curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "DELETE");
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DEBUGDATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_DEBUGDATA.3
deleted file mode 100644
index 300f50d5a3..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_DEBUGDATA.3
+++ /dev/null
@@ -1,73 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_DEBUGDATA 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_DEBUGDATA \- pointer passed to the debug callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DEBUGDATA, void *pointer);
-.fi
-.SH DESCRIPTION
-Pass a \fIpointer\fP to whatever you want passed in to your
-\fICURLOPT_DEBUGFUNCTION(3)\fP in the last void * argument. This pointer is
-not used by libcurl, it is only passed to the callback.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-int main(void)
-{
-  CURL *curl;
-  CURLcode res;
-  struct data my_tracedata;
-
-  curl = curl_easy_init();
-  if(curl) {
-    curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, my_trace);
-
-    curl_easy_setopt(curl, CURLOPT_DEBUGDATA, &my_tracedata);
-
-    /* the DEBUGFUNCTION has no effect until we enable VERBOSE */
-    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
-
-    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-    res = curl_easy_perform(curl);
-
-    /* always cleanup */
-    curl_easy_cleanup(curl);
-  }
-  return 0;
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_STDERR "(3), " CURLOPT_DEBUGFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DEBUGDATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_DEBUGDATA.md
new file mode 100644
index 0000000000..d15a5576fb
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_DEBUGDATA.md
@@ -0,0 +1,89 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_DEBUGDATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DEBUGFUNCTION (3)
+  - CURLOPT_STDERR (3)
+Protocol:
+  - All
+Added-in: 7.9.6
+---
+
+# NAME
+
+CURLOPT_DEBUGDATA - pointer passed to the debug callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DEBUGDATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+Pass a *pointer* to whatever you want passed in to your
+CURLOPT_DEBUGFUNCTION(3) in the last void * argument. This pointer is
+not used by libcurl, it is only passed to the callback.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct data {
+  void *custom;
+};
+
+static int my_trace(CURL *handle, curl_infotype type,
+                    char *data, size_t size,
+                    void *clientp)
+{
+  struct data *mine = clientp;
+  printf("our ptr: %p\n", mine->custom);
+
+  /* output debug info */
+  return 0;
+}
+
+int main(void)
+{
+  CURL *curl;
+  CURLcode result;
+  struct data my_tracedata;
+
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, my_trace);
+
+    curl_easy_setopt(curl, CURLOPT_DEBUGDATA, &my_tracedata);
+
+    /* the DEBUGFUNCTION has no effect until we enable VERBOSE */
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    result = curl_easy_perform(curl);
+
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+  return 0;
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DEBUGFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_DEBUGFUNCTION.3
deleted file mode 100644
index 19ec8ac651..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_DEBUGFUNCTION.3
+++ /dev/null
@@ -1,194 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_DEBUGFUNCTION 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_DEBUGFUNCTION \- debug callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-typedef enum {
-  CURLINFO_TEXT = 0,
-  CURLINFO_HEADER_IN,    /* 1 */
-  CURLINFO_HEADER_OUT,   /* 2 */
-  CURLINFO_DATA_IN,      /* 3 */
-  CURLINFO_DATA_OUT,     /* 4 */
-  CURLINFO_SSL_DATA_IN,  /* 5 */
-  CURLINFO_SSL_DATA_OUT, /* 6 */
-  CURLINFO_END
-} curl_infotype;
-
-int debug_callback(CURL *handle,
-                   curl_infotype type,
-                   char *data,
-                   size_t size,
-                   void *clientp);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DEBUGFUNCTION,
-                          debug_callback);
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-\fICURLOPT_DEBUGFUNCTION(3)\fP replaces the standard debug function used when
-\fICURLOPT_VERBOSE(3)\fP is in effect. This callback receives debug
-information, as specified in the \fItype\fP argument. This function must
-return 0. The \fIdata\fP pointed to by the char * passed to this function is
-not null-terminated, but is exactly of the \fIsize\fP as told by the
-\fIsize\fP argument.
-
-The \fIclientp\fP argument is the pointer set with \fICURLOPT_DEBUGDATA(3)\fP.
-
-Available \fBcurl_infotype\fP values:
-.IP CURLINFO_TEXT
-The data is informational text.
-.IP CURLINFO_HEADER_IN
-The data is header (or header-like) data received from the peer.
-.IP CURLINFO_HEADER_OUT
-The data is header (or header-like) data sent to the peer.
-.IP CURLINFO_DATA_IN
-The data is the unprocessed protocol data received from the peer. Even if the
-data is encoded or compressed, it is not not provided decoded nor decompressed
-to this callback. If you need the data in decoded and decompressed form, use
-\fICURLOPT_WRITEFUNCTION(3)\fP.
-.IP CURLINFO_DATA_OUT
-The data is protocol data sent to the peer.
-.IP CURLINFO_SSL_DATA_OUT
-The data is SSL/TLS (binary) data sent to the peer.
-.IP CURLINFO_SSL_DATA_IN
-The data is SSL/TLS (binary) data received from the peer.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-static
-void dump(const char *text,
-          FILE *stream, unsigned char *ptr, size_t size)
-{
-  size_t i;
-  size_t c;
-  unsigned int width=0x10;
-
-  fprintf(stream, "%s, %10.10ld bytes (0x%8.8lx)\\n",
-          text, (long)size, (long)size);
-
-  for(i=0; i<size; i+= width) {
-    fprintf(stream, "%4.4lx: ", (long)i);
-
-    /* show hex to the left */
-    for(c = 0; c < width; c++) {
-      if(i+c < size)
-        fprintf(stream, "%02x ", ptr[i+c]);
-      else
-        fputs("   ", stream);
-    }
-
-    /* show data on the right */
-    for(c = 0; (c < width) && (i+c < size); c++) {
-      char x = (ptr[i+c] >= 0x20 && ptr[i+c] < 0x80) ? ptr[i+c] : '.';
-      fputc(x, stream);
-    }
-
-    fputc('\\n', stream); /* newline */
-  }
-}
-
-static
-int my_trace(CURL *handle, curl_infotype type,
-             char *data, size_t size,
-             void *clientp)
-{
-  const char *text;
-  (void)handle; /* prevent compiler warning */
-  (void)clientp;
-
-  switch (type) {
-  case CURLINFO_TEXT:
-    fputs("== Info: ", stderr);
-    fwrite(data, size, 1, stderr);
-  default: /* in case a new one is introduced to shock us */
-    return 0;
-
-  case CURLINFO_HEADER_OUT:
-    text = "=> Send header";
-    break;
-  case CURLINFO_DATA_OUT:
-    text = "=> Send data";
-    break;
-  case CURLINFO_SSL_DATA_OUT:
-    text = "=> Send SSL data";
-    break;
-  case CURLINFO_HEADER_IN:
-    text = "<= Recv header";
-    break;
-  case CURLINFO_DATA_IN:
-    text = "<= Recv data";
-    break;
-  case CURLINFO_SSL_DATA_IN:
-    text = "<= Recv SSL data";
-    break;
-  }
-
-  dump(text, stderr, (unsigned char *)data, size);
-  return 0;
-}
-
-int main(void)
-{
-  CURL *curl;
-  CURLcode res;
-
-  curl = curl_easy_init();
-  if(curl) {
-    curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, my_trace);
-
-    /* the DEBUGFUNCTION has no effect until we enable VERBOSE */
-    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
-
-    /* example.com is redirected, so we tell libcurl to follow redirection */
-    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
-
-    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-    res = curl_easy_perform(curl);
-    /* Check for errors */
-    if(res != CURLE_OK)
-      fprintf(stderr, "curl_easy_perform() failed: %s\\n",
-              curl_easy_strerror(res));
-
-    /* always cleanup */
-    curl_easy_cleanup(curl);
-  }
-  return 0;
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_VERBOSE "(3), " CURLOPT_DEBUGDATA "(3), "
-.BR curl_global_trace "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DEBUGFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_DEBUGFUNCTION.md
new file mode 100644
index 0000000000..b1d0dd872c
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_DEBUGFUNCTION.md
@@ -0,0 +1,221 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_DEBUGFUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CONN_ID (3)
+  - CURLINFO_XFER_ID (3)
+  - CURLOPT_DEBUGDATA (3)
+  - CURLOPT_VERBOSE (3)
+  - curl_global_trace (3)
+Protocol:
+  - All
+Added-in: 7.9.6
+---
+
+# NAME
+
+CURLOPT_DEBUGFUNCTION - debug callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+typedef enum {
+  CURLINFO_TEXT = 0,
+  CURLINFO_HEADER_IN,    /* 1 */
+  CURLINFO_HEADER_OUT,   /* 2 */
+  CURLINFO_DATA_IN,      /* 3 */
+  CURLINFO_DATA_OUT,     /* 4 */
+  CURLINFO_SSL_DATA_IN,  /* 5 */
+  CURLINFO_SSL_DATA_OUT, /* 6 */
+  CURLINFO_END
+} curl_infotype;
+
+int debug_callback(CURL *handle,
+                   curl_infotype type,
+                   char *data,
+                   size_t size,
+                   void *clientp);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DEBUGFUNCTION,
+                          debug_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+CURLOPT_DEBUGFUNCTION(3) replaces the standard debug function used when
+CURLOPT_VERBOSE(3) is in effect. This callback receives debug information, as
+specified in the *type* argument. This function must return 0. The *data*
+pointed to by the char * passed to this function is not null-terminated, but
+is exactly of the *size* as told by the *size* argument.
+
+**WARNING:** this callback may receive sensitive contents from headers and
+data, including information sent as **CURLINFO_TEXT**.
+
+The *clientp* argument is the pointer set with CURLOPT_DEBUGDATA(3).
+
+Available **curl_infotype** values:
+
+## CURLINFO_TEXT
+
+The data is informational text.
+
+## CURLINFO_HEADER_IN
+
+The data is header (or header-like) data received from the peer.
+
+## CURLINFO_HEADER_OUT
+
+The data is header (or header-like) data sent to the peer.
+
+## CURLINFO_DATA_IN
+
+The data is the unprocessed protocol data received from the peer. Even if the
+data is encoded or compressed, it is not provided decoded nor decompressed
+to this callback. If you need the data in decoded and decompressed form, use
+CURLOPT_WRITEFUNCTION(3).
+
+## CURLINFO_DATA_OUT
+
+The data is protocol data sent to the peer.
+
+## CURLINFO_SSL_DATA_OUT
+
+The data is SSL/TLS (binary) data sent to the peer.
+
+## CURLINFO_SSL_DATA_IN
+
+The data is SSL/TLS (binary) data received from the peer.
+
+##
+
+**WARNING:** This callback may be called with the curl *handle* set to an
+internal handle. (Added in 8.4.0)
+
+If you need to distinguish your curl *handle* from internal handles then set
+CURLOPT_PRIVATE(3) on your handle.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+static void dump(const char *text,
+                 FILE *stream, unsigned char *ptr, size_t size)
+{
+  size_t i;
+  size_t c;
+  unsigned int width = 0x10;
+
+  fprintf(stream, "%s, %lu bytes (0x%lx)\n",
+          text, (long)size, (long)size);
+
+  for(i = 0; i < size; i += width) {
+    fprintf(stream, "%4.4lx: ", (long)i);
+
+    /* show hex to the left */
+    for(c = 0; c < width; c++) {
+      if(i + c < size)
+        fprintf(stream, "%02x ", ptr[i + c]);
+      else
+        fputs("   ", stream);
+    }
+
+    /* show data on the right */
+    for(c = 0; (c < width) && (i + c < size); c++) {
+      char x = (ptr[i + c] >= 0x20 && ptr[i + c] < 0x80) ? ptr[i + c] : '.';
+      fputc(x, stream);
+    }
+
+    fputc('\n', stream); /* newline */
+  }
+}
+
+static int my_trace(CURL *handle, curl_infotype type,
+                    char *data, size_t size,
+                    void *clientp)
+{
+  const char *text;
+  (void)handle;
+  (void)clientp;
+
+  switch(type) {
+  case CURLINFO_TEXT:
+    fputs("== Info: ", stderr);
+    fwrite(data, size, 1, stderr);
+    return 0;
+  default: /* in case a new one is introduced to shock us */
+    return 0;
+
+  case CURLINFO_HEADER_OUT:
+    text = "=> Send header";
+    break;
+  case CURLINFO_DATA_OUT:
+    text = "=> Send data";
+    break;
+  case CURLINFO_SSL_DATA_OUT:
+    text = "=> Send SSL data";
+    break;
+  case CURLINFO_HEADER_IN:
+    text = "<= Recv header";
+    break;
+  case CURLINFO_DATA_IN:
+    text = "<= Recv data";
+    break;
+  case CURLINFO_SSL_DATA_IN:
+    text = "<= Recv SSL data";
+    break;
+  }
+
+  dump(text, stderr, (unsigned char *)data, size);
+  return 0;
+}
+
+int main(void)
+{
+  CURL *curl;
+  CURLcode result;
+
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, my_trace);
+
+    /* the DEBUGFUNCTION has no effect until we enable VERBOSE */
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+    /* example.com is redirected, so we tell libcurl to follow redirection */
+    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    result = curl_easy_perform(curl);
+    /* Check for errors */
+    if(result != CURLE_OK)
+      fprintf(stderr, "curl_easy_perform() failed: %s\n",
+              curl_easy_strerror(result));
+
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+  return 0;
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DEFAULT_PROTOCOL.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_DEFAULT_PROTOCOL.3
deleted file mode 100644
index f4f9793d97..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_DEFAULT_PROTOCOL.3
+++ /dev/null
@@ -1,86 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_DEFAULT_PROTOCOL 3 "18 Aug 2015" libcurl libcurl
-.SH NAME
-CURLOPT_DEFAULT_PROTOCOL \- default protocol to use if the URL is missing a
-scheme name
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DEFAULT_PROTOCOL,
-                          char *protocol);
-.fi
-.SH DESCRIPTION
-This option tells libcurl to use \fIprotocol\fP if the URL is missing a scheme
-name.
-
-Use one of these protocol (scheme) names:
-
-dict, file, ftp, ftps, gopher, http, https, imap, imaps, ldap, ldaps, pop3,
-pop3s, rtsp, scp, sftp, smb, smbs, smtp, smtps, telnet, tftp
-
-An unknown or unsupported protocol causes error
-\fICURLE_UNSUPPORTED_PROTOCOL\fP when libcurl parses a URL without a
-scheme. Parsing happens when \fIcurl_easy_perform(3)\fP or
-\fIcurl_multi_perform(3)\fP is called. The protocol set supported by libcurl
-vary depending on how it was built. Use \fIcurl_version_info(3)\fP if you need
-a list of protocol names supported by the build of libcurl that you are using.
-
-This option does not change the default proxy protocol (http).
-
-Without this option libcurl would make a guess based on the host, see
-\fICURLOPT_URL(3)\fP for details.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL (make a guess based on the host)
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  /* set a URL without a scheme */
-  curl_easy_setopt(curl, CURLOPT_URL, "example.com");
-
-  /* set the default protocol (scheme) for schemeless URLs */
-  curl_easy_setopt(curl, CURLOPT_DEFAULT_PROTOCOL, "https");
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.45.0
-.SH RETURN VALUE
-CURLE_OK if the option is supported.
-
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-
-CURLE_UNKNOWN_OPTION if the option is not supported.
-.SH "SEE ALSO"
-.BR CURLOPT_URL "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DEFAULT_PROTOCOL.md b/third-party/curl/docs/libcurl/opts/CURLOPT_DEFAULT_PROTOCOL.md
new file mode 100644
index 0000000000..1baf35ca05
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_DEFAULT_PROTOCOL.md
@@ -0,0 +1,93 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_DEFAULT_PROTOCOL
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_PROTOCOL (3)
+  - CURLINFO_SCHEME (3)
+  - CURLOPT_URL (3)
+Protocol:
+  - All
+Added-in: 7.45.0
+---
+
+# NAME
+
+CURLOPT_DEFAULT_PROTOCOL - default protocol to use if the URL is missing a
+scheme name
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DEFAULT_PROTOCOL,
+                          char *protocol);
+~~~
+
+# DESCRIPTION
+
+This option tells libcurl to use *protocol* if the URL is missing a scheme
+name.
+
+Use one of these protocol (scheme) names:
+
+dict, file, ftp, ftps, gopher, http, https, imap, imaps, ldap, ldaps, pop3,
+pop3s, rtsp, scp, sftp, smb, smbs, smtp, smtps, telnet, tftp
+
+An unknown or unsupported protocol causes error *CURLE_UNSUPPORTED_PROTOCOL*
+when libcurl parses a URL without a scheme. Parsing happens when
+curl_easy_perform(3) or curl_multi_perform(3) is called. The protocol set
+supported by libcurl vary depending on how it was built. Use
+curl_version_info(3) if you need a list of protocol names supported by the
+build of libcurl that you are using.
+
+This option does not change the default proxy protocol (http).
+
+Without this option libcurl would make a guess based on the host, see
+CURLOPT_URL(3) for details.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL (make a guess based on the host)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    /* set a URL without a scheme */
+    curl_easy_setopt(curl, CURLOPT_URL, "example.com");
+
+    /* set the default protocol (scheme) for schemeless URLs */
+    curl_easy_setopt(curl, CURLOPT_DEFAULT_PROTOCOL, "https");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+CURLE_OK if the option is supported.
+
+CURLE_OUT_OF_MEMORY if there was insufficient heap space.
+
+CURLE_UNKNOWN_OPTION if the option is not supported.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DIRLISTONLY.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_DIRLISTONLY.3
deleted file mode 100644
index 15fe79f1a9..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_DIRLISTONLY.3
+++ /dev/null
@@ -1,77 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_DIRLISTONLY 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_DIRLISTONLY \- ask for names only in a directory listing
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DIRLISTONLY, long listonly);
-.fi
-.SH DESCRIPTION
-For FTP and SFTP based URLs a parameter set to 1 tells the library to list the
-names of files in a directory, rather than performing a full directory listing
-that would normally include file sizes, dates etc.
-
-For POP3 a parameter of 1 tells the library to list the email message or
-messages on the POP3 server. This can be used to change the default behavior
-of libcurl, when combined with a URL that contains a message ID, to perform a
-"scan listing" which can then be used to determine the size of an email.
-
-Note: For FTP this causes a NLST command to be sent to the FTP server.  Beware
-that some FTP servers list only files in their response to NLST; they might not
-include subdirectories and symbolic links.
-
-Setting this option to 1 also implies a directory listing even if the URL
-does not end with a slash, which otherwise is necessary.
-
-Do not use this option if you also use \fICURLOPT_WILDCARDMATCH(3)\fP as it
-effectively breaks that feature.
-.SH DEFAULT
-0, disabled
-.SH PROTOCOLS
-FTP, SFTP and POP3
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/dir/");
-
-  /* list only */
-  curl_easy_setopt(curl, CURLOPT_DIRLISTONLY, 1L);
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-This option was known as CURLOPT_FTPLISTONLY up to 7.16.4. POP3 is supported
-since 7.21.5.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_CUSTOMREQUEST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DIRLISTONLY.md b/third-party/curl/docs/libcurl/opts/CURLOPT_DIRLISTONLY.md
new file mode 100644
index 0000000000..548d1f0bf6
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_DIRLISTONLY.md
@@ -0,0 +1,91 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_DIRLISTONLY
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CUSTOMREQUEST (3)
+  - CURLOPT_WILDCARDMATCH (3)
+Protocol:
+  - FTP
+  - SFTP
+  - POP3
+Added-in: 7.17.0
+---
+
+# NAME
+
+CURLOPT_DIRLISTONLY - ask for names only in a directory listing
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DIRLISTONLY, long listonly);
+~~~
+
+# DESCRIPTION
+
+For FTP and SFTP based URLs a parameter set to 1 tells the library to list the
+names of files in a directory, rather than performing a full directory listing
+that would normally include file sizes, dates etc.
+
+For POP3 a parameter of 1 tells the library to list the email message or
+messages on the POP3 server. This can be used to change the default behavior
+of libcurl, when combined with a URL that contains a message ID, to perform a
+"scan listing" which can then be used to determine the size of an email.
+
+For FILE, this option has no effect yet as directories are always listed in
+this mode.
+
+Note: For FTP this causes a NLST command to be sent to the FTP server. Beware
+that some FTP servers list only files in their response to NLST; they might
+not include subdirectories and symbolic links.
+
+Setting this option to 1 also implies a directory listing even if the URL
+does not end with a slash, which otherwise is necessary.
+
+Do not use this option if you also use CURLOPT_WILDCARDMATCH(3) as it
+effectively breaks that feature.
+
+# DEFAULT
+
+0, disabled
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/dir/");
+
+    /* list only */
+    curl_easy_setopt(curl, CURLOPT_DIRLISTONLY, 1L);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+This option was known as CURLOPT_FTPLISTONLY up to 7.16.4. POP3 is supported
+since 7.21.5.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DISALLOW_USERNAME_IN_URL.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_DISALLOW_USERNAME_IN_URL.3
deleted file mode 100644
index fcccd2e365..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_DISALLOW_USERNAME_IN_URL.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_DISALLOW_USERNAME_IN_URL 3 "30 May 2018" libcurl libcurl
-.SH NAME
-CURLOPT_DISALLOW_USERNAME_IN_URL \- disallow specifying username in the URL
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DISALLOW_USERNAME_IN_URL,
-                          long disallow);
-.fi
-.SH DESCRIPTION
-A long parameter set to 1 tells the library to not allow URLs that include a
-username.
-
-This is the equivalent to the \fICURLU_DISALLOW_USER\fP flag for the
-\fIcurl_url_set(3)\fP function.
-.SH DEFAULT
-0 (disabled) - user names are allowed by default.
-.SH PROTOCOLS
-Several
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_DISALLOW_USERNAME_IN_URL, 1L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.61.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-
-curl_easy_perform() returns CURLE_LOGIN_DENIED if this option is enabled and a
-URL containing a username is specified.
-.SH "SEE ALSO"
-.BR libcurl-security "(3), ", CURLOPT_PROTOCOLS "(3), "
-.BR curl_url_set "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DISALLOW_USERNAME_IN_URL.md b/third-party/curl/docs/libcurl/opts/CURLOPT_DISALLOW_USERNAME_IN_URL.md
new file mode 100644
index 0000000000..e896b8b685
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_DISALLOW_USERNAME_IN_URL.md
@@ -0,0 +1,73 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_DISALLOW_USERNAME_IN_URL
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROTOCOLS_STR (3)
+  - CURLOPT_URL (3)
+  - curl_url_set (3)
+  - libcurl-security (3)
+Protocol:
+  - All
+Added-in: 7.61.0
+---
+
+# NAME
+
+CURLOPT_DISALLOW_USERNAME_IN_URL - disallow specifying username in the URL
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DISALLOW_USERNAME_IN_URL,
+                          long disallow);
+~~~
+
+# DESCRIPTION
+
+A long parameter set to 1 tells the library to not allow URLs set with
+CURLOPT_URL(3) that include a username.
+
+This is the equivalent to the *CURLU_DISALLOW_USER* flag for the
+curl_url_set(3) function.
+
+Note that this option does not affect URLs set with CURLOPT_CURLU(3).
+
+# DEFAULT
+
+0 (disabled)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_DISALLOW_USERNAME_IN_URL, 1L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
+
+curl_easy_perform(3) returns CURLE_LOGIN_DENIED if this option is
+enabled and a URL containing a username is specified.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_CACHE_TIMEOUT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_CACHE_TIMEOUT.3
deleted file mode 100644
index 7027ab5403..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_CACHE_TIMEOUT.3
+++ /dev/null
@@ -1,85 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_DNS_CACHE_TIMEOUT 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_DNS_CACHE_TIMEOUT \- life-time for DNS cache entries
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DNS_CACHE_TIMEOUT, long age);
-.fi
-.SH DESCRIPTION
-Pass a long, this sets the timeout in seconds. Name resolve results are kept
-in memory and used for this number of seconds. Set to zero to completely
-disable caching, or set to -1 to make the cached entries remain forever. By
-default, libcurl caches this info for 60 seconds.
-
-We recommend users not to tamper with this option unless strictly necessary.
-If you do, be careful of using large values that can make the cache size grow
-significantly if many different host names are used within that timeout
-period.
-
-The name resolve functions of various libc implementations do not re-read name
-server information unless explicitly told so (for example, by calling
-\fIres_init(3)\fP). This may cause libcurl to keep using the older server even
-if DHCP has updated the server info, and this may look like a DNS cache issue
-to the casual libcurl-app user.
-
-DNS entries have a "TTL" property but libcurl does not use that. This DNS
-cache timeout is entirely speculative that a name resolves to the same address
-for a small amount of time into the future.
-
-Since version 8.1.0, libcurl prunes entries from the DNS cache if it exceeds
-30,000 entries no matter which timeout value is used.
-.SH DEFAULT
-60
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-
-  /* only reuse addresses for a short time */
-  curl_easy_setopt(curl, CURLOPT_DNS_CACHE_TIMEOUT, 2L);
-
-  ret = curl_easy_perform(curl);
-
-  /* in this second request, the cache is not be used if more than
-     two seconds have passed since the previous name resolve */
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_DNS_USE_GLOBAL_CACHE "(3), " CURLOPT_DNS_SERVERS "(3), "
-.BR CURLOPT_RESOLVE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_CACHE_TIMEOUT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_CACHE_TIMEOUT.md
new file mode 100644
index 0000000000..5a9b7bbb9a
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_CACHE_TIMEOUT.md
@@ -0,0 +1,95 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_DNS_CACHE_TIMEOUT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CONNECTTIMEOUT_MS (3)
+  - CURLOPT_DNS_SERVERS (3)
+  - CURLOPT_DNS_USE_GLOBAL_CACHE (3)
+  - CURLOPT_MAXAGE_CONN (3)
+  - CURLOPT_RESOLVE (3)
+  - CURLMOPT_NETWORK_CHANGED (3)
+Protocol:
+  - All
+Added-in: 7.9.3
+---
+
+# NAME
+
+CURLOPT_DNS_CACHE_TIMEOUT - life-time for DNS cache entries
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DNS_CACHE_TIMEOUT, long age);
+~~~
+
+# DESCRIPTION
+
+Pass a long, this sets the timeout in seconds. Name resolve results are kept
+in memory and used for this number of seconds. Set to zero to completely
+disable caching, or set to -1 to make the cached entries remain forever. By
+default, libcurl caches this info for 60 seconds.
+
+We recommend users not to tamper with this option unless strictly necessary.
+If you do, be careful of using large values that can make the cache size grow
+significantly if many different hostnames are used within that timeout period.
+
+The name resolve functions of various libc implementations do not re-read name
+server information unless explicitly told so (for example, by calling
+*res_init(3)*). This may cause libcurl to keep using the older server even
+if DHCP has updated the server info, and this may look like a DNS cache issue
+to the casual libcurl-app user.
+
+DNS entries have a "TTL" property but libcurl does not use that. This DNS
+cache timeout is entirely speculative that a name resolves to the same address
+for a small amount of time into the future.
+
+libcurl prunes entries from the DNS cache if it exceeds 30,000 entries no
+matter which timeout value is used. (Added in version 8.1.0)
+
+Since curl 8.16.0, failed name resolves are stored in the DNS cache for half
+the set timeout period.
+
+# DEFAULT
+
+60
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+
+    /* only reuse addresses for a short time */
+    curl_easy_setopt(curl, CURLOPT_DNS_CACHE_TIMEOUT, 2L);
+
+    result = curl_easy_perform(curl);
+
+    /* in this second request, the cache is not be used if more than
+       two seconds have passed since the previous name resolve */
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_INTERFACE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_INTERFACE.3
deleted file mode 100644
index 41d171b53b..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_INTERFACE.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_DNS_INTERFACE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_DNS_INTERFACE \- interface to speak DNS over
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DNS_INTERFACE, char *ifname);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter. Set the name of the network interface that the DNS
-resolver should bind to. This must be an interface name (not an address). Set
-this option to NULL to use the default setting (do not bind to a specific
-interface).
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All protocols except file:// - protocols that resolve host names.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-  curl_easy_setopt(curl, CURLOPT_DNS_INTERFACE, "eth0");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.33.0. This option also requires that libcurl was built with a
-resolver backend that supports this operation. The c-ares backend is the only
-such one.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not,
-or CURLE_NOT_BUILT_IN if support was disabled at compile-time.
-.SH "SEE ALSO"
-.BR CURLOPT_DNS_SERVERS "(3), " CURLOPT_DNS_LOCAL_IP4 "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_INTERFACE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_INTERFACE.md
new file mode 100644
index 0000000000..729223d21b
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_INTERFACE.md
@@ -0,0 +1,76 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_DNS_INTERFACE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DNS_LOCAL_IP4 (3)
+  - CURLOPT_DNS_LOCAL_IP6 (3)
+  - CURLOPT_DNS_SERVERS (3)
+  - CURLOPT_INTERFACE (3)
+Protocol:
+  - All
+Added-in: 7.33.0
+---
+
+# NAME
+
+CURLOPT_DNS_INTERFACE - interface to speak DNS over
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DNS_INTERFACE, char *ifname);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter. Set the name of the network interface that
+the DNS resolver should bind to. This must be an interface name (not an
+address). Set this option to NULL to use the default setting (do not bind to a
+specific interface).
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+    curl_easy_setopt(curl, CURLOPT_DNS_INTERFACE, "eth0");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# NOTES
+
+This option requires that libcurl was built with a resolver backend that
+supports this operation. The c-ares backend is the only such one.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_LOCAL_IP4.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_LOCAL_IP4.3
deleted file mode 100644
index cce07f6f7b..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_LOCAL_IP4.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_DNS_LOCAL_IP4 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_DNS_LOCAL_IP4 \- IPv4 address to bind DNS resolves to
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DNS_LOCAL_IP4, char *address);
-.fi
-.SH DESCRIPTION
-Set the local IPv4 \fIaddress\fP that the resolver should bind to. The
-argument should be of type char * and contain a single numerical IPv4 address
-as a string.  Set this option to NULL to use the default setting (do not bind
-to a specific IP address).
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-  curl_easy_setopt(curl, CURLOPT_DNS_LOCAL_IP4, "192.168.0.14");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-This option requires that libcurl was built with a resolver backend that
-supports this operation. The c-ares backend is the only such one.
-
-Added in 7.33.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not,
-CURLE_NOT_BUILT_IN if support was disabled at compile-time, or
-CURLE_BAD_FUNCTION_ARGUMENT when given a bad address.
-.SH "SEE ALSO"
-.BR CURLOPT_DNS_INTERFACE "(3), " CURLOPT_DNS_LOCAL_IP6 "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_LOCAL_IP4.md b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_LOCAL_IP4.md
new file mode 100644
index 0000000000..4613ff3e1d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_LOCAL_IP4.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_DNS_LOCAL_IP4
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DNS_INTERFACE (3)
+  - CURLOPT_DNS_LOCAL_IP6 (3)
+  - CURLOPT_DNS_SERVERS (3)
+Protocol:
+  - All
+Added-in: 7.33.0
+---
+
+# NAME
+
+CURLOPT_DNS_LOCAL_IP4 - IPv4 address to bind DNS resolves to
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DNS_LOCAL_IP4, char *address);
+~~~
+
+# DESCRIPTION
+
+Set the local IPv4 *address* that the resolver should bind to. The argument
+should be of type char * and contain a single numerical IPv4 address as a
+string. Set this option to NULL to use the default setting (do not bind to a
+specific IP address).
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+    curl_easy_setopt(curl, CURLOPT_DNS_LOCAL_IP4, "192.168.0.14");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# NOTES
+
+This option requires that libcurl was built with a resolver backend that
+supports this operation. The c-ares backend is the only such one.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_LOCAL_IP6.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_LOCAL_IP6.3
deleted file mode 100644
index 6fa51133c5..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_LOCAL_IP6.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_DNS_LOCAL_IP6 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_DNS_LOCAL_IP6 \- IPv6 address to bind DNS resolves to
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DNS_LOCAL_IP6, char *address);
-.fi
-.SH DESCRIPTION
-Set the local IPv6 \fIaddress\fP that the resolver should bind to. The
-argument should be of type char * and contain a single IPv6 address as a
-string.  Set this option to NULL to use the default setting (do not bind to a
-specific IP address).
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-  curl_easy_setopt(curl, CURLOPT_DNS_LOCAL_IP6, "fe80::a9ff:fe46:b619");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-This option requires that libcurl was built with a resolver backend that
-supports this operation. The c-ares backend is the only such one.
-
-Added in 7.33.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not,
-CURLE_NOT_BUILT_IN if support was disabled at compile-time, or
-CURLE_BAD_FUNCTION_ARGUMENT when given a bad address.
-.SH "SEE ALSO"
-.BR CURLOPT_DNS_INTERFACE "(3), " CURLOPT_DNS_LOCAL_IP4 "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_LOCAL_IP6.md b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_LOCAL_IP6.md
new file mode 100644
index 0000000000..3a0fe9abe3
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_LOCAL_IP6.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_DNS_LOCAL_IP6
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DNS_INTERFACE (3)
+  - CURLOPT_DNS_LOCAL_IP4 (3)
+  - CURLOPT_DNS_SERVERS (3)
+Protocol:
+  - All
+Added-in: 7.33.0
+---
+
+# NAME
+
+CURLOPT_DNS_LOCAL_IP6 - IPv6 address to bind DNS resolves to
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DNS_LOCAL_IP6, char *address);
+~~~
+
+# DESCRIPTION
+
+Set the local IPv6 *address* that the resolver should bind to. The argument
+should be of type char * and contain a single IPv6 address as a string. Set
+this option to NULL to use the default setting (do not bind to a specific IP
+address).
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+    curl_easy_setopt(curl, CURLOPT_DNS_LOCAL_IP6, "fe80::a9ff:fe46:b619");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# NOTES
+
+This option requires that libcurl was built with a resolver backend that
+supports this operation. The c-ares backend is the only such one.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_SERVERS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_SERVERS.3
deleted file mode 100644
index 4b0ebdbf37..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_SERVERS.3
+++ /dev/null
@@ -1,71 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_DNS_SERVERS 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_DNS_SERVERS \- DNS servers to use
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DNS_SERVERS, char *servers);
-.fi
-.SH DESCRIPTION
-Pass a char * that is the list of DNS servers to be used instead of the system
-default. The format of the dns servers option is:
-
-host[:port][,host[:port]]...
-
-For example:
-
-192.168.1.100,192.168.1.101,3.4.5.6
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL - use system default
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-  curl_easy_setopt(curl, CURLOPT_DNS_SERVERS, "192.168.1.100:53,192.168.1.101");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-This option requires that libcurl was built with a resolver backend that
-supports this operation. The c-ares backend is the only such one.
-
-Added in 7.24.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not,
-CURLE_NOT_BUILT_IN if support was disabled at compile-time,
-CURLE_BAD_FUNCTION_ARGUMENT when given an invalid server list, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_DNS_LOCAL_IP4 "(3), " CURLOPT_DNS_CACHE_TIMEOUT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_SERVERS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_SERVERS.md
new file mode 100644
index 0000000000..738714786f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_SERVERS.md
@@ -0,0 +1,80 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_DNS_SERVERS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DNS_CACHE_TIMEOUT (3)
+  - CURLOPT_DNS_LOCAL_IP4 (3)
+  - CURLOPT_DNS_LOCAL_IP6 (3)
+Protocol:
+  - All
+Added-in: 7.24.0
+---
+
+# NAME
+
+CURLOPT_DNS_SERVERS - DNS servers to use
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DNS_SERVERS, char *servers);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer that is the list of DNS servers to be used instead of the
+system default. The format of the dns servers option is:
+
+    host[:port][,host[:port]]...
+
+For example:
+
+    192.168.1.100,192.168.1.101,3.4.5.6
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+    curl_easy_setopt(curl, CURLOPT_DNS_SERVERS,
+                     "192.168.1.100:53,192.168.1.101");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# NOTES
+
+This option requires that libcurl was built with a resolver backend that
+supports this operation. The c-ares backend is the only such one.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_SHUFFLE_ADDRESSES.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_SHUFFLE_ADDRESSES.3
deleted file mode 100644
index 910fe75afd..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_SHUFFLE_ADDRESSES.3
+++ /dev/null
@@ -1,73 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_DNS_SHUFFLE_ADDRESSES 3 "3 March 2018" libcurl libcurl
-.SH NAME
-CURLOPT_DNS_SHUFFLE_ADDRESSES \- shuffle IP addresses for hostname
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DNS_SHUFFLE_ADDRESSES, long onoff);
-.fi
-.SH DESCRIPTION
-Pass a long set to 1 to enable this option.
-
-When a name is resolved and more than one IP address is returned, this
-function shuffles the order of all returned addresses so that they are used in
-a random order. This is similar to the ordering behavior of the legacy
-gethostbyname function which is no longer used on most platforms.
-
-Addresses are not reshuffled if name resolution is completed using the DNS
-cache. \fICURLOPT_DNS_CACHE_TIMEOUT(3)\fP can be used together with this
-option to reduce DNS cache timeout or disable caching entirely if frequent
-reshuffling is needed.
-
-Since the addresses returned are randomly reordered, the order is not in
-accordance with RFC 3484 or any other deterministic order that may be
-generated by the system's name resolution implementation. This may have
-performance impacts and may cause IPv4 to be used before IPv6 or vice versa.
-.SH DEFAULT
-0 (disabled)
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_DNS_SHUFFLE_ADDRESSES, 1L);
-
-  curl_easy_perform(curl);
-
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.60.0
-.SH RETURN VALUE
-CURLE_OK or an error such as CURLE_UNKNOWN_OPTION.
-.SH "SEE ALSO"
-.BR CURLOPT_DNS_CACHE_TIMEOUT "(3), " CURLOPT_IPRESOLVE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_SHUFFLE_ADDRESSES.md b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_SHUFFLE_ADDRESSES.md
new file mode 100644
index 0000000000..87d3fd82ef
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_SHUFFLE_ADDRESSES.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_DNS_SHUFFLE_ADDRESSES
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DNS_CACHE_TIMEOUT (3)
+  - CURLOPT_IPRESOLVE (3)
+Protocol:
+  - All
+Added-in: 7.60.0
+---
+
+# NAME
+
+CURLOPT_DNS_SHUFFLE_ADDRESSES - shuffle IP addresses for hostname
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DNS_SHUFFLE_ADDRESSES, long onoff);
+~~~
+
+# DESCRIPTION
+
+Pass a long set to 1 to enable this option.
+
+When a name is resolved and more than one IP address is returned, this
+function shuffles the order of all returned addresses so that they are used in
+a random order. This is similar to the ordering behavior of the legacy
+gethostbyname function which is no longer used on most platforms.
+
+Addresses are not reshuffled if name resolution is completed using the DNS
+cache. CURLOPT_DNS_CACHE_TIMEOUT(3) can be used together with this
+option to reduce DNS cache timeout or disable caching entirely if frequent
+reshuffling is needed.
+
+Since the addresses returned are randomly reordered, the order is not in
+accordance with RFC 3484 or any other deterministic order that may be
+generated by the system's name resolution implementation. This may have
+performance impacts and may cause IPv4 to be used before IPv6 or vice versa.
+
+# DEFAULT
+
+0 (disabled)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_DNS_SHUFFLE_ADDRESSES, 1L);
+
+    result = curl_easy_perform(curl);
+
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+CURLE_OK or an error such as CURLE_UNKNOWN_OPTION.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_USE_GLOBAL_CACHE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_USE_GLOBAL_CACHE.3
deleted file mode 100644
index 8754e63123..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_USE_GLOBAL_CACHE.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_DNS_USE_GLOBAL_CACHE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_DNS_USE_GLOBAL_CACHE \- global DNS cache
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DNS_USE_GLOBAL_CACHE,
-                          long enable);
-.fi
-.SH DESCRIPTION
-Has no function since 7.62.0. Do not use!
-
-Pass a long. If the \fIenable\fP value is 1, it tells curl to use a global DNS
-cache that survives between easy handle creations and deletions. This is not
-thread-safe and this uses a global variable.
-
-See \fICURLOPT_SHARE(3)\fP and \fIcurl_share_init(3)\fP for the correct way to
-share DNS cache between transfers.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  /* switch off the use of a global, thread unsafe, cache */
-  curl_easy_setopt(curl, CURLOPT_DNS_USE_GLOBAL_CACHE, 0L);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Deprecated since 7.11.1. Function removed in 7.62.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_SHARE "(3), " CURLOPT_DNS_CACHE_TIMEOUT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_USE_GLOBAL_CACHE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_USE_GLOBAL_CACHE.md
new file mode 100644
index 0000000000..05093eb2bd
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_DNS_USE_GLOBAL_CACHE.md
@@ -0,0 +1,74 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_DNS_USE_GLOBAL_CACHE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DNS_CACHE_TIMEOUT (3)
+  - CURLOPT_SHARE (3)
+Protocol:
+  - All
+Added-in: 7.9.3
+---
+
+# NAME
+
+CURLOPT_DNS_USE_GLOBAL_CACHE - global DNS cache
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DNS_USE_GLOBAL_CACHE,
+                          long enable);
+~~~
+
+# DESCRIPTION
+
+Has no function since 7.62.0. Do not use.
+
+Pass a long. If the *enable* value is 1, it tells curl to use a global DNS
+cache that survives between easy handle creations and deletions. This is not
+thread-safe and this uses a global variable.
+
+See CURLOPT_SHARE(3) and curl_share_init(3) for the correct way to share DNS
+cache between transfers.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* switch off the use of a global, thread-unsafe, cache */
+    curl_easy_setopt(curl, CURLOPT_DNS_USE_GLOBAL_CACHE, 0L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+
+~~~
+
+# DEPRECATED
+
+Deprecated since 7.11.1. Functionality removed in 7.62.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYHOST.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYHOST.3
deleted file mode 100644
index b572f9b81d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYHOST.3
+++ /dev/null
@@ -1,88 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_DOH_SSL_VERIFYHOST 3 "11 Feb 2021" libcurl libcurl
-.SH NAME
-CURLOPT_DOH_SSL_VERIFYHOST \- verify the host name in the DoH SSL certificate
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DOH_SSL_VERIFYHOST,
-                          long verify);
-.fi
-.SH DESCRIPTION
-Pass a long set to 2L as asking curl to \fIverify\fP the DoH (DNS-over-HTTPS)
-server's certificate name fields against the host name.
-
-This option is the DoH equivalent of \fICURLOPT_SSL_VERIFYHOST(3)\fP and
-only affects requests to the DoH server.
-
-When \fICURLOPT_DOH_SSL_VERIFYHOST(3)\fP is 2, the SSL certificate provided by
-the DoH server must indicate that the server name is the same as the server
-name to which you meant to connect to, or the connection fails.
-
-Curl considers the DoH server the intended one when the Common Name field or a
-Subject Alternate Name field in the certificate matches the host name in the
-DoH URL to which you told Curl to connect.
-
-When the \fIverify\fP value is set to 1L it is treated the same as 2L. However
-for consistency with the other \fIVERIFYHOST\fP options we suggest use 2 and
-not 1.
-
-When the \fIverify\fP value is set to 0L, the connection succeeds regardless of
-the names used in the certificate. Use that ability with caution!
-
-See also \fICURLOPT_DOH_SSL_VERIFYPEER(3)\fP to verify the digital signature
-of the DoH server certificate.
-.SH DEFAULT
-2
-.SH PROTOCOLS
-DoH
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  curl_easy_setopt(curl, CURLOPT_DOH_URL, "https://cloudflare-dns.com/dns-query");
-
-  /* Disable host name verification of the DoH server */
-  curl_easy_setopt(curl, CURLOPT_DOH_SSL_VERIFYHOST, 0L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.76.0
-
-If built TLS enabled.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_DOH_SSL_VERIFYPEER "(3), "
-.BR CURLOPT_SSL_VERIFYHOST "(3), "
-.BR CURLOPT_SSL_VERIFYPEER "(3), "
-.BR CURLOPT_PROXY_SSL_VERIFYPEER "(3), "
-.BR CURLOPT_PROXY_SSL_VERIFYHOST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYHOST.md b/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYHOST.md
new file mode 100644
index 0000000000..0d2c26f2de
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYHOST.md
@@ -0,0 +1,94 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_DOH_SSL_VERIFYHOST
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DOH_SSL_VERIFYPEER (3)
+  - CURLOPT_PROXY_SSL_VERIFYHOST (3)
+  - CURLOPT_PROXY_SSL_VERIFYPEER (3)
+  - CURLOPT_SSL_VERIFYHOST (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - All
+Added-in: 7.76.0
+---
+
+# NAME
+
+CURLOPT_DOH_SSL_VERIFYHOST - verify the hostname in the DoH SSL certificate
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DOH_SSL_VERIFYHOST,
+                          long verify);
+~~~
+
+# DESCRIPTION
+
+Pass a long set to 2L as asking curl to *verify* the DoH (DNS-over-HTTPS)
+server's certificate name fields against the hostname.
+
+This option is the DoH equivalent of CURLOPT_SSL_VERIFYHOST(3) and
+only affects requests to the DoH server.
+
+When CURLOPT_DOH_SSL_VERIFYHOST(3) is 2, the SSL certificate provided by
+the DoH server must indicate that the server name is the same as the server
+name to which you meant to connect to, or the connection fails.
+
+curl considers the DoH server the intended one when the Common Name field or a
+Subject Alternate Name field in the certificate matches the hostname in the
+DoH URL to which you told curl to connect.
+
+When the *verify* value is set to 1L it is treated the same as 2L. However
+for consistency with the other *VERIFYHOST* options we suggest use 2 and
+not 1.
+
+When the *verify* value is set to 0L, the connection succeeds regardless of
+the names used in the certificate. Use that ability with caution.
+
+See also CURLOPT_DOH_SSL_VERIFYPEER(3) to verify the digital signature
+of the DoH server certificate.
+
+# DEFAULT
+
+2
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    curl_easy_setopt(curl, CURLOPT_DOH_URL,
+                     "https://cloudflare-dns.com/dns-query");
+
+    /* Disable hostname verification of the DoH server */
+    curl_easy_setopt(curl, CURLOPT_DOH_SSL_VERIFYHOST, 0L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYPEER.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYPEER.3
deleted file mode 100644
index b802a6f53f..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYPEER.3
+++ /dev/null
@@ -1,101 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_DOH_SSL_VERIFYPEER 3 "11 Feb 2021" libcurl libcurl
-.SH NAME
-CURLOPT_DOH_SSL_VERIFYPEER \- verify the DoH SSL certificate
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DOH_SSL_VERIFYPEER,
-                          long verify);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter set to 1L to enable or 0L to disable.
-
-This option tells curl to verify the authenticity of the DoH (DNS-over-HTTPS)
-server's certificate. A value of 1 means curl verifies; 0 (zero) means it
-does not.
-
-This option is the DoH equivalent of \fICURLOPT_SSL_VERIFYPEER(3)\fP and
-only affects requests to the DoH server.
-
-When negotiating a TLS or SSL connection, the server sends a certificate
-indicating its identity. Curl verifies whether the certificate is authentic,
-i.e. that you can trust that the server is who the certificate says it is.
-This trust is based on a chain of digital signatures, rooted in certification
-authority (CA) certificates you supply.  curl uses a default bundle of CA
-certificates (the path for that is determined at build time) and you can
-specify alternate certificates with the \fICURLOPT_CAINFO(3)\fP option
-or the \fICURLOPT_CAPATH(3)\fP option.
-
-When \fICURLOPT_DOH_SSL_VERIFYPEER(3)\fP is enabled, and the verification
-fails to prove that the certificate is authentic, the connection fails.  When
-the option is zero, the peer certificate verification succeeds regardless.
-
-Authenticating the certificate is not enough to be sure about the server. You
-typically also want to ensure that the server is the server you mean to be
-talking to.  Use \fICURLOPT_DOH_SSL_VERIFYHOST(3)\fP for that. The check
-that the host name in the certificate is valid for the host name you are
-connecting to is done independently of the
-\fICURLOPT_DOH_SSL_VERIFYPEER(3)\fP option.
-
-WARNING: disabling verification of the certificate allows bad guys to
-man-in-the-middle the communication without you knowing it. Disabling
-verification makes the communication insecure. Just having encryption on a
-transfer is not enough as you cannot be sure that you are communicating with
-the correct end-point.
-.SH DEFAULT
-1
-.SH PROTOCOLS
-DoH
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  curl_easy_setopt(curl, CURLOPT_DOH_URL, "https://cloudflare-dns.com/dns-query");
-
-  /* Disable certificate verification of the DoH server */
-  curl_easy_setopt(curl, CURLOPT_DOH_SSL_VERIFYPEER, 0L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.76.0
-
-If built TLS enabled.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_DOH_SSL_VERIFYHOST "(3), "
-.BR CURLOPT_SSL_VERIFYHOST "(3), "
-.BR CURLOPT_SSL_VERIFYPEER "(3), "
-.BR CURLOPT_PROXY_SSL_VERIFYPEER "(3), "
-.BR CURLOPT_PROXY_SSL_VERIFYHOST "(3), "
-.BR CURLOPT_CAINFO "(3), "
-.BR CURLOPT_CAPATH "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYPEER.md b/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYPEER.md
new file mode 100644
index 0000000000..5c36f3db88
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYPEER.md
@@ -0,0 +1,106 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_DOH_SSL_VERIFYPEER
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CAINFO (3)
+  - CURLOPT_CAPATH (3)
+  - CURLOPT_DOH_SSL_VERIFYHOST (3)
+  - CURLOPT_PROXY_SSL_VERIFYHOST (3)
+  - CURLOPT_PROXY_SSL_VERIFYPEER (3)
+  - CURLOPT_SSL_VERIFYHOST (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - All
+Added-in: 7.76.0
+---
+
+# NAME
+
+CURLOPT_DOH_SSL_VERIFYPEER - verify the DoH SSL certificate
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DOH_SSL_VERIFYPEER,
+                          long verify);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter set to 1L to enable or 0L to disable.
+
+This option tells curl to verify the authenticity of the DoH (DNS-over-HTTPS)
+server's certificate. A value of 1 means curl verifies; 0 (zero) means it
+does not.
+
+This option is the DoH equivalent of CURLOPT_SSL_VERIFYPEER(3) and
+only affects requests to the DoH server.
+
+When negotiating a TLS or SSL connection, the server sends a certificate
+indicating its identity. curl verifies whether the certificate is authentic,
+i.e. that you can trust that the server is who the certificate says it is.
+This trust is based on a chain of digital signatures, rooted in certification
+authority (CA) certificates you supply. curl uses a default bundle of CA
+certificates (the path for that is determined at build time) and you can
+specify alternate certificates with the CURLOPT_CAINFO(3) option or the
+CURLOPT_CAPATH(3) option.
+
+When CURLOPT_DOH_SSL_VERIFYPEER(3) is enabled, and the verification fails to
+prove that the certificate is authentic, the connection fails. When the option
+is zero, the peer certificate verification succeeds regardless.
+
+Authenticating the certificate is not enough to be sure about the server. You
+typically also want to ensure that the server is the server you mean to be
+talking to. Use CURLOPT_DOH_SSL_VERIFYHOST(3) for that. The check that the
+hostname in the certificate is valid for the hostname you are connecting to
+is done independently of the CURLOPT_DOH_SSL_VERIFYPEER(3) option.
+
+**WARNING:** disabling verification of the certificate allows bad guys to
+man-in-the-middle the communication without you knowing it. Disabling
+verification makes the communication insecure. Having encryption on a transfer
+is not enough as you cannot be sure that you are communicating with the
+correct end-point.
+
+# DEFAULT
+
+1
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    curl_easy_setopt(curl, CURLOPT_DOH_URL,
+                     "https://cloudflare-dns.com/dns-query");
+
+    /* Disable certificate verification of the DoH server */
+    curl_easy_setopt(curl, CURLOPT_DOH_SSL_VERIFYPEER, 0L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYSTATUS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYSTATUS.3
deleted file mode 100644
index 8d92b1eba6..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYSTATUS.3
+++ /dev/null
@@ -1,74 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_DOH_SSL_VERIFYSTATUS 3 "11 Feb 2021" libcurl libcurl
-.SH NAME
-CURLOPT_DOH_SSL_VERIFYSTATUS \- verify the DoH SSL certificate's status
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DOH_SSL_VERIFYSTATUS,
-                          long verify);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter set to 1 to enable or 0 to disable.
-
-This option determines whether libcurl verifies the status of the DoH
-(DNS-over-HTTPS) server cert using the "Certificate Status Request" TLS
-extension (aka. OCSP stapling).
-
-This option is the DoH equivalent of \fICURLOPT_SSL_VERIFYSTATUS(3)\fP and
-only affects requests to the DoH server.
-
-If this option is enabled and the server does not support the TLS extension,
-the verification fails.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-DoH
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  curl_easy_setopt(curl, CURLOPT_DOH_URL, "https://cloudflare-dns.com/dns-query");
-
-  /* Ask for OCSP stapling when verifying the DoH server */
-  curl_easy_setopt(curl, CURLOPT_DOH_SSL_VERIFYSTATUS, 1L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.76.0. This option is currently only supported by the OpenSSL, and
-GnuTLS TLS backends.
-.SH RETURN VALUE
-Returns CURLE_OK if OCSP stapling is supported by the SSL backend, otherwise
-returns CURLE_NOT_BUILT_IN.
-.SH "SEE ALSO"
-.BR CURLOPT_DOH_SSL_VERIFYHOST "(3), "
-.BR CURLOPT_DOH_SSL_VERIFYPEER "(3), "
-.BR CURLOPT_SSL_VERIFYSTATUS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYSTATUS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYSTATUS.md
new file mode 100644
index 0000000000..85d12440c4
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_SSL_VERIFYSTATUS.md
@@ -0,0 +1,81 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_DOH_SSL_VERIFYSTATUS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DOH_SSL_VERIFYHOST (3)
+  - CURLOPT_DOH_SSL_VERIFYPEER (3)
+  - CURLOPT_SSL_VERIFYSTATUS (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+Added-in: 7.76.0
+---
+
+# NAME
+
+CURLOPT_DOH_SSL_VERIFYSTATUS - verify the DoH SSL certificate's status
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DOH_SSL_VERIFYSTATUS,
+                          long verify);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter set to 1 to enable or 0 to disable.
+
+This option determines whether libcurl verifies the status of the DoH
+(DNS-over-HTTPS) server cert using the "Certificate Status Request" TLS
+extension (aka. OCSP stapling).
+
+This option is the DoH equivalent of CURLOPT_SSL_VERIFYSTATUS(3) and
+only affects requests to the DoH server.
+
+If this option is enabled and the server does not support the TLS extension,
+the verification fails.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    curl_easy_setopt(curl, CURLOPT_DOH_URL,
+                     "https://cloudflare-dns.com/dns-query");
+
+    /* Ask for OCSP stapling when verifying the DoH server */
+    curl_easy_setopt(curl, CURLOPT_DOH_SSL_VERIFYSTATUS, 1L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_URL.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_URL.3
deleted file mode 100644
index 7042e17439..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_URL.3
+++ /dev/null
@@ -1,90 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_DOH_URL 3 "18 Jun 2018" libcurl libcurl
-.SH NAME
-CURLOPT_DOH_URL \- provide the DNS-over-HTTPS URL
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DOH_URL, char *URL);
-.fi
-.SH DESCRIPTION
-Pass in a pointer to a \fIURL\fP for the DoH server to use for name
-resolving. The parameter should be a char * to a null-terminated string which
-must be URL-encoded in the following format: "https://host:port/path". It MUST
-specify an HTTPS URL.
-
-libcurl does not validate the syntax or use this variable until the transfer
-is issued. Even if you set a crazy value here, \fIcurl_easy_setopt(3)\fP still
-returns \fICURLE_OK\fP.
-
-curl sends POST requests to the given DNS-over-HTTPS URL.
-
-To find the DoH server itself, which might be specified using a name, libcurl
-uses the default name lookup function. You can bootstrap that by providing the
-address for the DoH server with \fICURLOPT_RESOLVE(3)\fP.
-
-Disable DoH use again by setting this option to NULL.
-.SH "INHERIT OPTIONS"
-DoH lookups use SSL and some SSL settings from your transfer are inherited,
-like \fICURLOPT_SSL_CTX_FUNCTION(3)\fP.
-
-The hostname and peer certificate verification settings are not inherited but
-can be controlled separately via \fICURLOPT_DOH_SSL_VERIFYHOST(3)\fP and
-\fICURLOPT_DOH_SSL_VERIFYPEER(3)\fP.
-
-A set \fICURLOPT_OPENSOCKETFUNCTION(3)\fP callback is not inherited.
-.SH "KNOWN BUGS"
-Even when DoH is set to be used with this option, there are still some name
-resolves that are performed without it, using the default name resolver
-mechanism. This includes name resolves done for \fICURLOPT_INTERFACE(3)\fP,
-\fICURLOPT_FTPPORT(3)\fP, a proxy type set to \fBCURLPROXY_SOCKS4\fP or
-\fBCURLPROXY_SOCKS5\fP and probably some more.
-.SH DEFAULT
-NULL - there is no default DoH URL. If this option is not set, libcurl uses
-the default name resolver.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_DOH_URL, "https://dns.example.com");
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.62.0
-.SH RETURN VALUE
-Returns CURLE_OK on success or CURLE_OUT_OF_MEMORY if there was insufficient
-heap space.
-
-Note that \fIcurl_easy_setopt(3)\fP does immediately parse the given string so
-when given a bad DoH URL, libcurl might not detect the problem until it later
-tries to resolve a name with it.
-.SH "SEE ALSO"
-.BR CURLOPT_VERBOSE "(3), " CURLOPT_RESOLVE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_URL.md b/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_URL.md
new file mode 100644
index 0000000000..696903c6ba
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_DOH_URL.md
@@ -0,0 +1,104 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_DOH_URL
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DNS_CACHE_TIMEOUT (3)
+  - CURLOPT_RESOLVE (3)
+  - CURLOPT_VERBOSE (3)
+Protocol:
+  - All
+Added-in: 7.62.0
+---
+
+# NAME
+
+CURLOPT_DOH_URL - provide the DNS-over-HTTPS URL
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DOH_URL, char *URL);
+~~~
+
+# DESCRIPTION
+
+Pass in a pointer to a *URL* for the DoH server to use for name resolving. The
+parameter should be a char pointer to a null-terminated string which must be a
+valid and correct HTTPS URL.
+
+libcurl does not validate the syntax or use this variable until the transfer
+is issued. Even if you set a crazy value here, curl_easy_setopt(3) still
+returns *CURLE_OK*.
+
+curl sends POST requests to the given DNS-over-HTTPS URL.
+
+To find the DoH server itself, which might be specified using a name, libcurl
+uses the default name lookup function. You can bootstrap that by providing the
+address for the DoH server with CURLOPT_RESOLVE(3).
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+DoH lookups do not inherit proxy options from its parent transfer.
+
+# INHERIT OPTIONS
+
+DoH lookups use SSL and some SSL settings from your transfer are inherited,
+like CURLOPT_SSL_CTX_FUNCTION(3).
+
+The hostname and peer certificate verification settings are not inherited but
+can be controlled separately via CURLOPT_DOH_SSL_VERIFYHOST(3) and
+CURLOPT_DOH_SSL_VERIFYPEER(3).
+
+A set CURLOPT_OPENSOCKETFUNCTION(3) callback is not inherited.
+
+# KNOWN BUGS
+
+Even when DoH is set to be used with this option, there are still some name
+resolves that are performed without it, using the default name resolver
+mechanism. This includes name resolves done for CURLOPT_INTERFACE(3),
+CURLOPT_FTPPORT(3), a proxy type set to **CURLPROXY_SOCKS4** or
+**CURLPROXY_SOCKS5** and probably some more.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_DOH_URL, "https://dns.example.com");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
+
+Note that curl_easy_setopt(3) does not immediately parse the given string so
+when given a bad DoH URL, libcurl might not detect the problem until it later
+tries to resolve a name with it.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_ECH.md b/third-party/curl/docs/libcurl/opts/CURLOPT_ECH.md
new file mode 100644
index 0000000000..99d3ddaefc
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_ECH.md
@@ -0,0 +1,109 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_ECH
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DOH_URL (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - wolfSSL
+  - Rustls
+Added-in: 8.8.0
+---
+
+# NAME
+
+CURLOPT_ECH - configuration for Encrypted Client Hello
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ECH, char *config);
+~~~
+
+# DESCRIPTION
+
+This feature is **experimental** and may change before it is considered
+stable. We advise against using it in production.
+
+ECH is only compatible with TLSv1.3.
+
+Pass a string that specifies configuration details for ECH. In all cases, if
+ECH is attempted, it may fail for various reasons. The keywords supported are:
+
+## false
+
+Turns off ECH.
+
+## grease
+
+Instructs client to emit a GREASE ECH extension. (The connection fails if ECH
+is attempted but fails.)
+
+## true
+
+Instructs client to attempt ECH, if possible, but to not fail if attempting
+ECH is not possible.
+
+## hard
+
+Instructs client to attempt ECH and fail if attempting ECH is not possible.
+
+## ecl:\<base64-value\>
+
+If the string starts with `ecl:` then the remainder of the string should be a
+base64-encoded ECHConfigList that is used for ECH rather than attempting to
+download such a value from the DNS.
+
+## pn:\<name\>
+
+If the string starts with `pn:` then the remainder of the string should be a
+DNS/hostname that is used to over-ride the public_name field of the
+ECHConfigList that is used for ECH.
+
+##
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL or "false" to disable its use again.
+
+# DEFAULT
+
+NULL, meaning ECH is disabled.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+
+  const char *config = \
+    "ecl:AED+DQA87wAgACB/RuzUCsW3uBbSFI7mzD63TUXpI8sGDTnFTbFCDpa+" \
+    "CAAEAAEAAQANY292ZXIuZGVmby5pZQAA";
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_ECH, config);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_EGDSOCKET.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_EGDSOCKET.3
deleted file mode 100644
index ba953d4cc9..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_EGDSOCKET.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_EGDSOCKET 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_EGDSOCKET \- EGD socket path
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_EGDSOCKET, char *path);
-.fi
-.SH DESCRIPTION
-Deprecated option. It serves no purpose anymore.
-
-Pass a char * to the null-terminated path name to the Entropy Gathering Daemon
-socket. It is used to seed the random engine for TLS.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_EGDSOCKET, "/var/egd.socket");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-If built with TLS enabled. Only the OpenSSL backend uses this, and only with
-OpenSSL versions before 1.1.0.
-
-This option was deprecated in 7.84.0.
-.SH RETURN VALUE
-Returns CURLE_OK if TLS is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_RANDOM_FILE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_EGDSOCKET.md b/third-party/curl/docs/libcurl/opts/CURLOPT_EGDSOCKET.md
new file mode 100644
index 0000000000..76078ea16e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_EGDSOCKET.md
@@ -0,0 +1,47 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_EGDSOCKET
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_RANDOM_FILE (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+Added-in: 7.7
+---
+
+# NAME
+
+CURLOPT_EGDSOCKET - EGD socket path
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_EGDSOCKET, char *path);
+~~~
+
+# DESCRIPTION
+
+Deprecated option. It serves no purpose anymore.
+
+# DEFAULT
+
+NULL
+
+# DEPRECATED
+
+This option was deprecated in 7.84.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_ERRORBUFFER.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_ERRORBUFFER.3
deleted file mode 100644
index 5953d5e651..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_ERRORBUFFER.3
+++ /dev/null
@@ -1,96 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_ERRORBUFFER 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_ERRORBUFFER \- error buffer for error messages
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ERRORBUFFER, char *buf);
-.fi
-.SH DESCRIPTION
-Pass a char * to a buffer that libcurl may use to store human readable error
-messages on failures or problems. This may be more helpful than just the
-return code from \fIcurl_easy_perform(3)\fP and related functions. The buffer
-must be at least \fBCURL_ERROR_SIZE\fP bytes big.
-
-You must keep the associated buffer available until libcurl no longer needs
-it. Failing to do so might cause odd behavior or even crashes. libcurl might
-need it until you call \fIcurl_easy_cleanup(3)\fP or you set the same option
-again to use a different pointer.
-
-Do not rely on the contents of the buffer unless an error code was returned.
-Since 7.60.0 libcurl initializes the contents of the error buffer to an empty
-string before performing the transfer. For earlier versions if an error code
-was returned but there was no error detail then the buffer was untouched.
-
-Consider \fICURLOPT_VERBOSE(3)\fP and \fICURLOPT_DEBUGFUNCTION(3)\fP to better
-debug and trace why errors happen.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  CURLcode res;
-  char errbuf[CURL_ERROR_SIZE];
-
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* provide a buffer to store errors in */
-  curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, errbuf);
-
-  /* set the error buffer as empty before performing a request */
-  errbuf[0] = 0;
-
-  /* perform the request */
-  res = curl_easy_perform(curl);
-
-  /* if the request did not complete correctly, show the error
-  information. if no detailed error information was written to errbuf
-  show the more generic information from curl_easy_strerror instead.
-  */
-  if(res != CURLE_OK) {
-    size_t len = strlen(errbuf);
-    fprintf(stderr, "\\nlibcurl: (%d) ", res);
-    if(len)
-      fprintf(stderr, "%s%s", errbuf,
-              ((errbuf[len - 1] != '\\n') ? "\\n" : ""));
-    else
-      fprintf(stderr, "%s\\n", curl_easy_strerror(res));
-  }
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_DEBUGFUNCTION "(3), " CURLOPT_VERBOSE "(3), "
-.BR curl_easy_strerror "(3), " curl_multi_strerror "(3), "
-.BR curl_share_strerror "(3), " curl_url_strerror "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_ERRORBUFFER.md b/third-party/curl/docs/libcurl/opts/CURLOPT_ERRORBUFFER.md
new file mode 100644
index 0000000000..6ba194aabb
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_ERRORBUFFER.md
@@ -0,0 +1,113 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_ERRORBUFFER
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DEBUGFUNCTION (3)
+  - CURLOPT_VERBOSE (3)
+  - curl_easy_strerror (3)
+  - curl_multi_strerror (3)
+  - curl_share_strerror (3)
+  - curl_url_strerror (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_ERRORBUFFER - error buffer for error messages
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ERRORBUFFER, char *buf);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer to a buffer that libcurl may use to store human readable
+error messages on failures or problems. This may be more helpful than the
+single return code from curl_easy_perform(3) and related functions. The buffer
+must be at least **CURL_ERROR_SIZE** bytes big.
+
+You must keep the associated buffer available until libcurl no longer needs
+it. Failing to do so might cause odd behavior or even crashes. libcurl might
+need it until you call curl_easy_cleanup(3) or you set the same option again
+to use a different pointer.
+
+libcurl initializes the contents of the error buffer to an empty string before
+performing a transfer.
+
+Do not attempt to set the contents of the buffer yourself, including in any
+callbacks you write that may be called by libcurl. The library may overwrite
+the buffer after your callback returns.
+
+Consider CURLOPT_VERBOSE(3) and CURLOPT_DEBUGFUNCTION(3) to better debug and
+trace why errors happen.
+
+Using this option multiple times makes the last set pointer override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <string.h> /* for strlen() */
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    char errbuf[CURL_ERROR_SIZE];
+
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* provide a buffer to store errors in */
+    curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, errbuf);
+
+    /* set the error buffer as empty before performing a request */
+    errbuf[0] = 0;
+
+    /* perform the request */
+    result = curl_easy_perform(curl);
+
+    /* if the request did not complete correctly, show the error
+    information. if no detailed error information was written to errbuf
+    show the more generic information from curl_easy_strerror instead.
+    */
+    if(result != CURLE_OK) {
+      size_t len = strlen(errbuf);
+      fprintf(stderr, "\nlibcurl: (%d) ", result);
+      if(len)
+        fprintf(stderr, "%s%s", errbuf,
+                ((errbuf[len - 1] != '\n') ? "\n" : ""));
+      else
+        fprintf(stderr, "%s\n", curl_easy_strerror(result));
+    }
+  }
+}
+~~~
+
+# HISTORY
+
+Before curl 7.60.0, if an error code was returned but there was no error
+detail the buffer was untouched: not initialized.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_EXPECT_100_TIMEOUT_MS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_EXPECT_100_TIMEOUT_MS.3
deleted file mode 100644
index 78135c0a10..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_EXPECT_100_TIMEOUT_MS.3
+++ /dev/null
@@ -1,61 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_EXPECT_100_TIMEOUT_MS 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_EXPECT_100_TIMEOUT_MS \- timeout for Expect: 100-continue response
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_EXPECT_100_TIMEOUT_MS,
-                          long milliseconds);
-.SH DESCRIPTION
-Pass a long to tell libcurl the number of \fImilliseconds\fP to wait for a
-server response with the HTTP status 100 (Continue), 417 (Expectation Failed)
-or similar after sending an HTTP request containing an Expect: 100-continue
-header. If this times out before a response is received, the request body is
-sent anyway.
-.SH DEFAULT
-1000 milliseconds
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* wait 3 seconds for 100-continue */
-  curl_easy_setopt(curl, CURLOPT_EXPECT_100_TIMEOUT_MS, 3000L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.36.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_POST "(3), " CURLOPT_HTTPPOST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_EXPECT_100_TIMEOUT_MS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_EXPECT_100_TIMEOUT_MS.md
new file mode 100644
index 0000000000..9dd330b055
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_EXPECT_100_TIMEOUT_MS.md
@@ -0,0 +1,68 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_EXPECT_100_TIMEOUT_MS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HTTPPOST (3)
+  - CURLOPT_POST (3)
+Protocol:
+  - HTTP
+Added-in: 7.36.0
+---
+
+# NAME
+
+CURLOPT_EXPECT_100_TIMEOUT_MS - timeout for Expect: 100-continue response
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_EXPECT_100_TIMEOUT_MS,
+                          long milliseconds);
+~~~
+
+# DESCRIPTION
+
+Pass a long to tell libcurl the number of *milliseconds* to wait for a
+server response with the HTTP status 100 (Continue), 417 (Expectation Failed)
+or similar after sending an HTTP request containing an Expect: 100-continue
+header. If this times out before a response is received, the request body is
+sent anyway.
+
+# DEFAULT
+
+1000 milliseconds
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* wait 3 seconds for 100-continue */
+    curl_easy_setopt(curl, CURLOPT_EXPECT_100_TIMEOUT_MS, 3000L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FAILONERROR.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_FAILONERROR.3
deleted file mode 100644
index e4d16d79ac..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_FAILONERROR.3
+++ /dev/null
@@ -1,71 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_FAILONERROR 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_FAILONERROR \- request failure on HTTP response >= 400
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FAILONERROR, long fail);
-.fi
-.SH DESCRIPTION
-A long parameter set to 1 tells the library to fail the request if the HTTP
-code returned is equal to or larger than 400. The default action would be to
-return the page normally, ignoring that code.
-
-This method is not fail-safe and there are occasions where non-successful
-response codes slip through, especially when authentication is involved
-(response codes 401 and 407).
-
-You might get some amounts of headers transferred before this situation is
-detected, like when a "100-continue" is received as a response to a POST/PUT
-and a 401 or 407 is received immediately afterwards.
-
-When this option is used and an error is detected, it causes the connection to
-get closed and \fICURLE_HTTP_RETURNED_ERROR\fP is returned.
-.SH DEFAULT
-0, do not fail on error
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_FAILONERROR, 1L);
-  ret = curl_easy_perform(curl);
-  if(ret == CURLE_HTTP_RETURNED_ERROR) {
-    /* an HTTP response error problem */
-  }
-}
-.fi
-.SH AVAILABILITY
-Along with HTTP.
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is enabled, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_HTTP200ALIASES "(3), " CURLOPT_KEEP_SENDING_ON_ERROR "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FAILONERROR.md b/third-party/curl/docs/libcurl/opts/CURLOPT_FAILONERROR.md
new file mode 100644
index 0000000000..29578978fc
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_FAILONERROR.md
@@ -0,0 +1,76 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_FAILONERROR
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_RESPONSE_CODE (3)
+  - CURLOPT_HTTP200ALIASES (3)
+  - CURLOPT_KEEP_SENDING_ON_ERROR (3)
+Protocol:
+  - HTTP
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_FAILONERROR - request failure on HTTP response \>= 400
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FAILONERROR, long fail);
+~~~
+
+# DESCRIPTION
+
+A long parameter set to 1 tells the library to fail the request if the HTTP
+code returned is equal to or larger than 400. The default action would be to
+return the page normally, ignoring that code.
+
+This method is not fail-safe and there are occasions where non-successful
+response codes slip through, especially when authentication is involved
+(response codes 401 and 407).
+
+You might get some amounts of headers transferred before this situation is
+detected, like when a "100-continue" is received as a response to a POST/PUT
+and a 401 or 407 is received immediately afterwards.
+
+When this option is used and an error is detected, it causes the connection to
+get closed and *CURLE_HTTP_RETURNED_ERROR* is returned.
+
+# DEFAULT
+
+0, do not fail on error
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_FAILONERROR, 1L);
+    result = curl_easy_perform(curl);
+    if(result == CURLE_HTTP_RETURNED_ERROR) {
+      /* an HTTP response error problem */
+    }
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FILETIME.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_FILETIME.3
deleted file mode 100644
index 9f9a0f44b1..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_FILETIME.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_FILETIME 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_FILETIME \- get the modification time of the remote resource
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FILETIME, long gettime);
-.fi
-.SH DESCRIPTION
-Pass a long. If it is 1, libcurl attempts to get the modification time of the
-remote document in this operation. This requires that the remote server sends
-the time or replies to a time querying command. The \fIcurl_easy_getinfo(3)\fP
-function with the \fICURLINFO_FILETIME(3)\fP argument can be used after a
-transfer to extract the received time (if any).
-.SH DEFAULT
-0
-.SH PROTOCOLS
-HTTP(S), FTP(S), SFTP, FILE, SMB(S)
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  /* Ask for filetime */
-  curl_easy_setopt(curl, CURLOPT_FILETIME, 1L);
-  res = curl_easy_perform(curl);
-  if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_FILETIME, &filetime);
-    if((CURLE_OK == res) && (filetime >= 0)) {
-      time_t file_time = (time_t)filetime;
-      printf("filetime %s: %s", filename, ctime(&file_time));
-    }
-  }
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Always, for SFTP since 7.49.0
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FILETIME.md b/third-party/curl/docs/libcurl/opts/CURLOPT_FILETIME.md
new file mode 100644
index 0000000000..ccf93af2e0
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_FILETIME.md
@@ -0,0 +1,78 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_FILETIME
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_FILETIME (3)
+  - curl_easy_getinfo (3)
+Protocol:
+  - HTTP
+  - FTP
+  - SFTP
+  - FILE
+  - SMB
+Added-in: 7.5
+---
+
+# NAME
+
+CURLOPT_FILETIME - get the modification time of the remote resource
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FILETIME, long gettime);
+~~~
+
+# DESCRIPTION
+
+Pass a long. If it is 1, libcurl attempts to get the modification time of the
+remote document in this operation. This requires that the remote server sends
+the time or replies to a time querying command. The curl_easy_getinfo(3)
+function with the CURLINFO_FILETIME(3) argument can be used after a
+transfer to extract the received time (if any).
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/path.html");
+    /* Ask for filetime */
+    curl_easy_setopt(curl, CURLOPT_FILETIME, 1L);
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      long filetime;
+      result = curl_easy_getinfo(curl, CURLINFO_FILETIME, &filetime);
+      if((result == CURLE_OK) && (filetime >= 0)) {
+        time_t file_time = (time_t)filetime;
+        printf("filetime: %s", ctime(&file_time));
+      }
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FNMATCH_DATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_FNMATCH_DATA.3
deleted file mode 100644
index a25332b39e..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_FNMATCH_DATA.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_FNMATCH_DATA 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_FNMATCH_DATA \- pointer passed to the fnmatch callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FNMATCH_DATA,
-                          void *pointer);
-.SH DESCRIPTION
-Pass a pointer that is untouched by libcurl and passed as the ptr argument to
-the \fICURLOPT_FNMATCH_FUNCTION(3)\fP.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-FTP
-.SH EXAMPLE
-.nf
-static int my_fnmatch(void *clientp,
-                      const char *pattern, const char *string)
-{
-  struct local_stuff *data = (struct local_stuff *)clientp;
-  if(string_match(pattern, string))
-    return CURL_FNMATCHFUNC_MATCH;
-  else
-    return CURL_FNMATCHFUNC_NOMATCH;
-}
-
-{
-  struct local_stuff local_data;
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://ftp.example.com/file*");
-  curl_easy_setopt(curl, CURLOPT_WILDCARDMATCH, 1L);
-  curl_easy_setopt(curl, CURLOPT_FNMATCH_FUNCTION, my_fnmatch);
-  curl_easy_setopt(curl, CURLOPT_FNMATCH_DATA, &local_data);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.21.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_FNMATCH_FUNCTION "(3), " CURLOPT_WILDCARDMATCH "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FNMATCH_DATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_FNMATCH_DATA.md
new file mode 100644
index 0000000000..fd2660db69
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_FNMATCH_DATA.md
@@ -0,0 +1,84 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_FNMATCH_DATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_FNMATCH_FUNCTION (3)
+  - CURLOPT_WILDCARDMATCH (3)
+Protocol:
+  - FTP
+Added-in: 7.21.0
+---
+
+# NAME
+
+CURLOPT_FNMATCH_DATA - pointer passed to the fnmatch callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FNMATCH_DATA,
+                          void *pointer);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer that is untouched by libcurl and passed as the ptr argument to
+the CURLOPT_FNMATCH_FUNCTION(3).
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+extern int string_match(const char *s1, const char *s2);
+
+struct local_stuff {
+  void *custom;
+};
+
+static int my_fnmatch(void *clientp,
+                      const char *pattern, const char *string)
+{
+  struct local_stuff *my = clientp;
+  printf("my ptr: %p\n", my->custom);
+
+  if(string_match(pattern, string))
+    return CURL_FNMATCHFUNC_MATCH;
+  else
+    return CURL_FNMATCHFUNC_NOMATCH;
+}
+
+int main(void)
+{
+  struct local_stuff local_data;
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://ftp.example.com/file*");
+    curl_easy_setopt(curl, CURLOPT_WILDCARDMATCH, 1L);
+    curl_easy_setopt(curl, CURLOPT_FNMATCH_FUNCTION, my_fnmatch);
+    curl_easy_setopt(curl, CURLOPT_FNMATCH_DATA, &local_data);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FNMATCH_FUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_FNMATCH_FUNCTION.3
deleted file mode 100644
index 22ab4d850d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_FNMATCH_FUNCTION.3
+++ /dev/null
@@ -1,76 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_FNMATCH_FUNCTION 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_FNMATCH_FUNCTION \- wildcard match callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-int fnmatch_callback(void *ptr,
-                     const char *pattern,
-                     const char *string);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FNMATCH_FUNCTION,
-                          fnmatch_callback);
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-This callback is used for wildcard matching.
-
-Return \fICURL_FNMATCHFUNC_MATCH\fP if pattern matches the string,
-\fICURL_FNMATCHFUNC_NOMATCH\fP if not or \fICURL_FNMATCHFUNC_FAIL\fP if an
-error occurred.
-.SH DEFAULT
-NULL == an internal function for wildcard matching.
-.SH PROTOCOLS
-FTP
-.SH EXAMPLE
-.nf
-static int my_fnmatch(void *clientp,
-                      const char *pattern, const char *string)
-{
-  struct local_stuff *data = (struct local_stuff *)clientp;
-  if(string_match(pattern, string))
-    return CURL_FNMATCHFUNC_MATCH;
-  else
-    return CURL_FNMATCHFUNC_NOMATCH;
-}
-
-{
-  struct local_stuff local_data;
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://ftp.example.com/file*");
-  curl_easy_setopt(curl, CURLOPT_WILDCARDMATCH, 1L);
-  curl_easy_setopt(curl, CURLOPT_FNMATCH_FUNCTION, my_fnmatch);
-  curl_easy_setopt(curl, CURLOPT_FNMATCH_DATA, &local_data);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.21.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_FNMATCH_DATA "(3), " CURLOPT_DEBUGFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FNMATCH_FUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_FNMATCH_FUNCTION.md
new file mode 100644
index 0000000000..e0b220ccf1
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_FNMATCH_FUNCTION.md
@@ -0,0 +1,92 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_FNMATCH_FUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DEBUGFUNCTION (3)
+  - CURLOPT_FNMATCH_DATA (3)
+  - CURLOPT_WILDCARDMATCH (3)
+Protocol:
+  - FTP
+Added-in: 7.21.0
+---
+
+# NAME
+
+CURLOPT_FNMATCH_FUNCTION - wildcard match callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+int fnmatch_callback(void *ptr,
+                     const char *pattern,
+                     const char *string);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FNMATCH_FUNCTION,
+                          fnmatch_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+This callback is used for wildcard matching.
+
+Return *CURL_FNMATCHFUNC_MATCH* if pattern matches the string,
+*CURL_FNMATCHFUNC_NOMATCH* if not or *CURL_FNMATCHFUNC_FAIL* if an
+error occurred.
+
+# DEFAULT
+
+NULL == an internal function for wildcard matching.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+extern int string_match(const char *s1, const char *s2);
+
+struct local_stuff {
+  void *custom;
+};
+static int my_fnmatch(void *clientp,
+                      const char *pattern, const char *string)
+{
+  struct local_stuff *data = clientp;
+  printf("my pointer: %p\n", data->custom);
+  if(string_match(pattern, string))
+    return CURL_FNMATCHFUNC_MATCH;
+  else
+    return CURL_FNMATCHFUNC_NOMATCH;
+}
+
+int main(void)
+{
+  struct local_stuff local_data;
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://ftp.example.com/file*");
+    curl_easy_setopt(curl, CURLOPT_WILDCARDMATCH, 1L);
+    curl_easy_setopt(curl, CURLOPT_FNMATCH_FUNCTION, my_fnmatch);
+    curl_easy_setopt(curl, CURLOPT_FNMATCH_DATA, &local_data);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FOLLOWLOCATION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_FOLLOWLOCATION.3
deleted file mode 100644
index f7374b9df6..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_FOLLOWLOCATION.3
+++ /dev/null
@@ -1,88 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_FOLLOWLOCATION 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_FOLLOWLOCATION \- follow HTTP 3xx redirects
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FOLLOWLOCATION, long enable);
-.fi
-.SH DESCRIPTION
-A long parameter set to 1 tells the library to follow any Location: header
-redirects that a HTTP server sends in a 30x response. The Location: header can
-specify a relative or an absolute URL to follow.
-
-libcurl issues another request for the new URL and follows subsequent new
-Location: redirects all the way until no more such headers are returned or the
-maximum limit is reached. \fICURLOPT_MAXREDIRS(3)\fP is used to limit the
-number of redirects libcurl follows.
-
-libcurl restricts what protocols it automatically follow redirects to. The
-accepted target protocols are set with \fICURLOPT_REDIR_PROTOCOLS(3)\fP. By
-default libcurl allows HTTP, HTTPS, FTP and FTPS on redirects.
-
-When following a redirect, the specific 30x response code also dictates which
-request method libcurl uses in the subsequent request: For 301, 302 and 303
-responses libcurl switches method from POST to GET unless
-\fICURLOPT_POSTREDIR(3)\fP instructs libcurl otherwise. All other redirect
-response codes make libcurl use the same method again.
-
-For users who think the existing location following is too naive, too simple
-or just lacks features, it is easy to instead implement your own redirect
-follow logic with the use of \fIcurl_easy_getinfo(3)\fP's
-\fICURLINFO_REDIRECT_URL(3)\fP option instead of using
-\fICURLOPT_FOLLOWLOCATION(3)\fP.
-.SH NOTE
-Since libcurl changes method or not based on the specific HTTP response code,
-setting \fICURLOPT_CUSTOMREQUEST(3)\fP while following redirects may change
-what libcurl would otherwise do and if not that carefully may even make it
-misbehave since \fICURLOPT_CUSTOMREQUEST(3)\fP overrides the method libcurl
-would otherwise select internally.
-.SH DEFAULT
-0, disabled
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* example.com is redirected, so we tell libcurl to follow redirection */
-  curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Along with HTTP
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_REDIR_PROTOCOLS "(3), " CURLOPT_PROTOCOLS "(3), "
-.BR CURLOPT_POSTREDIR "(3), "
-.BR CURLINFO_REDIRECT_URL "(3), " CURLINFO_REDIRECT_COUNT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FOLLOWLOCATION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_FOLLOWLOCATION.md
new file mode 100644
index 0000000000..cc704576c4
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_FOLLOWLOCATION.md
@@ -0,0 +1,160 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_FOLLOWLOCATION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_REDIRECT_COUNT (3)
+  - CURLINFO_REDIRECT_URL (3)
+  - CURLOPT_POSTREDIR (3)
+  - CURLOPT_PROTOCOLS_STR (3)
+  - CURLOPT_REDIR_PROTOCOLS_STR (3)
+  - CURLOPT_UNRESTRICTED_AUTH (3)
+Protocol:
+  - HTTP
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_FOLLOWLOCATION - follow HTTP 3xx redirects
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FOLLOWLOCATION, long mode);
+~~~
+
+# DESCRIPTION
+
+This option tells the library to follow `Location:` header redirects that an
+HTTP server sends in a 30x response. The `Location:` header can specify a
+relative or an absolute URL to follow. The long parameter *mode* instructs how
+libcurl should act on subsequent requests.
+
+*mode* only had a single value (1L) for a long time that enables redirect
+following. Since 8.13.0, two additional modes are also supported. See below.
+
+When following redirects, libcurl issues another request for the new URL and
+follows subsequent new `Location:` redirects all the way until no more such
+headers are returned or the maximum limit is reached. CURLOPT_MAXREDIRS(3) is
+used to limit the number of redirects libcurl follows.
+
+libcurl restricts what protocols it automatically follow redirects to. The
+accepted target protocols are set with CURLOPT_REDIR_PROTOCOLS_STR(3). By
+default libcurl allows HTTP, HTTPS, FTP and FTPS on redirects.
+
+When following a redirect, the specific 30x response code also dictates which
+request method libcurl uses in the subsequent request: For 301, 302 and 303
+responses libcurl switches method from POST to GET unless CURLOPT_POSTREDIR(3)
+instructs libcurl otherwise. All other redirect response codes make libcurl
+use the same method again.
+
+When libcurl switches method to GET, it then uses that method without sending
+any request body. If it does not change the method, it sends the subsequent
+request the same way as the previous one; including the request body if one
+was provided.
+
+For users who think the existing location following is too naive, too simple
+or lacking features, it is easy to instead implement your own redirect follow
+logic with the use of curl_easy_getinfo(3)'s CURLINFO_REDIRECT_URL(3) option
+instead of using CURLOPT_FOLLOWLOCATION(3).
+
+By default, libcurl only sends `Authorization:` or explicitly set `Cookie:`
+headers to the initial host given in the original URL, to avoid leaking
+username + password to other sites. CURLOPT_UNRESTRICTED_AUTH(3) is provided
+to change that behavior.
+
+Due to the way HTTP works, almost any header can be made to contain data a
+client may not want to pass on to other servers than the initially intended
+host and for all other headers than the two mentioned above, there is no
+protection from this happening when libcurl is told to follow redirects.
+
+Pick one of the following modes:
+
+## CURLFOLLOW_ALL (1)
+
+Before 8.13.0 this bit had no name and 1L was the value to enable this option.
+This makes a set custom method be used in all HTTP requests, even after
+redirects.
+
+## CURLFOLLOW_OBEYCODE (2)
+
+When there is a custom request method set with CURLOPT_CUSTOMREQUEST(3), that
+set method replaces what libcurl would otherwise use. If a 301/302/303
+response code is returned to signal a redirect, the method is changed from
+POST to `GET`. For 307/308, the custom method remains set and used.
+
+Note that only POST (or a custom post) is changed to GET on 301/302, its not
+change PUT etc - and therefore also not when libcurl issues a custom PUT. A
+303 response makes it switch to GET independently of the original method
+(except for HEAD).
+
+To control for which of the 301/302/303 status codes libcurl should *not*
+switch back to GET for when doing a custom POST (a POST transfer using a
+modified method), and instead keep the custom method, use
+CURLOPT_POSTREDIR(3).
+
+If you prefer a custom POST method to be reset to exactly the method `POST`,
+use CURLFOLLOW_FIRSTONLY instead.
+
+## CURLFOLLOW_FIRSTONLY (3)
+
+When there is a custom request method set with CURLOPT_CUSTOMREQUEST(3), that
+set method replaces what libcurl would otherwise use in the first outgoing
+request only. The second request is then done according to the redirect
+response code.
+
+If you prefer your custom method to remain in use after a 307/308 redirect,
+use CURLFOLLOW_OBEYCODE instead.
+
+##
+
+# NOTE
+
+Since libcurl changes method or not based on the specific HTTP response code,
+setting CURLOPT_CUSTOMREQUEST(3) while following redirects may change what
+libcurl would otherwise do and if not that carefully may even make it
+misbehave since CURLOPT_CUSTOMREQUEST(3) overrides the method libcurl would
+otherwise select internally.
+
+Setting the CURLFOLLOW_OBEYCODE bit makes libcurl *not* use the custom set
+method after redirects for 301, 302 and 303 responses. Unless the
+CURLOPT_POSTREDIR(3) bits are set for those status codes.
+
+# DEFAULT
+
+0, disabled
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* example.com is redirected, so we tell libcurl to follow redirection */
+    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FORBID_REUSE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_FORBID_REUSE.3
deleted file mode 100644
index 4231051467..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_FORBID_REUSE.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_FORBID_REUSE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_FORBID_REUSE \- make connection get closed at once after use
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FORBID_REUSE, long close);
-.fi
-.SH DESCRIPTION
-Pass a long. Set \fIclose\fP to 1 to make libcurl explicitly close the
-connection when done with the transfer. Normally, libcurl keeps all
-connections alive when done with one transfer in case a succeeding one follows
-that can reuse them. This option should be used with caution and only if you
-understand what it does as it can seriously impact performance.
-
-Set to 0 to have libcurl keep the connection open for possible later reuse
-(default behavior).
-.SH DEFAULT
-0
-.SH PROTOCOLS
-Most
-.SH EXAMPLE
-.nf
-{
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_FORBID_REUSE, 1L);
-  curl_easy_perform(curl);
-
-  /* this second transfer may not reuse the same connection */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_FRESH_CONNECT "(3), " CURLOPT_MAXCONNECTS "(3), "
-.BR CURLOPT_MAXLIFETIME_CONN "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FORBID_REUSE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_FORBID_REUSE.md
new file mode 100644
index 0000000000..f7638eacc5
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_FORBID_REUSE.md
@@ -0,0 +1,74 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_FORBID_REUSE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_FRESH_CONNECT (3)
+  - CURLOPT_MAXCONNECTS (3)
+  - CURLOPT_MAXLIFETIME_CONN (3)
+  - CURLMOPT_NETWORK_CHANGED (3)
+Protocol:
+  - All
+Added-in: 7.7
+---
+
+# NAME
+
+CURLOPT_FORBID_REUSE - make connection get closed at once after use
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FORBID_REUSE, long close);
+~~~
+
+# DESCRIPTION
+
+Pass a long. Set *close* to 1 to make libcurl explicitly close the
+connection when done with the transfer. Normally, libcurl keeps all
+connections alive when done with one transfer in case a succeeding one follows
+that can reuse them. This option should be used with caution and only if you
+understand what it does as it can seriously impact performance.
+
+Set to 0 to have libcurl keep the connection open for possible later reuse
+(default behavior).
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    CURLcode result2;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_FORBID_REUSE, 1L);
+    result = curl_easy_perform(curl);
+
+    /* this second transfer may not reuse the same connection */
+    result2 = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FRESH_CONNECT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_FRESH_CONNECT.3
deleted file mode 100644
index bc385c993c..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_FRESH_CONNECT.3
+++ /dev/null
@@ -1,63 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_FRESH_CONNECT 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_FRESH_CONNECT \- force a new connection to be used
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FRESH_CONNECT, long fresh);
-.fi
-.SH DESCRIPTION
-Pass a long. Set to 1 to make the next transfer use a new (fresh) connection
-by force instead of trying to reuse an existing one. This option should be
-used with caution and only if you understand what it does as it may impact
-performance negatively.
-
-Related functionality is \fICURLOPT_FORBID_REUSE(3)\fP which makes sure the
-connection is closed after use so that it cannot be reused.
-
-Set \fIfresh\fP to 0 to have libcurl attempt reusing an existing connection
-(default behavior).
-.SH DEFAULT
-0
-.SH PROTOCOLS
-Most
-.SH EXAMPLE
-.nf
-{
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_FRESH_CONNECT, 1L);
-  /* this transfer must use a new connection, not reuse an existing */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_FORBID_REUSE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FRESH_CONNECT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_FRESH_CONNECT.md
new file mode 100644
index 0000000000..84257ff3c8
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_FRESH_CONNECT.md
@@ -0,0 +1,72 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_FRESH_CONNECT
+Section: 3
+Source: libcurl
+Protocol:
+  - All
+See-also:
+  - CURLOPT_FORBID_REUSE (3)
+  - CURLOPT_MAXAGE_CONN (3)
+  - CURLOPT_MAXLIFETIME_CONN (3)
+  - CURLMOPT_NETWORK_CHANGED (3)
+Added-in: 7.7
+---
+
+# NAME
+
+CURLOPT_FRESH_CONNECT - force a new connection to be used
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FRESH_CONNECT, long fresh);
+~~~
+
+# DESCRIPTION
+
+Pass a long. Set to 1 to make the next transfer use a new (fresh) connection
+by force instead of trying to reuse an existing one. This option should be
+used with caution and only if you understand what it does as it may impact
+performance negatively.
+
+Related functionality is CURLOPT_FORBID_REUSE(3) which makes sure the
+connection is closed after use so that it cannot be reused.
+
+Set *fresh* to 0 to have libcurl attempt reusing an existing connection
+(default behavior).
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_FRESH_CONNECT, 1L);
+    /* this transfer must use a new connection, not reuse an existing */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTPPORT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_FTPPORT.3
deleted file mode 100644
index 7775eb486d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_FTPPORT.3
+++ /dev/null
@@ -1,95 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_FTPPORT 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_FTPPORT \- make FTP transfer active
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTPPORT, char *spec);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter. It specifies that the
-FTP transfer should be made actively and the given string is used to get the
-IP address to use for the FTP PORT instruction.
-
-The PORT instruction tells the remote server to do a TCP connect to our
-specified IP address. The string may be a plain IP address, a host name, a
-network interface name (under Unix) or just a '-' symbol to let the library
-use your system's default IP address. Default FTP operations are passive, and
-does not use the PORT command.
-
-The address can be followed by a ':' to specify a port, optionally followed by
-a '-' to specify a port range. If the port specified is 0, the operating
-system picks a free port. If a range is provided and all ports in the range
-are not available, libcurl reports CURLE_FTP_PORT_FAILED for the
-handle. Invalid port/range settings are ignored. IPv6 addresses followed by a
-port or port range have to be in brackets. IPv6 addresses without port/range
-specifier can be in brackets.
-
-Examples with specified ports:
-
-.nf
-  eth0:0
-  192.168.1.2:32000-33000
-  curl.se:32123
-  [::1]:1234-4567
-.fi
-
-We strongly advise against specifying the address with a name, as it causes
-libcurl to do a blocking name resolve call to retrieve the IP address. That
-name resolve operation does \fBnot\fP use DNS-over-HTTPS even if
-\fICURLOPT_DOH_URL(3)\fP is set.
-
-Using anything else than "-" for this option should typically only be done if
-you have special knowledge and confirmation that it works.
-
-You disable PORT again and go back to using the passive version by setting
-this option to NULL.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-FTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/old-server/file.txt");
-  curl_easy_setopt(curl, CURLOPT_FTPPORT, "-");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Port range support was added in 7.19.5
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_FTP_USE_EPRT "(3), " CURLOPT_FTP_USE_EPSV "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTPPORT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_FTPPORT.md
new file mode 100644
index 0000000000..fe60393633
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_FTPPORT.md
@@ -0,0 +1,100 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_FTPPORT
+Section: 3
+Source: libcurl
+Protocol:
+  - FTP
+See-also:
+  - CURLOPT_FTP_USE_EPRT (3)
+  - CURLOPT_FTP_USE_EPSV (3)
+  - CURLOPT_ACCEPTTIMEOUT_MS (3)
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_FTPPORT - make FTP transfer active
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTPPORT, char *spec);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter. It specifies that the
+FTP transfer should be made actively and the given string is used to get the
+IP address to use for the FTP PORT instruction.
+
+The PORT instruction tells the remote server to do a TCP connect to our
+specified IP address. The string may be a plain IP address, a hostname, a
+network interface name (under Unix) or a '-' symbol to let the library use
+your system's default IP address. Default FTP operations are passive, and does
+not use the PORT command.
+
+The address can be followed by a ':' to specify a port, optionally followed by
+a '-' to specify a port range. If the port specified is 0, the operating
+system picks a free port. If a range is provided and all ports in the range
+are not available, libcurl reports CURLE_FTP_PORT_FAILED for the
+handle. Invalid port/range settings are ignored. IPv6 addresses followed by a
+port or port range have to be in brackets. IPv6 addresses without port/range
+specifier can be in brackets.
+
+Examples with specified ports:
+
+    eth0:0
+    192.168.1.2:32000-33000
+    curl.se:32123
+    [::1]:1234-4567
+
+We strongly advise against specifying the address with a name, as it causes
+libcurl to do a blocking name resolve call to retrieve the IP address. That
+name resolve operation does **not** use DNS-over-HTTPS even if
+CURLOPT_DOH_URL(3) is set.
+
+Using anything else than "-" for this option should typically only be done if
+you have special knowledge and confirmation that it works.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. You disable PORT again and go back to using the passive version
+by setting this option to NULL.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL,
+                     "ftp://example.com/old-server/file.txt");
+    curl_easy_setopt(curl, CURLOPT_FTPPORT, "-");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTPSSLAUTH.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_FTPSSLAUTH.3
deleted file mode 100644
index 6a3ef059d3..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_FTPSSLAUTH.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_FTPSSLAUTH 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_FTPSSLAUTH \- order in which to attempt TLS vs SSL
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTPSSLAUTH, long order);
-.fi
-.SH DESCRIPTION
-Pass a long using one of the values from below, to alter how libcurl issues
-\&"AUTH TLS" or "AUTH SSL" when FTP over SSL is activated. This is only
-interesting if \fICURLOPT_USE_SSL(3)\fP is also set.
-
-Possible \fIorder\fP values:
-.IP CURLFTPAUTH_DEFAULT
-Allow libcurl to decide.
-.IP CURLFTPAUTH_SSL
-Try "AUTH SSL" first, and only if that fails try "AUTH TLS".
-.IP CURLFTPAUTH_TLS
-Try "AUTH TLS" first, and only if that fails try "AUTH SSL".
-.SH DEFAULT
-CURLFTPAUTH_DEFAULT
-.SH PROTOCOLS
-FTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/file.txt");
-  curl_easy_setopt(curl, CURLOPT_USE_SSL, CURLUSESSL_TRY);
-  /* funny server, ask for SSL before TLS */
-  curl_easy_setopt(curl, CURLOPT_FTPSSLAUTH, (long)CURLFTPAUTH_SSL);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.12.2
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_USE_SSL "(3), " CURLOPT_FTP_SSL_CCC "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTPSSLAUTH.md b/third-party/curl/docs/libcurl/opts/CURLOPT_FTPSSLAUTH.md
new file mode 100644
index 0000000000..6360fb3908
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_FTPSSLAUTH.md
@@ -0,0 +1,83 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_FTPSSLAUTH
+Section: 3
+Source: libcurl
+Protocol:
+  - FTP
+See-also:
+  - CURLOPT_FTP_SSL_CCC (3)
+  - CURLOPT_USE_SSL (3)
+Added-in: 7.12.2
+---
+
+# NAME
+
+CURLOPT_FTPSSLAUTH - order in which to attempt TLS vs SSL
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTPSSLAUTH, long order);
+~~~
+
+# DESCRIPTION
+
+Pass a long using one of the values from below, to alter how libcurl issues
+"AUTH TLS" or "AUTH SSL" when FTP over SSL is activated. This is only
+interesting if CURLOPT_USE_SSL(3) is also set.
+
+Possible *order* values:
+
+## CURLFTPAUTH_DEFAULT
+
+Allow libcurl to decide.
+
+## CURLFTPAUTH_SSL
+
+Try "AUTH SSL" first, and only if that fails try "AUTH TLS".
+
+## CURLFTPAUTH_TLS
+
+Try "AUTH TLS" first, and only if that fails try "AUTH SSL".
+
+# DEFAULT
+
+CURLFTPAUTH_DEFAULT
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/file.txt");
+    curl_easy_setopt(curl, CURLOPT_USE_SSL, CURLUSESSL_TRY);
+    /* funny server, ask for SSL before TLS */
+    curl_easy_setopt(curl, CURLOPT_FTPSSLAUTH, CURLFTPAUTH_SSL);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURLFTPAUTH_*** enums became `long` types in 8.16.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_ACCOUNT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_ACCOUNT.3
deleted file mode 100644
index 7acce088f6..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_ACCOUNT.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_FTP_ACCOUNT 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_FTP_ACCOUNT \- account info for FTP
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTP_ACCOUNT, char *account);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string (or NULL to disable). When an FTP
-server asks for "account data" after user name and password has been provided,
-this data is sent off using the ACCT command.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-FTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/foo.bin");
-
-  curl_easy_setopt(curl, CURLOPT_FTP_ACCOUNT, "human-resources");
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.13.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_USERNAME "(3), " CURLOPT_PASSWORD "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_ACCOUNT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_ACCOUNT.md
new file mode 100644
index 0000000000..97b843696c
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_ACCOUNT.md
@@ -0,0 +1,71 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_FTP_ACCOUNT
+Section: 3
+Source: libcurl
+Protocol:
+  - FTP
+See-also:
+  - CURLOPT_PASSWORD (3)
+  - CURLOPT_USERNAME (3)
+Added-in: 7.13.0
+---
+
+# NAME
+
+CURLOPT_FTP_ACCOUNT - account info for FTP
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTP_ACCOUNT, char *account);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string (or NULL to disable). When an FTP
+server asks for "account data" after username and password has been provided,
+this data is sent off using the ACCT command.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/foo.bin");
+
+    curl_easy_setopt(curl, CURLOPT_FTP_ACCOUNT, "human-resources");
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_ALTERNATIVE_TO_USER.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_ALTERNATIVE_TO_USER.3
deleted file mode 100644
index 317b556a57..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_ALTERNATIVE_TO_USER.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_FTP_ALTERNATIVE_TO_USER 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_FTP_ALTERNATIVE_TO_USER \- command to use instead of USER with FTP
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTP_ALTERNATIVE_TO_USER,
-                          char *cmd);
-.SH DESCRIPTION
-Pass a char * as parameter, pointing to a string which is used to authenticate
-if the usual FTP "USER user" and "PASS password" negotiation fails. This is
-currently only known to be required when connecting to Tumbleweed's Secure
-Transport FTPS server using client certificates for authentication.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-FTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/foo.bin");
-
-  curl_easy_setopt(curl, CURLOPT_FTP_ALTERNATIVE_TO_USER, "two users");
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.15.5
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_FTP_SKIP_PASV_IP "(3), " CURLOPT_SERVER_RESPONSE_TIMEOUT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_ALTERNATIVE_TO_USER.md b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_ALTERNATIVE_TO_USER.md
new file mode 100644
index 0000000000..d8ca86427c
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_ALTERNATIVE_TO_USER.md
@@ -0,0 +1,71 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_FTP_ALTERNATIVE_TO_USER
+Section: 3
+Source: libcurl
+Protocol:
+  - FTP
+See-also:
+  - CURLOPT_FTP_ACCOUNT (3)
+  - CURLOPT_FTP_SKIP_PASV_IP (3)
+  - CURLOPT_SERVER_RESPONSE_TIMEOUT (3)
+  - CURLOPT_USERNAME (3)
+Added-in: 7.15.5
+---
+
+# NAME
+
+CURLOPT_FTP_ALTERNATIVE_TO_USER - command to use instead of USER with FTP
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTP_ALTERNATIVE_TO_USER,
+                          char *cmd);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter, pointing to a string which is used to
+authenticate if the usual FTP "USER user" and "PASS password" negotiation
+fails. This is currently only known to be required when connecting to
+Tumbleweed's Secure Transport FTPS server using client certificates for
+authentication.
+
+The application does not have to keep the string around after setting this
+option.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/foo.bin");
+    curl_easy_setopt(curl, CURLOPT_FTP_ALTERNATIVE_TO_USER, "two users");
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_CREATE_MISSING_DIRS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_CREATE_MISSING_DIRS.3
deleted file mode 100644
index 7299fc4d02..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_CREATE_MISSING_DIRS.3
+++ /dev/null
@@ -1,83 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_FTP_CREATE_MISSING_DIRS 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_FTP_CREATE_MISSING_DIRS \- create missing directories for FTP and SFTP
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-typedef enum {
-  CURLFTP_CREATE_DIR_NONE,
-  CURLFTP_CREATE_DIR,
-  CURLFTP_CREATE_DIR_RETRY
-} curl_ftpcreatedir;
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTP_CREATE_MISSING_DIRS,
-                          long create);
-.SH DESCRIPTION
-Pass a long telling libcurl to \fIcreate\fP the dir. If the value is
-\fICURLFTP_CREATE_DIR\fP (1), libcurl may create any remote directory that it
-fails to "move" into.
-
-For FTP requests, that means a CWD command fails. CWD being the command that
-changes working directory.
-
-For SFTP requests, libcurl may create the remote directory if it cannot obtain
-a handle to the target-location. The creation fails if a file of the same name
-as the directory to create already exists or lack of permissions prevents
-creation.
-
-Setting \fIcreate\fP to \fICURLFTP_CREATE_DIR_RETRY\fP (2), tells libcurl to
-retry the CWD command again if the subsequent \fBMKD\fP command fails. This is
-especially useful if you are doing many simultaneous connections against the
-same server and they all have this option enabled, as then CWD may first fail
-but then another connection does \fBMKD\fP before this connection and thus
-\fBMKD\fP fails but trying CWD works!
-.SH DEFAULT
-CURLFTP_CREATE_DIR_NONE (0)
-.SH PROTOCOLS
-FTP and SFTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/non-existing/new.txt");
-  curl_easy_setopt(curl, CURLOPT_FTP_CREATE_MISSING_DIRS,
-                   (long)CURLFTP_CREATE_DIR_RETRY);
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.10.7. SFTP support added in 7.16.3. The retry option was added in
-7.19.4.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if the
-create value is not.
-.SH "SEE ALSO"
-.BR CURLOPT_FTP_FILEMETHOD "(3), " CURLOPT_FTP_USE_EPSV "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_CREATE_MISSING_DIRS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_CREATE_MISSING_DIRS.md
new file mode 100644
index 0000000000..7b1a766d08
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_CREATE_MISSING_DIRS.md
@@ -0,0 +1,91 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_FTP_CREATE_MISSING_DIRS
+Section: 3
+Source: libcurl
+Protocol:
+  - FTP
+See-also:
+  - CURLOPT_FTP_FILEMETHOD (3)
+  - CURLOPT_FTP_USE_EPSV (3)
+Added-in: 7.10.7
+---
+
+# NAME
+
+CURLOPT_FTP_CREATE_MISSING_DIRS - create missing directories for FTP and SFTP
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+#define CURLFTP_CREATE_DIR_NONE  0L
+#define CURLFTP_CREATE_DIR       1L
+#define CURLFTP_CREATE_DIR_RETRY 2L
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTP_CREATE_MISSING_DIRS,
+                          long create);
+~~~
+
+# DESCRIPTION
+
+Pass a long telling libcurl to *create* the dir. If the value is
+*CURLFTP_CREATE_DIR* (1), libcurl may create any remote directory that it
+fails to "move" into.
+
+For FTP requests, that means a CWD command fails. CWD being the command that
+changes working directory.
+
+For SFTP requests, libcurl may create the remote directory if it cannot obtain
+a handle to the target-location. The creation fails if a file of the same name
+as the directory to create already exists or lack of permissions prevents
+creation.
+
+Setting *create* to *CURLFTP_CREATE_DIR_RETRY* (2), tells libcurl to
+retry the CWD command again if the subsequent **MKD** command fails. This is
+especially useful if you are doing many simultaneous connections against the
+same server and they all have this option enabled, as then CWD may first fail
+but then another connection does **MKD** before this connection and thus
+**MKD** fails but trying CWD works.
+
+# DEFAULT
+
+CURLFTP_CREATE_DIR_NONE (0)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL,
+                     "ftp://example.com/non-existing/new.txt");
+    curl_easy_setopt(curl, CURLOPT_FTP_CREATE_MISSING_DIRS,
+                     CURLFTP_CREATE_DIR_RETRY);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURLFTP_CREATE_*** enums became `long` types in 8.16.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_FILEMETHOD.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_FILEMETHOD.3
deleted file mode 100644
index d0bafc7c5e..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_FILEMETHOD.3
+++ /dev/null
@@ -1,76 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_FTP_FILEMETHOD 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_FTP_FILEMETHOD \- select directory traversing method for FTP
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTP_FILEMETHOD,
-                          long method);
-.SH DESCRIPTION
-Pass a long telling libcurl which \fImethod\fP to use to reach a file on a
-FTP(S) server.
-
-This option exists because some server implementations are not compliant to
-what the standards say should work.
-
-The argument should be one of the following alternatives:
-.IP CURLFTPMETHOD_MULTICWD
-libcurl does a single CWD operation for each path part in the given URL. For
-deep hierarchies this means many commands. This is how RFC 1738 says it should
-be done. This is the default but the slowest behavior.
-.IP CURLFTPMETHOD_NOCWD
-libcurl makes no CWD at all. libcurl does SIZE, RETR, STOR etc and gives a
-full path to the server for all these commands. This is the fastest behavior
-since it skips having to change directories.
-.IP CURLFTPMETHOD_SINGLECWD
-libcurl does one CWD with the full target directory and then operates on the
-file \&"normally" (like in the multicwd case). This is somewhat more standards
-compliant than 'nocwd' but without the full penalty of 'multicwd'.
-.SH DEFAULT
-CURLFTPMETHOD_MULTICWD
-.SH PROTOCOLS
-FTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/1/2/3/4/new.txt");
-  curl_easy_setopt(curl, CURLOPT_FTP_FILEMETHOD,
-                   (long)CURLFTPMETHOD_SINGLECWD);
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.15.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_DIRLISTONLY "(3), " CURLOPT_FTP_SKIP_PASV_IP "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_FILEMETHOD.md b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_FILEMETHOD.md
new file mode 100644
index 0000000000..dffec993d4
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_FILEMETHOD.md
@@ -0,0 +1,92 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_FTP_FILEMETHOD
+Section: 3
+Source: libcurl
+Protocol:
+  - FTP
+See-also:
+  - CURLOPT_DIRLISTONLY (3)
+  - CURLOPT_FTP_SKIP_PASV_IP (3)
+Added-in: 7.15.1
+---
+
+# NAME
+
+CURLOPT_FTP_FILEMETHOD - select directory traversing method for FTP
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTP_FILEMETHOD,
+                          long method);
+~~~
+
+# DESCRIPTION
+
+Pass a long telling libcurl which *method* to use to reach a file on a
+FTP(S) server.
+
+This option exists because some server implementations are not compliant to
+what the standards say should work.
+
+The argument should be one of the following alternatives:
+
+## CURLFTPMETHOD_MULTICWD
+
+libcurl does a single CWD operation for each path part in the given URL. For
+deep hierarchies this means many commands. This is how RFC 1738 says it should
+be done. This is the default but the slowest behavior.
+
+## CURLFTPMETHOD_NOCWD
+
+libcurl makes no CWD at all. libcurl does SIZE, RETR, STOR etc and gives a
+full path to the server for all these commands. This is the fastest behavior
+since it skips having to change directories.
+
+## CURLFTPMETHOD_SINGLECWD
+
+libcurl does one CWD with the full target directory and then operates on the
+file &"normally" (like in the multicwd case). This is somewhat more standards
+compliant than 'nocwd' but without the full penalty of 'multicwd'.
+
+# DEFAULT
+
+CURLFTPMETHOD_MULTICWD
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/1/2/3/4/new.txt");
+    curl_easy_setopt(curl, CURLOPT_FTP_FILEMETHOD, CURLFTPMETHOD_SINGLECWD);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURLFTPMETHOD_*** enums became `long` types in 8.16.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.3
deleted file mode 100644
index d6c89ba3f4..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.3
+++ /dev/null
@@ -1,69 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_FTP_SKIP_PASV_IP 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_FTP_SKIP_PASV_IP \- ignore the IP address in the PASV response
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTP_SKIP_PASV_IP, long skip);
-.fi
-.SH DESCRIPTION
-Pass a long. If \fIskip\fP is set to 1, it instructs libcurl to not use the IP
-address the server suggests in its 227-response to libcurl's PASV command when
-libcurl connects the data connection. Instead libcurl reuses the same IP
-address it already uses for the control connection. It still uses the port
-number from the 227-response.
-
-This option allows libcurl to work around broken server installations or funny
-network setups that due to NATs, firewalls or incompetence report the wrong IP
-address. Setting this option also reduces the risk for various sorts of client
-abuse by malicious servers.
-
-This option has no effect if PORT, EPRT or EPSV is used instead of PASV.
-.SH DEFAULT
-1 since 7.74.0, was 0 before then.
-.SH PROTOCOLS
-FTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/file.txt");
-
-  /* please ignore the IP in the PASV response */
-  curl_easy_setopt(curl, CURLOPT_FTP_SKIP_PASV_IP, 1L);
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.14.2
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_FTPPORT "(3), " CURLOPT_FTP_USE_EPRT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.md b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.md
new file mode 100644
index 0000000000..97e6ff6611
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.md
@@ -0,0 +1,78 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_FTP_SKIP_PASV_IP
+Section: 3
+Source: libcurl
+Protocol:
+  - FTP
+See-also:
+  - CURLOPT_FTPPORT (3)
+  - CURLOPT_FTP_USE_EPRT (3)
+Added-in: 7.15.0
+---
+
+# NAME
+
+CURLOPT_FTP_SKIP_PASV_IP - ignore the IP address in the PASV response
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTP_SKIP_PASV_IP, long skip);
+~~~
+
+# DESCRIPTION
+
+Pass a long. If *skip* is set to 1, it instructs libcurl to not use the IP
+address the server suggests in its 227-response to libcurl's PASV command when
+libcurl connects the data connection. Instead libcurl reuses the same IP
+address it already uses for the control connection. It still uses the port
+number from the 227-response.
+
+This option allows libcurl to work around broken server installations or funny
+network setups that due to NATs, firewalls or incompetence report the wrong IP
+address. Setting this option also reduces the risk for various sorts of client
+abuse by malicious servers.
+
+This option has no effect if PORT, EPRT or EPSV is used instead of PASV.
+
+# DEFAULT
+
+1, enabled.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/file.txt");
+
+    /* please ignore the IP in the PASV response */
+    curl_easy_setopt(curl, CURLOPT_FTP_SKIP_PASV_IP, 1L);
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+Before curl 7.74.0, this option was disabled by default.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_SSL_CCC.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_SSL_CCC.3
deleted file mode 100644
index 8d58faa7aa..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_SSL_CCC.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_FTP_SSL_CCC 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_FTP_SSL_CCC \- switch off SSL again with FTP after auth
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTP_SSL_CCC,
-                          long how);
-.fi
-.SH DESCRIPTION
-If enabled, this option makes libcurl use CCC (Clear Command Channel). It
-shuts down the SSL/TLS layer after authenticating. The rest of the control
-channel communication remains unencrypted. This allows NAT routers to follow
-the FTP transaction. Pass a long using one of the values below
-.IP CURLFTPSSL_CCC_NONE
-do not attempt to use CCC.
-.IP CURLFTPSSL_CCC_PASSIVE
-Do not initiate the shutdown, but wait for the server to do it. Do not send a
-reply.
-.IP CURLFTPSSL_CCC_ACTIVE
-Initiate the shutdown and wait for a reply.
-.SH DEFAULT
-CURLFTPSSL_CCC_NONE
-.SH PROTOCOLS
-FTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/file.txt");
-  curl_easy_setopt(curl, CURLOPT_USE_SSL, CURLUSESSL_CONTROL);
-  /* go back to clear-text FTP after authenticating */
-  curl_easy_setopt(curl, CURLOPT_FTP_SSL_CCC, (long)CURLFTPSSL_CCC_ACTIVE);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.16.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_USE_SSL "(3), " CURLOPT_FTPSSLAUTH "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_SSL_CCC.md b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_SSL_CCC.md
new file mode 100644
index 0000000000..78fc976bee
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_SSL_CCC.md
@@ -0,0 +1,85 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_FTP_SSL_CCC
+Section: 3
+Source: libcurl
+Protocol:
+  - FTP
+See-also:
+  - CURLOPT_FTPSSLAUTH (3)
+  - CURLOPT_PROTOCOLS_STR (3)
+  - CURLOPT_USE_SSL (3)
+Added-in: 7.16.1
+---
+
+# NAME
+
+CURLOPT_FTP_SSL_CCC - switch off SSL again with FTP after auth
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTP_SSL_CCC,
+                          long how);
+~~~
+
+# DESCRIPTION
+
+If enabled, this option makes libcurl use CCC (Clear Command Channel). It
+shuts down the SSL/TLS layer after authenticating. The rest of the control
+channel communication remains unencrypted. This allows NAT routers to follow
+the FTP transaction. Pass a long using one of the values below
+
+## CURLFTPSSL_CCC_NONE
+
+do not attempt to use CCC.
+
+## CURLFTPSSL_CCC_PASSIVE
+
+Do not initiate the shutdown, but wait for the server to do it. Do not send a
+reply.
+
+## CURLFTPSSL_CCC_ACTIVE
+
+Initiate the shutdown and wait for a reply.
+
+# DEFAULT
+
+CURLFTPSSL_CCC_NONE
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/file.txt");
+    curl_easy_setopt(curl, CURLOPT_USE_SSL, CURLUSESSL_CONTROL);
+    /* go back to clear-text FTP after authenticating */
+    curl_easy_setopt(curl, CURLOPT_FTP_SSL_CCC, CURLFTPSSL_CCC_ACTIVE);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURLFTPSSL_*** enums became `long` types in 8.16.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_EPRT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_EPRT.3
deleted file mode 100644
index 79a56ea8da..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_EPRT.3
+++ /dev/null
@@ -1,73 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_FTP_USE_EPRT 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_FTP_USE_EPRT \- use EPRT for FTP
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTP_USE_EPRT, long enabled);
-.fi
-.SH DESCRIPTION
-Pass a long. If the value is 1, it tells curl to use the EPRT command when
-doing active FTP downloads (which is enabled by
-\fICURLOPT_FTPPORT(3)\fP). Using EPRT means that libcurl first attempts to use
-EPRT before using PORT, but if you pass zero to this option, it avoids using
-EPRT, only plain PORT.
-
-The EPRT command is a slightly newer addition to the FTP protocol than PORT
-and is the preferred command to use since it enables IPv6 to be used. Very old
-FTP servers might not support it, which is why libcurl has a fallback
-mechanism. Sometimes that fallback is not enough and then this option might
-come handy.
-
-If the server is an IPv6 host, this option has no effect as EPRT is necessary
-then.
-.SH DEFAULT
-.SH PROTOCOLS
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/file.txt");
-
-  /* contact us back, aka "active" FTP */
-  curl_easy_setopt(curl, CURLOPT_FTPPORT, "-");
-
-  /* FTP the way the neanderthals did it */
-  curl_easy_setopt(curl, CURLOPT_FTP_USE_EPRT, 0L);
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.10.5
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_FTP_USE_EPSV "(3), " CURLOPT_FTPPORT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_EPRT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_EPRT.md
new file mode 100644
index 0000000000..781a2c75de
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_EPRT.md
@@ -0,0 +1,77 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_FTP_USE_EPRT
+Section: 3
+Source: libcurl
+Protocol:
+  - FTP
+See-also:
+  - CURLOPT_FTPPORT (3)
+  - CURLOPT_FTP_USE_EPSV (3)
+Added-in: 7.10.5
+---
+
+# NAME
+
+CURLOPT_FTP_USE_EPRT - use EPRT for FTP
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTP_USE_EPRT, long enabled);
+~~~
+
+# DESCRIPTION
+
+Pass a long. If the value is 1, it tells curl to use the EPRT command when
+doing active FTP downloads (which is enabled by
+CURLOPT_FTPPORT(3)). Using EPRT means that libcurl first attempts to use
+EPRT before using PORT, but if you pass zero to this option, it avoids using
+EPRT, only plain PORT.
+
+The EPRT command is a slightly newer addition to the FTP protocol than PORT
+and is the preferred command to use since it enables IPv6 to be used. Old FTP
+servers might not support it, which is why libcurl has a fallback mechanism.
+Sometimes that fallback is not enough and then this option might come handy.
+
+If the server is an IPv6 host, this option has no effect as EPRT is necessary
+then.
+
+# DEFAULT
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/file.txt");
+
+    /* contact us back, aka "active" FTP */
+    curl_easy_setopt(curl, CURLOPT_FTPPORT, "-");
+
+    /* FTP the way the neanderthals did it */
+    curl_easy_setopt(curl, CURLOPT_FTP_USE_EPRT, 0L);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_EPSV.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_EPSV.3
deleted file mode 100644
index 6c0c34d56e..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_EPSV.3
+++ /dev/null
@@ -1,70 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_FTP_USE_EPSV 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_FTP_USE_EPSV \- use EPSV for FTP
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTP_USE_EPSV, long epsv);
-.fi
-.SH DESCRIPTION
-Pass \fIepsv\fP as a long. If the value is 1, it tells curl to use the EPSV
-command when doing passive FTP downloads (which it does by default). Using
-EPSV means that libcurl first attempts to use the EPSV command before using
-PASV. If you pass zero to this option, it does not use EPSV, only plain PASV.
-
-The EPSV command is a slightly newer addition to the FTP protocol than PASV
-and is the preferred command to use since it enables IPv6 to be used. Very old
-FTP servers might not support it, which is why libcurl has a fallback
-mechanism. Sometimes that fallback is not enough and then this option might
-come handy.
-
-If the server is an IPv6 host, this option has no effect.
-.SH DEFAULT
-1
-.SH PROTOCOLS
-FTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/old-server/file.txt");
-
-  /* let's shut off this modern feature */
-  curl_easy_setopt(curl, CURLOPT_FTP_USE_EPSV, 0L);
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Along with FTP
-.SH RETURN VALUE
-Returns CURLE_OK if FTP is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_FTP_USE_EPRT "(3), " CURLOPT_FTPPORT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_EPSV.md b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_EPSV.md
new file mode 100644
index 0000000000..48eb13641d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_EPSV.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_FTP_USE_EPSV
+Section: 3
+Source: libcurl
+Protocol:
+  - FTP
+See-also:
+  - CURLOPT_FTPPORT (3)
+  - CURLOPT_FTP_USE_EPRT (3)
+Added-in: 7.9.2
+---
+
+# NAME
+
+CURLOPT_FTP_USE_EPSV - use EPSV for FTP
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTP_USE_EPSV, long epsv);
+~~~
+
+# DESCRIPTION
+
+Pass *epsv* as a long. If the value is 1, it tells curl to use the EPSV
+command when doing passive FTP downloads (which it does by default). Using
+EPSV means that libcurl first attempts to use the EPSV command before using
+PASV. If you pass zero to this option, it does not use EPSV, only plain PASV.
+
+The EPSV command is a slightly newer addition to the FTP protocol than PASV
+and is the preferred command to use since it enables IPv6 to be used. Old FTP
+servers might not support it, which is why libcurl has a fallback mechanism.
+Sometimes that fallback is not enough and then this option might come handy.
+
+If the server is an IPv6 host, this option has no effect.
+
+# DEFAULT
+
+1
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL,
+                     "ftp://example.com/old-server/file.txt");
+
+    /* let's shut off this modern feature */
+    curl_easy_setopt(curl, CURLOPT_FTP_USE_EPSV, 0L);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_PRET.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_PRET.3
deleted file mode 100644
index 478cf646b9..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_PRET.3
+++ /dev/null
@@ -1,62 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_FTP_USE_PRET 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_FTP_USE_PRET \- use PRET for FTP
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTP_USE_PRET, long enable);
-.fi
-.SH DESCRIPTION
-Pass a long. If the value is 1, it tells curl to send a PRET command before
-PASV (and EPSV). Certain FTP servers, mainly drftpd, require this non-standard
-command for directory listings as well as up and downloads in PASV mode. Has
-no effect when using the active FTP transfers mode.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-FTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/old-server/file.txt");
-
-  /* a drftpd server, do it! */
-  curl_easy_setopt(curl, CURLOPT_FTP_USE_PRET, 1L);
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.20.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_FTP_USE_EPRT "(3), " CURLOPT_FTP_USE_EPSV "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_PRET.md b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_PRET.md
new file mode 100644
index 0000000000..9a26cf4504
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_FTP_USE_PRET.md
@@ -0,0 +1,68 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_FTP_USE_PRET
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_FTP_USE_EPRT (3)
+  - CURLOPT_FTP_USE_EPSV (3)
+Protocol:
+  - FTP
+Added-in: 7.20.0
+---
+
+# NAME
+
+CURLOPT_FTP_USE_PRET - use PRET for FTP
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_FTP_USE_PRET, long enable);
+~~~
+
+# DESCRIPTION
+
+Pass a long. If the value is 1, it tells curl to send a PRET command before
+PASV (and EPSV). Certain FTP servers, mainly drftpd, require this non-standard
+command for directory listings as well as up and downloads in PASV mode. Has
+no effect when using the active FTP transfers mode.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL,
+                     "ftp://example.com/old-server/file.txt");
+
+    /* a drftpd server, do it */
+    curl_easy_setopt(curl, CURLOPT_FTP_USE_PRET, 1L);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_GSSAPI_DELEGATION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_GSSAPI_DELEGATION.3
deleted file mode 100644
index 66b7f49bb4..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_GSSAPI_DELEGATION.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_GSSAPI_DELEGATION 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_GSSAPI_DELEGATION \- allowed GSS-API delegation
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_GSSAPI_DELEGATION, long level);
-.fi
-.SH DESCRIPTION
-Set the long parameter \fIlevel\fP to \fBCURLGSSAPI_DELEGATION_FLAG\fP to
-allow unconditional GSSAPI credential delegation. The delegation is disabled
-by default since 7.21.7.  Set the parameter to
-\fBCURLGSSAPI_DELEGATION_POLICY_FLAG\fP to delegate only if the OK-AS-DELEGATE
-flag is set in the service ticket in case this feature is supported by the
-GSS-API implementation and the definition of \fIGSS_C_DELEG_POLICY_FLAG\fP was
-available at compile-time.
-.SH DEFAULT
-CURLGSSAPI_DELEGATION_NONE
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  /* delegate if okayed by policy */
-  curl_easy_setopt(curl, CURLOPT_GSSAPI_DELEGATION,
-                   (long)CURLGSSAPI_DELEGATION_POLICY_FLAG);
-  ret = curl_easy_perform(curl);
-}
-.fi
-
-.SH AVAILABILITY
-Added in 7.22.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_HTTPAUTH "(3), " CURLOPT_PROXYAUTH "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_GSSAPI_DELEGATION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_GSSAPI_DELEGATION.md
new file mode 100644
index 0000000000..2196f23984
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_GSSAPI_DELEGATION.md
@@ -0,0 +1,72 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_GSSAPI_DELEGATION
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+See-also:
+  - CURLOPT_HTTPAUTH (3)
+  - CURLOPT_PROXYAUTH (3)
+Added-in: 7.22.0
+---
+
+# NAME
+
+CURLOPT_GSSAPI_DELEGATION - allowed GSS-API delegation
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_GSSAPI_DELEGATION, long level);
+~~~
+
+# DESCRIPTION
+
+Set the long parameter *level* to **CURLGSSAPI_DELEGATION_FLAG** to allow
+unconditional GSSAPI credential delegation. The delegation is disabled by
+default since 7.21.7. Set the parameter to
+**CURLGSSAPI_DELEGATION_POLICY_FLAG** to delegate only if the OK-AS-DELEGATE
+flag is set in the service ticket in case this feature is supported by the
+GSS-API implementation and the definition of *GSS_C_DELEG_POLICY_FLAG* was
+available at compile-time.
+
+# DEFAULT
+
+CURLGSSAPI_DELEGATION_NONE
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* delegate if okayed by policy */
+    curl_easy_setopt(curl, CURLOPT_GSSAPI_DELEGATION,
+                     CURLGSSAPI_DELEGATION_POLICY_FLAG);
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURLGSSAPI_DELEGATION_*** macros became `long` types in 8.16.0, prior to this
+version a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS.3
deleted file mode 100644
index 2057fbe5c1..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS.3
+++ /dev/null
@@ -1,69 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS 3 "1 Feb 2018" libcurl libcurl
-.SH NAME
-CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS \- head start for IPv6 for happy eyeballs
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS,
-                          long timeout);
-.fi
-.SH DESCRIPTION
-Happy eyeballs is an algorithm that attempts to connect to both IPv4 and IPv6
-addresses for dual-stack hosts, preferring IPv6 first for \fItimeout\fP
-milliseconds. If the IPv6 address cannot be connected to within that time then
-a connection attempt is made to the IPv4 address in parallel. The first
-connection to be established is the one that is used.
-
-The range of suggested useful values for \fItimeout\fP is limited. Happy
-Eyeballs RFC 6555 says "It is RECOMMENDED that connection attempts be paced
-150-250 ms apart to balance human factors against network load." libcurl
-currently defaults to 200 ms. Firefox and Chrome currently default to 300 ms.
-.SH DEFAULT
-CURL_HET_DEFAULT (currently defined as 200L)
-.SH PROTOCOLS
-All except FILE
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS, 300L);
-
-  curl_easy_perform(curl);
-
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.59.0
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH SEE ALSO
-.BR CURLOPT_CONNECTTIMEOUT_MS "(3), "
-.BR CURLOPT_TIMEOUT "(3), " CURLOPT_LOW_SPEED_LIMIT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS.md
new file mode 100644
index 0000000000..9136021c3a
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS.md
@@ -0,0 +1,130 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS
+Section: 3
+Source: libcurl
+Protocol:
+  - All
+See-also:
+  - CURLOPT_CONNECTTIMEOUT_MS (3)
+  - CURLOPT_LOW_SPEED_LIMIT (3)
+  - CURLOPT_TIMEOUT (3)
+Added-in: 7.59.0
+---
+
+# NAME
+
+CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS - timing of connect attempts
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS,
+                          long timeout);
+~~~
+
+# DESCRIPTION
+
+Happy eyeballs is an algorithm that controls connecting to a host that
+resolves to more than one IP address. A common setup is to expose an
+IPv4 and IPv6 address (dual-stack). Other host offer a range of addresses
+for one or both stacks.
+
+## IP Addresses
+
+When curl is built with IPv6 support, it attempts to connect to IPv6
+first, when available. When that fails, another connect attempt for
+the first IPv4 address (again, if available) is started. Should that
+fail, the next IPv6 address is used, then the next IPv4, etc. If there
+are only addresses for one stack, those are tried one after the other.
+
+When there is neither a positive nor negative response to an attempt,
+another attempt is started after *timeout* has passed. Then another,
+after *timeout* has passed again. As long as there are addresses available.
+
+When all addresses have been tried and failed, the transfer fails.
+All attempts are aborted after CURLOPT_CONNECTTIMEOUT_MS(3) has
+passed, counted from the first attempt onward.
+
+The range of suggested useful values for *timeout* is limited. Happy
+Eyeballs RFC 6555 says "It is RECOMMENDED that connection attempts be paced
+150-250 ms apart to balance human factors against network load." libcurl
+currently defaults to 200 ms. Firefox and Chrome currently default to 300 ms.
+
+As an example, for a host that resolves to 'a1_v4, a2_v4, a3_v6, a4_v6'
+curl opens a socket to 'a3_v6' first. When that does not report back,
+it opens another socket to 'a1_v4' after 200ms. The first socket is
+left open and might still succeed. When 200ms have gone by again, a
+socket for 'a4_v6' is opened. 200ms later, 'a2_v4' is tried.
+
+At this point, there are 4 sockets open (unless the network has reported
+anything back). That took 3 times the happy eyeballs timeout, so 600ms
+in the default setting. When any of those four report a success, that
+socket is used for the transfer and the other three are closed.
+
+There is a limit on the number of sockets opened for connect attempts. When
+that limit is reached and more addresses are available, the oldest
+attempt is discarded. This limit is currently 6. With the default
+happy eyeballs timeout of 200ms, this closes attempts after 1.2 seconds
+*as long as there are more addresses to try*.
+
+There are situations where connect attempts fail, but the failure is
+considered being inconclusive. The QUIC protocol may encounter this.
+When a QUIC server restarts, it may send replies indicating that it
+is not accepting new connections right now, but maybe later.
+
+Such "inclusive" connect attempt failures cause a restart of
+the attempt, with the same address on a new socket, closing the
+previous one. Repeatedly until CURLOPT_CONNECTTIMEOUT_MS(3) strikes.
+
+## HTTPS
+
+When connection with the HTTPS protocol to a host that may talk HTTP/3,
+HTTP/2 or HTTP/1.1, curl applies a similar happy eyeballs strategy when
+attempting these versions.
+
+When HTTPS only involves a TCP connection, the versions are negotiated
+via ALPN, the TLS extension, in a single connect. Since HTTP/3 runs on
+QUIC (which runs on UDP), it requires a separate connect attempt.
+
+The HTTP/3 attempt is started first and, after *timeout* expires, the
+HTTP/2 (or 1.1) attempt is started in parallel.
+
+# DEFAULT
+
+CURL_HET_DEFAULT (currently defined as 200L)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Set the timeout to 300 milliseconds */
+    curl_easy_setopt(curl, CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS, 300L);
+
+    result = curl_easy_perform(curl);
+
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HAPROXYPROTOCOL.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HAPROXYPROTOCOL.3
deleted file mode 100644
index dab0a1f09e..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HAPROXYPROTOCOL.3
+++ /dev/null
@@ -1,63 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HAPROXYPROTOCOL 3 "5 Feb 2018" libcurl libcurl
-.SH NAME
-CURLOPT_HAPROXYPROTOCOL \- send HAProxy PROXY protocol v1 header
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HAPROXYPROTOCOL,
-                          long haproxy_protocol);
-.fi
-.SH DESCRIPTION
-A long parameter set to 1 tells the library to send an HAProxy PROXY
-protocol v1 header at beginning of the connection. The default action is not to
-send this header.
-
-This option is primarily useful when sending test requests to a service that
-expects this header.
-
-Most applications do not need this option.
-.SH DEFAULT
-0, do not send any HAProxy PROXY protocol header
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_HAPROXYPROTOCOL, 1L);
-  ret = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Along with HTTP. Added in 7.60.0.
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is enabled, and CURLE_UNKNOWN_OPTION if not.
-.SH SEE ALSO
-.BR CURLOPT_PROXY "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HAPROXYPROTOCOL.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HAPROXYPROTOCOL.md
new file mode 100644
index 0000000000..1cfb53de60
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HAPROXYPROTOCOL.md
@@ -0,0 +1,70 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HAPROXYPROTOCOL
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY (3)
+Protocol:
+  - All
+Added-in: 7.60.0
+---
+
+# NAME
+
+CURLOPT_HAPROXYPROTOCOL - send HAProxy PROXY protocol v1 header
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HAPROXYPROTOCOL,
+                          long haproxy_protocol);
+~~~
+
+# DESCRIPTION
+
+A long parameter set to 1 tells the library to send an HAProxy PROXY
+protocol v1 header at beginning of the connection. The default action is not to
+send this header.
+
+This option is primarily useful when sending test requests to a service that
+expects this header.
+
+Note that the HAProxy protocol message is only is sent over a freshly setup
+connection. A subsequent transfer that reuses a previous connection does not
+send it again.
+
+Most applications do not need this option.
+
+# DEFAULT
+
+0, do not send any HAProxy PROXY protocol header
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_HAPROXYPROTOCOL, 1L);
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HAPROXY_CLIENT_IP.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HAPROXY_CLIENT_IP.3
deleted file mode 100644
index 04d8621f5a..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HAPROXY_CLIENT_IP.3
+++ /dev/null
@@ -1,62 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HAPROXY_CLIENT_IP 3 "8 May 2023" libcurl libcurl
-.SH NAME
-CURLOPT_HAPROXY_CLIENT_IP \- set HAProxy PROXY protocol client IP
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HAPROXY_CLIENT_IP,
-                          char *client_ip);
-.fi
-.SH DESCRIPTION
-When this parameter is set to a valid IPv4 or IPv6 numerical address, the
-library sends this address as client address in the HAProxy PROXY protocol v1
-header at beginning of the connection.
-
-This option is an alternative to \fICURLOPT_HAPROXYPROTOCOL(3)\fP as that one
-cannot use a specified address.
-.SH DEFAULT
-NULL, no HAProxy header is sent
-.SH PROTOCOLS
-HTTP, HAProxy PROTOCOL
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_HAPROXY_CLIENT_IP, "1.1.1.1");
-  ret = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Along with HTTP. Added in 8.2.0.
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is enabled, and CURLE_UNKNOWN_OPTION if not.
-.SH SEE ALSO
-.BR CURLOPT_PROXY "(3), "
-.BR CURLOPT_HAPROXYPROTOCOL "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HAPROXY_CLIENT_IP.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HAPROXY_CLIENT_IP.md
new file mode 100644
index 0000000000..f9fdba66b5
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HAPROXY_CLIENT_IP.md
@@ -0,0 +1,81 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HAPROXY_CLIENT_IP
+Section: 3
+Source: libcurl
+Protocol:
+  - All
+See-also:
+  - CURLOPT_HAPROXYPROTOCOL (3)
+  - CURLOPT_PROXY (3)
+Added-in: 8.2.0
+---
+
+# NAME
+
+CURLOPT_HAPROXY_CLIENT_IP - set HAProxy PROXY protocol client IP
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HAPROXY_CLIENT_IP,
+                          char *client_ip);
+~~~
+
+# DESCRIPTION
+
+When this parameter is set to a valid IPv4 or IPv6 numerical address in its
+printable ASCII string version, the library sends this as the client address
+in the HAProxy PROXY protocol v1 header at beginning of the connection.
+
+The client address is reported upstream as the source *and* destination address
+of the non-existing client connection (since 8.20.0).
+
+This option is an alternative to CURLOPT_HAPROXYPROTOCOL(3) as that one cannot
+use a specified address.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+The application does not have to keep the string around after setting this
+option.
+
+As with most libcurl options, the user of this option must make sure that the
+*correct* data (address) is passed on. libcurl does little to no verification.
+
+Note that if you want to send a *different* HAProxy client IP in a subsequent
+request, you need to make sure that it is done over a fresh connection as
+libcurl does not send it again while reusing connections.
+
+# DEFAULT
+
+NULL, no HAProxy header is sent
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_HAPROXY_CLIENT_IP, "1.1.1.1");
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HEADER.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HEADER.3
deleted file mode 100644
index a86fa56e91..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HEADER.3
+++ /dev/null
@@ -1,75 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HEADER 3 "16 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_HEADER \- pass headers to the data stream
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HEADER, long onoff);
-.fi
-.SH DESCRIPTION
-Pass the long value \fIonoff\fP set to 1 to ask libcurl to include the headers
-in the write callback (\fICURLOPT_WRITEFUNCTION(3)\fP). This option is
-relevant for protocols that actually have headers or other meta-data (like
-HTTP and FTP).
-
-When asking to get the headers passed to the same callback as the body, it is
-not possible to accurately separate them again without detailed knowledge
-about the protocol in use.
-
-Further: the \fICURLOPT_WRITEFUNCTION(3)\fP callback is limited to only ever
-get a maximum of \fICURL_MAX_WRITE_SIZE\fP bytes passed to it (16KB), while a
-header can be longer and the \fICURLOPT_HEADERFUNCTION(3)\fP supports getting
-called with headers up to \fICURL_MAX_HTTP_HEADER\fP bytes big (100KB).
-
-It is often better to use \fICURLOPT_HEADERFUNCTION(3)\fP to get the header
-data separately.
-
-While named confusingly similar, \fICURLOPT_HTTPHEADER(3)\fP is used to set
-custom HTTP headers!
-.SH DEFAULT
-0
-.SH PROTOCOLS
-Most
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  curl_easy_setopt(curl, CURLOPT_HEADER, 1L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Provided in all libcurl versions.
-.SH RETURN VALUE
-Returns CURLE_OK.
-.SH "SEE ALSO"
-.BR CURLOPT_HEADERFUNCTION "(3), "
-.BR CURLOPT_HTTPHEADER "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HEADER.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HEADER.md
new file mode 100644
index 0000000000..ea513f5196
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HEADER.md
@@ -0,0 +1,84 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HEADER
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+  - FTP
+  - IMAP
+  - POP3
+  - SMTP
+See-also:
+  - CURLOPT_HEADERFUNCTION (3)
+  - CURLOPT_HTTPHEADER (3)
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_HEADER - pass headers to the data stream
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HEADER, long onoff);
+~~~
+
+# DESCRIPTION
+
+Pass the long value *onoff* set to 1 to ask libcurl to include the headers
+in the write callback (CURLOPT_WRITEFUNCTION(3)). This option is
+relevant for protocols that actually have headers or other meta-data (like
+HTTP and FTP).
+
+When asking to get the headers passed to the same callback as the body, it is
+not possible to accurately separate them again without detailed knowledge
+about the protocol in use.
+
+Further: the CURLOPT_WRITEFUNCTION(3) callback is limited to only ever
+get a maximum of *CURL_MAX_WRITE_SIZE* bytes passed to it (16KB), while a
+header can be longer and the CURLOPT_HEADERFUNCTION(3) supports getting
+called with headers up to *CURL_MAX_HTTP_HEADER* bytes big (100KB).
+
+It is often better to use CURLOPT_HEADERFUNCTION(3) to get the header
+data separately.
+
+While named confusingly similar, CURLOPT_HTTPHEADER(3) is used to set
+custom HTTP headers.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    curl_easy_setopt(curl, CURLOPT_HEADER, 1L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HEADERDATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HEADERDATA.3
deleted file mode 100644
index 269965b205..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HEADERDATA.3
+++ /dev/null
@@ -1,86 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HEADERDATA 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_HEADERDATA \- pointer to pass to header callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HEADERDATA, void *pointer);
-.fi
-.SH DESCRIPTION
-Pass a \fIpointer\fP to be used to write the header part of the received data
-to.
-
-If \fICURLOPT_WRITEFUNCTION(3)\fP or \fICURLOPT_HEADERFUNCTION(3)\fP is used,
-\fIpointer\fP is passed in to the respective callback.
-
-If neither of those options are set, \fIpointer\fP must be a valid FILE * and
-it is used by a plain fwrite() to write headers to.
-
-If you are using libcurl as a win32 DLL, you \fBMUST\fP use a
-\fICURLOPT_WRITEFUNCTION(3)\fP or \fICURLOPT_HEADERFUNCTION(3)\fP if you set
-this option or you might experience crashes.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-struct my_info {
-  int shoesize;
-  char *secret;
-};
-
-static size_t header_callback(char *buffer, size_t size,
-                              size_t nitems, void *userdata)
-{
-  struct my_info *i = (struct my_info *)userdata;
-
-  /* now this callback can access the my_info struct */
-
-  return nitems * size;
-}
-
-CURL *curl = curl_easy_init();
-if(curl) {
-  struct my_info my = { 10, "the cookies are in the cupboard" };
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, header_callback);
-
-  /* pass in custom data to the callback */
-  curl_easy_setopt(curl, CURLOPT_HEADERDATA, &my);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_HEADERFUNCTION "(3), " CURLOPT_WRITEFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HEADERDATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HEADERDATA.md
new file mode 100644
index 0000000000..7df0f0d1e6
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HEADERDATA.md
@@ -0,0 +1,94 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HEADERDATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HEADERFUNCTION (3)
+  - CURLOPT_WRITEFUNCTION (3)
+  - curl_easy_header (3)
+Protocol:
+  - All
+Added-in: 7.10
+---
+
+# NAME
+
+CURLOPT_HEADERDATA - pointer to pass to header callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HEADERDATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+Pass a *pointer* to be used to write the header part of the received data
+to.
+
+If CURLOPT_WRITEFUNCTION(3) or CURLOPT_HEADERFUNCTION(3) is used,
+*pointer* is passed in to the respective callback.
+
+If neither of those options are set, *pointer* must be a valid FILE * and
+it is used by a plain fwrite() to write headers to.
+
+If you are using libcurl as a Windows DLL, you **must** use a
+CURLOPT_WRITEFUNCTION(3) or CURLOPT_HEADERFUNCTION(3) if you set this option
+or you might experience crashes.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct my_info {
+  int shoesize;
+  char *secret;
+};
+
+static size_t header_callback(char *buffer, size_t size,
+                              size_t nitems, void *userdata)
+{
+  struct my_info *i = userdata;
+  printf("shoe size: %d\n", i->shoesize);
+  /* now this callback can access the my_info struct */
+
+  return nitems * size;
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    struct my_info my = { 10, "the cookies are in the cupboard" };
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, header_callback);
+
+    /* pass in custom data to the callback */
+    curl_easy_setopt(curl, CURLOPT_HEADERDATA, &my);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HEADERFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HEADERFUNCTION.3
deleted file mode 100644
index a2137c24d6..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HEADERFUNCTION.3
+++ /dev/null
@@ -1,128 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HEADERFUNCTION 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_HEADERFUNCTION \- callback that receives header data
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-size_t header_callback(char *buffer,
-                       size_t size,
-                       size_t nitems,
-                       void *userdata);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HEADERFUNCTION,
-                          header_callback);
-.fi
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-This callback function gets invoked by libcurl as soon as it has received
-header data. The header callback is called once for each header and only
-complete header lines are passed on to the callback. Parsing headers is easy
-to do using this callback. \fIbuffer\fP points to the delivered data, and the
-size of that data is \fInitems\fP; \fIsize\fP is always 1. The provide header
-line is not null-terminated!
-
-The pointer named \fIuserdata\fP is the one you set with the
-\fICURLOPT_HEADERDATA(3)\fP option.
-
-Your callback should return the number of bytes actually taken care of. If
-that amount differs from the amount passed to your callback function, it
-signals an error condition to the library. This causes the transfer to get
-aborted and the libcurl function used returns \fICURLE_WRITE_ERROR\fP.
-
-You can also abort the transfer by returning CURL_WRITEFUNC_ERROR. (7.87.0)
-
-A complete HTTP header that is passed to this function can be up to
-\fICURL_MAX_HTTP_HEADER\fP (100K) bytes and includes the final line terminator.
-
-If this option is not set, or if it is set to NULL, but
-\fICURLOPT_HEADERDATA(3)\fP is set to anything but NULL, the function used to
-accept response data is used instead. That is the function specified with
-\fICURLOPT_WRITEFUNCTION(3)\fP, or if it is not specified or NULL - the
-default, stream-writing function.
-
-It's important to note that the callback is invoked for the headers of all
-responses received after initiating a request and not just the final
-response. This includes all responses which occur during authentication
-negotiation. If you need to operate on only the headers from the final
-response, you need to collect headers in the callback yourself and use HTTP
-status lines, for example, to delimit response boundaries.
-
-For an HTTP transfer, the status line and the blank line preceding the response
-body are both included as headers and passed to this function.
-
-When a server sends a chunked encoded transfer, it may contain a trailer. That
-trailer is identical to an HTTP header and if such a trailer is received it is
-passed to the application using this callback as well. There are several ways
-to detect it being a trailer and not an ordinary header: 1) it comes after the
-response-body. 2) it comes after the final header line (CR LF) 3) a Trailer:
-header among the regular response-headers mention what header(s) to expect in
-the trailer.
-
-For non-HTTP protocols like FTP, POP3, IMAP and SMTP this function gets called
-with the server responses to the commands that libcurl sends.
-
-A more convenient way to get HTTP headers might be to use
-\fIcurl_easy_header(3)\fP.
-.SH LIMITATIONS
-libcurl does not unfold HTTP "folded headers" (deprecated since RFC 7230). A
-folded header is a header that continues on a subsequent line and starts with
-a whitespace. Such folds are passed to the header callback as separate ones,
-although strictly they are just continuations of the previous lines.
-.SH DEFAULT
-Nothing.
-.SH PROTOCOLS
-Used for all protocols with headers or meta-data concept: HTTP, FTP, POP3,
-IMAP, SMTP and more.
-.SH EXAMPLE
-.nf
-static size_t header_callback(char *buffer, size_t size,
-                              size_t nitems, void *userdata)
-{
-  /* received header is nitems * size long in 'buffer' NOT ZERO TERMINATED */
-  /* 'userdata' is set with CURLOPT_HEADERDATA */
-  return nitems * size;
-}
-
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, header_callback);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR curl_easy_header "(3), "
-.BR CURLOPT_HEADERDATA "(3), " CURLOPT_WRITEFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HEADERFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HEADERFUNCTION.md
new file mode 100644
index 0000000000..e89ec887f2
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HEADERFUNCTION.md
@@ -0,0 +1,140 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HEADERFUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HEADERDATA (3)
+  - CURLOPT_WRITEFUNCTION (3)
+  - curl_easy_header (3)
+Protocol:
+  - HTTP
+  - FTP
+  - POP3
+  - IMAP
+  - SMTP
+Added-in: 7.7.2
+---
+
+# NAME
+
+CURLOPT_HEADERFUNCTION - callback that receives header data
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+size_t header_callback(char *buffer,
+                       size_t size,
+                       size_t nitems,
+                       void *userdata);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HEADERFUNCTION,
+                          header_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+This callback function gets invoked by libcurl as soon as it has received
+header data. The header callback is called once for each header and only
+complete header lines are passed on to the callback. Parsing headers is easy
+to do using this callback. *buffer* points to the delivered data, and the size
+of that data is *nitems*; *size* is always 1. The provided header line is not
+null-terminated. Do not modify the passed in buffer.
+
+The pointer named *userdata* is the one you set with the CURLOPT_HEADERDATA(3)
+option.
+
+Your callback should return the number of bytes actually taken care of. If
+that amount differs from the amount passed to your callback function, it
+signals an error condition to the library. This causes the transfer to get
+aborted and the libcurl function used returns *CURLE_WRITE_ERROR*.
+
+You can also abort the transfer by returning CURL_WRITEFUNC_ERROR. (7.87.0)
+
+A complete HTTP header that is passed to this function can be up to
+*CURL_MAX_HTTP_HEADER* (100K) bytes and includes the final line terminator.
+
+If this option is not set, or if it is set to NULL, but
+CURLOPT_HEADERDATA(3) is set to anything but NULL, the function used to
+accept response data is used instead. That is the function specified with
+CURLOPT_WRITEFUNCTION(3), or if it is not specified or NULL - the
+default, stream-writing function.
+
+It is important to note that the callback is invoked for the headers of all
+responses received after initiating a request and not the final response. This
+includes all responses which occur during authentication negotiation. If you
+need to operate on only the headers from the final response, you need to
+collect headers in the callback yourself and use HTTP status lines, for
+example, to delimit response boundaries.
+
+For an HTTP transfer, the status line and the blank line preceding the response
+body are both included as headers and passed to this function.
+
+When a server sends a chunked encoded transfer, it may contain a trailer. That
+trailer is identical to an HTTP header and if such a trailer is received it is
+passed to the application using this callback as well. There are several ways
+to detect it being a trailer and not an ordinary header: 1) it comes after the
+response-body. 2) it comes after the final header line (CR LF) 3) a Trailer:
+header among the regular response-headers mention what header(s) to expect in
+the trailer.
+
+For non-HTTP protocols like FTP, POP3, IMAP and SMTP this function gets called
+with the server responses to the commands that libcurl sends.
+
+A more convenient way to get HTTP headers might be to use
+curl_easy_header(3).
+
+# LIMITATIONS
+
+libcurl does not unfold HTTP "folded headers" (deprecated since RFC 7230). A
+folded header is a header that continues on a subsequent line and starts with
+a whitespace. Such folds are passed to the header callback as separate ones,
+although strictly they are continuations of the previous lines.
+
+# DEFAULT
+
+Nothing.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+static size_t header_callback(char *buffer, size_t size,
+                              size_t nitems, void *userdata)
+{
+  /* received header is 'nitems' bytes in 'buffer' NOT NULL-TERMINATED */
+  /* 'userdata' is set with CURLOPT_HEADERDATA */
+  return nitems;
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, header_callback);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HEADEROPT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HEADEROPT.3
deleted file mode 100644
index 5774fd45de..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HEADEROPT.3
+++ /dev/null
@@ -1,79 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HEADEROPT 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_HEADEROPT \- send HTTP headers to both proxy and host or separately
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HEADEROPT, long bitmask);
-.fi
-.SH DESCRIPTION
-Pass a long that is a bitmask of options of how to deal with headers. The two
-mutually exclusive options are:
-
-\fBCURLHEADER_UNIFIED\fP - the headers specified in
-\fICURLOPT_HTTPHEADER(3)\fP are used in requests both to servers and
-proxies. With this option enabled, \fICURLOPT_PROXYHEADER(3)\fP does not have
-any effect.
-
-\fBCURLHEADER_SEPARATE\fP - makes \fICURLOPT_HTTPHEADER(3)\fP headers only get
-sent to a server and not to a proxy. Proxy headers must be set with
-\fICURLOPT_PROXYHEADER(3)\fP to get used. Note that if a non-CONNECT request
-is sent to a proxy, libcurl sends both server headers and proxy headers. When
-doing CONNECT, libcurl sends \fICURLOPT_PROXYHEADER(3)\fP headers only to the
-proxy and then \fICURLOPT_HTTPHEADER(3)\fP headers only to the server.
-.SH DEFAULT
-CURLHEADER_SEPARATE (changed in 7.42.1, used CURLHEADER_UNIFIED before then)
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  struct curl_slist *list;
-  list = curl_slist_append(NULL, "Shoesize: 10");
-  list = curl_slist_append(list, "Accept:");
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "http://localhost:8080");
-  curl_easy_setopt(curl, CURLOPT_HTTPHEADER, list);
-
-  /* HTTPS over a proxy makes a separate CONNECT to the proxy, so tell
-     libcurl to not send the custom headers to the proxy. Keep them
-     separate! */
-  curl_easy_setopt(curl, CURLOPT_HEADEROPT, CURLHEADER_SEPARATE);
-  ret = curl_easy_perform(curl);
-  curl_slist_free_all(list);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.37.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_HTTPHEADER "(3), " CURLOPT_PROXYHEADER "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HEADEROPT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HEADEROPT.md
new file mode 100644
index 0000000000..88d8194aba
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HEADEROPT.md
@@ -0,0 +1,88 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HEADEROPT
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+See-also:
+  - CURLOPT_HTTPHEADER (3)
+  - CURLOPT_PROXYHEADER (3)
+Added-in: 7.37.0
+---
+
+# NAME
+
+CURLOPT_HEADEROPT - send HTTP headers to both proxy and host or separately
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HEADEROPT, long bitmask);
+~~~
+
+# DESCRIPTION
+
+Pass a long that is a bitmask of options of how to deal with headers. The two
+mutually exclusive options are:
+
+**CURLHEADER_UNIFIED** - the headers specified in
+CURLOPT_HTTPHEADER(3) are used in requests both to servers and
+proxies. With this option enabled, CURLOPT_PROXYHEADER(3) does not have
+any effect.
+
+**CURLHEADER_SEPARATE** - makes CURLOPT_HTTPHEADER(3) headers only get
+sent to a server and not to a proxy. Proxy headers must be set with
+CURLOPT_PROXYHEADER(3) to get used. Note that if a non-CONNECT request
+is sent to a proxy, libcurl sends both server headers and proxy headers. When
+doing CONNECT, libcurl sends CURLOPT_PROXYHEADER(3) headers only to the
+proxy and then CURLOPT_HTTPHEADER(3) headers only to the server.
+
+# DEFAULT
+
+CURLHEADER_SEPARATE (changed in 7.42.1, used CURLHEADER_UNIFIED before then)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    struct curl_slist *list;
+    list = curl_slist_append(NULL, "Shoesize: 10");
+    list = curl_slist_append(list, "Accept:");
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "http://localhost:8080");
+    curl_easy_setopt(curl, CURLOPT_HTTPHEADER, list);
+
+    /* HTTPS over a proxy makes a separate CONNECT to the proxy, so tell
+       libcurl to not send the custom headers to the proxy. Keep them
+       separate. */
+    curl_easy_setopt(curl, CURLOPT_HEADEROPT, CURLHEADER_SEPARATE);
+    result = curl_easy_perform(curl);
+    curl_slist_free_all(list);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURLHEADER_*** macros became `long` types in 8.16.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HSTS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HSTS.3
deleted file mode 100644
index cce62ac4ff..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HSTS.3
+++ /dev/null
@@ -1,78 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HSTS 3 "5 Feb 2019" libcurl libcurl
-.SH NAME
-CURLOPT_HSTS \- HSTS cache file name
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HSTS, char *filename);
-.fi
-.SH DESCRIPTION
-Make the \fIfilename\fP point to a file name to load an existing HSTS cache
-from, and to store the cache in when the easy handle is closed. Setting a file
-name with this option also enables HSTS for this handle (the equivalent of
-setting \fICURLHSTS_ENABLE\fP with \fICURLOPT_HSTS_CTRL(3)\fP).
-
-If the given file does not exist or contains no HSTS entries at startup, the
-HSTS cache simply starts empty. Setting the file name to NULL or "" only
-enables HSTS without reading from or writing to any file.
-
-If this option is set multiple times, libcurl loads cache entries from each
-given file but only stores the last used name for later writing.
-.SH "FILE FORMAT"
-The HSTS cache is saved to and loaded from a text file with one entry per
-physical line. Each line in the file has the following format:
-
-[host] [stamp]
-
-[host] is the domain name for the entry and the name is dot-prefixed if it is
-an entry valid for all subdomains to the name as well or only for the exact
-name.
-
-[stamp] is the time (in UTC) when the entry expires and it uses the format
-\&"YYYYMMDD HH:MM:SS".
-
-Lines starting with "#" are treated as comments and are ignored. There is
-currently no length or size limit.
-.SH DEFAULT
-NULL, no file name
-.SH PROTOCOLS
-HTTPS and HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_HSTS, "/home/user/.hsts-cache");
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.74.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_HSTS_CTRL "(3), " CURLOPT_ALTSVC "(3), " CURLOPT_RESOLVE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HSTS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HSTS.md
new file mode 100644
index 0000000000..12efff50bc
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HSTS.md
@@ -0,0 +1,105 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HSTS
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+See-also:
+  - CURLOPT_ALTSVC (3)
+  - CURLOPT_HSTS_CTRL (3)
+  - CURLOPT_RESOLVE (3)
+Added-in: 7.74.0
+---
+
+# NAME
+
+CURLOPT_HSTS - HSTS cache filename
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HSTS, char *filename);
+~~~
+
+# DESCRIPTION
+
+Make the *filename* point to a filename to load an existing HSTS cache from,
+and to store the cache in when the easy handle is closed. Setting a filename
+with this option also enables HSTS for this handle (the equivalent of setting
+*CURLHSTS_ENABLE* with CURLOPT_HSTS_CTRL(3)).
+
+If the given file does not exist or contains no HSTS entries at startup, the
+HSTS cache starts empty. Setting the filename to NULL allows HSTS without
+reading from or writing to any file. NULL also makes libcurl clear the list of
+files to read HSTS data from, if any such were previously set.
+
+If this option is set multiple times, libcurl loads cache entries from each
+given file but only stores the last used name for later writing.
+
+Since libcurl 8.20.0, each in-memory HSTS cache (per easy handle or shared
+cache) holds no more than the most recently added 10,000 HSTS hostnames.
+
+# FILE FORMAT
+
+The HSTS cache is saved to and loaded from a text file with one entry per
+physical line. Each line in the file has the following format:
+
+    [host] [stamp]
+
+[host] is the domain name for the entry and the name is dot-prefixed if it is
+an entry valid for all subdomains to the name as well or only for the exact
+name.
+
+[stamp] is the time (in UTC) when the entry expires and it uses the format
+"YYYYMMDD HH:MM:SS".
+
+Lines starting with "#" are treated as comments and are ignored. There is
+currently no length or size limit.
+
+# DEFAULT
+
+NULL, no filename
+
+# SECURITY CONCERNS
+
+We strongly urge users to stick to `https://` URLs, which makes this option
+unnecessary.
+
+libcurl cannot fully protect against attacks where an attacker has write
+access to the same directory where it is directed to save files. This is
+particularly sensitive if you save files using elevated privileges.
+
+libcurl creates the file to store HSTS data in using default file permissions,
+meaning that on *nix systems you may need to restrict your umask to prevent
+other users on the same system to access the file.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_HSTS, "/home/user/.hsts-cache");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSREADDATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSREADDATA.3
deleted file mode 100644
index fb348ac449..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSREADDATA.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HSTSREADDATA 3 "14 Sep 2020" libcurl libcurl
-.SH NAME
-CURLOPT_HSTSREADDATA \- pointer passed to the HSTS read callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HSTSREADDATA, void *pointer);
-.fi
-.SH DESCRIPTION
-Data \fIpointer\fP to pass to the HSTS read function. If you use the
-\fICURLOPT_HSTSREADFUNCTION(3)\fP option, this is the pointer you get as input
-in the 3rd argument to the callback.
-
-This option does not enable HSTS, you need to use \fICURLOPT_HSTS_CTRL(3)\fP to
-do that.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-This feature is only used for HTTP(S) transfer.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-struct MyData this;
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "http://example.com");
-
-  /* pass pointer that gets passed in to the
-     CURLOPT_HSTSREADFUNCTION callback */
-  curl_easy_setopt(curl, CURLOPT_HSTSREADDATA, &this);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.74.0
-.SH RETURN VALUE
-This returns CURLE_OK.
-.SH "SEE ALSO"
-.BR CURLOPT_HSTSREADFUNCTION "(3), " CURLOPT_HSTSWRITEDATA "(3), "
-.BR CURLOPT_HSTSWRITEFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSREADDATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSREADDATA.md
new file mode 100644
index 0000000000..0b5174d8e1
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSREADDATA.md
@@ -0,0 +1,82 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HSTSREADDATA
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+See-also:
+  - CURLOPT_HSTS (3)
+  - CURLOPT_HSTSREADFUNCTION (3)
+  - CURLOPT_HSTSWRITEDATA (3)
+  - CURLOPT_HSTSWRITEFUNCTION (3)
+Added-in: 7.74.0
+---
+
+# NAME
+
+CURLOPT_HSTSREADDATA - pointer passed to the HSTS read callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HSTSREADDATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+Data *pointer* to pass to the HSTS read function. If you use the
+CURLOPT_HSTSREADFUNCTION(3) option, this is the pointer you get as input
+in the 3rd argument to the callback.
+
+This option does not enable HSTS, you need to use CURLOPT_HSTS_CTRL(3) to
+do that.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct MyData {
+  void *custom;
+};
+
+static CURLSTScode hsts_cb(CURL *easy, struct curl_hstsentry *sts,
+                           void *clientp)
+{
+  /* populate the struct as documented */
+  return CURLSTS_OK;
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  struct MyData this;
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "http://example.com");
+
+    /* pass pointer that gets passed in to the
+       CURLOPT_HSTSREADFUNCTION callback */
+    curl_easy_setopt(curl, CURLOPT_HSTSREADDATA, &this);
+    /* set HSTS read callback */
+    curl_easy_setopt(curl, CURLOPT_HSTSREADFUNCTION, hsts_cb);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This returns CURLE_OK.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSREADFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSREADFUNCTION.3
deleted file mode 100644
index 0ceb1866c0..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSREADFUNCTION.3
+++ /dev/null
@@ -1,88 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HSTSREADFUNCTION 3 "14 Sep 2020" libcurl libcurl
-.SH NAME
-CURLOPT_HSTSREADFUNCTION \- read callback for HSTS hosts
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-struct curl_hstsentry {
-  char *name;
-  size_t namelen;
-  unsigned int includeSubDomains:1;
-  char expire[18]; /* YYYYMMDD HH:MM:SS [null-terminated] */
-};
-
-CURLSTScode hstsread(CURL *easy, struct curl_hstsentry *sts, void *clientp);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HSTSREADFUNCTION, hstsread);
-.fi
-.SH DESCRIPTION
-Pass a pointer to your callback function, as the prototype shows above.
-
-This callback function gets called by libcurl repeatedly when it populates the
-in-memory HSTS cache.
-
-Set the \fIclientp\fP argument with the \fICURLOPT_HSTSREADDATA(3)\fP option
-or it is NULL.
-
-When this callback is invoked, the \fIsts\fP pointer points to a populated
-struct: Copy the host name to \fIname\fP (no longer than \fInamelen\fP
-bytes). Make it null-terminated. Set \fIincludeSubDomains\fP to TRUE or
-FALSE. Set \fIexpire\fP to a date stamp or a zero length string for *forever*
-(wrong date stamp format might cause the name to not get accepted)
-
-The callback should return \fICURLSTS_OK\fP if it returns a name and is
-prepared to be called again (for another host) or \fICURLSTS_DONE\fP if it has
-no entry to return. It can also return \fICURLSTS_FAIL\fP to signal
-error. Returning \fICURLSTS_FAIL\fP stops the transfer from being performed
-and make \fICURLE_ABORTED_BY_CALLBACK\fP get returned.
-
-This option does not enable HSTS, you need to use \fICURLOPT_HSTS_CTRL(3)\fP to
-do that.
-.SH DEFAULT
-NULL - no callback.
-.SH PROTOCOLS
-This feature is only used for HTTP(S) transfer.
-.SH EXAMPLE
-.nf
-{
-  /* set HSTS read callback */
-  curl_easy_setopt(curl, CURLOPT_HSTSREADFUNCTION, hstsread);
-
-  /* pass in suitable argument to the callback */
-  curl_easy_setopt(curl, CURLOPT_HSTSREADDATA, &hstspreload[0]);
-
-  result = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.74.0
-.SH RETURN VALUE
-This returns CURLE_OK.
-.SH "SEE ALSO"
-.BR CURLOPT_HSTSREADDATA "(3), " CURLOPT_HSTSWRITEFUNCTION "(3), "
-.BR CURLOPT_HSTS "(3), " CURLOPT_HSTS_CTRL "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSREADFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSREADFUNCTION.md
new file mode 100644
index 0000000000..259d2f0f26
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSREADFUNCTION.md
@@ -0,0 +1,110 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HSTSREADFUNCTION
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+See-also:
+  - CURLOPT_HSTS (3)
+  - CURLOPT_HSTSREADDATA (3)
+  - CURLOPT_HSTSWRITEFUNCTION (3)
+  - CURLOPT_HSTS_CTRL (3)
+Added-in: 7.74.0
+---
+
+# NAME
+
+CURLOPT_HSTSREADFUNCTION - read callback for HSTS hosts
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+struct curl_hstsentry {
+  char *name;
+  size_t namelen;
+  unsigned int includeSubDomains:1;
+  char expire[18]; /* YYYYMMDD HH:MM:SS [null-terminated] */
+};
+
+CURLSTScode hstsread(CURL *easy, struct curl_hstsentry *sts, void *clientp);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HSTSREADFUNCTION, hstsread);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, as the prototype shows above.
+
+This callback function gets called by libcurl repeatedly when it populates the
+in-memory HSTS cache.
+
+Set the *clientp* argument with the CURLOPT_HSTSREADDATA(3) option or it is
+NULL.
+
+When this callback is invoked, the *sts* pointer points to a populated struct:
+Copy the hostname to *name* (no longer than *namelen* bytes). Make it
+null-terminated. Set *includeSubDomains* to TRUE or FALSE. Set *expire* to a
+date stamp or a zero length string for *forever* (wrong date stamp format
+might cause the name to not get accepted)
+
+The callback should return *CURLSTS_OK* if it returns a name and is prepared
+to be called again (for another host) or *CURLSTS_DONE* if it has no entry to
+return. It can also return *CURLSTS_FAIL* to signal error. Returning
+*CURLSTS_FAIL* stops the transfer from being performed and make
+*CURLE_ABORTED_BY_CALLBACK* get returned.
+
+This option does not enable HSTS, you need to use CURLOPT_HSTS_CTRL(3) to do
+that.
+
+The hostname provided to libcurl *should not* have a trailing dot nor leading
+dot.
+
+# DEFAULT
+
+NULL - no callback.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct priv {
+  void *custom;
+};
+
+static CURLSTScode hsts_cb(CURL *easy, struct curl_hstsentry *sts,
+                           void *clientp)
+{
+  /* populate the struct as documented */
+  return CURLSTS_OK;
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    struct priv my_stuff;
+    CURLcode result;
+
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* set HSTS read callback */
+    curl_easy_setopt(curl, CURLOPT_HSTSREADFUNCTION, hsts_cb);
+
+    /* pass in suitable argument to the callback */
+    curl_easy_setopt(curl, CURLOPT_HSTSREADDATA, &my_stuff);
+
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This returns CURLE_OK.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSWRITEDATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSWRITEDATA.3
deleted file mode 100644
index c088d97bba..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSWRITEDATA.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HSTSWRITEDATA 3 "14 Sep 2020" libcurl libcurl
-.SH NAME
-CURLOPT_HSTSWRITEDATA \- pointer passed to the HSTS write callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HSTSWRITEDATA, void *pointer);
-.fi
-.SH DESCRIPTION
-Data \fIpointer\fP to pass to the HSTS write function. If you use the
-\fICURLOPT_HSTSWRITEFUNCTION(3)\fP option, this is the pointer you get as
-input in the fourth argument to the callback.
-
-This option does not enable HSTS, you need to use \fICURLOPT_HSTS_CTRL(3)\fP to
-do that.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-This feature is only used for HTTP(S) transfer.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-struct MyData this;
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "http://example.com");
-
-  /* pass pointer that gets passed in to the
-     CURLOPT_HSTSWRITEFUNCTION callback */
-  curl_easy_setopt(curl, CURLOPT_HSTSWRITEDATA, &this);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.74.0
-.SH RETURN VALUE
-This returns CURLE_OK.
-.SH "SEE ALSO"
-.BR CURLOPT_HSTSWRITEFUNCTION "(3), " CURLOPT_HSTSREADDATA "(3), "
-.BR CURLOPT_HSTSREADFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSWRITEDATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSWRITEDATA.md
new file mode 100644
index 0000000000..cc078539dd
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSWRITEDATA.md
@@ -0,0 +1,73 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HSTSWRITEDATA
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+See-also:
+  - CURLOPT_HSTS (3)
+  - CURLOPT_HSTSREADDATA (3)
+  - CURLOPT_HSTSREADFUNCTION (3)
+  - CURLOPT_HSTSWRITEFUNCTION (3)
+Added-in: 7.74.0
+---
+
+# NAME
+
+CURLOPT_HSTSWRITEDATA - pointer passed to the HSTS write callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HSTSWRITEDATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+Data *pointer* to pass to the HSTS write function. If you use the
+CURLOPT_HSTSWRITEFUNCTION(3) option, this is the pointer you get as
+input in the fourth argument to the callback.
+
+This option does not enable HSTS, you need to use CURLOPT_HSTS_CTRL(3) to
+do that.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct MyData {
+  void *custom;
+};
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  struct MyData this;
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "http://example.com");
+
+    /* pass pointer that gets passed in to the
+       CURLOPT_HSTSWRITEFUNCTION callback */
+    curl_easy_setopt(curl, CURLOPT_HSTSWRITEDATA, &this);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This returns CURLE_OK.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSWRITEFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSWRITEFUNCTION.3
deleted file mode 100644
index 3a185b27e9..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSWRITEFUNCTION.3
+++ /dev/null
@@ -1,92 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HSTSWRITEFUNCTION 3 "14 Sep 2020" libcurl libcurl
-.SH NAME
-CURLOPT_HSTSWRITEFUNCTION \- write callback for HSTS hosts
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-struct curl_hstsentry {
-  char *name;
-  size_t namelen;
-  unsigned int includeSubDomains:1;
-  char expire[18]; /* YYYYMMDD HH:MM:SS [null-terminated] */
-};
-
-struct curl_index {
-  size_t index; /* the provided entry's "index" or count */
-  size_t total; /* total number of entries to save */
-};
-
-CURLSTScode hstswrite(CURL *easy, struct curl_hstsentry *sts,
-                      struct curl_index *count, void *clientp);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HSTSWRITEFUNCTION, hstswrite);
-.fi
-.SH DESCRIPTION
-Pass a pointer to your callback function, as the prototype shows above.
-
-This callback function gets called by libcurl repeatedly to allow the
-application to store the in-memory HSTS cache when libcurl is about to discard
-it.
-
-Set the \fIclientp\fP argument with the \fICURLOPT_HSTSWRITEDATA(3)\fP option
-or it is NULL.
-When the callback is invoked, the \fIsts\fP pointer points to a populated
-struct: Read the host name to 'name' (it is \fInamelen\fP bytes long and null
-terminated. The \fIincludeSubDomains\fP field is non-zero if the entry matches
-subdomains. The \fIexpire\fP string is a date stamp null-terminated string
-using the syntax YYYYMMDD HH:MM:SS.
-
-The callback should return \fICURLSTS_OK\fP if it succeeded and is prepared to
-be called again (for another host) or \fICURLSTS_DONE\fP if there is nothing
-more to do. It can also return \fICURLSTS_FAIL\fP to signal error.
-
-This option does not enable HSTS, you need to use \fICURLOPT_HSTS_CTRL(3)\fP to
-do that.
-.SH DEFAULT
-NULL - no callback.
-.SH PROTOCOLS
-This feature is only used for HTTP(S) transfer.
-.SH EXAMPLE
-.nf
-{
-  /* set HSTS read callback */
-  curl_easy_setopt(curl, CURLOPT_HSTSWRITEFUNCTION, hstswrite);
-
-  /* pass in suitable argument to the callback */
-  curl_easy_setopt(curl, CURLOPT_HSTSWRITEDATA, &hstspreload[0]);
-
-  result = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.74.0
-.SH RETURN VALUE
-This returns CURLE_OK.
-.SH "SEE ALSO"
-.BR CURLOPT_HSTSWRITEDATA "(3), " CURLOPT_HSTSWRITEFUNCTION "(3), "
-.BR CURLOPT_HSTS "(3), " CURLOPT_HSTS_CTRL "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSWRITEFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSWRITEFUNCTION.md
new file mode 100644
index 0000000000..cdbdbe5d26
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HSTSWRITEFUNCTION.md
@@ -0,0 +1,109 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HSTSWRITEFUNCTION
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+See-also:
+  - CURLOPT_HSTS (3)
+  - CURLOPT_HSTSWRITEDATA (3)
+  - CURLOPT_HSTSWRITEFUNCTION (3)
+  - CURLOPT_HSTS_CTRL (3)
+Added-in: 7.74.0
+---
+
+# NAME
+
+CURLOPT_HSTSWRITEFUNCTION - write callback for HSTS hosts
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+struct curl_hstsentry {
+  char *name;
+  size_t namelen;
+  unsigned int includeSubDomains:1;
+  char expire[18]; /* YYYYMMDD HH:MM:SS [null-terminated] */
+};
+
+struct curl_index {
+  size_t index; /* the provided entry's "index" or count */
+  size_t total; /* total number of entries to save */
+};
+
+CURLSTScode hstswrite(CURL *easy, struct curl_hstsentry *sts,
+                      struct curl_index *count, void *clientp);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HSTSWRITEFUNCTION, hstswrite);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, as the prototype shows above.
+
+This callback function gets called by libcurl repeatedly to allow the
+application to store the in-memory HSTS cache when libcurl is about to discard
+it.
+
+Set the *clientp* argument with the CURLOPT_HSTSWRITEDATA(3) option
+or it is NULL.
+When the callback is invoked, the *sts* pointer points to a populated
+struct: Read the hostname to 'name' (it is *namelen* bytes long and null
+terminated. The *includeSubDomains* field is non-zero if the entry matches
+subdomains. The *expire* string is a date stamp null-terminated string
+using the syntax YYYYMMDD HH:MM:SS.
+
+The callback should return *CURLSTS_OK* if it succeeded and is prepared to
+be called again (for another host) or *CURLSTS_DONE* if there is nothing
+more to do. It can also return *CURLSTS_FAIL* to signal error.
+
+This option does not enable HSTS, you need to use CURLOPT_HSTS_CTRL(3) to
+do that.
+
+# DEFAULT
+
+NULL - no callback.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct priv {
+  void *custom;
+};
+
+static CURLSTScode hswr_cb(CURL *easy, struct curl_hstsentry *sts,
+                           struct curl_index *count, void *clientp)
+{
+  /* save the passed in HSTS data somewhere */
+  return CURLSTS_OK;
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    struct priv my_stuff;
+    CURLcode result;
+
+    /* set HSTS read callback */
+    curl_easy_setopt(curl, CURLOPT_HSTSWRITEFUNCTION, hswr_cb);
+
+    /* pass in suitable argument to the callback */
+    curl_easy_setopt(curl, CURLOPT_HSTSWRITEDATA, &my_stuff);
+
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This returns CURLE_OK.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HSTS_CTRL.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HSTS_CTRL.3
deleted file mode 100644
index 2136e48308..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HSTS_CTRL.3
+++ /dev/null
@@ -1,70 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HSTS_CTRL 3 "4 Sep 2020" libcurl libcurl
-.SH NAME
-CURLOPT_HSTS_CTRL \- control HSTS behavior
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-#define CURLHSTS_ENABLE       (1<<0)
-#define CURLHSTS_READONLYFILE (1<<1)
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HSTS_CTRL, long bitmask);
-.fi
-.SH DESCRIPTION
-HSTS (HTTP Strict Transport Security) means that an HTTPS server can instruct
-the client to not contact it again over clear-text HTTP for a certain period
-into the future. libcurl then automatically redirects HTTP attempts to such
-hosts to instead use HTTPS. This is done by libcurl retaining this knowledge
-in an in-memory cache.
-
-Populate the long \fIbitmask\fP with the correct set of features to instruct
-libcurl how to handle HSTS for the transfers using this handle.
-.SH BITS
-.IP "CURLHSTS_ENABLE"
-Enable the in-memory HSTS cache for this handle.
-.IP "CURLHSTS_READONLYFILE"
-Make the HSTS file (if specified) read-only - makes libcurl not save the cache
-to the file when closing the handle.
-.SH DEFAULT
-0. HSTS is disabled by default.
-.SH PROTOCOLS
-HTTPS and HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_HSTS_CTRL, (long)CURLHSTS_ENABLE);
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.74.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_HSTS "(3), " CURLOPT_CONNECT_TO "(3), " CURLOPT_RESOLVE "(3), "
-.BR CURLOPT_ALTSVC "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HSTS_CTRL.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HSTS_CTRL.md
new file mode 100644
index 0000000000..7445b154b7
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HSTS_CTRL.md
@@ -0,0 +1,85 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HSTS_CTRL
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+See-also:
+  - CURLOPT_ALTSVC (3)
+  - CURLOPT_CONNECT_TO (3)
+  - CURLOPT_HSTS (3)
+  - CURLOPT_RESOLVE (3)
+Added-in: 7.74.0
+---
+
+# NAME
+
+CURLOPT_HSTS_CTRL - control HSTS behavior
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+#define CURLHSTS_ENABLE       (1L << 0)
+#define CURLHSTS_READONLYFILE (1L << 1)
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HSTS_CTRL, long bitmask);
+~~~
+
+# DESCRIPTION
+
+HSTS (HTTP Strict Transport Security) means that an HTTPS server can instruct
+the client to not contact it again over clear-text HTTP for a certain period
+into the future. libcurl then automatically redirects HTTP attempts to such
+hosts to instead use HTTPS. This is done by libcurl retaining this knowledge
+in an in-memory cache.
+
+Populate the long *bitmask* with the correct set of features to instruct
+libcurl how to handle HSTS for the transfers using this handle.
+
+# BITS
+
+## CURLHSTS_ENABLE
+
+Enable the in-memory HSTS cache for this handle.
+
+## CURLHSTS_READONLYFILE
+
+Make the HSTS file (if specified) read-only - makes libcurl not save the cache
+to the file when closing the handle.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    /* enable HSTS */
+    curl_easy_setopt(curl, CURLOPT_HSTS_CTRL, CURLHSTS_ENABLE);
+    /* specify where to store the HSTS cache */
+    curl_easy_setopt(curl, CURLOPT_HSTS, "/home/user/.hsts-cache");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP09_ALLOWED.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP09_ALLOWED.3
deleted file mode 100644
index f3e1e625ce..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP09_ALLOWED.3
+++ /dev/null
@@ -1,62 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HTTP09_ALLOWED 3 "17 Dec 2018" libcurl libcurl
-.SH NAME
-CURLOPT_HTTP09_ALLOWED \- allow HTTP/0.9 response
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTP09_ALLOWED, long allowed);
-.fi
-.SH DESCRIPTION
-Pass the long argument \fIallowed\fP set to 1L to allow HTTP/0.9 responses.
-
-An HTTP/0.9 response is a server response entirely without headers and only a
-body. You can connect to lots of random TCP services and still get a response
-that curl might consider to be HTTP/0.9!
-.SH DEFAULT
-curl allowed HTTP/0.9 responses by default before 7.66.0
-
-Since 7.66.0, libcurl requires this option set to 1L to allow HTTP/0.9
-responses.
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_HTTP09_ALLOWED, 1L);
-  ret = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Option added in 7.64.0, present along with HTTP.
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_SSLVERSION "(3), " CURLOPT_HTTP_VERSION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP09_ALLOWED.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP09_ALLOWED.md
new file mode 100644
index 0000000000..400348f4ca
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP09_ALLOWED.md
@@ -0,0 +1,70 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HTTP09_ALLOWED
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+See-also:
+  - CURLOPT_HTTP_VERSION (3)
+  - CURLOPT_SSLVERSION (3)
+Added-in: 7.64.0
+---
+
+# NAME
+
+CURLOPT_HTTP09_ALLOWED - allow HTTP/0.9 response
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTP09_ALLOWED, long allowed);
+~~~
+
+# DESCRIPTION
+
+Pass the long argument *allowed* set to 1L to allow HTTP/0.9 responses.
+
+An HTTP/0.9 response is a server response entirely without headers and only a
+body. You can connect to lots of random TCP services and still get a response
+that curl might consider to be HTTP/0.9.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_HTTP09_ALLOWED, 1L);
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+curl allowed HTTP/0.9 responses by default before 7.66.0
+
+Since 7.66.0, libcurl requires this option set to 1L to allow HTTP/0.9
+responses.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP200ALIASES.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP200ALIASES.3
deleted file mode 100644
index 06ac5233bd..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP200ALIASES.3
+++ /dev/null
@@ -1,72 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HTTP200ALIASES 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_HTTP200ALIASES \- alternative matches for HTTP 200 OK
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTP200ALIASES,
-                          struct curl_slist *aliases);
-.SH DESCRIPTION
-Pass a pointer to a linked list of \fIaliases\fP to be treated as valid HTTP
-200 responses.  Some servers respond with a custom header response line.  For
-example, SHOUTcast servers respond with "ICY 200 OK". Also some old Icecast
-1.3.x servers respond like that for certain user agent headers or in absence
-of such. By including this string in your list of aliases, the response gets
-treated as a valid HTTP header line such as "HTTP/1.0 200 OK".
-
-The linked list should be a fully valid list of struct curl_slist structs, and
-be properly filled in.  Use \fIcurl_slist_append(3)\fP to create the list and
-\fIcurl_slist_free_all(3)\fP to clean up an entire list.
-
-The alias itself is not parsed for any version strings. The protocol is
-assumed to match HTTP 1.0 when an alias match.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  struct curl_slist *list;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  list = curl_slist_append(NULL, "ICY 200 OK");
-  list = curl_slist_append(list, "WEIRDO 99 FINE");
-
-  curl_easy_setopt(curl, CURLOPT_HTTP200ALIASES, list);
-  curl_easy_perform(curl);
-  curl_slist_free_all(list); /* free the list again */
-}
-.fi
-.SH AVAILABILITY
-Added in 7.10.3
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_HTTP_VERSION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP200ALIASES.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP200ALIASES.md
new file mode 100644
index 0000000000..daf0b06b16
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP200ALIASES.md
@@ -0,0 +1,85 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HTTP200ALIASES
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+See-also:
+  - CURLOPT_HTTP09_ALLOWED (3)
+  - CURLOPT_HTTP_VERSION (3)
+Added-in: 7.10.3
+---
+
+# NAME
+
+CURLOPT_HTTP200ALIASES - alternative matches for HTTP 200 OK
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTP200ALIASES,
+                          struct curl_slist *aliases);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a linked list of *aliases* to be treated as valid HTTP 200
+responses. Some servers respond with a custom header response line. For
+example, SHOUTcast servers respond with "ICY 200 OK". Also some old Icecast
+1.3.x servers respond like that for certain user agent headers or in absence
+of such. By including this string in your list of aliases, the response gets
+treated as a valid HTTP header line such as "HTTP/1.0 200 OK".
+
+The linked list should be a fully valid list of struct curl_slist structs, and
+be properly filled in. Use curl_slist_append(3) to create the list and
+curl_slist_free_all(3) to clean up an entire list.
+
+The alias itself is not parsed for any version strings. The protocol is
+assumed to match HTTP 1.0 when an alias match.
+
+Using this option multiple times makes the last set list override the previous
+ones. Set it to NULL to disable its use again.
+
+libcurl does not copy the list, it needs to be kept around until after the
+transfer has completed.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    struct curl_slist *list;
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    list = curl_slist_append(NULL, "ICY 200 OK");
+    list = curl_slist_append(list, "WEIRDO 99 FINE");
+
+    curl_easy_setopt(curl, CURLOPT_HTTP200ALIASES, list);
+    result = curl_easy_perform(curl);
+    curl_slist_free_all(list); /* free the list again */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPAUTH.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPAUTH.3
deleted file mode 100644
index 53a19c9424..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPAUTH.3
+++ /dev/null
@@ -1,138 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HTTPAUTH 3 "2 Aug 2014" libcurl libcurl
-.SH NAME
-CURLOPT_HTTPAUTH \- HTTP server authentication methods to try
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTPAUTH, long bitmask);
-.SH DESCRIPTION
-Pass a long as parameter, which is set to a bitmask, to tell libcurl which
-authentication method(s) you want it to use speaking to the remote server.
-
-The available bits are listed below. If more than one bit is set, libcurl
-first queries the host to see which authentication methods it supports and
-then picks the best one you allow it to use. For some methods, this induces an
-extra network round-trip. Set the actual name and password with the
-\fICURLOPT_USERPWD(3)\fP option or with the \fICURLOPT_USERNAME(3)\fP and the
-\fICURLOPT_PASSWORD(3)\fP options.
-
-For authentication with a proxy, see \fICURLOPT_PROXYAUTH(3)\fP.
-
-.IP CURLAUTH_BASIC
-HTTP Basic authentication. This is the default choice, and the only method
-that is in wide-spread use and supported virtually everywhere. This sends
-the user name and password over the network in plain text, easily captured by
-others.
-.IP CURLAUTH_DIGEST
-HTTP Digest authentication.  Digest authentication is defined in RFC 2617 and
-is a more secure way to do authentication over public networks than the
-regular old-fashioned Basic method.
-.IP CURLAUTH_DIGEST_IE
-HTTP Digest authentication with an IE flavor.  Digest authentication is
-defined in RFC 2617 and is a more secure way to do authentication over public
-networks than the regular old-fashioned Basic method. The IE flavor is simply
-that libcurl uses a special "quirk" that IE is known to have used before
-version 7 and that some servers require the client to use.
-.IP CURLAUTH_BEARER
-HTTP Bearer token authentication, used primarily in OAuth 2.0 protocol.
-
-You can set the Bearer token to use with \fICURLOPT_XOAUTH2_BEARER(3)\fP.
-.IP CURLAUTH_NEGOTIATE
-HTTP Negotiate (SPNEGO) authentication. Negotiate authentication is defined
-in RFC 4559 and is the most secure way to perform authentication over HTTP.
-
-You need to build libcurl with a suitable GSS-API library or SSPI on Windows
-for this to work.
-.IP CURLAUTH_NTLM
-HTTP NTLM authentication. A proprietary protocol invented and used by
-Microsoft. It uses a challenge-response and hash concept similar to Digest, to
-prevent the password from being eavesdropped.
-
-You need to build libcurl with either OpenSSL or GnuTLS support for this
-option to work, or build libcurl on Windows with SSPI support.
-.IP CURLAUTH_NTLM_WB
-NTLM delegating to winbind helper. Authentication is performed by a separate
-binary application that is executed when needed. The name of the application
-is specified at compile time but is typically \fB/usr/bin/ntlm_auth\fP.
-
-Note that libcurl forks when necessary to run the winbind application and kill
-it when complete, calling \fBwaitpid()\fP to await its exit when done. On
-POSIX operating systems, killing the process causes a SIGCHLD signal to be
-raised (regardless of whether \fICURLOPT_NOSIGNAL(3)\fP is set), which must be
-handled intelligently by the application. In particular, the application must
-not unconditionally call wait() in its SIGCHLD signal handler to avoid being
-subject to a race condition.  This behavior is subject to change in future
-versions of libcurl.
-.IP CURLAUTH_ANY
-This is a convenience macro that sets all bits and thus makes libcurl pick any
-it finds suitable. libcurl automatically selects the one it finds most secure.
-.IP CURLAUTH_ANYSAFE
-This is a convenience macro that sets all bits except Basic and thus makes
-libcurl pick any it finds suitable. libcurl automatically selects the one it
-finds most secure.
-.IP CURLAUTH_ONLY
-This is a meta symbol. OR this value together with a single specific auth
-value to force libcurl to probe for unrestricted auth and if not, only that
-single auth algorithm is acceptable.
-.IP CURLAUTH_AWS_SIGV4
-provides AWS V4 signature authentication on HTTPS header
-see \fICURLOPT_AWS_SIGV4(3)\fP.
-.SH DEFAULT
-CURLAUTH_BASIC
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  /* allow whatever auth the server speaks */
-  curl_easy_setopt(curl, CURLOPT_HTTPAUTH, (long)CURLAUTH_ANY);
-  curl_easy_setopt(curl, CURLOPT_USERPWD, "james:bond");
-  ret = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Option Added in 7.10.6.
-
-CURLAUTH_DIGEST_IE was added in 7.19.3
-
-CURLAUTH_ONLY was added in 7.21.3
-
-CURLAUTH_NTLM_WB was added in 7.22.0
-
-CURLAUTH_BEARER was added in 7.61.0
-
-CURLAUTH_AWS_SIGV4 was added in 7.74.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_NOT_BUILT_IN if the bitmask specified no supported authentication
-methods.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXYAUTH "(3), " CURLOPT_USERPWD "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPAUTH.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPAUTH.md
new file mode 100644
index 0000000000..692178c72e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPAUTH.md
@@ -0,0 +1,168 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HTTPAUTH
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+See-also:
+  - CURLOPT_PASSWORD (3)
+  - CURLOPT_PROXYAUTH (3)
+  - CURLOPT_USERNAME (3)
+Added-in: 7.10.6
+---
+
+# NAME
+
+CURLOPT_HTTPAUTH - HTTP server authentication methods to try
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTPAUTH, long bitmask);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter, which is set to a bitmask, to tell libcurl which
+authentication method(s) you want it to use speaking to the remote server.
+
+The available bits are listed below. If more than one bit is set, libcurl
+first queries the host to see which authentication methods it supports and
+then picks the best one you allow it to use. For some methods, this induces an
+extra network round-trip. Set the actual name and password with the
+CURLOPT_USERPWD(3) option or with the CURLOPT_USERNAME(3) and the
+CURLOPT_PASSWORD(3) options.
+
+For authentication with a proxy, see CURLOPT_PROXYAUTH(3).
+
+## CURLAUTH_BASIC
+
+HTTP Basic authentication. This is the default choice, and the only method
+that is in wide-spread use and supported virtually everywhere. This sends
+the username and password over the network in plain text, easily captured by
+others.
+
+## CURLAUTH_DIGEST
+
+HTTP Digest authentication. Digest authentication is defined in RFC 2617 and
+is a more secure way to do authentication over public networks than the
+regular old-fashioned Basic method.
+
+## CURLAUTH_DIGEST_IE
+
+The IE-specific Digest authentication behavior is no longer supported.
+This bit is kept for compatibility and is treated as CURLAUTH_DIGEST.
+
+## CURLAUTH_BEARER
+
+HTTP Bearer token authentication, used primarily in OAuth 2.0 protocol.
+
+You can set the Bearer token to use with CURLOPT_XOAUTH2_BEARER(3).
+
+## CURLAUTH_NEGOTIATE
+
+HTTP Negotiate (SPNEGO) authentication. Negotiate authentication is defined
+in RFC 4559 and is the most secure way to perform authentication over HTTP.
+
+You need to build libcurl with a suitable GSS-API library or SSPI on Windows
+for this to work.
+
+## CURLAUTH_NTLM
+
+HTTP NTLM authentication. A proprietary protocol invented and used by
+Microsoft. It uses a challenge-response and hash concept similar to Digest, to
+prevent the password from being eavesdropped.
+
+NTLM uses weak cryptographic algorithms and is not considered secure.
+
+## CURLAUTH_NTLM_WB
+
+Support for this is removed since libcurl 8.8.0.
+
+NTLM delegating to winbind helper. Authentication is performed by a separate
+binary application that is executed when needed. The name of the application
+is specified at compile time but is typically **/usr/bin/ntlm_auth**.
+
+Note that libcurl forks when necessary to run the winbind application and kill
+it when complete, calling **waitpid()** to await its exit when done. On POSIX
+operating systems, killing the process causes a SIGCHLD signal to be raised
+(regardless of whether CURLOPT_NOSIGNAL(3) is set), which must be handled
+intelligently by the application. In particular, the application must not
+unconditionally call wait() in its SIGCHLD signal handler to avoid being
+subject to a race condition. This behavior is subject to change in future
+versions of libcurl.
+
+## CURLAUTH_ANY
+
+This is a convenience macro that sets all bits and thus makes libcurl pick any
+it finds suitable. libcurl automatically selects the one it finds most secure.
+
+## CURLAUTH_ANYSAFE
+
+This is a convenience macro that sets all bits except Basic and thus makes
+libcurl pick any it finds suitable. libcurl automatically selects the one it
+finds most secure.
+
+## CURLAUTH_ONLY
+
+This is a meta symbol. OR this value together with a single specific auth
+value to force libcurl to probe for unrestricted auth and if not, only that
+single auth algorithm is acceptable.
+
+## CURLAUTH_AWS_SIGV4
+
+provides AWS V4 signature authentication on HTTPS header
+see CURLOPT_AWS_SIGV4(3).
+
+# DEFAULT
+
+CURLAUTH_BASIC
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* allow whatever auth the server speaks */
+    curl_easy_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_ANY);
+    curl_easy_setopt(curl, CURLOPT_USERPWD, "james:bond");
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+CURLAUTH_DIGEST_IE was added in 7.19.3
+
+CURLAUTH_ONLY was added in 7.21.3
+
+CURLAUTH_NTLM_WB was added in 7.22.0
+
+**CURLAUTH_*** macros became `long` types in 7.26.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+CURLAUTH_BEARER was added in 7.61.0
+
+CURLAUTH_AWS_SIGV4 was added in 7.74.0
+
+CURLAUTH_DIGEST_IE does nothing since 8.21.0
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPGET.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPGET.3
deleted file mode 100644
index 4d4a9106f6..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPGET.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HTTPGET 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_HTTPGET \- ask for an HTTP GET request
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTPGET, long useget);
-.fi
-.SH DESCRIPTION
-Pass a long. If \fIuseget\fP is 1, this forces the HTTP request to get back to
-using GET. Usable if a POST, HEAD, PUT, etc has been used previously using the
-same curl \fIhandle\fP.
-
-When setting \fICURLOPT_HTTPGET(3)\fP to 1, libcurl automatically sets
-\fICURLOPT_NOBODY(3)\fP to 0 and \fICURLOPT_UPLOAD(3)\fP to 0.
-
-Setting this option to zero has no effect. Applications need to explicitly
-select which HTTP request method to use, they cannot deselect a method. To
-reset a handle to default method, consider \fIcurl_easy_reset(3)\fP.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* use a GET to fetch this */
-  curl_easy_setopt(curl, CURLOPT_HTTPGET, 1L);
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Along with HTTP
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_NOBODY "(3), " CURLOPT_UPLOAD "(3), " CURLOPT_POST "(3), "
-.BR curl_easy_reset "(3) "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPGET.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPGET.md
new file mode 100644
index 0000000000..aba51f1465
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPGET.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HTTPGET
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+See-also:
+  - CURLOPT_NOBODY (3)
+  - CURLOPT_POST (3)
+  - CURLOPT_UPLOAD (3)
+  - curl_easy_reset (3)
+Added-in: 7.8.1
+---
+
+# NAME
+
+CURLOPT_HTTPGET - ask for an HTTP GET request
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTPGET, long useget);
+~~~
+
+# DESCRIPTION
+
+Pass a long. If *useget* is 1, this forces the HTTP request to get back to
+using GET. Usable if a POST, HEAD, PUT, etc has been used previously using the
+same curl *handle*.
+
+When setting CURLOPT_HTTPGET(3) to 1, libcurl automatically sets
+CURLOPT_NOBODY(3) to 0 and CURLOPT_UPLOAD(3) to 0.
+
+Setting this option to zero has no effect. Applications need to explicitly
+select which HTTP request method to use, they cannot deselect a method. To
+reset a handle to default method, consider curl_easy_reset(3).
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* use a GET to fetch this */
+    curl_easy_setopt(curl, CURLOPT_HTTPGET, 1L);
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPHEADER.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPHEADER.3
deleted file mode 100644
index baf6cb047c..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPHEADER.3
+++ /dev/null
@@ -1,162 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HTTPHEADER 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_HTTPHEADER \- set of HTTP headers
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTPHEADER,
-                          struct curl_slist *headers);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a linked list of HTTP headers to pass to the server and/or
-proxy in your HTTP request. The same list can be used for both host and proxy
-requests!
-
-When used within an IMAP or SMTP request to upload a MIME mail, the given
-header list establishes the document-level MIME headers to prepend to the
-uploaded document described by \fICURLOPT_MIMEPOST(3)\fP. This does not affect
-raw mail uploads.
-
-The linked list should be a fully valid list of \fBstruct curl_slist\fP
-structs properly filled in. Use \fIcurl_slist_append(3)\fP to create the list
-and \fIcurl_slist_free_all(3)\fP to clean up an entire list. If you add a
-header that is otherwise generated and used by libcurl internally, your added
-header is used instead. If you add a header with no content as in 'Accept:'
-(no data on the right side of the colon), the internally used header is
-disabled/removed. With this option you can add new headers, replace internal
-headers and remove internal headers. To add a header with no content (nothing
-to the right side of the colon), use the form 'name;' (note the ending
-semicolon).
-
-The headers included in the linked list \fBmust not\fP be CRLF-terminated,
-because libcurl adds CRLF after each header item itself. Failure to comply
-with this might result in strange behavior.
-
-The first line in an HTTP request (containing the method, usually a GET or
-POST) is not a header and cannot be replaced using this option. Only the lines
-following the request-line are headers. Adding this method line in this list
-of headers only causes your request to send an invalid header. Use
-\fICURLOPT_CUSTOMREQUEST(3)\fP to change the method.
-
-When this option is passed to \fIcurl_easy_setopt(3)\fP, libcurl does not copy
-the entire list so you \fBmust\fP keep it around until you no longer use this
-\fIhandle\fP for a transfer before you call \fIcurl_slist_free_all(3)\fP on
-the list.
-
-Pass a NULL to this option to reset back to no custom headers.
-
-The most commonly replaced HTTP headers have "shortcuts" in the options
-\fICURLOPT_COOKIE(3)\fP, \fICURLOPT_USERAGENT(3)\fP and
-\fICURLOPT_REFERER(3)\fP. We recommend using those.
-
-There is an alternative option that sets or replaces headers only for requests
-that are sent with CONNECT to a proxy: \fICURLOPT_PROXYHEADER(3)\fP. Use
-\fICURLOPT_HEADEROPT(3)\fP to control the behavior.
-.SH SPECIFIC HTTP HEADERS
-Setting some specific headers causes libcurl to act differently.
-.IP "Host:"
-The specified host name is used for cookie matching if the cookie engine is
-also enabled for this transfer. If the request is done over HTTP/2 or HTTP/3,
-the custom host name is instead used in the ":authority" header field and
-Host: is not sent at all over the wire.
-.IP "Transfer-Encoding: chunked"
-Tells libcurl the upload is to be done using this chunked encoding instead of
-providing the Content-Length: field in the request.
-.SH SPECIFIC MIME HEADERS
-When used to build a MIME e-mail for IMAP or SMTP, the following
-document-level headers can be set to override libcurl-generated values:
-.IP "Mime-Version:"
-Tells the parser at the receiving site how to interpret the MIME framing.
-It defaults to "1.0" and should normally not be altered.
-.IP "Content-Type:"
-Indicates the document's global structure type. By default, libcurl sets it
-to "multipart/mixed", describing a document made of independent parts. When a
-MIME mail is only composed of alternative representations of the same data
-(i.e.: HTML and plain text), this header must be set to "multipart/alternative".
-In all cases the value must be of the form "multipart/*" to respect the
-document structure and may not include the "boundary=" parameter.
-.P
-Other specific headers that do not have a libcurl default value but are
-strongly desired by mail delivery and user agents should also be included.
-These are "From:", "To:", "Date:" and "Subject:" among others and their
-presence and value is generally checked by anti-spam utilities.
-.SH SECURITY CONCERNS
-By default, this option makes libcurl send the given headers in all HTTP
-requests done by this handle. You should therefore use this option with
-caution if you for example connect to the remote site using a proxy and a
-CONNECT request, you should to consider if that proxy is supposed to also get
-the headers. They may be private or otherwise sensitive to leak.
-
-Use \fICURLOPT_HEADEROPT(3)\fP to make the headers only get sent to where you
-intend them to get sent.
-
-Custom headers are sent in all requests done by the easy handle, which implies
-that if you tell libcurl to follow redirects
-(\fICURLOPT_FOLLOWLOCATION(3)\fP), the same set of custom headers is sent in
-the subsequent request. Redirects can of course go to other hosts and thus
-those servers get all the contents of your custom headers too.
-
-Starting in 7.58.0, libcurl specifically prevents "Authorization:" headers
-from being sent to other hosts than the first used one, unless specifically
-permitted with the \fICURLOPT_UNRESTRICTED_AUTH(3)\fP option.
-
-Starting in 7.64.0, libcurl specifically prevents "Cookie:" headers from being
-sent to other hosts than the first used one, unless specifically permitted
-with the \fICURLOPT_UNRESTRICTED_AUTH(3)\fP option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP, IMAP and SMTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-
-struct curl_slist *list = NULL;
-
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  list = curl_slist_append(list, "Shoesize: 10");
-  list = curl_slist_append(list, "Accept:");
-
-  curl_easy_setopt(curl, CURLOPT_HTTPHEADER, list);
-
-  curl_easy_perform(curl);
-
-  curl_slist_free_all(list); /* free the list */
-}
-.fi
-
-.SH AVAILABILITY
-As long as HTTP is enabled. Use in MIME mail added in 7.56.0.
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_CUSTOMREQUEST "(3), " CURLOPT_HEADEROPT "(3), "
-.BR CURLOPT_PROXYHEADER "(3), " CURLOPT_HEADER "(3), "
-.BR CURLOPT_MIMEPOST "(3), " curl_mime_init "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPHEADER.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPHEADER.md
new file mode 100644
index 0000000000..2c9ed039c7
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPHEADER.md
@@ -0,0 +1,205 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HTTPHEADER
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+  - SMTP
+  - IMAP
+See-also:
+  - CURLOPT_CUSTOMREQUEST (3)
+  - CURLOPT_HEADER (3)
+  - CURLOPT_HEADEROPT (3)
+  - CURLOPT_MIMEPOST (3)
+  - CURLOPT_PROXYHEADER (3)
+  - curl_mime_init (3)
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_HTTPHEADER - set of HTTP headers
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTPHEADER,
+                          struct curl_slist *headers);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a linked list of HTTP headers to pass to the server and/or
+proxy in your HTTP request. The same list can be used for both host and proxy
+requests.
+
+When used within an IMAP or SMTP request to upload a MIME mail, the given
+header list establishes the document-level MIME headers to prepend to the
+uploaded document described by CURLOPT_MIMEPOST(3). This does not affect raw
+mail uploads.
+
+When used with HTTP, this option can add new headers, replace internal headers
+and remove internal headers.
+
+The linked list should be a valid list of **struct curl_slist** entries
+properly filled in. Use curl_slist_append(3) to create the list and
+curl_slist_free_all(3) to free it again after use.
+
+If you provide a header that is otherwise generated and used by libcurl
+internally, your header alternative is used instead. If you provide a header
+without content (no data on the right side of the colon) as in `Accept:`, the
+internally used header is removed. To forcibly add a header without content
+(nothing after the colon), use the form `name;` (using a trailing semicolon).
+
+There are exceptions when suppressing headers. The `Connection:` header in
+HTTP/1.1 cannot be overridden. You can provide values for it, but should a
+request require specific ones, they are always added to your own.
+
+The headers included in the linked list **must not** be CRLF-terminated, since
+libcurl adds CRLF after each header item itself. Failure to comply with this
+might result in strange behavior. libcurl passes on the verbatim strings you
+give it, without any filter or other safe guards. That includes white space
+and control characters.
+
+The first line in an HTTP request (containing the method, usually a GET or
+POST) is not a header and cannot be replaced using this option. Only the lines
+following the request-line are headers. Adding this method line in this list
+of headers only causes your request to send an invalid header. Use
+CURLOPT_CUSTOMREQUEST(3) to change the method.
+
+When this option is passed to curl_easy_setopt(3), libcurl does not copy the
+entire list so you **must** keep it around until you no longer use this
+*handle* for a transfer before you call curl_slist_free_all(3) on the list.
+
+Using this option multiple times makes the last set list override the previous
+ones. Set it to NULL to disable its use again.
+
+The most commonly replaced HTTP headers have "shortcuts" in the options
+CURLOPT_COOKIE(3), CURLOPT_USERAGENT(3) and CURLOPT_REFERER(3). We recommend
+using those.
+
+There is an alternative option that sets or replaces headers only for requests
+that are sent with CONNECT to a proxy: CURLOPT_PROXYHEADER(3). Use
+CURLOPT_HEADEROPT(3) to control the behavior.
+
+# SPECIFIC HTTP HEADERS
+
+Setting some specific headers causes libcurl to act differently.
+
+## Host:
+
+The specified hostname is used for cookie matching if the cookie engine is
+also enabled for this transfer. If the request is done over HTTP/2 or HTTP/3,
+the custom hostname is instead used in the ":authority" header field and
+Host: is not sent at all over the wire.
+
+## Transfer-Encoding: chunked
+
+Tells libcurl the upload is to be done using this chunked encoding instead of
+providing the Content-Length: field in the request.
+
+# SPECIFIC MIME HEADERS
+
+When used to build a MIME email for IMAP or SMTP, the following document-level
+headers can be set to override libcurl-generated values:
+
+## Mime-Version:
+
+Tells the parser at the receiving site how to interpret the MIME framing.
+It defaults to "1.0" and should normally not be altered.
+
+## Content-Type:
+
+Indicates the document's global structure type. By default, libcurl sets it
+to "multipart/mixed", describing a document made of independent parts. When a
+MIME mail is only composed of alternative representations of the same data
+(i.e.: HTML and plain text), this header must be set to "multipart/alternative".
+In all cases the value must be of the form "multipart/*" to respect the
+document structure and may not include the "boundary=" parameter.
+
+##
+
+Other specific headers that do not have a libcurl default value but are
+strongly desired by mail delivery and user agents should also be included.
+These are `From:`, `To:`, `Date:` and `Subject:` among others and their
+presence and value is generally checked by anti-spam utilities.
+
+# SECURITY CONCERNS
+
+By default, this option makes libcurl send the given headers in all HTTP
+requests done by this handle. You should therefore use this option with
+caution if you for example connect to the remote site using a proxy and a
+CONNECT request, you should to consider if that proxy is supposed to also get
+the headers. They may be private or otherwise sensitive to leak.
+
+Use CURLOPT_HEADEROPT(3) to make the headers only get sent to where you
+intend them to get sent.
+
+Custom headers are sent in all requests done by the easy handle, which implies
+that if you tell libcurl to follow redirects
+(CURLOPT_FOLLOWLOCATION(3)), the same set of custom headers is sent in
+the subsequent request. Redirects can of course go to other hosts and thus
+those servers get all the contents of your custom headers too.
+
+Starting in 7.58.0, libcurl specifically prevents "Authorization:" headers
+from being sent to other hosts than the first used one, unless specifically
+permitted with the CURLOPT_UNRESTRICTED_AUTH(3) option.
+
+Starting in 7.64.0, libcurl specifically prevents "Cookie:" headers from being
+sent to other hosts than the first used one, unless specifically permitted
+with the CURLOPT_UNRESTRICTED_AUTH(3) option.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+
+  struct curl_slist *list = NULL;
+
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* add this header */
+    list = curl_slist_append(list, "Shoesize: 10");
+
+    /* remove this header */
+    list = curl_slist_append(list, "Accept:");
+
+    /* change this header */
+    list = curl_slist_append(list, "Host: example.net");
+
+    curl_easy_setopt(curl, CURLOPT_HTTPHEADER, list);
+
+    result = curl_easy_perform(curl);
+
+    curl_slist_free_all(list); /* free the list */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+Use for MIME mail added in 7.56.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPPOST.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPPOST.3
deleted file mode 100644
index c064b2c426..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPPOST.3
+++ /dev/null
@@ -1,83 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HTTPPOST 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_HTTPPOST \- multipart formpost content
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTPPOST,
-                          struct curl_httppost *formpost);
-.SH DESCRIPTION
-\fBThis option is deprecated.\fP Use \fICURLOPT_MIMEPOST(3)\fP instead.
-
-Tells libcurl you want a \fBmultipart/formdata\fP HTTP POST to be made and you
-instruct what data to pass on to the server in the \fIformpost\fP argument.
-Pass a pointer to a linked list of \fIcurl_httppost\fP structs as parameter.
-The easiest way to create such a list, is to use \fIcurl_formadd(3)\fP as
-documented. The data in this list must remain intact as long as the curl
-transfer is alive and is using it.
-
-Using POST with HTTP 1.1 implies the use of a "Expect: 100-continue" header.
-You can disable this header with \fICURLOPT_HTTPHEADER(3)\fP.
-
-When setting \fICURLOPT_HTTPPOST(3)\fP, libcurl automatically sets
-\fICURLOPT_NOBODY(3)\fP to 0.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-/* Fill in the file upload field. This makes libcurl load data from
-   the given file name when curl_easy_perform() is called. */
-curl_formadd(&formpost,
-             &lastptr,
-             CURLFORM_COPYNAME, "sendfile",
-             CURLFORM_FILE, "postit2.c",
-             CURLFORM_END);
-
-/* Fill in the filename field */
-curl_formadd(&formpost,
-             &lastptr,
-             CURLFORM_COPYNAME, "filename",
-             CURLFORM_COPYCONTENTS, "postit2.c",
-             CURLFORM_END);
-
-/* Fill in the submit field too, even if this is rarely needed */
-curl_formadd(&formpost,
-             &lastptr,
-             CURLFORM_COPYNAME, "submit",
-             CURLFORM_COPYCONTENTS, "send",
-             CURLFORM_END);
-.fi
-.SH AVAILABILITY
-As long as HTTP is enabled. Deprecated in 7.56.0.
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is enabled, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_POSTFIELDS "(3), " CURLOPT_POST "(3), " CURLOPT_MIMEPOST "(3),"
-.BR curl_formadd "(3), " curl_formfree "(3), " curl_mime_init "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPPOST.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPPOST.md
new file mode 100644
index 0000000000..8ae91095e4
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPPOST.md
@@ -0,0 +1,107 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HTTPPOST
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+See-also:
+  - CURLOPT_MIMEPOST (3)
+  - CURLOPT_POST (3)
+  - CURLOPT_POSTFIELDS (3)
+  - curl_formadd (3)
+  - curl_formfree (3)
+  - curl_mime_init (3)
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_HTTPPOST - multipart formpost content
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTPPOST,
+                          struct curl_httppost *formpost);
+~~~
+
+# DESCRIPTION
+
+**This option is deprecated.** Use CURLOPT_MIMEPOST(3) instead.
+
+Tells libcurl you want a **multipart/formdata** HTTP POST to be made and you
+instruct what data to pass on to the server in the *formpost* argument.
+Pass a pointer to a linked list of *curl_httppost* structs as parameter.
+The easiest way to create such a list, is to use curl_formadd(3) as
+documented. The data in this list must remain intact as long as the curl
+transfer is alive and is using it.
+
+Using POST with HTTP 1.1 implies the use of a "Expect: 100-continue" header.
+You can disable this header with CURLOPT_HTTPHEADER(3).
+
+When setting CURLOPT_HTTPPOST(3), libcurl automatically sets
+CURLOPT_NOBODY(3) to 0.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  struct curl_httppost *formpost;
+  struct curl_httppost *lastptr;
+
+  /* Fill in the file upload field. This makes libcurl load data from
+     the given filename when curl_easy_perform() is called. */
+  curl_formadd(&formpost,
+               &lastptr,
+               CURLFORM_COPYNAME, "sendfile",
+               CURLFORM_FILE, "postit2.c",
+               CURLFORM_END);
+
+  /* Fill in the filename field */
+  curl_formadd(&formpost,
+               &lastptr,
+               CURLFORM_COPYNAME, "filename",
+               CURLFORM_COPYCONTENTS, "postit2.c",
+               CURLFORM_END);
+
+  /* Fill in the submit field too, even if this is rarely needed */
+  curl_formadd(&formpost,
+               &lastptr,
+               CURLFORM_COPYNAME, "submit",
+               CURLFORM_COPYCONTENTS, "send",
+               CURLFORM_END);
+
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_HTTPPOST, formpost);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+  curl_formfree(formpost);
+}
+~~~
+
+# DEPRECATED
+
+Deprecated in 7.56.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPPROXYTUNNEL.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPPROXYTUNNEL.3
deleted file mode 100644
index be9b514b77..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPPROXYTUNNEL.3
+++ /dev/null
@@ -1,72 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HTTPPROXYTUNNEL 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_HTTPPROXYTUNNEL \- tunnel through HTTP proxy
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTPPROXYTUNNEL, long tunnel);
-.fi
-.SH DESCRIPTION
-Set the \fBtunnel\fP parameter to 1L to make libcurl tunnel all operations
-through the HTTP proxy (set with \fICURLOPT_PROXY(3)\fP). There is a big
-difference between using a proxy and to tunnel through it.
-
-Tunneling means that an HTTP CONNECT request is sent to the proxy, asking it
-to connect to a remote host on a specific port number and then the traffic is
-just passed through the proxy. Proxies tend to white-list specific port numbers
-it allows CONNECT requests to and often only port 80 and 443 are allowed.
-
-To suppress proxy CONNECT response headers from user callbacks use
-\fICURLOPT_SUPPRESS_CONNECT_HEADERS(3)\fP.
-
-HTTP proxies can generally only speak HTTP (for obvious reasons), which makes
-libcurl convert non-HTTP requests to HTTP when using an HTTP proxy without
-this tunnel option set. For example, asking for an FTP URL and specifying an
-HTTP proxy makes libcurl send an FTP URL in an HTTP GET request to the
-proxy. By instead tunneling through the proxy, you avoid that conversion (that
-rarely works through the proxy anyway).
-.SH DEFAULT
-0
-.SH PROTOCOLS
-All network protocols
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/file.txt");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "http://127.0.0.1:80");
-  curl_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY "(3), " CURLOPT_PROXYTYPE "(3), " CURLOPT_PROXYPORT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPPROXYTUNNEL.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPPROXYTUNNEL.md
new file mode 100644
index 0000000000..4087ec40a6
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTPPROXYTUNNEL.md
@@ -0,0 +1,79 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HTTPPROXYTUNNEL
+Section: 3
+Source: libcurl
+Protocol:
+  - All
+See-also:
+  - CURLOPT_PROXY (3)
+  - CURLOPT_PROXYPORT (3)
+  - CURLOPT_PROXYTYPE (3)
+Added-in: 7.3
+---
+
+# NAME
+
+CURLOPT_HTTPPROXYTUNNEL - tunnel through HTTP proxy
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTPPROXYTUNNEL, long tunnel);
+~~~
+
+# DESCRIPTION
+
+Set the **tunnel** parameter to 1L to make libcurl tunnel all operations
+through the HTTP proxy (set with CURLOPT_PROXY(3)). There is a big
+difference between using a proxy and to tunnel through it.
+
+Tunneling means that an HTTP CONNECT request is sent to the proxy, asking it
+to connect to a remote host on a specific port number and then the traffic is
+passed through the proxy. Proxies tend to white-list specific port numbers it
+allows CONNECT requests to and often only port 80 and 443 are allowed.
+
+To suppress proxy CONNECT response headers from user callbacks use
+CURLOPT_SUPPRESS_CONNECT_HEADERS(3).
+
+HTTP proxies can generally only speak HTTP (for obvious reasons), which makes
+libcurl convert non-HTTP requests to HTTP when using an HTTP proxy without
+this tunnel option set. For example, asking for an FTP URL and specifying an
+HTTP proxy makes libcurl send an FTP URL in an HTTP GET request to the
+proxy. By instead tunneling through the proxy, you avoid that conversion (that
+rarely works through the proxy anyway).
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/file.txt");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "http://127.0.0.1:80");
+    curl_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_CONTENT_DECODING.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_CONTENT_DECODING.3
deleted file mode 100644
index 61e3efef4f..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_CONTENT_DECODING.3
+++ /dev/null
@@ -1,59 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HTTP_CONTENT_DECODING 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_HTTP_CONTENT_DECODING \- HTTP content decoding control
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTP_CONTENT_DECODING,
-                          long enabled);
-.SH DESCRIPTION
-Pass a long to tell libcurl how to act on content decoding. If set to zero,
-content decoding is disabled. If set to 1 it is enabled. Libcurl has no
-default content decoding but requires you to use
-\fICURLOPT_ACCEPT_ENCODING(3)\fP for that.
-.SH DEFAULT
-1
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_HTTP_CONTENT_DECODING, 0L);
-  ret = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.16.2
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_STDERR "(3), " CURLOPT_DEBUGFUNCTION "(3), "
-.BR CURLOPT_ACCEPT_ENCODING "(3) "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_CONTENT_DECODING.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_CONTENT_DECODING.md
new file mode 100644
index 0000000000..f56e55f184
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_CONTENT_DECODING.md
@@ -0,0 +1,64 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HTTP_CONTENT_DECODING
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+See-also:
+  - CURLOPT_ACCEPT_ENCODING (3)
+  - CURLOPT_DEBUGFUNCTION (3)
+  - CURLOPT_STDERR (3)
+Added-in: 7.16.2
+---
+
+# NAME
+
+CURLOPT_HTTP_CONTENT_DECODING - HTTP content decoding control
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTP_CONTENT_DECODING,
+                          long enabled);
+~~~
+
+# DESCRIPTION
+
+Pass a long to tell libcurl how to act on content decoding. If set to zero,
+content decoding is disabled. If set to 1 it is enabled. libcurl has no
+default content decoding but requires you to use
+CURLOPT_ACCEPT_ENCODING(3) for that.
+
+# DEFAULT
+
+1
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_HTTP_CONTENT_DECODING, 0L);
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_TRANSFER_DECODING.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_TRANSFER_DECODING.3
deleted file mode 100644
index e1a7a335e2..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_TRANSFER_DECODING.3
+++ /dev/null
@@ -1,58 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HTTP_TRANSFER_DECODING 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_HTTP_TRANSFER_DECODING \- HTTP transfer decoding control
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTP_TRANSFER_DECODING,
-                         long enabled);
-.SH DESCRIPTION
-Pass a long to tell libcurl how to act on transfer decoding. If set to zero,
-transfer decoding is disabled, if set to 1 it is enabled (default). libcurl
-does chunked transfer decoding by default unless this option is set to zero.
-.SH DEFAULT
-1
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_HTTP_TRANSFER_DECODING, 0L);
-  ret = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.16.2 Does not work with the hyper backend (it always has transfer
-decoding enabled).
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_HTTP_CONTENT_DECODING "(3), " CURLOPT_ACCEPT_ENCODING "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_TRANSFER_DECODING.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_TRANSFER_DECODING.md
new file mode 100644
index 0000000000..15444a2e96
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_TRANSFER_DECODING.md
@@ -0,0 +1,62 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HTTP_TRANSFER_DECODING
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+See-also:
+  - CURLOPT_ACCEPT_ENCODING (3)
+  - CURLOPT_HTTP_CONTENT_DECODING (3)
+Added-in: 7.16.2
+---
+
+# NAME
+
+CURLOPT_HTTP_TRANSFER_DECODING - HTTP transfer decoding control
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTP_TRANSFER_DECODING,
+                         long enabled);
+~~~
+
+# DESCRIPTION
+
+Pass a long to tell libcurl how to act on transfer decoding. If set to zero,
+transfer decoding is disabled, if set to 1 it is enabled (default). libcurl
+does chunked transfer decoding by default unless this option is set to zero.
+
+# DEFAULT
+
+1
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_HTTP_TRANSFER_DECODING, 0L);
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_VERSION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_VERSION.3
deleted file mode 100644
index c8b0ce44f8..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_VERSION.3
+++ /dev/null
@@ -1,101 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_HTTP_VERSION 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_HTTP_VERSION \- HTTP protocol version to use
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTP_VERSION, long version);
-.fi
-.SH DESCRIPTION
-Pass \fIversion\fP a long, set to one of the values described below. They ask
-libcurl to use the specific HTTP versions.
-
-Note that the HTTP version is just a request. libcurl still prioritizes to
-reuse existing connections so it might then reuse a connection using a HTTP
-version you have not asked for.
-
-.IP CURL_HTTP_VERSION_NONE
-We do not care about what version the library uses. libcurl uses whatever it
-thinks fit.
-.IP CURL_HTTP_VERSION_1_0
-Enforce HTTP 1.0 requests.
-.IP CURL_HTTP_VERSION_1_1
-Enforce HTTP 1.1 requests.
-.IP CURL_HTTP_VERSION_2_0
-Attempt HTTP 2 requests. libcurl falls back to HTTP 1.1 if HTTP 2 cannot be
-negotiated with the server. (Added in 7.33.0)
-
-When libcurl uses HTTP/2 over HTTPS, it does not itself insist on TLS 1.2 or
-higher even though that is required by the specification. A user can add this
-version requirement with \fICURLOPT_SSLVERSION(3)\fP.
-
-The alias \fICURL_HTTP_VERSION_2\fP was added in 7.43.0 to better reflect the
-actual protocol name.
-.IP CURL_HTTP_VERSION_2TLS
-Attempt HTTP 2 over TLS (HTTPS) only. libcurl falls back to HTTP 1.1 if HTTP 2
-cannot be negotiated with the HTTPS server. For clear text HTTP servers,
-libcurl uses 1.1. (Added in 7.47.0)
-.IP CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE
-Issue non-TLS HTTP requests using HTTP/2 without HTTP/1.1 Upgrade. It requires
-prior knowledge that the server supports HTTP/2 straight away. HTTPS requests
-still do HTTP/2 the standard way with negotiated protocol version in the TLS
-handshake. (Added in 7.49.0)
-.IP CURL_HTTP_VERSION_3
-(Added in 7.66.0) This option makes libcurl attempt to use HTTP/3 to the host
-given in the URL, with fallback to earlier HTTP versions if needed.
-.IP CURL_HTTP_VERSION_3ONLY
-(Added in 7.88.0) Setting this makes libcurl attempt to use HTTP/3 directly to
-server given in the URL and does not downgrade to earlier HTTP version if the
-server does not support HTTP/3.
-.SH DEFAULT
-Since curl 7.62.0: CURL_HTTP_VERSION_2TLS
-
-Before that: CURL_HTTP_VERSION_1_1
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_HTTP_VERSION,
-                   (long)CURL_HTTP_VERSION_2TLS);
-  ret = curl_easy_perform(curl);
-  if(ret == CURLE_HTTP_RETURNED_ERROR) {
-    /* an HTTP response error problem */
-  }
-}
-.fi
-.SH AVAILABILITY
-Along with HTTP
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_SSLVERSION "(3), " CURLOPT_HTTP200ALIASES "(3), "
-.BR CURLOPT_HTTP09_ALLOWED "(3), " CURLOPT_ALTSVC "(3) "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_VERSION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_VERSION.md
new file mode 100644
index 0000000000..f865955d48
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_HTTP_VERSION.md
@@ -0,0 +1,131 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_HTTP_VERSION
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+See-also:
+  - CURLOPT_ALTSVC (3)
+  - CURLOPT_HTTP09_ALLOWED (3)
+  - CURLOPT_HTTP200ALIASES (3)
+  - CURLOPT_SSLVERSION (3)
+Added-in: 7.9.1
+---
+
+# NAME
+
+CURLOPT_HTTP_VERSION - HTTP protocol version to use
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTP_VERSION, long version);
+~~~
+
+# DESCRIPTION
+
+Pass *version* a long, set to one of the values described below. They ask
+libcurl to use the specific HTTP versions.
+
+Note that the HTTP version is a request. libcurl still prioritizes to reuse
+existing connections so it might then reuse a connection using an HTTP version
+you have not asked for.
+
+## CURL_HTTP_VERSION_NONE
+
+We do not care about what version the library uses. libcurl uses whatever it
+thinks fit.
+
+## CURL_HTTP_VERSION_1_0
+
+Enforce HTTP 1.0 requests.
+
+## CURL_HTTP_VERSION_1_1
+
+Enforce HTTP 1.1 requests.
+
+## CURL_HTTP_VERSION_2_0
+
+Attempt HTTP 2 requests. libcurl falls back to HTTP 1.1 if HTTP 2 cannot be
+negotiated with the server.
+
+When libcurl uses HTTP/2 over HTTPS, it does not itself insist on TLS 1.2 or
+higher even though that is required by the specification. A user can add this
+version requirement with CURLOPT_SSLVERSION(3).
+
+The alias *CURL_HTTP_VERSION_2* was added to better reflect the actual
+protocol name.
+
+## CURL_HTTP_VERSION_2TLS
+
+Attempt HTTP 2 over TLS (HTTPS) only. libcurl falls back to HTTP 1.1 if HTTP 2
+cannot be negotiated with the HTTPS server. For clear text HTTP servers,
+libcurl uses 1.1.
+
+## CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE
+
+Issue non-TLS HTTP requests using HTTP/2 without HTTP/1.1 Upgrade. It requires
+prior knowledge that the server supports HTTP/2 straight away. HTTPS requests
+still do HTTP/2 the standard way with negotiated protocol version in the TLS
+handshake.
+
+Since 8.10.0 if this option is set for an HTTPS request then the application
+layer protocol version (ALPN) offered to the server is only HTTP/2. Prior to
+that both HTTP/1.1 and HTTP/2 were offered.
+
+## CURL_HTTP_VERSION_3
+
+(Added in 7.66.0) This option makes libcurl attempt to use HTTP/3 to the host
+given in the URL, with fallback to earlier HTTP versions if needed.
+
+## CURL_HTTP_VERSION_3ONLY
+
+(Added in 7.88.0) Setting this makes libcurl attempt to use HTTP/3 directly to
+server given in the URL and does not downgrade to earlier HTTP version if the
+server does not support HTTP/3.
+
+# DEFAULT
+
+Since curl 8.13.0: CURL_HTTP_VERSION_NONE
+
+Since curl 7.62.0: CURL_HTTP_VERSION_2TLS
+
+Before that: CURL_HTTP_VERSION_1_1
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2TLS);
+    result = curl_easy_perform(curl);
+    if(result == CURLE_HTTP_RETURNED_ERROR) {
+      /* an HTTP response error problem */
+    }
+  }
+}
+~~~
+
+# HISTORY
+
+**CURL_HTTP_VERSION_*** enums became `long` types in 8.13.0, prior to this
+version a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_IGNORE_CONTENT_LENGTH.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_IGNORE_CONTENT_LENGTH.3
deleted file mode 100644
index 61c844c5a2..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_IGNORE_CONTENT_LENGTH.3
+++ /dev/null
@@ -1,70 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_IGNORE_CONTENT_LENGTH 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_IGNORE_CONTENT_LENGTH \- ignore content length
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_IGNORE_CONTENT_LENGTH,
-                          long ignore);
-.SH DESCRIPTION
-If \fIignore\fP is set to 1L, ignore the Content-Length header in the HTTP
-response and ignore asking for or relying on it for FTP transfers.
-
-This is useful for doing HTTP transfers with ancient web servers which report
-incorrect content length for files over 2 gigabytes. If this option is used,
-curl cannot accurately report progress, and it instead stops the download when
-the server ends the connection.
-
-It is also useful with FTP when for example the file is growing while the
-transfer is in progress which otherwise unconditionally causes libcurl to
-report error.
-
-Only use this option if strictly necessary.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* we know the server is silly, ignore content-length */
-  curl_easy_setopt(curl, CURLOPT_IGNORE_CONTENT_LENGTH, 1L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.14.1. Support for FTP added in 7.46.0. This option is not working
-for HTTP when libcurl is built to use the hyper backend.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_HTTP_VERSION "(3), " CURLOPT_MAXFILESIZE_LARGE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_IGNORE_CONTENT_LENGTH.md b/third-party/curl/docs/libcurl/opts/CURLOPT_IGNORE_CONTENT_LENGTH.md
new file mode 100644
index 0000000000..c199ee3f37
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_IGNORE_CONTENT_LENGTH.md
@@ -0,0 +1,81 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_IGNORE_CONTENT_LENGTH
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+  - FTP
+See-also:
+  - CURLOPT_HTTP_VERSION (3)
+  - CURLOPT_MAXFILESIZE_LARGE (3)
+Added-in: 7.14.1
+---
+
+# NAME
+
+CURLOPT_IGNORE_CONTENT_LENGTH - ignore content length
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_IGNORE_CONTENT_LENGTH,
+                          long ignore);
+~~~
+
+# DESCRIPTION
+
+If *ignore* is set to 1L, ignore the Content-Length header in the HTTP
+response and ignore asking for or relying on it for FTP transfers.
+
+This is useful for doing HTTP transfers with ancient web servers which report
+incorrect content length for files over 2 gigabytes. If this option is used,
+curl cannot accurately report progress, and it instead stops the download when
+the server ends the connection.
+
+It is also useful with FTP when for example the file is growing while the
+transfer is in progress which otherwise unconditionally causes libcurl to
+report error.
+
+Only use this option if strictly necessary.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* we know the server is silly, ignore content-length */
+    curl_easy_setopt(curl, CURLOPT_IGNORE_CONTENT_LENGTH, 1L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+Support for FTP added in 7.46.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_INFILESIZE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_INFILESIZE.3
deleted file mode 100644
index c3cb8497f5..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_INFILESIZE.3
+++ /dev/null
@@ -1,78 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_INFILESIZE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_INFILESIZE \- size of the input file to send off
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_INFILESIZE, long filesize);
-.fi
-.SH DESCRIPTION
-When uploading a file to a remote site, \fIfilesize\fP should be used to tell
-libcurl what the expected size of the input file is. This value must be passed
-as a long. See also \fICURLOPT_INFILESIZE_LARGE(3)\fP for sending files larger
-than 2GB.
-
-For uploading using SCP, this option or \fICURLOPT_INFILESIZE_LARGE(3)\fP is
-mandatory.
-
-To unset this value again, set it to -1.
-
-Using \fICURLOPT_UPLOAD(3)\fP to a HTTP/1.1 server and this value set to -1,
-makes libcurl do a chunked transfer-encoded upload.
-
-When sending emails using SMTP, this command can be used to specify the
-optional SIZE parameter for the MAIL FROM command.
-
-This option does not limit how much data libcurl actually sends, as that is
-controlled entirely by what the read callback returns, but telling one value
-and sending a different amount may lead to errors.
-.SH DEFAULT
-Unset
-.SH PROTOCOLS
-Many
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  long uploadsize = FILE_SIZE;
-
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/destination.tar.gz");
-
-  curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
-
-  curl_easy_setopt(curl, CURLOPT_INFILESIZE, uploadsize);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-SMTP support added in 7.23.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_INFILESIZE_LARGE "(3), " CURLOPT_UPLOAD "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_INFILESIZE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_INFILESIZE.md
new file mode 100644
index 0000000000..87e12f3dcb
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_INFILESIZE.md
@@ -0,0 +1,93 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_INFILESIZE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CONTENT_LENGTH_UPLOAD_T (3)
+  - CURLOPT_INFILESIZE_LARGE (3)
+  - CURLOPT_UPLOAD (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_INFILESIZE - size of the input file to send off
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_INFILESIZE, long filesize);
+~~~
+
+# DESCRIPTION
+
+When uploading a file to a remote site, *filesize* should be used to tell
+libcurl what the expected size of the input file is. This value must be passed
+as a long. See also CURLOPT_INFILESIZE_LARGE(3) for sending files larger
+than 2GB.
+
+For uploading using SCP, this option or CURLOPT_INFILESIZE_LARGE(3) is
+mandatory.
+
+To unset this value again, set it to -1.
+
+Using CURLOPT_UPLOAD(3) to an HTTP/1.1 server and this value set to -1, makes
+libcurl do a chunked transfer-encoded upload.
+
+When sending emails using SMTP, this command can be used to specify the
+optional SIZE parameter for the MAIL FROM command.
+
+This option does not limit how much data libcurl actually sends, as that is
+controlled entirely by what the read callback returns, but telling one value
+and sending a different amount may lead to errors.
+
+# DEFAULT
+
+Unset
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+
+#define FILE_SIZE 12345L
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    long uploadsize = FILE_SIZE;
+
+    curl_easy_setopt(curl, CURLOPT_URL,
+                     "ftp://example.com/destination.tar.gz");
+
+    curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+
+    curl_easy_setopt(curl, CURLOPT_INFILESIZE, uploadsize);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+SMTP support added in 7.23.0
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_INFILESIZE_LARGE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_INFILESIZE_LARGE.3
deleted file mode 100644
index badb337022..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_INFILESIZE_LARGE.3
+++ /dev/null
@@ -1,74 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_INFILESIZE_LARGE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_INFILESIZE_LARGE \- size of the input file to send off
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_INFILESIZE_LARGE,
-                          curl_off_t filesize);
-.SH DESCRIPTION
-When uploading a file to a remote site, \fIfilesize\fP should be used to tell
-libcurl what the expected size of the input file is. This value must be passed
-as a \fBcurl_off_t\fP.
-
-For uploading using SCP, this option or \fICURLOPT_INFILESIZE(3)\fP is
-mandatory.
-
-To unset this value again, set it to -1.
-
-When sending emails using SMTP, this command can be used to specify the
-optional SIZE parameter for the MAIL FROM command.
-
-This option does not limit how much data libcurl actually sends, as that is
-controlled entirely by what the read callback returns, but telling one value
-and sending a different amount may lead to errors.
-.SH DEFAULT
-Unset
-.SH PROTOCOLS
-Many
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_off_t uploadsize = FILE_SIZE;
-
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/destination.tar.gz");
-
-  curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
-
-  curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, uploadsize);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-SMTP support added in 7.23.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_INFILESIZE "(3), " CURLOPT_UPLOAD "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_INFILESIZE_LARGE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_INFILESIZE_LARGE.md
new file mode 100644
index 0000000000..7e00499182
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_INFILESIZE_LARGE.md
@@ -0,0 +1,89 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_INFILESIZE_LARGE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CONTENT_LENGTH_UPLOAD_T (3)
+  - CURLOPT_INFILESIZE (3)
+  - CURLOPT_UPLOAD (3)
+Protocol:
+  - All
+Added-in: 7.11.0
+---
+
+# NAME
+
+CURLOPT_INFILESIZE_LARGE - size of the input file to send off
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_INFILESIZE_LARGE,
+                          curl_off_t filesize);
+~~~
+
+# DESCRIPTION
+
+When uploading a file to a remote site, *filesize* should be used to tell
+libcurl what the expected size of the input file is. This value must be passed
+as a **curl_off_t**.
+
+For uploading using SCP, this option or CURLOPT_INFILESIZE(3) is
+mandatory.
+
+To unset this value again, set it to -1.
+
+When sending emails using SMTP, this command can be used to specify the
+optional SIZE parameter for the MAIL FROM command.
+
+This option does not limit how much data libcurl actually sends, as that is
+controlled entirely by what the read callback returns, but telling one value
+and sending a different amount may lead to errors.
+
+# DEFAULT
+
+Unset
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#define FILE_SIZE 123456
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_off_t uploadsize = FILE_SIZE;
+
+    curl_easy_setopt(curl, CURLOPT_URL,
+                     "ftp://example.com/destination.tar.gz");
+
+    curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+
+    curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, uploadsize);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+SMTP support added in 7.23.0
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_INTERFACE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_INTERFACE.3
deleted file mode 100644
index 6997ede70d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_INTERFACE.3
+++ /dev/null
@@ -1,80 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_INTERFACE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_INTERFACE \- source interface for outgoing traffic
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_INTERFACE, char *interface);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter. This sets the \fIinterface\fP name to use as
-outgoing network interface. The name can be an interface name, an IP address,
-or a host name.
-
-If the parameter starts with "if!" then it is treated only as an interface
-name. If the parameter starts with \&"host!" it is treated as either an IP
-address or a hostname.
-
-If "if!" is specified but the parameter does not match an existing interface,
-\fICURLE_INTERFACE_FAILED\fP is returned from the libcurl function used to
-perform the transfer.
-
-libcurl does not support using network interface names for this option on
-Windows.
-
-We strongly advise against specifying the interface with a hostname, as it
-causes libcurl to do a blocking name resolve call to retrieve the IP
-address. That name resolve operation does \fBnot\fP use DNS-over-HTTPS even if
-\fICURLOPT_DOH_URL(3)\fP is set.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL, use whatever the TCP stack finds suitable
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-
-  curl_easy_setopt(curl, CURLOPT_INTERFACE, "eth0");
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-The "if!" and "host!" syntax was added in 7.24.0.
-.SH RETURN VALUE
-Returns CURLE_OK on success or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_SOCKOPTFUNCTION "(3), " CURLOPT_TCP_NODELAY "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_INTERFACE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_INTERFACE.md
new file mode 100644
index 0000000000..dc966aad19
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_INTERFACE.md
@@ -0,0 +1,95 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_INTERFACE
+Section: 3
+Source: libcurl
+Protocol:
+  - All
+See-also:
+  - CURLOPT_SOCKOPTFUNCTION (3)
+  - CURLOPT_TCP_NODELAY (3)
+  - CURLOPT_LOCALPORT (3)
+Added-in: 7.3
+---
+
+# NAME
+
+CURLOPT_INTERFACE - source interface for outgoing traffic
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_INTERFACE, char *interface);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter. This sets the *interface* name to use as
+outgoing network interface. The name can be an interface name, an IP address,
+or a hostname. If you prefer one of these, you can use the following special
+prefixes:
+
+* `if!\<name\>` - Interface name
+* `host!\<name\>` - IP address or hostname
+* `ifhost!\<interface\>!\<host\>` - Interface name and IP address or hostname
+
+If `if!` or `ifhost!` is specified but the parameter does not match an existing
+interface, *CURLE_INTERFACE_FAILED* is returned from the libcurl function used
+to perform the transfer.
+
+libcurl does not support using network interface names for this option on
+Windows.
+
+We strongly advise against specifying the interface with a hostname, as it
+causes libcurl to do a blocking name resolve call to retrieve the IP address.
+That name resolve operation does **not** use DNS-over-HTTPS even if
+CURLOPT_DOH_URL(3) is set.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL, use whatever the TCP stack finds suitable
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+
+    curl_easy_setopt(curl, CURLOPT_INTERFACE, "eth0");
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+The `if!` and `host!` syntax was added in 7.24.0.
+
+The `ifhost!` syntax was added in 8.9.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_INTERLEAVEDATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_INTERLEAVEDATA.3
deleted file mode 100644
index 962847fa0a..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_INTERLEAVEDATA.3
+++ /dev/null
@@ -1,62 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_INTERLEAVEDATA 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_INTERLEAVEDATA \- pointer passed to RTSP interleave callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_INTERLEAVEDATA, void *pointer);
-.fi
-.SH DESCRIPTION
-This is the userdata \fIpointer\fP that is passed to
-\fICURLOPT_INTERLEAVEFUNCTION(3)\fP when interleaved RTP data is received. If
-the interleave function callback is not set, this pointer is not used
-anywhere.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-RTSP
-.SH EXAMPLE
-.nf
-static size_t rtp_write(void *ptr, size_t size, size_t nmemb, void *user)
-{
-  struct local *l = (struct local *)user;
-  /* take care of the packet in 'ptr', then return... */
-  return size * nmemb;
-}
-{
-  struct local rtp_data;
-  curl_easy_setopt(curl, CURLOPT_INTERLEAVEFUNCTION, rtp_write);
-  curl_easy_setopt(curl, CURLOPT_INTERLEAVEDATA, &rtp_data);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.20.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_INTERLEAVEFUNCTION "(3), " CURLOPT_RTSP_REQUEST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_INTERLEAVEDATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_INTERLEAVEDATA.md
new file mode 100644
index 0000000000..b426b558bc
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_INTERLEAVEDATA.md
@@ -0,0 +1,76 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_INTERLEAVEDATA
+Section: 3
+Source: libcurl
+Protocol:
+  - RTSP
+See-also:
+  - CURLOPT_INTERLEAVEFUNCTION (3)
+  - CURLOPT_RTSP_REQUEST (3)
+Added-in: 7.20.0
+---
+
+# NAME
+
+CURLOPT_INTERLEAVEDATA - pointer passed to RTSP interleave callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_INTERLEAVEDATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+This is the userdata *pointer* that is passed to
+CURLOPT_INTERLEAVEFUNCTION(3) when interleaved RTP data is received. If
+the interleave function callback is not set, this pointer is not used
+anywhere.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct local {
+  void *custom;
+};
+static size_t rtp_write(void *ptr, size_t size, size_t nmemb, void *userp)
+{
+  struct local *l = userp;
+  printf("my pointer: %p\n", l->custom);
+  /* take care of the packet in 'ptr', then return... */
+  return size * nmemb;
+}
+
+int main(void)
+{
+  struct local rtp_data;
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_INTERLEAVEFUNCTION, rtp_write);
+    curl_easy_setopt(curl, CURLOPT_INTERLEAVEDATA, &rtp_data);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_INTERLEAVEFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_INTERLEAVEFUNCTION.3
deleted file mode 100644
index bb8fe73d6c..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_INTERLEAVEFUNCTION.3
+++ /dev/null
@@ -1,92 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_INTERLEAVEFUNCTION 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_INTERLEAVEFUNCTION \- callback for RTSP interleaved data
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-size_t interleave_callback(void *ptr, size_t size, size_t nmemb,
-                           void *userdata);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_INTERLEAVEFUNCTION,
-                          interleave_callback);
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-This callback function gets called by libcurl as soon as it has received
-interleaved RTP data. This function gets called for each $ block and therefore
-contains exactly one upper-layer protocol unit (e.g.  one RTP packet). Curl
-writes the interleaved header as well as the included data for each call. The
-first byte is always an ASCII dollar sign. The dollar sign is followed by a
-one byte channel identifier and then a 2 byte integer length in network byte
-order. See RFC 2326 Section 10.12 for more information on how RTP interleaving
-behaves. If unset or set to NULL, curl uses the default write function.
-
-Interleaved RTP poses some challenges for the client application. Since the
-stream data is sharing the RTSP control connection, it is critical to service
-the RTP in a timely fashion. If the RTP data is not handled quickly,
-subsequent response processing may become unreasonably delayed and the
-connection may close. The application may use \fICURL_RTSPREQ_RECEIVE\fP to
-service RTP data when no requests are desired. If the application makes a
-request, (e.g. \fICURL_RTSPREQ_PAUSE\fP) then the response handler processes
-any pending RTP data before marking the request as finished.
-
-The \fICURLOPT_INTERLEAVEDATA(3)\fP is passed in the \fIuserdata\fP argument in
-the callback.
-
-Your callback should return the number of bytes actually taken care of. If
-that amount differs from the amount passed to your callback function, it
-signals an error condition to the library. This causes the transfer to abort
-and the libcurl function used returns \fICURLE_WRITE_ERROR\fP.
-
-You can also abort the transfer by returning CURL_WRITEFUNC_ERROR. (7.87.0)
-.SH DEFAULT
-NULL, the interleave data is then passed to the regular write function:
-\fICURLOPT_WRITEFUNCTION(3)\fP.
-.SH PROTOCOLS
-RTSP
-.SH EXAMPLE
-.nf
-static size_t rtp_write(void *ptr, size_t size, size_t nmemb, void *user)
-{
-  struct local *l = (struct local *)user;
-  /* take care of the packet in 'ptr', then return... */
-  return size * nmemb;
-}
-{
-  struct local rtp_data;
-  curl_easy_setopt(curl, CURLOPT_INTERLEAVEFUNCTION, rtp_write);
-  curl_easy_setopt(curl, CURLOPT_INTERLEAVEDATA, &rtp_data);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.20.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_INTERLEAVEDATA "(3), " CURLOPT_RTSP_REQUEST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_INTERLEAVEFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_INTERLEAVEFUNCTION.md
new file mode 100644
index 0000000000..8cfe40406d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_INTERLEAVEFUNCTION.md
@@ -0,0 +1,104 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_INTERLEAVEFUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_INTERLEAVEDATA (3)
+  - CURLOPT_RTSP_REQUEST (3)
+Protocol:
+  - RTSP
+Added-in: 7.20.0
+---
+
+# NAME
+
+CURLOPT_INTERLEAVEFUNCTION - callback for RTSP interleaved data
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+size_t interleave_callback(void *ptr, size_t size, size_t nmemb,
+                           void *userdata);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_INTERLEAVEFUNCTION,
+                          interleave_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+This callback function gets called by libcurl as soon as it has received
+interleaved RTP data. This function gets called for each $ block and therefore
+contains exactly one upper-layer protocol unit (e.g. one RTP packet). curl
+writes the interleaved header as well as the included data for each call. The
+first byte is always an ASCII dollar sign. The dollar sign is followed by a
+one-byte channel identifier and then a 2-byte integer length in network byte
+order. See RFC 2326 Section 10.12 for more information on how RTP interleaving
+behaves. If unset or set to NULL, curl uses the default write function.
+
+Interleaved RTP poses some challenges for the client application. Since the
+stream data is sharing the RTSP control connection, it is critical to service
+the RTP in a timely fashion. If the RTP data is not handled quickly,
+subsequent response processing may become unreasonably delayed and the
+connection may close. The application may use *CURL_RTSPREQ_RECEIVE* to
+service RTP data when no requests are desired. If the application makes a
+request, (e.g. *CURL_RTSPREQ_PAUSE*) then the response handler processes
+any pending RTP data before marking the request as finished.
+
+The CURLOPT_INTERLEAVEDATA(3) is passed in the *userdata* argument in
+the callback.
+
+Your callback should return the number of bytes actually taken care of. If
+that amount differs from the amount passed to your callback function, it
+signals an error condition to the library. This causes the transfer to abort
+and the libcurl function used returns *CURLE_WRITE_ERROR*.
+
+You can also abort the transfer by returning CURL_WRITEFUNC_ERROR. (7.87.0)
+
+# DEFAULT
+
+NULL, the interleave data is then passed to the regular write function:
+CURLOPT_WRITEFUNCTION(3).
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct local {
+  void *custom;
+};
+
+static size_t rtp_write(void *ptr, size_t size, size_t nmemb, void *userp)
+{
+  struct local *l = userp;
+  printf("our ptr: %p\n", l->custom);
+  /* take care of the packet in 'ptr', then return... */
+  return size * nmemb;
+}
+
+int main(void)
+{
+  struct local rtp_data;
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_INTERLEAVEFUNCTION, rtp_write);
+    curl_easy_setopt(curl, CURLOPT_INTERLEAVEDATA, &rtp_data);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_IOCTLDATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_IOCTLDATA.3
deleted file mode 100644
index 190f4d5826..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_IOCTLDATA.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_IOCTLDATA 3 "16 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_IOCTLDATA \- pointer passed to I/O callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_IOCTLDATA, void *pointer);
-.fi
-.SH DESCRIPTION
-Pass the \fIpointer\fP that is untouched by libcurl and passed as the 3rd
-argument in the ioctl callback set with \fICURLOPT_IOCTLFUNCTION(3)\fP.
-.SH DEFAULT
-By default, the value of this parameter is NULL.
-.SH PROTOCOLS
-Used with HTTP
-.SH EXAMPLE
-.nf
-static curlioerr ioctl_callback(CURL *handle, int cmd, void *clientp)
-{
-  struct data *io = (struct data *)clientp;
-  if(cmd == CURLIOCMD_RESTARTREAD) {
-    lseek(fd, 0, SEEK_SET);
-    current_offset = 0;
-    return CURLIOE_OK;
-  }
-  return CURLIOE_UNKNOWNCMD;
-}
-{
-  struct data ioctl_data;
-  curl_easy_setopt(curl, CURLOPT_IOCTLFUNCTION, ioctl_callback);
-  curl_easy_setopt(curl, CURLOPT_IOCTLDATA, &ioctl_data);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.12.3. Deprecated since 7.18.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_IOCTLFUNCTION "(3), " CURLOPT_SEEKFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_IOCTLDATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_IOCTLDATA.md
new file mode 100644
index 0000000000..18175eecf6
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_IOCTLDATA.md
@@ -0,0 +1,78 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_IOCTLDATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_IOCTLFUNCTION (3)
+  - CURLOPT_SEEKFUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.12.3
+---
+
+# NAME
+
+CURLOPT_IOCTLDATA - pointer passed to I/O callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_IOCTLDATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+Pass the *pointer* that is untouched by libcurl and passed as the 3rd
+argument in the ioctl callback set with CURLOPT_IOCTLFUNCTION(3).
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <unistd.h> /* for lseek */
+
+struct data {
+  int fd; /* our file descriptor */
+};
+
+static curlioerr ioctl_callback(CURL *handle, int cmd, void *clientp)
+{
+  struct data *io = (struct data *)clientp;
+  if(cmd == CURLIOCMD_RESTARTREAD) {
+    lseek(io->fd, 0, SEEK_SET);
+    return CURLIOE_OK;
+  }
+  return CURLIOE_UNKNOWNCMD;
+}
+int main(void)
+{
+  struct data ioctl_data;
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_IOCTLFUNCTION, ioctl_callback);
+    curl_easy_setopt(curl, CURLOPT_IOCTLDATA, &ioctl_data);
+  }
+}
+~~~
+
+# DEPRECATED
+
+Deprecated since 7.18.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_IOCTLFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_IOCTLFUNCTION.3
deleted file mode 100644
index b933ab8781..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_IOCTLFUNCTION.3
+++ /dev/null
@@ -1,94 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_IOCTLFUNCTION 3 "16 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_IOCTLFUNCTION \- callback for I/O operations
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-typedef enum {
-  CURLIOE_OK,            /* I/O operation successful */
-  CURLIOE_UNKNOWNCMD,    /* command was unknown to callback */
-  CURLIOE_FAILRESTART,   /* failed to restart the read */
-  CURLIOE_LAST           /* never use */
-} curlioerr;
-
-typedef enum  {
-  CURLIOCMD_NOP,         /* no operation */
-  CURLIOCMD_RESTARTREAD, /* restart the read stream from start */
-  CURLIOCMD_LAST         /* never use */
-} curliocmd;
-
-curlioerr ioctl_callback(CURL *handle, int cmd, void *clientp);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_IOCTLFUNCTION, ioctl_callback);
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-This callback function gets called by libcurl when something special
-I/O-related needs to be done that the library cannot do by itself. For now,
-rewinding the read data stream is the only action it can request. The
-rewinding of the read data stream may be necessary when doing an HTTP PUT or
-POST with a multi-pass authentication method.
-
-The callback MUST return \fICURLIOE_UNKNOWNCMD\fP if the input \fIcmd\fP is
-not \fICURLIOCMD_RESTARTREAD\fP.
-
-The \fIclientp\fP argument to the callback is set with the
-\fICURLOPT_IOCTLDATA(3)\fP option.
-
-This option is deprecated! Do not use it. Use \fICURLOPT_SEEKFUNCTION(3)\fP
-instead to provide seeking! If \fICURLOPT_SEEKFUNCTION(3)\fP is set, this
-parameter is ignored when seeking.
-.SH DEFAULT
-By default, this parameter is set to NULL. Not used.
-.SH PROTOCOLS
-Used with HTTP
-.SH EXAMPLE
-.nf
-static curlioerr ioctl_callback(CURL *handle, int cmd, void *clientp)
-{
-  struct data *io = (struct data *)clientp;
-  if(cmd == CURLIOCMD_RESTARTREAD) {
-    lseek(fd, 0, SEEK_SET);
-    current_offset = 0;
-    return CURLIOE_OK;
-  }
-  return CURLIOE_UNKNOWNCMD;
-}
-{
-  struct data ioctl_data;
-  curl_easy_setopt(curl, CURLOPT_IOCTLFUNCTION, ioctl_callback);
-  curl_easy_setopt(curl, CURLOPT_IOCTLDATA, &ioctl_data);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.12.3. Deprecated since 7.18.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_IOCTLDATA "(3), " CURLOPT_SEEKFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_IOCTLFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_IOCTLFUNCTION.md
new file mode 100644
index 0000000000..939161bee0
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_IOCTLFUNCTION.md
@@ -0,0 +1,109 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_IOCTLFUNCTION
+Section: 3
+Source: libcurl
+Protocol:
+  - All
+See-also:
+  - CURLOPT_IOCTLDATA (3)
+  - CURLOPT_SEEKFUNCTION (3)
+Added-in: 7.12.3
+---
+
+# NAME
+
+CURLOPT_IOCTLFUNCTION - callback for I/O operations
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+typedef enum {
+  CURLIOE_OK,            /* I/O operation successful */
+  CURLIOE_UNKNOWNCMD,    /* command was unknown to callback */
+  CURLIOE_FAILRESTART,   /* failed to restart the read */
+  CURLIOE_LAST           /* never use */
+} curlioerr;
+
+typedef enum {
+  CURLIOCMD_NOP,         /* no operation */
+  CURLIOCMD_RESTARTREAD, /* restart the read stream from start */
+  CURLIOCMD_LAST         /* never use */
+} curliocmd;
+
+curlioerr ioctl_callback(CURL *handle, int cmd, void *clientp);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_IOCTLFUNCTION, ioctl_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+This callback function gets called by libcurl when something special
+I/O-related needs to be done that the library cannot do by itself. For now,
+rewinding the read data stream is the only action it can request. The
+rewinding of the read data stream may be necessary when doing an HTTP PUT or
+POST with a multi-pass authentication method.
+
+The callback **must** return *CURLIOE_UNKNOWNCMD* if the input *cmd* is not
+*CURLIOCMD_RESTARTREAD*.
+
+The *clientp* argument to the callback is set with the CURLOPT_IOCTLDATA(3)
+option.
+
+**This option is deprecated**. Do not use it. Use CURLOPT_SEEKFUNCTION(3)
+instead to provide seeking. If CURLOPT_SEEKFUNCTION(3) is set, this parameter
+is ignored when seeking.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <unistd.h> /* for lseek */
+
+struct data {
+  int fd; /* our file descriptor */
+};
+
+static curlioerr ioctl_callback(CURL *handle, int cmd, void *clientp)
+{
+  struct data *io = (struct data *)clientp;
+  if(cmd == CURLIOCMD_RESTARTREAD) {
+    lseek(io->fd, 0, SEEK_SET);
+    return CURLIOE_OK;
+  }
+  return CURLIOE_UNKNOWNCMD;
+}
+int main(void)
+{
+  struct data ioctl_data;
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_IOCTLFUNCTION, ioctl_callback);
+    curl_easy_setopt(curl, CURLOPT_IOCTLDATA, &ioctl_data);
+  }
+}
+~~~
+
+# DEPRECATED
+
+Deprecated since 7.18.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_IPRESOLVE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_IPRESOLVE.3
deleted file mode 100644
index 38209f6b01..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_IPRESOLVE.3
+++ /dev/null
@@ -1,74 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_IPRESOLVE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_IPRESOLVE \- IP protocol version to use
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_IPRESOLVE, long resolve);
-.fi
-.SH DESCRIPTION
-Allows an application to select what kind of IP addresses to use when
-establishing a connection or choosing one from the connection pool. This is
-interesting when using host names that resolve to more than one IP family.
-
-If the URL provided for a transfer contains a numerical IP version as a host
-name, this option does not override or prohibit libcurl from using that IP
-version.
-
-Available values for this option are:
-.IP CURL_IPRESOLVE_WHATEVER
-Default, can use addresses of all IP versions that your system allows.
-.IP CURL_IPRESOLVE_V4
-Uses only IPv4 addresses.
-.IP CURL_IPRESOLVE_V6
-Uses only IPv6 addresses.
-.SH DEFAULT
-CURL_IPRESOLVE_WHATEVER
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-
-  /* of all addresses example.com resolves to, only IPv6 ones are used */
-  curl_easy_setopt(curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V6);
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_HTTP_VERSION "(3), " CURLOPT_SSLVERSION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_IPRESOLVE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_IPRESOLVE.md
new file mode 100644
index 0000000000..180546a9df
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_IPRESOLVE.md
@@ -0,0 +1,90 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_IPRESOLVE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HTTP_VERSION (3)
+  - CURLOPT_RESOLVE (3)
+  - CURLOPT_SSLVERSION (3)
+Protocol:
+  - All
+Added-in: 7.10.8
+---
+
+# NAME
+
+CURLOPT_IPRESOLVE - IP protocol version to use
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_IPRESOLVE, long resolve);
+~~~
+
+# DESCRIPTION
+
+Allows an application to select what kind of IP addresses to use when
+establishing a connection or choosing one from the connection pool. This is
+interesting when using hostnames that resolve to more than one IP family.
+
+If the URL provided for a transfer contains a numerical IP version as a host
+name, this option does not override or prohibit libcurl from using that IP
+version.
+
+Available values for this option are:
+
+## CURL_IPRESOLVE_WHATEVER
+
+Default, can use addresses of all IP versions that your system allows.
+
+## CURL_IPRESOLVE_V4
+
+Uses only IPv4 addresses.
+
+## CURL_IPRESOLVE_V6
+
+Uses only IPv6 addresses.
+
+# DEFAULT
+
+CURL_IPRESOLVE_WHATEVER
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+
+    /* of all addresses example.com resolves to, only IPv6 ones are used */
+    curl_easy_setopt(curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V6);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURL_IPRESOLVE_*** macros became `long` types in 8.15.0, before this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_ISSUERCERT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_ISSUERCERT.3
deleted file mode 100644
index ef03e65c77..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_ISSUERCERT.3
+++ /dev/null
@@ -1,73 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_ISSUERCERT 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_ISSUERCERT \- issuer SSL certificate filename
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ISSUERCERT, char *file);
-.fi
-.SH DESCRIPTION
-Pass a char * to a null-terminated string naming a \fIfile\fP holding a CA
-certificate in PEM format. If the option is set, an additional check against
-the peer certificate is performed to verify the issuer is indeed the one
-associated with the certificate provided by the option. This additional check
-is useful in multi-level PKI where one needs to enforce that the peer
-certificate is from a specific branch of the tree.
-
-This option makes sense only when used in combination with the
-\fICURLOPT_SSL_VERIFYPEER(3)\fP option. Otherwise, the result of the check is
-not considered as failure.
-
-A specific error code (CURLE_SSL_ISSUER_ERROR) is defined with the option,
-which is returned if the setup of the SSL/TLS session has failed due to a
-mismatch with the issuer of peer certificate (\fICURLOPT_SSL_VERIFYPEER(3)\fP
-has to be set too for the check to fail). (Added in 7.19.0)
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS-based protocols
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_ISSUERCERT, "/etc/certs/cacert.pem");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-If built TLS enabled
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_CRLFILE "(3), " CURLOPT_SSL_VERIFYPEER "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_ISSUERCERT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_ISSUERCERT.md
new file mode 100644
index 0000000000..1e10b1bbb2
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_ISSUERCERT.md
@@ -0,0 +1,84 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_ISSUERCERT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CRLFILE (3)
+  - CURLOPT_SSL_VERIFYHOST (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+Added-in: 7.19.0
+---
+
+# NAME
+
+CURLOPT_ISSUERCERT - issuer SSL certificate filename
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ISSUERCERT, char *file);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer to a null-terminated string naming a *file* holding a CA
+certificate in PEM format. If the option is set, an additional check against
+the peer certificate is performed to verify the issuer is indeed the one
+associated with the certificate provided by the option. This additional check
+is useful in multi-level PKI where one needs to enforce that the peer
+certificate is from a specific branch of the tree.
+
+This option makes sense only when used in combination with the
+CURLOPT_SSL_VERIFYPEER(3) option. Otherwise, the result of the check is
+not considered as failure.
+
+A specific error code (CURLE_SSL_ISSUER_ERROR) is defined with the option,
+which is returned if the setup of the SSL/TLS session has failed due to a
+mismatch with the issuer of peer certificate (CURLOPT_SSL_VERIFYPEER(3) has to
+be set too for the check to fail).
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+The application does not have to keep the string around after setting this
+option.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_ISSUERCERT, "/etc/certs/cacert.pem");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_ISSUERCERT_BLOB.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_ISSUERCERT_BLOB.3
deleted file mode 100644
index 3e07066ba3..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_ISSUERCERT_BLOB.3
+++ /dev/null
@@ -1,84 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_ISSUERCERT_BLOB 3 "24 Jun 2020" libcurl libcurl
-.SH NAME
-CURLOPT_ISSUERCERT_BLOB \- issuer SSL certificate from memory blob
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ISSUERCERT_BLOB,
-                          struct curl_blob *stblob);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a curl_blob structure, which contains information (pointer
-and size) about a memory block with binary data of a CA certificate in PEM
-format. If the option is set, an additional check against the peer certificate
-is performed to verify the issuer is indeed the one associated with the
-certificate provided by the option. This additional check is useful in
-multi-level PKI where one needs to enforce that the peer certificate is from a
-specific branch of the tree.
-
-This option should be used in combination with the
-\fICURLOPT_SSL_VERIFYPEER(3)\fP option. Otherwise, the result of the check is
-not considered as failure.
-
-A specific error code (CURLE_SSL_ISSUER_ERROR) is defined with the option,
-which is returned if the setup of the SSL/TLS session has failed due to a
-mismatch with the issuer of peer certificate (\fICURLOPT_SSL_VERIFYPEER(3)\fP
-has to be set too for the check to fail).
-
-If the blob is initialized with the flags member of struct curl_blob set to
-CURL_BLOB_COPY, the application does not have to keep the buffer around after
-setting this.
-
-This option is an alternative to \fICURLOPT_ISSUERCERT(3)\fP which instead
-expects a file name as input.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS-based protocols
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  struct curl_blob blob;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  blob.data = certificateData;
-  blob.len = filesize;
-  blob.flags = CURL_BLOB_COPY;
-  curl_easy_setopt(curl, CURLOPT_ISSUERCERT_BLOB, &blob);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.71.0. This option is supported by the OpenSSL backends.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_ISSUERCERT "(3),"
-.BR CURLOPT_CRLFILE "(3), " CURLOPT_SSL_VERIFYPEER "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_ISSUERCERT_BLOB.md b/third-party/curl/docs/libcurl/opts/CURLOPT_ISSUERCERT_BLOB.md
new file mode 100644
index 0000000000..c000353619
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_ISSUERCERT_BLOB.md
@@ -0,0 +1,95 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_ISSUERCERT_BLOB
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CRLFILE (3)
+  - CURLOPT_ISSUERCERT (3)
+  - CURLOPT_SSL_VERIFYHOST (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+Added-in: 7.71.0
+---
+
+# NAME
+
+CURLOPT_ISSUERCERT_BLOB - issuer SSL certificate from memory blob
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ISSUERCERT_BLOB,
+                          struct curl_blob *stblob);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a curl_blob structure, which contains information (pointer
+and size) about a memory block with binary data of a CA certificate in PEM
+format. If the option is set, an additional check against the peer certificate
+is performed to verify the issuer is indeed the one associated with the
+certificate provided by the option. This additional check is useful in
+multi-level PKI where one needs to enforce that the peer certificate is from a
+specific branch of the tree.
+
+This option should be used in combination with the
+CURLOPT_SSL_VERIFYPEER(3) option. Otherwise, the result of the check is
+not considered as failure.
+
+A specific error code (CURLE_SSL_ISSUER_ERROR) is defined with the option,
+which is returned if the setup of the SSL/TLS session has failed due to a
+mismatch with the issuer of peer certificate (CURLOPT_SSL_VERIFYPEER(3)
+has to be set too for the check to fail).
+
+If the blob is initialized with the flags member of struct curl_blob set to
+CURL_BLOB_COPY, the application does not have to keep the buffer around after
+setting this.
+
+This option is an alternative to CURLOPT_ISSUERCERT(3) which instead
+expects a filename as input.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+
+extern char *certificateData;
+extern size_t filesize;
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    struct curl_blob blob;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    blob.data = certificateData;
+    blob.len = filesize;
+    blob.flags = CURL_BLOB_COPY;
+    curl_easy_setopt(curl, CURLOPT_ISSUERCERT_BLOB, &blob);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_KEEP_SENDING_ON_ERROR.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_KEEP_SENDING_ON_ERROR.3
deleted file mode 100644
index 816a19f434..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_KEEP_SENDING_ON_ERROR.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_KEEP_SENDING_ON_ERROR 3 "22 Sep 2016" libcurl libcurl
-.SH NAME
-CURLOPT_KEEP_SENDING_ON_ERROR \- keep sending on early HTTP response >= 300
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_KEEP_SENDING_ON_ERROR,
-                          long keep_sending);
-.fi
-.SH DESCRIPTION
-A long parameter set to 1 tells the library to keep sending the request body
-if the HTTP code returned is equal to or larger than 300. The default action
-would be to stop sending and close the stream or connection.
-
-This option is suitable for manual NTLM authentication, i.e. if an application
-does not use \fICURLOPT_HTTPAUTH(3)\fP, but instead sets "Authorization: NTLM ..."
-headers manually using \fICURLOPT_HTTPHEADER(3)\fP.
-
-Most applications do not need this option.
-.SH DEFAULT
-0, stop sending on error
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_POSTFIELDS, "sending data");
-  curl_easy_setopt(curl, CURLOPT_KEEP_SENDING_ON_ERROR, 1L);
-  ret = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Along with HTTP. Added in 7.51.0.
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is enabled, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_FAILONERROR "(3), " CURLOPT_HTTPHEADER "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_KEEP_SENDING_ON_ERROR.md b/third-party/curl/docs/libcurl/opts/CURLOPT_KEEP_SENDING_ON_ERROR.md
new file mode 100644
index 0000000000..eeb4704dd2
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_KEEP_SENDING_ON_ERROR.md
@@ -0,0 +1,70 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_KEEP_SENDING_ON_ERROR
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_RESPONSE_CODE (3)
+  - CURLOPT_FAILONERROR (3)
+  - CURLOPT_HTTPHEADER (3)
+Protocol:
+  - HTTP
+Added-in: 7.51.0
+---
+
+# NAME
+
+CURLOPT_KEEP_SENDING_ON_ERROR - keep sending on early HTTP response \>= 300
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_KEEP_SENDING_ON_ERROR,
+                          long keep_sending);
+~~~
+
+# DESCRIPTION
+
+A long parameter set to 1 tells the library to keep sending the request body
+if the HTTP code returned is equal to or larger than 300. The default action
+would be to stop sending and close the stream or connection.
+
+This option is suitable for manual NTLM authentication, i.e. if an application
+does not use CURLOPT_HTTPAUTH(3), but instead sets "Authorization: NTLM ..."
+headers manually using CURLOPT_HTTPHEADER(3).
+
+Most applications do not need this option.
+
+# DEFAULT
+
+0, stop sending on error
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, "sending data");
+    curl_easy_setopt(curl, CURLOPT_KEEP_SENDING_ON_ERROR, 1L);
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_KEYPASSWD.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_KEYPASSWD.3
deleted file mode 100644
index 4f32976119..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_KEYPASSWD.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_KEYPASSWD 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_KEYPASSWD \- passphrase to private key
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_KEYPASSWD, char *pwd);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter. It is used as the
-password required to use the \fICURLOPT_SSLKEY(3)\fP or
-\fICURLOPT_SSH_PRIVATE_KEYFILE(3)\fP private key.  You never need a pass
-phrase to load a certificate but you need one to load your private key.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-  curl_easy_setopt(curl, CURLOPT_SSLCERT, "client.pem");
-  curl_easy_setopt(curl, CURLOPT_SSLKEY, "key.pem");
-  curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "superman");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-This option was known as CURLOPT_SSLKEYPASSWD up to 7.16.4 and
-CURLOPT_SSLCERTPASSWD up to 7.9.2.
-.SH RETURN VALUE
-Returns CURLE_OK if TLS enabled, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_SSLKEY "(3), " CURLOPT_SSH_PRIVATE_KEYFILE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_KEYPASSWD.md b/third-party/curl/docs/libcurl/opts/CURLOPT_KEYPASSWD.md
new file mode 100644
index 0000000000..38f5120cae
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_KEYPASSWD.md
@@ -0,0 +1,83 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_KEYPASSWD
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSH_PRIVATE_KEYFILE (3)
+  - CURLOPT_SSLKEY (3)
+Protocol:
+  - TLS
+  - SFTP
+  - SCP
+TLS-backend:
+  - OpenSSL
+  - mbedTLS
+  - Schannel
+  - wolfSSL
+Added-in: 7.17.0
+---
+
+# NAME
+
+CURLOPT_KEYPASSWD - passphrase to private key
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_KEYPASSWD, char *pwd);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter. It is used as the
+password required to use the CURLOPT_SSLKEY(3) or
+CURLOPT_SSH_PRIVATE_KEYFILE(3) private key. You never need a passphrase to
+load a certificate but you need one to load your private key.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+    curl_easy_setopt(curl, CURLOPT_SSLCERT, "client.pem");
+    curl_easy_setopt(curl, CURLOPT_SSLKEY, "key.pem");
+    curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "superman");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+This option was known as CURLOPT_SSLKEYPASSWD up to 7.16.4 and
+CURLOPT_SSLCERTPASSWD up to 7.9.2.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_KRBLEVEL.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_KRBLEVEL.3
deleted file mode 100644
index c405462061..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_KRBLEVEL.3
+++ /dev/null
@@ -1,63 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_KRBLEVEL 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_KRBLEVEL \- FTP kerberos security level
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_KRBLEVEL, char *level);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter. Set the kerberos security level for FTP; this also
-enables kerberos awareness.  This is a string that should match one of the
-following: \&'clear', \&'safe', \&'confidential' or \&'private'. If the string
-is set but does not match one of these, 'private' is used. Set the string to
-NULL to disable kerberos support for FTP.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-FTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/foo.bin");
-  curl_easy_setopt(curl, CURLOPT_KRBLEVEL, "private");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-This option was known as CURLOPT_KRB4LEVEL up to 7.16.3
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_KRBLEVEL "(3), " CURLOPT_USE_SSL "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_KRBLEVEL.md b/third-party/curl/docs/libcurl/opts/CURLOPT_KRBLEVEL.md
new file mode 100644
index 0000000000..cfc728ccd6
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_KRBLEVEL.md
@@ -0,0 +1,81 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_KRBLEVEL
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_USE_SSL (3)
+Protocol:
+  - FTP
+Added-in: 7.16.4
+---
+
+# NAME
+
+CURLOPT_KRBLEVEL - FTP kerberos security level
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_KRBLEVEL, char *level);
+~~~
+
+# DESCRIPTION
+
+Deprecated. It serves no purpose anymore.
+
+Pass a char pointer as parameter. Set the kerberos security level for FTP;
+this also enables kerberos awareness. This is a string that should match one
+of the following: `clear`, `safe`, `confidential` or `private`. If the string
+is set but does not match one of these, `private` is used. Set the string to
+NULL to disable kerberos support for FTP.
+
+The application does not have to keep the string around after setting this
+option.
+
+The application does not have to keep the string around after setting this
+option.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/foo.bin");
+    curl_easy_setopt(curl, CURLOPT_KRBLEVEL, "private");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+Functionality removed in 8.17.0
+
+This option was known as CURLOPT_KRB4LEVEL up to 7.16.3
+
+# DEPRECATED
+
+Deprecated since 8.17.0
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_LOCALPORT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_LOCALPORT.3
deleted file mode 100644
index 599db391ce..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_LOCALPORT.3
+++ /dev/null
@@ -1,60 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_LOCALPORT 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_LOCALPORT \- local port number to use for socket
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_LOCALPORT, long port);
-.fi
-.SH DESCRIPTION
-Pass a long. This sets the local port number of the socket used for the
-connection. This can be used in combination with \fICURLOPT_INTERFACE(3)\fP
-and you are recommended to use \fICURLOPT_LOCALPORTRANGE(3)\fP as well when
-this option is set. Valid port numbers are 1 - 65535.
-.SH DEFAULT
-0, disabled - use whatever the system thinks is fine
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-  curl_easy_setopt(curl, CURLOPT_LOCALPORT, 49152L);
-  /* and try 20 more ports following that */
-  curl_easy_setopt(curl, CURLOPT_LOCALPORTRANGE, 20L);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.15.2
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_LOCALPORTRANGE "(3), " CURLOPT_INTERFACE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_LOCALPORT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_LOCALPORT.md
new file mode 100644
index 0000000000..806de6e9ac
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_LOCALPORT.md
@@ -0,0 +1,66 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_LOCALPORT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_LOCAL_PORT (3)
+  - CURLOPT_INTERFACE (3)
+  - CURLOPT_LOCALPORTRANGE (3)
+Protocol:
+  - All
+Added-in: 7.15.2
+---
+
+# NAME
+
+CURLOPT_LOCALPORT - local port number to use for socket
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_LOCALPORT, long port);
+~~~
+
+# DESCRIPTION
+
+Pass a long. This sets the local port number of the socket used for the
+connection. This can be used in combination with CURLOPT_INTERFACE(3)
+and you are recommended to use CURLOPT_LOCALPORTRANGE(3) as well when
+this option is set. Valid port numbers are 1 - 65535.
+
+# DEFAULT
+
+0, disabled - use whatever the system thinks is fine
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+    curl_easy_setopt(curl, CURLOPT_LOCALPORT, 49152L);
+    /* and try 20 more ports following that */
+    curl_easy_setopt(curl, CURLOPT_LOCALPORTRANGE, 20L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_LOCALPORTRANGE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_LOCALPORTRANGE.3
deleted file mode 100644
index 58d4ea4582..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_LOCALPORTRANGE.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_LOCALPORTRANGE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_LOCALPORTRANGE \- number of additional local ports to try
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_LOCALPORTRANGE,
-                          long range);
-.fi
-.SH DESCRIPTION
-Pass a long. The \fIrange\fP argument is the number of attempts libcurl makes
-to find a working local port number. It starts with the given
-\fICURLOPT_LOCALPORT(3)\fP and adds one to the number for each retry. Setting
-this option to 1 or below makes libcurl only do one try for the exact port
-number. Port numbers by nature are scarce resources that are busy at times so
-setting this value to something too low might cause unnecessary connection
-setup failures.
-.SH DEFAULT
-1
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-  curl_easy_setopt(curl, CURLOPT_LOCALPORT, 49152L);
-  /* and try 20 more ports following that */
-  curl_easy_setopt(curl, CURLOPT_LOCALPORTRANGE, 20L);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.15.2
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_LOCALPORT "(3), " CURLOPT_INTERFACE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_LOCALPORTRANGE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_LOCALPORTRANGE.md
new file mode 100644
index 0000000000..da3ef5ae1f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_LOCALPORTRANGE.md
@@ -0,0 +1,69 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_LOCALPORTRANGE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_INTERFACE (3)
+  - CURLOPT_LOCALPORT (3)
+Protocol:
+  - All
+Added-in: 7.15.2
+---
+
+# NAME
+
+CURLOPT_LOCALPORTRANGE - number of additional local ports to try
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_LOCALPORTRANGE,
+                          long range);
+~~~
+
+# DESCRIPTION
+
+Pass a long. The *range* argument is the number of attempts libcurl makes
+to find a working local port number. It starts with the given
+CURLOPT_LOCALPORT(3) and adds one to the number for each retry. Setting
+this option to 1 or below makes libcurl only do one try for the exact port
+number. Port numbers by nature are scarce resources that are busy at times so
+setting this value to something too low might cause unnecessary connection
+setup failures.
+
+# DEFAULT
+
+1
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+    curl_easy_setopt(curl, CURLOPT_LOCALPORT, 49152L);
+    /* and try 20 more ports following that */
+    curl_easy_setopt(curl, CURLOPT_LOCALPORTRANGE, 20L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_LOGIN_OPTIONS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_LOGIN_OPTIONS.3
deleted file mode 100644
index c1506ba279..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_LOGIN_OPTIONS.3
+++ /dev/null
@@ -1,74 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_LOGIN_OPTIONS 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_LOGIN_OPTIONS \- login options
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_LOGIN_OPTIONS, char *options);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter, which should be pointing to the null-terminated
-\fIoptions\fP string to use for the transfer.
-
-For more information about the login options please see RFC 2384, RFC 5092 and
-the IETF draft \fBdraft-earhart-url-smtp-00.txt\fP.
-
-\fICURLOPT_LOGIN_OPTIONS(3)\fP can be used to set protocol specific login
-options, such as the preferred authentication mechanism via "AUTH=NTLM" or
-"AUTH=*", and should be used in conjunction with the \fICURLOPT_USERNAME(3)\fP
-option.
-
-Since 8.2.0, IMAP supports the login option "AUTH=+LOGIN". With this option,
-curl uses the plain (not SASL) LOGIN IMAP command even if the server
-advertises SASL authentication. Care should be taken in using this option, as
-it sends your password in plain text. This does not work if the IMAP server
-disables the plain LOGIN (e.g. to prevent password snooping).
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-Only IMAP, LDAP, POP3 and SMTP support login options.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "smtp://example.com/");
-  curl_easy_setopt(curl, CURLOPT_LOGIN_OPTIONS, "AUTH=*");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.34.0. Support for OpenLDAP added in 7.82.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_USERNAME "(3), " CURLOPT_PASSWORD "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_LOGIN_OPTIONS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_LOGIN_OPTIONS.md
new file mode 100644
index 0000000000..80dabd7027
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_LOGIN_OPTIONS.md
@@ -0,0 +1,96 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_LOGIN_OPTIONS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PASSWORD (3)
+  - CURLOPT_USERNAME (3)
+Protocol:
+  - IMAP
+  - LDAP
+  - POP3
+  - SMTP
+Added-in: 7.34.0
+---
+
+# NAME
+
+CURLOPT_LOGIN_OPTIONS - login options
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_LOGIN_OPTIONS, char *options);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter, which should be pointing to the
+null-terminated *options* string to use for the transfer.
+
+For more information about the login options please see RFC 2384, RFC 5092 and
+the IETF draft **draft-earhart-url-smtp-00.txt**.
+
+CURLOPT_LOGIN_OPTIONS(3) can be used to set protocol specific login options,
+such as the preferred authentication mechanism via "AUTH=NTLM" or "AUTH=*",
+and should be used in conjunction with the CURLOPT_USERNAME(3) option.
+
+Since 8.2.0, IMAP supports the login option "AUTH=+LOGIN". With this option,
+curl uses the plain (not SASL) LOGIN IMAP command even if the server
+advertises SASL authentication. Care should be taken in using this option, as
+it sends your password in plain text. This does not work if the IMAP server
+disables the plain LOGIN (e.g. to prevent password snooping).
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+CURLOPT_LOGIN_OPTIONS(3) is a *login property*, it does not change the
+security context. This means that this option changes how the login happens
+when a connection is created, but it does not affect which connections libcurl
+can reuse. libcurl may reuse a connection that was set up with a different
+options string; a different options string does not by itself prevent reuse.
+Connection reuse still depends on other connection properties matching, such
+as the protocol, hostname, port number, credentials and other settings that
+affect the connection.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "smtp://example.com/");
+    curl_easy_setopt(curl, CURLOPT_LOGIN_OPTIONS, "AUTH=*");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+Support for OpenLDAP added in 7.82.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_LOW_SPEED_LIMIT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_LOW_SPEED_LIMIT.3
deleted file mode 100644
index 7ac5bf5594..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_LOW_SPEED_LIMIT.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_LOW_SPEED_LIMIT 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_LOW_SPEED_LIMIT \- low speed limit in bytes per second
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_LOW_SPEED_LIMIT,
-                          long speedlimit);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter. It contains the average transfer speed in bytes per
-second that the transfer should be below during
-\fICURLOPT_LOW_SPEED_TIME(3)\fP seconds for libcurl to consider it to be too
-slow and abort.
-.SH DEFAULT
-0, disabled
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  /* abort if slower than 30 bytes/sec during 60 seconds */
-  curl_easy_setopt(curl, CURLOPT_LOW_SPEED_TIME, 60L);
-  curl_easy_setopt(curl, CURLOPT_LOW_SPEED_LIMIT, 30L);
-  res = curl_easy_perform(curl);
-  if(CURLE_OPERATION_TIMEDOUT == res) {
-    printf("Timeout!\\n");
-  }
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_LOW_SPEED_TIME "(3), " CURLOPT_TIMEOUT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_LOW_SPEED_LIMIT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_LOW_SPEED_LIMIT.md
new file mode 100644
index 0000000000..7a5f094b77
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_LOW_SPEED_LIMIT.md
@@ -0,0 +1,72 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_LOW_SPEED_LIMIT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_LOW_SPEED_TIME (3)
+  - CURLOPT_MAX_RECV_SPEED_LARGE (3)
+  - CURLOPT_MAX_SEND_SPEED_LARGE (3)
+  - CURLOPT_TIMEOUT (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_LOW_SPEED_LIMIT - low speed limit in bytes per second
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_LOW_SPEED_LIMIT,
+                          long speedlimit);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter. It contains the average transfer speed in bytes per
+second that the transfer should be below during
+CURLOPT_LOW_SPEED_TIME(3) seconds for libcurl to consider it to be too
+slow and abort.
+
+# DEFAULT
+
+0, disabled
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    /* abort if slower than 30 bytes/sec during 60 seconds */
+    curl_easy_setopt(curl, CURLOPT_LOW_SPEED_TIME, 60L);
+    curl_easy_setopt(curl, CURLOPT_LOW_SPEED_LIMIT, 30L);
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OPERATION_TIMEDOUT) {
+      printf("Timeout.\n");
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_LOW_SPEED_TIME.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_LOW_SPEED_TIME.3
deleted file mode 100644
index 9f54ff7b0e..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_LOW_SPEED_TIME.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_LOW_SPEED_TIME 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_LOW_SPEED_TIME \- low speed limit time period
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_LOW_SPEED_TIME,
-                          long speedtime);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter. It contains the time in number seconds that the
-transfer speed should be below the \fICURLOPT_LOW_SPEED_LIMIT(3)\fP for the
-library to consider it too slow and abort.
-.SH DEFAULT
-0, disabled
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, url);
-  /* abort if slower than 30 bytes/sec during 60 seconds */
-  curl_easy_setopt(curl, CURLOPT_LOW_SPEED_TIME, 60L);
-  curl_easy_setopt(curl, CURLOPT_LOW_SPEED_LIMIT, 30L);
-  res = curl_easy_perform(curl);
-  if(CURLE_OPERATION_TIMEDOUT == res) {
-    printf("Timeout!\\n");
-  }
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_LOW_SPEED_LIMIT "(3), " CURLOPT_TIMEOUT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_LOW_SPEED_TIME.md b/third-party/curl/docs/libcurl/opts/CURLOPT_LOW_SPEED_TIME.md
new file mode 100644
index 0000000000..a27e2f0c5d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_LOW_SPEED_TIME.md
@@ -0,0 +1,69 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_LOW_SPEED_TIME
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_LOW_SPEED_LIMIT (3)
+  - CURLOPT_TIMEOUT (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_LOW_SPEED_TIME - low speed limit time period
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_LOW_SPEED_TIME,
+                          long speedtime);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter. It contains the time in number seconds that the
+transfer speed should be below the CURLOPT_LOW_SPEED_LIMIT(3) for the
+library to consider it too slow and abort.
+
+# DEFAULT
+
+0, disabled
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    /* abort if slower than 30 bytes/sec during 60 seconds */
+    curl_easy_setopt(curl, CURLOPT_LOW_SPEED_TIME, 60L);
+    curl_easy_setopt(curl, CURLOPT_LOW_SPEED_LIMIT, 30L);
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OPERATION_TIMEDOUT) {
+      printf("Timeout.\n");
+    }
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_AUTH.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_AUTH.3
deleted file mode 100644
index c709e3d001..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_AUTH.3
+++ /dev/null
@@ -1,73 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_MAIL_AUTH 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_MAIL_AUTH \- SMTP authentication address
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAIL_AUTH, char *auth);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter. This is used to
-specify the authentication address (identity) of a submitted message that is
-being relayed to another server.
-
-This optional parameter allows co-operating agents in a trusted environment to
-communicate the authentication of individual messages and should only be used
-by the application program, using libcurl, if the application is itself a mail
-server acting in such an environment. If the application is operating as such
-and the AUTH address is not known or is invalid, then an empty string should
-be used for this parameter.
-
-Unlike \fICURLOPT_MAIL_FROM(3)\fP and \fICURLOPT_MAIL_RCPT(3)\fP, the address
-should not be specified within a pair of angled brackets (<>). However, if an
-empty string is used then a pair of brackets are sent by libcurl as required
-by RFC 2554.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-SMTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "smtp://example.com/");
-  curl_easy_setopt(curl, CURLOPT_MAIL_AUTH, "<secret@cave>");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.25.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_MAIL_FROM "(3), " CURLOPT_MAIL_RCPT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_AUTH.md b/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_AUTH.md
new file mode 100644
index 0000000000..3a0263a177
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_AUTH.md
@@ -0,0 +1,79 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_MAIL_AUTH
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_MAIL_FROM (3)
+  - CURLOPT_MAIL_RCPT (3)
+Protocol:
+  - SMTP
+Added-in: 7.25.0
+---
+
+# NAME
+
+CURLOPT_MAIL_AUTH - SMTP authentication address
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAIL_AUTH, char *auth);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter. This is used to
+specify the authentication address (identity) of a submitted message that is
+being relayed to another server.
+
+This optional parameter allows co-operating agents in a trusted environment to
+communicate the authentication of individual messages and should only be used
+by the application program, using libcurl, if the application is itself a mail
+server acting in such an environment. If the application is operating as such
+and the AUTH address is not known or is invalid, then an empty string should
+be used for this parameter.
+
+Unlike CURLOPT_MAIL_FROM(3) and CURLOPT_MAIL_RCPT(3), the address should not
+be specified within a pair of angled brackets (\<\>). If an empty string is
+used, a pair of brackets is sent by libcurl as required by RFC 2554.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "smtp://example.com/");
+    curl_easy_setopt(curl, CURLOPT_MAIL_AUTH, "<secret@cave>");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_FROM.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_FROM.3
deleted file mode 100644
index 4fa5646a07..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_FROM.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_MAIL_FROM 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_MAIL_FROM \- SMTP sender address
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAIL_FROM, char *from);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter. This should be used
-to specify the sender's email address when sending SMTP mail with libcurl.
-
-An originator email address should be specified with angled brackets (<>)
-around it, which if not specified are added automatically.
-
-If this parameter is not specified then an empty address is sent to the SMTP
-server which might cause the email to be rejected.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-blank
-.SH PROTOCOLS
-SMTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "smtp://example.com/");
-  curl_easy_setopt(curl, CURLOPT_MAIL_FROM, "president@example.com");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.20.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_MAIL_RCPT "(3), " CURLOPT_MAIL_AUTH "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_FROM.md b/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_FROM.md
new file mode 100644
index 0000000000..fe6968f368
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_FROM.md
@@ -0,0 +1,76 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_MAIL_FROM
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_MAIL_AUTH (3)
+  - CURLOPT_MAIL_RCPT (3)
+Protocol:
+  - SMTP
+Added-in: 7.20.0
+---
+
+# NAME
+
+CURLOPT_MAIL_FROM - SMTP sender address
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAIL_FROM, char *from);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter. This should be used
+to specify the sender's email address when sending SMTP mail with libcurl.
+
+An originator email address should be specified with angled brackets (\<\>)
+around it, which if not specified are added automatically.
+
+In order to specify DSN parameters (as per RFC 3461), the address has to be
+written in angled brackets, followed by the parameters.
+
+If this parameter is not specified then an empty address is sent to the SMTP
+server which might cause the email to be rejected.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+blank
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "smtp://example.com/");
+    curl_easy_setopt(curl, CURLOPT_MAIL_FROM, "president@example.com");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_RCPT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_RCPT.3
deleted file mode 100644
index a239b0736e..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_RCPT.3
+++ /dev/null
@@ -1,76 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_MAIL_RCPT 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_MAIL_RCPT \- list of SMTP mail recipients
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAIL_RCPT,
-                          struct curl_slist *rcpts);
-.SH DESCRIPTION
-Pass a pointer to a linked list of recipients to pass to the server in your
-SMTP mail request. The linked list should be a fully valid list of
-\fBstruct curl_slist\fP structs properly filled in. Use
-\fIcurl_slist_append(3)\fP to create the list and \fIcurl_slist_free_all(3)\fP
-to clean up an entire list.
-
-When performing a mail transfer, each recipient should be specified within a
-pair of angled brackets (<>), however, should you not use an angled bracket as
-the first character libcurl assumes you provided a single email address and
-encloses that address within brackets for you.
-
-When performing an address verification (\fBVRFY\fP command), each recipient
-should be specified as the user name or user name and domain (as per Section
-3.5 of RFC 5321).
-
-When performing a mailing list expand (\fBEXPN\fP command), each recipient
-should be specified using the mailing list name, such as "Friends" or
-"London-Office".
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-SMTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  struct curl_slist *list;
-  list = curl_slist_append(NULL, "root@localhost");
-  list = curl_slist_append(list, "person@example.com");
-  curl_easy_setopt(curl, CURLOPT_URL, "smtp://example.com/");
-  curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, list);
-  ret = curl_easy_perform(curl);
-  curl_slist_free_all(list);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.20.0. The \fBVRFY\fP and \fBEXPN\fP logic was added in 7.34.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_MAIL_FROM "(3), " CURLOPT_MAIL_AUTH "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_RCPT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_RCPT.md
new file mode 100644
index 0000000000..49dd618fae
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_RCPT.md
@@ -0,0 +1,91 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_MAIL_RCPT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_MAIL_AUTH (3)
+  - CURLOPT_MAIL_FROM (3)
+Protocol:
+  - SMTP
+Added-in: 7.20.0
+---
+
+# NAME
+
+CURLOPT_MAIL_RCPT - list of SMTP mail recipients
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAIL_RCPT,
+                          struct curl_slist *rcpts);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a linked list of recipients to pass to the server in your
+SMTP mail request. The linked list should be a fully valid list of
+**struct curl_slist** structs properly filled in. Use curl_slist_append(3) to
+create the list and curl_slist_free_all(3) to clean up an entire list.
+
+libcurl does not copy the list, it needs to be kept around until after the
+transfer has completed.
+
+When performing a mail transfer, each recipient should be specified within a
+pair of angled brackets (\<\>). Should you not use an angled bracket as the
+first character, libcurl assumes you provided a single email address and
+encloses that address within brackets for you.
+
+In order to specify DSN parameters (as per RFC 3461), the address has to be
+written in angled brackets, followed by the parameters.
+
+When performing an address verification (**VRFY** command), each recipient
+should be specified as the username or username plus domain (as per Section
+3.5 of RFC 5321).
+
+When performing a mailing list expand (**EXPN** command), each recipient
+should be specified using the mailing list name, such as `Friends` or
+`London-Office`.
+
+Using this option multiple times makes the last set list override the previous
+ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    struct curl_slist *list;
+    list = curl_slist_append(NULL, "root@localhost");
+    list = curl_slist_append(list, "person@example.com");
+    list = curl_slist_append(list, "<other@example.com> NOTIFY=SUCCESS");
+    curl_easy_setopt(curl, CURLOPT_URL, "smtp://example.com/");
+    curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, list);
+    result = curl_easy_perform(curl);
+    curl_slist_free_all(list);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_RCPT_ALLOWFAILS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_RCPT_ALLOWFAILS.3
deleted file mode 100644
index 6e486f5cc3..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_RCPT_ALLOWFAILS.3
+++ /dev/null
@@ -1,77 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_MAIL_RCPT_ALLOWFAILS 3 "16 Jan 2020" libcurl libcurl
-.SH NAME
-CURLOPT_MAIL_RCPT_ALLOWFAILS \- allow RCPT TO command to fail for some recipients
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAIL_RCPT_ALLOWFAILS,
-                          long allow);
-.SH DESCRIPTION
-If \fIallow\fP is set to 1L, allow RCPT TO command to fail for some recipients.
-
-When sending data to multiple recipients, by default curl aborts the SMTP
-conversation if either one of the recipients causes the RCPT TO command to
-return an error.
-
-The default behavior can be changed by setting \fIallow\fP to 1L which makes
-libcurl ignore errors for individual recipients and proceed with the remaining
-accepted recipients.
-
-If all recipients trigger RCPT TO failures and this flag is specified, curl
-aborts the SMTP conversation and returns the error received from to the last
-RCPT TO command.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-SMTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  struct curl_slist *list;
-
-  /* Adding one valid and one invalid email address */
-  list = curl_slist_append(NULL, "person@example.com");
-  list = curl_slist_append(list, "invalidemailaddress");
-
-  curl_easy_setopt(curl, CURLOPT_URL, "smtp://example.com/");
-  curl_easy_setopt(curl, CURLOPT_MAIL_RCPT_ALLOWFAILS, 1L);
-
-  ret = curl_easy_perform(curl);
-  curl_slist_free_all(list);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-This option was called CURLOPT_MAIL_RCPT_ALLLOWFAILS before 8.2.0
-
-Added in 7.69.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_MAIL_FROM "(3), " CURLOPT_MAIL_RCPT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_RCPT_ALLOWFAILS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_RCPT_ALLOWFAILS.md
new file mode 100644
index 0000000000..d87ba09bd7
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_MAIL_RCPT_ALLOWFAILS.md
@@ -0,0 +1,86 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_MAIL_RCPT_ALLOWFAILS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_MAIL_FROM (3)
+  - CURLOPT_MAIL_RCPT (3)
+Protocol:
+  - SMTP
+Added-in: 8.2.0
+---
+
+# NAME
+
+CURLOPT_MAIL_RCPT_ALLOWFAILS - allow RCPT TO command to fail for some recipients
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAIL_RCPT_ALLOWFAILS,
+                          long allow);
+~~~
+
+# DESCRIPTION
+
+If *allow* is set to 1L, allow RCPT TO command to fail for some recipients.
+
+When sending data to multiple recipients, by default curl aborts the SMTP
+conversation if either one of the recipients causes the RCPT TO command to
+return an error.
+
+The default behavior can be changed by setting *allow* to 1L which makes
+libcurl ignore errors for individual recipients and proceed with the remaining
+accepted recipients.
+
+If all recipients trigger RCPT TO failures and this flag is specified, curl
+aborts the SMTP conversation and returns the error received from to the last
+RCPT TO command.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    struct curl_slist *list;
+    CURLcode result;
+
+    /* Adding one valid and one invalid email address */
+    list = curl_slist_append(NULL, "person@example.com");
+    list = curl_slist_append(list, "invalidemailaddress");
+
+    curl_easy_setopt(curl, CURLOPT_URL, "smtp://example.com/");
+    curl_easy_setopt(curl, CURLOPT_MAIL_RCPT_ALLOWFAILS, 1L);
+
+    result = curl_easy_perform(curl);
+    curl_slist_free_all(list);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+This option was called CURLOPT_MAIL_RCPT_ALLLOWFAILS (with three instead of
+two letter L) before 8.2.0
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAXAGE_CONN.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_MAXAGE_CONN.3
deleted file mode 100644
index eb32421b54..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_MAXAGE_CONN.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_MAXAGE_CONN 3 "18 Apr 2019" libcurl libcurl
-.SH NAME
-CURLOPT_MAXAGE_CONN \- max idle time allowed for reusing a connection
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAXAGE_CONN, long age);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter containing \fIage\fP - the maximum time in seconds
-allowed for an existing connection to have been idle to be considered for
-reuse for this request.
-
-The "connection cache" holds previously used connections. When a new request
-is to be done, libcurl considers any connection that matches for reuse. The
-\fICURLOPT_MAXAGE_CONN(3)\fP limit prevents libcurl from trying too old
-connections for reuse, since old connections have a higher risk of not working
-and thus trying them is a performance loss and sometimes service loss due to
-the difficulties to figure out the situation. If a connection is found in the
-cache that is older than this set \fIage\fP, it is closed instead.
-.SH DEFAULT
-Default maximum age is set to 118 seconds.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* only allow 30 seconds idle time */
-  curl_easy_setopt(curl, CURLOPT_MAXAGE_CONN, 30L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.65.0
-.SH RETURN VALUE
-Returns CURLE_OK.
-.SH "SEE ALSO"
-.BR CURLOPT_TIMEOUT "(3), " CURLOPT_FORBID_REUSE "(3), "
-.BR CURLOPT_FRESH_CONNECT "(3), " CURLOPT_MAXLIFETIME_CONN "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAXAGE_CONN.md b/third-party/curl/docs/libcurl/opts/CURLOPT_MAXAGE_CONN.md
new file mode 100644
index 0000000000..73d5d39b78
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_MAXAGE_CONN.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_MAXAGE_CONN
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_FORBID_REUSE (3)
+  - CURLOPT_FRESH_CONNECT (3)
+  - CURLOPT_MAXLIFETIME_CONN (3)
+  - CURLOPT_TIMEOUT (3)
+Protocol:
+  - All
+Added-in: 7.65.0
+---
+
+# NAME
+
+CURLOPT_MAXAGE_CONN - max idle time allowed for reusing a connection
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAXAGE_CONN, long age);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter containing *age* - the maximum time in seconds
+allowed for an existing connection to have been idle to be considered for
+reuse for this request.
+
+The "connection cache" holds previously used connections. When a new request
+is to be done, libcurl considers any connection that matches for reuse. The
+CURLOPT_MAXAGE_CONN(3) limit prevents libcurl from trying too old
+connections for reuse, since old connections have a higher risk of not working
+and thus trying them is a performance loss and sometimes service loss due to
+the difficulties to figure out the situation. If a connection is found in the
+cache that is older than this set *age*, it is closed instead.
+
+# DEFAULT
+
+118 seconds
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* only allow 30 seconds idle time */
+    curl_easy_setopt(curl, CURLOPT_MAXAGE_CONN, 30L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAXCONNECTS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_MAXCONNECTS.3
deleted file mode 100644
index b07f98c2c2..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_MAXCONNECTS.3
+++ /dev/null
@@ -1,71 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_MAXCONNECTS 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_MAXCONNECTS \- maximum connection cache size
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAXCONNECTS, long amount);
-.fi
-.SH DESCRIPTION
-Pass a long. The set \fIamount\fP is the maximum number of simultaneously open
-persistent connections that libcurl may cache in the pool associated with this
-handle. The default is 5, and there is not much point in changing this value
-unless you are perfectly aware of how this works. This concerns connections
-using any of the protocols that support persistent connections.
-
-When reaching the maximum limit, curl closes the oldest one in the cache to
-prevent increasing the number of open connections.
-
-If you already have performed transfers with this curl handle, setting a
-smaller \fICURLOPT_MAXCONNECTS(3)\fP than before may cause open connections to
-get closed unnecessarily.
-
-If you add this easy handle to a multi handle, this setting is not
-acknowledged, and you must instead use \fIcurl_multi_setopt(3)\fP and the
-\fICURLMOPT_MAXCONNECTS(3)\fP option.
-.SH DEFAULT
-5
-.SH PROTOCOLS
-Most
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  /* limit the connection cache for this handle to no more than 3 */
-  curl_easy_setopt(curl, CURLOPT_MAXCONNECTS, 3L);
-  ret = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLMOPT_MAXCONNECTS "(3), " CURLOPT_MAXREDIRS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAXCONNECTS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_MAXCONNECTS.md
new file mode 100644
index 0000000000..96df2614a1
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_MAXCONNECTS.md
@@ -0,0 +1,77 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_MAXCONNECTS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_MAXCONNECTS (3)
+  - CURLMOPT_MAX_HOST_CONNECTIONS (3)
+  - CURLMOPT_MAX_TOTAL_CONNECTIONS (3)
+  - CURLOPT_MAXREDIRS (3)
+Protocol:
+  - All
+Added-in: 7.7
+---
+
+# NAME
+
+CURLOPT_MAXCONNECTS - maximum connection cache size
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAXCONNECTS, long amount);
+~~~
+
+# DESCRIPTION
+
+Pass a long. The set *amount* is the maximum number of connections that
+libcurl may keep alive in its connection cache after use. The default is 5,
+and there is not much point in changing this value unless you are perfectly
+aware of how this works. This concerns connections using any of the protocols
+that support persistent connections.
+
+When reaching the maximum limit, curl closes the oldest connection present in
+the cache to prevent the number of connections from increasing.
+
+If you already have performed transfers with this curl handle, setting a
+smaller CURLOPT_MAXCONNECTS(3) than before may cause open connections to get
+closed unnecessarily.
+
+If you add this easy handle to a multi handle, this setting is not
+acknowledged, and you must instead use curl_multi_setopt(3) and the
+CURLMOPT_MAXCONNECTS(3) option.
+
+# DEFAULT
+
+5
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* limit the connection cache for this handle to no more than 3 */
+    curl_easy_setopt(curl, CURLOPT_MAXCONNECTS, 3L);
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAXFILESIZE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_MAXFILESIZE.3
deleted file mode 100644
index f4b024047f..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_MAXFILESIZE.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_MAXFILESIZE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_MAXFILESIZE \- maximum file size allowed to download
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAXFILESIZE, long size);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter. This specifies the maximum accepted \fIsize\fP (in
-bytes) of a file to download. If the file requested is found larger than this
-value, the transfer is aborted and \fICURLE_FILESIZE_EXCEEDED\fP is returned.
-
-The file size is not always known prior to the download start, and for such
-transfers this option has no effect - even if the file transfer eventually
-ends up being larger than this given limit.
-
-If you want a limit above 2GB, use \fICURLOPT_MAXFILESIZE_LARGE(3)\fP.
-.SH DEFAULT
-None
-.SH PROTOCOLS
-FTP, HTTP and MQTT
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  /* refuse to download if larger than 1000 bytes! */
-  curl_easy_setopt(curl, CURLOPT_MAXFILESIZE, 1000L);
-  ret = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_MAXFILESIZE_LARGE "(3), " CURLOPT_MAX_RECV_SPEED_LARGE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAXFILESIZE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_MAXFILESIZE.md
new file mode 100644
index 0000000000..a1a0d8496c
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_MAXFILESIZE.md
@@ -0,0 +1,79 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_MAXFILESIZE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_MAXFILESIZE_LARGE (3)
+  - CURLOPT_MAX_RECV_SPEED_LARGE (3)
+Protocol:
+  - All
+Added-in: 7.10.8
+---
+
+# NAME
+
+CURLOPT_MAXFILESIZE - maximum file size allowed to download
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAXFILESIZE, long size);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter. This specifies the maximum accepted *size* (in
+bytes) of a file to download. If the file requested is found larger than this
+value, the transfer is aborted and *CURLE_FILESIZE_EXCEEDED* is returned.
+Passing a zero *size* disables this, and passing a negative *size* yields a
+*CURLE_BAD_FUNCTION_ARGUMENT*.
+
+If you want a limit above 2GB, use CURLOPT_MAXFILESIZE_LARGE(3).
+
+If the size is known to be too big before the transfer starts, libcurl
+aborts before starting the transfer. If it is instead found to be too big
+while the transfer is in progress, libcurl aborts the transfer once the
+received bytes exceed the limit.
+
+Since 8.20.0, this option also aborts ongoing transfers once the
+decompressed bytes exceed this threshold due to automatic decompression using
+CURLOPT_ACCEPT_ENCODING(3).
+
+# DEFAULT
+
+0, meaning disabled.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* refuse to download if larger than 1000 bytes */
+    curl_easy_setopt(curl, CURLOPT_MAXFILESIZE, 1000L);
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# HISTORY
+
+Before curl 8.4.0, the limit was not applied to transfers in progress.
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAXFILESIZE_LARGE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_MAXFILESIZE_LARGE.3
deleted file mode 100644
index 7e37fca92a..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_MAXFILESIZE_LARGE.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_MAXFILESIZE_LARGE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_MAXFILESIZE_LARGE \- maximum file size allowed to download
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAXFILESIZE_LARGE,
-                          curl_off_t size);
-.SH DESCRIPTION
-Pass a curl_off_t as parameter. This specifies the maximum accepted \fIsize\fP
-(in bytes) of a file to download. If the file requested is found larger than
-this value, the transfer is aborted and \fICURLE_FILESIZE_EXCEEDED\fP is
-returned.
-
-The file size is not always known prior to the download start, and for such
-transfers this option has no effect - even if the file transfer eventually
-ends up being larger than this given limit.
-.SH DEFAULT
-None
-.SH PROTOCOLS
-FTP, HTTP and MQTT
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_off_t ridiculous = 1 << 48;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  /* refuse to download if larger than ridiculous */
-  curl_easy_setopt(curl, CURLOPT_MAXFILESIZE_LARGE, ridiculous);
-  ret = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.11.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_MAXFILESIZE "(3), " CURLOPT_MAX_RECV_SPEED_LARGE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAXFILESIZE_LARGE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_MAXFILESIZE_LARGE.md
new file mode 100644
index 0000000000..929bae67f2
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_MAXFILESIZE_LARGE.md
@@ -0,0 +1,79 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_MAXFILESIZE_LARGE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_MAXFILESIZE (3)
+  - CURLOPT_MAX_RECV_SPEED_LARGE (3)
+Protocol:
+  - FTP
+  - HTTP
+  - MQTT
+Added-in: 7.11.0
+---
+
+# NAME
+
+CURLOPT_MAXFILESIZE_LARGE - maximum file size allowed to download
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAXFILESIZE_LARGE,
+                          curl_off_t size);
+~~~
+
+# DESCRIPTION
+
+Pass a curl_off_t as parameter. This specifies the maximum accepted *size* (in
+bytes) of a file to download. If the file requested is found larger than this
+value, the transfer is aborted and *CURLE_FILESIZE_EXCEEDED* is returned.
+Passing a zero *size* disables this, and passing a negative *size* yields a
+*CURLE_BAD_FUNCTION_ARGUMENT*.
+
+If the size is known to exceed the limit before the transfer starts, libcurl
+aborts before starting the transfer. If the transfer instead exceeds the limit
+while it is in progress, libcurl aborts it at that point.
+
+Since 8.20.0, this option also stops ongoing transfers that would reach this
+threshold due to automatic decompression using CURLOPT_ACCEPT_ENCODING(3).
+
+# DEFAULT
+
+0, meaning disabled.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_off_t ridiculous = (curl_off_t)1 << 48;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* refuse to download if larger than ridiculous */
+    curl_easy_setopt(curl, CURLOPT_MAXFILESIZE_LARGE, ridiculous);
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# HISTORY
+
+Before curl 8.4.0, the limit was not applied to transfers in progress.
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAXLIFETIME_CONN.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_MAXLIFETIME_CONN.3
deleted file mode 100644
index 2d7536f8c7..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_MAXLIFETIME_CONN.3
+++ /dev/null
@@ -1,70 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_MAXLIFETIME_CONN 3 "10 Nov 2021" libcurl libcurl
-.SH NAME
-CURLOPT_MAXLIFETIME_CONN \- max lifetime (since creation) allowed for reusing a connection
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAXLIFETIME_CONN,
-                          long maxlifetime);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter containing \fImaxlifetime\fP - the maximum time in
-seconds, since the creation of the connection, that you allow an existing
-connection to have to be considered for reuse for this request.
-
-libcurl features a connection cache that holds previously used connections.
-When a new request is to be done, libcurl considers any connection that
-matches for reuse. The \fICURLOPT_MAXLIFETIME_CONN(3)\fP limit prevents
-libcurl from trying too old connections for reuse. This can be used for
-client-side load balancing. If a connection is found in the cache that is
-older than this set \fImaxlifetime\fP, it is instead marked for closure.
-
-If set to 0, this behavior is disabled: all connections are eligible for reuse.
-.SH DEFAULT
-Default \fImaxlifetime\fP is 0 seconds (i.e., disabled).
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* only allow each connection to be reused for 30 seconds */
-  curl_easy_setopt(curl, CURLOPT_MAXLIFETIME_CONN, 30L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.80.0
-.SH RETURN VALUE
-Returns CURLE_OK.
-.SH "SEE ALSO"
-.BR CURLOPT_TIMEOUT "(3), " CURLOPT_FORBID_REUSE "(3), "
-.BR CURLOPT_FRESH_CONNECT "(3), " CURLOPT_MAXAGE_CONN "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAXLIFETIME_CONN.md b/third-party/curl/docs/libcurl/opts/CURLOPT_MAXLIFETIME_CONN.md
new file mode 100644
index 0000000000..e979caff72
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_MAXLIFETIME_CONN.md
@@ -0,0 +1,79 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_MAXLIFETIME_CONN
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_FORBID_REUSE (3)
+  - CURLOPT_FRESH_CONNECT (3)
+  - CURLOPT_MAXAGE_CONN (3)
+  - CURLOPT_TIMEOUT (3)
+Protocol:
+  - All
+Added-in: 7.80.0
+---
+
+# NAME
+
+CURLOPT_MAXLIFETIME_CONN - max lifetime (since creation) allowed for reusing a connection
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAXLIFETIME_CONN,
+                          long maxlifetime);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter containing *maxlifetime* - the maximum time in
+seconds, since the creation of the connection, that you allow an existing
+connection to have to be considered for reuse for this request.
+
+libcurl features a connection cache that holds previously used connections.
+When a new request is to be done, libcurl considers any connection that
+matches for reuse. The CURLOPT_MAXLIFETIME_CONN(3) limit prevents libcurl from
+trying too old connections for reuse. This can be used for client-side load
+balancing. If a connection is found in the cache that is older than this set
+*maxlifetime*, it is instead marked for closure.
+
+If set to 0, this behavior is disabled: all connections are eligible for
+reuse.
+
+# DEFAULT
+
+24 hours (since 8.17.0). Before that, the default was 0 seconds (i.e.,
+disabled)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* only allow each connection to be reused for 30 seconds */
+    curl_easy_setopt(curl, CURLOPT_MAXLIFETIME_CONN, 30L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAXREDIRS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_MAXREDIRS.3
deleted file mode 100644
index 7191f7da7d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_MAXREDIRS.3
+++ /dev/null
@@ -1,69 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_MAXREDIRS 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_MAXREDIRS \- maximum number of redirects allowed
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAXREDIRS, long amount);
-.fi
-.SH DESCRIPTION
-Pass a long. The set number is the redirection limit \fIamount\fP. If that
-many redirections have been followed, the next redirect triggers the error
-(\fICURLE_TOO_MANY_REDIRECTS\fP). This option only makes sense if the
-\fICURLOPT_FOLLOWLOCATION(3)\fP is used at the same time.
-
-Setting the limit to 0 makes libcurl refuse any redirect.
-
-Set it to -1 for an infinite number of redirects. This allows your application
-to get stuck in never-ending redirect loops.
-.SH DEFAULT
-30 (since 8.3.0), it was previously unlimited.
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-
-  /* enable redirect following */
-  curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
-
-  /* allow three redirects */
-  curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 3L);
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Along with HTTP
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_FOLLOWLOCATION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAXREDIRS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_MAXREDIRS.md
new file mode 100644
index 0000000000..943702a06c
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_MAXREDIRS.md
@@ -0,0 +1,76 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_MAXREDIRS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_REDIRECT_COUNT (3)
+  - CURLINFO_REDIRECT_URL (3)
+  - CURLOPT_FOLLOWLOCATION (3)
+Protocol:
+  - HTTP
+Added-in: 7.5
+---
+
+# NAME
+
+CURLOPT_MAXREDIRS - maximum number of redirects allowed
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAXREDIRS, long amount);
+~~~
+
+# DESCRIPTION
+
+Pass a long. The set number is the redirection limit *amount*. If that
+many redirections have been followed, the next redirect triggers the error
+(*CURLE_TOO_MANY_REDIRECTS*). This option only makes sense if the
+CURLOPT_FOLLOWLOCATION(3) is used at the same time.
+
+Setting the limit to 0 makes libcurl refuse any redirect.
+
+Set it to -1 for an infinite number of redirects. This allows your application
+to get stuck in never-ending redirect loops.
+
+# DEFAULT
+
+30 (since 8.3.0), it was previously unlimited.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+
+    /* enable redirect following */
+    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+
+    /* allow three redirects */
+    curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 3L);
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAX_RECV_SPEED_LARGE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_MAX_RECV_SPEED_LARGE.3
deleted file mode 100644
index 6e8d4f87de..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_MAX_RECV_SPEED_LARGE.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_MAX_RECV_SPEED_LARGE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_MAX_RECV_SPEED_LARGE \- rate limit data download speed
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAX_RECV_SPEED_LARGE,
-                          curl_off_t maxspeed);
-.SH DESCRIPTION
-Pass a curl_off_t as parameter. If a download exceeds this \fImaxspeed\fP
-(counted in bytes per second) the transfer pauses to keep the average speed
-less than or equal to the parameter value. Defaults to unlimited speed.
-
-This is not an exact science. libcurl attempts to keep the average speed below
-the given threshold over a period time.
-
-If you set \fImaxspeed\fP to a value lower than \fICURLOPT_BUFFERSIZE(3)\fP,
-libcurl might download faster than the set limit initially.
-
-This option does not affect transfer speeds done with FILE:// URLs.
-.SH DEFAULT
-0, disabled
-.SH PROTOCOLS
-All but file://
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  /* cap the download speed to 31415 bytes/sec */
-  curl_easy_setopt(curl, CURLOPT_MAX_RECV_SPEED_LARGE, (curl_off_t)31415);
-  ret = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.15.5
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_MAX_SEND_SPEED_LARGE "(3), " CURLOPT_LOW_SPEED_LIMIT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAX_RECV_SPEED_LARGE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_MAX_RECV_SPEED_LARGE.md
new file mode 100644
index 0000000000..ee0c7e84bf
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_MAX_RECV_SPEED_LARGE.md
@@ -0,0 +1,72 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_MAX_RECV_SPEED_LARGE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_LOW_SPEED_LIMIT (3)
+  - CURLOPT_MAX_SEND_SPEED_LARGE (3)
+  - CURLOPT_TIMEOUT (3)
+Protocol:
+  - All
+Added-in: 7.15.5
+---
+
+# NAME
+
+CURLOPT_MAX_RECV_SPEED_LARGE - rate limit data download speed
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAX_RECV_SPEED_LARGE,
+                          curl_off_t maxspeed);
+~~~
+
+# DESCRIPTION
+
+Pass a curl_off_t as parameter. If a download exceeds this *maxspeed*
+(counted in bytes per second) the transfer pauses to keep the average speed
+less than or equal to the parameter value. Defaults to unlimited speed.
+
+This is not an exact science. libcurl attempts to keep the average speed below
+the given threshold over a period time.
+
+If you set *maxspeed* to a value lower than CURLOPT_BUFFERSIZE(3),
+libcurl might download faster than the set limit initially.
+
+This option does not affect transfer speeds done with `file://` URLs.
+
+# DEFAULT
+
+0, disabled
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* cap the download speed to 31415 bytes/sec */
+    curl_easy_setopt(curl, CURLOPT_MAX_RECV_SPEED_LARGE, (curl_off_t)31415);
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAX_SEND_SPEED_LARGE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_MAX_SEND_SPEED_LARGE.3
deleted file mode 100644
index d9e4bd3a57..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_MAX_SEND_SPEED_LARGE.3
+++ /dev/null
@@ -1,69 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_MAX_SEND_SPEED_LARGE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_MAX_SEND_SPEED_LARGE \- rate limit data upload speed
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAX_SEND_SPEED_LARGE,
-                          curl_off_t maxspeed);
-.SH DESCRIPTION
-Pass a curl_off_t as parameter with the \fImaxspeed\fP. If an upload exceeds
-this speed (counted in bytes per second) the transfer pauses to keep the
-average speed less than or equal to the parameter value. Defaults to unlimited
-speed.
-
-This is not an exact science. libcurl attempts to keep the average speed below
-the given threshold over a period time.
-
-If you set \fImaxspeed\fP to a value lower than
-\fICURLOPT_UPLOAD_BUFFERSIZE(3)\fP, libcurl might "shoot over" the limit on
-its first send and still send off a full buffer.
-
-This option does not affect transfer speeds done with FILE:// URLs.
-.SH DEFAULT
-0, disabled
-.SH PROTOCOLS
-All except file://
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  /* cap the upload speed to 1000 bytes/sec */
-  curl_easy_setopt(curl, CURLOPT_MAX_SEND_SPEED_LARGE, (curl_off_t)1000);
-  /* (set some upload options as well!) */
-  ret = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.15.5
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_MAX_RECV_SPEED_LARGE "(3), " CURLOPT_LOW_SPEED_LIMIT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MAX_SEND_SPEED_LARGE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_MAX_SEND_SPEED_LARGE.md
new file mode 100644
index 0000000000..d64d324afd
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_MAX_SEND_SPEED_LARGE.md
@@ -0,0 +1,74 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_MAX_SEND_SPEED_LARGE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_LOW_SPEED_LIMIT (3)
+  - CURLOPT_MAX_RECV_SPEED_LARGE (3)
+Protocol:
+  - All
+Added-in: 7.15.5
+---
+
+# NAME
+
+CURLOPT_MAX_SEND_SPEED_LARGE - rate limit data upload speed
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAX_SEND_SPEED_LARGE,
+                          curl_off_t maxspeed);
+~~~
+
+# DESCRIPTION
+
+Pass a curl_off_t as parameter with the *maxspeed*. If an upload exceeds
+this speed (counted in bytes per second) the transfer pauses to keep the
+average speed less than or equal to the parameter value. Defaults to unlimited
+speed.
+
+This is not an exact science. libcurl attempts to keep the average speed below
+the given threshold over a period time.
+
+If you set *maxspeed* to a value lower than
+CURLOPT_UPLOAD_BUFFERSIZE(3), libcurl might "shoot over" the limit on
+its first send and still send off a full buffer.
+
+This option does not affect transfer speeds done with `file://` URLs.
+
+# DEFAULT
+
+0, disabled
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* cap the upload speed to 1000 bytes/sec */
+    curl_easy_setopt(curl, CURLOPT_MAX_SEND_SPEED_LARGE, (curl_off_t)1000);
+    /* (set some upload options as well) */
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MIMEPOST.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_MIMEPOST.3
deleted file mode 100644
index f588f7a380..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_MIMEPOST.3
+++ /dev/null
@@ -1,74 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_MIMEPOST 3 "22 Aug 2017" libcurl libcurl
-.SH NAME
-CURLOPT_MIMEPOST \- send data from mime structure
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-curl_mime *mime;
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MIMEPOST, mime);
-.SH DESCRIPTION
-Pass a mime handle previously obtained from \fIcurl_mime_init(3)\fP.
-
-This setting is supported by the HTTP protocol to post forms and by the
-SMTP and IMAP protocols to provide the email data to send/upload.
-
-This option is the preferred way of posting an HTTP form, replacing and
-extending the \fICURLOPT_HTTPPOST(3)\fP option.
-
-When setting \fICURLOPT_MIMEPOST(3)\fP to NULL, libcurl resets the request
-type for HTTP to the default to disable the POST. Typically that would mean it
-is reset to GET. Instead you should set a desired request method explicitly.
-.SH PROTOCOLS
-HTTP, SMTP, IMAP.
-.SH EXAMPLE
-.nf
- curl_mime *multipart = curl_mime_init(handle);
- curl_mimepart *part = curl_mime_addpart(multipart);
- curl_mime_name(part, "name");
- curl_mime_data(part, "daniel", CURL_ZERO_TERMINATED);
- part = curl_mime_addpart(multipart);
- curl_mime_name(part, "project");
- curl_mime_data(part, "curl", CURL_ZERO_TERMINATED);
- part = curl_mime_addpart(multipart);
- curl_mime_name(part, "logotype-image");
- curl_mime_filedata(part, "curl.png");
-
- /* Set the form info */
- curl_easy_setopt(handle, CURLOPT_MIMEPOST, multipart);
-
- curl_easy_perform(handle); /* post away! */
-
- curl_mime_free(multipart); /* free the post data */
-.fi
-.SH AVAILABILITY
-Added in 7.56.0
-.SH RETURN VALUE
-This returns CURLE_OK.
-.SH "SEE ALSO"
-.BR curl_mime_init "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MIMEPOST.md b/third-party/curl/docs/libcurl/opts/CURLOPT_MIMEPOST.md
new file mode 100644
index 0000000000..1f12908e15
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_MIMEPOST.md
@@ -0,0 +1,84 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_MIMEPOST
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HTTPPOST (3)
+  - CURLOPT_POSTFIELDS (3)
+  - CURLOPT_PUT (3)
+  - curl_mime_init (3)
+Protocol:
+  - HTTP
+  - SMTP
+  - IMAP
+Added-in: 7.56.0
+---
+
+# NAME
+
+CURLOPT_MIMEPOST - send data from mime structure
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+curl_mime *mime;
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MIMEPOST, mime);
+~~~
+
+# DESCRIPTION
+
+Pass a mime handle previously obtained from curl_mime_init(3).
+
+This setting is supported by the HTTP protocol to post forms and by the
+SMTP and IMAP protocols to provide the email data to send/upload.
+
+This option is the preferred way of posting an HTTP form, replacing and
+extending the CURLOPT_HTTPPOST(3) option.
+
+When setting CURLOPT_MIMEPOST(3) to NULL, libcurl resets the request
+type for HTTP to the default to disable the POST. Typically that would mean it
+is reset to GET. Instead you should set a desired request method explicitly.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    curl_mime *multipart = curl_mime_init(curl);
+    if(multipart) {
+      CURLcode result;
+      curl_mimepart *part = curl_mime_addpart(multipart);
+      curl_mime_name(part, "name");
+      curl_mime_data(part, "daniel", CURL_ZERO_TERMINATED);
+      part = curl_mime_addpart(multipart);
+      curl_mime_name(part, "project");
+      curl_mime_data(part, "curl", CURL_ZERO_TERMINATED);
+      part = curl_mime_addpart(multipart);
+      curl_mime_name(part, "logotype-image");
+      curl_mime_filedata(part, "curl.png");
+
+      /* Set the form info */
+      curl_easy_setopt(curl, CURLOPT_MIMEPOST, multipart);
+
+      result = curl_easy_perform(curl); /* post away */
+      curl_mime_free(multipart); /* free the post data */
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This returns CURLE_OK.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MIME_OPTIONS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_MIME_OPTIONS.3
deleted file mode 100644
index ba1ae9a10b..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_MIME_OPTIONS.3
+++ /dev/null
@@ -1,93 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_MIME_OPTIONS 3 "2 Oct 2021" libcurl libcurl
-.SH NAME
-CURLOPT_MIME_OPTIONS \- set MIME option flags
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MIME_OPTIONS, long options);
-.fi
-.SH DESCRIPTION
-Pass a long that holds a bitmask of CURLMIMEOPT_* defines. Each bit is a
-Boolean flag used while encoding a MIME tree or multipart form data.
-
-Available bits are:
-.IP CURLMIMEOPT_FORMESCAPE
-Tells libcurl to escape multipart form field and file names using the
-backslash-escaping algorithm rather than percent-encoding (HTTP only).
-
-Backslash-escaping consists in preceding backslashes and double quotes with
-a backslash. Percent encoding maps all occurrences of double quote,
-carriage return and line feed to %22, %0D and %0A respectively.
-
-Before version 7.81.0, percent-encoding was never applied.
-
-HTTP browsers used to do backslash-escaping in the past but have over time
-transitioned to use percent-encoding. This option allows one to address
-server-side applications that have not yet have been converted.
-
-As an example, consider field or file name \fIstrange\\name"kind\fP.
-When the containing multipart form is sent, this is normally transmitted as
-\fIstrange\\name%22kind\fP. When this option is set, it is sent as
-\fIstrange\\\\name\\"kind\fP.
-.SH DEFAULT
-0, meaning disabled.
-.SH PROTOCOLS
-HTTP, IMAP, SMTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-curl_mime *form = NULL;
-
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_MIME_OPTIONS, CURLMIMEOPT_FORMESCAPE);
-
-  form = curl_mime_init(curl);
-  if(form) {
-    curl_mimepart *part = curl_mime_addpart(form);
-
-    if(part) {
-      curl_mime_filedata(part, "strange\\\\file\\\\name");
-      curl_mime_name(part, "strange\\"field\\"name");
-      curl_easy_setopt(curl, CURLOPT_MIMEPOST, form);
-
-      /* Perform the request */
-      curl_easy_perform(curl);
-    }
-  }
-
-  curl_easy_cleanup(curl);
-  curl_mime_free(mime);
-}
-.fi
-.SH AVAILABILITY
-Option added in 7.81.0.
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_MIMEPOST "(3), " CURLOPT_HTTPPOST "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_MIME_OPTIONS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_MIME_OPTIONS.md
new file mode 100644
index 0000000000..15ffc97dc3
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_MIME_OPTIONS.md
@@ -0,0 +1,107 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_MIME_OPTIONS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HTTPPOST (3)
+  - CURLOPT_MIMEPOST (3)
+Protocol:
+  - HTTP
+  - IMAP
+  - SMTP
+Added-in: 7.81.0
+---
+
+# NAME
+
+CURLOPT_MIME_OPTIONS - set MIME option flags
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MIME_OPTIONS, long options);
+~~~
+
+# DESCRIPTION
+
+Pass a long that holds a bitmask of options. Each bit is a boolean flag used
+while encoding a MIME tree or multipart form data.
+
+Available bits are:
+
+## CURLMIMEOPT_FORMESCAPE
+
+Tells libcurl to escape multipart form field and filenames using the
+backslash-escaping algorithm rather than percent-encoding (HTTP only).
+
+Backslash-escaping consists in preceding backslashes and double quotes with
+a backslash. Percent encoding maps all occurrences of double quote,
+carriage return and line feed to %22, %0D and %0A respectively.
+
+Before version 7.81.0, percent-encoding was never applied.
+
+HTTP browsers used to do backslash-escaping in the past but have over time
+transitioned to use percent-encoding. This option allows one to address
+server-side applications that have not yet have been converted.
+
+As an example, consider field or filename *strangename"kind*. When the
+containing multipart form is sent, this is normally transmitted as
+*strangename%22kind*. When this option is set, it is sent as
+*strangename"kind*.
+
+# DEFAULT
+
+0, meaning disabled.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  curl_mime *form = NULL;
+
+  if(curl) {
+    CURLcode result = CURLE_OK;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_MIME_OPTIONS, CURLMIMEOPT_FORMESCAPE);
+
+    form = curl_mime_init(curl);
+    if(form) {
+      curl_mimepart *part = curl_mime_addpart(form);
+
+      if(part) {
+        curl_mime_filedata(part, "strange\\file\\name");
+        curl_mime_name(part, "strange\"field\"name");
+        curl_easy_setopt(curl, CURLOPT_MIMEPOST, form);
+
+        /* Perform the request */
+        result = curl_easy_perform(curl);
+      }
+    }
+
+    curl_easy_cleanup(curl);
+    curl_mime_free(form);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURLMIMEOPT_FORMESCAPE** macro became `long` type in 8.16.0, prior to this
+version a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_NETRC.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_NETRC.3
deleted file mode 100644
index 08d3196341..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_NETRC.3
+++ /dev/null
@@ -1,121 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_NETRC 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_NETRC \- enable use of .netrc
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_NETRC, long level);
-.fi
-.SH DESCRIPTION
-This parameter controls the preference \fIlevel\fP of libcurl between using
-user names and passwords from your \fI~/.netrc\fP file, relative to user names
-and passwords in the URL supplied with \fICURLOPT_URL(3)\fP.
-
-On Windows, libcurl uses the file as \fI%HOME%/_netrc\fP. If \fI%HOME%\fP is
-not set on Windows, libcurl falls back to \fI%USERPROFILE%\fP.
-
-You can also tell libcurl a different file name to use with
-\fICURLOPT_NETRC_FILE(3)\fP.
-
-libcurl uses a user name (and supplied or prompted password) supplied with
-\fICURLOPT_USERPWD(3)\fP or \fICURLOPT_USERNAME(3)\fP in preference to any of
-the options controlled by this parameter.
-
-Only machine name, user name and password are taken into account (init macros
-and similar things are not supported).
-
-libcurl does not verify that the file has the correct properties set (as the
-standard Unix ftp client does). It should only be readable by user.
-
-\fIlevel\fP is a long that should be set to one of the values described below.
-.IP "CURL_NETRC_IGNORED (0)"
-libcurl ignores the \fI.netrc\fP file. This is the default.
-.IP "CURL_NETRC_OPTIONAL (1)"
-The use of the \fI.netrc\fP file is optional, and information in the URL is to
-be preferred. The file is scanned for the host and user name (to find the
-password only) or for the host only, to find the first user name and password
-after that \fImachine\fP, which ever information is not specified.
-.IP "CURL_NETRC_REQUIRED (2)"
-The use of the \fI.netrc\fP file is required, and any credential information
-present in the URL is ignored. The file is scanned for the host and user name
-(to find the password only) or for the host only, to find the first user name
-and password after that \fImachine\fP, which ever information is not
-specified.
-.SH FILE FORMAT
-The \fB.netrc\fP file format is simple: you specify lines with a machine name
-and follow the login and password that are associated with that machine.
-
-Each field is provided as a sequence of letters that ends with a space or
-newline. Starting in 7.84.0, libcurl also supports quoted strings. They start
-and end with double quotes and support the escaped special letters \\\", \\n,
-\\r, and \\t. Quoted strings are the only way a space character can be used in
-a user name or password.
-
-.IP "machine <name>"
-Provides credentials for a host called \fBname\fP. libcurl searches the .netrc
-file for a machine token that matches the host name specified in the URL. Once
-a match is made, the subsequent tokens are processed, stopping when the end of
-file is reached or another "machine" is encountered.
-.IP default
-This is the same as "machine" name except that default matches any name. There
-can be only one default token, and it must be after all machine tokens. To
-provide a default anonymous login for hosts that are not otherwise matched,
-add a line similar to this in the end:
-
- default login anonymous password user@domain
-.IP "login <name>"
-The user name string for the remote machine.
-.IP "password <secret>"
-Supply a password. If this token is present, curl supplies the specified
-string if the remote server requires a password as part of the login process.
-Note that if this token is present in the .netrc file you really should make
-sure the file is not readable by anyone besides the user.
-.IP "macdef <name>"
-Define a macro. This feature is not supported by libcurl. In order for the
-rest of the .netrc to still work fine, libcurl properly skips every definition
-done with "macdef" that it finds.
-.SH DEFAULT
-CURL_NETRC_IGNORED
-.SH PROTOCOLS
-Most
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/");
-  curl_easy_setopt(curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
-  ret = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_USERPWD "(3), " CURLOPT_USERNAME "(3), " CURLOPT_NETRC_FILE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_NETRC.md b/third-party/curl/docs/libcurl/opts/CURLOPT_NETRC.md
new file mode 100644
index 0000000000..1e3dbb1dde
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_NETRC.md
@@ -0,0 +1,159 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_NETRC
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_NETRC_FILE (3)
+  - CURLOPT_USERNAME (3)
+  - CURLOPT_USERPWD (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_NETRC - enable use of .netrc
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_NETRC, long level);
+~~~
+
+# DESCRIPTION
+
+This parameter controls the preference *level* of libcurl between using
+usernames and passwords from your *~/.netrc* file, relative to usernames and
+passwords in the URL supplied with CURLOPT_URL(3). If the `NETRC` environment
+variable is set, that filename is used as the netrc file. (Added in 8.16.0)
+
+On Windows, libcurl primarily checks for *.netrc* in *%HOME%*. If *%HOME%* is
+not set on Windows, libcurl falls back to *%USERPROFILE%*. If the file does
+not exist, it falls back to check if there is instead a file named *_netrc* -
+using an underscore instead of period.
+
+You can also tell libcurl a different filename to use with
+CURLOPT_NETRC_FILE(3).
+
+libcurl uses a username (and supplied or prompted password) supplied with
+CURLOPT_USERPWD(3) or CURLOPT_USERNAME(3) in preference to any of
+the options controlled by this parameter.
+
+Only machine name, username and password are taken into account (init macros
+and similar things are not supported).
+
+The netrc file provides credentials for a hostname independent of which
+protocol and port number that are used.
+
+When providing a username in the URL and a *.netrc* file, libcurl looks for
+and uses the password for that specific user for the given host if such an
+entry appears in the file before a "generic" `machine` entry without `login`
+specified.
+
+libcurl does not verify that the file has the correct properties set (as the
+standard Unix ftp client does). It should only be readable by user.
+
+*level* is a long that should be set to one of the values described below.
+
+## CURL_NETRC_IGNORED (0)
+
+libcurl ignores the *.netrc* file. This is the default.
+
+## CURL_NETRC_OPTIONAL (1)
+
+The use of the *.netrc* file is optional, and information in the URL is to
+be preferred. The file is scanned for the host and username (to find the
+password only) or for the host only, to find the first username and password
+after that *machine*, which ever information is not specified.
+
+## CURL_NETRC_REQUIRED (2)
+
+The use of the *.netrc* file is required, and any credential information
+present in the URL is ignored. The file is scanned for the host and username
+(to find the password only) or for the host only, to find the first username
+and password after that *machine*, which ever information is not
+specified.
+
+# FILE FORMAT
+
+The **.netrc** file format is simple: you specify lines with a machine name
+and follow the login and password that are associated with that machine.
+
+Each field is provided as a sequence of letters that ends with a space or
+newline. Starting in 7.84.0, libcurl also supports quoted strings. They start
+and end with double quotes and support the escaped special letters ", n,
+r, and t. Quoted strings are the only way a space character can be used in
+a username or password.
+
+## machine \<name\>
+
+Provides credentials for a host called **name**. libcurl searches the .netrc
+file for a machine token that matches the hostname specified in the URL. Once
+a match is made, the subsequent tokens are processed, stopping when the end of
+file is reached or another "machine" is encountered.
+
+## default
+
+This is the same as machine name except that default matches any name. There
+can be only one default token, and it must be after all machine tokens. To
+provide a default anonymous login for hosts that are not otherwise matched,
+add a line similar to this in the end:
+
+    default login anonymous password user@domain
+
+## login \<name\>
+
+The username string for the remote machine.
+
+## password \<secret\>
+
+Supply a password. If this token is present, curl supplies the specified
+string if the remote server requires a password as part of the login process.
+Note that if this token is present in the .netrc file you really should make
+sure the file is not readable by anyone besides the user.
+
+## macdef \<name\>
+
+Define a macro. This feature is not supported by libcurl. In order for the
+rest of the .netrc to still work fine, libcurl properly skips every definition
+done with "macdef" that it finds.
+
+# DEFAULT
+
+CURL_NETRC_IGNORED
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/");
+    curl_easy_setopt(curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURL_NETRC_*** enums became `long` types in 8.13.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_NETRC_FILE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_NETRC_FILE.3
deleted file mode 100644
index 1a05540a6a..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_NETRC_FILE.3
+++ /dev/null
@@ -1,63 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_NETRC_FILE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_NETRC_FILE \- file name to read .netrc info from
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_NETRC_FILE, char *file);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter, pointing to a null-terminated string containing
-the full path name to the \fIfile\fP you want libcurl to use as .netrc
-file. If this option is omitted, and \fICURLOPT_NETRC(3)\fP is set, libcurl
-checks for a .netrc file in the current user's home directory.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/");
-  curl_easy_setopt(curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
-  curl_easy_setopt(curl, CURLOPT_NETRC_FILE, "/tmp/magic-netrc");
-  ret = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.10.9
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_NETRC "(3), " CURLOPT_USERNAME "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_NETRC_FILE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_NETRC_FILE.md
new file mode 100644
index 0000000000..dba6f85007
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_NETRC_FILE.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_NETRC_FILE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_NETRC (3)
+  - CURLOPT_PASSWORD (3)
+  - CURLOPT_USERNAME (3)
+Protocol:
+  - All
+Added-in: 7.11.0
+---
+
+# NAME
+
+CURLOPT_NETRC_FILE - filename to read .netrc info from
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_NETRC_FILE, char *file);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter, pointing to a null-terminated string
+containing the full path name to the *file* you want libcurl to use as .netrc
+file. If this option is omitted, and CURLOPT_NETRC(3) is set, libcurl checks
+for a .netrc file in the current user's home directory.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/");
+    curl_easy_setopt(curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
+    curl_easy_setopt(curl, CURLOPT_NETRC_FILE, "/tmp/magic-netrc");
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURL_NETRC_*** enums became `long` types in 8.13.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_NEW_DIRECTORY_PERMS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_NEW_DIRECTORY_PERMS.3
deleted file mode 100644
index 4f0dfd43e0..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_NEW_DIRECTORY_PERMS.3
+++ /dev/null
@@ -1,59 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_NEW_DIRECTORY_PERMS 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_NEW_DIRECTORY_PERMS \- permissions for remotely created directories
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_NEW_DIRECTORY_PERMS,
-                          long mode);
-.SH DESCRIPTION
-Pass a long as a parameter, containing the value of the permissions that is
-set on newly created directories on the remote server. The default value is
-\fI0755\fP, but any valid value can be used.  The only protocols that can use
-this are \fIsftp://\fP, \fIscp://\fP, and \fIfile://\fP.
-.SH DEFAULT
-0755
-.SH PROTOCOLS
-SFTP, SCP and FILE
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "sftp://upload.example.com/newdir/file.zip");
-  curl_easy_setopt(curl, CURLOPT_FTP_CREATE_MISSING_DIRS, 1L);
-  curl_easy_setopt(curl, CURLOPT_NEW_DIRECTORY_PERMS, 0644L);
-  ret = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.16.4
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_NEW_FILE_PERMS "(3), " CURLOPT_UPLOAD "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_NEW_DIRECTORY_PERMS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_NEW_DIRECTORY_PERMS.md
new file mode 100644
index 0000000000..264ae897cd
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_NEW_DIRECTORY_PERMS.md
@@ -0,0 +1,68 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_NEW_DIRECTORY_PERMS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_FTP_CREATE_MISSING_DIRS (3)
+  - CURLOPT_NEW_FILE_PERMS (3)
+  - CURLOPT_UPLOAD (3)
+Protocol:
+  - SFTP
+  - SCP
+  - FILE
+Added-in: 7.16.4
+---
+
+# NAME
+
+CURLOPT_NEW_DIRECTORY_PERMS - permissions for remotely created directories
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_NEW_DIRECTORY_PERMS,
+                          long mode);
+~~~
+
+# DESCRIPTION
+
+Pass a long as a parameter, containing the value of the permissions that is
+set on newly created directories on the remote server. The default value is
+*0755*, but any valid value can be used. The only protocols that can use
+this are `sftp://`, `scp://`, and `file://`.
+
+# DEFAULT
+
+0755
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL,
+                     "sftp://upload.example.com/newdir/file.zip");
+    curl_easy_setopt(curl, CURLOPT_FTP_CREATE_MISSING_DIRS, 1L);
+    curl_easy_setopt(curl, CURLOPT_NEW_DIRECTORY_PERMS, 0644L);
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_NEW_FILE_PERMS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_NEW_FILE_PERMS.3
deleted file mode 100644
index 765064dd4b..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_NEW_FILE_PERMS.3
+++ /dev/null
@@ -1,58 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_NEW_FILE_PERMS 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_NEW_FILE_PERMS \- permissions for remotely created files
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_NEW_FILE_PERMS,
-                          long mode);
-.SH DESCRIPTION
-Pass a long as a parameter, containing the value of the permissions that are
-set on newly created files on the remote server. The default value is
-\fI0644\fP, but any valid value can be used.  The only protocols that can use
-this are \fIsftp://\fP, \fIscp://\fP, and \fIfile://\fP.
-.SH DEFAULT
-0644
-.SH PROTOCOLS
-SFTP, SCP and FILE
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "sftp://upload.example.com/file.txt");
-  curl_easy_setopt(curl, CURLOPT_NEW_FILE_PERMS, 0664L);
-  ret = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.16.4
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_NEW_DIRECTORY_PERMS "(3), " CURLOPT_UPLOAD "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_NEW_FILE_PERMS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_NEW_FILE_PERMS.md
new file mode 100644
index 0000000000..00766f1e7e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_NEW_FILE_PERMS.md
@@ -0,0 +1,64 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_NEW_FILE_PERMS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_NEW_DIRECTORY_PERMS (3)
+  - CURLOPT_UPLOAD (3)
+Protocol:
+  - SFTP
+  - SCP
+  - FILE
+Added-in: 7.16.4
+---
+
+# NAME
+
+CURLOPT_NEW_FILE_PERMS - permissions for remotely created files
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_NEW_FILE_PERMS,
+                          long mode);
+~~~
+
+# DESCRIPTION
+
+Pass a long as a parameter, containing the value of the permissions that are
+set on newly created files on the remote server. The default value is *0644*.
+The only protocols that can use this are `sftp://`, `scp://`, and `file://`.
+
+# DEFAULT
+
+0644
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "sftp://upload.example.com/file.txt");
+    curl_easy_setopt(curl, CURLOPT_NEW_FILE_PERMS, 0664L);
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_NOBODY.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_NOBODY.3
deleted file mode 100644
index 551744f033..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_NOBODY.3
+++ /dev/null
@@ -1,74 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_NOBODY 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_NOBODY \- do the download request without getting the body
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_NOBODY, long opt);
-.fi
-.SH DESCRIPTION
-A long parameter set to 1 tells libcurl to not include the body-part in the
-output when doing what would otherwise be a download. For HTTP(S), this makes
-libcurl do a HEAD request. For most other protocols it means just not asking
-to transfer the body data.
-
-For HTTP operations when \fICURLOPT_NOBODY(3)\fP has been set, disabling this
-option (with 0) makes it a GET again - only if the method is still set to be
-HEAD. The proper way to get back to a GET request is to set
-\fICURLOPT_HTTPGET(3)\fP and for other methods, use the POST or UPLOAD
-options.
-
-Enabling \fICURLOPT_NOBODY(3)\fP means asking for a download without a body.
-
-If you do a transfer with HTTP that involves a method other than HEAD, you get
-a body (unless the resource and server sends a zero byte body for the specific
-URL you request).
-.SH DEFAULT
-0, the body is transferred
-.SH PROTOCOLS
-Most
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* get us the resource without a body - use HEAD! */
-  curl_easy_setopt(curl, CURLOPT_NOBODY, 1L);
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_HTTPGET "(3), " CURLOPT_POSTFIELDS "(3), " CURLOPT_UPLOAD "(3), "
-.BR CURLOPT_REQUEST_TARGET "(3), " CURLOPT_MIMEPOST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_NOBODY.md b/third-party/curl/docs/libcurl/opts/CURLOPT_NOBODY.md
new file mode 100644
index 0000000000..3cf29d8453
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_NOBODY.md
@@ -0,0 +1,82 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_NOBODY
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HTTPGET (3)
+  - CURLOPT_MIMEPOST (3)
+  - CURLOPT_POSTFIELDS (3)
+  - CURLOPT_REQUEST_TARGET (3)
+  - CURLOPT_UPLOAD (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_NOBODY - do the download request without getting the body
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_NOBODY, long opt);
+~~~
+
+# DESCRIPTION
+
+A long parameter set to 1 tells libcurl to not include the body-part in the
+output when doing what would otherwise be a download. For HTTP(S), this makes
+libcurl do a HEAD request. For most other protocols it means not asking to
+transfer the body data.
+
+For HTTP operations when CURLOPT_NOBODY(3) has been set, disabling this
+option (with 0) makes it a GET again - only if the method is still set to be
+HEAD. The proper way to get back to a GET request is to set
+CURLOPT_HTTPGET(3) and for other methods, use the POST or UPLOAD
+options.
+
+Enabling CURLOPT_NOBODY(3) means asking for a download without a body.
+
+If you do a transfer with HTTP that involves a method other than HEAD, you get
+a body (unless the resource and server sends a zero byte body for the specific
+URL you request).
+
+# DEFAULT
+
+0, the body is transferred
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* get us the resource without a body - use HEAD */
+    curl_easy_setopt(curl, CURLOPT_NOBODY, 1L);
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_NOPROGRESS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_NOPROGRESS.3
deleted file mode 100644
index 216b573177..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_NOPROGRESS.3
+++ /dev/null
@@ -1,63 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_NOPROGRESS 3 "16 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_NOPROGRESS \- switch off the progress meter
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_NOPROGRESS, long onoff);
-.fi
-.SH DESCRIPTION
-If \fIonoff\fP is to 1, it tells the library to shut off the progress meter
-completely for requests done with this \fIhandle\fP. It also prevents the
-\fICURLOPT_XFERINFOFUNCTION(3)\fP or \fICURLOPT_PROGRESSFUNCTION(3)\fP from
-getting called.
-.SH DEFAULT
-1, meaning it normally runs without a progress meter.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* enable progress meter */
-  curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK.
-.SH "SEE ALSO"
-.BR CURLOPT_XFERINFOFUNCTION "(3), "
-.BR CURLOPT_PROGRESSFUNCTION "(3), "
-.BR CURLOPT_VERBOSE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_NOPROGRESS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_NOPROGRESS.md
new file mode 100644
index 0000000000..c518359fdd
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_NOPROGRESS.md
@@ -0,0 +1,69 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_NOPROGRESS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DEBUGFUNCTION (3)
+  - CURLOPT_PROGRESSFUNCTION (3)
+  - CURLOPT_VERBOSE (3)
+  - CURLOPT_XFERINFOFUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_NOPROGRESS - switch off the progress meter
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_NOPROGRESS, long onoff);
+~~~
+
+# DESCRIPTION
+
+If *onoff* is to 1, it tells the library to shut off the progress meter
+completely for requests done with this *handle*. It also prevents the
+CURLOPT_XFERINFOFUNCTION(3) or CURLOPT_PROGRESSFUNCTION(3) from
+getting called.
+
+# DEFAULT
+
+1, meaning it normally runs without a progress meter.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* enable progress meter */
+    curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_NOPROXY.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_NOPROXY.3
deleted file mode 100644
index bd07d0e648..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_NOPROXY.3
+++ /dev/null
@@ -1,86 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_NOPROXY 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_NOPROXY \- disable proxy use for specific hosts
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_NOPROXY, char *noproxy);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string. The string consists of a comma
-separated list of host names that do not require a proxy to get reached, even
-if one is specified.  The only wildcard available is a single * character,
-which matches all hosts, and effectively disables the proxy. Each name in this
-list is matched as either a domain which contains the hostname, or the
-hostname itself. For example, "ample.com" would match ample.com, ample.com:80,
-and www.ample.com, but not www.example.com or ample.com.org.
-
-Setting the \fInoproxy\fP string to "" (an empty string) explicitly enables
-the proxy for all host names, even if there is an environment variable set for
-it.
-
-Enter IPv6 numerical addresses in the list of host names without enclosing
-brackets:
-
- "example.com,::1,localhost"
-
-Since 7.86.0, IP addresses specified to this option can be provided using CIDR
-notation: an appended slash and number specifies the number of "network bits"
-out of the address to use in the comparison. For example "192.168.0.0/16"
-would match all addresses starting with "192.168".
-
-The application does not have to keep the string around after setting this
-option.
-.SH "Environment variables"
-If there is an environment variable called \fBno_proxy\fP (or \fBNO_PROXY\fP),
-it is used if the \fICURLOPT_NOPROXY(3)\fP option is not set. It works exactly
-the same way.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-Most
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  /* accept various URLs */
-  curl_easy_setopt(curl, CURLOPT_URL, input);
-  /* use this proxy */
-  curl_easy_setopt(curl, CURLOPT_PROXY, "http://proxy:80");
-  /* ... but make sure this host name is not proxied */
-  curl_easy_setopt(curl, CURLOPT_NOPROXY, "www.example.com");
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.19.4
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY "(3), " CURLOPT_PROXYAUTH "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_NOPROXY.md b/third-party/curl/docs/libcurl/opts/CURLOPT_NOPROXY.md
new file mode 100644
index 0000000000..244f68a5b9
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_NOPROXY.md
@@ -0,0 +1,103 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_NOPROXY
+Section: 3
+Source: libcurl
+Protocol:
+  - All
+See-also:
+  - CURLOPT_PROXY (3)
+  - CURLOPT_PROXYAUTH (3)
+  - CURLOPT_PROXYTYPE (3)
+Added-in: 7.19.4
+---
+
+# NAME
+
+CURLOPT_NOPROXY - disable proxy use for specific hosts
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_NOPROXY, char *noproxy);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string. The string consists of a comma
+separated list of hostnames that do not require a proxy to get reached, even
+if one is specified. The only wildcard available is a single * character,
+which matches all hosts, and effectively disables the proxy. Each name in this
+list is matched as either a domain which contains the hostname, or the
+hostname itself. For example, "ample.com" would match ample.com, ample.com:80,
+and www.ample.com, but not www.example.com or ample.com.org.
+
+Setting the *noproxy* string to "" (an empty string) explicitly enables the
+proxy for all hostnames, even if there is an environment variable set for it.
+
+Enter IPv6 numerical addresses in the list of hostnames without enclosing
+brackets:
+
+    "example.com,::1,localhost"
+
+IP addresses specified to this option can be provided using CIDR notation: an
+appended slash and number specifies the number of "network bits" out of the
+address to use in the comparison. For example "192.168.0.0/16" would match all
+addresses starting with "192.168".
+
+To use international hostnames in this list, add the punycode version of the
+hostname.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# Environment variables
+
+If there is an environment variable called **no_proxy** (or **NO_PROXY**),
+it is used if the CURLOPT_NOPROXY(3) option is not set. It works exactly
+the same way.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    /* accept various URLs */
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* use this proxy */
+    curl_easy_setopt(curl, CURLOPT_PROXY, "http://proxy.example:80");
+    /* ... but make sure this hostname is not proxied */
+    curl_easy_setopt(curl, CURLOPT_NOPROXY, "www.example.com");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+CIDR format support was added in 7.86.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_NOSIGNAL.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_NOSIGNAL.3
deleted file mode 100644
index 2ab15c2b6e..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_NOSIGNAL.3
+++ /dev/null
@@ -1,76 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_NOSIGNAL 3 "16 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_NOSIGNAL \- skip all signal handling
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_NOSIGNAL, long onoff);
-.fi
-.SH DESCRIPTION
-If \fIonoff\fP is 1, libcurl uses no functions that install signal handlers or
-any functions that cause signals to be sent to the process. This option is
-here to allow multi-threaded unix applications to still set/use all timeout
-options etc, without risking getting signals.
-
-If this option is set and libcurl has been built with the standard name
-resolver, timeouts cannot occur while the name resolve takes place. Consider
-building libcurl with the c-ares or threaded resolver backends to enable
-asynchronous DNS lookups, to enable timeouts for name resolves without the use
-of signals.
-
-Setting \fICURLOPT_NOSIGNAL(3)\fP to 1 makes libcurl NOT ask the system to
-ignore SIGPIPE signals, which otherwise are sent by the system when trying to
-send data to a socket which is closed in the other end. libcurl makes an
-effort to never cause such SIGPIPE signals to trigger, but some operating
-systems have no way to avoid them and even on those that have there are some
-corner cases when they may still happen, contrary to our desire. In addition,
-using \fICURLAUTH_NTLM_WB\fP authentication could cause a SIGCHLD signal to be
-raised.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-
-  curl_easy_setopt(curl, CURLOPT_NOSIGNAL, 1L);
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.10
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH SEE ALSO
-.BR CURLOPT_TIMEOUT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_NOSIGNAL.md b/third-party/curl/docs/libcurl/opts/CURLOPT_NOSIGNAL.md
new file mode 100644
index 0000000000..c89b01465b
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_NOSIGNAL.md
@@ -0,0 +1,78 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_NOSIGNAL
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_TIMEOUT (3)
+Protocol:
+  - All
+Added-in: 7.10
+---
+
+# NAME
+
+CURLOPT_NOSIGNAL - skip all signal handling
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_NOSIGNAL, long onoff);
+~~~
+
+# DESCRIPTION
+
+If *onoff* is 1, libcurl uses no functions that install signal handlers or
+any functions that cause signals to be sent to the process. This option is
+here to allow multi-threaded Unix applications to still set/use all timeout
+options etc, without risking getting signals.
+
+If this option is set and libcurl has been built with the standard name
+resolver, timeouts cannot occur while the name resolve takes place. Consider
+building libcurl with the c-ares or threaded resolver backends to enable
+asynchronous DNS lookups, to enable timeouts for name resolves without the use
+of signals.
+
+Setting CURLOPT_NOSIGNAL(3) to 1 makes libcurl NOT ask the system to
+ignore SIGPIPE signals, which otherwise are sent by the system when trying to
+send data to a socket which is closed in the other end. libcurl makes an
+effort to never cause such SIGPIPE signals to trigger, but some operating
+systems have no way to avoid them and even on those that have there are some
+corner cases when they may still happen, contrary to our desire.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+
+    curl_easy_setopt(curl, CURLOPT_NOSIGNAL, 1L);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_OPENSOCKETDATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_OPENSOCKETDATA.3
deleted file mode 100644
index dc1b27a92a..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_OPENSOCKETDATA.3
+++ /dev/null
@@ -1,86 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_OPENSOCKETDATA 3 "16 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_OPENSOCKETDATA \- pointer passed to open socket callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_OPENSOCKETDATA, void *pointer);
-.fi
-.SH DESCRIPTION
-Pass a \fIpointer\fP that is untouched by libcurl and passed as the first
-argument in the open socket callback set with
-\fICURLOPT_OPENSOCKETFUNCTION(3)\fP.
-.SH DEFAULT
-The default value of this parameter is NULL.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-/* make libcurl use the already established socket 'sockfd' */
-
-static curl_socket_t opensocket(void *clientp,
-                                curlsocktype purpose,
-                                struct curl_sockaddr *address)
-{
-  curl_socket_t sockfd;
-  sockfd = *(curl_socket_t *)clientp;
-  /* the actual externally set socket is passed in via the OPENSOCKETDATA
-     option */
-  return sockfd;
-}
-
-static int sockopt_callback(void *clientp, curl_socket_t curlfd,
-                            curlsocktype purpose)
-{
-  /* This return code was added in libcurl 7.21.5 */
-  return CURL_SOCKOPT_ALREADY_CONNECTED;
-}
-
-curl = curl_easy_init();
-if(curl) {
-  /* libcurl thinks that you connect to the host
-   * and port that you specify in the URL option. */
-  curl_easy_setopt(curl, CURLOPT_URL, "http://99.99.99.99:9999");
-  /* call this function to get a socket */
-  curl_easy_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, opensocket);
-  curl_easy_setopt(curl, CURLOPT_OPENSOCKETDATA, &sockfd);
-
-  /* call this function to set options for the socket */
-  curl_easy_setopt(curl, CURLOPT_SOCKOPTFUNCTION, sockopt_callback);
-
-  res = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.17.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_OPENSOCKETFUNCTION "(3), " CURLOPT_SOCKOPTFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_OPENSOCKETDATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_OPENSOCKETDATA.md
new file mode 100644
index 0000000000..2bcdee3b66
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_OPENSOCKETDATA.md
@@ -0,0 +1,93 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_OPENSOCKETDATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CLOSESOCKETFUNCTION (3)
+  - CURLOPT_OPENSOCKETFUNCTION (3)
+  - CURLOPT_SOCKOPTFUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.17.1
+---
+
+# NAME
+
+CURLOPT_OPENSOCKETDATA - pointer passed to open socket callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_OPENSOCKETDATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+Pass a *pointer* that is untouched by libcurl and passed as the first
+argument in the open socket callback set with
+CURLOPT_OPENSOCKETFUNCTION(3).
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+/* make libcurl use the already established socket 'sockfd' */
+
+static curl_socket_t opensocket(void *clientp,
+                                curlsocktype purpose,
+                                struct curl_sockaddr *address)
+{
+  curl_socket_t sockfd;
+  sockfd = *(curl_socket_t *)clientp;
+  /* the actual externally set socket is passed in via the OPENSOCKETDATA
+     option */
+  return sockfd;
+}
+
+static int sockopt_callback(void *clientp, curl_socket_t curlfd,
+                            curlsocktype purpose)
+{
+  return CURL_SOCKOPT_ALREADY_CONNECTED;
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    extern int sockfd; /* the already connected one */
+
+    /* libcurl thinks that you connect to the host
+     * and port that you specify in the URL option. */
+    curl_easy_setopt(curl, CURLOPT_URL, "http://99.99.99.99:9999");
+    /* call this function to get a socket */
+    curl_easy_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, opensocket);
+    curl_easy_setopt(curl, CURLOPT_OPENSOCKETDATA, &sockfd);
+
+    /* call this function to set options for the socket */
+    curl_easy_setopt(curl, CURLOPT_SOCKOPTFUNCTION, sockopt_callback);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_OPENSOCKETFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_OPENSOCKETFUNCTION.3
deleted file mode 100644
index f936271d0e..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_OPENSOCKETFUNCTION.3
+++ /dev/null
@@ -1,127 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_OPENSOCKETFUNCTION 3 "16 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_OPENSOCKETFUNCTION \- callback for opening socket
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-typedef enum  {
-  CURLSOCKTYPE_IPCXN,  /* socket created for a specific IP connection */
-} curlsocktype;
-
-struct curl_sockaddr {
-  int family;
-  int socktype;
-  int protocol;
-  unsigned int addrlen;
-  struct sockaddr addr;
-};
-
-curl_socket_t opensocket_callback(void *clientp,
-                                  curlsocktype purpose,
-                                  struct curl_sockaddr *address);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_OPENSOCKETFUNCTION, opensocket_callback);
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-This callback function gets called by libcurl instead of the \fIsocket(2)\fP
-call. The callback's \fIpurpose\fP argument identifies the exact purpose for
-this particular socket. \fICURLSOCKTYPE_IPCXN\fP is for IP based connections
-and is the only purpose currently used in libcurl. Future versions of libcurl
-may support more purposes.
-
-The \fIclientp\fP pointer contains whatever user-defined value set using the
-\fICURLOPT_OPENSOCKETDATA(3)\fP function.
-
-The callback gets the resolved peer address as the \fIaddress\fP argument and
-is allowed to modify the address or refuse to connect completely. The callback
-function should return the newly created socket or \fICURL_SOCKET_BAD\fP in
-case no connection could be established or another error was detected. Any
-additional \fIsetsockopt(2)\fP calls can of course be done on the socket at
-the user's discretion. A \fICURL_SOCKET_BAD\fP return value from the callback
-function signals an unrecoverable error to libcurl and it returns
-\fICURLE_COULDNT_CONNECT\fP from the function that triggered this callback.
-This return code can be used for IP address block listing.
-
-If you want to pass in a socket with an already established connection, pass
-the socket back with this callback and then use
-\fICURLOPT_SOCKOPTFUNCTION(3)\fP to signal that it already is connected.
-.SH DEFAULT
-The default behavior is the equivalent of this:
-.nf
-   return socket(addr->family, addr->socktype, addr->protocol);
-.fi
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-/* make libcurl use the already established socket 'sockfd' */
-
-static curl_socket_t opensocket(void *clientp,
-                                curlsocktype purpose,
-                                struct curl_sockaddr *address)
-{
-  curl_socket_t sockfd;
-  sockfd = *(curl_socket_t *)clientp;
-  /* the actual externally set socket is passed in via the OPENSOCKETDATA
-     option */
-  return sockfd;
-}
-
-static int sockopt_callback(void *clientp, curl_socket_t curlfd,
-                            curlsocktype purpose)
-{
-  /* This return code was added in libcurl 7.21.5 */
-  return CURL_SOCKOPT_ALREADY_CONNECTED;
-}
-
-curl = curl_easy_init();
-if(curl) {
-  /* libcurl thinks that you connect to the host
-   * and port that you specify in the URL option. */
-  curl_easy_setopt(curl, CURLOPT_URL, "http://99.99.99.99:9999");
-  /* call this function to get a socket */
-  curl_easy_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, opensocket);
-  curl_easy_setopt(curl, CURLOPT_OPENSOCKETDATA, &sockfd);
-
-  /* call this function to set options for the socket */
-  curl_easy_setopt(curl, CURLOPT_SOCKOPTFUNCTION, sockopt_callback);
-
-  res = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.17.1.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_OPENSOCKETDATA "(3), " CURLOPT_SOCKOPTFUNCTION "(3), "
-.BR CURLOPT_CLOSESOCKETFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_OPENSOCKETFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_OPENSOCKETFUNCTION.md
new file mode 100644
index 0000000000..568fb11b94
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_OPENSOCKETFUNCTION.md
@@ -0,0 +1,140 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_OPENSOCKETFUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CLOSESOCKETFUNCTION (3)
+  - CURLOPT_OPENSOCKETFUNCTION (3)
+  - CURLOPT_SOCKOPTFUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.17.1
+---
+
+# NAME
+
+CURLOPT_OPENSOCKETFUNCTION - callback for opening socket
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+typedef enum {
+  CURLSOCKTYPE_IPCXN,  /* socket created for a specific IP connection */
+} curlsocktype;
+
+struct curl_sockaddr {
+  int family;
+  int socktype;
+  int protocol;
+  unsigned int addrlen;
+  struct sockaddr addr;
+};
+
+curl_socket_t opensocket_callback(void *clientp,
+                                  curlsocktype purpose,
+                                  struct curl_sockaddr *address);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_OPENSOCKETFUNCTION, opensocket_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+This callback function gets called by libcurl instead of the *socket(2)*
+call. The callback's *purpose* argument identifies the exact purpose for
+this particular socket. *CURLSOCKTYPE_IPCXN* is for IP based connections
+and is the only purpose currently used in libcurl. Future versions of libcurl
+may support more purposes.
+
+The *clientp* pointer contains whatever user-defined value set using the
+CURLOPT_OPENSOCKETDATA(3) function.
+
+The callback gets the resolved peer address as the *address* argument and
+is allowed to modify the address or refuse to connect completely. The callback
+function should return the newly created socket or *CURL_SOCKET_BAD* in
+case no connection could be established or another error was detected. Any
+additional *setsockopt(2)* calls can of course be done on the socket at
+the user's discretion.
+
+If *CURL_SOCKET_BAD* is returned by the callback then libcurl treats it as a
+failed connection and tries to open a socket to connect to a different IP
+address associated with the transfer. If there are no more addresses to try
+then libcurl fails the transfer with error code *CURLE_COULDNT_CONNECT*.
+
+You can get the IP address that curl is opening the socket for by casting
+*address-\>addr* to `sockaddr_in` if *address-\>family* is `AF_INET`, or to
+`sockaddr_in6` if *address-\>family* is `AF_INET6`. For an example of how that
+data can be compared against refer to *docs/examples/block_ip.c*.
+
+If you want to pass in a socket with an already established connection, pass
+the socket back with this callback and then use CURLOPT_SOCKOPTFUNCTION(3) to
+signal that it already is connected.
+
+# DEFAULT
+
+The equivalent of this:
+~~~c
+  return socket(addr->family, addr->socktype, addr->protocol);
+~~~
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+/* make libcurl use the already established socket 'sockfd' */
+
+static curl_socket_t opensocket(void *clientp,
+                                curlsocktype purpose,
+                                struct curl_sockaddr *address)
+{
+  curl_socket_t sockfd;
+  sockfd = *(curl_socket_t *)clientp;
+  /* the actual externally set socket is passed in via the OPENSOCKETDATA
+     option */
+  return sockfd;
+}
+
+static int sockopt_callback(void *clientp, curl_socket_t curlfd,
+                            curlsocktype purpose)
+{
+  return CURL_SOCKOPT_ALREADY_CONNECTED;
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    extern int sockfd; /* the already connected one */
+    /* libcurl thinks that you connect to the host
+     * and port that you specify in the URL option. */
+    curl_easy_setopt(curl, CURLOPT_URL, "http://99.99.99.99:9999");
+    /* call this function to get a socket */
+    curl_easy_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, opensocket);
+    curl_easy_setopt(curl, CURLOPT_OPENSOCKETDATA, &sockfd);
+
+    /* call this function to set options for the socket */
+    curl_easy_setopt(curl, CURLOPT_SOCKOPTFUNCTION, sockopt_callback);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PASSWORD.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PASSWORD.3
deleted file mode 100644
index db6c862abd..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PASSWORD.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PASSWORD 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_PASSWORD \- password to use in authentication
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PASSWORD, char *pwd);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter, which should be pointing to the null-terminated
-password to use for the transfer.
-
-The \fICURLOPT_PASSWORD(3)\fP option should be used in conjunction with the
-\fICURLOPT_USERNAME(3)\fP option.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-blank
-.SH PROTOCOLS
-Most
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-
-  curl_easy_setopt(curl, CURLOPT_PASSWORD, "qwerty");
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.19.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_USERPWD "(3), " CURLOPT_USERNAME "(3), "
-.BR CURLOPT_HTTPAUTH "(3), " CURLOPT_PROXYAUTH "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PASSWORD.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PASSWORD.md
new file mode 100644
index 0000000000..f8b9ee752d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PASSWORD.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PASSWORD
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HTTPAUTH (3)
+  - CURLOPT_PROXYAUTH (3)
+  - CURLOPT_USERNAME (3)
+  - CURLOPT_USERPWD (3)
+Protocol:
+  - All
+Added-in: 7.19.1
+---
+
+# NAME
+
+CURLOPT_PASSWORD - password to use in authentication
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PASSWORD, char *pwd);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter, which should be pointing to the
+null-terminated password to use for the transfer.
+
+The CURLOPT_PASSWORD(3) option should be used in conjunction with the
+CURLOPT_USERNAME(3) option.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+blank
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+
+    curl_easy_setopt(curl, CURLOPT_PASSWORD, "qwerty");
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PATH_AS_IS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PATH_AS_IS.3
deleted file mode 100644
index 8545fb4d74..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PATH_AS_IS.3
+++ /dev/null
@@ -1,71 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PATH_AS_IS 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_PATH_AS_IS \- do not handle dot dot sequences
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PATH_AS_IS, long leaveit);
-.fi
-.SH DESCRIPTION
-Set the long \fIleaveit\fP to 1, to explicitly tell libcurl to not alter the
-given path before passing it on to the server.
-
-This instructs libcurl to NOT squash sequences of "/../" or "/./" that may
-exist in the URL's path part and that is supposed to be removed according to
-RFC 3986 section 5.2.4.
-
-Some server implementations are known to (erroneously) require the dot dot
-sequences to remain in the path and some clients want to pass these on in
-order to try out server implementations.
-
-By default libcurl normalizes such sequences before using the path.
-
-The corresponding flag for the \fIcurl_url_set(3)\fP function is called
-\fBCURLU_PATH_AS_IS\fP.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/../../etc/password");
-
-  curl_easy_setopt(curl, CURLOPT_PATH_AS_IS, 1L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.42.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_STDERR "(3), " CURLOPT_DEBUGFUNCTION "(3), "
-.BR CURLOPT_URL "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PATH_AS_IS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PATH_AS_IS.md
new file mode 100644
index 0000000000..c78eaa7e4e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PATH_AS_IS.md
@@ -0,0 +1,82 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PATH_AS_IS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DEBUGFUNCTION (3)
+  - CURLOPT_STDERR (3)
+  - CURLOPT_URL (3)
+  - curl_url_set (3)
+Protocol:
+  - All
+Added-in: 7.42.0
+---
+
+# NAME
+
+CURLOPT_PATH_AS_IS - do not handle dot-dot sequences
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PATH_AS_IS, long leaveit);
+~~~
+
+# DESCRIPTION
+
+Set the long *leaveit* to 1, to explicitly tell libcurl to not alter the
+given path before passing it on to the server.
+
+This instructs libcurl to NOT squash sequences of "/../" or "/./" that may
+exist in the URL's path part and that is supposed to be removed according to
+RFC 3986 section 5.2.4.
+
+Some server implementations are known to (erroneously) require the dot-dot
+sequences to remain in the path and some clients want to pass these on in
+order to try out server implementations.
+
+By default libcurl normalizes such sequences before using the path.
+
+This is a request for the *first* request libcurl issues. When following
+redirects, it may no longer apply.
+
+The corresponding flag for the curl_url_set(3) function is called
+**CURLU_PATH_AS_IS**.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL,
+                     "https://example.com/../../etc/password");
+
+    curl_easy_setopt(curl, CURLOPT_PATH_AS_IS, 1L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.3
deleted file mode 100644
index dd5e5dc871..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.3
+++ /dev/null
@@ -1,131 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PINNEDPUBLICKEY 3 "27 Aug 2014" libcurl libcurl
-.SH NAME
-CURLOPT_PINNEDPUBLICKEY \- pinned public key
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PINNEDPUBLICKEY,
-                          char *pinnedpubkey);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter. The string can be the
-file name of your pinned public key. The file format expected is "PEM" or "DER".
-The string can also be any number of base64 encoded sha256 hashes preceded by
-"sha256//" and separated by ";"
-
-When negotiating a TLS or SSL connection, the server sends a certificate
-indicating its identity. A public key is extracted from this certificate and
-if it does not exactly match the public key provided to this option, curl
-aborts the connection before sending or receiving any data.
-
-On mismatch, \fICURLE_SSL_PINNEDPUBKEYNOTMATCH\fP is returned.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_PINNEDPUBLICKEY, "/etc/publickey.der");
-  /* OR
-  curl_easy_setopt(curl, CURLOPT_PINNEDPUBLICKEY, "sha256//YhKJKSzoTt2b5FP18fvpHo7fJYqQCjAa3HWY3tvRMwE=;sha256//t62CeU2tQiqkexU74Gxa2eg7fRbEgoChTociMee9wno=");
-  */
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH PUBLIC KEY EXTRACTION
-If you do not have the server's public key file you can extract it from the
-server's certificate.
-.nf
-# retrieve the server's certificate if you do not already have it
-#
-# be sure to examine the certificate to see if it is what you expected
-#
-# Windows-specific:
-# - Use NUL instead of /dev/null.
-# - OpenSSL may wait for input instead of disconnecting. Hit enter.
-# - If you do not have sed, then just copy the certificate into a file:
-#   Lines from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----.
-#
-openssl s_client -servername www.example.com -connect www.example.com:443 < /dev/null | sed -n "/-----BEGIN/,/-----END/p" > www.example.com.pem
-
-# extract public key in pem format from certificate
-openssl x509 -in www.example.com.pem -pubkey -noout > www.example.com.pubkey.pem
-
-# convert public key from pem to der
-openssl asn1parse -noout -inform pem -in www.example.com.pubkey.pem -out www.example.com.pubkey.der
-
-# sha256 hash and base64 encode der to string for use
-openssl dgst -sha256 -binary www.example.com.pubkey.der | openssl base64
-.fi
-The public key in PEM format contains a header, base64 data and a
-footer:
-.nf
------BEGIN PUBLIC KEY-----
-[BASE 64 DATA]
------END PUBLIC KEY-----
-.fi
-.SH AVAILABILITY
-PEM/DER support:
-
-  7.39.0: OpenSSL, GnuTLS
-
-  7.43.0: wolfSSL
-
-  7.47.0: mbedTLS
-
-  7.54.1: Secure Transport on macOS 10.7+/iOS 10+
-
-  7.58.1: Schannel
-
-sha256 support:
-
-  7.44.0: OpenSSL, GnuTLS and wolfSSL
-
-  7.47.0: mbedTLS
-
-  7.54.1: Secure Transport on macOS 10.7+/iOS 10+
-
-  7.58.1: Schannel Windows XP SP3+
-
-Other SSL backends not supported.
-.SH RETURN VALUE
-Returns CURLE_OK if TLS enabled, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_SSL_VERIFYPEER "(3), "
-.BR CURLOPT_SSL_VERIFYHOST "(3), "
-.BR CURLOPT_CAINFO "(3), "
-.BR CURLOPT_CAPATH "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.md
new file mode 100644
index 0000000000..ed4011d57f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.md
@@ -0,0 +1,161 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PINNEDPUBLICKEY
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CAINFO (3)
+  - CURLOPT_CAPATH (3)
+  - CURLOPT_SSL_VERIFYHOST (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+  - wolfSSL
+  - mbedTLS
+  - Schannel
+Added-in: 7.39.0
+---
+
+# NAME
+
+CURLOPT_PINNEDPUBLICKEY - pinned public key
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PINNEDPUBLICKEY,
+                          char *pinnedpubkey);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter. The string can be the
+filename of your pinned public key. The file format expected is `PEM` or
+`DER`. The string can also be any number of base64 encoded sha256 hashes
+preceded by `sha256//` and separated by `;`.
+
+When negotiating a TLS or SSL connection, the server sends a certificate
+indicating its identity. A public key is extracted from this certificate and
+if it does not exactly match the public key provided to this option, curl
+aborts the connection before sending or receiving any data.
+
+This option is independent of option CURLOPT_SSL_VERIFYPEER(3). If you turn
+off that option then the peer is still verified by public key.
+
+On mismatch, *CURLE_SSL_PINNEDPUBKEYNOTMATCH* is returned.
+
+The application does not have to keep the string around after setting this
+option.
+
+The pinned public key is used to verify the initial origin used in a transfer.
+If the transfer is set to follow redirects to other origins, they are *not*
+checked against this key.
+
+This option has no effect on LDAP connections when libcurl uses the legacy LDAP
+backend. That backend manages TLS independently of curl's TLS layer. When
+libcurl is built with USE_OPENLDAP, the OpenLDAP backend routes TLS through
+curl's layer and this option is honored.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_PINNEDPUBLICKEY, "/etc/publickey.der");
+    /* OR
+    curl_easy_setopt(curl, CURLOPT_PINNEDPUBLICKEY,
+                     "sha256//YhKJKSzoTt2b5FP18fvpHo7fJYqQCjAa3HWY3"
+                     "tvRMwE=;sha256//t62CeU2tQiqkexU74Gxa2eg7fRbEg"
+                     "oChTociMee9wno=");
+    */
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# PUBLIC KEY EXTRACTION
+
+If you do not have the server's public key file you can extract it from the
+server's certificate.
+~~~
+# retrieve the server's certificate if you do not already have it
+#
+# be sure to examine the certificate to see if it is what you expected
+#
+# Windows-specific:
+# - Use NUL instead of /dev/null.
+# - OpenSSL may wait for input instead of disconnecting. Hit enter.
+# - If you do not have sed, then copy the certificate into a file:
+#   Lines from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----.
+#
+openssl s_client -servername www.example.com -connect www.example.com:443 \
+  < /dev/null | sed -n "/-----BEGIN/,/-----END/p" > www.example.com.pem
+
+# extract public key in pem format from certificate
+openssl x509 -in www.example.com.pem -pubkey -noout > www.example.com.pubkey.pem
+
+# convert public key from pem to der
+openssl asn1parse -noout -inform pem -in www.example.com.pubkey.pem \
+  -out www.example.com.pubkey.der
+
+# sha256 hash and base64 encode der to string for use
+openssl dgst -sha256 -binary www.example.com.pubkey.der | openssl base64
+~~~
+
+The public key in PEM format contains a header, base64 data and a
+footer:
+~~~
+-----BEGIN PUBLIC KEY-----
+[BASE 64 DATA]
+-----END PUBLIC KEY-----
+~~~
+
+# HISTORY
+
+## PEM/DER support
+
+7.39.0: OpenSSL, GnuTLS
+
+7.43.0: wolfSSL
+
+7.47.0: mbedTLS
+
+7.58.1: Schannel
+
+## sha256 support
+
+7.44.0: OpenSSL, GnuTLS and wolfSSL
+
+7.47.0: mbedTLS
+
+7.58.1: Schannel
+
+Other SSL backends not supported.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PIPEWAIT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PIPEWAIT.3
deleted file mode 100644
index 5a73fed1b2..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PIPEWAIT.3
+++ /dev/null
@@ -1,75 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PIPEWAIT 3 "12 May 2015" libcurl libcurl
-.SH NAME
-CURLOPT_PIPEWAIT \- wait for multiplexing
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PIPEWAIT, long wait);
-.fi
-.SH DESCRIPTION
-Set \fIwait\fP to 1L to tell libcurl to prefer to wait for a connection to
-confirm or deny that it can do multiplexing before continuing.
-
-When about to perform a new transfer that allows multiplexing, libcurl checks
-for existing connections to use. If no such connection exists it immediately
-continues and creates a fresh new connection to use.
-
-By setting this option to 1 - and having \fICURLMOPT_PIPELINING(3)\fP enabled
-for the multi handle this transfer is associated with - libcurl instead waits
-for the connection to reveal if it is possible to multiplex on before it
-continues. This enables libcurl to much better keep the number of connections
-to a minimum when using multiplexing protocols.
-
-With this option set, libcurl prefers to wait and reuse an existing connection
-for multiplexing rather than the opposite: prefer to open a new connection
-rather than waiting.
-
-The waiting time is as long as it takes for the connection to get up and for
-libcurl to get the necessary response back that informs it about its protocol
-and support level.
-.SH DEFAULT
-0 (off)
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_PIPEWAIT, 1L);
-
-  /* now add this easy handle to the multi handle */
-}
-.fi
-.SH AVAILABILITY
-Added in 7.43.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_FORBID_REUSE "(3), " CURLOPT_FRESH_CONNECT "(3), "
-.BR CURLMOPT_PIPELINING "(3), " CURLMOPT_MAX_HOST_CONNECTIONS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PIPEWAIT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PIPEWAIT.md
new file mode 100644
index 0000000000..745b294584
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PIPEWAIT.md
@@ -0,0 +1,80 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PIPEWAIT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_MAX_HOST_CONNECTIONS (3)
+  - CURLMOPT_PIPELINING (3)
+  - CURLOPT_FORBID_REUSE (3)
+  - CURLOPT_FRESH_CONNECT (3)
+Protocol:
+  - HTTP
+Added-in: 7.43.0
+---
+
+# NAME
+
+CURLOPT_PIPEWAIT - wait for multiplexing
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PIPEWAIT, long wait);
+~~~
+
+# DESCRIPTION
+
+Set *wait* to 1L to tell libcurl to prefer to wait for a connection to
+confirm or deny that it can do multiplexing before continuing.
+
+When about to perform a new transfer that allows multiplexing, libcurl checks
+for existing connections to use. If no such connection exists it immediately
+continues and creates a fresh new connection to use.
+
+By setting this option to 1 - and having CURLMOPT_PIPELINING(3) enabled
+for the multi handle this transfer is associated with - libcurl instead waits
+for the connection to reveal if it is possible to multiplex on before it
+continues. This enables libcurl to much better keep the number of connections
+to a minimum when using multiplexing protocols.
+
+With this option set, libcurl prefers to wait and reuse an existing connection
+for multiplexing rather than the opposite: prefer to open a new connection
+rather than waiting.
+
+The waiting time is as long as it takes for the connection to get up and for
+libcurl to get the necessary response back that informs it about its protocol
+and support level.
+
+# DEFAULT
+
+0 (off)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_PIPEWAIT, 1L);
+
+    /* now add this easy handle to the multi handle */
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PORT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PORT.3
deleted file mode 100644
index ceee890cc4..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PORT.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PORT 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_PORT \- remote port number to connect to
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PORT, long number);
-.fi
-.SH DESCRIPTION
-We discourage using this option since its scope is not obvious and hard to
-predict. Set the preferred port number in the URL instead.
-
-This option sets \fInumber\fP to be the remote port number to connect to,
-instead of the one specified in the URL or the default port for the used
-protocol.
-
-Usually, you just let the URL decide which port to use but this allows the
-application to override that.
-
-While this option accepts a 'long', a port number is an unsigned 16 bit number
-and therefore using a port number lower than zero or over 65535 causes a
-\fBCURLE_BAD_FUNCTION_ARGUMENT\fP error.
-.SH DEFAULT
-By default this is 0 which makes it not used. This also makes port number zero
-impossible to set with this API.
-.SH PROTOCOLS
-Used for all protocols that speak to a port number.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-  curl_easy_setopt(curl, CURLOPT_PORT, 8080L);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_STDERR "(3), " CURLOPT_DEBUGFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PORT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PORT.md
new file mode 100644
index 0000000000..567d6a975a
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PORT.md
@@ -0,0 +1,74 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PORT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_PRIMARY_PORT (3)
+  - CURLOPT_STDERR (3)
+  - CURLOPT_URL (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_PORT - remote port number to connect to
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PORT, long number);
+~~~
+
+# DESCRIPTION
+
+We strongly discourage using this unreliable option since its scope is not
+obvious and hard to predict. Set the preferred port number in the URL instead.
+
+This option sets *number* to be the remote port number to connect to,
+instead of the one specified in the URL or the default port for the used
+protocol.
+
+Usually, you let the URL decide which port to use but this allows the
+application to override that.
+
+While this option accepts a 'long', a port number is an unsigned 16-bit number
+and therefore using a port number lower than zero or over 65535 causes a
+**CURLE_BAD_FUNCTION_ARGUMENT** error.
+
+# DEFAULT
+
+0 which makes it not used. This also makes port number zero impossible to set
+with this API.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+    curl_easy_setopt(curl, CURLOPT_PORT, 8080L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_POST.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_POST.3
deleted file mode 100644
index e824ef7ab7..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_POST.3
+++ /dev/null
@@ -1,98 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_POST 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_POST \- make an HTTP POST
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_POST, long post);
-.fi
-.SH DESCRIPTION
-A parameter set to 1 tells libcurl to do a regular HTTP post. This also makes
-libcurl use a "Content-Type: application/x-www-form-urlencoded" header. This
-is the most commonly used POST method.
-
-Use one of \fICURLOPT_POSTFIELDS(3)\fP or \fICURLOPT_COPYPOSTFIELDS(3)\fP
-options to specify what data to post and \fICURLOPT_POSTFIELDSIZE(3)\fP or
-\fICURLOPT_POSTFIELDSIZE_LARGE(3)\fP to set the data size.
-
-Optionally, you can provide data to POST using the
-\fICURLOPT_READFUNCTION(3)\fP and \fICURLOPT_READDATA(3)\fP options but then
-you must make sure to not set \fICURLOPT_POSTFIELDS(3)\fP to anything but
-NULL. When providing data with a callback, you must transmit it using chunked
-transfer-encoding or you must set the size of the data with the
-\fICURLOPT_POSTFIELDSIZE(3)\fP or \fICURLOPT_POSTFIELDSIZE_LARGE(3)\fP
-options. To enable chunked encoding, you simply pass in the appropriate
-Transfer-Encoding header, see the post-callback.c example.
-
-You can override the default POST Content-Type: header by setting your own
-with \fICURLOPT_HTTPHEADER(3)\fP.
-
-Using POST with HTTP 1.1 implies the use of a "Expect: 100-continue" header.
-You can disable this header with \fICURLOPT_HTTPHEADER(3)\fP as usual.
-
-If you use POST to an HTTP 1.1 server, you can send data without knowing the
-size before starting the POST if you use chunked encoding. You enable this by
-adding a header like "Transfer-Encoding: chunked" with
-\fICURLOPT_HTTPHEADER(3)\fP. With HTTP 1.0 or without chunked transfer, you
-must specify the size in the request. (Since 7.66.0, libcurl automatically
-uses chunked encoding for POSTs if the size is unknown.)
-
-When setting \fICURLOPT_POST(3)\fP to 1, libcurl automatically sets
-\fICURLOPT_NOBODY(3)\fP and \fICURLOPT_HTTPGET(3)\fP to 0.
-
-If you issue a POST request and then want to make a HEAD or GET using the same
-reused handle, you must explicitly set the new request type using
-\fICURLOPT_NOBODY(3)\fP or \fICURLOPT_HTTPGET(3)\fP or similar.
-
-When setting \fICURLOPT_POST(3)\fP to 0, libcurl resets the request type to
-the default to disable the POST. Typically that would mean it's reset to GET.
-Instead you should set a new request type explicitly as described above.
-.SH DEFAULT
-0, disabled
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-  curl_easy_setopt(curl, CURLOPT_POST, 1L);
-
-  /* set up the read callback with CURLOPT_READFUNCTION */
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Along with HTTP
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_POSTFIELDS "(3), " CURLOPT_HTTPPOST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_POST.md b/third-party/curl/docs/libcurl/opts/CURLOPT_POST.md
new file mode 100644
index 0000000000..1bc634a04f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_POST.md
@@ -0,0 +1,104 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_POST
+Section: 3
+Source: libcurl
+Protocol:
+  - HTTP
+See-also:
+  - CURLOPT_HTTPPOST (3)
+  - CURLOPT_POSTFIELDS (3)
+  - CURLOPT_UPLOAD (3)
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_POST - make an HTTP POST
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_POST, long post);
+~~~
+
+# DESCRIPTION
+
+A parameter set to 1 tells libcurl to do a regular HTTP post. This also makes
+libcurl use a "Content-Type: application/x-www-form-urlencoded" header. This
+is the most commonly used POST method.
+
+Use one of CURLOPT_POSTFIELDS(3) or CURLOPT_COPYPOSTFIELDS(3)
+options to specify what data to post and CURLOPT_POSTFIELDSIZE(3) or
+CURLOPT_POSTFIELDSIZE_LARGE(3) to set the data size.
+
+Optionally, you can provide data to POST using the
+CURLOPT_READFUNCTION(3) and CURLOPT_READDATA(3) options but then
+you must make sure to not set CURLOPT_POSTFIELDS(3) to anything but
+NULL. When providing data with a callback, you must transmit it using chunked
+transfer-encoding or you must set the size of the data with the
+CURLOPT_POSTFIELDSIZE(3) or CURLOPT_POSTFIELDSIZE_LARGE(3)
+options. To enable chunked encoding, pass in the appropriate
+Transfer-Encoding header, see the post-callback.c example.
+
+You can override the default POST Content-Type: header by setting your own
+with CURLOPT_HTTPHEADER(3).
+
+Using POST with HTTP 1.1 implies the use of a "Expect: 100-continue" header.
+You can disable this header with CURLOPT_HTTPHEADER(3) as usual.
+
+If you use POST to an HTTP 1.1 server, you can send data without knowing the
+size before starting the POST if you use chunked encoding. You enable this by
+adding a header like "Transfer-Encoding: chunked" with CURLOPT_HTTPHEADER(3).
+With HTTP 1.0 or without chunked transfer, you must specify the size in the
+request. libcurl automatically uses chunked encoding for POSTs if the size is
+unknown.
+
+When setting CURLOPT_POST(3) to 1, libcurl automatically sets
+CURLOPT_NOBODY(3) and CURLOPT_HTTPGET(3) to 0.
+
+If you issue a POST request and then want to make a HEAD or GET using the same
+reused handle, you must explicitly set the new request type using
+CURLOPT_NOBODY(3) or CURLOPT_HTTPGET(3) or similar.
+
+When setting CURLOPT_POST(3) to 0, libcurl resets the request type to the
+default to disable the POST. Typically that means gets reset to GET. Instead
+you should set a new request type explicitly as described above.
+
+# DEFAULT
+
+0, disabled
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+    curl_easy_setopt(curl, CURLOPT_POST, 1L);
+
+    /* set up the read callback with CURLOPT_READFUNCTION */
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDS.3
deleted file mode 100644
index 6efcf31139..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDS.3
+++ /dev/null
@@ -1,121 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_POSTFIELDS 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_POSTFIELDS \- data to POST to server
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_POSTFIELDS, char *postdata);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter, pointing to the data buffer to use in an HTTP POST
-operation. The data must be formatted and encoded the way you want the server
-to receive it. libcurl does not convert or encode it in any way. For example,
-the web server may assume that this data is URL encoded.
-
-The data pointed to is NOT copied by the library: as a consequence, it must be
-preserved by the calling application until the associated transfer finishes.
-This behavior can be changed (so libcurl does copy the data) by instead using
-the \fICURLOPT_COPYPOSTFIELDS(3)\fP option.
-
-This POST is a normal \fBapplication/x-www-form-urlencoded\fP kind (and
-libcurl sets that Content-Type by default when this option is used), which is
-commonly used by HTML forms. Change Content-Type with
-\fICURLOPT_HTTPHEADER(3)\fP.
-
-You can use \fIcurl_easy_escape(3)\fP to URL encode your data, if
-necessary. It returns a pointer to an encoded string that can be passed as
-\fIpostdata\fP.
-
-Using \fICURLOPT_POSTFIELDS(3)\fP implies setting \fICURLOPT_POST(3)\fP to 1.
-
-If \fICURLOPT_POSTFIELDS(3)\fP is explicitly set to NULL then libcurl gets the
-POST data from the read callback. If you want to send a zero-byte POST set
-\fICURLOPT_POSTFIELDS(3)\fP to an empty string, or set \fICURLOPT_POST(3)\fP
-to 1 and \fICURLOPT_POSTFIELDSIZE(3)\fP to 0.
-
-libcurl assumes this option points to a null-terminated string unless you also
-set \fICURLOPT_POSTFIELDSIZE(3)\fP to specify the length of the provided data,
-which then is strictly required if you want to send off null bytes included in
-the data.
-
-Using POST with HTTP 1.1 implies the use of a "Expect: 100-continue" header,
-and libcurl adds that header automatically if the POST is either known to be
-larger than 1MB or if the expected size is unknown. You can disable this
-header with \fICURLOPT_HTTPHEADER(3)\fP as usual.
-
-To make \fBmultipart/formdata\fP posts, check out the
-\fICURLOPT_MIMEPOST(3)\fP option combined with \fIcurl_mime_init(3)\fP.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-/* send an application/x-www-form-urlencoded POST */
-CURL *curl = curl_easy_init();
-if(curl) {
-  const char *data = "data to send";
-
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* size of the POST data if strlen() is not good enough */
-  curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, 12L);
-
-  /* pass in a pointer to the data - libcurl does not copy */
-  curl_easy_setopt(curl, CURLOPT_POSTFIELDS, data);
-
-  curl_easy_perform(curl);
-}
-
-/* send an application/json POST */
-CURL *curl = curl_easy_init();
-if(curl) {
-  const char *json = "{\"name\": \"daniel\"}";
-  struct curl_slist *slist1 = NULL;
-  slist1 = curl_slist_append(slist1, "Content-Type: application/json");
-  slist1 = curl_slist_append(slist1, "Accept: application/json");
-
-  /* set custom headers */
-  curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, slist1);
-
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* pass in a pointer to the data - libcurl does not copy */
-  curl_easy_setopt(curl, CURLOPT_POSTFIELDS, json);
-
-  curl_easy_perform(curl);
-}
-
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_POSTFIELDSIZE "(3), " CURLOPT_READFUNCTION "(3), "
-.BR CURLOPT_MIMEPOST "(3), " CURLOPT_UPLOAD "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDS.md
new file mode 100644
index 0000000000..6258e53f20
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDS.md
@@ -0,0 +1,133 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_POSTFIELDS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_COPYPOSTFIELDS (3)
+  - CURLOPT_MIMEPOST (3)
+  - CURLOPT_POSTFIELDSIZE (3)
+  - CURLOPT_READFUNCTION (3)
+  - CURLOPT_UPLOAD (3)
+Protocol:
+  - HTTP
+  - MQTT
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_POSTFIELDS - data to POST to server
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_POSTFIELDS, char *postdata);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter, pointing to the data buffer to use in an
+HTTP POST operation or an MQTT subscribe. The data must be formatted and
+encoded the way you want the server to receive it. libcurl does not convert or
+encode it in any way. For example, a web server may assume that this data is
+URL encoded.
+
+The data pointed to is NOT copied by the library: as a consequence, it must be
+preserved by the calling application until the associated transfer finishes.
+This behavior can be changed (so libcurl does copy the data) by instead using
+the CURLOPT_COPYPOSTFIELDS(3) option.
+
+This POST is a normal **application/x-www-form-urlencoded** kind (and libcurl
+sets that Content-Type by default when this option is used), which is commonly
+used by HTML forms. Change Content-Type with CURLOPT_HTTPHEADER(3).
+
+You can use curl_easy_escape(3) to URL encode your data, if
+necessary. It returns a pointer to an encoded string that can be passed as
+*postdata*.
+
+Using CURLOPT_POSTFIELDS(3) implies setting CURLOPT_POST(3) to 1.
+
+If CURLOPT_POSTFIELDS(3) is explicitly set to NULL then libcurl gets the POST
+data from the read callback. To send a zero-length (empty) POST, set
+CURLOPT_POSTFIELDS(3) to an empty string, or set CURLOPT_POST(3) to 1 and
+CURLOPT_POSTFIELDSIZE(3) to 0.
+
+libcurl assumes this option points to a null-terminated string unless you also
+set CURLOPT_POSTFIELDSIZE(3) to specify the length of the provided data, which
+then is strictly required if you want to send off null bytes included in the
+data.
+
+Using POST with HTTP 1.1 implies the use of a "Expect: 100-continue" header,
+and libcurl adds that header automatically if the POST is either known to be
+larger than 1MB or if the expected size is unknown. You can disable this
+header with CURLOPT_HTTPHEADER(3) as usual.
+
+To make **multipart/formdata** posts, check out the
+CURLOPT_MIMEPOST(3) option combined with curl_mime_init(3).
+
+Using this option multiple times makes the last set pointer override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+/* send an application/x-www-form-urlencoded POST */
+int main(void)
+{
+  CURLcode result = CURLE_OK;
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    const char *data = "data to send";
+
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* size of the POST data if strlen() is not good enough */
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, 12L);
+
+    /* pass in a pointer to the data - libcurl does not copy */
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, data);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+
+  /* send an application/json POST */
+  curl = curl_easy_init();
+  if(curl) {
+    const char *json = "{\"name\": \"daniel\"}";
+    struct curl_slist *slist1 = NULL;
+    slist1 = curl_slist_append(slist1, "Content-Type: application/json");
+    slist1 = curl_slist_append(slist1, "Accept: application/json");
+
+    /* set custom headers */
+    curl_easy_setopt(curl, CURLOPT_HTTPHEADER, slist1);
+
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* pass in a pointer to the data - libcurl does not copy */
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, json);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDSIZE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDSIZE.3
deleted file mode 100644
index 37847b5eac..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDSIZE.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_POSTFIELDSIZE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_POSTFIELDSIZE \- size of POST data pointed to
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_POSTFIELDSIZE, long size);
-.fi
-.SH DESCRIPTION
-If you want to post static data to the server without having libcurl do a
-strlen() to measure the data size, this option must be used. When this option
-is used you can post fully binary data, which otherwise is likely to fail. If
-this size is set to -1, libcurl uses strlen() to get the size or relies on the
-\fICURLOPT_READFUNCTION\fP (if used) to signal the end of data.
-
-If you post more than 2GB, use \fICURLOPT_POSTFIELDSIZE_LARGE(3)\fP.
-.SH DEFAULT
--1
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  const char *data = "data to send";
-
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* size of the POST data */
-  curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long) strlen(data));
-
-  curl_easy_setopt(curl, CURLOPT_POSTFIELDS, data);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Along with HTTP
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_POSTFIELDS "(3), " CURLOPT_POSTFIELDSIZE_LARGE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDSIZE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDSIZE.md
new file mode 100644
index 0000000000..4dbc324e2d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDSIZE.md
@@ -0,0 +1,77 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_POSTFIELDSIZE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_POSTFIELDS (3)
+  - CURLOPT_POSTFIELDSIZE_LARGE (3)
+Protocol:
+  - HTTP
+  - MQTT
+  - RTSP
+Added-in: 7.2
+---
+
+# NAME
+
+CURLOPT_POSTFIELDSIZE - size of POST data pointed to
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_POSTFIELDSIZE, long size);
+~~~
+
+# DESCRIPTION
+
+If you want to post static data to the server without having libcurl do a
+strlen() to measure the data size, this option must be used. When this option
+is used you can post fully binary data, which otherwise is likely to fail. If
+this size is set to -1, libcurl uses strlen() to get the size or relies on the
+CURLOPT_READFUNCTION(3) (if used) to signal the end of data.
+
+If you post more than 2GB, use CURLOPT_POSTFIELDSIZE_LARGE(3).
+
+# DEFAULT
+
+-1
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <string.h> /* for strlen */
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    const char *data = "data to send";
+
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* size of the POST data */
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(data));
+
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, data);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDSIZE_LARGE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDSIZE_LARGE.3
deleted file mode 100644
index aa047f9a4a..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDSIZE_LARGE.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_POSTFIELDSIZE_LARGE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_POSTFIELDSIZE_LARGE \- size of POST data pointed to
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_POSTFIELDSIZE_LARGE,
-                          curl_off_t size);
-.SH DESCRIPTION
-If you want to post static data to the server without having libcurl do a
-strlen() to measure the data size, this option must be used. When this option
-is used you can post fully binary data, which otherwise is likely to fail. If
-this size is set to -1, libcurl uses strlen() to get the size or relies on the
-\fICURLOPT_READFUNCTION\fP (if used) to signal the end of data.
-.SH DEFAULT
--1
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  const char *data = large_chunk;
-  curl_off_t length_of_data; /* set somehow */
-
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* size of the POST data */
-  curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE_LARGE, length_of_data);
-
-  curl_easy_setopt(curl, CURLOPT_POSTFIELDS, data);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Along with HTTP
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_POSTFIELDS "(3), " CURLOPT_COPYPOSTFIELDS "(3), "
-.BR CURLOPT_POSTFIELDSIZE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDSIZE_LARGE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDSIZE_LARGE.md
new file mode 100644
index 0000000000..9f2fcb2f97
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_POSTFIELDSIZE_LARGE.md
@@ -0,0 +1,78 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_POSTFIELDSIZE_LARGE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_COPYPOSTFIELDS (3)
+  - CURLOPT_POSTFIELDS (3)
+  - CURLOPT_POSTFIELDSIZE (3)
+Protocol:
+  - HTTP
+  - MQTT
+  - RTSP
+Added-in: 7.11.1
+---
+
+# NAME
+
+CURLOPT_POSTFIELDSIZE_LARGE - size of POST data pointed to
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_POSTFIELDSIZE_LARGE,
+                          curl_off_t size);
+~~~
+
+# DESCRIPTION
+
+If you want to post static data to the server without having libcurl do a
+strlen() to measure the data size, this option must be used. When this option
+is used you can post fully binary data, which otherwise is likely to fail. If
+this size is set to -1, libcurl uses strlen() to get the size or relies on the
+CURLOPT_READFUNCTION(3) (if used) to signal the end of data.
+
+# DEFAULT
+
+-1
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+extern char *large_chunk; /* pointer to somewhere */
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    const char *data = large_chunk;
+    curl_off_t length_of_data = 12345; /* set somehow */
+
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* size of the POST data */
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE_LARGE, length_of_data);
+
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, data);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_POSTQUOTE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_POSTQUOTE.3
deleted file mode 100644
index 629477a6b5..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_POSTQUOTE.3
+++ /dev/null
@@ -1,69 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_POSTQUOTE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_POSTQUOTE \- (S)FTP commands to run after the transfer
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_POSTQUOTE,
-                          struct curl_slist *cmds);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a linked list of FTP or SFTP commands to pass to the server
-after your FTP transfer request. The commands are only issues if no error
-occur. The linked list should be a fully valid list of struct curl_slist
-structs properly filled in as described for \fICURLOPT_QUOTE(3)\fP.
-
-Disable this operation again by setting a NULL to this option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-SFTP and FTP
-.SH EXAMPLE
-.nf
-struct curl_slist *cmdlist = NULL;
-cmdlist = curl_slist_append(cmdlist, "RNFR source-name");
-cmdlist = curl_slist_append(cmdlist, "RNTO new-name");
-
-curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/foo.bin");
-
-  /* pass in the FTP commands to run after the transfer */
-  curl_easy_setopt(curl, CURLOPT_POSTQUOTE, cmdlist);
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-If support for the protocols are built-in.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_QUOTE "(3), " CURLOPT_PREQUOTE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_POSTQUOTE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_POSTQUOTE.md
new file mode 100644
index 0000000000..55ef81aabc
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_POSTQUOTE.md
@@ -0,0 +1,80 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_POSTQUOTE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PREQUOTE (3)
+  - CURLOPT_QUOTE (3)
+Protocol:
+  - FTP
+  - SFTP
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_POSTQUOTE - (S)FTP commands to run after the transfer
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_POSTQUOTE,
+                          struct curl_slist *cmds);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a linked list of FTP or SFTP commands to pass to the server
+after your FTP transfer request. The commands are only issued if no error
+occur. The linked list should be a fully valid list of struct curl_slist
+structs properly filled in as described for CURLOPT_QUOTE(3).
+
+Using this option multiple times makes the last set list override the previous
+ones. Set it to NULL to disable its use again.
+
+libcurl does not copy the list, it needs to be kept around until after the
+transfer has completed.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  struct curl_slist *cmdlist = NULL;
+  cmdlist = curl_slist_append(cmdlist, "RNFR source-name");
+  cmdlist = curl_slist_append(cmdlist, "RNTO new-name");
+
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/foo.bin");
+
+    /* pass in the FTP commands to run after the transfer */
+    curl_easy_setopt(curl, CURLOPT_POSTQUOTE, cmdlist);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+  curl_slist_free_all(cmdlist);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_POSTREDIR.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_POSTREDIR.3
deleted file mode 100644
index c2f773d575..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_POSTREDIR.3
+++ /dev/null
@@ -1,75 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_POSTREDIR 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_POSTREDIR \- how to act on an HTTP POST redirect
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_POSTREDIR,
-                          long bitmask);
-.SH DESCRIPTION
-Pass a bitmask to control how libcurl acts on redirects after POSTs that get a
-301, 302 or 303 response back.  A parameter with bit 0 set (value
-\fBCURL_REDIR_POST_301\fP) tells the library to respect RFC 7231 (section
-6.4.2 to 6.4.4) and not convert POST requests into GET requests when following
-a 301 redirection.  Setting bit 1 (value \fBCURL_REDIR_POST_302\fP) makes
-libcurl maintain the request method after a 302 redirect whilst setting bit 2
-(value \fBCURL_REDIR_POST_303\fP) makes libcurl maintain the request method
-after a 303 redirect. The value \fBCURL_REDIR_POST_ALL\fP is a convenience
-define that sets all three bits.
-
-The non-RFC behavior is ubiquitous in web browsers, so the library does the
-conversion by default to maintain consistency. However, a server may require a
-POST to remain a POST after such a redirection. This option is meaningful only
-when setting \fICURLOPT_FOLLOWLOCATION(3)\fP.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-HTTP(S)
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* a silly POST example */
-  curl_easy_setopt(curl, CURLOPT_POSTFIELDS, "data=true");
-
-  /* example.com is redirected, so we tell libcurl to send POST on 301, 302 and
-     303 HTTP response codes */
-  curl_easy_setopt(curl, CURLOPT_POSTREDIR, CURL_REDIR_POST_ALL);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.17.1. This option was known as CURLOPT_POST301 up to 7.19.0 as it
-only supported the 301 then. CURL_REDIR_POST_303 was added in 7.26.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_FOLLOWLOCATION "(3), " CURLOPT_POSTFIELDS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_POSTREDIR.md b/third-party/curl/docs/libcurl/opts/CURLOPT_POSTREDIR.md
new file mode 100644
index 0000000000..13cd9f333d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_POSTREDIR.md
@@ -0,0 +1,95 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_POSTREDIR
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_EFFECTIVE_METHOD (3)
+  - CURLINFO_REDIRECT_COUNT (3)
+  - CURLOPT_FOLLOWLOCATION (3)
+  - CURLOPT_MAXREDIRS (3)
+  - CURLOPT_POSTFIELDS (3)
+Protocol:
+  - HTTP
+Added-in: 7.19.1
+---
+
+# NAME
+
+CURLOPT_POSTREDIR - how to act on an HTTP POST redirect
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_POSTREDIR,
+                          long bitmask);
+~~~
+
+# DESCRIPTION
+
+Pass a bitmask to control how libcurl acts on redirects after POSTs that get a
+301, 302 or 303 response back. A parameter with bit 0 set (value
+**CURL_REDIR_POST_301**) tells the library to not convert POST requests into
+GET requests when following a 301 redirection. Setting bit 1 (value
+**CURL_REDIR_POST_302**) makes libcurl maintain the request method after a 302
+redirect whilst setting bit 2 (value **CURL_REDIR_POST_303**) makes libcurl
+maintain the request method after a 303 redirect. The value
+**CURL_REDIR_POST_ALL** is a convenience define that sets all three bits.
+
+The non-RFC behavior is ubiquitous in web browsers, so the library does the
+conversion by default to maintain consistency. A server may require a POST to
+remain a POST after such a redirection. This option is meaningful only when
+setting CURLOPT_FOLLOWLOCATION(3).
+
+This option affects transfers where libcurl has been told to use HTTP POST
+using for example CURLOPT_POST(3) or CURLOPT_MIMEPOST(3) and not if the
+method has merely been modified with CURLOPT_CUSTOMREQUEST(3).
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* a silly POST example */
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, "data=true");
+
+    /* example.com is redirected, so we tell libcurl to send POST on 301,
+       302 and 303 HTTP response codes */
+    curl_easy_setopt(curl, CURLOPT_POSTREDIR, CURL_REDIR_POST_ALL);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+This option was known as CURLOPT_POST301 up to 7.19.0 as it only supported the
+301 then. CURL_REDIR_POST_303 was added in 7.26.0.
+
+**CURL_REDIR_*** macros became `long` types in 8.16.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PREQUOTE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PREQUOTE.3
deleted file mode 100644
index 9b5f815e8a..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PREQUOTE.3
+++ /dev/null
@@ -1,73 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PREQUOTE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_PREQUOTE \- commands to run before an FTP transfer
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PREQUOTE,
-                          struct curl_slist *cmds);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a linked list of FTP commands to pass to the server after
-the transfer type is set. The linked list should be a fully valid list of
-struct curl_slist structs properly filled in as described for
-\fICURLOPT_QUOTE(3)\fP. Disable this operation again by setting a NULL to this
-option.
-
-These commands are not performed when a directory listing is performed, only
-for file transfers.
-
-While \fICURLOPT_QUOTE(3)\fP and \fICURLOPT_POSTQUOTE(3)\fP work for SFTP,
-this option does not.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-FTP
-.SH EXAMPLE
-.nf
-struct curl_slist *cmdlist = NULL;
-cmdlist = curl_slist_append(cmdlist, "SYST");
-
-curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/foo.bin");
-
-  /* pass in the FTP commands to run */
-  curl_easy_setopt(curl, CURLOPT_PREQUOTE, cmdlist);
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Along with the protocol support
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_QUOTE "(3), " CURLOPT_POSTQUOTE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PREQUOTE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PREQUOTE.md
new file mode 100644
index 0000000000..79cf9fee80
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PREQUOTE.md
@@ -0,0 +1,81 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PREQUOTE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_POSTQUOTE (3)
+  - CURLOPT_QUOTE (3)
+Protocol:
+  - FTP
+Added-in: 7.9.5
+---
+
+# NAME
+
+CURLOPT_PREQUOTE - commands to run before an FTP transfer
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PREQUOTE,
+                          struct curl_slist *cmds);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a linked list of FTP commands to pass to the server after
+the transfer type is set. The linked list should be a fully valid list of
+struct curl_slist structs properly filled in as described for
+CURLOPT_QUOTE(3).
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+libcurl does not copy the list, it needs to be kept around until after the
+transfer has completed.
+
+While CURLOPT_QUOTE(3) and CURLOPT_POSTQUOTE(3) work for SFTP,
+this option does not.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  struct curl_slist *cmdlist = NULL;
+  cmdlist = curl_slist_append(cmdlist, "SYST");
+
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/foo.bin");
+
+    /* pass in the FTP commands to run */
+    curl_easy_setopt(curl, CURLOPT_PREQUOTE, cmdlist);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+  curl_slist_free_all(cmdlist);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PREREQDATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PREREQDATA.3
deleted file mode 100644
index b7d620db4e..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PREREQDATA.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Max Dymond, <max.dymond@microsoft.com>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PREREQDATA 3 "2 Aug 2021" libcurl libcurl
-.SH NAME
-CURLOPT_PREREQDATA \- pointer passed to the pre-request callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PREREQDATA, void *pointer);
-.fi
-.SH DESCRIPTION
-Pass a \fIpointer\fP that is untouched by libcurl and passed as the first
-argument in the pre-request callback set with \fICURLOPT_PREREQFUNCTION(3)\fP.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-static int prereq_callback(void *clientp,
-                           char *conn_primary_ip,
-                           char *conn_local_ip,
-                           int conn_primary_port,
-                           int conn_local_port)
-{
-  printf("Connection made to %s:%s\\n", conn_primary_ip, conn_primary_port);
-  return CURL_PREREQFUNC_OK;
-}
-
-{
-  struct data prereq_data;
-  curl_easy_setopt(CURL *handle, CURLOPT_PREREQFUNCTION, prereq_callback);
-  curl_easy_setopt(CURL *handle, CURLOPT_PREREQDATA, &prereq_data);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.80.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_PREREQFUNCTION "(3) "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PREREQDATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PREREQDATA.md
new file mode 100644
index 0000000000..d7d6439ece
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PREREQDATA.md
@@ -0,0 +1,77 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PREREQDATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_PRIMARY_IP (3)
+  - CURLINFO_PRIMARY_PORT (3)
+  - CURLOPT_PREREQFUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.80.0
+---
+
+# NAME
+
+CURLOPT_PREREQDATA - pointer passed to the pre-request callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PREREQDATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+Pass a *pointer* that is untouched by libcurl and passed as the first
+argument in the pre-request callback set with CURLOPT_PREREQFUNCTION(3).
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct priv {
+  void *custom;
+};
+
+static int prereq_callback(void *clientp,
+                           char *conn_primary_ip,
+                           char *conn_local_ip,
+                           int conn_primary_port,
+                           int conn_local_port)
+{
+  printf("Connection made to %s:%d\n", conn_primary_ip, conn_primary_port);
+  return CURL_PREREQFUNC_OK;
+}
+
+int main(void)
+{
+  struct priv prereq_data;
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_PREREQFUNCTION, prereq_callback);
+    curl_easy_setopt(curl, CURLOPT_PREREQDATA, &prereq_data);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PREREQFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PREREQFUNCTION.3
deleted file mode 100644
index e67a13a238..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PREREQFUNCTION.3
+++ /dev/null
@@ -1,105 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Max Dymond, <max.dymond@microsoft.com>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PREREQFUNCTION 3 "2 Aug 2021" libcurl libcurl
-.SH NAME
-CURLOPT_PREREQFUNCTION \- user callback called when a connection has been
-established, but before a request has been made.
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-/* These are the return codes for the pre-request callback. */
-#define CURL_PREREQFUNC_OK 0
-#define CURL_PREREQFUNC_ABORT 1 /* fail the entire transfer */
-
-int prereq_callback(void *clientp,
-                    char *conn_primary_ip,
-                    char *conn_local_ip,
-                    int conn_primary_port,
-                    int conn_local_port);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PREREQFUNCTION, prereq_callback);
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-This function gets called by libcurl after a connection has been established
-or a connection has been reused (including any SSL handshaking), but before any
-request is actually made on the connection. For example, for HTTP, this
-callback is called once a connection has been established to the server, but
-before a GET/HEAD/POST/etc request has been sent.
-
-This function may be called multiple times if redirections are enabled and are
-being followed (see \fICURLOPT_FOLLOWLOCATION(3)\fP).
-
-The callback function must return \fICURL_PREREQFUNC_OK\fP on success, or
-\fICURL_PREREQFUNC_ABORT\fP to cause the transfer to fail.
-
-This function is passed the following arguments:
-.IP conn_primary_ip
-A null-terminated pointer to a C string containing the primary IP of the
-remote server established with this connection. For FTP, this is the IP for
-the control connection. IPv6 addresses are represented without surrounding
-brackets.
-.IP conn_local_ip
-A null-terminated pointer to a C string containing the originating IP for this
-connection. IPv6 addresses are represented without surrounding brackets.
-.IP conn_primary_port
-The primary port number on the remote server established with this connection.
-For FTP, this is the port for the control connection. This can be a TCP or a
-UDP port number depending on the protocol.
-.IP conn_local_port
-The originating port number for this connection. This can be a TCP or a UDP
-port number depending on the protocol.
-.IP clientp
-The pointer you set with \fICURLOPT_PREREQDATA(3)\fP.
-.SH DEFAULT
-By default, this is NULL and unused.
-.SH PROTOCOLS
-ALL
-.SH EXAMPLE
-.nf
-static int prereq_callback(void *clientp,
-                           char *conn_primary_ip,
-                           char *conn_local_ip,
-                           int conn_primary_port,
-                           int conn_local_port)
-{
-  printf("Connection made to %s:%s\\n", conn_primary_ip, conn_primary_port);
-  return CURL_PREREQFUNC_OK;
-}
-
-{
-  struct data prereq_data;
-  curl_easy_setopt(CURL *handle, CURLOPT_PREREQFUNCTION, prereq_callback);
-  curl_easy_setopt(CURL *handle, CURLOPT_PREREQDATA, &prereq_data);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.80.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_PREREQDATA "(3) "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PREREQFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PREREQFUNCTION.md
new file mode 100644
index 0000000000..f6b474f7eb
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PREREQFUNCTION.md
@@ -0,0 +1,130 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PREREQFUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_PRIMARY_IP (3)
+  - CURLINFO_PRIMARY_PORT (3)
+  - CURLOPT_PREREQDATA (3)
+Protocol:
+  - All
+Added-in: 7.80.0
+---
+
+# NAME
+
+CURLOPT_PREREQFUNCTION - user callback called when a connection has been
+established, but before a request has been made.
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+/* These are the return codes for the pre-request callback. */
+#define CURL_PREREQFUNC_OK 0
+#define CURL_PREREQFUNC_ABORT 1 /* fail the entire transfer */
+
+int prereq_callback(void *clientp,
+                    char *conn_primary_ip,
+                    char *conn_local_ip,
+                    int conn_primary_port,
+                    int conn_local_port);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PREREQFUNCTION, prereq_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+This function gets called by libcurl after a connection has been established
+or a connection has been reused (including any SSL handshaking), but before any
+request is actually made on the connection. For example, for HTTP, this
+callback is called once a connection has been established to the server, but
+before a GET/HEAD/POST/etc request has been sent.
+
+This function may be called multiple times if redirections are enabled and are
+being followed (see CURLOPT_FOLLOWLOCATION(3)).
+
+The callback function must return *CURL_PREREQFUNC_OK* on success, or
+*CURL_PREREQFUNC_ABORT* to cause the transfer to fail with result
+*CURLE_ABORTED_BY_CALLBACK*.
+
+This function is passed the following arguments:
+
+## `conn_primary_ip`
+
+A pointer to a null-terminated C string containing the primary IP of the
+remote server established with this connection. For FTP, this is the IP for
+the control connection. IPv6 addresses are represented without surrounding
+brackets.
+
+## `conn_local_ip`
+
+A pointer to a null-terminated C string containing the originating IP for this
+connection. IPv6 addresses are represented without surrounding brackets.
+
+## `conn_primary_port`
+
+The primary port number on the remote server established with this connection.
+For FTP, this is the port for the control connection. This can be a TCP or a
+UDP port number depending on the protocol.
+
+## `conn_local_port`
+
+The originating port number for this connection. This can be a TCP or a UDP
+port number depending on the protocol.
+
+## `clientp`
+
+The pointer you set with CURLOPT_PREREQDATA(3).
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct priv {
+  void *custom;
+};
+
+static int prereq_callback(void *clientp,
+                           char *conn_primary_ip,
+                           char *conn_local_ip,
+                           int conn_primary_port,
+                           int conn_local_port)
+{
+  printf("Connection made to %s:%d\n", conn_primary_ip, conn_primary_port);
+  return CURL_PREREQFUNC_OK;
+}
+
+int main(void)
+{
+  struct priv prereq_data;
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_PREREQFUNCTION, prereq_callback);
+    curl_easy_setopt(curl, CURLOPT_PREREQDATA, &prereq_data);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PRE_PROXY.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PRE_PROXY.3
deleted file mode 100644
index 982e1991c1..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PRE_PROXY.3
+++ /dev/null
@@ -1,83 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PRE_PROXY 3 "16 Nov 2016" libcurl libcurl
-.SH NAME
-CURLOPT_PRE_PROXY \- pre-proxy host to use
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PRE_PROXY, char *preproxy);
-.fi
-.SH DESCRIPTION
-Set the \fIpreproxy\fP to use for the upcoming request. The parameter
-should be a char * to a null-terminated string holding the host name or dotted
-numerical IP address. A numerical IPv6 address must be written within
-[brackets].
-
-To specify port number in this string, append :[port] to the end of the host
-name. The proxy's port number may optionally be specified with the separate
-option \fICURLOPT_PROXYPORT(3)\fP. If not specified, libcurl defaults to using
-port 1080 for proxies.
-
-A pre proxy is a SOCKS proxy that curl connects to before it connects to the
-HTTP(S) proxy specified in the \fICURLOPT_PROXY\fP option. The pre proxy can
-only be a SOCKS proxy.
-
-The pre proxy string should be prefixed with [scheme]:// to specify which kind
-of socks is used. Use socks4://, socks4a://, socks5:// or socks5h:// (the last
-one to enable socks5 and asking the proxy to do the resolving, also known as
-\fICURLPROXY_SOCKS5_HOSTNAME\fP type) to request the specific SOCKS version to
-be used. Otherwise SOCKS4 is used as default.
-
-Setting the pre proxy string to "" (an empty string) explicitly disables the
-use of a pre proxy.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-Default is NULL, meaning no pre proxy is used.
-
-When you set a host name to use, do not assume that there is any particular
-single port number used widely for proxies. Specify it!
-.SH PROTOCOLS
-All except file://. Note that some protocols do not work well over proxy.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/file.txt");
-  curl_easy_setopt(curl, CURLOPT_PRE_PROXY, "socks4://socks-proxy:1080");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "http://proxy:80");
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0
-.SH RETURN VALUE
-Returns CURLE_OK if proxies are supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY "(3), " CURLOPT_HTTPPROXYTUNNEL "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PRE_PROXY.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PRE_PROXY.md
new file mode 100644
index 0000000000..06d0f320f4
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PRE_PROXY.md
@@ -0,0 +1,90 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PRE_PROXY
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HTTPPROXYTUNNEL (3)
+  - CURLOPT_PROXY (3)
+Protocol:
+  - All
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLOPT_PRE_PROXY - pre-proxy host to use
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PRE_PROXY, char *preproxy);
+~~~
+
+# DESCRIPTION
+
+Set the *preproxy* to use for the upcoming request. The parameter should be a
+char * to a null-terminated string holding the hostname or dotted numerical IP
+address. A numerical IPv6 address must be written within [brackets].
+
+To specify port number in this string, append :[port] to the end of the host
+name. The proxy's port number may optionally be specified with the separate
+option CURLOPT_PROXYPORT(3). If not specified, libcurl defaults to using
+port 1080 for proxies.
+
+A pre proxy is a SOCKS proxy that curl connects to before it connects to the
+HTTP(S) proxy specified in the CURLOPT_PROXY(3) option. The pre proxy
+can only be a SOCKS proxy.
+
+The pre proxy string should be prefixed with `[scheme]://` to specify which
+kind of socks is used. Use `socks4://`, `socks4a://`, `socks5://` or
+`socks5h://` (the last one to enable socks5 and asking the proxy to do the
+resolving, also known as *CURLPROXY_SOCKS5_HOSTNAME* type) to request the
+specific SOCKS version to be used. Otherwise SOCKS4 is used as default.
+
+Setting the pre proxy string to "" (an empty string) explicitly disables the
+use of a pre proxy.
+
+When you set a hostname to use, do not assume that there is any particular
+single port number used widely for proxies. Specify it.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/file.txt");
+    curl_easy_setopt(curl, CURLOPT_PRE_PROXY, "socks4://socks-proxy:1080");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "http://proxy:80");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PRIVATE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PRIVATE.3
deleted file mode 100644
index 8f88202f8e..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PRIVATE.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PRIVATE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_PRIVATE \- store a private pointer
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PRIVATE, void *pointer);
-.fi
-.SH DESCRIPTION
-Pass a void * as parameter, pointing to data that should be associated with
-this curl handle.  The pointer can subsequently be retrieved using
-\fIcurl_easy_getinfo(3)\fP with the \fICURLINFO_PRIVATE(3)\fP option. libcurl
-itself never does anything with this data.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-struct private secrets;
-if(curl) {
-  struct private *extracted;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* store a pointer to our private struct */
-  curl_easy_setopt(curl, CURLOPT_PRIVATE, &secrets);
-
-  curl_easy_perform(curl);
-
-  /* we can extract the private pointer again too */
-  curl_easy_getinfo(curl, CURLINFO_PRIVATE, &extracted);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.10.3
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_VERBOSE "(3), " CURLOPT_STDERR "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PRIVATE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PRIVATE.md
new file mode 100644
index 0000000000..e59016bf8c
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PRIVATE.md
@@ -0,0 +1,77 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PRIVATE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_PRIVATE (3)
+  - CURLOPT_STDERR (3)
+  - CURLOPT_VERBOSE (3)
+Protocol:
+  - All
+Added-in: 7.10.3
+---
+
+# NAME
+
+CURLOPT_PRIVATE - store a private pointer
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PRIVATE, void *pointer);
+~~~
+
+# DESCRIPTION
+
+Pass a void * as parameter, pointing to data that should be associated with
+this curl handle. The pointer can subsequently be retrieved using
+curl_easy_getinfo(3) with the CURLINFO_PRIVATE(3) option. libcurl itself
+never does anything with this data.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct private {
+  void *custom;
+};
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  struct private secrets;
+  if(curl) {
+    CURLcode result;
+    struct private *extracted;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* store a pointer to our private struct */
+    curl_easy_setopt(curl, CURLOPT_PRIVATE, &secrets);
+
+    result = curl_easy_perform(curl);
+
+    /* we can extract the private pointer again too */
+    curl_easy_getinfo(curl, CURLINFO_PRIVATE, &extracted);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROGRESSDATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROGRESSDATA.3
deleted file mode 100644
index f85c68d047..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROGRESSDATA.3
+++ /dev/null
@@ -1,73 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROGRESSDATA 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_PROGRESSDATA \- pointer passed to the progress callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROGRESSDATA, void *pointer);
-.fi
-.SH DESCRIPTION
-Pass a \fIpointer\fP that is untouched by libcurl and passed as the first
-argument in the progress callback set with \fICURLOPT_PROGRESSFUNCTION(3)\fP.
-.SH DEFAULT
-The default value of this parameter is NULL.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
- struct progress {
-   char *private;
-   size_t size;
- };
-
- static size_t progress_callback(void *clientp,
-                                 double dltotal,
-                                 double dlnow,
-                                 double ultotal,
-                                 double ulnow)
- {
-   struct memory *progress = (struct progress *)clientp;
-
-   /* use the values */
-
-   return 0; /* all is good */
- }
-
- struct progress data;
-
- /* pass struct to callback  */
- curl_easy_setopt(curl_handle, CURLOPT_PROGRESSDATA, &data);
-
- curl_easy_setopt(curl_handle, CURLOPT_PROGRESSFUNCTION, progress_callback);
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_PROGRESSFUNCTION "(3), " CURLOPT_XFERINFOFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROGRESSDATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROGRESSDATA.md
new file mode 100644
index 0000000000..6222995e61
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROGRESSDATA.md
@@ -0,0 +1,84 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROGRESSDATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROGRESSFUNCTION (3)
+  - CURLOPT_XFERINFOFUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_PROGRESSDATA - pointer passed to the progress callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROGRESSDATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+Pass a *pointer* that is untouched by libcurl and passed as the first
+argument in the progress callback set with CURLOPT_PROGRESSFUNCTION(3).
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct progress {
+  char *private;
+  size_t size;
+};
+
+static int progress_callback(void *clientp,
+                             double dltotal,
+                             double dlnow,
+                             double ultotal,
+                             double ulnow)
+{
+  struct progress *memory = clientp;
+  printf("private: %p\n", memory->private);
+
+  /* use the values */
+
+  return 0; /* all is good */
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    struct progress data;
+
+    /* pass struct to callback */
+    curl_easy_setopt(curl, CURLOPT_PROGRESSDATA, &data);
+    curl_easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, progress_callback);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROGRESSFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROGRESSFUNCTION.3
deleted file mode 100644
index 9f7a865c75..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROGRESSFUNCTION.3
+++ /dev/null
@@ -1,118 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROGRESSFUNCTION 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_PROGRESSFUNCTION \- progress meter callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-int progress_callback(void *clientp,
-                      double dltotal,
-                      double dlnow,
-                      double ultotal,
-                      double ulnow);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROGRESSFUNCTION,
-                          progress_callback);
-.fi
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-This option is deprecated and we encourage users to use the
-newer \fICURLOPT_XFERINFOFUNCTION(3)\fP instead, if you can.
-
-This function gets called by libcurl instead of its internal equivalent with a
-frequent interval. While data is being transferred it is invoked frequently,
-and during slow periods like when nothing is being transferred it can slow
-down to about one call per second.
-
-\fIclientp\fP is the pointer set with \fICURLOPT_PROGRESSDATA(3)\fP, it is not
-used by libcurl but is only passed along from the application to the callback.
-
-The callback gets told how much data libcurl is about to transfer and has
-transferred, in number of bytes. \fIdltotal\fP is the total number of bytes
-libcurl expects to download in this transfer. \fIdlnow\fP is the number of
-bytes downloaded so far. \fIultotal\fP is the total number of bytes libcurl
-expects to upload in this transfer. \fIulnow\fP is the number of bytes
-uploaded so far.
-
-Unknown/unused argument values passed to the callback are be set to zero (like
-if you only download data, the upload size remains 0). Many times the callback
-is called one or more times first, before it knows the data sizes so a program
-must be made to handle that.
-
-If your callback function returns CURL_PROGRESSFUNC_CONTINUE it causes libcurl
-to continue executing the default progress function.
-
-Returning any other non-zero value from this callback makes libcurl abort the
-transfer and return \fICURLE_ABORTED_BY_CALLBACK\fP.
-
-If you transfer data with the multi interface, this function is not called
-during periods of idleness unless you call the appropriate libcurl function
-that performs transfers.
-
-\fICURLOPT_NOPROGRESS(3)\fP must be set to 0 to make this function actually
-get called.
-.SH DEFAULT
-By default, libcurl has an internal progress meter. That is rarely wanted by
-users.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
- struct progress {
-   char *private;
-   size_t size;
- };
-
- static size_t progress_callback(void *clientp,
-                                 double dltotal,
-                                 double dlnow,
-                                 double ultotal,
-                                 double ulnow)
- {
-   struct progress *memory = (struct progress *)clientp;
-
-   /* use the values */
-
-   return 0; /* all is good */
- }
-
- struct progress data;
-
- /* pass struct to callback  */
- curl_easy_setopt(curl_handle, CURLOPT_PROGRESSDATA, &data);
-
- curl_easy_setopt(curl_handle, CURLOPT_PROGRESSFUNCTION, progress_callback);
-.fi
-.SH AVAILABILITY
-Deprecated since 7.32.0.
-.SH RETURN VALUE
-Returns CURLE_OK.
-.SH "SEE ALSO"
-.BR CURLOPT_VERBOSE "(3), " CURLOPT_NOPROGRESS "(3), "
-.BR CURLOPT_XFERINFOFUNCTION "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROGRESSFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROGRESSFUNCTION.md
new file mode 100644
index 0000000000..d1d6ba3d37
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROGRESSFUNCTION.md
@@ -0,0 +1,134 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROGRESSFUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_NOPROGRESS (3)
+  - CURLOPT_VERBOSE (3)
+  - CURLOPT_XFERINFOFUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_PROGRESSFUNCTION - progress meter callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+int progress_callback(void *clientp,
+                      double dltotal,
+                      double dlnow,
+                      double ultotal,
+                      double ulnow);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROGRESSFUNCTION,
+                          progress_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+This option is deprecated and we encourage users to use the
+newer CURLOPT_XFERINFOFUNCTION(3) instead, if you can.
+
+This function gets called by libcurl instead of its internal equivalent with a
+frequent interval. While data is being transferred it is invoked frequently,
+and during slow periods like when nothing is being transferred it can slow
+down to about one call per second.
+
+*clientp* is the pointer set with CURLOPT_PROGRESSDATA(3), it is not
+used by libcurl but is only passed along from the application to the callback.
+
+The callback gets told how much data libcurl is about to transfer and has
+transferred, in number of bytes. *dltotal* is the total number of bytes
+libcurl expects to download in this transfer. *dlnow* is the number of
+bytes downloaded so far. *ultotal* is the total number of bytes libcurl
+expects to upload in this transfer. *ulnow* is the number of bytes
+uploaded so far.
+
+Unknown/unused argument values passed to the callback are be set to zero (like
+if you only download data, the upload size remains 0). Many times the callback
+is called one or more times first, before it knows the data sizes so a program
+must be made to handle that.
+
+Return zero from the callback if everything is fine.
+
+If your callback function returns CURL_PROGRESSFUNC_CONTINUE it causes libcurl
+to continue executing the default progress function.
+
+Return 1 from this callback to make libcurl abort the transfer and return
+*CURLE_ABORTED_BY_CALLBACK*.
+
+If you transfer data with the multi interface, this function is not called
+during periods of idleness unless you call the appropriate libcurl function
+that performs transfers.
+
+CURLOPT_NOPROGRESS(3) must be set to 0 to make this function actually
+get called.
+
+# DEFAULT
+
+NULL. libcurl has an internal progress meter. That is rarely wanted by users.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct progress {
+  char *private;
+  size_t size;
+};
+
+static int progress_callback(void *clientp,
+                             double dltotal,
+                             double dlnow,
+                             double ultotal,
+                             double ulnow)
+{
+  struct progress *memory = clientp;
+  printf("private: %p\n", memory->private);
+
+  /* use the values */
+
+  return 0; /* all is good */
+}
+
+int main(void)
+{
+  struct progress data;
+
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    /* pass struct to callback */
+    curl_easy_setopt(curl, CURLOPT_PROGRESSDATA, &data);
+    curl_easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, progress_callback);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# DEPRECATED
+
+Deprecated since 7.32.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROTOCOLS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROTOCOLS.3
deleted file mode 100644
index 2f35e538ce..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROTOCOLS.3
+++ /dev/null
@@ -1,101 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROTOCOLS 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_PROTOCOLS \- allowed protocols
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROTOCOLS, long bitmask);
-.fi
-.SH DESCRIPTION
-This option is deprecated. We strongly recommend using
-\fICURLOPT_PROTOCOLS_STR(3)\fP instead because this option cannot control all
-available protocols!
-
-Pass a long that holds a bitmask of CURLPROTO_* defines. If used, this bitmask
-limits what protocols libcurl may use in the transfer. This allows you to have
-a libcurl built to support a wide range of protocols but still limit specific
-transfers to only be allowed to use a subset of them. By default libcurl
-accepts all protocols it supports (\fICURLPROTO_ALL\fP). See also
-\fICURLOPT_REDIR_PROTOCOLS(3)\fP.
-
-These are the available protocol defines:
-.nf
-CURLPROTO_DICT
-CURLPROTO_FILE
-CURLPROTO_FTP
-CURLPROTO_FTPS
-CURLPROTO_GOPHER
-CURLPROTO_HTTP
-CURLPROTO_HTTPS
-CURLPROTO_IMAP
-CURLPROTO_IMAPS
-CURLPROTO_LDAP
-CURLPROTO_LDAPS
-CURLPROTO_POP3
-CURLPROTO_POP3S
-CURLPROTO_RTMP
-CURLPROTO_RTMPE
-CURLPROTO_RTMPS
-CURLPROTO_RTMPT
-CURLPROTO_RTMPTE
-CURLPROTO_RTMPTS
-CURLPROTO_RTSP
-CURLPROTO_SCP
-CURLPROTO_SFTP
-CURLPROTO_SMB
-CURLPROTO_SMBS
-CURLPROTO_SMTP
-CURLPROTO_SMTPS
-CURLPROTO_TELNET
-CURLPROTO_TFTP
-.fi
-.SH DEFAULT
-All protocols built-in.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  /* pass in the URL from an external source */
-  curl_easy_setopt(curl, CURLOPT_URL, argv[1]);
-
-  /* only allow HTTP, TFTP and SFTP */
-  curl_easy_setopt(curl, CURLOPT_PROTOCOLS,
-                   CURLPROTO_HTTP | CURLPROTO_TFTP | CURLPROTO_SFTP);
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.19.4. Deprecated since 7.85.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_REDIR_PROTOCOLS "(3), " CURLOPT_URL "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROTOCOLS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROTOCOLS.md
new file mode 100644
index 0000000000..cdd02b5ed8
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROTOCOLS.md
@@ -0,0 +1,120 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROTOCOLS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DEFAULT_PROTOCOL (3)
+  - CURLOPT_REDIR_PROTOCOLS (3)
+  - CURLOPT_URL (3)
+Protocol:
+  - All
+Added-in: 7.19.4
+---
+
+# NAME
+
+CURLOPT_PROTOCOLS - allowed protocols
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROTOCOLS, long bitmask);
+~~~
+
+# DESCRIPTION
+
+This option is deprecated. We strongly recommend using
+CURLOPT_PROTOCOLS_STR(3) instead because this option cannot control all
+available protocols.
+
+Pass a long that holds a bitmask of protocol bits. If used, this bitmask
+limits what protocols libcurl may use in the transfer. This allows you to have
+a libcurl built to support a wide range of protocols but still limit specific
+transfers to only be allowed to use a subset of them. By default libcurl
+accepts all protocols it supports. See also CURLOPT_REDIR_PROTOCOLS(3).
+
+Note that the old define *CURLPROTO_ALL* no longer enables all protocols a
+modern curl might support!
+
+These are the available protocol defines:
+~~~c
+CURLPROTO_DICT
+CURLPROTO_FILE
+CURLPROTO_FTP
+CURLPROTO_FTPS
+CURLPROTO_GOPHER
+CURLPROTO_HTTP
+CURLPROTO_HTTPS
+CURLPROTO_IMAP
+CURLPROTO_IMAPS
+CURLPROTO_LDAP
+CURLPROTO_LDAPS
+CURLPROTO_MQTT
+CURLPROTO_POP3
+CURLPROTO_POP3S
+CURLPROTO_RTMP
+CURLPROTO_RTMPE
+CURLPROTO_RTMPS
+CURLPROTO_RTMPT
+CURLPROTO_RTMPTE
+CURLPROTO_RTMPTS
+CURLPROTO_RTSP
+CURLPROTO_SCP
+CURLPROTO_SFTP
+CURLPROTO_SMB
+CURLPROTO_SMBS
+CURLPROTO_SMTP
+CURLPROTO_SMTPS
+CURLPROTO_TELNET
+CURLPROTO_TFTP
+~~~
+
+# DEFAULT
+
+All protocols built-in.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(int argc, char **argv)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    /* pass in the URL from an external source */
+    curl_easy_setopt(curl, CURLOPT_URL, argv[1]);
+
+    /* only allow HTTP, TFTP and SFTP */
+    curl_easy_setopt(curl, CURLOPT_PROTOCOLS,
+                     CURLPROTO_HTTP | CURLPROTO_TFTP | CURLPROTO_SFTP);
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURLPROTO_*** macros became `long` types in 8.16.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# DEPRECATED
+
+Deprecated since 7.85.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROTOCOLS_STR.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROTOCOLS_STR.3
deleted file mode 100644
index 285db11c9b..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROTOCOLS_STR.3
+++ /dev/null
@@ -1,84 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROTOCOLS_STR 3 "11 Jun 2022" libcurl libcurl
-.SH NAME
-CURLOPT_PROTOCOLS_STR \- allowed protocols
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROTOCOLS_STR, char *spec);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a string that holds a comma-separated list of case
-insensitive protocol names (URL schemes) to allow in the transfer. This
-option allows applications to use libcurl built to support a wide range of
-protocols but still limit specific transfers to only be allowed to use a
-subset of them. By default, libcurl accepts all protocols it was built with
-support for. See also \fICURLOPT_REDIR_PROTOCOLS_STR(3)\fP.
-
-If trying to set a non-existing protocol or if no matching protocol at all is
-set, it returns error.
-
-These are the available protocols:
-
-DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS,
-MQTT, POP3, POP3S, RTMP, RTMPE, RTMPS, RTMPT, RTMPTE, RTMPTS, RTSP, SCP, SFTP,
-SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS, WSS
-
-You can set "ALL" as a short-cut to enable all protocols. Note that by setting
-all, you may enable protocols that were not supported the day you write this
-but are introduced in a future libcurl version.
-
-\fIcurl_version_info(3)\fP can be used to get a list of all supported
-protocols in the current libcurl. \fICURLINFO_SCHEME(3)\fP is the recommended
-way to figure out the protocol used in a previous transfer.
-.SH DEFAULT
-All protocols built-in
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  /* pass in the URL from an external source */
-  curl_easy_setopt(curl, CURLOPT_URL, argv[1]);
-
-  /* only allow HTTP, TFTP and SFTP */
-  curl_easy_setopt(curl, CURLOPT_PROTOCOLS_STR, "http,tftp,sftp");
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.85.0
-.SH RETURN VALUE
-Returns CURLE_UNKNOWN_OPTION if the option is not implemented,
-CURLE_UNSUPPORTED_PROTOCOL if a listed protocol is not supported or disabled,
-CURLE_BAD_FUNCTION_ARGUMENT if no protocol is listed else CURLE_OK.
-.SH "SEE ALSO"
-.BR CURLOPT_REDIR_PROTOCOLS_STR "(3), " CURLOPT_URL "(3), "
-.BR curl_version_info "(3), " CURLINFO_SCHEME "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROTOCOLS_STR.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROTOCOLS_STR.md
new file mode 100644
index 0000000000..02a78ae5d6
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROTOCOLS_STR.md
@@ -0,0 +1,96 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROTOCOLS_STR
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_SCHEME (3)
+  - CURLOPT_DEFAULT_PROTOCOL (3)
+  - CURLOPT_REDIR_PROTOCOLS_STR (3)
+  - CURLOPT_URL (3)
+  - curl_version_info (3)
+Protocol:
+  - All
+Added-in: 7.85.0
+---
+
+# NAME
+
+CURLOPT_PROTOCOLS_STR - allowed protocols
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROTOCOLS_STR, char *spec);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a string that holds a comma-separated list of case
+insensitive protocol names (URL schemes) to allow in the transfer. This
+option allows applications to use libcurl built to support a wide range of
+protocols but still limit specific transfers to only be allowed to use a
+subset of them. By default, libcurl accepts all protocols it was built with
+support for. See also CURLOPT_REDIR_PROTOCOLS_STR(3).
+
+If trying to set a non-existing protocol or if no matching protocol at all is
+set, it returns error.
+
+These are the available protocols:
+
+DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS,
+MQTT, MQTTS, POP3, POP3S, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET,
+TFTP, WS, WSS
+
+You can set "ALL" as a short-cut to enable all protocols. Note that by setting
+all, you may enable protocols that were not supported the day you write this
+but are introduced in a future libcurl version.
+
+curl_version_info(3) can be used to get a list of all supported protocols in
+the current libcurl. CURLINFO_SCHEME(3) is the recommended way to figure out
+the protocol used in a previous transfer.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to restore to the internal default.
+
+# DEFAULT
+
+All protocols built-in
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(int argc, char **argv)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    /* pass in the URL from an external source */
+    curl_easy_setopt(curl, CURLOPT_URL, argv[1]);
+
+    /* only allow HTTP, TFTP and SFTP */
+    curl_easy_setopt(curl, CURLOPT_PROTOCOLS_STR, "http,tftp,sftp");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+RTMP and its related protocol schemes are not supported since curl 8.20.0
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+Returns CURLE_UNKNOWN_OPTION if the option is not implemented,
+CURLE_UNSUPPORTED_PROTOCOL if a listed protocol is not supported or disabled,
+CURLE_BAD_FUNCTION_ARGUMENT if no protocol is listed else CURLE_OK.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY.3
deleted file mode 100644
index bdd59add95..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY.3
+++ /dev/null
@@ -1,132 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY \- proxy to use
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY, char *proxy);
-.fi
-.SH DESCRIPTION
-Set the \fIproxy\fP to use for transfers with this easy handle. The parameter
-should be a char * to a null-terminated string holding the host name or dotted
-numerical IP address. A numerical IPv6 address must be written within
-[brackets].
-
-To specify port number in this string, append :[port] to the end of the host
-name. The proxy's port number may optionally (but discouraged) be specified
-with the separate option \fICURLOPT_PROXYPORT(3)\fP. If not specified, libcurl
-defaults to using port 1080 for proxies.
-
-The proxy string may be prefixed with [scheme]:// to specify which kind of
-proxy is used.
-
-.RS
-.IP http://
-HTTP Proxy. Default when no scheme or proxy type is specified.
-.IP https://
-HTTPS Proxy. (Added in 7.52.0 for OpenSSL and GnuTLS Since 7.87.0, it
-also works for BearSSL, mbedTLS, rustls, Schannel, Secure Transport and
-wolfSSL.)
-
-This uses HTTP/1 by default. Setting \fICURLOPT_PROXYTYPE(3)\fP to
-\fBCURLPROXY_HTTPS2\fP allows libcurl to negotiate using HTTP/2 with proxy.
-.IP socks4://
-SOCKS4 Proxy.
-.IP socks4a://
-SOCKS4a Proxy. Proxy resolves URL hostname.
-.IP socks5://
-SOCKS5 Proxy.
-.IP socks5h://
-SOCKS5 Proxy. Proxy resolves URL hostname.
-.RE
-
-Without a scheme prefix, \fICURLOPT_PROXYTYPE(3)\fP can be used to specify
-which kind of proxy the string identifies.
-
-When you tell the library to use an HTTP proxy, libcurl transparently converts
-operations to HTTP even if you specify an FTP URL etc. This may have an impact
-on what other features of the library you can use, such as
-\fICURLOPT_QUOTE(3)\fP and similar FTP specifics that do not work unless you
-tunnel through the HTTP proxy. Such tunneling is activated with
-\fICURLOPT_HTTPPROXYTUNNEL(3)\fP.
-
-Setting the proxy string to "" (an empty string) explicitly disables the use
-of a proxy, even if there is an environment variable set for it.
-
-A proxy host string can also include protocol scheme (http://) and embedded
-user + password.
-
-Unix domain sockets are supported for socks proxies since 7.84.0. Set
-localhost for the host part. e.g. socks5h://localhost/path/to/socket.sock
-
-The application does not have to keep the string around after setting this
-option.
-
-When a proxy is used, the active FTP mode as set with \fICUROPT_FTPPORT(3)\fP,
-cannot be used.
-.SH "Environment variables"
-libcurl respects the proxy environment variables named \fBhttp_proxy\fP,
-\fBftp_proxy\fP, \fBsftp_proxy\fP etc. If set, libcurl uses the specified
-proxy for that URL scheme. So for a "FTP://" URL, the \fBftp_proxy\fP is
-considered. \fBall_proxy\fP is used if no protocol specific proxy was set.
-
-If \fBno_proxy\fP (or \fBNO_PROXY\fP) is set, it is the exact equivalent of
-setting the \fICURLOPT_NOPROXY(3)\fP option.
-
-The \fICURLOPT_PROXY(3)\fP and \fICURLOPT_NOPROXY(3)\fP options override
-environment variables.
-.SH DEFAULT
-Default is NULL, meaning no proxy is used.
-
-When you set a host name to use, do not assume that there is any particular
-single port number used widely for proxies. Specify it!
-.SH PROTOCOLS
-All except file://. Note that some protocols do not work well over proxy.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/file.txt");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "http://proxy:80");
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Since 7.14.1 the proxy environment variable names can include the protocol
-scheme.
-
-Since 7.21.7 the proxy string supports the socks protocols as "schemes".
-
-Since 7.50.2, unsupported schemes in proxy strings cause libcurl to return
-error.
-.SH RETURN VALUE
-Returns CURLE_OK if proxies are supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXYPORT "(3), " CURLOPT_HTTPPROXYTUNNEL "(3), "
-.BR CURLOPT_PROXYTYPE "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY.md
new file mode 100644
index 0000000000..072dfd4809
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY.md
@@ -0,0 +1,174 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HTTPPROXYTUNNEL (3)
+  - CURLOPT_PRE_PROXY (3)
+  - CURLOPT_PROXYPORT (3)
+  - CURLOPT_PROXYTYPE (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_PROXY - proxy to use
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY, char *proxy);
+~~~
+
+# DESCRIPTION
+
+Set the *proxy* to use for transfers with this easy handle. The parameter
+should be a char * to a null-terminated string holding the hostname or dotted
+numerical IP address. A numerical IPv6 address must be written within
+[brackets].
+
+To specify port number in this string, append `:[port]` to the end of the host
+name. The proxy's port number may optionally (but discouraged) be specified
+with the separate option CURLOPT_PROXYPORT(3). If not specified, libcurl
+defaults to using port 1080 for proxies.
+
+The proxy string may be prefixed with `[scheme]://` to specify which kind of
+proxy is used.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+The application does not have to keep the string around after setting this
+option.
+
+## `http://`
+
+HTTP Proxy. Default when no scheme or proxy type is specified.
+
+## `https://`
+
+HTTPS Proxy. (with OpenSSL, GnuTLS, mbedTLS, Rustls, Schannel or wolfSSL.)
+
+This uses HTTP/1 by default. Setting CURLOPT_PROXYTYPE(3) to
+**CURLPROXY_HTTPS2** allows libcurl to negotiate using HTTP/2 with proxy.
+
+Setting CURLOPT_PROXYTYPE(3) to **CURLPROXY_HTTPS3** allows libcurl to
+negotiate using HTTP/3 with proxy. This feature is experimental and requires
+a build with HTTP/3 proxy support enabled.
+
+## socks4://
+
+SOCKS4 Proxy.
+
+## `socks4a://`
+
+SOCKS4a Proxy. Proxy resolves URL hostname.
+
+## `socks5://`
+
+SOCKS5 Proxy.
+
+## `socks5h://`
+
+SOCKS5 Proxy. Proxy resolves URL hostname.
+
+##
+
+Without a scheme prefix, CURLOPT_PROXYTYPE(3) can be used to specify which
+kind of proxy the string identifies.
+
+When you tell the library to use an HTTP proxy, libcurl transparently converts
+operations to HTTP even if you specify an FTP URL etc. This may have an impact
+on what other features of the library you can use, such as CURLOPT_QUOTE(3)
+and similar FTP specifics that do not work unless you tunnel through the HTTP
+proxy. Such tunneling is activated with CURLOPT_HTTPPROXYTUNNEL(3).
+
+Setting the proxy string to "" (an empty string) explicitly disables the use
+of a proxy, even if there is an environment variable set for it.
+
+Unix domain sockets are supported for SOCKS proxies. Set `localhost` for the
+host part and append the absolute path to the domain socket. For example:
+`socks5h://localhost/path/to/socket.sock`
+
+When you set a hostname to use, do not assume that there is any particular
+single port number used widely for proxies. Specify it.
+
+When a proxy is used, the active FTP mode as set with *CUROPT_FTPPORT(3)*,
+cannot be used.
+
+Doing FTP over an HTTP proxy without CURLOPT_HTTPPROXYTUNNEL(3) set makes
+libcurl do HTTP with an FTP URL over the proxy. For such transfers, common FTP
+specific options do not work, for example CURLOPT_USE_SSL(3).
+
+# Authentication
+
+The proxy can also be specified with its associated credentials like for
+ordinary URLs in the style: `scheme://username:password@hostname`
+
+Alternatively, set them using CURLOPT_PROXYUSERNAME(3) and
+CURLOPT_PROXYPASSWORD(3).
+
+# Environment variables
+
+libcurl respects the proxy environment variables named **http_proxy**,
+**ftp_proxy**, **sftp_proxy** etc. If set, libcurl uses the specified proxy
+for that URL scheme. For an `ftp://` URL, the **ftp_proxy** is
+considered. **all_proxy** is used if no protocol specific proxy was set.
+
+If **no_proxy** (or **NO_PROXY**) is set, it is the exact equivalent of
+setting the CURLOPT_NOPROXY(3) option.
+
+The CURLOPT_PROXY(3) and CURLOPT_NOPROXY(3) options override environment
+variables.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/file.txt");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "http://proxy.example:80");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+Since 7.14.1 the proxy environment variable names can include the protocol
+scheme.
+
+Since 7.21.7 the proxy string supports the socks protocols as "schemes".
+
+Since 7.50.2, unsupported schemes in proxy strings cause libcurl to return
+error.
+
+Since 7.52.0, it supports HTTPS proxy for OpenSSL.
+
+Since 7.87.0, it supports HTTPS proxy for GnuTLS, for mbedTLS, Rustls,
+Schannel and wolfSSL.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYAUTH.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYAUTH.3
deleted file mode 100644
index f37197c269..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYAUTH.3
+++ /dev/null
@@ -1,73 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXYAUTH 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_PROXYAUTH \- HTTP proxy authentication methods
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXYAUTH, long bitmask);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter, which is set to a bitmask, to tell libcurl which
-HTTP authentication method(s) you want it to use for your proxy
-authentication. If more than one bit is set, libcurl first queries the site to
-see what authentication methods it supports and then it picks the best one you
-allow it to use. For some methods, this induces an extra network round-trip.
-Set the actual name and password with the \fICURLOPT_PROXYUSERPWD(3)\fP
-option.
-
-The bitmask can be constructed by the bits listed and described in the
-\fICURLOPT_HTTPAUTH(3)\fP man page.
-.SH DEFAULT
-CURLAUTH_BASIC
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  /* use this proxy */
-  curl_easy_setopt(curl, CURLOPT_PROXY, "http://local.example.com:1080");
-  /* allow whatever auth the proxy speaks */
-  curl_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_ANY);
-  /* set the proxy credentials */
-  curl_easy_setopt(curl, CURLOPT_PROXYUSERPWD, "james:007");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.10.7
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_NOT_BUILT_IN if the bitmask specified no supported authentication
-methods.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY "(3), " CURLOPT_PROXYTYPE "(3), "
-.BR CURLOPT_PROXYUSERPWD "(3), " CURLOPT_PROXYPORT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYAUTH.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYAUTH.md
new file mode 100644
index 0000000000..459fd429c3
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYAUTH.md
@@ -0,0 +1,82 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXYAUTH
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HTTPAUTH (3)
+  - CURLOPT_PROXY (3)
+  - CURLOPT_PROXYPORT (3)
+  - CURLOPT_PROXYTYPE (3)
+  - CURLOPT_PROXYUSERPWD (3)
+Protocol:
+  - All
+Added-in: 7.10.7
+---
+
+# NAME
+
+CURLOPT_PROXYAUTH - HTTP proxy authentication methods
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXYAUTH, long bitmask);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter, which is set to a bitmask, to tell libcurl which
+HTTP authentication method(s) you want it to use for your proxy
+authentication. If more than one bit is set, libcurl first queries the site to
+see what authentication methods it supports and then it picks the best one you
+allow it to use. For some methods, this induces an extra network round-trip.
+Set the actual name and password with the CURLOPT_PROXYUSERPWD(3)
+option.
+
+The bitmask can be constructed by the bits listed and described in the
+CURLOPT_HTTPAUTH(3) man page.
+
+# DEFAULT
+
+CURLAUTH_BASIC
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* use this proxy */
+    curl_easy_setopt(curl, CURLOPT_PROXY, "http://local.example.com:1080");
+    /* allow whatever auth the proxy speaks */
+    curl_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_ANY);
+    /* set the proxy credentials */
+    curl_easy_setopt(curl, CURLOPT_PROXYUSERPWD, "james:007");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURLAUTH_*** macros became `long` types in 7.26.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYHEADER.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYHEADER.3
deleted file mode 100644
index 47b5f33af7..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYHEADER.3
+++ /dev/null
@@ -1,77 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXYHEADER 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_PROXYHEADER \- set of HTTP headers to pass to proxy
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXYHEADER,
-                          struct curl_slist *headers);
-.SH DESCRIPTION
-Pass a pointer to a linked list of HTTP headers to pass in your HTTP request
-sent to a proxy. The rules for this list is identical to the
-\fICURLOPT_HTTPHEADER(3)\fP option's.
-
-The headers set with this option is only ever used in requests sent to a proxy
-- when there is also a request sent to a host.
-
-The first line in a request (containing the method, usually a GET or POST) is
-NOT a header and cannot be replaced using this option. Only the lines
-following the request-line are headers. Adding this method line in this list
-of headers causes your request to send an invalid header.
-
-Pass a NULL to this to reset back to no custom headers.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-
-struct curl_slist *list;
-
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "http://proxy.example.com:80");
-
-  list = curl_slist_append(NULL, "Shoesize: 10");
-  list = curl_slist_append(list, "Accept:");
-
-  curl_easy_setopt(curl, CURLOPT_PROXYHEADER, list);
-
-  curl_easy_perform(curl);
-
-  curl_slist_free_all(list); /* free the list again */
-}
-.fi
-.SH AVAILABILITY
-Added in 7.37.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_HEADEROPT "(3), " CURLOPT_HTTPHEADER "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYHEADER.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYHEADER.md
new file mode 100644
index 0000000000..340446b53e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYHEADER.md
@@ -0,0 +1,88 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXYHEADER
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HEADEROPT (3)
+  - CURLOPT_HTTPHEADER (3)
+Protocol:
+  - All
+Added-in: 7.37.0
+---
+
+# NAME
+
+CURLOPT_PROXYHEADER - set of HTTP headers to pass to proxy
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXYHEADER,
+                          struct curl_slist *headers);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a linked list of HTTP headers to pass in your HTTP request
+sent to a proxy. The rules for this list is identical to the
+CURLOPT_HTTPHEADER(3) option's.
+
+The headers set with this option is only ever used in requests sent to a proxy
+- when there is also a request sent to a host.
+
+The first line in a request (containing the method, usually a GET or POST) is
+NOT a header and cannot be replaced using this option. Only the lines
+following the request-line are headers. Adding this method line in this list
+of headers causes your request to send an invalid header.
+
+Using this option multiple times makes the last set list override the previous
+ones. Set it to NULL to disable its use again.
+
+libcurl does not copy the list, it needs to be kept around until after the
+transfer has completed.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+
+  struct curl_slist *list;
+
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "http://proxy.example.com:80");
+
+    list = curl_slist_append(NULL, "Shoesize: 10");
+    list = curl_slist_append(list, "Accept:");
+
+    curl_easy_setopt(curl, CURLOPT_PROXYHEADER, list);
+
+    result = curl_easy_perform(curl);
+
+    curl_slist_free_all(list); /* free the list again */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYPASSWORD.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYPASSWORD.3
deleted file mode 100644
index 9a8954fe0f..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYPASSWORD.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXYPASSWORD 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_PROXYPASSWORD \- password to use with proxy authentication
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXYPASSWORD, char *pwd);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter, which should be pointing to the null-terminated
-password to use for authentication with the proxy.
-
-The \fICURLOPT_PROXYPASSWORD(3)\fP option should be used in conjunction with
-the \fICURLOPT_PROXYUSERNAME(3)\fP option.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-blank
-.SH PROTOCOLS
-Most
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "http://localhost:8080");
-  curl_easy_setopt(curl, CURLOPT_PROXYUSERNAME, "mrsmith");
-  curl_easy_setopt(curl, CURLOPT_PROXYPASSWORD, "qwerty");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.19.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PASSWORD "(3), " CURLOPT_PROXYUSERNAME "(3), "
-.BR CURLOPT_HTTPAUTH "(3), " CURLOPT_PROXYAUTH "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYPASSWORD.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYPASSWORD.md
new file mode 100644
index 0000000000..c4664b6631
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYPASSWORD.md
@@ -0,0 +1,74 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXYPASSWORD
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HTTPAUTH (3)
+  - CURLOPT_PASSWORD (3)
+  - CURLOPT_PROXYAUTH (3)
+  - CURLOPT_PROXYUSERNAME (3)
+Protocol:
+  - All
+Added-in: 7.19.1
+---
+
+# NAME
+
+CURLOPT_PROXYPASSWORD - password to use with proxy authentication
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXYPASSWORD, char *pwd);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter, which should be pointing to the
+null-terminated password to use for authentication with the proxy.
+
+The CURLOPT_PROXYPASSWORD(3) option should be used in conjunction with the
+CURLOPT_PROXYUSERNAME(3) option.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+blank
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "http://localhost:8080");
+    curl_easy_setopt(curl, CURLOPT_PROXYUSERNAME, "mrsmith");
+    curl_easy_setopt(curl, CURLOPT_PROXYPASSWORD, "qwerty");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYPORT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYPORT.3
deleted file mode 100644
index 458841fa40..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYPORT.3
+++ /dev/null
@@ -1,61 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXYPORT 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_PROXYPORT \- port number the proxy listens on
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXYPORT, long port);
-.fi
-.SH DESCRIPTION
-Pass a long with this option to set the proxy port to connect to unless it is
-specified in the proxy string \fICURLOPT_PROXY(3)\fP or uses 443 for https
-proxies and 1080 for all others as default.
-
-While this accepts a 'long', the port number is 16 bit so it cannot be larger
-than 65535.
-.SH DEFAULT
-0, not specified which makes it use the default port
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "localhost");
-  curl_easy_setopt(curl, CURLOPT_PROXYPORT, 8080L);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY "(3), " CURLOPT_PROXYTYPE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYPORT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYPORT.md
new file mode 100644
index 0000000000..faab053f59
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYPORT.md
@@ -0,0 +1,74 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXYPORT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_PRIMARY_PORT (3)
+  - CURLOPT_PORT (3)
+  - CURLOPT_PROXY (3)
+  - CURLOPT_PROXYTYPE (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_PROXYPORT - port number the proxy listens on
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXYPORT, long port);
+~~~
+
+# DESCRIPTION
+
+We discourage use of this option.
+
+Pass a long with this option to set the proxy port to connect to unless it is
+specified in the proxy string CURLOPT_PROXY(3) or uses 443 for https proxies
+and 1080 for all others as default.
+
+Disabling this option, setting it to zero, makes it not specified which makes
+libcurl use the default proxy port number or the port number specified in the
+proxy URL string.
+
+While this accepts a 'long', the port number is 16-bit so it cannot be larger
+than 65535.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "localhost");
+    curl_easy_setopt(curl, CURLOPT_PROXYPORT, 8080L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYTYPE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYTYPE.3
deleted file mode 100644
index 9a325981ee..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYTYPE.3
+++ /dev/null
@@ -1,84 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXYTYPE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_PROXYTYPE \- proxy protocol type
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXYTYPE, long type);
-.fi
-.SH DESCRIPTION
-Pass one of the values below to set the type of the proxy.
-
-.RS
-.IP CURLPROXY_HTTP
-HTTP Proxy. Default.
-.IP CURLPROXY_HTTPS
-HTTPS Proxy using HTTP/1. (Added in 7.52.0 for OpenSSL and GnuTLS. Since
-7.87.0, it also works for BearSSL, mbedTLS, rustls, Schannel, Secure Transport
-and wolfSSL.)
-.IP CURLPROXY_HTTPS2
-HTTPS Proxy and attempt to speak HTTP/2 over it. (Added in 8.1.0)
-.IP CURLPROXY_HTTP_1_0
-HTTP 1.0 Proxy. This is similar to CURLPROXY_HTTP except it uses HTTP/1.0 for
-any CONNECT tunneling. It does not change the HTTP version of the actual HTTP
-requests, controlled by \fICURLOPT_HTTP_VERSION(3)\fP.
-.IP CURLPROXY_SOCKS4
-SOCKS4 Proxy.
-.IP CURLPROXY_SOCKS4A
-SOCKS4a Proxy. Proxy resolves URL hostname.
-.IP CURLPROXY_SOCKS5
-SOCKS5 Proxy.
-.IP CURLPROXY_SOCKS5_HOSTNAME
-SOCKS5 Proxy. Proxy resolves URL hostname.
-.RE
-
-Often it is more convenient to specify the proxy type with the scheme part of
-the \fICURLOPT_PROXY(3)\fP string.
-.SH DEFAULT
-CURLPROXY_HTTP
-.SH PROTOCOLS
-Most
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "local.example.com:1080");
-  /* set the proxy type */
-  curl_easy_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY "(3), " CURLOPT_PROXYPORT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYTYPE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYTYPE.md
new file mode 100644
index 0000000000..1dc1a1328a
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYTYPE.md
@@ -0,0 +1,113 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXYTYPE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY (3)
+  - CURLOPT_PROXYPORT (3)
+Protocol:
+  - All
+Added-in: 7.10
+---
+
+# NAME
+
+CURLOPT_PROXYTYPE - proxy protocol type
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXYTYPE, long type);
+~~~
+
+# DESCRIPTION
+
+Pass one of the values below to set the type of the proxy.
+
+## CURLPROXY_HTTP
+
+HTTP Proxy. Default.
+
+## CURLPROXY_HTTPS
+
+HTTPS Proxy using HTTP/1. (Added in 7.52.0 for OpenSSL and GnuTLS. Since
+7.87.0, it also works for mbedTLS, Rustls, Schannel and wolfSSL.)
+
+## CURLPROXY_HTTPS2
+
+HTTPS Proxy and attempt to speak HTTP/2 over it. (Added in 8.1.0)
+
+## CURLPROXY_HTTPS3
+
+HTTPS Proxy and attempt to speak HTTP/3 over it. (Added in 8.21.0)
+This feature is experimental and requires a build with HTTP/3 proxy support
+enabled.
+
+## CURLPROXY_HTTP_1_0
+
+HTTP 1.0 Proxy. This is similar to CURLPROXY_HTTP except it uses HTTP/1.0 for
+any CONNECT tunneling. It does not change the HTTP version of the actual HTTP
+requests, controlled by CURLOPT_HTTP_VERSION(3).
+
+## CURLPROXY_SOCKS4
+
+SOCKS4 Proxy.
+
+## CURLPROXY_SOCKS4A
+
+SOCKS4a Proxy. Proxy resolves URL hostname.
+
+## CURLPROXY_SOCKS5
+
+SOCKS5 Proxy.
+
+## CURLPROXY_SOCKS5_HOSTNAME
+
+SOCKS5 Proxy. Proxy resolves URL hostname.
+
+##
+
+Often it is more convenient to specify the proxy type with the scheme part of
+the CURLOPT_PROXY(3) string.
+
+# DEFAULT
+
+CURLPROXY_HTTP
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "local.example.com:1080");
+    /* set the proxy type */
+    curl_easy_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURLPROXY_*** enums became `long` types in 8.16.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYUSERNAME.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYUSERNAME.3
deleted file mode 100644
index 5ff3783b1e..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYUSERNAME.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXYUSERNAME 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_PROXYUSERNAME \- user name to use for proxy authentication
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXYUSERNAME,
-                          char *username);
-.SH DESCRIPTION
-Pass a char * as parameter, which should be pointing to the null-terminated
-user name to use for the transfer.
-
-\fICURLOPT_PROXYUSERNAME(3)\fP sets the user name to be used in protocol
-authentication with the proxy.
-
-To specify the proxy password use the \fICURLOPT_PROXYPASSWORD(3)\fP.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-blank
-.SH PROTOCOLS
-Most
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "http://localhost:8080");
-  curl_easy_setopt(curl, CURLOPT_PROXYUSERNAME, "mrsmith");
-  curl_easy_setopt(curl, CURLOPT_PROXYPASSWORD, "qwerty");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.19.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXYPASSWORD "(3), " CURLOPT_USERNAME "(3), "
-.BR CURLOPT_HTTPAUTH "(3), " CURLOPT_PROXYAUTH "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYUSERNAME.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYUSERNAME.md
new file mode 100644
index 0000000000..be196eed13
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYUSERNAME.md
@@ -0,0 +1,74 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXYUSERNAME
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HTTPAUTH (3)
+  - CURLOPT_PROXYAUTH (3)
+  - CURLOPT_PROXYPASSWORD (3)
+  - CURLOPT_USERNAME (3)
+Protocol:
+  - All
+Added-in: 7.19.1
+---
+
+# NAME
+
+CURLOPT_PROXYUSERNAME - username to use for proxy authentication
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXYUSERNAME,
+                          char *username);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter, which should be pointing to the
+null-terminated username to use for the transfer.
+
+CURLOPT_PROXYUSERNAME(3) sets the username to be used in protocol
+authentication with the proxy.
+
+To specify the proxy password use the CURLOPT_PROXYPASSWORD(3).
+
+The application does not have to keep the string around after setting this
+option.
+
+# DEFAULT
+
+blank
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "http://localhost:8080");
+    curl_easy_setopt(curl, CURLOPT_PROXYUSERNAME, "mrsmith");
+    curl_easy_setopt(curl, CURLOPT_PROXYPASSWORD, "qwerty");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYUSERPWD.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYUSERPWD.3
deleted file mode 100644
index fee96ebd58..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYUSERPWD.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXYUSERPWD 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_PROXYUSERPWD \- user name and password to use for proxy authentication
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXYUSERPWD, char *userpwd);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter, which should be [user name]:[password] to use for
-the connection to the HTTP proxy. Both the name and the password are URL
-decoded before used, so to include for example a colon in the user name you
-should encode it as %3A. (This is different to how \fICURLOPT_USERPWD(3)\fP is
-used - beware.)
-
-Use \fICURLOPT_PROXYAUTH(3)\fP to specify the authentication method.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-This is NULL by default.
-.SH PROTOCOLS
-Used with all protocols that can use a proxy
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "http://localhost:8080");
-  curl_easy_setopt(curl, CURLOPT_PROXYUSERPWD, "clark%20kent:superman");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK if proxies are supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY "(3), " CURLOPT_PROXYTYPE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYUSERPWD.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYUSERPWD.md
new file mode 100644
index 0000000000..87dac82a13
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXYUSERPWD.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXYUSERPWD
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY (3)
+  - CURLOPT_PROXYPASSWORD (3)
+  - CURLOPT_PROXYTYPE (3)
+  - CURLOPT_PROXYUSERNAME (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_PROXYUSERPWD - username and password to use for proxy authentication
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXYUSERPWD, char *userpwd);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter, which should be [username]:[password] to use
+for the connection to the HTTP proxy. Both the name and the password are URL
+decoded before used, so to include for example a colon in the username you
+should encode it as %3A. (This is different to how CURLOPT_USERPWD(3) is
+used - beware.)
+
+Use CURLOPT_PROXYAUTH(3) to specify the authentication method.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "http://localhost:8080");
+    curl_easy_setopt(curl, CURLOPT_PROXYUSERPWD, "clark%20kent:superman");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAINFO.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAINFO.3
deleted file mode 100644
index 5f871e90e9..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAINFO.3
+++ /dev/null
@@ -1,87 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_CAINFO 3 "16 Nov 2016" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_CAINFO \- path to proxy Certificate Authority (CA) bundle
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_CAINFO, char *path);
-.fi
-.SH DESCRIPTION
-This option is for connecting to an HTTPS proxy, not an HTTPS server.
-
-Pass a char * to a null-terminated string naming a file holding one or more
-certificates to verify the HTTPS proxy with.
-
-If \fICURLOPT_PROXY_SSL_VERIFYPEER(3)\fP is zero and you avoid verifying the
-server's certificate, \fICURLOPT_PROXY_CAINFO(3)\fP need not even indicate an
-accessible file.
-
-This option is by default set to the system path where libcurl's CA
-certificate bundle is assumed to be stored, as established at build time.
-
-(iOS and macOS only) If curl is built against Secure Transport, then this
-option is supported for backward compatibility with other SSL engines, but it
-should not be set. If the option is not set, then curl uses the certificates
-in the system and user Keychain to verify the peer, which is the preferred
-method of verifying the peer's certificate chain.
-
-The application does not have to keep the string around after setting this
-option.
-
-The default value for this can be figured out with \fICURLINFO_CAINFO(3)\fP.
-.SH DEFAULT
-Built-in system specific
-.SH PROTOCOLS
-Used with HTTPS proxy
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  /* using an HTTPS proxy */
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://localhost:443");
-  curl_easy_setopt(curl, CURLOPT_PROXY_CAINFO, "/etc/certs/cabundle.pem");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0
-
-For TLS backends that do not support certificate files, the
-\fICURLOPT_PROXY_CAINFO(3)\fP option is ignored. Refer to
-https://curl.se/docs/ssl-compared.html
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_CAINFO_BLOB "(3), " CURLOPT_PROXY_CAPATH "(3), "
-.BR CURLOPT_PROXY_SSL_VERIFYPEER "(3), " CURLOPT_PROXY_SSL_VERIFYHOST "(3), "
-.BR CURLOPT_CAINFO "(3), " CURLOPT_CAINFO_BLOB "(3), "
-.BR CURLOPT_CAPATH "(3), "
-.BR CURLOPT_SSL_VERIFYPEER "(3), " CURLOPT_SSL_VERIFYHOST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAINFO.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAINFO.md
new file mode 100644
index 0000000000..3eb5af912a
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAINFO.md
@@ -0,0 +1,96 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_CAINFO
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CAINFO (3)
+  - CURLOPT_CAINFO_BLOB (3)
+  - CURLOPT_CAPATH (3)
+  - CURLOPT_PROXY_CAINFO_BLOB (3)
+  - CURLOPT_PROXY_CAPATH (3)
+  - CURLOPT_PROXY_SSL_VERIFYHOST (3)
+  - CURLOPT_PROXY_SSL_VERIFYPEER (3)
+  - CURLOPT_SSL_VERIFYHOST (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - All
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLOPT_PROXY_CAINFO - path to proxy Certificate Authority (CA) bundle
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_CAINFO, char *path);
+~~~
+
+# DESCRIPTION
+
+This option is for connecting to an HTTPS proxy, not an HTTPS server.
+
+Pass a char pointer to a null-terminated string naming a file holding one or
+more certificates to verify the HTTPS proxy with.
+
+If CURLOPT_PROXY_SSL_VERIFYPEER(3) is zero and you avoid verifying the
+server's certificate, CURLOPT_PROXY_CAINFO(3) need not even indicate an
+accessible file.
+
+This option is by default set to the system path where libcurl's CA
+certificate bundle is assumed to be stored, as established at build time.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again and switches back to
+internal default.
+
+The default value for this can be figured out with CURLINFO_CAINFO(3).
+
+# DEFAULT
+
+Built-in system specific
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* using an HTTPS proxy */
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example:443");
+    curl_easy_setopt(curl, CURLOPT_PROXY_CAINFO, "/etc/certs/cabundle.pem");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# NOTES
+
+For TLS backends that do not support certificate files, the
+CURLOPT_PROXY_CAINFO(3) option is ignored. Refer to
+https://curl.se/docs/ssl-compared.html
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAINFO_BLOB.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAINFO_BLOB.3
deleted file mode 100644
index 0945892018..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAINFO_BLOB.3
+++ /dev/null
@@ -1,80 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_CAINFO_BLOB 3 "31 March 2021" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_CAINFO_BLOB \- proxy Certificate Authority (CA) bundle in PEM format
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_CAINFO_BLOB,
-                          struct curl_blob *stblob);
-.fi
-.SH DESCRIPTION
-This option is for connecting to an HTTPS proxy, not an HTTPS server.
-
-Pass a pointer to a curl_blob structure, which contains information (pointer
-and size) about a memory block with binary data of PEM encoded content holding
-one or more certificates to verify the HTTPS proxy with.
-
-If \fICURLOPT_PROXY_SSL_VERIFYPEER(3)\fP is zero and you avoid verifying the
-server's certificate, \fICURLOPT_PROXY_CAINFO_BLOB(3)\fP is not needed.
-
-This option overrides \fICURLOPT_PROXY_CAINFO(3)\fP.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-Used with HTTPS proxy
-.SH EXAMPLE
-.nf
-char *strpem; /* strpem must point to a PEM string */
-CURL *curl = curl_easy_init();
-if(curl) {
-  struct curl_blob blob;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  /* using an HTTPS proxy */
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://localhost:443");
-  blob.data = strpem;
-  blob.len = strlen(strpem);
-  blob.flags = CURL_BLOB_COPY;
-  curl_easy_setopt(curl, CURLOPT_PROXY_CAINFO_BLOB, &blob);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.77.0.
-
-This option is supported by the rustls (since 7.82.0), OpenSSL, Secure
-Transport and Schannel backends.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_CAINFO "(3), " CURLOPT_PROXY_CAPATH "(3), "
-.BR CURLOPT_PROXY_SSL_VERIFYPEER "(3), " CURLOPT_PROXY_SSL_VERIFYHOST "(3), "
-.BR CURLOPT_CAINFO "(3), " CURLOPT_CAINFO_BLOB "(3), "
-.BR CURLOPT_CAPATH "(3), "
-.BR CURLOPT_SSL_VERIFYPEER "(3), " CURLOPT_SSL_VERIFYHOST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAINFO_BLOB.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAINFO_BLOB.md
new file mode 100644
index 0000000000..36666edf21
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAINFO_BLOB.md
@@ -0,0 +1,94 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_CAINFO_BLOB
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CAINFO (3)
+  - CURLOPT_CAINFO_BLOB (3)
+  - CURLOPT_CAPATH (3)
+  - CURLOPT_PROXY_CAINFO (3)
+  - CURLOPT_PROXY_CAPATH (3)
+  - CURLOPT_PROXY_SSL_VERIFYHOST (3)
+  - CURLOPT_PROXY_SSL_VERIFYPEER (3)
+  - CURLOPT_SSL_VERIFYHOST (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - Rustls
+  - Schannel
+Added-in: 7.77.0
+---
+
+# NAME
+
+CURLOPT_PROXY_CAINFO_BLOB - proxy Certificate Authority (CA) bundle in PEM format
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_CAINFO_BLOB,
+                          struct curl_blob *stblob);
+~~~
+
+# DESCRIPTION
+
+This option is for connecting to an HTTPS proxy, not an HTTPS server.
+
+Pass a pointer to a curl_blob structure, which contains information (pointer
+and size) about a memory block with binary data of PEM encoded content holding
+one or more certificates to verify the HTTPS proxy with.
+
+If the blob is initialized with the flags member of struct curl_blob set to
+CURL_BLOB_COPY, the application does not have to keep the buffer around after
+setting this.
+
+If CURLOPT_PROXY_SSL_VERIFYPEER(3) is zero and you avoid verifying the
+server's certificate, CURLOPT_PROXY_CAINFO_BLOB(3) is not needed.
+
+This option overrides CURLOPT_PROXY_CAINFO(3).
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <string.h> /* for strlen */
+
+extern char *strpem; /* strpem must point to a PEM string */
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    struct curl_blob blob;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* using an HTTPS proxy */
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example:443");
+    blob.data = strpem;
+    blob.len = strlen(strpem);
+    blob.flags = CURL_BLOB_COPY;
+    curl_easy_setopt(curl, CURLOPT_PROXY_CAINFO_BLOB, &blob);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAPATH.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAPATH.3
deleted file mode 100644
index f4c7fada4d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAPATH.3
+++ /dev/null
@@ -1,77 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_CAPATH 3 "16 Nov 2016" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_CAPATH \- directory holding HTTPS proxy CA certificates
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_CAPATH, char *capath);
-.fi
-.SH DESCRIPTION
-Pass a char * to a null-terminated string naming a directory holding multiple
-CA certificates to verify the HTTPS proxy with. If libcurl is built against
-OpenSSL, the certificate directory must be prepared using the OpenSSL
-\fBc_rehash\fP utility. This makes sense only when
-\fICURLOPT_PROXY_SSL_VERIFYPEER(3)\fP is enabled (which it is by default).
-
-The application does not have to keep the string around after setting this
-option.
-
-The default value for this can be figured out with \fICURLINFO_CAPATH(3)\fP.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-Everything used over an HTTPS proxy
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  /* using an HTTPS proxy */
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://localhost:443");
-  curl_easy_setopt(curl, CURLOPT_PROXY_CAPATH, "/etc/cert-dir");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0
-
-This option is supported by the OpenSSL, GnuTLS, and mbedTLS (since 7.56.0)
-backends.
-.SH RETURN VALUE
-CURLE_OK if supported; or an error such as:
-
-CURLE_NOT_BUILT_IN - Not supported by the SSL backend
-
-CURLE_UNKNOWN_OPTION
-
-CURLE_OUT_OF_MEMORY
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_CAINFO "(3), "
-.BR CURLOPT_CAINFO "(3), " CURLOPT_PROXY_SSL_VERIFYHOST "(3), "
-.BR CURLOPT_STDERR "(3), " CURLOPT_DEBUGFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAPATH.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAPATH.md
new file mode 100644
index 0000000000..0bd3770f91
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CAPATH.md
@@ -0,0 +1,85 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_CAPATH
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CAINFO (3)
+  - CURLOPT_DEBUGFUNCTION (3)
+  - CURLOPT_PROXY_CAINFO (3)
+  - CURLOPT_PROXY_SSL_VERIFYHOST (3)
+  - CURLOPT_STDERR (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+  - mbedTLS
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLOPT_PROXY_CAPATH - directory holding HTTPS proxy CA certificates
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_CAPATH, char *capath);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer to a null-terminated string naming a directory holding
+multiple CA certificates to verify the HTTPS proxy with. If libcurl is built
+against OpenSSL, the certificate directory must be prepared using the OpenSSL
+**c_rehash** utility. This makes sense only when
+CURLOPT_PROXY_SSL_VERIFYPEER(3) is enabled (which it is by default).
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again and switch back to
+internal default.
+
+The default value for this can be figured out with CURLINFO_CAPATH(3).
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* using an HTTPS proxy */
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example:443");
+    curl_easy_setopt(curl, CURLOPT_PROXY_CAPATH, "/etc/cert-dir");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+CURLE_OK if supported; or an error such as:
+
+CURLE_NOT_BUILT_IN - Not supported by the SSL backend
+
+CURLE_UNKNOWN_OPTION
+
+CURLE_OUT_OF_MEMORY
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CRLFILE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CRLFILE.3
deleted file mode 100644
index d07061e401..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CRLFILE.3
+++ /dev/null
@@ -1,79 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_CRLFILE 3 "16 Nov 2016" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_CRLFILE \- HTTPS proxy Certificate Revocation List file
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_CRLFILE, char *file);
-.fi
-.SH DESCRIPTION
-This option is for connecting to an HTTPS proxy, not an HTTPS server.
-
-Pass a char * to a null-terminated string naming a \fIfile\fP with the
-concatenation of CRL (in PEM format) to use in the certificate validation that
-occurs during the SSL exchange.
-
-When curl is built to use GnuTLS, there is no way to influence the use of CRL
-passed to help in the verification process. When libcurl is built with OpenSSL
-support, X509_V_FLAG_CRL_CHECK and X509_V_FLAG_CRL_CHECK_ALL are both set,
-requiring CRL check against all the elements of the certificate chain if a CRL
-file is passed.
-
-This option makes sense only when used in combination with the
-\fICURLOPT_PROXY_SSL_VERIFYPEER(3)\fP option.
-
-A specific error code (\fICURLE_SSL_CRL_BADFILE\fP) is defined with the
-option. It is returned when the SSL exchange fails because the CRL file cannot
-be loaded.  A failure in certificate verification due to a revocation
-information found in the CRL does not trigger this specific error.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-Used with HTTPS proxy.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://localhost:80");
-  curl_easy_setopt(curl, CURLOPT_PROXY_CRLFILE, "/etc/certs/crl.pem");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_SSL_VERIFYPEER "(3), " CURLOPT_PROXY_SSL_VERIFYHOST "(3), "
-.BR CURLOPT_SSL_VERIFYPEER "(3), " CURLOPT_SSL_VERIFYHOST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CRLFILE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CRLFILE.md
new file mode 100644
index 0000000000..2dda8235c6
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_CRLFILE.md
@@ -0,0 +1,91 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_CRLFILE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_SSL_VERIFYHOST (3)
+  - CURLOPT_PROXY_SSL_VERIFYPEER (3)
+  - CURLOPT_SSL_VERIFYHOST (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - GnuTLS
+  - mbedTLS
+  - OpenSSL
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLOPT_PROXY_CRLFILE - HTTPS proxy Certificate Revocation List file
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_CRLFILE, char *file);
+~~~
+
+# DESCRIPTION
+
+This option is for connecting to an HTTPS proxy, not an HTTPS server.
+
+Pass a char pointer to a null-terminated string naming a *file* with the
+concatenation of CRL (in PEM format) to use in the certificate validation that
+occurs during the SSL exchange.
+
+When curl is built to use GnuTLS, there is no way to influence the use of CRL
+passed to help in the verification process. When libcurl is built with OpenSSL
+support, X509_V_FLAG_CRL_CHECK and X509_V_FLAG_CRL_CHECK_ALL are both set,
+requiring CRL check against all the elements of the certificate chain if a CRL
+file is passed.
+
+This option makes sense only when used in combination with the
+CURLOPT_PROXY_SSL_VERIFYPEER(3) option.
+
+A specific error code (*CURLE_SSL_CRL_BADFILE*) is defined with the option. It
+is returned when the SSL exchange fails because the CRL file cannot be loaded.
+A failure in certificate verification due to a revocation information found in
+the CRL does not trigger this specific error.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://localhost:80");
+    curl_easy_setopt(curl, CURLOPT_PROXY_CRLFILE, "/etc/certs/crl.pem");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_ISSUERCERT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_ISSUERCERT.3
deleted file mode 100644
index 5cf5358347..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_ISSUERCERT.3
+++ /dev/null
@@ -1,77 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_ISSUERCERT 3 "24 Jun 2020" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_ISSUERCERT \- proxy issuer SSL certificate filename
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_ISSUERCERT, char *file);
-.fi
-.SH DESCRIPTION
-Pass a char * to a null-terminated string naming a \fIfile\fP holding a CA
-certificate in PEM format. If the option is set, an additional check against
-the peer certificate is performed to verify the issuer of the the HTTPS proxy
-is indeed the one associated with the certificate provided by the option.
-This additional check is useful in multi-level PKI where one needs to enforce
-that the peer certificate is from a specific branch of the tree.
-
-This option makes sense only when used in combination with the
-\fICURLOPT_PROXY_SSL_VERIFYPEER(3)\fP option. Otherwise, the result of the
-check is not considered as failure.
-
-A specific error code (CURLE_SSL_ISSUER_ERROR) is defined with the option,
-which is returned if the setup of the SSL/TLS session has failed due to a
-mismatch with the issuer of peer certificate
-(\fICURLOPT_PROXY_SSL_VERIFYPEER(3)\fP has to be set too for the check to
-fail).
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS-based protocols
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  /* using an HTTPS proxy */
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://localhost:443");
-  curl_easy_setopt(curl, CURLOPT_PROXY_ISSUERCERT, "/etc/certs/cacert.pem");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.71.0. This option is supported by the OpenSSL backends.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_SSL_VERIFYPEER "(3), " CURLOPT_PROXY_SSL_VERIFYHOST "(3), "
-.BR CURLOPT_SSL_VERIFYPEER "(3), " CURLOPT_SSL_VERIFYHOST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_ISSUERCERT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_ISSUERCERT.md
new file mode 100644
index 0000000000..c3687a46fe
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_ISSUERCERT.md
@@ -0,0 +1,88 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_ISSUERCERT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_ISSUERCERT (3)
+  - CURLOPT_PROXY_SSL_VERIFYHOST (3)
+  - CURLOPT_PROXY_SSL_VERIFYPEER (3)
+  - CURLOPT_SSL_VERIFYHOST (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+Added-in: 7.71.0
+---
+
+# NAME
+
+CURLOPT_PROXY_ISSUERCERT - proxy issuer SSL certificate filename
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_ISSUERCERT, char *file);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer to a null-terminated string naming a *file* holding a CA
+certificate in PEM format. If the option is set, an additional check against
+the peer certificate is performed to verify the issuer of the HTTPS proxy is
+indeed the one associated with the certificate provided by the option. This
+additional check is useful in multi-level PKI where one needs to enforce that
+the peer certificate is from a specific branch of the tree.
+
+This option makes sense only when used in combination with the
+CURLOPT_PROXY_SSL_VERIFYPEER(3) option. Otherwise, the result of the check is
+not considered as failure.
+
+A specific error code (CURLE_SSL_ISSUER_ERROR) is defined with the option,
+which is returned if the setup of the SSL/TLS session has failed due to a
+mismatch with the issuer of peer certificate (CURLOPT_PROXY_SSL_VERIFYPEER(3)
+has to be set too for the check to fail).
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* using an HTTPS proxy */
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example:443");
+    curl_easy_setopt(curl, CURLOPT_PROXY_ISSUERCERT, "/etc/certs/cacert.pem");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_ISSUERCERT_BLOB.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_ISSUERCERT_BLOB.3
deleted file mode 100644
index 65d1de212a..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_ISSUERCERT_BLOB.3
+++ /dev/null
@@ -1,87 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_ISSUERCERT_BLOB 3 "24 Jun 2020" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_ISSUERCERT_BLOB \- proxy issuer SSL certificate from memory blob
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_ISSUERCERT_BLOB,
-                          struct curl_blob *blob);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a curl_blob struct, which contains information (pointer and
-size) about a memory block with binary data of a CA certificate in PEM
-format. If the option is set, an additional check against the peer certificate
-is performed to verify the issuer of the the HTTPS proxy is indeed the one
-associated with the certificate provided by the option. This additional check
-is useful in multi-level PKI where one needs to enforce that the peer
-certificate is from a specific branch of the tree.
-
-This option should be used in combination with the
-\fICURLOPT_PROXY_SSL_VERIFYPEER(3)\fP option. Otherwise, the result of the
-check is not considered as failure.
-
-A specific error code (CURLE_SSL_ISSUER_ERROR) is defined with the option,
-which is returned if the setup of the SSL/TLS session has failed due to a
-mismatch with the issuer of peer certificate
-(\fICURLOPT_PROXY_SSL_VERIFYPEER(3)\fP has to be set too for the check to
-fail).
-
-If the blob is initialized with the flags member of struct curl_blob set to
-CURL_BLOB_COPY, the application does not have to keep the buffer around after
-setting this.
-
-This option is an alternative to \fICURLOPT_PROXY_ISSUERCERT(3)\fP which
-instead expects a file name as input.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS-based protocols
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  struct curl_blob blob;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  /* using an HTTPS proxy */
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://localhost:443");
-  blob.data = certificateData;
-  blob.len = filesize;
-  blob.flags = CURL_BLOB_COPY;
-  curl_easy_setopt(curl, CURLOPT_PROXY_ISSUERCERT_BLOB, &blob);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.71.0. This option is supported by the OpenSSL backends.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_SSL_VERIFYPEER "(3), " CURLOPT_PROXY_SSL_VERIFYHOST "(3), "
-.BR CURLOPT_SSL_VERIFYPEER "(3), " CURLOPT_SSL_VERIFYHOST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_ISSUERCERT_BLOB.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_ISSUERCERT_BLOB.md
new file mode 100644
index 0000000000..180a7b1808
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_ISSUERCERT_BLOB.md
@@ -0,0 +1,98 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_ISSUERCERT_BLOB
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_ISSUERCERT_BLOB (3)
+  - CURLOPT_PROXY_SSL_VERIFYHOST (3)
+  - CURLOPT_PROXY_SSL_VERIFYPEER (3)
+  - CURLOPT_SSL_VERIFYHOST (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+Added-in: 7.71.0
+---
+
+# NAME
+
+CURLOPT_PROXY_ISSUERCERT_BLOB - proxy issuer SSL certificate from memory blob
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_ISSUERCERT_BLOB,
+                          struct curl_blob *blob);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a curl_blob struct, which contains information (pointer and
+size) about a memory block with binary data of a CA certificate in PEM
+format. If the option is set, an additional check against the peer certificate
+is performed to verify the issuer of the HTTPS proxy is indeed the one
+associated with the certificate provided by the option. This additional check
+is useful in multi-level PKI where one needs to enforce that the peer
+certificate is from a specific branch of the tree.
+
+This option should be used in combination with the
+CURLOPT_PROXY_SSL_VERIFYPEER(3) option. Otherwise, the result of the
+check is not considered as failure.
+
+A specific error code (CURLE_SSL_ISSUER_ERROR) is defined with the option,
+which is returned if the setup of the SSL/TLS session has failed due to a
+mismatch with the issuer of peer certificate
+(CURLOPT_PROXY_SSL_VERIFYPEER(3) has to be set too for the check to fail).
+
+If the blob is initialized with the flags member of struct curl_blob set to
+CURL_BLOB_COPY, the application does not have to keep the buffer around after
+setting this.
+
+This option is an alternative to CURLOPT_PROXY_ISSUERCERT(3) which
+instead expects a filename as input.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+
+extern char *certificateData; /* point to the data */
+size_t filesize; /* size of the data */
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    struct curl_blob blob;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* using an HTTPS proxy */
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example:443");
+    blob.data = certificateData;
+    blob.len = filesize;
+    blob.flags = CURL_BLOB_COPY;
+    curl_easy_setopt(curl, CURLOPT_PROXY_ISSUERCERT_BLOB, &blob);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_KEYPASSWD.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_KEYPASSWD.3
deleted file mode 100644
index 23343ffe80..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_KEYPASSWD.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_KEYPASSWD 3 "16 Nov 2016" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_KEYPASSWD \- passphrase for the proxy private key
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_KEYPASSWD, char *pwd);
-.fi
-.SH DESCRIPTION
-This option is for connecting to an HTTPS proxy, not an HTTPS server.
-
-Pass a pointer to a null-terminated string as parameter. It is used as the
-password required to use the \fICURLOPT_PROXY_SSLKEY(3)\fP private key.  You
-never need a pass phrase to load a certificate but you need one to load your
-private key.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-Used with HTTPS proxy
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy:443");
-  curl_easy_setopt(curl, CURLOPT_PROXY_KEYPASSWD, "superman");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0
-.SH RETURN VALUE
-Returns CURLE_OK if TLS enabled, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_SSLKEY "(3), " CURLOPT_SSH_PRIVATE_KEYFILE "(3), "
-.BR CURLOPT_SSLKEY "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_KEYPASSWD.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_KEYPASSWD.md
new file mode 100644
index 0000000000..98f3683eef
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_KEYPASSWD.md
@@ -0,0 +1,79 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_KEYPASSWD
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_KEYPASSWD (3)
+  - CURLOPT_PROXY_SSLKEY (3)
+  - CURLOPT_SSH_PRIVATE_KEYFILE (3)
+  - CURLOPT_SSLKEY (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - mbedTLS
+  - Schannel
+  - wolfSSL
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLOPT_PROXY_KEYPASSWD - passphrase for the proxy private key
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_KEYPASSWD, char *pwd);
+~~~
+
+# DESCRIPTION
+
+This option is for connecting to an HTTPS proxy, not an HTTPS server.
+
+Pass a pointer to a null-terminated string as parameter. It is used as the
+password required to use the CURLOPT_PROXY_SSLKEY(3) private key. You never
+need a passphrase to load a certificate but you need one to load your private
+key.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example:443");
+    curl_easy_setopt(curl, CURLOPT_PROXY_KEYPASSWD, "superman");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_PINNEDPUBLICKEY.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_PINNEDPUBLICKEY.3
deleted file mode 100644
index 1d17551000..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_PINNEDPUBLICKEY.3
+++ /dev/null
@@ -1,115 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_PINNEDPUBLICKEY 3 "24 Nov 2016" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_PINNEDPUBLICKEY \- pinned public key for https proxy
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_PINNEDPUBLICKEY, char *pinnedpubkey);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter. The string can be the
-file name of your pinned public key. The file format expected is "PEM" or "DER".
-The string can also be any number of base64 encoded sha256 hashes preceded by
-"sha256//" and separated by ";"
-
-When negotiating a TLS or SSL connection, the https proxy sends a certificate
-indicating its identity. A public key is extracted from this certificate and
-if it does not exactly match the public key provided to this option, libcurl
-aborts the connection before sending or receiving any data.
-
-On mismatch, \fICURLE_SSL_PINNEDPUBKEYNOTMATCH\fP is returned.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy:443");
-  curl_easy_setopt(curl, CURLOPT_PROXY_PINNEDPUBLICKEY,
-  "sha256//YhKJKSzoTt2b5FP18fvpHo7fJYqQCjAa3HWY3tvRMwE=;sha256//t62CeU2tQiqkexU74Gxa2eg7fRbEgoChTociMee9wno=");
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH PUBLIC KEY EXTRACTION
-If you do not have the https proxy server's public key file you can extract it
-from the https proxy server's certificate.
-.nf
-# retrieve the server's certificate if you do not already have it
-#
-# be sure to examine the certificate to see if it is what you expected
-#
-# Windows-specific:
-# - Use NUL instead of /dev/null.
-# - OpenSSL may wait for input instead of disconnecting. Hit enter.
-# - If you do not have sed, then just copy the certificate into a file:
-#   Lines from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----.
-#
-openssl s_client -servername www.example.com -connect www.example.com:443 < /dev/null | sed -n "/-----BEGIN/,/-----END/p" > www.example.com.pem
-
-# extract public key in pem format from certificate
-openssl x509 -in www.example.com.pem -pubkey -noout > www.example.com.pubkey.pem
-
-# convert public key from pem to der
-openssl asn1parse -noout -inform pem -in www.example.com.pubkey.pem -out www.example.com.pubkey.der
-
-# sha256 hash and base64 encode der to string for use
-openssl dgst -sha256 -binary www.example.com.pubkey.der | openssl base64
-.fi
-The public key in PEM format contains a header, base64 data and a
-footer:
-.nf
------BEGIN PUBLIC KEY-----
-[BASE 64 DATA]
------END PUBLIC KEY-----
-.fi
-.SH AVAILABILITY
-PEM/DER support:
-
-  7.52.0: GnuTLS, OpenSSL, mbedTLS, wolfSSL
-
-sha256 support:
-
-  7.52.0: GnuTLS, OpenSSL, mbedTLS, wolfSSL
-
-Other SSL backends not supported.
-.SH RETURN VALUE
-Returns CURLE_OK if TLS enabled, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_SSL_VERIFYPEER "(3), "
-.BR CURLOPT_PROXY_SSL_VERIFYHOST "(3), "
-.BR CURLOPT_PROXY_CAINFO "(3), "
-.BR CURLOPT_PROXY_CAPATH "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_PINNEDPUBLICKEY.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_PINNEDPUBLICKEY.md
new file mode 100644
index 0000000000..21e0bd42a3
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_PINNEDPUBLICKEY.md
@@ -0,0 +1,139 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_PINNEDPUBLICKEY
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PINNEDPUBLICKEY (3)
+  - CURLOPT_PROXY_CAINFO (3)
+  - CURLOPT_PROXY_CAPATH (3)
+  - CURLOPT_PROXY_SSL_VERIFYHOST (3)
+  - CURLOPT_PROXY_SSL_VERIFYPEER (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+  - mbedTLS
+  - wolfSSL
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLOPT_PROXY_PINNEDPUBLICKEY - pinned public key for https proxy
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_PINNEDPUBLICKEY,
+                          char *pinnedpubkey);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter. The string can be the
+filename of your pinned public key. The file format expected is "PEM" or
+"DER". The string can also be any number of base64 encoded sha256 hashes
+preceded by "sha256//" and separated by ";"
+
+When negotiating a TLS or SSL connection, the https proxy sends a certificate
+indicating its identity. A public key is extracted from this certificate and
+if it does not exactly match the public key provided to this option, libcurl
+aborts the connection before sending or receiving any data.
+
+On mismatch, *CURLE_SSL_PINNEDPUBKEYNOTMATCH* is returned.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example:443");
+    curl_easy_setopt(curl, CURLOPT_PROXY_PINNEDPUBLICKEY,
+                     "sha256//YhKJKSzoTt2b5FP18fvpHo7fJYqQCjA"
+                     "a3HWY3tvRMwE=;sha256//t62CeU2tQiqkexU74"
+                     "Gxa2eg7fRbEgoChTociMee9wno=");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# PUBLIC KEY EXTRACTION
+
+If you do not have the https proxy server's public key file you can extract it
+from the https proxy server's certificate.
+~~~c
+# retrieve the server's certificate if you do not already have it
+#
+# be sure to examine the certificate to see if it is what you expected
+#
+# Windows-specific:
+# - Use NUL instead of /dev/null.
+# - OpenSSL may wait for input instead of disconnecting. Hit enter.
+# - If you do not have sed, then copy the certificate into a file:
+#   Lines from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----.
+#
+openssl s_client -servername www.example.com -connect www.example.com:443 \
+  < /dev/null | sed -n "/-----BEGIN/,/-----END/p" > www.example.com.pem
+
+# extract public key in pem format from certificate
+openssl x509 -in www.example.com.pem -pubkey -noout > www.example.com.pubkey.pem
+
+# convert public key from pem to der
+openssl asn1parse -noout -inform pem -in www.example.com.pubkey.pem \
+  -out www.example.com.pubkey.der
+
+# sha256 hash and base64 encode der to string for use
+openssl dgst -sha256 -binary www.example.com.pubkey.der | openssl base64
+~~~
+The public key in PEM format contains a header, base64 data and a
+footer:
+~~~c
+-----BEGIN PUBLIC KEY-----
+[BASE 64 DATA]
+-----END PUBLIC KEY-----
+~~~
+
+# HISTORY
+
+PEM/DER support:
+
+ 7.52.0: GnuTLS, OpenSSL, mbedTLS, wolfSSL
+
+sha256 support:
+
+ 7.52.0: GnuTLS, OpenSSL, mbedTLS, wolfSSL
+
+Other SSL backends not supported.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SERVICE_NAME.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SERVICE_NAME.3
deleted file mode 100644
index 664833ca12..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SERVICE_NAME.3
+++ /dev/null
@@ -1,62 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_SERVICE_NAME 3 "17 Jun 2015" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_SERVICE_NAME \- proxy authentication service name
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SERVICE_NAME,
-                          char *name);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter to a string holding the \fIname\fP of the
-service. The default service name is \fB"HTTP"\fP for HTTP based proxies and
-\fB"rcmd"\fP for SOCKS5. This option allows you to change it.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-See above
-.SH PROTOCOLS
-All network protocols
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_PROXY_SERVICE_NAME, "custom");
-  ret = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.43.0 for HTTP proxies, 7.49.0 for SOCKS5 proxies.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY "(3), " CURLOPT_PROXYTYPE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SERVICE_NAME.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SERVICE_NAME.md
new file mode 100644
index 0000000000..9bdb4af26a
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SERVICE_NAME.md
@@ -0,0 +1,69 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_SERVICE_NAME
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY (3)
+  - CURLOPT_PROXYTYPE (3)
+  - CURLOPT_SERVICE_NAME (3)
+Protocol:
+  - All
+Added-in: 7.43.0
+---
+
+# NAME
+
+CURLOPT_PROXY_SERVICE_NAME - proxy authentication service name
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SERVICE_NAME,
+                          char *name);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter to a string holding the *name* of the
+service. The default service name is **"HTTP"** for HTTP based proxies and
+**"rcmd"** for SOCKS5. This option allows you to change it.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+See above
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_PROXY_SERVICE_NAME, "custom");
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERT.3
deleted file mode 100644
index fd37d1d158..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERT.3
+++ /dev/null
@@ -1,76 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_SSLCERT 3 "16 Nov 2016" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_SSLCERT \- HTTPS proxy client certificate
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSLCERT, char *cert);
-.fi
-.SH DESCRIPTION
-This option is for connecting to an HTTPS proxy, not an HTTPS server.
-
-Pass a pointer to a null-terminated string as parameter. The string should be
-the file name of your client certificate used to connect to the HTTPS proxy.
-The default format is "P12" on Secure Transport and "PEM" on other engines,
-and can be changed with \fICURLOPT_PROXY_SSLCERTTYPE(3)\fP.
-
-With Secure Transport, this can also be the nickname of the certificate you
-wish to authenticate with as it is named in the security database. If you want
-to use a file from the current directory, please precede it with "./" prefix,
-in order to avoid confusion with a nickname.
-
-When using a client certificate, you most likely also need to provide a
-private key with \fICURLOPT_PROXY_SSLKEY(3)\fP.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-Used with HTTPS proxy
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy");
-  curl_easy_setopt(curl, CURLOPT_PROXY_SSLCERT, "client.pem");
-  curl_easy_setopt(curl, CURLOPT_PROXY_SSLKEY, "key.pem");
-  curl_easy_setopt(curl, CURLOPT_PROXY_KEYPASSWD, "s3cret");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0
-.SH RETURN VALUE
-Returns CURLE_OK if TLS enabled, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_SSLCERTTYPE "(3), " CURLOPT_PROXY_SSLKEY "(3), "
-.BR CURLOPT_SSLCERT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERT.md
new file mode 100644
index 0000000000..8ba84add1f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERT.md
@@ -0,0 +1,84 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_SSLCERT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_SSLCERTTYPE (3)
+  - CURLOPT_PROXY_SSLKEY (3)
+  - CURLOPT_SSLCERT (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+  - mbedTLS
+  - Schannel
+  - wolfSSL
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLOPT_PROXY_SSLCERT - HTTPS proxy client certificate
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSLCERT, char *cert);
+~~~
+
+# DESCRIPTION
+
+This option is for connecting to an HTTPS proxy, not an HTTPS server.
+
+Pass a pointer to a null-terminated string as parameter. The string should be
+the filename of your client certificate used to connect to the HTTPS proxy.
+The default format "PEM", and can be changed with
+CURLOPT_PROXY_SSLCERTTYPE(3).
+
+When using a client certificate, you most likely also need to provide a
+private key with CURLOPT_PROXY_SSLKEY(3).
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example");
+    curl_easy_setopt(curl, CURLOPT_PROXY_SSLCERT, "client.pem");
+    curl_easy_setopt(curl, CURLOPT_PROXY_SSLKEY, "key.pem");
+    curl_easy_setopt(curl, CURLOPT_PROXY_KEYPASSWD, "s3cret");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERTTYPE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERTTYPE.3
deleted file mode 100644
index 502868f936..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERTTYPE.3
+++ /dev/null
@@ -1,72 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_SSLCERTTYPE 3 "16 Nov 2016" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_SSLCERTTYPE \- type of the proxy client SSL certificate
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSLCERTTYPE, char *type);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter. The string should be
-the format of your client certificate used when connecting to an HTTPS proxy.
-
-Supported formats are "PEM" and "DER", except with Secure Transport or
-Schannel. OpenSSL (versions 0.9.3 and later), Secure Transport (on iOS 5 or
-later, or OS X 10.7 or later) and Schannel support "P12" for PKCS#12-encoded
-files.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-"PEM"
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy");
-  curl_easy_setopt(curl, CURLOPT_PROXY_SSLCERT, "client.pem");
-  curl_easy_setopt(curl, CURLOPT_PROXY_SSLCERTTYPE, "PEM");
-  curl_easy_setopt(curl, CURLOPT_PROXY_SSLKEY, "key.pem");
-  curl_easy_setopt(curl, CURLOPT_PROXY_KEYPASSWD, "s3cret");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0
-
-If built TLS enabled.
-.SH RETURN VALUE
-Returns CURLE_OK if TLS is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_SSLCERT "(3), " CURLOPT_PROXY_SSLKEY "(3), "
-.BR CURLOPT_SSLCERTTYPE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERTTYPE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERTTYPE.md
new file mode 100644
index 0000000000..c7c7b728a5
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERTTYPE.md
@@ -0,0 +1,81 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_SSLCERTTYPE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_SSLCERT (3)
+  - CURLOPT_PROXY_SSLKEY (3)
+  - CURLOPT_SSLCERTTYPE (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+  - mbedTLS
+  - Schannel
+  - wolfSSL
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLOPT_PROXY_SSLCERTTYPE - type of the proxy client SSL certificate
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSLCERTTYPE, char *type);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter. The string should be
+the format of your client certificate used when connecting to an HTTPS proxy.
+
+Supported formats are "PEM" and "DER", except with Schannel. OpenSSL and
+Schannel support "P12" for PKCS#12-encoded files.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+"PEM"
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example");
+    curl_easy_setopt(curl, CURLOPT_PROXY_SSLCERT, "client.pem");
+    curl_easy_setopt(curl, CURLOPT_PROXY_SSLCERTTYPE, "PEM");
+    curl_easy_setopt(curl, CURLOPT_PROXY_SSLKEY, "key.pem");
+    curl_easy_setopt(curl, CURLOPT_PROXY_KEYPASSWD, "s3cret");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERT_BLOB.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERT_BLOB.3
deleted file mode 100644
index f97bb81d75..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERT_BLOB.3
+++ /dev/null
@@ -1,77 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_SSLCERT_BLOB 3 "24 Jun 2020" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_SSLCERT_BLOB \- SSL proxy client certificate from memory blob
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSLCERT_BLOB,
-                          struct curl_blob *blob);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a curl_blob structure, which contains information (pointer
-and size) about a memory block with binary data of the certificate used to
-connect to the HTTPS proxy. The format must be "P12" on Secure Transport or
-Schannel. The format must be "P12" or "PEM" on OpenSSL.  The string "P12" or
-"PEM" must be specified with \fICURLOPT_PROXY_SSLCERTTYPE(3)\fP.
-
-If the blob is initialized with the flags member of struct curl_blob set to
-CURL_BLOB_COPY, the application does not have to keep the buffer around after
-setting this.
-
-This option is an alternative to \fICURLOPT_PROXY_SSLCERT(3)\fP which instead
-expects a file name as input.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-Used with HTTPS proxy
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  struct curl_blob blob;
-  blob.data = certificateData;
-  blob.len = filesize;
-  blob.flags = CURL_BLOB_COPY;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy");
-  curl_easy_setopt(curl, CURLOPT_PROXY_SSLKEY, "key.pem");
-  curl_easy_setopt(curl, CURLOPT_PROXY_KEYPASSWD, "s3cret");
-  curl_easy_setopt(curl, CURLOPT_PROXY_SSLCERT_BLOB, &blob);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.71.0. This option is supported by the OpenSSL, Secure Transport and
-Schannel backends.
-.SH RETURN VALUE
-Returns CURLE_OK if TLS enabled, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_SSLCERTTYPE "(3), " CURLOPT_PROXY_SSLKEY "(3), "
-.BR CURLOPT_PROXY_SSLCERT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERT_BLOB.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERT_BLOB.md
new file mode 100644
index 0000000000..5be7b134a0
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLCERT_BLOB.md
@@ -0,0 +1,88 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_SSLCERT_BLOB
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_SSLCERT (3)
+  - CURLOPT_PROXY_SSLCERTTYPE (3)
+  - CURLOPT_PROXY_SSLKEY (3)
+  - CURLOPT_SSLCERT_BLOB (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - Schannel
+Added-in: 7.71.0
+---
+
+# NAME
+
+CURLOPT_PROXY_SSLCERT_BLOB - SSL proxy client certificate from memory blob
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSLCERT_BLOB,
+                          struct curl_blob *blob);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a curl_blob structure, which contains information (pointer
+and size) about a memory block with binary data of the certificate used to
+connect to the HTTPS proxy. The format must be "P12" on Schannel. The format
+must be "P12" or "PEM" on OpenSSL. The string "P12" or "PEM" must be specified
+with CURLOPT_PROXY_SSLCERTTYPE(3).
+
+If the blob is initialized with the flags member of struct curl_blob set to
+CURL_BLOB_COPY, the application does not have to keep the buffer around after
+setting this.
+
+This option is an alternative to CURLOPT_PROXY_SSLCERT(3) which instead
+expects a filename as input.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+
+extern char *certificateData; /* point to data */
+extern size_t filesize; /* size of the data */
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    struct curl_blob blob;
+    blob.data = certificateData;
+    blob.len = filesize;
+    blob.flags = CURL_BLOB_COPY;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example");
+    curl_easy_setopt(curl, CURLOPT_PROXY_SSLKEY, "key.pem");
+    curl_easy_setopt(curl, CURLOPT_PROXY_KEYPASSWD, "s3cret");
+    curl_easy_setopt(curl, CURLOPT_PROXY_SSLCERT_BLOB, &blob);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEY.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEY.3
deleted file mode 100644
index 5d1e669eef..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEY.3
+++ /dev/null
@@ -1,72 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_SSLKEY 3 "16 Nov 2016" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_SSLKEY \- private key file for HTTPS proxy client cert
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSLKEY, char *keyfile);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter. The string should be
-the file name of your private key used for connecting to the HTTPS proxy. The
-default format is "PEM" and can be changed with
-\fICURLOPT_PROXY_SSLKEYTYPE(3)\fP.
-
-(Windows, iOS and Mac OS X) This option is ignored by Secure Transport and
-Schannel SSL backends because they expect the private key to be already
-present in the key chain or PKCS#12 file containing the certificate.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy");
-  curl_easy_setopt(curl, CURLOPT_PROXY_SSLCERT, "client.pem");
-  curl_easy_setopt(curl, CURLOPT_PROXY_SSLKEY, "key.pem");
-  curl_easy_setopt(curl, CURLOPT_PROXY_KEYPASSWD, "s3cret");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0
-
-If built TLS enabled.
-.SH RETURN VALUE
-Returns CURLE_OK if TLS is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_SSLKEYTYPE "(3), " CURLOPT_PROXY_SSLCERT "(3), "
-.BR CURLOPT_SSLKEYTYPE "(3), " CURLOPT_SSLCERT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEY.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEY.md
new file mode 100644
index 0000000000..9b8d293735
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEY.md
@@ -0,0 +1,84 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_SSLKEY
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_SSLCERT (3)
+  - CURLOPT_PROXY_SSLKEYTYPE (3)
+  - CURLOPT_SSLCERT (3)
+  - CURLOPT_SSLKEY (3)
+  - CURLOPT_SSLKEYTYPE (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - mbedTLS
+  - Schannel
+  - wolfSSL
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLOPT_PROXY_SSLKEY - private key file for HTTPS proxy client cert
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSLKEY, char *keyfile);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter. The string should be
+the filename of your private key used for connecting to the HTTPS proxy. The
+default format is "PEM" and can be changed with
+CURLOPT_PROXY_SSLKEYTYPE(3).
+
+This option is ignored by the Schannel backend because it expects the private
+key to be already present in the key chain or PKCS#12 file containing the
+certificate.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example");
+    curl_easy_setopt(curl, CURLOPT_PROXY_SSLCERT, "client.pem");
+    curl_easy_setopt(curl, CURLOPT_PROXY_SSLKEY, "key.pem");
+    curl_easy_setopt(curl, CURLOPT_PROXY_KEYPASSWD, "s3cret");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEYTYPE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEYTYPE.3
deleted file mode 100644
index ca1d261745..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEYTYPE.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_SSLKEYTYPE 3 "16 Nov 2016" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_SSLKEYTYPE \- type of the proxy private key file
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSLKEYTYPE, char *type);
-.fi
-.SH DESCRIPTION
-This option is for connecting to an HTTPS proxy, not an HTTPS server.
-
-Pass a pointer to a null-terminated string as parameter. The string should be
-the format of your private key. Supported formats are "PEM", "DER" and "ENG".
-
-The application does not have to keep the string around after setting this
-option.
-.SH PROTOCOLS
-Used with HTTPS proxy
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy");
-  curl_easy_setopt(curl, CURLOPT_PROXY_SSLCERT, "client.pem");
-  curl_easy_setopt(curl, CURLOPT_PROXY_SSLKEY, "key.pem");
-  curl_easy_setopt(curl, CURLOPT_PROXY_SSLKEYTYPE, "PEM");
-  curl_easy_setopt(curl, CURLOPT_PROXY_KEYPASSWD, "s3cret");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0
-.SH RETURN VALUE
-Returns CURLE_OK if TLS is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_SSLKEY "(3), " CURLOPT_PROXY_SSLCERT "(3), "
-.BR CURLOPT_SSLKEYTYPE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEYTYPE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEYTYPE.md
new file mode 100644
index 0000000000..8513dffced
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEYTYPE.md
@@ -0,0 +1,74 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_SSLKEYTYPE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_SSLCERT (3)
+  - CURLOPT_PROXY_SSLKEY (3)
+  - CURLOPT_SSLKEYTYPE (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - wolfSSL
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLOPT_PROXY_SSLKEYTYPE - type of the proxy private key file
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSLKEYTYPE, char *type);
+~~~
+
+# DESCRIPTION
+
+This option is for connecting to an HTTPS proxy, not an HTTPS server.
+
+Pass a pointer to a null-terminated string as parameter. The string should be
+the format of your private key. Supported formats are "PEM", "DER", "ENG" and
+"PROV" (the latter added in curl 8.12.0).
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example");
+    curl_easy_setopt(curl, CURLOPT_PROXY_SSLCERT, "client.pem");
+    curl_easy_setopt(curl, CURLOPT_PROXY_SSLKEY, "key.pem");
+    curl_easy_setopt(curl, CURLOPT_PROXY_SSLKEYTYPE, "PEM");
+    curl_easy_setopt(curl, CURLOPT_PROXY_KEYPASSWD, "s3cret");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEY_BLOB.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEY_BLOB.3
deleted file mode 100644
index e6d769e64e..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEY_BLOB.3
+++ /dev/null
@@ -1,75 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_SSLKEY_BLOB 3 "24 Jun 2020" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_SSLKEY_BLOB \- private key for proxy cert from memory blob
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSLKEY_BLOB,
-                          struct curl_blob *blob);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a curl_blob structure that contains information (pointer and
-size) about the private key for connecting to the HTTPS proxy. Compatible with
-OpenSSL. The format (like "PEM") must be specified with
-\fICURLOPT_PROXY_SSLKEYTYPE(3)\fP.
-
-If the blob is initialized with the flags member of struct curl_blob set to
-CURL_BLOB_COPY, the application does not have to keep the buffer around after
-setting this.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  struct curl_blob blob;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy");
-  blob.data = certificateData;
-  blob.len = filesize;
-  blob.flags = CURL_BLOB_COPY;
-  curl_easy_setopt(curl, CURLOPT_PROXY_SSLCERT_BLOB, &blob);
-  curl_easy_setopt(curl, CURLOPT_PROXY_SSLCERTTYPE, "PEM");
-
-  blob.data = privateKeyData;
-  blob.len = privateKeySize;
-  curl_easy_setopt(curl, CURLOPT_PROXY_SSLKEY_BLOB, &blob);
-  curl_easy_setopt(curl, CURLOPT_PROXY_KEYPASSWD, "s3cret");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.71.0. This option is supported by the OpenSSL backends.
-.SH RETURN VALUE
-Returns CURLE_OK if TLS enabled, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_SSLKEYTYPE "(3), " CURLOPT_SSLKEY "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEY_BLOB.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEY_BLOB.md
new file mode 100644
index 0000000000..65f940b861
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLKEY_BLOB.md
@@ -0,0 +1,89 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_SSLKEY_BLOB
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSLKEY (3)
+  - CURLOPT_SSLKEYTYPE (3)
+  - CURLOPT_SSLKEY_BLOB (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+Added-in: 7.71.0
+---
+
+# NAME
+
+CURLOPT_PROXY_SSLKEY_BLOB - private key for proxy cert from memory blob
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSLKEY_BLOB,
+                          struct curl_blob *blob);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a curl_blob structure that contains information (pointer and
+size) about the private key for connecting to the HTTPS proxy. Compatible with
+OpenSSL. The format (like "PEM") must be specified with
+CURLOPT_PROXY_SSLKEYTYPE(3).
+
+If the blob is initialized with the flags member of struct curl_blob set to
+CURL_BLOB_COPY, the application does not have to keep the buffer around after
+setting this.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+
+extern char *certificateData; /* point to data */
+extern size_t filesize; /* size of data */
+
+extern char *privateKeyData; /* point to data */
+extern size_t privateKeySize; /* size */
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    struct curl_blob blob;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example");
+    blob.data = certificateData;
+    blob.len = filesize;
+    blob.flags = CURL_BLOB_COPY;
+    curl_easy_setopt(curl, CURLOPT_PROXY_SSLCERT_BLOB, &blob);
+    curl_easy_setopt(curl, CURLOPT_PROXY_SSLCERTTYPE, "PEM");
+
+    blob.data = privateKeyData;
+    blob.len = privateKeySize;
+    curl_easy_setopt(curl, CURLOPT_PROXY_SSLKEY_BLOB, &blob);
+    curl_easy_setopt(curl, CURLOPT_PROXY_KEYPASSWD, "s3cret");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLVERSION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLVERSION.3
deleted file mode 100644
index 08c8c86ab3..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLVERSION.3
+++ /dev/null
@@ -1,105 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_SSLVERSION 3 "16 Nov 2016" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_SSLVERSION \- preferred HTTPS proxy TLS version
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSLVERSION,
-                          long version);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter to control which version of SSL/TLS to attempt to use
-when connecting to an HTTPS proxy.
-
-Use one of the available defines for this purpose. The available options are:
-.RS
-.IP CURL_SSLVERSION_DEFAULT
-The default action. This attempts to figure out the remote SSL protocol
-version.
-.IP CURL_SSLVERSION_TLSv1
-TLSv1.x
-.IP CURL_SSLVERSION_TLSv1_0
-TLSv1.0
-.IP CURL_SSLVERSION_TLSv1_1
-TLSv1.1
-.IP CURL_SSLVERSION_TLSv1_2
-TLSv1.2
-.IP CURL_SSLVERSION_TLSv1_3
-TLSv1.3
-.RE
-The maximum TLS version can be set by using \fIone\fP of the
-CURL_SSLVERSION_MAX_ macros below. It is also possible to OR \fIone\fP of the
-CURL_SSLVERSION_ macros with \fIone\fP of the CURL_SSLVERSION_MAX_ macros.
-The MAX macros are not supported for WolfSSL.
-.RS
-.IP CURL_SSLVERSION_MAX_DEFAULT
-The flag defines the maximum supported TLS version as TLSv1.2, or the default
-value from the SSL library.
-(Added in 7.54.0)
-.IP CURL_SSLVERSION_MAX_TLSv1_0
-The flag defines maximum supported TLS version as TLSv1.0.
-(Added in 7.54.0)
-.IP CURL_SSLVERSION_MAX_TLSv1_1
-The flag defines maximum supported TLS version as TLSv1.1.
-(Added in 7.54.0)
-.IP CURL_SSLVERSION_MAX_TLSv1_2
-The flag defines maximum supported TLS version as TLSv1.2.
-(Added in 7.54.0)
-.IP CURL_SSLVERSION_MAX_TLSv1_3
-The flag defines maximum supported TLS version as TLSv1.3.
-(Added in 7.54.0)
-.RE
-
-In versions of curl prior to 7.54 the CURL_SSLVERSION_TLS options were
-documented to allow \fIonly\fP the specified TLS version, but behavior was
-inconsistent depending on the TLS library.
-
-.SH DEFAULT
-CURL_SSLVERSION_DEFAULT
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* ask libcurl to use TLS version 1.0 or later */
-  curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_USE_SSL "(3), " CURLOPT_HTTP_VERSION "(3), "
-.BR CURLOPT_IPRESOLVE "(3) " CURLOPT_SSLVERSION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLVERSION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLVERSION.md
new file mode 100644
index 0000000000..eb35d9c323
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSLVERSION.md
@@ -0,0 +1,130 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_SSLVERSION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HTTP_VERSION (3)
+  - CURLOPT_IPRESOLVE (3)
+  - CURLOPT_SSLVERSION (3)
+  - CURLOPT_USE_SSL (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - All
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLOPT_PROXY_SSLVERSION - preferred HTTPS proxy TLS version
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSLVERSION,
+                          long version);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter to control which version of SSL/TLS to attempt to use
+when connecting to an HTTPS proxy.
+
+Use one of the available defines for this purpose. The available options are:
+
+## CURL_SSLVERSION_DEFAULT
+
+The default action. This attempts to figure out the remote SSL protocol
+version.
+
+## CURL_SSLVERSION_TLSv1
+
+TLSv1.x
+
+## CURL_SSLVERSION_TLSv1_0
+
+TLSv1.0
+
+## CURL_SSLVERSION_TLSv1_1
+
+TLSv1.1
+
+## CURL_SSLVERSION_TLSv1_2
+
+TLSv1.2
+
+## CURL_SSLVERSION_TLSv1_3
+
+TLSv1.3
+
+##
+
+The maximum TLS version can be set by using *one* of the CURL_SSLVERSION_MAX_
+macros below. It is also possible to OR *one* of the CURL_SSLVERSION_ macros
+with *one* of the CURL_SSLVERSION_MAX_ macros. The MAX macros are not
+supported for wolfSSL.
+
+## CURL_SSLVERSION_MAX_DEFAULT
+
+The flag defines the maximum supported TLS version as TLSv1.2, or the default
+value from the SSL library.
+
+## CURL_SSLVERSION_MAX_TLSv1_0
+
+The flag defines maximum supported TLS version as TLSv1.0.
+
+## CURL_SSLVERSION_MAX_TLSv1_1
+
+The flag defines maximum supported TLS version as TLSv1.1.
+
+## CURL_SSLVERSION_MAX_TLSv1_2
+
+The flag defines maximum supported TLS version as TLSv1.2.
+
+## CURL_SSLVERSION_MAX_TLSv1_3
+
+The flag defines maximum supported TLS version as TLSv1.3.
+
+# DEFAULT
+
+CURL_SSLVERSION_DEFAULT
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* ask libcurl to use TLS version 1.0 or later */
+    curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURL_SSLVERSION_*** macros became `long` types in 8.16.0, prior to this
+version a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_CIPHER_LIST.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_CIPHER_LIST.3
deleted file mode 100644
index 88acfe370c..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_CIPHER_LIST.3
+++ /dev/null
@@ -1,87 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_SSL_CIPHER_LIST 3 "16 Nov 2016" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_SSL_CIPHER_LIST \- ciphers to use for HTTPS proxy
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSL_CIPHER_LIST,
-                          char *list);
-.fi
-.SH DESCRIPTION
-Pass a char *, pointing to a null-terminated string holding the list of
-ciphers to use for the connection to the HTTPS proxy. The list must be
-syntactically correct, it consists of one or more cipher strings separated by
-colons. Commas or spaces are also acceptable separators but colons are
-normally used, \&!, \&- and \&+ can be used as operators.
-
-For OpenSSL and GnuTLS valid examples of cipher lists include \fBRC4-SHA\fP,
-\fBSHA1+DES\fP, \fBTLSv1\fP and \fBDEFAULT\fP. The default list is normally
-set when you compile OpenSSL.
-
-For WolfSSL, valid examples of cipher lists include \fBECDHE-RSA-RC4-SHA\fP,
-\fBAES256-SHA:AES256-SHA256\fP, etc.
-
-For BearSSL, valid examples of cipher lists include
-\fBECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256\fP, or when using IANA names
-\fBTLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\fP,
-etc.
-With BearSSL you do not add/remove ciphers. If one uses this option then all
-known ciphers are disabled and only those passed in are enabled.
-
-Find more details about cipher lists on this URL:
-
- https://curl.se/docs/ssl-ciphers.html
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL, use internal default
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://localhost");
-  curl_easy_setopt(curl, CURLOPT_PROXY_SSL_CIPHER_LIST, "TLSv1");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0, in 7.83.0 for BearSSL
-
-If built TLS enabled.
-.SH RETURN VALUE
-Returns CURLE_OK if TLS is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_TLS13_CIPHERS "(3), " CURLOPT_PROXY_SSLVERSION "(3), "
-.BR CURLOPT_SSL_CIPHER_LIST "(3), " CURLOPT_TLS13_CIPHERS "(3), "
-.BR CURLOPT_SSLVERSION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_CIPHER_LIST.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_CIPHER_LIST.md
new file mode 100644
index 0000000000..ce1f63aa3b
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_CIPHER_LIST.md
@@ -0,0 +1,106 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_SSL_CIPHER_LIST
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_SSLVERSION (3)
+  - CURLOPT_PROXY_TLS13_CIPHERS (3)
+  - CURLOPT_SSLVERSION (3)
+  - CURLOPT_SSL_CIPHER_LIST (3)
+  - CURLOPT_TLS13_CIPHERS (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - Schannel
+  - wolfSSL
+  - mbedTLS
+  - Rustls
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLOPT_PROXY_SSL_CIPHER_LIST - ciphers to use for HTTPS proxy
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSL_CIPHER_LIST,
+                          char *list);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer, pointing to a null-terminated string holding the list of
+cipher suites to use for the TLS 1.2 (1.1, 1.0) connection to the HTTPS proxy.
+The list must be syntactically correct, it consists of one or more cipher suite
+strings separated by colons.
+
+For setting TLS 1.3 ciphers see CURLOPT_PROXY_TLS13_CIPHERS(3).
+
+A valid example of a cipher list is:
+~~~
+"ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:"
+"ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305"
+~~~
+
+For Schannel, you can use this option to set algorithms but not specific
+cipher suites. Refer to the ciphers lists document for algorithms.
+
+Find more details about cipher lists on this URL:
+
+ https://curl.se/docs/ssl-ciphers.html
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL, use internal built-in list.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://localhost");
+    curl_easy_setopt(curl, CURLOPT_PROXY_SSL_CIPHER_LIST,
+                     "ECDHE-ECDSA-CHACHA20-POLY1305:"
+                     "ECDHE-RSA-CHACHA20-POLY1305");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+OpenSSL support added in 7.52.0.
+wolfSSL, Schannel support added in 7.87.0
+mbedTLS support added in 8.8.0.
+Rustls support added in 8.10.0.
+
+Since curl 8.10.0 returns CURLE_NOT_BUILT_IN when not supported.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_OPTIONS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_OPTIONS.3
deleted file mode 100644
index 7097842cdc..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_OPTIONS.3
+++ /dev/null
@@ -1,102 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_SSL_OPTIONS 3 "16 Nov 2016" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_SSL_OPTIONS \- HTTPS proxy SSL behavior options
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSL_OPTIONS,
-                          long bitmask);
-.fi
-.SH DESCRIPTION
-Pass a long with a bitmask to tell libcurl about specific SSL
-behaviors. Available bits:
-.IP CURLSSLOPT_ALLOW_BEAST
-Tells libcurl to not attempt to use any workarounds for a security flaw in the
-SSL3 and TLS1.0 protocols.  If this option is not used or this bit is set to 0,
-the SSL layer libcurl uses may use a work-around for this flaw although it
-might cause interoperability problems with some (older) SSL implementations.
-WARNING: avoiding this work-around lessens the security, and by setting this
-option to 1 you ask for exactly that. This option is only supported for
-Secure Transport and OpenSSL.
-.IP CURLSSLOPT_NO_REVOKE
-Tells libcurl to disable certificate revocation checks for those SSL backends
-where such behavior is present. This option is only supported for Schannel
-(the native Windows SSL library), with an exception in the case of Windows'
-Untrusted Publishers block list which it seems cannot be bypassed. (Added in
-7.44.0)
-.IP CURLSSLOPT_NO_PARTIALCHAIN
-Tells libcurl to not accept "partial" certificate chains, which it otherwise
-does by default. This option is only supported for OpenSSL and fails the
-certificate verification if the chain ends with an intermediate certificate
-and not with a root cert. (Added in 7.68.0)
-.IP CURLSSLOPT_REVOKE_BEST_EFFORT
-Tells libcurl to ignore certificate revocation checks in case of missing or
-offline distribution points for those SSL backends where such behavior is
-present. This option is only supported for Schannel (the native Windows SSL
-library). If combined with \fICURLSSLOPT_NO_REVOKE\fP, the latter takes
-precedence. (Added in 7.70.0)
-.IP CURLSSLOPT_NATIVE_CA
-Tell libcurl to use the operating system's native CA store for certificate
-verification. Works only on Windows, Linux (Debian, Ubuntu, Gentoo, Fedora,
-RHEL), macOS, Android and iOS when built to use wolfSSL (since 8.3.0) or on
-Windows when built to use OpenSSL. If you set this option and also set a CA
-certificate file or directory then during verification those certificates
-are searched in addition to the native CA store.
-(Added in 7.71.0)
-.IP CURLSSLOPT_AUTO_CLIENT_CERT
-Tell libcurl to automatically locate and use a client certificate for
-authentication, when requested by the server. This option is only supported
-for Schannel (the native Windows SSL library). Prior to 7.77.0 this was the
-default behavior in libcurl with Schannel. Since the server can request any
-certificate that supports client authentication in the OS certificate store it
-could be a privacy violation and unexpected.
-(Added in 7.77.0)
-.SH DEFAULT
-0
-.SH PROTOCOLS
-All TLS-based protocols
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy");
-  /* weaken TLS only for use with silly proxies */
-  curl_easy_setopt(curl, CURLOPT_PROXY_SSL_OPTIONS, CURLSSLOPT_ALLOW_BEAST |
-                   CURLSSLOPT_NO_REVOKE);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_SSLVERSION "(3), " CURLOPT_PROXY_SSL_CIPHER_LIST "(3), "
-.BR CURLOPT_SSLVERSION "(3), " CURLOPT_SSL_CIPHER_LIST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_OPTIONS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_OPTIONS.md
new file mode 100644
index 0000000000..0b491eeff6
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_OPTIONS.md
@@ -0,0 +1,132 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_SSL_OPTIONS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_SSLVERSION (3)
+  - CURLOPT_PROXY_SSL_CIPHER_LIST (3)
+  - CURLOPT_SSLVERSION (3)
+  - CURLOPT_SSL_CIPHER_LIST (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - All
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLOPT_PROXY_SSL_OPTIONS - HTTPS proxy SSL behavior options
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSL_OPTIONS,
+                          long bitmask);
+~~~
+
+# DESCRIPTION
+
+Pass a long with a bitmask to tell libcurl about specific SSL
+behaviors. Available bits:
+
+## CURLSSLOPT_ALLOW_BEAST
+
+Tells libcurl to not attempt to use any workarounds for a security flaw in the
+SSL3 and TLS1.0 protocols. If this option is not used or this bit is set to 0,
+the SSL layer libcurl uses may use a workaround for this flaw although it
+might cause interoperability problems with some (older) SSL implementations.
+
+**WARNING:** avoiding this workaround lessens the security, and by setting
+this option to 1 you ask for exactly that. This option is only supported for
+Secure Transport and OpenSSL.
+
+## CURLSSLOPT_NO_REVOKE
+
+Tells libcurl to disable certificate revocation checks for those SSL backends
+where such behavior is present. This option is only supported for Schannel
+(the native Windows SSL library), with an exception in the case of Windows'
+Untrusted Publishers block list which it seems cannot be bypassed.
+
+## CURLSSLOPT_NO_PARTIALCHAIN
+
+Tells libcurl to not accept "partial" certificate chains, which it otherwise
+does by default. This option fails the certificate verification if the chain
+ends with an intermediate certificate and not with a root cert.
+
+Works with OpenSSL and its forks (BoringSSL, LibreSSL, etc). (Added in 7.68.0)
+
+Works with Schannel if the user specified certificates to verify the peer.
+(Added in 8.15.0)
+
+## CURLSSLOPT_REVOKE_BEST_EFFORT
+
+Tells libcurl to ignore certificate revocation checks in case of missing or
+offline distribution points for those SSL backends where such behavior is
+present. This option is only supported for Schannel (the native Windows SSL
+library). If combined with *CURLSSLOPT_NO_REVOKE*, the latter takes
+precedence. (Added in 7.70.0)
+
+## CURLSSLOPT_NATIVE_CA
+
+Tell libcurl to use the operating system's native CA store for certificate
+verification. This option is independent of other CA certificate locations set
+at run time or build time. Those locations are searched in addition to the
+native CA store.
+
+Works with wolfSSL on Windows, Linux (Debian, Fedora, Gentoo, RHEL, Ubuntu),
+macOS, Android and iOS (added in 8.3.0); with GnuTLS (added in 8.5.0) and with
+OpenSSL and its forks (BoringSSL, LibreSSL, etc) on Windows (Added in 7.71.0).
+
+## CURLSSLOPT_AUTO_CLIENT_CERT
+
+Tell libcurl to automatically locate and use a client certificate for
+authentication, when requested by the server. This option is only supported
+for Schannel (the native Windows SSL library). Prior to 7.77.0 this was the
+default behavior in libcurl with Schannel. Since the server can request any
+certificate that supports client authentication in the OS certificate store it
+could be a privacy violation and unexpected.
+(Added in 7.77.0)
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example");
+    /* weaken TLS only for use with silly proxies */
+    curl_easy_setopt(curl, CURLOPT_PROXY_SSL_OPTIONS,
+                     CURLSSLOPT_ALLOW_BEAST | CURLSSLOPT_NO_REVOKE);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURLSSLOPT_*** macros became `long` types in 8.15.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_VERIFYHOST.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_VERIFYHOST.3
deleted file mode 100644
index 29c3980562..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_VERIFYHOST.3
+++ /dev/null
@@ -1,91 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_SSL_VERIFYHOST 3 "16 Nov 2016" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_SSL_VERIFYHOST \- verify the proxy certificate's name against host
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSL_VERIFYHOST,
-                          long verify);
-.fi
-.SH DESCRIPTION
-Pass a long set to 2L as asking curl to \fIverify\fP in the HTTPS proxy's
-certificate name fields against the proxy name.
-
-This option determines whether libcurl verifies that the proxy cert contains
-the correct name for the name it is known as.
-
-When \fICURLOPT_PROXY_SSL_VERIFYHOST(3)\fP is 2, the proxy certificate must
-indicate that the server is the proxy to which you meant to connect to, or the
-connection fails.
-
-Curl considers the proxy the intended one when the Common Name field or a
-Subject Alternate Name field in the certificate matches the host name in the
-proxy string which you told curl to use.
-
-If \fIverify\fP value is set to 1:
-
-In 7.28.0 and earlier: treated as a debug option of some sorts, not supported
-anymore due to frequently leading to programmer mistakes.
-
-From 7.28.1 to 7.65.3: setting it to 1 made curl_easy_setopt() return an error
-and leaving the flag untouched.
-
-From 7.66.0: treats 1 and 2 the same.
-
-When the \fIverify\fP value is 0L, the connection succeeds regardless of the
-names used in the certificate. Use that ability with caution!
-
-See also \fICURLOPT_PROXY_SSL_VERIFYPEER(3)\fP to verify the digital signature
-of the proxy certificate.
-.SH DEFAULT
-2
-.SH PROTOCOLS
-All protocols when used over an HTTPS proxy.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Set the default value: strict name check please */
-  curl_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYHOST, 2L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0.
-
-If built TLS enabled.
-.SH RETURN VALUE
-Returns CURLE_OK if TLS is supported, and CURLE_UNKNOWN_OPTION if not.
-
-If 1 is set as argument, \fICURLE_BAD_FUNCTION_ARGUMENT\fP is returned.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_SSL_VERIFYPEER "(3), " CURLOPT_PROXY_CAINFO "(3), "
-.BR CURLOPT_SSL_VERIFYPEER "(3), " CURLOPT_CAINFO "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_VERIFYHOST.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_VERIFYHOST.md
new file mode 100644
index 0000000000..bc86ed1c3f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_VERIFYHOST.md
@@ -0,0 +1,96 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_SSL_VERIFYHOST
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CAINFO (3)
+  - CURLOPT_PROXY_CAINFO (3)
+  - CURLOPT_PROXY_SSL_VERIFYPEER (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - All
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLOPT_PROXY_SSL_VERIFYHOST - verify the proxy certificate's name against host
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSL_VERIFYHOST,
+                          long verify);
+~~~
+
+# DESCRIPTION
+
+Pass a long set to 2L as asking curl to *verify* in the HTTPS proxy's
+certificate name fields against the proxy name.
+
+This option determines whether libcurl verifies that the proxy cert contains
+the correct name for the name it is known as.
+
+When CURLOPT_PROXY_SSL_VERIFYHOST(3) is 2, the proxy certificate must
+indicate that the server is the proxy to which you meant to connect to, or the
+connection fails.
+
+curl considers the proxy the intended one when the Common Name field or a
+Subject Alternate Name field in the certificate matches the hostname in the
+proxy string which you told curl to use.
+
+If *verify* value is set to 1:
+
+In 7.28.0 and earlier: treated as a debug option of some sorts, not supported
+anymore due to frequently leading to programmer mistakes.
+
+From 7.28.1 to 7.65.3: setting it to 1 made curl_easy_setopt(3) return
+an error and leaving the flag untouched.
+
+From 7.66.0: treats 1 and 2 the same.
+
+When the *verify* value is 0L, the connection succeeds regardless of the
+names used in the certificate. Use that ability with caution.
+
+See also CURLOPT_PROXY_SSL_VERIFYPEER(3) to verify the digital signature
+of the proxy certificate.
+
+# DEFAULT
+
+2
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Set the default value: strict name check please */
+    curl_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYHOST, 2L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_VERIFYPEER.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_VERIFYPEER.3
deleted file mode 100644
index de445e5ad4..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_VERIFYPEER.3
+++ /dev/null
@@ -1,94 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_SSL_VERIFYPEER 3 "16 Nov 2016" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_SSL_VERIFYPEER \- verify the proxy's SSL certificate
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSL_VERIFYPEER,
-                          long verify);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter set to 1L to enable or 0L to disable.
-
-This option tells curl to verify the authenticity of the HTTPS proxy's
-certificate. A value of 1 means curl verifies; 0 (zero) means it does not.
-
-This is the proxy version of \fICURLOPT_SSL_VERIFYPEER(3)\fP that is used for
-ordinary HTTPS servers.
-
-When negotiating a TLS or SSL connection, the server sends a certificate
-indicating its identity. Curl verifies whether the certificate is authentic,
-i.e. that you can trust that the server is who the certificate says it is.
-This trust is based on a chain of digital signatures, rooted in certification
-authority (CA) certificates you supply.  curl uses a default bundle of CA
-certificates (the path for that is determined at build time) and you can
-specify alternate certificates with the \fICURLOPT_PROXY_CAINFO(3)\fP option
-or the \fICURLOPT_PROXY_CAPATH(3)\fP option.
-
-When \fICURLOPT_PROXY_SSL_VERIFYPEER(3)\fP is enabled, and the verification
-fails to prove that the certificate is authentic, the connection fails.  When
-the option is zero, the peer certificate verification succeeds regardless.
-
-Authenticating the certificate is not enough to be sure about the server. You
-typically also want to ensure that the server is the server you mean to be
-talking to.  Use \fICURLOPT_PROXY_SSL_VERIFYHOST(3)\fP for that. The check
-that the host name in the certificate is valid for the host name you are
-connecting to is done independently of the
-\fICURLOPT_PROXY_SSL_VERIFYPEER(3)\fP option.
-
-WARNING: disabling verification of the certificate allows bad guys to
-man-in-the-middle the communication without you knowing it. Disabling
-verification makes the communication insecure. Just having encryption on a
-transfer is not enough as you cannot be sure that you are communicating with
-the correct end-point.
-.SH DEFAULT
-1
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Set the default value: strict certificate check please */
-  curl_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYPEER, 1L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0
-
-If built TLS enabled.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_SSL_VERIFYHOST "(3), "
-.BR CURLOPT_SSL_VERIFYPEER "(3), "
-.BR CURLOPT_SSL_VERIFYHOST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_VERIFYPEER.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_VERIFYPEER.md
new file mode 100644
index 0000000000..62239eae24
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_SSL_VERIFYPEER.md
@@ -0,0 +1,98 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_SSL_VERIFYPEER
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_SSL_VERIFYHOST (3)
+  - CURLOPT_SSL_VERIFYHOST (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - All
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLOPT_PROXY_SSL_VERIFYPEER - verify the proxy's SSL certificate
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSL_VERIFYPEER,
+                          long verify);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter set to 1L to enable or 0L to disable.
+
+This option tells curl to verify the authenticity of the HTTPS proxy's
+certificate. A value of 1 means curl verifies; 0 (zero) means it does not.
+
+This is the proxy version of CURLOPT_SSL_VERIFYPEER(3) that is used for
+ordinary HTTPS servers.
+
+When negotiating a TLS or SSL connection, the server sends a certificate
+indicating its identity. curl verifies whether the certificate is authentic,
+i.e. that you can trust that the server is who the certificate says it is.
+This trust is based on a chain of digital signatures, rooted in certification
+authority (CA) certificates you supply. curl uses a default bundle of CA
+certificates (the path for that is determined at build time) and you can
+specify alternate certificates with the CURLOPT_PROXY_CAINFO(3) option or
+the CURLOPT_PROXY_CAPATH(3) option.
+
+When CURLOPT_PROXY_SSL_VERIFYPEER(3) is enabled, and the verification
+fails to prove that the certificate is authentic, the connection fails. When
+the option is zero, the peer certificate verification succeeds regardless.
+
+Authenticating the certificate is not enough to be sure about the server. You
+typically also want to ensure that the server is the server you mean to be
+talking to. Use CURLOPT_PROXY_SSL_VERIFYHOST(3) for that. The check that the
+hostname in the certificate is valid for the hostname you are connecting to is
+done independently of the CURLOPT_PROXY_SSL_VERIFYPEER(3) option.
+
+**WARNING:** disabling verification of the certificate allows bad guys to
+man-in-the-middle the communication without you knowing it. Disabling
+verification makes the communication insecure. Having encryption on a transfer
+is not enough as you cannot be sure that you are communicating with the
+correct end-point.
+
+# DEFAULT
+
+1
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Set the default value: strict certificate check please */
+    curl_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYPEER, 1L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLS13_CIPHERS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLS13_CIPHERS.3
deleted file mode 100644
index 01a603b202..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLS13_CIPHERS.3
+++ /dev/null
@@ -1,74 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_TLS13_CIPHERS 3 "25 May 2018" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_TLS13_CIPHERS \- ciphers suites for proxy TLS 1.3
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_TLS13_CIPHERS,
-                          char *list);
-.fi
-.SH DESCRIPTION
-Pass a char *, pointing to a null-terminated string holding the list of cipher
-suites to use for the TLS 1.3 connection to a proxy. The list must be
-syntactically correct, it consists of one or more cipher suite strings
-separated by colons.
-
-Find more details about cipher lists on this URL:
-
- https://curl.se/docs/ssl-ciphers.html
-
-This option is currently used only when curl is built to use OpenSSL 1.1.1 or
-later. If you are using a different SSL backend you can try setting TLS 1.3
-cipher suites by using the \fICURLOPT_PROXY_SSL_CIPHER_LIST(3)\fP option.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL, use internal default
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_PROXY_TLS13_CIPHERS,
-                   "TLS_CHACHA20_POLY1305_SHA256");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.61.0.
-Available when built with OpenSSL >= 1.1.1.
-.SH RETURN VALUE
-Returns CURLE_OK if supported, CURLE_NOT_BUILT_IN otherwise.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_SSL_CIPHER_LIST "(3), " CURLOPT_PROXY_SSLVERSION "(3), "
-.BR CURLOPT_SSL_CIPHER_LIST "(3), " CURLOPT_TLS13_CIPHERS "(3), "
-.BR CURLOPT_SSLVERSION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLS13_CIPHERS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLS13_CIPHERS.md
new file mode 100644
index 0000000000..999a111c98
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLS13_CIPHERS.md
@@ -0,0 +1,101 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_TLS13_CIPHERS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_SSLVERSION (3)
+  - CURLOPT_PROXY_SSL_CIPHER_LIST (3)
+  - CURLOPT_SSLVERSION (3)
+  - CURLOPT_SSL_CIPHER_LIST (3)
+  - CURLOPT_TLS13_CIPHERS (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - wolfSSL
+  - mbedTLS
+  - Rustls
+Added-in: 7.61.0
+---
+
+# NAME
+
+CURLOPT_PROXY_TLS13_CIPHERS - ciphers suites for proxy TLS 1.3
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_TLS13_CIPHERS,
+                          char *list);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer, pointing to a null-terminated string holding the list of
+cipher suites to use for the TLS 1.3 connection to a proxy. The list must be
+syntactically correct, it consists of one or more cipher suite strings
+separated by colons.
+
+For setting TLS 1.2 (1.1, 1.0) ciphers see CURLOPT_PROXY_SSL_CIPHER_LIST(3).
+
+A valid example of a cipher list is:
+~~~
+"TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256"
+~~~
+
+Find more details about cipher lists on this URL:
+
+ https://curl.se/docs/ssl-ciphers.html
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL, use internal built-in list
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_PROXY_TLS13_CIPHERS,
+                     "TLS_CHACHA20_POLY1305_SHA256");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+OpenSSL support added in 7.61.0, available when built with OpenSSL \>= 1.1.1.
+LibreSSL support added in 8.3.0, available when built with LibreSSL \>= 3.4.1.
+wolfSSL support added in 8.10.0.
+mbedTLS support added in 8.10.0, available when built with mbedTLS \>= 3.6.0.
+Rustls support added in 8.10.0.
+
+Before curl 8.10.0 with mbedTLS or wolfSSL, TLS 1.3 cipher suites were set
+by using the CURLOPT_PROXY_SSL_CIPHER_LIST(3) option.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_PASSWORD.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_PASSWORD.3
deleted file mode 100644
index c8750e8863..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_PASSWORD.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_TLSAUTH_PASSWORD 3 "16 Nov 2016" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_TLSAUTH_PASSWORD \- password to use for proxy TLS authentication
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_TLSAUTH_PASSWORD,
-                          char *pwd);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter, which should point to the null-terminated password
-to use for the TLS authentication method specified with the
-\fICURLOPT_PROXY_TLSAUTH_TYPE(3)\fP option. Requires that the
-\fICURLOPT_PROXY_TLSAUTH_USERNAME(3)\fP option also be set.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy");
-  curl_easy_setopt(curl, CURLOPT_PROXY_TLSAUTH_TYPE, "SRP");
-  curl_easy_setopt(curl, CURLOPT_PROXY_TLSAUTH_USERNAME, "user");
-  curl_easy_setopt(curl, CURLOPT_PROXY_TLSAUTH_PASSWORD, "secret");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0, with the OpenSSL and GnuTLS backends only
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_TLSAUTH_TYPE "(3), " CURLOPT_PROXY_TLSAUTH_USERNAME "(3), "
-.BR CURLOPT_TLSAUTH_TYPE "(3), " CURLOPT_TLSAUTH_USERNAME "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_PASSWORD.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_PASSWORD.md
new file mode 100644
index 0000000000..17acca6761
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_PASSWORD.md
@@ -0,0 +1,78 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_TLSAUTH_PASSWORD
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_TLSAUTH_TYPE (3)
+  - CURLOPT_PROXY_TLSAUTH_USERNAME (3)
+  - CURLOPT_TLSAUTH_TYPE (3)
+  - CURLOPT_TLSAUTH_USERNAME (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLOPT_PROXY_TLSAUTH_PASSWORD - password to use for proxy TLS authentication
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_TLSAUTH_PASSWORD,
+                          char *pwd);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter, which should point to the null-terminated
+password to use for the TLS authentication method specified with the
+CURLOPT_PROXY_TLSAUTH_TYPE(3) option. Requires that the
+CURLOPT_PROXY_TLSAUTH_USERNAME(3) option also be set.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example");
+    curl_easy_setopt(curl, CURLOPT_PROXY_TLSAUTH_TYPE, "SRP");
+    curl_easy_setopt(curl, CURLOPT_PROXY_TLSAUTH_USERNAME, "user");
+    curl_easy_setopt(curl, CURLOPT_PROXY_TLSAUTH_PASSWORD, "secret");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_TYPE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_TYPE.3
deleted file mode 100644
index f01bf459a7..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_TYPE.3
+++ /dev/null
@@ -1,75 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_TLSAUTH_TYPE 3 "16 Nov 2016" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_TLSAUTH_TYPE \- HTTPS proxy TLS authentication methods
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_TLSAUTH_TYPE,
-                          char *type);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter. The string should be
-the method of the TLS authentication used for the HTTPS connection. Supported
-method is "SRP".
-
-.IP SRP
-TLS-SRP authentication. Secure Remote Password authentication for TLS is
-defined in RFC 5054 and provides mutual authentication if both sides have a
-shared secret. To use TLS-SRP, you must also set the
-\fICURLOPT_PROXY_TLSAUTH_USERNAME(3)\fP and
-\fICURLOPT_PROXY_TLSAUTH_PASSWORD(3)\fP options.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-blank
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy");
-  curl_easy_setopt(curl, CURLOPT_PROXY_TLSAUTH_TYPE, "SRP");
-  curl_easy_setopt(curl, CURLOPT_PROXY_TLSAUTH_USERNAME, "user");
-  curl_easy_setopt(curl, CURLOPT_PROXY_TLSAUTH_PASSWORD, "secret");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0
-
-You need to build libcurl with GnuTLS or OpenSSL with TLS-SRP support for this
-to work.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_TLSAUTH_USERNAME "(3), " CURLOPT_PROXY_TLSAUTH_PASSWORD "(3), "
-.BR CURLOPT_TLSAUTH_USERNAME "(3), " CURLOPT_TLSAUTH_PASSWORD "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_TYPE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_TYPE.md
new file mode 100644
index 0000000000..d1badf4be5
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_TYPE.md
@@ -0,0 +1,85 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_TLSAUTH_TYPE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_TLSAUTH_PASSWORD (3)
+  - CURLOPT_PROXY_TLSAUTH_USERNAME (3)
+  - CURLOPT_TLSAUTH_PASSWORD (3)
+  - CURLOPT_TLSAUTH_USERNAME (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLOPT_PROXY_TLSAUTH_TYPE - HTTPS proxy TLS authentication methods
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_TLSAUTH_TYPE,
+                          char *type);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter. The string should be
+the method of the TLS authentication used for the HTTPS connection. Supported
+method is "SRP".
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to restore to internal default.
+
+The application does not have to keep the string around after setting this
+option.
+
+## SRP
+
+TLS-SRP authentication. Secure Remote Password authentication for TLS is
+defined in RFC 5054 and provides mutual authentication if both sides have a
+shared secret. To use TLS-SRP, you must also set the
+CURLOPT_PROXY_TLSAUTH_USERNAME(3) and CURLOPT_PROXY_TLSAUTH_PASSWORD(3)
+options.
+
+# DEFAULT
+
+blank
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example");
+    curl_easy_setopt(curl, CURLOPT_PROXY_TLSAUTH_TYPE, "SRP");
+    curl_easy_setopt(curl, CURLOPT_PROXY_TLSAUTH_USERNAME, "user");
+    curl_easy_setopt(curl, CURLOPT_PROXY_TLSAUTH_PASSWORD, "secret");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_USERNAME.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_USERNAME.3
deleted file mode 100644
index 5511088e76..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_USERNAME.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_TLSAUTH_USERNAME 3 "16 Nov 2016" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_TLSAUTH_USERNAME \- user name to use for proxy TLS authentication
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_TLSAUTH_USERNAME,
-                          char *user);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter, which should point to the null-terminated username
-to use for the HTTPS proxy TLS authentication method specified with the
-\fICURLOPT_PROXY_TLSAUTH_TYPE(3)\fP option. Requires that the
-\fICURLOPT_PROXY_TLSAUTH_PASSWORD(3)\fP option also be set.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy");
-  curl_easy_setopt(curl, CURLOPT_PROXY_TLSAUTH_TYPE, "SRP");
-  curl_easy_setopt(curl, CURLOPT_PROXY_TLSAUTH_USERNAME, "user");
-  curl_easy_setopt(curl, CURLOPT_PROXY_TLSAUTH_PASSWORD, "secret");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.52.0, with the OpenSSL and GnuTLS backends only.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY_TLSAUTH_TYPE "(3), " CURLOPT_PROXY_TLSAUTH_PASSWORD "(3), "
-.BR CURLOPT_TLSAUTH_TYPE "(3), " CURLOPT_TLSAUTH_PASSWORD "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_USERNAME.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_USERNAME.md
new file mode 100644
index 0000000000..c4db7aa815
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_USERNAME.md
@@ -0,0 +1,78 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_TLSAUTH_USERNAME
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_TLSAUTH_PASSWORD (3)
+  - CURLOPT_PROXY_TLSAUTH_TYPE (3)
+  - CURLOPT_TLSAUTH_PASSWORD (3)
+  - CURLOPT_TLSAUTH_TYPE (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+Added-in: 7.52.0
+---
+
+# NAME
+
+CURLOPT_PROXY_TLSAUTH_USERNAME - username to use for proxy TLS authentication
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_TLSAUTH_USERNAME,
+                          char *user);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter, which should point to the null-terminated
+username to use for the HTTPS proxy TLS authentication method specified with
+the CURLOPT_PROXY_TLSAUTH_TYPE(3) option. Requires that the
+CURLOPT_PROXY_TLSAUTH_PASSWORD(3) option also be set.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example");
+    curl_easy_setopt(curl, CURLOPT_PROXY_TLSAUTH_TYPE, "SRP");
+    curl_easy_setopt(curl, CURLOPT_PROXY_TLSAUTH_USERNAME, "user");
+    curl_easy_setopt(curl, CURLOPT_PROXY_TLSAUTH_PASSWORD, "secret");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TRANSFER_MODE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TRANSFER_MODE.3
deleted file mode 100644
index a50c711403..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TRANSFER_MODE.3
+++ /dev/null
@@ -1,63 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PROXY_TRANSFER_MODE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_PROXY_TRANSFER_MODE \- append FTP transfer mode to URL for proxy
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_TRANSFER_MODE,
-                          long enabled);
-.fi
-.SH DESCRIPTION
-Pass a long. If the value is set to 1 (one), it tells libcurl to set the
-transfer mode (binary or ASCII) for FTP transfers done via an HTTP proxy, by
-appending ;type=a or ;type=i to the URL. Without this setting, or it being set
-to 0 (zero, the default), \fICURLOPT_TRANSFERTEXT(3)\fP has no effect when
-doing FTP via a proxy. Beware that not all proxies support this feature.
-.SH DEFAULT
-0, disabled
-.SH PROTOCOLS
-FTP over proxy
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/old-server/file.txt");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "http://localhost:80");
-  curl_easy_setopt(curl, CURLOPT_PROXY_TRANSFER_MODE, 1L);
-  curl_easy_setopt(curl, CURLOPT_TRANSFERTEXT, 1L);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.18.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if the
-enabled value is not supported.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY "(3), " CURLOPT_HTTPPROXYTUNNEL "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TRANSFER_MODE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TRANSFER_MODE.md
new file mode 100644
index 0000000000..93b483802e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PROXY_TRANSFER_MODE.md
@@ -0,0 +1,70 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PROXY_TRANSFER_MODE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CRLF (3)
+  - CURLOPT_HTTPPROXYTUNNEL (3)
+  - CURLOPT_PROXY (3)
+  - CURLOPT_TRANSFERTEXT (3)
+Protocol:
+    - All
+Added-in: 7.18.0
+---
+
+# NAME
+
+CURLOPT_PROXY_TRANSFER_MODE - append FTP transfer mode to URL for proxy
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_TRANSFER_MODE,
+                          long enabled);
+~~~
+
+# DESCRIPTION
+
+Pass a long. If the value is set to 1 (one), it tells libcurl to set the
+transfer mode (binary or ASCII) for FTP transfers done via an HTTP proxy, by
+appending ;type=a or ;type=i to the URL. Without this setting, or it being set
+to 0 (zero, the default), CURLOPT_TRANSFERTEXT(3) has no effect when
+doing FTP via a proxy. Beware that not all proxies support this feature.
+
+# DEFAULT
+
+0, disabled
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL,
+                     "ftp://example.com/old-server/file.txt");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "http://localhost:80");
+    curl_easy_setopt(curl, CURLOPT_PROXY_TRANSFER_MODE, 1L);
+    curl_easy_setopt(curl, CURLOPT_TRANSFERTEXT, 1L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PUT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_PUT.3
deleted file mode 100644
index 1138bb5371..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_PUT.3
+++ /dev/null
@@ -1,73 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_PUT 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_PUT \- make an HTTP PUT request
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PUT, long put);
-.fi
-.SH DESCRIPTION
-A parameter set to 1 tells the library to use HTTP PUT to transfer data. The
-data should be set with \fICURLOPT_READDATA(3)\fP and
-\fICURLOPT_INFILESIZE(3)\fP.
-
-This option is \fBdeprecated\fP since version 7.12.1. Use
-\fICURLOPT_UPLOAD(3)\fP!
-.SH DEFAULT
-0, disabled
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  /* we want to use our own read function */
-  curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_callback);
-
-  /* enable PUT */
-  curl_easy_setopt(curl, CURLOPT_PUT, 1L);
-
-  /* specify target */
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/dir/to/newfile");
-
-  /* now specify which pointer to pass to our callback */
-  curl_easy_setopt(curl, CURLOPT_READDATA, hd_src);
-
-  /* Set the size of the file to upload */
-  curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, (curl_off_t)fsize);
-
-  /* Now run off and do what you have been told! */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Deprecated since 7.12.1. Do not use.
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_UPLOAD "(3), " CURLOPT_HTTPGET "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_PUT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_PUT.md
new file mode 100644
index 0000000000..3e44da6fc4
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_PUT.md
@@ -0,0 +1,101 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_PUT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HTTPGET (3)
+  - CURLOPT_MIMEPOST (3)
+  - CURLOPT_POSTFIELDS (3)
+  - CURLOPT_UPLOAD (3)
+Protocol:
+  - HTTP
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_PUT - make an HTTP PUT request
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PUT, long put);
+~~~
+
+# DESCRIPTION
+
+A parameter set to 1 tells the library to use HTTP PUT to transfer data. The
+data should be set with CURLOPT_READDATA(3) and
+CURLOPT_INFILESIZE(3).
+
+This option is **deprecated** since version 7.12.1. Use CURLOPT_UPLOAD(3).
+
+# DEFAULT
+
+0, disabled
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+static size_t read_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
+{
+  FILE *src = userdata;
+  /* copy as much data as possible into the 'ptr' buffer, but no more than
+     'size' * 'nmemb' bytes */
+  size_t retcode = fread(ptr, size, nmemb, src);
+
+  return retcode;
+}
+
+int main(void)
+{
+  CURL *curl;
+  FILE *src = fopen("local-file", "r");
+  if(!src)
+    return 1;
+  curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_off_t fsize = 123456; /* set this to the size of the input file */
+
+    /* we want to use our own read function */
+    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
+
+    /* enable PUT */
+    curl_easy_setopt(curl, CURLOPT_PUT, 1L);
+
+    /* specify target */
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/dir/to/newfile");
+
+    /* now specify which pointer to pass to our callback */
+    curl_easy_setopt(curl, CURLOPT_READDATA, src);
+
+    /* Set the size of the file to upload */
+    curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, (curl_off_t)fsize);
+
+    /* Now run off and do what you have been told */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+  fclose(src);
+}
+~~~
+
+# DEPRECATED
+
+Deprecated since 7.12.1.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_QUICK_EXIT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_QUICK_EXIT.3
deleted file mode 100644
index f11b0ddd9d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_QUICK_EXIT.3
+++ /dev/null
@@ -1,59 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_QUICK_EXIT 3 "30 Sep 2022" libcurl libcurl
-.SH NAME
-CURLOPT_QUICK_EXIT \- allow to exit quickly
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_QUICK_EXIT,
-                          long value);
-.SH DESCRIPTION
-Pass a long as a parameter, 1L meaning that when recovering from a timeout,
-libcurl should skip lengthy cleanups that are intended to avoid all kinds of
-leaks (threads etc.), as the caller program is about to call exit() anyway.
-This allows for a swift termination after a DNS timeout for example, by
-canceling and/or forgetting about a resolver thread, at the expense of a
-possible (though short-lived) leak of associated resources.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_QUICK_EXIT, 1L);
-  ret = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.87.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_RESOLVE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_QUICK_EXIT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_QUICK_EXIT.md
new file mode 100644
index 0000000000..d6505244cb
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_QUICK_EXIT.md
@@ -0,0 +1,64 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_QUICK_EXIT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_FAILONERROR (3)
+  - CURLOPT_RESOLVE (3)
+Protocol:
+  - All
+Added-in: 7.87.0
+---
+
+# NAME
+
+CURLOPT_QUICK_EXIT - allow libcurl to exit quickly
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_QUICK_EXIT,
+                          long value);
+~~~
+
+# DESCRIPTION
+
+Pass a long as a parameter, 1L meaning that when recovering from a timeout,
+libcurl should skip lengthy cleanups that are intended to avoid all kinds of
+leaks (threads etc.), as the caller program is about to call exit() anyway.
+This allows for a swift termination after a DNS timeout for example, by
+canceling and/or forgetting about a resolver thread, at the expense of a
+possible (though short-lived) leak of associated resources.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_QUICK_EXIT, 1L);
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_QUOTE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_QUOTE.3
deleted file mode 100644
index 7f842b62c9..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_QUOTE.3
+++ /dev/null
@@ -1,126 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_QUOTE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_QUOTE \- (S)FTP commands to run before transfer
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_QUOTE,
-                          struct curl_slist *cmds);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a linked list of FTP or SFTP commands to pass to the server
-prior to your request. This is done before any other commands are issued (even
-before the CWD command for FTP). The linked list should be a fully valid list
-of 'struct curl_slist' structs properly filled in with text strings. Use
-\fIcurl_slist_append(3)\fP to append strings (commands) to the list, and clear
-the entire list afterwards with \fIcurl_slist_free_all(3)\fP.
-
-Disable this operation again by setting a NULL to this option.
-
-When speaking to an FTP server, prefix the command with an asterisk (*) to
-make libcurl continue even if the command fails as by default libcurl stops at
-first failure.
-
-The set of valid FTP commands depends on the server (see RFC 959 for a list of
-mandatory commands).
-
-libcurl does not inspect, parse or "understand" the commands passed to the
-server using this option. If you change connection state, working directory or
-similar using quote commands, libcurl does not know about it.
-
-The valid SFTP commands are:
-.RS
-.IP "atime date file"
-The atime command sets the last access time of the file named by the file
-operand. The <date expression> can be all sorts of date strings, see the
-\fIcurl_getdate(3)\fP man page for date expression details. (Added in 7.73.0)
-.IP "chgrp group file"
-The chgrp command sets the group ID of the file named by the file operand to
-the group ID specified by the group operand. The group operand is a decimal
-integer group ID.
-.IP "chmod mode file"
-The chmod command modifies the file mode bits of the specified file. The
-mode operand is an octal integer mode number.
-.IP "chown user file"
-The chown command sets the owner of the file named by the file operand to the
-user ID specified by the user operand. The user operand is a decimal
-integer user ID.
-.IP "ln source_file target_file"
-The \fBln\fP and \fBsymlink\fP commands create a symbolic link at the
-target_file location pointing to the source_file location.
-.IP "mkdir directory_name"
-The mkdir command creates the directory named by the directory_name operand.
-.IP "mtime date file"
-The mtime command sets the last modification time of the file named by the
-file operand. The <date expression> can be all sorts of date strings, see the
-\fIcurl_getdate(3)\fP man page for date expression details. (Added in 7.73.0)
-.IP "pwd"
-The \fBpwd\fP command returns the absolute path of the current working
-directory.
-.IP "rename source target"
-The rename command renames the file or directory named by the source
-operand to the destination path named by the target operand.
-.IP "rm file"
-The rm command removes the file specified by the file operand.
-.IP "rmdir directory"
-The rmdir command removes the directory entry specified by the directory
-operand, provided it is empty.
-.IP "statvfs file"
-The statvfs command returns statistics on the file system in which specified
-file resides. (Added in 7.49.0)
-.IP "symlink source_file target_file"
-See ln.
-.RE
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-SFTP and FTP
-.SH EXAMPLE
-.nf
-struct curl_slist *cmdlist = NULL;
-cmdlist = curl_slist_append(cmdlist, "RNFR source-name");
-cmdlist = curl_slist_append(cmdlist, "RNTO new-name");
-
-curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/foo.bin");
-
-  /* pass in the FTP commands to run before the transfer */
-  curl_easy_setopt(curl, CURLOPT_QUOTE, cmdlist);
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-SFTP support added in 7.16.3. *-prefix for SFTP added in 7.24.0
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_POSTQUOTE "(3), " CURLOPT_PREQUOTE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_QUOTE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_QUOTE.md
new file mode 100644
index 0000000000..d4365f7b41
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_QUOTE.md
@@ -0,0 +1,176 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_QUOTE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CUSTOMREQUEST (3)
+  - CURLOPT_DIRLISTONLY (3)
+  - CURLOPT_POSTQUOTE (3)
+  - CURLOPT_PREQUOTE (3)
+Protocol:
+  - FTP
+  - SFTP
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_QUOTE - (S)FTP commands to run before transfer
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_QUOTE,
+                          struct curl_slist *cmds);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a linked list of FTP or SFTP commands to pass to the server
+prior to your request. This is done before any other commands are issued (even
+before the CWD command for FTP). The linked list should be a fully valid list
+of 'struct curl_slist' structs properly filled in with text strings. Use
+curl_slist_append(3) to append strings (commands) to the list, and clear
+the entire list afterwards with curl_slist_free_all(3).
+
+Using this option multiple times makes the last set list override the previous
+ones. Set it to NULL to disable its use again. libcurl does not copy the list,
+it needs to be kept around until after the transfer has completed.
+
+When speaking to an FTP server, prefix the command with an asterisk (*) to
+make libcurl continue even if the command fails as by default libcurl stops at
+first failure.
+
+The set of valid FTP commands depends on the server (see RFC 959 for a list of
+mandatory commands).
+
+libcurl does not inspect, parse or "understand" the commands passed to the
+server using this option. If you change connection state, working directory or
+similar using quote commands, libcurl does not know about it.
+
+The path arguments for FTP or SFTP should use double quotes to distinguish a
+space from being the parameter separator or being a part of the path. For
+example, rename with sftp using a quote command like this:
+
+    rename "test/_upload.txt" "test/Hello World.txt"
+
+For SFTP, filenames must be provided within double quotes to embed spaces,
+backslashes, quotes or double quotes. Within double quotes the following
+escape sequences are available for that purpose: \\, \", and \'.
+
+# SFTP commands
+
+## atime date file
+
+The atime command sets the last access time of the file named by the file
+operand. The date expression can be all sorts of date strings, see the
+curl_getdate(3) man page for date expression details. (Added in 7.73.0)
+
+## chgrp group file
+
+The chgrp command sets the group ID of the file named by the file operand to
+the group ID specified by the group operand. The group operand is a decimal
+integer group ID.
+
+## chmod mode file
+
+The chmod command modifies the file mode bits of the specified file. The
+mode operand is an octal integer mode number.
+
+## chown user file
+
+The chown command sets the owner of the file named by the file operand to the
+user ID specified by the user operand. The user operand is a decimal
+integer user ID.
+
+## ln source_file target_file
+
+The **ln** and **symlink** commands create a symbolic link at the
+target_file location pointing to the source_file location.
+
+## mkdir directory_name
+
+The mkdir command creates the directory named by the directory_name operand.
+
+## mtime date file
+
+The mtime command sets the last modification time of the file named by the
+file operand. The date expression can be all sorts of date strings, see the
+curl_getdate(3) man page for date expression details. (Added in 7.73.0)
+
+## pwd
+
+The **pwd** command returns the absolute path of the current working
+directory.
+
+## rename source target
+
+The rename command renames the file or directory named by the source
+operand to the destination path named by the target operand.
+
+## rm file
+
+The rm command removes the file specified by the file operand.
+
+## rmdir directory
+
+The rmdir command removes the directory entry specified by the directory
+operand, provided it is empty.
+
+## statvfs file
+
+The statvfs command returns statistics on the file system in which specified
+file resides.
+
+## symlink source_file target_file
+
+See ln.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  struct curl_slist *cmdlist = NULL;
+  cmdlist = curl_slist_append(cmdlist, "RNFR source-name");
+  cmdlist = curl_slist_append(cmdlist, "RNTO new-name");
+
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/foo.bin");
+
+    /* pass in the FTP commands to run before the transfer */
+    curl_easy_setopt(curl, CURLOPT_QUOTE, cmdlist);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+
+  curl_slist_free_all(cmdlist);
+}
+~~~
+
+# HISTORY
+
+SFTP support added in 7.16.3. *-prefix for SFTP added in 7.24.0
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RANDOM_FILE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_RANDOM_FILE.3
deleted file mode 100644
index 1ee5ef1855..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_RANDOM_FILE.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_RANDOM_FILE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_RANDOM_FILE \- file to read random data from
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RANDOM_FILE, char *path);
-.fi
-.SH DESCRIPTION
-Deprecated option. It serves no purpose anymore.
-
-Pass a char * to a null-terminated file name. The file might be used to read
-from to seed the random engine for SSL and more.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL, not used
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_RANDOM_FILE, "junk.txt");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-If built with TLS enabled. Only the OpenSSL backend uses this, and only with
-OpenSSL versions before 1.1.0.
-
-This option was deprecated in 7.84.0.
-.SH RETURN VALUE
-Returns CURLE_OK on success or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_EGDSOCKET "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RANDOM_FILE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_RANDOM_FILE.md
new file mode 100644
index 0000000000..f69fa63235
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_RANDOM_FILE.md
@@ -0,0 +1,47 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_RANDOM_FILE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_EGDSOCKET (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+Added-in: 7.7
+---
+
+# NAME
+
+CURLOPT_RANDOM_FILE - file to read random data from
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RANDOM_FILE, char *path);
+~~~
+
+# DESCRIPTION
+
+Deprecated option. It serves no purpose anymore.
+
+# DEFAULT
+
+NULL, not used
+
+# DEPRECATED
+
+Deprecated since 7.84.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RANGE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_RANGE.3
deleted file mode 100644
index cad29a0c63..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_RANGE.3
+++ /dev/null
@@ -1,80 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_RANGE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_RANGE \- byte range to request
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RANGE, char *range);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter, which should contain the specified range you want
-to retrieve. It should be in the format "X-Y", where either X or Y may be left
-out and X and Y are byte indexes.
-
-HTTP transfers also support several intervals, separated with commas as in
-\fI"X-Y,N-M"\fP. Using this kind of multiple intervals causes the HTTP server
-to send the response document in pieces (using standard MIME separation
-techniques). Unfortunately, the HTTP standard (RFC 7233 section 3.1) allows
-servers to ignore range requests so even when you set \fICURLOPT_RANGE(3)\fP
-for a request, you may end up getting the full response sent back.
-
-For RTSP, the formatting of a range should follow RFC 2326 Section 12.29. For
-RTSP, byte ranges are \fBnot\fP permitted. Instead, ranges should be given in
-\fBnpt\fP, \fButc\fP, or \fBsmpte\fP formats.
-
-For HTTP PUT uploads this option should not be used, since it may conflict with
-other options.
-
-Pass a NULL to this option to disable the use of ranges.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP, FTP, FILE, RTSP and SFTP.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* get the first 200 bytes */
-  curl_easy_setopt(curl, CURLOPT_RANGE, "0-199");
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-FILE since 7.18.0, RTSP since 7.20.0
-.SH RETURN VALUE
-Returns CURLE_OK on success or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_RESUME_FROM "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RANGE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_RANGE.md
new file mode 100644
index 0000000000..4f7f1a88b2
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_RANGE.md
@@ -0,0 +1,100 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_RANGE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_LOW_SPEED_LIMIT (3)
+  - CURLOPT_MAXFILESIZE_LARGE (3)
+  - CURLOPT_MAX_RECV_SPEED_LARGE (3)
+  - CURLOPT_RESUME_FROM (3)
+Protocol:
+  - HTTP
+  - FTP
+  - FILE
+  - RTSP
+  - SFTP
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_RANGE - byte range to request
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RANGE, char *range);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter, which should contain the specified range you
+want to retrieve. It should be in the format "X-Y", where either X or Y may be
+left out and X and Y are byte indexes.
+
+HTTP transfers also support several intervals, separated with commas as in
+*"X-Y,N-M"*. Using this kind of multiple intervals causes the HTTP server
+to send the response document in pieces (using standard MIME separation
+techniques) as a multiple part response which libcurl returns as-is. It
+contains meta information in addition to the requested bytes. Parsing or
+otherwise transforming this response is the responsibility of the caller.
+
+Unfortunately, the HTTP standard (RFC 7233 section 3.1) allows servers to
+ignore range requests so even when you set CURLOPT_RANGE(3) for a request, you
+may end up getting the full response sent back.
+
+For RTSP, the formatting of a range should follow RFC 2326 Section 12.29. For
+RTSP, byte ranges are **not** permitted. Instead, ranges should be given in
+**npt**, **utc**, or **smpte** formats.
+
+For HTTP PUT uploads this option should not be used, since it may conflict with
+other options.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+The application does not have to keep the string around after setting this
+option.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* get the first 200 bytes */
+    curl_easy_setopt(curl, CURLOPT_RANGE, "0-199");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+FILE since 7.18.0, RTSP since 7.20.0
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_READDATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_READDATA.3
deleted file mode 100644
index 9040a64f1a..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_READDATA.3
+++ /dev/null
@@ -1,69 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_READDATA 3 "16 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_READDATA \- pointer passed to the read callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_READDATA, void *pointer);
-.fi
-.SH DESCRIPTION
-Data \fIpointer\fP to pass to the file read function. If you use the
-\fICURLOPT_READFUNCTION(3)\fP option, this is the pointer you get as input in
-the fourth argument to the callback.
-
-If you do not specify a read callback but instead rely on the default internal
-read function, this data must be a valid readable FILE * (cast to 'void *').
-
-If you are using libcurl as a DLL on Windows, you must use the
-\fICURLOPT_READFUNCTION(3)\fP callback if you set this option, otherwise you
-might experience crashes.
-.SH DEFAULT
-By default, this is a FILE * to stdin.
-.SH PROTOCOLS
-This is used for all protocols when sending data.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-struct MyData this;
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* pass pointer that gets passed in to the
-     CURLOPT_READFUNCTION callback */
-  curl_easy_setopt(curl, CURLOPT_READDATA, &this);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-This option was once known by the older name CURLOPT_INFILE, the name
-\fICURLOPT_READDATA(3)\fP was introduced in 7.9.7.
-.SH RETURN VALUE
-This returns CURLE_OK.
-.SH "SEE ALSO"
-.BR CURLOPT_READFUNCTION "(3), " CURLOPT_WRITEDATA "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_READDATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_READDATA.md
new file mode 100644
index 0000000000..fb18753363
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_READDATA.md
@@ -0,0 +1,82 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_READDATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HEADERDATA (3)
+  - CURLOPT_READFUNCTION (3)
+  - CURLOPT_WRITEDATA (3)
+  - CURLOPT_WRITEFUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.9.7
+---
+
+# NAME
+
+CURLOPT_READDATA - pointer passed to the read callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_READDATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+Data *pointer* to pass to the file read function. If you use the
+CURLOPT_READFUNCTION(3) option, this is the pointer you get as input in
+the fourth argument to the callback.
+
+If you do not specify a read callback but instead rely on the default internal
+read function, this data must be a valid readable FILE * (cast to 'void *').
+
+If you are using libcurl as a DLL on Windows, you must use the
+CURLOPT_READFUNCTION(3) callback if you set this option, otherwise you
+might experience crashes.
+
+# DEFAULT
+
+stdin
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct MyData {
+  void *custom;
+};
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  struct MyData this;
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* pass pointer that gets passed in to the
+       CURLOPT_READFUNCTION callback */
+    curl_easy_setopt(curl, CURLOPT_READDATA, &this);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+This option was once known by the older name CURLOPT_INFILE, the name
+CURLOPT_READDATA(3) was introduced in 7.9.7.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This returns CURLE_OK.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_READFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_READFUNCTION.3
deleted file mode 100644
index d3f4f3bb02..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_READFUNCTION.3
+++ /dev/null
@@ -1,119 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_READFUNCTION 3 "25 Jun 2020" libcurl libcurl
-.SH NAME
-CURLOPT_READFUNCTION \- read callback for data uploads
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-size_t read_callback(char *buffer, size_t size, size_t nitems, void *userdata);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_READFUNCTION, read_callback);
-.fi
-.SH DESCRIPTION
-Pass a pointer to your callback function, as the prototype shows above.
-
-This callback function gets called by libcurl as soon as it needs to read data
-in order to send it to the peer - like if you ask it to upload or post data to
-the server. The data area pointed at by the pointer \fIbuffer\fP should be
-filled up with at most \fIsize\fP multiplied with \fInitems\fP number of bytes
-by your function. \fIsize\fP is always 1.
-
-Set the \fIuserdata\fP argument with the \fICURLOPT_READDATA(3)\fP option.
-
-Your function must return the actual number of bytes that it stored in the
-data area pointed at by the pointer \fIbuffer\fP. Returning 0 signals
-end-of-file to the library and causes it to stop the current transfer.
-
-If you stop the current transfer by returning 0 "pre-maturely" (i.e before the
-server expected it, like when you have said you would upload N bytes and you
-upload less than N bytes), you may experience that the server "hangs" waiting
-for the rest of the data that is not sent.
-
-The read callback may return \fICURL_READFUNC_ABORT\fP to stop the current
-operation immediately, resulting in a \fICURLE_ABORTED_BY_CALLBACK\fP error
-code from the transfer.
-
-The callback can return \fICURL_READFUNC_PAUSE\fP to cause reading from this
-connection to pause. See \fIcurl_easy_pause(3)\fP for further details.
-
-\fBBugs\fP: when doing TFTP uploads, you must return the exact amount of data
-that the callback wants, or it is considered the final packet by the server
-end and the transfer ends there.
-
-If you set this callback pointer to NULL, or do not set it at all, the default
-internal read function is used. It is doing an fread() on the FILE * userdata
-set with \fICURLOPT_READDATA(3)\fP.
-
-You can set the total size of the data you are sending by using
-\fICURLOPT_INFILESIZE_LARGE(3)\fP or \fICURLOPT_POSTFIELDSIZE_LARGE(3)\fP,
-depending on the type of transfer. For some transfer types it may be required
-and it allows for better error checking.
-.SH DEFAULT
-The default internal read callback is fread().
-.SH PROTOCOLS
-This is used for all protocols when doing uploads.
-.SH EXAMPLE
-.nf
-size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userdata)
-{
-  FILE *readhere = (FILE *)userdata;
-  curl_off_t nread;
-
-  /* copy as much data as possible into the 'ptr' buffer, but no more than
-     'size' * 'nmemb' bytes! */
-  size_t retcode = fread(ptr, size, nmemb, readhere);
-
-  nread = (curl_off_t)retcode;
-
-  fprintf(stderr, "*** We read %" CURL_FORMAT_CURL_OFF_T
-          " bytes from file\\n", nread);
-  return retcode;
-}
-
-void setup(char *uploadthis)
-{
-  FILE *file = fopen(uploadthis, "rb");
-  CURLcode result;
-
-  /* set callback to use */
-  curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_callback);
-
-  /* pass in suitable argument to callback */
-  curl_easy_setopt(curl, CURLOPT_READDATA, (void *)file);
-
-  result = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-CURL_READFUNC_PAUSE return code was added in 7.18.0 and CURL_READFUNC_ABORT
-was added in 7.12.1.
-.SH RETURN VALUE
-This returns CURLE_OK.
-.SH "SEE ALSO"
-.BR CURLOPT_READDATA "(3), " CURLOPT_WRITEFUNCTION "(3), "
-.BR CURLOPT_SEEKFUNCTION "(3), " CURLOPT_UPLOAD "(3), " CURLOPT_POST "(3), "
-.BR CURLOPT_UPLOAD_BUFFERSIZE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_READFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_READFUNCTION.md
new file mode 100644
index 0000000000..0046ded635
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_READFUNCTION.md
@@ -0,0 +1,130 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_READFUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_POST (3)
+  - CURLOPT_READDATA (3)
+  - CURLOPT_SEEKFUNCTION (3)
+  - CURLOPT_UPLOAD (3)
+  - CURLOPT_UPLOAD_BUFFERSIZE (3)
+  - CURLOPT_WRITEFUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_READFUNCTION - read callback for data uploads
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+size_t read_callback(char *buffer, size_t size, size_t nitems, void *userdata);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_READFUNCTION, read_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, as the prototype shows above.
+
+This callback function gets called by libcurl as soon as it needs to read data
+in order to send it to the peer - like if you ask it to upload or post data to
+the server. The data area pointed at by the pointer *buffer* should be filled
+up with at most *nitems* number of bytes by your function. *size* is always 1.
+
+Set the *userdata* argument with the CURLOPT_READDATA(3) option.
+
+Your function must return the actual number of bytes that it stored in the
+data area pointed at by the pointer *buffer*. Returning 0 signals
+end-of-file to the library and causes it to stop the current transfer.
+
+If you stop the current transfer by returning 0 "pre-maturely" (i.e before the
+server expected it, like when you have said you would upload N bytes and you
+upload less than N bytes), you may experience that the server "hangs" waiting
+for the rest of the data that is not sent.
+
+The read callback may return *CURL_READFUNC_ABORT* to stop the current
+operation immediately, resulting in a *CURLE_ABORTED_BY_CALLBACK* error
+code from the transfer.
+
+The callback can return *CURL_READFUNC_PAUSE* to cause reading from this
+connection to pause. See curl_easy_pause(3) for further details.
+
+**Bugs**: when doing TFTP uploads, you must return the exact amount of data
+that the callback wants, or it is considered the final packet by the server
+end and the transfer ends there.
+
+If you set this callback pointer to NULL, or do not set it at all, the default
+internal read function is used. It is doing an fread() on the FILE * userdata
+set with CURLOPT_READDATA(3).
+
+You can set the total size of the data you are sending by using
+CURLOPT_INFILESIZE_LARGE(3) or CURLOPT_POSTFIELDSIZE_LARGE(3),
+depending on the type of transfer. For some transfer types it may be required
+and it allows for better error checking.
+
+When this option is used in combination with telling libcurl to follow
+redirects with CURLOPT_FOLLOWLOCATION(3), the data might need to be rewound
+and sent again. The CURLOPT_SEEKFUNCTION(3) can then be invoked for that
+rewind operation.
+
+# DEFAULT
+
+fread(3)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userdata)
+{
+  FILE *readhere = (FILE *)userdata;
+  curl_off_t nread;
+
+  /* copy as much data as possible into the 'ptr' buffer, but no more than
+     'size' * 'nmemb' bytes. */
+  size_t retcode = fread(ptr, size, nmemb, readhere);
+
+  nread = (curl_off_t)retcode;
+
+  fprintf(stderr, "*** We read %" CURL_FORMAT_CURL_OFF_T
+          " bytes from file\n", nread);
+  return retcode;
+}
+
+int main(int argc, char **argv)
+{
+  FILE *file = fopen(argv[1], "rb");
+  CURLcode result;
+
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    /* set callback to use */
+    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_callback);
+
+    /* pass in suitable argument to callback */
+    curl_easy_setopt(curl, CURLOPT_READDATA, (void *)file);
+
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+CURL_READFUNC_PAUSE return code was added in 7.18.0 and CURL_READFUNC_ABORT
+was added in 7.12.1.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This returns CURLE_OK.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_REDIR_PROTOCOLS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_REDIR_PROTOCOLS.3
deleted file mode 100644
index 2649407918..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_REDIR_PROTOCOLS.3
+++ /dev/null
@@ -1,111 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_REDIR_PROTOCOLS 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_REDIR_PROTOCOLS \- protocols allowed to redirect to
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_REDIR_PROTOCOLS, long bitmask);
-.fi
-.SH DESCRIPTION
-This option is deprecated. We strongly recommend using
-\fICURLOPT_REDIR_PROTOCOLS_STR(3)\fP instead because this option cannot
-control all available protocols!
-
-Pass a long that holds a bitmask of CURLPROTO_* defines. If used, this bitmask
-limits what protocols libcurl may use in a transfer that it follows to in a
-redirect when \fICURLOPT_FOLLOWLOCATION(3)\fP is enabled. This allows you to
-limit specific transfers to only be allowed to use a subset of protocols in
-redirections.
-
-Protocols denied by \fICURLOPT_PROTOCOLS(3)\fP are not overridden by this
-option.
-
-By default libcurl allows HTTP, HTTPS, FTP and FTPS on redirect (7.65.2).
-\fICURLPROTO_ALL\fP enables all protocols on redirect, including those
-otherwise disabled for security.
-
-These are the available protocol defines:
-.nf
-CURLPROTO_DICT
-CURLPROTO_FILE
-CURLPROTO_FTP
-CURLPROTO_FTPS
-CURLPROTO_GOPHER
-CURLPROTO_HTTP
-CURLPROTO_HTTPS
-CURLPROTO_IMAP
-CURLPROTO_IMAPS
-CURLPROTO_LDAP
-CURLPROTO_LDAPS
-CURLPROTO_POP3
-CURLPROTO_POP3S
-CURLPROTO_RTMP
-CURLPROTO_RTMPE
-CURLPROTO_RTMPS
-CURLPROTO_RTMPT
-CURLPROTO_RTMPTE
-CURLPROTO_RTMPTS
-CURLPROTO_RTSP
-CURLPROTO_SCP
-CURLPROTO_SFTP
-CURLPROTO_SMB
-CURLPROTO_SMBS
-CURLPROTO_SMTP
-CURLPROTO_SMTPS
-CURLPROTO_TELNET
-CURLPROTO_TFTP
-.fi
-.SH DEFAULT
-HTTP, HTTPS, FTP and FTPS (Added in 7.65.2).
-
-Older versions defaulted to all protocols except FILE, SCP and since 7.40.0
-SMB and SMBS.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  /* pass in the URL from an external source */
-  curl_easy_setopt(curl, CURLOPT_URL, argv[1]);
-
-  /* only allow redirects to HTTP and HTTPS URLs */
-  curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS,
-                   CURLPROTO_HTTP | CURLPROTO_HTTPS);
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.19.4, before then it would follow all protocols. Deprecated
-since 7.85.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_PROTOCOLS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_REDIR_PROTOCOLS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_REDIR_PROTOCOLS.md
new file mode 100644
index 0000000000..1d860312c0
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_REDIR_PROTOCOLS.md
@@ -0,0 +1,125 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_REDIR_PROTOCOLS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_SCHEME (3)
+  - CURLOPT_DEFAULT_PROTOCOL (3)
+  - CURLOPT_PROTOCOLS (3)
+  - CURLOPT_REDIR_PROTOCOLS_STR (3)
+Protocol:
+  - HTTP
+Added-in: 7.19.4
+---
+
+# NAME
+
+CURLOPT_REDIR_PROTOCOLS - protocols allowed to redirect to
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_REDIR_PROTOCOLS, long bitmask);
+~~~
+
+# DESCRIPTION
+
+This option is deprecated. We strongly recommend using
+CURLOPT_REDIR_PROTOCOLS_STR(3) instead because this option cannot
+control all available protocols.
+
+Pass a long that holds a bitmask of protocol bits. If used, this bitmask
+limits what protocols libcurl may use in a transfer that it follows to in a
+redirect when CURLOPT_FOLLOWLOCATION(3) is enabled. This allows you to limit
+specific transfers to only be allowed to use a subset of protocols in
+redirections.
+
+Protocols denied by CURLOPT_PROTOCOLS(3) are not overridden by this
+option.
+
+By default libcurl allows HTTP, HTTPS, FTP and FTPS on redirect (7.65.2).
+*CURLPROTO_ALL* enables all protocols on redirect, including those
+otherwise disabled for security.
+
+These are the available protocol defines:
+~~~c
+CURLPROTO_DICT
+CURLPROTO_FILE
+CURLPROTO_FTP
+CURLPROTO_FTPS
+CURLPROTO_GOPHER
+CURLPROTO_HTTP
+CURLPROTO_HTTPS
+CURLPROTO_IMAP
+CURLPROTO_IMAPS
+CURLPROTO_LDAP
+CURLPROTO_LDAPS
+CURLPROTO_MQTT
+CURLPROTO_POP3
+CURLPROTO_POP3S
+CURLPROTO_RTMP
+CURLPROTO_RTMPE
+CURLPROTO_RTMPS
+CURLPROTO_RTMPT
+CURLPROTO_RTMPTE
+CURLPROTO_RTMPTS
+CURLPROTO_RTSP
+CURLPROTO_SCP
+CURLPROTO_SFTP
+CURLPROTO_SMB
+CURLPROTO_SMBS
+CURLPROTO_SMTP
+CURLPROTO_SMTPS
+CURLPROTO_TELNET
+CURLPROTO_TFTP
+~~~
+
+# DEFAULT
+
+HTTP, HTTPS, FTP and FTPS
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(int argc, char **argv)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    /* pass in the URL from an external source */
+    curl_easy_setopt(curl, CURLOPT_URL, argv[1]);
+
+    /* only allow redirects to HTTP and HTTPS URLs */
+    curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS,
+                     CURLPROTO_HTTP | CURLPROTO_HTTPS);
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURLPROTO_*** macros became `long` types in 8.16.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# DEPRECATED
+
+Deprecated since 7.85.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_REDIR_PROTOCOLS_STR.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_REDIR_PROTOCOLS_STR.3
deleted file mode 100644
index 62629170c1..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_REDIR_PROTOCOLS_STR.3
+++ /dev/null
@@ -1,89 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_REDIR_PROTOCOLS_STR 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_REDIR_PROTOCOLS_STR \- protocols allowed to redirect to
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_REDIR_PROTOCOLS_STR,
-                          char *spec);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a string that holds a comma-separated list of case
-insensitive protocol names (URL schemes). That list limits what protocols
-libcurl may use in a transfer that it follows to in a redirect when
-\fICURLOPT_FOLLOWLOCATION(3)\fP is enabled. This option allows applications to
-limit specific transfers to only be allowed to use a subset of protocols in
-redirections.
-
-Protocols denied by \fICURLOPT_PROTOCOLS_STR(3)\fP are not overridden by this
-option.
-
-By default libcurl allows HTTP, HTTPS, FTP and FTPS on redirects (since
-7.65.2).
-
-These are the available protocols:
-
-DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS,
-MQTT, POP3, POP3S, RTMP, RTMPE, RTMPS, RTMPT, RTMPTE, RTMPTS, RTSP, SCP, SFTP,
-SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS, WSS
-
-You can set "ALL" as a short-cut to enable all protocols. Note that by setting
-all, you may enable protocols that were not supported the day you write this
-but are introduced in a future libcurl version.
-
-If trying to set a non-existing protocol or if no matching protocol at all is
-set, it returns error.
-.SH DEFAULT
-HTTP, HTTPS, FTP and FTPS (Added in 7.65.2).
-
-Older versions defaulted to all protocols except FILE, SCP and since 7.40.0
-SMB and SMBS.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  /* pass in the URL from an external source */
-  curl_easy_setopt(curl, CURLOPT_URL, argv[1]);
-
-  /* only allow redirects to HTTP and HTTPS URLs */
-  curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS_STR, "http,https");
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.85.0.
-.SH RETURN VALUE
-Returns CURLE_UNKNOWN_OPTION if the option is not implemented,
-CURLE_UNSUPPORTED_PROTOCOL if a listed protocol is not supported or disabled,
-CURLE_BAD_FUNCTION_ARGUMENT if no protocol is listed else CURLE_OK.
-.SH "SEE ALSO"
-.BR CURLOPT_PROTOCOLS_STR "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_REDIR_PROTOCOLS_STR.md b/third-party/curl/docs/libcurl/opts/CURLOPT_REDIR_PROTOCOLS_STR.md
new file mode 100644
index 0000000000..8f3c0ef885
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_REDIR_PROTOCOLS_STR.md
@@ -0,0 +1,98 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_REDIR_PROTOCOLS_STR
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_SCHEME (3)
+  - CURLOPT_DEFAULT_PROTOCOL (3)
+  - CURLOPT_PROTOCOLS (3)
+  - CURLOPT_PROTOCOLS_STR (3)
+  - CURLOPT_REDIR_PROTOCOLS (3)
+Protocol:
+  - HTTP
+Added-in: 7.85.0
+---
+
+# NAME
+
+CURLOPT_REDIR_PROTOCOLS_STR - protocols allowed to redirect to
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_REDIR_PROTOCOLS_STR,
+                          char *spec);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a string that holds a comma-separated list of case
+insensitive protocol names (URL schemes). That list limits what protocols
+libcurl may use in a transfer that it follows to in a redirect when
+CURLOPT_FOLLOWLOCATION(3) is enabled. This option allows applications to limit
+specific transfers to only be allowed to use a subset of protocols in
+redirections.
+
+Protocols denied by CURLOPT_PROTOCOLS_STR(3) are not overridden by this
+option.
+
+By default libcurl allows HTTP, HTTPS, FTP and FTPS on redirects (since
+7.65.2).
+
+These are the available protocols:
+
+DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS,
+MQTT, MQTTS, POP3, POP3S, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET,
+TFTP, WS, WSS
+
+You can set "ALL" as a short-cut to enable all protocols. Note that by setting
+all, you may enable protocols that were not supported the day you write this
+but are introduced in a future libcurl version.
+
+If trying to set a non-existing protocol or if no matching protocol at all is
+set, it returns error.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to restore to internal default.
+
+The application does not have to keep the string around after setting this
+option.
+
+# DEFAULT
+
+HTTP, HTTPS, FTP and FTPS
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(int argc, char **argv)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    /* pass in the URL from an external source */
+    curl_easy_setopt(curl, CURLOPT_URL, argv[1]);
+
+    /* only allow redirects to HTTP and HTTPS URLs */
+    curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS_STR, "http,https");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+Returns CURLE_UNKNOWN_OPTION if the option is not implemented,
+CURLE_UNSUPPORTED_PROTOCOL if a listed protocol is not supported or disabled,
+CURLE_BAD_FUNCTION_ARGUMENT if no protocol is listed else CURLE_OK.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_REFERER.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_REFERER.3
deleted file mode 100644
index f5bc74dd54..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_REFERER.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_REFERER 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_REFERER \- the HTTP referer header
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_REFERER, char *where);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter. It is used to set the
-Referer: header field in the HTTP request sent to the remote server. You can
-set any custom header with \fICURLOPT_HTTPHEADER(3)\fP.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* tell it where we found the link to this place */
-  curl_easy_setopt(curl, CURLOPT_REFERER, "https://example.com/aboutme.html");
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-If built with HTTP support
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP support is enabled, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_USERAGENT "(3), " CURLOPT_HTTPHEADER "(3), "
-.BR CURLINFO_REFERER "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_REFERER.md b/third-party/curl/docs/libcurl/opts/CURLOPT_REFERER.md
new file mode 100644
index 0000000000..5c927016e2
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_REFERER.md
@@ -0,0 +1,73 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_REFERER
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_REDIRECT_URL (3)
+  - CURLINFO_REFERER (3)
+  - CURLOPT_HTTPHEADER (3)
+  - CURLOPT_USERAGENT (3)
+Protocol:
+  - HTTP
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_REFERER - the HTTP referer header
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_REFERER, char *where);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter. It is used to set the
+Referer: header field in the HTTP request sent to the remote server. You can
+set any custom header with CURLOPT_HTTPHEADER(3).
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* tell it where we found the link to this place */
+    curl_easy_setopt(curl, CURLOPT_REFERER, "https://example.org/me.html");
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_REQUEST_TARGET.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_REQUEST_TARGET.3
deleted file mode 100644
index 824209c104..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_REQUEST_TARGET.3
+++ /dev/null
@@ -1,60 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_REQUEST_TARGET 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_REQUEST_TARGET \- alternative target for this request
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_REQUEST_TARGET, string);
-.fi
-.SH DESCRIPTION
-Pass a char * to string which libcurl uses in the upcoming request instead of
-the path as extracted from the URL.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/*");
-  curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "OPTIONS");
-
-  /* issue an OPTIONS * request (no leading slash) */
-  curl_easy_setopt(curl, CURLOPT_REQUEST_TARGET, "*");
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.55.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_CUSTOMREQUEST "(3), " CURLOPT_HTTPGET "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_REQUEST_TARGET.md b/third-party/curl/docs/libcurl/opts/CURLOPT_REQUEST_TARGET.md
new file mode 100644
index 0000000000..2c2cf201a9
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_REQUEST_TARGET.md
@@ -0,0 +1,77 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_REQUEST_TARGET
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CUSTOMREQUEST (3)
+  - CURLOPT_HTTPGET (3)
+  - CURLOPT_PATH_AS_IS (3)
+  - CURLOPT_URL (3)
+Protocol:
+  - HTTP
+Added-in: 7.55.0
+---
+
+# NAME
+
+CURLOPT_REQUEST_TARGET - alternative target for this request
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_REQUEST_TARGET, string);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer to string which libcurl uses in the upcoming request
+instead of the path as extracted from the URL.
+
+libcurl passes on the verbatim string in its request without any filter or
+other safe guards. That includes white space and control characters.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+The application does not have to keep the string around after setting this
+option.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/*");
+    curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "OPTIONS");
+
+    /* issue an OPTIONS * request (no leading slash) */
+    curl_easy_setopt(curl, CURLOPT_REQUEST_TARGET, "*");
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVE.3
deleted file mode 100644
index 7647df50ba..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVE.3
+++ /dev/null
@@ -1,112 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_RESOLVE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_RESOLVE \- provide custom host name to IP address resolves
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RESOLVE,
-                          struct curl_slist *hosts);
-.SH DESCRIPTION
-Pass a pointer to a linked list of strings with host name resolve information
-to use for requests with this handle. The linked list should be a fully valid
-list of \fBstruct curl_slist\fP structs properly filled in. Use
-\fIcurl_slist_append(3)\fP to create the list and \fIcurl_slist_free_all(3)\fP
-to clean up an entire list.
-
-Each resolve rule to add should be written using the format
-
-.nf
- [+]HOST:PORT:ADDRESS[,ADDRESS]
-.fi
-
-HOST is the name libcurl wants to resolve, PORT is the port number of the
-service where libcurl wants to connect to the HOST and ADDRESS is one or more
-numerical IP addresses. If you specify multiple IP addresses they need to be
-separated by comma. If libcurl is built to support IPv6, each of the ADDRESS
-entries can of course be either IPv4 or IPv6 style addressing.
-
-This option effectively populates the DNS cache with entries for the host+port
-pair so redirects and everything that operations against the HOST+PORT instead
-use your provided ADDRESS.
-
-The optional leading "+" specifies that the new entry should time-out. Entries
-added without the leading plus character never times out whereas entries added
-with "+HOST:..." times out just like ordinary DNS cache entries.
-
-If the DNS cache already has an entry for the given host+port pair, the new
-entry overrides the former one.
-
-An ADDRESS provided by this option is only used if not restricted by the
-setting of \fICURLOPT_IPRESOLVE(3)\fP to a different IP version.
-
-To remove names from the DNS cache again, to stop providing these fake
-resolves, include a string in the linked list that uses the format
-
-.nf
-  -HOST:PORT
-.fi
-
-The entry to remove must be prefixed with a dash, and the host name and port
-number must exactly match what was added previously.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl;
-struct curl_slist *host = NULL;
-host = curl_slist_append(NULL, "example.com:443:127.0.0.1");
-
-curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_RESOLVE, host);
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  curl_easy_perform(curl);
-
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-
-curl_slist_free_all(host);
-.fi
-.SH AVAILABILITY
-Added in 7.21.3. Removal support added in 7.42.0.
-
-Support for providing the ADDRESS within [brackets] was added in 7.57.0.
-
-Support for providing multiple IP addresses per entry was added in 7.59.0.
-
-Support for adding non-permanent entries by using the "+" prefix was added in
-7.75.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_IPRESOLVE "(3), " CURLOPT_DNS_CACHE_TIMEOUT "(3), "
-.BR CURLOPT_CONNECT_TO "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVE.md
new file mode 100644
index 0000000000..b4152b11af
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVE.md
@@ -0,0 +1,133 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_RESOLVE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CONNECT_TO (3)
+  - CURLOPT_DNS_CACHE_TIMEOUT (3)
+  - CURLOPT_IPRESOLVE (3)
+Protocol:
+  - All
+Added-in: 7.21.3
+---
+
+# NAME
+
+CURLOPT_RESOLVE - provide custom hostname to IP address resolves
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RESOLVE,
+                          struct curl_slist *hosts);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a linked list of strings with hostname resolve information
+to use for requests with this handle. The linked list should be a fully valid
+list of **struct curl_slist** structs properly filled in. Use
+curl_slist_append(3) to create the list and curl_slist_free_all(3) to clean up
+an entire list.
+
+libcurl does not copy the list, it needs to be kept around until after the
+transfer has completed.
+
+Each resolve rule to add should be written using the format
+
+    [+]HOST:PORT:ADDRESS[,ADDRESS]
+
+HOST is the name libcurl wants to resolve, PORT is the port number of the
+service where libcurl wants to connect to the HOST and ADDRESS is one or more
+numerical IP addresses. If you specify multiple IP addresses they need to be
+separated by comma. If libcurl is built to support IPv6, each of the ADDRESS
+entries can of course be either IPv4 or IPv6 style addressing.
+
+Specify the host as a single asterisk (`*`) to match all names. This wildcard
+is resolved last so any resolve with a specific host and port number is given
+priority.
+
+This option effectively populates the DNS cache with entries for the host+port
+pair so redirects and everything that operations against the HOST+PORT instead
+use your provided ADDRESS.
+
+The optional leading plus (`+`) specifies that the new entry should timeout.
+Entries added without the leading plus character never times out whereas
+entries added with `+HOST:...` times out like ordinary DNS cache entries.
+
+If the DNS cache already has an entry for the given host+port pair, the new
+entry overrides the former one.
+
+An ADDRESS provided by this option is only used if not restricted by the
+setting of CURLOPT_IPRESOLVE(3) to a different IP version.
+
+To remove names from the DNS cache again, to stop providing these fake
+resolves, include a string in the linked list that uses the format
+
+    -HOST:PORT
+
+The entry to remove must be prefixed with a dash, and the hostname and port
+number must exactly match what was added previously.
+
+Provide IPv6 addresses within [brackets].
+
+Using this option multiple times makes the last set list override the previous
+ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl;
+  struct curl_slist *host = NULL;
+  host = curl_slist_append(NULL, "example.com:443:127.0.0.1");
+  host = curl_slist_append(host, "example.com:443:[2001:db8::252f:efd6]");
+
+  curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_RESOLVE, host);
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    result = curl_easy_perform(curl);
+
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+
+  curl_slist_free_all(host);
+}
+~~~
+
+# HISTORY
+
+Added in 7.21.3. Removal support added in 7.42.0.
+
+Support for providing the ADDRESS within [brackets] was added in 7.57.0.
+
+Support for providing multiple IP addresses per entry was added in 7.59.0.
+
+Support for adding non-permanent entries by using the "+" prefix was added in
+7.75.0.
+
+Support for specifying the host component as an IPv6 address was added in 8.13.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVER_START_DATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVER_START_DATA.3
deleted file mode 100644
index 52c6844cd7..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVER_START_DATA.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_RESOLVER_START_DATA 3 "14 Feb 2018" libcurl libcurl
-.SH NAME
-CURLOPT_RESOLVER_START_DATA \- pointer passed to the resolver start callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RESOLVER_START_DATA,
-                          void *pointer);
-.fi
-.SH DESCRIPTION
-Pass a \fIpointer\fP is be untouched by libcurl and passed as the third
-argument in the resolver start callback set with
-\fICURLOPT_RESOLVER_START_FUNCTION(3)\fP.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-static int resolver_start_cb(void *resolver_state, void *reserved,
-                             void *userdata)
-{
-  (void)reserved;
-  printf("Received resolver_state=%p userdata=%p\\n",
-         resolver_state, userdata);
-  return 0;
-}
-
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_RESOLVER_START_FUNCTION, resolver_start_cb);
-  curl_easy_setopt(curl, CURLOPT_RESOLVER_START_DATA, curl);
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.59.0
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_RESOLVER_START_FUNCTION "(3) "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVER_START_DATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVER_START_DATA.md
new file mode 100644
index 0000000000..4e283cb29b
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVER_START_DATA.md
@@ -0,0 +1,73 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_RESOLVER_START_DATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PREREQFUNCTION (3)
+  - CURLOPT_RESOLVER_START_FUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.59.0
+---
+
+# NAME
+
+CURLOPT_RESOLVER_START_DATA - pointer passed to the resolver start callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RESOLVER_START_DATA,
+                          void *pointer);
+~~~
+
+# DESCRIPTION
+
+Pass a *pointer* is be untouched by libcurl and passed as the third
+argument in the resolver start callback set with
+CURLOPT_RESOLVER_START_FUNCTION(3).
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+static int resolver_start_cb(void *resolver_state, void *reserved,
+                             void *userdata)
+{
+  (void)reserved;
+  printf("Received resolver_state=%p userdata=%p\n",
+         resolver_state, userdata);
+  return 0;
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_RESOLVER_START_FUNCTION, resolver_start_cb);
+    curl_easy_setopt(curl, CURLOPT_RESOLVER_START_DATA, curl);
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVER_START_FUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVER_START_FUNCTION.3
deleted file mode 100644
index 8e2aab1efc..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVER_START_FUNCTION.3
+++ /dev/null
@@ -1,85 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_RESOLVER_START_FUNCTION 3 "14 Feb 2018" libcurl libcurl
-.SH NAME
-CURLOPT_RESOLVER_START_FUNCTION \- callback called before a new name resolve is started
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-int resolver_start_cb(void *resolver_state, void *reserved, void *userdata);
-
-CURLcode curl_easy_setopt(CURL *handle,
-                          CURLOPT_RESOLVER_START_FUNCTION,
-                          resolver_start_cb);
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-This callback function gets called by libcurl every time before a new resolve
-request is started.
-
-\fIresolver_state\fP points to a backend-specific resolver state. Currently
-only the ares resolver backend has a resolver state. It can be used to set up
-any desired option on the ares channel before it's used, for example setting up
-socket callback options.
-
-\fIreserved\fP is reserved.
-
-\fIuserdata\fP is the user pointer set with the
-\fICURLOPT_RESOLVER_START_DATA(3)\fP option.
-
-The callback must return 0 on success. Returning a non-zero value causes the
-resolve to fail.
-.SH DEFAULT
-NULL (No callback)
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-static int resolver_start_cb(void *resolver_state, void *reserved,
-                             void *userdata)
-{
-  (void)reserved;
-  printf("Received resolver_state=%p userdata=%p\\n",
-         resolver_state, userdata);
-  return 0;
-}
-
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_RESOLVER_START_FUNCTION, resolver_start_cb);
-  curl_easy_setopt(curl, CURLOPT_RESOLVER_START_DATA, curl);
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.59.0
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_RESOLVER_START_DATA "(3) "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVER_START_FUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVER_START_FUNCTION.md
new file mode 100644
index 0000000000..04e3b0d1b2
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_RESOLVER_START_FUNCTION.md
@@ -0,0 +1,91 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_RESOLVER_START_FUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PREREQFUNCTION (3)
+  - CURLOPT_RESOLVER_START_DATA (3)
+Protocol:
+  - All
+Added-in: 7.59.0
+---
+
+# NAME
+
+CURLOPT_RESOLVER_START_FUNCTION - callback called before a new name resolve is started
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+int resolver_start_cb(void *resolver_state, void *reserved, void *userdata);
+
+CURLcode curl_easy_setopt(CURL *handle,
+                          CURLOPT_RESOLVER_START_FUNCTION,
+                          resolver_start_cb);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+This callback function gets called by libcurl every time before a new resolve
+request is started.
+
+*resolver_state* points to a backend-specific resolver state. Currently only
+the ares resolver backend has a resolver state. It can be used to set up any
+desired option on the ares channel before it is used, for example setting up
+socket callback options.
+
+*reserved* is reserved.
+
+*userdata* is the user pointer set with the
+CURLOPT_RESOLVER_START_DATA(3) option.
+
+The callback must return 0 on success. Returning a non-zero value causes the
+resolve to fail.
+
+# DEFAULT
+
+NULL (No callback)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+static int start_cb(void *resolver_state, void *reserved,
+                    void *userdata)
+{
+  (void)reserved;
+  printf("Received resolver_state=%p userdata=%p\n",
+         resolver_state, userdata);
+  return 0;
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_RESOLVER_START_FUNCTION, start_cb);
+    curl_easy_setopt(curl, CURLOPT_RESOLVER_START_DATA, curl);
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RESUME_FROM.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_RESUME_FROM.3
deleted file mode 100644
index ebae1edd02..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_RESUME_FROM.3
+++ /dev/null
@@ -1,76 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_RESUME_FROM 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_RESUME_FROM \- offset to resume transfer from
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RESUME_FROM, long from);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter. It contains the offset in number of bytes that you
-want the transfer to start from. Set this option to 0 to make the transfer
-start from the beginning (effectively disabling resume). For FTP, set this
-option to -1 to make the transfer start from the end of the target file
-(useful to continue an interrupted upload).
-
-When doing uploads with FTP, the resume position is where in the local/source
-file libcurl should try to resume the upload from and it then appends the
-source file to the remote target file.
-
-If you need to resume a transfer beyond the 2GB limit, use
-\fICURLOPT_RESUME_FROM_LARGE(3)\fP instead.
-.SH DEFAULT
-0, not used
-.SH PROTOCOLS
-HTTP, FTP, SFTP, FILE
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com");
-
-  /* resume upload at byte index 200 */
-  curl_easy_setopt(curl, CURLOPT_RESUME_FROM, 200L);
-
-  /* ask for upload */
-  curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
-
-  /* set total data amount to expect */
-  curl_easy_setopt(curl, CURLOPT_INFILESIZE, size_of_file);
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_RESUME_FROM_LARGE "(3), " CURLOPT_RANGE "(3), "
-.BR CURLOPT_INFILESIZE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RESUME_FROM.md b/third-party/curl/docs/libcurl/opts/CURLOPT_RESUME_FROM.md
new file mode 100644
index 0000000000..d688430ba6
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_RESUME_FROM.md
@@ -0,0 +1,84 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_RESUME_FROM
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_INFILESIZE (3)
+  - CURLOPT_RANGE (3)
+  - CURLOPT_RESUME_FROM_LARGE (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_RESUME_FROM - offset to resume transfer from
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RESUME_FROM, long from);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter. It contains the offset in number of bytes that you
+want the transfer to start from. Set this option to 0 to make the transfer
+start from the beginning (effectively disabling resume). For FTP, set this
+option to -1 to make the transfer start from the end of the target file
+(useful to continue an interrupted upload).
+
+When doing uploads with FTP, the resume position is where in the local/source
+file libcurl should try to resume the upload from and it then appends the
+source file to the remote target file.
+
+If you need to resume a transfer beyond the 2GB limit, use
+CURLOPT_RESUME_FROM_LARGE(3) instead.
+
+# DEFAULT
+
+0, not used
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    long size_of_file = 6789;
+
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com");
+
+    /* resume upload at byte index 200 */
+    curl_easy_setopt(curl, CURLOPT_RESUME_FROM, 200L);
+
+    /* ask for upload */
+    curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+
+    /* set total data amount to expect */
+    curl_easy_setopt(curl, CURLOPT_INFILESIZE, size_of_file);
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RESUME_FROM_LARGE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_RESUME_FROM_LARGE.3
deleted file mode 100644
index e8f520b359..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_RESUME_FROM_LARGE.3
+++ /dev/null
@@ -1,76 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_RESUME_FROM_LARGE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_RESUME_FROM_LARGE \- offset to resume transfer from
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RESUME_FROM_LARGE,
-                          curl_off_t from);
-.SH DESCRIPTION
-Pass a curl_off_t as parameter. It contains the offset in number of bytes that
-you want the transfer to start from. Set this option to 0 to make the transfer
-start from the beginning (effectively disabling resume). For FTP, set this
-option to -1 to make the transfer start from the end of the target file
-(useful to continue an interrupted upload).
-
-When doing uploads with FTP, the resume position is where in the local/source
-file libcurl should try to resume the upload from and it appends the source
-file to the remote target file.
-.SH DEFAULT
-0, not used
-.SH PROTOCOLS
-HTTP, FTP, SFTP, FILE
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_off_t resume_position = GET_IT_SOMEHOW;
-  curl_off_t file_size = GET_IT_SOMEHOW_AS_WELL;
-
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com");
-
-  /* resuming upload at this position, possibly beyond 2GB */
-  curl_easy_setopt(curl, CURLOPT_RESUME_FROM_LARGE, resume_position);
-
-  /* ask for upload */
-  curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
-
-  /* set total data amount to expect */
-  curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, file_size);
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.11.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_RESUME_FROM "(3), " CURLOPT_RANGE "(3), "
-.BR CURLOPT_INFILESIZE_LARGE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RESUME_FROM_LARGE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_RESUME_FROM_LARGE.md
new file mode 100644
index 0000000000..da1d9aa53f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_RESUME_FROM_LARGE.md
@@ -0,0 +1,83 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_RESUME_FROM_LARGE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_INFILESIZE_LARGE (3)
+  - CURLOPT_RANGE (3)
+  - CURLOPT_RESUME_FROM (3)
+Protocol:
+  - All
+Added-in: 7.11.0
+---
+
+# NAME
+
+CURLOPT_RESUME_FROM_LARGE - offset to resume transfer from
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RESUME_FROM_LARGE,
+                          curl_off_t from);
+~~~
+
+# DESCRIPTION
+
+Pass a curl_off_t as parameter. It contains the offset in number of bytes that
+you want the transfer to start from. Set this option to 0 to make the transfer
+start from the beginning (effectively disabling resume). For FTP, set this
+option to -1 to make the transfer start from the end of the target file
+(useful to continue an interrupted upload).
+
+When doing uploads with FTP, the resume position is where in the local/source
+file libcurl should try to resume the upload from and it appends the source
+file to the remote target file.
+
+# DEFAULT
+
+0, not used
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_off_t resume_position = 1234; /* get it somehow */
+    curl_off_t file_size = 9876; /* get it somehow as well */
+
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com");
+
+    /* resuming upload at this position, possibly beyond 2GB */
+    curl_easy_setopt(curl, CURLOPT_RESUME_FROM_LARGE, resume_position);
+
+    /* ask for upload */
+    curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+
+    /* set total data amount to expect */
+    curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, file_size);
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_CLIENT_CSEQ.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_CLIENT_CSEQ.3
deleted file mode 100644
index 9c3a81a2cd..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_CLIENT_CSEQ.3
+++ /dev/null
@@ -1,57 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_RTSP_CLIENT_CSEQ 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_RTSP_CLIENT_CSEQ \- RTSP client CSEQ number
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RTSP_CLIENT_CSEQ, long cseq);
-.fi
-.SH DESCRIPTION
-Pass a long to set the CSEQ number to issue for the next RTSP request. Useful
-if the application is resuming a previously broken connection. The CSEQ
-increments from this new number henceforth.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-RTSP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "rtsp://example.com/");
-  curl_easy_setopt(curl, CURLOPT_RTSP_CLIENT_CSEQ, 1234L);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.20.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_RTSP_SERVER_CSEQ "(3), " CURLOPT_RTSP_REQUEST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_CLIENT_CSEQ.md b/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_CLIENT_CSEQ.md
new file mode 100644
index 0000000000..27da0f3b83
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_CLIENT_CSEQ.md
@@ -0,0 +1,64 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_RTSP_CLIENT_CSEQ
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_RTSP_CLIENT_CSEQ (3)
+  - CURLINFO_RTSP_SERVER_CSEQ (3)
+  - CURLOPT_RTSP_REQUEST (3)
+  - CURLOPT_RTSP_SERVER_CSEQ (3)
+Protocol:
+  - RTSP
+Added-in: 7.20.0
+---
+
+# NAME
+
+CURLOPT_RTSP_CLIENT_CSEQ - RTSP client CSEQ number
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RTSP_CLIENT_CSEQ, long cseq);
+~~~
+
+# DESCRIPTION
+
+Pass a long to set the CSEQ number to issue for the next RTSP request. Useful
+if the application is resuming a previously broken connection. The CSEQ
+increments from this new number henceforth.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "rtsp://example.com/");
+    curl_easy_setopt(curl, CURLOPT_RTSP_CLIENT_CSEQ, 1234L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_REQUEST.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_REQUEST.3
deleted file mode 100644
index 9b3fc84912..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_REQUEST.3
+++ /dev/null
@@ -1,117 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_RTSP_REQUEST 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_RTSP_REQUEST \- RTSP request
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RTSP_REQUEST, long request);
-.fi
-.SH DESCRIPTION
-Tell libcurl what kind of RTSP request to make. Pass one of the following RTSP
-enum values as a long in the \fIrequest\fP argument. Unless noted otherwise,
-commands require the Session ID to be initialized.
-.IP CURL_RTSPREQ_OPTIONS
-Used to retrieve the available methods of the server. The application is
-responsible for parsing and obeying the response. The session ID is not needed
-for this method.
-.IP CURL_RTSPREQ_DESCRIBE
-Used to get the low level description of a stream. The application should note
-what formats it understands in the \fI'Accept:'\fP header. Unless set
-manually, libcurl automatically adds in \fI'Accept: application/sdp'\fP.
-Time-condition headers are added to Describe requests if the
-\fICURLOPT_TIMECONDITION(3)\fP option is used. \fB(The session ID is not
-needed for this method)\fP
-.IP CURL_RTSPREQ_ANNOUNCE
-When sent by a client, this method changes the description of the session. For
-example, if a client is using the server to record a meeting, the client can
-use Announce to inform the server of all the meta-information about the
-session.  ANNOUNCE acts like an HTTP PUT or POST just like
-\fICURL_RTSPREQ_SET_PARAMETER\fP
-.IP CURL_RTSPREQ_SETUP
-Setup is used to initialize the transport layer for the session. The
-application must set the desired Transport options for a session by using the
-\fICURLOPT_RTSP_TRANSPORT(3)\fP option prior to calling setup. If no session
-ID is currently set with \fICURLOPT_RTSP_SESSION_ID(3)\fP, libcurl extracts
-and uses the session ID in the response to this request. The session ID is not
-needed for this method.
-.IP CURL_RTSPREQ_PLAY
-Send a Play command to the server. Use the \fICURLOPT_RANGE(3)\fP option to
-modify the playback time (e.g. \fInpt=10-15\fP).
-.IP CURL_RTSPREQ_PAUSE
-Send a Pause command to the server. Use the \fICURLOPT_RANGE(3)\fP option with
-a single value to indicate when the stream should be
-halted. (e.g. \fInpt=25\fP)
-.IP CURL_RTSPREQ_TEARDOWN
-This command terminates an RTSP session. Simply closing a connection does not
-terminate the RTSP session since it is valid to control an RTSP session over
-different connections.
-.IP CURL_RTSPREQ_GET_PARAMETER
-Retrieve a parameter from the server. By default, libcurl adds a
-\fIContent-Type: text/parameters\fP header on all non-empty requests unless a
-custom one is set. GET_PARAMETER acts just like an HTTP PUT or POST (see
-\fICURL_RTSPREQ_SET_PARAMETER\fP).  Applications wishing to send a heartbeat
-message (e.g. in the presence of a server-specified timeout) should send use
-an empty GET_PARAMETER request.
-.IP CURL_RTSPREQ_SET_PARAMETER
-Set a parameter on the server. By default, libcurl uses a
-\fIContent-Type: text/parameters\fP header unless a custom one is set.
-The interaction with SET_PARAMETER is much like an HTTP PUT or POST. An
-application may either use \fICURLOPT_UPLOAD(3)\fP with
-\fICURLOPT_READDATA(3)\fP like a HTTP PUT, or it may use
-\fICURLOPT_POSTFIELDS(3)\fP like an HTTP POST. No chunked transfers are
-allowed, so the application must set the \fICURLOPT_INFILESIZE(3)\fP in the
-former and \fICURLOPT_POSTFIELDSIZE(3)\fP in the latter. Also, there is no use
-of multi-part POSTs within RTSP.
-.IP CURL_RTSPREQ_RECORD
-Used to tell the server to record a session. Use the \fICURLOPT_RANGE(3)\fP
-option to modify the record time.
-.IP CURL_RTSPREQ_RECEIVE
-This is a special request because it does not send any data to the server. The
-application may call this function in order to receive interleaved RTP
-data. It returns after processing one read buffer of data in order to give the
-application a chance to run.
-.SH DEFAULT
-.SH PROTOCOLS
-RTSP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "rtsp://example.com/");
-  /* ask for options! */
-  curl_easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_OPTIONS);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.20.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_RTSP_SESSION_ID "(3), " CURLOPT_RTSP_STREAM_URI "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_REQUEST.md b/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_REQUEST.md
new file mode 100644
index 0000000000..c9c00a4b10
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_REQUEST.md
@@ -0,0 +1,146 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_RTSP_REQUEST
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_RTSP_SESSION_ID (3)
+  - CURLOPT_RTSP_STREAM_URI (3)
+Protocol:
+  - RTSP
+Added-in: 7.20.0
+---
+
+# NAME
+
+CURLOPT_RTSP_REQUEST - RTSP request
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RTSP_REQUEST, long request);
+~~~
+
+# DESCRIPTION
+
+Tell libcurl what kind of RTSP request to make. Pass one of the following RTSP
+enum values as a long in the *request* argument. Unless noted otherwise,
+commands require the Session ID to be initialized.
+
+## CURL_RTSPREQ_OPTIONS
+
+Used to retrieve the available methods of the server. The application is
+responsible for parsing and obeying the response. The session ID is not needed
+for this method.
+
+## CURL_RTSPREQ_DESCRIBE
+
+Used to get the low level description of a stream. The application should note
+what formats it understands in the *'Accept:'* header. Unless set manually,
+libcurl automatically adds in *'Accept: application/sdp'*. Time-condition
+headers are added to Describe requests if the CURLOPT_TIMECONDITION(3)
+option is used. (The session ID is not needed for this method)
+
+## CURL_RTSPREQ_ANNOUNCE
+
+When sent by a client, this method changes the description of the session. For
+example, if a client is using the server to record a meeting, the client can
+use Announce to inform the server of all the meta-information about the
+session. ANNOUNCE acts like an HTTP PUT or POST like
+*CURL_RTSPREQ_SET_PARAMETER*
+
+## CURL_RTSPREQ_SETUP
+
+Setup is used to initialize the transport layer for the session. The
+application must set the desired Transport options for a session by using the
+CURLOPT_RTSP_TRANSPORT(3) option prior to calling setup. If no session
+ID is currently set with CURLOPT_RTSP_SESSION_ID(3), libcurl extracts
+and uses the session ID in the response to this request. The session ID is not
+needed for this method.
+
+## CURL_RTSPREQ_PLAY
+
+Send a Play command to the server. Use the CURLOPT_RANGE(3) option to
+modify the playback time (e.g. *npt=10-15*).
+
+## CURL_RTSPREQ_PAUSE
+
+Send a Pause command to the server. Use the CURLOPT_RANGE(3) option with
+a single value to indicate when the stream should be
+halted. (e.g. *npt=25*)
+
+## CURL_RTSPREQ_TEARDOWN
+
+This command terminates an RTSP session. Closing a connection does not
+terminate the RTSP session since it is valid to control an RTSP session over
+different connections.
+
+## CURL_RTSPREQ_GET_PARAMETER
+
+Retrieve a parameter from the server. By default, libcurl adds a
+*Content-Type: text/parameters* header on all non-empty requests unless a
+custom one is set. GET_PARAMETER acts like an HTTP PUT or POST (see
+*CURL_RTSPREQ_SET_PARAMETER*). Applications wishing to send a heartbeat
+message (e.g. in the presence of a server-specified timeout) should send use
+an empty GET_PARAMETER request.
+
+## CURL_RTSPREQ_SET_PARAMETER
+
+Set a parameter on the server. By default, libcurl uses a *Content-Type:
+text/parameters* header unless a custom one is set. The interaction with
+SET_PARAMETER is much like an HTTP PUT or POST. An application may either use
+CURLOPT_UPLOAD(3) with CURLOPT_READDATA(3) like an HTTP PUT, or it may use
+CURLOPT_POSTFIELDS(3) like an HTTP POST. No chunked transfers are allowed, so
+the application must set the CURLOPT_INFILESIZE(3) in the former and
+CURLOPT_POSTFIELDSIZE(3) in the latter. Also, there is no use of multi-part
+POSTs within RTSP.
+
+## CURL_RTSPREQ_RECORD
+
+Used to tell the server to record a session. Use the CURLOPT_RANGE(3)
+option to modify the record time.
+
+## CURL_RTSPREQ_RECEIVE
+
+This is a special request because it does not send any data to the server. The
+application may call this function in order to receive interleaved RTP
+data. It returns after processing one read buffer of data in order to give the
+application a chance to run.
+
+# DEFAULT
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "rtsp://example.com/");
+    /* ask for options */
+    curl_easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_OPTIONS);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURL_RTSPREQ_*** enums became `long` types in 8.13.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_SERVER_CSEQ.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_SERVER_CSEQ.3
deleted file mode 100644
index aa153f6b43..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_SERVER_CSEQ.3
+++ /dev/null
@@ -1,57 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_RTSP_SERVER_CSEQ 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_RTSP_SERVER_CSEQ \- RTSP server CSEQ number
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RTSP_SERVER_CSEQ, long cseq);
-.fi
-.SH DESCRIPTION
-Pass a long to set the CSEQ number to expect for the next RTSP Server->Client
-request.  \fBNOTE\fP: this feature (listening for Server requests) is
-unimplemented.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-RTSP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "rtsp://example.com/");
-  curl_easy_setopt(curl, CURLOPT_RTSP_SERVER_CSEQ, 1234L);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.20.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_RTSP_CLIENT_CSEQ "(3), " CURLOPT_RTSP_STREAM_URI "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_SERVER_CSEQ.md b/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_SERVER_CSEQ.md
new file mode 100644
index 0000000000..f8672f1bf4
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_SERVER_CSEQ.md
@@ -0,0 +1,63 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_RTSP_SERVER_CSEQ
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_RTSP_SERVER_CSEQ (3)
+  - CURLOPT_RTSP_CLIENT_CSEQ (3)
+  - CURLOPT_RTSP_STREAM_URI (3)
+Protocol:
+  - RTSP
+Added-in: 7.20.0
+---
+
+# NAME
+
+CURLOPT_RTSP_SERVER_CSEQ - RTSP server CSEQ number
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RTSP_SERVER_CSEQ, long cseq);
+~~~
+
+# DESCRIPTION
+
+Pass a long to set the CSEQ number to expect for the next RTSP Server to
+Client request. **NOTE**: this feature (listening for Server requests) is
+unimplemented.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "rtsp://example.com/");
+    curl_easy_setopt(curl, CURLOPT_RTSP_SERVER_CSEQ, 1234L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_SESSION_ID.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_SESSION_ID.3
deleted file mode 100644
index b895f7c7c3..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_SESSION_ID.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_RTSP_SESSION_ID 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_RTSP_SESSION_ID \- RTSP session ID
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RTSP_SESSION_ID, char *id);
-.fi
-.SH DESCRIPTION
-Pass a char * as a parameter to set the value of the current RTSP Session ID
-for the handle. Useful for resuming an in-progress session. Once this value is
-set to any non-NULL value, libcurl returns \fICURLE_RTSP_SESSION_ERROR\fP if
-ID received from the server does not match. If unset (or set to NULL), libcurl
-automatically sets the ID the first time the server sets it in a response.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-RTSP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  char *prev_id; /* saved from before somehow */
-  curl_easy_setopt(curl, CURLOPT_URL, "rtsp://example.com/");
-  curl_easy_setopt(curl, CURLOPT_RTSP_SESSION_ID, prev_id);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.20.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_RTSP_REQUEST "(3), " CURLOPT_RTSP_STREAM_URI "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_SESSION_ID.md b/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_SESSION_ID.md
new file mode 100644
index 0000000000..39d6ae7913
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_SESSION_ID.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_RTSP_SESSION_ID
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_RTSP_REQUEST (3)
+  - CURLOPT_RTSP_STREAM_URI (3)
+Protocol:
+  - RTSP
+Added-in: 7.20.0
+---
+
+# NAME
+
+CURLOPT_RTSP_SESSION_ID - RTSP session ID
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RTSP_SESSION_ID, char *id);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as a parameter to set the value of the current RTSP
+Session ID for the handle. Useful for resuming an in-progress session. Once
+this value is set to any non-NULL value, libcurl returns
+*CURLE_RTSP_SESSION_ERROR* if the ID received from the server does not match.
+If unset (or set to NULL), libcurl automatically sets the ID the first time
+the server sets it in a response.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+**WARNING:** when changing the URL's origin in a reused easy handle, you might
+want to set or clear the Session ID to avoid reuse across different hosts.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    char *prev_id = "old"; /* previously retrieved RTSP session ID */
+    curl_easy_setopt(curl, CURLOPT_URL, "rtsp://example.com/");
+    curl_easy_setopt(curl, CURLOPT_RTSP_SESSION_ID, prev_id);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_STREAM_URI.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_STREAM_URI.3
deleted file mode 100644
index e0cee0cbed..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_STREAM_URI.3
+++ /dev/null
@@ -1,70 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_RTSP_STREAM_URI 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_RTSP_STREAM_URI \- RTSP stream URI
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RTSP_STREAM_URI, char *URI);
-.fi
-.SH DESCRIPTION
-Set the stream \fIURI\fP to operate on by passing a char * . For example, a
-single session may be controlling \fIrtsp://foo/twister/audio\fP and
-\fIrtsp://foo/twister/video\fP and the application can switch to the
-appropriate stream using this option. If unset, libcurl defaults to operating
-on generic server options by passing '*' in the place of the RTSP Stream
-URI. This option is distinct from \fICURLOPT_URL(3)\fP. When working with
-RTSP, the \fICURLOPT_RTSP_STREAM_URI(3)\fP indicates what URL to send to the
-server in the request header while the \fICURLOPT_URL(3)\fP indicates where to
-make the connection to.  (e.g. the \fICURLOPT_URL(3)\fP for the above examples
-might be set to \fIrtsp://foo/twister\fP
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-\&'*'
-.SH PROTOCOLS
-RTSP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  char *prev_id; /* saved from before somehow */
-  curl_easy_setopt(curl, CURLOPT_URL, "rtsp://example.com/");
-  curl_easy_setopt(curl, CURLOPT_RTSP_STREAM_URI,
-                   "rtsp://foo.example.com/twister/video");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.20.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_RTSP_REQUEST "(3), " CURLOPT_RTSP_TRANSPORT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_STREAM_URI.md b/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_STREAM_URI.md
new file mode 100644
index 0000000000..619096bf1a
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_STREAM_URI.md
@@ -0,0 +1,76 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_RTSP_STREAM_URI
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_RTSP_REQUEST (3)
+  - CURLOPT_RTSP_TRANSPORT (3)
+Protocol:
+  - RTSP
+Added-in: 7.20.0
+---
+
+# NAME
+
+CURLOPT_RTSP_STREAM_URI - RTSP stream URI
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RTSP_STREAM_URI, char *URI);
+~~~
+
+# DESCRIPTION
+
+Set the stream *URI* to operate on by passing a char * . For example, a single
+session may be controlling *rtsp://foo/twister/audio* and
+*rtsp://foo/twister/video* and the application can switch to the appropriate
+stream using this option. If unset, libcurl defaults to operating on generic
+server options by passing '*' in the place of the RTSP Stream URI. This option
+is distinct from CURLOPT_URL(3). When working with RTSP, the
+CURLOPT_RTSP_STREAM_URI(3) indicates what URL to send to the server in the
+request header while the CURLOPT_URL(3) indicates where to make the connection
+to. (e.g. the CURLOPT_URL(3) for the above examples might be set to
+*rtsp://foo/twister*
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+"*"
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "rtsp://example.com/");
+    curl_easy_setopt(curl, CURLOPT_RTSP_STREAM_URI,
+                     "rtsp://foo.example.com/twister/video");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_TRANSPORT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_TRANSPORT.3
deleted file mode 100644
index dd9c399229..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_TRANSPORT.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_RTSP_TRANSPORT 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_RTSP_TRANSPORT \- RTSP Transport: header
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RTSP_TRANSPORT,
-                          char *transport);
-.SH DESCRIPTION
-Pass a char * to tell libcurl what to pass for the Transport: header for this
-RTSP session. This is mainly a convenience method to avoid needing to set a
-custom Transport: header for every SETUP request. The application must set a
-Transport: header before issuing a SETUP request.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-RTSP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "rtsp://example.com/");
-  curl_easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_SETUP);
-  curl_easy_setopt(curl, CURLOPT_RTSP_TRANSPORT,
-                   "RTP/AVP;unicast;client_port=4588-4589");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.20.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_RTSP_REQUEST "(3), " CURLOPT_RTSP_SESSION_ID "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_TRANSPORT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_TRANSPORT.md
new file mode 100644
index 0000000000..44633cd71d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_RTSP_TRANSPORT.md
@@ -0,0 +1,74 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_RTSP_TRANSPORT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_RTSP_REQUEST (3)
+  - CURLOPT_RTSP_SESSION_ID (3)
+Protocol:
+  - RTSP
+Added-in: 7.20.0
+---
+
+# NAME
+
+CURLOPT_RTSP_TRANSPORT - RTSP Transport: header
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_RTSP_TRANSPORT,
+                          char *transport);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer to tell libcurl what to pass for the Transport: header for
+this RTSP session. This is mainly a convenience method to avoid needing to set
+a custom Transport: header for every SETUP request. The application must set a
+Transport: header before issuing a SETUP request.
+
+The application does not have to keep the string around after setting this
+option.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "rtsp://example.com/");
+    curl_easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_SETUP);
+    curl_easy_setopt(curl, CURLOPT_RTSP_TRANSPORT,
+                     "RTP/AVP;unicast;client_port=4588-4589");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURL_RTSPREQ_*** enums became `long` types in 8.13.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SASL_AUTHZID.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SASL_AUTHZID.3
deleted file mode 100644
index 514704c65c..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SASL_AUTHZID.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SASL_AUTHZID 3 "11 Sep 2019" libcurl libcurl
-.SH NAME
-CURLOPT_SASL_AUTHZID \- authorization identity (identity to act as)
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SASL_AUTHZID, char *authzid);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter, which should be pointing to the null-terminated
-authorization identity (\fIauthzid\fP) for the transfer. Only applicable to
-the PLAIN SASL authentication mechanism where it is optional.
-
-When not specified only the authentication identity (\fIauthcid\fP) as
-specified by the username is sent to the server, along with the password. The
-server derives a \fIauthzid\fP from the \fIauthcid\fP when not provided, which
-it then uses internally.
-
-When the \fIauthzid\fP is specified, the use of which is server dependent, it
-can be used to access another user's inbox, that the user has been granted
-access to, or a shared mailbox for example.
-.SH DEFAULT
-blank
-.SH PROTOCOLS
-IMAP, LDAP, POP3 and SMTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "imap://example.com/");
-  curl_easy_setopt(curl, CURLOPT_USERNAME, "Kurt");
-  curl_easy_setopt(curl, CURLOPT_PASSWORD, "xipj3plmq");
-  curl_easy_setopt(curl, CURLOPT_SASL_AUTHZID, "Ursel");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.66.0. Support for OpenLDAP added in 7.82.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_USERNAME "(3), " CURLOPT_PASSWORD "(3), ".BR CURLOPT_USERPWD "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SASL_AUTHZID.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SASL_AUTHZID.md
new file mode 100644
index 0000000000..e32380d65e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SASL_AUTHZID.md
@@ -0,0 +1,80 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SASL_AUTHZID
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PASSWORD (3)
+  - CURLOPT_USERNAME (3)
+  - CURLOPT_USERPWD (3)
+Protocol:
+  - IMAP
+Added-in: 7.66.0
+---
+
+# NAME
+
+CURLOPT_SASL_AUTHZID - authorization identity (identity to act as)
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SASL_AUTHZID, char *authzid);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter, which should be pointing to the
+null-terminated authorization identity (*authzid*) for the transfer. Only
+applicable to the PLAIN SASL authentication mechanism where it is optional.
+
+When not specified only the authentication identity (*authcid*) as specified
+by the username is sent to the server, along with the password. The server
+derives a *authzid* from the *authcid* when not provided, which it then uses
+internally.
+
+When the *authzid* is specified, the use of which is server dependent, it can
+be used to access another user's inbox, that the user has been granted access
+to, or a shared mailbox for example.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+blank
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "imap://example.com/");
+    curl_easy_setopt(curl, CURLOPT_USERNAME, "Kurt");
+    curl_easy_setopt(curl, CURLOPT_PASSWORD, "xipj3plmq");
+    curl_easy_setopt(curl, CURLOPT_SASL_AUTHZID, "Ursel");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SASL_IR.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SASL_IR.3
deleted file mode 100644
index e0ff2317cb..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SASL_IR.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SASL_IR 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SASL_IR \- send initial response in first packet
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SASL_IR, long enable);
-.fi
-.SH DESCRIPTION
-Pass a long. If the value is 1, curl sends the initial response to the server
-in the first authentication packet in order to reduce the number of ping pong
-requests. Only applicable to the following supporting SASL authentication
-mechanisms:
-
-* Login
-* Plain
-* GSSAPI
-* NTLM
-* OAuth 2.0
-
-Note: Whilst IMAP supports this option there is no need to explicitly set it,
-as libcurl can determine the feature itself when the server supports the
-SASL-IR CAPABILITY.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-IMAP, POP3 and SMTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "smtp://example.com/");
-  curl_easy_setopt(curl, CURLOPT_SASL_IR, 1L);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.31.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_MAIL_AUTH "(3), " CURLOPT_MAIL_FROM "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SASL_IR.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SASL_IR.md
new file mode 100644
index 0000000000..c99239db5b
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SASL_IR.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SASL_IR
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_MAIL_AUTH (3)
+  - CURLOPT_MAIL_FROM (3)
+  - CURLOPT_SASL_AUTHZID (3)
+Protocol:
+  - SMTP
+  - IMAP
+Added-in: 7.31.0
+---
+
+# NAME
+
+CURLOPT_SASL_IR - send initial response in first packet
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SASL_IR, long enable);
+~~~
+
+# DESCRIPTION
+
+Pass a long. If the value is 1, curl sends the initial response to the server
+in the first authentication packet in order to reduce the number of ping pong
+requests. Only applicable to the following supporting SASL authentication
+mechanisms:
+
+* Login
+* Plain
+* GSSAPI
+* NTLM
+* OAuth 2.0
+
+Note: Whilst IMAP supports this option there is no need to explicitly set it,
+as libcurl can determine the feature itself when the server supports the
+SASL-IR CAPABILITY.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "smtp://example.com/");
+    curl_easy_setopt(curl, CURLOPT_SASL_IR, 1L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SEEKDATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SEEKDATA.3
deleted file mode 100644
index 4fe8206334..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SEEKDATA.3
+++ /dev/null
@@ -1,60 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SEEKDATA 3 "16 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SEEKDATA \- pointer passed to the seek callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SEEKDATA, void *pointer);
-.fi
-.SH DESCRIPTION
-Data \fIpointer\fP to pass to the seek callback function. If you use the
-\fICURLOPT_SEEKFUNCTION(3)\fP option, this is the pointer you get as input.
-.SH DEFAULT
-If you do not set this, NULL is passed to the callback.
-.SH PROTOCOLS
-HTTP, FTP, SFTP
-.SH EXAMPLE
-.nf
-static int seek_cb(void *clientp, curl_off_t offset, int origin)
-{
-  struct data *d = (struct data *)clientp;
-  lseek(d->our_fd, offset, origin);
-  return CURL_SEEKFUNC_OK;
-}
-
-{
-  struct data seek_data;
-  curl_easy_setopt(CURL *handle, CURLOPT_SEEKFUNCTION, seek_cb);
-  curl_easy_setopt(CURL *handle, CURLOPT_SEEKDATA, &seek_data);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.18.0
-.SH RETURN VALUE
-.SH "SEE ALSO"
-.BR CURLOPT_STDERR "(3), " CURLOPT_DEBUGFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SEEKDATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SEEKDATA.md
new file mode 100644
index 0000000000..66f91c731b
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SEEKDATA.md
@@ -0,0 +1,71 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SEEKDATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DEBUGFUNCTION (3)
+  - CURLOPT_IOCTLFUNCTION (3)
+  - CURLOPT_SEEKFUNCTION (3)
+  - CURLOPT_STDERR (3)
+Protocol:
+  - FTP
+  - HTTP
+  - SFTP
+Added-in: 7.18.0
+---
+
+# NAME
+
+CURLOPT_SEEKDATA - pointer passed to the seek callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SEEKDATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+Data *pointer* to pass to the seek callback function. If you use the
+CURLOPT_SEEKFUNCTION(3) option, this is the pointer you get as input.
+
+# DEFAULT
+
+If you do not set this, NULL is passed to the callback.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <unistd.h> /* for lseek() */
+
+struct data {
+  int our_fd;
+};
+
+static int seek_cb(void *clientp, curl_off_t offset, int origin)
+{
+  struct data *d = (struct data *)clientp;
+  lseek(d->our_fd, offset, origin);
+  return CURL_SEEKFUNC_OK;
+}
+
+int main(void)
+{
+  struct data seek_data;
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_SEEKFUNCTION, seek_cb);
+    curl_easy_setopt(curl, CURLOPT_SEEKDATA, &seek_data);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SEEKFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SEEKFUNCTION.3
deleted file mode 100644
index 09be6efac9..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SEEKFUNCTION.3
+++ /dev/null
@@ -1,91 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SEEKFUNCTION 3 "16 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SEEKFUNCTION \- user callback for seeking in input stream
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-/* These are the return codes for the seek callbacks */
-#define CURL_SEEKFUNC_OK       0
-#define CURL_SEEKFUNC_FAIL     1 /* fail the entire transfer */
-#define CURL_SEEKFUNC_CANTSEEK 2 /* tell libcurl seeking cannot be done, so
-                                    libcurl might try other means instead */
-
-int seek_callback(void *clientp, curl_off_t offset, int origin);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SEEKFUNCTION, seek_callback);
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-This function gets called by libcurl to seek to a certain position in the
-input stream and can be used to fast forward a file in a resumed upload
-(instead of reading all uploaded bytes with the normal read
-function/callback). It is also called to rewind a stream when data has already
-been sent to the server and needs to be sent again. This may happen when doing
-an HTTP PUT or POST with a multi-pass authentication method, or when an
-existing HTTP connection is reused too late and the server closes the
-connection. The function shall work like fseek(3) or lseek(3) and it gets
-SEEK_SET, SEEK_CUR or SEEK_END as argument for \fIorigin\fP, although libcurl
-currently only passes SEEK_SET.
-
-\fIclientp\fP is the pointer you set with \fICURLOPT_SEEKDATA(3)\fP.
-
-The callback function must return \fICURL_SEEKFUNC_OK\fP on success,
-\fICURL_SEEKFUNC_FAIL\fP to cause the upload operation to fail or
-\fICURL_SEEKFUNC_CANTSEEK\fP to indicate that while the seek failed, libcurl
-is free to work around the problem if possible. The latter can sometimes be
-done by instead reading from the input or similar.
-
-If you forward the input arguments directly to fseek(3) or lseek(3), note that
-the data type for \fIoffset\fP is not the same as defined for curl_off_t on
-many systems!
-.SH DEFAULT
-By default, this is NULL and unused.
-.SH PROTOCOLS
-HTTP, FTP, SFTP
-.SH EXAMPLE
-.nf
-static int seek_cb(void *clientp, curl_off_t offset, int origin)
-{
-  struct data *d = (struct data *)clientp;
-  lseek(our_fd, offset, origin);
-  return CURL_SEEKFUNC_OK;
-}
-
-{
-  struct data seek_data;
-  curl_easy_setopt(CURL *handle, CURLOPT_SEEKFUNCTION, seek_cb);
-  curl_easy_setopt(CURL *handle, CURLOPT_SEEKDATA, &seek_data);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.18.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_SEEKDATA "(3), " CURLOPT_IOCTLFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SEEKFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SEEKFUNCTION.md
new file mode 100644
index 0000000000..2f4d96806e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SEEKFUNCTION.md
@@ -0,0 +1,106 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SEEKFUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DEBUGFUNCTION (3)
+  - CURLOPT_IOCTLFUNCTION (3)
+  - CURLOPT_SEEKDATA (3)
+  - CURLOPT_STDERR (3)
+Protocol:
+  - FTP
+  - HTTP
+  - SFTP
+Added-in: 7.18.0
+---
+
+# NAME
+
+CURLOPT_SEEKFUNCTION - user callback for seeking in input stream
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+/* These are the return codes for the seek callbacks */
+#define CURL_SEEKFUNC_OK       0
+#define CURL_SEEKFUNC_FAIL     1 /* fail the entire transfer */
+#define CURL_SEEKFUNC_CANTSEEK 2 /* tell libcurl seeking cannot be done, so
+                                    libcurl might try other means instead */
+
+int seek_callback(void *clientp, curl_off_t offset, int origin);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SEEKFUNCTION, seek_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+This function gets called by libcurl to seek to a certain position in the
+input stream and can be used to fast forward a file in a resumed upload
+(instead of reading all uploaded bytes with the normal read
+function/callback). It is also called to rewind a stream when data has already
+been sent to the server and needs to be sent again. This may happen when doing
+an HTTP PUT or POST with a multi-pass authentication method, or when an
+existing HTTP connection is reused too late and the server closes the
+connection. The function shall work like fseek(3) or lseek(3) and it gets
+SEEK_SET, SEEK_CUR or SEEK_END as argument for *origin*, although libcurl
+currently only passes SEEK_SET.
+
+*clientp* is the pointer you set with CURLOPT_SEEKDATA(3).
+
+The callback function must return *CURL_SEEKFUNC_OK* on success,
+*CURL_SEEKFUNC_FAIL* to cause the upload operation to fail or
+*CURL_SEEKFUNC_CANTSEEK* to indicate that while the seek failed, libcurl
+is free to work around the problem if possible. The latter can sometimes be
+done by instead reading from the input or similar.
+
+If you forward the input arguments directly to fseek(3) or lseek(3), note that
+the data type for *offset* is not the same as defined for curl_off_t on
+many systems.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <unistd.h> /* for lseek */
+
+struct data {
+  int our_fd;
+};
+static int seek_cb(void *clientp, curl_off_t offset, int origin)
+{
+  struct data *d = (struct data *)clientp;
+  lseek(d->our_fd, offset, origin);
+  return CURL_SEEKFUNC_OK;
+}
+
+int main(void)
+{
+  struct data seek_data;
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_SEEKFUNCTION, seek_cb);
+    curl_easy_setopt(curl, CURLOPT_SEEKDATA, &seek_data);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SERVER_RESPONSE_TIMEOUT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SERVER_RESPONSE_TIMEOUT.3
deleted file mode 100644
index 46d6fdaa74..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SERVER_RESPONSE_TIMEOUT.3
+++ /dev/null
@@ -1,72 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SERVER_RESPONSE_TIMEOUT 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SERVER_RESPONSE_TIMEOUT \- time allowed to wait for server response
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SERVER_RESPONSE_TIMEOUT,
-                          long timeout);
-.fi
-.SH DESCRIPTION
-Pass a long.  Causes libcurl to set a \fItimeout\fP period (in seconds) on the
-amount of time that the server is allowed to take in order to send a response
-message for a command before the session is considered dead.  While libcurl is
-waiting for a response, this value overrides \fICURLOPT_TIMEOUT(3)\fP. It is
-recommended that if used in conjunction with \fICURLOPT_TIMEOUT(3)\fP, you set
-\fICURLOPT_SERVER_RESPONSE_TIMEOUT(3)\fP to a value smaller than
-\fICURLOPT_TIMEOUT(3)\fP.
-
-This option was formerly known as \fBCURLOPT_FTP_RESPONSE_TIMEOUT\fP.
-.SH DEFAULT
-None
-.SH PROTOCOLS
-FTP, IMAP, POP3, SMTP, and SSH
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/slow.txt");
-  /* wait no more than 23 seconds */
-  curl_easy_setopt(curl, CURLOPT_SERVER_RESPONSE_TIMEOUT, 23L);
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.10.8. Used under this name since 7.20.0
-
-Support for SSH is predicated on a new enough (1.11.0) version of libssh2
-being available when compiling libcurl.
-.SH RETURN VALUE
-Returns CURLE_OK if supported, and CURLE_UNKNOWN_OPTION if not. Returns
-CURLE_BAD_FUNCTION_ARGUMENT if set to a negative value or a value that when
-converted to milliseconds is too large.
-.SH "SEE ALSO"
-.BR CURLOPT_TIMEOUT "(3), " CURLOPT_CONNECTTIMEOUT "(3), "
-.BR CURLOPT_LOW_SPEED_LIMIT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SERVER_RESPONSE_TIMEOUT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SERVER_RESPONSE_TIMEOUT.md
new file mode 100644
index 0000000000..68e27529dc
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SERVER_RESPONSE_TIMEOUT.md
@@ -0,0 +1,79 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SERVER_RESPONSE_TIMEOUT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SERVER_RESPONSE_TIMEOUT_MS (3)
+  - CURLOPT_CONNECTTIMEOUT (3)
+  - CURLOPT_LOW_SPEED_LIMIT (3)
+  - CURLOPT_TIMEOUT (3)
+Protocol:
+  - FTP
+  - IMAP
+  - POP3
+  - SMTP
+  - SFTP
+  - SCP
+Added-in: 7.20.0
+---
+
+# NAME
+
+CURLOPT_SERVER_RESPONSE_TIMEOUT - time allowed to wait for server response
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SERVER_RESPONSE_TIMEOUT,
+                          long timeout);
+~~~
+
+# DESCRIPTION
+
+Pass a long. It tells libcurl to wait no longer than *timeout* seconds for
+responses on sent commands. If no response is received within this period, the
+connection is considered dead and the transfer fails.
+
+It is recommended that if used in conjunction with CURLOPT_TIMEOUT(3), you set
+CURLOPT_SERVER_RESPONSE_TIMEOUT(3) to a value smaller than CURLOPT_TIMEOUT(3).
+
+# DEFAULT
+
+60 seconds
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/slow.txt");
+    /* wait no more than 23 seconds */
+    curl_easy_setopt(curl, CURLOPT_SERVER_RESPONSE_TIMEOUT, 23L);
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+This option was formerly known as CURLOPT_FTP_RESPONSE_TIMEOUT.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SERVER_RESPONSE_TIMEOUT_MS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SERVER_RESPONSE_TIMEOUT_MS.md
new file mode 100644
index 0000000000..cb57bf5d4a
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SERVER_RESPONSE_TIMEOUT_MS.md
@@ -0,0 +1,80 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SERVER_RESPONSE_TIMEOUT_MS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SERVER_RESPONSE_TIMEOUT (3)
+  - CURLOPT_CONNECTTIMEOUT (3)
+  - CURLOPT_LOW_SPEED_LIMIT (3)
+  - CURLOPT_TIMEOUT (3)
+Protocol:
+  - FTP
+  - IMAP
+  - POP3
+  - SMTP
+  - SFTP
+  - SCP
+Added-in: 8.6.0
+---
+
+# NAME
+
+CURLOPT_SERVER_RESPONSE_TIMEOUT_MS - time allowed to wait for server response
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SERVER_RESPONSE_TIMEOUT_MS,
+                          long timeout);
+~~~
+
+# DESCRIPTION
+
+Pass a long. It tells libcurl to wait no longer than *timeout* milliseconds
+for responses on sent commands. If no response is received within this period,
+the connection is considered dead and the transfer fails.
+
+It is recommended that if used in conjunction with CURLOPT_TIMEOUT(3), you set
+CURLOPT_SERVER_RESPONSE_TIMEOUT_MS(3) to a value smaller than
+CURLOPT_TIMEOUT(3).
+
+The maximum accepted value is 2147483648.
+
+This is the millisecond version of CURLOPT_SERVER_RESPONSE_TIMEOUT(3).
+
+# DEFAULT
+
+60000 milliseconds
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/slow.txt");
+    /* wait no more than 237 milliseconds */
+    curl_easy_setopt(curl, CURLOPT_SERVER_RESPONSE_TIMEOUT_MS, 237L);
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SERVICE_NAME.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SERVICE_NAME.3
deleted file mode 100644
index 8046d3990b..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SERVICE_NAME.3
+++ /dev/null
@@ -1,63 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SERVICE_NAME 3 "17 Jun 2015" libcurl libcurl
-.SH NAME
-CURLOPT_SERVICE_NAME \- authentication service name
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SERVICE_NAME, char *name);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter to a string holding the \fIname\fP of the service
-for DIGEST-MD5, SPNEGO and Kerberos 5 authentication mechanisms. The default
-service names are "ftp", "HTTP", "imap", "ldap", "pop" and "smtp". This option
-allows you to change them.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-See above
-.SH PROTOCOLS
-HTTP, FTP, IMAP, LDAP, POP3 and SMTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  CURLcode ret;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_SERVICE_NAME, "custom");
-  ret = curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.43.0 for HTTP, 7.49.0 for FTP, IMAP, POP3 and SMTP,
-7.82.0 for OpenLDAP.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY "(3), " CURLOPT_PROXYTYPE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SERVICE_NAME.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SERVICE_NAME.md
new file mode 100644
index 0000000000..f6efb393f2
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SERVICE_NAME.md
@@ -0,0 +1,74 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SERVICE_NAME
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY (3)
+  - CURLOPT_PROXYTYPE (3)
+  - CURLOPT_PROXY_SERVICE_NAME (3)
+Protocol:
+  - HTTP
+  - FTP
+  - IMAP
+  - POP3
+  - SMTP
+  - LDAP
+Added-in: 7.43.0
+---
+
+# NAME
+
+CURLOPT_SERVICE_NAME - authentication service name
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SERVICE_NAME, char *name);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter to a string holding the *name* of the service
+for DIGEST-MD5, SPNEGO and Kerberos 5 authentication mechanisms. The default
+service names are "ftp", "HTTP", "imap", "ldap", "pop" and "smtp". This option
+allows you to change them.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+See above
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_SERVICE_NAME, "custom");
+    result = curl_easy_perform(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SHARE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SHARE.3
deleted file mode 100644
index 40e8bf1b0d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SHARE.3
+++ /dev/null
@@ -1,85 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SHARE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SHARE \- share handle to use
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SHARE, CURLSH *share);
-.fi
-.SH DESCRIPTION
-Pass a \fIshare\fP handle as a parameter. The share handle must have been
-created by a previous call to \fIcurl_share_init(3)\fP. Setting this option,
-makes this curl handle use the data from the shared handle instead of keeping
-the data to itself. This enables several curl handles to share data. If the
-curl handles are used simultaneously in multiple threads, you \fBMUST\fP use
-the locking methods in the share handle. See \fIcurl_share_setopt(3)\fP for
-details.
-
-If you add a share that is set to share cookies, your easy handle uses that
-cookie cache and get the cookie engine enabled. If you stop sharing an object
-that was using cookies (or change to another object that does not share
-cookies), the easy handle gets its cookie engine disabled.
-
-Data that the share object is not set to share is dealt with the usual way, as
-if no share was used.
-
-Set this option to NULL again to stop using that share object.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-CURL *curl2 = curl_easy_init(); /* a second handle */
-if(curl) {
-  CURLSH *shobject = curl_share_init();
-  curl_share_setopt(shobject, CURLSHOPT_SHARE, CURL_LOCK_DATA_COOKIE);
-
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_COOKIEFILE, "");
-  curl_easy_setopt(curl, CURLOPT_SHARE, shobject);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-
-  /* the second handle shares cookies from the first */
-  curl_easy_setopt(curl2, CURLOPT_URL, "https://example.com/second");
-  curl_easy_setopt(curl2, CURLOPT_COOKIEFILE, "");
-  curl_easy_setopt(curl2, CURLOPT_SHARE, shobject);
-  ret = curl_easy_perform(curl2);
-  curl_easy_cleanup(curl2);
-
-  curl_share_cleanup(shobject);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_COOKIE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SHARE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SHARE.md
new file mode 100644
index 0000000000..907e4f2805
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SHARE.md
@@ -0,0 +1,92 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SHARE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_COOKIE (3)
+  - CURLSHOPT_SHARE (3)
+Protocol:
+  - All
+Added-in: 7.10
+---
+
+# NAME
+
+CURLOPT_SHARE - share handle to use
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SHARE, CURLSH *share);
+~~~
+
+# DESCRIPTION
+
+Pass a *share* handle as a parameter. The share handle must have been created
+by a previous call to curl_share_init(3). Setting this option, makes this curl
+handle use the data from the shared handle instead of keeping the data to
+itself. This enables several curl handles to share data. If the curl handles
+are used simultaneously in multiple threads, you **must** use the locking
+methods in the share handle. See curl_share_setopt(3) for details.
+
+If you add a share that is set to share cookies, your easy handle uses that
+cookie cache and get the cookie engine enabled. If you stop sharing an object
+that was using cookies (or change to another object that does not share
+cookies), the easy handle gets its cookie engine disabled.
+
+Data that the share object is not set to share is dealt with the usual way, as
+if no share was used.
+
+Set this option to NULL again to stop using that share object.
+
+Warning: adding a *share* and then setting it to NULL while the transfer
+is ongoing is discouraged and may lead to undefined behavior.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  CURL *curl2 = curl_easy_init(); /* a second handle */
+  if(curl) {
+    CURLcode result;
+    CURLSH *shobject = curl_share_init();
+    curl_share_setopt(shobject, CURLSHOPT_SHARE, CURL_LOCK_DATA_COOKIE);
+
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_COOKIEFILE, "");
+    curl_easy_setopt(curl, CURLOPT_SHARE, shobject);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+
+    /* the second handle shares cookies from the first */
+    curl_easy_setopt(curl2, CURLOPT_URL, "https://example.com/second");
+    curl_easy_setopt(curl2, CURLOPT_COOKIEFILE, "");
+    curl_easy_setopt(curl2, CURLOPT_SHARE, shobject);
+    result = curl_easy_perform(curl2);
+    curl_easy_cleanup(curl2);
+
+    curl_share_cleanup(shobject);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKOPTDATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKOPTDATA.3
deleted file mode 100644
index b2e6aa76d1..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKOPTDATA.3
+++ /dev/null
@@ -1,71 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SOCKOPTDATA 3 "16 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SOCKOPTDATA \- pointer to pass to sockopt callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SOCKOPTDATA, void *pointer);
-.fi
-.SH DESCRIPTION
-Pass a \fIpointer\fP that is untouched by libcurl and passed as the first
-argument in the sockopt callback set with \fICURLOPT_SOCKOPTFUNCTION(3)\fP.
-.SH DEFAULT
-The default value of this parameter is NULL.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-static int sockopt_callback(void *clientp, curl_socket_t curlfd,
-                            curlsocktype purpose)
-{
-  int val = *(int *)clientp;
-  setsockopt(curldfd, SOL_SOCKET, SO_RCVBUF, (const char *)&val, sizeof(val));
-  return CURL_SOCKOPT_OK;
-}
-
-curl = curl_easy_init();
-if(curl) {
-  int recvbuffersize = 256 * 1024;
-
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-
-  /* call this function to set options for the socket */
-  curl_easy_setopt(curl, CURLOPT_SOCKOPTFUNCTION, sockopt_callback);
-  curl_easy_setopt(curl, CURLOPT_SOCKOPTDATA, &recvbuffersize);
-
-  res = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.16.0
-.SH RETURN VALUE
-Returns \fICURLE_OK\fP if the option is supported, and \fICURLE_UNKNOWN_OPTION\fP if not.
-.SH "SEE ALSO"
-.BR CURLOPT_SOCKOPTFUNCTION "(3), " CURLOPT_OPENSOCKETFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKOPTDATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKOPTDATA.md
new file mode 100644
index 0000000000..be913df029
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKOPTDATA.md
@@ -0,0 +1,74 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SOCKOPTDATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_OPENSOCKETFUNCTION (3)
+  - CURLOPT_SOCKOPTFUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.16.0
+---
+
+# NAME
+
+CURLOPT_SOCKOPTDATA - pointer to pass to sockopt callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SOCKOPTDATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+Pass a *pointer* that is untouched by libcurl and passed as the first
+argument in the sockopt callback set with CURLOPT_SOCKOPTFUNCTION(3).
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+static int sockopt_callback(void *clientp, curl_socket_t curlfd,
+                            curlsocktype purpose)
+{
+  int val = *(int *)clientp;
+  setsockopt((int)curlfd, SOL_SOCKET, SO_RCVBUF,
+             (const char *)&val, sizeof(val));
+  return CURL_SOCKOPT_OK;
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    int recvbuffersize = 256 * 1024;
+
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+
+    /* call this function to set options for the socket */
+    curl_easy_setopt(curl, CURLOPT_SOCKOPTFUNCTION, sockopt_callback);
+    curl_easy_setopt(curl, CURLOPT_SOCKOPTDATA, &recvbuffersize);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+Returns *CURLE_OK* if the option is supported, and *CURLE_UNKNOWN_OPTION* if not.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKOPTFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKOPTFUNCTION.3
deleted file mode 100644
index b385040178..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKOPTFUNCTION.3
+++ /dev/null
@@ -1,125 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SOCKOPTFUNCTION 3 "16 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SOCKOPTFUNCTION \- callback for setting socket options
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-typedef enum  {
-  CURLSOCKTYPE_IPCXN,  /* socket created for a specific IP connection */
-  CURLSOCKTYPE_ACCEPT, /* socket created by accept() call */
-  CURLSOCKTYPE_LAST    /* never use */
-} curlsocktype;
-
-#define CURL_SOCKOPT_OK 0
-#define CURL_SOCKOPT_ERROR 1 /* causes libcurl to abort and return
-                                CURLE_ABORTED_BY_CALLBACK */
-#define CURL_SOCKOPT_ALREADY_CONNECTED 2
-
-int sockopt_callback(void *clientp,
-                     curl_socket_t curlfd,
-                     curlsocktype purpose);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SOCKOPTFUNCTION, sockopt_callback);
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-When set, this callback function gets called by libcurl when the socket has
-been created, but before the connect call to allow applications to change
-specific socket options. The callback's \fIpurpose\fP argument identifies the
-exact purpose for this particular socket:
-
-\fICURLSOCKTYPE_IPCXN\fP for actively created connections or since 7.28.0
-\fICURLSOCKTYPE_ACCEPT\fP for FTP when the connection was setup with PORT/EPSV
-(in earlier versions these sockets were not passed to this callback).
-
-Future versions of libcurl may support more purposes. libcurl passes the newly
-created socket descriptor to the callback in the \fIcurlfd\fP parameter so
-additional setsockopt() calls can be done at the user's discretion.
-
-The \fIclientp\fP pointer contains whatever user-defined value set using the
-\fICURLOPT_SOCKOPTDATA(3)\fP function.
-
-Return \fICURL_SOCKOPT_OK\fP from the callback on success. Return
-\fICURL_SOCKOPT_ERROR\fP from the callback function to signal an unrecoverable
-error to the library and it closes the socket and returns
-\fICURLE_COULDNT_CONNECT\fP. Alternatively, the callback function can return
-\fICURL_SOCKOPT_ALREADY_CONNECTED\fP, to tell libcurl that the socket is
-already connected and then libcurl does no attempt to connect. This allows an
-application to pass in an already connected socket with
-\fICURLOPT_OPENSOCKETFUNCTION(3)\fP and then have this function make libcurl
-not attempt to connect (again).
-.SH DEFAULT
-By default, this callback is NULL and unused.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-/* make libcurl use the already established socket 'sockfd' */
-
-static curl_socket_t opensocket(void *clientp,
-                                curlsocktype purpose,
-                                struct curl_sockaddr *address)
-{
-  curl_socket_t sockfd;
-  sockfd = *(curl_socket_t *)clientp;
-  /* the actual externally set socket is passed in via the OPENSOCKETDATA
-     option */
-  return sockfd;
-}
-
-static int sockopt_callback(void *clientp, curl_socket_t curlfd,
-                            curlsocktype purpose)
-{
-  /* This return code was added in libcurl 7.21.5 */
-  return CURL_SOCKOPT_ALREADY_CONNECTED;
-}
-
-curl = curl_easy_init();
-if(curl) {
-  /* libcurl thinks that you connect to the host
-   * and port that you specify in the URL option. */
-  curl_easy_setopt(curl, CURLOPT_URL, "http://99.99.99.99:9999");
-  /* call this function to get a socket */
-  curl_easy_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, opensocket);
-  curl_easy_setopt(curl, CURLOPT_OPENSOCKETDATA, &sockfd);
-
-  /* call this function to set options for the socket */
-  curl_easy_setopt(curl, CURLOPT_SOCKOPTFUNCTION, sockopt_callback);
-
-  res = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-.fi
-.SH AVAILABILITY
-Added in 7.16.0. The \fICURL_SOCKOPT_ALREADY_CONNECTED\fP return code was
-added in 7.21.5.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_SOCKOPTDATA "(3), " CURLOPT_OPENSOCKETFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKOPTFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKOPTFUNCTION.md
new file mode 100644
index 0000000000..2080aa9483
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKOPTFUNCTION.md
@@ -0,0 +1,134 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SOCKOPTFUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_OPENSOCKETFUNCTION (3)
+  - CURLOPT_SEEKFUNCTION (3)
+  - CURLOPT_SOCKOPTDATA (3)
+Protocol:
+  - All
+Added-in: 7.16.0
+---
+
+# NAME
+
+CURLOPT_SOCKOPTFUNCTION - callback for setting socket options
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+typedef enum {
+  CURLSOCKTYPE_IPCXN,  /* socket created for a specific IP connection */
+  CURLSOCKTYPE_ACCEPT, /* socket created by accept() call */
+  CURLSOCKTYPE_LAST    /* never use */
+} curlsocktype;
+
+#define CURL_SOCKOPT_OK 0
+#define CURL_SOCKOPT_ERROR 1 /* causes libcurl to abort and return
+                                CURLE_ABORTED_BY_CALLBACK */
+#define CURL_SOCKOPT_ALREADY_CONNECTED 2
+
+int sockopt_callback(void *clientp,
+                     curl_socket_t curlfd,
+                     curlsocktype purpose);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SOCKOPTFUNCTION, sockopt_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+When set, this callback function gets called by libcurl when the socket has
+been created, but before the connect call to allow applications to change
+specific socket options. The callback's *purpose* argument identifies the
+exact purpose for this particular socket:
+
+*CURLSOCKTYPE_IPCXN* for actively created connections or *CURLSOCKTYPE_ACCEPT*
+for FTP when the connection was setup with PORT/EPSV (in earlier versions
+these sockets were not passed to this callback).
+
+Future versions of libcurl may support more purposes. libcurl passes the newly
+created socket descriptor to the callback in the *curlfd* parameter so
+additional setsockopt() calls can be done at the user's discretion.
+
+The *clientp* pointer contains whatever user-defined value set using the
+CURLOPT_SOCKOPTDATA(3) function.
+
+Return *CURL_SOCKOPT_OK* from the callback on success. Return
+*CURL_SOCKOPT_ERROR* from the callback function to signal an unrecoverable
+error to the library and it closes the socket and returns
+*CURLE_COULDNT_CONNECT* for *CURLSOCKTYPE_IPCXN* and
+*CURLE_ABORTED_BY_CALLBACK* for *CURLSOCKTYPE_ACCEPT*.
+
+The callback function may return *CURL_SOCKOPT_ALREADY_CONNECTED* for
+*CURLSOCKTYPE_IPCXN*, to tell libcurl that the socket is already connected and
+then libcurl does no attempt to connect. This allows an application to pass in
+an already connected socket with CURLOPT_OPENSOCKETFUNCTION(3) and then have
+this function make libcurl not attempt to connect (again).
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+/* make libcurl use the already established socket 'sockfd' */
+
+static curl_socket_t opensocket(void *clientp,
+                                curlsocktype purpose,
+                                struct curl_sockaddr *address)
+{
+  curl_socket_t sockfd;
+  sockfd = *(curl_socket_t *)clientp;
+  /* the actual externally set socket is passed in via the OPENSOCKETDATA
+     option */
+  return sockfd;
+}
+
+static int sockopt_callback(void *clientp, curl_socket_t curlfd,
+                            curlsocktype purpose)
+{
+  return CURL_SOCKOPT_ALREADY_CONNECTED;
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    int sockfd; /* our custom file descriptor */
+    /* libcurl thinks that you connect to the host
+     * and port that you specify in the URL option. */
+    curl_easy_setopt(curl, CURLOPT_URL, "http://99.99.99.99:9999");
+    /* call this function to get a socket */
+    curl_easy_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, opensocket);
+    curl_easy_setopt(curl, CURLOPT_OPENSOCKETDATA, &sockfd);
+
+    /* call this function to set options for the socket */
+    curl_easy_setopt(curl, CURLOPT_SOCKOPTFUNCTION, sockopt_callback);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_AUTH.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_AUTH.3
deleted file mode 100644
index 3ddc842b65..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_AUTH.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SOCKS5_AUTH 3 "27 April 2017" libcurl libcurl
-.SH NAME
-CURLOPT_SOCKS5_AUTH \- methods for SOCKS5 proxy authentication
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SOCKS5_AUTH, long bitmask);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter, which is set to a bitmask, to tell libcurl which
-authentication method(s) are allowed for SOCKS5 proxy authentication.  The only
-supported flags are \fICURLAUTH_BASIC\fP, which allows username/password
-authentication, \fICURLAUTH_GSSAPI\fP, which allows GSS-API authentication, and
-\fICURLAUTH_NONE\fP, which allows no authentication.  Set the actual user name
-and password with the \fICURLOPT_PROXYUSERPWD(3)\fP option.
-.SH DEFAULT
-CURLAUTH_BASIC|CURLAUTH_GSSAPI
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* request to use a SOCKS5 proxy */
-  curl_easy_setopt(curl, CURLOPT_PROXY, "socks5://user:pass@myproxy.com");
-
-  /* enable username/password authentication only */
-  curl_easy_setopt(curl, CURLOPT_SOCKS5_AUTH, (long)CURLAUTH_BASIC);
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.55.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_NOT_BUILT_IN if the bitmask contains unsupported flags.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY "(3), " CURLOPT_PROXYTYPE "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_AUTH.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_AUTH.md
new file mode 100644
index 0000000000..2fe3de3f45
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_AUTH.md
@@ -0,0 +1,86 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SOCKS5_AUTH
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY (3)
+  - CURLOPT_PROXYTYPE (3)
+Protocol:
+  - All
+Added-in: 7.55.0
+---
+
+# NAME
+
+CURLOPT_SOCKS5_AUTH - methods for SOCKS5 proxy authentication
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SOCKS5_AUTH, long bitmask);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter, which is set to a bitmask, to tell libcurl which
+authentication method(s) are allowed for SOCKS5 proxy authentication. The only
+supported flags are *CURLAUTH_BASIC*, which allows username/password
+authentication, *CURLAUTH_GSSAPI*, which allows GSS-API authentication, and
+*CURLAUTH_NONE*, which allows no authentication. Set the actual username and
+password with the CURLOPT_PROXYUSERPWD(3) option.
+
+The specific socks authentication method is an *access property*, it does not
+change the security context. This means that this option changes how the
+connection and access to the proxy happens when a connection is setup, but it
+does not affect which proxy connections libcurl can reuse. libcurl may reuse a
+connection that was set up with a different socks authentication method. Proxy
+connection reuse still depends on other properties matching, such as the
+protocol, proxy hostname, port number, credentials and other settings that
+affect the connection.
+
+# DEFAULT
+
+CURLAUTH_BASIC | CURLAUTH_GSSAPI
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* request to use a SOCKS5 proxy */
+    curl_easy_setopt(curl, CURLOPT_PROXY, "socks5://user:pass@myproxy.com");
+
+    /* enable username/password authentication only */
+    curl_easy_setopt(curl, CURLOPT_SOCKS5_AUTH, CURLAUTH_BASIC);
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURLAUTH_*** macros became `long` types in 7.26.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_GSSAPI_NEC.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_GSSAPI_NEC.3
deleted file mode 100644
index 0f6b58430c..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_GSSAPI_NEC.3
+++ /dev/null
@@ -1,60 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SOCKS5_GSSAPI_NEC 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SOCKS5_GSSAPI_NEC \- SOCKS proxy GSSAPI negotiation protection
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SOCKS5_GSSAPI_NEC, long nec);
-.fi
-.SH DESCRIPTION
-Pass a long set to 1 to enable or 0 to disable. As part of the GSSAPI
-negotiation a protection mode is negotiated. The RFC 1961 says in section
-4.3/4.4 it should be protected, but the NEC reference implementation does not.
-If enabled, this option allows the unprotected exchange of the protection mode
-negotiation.
-.SH DEFAULT
-?
-.SH PROTOCOLS
-Most
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "socks5://proxy");
-  curl_easy_setopt(curl, CURLOPT_SOCKS5_GSSAPI_NEC, 1L);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.19.4
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_SOCKS5_GSSAPI_SERVICE "(3), " CURLOPT_PROXY "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_GSSAPI_NEC.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_GSSAPI_NEC.md
new file mode 100644
index 0000000000..38f5004adc
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_GSSAPI_NEC.md
@@ -0,0 +1,65 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SOCKS5_GSSAPI_NEC
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY (3)
+  - CURLOPT_PROXY_SERVICE_NAME (3)
+Protocol:
+  - All
+Added-in: 7.19.4
+---
+
+# NAME
+
+CURLOPT_SOCKS5_GSSAPI_NEC - SOCKS proxy GSSAPI negotiation protection
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SOCKS5_GSSAPI_NEC, long nec);
+~~~
+
+# DESCRIPTION
+
+Pass a long set to 1 to enable or 0 to disable. As part of the GSSAPI
+negotiation a protection mode is negotiated. The RFC 1961 says in section
+4.3/4.4 it should be protected, but the NEC reference implementation does not.
+If enabled, this option allows the unprotected exchange of the protection mode
+negotiation.
+
+# DEFAULT
+
+?
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "socks5://proxy");
+    curl_easy_setopt(curl, CURLOPT_SOCKS5_GSSAPI_NEC, 1L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_GSSAPI_SERVICE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_GSSAPI_SERVICE.3
deleted file mode 100644
index 995b020a04..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_GSSAPI_SERVICE.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SOCKS5_GSSAPI_SERVICE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SOCKS5_GSSAPI_SERVICE \- SOCKS5 proxy authentication service name
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SOCKS5_GSSAPI_SERVICE,
-                          char *name);
-.fi
-.SH DESCRIPTION
-Deprecated since 7.49.0. Use \fICURLOPT_PROXY_SERVICE_NAME(3)\fP instead.
-
-Pass a \fBchar *\fP as parameter to a string holding the \fIname\fP of the
-service.  The default service name for a SOCKS5 server is \fI"rcmd"\fP. This
-option allows you to change it.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-See above
-.SH PROTOCOLS
-All network protocols
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_PROXY, "socks5://proxy");
-  curl_easy_setopt(curl, CURLOPT_SOCKS5_GSSAPI_SERVICE, "rcmd-special");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.19.4, deprecated in 7.49.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_PROXY "(3), " CURLOPT_PROXYTYPE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_GSSAPI_SERVICE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_GSSAPI_SERVICE.md
new file mode 100644
index 0000000000..51ae347a2d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SOCKS5_GSSAPI_SERVICE.md
@@ -0,0 +1,73 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SOCKS5_GSSAPI_SERVICE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY (3)
+  - CURLOPT_PROXYTYPE (3)
+Protocol:
+  - All
+Added-in: 7.19.4
+---
+
+# NAME
+
+CURLOPT_SOCKS5_GSSAPI_SERVICE - SOCKS5 proxy authentication service name
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SOCKS5_GSSAPI_SERVICE,
+                          char *name);
+~~~
+
+# DESCRIPTION
+
+Deprecated. Use CURLOPT_PROXY_SERVICE_NAME(3) instead.
+
+Pass a char pointer as parameter to a string holding the *name* of the
+service. The default service name for a SOCKS5 server is *rcmd*. This option
+allows you to change it.
+
+The application does not have to keep the string around after setting this
+option.
+
+# DEFAULT
+
+See above
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_PROXY, "socks5://proxy");
+    curl_easy_setopt(curl, CURLOPT_SOCKS5_GSSAPI_SERVICE, "rcmd-special");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# DEPRECATED
+
+Deprecated since 7.49.0
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_AUTH_TYPES.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_AUTH_TYPES.3
deleted file mode 100644
index 6d1a856c03..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_AUTH_TYPES.3
+++ /dev/null
@@ -1,63 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSH_AUTH_TYPES 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSH_AUTH_TYPES \- auth types for SFTP and SCP
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_AUTH_TYPES, long bitmask);
-.fi
-.SH DESCRIPTION
-Pass a long set to a bitmask consisting of one or more of
-CURLSSH_AUTH_PUBLICKEY, CURLSSH_AUTH_PASSWORD, CURLSSH_AUTH_HOST,
-CURLSSH_AUTH_KEYBOARD and CURLSSH_AUTH_AGENT.
-
-Set \fICURLSSH_AUTH_ANY\fP to let libcurl pick a suitable one. Currently
-CURLSSH_AUTH_HOST has no effect. If CURLSSH_AUTH_AGENT is used, libcurl
-attempts to connect to ssh-agent or pageant and let the agent attempt the
-authentication.
-.SH DEFAULT
-CURLSSH_AUTH_ANY (all available)
-.SH PROTOCOLS
-SFTP and SCP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/file");
-  curl_easy_setopt(curl, CURLOPT_SSH_AUTH_TYPES,
-                   CURLSSH_AUTH_PUBLICKEY | CURLSSH_AUTH_KEYBOARD);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-CURLSSH_AUTH_HOST was added in 7.16.1, CURLSSH_AUTH_AGENT was added in 7.28.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 "(3), " CURLOPT_SSH_PUBLIC_KEYFILE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_AUTH_TYPES.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_AUTH_TYPES.md
new file mode 100644
index 0000000000..3b9fb989d1
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_AUTH_TYPES.md
@@ -0,0 +1,75 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSH_AUTH_TYPES
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 (3)
+  - CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 (3)
+  - CURLOPT_SSH_PUBLIC_KEYFILE (3)
+Protocol:
+  - SFTP
+  - SCP
+Added-in: 7.16.1
+---
+
+# NAME
+
+CURLOPT_SSH_AUTH_TYPES - auth types for SFTP and SCP
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_AUTH_TYPES, long bitmask);
+~~~
+
+# DESCRIPTION
+
+Pass a long set to a bitmask consisting of one or more of
+CURLSSH_AUTH_PUBLICKEY, CURLSSH_AUTH_PASSWORD, CURLSSH_AUTH_HOST,
+CURLSSH_AUTH_KEYBOARD and CURLSSH_AUTH_AGENT.
+
+Set *CURLSSH_AUTH_ANY* to let libcurl pick a suitable one. Currently
+CURLSSH_AUTH_HOST has no effect. If CURLSSH_AUTH_AGENT is used, libcurl
+attempts to connect to ssh-agent or pageant and let the agent attempt the
+authentication.
+
+# DEFAULT
+
+CURLSSH_AUTH_ANY (all available)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/file");
+    curl_easy_setopt(curl, CURLOPT_SSH_AUTH_TYPES,
+                     CURLSSH_AUTH_PUBLICKEY | CURLSSH_AUTH_KEYBOARD);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURLSSH_AUTH_*** macros became `long` types in 8.16.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_COMPRESSION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_COMPRESSION.3
deleted file mode 100644
index 1f760dfa5b..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_COMPRESSION.3
+++ /dev/null
@@ -1,62 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSH_COMPRESSION 3 "05 Aug 2017" libcurl libcurl
-.SH NAME
-CURLOPT_SSH_COMPRESSION \- enable SSH compression
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_COMPRESSION, long enable);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter set to 1L to enable or 0L to disable.
-
-Enables built-in SSH compression.  This is a request, not an order; the server
-may or may not do it.
-.SH DEFAULT
-0, disabled
-.SH PROTOCOLS
-All SSH based protocols: SCP, SFTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com");
-
-  /* enable built-in compression */
-  curl_easy_setopt(curl, CURLOPT_SSH_COMPRESSION, 1L);
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.56.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_ACCEPT_ENCODING "(3), " CURLOPT_TRANSFER_ENCODING "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_COMPRESSION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_COMPRESSION.md
new file mode 100644
index 0000000000..291f924d4d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_COMPRESSION.md
@@ -0,0 +1,68 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSH_COMPRESSION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_ACCEPT_ENCODING (3)
+  - CURLOPT_TRANSFER_ENCODING (3)
+Protocol:
+  - SFTP
+  - SCP
+Added-in: 7.56.0
+---
+
+# NAME
+
+CURLOPT_SSH_COMPRESSION - enable SSH compression
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_COMPRESSION, long enable);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter set to 1L to enable or 0L to disable.
+
+Enables built-in SSH compression. This is a request, not an order; the server
+may or may not do it.
+
+# DEFAULT
+
+0, disabled
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com");
+
+    /* enable built-in compression */
+    curl_easy_setopt(curl, CURLOPT_SSH_COMPRESSION, 1L);
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOSTKEYDATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOSTKEYDATA.3
deleted file mode 100644
index def7991625..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOSTKEYDATA.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSH_KEYDATA 3 "4 Nov 2021" libcurl libcurl
-.SH NAME
-CURLOPT_SSH_HOSTKEYDATA \- pointer to pass to the SSH host key callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_HOSTKEYDATA, void *pointer);
-.fi
-.SH DESCRIPTION
-Pass a void * as parameter. This \fIpointer\fP is passed along untouched to
-the callback set with \fICURLOPT_SSH_HOSTKEYFUNCTION(3)\fP.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-SCP and SFTP
-.SH EXAMPLE
-.nf
-int hostkeycb(void *clientp,    /* passed with CURLOPT_SSH_HOSTKEYDATA */
-              int keytype,      /* CURLKHTYPE */
-              const char * key, /* host key to check */
-              size_t keylen);   /* length of the key */
-{
-  /* 'clientp' points to the callback_data struct */
-  /* investigate the situation and return the correct value */
-  return CURLKHMATCH_OK;
-}
-{
-  curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/thisfile.txt");
-  curl_easy_setopt(curl, CURLOPT_SSH_HOSTKEYFUNCTION, hostkeycb);
-  curl_easy_setopt(curl, CURLOPT_SSH_HOSTKEYDATA, &callback_data);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.84.0, works only with libssh2 backend.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_SSH_HOSTKEYFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOSTKEYDATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOSTKEYDATA.md
new file mode 100644
index 0000000000..fc3e48aa80
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOSTKEYDATA.md
@@ -0,0 +1,82 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSH_HOSTKEYDATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSH_HOSTKEYFUNCTION (3)
+Protocol:
+  - SFTP
+  - SCP
+Added-in: 7.84.0
+---
+
+# NAME
+
+CURLOPT_SSH_HOSTKEYDATA - pointer to pass to the SSH host key callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_HOSTKEYDATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+Pass a void * as parameter. This *pointer* is passed along untouched to
+the callback set with CURLOPT_SSH_HOSTKEYFUNCTION(3).
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct mine {
+  void *custom;
+};
+
+static int hostkeycb(void *clientp,   /* CURLOPT_SSH_HOSTKEYDATA */
+                     int keytype,     /* CURLKHTYPE */
+                     const char *key, /* host key to check */
+                     size_t keylen)   /* length of the key */
+{
+  /* 'clientp' points to the callback_data struct */
+  /* investigate the situation and return the correct value */
+  return CURLKHMATCH_OK;
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    struct mine callback_data;
+    curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/thisfile.txt");
+    curl_easy_setopt(curl, CURLOPT_SSH_HOSTKEYFUNCTION, hostkeycb);
+    curl_easy_setopt(curl, CURLOPT_SSH_HOSTKEYDATA, &callback_data);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# NOTES
+
+Works only with the libssh2 backend.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOSTKEYFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOSTKEYFUNCTION.3
deleted file mode 100644
index 024cded841..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOSTKEYFUNCTION.3
+++ /dev/null
@@ -1,87 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSH_HOSTKEYFUNCTION 3 "4 Nov 2021" libcurl libcurl
-.SH NAME
-CURLOPT_SSH_HOSTKEYFUNCTION \- callback to check host key
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-int keycallback(void *clientp,
-                int keytype,
-                const char *key,
-                size_t keylen);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_HOSTKEYFUNCTION,
-                          keycallback);
-.fi
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above. It overrides \fICURLOPT_SSH_KNOWNHOSTS(3)\fP.
-
-This callback gets called when the verification of the SSH host key is needed.
-
-\fBkey\fP is \fBkeylen\fP bytes long and is the key to check. \fBkeytype\fP
-says what type it is, from the \fBCURLKHTYPE_*\fP series in the
-\fBcurl_khtype\fP enum.
-
-\fBclientp\fP is a custom pointer set with \fICURLOPT_SSH_HOSTKEYDATA(3)\fP.
-
-The callback MUST return one of the following return codes to tell libcurl how
-to act:
-.IP CURLKHMATCH_OK
-The host key is accepted, the connection should continue.
-.IP CURLKHMATCH_MISMATCH
-the host key is rejected, the connection is canceled.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-SCP and SFTP
-.SH EXAMPLE
-.nf
-int hostkeycb(void *clientp,    /* passed with CURLOPT_SSH_HOSTKEYDATA */
-              int keytype,      /* CURLKHTYPE */
-              const char * key, /* host key to check */
-              size_t keylen);   /* length of the key */
-{
-  /* 'clientp' points to the callback_data struct */
-  /* investigate the situation and return the correct value */
-  return CURLKHMATCH_OK;
-}
-{
-  curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/thisfile.txt");
-  curl_easy_setopt(curl, CURLOPT_SSH_HOSTKEYFUNCTION, hostkeycb);
-  curl_easy_setopt(curl, CURLOPT_SSH_HOSTKEYDATA, &callback_data);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.84.0 , work only with libssh2 backend.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_SSH_HOSTKEYDATA "(3), "
-.BR CURLOPT_SSH_KNOWNHOSTS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOSTKEYFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOSTKEYFUNCTION.md
new file mode 100644
index 0000000000..1125ec392e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOSTKEYFUNCTION.md
@@ -0,0 +1,110 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSH_HOSTKEYFUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSH_HOSTKEYDATA (3)
+  - CURLOPT_SSH_KNOWNHOSTS (3)
+Protocol:
+  - SFTP
+  - SCP
+Added-in: 7.84.0
+---
+
+# NAME
+
+CURLOPT_SSH_HOSTKEYFUNCTION - callback to check host key
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+int keycallback(void *clientp,
+                int keytype,
+                const char *key,
+                size_t keylen);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_HOSTKEYFUNCTION,
+                          keycallback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above. It overrides CURLOPT_SSH_KNOWNHOSTS(3).
+
+This callback gets called when the verification of the SSH host key is needed.
+
+**key** is **keylen** bytes long and is the key to check. **keytype** says
+what type it is, from the **CURLKHTYPE_*** series in the **curl_khtype** enum.
+
+**clientp** is a custom pointer set with CURLOPT_SSH_HOSTKEYDATA(3).
+
+This option is used to verify new SSH connections only. Once the connection
+has been vetted by this callback it is deemed vetted and may be reused again
+without invoking this callback again.
+
+The callback must return one of the following return codes to tell libcurl how
+to act:
+
+## CURLKHMATCH_OK
+
+The host key is accepted, the connection should continue.
+
+## CURLKHMATCH_MISMATCH
+
+the host key is rejected, the connection is canceled.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct mine {
+  void *custom;
+};
+
+int hostkeycb(void *clientp,    /* passed with CURLOPT_SSH_HOSTKEYDATA */
+              int keytype,      /* CURLKHTYPE */
+              const char *key,  /* host key to check */
+              size_t keylen)    /* length of the key */
+{
+  /* 'clientp' points to the callback_data struct */
+  /* investigate the situation and return the correct value */
+  return CURLKHMATCH_OK;
+}
+int main(void)
+{
+  struct mine callback_data;
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/thisfile.txt");
+    curl_easy_setopt(curl, CURLOPT_SSH_HOSTKEYFUNCTION, hostkeycb);
+    curl_easy_setopt(curl, CURLOPT_SSH_HOSTKEYDATA, &callback_data);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# NOTES
+
+Work only with the libssh2 backend.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_MD5.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_MD5.3
deleted file mode 100644
index 2772ae8619..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_MD5.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 \- MD5 checksum of SSH server public key
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_HOST_PUBLIC_KEY_MD5,
-                          char *md5);
-.SH DESCRIPTION
-Pass a char * pointing to a string containing 32 hexadecimal digits. The
-string should be the 128 bit MD5 checksum of the remote host's public key, and
-libcurl aborts the connection to the host unless the MD5 checksum match.
-
-MD5 is a weak algorithm. We strongly recommend using
-\fICURLOPT_SSH_HOST_PUBLIC_KEY_SHA256(3)\fP instead.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-SCP and SFTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/file");
-  curl_easy_setopt(curl, CURLOPT_SSH_HOST_PUBLIC_KEY_MD5,
-                   "afe17cd62a0f3b61f1ab9cb22ba269a7");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.17.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_SSH_PUBLIC_KEYFILE "(3), " CURLOPT_SSH_AUTH_TYPES "(3), "
-.BR CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_MD5.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_MD5.md
new file mode 100644
index 0000000000..777b25c4a1
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_MD5.md
@@ -0,0 +1,90 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSH_HOST_PUBLIC_KEY_MD5
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSH_AUTH_TYPES (3)
+  - CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 (3)
+  - CURLOPT_SSH_KNOWNHOSTS (3)
+  - CURLOPT_SSH_PUBLIC_KEYFILE (3)
+Protocol:
+  - SFTP
+  - SCP
+Added-in: 7.17.1
+---
+
+# NAME
+
+CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 - MD5 checksum of SSH server public key
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_HOST_PUBLIC_KEY_MD5,
+                          char *md5);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer pointing to a string containing 32 hexadecimal digits. The
+string should be the 128-bit MD5 checksum of the remote host's public key, and
+libcurl aborts the connection to the host unless the MD5 checksum match.
+
+MD5 is a weak algorithm. We strongly recommend using
+CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256(3) instead.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+This option is only applied when libcurl creates a new SSH connection. Once a
+connection has been created and successfully verified with this MD5 check, it
+is deemed vetted and may be reused by libcurl without performing the MD5
+verification again, even if you later change or disable this option or switch
+to other verification mechanisms such as CURLOPT_SSH_KNOWNHOSTS(3) or
+CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256(3). Any such changes only affect future new
+connections, not already established ones.
+
+When MD5 verification is enabled for a connection via this option, libcurl
+uses that MD5-based check instead of the known hosts/host key callback
+verification path for that connection, so you must not assume that both the
+MD5 check and the known hosts/host key callback verification are performed for
+the same connection.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/file");
+    curl_easy_setopt(curl, CURLOPT_SSH_HOST_PUBLIC_KEY_MD5,
+                     "afe17cd62a0f3b61f1ab9cb22ba269a7");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256.3
deleted file mode 100644
index 8d6311d51f..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256.3
+++ /dev/null
@@ -1,61 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 3 "27 Aug 2021" libcurl libcurl
-.SH NAME
-CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 \- SHA256 hash of SSH server public key
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256,
-                          char *sha256);
-.SH DESCRIPTION
-Pass a char * pointing to a string containing a Base64-encoded SHA256 hash of
-the remote host's public key.  The transfer fails if the given hash does not
-match the hash the remote host provides.
-
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-SCP and SFTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/file");
-  curl_easy_setopt(curl, CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256,
-                   "NDVkMTQxMGQ1ODdmMjQ3MjczYjAyOTY5MmRkMjVmNDQ=");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.80.0
-Requires the libssh2 backend.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_SSH_PUBLIC_KEYFILE "(3), " CURLOPT_SSH_AUTH_TYPES "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256.md
new file mode 100644
index 0000000000..fce7e58f04
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256.md
@@ -0,0 +1,83 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSH_AUTH_TYPES (3)
+  - CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 (3)
+  - CURLOPT_SSH_PUBLIC_KEYFILE (3)
+Protocol:
+  - SFTP
+  - SCP
+Added-in: 7.80.0
+---
+
+# NAME
+
+CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 - SHA256 hash of SSH server public key
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256,
+                          char *sha256);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer pointing to a string containing a Base64-encoded SHA256
+hash of the remote host's public key. The transfer fails if the given hash
+does not match the hash the remote host provides.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+This option is used to verify a new connection only. The SHA256 hash check is
+performed when libcurl establishes a new SSH connection; once that connection
+has been successfully verified, it is deemed vetted and may be reused without
+performing the SHA256 (or any other host key) verification again, even if you
+subsequently change SSH verification-related options. When this SHA256-based
+verification is enabled for a new connection, libcurl does not additionally
+consult CURLOPT_SSH_KNOWNHOSTS(3) or SSH host key callbacks (including
+CURLOPT_SSH_HOST_PUBLIC_KEY_MD5(3)) for that connection, so you should not
+expect multiple host verification methods to be applied to the same new
+connection.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/file");
+    curl_easy_setopt(curl, CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256,
+                     "NDVkMTQxMGQ1ODdmMjQ3MjczYjAyOTY5MmRkMjVmNDQ=");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KEYDATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KEYDATA.3
deleted file mode 100644
index 3696ab325e..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KEYDATA.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSH_KEYDATA 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSH_KEYDATA \- pointer passed to the SSH key callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_KEYDATA, void *pointer);
-.fi
-.SH DESCRIPTION
-Pass a void * as parameter. This \fIpointer\fP is passed along verbatim to the
-callback set with \fICURLOPT_SSH_KEYFUNCTION(3)\fP.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-SFTP and SCP
-.SH EXAMPLE
-.nf
-static int keycb(CURL *easy,
-                 const struct curl_khkey *knownkey,
-                 const struct curl_khkey *foundkey,
-                 enum curl_khmatch match,
-                 void *clientp)
-{
-  /* 'clientp' points to the callback_data struct */
-  /* investigate the situation and return the correct value */
-  return CURLKHSTAT_FINE_ADD_TO_FILE;
-}
-{
-  curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/thisfile.txt");
-  curl_easy_setopt(curl, CURLOPT_SSH_KEYFUNCTION, keycb);
-  curl_easy_setopt(curl, CURLOPT_SSH_KEYDATA, &callback_data);
-  curl_easy_setopt(curl, CURLOPT_SSH_KNOWNHOSTS, "/home/user/known_hosts");
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.19.6
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_SSH_KEYDATA "(3), " CURLOPT_SSH_KNOWNHOSTS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KEYDATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KEYDATA.md
new file mode 100644
index 0000000000..aebaf79af1
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KEYDATA.md
@@ -0,0 +1,80 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSH_KEYDATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSH_KEYDATA (3)
+  - CURLOPT_SSH_KNOWNHOSTS (3)
+Protocol:
+  - SFTP
+  - SCP
+Added-in: 7.19.6
+---
+
+# NAME
+
+CURLOPT_SSH_KEYDATA - pointer passed to the SSH key callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_KEYDATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+Pass a void * as parameter. This *pointer* is passed along verbatim to the
+callback set with CURLOPT_SSH_KEYFUNCTION(3).
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct mine {
+  void *custom;
+};
+static int keycb(CURL *easy,
+                 const struct curl_khkey *knownkey,
+                 const struct curl_khkey *foundkey,
+                 enum curl_khmatch match,
+                 void *clientp)
+{
+  /* 'clientp' points to the callback_data struct */
+  /* investigate the situation and return the correct value */
+  return CURLKHSTAT_FINE_ADD_TO_FILE;
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    struct mine callback_data;
+    curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/thisfile.txt");
+    curl_easy_setopt(curl, CURLOPT_SSH_KEYFUNCTION, keycb);
+    curl_easy_setopt(curl, CURLOPT_SSH_KEYDATA, &callback_data);
+    curl_easy_setopt(curl, CURLOPT_SSH_KNOWNHOSTS, "/home/user/known_hosts");
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KEYFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KEYFUNCTION.3
deleted file mode 100644
index a8f77827ab..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KEYFUNCTION.3
+++ /dev/null
@@ -1,132 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSH_KEYFUNCTION 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSH_KEYFUNCTION \- callback for known host matching logic
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-enum curl_khstat {
-  CURLKHSTAT_FINE_ADD_TO_FILE,
-  CURLKHSTAT_FINE,
-  CURLKHSTAT_REJECT, /* reject the connection, return an error */
-  CURLKHSTAT_DEFER,  /* do not accept it, but we cannot answer right
-                        now. Causes a CURLE_PEER_FAILED_VERIFICATION error but
-                        the connection is left intact */
-  CURLKHSTAT_FINE_REPLACE
-};
-
-enum curl_khmatch {
-  CURLKHMATCH_OK,       /* match */
-  CURLKHMATCH_MISMATCH, /* host found, key mismatch! */
-  CURLKHMATCH_MISSING,  /* no matching host/key found */
-};
-
-struct curl_khkey {
-  const char *key; /* points to a null-terminated string encoded with
-                      base64 if len is zero, otherwise to the "raw"
-                      data */
-  size_t len;
-  enum curl_khtype keytype;
-};
-
-int ssh_keycallback(CURL *easy,
-                    const struct curl_khkey *knownkey,
-                    const struct curl_khkey *foundkey,
-                    enum curl_khmatch match,
-                    void *clientp);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_KEYFUNCTION,
-                          ssh_keycallback);
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-It gets called when the known_host matching has been done, to allow the
-application to act and decide for libcurl how to proceed. The callback is only
-called if \fICURLOPT_SSH_KNOWNHOSTS(3)\fP is also set.
-
-This callback function gets passed the CURL handle, the key from the
-known_hosts file \fIknownkey\fP, the key from the remote site \fIfoundkey\fP,
-info from libcurl on the matching status and a custom pointer (set with
-\fICURLOPT_SSH_KEYDATA(3)\fP). It MUST return one of the following return
-codes to tell libcurl how to act:
-.IP CURLKHSTAT_FINE_REPLACE
-The new host+key is accepted and libcurl replaces the old host+key into the
-known_hosts file before continuing with the connection. This also adds the new
-host+key combo to the known_host pool kept in memory if it was not already
-present there. The adding of data to the file is done by completely replacing
-the file with a new copy, so the permissions of the file must allow
-this. (Added in 7.73.0)
-.IP CURLKHSTAT_FINE_ADD_TO_FILE
-The host+key is accepted and libcurl appends it to the known_hosts file before
-continuing with the connection. This also adds the host+key combo to the
-known_host pool kept in memory if it was not already present there. The adding
-of data to the file is done by completely replacing the file with a new copy,
-so the permissions of the file must allow this.
-.IP CURLKHSTAT_FINE
-The host+key is accepted libcurl continues with the connection. This also adds
-the host+key combo to the known_host pool kept in memory if it was not already
-present there.
-.IP CURLKHSTAT_REJECT
-The host+key is rejected. libcurl denies the connection to continue and it is
-closed.
-.IP CURLKHSTAT_DEFER
-The host+key is rejected, but the SSH connection is asked to be kept alive.
-This feature could be used when the app wants to somehow return back and act
-on the host+key situation and then retry without needing the overhead of
-setting it up from scratch again.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-SFTP and SCP
-.SH EXAMPLE
-.nf
-static int keycb(CURL *easy,
-                 const struct curl_khkey *knownkey,
-                 const struct curl_khkey *foundkey,
-                 enum curl_khmatch match,
-                 void *clientp)
-{
-  /* 'clientp' points to the callback_data struct */
-  /* investigate the situation and return the correct value */
-  return CURLKHSTAT_FINE_ADD_TO_FILE;
-}
-{
-  curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/thisfile.txt");
-  curl_easy_setopt(curl, CURLOPT_SSH_KEYFUNCTION, keycb);
-  curl_easy_setopt(curl, CURLOPT_SSH_KEYDATA, &callback_data);
-  curl_easy_setopt(curl, CURLOPT_SSH_KNOWNHOSTS, "/home/user/known_hosts");
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.19.6
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_SSH_KEYDATA "(3), " CURLOPT_SSH_KNOWNHOSTS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KEYFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KEYFUNCTION.md
new file mode 100644
index 0000000000..72bbbb4d92
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KEYFUNCTION.md
@@ -0,0 +1,157 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSH_KEYFUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSH_KEYDATA (3)
+  - CURLOPT_SSH_KNOWNHOSTS (3)
+Protocol:
+  - SFTP
+  - SCP
+Added-in: 7.19.6
+---
+
+# NAME
+
+CURLOPT_SSH_KEYFUNCTION - callback for known host matching logic
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+enum curl_khstat {
+  CURLKHSTAT_FINE_ADD_TO_FILE,
+  CURLKHSTAT_FINE,
+  CURLKHSTAT_REJECT, /* reject the connection, return an error */
+  CURLKHSTAT_DEFER,  /* do not accept it, but we cannot answer right
+                        now. Causes a CURLE_PEER_FAILED_VERIFICATION error but
+                        the connection is left intact */
+  CURLKHSTAT_FINE_REPLACE
+};
+
+enum curl_khmatch {
+  CURLKHMATCH_OK,       /* match */
+  CURLKHMATCH_MISMATCH, /* host found, key mismatch */
+  CURLKHMATCH_MISSING,  /* no matching host/key found */
+};
+
+struct curl_khkey {
+  const char *key; /* points to a null-terminated string encoded with
+                      base64 if len is zero, otherwise to the "raw"
+                      data */
+  size_t len;
+  enum curl_khtype keytype;
+};
+
+int ssh_keycallback(CURL *easy,
+                    const struct curl_khkey *knownkey,
+                    const struct curl_khkey *foundkey,
+                    enum curl_khmatch match,
+                    void *clientp);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_KEYFUNCTION,
+                          ssh_keycallback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+It gets called when the known_host matching has been done, to allow the
+application to act and decide for libcurl how to proceed. The callback is only
+called if CURLOPT_SSH_KNOWNHOSTS(3) is also set.
+
+This callback function gets passed the curl handle, the key from the
+known_hosts file *knownkey*, the key from the remote site *foundkey*, info
+from libcurl on the matching status and a custom pointer (set with
+CURLOPT_SSH_KEYDATA(3)). It must return one of the following return codes to
+tell libcurl how to act:
+
+## CURLKHSTAT_FINE_REPLACE
+
+The new host+key is accepted and libcurl replaces the old host+key into the
+known_hosts file before continuing with the connection. This also adds the new
+host+key combo to the known_host pool kept in memory if it was not already
+present there. The adding of data to the file is done by completely replacing
+the file with a new copy, so the permissions of the file must allow
+this. (Added in 7.73.0)
+
+## CURLKHSTAT_FINE_ADD_TO_FILE
+
+The host+key is accepted and libcurl appends it to the known_hosts file before
+continuing with the connection. This also adds the host+key combo to the
+known_host pool kept in memory if it was not already present there. The adding
+of data to the file is done by completely replacing the file with a new copy,
+so the permissions of the file must allow this.
+
+## CURLKHSTAT_FINE
+
+The host+key is accepted libcurl continues with the connection. This also adds
+the host+key combo to the known_host pool kept in memory if it was not already
+present there.
+
+## CURLKHSTAT_REJECT
+
+The host+key is rejected. libcurl denies the connection to continue and it is
+closed.
+
+## CURLKHSTAT_DEFER
+
+The host+key is rejected, but the SSH connection is asked to be kept alive.
+This feature could be used when the app wants to return and act on the
+host+key situation and then retry without needing the overhead of setting it
+up from scratch again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct mine {
+  void *custom;
+};
+
+static int keycb(CURL *easy,
+                 const struct curl_khkey *knownkey,
+                 const struct curl_khkey *foundkey,
+                 enum curl_khmatch match,
+                 void *clientp)
+{
+  /* 'clientp' points to the callback_data struct */
+  /* investigate the situation and return the correct value */
+  return CURLKHSTAT_FINE_ADD_TO_FILE;
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    struct mine callback_data;
+    curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/thisfile.txt");
+    curl_easy_setopt(curl, CURLOPT_SSH_KEYFUNCTION, keycb);
+    curl_easy_setopt(curl, CURLOPT_SSH_KEYDATA, &callback_data);
+    curl_easy_setopt(curl, CURLOPT_SSH_KNOWNHOSTS, "/home/user/known_hosts");
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KNOWNHOSTS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KNOWNHOSTS.3
deleted file mode 100644
index 6ced1657b4..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KNOWNHOSTS.3
+++ /dev/null
@@ -1,65 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSH_KNOWNHOSTS 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSH_KNOWNHOSTS \- file name holding the SSH known hosts
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_KNOWNHOSTS, char *fname);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string holding the file name of the
-known_host file to use.  The known_hosts file should use the OpenSSH file
-format as supported by libssh2. If this file is specified, libcurl only
-accepts connections with hosts that are known and present in that file, with a
-matching public key. Use \fICURLOPT_SSH_KEYFUNCTION(3)\fP to alter the default
-behavior on host and key matches and mismatches.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-SFTP and SCP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/file");
-  curl_easy_setopt(curl, CURLOPT_SSH_KNOWNHOSTS,
-                   "/home/clarkkent/.ssh/known_hosts");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.19.6
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_SSH_AUTH_TYPES "(3), " CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KNOWNHOSTS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KNOWNHOSTS.md
new file mode 100644
index 0000000000..fc7e607771
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_KNOWNHOSTS.md
@@ -0,0 +1,90 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSH_KNOWNHOSTS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSH_AUTH_TYPES (3)
+  - CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 (3)
+  - CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 (3)
+Protocol:
+  - SFTP
+  - SCP
+Added-in: 7.19.6
+---
+
+# NAME
+
+CURLOPT_SSH_KNOWNHOSTS - filename holding the SSH known hosts
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_KNOWNHOSTS, char *fname);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string holding the filename of the
+known_host file to use. The known_hosts file should use the OpenSSH file
+format. If this file is specified, libcurl only accepts connections with hosts
+that are known and present in that file, with a matching public key. Use
+CURLOPT_SSH_KEYFUNCTION(3) to alter the default behavior on host and key
+matches and mismatches.
+
+We strongly suggest users doing SCP or SFTP transfers to set this option to
+make sure that the network communication is done with the intended server and
+not an impostor.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+This option is only consulted when libcurl establishes a new connection. Once
+a connection has been created and its host key verified against the known
+hosts file, it is deemed vetted and may be reused by libcurl without
+re-running the known hosts check, even if you later change SSH host
+verification options (including setting this option to NULL or using
+CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256(3) or CURLOPT_SSH_HOST_PUBLIC_KEY_MD5(3)).
+Such changes only affect subsequently created connections; existing cached
+connections can continue to be reused with the verification that was in effect
+when they were first established. If you need to force re-verification with
+the new settings, use CURLOPT_FRESH_CONNECT(3) or CURLOPT_FORBID_REUSE(3) to
+avoid reusing the old connection.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/file");
+    curl_easy_setopt(curl, CURLOPT_SSH_KNOWNHOSTS,
+                     "/home/clarkkent/.ssh/known_hosts");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_PRIVATE_KEYFILE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_PRIVATE_KEYFILE.3
deleted file mode 100644
index e23c874419..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_PRIVATE_KEYFILE.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSH_PRIVATE_KEYFILE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSH_PRIVATE_KEYFILE \- private key file for SSH auth
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_PRIVATE_KEYFILE,
-                          char *filename);
-.SH DESCRIPTION
-Pass a char * pointing to a \fIfilename\fP for your private key. If not used,
-libcurl defaults to \fB$HOME/.ssh/id_rsa\fP or \fB$HOME/.ssh/id_dsa\fP if the
-HOME environment variable is set, and just \fB"id_rsa"\fP or \fB"id_dsa"\fP in
-the current directory if HOME is not set.
-
-If the file is password-protected, set the password with
-\fICURLOPT_KEYPASSWD(3)\fP.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-As explained above
-.SH PROTOCOLS
-SFTP and SCP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/file");
-  curl_easy_setopt(curl, CURLOPT_SSH_PRIVATE_KEYFILE,
-                   "/home/clarkkent/.ssh/id_rsa");
-  curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "password");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.16.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_SSH_PUBLIC_KEYFILE "(3), " CURLOPT_SSH_AUTH_TYPES "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_PRIVATE_KEYFILE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_PRIVATE_KEYFILE.md
new file mode 100644
index 0000000000..2a1f79845d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_PRIVATE_KEYFILE.md
@@ -0,0 +1,78 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSH_PRIVATE_KEYFILE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSH_AUTH_TYPES (3)
+  - CURLOPT_SSH_PUBLIC_KEYFILE (3)
+Protocol:
+  - SFTP
+  - SCP
+Added-in: 7.16.1
+---
+
+# NAME
+
+CURLOPT_SSH_PRIVATE_KEYFILE - private key file for SSH auth
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_PRIVATE_KEYFILE,
+                          char *filename);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer pointing to a *filename* for your private key. If not
+used, libcurl defaults to **$HOME/.ssh/id_rsa** or **$HOME/.ssh/id_dsa** if
+the HOME environment variable is set, and in the current directory if HOME is
+not set.
+
+If the file is password-protected, set the password with
+CURLOPT_KEYPASSWD(3).
+
+The SSH library derives the public key from this private key when possible. If
+the SSH library cannot derive the public key from the private one and no
+public one is provided with CURLOPT_SSH_PUBLIC_KEYFILE(3), the transfer
+fails.
+
+The application does not have to keep the string around after setting this
+option.
+
+# DEFAULT
+
+As explained above
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/file");
+    curl_easy_setopt(curl, CURLOPT_SSH_PRIVATE_KEYFILE,
+                     "/home/clarkkent/.ssh/id_rsa");
+    curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "password");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_PUBLIC_KEYFILE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_PUBLIC_KEYFILE.3
deleted file mode 100644
index 516185493c..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_PUBLIC_KEYFILE.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSH_PUBLIC_KEYFILE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSH_PUBLIC_KEYFILE \- public key file for SSH auth
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_PUBLIC_KEYFILE,
-                          char *filename);
-.SH DESCRIPTION
-Pass a char * pointing to a \fIfilename\fP for your public key. If not used,
-libcurl defaults to \fB$HOME/.ssh/id_dsa.pub\fP if the HOME environment
-variable is set, and just "id_dsa.pub" in the current directory if HOME is not
-set.
-
-If NULL (or an empty string) is passed, libcurl passes no public key to
-libssh2, which then computes it from the private key. This is known to work
-with libssh2 1.4.0+ linked against OpenSSL.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-SFTP and SCP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/file");
-  curl_easy_setopt(curl, CURLOPT_SSH_PUBLIC_KEYFILE,
-                   "/home/clarkkent/.ssh/id_rsa.pub");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-The "" trick was added in 7.26.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_SSH_PRIVATE_KEYFILE "(3), " CURLOPT_SSH_AUTH_TYPES "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_PUBLIC_KEYFILE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_PUBLIC_KEYFILE.md
new file mode 100644
index 0000000000..161daf4ecf
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSH_PUBLIC_KEYFILE.md
@@ -0,0 +1,77 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSH_PUBLIC_KEYFILE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSH_AUTH_TYPES (3)
+  - CURLOPT_SSH_PRIVATE_KEYFILE (3)
+Protocol:
+  - SFTP
+  - SCP
+Added-in: 7.16.1
+---
+
+# NAME
+
+CURLOPT_SSH_PUBLIC_KEYFILE - public key file for SSH auth
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_PUBLIC_KEYFILE,
+                          char *filename);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer pointing to a *filename* for your public key. If not used,
+libcurl defaults to **$HOME/.ssh/id_dsa.pub** if the HOME environment variable
+is set, and "id_dsa.pub" in the current directory if HOME is not set.
+
+If NULL (or an empty string) is passed to this option, libcurl passes no
+public key to the SSH library, which then rather derives it from the private
+key. If the SSH library cannot derive the public key from the private one and
+no public one is provided, the transfer fails.
+
+The application does not have to keep the string around after setting this
+option.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/file");
+    curl_easy_setopt(curl, CURLOPT_SSH_PUBLIC_KEYFILE,
+                     "/home/clarkkent/.ssh/id_rsa.pub");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+The "" trick was added in 7.26.0
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERT.3
deleted file mode 100644
index 575037fe37..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERT.3
+++ /dev/null
@@ -1,84 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSLCERT 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSLCERT \- SSL client certificate
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLCERT, char *cert);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter. The string should be
-the file name of your client certificate. The default format is "P12" on
-Secure Transport and "PEM" on other engines, and can be changed with
-\fICURLOPT_SSLCERTTYPE(3)\fP.
-
-With Secure Transport, this can also be the nickname of the certificate you
-wish to authenticate with as it is named in the security database. If you want
-to use a file from the current directory, please precede it with "./" prefix,
-in order to avoid confusion with a nickname.
-
-(Schannel only) Client certificates can be specified by a path expression to a
-certificate store. (You can import \fIPFX\fP to a store first). You can use
-"<store location>\\<store name>\\<thumbprint>" to refer to a certificate in
-the system certificates store, for example,
-\fB"CurrentUser\\MY\\934a7ac6f8a5d579285a74fa"\fP. The thumbprint is usually a
-SHA-1 hex string which you can see in certificate details. Following store
-locations are supported: \fBCurrentUser\fP, \fBLocalMachine\fP,
-\fBCurrentService\fP, \fBServices\fP, \fBCurrentUserGroupPolicy\fP,
-\fBLocalMachineGroupPolicy\fP, \fBLocalMachineEnterprise\fP.  Schannel also
-support P12 certificate file, with the string "P12" specified with
-\fICURLOPT_SSLCERTTYPE(3)\fP.
-
-When using a client certificate, you most likely also need to provide a
-private key with \fICURLOPT_SSLKEY(3)\fP.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_SSLCERT, "client.pem");
-  curl_easy_setopt(curl, CURLOPT_SSLKEY, "key.pem");
-  curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "s3cret");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-If built TLS enabled.
-.SH RETURN VALUE
-Returns CURLE_OK if TLS enabled, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_SSLCERTTYPE "(3), " CURLOPT_SSLKEY "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERT.md
new file mode 100644
index 0000000000..d3669e90a4
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERT.md
@@ -0,0 +1,87 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSLCERT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_KEYPASSWD (3)
+  - CURLOPT_SSLCERTTYPE (3)
+  - CURLOPT_SSLKEY (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_SSLCERT - SSL client certificate
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLCERT, char *cert);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter. The string should be
+the filename of your client certificate. The default format is `PEM` but can
+be changed with CURLOPT_SSLCERTTYPE(3).
+
+(Schannel) Client certificates can be specified by a path expression to a
+certificate store. (You can import *PFX* to a store first). You can use
+"\<store location\>\\\<store name\>\\\<thumbprint\>" to refer to a certificate
+in the system certificates store, for example,
+**"CurrentUser\\MY\\934a7ac6f8a5d5"**. The thumbprint is usually a SHA-1 hex
+string which you can see in certificate details. Following store locations are
+supported: **CurrentUser**, **LocalMachine**, **CurrentService**,
+**Services**, **CurrentUserGroupPolicy**, **LocalMachineGroupPolicy**,
+**LocalMachineEnterprise**. Schannel also support P12 certificate file, with
+the string `P12` specified with CURLOPT_SSLCERTTYPE(3).
+
+When using a client certificate, you most likely also need to provide a
+private key with CURLOPT_SSLKEY(3).
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_SSLCERT, "client.pem");
+    curl_easy_setopt(curl, CURLOPT_SSLKEY, "key.pem");
+    curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "s3cret");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERTTYPE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERTTYPE.3
deleted file mode 100644
index 52d442c8ef..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERTTYPE.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSLCERTTYPE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSLCERTTYPE \- type of client SSL certificate
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLCERTTYPE, char *type);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter. The string should be
-the format of your certificate.
-
-Supported formats are "PEM" and "DER", except with Secure Transport or
-Schannel. OpenSSL (versions 0.9.3 and later), Secure Transport (on iOS 5 or
-later, or OS X 10.7 or later) and Schannel support "P12" for PKCS#12-encoded
-files.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-"PEM"
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_SSLCERT, "client.pem");
-  curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM");
-  curl_easy_setopt(curl, CURLOPT_SSLKEY, "key.pem");
-  curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "s3cret");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-If built TLS enabled. Added in 7.9.3
-.SH RETURN VALUE
-Returns CURLE_OK if TLS is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_SSLCERT "(3), " CURLOPT_SSLKEY "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERTTYPE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERTTYPE.md
new file mode 100644
index 0000000000..8497016083
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERTTYPE.md
@@ -0,0 +1,80 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSLCERTTYPE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSLCERT (3)
+  - CURLOPT_SSLKEY (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+  - mbedTLS
+  - Schannel
+  - wolfSSL
+Added-in: 7.9.3
+---
+
+# NAME
+
+CURLOPT_SSLCERTTYPE - type of client SSL certificate
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLCERTTYPE, char *type);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter. The string should be
+the format of your certificate.
+
+Supported formats are "PEM" and "DER", except with Schannel. OpenSSL and
+Schannel support "P12" for PKCS#12-encoded files. GnuTLS supports P12 starting
+with curl 8.11.0.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL restores back to internal default.
+
+# DEFAULT
+
+"PEM"
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_SSLCERT, "client.pem");
+    curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM");
+    curl_easy_setopt(curl, CURLOPT_SSLKEY, "key.pem");
+    curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "s3cret");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERT_BLOB.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERT_BLOB.3
deleted file mode 100644
index d9d47304b4..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERT_BLOB.3
+++ /dev/null
@@ -1,75 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSLCERT_BLOB 3 "24 Jun 2020" libcurl libcurl
-.SH NAME
-CURLOPT_SSLCERT_BLOB \- SSL client certificate from memory blob
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLCERT_BLOB,
-                          struct curl_blob *stblob);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a curl_blob structure, which contains (pointer and size) a
-client certificate. The format must be "P12" on Secure Transport or
-Schannel. The format must be "P12" or "PEM" on OpenSSL. The format must be
-"DER" or "PEM" on mbedTLS. The format must be specified with
-\fICURLOPT_SSLCERTTYPE(3)\fP.
-
-If the blob is initialized with the flags member of struct curl_blob set to
-CURL_BLOB_COPY, the application does not have to keep the buffer around after
-setting this.
-
-This option is an alternative to \fICURLOPT_SSLCERT(3)\fP which instead
-expects a file name as input.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  struct curl_blob stblob;
-  stblob.data = certificateData;
-  stblob.len = filesize;
-  stblob.flags = CURL_BLOB_COPY;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_SSLCERT_BLOB, &stblob);
-  curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "P12");
-  curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "s3cret");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.71.0. This option is supported by the OpenSSL, Secure Transport,
-Schannel and mbedTLS (since 7.78.0) backends.
-.SH RETURN VALUE
-Returns CURLE_OK if TLS enabled, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_SSLCERTTYPE "(3), " CURLOPT_SSLKEY "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERT_BLOB.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERT_BLOB.md
new file mode 100644
index 0000000000..aa69fbbc89
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLCERT_BLOB.md
@@ -0,0 +1,87 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSLCERT_BLOB
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_KEYPASSWD (3)
+  - CURLOPT_SSLCERTTYPE (3)
+  - CURLOPT_SSLKEY (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - Schannel
+  - mbedTLS
+  - wolfSSL
+Added-in: 7.71.0
+---
+
+# NAME
+
+CURLOPT_SSLCERT_BLOB - SSL client certificate from memory blob
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLCERT_BLOB,
+                          struct curl_blob *stblob);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a curl_blob structure, which contains (pointer and size) a
+client certificate. The format must be "P12" on Schannel. The format must be
+"P12" or "PEM" on OpenSSL. The format must be "DER" or "PEM" on mbedTLS. The
+format must be specified with CURLOPT_SSLCERTTYPE(3).
+
+If the blob is initialized with the flags member of struct curl_blob set to
+CURL_BLOB_COPY, the application does not have to keep the buffer around after
+setting this.
+
+This option is an alternative to CURLOPT_SSLCERT(3) which instead
+expects a filename as input.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+
+extern char *certificateData; /* point to data */
+extern size_t filesize; /* size of data */
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    struct curl_blob stblob;
+    stblob.data = certificateData;
+    stblob.len = filesize;
+    stblob.flags = CURL_BLOB_COPY;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_SSLCERT_BLOB, &stblob);
+    curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "P12");
+    curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "s3cret");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLENGINE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLENGINE.3
deleted file mode 100644
index 868cc789af..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLENGINE.3
+++ /dev/null
@@ -1,70 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSLENGINE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSLENGINE \- SSL engine identifier
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLENGINE, char *id);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter. It is used as the
-identifier for the crypto engine you want to use for your private key.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_SSLENGINE, "dynamic");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Only if the SSL backend is OpenSSL built with engine support.
-.SH RETURN VALUE
-CURLE_OK - Engine found.
-
-CURLE_SSL_ENGINE_NOTFOUND - Engine not found, or OpenSSL was not built with
-engine support.
-
-CURLE_SSL_ENGINE_INITFAILED - Engine found but initialization failed.
-
-CURLE_NOT_BUILT_IN - Option not built in, OpenSSL is not the SSL backend.
-
-CURLE_UNKNOWN_OPTION - Option not recognized.
-
-CURLE_OUT_OF_MEMORY - Insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_SSLENGINE_DEFAULT "(3), " CURLOPT_SSLKEY "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLENGINE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLENGINE.md
new file mode 100644
index 0000000000..85aa7753ec
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLENGINE.md
@@ -0,0 +1,83 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSLENGINE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_SSL_ENGINES (3)
+  - CURLOPT_SSLENGINE_DEFAULT (3)
+  - CURLOPT_SSLKEY (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+Added-in: 7.9.3
+---
+
+# NAME
+
+CURLOPT_SSLENGINE - Set SSL engine or provider
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLENGINE, char *id);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter. It is used as the
+identifier for the *engine* or *provider* you want to use for your private
+key. OpenSSL 1 had engines, OpenSSL 3 has providers.
+
+The application does not have to keep the string around after setting this
+option.
+
+When asking libcurl to use a provider, the application can also optionally
+provide a *property*, a set of name value pairs. Such a property can be
+specified separated from the name with a colon (`:`).
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_SSLENGINE, "dynamic");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+CURLE_OK - Engine found.
+
+CURLE_SSL_ENGINE_NOTFOUND - Engine not found, or OpenSSL was not built with
+engine support.
+
+CURLE_SSL_ENGINE_INITFAILED - Engine found but initialization failed.
+
+CURLE_NOT_BUILT_IN - Option not built in, OpenSSL is not the SSL backend.
+
+CURLE_UNKNOWN_OPTION - Option not recognized.
+
+CURLE_OUT_OF_MEMORY - Insufficient heap space.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLENGINE_DEFAULT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLENGINE_DEFAULT.3
deleted file mode 100644
index 5e53f6a995..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLENGINE_DEFAULT.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSLENGINE_DEFAULT 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSLENGINE_DEFAULT \- make SSL engine default
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLENGINE_DEFAULT, long val);
-.fi
-.SH DESCRIPTION
-Pass a long set to 1 to make the already specified crypto engine the default
-for (asymmetric) crypto operations.
-
-This option has no effect unless set after \fICURLOPT_SSLENGINE(3)\fP.
-.SH DEFAULT
-None
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_SSLENGINE, "dynamic");
-  curl_easy_setopt(curl, CURLOPT_SSLENGINE_DEFAULT, 1L);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Only if the SSL backend is OpenSSL built with engine support.
-.SH RETURN VALUE
-CURLE_OK - Engine set as default.
-
-CURLE_SSL_ENGINE_SETFAILED - Engine could not be set as default.
-
-CURLE_NOT_BUILT_IN - Option not built in, OpenSSL is not the SSL backend.
-
-CURLE_UNKNOWN_OPTION - Option not recognized.
-
-CURLE_OUT_OF_MEMORY - Insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_SSLENGINE "(3), " CURLOPT_SSLCERT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLENGINE_DEFAULT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLENGINE_DEFAULT.md
new file mode 100644
index 0000000000..87aab0c2bb
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLENGINE_DEFAULT.md
@@ -0,0 +1,71 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSLENGINE_DEFAULT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSLCERT (3)
+  - CURLOPT_SSLENGINE (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+Added-in: 7.9.3
+---
+
+# NAME
+
+CURLOPT_SSLENGINE_DEFAULT - make SSL engine default
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLENGINE_DEFAULT, long val);
+~~~
+
+# DESCRIPTION
+
+Pass a long set to 1 to make the already specified crypto engine the default
+for (asymmetric) crypto operations.
+
+This option has no effect unless set after CURLOPT_SSLENGINE(3).
+
+# DEFAULT
+
+None
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_SSLENGINE, "dynamic");
+    curl_easy_setopt(curl, CURLOPT_SSLENGINE_DEFAULT, 1L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+CURLE_OK - Engine set as default.
+
+CURLE_SSL_ENGINE_SETFAILED - Engine could not be set as default.
+
+CURLE_NOT_BUILT_IN - Option not built in, OpenSSL is not the SSL backend.
+
+CURLE_UNKNOWN_OPTION - Option not recognized.
+
+CURLE_OUT_OF_MEMORY - Insufficient heap space.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEY.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEY.3
deleted file mode 100644
index 7df27bb4fb..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEY.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSLKEY 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSLKEY \- private key file for TLS and SSL client cert
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLKEY, char *keyfile);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter. The string should be
-the file name of your private key. The default format is "PEM" and can be
-changed with \fICURLOPT_SSLKEYTYPE(3)\fP.
-
-(Windows, iOS and Mac OS X) This option is ignored by Secure Transport and
-Schannel SSL backends because they expect the private key to be already present
-in the key-chain or PKCS#12 file containing the certificate.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_SSLCERT, "client.pem");
-  curl_easy_setopt(curl, CURLOPT_SSLKEY, "key.pem");
-  curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "s3cret");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-If built TLS enabled.
-.SH RETURN VALUE
-Returns CURLE_OK if TLS is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_SSLKEYTYPE "(3), " CURLOPT_SSLCERT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEY.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEY.md
new file mode 100644
index 0000000000..f590e16e9e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEY.md
@@ -0,0 +1,81 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSLKEY
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSLCERT (3)
+  - CURLOPT_SSLKEYTYPE (3)
+  - CURLOPT_SSLKEY_BLOB (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - mbedTLS
+  - Schannel
+  - wolfSSL
+  - Rustls
+Added-in: 7.9.3
+---
+
+# NAME
+
+CURLOPT_SSLKEY - private key file for TLS and SSL client cert
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLKEY, char *keyfile);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter. The string should be
+the filename of your private key. The default format is "PEM" and can be
+changed with CURLOPT_SSLKEYTYPE(3).
+
+(Windows) This option is ignored by the Schannel SSL backend because it
+expects the private key to be already present in the key-chain or PKCS#12 file
+containing the certificate.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_SSLCERT, "client.pem");
+    curl_easy_setopt(curl, CURLOPT_SSLKEY, "key.pem");
+    curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "s3cret");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEYTYPE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEYTYPE.3
deleted file mode 100644
index 78d1744476..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEYTYPE.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSLKEYTYPE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSLKEYTYPE \- type of the private key file
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLKEYTYPE, char *type);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter. The string should be
-the format of your private key. Supported formats are "PEM", "DER" and "ENG".
-
-The format "ENG" enables you to load the private key from a crypto engine. In
-this case \fICURLOPT_SSLKEY(3)\fP is used as an identifier passed to the
-engine. You have to set the crypto engine with \fICURLOPT_SSLENGINE(3)\fP.
-\&"DER" format key file currently does not work because of a bug in OpenSSL.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-"PEM"
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_SSLCERT, "client.pem");
-  curl_easy_setopt(curl, CURLOPT_SSLKEY, "key.pem");
-  curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, "PEM");
-  curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "s3cret");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-If built TLS enabled.
-.SH RETURN VALUE
-Returns CURLE_OK if TLS is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_SSLKEY "(3), " CURLOPT_SSLCERT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEYTYPE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEYTYPE.md
new file mode 100644
index 0000000000..aef7fd5f8d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEYTYPE.md
@@ -0,0 +1,85 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSLKEYTYPE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_SSLKEYTYPE (3)
+  - CURLOPT_SSLCERT (3)
+  - CURLOPT_SSLKEY (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - wolfSSL
+Added-in: 7.9.3
+---
+
+# NAME
+
+CURLOPT_SSLKEYTYPE - type of the private key file
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLKEYTYPE, char *type);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter. The string should be
+the format of your private key. Supported formats are "PEM", "DER", "ENG" and
+"PROV".
+
+The format "ENG" enables you to load the private key from a crypto engine. In
+this case CURLOPT_SSLKEY(3) is used as an identifier passed to the engine. You
+have to set the crypto engine with CURLOPT_SSLENGINE(3).
+
+The format "PROV" enables you to load the private key from a crypto provider
+(Added in 8.12.0). In this case CURLOPT_SSLKEY(3) is used as an identifier
+passed to the provider.
+
+The "DER" format does not work with OpenSSL.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to restore to internal default.
+
+# DEFAULT
+
+"PEM"
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_SSLCERT, "client.pem");
+    curl_easy_setopt(curl, CURLOPT_SSLKEY, "key.pem");
+    curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, "PEM");
+    curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "s3cret");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEY_BLOB.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEY_BLOB.3
deleted file mode 100644
index 27cd9b95f9..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEY_BLOB.3
+++ /dev/null
@@ -1,77 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSLKEY_BLOB 3 "24 Jun 2020" libcurl libcurl
-.SH NAME
-CURLOPT_SSLKEY_BLOB \- private key for client cert from memory blob
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLKEY_BLOB,
-                          struct curl_blob *blob);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a curl_blob structure, which contains information (pointer
-and size) for a private key. Compatible with OpenSSL. The format (like "PEM")
-must be specified with \fICURLOPT_SSLKEYTYPE(3)\fP.
-
-If the blob is initialized with the flags member of struct curl_blob set to
-CURL_BLOB_COPY, the application does not have to keep the buffer around after
-setting this.
-
-This option is an alternative to \fICURLOPT_SSLKEY(3)\fP which instead expects
-a file name as input.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  struct curl_blob blob;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  blob.data = certificateData;
-  blob.len = filesize;
-  blob.flags = CURL_BLOB_COPY;
-  curl_easy_setopt(curl, CURLOPT_SSLCERT_BLOB, &blob);
-  curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM");
-
-  blob.data = privateKeyData;
-  blob.len = privateKeySize;
-  curl_easy_setopt(curl, CURLOPT_SSLKEY_BLOB, &blob);
-  curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "s3cret");
-  curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, "PEM");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.71.0. This option is supported by the OpenSSL backends.
-.SH RETURN VALUE
-Returns CURLE_OK if TLS enabled, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_SSLKEYTYPE "(3), " CURLOPT_SSLKEY "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEY_BLOB.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEY_BLOB.md
new file mode 100644
index 0000000000..a062d39deb
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLKEY_BLOB.md
@@ -0,0 +1,91 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSLKEY_BLOB
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSLKEY (3)
+  - CURLOPT_SSLKEYTYPE (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - wolfSSL
+Added-in: 7.71.0
+---
+
+# NAME
+
+CURLOPT_SSLKEY_BLOB - private key for client cert from memory blob
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLKEY_BLOB,
+                          struct curl_blob *blob);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a curl_blob structure, which contains information (pointer
+and size) for a private key. Compatible with OpenSSL. The format (like "PEM")
+must be specified with CURLOPT_SSLKEYTYPE(3).
+
+If the blob is initialized with the flags member of struct curl_blob set to
+CURL_BLOB_COPY, the application does not have to keep the buffer around after
+setting this.
+
+This option is an alternative to CURLOPT_SSLKEY(3) which instead expects a
+filename as input.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+
+extern char *certificateData; /* point to cert */
+extern size_t filesize; /* size of cert */
+
+extern char *privateKeyData; /* point to key */
+extern size_t privateKeySize; /* size of key */
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    struct curl_blob blob;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    blob.data = certificateData;
+    blob.len = filesize;
+    blob.flags = CURL_BLOB_COPY;
+    curl_easy_setopt(curl, CURLOPT_SSLCERT_BLOB, &blob);
+    curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM");
+
+    blob.data = privateKeyData;
+    blob.len = privateKeySize;
+    curl_easy_setopt(curl, CURLOPT_SSLKEY_BLOB, &blob);
+    curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "s3cret");
+    curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, "PEM");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLVERSION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLVERSION.3
deleted file mode 100644
index 3424e629d1..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLVERSION.3
+++ /dev/null
@@ -1,119 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSLVERSION 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSLVERSION \- preferred TLS/SSL version
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLVERSION, long version);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter to control which version range of SSL/TLS versions to
-use.
-
-The SSL and TLS versions have typically developed from the most insecure
-version to be more and more secure in this order through history: SSL v2,
-SSLv3, TLS v1.0, TLS v1.1, TLS v1.2 and the most recent TLS v1.3.
-
-Use one of the available defines for this purpose. The available options are:
-.RS
-.IP CURL_SSLVERSION_DEFAULT
-The default acceptable version range. The minimum acceptable version is by
-default TLS v1.0 since 7.39.0 (unless the TLS library has a stricter rule).
-.IP CURL_SSLVERSION_TLSv1
-TLS v1.0 or later
-.IP CURL_SSLVERSION_SSLv2
-SSL v2 - refused
-.IP CURL_SSLVERSION_SSLv3
-SSL v3 - refused
-.IP CURL_SSLVERSION_TLSv1_0
-TLS v1.0 or later (Added in 7.34.0)
-.IP CURL_SSLVERSION_TLSv1_1
-TLS v1.1 or later (Added in 7.34.0)
-.IP CURL_SSLVERSION_TLSv1_2
-TLS v1.2 or later (Added in 7.34.0)
-.IP CURL_SSLVERSION_TLSv1_3
-TLS v1.3 or later (Added in 7.52.0)
-.RE
-
-The maximum TLS version can be set by using \fIone\fP of the
-CURL_SSLVERSION_MAX_ macros below. It is also possible to OR \fIone\fP of the
-CURL_SSLVERSION_ macros with \fIone\fP of the CURL_SSLVERSION_MAX_ macros.
-The MAX macros are not supported for WolfSSL.
-.RS
-.IP CURL_SSLVERSION_MAX_DEFAULT
-The flag defines the maximum supported TLS version by libcurl, or the default
-value from the SSL library is used. libcurl uses a sensible default maximum,
-which was TLS v1.2 up to before 7.61.0 and is TLS v1.3 since then - assuming
-the TLS library support it. (Added in 7.54.0)
-.IP CURL_SSLVERSION_MAX_TLSv1_0
-The flag defines maximum supported TLS version as TLS v1.0.
-(Added in 7.54.0)
-.IP CURL_SSLVERSION_MAX_TLSv1_1
-The flag defines maximum supported TLS version as TLS v1.1.
-(Added in 7.54.0)
-.IP CURL_SSLVERSION_MAX_TLSv1_2
-The flag defines maximum supported TLS version as TLS v1.2.
-(Added in 7.54.0)
-.IP CURL_SSLVERSION_MAX_TLSv1_3
-The flag defines maximum supported TLS version as TLS v1.3.
-(Added in 7.54.0)
-.RE
-
-In versions of curl prior to 7.54 the CURL_SSLVERSION_TLS options were
-documented to allow \fIonly\fP the specified TLS version, but behavior was
-inconsistent depending on the TLS library.
-
-.SH DEFAULT
-CURL_SSLVERSION_DEFAULT
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* ask libcurl to use TLS version 1.0 or later */
-  curl_easy_setopt(curl, CURLOPT_SSLVERSION, (long)CURL_SSLVERSION_TLSv1);
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-SSLv2 and SSLv3 are refused completely since curl 7.77.0
-
-SSLv2 is disabled by default since 7.18.1. Other SSL versions availability may
-vary depending on which backend libcurl has been built to use.
-
-SSLv3 is disabled by default since 7.39.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_USE_SSL "(3), " CURLOPT_HTTP_VERSION "(3), "
-.BR CURLOPT_PROXY_SSLVERSION "(3), " CURLOPT_IPRESOLVE "(3) "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSLVERSION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLVERSION.md
new file mode 100644
index 0000000000..cbe7a89c30
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSLVERSION.md
@@ -0,0 +1,155 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSLVERSION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HTTP_VERSION (3)
+  - CURLOPT_IPRESOLVE (3)
+  - CURLOPT_PROXY_SSLVERSION (3)
+  - CURLOPT_USE_SSL (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_SSLVERSION - preferred TLS/SSL version
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLVERSION, long version);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter to control which version range of SSL/TLS versions to
+use.
+
+The SSL and TLS versions have typically developed from the most insecure
+version to be more and more secure in this order through history: SSLv2,
+SSLv3, TLSv1.0, TLSv1.1, TLSv1.2 and the most recent TLSv1.3.
+
+Use one of the available defines for this purpose. The available options are:
+
+## CURL_SSLVERSION_DEFAULT
+
+The default acceptable version range. The minimum acceptable version is by
+default TLSv1.2 since 8.16.0 (unless the TLS library has a stricter rule).
+
+## CURL_SSLVERSION_TLSv1
+
+TLSv1.0 or later
+
+## CURL_SSLVERSION_SSLv2
+
+SSLv2 - refused
+
+## CURL_SSLVERSION_SSLv3
+
+SSLv3 - refused
+
+## CURL_SSLVERSION_TLSv1_0
+
+TLSv1.0 or later
+
+## CURL_SSLVERSION_TLSv1_1
+
+TLSv1.1 or later
+
+## CURL_SSLVERSION_TLSv1_2
+
+TLSv1.2 or later
+
+## CURL_SSLVERSION_TLSv1_3
+
+TLSv1.3 or later
+
+##
+
+The maximum TLS version can be set by using *one* of the CURL_SSLVERSION_MAX_
+macros below. It is also possible to OR *one* of the CURL_SSLVERSION_ macros
+with *one* of the CURL_SSLVERSION_MAX_ macros.
+
+## CURL_SSLVERSION_MAX_DEFAULT
+
+The flag defines the maximum supported TLS version by libcurl, or the default
+value from the SSL library is used. libcurl uses a sensible default maximum,
+which was TLSv1.2 up to before 7.61.0 and is TLSv1.3 since then - assuming
+the TLS library support it.
+
+## CURL_SSLVERSION_MAX_TLSv1_0
+
+The flag defines maximum supported TLS version as TLSv1.0.
+
+## CURL_SSLVERSION_MAX_TLSv1_1
+
+The flag defines maximum supported TLS version as TLSv1.1.
+
+## CURL_SSLVERSION_MAX_TLSv1_2
+
+The flag defines maximum supported TLS version as TLSv1.2.
+
+## CURL_SSLVERSION_MAX_TLSv1_3
+
+The flag defines maximum supported TLS version as TLSv1.3.
+
+# DEFAULT
+
+CURL_SSLVERSION_DEFAULT
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* ask libcurl to use TLS version 1.0 or later */
+    curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+SSLv2 is disabled by default since 7.18.1. Other SSL versions availability may
+vary depending on which backend libcurl has been built to use.
+
+SSLv3 is disabled by default since 7.39.0.
+
+SSLv2 and SSLv3 are refused completely since curl 7.77.0
+
+Since 8.10.0 wolfSSL is fully supported. Before 8.10.0 the MAX macros were not
+supported with wolfSSL and the other macros did not set a minimum, but
+restricted the TLS version to only the specified one.
+
+Rustls support added in 8.10.0.
+
+**CURL_SSLVERSION_*** macros became `long` types in 8.16.0, prior to this
+version a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CIPHER_LIST.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CIPHER_LIST.3
deleted file mode 100644
index 2e4f77bc1f..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CIPHER_LIST.3
+++ /dev/null
@@ -1,88 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSL_CIPHER_LIST 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSL_CIPHER_LIST \- ciphers to use for TLS
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_CIPHER_LIST, char *list);
-.fi
-.SH DESCRIPTION
-Pass a char *, pointing to a null-terminated string holding the list of
-ciphers to use for the SSL connection. The list must be syntactically correct,
-it consists of one or more cipher strings separated by colons. Commas or
-spaces are also acceptable separators but colons are normally used, \&!, \&-
-and \&+ can be used as operators.
-
-For OpenSSL and GnuTLS valid examples of cipher lists include \fBRC4-SHA\fP,
-\fBSHA1+DES\fP, \fBTLSv1\fP and \fBDEFAULT\fP. The default list is normally
-set when you compile OpenSSL.
-
-For WolfSSL, valid examples of cipher lists include \fBECDHE-RSA-RC4-SHA\fP,
-\fBAES256-SHA:AES256-SHA256\fP, etc.
-
-For BearSSL, valid examples of cipher lists include
-\fBECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256\fP, or when using IANA names
-\fBTLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\fP,
-etc.
-With BearSSL you do not add/remove ciphers. If one uses this option then all
-known ciphers are disabled and only those passed in are enabled.
-
-For Schannel, you can use this option to set algorithms but not specific cipher
-suites. Refer to the ciphers lists document for algorithms.
-
-Find more details about cipher lists on this URL:
-
- https://curl.se/docs/ssl-ciphers.html
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL, use internal default
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_SSL_CIPHER_LIST, "TLSv1");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.9, in 7.83.0 for BearSSL
-
-If built TLS enabled.
-.SH RETURN VALUE
-Returns CURLE_OK if TLS is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_TLS13_CIPHERS "(3), " CURLOPT_SSLVERSION "(3), "
-.BR CURLOPT_PROXY_SSL_CIPHER_LIST "(3), " CURLOPT_PROXY_TLS13_CIPHERS "(3), "
-.BR CURLOPT_USE_SSL "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CIPHER_LIST.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CIPHER_LIST.md
new file mode 100644
index 0000000000..1bbbf6e8c5
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CIPHER_LIST.md
@@ -0,0 +1,111 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSL_CIPHER_LIST
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_SSL_CIPHER_LIST (3)
+  - CURLOPT_PROXY_TLS13_CIPHERS (3)
+  - CURLOPT_SSLVERSION (3)
+  - CURLOPT_TLS13_CIPHERS (3)
+  - CURLOPT_USE_SSL (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - Schannel
+  - wolfSSL
+  - mbedTLS
+  - Rustls
+  - GnuTLS
+Added-in: 7.9
+---
+
+# NAME
+
+CURLOPT_SSL_CIPHER_LIST - ciphers to use for TLS
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_CIPHER_LIST, char *list);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer, pointing to a null-terminated string holding the list of
+cipher suites to use for the TLS 1.2 (1.1, 1.0) connection. The list must
+be syntactically correct, it consists of one or more cipher suite strings
+separated by colons.
+
+For setting TLS 1.3 ciphers see CURLOPT_TLS13_CIPHERS(3).
+
+A valid example of a cipher list with OpenSSL is:
+~~~
+"ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:"
+"ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305"
+~~~
+
+For Schannel, you can use this option to set algorithms but not specific
+cipher suites. Refer to the ciphers lists document for algorithms.
+
+GnuTLS has the concept of a
+[priority string](https://gnutls.org/manual/html_node/Priority-Strings.html)
+which has its own syntax and keywords. The string set via
+CURLOPT_SSL_CIPHER_LIST(3) directly influences the priority setting.
+
+Find more details about cipher lists on this URL:
+
+ https://curl.se/docs/ssl-ciphers.html
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL, use built-in list
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_SSL_CIPHER_LIST,
+                     "ECDHE-ECDSA-CHACHA20-POLY1305:"
+                     "ECDHE-RSA-CHACHA20-POLY1305");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+OpenSSL support added in 7.9.
+wolfSSL support added in 7.53.0.
+Schannel support added in 7.61.0.
+mbedTLS support added in 8.8.0.
+Rustls support added in 8.10.0.
+
+Since curl 8.10.0 returns CURLE_NOT_BUILT_IN when not supported.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CTX_DATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CTX_DATA.3
deleted file mode 100644
index 5c3a9e0a6f..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CTX_DATA.3
+++ /dev/null
@@ -1,125 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSL_CTX_DATA 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSL_CTX_DATA \- pointer passed to SSL context callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_CTX_DATA, void *pointer);
-.fi
-.SH DESCRIPTION
-Data \fIpointer\fP to pass to the ssl context callback set by the option
-\fICURLOPT_SSL_CTX_FUNCTION(3)\fP, this is the pointer you get as third
-parameter.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-/* OpenSSL specific */
-
-#include <openssl/ssl.h>
-#include <curl/curl.h>
-#include <stdio.h>
-
-static CURLcode sslctx_function(CURL *curl, void *sslctx, void *parm)
-{
-  X509_STORE *store;
-  X509 *cert = NULL;
-  BIO *bio;
-  char *mypem = parm;
-  /* get a BIO */
-  bio = BIO_new_mem_buf(mypem, -1);
-  /* use it to read the PEM formatted certificate from memory into an
-   * X509 structure that SSL can use
-   */
-  PEM_read_bio_X509(bio, &cert, 0, NULL);
-  if(cert == NULL)
-    printf("PEM_read_bio_X509 failed...\\n");
-
-  /* get a pointer to the X509 certificate store (which may be empty) */
-  store = SSL_CTX_get_cert_store((SSL_CTX *)sslctx);
-
-  /* add our certificate to this store */
-  if(X509_STORE_add_cert(store, cert) == 0)
-    printf("error adding certificate\\n");
-
-  /* decrease reference counts */
-  X509_free(cert);
-  BIO_free(bio);
-
-  /* all set to go */
-  return CURLE_OK;
-}
-
-int main(void)
-{
-  CURL * ch;
-  CURLcode rv;
-  char *mypem = /* example CA cert PEM - shortened */
-    "-----BEGIN CERTIFICATE-----\\n"
-    "MIIHPTCCBSWgAwIBAgIBADANBgkqhkiG9w0BAQQFADB5MRAwDgYDVQQKEwdSb290\\n"
-    "IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNB\\n"
-    "IENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRA\\n"
-    "Y2FjZXJ0Lm9yZzAeFw0wMzAzMzAxMjI5NDlaFw0zMzAzMjkxMjI5NDlaMHkxEDAO\\n"
-    "GCSNe9FINSkYQKyTYOGWhlC0elnYjyELn8+CkcY7v2vcB5G5l1YjqrZslMZIBjzk\\n"
-    "zk6q5PYvCdxTby78dOs6Y5nCpqyJvKeyRKANihDjbPIky/qbn3BHLt4Ui9SyIAmW\\n"
-    "omTxJBzcoTWcFbLUvFUufQb1nA5V9FrWk9p2rSVzTMVD\\n"
-    "-----END CERTIFICATE-----\\n";
-
-  curl_global_init(CURL_GLOBAL_ALL);
-  ch = curl_easy_init();
-
-  curl_easy_setopt(ch, CURLOPT_SSLCERTTYPE, "PEM");
-  curl_easy_setopt(ch, CURLOPT_SSL_VERIFYPEER, 1L);
-  curl_easy_setopt(ch, CURLOPT_URL, "https://www.example.com/");
-
-  curl_easy_setopt(ch, CURLOPT_SSL_CTX_FUNCTION, *sslctx_function);
-  curl_easy_setopt(ch, CURLOPT_SSL_CTX_DATA, mypem);
-  rv = curl_easy_perform(ch);
-  if(!rv)
-    printf("*** transfer succeeded ***\\n");
-  else
-    printf("*** transfer failed ***\\n");
-
-  curl_easy_cleanup(ch);
-  curl_global_cleanup();
-  return rv;
-}
-.fi
-.SH AVAILABILITY
-Added in 7.11.0 for OpenSSL, in 7.42.0 for wolfSSL, in 7.54.0 for mbedTLS,
-in 7.83.0 in BearSSL. Other SSL backends are not supported.
-.SH RETURN VALUE
-CURLE_OK if supported; or an error such as:
-
-CURLE_NOT_BUILT_IN - Not supported by the SSL backend
-
-CURLE_UNKNOWN_OPTION
-.SH "SEE ALSO"
-.BR CURLOPT_SSL_CTX_FUNCTION "(3), " CURLOPT_SSLVERSION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CTX_DATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CTX_DATA.md
new file mode 100644
index 0000000000..73a16ae412
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CTX_DATA.md
@@ -0,0 +1,130 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSL_CTX_DATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSLVERSION (3)
+  - CURLOPT_SSL_CTX_FUNCTION (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - wolfSSL
+  - mbedTLS
+Added-in: 7.10.6
+---
+
+# NAME
+
+CURLOPT_SSL_CTX_DATA - pointer passed to SSL context callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_CTX_DATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+Data *pointer* to pass to the SSL context callback set by the option
+CURLOPT_SSL_CTX_FUNCTION(3), this is the pointer you get as third
+parameter.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+/* OpenSSL specific */
+
+#include <openssl/ssl.h>
+#include <curl/curl.h>
+#include <stdio.h>
+
+static CURLcode sslctx_function(CURL *curl, void *sslctx, void *pointer)
+{
+  X509_STORE *store;
+  X509 *cert = NULL;
+  BIO *bio;
+  char *mypem = pointer;
+  /* get a BIO */
+  bio = BIO_new_mem_buf(mypem, -1);
+  /* use it to read the PEM formatted certificate from memory into an
+   * X509 structure that SSL can use
+   */
+  PEM_read_bio_X509(bio, &cert, 0, NULL);
+  if(!cert)
+    printf("PEM_read_bio_X509 failed...\n");
+
+  /* get a pointer to the X509 certificate store (which may be empty) */
+  store = SSL_CTX_get_cert_store((SSL_CTX *)sslctx);
+
+  /* add our certificate to this store */
+  if(X509_STORE_add_cert(store, cert) == 0)
+    printf("error adding certificate\n");
+
+  /* decrease reference counts */
+  X509_free(cert);
+  BIO_free(bio);
+
+  /* all set to go */
+  return CURLE_OK;
+}
+
+int main(void)
+{
+  CURL *curl;
+  CURLcode result;
+  /* CA cert in PEM format, replace the XXXs */
+  char *mypem =
+    "-----BEGIN CERTIFICATE-----\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "-----END CERTIFICATE-----\n";
+
+  curl_global_init(CURL_GLOBAL_ALL);
+  curl = curl_easy_init();
+
+  curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM");
+  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
+  curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");
+
+  curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, *sslctx_function);
+  curl_easy_setopt(curl, CURLOPT_SSL_CTX_DATA, mypem);
+  result = curl_easy_perform(curl);
+  if(result == CURLE_OK)
+    printf("*** transfer succeeded ***\n");
+  else
+    printf("*** transfer failed ***\n");
+
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+  return (int)result;
+}
+~~~
+
+# HISTORY
+
+Added in 7.11.0 for OpenSSL, in 7.42.0 for wolfSSL, in 7.54.0 for mbedTLS.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+CURLE_OK if supported; or an error such as:
+
+CURLE_NOT_BUILT_IN - Not supported by the SSL backend
+
+CURLE_UNKNOWN_OPTION
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CTX_FUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CTX_FUNCTION.3
deleted file mode 100644
index 663a0868cc..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CTX_FUNCTION.3
+++ /dev/null
@@ -1,167 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSL_CTX_FUNCTION 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSL_CTX_FUNCTION \- SSL context callback for OpenSSL, wolfSSL or mbedTLS
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode ssl_ctx_callback(CURL *curl, void *ssl_ctx, void *clientp);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_CTX_FUNCTION,
-                          ssl_ctx_callback);
-.SH DESCRIPTION
-This option only works for libcurl powered by OpenSSL, wolfSSL, mbedTLS or
-BearSSL. If libcurl was built against another SSL library this functionality
-is absent.
-
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-This callback function gets called by libcurl just before the initialization
-of an SSL connection after having processed all other SSL related options to
-give a last chance to an application to modify the behavior of the SSL
-initialization. The \fIssl_ctx\fP parameter is actually a pointer to the SSL
-library's \fISSL_CTX\fP for OpenSSL or wolfSSL, a pointer to
-\fImbedtls_ssl_config\fP for mbedTLS or a pointer to
-\fIbr_ssl_client_context\fP for BearSSL. If an error is returned from the
-callback no attempt to establish a connection is made and the perform
-operation returns the callback's error code. Set the \fIclientp\fP argument
-with the \fICURLOPT_SSL_CTX_DATA(3)\fP option.
-
-This function gets called on all new connections made to a server, during the
-SSL negotiation. The \fIssl_ctx\fP points to a newly initialized object each
-time, but note the pointer may be the same as from a prior call.
-
-To use this properly, a non-trivial amount of knowledge of your SSL library is
-necessary. For example, you can use this function to call library-specific
-callbacks to add additional validation code for certificates, and even to
-change the actual URI of an HTTPS request.
-
-For OpenSSL, asynchronous certificate verification via
-\fISSL_set_retry_verify\fP is supported. (Added in 8.3.0)
-
-WARNING: The \fICURLOPT_SSL_CTX_FUNCTION(3)\fP callback allows the application
-to reach in and modify SSL details in the connection without libcurl itself
-knowing anything about it, which then subsequently can lead to libcurl
-unknowingly reusing SSL connections with different properties. To remedy this
-you may set \fICURLOPT_FORBID_REUSE(3)\fP from the callback function.
-
-WARNING: If you are using DNS-over-HTTPS (DoH) via \fICURLOPT_DOH_URL(3)\fP
-then this callback is also called for those transfers and the curl handle is
-set to an internal handle. \fBThis behavior is subject to change.\fP We
-recommend before performing your transfer set \fICURLOPT_PRIVATE(3)\fP on your
-curl handle so you can identify it in the context callback. If you have a
-reason to modify DoH SSL context please let us know on the curl-library
-mailing list because we are considering removing this capability.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-/* OpenSSL specific */
-
-#include <openssl/ssl.h>
-#include <curl/curl.h>
-#include <stdio.h>
-
-static CURLcode sslctx_function(CURL *curl, void *sslctx, void *parm)
-{
-  X509_STORE *store;
-  X509 *cert = NULL;
-  BIO *bio;
-  char *mypem = parm;
-  /* get a BIO */
-  bio = BIO_new_mem_buf(mypem, -1);
-  /* use it to read the PEM formatted certificate from memory into an
-   * X509 structure that SSL can use
-   */
-  PEM_read_bio_X509(bio, &cert, 0, NULL);
-  if(cert == NULL)
-    printf("PEM_read_bio_X509 failed...\\n");
-
-  /* get a pointer to the X509 certificate store (which may be empty) */
-  store = SSL_CTX_get_cert_store((SSL_CTX *)sslctx);
-
-  /* add our certificate to this store */
-  if(X509_STORE_add_cert(store, cert) == 0)
-    printf("error adding certificate\\n");
-
-  /* decrease reference counts */
-  X509_free(cert);
-  BIO_free(bio);
-
-  /* all set to go */
-  return CURLE_OK;
-}
-
-int main(void)
-{
-  CURL * ch;
-  CURLcode rv;
-  char *mypem = /* example CA cert PEM - shortened */
-    "-----BEGIN CERTIFICATE-----\\n"
-    "MIIHPTCCBSWgAwIBAgIBADANBgkqhkiG9w0BAQQFADB5MRAwDgYDVQQKEwdSb290\\n"
-    "IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNB\\n"
-    "IENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRA\\n"
-    "Y2FjZXJ0Lm9yZzAeFw0wMzAzMzAxMjI5NDlaFw0zMzAzMjkxMjI5NDlaMHkxEDAO\\n"
-    "GCSNe9FINSkYQKyTYOGWhlC0elnYjyELn8+CkcY7v2vcB5G5l1YjqrZslMZIBjzk\\n"
-    "zk6q5PYvCdxTby78dOs6Y5nCpqyJvKeyRKANihDjbPIky/qbn3BHLt4Ui9SyIAmW\\n"
-    "omTxJBzcoTWcFbLUvFUufQb1nA5V9FrWk9p2rSVzTMVD\\n"
-    "-----END CERTIFICATE-----\\n";
-
-  curl_global_init(CURL_GLOBAL_ALL);
-  ch = curl_easy_init();
-
-  curl_easy_setopt(ch, CURLOPT_SSLCERTTYPE, "PEM");
-  curl_easy_setopt(ch, CURLOPT_SSL_VERIFYPEER, 1L);
-  curl_easy_setopt(ch, CURLOPT_URL, "https://www.example.com/");
-
-  curl_easy_setopt(ch, CURLOPT_SSL_CTX_FUNCTION, *sslctx_function);
-  curl_easy_setopt(ch, CURLOPT_SSL_CTX_DATA, mypem);
-  rv = curl_easy_perform(ch);
-  if(!rv)
-    printf("*** transfer succeeded ***\\n");
-  else
-    printf("*** transfer failed ***\\n");
-
-  curl_easy_cleanup(ch);
-  curl_global_cleanup();
-  return rv;
-}
-.fi
-.SH AVAILABILITY
-Added in 7.11.0 for OpenSSL, in 7.42.0 for wolfSSL, in 7.54.0 for mbedTLS,
-in 7.83.0 in BearSSL. Other SSL backends are not supported.
-.SH RETURN VALUE
-CURLE_OK if supported; or an error such as:
-
-CURLE_NOT_BUILT_IN - Not supported by the SSL backend
-
-CURLE_UNKNOWN_OPTION
-.SH "SEE ALSO"
-.BR CURLOPT_SSL_CTX_DATA "(3), " CURLOPT_SSL_VERIFYPEER "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CTX_FUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CTX_FUNCTION.md
new file mode 100644
index 0000000000..f0460e5357
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_CTX_FUNCTION.md
@@ -0,0 +1,184 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSL_CTX_FUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CA_CACHE_TIMEOUT (3)
+  - CURLOPT_CAINFO (3)
+  - CURLOPT_CAINFO_BLOB (3)
+  - CURLOPT_SSL_CTX_DATA (3)
+  - CURLOPT_SSL_VERIFYHOST (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - wolfSSL
+  - mbedTLS
+Added-in: 7.10.6
+---
+
+# NAME
+
+CURLOPT_SSL_CTX_FUNCTION - SSL context callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode ssl_ctx_callback(CURL *curl, void *ssl_ctx, void *clientp);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_CTX_FUNCTION,
+                          ssl_ctx_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+This callback function gets called by libcurl immediately before the
+initialization of an SSL connection after having processed all other SSL
+related options to give a last chance to an application to modify the behavior
+of the SSL initialization. The *ssl_ctx* parameter is a pointer to the SSL
+library's *SSL_CTX* for OpenSSL or wolfSSL, a pointer to *mbedtls_ssl_config*
+for mbedTLS. If an error is returned from the callback no attempt to establish
+a connection is made and the perform operation returns the callback's error
+code. Set the *clientp* argument passed in to this callback with the
+CURLOPT_SSL_CTX_DATA(3) option.
+
+This function gets called for all new connections made to a server, during the
+SSL negotiation. While *ssl_ctx* points to a newly initialized object each
+time, the pointer may still be the same as in a prior call.
+
+To use this callback, a non-trivial amount of knowledge of your SSL library is
+necessary. For example, you can use this function to call library-specific
+callbacks to add additional validation code for certificates, and even to
+change the actual URI of an HTTPS request.
+
+For OpenSSL, asynchronous certificate verification via *SSL_set_retry_verify*
+is supported. When *SSL_set_retry_verify* is set, the transfer is paused.
+When verification should continue, call curl_easy_pause(3) to unpause
+the transfer. (Added in 8.3.0, Pausing added in 8.16.0)
+
+The CURLOPT_SSL_CTX_FUNCTION(3) callback allows the application to reach in
+and modify SSL details in the connection without libcurl itself knowing
+anything about it, which then subsequently can lead to libcurl unknowingly
+reusing SSL connections with different properties. To remedy this you may set
+CURLOPT_FORBID_REUSE(3) from the callback function.
+
+A connection that is set up with this callback can be put in the connection
+pool by libcurl and then reused in following transfers without the callback
+being called. The connection may even be selected from the pool to be used for
+transfers not using this callback. If the callback should only be valid for
+the specific transfer the callback verifies, it should be marked unsuitable
+for reuse with CURLOPT_FORBID_REUSE(3).
+
+If you are using DNS-over-HTTPS (DoH) via CURLOPT_DOH_URL(3) then this
+callback is also called for those transfers and the curl handle is set to an
+internal handle. **This behavior is subject to change.** We recommend setting
+CURLOPT_PRIVATE(3) on your curl handle so you can identify it correctly in the
+context callback. If you have a reason to modify DoH SSL context please let us
+know on the curl-library mailing list because we are considering removing this
+capability.
+
+libcurl does not guarantee the lifetime of the passed in object once this
+callback function has returned. Your application must not assume that it can
+keep using the SSL context or data derived from it once this function is
+completed.
+
+For libcurl builds using TLS backends that support CA caching and
+CURLOPT_CA_CACHE_TIMEOUT(3) is not set to zero, multiple calls to this
+callback may be done with the same CA store in memory.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+/* OpenSSL specific */
+
+#include <openssl/ssl.h>
+#include <curl/curl.h>
+#include <stdio.h>
+
+static CURLcode sslctx_function(CURL *curl, void *sslctx, void *pointer)
+{
+  X509_STORE *store;
+  X509 *cert = NULL;
+  BIO *bio;
+  char *mypem = pointer;
+  /* get a BIO */
+  bio = BIO_new_mem_buf(mypem, -1);
+  /* use it to read the PEM formatted certificate from memory into an
+   * X509 structure that SSL can use
+   */
+  PEM_read_bio_X509(bio, &cert, 0, NULL);
+  if(!cert)
+    printf("PEM_read_bio_X509 failed...\n");
+
+  /* get a pointer to the X509 certificate store (which may be empty) */
+  store = SSL_CTX_get_cert_store((SSL_CTX *)sslctx);
+
+  /* add our certificate to this store */
+  if(X509_STORE_add_cert(store, cert) == 0)
+    printf("error adding certificate\n");
+
+  /* decrease reference counts */
+  X509_free(cert);
+  BIO_free(bio);
+
+  /* all set to go */
+  return CURLE_OK;
+}
+
+int main(void)
+{
+  CURL *curl;
+  CURLcode result;
+  /* CA cert in PEM format, replace the XXXs */
+  char *mypem =
+    "-----BEGIN CERTIFICATE-----\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n"
+    "-----END CERTIFICATE-----\n";
+
+  curl_global_init(CURL_GLOBAL_ALL);
+  curl = curl_easy_init();
+
+  curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM");
+  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
+  curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");
+
+  curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, *sslctx_function);
+  curl_easy_setopt(curl, CURLOPT_SSL_CTX_DATA, mypem);
+  result = curl_easy_perform(curl);
+  if(result == CURLE_OK)
+    printf("*** transfer succeeded ***\n");
+  else
+    printf("*** transfer failed ***\n");
+
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+  return (int)result;
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+CURLE_OK if supported; or an error such as:
+
+CURLE_NOT_BUILT_IN - Not supported by the SSL backend
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_EC_CURVES.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_EC_CURVES.3
deleted file mode 100644
index 4d91437291..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_EC_CURVES.3
+++ /dev/null
@@ -1,58 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSL_EC_CURVES 3 "29 Aug 2020" libcurl libcurl
-.SH NAME
-CURLOPT_SSL_EC_CURVES \- key exchange curves
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_EC_CURVES, char *alg_list);
-.fi
-.SH DESCRIPTION
-Pass a string as parameter with a colon delimited list of (EC) algorithms. This
-option defines the client's key exchange algorithms in the SSL handshake (if
-the SSL backend libcurl is built to use supports it).
-.SH DEFAULT
-"", embedded in SSL backend
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_SSL_EC_CURVES, "X25519:P-521");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.73.0. Supported by the OpenSSL backend.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_SSL_OPTIONS "(3), " CURLOPT_SSL_CIPHER_LIST "(3), "
-.BR CURLOPT_TLS13_CIPHERS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_EC_CURVES.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_EC_CURVES.md
new file mode 100644
index 0000000000..674e1ac6d5
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_EC_CURVES.md
@@ -0,0 +1,72 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSL_EC_CURVES
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSL_CIPHER_LIST (3)
+  - CURLOPT_SSL_OPTIONS (3)
+  - CURLOPT_TLS13_CIPHERS (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - wolfSSL
+Added-in: 7.73.0
+---
+
+# NAME
+
+CURLOPT_SSL_EC_CURVES - key exchange curves
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_EC_CURVES, char *list);
+~~~
+
+# DESCRIPTION
+
+Pass a string as parameter with a colon delimited list of Elliptic curve (EC)
+algorithms. This option defines the client's key exchange algorithms in the
+SSL handshake (if the SSL backend libcurl is built to use supports it).
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to restore back to internal default.
+
+# DEFAULT
+
+"", embedded in SSL backend
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_SSL_EC_CURVES, "X25519:P-521");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_ENABLE_ALPN.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_ENABLE_ALPN.3
deleted file mode 100644
index 973306e293..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_ENABLE_ALPN.3
+++ /dev/null
@@ -1,57 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSL_ENABLE_ALPN 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSL_ENABLE_ALPN \- Application Layer Protocol Negotiation
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_ENABLE_ALPN, long npn);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter, 0 or 1 where 1 is for enable and 0 for disable. This
-option enables/disables ALPN in the SSL handshake (if the SSL backend libcurl
-is built to use supports it), which can be used to negotiate http2.
-.SH DEFAULT
-1, enabled
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_SSL_ENABLE_ALPN, 0L);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.36.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_SSL_ENABLE_NPN "(3), " CURLOPT_SSL_OPTIONS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_ENABLE_ALPN.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_ENABLE_ALPN.md
new file mode 100644
index 0000000000..2e0399d0fa
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_ENABLE_ALPN.md
@@ -0,0 +1,64 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSL_ENABLE_ALPN
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSL_ENABLE_NPN (3)
+  - CURLOPT_SSL_OPTIONS (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - All
+Added-in: 7.36.0
+---
+
+# NAME
+
+CURLOPT_SSL_ENABLE_ALPN - Application Layer Protocol Negotiation
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_ENABLE_ALPN, long npn);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter, 0 or 1 where 1 is for enable and 0 for disable. This
+option enables/disables ALPN in the SSL handshake (if the SSL backend libcurl
+is built to use supports it), which can be used to negotiate http2.
+
+# DEFAULT
+
+1, enabled
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_SSL_ENABLE_ALPN, 0L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_ENABLE_NPN.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_ENABLE_NPN.3
deleted file mode 100644
index c3a995a51c..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_ENABLE_NPN.3
+++ /dev/null
@@ -1,59 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSL_ENABLE_NPN 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSL_ENABLE_NPN \- use NPN
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_ENABLE_NPN, long npn);
-.fi
-.SH DESCRIPTION
-Deprecated in 7.86.0. Setting this option has no function.
-
-Pass a long as parameter, 0 or 1 where 1 is for enable and 0 for disable. This
-option enables/disables NPN in the SSL handshake (if the SSL backend libcurl
-is built to use supports it), which can be used to negotiate http2.
-.SH DEFAULT
-1, enabled
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_SSL_ENABLE_NPN, 1L);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.36.0. Deprecated in 7.86.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_SSL_ENABLE_ALPN "(3), " CURLOPT_SSL_OPTIONS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_ENABLE_NPN.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_ENABLE_NPN.md
new file mode 100644
index 0000000000..849791e9e3
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_ENABLE_NPN.md
@@ -0,0 +1,70 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSL_ENABLE_NPN
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSL_ENABLE_ALPN (3)
+  - CURLOPT_SSL_OPTIONS (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - All
+Added-in: 7.36.0
+---
+
+# NAME
+
+CURLOPT_SSL_ENABLE_NPN - use NPN
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_ENABLE_NPN, long npn);
+~~~
+
+# DESCRIPTION
+
+Deprecated. Setting this option has no function.
+
+Pass a long as parameter, 0 or 1 where 1 is for enable and 0 for disable. This
+option enables/disables NPN in the SSL handshake (if the SSL backend libcurl
+is built to use supports it), which can be used to negotiate http2.
+
+# DEFAULT
+
+1, enabled
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_SSL_ENABLE_NPN, 1L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# DEPRECATED
+
+Deprecated since 7.86.0
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_FALSESTART.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_FALSESTART.3
deleted file mode 100644
index 4d3339e530..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_FALSESTART.3
+++ /dev/null
@@ -1,61 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSL_FALSESTART 3 "14 Feb 2015" libcurl libcurl
-.SH NAME
-CURLOPT_SSL_FALSESTART \- TLS false start
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_FALSESTART, long enable);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter set to 1L to enable or 0 to disable.
-
-This option determines whether libcurl should use false start during the TLS
-handshake. False start is a mode where a TLS client starts sending application
-data before verifying the server's Finished message, thus saving a round trip
-when performing a full handshake.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_SSL_FALSESTART, 1L);
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.42.0. This option is currently only supported by the Secure
-Transport (on iOS 7.0 or later, or OS X 10.9 or later) TLS backend.
-.SH RETURN VALUE
-Returns CURLE_OK if false start is supported by the SSL backend, otherwise
-returns CURLE_NOT_BUILT_IN.
-.SH SEE ALSO
-.BR CURLOPT_TCP_FASTOPEN "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_FALSESTART.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_FALSESTART.md
new file mode 100644
index 0000000000..d63a24c35e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_FALSESTART.md
@@ -0,0 +1,70 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSL_FALSESTART
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_TCP_FASTOPEN (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - none
+Added-in: 7.42.0
+---
+
+# NAME
+
+CURLOPT_SSL_FALSESTART - TLS false start
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_FALSESTART, long enable);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter set to 1L to enable or 0 to disable.
+
+This option determines whether libcurl should use false start during the TLS
+handshake. False start is a mode where a TLS client starts sending application
+data before verifying the server's Finished message, thus saving a round trip
+when performing a full handshake.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_SSL_FALSESTART, 1L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# DEPRECATED
+
+Deprecated since 8.15.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_OPTIONS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_OPTIONS.3
deleted file mode 100644
index 6d6821420a..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_OPTIONS.3
+++ /dev/null
@@ -1,99 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSL_OPTIONS 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSL_OPTIONS \- SSL behavior options
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_OPTIONS, long bitmask);
-.fi
-.SH DESCRIPTION
-Pass a long with a bitmask to tell libcurl about specific SSL
-behaviors. Available bits:
-.IP CURLSSLOPT_ALLOW_BEAST
-Tells libcurl to not attempt to use any workarounds for a security flaw in the
-SSL3 and TLS1.0 protocols.  If this option is not used or this bit is set to 0,
-the SSL layer libcurl uses may use a work-around for this flaw although it
-might cause interoperability problems with some (older) SSL implementations.
-WARNING: avoiding this work-around lessens the security, and by setting this
-option to 1 you ask for exactly that. This option is only supported for
-Secure Transport and OpenSSL.
-.IP CURLSSLOPT_NO_REVOKE
-Tells libcurl to disable certificate revocation checks for those SSL backends
-where such behavior is present. This option is only supported for Schannel
-(the native Windows SSL library), with an exception in the case of Windows'
-Untrusted Publishers block list which it seems cannot be bypassed. (Added in
-7.44.0)
-.IP CURLSSLOPT_NO_PARTIALCHAIN
-Tells libcurl to not accept "partial" certificate chains, which it otherwise
-does by default. This option is only supported for OpenSSL and fails the
-certificate verification if the chain ends with an intermediate certificate
-and not with a root cert. (Added in 7.68.0)
-.IP CURLSSLOPT_REVOKE_BEST_EFFORT
-Tells libcurl to ignore certificate revocation checks in case of missing or
-offline distribution points for those SSL backends where such behavior is
-present. This option is only supported for Schannel (the native Windows SSL
-library). If combined with \fICURLSSLOPT_NO_REVOKE\fP, the latter takes
-precedence. (Added in 7.70.0)
-.IP CURLSSLOPT_NATIVE_CA
-Tell libcurl to use the operating system's native CA store for certificate
-verification. Works only on Windows, Linux (Debian, Ubuntu, Gentoo, Fedora,
-RHEL), macOS, Android and iOS when built to use wolfSSL (since 8.3.0) or on
-Windows when built to use OpenSSL. If you set this option and also set a CA
-certificate file or directory then during verification those certificates
-are searched in addition to the native CA store.
-(Added in 7.71.0)
-.IP CURLSSLOPT_AUTO_CLIENT_CERT
-Tell libcurl to automatically locate and use a client certificate for
-authentication, when requested by the server. This option is only supported
-for Schannel (the native Windows SSL library). Prior to 7.77.0 this was the
-default behavior in libcurl with Schannel. Since the server can request any
-certificate that supports client authentication in the OS certificate store it
-could be a privacy violation and unexpected.
-(Added in 7.77.0)
-.SH DEFAULT
-0
-.SH PROTOCOLS
-All TLS-based protocols
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  /* weaken TLS only for use with silly servers */
-  curl_easy_setopt(curl, CURLOPT_SSL_OPTIONS, (long)CURLSSLOPT_ALLOW_BEAST |
-                   CURLSSLOPT_NO_REVOKE);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.25.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_SSLVERSION "(3), " CURLOPT_SSL_CIPHER_LIST "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_OPTIONS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_OPTIONS.md
new file mode 100644
index 0000000000..13dd45077d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_OPTIONS.md
@@ -0,0 +1,145 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSL_OPTIONS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_SSL_OPTIONS (3)
+  - CURLOPT_SSLVERSION (3)
+  - CURLOPT_SSL_CIPHER_LIST (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - All
+Added-in: 7.25.0
+---
+
+# NAME
+
+CURLOPT_SSL_OPTIONS - SSL behavior options
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_OPTIONS, long bitmask);
+~~~
+
+# DESCRIPTION
+
+Pass a long with a bitmask to tell libcurl about specific SSL
+behaviors. Available bits:
+
+## CURLSSLOPT_ALLOW_BEAST
+
+Tells libcurl to not attempt to use any workarounds for a security flaw in the
+SSL3 and TLS1.0 protocols. If this option is not used or this bit is set to 0,
+the SSL layer libcurl uses may use a workaround for this flaw although it
+might cause interoperability problems with some (older) SSL implementations.
+
+**WARNING:** avoiding this workaround lessens the security, and by setting
+this option to 1 you ask for exactly that. This option is only supported for
+Secure Transport and OpenSSL.
+
+## CURLSSLOPT_NO_REVOKE
+
+Tells libcurl to disable certificate revocation checks for those SSL backends
+where such behavior is present. This option is only supported for Schannel
+(the native Windows SSL library), with an exception in the case of Windows'
+Untrusted Publishers block list which it seems cannot be bypassed.
+
+## CURLSSLOPT_NO_PARTIALCHAIN
+
+Tells libcurl to not accept "partial" certificate chains, which it otherwise
+does by default. This option fails the certificate verification if the chain
+ends with an intermediate certificate and not with a root cert.
+
+Works with OpenSSL and its forks (BoringSSL, LibreSSL, etc). (Added in 7.68.0)
+
+Works with Schannel if the user specified certificates to verify the peer.
+(Added in 8.15.0)
+
+## CURLSSLOPT_REVOKE_BEST_EFFORT
+
+Tells libcurl to ignore certificate revocation checks in case of missing or
+offline distribution points for those SSL backends where such behavior is
+present. This option is only supported for Schannel (the native Windows SSL
+library). If combined with *CURLSSLOPT_NO_REVOKE*, the latter takes
+precedence. (Added in 7.70.0)
+
+## CURLSSLOPT_NATIVE_CA
+
+Tell libcurl to use the operating system's native CA store for certificate
+verification. This option is independent of other CA certificate locations set
+at run time or build time. Those locations are searched in addition to the
+native CA store.
+
+Works with wolfSSL on Windows, Linux (Debian, Fedora, Gentoo, RHEL, Ubuntu),
+macOS, Android and iOS (added in 8.3.0); with GnuTLS (added in 8.5.0) and with
+OpenSSL and its forks (BoringSSL, LibreSSL, etc) on Windows (Added in 7.71.0).
+
+This works with Rustls on Windows, macOS, Android and iOS. On Linux it is
+equivalent to using the Mozilla CA certificate bundle. When used with Rustls
+_only_ the native CA store is consulted, not other locations set at run time or
+build time. (Added in 8.13.0)
+
+## CURLSSLOPT_AUTO_CLIENT_CERT
+
+Tell libcurl to automatically locate and use a client certificate for
+authentication, when requested by the server. This option is only supported
+for Schannel (the native Windows SSL library). Prior to 7.77.0 this was the
+default behavior in libcurl with Schannel. Since the server can request any
+certificate that supports client authentication in the OS certificate store it
+could be a privacy violation and unexpected.
+(Added in 7.77.0)
+
+## CURLSSLOPT_EARLYDATA
+
+Tell libcurl to try sending application data as TLS1.3 early data. This option
+is supported for GnuTLS, OpenSSL, quictls and wolfSSL (but not AWS-LC or
+BoringSSL). It works on TCP and QUIC connections using ngtcp2.
+This option works on a best effort basis,
+in cases when it was not possible to send early data the request is resent
+normally post-handshake.
+This option does not work when using QUIC.
+(Added in 8.11.0 for GnuTLS and 8.13.0 for OpenSSL, quictls and wolfSSL)
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* weaken TLS only for use with silly servers */
+    curl_easy_setopt(curl, CURLOPT_SSL_OPTIONS,
+                     CURLSSLOPT_ALLOW_BEAST | CURLSSLOPT_NO_REVOKE);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURLSSLOPT_*** macros became `long` types in 8.15.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_SESSIONID_CACHE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_SESSIONID_CACHE.3
deleted file mode 100644
index 7651d3cbd1..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_SESSIONID_CACHE.3
+++ /dev/null
@@ -1,60 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSL_SESSIONID_CACHE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSL_SESSIONID_CACHE \- use the SSL session-ID cache
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_SESSIONID_CACHE,
-                         long enabled);
-.SH DESCRIPTION
-Pass a long set to 0 to disable libcurl's use of SSL session-ID caching. Set
-this to 1 to enable it. By default all transfers are done using the cache
-enabled. While nothing ever should get hurt by attempting to reuse SSL
-session-IDs, there seem to be or have been broken SSL implementations in the
-wild that may require you to disable this in order for you to succeed.
-.SH DEFAULT
-1
-.SH PROTOCOLS
-All TLS-based
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  /* switch off session-id use! */
-  curl_easy_setopt(curl, CURLOPT_SSL_SESSIONID_CACHE, 0L);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.16.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_DNS_CACHE_TIMEOUT "(3), " CURLOPT_SSLVERSION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_SESSIONID_CACHE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_SESSIONID_CACHE.md
new file mode 100644
index 0000000000..2e0c7c6fc0
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_SESSIONID_CACHE.md
@@ -0,0 +1,70 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSL_SESSIONID_CACHE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DNS_CACHE_TIMEOUT (3)
+  - CURLOPT_MAXAGE_CONN (3)
+  - CURLOPT_MAXLIFETIME_CONN (3)
+  - CURLOPT_SSLVERSION (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - All
+Added-in: 7.16.0
+---
+
+# NAME
+
+CURLOPT_SSL_SESSIONID_CACHE - use the SSL session-ID cache
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_SESSIONID_CACHE,
+                         long enabled);
+~~~
+
+# DESCRIPTION
+
+Pass a long set to 0 to disable libcurl's use of SSL session-ID caching. Set
+this to 1 to enable it. By default all transfers are done using the cache
+enabled. While nothing ever should get hurt by attempting to reuse SSL
+session-IDs, there seem to be or have been broken SSL implementations in the
+wild that may require you to disable this in order for you to succeed.
+
+# DEFAULT
+
+1
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* switch off session-id use */
+    curl_easy_setopt(curl, CURLOPT_SSL_SESSIONID_CACHE, 0L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_SIGNATURE_ALGORITHMS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_SIGNATURE_ALGORITHMS.md
new file mode 100644
index 0000000000..4e7644719c
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_SIGNATURE_ALGORITHMS.md
@@ -0,0 +1,84 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSL_SIGNATURE_ALGORITHMS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSL_CIPHER_LIST (3)
+  - CURLOPT_SSL_EC_CURVES (3)
+  - CURLOPT_SSLVERSION (3)
+  - CURLOPT_USE_SSL (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+Added-in: 8.14.0
+---
+
+# NAME
+
+CURLOPT_SSL_SIGNATURE_ALGORITHMS - signature algorithms to use for TLS
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_SIGNATURE_ALGORITHMS, char *list);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer, pointing to a null-terminated string holding the list of
+signature algorithms to use for the TLS connection. The list must be syntactically
+correct, it consists of one or more signature algorithm strings separated by colons.
+
+A valid example of a signature algorithms list with OpenSSL is:
+~~~
+"DSA+SHA256:rsa_pss_pss_sha256"
+~~~
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+Works with OpenSSL and its BoringSSL fork (added in 8.14.0).
+
+# DEFAULT
+
+NULL, use built-in list
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_SSL_SIGNATURE_ALGORITHMS,
+                     "DSA+SHA256:rsa_pss_pss_sha256");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+OpenSSL support added in 8.14.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYHOST.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYHOST.3
deleted file mode 100644
index 73443dcf59..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYHOST.3
+++ /dev/null
@@ -1,110 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSL_VERIFYHOST 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSL_VERIFYHOST \- verify the certificate's name against host
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_VERIFYHOST, long verify);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter specifying what to \fIverify\fP.
-
-This option determines whether libcurl verifies that the server cert is for
-the server it is known as.
-
-When negotiating TLS and SSL connections, the server sends a certificate
-indicating its identity.
-
-When \fICURLOPT_SSL_VERIFYHOST(3)\fP is 2, that certificate must indicate that
-the server is the server to which you meant to connect, or the connection
-fails. Simply put, it means it has to have the same name in the certificate as
-is in the URL you operate against.
-
-Curl considers the server the intended one when the Common Name field or a
-Subject Alternate Name field in the certificate matches the host name in the
-URL to which you told Curl to connect.
-
-If \fIverify\fP value is set to 1:
-
-In 7.28.0 and earlier: treated as a debug option of some sorts, not supported
-anymore due to frequently leading to programmer mistakes.
-
-From 7.28.1 to 7.65.3: setting it to 1 made curl_easy_setopt() return an error
-and leaving the flag untouched.
-
-From 7.66.0: treats 1 and 2 the same.
-
-When the \fIverify\fP value is 0, the connection succeeds regardless of the
-names in the certificate. Use that ability with caution!
-
-The default value for this option is 2.
-
-This option controls checking the server's certificate's claimed identity.
-The server could be lying.  To control lying, see
-\fICURLOPT_SSL_VERIFYPEER(3)\fP.
-
-WARNING: disabling verification of the certificate allows bad guys to
-man-in-the-middle the communication without you knowing it. Disabling
-verification makes the communication insecure. Just having encryption on a
-transfer is not enough as you cannot be sure that you are communicating with
-the correct end-point.
-
-When libcurl uses secure protocols it trusts responses and allows for example
-HSTS and Alt-Svc information to be stored and used subsequently. Disabling
-certificate verification can make libcurl trust and use such information from
-malicious servers.
-.SH LIMITATIONS
-Secure Transport: If \fIverify\fP value is 0, then SNI is also disabled. SNI is
-a TLS extension that sends the hostname to the server. The server may use that
-information to do such things as sending back a specific certificate for the
-hostname, or forwarding the request to a specific origin server. Some hostnames
-may be inaccessible if SNI is not sent.
-.SH DEFAULT
-2
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Set the default value: strict name check please */
-  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-If built TLS enabled.
-.SH RETURN VALUE
-Returns CURLE_OK if TLS is supported, and CURLE_UNKNOWN_OPTION if not.
-
-If 1 is set as argument, \fICURLE_BAD_FUNCTION_ARGUMENT\fP is returned.
-.SH "SEE ALSO"
-.BR CURLOPT_SSL_VERIFYPEER "(3), " CURLOPT_CAINFO "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYHOST.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYHOST.md
new file mode 100644
index 0000000000..d4c0ae9acf
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYHOST.md
@@ -0,0 +1,120 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSL_VERIFYHOST
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CAINFO (3)
+  - CURLOPT_PINNEDPUBLICKEY (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+  - CURLOPT_PROXY_SSL_VERIFYHOST (3)
+  - CURLOPT_DOH_SSL_VERIFYHOST (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - All
+Added-in: 7.8.1
+---
+
+# NAME
+
+CURLOPT_SSL_VERIFYHOST - verify the certificate's name against host
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_VERIFYHOST, long verify);
+~~~
+
+# DESCRIPTION
+
+Pass a long set to 2L to make libcurl verify the host in the server's TLS
+certificate.
+
+When negotiating a TLS connection, the server sends a certificate indicating
+its identity.
+
+When CURLOPT_SSL_VERIFYHOST(3) is set to 1 or 2, the server certificate must
+indicate that it was made for the hostname or address curl connects to, or the
+connection fails. The certificate has to have the same name as is used in the
+URL you operate against.
+
+curl considers the server the intended one when the Common Name field or a
+Subject Alternate Name field in the certificate matches the hostname in the
+URL to which you told curl to connect.
+
+When the *verify* value is 0, the connection succeeds regardless of the names
+in the certificate. Use that ability with caution.
+
+This option controls checking the server's certificate's claimed identity. The
+separate CURLOPT_SSL_VERIFYPEER(3) options enables/disables verification that
+the certificate is signed by a trusted Certificate Authority.
+
+**WARNING:** disabling verification of the certificate allows bad guys to
+man-in-the-middle the communication without you knowing it. Disabling
+verification makes the communication insecure. Having encryption on a transfer
+is not enough as you cannot be sure that you are communicating with the
+correct end-point.
+
+When libcurl uses secure protocols it trusts responses and allows for example
+HSTS and Alt-Svc information to be stored and used subsequently. Disabling
+certificate verification can make libcurl trust and use such information from
+malicious servers.
+
+# MATCHING
+
+A certificate can have the name as a wildcard. The only asterisk (`*`) must
+then be the left-most character and it must be followed by a period. The
+wildcard must further contain more than one period as it cannot be set for a
+top-level domain.
+
+A certificate can be set for a numerical IP address (IPv4 or IPv6), but then
+it should be a Subject Alternate Name kind and its type should correctly
+identify the field as an IP address.
+
+# DEFAULT
+
+2
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Set the default value: strict name check please */
+    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# HISTORY
+
+In 7.28.0 and earlier: the value 1 was treated as a debug option of some
+sorts, not supported anymore due to frequently leading to programmer mistakes.
+
+From 7.28.1 to 7.65.3: setting it to 1 made curl_easy_setopt(3) return
+an error and leaving the flag untouched.
+
+From 7.66.0: libcurl treats 1 and 2 to this option the same.
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYPEER.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYPEER.3
deleted file mode 100644
index ecaa1b233b..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYPEER.3
+++ /dev/null
@@ -1,97 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSL_VERIFYPEER 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSL_VERIFYPEER \- verify the peer's SSL certificate
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_VERIFYPEER, long verify);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter to enable or disable.
-
-This option determines whether curl verifies the authenticity of the peer's
-certificate. A value of 1 means curl verifies; 0 (zero) means it does not.
-
-When negotiating a TLS or SSL connection, the server sends a certificate
-indicating its identity. Curl verifies whether the certificate is authentic,
-i.e. that you can trust that the server is who the certificate says it is.
-This trust is based on a chain of digital signatures, rooted in certification
-authority (CA) certificates you supply. curl uses a default bundle of CA
-certificates (the path for that is determined at build time) and you can
-specify alternate certificates with the \fICURLOPT_CAINFO(3)\fP option or the
-\fICURLOPT_CAPATH(3)\fP option.
-
-When \fICURLOPT_SSL_VERIFYPEER(3)\fP is enabled, and the verification fails to
-prove that the certificate is signed by a CA, the connection fails.
-
-When this option is disabled (set to zero), the CA certificates are not loaded
-and the peer certificate verification is simply skipped.
-
-Authenticating the certificate is not enough to be sure about the server. You
-typically also want to ensure that the server is the server you mean to be
-talking to.  Use \fICURLOPT_SSL_VERIFYHOST(3)\fP for that. The check that the
-host name in the certificate is valid for the host name you are connecting to
-is done independently of the \fICURLOPT_SSL_VERIFYPEER(3)\fP option.
-
-WARNING: disabling verification of the certificate allows bad guys to
-man-in-the-middle the communication without you knowing it. Disabling
-verification makes the communication insecure. Just having encryption on a
-transfer is not enough as you cannot be sure that you are communicating with
-the correct end-point.
-
-When libcurl uses secure protocols it trusts responses and allows for example
-HSTS and Alt-Svc information to be stored and used subsequently. Disabling
-certificate verification can make libcurl trust and use such information from
-malicious servers.
-.SH DEFAULT
-1 - enabled
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Set the default value: strict certificate check please */
-  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-If built TLS enabled.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_SSL_VERIFYHOST "(3), "
-.BR CURLOPT_PROXY_SSL_VERIFYPEER "(3), "
-.BR CURLOPT_PROXY_SSL_VERIFYHOST "(3), "
-.BR CURLOPT_CAINFO "(3), "
-.BR CURLINFO_CAINFO "(3), "
-.BR CURLINFO_CAPATH "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYPEER.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYPEER.md
new file mode 100644
index 0000000000..ad0242ba58
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYPEER.md
@@ -0,0 +1,104 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSL_VERIFYPEER
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_CAINFO (3)
+  - CURLINFO_CAPATH (3)
+  - CURLOPT_CAINFO (3)
+  - CURLOPT_PROXY_SSL_VERIFYHOST (3)
+  - CURLOPT_PROXY_SSL_VERIFYPEER (3)
+  - CURLOPT_SSL_VERIFYHOST (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - All
+Added-in: 7.4.2
+---
+
+# NAME
+
+CURLOPT_SSL_VERIFYPEER - verify the peer's SSL certificate
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_VERIFYPEER, long verify);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter to enable or disable.
+
+This option determines whether curl verifies the authenticity of the peer's
+certificate. A value of 1 means curl verifies; 0 (zero) means it does not.
+
+When negotiating a TLS or SSL connection, the server sends a certificate
+indicating its identity. curl verifies whether the certificate is authentic,
+i.e. that you can trust that the server is who the certificate says it is.
+This trust is based on a chain of digital signatures, rooted in certification
+authority (CA) certificates you supply. curl uses a default bundle of CA
+certificates (the path for that is determined at build time) and you can
+specify alternate certificates with the CURLOPT_CAINFO(3) option or the
+CURLOPT_CAPATH(3) option.
+
+When CURLOPT_SSL_VERIFYPEER(3) is enabled, and the verification fails to
+prove that the certificate is signed by a CA, the connection fails.
+
+When this option is disabled (set to zero), the CA certificates are not loaded
+and the peer certificate verification is skipped.
+
+Authenticating the certificate is not enough to be sure about the server. You
+typically also want to ensure that the server is the server you mean to be
+talking to. Use CURLOPT_SSL_VERIFYHOST(3) for that. The check that the host
+name in the certificate is valid for the hostname you are connecting to is
+done independently of the CURLOPT_SSL_VERIFYPEER(3) option.
+
+**WARNING:** disabling verification of the certificate allows bad guys to
+man-in-the-middle the communication without you knowing it. Disabling
+verification makes the communication insecure. Having encryption on a transfer
+is not enough as you cannot be sure that you are communicating with the
+correct end-point.
+
+When libcurl uses secure protocols it trusts responses and allows for example
+HSTS and Alt-Svc information to be stored and used subsequently. Disabling
+certificate verification can make libcurl trust and use such information from
+malicious servers.
+
+# DEFAULT
+
+1 - enabled
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Set the default value: strict certificate check please */
+    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYSTATUS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYSTATUS.3
deleted file mode 100644
index c8f1b52c7a..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYSTATUS.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SSL_VERIFYSTATUS 3 "04 Dec 2014" libcurl libcurl
-.SH NAME
-CURLOPT_SSL_VERIFYSTATUS \- verify the certificate's status
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_VERIFYSTATUS, long verify);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter set to 1 to enable or 0 to disable.
-
-This option determines whether libcurl verifies the status of the server cert
-using the "Certificate Status Request" TLS extension (aka. OCSP stapling).
-
-Note that if this option is enabled but the server does not support the TLS
-extension, the verification fails.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  /* ask for OCSP stapling! */
-  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYSTATUS, 1L);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.41.0. This option is currently only supported by the OpenSSL and
-GnuTLS TLS backends.
-.SH RETURN VALUE
-Returns CURLE_OK if OCSP stapling is supported by the SSL backend, otherwise
-returns CURLE_NOT_BUILT_IN.
-.SH "SEE ALSO"
-.BR CURLOPT_SSL_VERIFYHOST "(3), "
-.BR CURLOPT_SSL_VERIFYPEER "(3), "
-.BR CURLOPT_CAINFO "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYSTATUS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYSTATUS.md
new file mode 100644
index 0000000000..b1d373eef6
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SSL_VERIFYSTATUS.md
@@ -0,0 +1,71 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SSL_VERIFYSTATUS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CAINFO (3)
+  - CURLOPT_SSL_VERIFYHOST (3)
+  - CURLOPT_SSL_VERIFYPEER (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+Added-in: 7.41.0
+---
+
+# NAME
+
+CURLOPT_SSL_VERIFYSTATUS - verify the certificate's status
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_VERIFYSTATUS, long verify);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter set to 1 to enable or 0 to disable.
+
+This option determines whether libcurl verifies the status of the server cert
+using the "Certificate Status Request" TLS extension (aka. OCSP stapling).
+
+Note that if this option is enabled but the server does not support the TLS
+extension, the verification fails.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* ask for OCSP stapling */
+    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYSTATUS, 1L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_STDERR.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_STDERR.3
deleted file mode 100644
index e28d8367c4..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_STDERR.3
+++ /dev/null
@@ -1,63 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_STDERR 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_STDERR \- redirect stderr to another stream
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_STDERR, FILE *stream);
-.fi
-.SH DESCRIPTION
-Pass a FILE * as parameter. Tell libcurl to use this \fIstream\fP instead of
-stderr when showing the progress meter and displaying \fICURLOPT_VERBOSE(3)\fP
-data.
-
-If you are using libcurl as a Windows DLL, this option causes an exception and
-a crash in the library since it cannot access a FILE * passed on from the
-application. A work-around is to instead use \fICURLOPT_DEBUGFUNCTION(3)\fP.
-.SH DEFAULT
-stderr
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-FILE *filep = fopen("dump", "wb");
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_STDERR, filep);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_VERBOSE "(3), " CURLOPT_NOPROGRESS "(3), "
-.BR CURLOPT_DEBUGFUNCTION "(3) "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_STDERR.md b/third-party/curl/docs/libcurl/opts/CURLOPT_STDERR.md
new file mode 100644
index 0000000000..9294fafa60
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_STDERR.md
@@ -0,0 +1,73 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_STDERR
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DEBUGFUNCTION (3)
+  - CURLOPT_NOPROGRESS (3)
+  - CURLOPT_VERBOSE (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_STDERR - redirect stderr to another stream
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_STDERR, FILE *stream);
+~~~
+
+# DESCRIPTION
+
+Pass a FILE * as parameter. Tell libcurl to use this *stream* instead of
+stderr when showing the progress meter and displaying CURLOPT_VERBOSE(3)
+data.
+
+If you are using libcurl as a Windows DLL, this option causes an exception and
+a crash in the library since it cannot access a FILE * passed on from the
+application. A workaround is to instead use CURLOPT_DEBUGFUNCTION(3).
+
+# DEFAULT
+
+stderr
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl;
+  FILE *filep = fopen("dump", "wb");
+  if(!filep)
+    return 1;
+  curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_STDERR, filep);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+  fclose(filep);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS.3
deleted file mode 100644
index ce92062917..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS.3
+++ /dev/null
@@ -1,73 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_STREAM_DEPENDS 3 "13 Sep 2015" libcurl libcurl
-.SH NAME
-CURLOPT_STREAM_DEPENDS \- stream this transfer depends on
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_STREAM_DEPENDS,
-                          CURL *dephandle);
-.fi
-.SH DESCRIPTION
-Pass a CURL * pointer in \fIdephandle\fP to identify the stream within the
-same connection that this stream is depending upon. This option clears the
-exclusive bit and is mutually exclusive to the
-\fICURLOPT_STREAM_DEPENDS_E(3)\fP option.
-
-The spec says "Including a dependency expresses a preference to allocate
-resources to the identified stream rather than to the dependent stream."
-
-This option can be set during transfer.
-
-\fIdephandle\fP must not be the same as \fIhandle\fP, that makes this function
-return an error. It must be another easy handle, and it also needs to be a
-handle of a transfer that is about to be sent over the same HTTP/2 connection
-for this option to have an actual effect.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP/2
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-CURL *curl2 = curl_easy_init(); /* a second handle */
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/one");
-
-  /* the second depends on the first */
-  curl_easy_setopt(curl2, CURLOPT_URL, "https://example.com/two");
-  curl_easy_setopt(curl2, CURLOPT_STREAM_DEPENDS, curl);
-
-  /* then add both to a multi handle and transfer them! */
-}
-.fi
-.SH AVAILABILITY
-Added in 7.46.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_STREAM_WEIGHT "(3), " CURLOPT_STREAM_DEPENDS_E "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS.md
new file mode 100644
index 0000000000..e0e8ef0c53
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS.md
@@ -0,0 +1,87 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_STREAM_DEPENDS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_PIPELINING (3)
+  - CURLOPT_HTTP_VERSION (3)
+  - CURLOPT_STREAM_DEPENDS_E (3)
+  - CURLOPT_STREAM_WEIGHT (3)
+Protocol:
+  - HTTP
+Added-in: 7.46.0
+---
+
+# NAME
+
+CURLOPT_STREAM_DEPENDS - stream this transfer depends on
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_STREAM_DEPENDS,
+                          CURL *dephandle);
+~~~
+
+# DESCRIPTION
+
+Pass a CURL pointer in *dephandle* to identify the stream within the same
+connection that this stream is depending upon. This option clears the
+exclusive bit and is mutually exclusive to the CURLOPT_STREAM_DEPENDS_E(3)
+option.
+
+The spec says "Including a dependency expresses a preference to allocate
+resources to the identified stream rather than to the dependent stream."
+
+This option can be set during transfer.
+
+*dephandle* must not be the same as *handle*, that makes this function return
+an error. It must be another easy handle, and it also needs to be a handle of
+a transfer that is about to be sent over the same HTTP/2 connection for this
+option to have an actual effect.
+
+Since version 8.21.0 setting this option no longer has an effect. HTTP/2
+stream dependencies were introduced in RFC 7540 and then later deprecated
+in RFC 9113.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  CURL *curl2 = curl_easy_init(); /* a second handle */
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/one");
+
+    /* the second depends on the first */
+    curl_easy_setopt(curl2, CURLOPT_URL, "https://example.com/two");
+    curl_easy_setopt(curl2, CURLOPT_STREAM_DEPENDS, curl);
+
+    /* then add both to a multi handle and transfer them */
+  }
+}
+~~~
+
+# DEPRECATED
+
+Deprecated since 8.21.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS_E.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS_E.3
deleted file mode 100644
index c6f5a13e04..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS_E.3
+++ /dev/null
@@ -1,76 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_STREAM_DEPENDS_E 3 "13 Sep 2015" libcurl libcurl
-.SH NAME
-CURLOPT_STREAM_DEPENDS_E \- stream this transfer depends on exclusively
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_STREAM_DEPENDS_E,
-                          CURL *dephandle);
-.fi
-.SH DESCRIPTION
-Pass a CURL * pointer in \fIdephandle\fP to identify the stream within the
-same connection that this stream is depending upon exclusively. That means it
-depends on it and sets the Exclusive bit.
-
-The spec says "Including a dependency expresses a preference to allocate
-resources to the identified stream rather than to the dependent stream."
-
-Setting a dependency with the exclusive flag for a reprioritized stream causes
-all the dependencies of the new parent stream to become dependent on the
-reprioritized stream.
-
-This option can be set during transfer.
-
-\fIdephandle\fP must not be the same as \fIhandle\fP, that makes this function
-return an error. It must be another easy handle, and it also needs to be a
-handle of a transfer that is about to be sent over the same HTTP/2 connection
-for this option to have an actual effect.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP/2
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-CURL *curl2 = curl_easy_init(); /* a second handle */
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/one");
-
-  /* the second depends on the first */
-  curl_easy_setopt(curl2, CURLOPT_URL, "https://example.com/two");
-  curl_easy_setopt(curl2, CURLOPT_STREAM_DEPENDS_E, curl);
-
-  /* then add both to a multi handle and transfer them! */
-}
-.fi
-.SH AVAILABILITY
-Added in 7.46.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_STREAM_WEIGHT "(3), " CURLOPT_STREAM_DEPENDS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS_E.md b/third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS_E.md
new file mode 100644
index 0000000000..fe8f97f950
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS_E.md
@@ -0,0 +1,90 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_STREAM_DEPENDS_E
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_PIPELINING (3)
+  - CURLOPT_HTTP_VERSION (3)
+  - CURLOPT_STREAM_DEPENDS (3)
+  - CURLOPT_STREAM_WEIGHT (3)
+Protocol:
+  - HTTP
+Added-in: 7.46.0
+---
+
+# NAME
+
+CURLOPT_STREAM_DEPENDS_E - stream this transfer depends on exclusively
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_STREAM_DEPENDS_E,
+                          CURL *dephandle);
+~~~
+
+# DESCRIPTION
+
+Pass a `CURL` pointer in *dephandle* to identify the stream within the same
+connection that this stream is depending upon exclusively. That means it
+depends on it and sets the Exclusive bit.
+
+The spec says "Including a dependency expresses a preference to allocate
+resources to the identified stream rather than to the dependent stream."
+
+Setting a dependency with the exclusive flag for a reprioritized stream causes
+all the dependencies of the new parent stream to become dependent on the
+reprioritized stream.
+
+This option can be set during transfer.
+
+*dephandle* must not be the same as *handle*, that makes this function return
+an error. It must be another easy handle, and it also needs to be a handle of
+a transfer that is about to be sent over the same HTTP/2 connection for this
+option to have an actual effect.
+
+Since version 8.21.0 setting this option no longer has an effect. HTTP/2
+stream dependencies were introduced in RFC 7540 and then later deprecated
+in RFC 9113.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  CURL *curl2 = curl_easy_init(); /* a second handle */
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/one");
+
+    /* the second depends on the first */
+    curl_easy_setopt(curl2, CURLOPT_URL, "https://example.com/two");
+    curl_easy_setopt(curl2, CURLOPT_STREAM_DEPENDS_E, curl);
+
+    /* then add both to a multi handle and transfer them */
+  }
+}
+~~~
+
+# DEPRECATED
+
+Deprecated since 8.21.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_WEIGHT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_WEIGHT.3
deleted file mode 100644
index 7c12b9c1e0..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_WEIGHT.3
+++ /dev/null
@@ -1,78 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_STREAM_WEIGHT 3 "13 Sep 2015" libcurl libcurl
-.SH NAME
-CURLOPT_STREAM_WEIGHT \- numerical stream weight
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_STREAM_WEIGHT, long weight);
-.fi
-.SH DESCRIPTION
-Set the long \fIweight\fP to a number between 1 and 256.
-
-When using HTTP/2, this option sets the individual weight for this particular
-stream used by the easy \fIhandle\fP. Setting and using weights only makes
-sense and is only usable when doing multiple streams over the same
-connections, which thus implies that you use \fICURLMOPT_PIPELINING(3)\fP.
-
-This option can be set during transfer and causes the updated weight info get
-sent to the server the next time an HTTP/2 frame is sent to the server.
-
-See section 5.3 of RFC 7540 for protocol details.
-
-Streams with the same parent should be allocated resources proportionally
-based on their weight. So if you have two streams going, stream A with weight
-16 and stream B with weight 32, stream B gets two thirds (32/48) of the
-available bandwidth (assuming the server can send off the data equally for
-both streams).
-.SH DEFAULT
-If nothing is set, the HTTP/2 protocol itself uses its own default which is
-16.
-.SH PROTOCOLS
-HTTP/2
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-CURL *curl2 = curl_easy_init(); /* a second handle */
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/one");
-  curl_easy_setopt(curl, CURLOPT_STREAM_WEIGHT, 10L);
-
-  /* the second has twice the weight */
-  curl_easy_setopt(curl2, CURLOPT_URL, "https://example.com/two");
-  curl_easy_setopt(curl2, CURLOPT_STREAM_WEIGHT, 20L);
-
-  /* then add both to a multi handle and transfer them! */
-}
-.fi
-.SH AVAILABILITY
-Added in 7.46.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_STREAM_DEPENDS "(3), " CURLOPT_STREAM_DEPENDS_E "(3), "
-.BR CURLOPT_PIPEWAIT "(3), " CURLMOPT_PIPELINING "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_WEIGHT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_WEIGHT.md
new file mode 100644
index 0000000000..2d450c4cb9
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_STREAM_WEIGHT.md
@@ -0,0 +1,82 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_STREAM_WEIGHT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLMOPT_PIPELINING (3)
+  - CURLOPT_PIPEWAIT (3)
+  - CURLOPT_STREAM_DEPENDS (3)
+  - CURLOPT_STREAM_DEPENDS_E (3)
+Protocol:
+  - HTTP
+Added-in: 7.46.0
+---
+
+# NAME
+
+CURLOPT_STREAM_WEIGHT - numerical stream weight
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_STREAM_WEIGHT, long weight);
+~~~
+
+# DESCRIPTION
+
+Set the long *weight* to a number between 1 and 256.
+
+When using HTTP/2, this option sets the individual weight for this particular
+stream used by the easy *handle*. Setting and using weights only makes
+sense and is only usable when doing multiple streams over the same
+connections, which thus implies that you use CURLMOPT_PIPELINING(3).
+
+This option can be set during transfer and causes the updated weight info get
+sent to the server the next time an HTTP/2 frame is sent to the server.
+
+See section 5.3 of RFC 7540 for protocol details.
+
+Streams with the same parent should be allocated resources proportionally
+based on their weight. If you have two streams going, stream A with weight 16
+and stream B with weight 32, stream B gets two thirds (32/48) of the available
+bandwidth (assuming the server can send off the data equally for both
+streams).
+
+# DEFAULT
+
+16
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  CURL *curl2 = curl_easy_init(); /* a second handle */
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/one");
+    curl_easy_setopt(curl, CURLOPT_STREAM_WEIGHT, 10L);
+
+    /* the second has twice the weight */
+    curl_easy_setopt(curl2, CURLOPT_URL, "https://example.com/two");
+    curl_easy_setopt(curl2, CURLOPT_STREAM_WEIGHT, 20L);
+
+    /* then add both to a multi handle and transfer them */
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SUPPRESS_CONNECT_HEADERS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_SUPPRESS_CONNECT_HEADERS.3
deleted file mode 100644
index f67a87df7b..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_SUPPRESS_CONNECT_HEADERS.3
+++ /dev/null
@@ -1,97 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_SUPPRESS_CONNECT_HEADERS 3 "13 February 2017" libcurl libcurl
-.SH NAME
-CURLOPT_SUPPRESS_CONNECT_HEADERS \- suppress proxy CONNECT response headers from user callbacks
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SUPPRESS_CONNECT_HEADERS, long onoff);
-.fi
-.SH DESCRIPTION
-When \fICURLOPT_HTTPPROXYTUNNEL(3)\fP is used and a CONNECT request is made,
-suppress proxy CONNECT response headers from the user callback functions
-\fICURLOPT_HEADERFUNCTION(3)\fP and \fICURLOPT_WRITEFUNCTION(3)\fP.
-
-Proxy CONNECT response headers can complicate header processing since it's
-essentially a separate set of headers. You can enable this option to suppress
-those headers.
-
-For example let's assume an HTTPS URL is to be retrieved via CONNECT. On
-success there would normally be two sets of headers, and each header line sent
-to the header function and/or the write function. The data given to the
-callbacks would look like this:
-
-.nf
-HTTP/1.1 200 Connection established
-{headers}...
-
-HTTP/1.1 200 OK
-Content-Type: application/json
-{headers}...
-
-{body}...
-.fi
-
-However by enabling this option the CONNECT response headers are suppressed, so
-the data given to the callbacks would look like this:
-
-.nf
-HTTP/1.1 200 OK
-Content-Type: application/json
-{headers}...
-
-{body}...
-.fi
-
-.SH DEFAULT
-0
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  curl_easy_setopt(curl, CURLOPT_HEADER, 1L);
-  curl_easy_setopt(curl, CURLOPT_PROXY, "http://foo:3128");
-  curl_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
-  curl_easy_setopt(curl, CURLOPT_SUPPRESS_CONNECT_HEADERS, 1L);
-
-  curl_easy_perform(curl);
-
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.54.0
-.SH RETURN VALUE
-CURLE_OK or an error such as CURLE_UNKNOWN_OPTION.
-.SH "SEE ALSO"
-.BR CURLOPT_HEADER "(3), " CURLOPT_PROXY "(3), "
-.BR CURLOPT_HTTPPROXYTUNNEL "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_SUPPRESS_CONNECT_HEADERS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_SUPPRESS_CONNECT_HEADERS.md
new file mode 100644
index 0000000000..b096fcb83f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_SUPPRESS_CONNECT_HEADERS.md
@@ -0,0 +1,103 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_SUPPRESS_CONNECT_HEADERS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HEADER (3)
+  - CURLOPT_HTTPPROXYTUNNEL (3)
+  - CURLOPT_PROXY (3)
+Protocol:
+  - All
+Added-in: 7.54.0
+---
+
+# NAME
+
+CURLOPT_SUPPRESS_CONNECT_HEADERS - suppress proxy CONNECT response headers
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SUPPRESS_CONNECT_HEADERS, long onoff);
+~~~
+
+# DESCRIPTION
+
+When CURLOPT_HTTPPROXYTUNNEL(3) is used and a CONNECT request is made,
+suppress proxy CONNECT response headers from the user callback functions
+CURLOPT_HEADERFUNCTION(3) and CURLOPT_WRITEFUNCTION(3).
+
+Proxy CONNECT response headers can complicate header processing since it is
+essentially a separate set of headers. You can enable this option to suppress
+those headers.
+
+For example let's assume an HTTPS URL is to be retrieved via CONNECT. On
+success there would normally be two sets of headers, and each header line sent
+to the header function and/or the write function. The data given to the
+callbacks would look like this:
+
+~~~c
+HTTP/1.1 200 Connection established
+{headers}
+...
+
+HTTP/1.1 200 OK
+Content-Type: application/json
+{headers}
+...
+
+{body}
+...
+~~~
+
+However by enabling this option the CONNECT response headers are suppressed,
+so the data given to the callbacks would look like this:
+
+~~~c
+HTTP/1.1 200 OK
+Content-Type: application/json
+{headers}
+...
+
+{body}
+...
+~~~
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    curl_easy_setopt(curl, CURLOPT_HEADER, 1L);
+    curl_easy_setopt(curl, CURLOPT_PROXY, "http://proxy.example:3128");
+    curl_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
+    curl_easy_setopt(curl, CURLOPT_SUPPRESS_CONNECT_HEADERS, 1L);
+
+    result = curl_easy_perform(curl);
+
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+CURLE_OK or an error such as CURLE_UNKNOWN_OPTION.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_FASTOPEN.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_FASTOPEN.3
deleted file mode 100644
index 06da3bf4c0..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_FASTOPEN.3
+++ /dev/null
@@ -1,63 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TCP_FASTOPEN 3 "16 Feb 2016" libcurl libcurl
-.SH NAME
-CURLOPT_TCP_FASTOPEN \- TCP Fast Open
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TCP_FASTOPEN, long enable);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter set to 1L to enable or 0 to disable.
-
-TCP Fast Open (RFC 7413) is a mechanism that allows data to be carried in the
-SYN and SYN-ACK packets and consumed by the receiving end during the initial
-connection handshake, saving up to one full round-trip time (RTT).
-
-Beware: the TLS session cache does not work when TCP Fast Open is enabled. TCP
-Fast Open is also known to be problematic on or across certain networks.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_TCP_FASTOPEN, 1L);
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.49.0. This option is currently only supported on Linux and macOS
-10.11 or later.
-.SH RETURN VALUE
-Returns CURLE_OK if fast open is supported by the operating system, otherwise
-returns CURLE_NOT_BUILT_IN.
-.SH SEE ALSO
-.BR CURLOPT_SSL_FALSESTART "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_FASTOPEN.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_FASTOPEN.md
new file mode 100644
index 0000000000..d27d1204de
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_FASTOPEN.md
@@ -0,0 +1,70 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TCP_FASTOPEN
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_SSL_FALSESTART (3)
+Protocol:
+  - TCP
+Added-in: 7.49.0
+---
+
+# NAME
+
+CURLOPT_TCP_FASTOPEN - TCP Fast Open
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TCP_FASTOPEN, long enable);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter set to 1L to enable or 0 to disable.
+
+TCP Fast Open (RFC 7413) is a mechanism that allows data to be carried in the
+SYN and SYN-ACK packets and consumed by the receiving end during the initial
+connection handshake, saving up to one full round-trip time (RTT).
+
+Beware: the TLS session cache does not work when TCP Fast Open is enabled. TCP
+Fast Open is also known to be problematic on or across certain networks.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_TCP_FASTOPEN, 1L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# NOTES
+
+This option is only supported on Linux and macOS 10.11 or later.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPALIVE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPALIVE.3
deleted file mode 100644
index 9ccb38573a..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPALIVE.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TCP_KEEPALIVE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_TCP_KEEPALIVE \- TCP keep-alive probing
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TCP_KEEPALIVE, long probe);
-.fi
-.SH DESCRIPTION
-Pass a long. If set to 1, TCP keepalive probes are used. The delay and
-frequency of these probes can be controlled by the
-\fICURLOPT_TCP_KEEPIDLE(3)\fP and \fICURLOPT_TCP_KEEPINTVL(3)\fP options,
-provided the operating system supports them. Set to 0 (default behavior) to
-disable keepalive probes
-.SH DEFAULT
-0
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* enable TCP keep-alive for this transfer */
-  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
-
-  /* keep-alive idle time to 120 seconds */
-  curl_easy_setopt(curl, CURLOPT_TCP_KEEPIDLE, 120L);
-
-  /* interval time between keep-alive probes: 60 seconds */
-  curl_easy_setopt(curl, CURLOPT_TCP_KEEPINTVL, 60L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.25.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_TCP_KEEPIDLE "(3), " CURLOPT_TCP_KEEPINTVL "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPALIVE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPALIVE.md
new file mode 100644
index 0000000000..cab2f2f4d8
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPALIVE.md
@@ -0,0 +1,79 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TCP_KEEPALIVE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_LOW_SPEED_LIMIT (3)
+  - CURLOPT_MAX_RECV_SPEED_LARGE (3)
+  - CURLOPT_TCP_KEEPIDLE (3)
+  - CURLOPT_TCP_KEEPINTVL (3)
+  - CURLOPT_TCP_KEEPCNT (3)
+Protocol:
+  - TCP
+Added-in: 7.25.0
+---
+
+# NAME
+
+CURLOPT_TCP_KEEPALIVE - TCP keep-alive probing
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TCP_KEEPALIVE, long probe);
+~~~
+
+# DESCRIPTION
+
+Pass a long. If set to 1, TCP keepalive probes are used. The delay and
+frequency of these probes can be controlled by the
+CURLOPT_TCP_KEEPIDLE(3), CURLOPT_TCP_KEEPINTVL(3), and CURLOPT_TCP_KEEPCNT(3)
+options, provided the operating system supports them. Set to 0 (default behavior)
+to disable keepalive probes.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* enable TCP keep-alive for this transfer */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+
+    /* keep-alive idle time to 120 seconds */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPIDLE, 120L);
+
+    /* interval time between keep-alive probes: 60 seconds */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPINTVL, 60L);
+
+    /* maximum number of keep-alive probes: 3 */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPCNT, 3L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPCNT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPCNT.md
new file mode 100644
index 0000000000..22959479cc
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPCNT.md
@@ -0,0 +1,79 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TCP_KEEPCNT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_TCP_KEEPALIVE (3)
+  - CURLOPT_TCP_KEEPIDLE (3)
+  - CURLOPT_TCP_KEEPINTVL (3)
+Protocol:
+  - TCP
+Added-in: 8.9.0
+---
+
+# NAME
+
+CURLOPT_TCP_KEEPCNT - Maximum number of TCP keep-alive probes
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TCP_KEEPCNT, long cnt);
+~~~
+
+# DESCRIPTION
+
+Pass a long. Sets the number of probes to send before dropping
+the connection. Not all operating systems support this option.
+(Added in 8.9.0)
+
+The maximum value this option accepts is INT_MAX or whatever your
+system allows.
+Any larger value is capped to this amount.
+
+# DEFAULT
+
+9
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* enable TCP keep-alive for this transfer */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+
+    /* set keep-alive idle time to 120 seconds */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPIDLE, 120L);
+
+    /* interval time between keep-alive probes: 60 seconds */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPINTVL, 60L);
+
+    /* maximum number of keep-alive probes: 3 */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPCNT, 3L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPIDLE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPIDLE.3
deleted file mode 100644
index a4e16be270..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPIDLE.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TCP_KEEPIDLE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_TCP_KEEPIDLE \- TCP keep-alive idle time wait
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TCP_KEEPIDLE, long delay);
-.fi
-.SH DESCRIPTION
-Pass a long. Sets the \fIdelay\fP, in seconds, to wait while the connection is
-idle before sending keepalive probes. Not all operating systems support this
-option.
-
-The maximum value this accepts is 2147483648. Any larger value is capped to
-this amount.
-.SH DEFAULT
-60
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* enable TCP keep-alive for this transfer */
-  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
-
-  /* set keep-alive idle time to 120 seconds */
-  curl_easy_setopt(curl, CURLOPT_TCP_KEEPIDLE, 120L);
-
-  /* interval time between keep-alive probes: 60 seconds */
-  curl_easy_setopt(curl, CURLOPT_TCP_KEEPINTVL, 60L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.25.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_TCP_KEEPALIVE "(3), " CURLOPT_TCP_KEEPINTVL "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPIDLE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPIDLE.md
new file mode 100644
index 0000000000..6ffaf05ad5
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPIDLE.md
@@ -0,0 +1,78 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TCP_KEEPIDLE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_TCP_KEEPALIVE (3)
+  - CURLOPT_TCP_KEEPINTVL (3)
+  - CURLOPT_TCP_KEEPCNT (3)
+Protocol:
+  - TCP
+Added-in: 7.25.0
+---
+
+# NAME
+
+CURLOPT_TCP_KEEPIDLE - TCP keep-alive idle time wait
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TCP_KEEPIDLE, long delay);
+~~~
+
+# DESCRIPTION
+
+Pass a long. Sets the *delay*, in seconds, to wait while the connection is
+idle before sending keepalive probes. Not all operating systems support this
+option.
+
+The maximum value this accepts is 2147483648. Any larger value is capped to
+this amount.
+
+# DEFAULT
+
+60
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* enable TCP keep-alive for this transfer */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+
+    /* set keep-alive idle time to 120 seconds */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPIDLE, 120L);
+
+    /* interval time between keep-alive probes: 60 seconds */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPINTVL, 60L);
+
+    /* maximum number of keep-alive probes: 3 */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPCNT, 3L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPINTVL.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPINTVL.3
deleted file mode 100644
index b5597da838..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPINTVL.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TCP_KEEPINTVL 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_TCP_KEEPINTVL \- TCP keep-alive interval
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TCP_KEEPINTVL, long interval);
-.fi
-.SH DESCRIPTION
-Pass a long. Sets the interval, in seconds, to wait between sending keepalive
-probes. Not all operating systems support this option. (Added in 7.25.0)
-
-The maximum value this accepts is 2147483648. Any larger value is capped to
-this amount.
-.SH DEFAULT
-60
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* enable TCP keep-alive for this transfer */
-  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
-
-  /* set keep-alive idle time to 120 seconds */
-  curl_easy_setopt(curl, CURLOPT_TCP_KEEPIDLE, 120L);
-
-  /* interval time between keep-alive probes: 60 seconds */
-  curl_easy_setopt(curl, CURLOPT_TCP_KEEPINTVL, 60L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_TCP_KEEPALIVE "(3), " CURLOPT_TCP_KEEPIDLE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPINTVL.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPINTVL.md
new file mode 100644
index 0000000000..f23278c6c5
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_KEEPINTVL.md
@@ -0,0 +1,77 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TCP_KEEPINTVL
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_TCP_KEEPALIVE (3)
+  - CURLOPT_TCP_KEEPIDLE (3)
+  - CURLOPT_TCP_KEEPCNT (3)
+Protocol:
+  - TCP
+Added-in: 7.25.0
+---
+
+# NAME
+
+CURLOPT_TCP_KEEPINTVL - TCP keep-alive interval
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TCP_KEEPINTVL, long interval);
+~~~
+
+# DESCRIPTION
+
+Pass a long. Sets the interval, in seconds, to wait between sending keepalive
+probes. Not all operating systems support this option.
+
+The maximum value this accepts is 2147483648. Any larger value is capped to
+this amount.
+
+# DEFAULT
+
+60
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* enable TCP keep-alive for this transfer */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+
+    /* set keep-alive idle time to 120 seconds */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPIDLE, 120L);
+
+    /* interval time between keep-alive probes: 60 seconds */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPINTVL, 60L);
+
+    /* maximum number of keep-alive probes: 3 */
+    curl_easy_setopt(curl, CURLOPT_TCP_KEEPCNT, 3L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_NODELAY.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_NODELAY.3
deleted file mode 100644
index d1dd97217a..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_NODELAY.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TCP_NODELAY 3 "30 Jun 2016" libcurl libcurl
-.SH NAME
-CURLOPT_TCP_NODELAY \- the TCP_NODELAY option
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TCP_NODELAY, long nodelay);
-.fi
-.SH DESCRIPTION
-Pass a long specifying whether the \fITCP_NODELAY\fP option is to be set or
-cleared (1L = set, 0 = clear). The option is set by default. This has no
-effect after the connection has been established.
-
-Setting this option to 1L disables TCP's Nagle algorithm on connections
-created using this handle. The purpose of this algorithm is to try to minimize
-the number of small packets on the network (where "small packets" means TCP
-segments less than the Maximum Segment Size for the network).
-
-Maximizing the amount of data sent per TCP segment is good because it
-amortizes the overhead of the send. However, in some cases small segments may
-need to be sent without delay. This is less efficient than sending larger
-amounts of data at a time, and can contribute to congestion on the network if
-overdone.
-.SH DEFAULT
-1
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  /* leave Nagle enabled */
-  curl_easy_setopt(curl, CURLOPT_TCP_NODELAY, 0);
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always. The default was changed to 1 from 0 in 7.50.2.
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_SOCKOPTFUNCTION "(3), " CURLOPT_TCP_KEEPALIVE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_NODELAY.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_NODELAY.md
new file mode 100644
index 0000000000..74a49527b3
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TCP_NODELAY.md
@@ -0,0 +1,78 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TCP_NODELAY
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_BUFFERSIZE (3)
+  - CURLOPT_SOCKOPTFUNCTION (3)
+  - CURLOPT_TCP_KEEPALIVE (3)
+Protocol:
+  - TCP
+Added-in: 7.11.2
+---
+
+# NAME
+
+CURLOPT_TCP_NODELAY - the TCP_NODELAY option
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TCP_NODELAY, long nodelay);
+~~~
+
+# DESCRIPTION
+
+Pass a long specifying whether the *TCP_NODELAY* option is to be set or
+cleared (1L = set, 0 = clear). The option is set by default. This has no
+effect after the connection has been established.
+
+Setting this option to 1L disables the Nagle algorithm on connections created
+using this handle. The purpose of this algorithm is to minimize the number of
+small packets on the network (where "small packets" means TCP segments less
+than the Maximum Segment Size for the network).
+
+Maximizing the amount of data sent per TCP segment is good because it
+amortizes the overhead of the send. In some cases small segments may need to
+be sent without delay. This is less efficient than sending larger amounts of
+data at a time, and can contribute to congestion on the network if overdone.
+
+# DEFAULT
+
+1
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    /* leave Nagle enabled */
+    curl_easy_setopt(curl, CURLOPT_TCP_NODELAY, 0L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+The default was changed to 1 from 0 in 7.50.2.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TELNETOPTIONS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TELNETOPTIONS.3
deleted file mode 100644
index c2c106511d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TELNETOPTIONS.3
+++ /dev/null
@@ -1,63 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TELNETOPTIONS 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_TELNETOPTIONS \- set of telnet options
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TELNETOPTIONS,
-                          struct curl_slist *cmds);
-.fi
-.SH DESCRIPTION
-Provide a pointer to a curl_slist with variables to pass to the telnet
-negotiations. The variables should be in the format <option=value>. libcurl
-supports the options \fBTTYPE\fP, \fBXDISPLOC\fP and \fBNEW_ENV\fP. See the
-TELNET standard for details.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-TELNET
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  struct curl_slist *options;
-  options = curl_slist_append(NULL, "TTTYPE=vt100");
-  options = curl_slist_append(options, "USER=foobar");
-  curl_easy_setopt(curl, CURLOPT_URL, "telnet://example.com/");
-  curl_easy_setopt(curl, CURLOPT_TELNETOPTIONS, options);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-  curl_slist_free_all(options);
-}
-.fi
-.SH AVAILABILITY
-Along with TELNET
-.SH RETURN VALUE
-Returns CURLE_OK if TELNET is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_HTTPHEADER "(3), " CURLOPT_QUOTE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TELNETOPTIONS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TELNETOPTIONS.md
new file mode 100644
index 0000000000..8cab6200bc
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TELNETOPTIONS.md
@@ -0,0 +1,74 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TELNETOPTIONS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HTTPHEADER (3)
+  - CURLOPT_QUOTE (3)
+Protocol:
+  - TELNET
+Added-in: 7.7
+---
+
+# NAME
+
+CURLOPT_TELNETOPTIONS - set of telnet options
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TELNETOPTIONS,
+                          struct curl_slist *cmds);
+~~~
+
+# DESCRIPTION
+
+Provide a pointer to a curl_slist with variables to pass to the telnet
+negotiations. The variables should be in the format \<option=value\>. libcurl
+supports the options **TTYPE**, **XDISPLOC** and **NEW_ENV**. See the TELNET
+standard for details.
+
+Using this option multiple times makes the last set list override the previous
+ones. Set it to NULL to disable its use again.
+
+libcurl does not copy the list, it needs to be kept around until after the
+transfer has completed.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    struct curl_slist *options;
+    options = curl_slist_append(NULL, "TTTYPE=vt100");
+    options = curl_slist_append(options, "USER=foobar");
+    curl_easy_setopt(curl, CURLOPT_URL, "telnet://example.com/");
+    curl_easy_setopt(curl, CURLOPT_TELNETOPTIONS, options);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+    curl_slist_free_all(options);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TFTP_BLKSIZE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TFTP_BLKSIZE.3
deleted file mode 100644
index 20881d6921..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TFTP_BLKSIZE.3
+++ /dev/null
@@ -1,61 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TFTP_BLKSIZE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_TFTP_BLKSIZE \- TFTP block size
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TFTP_BLKSIZE, long blocksize);
-.fi
-.SH DESCRIPTION
-Specify \fIblocksize\fP to use for TFTP data transmission. Valid range as per
-RFC 2348 is 8-65464 bytes. The default of 512 bytes is used if this option is
-not specified. The specified block size is only used if supported by the
-remote server. If the server does not return an option acknowledgment or
-returns an option acknowledgment with no block size, the default of 512 bytes
-is used.
-.SH DEFAULT
-512
-.SH PROTOCOLS
-TFTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "tftp://example.com/bootimage");
-  /* try using larger blocks */
-  curl_easy_setopt(curl, CURLOPT_TFTP_BLKSIZE, 2048L);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.19.4
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_MAXFILESIZE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TFTP_BLKSIZE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TFTP_BLKSIZE.md
new file mode 100644
index 0000000000..d2de3c19c7
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TFTP_BLKSIZE.md
@@ -0,0 +1,65 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TFTP_BLKSIZE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_MAXFILESIZE (3)
+Protocol:
+  - TFTP
+Added-in: 7.19.4
+---
+
+# NAME
+
+CURLOPT_TFTP_BLKSIZE - TFTP block size
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TFTP_BLKSIZE, long blocksize);
+~~~
+
+# DESCRIPTION
+
+Specify *blocksize* to use for TFTP data transmission. Valid range as per
+RFC 2348 is 8-65464 bytes. The default of 512 bytes is used if this option is
+not specified. The specified block size is only used if supported by the
+remote server. If the server does not return an option acknowledgment or
+returns an option acknowledgment with no block size, the default of 512 bytes
+is used.
+
+# DEFAULT
+
+512
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "tftp://example.com/bootimage");
+    /* try using larger blocks */
+    curl_easy_setopt(curl, CURLOPT_TFTP_BLKSIZE, 2048L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TFTP_NO_OPTIONS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TFTP_NO_OPTIONS.3
deleted file mode 100644
index fc3b3b3f81..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TFTP_NO_OPTIONS.3
+++ /dev/null
@@ -1,77 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TFTP_NO_OPTIONS 3 "23 Feb 2016" libcurl libcurl
-.SH NAME
-CURLOPT_TFTP_NO_OPTIONS \- send no TFTP options requests
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TFTP_NO_OPTIONS, long onoff);
-.fi
-.SH DESCRIPTION
-Set \fIonoff\fP to 1L to exclude all TFTP options defined in RFC 2347,
-RFC 2348 and RFC 2349 from read and write requests.
-
-This option improves interoperability with legacy servers that do not
-acknowledge or properly implement TFTP options. When this option is used
-\fICURLOPT_TFTP_BLKSIZE(3)\fP is ignored.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-TFTP
-.SH EXAMPLE
-.nf
-size_t write_callback(char *ptr, size_t size, size_t nmemb, void *fp)
-{
-  return fwrite(ptr, size, nmemb, (FILE *)fp);
-}
-
-CURL *curl = curl_easy_init();
-if(curl) {
-  FILE *fp = fopen("foo.bin", "wb");
-  if(fp) {
-    curl_easy_setopt(curl, CURLOPT_WRITEDATA, (void *)fp);
-    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_callback);
-
-    curl_easy_setopt(curl, CURLOPT_URL, "tftp://example.com/foo.bin");
-
-    /* do not send TFTP options requests */
-    curl_easy_setopt(curl, CURLOPT_TFTP_NO_OPTIONS, 1L);
-
-    /* Perform the request */
-    curl_easy_perform(curl);
-
-    fclose(fp);
-  }
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.48.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH SEE ALSO
-.BR CURLOPT_TFTP_BLKSIZE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TFTP_NO_OPTIONS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TFTP_NO_OPTIONS.md
new file mode 100644
index 0000000000..43f3317c01
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TFTP_NO_OPTIONS.md
@@ -0,0 +1,81 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TFTP_NO_OPTIONS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_TFTP_BLKSIZE (3)
+Protocol:
+  - TFTP
+Added-in: 7.48.0
+---
+
+# NAME
+
+CURLOPT_TFTP_NO_OPTIONS - send no TFTP options requests
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TFTP_NO_OPTIONS, long onoff);
+~~~
+
+# DESCRIPTION
+
+Set *onoff* to 1L to exclude all TFTP options defined in RFC 2347,
+RFC 2348 and RFC 2349 from read and write requests.
+
+This option improves interoperability with legacy servers that do not
+acknowledge or properly implement TFTP options. When this option is used
+CURLOPT_TFTP_BLKSIZE(3) is ignored.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+size_t write_callback(char *ptr, size_t size, size_t nmemb, void *fp)
+{
+  return fwrite(ptr, size, nmemb, (FILE *)fp);
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result = CURLE_OK;
+    FILE *fp = fopen("foo.bin", "wb");
+    if(fp) {
+      curl_easy_setopt(curl, CURLOPT_WRITEDATA, (void *)fp);
+      curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_callback);
+
+      curl_easy_setopt(curl, CURLOPT_URL, "tftp://example.com/foo.bin");
+
+      /* do not send TFTP options requests */
+      curl_easy_setopt(curl, CURLOPT_TFTP_NO_OPTIONS, 1L);
+
+      /* Perform the request */
+      result = curl_easy_perform(curl);
+
+      fclose(fp);
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TIMECONDITION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TIMECONDITION.3
deleted file mode 100644
index f1b971ce01..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TIMECONDITION.3
+++ /dev/null
@@ -1,70 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TIMECONDITION 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_TIMECONDITION \- select condition for a time request
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TIMECONDITION, long cond);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter. This defines how the \fICURLOPT_TIMEVALUE(3)\fP time
-value is treated. You can set this parameter to \fICURL_TIMECOND_IFMODSINCE\fP
-or \fICURL_TIMECOND_IFUNMODSINCE\fP.
-
-The last modification time of a file is not always known and in such instances
-this feature has no effect even if the given time condition would not have
-been met. \fIcurl_easy_getinfo(3)\fP with the \fICURLINFO_CONDITION_UNMET\fP
-option can be used after a transfer to learn if a zero-byte successful
-"transfer" was due to this condition not matching.
-.SH DEFAULT
-CURL_TIMECOND_NONE (0)
-.SH PROTOCOLS
-HTTP, FTP, RTSP, and FILE
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* January 1, 2020 is 1577833200 */
-  curl_easy_setopt(curl, CURLOPT_TIMEVALUE, 1577833200L);
-
-  /* If-Modified-Since the above time stamp */
-  curl_easy_setopt(curl, CURLOPT_TIMECONDITION,
-                   (long)CURL_TIMECOND_IFMODSINCE);
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_TIMEVALUE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TIMECONDITION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TIMECONDITION.md
new file mode 100644
index 0000000000..3ebfb10386
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TIMECONDITION.md
@@ -0,0 +1,82 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TIMECONDITION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_FILETIME (3)
+  - CURLOPT_TIMEVALUE (3)
+Protocol:
+  - HTTP
+  - FILE
+  - FTP
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_TIMECONDITION - select condition for a time request
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TIMECONDITION, long cond);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter. This defines how the CURLOPT_TIMEVALUE(3) time value
+is treated. You can set this parameter to *CURL_TIMECOND_IFMODSINCE* or
+*CURL_TIMECOND_IFUNMODSINCE*.
+
+The last modification time of a file is not always known and in such instances
+this feature has no effect even if the given time condition would not have
+been met. curl_easy_getinfo(3) with the *CURLINFO_CONDITION_UNMET* option can
+be used after a transfer to learn if a zero-byte successful "transfer" was due
+to this condition not matching.
+
+# DEFAULT
+
+CURL_TIMECOND_NONE (0)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* January 1, 2020 is 1577833200 */
+    curl_easy_setopt(curl, CURLOPT_TIMEVALUE, 1577833200L);
+
+    /* If-Modified-Since the above time stamp */
+    curl_easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE);
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURL_TIMECOND_*** enums became `long` types in 8.13.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEOUT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEOUT.3
deleted file mode 100644
index e45fbefa5d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEOUT.3
+++ /dev/null
@@ -1,87 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TIMEOUT 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_TIMEOUT \- maximum time the transfer is allowed to complete
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TIMEOUT, long timeout);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter containing \fItimeout\fP - the maximum time in
-seconds that you allow the entire transfer operation to take. The whole thing,
-from start to end. Normally, name lookups can take a considerable time and
-limiting operations risk aborting perfectly normal operations.
-
-\fICURLOPT_TIMEOUT_MS(3)\fP is the same function but set in milliseconds.
-
-If both \fICURLOPT_TIMEOUT(3)\fP and \fICURLOPT_TIMEOUT_MS(3)\fP are set, the
-value set last is used.
-
-Since this option puts a hard limit on how long time a request is allowed to
-take, it has limited use in dynamic use cases with varying transfer
-times. That is especially apparent when using the multi interface, which may
-queue the transfer, and that time is included. You are advised to explore
-\fICURLOPT_LOW_SPEED_LIMIT(3)\fP, \fICURLOPT_LOW_SPEED_TIME(3)\fP or using
-\fICURLOPT_PROGRESSFUNCTION(3)\fP to implement your own timeout logic.
-
-The connection timeout set with \fICURLOPT_CONNECTTIMEOUT(3)\fP is included in
-this general all-covering timeout.
-
-With \fICURLOPT_CONNECTTIMEOUT(3)\fP set to 3 and \fICURLOPT_TIMEOUT(3)\fP set
-to 5, the operation can never last longer than 5 seconds.
-
-With \fICURLOPT_CONNECTTIMEOUT(3)\fP set to 4 and \fICURLOPT_TIMEOUT(3)\fP set
-to 2, the operation can never last longer than 2 seconds.
-
-This option may cause libcurl to use the SIGALRM signal to timeout system
-calls on builds not using asynch DNS. In unix-like systems, this might cause
-signals to be used unless \fICURLOPT_NOSIGNAL(3)\fP is set.
-.SH DEFAULT
-Default timeout is 0 (zero) which means it never times out during transfer.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* complete within 20 seconds */
-  curl_easy_setopt(curl, CURLOPT_TIMEOUT, 20L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK. Returns CURLE_BAD_FUNCTION_ARGUMENT if set to a negative
-value or a value that when converted to milliseconds is too large.
-.SH "SEE ALSO"
-.BR CURLOPT_TIMEOUT_MS "(3), "
-.BR CURLOPT_CONNECTTIMEOUT "(3), " CURLOPT_LOW_SPEED_LIMIT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEOUT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEOUT.md
new file mode 100644
index 0000000000..4058dd4cb7
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEOUT.md
@@ -0,0 +1,93 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TIMEOUT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CONNECTTIMEOUT (3)
+  - CURLOPT_LOW_SPEED_LIMIT (3)
+  - CURLOPT_TCP_KEEPALIVE (3)
+  - CURLOPT_TIMEOUT_MS (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_TIMEOUT - maximum time the transfer is allowed to complete
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TIMEOUT, long timeout);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter containing *timeout* - the maximum time in
+seconds that you allow the entire transfer operation to take. The whole thing,
+from start to end. Normally, name lookups can take a considerable time and
+limiting operations risk aborting perfectly normal operations.
+
+CURLOPT_TIMEOUT_MS(3) is the same function but set in milliseconds.
+
+If both CURLOPT_TIMEOUT(3) and CURLOPT_TIMEOUT_MS(3) are set, the
+value set last is used.
+
+Since this option puts a hard limit on how long time a request is allowed to
+take, it has limited use in dynamic use cases with varying transfer
+times. That is especially apparent when using the multi interface, which may
+queue the transfer, and that time is included. You are advised to explore
+CURLOPT_LOW_SPEED_LIMIT(3), CURLOPT_LOW_SPEED_TIME(3) or using
+CURLOPT_PROGRESSFUNCTION(3) to implement your own timeout logic.
+
+The connection timeout set with CURLOPT_CONNECTTIMEOUT(3) is included in
+this general all-covering timeout.
+
+With CURLOPT_CONNECTTIMEOUT(3) set to 3 and CURLOPT_TIMEOUT(3) set
+to 5, the operation can never last longer than 5 seconds.
+
+With CURLOPT_CONNECTTIMEOUT(3) set to 4 and CURLOPT_TIMEOUT(3) set
+to 2, the operation can never last longer than 2 seconds.
+
+This option may cause libcurl to use the SIGALRM signal to timeout system
+calls on builds not using asynch DNS. In Unix-like systems, this might cause
+signals to be used unless CURLOPT_NOSIGNAL(3) is set.
+
+# DEFAULT
+
+0 (zero) which means it never times out during transfer.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* complete within 20 seconds */
+    curl_easy_setopt(curl, CURLOPT_TIMEOUT, 20L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEOUT_MS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEOUT_MS.3
deleted file mode 100644
index 3017bd3079..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEOUT_MS.3
+++ /dev/null
@@ -1,61 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TIMEOUT_MS 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_TIMEOUT_MS \- maximum time the transfer is allowed to complete
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TIMEOUT_MS, long timeout);
-.fi
-.SH DESCRIPTION
-Pass a long as parameter containing \fItimeout\fP - the maximum time in
-milliseconds that you allow the libcurl transfer operation to take.
-
-See \fICURLOPT_TIMEOUT(3)\fP for details.
-.SH DEFAULT
-Default timeout is 0 (zero) which means it never times out during transfer.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* complete within 20000 milliseconds */
-  curl_easy_setopt(curl, CURLOPT_TIMEOUT_MS, 20000L);
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_TIMEOUT "(3), "
-.BR CURLOPT_CONNECTTIMEOUT "(3), " CURLOPT_LOW_SPEED_LIMIT "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEOUT_MS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEOUT_MS.md
new file mode 100644
index 0000000000..11e3403002
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEOUT_MS.md
@@ -0,0 +1,68 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TIMEOUT_MS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CONNECTTIMEOUT (3)
+  - CURLOPT_LOW_SPEED_LIMIT (3)
+  - CURLOPT_TCP_KEEPALIVE (3)
+  - CURLOPT_TIMEOUT (3)
+Protocol:
+  - All
+Added-in: 7.16.2
+---
+
+# NAME
+
+CURLOPT_TIMEOUT_MS - maximum time the transfer is allowed to complete
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TIMEOUT_MS, long timeout);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter containing *timeout* - the maximum time in
+milliseconds that you allow the libcurl transfer operation to take.
+
+See CURLOPT_TIMEOUT(3) for details.
+
+# DEFAULT
+
+0 (zero) which means it never times out during transfer.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* complete within 20000 milliseconds */
+    curl_easy_setopt(curl, CURLOPT_TIMEOUT_MS, 20000L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEVALUE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEVALUE.3
deleted file mode 100644
index 3b58077f25..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEVALUE.3
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TIMEVALUE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_TIMEVALUE \- time value for conditional
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TIMEVALUE, long val);
-.fi
-.SH DESCRIPTION
-Pass a long \fIval\fP as parameter. This should be the time counted as seconds
-since 1 Jan 1970, and the time is used in a condition as specified with
-\fICURLOPT_TIMECONDITION(3)\fP.
-
-On systems with 32 bit 'long' variables (such as Windows), this option cannot
-set dates beyond the year 2038. Consider \fICURLOPT_TIMEVALUE_LARGE(3)\fP
-instead.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-HTTP, FTP, RTSP, and FILE
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* January 1, 2020 is 1577833200 */
-  curl_easy_setopt(curl, CURLOPT_TIMEVALUE, 1577833200L);
-
-  /* If-Modified-Since the above time stamp */
-  curl_easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE);
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_TIMECONDITION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEVALUE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEVALUE.md
new file mode 100644
index 0000000000..e28ccf5d23
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEVALUE.md
@@ -0,0 +1,78 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TIMEVALUE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_TIMECONDITION (3)
+  - CURLOPT_TIMEVALUE_LARGE (3)
+Protocol:
+  - HTTP
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_TIMEVALUE - time value for conditional
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TIMEVALUE, long val);
+~~~
+
+# DESCRIPTION
+
+Pass a long *val* as parameter. This should be the time counted as seconds
+since 1 Jan 1970, and the time is used in a condition as specified with
+CURLOPT_TIMECONDITION(3).
+
+On systems with 32-bit 'long' variables (such as Windows), this option cannot
+set dates beyond the year 2038. Consider CURLOPT_TIMEVALUE_LARGE(3)
+instead.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* January 1, 2020 is 1577833200 */
+    curl_easy_setopt(curl, CURLOPT_TIMEVALUE, 1577833200L);
+
+    /* If-Modified-Since the above time stamp */
+    curl_easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE);
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURL_TIMECOND_*** enums became `long` types in 8.13.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEVALUE_LARGE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEVALUE_LARGE.3
deleted file mode 100644
index 1afd20f8bc..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEVALUE_LARGE.3
+++ /dev/null
@@ -1,69 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TIMEVALUE_LARGE 3 "25 Jan 2018" libcurl libcurl
-.SH NAME
-CURLOPT_TIMEVALUE_LARGE \- time value for conditional
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TIMEVALUE_LARGE,
-                          curl_off_t val);
-.fi
-.SH DESCRIPTION
-Pass a curl_off_t \fIval\fP as parameter. This should be the time counted as
-seconds since 1 Jan 1970, and the time is used in a condition as specified
-with \fICURLOPT_TIMECONDITION(3)\fP.
-
-The difference between this option and \fICURLOPT_TIMEVALUE(3)\fP is the type
-of the argument. On systems where 'long' is only 32 bit wide, this option has
-to be used to set dates beyond the year 2038.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-HTTP, FTP, RTSP, and FILE
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* January 1, 2020 is 1577833200 */
-  curl_easy_setopt(curl, CURLOPT_TIMEVALUE_LARGE, (curl_off_t)1577833200);
-
-  /* If-Modified-Since the above time stamp */
-  curl_easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE);
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.59.0.
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_TIMECONDITION "(3), "
-.BR CURLOPT_TIMEVALUE_LARGE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEVALUE_LARGE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEVALUE_LARGE.md
new file mode 100644
index 0000000000..385b067b18
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TIMEVALUE_LARGE.md
@@ -0,0 +1,80 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TIMEVALUE_LARGE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_FILETIME (3)
+  - CURLOPT_TIMECONDITION (3)
+  - CURLOPT_TIMEVALUE (3)
+Protocol:
+  - HTTP
+Added-in: 7.59.0
+---
+
+# NAME
+
+CURLOPT_TIMEVALUE_LARGE - time value for conditional
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TIMEVALUE_LARGE,
+                          curl_off_t val);
+~~~
+
+# DESCRIPTION
+
+Pass a curl_off_t *val* as parameter. This should be the time counted as
+seconds since 1 Jan 1970, and the time is used in a condition as specified
+with CURLOPT_TIMECONDITION(3).
+
+The difference between this option and CURLOPT_TIMEVALUE(3) is the type of the
+argument. On systems where 'long' is only 32 bits wide, this option has to be
+used to set dates beyond the year 2038.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* January 1, 2020 is 1577833200 */
+    curl_easy_setopt(curl, CURLOPT_TIMEVALUE_LARGE, (curl_off_t)1577833200);
+
+    /* If-Modified-Since the above time stamp */
+    curl_easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE);
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURL_TIMECOND_*** enums became `long` types in 8.13.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TLS13_CIPHERS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TLS13_CIPHERS.3
deleted file mode 100644
index d5aac1d9c9..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TLS13_CIPHERS.3
+++ /dev/null
@@ -1,74 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TLS13_CIPHERS 3 "25 May 2018" libcurl libcurl
-.SH NAME
-CURLOPT_TLS13_CIPHERS \- ciphers suites to use for TLS 1.3
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TLS13_CIPHERS, char *list);
-.fi
-.SH DESCRIPTION
-Pass a char *, pointing to a null-terminated string holding the list of cipher
-suites to use for the TLS 1.3 connection. The list must be syntactically
-correct, it consists of one or more cipher suite strings separated by colons.
-
-Find more details about cipher lists on this URL:
-
- https://curl.se/docs/ssl-ciphers.html
-
-This option is currently used only when curl is built to use OpenSSL 1.1.1 or
-later, or Schannel. If you are using a different SSL backend you can try
-setting TLS 1.3 cipher suites by using the \fICURLOPT_SSL_CIPHER_LIST(3)\fP
-option.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL, use internal default
-.SH PROTOCOLS
-All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_TLS13_CIPHERS,
-                   "TLS_CHACHA20_POLY1305_SHA256");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.61.0 for OpenSSL. Available when built with OpenSSL >= 1.1.1.
-
-Added in 7.85.0 for Schannel.
-.SH RETURN VALUE
-Returns CURLE_OK if supported, CURLE_NOT_BUILT_IN otherwise.
-.SH "SEE ALSO"
-.BR CURLOPT_SSL_CIPHER_LIST "(3), " CURLOPT_SSLVERSION "(3), "
-.BR CURLOPT_PROXY_SSL_CIPHER_LIST "(3), " CURLOPT_PROXY_TLS13_CIPHERS "(3), "
-.BR CURLOPT_PROXY_SSLVERSION "(3), " CURLOPT_USE_SSL "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TLS13_CIPHERS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TLS13_CIPHERS.md
new file mode 100644
index 0000000000..07dcc79c64
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TLS13_CIPHERS.md
@@ -0,0 +1,101 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TLS13_CIPHERS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_SSLVERSION (3)
+  - CURLOPT_PROXY_SSL_CIPHER_LIST (3)
+  - CURLOPT_PROXY_TLS13_CIPHERS (3)
+  - CURLOPT_SSLVERSION (3)
+  - CURLOPT_SSL_CIPHER_LIST (3)
+  - CURLOPT_USE_SSL (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - wolfSSL
+  - mbedTLS
+  - Rustls
+Added-in: 7.61.0
+---
+
+# NAME
+
+CURLOPT_TLS13_CIPHERS - ciphers suites to use for TLS 1.3
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TLS13_CIPHERS, char *list);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer, pointing to a null-terminated string holding the list of
+cipher suites to use for the TLS 1.3 connection. The list must be
+syntactically correct, it consists of one or more cipher suite strings
+separated by colons.
+
+For setting TLS 1.2 (1.1, 1.0) ciphers see CURLOPT_SSL_CIPHER_LIST(3).
+
+A valid example of a cipher list is:
+~~~c
+"TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256"
+~~~
+
+Find more details about cipher lists on this URL:
+
+ https://curl.se/docs/ssl-ciphers.html
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to restore to internal default.
+
+# DEFAULT
+
+NULL, use internal built-in
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_TLS13_CIPHERS,
+                     "TLS_CHACHA20_POLY1305_SHA256");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+OpenSSL support added in 7.61.0, available when built with OpenSSL \>= 1.1.1.
+LibreSSL support added in 8.3.0, available when built with LibreSSL \>= 3.4.1.
+wolfSSL support added in 8.10.0.
+mbedTLS support added in 8.10.0, available when built with mbedTLS \>= 3.6.0.
+Rustls support added in 8.10.0.
+
+Before curl 8.10.0 with mbedTLS or wolfSSL, TLS 1.3 cipher suites were set
+by using the CURLOPT_SSL_CIPHER_LIST(3) option.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_PASSWORD.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_PASSWORD.3
deleted file mode 100644
index df9e3780df..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_PASSWORD.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TLSAUTH_PASSWORD 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_TLSAUTH_PASSWORD \- password to use for TLS authentication
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TLSAUTH_PASSWORD, char *pwd);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter, which should point to the null-terminated password
-to use for the TLS authentication method specified with the
-\fICURLOPT_TLSAUTH_TYPE(3)\fP option. Requires that the
-\fICURLOPT_TLSAUTH_USERNAME(3)\fP option also be set.
-
-The application does not have to keep the string around after setting this
-option.
-
-This feature relies in TLS SRP which does not work with TLS 1.3.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS-based protocols
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_TLSAUTH_TYPE, "SRP");
-  curl_easy_setopt(curl, CURLOPT_TLSAUTH_USERNAME, "user");
-  curl_easy_setopt(curl, CURLOPT_TLSAUTH_PASSWORD, "secret");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.21.4, with the OpenSSL and GnuTLS backends only
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_TLSAUTH_TYPE "(3), " CURLOPT_TLSAUTH_USERNAME "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_PASSWORD.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_PASSWORD.md
new file mode 100644
index 0000000000..89dd79ebc9
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_PASSWORD.md
@@ -0,0 +1,77 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TLSAUTH_PASSWORD
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_TLSAUTH_PASSWORD (3)
+  - CURLOPT_TLSAUTH_TYPE (3)
+  - CURLOPT_TLSAUTH_USERNAME (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+Added-in: 7.21.4
+---
+
+# NAME
+
+CURLOPT_TLSAUTH_PASSWORD - password to use for TLS authentication
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TLSAUTH_PASSWORD, char *pwd);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter, which should point to the null-terminated
+password to use for the TLS authentication method specified with the
+CURLOPT_TLSAUTH_TYPE(3) option. Requires that the CURLOPT_TLSAUTH_USERNAME(3)
+option also be set.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+This feature relies on TLS-SRP which does not work with TLS 1.3.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_TLSAUTH_TYPE, "SRP");
+    curl_easy_setopt(curl, CURLOPT_TLSAUTH_USERNAME, "user");
+    curl_easy_setopt(curl, CURLOPT_TLSAUTH_PASSWORD, "secret");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_TYPE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_TYPE.3
deleted file mode 100644
index 6f87657bc1..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_TYPE.3
+++ /dev/null
@@ -1,71 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TLSAUTH_TYPE 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_TLSAUTH_TYPE \- TLS authentication methods
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TLSAUTH_TYPE, char *type);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter. The string should be
-the method of the TLS authentication. Supported method is "SRP".
-
-.IP SRP
-TLS-SRP authentication. Secure Remote Password authentication for TLS is
-defined in RFC 5054 and provides mutual authentication if both sides have a
-shared secret. To use TLS-SRP, you must also set the
-\fICURLOPT_TLSAUTH_USERNAME(3)\fP and \fICURLOPT_TLSAUTH_PASSWORD(3)\fP
-options.
-
-The application does not have to keep the string around after setting this
-option.
-
-TLS SRP does not work with TLS 1.3.
-.SH DEFAULT
-blank
-.SH PROTOCOLS
-All TLS-based protocols
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_TLSAUTH_TYPE, "SRP");
-  curl_easy_setopt(curl, CURLOPT_TLSAUTH_USERNAME, "user");
-  curl_easy_setopt(curl, CURLOPT_TLSAUTH_PASSWORD, "secret");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-You need to build libcurl with GnuTLS or OpenSSL with TLS-SRP support for this
-to work. Added in 7.21.4
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_TLSAUTH_USERNAME "(3), " CURLOPT_TLSAUTH_PASSWORD "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_TYPE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_TYPE.md
new file mode 100644
index 0000000000..35ae6bf467
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_TYPE.md
@@ -0,0 +1,81 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TLSAUTH_TYPE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_TLSAUTH_PASSWORD (3)
+  - CURLOPT_TLSAUTH_USERNAME (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+Added-in: 7.21.4
+---
+
+# NAME
+
+CURLOPT_TLSAUTH_TYPE - TLS authentication methods
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TLSAUTH_TYPE, char *type);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter. The string should be
+the method of the TLS authentication. Supported method is "SRP".
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to restore to internal default.
+
+The application does not have to keep the string around after setting this
+option.
+
+## SRP
+
+TLS-SRP authentication. Secure Remote Password authentication for TLS is
+defined in RFC 5054 and provides mutual authentication if both sides have a
+shared secret. To use TLS-SRP, you must also set the
+CURLOPT_TLSAUTH_USERNAME(3) and CURLOPT_TLSAUTH_PASSWORD(3) options.
+
+TLS-SRP does not work with TLS 1.3.
+
+# DEFAULT
+
+blank
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_TLSAUTH_TYPE, "SRP");
+    curl_easy_setopt(curl, CURLOPT_TLSAUTH_USERNAME, "user");
+    curl_easy_setopt(curl, CURLOPT_TLSAUTH_PASSWORD, "secret");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_USERNAME.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_USERNAME.3
deleted file mode 100644
index d7868e04b1..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_USERNAME.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TLSAUTH_USERNAME 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_TLSAUTH_USERNAME \- user name to use for TLS authentication
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TLSAUTH_USERNAME, char *user);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter, which should point to the null-terminated username
-to use for the TLS authentication method specified with the
-\fICURLOPT_TLSAUTH_TYPE(3)\fP option. Requires that the
-\fICURLOPT_TLSAUTH_PASSWORD(3)\fP option also be set.
-
-The application does not have to keep the string around after setting this
-option.
-
-This feature relies in TLS SRP which does not work with TLS 1.3.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-All TLS-based protocols
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  curl_easy_setopt(curl, CURLOPT_TLSAUTH_TYPE, "SRP");
-  curl_easy_setopt(curl, CURLOPT_TLSAUTH_USERNAME, "user");
-  curl_easy_setopt(curl, CURLOPT_TLSAUTH_PASSWORD, "secret");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.21.4, with the OpenSSL and GnuTLS backends only
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_TLSAUTH_TYPE "(3), " CURLOPT_TLSAUTH_PASSWORD "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_USERNAME.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_USERNAME.md
new file mode 100644
index 0000000000..b1d352e80e
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TLSAUTH_USERNAME.md
@@ -0,0 +1,76 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TLSAUTH_USERNAME
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_TLSAUTH_PASSWORD (3)
+  - CURLOPT_TLSAUTH_TYPE (3)
+Protocol:
+  - TLS
+TLS-backend:
+  - OpenSSL
+  - GnuTLS
+Added-in: 7.21.4
+---
+
+# NAME
+
+CURLOPT_TLSAUTH_USERNAME - username to use for TLS authentication
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TLSAUTH_USERNAME, char *user);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter, which should point to the null-terminated
+username to use for the TLS authentication method specified with the
+CURLOPT_TLSAUTH_TYPE(3) option. Requires that the CURLOPT_TLSAUTH_PASSWORD(3)
+option also be set.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+This feature relies on TLS-SRP which does not work with TLS 1.3.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    curl_easy_setopt(curl, CURLOPT_TLSAUTH_TYPE, "SRP");
+    curl_easy_setopt(curl, CURLOPT_TLSAUTH_USERNAME, "user");
+    curl_easy_setopt(curl, CURLOPT_TLSAUTH_PASSWORD, "secret");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TRAILERDATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TRAILERDATA.3
deleted file mode 100644
index ef2ea56169..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TRAILERDATA.3
+++ /dev/null
@@ -1,55 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TRAILERDATA 3 "14 Aug 2018" libcurl libcurl
-.SH NAME
-CURLOPT_TRAILERDATA \- pointer passed to trailing headers callback
-.SH SYNOPSIS
-.nf
-#include <curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TRAILERDATA, void *userdata);
-.fi
-.SH DESCRIPTION
-Data pointer to be passed to the HTTP trailer callback function.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-/* Assuming we have a CURL handle in the hndl variable. */
-
-struct MyData data;
-
-curl_easy_setopt(hndl, CURLOPT_TRAILERDATA, &data);
-.fi
-
-A more complete example can be found in examples/http_trailers.html
-.SH AVAILABILITY
-This option was added in curl 7.64.0 and is present if HTTP support is enabled
-.SH RETURN VALUE
-Returns CURLE_OK.
-.SH "SEE ALSO"
-.BR CURLOPT_TRAILERFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TRAILERDATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TRAILERDATA.md
new file mode 100644
index 0000000000..3b1b78f142
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TRAILERDATA.md
@@ -0,0 +1,61 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TRAILERDATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_TRAILERFUNCTION (3)
+  - CURLOPT_WRITEFUNCTION (3)
+Protocol:
+  - HTTP
+Added-in: 7.64.0
+---
+
+# NAME
+
+CURLOPT_TRAILERDATA - pointer passed to trailing headers callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TRAILERDATA, void *userdata);
+~~~
+
+# DESCRIPTION
+
+Data pointer to be passed to the HTTP trailer callback function.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct MyData {
+  void *custom;
+};
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    struct MyData data;
+    curl_easy_setopt(curl, CURLOPT_TRAILERDATA, &data);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TRAILERFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TRAILERFUNCTION.3
deleted file mode 100644
index 4895592c08..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TRAILERFUNCTION.3
+++ /dev/null
@@ -1,108 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TRAILERFUNCTION 3 "14 Aug 2018" libcurl libcurl
-.SH NAME
-CURLOPT_TRAILERFUNCTION \- callback for sending trailing headers
-.SH SYNOPSIS
-.nf
-#include <curl.h>
-
-int curl_trailer_callback(struct curl_slist ** list, void *userdata);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TRAILERFUNCTION,
-                          curl_trailer_callback *func);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a callback function.
-
-This callback function is called once right before sending the final CR LF in
-an HTTP chunked transfer to fill a list of trailing headers to be sent before
-finishing the HTTP transfer.
-
-You can set the userdata argument with the \fICURLOPT_TRAILERDATA(3)\fP
-option.
-
-The trailing headers included in the linked list must not be CRLF-terminated,
-because libcurl adds the appropriate line termination characters after each
-header item.
-
-If you use curl_slist_append to add trailing headers to the curl_slist then
-libcurl duplicates the strings, and frees the curl_slist and the duplicates
-once the trailers have been sent.
-
-If one of the trailing header fields is not formatted correctly it is ignored
-and an info message is emitted.
-
-The return value can either be \fBCURL_TRAILERFUNC_OK\fP or
-\fBCURL_TRAILERFUNC_ABORT\fP which would respectively instruct libcurl to
-either continue with sending the trailers or to abort the request.
-
-If you set this option to NULL, then the transfer proceeds as usual
-without any interruptions.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-#include <curl/curl.h>
-
-static int trailer_cb(struct curl_slist **tr, void *data)
-{
-  /* libcurl frees the list */
-  *tr = curl_slist_append(*tr, "My-super-awesome-trailer: trailer-stuff");
-  return CURL_TRAILERFUNC_OK;
-}
-
-CURL *curl = curl_easy_init();
-if(curl) {
-  /* Set the URL of the request */
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
-  /* Now set it as a put */
-  curl_easy_setopt(curl, CURLOPT_PUT, 1L);
-
-  /* Assuming we have a function that returns the data to be pushed
-     Let that function be read_cb */
-  curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
-
-  struct curl_slist *headers = NULL;
-  headers = curl_slist_append(headers, "Trailer: My-super-awesome-trailer");
-  res = curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
-
-  /* Set the trailers filling callback */
-  curl_easy_setopt(curl, CURLOPT_TRAILERFUNCTION, trailer_cb);
-
-  /* Perform the transfer */
-  res = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-
-  curl_slist_free_all(headers);
-}
-.SH AVAILABILITY
-This option was added in curl 7.64.0 and is present if HTTP support is enabled
-.SH RETURN VALUE
-Returns CURLE_OK.
-.SH "SEE ALSO"
-.BR CURLOPT_TRAILERDATA "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TRAILERFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TRAILERFUNCTION.md
new file mode 100644
index 0000000000..716967d88a
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TRAILERFUNCTION.md
@@ -0,0 +1,116 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TRAILERFUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_TRAILERDATA (3)
+  - CURLOPT_WRITEFUNCTION (3)
+Protocol:
+  - HTTP
+Added-in: 7.64.0
+---
+
+# NAME
+
+CURLOPT_TRAILERFUNCTION - callback for sending trailing headers
+
+# SYNOPSIS
+
+~~~c
+#include <curl.h>
+
+int curl_trailer_callback(struct curl_slist ** list, void *userdata);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TRAILERFUNCTION,
+                          curl_trailer_callback *func);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a callback function.
+
+This callback function is called once right before sending the final CR LF in
+an HTTP chunked transfer to fill a list of trailing headers to be sent before
+finishing the HTTP transfer.
+
+You can set the userdata argument with the CURLOPT_TRAILERDATA(3)
+option.
+
+The trailing headers included in the linked list must not be CRLF-terminated,
+because libcurl adds the appropriate line termination characters after each
+header item.
+
+If you use curl_slist_append(3) to add trailing headers to the *curl_slist*
+then libcurl duplicates the strings, and frees the *curl_slist* once the
+trailers have been sent.
+
+If one of the trailing header fields is not formatted correctly it is ignored
+and an info message is emitted.
+
+The return value can either be **CURL_TRAILERFUNC_OK** or
+**CURL_TRAILERFUNC_ABORT** which would respectively instruct libcurl to
+either continue with sending the trailers or to abort the request.
+
+If you set this option to NULL, then the transfer proceeds as usual
+without any interruptions.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+~~~c
+extern size_t read_cb(char *ptr, size_t size,
+                      size_t nmemb, void *userdata);
+
+static int trailer_cb(struct curl_slist **tr, void *data)
+{
+  /* libcurl frees the list */
+  *tr = curl_slist_append(*tr, "My-super-awesome-trailer: trailer-stuff");
+  return CURL_TRAILERFUNC_OK;
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+
+    /* Set the URL of the request */
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
+    /* Now set it as a put */
+    curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+
+    /* Assuming we have a function that returns the data to be pushed
+       Let that function be read_cb */
+    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
+
+    struct curl_slist *headers = NULL;
+    headers = curl_slist_append(headers, "Trailer: My-super-awesome-trailer");
+    result = curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
+
+    /* Set the trailers filling callback */
+    curl_easy_setopt(curl, CURLOPT_TRAILERFUNCTION, trailer_cb);
+
+    /* Perform the transfer */
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+
+    curl_slist_free_all(headers);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TRANSFERTEXT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TRANSFERTEXT.3
deleted file mode 100644
index b572ce467f..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TRANSFERTEXT.3
+++ /dev/null
@@ -1,63 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TRANSFERTEXT 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_TRANSFERTEXT \- request a text based transfer for FTP
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TRANSFERTEXT, long text);
-.fi
-.SH DESCRIPTION
-A parameter set to 1 tells the library to use ASCII mode for FTP transfers,
-instead of the default binary transfer. For win32 systems it does not set the
-stdout to binary mode. This option can be usable when transferring text data
-between systems with different views on certain characters, such as newlines
-or similar.
-
-libcurl does not do a complete ASCII conversion when doing ASCII transfers
-over FTP. This is a known limitation/flaw that nobody has rectified. libcurl
-simply sets the mode to ASCII and performs a standard transfer.
-.SH DEFAULT
-0, disabled
-.SH PROTOCOLS
-FTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/textfile");
-  curl_easy_setopt(curl, CURLOPT_TRANSFERTEXT, 1L);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Along with FTP
-.SH RETURN VALUE
-Returns CURLE_OK if FTP is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_CRLF "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TRANSFERTEXT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TRANSFERTEXT.md
new file mode 100644
index 0000000000..8e742abb1a
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TRANSFERTEXT.md
@@ -0,0 +1,67 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TRANSFERTEXT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CRLF (3)
+Protocol:
+  - All
+Added-in: 7.1.1
+---
+
+# NAME
+
+CURLOPT_TRANSFERTEXT - request a text based transfer for FTP
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TRANSFERTEXT, long text);
+~~~
+
+# DESCRIPTION
+
+A parameter set to 1 tells the library to use ASCII mode for FTP transfers,
+instead of the default binary transfer. For Win32 systems it does not set the
+stdout to binary mode. This option can be usable when transferring text data
+between systems with different views on certain characters, such as newlines
+or similar.
+
+libcurl does not do a complete ASCII conversion when doing ASCII transfers
+over FTP. This is a known limitation/flaw that nobody has rectified. libcurl
+only sets the mode to ASCII and performs a standard transfer.
+
+# DEFAULT
+
+0, disabled
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/textfile");
+    curl_easy_setopt(curl, CURLOPT_TRANSFERTEXT, 1L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TRANSFER_ENCODING.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_TRANSFER_ENCODING.3
deleted file mode 100644
index dc62f39b8f..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_TRANSFER_ENCODING.3
+++ /dev/null
@@ -1,66 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TRANSFER_ENCODING 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_TRANSFER_ENCODING \- ask for HTTP Transfer Encoding
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TRANSFER_ENCODING,
-                          long enable);
-.fi
-.SH DESCRIPTION
-Pass a long set to 1L to \fIenable\fP or 0 to disable.
-
-Adds a request for compressed Transfer Encoding in the outgoing HTTP
-request. If the server supports this and so desires, it can respond with the
-HTTP response sent using a compressed Transfer-Encoding that is automatically
-uncompressed by libcurl on reception.
-
-Transfer-Encoding differs slightly from the Content-Encoding you ask for with
-\fICURLOPT_ACCEPT_ENCODING(3)\fP in that a Transfer-Encoding is strictly meant
-to be for the transfer and thus MUST be decoded before the data arrives in the
-client. Traditionally, Transfer-Encoding has been much less used and supported
-by both HTTP clients and HTTP servers.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_TRANSFER_ENCODING, 1L);
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.21.6
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_ACCEPT_ENCODING "(3), " CURLOPT_HTTP_TRANSFER_DECODING "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_TRANSFER_ENCODING.md b/third-party/curl/docs/libcurl/opts/CURLOPT_TRANSFER_ENCODING.md
new file mode 100644
index 0000000000..dead797f1f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_TRANSFER_ENCODING.md
@@ -0,0 +1,72 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_TRANSFER_ENCODING
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_ACCEPT_ENCODING (3)
+  - CURLOPT_HTTP_TRANSFER_DECODING (3)
+Protocol:
+  - HTTP
+Added-in: 7.21.6
+---
+
+# NAME
+
+CURLOPT_TRANSFER_ENCODING - ask for HTTP Transfer Encoding
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TRANSFER_ENCODING,
+                          long enable);
+~~~
+
+# DESCRIPTION
+
+Pass a long set to 1L to *enable* or 0 to disable.
+
+Adds a request for compressed Transfer Encoding in the outgoing HTTP
+request. If the server supports this and so desires, it can respond with the
+HTTP response sent using a compressed Transfer-Encoding that is automatically
+uncompressed by libcurl on reception.
+
+Transfer-Encoding differs slightly from the Content-Encoding you ask for with
+CURLOPT_ACCEPT_ENCODING(3) in that a Transfer-Encoding is strictly meant to be
+for the transfer and thus must be decoded before the data arrives in the
+client. Traditionally, Transfer-Encoding has been much less used and supported
+by both HTTP clients and HTTP servers.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_TRANSFER_ENCODING, 1L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_UNIX_SOCKET_PATH.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_UNIX_SOCKET_PATH.3
deleted file mode 100644
index 1c51dd7383..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_UNIX_SOCKET_PATH.3
+++ /dev/null
@@ -1,83 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_UNIX_SOCKET_PATH 3 "09 Oct 2014" libcurl libcurl
-.SH NAME
-CURLOPT_UNIX_SOCKET_PATH \- Unix domain socket
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_UNIX_SOCKET_PATH, char *path);
-.fi
-.SH DESCRIPTION
-Enables the use of Unix domain sockets as connection endpoint and sets the
-path to \fIpath\fP. If \fIpath\fP is NULL, then Unix domain sockets are
-disabled.
-
-When enabled, curl connects to the Unix domain socket instead of establishing
-a TCP connection to the host. Since no network connection is created, curl
-does not resolve the DNS hostname in the URL.
-
-The maximum path length on Cygwin, Linux and Solaris is 107. On other platforms
-it might be even less.
-
-Proxy and TCP options such as \fICURLOPT_TCP_NODELAY(3)\fP are not
-supported. Proxy options such as \fICURLOPT_PROXY(3)\fP have no effect either
-as these are TCP-oriented, and asking a proxy server to connect to a certain
-Unix domain socket is not possible.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-Default is NULL, meaning that no Unix domain sockets are used.
-.SH PROTOCOLS
-All protocols except for FILE and FTP are supported in theory. HTTP, IMAP,
-POP3 and SMTP should in particular work (including their SSL/TLS variants).
-.SH EXAMPLE
-Given that you have an HTTP server running listening on /tmp/httpd.sock, you
-can request an HTTP resource with:
-
-.nf
-  curl_easy_setopt(curl_handle, CURLOPT_UNIX_SOCKET_PATH, "/tmp/httpd.sock");
-  curl_easy_setopt(curl_handle, CURLOPT_URL, "http://localhost/");
-.fi
-
-If you are on Linux and somehow have a need for paths larger than 107 bytes,
-you could use the proc filesystem to bypass the limitation:
-
-.nf
-  int dirfd = open(long_directory_path_to_socket, O_DIRECTORY | O_RDONLY);
-  char path[108];
-  snprintf(path, sizeof(path), "/proc/self/fd/%d/httpd.sock", dirfd);
-  curl_easy_setopt(curl_handle, CURLOPT_UNIX_SOCKET_PATH, path);
-  /* Be sure to keep dirfd valid until you discard the handle */
-.fi
-.SH AVAILABILITY
-Added in 7.40.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_ABSTRACT_UNIX_SOCKET "(3), "
-.BR CURLOPT_OPENSOCKETFUNCTION "(3), " unix "(7), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_UNIX_SOCKET_PATH.md b/third-party/curl/docs/libcurl/opts/CURLOPT_UNIX_SOCKET_PATH.md
new file mode 100644
index 0000000000..2ff1c1bcb5
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_UNIX_SOCKET_PATH.md
@@ -0,0 +1,93 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_UNIX_SOCKET_PATH
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_ABSTRACT_UNIX_SOCKET (3)
+  - CURLOPT_OPENSOCKETFUNCTION (3)
+  - unix (7)
+Protocol:
+  - All
+Added-in: 7.40.0
+---
+
+# NAME
+
+CURLOPT_UNIX_SOCKET_PATH - Unix domain socket
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_UNIX_SOCKET_PATH, char *path);
+~~~
+
+# DESCRIPTION
+
+Enables the use of Unix domain sockets as connection endpoint and sets the
+path to *path*. If *path* is NULL, then Unix domain sockets are
+disabled.
+
+When enabled, curl connects to the Unix domain socket instead of establishing
+a TCP connection to the host. Since no network connection is created, curl
+does not resolve the DNS hostname in the URL.
+
+The maximum path length on Cygwin, Linux and Solaris is 107. On other platforms
+it might be even less.
+
+Proxy and TCP options such as CURLOPT_TCP_NODELAY(3) are not supported. Proxy
+options such as CURLOPT_PROXY(3) have no effect either as these are
+TCP-oriented, and asking a proxy server to connect to a certain Unix domain
+socket is not possible.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL - no Unix domain sockets are used.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_UNIX_SOCKET_PATH, "/tmp/httpd.sock");
+    curl_easy_setopt(curl, CURLOPT_URL, "http://localhost/");
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+If you are on Linux and somehow have a need for paths larger than 107 bytes,
+you can use the *proc* file system to bypass the limitation:
+
+~~~c
+  int dirfd = open(long_directory_path_to_socket, O_DIRECTORY | O_RDONLY);
+  char path[108];
+  snprintf(path, sizeof(path), "/proc/self/fd/%d/httpd.sock", dirfd);
+  curl_easy_setopt(curl_handle, CURLOPT_UNIX_SOCKET_PATH, path);
+  /* Be sure to keep dirfd valid until you discard the handle */
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_UNRESTRICTED_AUTH.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_UNRESTRICTED_AUTH.3
deleted file mode 100644
index 44e9412c0a..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_UNRESTRICTED_AUTH.3
+++ /dev/null
@@ -1,75 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_UNRESTRICTED_AUTH 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_UNRESTRICTED_AUTH \- send credentials to other hosts too
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_UNRESTRICTED_AUTH,
-                          long goahead);
-.SH DESCRIPTION
-Set the long \fIgohead\fP parameter to 1L to make libcurl continue to send
-authentication (user+password) credentials when following locations, even when
-hostname changed. This option is meaningful only when setting
-\fICURLOPT_FOLLOWLOCATION(3)\fP.
-
-Further, when this option is not used or set to \fB0L\fP, libcurl does not
-send custom nor internally generated Authentication: headers on requests done
-to other hosts than the one used for the initial URL.
-
-By default, libcurl only sends credentials and Authentication headers to the
-initial host name as given in the original URL, to avoid leaking username +
-password to other sites.
-
-This option should be used with caution: when curl follows redirects it
-blindly fetches the next URL as instructed by the server. Setting
-\fICURLOPT_UNRESTRICTED_AUTH(3)\fP to 1L therefore also makes curl trust the
-server and sends possibly sensitive credentials to any host the server points
-out. And then maybe again and again as the following hosts can keep
-redirecting to new hosts.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-HTTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-  curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
-  curl_easy_setopt(curl, CURLOPT_UNRESTRICTED_AUTH, 1L);
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Along with HTTP
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_FOLLOWLOCATION "(3), " CURLOPT_USERPWD "(3), "
-.BR CURLOPT_MAXREDIRS "(3), "
-.BR CURLOPT_REDIR_PROTOCOLS_STR "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_UNRESTRICTED_AUTH.md b/third-party/curl/docs/libcurl/opts/CURLOPT_UNRESTRICTED_AUTH.md
new file mode 100644
index 0000000000..2dc15ca6b0
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_UNRESTRICTED_AUTH.md
@@ -0,0 +1,89 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_UNRESTRICTED_AUTH
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_REDIRECT_COUNT (3)
+  - CURLOPT_FOLLOWLOCATION (3)
+  - CURLOPT_MAXREDIRS (3)
+  - CURLOPT_REDIR_PROTOCOLS_STR (3)
+  - CURLOPT_USERPWD (3)
+Protocol:
+  - HTTP
+Added-in: 7.10.4
+---
+
+# NAME
+
+CURLOPT_UNRESTRICTED_AUTH - send credentials to other hosts too
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_UNRESTRICTED_AUTH,
+                          long goahead);
+~~~
+
+# DESCRIPTION
+
+Set the long *gohead* parameter to 1L to make libcurl continue to send
+authentication (user+password) credentials or explicitly set cookie headers
+when following locations, even when the host changes. This option is
+meaningful only when setting CURLOPT_FOLLOWLOCATION(3).
+
+Further, when this option is not used or set to **0L**, libcurl does not send
+custom nor internally generated `Authentication:` or `Cookie:` headers on
+requests done to other hosts than the one used for the initial URL. Another
+host means that one or more of hostname, protocol scheme or port number
+changed.
+
+By default, libcurl only sends `Authentication:` or explicitly set `Cookie:`
+headers to the initial host as given in the original URL, to avoid leaking
+username + password to other sites.
+
+This option should be used with caution: when curl follows redirects it
+blindly fetches the next URL as instructed by the server. Setting
+CURLOPT_UNRESTRICTED_AUTH(3) to 1L makes curl trust the server and sends
+possibly sensitive credentials to any host the server points to, possibly
+again and again as the following hosts can keep redirecting to new hosts.
+
+Due to the way HTTP works, almost any header can be made to contain data a
+client may not want to pass on to other servers than the initially intended
+host and for all other headers than the two mentioned above, there is no
+protection from this happening when libcurl is told to follow redirects.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+    curl_easy_setopt(curl, CURLOPT_UNRESTRICTED_AUTH, 1L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_UPKEEP_INTERVAL_MS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_UPKEEP_INTERVAL_MS.3
deleted file mode 100644
index 9b35194647..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_UPKEEP_INTERVAL_MS.3
+++ /dev/null
@@ -1,82 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_UPKEEP_INTERVAL_MS 3 "31 Oct 2018" libcurl libcurl
-.SH NAME
-CURLOPT_UPKEEP_INTERVAL_MS \- connection upkeep interval
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_UPKEEP_INTERVAL_MS,
-                          long upkeep_interval_ms);
-.fi
-.SH DESCRIPTION
-Some protocols have "connection upkeep" mechanisms. These mechanisms usually
-send some traffic on existing connections in order to keep them alive; this
-can prevent connections from being closed due to overzealous firewalls, for
-example.
-
-The user needs to explicitly call \fIcurl_easy_upkeep(3)\fP in order to
-perform the upkeep work.
-
-Currently the only protocol with a connection upkeep mechanism is HTTP/2: when
-the connection upkeep interval is exceeded and \fIcurl_easy_upkeep(3)\fP
-is called, an HTTP/2 PING frame is sent on the connection.
-
-.SH DEFAULT
-CURL_UPKEEP_INTERVAL_DEFAULT (currently defined as 60000L, which is 60 seconds)
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  /* Make a connection to an HTTP/2 server. */
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* Set the interval to 30000ms / 30s */
-  curl_easy_setopt(curl, CURLOPT_UPKEEP_INTERVAL_MS, 30000L);
-
-  curl_easy_perform(curl);
-
-  /* Perform more work here. */
-
-  /* While the connection is being held open, curl_easy_upkeep() can be
-     called. If curl_easy_upkeep() is called and the time since the last
-     upkeep exceeds the interval, then an HTTP/2 PING is sent. */
-  curl_easy_upkeep(curl);
-
-  /* Perform more work here. */
-
-  /* always cleanup */
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.62.0
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH SEE ALSO
-.BR CURLOPT_TCP_KEEPALIVE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_UPKEEP_INTERVAL_MS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_UPKEEP_INTERVAL_MS.md
new file mode 100644
index 0000000000..8b0e87cfb6
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_UPKEEP_INTERVAL_MS.md
@@ -0,0 +1,85 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_UPKEEP_INTERVAL_MS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_TCP_KEEPALIVE (3)
+Protocol:
+  - All
+Added-in: 7.62.0
+---
+
+# NAME
+
+CURLOPT_UPKEEP_INTERVAL_MS - connection upkeep interval
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_UPKEEP_INTERVAL_MS,
+                          long upkeep_interval_ms);
+~~~
+
+# DESCRIPTION
+
+Some protocols have "connection upkeep" mechanisms. These mechanisms usually
+send some traffic on existing connections in order to keep them alive; this
+can prevent connections from being closed due to overzealous firewalls, for
+example.
+
+The user needs to explicitly call curl_easy_upkeep(3) in order to
+perform the upkeep work.
+
+Currently the only protocol with a connection upkeep mechanism is HTTP/2: when
+the connection upkeep interval is exceeded and curl_easy_upkeep(3)
+is called, an HTTP/2 PING frame is sent on the connection.
+
+# DEFAULT
+
+CURL_UPKEEP_INTERVAL_DEFAULT (currently defined as 60000L, which is 60 seconds)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    /* Make a connection to an HTTP/2 server. */
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* Set the interval to 30000ms / 30s */
+    curl_easy_setopt(curl, CURLOPT_UPKEEP_INTERVAL_MS, 30000L);
+
+    result = curl_easy_perform(curl);
+
+    /* Perform more work here. */
+
+    /* While the connection is being held open, curl_easy_upkeep() can be
+       called. If curl_easy_upkeep() is called and the time since the last
+       upkeep exceeds the interval, then an HTTP/2 PING is sent. */
+    curl_easy_upkeep(curl);
+
+    /* Perform more work here. */
+
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD.3
deleted file mode 100644
index 190e6ae332..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD.3
+++ /dev/null
@@ -1,82 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_UPLOAD 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_UPLOAD \- data upload
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_UPLOAD, long upload);
-.fi
-.SH DESCRIPTION
-The long parameter \fIupload\fP set to 1 tells the library to prepare for and
-perform an upload. The \fICURLOPT_READDATA(3)\fP and
-\fICURLOPT_INFILESIZE(3)\fP or \fICURLOPT_INFILESIZE_LARGE(3)\fP options are
-also interesting for uploads. If the protocol is HTTP, uploading means using
-the PUT request unless you tell libcurl otherwise.
-
-Using PUT with HTTP 1.1 implies the use of a "Expect: 100-continue" header.
-You can disable this header with \fICURLOPT_HTTPHEADER(3)\fP as usual.
-
-If you use PUT to an HTTP 1.1 server, you can upload data without knowing the
-size before starting the transfer. The library enables this by adding a header
-"Transfer-Encoding: chunked". With HTTP 1.0 or if you prefer not to use chunked
-transfer, you must specify the size of the data with
-\fICURLOPT_INFILESIZE(3)\fP or \fICURLOPT_INFILESIZE_LARGE(3)\fP.
-.SH DEFAULT
-0, default is download
-.SH PROTOCOLS
-Most
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  /* we want to use our own read function */
-  curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_callback);
-
-  /* enable uploading */
-  curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
-
-  /* specify target */
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/dir/to/newfile");
-
-  /* now specify which pointer to pass to our callback */
-  curl_easy_setopt(curl, CURLOPT_READDATA, hd_src);
-
-  /* Set the size of the file to upload */
-  curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, (curl_off_t)fsize);
-
-  /* Now run off and do what you have been told! */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_PUT "(3), " CURLOPT_READFUNCTION "(3), "
-.BR CURLOPT_INFILESIZE_LARGE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD.md b/third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD.md
new file mode 100644
index 0000000000..5c81b86fe4
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD.md
@@ -0,0 +1,101 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_UPLOAD
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_INFILESIZE_LARGE (3)
+  - CURLOPT_PUT (3)
+  - CURLOPT_READFUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_UPLOAD - data upload
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_UPLOAD, long upload);
+~~~
+
+# DESCRIPTION
+
+The long parameter *upload* set to 1 tells the library to prepare for and
+perform an upload. The CURLOPT_READDATA(3) and CURLOPT_INFILESIZE(3) or
+CURLOPT_INFILESIZE_LARGE(3) options are also interesting for uploads. If the
+protocol is HTTP, uploading means using the PUT request unless you tell
+libcurl otherwise.
+
+Using PUT with HTTP 1.1 implies the use of a "Expect: 100-continue" header.
+You can disable this header with CURLOPT_HTTPHEADER(3) as usual.
+
+If you use PUT to an HTTP 1.1 server, you can upload data without knowing the
+size before starting the transfer. The library enables this by adding a header
+"Transfer-Encoding: chunked". With HTTP 1.0 or if you prefer not to use
+chunked transfer, you must specify the size of the data with
+CURLOPT_INFILESIZE(3) or CURLOPT_INFILESIZE_LARGE(3).
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+static size_t read_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
+{
+  FILE *src = userdata;
+  /* copy as much data as possible into the 'ptr' buffer, but no more than
+     'size' * 'nmemb' bytes */
+  size_t retcode = fread(ptr, size, nmemb, src);
+
+  return retcode;
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    FILE *src = fopen("local-file", "r");
+    curl_off_t fsize = 1234; /* set this to the size of the input file */
+
+    /* we want to use our own read function */
+    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
+
+    /* enable uploading */
+    curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+
+    /* specify target */
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/dir/to/newfile");
+
+    /* now specify which pointer to pass to our callback */
+    curl_easy_setopt(curl, CURLOPT_READDATA, src);
+
+    /* Set the size of the file to upload */
+    curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, (curl_off_t)fsize);
+
+    /* Now run off and do what you have been told */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD_BUFFERSIZE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD_BUFFERSIZE.3
deleted file mode 100644
index 69d7b7ad0d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD_BUFFERSIZE.3
+++ /dev/null
@@ -1,76 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_UPLOAD_BUFFERSIZE 3 "18 Aug 2018" libcurl libcurl
-.SH NAME
-CURLOPT_UPLOAD_BUFFERSIZE \- upload buffer size
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_UPLOAD_BUFFERSIZE, long size);
-.fi
-.SH DESCRIPTION
-Pass a long specifying your preferred \fIsize\fP (in bytes) for the upload
-buffer in libcurl. It makes libcurl uses a larger buffer that gets passed to
-the next layer in the stack to get sent off. In some setups and for some
-protocols, there is a huge performance benefit of having a larger upload
-buffer.
-
-This is just treated as a request, not an order. You cannot be guaranteed to
-actually get the given size.
-
-The upload buffer size is by default 64 kilobytes. The maximum buffer size
-allowed to be set is 2 megabytes. The minimum buffer size allowed to be set is
-16 kilobytes.
-
-The upload buffer is allocated on-demand - so if the handle is not used for
-upload, this buffer is not allocated at all.
-
-DO NOT set this option on a handle that is currently used for an active
-transfer as that may lead to unintended consequences.
-.SH DEFAULT
-65536 bytes
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/foo.bin");
-
-  /* ask libcurl to allocate a larger upload buffer */
-  curl_easy_setopt(curl, CURLOPT_UPLOAD_BUFFERSIZE, 120000L);
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.62.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_BUFFERSIZE "(3), " CURLOPT_READFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD_BUFFERSIZE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD_BUFFERSIZE.md
new file mode 100644
index 0000000000..425fe23deb
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD_BUFFERSIZE.md
@@ -0,0 +1,82 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_UPLOAD_BUFFERSIZE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_BUFFERSIZE (3)
+  - CURLOPT_READFUNCTION (3)
+  - CURLOPT_TCP_NODELAY (3)
+Protocol:
+  - All
+Added-in: 7.62.0
+---
+
+# NAME
+
+CURLOPT_UPLOAD_BUFFERSIZE - upload buffer size
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_UPLOAD_BUFFERSIZE, long size);
+~~~
+
+# DESCRIPTION
+
+Pass a long specifying your preferred *size* (in bytes) for the upload
+buffer in libcurl. It makes libcurl uses a larger buffer that gets passed to
+the next layer in the stack to get sent off. In some setups and for some
+protocols, there is a huge performance benefit of having a larger upload
+buffer.
+
+This is treated as a request, not an order. You cannot be guaranteed to
+actually get the given size.
+
+The upload buffer size is by default 64 kilobytes. The maximum buffer size
+allowed to be set is 2 megabytes. The minimum buffer size allowed to be set is
+16 kilobytes.
+
+The upload buffer is allocated on-demand - so if the handle is not used for
+upload, this buffer is not allocated at all.
+
+DO NOT set this option on a handle that is currently used for an active
+transfer as that may lead to unintended consequences.
+
+# DEFAULT
+
+65536 bytes
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/foo.bin");
+
+    /* ask libcurl to allocate a larger upload buffer */
+    curl_easy_setopt(curl, CURLOPT_UPLOAD_BUFFERSIZE, 120000L);
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD_FLAGS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD_FLAGS.md
new file mode 100644
index 0000000000..0e8c723dc8
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_UPLOAD_FLAGS.md
@@ -0,0 +1,129 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_UPLOAD_FLAGS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_UPLOAD (3)
+Protocol:
+  - IMAP
+  - IMAPS
+Added-in: 8.13.0
+---
+
+# NAME
+
+CURLOPT_UPLOAD_FLAGS - upload flags for IMAP
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_UPLOAD_FLAGS, long bitmask);
+~~~
+
+# DESCRIPTION
+
+Pass a long as parameter, which is set to a bitmask, to tell libcurl which
+flags to send the server relating to uploaded files. The currently supported
+flags are:
+
+## `CURLULFLAG_ANSWERED`
+
+Sets the **Answered** flag for IMAP uploads. Indicates that the message has
+been replied to.
+
+## `CURLULFLAG_DELETED`
+
+Sets the **Deleted** flag for IMAP uploads. Marks the message for deletion
+rather than immediately removing it.
+
+## `CURLULFLAG_DRAFT`
+
+Sets the **Draft** flag for IMAP uploads. Marks the message as an uncompleted
+composition.
+
+## `CURLULFLAG_FLAGGED`
+
+Sets the **Flagged** flag for IMAP uploads. Marks the message for special
+attention.
+
+## `CURLULFLAG_SEEN`
+
+Sets the **Seen** flag for IMAP uploads. Marks the message as read.
+
+##
+
+# DEFAULT
+
+A bitmask with only the **CURLULFLAG_SEEN** flag set.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+static size_t read_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
+{
+  FILE *src = userdata;
+  /* copy as much data as possible into the 'ptr' buffer, but no more than
+     'size' * 'nmemb' bytes */
+  size_t retcode = fread(ptr, size, nmemb, src);
+
+  return retcode;
+}
+
+int main(void)
+{
+  CURL *curl;
+  FILE *src = fopen("local-file", "r");
+  if(!src)
+    return 1;
+
+  curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_off_t fsize = 9876; /* set this to the size of the input file */
+
+    /* we want to use our own read function */
+    curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_cb);
+
+    /* enable uploading */
+    curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+
+    /* specify target */
+    curl_easy_setopt(curl, CURLOPT_URL, "imap://example.com:993/mailbox");
+
+    /* provide username */
+    curl_easy_setopt(curl, CURLOPT_USERNAME, "user@example.com");
+
+    /* provide password */
+    curl_easy_setopt(curl, CURLOPT_PASSWORD, "password");
+
+    /* specify that uploaded mail should be considered flagged */
+    curl_easy_setopt(curl, CURLOPT_UPLOAD_FLAGS, CURLULFLAG_FLAGGED);
+
+    /* now specify which pointer to pass to our callback */
+    curl_easy_setopt(curl, CURLOPT_READDATA, src);
+
+    /* Set the size of the file to upload */
+    curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, (curl_off_t)fsize);
+
+    /* perform the upload */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+  fclose(src);
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_URL.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_URL.3
deleted file mode 100644
index 42d2ec25e4..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_URL.3
+++ /dev/null
@@ -1,138 +0,0 @@
-
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_URL 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_URL \- URL for this transfer
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_URL, char *URL);
-.fi
-.SH DESCRIPTION
-Pass in a pointer to the \fIURL\fP to work with. The parameter should be a
-char * to a null-terminated string which must be URL-encoded in the following
-format:
-
-scheme://host:port/path
-
-For a greater explanation of the format please see RFC 3986.
-
-libcurl does not validate the syntax or use the URL until the transfer is
-started. Even if you set a crazy value here, \fIcurl_easy_setopt(3)\fP might
-still return \fICURLE_OK\fP.
-
-If the given URL is missing a scheme name (such as "http://" or "ftp://" etc)
-then libcurl guesses based on the host. If the outermost subdomain name
-matches DICT, FTP, IMAP, LDAP, POP3 or SMTP then that protocol gets used,
-otherwise HTTP is used. Since 7.45.0 guessing can be disabled by setting a
-default protocol, see \fICURLOPT_DEFAULT_PROTOCOL(3)\fP for details.
-
-Should the protocol, either as specified by the URL scheme or deduced by
-libcurl from the host name, not be supported by libcurl then
-\fICURLE_UNSUPPORTED_PROTOCOL\fP is returned from either the
-\fIcurl_easy_perform(3)\fP or \fIcurl_multi_perform(3)\fP functions when you
-call them. Use \fIcurl_version_info(3)\fP for detailed information of which
-protocols are supported by the build of libcurl you are using.
-
-\fICURLOPT_PROTOCOLS_STR(3)\fP can be used to limit what protocols libcurl may
-use for this transfer, independent of what libcurl has been compiled to
-support. That may be useful if you accept the URL from an external source and
-want to limit the accessibility.
-
-The \fICURLOPT_URL(3)\fP string is ignored if \fICURLOPT_CURLU(3)\fP is set.
-
-Either \fICURLOPT_URL(3)\fP or \fICURLOPT_CURLU(3)\fP must be set before a
-transfer is started.
-
-The application does not have to keep the string around after setting this
-option.
-
-The parser used for handling the URL set with \fICURLOPT_URL(3)\fP is the same
-that \fIcurl_url_set(3)\fP uses.
-.SH ENCODING
-The string pointed to in the \fICURLOPT_URL(3)\fP argument is generally
-expected to be a sequence of characters using an ASCII compatible encoding.
-
-If libcurl is built with IDN support, the server name part of the URL can use
-an "international name" by using the current encoding (according to locale) or
-UTF-8 (when winidn is used; or a Windows Unicode build using libidn2).
-
-If libcurl is built without IDN support, the server name is used exactly as
-specified when passed to the name resolver functions.
-.SH DEFAULT
-There is no default URL. If this option is not set, no transfer can be
-performed.
-.SH SECURITY CONCERNS
-Applications may at times find it convenient to allow users to specify URLs
-for various purposes and that string would then end up fed to this option.
-
-Getting a URL from an external untrusted party brings several security
-concerns:
-
-If you have an application that runs as or in a server application, getting an
-unfiltered URL can easily trick your application to access a local resource
-instead of a remote. Protecting yourself against localhost accesses is hard
-when accepting user provided URLs.
-
-Such custom URLs can also access other ports than you planned as port numbers
-are part of the regular URL format. The combination of a local host and a
-custom port number can allow external users to play tricks with your local
-services.
-
-Accepting external URLs may also use other protocols than http:// or other
-common ones. Restrict what accept with \fICURLOPT_PROTOCOLS(3)\fP.
-
-User provided URLs can also be made to point to sites that redirect further on
-(possibly to other protocols too). Consider your
-\fICURLOPT_FOLLOWLOCATION(3)\fP and \fICURLOPT_REDIR_PROTOCOLS(3)\fP settings.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-POP3 and SMTP were added in 7.31.0
-.SH RETURN VALUE
-Returns CURLE_OK on success or CURLE_OUT_OF_MEMORY if there was insufficient
-heap space.
-
-Note that \fIcurl_easy_setopt(3)\fP does not parse the given string so given a
-bad URL, it is not detected until \fIcurl_easy_perform(3)\fP or similar is
-called.
-.SH "SEE ALSO"
-.BR CURLOPT_VERBOSE "(3), " CURLOPT_PROTOCOLS "(3), "
-.BR CURLOPT_FORBID_REUSE "(3), " CURLOPT_FRESH_CONNECT "(3), "
-.BR curl_easy_perform "(3), "
-.BR CURLINFO_REDIRECT_URL "(3), " CURLOPT_PATH_AS_IS "(3), " CURLOPT_CURLU "(3), "
-.BR curl_url_set "(3), "
-.BR curl_url_get "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_URL.md b/third-party/curl/docs/libcurl/opts/CURLOPT_URL.md
new file mode 100644
index 0000000000..b9e5e52b4f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_URL.md
@@ -0,0 +1,149 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_URL
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_REDIRECT_URL (3)
+  - CURLOPT_CURLU (3)
+  - CURLOPT_FORBID_REUSE (3)
+  - CURLOPT_FRESH_CONNECT (3)
+  - CURLOPT_PATH_AS_IS (3)
+  - CURLOPT_PROTOCOLS_STR (3)
+  - curl_easy_perform (3)
+  - curl_url_get (3)
+  - curl_url_set (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_URL - URL for this transfer
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_URL, char *URL);
+~~~
+
+# DESCRIPTION
+
+Pass in a pointer to the *URL* to work with. The parameter should be a char *
+to a null-terminated string which must be URL-encoded in the following format:
+
+scheme://host:port/path
+
+For a greater explanation of the format please see RFC 3986.
+
+libcurl does not validate the syntax or use the URL until the transfer is
+started. Even if you set a crazy value here, curl_easy_setopt(3) might still
+return *CURLE_OK*.
+
+If the given URL is missing a scheme name (such as `http://` or `ftp://` etc)
+then libcurl guesses based on the host. If the outermost subdomain name
+matches DICT, FTP, IMAP, LDAP, POP3 or SMTP then that protocol gets used,
+otherwise HTTP is used. Scheme guessing can be disabled by setting a default
+protocol, see CURLOPT_DEFAULT_PROTOCOL(3) for details.
+
+Should the protocol, either as specified by the URL scheme or deduced by
+libcurl from the hostname, not be supported by libcurl then
+*CURLE_UNSUPPORTED_PROTOCOL* is returned from either the curl_easy_perform(3)
+or curl_multi_perform(3) functions when you call them. Use
+curl_version_info(3) for detailed information of which protocols are supported
+by the build of libcurl you are using.
+
+CURLOPT_PROTOCOLS_STR(3) can be used to limit what protocols libcurl may use
+for this transfer, independent of what libcurl has been compiled to support.
+That may be useful if you accept the URL from an external source and want to
+limit the accessibility.
+
+The CURLOPT_URL(3) string is ignored if CURLOPT_CURLU(3) is set.
+
+Either CURLOPT_URL(3) or CURLOPT_CURLU(3) must be set before a transfer is
+started.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again. Note however that
+libcurl needs a URL set to be able to performed a transfer.
+
+The parser used for handling the URL set with CURLOPT_URL(3) is the same that
+curl_url_set(3) uses.
+
+# ENCODING
+
+The string pointed to in the CURLOPT_URL(3) argument is generally expected to
+be a sequence of characters using an ASCII compatible encoding.
+
+If libcurl is built with IDN support, the server name part of the URL can use
+an "international name" by using the current encoding (according to locale) or
+UTF-8 (when WinIDN is used; or a Windows Unicode build using libidn2).
+
+If libcurl is built without IDN support, the server name is used exactly as
+specified when passed to the name resolver functions.
+
+# DEFAULT
+
+NULL. If this option is not set, no transfer can be performed.
+
+# SECURITY CONCERNS
+
+Applications may at times find it convenient to allow users to specify URLs
+for various purposes and that string would then end up fed to this option.
+
+Getting a URL from an external untrusted party brings several security
+concerns:
+
+If you have an application that runs as or in a server application, getting an
+unfiltered URL can easily trick your application to access a local resource
+instead of a remote. Protecting yourself against localhost accesses is hard
+when accepting user provided URLs.
+
+Such custom URLs can also access other ports than you planned as port numbers
+are part of the regular URL format. The combination of a local host and a
+custom port number can allow external users to play tricks with your local
+services.
+
+Accepting external URLs may also use other protocols than `http://` or other
+common ones. Restrict what accept with CURLOPT_PROTOCOLS_STR(3).
+
+User provided URLs can also be made to point to sites that redirect further on
+(possibly to other protocols too). Consider your
+CURLOPT_FOLLOWLOCATION(3) and CURLOPT_REDIR_PROTOCOLS_STR(3) settings.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
+
+Note that curl_easy_setopt(3) does not parse the given string so given a bad
+URL, it is not detected until curl_easy_perform(3) or similar is called.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_USERAGENT.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_USERAGENT.3
deleted file mode 100644
index 793dc5c34a..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_USERAGENT.3
+++ /dev/null
@@ -1,62 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_USERAGENT 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_USERAGENT \- HTTP user-agent header
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_USERAGENT, char *ua);
-.fi
-.SH DESCRIPTION
-Pass a pointer to a null-terminated string as parameter. It is used to set the
-User-Agent: header field in the HTTP request sent to the remote server. You
-can also set any custom header with \fICURLOPT_HTTPHEADER(3)\fP.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL, no User-Agent: header is used by default.
-.SH PROTOCOLS
-HTTP, HTTPS
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  curl_easy_setopt(curl, CURLOPT_USERAGENT, "Dark Secret Ninja/1.0");
-
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-As long as HTTP is supported
-.SH RETURN VALUE
-Returns CURLE_OK if HTTP is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_REFERER "(3), " CURLOPT_HTTPHEADER "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_USERAGENT.md b/third-party/curl/docs/libcurl/opts/CURLOPT_USERAGENT.md
new file mode 100644
index 0000000000..7aae9cde78
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_USERAGENT.md
@@ -0,0 +1,72 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_USERAGENT
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CUSTOMREQUEST (3)
+  - CURLOPT_HTTPHEADER (3)
+  - CURLOPT_REFERER (3)
+  - CURLOPT_REQUEST_TARGET (3)
+Protocol:
+  - HTTP
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_USERAGENT - HTTP user-agent header
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_USERAGENT, char *ua);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a null-terminated string as parameter. It is used to set the
+User-Agent: header field in the HTTP request sent to the remote server. You
+can also set any custom header with CURLOPT_HTTPHEADER(3).
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL, no User-Agent: header is used.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    curl_easy_setopt(curl, CURLOPT_USERAGENT, "Dark Secret Ninja/1.0");
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_USERNAME.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_USERNAME.3
deleted file mode 100644
index 0c32762094..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_USERNAME.3
+++ /dev/null
@@ -1,87 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_USERNAME 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_USERNAME \- user name to use in authentication
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_USERNAME,
-                          char *username);
-.SH DESCRIPTION
-Pass a char * as parameter, which should be pointing to the null-terminated
-user name to use for the transfer.
-
-\fICURLOPT_USERNAME(3)\fP sets the user name to be used in protocol
-authentication. You should not use this option together with the (older)
-\fICURLOPT_USERPWD(3)\fP option.
-
-When using Kerberos V5 authentication with a Windows based server, you should
-include the domain name in order for the server to successfully obtain a
-Kerberos Ticket. If you do not then the initial part of the authentication
-handshake may fail.
-
-When using NTLM, the user name can be specified simply as the user name
-without the domain name should the server be part of a single domain and
-forest.
-
-To include the domain name use either Down-Level Logon Name or UPN (User
-Principal Name) formats. For example, EXAMPLE\\user and user@example.com
-respectively.
-
-Some HTTP servers (on Windows) support inclusion of the domain for Basic
-authentication as well.
-
-To specify the password and login options, along with the user name, use the
-\fICURLOPT_PASSWORD(3)\fP and \fICURLOPT_LOGIN_OPTIONS(3)\fP options.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-blank
-.SH PROTOCOLS
-Most
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-
-  curl_easy_setopt(curl, CURLOPT_USERNAME, "clark");
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.19.1
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_USERPWD "(3), " CURLOPT_PASSWORD "(3), "
-.BR CURLOPT_HTTPAUTH "(3), " CURLOPT_PROXYAUTH "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_USERNAME.md b/third-party/curl/docs/libcurl/opts/CURLOPT_USERNAME.md
new file mode 100644
index 0000000000..faf7031949
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_USERNAME.md
@@ -0,0 +1,92 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_USERNAME
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HTTPAUTH (3)
+  - CURLOPT_PASSWORD (3)
+  - CURLOPT_PROXYAUTH (3)
+  - CURLOPT_USERPWD (3)
+Protocol:
+  - All
+Added-in: 7.19.1
+---
+
+# NAME
+
+CURLOPT_USERNAME - username to use in authentication
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_USERNAME,
+                          char *username);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter, which should be pointing to the
+null-terminated username to use for the transfer.
+
+CURLOPT_USERNAME(3) sets the username to be used in protocol
+authentication. You should not use this option together with the (older)
+CURLOPT_USERPWD(3) option.
+
+When using Kerberos V5 authentication with a Windows based server, you should
+include the domain name in order for the server to successfully obtain a
+Kerberos Ticket. If you do not then the initial part of the authentication
+handshake may fail.
+
+When using NTLM, the username can be specified without the domain name
+should the server be part of a single domain and forest.
+
+To include the domain name use either Down-Level Logon Name or UPN (User
+Principal Name) formats. For example, **EXAMPLE\user** and
+**user@example.com** respectively.
+
+Some HTTP servers (on Windows) support inclusion of the domain for Basic
+authentication as well.
+
+To specify the password and login options, along with the username, use the
+CURLOPT_PASSWORD(3) and CURLOPT_LOGIN_OPTIONS(3) options.
+
+The application does not have to keep the string around after setting this
+option.
+
+# DEFAULT
+
+blank
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+
+    curl_easy_setopt(curl, CURLOPT_USERNAME, "clark");
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_USERPWD.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_USERPWD.3
deleted file mode 100644
index ffff859822..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_USERPWD.3
+++ /dev/null
@@ -1,95 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_USERPWD 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_USERPWD \- user name and password to use in authentication
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_USERPWD, char *userpwd);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter, pointing to a null-terminated login details string
-for the connection. The format of which is: [user name]:[password].
-
-When using Kerberos V5 authentication with a Windows based server, you should
-specify the user name part with the domain name in order for the server to
-successfully obtain a Kerberos Ticket. If you do not then the initial part of
-the authentication handshake may fail.
-
-When using NTLM, the user name can be specified simply as the user name
-without the domain name should the server be part of a single domain and
-forest.
-
-To specify the domain name use either Down-Level Logon Name or UPN (User
-Principal Name) formats. For example, EXAMPLE\\user and user@example.com
-respectively.
-
-Some HTTP servers (on Windows) support inclusion of the domain for Basic
-authentication as well.
-
-When using HTTP and \fICURLOPT_FOLLOWLOCATION(3)\fP, libcurl might perform
-several requests to possibly different hosts. libcurl only sends this user and
-password information to hosts using the initial host name (unless
-\fICURLOPT_UNRESTRICTED_AUTH(3)\fP is set), so if libcurl follows redirects to
-other hosts, it does not send the user and password to those. This is enforced
-to prevent accidental information leakage.
-
-Use \fICURLOPT_HTTPAUTH(3)\fP to specify the authentication method for HTTP
-based connections or \fICURLOPT_LOGIN_OPTIONS(3)\fP to control IMAP, POP3 and
-SMTP options.
-
-The user and password strings are not URL decoded, so there is no way to send
-in a user name containing a colon using this option. Use
-\fICURLOPT_USERNAME(3)\fP for that, or include it in the URL.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-Most
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
-
-  curl_easy_setopt(curl, CURLOPT_USERPWD, "clark:kent");
-
-  ret = curl_easy_perform(curl);
-
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK on success or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_USERNAME "(3), " CURLOPT_PASSWORD "(3), "
-.BR CURLOPT_PROXYUSERPWD "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_USERPWD.md b/third-party/curl/docs/libcurl/opts/CURLOPT_USERPWD.md
new file mode 100644
index 0000000000..d42a83e582
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_USERPWD.md
@@ -0,0 +1,101 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_USERPWD
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PASSWORD (3)
+  - CURLOPT_PROXYUSERPWD (3)
+  - CURLOPT_USERNAME (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_USERPWD - username and password to use in authentication
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_USERPWD, char *userpwd);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter, pointing to a null-terminated login details
+string for the connection. The format of which is: [username]:[password].
+
+When using Kerberos V5 authentication with a Windows based server, you should
+specify the username part with the domain name in order for the server to
+successfully obtain a Kerberos Ticket. If you do not then the initial part of
+the authentication handshake may fail.
+
+When using NTLM, the username can be specified without the domain name
+should the server be part of a single domain and forest.
+
+To specify the domain name use either Down-Level Logon Name or UPN (User
+Principal Name) formats. For example **EXAMPLE\user** and **user@example.com**
+respectively.
+
+Some HTTP servers (on Windows) support inclusion of the domain for Basic
+authentication as well.
+
+When using HTTP and CURLOPT_FOLLOWLOCATION(3), libcurl might perform several
+requests to possibly different hosts. libcurl only sends this user and
+password information to hosts using the initial hostname (unless
+CURLOPT_UNRESTRICTED_AUTH(3) is set), so if libcurl follows redirects to other
+hosts, it does not send the user and password to those. This is enforced to
+prevent accidental information leakage.
+
+Use CURLOPT_HTTPAUTH(3) to specify the authentication method for HTTP
+based connections or CURLOPT_LOGIN_OPTIONS(3) to control IMAP, POP3 and
+SMTP options.
+
+The user and password strings are not URL decoded, so there is no way to send
+in a username containing a colon using this option. Use CURLOPT_USERNAME(3)
+for that, or include it in the URL.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
+
+    curl_easy_setopt(curl, CURLOPT_USERPWD, "clark:kent");
+
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_USE_SSL.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_USE_SSL.3
deleted file mode 100644
index 3e6f6305e4..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_USE_SSL.3
+++ /dev/null
@@ -1,76 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_USE_SSL 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_USE_SSL \- request using SSL / TLS for the transfer
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_USE_SSL, long level);
-.fi
-.SH DESCRIPTION
-Pass a long using one of the values from below, to make libcurl use your
-desired \fIlevel\fP of SSL for the transfer.
-
-These are all protocols that start out plain text and get "upgraded" to SSL
-using the STARTTLS command.
-
-This is for enabling SSL/TLS when you use FTP, SMTP, POP3, IMAP etc.
-.IP CURLUSESSL_NONE
-do not attempt to use SSL.
-.IP CURLUSESSL_TRY
-Try using SSL, proceed as normal otherwise. Note that server may close the
-connection if the negotiation does not succeed.
-.IP CURLUSESSL_CONTROL
-Require SSL for the control connection or fail with \fICURLE_USE_SSL_FAILED\fP.
-.IP CURLUSESSL_ALL
-Require SSL for all communication or fail with \fICURLE_USE_SSL_FAILED\fP.
-.SH DEFAULT
-CURLUSESSL_NONE
-.SH PROTOCOLS
-FTP, SMTP, POP3, IMAP, LDAP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/dir/file.ext");
-
-  /* require use of SSL for this, or fail */
-  curl_easy_setopt(curl, CURLOPT_USE_SSL, (long)CURLUSESSL_ALL);
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.11.0. This option was known as CURLOPT_FTP_SSL up to 7.16.4, and
-the constants were known as CURLFTPSSL_*
-Handled by LDAP since 7.81.0. Fully supported by the OpenLDAP backend only.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_SSLVERSION "(3), " CURLOPT_PROXY_SSLVERSION "(3), "
-.BR CURLOPT_SSL_OPTIONS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_USE_SSL.md b/third-party/curl/docs/libcurl/opts/CURLOPT_USE_SSL.md
new file mode 100644
index 0000000000..03b03df5df
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_USE_SSL.md
@@ -0,0 +1,106 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_USE_SSL
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_PROXY_SSLVERSION (3)
+  - CURLOPT_SSLVERSION (3)
+  - CURLOPT_SSL_OPTIONS (3)
+Protocol:
+  - FTP
+  - SMTP
+  - POP3
+  - IMAP
+Added-in: 7.17.0
+---
+
+# NAME
+
+CURLOPT_USE_SSL - request using SSL / TLS for the transfer
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_USE_SSL, long level);
+~~~
+
+# DESCRIPTION
+
+Pass a long using one of the values from below, to make libcurl use your
+desired *level* of SSL for the transfer.
+
+These are all protocols that start out plain text and get "upgraded" to SSL
+using the STARTTLS command.
+
+This is for enabling SSL/TLS when you use FTP, SMTP, POP3, IMAP etc.
+
+## CURLUSESSL_NONE
+
+Do not attempt to use SSL.
+
+## CURLUSESSL_TRY
+
+Try using SSL, proceed as normal otherwise. Note that server may close the
+connection if the negotiation fails. This level is *insecure* and should be
+avoided since it allows the connection to remain unprotected.
+
+## CURLUSESSL_CONTROL
+
+Require SSL for the control connection or fail with *CURLE_USE_SSL_FAILED*.
+This level is partially *insecure* and should be avoided since it lets the
+data connection remain unprotected.
+
+This level is meant for FTP, since that is the only protocol with separate
+connections for control and data. If used for IMAP, POP3 or SMTP it equals
+`CURLUSESSL_ALL`.
+
+## CURLUSESSL_ALL
+
+Require SSL for all communication or fail with *CURLE_USE_SSL_FAILED*.
+
+# DEFAULT
+
+CURLUSESSL_NONE
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ftp://example.com/dir/file.ext");
+
+    /* require use of SSL for this, or fail */
+    curl_easy_setopt(curl, CURLOPT_USE_SSL, CURLUSESSL_ALL);
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+This option was known as CURLOPT_FTP_SSL up to 7.16.4. Supported by LDAP since
+7.81.0. Fully supported by the OpenLDAP backend only.
+
+**CURLUSESSL_*** enums became `long` types in 8.13.0, prior to this version
+a `long` cast was necessary when passed to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_VERBOSE.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_VERBOSE.3
deleted file mode 100644
index b2c9b4ecdc..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_VERBOSE.3
+++ /dev/null
@@ -1,69 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_VERBOSE 3 "16 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_VERBOSE \- verbose mode
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_VERBOSE, long onoff);
-.fi
-.SH DESCRIPTION
-Set the \fIonoff\fP parameter to 1 to make the library display a lot of
-verbose information about its operations on this \fIhandle\fP. Useful for
-libcurl and/or protocol debugging and understanding. The verbose information
-is sent to stderr, or the stream set with \fICURLOPT_STDERR(3)\fP.
-
-You hardly ever want this enabled in production use, you almost always want
-this used when you debug/report problems.
-
-To also get all the protocol data sent and received, consider using the
-\fICURLOPT_DEBUGFUNCTION(3)\fP.
-.SH DEFAULT
-0, meaning disabled.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
-
-  /* ask libcurl to show us the verbose output */
-  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
-
-  /* Perform the request */
-  curl_easy_perform(curl);
-}
-.fi
-.SH AVAILABILITY
-Always
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_STDERR "(3), " CURLOPT_DEBUGFUNCTION "(3), "
-.BR CURLOPT_ERRORBUFFER "(3), "
-.BR curl_global_trace "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_VERBOSE.md b/third-party/curl/docs/libcurl/opts/CURLOPT_VERBOSE.md
new file mode 100644
index 0000000000..80b66a8a63
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_VERBOSE.md
@@ -0,0 +1,78 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_VERBOSE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_DEBUGFUNCTION (3)
+  - CURLOPT_ERRORBUFFER (3)
+  - CURLOPT_STDERR (3)
+  - curl_global_trace (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_VERBOSE - verbose mode
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_VERBOSE, long onoff);
+~~~
+
+# DESCRIPTION
+
+Set the *onoff* parameter to 1 to make the library display a lot of verbose
+information about its operations on this *handle*. Useful for libcurl and/or
+protocol debugging and understanding. The verbose information is sent to
+stderr, or the stream set with CURLOPT_STDERR(3).
+
+You hardly ever want this enabled in production use, you almost always want
+this used when you debug/report problems.
+
+To also get all the protocol data sent and received, consider using the
+CURLOPT_DEBUGFUNCTION(3).
+
+**WARNING:** this may show sensitive contents from headers and data.
+
+# DEFAULT
+
+0, meaning disabled.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+    /* ask libcurl to show us the verbose output */
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+    /* Perform the request */
+    result = curl_easy_perform(curl);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_WILDCARDMATCH.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_WILDCARDMATCH.3
deleted file mode 100644
index a74df70afd..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_WILDCARDMATCH.3
+++ /dev/null
@@ -1,108 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_WILDCARDMATCH 3 "16 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_WILDCARDMATCH \- directory wildcard transfers
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_WILDCARDMATCH, long onoff);
-.fi
-.SH DESCRIPTION
-Set \fIonoff\fP to 1 if you want to transfer multiple files according to a
-file name pattern. The pattern can be specified as part of the
-\fICURLOPT_URL(3)\fP option, using an \fBfnmatch\fP-like pattern (Shell
-Pattern Matching) in the last part of URL (file name).
-
-By default, libcurl uses its internal wildcard matching implementation. You
-can provide your own matching function by the
-\fICURLOPT_FNMATCH_FUNCTION(3)\fP option.
-
-A brief introduction of its syntax follows:
-.RS
-.IP "* - ASTERISK"
-.nf
-  ftp://example.com/some/path/*.txt
-.fi
-for all txt's from the root directory. Only two asterisks are allowed within
-the same pattern string.
-.RE
-.RS
-.IP "? - QUESTION MARK"
-Question mark matches any (exactly one) character.
-.nf
-  ftp://example.com/some/path/photo?.jpg
-.fi
-.RE
-.RS
-.IP "[ - BRACKET EXPRESSION"
-The left bracket opens a bracket expression. The question mark and asterisk have
-no special meaning in a bracket expression. Each bracket expression ends by the
-right bracket and matches exactly one character. Some examples follow:
-
-\fB[a-zA-Z0\-9]\fP or \fB[f\-gF\-G]\fP \- character interval
-
-\fB[abc]\fP - character enumeration
-
-\fB[^abc]\fP or \fB[!abc]\fP - negation
-
-\fB[[:name:]]\fP class expression. Supported classes are
-\fBalnum\fP,\fBlower\fP, \fBspace\fP, \fBalpha\fP, \fBdigit\fP, \fBprint\fP,
-\fBupper\fP, \fBblank\fP, \fBgraph\fP, \fBxdigit\fP.
-
-\fB[][-!^]\fP - special case \- matches only '\-', ']', '[', '!' or '^'. These
-characters have no special purpose.
-
-\fB[\\[\\]\\\\]\fP - escape syntax. Matches '[', ']' or '\e'.
-
-Using the rules above, a file name pattern can be constructed:
-.nf
-  ftp://example.com/some/path/[a-z[:upper:]\\\\].jpg
-.fi
-.SH PROTOCOLS
-This feature is only supported for FTP download.
-.SH EXAMPLE
-.nf
-/* initialization of easy handle */
-handle = curl_easy_init();
-
-/* turn on wildcard matching */
-curl_easy_setopt(handle, CURLOPT_WILDCARDMATCH, 1L);
-
-/* callback is called before download of concrete file started */
-curl_easy_setopt(handle, CURLOPT_CHUNK_BGN_FUNCTION, file_is_coming);
-
-/* callback is called after data from the file have been transferred */
-curl_easy_setopt(handle, CURLOPT_CHUNK_END_FUNCTION, file_is_downloaded);
-
-/* See more on https://curl.se/libcurl/c/ftp-wildcard.html */
-.fi
-.SH AVAILABILITY
-Added in 7.21.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_FNMATCH_FUNCTION "(3), " CURLOPT_URL "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_WILDCARDMATCH.md b/third-party/curl/docs/libcurl/opts/CURLOPT_WILDCARDMATCH.md
new file mode 100644
index 0000000000..01149c4f5b
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_WILDCARDMATCH.md
@@ -0,0 +1,113 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_WILDCARDMATCH
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CHUNK_BGN_FUNCTION (3)
+  - CURLOPT_CHUNK_END_FUNCTION (3)
+  - CURLOPT_FNMATCH_FUNCTION (3)
+  - CURLOPT_URL (3)
+Protocol:
+  - FTP
+Added-in: 7.21.0
+---
+
+# NAME
+
+CURLOPT_WILDCARDMATCH - directory wildcard transfers
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_WILDCARDMATCH, long onoff);
+~~~
+
+# DESCRIPTION
+
+Set *onoff* to 1 if you want to transfer multiple files according to a
+filename pattern. The pattern can be specified as part of the CURLOPT_URL(3)
+option, using an **fnmatch**-like pattern (Shell Pattern Matching) in the last
+part of URL (filename).
+
+By default, libcurl uses its internal wildcard matching implementation. You
+can provide your own matching function by the
+CURLOPT_FNMATCH_FUNCTION(3) option.
+
+A brief introduction of its syntax follows:
+
+## * - ASTERISK
+
+    ftp://example.com/some/path/*.txt
+
+matches all `.txt` files in the root directory. Only two asterisks are allowed
+within the same pattern string.
+
+## ? - QUESTION MARK
+
+Question mark matches any (exactly one) character.
+
+    ftp://example.com/some/path/photo?.jpg
+
+## [ - BRACKET EXPRESSION
+
+The left bracket opens a bracket expression. The question mark and asterisk have
+no special meaning in a bracket expression. Each bracket expression ends by the
+right bracket and matches exactly one character. Some examples follow:
+
+**[a-zA-Z0-9]** or **[f-gF-G]** - character interval
+
+**[abc]** - character enumeration
+
+**[^abc]** or **[!abc]** - negation
+
+**[[:name:]]** class expression. Supported classes are **alnum**,**lower**,
+**space**, **alpha**, **digit**, **print**, **upper**, **blank**, **graph**,
+**xdigit**.
+
+**[][-!^]** - special case - matches only '-', ']', '[', '!' or '^'. These
+characters have no special purpose.
+
+**[[]]** - escape syntax. Matches '[', ']' or 'e'.
+
+Using the rules above, a filename pattern can be constructed:
+
+    ftp://example.com/some/path/[a-z[:upper:]\\].jpg
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+extern long begin_cb(struct curl_fileinfo *, void *, int);
+extern long end_cb(void *ptr);
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    /* turn on wildcard matching */
+    curl_easy_setopt(curl, CURLOPT_WILDCARDMATCH, 1L);
+
+    /* callback is called before download of concrete file started */
+    curl_easy_setopt(curl, CURLOPT_CHUNK_BGN_FUNCTION, begin_cb);
+
+    /* callback is called after data from the file have been transferred */
+    curl_easy_setopt(curl, CURLOPT_CHUNK_END_FUNCTION, end_cb);
+
+    /* See more on https://curl.se/libcurl/c/ftp-wildcard.html */
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_WRITEDATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_WRITEDATA.3
deleted file mode 100644
index 1de226e842..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_WRITEDATA.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_WRITEDATA 3 "16 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_WRITEDATA \- pointer passed to the write callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_WRITEDATA, void *pointer);
-.fi
-.SH DESCRIPTION
-A data \fIpointer\fP to pass to the write callback. If you use the
-\fICURLOPT_WRITEFUNCTION(3)\fP option, this is the pointer you get in that
-callback's fourth and last argument. If you do not use a write callback, you
-must make \fIpointer\fP a 'FILE *' (cast to 'void *') as libcurl passes this
-to \fIfwrite(3)\fP when writing data.
-
-The internal \fICURLOPT_WRITEFUNCTION(3)\fP writes the data to the FILE *
-given with this option, or to stdout if this option has not been set.
-
-If you are using libcurl as a Windows DLL, you \fBMUST\fP use a
-\fICURLOPT_WRITEFUNCTION(3)\fP if you set this option or you might experience
-crashes.
-.SH DEFAULT
-By default, this is a FILE * to stdout.
-.SH PROTOCOLS
-Used for all protocols.
-.SH EXAMPLE
-A common technique is to use the write callback to store the incoming data
-into a dynamically growing allocated buffer, and then this
-\fICURLOPT_WRITEDATA(3)\fP is used to point to a struct or the buffer to store
-data in. Like in the getinmemory example:
-https://curl.se/libcurl/c/getinmemory.html
-.SH AVAILABILITY
-Available in all libcurl versions. This option was formerly known as
-\fICURLOPT_FILE\fP, the name \fICURLOPT_WRITEDATA(3)\fP was introduced in
-7.9.7.
-.SH RETURN VALUE
-This returns CURLE_OK.
-.SH "SEE ALSO"
-.BR CURLOPT_WRITEFUNCTION "(3), " CURLOPT_READDATA "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_WRITEDATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_WRITEDATA.md
new file mode 100644
index 0000000000..f6c6a2eeb9
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_WRITEDATA.md
@@ -0,0 +1,66 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_WRITEDATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HEADERDATA (3)
+  - CURLOPT_READDATA (3)
+  - CURLOPT_WRITEFUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.9.7
+---
+
+# NAME
+
+CURLOPT_WRITEDATA - pointer passed to the write callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_WRITEDATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+A data *pointer* to pass to the write callback. If you use the
+CURLOPT_WRITEFUNCTION(3) option, this is the pointer you get in that
+callback's fourth and last argument. If you do not use a write callback, you
+must make *pointer* a 'FILE *' (cast to 'void *') as libcurl passes this
+to *fwrite(3)* when writing data.
+
+The internal CURLOPT_WRITEFUNCTION(3) writes the data to the FILE *
+given with this option, or to stdout if this option has not been set.
+
+If you are using libcurl as a Windows DLL, you must also use
+CURLOPT_WRITEFUNCTION(3) if you set this option or you might experience
+crashes.
+
+# DEFAULT
+
+stdout
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+A common technique is to use the write callback to store the incoming data
+into a dynamically growing allocated buffer, and then this
+CURLOPT_WRITEDATA(3) is used to point to a struct or the buffer to store data
+in. Like in the *getinmemory* example:
+https://curl.se/libcurl/c/getinmemory.html
+
+# HISTORY
+
+This option was formerly known as CURLOPT_FILE, the name CURLOPT_WRITEDATA(3)
+was added in 7.9.7.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This returns CURLE_OK.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_WRITEFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_WRITEFUNCTION.3
deleted file mode 100644
index 775a6f0bc2..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_WRITEFUNCTION.3
+++ /dev/null
@@ -1,132 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_WRITEFUNCTION 3 "16 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_WRITEFUNCTION \- callback for writing received data
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-size_t write_callback(char *ptr, size_t size, size_t nmemb, void *userdata);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_WRITEFUNCTION, write_callback);
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-This callback function gets called by libcurl as soon as there is data
-received that needs to be saved. For most transfers, this callback gets called
-many times and each invoke delivers another chunk of data. \fIptr\fP points to
-the delivered data, and the size of that data is \fInmemb\fP; \fIsize\fP is
-always 1.
-
-The callback function is passed as much data as possible in all invokes, but
-you must not make any assumptions. It may be one byte, it may be
-thousands. The maximum amount of body data that is be passed to the write
-callback is defined in the curl.h header file: \fICURL_MAX_WRITE_SIZE\fP (the
-usual default is 16K). If \fICURLOPT_HEADER(3)\fP is enabled, which makes
-header data get passed to the write callback, you can get up to
-\fICURL_MAX_HTTP_HEADER\fP bytes of header data passed into it. This usually
-means 100K.
-
-This function may be called with zero bytes data if the transferred file is
-empty.
-
-The data passed to this function is not null-terminated!
-
-Set the \fIuserdata\fP argument with the \fICURLOPT_WRITEDATA(3)\fP option.
-
-Your callback should return the number of bytes actually taken care of. If
-that amount differs from the amount passed to your callback function, it
-signals an error condition to the library. This causes the transfer to get
-aborted and the libcurl function used returns \fICURLE_WRITE_ERROR\fP.
-
-You can also abort the transfer by returning CURL_WRITEFUNC_ERROR. (7.87.0)
-
-If the callback function returns CURL_WRITEFUNC_PAUSE it pauses this
-transfer. See \fIcurl_easy_pause(3)\fP for further details.
-
-Set this option to NULL to get the internal default function used instead of
-your callback. The internal default function writes the data to the FILE *
-given with \fICURLOPT_WRITEDATA(3)\fP.
-
-This option does not enable HSTS, you need to use \fICURLOPT_HSTS_CTRL(3)\fP to
-do that.
-.SH DEFAULT
-libcurl uses 'fwrite' as a callback by default.
-.SH PROTOCOLS
-For all protocols
-.SH EXAMPLE
-.nf
-struct memory {
-  char *response;
-  size_t size;
-};
-
-static size_t cb(void *data, size_t size, size_t nmemb, void *clientp)
-{
-  size_t realsize = size * nmemb;
-  struct memory *mem = (struct memory *)clientp;
-
-  char *ptr = realloc(mem->response, mem->size + realsize + 1);
-  if(ptr == NULL)
-    return 0;  /* out of memory! */
-
-  mem->response = ptr;
-  memcpy(&(mem->response[mem->size]), data, realsize);
-  mem->size += realsize;
-  mem->response[mem->size] = 0;
-
-  return realsize;
-}
-
-struct memory chunk = {0};
-CURLcode res;
-CURL *curl_handle = curl_easy_init();
-
-if (curl_handle)
-{
-  /* send all data to this function  */
-  curl_easy_setopt(curl_handle, CURLOPT_WRITEFUNCTION, cb);
-
-  /* we pass our 'chunk' struct to the callback function */
-  curl_easy_setopt(curl_handle, CURLOPT_WRITEDATA, (void *)&chunk);
-
-  /* send a request */
-  res = curl_easy_perform(curl_handle);
-
-  /* remember to free the buffer */
-  free(chunk.response);
-
-  curl_easy_cleanup(curl_handle);
-}
-.fi
-.SH AVAILABILITY
-Support for the CURL_WRITEFUNC_PAUSE return code was added in version 7.18.0.
-.SH RETURN VALUE
-This returns CURLE_OK.
-.SH "SEE ALSO"
-.BR CURLOPT_WRITEDATA "(3), " CURLOPT_READFUNCTION "(3), "
-.BR CURLOPT_HEADERFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_WRITEFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_WRITEFUNCTION.md
new file mode 100644
index 0000000000..792ed3d3b8
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_WRITEFUNCTION.md
@@ -0,0 +1,140 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_WRITEFUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_HEADERFUNCTION (3)
+  - CURLOPT_READFUNCTION (3)
+  - CURLOPT_WRITEDATA (3)
+Protocol:
+  - All
+Added-in: 7.1
+---
+
+# NAME
+
+CURLOPT_WRITEFUNCTION - callback for writing received data
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+size_t write_callback(char *ptr, size_t size, size_t nmemb, void *userdata);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_WRITEFUNCTION, write_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+This callback function gets called by libcurl as soon as there is data
+received that needs to be saved. For most transfers, this callback gets called
+many times and each invoke delivers another chunk of data. *ptr* points to the
+delivered data, and the size of that data is *nmemb*; *size* is always 1.
+
+The data passed to this function is not null-terminated.
+
+The callback function is passed as much data as possible in all invokes, but
+you must not make any assumptions. It may be one byte, it may be thousands.
+The maximum amount of body data that is passed to the write callback is
+defined in the curl.h header file: *CURL_MAX_WRITE_SIZE* (the usual default is
+16K). If CURLOPT_HEADER(3) is enabled, which makes header data get passed to
+the write callback, you can get up to *CURL_MAX_HTTP_HEADER* bytes of header
+data passed into it. This usually means 100K.
+
+The CURLOPT_WRITEFUNCTION(3) callback receives the final response payload.
+When CURLOPT_FOLLOWLOCATION(3) is enabled, libcurl automatically handles
+intermediate 3xx redirects, meaning their HTTP bodies are skipped and not
+passed to this callback.
+
+This function may be called with zero bytes data if the transferred file is
+empty.
+
+Set the *userdata* argument with the CURLOPT_WRITEDATA(3) option.
+
+Your callback should return the number of bytes actually taken care of. If
+that amount differs from the amount passed to your callback function, it
+signals an error condition to the library. This causes the transfer to get
+aborted and the libcurl function used returns *CURLE_WRITE_ERROR*.
+
+You can also abort the transfer by returning CURL_WRITEFUNC_ERROR (added in
+7.87.0), which makes *CURLE_WRITE_ERROR* get returned.
+
+If the callback function returns CURL_WRITEFUNC_PAUSE it pauses this transfer.
+See curl_easy_pause(3) for further details.
+
+Set this option to NULL to get the internal default function used instead of
+your callback. The internal default function writes the data to the FILE *
+given with CURLOPT_WRITEDATA(3).
+
+# DEFAULT
+
+fwrite(3)
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+#include <stdlib.h> /* for realloc */
+#include <string.h> /* for memcpy */
+
+struct memory {
+  char *response;
+  size_t size;
+};
+
+static size_t cb(char *data, size_t size, size_t nmemb, void *clientp)
+{
+  size_t realsize = nmemb;
+  struct memory *mem = (struct memory *)clientp;
+
+  char *ptr = realloc(mem->response, mem->size + realsize + 1);
+  if(!ptr)
+    return 0;  /* out of memory */
+
+  mem->response = ptr;
+  memcpy(&(mem->response[mem->size]), data, realsize);
+  mem->size += realsize;
+  mem->response[mem->size] = 0;
+
+  return realsize;
+}
+
+int main(void)
+{
+  struct memory chunk = { 0 };
+  CURLcode result;
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    /* send all data to this function */
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, cb);
+
+    /* we pass our 'chunk' struct to the callback function */
+    curl_easy_setopt(curl, CURLOPT_WRITEDATA, (void *)&chunk);
+
+    /* send a request */
+    result = curl_easy_perform(curl);
+
+    /* remember to free the buffer */
+    free(chunk.response);
+
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+Support for the CURL_WRITEFUNC_PAUSE return code was added in version 7.18.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+This returns CURLE_OK.
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_WS_OPTIONS.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_WS_OPTIONS.3
deleted file mode 100644
index a575fc3550..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_WS_OPTIONS.3
+++ /dev/null
@@ -1,69 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_WS_OPTIONS 3 "10 Jun 2022" libcurl libcurl
-.SH NAME
-CURLOPT_WS_OPTIONS \- WebSocket behavior options
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_WS_OPTIONS, long bitmask);
-.fi
-.SH DESCRIPTION
-Pass a long with a bitmask to tell libcurl about specific WebSocket
-behaviors.
-
-To detach a WebSocket connection and use the \fIcurl_ws_send(3)\fP and
-\fIcurl_ws_recv(3)\fP functions after the HTTP upgrade procedure, set the
-\fICURLOPT_CONNECT_ONLY(3)\fP option to 2L.
-
-Available bits in the bitmask
-.IP "CURLWS_RAW_MODE (1)"
-Deliver "raw" WebSocket traffic to the \fICURLOPT_WRITEFUNCTION(3)\fP
-callback.
-
-In raw mode, libcurl does not handle pings or any other frame for the
-application.
-.SH DEFAULT
-0
-.SH PROTOCOLS
-WebSocket
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "ws://example.com/");
-  /* tell curl we deal with all the WebSocket magic ourselves */
-  curl_easy_setopt(curl, CURLOPT_WS_OPTIONS, (long)CURLWS_RAW_MODE);
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.86.0
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR curl_ws_recv "(3), " curl_ws_send "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_WS_OPTIONS.md b/third-party/curl/docs/libcurl/opts/CURLOPT_WS_OPTIONS.md
new file mode 100644
index 0000000000..965183b38f
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_WS_OPTIONS.md
@@ -0,0 +1,90 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_WS_OPTIONS
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_CONNECT_ONLY (3)
+  - curl_ws_recv (3)
+  - curl_ws_send (3)
+Protocol:
+  - WS
+Added-in: 7.86.0
+---
+
+# NAME
+
+CURLOPT_WS_OPTIONS - WebSocket behavior options
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_WS_OPTIONS, long bitmask);
+~~~
+
+# DESCRIPTION
+
+Pass a long with a bitmask to tell libcurl about specific WebSocket
+behaviors.
+
+To detach a WebSocket connection and use the curl_ws_send(3) and
+curl_ws_recv(3) functions after the HTTP upgrade procedure, set the
+CURLOPT_CONNECT_ONLY(3) option to 2L.
+
+Available bits in the bitmask
+
+## CURLWS_RAW_MODE (1)
+
+Deliver "raw" WebSocket traffic to the CURLOPT_WRITEFUNCTION(3)
+callback. Read "raw" WebSocket traffic from the CURLOPT_READFUNCTION(3)
+callback.
+
+In raw mode, libcurl does not handle pings or any other frame for the
+application.
+
+## CURLWS_NOAUTOPONG (2)
+
+Disable the automatic reply to PING messages. This means users must
+send a PONG message with curl_ws_send(3). This feature is added with
+version 8.14.0.
+
+# DEFAULT
+
+0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "ws://example.com/");
+    /* tell curl we deal with all the WebSocket logic ourselves */
+    curl_easy_setopt(curl, CURLOPT_WS_OPTIONS, CURLWS_RAW_MODE);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+**CURLWS_RAW_MODE** and **CURLWS_NOAUTOPONG** macros became `long` types
+in 8.16.0, prior to this version a `long` cast was necessary when passed
+to curl_easy_setopt(3).
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_XFERINFODATA.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_XFERINFODATA.3
deleted file mode 100644
index 2b7c75023d..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_XFERINFODATA.3
+++ /dev/null
@@ -1,75 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_XFERINFODATA 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_XFERINFODATA \- pointer passed to the progress callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_XFERINFODATA, void *pointer);
-.fi
-.SH DESCRIPTION
-Pass a \fIpointer\fP that is untouched by libcurl and passed as the first
-argument in the progress callback set with \fICURLOPT_XFERINFOFUNCTION(3)\fP.
-
-This is an alias for \fICURLOPT_PROGRESSDATA(3)\fP.
-.SH DEFAULT
-The default value of this parameter is NULL.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
- struct progress {
-   char *private;
-   size_t size;
- };
-
- static size_t progress_callback(void *clientp,
-                                 curl_off_t dltotal,
-                                 curl_off_t dlnow,
-                                 curl_off_t ultotal,
-                                 curl_off_t ulnow)
- {
-   struct memory *progress = (struct progress *)clientp;
-
-   /* use the values */
-
-   return 0; /* all is good */
- }
-
- struct progress data;
-
- /* pass struct to callback  */
- curl_easy_setopt(curl_handle, CURLOPT_XFERINFODATA, &data);
-
- curl_easy_setopt(curl_handle, CURLOPT_XFERINFOFUNCTION, progress_callback);
-.fi
-.SH AVAILABILITY
-Added in 7.32.0
-.SH RETURN VALUE
-Returns CURLE_OK
-.SH "SEE ALSO"
-.BR CURLOPT_XFERINFOFUNCTION "(3), " CURLOPT_VERBOSE "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_XFERINFODATA.md b/third-party/curl/docs/libcurl/opts/CURLOPT_XFERINFODATA.md
new file mode 100644
index 0000000000..5099e0a469
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_XFERINFODATA.md
@@ -0,0 +1,82 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_XFERINFODATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_NOPROGRESS (3)
+  - CURLOPT_VERBOSE (3)
+  - CURLOPT_XFERINFOFUNCTION (3)
+Protocol:
+  - All
+Added-in: 7.32.0
+---
+
+# NAME
+
+CURLOPT_XFERINFODATA - pointer passed to the progress callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_XFERINFODATA, void *pointer);
+~~~
+
+# DESCRIPTION
+
+Pass a *pointer* that is untouched by libcurl and passed as the first
+argument in the progress callback set with CURLOPT_XFERINFOFUNCTION(3).
+
+This is an alias for CURLOPT_PROGRESSDATA(3).
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct progress {
+  char *private;
+  size_t size;
+};
+
+static int progress_cb(void *clientp,
+                       curl_off_t dltotal,
+                       curl_off_t dlnow,
+                       curl_off_t ultotal,
+                       curl_off_t ulnow)
+{
+  struct progress *memory = clientp;
+  printf("private ptr: %p\n", memory->private);
+  /* use the values */
+
+  return 0; /* all is good */
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    struct progress data;
+
+    /* pass struct to callback */
+    curl_easy_setopt(curl, CURLOPT_XFERINFODATA, &data);
+    curl_easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, progress_cb);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_XFERINFOFUNCTION.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_XFERINFOFUNCTION.3
deleted file mode 100644
index 27644e2750..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_XFERINFOFUNCTION.3
+++ /dev/null
@@ -1,114 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_XFERINFOFUNCTION 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_XFERINFOFUNCTION \- progress meter callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-int progress_callback(void *clientp,
-                      curl_off_t dltotal,
-                      curl_off_t dlnow,
-                      curl_off_t ultotal,
-                      curl_off_t ulnow);
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_XFERINFOFUNCTION,
-                          progress_callback);
-.fi
-.SH DESCRIPTION
-Pass a pointer to your callback function, which should match the prototype
-shown above.
-
-This function gets called by libcurl instead of its internal equivalent with a
-frequent interval. While data is being transferred it gets called frequently,
-and during slow periods like when nothing is being transferred it can slow
-down to about one call per second.
-
-\fIclientp\fP is the pointer set with \fICURLOPT_XFERINFODATA(3)\fP, it is not
-used by libcurl but is only passed along from the application to the callback.
-
-The callback gets told how much data libcurl is about to transfer and has
-already transferred, in number of bytes. \fIdltotal\fP is the total number of
-bytes libcurl expects to download in this transfer. \fIdlnow\fP is the number
-of bytes downloaded so far. \fIultotal\fP is the total number of bytes libcurl
-expects to upload in this transfer. \fIulnow\fP is the number of bytes
-uploaded so far.
-
-Unknown/unused argument values passed to the callback are set to zero (like if
-you only download data, the upload size remains 0). Many times the callback is
-called one or more times first, before it knows the data sizes so a program
-must be made to handle that.
-
-If your callback function returns CURL_PROGRESSFUNC_CONTINUE it makes libcurl
-to continue executing the default progress function.
-
-Returning any other non-zero value from this callback makes libcurl abort the
-transfer and return \fICURLE_ABORTED_BY_CALLBACK\fP.
-
-If you transfer data with the multi interface, this function is not called
-during periods of idleness unless you call the appropriate libcurl function
-that performs transfers.
-
-\fICURLOPT_NOPROGRESS(3)\fP must be set to 0 to make this function actually
-get called.
-.SH DEFAULT
-By default, libcurl has an internal progress meter. That is rarely wanted by
-users.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
- struct progress {
-   char *private;
-   size_t size;
- };
-
- static size_t progress_callback(void *clientp,
-                                 curl_off_t dltotal,
-                                 curl_off_t dlnow,
-                                 curl_off_t ultotal,
-                                 curl_off_t ulnow)
- {
-   struct progress *memory = (struct progress *)clientp;
-
-   /* use the values */
-
-   return 0; /* all is good */
- }
-
- struct progress data;
-
- /* pass struct to callback  */
- curl_easy_setopt(curl_handle, CURLOPT_XFERINFODATA, &data);
-
- curl_easy_setopt(curl_handle, CURLOPT_XFERINFOFUNCTION, progress_callback);
-.fi
-.SH AVAILABILITY
-Added in 7.32.0. This callback replaces \fICURLOPT_PROGRESSFUNCTION(3)\fP
-.SH RETURN VALUE
-Returns CURLE_OK.
-.SH "SEE ALSO"
-.BR CURLOPT_XFERINFODATA "(3), " CURLOPT_NOPROGRESS "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_XFERINFOFUNCTION.md b/third-party/curl/docs/libcurl/opts/CURLOPT_XFERINFOFUNCTION.md
new file mode 100644
index 0000000000..161be8fd4b
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_XFERINFOFUNCTION.md
@@ -0,0 +1,126 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_XFERINFOFUNCTION
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_NOPROGRESS (3)
+  - CURLOPT_XFERINFODATA (3)
+Protocol:
+  - All
+Added-in: 7.32.0
+---
+
+# NAME
+
+CURLOPT_XFERINFOFUNCTION - progress meter callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+int progress_callback(void *clientp,
+                      curl_off_t dltotal,
+                      curl_off_t dlnow,
+                      curl_off_t ultotal,
+                      curl_off_t ulnow);
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_XFERINFOFUNCTION,
+                          progress_callback);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to your callback function, which should match the prototype
+shown above.
+
+This function gets called by libcurl instead of its internal equivalent with a
+frequent interval. While data is being transferred it gets called frequently,
+and during slow periods like when nothing is being transferred it can slow
+down to about one call per second.
+
+*clientp* is the pointer set with CURLOPT_XFERINFODATA(3), it is not
+used by libcurl but is only passed along from the application to the callback.
+
+The callback gets told how much data libcurl is about to transfer and has
+already transferred, in number of bytes. *dltotal* is the total number of
+bytes libcurl expects to download in this transfer. *dlnow* is the number
+of bytes downloaded so far. *ultotal* is the total number of bytes libcurl
+expects to upload in this transfer. *ulnow* is the number of bytes
+uploaded so far.
+
+Unknown/unused argument values passed to the callback are set to zero (like if
+you only download data, the upload size remains 0). Many times the callback is
+called one or more times first, before it knows the data sizes so a program
+must be made to handle that.
+
+Return zero from the callback if everything is fine.
+
+Return 1 from this callback to make libcurl abort the transfer and return
+*CURLE_ABORTED_BY_CALLBACK*.
+
+If your callback function returns CURL_PROGRESSFUNC_CONTINUE it makes libcurl
+to continue executing the default progress function.
+
+If you transfer data with the multi interface, this function is not called
+during periods of idleness unless you call the appropriate libcurl function
+that performs transfers.
+
+CURLOPT_NOPROGRESS(3) must be set to 0 to make this function actually
+get called.
+
+# DEFAULT
+
+NULL - use the internal progress meter. That is rarely wanted by users.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct progress {
+  char *private;
+  size_t size;
+};
+
+static int xferinfo_callback(void *clientp,
+                             curl_off_t dltotal,
+                             curl_off_t dlnow,
+                             curl_off_t ultotal,
+                             curl_off_t ulnow)
+{
+  struct progress *memory = clientp;
+  printf("my ptr: %p\n", memory->private);
+
+  /* use the values */
+
+  return 0; /* all is good */
+}
+
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    struct progress data;
+
+    /* pass struct to callback */
+    curl_easy_setopt(curl, CURLOPT_XFERINFODATA, &data);
+
+    /* enable progress callback getting called */
+    curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
+
+    curl_easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, xferinfo_callback);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_XOAUTH2_BEARER.3 b/third-party/curl/docs/libcurl/opts/CURLOPT_XOAUTH2_BEARER.3
deleted file mode 100644
index 04dc7b6780..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLOPT_XOAUTH2_BEARER.3
+++ /dev/null
@@ -1,64 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_XOAUTH2_BEARER 3 "19 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_XOAUTH2_BEARER \- OAuth 2.0 access token
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_XOAUTH2_BEARER, char *token);
-.fi
-.SH DESCRIPTION
-Pass a char * as parameter, which should point to the null-terminated OAuth
-2.0 Bearer Access Token for use with HTTP, IMAP, LDAP, POP3 and SMTP servers
-that support the OAuth 2.0 Authorization Framework.
-
-Note: For IMAP, LDAP, POP3 and SMTP, the user name used to generate the
-Bearer Token should be supplied via the \fICURLOPT_USERNAME(3)\fP option.
-
-The application does not have to keep the string around after setting this
-option.
-.SH DEFAULT
-NULL
-.SH PROTOCOLS
-HTTP, IMAP, LDAP, POP3 and SMTP
-.SH EXAMPLE
-.nf
-CURL *curl = curl_easy_init();
-if(curl) {
-  curl_easy_setopt(curl, CURLOPT_URL, "pop3://example.com/");
-  curl_easy_setopt(curl, CURLOPT_XOAUTH2_BEARER, "1ab9cb22ba269a7");
-  ret = curl_easy_perform(curl);
-  curl_easy_cleanup(curl);
-}
-.fi
-.SH AVAILABILITY
-Added in 7.33.0. Support for OpenLDAP added in 7.82.0.
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
-.SH "SEE ALSO"
-.BR CURLOPT_MAIL_AUTH "(3), " CURLOPT_USERNAME "(3), "
diff --git a/third-party/curl/docs/libcurl/opts/CURLOPT_XOAUTH2_BEARER.md b/third-party/curl/docs/libcurl/opts/CURLOPT_XOAUTH2_BEARER.md
new file mode 100644
index 0000000000..894c1384a5
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLOPT_XOAUTH2_BEARER.md
@@ -0,0 +1,79 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLOPT_XOAUTH2_BEARER
+Section: 3
+Source: libcurl
+See-also:
+  - CURLOPT_MAIL_AUTH (3)
+  - CURLOPT_USERNAME (3)
+Protocol:
+  - HTTP
+  - IMAP
+  - LDAP
+  - POP3
+  - SMTP
+Added-in: 7.33.0
+---
+
+# NAME
+
+CURLOPT_XOAUTH2_BEARER - OAuth 2.0 access token
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_XOAUTH2_BEARER, char *token);
+~~~
+
+# DESCRIPTION
+
+Pass a char pointer as parameter, which should point to the null-terminated
+OAuth 2.0 Bearer Access Token for use with HTTP, IMAP, LDAP, POP3 and SMTP
+servers that support the OAuth 2.0 Authorization Framework.
+
+Note: For IMAP, LDAP, POP3 and SMTP, the username used to generate the Bearer
+Token should be supplied via the CURLOPT_USERNAME(3) option.
+
+The application does not have to keep the string around after setting this
+option.
+
+Using this option multiple times makes the last set string override the
+previous ones. Set it to NULL to disable its use again.
+
+# DEFAULT
+
+NULL
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "pop3://example.com/");
+    curl_easy_setopt(curl, CURLOPT_XOAUTH2_BEARER, "1ab9cb22bf269a7");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# HISTORY
+
+Support for OpenLDAP added in 7.82.0.
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_setopt(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/third-party/curl/docs/libcurl/opts/CURLSHOPT_LOCKFUNC.3 b/third-party/curl/docs/libcurl/opts/CURLSHOPT_LOCKFUNC.3
deleted file mode 100644
index 45b456a1a2..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLSHOPT_LOCKFUNC.3
+++ /dev/null
@@ -1,72 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH CURLSHOPT_LOCKFUNC 3 "8 Aug 2003" libcurl libcurl
-.SH NAME
-CURLSHOPT_LOCKFUNC - mutex lock callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-void lockcb(CURL *handle, curl_lock_data data, curl_lock_access access,
-            void *clientp);
-
-CURLSHcode curl_share_setopt(CURLSH *share, CURLSHOPT_LOCKFUNC, lockcb);
-.fi
-.SH DESCRIPTION
-Set a mutex lock callback for the share object, to allow it to get used by
-multiple threads concurrently. There is a corresponding
-\fICURLSHOPT_UNLOCKFUNC(3)\fP callback called when the mutex is again released.
-
-The \fIlockcb\fP argument must be a pointer to a function matching the
-prototype shown above. The arguments to the callback are:
-
-\fIhandle\fP is the currently active easy handle in use when the share object
-is intended to get used.
-
-The \fIdata\fP argument tells what kind of data libcurl wants to lock. Make
-sure that the callback uses a different lock for each kind of data.
-
-\fIaccess\fP defines what access type libcurl wants, shared or single.
-
-\fIclientp\fP is the private pointer you set with \fICURLSHOPT_USERDATA\fP.
-This pointer is not used by libcurl itself.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-  CURLSHcode sh;
-  share = curl_share_init();
-  sh = curl_share_setopt(share, CURLSHOPT_LOCKFUNC, mutex_lock);
-  if(sh)
-    printf("Error: %s\\n", curl_share_strerror(sh));
-.fi
-.SH AVAILABILITY
-Added in 7.10
-.SH RETURN VALUE
-CURLSHE_OK (zero) means that the option was set properly, non-zero means an
-error occurred. See \fIlibcurl-errors(3)\fP for the full list with
-descriptions.
-.SH "SEE ALSO"
-.BR CURLSHOPT_UNLOCKFUNC "(3), "
-.BR curl_share_setopt "(3), " curl_share_cleanup "(3), " curl_share_init "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLSHOPT_LOCKFUNC.md b/third-party/curl/docs/libcurl/opts/CURLSHOPT_LOCKFUNC.md
new file mode 100644
index 0000000000..208dfdd62a
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLSHOPT_LOCKFUNC.md
@@ -0,0 +1,76 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLSHOPT_LOCKFUNC
+Section: 3
+Source: libcurl
+See-also:
+  - CURLSHOPT_UNLOCKFUNC (3)
+  - curl_share_cleanup (3)
+  - curl_share_init (3)
+  - curl_share_setopt (3)
+Protocol:
+  - All
+Added-in: 7.10.3
+---
+
+# NAME
+
+CURLSHOPT_LOCKFUNC - mutex lock callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+void lockcb(CURL *handle, curl_lock_data data, curl_lock_access access,
+            void *clientp);
+
+CURLSHcode curl_share_setopt(CURLSH *share, CURLSHOPT_LOCKFUNC, lockcb);
+~~~
+
+# DESCRIPTION
+
+Set a mutex lock callback for the share object, to allow it to get used by
+multiple threads concurrently. There is a corresponding
+CURLSHOPT_UNLOCKFUNC(3) callback called when the mutex is again released.
+
+The *lockcb* argument must be a pointer to a function matching the
+prototype shown above. The arguments to the callback are:
+
+*handle* is the currently active easy handle in use when the share object
+is intended to get used.
+
+The *data* argument tells what kind of data libcurl wants to lock. Make
+sure that the callback uses a different lock for each kind of data.
+
+*access* defines what access type libcurl wants, shared or single.
+
+*clientp* is the private pointer you set with CURLSHOPT_USERDATA(3).
+This pointer is not used by libcurl itself.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+extern void mutex_lock(CURL *handle, curl_lock_data data,
+                       curl_lock_access access, void *clientp);
+
+int main(void)
+{
+  CURLSHcode sh;
+  CURLSH *share = curl_share_init();
+  sh = curl_share_setopt(share, CURLSHOPT_LOCKFUNC, mutex_lock);
+  if(sh)
+    printf("Error: %s\n", curl_share_strerror(sh));
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+CURLSHE_OK (zero) means that the option was set properly, non-zero means an
+error occurred. See libcurl-errors(3) for the full list with
+descriptions.
diff --git a/third-party/curl/docs/libcurl/opts/CURLSHOPT_SHARE.3 b/third-party/curl/docs/libcurl/opts/CURLSHOPT_SHARE.3
deleted file mode 100644
index 2d4592ec7c..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLSHOPT_SHARE.3
+++ /dev/null
@@ -1,103 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH CURLSHOPT_SHARE 3 "8 Aug 2003" libcurl libcurl
-.SH NAME
-CURLSHOPT_SHARE - add data to share
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLSHcode curl_share_setopt(CURLSH *share, CURLSHOPT_SHARE, long type);
-.fi
-.SH DESCRIPTION
-The \fItype\fP parameter specifies what specific data that should be shared
-and kept in the share object that was created with \fIcurl_share_init(3)\fP.
-The given \fItype\fP must be be one of the values described below. You can set
-\fICURLSHOPT_SHARE(3)\fP multiple times with different data arguments to have
-the share object share multiple types of data. Unset a type again by setting
-\fICURLSHOPT_UNSHARE(3)\fP.
-.IP CURL_LOCK_DATA_COOKIE
-Cookie data is shared across the easy handles using this shared object. Note
-that this does not activate an easy handle's cookie handling. You can do that
-separately by using \fICURLOPT_COOKIEFILE(3)\fP for example.
-.IP CURL_LOCK_DATA_DNS
-Cached DNS hosts are shared across the easy handles using this shared
-object. Note that when you use the multi interface, all easy handles added to
-the same multi handle share DNS cache by default without using this option.
-.IP CURL_LOCK_DATA_SSL_SESSION
-SSL session IDs are shared across the easy handles using this shared
-object. This reduces the time spent in the SSL handshake when reconnecting to
-the same server. Note SSL session IDs are reused within the same easy handle
-by default. Note this symbol was added in 7.10.3 but was not implemented until
-7.23.0.
-.IP CURL_LOCK_DATA_CONNECT
-Put the connection cache in the share object and make all easy handles using
-this share object share the connection cache.
-
-It is not supported to share connections between multiple concurrent threads.
-
-Connections that are used for HTTP/1.1 Pipelining or HTTP/2 multiplexing only
-get additional transfers added to them if the existing connection is held by
-the same multi or easy handle. libcurl does not support doing HTTP/2 streams
-in different threads using a shared connection.
-
-Support for \fBCURL_LOCK_DATA_CONNECT\fP was added in 7.57.0, but the symbol
-existed before this.
-
-Note that when you use the multi interface, all easy handles added to the same
-multi handle shares connection cache by default without using this option.
-.IP CURL_LOCK_DATA_PSL
-The Public Suffix List stored in the share object is made available to all
-easy handle bound to the later. Since the Public Suffix List is periodically
-refreshed, this avoids updates in too many different contexts.
-
-Added in 7.61.0.
-
-Note that when you use the multi interface, all easy handles added to the same
-multi handle shares PSL cache by default without using this option.
-.IP CURL_LOCK_DATA_HSTS
-The in-memory HSTS cache.
-
-It is not supported to share the HSTS between multiple concurrent threads.
-
-Added in 7.88.0
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-  CURLSHcode sh;
-  share = curl_share_init();
-  sh = curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_COOKIE);
-  if(sh)
-    printf("Error: %s\\n", curl_share_strerror(sh));
-.fi
-.SH AVAILABILITY
-Added in 7.10
-.SH RETURN VALUE
-CURLSHE_OK (zero) means that the option was set properly, non-zero means an
-error occurred. See \fIlibcurl-errors(3)\fP for the full list with
-descriptions.
-.SH "SEE ALSO"
-.BR CURLSHOPT_UNSHARE "(3), "
-.BR curl_share_setopt "(3), " curl_share_cleanup "(3), " curl_share_init "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLSHOPT_SHARE.md b/third-party/curl/docs/libcurl/opts/CURLSHOPT_SHARE.md
new file mode 100644
index 0000000000..60e1405bb2
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLSHOPT_SHARE.md
@@ -0,0 +1,119 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLSHOPT_SHARE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLSHOPT_UNSHARE (3)
+  - curl_share_cleanup (3)
+  - curl_share_init (3)
+  - curl_share_setopt (3)
+Protocol:
+  - All
+Added-in: 7.10.3
+---
+
+# NAME
+
+CURLSHOPT_SHARE - add data to share
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLSHcode curl_share_setopt(CURLSH *share, CURLSHOPT_SHARE, int type);
+~~~
+
+# DESCRIPTION
+
+The *type* parameter specifies what specific data that should be shared
+and kept in the share object that was created with curl_share_init(3).
+The given *type* must be one of the values described below. You can set
+CURLSHOPT_SHARE(3) multiple times with different data arguments to have
+the share object share multiple types of data. Unset a type again by setting
+CURLSHOPT_UNSHARE(3).
+
+If any of the data is to be shared in multiple threads then mutex callbacks
+must be set as well. See CURLSHOPT_LOCKFUNC(3) and CURLSHOPT_UNLOCKFUNC(3).
+
+## CURL_LOCK_DATA_COOKIE
+
+Cookie data is shared across the easy handles using this shared object. Note
+that this does not activate an easy handle's cookie handling. You can do that
+separately by using CURLOPT_COOKIEFILE(3) for example.
+
+It is not supported to share cookies between multiple concurrent threads.
+
+## CURL_LOCK_DATA_DNS
+
+Cached DNS hosts are shared across the easy handles using this shared
+object. Note that when you use the multi interface, all easy handles added to
+the same multi handle share the DNS cache by default without using this option.
+
+## CURL_LOCK_DATA_SSL_SESSION
+
+SSL sessions are shared across the easy handles using this shared object. This
+reduces the time spent in the SSL handshake when reconnecting to the same
+server.
+
+Note that when you use the multi interface, all easy handles added to the same
+multi handle share the SSL session cache by default without using this option.
+
+## CURL_LOCK_DATA_CONNECT
+
+Put the connection cache in the share object and make all easy handles using
+this share object share the connection cache.
+
+It is not supported to share connections between multiple concurrent threads.
+
+Connections that are used for HTTP/2 or HTTP/3 multiplexing only get
+additional transfers added to them if the existing connection is held by the
+same multi or easy handle. libcurl does not support doing multiplexed streams
+in different threads using a shared connection.
+
+Note that when you use the multi interface, all easy handles added to the same
+multi handle share the connection cache by default without using this option.
+
+## CURL_LOCK_DATA_PSL
+
+The Public Suffix List stored in the share object is made available to all
+easy handle bound to the later. Since the Public Suffix List is periodically
+refreshed, this avoids updates in too many different contexts.
+
+Added in 7.61.0.
+
+Note that when you use the multi interface, all easy handles added to the same
+multi handle share the PSL cache by default without using this option.
+
+## CURL_LOCK_DATA_HSTS
+
+The in-memory HSTS cache.
+
+It is not supported to share the HSTS between multiple concurrent threads.
+
+Added in 7.88.0
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLSHcode sh;
+  CURLSH *share = curl_share_init();
+  sh = curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_COOKIE);
+  if(sh)
+    printf("Error: %s\n", curl_share_strerror(sh));
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+CURLSHE_OK (zero) means that the option was set properly, non-zero means an
+error occurred. See libcurl-errors(3) for the full list with
+descriptions.
diff --git a/third-party/curl/docs/libcurl/opts/CURLSHOPT_UNLOCKFUNC.3 b/third-party/curl/docs/libcurl/opts/CURLSHOPT_UNLOCKFUNC.3
deleted file mode 100644
index 18c955df81..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLSHOPT_UNLOCKFUNC.3
+++ /dev/null
@@ -1,68 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH CURLSHOPT_UNLOCKFUNC 3 "8 Aug 2003" libcurl libcurl
-.SH NAME
-CURLSHOPT_UNLOCKFUNC - mutex unlock callback
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-void unlockcb(CURL *handle, curl_lock_data data, void *clientp);
-
-CURLSHcode curl_share_setopt(CURLSH *share, CURLSHOPT_UNLOCKFUNC, unlockcb);
-.fi
-.SH DESCRIPTION
-Set a mutex unlock callback for the share object. There is a corresponding
-\fICURLSHOPT_LOCKFUNC(3)\fP callback called when the mutex is first locked.
-
-The \fIunlockcb\fP argument must be a pointer to a function matching the
-prototype shown above. The arguments to the callback are:
-
-\fIhandle\fP is the currently active easy handle in use when the share object
-is released.
-
-The \fIdata\fP argument tells what kind of data libcurl wants to unlock. Make
-sure that the callback uses a different lock for each kind of data.
-
-\fIclientp\fP is the private pointer you set with \fICURLSHOPT_USERDATA\fP.
-This pointer is not used by libcurl itself.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-  CURLSHcode sh;
-  share = curl_share_init();
-  sh = curl_share_setopt(share, CURLSHOPT_UNLOCKFUNC, mutex_unlock);
-  if(sh)
-    printf("Error: %s\\n", curl_share_strerror(sh));
-.fi
-.SH AVAILABILITY
-Added in 7.10
-.SH RETURN VALUE
-CURLSHE_OK (zero) means that the option was set properly, non-zero means an
-error occurred. See \fIlibcurl-errors(3)\fP for the full list with
-descriptions.
-.SH "SEE ALSO"
-.BR CURLSHOPT_LOCKFUNC "(3), "
-.BR curl_share_setopt "(3), " curl_share_cleanup "(3), " curl_share_init "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLSHOPT_UNLOCKFUNC.md b/third-party/curl/docs/libcurl/opts/CURLSHOPT_UNLOCKFUNC.md
new file mode 100644
index 0000000000..503918231d
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLSHOPT_UNLOCKFUNC.md
@@ -0,0 +1,71 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLSHOPT_UNLOCKFUNC
+Section: 3
+Source: libcurl
+See-also:
+  - CURLSHOPT_LOCKFUNC (3)
+  - curl_share_cleanup (3)
+  - curl_share_init (3)
+  - curl_share_setopt (3)
+Protocol:
+  - All
+Added-in: 7.10.3
+---
+
+# NAME
+
+CURLSHOPT_UNLOCKFUNC - mutex unlock callback
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+void unlockcb(CURL *handle, curl_lock_data data, void *clientp);
+
+CURLSHcode curl_share_setopt(CURLSH *share, CURLSHOPT_UNLOCKFUNC, unlockcb);
+~~~
+
+# DESCRIPTION
+
+Set a mutex unlock callback for the share object. There is a corresponding
+CURLSHOPT_LOCKFUNC(3) callback called when the mutex is first locked.
+
+The *unlockcb* argument must be a pointer to a function matching the
+prototype shown above. The arguments to the callback are:
+
+*handle* is the currently active easy handle in use when the share object
+is released.
+
+The *data* argument tells what kind of data libcurl wants to unlock. Make
+sure that the callback uses a different lock for each kind of data.
+
+*clientp* is the private pointer you set with CURLSHOPT_USERDATA(3).
+This pointer is not used by libcurl itself.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+extern void mutex_unlock(CURL *, curl_lock_data, void *);
+
+int main(void)
+{
+  CURLSHcode sh;
+  CURLSH *share = curl_share_init();
+  sh = curl_share_setopt(share, CURLSHOPT_UNLOCKFUNC, mutex_unlock);
+  if(sh)
+    printf("Error: %s\n", curl_share_strerror(sh));
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+CURLSHE_OK (zero) means that the option was set properly, non-zero means an
+error occurred. See libcurl-errors(3) for the full list with
+descriptions.
diff --git a/third-party/curl/docs/libcurl/opts/CURLSHOPT_UNSHARE.3 b/third-party/curl/docs/libcurl/opts/CURLSHOPT_UNSHARE.3
deleted file mode 100644
index a7de4399c1..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLSHOPT_UNSHARE.3
+++ /dev/null
@@ -1,72 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH CURLSHOPT_UNSHARE 3 "8 Aug 2003" libcurl libcurl
-.SH NAME
-CURLSHOPT_UNSHARE - remove data to share
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLSHcode curl_share_setopt(CURLSH *share, CURLSHOPT_UNSHARE, long type);
-.fi
-.SH DESCRIPTION
-The \fItype\fP parameter specifies what specific data that should no longer be
-shared and kept in the share object that was created with
-\fIcurl_share_init(3)\fP. In other words, stop sharing that data in this
-shared object. The given \fItype\fP must be be one of the values described
-below. You can set \fICURLSHOPT_UNSHARE(3)\fP multiple times with different
-data arguments to remove multiple types from the shared object. Add data to
-share again with \fICURLSHOPT_SHARE(3)\fP.
-.IP CURL_LOCK_DATA_COOKIE
-Cookie data is no longer shared across the easy handles using this shared
-object.
-.IP CURL_LOCK_DATA_DNS
-Cached DNS hosts are no longer shared across the easy handles using this
-shared object.
-.IP CURL_LOCK_DATA_SSL_SESSION
-SSL session IDs are no longer shared across the easy handles using this shared
-object.
-.IP CURL_LOCK_DATA_CONNECT
-The connection cache is no longer shared.
-.IP CURL_LOCK_DATA_PSL
-The Public Suffix List is no longer shared.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-  CURLSHcode sh;
-  share = curl_share_init();
-  sh = curl_share_setopt(share, CURLSHOPT_UNSHARE, CURL_LOCK_DATA_COOKIE);
-  if(sh)
-    printf("Error: %s\\n", curl_share_strerror(sh));
-.fi
-.SH AVAILABILITY
-Added in 7.10
-.SH RETURN VALUE
-CURLSHE_OK (zero) means that the option was set properly, non-zero means an
-error occurred. See \fIlibcurl-errors(3)\fP for the full list with
-descriptions.
-.SH "SEE ALSO"
-.BR CURLSHOPT_SHARE "(3), "
-.BR curl_share_setopt "(3), " curl_share_cleanup "(3), " curl_share_init "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLSHOPT_UNSHARE.md b/third-party/curl/docs/libcurl/opts/CURLSHOPT_UNSHARE.md
new file mode 100644
index 0000000000..45ee27dec0
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLSHOPT_UNSHARE.md
@@ -0,0 +1,83 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLSHOPT_UNSHARE
+Section: 3
+Source: libcurl
+See-also:
+  - CURLSHOPT_SHARE (3)
+  - curl_share_cleanup (3)
+  - curl_share_init (3)
+  - curl_share_setopt (3)
+Protocol:
+  - All
+Added-in: 7.10.3
+---
+
+# NAME
+
+CURLSHOPT_UNSHARE - remove data to share
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLSHcode curl_share_setopt(CURLSH *share, CURLSHOPT_UNSHARE, int type);
+~~~
+
+# DESCRIPTION
+
+The *type* parameter specifies what specific data that should no longer be
+shared and kept in the share object that was created with
+curl_share_init(3). In other words, stop sharing that data in this
+shared object. The given *type* must be one of the values described
+below. You can set CURLSHOPT_UNSHARE(3) multiple times with different
+data arguments to remove multiple types from the shared object. Add data to
+share again with CURLSHOPT_SHARE(3).
+
+## CURL_LOCK_DATA_COOKIE
+
+Cookie data is no longer shared across the easy handles using this shared
+object.
+
+## CURL_LOCK_DATA_DNS
+
+Cached DNS hosts are no longer shared across the easy handles using this
+shared object.
+
+## CURL_LOCK_DATA_SSL_SESSION
+
+SSL session IDs are no longer shared across the easy handles using this shared
+object.
+
+## CURL_LOCK_DATA_CONNECT
+
+The connection cache is no longer shared.
+
+## CURL_LOCK_DATA_PSL
+
+The Public Suffix List is no longer shared.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURLSHcode sh;
+  CURLSH *share = curl_share_init();
+  sh = curl_share_setopt(share, CURLSHOPT_UNSHARE, CURL_LOCK_DATA_COOKIE);
+  if(sh)
+    printf("Error: %s\n", curl_share_strerror(sh));
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+CURLSHE_OK (zero) means that the option was set properly, non-zero means an
+error occurred. See libcurl-errors(3) for the full list with
+descriptions.
diff --git a/third-party/curl/docs/libcurl/opts/CURLSHOPT_USERDATA.3 b/third-party/curl/docs/libcurl/opts/CURLSHOPT_USERDATA.3
deleted file mode 100644
index f4ed32f5ef..0000000000
--- a/third-party/curl/docs/libcurl/opts/CURLSHOPT_USERDATA.3
+++ /dev/null
@@ -1,56 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.TH CURLSHOPT_USERDATA 3 "8 Aug 2003" libcurl libcurl
-.SH NAME
-CURLSHOPT_USERDATA - pointer passed to the lock and unlock mutex callbacks
-.SH SYNOPSIS
-.nf
-#include <curl/curl.h>
-
-CURLSHcode curl_share_setopt(CURLSH *share, CURLSHOPT_USERDATA, void *clientp);
-.fi
-.SH DESCRIPTION
-The \fIclientp\fP parameter is held verbatim by libcurl and is passed on as
-the \fIclientp\fP argument to the callbacks set with
-\fICURLSHOPT_LOCKFUNC(3)\fP and \fICURLSHOPT_UNLOCKFUNC(3)\fP.
-.SH PROTOCOLS
-All
-.SH EXAMPLE
-.nf
-  CURLSHcode sh;
-  struct secrets private_stuff;
-  share = curl_share_init();
-  sh = curl_share_setopt(share, CURLSHOPT_USERDATA, &private_stuff);
-  if(sh)
-    printf("Error: %s\\n", curl_share_strerror(sh));
-.fi
-.SH AVAILABILITY
-Added in 7.10
-.SH RETURN VALUE
-CURLSHE_OK (zero) means that the option was set properly, non-zero means an
-error occurred. See \fIlibcurl-errors(3)\fP for the full list with
-descriptions.
-.SH "SEE ALSO"
-.BR CURLSHOPT_LOCKFUNC "(3), "
-.BR curl_share_setopt "(3), " curl_share_cleanup "(3), " curl_share_init "(3)"
diff --git a/third-party/curl/docs/libcurl/opts/CURLSHOPT_USERDATA.md b/third-party/curl/docs/libcurl/opts/CURLSHOPT_USERDATA.md
new file mode 100644
index 0000000000..5796ce21b2
--- /dev/null
+++ b/third-party/curl/docs/libcurl/opts/CURLSHOPT_USERDATA.md
@@ -0,0 +1,61 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLSHOPT_USERDATA
+Section: 3
+Source: libcurl
+See-also:
+  - CURLSHOPT_LOCKFUNC (3)
+  - curl_share_cleanup (3)
+  - curl_share_init (3)
+  - curl_share_setopt (3)
+Protocol:
+  - All
+Added-in: 7.10.3
+---
+
+# NAME
+
+CURLSHOPT_USERDATA - pointer passed to the lock and unlock mutex callbacks
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLSHcode curl_share_setopt(CURLSH *share, CURLSHOPT_USERDATA, void *clientp);
+~~~
+
+# DESCRIPTION
+
+The *clientp* parameter is held verbatim by libcurl and is passed on as
+the *clientp* argument to the callbacks set with
+CURLSHOPT_LOCKFUNC(3) and CURLSHOPT_UNLOCKFUNC(3).
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+struct secrets {
+  void *custom;
+};
+
+int main(void)
+{
+  CURLSHcode sh;
+  struct secrets private_stuff;
+  CURLSH *share = curl_share_init();
+  sh = curl_share_setopt(share, CURLSHOPT_USERDATA, &private_stuff);
+  if(sh)
+    printf("Error: %s\n", curl_share_strerror(sh));
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+CURLSHE_OK (zero) means that the option was set properly, non-zero means an
+error occurred. See libcurl-errors(3) for the full list with
+descriptions.
diff --git a/third-party/curl/docs/libcurl/opts/Makefile.am b/third-party/curl/docs/libcurl/opts/Makefile.am
index 250937fd16..cf33491367 100644
--- a/third-party/curl/docs/libcurl/opts/Makefile.am
+++ b/third-party/curl/docs/libcurl/opts/Makefile.am
@@ -24,40 +24,26 @@
 
 AUTOMAKE_OPTIONS = foreign no-dependencies
 
+if BUILD_DOCS
+# Get man_MANS variable
 include Makefile.inc
 
-man_DISTMANS = $(man_MANS:.3=.3.dist)
+CURLPAGES = $(man_MANS:.3=.md)
+endif
+CLEANFILES = $(man_MANS)
 
-HTMLPAGES = $(man_MANS:.3=.html)
+EXTRA_DIST = $(CURLPAGES) CMakeLists.txt
 
-PDFPAGES = $(man_MANS:.3=.pdf)
+if BUILD_DOCS
 
-CLEANFILES = $(HTMLPAGES) $(PDFPAGES) $(man_DISTMANS)
+CD2NROFF = $(top_srcdir)/scripts/cd2nroff $< >$@
+CD2 = $(CD2_$(V))
+CD2_0 = @echo "  RENDER " $@;
+CD2_1 =
+CD2_ = $(CD2_0)
 
-EXTRA_DIST = $(man_MANS) CMakeLists.txt
-MAN2HTML= roffit --mandir=. $< >$@
+SUFFIXES = .3 .md
 
-SUFFIXES = .3 .html
-
-html: $(HTMLPAGES)
-
-.3.html:
-	$(MAN2HTML)
-
-pdf: $(PDFPAGES)
-
-.3.pdf:
-	@(foo=`echo $@ | sed -e 's/\.[0-9]$$//g'`; \
-	groff -Tps -man $< >$$foo.ps; \
-	ps2pdf $$foo.ps $@; \
-	rm $$foo.ps; \
-	echo "converted $< to $@")
-
-mancheck:
-	@(cd $(top_srcdir)/docs/libcurl/opts && ls `awk -F, '!/OBSOLETE/ && /^  CINIT/ { a=substr($$1, 9); print "CURLOPT_" a ".3"}' $(top_srcdir)/include/curl/curl.h`)
-	rm -f in_temp
-	@(for a in $(man_MANS); do echo $$a >>in_temp; done)
-	sort in_temp > in_makefile
-	ls CURL*.3 > in_directory
-	-diff -u in_makefile in_directory
-	rm in_temp in_directory in_makefile
+.md.3:
+	$(CD2)$(CD2NROFF)
+endif
diff --git a/third-party/curl/docs/libcurl/opts/Makefile.inc b/third-party/curl/docs/libcurl/opts/Makefile.inc
index eab3c7ef41..1eb628b800 100644
--- a/third-party/curl/docs/libcurl/opts/Makefile.inc
+++ b/third-party/curl/docs/libcurl/opts/Makefile.inc
@@ -21,7 +21,7 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Shared between Makefile.am and CMakeLists.txt
+# Shared between CMakeLists.txt and Makefile.am
 
 man_MANS =                                      \
   CURLINFO_ACTIVESOCKET.3                       \
@@ -32,6 +32,7 @@ man_MANS =                                      \
   CURLINFO_CERTINFO.3                           \
   CURLINFO_CONDITION_UNMET.3                    \
   CURLINFO_CONNECT_TIME.3                       \
+  CURLINFO_CONN_ID.3                            \
   CURLINFO_CONNECT_TIME_T.3                     \
   CURLINFO_CONTENT_LENGTH_DOWNLOAD.3            \
   CURLINFO_CONTENT_LENGTH_DOWNLOAD_T.3          \
@@ -39,6 +40,7 @@ man_MANS =                                      \
   CURLINFO_CONTENT_LENGTH_UPLOAD_T.3            \
   CURLINFO_CONTENT_TYPE.3                       \
   CURLINFO_COOKIELIST.3                         \
+  CURLINFO_EARLYDATA_SENT_T.3                   \
   CURLINFO_EFFECTIVE_METHOD.3                   \
   CURLINFO_EFFECTIVE_URL.3                      \
   CURLINFO_FILETIME.3                           \
@@ -48,6 +50,7 @@ man_MANS =                                      \
   CURLINFO_HTTP_CONNECTCODE.3                   \
   CURLINFO_HTTP_VERSION.3                       \
   CURLINFO_HTTPAUTH_AVAIL.3                     \
+  CURLINFO_HTTPAUTH_USED.3                      \
   CURLINFO_LASTSOCKET.3                         \
   CURLINFO_LOCAL_IP.3                           \
   CURLINFO_LOCAL_PORT.3                         \
@@ -57,6 +60,7 @@ man_MANS =                                      \
   CURLINFO_OS_ERRNO.3                           \
   CURLINFO_PRETRANSFER_TIME.3                   \
   CURLINFO_PRETRANSFER_TIME_T.3                 \
+  CURLINFO_POSTTRANSFER_TIME_T.3                \
   CURLINFO_PRIMARY_IP.3                         \
   CURLINFO_PRIMARY_PORT.3                       \
   CURLINFO_PRIVATE.3                            \
@@ -64,6 +68,8 @@ man_MANS =                                      \
   CURLINFO_PROXY_ERROR.3                        \
   CURLINFO_PROXY_SSL_VERIFYRESULT.3             \
   CURLINFO_PROXYAUTH_AVAIL.3                    \
+  CURLINFO_PROXYAUTH_USED.3                     \
+  CURLINFO_QUEUE_TIME_T.3                       \
   CURLINFO_REDIRECT_COUNT.3                     \
   CURLINFO_REDIRECT_TIME.3                      \
   CURLINFO_REDIRECT_TIME_T.3                    \
@@ -77,6 +83,7 @@ man_MANS =                                      \
   CURLINFO_RTSP_SERVER_CSEQ.3                   \
   CURLINFO_RTSP_SESSION_ID.3                    \
   CURLINFO_SCHEME.3                             \
+  CURLINFO_SIZE_DELIVERED.3                     \
   CURLINFO_SIZE_DOWNLOAD.3                      \
   CURLINFO_SIZE_DOWNLOAD_T.3                    \
   CURLINFO_SIZE_UPLOAD.3                        \
@@ -93,6 +100,13 @@ man_MANS =                                      \
   CURLINFO_TLS_SSL_PTR.3                        \
   CURLINFO_TOTAL_TIME.3                         \
   CURLINFO_TOTAL_TIME_T.3                       \
+  CURLINFO_USED_PROXY.3                         \
+  CURLINFO_XFER_ID.3                            \
+  CURLMINFO_XFERS_ADDED.3                       \
+  CURLMINFO_XFERS_CURRENT.3                     \
+  CURLMINFO_XFERS_DONE.3                        \
+  CURLMINFO_XFERS_PENDING.3                     \
+  CURLMINFO_XFERS_RUNNING.3                     \
   CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE.3          \
   CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE.3        \
   CURLMOPT_MAX_CONCURRENT_STREAMS.3             \
@@ -100,11 +114,16 @@ man_MANS =                                      \
   CURLMOPT_MAX_PIPELINE_LENGTH.3                \
   CURLMOPT_MAX_TOTAL_CONNECTIONS.3              \
   CURLMOPT_MAXCONNECTS.3                        \
+  CURLMOPT_NETWORK_CHANGED.3                    \
+  CURLMOPT_NOTIFYDATA.3                           \
+  CURLMOPT_NOTIFYFUNCTION.3                       \
   CURLMOPT_PIPELINING.3                         \
   CURLMOPT_PIPELINING_SERVER_BL.3               \
   CURLMOPT_PIPELINING_SITE_BL.3                 \
   CURLMOPT_PUSHDATA.3                           \
   CURLMOPT_PUSHFUNCTION.3                       \
+  CURLMOPT_QUICK_EXIT.3                         \
+  CURLMOPT_RESOLVE_THREADS_MAX.3                \
   CURLMOPT_SOCKETDATA.3                         \
   CURLMOPT_SOCKETFUNCTION.3                     \
   CURLMOPT_TIMERDATA.3                          \
@@ -162,6 +181,7 @@ man_MANS =                                      \
   CURLOPT_DOH_SSL_VERIFYPEER.3                  \
   CURLOPT_DOH_SSL_VERIFYSTATUS.3                \
   CURLOPT_DOH_URL.3                             \
+  CURLOPT_ECH.3                                 \
   CURLOPT_EGDSOCKET.3                           \
   CURLOPT_ERRORBUFFER.3                         \
   CURLOPT_EXPECT_100_TIMEOUT_MS.3               \
@@ -304,6 +324,7 @@ man_MANS =                                      \
   CURLOPT_PROXYUSERNAME.3                       \
   CURLOPT_PROXYUSERPWD.3                        \
   CURLOPT_PUT.3                                 \
+  CURLOPT_QUICK_EXIT.3                          \
   CURLOPT_QUOTE.3                               \
   CURLOPT_RANDOM_FILE.3                         \
   CURLOPT_RANGE.3                               \
@@ -329,6 +350,7 @@ man_MANS =                                      \
   CURLOPT_SEEKDATA.3                            \
   CURLOPT_SEEKFUNCTION.3                        \
   CURLOPT_SERVER_RESPONSE_TIMEOUT.3             \
+  CURLOPT_SERVER_RESPONSE_TIMEOUT_MS.3          \
   CURLOPT_SERVICE_NAME.3                        \
   CURLOPT_SHARE.3                               \
   CURLOPT_SOCKOPTDATA.3                         \
@@ -338,6 +360,8 @@ man_MANS =                                      \
   CURLOPT_SOCKS5_GSSAPI_SERVICE.3               \
   CURLOPT_SSH_AUTH_TYPES.3                      \
   CURLOPT_SSH_COMPRESSION.3                     \
+  CURLOPT_SSH_HOSTKEYDATA.3                     \
+  CURLOPT_SSH_HOSTKEYFUNCTION.3                 \
   CURLOPT_SSH_HOST_PUBLIC_KEY_MD5.3             \
   CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256.3          \
   CURLOPT_SSH_KEYDATA.3                         \
@@ -354,6 +378,7 @@ man_MANS =                                      \
   CURLOPT_SSL_FALSESTART.3                      \
   CURLOPT_SSL_OPTIONS.3                         \
   CURLOPT_SSL_SESSIONID_CACHE.3                 \
+  CURLOPT_SSL_SIGNATURE_ALGORITHMS.3            \
   CURLOPT_SSL_VERIFYHOST.3                      \
   CURLOPT_SSL_VERIFYPEER.3                      \
   CURLOPT_SSL_VERIFYSTATUS.3                    \
@@ -375,6 +400,7 @@ man_MANS =                                      \
   CURLOPT_TCP_KEEPALIVE.3                       \
   CURLOPT_TCP_KEEPIDLE.3                        \
   CURLOPT_TCP_KEEPINTVL.3                       \
+  CURLOPT_TCP_KEEPCNT.3                         \
   CURLOPT_TCP_NODELAY.3                         \
   CURLOPT_TELNETOPTIONS.3                       \
   CURLOPT_TFTP_BLKSIZE.3                        \
@@ -397,6 +423,7 @@ man_MANS =                                      \
   CURLOPT_UPKEEP_INTERVAL_MS.3                  \
   CURLOPT_UPLOAD.3                              \
   CURLOPT_UPLOAD_BUFFERSIZE.3                   \
+  CURLOPT_UPLOAD_FLAGS.3                        \
   CURLOPT_URL.3                                 \
   CURLOPT_USE_SSL.3                             \
   CURLOPT_USERAGENT.3                           \
diff --git a/third-party/curl/docs/libcurl/opts/template.3 b/third-party/curl/docs/libcurl/opts/template.3
deleted file mode 100644
index 93f51c47fa..0000000000
--- a/third-party/curl/docs/libcurl/opts/template.3
+++ /dev/null
@@ -1,40 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH CURLOPT_TEMPLATE 3 "17 Jun 2014" libcurl libcurl
-.SH NAME
-CURLOPT_TEMPLATE \- [short description]
-.SH SYNOPSIS
-#include <curl/curl.h>
-
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TEMPLATE, [argument]);
-.SH DESCRIPTION
-.SH DEFAULT
-.SH PROTOCOLS
-.SH EXAMPLE
-.SH AVAILABILITY
-.SH RETURN VALUE
-Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
-.SH "SEE ALSO"
-.BR CURLOPT_STDERR "(3), " CURLOPT_DEBUGFUNCTION "(3), "
diff --git a/third-party/curl/docs/libcurl/symbols-in-versions b/third-party/curl/docs/libcurl/symbols-in-versions
index 7adf5c4ae4..5bad9a9842 100644
--- a/third-party/curl/docs/libcurl/symbols-in-versions
+++ b/third-party/curl/docs/libcurl/symbols-in-versions
@@ -45,6 +45,7 @@ CURL_GLOBAL_DEFAULT             7.8
 CURL_GLOBAL_NOTHING             7.8
 CURL_GLOBAL_SSL                 7.8
 CURL_GLOBAL_WIN32               7.8.1
+CURL_HAS_DECLSPEC_ATTRIBUTE     8.13.0
 CURL_HET_DEFAULT                7.59.0
 CURL_HTTP_VERSION_1_0           7.9.1
 CURL_HTTP_VERSION_1_1           7.9.1
@@ -67,7 +68,7 @@ CURL_IGNORE_DEPRECATION         7.87.0
 CURL_IPRESOLVE_V4               7.10.8
 CURL_IPRESOLVE_V6               7.10.8
 CURL_IPRESOLVE_WHATEVER         7.10.8
-CURL_ISOCPP                     7.10.2
+CURL_ISOCPP                     7.10.2        -           8.14.1
 CURL_LOCK_ACCESS_NONE           7.10.3
 CURL_LOCK_ACCESS_SHARED         7.10.3
 CURL_LOCK_ACCESS_SINGLE         7.10.3
@@ -109,7 +110,7 @@ CURL_READFUNC_PAUSE             7.18.0
 CURL_REDIR_GET_ALL              7.19.1
 CURL_REDIR_POST_301             7.19.1
 CURL_REDIR_POST_302             7.19.1
-CURL_REDIR_POST_303             7.25.1
+CURL_REDIR_POST_303             7.26.0
 CURL_REDIR_POST_ALL             7.19.1
 CURL_RTSPREQ_ANNOUNCE           7.20.0
 CURL_RTSPREQ_DESCRIBE           7.20.0
@@ -160,7 +161,7 @@ CURL_VERSION_ASYNCHDNS          7.10.7
 CURL_VERSION_BITS               7.43.0
 CURL_VERSION_BROTLI             7.57.0
 CURL_VERSION_CONV               7.15.4
-CURL_VERSION_CURLDEBUG          7.19.6
+CURL_VERSION_CURLDEBUG          7.19.6        8.19.0
 CURL_VERSION_DEBUG              7.10.6
 CURL_VERSION_GSASL              7.76.0
 CURL_VERSION_GSSAPI             7.38.0
@@ -177,7 +178,7 @@ CURL_VERSION_LARGEFILE          7.11.1
 CURL_VERSION_LIBZ               7.10
 CURL_VERSION_MULTI_SSL          7.56.0
 CURL_VERSION_NTLM               7.10.6
-CURL_VERSION_NTLM_WB            7.22.0
+CURL_VERSION_NTLM_WB            7.22.0                    8.8.0
 CURL_VERSION_PSL                7.47.0
 CURL_VERSION_SPNEGO             7.10.8
 CURL_VERSION_SSL                7.10
@@ -190,7 +191,7 @@ CURL_VERSION_ZSTD               7.72.0
 CURL_WAIT_POLLIN                7.28.0
 CURL_WAIT_POLLOUT               7.28.0
 CURL_WAIT_POLLPRI               7.28.0
-CURL_WIN32                      7.69.0
+CURL_WIN32                      7.69.0        -           8.5.0
 CURL_WRITEFUNC_ERROR            7.87.0
 CURL_WRITEFUNC_PAUSE            7.18.0
 CURL_ZERO_TERMINATED            7.56.0
@@ -204,20 +205,20 @@ CURLAUTH_AWS_SIGV4              7.75.0
 CURLAUTH_BASIC                  7.10.6
 CURLAUTH_BEARER                 7.61.0
 CURLAUTH_DIGEST                 7.10.6
-CURLAUTH_DIGEST_IE              7.19.3
+CURLAUTH_DIGEST_IE              7.19.3        8.21.0
 CURLAUTH_GSSAPI                 7.55.0
-CURLAUTH_GSSNEGOTIATE           7.10.6       7.38.0
+CURLAUTH_GSSNEGOTIATE           7.10.6        7.38.0
 CURLAUTH_NEGOTIATE              7.38.0
 CURLAUTH_NONE                   7.10.6
 CURLAUTH_NTLM                   7.10.6
-CURLAUTH_NTLM_WB                7.22.0
+CURLAUTH_NTLM_WB                7.22.0                    8.8.0
 CURLAUTH_ONLY                   7.21.3
-CURLCLOSEPOLICY_CALLBACK        7.7
-CURLCLOSEPOLICY_LEAST_RECENTLY_USED 7.7
-CURLCLOSEPOLICY_LEAST_TRAFFIC   7.7
-CURLCLOSEPOLICY_NONE            7.7
-CURLCLOSEPOLICY_OLDEST          7.7
-CURLCLOSEPOLICY_SLOWEST         7.7
+CURLCLOSEPOLICY_CALLBACK        7.7           7.16.1
+CURLCLOSEPOLICY_LEAST_RECENTLY_USED 7.7       7.16.1
+CURLCLOSEPOLICY_LEAST_TRAFFIC   7.7           7.16.1
+CURLCLOSEPOLICY_NONE            7.7           7.16.1
+CURLCLOSEPOLICY_OLDEST          7.7           7.16.1
+CURLCLOSEPOLICY_SLOWEST         7.7           7.16.1
 CURLE_ABORTED_BY_CALLBACK       7.1
 CURLE_AGAIN                     7.18.2
 CURLE_ALREADY_COMPLETE          7.7.2         7.8
@@ -233,6 +234,7 @@ CURLE_CONV_REQD                 7.15.4        7.82.0
 CURLE_COULDNT_CONNECT           7.1
 CURLE_COULDNT_RESOLVE_HOST      7.1
 CURLE_COULDNT_RESOLVE_PROXY     7.1
+CURLE_ECH_REQUIRED              8.8.0
 CURLE_FAILED_INIT               7.1
 CURLE_FILE_COULDNT_READ_FILE    7.1
 CURLE_FILESIZE_EXCEEDED         7.10.8
@@ -262,14 +264,14 @@ CURLE_FTP_WEIRD_PASV_REPLY      7.1
 CURLE_FTP_WEIRD_SERVER_REPLY    7.1           7.51.0
 CURLE_FTP_WEIRD_USER_REPLY      7.1           7.17.0
 CURLE_FTP_WRITE_ERROR           7.1           7.17.0
-CURLE_FUNCTION_NOT_FOUND        7.1
+CURLE_FUNCTION_NOT_FOUND        7.1           7.53.0
 CURLE_GOT_NOTHING               7.9.1
 CURLE_HTTP2                     7.38.0
 CURLE_HTTP2_STREAM              7.49.0
 CURLE_HTTP3                     7.68.0
 CURLE_HTTP_NOT_FOUND            7.1           7.10.3
 CURLE_HTTP_PORT_FAILED          7.3           7.12.0
-CURLE_HTTP_POST_ERROR           7.1
+CURLE_HTTP_POST_ERROR           7.1           7.56.0
 CURLE_HTTP_RANGE_ERROR          7.1           7.17.0
 CURLE_HTTP_RETURNED_ERROR       7.10.3
 CURLE_INTERFACE_FAILED          7.12.0
@@ -320,7 +322,7 @@ CURLE_SSL_ISSUER_ERROR          7.19.0
 CURLE_SSL_PEER_CERTIFICATE      7.8           7.17.1
 CURLE_SSL_PINNEDPUBKEYNOTMATCH  7.39.0
 CURLE_SSL_SHUTDOWN_FAILED       7.16.1
-CURLE_TELNET_OPTION_SYNTAX      7.7
+CURLE_TELNET_OPTION_SYNTAX      7.7           7.78.0
 CURLE_TFTP_DISKFULL             7.15.0        7.17.0
 CURLE_TFTP_EXISTS               7.15.0        7.17.0
 CURLE_TFTP_ILLEGAL              7.15.0
@@ -328,6 +330,7 @@ CURLE_TFTP_NOSUCHUSER           7.15.0
 CURLE_TFTP_NOTFOUND             7.15.0
 CURLE_TFTP_PERM                 7.15.0
 CURLE_TFTP_UNKNOWNID            7.15.0
+CURLE_TOO_LARGE                 8.6.0
 CURLE_TOO_MANY_REDIRECTS        7.5
 CURLE_UNKNOWN_OPTION            7.21.5
 CURLE_UNKNOWN_TELNET_OPTION     7.7           7.21.5
@@ -356,6 +359,9 @@ CURLFINFOFLAG_KNOWN_PERM        7.21.0
 CURLFINFOFLAG_KNOWN_SIZE        7.21.0
 CURLFINFOFLAG_KNOWN_TIME        7.21.0
 CURLFINFOFLAG_KNOWN_UID         7.21.0
+CURLFOLLOW_ALL                  8.13.0
+CURLFOLLOW_FIRSTONLY            8.13.0
+CURLFOLLOW_OBEYCODE             8.13.0
 CURLFORM_ARRAY                  7.9.1         7.56.0
 CURLFORM_ARRAY_END              7.9.1         7.9.5       7.9.6
 CURLFORM_ARRAY_START            7.9.1         7.9.5       7.9.6
@@ -433,6 +439,7 @@ CURLINFO_COOKIELIST             7.14.1
 CURLINFO_DATA_IN                7.9.6
 CURLINFO_DATA_OUT               7.9.6
 CURLINFO_DOUBLE                 7.4.1
+CURLINFO_EARLYDATA_SENT_T       8.11.0
 CURLINFO_EFFECTIVE_METHOD       7.72.0
 CURLINFO_EFFECTIVE_URL          7.4
 CURLINFO_END                    7.9.6
@@ -446,6 +453,7 @@ CURLINFO_HTTP_CODE              7.4.1         7.10.8
 CURLINFO_HTTP_CONNECTCODE       7.10.7
 CURLINFO_HTTP_VERSION           7.50.0
 CURLINFO_HTTPAUTH_AVAIL         7.10.8
+CURLINFO_HTTPAUTH_USED          8.12.0
 CURLINFO_LASTONE                7.4.1
 CURLINFO_LASTSOCKET             7.15.2        7.45.0
 CURLINFO_LOCAL_IP               7.21.0
@@ -458,6 +466,7 @@ CURLINFO_NONE                   7.4.1
 CURLINFO_NUM_CONNECTS           7.12.3
 CURLINFO_OFF_T                  7.55.0
 CURLINFO_OS_ERRNO               7.12.2
+CURLINFO_POSTTRANSFER_TIME_T    8.10.0
 CURLINFO_PRETRANSFER_TIME       7.4.1
 CURLINFO_PRETRANSFER_TIME_T     7.61.0
 CURLINFO_PRIMARY_IP             7.19.0
@@ -467,7 +476,9 @@ CURLINFO_PROTOCOL               7.52.0        7.85.0
 CURLINFO_PROXY_ERROR            7.73.0
 CURLINFO_PROXY_SSL_VERIFYRESULT 7.52.0
 CURLINFO_PROXYAUTH_AVAIL        7.10.8
+CURLINFO_PROXYAUTH_USED         8.12.0
 CURLINFO_PTR                    7.54.1
+CURLINFO_QUEUE_TIME_T           8.6.0
 CURLINFO_REDIRECT_COUNT         7.9.7
 CURLINFO_REDIRECT_TIME          7.9.7
 CURLINFO_REDIRECT_TIME_T        7.61.0
@@ -481,6 +492,7 @@ CURLINFO_RTSP_CSEQ_RECV         7.20.0
 CURLINFO_RTSP_SERVER_CSEQ       7.20.0
 CURLINFO_RTSP_SESSION_ID        7.20.0
 CURLINFO_SCHEME                 7.52.0
+CURLINFO_SIZE_DELIVERED         8.20.0
 CURLINFO_SIZE_DOWNLOAD          7.4.1         7.55.0
 CURLINFO_SIZE_DOWNLOAD_T        7.55.0
 CURLINFO_SIZE_UPLOAD            7.4.1         7.55.0
@@ -504,6 +516,7 @@ CURLINFO_TLS_SSL_PTR            7.48.0
 CURLINFO_TOTAL_TIME             7.4.1
 CURLINFO_TOTAL_TIME_T           7.61.0
 CURLINFO_TYPEMASK               7.4.1
+CURLINFO_USED_PROXY             8.7.0
 CURLINFO_XFER_ID                8.2.0
 CURLIOCMD_NOP                   7.12.3
 CURLIOCMD_RESTARTREAD           7.12.3
@@ -525,7 +538,7 @@ CURLKHTYPE_RSA                  7.19.6
 CURLKHTYPE_RSA1                 7.19.6
 CURLKHTYPE_UNKNOWN              7.19.6
 CURLM_ABORTED_BY_CALLBACK       7.81.0
-CURLM_ADDED_ALREADY             7.32.1
+CURLM_ADDED_ALREADY             7.33.0
 CURLM_BAD_EASY_HANDLE           7.9.6
 CURLM_BAD_FUNCTION_ARGUMENT     7.69.0
 CURLM_BAD_HANDLE                7.9.6
@@ -540,6 +553,17 @@ CURLM_UNKNOWN_OPTION            7.15.4
 CURLM_UNRECOVERABLE_POLL        7.84.0
 CURLM_WAKEUP_FAILURE            7.68.0
 CURLMIMEOPT_FORMESCAPE          7.81.0
+CURLMINFO_NONE                  8.16.0
+CURLMINFO_XFERS_ADDED           8.16.0
+CURLMINFO_XFERS_CURRENT         8.16.0
+CURLMINFO_XFERS_DONE            8.16.0
+CURLMINFO_XFERS_PENDING         8.16.0
+CURLMINFO_XFERS_RUNNING         8.16.0
+CURLMNOTIFY_EASY_DONE           8.17.0
+CURLMNOTIFY_INFO_READ           8.17.0
+CURLMNWC_CLEAR_ALL              8.20.0
+CURLMNWC_CLEAR_CONNS            8.16.0
+CURLMNWC_CLEAR_DNS              8.16.0
 CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE 7.30.0
 CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE 7.30.0
 CURLMOPT_MAX_CONCURRENT_STREAMS  7.67.0
@@ -547,11 +571,16 @@ CURLMOPT_MAX_HOST_CONNECTIONS   7.30.0
 CURLMOPT_MAX_PIPELINE_LENGTH    7.30.0
 CURLMOPT_MAX_TOTAL_CONNECTIONS  7.30.0
 CURLMOPT_MAXCONNECTS            7.16.3
+CURLMOPT_NETWORK_CHANGED        8.16.0
+CURLMOPT_NOTIFYDATA             8.17.0
+CURLMOPT_NOTIFYFUNCTION         8.17.0
 CURLMOPT_PIPELINING             7.16.0
 CURLMOPT_PIPELINING_SERVER_BL   7.30.0
 CURLMOPT_PIPELINING_SITE_BL     7.30.0
 CURLMOPT_PUSHDATA               7.44.0
 CURLMOPT_PUSHFUNCTION           7.44.0
+CURLMOPT_QUICK_EXIT             8.20.0
+CURLMOPT_RESOLVE_THREADS_MAX    8.20.0
 CURLMOPT_SOCKETDATA             7.15.4
 CURLMOPT_SOCKETFUNCTION         7.15.4
 CURLMOPT_TIMERDATA              7.16.0
@@ -569,10 +598,10 @@ CURLOPT_APPEND                  7.17.0
 CURLOPT_AUTOREFERER             7.1
 CURLOPT_AWS_SIGV4               7.75.0
 CURLOPT_BUFFERSIZE              7.10
+CURLOPT_CA_CACHE_TIMEOUT        7.87.0
 CURLOPT_CAINFO                  7.4.2
 CURLOPT_CAINFO_BLOB             7.77.0
 CURLOPT_CAPATH                  7.9.8
-CURLOPT_CA_CACHE_TIMEOUT        7.87.0
 CURLOPT_CERTINFO                7.19.1
 CURLOPT_CHUNK_BGN_FUNCTION      7.21.0
 CURLOPT_CHUNK_DATA              7.21.0
@@ -614,6 +643,7 @@ CURLOPT_DOH_SSL_VERIFYHOST      7.76.0
 CURLOPT_DOH_SSL_VERIFYPEER      7.76.0
 CURLOPT_DOH_SSL_VERIFYSTATUS    7.76.0
 CURLOPT_DOH_URL                 7.62.0
+CURLOPT_ECH                     8.8.0
 CURLOPT_EGDSOCKET               7.7           7.84.0
 CURLOPT_ENCODING                7.10          7.21.6
 CURLOPT_ERRORBUFFER             7.1
@@ -644,8 +674,8 @@ CURLOPT_FTPPORT                 7.1
 CURLOPT_FTPSSLAUTH              7.12.2
 CURLOPT_GSSAPI_DELEGATION       7.22.0
 CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS 7.59.0
-CURLOPT_HAPROXYPROTOCOL         7.60.0
 CURLOPT_HAPROXY_CLIENT_IP       8.2.0
+CURLOPT_HAPROXYPROTOCOL         7.60.0
 CURLOPT_HEADER                  7.1
 CURLOPT_HEADERDATA              7.10
 CURLOPT_HEADERFUNCTION          7.7.2
@@ -682,7 +712,7 @@ CURLOPT_ISSUERCERT_BLOB         7.71.0
 CURLOPT_KEEP_SENDING_ON_ERROR   7.51.0
 CURLOPT_KEYPASSWD               7.17.0
 CURLOPT_KRB4LEVEL               7.3           7.17.0
-CURLOPT_KRBLEVEL                7.16.4
+CURLOPT_KRBLEVEL                7.16.4        8.17.0
 CURLOPT_LOCALPORT               7.15.2
 CURLOPT_LOCALPORTRANGE          7.15.2
 CURLOPT_LOGIN_OPTIONS           7.34.0
@@ -693,7 +723,6 @@ CURLOPT_MAIL_FROM               7.20.0
 CURLOPT_MAIL_RCPT               7.20.0
 CURLOPT_MAIL_RCPT_ALLLOWFAILS   7.69.0        8.2.0
 CURLOPT_MAIL_RCPT_ALLOWFAILS    8.2.0
-CURLOPT_QUICK_EXIT              7.87.0
 CURLOPT_MAX_RECV_SPEED_LARGE    7.15.5
 CURLOPT_MAX_SEND_SPEED_LARGE    7.15.5
 CURLOPT_MAXAGE_CONN             7.65.0
@@ -774,6 +803,7 @@ CURLOPT_PROXYTYPE               7.10
 CURLOPT_PROXYUSERNAME           7.19.1
 CURLOPT_PROXYUSERPWD            7.1
 CURLOPT_PUT                     7.1           7.12.1
+CURLOPT_QUICK_EXIT              7.87.0
 CURLOPT_QUOTE                   7.1
 CURLOPT_RANDOM_FILE             7.7           7.84.0
 CURLOPT_RANGE                   7.1
@@ -800,6 +830,7 @@ CURLOPT_SASL_IR                 7.31.0
 CURLOPT_SEEKDATA                7.18.0
 CURLOPT_SEEKFUNCTION            7.18.0
 CURLOPT_SERVER_RESPONSE_TIMEOUT 7.20.0
+CURLOPT_SERVER_RESPONSE_TIMEOUT_MS 8.6.0
 CURLOPT_SERVICE_NAME            7.43.0
 CURLOPT_SHARE                   7.10
 CURLOPT_SOCKOPTDATA             7.16.0
@@ -819,8 +850,8 @@ CURLOPT_SSH_AUTH_TYPES          7.16.1
 CURLOPT_SSH_COMPRESSION         7.56.0
 CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 7.17.1
 CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 7.80.0
-CURLOPT_SSH_HOSTKEYDATA                 7.84.0
-CURLOPT_SSH_HOSTKEYFUNCTION             7.84.0
+CURLOPT_SSH_HOSTKEYDATA         7.84.0
+CURLOPT_SSH_HOSTKEYFUNCTION     7.84.0
 CURLOPT_SSH_KEYDATA             7.19.6
 CURLOPT_SSH_KEYFUNCTION         7.19.6
 CURLOPT_SSH_KNOWNHOSTS          7.19.6
@@ -832,9 +863,10 @@ CURLOPT_SSL_CTX_FUNCTION        7.10.6
 CURLOPT_SSL_EC_CURVES           7.73.0
 CURLOPT_SSL_ENABLE_ALPN         7.36.0
 CURLOPT_SSL_ENABLE_NPN          7.36.0        7.86.0
-CURLOPT_SSL_FALSESTART          7.42.0
+CURLOPT_SSL_FALSESTART          7.42.0        8.15.0
 CURLOPT_SSL_OPTIONS             7.25.0
 CURLOPT_SSL_SESSIONID_CACHE     7.16.0
+CURLOPT_SSL_SIGNATURE_ALGORITHMS 8.14.0
 CURLOPT_SSL_VERIFYHOST          7.8.1
 CURLOPT_SSL_VERIFYPEER          7.4.2
 CURLOPT_SSL_VERIFYSTATUS        7.41.0
@@ -850,12 +882,13 @@ CURLOPT_SSLKEYPASSWD            7.9.3         7.17.0
 CURLOPT_SSLKEYTYPE              7.9.3
 CURLOPT_SSLVERSION              7.1
 CURLOPT_STDERR                  7.1
-CURLOPT_STREAM_DEPENDS          7.46.0
-CURLOPT_STREAM_DEPENDS_E        7.46.0
+CURLOPT_STREAM_DEPENDS          7.46.0        8.21.0
+CURLOPT_STREAM_DEPENDS_E        7.46.0        8.21.0
 CURLOPT_STREAM_WEIGHT           7.46.0
 CURLOPT_SUPPRESS_CONNECT_HEADERS 7.54.0
 CURLOPT_TCP_FASTOPEN            7.49.0
 CURLOPT_TCP_KEEPALIVE           7.25.0
+CURLOPT_TCP_KEEPCNT             8.9.0
 CURLOPT_TCP_KEEPIDLE            7.25.0
 CURLOPT_TCP_KEEPINTVL           7.25.0
 CURLOPT_TCP_NODELAY             7.11.2
@@ -877,9 +910,10 @@ CURLOPT_TRANSFER_ENCODING       7.21.6
 CURLOPT_TRANSFERTEXT            7.1.1
 CURLOPT_UNIX_SOCKET_PATH        7.40.0
 CURLOPT_UNRESTRICTED_AUTH       7.10.4
-CURLOPT_UPKEEP_INTERVAL_MS 7.62.0
+CURLOPT_UPKEEP_INTERVAL_MS      7.62.0
 CURLOPT_UPLOAD                  7.1
 CURLOPT_UPLOAD_BUFFERSIZE       7.62.0
+CURLOPT_UPLOAD_FLAGS            8.13.0
 CURLOPT_URL                     7.1
 CURLOPT_USE_SSL                 7.17.0
 CURLOPT_USERAGENT               7.1
@@ -940,12 +974,12 @@ CURLPROTO_LDAPS                 7.19.4
 CURLPROTO_MQTT                  7.71.0
 CURLPROTO_POP3                  7.20.0
 CURLPROTO_POP3S                 7.20.0
-CURLPROTO_RTMP                  7.21.0
-CURLPROTO_RTMPE                 7.21.0
-CURLPROTO_RTMPS                 7.21.0
-CURLPROTO_RTMPT                 7.21.0
-CURLPROTO_RTMPTE                7.21.0
-CURLPROTO_RTMPTS                7.21.0
+CURLPROTO_RTMP                  7.21.0        8.20.0
+CURLPROTO_RTMPE                 7.21.0        8.20.0
+CURLPROTO_RTMPS                 7.21.0        8.20.0
+CURLPROTO_RTMPT                 7.21.0        8.20.0
+CURLPROTO_RTMPTE                7.21.0        8.20.0
+CURLPROTO_RTMPTS                7.21.0        8.20.0
 CURLPROTO_RTSP                  7.20.0
 CURLPROTO_SCP                   7.19.4
 CURLPROTO_SFTP                  7.19.4
@@ -959,6 +993,7 @@ CURLPROXY_HTTP                  7.10
 CURLPROXY_HTTP_1_0              7.19.4
 CURLPROXY_HTTPS                 7.52.0
 CURLPROXY_HTTPS2                8.1.0
+CURLPROXY_HTTPS3                8.21.0
 CURLPROXY_SOCKS4                7.10
 CURLPROXY_SOCKS4A               7.18.0
 CURLPROXY_SOCKS5                7.10
@@ -1021,27 +1056,28 @@ CURLSSH_AUTH_NONE               7.16.1
 CURLSSH_AUTH_PASSWORD           7.16.1
 CURLSSH_AUTH_PUBLICKEY          7.16.1
 CURLSSLBACKEND_AWSLC            8.1.0
-CURLSSLBACKEND_AXTLS            7.38.0       7.61.0
-CURLSSLBACKEND_BEARSSL          7.68.0
+CURLSSLBACKEND_AXTLS            7.38.0        7.61.0
+CURLSSLBACKEND_BEARSSL          7.68.0        8.15.0
 CURLSSLBACKEND_BORINGSSL        7.49.0
 CURLSSLBACKEND_CYASSL           7.34.0
-CURLSSLBACKEND_DARWINSSL        7.34.0       7.64.1
+CURLSSLBACKEND_DARWINSSL        7.34.0        7.64.1
 CURLSSLBACKEND_GNUTLS           7.34.0
-CURLSSLBACKEND_GSKIT            7.34.0
+CURLSSLBACKEND_GSKIT            7.34.0        8.3.0
 CURLSSLBACKEND_LIBRESSL         7.49.0
 CURLSSLBACKEND_MBEDTLS          7.46.0
-CURLSSLBACKEND_MESALINK         7.62.0
+CURLSSLBACKEND_MESALINK         7.62.0        7.82.0
 CURLSSLBACKEND_NONE             7.34.0
-CURLSSLBACKEND_NSS              7.34.0
+CURLSSLBACKEND_NSS              7.34.0        8.3.0
 CURLSSLBACKEND_OPENSSL          7.34.0
-CURLSSLBACKEND_POLARSSL         7.34.0       7.69.0
+CURLSSLBACKEND_POLARSSL         7.34.0        7.69.0
 CURLSSLBACKEND_QSOSSL           7.34.0        -           7.38.0
 CURLSSLBACKEND_RUSTLS           7.76.0
 CURLSSLBACKEND_SCHANNEL         7.34.0
-CURLSSLBACKEND_SECURETRANSPORT  7.64.1
+CURLSSLBACKEND_SECURETRANSPORT  7.64.1        8.15.0
 CURLSSLBACKEND_WOLFSSL          7.49.0
 CURLSSLOPT_ALLOW_BEAST          7.25.0
 CURLSSLOPT_AUTO_CLIENT_CERT     7.77.0
+CURLSSLOPT_EARLYDATA            8.11.0
 CURLSSLOPT_NATIVE_CA            7.71.0
 CURLSSLOPT_NO_PARTIALCHAIN      7.68.0
 CURLSSLOPT_NO_REVOKE            7.44.0
@@ -1058,9 +1094,11 @@ CURLU_APPENDQUERY               7.62.0
 CURLU_DEFAULT_PORT              7.62.0
 CURLU_DEFAULT_SCHEME            7.62.0
 CURLU_DISALLOW_USER             7.62.0
+CURLU_GET_EMPTY                 8.8.0
 CURLU_GUESS_SCHEME              7.62.0
 CURLU_NO_AUTHORITY              7.67.0
 CURLU_NO_DEFAULT_PORT           7.62.0
+CURLU_NO_GUESS_SCHEME           8.9.0
 CURLU_NON_SUPPORT_SCHEME        7.62.0
 CURLU_PATH_AS_IS                7.62.0
 CURLU_PUNY2IDN                  8.3.0
@@ -1094,10 +1132,16 @@ CURLUE_NO_USER                  7.62.0
 CURLUE_NO_ZONEID                7.81.0
 CURLUE_OK                       7.62.0
 CURLUE_OUT_OF_MEMORY            7.62.0
+CURLUE_TOO_LARGE                8.6.0
 CURLUE_UNKNOWN_PART             7.62.0
 CURLUE_UNSUPPORTED_SCHEME       7.62.0
 CURLUE_URLDECODE                7.62.0
 CURLUE_USER_NOT_ALLOWED         7.62.0
+CURLULFLAG_ANSWERED             8.13.0
+CURLULFLAG_DELETED              8.13.0
+CURLULFLAG_DRAFT                8.13.0
+CURLULFLAG_FLAGGED              8.13.0
+CURLULFLAG_SEEN                 8.13.0
 CURLUPART_FRAGMENT              7.62.0
 CURLUPART_HOST                  7.62.0
 CURLUPART_OPTIONS               7.62.0
@@ -1125,10 +1169,12 @@ CURLVERSION_SEVENTH             7.70.0
 CURLVERSION_SIXTH               7.66.0
 CURLVERSION_TENTH               7.77.0
 CURLVERSION_THIRD               7.12.0
+CURLVERSION_TWELFTH             8.8.0
 CURLWARNING                     7.66.0
 CURLWS_BINARY                   7.86.0
 CURLWS_CLOSE                    7.86.0
 CURLWS_CONT                     7.86.0
+CURLWS_NOAUTOPONG               8.14.0
 CURLWS_OFFSET                   7.86.0
 CURLWS_PING                     7.86.0
 CURLWS_PONG                     7.86.0
@@ -1136,8 +1182,8 @@ CURLWS_RAW_MODE                 7.86.0
 CURLWS_TEXT                     7.86.0
 LIBCURL_COPYRIGHT               7.18.0
 LIBCURL_TIMESTAMP               7.16.2
-LIBCURL_VERSION                 7.11.0
+LIBCURL_VERSION                 7.1.1
 LIBCURL_VERSION_MAJOR           7.11.0
 LIBCURL_VERSION_MINOR           7.11.0
-LIBCURL_VERSION_NUM             7.11.0
+LIBCURL_VERSION_NUM             7.1.1
 LIBCURL_VERSION_PATCH           7.11.0
diff --git a/third-party/curl/docs/libcurl/symbols.pl b/third-party/curl/docs/libcurl/symbols.pl
index 1105ae66b6..2717ac3a55 100644
--- a/third-party/curl/docs/libcurl/symbols.pl
+++ b/third-party/curl/docs/libcurl/symbols.pl
@@ -44,12 +44,15 @@
 # #endif
 #
 #
+use strict;
+use warnings;
+
 open F, "<symbols-in-versions";
 
 sub str2num {
-    my ($str)=@_;
-    if($str =~ /([0-9]*)\.([0-9]*)\.*([0-9]*)/) {
-        return sprintf("0x%06x", $1<<16 | $2 << 8 | $3);
+    my ($str) = @_;
+    if($str && $str =~ /([0-9]*)\.([0-9]*)\.*([0-9]*)/) {
+        return sprintf("0x%06x", $1 << 16 | $2 << 8 | ($3 || '0'));
     }
 }
 
@@ -66,7 +69,7 @@ EOS
 
 while(<F>) {
     if(/^(CURL[^ ]*)[ \t]*(.*)/) {
-        my ($sym, $vers)=($1, $2);
+        my ($sym, $vers) = ($1, $2);
 
         my $intr;
         my $rm;
@@ -74,11 +77,11 @@ while(<F>) {
 
         # is there removed info?
         if($vers =~ /([\d.]+)[ \t-]+([\d.-]+)[ \t]+([\d.]+)/) {
-            ($intr, $dep, $rm)=($1, $2, $3);
+            ($intr, $dep, $rm) = ($1, $2, $3);
         }
         # is it a dep-only line?
         elsif($vers =~ /([\d.]+)[ \t-]+([\d.]+)/) {
-            ($intr, $dep)=($1, $2);
+            ($intr, $dep) = ($1, $2);
         }
         else {
             $intr = $vers;
@@ -97,6 +100,5 @@ EOS
 EOS
 ;
         }
-
     }
 }
diff --git a/third-party/curl/docs/mk-ca-bundle.1 b/third-party/curl/docs/mk-ca-bundle.1
deleted file mode 100644
index e6db0504c0..0000000000
--- a/third-party/curl/docs/mk-ca-bundle.1
+++ /dev/null
@@ -1,120 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH mk-ca-bundle 1 "24 Oct 2016" mk-ca-bundle mk-ca-bundle
-.SH NAME
-mk-ca-bundle \- convert Mozilla's certificate bundle to PEM format
-.SH SYNOPSIS
-mk-ca-bundle [options]
-.I [outputfile]
-.SH DESCRIPTION
-The mk-ca-bundle tool downloads the \fIcertdata.txt\fP file from Mozilla's
-source tree over HTTPS, then parses \fIcertdata.txt\fP and extracts
-certificates into PEM format. By default, only CA root certificates trusted to
-issue SSL server authentication certificates are extracted. These are then
-processed with the OpenSSL command line tool to produce the final ca-bundle
-file.
-
-The default \fIoutputfile\fP name is \fBca-bundle.crt\fP. By setting it to '-'
-(a single dash) you will get the output sent to STDOUT instead of a file.
-
-The PEM format this scripts uses for output makes the result readily available
-for use by just about all OpenSSL or GnuTLS powered applications, such as curl
-and others.
-.SH OPTIONS
-The following options are supported:
-.IP -b
-backup an existing version of \fIoutputfilename\fP
-.IP "-d [name]"
-specify which Mozilla tree to pull \fIcertdata.txt\fP from (or a custom
-URL). Valid names are: aurora, beta, central, Mozilla, nss, release
-(default). They are shortcuts for which source tree to get the certificates
-data from.
-.IP -f
-force rebuild even if \fIcertdata.txt\fP is current (Added in version 1.17)
-.IP -i
-print version info about used modules
-.IP -k
-Allow insecure data transfer. By default (since 1.27) this command will fail
-if the HTTPS transfer fails. This overrides that decision (and opens for
-man-in-the-middle attacks).
-.IP -l
-print license info about \fIcertdata.txt\fP
-.IP -m
-(Added in 1.26) Include meta data comments in the output. The meta data is
-specific information about each certificate that is stored in the original
-file as comments and using this option will make those comments get passed on
-to the output file. The meta data is not parsed in any way by mk-ca-bundle.
-.IP -n
-no download of \fIcertdata.txt\fP (to use existing)
-.IP "-p [purposes]:[levels]"
-list of Mozilla trust purposes and levels for certificates to include in
-output.  Takes the form of a comma separated list of purposes, a colon, and a
-comma separated list of levels. The default is to include all certificates
-trusted to issue SSL Server certificates
-(\fISERVER_AUTH:TRUSTED_DELEGATOR\fP).
-
-(Added in version 1.21, Perl only)
-
-Valid purposes are:
-.RS
-\fIALL\fP, \fIDIGITAL_SIGNATURE\fP, \fINON_REPUDIATION\fP,
-\fIKEY_ENCIPHERMENT\fP, \fIDATA_ENCIPHERMENT\fP, \fIKEY_AGREEMENT\fP,
-\fIKEY_CERT_SIGN\fP, \fICRL_SIGN\fP, \fISERVER_AUTH\fP (default),
-\fICLIENT_AUTH\fP, \fICODE_SIGNING\fP, \fIEMAIL_PROTECTION\fP,
-\fIIPSEC_END_SYSTEM\fP, \fIIPSEC_TUNNEL\fP, \fIIPSEC_USER\fP,
-\fITIME_STAMPING\fP, \fISTEP_UP_APPROVED\fP
-.RE
-.IP
-Valid trust levels are:
-.RS
-\fIALL\fP, \fITRUSTED_DELEGATOR\fP (default), \fINOT_TRUSTED\fP, \fIMUST_VERIFY_TRUST\fP, \fITRUSTED\fP
-.RE
-.IP -q
-be really quiet (no progress output at all)
-.IP -t
-include plain text listing of certificates
-.IP "-s [algorithms]"
-comma separated list of signature algorithms with which to hash/fingerprint
-each certificate and output when run in plain text mode.
-
-(Added in version 1.21, Perl only)
-
-Valid algorithms are:
-.RS
-ALL, NONE, MD5 (default), SHA1, SHA256, SHA384, SHA512
-.RE
-.IP -u
-unlink (remove) \fIcertdata.txt\fP after processing
-.IP -v
-be verbose and print out processed certificate authorities
-.SH EXIT STATUS
-Returns 0 on success. Returns 1 if it fails to download data.
-.SH FILE FORMAT
-The file format used by Mozilla for this trust information is documented here:
-.nf
-https://p11-glue.freedesktop.org/doc/storing-trust-policy/storing-trust-existing.html
-.fi
-.SH SEE ALSO
-.BR curl (1)
diff --git a/third-party/curl/docs/mk-ca-bundle.md b/third-party/curl/docs/mk-ca-bundle.md
new file mode 100644
index 0000000000..8fb80268bc
--- /dev/null
+++ b/third-party/curl/docs/mk-ca-bundle.md
@@ -0,0 +1,125 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: mk-ca-bundle
+Section: 1
+Source: mk-ca-bundle
+See-also:
+  - curl (1)
+Added-in: n/a
+---
+
+# NAME
+
+mk-ca-bundle - convert Mozilla's certificate bundle to PEM format
+
+# SYNOPSIS
+
+mk-ca-bundle [options] [output]
+
+# DESCRIPTION
+
+This tool downloads the *certdata.txt* file from Mozilla's source tree over
+HTTPS, then parses it and extracts the included certificates into PEM format.
+By default, only CA root certificates trusted to issue SSL server
+authentication certificates are extracted. These are then processed with the
+OpenSSL command line tool to produce the final ca-bundle output file.
+
+The default *output* name is **ca-bundle.crt**. By setting it to '-' (a single
+dash) you get the output sent to STDOUT instead of a file.
+
+The PEM format this scripts uses for output makes the result readily available
+for use by OpenSSL or GnuTLS powered applications, such as curl and others.
+
+# OPTIONS
+
+The following options are supported:
+
+## -b
+
+backup an existing version of *output*
+
+## -d [name]
+
+specify which Mozilla tree to pull *certdata.txt* from (or a custom URL).
+Valid names are: **aurora**, **beta**, **central**, **Mozilla**, **nss**,
+**release** (default). They are shortcuts for which source tree to get the
+certificate data from.
+
+## -f
+
+force rebuild even if *certdata.txt* is current (Added in version 1.17)
+
+## -i
+
+print version info about used modules
+
+## -k
+
+Allow insecure data transfer. By default (since 1.27) this command fails if
+the HTTPS transfer fails. This overrides that decision (and opens for
+man-in-the-middle attacks).
+
+## -l
+
+print license info about *certdata.txt*
+
+## -m
+
+(Added in 1.26) Include meta data comments in the output. The meta data is
+specific information about each certificate that is stored in the original
+file as comments and using this option makes those comments get passed on to
+the output file. The meta data is not parsed in any way by mk-ca-bundle.
+
+## -n
+
+Do not download *certdata.txt* - use the existing.
+
+## -p [purposes]:[levels]
+
+list of Mozilla trust purposes and levels for certificates to include in
+output. Takes the form of a comma separated list of purposes, a colon, and a
+comma separated list of levels. The default is to include all certificates
+trusted to issue SSL Server certificates (*SERVER_AUTH:TRUSTED_DELEGATOR*).
+
+Valid purposes are: **ALL**, **DIGITAL_SIGNATURE**, **NON_REPUDIATION**,
+**KEY_ENCIPHERMENT**, **DATA_ENCIPHERMENT**, **KEY_AGREEMENT**,
+**KEY_CERT_SIGN**, **CRL_SIGN**, **SERVER_AUTH** (default), **CLIENT_AUTH**,
+**CODE_SIGNING**, **EMAIL_PROTECTION**, **IPSEC_END_SYSTEM**,
+**IPSEC_TUNNEL**, **IPSEC_USER**, **TIME_STAMPING**, **STEP_UP_APPROVED**
+
+Valid trust levels are: **ALL**, **TRUSTED_DELEGATOR** (default), **NOT_TRUSTED**,
+**MUST_VERIFY_TRUST**, **TRUSTED**
+
+## -q
+
+be really quiet (no progress output at all)
+
+## -t
+
+include plain text listing of certificates
+
+## -s [algorithms]
+
+A comma separated list of signature algorithms with which to hash/fingerprint
+each certificate and output when run in plain text mode.
+
+Valid algorithms are:
+ALL, NONE, MD5 (default), SHA1, SHA256, SHA384, SHA512
+
+## -u
+
+unlink (remove) *certdata.txt* after processing
+
+## -v
+
+be verbose and print out processed certificate authorities
+
+# EXIT STATUS
+
+Returns 0 on success. Returns 1 if it fails to download data.
+
+# FILE FORMAT
+
+The file format used by Mozilla for this trust information is [documented
+here](https://p11-glue.github.io/p11-glue/doc/storing-trust-policy/storing-trust-existing.html).
diff --git a/third-party/curl/docs/options-in-versions b/third-party/curl/docs/options-in-versions
index e79a25ad25..fa20b2dd29 100644
--- a/third-party/curl/docs/options-in-versions
+++ b/third-party/curl/docs/options-in-versions
@@ -54,7 +54,9 @@
 --doh-cert-status                    7.76.0
 --doh-insecure                       7.76.0
 --doh-url                            7.62.0
+--dump-ca-embed                      8.10.0
 --dump-header (-D)                   5.7
+--ech                                8.8.0
 --egd-file                           7.7
 --engine                             7.9.3
 --etag-compare                       7.68.0
@@ -74,7 +76,7 @@
 --ftp-pasv                           7.11.0
 --ftp-port (-P)                      4.0
 --ftp-pret                           7.20.0
---ftp-skip-pasv-ip                   7.14.2
+--ftp-skip-pasv-ip                   7.15.0
 --ftp-ssl-ccc                        7.16.1
 --ftp-ssl-ccc-mode                   7.16.2
 --ftp-ssl-control                    7.16.0
@@ -97,16 +99,19 @@
 --http3                              7.66.0
 --http3-only                         7.88.0
 --ignore-content-length              7.14.1
---include (-i)                       4.8
+--ip-tos                             8.9.0
+--ipfs-gateway                       8.4.0
 --insecure (-k)                      7.10
 --interface                          7.3
 --ipv4 (-4)                          7.10.8
 --ipv6 (-6)                          7.10.8
 --json                               7.82.0
 --junk-session-cookies (-j)          7.9.7
+--keepalive-cnt                      8.9.0
 --keepalive-time                     7.18.0
 --key                                7.9.3
 --key-type                           7.9.3
+--knownhosts                         8.17.0
 --krb                                7.3
 --libcurl                            7.16.1
 --limit-rate                         7.10
@@ -124,6 +129,7 @@
 --max-redirs                         7.5
 --max-time (-m)                      4.0
 --metalink                           7.27.0
+--mptcp                              8.9.0
 --negotiate                          7.10.6
 --netrc (-n)                         4.6
 --netrc-file                         7.21.5
@@ -140,11 +146,13 @@
 --ntlm                               7.10.6
 --ntlm-wb                            7.22.0
 --oauth2-bearer                      7.33.0
+--out-null                           8.16.0
 --output (-o)                        4.0
 --output-dir                         7.73.0
 --parallel (-Z)                      7.66.0
 --parallel-immediate                 7.68.0
 --parallel-max                       7.66.0
+--parallel-max-host                  8.16.0
 --pass                               7.9.3
 --path-as-is                         7.42.0
 --pinnedpubkey                       7.39.0
@@ -153,9 +161,9 @@
 --post303                            7.26.0
 --preproxy                           7.52.0
 --progress-bar (-#)                  5.10
---proto                              7.20.2
+--proto                              7.21.0
 --proto-default                      7.45.0
---proto-redir                        7.20.2
+--proto-redir                        7.21.0
 --proxy (-x)                         4.0
 --proxy-anyauth                      7.13.2
 --proxy-basic                        7.12.0
@@ -169,6 +177,7 @@
 --proxy-digest                       7.12.0
 --proxy-header                       7.37.0
 --proxy-http2                        8.1.0
+--proxy-http3                        8.21.0
 --proxy-insecure                     7.52.0
 --proxy-key                          7.52.0
 --proxy-key-type                     7.52.0
@@ -193,6 +202,7 @@
 --range (-r)                         4.0
 --rate                               7.84.0
 --raw                                7.16.2
+--follow                             8.16.0
 --referer (-e)                       4.0
 --remote-header-name (-J)            7.20.0
 --remote-name (-O)                   4.0
@@ -211,7 +221,10 @@
 --sasl-ir                            7.31.0
 --service-name                       7.43.0
 --show-error (-S)                    5.9
+--show-headers (-i)                  4.8
 --silent (-s)                        4.0
+--sigalgs                            8.14.0
+--skip-existing                      8.10.0
 --socks4                             7.15.2
 --socks4a                            7.18.0
 --socks5                             7.18.0
@@ -228,6 +241,7 @@
 --ssl-no-revoke                      7.44.0
 --ssl-reqd                           7.20.0
 --ssl-revoke-best-effort             7.70.0
+--ssl-sessions                       8.12.0
 --sslv2 (-2)                         5.9
 --sslv3 (-3)                         5.9
 --stderr                             6.2
@@ -239,6 +253,7 @@
 --tftp-blksize                       7.20.0
 --tftp-no-options                    7.48.0
 --time-cond (-z)                     5.8
+--tls-earlydata                      8.11.0
 --tls-max                            7.54.0
 --tls13-ciphers                      7.61.0
 --tlsauthtype                        7.21.4
@@ -257,6 +272,7 @@
 --trace-time                         7.14.0
 --unix-socket                        7.40.0
 --upload-file (-T)                   4.0
+--upload-flags                       8.13.0
 --url                                7.5
 --url-query                          7.87.0
 --use-ascii (-B)                     5.0
@@ -265,5 +281,6 @@
 --variable                           8.3.0
 --verbose (-v)                       4.0
 --version (-V)                       4.0
+--vlan-priority                      8.9.0
 --write-out (-w)                     6.5
 --xattr                              7.21.3
diff --git a/third-party/curl/docs/runtests.md b/third-party/curl/docs/runtests.md
new file mode 100644
index 0000000000..a1190004af
--- /dev/null
+++ b/third-party/curl/docs/runtests.md
@@ -0,0 +1,320 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: runtests.pl
+Section: 1
+Source: runtests
+See-also:
+  - runtests.pl
+Added-in: 7.5
+---
+
+# NAME
+
+runtests.pl - run one or more test cases
+
+# SYNOPSIS
+
+**runtests.pl [options] [tests]**
+
+# DESCRIPTION
+
+*runtests.pl* runs one, several or all the existing test cases in curl's
+test suite. It is often called from the root Makefile of the curl package with
+'make test'.
+
+# TESTS
+
+Specify which test(s) to run by specifying test numbers or keywords.
+
+If no test number or keyword is given, all existing tests that the script can
+find are considered for running. You can specify single test cases to run by
+specifying test numbers space-separated, like `1 3 5 7 11`, and you can
+specify a range of tests like `45 to 67`.
+
+Specify tests to not run with a leading exclamation point, like `!66`, which
+runs all available tests except number 66.
+
+Prefix a test number with a tilde (~) to still run it, but ignore the results.
+
+It is also possible to specify tests based on a keyword describing the test(s)
+to run, like `FTPS`. The keywords are strings used in the individual tests.
+
+Features are included as keywords with the `feat:` prefix (e.g., `feat:debug`).
+Specify a feature to run only tests requiring it, or exclude tests using
+`!feat:<feature>`, like `!feat:proxy`, to disable tests which depend on that
+feature.
+
+You can also specify keywords with a leading exclamation point and the keyword
+or phrase, like "!HTTP NTLM auth" to run all tests **except** those using this
+keyword. Remember that the exclamation marks and spaces need to be quoted
+somehow when entered at many command shells.
+
+Prefix a keyword with a tilde (~) to still run it, but ignore the results.
+
+# OUTPUT
+
+When running without `-s` (short output), for instance when running
+runtests.pl directly rather than via make, each test emits a pair of lines
+like this:
+
+    Test 0045...[simple HTTP Location: without protocol in initial URL]
+    --pd---e-v- OK (45  out of 1427, remaining: 16:08, took 6.188s, duration: 00:31)
+
+the first line contains the test number and a description. On the second line,
+the characters at the beginning are flags indicating which aspects of curl's
+behavior were checked by the test:
+
+    s stdout
+    r stderr
+    p protocol
+    d data
+    u upload
+    P proxy
+    o output
+    e exit code
+    m memory
+    v valgrind
+    E the test was run event-based
+
+The remainder of the second line contains the test result, current test sequence,
+total number of tests to be run and an estimated amount of time to complete the
+test run.
+
+# OPTIONS
+
+## `-a`
+
+Continue running the rest of the test cases even if one test fails. By
+default, the test script stops as soon as an error is detected.
+
+## `-ac \<curl\>`
+
+Provide a path to a curl binary to talk to APIs (currently only CI test APIs).
+
+## `-am`
+
+Display test results in automake style output (`PASS/FAIL: [number] [name]`).
+
+## `--buildinfo`
+
+Dump `buildinfo.txt`.
+
+## `-c \<curl\>`
+
+Provide a path to a custom curl binary to run the tests with. Default is the
+curl executable in the build tree.
+
+## `-d`
+
+Enable protocol debug: have the servers display protocol output. If used in
+conjunction with parallel testing, it is difficult to associate the logs with
+the specific test being run.
+
+## `-E \<exclude_file\>`
+
+Load the **exclude_file** with additional reasons why certain tests should be
+skipped. Useful when testing with external HTTP proxies in which case some of
+the tests are not appropriate.
+
+The file contains colon-delimited lines. The first field contains the type of
+exclusion, the second field contains a pattern and the final field contains
+the reason why matching tests should be skipped. The exclusion types are
+*keyword*, *test*, and *tool*.
+
+## `-e` or `--test-event`
+
+Run the test event-based (if possible). This makes runtests invoke curl with
+--test-event option. This option only works if both curl and libcurl were
+built debug-enabled.
+
+## `-f`
+
+Force the test to run even if mentioned in DISABLED.
+
+## `-g`
+
+Run the given test(s) with gdb. This is best used on a single test case and
+curl built --disable-shared. This then fires up gdb with command line set to
+run the specified test case. Set a break-point if needed and type 'run' to
+start.
+
+## `-gl`
+
+Run the given test(s) with lldb. This is best used on a single test case and
+curl built --disable-shared. This then fires up lldb with command line set to
+run the specified test case. Set a break-point if needed and type 'run' to
+start.
+
+## `-gw`
+
+Run the given test(s) with gdb as a windowed application.
+
+## `-h, --help`
+
+Displays a help text about this program's command line options.
+
+## `-j[num]`
+
+Spawn the given number of processes to run tests in. This defaults to 0 to run
+tests serially within a single process. Using a number greater than one allows
+multiple tests to run in parallel, speeding up a test run. The optimum number
+is dependent on the system and set of tests to run, but 7 times the number of
+CPU cores is a good figure to start with, or 1.3 times if Valgrind is in use,
+or 5 times for torture tests. Enabling parallel tests is not recommended in
+conjunction with the -g option.
+
+## `-L \<file\>`
+
+Load and execute the specified file which should contain perl code. This
+option allows one to change *runtests.pl* behavior by overwriting functions
+and variables and is useful when testing external proxies using curl's
+regression test suite.
+
+## `-l`
+
+Lists all test case names.
+
+## `-m=[seconds]`
+
+Set timeout for curl commands in tests.
+
+## `--min=[count]`
+
+Set the minimum number of tests to run. This overrides the `CURL_TEST_MIN`
+environment variable, if any.
+
+## `-n`
+
+Disable the check for and use of valgrind.
+
+## `--no-debuginfod`
+
+Delete the `DEBUGINFOD_URLS` variable if that is defined. Makes valgrind, gdb
+etc not able to use this functionality.
+
+## `-o \<variablename=value\>`
+
+Overwrite the specified internal **variable** with **value**. Useful to change
+variables that did not get a dedicated flag to change them. Check the source to
+see which variables are available.
+
+## `-P \<proxy\>`
+
+Use the specified HTTP proxy when executing tests, even if the tests
+themselves do not specify a proxy. This option allows one to test external
+proxies using curl's regression test suite.
+
+## `-p`
+
+Prints out all files in the log directory to stdout when a test case fails.
+Practical when used in the automated and distributed tests since then the
+people checking the failures and the reasons for them might not have physical
+access to the machine and logs.
+
+## `-R`
+
+Run the tests in a scrambled, or randomized, order instead of sequentially.
+
+The random seed initially set for this is fixed per month and can be set with
+*--seed*.
+
+## `-r`
+
+Display run time statistics. (Requires the `Perl Time::HiRes` module)
+
+## `-rf`
+
+Display full run time statistics. (Requires the `Perl Time::HiRes` module)
+
+## `--repeat=[num]`
+
+This repeats the given set of test numbers this many times. If no test numbers
+are given, it repeats ALL tests this many times. It adds the new repeated
+sequence at the end of the initially given one.
+
+If **-R** option is also used, the scrambling is done after the repeats have
+extended the test sequence.
+
+## `--retry=[num]`
+
+Number of attempts for the whole test run to retry failed tests.
+
+## `-s`
+
+Shorter output. Speaks less than default.
+
+## `--seed=[num]`
+
+When using *--shallow* or *-R* that randomize certain aspects of the behavior,
+this option can set the initial seed. If not set, the random seed is set based
+on the currently set local year and month and the first line of the "curl -V"
+output.
+
+## `--shallow=[num]`
+
+Used together with **-t**. This limits the number of tests to fail in torture
+mode to no more than **num** per test case. If this reduces the amount, the
+script randomly discards entries to fail until the amount is **num**.
+
+The random seed initially set for this is fixed per month and can be set with
+*--seed*.
+
+## `-t[num]`
+
+Selects a **torture** test for the given tests. This makes runtests.pl first
+run the tests once and count the number of memory allocations made. It then
+reruns the test that number of times, each time forcing one of the allocations
+to fail until all allocations have been tested. By setting *num* you can force
+the allocation with that number to be set to fail at once instead of looping
+through everyone, which is handy when debugging and then often in combination
+with *-g*.
+
+## `--test-duphandle`
+
+Passes the `--test-duphandle` option to curl when invoked. This command line
+option only exists in debug builds and runs curl normally, but duplicates the
+easy handle before the transfer and use the duplicate instead of the original
+handle. This verifies that the duplicate works exactly as good as the original
+handle.
+
+Because of how the curl tool uses a share object to store and keep some data,
+not everything is however perfectly copied in the duplicate. In particular
+HSTS data is not. A specific test case can be set to avoid using
+`--test-duphandle` by disabling it on a per test basis.
+
+## `-u`
+
+Error instead of warning on server unexpectedly alive.
+
+## `-v`
+
+Enable verbose output. Speaks more than by default. If used in conjunction
+with parallel testing, it is difficult to associate the logs with the specific
+test being run.
+
+## `-vc \<curl\>`
+
+Provide a path to a custom curl binary to run when verifying that the servers
+running are indeed our test servers. Default is the curl executable in the
+build tree.
+
+# RUNNING TESTS
+
+Many tests have conditions that must be met before the test case can run fine.
+They could depend on built-in features in libcurl or features present in the
+operating system or even in third-party libraries that curl may or may not
+use.
+
+The test script checks most of these by itself to determine when it is safe to
+attempt to run each test. Those which cannot be run due to failed requirements
+are skipped and listed at the completion of all test cases. In some
+unusual configurations, the test script cannot make the correct determination
+for all tests. In these cases, the problematic tests can be skipped using the
+"!keyword" skip feature documented earlier.
+
+# WRITING TESTS
+
+The simplest way to write test cases is to start with a similar existing test,
+save it with a new number and then adjust it to fit. There is an attempt to
+document the test case file format in **tests/FILEFORMAT.md**.
diff --git a/third-party/curl/docs/testcurl.md b/third-party/curl/docs/testcurl.md
new file mode 100644
index 0000000000..090401aac0
--- /dev/null
+++ b/third-party/curl/docs/testcurl.md
@@ -0,0 +1,138 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: testcurl.pl
+Section: 1
+Source: testcurl
+See-also:
+  - runtests.pl
+Added-in: 7.11.2
+---
+
+# NAME
+
+testcurl.pl - (automatically) test curl
+
+# SYNOPSIS
+
+**testcurl.pl [options] [dir] \> output**
+
+# DESCRIPTION
+
+*testcurl* is the master script to use for automatic distributed testing of
+curl from git or daily snapshots. It is written for the purpose of being run
+from a crontab job or similar at a regular interval. The output is suitable to
+be mailed to **curl-autocompile@haxx.se** to be dealt with automatically (make
+sure the subject includes the word "autobuild" as the mail gets silently
+discarded otherwise). The most current build status (with a reasonable
+backlog) is published on the curl site, at https://curl.se/dev/builds.html
+
+*options* may be omitted. See *--setup* for what happens then.
+
+*dir* is a curl source directory, possibly a daily snapshot one. Using this
+makes *testcurl* skip the *autoreconf* stage and thus it removes the
+dependency on automake, autoconf, libtool, GNU m4 and possibly a few other
+things.
+
+*testcurl* runs `autoreconf` (or similar), configure, builds curl and libcurl
+in a separate build directory and then runs `make test` to test the fresh
+build.
+
+# OPTIONS
+
+## `--configure=[options]`
+
+Configure options passed to configure.
+
+## `--crosscompile`
+
+This is a cross-compile. Makes *testcurl* skip a few things.
+
+## `--desc=[desc]`
+
+Description of your test system. Displayed on the build summary page on the
+website.
+
+## `--email=[email]`
+
+Set email address to report as. Displayed in the build logs on the site.
+
+## `--mktarball=[command]`
+
+Generic command to run after completed test.
+
+## `--name=[name]`
+
+Set name to report as. Displayed in the build summary on the site.
+
+## `--nobuildconf`
+
+Do not run autoreconf. Useful when many builds use the same source tree, as
+then only one need to do this. Also, if multiple processes run tests
+simultaneously on the same source tree (like several hosts on a NFS mounted
+directory), simultaneous autoreconf invokes may cause problems. (Added in
+7.14.1)
+
+## `--nogitpull`
+
+Do not update from git even though it is a git tree. Useful to still be able
+to test even though your network is down, or similar.
+
+## `--runtestopts=[options]`
+
+Options that is passed to the runtests script. Useful for disabling valgrind
+by force, and similar.
+
+## `--setup=[filename]`
+
+filename to read setup from (deprecated). The old style of providing info. If
+info is missing when *testcurl* is started, it prompts you and then stores the
+info in a 'setup' file, which it looks for on each invoke. Use *--name*,
+*--email*, *--configure* and *--desc* instead.
+
+## `--target=[your os]`
+
+Specify your target environment. Recognized strings include `vc`, `mingw32`,
+and `borland`.
+
+# INITIAL SETUP
+
+First, make a checkout from git (or you write a script that downloads daily
+snapshots automatically):
+
+    $ mkdir curl-testing
+    $ cd curl-testing
+    $ git clone https://github.com/curl/curl
+
+With the curl sources checked out, or downloaded, you can start testing right
+away. If you want to use *testcurl* without command line arguments and to have
+it store and remember the config in its 'setup' file, then start it manually
+now and fill in the answers to the questions it prompts you for:
+
+    $ ./curl/tests/testcurl
+
+Now you are ready to go. If you let the script run, it performs a full cycle
+and spit out lots of output. Mail us that output as described above.
+
+# CRONTAB EXAMPLE
+
+The crontab could include something like this:
+
+    # autobuild curl:
+    0 4 * * * cd curl-testing && ./testit.sh
+
+Where `testit.sh` is a shell script that could look similar to this:
+
+    mail="mail -s autobuild curl-autocompile@haxx.se"
+    name="--name=whoami"
+    email="--email=iamme@nowhere"
+    desc='"--desc=supermachine Turbo 2000"'
+    testprog="perl ./curl/tests/testcurl.pl $name $email $desc"
+    opts1="--configure=--enable-debug"
+    opts2="--configure=--enable-ipv6"
+
+    # run first test
+    $testprog $opts1 | $mail
+
+    # run second test
+    $testprog $opts2 | $mail
diff --git a/third-party/curl/docs/tests/CI.md b/third-party/curl/docs/tests/CI.md
new file mode 100644
index 0000000000..e68c9bc885
--- /dev/null
+++ b/third-party/curl/docs/tests/CI.md
@@ -0,0 +1,92 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# Continuous Integration for curl
+
+curl runs in many different environments, so every change is run against a
+large number of test suites.
+
+Every pull request is verified for each of the following:
+
+- it still builds, warning-free, on Linux, macOS, Windows, BSDs, with both
+  clang and gcc, autotools and cmake, out-of-tree and in-tree.
+- it still builds fine on Windows with all supported MSVC versions
+- it follows rudimentary code style rules
+- the test suite still runs 100% fine
+- the release tarball (the "dist") still works
+- different TLS backends and options still compile and pass tests
+
+If the pull-request fails one of these tests, it shows up as a red X and you
+are expected to fix the problem. If you do not understand what the issue is or
+have other problems to fix the complaint, ask and other project members can
+likely help out.
+
+Consider the following table while looking at pull request failures:
+
+| CI platform as shown in PR          | State  | What to look at next       |
+| ----------------------------------- | ------ | -------------------------- |
+| Linux / macOS / Windows / ...       | stable | all errors and failures    |
+| Fuzzer                              | stable | fuzzing results            |
+| Code analyzers                      | stable | new findings               |
+| checkdocs / checksrc / dist / ...   | stable | all errors and failures    |
+| AppVeyor                            | stable | all errors and failures    |
+| buildbot/curl_Schannel ...          | stable | all errors and failures    |
+| curl.curl (linux ...)               | stable | all errors and failures    |
+
+Sometimes the tests fail or run slowly due to a dependency service temporarily
+having issues, for example package downloads, or virtualized (non-native)
+environments. Sometimes a flaky failed test may occur in any jobs.
+
+Windows jobs have a number of flaky issues, most often, these:
+- test run hanging and timing out after 20 minutes.
+- test run aborting with 2304 (hex 0900) or 3840 (hex 0F00).
+- test run crashing with fork errors.
+- steps past the test run exiting with -1073741502 (hex C0000142).
+
+In these cases you can try to update your pull requests to rerun the tests
+later as described below.
+
+A detailed overview of test runs and results can be found on
+[Test Clutch](https://testclutch.curl.se/).
+
+## CI servers
+
+Here are the different CI environments that are currently in use, and how they
+are configured:
+
+### GitHub Actions (GHA)
+
+GitHub Actions runs the following tests:
+
+- Tests with a variety of different compilation options, OSes, CPUs.
+- Fuzz tests ([see the curl-fuzzer repo for more
+  info](https://github.com/curl/curl-fuzzer)).
+- Static analysis and sanitizers: clang-tidy, address sanitizer,
+  memory sanitizer, thread sanitizer, CodeQL, valgrind, torture tests.
+
+These are each configured in different files in `.github/workflows`.
+
+### AppVeyor CI
+
+AppVeyor runs a variety of different Windows builds, with different compilation
+options.
+
+As of October 2025 `@bagder`, `@mback2k`, `@jay`, `@vszakats`, `@dfandrich`
+and `@danielgustafsson` have administrator access to the AppVeyor CI
+environment.  Additional admins/group members can be added on request.
+
+The tests are configured in `appveyor.yml`.
+
+### Circle CI
+
+Circle CI runs a basic Linux test suite on Ubuntu for both x86 and ARM
+processors. This is configured in `.circleci/config.yml`.
+
+You can [view the full list of CI jobs on Circle CI's
+website](https://app.circleci.com/pipelines/github/curl/curl).
+
+`@bagder` has access to edit the "Project Settings" on that page. Additional
+admins/group members can be added on request.
diff --git a/third-party/curl/docs/tests/FILEFORMAT.md b/third-party/curl/docs/tests/FILEFORMAT.md
new file mode 100644
index 0000000000..b19cd7f87f
--- /dev/null
+++ b/third-party/curl/docs/tests/FILEFORMAT.md
@@ -0,0 +1,823 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# curl test suite file format
+
+The curl test suite's file format is simple and extendable, closely resembling
+XML. All data for a single test case resides in a single ASCII file. Labels
+mark the beginning and the end of all sections, and each label must be written
+in its own line. Comments are either XML-style (enclosed with `<!--` and
+`-->`) or shell script style (beginning with `#`) and must appear on their own
+lines and not alongside actual test data. Test data files are syntactically
+valid XML; lack of support for character entities is a big difference but macros
+like %CR fill that particular role here.
+
+Each test case source exists as a file matching the format
+`tests/data/testNUM`, where `NUM` is the unique test number, and must begin
+with a `testcase` tag, which encompasses the remainder of the file.
+
+# Preprocessing
+
+When a test is to be executed, the source file is first preprocessed and
+variables are substituted by their respective contents and the output version
+of the test file is stored as `%LOGDIR/testNUM`. That version is what is read
+and used by the test servers.
+
+## Base64 Encoding
+
+In the preprocess stage, a special instruction can be used to have runtests.pl
+base64 encode a certain section and insert in the generated output file. This
+is in particular good for test cases where the test tool is expected to pass
+in base64 encoded content that might use dynamic information that is unique
+for this particular test invocation, like the server port number.
+
+To insert a base64 encoded string into the output, use this syntax:
+
+    %b64[ data to encode ]b64%
+
+The data to encode can then use any of the existing variables mentioned below,
+or even percent-encoded individual bytes. As an example, insert the HTTP
+server's port number (in ASCII) followed by a space and the hexadecimal byte
+9a:
+
+    %b64[%HTTPPORT %9a]b64%
+
+## Hexadecimal decoding
+
+In the preprocess stage, a special instruction can be used to have runtests.pl
+generate a sequence of binary bytes.
+
+To insert a sequence of bytes from a hex encoded string, use this syntax:
+
+    %hex[ %XX-encoded data to decode ]hex%
+
+Other bytes within the brackets that not percent encoded are inserted as-is.
+
+For example, to insert the binary octets 0, 1 and 255 into the test file:
+
+    %hex[%00%01%FF]hex%
+
+## Repeat content
+
+In the preprocess stage, a special instruction can be used to have runtests.pl
+generate a repetitive sequence of bytes.
+
+To insert a sequence of repeat bytes, use this syntax to make the `<string>`
+get repeated `<number>` of times. The number has to be 1 or larger and the
+string may contain `%HH` hexadecimal codes:
+
+    %repeat[<number> x <string>]%
+
+For example, to insert the word hello 100 times:
+
+    %repeat[100 x hello]%
+
+## Whitespace
+
+To force CRLF newline, add this macro to the end of the line:
+
+    %CR  - carriage return
+
+To add significant whitespace characters at the end of the line, or to empty
+lines:
+
+    %SP  - space
+    %TAB - horizontal tab
+
+## Special characters
+
+Macros to help keep data files XML-compliant:
+
+    %AMP - Ampersand: `&`
+    %GT  - Greater-than sign: `>`
+    %LT  - Less-than sign: `<`
+
+## Insert capped epoch days
+
+Mostly to test capped cookie expire dates: `%days[NUM]` inserts the number of
+seconds for the given number of days into the future, aligned to the nearest
+minute. That is the same calculation the cookie engine uses to cap expiration
+dates.
+
+## Include file
+
+This instruction allows a test case to include another file. It is helpful to
+remember that the ordinary variables are expanded before the include happens
+so `%LOGDIR` and the others can be used in the include line.
+
+The filename cannot contain `%` as that letter is used to end the name for
+the include instruction:
+
+    %include filename%
+
+Or, a variant of the above where the file is loaded as a newline-agnostic
+text file, and whitespace, special character macros and variables expanded
+after inclusion:
+
+    %includetext filename%
+
+## Conditional lines
+
+Lines in the test file can be made to appear conditionally on a specific
+feature (see the "features" section below) being set or not set. If the
+specific feature is present, the following lines are output, otherwise it
+outputs nothing, until a following else or `endif` clause. Like this:
+
+    %if brotli
+    Accept-Encoding
+    %endif
+
+It can also check for the inverse condition, so if the feature is *not* set by
+the use of an exclamation mark:
+
+    %if !brotli
+    Accept-Encoding: not-brotli
+    %endif
+
+You can also make an "else" clause to get output for the opposite condition,
+like:
+
+    %if brotli
+    Accept-Encoding: brotli
+    %else
+    Accept-Encoding: nothing
+    %endif
+
+Nested conditions are supported.
+
+# Variables
+
+When the test is preprocessed, a range of "variables" in the test file is
+replaced by their content at that time.
+
+Available substitute variables include:
+
+- `%CLIENT6IP` - IPv6 address of the client running curl (including brackets)
+- `%CLIENT6IP-NB` - IPv6 address of the client running curl (no brackets)
+- `%CLIENTIP` - IPv4 address of the client running curl
+- `%CURL` - Path to the curl executable
+- `%DATE` - current YYYY-MM-DD date
+- `%DEV_NULL` - Null device (e.g. /dev/null)
+- `%FILE_PWD` - Current directory, on Windows prefixed with a slash
+- `%FTP6PORT` - IPv6 port number of the FTP server
+- `%FTPPORT` - Port number of the FTP server
+- `%FTPSPORT` - Port number of the FTPS server
+- `%FTPTIME2` - Timeout in seconds that should be sufficient to receive a
+  response from the test FTP server
+- `%GOPHER6PORT` - IPv6 port number of the Gopher server
+- `%GOPHERPORT` - Port number of the Gopher server
+- `%GOPHERSPORT` - Port number of the Gophers server
+- `%HOST6IP` - IPv6 address of the host running this test
+- `%HOSTIP` - IPv4 address of the host running this test
+- `%HTTP2PORT` - Port number of the HTTP/2 server
+- `%HTTP6PORT` - IPv6 port number of the HTTP server
+- `%HTTPPORT` - Port number of the HTTP server
+- `%HTTPSPORT` - Port number of the HTTPS server
+- `%HTTPSPROXYPORT` - Port number of the HTTPS-proxy
+- `%HTTPTLS6PORT` - IPv6 port number of the HTTP TLS server
+- `%HTTPTLSPORT` - Port number of the HTTP TLS server
+- `%HTTPUNIXPATH` - Path to the Unix socket of the HTTP server
+- `%IMAP6PORT` - IPv6 port number of the IMAP server
+- `%IMAPPORT` - Port number of the IMAP server
+- `%LOGDIR` - Log directory relative to %PWD
+- `%MQTTPORT` - Port number of the MQTT server
+- `%MQTTSPORT` - Port number of the MQTTS server
+- `%NOLISTENPORT` - Port number where no service is listening
+- `%POP36PORT` - IPv6 port number of the POP3 server
+- `%POP3PORT` - Port number of the POP3 server
+- `%PROXYPORT` - Port number of the HTTP proxy
+- `%PWD` - Current directory
+- `%RESOLVE` - server/resolve command
+- `%RTSP6PORT` - IPv6 port number of the RTSP server
+- `%RTSPPORT` - Port number of the RTSP server
+- `%SMBPORT` - Port number of the SMB server
+- `%SMBSPORT` - Port number of the SMBS server
+- `%SMTP6PORT` - IPv6 port number of the SMTP server
+- `%SMTPPORT` - Port number of the SMTP server
+- `%SOCKSPORT` - Port number of the SOCKS4/5 server
+- `%SOCKSUNIXPATH` - Path to the Unix socket of the SOCKS server
+- `%SRCDIR` - Full path to the source dir
+- `%SCP_PWD` - Current directory friendly for the SSH server for the `scp://` protocol
+- `%SFTP_PWD` - Current directory friendly for the SSH server for the `sftp://` protocol
+- `%SSHKEYALGO` - SSH host and client key algorithm, e.g. `ssh-rsa` or `ssh-ed25519`
+- `%SSHPORT` - Port number of the SCP/SFTP server
+- `%SSHSRVMD5` - MD5 of SSH server's public key
+- `%SSHSRVSHA256` - SHA256 of SSH server's public key
+- `%TELNETPORT` - Port number of the telnet server
+- `%TESTNUMBER` - Number of the test case
+- `%TFTP6PORT` - IPv6 port number of the TFTP server
+- `%TFTPPORT` - Port number of the TFTP server
+- `%USER` - Login ID of the user running the test
+- `%VERNUM` - the version number of the tested curl (without -DEV)
+- `%VERSION` - the full version number of the tested curl
+
+# `<testcase>`
+
+Each test is always specified entirely within the `testcase` tag. Each test
+case is split up in four main sections: `info`, `reply`, `client` and
+`verify`.
+
+- **info** provides information about the test case
+
+- **reply** is used for the server to know what to send as a reply for the
+requests curl sends
+
+- **client** defines how the client should behave
+
+- **verify** defines how to verify that the data stored after a command has
+been run ended up correct
+
+Each main section has a number of available subsections that can be specified,
+that are checked/used if specified.
+
+## `<info>`
+
+### `<keywords>`
+A newline-separated list of keywords describing what this test case uses and
+tests. Try to use already used keywords. These keywords are used for
+statistical/informational purposes and for choosing or skipping classes of
+tests. Keywords must begin with an alphabetic character, `-`, `[` or `{` and
+may actually consist of multiple words separated by spaces which are treated
+together as a single identifier. Most keywords are only there to provide a way
+for users to skip certain classes of tests, if desired, but a few are treated
+specially by the test harness or build system.
+
+When running a unit test and the keywords include `unittest`, the `<tool>`
+section can be left empty to use the standard unit test tool name `unitN` where
+`N` is the test number.
+
+The `test-ci` make target automatically skips test with the `flaky` keyword.
+
+Tests that have strict timing dependencies have the `timing-dependent` keyword.
+These are intended to eventually be treated specially on CI builds which are
+often run on overloaded machines with unpredictable timing.
+
+Tests using non-7-bit-ASCII characters must provide them with `%hex[]` or
+similar.
+
+## `<reply>`
+
+### `<data [nocheck="yes"] [sendzero="yes"] [nonewline="yes"] [crlf="yes|headers"]>`
+
+data to be sent to the client on its request and later verified that it
+arrived safely. Set `nocheck="yes"` to prevent the test script from verifying
+the arrival of this data.
+
+If the data contains `swsclose` anywhere within the start and end tag, and
+this is an HTTP test, then the connection is closed by the server after this
+response is sent. If not, the connection is kept persistent.
+
+If the data contains `swsbounce` anywhere within the start and end tag, then
+the HTTP server overrides the part number response returned for a subsequent
+request made by the same test to `previous part number + 1`. For example, if a
+test makes a request which causes the server to return `<data>` that contains
+keyword `swsbounce` then for the next response it ignores the requested part
+number and instead returns `<data1>`. If `<data1>` contains keyword
+`swsbounce` then the next response is `<data2>` and so on. This is useful for
+auth tests and similar.
+
+`sendzero=yes` means that the (FTP) server "sends" the data even if the size
+is zero bytes. Used to verify curl's behavior on zero bytes transfers.
+
+`nonewline=yes` means that the last byte (the trailing newline character)
+should be cut off from the data before sending or comparing it.
+
+`crlf=yes` forces the newlines to become CRLF even if not written so in the
+test.
+
+`crlf=headers` forces *header* newlines to become CRLF even if not written so
+in the source file. Note that this makes runtests.pl parse and "guess" what is
+a header and what is not in order to apply the CRLF line endings appropriately.
+
+For FTP file listings, the `<data>` section is be used *only* if you make sure
+that there has been a CWD done first to a directory named `test-[NUM]` where
+`NUM` is the test case number. Otherwise the ftp server cannot know from which
+test file to load the list content.
+
+### `<dataNUM [crlf="yes|headers"]>`
+
+Send back this contents instead of the `<data>` one. The `NUM` is set by:
+
+- The test number in the request line is >10000 and this is the remainder of
+  [test case number]%10000.
+- The request was HTTP and included digest details, which adds 1000 to `NUM`
+- If an HTTP request is NTLM type-1, it adds 1001 to `NUM`
+- If an HTTP request is NTLM type-3, it adds 1002 to `NUM`
+- If an HTTP request is Basic and `NUM` is already >=1000, it adds 1 to `NUM`
+- If an HTTP request is Negotiate, `NUM` gets incremented by one for each
+  request with Negotiate authorization header on the same test case.
+
+Dynamically changing `NUM` in this way allows the test harness to be used to
+test authentication negotiation where several different requests must be sent
+to complete a transfer. The response to each request is found in its own data
+section. Validating the entire negotiation sequence can be done by specifying
+a `datacheck` section.
+
+### `<connect [crlf="yes|headers"]>`
+The connect section is used instead of the 'data' for all CONNECT
+requests. The remainder of the rules for the data section then apply but with
+a connect prefix.
+
+`crlf=yes` forces the newlines to become CRLF even if not written so in the
+test.
+
+`crlf=headers` forces *header* newlines to become CRLF even if not written so
+in the source file. Note that this makes runtests.pl parse and "guess" what is
+a header and what is not in order to apply the CRLF line endings appropriately.
+
+### `<socks>`
+Address type and address details as logged by the SOCKS proxy.
+
+### `<datacheck [mode="text"] [nonewline="yes"] [crlf="yes|headers"]>`
+if the data is sent but this is what should be checked afterwards. If
+`nonewline=yes` is set, runtests cuts off the trailing newline from the data
+before comparing with the one actually received by the client.
+
+Use the `mode="text"` attribute if the output is in text mode on platforms
+that have a text/binary difference.
+
+### `<datacheckNUM [nonewline="yes"] [mode="text"] [crlf="yes|headers"]>`
+The contents of numbered `datacheck` sections are appended to the non-numbered
+one.
+
+### `<size>`
+number to return on an ftp SIZE command (set to -1 to make this command fail)
+
+### `<mdtm>`
+what to send back if the client sends a (FTP) `MDTM` command, set to -1 to
+have it return that the file does not exist
+
+### `<postcmd>`
+special purpose server-command to control its behavior *after* the
+reply is sent
+For HTTP/HTTPS, these are supported:
+
+`wait [secs]` - Pause for the given time
+
+### `<servercmd>`
+Special-commands for the server.
+
+The first line of this file is always set to `Testnum [number]` by the test
+script, to allow servers to read that to know what test the client is about to
+issue.
+
+#### For FTP/SMTP/POP/IMAP
+
+- `REPLY [command] [return value] [response string]` - Changes how the server
+  responds to the [command]. [response string] is evaluated as a perl string,
+  so it can contain embedded \r\n, for example. There is a special [command]
+  named "welcome" (without quotes) which is the string sent immediately on
+  connect as a welcome.
+- `REPLYLF` (like above but sends the response terminated with LF-only and not
+   CRLF)
+- `COUNT [command] [num]` - Do the `REPLY` change for `[command]` only `[num]`
+  times and then go back to the built-in approach
+- `DELAY [command] [secs]` - Delay responding to this command for the given
+  time
+- `RETRWEIRDO` - Enable the "weirdo" RETR case when multiple response lines
+   appear at once when a file is transferred
+- `RETRNOSIZE` - Make sure the RETR response does not contain the size of the
+  file
+- `RETRSIZE [size]` - Force RETR response to contain the specified size
+- `NOSAVE` - Do not actually save what is received
+- `SLOWDOWN` - Send FTP responses with 0.01 sec delay between each byte
+- `SLOWDOWNDATA` - Send FTP responses with 0.01 sec delay between each data
+  byte
+- `PASVBADIP` - makes PASV send back an illegal IP in its 227 response
+- `CAPA [capabilities]` - Enables support for and specifies a list of space
+   separated capabilities to return to the client for the IMAP `CAPABILITY`,
+   POP3 `CAPA` and SMTP `EHLO` commands
+- `AUTH [mechanisms]` - Enables support for SASL authentication and specifies
+   a list of space separated mechanisms for IMAP, POP3 and SMTP
+- `STOR [msg]` respond with this instead of default after `STOR`
+
+#### For HTTP/HTTPS
+
+- `auth_required` if this is set and a POST/PUT is made without auth, the
+  server does NOT wait for the full request body to get sent
+- `delay: [msecs]` - delay this amount after connection
+- `idle` - do nothing after receiving the request, "sit idle"
+- `stream` - continuously send data to the client, never-ending
+- `writedelay: [msecs]` delay this amount between reply packets
+- `skip: [num]` - instructs the server to ignore reading this many bytes from
+  a PUT or POST request
+- `rtp: part [num] channel [num] size [num]` - stream a fake RTP packet for
+  the given part on a chosen channel with the given payload size
+- `connection-monitor` - When used, this logs `[DISCONNECT]` to the
+  `server.input` log when the connection is disconnected.
+- `upgrade` - when an HTTP upgrade header is found, the server upgrades to
+  http2
+- `swsclose` - instruct server to close connection after response
+- `no-expect` - do not read the request body if Expect: is present
+
+#### For TFTP
+`writedelay: [secs]` delay this amount between reply packets (each packet
+  being 512 bytes payload)
+
+### `<dns>`
+
+Commands for the test DNS server.
+
+- `A: [dotted ipv4 address]` - set IPv4 address to return
+- `AAAA: [numerical IPv6 address]` - set IPv6 address to return, with or
+  without `[]`
+
+## `<client>`
+
+### `<server>`
+What server(s) this test case requires/uses. Available servers:
+
+- `dict`
+- `file`
+- `ftp`
+- `ftp-ipv6`
+- `ftps`
+- `gopher`
+- `gopher-ipv6`
+- `gophers`
+- `http`
+- `http/2`
+- `http-ipv6`
+- `http-proxy`
+- `https`
+- `https-proxy`
+- `https-mtls`
+- `httptls+srp`
+- `httptls+srp-ipv6`
+- `http-unix`
+- `imap`
+- `mqtt`
+- `pop3`
+- `rtsp`
+- `rtsp-ipv6`
+- `scp`
+- `sftp`
+- `smb`
+- `smtp`
+- `socks4`
+- `socks5`
+- `socks5unix`
+- `telnet`
+- `tftp`
+
+Give only one per line. If a test does not require any servers, the `<server>`
+subsection should be omitted.
+
+Servers that require a special server certificate can
+have the PEM certificate filename (found in the `certs` directory) appended to
+the server name separated by a space.
+
+### `<features>`
+A list of features that MUST be present in the client/library for this test to
+be able to run. If a required feature is not present then the test is SKIPPED.
+
+Alternatively a feature can be prefixed with an exclamation mark to indicate a
+feature is NOT required. If the feature is present then the test is SKIPPED.
+
+Features testable here are:
+
+- `--libcurl`
+- `alt-svc`
+- `aws` - built with **aws-sigv4** support
+- `AppleIDN`
+- `asyn-rr` - c-ares is used for additional records only
+- `brotli`
+- `c-ares` - c-ares is used for (all) name resolves
+- `CharConv`
+- `codeset-utf8` - if the running codeset is UTF-8 capable.
+- `cookies`
+- `crypto`
+- `cygwin`
+- `Debug`
+- `digest`
+- `DoH`
+- `getrlimit`
+- `GnuTLS`
+- `GSS-API`
+- `h2c`
+- `headers-api`
+- `HSTS`
+- `HTTP-auth`
+- `http/2`
+- `http/3`
+- `HTTPS-proxy`
+- `HTTPSRR`
+- `IDN`
+- `IPv6`
+- `Kerberos`
+- `Largefile`
+- `large-time` - time_t is larger than 32-bit
+- `large-size` - size_t is larger than 32-bit
+- `libssh2`
+- `libssh`
+- `badlibssh` - libssh configuration incompatible with the test suite
+- `libz`
+- `local-http` - the HTTP server runs on 127.0.0.1
+- `manual`
+- `mbedtls`
+- `Mime`
+- `netrc`
+- `nghttpx`
+- `nghttpx-h3`
+- `NTLM`
+- `NTLM_WB`
+- `OpenSSL`
+- `override-dns` - this build can use a "fake" DNS server
+- `parsedate`
+- `proxy`
+- `PSL`
+- `rustls`
+- `Schannel`
+- `shuffle-dns`
+- `socks`
+- `SPNEGO`
+- `SSL`
+- `SSLpinning`
+- `SSPI`
+- `threaded-resolver`
+- `TLS-SRP`
+- `torture` - if runtests is running in memory test mode
+- `TrackMemory`
+- `typecheck`
+- `threadsafe`
+- `Unicode`
+- `unittest`
+- `UnixSockets`
+- `verbose-strings`
+- `wakeup`
+- `win32`
+- `WinIDN`
+- `wolfssl`
+- `xattr`
+- `zstd`
+
+as well as each protocol that curl supports. A protocol only needs to be
+specified if it is different from the server (useful when the server is
+`none`).
+
+### `<killserver>`
+Using the same syntax as in `<server>` but when mentioned here these servers
+are explicitly KILLED when this test case is completed. Only use this if there
+is no other alternatives. Using this of course requires subsequent tests to
+restart servers.
+
+### `<precheck>`
+A command line that if set gets run by the test script before the test. If an
+output is displayed by the command or if the return code is non-zero, the test
+is skipped and the (single-line) output is displayed as reason for not running
+the test.
+
+### `<tool>`
+Name of tool to invoke instead of "curl". This tool must be built and exist
+either in the `libtest/` directory (if the tool name starts with `lib`) or in
+the `unit/` directory (if the tool name starts with `unit`).
+
+### `<name>`
+Brief test case description, shown when the test runs.
+
+### `<setenv>`
+
+    variable1=contents1
+    variable2=contents2
+    variable3
+
+Set the given environment variables to the specified value before the actual
+command is run. They are restored back to their former values again after the
+command has been run.
+
+If the variable name has no assignment, no `=`, then that variable is deleted.
+
+### `<command [option="no-q/no-output/no-include/no-memdebug/force-output/binary-trace"] [timeout="secs"][delay="secs"][type="perl/shell"]>`
+Command line to run.
+
+If the command spans multiple lines, they are concatenated with a space added
+between them.
+
+Set `type="perl"` to write the test case as a perl script. It implies that
+there is no memory debugging and valgrind gets shut off for this test.
+
+Set `type="shell"` to write the test case as a shell script. It implies that
+there is no memory debugging and valgrind gets shut off for this test.
+
+Set `option="no-output"` to prevent the test script to slap on the `--output`
+argument that directs the output to a file. The `--output` is also not added
+if the verify/stdout section is used.
+
+Set `option="force-output"` to make use of `--output` even when the test is
+otherwise written to verify stdout.
+
+Set `option="no-include"` to prevent the test script to slap on the
+`--include` argument.
+
+Set `option="no-memdebug"` to make the test run without the memdebug tracking
+system. For tests that are incompatible - multi-threaded for example.
+
+Set `option="no-q"` avoid using `-q` as the first argument in the curl command
+line.
+
+Set `option="binary-trace"` to use `--trace` instead of `--trace-ascii` for
+tracing. Suitable for binary-oriented protocols such as MQTT.
+
+Set `timeout="secs"` to override default server logs advisor read lock
+timeout. This timeout is used by the test harness, once that the command has
+completed execution, to wait for the test server to write out server side log
+files and remove the lock that advised not to read them. The "secs" parameter
+is the not negative integer number of seconds for the timeout. This `timeout`
+attribute is documented for completeness sake, but is deep test harness stuff
+and only needed for singular and specific test cases. Avoid using it.
+
+Set `delay="secs"` to introduce a time delay once that the command has
+completed execution and before the `<postcheck>` section runs. The "secs"
+parameter is the not negative integer number of seconds for the delay. This
+'delay' attribute is intended for specific test cases, and normally not
+needed.
+
+### `<file name="%LOGDIR/filename" [options]>`
+This creates the named file with this content before the test case is run,
+which is useful if the test case needs a file to act on.
+
+If `nonewline="yes"` is used, the created file gets the final newline stripped
+off.
+
+`crlf=yes` forces the newlines to become CRLF even if not written so in the
+test.
+
+`mode="text"` normalizes the line endings to make them compare as text on all
+platforms.
+
+### `<file1>`
+1 to 4 can be appended to 'file' to create more files.
+
+### `<file2>`
+
+### `<file3>`
+
+### `<file4>`
+
+### `<stdin [nonewline="yes"][crlf="yes"]>`
+Pass this given data on stdin to the tool.
+
+If `nonewline` is set, we cut off the trailing newline of this given data
+before comparing with the one actually received by the client
+
+`crlf=yes` forces the newlines to become CRLF even if not written so in the
+test.
+
+## `<disable>`
+
+If `test-duphandle` is a listed item here, this is not run when
+`--test-duphandle` is used.
+
+## `<verify>`
+### `<errorcode>`
+numerical error code curl is supposed to return. Specify a list of accepted
+error codes by separating multiple numbers with comma. See test 237 for an
+example.
+
+### `<strip>`
+One regex per line that is removed from the protocol dumps before the
+comparison is made. This is useful to remove dependencies on dynamically
+changing protocol data such as port numbers or user-agent strings.
+
+### `<strippart>`
+One perl op per line that operates on the protocol dump. This is pretty
+advanced. Example: `s/^EPRT .*/EPRT stripped/`.
+
+### `<postcheck>`
+A command line that if set gets run by the test script after the test. If the
+command exists with a non-zero status code, the test is considered failed.
+
+### `<notexists>`
+A list of directory entries that are checked for after the test has completed
+and that must not exist. A listed entry existing causes the test to fail.
+
+### `<protocol [nonewline="yes"][crlf="yes|headers"]>`
+
+the protocol dump curl should transmit, if `nonewline` is set, we cut off the
+trailing newline of this given data before comparing with the one actually
+sent by the client The `<strip>` and `<strippart>` rules are applied before
+comparisons are made.
+
+`crlf=yes` forces the newlines to become CRLF even if not written so in the
+test.
+
+`crlf=headers` forces *header* newlines to become CRLF even if not written so
+in the source file. Note that this makes runtests.pl parse and "guess" what is
+a header and what is not in order to apply the CRLF line endings appropriately.
+
+### `<proxy [nonewline="yes"][crlf="yes|headers"]>`
+
+The protocol dump curl should transmit to an HTTP proxy (when the http-proxy
+server is used), if `nonewline` is set, we cut off the trailing newline of
+this given data before comparing with the one actually sent by the client The
+`<strip>` and `<strippart>` rules are applied before comparisons are made.
+
+### `<stderr [mode="text/warn"] [nonewline="yes"] [crlf="yes|headers"]>`
+This verifies that this data was passed to stderr.
+
+Use the mode="text" attribute if the output is in text mode on platforms that
+have a text/binary difference.
+
+Use the mode="warn" attribute for curl warning output, as it then makes the
+check without newlines and the prefix to better handle that the lines may wrap
+at different points depending on the lengths of the lines and terminal width.
+
+`crlf=yes` forces the newlines to become CRLF even if not written so in the
+test.
+
+`crlf=headers` forces *header* newlines to become CRLF even if not written so
+in the source file. Note that this makes runtests.pl parse and "guess" what is
+a header and what is not in order to apply the CRLF line endings appropriately.
+
+If `nonewline` is set, we cut off the trailing newline of this given data
+before comparing with the one actually received by the client
+
+### `<stdout [mode="text"] [nonewline="yes"] [crlf="yes|headers"] [loadfile="filename"]>`
+This verifies that this data was passed to stdout.
+
+Use the mode="text" attribute if the output is in text mode on platforms that
+have a text/binary difference.
+
+If `nonewline` is set, we cut off the trailing newline of this given data
+before comparing with the one actually received by the client
+
+`crlf=yes` forces the newlines to become CRLF even if not written so in the
+test.
+
+`crlf=headers` forces *header* newlines to become CRLF even if not written so
+in the source file. Note that this makes runtests.pl parse and "guess" what is
+a header and what is not in order to apply the CRLF line endings appropriately.
+
+`loadfile="filename"` makes loading the data from an external file.
+
+To verify that there was nothing sent to stdout, put `%EMPTY` as the only
+content.
+
+### `<limit>`
+
+When this test runs and curl was built with debug enabled, runtests make sure
+that the set limits are not exceeded. Supported limits:
+
+    Allocations: [number of allocation calls]
+    Maximum allocated: [maximum concurrent memory allocated]
+
+### `<file name="%LOGDIR/filename" [mode="text"] [crlf="yes|headers"]>`
+The file's contents must be identical to this after the test is complete. Use
+the mode="text" attribute if the output is in text mode on platforms that have
+a text/binary difference.
+
+`crlf=yes` forces the newlines to become CRLF even if not written so in the
+test.
+
+`crlf=headers` forces *header* newlines to become CRLF even if not written so
+in the source file. Note that this makes runtests.pl parse and "guess" what is
+a header and what is not in order to apply the CRLF line endings appropriately.
+
+### `<file1>`
+1 to 4 can be appended to 'file' to compare more files.
+
+### `<file2>`
+
+### `<file3>`
+
+### `<file4>`
+
+### `<stripfile>`
+One perl op per line that operates on the output file or stdout before being
+compared with what is stored in the test file. This is pretty
+advanced. Example: "s/^EPRT .*/EPRT stripped/"
+
+### `<stripfile1>`
+1 to 4 can be appended to `stripfile` to strip the corresponding `<fileN>`
+content
+
+### `<stripfile2>`
+
+### `<stripfile3>`
+
+### `<stripfile4>`
+
+### `<upload [crlf="yes"] [nonewline="yes"]>`
+the contents of the upload data curl should have sent
+
+`crlf=yes` forces *upload* newlines to become CRLF even if not written so in
+the source file.
+
+`nonewline=yes` means that the last byte (the trailing newline character)
+should be cut off from the upload data before comparing it.
+
+### `<valgrind>`
+disable - disables the valgrind log check for this test
+
+### `<dns [host="name"]>`
+
+This specify the input the DNS server is expected to get from curl. Because of
+differences in implementations, this section is sorted automatically before
+compared.
+
+Because of local configurations in machines running tests, there may be
+additional requests sent to `[host].[custom suffix]`. To prevent such requests
+to mess up comparisons, we can set the hostname to check in the `<dns>` tag.
diff --git a/third-party/curl/docs/tests/HTTP.md b/third-party/curl/docs/tests/HTTP.md
new file mode 100644
index 0000000000..79f3fac200
--- /dev/null
+++ b/third-party/curl/docs/tests/HTTP.md
@@ -0,0 +1,206 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# The curl HTTP Test Suite
+
+This is an additional test suite using a combination of Apache httpd and
+nghttpx servers to perform various tests beyond the capabilities of the
+standard curl test suite.
+
+# Usage
+
+The test cases and necessary files are in `tests/http`. You can invoke
+`pytest` from there or from the top level curl checkout and it finds all
+tests.
+
+```sh
+curl> pytest tests/http
+platform darwin -- Python 3.9.15, pytest-6.2.0, py-1.10.0, pluggy-0.13.1
+rootdir: /Users/sei/projects/curl
+collected 5 items
+
+tests/http/test_01_basic.py .....
+```
+
+Pytest takes arguments. `-v` increases its verbosity and can be used several
+times. `-k <expr>` can be used to run only matching test cases. The `expr` can
+be something resembling a python test or a string that needs to match test
+cases in their names.
+
+```sh
+curl/tests/http> pytest -vv -k test_01_02
+```
+
+runs all test cases that have `test_01_02` in their name. This does not have
+to be the start of the name.
+
+Depending on your setup, some test cases may be skipped and appear as `s` in
+the output. If you run pytest verbose, it also gives you the reason for
+skipping.
+
+# Prerequisites
+
+You need:
+
+1. a recent Python, `pytest` and the other modules listed in
+   `tests/http/requirements.txt`
+2. Apache httpd and its development files. On Debian/Ubuntu, the packages
+   `apache2-bin` and `apache2-dev` have these.
+3. the Apache `mod_ssl`, `mod_http2` and `mod_proxy` modules. On Debian/Ubuntu, these
+   modules are part of the `apache2-bin` package, but other distributions may
+   package them separately.
+4. a local `curl` project build
+5. optionally, `nghttpx` with HTTP/3 enabled or h3 test cases are skipped
+
+### Configuration
+
+Via curl's `configure` script you may specify:
+
+  * `--with-test-nghttpx=<path-of-nghttpx>` if you have nghttpx to use
+   somewhere outside your `$PATH`.
+
+  * `--with-test-h2o=<path-of-h2o>` if you have h2o to use somewhere
+   outside your `$PATH`.
+
+  * `--with-test-httpd=<httpd-install-path>` if you have an Apache httpd
+   installed somewhere else. On Debian/Ubuntu it otherwise looks into
+   `/usr/bin` and `/usr/sbin` to find those.
+
+  * `--with-test-caddy=<caddy-install-path>` if you have a Caddy web server
+   installed somewhere else.
+
+  * `--with-test-vsftpd=<vsftpd-install-path>` if you have a vsftpd ftp
+   server installed somewhere else.
+
+  * `--with-test-danted=<danted-path>` if you have `dante-server` installed
+
+## Usage Tips
+
+Several test cases are parameterized, for example with the HTTP version to
+use. If you want to run a test with a particular protocol only, use a command
+line like:
+
+```sh
+curl/tests/http> pytest -k "test_02_06 and h2"
+```
+
+Test cases can be repeated, with the `pytest-repeat` module (`pip install
+pytest-repeat`). Like in:
+
+```sh
+curl/tests/http> pytest -k "test_02_06 and h2" --count=100
+```
+
+which then runs this test case a hundred times. In case of flaky tests, you
+can make pytest stop on the first one with:
+
+```sh
+curl/tests/http> pytest -k "test_02_06 and h2" --count=100 --maxfail=1
+```
+
+which allow you to inspect output and log files for the failed run. Speaking
+of log files, the verbosity of pytest is also used to collect curl trace
+output. If you specify `-v` three times, the `curl` command is started with
+`--trace`:
+
+```sh
+curl/tests/http> pytest -vvv -k "test_02_06 and h2" --count=100 --maxfail=1
+```
+
+all of curl's output and trace file are found in `tests/http/gen/curl`.
+
+## Writing Tests
+
+There is a lot of [`pytest` documentation](https://docs.pytest.org/) with
+examples. No use in repeating that here. Assuming you are somewhat familiar
+with it, it is useful how *this* general test suite is setup. Especially if
+you want to add test cases.
+
+### Servers
+
+In `conftest.py` 3 "fixtures" are defined that are used by all test cases:
+
+1. `env`: the test environment. It is an instance of class
+   `testenv/env.py:Env`. It holds all information about paths, availability of
+   features (HTTP/3), port numbers to use, domains and SSL certificates for
+   those.
+2. `httpd`: the Apache httpd instance, configured and started, then stopped at
+   the end of the test suite. It has sites configured for the domains from
+   `env`. It also loads a local module `mod_curltest?` and makes it available
+   in certain locations. (more on mod_curltest below).
+3. `nghttpx`: an instance of nghttpx that provides HTTP/3 support. `nghttpx`
+   proxies those requests to the `httpd` server. In a direct mapping, so you
+   may access all the resources under the same path as with HTTP/2. Only the
+   port number used for HTTP/3 requests are different.
+
+`pytest` manages these fixture so that they are created once and terminated
+before exit. This means you can `Ctrl-C` a running pytest and the server then
+shutdowns. Only when you brutally chop its head off, might there be servers
+left behind.
+
+### Test Cases
+
+Tests making use of these fixtures have them in their parameter list. This
+tells pytest that a particular test needs them, so it has to create them.
+Since one can invoke pytest for a single test, it is important that a test
+references the ones it needs.
+
+All test cases start with `test_` in their name. We use a double number scheme
+to group them. This makes it ease to run only specific tests and also give a
+short mnemonic to communicate trouble with others in the project. Otherwise
+you are free to name test cases as you think fitting.
+
+Tests are grouped thematically in a file with a single Python test class. This
+is convenient if you need a special "fixture" for several tests. "fixtures"
+can have "class" scope.
+
+There is a curl helper class that knows how to invoke curl and interpret its
+output. Among other things, it does add the local CA to the command line, so
+that SSL connections to the test servers are verified. Nothing prevents anyone
+from running curl directly, for specific uses not covered by the `CurlClient`
+class.
+
+### mod_curltest
+
+The module source code is found in `testenv/mod_curltest`. It is compiled
+using the `apxs` command, commonly provided via the `apache2-dev` package.
+Compilation is quick and done once at the start of a test run.
+
+The module adds 2 "handlers" to the Apache server (right now). Handler are
+pieces of code that receive HTTP requests and generate the response. Those
+handlers are:
+
+* `curltest-echo`: hooked up on the path `/curltest/echo`. This one echoes
+  a request and copies all data from the request body to the response body.
+  Useful for simulating upload and checking that the data arrived as intended.
+
+* `curltest-tweak`: hooked up on the path `/curltest/tweak`. This handler is
+  more of a Swiss army knife. It interprets parameters from the URL query
+  string to drive its behavior.
+
+  * `status=nnn`: generate a response with HTTP status code `nnn`.
+  * `chunks=n`: generate `n` chunks of data in the response body, defaults to 3.
+  * `chunk_size=nnn`: each chunk should contain `nnn` bytes of data. Maximum is 16KB right now.
+  * `chunkd_delay=duration`: wait `duration` time between writing chunks
+  * `delay=duration`: wait `duration` time to send the response headers
+  * `body_error=(timeout|reset)`: produce an error after the first chunk in the response body
+  * `id=str`: add `str` in the response header `request-id`
+
+`duration` values are integers, optionally followed by a unit. Units are:
+
+  * `d`: days (probably not useful here)
+  * `h`: hours
+  * `mi`: minutes
+  * `s`: seconds (the default)
+  * `ms`: milliseconds
+
+As you can see, `mod_curltest`'s tweak handler allows Apache to simulate many
+kinds of responses. An example of its use is `test_03_01` where responses are
+delayed using `chunk_delay`. This gives the response a defined duration and the
+test uses that to reload `httpd` in the middle of the first request. A graceful
+reload in httpd lets ongoing requests finish, but closes the connection
+afterwards and tears down the serving process. The following request then needs
+to open a new connection. This is verified by the test case.
diff --git a/third-party/curl/docs/tests/TEST-SUITE.md b/third-party/curl/docs/tests/TEST-SUITE.md
new file mode 100644
index 0000000000..6856eb5f8a
--- /dev/null
+++ b/third-party/curl/docs/tests/TEST-SUITE.md
@@ -0,0 +1,323 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# The curl Test Suite
+
+# Running
+
+See the "Requires to run" section for prerequisites.
+
+In the root of the curl repository:
+
+    ./configure && make && make test
+
+To run a specific set of tests (e.g. 303 and 410):
+
+    make test TFLAGS="303 410"
+
+To run the tests faster, pass the -j (parallelism) flag:
+
+    make test TFLAGS="-j10"
+
+`make test` builds the test suite support code and invokes the `runtests.pl`
+perl script to run all the tests. The value of `TFLAGS` is passed directly
+to `runtests.pl`.
+
+When you run tests via make, the flags `-a` and `-s` are passed, meaning to
+continue running tests even after one fails, and to emit short output.
+
+If you would like to not use those flags, you can run `runtests.pl`
+directly. You must `chdir` into the tests directory, then you can run it
+like so:
+
+    ./runtests.pl 303 410
+
+You must have run `make test` at least once first to build the support code.
+
+To see what flags are available for `runtests.pl`, and what output it emits,
+see `docs/runtests.md`.
+
+After a test fails, examine the tests/log directory for stdout, stderr, and
+output from the servers used in the test.
+
+## Requires to run
+
+- `perl` (and a Unix-style shell)
+- `python` (and a Unix-style shell, for SMB and TELNET tests)
+- `python-impacket` (for SMB tests)
+- `diff` (when a test fails, a diff is shown)
+- `stunnel` (for HTTPS and FTPS tests)
+- `openssl` (the command line tool, for generating test server certificates)
+- `openssh` or `SunSSH` (for SCP and SFTP tests)
+- `nghttpx` (for HTTP/2 and HTTP/3 tests)
+
+### Installation of impacket
+
+The Python-based test servers support Python 3.
+
+Please install python-impacket in the correct Python environment. You can
+use pip or your OS' package manager to install 'impacket'.
+
+On Debian/Ubuntu the package name is 'python3-impacket'
+
+On FreeBSD the package name is 'py311-impacket'
+
+On any system where pip is available: 'python3 -m pip install impacket'
+
+You may also need to manually install the Python package 'six' as that may
+be a missing requirement for impacket.
+
+## Event-based
+
+If curl is built with `Debug` enabled (see below), then the `runtests.pl`
+script offers a `-e` option (or `--test-event`) that makes it perform
+*event-based*. Such tests invokes the curl tool with `--test-event`, a
+debug-only option made for this purpose.
+
+Performing event-based means that the curl tool uses the
+`curl_multi_socket_action()` API call to drive the transfer(s), instead of
+the otherwise "normal" functions it would use. This allows us to test drive
+the socket_action API. Transfers done this way should work exactly the same
+as with the non-event based API.
+
+To be able to use `--test-event` together with `--parallel`, curl requires
+*libuv* to be present and enabled in the build: `configure --enable-libuv`
+
+## Duplicated handles
+
+If curl is built with `Debug` enabled (see below), then the `runtests.pl`
+script offers a `--test-duphandle` option. When enabled, curl always
+duplicates the easy handle and does its transfers using the new one instead
+of the original. This is done entirely for testing purpose to verify that
+everything works exactly the same when this is done; confirming that the
+`curl_easy_duphandle()` function duplicates everything that it should.
+
+### Port numbers used by test servers
+
+All test servers run on "random" port numbers. All tests must be written to
+use the suitable variables instead of fixed port numbers so that test cases
+continue to work independently of what port numbers the test servers
+actually use.
+
+See [`FILEFORMAT`](FILEFORMAT.md) for the port number variables.
+
+### Test servers
+
+The test suite runs stand-alone servers on random ports to which it makes
+requests. For SSL tests, it runs stunnel to handle encryption to the regular
+servers. For SSH, it runs a standard OpenSSH server.
+
+The listen port numbers for the test servers are picked randomly to allow
+users to run multiple test cases concurrently and to not collide with other
+existing services that might listen to ports on the machine.
+
+The HTTP server supports listening on a Unix domain socket, the default
+location is 'http.sock'.
+
+For HTTP/2 and HTTP/3 testing an installed `nghttpx` is used. HTTP/3 tests
+check if nghttpx supports the protocol. To override the nghttpx used, set
+the environment variable `NGHTTPX`. The default can also be changed by
+specifying `--with-test-nghttpx=<path>` as argument to `configure`.
+
+### DNS server
+
+There is a test DNS server to allow tests to resolve hostnames to verify
+those code paths. This server is started like all the other servers within
+the `<servers>` section.
+
+To make a curl build actually use the test DNS server requires a debug
+build. When such a test runs, the environment variable `CURL_DNS_SERVER` is
+set to identify the IP address and port number of the DNS server to use.
+
+- curl built to use c-ares for resolving automatically asks that server for
+  host information
+
+- curl built to use `getaddrinfo()` for resolving *and* is built with c-ares
+  1.26.0 or later, gets a special workaround. In such builds, when the
+  environment variable is set, curl instead invokes a getaddrinfo wrapper
+  that emulates the function and acknowledges the DNS server environment
+  variable. This way, the getaddrinfo-using code paths in curl are verified,
+  and yet the custom responses from the test DNS server are used.
+
+curl that is built to support a custom DNS server in a test gets the
+`override-dns` feature set.
+
+When curl ask for HTTPS-RR, c-ares is always used and in debug builds such
+asks respects the dns server environment variable as well.
+
+The test DNS server only has a few limited responses. When asked for
+
+- type `A` response, it returns the address `127.0.0.1` three times
+- type `AAAA` response, it returns the address `::1` three times
+- other types, it returns a blank response without answers
+
+### Shell startup scripts
+
+Tests which use the ssh test server, SCP/SFTP tests, might be badly
+influenced by the output of system wide or user specific shell startup
+scripts, .bashrc, .profile, /etc/csh.cshrc, .login, /etc/bashrc, etc. which
+output text messages or escape sequences on user login. When these shell
+startup messages or escape sequences are output they might corrupt the
+expected stream of data which flows to the sftp-server or from the ssh
+client which can result in bad test behavior or even prevent the test server
+from running.
+
+If the test suite ssh or sftp server fails to start up and logs the message
+'Received message too long' then you are certainly suffering the unwanted
+output of a shell startup script. Locate, cleanup or adjust the shell
+script.
+
+### Memory test
+
+The test script checks that all allocated memory is freed properly IF curl
+has been built with the `DEBUGBUILD` define set. The script automatically
+detects if that is the case, and it uses the `memanalyze.pl` script to
+analyze the memory debugging output.
+
+Also, if you run tests on a machine where valgrind is found, the script uses
+valgrind to run the test with (unless you use `-n`) to further verify
+correctness.
+
+The `runtests.pl` `-t` option enables torture testing mode. It runs each
+test many times and makes each different memory allocation fail on each
+successive run. This tests the out of memory error handling code to ensure
+that memory leaks do not occur even in those situations. It can help to
+compile curl with `CPPFLAGS=-DMEMDEBUG_LOG_SYNC` when using this option, to
+ensure that the memory log file is properly written even if curl crashes.
+
+If a specific test takes a long time to run in memory test mode, you can
+disable it individually by adding `!torture` to its `<features>` section.
+
+### Debug
+
+If a test case fails, you can conveniently get the script to invoke the
+debugger (gdb) for you with the server running and the same command line
+parameters that failed. Invoke `runtests.pl <test number> -g` and then
+type 'run' in the debugger to perform the command through the debugger.
+
+### Logs
+
+All logs are generated in the log/ subdirectory (it is emptied first in the
+runtests.pl script). They remain in there after a test run.
+
+### Log Verbosity
+
+A curl build with `--enable-debug` offers more verbose output in the logs.
+This applies not only for test cases, but also when running it standalone
+with `curl -v`. While a curl debug built is
+***not suitable for production***, it is often helpful in tracking down
+problems.
+
+Sometimes, one needs detailed logging of operations, but does not want
+to drown in output. The newly introduced *connection filters* allows one to
+dynamically increase log verbosity for a particular *filter type*. Example:
+
+    CURL_DEBUG=ssl curl -v https://curl.se/
+
+makes the `ssl` connection filter log more details. One may do that for
+every filter type and also use a combination of names, separated by `,` or
+space.
+
+    CURL_DEBUG=ssl,http/2 curl -v https://curl.se/
+
+The order of filter type names is not relevant. Names used here are
+case insensitive. Note that these names are implementation internals and
+subject to change.
+
+Some, likely stable names are `tcp`, `ssl`, `http/2`. For a current list,
+one may search the sources for `struct Curl_cftype` definitions and find
+the names there. Also, some filters are only available with certain build
+options, of course.
+
+### Test input files
+
+All test cases are put in the `data/` subdirectory. Each test is stored in
+the file named according to the test number.
+
+See [`FILEFORMAT`](FILEFORMAT.md) for a description of the test case file
+format.
+
+### Code coverage
+
+gcc provides a tool that can determine the code coverage figures for the
+test suite. To use it, configure curl with `CFLAGS='-fprofile-arcs
+-ftest-coverage -g -O0'`. Make sure you run the normal and torture tests to
+get more full coverage, i.e. do:
+
+    make test
+    make test-torture
+
+The graphical tool `ggcov` can be used to browse the source and create
+coverage reports on \*nix hosts:
+
+    ggcov -r lib src
+
+The text mode tool `gcov` may also be used, but it does not handle object
+files in more than one directory correctly.
+
+### Remote testing
+
+The runtests.pl script provides some hooks to allow curl to be tested on a
+machine where perl can not be run. The test framework in this case runs on
+a workstation where perl is available, while curl itself is run on a remote
+system using ssh or some other remote execution method. See the comments at
+the beginning of runtests.pl for details.
+
+## Test case numbering
+
+Test cases used to be numbered by category ranges, but the ranges filled
+up. Subsets of tests can now be selected by passing keywords to the
+runtests.pl script via the make `TFLAGS` variable.
+
+New tests are added by finding a free number in `tests/data/Makefile.am`.
+
+## Write tests
+
+Here's a quick description on writing test cases. We have three kinds of
+tests: the ones that test the curl tool, the ones that build small
+applications and test libcurl directly and the unit tests that test individual
+(possibly internal) functions.
+
+### test data
+
+Each test has a master file that controls all the test data. What to read,
+what the protocol exchange should look like, what exit code to expect and
+what command line arguments to use etc.
+
+These files are `tests/data/test[num]` where `[num]` is a unique identifier
+described above, and the XML-like file format of them is described in the
+separate [`FILEFORMAT`](FILEFORMAT.md) document.
+
+### curl tests
+
+A test case that runs the curl tool and verifies that it gets the correct
+data, it sends the correct data, it uses the correct protocol primitives
+etc.
+
+### libcurl tests
+
+The libcurl tests are identical to the curl ones, except that they use a
+specific and dedicated custom-built program to run instead of "curl". This
+tool is built from source code placed in `tests/libtest` and if you want to
+make a new libcurl test that is where you add your code.
+
+### unit tests
+
+Unit tests are placed in `tests/unit`. There is a tests/unit/README
+describing the specific set of checks and macros that may be used when
+writing tests that verify behaviors of specific individual functions.
+
+The unit tests depend on curl being built with debug enabled.
+
+### test bundles
+
+Individual tests are bundled into single executables, one for libtests, one
+for unit tests and one for servers. The executables' first argument is
+the name of libtest, unit test or server respectively.
+In these executables, the build process automatically renames the entry point
+to a unique symbol. `test` becomes `test_<tool>`, e.g. `test_lib1598` or
+`test_unit1305`. For servers `main` becomes `main_sws` for the `sws` server,
+and so on. Other common symbols may also be suffixed the same way.
diff --git a/third-party/curl/docs/wcurl.md b/third-party/curl/docs/wcurl.md
new file mode 100644
index 0000000000..f0ed42baf2
--- /dev/null
+++ b/third-party/curl/docs/wcurl.md
@@ -0,0 +1,154 @@
+---
+c: Copyright (C) Samuel Henrique <samueloph@debian.org>, Sergio Durigan Junior <sergiodj@debian.org> and many contributors, see the AUTHORS file.
+SPDX-License-Identifier: curl
+Title: wcurl
+Section: 1
+Source: wcurl
+See-also:
+  - curl (1)
+  - trurl (1)
+Added-in: n/a
+---
+
+# NAME
+
+**wcurl** - a simple wrapper around curl to easily download files.
+
+# SYNOPSIS
+
+**wcurl \<URL\>...**
+
+**wcurl [--curl-options \<CURL_OPTIONS\>]... [--dry-run] [--no-decode-filename] [-o|-O|--output \<PATH\>] [--] \<URL\>...**
+
+**wcurl [--curl-options=\<CURL_OPTIONS\>]... [--dry-run] [--no-decode-filename] [--output=\<PATH\>] [--] \<URL\>...**
+
+**wcurl -V|--version**
+
+**wcurl -h|--help**
+
+# DESCRIPTION
+
+**wcurl** is a simple curl wrapper which lets you use curl to download files
+without having to remember any parameters.
+
+Call **wcurl** with a list of URLs you want to download and **wcurl**
+picks sane defaults.
+
+If you need anything more complex, you can provide any of curl's supported
+parameters via the **--curl-options** option. Beware that you likely should be
+using curl directly if your use case is not covered.
+
+By default, **wcurl** does:
+
+## * Percent-encode whitespace in URLs;
+
+## * Download multiple URLs in parallel
+    if the installed curl's version is \>= 7.66.0 (--parallel);
+
+## * Use a total number of 5 parallel connections to the same protocol + hostname + port number target
+    if the installed curl's version is \>= 8.16.0 (--parallel-max-host);
+
+## * Follow redirects;
+
+## * Automatically choose a filename as output;
+
+## * Avoid overwriting files
+    if the installed curl's version is \>= 7.83.0 (--no-clobber);
+
+## * Perform retries;
+
+## * Set the downloaded file timestamp
+    to the value provided by the server, if available;
+
+## * Default to https
+    if the URL does not contain any scheme;
+
+## * Disable curl's URL globbing parser
+    so {} and [] characters in URLs are not treated specially;
+
+## * Percent-decode the resulting filename;
+
+## * Use 'index.html' as the default filename
+    if there is none in the URL.
+
+# OPTIONS
+
+## --curl-options, --curl-options=\<CURL_OPTIONS\>...
+
+Specify extra options to be passed when invoking curl. May be specified more
+than once.
+
+## -o, -O, --output, --output=\<PATH\>
+
+Use the provided output path instead of getting it from the URL. If multiple
+URLs are provided, resulting files share the same name with a number appended to
+the end (curl \>= 7.83.0). If this option is provided multiple times, only the
+last value is considered.
+
+## --no-decode-filename
+
+Do not percent-decode the output filename, even if the percent-encoding in the
+URL was done by **wcurl**, e.g.: The URL contained whitespace.
+
+## --dry-run
+
+Do not actually execute curl, print what would be invoked.
+
+## -V, \--version
+
+Print version information.
+
+## -h, \--help
+
+Print help message.
+
+# CURL_OPTIONS
+
+Any option supported by curl can be set here. This is not used by **wcurl**; it
+is instead forwarded to the curl invocation.
+
+# URL
+
+URL to be downloaded. Anything that is not a parameter is considered
+an URL. Whitespace is percent-encoded and the URL is passed to curl, which
+then performs the parsing. May be specified more than once.
+
+# EXAMPLES
+
+Download a single file:
+
+**wcurl example.com/filename.txt**
+
+Download two files in parallel:
+
+**wcurl example.com/filename1.txt example.com/filename2.txt**
+
+Download a file passing the **--progress-bar** and **--http2** flags to curl:
+
+**wcurl --curl-options="--progress-bar --http2" example.com/filename.txt**
+
+Resume from an interrupted download. The options necessary to resume the download
+(`--clobber --continue-at -`) must be the **last** options specified in `--curl-options`.
+Note that the only way to resume interrupted downloads is to allow wcurl to overwrite
+the destination file:
+
+**wcurl --curl-options="--clobber --continue-at -" example.com/filename.txt**
+
+Download multiple files without a limit of concurrent connections per host (the default limit is 5):
+
+**wcurl --curl-options="--parallel-max-host 0" example.com/filename1.txt example.com/filename2.txt**
+
+# AUTHORS
+
+    Samuel Henrique \<samueloph@debian.org\>
+    Sergio Durigan Junior \<sergiodj@debian.org\>
+    and many contributors, see the AUTHORS file.
+
+# REPORTING BUGS
+
+If you experience any problems with **wcurl** that you do not experience with
+curl, submit an issue on GitHub: https://github.com/curl/wcurl
+
+# COPYRIGHT
+
+**wcurl** is licensed under the curl license
diff --git a/third-party/curl/include/README.md b/third-party/curl/include/README.md
index c96593263f..b155d8c13b 100644
--- a/third-party/curl/include/README.md
+++ b/third-party/curl/include/README.md
@@ -8,7 +8,7 @@ SPDX-License-Identifier: curl
 
 Public include files for libcurl, external users.
 
-They're all placed in the curl subdirectory here for better fit in any kind of
+They are all placed in the curl subdirectory here for better fit in any kind of
 environment. You must include files from here using...
 
     #include <curl/curl.h>
diff --git a/third-party/curl/include/curl/.gitignore b/third-party/curl/include/curl/.gitignore
deleted file mode 100644
index 2467938825..0000000000
--- a/third-party/curl/include/curl/.gitignore
+++ /dev/null
@@ -1,7 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-curlver.h.dist
-stamp-h2
-stamp-h3
diff --git a/third-party/curl/include/curl/Makefile.am b/third-party/curl/include/curl/Makefile.am
index a655aff1c8..f2810fd307 100644
--- a/third-party/curl/include/curl/Makefile.am
+++ b/third-party/curl/include/curl/Makefile.am
@@ -25,7 +25,7 @@ pkginclude_HEADERS = \
   curl.h curlver.h easy.h mprintf.h stdcheaders.h multi.h \
   typecheck-gcc.h system.h urlapi.h options.h header.h websockets.h
 
-pkgincludedir= $(includedir)/curl
+pkgincludedir = $(includedir)/curl
 
 CHECKSRC = $(CS_$(V))
 CS_0 = @echo "  RUN     " $@;
@@ -35,7 +35,9 @@ CS_ = $(CS_0)
 checksrc:
 	$(CHECKSRC)@PERL@ $(top_srcdir)/scripts/checksrc.pl -D$(top_srcdir)/include/curl $(pkginclude_HEADERS)
 
-if CURLDEBUG
+if NOT_CURL_CI
+if DEBUGBUILD
 # for debug builds, we scan the sources on all regular make invokes
 all-local: checksrc
 endif
+endif
diff --git a/third-party/curl/include/curl/curl.h b/third-party/curl/include/curl/curl.h
index 898cbda839..7e59e43c4d 100644
--- a/third-party/curl/include/curl/curl.h
+++ b/third-party/curl/include/curl/curl.h
@@ -30,55 +30,55 @@
  */
 
 #ifdef CURL_NO_OLDIES
-#define CURL_STRICTER
+#define CURL_STRICTER /* not used since 8.11.0 */
 #endif
 
 /* Compile-time deprecation macros. */
-#if defined(__GNUC__) &&                                                \
-  ((__GNUC__ > 12) || ((__GNUC__ == 12) && (__GNUC_MINOR__ >= 1 ))) &&  \
-  !defined(__INTEL_COMPILER) &&                                         \
+#if (defined(__GNUC__) &&                                              \
+  ((__GNUC__ > 12) || ((__GNUC__ == 12) && (__GNUC_MINOR__ >= 1))) ||  \
+  (defined(__clang__) && __clang_major__ >= 3) ||                      \
+  defined(__IAR_SYSTEMS_ICC__)) &&                                     \
+  !defined(__INTEL_COMPILER) &&                                        \
   !defined(CURL_DISABLE_DEPRECATION) && !defined(BUILDING_LIBCURL)
 #define CURL_DEPRECATED(version, message)                       \
   __attribute__((deprecated("since " # version ". " message)))
+#ifdef __IAR_SYSTEMS_ICC__
+#define CURL_IGNORE_DEPRECATION(statements) \
+      _Pragma("diag_suppress=Pe1444") \
+      statements \
+      _Pragma("diag_default=Pe1444")
+#else
 #define CURL_IGNORE_DEPRECATION(statements) \
       _Pragma("GCC diagnostic push") \
       _Pragma("GCC diagnostic ignored \"-Wdeprecated-declarations\"") \
       statements \
       _Pragma("GCC diagnostic pop")
+#endif
 #else
 #define CURL_DEPRECATED(version, message)
 #define CURL_IGNORE_DEPRECATION(statements)     statements
 #endif
 
-#include "curlver.h"         /* libcurl version defines   */
-#include "system.h"          /* determine things run-time */
-
-/*
- * Define CURL_WIN32 when build target is Win32 API
- */
-
-#if (defined(_WIN32) || defined(__WIN32__) || defined(WIN32)) &&        \
-  !defined(__SYMBIAN32__)
-#define CURL_WIN32
-#endif
+#include "curlver.h"         /* libcurl version defines */
+#include "system.h"          /* determine things runtime */
 
 #include <stdio.h>
 #include <limits.h>
 
-#if (defined(__FreeBSD__) && (__FreeBSD__ >= 2)) || defined(__MidnightBSD__)
+#if defined(__FreeBSD__) || defined(__MidnightBSD__)
 /* Needed for __FreeBSD_version or __MidnightBSD_version symbol definition */
-#include <osreldate.h>
+#include <sys/param.h>
 #endif
 
 /* The include stuff here below is mainly for time_t! */
 #include <sys/types.h>
 #include <time.h>
 
-#if defined(CURL_WIN32) && !defined(_WIN32_WCE) && !defined(__CYGWIN__)
+#if defined(_WIN32) && !defined(_WIN32_WCE) && !defined(__CYGWIN__)
 #if !(defined(_WINSOCKAPI_) || defined(_WINSOCK_H) || \
       defined(__LWIP_OPT_H__) || defined(LWIP_HDR_OPT_H))
-/* The check above prevents the winsock2 inclusion if winsock.h already was
-   included, since they can't co-exist without problems */
+/* The check above prevents the winsock2.h inclusion if winsock.h already was
+   included, since they cannot co-exist without problems */
 #include <winsock2.h>
 #include <ws2tcpip.h>
 #endif
@@ -88,7 +88,7 @@
    libc5-based Linux systems. Only include it on systems that are known to
    require it! */
 #if defined(_AIX) || defined(__NOVELL_LIBC__) || defined(__NetBSD__) || \
-    defined(__minix) || defined(__SYMBIAN32__) || defined(__INTEGRITY) || \
+    defined(__minix) || defined(__INTEGRITY) || \
     defined(ANDROID) || defined(__ANDROID__) || defined(__OpenBSD__) || \
     defined(__CYGWIN__) || defined(AMIGA) || defined(__NuttX__) || \
    (defined(__FreeBSD_version) && (__FreeBSD_version < 800000)) || \
@@ -97,41 +97,34 @@
 #include <sys/select.h>
 #endif
 
-#if !defined(CURL_WIN32) && !defined(_WIN32_WCE)
+#ifndef _WIN32
 #include <sys/socket.h>
-#endif
-
-#if !defined(CURL_WIN32)
 #include <sys/time.h>
 #endif
 
-/* Compatibility for non-Clang compilers */
-#ifndef __has_declspec_attribute
-#  define __has_declspec_attribute(x) 0
-#endif
-
-#ifdef  __cplusplus
+#ifdef __cplusplus
 extern "C" {
 #endif
 
-#if defined(BUILDING_LIBCURL) || defined(CURL_STRICTER)
-typedef struct Curl_easy CURL;
-typedef struct Curl_share CURLSH;
-#else
 typedef void CURL;
 typedef void CURLSH;
-#endif
 
 /*
  * libcurl external API function linkage decorations.
  */
 
+#ifdef __has_declspec_attribute
+#define CURL_HAS_DECLSPEC_ATTRIBUTE(x) __has_declspec_attribute(x)
+#else
+#define CURL_HAS_DECLSPEC_ATTRIBUTE(x) 0
+#endif
+
 #ifdef CURL_STATICLIB
 #  define CURL_EXTERN
-#elif defined(CURL_WIN32) || defined(__SYMBIAN32__) || \
-     (__has_declspec_attribute(dllexport) && \
-      __has_declspec_attribute(dllimport))
-#  if defined(BUILDING_LIBCURL)
+#elif defined(_WIN32) || \
+     (CURL_HAS_DECLSPEC_ATTRIBUTE(dllexport) && \
+      CURL_HAS_DECLSPEC_ATTRIBUTE(dllimport))
+#  ifdef BUILDING_LIBCURL
 #    define CURL_EXTERN  __declspec(dllexport)
 #  else
 #    define CURL_EXTERN  __declspec(dllimport)
@@ -144,12 +137,12 @@ typedef void CURLSH;
 
 #ifndef curl_socket_typedef
 /* socket typedef */
-#if defined(CURL_WIN32) && !defined(__LWIP_OPT_H__) && !defined(LWIP_HDR_OPT_H)
+#if defined(_WIN32) && !defined(__LWIP_OPT_H__) && !defined(LWIP_HDR_OPT_H)
 typedef SOCKET curl_socket_t;
 #define CURL_SOCKET_BAD INVALID_SOCKET
 #else
 typedef int curl_socket_t;
-#define CURL_SOCKET_BAD -1
+#define CURL_SOCKET_BAD (-1)
 #endif
 #define curl_socket_typedef
 #endif /* curl_socket_typedef */
@@ -159,17 +152,17 @@ typedef enum {
   CURLSSLBACKEND_NONE = 0,
   CURLSSLBACKEND_OPENSSL = 1,
   CURLSSLBACKEND_GNUTLS = 2,
-  CURLSSLBACKEND_NSS = 3,
+  CURLSSLBACKEND_NSS                    CURL_DEPRECATED(8.3.0, "") = 3,
   CURLSSLBACKEND_OBSOLETE4 = 4,  /* Was QSOSSL. */
   CURLSSLBACKEND_GSKIT                  CURL_DEPRECATED(8.3.0, "") = 5,
   CURLSSLBACKEND_POLARSSL               CURL_DEPRECATED(7.69.0, "") = 6,
   CURLSSLBACKEND_WOLFSSL = 7,
   CURLSSLBACKEND_SCHANNEL = 8,
-  CURLSSLBACKEND_SECURETRANSPORT = 9,
+  CURLSSLBACKEND_SECURETRANSPORT        CURL_DEPRECATED(8.15.0, "") = 9,
   CURLSSLBACKEND_AXTLS                  CURL_DEPRECATED(7.61.0, "") = 10,
   CURLSSLBACKEND_MBEDTLS = 11,
   CURLSSLBACKEND_MESALINK               CURL_DEPRECATED(7.82.0, "") = 12,
-  CURLSSLBACKEND_BEARSSL = 13,
+  CURLSSLBACKEND_BEARSSL                CURL_DEPRECATED(8.15.0, "") = 13,
   CURLSSLBACKEND_RUSTLS = 14
 } curl_sslbackend;
 
@@ -182,6 +175,16 @@ typedef enum {
 #define CURLSSLBACKEND_CYASSL CURLSSLBACKEND_WOLFSSL
 #define CURLSSLBACKEND_DARWINSSL CURLSSLBACKEND_SECURETRANSPORT
 
+/* bits for the CURLOPT_FOLLOWLOCATION option */
+#define CURLFOLLOW_ALL       1L /* generic follow redirects */
+
+/* Do not use the custom method in the follow-up request if the HTTP code
+   instructs so (301, 302, 303). */
+#define CURLFOLLOW_OBEYCODE  2L
+
+/* Only use the custom method in the first request, always reset in the next */
+#define CURLFOLLOW_FIRSTONLY 3L
+
 struct curl_httppost {
   struct curl_httppost *next;       /* next entry in the list */
   char *name;                       /* pointer to allocated name */
@@ -198,27 +201,27 @@ struct curl_httppost {
                                        files */
   long flags;                       /* as defined below */
 
-/* specified content is a file name */
-#define CURL_HTTPPOST_FILENAME (1<<0)
-/* specified content is a file name */
-#define CURL_HTTPPOST_READFILE (1<<1)
+/* specified content is a filename */
+#define CURL_HTTPPOST_FILENAME (1 << 0)
+/* specified content is a filename */
+#define CURL_HTTPPOST_READFILE (1 << 1)
 /* name is only stored pointer do not free in formfree */
-#define CURL_HTTPPOST_PTRNAME (1<<2)
+#define CURL_HTTPPOST_PTRNAME (1 << 2)
 /* contents is only stored pointer do not free in formfree */
-#define CURL_HTTPPOST_PTRCONTENTS (1<<3)
+#define CURL_HTTPPOST_PTRCONTENTS (1 << 3)
 /* upload file from buffer */
-#define CURL_HTTPPOST_BUFFER (1<<4)
+#define CURL_HTTPPOST_BUFFER (1 << 4)
 /* upload file from pointer contents */
-#define CURL_HTTPPOST_PTRBUFFER (1<<5)
+#define CURL_HTTPPOST_PTRBUFFER (1 << 5)
 /* upload file contents by using the regular read callback to get the data and
    pass the given pointer as custom pointer */
-#define CURL_HTTPPOST_CALLBACK (1<<6)
+#define CURL_HTTPPOST_CALLBACK (1 << 6)
 /* use size in 'contentlen', added in 7.46.0 */
-#define CURL_HTTPPOST_LARGE (1<<7)
+#define CURL_HTTPPOST_LARGE (1 << 7)
 
-  char *showfilename;               /* The file name to show. If not set, the
-                                       actual file name will be used (if this
-                                       is a file part) */
+  char *showfilename;               /* The filename to show. If not set, the
+                                       actual filename is used (if this is
+                                       a file part) */
   void *userp;                      /* custom pointer used for
                                        HTTPPOST_CALLBACK posts */
   curl_off_t contentlen;            /* alternative length of contents
@@ -226,9 +229,8 @@ struct curl_httppost {
                                        set. Added in 7.46.0 */
 };
 
-
-/* This is a return code for the progress callback that, when returned, will
-   signal libcurl to continue executing the default progress function */
+/* This is a return code for the progress callback that, when returned,
+   signals libcurl to continue executing the default progress function */
 #define CURL_PROGRESSFUNC_CONTINUE 0x10000001
 
 /* This is the CURLOPT_PROGRESSFUNCTION callback prototype. It is now
@@ -250,32 +252,32 @@ typedef int (*curl_xferinfo_callback)(void *clientp,
 
 #ifndef CURL_MAX_READ_SIZE
   /* The maximum receive buffer size configurable via CURLOPT_BUFFERSIZE. */
-#define CURL_MAX_READ_SIZE (10*1024*1024)
+#define CURL_MAX_READ_SIZE (10 * 1024 * 1024)
 #endif
 
 #ifndef CURL_MAX_WRITE_SIZE
-  /* Tests have proven that 20K is a very bad buffer size for uploads on
-     Windows, while 16K for some odd reason performed a lot better.
-     We do the ifndef check to allow this value to easier be changed at build
-     time for those who feel adventurous. The practical minimum is about
-     400 bytes since libcurl uses a buffer of this size as a scratch area
-     (unrelated to network send operations). */
+  /* Tests have proven that 20K is a bad buffer size for uploads on Windows,
+     while 16K for some odd reason performed a lot better. We do the ifndef
+     check to allow this value to easier be changed at build time for those
+     who feel adventurous. The practical minimum is about 400 bytes since
+     libcurl uses a buffer of this size as a scratch area (unrelated to
+     network send operations). */
 #define CURL_MAX_WRITE_SIZE 16384
 #endif
 
 #ifndef CURL_MAX_HTTP_HEADER
 /* The only reason to have a max limit for this is to avoid the risk of a bad
-   server feeding libcurl with a never-ending header that will cause reallocs
+   server feeding libcurl with a never-ending header that causes reallocs
    infinitely */
-#define CURL_MAX_HTTP_HEADER (100*1024)
+#define CURL_MAX_HTTP_HEADER (100 * 1024)
 #endif
 
 /* This is a magic return code for the write callback that, when returned,
-   will signal libcurl to pause receiving on the current transfer. */
+   signals libcurl to pause receiving on the current transfer. */
 #define CURL_WRITEFUNC_PAUSE 0x10000001
 
 /* This is a magic return code for the write callback that, when returned,
-   will signal an error from the callback. */
+   signals an error from the callback. */
 #define CURL_WRITEFUNC_ERROR 0xFFFFFFFF
 
 typedef size_t (*curl_write_callback)(char *buffer,
@@ -283,7 +285,7 @@ typedef size_t (*curl_write_callback)(char *buffer,
                                       size_t nitems,
                                       void *outstream);
 
-/* This callback will be called when a new resolver request is made */
+/* This callback is called when a new resolver request is made */
 typedef int (*curl_resolver_start_callback)(void *resolver_state,
                                             void *reserved, void *userdata);
 
@@ -301,14 +303,14 @@ typedef enum {
   CURLFILETYPE_UNKNOWN /* should never occur */
 } curlfiletype;
 
-#define CURLFINFOFLAG_KNOWN_FILENAME    (1<<0)
-#define CURLFINFOFLAG_KNOWN_FILETYPE    (1<<1)
-#define CURLFINFOFLAG_KNOWN_TIME        (1<<2)
-#define CURLFINFOFLAG_KNOWN_PERM        (1<<3)
-#define CURLFINFOFLAG_KNOWN_UID         (1<<4)
-#define CURLFINFOFLAG_KNOWN_GID         (1<<5)
-#define CURLFINFOFLAG_KNOWN_SIZE        (1<<6)
-#define CURLFINFOFLAG_KNOWN_HLINKCOUNT  (1<<7)
+#define CURLFINFOFLAG_KNOWN_FILENAME    (1 << 0)
+#define CURLFINFOFLAG_KNOWN_FILETYPE    (1 << 1)
+#define CURLFINFOFLAG_KNOWN_TIME        (1 << 2)
+#define CURLFINFOFLAG_KNOWN_PERM        (1 << 3)
+#define CURLFINFOFLAG_KNOWN_UID         (1 << 4)
+#define CURLFINFOFLAG_KNOWN_GID         (1 << 5)
+#define CURLFINFOFLAG_KNOWN_SIZE        (1 << 6)
+#define CURLFINFOFLAG_KNOWN_HLINKCOUNT  (1 << 7)
 
 /* Information about a single file, used when doing FTP wildcard matching */
 struct curl_fileinfo {
@@ -359,13 +361,13 @@ typedef long (*curl_chunk_bgn_callback)(const void *transfer_info,
    download of an individual chunk finished.
    Note! After this callback was set then it have to be called FOR ALL chunks.
    Even if downloading of this chunk was skipped in CHUNK_BGN_FUNC.
-   This is the reason why we don't need "transfer_info" parameter in this
+   This is the reason why we do not need "transfer_info" parameter in this
    callback and we are not interested in "remains" parameter too. */
 typedef long (*curl_chunk_end_callback)(void *ptr);
 
 /* return codes for FNMATCHFUNCTION */
 #define CURL_FNMATCHFUNC_MATCH    0 /* string corresponds to the pattern */
-#define CURL_FNMATCHFUNC_NOMATCH  1 /* pattern doesn't match the string */
+#define CURL_FNMATCHFUNC_NOMATCH  1 /* pattern does not match the string */
 #define CURL_FNMATCHFUNC_FAIL     2 /* an error occurred */
 
 /* callback type for wildcard downloading pattern matching. If the
@@ -377,17 +379,17 @@ typedef int (*curl_fnmatch_callback)(void *ptr,
 /* These are the return codes for the seek callbacks */
 #define CURL_SEEKFUNC_OK       0
 #define CURL_SEEKFUNC_FAIL     1 /* fail the entire transfer */
-#define CURL_SEEKFUNC_CANTSEEK 2 /* tell libcurl seeking can't be done, so
+#define CURL_SEEKFUNC_CANTSEEK 2 /* tell libcurl seeking cannot be done, so
                                     libcurl might try other means instead */
 typedef int (*curl_seek_callback)(void *instream,
                                   curl_off_t offset,
                                   int origin); /* 'whence' */
 
-/* This is a return code for the read callback that, when returned, will
-   signal libcurl to immediately abort the current transfer. */
+/* This is a return code for the read callback that, when returned,
+   signals libcurl to immediately abort the current transfer. */
 #define CURL_READFUNC_ABORT 0x10000000
-/* This is a return code for the read callback that, when returned, will
-   signal libcurl to pause sending data on the current transfer. */
+/* This is a return code for the read callback that, when returned,
+   signals libcurl to pause sending data on the current transfer. */
 #define CURL_READFUNC_PAUSE 0x10000001
 
 /* Return code for when the trailing headers' callback has terminated
@@ -398,12 +400,12 @@ typedef int (*curl_seek_callback)(void *instream,
 #define CURL_TRAILERFUNC_ABORT 1
 
 typedef size_t (*curl_read_callback)(char *buffer,
-                                      size_t size,
-                                      size_t nitems,
-                                      void *instream);
+                                     size_t size,
+                                     size_t nitems,
+                                     void *instream);
 
 typedef int (*curl_trailer_callback)(struct curl_slist **list,
-                                      void *userdata);
+                                     void *userdata);
 
 typedef enum {
   CURLSOCKTYPE_IPCXN,  /* socket created for a specific IP connection */
@@ -460,7 +462,7 @@ typedef curlioerr (*curl_ioctl_callback)(CURL *handle,
 #ifndef CURL_DID_MEMORY_FUNC_TYPEDEFS
 /*
  * The following typedef's are signatures of malloc, free, realloc, strdup and
- * calloc respectively.  Function pointers of these types can be passed to the
+ * calloc respectively. Function pointers of these types can be passed to the
  * curl_global_init_mem() function to set user defined memory management
  * callback routines.
  */
@@ -548,22 +550,22 @@ typedef enum {
   CURLE_WRITE_ERROR,             /* 23 */
   CURLE_OBSOLETE24,              /* 24 - NOT USED */
   CURLE_UPLOAD_FAILED,           /* 25 - failed upload "command" */
-  CURLE_READ_ERROR,              /* 26 - couldn't open/read from file */
+  CURLE_READ_ERROR,              /* 26 - could not open/read from file */
   CURLE_OUT_OF_MEMORY,           /* 27 */
   CURLE_OPERATION_TIMEDOUT,      /* 28 - the timeout time was reached */
   CURLE_OBSOLETE29,              /* 29 - NOT USED */
   CURLE_FTP_PORT_FAILED,         /* 30 - FTP PORT operation failed */
   CURLE_FTP_COULDNT_USE_REST,    /* 31 - the REST command failed */
   CURLE_OBSOLETE32,              /* 32 - NOT USED */
-  CURLE_RANGE_ERROR,             /* 33 - RANGE "command" didn't work */
-  CURLE_HTTP_POST_ERROR,         /* 34 */
+  CURLE_RANGE_ERROR,             /* 33 - RANGE "command" did not work */
+  CURLE_OBSOLETE34,              /* 34 */
   CURLE_SSL_CONNECT_ERROR,       /* 35 - wrong when connecting with SSL */
-  CURLE_BAD_DOWNLOAD_RESUME,     /* 36 - couldn't resume download */
+  CURLE_BAD_DOWNLOAD_RESUME,     /* 36 - could not resume download */
   CURLE_FILE_COULDNT_READ_FILE,  /* 37 */
   CURLE_LDAP_CANNOT_BIND,        /* 38 */
   CURLE_LDAP_SEARCH_FAILED,      /* 39 */
   CURLE_OBSOLETE40,              /* 40 - NOT USED */
-  CURLE_FUNCTION_NOT_FOUND,      /* 41 - NOT USED starting with 7.53.0 */
+  CURLE_OBSOLETE41,              /* 41 - NOT USED starting with 7.53.0 */
   CURLE_ABORTED_BY_CALLBACK,     /* 42 */
   CURLE_BAD_FUNCTION_ARGUMENT,   /* 43 */
   CURLE_OBSOLETE44,              /* 44 - NOT USED */
@@ -582,16 +584,16 @@ typedef enum {
   CURLE_RECV_ERROR,              /* 56 - failure in receiving network data */
   CURLE_OBSOLETE57,              /* 57 - NOT IN USE */
   CURLE_SSL_CERTPROBLEM,         /* 58 - problem with the local certificate */
-  CURLE_SSL_CIPHER,              /* 59 - couldn't use specified cipher */
+  CURLE_SSL_CIPHER,              /* 59 - could not use specified cipher */
   CURLE_PEER_FAILED_VERIFICATION, /* 60 - peer's certificate or fingerprint
-                                     wasn't verified fine */
+                                     was not verified fine */
   CURLE_BAD_CONTENT_ENCODING,    /* 61 - Unrecognized/bad encoding */
   CURLE_OBSOLETE62,              /* 62 - NOT IN USE since 7.82.0 */
   CURLE_FILESIZE_EXCEEDED,       /* 63 - Maximum file size exceeded */
   CURLE_USE_SSL_FAILED,          /* 64 - Requested FTP SSL level failed */
   CURLE_SEND_FAIL_REWIND,        /* 65 - Sending the data requires a rewind
                                     that failed */
-  CURLE_SSL_ENGINE_INITFAILED,   /* 66 - failed to initialise ENGINE */
+  CURLE_SSL_ENGINE_INITFAILED,   /* 66 - failed to initialize ENGINE */
   CURLE_LOGIN_DENIED,            /* 67 - user, password or similar was not
                                     accepted and we failed to login */
   CURLE_TFTP_NOTFOUND,           /* 68 - file not found on server */
@@ -607,13 +609,13 @@ typedef enum {
                                     or wrong format */
   CURLE_REMOTE_FILE_NOT_FOUND,   /* 78 - remote file not found */
   CURLE_SSH,                     /* 79 - error from the SSH layer, somewhat
-                                    generic so the error message will be of
+                                    generic so the error message is of
                                     interest when this has happened */
 
   CURLE_SSL_SHUTDOWN_FAILED,     /* 80 - Failed to shut down the SSL
                                     connection */
   CURLE_AGAIN,                   /* 81 - socket is not ready for send/recv,
-                                    wait till it's ready and try again (Added
+                                    wait till it is ready and try again (Added
                                     in 7.18.2) */
   CURLE_SSL_CRL_BADFILE,         /* 82 - could not load CRL file, missing or
                                     wrong format (Added in 7.19.0) */
@@ -625,7 +627,7 @@ typedef enum {
   CURLE_FTP_BAD_FILE_LIST,       /* 87 - unable to parse FTP file list */
   CURLE_CHUNK_FAILED,            /* 88 - chunk callback reported error */
   CURLE_NO_CONNECTION_AVAILABLE, /* 89 - No connection available, the
-                                    session will be queued */
+                                    session is queued */
   CURLE_SSL_PINNEDPUBKEYNOTMATCH, /* 90 - specified pinned public key did not
                                      match */
   CURLE_SSL_INVALIDCERTSTATUS,   /* 91 - invalid certificate status */
@@ -640,16 +642,24 @@ typedef enum {
   CURLE_PROXY,                   /* 97 - proxy handshake error */
   CURLE_SSL_CLIENTCERT,          /* 98 - client-side certificate required */
   CURLE_UNRECOVERABLE_POLL,      /* 99 - poll/select returned fatal error */
+  CURLE_TOO_LARGE,               /* 100 - a value/data met its maximum */
+  CURLE_ECH_REQUIRED,            /* 101 - ECH tried but failed */
   CURL_LAST /* never use! */
 } CURLcode;
 
 #ifndef CURL_NO_OLDIES /* define this to test if your app builds with all
                           the obsolete stuff removed! */
 
-/* Previously obsolete error code re-used in 7.38.0 */
+/* removed in 7.53.0 */
+#define CURLE_FUNCTION_NOT_FOUND CURLE_OBSOLETE41
+
+/* removed in 7.56.0 */
+#define CURLE_HTTP_POST_ERROR CURLE_OBSOLETE34
+
+/* Previously obsolete error code reused in 7.38.0 */
 #define CURLE_OBSOLETE16 CURLE_HTTP2
 
-/* Previously obsolete error codes re-used in 7.24.0 */
+/* Previously obsolete error codes reused in 7.24.0 */
 #define CURLE_OBSOLETE10 CURLE_FTP_ACCEPT_FAILED
 #define CURLE_OBSOLETE12 CURLE_FTP_ACCEPT_TIMEOUT
 
@@ -720,6 +730,8 @@ typedef enum {
    with them. */
 #define CURLOPT_WRITEINFO CURLOPT_OBSOLETE40
 #define CURLOPT_CLOSEPOLICY CURLOPT_OBSOLETE72
+#define CURLOPT_OBSOLETE72 9999
+#define CURLOPT_OBSOLETE40 9999
 
 #endif /* !CURL_NO_OLDIES */
 
@@ -770,25 +782,31 @@ typedef CURLcode (*curl_conv_callback)(char *buffer, size_t length);
 
 typedef CURLcode (*curl_ssl_ctx_callback)(CURL *curl,    /* easy handle */
                                           void *ssl_ctx, /* actually an OpenSSL
-                                                            or WolfSSL SSL_CTX,
+                                                            or wolfSSL SSL_CTX,
                                                             or an mbedTLS
                                                           mbedtls_ssl_config */
                                           void *userptr);
 
+#define CURLPROXY_HTTP            0L /* added in 7.10, new in 7.19.4 default is
+                                        to use CONNECT HTTP/1.1 */
+#define CURLPROXY_HTTP_1_0        1L /* force to use CONNECT HTTP/1.0
+                                        added in 7.19.4 */
+#define CURLPROXY_HTTPS           2L /* HTTPS but stick to HTTP/1
+                                        added in 7.52.0 */
+#define CURLPROXY_HTTPS2          3L /* HTTPS and attempt HTTP/2
+                                        added in 8.2.0 */
+#define CURLPROXY_SOCKS4          4L /* support added in 7.15.2, enum existed
+                                        already in 7.10 */
+#define CURLPROXY_SOCKS5          5L /* added in 7.10 */
+#define CURLPROXY_SOCKS4A         6L /* added in 7.18.0 */
+#define CURLPROXY_SOCKS5_HOSTNAME 7L /* Use the SOCKS5 protocol but pass along
+                                        the hostname rather than the IP
+                                        address. added in 7.18.0 */
+#define CURLPROXY_HTTPS3          8L /* HTTPS and attempt HTTP/3
+                                        added in 8.21.0 */
+
 typedef enum {
-  CURLPROXY_HTTP = 0,   /* added in 7.10, new in 7.19.4 default is to use
-                           CONNECT HTTP/1.1 */
-  CURLPROXY_HTTP_1_0 = 1,   /* added in 7.19.4, force to use CONNECT
-                               HTTP/1.0  */
-  CURLPROXY_HTTPS = 2,  /* HTTPS but stick to HTTP/1 added in 7.52.0 */
-  CURLPROXY_HTTPS2 = 3, /* HTTPS and attempt HTTP/2 added in 8.2.0 */
-  CURLPROXY_SOCKS4 = 4, /* support added in 7.15.2, enum existed already
-                           in 7.10 */
-  CURLPROXY_SOCKS5 = 5, /* added in 7.10 */
-  CURLPROXY_SOCKS4A = 6, /* added in 7.18.0 */
-  CURLPROXY_SOCKS5_HOSTNAME = 7 /* Use the SOCKS5 protocol but pass along the
-                                   host name rather than the IP address. added
-                                   in 7.18.0 */
+  CURLPROXY_LAST = 9 /* never use */
 } curl_proxytype;  /* this enum was added in 7.10 */
 
 /*
@@ -800,45 +818,51 @@ typedef enum {
  * CURLAUTH_NEGOTIATE    - HTTP Negotiate (SPNEGO) authentication
  * CURLAUTH_GSSNEGOTIATE - Alias for CURLAUTH_NEGOTIATE (deprecated)
  * CURLAUTH_NTLM         - HTTP NTLM authentication
- * CURLAUTH_DIGEST_IE    - HTTP Digest authentication with IE flavour
+ * CURLAUTH_DIGEST_IE    - HTTP Digest authentication with IE flavor
  * CURLAUTH_NTLM_WB      - HTTP NTLM authentication delegated to winbind helper
  * CURLAUTH_BEARER       - HTTP Bearer token authentication
  * CURLAUTH_ONLY         - Use together with a single other type to force no
- *                         authentication or just that single type
+ *                         authentication or that single type
  * CURLAUTH_ANY          - All fine types set
  * CURLAUTH_ANYSAFE      - All fine types except Basic
  */
 
 #define CURLAUTH_NONE         ((unsigned long)0)
-#define CURLAUTH_BASIC        (((unsigned long)1)<<0)
-#define CURLAUTH_DIGEST       (((unsigned long)1)<<1)
-#define CURLAUTH_NEGOTIATE    (((unsigned long)1)<<2)
+#define CURLAUTH_BASIC        (((unsigned long)1) << 0)
+#define CURLAUTH_DIGEST       (((unsigned long)1) << 1)
+#define CURLAUTH_NEGOTIATE    (((unsigned long)1) << 2)
 /* Deprecated since the advent of CURLAUTH_NEGOTIATE */
 #define CURLAUTH_GSSNEGOTIATE CURLAUTH_NEGOTIATE
 /* Used for CURLOPT_SOCKS5_AUTH to stay terminologically correct */
 #define CURLAUTH_GSSAPI CURLAUTH_NEGOTIATE
-#define CURLAUTH_NTLM         (((unsigned long)1)<<3)
-#define CURLAUTH_DIGEST_IE    (((unsigned long)1)<<4)
-#define CURLAUTH_NTLM_WB      (((unsigned long)1)<<5)
-#define CURLAUTH_BEARER       (((unsigned long)1)<<6)
-#define CURLAUTH_AWS_SIGV4    (((unsigned long)1)<<7)
-#define CURLAUTH_ONLY         (((unsigned long)1)<<31)
-#define CURLAUTH_ANY          (~CURLAUTH_DIGEST_IE)
-#define CURLAUTH_ANYSAFE      (~(CURLAUTH_BASIC|CURLAUTH_DIGEST_IE))
+#define CURLAUTH_NTLM         (((unsigned long)1) << 3)
+#define CURLAUTH_DIGEST_IE    (((unsigned long)1) << 4)
+#ifndef CURL_NO_OLDIES
+  /* functionality removed since 8.8.0 */
+#define CURLAUTH_NTLM_WB      (((unsigned long)1) << 5)
+#endif
+#define CURLAUTH_BEARER       (((unsigned long)1) << 6)
+#define CURLAUTH_AWS_SIGV4    (((unsigned long)1) << 7)
+#define CURLAUTH_ONLY         (((unsigned long)1) << 31)
+#define CURLAUTH_ANY          ((~CURLAUTH_DIGEST_IE) & \
+                               ((unsigned long)0xffffffff))
+#define CURLAUTH_ANYSAFE      ((~(CURLAUTH_BASIC | CURLAUTH_DIGEST_IE)) & \
+                               ((unsigned long)0xffffffff))
 
-#define CURLSSH_AUTH_ANY       ~0     /* all types supported by the server */
-#define CURLSSH_AUTH_NONE      0      /* none allowed, silly but complete */
-#define CURLSSH_AUTH_PUBLICKEY (1<<0) /* public/private key files */
-#define CURLSSH_AUTH_PASSWORD  (1<<1) /* password */
-#define CURLSSH_AUTH_HOST      (1<<2) /* host key files */
-#define CURLSSH_AUTH_KEYBOARD  (1<<3) /* keyboard interactive */
-#define CURLSSH_AUTH_AGENT     (1<<4) /* agent (ssh-agent, pageant...) */
-#define CURLSSH_AUTH_GSSAPI    (1<<5) /* gssapi (kerberos, ...) */
-#define CURLSSH_AUTH_DEFAULT CURLSSH_AUTH_ANY
+/* all types supported by server */
+#define CURLSSH_AUTH_ANY       ((unsigned long)0xffffffff)
+#define CURLSSH_AUTH_NONE      0L        /* none allowed, silly but complete */
+#define CURLSSH_AUTH_PUBLICKEY (1L << 0) /* public/private key files */
+#define CURLSSH_AUTH_PASSWORD  (1L << 1) /* password */
+#define CURLSSH_AUTH_HOST      (1L << 2) /* host key files */
+#define CURLSSH_AUTH_KEYBOARD  (1L << 3) /* keyboard interactive */
+#define CURLSSH_AUTH_AGENT     (1L << 4) /* agent (ssh-agent, pageant...) */
+#define CURLSSH_AUTH_GSSAPI    (1L << 5) /* gssapi (kerberos, ...) */
+#define CURLSSH_AUTH_DEFAULT   CURLSSH_AUTH_ANY
 
-#define CURLGSSAPI_DELEGATION_NONE        0      /* no delegation (default) */
-#define CURLGSSAPI_DELEGATION_POLICY_FLAG (1<<0) /* if permitted by policy */
-#define CURLGSSAPI_DELEGATION_FLAG        (1<<1) /* delegate always */
+#define CURLGSSAPI_DELEGATION_NONE        0L      /* no delegation (default) */
+#define CURLGSSAPI_DELEGATION_POLICY_FLAG (1L<<0) /* if permitted by policy */
+#define CURLGSSAPI_DELEGATION_FLAG        (1L<<1) /* delegate always */
 
 #define CURL_ERROR_SIZE 256
 
@@ -864,9 +888,9 @@ enum curl_khstat {
   CURLKHSTAT_FINE_ADD_TO_FILE,
   CURLKHSTAT_FINE,
   CURLKHSTAT_REJECT, /* reject the connection, return an error */
-  CURLKHSTAT_DEFER,  /* do not accept it, but we can't answer right now.
+  CURLKHSTAT_DEFER,  /* do not accept it, but we cannot answer right now.
                         Causes a CURLE_PEER_FAILED_VERIFICATION error but the
-                        connection will be left intact etc */
+                        connection is left intact etc */
   CURLKHSTAT_FINE_REPLACE, /* accept and replace the wrong key */
   CURLKHSTAT_LAST    /* not for use, only a marker for last-in-list */
 };
@@ -880,61 +904,64 @@ enum curl_khmatch {
 };
 
 typedef int
-  (*curl_sshkeycallback) (CURL *easy,     /* easy handle */
-                          const struct curl_khkey *knownkey, /* known */
-                          const struct curl_khkey *foundkey, /* found */
-                          enum curl_khmatch, /* libcurl's view on the keys */
-                          void *clientp); /* custom pointer passed with */
-                                          /* CURLOPT_SSH_KEYDATA */
+  (*curl_sshkeycallback)(CURL *easy,     /* easy handle */
+                         const struct curl_khkey *knownkey, /* known */
+                         const struct curl_khkey *foundkey, /* found */
+                         enum curl_khmatch, /* libcurl's view on the keys */
+                         void *clientp); /* custom pointer passed with */
+                                         /* CURLOPT_SSH_KEYDATA */
 
 typedef int
-  (*curl_sshhostkeycallback) (void *clientp,/* custom pointer passed */
-                                            /* with CURLOPT_SSH_HOSTKEYDATA */
+  (*curl_sshhostkeycallback)(void *clientp,/* custom pointer passed */
+                                           /* with CURLOPT_SSH_HOSTKEYDATA */
                           int keytype, /* CURLKHTYPE */
                           const char *key, /* hostkey to check */
                           size_t keylen); /* length of the key */
                           /* return CURLE_OK to accept */
                           /* or something else to refuse */
 
-
 /* parameter for the CURLOPT_USE_SSL option */
+#define CURLUSESSL_NONE    0L /* do not attempt to use SSL */
+#define CURLUSESSL_TRY     1L /* try using SSL, proceed anyway otherwise */
+#define CURLUSESSL_CONTROL 2L /* SSL for the control connection or fail */
+#define CURLUSESSL_ALL     3L /* SSL for all communication or fail */
+
 typedef enum {
-  CURLUSESSL_NONE,    /* do not attempt to use SSL */
-  CURLUSESSL_TRY,     /* try using SSL, proceed anyway otherwise */
-  CURLUSESSL_CONTROL, /* SSL for the control connection or fail */
-  CURLUSESSL_ALL,     /* SSL for all communication or fail */
-  CURLUSESSL_LAST     /* not an option, never use */
+  CURLUSESSL_LAST = 4 /* not an option, never use */
 } curl_usessl;
 
 /* Definition of bits for the CURLOPT_SSL_OPTIONS argument: */
 
 /* - ALLOW_BEAST tells libcurl to allow the BEAST SSL vulnerability in the
    name of improving interoperability with older servers. Some SSL libraries
-   have introduced work-arounds for this flaw but those work-arounds sometimes
+   have introduced workarounds for this flaw but those workarounds sometimes
    make the SSL communication fail. To regain functionality with those broken
    servers, a user can this way allow the vulnerability back. */
-#define CURLSSLOPT_ALLOW_BEAST (1<<0)
+#define CURLSSLOPT_ALLOW_BEAST (1L << 0)
 
 /* - NO_REVOKE tells libcurl to disable certificate revocation checks for those
    SSL backends where such behavior is present. */
-#define CURLSSLOPT_NO_REVOKE (1<<1)
+#define CURLSSLOPT_NO_REVOKE (1L << 1)
 
 /* - NO_PARTIALCHAIN tells libcurl to *NOT* accept a partial certificate chain
    if possible. The OpenSSL backend has this ability. */
-#define CURLSSLOPT_NO_PARTIALCHAIN (1<<2)
+#define CURLSSLOPT_NO_PARTIALCHAIN (1L << 2)
 
 /* - REVOKE_BEST_EFFORT tells libcurl to ignore certificate revocation offline
    checks and ignore missing revocation list for those SSL backends where such
    behavior is present. */
-#define CURLSSLOPT_REVOKE_BEST_EFFORT (1<<3)
+#define CURLSSLOPT_REVOKE_BEST_EFFORT (1L << 3)
 
 /* - CURLSSLOPT_NATIVE_CA tells libcurl to use standard certificate store of
    operating system. Currently implemented under MS-Windows. */
-#define CURLSSLOPT_NATIVE_CA (1<<4)
+#define CURLSSLOPT_NATIVE_CA (1L << 4)
 
 /* - CURLSSLOPT_AUTO_CLIENT_CERT tells libcurl to automatically locate and use
    a client certificate for authentication. (Schannel) */
-#define CURLSSLOPT_AUTO_CLIENT_CERT (1<<5)
+#define CURLSSLOPT_AUTO_CLIENT_CERT (1L << 5)
+
+/* If possible, send data using TLS 1.3 early data */
+#define CURLSSLOPT_EARLYDATA (1L << 6)
 
 /* The default connection attempt delay in milliseconds for happy eyeballs.
    CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS.3 and happy-eyeballs-timeout-ms.d document
@@ -959,51 +986,62 @@ typedef enum {
 #endif /* !CURL_NO_OLDIES */
 
 /* parameter for the CURLOPT_FTP_SSL_CCC option */
+#define CURLFTPSSL_CCC_NONE    0L /* do not send CCC */
+#define CURLFTPSSL_CCC_PASSIVE 1L /* Let the server initiate the shutdown */
+#define CURLFTPSSL_CCC_ACTIVE  2L /* Initiate the shutdown */
+
 typedef enum {
-  CURLFTPSSL_CCC_NONE,    /* do not send CCC */
-  CURLFTPSSL_CCC_PASSIVE, /* Let the server initiate the shutdown */
-  CURLFTPSSL_CCC_ACTIVE,  /* Initiate the shutdown */
-  CURLFTPSSL_CCC_LAST     /* not an option, never use */
+  CURLFTPSSL_CCC_LAST = 3 /* not an option, never use */
 } curl_ftpccc;
 
 /* parameter for the CURLOPT_FTPSSLAUTH option */
+#define CURLFTPAUTH_DEFAULT 0L /* let libcurl decide */
+#define CURLFTPAUTH_SSL     1L /* use "AUTH SSL" */
+#define CURLFTPAUTH_TLS     2L /* use "AUTH TLS" */
+
 typedef enum {
-  CURLFTPAUTH_DEFAULT, /* let libcurl decide */
-  CURLFTPAUTH_SSL,     /* use "AUTH SSL" */
-  CURLFTPAUTH_TLS,     /* use "AUTH TLS" */
-  CURLFTPAUTH_LAST /* not an option, never use */
+  CURLFTPAUTH_LAST = 3 /* not an option, never use */
 } curl_ftpauth;
 
 /* parameter for the CURLOPT_FTP_CREATE_MISSING_DIRS option */
+#define CURLFTP_CREATE_DIR_NONE  0L /* do NOT create missing dirs! */
+#define CURLFTP_CREATE_DIR       1L /* (FTP/SFTP) if CWD fails, try MKD and
+                                       then CWD again if MKD succeeded, for
+                                       SFTP this does similar magic */
+#define CURLFTP_CREATE_DIR_RETRY 2L /* (FTP only) if CWD fails, try MKD and
+                                       then CWD again even if MKD failed! */
+
 typedef enum {
-  CURLFTP_CREATE_DIR_NONE,  /* do NOT create missing dirs! */
-  CURLFTP_CREATE_DIR,       /* (FTP/SFTP) if CWD fails, try MKD and then CWD
-                               again if MKD succeeded, for SFTP this does
-                               similar magic */
-  CURLFTP_CREATE_DIR_RETRY, /* (FTP only) if CWD fails, try MKD and then CWD
-                               again even if MKD failed! */
-  CURLFTP_CREATE_DIR_LAST   /* not an option, never use */
+  CURLFTP_CREATE_DIR_LAST = 3 /* not an option, never use */
 } curl_ftpcreatedir;
 
 /* parameter for the CURLOPT_FTP_FILEMETHOD option */
+#define CURLFTPMETHOD_DEFAULT   0L /* let libcurl pick */
+#define CURLFTPMETHOD_MULTICWD  1L /* single CWD operation for each path
+                                      part */
+#define CURLFTPMETHOD_NOCWD     2L /* no CWD at all */
+#define CURLFTPMETHOD_SINGLECWD 3L /* one CWD to full dir, then work on file */
+
 typedef enum {
-  CURLFTPMETHOD_DEFAULT,   /* let libcurl pick */
-  CURLFTPMETHOD_MULTICWD,  /* single CWD operation for each path part */
-  CURLFTPMETHOD_NOCWD,     /* no CWD at all */
-  CURLFTPMETHOD_SINGLECWD, /* one CWD to full dir, then work on file */
-  CURLFTPMETHOD_LAST       /* not an option, never use */
+  CURLFTPMETHOD_LAST = 4 /* not an option, never use */
 } curl_ftpmethod;
 
 /* bitmask defines for CURLOPT_HEADEROPT */
-#define CURLHEADER_UNIFIED  0
-#define CURLHEADER_SEPARATE (1<<0)
+#define CURLHEADER_UNIFIED  0L
+#define CURLHEADER_SEPARATE (1L << 0)
 
 /* CURLALTSVC_* are bits for the CURLOPT_ALTSVC_CTRL option */
-#define CURLALTSVC_READONLYFILE (1<<2)
-#define CURLALTSVC_H1           (1<<3)
-#define CURLALTSVC_H2           (1<<4)
-#define CURLALTSVC_H3           (1<<5)
+#define CURLALTSVC_READONLYFILE (1L << 2)
+#define CURLALTSVC_H1           (1L << 3)
+#define CURLALTSVC_H2           (1L << 4)
+#define CURLALTSVC_H3           (1L << 5)
 
+/* bitmask values for CURLOPT_UPLOAD_FLAGS */
+#define CURLULFLAG_ANSWERED (1L << 0)
+#define CURLULFLAG_DELETED  (1L << 1)
+#define CURLULFLAG_DRAFT    (1L << 2)
+#define CURLULFLAG_FLAGGED  (1L << 3)
+#define CURLULFLAG_SEEN     (1L << 4)
 
 struct curl_hstsentry {
   char *name;
@@ -1032,42 +1070,43 @@ typedef CURLSTScode (*curl_hstswrite_callback)(CURL *easy,
                                                void *userp);
 
 /* CURLHSTS_* are bits for the CURLOPT_HSTS option */
-#define CURLHSTS_ENABLE       (long)(1<<0)
-#define CURLHSTS_READONLYFILE (long)(1<<1)
+#define CURLHSTS_ENABLE       (1L << 0)
+#define CURLHSTS_READONLYFILE (1L << 1)
 
 /* The CURLPROTO_ defines below are for the **deprecated** CURLOPT_*PROTOCOLS
    options. Do not use. */
-#define CURLPROTO_HTTP   (1<<0)
-#define CURLPROTO_HTTPS  (1<<1)
-#define CURLPROTO_FTP    (1<<2)
-#define CURLPROTO_FTPS   (1<<3)
-#define CURLPROTO_SCP    (1<<4)
-#define CURLPROTO_SFTP   (1<<5)
-#define CURLPROTO_TELNET (1<<6)
-#define CURLPROTO_LDAP   (1<<7)
-#define CURLPROTO_LDAPS  (1<<8)
-#define CURLPROTO_DICT   (1<<9)
-#define CURLPROTO_FILE   (1<<10)
-#define CURLPROTO_TFTP   (1<<11)
-#define CURLPROTO_IMAP   (1<<12)
-#define CURLPROTO_IMAPS  (1<<13)
-#define CURLPROTO_POP3   (1<<14)
-#define CURLPROTO_POP3S  (1<<15)
-#define CURLPROTO_SMTP   (1<<16)
-#define CURLPROTO_SMTPS  (1<<17)
-#define CURLPROTO_RTSP   (1<<18)
-#define CURLPROTO_RTMP   (1<<19)
-#define CURLPROTO_RTMPT  (1<<20)
-#define CURLPROTO_RTMPE  (1<<21)
-#define CURLPROTO_RTMPTE (1<<22)
-#define CURLPROTO_RTMPS  (1<<23)
-#define CURLPROTO_RTMPTS (1<<24)
-#define CURLPROTO_GOPHER (1<<25)
-#define CURLPROTO_SMB    (1<<26)
-#define CURLPROTO_SMBS   (1<<27)
-#define CURLPROTO_MQTT   (1<<28)
-#define CURLPROTO_GOPHERS (1<<29)
-#define CURLPROTO_ALL    (~0) /* enable everything */
+#define CURLPROTO_HTTP    (1L << 0)
+#define CURLPROTO_HTTPS   (1L << 1)
+#define CURLPROTO_FTP     (1L << 2)
+#define CURLPROTO_FTPS    (1L << 3)
+#define CURLPROTO_SCP     (1L << 4)
+#define CURLPROTO_SFTP    (1L << 5)
+#define CURLPROTO_TELNET  (1L << 6)
+#define CURLPROTO_LDAP    (1L << 7)
+#define CURLPROTO_LDAPS   (1L << 8)
+#define CURLPROTO_DICT    (1L << 9)
+#define CURLPROTO_FILE    (1L << 10)
+#define CURLPROTO_TFTP    (1L << 11)
+#define CURLPROTO_IMAP    (1L << 12)
+#define CURLPROTO_IMAPS   (1L << 13)
+#define CURLPROTO_POP3    (1L << 14)
+#define CURLPROTO_POP3S   (1L << 15)
+#define CURLPROTO_SMTP    (1L << 16)
+#define CURLPROTO_SMTPS   (1L << 17)
+#define CURLPROTO_RTSP    (1L << 18)
+#define CURLPROTO_RTMP    (1L << 19)
+#define CURLPROTO_RTMPT   (1L << 20)
+#define CURLPROTO_RTMPE   (1L << 21)
+#define CURLPROTO_RTMPTE  (1L << 22)
+#define CURLPROTO_RTMPS   (1L << 23)
+#define CURLPROTO_RTMPTS  (1L << 24)
+#define CURLPROTO_GOPHER  (1L << 25)
+#define CURLPROTO_SMB     (1L << 26)
+#define CURLPROTO_SMBS    (1L << 27)
+#define CURLPROTO_MQTT    (1L << 28)
+#define CURLPROTO_GOPHERS (1L << 29)
+#define CURLPROTO_ALL     ((unsigned long)0xffffffff) /* old-style enable
+                                                         "everything" */
 
 /* long may be 32 or 64 bits, but we should never depend on anything else
    but 32 */
@@ -1080,11 +1119,11 @@ typedef CURLSTScode (*curl_hstswrite_callback)(CURL *easy,
 /* *STRINGPOINT is an alias for OBJECTPOINT to allow tools to extract the
    string options from the header file */
 
+#define CURLOPT(na, t, nu) na = ((t) + (nu))
+#define CURLOPTDEPRECATED(na, t, nu, v, m) na CURL_DEPRECATED(v, m) \
+  = ((t) + (nu))
 
-#define CURLOPT(na,t,nu) na = t + nu
-#define CURLOPTDEPRECATED(na,t,nu,v,m) na CURL_DEPRECATED(v,m) = t + nu
-
-/* CURLOPT aliases that make no run-time difference */
+/* CURLOPT aliases that make no runtime difference */
 
 /* 'char *' argument to a string with a trailing zero */
 #define CURLOPTTYPE_STRINGPOINT CURLOPTTYPE_OBJECTPOINT
@@ -1133,12 +1172,12 @@ typedef enum {
    * bytes big. */
   CURLOPT(CURLOPT_ERRORBUFFER, CURLOPTTYPE_OBJECTPOINT, 10),
 
-  /* Function that will be called to store the output (instead of fwrite). The
-   * parameters will use fwrite() syntax, make sure to follow them. */
+  /* Function that is called to store the output (instead of fwrite). The
+   * parameters use fwrite() syntax, make sure to follow them. */
   CURLOPT(CURLOPT_WRITEFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 11),
 
-  /* Function that will be called to read the input (instead of fread). The
-   * parameters will use fread() syntax, make sure to follow them. */
+  /* Function that is called to read the input (instead of fread). The
+   * parameters use fread() syntax, make sure to follow them. */
   CURLOPT(CURLOPT_READFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 12),
 
   /* Time-out the read operation after this amount of seconds */
@@ -1151,7 +1190,7 @@ typedef enum {
    *
    * For large file support, there is also a _LARGE version of the key
    * which takes an off_t type, allowing platforms with larger off_t
-   * sizes to handle larger files.  See below for INFILESIZE_LARGE.
+   * sizes to handle larger files. See below for INFILESIZE_LARGE.
    */
   CURLOPT(CURLOPT_INFILESIZE, CURLOPTTYPE_LONG, 14),
 
@@ -1184,7 +1223,7 @@ typedef enum {
    *
    * Note there is also a _LARGE version of this key which uses
    * off_t types, allowing for large file offsets on platforms which
-   * use larger-than-32-bit off_t's.  Look below for RESUME_FROM_LARGE.
+   * use larger-than-32-bit off_t's. Look below for RESUME_FROM_LARGE.
    */
   CURLOPT(CURLOPT_RESUME_FROM, CURLOPTTYPE_LONG, 21),
 
@@ -1212,7 +1251,7 @@ typedef enum {
   CURLOPT(CURLOPT_QUOTE, CURLOPTTYPE_SLISTPOINT, 28),
 
   /* send FILE * or void * to store headers to, if you use a callback it
-     is simply passed to the callback unmodified */
+     is passed to the callback unmodified */
   CURLOPT(CURLOPT_HEADERDATA, CURLOPTTYPE_CBPOINT, 29),
 
   /* point to a file to read the initial cookies from, also enables
@@ -1246,8 +1285,7 @@ typedef enum {
   /* send linked-list of post-transfer QUOTE commands */
   CURLOPT(CURLOPT_POSTQUOTE, CURLOPTTYPE_SLISTPOINT, 39),
 
-   /* OBSOLETE, do not use! */
-  CURLOPT(CURLOPT_OBSOLETE40, CURLOPTTYPE_OBJECTPOINT, 40),
+  /* 40 is not used */
 
   /* talk a lot */
   CURLOPT(CURLOPT_VERBOSE, CURLOPTTYPE_LONG, 41),
@@ -1293,7 +1331,7 @@ typedef enum {
   /* 55 = OBSOLETE */
 
   /* DEPRECATED
-   * Function that will be called instead of the internal progress display
+   * Function that is called instead of the internal progress display
    * function. This function should be defined as the curl_progress_callback
    * prototype defines. */
   CURLOPTDEPRECATED(CURLOPT_PROGRESSFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 56,
@@ -1320,12 +1358,13 @@ typedef enum {
   /* Set the interface string to use as outgoing network interface */
   CURLOPT(CURLOPT_INTERFACE, CURLOPTTYPE_STRINGPOINT, 62),
 
-  /* Set the krb4/5 security level, this also enables krb4/5 awareness.  This
-   * is a string, 'clear', 'safe', 'confidential' or 'private'.  If the string
-   * is set but doesn't match one of these, 'private' will be used.  */
-  CURLOPT(CURLOPT_KRBLEVEL, CURLOPTTYPE_STRINGPOINT, 63),
+  /* Set the krb4/5 security level, this also enables krb4/5 awareness. This
+   * is a string, 'clear', 'safe', 'confidential' or 'private'. If the string
+   * is set but does not match one of these, 'private' is used. */
+  CURLOPTDEPRECATED(CURLOPT_KRBLEVEL, CURLOPTTYPE_STRINGPOINT, 63,
+                    8.17.0, "removed"),
 
-  /* Set if we should verify the peer in ssl handshake, set 1 to verify. */
+  /* Set if we should verify the peer in SSL handshake, set 1 to verify. */
   CURLOPT(CURLOPT_SSL_VERIFYPEER, CURLOPTTYPE_LONG, 64),
 
   /* The CApath or CAfile used to validate the peer certificate
@@ -1348,22 +1387,20 @@ typedef enum {
   /* Max amount of cached alive connections */
   CURLOPT(CURLOPT_MAXCONNECTS, CURLOPTTYPE_LONG, 71),
 
-  /* OBSOLETE, do not use! */
-  CURLOPT(CURLOPT_OBSOLETE72, CURLOPTTYPE_LONG, 72),
-
+  /* 72 = OBSOLETE */
   /* 73 = OBSOLETE */
 
   /* Set to explicitly use a new connection for the upcoming transfer.
-     Do not use this unless you're absolutely sure of this, as it makes the
+     Do not use this unless you are absolutely sure of this, as it makes the
      operation slower and is less friendly for the network. */
   CURLOPT(CURLOPT_FRESH_CONNECT, CURLOPTTYPE_LONG, 74),
 
-  /* Set to explicitly forbid the upcoming transfer's connection to be re-used
-     when done. Do not use this unless you're absolutely sure of this, as it
+  /* Set to explicitly forbid the upcoming transfer's connection to be reused
+     when done. Do not use this unless you are absolutely sure of this, as it
      makes the operation slower and is less friendly for the network. */
   CURLOPT(CURLOPT_FORBID_REUSE, CURLOPTTYPE_LONG, 75),
 
-  /* Set to a file name that contains random data for libcurl to use to
+  /* Set to a filename that contains random data for libcurl to use to
      seed the random engine when doing SSL connects. */
   CURLOPTDEPRECATED(CURLOPT_RANDOM_FILE, CURLOPTTYPE_STRINGPOINT, 76,
                     7.84.0, "Serves no purpose anymore"),
@@ -1376,8 +1413,8 @@ typedef enum {
      OK within this time, then fine... This only aborts the connect phase. */
   CURLOPT(CURLOPT_CONNECTTIMEOUT, CURLOPTTYPE_LONG, 78),
 
-  /* Function that will be called to store headers (instead of fwrite). The
-   * parameters will use fwrite() syntax, make sure to follow them. */
+  /* Function that is called to store headers (instead of fwrite). The
+   * parameters use fwrite() syntax, make sure to follow them. */
   CURLOPT(CURLOPT_HEADERFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 79),
 
   /* Set this to force the HTTP request to get back to GET. Only really usable
@@ -1385,16 +1422,16 @@ typedef enum {
    */
   CURLOPT(CURLOPT_HTTPGET, CURLOPTTYPE_LONG, 80),
 
-  /* Set if we should verify the Common name from the peer certificate in ssl
+  /* Set if we should verify the Common name from the peer certificate in SSL
    * handshake, set 1 to check existence, 2 to ensure that it matches the
    * provided hostname. */
   CURLOPT(CURLOPT_SSL_VERIFYHOST, CURLOPTTYPE_LONG, 81),
 
-  /* Specify which file name to write all known cookies in after completed
-     operation. Set file name to "-" (dash) to make it go to stdout. */
+  /* Specify which filename to write all known cookies in after completed
+     operation. Set filename to "-" (dash) to make it go to stdout. */
   CURLOPT(CURLOPT_COOKIEJAR, CURLOPTTYPE_STRINGPOINT, 82),
 
-  /* Specify which SSL ciphers to use */
+  /* Specify which TLS 1.2 (1.1, 1.0) ciphers to use */
   CURLOPT(CURLOPT_SSL_CIPHER_LIST, CURLOPTTYPE_STRINGPOINT, 83),
 
   /* Specify which HTTP version to use! This must be set to one of the
@@ -1402,7 +1439,7 @@ typedef enum {
   CURLOPT(CURLOPT_HTTP_VERSION, CURLOPTTYPE_VALUES, 84),
 
   /* Specifically switch on or off the FTP engine's use of the EPSV command. By
-     default, that one will always be attempted before the more traditional
+     default, that one is always attempted before the more traditional
      PASV command. */
   CURLOPT(CURLOPT_FTP_USE_EPSV, CURLOPTTYPE_LONG, 85),
 
@@ -1459,8 +1496,8 @@ typedef enum {
   CURLOPT(CURLOPT_SHARE, CURLOPTTYPE_OBJECTPOINT, 100),
 
   /* indicates type of proxy. accepted values are CURLPROXY_HTTP (default),
-     CURLPROXY_HTTPS, CURLPROXY_SOCKS4, CURLPROXY_SOCKS4A and
-     CURLPROXY_SOCKS5. */
+     CURLPROXY_HTTPS, CURLPROXY_HTTPS2, CURLPROXY_HTTPS3, CURLPROXY_SOCKS4,
+     CURLPROXY_SOCKS4A and CURLPROXY_SOCKS5. */
   CURLOPT(CURLOPT_PROXYTYPE, CURLOPTTYPE_VALUES, 101),
 
   /* Set the Accept-Encoding string. Use this to tell a server you would like
@@ -1480,7 +1517,7 @@ typedef enum {
   CURLOPT(CURLOPT_UNRESTRICTED_AUTH, CURLOPTTYPE_LONG, 105),
 
   /* Specifically switch on or off the FTP engine's use of the EPRT command (
-     it also disables the LPRT attempt). By default, those ones will always be
+     it also disables the LPRT attempt). By default, those ones are always
      attempted before the good old traditional PORT command. */
   CURLOPT(CURLOPT_FTP_USE_EPRT, CURLOPTTYPE_LONG, 106),
 
@@ -1489,12 +1526,12 @@ typedef enum {
      Note that setting multiple bits may cause extra network round-trips. */
   CURLOPT(CURLOPT_HTTPAUTH, CURLOPTTYPE_VALUES, 107),
 
-  /* Set the ssl context callback function, currently only for OpenSSL or
-     WolfSSL ssl_ctx, or mbedTLS mbedtls_ssl_config in the second argument.
+  /* Set the SSL context callback function, currently only for OpenSSL or
+     wolfSSL ssl_ctx, or mbedTLS mbedtls_ssl_config in the second argument.
      The function must match the curl_ssl_ctx_callback prototype. */
   CURLOPT(CURLOPT_SSL_CTX_FUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 108),
 
-  /* Set the userdata for the ssl context callback function's third
+  /* Set the userdata for the SSL context callback function's third
      argument */
   CURLOPT(CURLOPT_SSL_CTX_DATA, CURLOPTTYPE_CBPOINT, 109),
 
@@ -1510,7 +1547,7 @@ typedef enum {
   CURLOPT(CURLOPT_PROXYAUTH, CURLOPTTYPE_VALUES, 111),
 
   /* Option that changes the timeout, in seconds, associated with getting a
-     response.  This is different from transfer timeout time and essentially
+     response. This is different from transfer timeout time and essentially
      places a demand on the server to acknowledge commands in a timely
      manner. For FTP, SMTP, IMAP and POP3. */
   CURLOPT(CURLOPT_SERVER_RESPONSE_TIMEOUT, CURLOPTTYPE_LONG, 112),
@@ -1520,11 +1557,11 @@ typedef enum {
      systems with support for more than one, i.e IPv4 _and_ IPv6. */
   CURLOPT(CURLOPT_IPRESOLVE, CURLOPTTYPE_VALUES, 113),
 
-  /* Set this option to limit the size of a file that will be downloaded from
+  /* Set this option to limit the size of a file that is to be downloaded from
      an HTTP or FTP server.
 
      Note there is also _LARGE version which adds large file support for
-     platforms which have larger off_t sizes.  See MAXFILESIZE_LARGE below. */
+     platforms which have larger off_t sizes. See MAXFILESIZE_LARGE below. */
   CURLOPT(CURLOPT_MAXFILESIZE, CURLOPTTYPE_LONG, 114),
 
   /* See the comment for INFILESIZE above, but in short, specifies
@@ -1532,18 +1569,18 @@ typedef enum {
    */
   CURLOPT(CURLOPT_INFILESIZE_LARGE, CURLOPTTYPE_OFF_T, 115),
 
-  /* Sets the continuation offset.  There is also a CURLOPTTYPE_LONG version
+  /* Sets the continuation offset. There is also a CURLOPTTYPE_LONG version
    * of this; look above for RESUME_FROM.
    */
   CURLOPT(CURLOPT_RESUME_FROM_LARGE, CURLOPTTYPE_OFF_T, 116),
 
-  /* Sets the maximum size of data that will be downloaded from
-   * an HTTP or FTP server.  See MAXFILESIZE above for the LONG version.
+  /* Sets the maximum size of data that is to be downloaded from
+   * an HTTP or FTP server. See MAXFILESIZE above for the LONG version.
    */
   CURLOPT(CURLOPT_MAXFILESIZE_LARGE, CURLOPTTYPE_OFF_T, 117),
 
-  /* Set this option to the file name of your .netrc file you want libcurl
-     to parse (using the CURLOPT_NETRC option). If not set, libcurl will do
+  /* Set this option to the filename of your .netrc file you want libcurl
+     to parse (using the CURLOPT_NETRC option). If not set, libcurl does
      a poor attempt to find the user's home directory and check for a .netrc
      file in there. */
   CURLOPT(CURLOPT_NETRC_FILE, CURLOPTTYPE_STRINGPOINT, 118),
@@ -1601,7 +1638,7 @@ typedef enum {
 
   /* Set to non-zero to skip the IP address received in a 227 PASV FTP server
      response. Typically used for FTP-SSL purposes but is not restricted to
-     that. libcurl will then instead use the same IP address it used for the
+     that. libcurl is then instead using the same IP address it used for the
      control connection. */
   CURLOPT(CURLOPT_FTP_SKIP_PASV_IP, CURLOPTTYPE_LONG, 137),
 
@@ -1613,7 +1650,7 @@ typedef enum {
   CURLOPT(CURLOPT_LOCALPORT, CURLOPTTYPE_LONG, 139),
 
   /* Number of ports to try, including the first one set with LOCALPORT.
-     Thus, setting it to 1 will make no additional attempts but the first.
+     Thus, setting it to 1 makes no additional attempts but the first.
   */
   CURLOPT(CURLOPT_LOCALPORTRANGE, CURLOPTTYPE_LONG, 140),
 
@@ -1621,19 +1658,19 @@ typedef enum {
      extracting it with CURLINFO_LASTSOCKET */
   CURLOPT(CURLOPT_CONNECT_ONLY, CURLOPTTYPE_LONG, 141),
 
-  /* Function that will be called to convert from the
+  /* Function that is called to convert from the
      network encoding (instead of using the iconv calls in libcurl) */
   CURLOPTDEPRECATED(CURLOPT_CONV_FROM_NETWORK_FUNCTION,
                     CURLOPTTYPE_FUNCTIONPOINT, 142,
                     7.82.0, "Serves no purpose anymore"),
 
-  /* Function that will be called to convert to the
+  /* Function that is called to convert to the
      network encoding (instead of using the iconv calls in libcurl) */
   CURLOPTDEPRECATED(CURLOPT_CONV_TO_NETWORK_FUNCTION,
                     CURLOPTTYPE_FUNCTIONPOINT, 143,
                     7.82.0, "Serves no purpose anymore"),
 
-  /* Function that will be called to convert from UTF8
+  /* Function that is called to convert from UTF8
      (instead of using the iconv calls in libcurl)
      Note that this is used only for SSL certificate processing */
   CURLOPTDEPRECATED(CURLOPT_CONV_FROM_UTF8_FUNCTION,
@@ -1652,7 +1689,7 @@ typedef enum {
   CURLOPT(CURLOPT_SOCKOPTFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 148),
   CURLOPT(CURLOPT_SOCKOPTDATA, CURLOPTTYPE_CBPOINT, 149),
 
-  /* set to 0 to disable session ID re-use for this transfer, default is
+  /* set to 0 to disable session ID reuse for this transfer, default is
      enabled (== 1) */
   CURLOPT(CURLOPT_SSL_SESSIONID_CACHE, CURLOPTTYPE_LONG, 150),
 
@@ -1689,7 +1726,7 @@ typedef enum {
 
   /* Callback function for opening socket (instead of socket(2)). Optionally,
      callback is able change the address or refuse to connect returning
-     CURL_SOCKET_BAD.  The callback should have type
+     CURL_SOCKET_BAD. The callback should have type
      curl_opensocket_callback */
   CURLOPT(CURLOPT_OPENSOCKETFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 163),
   CURLOPT(CURLOPT_OPENSOCKETDATA, CURLOPTTYPE_CBPOINT, 164),
@@ -1727,9 +1764,9 @@ typedef enum {
 
   /* Comma separated list of hostnames defining no-proxy zones. These should
      match both hostnames directly, and hostnames within a domain. For
-     example, local.com will match local.com and www.local.com, but NOT
+     example, local.com matches local.com and www.local.com, but NOT
      notlocal.com or www.notlocal.com. For compatibility with other
-     implementations of this, .local.com will be considered to be the same as
+     implementations of this, .local.com is considered to be the same as
      local.com. A single * is the only valid wildcard, and effectively
      disables the use of proxy. */
   CURLOPT(CURLOPT_NOPROXY, CURLOPTTYPE_STRINGPOINT, 177),
@@ -1759,7 +1796,7 @@ typedef enum {
   CURLOPTDEPRECATED(CURLOPT_REDIR_PROTOCOLS, CURLOPTTYPE_LONG, 182,
                     7.85.0, "Use CURLOPT_REDIR_PROTOCOLS_STR"),
 
-  /* set the SSH knownhost file name to use */
+  /* set the SSH knownhost filename to use */
   CURLOPT(CURLOPT_SSH_KNOWNHOSTS, CURLOPTTYPE_STRINGPOINT, 183),
 
   /* set the SSH host key callback, must point to a curl_sshkeycallback
@@ -1839,11 +1876,9 @@ typedef enum {
      in outgoing requests. The current default is 0, but it might change in a
      future libcurl release.
 
-     libcurl will ask for the compressed methods it knows of, and if that
-     isn't any, it will not ask for transfer-encoding at all even if this
-     option is set to 1.
-
-  */
+     libcurl asks for the compressed methods it knows of, and if that
+     is not any, it does not ask for transfer-encoding at all even if this
+     option is set to 1. */
   CURLOPT(CURLOPT_TRANSFER_ENCODING, CURLOPTTYPE_LONG, 207),
 
   /* Callback function for closing socket (instead of close(2)). The callback
@@ -1854,7 +1889,8 @@ typedef enum {
   /* allow GSSAPI credential delegation */
   CURLOPT(CURLOPT_GSSAPI_DELEGATION, CURLOPTTYPE_VALUES, 210),
 
-  /* Set the name servers to use for DNS resolution */
+  /* Set the name servers to use for DNS resolution.
+   * Only supported by the c-ares DNS backend */
   CURLOPT(CURLOPT_DNS_SERVERS, CURLOPTTYPE_STRINGPOINT, 211),
 
   /* Time-out accept operations (currently for FTP only) after this amount
@@ -1877,7 +1913,7 @@ typedef enum {
   /* Enable/disable SASL initial response */
   CURLOPT(CURLOPT_SASL_IR, CURLOPTTYPE_LONG, 218),
 
-  /* Function that will be called instead of the internal progress display
+  /* Function that is called instead of the internal progress display
    * function. This function should be defined as the curl_xferinfo_callback
    * prototype defines. (Deprecates CURLOPT_PROGRESSFUNCTION) */
   CURLOPT(CURLOPT_XFERINFOFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 219),
@@ -1901,11 +1937,11 @@ typedef enum {
   /* Set authentication options directly */
   CURLOPT(CURLOPT_LOGIN_OPTIONS, CURLOPTTYPE_STRINGPOINT, 224),
 
-  /* Enable/disable TLS NPN extension (http2 over ssl might fail without) */
+  /* Enable/disable TLS NPN extension (http2 over SSL might fail without) */
   CURLOPTDEPRECATED(CURLOPT_SSL_ENABLE_NPN, CURLOPTTYPE_LONG, 225,
                     7.86.0, "Has no function"),
 
-  /* Enable/disable TLS ALPN extension (http2 over ssl might fail without) */
+  /* Enable/disable TLS ALPN extension (http2 over SSL might fail without) */
   CURLOPT(CURLOPT_SSL_ENABLE_ALPN, CURLOPTTYPE_LONG, 226),
 
   /* Time to wait for a response to an HTTP request containing an
@@ -1919,8 +1955,7 @@ typedef enum {
   /* Pass in a bitmask of "header options" */
   CURLOPT(CURLOPT_HEADEROPT, CURLOPTTYPE_VALUES, 229),
 
-  /* The public key in DER form used to validate the peer public key
-     this option is used only if SSL_VERIFYPEER is true */
+  /* The public key used to validate the peer public key */
   CURLOPT(CURLOPT_PINNEDPUBLICKEY, CURLOPTTYPE_STRINGPOINT, 230),
 
   /* Path to Unix domain socket */
@@ -1930,7 +1965,8 @@ typedef enum {
   CURLOPT(CURLOPT_SSL_VERIFYSTATUS, CURLOPTTYPE_LONG, 232),
 
   /* Set if we should enable TLS false start. */
-  CURLOPT(CURLOPT_SSL_FALSESTART, CURLOPTTYPE_LONG, 233),
+  CURLOPTDEPRECATED(CURLOPT_SSL_FALSESTART, CURLOPTTYPE_LONG, 233,
+                    8.15.0, "Has no function"),
 
   /* Do not squash dot-dot sequences */
   CURLOPT(CURLOPT_PATH_AS_IS, CURLOPTTYPE_LONG, 234),
@@ -1941,7 +1977,7 @@ typedef enum {
   /* Service Name */
   CURLOPT(CURLOPT_SERVICE_NAME, CURLOPTTYPE_STRINGPOINT, 236),
 
-  /* Wait/don't wait for pipe/mutex to clarify */
+  /* Wait/do not wait for pipe/mutex to clarify */
   CURLOPT(CURLOPT_PIPEWAIT, CURLOPTTYPE_LONG, 237),
 
   /* Set the protocol used when curl is given a URL without a protocol */
@@ -1950,11 +1986,13 @@ typedef enum {
   /* Set stream weight, 1 - 256 (default is 16) */
   CURLOPT(CURLOPT_STREAM_WEIGHT, CURLOPTTYPE_LONG, 239),
 
-  /* Set stream dependency on another CURL handle */
-  CURLOPT(CURLOPT_STREAM_DEPENDS, CURLOPTTYPE_OBJECTPOINT, 240),
+  /* Set stream dependency on another curl handle */
+  CURLOPTDEPRECATED(CURLOPT_STREAM_DEPENDS, CURLOPTTYPE_OBJECTPOINT, 240,
+                    8.21.0, "Has no function"),
 
-  /* Set E-xclusive stream dependency on another CURL handle */
-  CURLOPT(CURLOPT_STREAM_DEPENDS_E, CURLOPTTYPE_OBJECTPOINT, 241),
+  /* Set E-xclusive stream dependency on another curl handle */
+  CURLOPTDEPRECATED(CURLOPT_STREAM_DEPENDS_E, CURLOPTTYPE_OBJECTPOINT, 241,
+                    8.21.0, "Has no function"),
 
   /* Do not send any tftp option requests to the server */
   CURLOPT(CURLOPT_TFTP_NO_OPTIONS, CURLOPTTYPE_LONG, 242),
@@ -1978,11 +2016,11 @@ typedef enum {
      this option is used only if PROXY_SSL_VERIFYPEER is true */
   CURLOPT(CURLOPT_PROXY_CAPATH, CURLOPTTYPE_STRINGPOINT, 247),
 
-  /* Set if we should verify the proxy in ssl handshake,
+  /* Set if we should verify the proxy in SSL handshake,
      set 1 to verify. */
   CURLOPT(CURLOPT_PROXY_SSL_VERIFYPEER, CURLOPTTYPE_LONG, 248),
 
-  /* Set if we should verify the Common name from the proxy certificate in ssl
+  /* Set if we should verify the Common name from the proxy certificate in SSL
    * handshake, set 1 to check existence, 2 to ensure that it matches
    * the provided hostname. */
   CURLOPT(CURLOPT_PROXY_SSL_VERIFYHOST, CURLOPTTYPE_LONG, 249),
@@ -2017,7 +2055,7 @@ typedef enum {
   /* password for the SSL private key for proxy */
   CURLOPT(CURLOPT_PROXY_KEYPASSWD, CURLOPTTYPE_STRINGPOINT, 258),
 
-  /* Specify which SSL ciphers to use for proxy */
+  /* Specify which TLS 1.2 (1.1, 1.0) ciphers to use for proxy */
   CURLOPT(CURLOPT_PROXY_SSL_CIPHER_LIST, CURLOPTTYPE_STRINGPOINT, 259),
 
   /* CRL file for proxy */
@@ -2059,7 +2097,7 @@ typedef enum {
   /* Head start in milliseconds to give happy eyeballs. */
   CURLOPT(CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS, CURLOPTTYPE_LONG, 271),
 
-  /* Function that will be called before a resolver request is made */
+  /* Function that is called before a resolver request is made */
   CURLOPT(CURLOPT_RESOLVER_START_FUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 272),
 
   /* User data to pass to the resolver start callback. */
@@ -2090,7 +2128,7 @@ typedef enum {
   /* Specify URL using CURL URL API. */
   CURLOPT(CURLOPT_CURLU, CURLOPTTYPE_OBJECTPOINT, 282),
 
-  /* add trailing data just after no more data is available */
+  /* add trailing data after no more data is available */
   CURLOPT(CURLOPT_TRAILERFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 283),
 
   /* pointer to be passed to HTTP_TRAILER_FUNCTION */
@@ -2102,7 +2140,7 @@ typedef enum {
   /* alt-svc control bitmask */
   CURLOPT(CURLOPT_ALTSVC_CTRL, CURLOPTTYPE_LONG, 286),
 
-  /* alt-svc cache file name to possibly read from/write to */
+  /* alt-svc cache filename to possibly read from/write to */
   CURLOPT(CURLOPT_ALTSVC, CURLOPTTYPE_STRINGPOINT, 287),
 
   /* maximum age (idle time) of a connection to consider it for reuse
@@ -2128,13 +2166,13 @@ typedef enum {
 
   /* the EC curves requested by the TLS client (RFC 8422, 5.1);
    * OpenSSL support via 'set_groups'/'set_curves':
-   * https://www.openssl.org/docs/manmaster/man3/SSL_CTX_set1_groups.html
+   * https://docs.openssl.org/master/man3/SSL_CTX_set1_curves/
    */
   CURLOPT(CURLOPT_SSL_EC_CURVES, CURLOPTTYPE_STRINGPOINT, 298),
 
   /* HSTS bitmask */
   CURLOPT(CURLOPT_HSTS_CTRL, CURLOPTTYPE_LONG, 299),
-  /* HSTS file name */
+  /* HSTS filename */
   CURLOPT(CURLOPT_HSTS, CURLOPTTYPE_STRINGPOINT, 300),
 
   /* HSTS read callback */
@@ -2168,8 +2206,8 @@ typedef enum {
   /* used by scp/sftp to verify the host's public key */
   CURLOPT(CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256, CURLOPTTYPE_STRINGPOINT, 311),
 
-  /* Function that will be called immediately before the initial request
-     is made on a connection (after any protocol negotiation step).  */
+  /* Function that is called immediately before the initial request
+     is made on a connection (after any protocol negotiation step). */
   CURLOPT(CURLOPT_PREREQFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 312),
 
   /* Data passed to the CURLOPT_PREREQFUNCTION callback */
@@ -2198,7 +2236,7 @@ typedef enum {
   /* specify which protocols that libcurl is allowed to follow directs to */
   CURLOPT(CURLOPT_REDIR_PROTOCOLS_STR, CURLOPTTYPE_STRINGPOINT, 319),
 
-  /* websockets options */
+  /* WebSockets options */
   CURLOPT(CURLOPT_WS_OPTIONS, CURLOPTTYPE_LONG, 320),
 
   /* CA cache timeout */
@@ -2210,6 +2248,20 @@ typedef enum {
   /* set a specific client IP for HAProxy PROXY protocol header? */
   CURLOPT(CURLOPT_HAPROXY_CLIENT_IP, CURLOPTTYPE_STRINGPOINT, 323),
 
+  /* millisecond version */
+  CURLOPT(CURLOPT_SERVER_RESPONSE_TIMEOUT_MS, CURLOPTTYPE_LONG, 324),
+
+  /* set ECH configuration */
+  CURLOPT(CURLOPT_ECH, CURLOPTTYPE_STRINGPOINT, 325),
+
+  /* maximum number of keepalive probes (Linux, *BSD, macOS, etc.) */
+  CURLOPT(CURLOPT_TCP_KEEPCNT, CURLOPTTYPE_LONG, 326),
+
+  CURLOPT(CURLOPT_UPLOAD_FLAGS, CURLOPTTYPE_LONG, 327),
+
+  /* set TLS supported signature algorithms */
+  CURLOPT(CURLOPT_SSL_SIGNATURE_ALGORITHMS, CURLOPTTYPE_STRINGPOINT, 328),
+
   CURLOPT_LASTENTRY /* the last unused */
 } CURLoption;
 
@@ -2235,7 +2287,6 @@ typedef enum {
 #define CURLOPT_SSLCERTPASSWD CURLOPT_KEYPASSWD
 #define CURLOPT_KRB4LEVEL CURLOPT_KRBLEVEL
 
-/* */
 #define CURLOPT_FTP_RESPONSE_TIMEOUT CURLOPT_SERVER_RESPONSE_TIMEOUT
 
 /* Added in 8.2.0 */
@@ -2246,38 +2297,36 @@ typedef enum {
 #undef CURLOPT_DNS_USE_GLOBAL_CACHE /* soon obsolete */
 #endif
 
-
-  /* Below here follows defines for the CURLOPT_IPRESOLVE option. If a host
-     name resolves addresses using more than one IP protocol version, this
-     option might be handy to force libcurl to use a specific IP version. */
-#define CURL_IPRESOLVE_WHATEVER 0 /* default, uses addresses to all IP
+/* Below here follows defines for the CURLOPT_IPRESOLVE option. If a host
+   name resolves addresses using more than one IP protocol version, this
+   option might be handy to force libcurl to use a specific IP version. */
+#define CURL_IPRESOLVE_WHATEVER 0L /* default, uses addresses to all IP
                                      versions that your system allows */
-#define CURL_IPRESOLVE_V4       1 /* uses only IPv4 addresses/connections */
-#define CURL_IPRESOLVE_V6       2 /* uses only IPv6 addresses/connections */
+#define CURL_IPRESOLVE_V4       1L /* uses only IPv4 addresses/connections */
+#define CURL_IPRESOLVE_V6       2L /* uses only IPv6 addresses/connections */
 
   /* Convenient "aliases" */
 #define CURLOPT_RTSPHEADER CURLOPT_HTTPHEADER
 
-  /* These enums are for use with the CURLOPT_HTTP_VERSION option. */
-enum {
-  CURL_HTTP_VERSION_NONE, /* setting this means we don't care, and that we'd
-                             like the library to choose the best possible
-                             for us! */
-  CURL_HTTP_VERSION_1_0,  /* please use HTTP 1.0 in the request */
-  CURL_HTTP_VERSION_1_1,  /* please use HTTP 1.1 in the request */
-  CURL_HTTP_VERSION_2_0,  /* please use HTTP 2 in the request */
-  CURL_HTTP_VERSION_2TLS, /* use version 2 for HTTPS, version 1.1 for HTTP */
-  CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE,  /* please use HTTP 2 without HTTP/1.1
-                                           Upgrade */
-  CURL_HTTP_VERSION_3 = 30, /* Use HTTP/3, fallback to HTTP/2 or HTTP/1 if
-                               needed. For HTTPS only. For HTTP, this option
-                               makes libcurl return error. */
-  CURL_HTTP_VERSION_3ONLY = 31, /* Use HTTP/3 without fallback. For HTTPS
-                                   only. For HTTP, this makes libcurl
-                                   return error. */
-
-  CURL_HTTP_VERSION_LAST /* *ILLEGAL* http version */
-};
+/* These constants are for use with the CURLOPT_HTTP_VERSION option. */
+#define CURL_HTTP_VERSION_NONE  0L /* setting this means we do not care, and
+                                      that we would like the library to choose
+                                      the best possible for us! */
+#define CURL_HTTP_VERSION_1_0   1L /* please use HTTP 1.0 in the request */
+#define CURL_HTTP_VERSION_1_1   2L /* please use HTTP 1.1 in the request */
+#define CURL_HTTP_VERSION_2_0   3L /* please use HTTP 2 in the request */
+#define CURL_HTTP_VERSION_2TLS  4L /* use version 2 for HTTPS, version 1.1 for
+                                      HTTP */
+#define CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE 5L /* please use HTTP 2 without
+                                                  HTTP/1.1 Upgrade */
+#define CURL_HTTP_VERSION_3     30L /* Use HTTP/3, fallback to HTTP/2 or
+                                       HTTP/1 if needed. For HTTPS only. For
+                                       HTTP, this option makes libcurl
+                                       return error. */
+#define CURL_HTTP_VERSION_3ONLY 31L /* Use HTTP/3 without fallback. For
+                                       HTTPS only. For HTTP, this makes
+                                       libcurl return error. */
+#define CURL_HTTP_VERSION_LAST  32L /* *ILLEGAL* http version */
 
 /* Convenience definition simple because the name of the version is HTTP/2 and
    not 2.0. The 2_0 version of the enum name was set while the version was
@@ -2287,63 +2336,63 @@ enum {
 /*
  * Public API enums for RTSP requests
  */
-enum {
-    CURL_RTSPREQ_NONE, /* first in list */
-    CURL_RTSPREQ_OPTIONS,
-    CURL_RTSPREQ_DESCRIBE,
-    CURL_RTSPREQ_ANNOUNCE,
-    CURL_RTSPREQ_SETUP,
-    CURL_RTSPREQ_PLAY,
-    CURL_RTSPREQ_PAUSE,
-    CURL_RTSPREQ_TEARDOWN,
-    CURL_RTSPREQ_GET_PARAMETER,
-    CURL_RTSPREQ_SET_PARAMETER,
-    CURL_RTSPREQ_RECORD,
-    CURL_RTSPREQ_RECEIVE,
-    CURL_RTSPREQ_LAST /* last in list */
-};
+
+#define CURL_RTSPREQ_NONE          0L
+#define CURL_RTSPREQ_OPTIONS       1L
+#define CURL_RTSPREQ_DESCRIBE      2L
+#define CURL_RTSPREQ_ANNOUNCE      3L
+#define CURL_RTSPREQ_SETUP         4L
+#define CURL_RTSPREQ_PLAY          5L
+#define CURL_RTSPREQ_PAUSE         6L
+#define CURL_RTSPREQ_TEARDOWN      7L
+#define CURL_RTSPREQ_GET_PARAMETER 8L
+#define CURL_RTSPREQ_SET_PARAMETER 9L
+#define CURL_RTSPREQ_RECORD        10L
+#define CURL_RTSPREQ_RECEIVE       11L
+#define CURL_RTSPREQ_LAST          12L /* not used */
 
   /* These enums are for use with the CURLOPT_NETRC option. */
+#define CURL_NETRC_IGNORED  0L /* The .netrc is never read.
+                                  This is the default. */
+#define CURL_NETRC_OPTIONAL 1L /* A user:password in the URL is preferred
+                                  to one in the .netrc. */
+#define CURL_NETRC_REQUIRED 2L /* A user:password in the URL is ignored.
+                                  Unless one is set programmatically, the
+                                  .netrc is queried. */
 enum CURL_NETRC_OPTION {
-  CURL_NETRC_IGNORED,     /* The .netrc will never be read.
-                           * This is the default. */
-  CURL_NETRC_OPTIONAL,    /* A user:password in the URL will be preferred
-                           * to one in the .netrc. */
-  CURL_NETRC_REQUIRED,    /* A user:password in the URL will be ignored.
-                           * Unless one is set programmatically, the .netrc
-                           * will be queried. */
-  CURL_NETRC_LAST
+  /* we set a single member here, to make sure we still provide the enum, but
+     the values to use are defined above with L suffixes */
+  CURL_NETRC_LAST = 3
 };
 
-enum {
-  CURL_SSLVERSION_DEFAULT,
-  CURL_SSLVERSION_TLSv1, /* TLS 1.x */
-  CURL_SSLVERSION_SSLv2,
-  CURL_SSLVERSION_SSLv3,
-  CURL_SSLVERSION_TLSv1_0,
-  CURL_SSLVERSION_TLSv1_1,
-  CURL_SSLVERSION_TLSv1_2,
-  CURL_SSLVERSION_TLSv1_3,
+#define CURL_SSLVERSION_DEFAULT 0L
+#define CURL_SSLVERSION_TLSv1   1L /* TLS 1.x */
+#define CURL_SSLVERSION_SSLv2   2L
+#define CURL_SSLVERSION_SSLv3   3L
+#define CURL_SSLVERSION_TLSv1_0 4L
+#define CURL_SSLVERSION_TLSv1_1 5L
+#define CURL_SSLVERSION_TLSv1_2 6L
+#define CURL_SSLVERSION_TLSv1_3 7L
 
-  CURL_SSLVERSION_LAST /* never use, keep last */
-};
+#define CURL_SSLVERSION_LAST    8L /* never use, keep last */
 
-enum {
-  CURL_SSLVERSION_MAX_NONE =     0,
-  CURL_SSLVERSION_MAX_DEFAULT =  (CURL_SSLVERSION_TLSv1   << 16),
-  CURL_SSLVERSION_MAX_TLSv1_0 =  (CURL_SSLVERSION_TLSv1_0 << 16),
-  CURL_SSLVERSION_MAX_TLSv1_1 =  (CURL_SSLVERSION_TLSv1_1 << 16),
-  CURL_SSLVERSION_MAX_TLSv1_2 =  (CURL_SSLVERSION_TLSv1_2 << 16),
-  CURL_SSLVERSION_MAX_TLSv1_3 =  (CURL_SSLVERSION_TLSv1_3 << 16),
+#define CURL_SSLVERSION_MAX_NONE 0L
+#define CURL_SSLVERSION_MAX_DEFAULT (CURL_SSLVERSION_TLSv1   << 16)
+#define CURL_SSLVERSION_MAX_TLSv1_0 (CURL_SSLVERSION_TLSv1_0 << 16)
+#define CURL_SSLVERSION_MAX_TLSv1_1 (CURL_SSLVERSION_TLSv1_1 << 16)
+#define CURL_SSLVERSION_MAX_TLSv1_2 (CURL_SSLVERSION_TLSv1_2 << 16)
+#define CURL_SSLVERSION_MAX_TLSv1_3 (CURL_SSLVERSION_TLSv1_3 << 16)
 
-  /* never use, keep last */
-  CURL_SSLVERSION_MAX_LAST =     (CURL_SSLVERSION_LAST    << 16)
-};
+/* never use, keep last */
+#define CURL_SSLVERSION_MAX_LAST    (CURL_SSLVERSION_LAST    << 16)
+
+#define CURL_TLSAUTH_NONE 0L
+#define CURL_TLSAUTH_SRP  1L
 
 enum CURL_TLSAUTH {
-  CURL_TLSAUTH_NONE,
-  CURL_TLSAUTH_SRP,
-  CURL_TLSAUTH_LAST /* never use, keep last */
+  /* we set a single member here, to make sure we still provide the enum,
+     but the values to use are defined above with L suffixes */
+  CURL_TLSAUTH_LAST = 2
 };
 
 /* symbols to use with CURLOPT_POSTREDIR.
@@ -2351,25 +2400,27 @@ enum CURL_TLSAUTH {
    can be bitwise ORed so that CURL_REDIR_POST_301 | CURL_REDIR_POST_302
    | CURL_REDIR_POST_303 == CURL_REDIR_POST_ALL */
 
-#define CURL_REDIR_GET_ALL  0
-#define CURL_REDIR_POST_301 1
-#define CURL_REDIR_POST_302 2
-#define CURL_REDIR_POST_303 4
+#define CURL_REDIR_GET_ALL  0L
+#define CURL_REDIR_POST_301 1L
+#define CURL_REDIR_POST_302 2L
+#define CURL_REDIR_POST_303 4L
 #define CURL_REDIR_POST_ALL \
-    (CURL_REDIR_POST_301|CURL_REDIR_POST_302|CURL_REDIR_POST_303)
+  (CURL_REDIR_POST_301 | CURL_REDIR_POST_302 | CURL_REDIR_POST_303)
+
+#define CURL_TIMECOND_NONE         0L
+#define CURL_TIMECOND_IFMODSINCE   1L
+#define CURL_TIMECOND_IFUNMODSINCE 2L
+#define CURL_TIMECOND_LASTMOD      3L
 
 typedef enum {
-  CURL_TIMECOND_NONE,
-
-  CURL_TIMECOND_IFMODSINCE,
-  CURL_TIMECOND_IFUNMODSINCE,
-  CURL_TIMECOND_LASTMOD,
-
-  CURL_TIMECOND_LAST
+  /* we set a single member here, to make sure we still provide
+     the enum typedef, but the values to use are defined above with L
+     suffixes */
+  CURL_TIMECOND_LAST = 4
 } curl_TimeCond;
 
 /* Special size_t value signaling a null-terminated string. */
-#define CURL_ZERO_TERMINATED ((size_t) -1)
+#define CURL_ZERO_TERMINATED ((size_t)-1)
 
 /* curl_strequal() and curl_strnequal() are subject for removal in a future
    release */
@@ -2381,7 +2432,7 @@ typedef struct curl_mime      curl_mime;      /* Mime context. */
 typedef struct curl_mimepart  curl_mimepart;  /* Mime part context. */
 
 /* CURLMIMEOPT_ defines are for the CURLOPT_MIME_OPTIONS option. */
-#define CURLMIMEOPT_FORMESCAPE  (1<<0) /* Use backslash-escaping for forms. */
+#define CURLMIMEOPT_FORMESCAPE (1L << 0) /* Use backslash-escaping for forms */
 
 /*
  * NAME curl_mime_init()
@@ -2426,7 +2477,7 @@ CURL_EXTERN CURLcode curl_mime_name(curl_mimepart *part, const char *name);
  *
  * DESCRIPTION
  *
- * Set mime part remote file name.
+ * Set mime part remote filename.
  */
 CURL_EXTERN CURLcode curl_mime_filename(curl_mimepart *part,
                                         const char *filename);
@@ -2588,7 +2639,7 @@ curl_formadd(struct curl_httppost **httppost,
 
 /*
  * callback function for curl_formget()
- * The void *arg pointer will be the one passed as second argument to
+ * The void *arg pointer is the one passed as second argument to
  *   curl_formget().
  * The character buffer passed to it must not be freed.
  * Should return the buffer length passed to it as the argument "len" on
@@ -2603,7 +2654,7 @@ typedef size_t (*curl_formget_callback)(void *arg, const char *buf,
  * DESCRIPTION
  *
  * Serialize a curl_httppost struct built with curl_formadd().
- * Accepts a void pointer as second argument which will be passed to
+ * Accepts a void pointer as second argument which is passed to
  * the curl_formget_callback function.
  * Returns 0 on success.
  */
@@ -2635,7 +2686,7 @@ CURL_EXTERN char *curl_getenv(const char *variable);
  *
  * DESCRIPTION
  *
- * Returns a static ascii string of the libcurl version.
+ * Returns a static ASCII string of the libcurl version.
  */
 CURL_EXTERN char *curl_version(void);
 
@@ -2648,7 +2699,7 @@ CURL_EXTERN char *curl_version(void);
  * %XX versions). This function returns a new allocated string or NULL if an
  * error occurred.
  */
-CURL_EXTERN char *curl_easy_escape(CURL *handle,
+CURL_EXTERN char *curl_easy_escape(CURL *curl,
                                    const char *string,
                                    int length);
 
@@ -2656,21 +2707,20 @@ CURL_EXTERN char *curl_easy_escape(CURL *handle,
 CURL_EXTERN char *curl_escape(const char *string,
                               int length);
 
-
 /*
  * NAME curl_easy_unescape()
  *
  * DESCRIPTION
  *
- * Unescapes URL encoding in strings (converts all %XX codes to their 8bit
+ * Unescapes URL encoding in strings (converts all %XX codes to their 8-bit
  * versions). This function returns a new allocated string or NULL if an error
  * occurred.
  * Conversion Note: On non-ASCII platforms the ASCII %XX codes are
  * converted into the host encoding.
  */
-CURL_EXTERN char *curl_easy_unescape(CURL *handle,
+CURL_EXTERN char *curl_easy_unescape(CURL *curl,
                                      const char *string,
-                                     int length,
+                                     int inlength,
                                      int *outlength);
 
 /* the previous version */
@@ -2694,10 +2744,9 @@ CURL_EXTERN void curl_free(void *p);
  *
  * curl_global_init() should be invoked exactly once for each application that
  * uses libcurl and before any call of other libcurl functions.
-
+ *
  * This function is thread-safe if CURL_VERSION_THREADSAFE is set in the
  * curl_version_info_data.features flag (fetch by curl_version_info()).
-
  */
 CURL_EXTERN CURLcode curl_global_init(long flags);
 
@@ -2707,11 +2756,11 @@ CURL_EXTERN CURLcode curl_global_init(long flags);
  * DESCRIPTION
  *
  * curl_global_init() or curl_global_init_mem() should be invoked exactly once
- * for each application that uses libcurl.  This function can be used to
+ * for each application that uses libcurl. This function can be used to
  * initialize libcurl and set user defined memory management callback
- * functions.  Users can implement memory management routines to check for
- * memory leaks, check for mis-use of the curl library etc.  User registered
- * callback routines will be invoked by this library instead of the system
+ * functions. Users can implement memory management routines to check for
+ * memory leaks, check for misuse of the curl library etc. User registered
+ * callback routines is invoked by this library instead of the system
  * memory management routines like malloc, free etc.
  */
 CURL_EXTERN CURLcode curl_global_init_mem(long flags,
@@ -2738,10 +2787,9 @@ CURL_EXTERN void curl_global_cleanup(void);
  *
  * curl_global_trace() can be invoked at application start to
  * configure which components in curl should participate in tracing.
-
+ *
  * This function is thread-safe if CURL_VERSION_THREADSAFE is set in the
  * curl_version_info_data.features flag (fetch by curl_version_info()).
-
  */
 CURL_EXTERN CURLcode curl_global_trace(const char *config);
 
@@ -2761,20 +2809,20 @@ struct curl_slist {
  * *before* curl_global_init().
  *
  * The backend can be identified by the id (e.g. CURLSSLBACKEND_OPENSSL). The
- * backend can also be specified via the name parameter (passing -1 as id).
- * If both id and name are specified, the name will be ignored. If neither id
- * nor name are specified, the function will fail with
- * CURLSSLSET_UNKNOWN_BACKEND and set the "avail" pointer to the
- * NULL-terminated list of available backends.
+ * backend can also be specified via the name parameter (passing -1 as id). If
+ * both id and name are specified, the name is ignored. If neither id nor
+ * name are specified, the function fails with CURLSSLSET_UNKNOWN_BACKEND
+ * and set the "avail" pointer to the null-terminated list of available
+ * backends.
  *
  * Upon success, the function returns CURLSSLSET_OK.
  *
  * If the specified SSL backend is not available, the function returns
- * CURLSSLSET_UNKNOWN_BACKEND and sets the "avail" pointer to a NULL-terminated
- * list of available SSL backends.
+ * CURLSSLSET_UNKNOWN_BACKEND and sets the "avail" pointer to a
+ * null-terminated list of available SSL backends.
  *
  * The SSL backend can be set only once. If it has already been set, a
- * subsequent attempt to change it will result in a CURLSSLSET_TOO_LATE.
+ * subsequent attempt to change it results in a CURLSSLSET_TOO_LATE.
  */
 
 struct curl_ssl_backend {
@@ -2798,8 +2846,8 @@ CURL_EXTERN CURLsslset curl_global_sslset(curl_sslbackend id, const char *name,
  *
  * DESCRIPTION
  *
- * Appends a string to a linked list. If no list exists, it will be created
- * first. Returns the new list, after appending.
+ * Appends a string to a linked list. If no list exists, it is created first.
+ * Returns the new list, after appending.
  */
 CURL_EXTERN struct curl_slist *curl_slist_append(struct curl_slist *list,
                                                  const char *data);
@@ -2828,7 +2876,7 @@ CURL_EXTERN time_t curl_getdate(const char *p, const time_t *unused);
    for with CURLOPT_CERTINFO / CURLINFO_CERTINFO */
 struct curl_certinfo {
   int num_of_certs;             /* number of certificates with information */
-  struct curl_slist **certinfo; /* for each index in this array, there's a
+  struct curl_slist **certinfo; /* for each index in this array, there is a
                                    linked list with textual information for a
                                    certificate in the format "name:content".
                                    eg "Subject:foo", "Issuer:bar", etc. */
@@ -2941,7 +2989,14 @@ typedef enum {
   CURLINFO_CAPATH           = CURLINFO_STRING + 62,
   CURLINFO_XFER_ID          = CURLINFO_OFF_T + 63,
   CURLINFO_CONN_ID          = CURLINFO_OFF_T + 64,
-  CURLINFO_LASTONE          = 64
+  CURLINFO_QUEUE_TIME_T     = CURLINFO_OFF_T + 65,
+  CURLINFO_USED_PROXY       = CURLINFO_LONG + 66,
+  CURLINFO_POSTTRANSFER_TIME_T = CURLINFO_OFF_T + 67,
+  CURLINFO_EARLYDATA_SENT_T = CURLINFO_OFF_T + 68,
+  CURLINFO_HTTPAUTH_USED    = CURLINFO_LONG + 69,
+  CURLINFO_PROXYAUTH_USED   = CURLINFO_LONG + 70,
+  CURLINFO_SIZE_DELIVERED   = CURLINFO_OFF_T + 71,
+  CURLINFO_LASTONE          = 71
 } CURLINFO;
 
 /* CURLINFO_RESPONSE_CODE is the new name for the option previously known as
@@ -2960,13 +3015,12 @@ typedef enum {
   CURLCLOSEPOLICY_LAST /* last, never use this */
 } curl_closepolicy;
 
-#define CURL_GLOBAL_SSL (1<<0) /* no purpose since 7.57.0 */
-#define CURL_GLOBAL_WIN32 (1<<1)
-#define CURL_GLOBAL_ALL (CURL_GLOBAL_SSL|CURL_GLOBAL_WIN32)
+#define CURL_GLOBAL_SSL (1 << 0) /* no purpose since 7.57.0 */
+#define CURL_GLOBAL_WIN32 (1 << 1)
+#define CURL_GLOBAL_ALL (CURL_GLOBAL_SSL | CURL_GLOBAL_WIN32)
 #define CURL_GLOBAL_NOTHING 0
 #define CURL_GLOBAL_DEFAULT CURL_GLOBAL_ALL
-#define CURL_GLOBAL_ACK_EINTR (1<<2)
-
+#define CURL_GLOBAL_ACK_EINTR (1 << 2)
 
 /*****************************************************************************
  * Setup defines, protos etc for the sharing stuff.
@@ -2975,9 +3029,8 @@ typedef enum {
 /* Different data locks for a single share */
 typedef enum {
   CURL_LOCK_DATA_NONE = 0,
-  /*  CURL_LOCK_DATA_SHARE is used internally to say that
-   *  the locking is just made to change the internal state of the share
-   *  itself.
+  /*  CURL_LOCK_DATA_SHARE is used internally to say that the locking is made
+   *  to change the internal state of the share itself.
    */
   CURL_LOCK_DATA_SHARE,
   CURL_LOCK_DATA_COOKIE,
@@ -3005,7 +3058,6 @@ typedef void (*curl_unlock_function)(CURL *handle,
                                      curl_lock_data data,
                                      void *userptr);
 
-
 typedef enum {
   CURLSHE_OK,  /* all is fine */
   CURLSHE_BAD_OPTION, /* 1 */
@@ -3017,7 +3069,7 @@ typedef enum {
 } CURLSHcode;
 
 typedef enum {
-  CURLSHOPT_NONE,  /* don't use */
+  CURLSHOPT_NONE,  /* do not use */
   CURLSHOPT_SHARE,   /* specify a data type to share */
   CURLSHOPT_UNSHARE, /* specify which data type to stop sharing */
   CURLSHOPT_LOCKFUNC,   /* pass in a 'curl_lock_function' pointer */
@@ -3028,35 +3080,34 @@ typedef enum {
 } CURLSHoption;
 
 CURL_EXTERN CURLSH *curl_share_init(void);
-CURL_EXTERN CURLSHcode curl_share_setopt(CURLSH *share, CURLSHoption option,
-                                         ...);
-CURL_EXTERN CURLSHcode curl_share_cleanup(CURLSH *share);
+CURL_EXTERN CURLSHcode curl_share_setopt(CURLSH *sh, CURLSHoption option, ...);
+CURL_EXTERN CURLSHcode curl_share_cleanup(CURLSH *sh);
 
 /****************************************************************************
  * Structures for querying information about the curl library at runtime.
  */
 
 typedef enum {
-  CURLVERSION_FIRST,
-  CURLVERSION_SECOND,
-  CURLVERSION_THIRD,
-  CURLVERSION_FOURTH,
-  CURLVERSION_FIFTH,
-  CURLVERSION_SIXTH,
-  CURLVERSION_SEVENTH,
-  CURLVERSION_EIGHTH,
-  CURLVERSION_NINTH,
-  CURLVERSION_TENTH,
-  CURLVERSION_ELEVENTH,
+  CURLVERSION_FIRST,    /* 7.10 */
+  CURLVERSION_SECOND,   /* 7.11.1 */
+  CURLVERSION_THIRD,    /* 7.12.0 */
+  CURLVERSION_FOURTH,   /* 7.16.1 */
+  CURLVERSION_FIFTH,    /* 7.57.0 */
+  CURLVERSION_SIXTH,    /* 7.66.0 */
+  CURLVERSION_SEVENTH,  /* 7.70.0 */
+  CURLVERSION_EIGHTH,   /* 7.72.0 */
+  CURLVERSION_NINTH,    /* 7.75.0 */
+  CURLVERSION_TENTH,    /* 7.77.0 */
+  CURLVERSION_ELEVENTH, /* 7.87.0 */
+  CURLVERSION_TWELFTH,  /* 8.8.0 */
   CURLVERSION_LAST /* never actually use this */
 } CURLversion;
 
-/* The 'CURLVERSION_NOW' is the symbolic name meant to be used by
-   basically all programs ever that want to get version information. It is
-   meant to be a built-in version number for what kind of struct the caller
-   expects. If the struct ever changes, we redefine the NOW to another enum
-   from above. */
-#define CURLVERSION_NOW CURLVERSION_ELEVENTH
+/* The 'CURLVERSION_NOW' is the symbolic name meant to be used by programs
+   that want to get version information. It is meant to be a built-in
+   version number for what kind of struct the caller expects. If the struct
+   ever changes, we redefine the NOW to another enum from above. */
+#define CURLVERSION_NOW CURLVERSION_TWELFTH
 
 struct curl_version_info_data {
   CURLversion age;          /* age of the returned struct */
@@ -3116,6 +3167,9 @@ struct curl_version_info_data {
   /* These fields were added in CURLVERSION_ELEVENTH */
   /* feature_names is terminated by an entry with a NULL feature name */
   const char * const *feature_names;
+
+  /* These fields were added in CURLVERSION_TWELFTH */
+  const char *rtmp_version; /* human readable string. */
 };
 typedef struct curl_version_info_data curl_version_info_data;
 
@@ -3135,7 +3189,8 @@ typedef struct curl_version_info_data curl_version_info_data;
                                              supported */
 #define CURL_VERSION_SSPI         (1<<11) /* Built against Windows SSPI */
 #define CURL_VERSION_CONV         (1<<12) /* Character conversions supported */
-#define CURL_VERSION_CURLDEBUG    (1<<13) /* Debug memory tracking supported */
+#define CURL_VERSION_CURLDEBUG    (1<<13) /* Debug memory tracking supported
+                                             (deprecated) */
 #define CURL_VERSION_TLSAUTH_SRP  (1<<14) /* TLS-SRP auth is supported */
 #define CURL_VERSION_NTLM_WB      (1<<15) /* NTLM delegation to winbind helper
                                              is supported */
@@ -3156,7 +3211,7 @@ typedef struct curl_version_info_data curl_version_info_data;
 #define CURL_VERSION_GSASL        (1<<29) /* libgsasl is supported */
 #define CURL_VERSION_THREADSAFE   (1<<30) /* libcurl API is thread-safe */
 
- /*
+/*
  * NAME curl_version_info()
  *
  * DESCRIPTION
@@ -3164,7 +3219,7 @@ typedef struct curl_version_info_data curl_version_info_data;
  * This function returns a pointer to a static copy of the version info
  * struct. See above.
  */
-CURL_EXTERN curl_version_info_data *curl_version_info(CURLversion);
+CURL_EXTERN curl_version_info_data *curl_version_info(CURLversion stamp);
 
 /*
  * NAME curl_easy_strerror()
@@ -3172,10 +3227,10 @@ CURL_EXTERN curl_version_info_data *curl_version_info(CURLversion);
  * DESCRIPTION
  *
  * The curl_easy_strerror function may be used to turn a CURLcode value
- * into the equivalent human readable error string.  This is useful
+ * into the equivalent human readable error string. This is useful
  * for printing meaningful error messages.
  */
-CURL_EXTERN const char *curl_easy_strerror(CURLcode);
+CURL_EXTERN const char *curl_easy_strerror(CURLcode error);
 
 /*
  * NAME curl_share_strerror()
@@ -3183,10 +3238,10 @@ CURL_EXTERN const char *curl_easy_strerror(CURLcode);
  * DESCRIPTION
  *
  * The curl_share_strerror function may be used to turn a CURLSHcode value
- * into the equivalent human readable error string.  This is useful
+ * into the equivalent human readable error string. This is useful
  * for printing meaningful error messages.
  */
-CURL_EXTERN const char *curl_share_strerror(CURLSHcode);
+CURL_EXTERN const char *curl_share_strerror(CURLSHcode error);
 
 /*
  * NAME curl_easy_pause()
@@ -3194,47 +3249,98 @@ CURL_EXTERN const char *curl_share_strerror(CURLSHcode);
  * DESCRIPTION
  *
  * The curl_easy_pause function pauses or unpauses transfers. Select the new
- * state by setting the bitmask, use the convenience defines below.
+ * state by setting the action bitmask, use the convenience defines below.
  *
  */
-CURL_EXTERN CURLcode curl_easy_pause(CURL *handle, int bitmask);
+CURL_EXTERN CURLcode curl_easy_pause(CURL *curl, int action);
 
-#define CURLPAUSE_RECV      (1<<0)
-#define CURLPAUSE_RECV_CONT (0)
+#define CURLPAUSE_RECV      (1 << 0)
+#define CURLPAUSE_RECV_CONT 0
 
-#define CURLPAUSE_SEND      (1<<2)
-#define CURLPAUSE_SEND_CONT (0)
+#define CURLPAUSE_SEND      (1 << 2)
+#define CURLPAUSE_SEND_CONT 0
 
-#define CURLPAUSE_ALL       (CURLPAUSE_RECV|CURLPAUSE_SEND)
-#define CURLPAUSE_CONT      (CURLPAUSE_RECV_CONT|CURLPAUSE_SEND_CONT)
+#define CURLPAUSE_ALL       (CURLPAUSE_RECV | CURLPAUSE_SEND)
+#define CURLPAUSE_CONT      (CURLPAUSE_RECV_CONT | CURLPAUSE_SEND_CONT)
 
-#ifdef  __cplusplus
+/*
+ * NAME curl_easy_ssls_import()
+ *
+ * DESCRIPTION
+ *
+ * The curl_easy_ssls_import function adds a previously exported SSL session
+ * to the SSL session cache of the easy handle (or the underlying share).
+ */
+CURL_EXTERN CURLcode curl_easy_ssls_import(CURL *curl,
+                                           const char *session_key,
+                                           const unsigned char *shmac,
+                                           size_t shmac_len,
+                                           const unsigned char *sdata,
+                                           size_t sdata_len);
+
+/* This is the curl_ssls_export_cb callback prototype. It
+ * is passed to curl_easy_ssls_export() to extract SSL sessions/tickets. */
+typedef CURLcode curl_ssls_export_cb(CURL *curl,
+                                     void *userptr,
+                                     const char *session_key,
+                                     const unsigned char *shmac,
+                                     size_t shmac_len,
+                                     const unsigned char *sdata,
+                                     size_t sdata_len,
+                                     curl_off_t valid_until,
+                                     int ietf_tls_id,
+                                     const char *alpn,
+                                     size_t earlydata_max);
+
+/*
+ * NAME curl_easy_ssls_export()
+ *
+ * DESCRIPTION
+ *
+ * The curl_easy_ssls_export function iterates over all SSL sessions stored
+ * in the easy handle (or underlying share) and invokes the passed
+ * callback.
+ *
+ */
+CURL_EXTERN CURLcode curl_easy_ssls_export(CURL *curl,
+                                           curl_ssls_export_cb *export_fn,
+                                           void *userptr);
+
+#ifdef __cplusplus
 } /* end of extern "C" */
 #endif
 
 /* unfortunately, the easy.h and multi.h include files need options and info
-  stuff before they can be included! */
+   stuff before they can be included! */
 #include "easy.h" /* nothing in curl is fun without the easy stuff */
 #include "multi.h"
 #include "urlapi.h"
 #include "options.h"
 #include "header.h"
 #include "websockets.h"
+#include "mprintf.h"
 
-/* the typechecker doesn't work in C++ (yet) */
-#if defined(__GNUC__) && defined(__GNUC_MINOR__) && \
-    ((__GNUC__ > 4) || (__GNUC__ == 4 && __GNUC_MINOR__ >= 3)) && \
+/* the typechecker does not work in C++ (yet) */
+#if ((defined(__GNUC__) && defined(__GNUC_MINOR__) && \
+      ((__GNUC__ > 4) || (__GNUC__ == 4 && __GNUC_MINOR__ >= 3))) || \
+    (defined(__clang__) && __clang_major__ >= 14)) && \
     !defined(__cplusplus) && !defined(CURL_DISABLE_TYPECHECK)
 #include "typecheck-gcc.h"
 #else
 #if defined(__STDC__) && (__STDC__ >= 1)
-/* This preprocessor magic that replaces a call with the exact same call is
-   only done to make sure application authors pass exactly three arguments
-   to these functions. */
-#define curl_easy_setopt(handle,opt,param) curl_easy_setopt(handle,opt,param)
-#define curl_easy_getinfo(handle,info,arg) curl_easy_getinfo(handle,info,arg)
-#define curl_share_setopt(share,opt,param) curl_share_setopt(share,opt,param)
-#define curl_multi_setopt(handle,opt,param) curl_multi_setopt(handle,opt,param)
+/* This preprocessor magic ensures that application authors pass exactly three
+   arguments to these functions. For compatibility with C++ global namespace
+   '::' and reusing these symbols as method names, while also avoiding
+   recursive macros, use a two-stage solution. */
+#define curl_exactly_three_arguments(a, b, c) (a, b, c)
+#define curl_easy_setopt(handle, opt, param) \
+  curl_easy_setopt curl_exactly_three_arguments(handle, opt, param)
+#define curl_easy_getinfo(handle, info, arg) \
+  curl_easy_getinfo curl_exactly_three_arguments(handle, info, arg)
+#define curl_share_setopt(share, opt, param) \
+  curl_share_setopt curl_exactly_three_arguments(share, opt, param)
+#define curl_multi_setopt(handle, opt, param) \
+  curl_multi_setopt curl_exactly_three_arguments(handle, opt, param)
 #endif /* __STDC__ >= 1 */
 #endif /* gcc >= 4.3 && !__cplusplus && !CURL_DISABLE_TYPECHECK */
 
diff --git a/third-party/curl/include/curl/curlver.h b/third-party/curl/include/curl/curlver.h
index 6c441bbb1e..5cc0e27c61 100644
--- a/third-party/curl/include/curl/curlver.h
+++ b/third-party/curl/include/curl/curlver.h
@@ -32,23 +32,22 @@
 
 /* This is the version number of the libcurl package from which this header
    file origins: */
-#define LIBCURL_VERSION "8.3.0-DEV"
+#define LIBCURL_VERSION "8.21.0-DEV"
 
 /* The numeric version number is also available "in parts" by using these
    defines: */
 #define LIBCURL_VERSION_MAJOR 8
-#define LIBCURL_VERSION_MINOR 3
+#define LIBCURL_VERSION_MINOR 21
 #define LIBCURL_VERSION_PATCH 0
-
 /* This is the numeric version of the libcurl version number, meant for easier
-   parsing and comparisons by programs. The LIBCURL_VERSION_NUM define will
-   always follow this syntax:
+   parsing and comparisons by programs. The LIBCURL_VERSION_NUM define always
+   follows this syntax:
 
          0xXXYYZZ
 
    Where XX, YY and ZZ are the main version, release and patch numbers in
    hexadecimal (using 8 bits each). All three numbers are always represented
-   using two digits.  1.2 would appear as "0x010200" while version 9.11.7
+   using two digits. Version 1.2 would appear as "0x010200" while 9.11.7
    appears as "0x090b07".
 
    This 6-digit (24 bits) hexadecimal number does not show pre-release number,
@@ -59,7 +58,7 @@
    CURL_VERSION_BITS() macro since curl's own configure script greps for it
    and needs it to contain the full number.
 */
-#define LIBCURL_VERSION_NUM 0x080300
+#define LIBCURL_VERSION_NUM 0x081500
 
 /*
  * This is the date and time when the full source package was created. The
@@ -72,8 +71,8 @@
  */
 #define LIBCURL_TIMESTAMP "[unreleased]"
 
-#define CURL_VERSION_BITS(x,y,z) ((x)<<16|(y)<<8|(z))
-#define CURL_AT_LEAST_VERSION(x,y,z) \
+#define CURL_VERSION_BITS(x, y, z) ((x) << 16 | (y) << 8 | (z))
+#define CURL_AT_LEAST_VERSION(x, y, z) \
   (LIBCURL_VERSION_NUM >= CURL_VERSION_BITS(x, y, z))
 
 #endif /* CURLINC_CURLVER_H */
diff --git a/third-party/curl/include/curl/easy.h b/third-party/curl/include/curl/easy.h
index 1285101c58..197e6e7b92 100644
--- a/third-party/curl/include/curl/easy.h
+++ b/third-party/curl/include/curl/easy.h
@@ -23,7 +23,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#ifdef  __cplusplus
+#ifdef __cplusplus
 extern "C" {
 #endif
 
@@ -51,14 +51,13 @@ CURL_EXTERN void curl_easy_cleanup(CURL *curl);
  * Request internal information from the curl session with this function.
  * The third argument MUST be pointing to the specific type of the used option
  * which is documented in each man page of the option. The data pointed to
- * will be filled in accordingly and can be relied upon only if the function
+ * is filled in accordingly and can be relied upon only if the function
  * returns CURLE_OK. This function is intended to get used *AFTER* a performed
  * transfer, all results from this function are undefined until the transfer
  * is completed.
  */
 CURL_EXTERN CURLcode curl_easy_getinfo(CURL *curl, CURLINFO info, ...);
 
-
 /*
  * NAME curl_easy_duphandle()
  *
@@ -67,7 +66,7 @@ CURL_EXTERN CURLcode curl_easy_getinfo(CURL *curl, CURLINFO info, ...);
  * Creates a new curl session handle with the same options set for the handle
  * passed in. Duplicating a handle could only be a matter of cloning data and
  * options, internal state info and things like persistent connections cannot
- * be transferred. It is useful in multithreaded applications when you can run
+ * be transferred. It is useful in multi-threaded applications when you can run
  * curl_easy_duphandle() for each new thread to avoid a series of identical
  * curl_easy_setopt() invokes in every thread.
  */
@@ -78,8 +77,8 @@ CURL_EXTERN CURL *curl_easy_duphandle(CURL *curl);
  *
  * DESCRIPTION
  *
- * Re-initializes a CURL handle to the default values. This puts back the
- * handle to the same state as it was in when it was just created.
+ * Re-initializes a curl handle to the default values. This puts back the
+ * handle to the same state as it was in when it was created.
  *
  * It does keep: live connections, the Session ID cache, the DNS cache and the
  * cookies.
@@ -108,7 +107,6 @@ CURL_EXTERN CURLcode curl_easy_recv(CURL *curl, void *buffer, size_t buflen,
 CURL_EXTERN CURLcode curl_easy_send(CURL *curl, const void *buffer,
                                     size_t buflen, size_t *n);
 
-
 /*
  * NAME curl_easy_upkeep()
  *
@@ -118,7 +116,7 @@ CURL_EXTERN CURLcode curl_easy_send(CURL *curl, const void *buffer,
  */
 CURL_EXTERN CURLcode curl_easy_upkeep(CURL *curl);
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 } /* end of extern "C" */
 #endif
 
diff --git a/third-party/curl/include/curl/header.h b/third-party/curl/include/curl/header.h
index 8df11e1e42..5c3281a531 100644
--- a/third-party/curl/include/curl/header.h
+++ b/third-party/curl/include/curl/header.h
@@ -24,25 +24,25 @@
  *
  ***************************************************************************/
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 extern "C" {
 #endif
 
 struct curl_header {
   char *name;    /* this might not use the same case */
   char *value;
-  size_t amount; /* number of headers using this name  */
+  size_t amount; /* number of headers using this name */
   size_t index;  /* ... of this instance, 0 or higher */
   unsigned int origin; /* see bits below */
   void *anchor; /* handle privately used by libcurl */
 };
 
 /* 'origin' bits */
-#define CURLH_HEADER    (1<<0) /* plain server header */
-#define CURLH_TRAILER   (1<<1) /* trailers */
-#define CURLH_CONNECT   (1<<2) /* CONNECT headers */
-#define CURLH_1XX       (1<<3) /* 1xx headers */
-#define CURLH_PSEUDO    (1<<4) /* pseudo headers */
+#define CURLH_HEADER    (1 << 0) /* plain server header */
+#define CURLH_TRAILER   (1 << 1) /* trailers */
+#define CURLH_CONNECT   (1 << 2) /* CONNECT headers */
+#define CURLH_1XX       (1 << 3) /* 1xx headers */
+#define CURLH_PSEUDO    (1 << 4) /* pseudo headers */
 
 typedef enum {
   CURLHE_OK,
@@ -55,14 +55,14 @@ typedef enum {
   CURLHE_NOT_BUILT_IN   /* if API was disabled in the build */
 } CURLHcode;
 
-CURL_EXTERN CURLHcode curl_easy_header(CURL *easy,
+CURL_EXTERN CURLHcode curl_easy_header(CURL *curl,
                                        const char *name,
-                                       size_t index,
+                                       size_t nameindex,
                                        unsigned int origin,
                                        int request,
                                        struct curl_header **hout);
 
-CURL_EXTERN struct curl_header *curl_easy_nextheader(CURL *easy,
+CURL_EXTERN struct curl_header *curl_easy_nextheader(CURL *curl,
                                                      unsigned int origin,
                                                      int request,
                                                      struct curl_header *prev);
diff --git a/third-party/curl/include/curl/mprintf.h b/third-party/curl/include/curl/mprintf.h
index dc5664bc53..9272e74891 100644
--- a/third-party/curl/include/curl/mprintf.h
+++ b/third-party/curl/include/curl/mprintf.h
@@ -28,25 +28,40 @@
 #include <stdio.h> /* needed for FILE */
 #include "curl.h"  /* for CURL_EXTERN */
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 extern "C" {
 #endif
 
-#if (defined(__GNUC__) || defined(__clang__)) &&                        \
+#ifndef CURL_TEMP_PRINTF
+#if (defined(__GNUC__) || defined(__clang__) ||                         \
+  defined(__IAR_SYSTEMS_ICC__)) &&                                      \
   defined(__STDC_VERSION__) && (__STDC_VERSION__ >= 199901L) &&         \
-  !defined(__MINGW32__) && !defined(CURL_NO_FMT_CHECKS)
-#define CURL_TEMP_PRINTF(a,b) __attribute__ ((format(printf, a, b)))
+  !defined(CURL_NO_FMT_CHECKS)
+#if defined(__MINGW32__) && !defined(__clang__)
+#ifdef __MINGW_PRINTF_FORMAT  /* mingw-w64 3.0.0+. Needs stdio.h. */
+#define CURL_TEMP_PRINTF(fmt, arg) \
+  __attribute__((format(__MINGW_PRINTF_FORMAT, fmt, arg)))
 #else
-#define CURL_TEMP_PRINTF(a,b)
+#define CURL_TEMP_PRINTF(fmt, arg)
+#endif
+#else
+#define CURL_TEMP_PRINTF(fmt, arg) \
+  __attribute__((format(printf, fmt, arg)))
+#endif
+#else
+#define CURL_TEMP_PRINTF(fmt, arg)
+#endif
 #endif
 
-CURL_EXTERN int curl_mprintf(const char *format, ...) CURL_TEMP_PRINTF(1, 2);
+CURL_EXTERN int curl_mprintf(const char *format, ...)
+  CURL_TEMP_PRINTF(1, 2);
 CURL_EXTERN int curl_mfprintf(FILE *fd, const char *format, ...)
   CURL_TEMP_PRINTF(2, 3);
 CURL_EXTERN int curl_msprintf(char *buffer, const char *format, ...)
   CURL_TEMP_PRINTF(2, 3);
 CURL_EXTERN int curl_msnprintf(char *buffer, size_t maxlength,
-                               const char *format, ...) CURL_TEMP_PRINTF(3, 4);
+                               const char *format, ...)
+  CURL_TEMP_PRINTF(3, 4);
 CURL_EXTERN int curl_mvprintf(const char *format, va_list args)
   CURL_TEMP_PRINTF(1, 0);
 CURL_EXTERN int curl_mvfprintf(FILE *fd, const char *format, va_list args)
@@ -63,7 +78,7 @@ CURL_EXTERN char *curl_mvaprintf(const char *format, va_list args)
 
 #undef CURL_TEMP_PRINTF
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 } /* end of extern "C" */
 #endif
 
diff --git a/third-party/curl/include/curl/multi.h b/third-party/curl/include/curl/multi.h
index 13b55b7807..060b73eeec 100644
--- a/third-party/curl/include/curl/multi.h
+++ b/third-party/curl/include/curl/multi.h
@@ -24,7 +24,7 @@
  *
  ***************************************************************************/
 /*
-  This is an "external" header file. Don't give away any internals here!
+  This is an "external" header file. Do not give away any internals here!
 
   GOALS
 
@@ -50,15 +50,11 @@
  */
 #include "curl.h"
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 extern "C" {
 #endif
 
-#if defined(BUILDING_LIBCURL) || defined(CURL_STRICTER)
-typedef struct Curl_multi CURLM;
-#else
 typedef void CURLM;
-#endif
 
 typedef enum {
   CURLM_CALL_MULTI_PERFORM = -1, /* please call curl_multi_perform() or
@@ -66,7 +62,7 @@ typedef enum {
   CURLM_OK,
   CURLM_BAD_HANDLE,      /* the passed-in handle is not a valid CURLM handle */
   CURLM_BAD_EASY_HANDLE, /* an easy handle was not good/valid */
-  CURLM_OUT_OF_MEMORY,   /* if you ever get this, you're in deep sh*t */
+  CURLM_OUT_OF_MEMORY,   /* if you ever get this, you are in deep sh*t */
   CURLM_INTERNAL_ERROR,  /* this is a libcurl bug */
   CURLM_BAD_SOCKET,      /* the passed in socket argument did not match */
   CURLM_UNKNOWN_OPTION,  /* curl_multi_setopt() with unsupported option */
@@ -81,9 +77,8 @@ typedef enum {
   CURLM_LAST
 } CURLMcode;
 
-/* just to make code nicer when using curl_multi_socket() you can now check
-   for CURLM_CALL_MULTI_SOCKET too in the same style it works for
-   curl_multi_perform() and CURLM_CALL_MULTI_PERFORM */
+/* You can check for CURLM_CALL_MULTI_SOCKET too in the same style it works
+   for curl_multi_perform() and CURLM_CALL_MULTI_PERFORM */
 #define CURLM_CALL_MULTI_SOCKET CURLM_CALL_MULTI_PERFORM
 
 /* bitmask bits for CURLMOPT_PIPELINING */
@@ -109,7 +104,7 @@ struct CURLMsg {
 typedef struct CURLMsg CURLMsg;
 
 /* Based on poll(2) structure and values.
- * We don't use pollfd and POLL* constants explicitly
+ * We do not use pollfd and POLL* constants explicitly
  * to cover platforms without poll(). */
 #define CURL_WAIT_POLLIN    0x0001
 #define CURL_WAIT_POLLPRI   0x0002
@@ -137,29 +132,29 @@ CURL_EXTERN CURLM *curl_multi_init(void);
  *
  * Returns: CURLMcode type, general multi error code.
  */
-CURL_EXTERN CURLMcode curl_multi_add_handle(CURLM *multi_handle,
-                                            CURL *curl_handle);
+CURL_EXTERN CURLMcode curl_multi_add_handle(CURLM *m,
+                                            CURL *curl);
 
- /*
-  * Name:    curl_multi_remove_handle()
-  *
-  * Desc:    removes a curl handle from the multi stack again
-  *
-  * Returns: CURLMcode type, general multi error code.
-  */
-CURL_EXTERN CURLMcode curl_multi_remove_handle(CURLM *multi_handle,
-                                               CURL *curl_handle);
+/*
+ * Name:    curl_multi_remove_handle()
+ *
+ * Desc:    removes a curl handle from the multi stack again
+ *
+ * Returns: CURLMcode type, general multi error code.
+ */
+CURL_EXTERN CURLMcode curl_multi_remove_handle(CURLM *m,
+                                               CURL *curl);
 
- /*
-  * Name:    curl_multi_fdset()
-  *
-  * Desc:    Ask curl for its fd_set sets. The app can use these to select() or
-  *          poll() on. We want curl_multi_perform() called as soon as one of
-  *          them are ready.
-  *
-  * Returns: CURLMcode type, general multi error code.
-  */
-CURL_EXTERN CURLMcode curl_multi_fdset(CURLM *multi_handle,
+/*
+ * Name:    curl_multi_fdset()
+ *
+ * Desc:    Ask curl for its fd_set sets. The app can use these to select() or
+ *          poll() on. We want curl_multi_perform() called as soon as one of
+ *          them are ready.
+ *
+ * Returns: CURLMcode type, general multi error code.
+ */
+CURL_EXTERN CURLMcode curl_multi_fdset(CURLM *m,
                                        fd_set *read_fd_set,
                                        fd_set *write_fd_set,
                                        fd_set *exc_fd_set,
@@ -173,7 +168,7 @@ CURL_EXTERN CURLMcode curl_multi_fdset(CURLM *multi_handle,
  *
  * Returns:  CURLMcode type, general multi error code.
  */
-CURL_EXTERN CURLMcode curl_multi_wait(CURLM *multi_handle,
+CURL_EXTERN CURLMcode curl_multi_wait(CURLM *m,
                                       struct curl_waitfd extra_fds[],
                                       unsigned int extra_nfds,
                                       int timeout_ms,
@@ -187,7 +182,7 @@ CURL_EXTERN CURLMcode curl_multi_wait(CURLM *multi_handle,
  *
  * Returns:  CURLMcode type, general multi error code.
  */
-CURL_EXTERN CURLMcode curl_multi_poll(CURLM *multi_handle,
+CURL_EXTERN CURLMcode curl_multi_poll(CURLM *m,
                                       struct curl_waitfd extra_fds[],
                                       unsigned int extra_nfds,
                                       int timeout_ms,
@@ -200,80 +195,80 @@ CURL_EXTERN CURLMcode curl_multi_poll(CURLM *multi_handle,
  *
  * Returns:  CURLMcode type, general multi error code.
  */
-CURL_EXTERN CURLMcode curl_multi_wakeup(CURLM *multi_handle);
+CURL_EXTERN CURLMcode curl_multi_wakeup(CURLM *m);
 
- /*
-  * Name:    curl_multi_perform()
-  *
-  * Desc:    When the app thinks there's data available for curl it calls this
-  *          function to read/write whatever there is right now. This returns
-  *          as soon as the reads and writes are done. This function does not
-  *          require that there actually is data available for reading or that
-  *          data can be written, it can be called just in case. It returns
-  *          the number of handles that still transfer data in the second
-  *          argument's integer-pointer.
-  *
-  * Returns: CURLMcode type, general multi error code. *NOTE* that this only
-  *          returns errors etc regarding the whole multi stack. There might
-  *          still have occurred problems on individual transfers even when
-  *          this returns OK.
-  */
-CURL_EXTERN CURLMcode curl_multi_perform(CURLM *multi_handle,
+/*
+ * Name:    curl_multi_perform()
+ *
+ * Desc: When the app thinks there is data available for curl it calls this
+ *          function to read/write whatever there is right now. This returns
+ *          as soon as the reads and writes are done. This function does not
+ *          require that there actually is data available for reading or that
+ *          data can be written, it can be called. It returns the number of
+ *          handles that still transfer data in the second argument's
+ *          integer-pointer.
+ *
+ * Returns: CURLMcode type, general multi error code. *NOTE* that this only
+ *          returns errors etc regarding the whole multi stack. There might
+ *          still have occurred problems on individual transfers even when
+ *          this returns OK.
+ */
+CURL_EXTERN CURLMcode curl_multi_perform(CURLM *m,
                                          int *running_handles);
 
- /*
-  * Name:    curl_multi_cleanup()
-  *
-  * Desc:    Cleans up and removes a whole multi stack. It does not free or
-  *          touch any individual easy handles in any way. We need to define
-  *          in what state those handles will be if this function is called
-  *          in the middle of a transfer.
-  *
-  * Returns: CURLMcode type, general multi error code.
-  */
-CURL_EXTERN CURLMcode curl_multi_cleanup(CURLM *multi_handle);
+/*
+ * Name:    curl_multi_cleanup()
+ *
+ * Desc:    Cleans up and removes a whole multi stack. It does not free or
+ *          touch any individual easy handles in any way. We need to define
+ *          in what state those handles are going to be if this function is
+ *          called in the middle of a transfer.
+ *
+ * Returns: CURLMcode type, general multi error code.
+ */
+CURL_EXTERN CURLMcode curl_multi_cleanup(CURLM *m);
 
 /*
  * Name:    curl_multi_info_read()
  *
- * Desc:    Ask the multi handle if there's any messages/informationals from
+ * Desc:    Ask the multi handle if there is any messages/informationals from
  *          the individual transfers. Messages include informationals such as
- *          error code from the transfer or just the fact that a transfer is
+ *          error code from the transfer or the fact that a transfer is
  *          completed. More details on these should be written down as well.
  *
- *          Repeated calls to this function will return a new struct each
- *          time, until a special "end of msgs" struct is returned as a signal
- *          that there is no more to get at this point.
+ *          Repeated calls to this function return a new struct each time,
+ *          until a special "end of msgs" struct is returned as a signal that
+ *          there is no more to get at this point.
  *
- *          The data the returned pointer points to will not survive calling
+ *          The data the returned pointer points to does not survive calling
  *          curl_multi_cleanup().
  *
- *          The 'CURLMsg' struct is meant to be very simple and only contain
- *          very basic information. If more involved information is wanted,
- *          we will provide the particular "transfer handle" in that struct
- *          and that should/could/would be used in subsequent
- *          curl_easy_getinfo() calls (or similar). The point being that we
- *          must never expose complex structs to applications, as then we'll
- *          undoubtably get backwards compatibility problems in the future.
+ *          The 'CURLMsg' struct is meant to be simple and only contain basic
+ *          information. If more involved information is wanted, we provide
+ *          the particular "transfer handle" in that struct and that
+ *          should/could/would be used in subsequent curl_easy_getinfo() calls
+ *          (or similar). The point being that we must never expose complex
+ *          structs to applications, as then we undoubtably get backwards
+ *          compatibility problems in the future.
  *
  * Returns: A pointer to a filled-in struct, or NULL if it failed or ran out
  *          of structs. It also writes the number of messages left in the
  *          queue (after this read) in the integer the second argument points
  *          to.
  */
-CURL_EXTERN CURLMsg *curl_multi_info_read(CURLM *multi_handle,
+CURL_EXTERN CURLMsg *curl_multi_info_read(CURLM *m,
                                           int *msgs_in_queue);
 
 /*
  * Name:    curl_multi_strerror()
  *
  * Desc:    The curl_multi_strerror function may be used to turn a CURLMcode
- *          value into the equivalent human readable error string.  This is
+ *          value into the equivalent human readable error string. This is
  *          useful for printing meaningful error messages.
  *
  * Returns: A pointer to a null-terminated error message.
  */
-CURL_EXTERN const char *curl_multi_strerror(CURLMcode);
+CURL_EXTERN const char *curl_multi_strerror(CURLMcode error);
 
 /*
  * Name:    curl_multi_socket() and
@@ -313,27 +308,27 @@ typedef int (*curl_socket_callback)(CURL *easy,      /* easy handle */
  *
  * Returns: The callback should return zero.
  */
-typedef int (*curl_multi_timer_callback)(CURLM *multi,    /* multi handle */
+typedef int (*curl_multi_timer_callback)(CURLM *m,        /* multi handle */
                                          long timeout_ms, /* see above */
                                          void *userp);    /* private callback
                                                              pointer */
 
 CURL_EXTERN CURLMcode CURL_DEPRECATED(7.19.5, "Use curl_multi_socket_action()")
-curl_multi_socket(CURLM *multi_handle, curl_socket_t s, int *running_handles);
+curl_multi_socket(CURLM *m, curl_socket_t s, int *running_handles);
 
-CURL_EXTERN CURLMcode curl_multi_socket_action(CURLM *multi_handle,
+CURL_EXTERN CURLMcode curl_multi_socket_action(CURLM *m,
                                                curl_socket_t s,
                                                int ev_bitmask,
                                                int *running_handles);
 
 CURL_EXTERN CURLMcode CURL_DEPRECATED(7.19.5, "Use curl_multi_socket_action()")
-curl_multi_socket_all(CURLM *multi_handle, int *running_handles);
+curl_multi_socket_all(CURLM *m, int *running_handles);
 
 #ifndef CURL_ALLOW_OLD_MULTI_SOCKET
 /* This macro below was added in 7.16.3 to push users who recompile to use
-   the new curl_multi_socket_action() instead of the old curl_multi_socket()
-*/
-#define curl_multi_socket(x,y,z) curl_multi_socket_action(x,y,0,z)
+ * the new curl_multi_socket_action() instead of the old curl_multi_socket()
+ */
+#define curl_multi_socket(x, y, z) curl_multi_socket_action(x, y, 0, z)
 #endif
 
 /*
@@ -345,8 +340,8 @@ curl_multi_socket_all(CURLM *multi_handle, int *running_handles);
  *
  * Returns: CURLM error code.
  */
-CURL_EXTERN CURLMcode curl_multi_timeout(CURLM *multi_handle,
-                                         long *milliseconds);
+CURL_EXTERN CURLMcode curl_multi_timeout(CURLM *m,
+                                         long *timeout_ms);
 
 typedef enum {
   /* This is the socket callback function pointer */
@@ -355,10 +350,10 @@ typedef enum {
   /* This is the argument passed to the socket callback */
   CURLOPT(CURLMOPT_SOCKETDATA, CURLOPTTYPE_OBJECTPOINT, 2),
 
-    /* set to 1 to enable pipelining for this multi handle */
+  /* set to 1 to enable pipelining for this multi handle */
   CURLOPT(CURLMOPT_PIPELINING, CURLOPTTYPE_LONG, 3),
 
-   /* This is the timer callback function pointer */
+  /* This is the timer callback function pointer */
   CURLOPT(CURLMOPT_TIMERFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 4),
 
   /* This is the argument passed to the timer callback */
@@ -374,11 +369,11 @@ typedef enum {
   CURLOPT(CURLMOPT_MAX_PIPELINE_LENGTH, CURLOPTTYPE_LONG, 8),
 
   /* a connection with a content-length longer than this
-     will not be considered for pipelining */
+     is not considered for pipelining */
   CURLOPT(CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE, CURLOPTTYPE_OFF_T, 9),
 
   /* a connection with a chunk length longer than this
-     will not be considered for pipelining */
+     is not considered for pipelining */
   CURLOPT(CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE, CURLOPTTYPE_OFF_T, 10),
 
   /* a list of site names(+port) that are blocked from pipelining */
@@ -399,9 +394,39 @@ typedef enum {
   /* maximum number of concurrent streams to support on a connection */
   CURLOPT(CURLMOPT_MAX_CONCURRENT_STREAMS, CURLOPTTYPE_LONG, 16),
 
+  /* network has changed, adjust caches/connection reuse */
+  CURLOPT(CURLMOPT_NETWORK_CHANGED, CURLOPTTYPE_LONG, 17),
+
+  /* This is the notify callback function pointer */
+  CURLOPT(CURLMOPT_NOTIFYFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 18),
+
+  /* This is the argument passed to the notify callback */
+  CURLOPT(CURLMOPT_NOTIFYDATA, CURLOPTTYPE_OBJECTPOINT, 19),
+
+  /* maximum number of threads used with threaded DNS resolver */
+  CURLOPT(CURLMOPT_RESOLVE_THREADS_MAX, CURLOPTTYPE_LONG, 20),
+
+  /* set to 1L for not joining threads when multi is cleaned up */
+  CURLOPT(CURLMOPT_QUICK_EXIT, CURLOPTTYPE_LONG, 21),
+
   CURLMOPT_LASTENTRY /* the last unused */
 } CURLMoption;
 
+/* Definition of bits for the CURLMOPT_NETWORK_CHANGED argument: */
+
+/* - CURLMNWC_CLEAR_ALL tells libcurl to clear "everything" that could be
+   associated with this network, including both connections and DNS data. */
+#define CURLMNWC_CLEAR_ALL (1L << 0)
+
+/* - CURLMNWC_CLEAR_CONNS tells libcurl to prevent further reuse of existing
+   connections. Connections that are idle are closed. Ongoing transfers do
+   continue with the connection they have. */
+#define CURLMNWC_CLEAR_CONNS (1L << 1)
+
+/* - CURLMNWC_CLEAR_DNS tells libcurl to clear the DNS cache associated with
+   this multi handle. Ongoing transfers keep using their already resolved
+   addresses, but future name resolutions are performed again. */
+#define CURLMNWC_CLEAR_DNS (1L << 2)
 
 /*
  * Name:    curl_multi_setopt()
@@ -410,10 +435,9 @@ typedef enum {
  *
  * Returns: CURLM error code.
  */
-CURL_EXTERN CURLMcode curl_multi_setopt(CURLM *multi_handle,
+CURL_EXTERN CURLMcode curl_multi_setopt(CURLM *m,
                                         CURLMoption option, ...);
 
-
 /*
  * Name:    curl_multi_assign()
  *
@@ -423,9 +447,51 @@ CURL_EXTERN CURLMcode curl_multi_setopt(CURLM *multi_handle,
  *
  * Returns: CURLM error code.
  */
-CURL_EXTERN CURLMcode curl_multi_assign(CURLM *multi_handle,
+CURL_EXTERN CURLMcode curl_multi_assign(CURLM *m,
                                         curl_socket_t sockfd, void *sockp);
 
+/*
+ * Name:    curl_multi_get_handles()
+ *
+ * Desc:    Returns an allocated array holding all handles currently added to
+ *          the multi handle. Marks the final entry with a NULL pointer. If
+ *          there is no easy handle added to the multi handle, this function
+ *          returns an array with the first entry as a NULL pointer.
+ *
+ * Returns: NULL on failure, otherwise a CURL **array pointer
+ */
+CURL_EXTERN CURL **curl_multi_get_handles(CURLM *m);
+
+typedef enum {
+  CURLMINFO_NONE, /* first, never use this */
+  /* The number of easy handles currently managed by the multi handle,
+   * e.g. have been added but not yet removed. */
+  CURLMINFO_XFERS_CURRENT = 1,
+  /* The number of easy handles running, e.g. not done and not queueing. */
+  CURLMINFO_XFERS_RUNNING = 2,
+  /* The number of easy handles waiting to start, e.g. for a connection
+   * to become available due to limits on parallelism, max connections
+   * or other factors. */
+  CURLMINFO_XFERS_PENDING = 3,
+  /* The number of easy handles finished, waiting for their results to
+   * be read via `curl_multi_info_read()`. */
+  CURLMINFO_XFERS_DONE = 4,
+  /* The total number of easy handles added to the multi handle, ever. */
+  CURLMINFO_XFERS_ADDED = 5,
+
+  CURLMINFO_LASTENTRY /* the last unused */
+} CURLMinfo_offt;
+
+/*
+ * Name:    curl_multi_get_offt()
+ *
+ * Desc:    Retrieves a numeric value for the `CURLMINFO_*` enums.
+ *
+ * Returns: CULRM_OK or error when value could not be obtained.
+ */
+CURL_EXTERN CURLMcode curl_multi_get_offt(CURLM *m,
+                                          CURLMinfo_offt info,
+                                          curl_off_t *pvalue);
 
 /*
  * Name: curl_push_callback
@@ -453,6 +519,40 @@ typedef int (*curl_push_callback)(CURL *parent,
                                   struct curl_pushheaders *headers,
                                   void *userp);
 
+/*
+ * Name:    curl_multi_waitfds()
+ *
+ * Desc:    Ask curl for fds for polling. The app can use these to poll on.
+ *          We want curl_multi_perform() called as soon as one of them are
+ *          ready. Passing zero size allows to get a number of fds.
+ *
+ * Returns: CURLMcode type, general multi error code.
+ */
+CURL_EXTERN CURLMcode curl_multi_waitfds(CURLM *m,
+                                         struct curl_waitfd *ufds,
+                                         unsigned int size,
+                                         unsigned int *fd_count);
+
+/*
+ * Notifications dispatched by a multi handle, when enabled.
+ */
+#define CURLMNOTIFY_INFO_READ    0
+#define CURLMNOTIFY_EASY_DONE    1
+
+/*
+ * Callback to install via CURLMOPT_NOTIFYFUNCTION.
+ */
+typedef void (*curl_notify_callback)(CURLM *m,
+                                     unsigned int notification,
+                                     CURL *easy,
+                                     void *user_data);
+
+CURL_EXTERN CURLMcode curl_multi_notify_disable(CURLM *m,
+                                                unsigned int notification);
+
+CURL_EXTERN CURLMcode curl_multi_notify_enable(CURLM *m,
+                                               unsigned int notification);
+
 #ifdef __cplusplus
 } /* end of extern "C" */
 #endif
diff --git a/third-party/curl/include/curl/options.h b/third-party/curl/include/curl/options.h
index 1ed76a95c6..835a722e91 100644
--- a/third-party/curl/include/curl/options.h
+++ b/third-party/curl/include/curl/options.h
@@ -24,7 +24,7 @@
  *
  ***************************************************************************/
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 extern "C" {
 #endif
 
@@ -44,7 +44,7 @@ typedef enum {
 
 /* "alias" means it is provided for old programs to remain functional,
    we prefer another name */
-#define CURLOT_FLAG_ALIAS (1<<0)
+#define CURLOT_FLAG_ALIAS (1 << 0)
 
 /* The CURLOPTTYPE_* id ranges can still be used to figure out what type/size
    to use for curl_easy_setopt() for the given id */
diff --git a/third-party/curl/include/curl/system.h b/third-party/curl/include/curl/system.h
index 97e0d037a9..30216ea34c 100644
--- a/third-party/curl/include/curl/system.h
+++ b/third-party/curl/include/curl/system.h
@@ -31,83 +31,42 @@
  * changed.
  *
  * In order to differentiate between platforms/compilers/architectures use
- * only compiler built in predefined preprocessor symbols.
+ * only compiler built-in predefined preprocessor symbols.
  *
  * curl_off_t
  * ----------
  *
- * For any given platform/compiler curl_off_t must be typedef'ed to a 64-bit
+ * For any given platform/compiler curl_off_t MUST be typedef'ed to a 64-bit
  * wide signed integral data type. The width of this data type must remain
  * constant and independent of any possible large file support settings.
  *
- * As an exception to the above, curl_off_t shall be typedef'ed to a 32-bit
- * wide signed integral data type if there is no 64-bit type.
- *
  * As a general rule, curl_off_t shall not be mapped to off_t. This rule shall
  * only be violated if off_t is the only 64-bit data type available and the
  * size of off_t is independent of large file support settings. Keep your
- * build on the safe side avoiding an off_t gating.  If you have a 64-bit
+ * build on the safe side avoiding an off_t gating. If you have a 64-bit
  * off_t then take for sure that another 64-bit data type exists, dig deeper
- * and you will find it.
+ * to find it.
  *
  */
 
-#if defined(__DJGPP__) || defined(__GO32__)
-#  if defined(__DJGPP__) && (__DJGPP__ > 1)
-#    define CURL_TYPEOF_CURL_OFF_T     long long
-#    define CURL_FORMAT_CURL_OFF_T     "lld"
-#    define CURL_FORMAT_CURL_OFF_TU    "llu"
-#    define CURL_SUFFIX_CURL_OFF_T     LL
-#    define CURL_SUFFIX_CURL_OFF_TU    ULL
-#  else
-#    define CURL_TYPEOF_CURL_OFF_T     long
-#    define CURL_FORMAT_CURL_OFF_T     "ld"
-#    define CURL_FORMAT_CURL_OFF_TU    "lu"
-#    define CURL_SUFFIX_CURL_OFF_T     L
-#    define CURL_SUFFIX_CURL_OFF_TU    UL
-#  endif
-#  define CURL_TYPEOF_CURL_SOCKLEN_T int
-
-#elif defined(__SALFORDC__)
-#  define CURL_TYPEOF_CURL_OFF_T     long
-#  define CURL_FORMAT_CURL_OFF_T     "ld"
-#  define CURL_FORMAT_CURL_OFF_TU    "lu"
-#  define CURL_SUFFIX_CURL_OFF_T     L
-#  define CURL_SUFFIX_CURL_OFF_TU    UL
+#ifdef __DJGPP__
+#  define CURL_TYPEOF_CURL_OFF_T     long long
+#  define CURL_FORMAT_CURL_OFF_T     "lld"
+#  define CURL_FORMAT_CURL_OFF_TU    "llu"
+#  define CURL_SUFFIX_CURL_OFF_T     LL
+#  define CURL_SUFFIX_CURL_OFF_TU    ULL
 #  define CURL_TYPEOF_CURL_SOCKLEN_T int
 
 #elif defined(__BORLANDC__)
-#  if (__BORLANDC__ < 0x520)
-#    define CURL_TYPEOF_CURL_OFF_T     long
-#    define CURL_FORMAT_CURL_OFF_T     "ld"
-#    define CURL_FORMAT_CURL_OFF_TU    "lu"
-#    define CURL_SUFFIX_CURL_OFF_T     L
-#    define CURL_SUFFIX_CURL_OFF_TU    UL
-#  else
-#    define CURL_TYPEOF_CURL_OFF_T     __int64
-#    define CURL_FORMAT_CURL_OFF_T     "I64d"
-#    define CURL_FORMAT_CURL_OFF_TU    "I64u"
-#    define CURL_SUFFIX_CURL_OFF_T     i64
-#    define CURL_SUFFIX_CURL_OFF_TU    ui64
-#  endif
-#  define CURL_TYPEOF_CURL_SOCKLEN_T int
-
-#elif defined(__TURBOC__)
-#  define CURL_TYPEOF_CURL_OFF_T     long
-#  define CURL_FORMAT_CURL_OFF_T     "ld"
-#  define CURL_FORMAT_CURL_OFF_TU    "lu"
-#  define CURL_SUFFIX_CURL_OFF_T     L
-#  define CURL_SUFFIX_CURL_OFF_TU    UL
+#  define CURL_TYPEOF_CURL_OFF_T     __int64
+#  define CURL_FORMAT_CURL_OFF_T     "I64d"
+#  define CURL_FORMAT_CURL_OFF_TU    "I64u"
+#  define CURL_SUFFIX_CURL_OFF_T     i64
+#  define CURL_SUFFIX_CURL_OFF_TU    ui64
 #  define CURL_TYPEOF_CURL_SOCKLEN_T int
 
 #elif defined(__POCC__)
-#  if (__POCC__ < 280)
-#    define CURL_TYPEOF_CURL_OFF_T     long
-#    define CURL_FORMAT_CURL_OFF_T     "ld"
-#    define CURL_FORMAT_CURL_OFF_TU    "lu"
-#    define CURL_SUFFIX_CURL_OFF_T     L
-#    define CURL_SUFFIX_CURL_OFF_TU    UL
-#  elif defined(_MSC_VER)
+#  ifdef _MSC_VER
 #    define CURL_TYPEOF_CURL_OFF_T     __int64
 #    define CURL_FORMAT_CURL_OFF_T     "I64d"
 #    define CURL_FORMAT_CURL_OFF_TU    "I64u"
@@ -123,7 +82,7 @@
 #  define CURL_TYPEOF_CURL_SOCKLEN_T int
 
 #elif defined(__LCC__)
-#  if defined(__MCST__) /* MCST eLbrus Compiler Collection */
+#  ifdef __MCST__ /* MCST eLbrus Compiler Collection */
 #    define CURL_TYPEOF_CURL_OFF_T     long
 #    define CURL_FORMAT_CURL_OFF_T     "ld"
 #    define CURL_FORMAT_CURL_OFF_TU    "lu"
@@ -141,29 +100,6 @@
 #    define CURL_TYPEOF_CURL_SOCKLEN_T int
 #  endif
 
-#elif defined(__SYMBIAN32__)
-#  if defined(__EABI__) /* Treat all ARM compilers equally */
-#    define CURL_TYPEOF_CURL_OFF_T     long long
-#    define CURL_FORMAT_CURL_OFF_T     "lld"
-#    define CURL_FORMAT_CURL_OFF_TU    "llu"
-#    define CURL_SUFFIX_CURL_OFF_T     LL
-#    define CURL_SUFFIX_CURL_OFF_TU    ULL
-#  elif defined(__CW32__)
-#    pragma longlong on
-#    define CURL_TYPEOF_CURL_OFF_T     long long
-#    define CURL_FORMAT_CURL_OFF_T     "lld"
-#    define CURL_FORMAT_CURL_OFF_TU    "llu"
-#    define CURL_SUFFIX_CURL_OFF_T     LL
-#    define CURL_SUFFIX_CURL_OFF_TU    ULL
-#  elif defined(__VC32__)
-#    define CURL_TYPEOF_CURL_OFF_T     __int64
-#    define CURL_FORMAT_CURL_OFF_T     "lld"
-#    define CURL_FORMAT_CURL_OFF_TU    "llu"
-#    define CURL_SUFFIX_CURL_OFF_T     LL
-#    define CURL_SUFFIX_CURL_OFF_TU    ULL
-#  endif
-#  define CURL_TYPEOF_CURL_SOCKLEN_T unsigned int
-
 #elif defined(macintosh)
 #  include <ConditionalMacros.h>
 #  if TYPE_LONGLONG
@@ -182,17 +118,23 @@
 #  define CURL_TYPEOF_CURL_SOCKLEN_T unsigned int
 
 #elif defined(__TANDEM)
-# if ! defined(__LP64)
-   /* Required for 32-bit NonStop builds only. */
-#  define CURL_TYPEOF_CURL_OFF_T     long long
-#  define CURL_FORMAT_CURL_OFF_T     "lld"
-#  define CURL_FORMAT_CURL_OFF_TU    "llu"
-#  define CURL_SUFFIX_CURL_OFF_T     LL
-#  define CURL_SUFFIX_CURL_OFF_TU    ULL
-#  define CURL_TYPEOF_CURL_SOCKLEN_T int
-# endif
+#  ifndef __LP64
+#    define CURL_TYPEOF_CURL_OFF_T     long long
+#    define CURL_FORMAT_CURL_OFF_T     "lld"
+#    define CURL_FORMAT_CURL_OFF_TU    "llu"
+#    define CURL_SUFFIX_CURL_OFF_T     LL
+#    define CURL_SUFFIX_CURL_OFF_TU    ULL
+#    define CURL_TYPEOF_CURL_SOCKLEN_T int
+#  else
+#    define CURL_TYPEOF_CURL_OFF_T     long
+#    define CURL_FORMAT_CURL_OFF_T     "ld"
+#    define CURL_FORMAT_CURL_OFF_TU    "lu"
+#    define CURL_SUFFIX_CURL_OFF_T     L
+#    define CURL_SUFFIX_CURL_OFF_TU    UL
+#    define CURL_TYPEOF_CURL_SOCKLEN_T unsigned int
+#  endif
 
-#elif defined(_WIN32_WCE)
+#elif defined(UNDER_CE)
 #  define CURL_TYPEOF_CURL_OFF_T     __int64
 #  define CURL_FORMAT_CURL_OFF_T     "I64d"
 #  define CURL_FORMAT_CURL_OFF_TU    "I64u"
@@ -201,17 +143,17 @@
 #  define CURL_TYPEOF_CURL_SOCKLEN_T int
 
 #elif defined(__MINGW32__)
+#  include <inttypes.h>
 #  define CURL_TYPEOF_CURL_OFF_T     long long
-#  define CURL_FORMAT_CURL_OFF_T     "I64d"
-#  define CURL_FORMAT_CURL_OFF_TU    "I64u"
+#  define CURL_FORMAT_CURL_OFF_T     PRId64
+#  define CURL_FORMAT_CURL_OFF_TU    PRIu64
 #  define CURL_SUFFIX_CURL_OFF_T     LL
 #  define CURL_SUFFIX_CURL_OFF_TU    ULL
-#  define CURL_TYPEOF_CURL_SOCKLEN_T socklen_t
+#  define CURL_TYPEOF_CURL_SOCKLEN_T int
 #  define CURL_PULL_SYS_TYPES_H      1
-#  define CURL_PULL_WS2TCPIP_H       1
 
 #elif defined(__VMS)
-#  if defined(__VAX)
+#  ifdef __VAX
 #    define CURL_TYPEOF_CURL_OFF_T     long
 #    define CURL_FORMAT_CURL_OFF_T     "ld"
 #    define CURL_FORMAT_CURL_OFF_TU    "lu"
@@ -237,19 +179,13 @@
 #  define CURL_PULL_SYS_SOCKET_H     1
 
 #elif defined(__MVS__)
-#  if defined(_LONG_LONG)
+#  ifdef _LONG_LONG
 #    define CURL_TYPEOF_CURL_OFF_T     long long
 #    define CURL_FORMAT_CURL_OFF_T     "lld"
 #    define CURL_FORMAT_CURL_OFF_TU    "llu"
 #    define CURL_SUFFIX_CURL_OFF_T     LL
 #    define CURL_SUFFIX_CURL_OFF_TU    ULL
-#  elif defined(_LP64)
-#    define CURL_TYPEOF_CURL_OFF_T     long
-#    define CURL_FORMAT_CURL_OFF_T     "ld"
-#    define CURL_FORMAT_CURL_OFF_TU    "lu"
-#    define CURL_SUFFIX_CURL_OFF_T     L
-#    define CURL_SUFFIX_CURL_OFF_TU    UL
-#  else
+#  else /* _LP64 and default */
 #    define CURL_TYPEOF_CURL_OFF_T     long
 #    define CURL_FORMAT_CURL_OFF_T     "ld"
 #    define CURL_FORMAT_CURL_OFF_TU    "lu"
@@ -262,22 +198,13 @@
 
 #elif defined(__370__)
 #  if defined(__IBMC__) || defined(__IBMCPP__)
-#    if defined(_ILP32)
-#    elif defined(_LP64)
-#    endif
-#    if defined(_LONG_LONG)
+#    ifdef _LONG_LONG
 #      define CURL_TYPEOF_CURL_OFF_T     long long
 #      define CURL_FORMAT_CURL_OFF_T     "lld"
 #      define CURL_FORMAT_CURL_OFF_TU    "llu"
 #      define CURL_SUFFIX_CURL_OFF_T     LL
 #      define CURL_SUFFIX_CURL_OFF_TU    ULL
-#    elif defined(_LP64)
-#      define CURL_TYPEOF_CURL_OFF_T     long
-#      define CURL_FORMAT_CURL_OFF_T     "ld"
-#      define CURL_FORMAT_CURL_OFF_TU    "lu"
-#      define CURL_SUFFIX_CURL_OFF_T     L
-#      define CURL_SUFFIX_CURL_OFF_TU    UL
-#    else
+#    else /* _LP64 and default */
 #      define CURL_TYPEOF_CURL_OFF_T     long
 #      define CURL_FORMAT_CURL_OFF_T     "ld"
 #      define CURL_FORMAT_CURL_OFF_TU    "lu"
@@ -330,7 +257,7 @@
 #  define CURL_PULL_SYS_SOCKET_H     1
 
 #elif defined(__xlc__) /* IBM xlc compiler */
-#  if !defined(_LP64)
+#  ifndef _LP64
 #    define CURL_TYPEOF_CURL_OFF_T     long long
 #    define CURL_FORMAT_CURL_OFF_T     "lld"
 #    define CURL_FORMAT_CURL_OFF_TU    "llu"
@@ -348,7 +275,7 @@
 #  define CURL_PULL_SYS_SOCKET_H     1
 
 #elif defined(__hpux) /* HP aCC compiler */
-#  if !defined(_LP64)
+#  ifndef _LP64
 #    define CURL_TYPEOF_CURL_OFF_T     long long
 #    define CURL_FORMAT_CURL_OFF_T     "lld"
 #    define CURL_FORMAT_CURL_OFF_TU    "llu"
@@ -370,19 +297,17 @@
 /* ===================================== */
 
 #elif defined(_MSC_VER)
-#  if (_MSC_VER >= 900) && (_INTEGRAL_MAX_BITS >= 64)
-#    define CURL_TYPEOF_CURL_OFF_T     __int64
+#  if _MSC_VER >= 1800
+#    include <inttypes.h>
+#    define CURL_FORMAT_CURL_OFF_T     PRId64
+#    define CURL_FORMAT_CURL_OFF_TU    PRIu64
+#  else
 #    define CURL_FORMAT_CURL_OFF_T     "I64d"
 #    define CURL_FORMAT_CURL_OFF_TU    "I64u"
-#    define CURL_SUFFIX_CURL_OFF_T     i64
-#    define CURL_SUFFIX_CURL_OFF_TU    ui64
-#  else
-#    define CURL_TYPEOF_CURL_OFF_T     long
-#    define CURL_FORMAT_CURL_OFF_T     "ld"
-#    define CURL_FORMAT_CURL_OFF_TU    "lu"
-#    define CURL_SUFFIX_CURL_OFF_T     L
-#    define CURL_SUFFIX_CURL_OFF_TU    UL
 #  endif
+#  define CURL_TYPEOF_CURL_OFF_T     __int64
+#  define CURL_SUFFIX_CURL_OFF_T     i64
+#  define CURL_SUFFIX_CURL_OFF_TU    ui64
 #  define CURL_TYPEOF_CURL_SOCKLEN_T int
 
 /* ===================================== */
@@ -395,13 +320,18 @@
    defined(__ppc__) || defined(__powerpc__) || defined(__arm__) ||      \
    defined(__sparc__) || defined(__mips__) || defined(__sh__) ||        \
    defined(__XTENSA__) ||                                               \
-   (defined(__SIZEOF_LONG__) && __SIZEOF_LONG__ == 4)  ||               \
+   (defined(__SIZEOF_LONG__) && __SIZEOF_LONG__ == 4) ||                \
    (defined(__LONG_MAX__) && __LONG_MAX__ == 2147483647L))
 #    define CURL_TYPEOF_CURL_OFF_T     long long
 #    define CURL_FORMAT_CURL_OFF_T     "lld"
 #    define CURL_FORMAT_CURL_OFF_TU    "llu"
 #    define CURL_SUFFIX_CURL_OFF_T     LL
 #    define CURL_SUFFIX_CURL_OFF_TU    ULL
+#    if (__GNUC__ >= 4) || \
+       ((__GNUC__ == 3) && defined(__GNUC_MINOR__) && (__GNUC_MINOR__ >= 4))
+#      define CURL_POPCOUNT64(x)       __builtin_popcountll(x)
+#      define CURL_CTZ64(x)            __builtin_ctzll(x)
+#    endif
 #  elif defined(__LP64__) || \
         defined(__x86_64__) || defined(__ppc64__) || defined(__sparc64__) || \
         defined(__e2k__) || \
@@ -412,19 +342,24 @@
 #    define CURL_FORMAT_CURL_OFF_TU    "lu"
 #    define CURL_SUFFIX_CURL_OFF_T     L
 #    define CURL_SUFFIX_CURL_OFF_TU    UL
+#    if (__GNUC__ >= 4) || \
+       ((__GNUC__ == 3) && defined(__GNUC_MINOR__) && (__GNUC_MINOR__ >= 4))
+#      define CURL_POPCOUNT64(x)       __builtin_popcountl(x)
+#      define CURL_CTZ64(x)            __builtin_ctzl(x)
+#    endif
 #  endif
 #  define CURL_TYPEOF_CURL_SOCKLEN_T socklen_t
 #  define CURL_PULL_SYS_TYPES_H      1
 #  define CURL_PULL_SYS_SOCKET_H     1
 
 #else
-/* generic "safe guess" on old 32 bit style */
-# define CURL_TYPEOF_CURL_OFF_T     long
-# define CURL_FORMAT_CURL_OFF_T     "ld"
-# define CURL_FORMAT_CURL_OFF_TU    "lu"
-# define CURL_SUFFIX_CURL_OFF_T     L
-# define CURL_SUFFIX_CURL_OFF_TU    UL
-# define CURL_TYPEOF_CURL_SOCKLEN_T int
+/* generic "safe guess" on old 32-bit style */
+#  define CURL_TYPEOF_CURL_OFF_T     long long
+#  define CURL_FORMAT_CURL_OFF_T     "lld"
+#  define CURL_FORMAT_CURL_OFF_TU    "llu"
+#  define CURL_SUFFIX_CURL_OFF_T     LL
+#  define CURL_SUFFIX_CURL_OFF_TU    ULL
+#  define CURL_TYPEOF_CURL_SOCKLEN_T int
 #endif
 
 #ifdef _AIX
@@ -432,29 +367,20 @@
 #define CURL_PULL_SYS_POLL_H
 #endif
 
-
-/* CURL_PULL_WS2TCPIP_H is defined above when inclusion of header file  */
-/* ws2tcpip.h is required here to properly make type definitions below. */
-#ifdef CURL_PULL_WS2TCPIP_H
-#  include <winsock2.h>
-#  include <windows.h>
-#  include <ws2tcpip.h>
-#endif
-
-/* CURL_PULL_SYS_TYPES_H is defined above when inclusion of header file  */
-/* sys/types.h is required here to properly make type definitions below. */
+/* CURL_PULL_SYS_TYPES_H is defined above when inclusion of header file
+   sys/types.h is required here to properly make type definitions below. */
 #ifdef CURL_PULL_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
 
-/* CURL_PULL_SYS_SOCKET_H is defined above when inclusion of header file  */
-/* sys/socket.h is required here to properly make type definitions below. */
+/* CURL_PULL_SYS_SOCKET_H is defined above when inclusion of header file
+   sys/socket.h is required here to properly make type definitions below. */
 #ifdef CURL_PULL_SYS_SOCKET_H
 #  include <sys/socket.h>
 #endif
 
-/* CURL_PULL_SYS_POLL_H is defined above when inclusion of header file    */
-/* sys/poll.h is required here to properly make type definitions below.   */
+/* CURL_PULL_SYS_POLL_H is defined above when inclusion of header file
+   sys/poll.h is required here to properly make type definitions below. */
 #ifdef CURL_PULL_SYS_POLL_H
 #  include <sys/poll.h>
 #endif
@@ -470,52 +396,4 @@
   typedef CURL_TYPEOF_CURL_OFF_T curl_off_t;
 #endif
 
-/*
- * CURL_ISOCPP and CURL_OFF_T_C definitions are done here in order to allow
- * these to be visible and exported by the external libcurl interface API,
- * while also making them visible to the library internals, simply including
- * curl_setup.h, without actually needing to include curl.h internally.
- * If some day this section would grow big enough, all this should be moved
- * to its own header file.
- */
-
-/*
- * Figure out if we can use the ## preprocessor operator, which is supported
- * by ISO/ANSI C and C++. Some compilers support it without setting __STDC__
- * or  __cplusplus so we need to carefully check for them too.
- */
-
-#if defined(__STDC__) || defined(_MSC_VER) || defined(__cplusplus) || \
-  defined(__HP_aCC) || defined(__BORLANDC__) || defined(__LCC__) || \
-  defined(__POCC__) || defined(__SALFORDC__) || defined(__HIGHC__) || \
-  defined(__ILEC400__)
-  /* This compiler is believed to have an ISO compatible preprocessor */
-#define CURL_ISOCPP
-#else
-  /* This compiler is believed NOT to have an ISO compatible preprocessor */
-#undef CURL_ISOCPP
-#endif
-
-/*
- * Macros for minimum-width signed and unsigned curl_off_t integer constants.
- */
-
-#if defined(__BORLANDC__) && (__BORLANDC__ == 0x0551)
-#  define CURLINC_OFF_T_C_HLPR2(x) x
-#  define CURLINC_OFF_T_C_HLPR1(x) CURLINC_OFF_T_C_HLPR2(x)
-#  define CURL_OFF_T_C(Val)  CURLINC_OFF_T_C_HLPR1(Val) ## \
-                             CURLINC_OFF_T_C_HLPR1(CURL_SUFFIX_CURL_OFF_T)
-#  define CURL_OFF_TU_C(Val) CURLINC_OFF_T_C_HLPR1(Val) ## \
-                             CURLINC_OFF_T_C_HLPR1(CURL_SUFFIX_CURL_OFF_TU)
-#else
-#  ifdef CURL_ISOCPP
-#    define CURLINC_OFF_T_C_HLPR2(Val,Suffix) Val ## Suffix
-#  else
-#    define CURLINC_OFF_T_C_HLPR2(Val,Suffix) Val/**/Suffix
-#  endif
-#  define CURLINC_OFF_T_C_HLPR1(Val,Suffix) CURLINC_OFF_T_C_HLPR2(Val,Suffix)
-#  define CURL_OFF_T_C(Val)  CURLINC_OFF_T_C_HLPR1(Val,CURL_SUFFIX_CURL_OFF_T)
-#  define CURL_OFF_TU_C(Val) CURLINC_OFF_T_C_HLPR1(Val,CURL_SUFFIX_CURL_OFF_TU)
-#endif
-
 #endif /* CURLINC_SYSTEM_H */
diff --git a/third-party/curl/include/curl/typecheck-gcc.h b/third-party/curl/include/curl/typecheck-gcc.h
index b880f3dc60..d600c73cdc 100644
--- a/third-party/curl/include/curl/typecheck-gcc.h
+++ b/third-party/curl/include/curl/typecheck-gcc.h
@@ -24,141 +24,248 @@
  *
  ***************************************************************************/
 
-/* wraps curl_easy_setopt() with typechecking */
+/* wraps curl_easy_setopt() with type checking */
 
 /* To add a new kind of warning, add an
  *   if(curlcheck_sometype_option(_curl_opt))
  *     if(!curlcheck_sometype(value))
- *       _curl_easy_setopt_err_sometype();
+ *       Wcurl_easy_setopt_err_sometype();
  * block and define curlcheck_sometype_option, curlcheck_sometype and
- * _curl_easy_setopt_err_sometype below
+ * Wcurl_easy_setopt_err_sometype below
  *
  * NOTE: We use two nested 'if' statements here instead of the && operator, in
- *       order to work around gcc bug #32061.  It affects only gcc 4.3.x/4.4.x
+ *       order to work around gcc bug #32061. It affects only gcc 4.3.x/4.4.x
  *       when compiling with -Wlogical-op.
  *
- * To add an option that uses the same type as an existing option, you'll just
- * need to extend the appropriate _curl_*_option macro
+ * To add an option that uses the same type as an existing option, you need
+ * to extend the appropriate _curl_*_option macro
  */
+
 #define curl_easy_setopt(handle, option, value)                         \
   __extension__({                                                       \
-      CURLoption _curl_opt = (option);                                  \
-      if(__builtin_constant_p(_curl_opt)) {                             \
-        CURL_IGNORE_DEPRECATION(                                        \
-          if(curlcheck_long_option(_curl_opt))                          \
-            if(!curlcheck_long(value))                                  \
-              _curl_easy_setopt_err_long();                             \
-          if(curlcheck_off_t_option(_curl_opt))                         \
-            if(!curlcheck_off_t(value))                                 \
-              _curl_easy_setopt_err_curl_off_t();                       \
-          if(curlcheck_string_option(_curl_opt))                        \
-            if(!curlcheck_string(value))                                \
-              _curl_easy_setopt_err_string();                           \
-          if(curlcheck_write_cb_option(_curl_opt))                      \
-            if(!curlcheck_write_cb(value))                              \
-              _curl_easy_setopt_err_write_callback();                   \
-          if((_curl_opt) == CURLOPT_RESOLVER_START_FUNCTION)            \
-            if(!curlcheck_resolver_start_callback(value))               \
-              _curl_easy_setopt_err_resolver_start_callback();          \
-          if((_curl_opt) == CURLOPT_READFUNCTION)                       \
-            if(!curlcheck_read_cb(value))                               \
-              _curl_easy_setopt_err_read_cb();                          \
-          if((_curl_opt) == CURLOPT_IOCTLFUNCTION)                      \
-            if(!curlcheck_ioctl_cb(value))                              \
-              _curl_easy_setopt_err_ioctl_cb();                         \
-          if((_curl_opt) == CURLOPT_SOCKOPTFUNCTION)                    \
-            if(!curlcheck_sockopt_cb(value))                            \
-              _curl_easy_setopt_err_sockopt_cb();                       \
-          if((_curl_opt) == CURLOPT_OPENSOCKETFUNCTION)                 \
-            if(!curlcheck_opensocket_cb(value))                         \
-              _curl_easy_setopt_err_opensocket_cb();                    \
-          if((_curl_opt) == CURLOPT_PROGRESSFUNCTION)                   \
-            if(!curlcheck_progress_cb(value))                           \
-              _curl_easy_setopt_err_progress_cb();                      \
-          if((_curl_opt) == CURLOPT_DEBUGFUNCTION)                      \
-            if(!curlcheck_debug_cb(value))                              \
-              _curl_easy_setopt_err_debug_cb();                         \
-          if((_curl_opt) == CURLOPT_SSL_CTX_FUNCTION)                   \
-            if(!curlcheck_ssl_ctx_cb(value))                            \
-              _curl_easy_setopt_err_ssl_ctx_cb();                       \
-          if(curlcheck_conv_cb_option(_curl_opt))                       \
-            if(!curlcheck_conv_cb(value))                               \
-              _curl_easy_setopt_err_conv_cb();                          \
-          if((_curl_opt) == CURLOPT_SEEKFUNCTION)                       \
-            if(!curlcheck_seek_cb(value))                               \
-              _curl_easy_setopt_err_seek_cb();                          \
-          if(curlcheck_cb_data_option(_curl_opt))                       \
-            if(!curlcheck_cb_data(value))                               \
-              _curl_easy_setopt_err_cb_data();                          \
-          if((_curl_opt) == CURLOPT_ERRORBUFFER)                        \
-            if(!curlcheck_error_buffer(value))                          \
-              _curl_easy_setopt_err_error_buffer();                     \
-          if((_curl_opt) == CURLOPT_STDERR)                             \
-            if(!curlcheck_FILE(value))                                  \
-              _curl_easy_setopt_err_FILE();                             \
-          if(curlcheck_postfields_option(_curl_opt))                    \
-            if(!curlcheck_postfields(value))                            \
-              _curl_easy_setopt_err_postfields();                       \
-          if((_curl_opt) == CURLOPT_HTTPPOST)                           \
-            if(!curlcheck_arr((value), struct curl_httppost))           \
-              _curl_easy_setopt_err_curl_httpost();                     \
-          if((_curl_opt) == CURLOPT_MIMEPOST)                           \
-            if(!curlcheck_ptr((value), curl_mime))                      \
-              _curl_easy_setopt_err_curl_mimepost();                    \
-          if(curlcheck_slist_option(_curl_opt))                         \
-            if(!curlcheck_arr((value), struct curl_slist))              \
-              _curl_easy_setopt_err_curl_slist();                       \
-          if((_curl_opt) == CURLOPT_SHARE)                              \
-            if(!curlcheck_ptr((value), CURLSH))                         \
-              _curl_easy_setopt_err_CURLSH();                           \
-        )                                                               \
-      }                                                                 \
-      curl_easy_setopt(handle, _curl_opt, value);                       \
-    })
+    if(__builtin_constant_p(option)) {                                  \
+      CURL_IGNORE_DEPRECATION(                                          \
+        if(curlcheck_long_option(option))                               \
+          if(!curlcheck_long(value))                                    \
+            Wcurl_easy_setopt_err_long();                               \
+        if(curlcheck_off_t_option(option))                              \
+          if(!curlcheck_off_t(value))                                   \
+            Wcurl_easy_setopt_err_curl_off_t();                         \
+        if(curlcheck_string_option(option))                             \
+          if(!curlcheck_string(value))                                  \
+            Wcurl_easy_setopt_err_string();                             \
+        if((option) == CURLOPT_PRIVATE) { }                             \
+        if(curlcheck_write_cb_option(option))                           \
+          if(!curlcheck_write_cb(value))                                \
+            Wcurl_easy_setopt_err_write_callback();                     \
+        if(curlcheck_curl_option(option))                               \
+          if(!curlcheck_curl(value))                                    \
+            Wcurl_easy_setopt_err_curl();                               \
+        if((option) == CURLOPT_RESOLVER_START_FUNCTION)                 \
+          if(!curlcheck_resolver_start_callback(value))                 \
+            Wcurl_easy_setopt_err_resolver_start_callback();            \
+        if((option) == CURLOPT_READFUNCTION)                            \
+          if(!curlcheck_read_cb(value))                                 \
+            Wcurl_easy_setopt_err_read_cb();                            \
+        if((option) == CURLOPT_IOCTLFUNCTION)                           \
+          if(!curlcheck_ioctl_cb(value))                                \
+            Wcurl_easy_setopt_err_ioctl_cb();                           \
+        if((option) == CURLOPT_SOCKOPTFUNCTION)                         \
+          if(!curlcheck_sockopt_cb(value))                              \
+            Wcurl_easy_setopt_err_sockopt_cb();                         \
+        if((option) == CURLOPT_OPENSOCKETFUNCTION)                      \
+          if(!curlcheck_opensocket_cb(value))                           \
+            Wcurl_easy_setopt_err_opensocket_cb();                      \
+        if((option) == CURLOPT_PROGRESSFUNCTION)                        \
+          if(!curlcheck_progress_cb(value))                             \
+            Wcurl_easy_setopt_err_progress_cb();                        \
+        if((option) == CURLOPT_XFERINFOFUNCTION)                        \
+          if(!curlcheck_xferinfo_cb(value))                             \
+            Wcurl_easy_setopt_err_xferinfo_cb();                        \
+        if((option) == CURLOPT_DEBUGFUNCTION)                           \
+          if(!curlcheck_debug_cb(value))                                \
+            Wcurl_easy_setopt_err_debug_cb();                           \
+        if((option) == CURLOPT_SSL_CTX_FUNCTION)                        \
+          if(!curlcheck_ssl_ctx_cb(value))                              \
+            Wcurl_easy_setopt_err_ssl_ctx_cb();                         \
+        if(curlcheck_conv_cb_option(option))                            \
+          if(!curlcheck_conv_cb(value))                                 \
+            Wcurl_easy_setopt_err_conv_cb();                            \
+        if((option) == CURLOPT_SEEKFUNCTION)                            \
+          if(!curlcheck_seek_cb(value))                                 \
+            Wcurl_easy_setopt_err_seek_cb();                            \
+        if((option) == CURLOPT_CHUNK_BGN_FUNCTION)                      \
+          if(!curlcheck_chunk_bgn_cb(value))                            \
+            Wcurl_easy_setopt_err_chunk_bgn_cb();                       \
+        if((option) == CURLOPT_CHUNK_END_FUNCTION)                      \
+          if(!curlcheck_chunk_end_cb(value))                            \
+            Wcurl_easy_setopt_err_chunk_end_cb();                       \
+        if((option) == CURLOPT_CLOSESOCKETFUNCTION)                     \
+          if(!curlcheck_close_socket_cb(value))                         \
+            Wcurl_easy_setopt_err_close_socket_cb();                    \
+        if((option) == CURLOPT_FNMATCH_FUNCTION)                        \
+          if(!curlcheck_fnmatch_cb(value))                              \
+            Wcurl_easy_setopt_err_fnmatch_cb();                         \
+        if((option) == CURLOPT_HSTSREADFUNCTION)                        \
+          if(!curlcheck_hstsread_cb(value))                             \
+            Wcurl_easy_setopt_err_hstsread_cb();                        \
+        if((option) == CURLOPT_HSTSWRITEFUNCTION)                       \
+          if(!curlcheck_hstswrite_cb(value))                            \
+            Wcurl_easy_setopt_err_hstswrite_cb();                       \
+        if((option) == CURLOPT_SSH_HOSTKEYFUNCTION)                     \
+          if(!curlcheck_ssh_hostkey_cb(value))                          \
+            Wcurl_easy_setopt_err_ssh_hostkey_cb();                     \
+        if((option) == CURLOPT_SSH_KEYFUNCTION)                         \
+          if(!curlcheck_ssh_key_cb(value))                              \
+            Wcurl_easy_setopt_err_ssh_key_cb();                         \
+        if((option) == CURLOPT_INTERLEAVEFUNCTION)                      \
+          if(!curlcheck_interleave_cb(value))                           \
+            Wcurl_easy_setopt_err_interleave_cb();                      \
+        if((option) == CURLOPT_PREREQFUNCTION)                          \
+          if(!curlcheck_prereq_cb(value))                               \
+            Wcurl_easy_setopt_err_prereq_cb();                          \
+        if((option) == CURLOPT_TRAILERFUNCTION)                         \
+          if(!curlcheck_trailer_cb(value))                              \
+            Wcurl_easy_setopt_err_trailer_cb();                         \
+        if(curlcheck_cb_data_option(option))                            \
+          if(!curlcheck_cb_data(value))                                 \
+            Wcurl_easy_setopt_err_cb_data();                            \
+        if((option) == CURLOPT_ERRORBUFFER)                             \
+          if(!curlcheck_error_buffer(value))                            \
+            Wcurl_easy_setopt_err_error_buffer();                       \
+        if((option) == CURLOPT_CURLU)                                   \
+          if(!curlcheck_ptr((value), CURLU))                            \
+            Wcurl_easy_setopt_err_curlu();                              \
+        if((option) == CURLOPT_STDERR)                                  \
+          if(!curlcheck_FILE(value))                                    \
+            Wcurl_easy_setopt_err_FILE();                               \
+        if(curlcheck_postfields_option(option))                         \
+          if(!curlcheck_postfields(value))                              \
+            Wcurl_easy_setopt_err_postfields();                         \
+        if((option) == CURLOPT_HTTPPOST)                                \
+          if(!curlcheck_arr((value), struct curl_httppost))             \
+            Wcurl_easy_setopt_err_curl_httpost();                       \
+        if((option) == CURLOPT_MIMEPOST)                                \
+          if(!curlcheck_ptr((value), curl_mime))                        \
+            Wcurl_easy_setopt_err_curl_mimepost();                      \
+        if(curlcheck_slist_option(option))                              \
+          if(!curlcheck_arr((value), struct curl_slist))                \
+            Wcurl_easy_setopt_err_curl_slist();                         \
+        if((option) == CURLOPT_SHARE)                                   \
+          if(!curlcheck_ptr((value), CURLSH))                           \
+            Wcurl_easy_setopt_err_CURLSH();                             \
+      )                                                                 \
+    }                                                                   \
+    (curl_easy_setopt)(handle, option, value);                          \
+  })
 
-/* wraps curl_easy_getinfo() with typechecking */
+/* wraps curl_easy_getinfo() with type checking */
 #define curl_easy_getinfo(handle, info, arg)                            \
   __extension__({                                                       \
-      CURLINFO _curl_info = (info);                                     \
-      if(__builtin_constant_p(_curl_info)) {                            \
-        CURL_IGNORE_DEPRECATION(                                        \
-          if(curlcheck_string_info(_curl_info))                         \
-            if(!curlcheck_arr((arg), char *))                           \
-              _curl_easy_getinfo_err_string();                          \
-          if(curlcheck_long_info(_curl_info))                           \
-            if(!curlcheck_arr((arg), long))                             \
-              _curl_easy_getinfo_err_long();                            \
-          if(curlcheck_double_info(_curl_info))                         \
-            if(!curlcheck_arr((arg), double))                           \
-              _curl_easy_getinfo_err_double();                          \
-          if(curlcheck_slist_info(_curl_info))                          \
-            if(!curlcheck_arr((arg), struct curl_slist *))              \
-              _curl_easy_getinfo_err_curl_slist();                      \
-          if(curlcheck_tlssessioninfo_info(_curl_info))                 \
-            if(!curlcheck_arr((arg), struct curl_tlssessioninfo *))     \
-              _curl_easy_getinfo_err_curl_tlssesssioninfo();            \
-          if(curlcheck_certinfo_info(_curl_info))                       \
-            if(!curlcheck_arr((arg), struct curl_certinfo *))           \
-              _curl_easy_getinfo_err_curl_certinfo();                   \
-          if(curlcheck_socket_info(_curl_info))                         \
-            if(!curlcheck_arr((arg), curl_socket_t))                    \
-              _curl_easy_getinfo_err_curl_socket();                     \
-          if(curlcheck_off_t_info(_curl_info))                          \
-            if(!curlcheck_arr((arg), curl_off_t))                       \
-              _curl_easy_getinfo_err_curl_off_t();                      \
-        )                                                               \
-      }                                                                 \
-      curl_easy_getinfo(handle, _curl_info, arg);                       \
-    })
+    if(__builtin_constant_p(info)) {                                    \
+      CURL_IGNORE_DEPRECATION(                                          \
+        if(curlcheck_string_info(info))                                 \
+          if(!curlcheck_arr((arg), char *))                             \
+            Wcurl_easy_getinfo_err_string();                            \
+        if(curlcheck_long_info(info))                                   \
+          if(!curlcheck_arr((arg), long))                               \
+            Wcurl_easy_getinfo_err_long();                              \
+        if(curlcheck_double_info(info))                                 \
+          if(!curlcheck_arr((arg), double))                             \
+            Wcurl_easy_getinfo_err_double();                            \
+        if(curlcheck_slist_info(info))                                  \
+          if(!curlcheck_arr((arg), struct curl_slist *))                \
+            Wcurl_easy_getinfo_err_curl_slist();                        \
+        if(curlcheck_tlssessioninfo_info(info))                         \
+          if(!curlcheck_arr((arg), struct curl_tlssessioninfo *))       \
+            Wcurl_easy_getinfo_err_curl_tlssessioninfo();               \
+        if(curlcheck_certinfo_info(info))                               \
+          if(!curlcheck_arr((arg), struct curl_certinfo *))             \
+            Wcurl_easy_getinfo_err_curl_certinfo();                     \
+        if(curlcheck_socket_info(info))                                 \
+          if(!curlcheck_arr((arg), curl_socket_t))                      \
+            Wcurl_easy_getinfo_err_curl_socket();                       \
+        if(curlcheck_off_t_info(info))                                  \
+          if(!curlcheck_arr((arg), curl_off_t))                         \
+            Wcurl_easy_getinfo_err_curl_off_t();                        \
+      )                                                                 \
+    }                                                                   \
+    (curl_easy_getinfo)(handle, info, arg);                             \
+  })
+
+#define curl_multi_setopt(handle, option, value)                        \
+  __extension__({                                                       \
+    if(__builtin_constant_p(option)) {                                  \
+      if(curlcheck_long_option(option))                                 \
+        if(!curlcheck_long(value))                                      \
+          Wcurl_multi_setopt_err_long();                                \
+      if(curlcheck_off_t_option(option))                                \
+        if(!curlcheck_off_t(value))                                     \
+          Wcurl_multi_setopt_err_curl_off_t();                          \
+      if(curlcheck_multicb_data_option(option))                         \
+        if(!curlcheck_cb_data(value))                                   \
+          Wcurl_multi_setopt_err_cb_data();                             \
+      if(curlcheck_charpp_option(option))                               \
+        if(!curlcheck_ptrptr(value, char))                              \
+          Wcurl_multi_setopt_err_charpp();                              \
+      if((option) == CURLMOPT_NOTIFYFUNCTION)                           \
+        if(!curlcheck_multinotify_cb(value))                            \
+          Wcurl_multi_setopt_err_notifycb();                            \
+      if((option) == CURLMOPT_PUSHFUNCTION)                             \
+        if(!curlcheck_multipush_cb(value))                              \
+          Wcurl_multi_setopt_err_pushcb();                              \
+      if((option) == CURLMOPT_SOCKETFUNCTION)                           \
+        if(!curlcheck_multisocket_cb(value))                            \
+          Wcurl_multi_setopt_err_socketcb();                            \
+      if((option) == CURLMOPT_TIMERFUNCTION)                            \
+        if(!curlcheck_multitimer_cb(value))                             \
+          Wcurl_multi_setopt_err_timercb();                             \
+    }                                                                   \
+    (curl_multi_setopt)(handle, option, value);                         \
+  })
+
+/* evaluates to true if the option takes a data argument to pass to a
+   callback */
+#define curlcheck_multicb_data_option(option)                           \
+  ((option) == CURLMOPT_NOTIFYDATA ||                                   \
+   (option) == CURLMOPT_PUSHDATA ||                                     \
+   (option) == CURLMOPT_SOCKETDATA ||                                   \
+   (option) == CURLMOPT_TIMERDATA ||                                    \
+   0)
+
+/* evaluates to true if the option takes a char ** argument */
+#define curlcheck_charpp_option(option)                                 \
+  ((option) == CURLMOPT_PIPELINING_SERVER_BL ||                         \
+   (option) == CURLMOPT_PIPELINING_SITE_BL ||                           \
+   0)
+
+/* evaluates to true if expr is of type curl_multi_timer_callback */
+#define curlcheck_multitimer_cb(expr)                                   \
+  (curlcheck_NULL(expr) ||                                              \
+   curlcheck_cb_compatible((expr), curl_multi_timer_callback))
+
+/* evaluates to true if expr is of type curl_socket_callback */
+#define curlcheck_multisocket_cb(expr)                                  \
+  (curlcheck_NULL(expr) ||                                              \
+   curlcheck_cb_compatible((expr), curl_socket_callback))
+
+/* evaluates to true if expr is of type curl_push_callback */
+#define curlcheck_multipush_cb(expr)                                    \
+  (curlcheck_NULL(expr) ||                                              \
+   curlcheck_cb_compatible((expr), curl_push_callback))
+
+/* evaluates to true if expr is of type curl_push_callback */
+#define curlcheck_multinotify_cb(expr)                                  \
+  (curlcheck_NULL(expr) ||                                              \
+   curlcheck_cb_compatible((expr), curl_notify_callback))
 
 /*
- * For now, just make sure that the functions are called with three arguments
+ * Make sure that the functions are called with three arguments
  */
-#define curl_share_setopt(share,opt,param) curl_share_setopt(share,opt,param)
-#define curl_multi_setopt(handle,opt,param) curl_multi_setopt(handle,opt,param)
+#define curl_share_setopt(share, opt, param) \
+  (curl_share_setopt)(share, opt, param)
 
-
-/* the actual warnings, triggered by calling the _curl_easy_setopt_err*
+/* the actual warnings, triggered by calling the Wcurl_easy_setopt_err*
  * functions */
 
 /* To define a new warning, use _CURL_WARNING(identifier, "message") */
@@ -167,187 +274,230 @@
   __attribute__((__unused__)) __attribute__((__noinline__))             \
   id(void) { __asm__(""); }
 
-CURLWARNING(_curl_easy_setopt_err_long,
-  "curl_easy_setopt expects a long argument for this option")
-CURLWARNING(_curl_easy_setopt_err_curl_off_t,
-  "curl_easy_setopt expects a curl_off_t argument for this option")
-CURLWARNING(_curl_easy_setopt_err_string,
-              "curl_easy_setopt expects a "
-              "string ('char *' or char[]) argument for this option"
-  )
-CURLWARNING(_curl_easy_setopt_err_write_callback,
-  "curl_easy_setopt expects a curl_write_callback argument for this option")
-CURLWARNING(_curl_easy_setopt_err_resolver_start_callback,
-              "curl_easy_setopt expects a "
-              "curl_resolver_start_callback argument for this option"
-  )
-CURLWARNING(_curl_easy_setopt_err_read_cb,
-  "curl_easy_setopt expects a curl_read_callback argument for this option")
-CURLWARNING(_curl_easy_setopt_err_ioctl_cb,
-  "curl_easy_setopt expects a curl_ioctl_callback argument for this option")
-CURLWARNING(_curl_easy_setopt_err_sockopt_cb,
-  "curl_easy_setopt expects a curl_sockopt_callback argument for this option")
-CURLWARNING(_curl_easy_setopt_err_opensocket_cb,
-              "curl_easy_setopt expects a "
-              "curl_opensocket_callback argument for this option"
-  )
-CURLWARNING(_curl_easy_setopt_err_progress_cb,
-  "curl_easy_setopt expects a curl_progress_callback argument for this option")
-CURLWARNING(_curl_easy_setopt_err_debug_cb,
-  "curl_easy_setopt expects a curl_debug_callback argument for this option")
-CURLWARNING(_curl_easy_setopt_err_ssl_ctx_cb,
-  "curl_easy_setopt expects a curl_ssl_ctx_callback argument for this option")
-CURLWARNING(_curl_easy_setopt_err_conv_cb,
-  "curl_easy_setopt expects a curl_conv_callback argument for this option")
-CURLWARNING(_curl_easy_setopt_err_seek_cb,
-  "curl_easy_setopt expects a curl_seek_callback argument for this option")
-CURLWARNING(_curl_easy_setopt_err_cb_data,
-              "curl_easy_setopt expects a "
-              "private data pointer as argument for this option")
-CURLWARNING(_curl_easy_setopt_err_error_buffer,
-              "curl_easy_setopt expects a "
-              "char buffer of CURL_ERROR_SIZE as argument for this option")
-CURLWARNING(_curl_easy_setopt_err_FILE,
-  "curl_easy_setopt expects a 'FILE *' argument for this option")
-CURLWARNING(_curl_easy_setopt_err_postfields,
-  "curl_easy_setopt expects a 'void *' or 'char *' argument for this option")
-CURLWARNING(_curl_easy_setopt_err_curl_httpost,
-              "curl_easy_setopt expects a 'struct curl_httppost *' "
-              "argument for this option")
-CURLWARNING(_curl_easy_setopt_err_curl_mimepost,
-              "curl_easy_setopt expects a 'curl_mime *' "
-              "argument for this option")
-CURLWARNING(_curl_easy_setopt_err_curl_slist,
-  "curl_easy_setopt expects a 'struct curl_slist *' argument for this option")
-CURLWARNING(_curl_easy_setopt_err_CURLSH,
-  "curl_easy_setopt expects a CURLSH* argument for this option")
+CURLWARNING(Wcurl_multi_setopt_err_long,
+            "curl_multi_setopt expects a long argument")
+CURLWARNING(Wcurl_multi_setopt_err_curl_off_t,
+            "curl_multi_setopt expects a curl_off_t argument")
+CURLWARNING(Wcurl_multi_setopt_err_cb_data,
+            "curl_multi_setopt expects a 'void *' argument")
+CURLWARNING(Wcurl_multi_setopt_err_charpp,
+            "curl_multi_setopt expects a 'char **' argument")
+CURLWARNING(Wcurl_multi_setopt_err_pushcb,
+            "curl_multi_setopt expects a curl_push_callback argument")
+CURLWARNING(Wcurl_multi_setopt_err_notifycb,
+            "curl_multi_setopt expects a curl_notify_callback argument")
+CURLWARNING(Wcurl_multi_setopt_err_socketcb,
+            "curl_multi_setopt expects a curl_socket_callback argument")
+CURLWARNING(Wcurl_multi_setopt_err_timercb,
+            "curl_multi_setopt expects a curl_multi_timer_callback argument")
 
-CURLWARNING(_curl_easy_getinfo_err_string,
-  "curl_easy_getinfo expects a pointer to 'char *' for this info")
-CURLWARNING(_curl_easy_getinfo_err_long,
-  "curl_easy_getinfo expects a pointer to long for this info")
-CURLWARNING(_curl_easy_getinfo_err_double,
-  "curl_easy_getinfo expects a pointer to double for this info")
-CURLWARNING(_curl_easy_getinfo_err_curl_slist,
-  "curl_easy_getinfo expects a pointer to 'struct curl_slist *' for this info")
-CURLWARNING(_curl_easy_getinfo_err_curl_tlssesssioninfo,
-              "curl_easy_getinfo expects a pointer to "
-              "'struct curl_tlssessioninfo *' for this info")
-CURLWARNING(_curl_easy_getinfo_err_curl_certinfo,
-              "curl_easy_getinfo expects a pointer to "
-              "'struct curl_certinfo *' for this info")
-CURLWARNING(_curl_easy_getinfo_err_curl_socket,
-  "curl_easy_getinfo expects a pointer to curl_socket_t for this info")
-CURLWARNING(_curl_easy_getinfo_err_curl_off_t,
-  "curl_easy_getinfo expects a pointer to curl_off_t for this info")
+CURLWARNING(Wcurl_easy_setopt_err_long,
+            "curl_easy_setopt expects a long argument")
+CURLWARNING(Wcurl_easy_setopt_err_curl_off_t,
+            "curl_easy_setopt expects a curl_off_t argument")
+CURLWARNING(Wcurl_easy_setopt_err_string,
+            "curl_easy_setopt expects a "
+            "string ('char *' or char[]) argument")
+CURLWARNING(Wcurl_easy_setopt_err_write_callback,
+            "curl_easy_setopt expects a curl_write_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_resolver_start_callback,
+            "curl_easy_setopt expects a "
+            "curl_resolver_start_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_read_cb,
+            "curl_easy_setopt expects a curl_read_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_ioctl_cb,
+            "curl_easy_setopt expects a curl_ioctl_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_sockopt_cb,
+            "curl_easy_setopt expects a curl_sockopt_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_opensocket_cb,
+            "curl_easy_setopt expects a "
+            "curl_opensocket_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_progress_cb,
+            "curl_easy_setopt expects a curl_progress_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_xferinfo_cb,
+            "curl_easy_setopt expects a curl_xferinfo_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_debug_cb,
+            "curl_easy_setopt expects a curl_debug_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_ssl_ctx_cb,
+            "curl_easy_setopt expects a curl_ssl_ctx_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_conv_cb,
+            "curl_easy_setopt expects a curl_conv_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_seek_cb,
+            "curl_easy_setopt expects a curl_seek_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_cb_data,
+            "curl_easy_setopt expects a "
+            "private data pointer as argument")
+CURLWARNING(Wcurl_easy_setopt_err_chunk_bgn_cb,
+            "curl_easy_setopt expects a curl_chunk_bgn_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_chunk_end_cb,
+            "curl_easy_setopt expects a curl_chunk_end_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_close_socket_cb,
+            "curl_easy_setopt expects a curl_closesocket_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_fnmatch_cb,
+            "curl_easy_setopt expects a curl_fnmatch_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_hstsread_cb,
+            "curl_easy_setopt expects a curl_hstsread_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_hstswrite_cb,
+            "curl_easy_setopt expects a curl_hstswrite_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_ssh_key_cb,
+            "curl_easy_setopt expects a curl_sshkeycallback argument")
+CURLWARNING(Wcurl_easy_setopt_err_ssh_hostkey_cb,
+            "curl_easy_setopt expects a curl_sshhostkeycallback argument")
+CURLWARNING(Wcurl_easy_setopt_err_interleave_cb,
+            "curl_easy_setopt expects a curl_interleave_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_prereq_cb,
+            "curl_easy_setopt expects a curl_prereq_callback argument")
+CURLWARNING(Wcurl_easy_setopt_err_trailer_cb,
+            "curl_easy_setopt expects a curl_trailerfunc_ok argument")
+CURLWARNING(Wcurl_easy_setopt_err_error_buffer,
+            "curl_easy_setopt expects a "
+            "char buffer of CURL_ERROR_SIZE as argument")
+CURLWARNING(Wcurl_easy_setopt_err_curlu,
+            "curl_easy_setopt expects a 'CURLU *' argument")
+CURLWARNING(Wcurl_easy_setopt_err_curl,
+            "curl_easy_setopt expects a 'CURL *' argument")
+CURLWARNING(Wcurl_easy_setopt_err_FILE,
+            "curl_easy_setopt expects a 'FILE *' argument")
+CURLWARNING(Wcurl_easy_setopt_err_postfields,
+            "curl_easy_setopt expects a 'void *' or 'char *' argument")
+CURLWARNING(Wcurl_easy_setopt_err_curl_httpost,
+            "curl_easy_setopt expects a 'struct curl_httppost *' "
+            "argument")
+CURLWARNING(Wcurl_easy_setopt_err_curl_mimepost,
+            "curl_easy_setopt expects a 'curl_mime *' "
+            "argument")
+CURLWARNING(Wcurl_easy_setopt_err_curl_slist,
+            "curl_easy_setopt expects a 'struct curl_slist *' argument")
+CURLWARNING(Wcurl_easy_setopt_err_CURLSH,
+            "curl_easy_setopt expects a CURLSH* argument")
+CURLWARNING(Wcurl_easy_getinfo_err_string,
+            "curl_easy_getinfo expects a pointer to 'char *'")
+CURLWARNING(Wcurl_easy_getinfo_err_long,
+            "curl_easy_getinfo expects a pointer to long")
+CURLWARNING(Wcurl_easy_getinfo_err_double,
+            "curl_easy_getinfo expects a pointer to double")
+CURLWARNING(Wcurl_easy_getinfo_err_curl_slist,
+            "curl_easy_getinfo expects a pointer to 'struct curl_slist *'")
+CURLWARNING(Wcurl_easy_getinfo_err_curl_tlssessioninfo,
+            "curl_easy_getinfo expects a pointer to "
+            "'struct curl_tlssessioninfo *'")
+CURLWARNING(Wcurl_easy_getinfo_err_curl_certinfo,
+            "curl_easy_getinfo expects a pointer to "
+            "'struct curl_certinfo *'")
+CURLWARNING(Wcurl_easy_getinfo_err_curl_socket,
+            "curl_easy_getinfo expects a pointer to curl_socket_t")
+CURLWARNING(Wcurl_easy_getinfo_err_curl_off_t,
+            "curl_easy_getinfo expects a pointer to curl_off_t")
 
 /* groups of curl_easy_setops options that take the same type of argument */
 
-/* To add a new option to one of the groups, just add
- *   (option) == CURLOPT_SOMETHING
- * to the or-expression. If the option takes a long or curl_off_t, you don't
- * have to do anything
- */
-
 /* evaluates to true if option takes a long argument */
-#define curlcheck_long_option(option)                   \
+#define curlcheck_long_option(option)                                   \
   (0 < (option) && (option) < CURLOPTTYPE_OBJECTPOINT)
 
-#define curlcheck_off_t_option(option)          \
+#define curlcheck_off_t_option(option)                                  \
   (((option) > CURLOPTTYPE_OFF_T) && ((option) < CURLOPTTYPE_BLOB))
 
+/* option takes a CURL * argument */
+#define curlcheck_curl_option(option)                                   \
+  ((option) == CURLOPT_STREAM_DEPENDS ||                                \
+   (option) == CURLOPT_STREAM_DEPENDS_E ||                              \
+   0)
+
 /* evaluates to true if option takes a char* argument */
-#define curlcheck_string_option(option)                                       \
-  ((option) == CURLOPT_ABSTRACT_UNIX_SOCKET ||                                \
-   (option) == CURLOPT_ACCEPT_ENCODING ||                                     \
-   (option) == CURLOPT_ALTSVC ||                                              \
-   (option) == CURLOPT_CAINFO ||                                              \
-   (option) == CURLOPT_CAPATH ||                                              \
-   (option) == CURLOPT_COOKIE ||                                              \
-   (option) == CURLOPT_COOKIEFILE ||                                          \
-   (option) == CURLOPT_COOKIEJAR ||                                           \
-   (option) == CURLOPT_COOKIELIST ||                                          \
-   (option) == CURLOPT_CRLFILE ||                                             \
-   (option) == CURLOPT_CUSTOMREQUEST ||                                       \
-   (option) == CURLOPT_DEFAULT_PROTOCOL ||                                    \
-   (option) == CURLOPT_DNS_INTERFACE ||                                       \
-   (option) == CURLOPT_DNS_LOCAL_IP4 ||                                       \
-   (option) == CURLOPT_DNS_LOCAL_IP6 ||                                       \
-   (option) == CURLOPT_DNS_SERVERS ||                                         \
-   (option) == CURLOPT_DOH_URL ||                                             \
-   (option) == CURLOPT_EGDSOCKET ||                                           \
-   (option) == CURLOPT_FTP_ACCOUNT ||                                         \
-   (option) == CURLOPT_FTP_ALTERNATIVE_TO_USER ||                             \
-   (option) == CURLOPT_FTPPORT ||                                             \
-   (option) == CURLOPT_HSTS ||                                                \
-   (option) == CURLOPT_HAPROXY_CLIENT_IP ||                                   \
-   (option) == CURLOPT_INTERFACE ||                                           \
-   (option) == CURLOPT_ISSUERCERT ||                                          \
-   (option) == CURLOPT_KEYPASSWD ||                                           \
-   (option) == CURLOPT_KRBLEVEL ||                                            \
-   (option) == CURLOPT_LOGIN_OPTIONS ||                                       \
-   (option) == CURLOPT_MAIL_AUTH ||                                           \
-   (option) == CURLOPT_MAIL_FROM ||                                           \
-   (option) == CURLOPT_NETRC_FILE ||                                          \
-   (option) == CURLOPT_NOPROXY ||                                             \
-   (option) == CURLOPT_PASSWORD ||                                            \
-   (option) == CURLOPT_PINNEDPUBLICKEY ||                                     \
-   (option) == CURLOPT_PRE_PROXY ||                                           \
-   (option) == CURLOPT_PROTOCOLS_STR ||                                       \
-   (option) == CURLOPT_PROXY ||                                               \
-   (option) == CURLOPT_PROXY_CAINFO ||                                        \
-   (option) == CURLOPT_PROXY_CAPATH ||                                        \
-   (option) == CURLOPT_PROXY_CRLFILE ||                                       \
-   (option) == CURLOPT_PROXY_ISSUERCERT ||                                    \
-   (option) == CURLOPT_PROXY_KEYPASSWD ||                                     \
-   (option) == CURLOPT_PROXY_PINNEDPUBLICKEY ||                               \
-   (option) == CURLOPT_PROXY_SERVICE_NAME ||                                  \
-   (option) == CURLOPT_PROXY_SSL_CIPHER_LIST ||                               \
-   (option) == CURLOPT_PROXY_SSLCERT ||                                       \
-   (option) == CURLOPT_PROXY_SSLCERTTYPE ||                                   \
-   (option) == CURLOPT_PROXY_SSLKEY ||                                        \
-   (option) == CURLOPT_PROXY_SSLKEYTYPE ||                                    \
-   (option) == CURLOPT_PROXY_TLS13_CIPHERS ||                                 \
-   (option) == CURLOPT_PROXY_TLSAUTH_PASSWORD ||                              \
-   (option) == CURLOPT_PROXY_TLSAUTH_TYPE ||                                  \
-   (option) == CURLOPT_PROXY_TLSAUTH_USERNAME ||                              \
-   (option) == CURLOPT_PROXYPASSWORD ||                                       \
-   (option) == CURLOPT_PROXYUSERNAME ||                                       \
-   (option) == CURLOPT_PROXYUSERPWD ||                                        \
-   (option) == CURLOPT_RANDOM_FILE ||                                         \
-   (option) == CURLOPT_RANGE ||                                               \
-   (option) == CURLOPT_REDIR_PROTOCOLS_STR ||                                 \
-   (option) == CURLOPT_REFERER ||                                             \
-   (option) == CURLOPT_REQUEST_TARGET ||                                      \
-   (option) == CURLOPT_RTSP_SESSION_ID ||                                     \
-   (option) == CURLOPT_RTSP_STREAM_URI ||                                     \
-   (option) == CURLOPT_RTSP_TRANSPORT ||                                      \
-   (option) == CURLOPT_SASL_AUTHZID ||                                        \
-   (option) == CURLOPT_SERVICE_NAME ||                                        \
-   (option) == CURLOPT_SOCKS5_GSSAPI_SERVICE ||                               \
-   (option) == CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 ||                             \
-   (option) == CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 ||                          \
-   (option) == CURLOPT_SSH_KNOWNHOSTS ||                                      \
-   (option) == CURLOPT_SSH_PRIVATE_KEYFILE ||                                 \
-   (option) == CURLOPT_SSH_PUBLIC_KEYFILE ||                                  \
-   (option) == CURLOPT_SSLCERT ||                                             \
-   (option) == CURLOPT_SSLCERTTYPE ||                                         \
-   (option) == CURLOPT_SSLENGINE ||                                           \
-   (option) == CURLOPT_SSLKEY ||                                              \
-   (option) == CURLOPT_SSLKEYTYPE ||                                          \
-   (option) == CURLOPT_SSL_CIPHER_LIST ||                                     \
-   (option) == CURLOPT_TLS13_CIPHERS ||                                       \
-   (option) == CURLOPT_TLSAUTH_PASSWORD ||                                    \
-   (option) == CURLOPT_TLSAUTH_TYPE ||                                        \
-   (option) == CURLOPT_TLSAUTH_USERNAME ||                                    \
-   (option) == CURLOPT_UNIX_SOCKET_PATH ||                                    \
-   (option) == CURLOPT_URL ||                                                 \
-   (option) == CURLOPT_USERAGENT ||                                           \
-   (option) == CURLOPT_USERNAME ||                                            \
-   (option) == CURLOPT_AWS_SIGV4 ||                                           \
-   (option) == CURLOPT_USERPWD ||                                             \
-   (option) == CURLOPT_XOAUTH2_BEARER ||                                      \
-   (option) == CURLOPT_SSL_EC_CURVES ||                                       \
+#define curlcheck_string_option(option)                                 \
+  ((option) == CURLOPT_ABSTRACT_UNIX_SOCKET ||                          \
+   (option) == CURLOPT_ACCEPT_ENCODING ||                               \
+   (option) == CURLOPT_ALTSVC ||                                        \
+   (option) == CURLOPT_CAINFO ||                                        \
+   (option) == CURLOPT_CAPATH ||                                        \
+   (option) == CURLOPT_COOKIE ||                                        \
+   (option) == CURLOPT_COOKIEFILE ||                                    \
+   (option) == CURLOPT_COOKIEJAR ||                                     \
+   (option) == CURLOPT_COOKIELIST ||                                    \
+   (option) == CURLOPT_CRLFILE ||                                       \
+   (option) == CURLOPT_CUSTOMREQUEST ||                                 \
+   (option) == CURLOPT_DEFAULT_PROTOCOL ||                              \
+   (option) == CURLOPT_DNS_INTERFACE ||                                 \
+   (option) == CURLOPT_DNS_LOCAL_IP4 ||                                 \
+   (option) == CURLOPT_DNS_LOCAL_IP6 ||                                 \
+   (option) == CURLOPT_DNS_SERVERS ||                                   \
+   (option) == CURLOPT_DOH_URL ||                                       \
+   (option) == CURLOPT_ECH ||                                           \
+   (option) == CURLOPT_EGDSOCKET ||                                     \
+   (option) == CURLOPT_FTP_ACCOUNT ||                                   \
+   (option) == CURLOPT_FTP_ALTERNATIVE_TO_USER ||                       \
+   (option) == CURLOPT_FTPPORT ||                                       \
+   (option) == CURLOPT_HAPROXY_CLIENT_IP ||                             \
+   (option) == CURLOPT_HSTS ||                                          \
+   (option) == CURLOPT_INTERFACE ||                                     \
+   (option) == CURLOPT_ISSUERCERT ||                                    \
+   (option) == CURLOPT_KEYPASSWD ||                                     \
+   (option) == CURLOPT_KRBLEVEL ||                                      \
+   (option) == CURLOPT_LOGIN_OPTIONS ||                                 \
+   (option) == CURLOPT_MAIL_AUTH ||                                     \
+   (option) == CURLOPT_MAIL_FROM ||                                     \
+   (option) == CURLOPT_NETRC_FILE ||                                    \
+   (option) == CURLOPT_NOPROXY ||                                       \
+   (option) == CURLOPT_PASSWORD ||                                      \
+   (option) == CURLOPT_PINNEDPUBLICKEY ||                               \
+   (option) == CURLOPT_PRE_PROXY ||                                     \
+   (option) == CURLOPT_PROTOCOLS_STR ||                                 \
+   (option) == CURLOPT_PROXY ||                                         \
+   (option) == CURLOPT_PROXY_CAINFO ||                                  \
+   (option) == CURLOPT_PROXY_CAPATH ||                                  \
+   (option) == CURLOPT_PROXY_CRLFILE ||                                 \
+   (option) == CURLOPT_PROXY_ISSUERCERT ||                              \
+   (option) == CURLOPT_PROXY_KEYPASSWD ||                               \
+   (option) == CURLOPT_PROXY_PINNEDPUBLICKEY ||                         \
+   (option) == CURLOPT_PROXY_SERVICE_NAME ||                            \
+   (option) == CURLOPT_PROXY_SSL_CIPHER_LIST ||                         \
+   (option) == CURLOPT_PROXY_SSLCERT ||                                 \
+   (option) == CURLOPT_PROXY_SSLCERTTYPE ||                             \
+   (option) == CURLOPT_PROXY_SSLKEY ||                                  \
+   (option) == CURLOPT_PROXY_SSLKEYTYPE ||                              \
+   (option) == CURLOPT_PROXY_TLS13_CIPHERS ||                           \
+   (option) == CURLOPT_PROXY_TLSAUTH_PASSWORD ||                        \
+   (option) == CURLOPT_PROXY_TLSAUTH_TYPE ||                            \
+   (option) == CURLOPT_PROXY_TLSAUTH_USERNAME ||                        \
+   (option) == CURLOPT_PROXYPASSWORD ||                                 \
+   (option) == CURLOPT_PROXYUSERNAME ||                                 \
+   (option) == CURLOPT_PROXYUSERPWD ||                                  \
+   (option) == CURLOPT_RANDOM_FILE ||                                   \
+   (option) == CURLOPT_RANGE ||                                         \
+   (option) == CURLOPT_REDIR_PROTOCOLS_STR ||                           \
+   (option) == CURLOPT_REFERER ||                                       \
+   (option) == CURLOPT_REQUEST_TARGET ||                                \
+   (option) == CURLOPT_RTSP_SESSION_ID ||                               \
+   (option) == CURLOPT_RTSP_STREAM_URI ||                               \
+   (option) == CURLOPT_RTSP_TRANSPORT ||                                \
+   (option) == CURLOPT_SASL_AUTHZID ||                                  \
+   (option) == CURLOPT_SERVICE_NAME ||                                  \
+   (option) == CURLOPT_SOCKS5_GSSAPI_SERVICE ||                         \
+   (option) == CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 ||                       \
+   (option) == CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 ||                    \
+   (option) == CURLOPT_SSH_KNOWNHOSTS ||                                \
+   (option) == CURLOPT_SSH_PRIVATE_KEYFILE ||                           \
+   (option) == CURLOPT_SSH_PUBLIC_KEYFILE ||                            \
+   (option) == CURLOPT_SSLCERT ||                                       \
+   (option) == CURLOPT_SSLCERTTYPE ||                                   \
+   (option) == CURLOPT_SSLENGINE ||                                     \
+   (option) == CURLOPT_SSLKEY ||                                        \
+   (option) == CURLOPT_SSLKEYTYPE ||                                    \
+   (option) == CURLOPT_SSL_CIPHER_LIST ||                               \
+   (option) == CURLOPT_SSL_EC_CURVES ||                                 \
+   (option) == CURLOPT_SSL_SIGNATURE_ALGORITHMS ||                      \
+   (option) == CURLOPT_TLS13_CIPHERS ||                                 \
+   (option) == CURLOPT_TLSAUTH_PASSWORD ||                              \
+   (option) == CURLOPT_TLSAUTH_TYPE ||                                  \
+   (option) == CURLOPT_TLSAUTH_USERNAME ||                              \
+   (option) == CURLOPT_UNIX_SOCKET_PATH ||                              \
+   (option) == CURLOPT_URL ||                                           \
+   (option) == CURLOPT_USERAGENT ||                                     \
+   (option) == CURLOPT_USERNAME ||                                      \
+   (option) == CURLOPT_AWS_SIGV4 ||                                     \
+   (option) == CURLOPT_USERPWD ||                                       \
+   (option) == CURLOPT_XOAUTH2_BEARER ||                                \
    0)
 
 /* evaluates to true if option takes a curl_write_callback argument */
@@ -362,86 +512,89 @@ CURLWARNING(_curl_easy_getinfo_err_curl_off_t,
    (option) == CURLOPT_CONV_FROM_UTF8_FUNCTION)
 
 /* evaluates to true if option takes a data argument to pass to a callback */
-#define curlcheck_cb_data_option(option)                                      \
-  ((option) == CURLOPT_CHUNK_DATA ||                                          \
-   (option) == CURLOPT_CLOSESOCKETDATA ||                                     \
-   (option) == CURLOPT_DEBUGDATA ||                                           \
-   (option) == CURLOPT_FNMATCH_DATA ||                                        \
-   (option) == CURLOPT_HEADERDATA ||                                          \
-   (option) == CURLOPT_HSTSREADDATA ||                                        \
-   (option) == CURLOPT_HSTSWRITEDATA ||                                       \
-   (option) == CURLOPT_INTERLEAVEDATA ||                                      \
-   (option) == CURLOPT_IOCTLDATA ||                                           \
-   (option) == CURLOPT_OPENSOCKETDATA ||                                      \
-   (option) == CURLOPT_PREREQDATA ||                                          \
-   (option) == CURLOPT_PROGRESSDATA ||                                        \
-   (option) == CURLOPT_READDATA ||                                            \
-   (option) == CURLOPT_SEEKDATA ||                                            \
-   (option) == CURLOPT_SOCKOPTDATA ||                                         \
-   (option) == CURLOPT_SSH_KEYDATA ||                                         \
-   (option) == CURLOPT_SSL_CTX_DATA ||                                        \
-   (option) == CURLOPT_WRITEDATA ||                                           \
-   (option) == CURLOPT_RESOLVER_START_DATA ||                                 \
-   (option) == CURLOPT_TRAILERDATA ||                                         \
-   (option) == CURLOPT_SSH_HOSTKEYDATA ||                                     \
+#define curlcheck_cb_data_option(option)                                \
+  ((option) == CURLOPT_CHUNK_DATA ||                                    \
+   (option) == CURLOPT_CLOSESOCKETDATA ||                               \
+   (option) == CURLOPT_DEBUGDATA ||                                     \
+   (option) == CURLOPT_FNMATCH_DATA ||                                  \
+   (option) == CURLOPT_HEADERDATA ||                                    \
+   (option) == CURLOPT_HSTSREADDATA ||                                  \
+   (option) == CURLOPT_HSTSWRITEDATA ||                                 \
+   (option) == CURLOPT_INTERLEAVEDATA ||                                \
+   (option) == CURLOPT_IOCTLDATA ||                                     \
+   (option) == CURLOPT_OPENSOCKETDATA ||                                \
+   (option) == CURLOPT_PREREQDATA ||                                    \
+   (option) == CURLOPT_XFERINFODATA ||                                  \
+   (option) == CURLOPT_READDATA ||                                      \
+   (option) == CURLOPT_SEEKDATA ||                                      \
+   (option) == CURLOPT_SOCKOPTDATA ||                                   \
+   (option) == CURLOPT_SSH_KEYDATA ||                                   \
+   (option) == CURLOPT_SSL_CTX_DATA ||                                  \
+   (option) == CURLOPT_WRITEDATA ||                                     \
+   (option) == CURLOPT_RESOLVER_START_DATA ||                           \
+   (option) == CURLOPT_TRAILERDATA ||                                   \
+   (option) == CURLOPT_SSH_HOSTKEYDATA ||                               \
    0)
 
 /* evaluates to true if option takes a POST data argument (void* or char*) */
-#define curlcheck_postfields_option(option)                                   \
-  ((option) == CURLOPT_POSTFIELDS ||                                          \
-   (option) == CURLOPT_COPYPOSTFIELDS ||                                      \
+#define curlcheck_postfields_option(option)                             \
+  ((option) == CURLOPT_POSTFIELDS ||                                    \
+   (option) == CURLOPT_COPYPOSTFIELDS ||                                \
    0)
 
 /* evaluates to true if option takes a struct curl_slist * argument */
-#define curlcheck_slist_option(option)                                        \
-  ((option) == CURLOPT_HTTP200ALIASES ||                                      \
-   (option) == CURLOPT_HTTPHEADER ||                                          \
-   (option) == CURLOPT_MAIL_RCPT ||                                           \
-   (option) == CURLOPT_POSTQUOTE ||                                           \
-   (option) == CURLOPT_PREQUOTE ||                                            \
-   (option) == CURLOPT_PROXYHEADER ||                                         \
-   (option) == CURLOPT_QUOTE ||                                               \
-   (option) == CURLOPT_RESOLVE ||                                             \
-   (option) == CURLOPT_TELNETOPTIONS ||                                       \
-   (option) == CURLOPT_CONNECT_TO ||                                          \
+#define curlcheck_slist_option(option)                                  \
+  ((option) == CURLOPT_HTTP200ALIASES ||                                \
+   (option) == CURLOPT_HTTPHEADER ||                                    \
+   (option) == CURLOPT_MAIL_RCPT ||                                     \
+   (option) == CURLOPT_POSTQUOTE ||                                     \
+   (option) == CURLOPT_PREQUOTE ||                                      \
+   (option) == CURLOPT_PROXYHEADER ||                                   \
+   (option) == CURLOPT_QUOTE ||                                         \
+   (option) == CURLOPT_RESOLVE ||                                       \
+   (option) == CURLOPT_TELNETOPTIONS ||                                 \
+   (option) == CURLOPT_CONNECT_TO ||                                    \
    0)
 
 /* groups of curl_easy_getinfo infos that take the same type of argument */
 
 /* evaluates to true if info expects a pointer to char * argument */
-#define curlcheck_string_info(info)                             \
-  (CURLINFO_STRING < (info) && (info) < CURLINFO_LONG &&        \
+#define curlcheck_string_info(info)                                     \
+  (CURLINFO_STRING < (info) && (info) < CURLINFO_LONG &&                \
    (info) != CURLINFO_PRIVATE)
 
 /* evaluates to true if info expects a pointer to long argument */
-#define curlcheck_long_info(info)                       \
+#define curlcheck_long_info(info)                                       \
   (CURLINFO_LONG < (info) && (info) < CURLINFO_DOUBLE)
 
 /* evaluates to true if info expects a pointer to double argument */
-#define curlcheck_double_info(info)                     \
+#define curlcheck_double_info(info)                                     \
   (CURLINFO_DOUBLE < (info) && (info) < CURLINFO_SLIST)
 
 /* true if info expects a pointer to struct curl_slist * argument */
 #define curlcheck_slist_info(info)                                      \
-  (((info) == CURLINFO_SSL_ENGINES) || ((info) == CURLINFO_COOKIELIST))
+  (((info) == CURLINFO_SSL_ENGINES) ||                                  \
+   ((info) == CURLINFO_COOKIELIST))
 
 /* true if info expects a pointer to struct curl_tlssessioninfo * argument */
-#define curlcheck_tlssessioninfo_info(info)                              \
-  (((info) == CURLINFO_TLS_SSL_PTR) || ((info) == CURLINFO_TLS_SESSION))
+#define curlcheck_tlssessioninfo_info(info)                             \
+  (((info) == CURLINFO_TLS_SSL_PTR) ||                                  \
+   ((info) == CURLINFO_TLS_SESSION))
 
 /* true if info expects a pointer to struct curl_certinfo * argument */
 #define curlcheck_certinfo_info(info) ((info) == CURLINFO_CERTINFO)
 
 /* true if info expects a pointer to struct curl_socket_t argument */
-#define curlcheck_socket_info(info)                     \
+#define curlcheck_socket_info(info)                                     \
   (CURLINFO_SOCKET < (info) && (info) < CURLINFO_OFF_T)
 
 /* true if info expects a pointer to curl_off_t argument */
-#define curlcheck_off_t_info(info)              \
+#define curlcheck_off_t_info(info)                                      \
   (CURLINFO_OFF_T < (info))
 
-
-/* typecheck helpers -- check whether given expression has requested type */
+/*
+ * typecheck helpers -- check whether given expression has requested type
+ */
 
 /* For pointers, you can use the curlcheck_ptr/curlcheck_arr macros,
  * otherwise define a new macro. Search for __builtin_types_compatible_p
@@ -453,7 +606,7 @@ CURLWARNING(_curl_easy_getinfo_err_curl_off_t,
  */
 
 /* XXX: should evaluate to true if expr is a pointer */
-#define curlcheck_any_ptr(expr)                 \
+#define curlcheck_any_ptr(expr)                                         \
   (sizeof(expr) == sizeof(void *))
 
 /* evaluates to true if expr is NULL */
@@ -467,6 +620,14 @@ CURLWARNING(_curl_easy_getinfo_err_curl_off_t,
    __builtin_types_compatible_p(__typeof__(expr), type *) ||            \
    __builtin_types_compatible_p(__typeof__(expr), const type *))
 
+/* evaluates to true if expr is type**, const type** or NULL */
+#define curlcheck_ptrptr(expr, type)                                    \
+  (curlcheck_NULL(expr) ||                                              \
+   __builtin_types_compatible_p(__typeof__(expr), type **) ||           \
+   __builtin_types_compatible_p(__typeof__(expr), type *[]) ||          \
+   __builtin_types_compatible_p(__typeof__(expr), const type *[]) ||    \
+   __builtin_types_compatible_p(__typeof__(expr), const type **))
+
 /* evaluates to true if expr is one of type[], type*, NULL or const type* */
 #define curlcheck_arr(expr, type)                                       \
   (curlcheck_ptr((expr), type) ||                                       \
@@ -478,25 +639,38 @@ CURLWARNING(_curl_easy_getinfo_err_curl_off_t,
    curlcheck_arr((expr), signed char) ||                                \
    curlcheck_arr((expr), unsigned char))
 
+/* evaluates to true if expr is a CURL * */
+#define curlcheck_curl(expr)                                            \
+  (curlcheck_NULL(expr) ||                                              \
+   __builtin_types_compatible_p(__typeof__(expr), CURL *))
+
 /* evaluates to true if expr is a long (no matter the signedness)
  * XXX: for now, int is also accepted (and therefore short and char, which
  * are promoted to int when passed to a variadic function) */
-#define curlcheck_long(expr)                                                  \
-  (__builtin_types_compatible_p(__typeof__(expr), long) ||                    \
-   __builtin_types_compatible_p(__typeof__(expr), signed long) ||             \
-   __builtin_types_compatible_p(__typeof__(expr), unsigned long) ||           \
-   __builtin_types_compatible_p(__typeof__(expr), int) ||                     \
-   __builtin_types_compatible_p(__typeof__(expr), signed int) ||              \
-   __builtin_types_compatible_p(__typeof__(expr), unsigned int) ||            \
-   __builtin_types_compatible_p(__typeof__(expr), short) ||                   \
-   __builtin_types_compatible_p(__typeof__(expr), signed short) ||            \
-   __builtin_types_compatible_p(__typeof__(expr), unsigned short) ||          \
-   __builtin_types_compatible_p(__typeof__(expr), char) ||                    \
-   __builtin_types_compatible_p(__typeof__(expr), signed char) ||             \
-   __builtin_types_compatible_p(__typeof__(expr), unsigned char))
+#define curlcheck_long(expr)                                            \
+  (                                                                     \
+  ((sizeof(long) != sizeof(int)) &&                                     \
+   (__builtin_types_compatible_p(__typeof__(expr), long) ||             \
+    __builtin_types_compatible_p(__typeof__(expr), signed long) ||      \
+    __builtin_types_compatible_p(__typeof__(expr), unsigned long)))     \
+  ||                                                                    \
+  ((sizeof(long) == sizeof(int)) &&                                     \
+  (__builtin_types_compatible_p(__typeof__(expr), long) ||              \
+   __builtin_types_compatible_p(__typeof__(expr), signed long) ||       \
+   __builtin_types_compatible_p(__typeof__(expr), unsigned long) ||     \
+   __builtin_types_compatible_p(__typeof__(expr), int) ||               \
+   __builtin_types_compatible_p(__typeof__(expr), signed int) ||        \
+   __builtin_types_compatible_p(__typeof__(expr), unsigned int) ||      \
+   __builtin_types_compatible_p(__typeof__(expr), short) ||             \
+   __builtin_types_compatible_p(__typeof__(expr), signed short) ||      \
+   __builtin_types_compatible_p(__typeof__(expr), unsigned short) ||    \
+   __builtin_types_compatible_p(__typeof__(expr), char) ||              \
+   __builtin_types_compatible_p(__typeof__(expr), signed char) ||       \
+   __builtin_types_compatible_p(__typeof__(expr), unsigned char)))      \
+                                                                  )
 
 /* evaluates to true if expr is of type curl_off_t */
-#define curlcheck_off_t(expr)                                   \
+#define curlcheck_off_t(expr)                                           \
   (__builtin_types_compatible_p(__typeof__(expr), curl_off_t))
 
 /* evaluates to true if expr is abuffer suitable for CURLOPT_ERRORBUFFER */
@@ -512,7 +686,7 @@ CURLWARNING(_curl_easy_getinfo_err_curl_off_t,
   (curlcheck_ptr((expr), void) ||                                       \
    curlcheck_ptr((expr), FILE))
 #else /* be less strict */
-#define curlcheck_cb_data(expr)                 \
+#define curlcheck_cb_data(expr)                                         \
   curlcheck_any_ptr(expr)
 #endif
 
@@ -534,8 +708,8 @@ CURLWARNING(_curl_easy_getinfo_err_curl_off_t,
    __builtin_types_compatible_p(__typeof__(func) *, type))
 
 /* evaluates to true if expr is of type curl_resolver_start_callback */
-#define curlcheck_resolver_start_callback(expr)       \
-  (curlcheck_NULL(expr) || \
+#define curlcheck_resolver_start_callback(expr)                         \
+  (curlcheck_NULL(expr) ||                                              \
    curlcheck_cb_compatible((expr), curl_resolver_start_callback))
 
 /* evaluates to true if expr is of type curl_read_callback or "similar" */
@@ -543,118 +717,123 @@ CURLWARNING(_curl_easy_getinfo_err_curl_off_t,
   (curlcheck_NULL(expr) ||                                              \
    curlcheck_cb_compatible((expr), __typeof__(fread) *) ||              \
    curlcheck_cb_compatible((expr), curl_read_callback) ||               \
-   curlcheck_cb_compatible((expr), _curl_read_callback1) ||             \
-   curlcheck_cb_compatible((expr), _curl_read_callback2) ||             \
-   curlcheck_cb_compatible((expr), _curl_read_callback3) ||             \
-   curlcheck_cb_compatible((expr), _curl_read_callback4) ||             \
-   curlcheck_cb_compatible((expr), _curl_read_callback5) ||             \
-   curlcheck_cb_compatible((expr), _curl_read_callback6))
-typedef size_t (*_curl_read_callback1)(char *, size_t, size_t, void *);
-typedef size_t (*_curl_read_callback2)(char *, size_t, size_t, const void *);
-typedef size_t (*_curl_read_callback3)(char *, size_t, size_t, FILE *);
-typedef size_t (*_curl_read_callback4)(void *, size_t, size_t, void *);
-typedef size_t (*_curl_read_callback5)(void *, size_t, size_t, const void *);
-typedef size_t (*_curl_read_callback6)(void *, size_t, size_t, FILE *);
+   curlcheck_cb_compatible((expr), Wcurl_read_callback1) ||             \
+   curlcheck_cb_compatible((expr), Wcurl_read_callback2) ||             \
+   curlcheck_cb_compatible((expr), Wcurl_read_callback3) ||             \
+   curlcheck_cb_compatible((expr), Wcurl_read_callback4) ||             \
+   curlcheck_cb_compatible((expr), Wcurl_read_callback5) ||             \
+   curlcheck_cb_compatible((expr), Wcurl_read_callback6))
+typedef size_t (*Wcurl_read_callback1)(char *, size_t, size_t, void *);
+typedef size_t (*Wcurl_read_callback2)(char *, size_t, size_t, const void *);
+typedef size_t (*Wcurl_read_callback3)(char *, size_t, size_t, FILE *);
+typedef size_t (*Wcurl_read_callback4)(void *, size_t, size_t, void *);
+typedef size_t (*Wcurl_read_callback5)(void *, size_t, size_t, const void *);
+typedef size_t (*Wcurl_read_callback6)(void *, size_t, size_t, FILE *);
 
 /* evaluates to true if expr is of type curl_write_callback or "similar" */
 #define curlcheck_write_cb(expr)                                        \
   (curlcheck_read_cb(expr) ||                                           \
    curlcheck_cb_compatible((expr), __typeof__(fwrite) *) ||             \
    curlcheck_cb_compatible((expr), curl_write_callback) ||              \
-   curlcheck_cb_compatible((expr), _curl_write_callback1) ||            \
-   curlcheck_cb_compatible((expr), _curl_write_callback2) ||            \
-   curlcheck_cb_compatible((expr), _curl_write_callback3) ||            \
-   curlcheck_cb_compatible((expr), _curl_write_callback4) ||            \
-   curlcheck_cb_compatible((expr), _curl_write_callback5) ||            \
-   curlcheck_cb_compatible((expr), _curl_write_callback6))
-typedef size_t (*_curl_write_callback1)(const char *, size_t, size_t, void *);
-typedef size_t (*_curl_write_callback2)(const char *, size_t, size_t,
-                                       const void *);
-typedef size_t (*_curl_write_callback3)(const char *, size_t, size_t, FILE *);
-typedef size_t (*_curl_write_callback4)(const void *, size_t, size_t, void *);
-typedef size_t (*_curl_write_callback5)(const void *, size_t, size_t,
-                                       const void *);
-typedef size_t (*_curl_write_callback6)(const void *, size_t, size_t, FILE *);
+   curlcheck_cb_compatible((expr), Wcurl_write_callback1) ||            \
+   curlcheck_cb_compatible((expr), Wcurl_write_callback2) ||            \
+   curlcheck_cb_compatible((expr), Wcurl_write_callback3) ||            \
+   curlcheck_cb_compatible((expr), Wcurl_write_callback4) ||            \
+   curlcheck_cb_compatible((expr), Wcurl_write_callback5) ||            \
+   curlcheck_cb_compatible((expr), Wcurl_write_callback6))
+typedef size_t (*Wcurl_write_callback1)(const char *, size_t, size_t, void *);
+typedef size_t (*Wcurl_write_callback2)(const char *, size_t, size_t,
+                                        const void *);
+typedef size_t (*Wcurl_write_callback3)(const char *, size_t, size_t, FILE *);
+typedef size_t (*Wcurl_write_callback4)(const void *, size_t, size_t, void *);
+typedef size_t (*Wcurl_write_callback5)(const void *, size_t, size_t,
+                                        const void *);
+typedef size_t (*Wcurl_write_callback6)(const void *, size_t, size_t, FILE *);
 
 /* evaluates to true if expr is of type curl_ioctl_callback or "similar" */
 #define curlcheck_ioctl_cb(expr)                                        \
   (curlcheck_NULL(expr) ||                                              \
    curlcheck_cb_compatible((expr), curl_ioctl_callback) ||              \
-   curlcheck_cb_compatible((expr), _curl_ioctl_callback1) ||            \
-   curlcheck_cb_compatible((expr), _curl_ioctl_callback2) ||            \
-   curlcheck_cb_compatible((expr), _curl_ioctl_callback3) ||            \
-   curlcheck_cb_compatible((expr), _curl_ioctl_callback4))
-typedef curlioerr (*_curl_ioctl_callback1)(CURL *, int, void *);
-typedef curlioerr (*_curl_ioctl_callback2)(CURL *, int, const void *);
-typedef curlioerr (*_curl_ioctl_callback3)(CURL *, curliocmd, void *);
-typedef curlioerr (*_curl_ioctl_callback4)(CURL *, curliocmd, const void *);
+   curlcheck_cb_compatible((expr), Wcurl_ioctl_callback1) ||            \
+   curlcheck_cb_compatible((expr), Wcurl_ioctl_callback2) ||            \
+   curlcheck_cb_compatible((expr), Wcurl_ioctl_callback3) ||            \
+   curlcheck_cb_compatible((expr), Wcurl_ioctl_callback4))
+typedef curlioerr (*Wcurl_ioctl_callback1)(CURL *, int, void *);
+typedef curlioerr (*Wcurl_ioctl_callback2)(CURL *, int, const void *);
+typedef curlioerr (*Wcurl_ioctl_callback3)(CURL *, curliocmd, void *);
+typedef curlioerr (*Wcurl_ioctl_callback4)(CURL *, curliocmd, const void *);
 
 /* evaluates to true if expr is of type curl_sockopt_callback or "similar" */
 #define curlcheck_sockopt_cb(expr)                                      \
   (curlcheck_NULL(expr) ||                                              \
    curlcheck_cb_compatible((expr), curl_sockopt_callback) ||            \
-   curlcheck_cb_compatible((expr), _curl_sockopt_callback1) ||          \
-   curlcheck_cb_compatible((expr), _curl_sockopt_callback2))
-typedef int (*_curl_sockopt_callback1)(void *, curl_socket_t, curlsocktype);
-typedef int (*_curl_sockopt_callback2)(const void *, curl_socket_t,
-                                      curlsocktype);
+   curlcheck_cb_compatible((expr), Wcurl_sockopt_callback1) ||          \
+   curlcheck_cb_compatible((expr), Wcurl_sockopt_callback2))
+typedef int (*Wcurl_sockopt_callback1)(void *, curl_socket_t, curlsocktype);
+typedef int (*Wcurl_sockopt_callback2)(const void *, curl_socket_t,
+                                       curlsocktype);
 
 /* evaluates to true if expr is of type curl_opensocket_callback or
    "similar" */
 #define curlcheck_opensocket_cb(expr)                                   \
   (curlcheck_NULL(expr) ||                                              \
    curlcheck_cb_compatible((expr), curl_opensocket_callback) ||         \
-   curlcheck_cb_compatible((expr), _curl_opensocket_callback1) ||       \
-   curlcheck_cb_compatible((expr), _curl_opensocket_callback2) ||       \
-   curlcheck_cb_compatible((expr), _curl_opensocket_callback3) ||       \
-   curlcheck_cb_compatible((expr), _curl_opensocket_callback4))
-typedef curl_socket_t (*_curl_opensocket_callback1)
+   curlcheck_cb_compatible((expr), Wcurl_opensocket_callback1) ||       \
+   curlcheck_cb_compatible((expr), Wcurl_opensocket_callback2) ||       \
+   curlcheck_cb_compatible((expr), Wcurl_opensocket_callback3) ||       \
+   curlcheck_cb_compatible((expr), Wcurl_opensocket_callback4))
+typedef curl_socket_t (*Wcurl_opensocket_callback1)
   (void *, curlsocktype, struct curl_sockaddr *);
-typedef curl_socket_t (*_curl_opensocket_callback2)
+typedef curl_socket_t (*Wcurl_opensocket_callback2)
   (void *, curlsocktype, const struct curl_sockaddr *);
-typedef curl_socket_t (*_curl_opensocket_callback3)
+typedef curl_socket_t (*Wcurl_opensocket_callback3)
   (const void *, curlsocktype, struct curl_sockaddr *);
-typedef curl_socket_t (*_curl_opensocket_callback4)
+typedef curl_socket_t (*Wcurl_opensocket_callback4)
   (const void *, curlsocktype, const struct curl_sockaddr *);
 
 /* evaluates to true if expr is of type curl_progress_callback or "similar" */
 #define curlcheck_progress_cb(expr)                                     \
   (curlcheck_NULL(expr) ||                                              \
    curlcheck_cb_compatible((expr), curl_progress_callback) ||           \
-   curlcheck_cb_compatible((expr), _curl_progress_callback1) ||         \
-   curlcheck_cb_compatible((expr), _curl_progress_callback2))
-typedef int (*_curl_progress_callback1)(void *,
+   curlcheck_cb_compatible((expr), Wcurl_progress_callback1) ||         \
+   curlcheck_cb_compatible((expr), Wcurl_progress_callback2))
+typedef int (*Wcurl_progress_callback1)(void *,
     double, double, double, double);
-typedef int (*_curl_progress_callback2)(const void *,
+typedef int (*Wcurl_progress_callback2)(const void *,
     double, double, double, double);
 
+/* evaluates to true if expr is of type curl_xferinfo_callback */
+#define curlcheck_xferinfo_cb(expr)                                     \
+  (curlcheck_NULL(expr) ||                                              \
+   curlcheck_cb_compatible((expr), curl_xferinfo_callback))
+
 /* evaluates to true if expr is of type curl_debug_callback or "similar" */
 #define curlcheck_debug_cb(expr)                                        \
   (curlcheck_NULL(expr) ||                                              \
    curlcheck_cb_compatible((expr), curl_debug_callback) ||              \
-   curlcheck_cb_compatible((expr), _curl_debug_callback1) ||            \
-   curlcheck_cb_compatible((expr), _curl_debug_callback2) ||            \
-   curlcheck_cb_compatible((expr), _curl_debug_callback3) ||            \
-   curlcheck_cb_compatible((expr), _curl_debug_callback4) ||            \
-   curlcheck_cb_compatible((expr), _curl_debug_callback5) ||            \
-   curlcheck_cb_compatible((expr), _curl_debug_callback6) ||            \
-   curlcheck_cb_compatible((expr), _curl_debug_callback7) ||            \
-   curlcheck_cb_compatible((expr), _curl_debug_callback8))
-typedef int (*_curl_debug_callback1) (CURL *,
+   curlcheck_cb_compatible((expr), Wcurl_debug_callback1) ||            \
+   curlcheck_cb_compatible((expr), Wcurl_debug_callback2) ||            \
+   curlcheck_cb_compatible((expr), Wcurl_debug_callback3) ||            \
+   curlcheck_cb_compatible((expr), Wcurl_debug_callback4) ||            \
+   curlcheck_cb_compatible((expr), Wcurl_debug_callback5) ||            \
+   curlcheck_cb_compatible((expr), Wcurl_debug_callback6) ||            \
+   curlcheck_cb_compatible((expr), Wcurl_debug_callback7) ||            \
+   curlcheck_cb_compatible((expr), Wcurl_debug_callback8))
+typedef int (*Wcurl_debug_callback1)(CURL *,
     curl_infotype, char *, size_t, void *);
-typedef int (*_curl_debug_callback2) (CURL *,
+typedef int (*Wcurl_debug_callback2)(CURL *,
     curl_infotype, char *, size_t, const void *);
-typedef int (*_curl_debug_callback3) (CURL *,
+typedef int (*Wcurl_debug_callback3)(CURL *,
     curl_infotype, const char *, size_t, void *);
-typedef int (*_curl_debug_callback4) (CURL *,
+typedef int (*Wcurl_debug_callback4)(CURL *,
     curl_infotype, const char *, size_t, const void *);
-typedef int (*_curl_debug_callback5) (CURL *,
+typedef int (*Wcurl_debug_callback5)(CURL *,
     curl_infotype, unsigned char *, size_t, void *);
-typedef int (*_curl_debug_callback6) (CURL *,
+typedef int (*Wcurl_debug_callback6)(CURL *,
     curl_infotype, unsigned char *, size_t, const void *);
-typedef int (*_curl_debug_callback7) (CURL *,
+typedef int (*Wcurl_debug_callback7)(CURL *,
     curl_infotype, const unsigned char *, size_t, void *);
-typedef int (*_curl_debug_callback8) (CURL *,
+typedef int (*Wcurl_debug_callback8)(CURL *,
     curl_infotype, const unsigned char *, size_t, const void *);
 
 /* evaluates to true if expr is of type curl_ssl_ctx_callback or "similar" */
@@ -662,56 +841,120 @@ typedef int (*_curl_debug_callback8) (CURL *,
 #define curlcheck_ssl_ctx_cb(expr)                                      \
   (curlcheck_NULL(expr) ||                                              \
    curlcheck_cb_compatible((expr), curl_ssl_ctx_callback) ||            \
-   curlcheck_cb_compatible((expr), _curl_ssl_ctx_callback1) ||          \
-   curlcheck_cb_compatible((expr), _curl_ssl_ctx_callback2) ||          \
-   curlcheck_cb_compatible((expr), _curl_ssl_ctx_callback3) ||          \
-   curlcheck_cb_compatible((expr), _curl_ssl_ctx_callback4) ||          \
-   curlcheck_cb_compatible((expr), _curl_ssl_ctx_callback5) ||          \
-   curlcheck_cb_compatible((expr), _curl_ssl_ctx_callback6) ||          \
-   curlcheck_cb_compatible((expr), _curl_ssl_ctx_callback7) ||          \
-   curlcheck_cb_compatible((expr), _curl_ssl_ctx_callback8))
-typedef CURLcode (*_curl_ssl_ctx_callback1)(CURL *, void *, void *);
-typedef CURLcode (*_curl_ssl_ctx_callback2)(CURL *, void *, const void *);
-typedef CURLcode (*_curl_ssl_ctx_callback3)(CURL *, const void *, void *);
-typedef CURLcode (*_curl_ssl_ctx_callback4)(CURL *, const void *,
+   curlcheck_cb_compatible((expr), Wcurl_ssl_ctx_callback1) ||          \
+   curlcheck_cb_compatible((expr), Wcurl_ssl_ctx_callback2) ||          \
+   curlcheck_cb_compatible((expr), Wcurl_ssl_ctx_callback3) ||          \
+   curlcheck_cb_compatible((expr), Wcurl_ssl_ctx_callback4) ||          \
+   curlcheck_cb_compatible((expr), Wcurl_ssl_ctx_callback5) ||          \
+   curlcheck_cb_compatible((expr), Wcurl_ssl_ctx_callback6) ||          \
+   curlcheck_cb_compatible((expr), Wcurl_ssl_ctx_callback7) ||          \
+   curlcheck_cb_compatible((expr), Wcurl_ssl_ctx_callback8))
+typedef CURLcode (*Wcurl_ssl_ctx_callback1)(CURL *, void *, void *);
+typedef CURLcode (*Wcurl_ssl_ctx_callback2)(CURL *, void *, const void *);
+typedef CURLcode (*Wcurl_ssl_ctx_callback3)(CURL *, const void *, void *);
+typedef CURLcode (*Wcurl_ssl_ctx_callback4)(CURL *, const void *,
                                             const void *);
 #ifdef HEADER_SSL_H
 /* hack: if we included OpenSSL's ssl.h, we know about SSL_CTX
- * this will of course break if we're included before OpenSSL headers...
+ * this of course breaks if we are included before OpenSSL headers...
  */
-typedef CURLcode (*_curl_ssl_ctx_callback5)(CURL *, SSL_CTX *, void *);
-typedef CURLcode (*_curl_ssl_ctx_callback6)(CURL *, SSL_CTX *, const void *);
-typedef CURLcode (*_curl_ssl_ctx_callback7)(CURL *, const SSL_CTX *, void *);
-typedef CURLcode (*_curl_ssl_ctx_callback8)(CURL *, const SSL_CTX *,
+typedef CURLcode (*Wcurl_ssl_ctx_callback5)(CURL *, SSL_CTX *, void *);
+typedef CURLcode (*Wcurl_ssl_ctx_callback6)(CURL *, SSL_CTX *, const void *);
+typedef CURLcode (*Wcurl_ssl_ctx_callback7)(CURL *, const SSL_CTX *, void *);
+typedef CURLcode (*Wcurl_ssl_ctx_callback8)(CURL *, const SSL_CTX *,
                                             const void *);
 #else
-typedef _curl_ssl_ctx_callback1 _curl_ssl_ctx_callback5;
-typedef _curl_ssl_ctx_callback1 _curl_ssl_ctx_callback6;
-typedef _curl_ssl_ctx_callback1 _curl_ssl_ctx_callback7;
-typedef _curl_ssl_ctx_callback1 _curl_ssl_ctx_callback8;
+typedef Wcurl_ssl_ctx_callback1 Wcurl_ssl_ctx_callback5;
+typedef Wcurl_ssl_ctx_callback1 Wcurl_ssl_ctx_callback6;
+typedef Wcurl_ssl_ctx_callback1 Wcurl_ssl_ctx_callback7;
+typedef Wcurl_ssl_ctx_callback1 Wcurl_ssl_ctx_callback8;
 #endif
 
 /* evaluates to true if expr is of type curl_conv_callback or "similar" */
 #define curlcheck_conv_cb(expr)                                         \
   (curlcheck_NULL(expr) ||                                              \
    curlcheck_cb_compatible((expr), curl_conv_callback) ||               \
-   curlcheck_cb_compatible((expr), _curl_conv_callback1) ||             \
-   curlcheck_cb_compatible((expr), _curl_conv_callback2) ||             \
-   curlcheck_cb_compatible((expr), _curl_conv_callback3) ||             \
-   curlcheck_cb_compatible((expr), _curl_conv_callback4))
-typedef CURLcode (*_curl_conv_callback1)(char *, size_t length);
-typedef CURLcode (*_curl_conv_callback2)(const char *, size_t length);
-typedef CURLcode (*_curl_conv_callback3)(void *, size_t length);
-typedef CURLcode (*_curl_conv_callback4)(const void *, size_t length);
+   curlcheck_cb_compatible((expr), Wcurl_conv_callback1) ||             \
+   curlcheck_cb_compatible((expr), Wcurl_conv_callback2) ||             \
+   curlcheck_cb_compatible((expr), Wcurl_conv_callback3) ||             \
+   curlcheck_cb_compatible((expr), Wcurl_conv_callback4))
+typedef CURLcode (*Wcurl_conv_callback1)(char *, size_t length);
+typedef CURLcode (*Wcurl_conv_callback2)(const char *, size_t length);
+typedef CURLcode (*Wcurl_conv_callback3)(void *, size_t length);
+typedef CURLcode (*Wcurl_conv_callback4)(const void *, size_t length);
 
 /* evaluates to true if expr is of type curl_seek_callback or "similar" */
 #define curlcheck_seek_cb(expr)                                         \
   (curlcheck_NULL(expr) ||                                              \
    curlcheck_cb_compatible((expr), curl_seek_callback) ||               \
-   curlcheck_cb_compatible((expr), _curl_seek_callback1) ||             \
-   curlcheck_cb_compatible((expr), _curl_seek_callback2))
-typedef CURLcode (*_curl_seek_callback1)(void *, curl_off_t, int);
-typedef CURLcode (*_curl_seek_callback2)(const void *, curl_off_t, int);
+   curlcheck_cb_compatible((expr), Wcurl_seek_callback1) ||             \
+   curlcheck_cb_compatible((expr), Wcurl_seek_callback2))
+typedef CURLcode (*Wcurl_seek_callback1)(void *, curl_off_t, int);
+typedef CURLcode (*Wcurl_seek_callback2)(const void *, curl_off_t, int);
 
+/* evaluates to true if expr is of type curl_chunk_bgn_callback */
+#define curlcheck_chunk_bgn_cb(expr)                                    \
+  (curlcheck_NULL(expr) ||                                              \
+   curlcheck_cb_compatible((expr), curl_chunk_bgn_callback) ||          \
+   curlcheck_cb_compatible((expr), Wcurl_chunk_bgn_callback1) ||        \
+   curlcheck_cb_compatible((expr), Wcurl_chunk_bgn_callback2))
+typedef long (*Wcurl_chunk_bgn_callback1)(struct curl_fileinfo *,
+                                          void *, int);
+typedef long (*Wcurl_chunk_bgn_callback2)(void *, void *, int);
+
+/* evaluates to true if expr is of type curl_chunk_end_callback */
+#define curlcheck_chunk_end_cb(expr)                                    \
+  (curlcheck_NULL(expr) ||                                              \
+   curlcheck_cb_compatible((expr), curl_chunk_end_callback))
+
+/* evaluates to true if expr is of type curl_closesocket_callback */
+#define curlcheck_close_socket_cb(expr)                                 \
+  (curlcheck_NULL(expr) ||                                              \
+   curlcheck_cb_compatible((expr), curl_closesocket_callback))
+
+/* evaluates to true if expr is of type curl_fnmatch_callback */
+#define curlcheck_fnmatch_cb(expr)                                      \
+  (curlcheck_NULL(expr) ||                                              \
+   curlcheck_cb_compatible((expr), curl_fnmatch_callback))
+
+/* evaluates to true if expr is of type curl_hstsread_callback */
+#define curlcheck_hstsread_cb(expr)                                     \
+  (curlcheck_NULL(expr) ||                                              \
+   curlcheck_cb_compatible((expr), curl_hstsread_callback))
+
+/* evaluates to true if expr is of type curl_hstswrite_callback */
+#define curlcheck_hstswrite_cb(expr)                                    \
+  (curlcheck_NULL(expr) ||                                              \
+   curlcheck_cb_compatible((expr), curl_hstswrite_callback))
+
+/* evaluates to true if expr is of type curl_sshhostkeycallback */
+#define curlcheck_ssh_hostkey_cb(expr)                                  \
+  (curlcheck_NULL(expr) ||                                              \
+   curlcheck_cb_compatible((expr), curl_sshhostkeycallback))
+
+/* evaluates to true if expr is of type curl_sshkeycallback */
+#define curlcheck_ssh_key_cb(expr)                                      \
+  (curlcheck_NULL(expr) ||                                              \
+   curlcheck_cb_compatible((expr), curl_sshkeycallback))
+
+/* evaluates to true if expr is of type curl_interleave_callback */
+#define curlcheck_interleave_cb(expr)                                   \
+  (curlcheck_NULL(expr) ||                                              \
+   curlcheck_cb_compatible((expr), Wcurl_interleave_callback1) ||       \
+   curlcheck_cb_compatible((expr), Wcurl_interleave_callback2))
+typedef size_t (*Wcurl_interleave_callback1)(void *p, size_t s,
+                                             size_t n, void *u);
+typedef size_t (*Wcurl_interleave_callback2)(char *p, size_t s,
+                                             size_t n, void *u);
+
+/* evaluates to true if expr is of type curl_prereq_callback */
+#define curlcheck_prereq_cb(expr)                                       \
+  (curlcheck_NULL(expr) ||                                              \
+   curlcheck_cb_compatible((expr), curl_prereq_callback))
+
+/* evaluates to true if expr is of type curl_trailer_callback */
+#define curlcheck_trailer_cb(expr)                                      \
+  (curlcheck_NULL(expr) ||                                              \
+   curlcheck_cb_compatible((expr), curl_trailer_callback))
 
 #endif /* CURLINC_TYPECHECK_GCC_H */
diff --git a/third-party/curl/include/curl/urlapi.h b/third-party/curl/include/curl/urlapi.h
index 88cdeb3bca..b1f3a2316b 100644
--- a/third-party/curl/include/curl/urlapi.h
+++ b/third-party/curl/include/curl/urlapi.h
@@ -26,7 +26,7 @@
 
 #include "curl.h"
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 extern "C" {
 #endif
 
@@ -63,6 +63,7 @@ typedef enum {
   CURLUE_BAD_SLASHES,         /* 28 */
   CURLUE_BAD_USER,            /* 29 */
   CURLUE_LACKS_IDN,           /* 30 */
+  CURLUE_TOO_LARGE,           /* 31 */
   CURLUE_LAST
 } CURLUcode;
 
@@ -80,24 +81,28 @@ typedef enum {
   CURLUPART_ZONEID /* added in 7.65.0 */
 } CURLUPart;
 
-#define CURLU_DEFAULT_PORT (1<<0)       /* return default port number */
-#define CURLU_NO_DEFAULT_PORT (1<<1)    /* act as if no port number was set,
-                                           if the port number matches the
-                                           default for the scheme */
-#define CURLU_DEFAULT_SCHEME (1<<2)     /* return default scheme if
-                                           missing */
-#define CURLU_NON_SUPPORT_SCHEME (1<<3) /* allow non-supported scheme */
-#define CURLU_PATH_AS_IS (1<<4)         /* leave dot sequences */
-#define CURLU_DISALLOW_USER (1<<5)      /* no user+password allowed */
-#define CURLU_URLDECODE (1<<6)          /* URL decode on get */
-#define CURLU_URLENCODE (1<<7)          /* URL encode on set */
-#define CURLU_APPENDQUERY (1<<8)        /* append a form style part */
-#define CURLU_GUESS_SCHEME (1<<9)       /* legacy curl-style guessing */
-#define CURLU_NO_AUTHORITY (1<<10)      /* Allow empty authority when the
-                                           scheme is unknown. */
-#define CURLU_ALLOW_SPACE (1<<11)       /* Allow spaces in the URL */
-#define CURLU_PUNYCODE (1<<12)          /* get the host name in punycode */
-#define CURLU_PUNY2IDN (1<<13)          /* punycode => IDN conversion */
+#define CURLU_DEFAULT_PORT (1 << 0)       /* return default port number */
+#define CURLU_NO_DEFAULT_PORT (1 << 1)    /* act as if no port number was set,
+                                             if the port number matches the
+                                             default for the scheme */
+#define CURLU_DEFAULT_SCHEME (1 << 2)     /* return default scheme if
+                                             missing */
+#define CURLU_NON_SUPPORT_SCHEME (1 << 3) /* allow non-supported scheme */
+#define CURLU_PATH_AS_IS (1 << 4)         /* leave dot sequences */
+#define CURLU_DISALLOW_USER (1 << 5)      /* no user+password allowed */
+#define CURLU_URLDECODE (1 << 6)          /* URL decode on get */
+#define CURLU_URLENCODE (1 << 7)          /* URL encode on set */
+#define CURLU_APPENDQUERY (1 << 8)        /* append a form style part */
+#define CURLU_GUESS_SCHEME (1 << 9)       /* legacy curl-style guessing */
+#define CURLU_NO_AUTHORITY (1 << 10)      /* Allow empty authority when the
+                                             scheme is unknown. */
+#define CURLU_ALLOW_SPACE (1 << 11)       /* Allow spaces in the URL */
+#define CURLU_PUNYCODE (1 << 12)          /* get the hostname in punycode */
+#define CURLU_PUNY2IDN (1 << 13)          /* punycode => IDN conversion */
+#define CURLU_GET_EMPTY (1 << 14)         /* allow empty queries and fragments
+                                             when extracting the URL or the
+                                             components */
+#define CURLU_NO_GUESS_SCHEME (1 << 15)   /* for get, do not accept a guess */
 
 typedef struct Curl_URL CURLU;
 
@@ -109,10 +114,10 @@ CURL_EXTERN CURLU *curl_url(void);
 
 /*
  * curl_url_cleanup() frees the CURLU handle and related resources used for
- * the URL parsing. It will not free strings previously returned with the URL
+ * the URL parsing. It does not free strings previously returned with the URL
  * API.
  */
-CURL_EXTERN void curl_url_cleanup(CURLU *handle);
+CURL_EXTERN void curl_url_cleanup(CURLU *u);
 
 /*
  * curl_url_dup() duplicates a CURLU handle and returns a new copy. The new
@@ -125,23 +130,23 @@ CURL_EXTERN CURLU *curl_url_dup(const CURLU *in);
  * handle. Returns error code. The returned pointer MUST be freed with
  * curl_free() afterwards.
  */
-CURL_EXTERN CURLUcode curl_url_get(const CURLU *handle, CURLUPart what,
+CURL_EXTERN CURLUcode curl_url_get(const CURLU *u, CURLUPart what,
                                    char **part, unsigned int flags);
 
 /*
  * curl_url_set() sets a specific part of the URL in a CURLU handle. Returns
- * error code. The passed in string will be copied. Passing a NULL instead of
+ * error code. The passed in string is copied. Passing a NULL instead of
  * a part string, clears that part.
  */
-CURL_EXTERN CURLUcode curl_url_set(CURLU *handle, CURLUPart what,
+CURL_EXTERN CURLUcode curl_url_set(CURLU *u, CURLUPart what,
                                    const char *part, unsigned int flags);
 
 /*
  * curl_url_strerror() turns a CURLUcode value into the equivalent human
- * readable error string.  This is useful for printing meaningful error
+ * readable error string. This is useful for printing meaningful error
  * messages.
  */
-CURL_EXTERN const char *curl_url_strerror(CURLUcode);
+CURL_EXTERN const char *curl_url_strerror(CURLUcode error);
 
 #ifdef __cplusplus
 } /* end of extern "C" */
diff --git a/third-party/curl/include/curl/websockets.h b/third-party/curl/include/curl/websockets.h
index 6ef6a2bc92..bf93715abf 100644
--- a/third-party/curl/include/curl/websockets.h
+++ b/third-party/curl/include/curl/websockets.h
@@ -24,7 +24,7 @@
  *
  ***************************************************************************/
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 extern "C" {
 #endif
 
@@ -37,12 +37,12 @@ struct curl_ws_frame {
 };
 
 /* flag bits */
-#define CURLWS_TEXT       (1<<0)
-#define CURLWS_BINARY     (1<<1)
-#define CURLWS_CONT       (1<<2)
-#define CURLWS_CLOSE      (1<<3)
-#define CURLWS_PING       (1<<4)
-#define CURLWS_OFFSET     (1<<5)
+#define CURLWS_TEXT       (1 << 0)
+#define CURLWS_BINARY     (1 << 1)
+#define CURLWS_CONT       (1 << 2)
+#define CURLWS_CLOSE      (1 << 3)
+#define CURLWS_PING       (1 << 4)
+#define CURLWS_OFFSET     (1 << 5)
 
 /*
  * NAME curl_ws_recv()
@@ -57,7 +57,7 @@ CURL_EXTERN CURLcode curl_ws_recv(CURL *curl, void *buffer, size_t buflen,
                                   const struct curl_ws_frame **metap);
 
 /* flags for curl_ws_send() */
-#define CURLWS_PONG       (1<<6)
+#define CURLWS_PONG       (1 << 6)
 
 /*
  * NAME curl_ws_send()
@@ -67,17 +67,31 @@ CURL_EXTERN CURLcode curl_ws_recv(CURL *curl, void *buffer, size_t buflen,
  * Sends data over the websocket connection. Use after successful
  * curl_easy_perform() with CURLOPT_CONNECT_ONLY option.
  */
-CURL_EXTERN CURLcode curl_ws_send(CURL *curl, const void *buffer,
+CURL_EXTERN CURLcode curl_ws_send(CURL *curl, const void *buffer_arg,
                                   size_t buflen, size_t *sent,
                                   curl_off_t fragsize,
                                   unsigned int flags);
 
+/*
+ * NAME curl_ws_start_frame()
+ *
+ * DESCRIPTION
+ *
+ * Buffers a websocket frame header with the given flags and length.
+ * Errors when a previous frame is not complete, e.g. not all its
+ * payload has been added.
+ */
+CURL_EXTERN CURLcode curl_ws_start_frame(CURL *curl,
+                                         unsigned int flags,
+                                         curl_off_t frame_len);
+
 /* bits for the CURLOPT_WS_OPTIONS bitmask: */
-#define CURLWS_RAW_MODE (1<<0)
+#define CURLWS_RAW_MODE   (1L << 0)
+#define CURLWS_NOAUTOPONG (1L << 1)
 
 CURL_EXTERN const struct curl_ws_frame *curl_ws_meta(CURL *curl);
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 }
 #endif
 
diff --git a/third-party/curl/lib/.checksrc b/third-party/curl/lib/.checksrc
deleted file mode 100644
index 16133a44c5..0000000000
--- a/third-party/curl/lib/.checksrc
+++ /dev/null
@@ -1 +0,0 @@
-enable STRERROR
diff --git a/third-party/curl/lib/.gitattributes b/third-party/curl/lib/.gitattributes
deleted file mode 100644
index 7e1eea50ff..0000000000
--- a/third-party/curl/lib/.gitattributes
+++ /dev/null
@@ -1,3 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
diff --git a/third-party/curl/lib/.gitignore b/third-party/curl/lib/.gitignore
index 7528196ed2..0f0bcd6465 100644
--- a/third-party/curl/lib/.gitignore
+++ b/third-party/curl/lib/.gitignore
@@ -2,16 +2,9 @@
 #
 # SPDX-License-Identifier: curl
 
-*.a
-*.imp
-*.nlm
-*.orig
-*.rej
-*.res
-TAGS
+Makefile.soname.cmake
 curl_config.h
 curl_config.h.in
-libcurl.plist.dist
-libcurl.plist
 libcurl.vers
-stamp-h1
+libcurl_unity.c
+unitprotos.h
diff --git a/third-party/curl/lib/CMakeLists.txt b/third-party/curl/lib/CMakeLists.txt
index 9bb8f0beb0..3ef623536e 100644
--- a/third-party/curl/lib/CMakeLists.txt
+++ b/third-party/curl/lib/CMakeLists.txt
@@ -21,91 +21,68 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-set(LIB_NAME libcurl)
-set(LIBCURL_OUTPUT_NAME libcurl CACHE STRING "Basename of the curl library")
-add_definitions(-DBUILDING_LIBCURL)
 
-configure_file(curl_config.h.cmake
-  ${CMAKE_CURRENT_BINARY_DIR}/curl_config.h)
+set(LIBCURL_OUTPUT_NAME "${LIB_NAME}" CACHE STRING "Basename of the curl library")
 
-transform_makefile_inc("Makefile.inc" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
-include(${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake)
+set_property(DIRECTORY APPEND PROPERTY COMPILE_DEFINITIONS ${CURL_DEBUG_MACROS} "BUILDING_LIBCURL")
 
-list(APPEND HHEADERS
-  ${CMAKE_CURRENT_BINARY_DIR}/curl_config.h
-  )
+configure_file("curl_config-cmake.h.in" "${CMAKE_CURRENT_BINARY_DIR}/curl_config.h")
+
+# Get CSOURCES, HHEADERS, LIB_RCFILES variables
+curl_transform_makefile_inc("Makefile.inc" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
+include("${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
+
+list(APPEND HHEADERS "${CMAKE_CURRENT_BINARY_DIR}/curl_config.h")
 
 # The rest of the build
 
-include_directories(${CMAKE_CURRENT_BINARY_DIR}/../include)
-include_directories(${CMAKE_CURRENT_SOURCE_DIR}/..)
-include_directories(${CMAKE_CURRENT_SOURCE_DIR}/../include)
-include_directories(${CMAKE_CURRENT_BINARY_DIR}/..)
-include_directories(${CMAKE_CURRENT_SOURCE_DIR})
-include_directories(${CMAKE_CURRENT_BINARY_DIR})
-if(USE_ARES)
-  include_directories(${CARES_INCLUDE_DIR})
-endif()
-
-add_library(
-  curlu # special libcurlu library just for unittests
-  STATIC
-  EXCLUDE_FROM_ALL
-  ${HHEADERS} ${CSOURCES}
+set_property(DIRECTORY APPEND PROPERTY INCLUDE_DIRECTORIES
+  "${PROJECT_BINARY_DIR}/lib"        # for "curl_config.h"
+  "${PROJECT_SOURCE_DIR}/lib"
 )
-target_compile_definitions(curlu PUBLIC UNITTESTS CURL_STATICLIB)
 
-if(ENABLE_CURLDEBUG)
-  # We must compile memdebug.c separately to avoid memdebug.h redefinitions
-  # being applied to memdebug.c itself.
-  set_source_files_properties(memdebug.c PROPERTIES SKIP_UNITY_BUILD_INCLUSION ON)
-endif()
-target_link_libraries(curlu PRIVATE ${CURL_LIBS})
+if(CURL_BUILD_TESTING)
+  # special libcurlu library for unittests
+  add_library(curlu STATIC EXCLUDE_FROM_ALL ${HHEADERS} ${CSOURCES})
+  target_compile_definitions(curlu PUBLIC "CURL_STATICLIB" "UNITTESTS")
+  target_link_libraries(curlu PUBLIC ${CURL_LIBS})
+  # There is plenty of parallelism when building the testdeps target.
+  # Override the curlu batch size with the maximum to optimize performance.
+  set_target_properties(curlu PROPERTIES UNITY_BUILD ON UNITY_BUILD_BATCH_SIZE 0 C_CLANG_TIDY "")
 
-transform_makefile_inc("Makefile.soname" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.soname.cmake")
-include(${CMAKE_CURRENT_BINARY_DIR}/Makefile.soname.cmake)
-
-if(CMAKE_SYSTEM_NAME STREQUAL "AIX" OR
-  CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
-  CMAKE_SYSTEM_NAME STREQUAL "Darwin" OR
-  CMAKE_SYSTEM_NAME STREQUAL "SunOS" OR
-  CMAKE_SYSTEM_NAME STREQUAL "GNU/kFreeBSD" OR
-
-  # FreeBSD comes with the a.out and elf flavours
-  # but a.out was supported up to version 3.x and
-  # elf from 3.x. I cannot imagine someone running
-  # CMake on those ancient systems
-  CMAKE_SYSTEM_NAME STREQUAL "FreeBSD" OR
-
-  CMAKE_SYSTEM_NAME STREQUAL "Haiku")
-
-  math(EXPR CMAKESONAME "${VERSIONCHANGE} - ${VERSIONDEL}")
-  set(CMAKEVERSION "${CMAKESONAME}.${VERSIONDEL}.${VERSIONADD}")
-else()
-  unset(CMAKESONAME)
-endif()
-
-if(NOT WIN32 AND NOT CMAKE_CROSSCOMPILING)
-  # on not-Windows and not-crosscompiling, check for writable argv[]
-    include(CheckCSourceRuns)
-    check_c_source_runs("
-int main(int argc, char **argv)
-{
-  (void)argc;
-  argv[0][0] = ' ';
-  return (argv[0][0] == ' ')?0:1;
-}"
-      HAVE_WRITABLE_ARGV)
+  add_custom_command(OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/unitprotos.h"
+    WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
+    COMMAND ${PERL_EXECUTABLE} "${PROJECT_SOURCE_DIR}/scripts/extract-unit-protos"
+      ${CSOURCES} > "${CMAKE_CURRENT_BINARY_DIR}/unitprotos.h"
+    DEPENDS "${PROJECT_SOURCE_DIR}/scripts/extract-unit-protos" ${CSOURCES}
+    VERBATIM)
+  add_custom_target(curlu-unitprotos DEPENDS "${CMAKE_CURRENT_BINARY_DIR}/unitprotos.h")
 endif()
 
 ## Library definition
 
-# Add "_imp" as a suffix before the extension to avoid conflicting with
-# the statically linked "libcurl.lib" (typically with MSVC)
-if(WIN32 AND
-   NOT IMPORT_LIB_SUFFIX AND
-   CMAKE_STATIC_LIBRARY_SUFFIX STREQUAL CMAKE_IMPORT_LIBRARY_SUFFIX)
-  set(IMPORT_LIB_SUFFIX "_imp")
+if(NOT DEFINED IMPORT_LIB_SUFFIX)
+  # Suffix implib name with "_imp" by default, to avoid conflicting with
+  # the generated static "libcurl.lib" (typically with MSVC).
+  if(WIN32 AND BUILD_SHARED_LIBS AND
+     CMAKE_IMPORT_LIBRARY_SUFFIX STREQUAL CMAKE_STATIC_LIBRARY_SUFFIX)
+    set(IMPORT_LIB_SUFFIX "_imp")
+  else()
+    set(IMPORT_LIB_SUFFIX "")
+  endif()
+endif()
+if(NOT DEFINED STATIC_LIB_SUFFIX)
+  set(STATIC_LIB_SUFFIX "")
+endif()
+
+# Detect implib static lib filename collision
+if(WIN32 AND BUILD_STATIC_LIBS AND BUILD_SHARED_LIBS AND
+   "${IMPORT_LIB_SUFFIX}${CMAKE_IMPORT_LIBRARY_SUFFIX}" STREQUAL
+   "${STATIC_LIB_SUFFIX}${CMAKE_STATIC_LIBRARY_SUFFIX}")
+  message(FATAL_ERROR "Library suffix is the same ('${STATIC_LIB_SUFFIX}${CMAKE_STATIC_LIBRARY_SUFFIX}') "
+    "for the import and static '${LIBCURL_OUTPUT_NAME}' library. "
+    "Set IMPORT_LIB_SUFFIX and/or STATIC_LIB_SUFFIX to different values, "
+    "or disable building either the shared or static library to avoid the filename collision.")
 endif()
 
 # Whether to do a single compilation pass for libcurl sources and reuse these
@@ -125,61 +102,97 @@ endif()
 if(SHARE_LIB_OBJECT)
   set(LIB_OBJECT "libcurl_object")
   add_library(${LIB_OBJECT} OBJECT ${HHEADERS} ${CSOURCES})
+  if(WIN32)
+    # Define CURL_STATICLIB always, to disable __declspec(dllexport) for
+    # exported libcurl symbols. We handle exports via libcurl.def instead.
+    # Except with symbol hiding disabled or debug mode enabled, when we export
+    # _all_ symbols from libcurl DLL, without using libcurl.def.
+    set_property(TARGET ${LIB_OBJECT} APPEND PROPERTY COMPILE_DEFINITIONS "CURL_STATICLIB")
+  endif()
   target_link_libraries(${LIB_OBJECT} PRIVATE ${CURL_LIBS})
-  set_target_properties(${LIB_OBJECT} PROPERTIES
-    COMPILE_DEFINITIONS "BUILDING_LIBCURL"
-    INTERFACE_COMPILE_DEFINITIONS "CURL_STATICLIB"
-    POSITION_INDEPENDENT_CODE ON)
-  if(HIDES_CURL_PRIVATE_SYMBOLS)
-    set_target_properties(${LIB_OBJECT} PROPERTIES
-      COMPILE_DEFINITIONS "CURL_HIDDEN_SYMBOLS"
-      COMPILE_FLAGS "${CURL_CFLAG_SYMBOLS_HIDE}")
+  set_target_properties(${LIB_OBJECT} PROPERTIES POSITION_INDEPENDENT_CODE ON)
+  set_property(TARGET ${LIB_OBJECT} APPEND PROPERTY COMPILE_OPTIONS "${CURL_CFLAGS}")
+  if(CURL_HIDES_PRIVATE_SYMBOLS)
+    set_property(TARGET ${LIB_OBJECT} APPEND PROPERTY COMPILE_OPTIONS "${CURL_CFLAG_SYMBOLS_HIDE}")
+    set_property(TARGET ${LIB_OBJECT} APPEND PROPERTY COMPILE_DEFINITIONS "CURL_HIDDEN_SYMBOLS")
   endif()
   if(CURL_HAS_LTO)
-    set_target_properties(${LIB_OBJECT} PROPERTIES
-      INTERPROCEDURAL_OPTIMIZATION_RELEASE TRUE
-      INTERPROCEDURAL_OPTIMIZATION_RELWITHDEBINFO TRUE)
+    if(CMAKE_CONFIGURATION_TYPES)
+      set_target_properties(${LIB_OBJECT} PROPERTIES
+        INTERPROCEDURAL_OPTIMIZATION_RELEASE TRUE
+        INTERPROCEDURAL_OPTIMIZATION_RELWITHDEBINFO TRUE)
+    else()
+      set_target_properties(${LIB_OBJECT} PROPERTIES INTERPROCEDURAL_OPTIMIZATION TRUE)
+    endif()
+  endif()
+  if(CURL_CLANG_TIDY)
+    set_target_properties(${LIB_OBJECT} PROPERTIES UNITY_BUILD OFF)
+  endif()
+  if(CURL_ANALYZER_CFLAGS)
+    set_target_properties(${LIB_OBJECT} PROPERTIES UNITY_BUILD OFF)
+    set_property(TARGET ${LIB_OBJECT} APPEND PROPERTY COMPILE_OPTIONS ${CURL_ANALYZER_CFLAGS})
+  endif()
+  if(CURL_CODE_COVERAGE)
+    set_property(TARGET ${LIB_OBJECT} APPEND PROPERTY COMPILE_DEFINITIONS ${CURL_COVERAGE_MACROS})
+    set_property(TARGET ${LIB_OBJECT} APPEND PROPERTY COMPILE_OPTIONS ${CURL_COVERAGE_CFLAGS})
   endif()
 
   target_include_directories(${LIB_OBJECT} INTERFACE
-    $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
-    $<BUILD_INTERFACE:${CURL_SOURCE_DIR}/include>)
+    "$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>"
+    "$<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/include>")
 
   set(LIB_SOURCE $<TARGET_OBJECTS:${LIB_OBJECT}>)
 else()
   set(LIB_SOURCE ${HHEADERS} ${CSOURCES})
 endif()
 
-# we want it to be called libcurl on all platforms
+# We want it to be called libcurl on all platforms
 if(BUILD_STATIC_LIBS)
   list(APPEND libcurl_export ${LIB_STATIC})
   add_library(${LIB_STATIC} STATIC ${LIB_SOURCE})
   add_library(${PROJECT_NAME}::${LIB_STATIC} ALIAS ${LIB_STATIC})
+  if(WIN32)
+    set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_DEFINITIONS "CURL_STATICLIB")
+  endif()
   target_link_libraries(${LIB_STATIC} PRIVATE ${CURL_LIBS})
   # Remove the "lib" prefix since the library is already named "libcurl".
   set_target_properties(${LIB_STATIC} PROPERTIES
     PREFIX "" OUTPUT_NAME "${LIBCURL_OUTPUT_NAME}"
     SUFFIX "${STATIC_LIB_SUFFIX}${CMAKE_STATIC_LIBRARY_SUFFIX}"
-    COMPILE_DEFINITIONS "BUILDING_LIBCURL"
     INTERFACE_COMPILE_DEFINITIONS "CURL_STATICLIB")
-  if(HIDES_CURL_PRIVATE_SYMBOLS)
-    set_target_properties(${LIB_STATIC} PROPERTIES
-      COMPILE_DEFINITIONS "CURL_HIDDEN_SYMBOLS"
-      COMPILE_FLAGS "${CURL_CFLAG_SYMBOLS_HIDE}")
+  set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_OPTIONS "${CURL_CFLAGS}")
+  if(CURL_HIDES_PRIVATE_SYMBOLS)
+    set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_OPTIONS "${CURL_CFLAG_SYMBOLS_HIDE}")
+    set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_DEFINITIONS "CURL_HIDDEN_SYMBOLS")
   endif()
   if(CURL_HAS_LTO)
-    set_target_properties(${LIB_STATIC} PROPERTIES
-      INTERPROCEDURAL_OPTIMIZATION_RELEASE TRUE
-      INTERPROCEDURAL_OPTIMIZATION_RELWITHDEBINFO TRUE)
+    if(CMAKE_CONFIGURATION_TYPES)
+      set_target_properties(${LIB_STATIC} PROPERTIES
+        INTERPROCEDURAL_OPTIMIZATION_RELEASE TRUE
+        INTERPROCEDURAL_OPTIMIZATION_RELWITHDEBINFO TRUE)
+    else()
+      set_target_properties(${LIB_STATIC} PROPERTIES INTERPROCEDURAL_OPTIMIZATION TRUE)
+    endif()
   endif()
-  if(CMAKEVERSION AND CMAKESONAME)
-    set_target_properties(${LIB_STATIC} PROPERTIES
-      VERSION ${CMAKEVERSION} SOVERSION ${CMAKESONAME})
+  if(CURL_CLANG_TIDY)
+    if(BUILD_SHARED_LIBS)  # disable clang-tidy for static, and limit to the shared library, if both enabled
+      set_target_properties(${LIB_STATIC} PROPERTIES C_CLANG_TIDY "")
+    else()
+      set_target_properties(${LIB_STATIC} PROPERTIES UNITY_BUILD OFF)
+    endif()
+  endif()
+  if(CURL_ANALYZER_CFLAGS)
+    set_target_properties(${LIB_STATIC} PROPERTIES UNITY_BUILD OFF)
+    set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_OPTIONS ${CURL_ANALYZER_CFLAGS})
+  endif()
+  if(CURL_CODE_COVERAGE)
+    set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_DEFINITIONS ${CURL_COVERAGE_MACROS})
+    set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_OPTIONS ${CURL_COVERAGE_CFLAGS})
   endif()
 
   target_include_directories(${LIB_STATIC} INTERFACE
-    $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
-    $<BUILD_INTERFACE:${CURL_SOURCE_DIR}/include>)
+    "$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>"
+    "$<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/include>")
 endif()
 
 if(BUILD_SHARED_LIBS)
@@ -187,40 +200,130 @@ if(BUILD_SHARED_LIBS)
   add_library(${LIB_SHARED} SHARED ${LIB_SOURCE})
   add_library(${PROJECT_NAME}::${LIB_SHARED} ALIAS ${LIB_SHARED})
   if(WIN32)
-    set_property(TARGET ${LIB_SHARED} APPEND PROPERTY SOURCES libcurl.rc ${CURL_SOURCE_DIR}/libcurl.def)
+    set_property(TARGET ${LIB_SHARED} APPEND PROPERTY SOURCES "dllmain.c")
+    set_property(TARGET ${LIB_SHARED} APPEND PROPERTY SOURCES ${LIB_RCFILES})
+    if(CURL_HIDES_PRIVATE_SYMBOLS)
+      set_property(TARGET ${LIB_SHARED} APPEND PROPERTY SOURCES "${PROJECT_SOURCE_DIR}/lib/libcurl.def")
+    endif()
   endif()
   target_link_libraries(${LIB_SHARED} PRIVATE ${CURL_LIBS})
   # Remove the "lib" prefix since the library is already named "libcurl".
   set_target_properties(${LIB_SHARED} PROPERTIES
     PREFIX "" OUTPUT_NAME "${LIBCURL_OUTPUT_NAME}"
     IMPORT_PREFIX "" IMPORT_SUFFIX "${IMPORT_LIB_SUFFIX}${CMAKE_IMPORT_LIBRARY_SUFFIX}"
-    COMPILE_DEFINITIONS "BUILDING_LIBCURL"
     POSITION_INDEPENDENT_CODE ON)
-  if(HIDES_CURL_PRIVATE_SYMBOLS)
-    set_target_properties(${LIB_SHARED} PROPERTIES
-      COMPILE_DEFINITIONS "CURL_HIDDEN_SYMBOLS"
-      COMPILE_FLAGS "${CURL_CFLAG_SYMBOLS_HIDE}")
+  set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_OPTIONS "${CURL_CFLAGS}")
+  if(CURL_HIDES_PRIVATE_SYMBOLS)
+    set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_OPTIONS "${CURL_CFLAG_SYMBOLS_HIDE}")
+    set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_DEFINITIONS "CURL_HIDDEN_SYMBOLS")
   endif()
   if(CURL_HAS_LTO)
-    set_target_properties(${LIB_SHARED} PROPERTIES
-      INTERPROCEDURAL_OPTIMIZATION_RELEASE TRUE
-      INTERPROCEDURAL_OPTIMIZATION_RELWITHDEBINFO TRUE)
+    if(CMAKE_CONFIGURATION_TYPES)
+      set_target_properties(${LIB_SHARED} PROPERTIES
+        INTERPROCEDURAL_OPTIMIZATION_RELEASE TRUE
+        INTERPROCEDURAL_OPTIMIZATION_RELWITHDEBINFO TRUE)
+    else()
+      set_target_properties(${LIB_SHARED} PROPERTIES INTERPROCEDURAL_OPTIMIZATION TRUE)
+    endif()
   endif()
-  if(CMAKEVERSION AND CMAKESONAME)
-    set_target_properties(${LIB_SHARED} PROPERTIES
-      VERSION ${CMAKEVERSION} SOVERSION ${CMAKESONAME})
+  if(CURL_CLANG_TIDY)
+    set_target_properties(${LIB_SHARED} PROPERTIES UNITY_BUILD OFF)
+  endif()
+  if(CURL_ANALYZER_CFLAGS)
+    set_target_properties(${LIB_SHARED} PROPERTIES UNITY_BUILD OFF)
+    set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_OPTIONS ${CURL_ANALYZER_CFLAGS})
+  endif()
+  if(CURL_CODE_COVERAGE)
+    set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_DEFINITIONS ${CURL_COVERAGE_MACROS})
+    set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_OPTIONS ${CURL_COVERAGE_CFLAGS})
+    set_property(TARGET ${LIB_SHARED} APPEND PROPERTY LINK_OPTIONS ${CURL_COVERAGE_LDFLAGS})
   endif()
 
   target_include_directories(${LIB_SHARED} INTERFACE
-    $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
-    $<BUILD_INTERFACE:${CURL_SOURCE_DIR}/include>)
+    "$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>"
+    "$<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/include>")
+
+  if(CMAKE_DLL_NAME_WITH_SOVERSION OR
+    CYGWIN OR
+    APPLE OR
+    AIX OR CMAKE_SYSTEM_NAME STREQUAL "AIX" OR
+    CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
+    CMAKE_SYSTEM_NAME STREQUAL "SunOS" OR
+    CMAKE_SYSTEM_NAME STREQUAL "Haiku" OR
+    CMAKE_SYSTEM_NAME STREQUAL "OHOS" OR  # OpenHarmony
+    CMAKE_SYSTEM_NAME STREQUAL "GNU/kFreeBSD" OR
+    # FreeBSD comes with the a.out and ELF flavors but a.out was supported
+    # up to v3.x and ELF from v3.x. I cannot imagine someone running CMake
+    # on those ancient systems.
+    CMAKE_SYSTEM_NAME STREQUAL "FreeBSD")
+    set(_soversion_default TRUE)
+  else()
+    set(_soversion_default FALSE)
+  endif()
+
+  option(CURL_LIBCURL_SOVERSION "Enable libcurl SOVERSION" ${_soversion_default})
+  option(CURL_LIBCURL_VERSIONED_SYMBOLS "Enable libcurl versioned symbols" OFF)
+
+  if(CURL_LIBCURL_SOVERSION OR CURL_LIBCURL_VERSIONED_SYMBOLS)
+    # Get VERSIONCHANGE, VERSIONADD, VERSIONDEL, VERSIONINFO variables
+    curl_transform_makefile_inc("Makefile.soname" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.soname.cmake")
+    include("${CMAKE_CURRENT_BINARY_DIR}/Makefile.soname.cmake")
+
+    math(EXPR _cmakesoname "${VERSIONCHANGE} - ${VERSIONDEL}")
+    set(_cmakeversion "${_cmakesoname}.${VERSIONDEL}.${VERSIONADD}")
+  endif()
+
+  if(CURL_LIBCURL_SOVERSION)
+    set_target_properties(${LIB_SHARED} PROPERTIES
+      VERSION "${_cmakeversion}" SOVERSION "${_cmakesoname}")
+  endif()
+
+  ## Versioned symbols
+
+  if(CURL_LIBCURL_VERSIONED_SYMBOLS)
+    if(NOT DEFINED CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX)
+      # Default to prefixes used by autotools
+      if(CURL_WITH_MULTI_SSL)
+        set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "MULTISSL_")
+      elseif(CURL_USE_OPENSSL)
+        set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "OPENSSL_")
+      elseif(CURL_USE_MBEDTLS)
+        set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "MBEDTLS_")
+      elseif(CURL_USE_WOLFSSL)
+        set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "WOLFSSL_")
+      elseif(CURL_USE_GNUTLS)
+        set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "GNUTLS_")
+      elseif(CURL_USE_RUSTLS)
+        set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "RUSTLS_")
+      endif()
+    endif()
+    # Generate version script for the linker, for versioned symbols.
+    # Consumed variables:
+    #   CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX
+    #   CURL_LIBCURL_VERSIONED_SYMBOLS_SONAME
+    set(CURL_LIBCURL_VERSIONED_SYMBOLS_SONAME ${_cmakesoname})
+    configure_file(
+      "${CMAKE_CURRENT_SOURCE_DIR}/libcurl.vers.in"
+      "${CMAKE_CURRENT_BINARY_DIR}/libcurl.vers" @ONLY)
+    include(CMakePushCheckState)
+    include(CheckCSourceCompiles)
+    cmake_push_check_state()
+    set(CMAKE_REQUIRED_LINK_OPTIONS "-Wl,--version-script=${CMAKE_CURRENT_BINARY_DIR}/libcurl.vers")
+    check_c_source_compiles("int main(void) { return 0; }" HAVE_VERSIONED_SYMBOLS)
+    if(HAVE_VERSIONED_SYMBOLS)
+      set_property(TARGET ${LIB_SHARED} APPEND PROPERTY LINK_OPTIONS "${CMAKE_REQUIRED_LINK_OPTIONS}")
+    else()
+      message(WARNING "Versioned symbols requested, but not supported by the toolchain.")
+    endif()
+    cmake_pop_check_state()
+  endif()
 endif()
 
 add_library(${LIB_NAME} ALIAS ${LIB_SELECTED})
 add_library(${PROJECT_NAME}::${LIB_NAME} ALIAS ${LIB_SELECTED})
 
 if(CURL_ENABLE_EXPORT_TARGET)
-  if(BUILD_STATIC_LIBS)
+  if(NOT CURL_DISABLE_INSTALL AND BUILD_STATIC_LIBS)
     install(TARGETS ${LIB_STATIC}
       EXPORT ${TARGETS_EXPORT_NAME}
       ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
@@ -228,7 +331,7 @@ if(CURL_ENABLE_EXPORT_TARGET)
       RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
     )
   endif()
-  if(BUILD_SHARED_LIBS)
+  if(NOT CURL_DISABLE_INSTALL AND BUILD_SHARED_LIBS)
     install(TARGETS ${LIB_SHARED}
       EXPORT ${TARGETS_EXPORT_NAME}
       ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
@@ -238,7 +341,16 @@ if(CURL_ENABLE_EXPORT_TARGET)
   endif()
 
   export(TARGETS ${libcurl_export}
-         FILE ${PROJECT_BINARY_DIR}/libcurl-target.cmake
-         NAMESPACE ${PROJECT_NAME}::
+    FILE "${PROJECT_BINARY_DIR}/libcurl-target.cmake"
+    NAMESPACE ${PROJECT_NAME}::
+  )
+endif()
+
+if(PERL_EXECUTABLE)
+  add_custom_target(curl-optiontable
+    COMMENT "Generating lib/easyoptions.c" VERBATIM USES_TERMINAL
+    COMMAND "${PERL_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/optiontable.pl" "${PROJECT_SOURCE_DIR}/include/curl/curl.h"
+      > "${PROJECT_SOURCE_DIR}/lib/easyoptions.c"
+    DEPENDS "${CMAKE_CURRENT_SOURCE_DIR}/optiontable.pl" "${PROJECT_SOURCE_DIR}/include/curl/curl.h"
   )
 endif()
diff --git a/third-party/curl/lib/Makefile.am b/third-party/curl/lib/Makefile.am
index 3c0a709127..8a2bd4e68e 100644
--- a/third-party/curl/lib/Makefile.am
+++ b/third-party/curl/lib/Makefile.am
@@ -23,18 +23,23 @@
 ###########################################################################
 AUTOMAKE_OPTIONS = foreign nostdinc
 
-CMAKE_DIST = CMakeLists.txt curl_config.h.cmake
+# Get CSOURCES, HHEADERS, LIB_RCFILES variables
+include Makefile.inc
 
-EXTRA_DIST = Makefile.mk config-win32.h config-win32ce.h config-plan9.h    \
- config-riscos.h config-mac.h curl_config.h.in config-dos.h                \
- libcurl.plist libcurl.rc config-amigaos.h config-win32ce.h                \
- config-os400.h setup-os400.h $(CMAKE_DIST) setup-win32.h .checksrc \
- Makefile.soname
+CMAKE_DIST = CMakeLists.txt curl_config-cmake.h.in
+
+EXTRA_DIST = config-mac.h config-os400.h config-riscos.h config-win32.h         \
+  curl_config.h.in $(LIB_RCFILES) libcurl.def $(CMAKE_DIST) Makefile.soname     \
+  optiontable.pl
 
 lib_LTLIBRARIES = libcurl.la
 
 if BUILD_UNITTESTS
 noinst_LTLIBRARIES = libcurlu.la
+
+# generate a file with "private" prototypes for unit testing
+UNITPROTOS = unitprotos.h
+
 else
 noinst_LTLIBRARIES =
 endif
@@ -49,32 +54,49 @@ CFLAGS += @CURL_CFLAG_EXTRAS@
 #
 # $(top_srcdir)/include is for libcurl's external include files
 # $(top_builddir)/lib is for libcurl's generated lib/curl_config.h file
-# $(top_srcdir)/lib for libcurl's lib/curl_setup.h and other "private" files
+# $(srcdir) for the generated unity source to find included sources
 
-AM_CPPFLAGS = -I$(top_srcdir)/include        \
-              -I$(top_builddir)/lib          \
-              -I$(top_srcdir)/lib
+AM_CPPFLAGS = -I$(top_srcdir)/include   \
+              -I$(top_builddir)/lib     \
+              -I$(top_srcdir)/lib       \
+              -I$(srcdir)
 
 # Prevent LIBS from being used for all link targets
 LIBS = $(BLANK_AT_MAKETIME)
 
-include Makefile.soname
-
+if DEBUGBUILD
+AM_CPPFLAGS += -DDEBUGBUILD
+endif
 AM_CPPFLAGS += -DBUILDING_LIBCURL
-AM_LDFLAGS =
-AM_CFLAGS =
 
-# Makefile.inc provides the CSOURCES and HHEADERS defines
-include Makefile.inc
+if DOING_NATIVE_WINDOWS
+CSOURCES += dllmain.c
+endif
 
+if USE_UNITY
+libcurl_unity.c: $(top_srcdir)/scripts/mk-unity.pl $(CSOURCES)
+	@PERL@ $(top_srcdir)/scripts/mk-unity.pl --include $(CSOURCES) > libcurl_unity.c
+
+nodist_libcurl_la_SOURCES = libcurl_unity.c
+libcurl_la_SOURCES =
+nodist_libcurlu_la_SOURCES = libcurl_unity.c
+libcurlu_la_SOURCES =
+CLEANFILES = libcurl_unity.c
+else
 libcurl_la_SOURCES = $(CSOURCES) $(HHEADERS)
 libcurlu_la_SOURCES = $(CSOURCES) $(HHEADERS)
+CLEANFILES =
+endif
+
+CLEANFILES += $(UNITPROTOS)
 
 libcurl_la_CPPFLAGS_EXTRA =
 libcurl_la_LDFLAGS_EXTRA =
 libcurl_la_CFLAGS_EXTRA =
 
 if CURL_LT_SHLIB_USE_VERSION_INFO
+# Get VERSIONCHANGE, VERSIONADD, VERSIONDEL, VERSIONINFO variables
+include Makefile.soname
 libcurl_la_LDFLAGS_EXTRA += $(VERSIONINFO)
 endif
 
@@ -110,12 +132,11 @@ libcurl_la_CFLAGS_EXTRA += $(CFLAG_CURL_SYMBOL_HIDING)
 endif
 
 libcurl_la_CPPFLAGS = $(AM_CPPFLAGS) $(libcurl_la_CPPFLAGS_EXTRA)
-libcurl_la_LDFLAGS = $(AM_LDFLAGS) $(libcurl_la_LDFLAGS_EXTRA) $(LDFLAGS) $(LIBCURL_LIBS)
-libcurl_la_CFLAGS = $(AM_CFLAGS) $(libcurl_la_CFLAGS_EXTRA)
+libcurl_la_LDFLAGS = $(libcurl_la_LDFLAGS_EXTRA) $(CURL_LDFLAGS_LIB) $(LIBCURL_PC_LIBS_PRIVATE)
+libcurl_la_CFLAGS = $(libcurl_la_CFLAGS_EXTRA)
 
 libcurlu_la_CPPFLAGS = $(AM_CPPFLAGS) -DCURL_STATICLIB -DUNITTESTS
-libcurlu_la_LDFLAGS = $(AM_LDFLAGS) -static $(LIBCURL_LIBS)
-libcurlu_la_CFLAGS = $(AM_CFLAGS)
+libcurlu_la_LDFLAGS = -static $(LIBCURL_PC_LIBS_PRIVATE)
 
 CHECKSRC = $(CS_$(V))
 CS_0 = @echo "  RUN     " $@;
@@ -123,25 +144,42 @@ CS_1 =
 CS_ = $(CS_0)
 
 checksrc:
-	$(CHECKSRC)(@PERL@ $(top_srcdir)/scripts/checksrc.pl -D$(srcdir)    \
-	-W$(srcdir)/curl_config.h $(srcdir)/*.[ch] $(srcdir)/vauth/*.[ch]   \
-	$(srcdir)/vtls/*.[ch] $(srcdir)/vquic/*.[ch] $(srcdir)/vssh/*.[ch])
+	$(CHECKSRC)(@PERL@ $(top_srcdir)/scripts/checksrc.pl -D$(srcdir) $(CSOURCES) $(HHEADERS))
 
-if CURLDEBUG
+if NOT_CURL_CI
+if DEBUGBUILD
 # for debug builds, we scan the sources on all regular make invokes
-all-local: checksrc
+CHECKSOURCES = checksrc
+endif
 endif
 
-# disable the tests that are mostly causing false positives
-TIDYFLAGS=-checks=-clang-analyzer-security.insecureAPI.strcpy,-clang-analyzer-optin.performance.Padding,-clang-analyzer-valist.Uninitialized,-clang-analyzer-core.NonNullParamChecker,-clang-analyzer-core.NullDereference -quiet
+all-local: $(CHECKSOURCES)
 
-TIDY:=clang-tidy
+UNIT_V = $(UNITV_$(V))
+UNITV_0 = @echo "  UNITPR  " $@;
+UNITV_1 =
+UNITV_ = $(UNITV_0)
+
+# UNITPROTOS depends on every C file in the lib/ dir
+$(UNITPROTOS): $(CSOURCES)
+	$(UNIT_V)(cd $(srcdir) && @PERL@ ../scripts/extract-unit-protos $(CSOURCES)) > $(top_builddir)/lib/$(UNITPROTOS)
+
+_tidy_cflags =
+TIDYFLAGS =
+if CURL_WERROR
+TIDYFLAGS += '--warnings-as-errors=*'
+endif
+if CLANG
+_tidy_cflags += $(CFLAGS)
+endif
 
 tidy:
-	$(TIDY) $(CSOURCES) $(TIDYFLAGS) -- $(AM_CPPFLAGS) $(CPPFLAGS) -DHAVE_CONFIG_H
+	(_csources=`echo ' $(CSOURCES)' | sed -E -e 's/ +$$//' -e 's/ +/ /g' -e 's| | $(srcdir)/|g'`; \
+	@CLANG_TIDY@ --config-file=$(top_srcdir)/.clang-tidy.yml $(TIDYFLAGS) $(CURL_CLANG_TIDYFLAGS) $$_csources \
+	  -- $(AM_CPPFLAGS) $(CPPFLAGS) -DHAVE_CONFIG_H $(_tidy_cflags))
 
 optiontable:
-	perl optiontable.pl < $(top_srcdir)/include/curl/curl.h > easyoptions.c
+	@PERL@ $(srcdir)/optiontable.pl $(top_srcdir)/include/curl/curl.h > $(srcdir)/easyoptions.c
 
 if HAVE_WINDRES
 .rc.lo:
diff --git a/third-party/curl/lib/Makefile.inc b/third-party/curl/lib/Makefile.inc
index a08180b531..266ba52af3 100644
--- a/third-party/curl/lib/Makefile.inc
+++ b/third-party/curl/lib/Makefile.inc
@@ -21,6 +21,49 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+# Shared between CMakeLists.txt and Makefile.am
+
+LIB_CURLX_CFILES =      \
+  curlx/base64.c        \
+  curlx/basename.c      \
+  curlx/dynbuf.c        \
+  curlx/fopen.c         \
+  curlx/inet_ntop.c     \
+  curlx/inet_pton.c     \
+  curlx/multibyte.c     \
+  curlx/nonblock.c      \
+  curlx/snprintf.c      \
+  curlx/strcopy.c       \
+  curlx/strdup.c        \
+  curlx/strerr.c        \
+  curlx/strparse.c      \
+  curlx/timediff.c      \
+  curlx/timeval.c       \
+  curlx/version_win32.c \
+  curlx/wait.c          \
+  curlx/warnless.c      \
+  curlx/winapi.c
+
+LIB_CURLX_HFILES =      \
+  curlx/base64.h        \
+  curlx/basename.h      \
+  curlx/dynbuf.h        \
+  curlx/fopen.h         \
+  curlx/inet_ntop.h     \
+  curlx/inet_pton.h     \
+  curlx/multibyte.h     \
+  curlx/nonblock.h      \
+  curlx/snprintf.h      \
+  curlx/strcopy.h       \
+  curlx/strdup.h        \
+  curlx/strerr.h        \
+  curlx/strparse.h      \
+  curlx/timediff.h      \
+  curlx/timeval.h       \
+  curlx/version_win32.h \
+  curlx/wait.h          \
+  curlx/warnless.h      \
+  curlx/winapi.h
 
 LIB_VAUTH_CFILES =      \
   vauth/cleartext.c     \
@@ -39,111 +82,128 @@ LIB_VAUTH_CFILES =      \
 
 LIB_VAUTH_HFILES =      \
   vauth/digest.h        \
-  vauth/ntlm.h          \
   vauth/vauth.h
 
 LIB_VTLS_CFILES =           \
-  vtls/bearssl.c            \
+  vtls/apple.c              \
+  vtls/cipher_suite.c       \
   vtls/gtls.c               \
   vtls/hostcheck.c          \
   vtls/keylog.c             \
   vtls/mbedtls.c            \
-  vtls/mbedtls_threadlock.c \
   vtls/openssl.c            \
   vtls/rustls.c             \
   vtls/schannel.c           \
   vtls/schannel_verify.c    \
-  vtls/sectransp.c          \
   vtls/vtls.c               \
+  vtls/vtls_config.c        \
+  vtls/vtls_scache.c        \
+  vtls/vtls_spack.c         \
   vtls/wolfssl.c            \
   vtls/x509asn1.c
 
 LIB_VTLS_HFILES =           \
-  vtls/bearssl.h            \
+  vtls/apple.h              \
+  vtls/cipher_suite.h       \
   vtls/gtls.h               \
   vtls/hostcheck.h          \
   vtls/keylog.h             \
   vtls/mbedtls.h            \
-  vtls/mbedtls_threadlock.h \
   vtls/openssl.h            \
   vtls/rustls.h             \
   vtls/schannel.h           \
   vtls/schannel_int.h       \
-  vtls/sectransp.h          \
   vtls/vtls.h               \
+  vtls/vtls_config.h        \
   vtls/vtls_int.h           \
+  vtls/vtls_scache.h        \
+  vtls/vtls_spack.h         \
   vtls/wolfssl.h            \
   vtls/x509asn1.h
 
-LIB_VQUIC_CFILES = \
-  vquic/curl_msh3.c   \
-  vquic/curl_ngtcp2.c   \
-  vquic/curl_quiche.c   \
-  vquic/vquic.c
+LIB_VQUIC_CFILES =          \
+  vquic/capsule.c           \
+  vquic/cf-capsule.c        \
+  vquic/cf-ngtcp2.c         \
+  vquic/cf-ngtcp2-cmn.c     \
+  vquic/cf-ngtcp2-proxy.c   \
+  vquic/cf-quiche.c         \
+  vquic/vquic.c             \
+  vquic/vquic-tls.c
 
-LIB_VQUIC_HFILES = \
-  vquic/curl_msh3.h   \
-  vquic/curl_ngtcp2.h   \
-  vquic/curl_quiche.h   \
-  vquic/vquic.h    \
-  vquic/vquic_int.h
+LIB_VQUIC_HFILES =          \
+  vquic/capsule.h           \
+  vquic/cf-capsule.h        \
+  vquic/cf-ngtcp2.h         \
+  vquic/cf-ngtcp2-cmn.h     \
+  vquic/cf-ngtcp2-proxy.h   \
+  vquic/cf-quiche.h         \
+  vquic/vquic.h             \
+  vquic/vquic_int.h         \
+  vquic/vquic-tls.h
 
-LIB_VSSH_CFILES =  \
-  vssh/libssh.c    \
-  vssh/libssh2.c   \
-  vssh/wolfssh.c
+LIB_VSSH_CFILES =    \
+  vssh/libssh.c      \
+  vssh/libssh2.c     \
+  vssh/vssh.c
 
-LIB_VSSH_HFILES =  \
+LIB_VSSH_HFILES =    \
+  vssh/vssh.h        \
   vssh/ssh.h
 
 LIB_CFILES =         \
   altsvc.c           \
   amigaos.c          \
   asyn-ares.c        \
-  asyn-thread.c      \
-  base64.c           \
+  asyn-base.c        \
+  asyn-thrdd.c       \
   bufq.c             \
   bufref.c           \
-  c-hyper.c          \
+  cf-dns.c           \
   cf-h1-proxy.c      \
   cf-h2-proxy.c      \
   cf-haproxy.c       \
   cf-https-connect.c \
+  cf-ip-happy.c      \
+  cf-recvbuf.c       \
+  cf-setup.c         \
   cf-socket.c        \
   cfilters.c         \
   conncache.c        \
   connect.c          \
   content_encoding.c \
   cookie.c           \
+  creds.c            \
+  cshutdn.c          \
   curl_addrinfo.c    \
-  curl_des.c         \
   curl_endian.c      \
   curl_fnmatch.c     \
+  curl_fopen.c       \
   curl_get_line.c    \
   curl_gethostname.c \
   curl_gssapi.c      \
   curl_memrchr.c     \
-  curl_multibyte.c   \
   curl_ntlm_core.c   \
-  curl_ntlm_wb.c     \
-  curl_path.c        \
   curl_range.c       \
-  curl_rtmp.c        \
   curl_sasl.c        \
+  curl_sha512_256.c  \
+  curl_share.c       \
   curl_sspi.c        \
   curl_threads.c     \
   curl_trc.c         \
+  cw-out.c           \
+  cw-pause.c         \
   dict.c             \
+  dnscache.c         \
   doh.c              \
-  dynbuf.c           \
   dynhds.c           \
   easy.c             \
   easygetopt.c       \
   easyoptions.c      \
   escape.c           \
+  fake_addrinfo.c    \
   file.c             \
   fileinfo.c         \
-  fopen.c            \
   formdata.c         \
   ftp.c              \
   ftplistparser.c    \
@@ -153,27 +213,23 @@ LIB_CFILES =         \
   hash.c             \
   headers.c          \
   hmac.c             \
-  hostasyn.c         \
   hostip.c           \
   hostip4.c          \
   hostip6.c          \
-  hostsyn.c          \
   hsts.c             \
   http.c             \
   http1.c            \
   http2.c            \
+  http_aws_sigv4.c   \
   http_chunks.c      \
   http_digest.c      \
   http_negotiate.c   \
   http_ntlm.c        \
   http_proxy.c       \
-  http_aws_sigv4.c   \
+  httpsrr.c          \
   idn.c              \
   if2ip.c            \
   imap.c             \
-  inet_ntop.c        \
-  inet_pton.c        \
-  krb5.c             \
   ldap.c             \
   llist.c            \
   macos.c            \
@@ -184,23 +240,26 @@ LIB_CFILES =         \
   mprintf.c          \
   mqtt.c             \
   multi.c            \
+  multi_ev.c         \
+  multi_ntfy.c       \
   netrc.c            \
-  nonblock.c         \
-  noproxy.c          \
   openldap.c         \
   parsedate.c        \
+  peer.c             \
   pingpong.c         \
   pop3.c             \
   progress.c         \
+  protocol.c         \
+  proxy.c            \
   psl.c              \
   rand.c             \
-  rename.c           \
+  ratelimit.c        \
+  request.c          \
   rtsp.c             \
   select.c           \
   sendf.c            \
   setopt.c           \
   sha256.c           \
-  share.c            \
   slist.c            \
   smb.c              \
   smtp.c             \
@@ -208,24 +267,23 @@ LIB_CFILES =         \
   socks.c            \
   socks_gssapi.c     \
   socks_sspi.c       \
-  speedcheck.c       \
   splay.c            \
   strcase.c          \
-  strdup.c           \
+  strequal.c         \
   strerror.c         \
-  strtok.c           \
-  strtoofft.c        \
   system_win32.c     \
   telnet.c           \
   tftp.c             \
-  timediff.c         \
-  timeval.c          \
+  thrdpool.c         \
+  thrdqueue.c        \
   transfer.c         \
+  uint-bset.c        \
+  uint-hash.c        \
+  uint-spbset.c      \
+  uint-table.c       \
   url.c              \
   urlapi.c           \
   version.c          \
-  version_win32.c    \
-  warnless.c         \
   ws.c
 
 LIB_HFILES =         \
@@ -235,63 +293,64 @@ LIB_HFILES =         \
   asyn.h             \
   bufq.h             \
   bufref.h           \
-  c-hyper.h          \
+  cf-dns.h           \
   cf-h1-proxy.h      \
   cf-h2-proxy.h      \
   cf-haproxy.h       \
   cf-https-connect.h \
+  cf-ip-happy.h      \
+  cf-recvbuf.h       \
+  cf-setup.h         \
   cf-socket.h        \
   cfilters.h         \
   conncache.h        \
+  cshutdn.h          \
   connect.h          \
   content_encoding.h \
   cookie.h           \
+  creds.h            \
   curl_addrinfo.h    \
-  curl_base64.h      \
   curl_ctype.h       \
-  curl_des.h         \
   curl_endian.h      \
   curl_fnmatch.h     \
+  curl_fopen.h       \
   curl_get_line.h    \
   curl_gethostname.h \
   curl_gssapi.h      \
   curl_hmac.h        \
-  curl_krb5.h        \
   curl_ldap.h        \
   curl_md4.h         \
   curl_md5.h         \
-  curl_memory.h      \
   curl_memrchr.h     \
-  curl_multibyte.h   \
   curl_ntlm_core.h   \
-  curl_ntlm_wb.h     \
-  curl_path.h        \
   curl_printf.h      \
   curl_range.h       \
-  curl_rtmp.h        \
   curl_sasl.h        \
   curl_setup.h       \
-  curl_setup_once.h  \
   curl_sha256.h      \
+  curl_sha512_256.h  \
+  curl_share.h       \
   curl_sspi.h        \
   curl_threads.h     \
   curl_trc.h         \
-  curlx.h            \
+  cw-out.h           \
+  cw-pause.h         \
   dict.h             \
+  dnscache.h         \
   doh.h              \
-  dynbuf.h           \
   dynhds.h           \
   easy_lock.h        \
   easyif.h           \
   easyoptions.h      \
   escape.h           \
+  fake_addrinfo.h    \
   file.h             \
   fileinfo.h         \
-  fopen.h            \
   formdata.h         \
-  functypes.h        \
   ftp.h              \
+  ftp-int.h          \
   ftplistparser.h    \
+  functypes.h        \
   getinfo.h          \
   gopher.h           \
   hash.h             \
@@ -301,40 +360,43 @@ LIB_HFILES =         \
   http.h             \
   http1.h            \
   http2.h            \
+  http_aws_sigv4.h   \
   http_chunks.h      \
   http_digest.h      \
   http_negotiate.h   \
   http_ntlm.h        \
   http_proxy.h       \
-  http_aws_sigv4.h   \
+  httpsrr.h          \
   idn.h              \
   if2ip.h            \
   imap.h             \
-  inet_ntop.h        \
-  inet_pton.h        \
   llist.h            \
   macos.h            \
-  memdebug.h         \
   mime.h             \
   mqtt.h             \
   multihandle.h      \
+  multi_ev.h         \
+  multi_ntfy.h       \
   multiif.h          \
   netrc.h            \
-  nonblock.h         \
-  noproxy.h          \
   parsedate.h        \
+  peer.h             \
   pingpong.h         \
   pop3.h             \
   progress.h         \
+  protocol.h         \
+  proxy.h            \
   psl.h              \
   rand.h             \
-  rename.h           \
+  ratelimit.h        \
+  request.h          \
   rtsp.h             \
   select.h           \
   sendf.h            \
   setopt.h           \
+  setup-os400.h      \
   setup-vms.h        \
-  share.h            \
+  setup-win32.h      \
   sigpipe.h          \
   slist.h            \
   smb.h              \
@@ -342,29 +404,27 @@ LIB_HFILES =         \
   sockaddr.h         \
   socketpair.h       \
   socks.h            \
-  speedcheck.h       \
   splay.h            \
   strcase.h          \
-  strdup.h           \
   strerror.h         \
-  strtok.h           \
-  strtoofft.h        \
   system_win32.h     \
   telnet.h           \
   tftp.h             \
-  timediff.h         \
-  timeval.h          \
+  thrdpool.h         \
+  thrdqueue.h        \
   transfer.h         \
+  uint-bset.h        \
+  uint-hash.h        \
+  uint-spbset.h      \
+  uint-table.h       \
   url.h              \
   urlapi-int.h       \
   urldata.h          \
-  version_win32.h    \
-  warnless.h         \
   ws.h
 
 LIB_RCFILES = libcurl.rc
 
 CSOURCES = $(LIB_CFILES) $(LIB_VAUTH_CFILES) $(LIB_VTLS_CFILES) \
-  $(LIB_VQUIC_CFILES) $(LIB_VSSH_CFILES)
+  $(LIB_VQUIC_CFILES) $(LIB_VSSH_CFILES) $(LIB_CURLX_CFILES)
 HHEADERS = $(LIB_HFILES) $(LIB_VAUTH_HFILES) $(LIB_VTLS_HFILES) \
-  $(LIB_VQUIC_HFILES) $(LIB_VSSH_HFILES)
+  $(LIB_VQUIC_HFILES) $(LIB_VSSH_HFILES) $(LIB_CURLX_HFILES)
diff --git a/third-party/curl/lib/Makefile.mk b/third-party/curl/lib/Makefile.mk
deleted file mode 100644
index e1f782bac8..0000000000
--- a/third-party/curl/lib/Makefile.mk
+++ /dev/null
@@ -1,421 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-#***************************************************************************
-
-# Makefile to build curl parts with GCC-like toolchains and optional features.
-#
-# Usage:   [mingw32-]make -f Makefile.mk CFG=-feat1[-feat2][-feat3][...]
-# Example: [mingw32-]make -f Makefile.mk CFG=-zlib-ssl-libssh2-ipv6
-#
-# Look for ' ?=' to find all accepted customization variables.
-
-# This script is reused by 'src' and 'docs/examples' Makefile.mk scripts.
-
-ifndef PROOT
-  PROOT := ..
-  LOCAL := 1
-endif
-
-### Common
-
-CFLAGS ?=
-CPPFLAGS ?=
-RCFLAGS ?=
-LDFLAGS ?=
-CURL_LDFLAGS_BIN ?=
-CURL_LDFLAGS_LIB ?=
-LIBS ?=
-
-CROSSPREFIX ?=
-
-ifeq ($(CC),cc)
-  CC := gcc
-endif
-CC := $(CROSSPREFIX)$(CC)
-AR := $(CROSSPREFIX)$(AR)
-RC ?= $(CROSSPREFIX)windres
-
-# For compatibility
-ARCH ?=
-ifeq ($(ARCH),w64)
-  TRIPLET := x86_64-w64-mingw32
-  CFLAGS  += -m64
-  LDFLAGS += -m64
-  RCFLAGS += --target=pe-x86-64
-else ifdef ARCH
-  TRIPLET := i686-w64-mingw32
-  CFLAGS  += -m32
-  LDFLAGS += -m32
-  RCFLAGS += --target=pe-i386
-else
-  TRIPLET ?= $(shell $(CC) -dumpmachine)
-endif
-
-BIN_EXT := .exe
-
-ifneq ($(findstring -w,$(TRIPLET)),)
-  WIN32 := 1
-else ifneq ($(findstring msdos,$(TRIPLET)),)
-  # Cross-tools: https://github.com/andrewwutw/build-djgpp
-  MSDOS := 1
-else ifneq ($(findstring amigaos,$(TRIPLET)),)
-  # Cross-tools: https://github.com/bebbo/amiga-gcc
-  AMIGA := 1
-endif
-
-CPPFLAGS += -I. -I$(PROOT)/include
-RCFLAGS  += -I$(PROOT)/include
-
-ifndef WIN32
-  DYN :=
-endif
-
-ifdef AMIGA
-  BIN_EXT :=
-endif
-
-### Deprecated settings. For compatibility.
-
-ifdef WATT_ROOT
-  WATT_PATH := $(realpath $(WATT_ROOT))
-endif
-
-### Optional features
-
-ifneq ($(findstring -debug,$(CFG)),)
-  CFLAGS += -g
-  CPPFLAGS += -DDEBUGBUILD
-else
-  CPPFLAGS += -DNDEBUG
-endif
-ifneq ($(findstring -trackmem,$(CFG)),)
-  CPPFLAGS += -DCURLDEBUG
-endif
-ifneq ($(findstring -map,$(CFG)),)
-  MAP := 1
-endif
-
-ifdef WIN32
-  ifneq ($(findstring -unicode,$(CFG)),)
-    CPPFLAGS += -DUNICODE -D_UNICODE
-    CURL_LDFLAGS_BIN += -municode
-  endif
-endif
-
-# CPPFLAGS below are only necessary when building libcurl via 'lib' (see
-# comments below about exceptions). Always include them anyway to match
-# behavior of other build systems.
-
-# Linker options to exclude for shared mode executables.
-_LDFLAGS :=
-_LIBS :=
-
-ifneq ($(findstring -sync,$(CFG)),)
-  CPPFLAGS += -DUSE_SYNC_DNS
-else ifneq ($(findstring -ares,$(CFG)),)
-  LIBCARES_PATH ?= $(PROOT)/../c-ares
-  CPPFLAGS += -DUSE_ARES
-  CPPFLAGS += -I"$(LIBCARES_PATH)/include"
-  _LDFLAGS += -L"$(LIBCARES_PATH)/lib"
-  _LIBS += -lcares
-endif
-
-ifneq ($(findstring -rtmp,$(CFG)),)
-  LIBRTMP_PATH ?= $(PROOT)/../librtmp
-  CPPFLAGS += -DUSE_LIBRTMP
-  CPPFLAGS += -I"$(LIBRTMP_PATH)"
-  _LDFLAGS += -L"$(LIBRTMP_PATH)/librtmp"
-  _LIBS += -lrtmp -lwinmm
-  ZLIB := 1
-endif
-
-ifneq ($(findstring -ssh2,$(CFG)),)
-  LIBSSH2_PATH ?= $(PROOT)/../libssh2
-  CPPFLAGS += -DUSE_LIBSSH2
-  CPPFLAGS += -I"$(LIBSSH2_PATH)/include"
-  _LDFLAGS += -L"$(LIBSSH2_PATH)/lib"
-  ifdef WIN32
-    _LDFLAGS += -L"$(LIBSSH2_PATH)/win32"
-  endif
-  _LIBS += -lssh2
-else ifneq ($(findstring -libssh,$(CFG)),)
-  LIBSSH_PATH ?= $(PROOT)/../libssh
-  CPPFLAGS += -DUSE_LIBSSH
-  CPPFLAGS += -I"$(LIBSSH_PATH)/include"
-  _LDFLAGS += -L"$(LIBSSH_PATH)/lib"
-  _LIBS += -lssh
-else ifneq ($(findstring -wolfssh,$(CFG)),)
-  WOLFSSH_PATH ?= $(PROOT)/../wolfssh
-  CPPFLAGS += -DUSE_WOLFSSH
-  CPPFLAGS += -I"$(WOLFSSH_PATH)/include"
-  _LDFLAGS += -L"$(WOLFSSH_PATH)/lib"
-  _LIBS += -lwolfssh
-endif
-
-ifneq ($(findstring -ssl,$(CFG)),)
-  OPENSSL_PATH ?= $(PROOT)/../openssl
-  CPPFLAGS += -DUSE_OPENSSL
-  CPPFLAGS += -DCURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG
-  OPENSSL_INCLUDE ?= $(OPENSSL_PATH)/include
-  OPENSSL_LIBPATH ?= $(OPENSSL_PATH)/lib
-  CPPFLAGS += -I"$(OPENSSL_INCLUDE)"
-  _LDFLAGS += -L"$(OPENSSL_LIBPATH)"
-  OPENSSL_LIBS ?= -lssl -lcrypto
-  _LIBS += $(OPENSSL_LIBS)
-
-  ifneq ($(findstring -srp,$(CFG)),)
-    ifneq ($(wildcard $(OPENSSL_INCLUDE)/openssl/srp.h),)
-      # OpenSSL 1.0.1 and later.
-      CPPFLAGS += -DHAVE_OPENSSL_SRP -DUSE_TLS_SRP
-    endif
-  endif
-  SSLLIBS += 1
-endif
-ifneq ($(findstring -wolfssl,$(CFG)),)
-  WOLFSSL_PATH ?= $(PROOT)/../wolfssl
-  CPPFLAGS += -DUSE_WOLFSSL
-  CPPFLAGS += -DSIZEOF_LONG_LONG=8
-  CPPFLAGS += -I"$(WOLFSSL_PATH)/include"
-  _LDFLAGS += -L"$(WOLFSSL_PATH)/lib"
-  _LIBS += -lwolfssl
-  SSLLIBS += 1
-endif
-ifneq ($(findstring -mbedtls,$(CFG)),)
-  MBEDTLS_PATH ?= $(PROOT)/../mbedtls
-  CPPFLAGS += -DUSE_MBEDTLS
-  CPPFLAGS += -I"$(MBEDTLS_PATH)/include"
-  _LDFLAGS += -L"$(MBEDTLS_PATH)/lib"
-  _LIBS += -lmbedtls -lmbedx509 -lmbedcrypto
-  SSLLIBS += 1
-endif
-ifneq ($(findstring -schannel,$(CFG)),)
-  CPPFLAGS += -DUSE_SCHANNEL
-  SSLLIBS += 1
-endif
-
-ifneq ($(findstring -nghttp2,$(CFG)),)
-  NGHTTP2_PATH ?= $(PROOT)/../nghttp2
-  CPPFLAGS += -DUSE_NGHTTP2
-  CPPFLAGS += -I"$(NGHTTP2_PATH)/include"
-  _LDFLAGS += -L"$(NGHTTP2_PATH)/lib"
-  _LIBS += -lnghttp2
-endif
-
-ifeq ($(findstring -nghttp3,$(CFG))$(findstring -ngtcp2,$(CFG)),-nghttp3-ngtcp2)
-  NGHTTP3_PATH ?= $(PROOT)/../nghttp3
-  CPPFLAGS += -DUSE_NGHTTP3
-  CPPFLAGS += -I"$(NGHTTP3_PATH)/include"
-  _LDFLAGS += -L"$(NGHTTP3_PATH)/lib"
-  _LIBS += -lnghttp3
-
-  NGTCP2_PATH ?= $(PROOT)/../ngtcp2
-  CPPFLAGS += -DUSE_NGTCP2
-  CPPFLAGS += -I"$(NGTCP2_PATH)/include"
-  _LDFLAGS += -L"$(NGTCP2_PATH)/lib"
-
-  NGTCP2_LIBS ?=
-  ifeq ($(NGTCP2_LIBS),)
-    ifneq ($(findstring -ssl,$(CFG)),)
-      ifneq ($(wildcard $(OPENSSL_INCLUDE)/openssl/aead.h),)
-        NGTCP2_LIBS := -lngtcp2_crypto_boringssl
-      else  # including libressl
-        NGTCP2_LIBS := -lngtcp2_crypto_quictls
-      endif
-    else ifneq ($(findstring -wolfssl,$(CFG)),)
-      NGTCP2_LIBS := -lngtcp2_crypto_wolfssl
-    endif
-  endif
-
-  _LIBS += -lngtcp2 $(NGTCP2_LIBS)
-endif
-
-ifneq ($(findstring -zlib,$(CFG))$(ZLIB),)
-  ZLIB_PATH ?= $(PROOT)/../zlib
-  # These CPPFLAGS are also required when compiling the curl tool via 'src'.
-  CPPFLAGS += -DHAVE_LIBZ
-  CPPFLAGS += -I"$(ZLIB_PATH)/include"
-  _LDFLAGS += -L"$(ZLIB_PATH)/lib"
-  ZLIB_LIBS ?= -lz
-  _LIBS += $(ZLIB_LIBS)
-  ZLIB := 1
-endif
-ifneq ($(findstring -zstd,$(CFG)),)
-  ZSTD_PATH ?= $(PROOT)/../zstd
-  CPPFLAGS += -DHAVE_ZSTD
-  CPPFLAGS += -I"$(ZSTD_PATH)/include"
-  _LDFLAGS += -L"$(ZSTD_PATH)/lib"
-  ZSTD_LIBS ?= -lzstd
-  _LIBS += $(ZSTD_LIBS)
-endif
-ifneq ($(findstring -brotli,$(CFG)),)
-  BROTLI_PATH ?= $(PROOT)/../brotli
-  CPPFLAGS += -DHAVE_BROTLI
-  CPPFLAGS += -I"$(BROTLI_PATH)/include"
-  _LDFLAGS += -L"$(BROTLI_PATH)/lib"
-  BROTLI_LIBS ?= -lbrotlidec -lbrotlicommon
-  _LIBS += $(BROTLI_LIBS)
-endif
-ifneq ($(findstring -gsasl,$(CFG)),)
-  LIBGSASL_PATH ?= $(PROOT)/../gsasl
-  CPPFLAGS += -DUSE_GSASL
-  CPPFLAGS += -I"$(LIBGSASL_PATH)/include"
-  _LDFLAGS += -L"$(LIBGSASL_PATH)/lib"
-  _LIBS += -lgsasl
-endif
-
-ifneq ($(findstring -idn2,$(CFG)),)
-  LIBIDN2_PATH ?= $(PROOT)/../libidn2
-  CPPFLAGS += -DUSE_LIBIDN2
-  CPPFLAGS += -I"$(LIBIDN2_PATH)/include"
-  _LDFLAGS += -L"$(LIBIDN2_PATH)/lib"
-  _LIBS += -lidn2
-
-ifneq ($(findstring -psl,$(CFG)),)
-  LIBPSL_PATH ?= $(PROOT)/../libpsl
-  CPPFLAGS += -DUSE_LIBPSL
-  CPPFLAGS += -I"$(LIBPSL_PATH)/include"
-  _LDFLAGS += -L"$(LIBPSL_PATH)/lib"
-  _LIBS += -lpsl
-endif
-else ifneq ($(findstring -winidn,$(CFG)),)
-  CPPFLAGS += -DUSE_WIN32_IDN
-  _LIBS += -lnormaliz
-endif
-
-ifneq ($(findstring -sspi,$(CFG)),)
-  ifdef WIN32
-    CPPFLAGS += -DUSE_WINDOWS_SSPI
-  endif
-endif
-ifneq ($(findstring -ipv6,$(CFG)),)
-  CPPFLAGS += -DENABLE_IPV6
-endif
-
-ifneq ($(findstring -watt,$(CFG))$(MSDOS),)
-  WATT_PATH ?= $(PROOT)/../watt
-  CPPFLAGS += -I"$(WATT_PATH)/inc"
-  _LDFLAGS += -L"$(WATT_PATH)/lib"
-  _LIBS += -lwatt
-endif
-
-ifdef WIN32
-  ifeq ($(findstring -lldap,$(LIBS)),)
-    _LIBS += -lwldap32
-  endif
-  _LIBS += -lws2_32 -lcrypt32 -lbcrypt
-endif
-
-ifneq ($(findstring 11,$(subst $(subst ,, ),,$(SSLLIBS))),)
-  CPPFLAGS += -DCURL_WITH_MULTI_SSL
-endif
-
-ifndef DYN
-  LDFLAGS += $(_LDFLAGS)
-  LIBS += $(_LIBS)
-endif
-
-### Common rules
-
-OBJ_DIR := $(TRIPLET)
-
-ifneq ($(findstring /sh,$(SHELL)),)
-DEL   = rm -f $1
-COPY  = -cp -afv $1 $2
-MKDIR = mkdir -p $1
-RMDIR = rm -fr $1
-WHICH = $(SHELL) -c "command -v $1"
-else
-DEL   = -del 2>NUL /q /f $(subst /,\,$1)
-COPY  = -copy 2>NUL /y $(subst /,\,$1) $(subst /,\,$2)
-MKDIR = -md 2>NUL $(subst /,\,$1)
-RMDIR = -rd 2>NUL /q /s $(subst /,\,$1)
-WHICH = where $1
-endif
-
-all: $(TARGETS)
-
-$(OBJ_DIR):
-	-$(call MKDIR, $(OBJ_DIR))
-
-$(OBJ_DIR)/%.o: %.c
-	$(CC) -W -Wall $(CFLAGS) $(CPPFLAGS) -c $< -o $@
-
-$(OBJ_DIR)/%.res: %.rc
-	$(RC) -O coff $(RCFLAGS) -i $< -o $@
-
-clean:
-	@$(call DEL, $(TOCLEAN))
-	@$(RMDIR) $(OBJ_DIR)
-
-distclean vclean: clean
-	@$(call DEL, $(TARGETS) $(TOVCLEAN))
-
-### Local
-
-ifdef LOCAL
-
-CPPFLAGS += -DBUILDING_LIBCURL
-
-### Sources and targets
-
-# Provides CSOURCES, HHEADERS, LIB_RCFILES
-include Makefile.inc
-
-vpath %.c vauth vquic vssh vtls
-
-libcurl_a_LIBRARY := libcurl.a
-ifdef WIN32
-CURL_DLL_SUFFIX ?=
-libcurl_dll_LIBRARY := libcurl$(CURL_DLL_SUFFIX).dll
-libcurl_dll_a_LIBRARY := libcurl.dll.a
-CURL_LDFLAGS_LIB += $(PROOT)/libcurl.def
-ifdef MAP
-libcurl_map_LIBRARY := libcurl$(CURL_DLL_SUFFIX).map
-CURL_LDFLAGS_LIB += -Wl,-Map,$(libcurl_map_LIBRARY)
-endif
-endif
-
-TARGETS := $(libcurl_a_LIBRARY) $(libcurl_dll_LIBRARY)
-
-libcurl_a_OBJECTS := $(patsubst %.c,$(OBJ_DIR)/%.o,$(notdir $(strip $(CSOURCES))))
-libcurl_a_DEPENDENCIES := $(strip $(CSOURCES) $(HHEADERS))
-ifdef WIN32
-libcurl_dll_OBJECTS := $(libcurl_a_OBJECTS)
-libcurl_dll_OBJECTS += $(patsubst %.rc,$(OBJ_DIR)/%.res,$(strip $(LIB_RCFILES)))
-endif
-
-TOCLEAN := $(libcurl_dll_OBJECTS)
-TOVCLEAN := $(libcurl_dll_LIBRARY:.dll=.def) $(libcurl_dll_a_LIBRARY) $(libcurl_map_LIBRARY)
-
-### Rules
-
-$(libcurl_a_LIBRARY): $(libcurl_a_OBJECTS) $(libcurl_a_DEPENDENCIES)
-	@$(call DEL, $@)
-	$(AR) rcs $@ $(libcurl_a_OBJECTS)
-
-$(libcurl_dll_LIBRARY): $(libcurl_dll_OBJECTS)
-	$(CC) $(LDFLAGS) -shared $(CURL_LDFLAGS_LIB) -o $@ $(libcurl_dll_OBJECTS) $(LIBS) \
-	  -Wl,--output-def,$(@:.dll=.def),--out-implib,$(libcurl_dll_a_LIBRARY)
-
-all: $(OBJ_DIR) $(TARGETS)
-endif
diff --git a/third-party/curl/lib/Makefile.soname b/third-party/curl/lib/Makefile.soname
index 02e003a8aa..aadc7f413e 100644
--- a/third-party/curl/lib/Makefile.soname
+++ b/third-party/curl/lib/Makefile.soname
@@ -21,16 +21,17 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+# Shared between CMakeLists.txt and Makefile.am
 
+# Keep in sync with CURL_LIBCURL_VERSIONED_SYMBOLS_SONAME in configure.ac
 VERSIONCHANGE=12
 VERSIONADD=0
 VERSIONDEL=8
 
 # libtool version:
 VERSIONINFO=-version-info $(VERSIONCHANGE):$(VERSIONADD):$(VERSIONDEL)
-# This flag accepts an argument of the form current[:revision[:age]]. So,
-# passing -version-info 3:12:1 sets current to 3, revision to 12, and age to
-# 1.
+# This flag accepts an argument of the form current[:revision[:age]]. It means
+# passing -version-info 3:12:1 sets current to 3, revision to 12, and age to 1.
 #
 # Here's the simplified rule guide on how to change -version-info:
 # (current version is C:R:A)
diff --git a/third-party/curl/lib/altsvc.c b/third-party/curl/lib/altsvc.c
index 22b0b69c77..80913d9a1d 100644
--- a/third-party/curl/lib/altsvc.c
+++ b/third-party/curl/lib/altsvc.c
@@ -28,44 +28,40 @@
 #include "curl_setup.h"
 
 #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_ALTSVC)
-#include <curl/curl.h>
 #include "urldata.h"
 #include "altsvc.h"
+#include "curl_fopen.h"
 #include "curl_get_line.h"
-#include "strcase.h"
 #include "parsedate.h"
-#include "sendf.h"
-#include "warnless.h"
-#include "fopen.h"
-#include "rename.h"
-#include "strdup.h"
-#include "inet_pton.h"
+#include "curl_trc.h"
+#include "curlx/inet_pton.h"
+#include "curlx/strparse.h"
+#include "connect.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-#define MAX_ALTSVC_LINE 4095
-#define MAX_ALTSVC_DATELENSTR "64"
-#define MAX_ALTSVC_DATELEN 64
-#define MAX_ALTSVC_HOSTLENSTR "512"
-#define MAX_ALTSVC_HOSTLEN 512
-#define MAX_ALTSVC_ALPNLENSTR "10"
+#define MAX_ALTSVC_LINE    4095
+#define MAX_ALTSVC_DATELEN 17
+#define MAX_ALTSVC_HOSTLEN 2048
 #define MAX_ALTSVC_ALPNLEN 10
 
 #define H3VERSION "h3"
 
-static enum alpnid alpn2alpnid(char *name)
+#if defined(DEBUGBUILD) || defined(UNITTESTS)
+/* to play well with debug builds, we can *set* a fixed time this will
+   return */
+static time_t altsvc_debugtime(void *unused)
 {
-  if(strcasecompare(name, "h1"))
-    return ALPN_h1;
-  if(strcasecompare(name, "h2"))
-    return ALPN_h2;
-  if(strcasecompare(name, H3VERSION))
-    return ALPN_h3;
-  return ALPN_none; /* unknown, probably rubbish input */
+  const char *timestr = getenv("CURL_TIME");
+  (void)unused;
+  if(timestr) {
+    curl_off_t val;
+    curlx_str_number(&timestr, &val, TIME_T_MAX);
+    return (time_t)val;
+  }
+  return time(NULL);
 }
+#undef time
+#define time(x) altsvc_debugtime(x)
+#endif
 
 /* Given the ALPN ID, return the name */
 const char *Curl_alpnid2str(enum alpnid id)
@@ -82,116 +78,142 @@ const char *Curl_alpnid2str(enum alpnid id)
   }
 }
 
-
-static void altsvc_free(struct altsvc *as)
-{
-  free(as->src.host);
-  free(as->dst.host);
-  free(as);
-}
+#define altsvc_free(x) curlx_free(x)
 
 static struct altsvc *altsvc_createid(const char *srchost,
+                                      size_t hlen,
                                       const char *dsthost,
+                                      size_t dlen, /* dsthost length */
                                       enum alpnid srcalpnid,
                                       enum alpnid dstalpnid,
-                                      unsigned int srcport,
-                                      unsigned int dstport)
+                                      size_t srcport,
+                                      size_t dstport)
 {
-  struct altsvc *as = calloc(sizeof(struct altsvc), 1);
-  size_t hlen;
-  size_t dlen;
-  if(!as)
-    return NULL;
-  hlen = strlen(srchost);
-  dlen = strlen(dsthost);
-  DEBUGASSERT(hlen);
-  DEBUGASSERT(dlen);
-  if(!hlen || !dlen)
-    /* bad input */
-    return NULL;
+  struct altsvc *as;
   if((hlen > 2) && srchost[0] == '[') {
     /* IPv6 address, strip off brackets */
     srchost++;
     hlen -= 2;
   }
-  else if(srchost[hlen - 1] == '.')
+  else if(hlen && (srchost[hlen - 1] == '.')) {
     /* strip off trailing dot */
     hlen--;
+  }
   if((dlen > 2) && dsthost[0] == '[') {
     /* IPv6 address, strip off brackets */
     dsthost++;
     dlen -= 2;
   }
+  if(!hlen || !dlen)
+    /* bad input */
+    return NULL;
+  /* struct size plus both strings */
+  as = curlx_calloc(1, sizeof(struct altsvc) + (hlen + 1) + (dlen + 1));
+  if(!as)
+    return NULL;
+  as->src.host = (char *)as + sizeof(struct altsvc);
+  memcpy(as->src.host, srchost, hlen);
+  /* the null-terminator is already there */
 
-  as->src.host = Curl_memdup(srchost, hlen + 1);
-  if(!as->src.host)
-    goto error;
-  as->src.host[hlen] = 0;
-
-  as->dst.host = Curl_memdup(dsthost, dlen + 1);
-  if(!as->dst.host)
-    goto error;
-  as->dst.host[dlen] = 0;
+  as->dst.host = (char *)as + sizeof(struct altsvc) + hlen + 1;
+  memcpy(as->dst.host, dsthost, dlen);
+  /* the null-terminator is already there */
 
   as->src.alpnid = srcalpnid;
   as->dst.alpnid = dstalpnid;
-  as->src.port = curlx_ultous(srcport);
-  as->dst.port = curlx_ultous(dstport);
+  as->src.port = (unsigned short)srcport;
+  as->dst.port = (unsigned short)dstport;
 
   return as;
-error:
-  altsvc_free(as);
-  return NULL;
 }
 
-static struct altsvc *altsvc_create(char *srchost,
-                                    char *dsthost,
-                                    char *srcalpn,
-                                    char *dstalpn,
-                                    unsigned int srcport,
-                                    unsigned int dstport)
+static struct altsvc *altsvc_create(struct Curl_str *srchost,
+                                    struct Curl_str *dsthost,
+                                    struct Curl_str *srcalpn,
+                                    struct Curl_str *dstalpn,
+                                    size_t srcport,
+                                    size_t dstport)
 {
-  enum alpnid dstalpnid = alpn2alpnid(dstalpn);
-  enum alpnid srcalpnid = alpn2alpnid(srcalpn);
+  enum alpnid dstalpnid = Curl_str2alpnid(dstalpn);
+  enum alpnid srcalpnid = Curl_str2alpnid(srcalpn);
   if(!srcalpnid || !dstalpnid)
     return NULL;
-  return altsvc_createid(srchost, dsthost, srcalpnid, dstalpnid,
+  return altsvc_createid(curlx_str(srchost), curlx_strlen(srchost),
+                         curlx_str(dsthost), curlx_strlen(dsthost),
+                         srcalpnid, dstalpnid,
                          srcport, dstport);
 }
 
+/* append the new entry to the list after possibly removing an old entry
+   first */
+static void altsvc_append(struct altsvcinfo *asi, struct altsvc *as)
+{
+  while(Curl_llist_count(&asi->list) >= MAX_ALTSVC_ENTRIES) {
+    /* It is full. Remove the first entry in the list */
+    struct Curl_llist_node *e = Curl_llist_head(&asi->list);
+    struct altsvc *oldas = Curl_node_elem(e);
+    Curl_node_remove(e);
+    altsvc_free(oldas);
+  }
+  Curl_llist_append(&asi->list, as, &as->node);
+}
+
 /* only returns SERIOUS errors */
-static CURLcode altsvc_add(struct altsvcinfo *asi, char *line)
+static CURLcode altsvc_add(struct altsvcinfo *asi, const char *line)
 {
   /* Example line:
      h2 example.com 443 h3 shiny.example.com 8443 "20191231 10:00:00" 1
    */
-  char srchost[MAX_ALTSVC_HOSTLEN + 1];
-  char dsthost[MAX_ALTSVC_HOSTLEN + 1];
-  char srcalpn[MAX_ALTSVC_ALPNLEN + 1];
-  char dstalpn[MAX_ALTSVC_ALPNLEN + 1];
-  char date[MAX_ALTSVC_DATELEN + 1];
-  unsigned int srcport;
-  unsigned int dstport;
-  unsigned int prio;
-  unsigned int persist;
-  int rc;
+  struct Curl_str srchost;
+  struct Curl_str dsthost;
+  struct Curl_str srcalpn;
+  struct Curl_str dstalpn;
+  struct Curl_str date;
+  curl_off_t srcport;
+  curl_off_t dstport;
+  curl_off_t persist;
+  curl_off_t prio;
 
-  rc = sscanf(line,
-              "%" MAX_ALTSVC_ALPNLENSTR "s %" MAX_ALTSVC_HOSTLENSTR "s %u "
-              "%" MAX_ALTSVC_ALPNLENSTR "s %" MAX_ALTSVC_HOSTLENSTR "s %u "
-              "\"%" MAX_ALTSVC_DATELENSTR "[^\"]\" %u %u",
-              srcalpn, srchost, &srcport,
-              dstalpn, dsthost, &dstport,
-              date, &persist, &prio);
-  if(9 == rc) {
-    struct altsvc *as;
-    time_t expires = Curl_getdate_capped(date);
-    as = altsvc_create(srchost, dsthost, srcalpn, dstalpn, srcport, dstport);
-    if(as) {
-      as->expires = expires;
-      as->prio = prio;
-      as->persist = persist ? 1 : 0;
-      Curl_llist_insert_next(&asi->list, asi->list.tail, as, &as->node);
+  if(curlx_str_word(&line, &srcalpn, MAX_ALTSVC_ALPNLEN) ||
+     curlx_str_singlespace(&line) ||
+     curlx_str_word(&line, &srchost, MAX_ALTSVC_HOSTLEN) ||
+     curlx_str_singlespace(&line) ||
+     curlx_str_number(&line, &srcport, 65535) ||
+     curlx_str_singlespace(&line) ||
+     curlx_str_word(&line, &dstalpn, MAX_ALTSVC_ALPNLEN) ||
+     curlx_str_singlespace(&line) ||
+     curlx_str_word(&line, &dsthost, MAX_ALTSVC_HOSTLEN) ||
+     curlx_str_singlespace(&line) ||
+     curlx_str_number(&line, &dstport, 65535) ||
+     curlx_str_singlespace(&line) ||
+     curlx_str_quotedword(&line, &date, MAX_ALTSVC_DATELEN) ||
+     curlx_str_singlespace(&line) ||
+     curlx_str_number(&line, &persist, 1) ||
+     curlx_str_singlespace(&line) ||
+     curlx_str_number(&line, &prio, 0) ||
+     curlx_str_newline(&line))
+    ;
+  else {
+    char dbuf[MAX_ALTSVC_DATELEN + 1];
+    time_t expires = 0;
+    time_t now = time(NULL);
+
+    /* The date parser works on a null-terminated string. The maximum length
+       is upheld by curlx_str_quotedword(). */
+    memcpy(dbuf, curlx_str(&date), curlx_strlen(&date));
+    dbuf[curlx_strlen(&date)] = 0;
+    Curl_getdate_capped(dbuf, &expires);
+
+    if(now < expires) {
+      struct altsvc *as = altsvc_create(&srchost, &dsthost, &srcalpn, &dstalpn,
+                                        (size_t)srcport, (size_t)dstport);
+      if(as) {
+        as->expires = expires;
+        as->persist = persist ? 1 : 0;
+        altsvc_append(asi, as);
+      }
+      else
+        return CURLE_OUT_OF_MEMORY;
     }
   }
 
@@ -209,47 +231,41 @@ static CURLcode altsvc_add(struct altsvcinfo *asi, char *line)
 static CURLcode altsvc_load(struct altsvcinfo *asi, const char *file)
 {
   CURLcode result = CURLE_OK;
-  char *line = NULL;
   FILE *fp;
 
-  /* we need a private copy of the file name so that the altsvc cache file
+  /* we need a private copy of the filename so that the altsvc cache file
      name survives an easy handle reset */
-  free(asi->filename);
-  asi->filename = strdup(file);
+  curlx_free(asi->filename);
+  asi->filename = curlx_strdup(file);
   if(!asi->filename)
     return CURLE_OUT_OF_MEMORY;
 
-  fp = fopen(file, FOPEN_READTEXT);
+  fp = curlx_fopen(file, FOPEN_READTEXT);
   if(fp) {
-    line = malloc(MAX_ALTSVC_LINE);
-    if(!line)
-      goto fail;
-    while(Curl_get_line(line, MAX_ALTSVC_LINE, fp)) {
-      char *lineptr = line;
-      while(*lineptr && ISBLANK(*lineptr))
-        lineptr++;
-      if(*lineptr == '#')
-        /* skip commented lines */
-        continue;
-
-      altsvc_add(asi, lineptr);
+    curlx_struct_stat stat;
+    if((curlx_fstat(fileno(fp), &stat) == -1) || !S_ISDIR(stat.st_mode)) {
+      bool eof = FALSE;
+      struct dynbuf buf;
+      curlx_dyn_init(&buf, MAX_ALTSVC_LINE);
+      do {
+        result = Curl_get_line(&buf, fp, &eof);
+        if(!result) {
+          const char *lineptr = curlx_dyn_ptr(&buf);
+          curlx_str_passblanks(&lineptr);
+          if(curlx_str_single(&lineptr, '#'))
+            altsvc_add(asi, lineptr);
+        }
+      } while(!result && !eof);
+      curlx_dyn_free(&buf); /* free the line buffer */
     }
-    free(line); /* free the line buffer */
-    fclose(fp);
+    curlx_fclose(fp);
   }
   return result;
-
-fail:
-  Curl_safefree(asi->filename);
-  free(line);
-  fclose(fp);
-  return CURLE_OUT_OF_MEMORY;
 }
 
 /*
  * Write this single altsvc entry to a single output line
  */
-
 static CURLcode altsvc_out(struct altsvc *as, FILE *fp)
 {
   struct tm stamp;
@@ -257,39 +273,39 @@ static CURLcode altsvc_out(struct altsvc *as, FILE *fp)
   const char *dst6_post = "";
   const char *src6_pre = "";
   const char *src6_post = "";
-  CURLcode result = Curl_gmtime(as->expires, &stamp);
+  CURLcode result = curlx_gmtime(as->expires, &stamp);
   if(result)
     return result;
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
   else {
     char ipv6_unused[16];
-    if(1 == Curl_inet_pton(AF_INET6, as->dst.host, ipv6_unused)) {
+    if(curlx_inet_pton(AF_INET6, as->dst.host, ipv6_unused) == 1) {
       dst6_pre = "[";
       dst6_post = "]";
     }
-    if(1 == Curl_inet_pton(AF_INET6, as->src.host, ipv6_unused)) {
+    if(curlx_inet_pton(AF_INET6, as->src.host, ipv6_unused) == 1) {
       src6_pre = "[";
       src6_post = "]";
     }
   }
 #endif
-  fprintf(fp,
-          "%s %s%s%s %u "
-          "%s %s%s%s %u "
-          "\"%d%02d%02d "
-          "%02d:%02d:%02d\" "
-          "%u %d\n",
-          Curl_alpnid2str(as->src.alpnid),
-          src6_pre, as->src.host, src6_post,
-          as->src.port,
+  curl_mfprintf(fp,
+                "%s %s%s%s %u "
+                "%s %s%s%s %u "
+                "\"%d%02d%02d "
+                "%02d:%02d:%02d\" "
+                "%d 0\n", /* prio still always zero */
+                Curl_alpnid2str(as->src.alpnid),
+                src6_pre, as->src.host, src6_post,
+                as->src.port,
 
-          Curl_alpnid2str(as->dst.alpnid),
-          dst6_pre, as->dst.host, dst6_post,
-          as->dst.port,
+                Curl_alpnid2str(as->dst.alpnid),
+                dst6_pre, as->dst.host, dst6_post,
+                as->dst.port,
 
-          stamp.tm_year + 1900, stamp.tm_mon + 1, stamp.tm_mday,
-          stamp.tm_hour, stamp.tm_min, stamp.tm_sec,
-          as->persist, as->prio);
+                stamp.tm_year + 1900, stamp.tm_mon + 1, stamp.tm_mday,
+                stamp.tm_hour, stamp.tm_min, stamp.tm_sec,
+                as->persist);
   return CURLE_OK;
 }
 
@@ -301,7 +317,7 @@ static CURLcode altsvc_out(struct altsvc *as, FILE *fp)
  */
 struct altsvcinfo *Curl_altsvc_init(void)
 {
-  struct altsvcinfo *asi = calloc(sizeof(struct altsvcinfo), 1);
+  struct altsvcinfo *asi = curlx_calloc(1, sizeof(struct altsvcinfo));
   if(!asi)
     return NULL;
   Curl_llist_init(&asi->list, NULL);
@@ -311,7 +327,7 @@ struct altsvcinfo *Curl_altsvc_init(void)
 #ifdef USE_HTTP2
     | CURLALTSVC_H2
 #endif
-#ifdef ENABLE_QUIC
+#ifdef USE_HTTP3
     | CURLALTSVC_H3
 #endif
     ;
@@ -323,22 +339,25 @@ struct altsvcinfo *Curl_altsvc_init(void)
  */
 CURLcode Curl_altsvc_load(struct altsvcinfo *asi, const char *file)
 {
-  CURLcode result;
   DEBUGASSERT(asi);
-  result = altsvc_load(asi, file);
-  return result;
+  return altsvc_load(asi, file);
 }
 
 /*
  * Curl_altsvc_ctrl() passes on the external bitmask.
  */
-CURLcode Curl_altsvc_ctrl(struct altsvcinfo *asi, const long ctrl)
+CURLcode Curl_altsvc_ctrl(struct Curl_easy *data, const long ctrl)
 {
-  DEBUGASSERT(asi);
+  DEBUGASSERT(data);
   if(!ctrl)
-    /* unexpected */
     return CURLE_BAD_FUNCTION_ARGUMENT;
-  asi->flags = ctrl;
+
+  if(!data->asi) {
+    data->asi = Curl_altsvc_init();
+    if(!data->asi)
+      return CURLE_OUT_OF_MEMORY;
+  }
+  data->asi->flags = ctrl;
   return CURLE_OK;
 }
 
@@ -346,20 +365,20 @@ CURLcode Curl_altsvc_ctrl(struct altsvcinfo *asi, const long ctrl)
  * Curl_altsvc_cleanup() frees an altsvc cache instance and all associated
  * resources.
  */
-void Curl_altsvc_cleanup(struct altsvcinfo **altsvcp)
+void Curl_altsvc_cleanup(struct altsvcinfo **asi)
 {
-  struct Curl_llist_element *e;
-  struct Curl_llist_element *n;
-  if(*altsvcp) {
-    struct altsvcinfo *altsvc = *altsvcp;
-    for(e = altsvc->list.head; e; e = n) {
-      struct altsvc *as = e->ptr;
-      n = e->next;
+  if(*asi) {
+    struct Curl_llist_node *e;
+    struct Curl_llist_node *n;
+    struct altsvcinfo *altsvc = *asi;
+    for(e = Curl_llist_head(&altsvc->list); e; e = n) {
+      struct altsvc *as = Curl_node_elem(e);
+      n = Curl_node_next(e);
       altsvc_free(as);
     }
-    free(altsvc->filename);
-    free(altsvc);
-    *altsvcp = NULL; /* clear the pointer */
+    curlx_free(altsvc->filename);
+    curlx_free(altsvc);
+    *asi = NULL; /* clear the pointer */
   }
 }
 
@@ -367,69 +386,49 @@ void Curl_altsvc_cleanup(struct altsvcinfo **altsvcp)
  * Curl_altsvc_save() writes the altsvc cache to a file.
  */
 CURLcode Curl_altsvc_save(struct Curl_easy *data,
-                          struct altsvcinfo *altsvc, const char *file)
+                          struct altsvcinfo *asi, const char *file)
 {
-  struct Curl_llist_element *e;
-  struct Curl_llist_element *n;
   CURLcode result = CURLE_OK;
   FILE *out;
   char *tempstore = NULL;
 
-  if(!altsvc)
+  if(!asi)
     /* no cache activated */
     return CURLE_OK;
 
   /* if not new name is given, use the one we stored from the load */
-  if(!file && altsvc->filename)
-    file = altsvc->filename;
+  if(!file && asi->filename)
+    file = asi->filename;
 
-  if((altsvc->flags & CURLALTSVC_READONLYFILE) || !file || !file[0])
-    /* marked as read-only, no file or zero length file name */
+  if((asi->flags & CURLALTSVC_READONLYFILE) || !file || !file[0])
+    /* marked as read-only, no file or zero length filename */
     return CURLE_OK;
 
   result = Curl_fopen(data, file, &out, &tempstore);
   if(!result) {
+    struct Curl_llist_node *e;
+    struct Curl_llist_node *n;
     fputs("# Your alt-svc cache. https://curl.se/docs/alt-svc.html\n"
           "# This file was generated by libcurl! Edit at your own risk.\n",
           out);
-    for(e = altsvc->list.head; e; e = n) {
-      struct altsvc *as = e->ptr;
-      n = e->next;
+    for(e = Curl_llist_head(&asi->list); e; e = n) {
+      struct altsvc *as = Curl_node_elem(e);
+      n = Curl_node_next(e);
       result = altsvc_out(as, out);
       if(result)
         break;
     }
-    fclose(out);
-    if(!result && tempstore && Curl_rename(tempstore, file))
+    curlx_fclose(out);
+    if(!result && tempstore && curlx_rename(tempstore, file))
       result = CURLE_WRITE_ERROR;
 
     if(result && tempstore)
       unlink(tempstore);
   }
-  free(tempstore);
+  curlx_free(tempstore);
   return result;
 }
 
-static CURLcode getalnum(const char **ptr, char *alpnbuf, size_t buflen)
-{
-  size_t len;
-  const char *protop;
-  const char *p = *ptr;
-  while(*p && ISBLANK(*p))
-    p++;
-  protop = p;
-  while(*p && !ISBLANK(*p) && (*p != ';') && (*p != '='))
-    p++;
-  len = p - protop;
-  *ptr = p;
-
-  if(!len || (len >= buflen))
-    return CURLE_BAD_FUNCTION_ARGUMENT;
-  memcpy(alpnbuf, protop, len);
-  alpnbuf[len] = 0;
-  return CURLE_OK;
-}
-
 /* hostcompare() returns true if 'host' matches 'check'. The first host
  * argument may have a trailing dot present that will be ignored.
  */
@@ -441,9 +440,9 @@ static bool hostcompare(const char *host, const char *check)
   if(hlen && (host[hlen - 1] == '.'))
     hlen--;
   if(hlen != clen)
-    /* they can't match if they have different lengths */
+    /* they cannot match if they have different lengths */
     return FALSE;
-  return strncasecompare(host, check, hlen);
+  return curl_strnequal(host, check, hlen);
 }
 
 /* altsvc_flush() removes all alternatives for this source origin from the
@@ -451,48 +450,29 @@ static bool hostcompare(const char *host, const char *check)
 static void altsvc_flush(struct altsvcinfo *asi, enum alpnid srcalpnid,
                          const char *srchost, unsigned short srcport)
 {
-  struct Curl_llist_element *e;
-  struct Curl_llist_element *n;
-  for(e = asi->list.head; e; e = n) {
-    struct altsvc *as = e->ptr;
-    n = e->next;
+  struct Curl_llist_node *e;
+  struct Curl_llist_node *n;
+  for(e = Curl_llist_head(&asi->list); e; e = n) {
+    struct altsvc *as = Curl_node_elem(e);
+    n = Curl_node_next(e);
     if((srcalpnid == as->src.alpnid) &&
        (srcport == as->src.port) &&
        hostcompare(srchost, as->src.host)) {
-      Curl_llist_remove(&asi->list, e, NULL);
+      Curl_node_remove(e);
       altsvc_free(as);
     }
   }
 }
 
-#ifdef DEBUGBUILD
-/* to play well with debug builds, we can *set* a fixed time this will
-   return */
-static time_t altsvc_debugtime(void *unused)
-{
-  char *timestr = getenv("CURL_TIME");
-  (void)unused;
-  if(timestr) {
-    unsigned long val = strtol(timestr, NULL, 10);
-    return (time_t)val;
-  }
-  return time(NULL);
-}
-#undef time
-#define time(x) altsvc_debugtime(x)
-#endif
-
-#define ISNEWLINE(x) (((x) == '\n') || (x) == '\r')
-
 /*
  * Curl_altsvc_parse() takes an incoming alt-svc response header and stores
  * the data correctly in the cache.
  *
- * 'value' points to the header *value*. That's contents to the right of the
+ * 'value' points to the header *value*. That is contents to the right of the
  * header name.
  *
  * Currently this function rejects invalid data without returning an error.
- * Invalid host name, port number will result in the specific alternative
+ * Invalid hostname, port number will result in the specific alternative
  * being rejected. Unknown protocols are skipped.
  */
 CURLcode Curl_altsvc_parse(struct Curl_easy *data,
@@ -501,180 +481,157 @@ CURLcode Curl_altsvc_parse(struct Curl_easy *data,
                            unsigned short srcport)
 {
   const char *p = value;
-  size_t len;
-  char namebuf[MAX_ALTSVC_HOSTLEN] = "";
-  char alpnbuf[MAX_ALTSVC_ALPNLEN] = "";
   struct altsvc *as;
   unsigned short dstport = srcport; /* the same by default */
-  CURLcode result = getalnum(&p, alpnbuf, sizeof(alpnbuf));
   size_t entries = 0;
-#ifdef CURL_DISABLE_VERBOSE_STRINGS
-  (void)data;
-#endif
-  if(result) {
-    infof(data, "Excessive alt-svc header, ignoring.");
-    return CURLE_OK;
-  }
+  struct Curl_str alpn;
 
   DEBUGASSERT(asi);
 
-  /* "clear" is a magic keyword */
-  if(strcasecompare(alpnbuf, "clear")) {
-    /* Flush cached alternatives for this source origin */
-    altsvc_flush(asi, srcalpnid, srchost, srcport);
-    return CURLE_OK;
+  /* initial check for "clear" */
+  if(!curlx_str_cspn(&p, &alpn, ";\n\r")) {
+    curlx_str_trimblanks(&alpn);
+    /* "clear" is a magic keyword */
+    if(curlx_str_casecompare(&alpn, "clear")) {
+      /* Flush cached alternatives for this source origin */
+      altsvc_flush(asi, srcalpnid, srchost, srcport);
+      return CURLE_OK;
+    }
   }
 
+  p = value;
+
+  if(curlx_str_until(&p, &alpn, MAX_ALTSVC_LINE, '='))
+    return CURLE_OK; /* strange line */
+
+  curlx_str_trimblanks(&alpn);
+
   do {
-    if(*p == '=') {
-      /* [protocol]="[host][:port]" */
-      enum alpnid dstalpnid = alpn2alpnid(alpnbuf); /* the same by default */
-      p++;
-      if(*p == '\"') {
-        const char *dsthost = "";
-        const char *value_ptr;
-        char option[32];
-        unsigned long num;
-        char *end_ptr;
-        bool quoted = FALSE;
-        time_t maxage = 24 * 3600; /* default is 24 hours */
-        bool persist = FALSE;
-        bool valid = TRUE;
-        p++;
-        if(*p != ':') {
-          /* host name starts here */
-          const char *hostp = p;
-          if(*p == '[') {
-            /* pass all valid IPv6 letters - does not handle zone id */
-            len = strspn(++p, "0123456789abcdefABCDEF:.");
-            if(p[len] != ']')
-              /* invalid host syntax, bail out */
+    if(!curlx_str_single(&p, '=')) {
+      time_t maxage = 24 * 3600; /* default is 24 hours */
+      bool persist = FALSE;
+      /* [protocol]="[host][:port], [protocol]="[host][:port]" */
+      enum alpnid dstalpnid = Curl_str2alpnid(&alpn);
+      if(!curlx_str_single(&p, '\"')) {
+        struct Curl_str dsthost;
+        curl_off_t port = 0;
+        if(curlx_str_single(&p, ':')) {
+          /* hostname starts here */
+          if(curlx_str_single(&p, '[')) {
+            if(curlx_str_until(&p, &dsthost, MAX_ALTSVC_HOSTLEN, ':')) {
+              infof(data, "Bad alt-svc hostname, ignoring.");
               break;
-            /* we store the IPv6 numerical address *with* brackets */
-            len += 2;
-            p = &p[len-1];
+            }
           }
           else {
-            while(*p && (ISALNUM(*p) || (*p == '.') || (*p == '-')))
-              p++;
-            len = p - hostp;
-          }
-          if(!len || (len >= MAX_ALTSVC_HOSTLEN)) {
-            infof(data, "Excessive alt-svc host name, ignoring.");
-            valid = FALSE;
-          }
-          else {
-            memcpy(namebuf, hostp, len);
-            namebuf[len] = 0;
-            dsthost = namebuf;
+            /* IPv6 hostname */
+            if(curlx_str_until(&p, &dsthost, MAX_IPADR_LEN, ']') ||
+               curlx_str_single(&p, ']')) {
+              infof(data, "Bad alt-svc IPv6 hostname, ignoring.");
+              break;
+            }
           }
+          if(curlx_str_single(&p, ':'))
+            break;
         }
-        else {
+        else
           /* no destination name, use source host */
-          dsthost = srchost;
-        }
-        if(*p == ':') {
-          unsigned long port = 0;
-          p++;
-          if(ISDIGIT(*p))
-            /* a port number */
-            port = strtoul(p, &end_ptr, 10);
-          else
-            end_ptr = (char *)p; /* not left uninitialized */
-          if(!port || port > USHRT_MAX || end_ptr == p || *end_ptr != '\"') {
-            infof(data, "Unknown alt-svc port number, ignoring.");
-            valid = FALSE;
-          }
-          else {
-            dstport = curlx_ultous(port);
-            p = end_ptr;
-          }
-        }
-        if(*p++ != '\"')
+          curlx_str_assign(&dsthost, srchost, strlen(srchost));
+
+        if(curlx_str_number(&p, &port, 0xffff)) {
+          infof(data, "Unknown alt-svc port number, ignoring.");
           break;
-        /* Handle the optional 'ma' and 'persist' flags. Unknown flags
-           are skipped. */
-        for(;;) {
-          while(ISBLANK(*p))
-            p++;
-          if(*p != ';')
-            break;
-          p++; /* pass the semicolon */
-          if(!*p || ISNEWLINE(*p))
-            break;
-          result = getalnum(&p, option, sizeof(option));
-          if(result) {
-            /* skip option if name is too long */
-            option[0] = '\0';
-          }
-          while(*p && ISBLANK(*p))
-            p++;
-          if(*p != '=')
-            return CURLE_OK;
-          p++;
-          while(*p && ISBLANK(*p))
-            p++;
-          if(!*p)
-            return CURLE_OK;
-          if(*p == '\"') {
-            /* quoted value */
-            p++;
-            quoted = TRUE;
-          }
-          value_ptr = p;
-          if(quoted) {
-            while(*p && *p != '\"')
-              p++;
-            if(!*p++)
-              return CURLE_OK;
-          }
-          else {
-            while(*p && !ISBLANK(*p) && *p!= ';' && *p != ',')
-              p++;
-          }
-          num = strtoul(value_ptr, &end_ptr, 10);
-          if((end_ptr != value_ptr) && (num < ULONG_MAX)) {
-            if(strcasecompare("ma", option))
-              maxage = num;
-            else if(strcasecompare("persist", option) && (num == 1))
-              persist = TRUE;
+        }
+
+        dstport = (unsigned short)port;
+
+        if(curlx_str_single(&p, '\"'))
+          break;
+
+        /* Handle the optional 'ma' and 'persist' flags. Unknown flags are
+           skipped. */
+        curlx_str_passblanks(&p);
+        if(!curlx_str_single(&p, ';')) {
+          for(;;) {
+            struct Curl_str name;
+            struct Curl_str val;
+            const char *vp;
+            curl_off_t num;
+            bool quoted;
+            /* allow some extra whitespaces around name and value */
+            if(curlx_str_until(&p, &name, 20, '=') ||
+               curlx_str_single(&p, '=') ||
+               curlx_str_cspn(&p, &val, ",;"))
+              break;
+            curlx_str_trimblanks(&name);
+            curlx_str_trimblanks(&val);
+            /* the value might be quoted */
+            vp = curlx_str(&val);
+            quoted = (*vp == '\"');
+            if(quoted)
+              vp++;
+            if(!curlx_str_number(&vp, &num, TIME_T_MAX)) {
+              if(curlx_str_casecompare(&name, "ma"))
+                maxage = (time_t)num;
+              else if(curlx_str_casecompare(&name, "persist") && (num == 1))
+                persist = TRUE;
+            }
+            else
+              break;
+            p = vp; /* point to the byte ending the value */
+            curlx_str_passblanks(&p);
+            if(quoted && curlx_str_single(&p, '\"'))
+              break;
+            curlx_str_passblanks(&p);
+            if(curlx_str_single(&p, ';'))
+              break;
           }
         }
-        if(dstalpnid && valid) {
+        if(dstalpnid) {
           if(!entries++)
             /* Flush cached alternatives for this source origin, if any - when
                this is the first entry of the line. */
             altsvc_flush(asi, srcalpnid, srchost, srcport);
 
-          as = altsvc_createid(srchost, dsthost,
+          as = altsvc_createid(srchost, strlen(srchost),
+                               curlx_str(&dsthost),
+                               curlx_strlen(&dsthost),
                                srcalpnid, dstalpnid,
                                srcport, dstport);
           if(as) {
-            /* The expires time also needs to take the Age: value (if any) into
-               account. [See RFC 7838 section 3.1] */
-            as->expires = maxage + time(NULL);
+            time_t secs = time(NULL);
+            /* The expires time also needs to take the Age: value (if any)
+               into account. [See RFC 7838 section 3.1] */
+            if(maxage > (TIME_T_MAX - secs))
+              as->expires = TIME_T_MAX;
+            else
+              as->expires = maxage + secs;
             as->persist = persist;
-            Curl_llist_insert_next(&asi->list, asi->list.tail, as, &as->node);
-            infof(data, "Added alt-svc: %s:%d over %s", dsthost, dstport,
-                  Curl_alpnid2str(dstalpnid));
+            altsvc_append(asi, as);
+            infof(data, "Added alt-svc: %.*s:%d over %s",
+                  (int)curlx_strlen(&dsthost), curlx_str(&dsthost),
+                  dstport, Curl_alpnid2str(dstalpnid));
           }
+          else
+            return CURLE_OUT_OF_MEMORY;
         }
       }
       else
         break;
-      /* after the double quote there can be a comma if there's another
+
+      /* after the double quote there can be a comma if there is another
          string or a semicolon if no more */
-      if(*p == ',') {
-        /* comma means another alternative is presented */
-        p++;
-        result = getalnum(&p, alpnbuf, sizeof(alpnbuf));
-        if(result)
-          break;
-      }
+      if(curlx_str_single(&p, ','))
+        break;
+
+      /* comma means another alternative is present */
+      if(curlx_str_until(&p, &alpn, MAX_ALTSVC_LINE, '='))
+        break;
+      curlx_str_trimblanks(&alpn);
     }
     else
       break;
-  } while(*p && (*p != ';') && (*p != '\n') && (*p != '\r'));
+  } while(1);
 
   return CURLE_OK;
 }
@@ -686,34 +643,42 @@ bool Curl_altsvc_lookup(struct altsvcinfo *asi,
                         enum alpnid srcalpnid, const char *srchost,
                         int srcport,
                         struct altsvc **dstentry,
-                        const int versions) /* one or more bits */
+                        const int versions, /* one or more bits */
+                        bool *psame_destination)
 {
-  struct Curl_llist_element *e;
-  struct Curl_llist_element *n;
+  struct Curl_llist_node *e;
+  struct Curl_llist_node *n;
   time_t now = time(NULL);
   DEBUGASSERT(asi);
   DEBUGASSERT(srchost);
   DEBUGASSERT(dstentry);
 
-  for(e = asi->list.head; e; e = n) {
-    struct altsvc *as = e->ptr;
-    n = e->next;
+  *psame_destination = FALSE;
+  for(e = Curl_llist_head(&asi->list); e; e = n) {
+    struct altsvc *as = Curl_node_elem(e);
+    n = Curl_node_next(e);
     if(as->expires < now) {
       /* an expired entry, remove */
-      Curl_llist_remove(&asi->list, e, NULL);
+      Curl_node_remove(e);
       altsvc_free(as);
       continue;
     }
     if((as->src.alpnid == srcalpnid) &&
        hostcompare(srchost, as->src.host) &&
        (as->src.port == srcport) &&
-       (versions & as->dst.alpnid)) {
+       (versions & (int)as->dst.alpnid)) {
       /* match */
       *dstentry = as;
+      *psame_destination = (srcport == as->dst.port) &&
+                           hostcompare(srchost, as->dst.host);
       return TRUE;
     }
   }
   return FALSE;
 }
 
+#if defined(DEBUGBUILD) || defined(UNITTESTS)
+#undef time
+#endif
+
 #endif /* !CURL_DISABLE_HTTP && !CURL_DISABLE_ALTSVC */
diff --git a/third-party/curl/lib/altsvc.h b/third-party/curl/lib/altsvc.h
index 7fea1434a5..dc1740bce1 100644
--- a/third-party/curl/lib/altsvc.h
+++ b/third-party/curl/lib/altsvc.h
@@ -26,19 +26,14 @@
 #include "curl_setup.h"
 
 #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_ALTSVC)
-#include <curl/curl.h>
 #include "llist.h"
 
-enum alpnid {
-  ALPN_none = 0,
-  ALPN_h1 = CURLALTSVC_H1,
-  ALPN_h2 = CURLALTSVC_H2,
-  ALPN_h3 = CURLALTSVC_H3
-};
+/* the maximum number of alt-svc entries kept in a single cache */
+#define MAX_ALTSVC_ENTRIES 5000
 
 struct althost {
   char *host;
-  unsigned short port;
+  uint16_t port;
   enum alpnid alpnid;
 };
 
@@ -46,9 +41,8 @@ struct altsvc {
   struct althost src;
   struct althost dst;
   time_t expires;
-  bool persist;
-  int prio;
-  struct Curl_llist_element node;
+  struct Curl_llist_node node;
+  BIT(persist);
 };
 
 struct altsvcinfo {
@@ -62,20 +56,21 @@ struct altsvcinfo *Curl_altsvc_init(void);
 CURLcode Curl_altsvc_load(struct altsvcinfo *asi, const char *file);
 CURLcode Curl_altsvc_save(struct Curl_easy *data,
                           struct altsvcinfo *asi, const char *file);
-CURLcode Curl_altsvc_ctrl(struct altsvcinfo *asi, const long ctrl);
-void Curl_altsvc_cleanup(struct altsvcinfo **altsvc);
+CURLcode Curl_altsvc_ctrl(struct Curl_easy *data, const long ctrl);
+void Curl_altsvc_cleanup(struct altsvcinfo **asi);
 CURLcode Curl_altsvc_parse(struct Curl_easy *data,
-                           struct altsvcinfo *altsvc, const char *value,
-                           enum alpnid srcalpn, const char *srchost,
+                           struct altsvcinfo *asi, const char *value,
+                           enum alpnid srcalpnid, const char *srchost,
                            unsigned short srcport);
 bool Curl_altsvc_lookup(struct altsvcinfo *asi,
                         enum alpnid srcalpnid, const char *srchost,
                         int srcport,
                         struct altsvc **dstentry,
-                        const int versions); /* CURLALTSVC_H* bits */
+                        const int versions, /* CURLALTSVC_H* bits */
+                        bool *psame_destination);
 #else
 /* disabled */
-#define Curl_altsvc_save(a,b,c)
+#define Curl_altsvc_save(a, b, c)
 #define Curl_altsvc_cleanup(x)
 #endif /* !CURL_DISABLE_HTTP && !CURL_DISABLE_ALTSVC */
 #endif /* HEADER_CURL_ALTSVC_H */
diff --git a/third-party/curl/lib/amigaos.c b/third-party/curl/lib/amigaos.c
index 139309b116..e4f3bfb77c 100644
--- a/third-party/curl/lib/amigaos.c
+++ b/third-party/curl/lib/amigaos.c
@@ -21,18 +21,16 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef __AMIGA__
 
-#include <curl/curl.h>
-
 #include "hostip.h"
+#include "curl_addrinfo.h"
 #include "amigaos.h"
 
 #ifdef HAVE_PROTO_BSDSOCKET_H
-#  if defined(__amigaos4__)
+#  ifdef __amigaos4__
 #    include <bsdsocket/socketbasetags.h>
 #  elif !defined(USE_AMISSL)
 #    include <amitcp/socketbasetags.h>
@@ -42,10 +40,6 @@
 #  endif
 #endif
 
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
-
 #ifdef HAVE_PROTO_BSDSOCKET_H
 
 #ifdef __amigaos4__
@@ -117,15 +111,14 @@ void Curl_amiga_cleanup(void)
 
 #ifdef CURLRES_AMIGA
 /*
- * Because we need to handle the different cases in hostip4.c at run-time,
+ * Because we need to handle the different cases in hostip4.c at runtime,
  * not at compile-time, based on what was detected in Curl_amiga_init(),
  * we replace it completely with our own as to not complicate the baseline
- * code. Assumes malloc/calloc/free are thread safe because Curl_he2ai()
+ * code. Assumes malloc/calloc/free are thread-safe because Curl_he2ai()
  * allocates memory also.
  */
 
-struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname,
-                                          int port)
+struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname, uint16_t port)
 {
   struct Curl_addrinfo *ai = NULL;
   struct hostent *h;
@@ -135,7 +128,7 @@ struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname,
     LONG h_errnop = 0;
     struct hostent *buf;
 
-    buf = calloc(1, CURL_HOSTENT_SIZE);
+    buf = curlx_calloc(1, CURL_HOSTENT_SIZE);
     if(buf) {
       h = gethostbyname_r((STRPTR)hostname, buf,
                           (char *)buf + sizeof(struct hostent),
@@ -144,12 +137,12 @@ struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname,
       if(h) {
         ai = Curl_he2ai(h, port);
       }
-      free(buf);
+      curlx_free(buf);
     }
   }
   else {
-    #ifdef CURLRES_THREADED
-    /* gethostbyname() is not thread safe, so we need to reopen bsdsocket
+#ifdef USE_RESOLV_THREADED
+    /* gethostbyname() is not thread-safe, so we need to reopen bsdsocket
      * on the thread's context
      */
     struct Library *base = OpenLibrary("bsdsocket.library", 4);
@@ -164,13 +157,13 @@ struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname,
       }
       CloseLibrary(base);
     }
-    #else
+#else
     /* not using threaded resolver - safe to use this as-is */
     h = gethostbyname(hostname);
     if(h) {
       ai = Curl_he2ai(h, port);
     }
-    #endif
+#endif
   }
 
   return ai;
@@ -184,7 +177,7 @@ int Curl_amiga_select(int nfds, fd_set *readfds, fd_set *writefds,
 {
   int r = WaitSelect(nfds, readfds, writefds, errorfds, timeout, 0);
   /* Ensure Ctrl-C signal is actioned */
-  if((r == -1) && (SOCKERRNO == EINTR))
+  if((r == -1) && (SOCKERRNO == SOCKEINTR))
     raise(SIGINT);
   return r;
 }
@@ -196,12 +189,12 @@ int Curl_amiga_select(int nfds, fd_set *readfds, fd_set *writefds,
  */
 
 struct Library *SocketBase = NULL;
-extern int errno, h_errno;
 
 #ifdef __libnix__
 void __request(const char *msg);
+#define CURL_AMIGA_REQUEST(msg)  __request(msg)
 #else
-# define __request(msg)       Printf(msg "\n\a")
+#define CURL_AMIGA_REQUEST(msg)  Printf((const unsigned char *)(msg "\n\a"), 0)
 #endif
 
 void Curl_amiga_cleanup(void)
@@ -215,17 +208,16 @@ void Curl_amiga_cleanup(void)
 CURLcode Curl_amiga_init(void)
 {
   if(!SocketBase)
-    SocketBase = OpenLibrary("bsdsocket.library", 4);
+    SocketBase = OpenLibrary((const unsigned char *)"bsdsocket.library", 4);
 
   if(!SocketBase) {
-    __request("No TCP/IP Stack running!");
+    CURL_AMIGA_REQUEST("No TCP/IP Stack running!");
     return CURLE_FAILED_INIT;
   }
 
-  if(SocketBaseTags(SBTM_SETVAL(SBTC_ERRNOPTR(sizeof(errno))), (ULONG) &errno,
-                    SBTM_SETVAL(SBTC_LOGTAGPTR), (ULONG) "curl",
-                    TAG_DONE)) {
-    __request("SocketBaseTags ERROR");
+  if(SocketBaseTags(SBTM_SETVAL(SBTC_ERRNOPTR(sizeof(errno))), (ULONG)&errno,
+                    SBTM_SETVAL(SBTC_LOGTAGPTR), (ULONG)"curl", TAG_DONE)) {
+    CURL_AMIGA_REQUEST("SocketBaseTags ERROR");
     return CURLE_FAILED_INIT;
   }
 
diff --git a/third-party/curl/lib/amigaos.h b/third-party/curl/lib/amigaos.h
index c99d963ece..58278f0935 100644
--- a/third-party/curl/lib/amigaos.h
+++ b/third-party/curl/lib/amigaos.h
@@ -33,7 +33,7 @@ void Curl_amiga_cleanup(void);
 
 #else
 
-#define Curl_amiga_init() CURLE_OK
+#define Curl_amiga_init()    CURLE_OK
 #define Curl_amiga_cleanup() Curl_nop_stmt
 
 #endif
diff --git a/third-party/curl/lib/arpa_telnet.h b/third-party/curl/lib/arpa_telnet.h
index de1373800c..826f937537 100644
--- a/third-party/curl/lib/arpa_telnet.h
+++ b/third-party/curl/lib/arpa_telnet.h
@@ -27,24 +27,23 @@
 /*
  * Telnet option defines. Add more here if in need.
  */
-#define CURL_TELOPT_BINARY   0  /* binary 8bit data */
-#define CURL_TELOPT_ECHO     1  /* just echo! */
-#define CURL_TELOPT_SGA      3  /* Suppress Go Ahead */
-#define CURL_TELOPT_EXOPL  255  /* EXtended OPtions List */
-#define CURL_TELOPT_TTYPE   24  /* Terminal TYPE */
-#define CURL_TELOPT_NAWS    31  /* Negotiate About Window Size */
-#define CURL_TELOPT_XDISPLOC 35 /* X DISPlay LOCation */
-
+#define CURL_TELOPT_BINARY      0   /* binary 8-bit data */
+#define CURL_TELOPT_ECHO        1   /* echo */
+#define CURL_TELOPT_SGA         3   /* Suppress Go Ahead */
+#define CURL_TELOPT_EXOPL       255 /* EXtended OPtions List */
+#define CURL_TELOPT_TTYPE       24  /* Terminal TYPE */
+#define CURL_TELOPT_NAWS        31  /* Negotiate About Window Size */
+#define CURL_TELOPT_XDISPLOC    35  /* X DISPlay LOCation */
 #define CURL_TELOPT_NEW_ENVIRON 39  /* NEW ENVIRONment variables */
+
 #define CURL_NEW_ENV_VAR   0
 #define CURL_NEW_ENV_VALUE 1
 
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
+#ifdef CURLVERBOSE
 /*
  * The telnet options represented as strings
  */
-static const char * const telnetoptions[]=
-{
+static const char * const telnetoptions[] = {
   "BINARY",      "ECHO",           "RCP",           "SUPPRESS GO AHEAD",
   "NAME",        "STATUS",         "TIMING MARK",   "RCTE",
   "NAOL",        "NAOP",           "NAOCRD",        "NAOHTS",
@@ -56,12 +55,14 @@ static const char * const telnetoptions[]=
   "TERM SPEED",  "LFLOW",          "LINEMODE",      "XDISPLOC",
   "OLD-ENVIRON", "AUTHENTICATION", "ENCRYPT",       "NEW-ENVIRON"
 };
+#define CURL_TELOPT(x) telnetoptions[x]
+#else
+#define CURL_TELOPT(x) ""
 #endif
 
 #define CURL_TELOPT_MAXIMUM CURL_TELOPT_NEW_ENVIRON
 
 #define CURL_TELOPT_OK(x) ((x) <= CURL_TELOPT_MAXIMUM)
-#define CURL_TELOPT(x)    telnetoptions[x]
 
 #define CURL_NTELOPTS 40
 
@@ -75,17 +76,16 @@ static const char * const telnetoptions[]=
 #define CURL_GA   249 /* Go Ahead, reverse the line */
 #define CURL_SB   250 /* SuBnegotiation */
 #define CURL_WILL 251 /* Our side WILL use this option */
-#define CURL_WONT 252 /* Our side WON'T use this option */
+#define CURL_WONT 252 /* Our side will not use this option */
 #define CURL_DO   253 /* DO use this option! */
-#define CURL_DONT 254 /* DON'T use this option! */
+#define CURL_DONT 254 /* DO NOT use this option! */
 #define CURL_IAC  255 /* Interpret As Command */
 
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
+#ifdef CURLVERBOSE
 /*
  * Then those numbers represented as strings:
  */
-static const char * const telnetcmds[]=
-{
+static const char * const telnetcmds[] = {
   "EOF",  "SUSP",  "ABORT", "EOR",  "SE",
   "NOP",  "DMARK", "BRK",   "IP",   "AO",
   "AYT",  "EC",    "EL",    "GA",   "SB",
@@ -101,9 +101,15 @@ static const char * const telnetcmds[]=
 #define CURL_TELQUAL_INFO 2
 #define CURL_TELQUAL_NAME 3
 
-#define CURL_TELCMD_OK(x) ( ((unsigned int)(x) >= CURL_TELCMD_MINIMUM) && \
-                       ((unsigned int)(x) <= CURL_TELCMD_MAXIMUM) )
-#define CURL_TELCMD(x)    telnetcmds[(x)-CURL_TELCMD_MINIMUM]
+#define CURL_TELCMD_OK(x)                        \
+  (((unsigned int)(x) >= CURL_TELCMD_MINIMUM) && \
+   ((unsigned int)(x) <= CURL_TELCMD_MAXIMUM))
+
+#ifdef CURLVERBOSE
+#define CURL_TELCMD(x) telnetcmds[(x) - CURL_TELCMD_MINIMUM]
+#else
+#define CURL_TELCMD(x) ""
+#endif
 
 #endif /* CURL_DISABLE_TELNET */
 
diff --git a/third-party/curl/lib/asyn-ares.c b/third-party/curl/lib/asyn-ares.c
index e73e41dab9..d17a6038e2 100644
--- a/third-party/curl/lib/asyn-ares.c
+++ b/third-party/curl/lib/asyn-ares.c
@@ -21,18 +21,16 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
+#ifdef USE_RESOLV_ARES
+
 /***********************************************************************
- * Only for ares-enabled builds
- * And only for functions that fulfill the asynch resolver backend API
- * as defined in asyn.h, nothing else belongs in this file!
+ * Only for ares-enabled builds and only for functions that fulfill
+ * the asynch resolver backend API as defined in asyn.h,
+ * nothing else belongs in this file!
  **********************************************************************/
 
-#ifdef CURLRES_ARES
-
-#include <limits.h>
 #ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
 #endif
@@ -48,612 +46,442 @@
 #endif
 
 #include "urldata.h"
-#include "sendf.h"
+#include "cfilters.h"
+#include "curl_addrinfo.h"
+#include "curl_trc.h"
 #include "hostip.h"
-#include "hash.h"
-#include "share.h"
 #include "url.h"
 #include "multiif.h"
-#include "inet_pton.h"
+#include "curlx/inet_pton.h"
 #include "connect.h"
 #include "select.h"
 #include "progress.h"
-#include "timediff.h"
+#include "curlx/timediff.h"
+#include "httpsrr.h"
+#include <ares.h>
 
-#  if defined(CURL_STATICLIB) && !defined(CARES_STATICLIB) &&   \
-  defined(WIN32)
-#    define CARES_STATICLIB
-#  endif
-#  include <ares.h>
-#  include <ares_version.h> /* really old c-ares didn't include this by
-                               itself */
-
-#if ARES_VERSION >= 0x010500
-/* c-ares 1.5.0 or later, the callback proto is modified */
-#define HAVE_CARES_CALLBACK_TIMEOUTS 1
+#if ARES_VERSION < 0x011000
+#error "requires c-ares 1.16.0 or newer"
 #endif
 
-#if ARES_VERSION >= 0x010601
-/* IPv6 supported since 1.6.1 */
-#define HAVE_CARES_IPV6 1
+#ifdef USE_HTTPSRR
+#if ARES_VERSION < 0x011c00
+#error "requires c-ares 1.28.0 or newer for HTTPSRR"
 #endif
-
-#if ARES_VERSION >= 0x010704
-#define HAVE_CARES_SERVERS_CSV 1
-#define HAVE_CARES_LOCAL_DEV 1
-#define HAVE_CARES_SET_LOCAL 1
+#define HTTPSRR_WORKS
 #endif
 
-#if ARES_VERSION >= 0x010b00
-#define HAVE_CARES_PORTS_CSV 1
-#endif
-
-#if ARES_VERSION >= 0x011000
-/* 1.16.0 or later has ares_getaddrinfo */
-#define HAVE_CARES_GETADDRINFO 1
-#endif
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-struct thread_data {
-  int num_pending; /* number of outstanding c-ares requests */
-  struct Curl_addrinfo *temp_ai; /* intermediary result while fetching c-ares
-                                    parts */
-  int last_status;
-#ifndef HAVE_CARES_GETADDRINFO
-  struct curltime happy_eyeballs_dns_time; /* when this timer started, or 0 */
-#endif
-  char hostname[1];
-};
-
-/* How long we are willing to wait for additional parallel responses after
-   obtaining a "definitive" one. For old c-ares without getaddrinfo.
-
-   This is intended to equal the c-ares default timeout.  cURL always uses that
-   default value.  Unfortunately, c-ares doesn't expose its default timeout in
-   its API, but it is officially documented as 5 seconds.
-
-   See query_completed_cb() for an explanation of how this is used.
- */
-#define HAPPY_EYEBALLS_DNS_TIMEOUT 5000
-
 #define CARES_TIMEOUT_PER_ATTEMPT 2000
 
+static int ares_ver = 0;
+
+static CURLcode async_ares_set_dns_servers(struct Curl_easy *data,
+                                           struct Curl_resolv_async *async);
+static CURLcode async_ares_set_dns_interface(struct Curl_easy *data,
+                                             struct Curl_resolv_async *async);
+static CURLcode async_ares_set_dns_local_ip4(struct Curl_easy *data,
+                                             struct Curl_resolv_async *async);
+static CURLcode async_ares_set_dns_local_ip6(struct Curl_easy *data,
+                                             struct Curl_resolv_async *async);
+
 /*
- * Curl_resolver_global_init() - the generic low-level asynchronous name
- * resolve API.  Called from curl_global_init() to initialize global resolver
- * environment.  Initializes ares library.
+ * Curl_async_global_init() - the generic low-level asynchronous name
+ * resolve API. Called from curl_global_init() to initialize global resolver
+ * environment. Initializes ares library.
  */
-int Curl_resolver_global_init(void)
+int Curl_async_global_init(void)
 {
 #ifdef CARES_HAVE_ARES_LIBRARY_INIT
   if(ares_library_init(ARES_LIB_INIT_ALL)) {
     return CURLE_FAILED_INIT;
   }
 #endif
+  ares_version(&ares_ver);
   return CURLE_OK;
 }
 
 /*
- * Curl_resolver_global_cleanup()
+ * Curl_async_global_cleanup()
  *
  * Called from curl_global_cleanup() to destroy global resolver environment.
  * Deinitializes ares library.
  */
-void Curl_resolver_global_cleanup(void)
+void Curl_async_global_cleanup(void)
 {
 #ifdef CARES_HAVE_ARES_LIBRARY_CLEANUP
   ares_library_cleanup();
 #endif
 }
 
-
 static void sock_state_cb(void *data, ares_socket_t socket_fd,
                           int readable, int writable)
 {
   struct Curl_easy *easy = data;
   if(!readable && !writable) {
     DEBUGASSERT(easy);
-    Curl_multi_closed(easy, socket_fd);
+    Curl_multi_will_close(easy, socket_fd);
   }
 }
 
-/*
- * Curl_resolver_init()
- *
- * Called from curl_easy_init() -> Curl_open() to initialize resolver
- * URL-state specific environment ('resolver' member of the UrlState
- * structure).  Fills the passed pointer by the initialized ares_channel.
- */
-CURLcode Curl_resolver_init(struct Curl_easy *easy, void **resolver)
+static CURLcode async_ares_init(struct Curl_easy *data,
+                                struct Curl_resolv_async *async)
 {
+  struct async_ares_ctx *ares = &async->ares;
   int status;
   struct ares_options options;
   int optmask = ARES_OPT_SOCK_STATE_CB;
+  CURLcode result = CURLE_OK;
+
+  /* initial status - failed */
+  ares->ares_status = ARES_ENOTFOUND;
+  async->queries_ongoing = 0;
+
   options.sock_state_cb = sock_state_cb;
-  options.sock_state_cb_data = easy;
-  options.timeout = CARES_TIMEOUT_PER_ATTEMPT;
-  optmask |= ARES_OPT_TIMEOUTMS;
+  options.sock_state_cb_data = data;
 
-  status = ares_init_options((ares_channel*)resolver, &options, optmask);
-  if(status != ARES_SUCCESS) {
-    if(status == ARES_ENOMEM)
-      return CURLE_OUT_OF_MEMORY;
-    else
-      return CURLE_FAILED_INIT;
-  }
-  return CURLE_OK;
-  /* make sure that all other returns from this function should destroy the
-     ares channel before returning error! */
-}
-
-/*
- * Curl_resolver_cleanup()
- *
- * Called from curl_easy_cleanup() -> Curl_close() to cleanup resolver
- * URL-state specific environment ('resolver' member of the UrlState
- * structure).  Destroys the ares channel.
- */
-void Curl_resolver_cleanup(void *resolver)
-{
-  ares_destroy((ares_channel)resolver);
-}
-
-/*
- * Curl_resolver_duphandle()
- *
- * Called from curl_easy_duphandle() to duplicate resolver URL-state specific
- * environment ('resolver' member of the UrlState structure).  Duplicates the
- * 'from' ares channel and passes the resulting channel to the 'to' pointer.
- */
-CURLcode Curl_resolver_duphandle(struct Curl_easy *easy, void **to, void *from)
-{
-  (void)from;
+  DEBUGASSERT(!ares->channel);
   /*
-   * it would be better to call ares_dup instead, but right now
-   * it is not possible to set 'sock_state_cb_data' outside of
-   * ares_init_options
-   */
-  return Curl_resolver_init(easy, to);
-}
+     if c ares < 1.20.0: curl set timeout to CARES_TIMEOUT_PER_ATTEMPT (2s)
 
-static void destroy_async_data(struct Curl_async *async);
+     if c-ares >= 1.20.0 it already has the timeout to 2s, curl does not need
+     to set the timeout value;
 
-/*
- * Cancel all possibly still on-going resolves for this connection.
- */
-void Curl_resolver_cancel(struct Curl_easy *data)
-{
-  DEBUGASSERT(data);
-  if(data->state.async.resolver)
-    ares_cancel((ares_channel)data->state.async.resolver);
-  destroy_async_data(&data->state.async);
+     if c-ares >= 1.24.0, user can set the timeout via /etc/resolv.conf to
+     overwrite c-ares' timeout.
+  */
+  DEBUGASSERT(ares_ver);
+  if(ares_ver < 0x011400) {
+    options.timeout = CARES_TIMEOUT_PER_ATTEMPT;
+    optmask |= ARES_OPT_TIMEOUTMS;
+  }
+
+  status = ares_init_options(&ares->channel, &options, optmask);
+  if(status != ARES_SUCCESS) {
+    ares->channel = NULL;
+    result = (status == ARES_ENOMEM) ? CURLE_OUT_OF_MEMORY : CURLE_FAILED_INIT;
+    goto out;
+  }
+
+  result = async_ares_set_dns_servers(data, async);
+  if(result && result != CURLE_NOT_BUILT_IN)
+    goto out;
+
+  result = async_ares_set_dns_interface(data, async);
+  if(result && result != CURLE_NOT_BUILT_IN)
+    goto out;
+
+  result = async_ares_set_dns_local_ip4(data, async);
+  if(result && result != CURLE_NOT_BUILT_IN)
+    goto out;
+
+  result = async_ares_set_dns_local_ip6(data, async);
+  if(result && result != CURLE_NOT_BUILT_IN)
+    goto out;
+
+  result = CURLE_OK;
+
+out:
+  if(result && ares->channel) {
+    ares_destroy(ares->channel);
+    ares->channel = NULL;
+  }
+  return result;
 }
 
 /*
- * We're equivalent to Curl_resolver_cancel() for the c-ares resolver.  We
- * never block.
+ * async_ares_cleanup() cleans up async resolver data.
  */
-void Curl_resolver_kill(struct Curl_easy *data)
+static void async_ares_cleanup(struct Curl_resolv_async *async)
 {
-  /* We don't need to check the resolver state because we can be called safely
-     at any time and we always do the same thing. */
-  Curl_resolver_cancel(data);
+  struct async_ares_ctx *ares = &async->ares;
+  if(ares->res_A) {
+    Curl_freeaddrinfo(ares->res_A);
+    ares->res_A = NULL;
+  }
+  if(ares->res_AAAA) {
+    Curl_freeaddrinfo(ares->res_AAAA);
+    ares->res_AAAA = NULL;
+  }
+#ifdef USE_HTTPSRR
+  Curl_httpsrr_cleanup(&ares->hinfo);
+#endif
 }
 
-/*
- * destroy_async_data() cleans up async resolver data.
- */
-static void destroy_async_data(struct Curl_async *async)
+void Curl_async_ares_shutdown(struct Curl_easy *data,
+                              struct Curl_resolv_async *async)
 {
-  if(async->tdata) {
-    struct thread_data *res = async->tdata;
-    if(res) {
-      if(res->temp_ai) {
-        Curl_freeaddrinfo(res->temp_ai);
-        res->temp_ai = NULL;
-      }
-      free(res);
+  /* c-ares has a method to "cancel" operations on a channel, but
+   * as reported in #18216, this does not totally reset the channel
+   * and ares may get stuck.
+   * We need to destroy the channel and on demand create a new
+   * one to avoid that. */
+  Curl_async_ares_destroy(data, async);
+}
+
+void Curl_async_ares_destroy(struct Curl_easy *data,
+                             struct Curl_resolv_async *async)
+{
+  struct async_ares_ctx *ares = &async->ares;
+  (void)data;
+  if(ares->channel) {
+    ares_destroy(ares->channel);
+    ares->channel = NULL;
+  }
+  async_ares_cleanup(async);
+}
+
+CURLcode Curl_async_pollset(struct Curl_easy *data,
+                            struct Curl_resolv_async *async,
+                            struct easy_pollset *ps)
+{
+  struct async_ares_ctx *ares = &async->ares;
+  CURLcode result = CURLE_OK;
+
+  if(ares->channel) {
+    result = Curl_ares_pollset(data, ares->channel, ps);
+    if(!result) {
+      timediff_t ms = Curl_ares_timeout_ms(data, async, ares->channel);
+      Curl_expire(data, ms, EXPIRE_ASYNC_NAME);
     }
-    async->tdata = NULL;
   }
+  return result;
 }
 
 /*
- * Curl_resolver_getsock() is called when someone from the outside world
- * (using curl_multi_fdset()) wants to get our fd_set setup and we're talking
- * with ares. The caller must make sure that this function is only called when
- * we have a working ares channel.
- *
- * Returns: sockets-in-use-bitmap
- */
-
-int Curl_resolver_getsock(struct Curl_easy *data,
-                          curl_socket_t *socks)
-{
-  struct timeval maxtime;
-  struct timeval timebuf;
-  struct timeval *timeout;
-  long milli;
-  int max = ares_getsock((ares_channel)data->state.async.resolver,
-                         (ares_socket_t *)socks, MAX_SOCKSPEREASYHANDLE);
-
-  maxtime.tv_sec = CURL_TIMEOUT_RESOLVE;
-  maxtime.tv_usec = 0;
-
-  timeout = ares_timeout((ares_channel)data->state.async.resolver, &maxtime,
-                         &timebuf);
-  milli = (long)curlx_tvtoms(timeout);
-  if(milli == 0)
-    milli += 10;
-  Curl_expire(data, milli, EXPIRE_ASYNC_NAME);
-
-  return max;
-}
-
-/*
- * waitperform()
- *
- * 1) Ask ares what sockets it currently plays with, then
- * 2) wait for the timeout period to check for action on ares' sockets.
- * 3) tell ares to act on all the sockets marked as "with action"
- *
- * return number of sockets it worked on, or -1 on error
- */
-
-static int waitperform(struct Curl_easy *data, timediff_t timeout_ms)
-{
-  int nfds;
-  int bitmask;
-  ares_socket_t socks[ARES_GETSOCK_MAXNUM];
-  struct pollfd pfd[ARES_GETSOCK_MAXNUM];
-  int i;
-  int num = 0;
-
-  bitmask = ares_getsock((ares_channel)data->state.async.resolver, socks,
-                         ARES_GETSOCK_MAXNUM);
-
-  for(i = 0; i < ARES_GETSOCK_MAXNUM; i++) {
-    pfd[i].events = 0;
-    pfd[i].revents = 0;
-    if(ARES_GETSOCK_READABLE(bitmask, i)) {
-      pfd[i].fd = socks[i];
-      pfd[i].events |= POLLRDNORM|POLLIN;
-    }
-    if(ARES_GETSOCK_WRITABLE(bitmask, i)) {
-      pfd[i].fd = socks[i];
-      pfd[i].events |= POLLWRNORM|POLLOUT;
-    }
-    if(pfd[i].events)
-      num++;
-    else
-      break;
-  }
-
-  if(num) {
-    nfds = Curl_poll(pfd, num, timeout_ms);
-    if(nfds < 0)
-      return -1;
-  }
-  else
-    nfds = 0;
-
-  if(!nfds)
-    /* Call ares_process() unconditionally here, even if we simply timed out
-       above, as otherwise the ares name resolve won't timeout! */
-    ares_process_fd((ares_channel)data->state.async.resolver, ARES_SOCKET_BAD,
-                    ARES_SOCKET_BAD);
-  else {
-    /* move through the descriptors and ask for processing on them */
-    for(i = 0; i < num; i++)
-      ares_process_fd((ares_channel)data->state.async.resolver,
-                      (pfd[i].revents & (POLLRDNORM|POLLIN))?
-                      pfd[i].fd:ARES_SOCKET_BAD,
-                      (pfd[i].revents & (POLLWRNORM|POLLOUT))?
-                      pfd[i].fd:ARES_SOCKET_BAD);
-  }
-  return nfds;
-}
-
-/*
- * Curl_resolver_is_resolved() is called repeatedly to check if a previous
+ * Curl_async_take_result() is called repeatedly to check if a previous
  * name resolve request has completed. It should also make sure to time-out if
  * the operation seems to take too long.
  *
  * Returns normal CURLcode errors.
  */
-CURLcode Curl_resolver_is_resolved(struct Curl_easy *data,
-                                   struct Curl_dns_entry **dns)
+CURLcode Curl_async_take_result(struct Curl_easy *data,
+                                struct Curl_resolv_async *async,
+                                struct Curl_dns_entry **pdns)
 {
-  struct thread_data *res = data->state.async.tdata;
+  struct async_ares_ctx *ares = &async->ares;
   CURLcode result = CURLE_OK;
 
-  DEBUGASSERT(dns);
-  *dns = NULL;
+  DEBUGASSERT(pdns);
+  *pdns = NULL;
+  if(!ares)
+    return CURLE_FAILED_INIT;
 
-  if(waitperform(data, 0) < 0)
-    return CURLE_UNRECOVERABLE_POLL;
-
-#ifndef HAVE_CARES_GETADDRINFO
-  /* Now that we've checked for any last minute results above, see if there are
-     any responses still pending when the EXPIRE_HAPPY_EYEBALLS_DNS timer
-     expires. */
-  if(res
-     && res->num_pending
-     /* This is only set to non-zero if the timer was started. */
-     && (res->happy_eyeballs_dns_time.tv_sec
-         || res->happy_eyeballs_dns_time.tv_usec)
-     && (Curl_timediff(Curl_now(), res->happy_eyeballs_dns_time)
-         >= HAPPY_EYEBALLS_DNS_TIMEOUT)) {
-    /* Remember that the EXPIRE_HAPPY_EYEBALLS_DNS timer is no longer
-       running. */
-    memset(
-      &res->happy_eyeballs_dns_time, 0, sizeof(res->happy_eyeballs_dns_time));
-
-    /* Cancel the raw c-ares request, which will fire query_completed_cb() with
-       ARES_ECANCELLED synchronously for all pending responses.  This will
-       leave us with res->num_pending == 0, which is perfect for the next
-       block. */
-    ares_cancel((ares_channel)data->state.async.resolver);
-    DEBUGASSERT(res->num_pending == 0);
+  if(Curl_ares_perform(ares->channel, 0) < 0) {
+    result = CURLE_UNRECOVERABLE_POLL;
+    goto out;
   }
+
+  if(async->queries_ongoing) {
+    result = CURLE_AGAIN;
+    goto out;
+  }
+
+  /* all c-ares operations done, what is the result to report? */
+  result = ares->result;
+  if(ares->ares_status == ARES_SUCCESS && !result) {
+    struct Curl_dns_entry *dns =
+      Curl_dnscache_mk_entry2(data, async->dns_queries,
+                              &ares->res_AAAA, &ares->res_A,
+                              async->hostname, async->port);
+    if(!dns) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+#ifdef HTTPSRR_WORKS
+    if(async->dns_queries & CURL_DNSQ_HTTPS) {
+      if(ares->hinfo.complete) {
+        struct Curl_https_rrinfo *lhrr = Curl_httpsrr_dup_move(&ares->hinfo);
+        if(!lhrr)
+          result = CURLE_OUT_OF_MEMORY;
+        else
+          Curl_dns_entry_set_https_rr(dns, lhrr);
+      }
+      else
+        Curl_dns_entry_set_https_rr(dns, NULL);
+    }
 #endif
-
-  if(res && !res->num_pending) {
-    (void)Curl_addrinfo_callback(data, res->last_status, res->temp_ai);
-    /* temp_ai ownership is moved to the connection, so we need not free-up
-       them */
-    res->temp_ai = NULL;
-
-    if(!data->state.async.dns)
-      result = Curl_resolver_error(data);
-    else
-      *dns = data->state.async.dns;
-
-    destroy_async_data(&data->state.async);
+    if(!result) {
+      *pdns = dns;
+    }
+  }
+  /* if we have not found anything, report the proper
+   * CURLE_COULDNT_RESOLVE_* code */
+  if(!result && !*pdns) {
+    const char *msg = NULL;
+    if(ares->ares_status != ARES_SUCCESS)
+      msg = ares_strerror(ares->ares_status);
+    result = Curl_async_failed(data, async, msg);
   }
 
+  CURL_TRC_DNS(data, "ares: is_resolved() result=%d, dns=%sfound",
+               (int)result, *pdns ? "" : "not ");
+  async_ares_cleanup(async);
+
+out:
+  if(result != CURLE_AGAIN)
+    ares->result = result;
   return result;
 }
 
+static timediff_t async_ares_poll_timeout(struct async_ares_ctx *ares,
+                                          timediff_t timeout_ms)
+{
+  struct timeval *ares_calced, time_buf, max_timeout;
+  int itimeout_ms;
+
+#if TIMEDIFF_T_MAX > INT_MAX
+  itimeout_ms = (timeout_ms > INT_MAX) ? INT_MAX :
+                 ((timeout_ms < 0) ? -1 : (int)timeout_ms);
+#else
+  itimeout_ms = (int)timeout_ms;
+#endif
+  max_timeout.tv_sec = itimeout_ms / 1000;
+  max_timeout.tv_usec = (itimeout_ms % 1000) * 1000;
+
+  /* c-ares tells us the shortest timeout of any operation on channel */
+  ares_calced = ares_timeout(ares->channel, &max_timeout, &time_buf);
+  /* use the timeout period ares returned to us above if less than one
+     second is left, otherwise use 1000ms to make sure the progress callback
+     gets called frequent enough */
+  if(!ares_calced->tv_sec)
+    return (timediff_t)(ares_calced->tv_usec / 1000);
+  else
+    return 1000;
+}
+
+static const struct Curl_addrinfo *async_ares_get_ai(
+  const struct Curl_addrinfo *ai,
+  int ai_family,
+  unsigned int index)
+{
+  unsigned int i = 0;
+  for(i = 0; ai; ai = ai->ai_next) {
+    if(ai->ai_family == ai_family) {
+      if(i == index)
+        return ai;
+      ++i;
+    }
+  }
+  return NULL;
+}
+
+const struct Curl_addrinfo *Curl_async_get_ai(struct Curl_easy *data,
+                                              struct Curl_resolv_async *async,
+                                              int ai_family,
+                                              unsigned int index)
+{
+  struct async_ares_ctx *ares = &async->ares;
+
+  (void)data;
+  switch(ai_family) {
+  case AF_INET:
+    if(ares->res_A)
+      return async_ares_get_ai(ares->res_A, ai_family, index);
+    break;
+  case AF_INET6:
+    if(ares->res_AAAA)
+      return async_ares_get_ai(ares->res_AAAA, ai_family, index);
+    break;
+  default:
+    break;
+  }
+  return NULL;
+}
+
+#ifdef USE_HTTPSRR
+const struct Curl_https_rrinfo *Curl_async_get_https(
+  struct Curl_easy *data,
+  struct Curl_resolv_async *async)
+{
+  if(Curl_async_knows_https(data, async))
+    return &async->ares.hinfo;
+  return NULL;
+}
+
+bool Curl_async_knows_https(struct Curl_easy *data,
+                            struct Curl_resolv_async *async)
+{
+  (void)data;
+  if(async->dns_queries & CURL_DNSQ_HTTPS)
+    return ((async->dns_responses & CURL_DNSQ_HTTPS) ||
+            !async->queries_ongoing);
+  return TRUE; /* we know it will never come */
+}
+
+#endif /* USE_HTTPSRR */
+
 /*
- * Curl_resolver_wait_resolv()
+ * Curl_async_await()
  *
  * Waits for a resolve to finish. This function should be avoided since using
  * this risk getting the multi interface to "hang".
  *
- * 'entry' MUST be non-NULL.
+ * 'pdns' MUST be non-NULL.
  *
  * Returns CURLE_COULDNT_RESOLVE_HOST if the host was not resolved,
  * CURLE_OPERATION_TIMEDOUT if a time-out occurred, or other errors.
  */
-CURLcode Curl_resolver_wait_resolv(struct Curl_easy *data,
-                                   struct Curl_dns_entry **entry)
+CURLcode Curl_async_await(struct Curl_easy *data, uint32_t resolv_id,
+                          struct Curl_dns_entry **pdns)
 {
+  struct Curl_resolv_async *async = Curl_async_get(data, resolv_id);
+  struct async_ares_ctx *ares = async ? &async->ares : NULL;
+  struct curltime start = *Curl_pgrs_now(data);
   CURLcode result = CURLE_OK;
-  timediff_t timeout;
-  struct curltime now = Curl_now();
 
-  DEBUGASSERT(entry);
-  *entry = NULL; /* clear on entry */
+  DEBUGASSERT(pdns);
+  *pdns = NULL; /* clear on entry */
 
-  timeout = Curl_timeleft(data, &now, TRUE);
-  if(timeout < 0) {
-    /* already expired! */
-    connclose(data->conn, "Timed out before name resolve started");
-    return CURLE_OPERATION_TIMEDOUT;
-  }
-  if(!timeout)
-    timeout = CURL_TIMEOUT_RESOLVE * 1000; /* default name resolve timeout */
+  if(!ares)
+    return CURLE_FAILED_INIT;
 
-  /* Wait for the name resolve query to complete. */
+  /* Wait for the name resolve query to complete or time out. */
   while(!result) {
-    struct timeval *tvp, tv, store;
-    int itimeout;
     timediff_t timeout_ms;
 
-#if TIMEDIFF_T_MAX > INT_MAX
-    itimeout = (timeout > INT_MAX) ? INT_MAX : (int)timeout;
-#else
-    itimeout = (int)timeout;
-#endif
+    timeout_ms = Curl_timeleft_ms(data);
+    if(!timeout_ms) { /* no applicable timeout from `data`*/
+      timediff_t elapsed_ms = curlx_ptimediff_ms(Curl_pgrs_now(data), &start);
+      if(elapsed_ms < CURL_TIMEOUT_RESOLVE_MS)
+        timeout_ms = CURL_TIMEOUT_RESOLVE_MS - elapsed_ms;
+      else
+        timeout_ms = -1;
+    }
 
-    store.tv_sec = itimeout/1000;
-    store.tv_usec = (itimeout%1000)*1000;
+    if(timeout_ms < 0) {
+      result = CURLE_OPERATION_TIMEDOUT;
+      break;
+    }
 
-    tvp = ares_timeout((ares_channel)data->state.async.resolver, &store, &tv);
+    if(Curl_ares_perform(ares->channel,
+                         async_ares_poll_timeout(ares, timeout_ms)) < 0) {
+      result = CURLE_UNRECOVERABLE_POLL;
+      break;
+    }
 
-    /* use the timeout period ares returned to us above if less than one
-       second is left, otherwise just use 1000ms to make sure the progress
-       callback gets called frequent enough */
-    if(!tvp->tv_sec)
-      timeout_ms = (timediff_t)(tvp->tv_usec/1000);
-    else
-      timeout_ms = 1000;
-
-    if(waitperform(data, timeout_ms) < 0)
-      return CURLE_UNRECOVERABLE_POLL;
-    result = Curl_resolver_is_resolved(data, entry);
-
-    if(result || data->state.async.done)
+    result = Curl_async_take_result(data, async, pdns);
+    if(result == CURLE_AGAIN)
+      result = CURLE_OK;
+    else if(result || *pdns)
       break;
 
-    if(Curl_pgrsUpdate(data))
+    if(Curl_pgrsUpdate(data)) {
       result = CURLE_ABORTED_BY_CALLBACK;
-    else {
-      struct curltime now2 = Curl_now();
-      timediff_t timediff = Curl_timediff(now2, now); /* spent time */
-      if(timediff <= 0)
-        timeout -= 1; /* always deduct at least 1 */
-      else if(timediff > timeout)
-        timeout = -1;
-      else
-        timeout -= timediff;
-      now = now2; /* for next loop */
+      break;
     }
-    if(timeout < 0)
-      result = CURLE_OPERATION_TIMEDOUT;
   }
-  if(result)
-    /* failure, so we cancel the ares operation */
-    ares_cancel((ares_channel)data->state.async.resolver);
-
-  /* Operation complete, if the lookup was successful we now have the entry
-     in the cache. */
-  if(entry)
-    *entry = data->state.async.dns;
 
   if(result)
-    /* close the connection, since we can't return failure here without
-       cleaning up this connection properly. */
-    connclose(data->conn, "c-ares resolve failed");
-
+    ares_cancel(ares->channel);
   return result;
 }
 
-#ifndef HAVE_CARES_GETADDRINFO
-
-/* Connects results to the list */
-static void compound_results(struct thread_data *res,
-                             struct Curl_addrinfo *ai)
-{
-  if(!ai)
-    return;
-
-#ifdef ENABLE_IPV6 /* CURLRES_IPV6 */
-  if(res->temp_ai && res->temp_ai->ai_family == PF_INET6) {
-    /* We have results already, put the new IPv6 entries at the head of the
-       list. */
-    struct Curl_addrinfo *temp_ai_tail = res->temp_ai;
-
-    while(temp_ai_tail->ai_next)
-      temp_ai_tail = temp_ai_tail->ai_next;
-
-    temp_ai_tail->ai_next = ai;
-  }
-  else
-#endif /* CURLRES_IPV6 */
-  {
-    /* Add the new results to the list of old results. */
-    struct Curl_addrinfo *ai_tail = ai;
-    while(ai_tail->ai_next)
-      ai_tail = ai_tail->ai_next;
-
-    ai_tail->ai_next = res->temp_ai;
-    res->temp_ai = ai;
-  }
-}
-
 /*
- * ares_query_completed_cb() is the callback that ares will call when
- * the host query initiated by ares_gethostbyname() from Curl_getaddrinfo(),
- * when using ares, is completed either successfully or with failure.
+ * async_ares_node2addr() converts an address list provided by c-ares
+ * to an internal libcurl compatible list.
  */
-static void query_completed_cb(void *arg,  /* (struct connectdata *) */
-                               int status,
-#ifdef HAVE_CARES_CALLBACK_TIMEOUTS
-                               int timeouts,
-#endif
-                               struct hostent *hostent)
-{
-  struct Curl_easy *data = (struct Curl_easy *)arg;
-  struct thread_data *res;
-
-#ifdef HAVE_CARES_CALLBACK_TIMEOUTS
-  (void)timeouts; /* ignored */
-#endif
-
-  if(ARES_EDESTRUCTION == status)
-    /* when this ares handle is getting destroyed, the 'arg' pointer may not
-       be valid so only defer it when we know the 'status' says its fine! */
-    return;
-
-  res = data->state.async.tdata;
-  if(res) {
-    res->num_pending--;
-
-    if(CURL_ASYNC_SUCCESS == status) {
-      struct Curl_addrinfo *ai = Curl_he2ai(hostent, data->state.async.port);
-      if(ai) {
-        compound_results(res, ai);
-      }
-    }
-    /* A successful result overwrites any previous error */
-    if(res->last_status != ARES_SUCCESS)
-      res->last_status = status;
-
-    /* If there are responses still pending, we presume they must be the
-       complementary IPv4 or IPv6 lookups that we started in parallel in
-       Curl_resolver_getaddrinfo() (for Happy Eyeballs).  If we've got a
-       "definitive" response from one of a set of parallel queries, we need to
-       think about how long we're willing to wait for more responses. */
-    if(res->num_pending
-       /* Only these c-ares status values count as "definitive" for these
-          purposes.  For example, ARES_ENODATA is what we expect when there is
-          no IPv6 entry for a domain name, and that's not a reason to get more
-          aggressive in our timeouts for the other response.  Other errors are
-          either a result of bad input (which should affect all parallel
-          requests), local or network conditions, non-definitive server
-          responses, or us cancelling the request. */
-       && (status == ARES_SUCCESS || status == ARES_ENOTFOUND)) {
-      /* Right now, there can only be up to two parallel queries, so don't
-         bother handling any other cases. */
-      DEBUGASSERT(res->num_pending == 1);
-
-      /* It's possible that one of these parallel queries could succeed
-         quickly, but the other could always fail or timeout (when we're
-         talking to a pool of DNS servers that can only successfully resolve
-         IPv4 address, for example).
-
-         It's also possible that the other request could always just take
-         longer because it needs more time or only the second DNS server can
-         fulfill it successfully.  But, to align with the philosophy of Happy
-         Eyeballs, we don't want to wait _too_ long or users will think
-         requests are slow when IPv6 lookups don't actually work (but IPv4 ones
-         do).
-
-         So, now that we have a usable answer (some IPv4 addresses, some IPv6
-         addresses, or "no such domain"), we start a timeout for the remaining
-         pending responses.  Even though it is typical that this resolved
-         request came back quickly, that needn't be the case.  It might be that
-         this completing request didn't get a result from the first DNS server
-         or even the first round of the whole DNS server pool.  So it could
-         already be quite some time after we issued the DNS queries in the
-         first place.  Without modifying c-ares, we can't know exactly where in
-         its retry cycle we are.  We could guess based on how much time has
-         gone by, but it doesn't really matter.  Happy Eyeballs tells us that,
-         given usable information in hand, we simply don't want to wait "too
-         much longer" after we get a result.
-
-         We simply wait an additional amount of time equal to the default
-         c-ares query timeout.  That is enough time for a typical parallel
-         response to arrive without being "too long".  Even on a network
-         where one of the two types of queries is failing or timing out
-         constantly, this will usually mean we wait a total of the default
-         c-ares timeout (5 seconds) plus the round trip time for the successful
-         request, which seems bearable.  The downside is that c-ares might race
-         with us to issue one more retry just before we give up, but it seems
-         better to "waste" that request instead of trying to guess the perfect
-         timeout to prevent it.  After all, we don't even know where in the
-         c-ares retry cycle each request is.
-      */
-      res->happy_eyeballs_dns_time = Curl_now();
-      Curl_expire(data, HAPPY_EYEBALLS_DNS_TIMEOUT,
-                  EXPIRE_HAPPY_EYEBALLS_DNS);
-    }
-  }
-}
-#else
-/* c-ares 1.16.0 or later */
-
-/*
- * ares2addr() converts an address list provided by c-ares to an internal
- * libcurl compatible list
- */
-static struct Curl_addrinfo *ares2addr(struct ares_addrinfo_node *node)
+static struct Curl_addrinfo *async_ares_node2addr(
+  struct ares_addrinfo_node *node)
 {
   /* traverse the ares_addrinfo_node list */
   struct ares_addrinfo_node *ai;
@@ -661,14 +489,14 @@ static struct Curl_addrinfo *ares2addr(struct ares_addrinfo_node *node)
   struct Curl_addrinfo *calast = NULL;
   int error = 0;
 
-  for(ai = node; ai != NULL; ai = ai->ai_next) {
+  for(ai = node; ai; ai = ai->ai_next) {
     size_t ss_size;
     struct Curl_addrinfo *ca;
-    /* ignore elements with unsupported address family, */
-    /* settle family-specific sockaddr structure size.  */
+    /* ignore elements with unsupported address family,
+       settle family-specific sockaddr structure size. */
     if(ai->ai_family == AF_INET)
       ss_size = sizeof(struct sockaddr_in);
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
     else if(ai->ai_family == AF_INET6)
       ss_size = sizeof(struct sockaddr_in6);
 #endif
@@ -683,14 +511,14 @@ static struct Curl_addrinfo *ares2addr(struct ares_addrinfo_node *node)
     if((size_t)ai->ai_addrlen < ss_size)
       continue;
 
-    ca = malloc(sizeof(struct Curl_addrinfo) + ss_size);
+    ca = curlx_malloc(sizeof(struct Curl_addrinfo) + ss_size);
     if(!ca) {
       error = EAI_MEMORY;
       break;
     }
 
-    /* copy each structure member individually, member ordering, */
-    /* size, or padding might be different for each platform.    */
+    /* copy each structure member individually, member ordering,
+       size, or padding might be different for each platform. */
 
     ca->ai_flags     = ai->ai_flags;
     ca->ai_family    = ai->ai_family;
@@ -723,130 +551,191 @@ static struct Curl_addrinfo *ares2addr(struct ares_addrinfo_node *node)
   return cafirst;
 }
 
-static void addrinfo_cb(void *arg, int status, int timeouts,
-                        struct ares_addrinfo *result)
+static void async_ares_A_cb(void *user_data, int status, int timeouts,
+                            struct ares_addrinfo *ares_ai)
 {
-  struct Curl_easy *data = (struct Curl_easy *)arg;
-  struct thread_data *res = data->state.async.tdata;
+  struct Curl_resolv_async *async = user_data;
+  struct async_ares_ctx *ares = async ? &async->ares : NULL;
+
   (void)timeouts;
-  if(ARES_SUCCESS == status) {
-    res->temp_ai = ares2addr(result->nodes);
-    res->last_status = CURL_ASYNC_SUCCESS;
-    ares_freeaddrinfo(result);
+  if(!async)
+    return;
+
+  async->dns_responses |= CURL_DNSQ_A;
+  async->queries_ongoing--;
+  async->done = !async->queries_ongoing;
+  if(status == ARES_SUCCESS) {
+    ares->ares_status = ARES_SUCCESS;
+    ares->res_A = async_ares_node2addr(ares_ai->nodes);
+    ares_freeaddrinfo(ares_ai);
   }
-  res->num_pending--;
+  else if(ares->ares_status != ARES_SUCCESS) /* do not overwrite success */
+    ares->ares_status = status;
 }
 
-#endif
-/*
- * Curl_resolver_getaddrinfo() - when using ares
- *
- * Returns name information about the given hostname and port number. If
- * successful, the 'hostent' is returned and the fourth argument will point to
- * memory we need to free after use. That memory *MUST* be freed with
- * Curl_freeaddrinfo(), nothing else.
- */
-struct Curl_addrinfo *Curl_resolver_getaddrinfo(struct Curl_easy *data,
-                                                const char *hostname,
-                                                int port,
-                                                int *waitp)
-{
-  struct thread_data *res = NULL;
-  size_t namelen = strlen(hostname);
-  *waitp = 0; /* default to synchronous response */
-
-  res = calloc(sizeof(struct thread_data) + namelen, 1);
-  if(res) {
-    strcpy(res->hostname, hostname);
-    data->state.async.hostname = res->hostname;
-    data->state.async.port = port;
-    data->state.async.done = FALSE;   /* not done */
-    data->state.async.status = 0;     /* clear */
-    data->state.async.dns = NULL;     /* clear */
-    data->state.async.tdata = res;
-
-    /* initial status - failed */
-    res->last_status = ARES_ENOTFOUND;
-
-#ifdef HAVE_CARES_GETADDRINFO
-    {
-      struct ares_addrinfo_hints hints;
-      char service[12];
-      int pf = PF_INET;
-      memset(&hints, 0, sizeof(hints));
 #ifdef CURLRES_IPV6
-      if((data->conn->ip_version != CURL_IPRESOLVE_V4) &&
-         Curl_ipv6works(data)) {
-        /* The stack seems to be IPv6-enabled */
-        if(data->conn->ip_version == CURL_IPRESOLVE_V6)
-          pf = PF_INET6;
-        else
-          pf = PF_UNSPEC;
-      }
-#endif /* CURLRES_IPV6 */
-      hints.ai_family = pf;
-      hints.ai_socktype = (data->conn->transport == TRNSPRT_TCP)?
-        SOCK_STREAM : SOCK_DGRAM;
-      /* Since the service is a numerical one, set the hint flags
-       * accordingly to save a call to getservbyname in inside C-Ares
-       */
-      hints.ai_flags = ARES_AI_NUMERICSERV;
-      msnprintf(service, sizeof(service), "%d", port);
-      res->num_pending = 1;
-      ares_getaddrinfo((ares_channel)data->state.async.resolver, hostname,
-                       service, &hints, addrinfo_cb, data);
-    }
-#else
+static void async_ares_AAAA_cb(void *user_data, int status, int timeouts,
+                               struct ares_addrinfo *ares_ai)
+{
+  struct Curl_resolv_async *async = user_data;
+  struct async_ares_ctx *ares = async ? &async->ares : NULL;
 
-#ifdef HAVE_CARES_IPV6
-    if((data->conn->ip_version != CURL_IPRESOLVE_V4) && Curl_ipv6works(data)) {
-      /* The stack seems to be IPv6-enabled */
-      res->num_pending = 2;
+  (void)timeouts;
+  if(!async)
+    return;
 
-      /* areschannel is already setup in the Curl_open() function */
-      ares_gethostbyname((ares_channel)data->state.async.resolver, hostname,
-                          PF_INET, query_completed_cb, data);
-      ares_gethostbyname((ares_channel)data->state.async.resolver, hostname,
-                          PF_INET6, query_completed_cb, data);
-    }
-    else
-#endif
-    {
-      res->num_pending = 1;
-
-      /* areschannel is already setup in the Curl_open() function */
-      ares_gethostbyname((ares_channel)data->state.async.resolver,
-                         hostname, PF_INET,
-                         query_completed_cb, data);
-    }
-#endif
-    *waitp = 1; /* expect asynchronous response */
+  async->dns_responses |= CURL_DNSQ_AAAA;
+  async->queries_ongoing--;
+  async->done = !async->queries_ongoing;
+  if(status == ARES_SUCCESS) {
+    ares->ares_status = ARES_SUCCESS;
+    ares->res_AAAA = async_ares_node2addr(ares_ai->nodes);
+    ares_freeaddrinfo(ares_ai);
   }
-  return NULL; /* no struct yet */
+  else if(ares->ares_status != ARES_SUCCESS) /* do not overwrite success */
+    ares->ares_status = status;
+}
+#endif /* CURLRES_IPV6 */
+
+#ifdef USE_HTTPSRR
+static void async_ares_rr_done(void *user_data, ares_status_t status,
+                               size_t timeouts,
+                               const ares_dns_record_t *dnsrec)
+{
+  struct Curl_resolv_async *async = user_data;
+  struct async_ares_ctx *ares = async ? &async->ares : NULL;
+
+  if(!async)
+    return;
+
+  (void)timeouts;
+  async->dns_responses |= CURL_DNSQ_HTTPS;
+  async->queries_ongoing--;
+  async->done = !async->queries_ongoing;
+  if((ARES_SUCCESS != status) || !dnsrec)
+    return;
+  ares->result = Curl_httpsrr_from_ares(dnsrec, &ares->hinfo);
+}
+#endif /* USE_HTTPSRR */
+
+/*
+ * Curl_async_getaddrinfo() - when using ares
+ *
+ * Starts a name resolve for the given hostname and port number.
+ */
+CURLcode Curl_async_getaddrinfo(struct Curl_easy *data,
+                                struct Curl_resolv_async *async)
+{
+  struct async_ares_ctx *ares = &async->ares;
+  char service[12];
+  int socktype;
+  CURLcode result = CURLE_OK;
+
+  if(ares->channel) {
+    DEBUGASSERT(0);
+    result = CURLE_FAILED_INIT;
+    goto out;
+  }
+
+  result = async_ares_init(data, async);
+  if(result)
+    goto out;
+
+  result = Curl_resolv_announce_start(data, ares->channel);
+  if(result)
+    goto out;
+
+#if defined(CURLVERBOSE) && ARES_VERSION >= 0x011800 /* >= v1.24.0 */
+  if(CURL_TRC_DNS_is_verbose(data)) {
+    char *csv = ares_get_servers_csv(ares->channel);
+    CURL_TRC_DNS(data, "ares: servers=%s", csv);
+    ares_free_string(csv);
+  }
+#endif
+
+  curl_msnprintf(service, sizeof(service), "%d", async->port);
+  socktype =
+    (Curl_conn_get_transport(data, data->conn) == TRNSPRT_TCP) ?
+    SOCK_STREAM : SOCK_DGRAM;
+
+#ifdef CURLRES_IPV6
+  if(async->dns_queries & CURL_DNSQ_AAAA) {
+    struct ares_addrinfo_hints hints;
+
+    memset(&hints, 0, sizeof(hints));
+    CURL_TRC_DNS(data, "ares: query AAAA records for %s", async->hostname);
+    hints.ai_family = PF_INET6;
+    hints.ai_socktype = socktype;
+    hints.ai_flags = ARES_AI_NUMERICSERV;
+    async->queries_ongoing++;
+    ares_getaddrinfo(ares->channel, async->hostname,
+                     service, &hints, async_ares_AAAA_cb, async);
+  }
+#endif /* CURLRES_IPV6 */
+
+  if(async->dns_queries & CURL_DNSQ_A) {
+    struct ares_addrinfo_hints hints;
+
+    memset(&hints, 0, sizeof(hints));
+    CURL_TRC_DNS(data, "ares: query A records for %s", async->hostname);
+    hints.ai_family = PF_INET;
+    hints.ai_socktype = socktype;
+    hints.ai_flags = ARES_AI_NUMERICSERV;
+    async->queries_ongoing++;
+    ares_getaddrinfo(ares->channel, async->hostname,
+                     service, &hints, async_ares_A_cb, async);
+  }
+
+#ifdef USE_HTTPSRR
+  memset(&ares->hinfo, 0, sizeof(ares->hinfo));
+  if(async->dns_queries & CURL_DNSQ_HTTPS) {
+    char *rrname = NULL;
+    if(async->port != 443) {
+      rrname = curl_maprintf("_%d._https.%s", async->port, async->hostname);
+      if(!rrname)
+        return CURLE_OUT_OF_MEMORY;
+    }
+    CURL_TRC_DNS(data, "ares: query HTTPS records for %s",
+                 rrname ? rrname : async->hostname);
+    ares->hinfo.rrname = rrname;
+    async->queries_ongoing++;
+    ares_query_dnsrec(ares->channel,
+                      rrname ? rrname : async->hostname,
+                      ARES_CLASS_IN, ARES_REC_TYPE_HTTPS,
+                      async_ares_rr_done, async, NULL);
+  }
+#endif /* USE_HTTPSRR */
+
+out:
+  ares->result = result;
+  return result ? result : (async->queries_ongoing ? CURLE_AGAIN : CURLE_OK);
 }
 
-CURLcode Curl_set_dns_servers(struct Curl_easy *data,
-                              char *servers)
+/* Set what DNS server are is to use. This is called in 2 situations:
+ * 1. when the application does 'CURLOPT_DNS_SERVERS' and passing NULL
+ *    means any previous set value should be unset. Which means
+ *    we need to destroy and create the are channel anew, if there is one.
+ * 2. When we lazy init the ares channel and NULL means that there
+ *    are no preferences and we do not reset any existing channel. */
+static CURLcode async_ares_set_dns_servers(struct Curl_easy *data,
+                                           struct Curl_resolv_async *async)
 {
+  struct async_ares_ctx *ares = async ? &async->ares : NULL;
   CURLcode result = CURLE_NOT_BUILT_IN;
-  int ares_result;
+  const char *servers = data->set.str[STRING_DNS_SERVERS];
+  int ares_result = ARES_SUCCESS;
 
-  /* If server is NULL or empty, this would purge all DNS servers
-   * from ares library, which will cause any and all queries to fail.
-   * So, just return OK if none are configured and don't actually make
-   * any changes to c-ares.  This lets c-ares use it's defaults, which
-   * it gets from the OS (for instance from /etc/resolv.conf on Linux).
-   */
-  if(!(servers && servers[0]))
+#ifdef DEBUGBUILD
+  if(getenv("CURL_DNS_SERVER"))
+    servers = getenv("CURL_DNS_SERVER");
+#endif
+
+  if(!servers)
     return CURLE_OK;
 
-#ifdef HAVE_CARES_SERVERS_CSV
-#ifdef HAVE_CARES_PORTS_CSV
-  ares_result = ares_set_servers_ports_csv(data->state.async.resolver,
-                                           servers);
-#else
-  ares_result = ares_set_servers_csv(data->state.async.resolver, servers);
-#endif
+  /* if channel is not there, this is a parameter check */
+  if(ares && ares->channel)
+    ares_result = ares_set_servers_ports_csv(ares->channel, servers);
   switch(ares_result) {
   case ARES_SUCCESS:
     result = CURLE_OK;
@@ -858,82 +747,82 @@ CURLcode Curl_set_dns_servers(struct Curl_easy *data,
   case ARES_ENODATA:
   case ARES_EBADSTR:
   default:
+    DEBUGF(infof(data, "bad servers set"));
     result = CURLE_BAD_FUNCTION_ARGUMENT;
     break;
   }
-#else /* too old c-ares version! */
-  (void)data;
-  (void)(ares_result);
-#endif
   return result;
 }
 
-CURLcode Curl_set_dns_interface(struct Curl_easy *data,
-                                const char *interf)
+static CURLcode async_ares_set_dns_interface(struct Curl_easy *data,
+                                             struct Curl_resolv_async *async)
 {
-#ifdef HAVE_CARES_LOCAL_DEV
+  struct async_ares_ctx *ares = async ? &async->ares : NULL;
+  const char *interf = data->set.str[STRING_DNS_INTERFACE];
+
   if(!interf)
     interf = "";
 
-  ares_set_local_dev((ares_channel)data->state.async.resolver, interf);
+  /* if channel is not there, this is a parameter check */
+  if(ares && ares->channel)
+    ares_set_local_dev(ares->channel, interf);
 
   return CURLE_OK;
-#else /* c-ares version too old! */
-  (void)data;
-  (void)interf;
-  return CURLE_NOT_BUILT_IN;
-#endif
 }
 
-CURLcode Curl_set_dns_local_ip4(struct Curl_easy *data,
-                                const char *local_ip4)
+static CURLcode async_ares_set_dns_local_ip4(struct Curl_easy *data,
+                                             struct Curl_resolv_async *async)
 {
-#ifdef HAVE_CARES_SET_LOCAL
+  struct async_ares_ctx *ares = async ? &async->ares : NULL;
   struct in_addr a4;
+  const char *local_ip4 = data->set.str[STRING_DNS_LOCAL_IP4];
 
-  if((!local_ip4) || (local_ip4[0] == 0)) {
+  if(!local_ip4 || (local_ip4[0] == 0)) {
     a4.s_addr = 0; /* disabled: do not bind to a specific address */
   }
   else {
-    if(Curl_inet_pton(AF_INET, local_ip4, &a4) != 1) {
+    if(curlx_inet_pton(AF_INET, local_ip4, &a4) != 1) {
+      DEBUGF(infof(data, "bad DNS IPv4 address"));
       return CURLE_BAD_FUNCTION_ARGUMENT;
     }
   }
 
-  ares_set_local_ip4((ares_channel)data->state.async.resolver,
-                     ntohl(a4.s_addr));
+  /* if channel is not there yet, this is a parameter check */
+  if(ares && ares->channel)
+    ares_set_local_ip4(ares->channel, ntohl(a4.s_addr));
 
   return CURLE_OK;
-#else /* c-ares version too old! */
-  (void)data;
-  (void)local_ip4;
-  return CURLE_NOT_BUILT_IN;
-#endif
 }
 
-CURLcode Curl_set_dns_local_ip6(struct Curl_easy *data,
-                                const char *local_ip6)
+static CURLcode async_ares_set_dns_local_ip6(struct Curl_easy *data,
+                                             struct Curl_resolv_async *async)
 {
-#if defined(HAVE_CARES_SET_LOCAL) && defined(ENABLE_IPV6)
+#ifdef USE_IPV6
+  struct async_ares_ctx *ares = async ? &async->ares : NULL;
   unsigned char a6[INET6_ADDRSTRLEN];
+  const char *local_ip6 = data->set.str[STRING_DNS_LOCAL_IP6];
 
-  if((!local_ip6) || (local_ip6[0] == 0)) {
+  if(!local_ip6 || (local_ip6[0] == 0)) {
     /* disabled: do not bind to a specific address */
     memset(a6, 0, sizeof(a6));
   }
   else {
-    if(Curl_inet_pton(AF_INET6, local_ip6, a6) != 1) {
+    if(curlx_inet_pton(AF_INET6, local_ip6, a6) != 1) {
+      DEBUGF(infof(data, "bad DNS IPv6 address"));
       return CURLE_BAD_FUNCTION_ARGUMENT;
     }
   }
 
-  ares_set_local_ip6((ares_channel)data->state.async.resolver, a6);
+  /* if channel is not there, this is a parameter check */
+  if(ares && ares->channel)
+    ares_set_local_ip6(ares->channel, a6);
 
   return CURLE_OK;
-#else /* c-ares version too old! */
+#else /* no IPv6 support */
   (void)data;
-  (void)local_ip6;
+  (void)async;
   return CURLE_NOT_BUILT_IN;
 #endif
 }
-#endif /* CURLRES_ARES */
+
+#endif /* USE_RESOLV_ARES */
diff --git a/third-party/curl/lib/asyn-base.c b/third-party/curl/lib/asyn-base.c
new file mode 100644
index 0000000000..62cb0effe4
--- /dev/null
+++ b/third-party/curl/lib/asyn-base.c
@@ -0,0 +1,265 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_NETDB_H
+#include <netdb.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+#ifdef __VMS
+#include <in.h>
+#include <inet.h>
+#endif
+
+#ifdef USE_ARES
+#include <ares.h>
+#endif
+
+#include "urldata.h"
+#include "connect.h"
+#include "curl_trc.h"
+#include "hostip.h"
+#include "multiif.h"
+#include "progress.h"
+#include "select.h"
+#include "url.h"
+
+/***********************************************************************
+ * Only for builds using asynchronous name resolves
+ **********************************************************************/
+#ifdef CURLRES_ASYNCH
+
+timediff_t Curl_async_timeleft_ms(struct Curl_easy *data,
+                                  struct Curl_resolv_async *async)
+{
+  if(async->timeout_ms) {
+    timediff_t elapsed_ms =
+      curlx_ptimediff_ms(Curl_pgrs_now(data), &async->start);
+    return async->timeout_ms - elapsed_ms;
+  }
+  return Curl_timeleft_ms(data);
+}
+
+#ifdef USE_ARES
+
+#if ARES_VERSION < 0x011000
+#error "requires c-ares 1.16.0 or newer"
+#endif
+
+/*
+ * Curl_ares_pollset() is called when the outside world (using
+ * curl_multi_fdset()) wants to get our fd_set setup and we are talking with
+ * ares. The caller must make sure that this function is only called when we
+ * have a working ares channel.
+ *
+ * Returns: sockets-in-use-bitmap
+ */
+CURLcode Curl_ares_pollset(struct Curl_easy *data,
+                           ares_channel channel,
+                           struct easy_pollset *ps)
+{
+  curl_socket_t sockets[16];  /* ARES documented limit */
+  unsigned int bitmap, i;
+  CURLcode result = CURLE_OK;
+
+  DEBUGASSERT(channel);
+  if(!channel)
+    return CURLE_FAILED_INIT;
+
+  bitmap = ares_getsock(channel, (ares_socket_t *)sockets,
+                        CURL_ARRAYSIZE(sockets));
+  for(i = 0; i < CURL_ARRAYSIZE(sockets); ++i) {
+    int flags = 0;
+    if(ARES_GETSOCK_READABLE(bitmap, i))
+      flags |= CURL_POLL_IN;
+    if(ARES_GETSOCK_WRITABLE(bitmap, i))
+      flags |= CURL_POLL_OUT;
+    if(!flags)
+      break;
+    result = Curl_pollset_change(data, ps, sockets[i], flags, 0);
+    if(result)
+      return result;
+  }
+  return result;
+}
+
+timediff_t Curl_ares_timeout_ms(struct Curl_easy *data,
+                                struct Curl_resolv_async *async,
+                                ares_channel channel)
+{
+  timediff_t async_timeout_ms;
+
+  DEBUGASSERT(channel);
+  if(!channel)
+    return -1;
+
+  async_timeout_ms = Curl_async_timeleft_ms(data, async);
+  if((async_timeout_ms > 0) && (async_timeout_ms < INT_MAX)) {
+    struct timeval timebuf;
+    struct timeval *timeout;
+    struct timeval end = { (int)async_timeout_ms / 1000,
+                           ((int)async_timeout_ms % 1000) * 1000 };
+
+    timeout = ares_timeout(channel, &end, &timebuf);
+    if(timeout)
+      return curlx_tvtoms(timeout);
+  }
+  return async_timeout_ms;
+}
+
+/*
+ * Curl_ares_perform()
+ *
+ * 1) Ask ares what sockets it currently plays with, then
+ * 2) wait for the timeout period to check for action on ares' sockets.
+ * 3) tell ares to act on all the sockets marked as "with action"
+ *
+ * return number of sockets it worked on, or -1 on error
+ */
+int Curl_ares_perform(ares_channel channel, timediff_t timeout_ms)
+{
+  int nfds;
+  int bitmask;
+  ares_socket_t socks[ARES_GETSOCK_MAXNUM];
+  struct pollfd pfd[ARES_GETSOCK_MAXNUM];
+  int i;
+  int num = 0;
+
+  if(!channel)
+    return 0;
+
+  bitmask = ares_getsock(channel, socks, ARES_GETSOCK_MAXNUM);
+
+  for(i = 0; i < ARES_GETSOCK_MAXNUM; i++) {
+    pfd[i].events = 0;
+    pfd[i].revents = 0;
+    if(ARES_GETSOCK_READABLE(bitmask, i)) {
+      pfd[i].fd = socks[i];
+      pfd[i].events |= POLLRDNORM | POLLIN;
+    }
+    if(ARES_GETSOCK_WRITABLE(bitmask, i)) {
+      pfd[i].fd = socks[i];
+      pfd[i].events |= POLLWRNORM | POLLOUT;
+    }
+    if(pfd[i].events)
+      num++;
+    else
+      break;
+  }
+
+  if(num) {
+    nfds = Curl_poll(pfd, (unsigned int)num, timeout_ms);
+    if(nfds < 0)
+      return -1;
+  }
+  else
+    nfds = 0;
+
+  if(!nfds)
+    /* Call ares_process() unconditionally here, even if we timed out
+       above, as otherwise the ares name resolve will not timeout! */
+    ares_process_fd(channel, ARES_SOCKET_BAD, ARES_SOCKET_BAD);
+  else {
+    /* move through the descriptors and ask for processing on them */
+    for(i = 0; i < num; i++)
+      ares_process_fd(channel,
+                      (pfd[i].revents & (POLLRDNORM | POLLIN)) ?
+                      pfd[i].fd : ARES_SOCKET_BAD,
+                      (pfd[i].revents & (POLLWRNORM | POLLOUT)) ?
+                      pfd[i].fd : ARES_SOCKET_BAD);
+  }
+  return nfds;
+}
+
+#endif /* USE_ARES */
+
+#endif /* CURLRES_ASYNCH */
+
+#ifdef USE_CURL_ASYNC
+
+#include "doh.h"
+
+void Curl_async_shutdown(struct Curl_easy *data,
+                         struct Curl_resolv_async *async)
+{
+  if(async) {
+    CURL_TRC_DNS(data, "[%u] shutdown async", async->id);
+    async->shutdown = TRUE;
+#ifdef USE_RESOLV_ARES
+    Curl_async_ares_shutdown(data, async);
+#endif
+#ifdef USE_RESOLV_THREADED
+    Curl_async_thrdd_shutdown(data, async);
+#endif
+#ifndef CURL_DISABLE_DOH
+    Curl_doh_cleanup(data, async);
+#endif
+  }
+}
+
+void Curl_async_destroy(struct Curl_easy *data,
+                        struct Curl_resolv_async *async)
+{
+  if(async) {
+    CURL_TRC_DNS(data, "[%u] destroy async", async->id);
+    async->shutdown = TRUE;
+#ifdef USE_RESOLV_ARES
+    Curl_async_ares_destroy(data, async);
+#endif
+#ifdef USE_RESOLV_THREADED
+    Curl_async_thrdd_destroy(data, async);
+#endif
+#ifndef CURL_DISABLE_DOH
+    Curl_doh_cleanup(data, async);
+#endif
+    curlx_safefree(async);
+  }
+}
+
+CURLcode Curl_async_failed(struct Curl_easy *data,
+                           struct Curl_resolv_async *async,
+                           const char *detail)
+{
+  const char *host_or_proxy = "host";
+  CURLcode result = CURLE_COULDNT_RESOLVE_HOST;
+
+#ifndef CURL_DISABLE_PROXY
+  if(async->for_proxy) {
+    host_or_proxy = "proxy";
+    result = CURLE_COULDNT_RESOLVE_PROXY;
+  }
+#endif
+
+  failf(data, "Could not resolve %s: %s%s%s%s",
+        host_or_proxy, async->hostname,
+        detail ? " (" : "", detail ? detail : "", detail ? ")" : "");
+  return result;
+}
+
+#endif /* USE_CURL_ASYNC */
diff --git a/third-party/curl/lib/asyn-thrdd.c b/third-party/curl/lib/asyn-thrdd.c
new file mode 100644
index 0000000000..aeadec11a4
--- /dev/null
+++ b/third-party/curl/lib/asyn-thrdd.c
@@ -0,0 +1,838 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+/***********************************************************************
+ * Only for threaded name resolves builds
+ **********************************************************************/
+#ifdef USE_RESOLV_THREADED
+
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_NETDB_H
+#include <netdb.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+#ifdef __VMS
+#include <in.h>
+#include <inet.h>
+#endif
+
+#ifdef HAVE_GETADDRINFO
+#define RESOLVER_ENOMEM  EAI_MEMORY  /* = WSA_NOT_ENOUGH_MEMORY on Windows */
+#else
+#define RESOLVER_ENOMEM  SOCKENOMEM
+#endif
+
+#include "urldata.h"
+#include "cfilters.h"
+#include "curl_addrinfo.h"
+#include "curl_trc.h"
+#include "hostip.h"
+#include "httpsrr.h"
+#include "url.h"
+#include "multiif.h"
+#include "curl_threads.h"
+#include "progress.h"
+#include "rand.h"
+#include "select.h"
+#include "thrdqueue.h"
+#include "curlx/strparse.h"
+#include "curlx/wait.h"
+
+#ifdef USE_ARES
+#include <ares.h>
+#ifdef USE_HTTPSRR
+#define USE_HTTPSRR_ARES  /* the combo */
+#endif
+#endif
+
+
+/*
+ * Curl_async_global_init()
+ * Called from curl_global_init() to initialize global resolver environment.
+ * Does nothing here.
+ */
+int Curl_async_global_init(void)
+{
+#if defined(USE_ARES) && defined(CARES_HAVE_ARES_LIBRARY_INIT)
+  if(ares_library_init(ARES_LIB_INIT_ALL)) {
+    return CURLE_FAILED_INIT;
+  }
+#endif
+  return CURLE_OK;
+}
+
+/*
+ * Curl_async_global_cleanup()
+ * Called from curl_global_cleanup() to destroy global resolver environment.
+ * Does nothing here.
+ */
+void Curl_async_global_cleanup(void)
+{
+#if defined(USE_ARES) && defined(CARES_HAVE_ARES_LIBRARY_INIT)
+  ares_library_cleanup();
+#endif
+}
+
+#ifdef CURLVERBOSE
+#define CURL_ASYN_ITEM_DESC_LEN   64
+#define async_item_description(x)   (x)->description
+#else
+#define async_item_description(x)   NULL
+#endif
+
+struct async_thrdd_item {
+  struct Curl_addrinfo *res;
+#ifdef CURLVERBOSE
+  char description[CURL_ASYN_ITEM_DESC_LEN];
+#endif
+  int sockerr;
+  uint32_t mid;
+  uint32_t resolv_id;
+  uint16_t port;
+  uint8_t transport;
+  uint8_t dns_queries;
+#ifdef DEBUGBUILD
+  uint32_t delay_ms;
+  uint32_t delay_fail_ms;
+#endif
+  char hostname[1];
+};
+
+/* Give up reference to add_ctx */
+static void async_thrdd_item_destroy(struct async_thrdd_item *item)
+{
+  if(item) {
+    if(item->res)
+      Curl_freeaddrinfo(item->res);
+    curlx_free(item);
+  }
+}
+
+/* Initialize context for threaded resolver */
+static struct async_thrdd_item *async_thrdd_item_create(
+  struct Curl_easy *data,
+  uint32_t resolv_id, uint8_t dns_queries,
+  const char *hostname, uint16_t port,
+  uint8_t transport)
+{
+  size_t hostlen = strlen(hostname);
+  struct async_thrdd_item *item;
+
+  item = curlx_calloc(1, sizeof(*item) + hostlen);
+  if(!item)
+    return NULL;
+
+  if(hostlen) /* NUL byte of name already in struct size */
+    memcpy(item->hostname, hostname, hostlen);
+  item->mid = data->mid;
+  item->resolv_id = resolv_id;
+  item->dns_queries = dns_queries;
+  item->port = port;
+  item->transport = transport;
+
+#ifdef CURLVERBOSE
+  curl_msnprintf(item->description, sizeof(item->description),
+                 "[%" FMT_OFF_T "/%u] %s %s:%u",
+                 data->id, item->resolv_id,
+                 Curl_resolv_query_str(dns_queries),
+                 item->hostname, item->port);
+#endif
+
+#ifdef DEBUGBUILD
+  {
+    const char *p = getenv("CURL_DBG_RESOLV_DELAY");
+    if(p) {
+      curl_off_t l;
+      if(!curlx_str_number(&p, &l, UINT32_MAX)) {
+        item->delay_ms = (uint32_t)l;
+      }
+    }
+    p = getenv("CURL_DBG_RESOLV_FAIL_DELAY");
+    if(p) {
+      curl_off_t l;
+      if(!curlx_str_number(&p, &l, UINT32_MAX)) {
+        unsigned char c = 0;
+        Curl_rand_bytes(data, FALSE, &c, 1);
+        item->delay_fail_ms = (uint32_t)l + c;
+      }
+    }
+  }
+#endif
+
+  return item;
+}
+
+#ifdef USE_HTTPSRR_ARES
+
+static void async_thrdd_rr_done(void *user_data, ares_status_t status,
+                                size_t timeouts,
+                                const ares_dns_record_t *dnsrec)
+{
+  struct Curl_resolv_async *async = user_data;
+  struct async_thrdd_ctx *thrdd = async ? &async->thrdd : NULL;
+
+  (void)timeouts;
+  if(!thrdd)
+    return;
+
+  async->dns_responses |= CURL_DNSQ_HTTPS;
+  async->queries_ongoing--;
+  async->done = !async->queries_ongoing;
+  if((ARES_SUCCESS == status) && dnsrec)
+    async->result = Curl_httpsrr_from_ares(dnsrec, &thrdd->rr.hinfo);
+}
+
+static CURLcode async_rr_start(struct Curl_easy *data,
+                               struct Curl_resolv_async *async)
+{
+  struct async_thrdd_ctx *thrdd = &async->thrdd;
+  int status;
+  char *rrname = NULL;
+
+  DEBUGASSERT(!thrdd->rr.channel);
+  if(async->port != 443) {
+    rrname = curl_maprintf("_%d_.https.%s", async->port, async->hostname);
+    if(!rrname)
+      return CURLE_OUT_OF_MEMORY;
+  }
+  status = ares_init_options(&thrdd->rr.channel, NULL, 0);
+  if(status != ARES_SUCCESS) {
+    thrdd->rr.channel = NULL;
+    curlx_free(rrname);
+    return CURLE_FAILED_INIT;
+  }
+#ifdef DEBUGBUILD
+  if(getenv("CURL_DNS_SERVER")) {
+    const char *servers = getenv("CURL_DNS_SERVER");
+    status = ares_set_servers_ports_csv(thrdd->rr.channel, servers);
+    if(status) {
+      curlx_free(rrname);
+      return CURLE_FAILED_INIT;
+    }
+  }
+#endif
+
+  memset(&thrdd->rr.hinfo, 0, sizeof(thrdd->rr.hinfo));
+  thrdd->rr.hinfo.rrname = rrname;
+  async->queries_ongoing++;
+  ares_query_dnsrec(thrdd->rr.channel,
+                    rrname ? rrname : async->hostname, ARES_CLASS_IN,
+                    ARES_REC_TYPE_HTTPS,
+                    async_thrdd_rr_done, async, NULL);
+  CURL_TRC_DNS(data, "[HTTPS-RR] initiated request for %s",
+               rrname ? rrname : async->hostname);
+  return CURLE_OK;
+}
+#endif
+
+void Curl_async_thrdd_shutdown(struct Curl_easy *data,
+                               struct Curl_resolv_async *async)
+{
+  Curl_async_thrdd_destroy(data, async);
+}
+
+struct async_thrdd_match_ctx {
+  uint32_t mid;
+  uint32_t resolv_id;
+};
+
+static bool async_thrdd_match_item(void *qitem, void *match_data)
+{
+  const struct async_thrdd_match_ctx *ctx = match_data;
+  struct async_thrdd_item *item = qitem;
+  return (item->mid == ctx->mid) && (item->resolv_id == ctx->resolv_id);
+}
+
+void Curl_async_thrdd_destroy(struct Curl_easy *data,
+                              struct Curl_resolv_async *async)
+{
+  (void)data;
+  if(async->queries_ongoing && !async->done &&
+     data->multi && data->multi->resolv_thrdq) {
+    /* Remove any resolve items still queued */
+    struct async_thrdd_match_ctx mctx;
+    mctx.mid = data->mid;
+    mctx.resolv_id = async->id;
+    Curl_thrdq_clear(data->multi->resolv_thrdq,
+                     async_thrdd_match_item, &mctx);
+  }
+#ifdef USE_HTTPSRR_ARES
+  if(async->thrdd.rr.channel) {
+    ares_destroy(async->thrdd.rr.channel);
+    async->thrdd.rr.channel = NULL;
+  }
+  Curl_httpsrr_cleanup(&async->thrdd.rr.hinfo);
+#endif
+  async_thrdd_item_destroy(async->thrdd.res_A);
+  async->thrdd.res_A = NULL;
+  async_thrdd_item_destroy(async->thrdd.res_AAAA);
+  async->thrdd.res_AAAA = NULL;
+}
+
+/*
+ * Waits for a resolve to finish. This function should be avoided since using
+ * this risk getting the multi interface to "hang".
+ */
+CURLcode Curl_async_await(struct Curl_easy *data, uint32_t resolv_id,
+                          struct Curl_dns_entry **pdns)
+{
+  struct Curl_resolv_async *async = Curl_async_get(data, resolv_id);
+  struct async_thrdd_ctx *thrdd = async ? &async->thrdd : NULL;
+  timediff_t milli, ms;
+
+  if(!thrdd)
+    return CURLE_FAILED_INIT;
+
+  while(async->queries_ongoing && !async->done) {
+    Curl_async_thrdd_multi_process(data->multi);
+    if(async->done)
+      break;
+
+    ms = curlx_ptimediff_ms(Curl_pgrs_now(data), &async->start);
+    if(ms < 3)
+      milli = 0;
+    else if(ms <= 50)
+      milli = ms / 3;
+    else if(ms <= 250)
+      milli = 50;
+    else
+      milli = 200;
+    CURL_TRC_DNS(data, "await, waiting %" FMT_TIMEDIFF_T "ms", milli);
+    curlx_wait_ms(milli);
+  }
+  return Curl_async_take_result(data, async, pdns);
+}
+
+#ifdef HAVE_GETADDRINFO
+
+/* Process the item, using Curl_getaddrinfo_ex() */
+static void async_thrdd_item_process(void *arg)
+{
+  struct async_thrdd_item *item = arg;
+  struct addrinfo hints;
+  char service[12];
+  int pf = PF_INET;
+  int rc;
+
+#ifdef DEBUGBUILD
+  if(item->delay_ms) {
+    curlx_wait_ms(item->delay_ms);
+  }
+  if(item->delay_fail_ms) {
+    curlx_wait_ms(item->delay_fail_ms);
+    return;
+  }
+#endif
+
+  memset(&hints, 0, sizeof(hints));
+#ifdef CURLRES_IPV6
+  if(item->dns_queries & CURL_DNSQ_AAAA) {
+    pf = (item->dns_queries & CURL_DNSQ_A) ? PF_UNSPEC : PF_INET6;
+  }
+#endif
+  hints.ai_family = pf;
+  hints.ai_socktype = Curl_socktype_for_transport(item->transport);
+  hints.ai_protocol = Curl_protocol_for_transport(item->transport);
+#ifdef __APPLE__
+  /* If we leave `ai_flags == 0` then macOS is looking for IPV4MAPPED
+   * when doing AAAA queries. We do not want this "help". */
+  hints.ai_flags = AI_ADDRCONFIG;
+#endif
+
+  curl_msnprintf(service, sizeof(service), "%u", item->port);
+#ifdef AI_NUMERICSERV
+  hints.ai_flags |= AI_NUMERICSERV;
+#endif
+
+  rc = Curl_getaddrinfo_ex(item->hostname, service, &hints, &item->res);
+  if(rc) {
+    item->sockerr = SOCKERRNO ? SOCKERRNO : rc;
+    if(item->sockerr == 0)
+      item->sockerr = RESOLVER_ENOMEM;
+  }
+  else {
+    Curl_addrinfo_set_port(item->res, item->port);
+  }
+}
+
+#else /* HAVE_GETADDRINFO */
+
+/* Process the item, using Curl_ipv4_resolve_r() */
+static void async_thrdd_item_process(void *arg)
+{
+  struct async_thrdd_item *item = arg;
+
+#ifdef DEBUGBUILD
+  if(item->delay_ms) {
+    curlx_wait_ms(item->delay_ms);
+  }
+  if(item->delay_fail_ms) {
+    curlx_wait_ms(item->delay_fail_ms);
+    return;
+  }
+#endif
+  item->res = Curl_ipv4_resolve_r(item->hostname, item->port);
+  if(!item->res) {
+    item->sockerr = SOCKERRNO;
+    if(item->sockerr == 0)
+      item->sockerr = RESOLVER_ENOMEM;
+  }
+}
+
+#endif /* HAVE_GETADDRINFO */
+
+#ifdef ENABLE_WAKEUP
+static void async_thrdd_event(const struct curl_thrdq *tqueue,
+                              Curl_thrdq_event ev,
+                              void *user_data)
+{
+  struct Curl_multi *multi = user_data;
+  (void)tqueue;
+  switch(ev) {
+  case CURL_THRDQ_EV_ITEM_DONE:
+    (void)curl_multi_wakeup(multi);
+    break;
+  default:
+    break;
+  }
+}
+#else
+#define async_thrdd_event   NULL
+#endif
+
+static void async_thrdd_item_free(void *item)
+{
+  async_thrdd_item_destroy(item);
+}
+
+/* Create a thread queue for processing resolv items */
+CURLcode Curl_async_thrdd_multi_init(struct Curl_multi *multi,
+                                     uint32_t min_threads,
+                                     uint32_t max_threads,
+                                     uint32_t idle_time_ms)
+{
+  CURLcode result;
+  DEBUGASSERT(!multi->resolv_thrdq);
+  result = Curl_thrdq_create(&multi->resolv_thrdq, "DNS", 0,
+                             min_threads, max_threads, idle_time_ms,
+                             async_thrdd_item_free,
+                             async_thrdd_item_process,
+                             async_thrdd_event,
+                             multi);
+#ifdef DEBUGBUILD
+  if(!result) {
+    const char *p = getenv("CURL_DBG_RESOLV_MAX_THREADS");
+    if(p) {
+      curl_off_t l;
+      if(!curlx_str_number(&p, &l, UINT32_MAX)) {
+        result = Curl_async_thrdd_multi_set_props(
+          multi, min_threads, (uint32_t)l, idle_time_ms);
+      }
+    }
+  }
+#endif
+  return result;
+}
+
+/* Tear down the thread queue, joining active threads or detaching them */
+void Curl_async_thrdd_multi_destroy(struct Curl_multi *multi, bool join)
+{
+  if(multi->resolv_thrdq) {
+#ifdef CURLVERBOSE
+    CURL_TRC_DNS(multi->admin, "destroy thread queue+pool, join=%d", join);
+    Curl_thrdq_trace(multi->resolv_thrdq, multi->admin);
+#endif
+    Curl_thrdq_destroy(multi->resolv_thrdq, join);
+    multi->resolv_thrdq = NULL;
+  }
+}
+
+#ifdef CURLVERBOSE
+static void async_thrdd_report_item(struct Curl_easy *data,
+                                    struct async_thrdd_item *item)
+{
+  char buf[MAX_IPADR_LEN];
+  struct dynbuf tmp;
+  const char *sep = "";
+  const struct Curl_addrinfo *ai = item->res;
+  CURLcode result;
+  int ai_family;
+#ifdef USE_IPV6
+  ai_family = (item->dns_queries & CURL_DNSQ_AAAA) ? AF_INET6 : AF_INET;
+#else
+  ai_family = AF_INET;
+#endif
+
+  if(!CURL_TRC_DNS_is_verbose(data))
+    return;
+
+  curlx_dyn_init(&tmp, 1024);
+  for(; ai; ai = ai->ai_next) {
+    if(ai->ai_family == ai_family) {
+      Curl_printable_address(ai, buf, sizeof(buf));
+      result = curlx_dyn_addf(&tmp, "%s%s", sep, buf);
+      if(result) {
+        CURL_TRC_DNS(data, "too many IP, cannot show");
+        goto out;
+      }
+      sep = ", ";
+    }
+  }
+
+  CURL_TRC_DNS(data, "Host %s:%u resolved IPv%c: %s",
+               item->hostname, item->port,
+               (item->dns_queries & CURL_DNSQ_AAAA) ? '6' : '4',
+               (curlx_dyn_len(&tmp) ? curlx_dyn_ptr(&tmp) : "(none)"));
+out:
+  curlx_dyn_free(&tmp);
+}
+#endif /* CURLVERBOSE */
+
+/* Process the receiving end of the thread queue, dispatching
+ * processed items to their transfer when it can still be found
+ * and has an `async` state present. Otherwise, destroy the item. */
+void Curl_async_thrdd_multi_process(struct Curl_multi *multi)
+{
+  struct Curl_easy *data;
+  void *qitem;
+
+  while(!Curl_thrdq_recv(multi->resolv_thrdq, &qitem)) {
+    /* dispatch resolve result */
+    struct async_thrdd_item *item = qitem;
+    struct Curl_resolv_async *async = NULL;
+
+    data = Curl_multi_get_easy(multi, item->mid);
+    if(data)
+      async = Curl_async_get(data, item->resolv_id);
+    if(async) {
+      struct async_thrdd_item **pdest = &async->thrdd.res_A;
+
+      async->dns_responses |= item->dns_queries;
+      --async->queries_ongoing;
+      async->done = !async->queries_ongoing;
+
+#ifdef CURLRES_IPV6
+      if(item->dns_queries & CURL_DNSQ_AAAA)
+        pdest = &async->thrdd.res_AAAA;
+#endif
+      if(!*pdest) {
+        VERBOSE(async_thrdd_report_item(data, item));
+        *pdest = item;
+        item = NULL;
+      }
+      else
+        DEBUGASSERT(0); /* should not receive duplicates here */
+      Curl_multi_mark_dirty(data);
+    }
+    async_thrdd_item_free(item);
+  }
+#ifdef CURLVERBOSE
+  Curl_thrdq_trace(multi->resolv_thrdq, multi->admin);
+#endif
+}
+
+CURLcode Curl_async_thrdd_multi_set_props(struct Curl_multi *multi,
+                                          uint32_t min_threads,
+                                          uint32_t max_threads,
+                                          uint32_t idle_time_ms)
+{
+  return Curl_thrdq_set_props(multi->resolv_thrdq, 0,
+                              min_threads, max_threads, idle_time_ms);
+}
+
+static CURLcode async_thrdd_query(struct Curl_easy *data,
+                                  struct Curl_resolv_async *async,
+                                  uint8_t dns_queries)
+{
+  struct async_thrdd_item *item;
+  CURLcode result;
+
+  item = async_thrdd_item_create(data, async->id, dns_queries,
+                                 async->hostname, async->port,
+                                 async->transport);
+  if(!item) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+  CURL_TRC_DNS(data, "queueing query %s", item->description);
+  result = Curl_thrdq_send(data->multi->resolv_thrdq, item,
+                           async_item_description(item), async->timeout_ms);
+  if(result)
+    goto out;
+  item = NULL;
+  async->queries_ongoing++;
+
+out:
+  if(item)
+    async_thrdd_item_free(item);
+  return result;
+}
+
+CURLcode Curl_async_getaddrinfo(struct Curl_easy *data,
+                                struct Curl_resolv_async *async)
+{
+  CURLcode result = CURLE_FAILED_INIT;
+  void *resolver = NULL;
+
+  if(async->queries_ongoing || async->done)
+    return CURLE_FAILED_INIT;
+
+#ifdef USE_HTTPSRR_ARES
+  DEBUGASSERT(!async->thrdd.rr.channel);
+  if((async->dns_queries & CURL_DNSQ_HTTPS) && !async->is_ipaddr) {
+    result = async_rr_start(data, async);
+    if(result)
+      goto out;
+    resolver = async->thrdd.rr.channel;
+  }
+#endif
+
+  result = Curl_resolv_announce_start(data, resolver);
+  if(result)
+    return result;
+
+#ifdef CURLRES_IPV6
+  /* Do not start an AAAA query for an ipv4 address when
+   * we will start an A query for it. */
+  if((async->dns_queries & CURL_DNSQ_AAAA) &&
+     !(async->is_ipv4addr && (async->dns_queries & CURL_DNSQ_A))) {
+    result = async_thrdd_query(data, async, CURL_DNSQ_AAAA);
+    if(result)
+      goto out;
+  }
+#endif
+  if(async->dns_queries & CURL_DNSQ_A) {
+    result = async_thrdd_query(data, async, CURL_DNSQ_A);
+    if(result)
+      goto out;
+  }
+
+#ifdef CURLVERBOSE
+  Curl_thrdq_trace(data->multi->resolv_thrdq, data);
+#endif
+
+out:
+  if(result)
+    CURL_TRC_DNS(data, "error queueing query %s:%d -> %d",
+                 async->hostname, async->port, (int)result);
+  return result;
+}
+
+CURLcode Curl_async_pollset(struct Curl_easy *data,
+                            struct Curl_resolv_async *async,
+                            struct easy_pollset *ps)
+{
+  timediff_t timeout_ms;
+
+  timeout_ms = Curl_async_timeleft_ms(data, async);
+#ifdef USE_HTTPSRR_ARES
+  if(async->thrdd.rr.channel) {
+    CURLcode result = Curl_ares_pollset(data, async->thrdd.rr.channel, ps);
+    if(result)
+      return result;
+    timeout_ms = Curl_ares_timeout_ms(data, async, async->thrdd.rr.channel);
+  }
+#else
+  (void)ps;
+#endif
+
+  if(!async->done) {
+#ifndef ENABLE_WAKEUP
+    timediff_t stutter_ms, elapsed_ms;
+    elapsed_ms = curlx_ptimediff_ms(Curl_pgrs_now(data), &async->start);
+    if(elapsed_ms < 3)
+      stutter_ms = 1;
+    else if(elapsed_ms <= 50)
+      stutter_ms = elapsed_ms / 3;
+    else if(elapsed_ms <= 250)
+      stutter_ms = 50;
+    else
+      stutter_ms = 200;
+    timeout_ms = CURLMIN(stutter_ms, timeout_ms);
+#endif
+    Curl_expire(data, timeout_ms, EXPIRE_ASYNC_NAME);
+  }
+  return CURLE_OK;
+}
+
+/*
+ * Curl_async_take_result() is called repeatedly to check if a previous
+ * name resolve request has completed. It should also make sure to time-out if
+ * the operation seems to take too long.
+ */
+CURLcode Curl_async_take_result(struct Curl_easy *data,
+                                struct Curl_resolv_async *async,
+                                struct Curl_dns_entry **pdns)
+{
+  struct async_thrdd_ctx *thrdd = &async->thrdd;
+  struct Curl_dns_entry *dns = NULL;
+  CURLcode result = CURLE_OK;
+
+  DEBUGASSERT(pdns);
+  *pdns = NULL;
+  if(!async->queries_ongoing && !async->done) {
+    DEBUGASSERT(0);
+    return CURLE_FAILED_INIT;
+  }
+
+#ifdef USE_HTTPSRR_ARES
+  /* best effort, ignore errors */
+  if(thrdd->rr.channel)
+    (void)Curl_ares_perform(thrdd->rr.channel, 0);
+#endif
+#ifndef ENABLE_WAKEUP
+  Curl_async_thrdd_multi_process(data->multi);
+#endif
+
+  if(!async->done)
+    return CURLE_AGAIN;
+
+  Curl_expire_done(data, EXPIRE_ASYNC_NAME);
+  if(async->result) {
+    result = async->result;
+    goto out;
+  }
+
+  if((thrdd->res_A && thrdd->res_A->res) ||
+     (thrdd->res_AAAA && thrdd->res_AAAA->res)) {
+    dns = Curl_dnscache_mk_entry2(
+      data, async->dns_queries,
+      thrdd->res_A ? &thrdd->res_A->res : NULL,
+      thrdd->res_AAAA ? &thrdd->res_AAAA->res : NULL,
+      async->hostname, async->port);
+    if(!dns) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+
+#ifdef USE_HTTPSRR_ARES
+    if(thrdd->rr.channel) {
+      struct Curl_https_rrinfo *lhrr = NULL;
+      if(thrdd->rr.hinfo.complete) {
+        lhrr = Curl_httpsrr_dup_move(&thrdd->rr.hinfo);
+        if(!lhrr) {
+          result = CURLE_OUT_OF_MEMORY;
+          goto out;
+        }
+      }
+      Curl_httpsrr_trace(data, lhrr);
+      Curl_dns_entry_set_https_rr(dns, lhrr);
+    }
+#endif
+  }
+
+  if(dns) {
+    *pdns = dns;
+    dns = NULL;
+  }
+#ifdef CURLVERBOSE
+  Curl_thrdq_trace(data->multi->resolv_thrdq, data);
+#endif
+
+out:
+  Curl_dns_entry_unlink(data, &dns);
+  Curl_async_thrdd_shutdown(data, async);
+  if(!result && !*pdns)
+    result = Curl_async_failed(data, async, NULL);
+  if(result &&
+     (result != CURLE_COULDNT_RESOLVE_HOST) &&
+     (result != CURLE_COULDNT_RESOLVE_PROXY)) {
+    CURL_TRC_DNS(data, "Error %d resolving %s:%d",
+                 (int)result, async->hostname, async->port);
+  }
+  return result;
+}
+
+static const struct Curl_addrinfo *async_thrdd_get_ai(
+  const struct Curl_addrinfo *ai,
+  int ai_family, unsigned int index)
+{
+  unsigned int i = 0;
+  for(i = 0; ai; ai = ai->ai_next) {
+    if(ai->ai_family == ai_family) {
+      if(i == index)
+        return ai;
+      ++i;
+    }
+  }
+  return NULL;
+}
+
+const struct Curl_addrinfo *Curl_async_get_ai(struct Curl_easy *data,
+                                              struct Curl_resolv_async *async,
+                                              int ai_family,
+                                              unsigned int index)
+{
+  struct async_thrdd_ctx *thrdd = &async->thrdd;
+
+  (void)data;
+  switch(ai_family) {
+  case AF_INET:
+    if(thrdd->res_A)
+      return async_thrdd_get_ai(thrdd->res_A->res, ai_family, index);
+    break;
+#ifdef USE_IPV6
+  case AF_INET6:
+    if(thrdd->res_AAAA)
+      return async_thrdd_get_ai(thrdd->res_AAAA->res, ai_family, index);
+    break;
+#endif
+  default:
+    break;
+  }
+  return NULL;
+}
+
+#ifdef USE_HTTPSRR
+const struct Curl_https_rrinfo *Curl_async_get_https(
+  struct Curl_easy *data,
+  struct Curl_resolv_async *async)
+{
+#ifdef USE_HTTPSRR_ARES
+  if(Curl_async_knows_https(data, async))
+    return &async->thrdd.rr.hinfo;
+#else
+  (void)data;
+  (void)async;
+#endif
+  return NULL;
+}
+
+bool Curl_async_knows_https(struct Curl_easy *data,
+                            struct Curl_resolv_async *async)
+{
+  (void)data;
+  if(async->dns_queries & CURL_DNSQ_HTTPS)
+    return ((async->dns_responses & CURL_DNSQ_HTTPS) || async->done);
+  return TRUE; /* we know it will never come */
+}
+
+#endif /* USE_HTTPSRR */
+
+#endif /* USE_RESOLV_THREADED */
diff --git a/third-party/curl/lib/asyn-thread.c b/third-party/curl/lib/asyn-thread.c
deleted file mode 100644
index a2e294f8f5..0000000000
--- a/third-party/curl/lib/asyn-thread.c
+++ /dev/null
@@ -1,760 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-#include "socketpair.h"
-
-/***********************************************************************
- * Only for threaded name resolves builds
- **********************************************************************/
-#ifdef CURLRES_THREADED
-
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-#ifdef __VMS
-#include <in.h>
-#include <inet.h>
-#endif
-
-#if defined(USE_THREADS_POSIX) && defined(HAVE_PTHREAD_H)
-#  include <pthread.h>
-#endif
-
-#ifdef HAVE_GETADDRINFO
-#  define RESOLVER_ENOMEM  EAI_MEMORY
-#else
-#  define RESOLVER_ENOMEM  ENOMEM
-#endif
-
-#include "urldata.h"
-#include "sendf.h"
-#include "hostip.h"
-#include "hash.h"
-#include "share.h"
-#include "url.h"
-#include "multiif.h"
-#include "inet_ntop.h"
-#include "curl_threads.h"
-#include "connect.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-struct resdata {
-  struct curltime start;
-};
-
-/*
- * Curl_resolver_global_init()
- * Called from curl_global_init() to initialize global resolver environment.
- * Does nothing here.
- */
-int Curl_resolver_global_init(void)
-{
-  return CURLE_OK;
-}
-
-/*
- * Curl_resolver_global_cleanup()
- * Called from curl_global_cleanup() to destroy global resolver environment.
- * Does nothing here.
- */
-void Curl_resolver_global_cleanup(void)
-{
-}
-
-/*
- * Curl_resolver_init()
- * Called from curl_easy_init() -> Curl_open() to initialize resolver
- * URL-state specific environment ('resolver' member of the UrlState
- * structure).
- */
-CURLcode Curl_resolver_init(struct Curl_easy *easy, void **resolver)
-{
-  (void)easy;
-  *resolver = calloc(1, sizeof(struct resdata));
-  if(!*resolver)
-    return CURLE_OUT_OF_MEMORY;
-  return CURLE_OK;
-}
-
-/*
- * Curl_resolver_cleanup()
- * Called from curl_easy_cleanup() -> Curl_close() to cleanup resolver
- * URL-state specific environment ('resolver' member of the UrlState
- * structure).
- */
-void Curl_resolver_cleanup(void *resolver)
-{
-  free(resolver);
-}
-
-/*
- * Curl_resolver_duphandle()
- * Called from curl_easy_duphandle() to duplicate resolver URL state-specific
- * environment ('resolver' member of the UrlState structure).
- */
-CURLcode Curl_resolver_duphandle(struct Curl_easy *easy, void **to, void *from)
-{
-  (void)from;
-  return Curl_resolver_init(easy, to);
-}
-
-static void destroy_async_data(struct Curl_async *);
-
-/*
- * Cancel all possibly still on-going resolves for this connection.
- */
-void Curl_resolver_cancel(struct Curl_easy *data)
-{
-  destroy_async_data(&data->state.async);
-}
-
-/* This function is used to init a threaded resolve */
-static bool init_resolve_thread(struct Curl_easy *data,
-                                const char *hostname, int port,
-                                const struct addrinfo *hints);
-
-
-/* Data for synchronization between resolver thread and its parent */
-struct thread_sync_data {
-  curl_mutex_t *mtx;
-  int done;
-  int port;
-  char *hostname;        /* hostname to resolve, Curl_async.hostname
-                            duplicate */
-#ifndef CURL_DISABLE_SOCKETPAIR
-  struct Curl_easy *data;
-  curl_socket_t sock_pair[2]; /* socket pair */
-#endif
-  int sock_error;
-  struct Curl_addrinfo *res;
-#ifdef HAVE_GETADDRINFO
-  struct addrinfo hints;
-#endif
-  struct thread_data *td; /* for thread-self cleanup */
-};
-
-struct thread_data {
-  curl_thread_t thread_hnd;
-  unsigned int poll_interval;
-  timediff_t interval_end;
-  struct thread_sync_data tsd;
-};
-
-static struct thread_sync_data *conn_thread_sync_data(struct Curl_easy *data)
-{
-  return &(data->state.async.tdata->tsd);
-}
-
-/* Destroy resolver thread synchronization data */
-static
-void destroy_thread_sync_data(struct thread_sync_data *tsd)
-{
-  if(tsd->mtx) {
-    Curl_mutex_destroy(tsd->mtx);
-    free(tsd->mtx);
-  }
-
-  free(tsd->hostname);
-
-  if(tsd->res)
-    Curl_freeaddrinfo(tsd->res);
-
-#ifndef CURL_DISABLE_SOCKETPAIR
-  /*
-   * close one end of the socket pair (may be done in resolver thread);
-   * the other end (for reading) is always closed in the parent thread.
-   */
-  if(tsd->sock_pair[1] != CURL_SOCKET_BAD) {
-    sclose(tsd->sock_pair[1]);
-  }
-#endif
-  memset(tsd, 0, sizeof(*tsd));
-}
-
-/* Initialize resolver thread synchronization data */
-static
-int init_thread_sync_data(struct thread_data *td,
-                           const char *hostname,
-                           int port,
-                           const struct addrinfo *hints)
-{
-  struct thread_sync_data *tsd = &td->tsd;
-
-  memset(tsd, 0, sizeof(*tsd));
-
-  tsd->td = td;
-  tsd->port = port;
-  /* Treat the request as done until the thread actually starts so any early
-   * cleanup gets done properly.
-   */
-  tsd->done = 1;
-#ifdef HAVE_GETADDRINFO
-  DEBUGASSERT(hints);
-  tsd->hints = *hints;
-#else
-  (void) hints;
-#endif
-
-  tsd->mtx = malloc(sizeof(curl_mutex_t));
-  if(!tsd->mtx)
-    goto err_exit;
-
-  Curl_mutex_init(tsd->mtx);
-
-#ifndef CURL_DISABLE_SOCKETPAIR
-  /* create socket pair, avoid AF_LOCAL since it doesn't build on Solaris */
-  if(Curl_socketpair(AF_UNIX, SOCK_STREAM, 0, &tsd->sock_pair[0]) < 0) {
-    tsd->sock_pair[0] = CURL_SOCKET_BAD;
-    tsd->sock_pair[1] = CURL_SOCKET_BAD;
-    goto err_exit;
-  }
-#endif
-  tsd->sock_error = CURL_ASYNC_SUCCESS;
-
-  /* Copying hostname string because original can be destroyed by parent
-   * thread during gethostbyname execution.
-   */
-  tsd->hostname = strdup(hostname);
-  if(!tsd->hostname)
-    goto err_exit;
-
-  return 1;
-
-err_exit:
-#ifndef CURL_DISABLE_SOCKETPAIR
-  if(tsd->sock_pair[0] != CURL_SOCKET_BAD) {
-    sclose(tsd->sock_pair[0]);
-    tsd->sock_pair[0] = CURL_SOCKET_BAD;
-  }
-#endif
-  destroy_thread_sync_data(tsd);
-  return 0;
-}
-
-static CURLcode getaddrinfo_complete(struct Curl_easy *data)
-{
-  struct thread_sync_data *tsd = conn_thread_sync_data(data);
-  CURLcode result;
-
-  result = Curl_addrinfo_callback(data, tsd->sock_error, tsd->res);
-  /* The tsd->res structure has been copied to async.dns and perhaps the DNS
-     cache.  Set our copy to NULL so destroy_thread_sync_data doesn't free it.
-  */
-  tsd->res = NULL;
-
-  return result;
-}
-
-
-#ifdef HAVE_GETADDRINFO
-
-/*
- * getaddrinfo_thread() resolves a name and then exits.
- *
- * For builds without ARES, but with ENABLE_IPV6, create a resolver thread
- * and wait on it.
- */
-static unsigned int CURL_STDCALL getaddrinfo_thread(void *arg)
-{
-  struct thread_sync_data *tsd = (struct thread_sync_data *)arg;
-  struct thread_data *td = tsd->td;
-  char service[12];
-  int rc;
-#ifndef CURL_DISABLE_SOCKETPAIR
-  char buf[1];
-#endif
-
-  msnprintf(service, sizeof(service), "%d", tsd->port);
-
-  rc = Curl_getaddrinfo_ex(tsd->hostname, service, &tsd->hints, &tsd->res);
-
-  if(rc) {
-    tsd->sock_error = SOCKERRNO?SOCKERRNO:rc;
-    if(tsd->sock_error == 0)
-      tsd->sock_error = RESOLVER_ENOMEM;
-  }
-  else {
-    Curl_addrinfo_set_port(tsd->res, tsd->port);
-  }
-
-  Curl_mutex_acquire(tsd->mtx);
-  if(tsd->done) {
-    /* too late, gotta clean up the mess */
-    Curl_mutex_release(tsd->mtx);
-    destroy_thread_sync_data(tsd);
-    free(td);
-  }
-  else {
-#ifndef CURL_DISABLE_SOCKETPAIR
-    if(tsd->sock_pair[1] != CURL_SOCKET_BAD) {
-      /* DNS has been resolved, signal client task */
-      buf[0] = 1;
-      if(swrite(tsd->sock_pair[1],  buf, sizeof(buf)) < 0) {
-        /* update sock_erro to errno */
-        tsd->sock_error = SOCKERRNO;
-      }
-    }
-#endif
-    tsd->done = 1;
-    Curl_mutex_release(tsd->mtx);
-  }
-
-  return 0;
-}
-
-#else /* HAVE_GETADDRINFO */
-
-/*
- * gethostbyname_thread() resolves a name and then exits.
- */
-static unsigned int CURL_STDCALL gethostbyname_thread(void *arg)
-{
-  struct thread_sync_data *tsd = (struct thread_sync_data *)arg;
-  struct thread_data *td = tsd->td;
-
-  tsd->res = Curl_ipv4_resolve_r(tsd->hostname, tsd->port);
-
-  if(!tsd->res) {
-    tsd->sock_error = SOCKERRNO;
-    if(tsd->sock_error == 0)
-      tsd->sock_error = RESOLVER_ENOMEM;
-  }
-
-  Curl_mutex_acquire(tsd->mtx);
-  if(tsd->done) {
-    /* too late, gotta clean up the mess */
-    Curl_mutex_release(tsd->mtx);
-    destroy_thread_sync_data(tsd);
-    free(td);
-  }
-  else {
-    tsd->done = 1;
-    Curl_mutex_release(tsd->mtx);
-  }
-
-  return 0;
-}
-
-#endif /* HAVE_GETADDRINFO */
-
-/*
- * destroy_async_data() cleans up async resolver data and thread handle.
- */
-static void destroy_async_data(struct Curl_async *async)
-{
-  if(async->tdata) {
-    struct thread_data *td = async->tdata;
-    int done;
-#ifndef CURL_DISABLE_SOCKETPAIR
-    curl_socket_t sock_rd = td->tsd.sock_pair[0];
-    struct Curl_easy *data = td->tsd.data;
-#endif
-
-    /*
-     * if the thread is still blocking in the resolve syscall, detach it and
-     * let the thread do the cleanup...
-     */
-    Curl_mutex_acquire(td->tsd.mtx);
-    done = td->tsd.done;
-    td->tsd.done = 1;
-    Curl_mutex_release(td->tsd.mtx);
-
-    if(!done) {
-      Curl_thread_destroy(td->thread_hnd);
-    }
-    else {
-      if(td->thread_hnd != curl_thread_t_null)
-        Curl_thread_join(&td->thread_hnd);
-
-      destroy_thread_sync_data(&td->tsd);
-
-      free(async->tdata);
-    }
-#ifndef CURL_DISABLE_SOCKETPAIR
-    /*
-     * ensure CURLMOPT_SOCKETFUNCTION fires CURL_POLL_REMOVE
-     * before the FD is invalidated to avoid EBADF on EPOLL_CTL_DEL
-     */
-    Curl_multi_closed(data, sock_rd);
-    sclose(sock_rd);
-#endif
-  }
-  async->tdata = NULL;
-
-  free(async->hostname);
-  async->hostname = NULL;
-}
-
-/*
- * init_resolve_thread() starts a new thread that performs the actual
- * resolve. This function returns before the resolve is done.
- *
- * Returns FALSE in case of failure, otherwise TRUE.
- */
-static bool init_resolve_thread(struct Curl_easy *data,
-                                const char *hostname, int port,
-                                const struct addrinfo *hints)
-{
-  struct thread_data *td = calloc(1, sizeof(struct thread_data));
-  int err = ENOMEM;
-  struct Curl_async *asp = &data->state.async;
-
-  data->state.async.tdata = td;
-  if(!td)
-    goto errno_exit;
-
-  asp->port = port;
-  asp->done = FALSE;
-  asp->status = 0;
-  asp->dns = NULL;
-  td->thread_hnd = curl_thread_t_null;
-
-  if(!init_thread_sync_data(td, hostname, port, hints)) {
-    asp->tdata = NULL;
-    free(td);
-    goto errno_exit;
-  }
-
-  free(asp->hostname);
-  asp->hostname = strdup(hostname);
-  if(!asp->hostname)
-    goto err_exit;
-
-  /* The thread will set this to 1 when complete. */
-  td->tsd.done = 0;
-
-#ifdef HAVE_GETADDRINFO
-  td->thread_hnd = Curl_thread_create(getaddrinfo_thread, &td->tsd);
-#else
-  td->thread_hnd = Curl_thread_create(gethostbyname_thread, &td->tsd);
-#endif
-
-  if(!td->thread_hnd) {
-    /* The thread never started, so mark it as done here for proper cleanup. */
-    td->tsd.done = 1;
-    err = errno;
-    goto err_exit;
-  }
-
-  return TRUE;
-
-err_exit:
-  destroy_async_data(asp);
-
-errno_exit:
-  errno = err;
-  return FALSE;
-}
-
-/*
- * 'entry' may be NULL and then no data is returned
- */
-static CURLcode thread_wait_resolv(struct Curl_easy *data,
-                                   struct Curl_dns_entry **entry,
-                                   bool report)
-{
-  struct thread_data *td;
-  CURLcode result = CURLE_OK;
-
-  DEBUGASSERT(data);
-  td = data->state.async.tdata;
-  DEBUGASSERT(td);
-  DEBUGASSERT(td->thread_hnd != curl_thread_t_null);
-
-  /* wait for the thread to resolve the name */
-  if(Curl_thread_join(&td->thread_hnd)) {
-    if(entry)
-      result = getaddrinfo_complete(data);
-  }
-  else
-    DEBUGASSERT(0);
-
-  data->state.async.done = TRUE;
-
-  if(entry)
-    *entry = data->state.async.dns;
-
-  if(!data->state.async.dns && report)
-    /* a name was not resolved, report error */
-    result = Curl_resolver_error(data);
-
-  destroy_async_data(&data->state.async);
-
-  if(!data->state.async.dns && report)
-    connclose(data->conn, "asynch resolve failed");
-
-  return result;
-}
-
-
-/*
- * Until we gain a way to signal the resolver threads to stop early, we must
- * simply wait for them and ignore their results.
- */
-void Curl_resolver_kill(struct Curl_easy *data)
-{
-  struct thread_data *td = data->state.async.tdata;
-
-  /* If we're still resolving, we must wait for the threads to fully clean up,
-     unfortunately.  Otherwise, we can simply cancel to clean up any resolver
-     data. */
-  if(td && td->thread_hnd != curl_thread_t_null
-     && (data->set.quick_exit != 1L))
-    (void)thread_wait_resolv(data, NULL, FALSE);
-  else
-    Curl_resolver_cancel(data);
-}
-
-/*
- * Curl_resolver_wait_resolv()
- *
- * Waits for a resolve to finish. This function should be avoided since using
- * this risk getting the multi interface to "hang".
- *
- * If 'entry' is non-NULL, make it point to the resolved dns entry
- *
- * Returns CURLE_COULDNT_RESOLVE_HOST if the host was not resolved,
- * CURLE_OPERATION_TIMEDOUT if a time-out occurred, or other errors.
- *
- * This is the version for resolves-in-a-thread.
- */
-CURLcode Curl_resolver_wait_resolv(struct Curl_easy *data,
-                                   struct Curl_dns_entry **entry)
-{
-  return thread_wait_resolv(data, entry, TRUE);
-}
-
-/*
- * Curl_resolver_is_resolved() is called repeatedly to check if a previous
- * name resolve request has completed. It should also make sure to time-out if
- * the operation seems to take too long.
- */
-CURLcode Curl_resolver_is_resolved(struct Curl_easy *data,
-                                   struct Curl_dns_entry **entry)
-{
-  struct thread_data *td = data->state.async.tdata;
-  int done = 0;
-
-  DEBUGASSERT(entry);
-  *entry = NULL;
-
-  if(!td) {
-    DEBUGASSERT(td);
-    return CURLE_COULDNT_RESOLVE_HOST;
-  }
-
-  Curl_mutex_acquire(td->tsd.mtx);
-  done = td->tsd.done;
-  Curl_mutex_release(td->tsd.mtx);
-
-  if(done) {
-    getaddrinfo_complete(data);
-
-    if(!data->state.async.dns) {
-      CURLcode result = Curl_resolver_error(data);
-      destroy_async_data(&data->state.async);
-      return result;
-    }
-    destroy_async_data(&data->state.async);
-    *entry = data->state.async.dns;
-  }
-  else {
-    /* poll for name lookup done with exponential backoff up to 250ms */
-    /* should be fine even if this converts to 32 bit */
-    timediff_t elapsed = Curl_timediff(Curl_now(),
-                                       data->progress.t_startsingle);
-    if(elapsed < 0)
-      elapsed = 0;
-
-    if(td->poll_interval == 0)
-      /* Start at 1ms poll interval */
-      td->poll_interval = 1;
-    else if(elapsed >= td->interval_end)
-      /* Back-off exponentially if last interval expired  */
-      td->poll_interval *= 2;
-
-    if(td->poll_interval > 250)
-      td->poll_interval = 250;
-
-    td->interval_end = elapsed + td->poll_interval;
-    Curl_expire(data, td->poll_interval, EXPIRE_ASYNC_NAME);
-  }
-
-  return CURLE_OK;
-}
-
-int Curl_resolver_getsock(struct Curl_easy *data, curl_socket_t *socks)
-{
-  int ret_val = 0;
-  timediff_t milli;
-  timediff_t ms;
-  struct resdata *reslv = (struct resdata *)data->state.async.resolver;
-#ifndef CURL_DISABLE_SOCKETPAIR
-  struct thread_data *td = data->state.async.tdata;
-#else
-  (void)socks;
-#endif
-
-#ifndef CURL_DISABLE_SOCKETPAIR
-  if(td) {
-    /* return read fd to client for polling the DNS resolution status */
-    socks[0] = td->tsd.sock_pair[0];
-    td->tsd.data = data;
-    ret_val = GETSOCK_READSOCK(0);
-  }
-  else {
-#endif
-    ms = Curl_timediff(Curl_now(), reslv->start);
-    if(ms < 3)
-      milli = 0;
-    else if(ms <= 50)
-      milli = ms/3;
-    else if(ms <= 250)
-      milli = 50;
-    else
-      milli = 200;
-    Curl_expire(data, milli, EXPIRE_ASYNC_NAME);
-#ifndef CURL_DISABLE_SOCKETPAIR
-  }
-#endif
-
-
-  return ret_val;
-}
-
-#ifndef HAVE_GETADDRINFO
-/*
- * Curl_getaddrinfo() - for platforms without getaddrinfo
- */
-struct Curl_addrinfo *Curl_resolver_getaddrinfo(struct Curl_easy *data,
-                                                const char *hostname,
-                                                int port,
-                                                int *waitp)
-{
-  struct resdata *reslv = (struct resdata *)data->state.async.resolver;
-
-  *waitp = 0; /* default to synchronous response */
-
-  reslv->start = Curl_now();
-
-  /* fire up a new resolver thread! */
-  if(init_resolve_thread(data, hostname, port, NULL)) {
-    *waitp = 1; /* expect asynchronous response */
-    return NULL;
-  }
-
-  failf(data, "getaddrinfo() thread failed");
-
-  return NULL;
-}
-
-#else /* !HAVE_GETADDRINFO */
-
-/*
- * Curl_resolver_getaddrinfo() - for getaddrinfo
- */
-struct Curl_addrinfo *Curl_resolver_getaddrinfo(struct Curl_easy *data,
-                                                const char *hostname,
-                                                int port,
-                                                int *waitp)
-{
-  struct addrinfo hints;
-  int pf = PF_INET;
-  struct resdata *reslv = (struct resdata *)data->state.async.resolver;
-
-  *waitp = 0; /* default to synchronous response */
-
-#ifdef CURLRES_IPV6
-  if((data->conn->ip_version != CURL_IPRESOLVE_V4) && Curl_ipv6works(data)) {
-    /* The stack seems to be IPv6-enabled */
-    if(data->conn->ip_version == CURL_IPRESOLVE_V6)
-      pf = PF_INET6;
-    else
-      pf = PF_UNSPEC;
-  }
-#endif /* CURLRES_IPV6 */
-
-  memset(&hints, 0, sizeof(hints));
-  hints.ai_family = pf;
-  hints.ai_socktype = (data->conn->transport == TRNSPRT_TCP)?
-    SOCK_STREAM : SOCK_DGRAM;
-
-  reslv->start = Curl_now();
-  /* fire up a new resolver thread! */
-  if(init_resolve_thread(data, hostname, port, &hints)) {
-    *waitp = 1; /* expect asynchronous response */
-    return NULL;
-  }
-
-  failf(data, "getaddrinfo() thread failed to start");
-  return NULL;
-
-}
-
-#endif /* !HAVE_GETADDRINFO */
-
-CURLcode Curl_set_dns_servers(struct Curl_easy *data,
-                              char *servers)
-{
-  (void)data;
-  (void)servers;
-  return CURLE_NOT_BUILT_IN;
-
-}
-
-CURLcode Curl_set_dns_interface(struct Curl_easy *data,
-                                const char *interf)
-{
-  (void)data;
-  (void)interf;
-  return CURLE_NOT_BUILT_IN;
-}
-
-CURLcode Curl_set_dns_local_ip4(struct Curl_easy *data,
-                                const char *local_ip4)
-{
-  (void)data;
-  (void)local_ip4;
-  return CURLE_NOT_BUILT_IN;
-}
-
-CURLcode Curl_set_dns_local_ip6(struct Curl_easy *data,
-                                const char *local_ip6)
-{
-  (void)data;
-  (void)local_ip6;
-  return CURLE_NOT_BUILT_IN;
-}
-
-#endif /* CURLRES_THREADED */
diff --git a/third-party/curl/lib/asyn.h b/third-party/curl/lib/asyn.h
index 7e207c4f56..ed50933654 100644
--- a/third-party/curl/lib/asyn.h
+++ b/third-party/curl/lib/asyn.h
@@ -23,15 +23,29 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+
+#if defined(USE_HTTPSRR) && defined(USE_ARES)
+#include "httpsrr.h"
+#endif
+
+struct Curl_easy;
+struct Curl_dns_entry;
+struct Curl_resolv_async;
+struct Curl_multi;
+struct easy_pollset;
+
+#ifdef CURLRES_ASYNCH
+
 #include "curl_addrinfo.h"
 
-struct addrinfo;
 struct hostent;
-struct Curl_easy;
 struct connectdata;
-struct Curl_dns_entry;
+struct easy_pollset;
+
+#if defined(USE_RESOLV_ARES) && defined(USE_RESOLV_THREADED)
+#error cannot have both USE_RESOLV_ARES and USE_RESOLV_THREADED defined
+#endif
 
 /*
  * This header defines all functions in the internal asynch resolver interface.
@@ -41,111 +55,21 @@ struct Curl_dns_entry;
  */
 
 /*
- * Curl_resolver_global_init()
+ * Curl_async_global_init()
  *
  * Called from curl_global_init() to initialize global resolver environment.
  * Returning anything else than CURLE_OK fails curl_global_init().
  */
-int Curl_resolver_global_init(void);
+int Curl_async_global_init(void);
 
 /*
- * Curl_resolver_global_cleanup()
+ * Curl_async_global_cleanup()
  * Called from curl_global_cleanup() to destroy global resolver environment.
  */
-void Curl_resolver_global_cleanup(void);
+void Curl_async_global_cleanup(void);
 
 /*
- * Curl_resolver_init()
- * Called from curl_easy_init() -> Curl_open() to initialize resolver
- * URL-state specific environment ('resolver' member of the UrlState
- * structure).  Should fill the passed pointer by the initialized handler.
- * Returning anything else than CURLE_OK fails curl_easy_init() with the
- * correspondent code.
- */
-CURLcode Curl_resolver_init(struct Curl_easy *easy, void **resolver);
-
-/*
- * Curl_resolver_cleanup()
- * Called from curl_easy_cleanup() -> Curl_close() to cleanup resolver
- * URL-state specific environment ('resolver' member of the UrlState
- * structure).  Should destroy the handler and free all resources connected to
- * it.
- */
-void Curl_resolver_cleanup(void *resolver);
-
-/*
- * Curl_resolver_duphandle()
- * Called from curl_easy_duphandle() to duplicate resolver URL-state specific
- * environment ('resolver' member of the UrlState structure).  Should
- * duplicate the 'from' handle and pass the resulting handle to the 'to'
- * pointer.  Returning anything else than CURLE_OK causes failed
- * curl_easy_duphandle() call.
- */
-CURLcode Curl_resolver_duphandle(struct Curl_easy *easy, void **to,
-                                 void *from);
-
-/*
- * Curl_resolver_cancel().
- *
- * It is called from inside other functions to cancel currently performing
- * resolver request. Should also free any temporary resources allocated to
- * perform a request.  This never waits for resolver threads to complete.
- *
- * It is safe to call this when conn is in any state.
- */
-void Curl_resolver_cancel(struct Curl_easy *data);
-
-/*
- * Curl_resolver_kill().
- *
- * This acts like Curl_resolver_cancel() except it will block until any threads
- * associated with the resolver are complete.  This never blocks for resolvers
- * that do not use threads.  This is intended to be the "last chance" function
- * that cleans up an in-progress resolver completely (before its owner is about
- * to die).
- *
- * It is safe to call this when conn is in any state.
- */
-void Curl_resolver_kill(struct Curl_easy *data);
-
-/* Curl_resolver_getsock()
- *
- * This function is called from the multi_getsock() function.  'sock' is a
- * pointer to an array to hold the file descriptors, with 'numsock' being the
- * size of that array (in number of entries). This function is supposed to
- * return bitmask indicating what file descriptors (referring to array indexes
- * in the 'sock' array) to wait for, read/write.
- */
-int Curl_resolver_getsock(struct Curl_easy *data, curl_socket_t *sock);
-
-/*
- * Curl_resolver_is_resolved()
- *
- * Called repeatedly to check if a previous name resolve request has
- * completed. It should also make sure to time-out if the operation seems to
- * take too long.
- *
- * Returns normal CURLcode errors.
- */
-CURLcode Curl_resolver_is_resolved(struct Curl_easy *data,
-                                   struct Curl_dns_entry **dns);
-
-/*
- * Curl_resolver_wait_resolv()
- *
- * Waits for a resolve to finish. This function should be avoided since using
- * this risk getting the multi interface to "hang".
- *
- * If 'entry' is non-NULL, make it point to the resolved dns entry
- *
- * Returns CURLE_COULDNT_RESOLVE_HOST if the host was not resolved,
- * CURLE_OPERATION_TIMEDOUT if a time-out occurred, or other errors.
- */
-CURLcode Curl_resolver_wait_resolv(struct Curl_easy *data,
-                                   struct Curl_dns_entry **dnsentry);
-
-/*
- * Curl_resolver_getaddrinfo() - when using this resolver
+ * Curl_async_getaddrinfo() - when using this resolver
  *
  * Returns name information about the given hostname and port number. If
  * successful, the 'hostent' is returned and the fourth argument will point to
@@ -155,30 +79,199 @@ CURLcode Curl_resolver_wait_resolv(struct Curl_easy *data,
  * Each resolver backend must of course make sure to return data in the
  * correct format to comply with this.
  */
-struct Curl_addrinfo *Curl_resolver_getaddrinfo(struct Curl_easy *data,
-                                                const char *hostname,
-                                                int port,
-                                                int *waitp);
+CURLcode Curl_async_getaddrinfo(struct Curl_easy *data,
+                                struct Curl_resolv_async *async);
 
-#ifndef CURLRES_ASYNCH
-/* convert these functions if an asynch resolver isn't used */
-#define Curl_resolver_cancel(x) Curl_nop_stmt
-#define Curl_resolver_kill(x) Curl_nop_stmt
-#define Curl_resolver_is_resolved(x,y) CURLE_COULDNT_RESOLVE_HOST
-#define Curl_resolver_wait_resolv(x,y) CURLE_COULDNT_RESOLVE_HOST
-#define Curl_resolver_duphandle(x,y,z) CURLE_OK
-#define Curl_resolver_init(x,y) CURLE_OK
-#define Curl_resolver_global_init() CURLE_OK
-#define Curl_resolver_global_cleanup() Curl_nop_stmt
-#define Curl_resolver_cleanup(x) Curl_nop_stmt
+const struct Curl_addrinfo *Curl_async_get_ai(struct Curl_easy *data,
+                                              struct Curl_resolv_async *async,
+                                              int ai_family,
+                                              unsigned int index);
+
+#ifdef USE_HTTPSRR
+const struct Curl_https_rrinfo *Curl_async_get_https(
+  struct Curl_easy *data,
+  struct Curl_resolv_async *async);
+bool Curl_async_knows_https(struct Curl_easy *data,
+                            struct Curl_resolv_async *async);
+#endif /* USE_HTTPSRR */
+
+#ifdef USE_ARES
+/* common functions for c-ares and threaded resolver with HTTPSRR */
+#include <ares.h>
+
+CURLcode Curl_ares_pollset(struct Curl_easy *data,
+                           ares_channel channel,
+                           struct easy_pollset *ps);
+
+timediff_t Curl_ares_timeout_ms(struct Curl_easy *data,
+                                struct Curl_resolv_async *async,
+                                ares_channel channel);
+
+int Curl_ares_perform(ares_channel channel, timediff_t timeout_ms);
 #endif
 
-#ifdef CURLRES_ASYNCH
-#define Curl_resolver_asynch() 1
-#else
-#define Curl_resolver_asynch() 0
+#ifdef USE_RESOLV_ARES
+/* async resolving implementation using c-ares alone */
+struct async_ares_ctx {
+  ares_channel channel;
+  struct Curl_addrinfo *res_A;
+  struct Curl_addrinfo *res_AAAA;
+  int ares_status;               /* ARES_SUCCESS, ARES_ENOTFOUND, etc. */
+  CURLcode result;               /* CURLE_OK or error handling response */
+  struct curltime happy_eyeballs_dns_time; /* when this timer started, or 0 */
+#ifdef USE_HTTPSRR
+  struct Curl_https_rrinfo hinfo;
+#endif
+};
+
+void Curl_async_ares_shutdown(struct Curl_easy *data,
+                              struct Curl_resolv_async *async);
+void Curl_async_ares_destroy(struct Curl_easy *data,
+                             struct Curl_resolv_async *async);
+
+#endif /* USE_RESOLV_ARES */
+
+#ifdef USE_RESOLV_THREADED
+
+struct async_thrdd_item;
+
+/* Context for threaded resolver */
+struct async_thrdd_ctx {
+  struct async_thrdd_item *res_A; /* ipv4 result */
+  struct async_thrdd_item *res_AAAA; /* ipv6 result */
+#if defined(USE_HTTPSRR) && defined(USE_ARES)
+  struct {
+    ares_channel channel;
+    struct Curl_https_rrinfo hinfo;
+  } rr;
+#endif
+};
+
+void Curl_async_thrdd_shutdown(struct Curl_easy *data,
+                               struct Curl_resolv_async *async);
+void Curl_async_thrdd_destroy(struct Curl_easy *data,
+                              struct Curl_resolv_async *async);
+
+CURLcode Curl_async_thrdd_multi_init(struct Curl_multi *multi,
+                                     uint32_t min_threads,
+                                     uint32_t max_threads,
+                                     uint32_t idle_time_ms);
+void Curl_async_thrdd_multi_destroy(struct Curl_multi *multi, bool join);
+void Curl_async_thrdd_multi_process(struct Curl_multi *multi);
+
+CURLcode Curl_async_thrdd_multi_set_props(struct Curl_multi *multi,
+                                          uint32_t min_threads,
+                                          uint32_t max_threads,
+                                          uint32_t idle_time_ms);
+
+#endif /* USE_RESOLV_THREADED */
+
+#ifndef CURL_DISABLE_DOH
+struct doh_probes;
 #endif
 
+/*
+ * Curl_async_await()
+ *
+ * Waits for a resolve to finish. This function should be avoided since using
+ * this risk getting the multi interface to "hang".
+ *
+ * On return 'dns' is assigned the resolved dns (CURLE_OK or NULL otherwise.
+ *
+ * Returns CURLE_COULDNT_RESOLVE_HOST if the host was not resolved,
+ * CURLE_OPERATION_TIMEDOUT if a time-out occurred, or other errors.
+ */
+CURLcode Curl_async_await(struct Curl_easy *data, uint32_t resolv_id,
+                          struct Curl_dns_entry **pdns);
+
+/*
+ * Take the result of an async resolve operation.
+ * Returns CURLE_OK with `*pdns` != NULL, CURLE_AGAIN while still
+ * ongoing or an error code for a failed resolve.
+ */
+CURLcode Curl_async_take_result(struct Curl_easy *data,
+                                struct Curl_resolv_async *async,
+                                struct Curl_dns_entry **pdns);
+
+/* Curl_async_pollset()
+ *
+ * This function is called from the Curl_multi_pollset() function.  'sock' is a
+ * pointer to an array to hold the file descriptors, with 'numsock' being the
+ * size of that array (in number of entries). This function is supposed to
+ * return bitmask indicating what file descriptors (referring to array indexes
+ * in the 'sock' array) to wait for, read/write.
+ */
+CURLcode Curl_async_pollset(struct Curl_easy *data,
+                            struct Curl_resolv_async *async,
+                            struct easy_pollset *ps);
+
+#else /* CURLRES_ASYNCH */
+
+/* convert these functions if an asynch resolver is not used */
+#define Curl_async_global_init()        CURLE_OK
+#define Curl_async_global_cleanup()     Curl_nop_stmt
+#define Curl_async_get_ai(a, b, c, d)   NULL
+#define Curl_async_await(a, b, c)       CURLE_COULDNT_RESOLVE_HOST
+#define Curl_async_take_result(x, y, z) CURLE_COULDNT_RESOLVE_HOST
+#define Curl_async_pollset(x, y, z)     CURLE_OK
+#define Curl_async_get_https(x, y)      NULL
+#define Curl_async_knows_https(x, y)    TRUE
+#endif /* !CURLRES_ASYNCH */
+
+#if defined(CURLRES_ASYNCH) || !defined(CURL_DISABLE_DOH)
+#define USE_CURL_ASYNC
+#endif
+
+#ifdef USE_CURL_ASYNC
+
+struct Curl_resolv_async {
+  struct Curl_resolv_async *next;
+#ifdef USE_RESOLV_ARES
+  struct async_ares_ctx ares;
+#elif defined(USE_RESOLV_THREADED)
+  struct async_thrdd_ctx thrdd;
+#endif
+#ifndef CURL_DISABLE_DOH
+  struct doh_probes *doh; /* DoH specific data for this request */
+#endif
+  struct curltime start;
+  timediff_t interval_end;
+  timediff_t timeout_ms;
+  CURLcode result;
+  uint32_t poll_interval;
+  uint32_t id; /* unique id per easy handle of the resolve operation */
+  /* what is being resolved */
+  uint16_t port;
+  uint8_t dns_queries; /* what queries are being performed */
+  uint8_t dns_responses; /* what queries had responses so far. */
+  uint8_t transport;
+  uint8_t queries_ongoing;
+  BIT(is_ipaddr);
+  BIT(is_ipv4addr);
+  BIT(for_proxy);
+  BIT(done);
+  BIT(shutdown);
+  char hostname[1];
+};
+
+timediff_t Curl_async_timeleft_ms(struct Curl_easy *data,
+                                  struct Curl_resolv_async *async);
+
+/* Shut down the given async resolve. */
+void Curl_async_shutdown(struct Curl_easy *data,
+                         struct Curl_resolv_async *async);
+
+/* Frees the resources of the given async resolve and the struct itself. */
+void Curl_async_destroy(struct Curl_easy *data,
+                        struct Curl_resolv_async *async);
+
+CURLcode Curl_async_failed(struct Curl_easy *data,
+                           struct Curl_resolv_async *async,
+                           const char *detail);
+
+#else /* !USE_CURL_ASYNC */
+#define Curl_async_shutdown(x, y) Curl_nop_stmt
+#endif /* USE_CURL_ASYNC */
 
 /********** end of generic resolver interface functions *****************/
 #endif /* HEADER_CURL_ASYN_H */
diff --git a/third-party/curl/lib/base64.c b/third-party/curl/lib/base64.c
deleted file mode 100644
index 30db7e5889..0000000000
--- a/third-party/curl/lib/base64.c
+++ /dev/null
@@ -1,292 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-/* Base64 encoding/decoding */
-
-#include "curl_setup.h"
-
-#if !defined(CURL_DISABLE_HTTP_AUTH) || defined(USE_SSH) || \
-  !defined(CURL_DISABLE_LDAP) || \
-  !defined(CURL_DISABLE_SMTP) || \
-  !defined(CURL_DISABLE_POP3) || \
-  !defined(CURL_DISABLE_IMAP) || \
-  !defined(CURL_DISABLE_DOH) || defined(USE_SSL)
-#include "curl/curl.h"
-#include "warnless.h"
-#include "curl_base64.h"
-
-/* The last 2 #include files should be in this order */
-#ifdef BUILDING_LIBCURL
-#include "curl_memory.h"
-#endif
-#include "memdebug.h"
-
-/* ---- Base64 Encoding/Decoding Table --- */
-/* Padding character string starts at offset 64. */
-static const char base64encdec[]=
-  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
-
-/* The Base 64 encoding with a URL and filename safe alphabet, RFC 4648
-   section 5 */
-static const char base64url[]=
-  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-
-static const unsigned char decodetable[] =
-{ 62, 255, 255, 255, 63, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 255, 255, 255,
-  255, 255, 255, 255, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
-  17, 18, 19, 20, 21, 22, 23, 24, 25, 255, 255, 255, 255, 255, 255, 26, 27, 28,
-  29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47,
-  48, 49, 50, 51 };
-/*
- * Curl_base64_decode()
- *
- * Given a base64 NUL-terminated string at src, decode it and return a
- * pointer in *outptr to a newly allocated memory area holding decoded
- * data. Size of decoded data is returned in variable pointed by outlen.
- *
- * Returns CURLE_OK on success, otherwise specific error code. Function
- * output shall not be considered valid unless CURLE_OK is returned.
- *
- * When decoded data length is 0, returns NULL in *outptr.
- *
- * @unittest: 1302
- */
-CURLcode Curl_base64_decode(const char *src,
-                            unsigned char **outptr, size_t *outlen)
-{
-  size_t srclen = 0;
-  size_t padding = 0;
-  size_t i;
-  size_t numQuantums;
-  size_t fullQuantums;
-  size_t rawlen = 0;
-  unsigned char *pos;
-  unsigned char *newstr;
-  unsigned char lookup[256];
-
-  *outptr = NULL;
-  *outlen = 0;
-  srclen = strlen(src);
-
-  /* Check the length of the input string is valid */
-  if(!srclen || srclen % 4)
-    return CURLE_BAD_CONTENT_ENCODING;
-
-  /* srclen is at least 4 here */
-  while(src[srclen - 1 - padding] == '=') {
-    /* count padding characters */
-    padding++;
-    /* A maximum of two = padding characters is allowed */
-    if(padding > 2)
-      return CURLE_BAD_CONTENT_ENCODING;
-  }
-
-  /* Calculate the number of quantums */
-  numQuantums = srclen / 4;
-  fullQuantums = numQuantums - (padding ? 1 : 0);
-
-  /* Calculate the size of the decoded string */
-  rawlen = (numQuantums * 3) - padding;
-
-  /* Allocate our buffer including room for a null-terminator */
-  newstr = malloc(rawlen + 1);
-  if(!newstr)
-    return CURLE_OUT_OF_MEMORY;
-
-  pos = newstr;
-
-  memset(lookup, 0xff, sizeof(lookup));
-  memcpy(&lookup['+'], decodetable, sizeof(decodetable));
-  /* replaces
-  {
-    unsigned char c;
-    const unsigned char *p = (const unsigned char *)base64encdec;
-    for(c = 0; *p; c++, p++)
-      lookup[*p] = c;
-  }
-  */
-
-  /* Decode the complete quantums first */
-  for(i = 0; i < fullQuantums; i++) {
-    unsigned char val;
-    unsigned int x = 0;
-    int j;
-
-    for(j = 0; j < 4; j++) {
-      val = lookup[(unsigned char)*src++];
-      if(val == 0xff) /* bad symbol */
-        goto bad;
-      x = (x << 6) | val;
-    }
-    pos[2] = x & 0xff;
-    pos[1] = (x >> 8) & 0xff;
-    pos[0] = (x >> 16) & 0xff;
-    pos += 3;
-  }
-  if(padding) {
-    /* this means either 8 or 16 bits output */
-    unsigned char val;
-    unsigned int x = 0;
-    int j;
-    size_t padc = 0;
-    for(j = 0; j < 4; j++) {
-      if(*src == '=') {
-        x <<= 6;
-        src++;
-        if(++padc > padding)
-          /* this is a badly placed '=' symbol! */
-          goto bad;
-      }
-      else {
-        val = lookup[(unsigned char)*src++];
-        if(val == 0xff) /* bad symbol */
-          goto bad;
-        x = (x << 6) | val;
-      }
-    }
-    if(padding == 1)
-      pos[1] = (x >> 8) & 0xff;
-    pos[0] = (x >> 16) & 0xff;
-    pos += 3 - padding;
-  }
-
-  /* Zero terminate */
-  *pos = '\0';
-
-  /* Return the decoded data */
-  *outptr = newstr;
-  *outlen = rawlen;
-
-  return CURLE_OK;
-bad:
-  free(newstr);
-  return CURLE_BAD_CONTENT_ENCODING;
-}
-
-static CURLcode base64_encode(const char *table64,
-                              const char *inputbuff, size_t insize,
-                              char **outptr, size_t *outlen)
-{
-  char *output;
-  char *base64data;
-  const unsigned char *in = (unsigned char *)inputbuff;
-  const char *padstr = &table64[64];    /* Point to padding string. */
-
-  *outptr = NULL;
-  *outlen = 0;
-
-  if(!insize)
-    insize = strlen(inputbuff);
-
-#if SIZEOF_SIZE_T == 4
-  if(insize > UINT_MAX/4)
-    return CURLE_OUT_OF_MEMORY;
-#endif
-
-  base64data = output = malloc((insize + 2) / 3 * 4 + 1);
-  if(!output)
-    return CURLE_OUT_OF_MEMORY;
-
-  while(insize >= 3) {
-    *output++ = table64[ in[0] >> 2 ];
-    *output++ = table64[ ((in[0] & 0x03) << 4) | (in[1] >> 4) ];
-    *output++ = table64[ ((in[1] & 0x0F) << 2) | ((in[2] & 0xC0) >> 6) ];
-    *output++ = table64[ in[2] & 0x3F ];
-    insize -= 3;
-    in += 3;
-  }
-  if(insize) {
-    /* this is only one or two bytes now */
-    *output++ = table64[ in[0] >> 2 ];
-    if(insize == 1) {
-      *output++ = table64[ ((in[0] & 0x03) << 4) ];
-      if(*padstr) {
-        *output++ = *padstr;
-        *output++ = *padstr;
-      }
-    }
-    else {
-      /* insize == 2 */
-      *output++ = table64[ ((in[0] & 0x03) << 4) | ((in[1] & 0xF0) >> 4) ];
-      *output++ = table64[ ((in[1] & 0x0F) << 2) ];
-      if(*padstr)
-        *output++ = *padstr;
-    }
-  }
-
-  /* Zero terminate */
-  *output = '\0';
-
-  /* Return the pointer to the new data (allocated memory) */
-  *outptr = base64data;
-
-  /* Return the length of the new data */
-  *outlen = output - base64data;
-
-  return CURLE_OK;
-}
-
-/*
- * Curl_base64_encode()
- *
- * Given a pointer to an input buffer and an input size, encode it and
- * return a pointer in *outptr to a newly allocated memory area holding
- * encoded data. Size of encoded data is returned in variable pointed by
- * outlen.
- *
- * Input length of 0 indicates input buffer holds a NUL-terminated string.
- *
- * Returns CURLE_OK on success, otherwise specific error code. Function
- * output shall not be considered valid unless CURLE_OK is returned.
- *
- * @unittest: 1302
- */
-CURLcode Curl_base64_encode(const char *inputbuff, size_t insize,
-                            char **outptr, size_t *outlen)
-{
-  return base64_encode(base64encdec, inputbuff, insize, outptr, outlen);
-}
-
-/*
- * Curl_base64url_encode()
- *
- * Given a pointer to an input buffer and an input size, encode it and
- * return a pointer in *outptr to a newly allocated memory area holding
- * encoded data. Size of encoded data is returned in variable pointed by
- * outlen.
- *
- * Input length of 0 indicates input buffer holds a NUL-terminated string.
- *
- * Returns CURLE_OK on success, otherwise specific error code. Function
- * output shall not be considered valid unless CURLE_OK is returned.
- *
- * @unittest: 1302
- */
-CURLcode Curl_base64url_encode(const char *inputbuff, size_t insize,
-                               char **outptr, size_t *outlen)
-{
-  return base64_encode(base64url, inputbuff, insize, outptr, outlen);
-}
-
-#endif /* no users so disabled */
diff --git a/third-party/curl/lib/bufq.c b/third-party/curl/lib/bufq.c
index 155544993d..750d86888f 100644
--- a/third-party/curl/lib/bufq.c
+++ b/third-party/curl/lib/bufq.c
@@ -21,14 +21,9 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
-#include "bufq.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "bufq.h"
 
 static bool chunk_is_empty(const struct buf_chunk *chunk)
 {
@@ -45,11 +40,6 @@ static size_t chunk_len(const struct buf_chunk *chunk)
   return chunk->w_offset - chunk->r_offset;
 }
 
-static size_t chunk_space(const struct buf_chunk *chunk)
-{
-  return chunk->dlen - chunk->w_offset;
-}
-
 static void chunk_reset(struct buf_chunk *chunk)
 {
   chunk->next = NULL;
@@ -57,9 +47,9 @@ static void chunk_reset(struct buf_chunk *chunk)
 }
 
 static size_t chunk_append(struct buf_chunk *chunk,
-                           const unsigned char *buf, size_t len)
+                           const uint8_t *buf, size_t len)
 {
-  unsigned char *p = &chunk->x.data[chunk->w_offset];
+  uint8_t *p = &chunk->x.data[chunk->w_offset];
   size_t n = chunk->dlen - chunk->w_offset;
   DEBUGASSERT(chunk->dlen >= chunk->w_offset);
   if(n) {
@@ -71,9 +61,9 @@ static size_t chunk_append(struct buf_chunk *chunk,
 }
 
 static size_t chunk_read(struct buf_chunk *chunk,
-                         unsigned char *buf, size_t len)
+                         uint8_t *buf, size_t len)
 {
-  unsigned char *p = &chunk->x.data[chunk->r_offset];
+  uint8_t *p = &chunk->x.data[chunk->r_offset];
   size_t n = chunk->w_offset - chunk->r_offset;
   DEBUGASSERT(chunk->w_offset >= chunk->r_offset);
   if(!n) {
@@ -91,31 +81,30 @@ static size_t chunk_read(struct buf_chunk *chunk,
   }
 }
 
-static ssize_t chunk_slurpn(struct buf_chunk *chunk, size_t max_len,
-                            Curl_bufq_reader *reader,
-                            void *reader_ctx, CURLcode *err)
+static CURLcode chunk_slurpn(struct buf_chunk *chunk, size_t max_len,
+                             Curl_bufq_reader *reader,
+                             void *reader_ctx, size_t *pnread)
 {
-  unsigned char *p = &chunk->x.data[chunk->w_offset];
+  uint8_t *p = &chunk->x.data[chunk->w_offset];
   size_t n = chunk->dlen - chunk->w_offset; /* free amount */
-  ssize_t nread;
+  CURLcode result;
 
+  *pnread = 0;
   DEBUGASSERT(chunk->dlen >= chunk->w_offset);
-  if(!n) {
-    *err = CURLE_AGAIN;
-    return -1;
-  }
+  if(!n)
+    return CURLE_AGAIN;
   if(max_len && n > max_len)
     n = max_len;
-  nread = reader(reader_ctx, p, n, err);
-  if(nread > 0) {
-    DEBUGASSERT((size_t)nread <= n);
-    chunk->w_offset += nread;
+  result = reader(reader_ctx, p, n, pnread);
+  if(!result) {
+    DEBUGASSERT(*pnread <= n);
+    chunk->w_offset += *pnread;
   }
-  return nread;
+  return result;
 }
 
 static void chunk_peek(const struct buf_chunk *chunk,
-                       const unsigned char **pbuf, size_t *plen)
+                       const uint8_t **pbuf, size_t *plen)
 {
   DEBUGASSERT(chunk->w_offset >= chunk->r_offset);
   *pbuf = &chunk->x.data[chunk->r_offset];
@@ -123,7 +112,7 @@ static void chunk_peek(const struct buf_chunk *chunk,
 }
 
 static void chunk_peek_at(const struct buf_chunk *chunk, size_t offset,
-                          const unsigned char **pbuf, size_t *plen)
+                          const uint8_t **pbuf, size_t *plen)
 {
   offset += chunk->r_offset;
   DEBUGASSERT(chunk->w_offset >= offset);
@@ -144,33 +133,16 @@ static size_t chunk_skip(struct buf_chunk *chunk, size_t amount)
   return n;
 }
 
-static void chunk_shift(struct buf_chunk *chunk)
-{
-  if(chunk->r_offset) {
-    if(!chunk_is_empty(chunk)) {
-      size_t n = chunk->w_offset - chunk->r_offset;
-      memmove(chunk->x.data, chunk->x.data + chunk->r_offset, n);
-      chunk->w_offset -= chunk->r_offset;
-      chunk->r_offset = 0;
-    }
-    else {
-      chunk->r_offset = chunk->w_offset = 0;
-    }
-  }
-}
-
 static void chunk_list_free(struct buf_chunk **anchor)
 {
   struct buf_chunk *chunk;
   while(*anchor) {
     chunk = *anchor;
     *anchor = chunk->next;
-    free(chunk);
+    curlx_free(chunk);
   }
 }
 
-
-
 void Curl_bufcp_init(struct bufc_pool *pool,
                      size_t chunk_size, size_t spare_max)
 {
@@ -195,7 +167,13 @@ static CURLcode bufcp_take(struct bufc_pool *pool,
     return CURLE_OK;
   }
 
-  chunk = calloc(1, sizeof(*chunk) + pool->chunk_size);
+  /* Check for integer overflow before allocation */
+  if(pool->chunk_size > SIZE_MAX - sizeof(*chunk)) {
+    *pchunk = NULL;
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  chunk = curlx_calloc(1, sizeof(*chunk) + pool->chunk_size);
   if(!chunk) {
     *pchunk = NULL;
     return CURLE_OUT_OF_MEMORY;
@@ -209,7 +187,7 @@ static void bufcp_put(struct bufc_pool *pool,
                       struct buf_chunk *chunk)
 {
   if(pool->spare_count >= pool->spare_max) {
-    free(chunk);
+    curlx_free(chunk);
   }
   else {
     chunk_reset(chunk);
@@ -285,24 +263,6 @@ size_t Curl_bufq_len(const struct bufq *q)
   return len;
 }
 
-size_t Curl_bufq_space(const struct bufq *q)
-{
-  size_t space = 0;
-  if(q->tail)
-    space += chunk_space(q->tail);
-  if(q->spare) {
-    struct buf_chunk *chunk = q->spare;
-    while(chunk) {
-      space += chunk->dlen;
-      chunk = chunk->next;
-    }
-  }
-  if(q->chunk_count < q->max_chunks) {
-    space += (q->max_chunks - q->chunk_count) * q->chunk_size;
-  }
-  return space;
-}
-
 bool Curl_bufq_is_empty(const struct bufq *q)
 {
   return !q->head || chunk_is_empty(q->head);
@@ -341,7 +301,12 @@ static struct buf_chunk *get_spare(struct bufq *q)
     return chunk;
   }
   else {
-    chunk = calloc(1, sizeof(*chunk) + q->chunk_size);
+    /* Check for integer overflow before allocation */
+    if(q->chunk_size > SIZE_MAX - sizeof(*chunk)) {
+      return NULL;
+    }
+
+    chunk = curlx_calloc(1, sizeof(*chunk) + q->chunk_size);
     if(!chunk)
       return NULL;
     chunk->dlen = q->chunk_size;
@@ -364,11 +329,11 @@ static void prune_head(struct bufq *q)
       --q->chunk_count;
     }
     else if((q->chunk_count > q->max_chunks) ||
-       (q->opts & BUFQ_OPT_NO_SPARES)) {
+            (q->opts & BUFQ_OPT_NO_SPARES)) {
       /* SOFT_LIMIT allowed us more than max. free spares until
        * we are at max again. Or free them if we are configured
        * to not use spares. */
-      free(chunk);
+      curlx_free(chunk);
       --q->chunk_count;
     }
     else {
@@ -399,64 +364,64 @@ static struct buf_chunk *get_non_full_tail(struct bufq *q)
   return chunk;
 }
 
-ssize_t Curl_bufq_write(struct bufq *q,
-                        const unsigned char *buf, size_t len,
-                        CURLcode *err)
+CURLcode Curl_bufq_write(struct bufq *q,
+                         const uint8_t *buf, size_t len,
+                         size_t *pnwritten)
 {
   struct buf_chunk *tail;
-  ssize_t nwritten = 0;
   size_t n;
 
   DEBUGASSERT(q->max_chunks > 0);
+  *pnwritten = 0;
   while(len) {
     tail = get_non_full_tail(q);
     if(!tail) {
-      if(q->chunk_count < q->max_chunks) {
-        *err = CURLE_OUT_OF_MEMORY;
-        return -1;
-      }
+      if((q->chunk_count < q->max_chunks) || (q->opts & BUFQ_OPT_SOFT_LIMIT))
+        /* should have gotten a tail, but did not */
+        return CURLE_OUT_OF_MEMORY;
       break;
     }
     n = chunk_append(tail, buf, len);
     if(!n)
       break;
-    nwritten += n;
+    *pnwritten += n;
     buf += n;
     len -= n;
   }
-  if(nwritten == 0 && len) {
-    *err = CURLE_AGAIN;
-    return -1;
-  }
-  *err = CURLE_OK;
-  return nwritten;
+  return (!*pnwritten && len) ? CURLE_AGAIN : CURLE_OK;
 }
 
-ssize_t Curl_bufq_read(struct bufq *q, unsigned char *buf, size_t len,
-                       CURLcode *err)
+CURLcode Curl_bufq_cwrite(struct bufq *q,
+                          const char *buf, size_t len,
+                          size_t *pnwritten)
 {
-  ssize_t nread = 0;
-  size_t n;
+  return Curl_bufq_write(q, (const uint8_t *)buf, len, pnwritten);
+}
 
-  *err = CURLE_OK;
+CURLcode Curl_bufq_read(struct bufq *q, uint8_t *buf, size_t len,
+                        size_t *pnread)
+{
+  *pnread = 0;
   while(len && q->head) {
-    n = chunk_read(q->head, buf, len);
+    size_t n = chunk_read(q->head, buf, len);
     if(n) {
-      nread += n;
+      *pnread += n;
       buf += n;
       len -= n;
     }
     prune_head(q);
   }
-  if(nread == 0) {
-    *err = CURLE_AGAIN;
-    return -1;
-  }
-  return nread;
+  return (!*pnread) ? CURLE_AGAIN : CURLE_OK;
+}
+
+CURLcode Curl_bufq_cread(struct bufq *q, char *buf, size_t len,
+                         size_t *pnread)
+{
+  return Curl_bufq_read(q, (uint8_t *)buf, len, pnread);
 }
 
 bool Curl_bufq_peek(struct bufq *q,
-                    const unsigned char **pbuf, size_t *plen)
+                    const uint8_t **pbuf, size_t *plen)
 {
   if(q->head && chunk_is_empty(q->head)) {
     prune_head(q);
@@ -471,7 +436,7 @@ bool Curl_bufq_peek(struct bufq *q,
 }
 
 bool Curl_bufq_peek_at(struct bufq *q, size_t offset,
-                       const unsigned char **pbuf, size_t *plen)
+                       const uint8_t **pbuf, size_t *plen)
 {
   struct buf_chunk *c = q->head;
   size_t clen;
@@ -504,163 +469,139 @@ void Curl_bufq_skip(struct bufq *q, size_t amount)
   }
 }
 
-void Curl_bufq_skip_and_shift(struct bufq *q, size_t amount)
+CURLcode Curl_bufq_pass(struct bufq *q, Curl_bufq_writer *writer,
+                        void *writer_ctx, size_t *pwritten)
 {
-  Curl_bufq_skip(q, amount);
-  if(q->tail)
-    chunk_shift(q->tail);
-}
-
-ssize_t Curl_bufq_pass(struct bufq *q, Curl_bufq_writer *writer,
-                       void *writer_ctx, CURLcode *err)
-{
-  const unsigned char *buf;
+  const uint8_t *buf;
   size_t blen;
-  ssize_t nwritten = 0;
+  CURLcode result = CURLE_OK;
 
+  *pwritten = 0;
   while(Curl_bufq_peek(q, &buf, &blen)) {
-    ssize_t chunk_written;
+    size_t chunk_written;
 
-    chunk_written = writer(writer_ctx, buf, blen, err);
-    if(chunk_written < 0) {
-      if(!nwritten || *err != CURLE_AGAIN) {
-        /* blocked on first write or real error, fail */
-        nwritten = -1;
+    result = writer(writer_ctx, buf, blen, &chunk_written);
+    if(result) {
+      if((result == CURLE_AGAIN) && *pwritten) {
+        /* blocked on subsequent write, report success */
+        result = CURLE_OK;
       }
       break;
     }
     if(!chunk_written) {
-      if(!nwritten) {
+      if(!*pwritten) {
         /* treat as blocked */
-        *err = CURLE_AGAIN;
-        nwritten = -1;
+        result = CURLE_AGAIN;
       }
       break;
     }
-    Curl_bufq_skip(q, (size_t)chunk_written);
-    nwritten += chunk_written;
+    *pwritten += chunk_written;
+    Curl_bufq_skip(q, chunk_written);
   }
-  return nwritten;
+  return result;
 }
 
-ssize_t Curl_bufq_write_pass(struct bufq *q,
-                             const unsigned char *buf, size_t len,
-                             Curl_bufq_writer *writer, void *writer_ctx,
-                             CURLcode *err)
+CURLcode Curl_bufq_write_pass(struct bufq *q,
+                              const uint8_t *buf, size_t len,
+                              Curl_bufq_writer *writer, void *writer_ctx,
+                              size_t *pwritten)
 {
-  ssize_t nwritten = 0, n;
+  CURLcode result = CURLE_OK;
+  size_t n;
 
-  *err = CURLE_OK;
+  *pwritten = 0;
   while(len) {
     if(Curl_bufq_is_full(q)) {
       /* try to make room in case we are full */
-      n = Curl_bufq_pass(q, writer, writer_ctx, err);
-      if(n < 0) {
-        if(*err != CURLE_AGAIN) {
+      result = Curl_bufq_pass(q, writer, writer_ctx, &n);
+      if(result) {
+        if(result != CURLE_AGAIN) {
           /* real error, fail */
-          return -1;
+          return result;
         }
         /* would block, bufq is full, give up */
         break;
       }
     }
 
-    /* Add whatever is remaining now to bufq */
-    n = Curl_bufq_write(q, buf, len, err);
-    if(n < 0) {
-      if(*err != CURLE_AGAIN) {
+    /* Add to bufq as much as there is room for */
+    result = Curl_bufq_write(q, buf, len, &n);
+    if(result) {
+      if(result != CURLE_AGAIN)
         /* real error, fail */
-        return -1;
-      }
-      /* no room in bufq */
-      break;
+        return result;
+      /* result == CURLE_AGAIN */
+      if(*pwritten)
+        /* we did write successfully before */
+        result = CURLE_OK;
+      return result;
     }
-    /* edge case of writer returning 0 (and len is >0)
-     * break or we might enter an infinite loop here */
-    if(n == 0)
+    else if(n == 0)
+      /* edge case of writer returning 0 (and len is >0)
+       * break or we might enter an infinite loop here */
       break;
 
-    /* Maybe only part of `data` has been added, continue to loop */
-    buf += (size_t)n;
-    len -= (size_t)n;
-    nwritten += (size_t)n;
+    /* Track what we added to bufq */
+    buf += n;
+    len -= n;
+    *pwritten += n;
   }
 
-  if(!nwritten && len) {
-    *err = CURLE_AGAIN;
-    return -1;
-  }
-  *err = CURLE_OK;
-  return nwritten;
+  return (!*pwritten && len) ? CURLE_AGAIN : CURLE_OK;
 }
 
-ssize_t Curl_bufq_sipn(struct bufq *q, size_t max_len,
-                       Curl_bufq_reader *reader, void *reader_ctx,
-                       CURLcode *err)
+CURLcode Curl_bufq_sipn(struct bufq *q, size_t max_len,
+                        Curl_bufq_reader *reader, void *reader_ctx,
+                        size_t *pnread)
 {
   struct buf_chunk *tail = NULL;
-  ssize_t nread;
 
-  *err = CURLE_AGAIN;
+  *pnread = 0;
   tail = get_non_full_tail(q);
   if(!tail) {
-    if(q->chunk_count < q->max_chunks) {
-      *err = CURLE_OUT_OF_MEMORY;
-      return -1;
-    }
+    if(q->chunk_count < q->max_chunks)
+      return CURLE_OUT_OF_MEMORY;
     /* full, blocked */
-    *err = CURLE_AGAIN;
-    return -1;
+    return CURLE_AGAIN;
   }
 
-  nread = chunk_slurpn(tail, max_len, reader, reader_ctx, err);
-  if(nread < 0) {
-    return -1;
-  }
-  else if(nread == 0) {
-    /* eof */
-    *err = CURLE_OK;
-  }
-  return nread;
+  return chunk_slurpn(tail, max_len, reader, reader_ctx, pnread);
 }
 
 /**
  * Read up to `max_len` bytes and append it to the end of the buffer queue.
  * if `max_len` is 0, no limit is imposed and the call behaves exactly
  * the same as `Curl_bufq_slurp()`.
- * Returns the total amount of buf read (may be 0) or -1 on other
- * reader errors.
- * Note that even in case of a -1 chunks may have been read and
+ * Returns the total amount of buf read (may be 0) in `pnread` or error
+ * Note that even in case of an error chunks may have been read and
  * the buffer queue will have different length than before.
  */
-static ssize_t bufq_slurpn(struct bufq *q, size_t max_len,
-                           Curl_bufq_reader *reader, void *reader_ctx,
-                           CURLcode *err)
+static CURLcode bufq_slurpn(struct bufq *q, size_t max_len,
+                            Curl_bufq_reader *reader, void *reader_ctx,
+                            size_t *pnread)
 {
-  ssize_t nread = 0, n;
+  CURLcode result;
 
-  *err = CURLE_AGAIN;
+  *pnread = 0;
   while(1) {
-
-    n = Curl_bufq_sipn(q, max_len, reader, reader_ctx, err);
-    if(n < 0) {
-      if(!nread || *err != CURLE_AGAIN) {
+    size_t n;
+    result = Curl_bufq_sipn(q, max_len, reader, reader_ctx, &n);
+    if(result) {
+      if(!*pnread || result != CURLE_AGAIN) {
         /* blocked on first read or real error, fail */
-        nread = -1;
+        return result;
       }
-      else
-        *err = CURLE_OK;
+      result = CURLE_OK;
       break;
     }
     else if(n == 0) {
-      /* eof */
-      *err = CURLE_OK;
+      /* eof, result remains CURLE_OK */
       break;
     }
-    nread += (size_t)n;
+    *pnread += n;
     if(max_len) {
-      DEBUGASSERT((size_t)n <= max_len);
-      max_len -= (size_t)n;
+      DEBUGASSERT(n <= max_len);
+      max_len -= n;
       if(!max_len)
         break;
     }
@@ -668,11 +609,11 @@ static ssize_t bufq_slurpn(struct bufq *q, size_t max_len,
     if(q->tail && !chunk_is_full(q->tail))
       break;
   }
-  return nread;
+  return result;
 }
 
-ssize_t Curl_bufq_slurp(struct bufq *q, Curl_bufq_reader *reader,
-                        void *reader_ctx, CURLcode *err)
+CURLcode Curl_bufq_slurp(struct bufq *q, Curl_bufq_reader *reader,
+                         void *reader_ctx, size_t *pnread)
 {
-  return bufq_slurpn(q, 0, reader, reader_ctx, err);
+  return bufq_slurpn(q, 0, reader, reader_ctx, pnread);
 }
diff --git a/third-party/curl/lib/bufq.h b/third-party/curl/lib/bufq.h
index 89b5c84efe..c53749d84e 100644
--- a/third-party/curl/lib/bufq.h
+++ b/third-party/curl/lib/bufq.h
@@ -25,8 +25,6 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
-#include <curl/curl.h>
-
 /**
  * A chunk of bytes for reading and writing.
  * The size is fixed a creation with read and write offset
@@ -38,7 +36,7 @@ struct buf_chunk {
   size_t r_offset;         /* first unread bytes */
   size_t w_offset;         /* one after last written byte */
   union {
-    unsigned char data[1]; /* the buffer for `dlen` bytes */
+    uint8_t data[1];       /* the buffer for `dlen` bytes */
     void *dummy;           /* alignment */
   } x;
 };
@@ -46,9 +44,8 @@ struct buf_chunk {
 /**
  * A pool for providing/keeping a number of chunks of the same size
  *
- * The same pool can be shared by many `bufq` instances. However, a pool
- * is not thread safe. All bufqs using it are supposed to operate in the
- * same thread.
+ * The same pool can be shared by many `bufq` instances. A pool is not thread
+ * safe. All bufqs using it are supposed to operate in the same thread.
  */
 struct bufc_pool {
   struct buf_chunk *spare;  /* list of available spare chunks */
@@ -79,13 +76,13 @@ void Curl_bufcp_free(struct bufc_pool *pool);
  *
  * By default, writing to a full bufq will return (-1, CURLE_AGAIN). Same
  * as reading from an empty bufq.
- * With `BUFQ_OPT_SOFT_LIMIT` set, a bufq will allow writing becond this
- * limit and use more than `max_chunks`. However it will report that it
- * is full nevertheless. This is provided for situation where writes
- * preferably never fail (except for memory exhaustion).
+ * With `BUFQ_OPT_SOFT_LIMIT` set, a bufq will allow writing beyond this limit
+ * and use more than `max_chunks`. It will report that it is full
+ * nevertheless. This is provided for situation where writes preferably never
+ * fail (except for memory exhaustion).
  *
  * By default and without a pool, a bufq will keep chunks that read
- * read empty in its `spare` list. Option `BUFQ_OPT_NO_SPARES` will
+ * empty in its `spare` list. Option `BUFQ_OPT_NO_SPARES` will
  * disable that and free chunks once they become empty.
  *
  * When providing a pool to a bufq, all chunk creation and spare handling
@@ -106,7 +103,7 @@ struct bufq {
  * Default behaviour: chunk limit is "hard", meaning attempts to write
  * more bytes than can be hold in `max_chunks` is refused and will return
  * -1, CURLE_AGAIN. */
-#define BUFQ_OPT_NONE        (0)
+#define BUFQ_OPT_NONE        0
 /**
  * Make `max_chunks` a "soft" limit. A bufq will report that it is "full"
  * when `max_chunks` are used, but allows writing beyond this limit.
@@ -135,8 +132,8 @@ void Curl_bufq_initp(struct bufq *q, struct bufc_pool *pool,
                      size_t max_chunks, int opts);
 
 /**
- * Reset the buffer queue to be empty. Will keep any allocated buffer
- * chunks around.
+ * Reset the buffer queue to be empty. Keep any allocated buffer chunks
+ * around.
  */
 void Curl_bufq_reset(struct bufq *q);
 
@@ -150,14 +147,6 @@ void Curl_bufq_free(struct bufq *q);
  */
 size_t Curl_bufq_len(const struct bufq *q);
 
-/**
- * Return the total amount of free space in the queue.
- * The returned length is the number of bytes that can
- * be expected to be written successfully to the bufq,
- * providing no memory allocations fail.
- */
-size_t Curl_bufq_space(const struct bufq *q);
-
 /**
  * Returns TRUE iff there is no data in the buffer queue.
  */
@@ -171,21 +160,25 @@ bool Curl_bufq_is_full(const struct bufq *q);
 /**
  * Write buf to the end of the buffer queue. The buf is copied
  * and the amount of copied bytes is returned.
- * A return code of -1 indicates an error, setting `err` to the
- * cause. An err of CURLE_AGAIN is returned if the buffer queue is full.
+ * CURLE_AGAIN is returned if the buffer queue is full.
  */
-ssize_t Curl_bufq_write(struct bufq *q,
-                        const unsigned char *buf, size_t len,
-                        CURLcode *err);
+CURLcode Curl_bufq_write(struct bufq *q,
+                         const uint8_t *buf, size_t len,
+                         size_t *pnwritten);
+
+CURLcode Curl_bufq_cwrite(struct bufq *q,
+                          const char *buf, size_t len,
+                          size_t *pnwritten);
 
 /**
  * Read buf from the start of the buffer queue. The buf is copied
  * and the amount of copied bytes is returned.
- * A return code of -1 indicates an error, setting `err` to the
- * cause. An err of CURLE_AGAIN is returned if the buffer queue is empty.
  */
-ssize_t Curl_bufq_read(struct bufq *q, unsigned char *buf, size_t len,
-                        CURLcode *err);
+CURLcode Curl_bufq_read(struct bufq *q, uint8_t *buf, size_t len,
+                        size_t *pnread);
+
+CURLcode Curl_bufq_cread(struct bufq *q, char *buf, size_t len,
+                         size_t *pnread);
 
 /**
  * Peek at the head chunk in the buffer queue. Returns a pointer to
@@ -197,27 +190,21 @@ ssize_t Curl_bufq_read(struct bufq *q, unsigned char *buf, size_t len,
  * is modified, see `Curl_bufq_skip()``
  */
 bool Curl_bufq_peek(struct bufq *q,
-                    const unsigned char **pbuf, size_t *plen);
+                    const uint8_t **pbuf, size_t *plen);
 
 bool Curl_bufq_peek_at(struct bufq *q, size_t offset,
-                       const unsigned char **pbuf, size_t *plen);
+                       const uint8_t **pbuf, size_t *plen);
 
 /**
- * Tell the buffer queue to discard `amount` buf bytes at the head
- * of the queue. Skipping more buf than is currently buffered will
- * just empty the queue.
+ * Tell the buffer queue to discard `amount` buf bytes at the head of the
+ * queue. Skipping more buf than is currently buffered will empty the queue.
  */
 void Curl_bufq_skip(struct bufq *q, size_t amount);
 
-/**
- * Same as `skip` but shift tail data to the start afterwards,
- * so that further writes will find room in tail.
- */
-void Curl_bufq_skip_and_shift(struct bufq *q, size_t amount);
+typedef CURLcode Curl_bufq_writer(void *writer_ctx,
+                                  const uint8_t *buf, size_t len,
+                                  size_t *pwritten);
 
-typedef ssize_t Curl_bufq_writer(void *writer_ctx,
-                                 const unsigned char *buf, size_t len,
-                                 CURLcode *err);
 /**
  * Passes the chunks in the buffer queue to the writer and returns
  * the amount of buf written. A writer may return -1 and CURLE_AGAIN
@@ -227,24 +214,23 @@ typedef ssize_t Curl_bufq_writer(void *writer_ctx,
  * Note that in case of a -1 chunks may have been written and
  * the buffer queue will have different length than before.
  */
-ssize_t Curl_bufq_pass(struct bufq *q, Curl_bufq_writer *writer,
-                       void *writer_ctx, CURLcode *err);
+CURLcode Curl_bufq_pass(struct bufq *q, Curl_bufq_writer *writer,
+                        void *writer_ctx, size_t *pwritten);
 
-typedef ssize_t Curl_bufq_reader(void *reader_ctx,
-                                 unsigned char *buf, size_t len,
-                                 CURLcode *err);
+typedef CURLcode Curl_bufq_reader(void *reader_ctx,
+                                  uint8_t *buf, size_t len,
+                                  size_t *pnread);
 
 /**
- * Read date and append it to the end of the buffer queue until the
+ * Read bytes and append them to the end of the buffer queue until the
  * reader returns blocking or the queue is full. A reader returns
- * -1 and CURLE_AGAIN to indicate blocking.
- * Returns the total amount of buf read (may be 0) or -1 on other
- * reader errors.
- * Note that in case of a -1 chunks may have been read and
+ * CURLE_AGAIN to indicate blocking.
+ * Returns the total amount of buf read (may be 0) in `pnread` on success.
+ * Note that in case of an error chunks may have been read and
  * the buffer queue will have different length than before.
  */
-ssize_t Curl_bufq_slurp(struct bufq *q, Curl_bufq_reader *reader,
-                        void *reader_ctx, CURLcode *err);
+CURLcode Curl_bufq_slurp(struct bufq *q, Curl_bufq_reader *reader,
+                         void *reader_ctx, size_t *pnread);
 
 /**
  * Read *once* up to `max_len` bytes and append it to the buffer.
@@ -252,20 +238,20 @@ ssize_t Curl_bufq_slurp(struct bufq *q, Curl_bufq_reader *reader,
  * Returns the total amount of buf read (may be 0) or -1 on other
  * reader errors.
  */
-ssize_t Curl_bufq_sipn(struct bufq *q, size_t max_len,
-                       Curl_bufq_reader *reader, void *reader_ctx,
-                       CURLcode *err);
+CURLcode Curl_bufq_sipn(struct bufq *q, size_t max_len,
+                        Curl_bufq_reader *reader, void *reader_ctx,
+                        size_t *pnread);
 
 /**
  * Write buf to the end of the buffer queue.
- * Will write bufq content or passed `buf` directly using the `writer`
+ * Write bufq content or passed `buf` directly using the `writer`
  * callback when it sees fit. 'buf' might get passed directly
  * on or is placed into the buffer, depending on `len` and current
  * amount buffered, chunk size, etc.
  */
-ssize_t Curl_bufq_write_pass(struct bufq *q,
-                             const unsigned char *buf, size_t len,
-                             Curl_bufq_writer *writer, void *writer_ctx,
-                             CURLcode *err);
+CURLcode Curl_bufq_write_pass(struct bufq *q,
+                              const uint8_t *buf, size_t len,
+                              Curl_bufq_writer *writer, void *writer_ctx,
+                              size_t *pwritten);
 
 #endif /* HEADER_CURL_BUFQ_H */
diff --git a/third-party/curl/lib/bufref.c b/third-party/curl/lib/bufref.c
index ce686b6f37..50fafdac03 100644
--- a/third-party/curl/lib/bufref.c
+++ b/third-party/curl/lib/bufref.c
@@ -21,15 +21,15 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+
 #include "urldata.h"
 #include "bufref.h"
+#include "curlx/strdup.h"
 
-#include "curl_memory.h"
-#include "memdebug.h"
-
+#ifdef DEBUGBUILD
 #define SIGNATURE 0x5c48e9b2    /* Random pattern. */
+#endif
 
 /*
  * Init a bufref struct.
@@ -47,7 +47,7 @@ void Curl_bufref_init(struct bufref *br)
 }
 
 /*
- * Free the buffer and re-init the necessary fields. It doesn't touch the
+ * Free the buffer and re-init the necessary fields. It does not touch the
  * 'signature' field and thus this buffer reference can be reused.
  */
 
@@ -58,7 +58,7 @@ void Curl_bufref_free(struct bufref *br)
   DEBUGASSERT(br->ptr || !br->len);
 
   if(br->ptr && br->dtor)
-    br->dtor((void *) br->ptr);
+    br->dtor(CURL_UNCONST(br->ptr));
 
   br->dtor = NULL;
   br->ptr = NULL;
@@ -76,7 +76,7 @@ void Curl_bufref_set(struct bufref *br, const void *ptr, size_t len,
   DEBUGASSERT(len <= CURL_MAX_INPUT_LENGTH);
 
   Curl_bufref_free(br);
-  br->ptr = (const unsigned char *) ptr;
+  br->ptr = (const unsigned char *)ptr;
   br->len = len;
   br->dtor = dtor;
 }
@@ -84,7 +84,7 @@ void Curl_bufref_set(struct bufref *br, const void *ptr, size_t len,
 /*
  * Get a pointer to the referenced buffer.
  */
-const unsigned char *Curl_bufref_ptr(const struct bufref *br)
+const unsigned char *Curl_bufref_uptr(const struct bufref *br)
 {
   DEBUGASSERT(br);
   DEBUGASSERT(br->signature == SIGNATURE);
@@ -93,6 +93,18 @@ const unsigned char *Curl_bufref_ptr(const struct bufref *br)
   return br->ptr;
 }
 
+/*
+ * Get a pointer to the referenced string.
+ */
+const char *Curl_bufref_ptr(const struct bufref *br)
+{
+  DEBUGASSERT(br);
+  DEBUGASSERT(br->signature == SIGNATURE);
+  DEBUGASSERT(br->ptr || !br->len);
+
+  return (const char *)br->ptr;
+}
+
 /*
  * Get the length of the referenced buffer data.
  */
@@ -105,7 +117,7 @@ size_t Curl_bufref_len(const struct bufref *br)
   return br->len;
 }
 
-CURLcode Curl_bufref_memdup(struct bufref *br, const void *ptr, size_t len)
+CURLcode Curl_bufref_memdup0(struct bufref *br, const void *ptr, size_t len)
 {
   unsigned char *cpy = NULL;
 
@@ -116,12 +128,9 @@ CURLcode Curl_bufref_memdup(struct bufref *br, const void *ptr, size_t len)
   DEBUGASSERT(len <= CURL_MAX_INPUT_LENGTH);
 
   if(ptr) {
-    cpy = malloc(len + 1);
+    cpy = curlx_memdup0(ptr, len);
     if(!cpy)
       return CURLE_OUT_OF_MEMORY;
-    if(len)
-      memcpy(cpy, ptr, len);
-    cpy[len] = '\0';
   }
 
   Curl_bufref_set(br, cpy, len, curl_free);
diff --git a/third-party/curl/lib/bufref.h b/third-party/curl/lib/bufref.h
index dd424f18f5..5d331adbdf 100644
--- a/third-party/curl/lib/bufref.h
+++ b/third-party/curl/lib/bufref.h
@@ -36,13 +36,16 @@ struct bufref {
 #endif
 };
 
-
 void Curl_bufref_init(struct bufref *br);
 void Curl_bufref_set(struct bufref *br, const void *ptr, size_t len,
                      void (*dtor)(void *));
-const unsigned char *Curl_bufref_ptr(const struct bufref *br);
+const char *Curl_bufref_ptr(const struct bufref *br);
+const unsigned char *Curl_bufref_uptr(const struct bufref *br);
 size_t Curl_bufref_len(const struct bufref *br);
-CURLcode Curl_bufref_memdup(struct bufref *br, const void *ptr, size_t len);
+CURLcode Curl_bufref_memdup0(struct bufref *br, const void *ptr, size_t len);
 void Curl_bufref_free(struct bufref *br);
 
+/* return a strdup() version of the buffer */
+#define Curl_bufref_dup(x) curlx_strdup(Curl_bufref_ptr(x))
+
 #endif
diff --git a/third-party/curl/lib/c-hyper.c b/third-party/curl/lib/c-hyper.c
deleted file mode 100644
index 61ca29a3ac..0000000000
--- a/third-party/curl/lib/c-hyper.c
+++ /dev/null
@@ -1,1281 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#if !defined(CURL_DISABLE_HTTP) && defined(USE_HYPER)
-
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-#ifdef HAVE_NET_IF_H
-#include <net/if.h>
-#endif
-#ifdef HAVE_SYS_IOCTL_H
-#include <sys/ioctl.h>
-#endif
-
-#ifdef HAVE_SYS_PARAM_H
-#include <sys/param.h>
-#endif
-
-#include <hyper.h>
-#include "urldata.h"
-#include "sendf.h"
-#include "transfer.h"
-#include "multiif.h"
-#include "progress.h"
-#include "content_encoding.h"
-#include "ws.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-typedef enum {
-    USERDATA_NOT_SET = 0, /* for tasks with no userdata set; must be zero */
-    USERDATA_RESP_BODY
-} userdata_t;
-
-size_t Curl_hyper_recv(void *userp, hyper_context *ctx,
-                       uint8_t *buf, size_t buflen)
-{
-  struct Curl_easy *data = userp;
-  struct connectdata *conn = data->conn;
-  CURLcode result;
-  ssize_t nread;
-  DEBUGASSERT(conn);
-  (void)ctx;
-
-  DEBUGF(infof(data, "Curl_hyper_recv(%zu)", buflen));
-  result = Curl_read(data, conn->sockfd, (char *)buf, buflen, &nread);
-  if(result == CURLE_AGAIN) {
-    /* would block, register interest */
-    DEBUGF(infof(data, "Curl_hyper_recv(%zu) -> EAGAIN", buflen));
-    if(data->hyp.read_waker)
-      hyper_waker_free(data->hyp.read_waker);
-    data->hyp.read_waker = hyper_context_waker(ctx);
-    if(!data->hyp.read_waker) {
-      failf(data, "Couldn't make the read hyper_context_waker");
-      return HYPER_IO_ERROR;
-    }
-    return HYPER_IO_PENDING;
-  }
-  else if(result) {
-    failf(data, "Curl_read failed");
-    return HYPER_IO_ERROR;
-  }
-  DEBUGF(infof(data, "Curl_hyper_recv(%zu) -> %zd", buflen, nread));
-  return (size_t)nread;
-}
-
-size_t Curl_hyper_send(void *userp, hyper_context *ctx,
-                       const uint8_t *buf, size_t buflen)
-{
-  struct Curl_easy *data = userp;
-  struct connectdata *conn = data->conn;
-  CURLcode result;
-  ssize_t nwrote;
-
-  DEBUGF(infof(data, "Curl_hyper_send(%zu)", buflen));
-  result = Curl_write(data, conn->sockfd, (void *)buf, buflen, &nwrote);
-  if(!result && !nwrote)
-    result = CURLE_AGAIN;
-  if(result == CURLE_AGAIN) {
-    DEBUGF(infof(data, "Curl_hyper_send(%zu) -> EAGAIN", buflen));
-    /* would block, register interest */
-    if(data->hyp.write_waker)
-      hyper_waker_free(data->hyp.write_waker);
-    data->hyp.write_waker = hyper_context_waker(ctx);
-    if(!data->hyp.write_waker) {
-      failf(data, "Couldn't make the write hyper_context_waker");
-      return HYPER_IO_ERROR;
-    }
-    return HYPER_IO_PENDING;
-  }
-  else if(result) {
-    failf(data, "Curl_write failed");
-    return HYPER_IO_ERROR;
-  }
-  DEBUGF(infof(data, "Curl_hyper_send(%zu) -> %zd", buflen, nwrote));
-  return (size_t)nwrote;
-}
-
-static int hyper_each_header(void *userdata,
-                             const uint8_t *name,
-                             size_t name_len,
-                             const uint8_t *value,
-                             size_t value_len)
-{
-  struct Curl_easy *data = (struct Curl_easy *)userdata;
-  size_t len;
-  char *headp;
-  CURLcode result;
-  int writetype;
-
-  if(name_len + value_len + 2 > CURL_MAX_HTTP_HEADER) {
-    failf(data, "Too long response header");
-    data->state.hresult = CURLE_OUT_OF_MEMORY;
-    return HYPER_ITER_BREAK;
-  }
-
-  if(!data->req.bytecount)
-    Curl_pgrsTime(data, TIMER_STARTTRANSFER);
-
-  Curl_dyn_reset(&data->state.headerb);
-  if(name_len) {
-    if(Curl_dyn_addf(&data->state.headerb, "%.*s: %.*s\r\n",
-                     (int) name_len, name, (int) value_len, value))
-      return HYPER_ITER_BREAK;
-  }
-  else {
-    if(Curl_dyn_addn(&data->state.headerb, STRCONST("\r\n")))
-      return HYPER_ITER_BREAK;
-  }
-  len = Curl_dyn_len(&data->state.headerb);
-  headp = Curl_dyn_ptr(&data->state.headerb);
-
-  result = Curl_http_header(data, data->conn, headp);
-  if(result) {
-    data->state.hresult = result;
-    return HYPER_ITER_BREAK;
-  }
-
-  Curl_debug(data, CURLINFO_HEADER_IN, headp, len);
-
-  if(!data->state.hconnect || !data->set.suppress_connect_headers) {
-    writetype = CLIENTWRITE_HEADER;
-    if(data->set.include_header)
-      writetype |= CLIENTWRITE_BODY;
-    if(data->state.hconnect)
-      writetype |= CLIENTWRITE_CONNECT;
-    if(data->req.httpcode/100 == 1)
-      writetype |= CLIENTWRITE_1XX;
-    result = Curl_client_write(data, writetype, headp, len);
-    if(result) {
-      data->state.hresult = CURLE_ABORTED_BY_CALLBACK;
-      return HYPER_ITER_BREAK;
-    }
-  }
-
-  result = Curl_bump_headersize(data, len, FALSE);
-  if(result) {
-    data->state.hresult = result;
-    return HYPER_ITER_BREAK;
-  }
-  return HYPER_ITER_CONTINUE;
-}
-
-static int hyper_body_chunk(void *userdata, const hyper_buf *chunk)
-{
-  char *buf = (char *)hyper_buf_bytes(chunk);
-  size_t len = hyper_buf_len(chunk);
-  struct Curl_easy *data = (struct Curl_easy *)userdata;
-  struct SingleRequest *k = &data->req;
-  CURLcode result = CURLE_OK;
-
-  if(0 == k->bodywrites++) {
-    bool done = FALSE;
-#if defined(USE_NTLM)
-    struct connectdata *conn = data->conn;
-    if(conn->bits.close &&
-       (((data->req.httpcode == 401) &&
-         (conn->http_ntlm_state == NTLMSTATE_TYPE2)) ||
-        ((data->req.httpcode == 407) &&
-         (conn->proxy_ntlm_state == NTLMSTATE_TYPE2)))) {
-      infof(data, "Connection closed while negotiating NTLM");
-      data->state.authproblem = TRUE;
-      Curl_safefree(data->req.newurl);
-    }
-#endif
-    if(data->state.expect100header) {
-      Curl_expire_done(data, EXPIRE_100_TIMEOUT);
-      if(data->req.httpcode < 400) {
-        k->exp100 = EXP100_SEND_DATA;
-        if(data->hyp.exp100_waker) {
-          hyper_waker_wake(data->hyp.exp100_waker);
-          data->hyp.exp100_waker = NULL;
-        }
-      }
-      else { /* >= 4xx */
-        k->exp100 = EXP100_FAILED;
-      }
-    }
-    if(data->state.hconnect && (data->req.httpcode/100 != 2) &&
-       data->state.authproxy.done) {
-      done = TRUE;
-      result = CURLE_OK;
-    }
-    else
-      result = Curl_http_firstwrite(data, data->conn, &done);
-    if(result || done) {
-      infof(data, "Return early from hyper_body_chunk");
-      data->state.hresult = result;
-      return HYPER_ITER_BREAK;
-    }
-  }
-  if(k->ignorebody)
-    return HYPER_ITER_CONTINUE;
-  if(0 == len)
-    return HYPER_ITER_CONTINUE;
-  Curl_debug(data, CURLINFO_DATA_IN, buf, len);
-  if(!data->set.http_ce_skip && k->writer_stack)
-    /* content-encoded data */
-    result = Curl_unencode_write(data, k->writer_stack, buf, len);
-  else
-    result = Curl_client_write(data, CLIENTWRITE_BODY, buf, len);
-
-  if(result) {
-    data->state.hresult = result;
-    return HYPER_ITER_BREAK;
-  }
-
-  data->req.bytecount += len;
-  Curl_pgrsSetDownloadCounter(data, data->req.bytecount);
-  return HYPER_ITER_CONTINUE;
-}
-
-/*
- * Hyper does not consider the status line, the first line in an HTTP/1
- * response, to be a header. The libcurl API does. This function sends the
- * status line in the header callback. */
-static CURLcode status_line(struct Curl_easy *data,
-                            struct connectdata *conn,
-                            uint16_t http_status,
-                            int http_version,
-                            const uint8_t *reason, size_t rlen)
-{
-  CURLcode result;
-  size_t len;
-  const char *vstr;
-  int writetype;
-  vstr = http_version == HYPER_HTTP_VERSION_1_1 ? "1.1" :
-    (http_version == HYPER_HTTP_VERSION_2 ? "2" : "1.0");
-
-  /* We need to set 'httpcodeq' for functions that check the response code in
-     a single place. */
-  data->req.httpcode = http_status;
-
-  if(data->state.hconnect)
-    /* CONNECT */
-    data->info.httpproxycode = http_status;
-  else {
-    conn->httpversion =
-      http_version == HYPER_HTTP_VERSION_1_1 ? 11 :
-      (http_version == HYPER_HTTP_VERSION_2 ? 20 : 10);
-    if(http_version == HYPER_HTTP_VERSION_1_0)
-      data->state.httpwant = CURL_HTTP_VERSION_1_0;
-
-    result = Curl_http_statusline(data, conn);
-    if(result)
-      return result;
-  }
-
-  Curl_dyn_reset(&data->state.headerb);
-
-  result = Curl_dyn_addf(&data->state.headerb, "HTTP/%s %03d %.*s\r\n",
-                         vstr,
-                         (int)http_status,
-                         (int)rlen, reason);
-  if(result)
-    return result;
-  len = Curl_dyn_len(&data->state.headerb);
-  Curl_debug(data, CURLINFO_HEADER_IN, Curl_dyn_ptr(&data->state.headerb),
-             len);
-
-  if(!data->state.hconnect || !data->set.suppress_connect_headers) {
-    writetype = CLIENTWRITE_HEADER|CLIENTWRITE_STATUS;
-    if(data->set.include_header)
-      writetype |= CLIENTWRITE_BODY;
-    result = Curl_client_write(data, writetype,
-                               Curl_dyn_ptr(&data->state.headerb), len);
-    if(result)
-      return result;
-  }
-  result = Curl_bump_headersize(data, len, FALSE);
-  return result;
-}
-
-/*
- * Hyper does not pass on the last empty response header. The libcurl API
- * does. This function sends an empty header in the header callback.
- */
-static CURLcode empty_header(struct Curl_easy *data)
-{
-  CURLcode result = Curl_http_size(data);
-  if(!result) {
-    result = hyper_each_header(data, NULL, 0, NULL, 0) ?
-      CURLE_WRITE_ERROR : CURLE_OK;
-    if(result)
-      failf(data, "hyperstream: couldn't pass blank header");
-  }
-  return result;
-}
-
-CURLcode Curl_hyper_stream(struct Curl_easy *data,
-                           struct connectdata *conn,
-                           int *didwhat,
-                           bool *done,
-                           int select_res)
-{
-  hyper_response *resp = NULL;
-  uint16_t http_status;
-  int http_version;
-  hyper_headers *headers = NULL;
-  hyper_body *resp_body = NULL;
-  struct hyptransfer *h = &data->hyp;
-  hyper_task *task;
-  hyper_task *foreach;
-  const uint8_t *reasonp;
-  size_t reason_len;
-  CURLcode result = CURLE_OK;
-  struct SingleRequest *k = &data->req;
-  (void)conn;
-
-  if(k->exp100 > EXP100_SEND_DATA) {
-    struct curltime now = Curl_now();
-    timediff_t ms = Curl_timediff(now, k->start100);
-    if(ms >= data->set.expect_100_timeout) {
-      /* we've waited long enough, continue anyway */
-      k->exp100 = EXP100_SEND_DATA;
-      k->keepon |= KEEP_SEND;
-      Curl_expire_done(data, EXPIRE_100_TIMEOUT);
-      infof(data, "Done waiting for 100-continue");
-      if(data->hyp.exp100_waker) {
-        hyper_waker_wake(data->hyp.exp100_waker);
-        data->hyp.exp100_waker = NULL;
-      }
-    }
-  }
-
-  if(select_res & CURL_CSELECT_IN) {
-    if(h->read_waker)
-      hyper_waker_wake(h->read_waker);
-    h->read_waker = NULL;
-  }
-  if(select_res & CURL_CSELECT_OUT) {
-    if(h->write_waker)
-      hyper_waker_wake(h->write_waker);
-    h->write_waker = NULL;
-  }
-
-  *done = FALSE;
-  do {
-    hyper_task_return_type t;
-    task = hyper_executor_poll(h->exec);
-    if(!task) {
-      *didwhat = KEEP_RECV;
-      break;
-    }
-    t = hyper_task_type(task);
-    if(t == HYPER_TASK_ERROR) {
-      hyper_error *hypererr = hyper_task_value(task);
-      hyper_task_free(task);
-      if(data->state.hresult) {
-        /* override Hyper's view, might not even be an error */
-        result = data->state.hresult;
-        infof(data, "hyperstream is done (by early callback)");
-      }
-      else {
-        uint8_t errbuf[256];
-        size_t errlen = hyper_error_print(hypererr, errbuf, sizeof(errbuf));
-        hyper_code code = hyper_error_code(hypererr);
-        failf(data, "Hyper: [%d] %.*s", (int)code, (int)errlen, errbuf);
-        switch(code) {
-        case HYPERE_ABORTED_BY_CALLBACK:
-          result = CURLE_OK;
-          break;
-        case HYPERE_UNEXPECTED_EOF:
-          if(!data->req.bytecount)
-            result = CURLE_GOT_NOTHING;
-          else
-            result = CURLE_RECV_ERROR;
-          break;
-        case HYPERE_INVALID_PEER_MESSAGE:
-          /* bump headerbytecount to avoid the count remaining at zero and
-             appearing to not having read anything from the peer at all */
-          data->req.headerbytecount++;
-          result = CURLE_UNSUPPORTED_PROTOCOL; /* maybe */
-          break;
-        default:
-          result = CURLE_RECV_ERROR;
-          break;
-        }
-      }
-      *done = TRUE;
-      hyper_error_free(hypererr);
-      break;
-    }
-    else if(t == HYPER_TASK_EMPTY) {
-      void *userdata = hyper_task_userdata(task);
-      hyper_task_free(task);
-      if((userdata_t)userdata == USERDATA_RESP_BODY) {
-        /* end of transfer */
-        *done = TRUE;
-        infof(data, "hyperstream is done");
-        if(!k->bodywrites) {
-          /* hyper doesn't always call the body write callback */
-          bool stilldone;
-          result = Curl_http_firstwrite(data, data->conn, &stilldone);
-        }
-        break;
-      }
-      else {
-        /* A background task for hyper; ignore */
-        continue;
-      }
-    }
-
-    DEBUGASSERT(HYPER_TASK_RESPONSE);
-
-    resp = hyper_task_value(task);
-    hyper_task_free(task);
-
-    *didwhat = KEEP_RECV;
-    if(!resp) {
-      failf(data, "hyperstream: couldn't get response");
-      return CURLE_RECV_ERROR;
-    }
-
-    http_status = hyper_response_status(resp);
-    http_version = hyper_response_version(resp);
-    reasonp = hyper_response_reason_phrase(resp);
-    reason_len = hyper_response_reason_phrase_len(resp);
-
-    if(http_status == 417 && data->state.expect100header) {
-      infof(data, "Got 417 while waiting for a 100");
-      data->state.disableexpect = TRUE;
-      data->req.newurl = strdup(data->state.url);
-      Curl_done_sending(data, k);
-    }
-
-    result = status_line(data, conn,
-                         http_status, http_version, reasonp, reason_len);
-    if(result)
-      break;
-
-    headers = hyper_response_headers(resp);
-    if(!headers) {
-      failf(data, "hyperstream: couldn't get response headers");
-      result = CURLE_RECV_ERROR;
-      break;
-    }
-
-    /* the headers are already received */
-    hyper_headers_foreach(headers, hyper_each_header, data);
-    if(data->state.hresult) {
-      result = data->state.hresult;
-      break;
-    }
-
-    result = empty_header(data);
-    if(result)
-      break;
-
-    k->deductheadercount =
-      (100 <= http_status && 199 >= http_status)?k->headerbytecount:0;
-#ifdef USE_WEBSOCKETS
-    if(k->upgr101 == UPGR101_WS) {
-      if(http_status == 101) {
-        /* verify the response */
-        result = Curl_ws_accept(data, NULL, 0);
-        if(result)
-          return result;
-      }
-      else {
-        failf(data, "Expected 101, got %u", k->httpcode);
-        result = CURLE_HTTP_RETURNED_ERROR;
-        break;
-      }
-    }
-#endif
-
-    /* Curl_http_auth_act() checks what authentication methods that are
-     * available and decides which one (if any) to use. It will set 'newurl'
-     * if an auth method was picked. */
-    result = Curl_http_auth_act(data);
-    if(result)
-      break;
-
-    resp_body = hyper_response_body(resp);
-    if(!resp_body) {
-      failf(data, "hyperstream: couldn't get response body");
-      result = CURLE_RECV_ERROR;
-      break;
-    }
-    foreach = hyper_body_foreach(resp_body, hyper_body_chunk, data);
-    if(!foreach) {
-      failf(data, "hyperstream: body foreach failed");
-      result = CURLE_OUT_OF_MEMORY;
-      break;
-    }
-    hyper_task_set_userdata(foreach, (void *)USERDATA_RESP_BODY);
-    if(HYPERE_OK != hyper_executor_push(h->exec, foreach)) {
-      failf(data, "Couldn't hyper_executor_push the body-foreach");
-      result = CURLE_OUT_OF_MEMORY;
-      break;
-    }
-
-    hyper_response_free(resp);
-    resp = NULL;
-  } while(1);
-  if(resp)
-    hyper_response_free(resp);
-  return result;
-}
-
-static CURLcode debug_request(struct Curl_easy *data,
-                              const char *method,
-                              const char *path,
-                              bool h2)
-{
-  char *req = aprintf("%s %s HTTP/%s\r\n", method, path,
-                      h2?"2":"1.1");
-  if(!req)
-    return CURLE_OUT_OF_MEMORY;
-  Curl_debug(data, CURLINFO_HEADER_OUT, req, strlen(req));
-  free(req);
-  return CURLE_OK;
-}
-
-/*
- * Given a full header line "name: value" (optional CRLF in the input, should
- * be in the output), add to Hyper and send to the debug callback.
- *
- * Supports multiple headers.
- */
-
-CURLcode Curl_hyper_header(struct Curl_easy *data, hyper_headers *headers,
-                           const char *line)
-{
-  const char *p;
-  const char *n;
-  size_t nlen;
-  const char *v;
-  size_t vlen;
-  bool newline = TRUE;
-  int numh = 0;
-
-  if(!line)
-    return CURLE_OK;
-  n = line;
-  do {
-    size_t linelen = 0;
-
-    p = strchr(n, ':');
-    if(!p)
-      /* this is fine if we already added at least one header */
-      return numh ? CURLE_OK : CURLE_BAD_FUNCTION_ARGUMENT;
-    nlen = p - n;
-    p++; /* move past the colon */
-    while(*p == ' ')
-      p++;
-    v = p;
-    p = strchr(v, '\r');
-    if(!p) {
-      p = strchr(v, '\n');
-      if(p)
-        linelen = 1; /* LF only */
-      else {
-        p = strchr(v, '\0');
-        newline = FALSE; /* no newline */
-      }
-    }
-    else
-      linelen = 2; /* CRLF ending */
-    linelen += (p - n);
-    vlen = p - v;
-
-    if(HYPERE_OK != hyper_headers_add(headers, (uint8_t *)n, nlen,
-                                      (uint8_t *)v, vlen)) {
-      failf(data, "hyper refused to add header '%s'", line);
-      return CURLE_OUT_OF_MEMORY;
-    }
-    if(data->set.verbose) {
-      char *ptr = NULL;
-      if(!newline) {
-        ptr = aprintf("%.*s\r\n", (int)linelen, line);
-        if(!ptr)
-          return CURLE_OUT_OF_MEMORY;
-        Curl_debug(data, CURLINFO_HEADER_OUT, ptr, linelen + 2);
-        free(ptr);
-      }
-      else
-        Curl_debug(data, CURLINFO_HEADER_OUT, (char *)n, linelen);
-    }
-    numh++;
-    n += linelen;
-  } while(newline);
-  return CURLE_OK;
-}
-
-static CURLcode request_target(struct Curl_easy *data,
-                               struct connectdata *conn,
-                               const char *method,
-                               bool h2,
-                               hyper_request *req)
-{
-  CURLcode result;
-  struct dynbuf r;
-
-  Curl_dyn_init(&r, DYN_HTTP_REQUEST);
-
-  result = Curl_http_target(data, conn, &r);
-  if(result)
-    return result;
-
-  if(h2 && hyper_request_set_uri_parts(req,
-                                       /* scheme */
-                                       (uint8_t *)data->state.up.scheme,
-                                       strlen(data->state.up.scheme),
-                                       /* authority */
-                                       (uint8_t *)conn->host.name,
-                                       strlen(conn->host.name),
-                                       /* path_and_query */
-                                       (uint8_t *)Curl_dyn_uptr(&r),
-                                       Curl_dyn_len(&r))) {
-    failf(data, "error setting uri parts to hyper");
-    result = CURLE_OUT_OF_MEMORY;
-  }
-  else if(!h2 && hyper_request_set_uri(req, (uint8_t *)Curl_dyn_uptr(&r),
-                                       Curl_dyn_len(&r))) {
-    failf(data, "error setting uri to hyper");
-    result = CURLE_OUT_OF_MEMORY;
-  }
-  else
-    result = debug_request(data, method, Curl_dyn_ptr(&r), h2);
-
-  Curl_dyn_free(&r);
-
-  return result;
-}
-
-static int uploadpostfields(void *userdata, hyper_context *ctx,
-                            hyper_buf **chunk)
-{
-  struct Curl_easy *data = (struct Curl_easy *)userdata;
-  (void)ctx;
-  if(data->req.exp100 > EXP100_SEND_DATA) {
-    if(data->req.exp100 == EXP100_FAILED)
-      return HYPER_POLL_ERROR;
-
-    /* still waiting confirmation */
-    if(data->hyp.exp100_waker)
-      hyper_waker_free(data->hyp.exp100_waker);
-    data->hyp.exp100_waker = hyper_context_waker(ctx);
-    return HYPER_POLL_PENDING;
-  }
-  if(data->req.upload_done)
-    *chunk = NULL; /* nothing more to deliver */
-  else {
-    /* send everything off in a single go */
-    hyper_buf *copy = hyper_buf_copy(data->set.postfields,
-                                     (size_t)data->req.p.http->postsize);
-    if(copy)
-      *chunk = copy;
-    else {
-      data->state.hresult = CURLE_OUT_OF_MEMORY;
-      return HYPER_POLL_ERROR;
-    }
-    /* increasing the writebytecount here is a little premature but we
-       don't know exactly when the body is sent */
-    data->req.writebytecount += (size_t)data->req.p.http->postsize;
-    Curl_pgrsSetUploadCounter(data, data->req.writebytecount);
-    data->req.upload_done = TRUE;
-  }
-  return HYPER_POLL_READY;
-}
-
-static int uploadstreamed(void *userdata, hyper_context *ctx,
-                          hyper_buf **chunk)
-{
-  size_t fillcount;
-  struct Curl_easy *data = (struct Curl_easy *)userdata;
-  struct connectdata *conn = (struct connectdata *)data->conn;
-  CURLcode result;
-  (void)ctx;
-
-  if(data->req.exp100 > EXP100_SEND_DATA) {
-    if(data->req.exp100 == EXP100_FAILED)
-      return HYPER_POLL_ERROR;
-
-    /* still waiting confirmation */
-    if(data->hyp.exp100_waker)
-      hyper_waker_free(data->hyp.exp100_waker);
-    data->hyp.exp100_waker = hyper_context_waker(ctx);
-    return HYPER_POLL_PENDING;
-  }
-
-  if(data->req.upload_chunky && conn->bits.authneg) {
-    fillcount = 0;
-    data->req.upload_chunky = FALSE;
-    result = CURLE_OK;
-  }
-  else {
-    result = Curl_fillreadbuffer(data, data->set.upload_buffer_size,
-                                 &fillcount);
-  }
-  if(result) {
-    data->state.hresult = result;
-    return HYPER_POLL_ERROR;
-  }
-  if(!fillcount) {
-    if((data->req.keepon & KEEP_SEND_PAUSE) != KEEP_SEND_PAUSE)
-      /* done! */
-      *chunk = NULL;
-    else {
-      /* paused, save a waker */
-      if(data->hyp.send_body_waker)
-        hyper_waker_free(data->hyp.send_body_waker);
-      data->hyp.send_body_waker = hyper_context_waker(ctx);
-      return HYPER_POLL_PENDING;
-    }
-  }
-  else {
-    hyper_buf *copy = hyper_buf_copy((uint8_t *)data->state.ulbuf, fillcount);
-    if(copy)
-      *chunk = copy;
-    else {
-      data->state.hresult = CURLE_OUT_OF_MEMORY;
-      return HYPER_POLL_ERROR;
-    }
-    /* increasing the writebytecount here is a little premature but we
-       don't know exactly when the body is sent */
-    data->req.writebytecount += fillcount;
-    Curl_pgrsSetUploadCounter(data, data->req.writebytecount);
-  }
-  return HYPER_POLL_READY;
-}
-
-/*
- * bodysend() sets up headers in the outgoing request for an HTTP transfer that
- * sends a body
- */
-
-static CURLcode bodysend(struct Curl_easy *data,
-                         struct connectdata *conn,
-                         hyper_headers *headers,
-                         hyper_request *hyperreq,
-                         Curl_HttpReq httpreq)
-{
-  struct HTTP *http = data->req.p.http;
-  CURLcode result = CURLE_OK;
-  struct dynbuf req;
-  if((httpreq == HTTPREQ_GET) || (httpreq == HTTPREQ_HEAD))
-    Curl_pgrsSetUploadSize(data, 0); /* no request body */
-  else {
-    hyper_body *body;
-    Curl_dyn_init(&req, DYN_HTTP_REQUEST);
-    result = Curl_http_bodysend(data, conn, &req, httpreq);
-
-    if(!result)
-      result = Curl_hyper_header(data, headers, Curl_dyn_ptr(&req));
-
-    Curl_dyn_free(&req);
-
-    body = hyper_body_new();
-    hyper_body_set_userdata(body, data);
-    if(data->set.postfields)
-      hyper_body_set_data_func(body, uploadpostfields);
-    else {
-      result = Curl_get_upload_buffer(data);
-      if(result) {
-        hyper_body_free(body);
-        return result;
-      }
-      /* init the "upload from here" pointer */
-      data->req.upload_fromhere = data->state.ulbuf;
-      hyper_body_set_data_func(body, uploadstreamed);
-    }
-    if(HYPERE_OK != hyper_request_set_body(hyperreq, body)) {
-      /* fail */
-      result = CURLE_OUT_OF_MEMORY;
-    }
-  }
-  http->sending = HTTPSEND_BODY;
-  return result;
-}
-
-static CURLcode cookies(struct Curl_easy *data,
-                        struct connectdata *conn,
-                        hyper_headers *headers)
-{
-  struct dynbuf req;
-  CURLcode result;
-  Curl_dyn_init(&req, DYN_HTTP_REQUEST);
-
-  result = Curl_http_cookies(data, conn, &req);
-  if(!result)
-    result = Curl_hyper_header(data, headers, Curl_dyn_ptr(&req));
-  Curl_dyn_free(&req);
-  return result;
-}
-
-/* called on 1xx responses */
-static void http1xx_cb(void *arg, struct hyper_response *resp)
-{
-  struct Curl_easy *data = (struct Curl_easy *)arg;
-  hyper_headers *headers = NULL;
-  CURLcode result = CURLE_OK;
-  uint16_t http_status;
-  int http_version;
-  const uint8_t *reasonp;
-  size_t reason_len;
-
-  infof(data, "Got HTTP 1xx informational");
-
-  http_status = hyper_response_status(resp);
-  http_version = hyper_response_version(resp);
-  reasonp = hyper_response_reason_phrase(resp);
-  reason_len = hyper_response_reason_phrase_len(resp);
-
-  result = status_line(data, data->conn,
-                       http_status, http_version, reasonp, reason_len);
-  if(!result) {
-    headers = hyper_response_headers(resp);
-    if(!headers) {
-      failf(data, "hyperstream: couldn't get 1xx response headers");
-      result = CURLE_RECV_ERROR;
-    }
-  }
-  data->state.hresult = result;
-
-  if(!result) {
-    /* the headers are already received */
-    hyper_headers_foreach(headers, hyper_each_header, data);
-    /* this callback also sets data->state.hresult on error */
-
-    if(empty_header(data))
-      result = CURLE_OUT_OF_MEMORY;
-  }
-
-  if(data->state.hresult)
-    infof(data, "ERROR in 1xx, bail out");
-}
-
-/*
- * Curl_http() gets called from the generic multi_do() function when an HTTP
- * request is to be performed. This creates and sends a properly constructed
- * HTTP request.
- */
-CURLcode Curl_http(struct Curl_easy *data, bool *done)
-{
-  struct connectdata *conn = data->conn;
-  struct hyptransfer *h = &data->hyp;
-  hyper_io *io = NULL;
-  hyper_clientconn_options *options = NULL;
-  hyper_task *task = NULL; /* for the handshake */
-  hyper_task *sendtask = NULL; /* for the send */
-  hyper_clientconn *client = NULL;
-  hyper_request *req = NULL;
-  hyper_headers *headers = NULL;
-  hyper_task *handshake = NULL;
-  CURLcode result;
-  const char *p_accept; /* Accept: string */
-  const char *method;
-  Curl_HttpReq httpreq;
-  bool h2 = FALSE;
-  const char *te = NULL; /* transfer-encoding */
-  hyper_code rc;
-
-  /* Always consider the DO phase done after this function call, even if there
-     may be parts of the request that is not yet sent, since we can deal with
-     the rest of the request in the PERFORM phase. */
-  *done = TRUE;
-
-  infof(data, "Time for the Hyper dance");
-  memset(h, 0, sizeof(struct hyptransfer));
-
-  result = Curl_http_host(data, conn);
-  if(result)
-    return result;
-
-  Curl_http_method(data, conn, &method, &httpreq);
-
-  /* setup the authentication headers */
-  {
-    char *pq = NULL;
-    if(data->state.up.query) {
-      pq = aprintf("%s?%s", data->state.up.path, data->state.up.query);
-      if(!pq)
-        return CURLE_OUT_OF_MEMORY;
-    }
-    result = Curl_http_output_auth(data, conn, method, httpreq,
-                                   (pq ? pq : data->state.up.path), FALSE);
-    free(pq);
-    if(result)
-      return result;
-  }
-
-  result = Curl_http_resume(data, conn, httpreq);
-  if(result)
-    return result;
-
-  result = Curl_http_range(data, httpreq);
-  if(result)
-    return result;
-
-  result = Curl_http_useragent(data);
-  if(result)
-    return result;
-
-  io = hyper_io_new();
-  if(!io) {
-    failf(data, "Couldn't create hyper IO");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-  /* tell Hyper how to read/write network data */
-  hyper_io_set_userdata(io, data);
-  hyper_io_set_read(io, Curl_hyper_recv);
-  hyper_io_set_write(io, Curl_hyper_send);
-
-  /* create an executor to poll futures */
-  if(!h->exec) {
-    h->exec = hyper_executor_new();
-    if(!h->exec) {
-      failf(data, "Couldn't create hyper executor");
-      result = CURLE_OUT_OF_MEMORY;
-      goto error;
-    }
-  }
-
-  options = hyper_clientconn_options_new();
-  if(!options) {
-    failf(data, "Couldn't create hyper client options");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-  if(conn->alpn == CURL_HTTP_VERSION_2) {
-    hyper_clientconn_options_http2(options, 1);
-    h2 = TRUE;
-  }
-  hyper_clientconn_options_set_preserve_header_case(options, 1);
-  hyper_clientconn_options_set_preserve_header_order(options, 1);
-  hyper_clientconn_options_http1_allow_multiline_headers(options, 1);
-
-  hyper_clientconn_options_exec(options, h->exec);
-
-  /* "Both the `io` and the `options` are consumed in this function call" */
-  handshake = hyper_clientconn_handshake(io, options);
-  if(!handshake) {
-    failf(data, "Couldn't create hyper client handshake");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-  io = NULL;
-  options = NULL;
-
-  if(HYPERE_OK != hyper_executor_push(h->exec, handshake)) {
-    failf(data, "Couldn't hyper_executor_push the handshake");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-  handshake = NULL; /* ownership passed on */
-
-  task = hyper_executor_poll(h->exec);
-  if(!task) {
-    failf(data, "Couldn't hyper_executor_poll the handshake");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-
-  client = hyper_task_value(task);
-  hyper_task_free(task);
-
-  req = hyper_request_new();
-  if(!req) {
-    failf(data, "Couldn't hyper_request_new");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-
-  if(!Curl_use_http_1_1plus(data, conn)) {
-    if(HYPERE_OK != hyper_request_set_version(req,
-                                              HYPER_HTTP_VERSION_1_0)) {
-      failf(data, "error setting HTTP version");
-      result = CURLE_OUT_OF_MEMORY;
-      goto error;
-    }
-  }
-  else {
-    if(!h2 && !data->state.disableexpect) {
-      data->state.expect100header = TRUE;
-    }
-  }
-
-  if(hyper_request_set_method(req, (uint8_t *)method, strlen(method))) {
-    failf(data, "error setting method");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-
-  result = request_target(data, conn, method, h2, req);
-  if(result)
-    goto error;
-
-  headers = hyper_request_headers(req);
-  if(!headers) {
-    failf(data, "hyper_request_headers");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-
-  rc = hyper_request_on_informational(req, http1xx_cb, data);
-  if(rc) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-
-  result = Curl_http_body(data, conn, httpreq, &te);
-  if(result)
-    goto error;
-
-  if(!h2) {
-    if(data->state.aptr.host) {
-      result = Curl_hyper_header(data, headers, data->state.aptr.host);
-      if(result)
-        goto error;
-    }
-  }
-  else {
-    /* For HTTP/2, we show the Host: header as if we sent it, to make it look
-       like for HTTP/1 but it isn't actually sent since :authority is then
-       used. */
-    Curl_debug(data, CURLINFO_HEADER_OUT, data->state.aptr.host,
-               strlen(data->state.aptr.host));
-  }
-
-  if(data->state.aptr.proxyuserpwd) {
-    result = Curl_hyper_header(data, headers, data->state.aptr.proxyuserpwd);
-    if(result)
-      goto error;
-  }
-
-  if(data->state.aptr.userpwd) {
-    result = Curl_hyper_header(data, headers, data->state.aptr.userpwd);
-    if(result)
-      goto error;
-  }
-
-  if((data->state.use_range && data->state.aptr.rangeline)) {
-    result = Curl_hyper_header(data, headers, data->state.aptr.rangeline);
-    if(result)
-      goto error;
-  }
-
-  if(data->set.str[STRING_USERAGENT] &&
-     *data->set.str[STRING_USERAGENT] &&
-     data->state.aptr.uagent) {
-    result = Curl_hyper_header(data, headers, data->state.aptr.uagent);
-    if(result)
-      goto error;
-  }
-
-  p_accept = Curl_checkheaders(data,
-                               STRCONST("Accept"))?NULL:"Accept: */*\r\n";
-  if(p_accept) {
-    result = Curl_hyper_header(data, headers, p_accept);
-    if(result)
-      goto error;
-  }
-  if(te) {
-    result = Curl_hyper_header(data, headers, te);
-    if(result)
-      goto error;
-  }
-
-#ifndef CURL_DISABLE_ALTSVC
-  if(conn->bits.altused && !Curl_checkheaders(data, STRCONST("Alt-Used"))) {
-    char *altused = aprintf("Alt-Used: %s:%d\r\n",
-                            conn->conn_to_host.name, conn->conn_to_port);
-    if(!altused) {
-      result = CURLE_OUT_OF_MEMORY;
-      goto error;
-    }
-    result = Curl_hyper_header(data, headers, altused);
-    if(result)
-      goto error;
-    free(altused);
-  }
-#endif
-
-#ifndef CURL_DISABLE_PROXY
-  if(conn->bits.httpproxy && !conn->bits.tunnel_proxy &&
-     !Curl_checkheaders(data, STRCONST("Proxy-Connection")) &&
-     !Curl_checkProxyheaders(data, conn, STRCONST("Proxy-Connection"))) {
-    result = Curl_hyper_header(data, headers, "Proxy-Connection: Keep-Alive");
-    if(result)
-      goto error;
-  }
-#endif
-
-  Curl_safefree(data->state.aptr.ref);
-  if(data->state.referer && !Curl_checkheaders(data, STRCONST("Referer"))) {
-    data->state.aptr.ref = aprintf("Referer: %s\r\n", data->state.referer);
-    if(!data->state.aptr.ref)
-      result = CURLE_OUT_OF_MEMORY;
-    else
-      result = Curl_hyper_header(data, headers, data->state.aptr.ref);
-    if(result)
-      goto error;
-  }
-
-#ifdef HAVE_LIBZ
-  /* we only consider transfer-encoding magic if libz support is built-in */
-  result = Curl_transferencode(data);
-  if(result)
-    goto error;
-  result = Curl_hyper_header(data, headers, data->state.aptr.te);
-  if(result)
-    goto error;
-#endif
-
-  if(!Curl_checkheaders(data, STRCONST("Accept-Encoding")) &&
-     data->set.str[STRING_ENCODING]) {
-    Curl_safefree(data->state.aptr.accept_encoding);
-    data->state.aptr.accept_encoding =
-      aprintf("Accept-Encoding: %s\r\n", data->set.str[STRING_ENCODING]);
-    if(!data->state.aptr.accept_encoding)
-      result = CURLE_OUT_OF_MEMORY;
-    else
-      result = Curl_hyper_header(data, headers,
-                                 data->state.aptr.accept_encoding);
-    if(result)
-      goto error;
-  }
-  else
-    Curl_safefree(data->state.aptr.accept_encoding);
-
-  result = cookies(data, conn, headers);
-  if(result)
-    goto error;
-
-  if(!result && conn->handler->protocol&(CURLPROTO_WS|CURLPROTO_WSS))
-    result = Curl_ws_request(data, headers);
-
-  result = Curl_add_timecondition(data, headers);
-  if(result)
-    goto error;
-
-  result = Curl_add_custom_headers(data, FALSE, headers);
-  if(result)
-    goto error;
-
-  result = bodysend(data, conn, headers, req, httpreq);
-  if(result)
-    goto error;
-
-  Curl_debug(data, CURLINFO_HEADER_OUT, (char *)"\r\n", 2);
-
-  if(data->req.upload_chunky && conn->bits.authneg) {
-    data->req.upload_chunky = TRUE;
-  }
-  else {
-    data->req.upload_chunky = FALSE;
-  }
-  sendtask = hyper_clientconn_send(client, req);
-  if(!sendtask) {
-    failf(data, "hyper_clientconn_send");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-  req = NULL;
-
-  if(HYPERE_OK != hyper_executor_push(h->exec, sendtask)) {
-    failf(data, "Couldn't hyper_executor_push the send");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-  sendtask = NULL; /* ownership passed on */
-
-  hyper_clientconn_free(client);
-  client = NULL;
-
-  if((httpreq == HTTPREQ_GET) || (httpreq == HTTPREQ_HEAD)) {
-    /* HTTP GET/HEAD download */
-    Curl_pgrsSetUploadSize(data, 0); /* nothing */
-    Curl_setup_transfer(data, FIRSTSOCKET, -1, TRUE, -1);
-  }
-  conn->datastream = Curl_hyper_stream;
-  if(data->state.expect100header)
-    /* Timeout count starts now since with Hyper we don't know exactly when
-       the full request has been sent. */
-    data->req.start100 = Curl_now();
-
-  /* clear userpwd and proxyuserpwd to avoid reusing old credentials
-   * from reused connections */
-  Curl_safefree(data->state.aptr.userpwd);
-  Curl_safefree(data->state.aptr.proxyuserpwd);
-  return CURLE_OK;
-error:
-  DEBUGASSERT(result);
-  if(io)
-    hyper_io_free(io);
-
-  if(options)
-    hyper_clientconn_options_free(options);
-
-  if(handshake)
-    hyper_task_free(handshake);
-
-  if(client)
-    hyper_clientconn_free(client);
-
-  if(req)
-    hyper_request_free(req);
-
-  return result;
-}
-
-void Curl_hyper_done(struct Curl_easy *data)
-{
-  struct hyptransfer *h = &data->hyp;
-  if(h->exec) {
-    hyper_executor_free(h->exec);
-    h->exec = NULL;
-  }
-  if(h->read_waker) {
-    hyper_waker_free(h->read_waker);
-    h->read_waker = NULL;
-  }
-  if(h->write_waker) {
-    hyper_waker_free(h->write_waker);
-    h->write_waker = NULL;
-  }
-  if(h->exp100_waker) {
-    hyper_waker_free(h->exp100_waker);
-    h->exp100_waker = NULL;
-  }
-}
-
-#endif /* !defined(CURL_DISABLE_HTTP) && defined(USE_HYPER) */
diff --git a/third-party/curl/lib/c-hyper.h b/third-party/curl/lib/c-hyper.h
deleted file mode 100644
index 0c7de90b70..0000000000
--- a/third-party/curl/lib/c-hyper.h
+++ /dev/null
@@ -1,59 +0,0 @@
-#ifndef HEADER_CURL_HYPER_H
-#define HEADER_CURL_HYPER_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "curl_setup.h"
-
-#if !defined(CURL_DISABLE_HTTP) && defined(USE_HYPER)
-
-#include <hyper.h>
-
-/* per-transfer data for the Hyper backend */
-struct hyptransfer {
-  hyper_waker *write_waker;
-  hyper_waker *read_waker;
-  const hyper_executor *exec;
-  hyper_waker *exp100_waker;
-  hyper_waker *send_body_waker;
-};
-
-size_t Curl_hyper_recv(void *userp, hyper_context *ctx,
-                       uint8_t *buf, size_t buflen);
-size_t Curl_hyper_send(void *userp, hyper_context *ctx,
-                       const uint8_t *buf, size_t buflen);
-CURLcode Curl_hyper_stream(struct Curl_easy *data,
-                           struct connectdata *conn,
-                           int *didwhat,
-                           bool *done,
-                           int select_res);
-
-CURLcode Curl_hyper_header(struct Curl_easy *data, hyper_headers *headers,
-                           const char *line);
-void Curl_hyper_done(struct Curl_easy *);
-
-#else
-#define Curl_hyper_done(x)
-
-#endif /* !defined(CURL_DISABLE_HTTP) && defined(USE_HYPER) */
-#endif /* HEADER_CURL_HYPER_H */
diff --git a/third-party/curl/lib/cf-dns.c b/third-party/curl/lib/cf-dns.c
new file mode 100644
index 0000000000..631c987be2
--- /dev/null
+++ b/third-party/curl/lib/cf-dns.c
@@ -0,0 +1,596 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "urldata.h"
+#include "curl_addrinfo.h"
+#include "cfilters.h"
+#include "connect.h"
+#include "dnscache.h"
+#include "httpsrr.h"
+#include "curl_trc.h"
+#include "progress.h"
+#include "url.h"
+#include "cf-dns.h"
+
+
+struct cf_dns_ctx {
+  struct Curl_dns_entry *dns;
+  struct Curl_peer *peer;
+  CURLcode resolv_result;
+  uint32_t resolv_id;
+  uint8_t dns_queries;
+  uint8_t transport;
+  BIT(started);
+  BIT(announced);
+  BIT(complete_resolve);
+  BIT(for_proxy);
+};
+
+static struct cf_dns_ctx *cf_dns_ctx_create(struct Curl_easy *data,
+                                            struct Curl_peer *peer,
+                                            uint8_t dns_queries,
+                                            uint8_t transport,
+                                            bool for_proxy,
+                                            bool complete_resolve)
+{
+  struct cf_dns_ctx *ctx;
+
+  ctx = curlx_calloc(1, sizeof(*ctx));
+  if(!ctx)
+    return NULL;
+
+  Curl_peer_link(&ctx->peer, peer);
+  ctx->dns_queries = dns_queries;
+  ctx->transport = transport;
+  ctx->for_proxy = for_proxy;
+  ctx->complete_resolve = complete_resolve;
+
+  CURL_TRC_DNS(data, "created DNS filter for %s:%u, transport=%x, queries=%x",
+               peer->hostname, peer->port, ctx->transport, ctx->dns_queries);
+  return ctx;
+}
+
+static void cf_dns_ctx_destroy(struct Curl_easy *data,
+                               struct cf_dns_ctx *ctx)
+{
+  if(ctx) {
+    Curl_peer_unlink(&ctx->peer);
+    Curl_dns_entry_unlink(data, &ctx->dns);
+    curlx_free(ctx);
+  }
+}
+
+#ifdef CURLVERBOSE
+static void cf_dns_report_addr(struct Curl_easy *data,
+                               struct dynbuf *tmp,
+                               const char *label,
+                               int ai_family,
+                               const struct Curl_addrinfo *ai)
+{
+  char buf[MAX_IPADR_LEN];
+  const char *sep = "";
+  CURLcode result;
+
+  curlx_dyn_reset(tmp);
+  for(; ai; ai = ai->ai_next) {
+    if(ai->ai_family == ai_family) {
+      Curl_printable_address(ai, buf, sizeof(buf));
+      result = curlx_dyn_addf(tmp, "%s%s", sep, buf);
+      if(result) {
+        infof(data, "too many IP, cannot show");
+        return;
+      }
+      sep = ", ";
+    }
+  }
+
+  infof(data, "%s%s", label,
+        (curlx_dyn_len(tmp) ? curlx_dyn_ptr(tmp) : "(none)"));
+}
+
+static void cf_dns_report(struct Curl_cfilter *cf,
+                          struct Curl_easy *data,
+                          struct Curl_dns_entry *dns)
+{
+  struct cf_dns_ctx *ctx = cf->ctx;
+  struct dynbuf tmp;
+
+  if(!Curl_trc_is_verbose(data) ||
+     /* ignore no name or numerical IP addresses */
+     !dns->hostname[0] || Curl_host_is_ipnum(dns->hostname))
+    return;
+
+  if(ctx->peer->unix_socket) {
+#ifdef USE_UNIX_SOCKETS
+    CURL_TRC_CF(data, cf, "resolved unix://%s", ctx->peer->hostname);
+#else
+    DEBUGASSERT(0);
+#endif
+  }
+  else {
+    curlx_dyn_init(&tmp, 1024);
+    infof(data, "Host %s:%u was resolved.", dns->hostname, dns->port);
+#ifdef CURLRES_IPV6
+    cf_dns_report_addr(data, &tmp, "IPv6: ", AF_INET6, dns->addr);
+#endif
+    cf_dns_report_addr(data, &tmp, "IPv4: ", AF_INET, dns->addr);
+#ifdef USE_HTTPSRR
+    if(!dns->hinfo)
+      infof(data, "HTTPS-RR: -");
+    else if(!Curl_httpsrr_applicable(data, dns->hinfo))
+      infof(data, "HTTPS-RR: not applicable");
+    else {
+      CURLcode result = Curl_httpsrr_print(&tmp, dns->hinfo);
+      if(!result)
+        infof(data, "HTTPS-RR: %s", curlx_dyn_ptr(&tmp));
+      else
+        infof(data, "Error printing HTTPS-RR information");
+    }
+#endif
+    curlx_dyn_free(&tmp);
+  }
+}
+#else
+#define cf_dns_report(x, y, z) Curl_nop_stmt
+#endif
+
+/*************************************************************
+ * Resolve the address of the server or proxy
+ *************************************************************/
+static CURLcode cf_dns_start(struct Curl_cfilter *cf,
+                             struct Curl_easy *data,
+                             struct Curl_dns_entry **pdns)
+{
+  struct cf_dns_ctx *ctx = cf->ctx;
+  timediff_t timeout_ms = Curl_timeleft_ms(data);
+  CURLcode result;
+
+  *pdns = NULL;
+
+  CURL_TRC_CF(data, cf, "cf_dns_start %s %s:%u",
+              ctx->peer->unix_socket ? "unix-domain-socket" : "host",
+              ctx->peer->hostname, ctx->peer->port);
+  if(ctx->peer->unix_socket)
+    ctx->dns_queries = 0;
+  else if(Curl_is_ipv4addr(ctx->peer->hostname))
+    ctx->dns_queries |= CURL_DNSQ_A;
+#ifdef USE_IPV6
+  else if(ctx->peer->ipv6)
+    ctx->dns_queries |= CURL_DNSQ_AAAA;
+#endif
+
+  result = Curl_resolv(data, ctx->peer, ctx->dns_queries, ctx->transport,
+                       (bool)ctx->for_proxy, timeout_ms,
+                       &ctx->resolv_id, pdns);
+  DEBUGASSERT(!result || !*pdns);
+  if(!result) { /* resolved right away, either sync or from dnscache */
+    DEBUGASSERT(*pdns);
+    return CURLE_OK;
+  }
+  else if(result == CURLE_AGAIN) { /* async resolv in progress */
+    return CURLE_OK;
+  }
+  else if(result == CURLE_OPERATION_TIMEDOUT) { /* took too long */
+    failf(data, "Failed to resolve '%s' with timeout after %"
+          FMT_TIMEDIFF_T " ms", ctx->peer->hostname,
+          curlx_ptimediff_ms(Curl_pgrs_now(data),
+                             &data->progress.t_startsingle));
+    return CURLE_OPERATION_TIMEDOUT;
+  }
+  else {
+    DEBUGASSERT(result);
+    failf(data, "Could not resolve: %s", ctx->peer->hostname);
+    return result;
+  }
+}
+
+#define CURL_HEV3_RESOLVE_DELAY_MS    50
+
+static bool cf_dns_ready_to_connect(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data)
+{
+  struct cf_dns_ctx *ctx = cf->ctx;
+
+  if(ctx->resolv_result)
+    return TRUE;
+  else if(ctx->dns)
+    return TRUE;
+#ifdef USE_CURL_ASYNC
+  else {
+    /* We want AAAA answer as we prefer ipv6. If a sub-filter desires
+    * HTTPS-RR, we check for that query as well. */
+    uint8_t wanted_answers = CURL_DNSQ_AAAA;
+    if(Curl_conn_cf_wants_httpsrr(cf, data))
+      wanted_answers |= CURL_DNSQ_HTTPS;
+
+    /* Note: if a query was never started, it is considered to have
+     * an answer (e.g. a negative one). */
+    if(Curl_resolv_has_answers(data, ctx->resolv_id, wanted_answers))
+      return TRUE;
+    /* If the wanted answers are not available after a delay,
+     * we let the connect attempts start anyway. */
+    return Curl_resolv_elapsed_ms(data, ctx->resolv_id) >=
+           CURL_HEV3_RESOLVE_DELAY_MS;
+  }
+#else
+  (void)data;
+  DEBUGASSERT(0); /* We should not come here */
+  return FALSE;
+#endif /* USE_CURL_ASYNC */
+}
+
+static CURLcode cf_dns_connect(struct Curl_cfilter *cf,
+                               struct Curl_easy *data,
+                               bool *done)
+{
+  struct cf_dns_ctx *ctx = cf->ctx;
+
+  if(cf->connected) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  *done = FALSE;
+  if(!ctx->started) {
+    ctx->started = TRUE;
+    ctx->resolv_result = cf_dns_start(cf, data, &ctx->dns);
+  }
+
+  if(!ctx->dns && !ctx->resolv_result) {
+    ctx->resolv_result =
+      Curl_resolv_take_result(data, ctx->resolv_id, &ctx->dns);
+  }
+
+  if(ctx->resolv_result) {
+    CURL_TRC_CF(data, cf, "error resolving: %d", (int)ctx->resolv_result);
+    return ctx->resolv_result;
+  }
+
+  if(ctx->dns && !ctx->announced) {
+    ctx->announced = TRUE;
+    if(cf->sockindex == FIRSTSOCKET) {
+      cf->conn->bits.dns_resolved = TRUE;
+      Curl_pgrsTime(data, TIMER_NAMELOOKUP);
+    }
+    cf_dns_report(cf, data, ctx->dns);
+  }
+
+  if(!cf_dns_ready_to_connect(cf, data)) {
+    return CURLE_OK;
+  }
+
+  if(cf->next && !cf->next->connected) {
+    bool sub_done;
+    CURLcode result = Curl_conn_cf_connect(cf->next, data, &sub_done);
+    if(result || !sub_done)
+      return result;
+    DEBUGASSERT(sub_done);
+  }
+
+  /* sub filter chain is connected */
+  CURL_TRC_CF(data, cf, "connected filter chain below");
+  if(ctx->complete_resolve && !ctx->dns && !ctx->resolv_result) {
+    /* This filter only connects when it has resolved everything. */
+    CURL_TRC_CF(data, cf, "delay connect until resolve complete");
+    return CURLE_OK;
+  }
+  *done = TRUE;
+  cf->connected = TRUE;
+  Curl_resolv_destroy(data, ctx->resolv_id);
+  return CURLE_OK;
+}
+
+static void cf_dns_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
+{
+  struct cf_dns_ctx *ctx = cf->ctx;
+
+  CURL_TRC_CF(data, cf, "destroy");
+  cf_dns_ctx_destroy(data, ctx);
+}
+
+static CURLcode cf_dns_adjust_pollset(struct Curl_cfilter *cf,
+                                      struct Curl_easy *data,
+                                      struct easy_pollset *ps)
+{
+#ifdef USE_CURL_ASYNC
+  if(!cf->connected)
+    return Curl_resolv_pollset(data, ps);
+#else
+  (void)cf;
+  (void)data;
+  (void)ps;
+#endif
+  return CURLE_OK;
+}
+
+static CURLcode cf_dns_cntrl(struct Curl_cfilter *cf,
+                             struct Curl_easy *data,
+                             int event, int arg1, void *arg2)
+{
+  struct cf_dns_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  (void)arg1;
+  (void)arg2;
+  switch(event) {
+  case CF_CTRL_DATA_DONE:
+    if(ctx->dns) {
+      /* Should only come here when the connect attempt failed and
+       * `data` is giving up on it. On a successful connect, we already
+       * unlinked the DNS entry. */
+      Curl_dns_entry_unlink(data, &ctx->dns);
+    }
+    break;
+  default:
+    break;
+  }
+  return result;
+}
+
+struct Curl_cftype Curl_cft_dns = {
+  "DNS",
+  CF_TYPE_SETUP,
+  CURL_LOG_LVL_NONE,
+  cf_dns_destroy,
+  cf_dns_connect,
+  Curl_cf_def_shutdown,
+  cf_dns_adjust_pollset,
+  Curl_cf_def_data_pending,
+  Curl_cf_def_send,
+  Curl_cf_def_recv,
+  cf_dns_cntrl,
+  Curl_cf_def_conn_is_alive,
+  Curl_cf_def_conn_keep_alive,
+  Curl_cf_def_query,
+};
+
+static CURLcode cf_dns_create(struct Curl_cfilter **pcf,
+                              struct Curl_easy *data,
+                              struct Curl_peer *peer,
+                              uint8_t dns_queries,
+                              uint8_t transport,
+                              bool for_proxy,
+                              bool complete_resolve)
+{
+  struct Curl_cfilter *cf = NULL;
+  struct cf_dns_ctx *ctx;
+  CURLcode result = CURLE_OK;
+
+  (void)data;
+  ctx = cf_dns_ctx_create(data, peer, dns_queries, transport,
+                          for_proxy, complete_resolve);
+  if(!ctx) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  result = Curl_cf_create(&cf, &Curl_cft_dns, ctx);
+
+out:
+  *pcf = result ? NULL : cf;
+  if(result)
+    cf_dns_ctx_destroy(data, ctx);
+  return result;
+}
+
+/* Adds a "resolv" filter at the top of the connection's filter chain.
+ * The filter will resolve the peer on the first connect attempt. */
+CURLcode Curl_cf_dns_add(struct Curl_easy *data,
+                         struct connectdata *conn,
+                         int sockindex,
+                         struct Curl_peer *peer,
+                         uint8_t dns_queries,
+                         uint8_t transport)
+{
+  struct Curl_cfilter *cf = NULL;
+  bool for_proxy = FALSE;
+  CURLcode result;
+
+  if(!peer)
+    return CURLE_FAILED_INIT;
+#ifndef CURL_DISABLE_PROXY
+  for_proxy = (peer == conn->socks_proxy.peer) ||
+              (peer == conn->http_proxy.peer);
+#endif
+
+  result = cf_dns_create(&cf, data, peer, dns_queries, transport,
+                         for_proxy, FALSE);
+  if(result)
+    goto out;
+  Curl_conn_cf_add(data, conn, sockindex, cf);
+out:
+  return result;
+}
+
+/* Insert a new "resolv" filter directly after `cf`. It will
+ * start a DNS resolve for the given peer on the
+ * first connect attempt.
+ * See socks.c on how this is used to make a non-blocking DNS
+ * resolve during connect.
+ */
+CURLcode Curl_cf_dns_insert_after(struct Curl_cfilter *cf_at,
+                                  struct Curl_easy *data,
+                                  uint8_t dns_queries,
+                                  struct Curl_peer *peer,
+                                  uint8_t transport,
+                                  bool complete_resolve)
+{
+  struct Curl_cfilter *cf;
+  CURLcode result;
+
+  result = cf_dns_create(&cf, data, peer, dns_queries, transport,
+                         FALSE, complete_resolve);
+  if(result)
+    return result;
+
+  Curl_conn_cf_insert_after(cf_at, cf);
+  return CURLE_OK;
+}
+
+/* Return the resolv result from the first "resolv" filter, starting
+ * the given filter `cf` downwards.
+ */
+static CURLcode cf_dns_result(struct Curl_cfilter *cf,
+                              struct Curl_peer *peer)
+{
+  for(; cf; cf = cf->next) {
+    if(cf->cft == &Curl_cft_dns) {
+      struct cf_dns_ctx *ctx = cf->ctx;
+      if(Curl_peer_same_destination(ctx->peer, peer)) {
+        if(ctx->dns || ctx->resolv_result)
+          return ctx->resolv_result;
+        return CURLE_AGAIN;
+      }
+      return CURLE_OK; /* ok, but no results */
+    }
+  }
+  return CURLE_FAILED_INIT;
+}
+
+/* Return the result of the DNS resolution for peer. Searches for a "resolv"
+ * filter from the top of the filter chain down. Returns
+ * - CURLE_AGAIN when not done yet
+ * - CURLE_OK when DNS was successfully resolved
+ * - CURLR_FAILED_INIT when no resolv filter was found
+ * - error returned by the DNS resolv
+ */
+CURLcode Curl_conn_dns_result(struct connectdata *conn,
+                              int sockindex,
+                              struct Curl_peer *peer)
+{
+  return cf_dns_result(conn->cfilter[sockindex], peer);
+}
+
+static const struct Curl_addrinfo *cf_dns_get_nth_ai(
+  struct Curl_cfilter *cf,
+  const struct Curl_addrinfo *ai,
+  int ai_family, unsigned int index)
+{
+  struct cf_dns_ctx *ctx = cf->ctx;
+  unsigned int i = 0;
+
+  if((ai_family == AF_INET) && !(ctx->dns_queries & CURL_DNSQ_A))
+    return NULL;
+#ifdef USE_IPV6
+  if((ai_family == AF_INET6) && !(ctx->dns_queries & CURL_DNSQ_AAAA))
+    return NULL;
+#endif
+  for(i = 0; ai; ai = ai->ai_next) {
+    if(ai->ai_family == ai_family) {
+      if(i == index)
+        return ai;
+      ++i;
+    }
+  }
+  return NULL;
+}
+
+/* Return the addrinfo at `index` for the given `family` from the
+ * first "resolve" filter underneath `cf`. If the DNS resolving is
+ * not done yet or if no address for the family exists, returns NULL.
+ */
+const struct Curl_addrinfo *Curl_cf_dns_get_ai(struct Curl_cfilter *cf,
+                                               struct Curl_easy *data,
+                                               struct Curl_peer *peer,
+                                               int ai_family,
+                                               unsigned int index)
+{
+  (void)data;
+  for(; cf; cf = cf->next) {
+    if(cf->cft == &Curl_cft_dns) {
+      struct cf_dns_ctx *ctx = cf->ctx;
+      if(Curl_peer_same_destination(ctx->peer, peer)) {
+        if(ctx->resolv_result)
+          return NULL;
+        else if(ctx->dns)
+          return cf_dns_get_nth_ai(cf, ctx->dns->addr, ai_family, index);
+        else
+          return Curl_resolv_get_ai(data, ctx->resolv_id, ai_family, index);
+      }
+    }
+  }
+  return NULL;
+}
+
+/* Return the addrinfo at `index` for the given `family` from the
+ * first "resolve" filter at the connection. If the DNS resolving is
+ * not done yet or if no address for the family exists, returns NULL.
+ */
+const struct Curl_addrinfo *Curl_conn_dns_get_ai(struct Curl_easy *data,
+                                                 struct Curl_peer *peer,
+                                                 int sockindex,
+                                                 int ai_family,
+                                                 unsigned int index)
+{
+  struct connectdata *conn = data->conn;
+  return Curl_cf_dns_get_ai(conn->cfilter[sockindex], data, peer,
+                            ai_family, index);
+}
+
+#ifdef USE_HTTPSRR
+/* Return the HTTPS-RR info from the first "resolve" filter at the
+ * connection. If the DNS resolving is not done yet or if there
+ * is no HTTPS-RR info, returns NULL.
+ */
+const struct Curl_https_rrinfo *
+Curl_conn_dns_get_https(struct Curl_easy *data,
+                        int sockindex,
+                        struct Curl_peer *peer)
+{
+  struct Curl_cfilter *cf = data->conn->cfilter[sockindex];
+  for(; cf; cf = cf->next) {
+    if(cf->cft == &Curl_cft_dns) {
+      struct cf_dns_ctx *ctx = cf->ctx;
+      if(Curl_peer_same_destination(ctx->peer, peer)) {
+        if(ctx->dns)
+          return ctx->dns->hinfo;
+        else
+          return Curl_resolv_get_https(data, ctx->resolv_id);
+      }
+    }
+  }
+  return NULL;
+}
+
+bool Curl_conn_dns_resolved_https(struct Curl_easy *data,
+                                  int sockindex,
+                                  struct Curl_peer *peer)
+{
+  struct Curl_cfilter *cf = data->conn->cfilter[sockindex];
+  for(; cf; cf = cf->next) {
+    if(cf->cft == &Curl_cft_dns) {
+      struct cf_dns_ctx *ctx = cf->ctx;
+      if(Curl_peer_same_destination(ctx->peer, peer)) {
+        if(ctx->dns)
+          return TRUE;
+        else
+          return Curl_resolv_knows_https(data, ctx->resolv_id);
+      }
+    }
+  }
+  return TRUE;
+}
+
+#endif /* USE_HTTPSRR */
diff --git a/third-party/curl/lib/cf-dns.h b/third-party/curl/lib/cf-dns.h
new file mode 100644
index 0000000000..891b1efea6
--- /dev/null
+++ b/third-party/curl/lib/cf-dns.h
@@ -0,0 +1,79 @@
+#ifndef HEADER_CURL_CF_DNS_H
+#define HEADER_CURL_CF_DNS_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+struct Curl_easy;
+struct connectdata;
+struct Curl_dns_entry;
+struct Curl_addrinfo;
+struct Curl_peer;
+
+CURLcode Curl_cf_dns_add(struct Curl_easy *data,
+                         struct connectdata *conn,
+                         int sockindex,
+                         struct Curl_peer *peer,
+                         uint8_t dns_queries,
+                         uint8_t transport);
+
+CURLcode Curl_cf_dns_insert_after(struct Curl_cfilter *cf_at,
+                                  struct Curl_easy *data,
+                                  uint8_t dns_queries,
+                                  struct Curl_peer *peer,
+                                  uint8_t transport,
+                                  bool complete_resolve);
+
+CURLcode Curl_conn_dns_result(struct connectdata *conn,
+                              int sockindex,
+                              struct Curl_peer *peer);
+
+const struct Curl_addrinfo *Curl_conn_dns_get_ai(struct Curl_easy *data,
+                                                 struct Curl_peer *peer,
+                                                 int sockindex,
+                                                 int ai_family,
+                                                 unsigned int index);
+
+const struct Curl_addrinfo *Curl_cf_dns_get_ai(struct Curl_cfilter *cf,
+                                               struct Curl_easy *data,
+                                               struct Curl_peer *peer,
+                                               int ai_family,
+                                               unsigned int index);
+
+#ifdef USE_HTTPSRR
+const struct Curl_https_rrinfo *
+Curl_conn_dns_get_https(struct Curl_easy *data,
+                        int sockindex,
+                        struct Curl_peer *peer);
+bool Curl_conn_dns_resolved_https(struct Curl_easy *data,
+                                  int sockindex,
+                                  struct Curl_peer *peer);
+#else
+#define Curl_conn_dns_get_https(a, b, c)        NULL
+#define Curl_conn_dns_resolved_https(a, b, c)   TRUE
+#endif
+
+extern struct Curl_cftype Curl_cft_dns;
+
+#endif /* HEADER_CURL_CF_DNS_H */
diff --git a/third-party/curl/lib/cf-h1-proxy.c b/third-party/curl/lib/cf-h1-proxy.c
index e9bc13d2a8..f1e5c7a42a 100644
--- a/third-party/curl/lib/cf-h1-proxy.c
+++ b/third-party/curl/lib/cf-h1-proxy.c
@@ -21,57 +21,46 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if !defined(CURL_DISABLE_PROXY) && !defined(CURL_DISABLE_HTTP)
 
+
 #include <curl/curl.h>
-#ifdef USE_HYPER
-#include <hyper.h>
-#endif
 #include "urldata.h"
-#include "dynbuf.h"
+#include "curlx/dynbuf.h"
 #include "sendf.h"
 #include "http.h"
+#include "http1.h"
 #include "http_proxy.h"
-#include "url.h"
 #include "select.h"
 #include "progress.h"
+#include "multiif.h"
 #include "cfilters.h"
 #include "cf-h1-proxy.h"
 #include "connect.h"
 #include "curl_trc.h"
-#include "curlx.h"
-#include "vtls/vtls.h"
-#include "transfer.h"
-#include "multiif.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
+#include "strcase.h"
+#include "curlx/strparse.h"
 
 typedef enum {
-    H1_TUNNEL_INIT,     /* init/default/no tunnel state */
-    H1_TUNNEL_CONNECT,  /* CONNECT request is being send */
-    H1_TUNNEL_RECEIVE,  /* CONNECT answer is being received */
-    H1_TUNNEL_RESPONSE, /* CONNECT response received completely */
-    H1_TUNNEL_ESTABLISHED,
-    H1_TUNNEL_FAILED
+  H1_TUNNEL_INIT,     /* init/default/no tunnel state */
+  H1_TUNNEL_CONNECT,  /* CONNECT request is being send */
+  H1_TUNNEL_RECEIVE,  /* CONNECT answer is being received */
+  H1_TUNNEL_RESPONSE, /* CONNECT response received completely */
+  H1_TUNNEL_ESTABLISHED,
+  H1_TUNNEL_FAILED
 } h1_tunnel_state;
 
 /* struct for HTTP CONNECT tunneling */
 struct h1_tunnel_state {
-  int sockindex;
-  const char *hostname;
-  int remote_port;
-  struct HTTP CONNECT;
+  struct Curl_peer *dest;
   struct dynbuf rcvbuf;
-  struct dynbuf req;
-  size_t nsend;
+  struct dynbuf request_data;
+  size_t nsent;
   size_t headerlines;
+  struct Curl_chunker ch;
+  int httpversion;
   enum keeponval {
     KEEPON_DONE,
     KEEPON_CONNECT,
@@ -81,8 +70,15 @@ struct h1_tunnel_state {
   h1_tunnel_state tunnel_state;
   BIT(chunked_encoding);
   BIT(close_connection);
+  BIT(maybe_folded);
+  BIT(leading_unfold);
 };
 
+/* Persistent context for the H1-PROXY filter */
+struct cf_h1_proxy_ctx {
+  struct h1_tunnel_state *ts;
+  BIT(udp_tunnel);
+};
 
 static bool tunnel_is_established(struct h1_tunnel_state *ts)
 {
@@ -94,67 +90,55 @@ static bool tunnel_is_failed(struct h1_tunnel_state *ts)
   return ts && (ts->tunnel_state == H1_TUNNEL_FAILED);
 }
 
-static CURLcode tunnel_reinit(struct h1_tunnel_state *ts,
-                              struct connectdata *conn,
-                              struct Curl_easy *data)
+static bool h1_proxy_is_udp(struct Curl_cfilter *cf)
+{
+  struct cf_h1_proxy_ctx *pctx = cf->ctx;
+  return (pctx->udp_tunnel ? TRUE : FALSE);
+}
+
+static CURLcode tunnel_reinit(struct Curl_cfilter *cf,
+                              struct Curl_easy *data,
+                              struct h1_tunnel_state *ts)
 {
   (void)data;
+  (void)cf;
   DEBUGASSERT(ts);
-  Curl_dyn_reset(&ts->rcvbuf);
-  Curl_dyn_reset(&ts->req);
+  curlx_dyn_reset(&ts->rcvbuf);
+  curlx_dyn_reset(&ts->request_data);
   ts->tunnel_state = H1_TUNNEL_INIT;
   ts->keepon = KEEPON_CONNECT;
   ts->cl = 0;
   ts->close_connection = FALSE;
-
-  if(conn->bits.conn_to_host)
-    ts->hostname = conn->conn_to_host.name;
-  else if(ts->sockindex == SECONDARYSOCKET)
-    ts->hostname = conn->secondaryhostname;
-  else
-    ts->hostname = conn->host.name;
-
-  if(ts->sockindex == SECONDARYSOCKET)
-    ts->remote_port = conn->secondary_port;
-  else if(conn->bits.conn_to_port)
-    ts->remote_port = conn->conn_to_port;
-  else
-    ts->remote_port = conn->remote_port;
-
+  ts->maybe_folded = FALSE;
+  ts->leading_unfold = FALSE;
+  ts->nsent = 0;
+  ts->headerlines = 0;
   return CURLE_OK;
 }
 
-static CURLcode tunnel_init(struct h1_tunnel_state **pts,
+static CURLcode tunnel_init(struct Curl_cfilter *cf,
                             struct Curl_easy *data,
-                            struct connectdata *conn,
-                            int sockindex)
+                            struct h1_tunnel_state **pts)
 {
   struct h1_tunnel_state *ts;
-  CURLcode result;
 
-  if(conn->handler->flags & PROTOPT_NOTCPPROXY) {
-    failf(data, "%s cannot be done over CONNECT", conn->handler->scheme);
+  if(cf->conn->scheme->flags & PROTOPT_NOTCPPROXY) {
+    failf(data, "%s cannot be done over CONNECT", cf->conn->scheme->name);
     return CURLE_UNSUPPORTED_PROTOCOL;
   }
 
-  /* we might need the upload buffer for streaming a partial request */
-  result = Curl_get_upload_buffer(data);
-  if(result)
-    return result;
-
-  ts = calloc(1, sizeof(*ts));
+  ts = curlx_calloc(1, sizeof(*ts));
   if(!ts)
     return CURLE_OUT_OF_MEMORY;
 
-  ts->sockindex = sockindex;
   infof(data, "allocate connect buffer");
 
-  Curl_dyn_init(&ts->rcvbuf, DYN_PROXY_CONNECT_HEADERS);
-  Curl_dyn_init(&ts->req, DYN_HTTP_REQUEST);
+  curlx_dyn_init(&ts->rcvbuf, DYN_PROXY_CONNECT_HEADERS);
+  curlx_dyn_init(&ts->request_data, DYN_HTTP_REQUEST);
+  Curl_httpchunk_init(data, &ts->ch, TRUE);
 
-  *pts =  ts;
-  connkeep(conn, "HTTP proxy CONNECT");
-  return tunnel_reinit(ts, conn, data);
+  *pts = ts;
+  return tunnel_reinit(cf, data, ts);
 }
 
 static void h1_tunnel_go_state(struct Curl_cfilter *cf,
@@ -164,26 +148,18 @@ static void h1_tunnel_go_state(struct Curl_cfilter *cf,
 {
   if(ts->tunnel_state == new_state)
     return;
-  /* leaving this one */
-  switch(ts->tunnel_state) {
-  case H1_TUNNEL_CONNECT:
-    data->req.ignorebody = FALSE;
-    break;
-  default:
-    break;
-  }
   /* entering this one */
   switch(new_state) {
   case H1_TUNNEL_INIT:
     CURL_TRC_CF(data, cf, "new tunnel state 'init'");
-    tunnel_reinit(ts, cf->conn, data);
+    tunnel_reinit(cf, data, ts);
     break;
 
   case H1_TUNNEL_CONNECT:
     CURL_TRC_CF(data, cf, "new tunnel state 'connect'");
     ts->tunnel_state = H1_TUNNEL_CONNECT;
     ts->keepon = KEEPON_CONNECT;
-    Curl_dyn_reset(&ts->rcvbuf);
+    curlx_dyn_reset(&ts->rcvbuf);
     break;
 
   case H1_TUNNEL_RECEIVE:
@@ -198,202 +174,214 @@ static void h1_tunnel_go_state(struct Curl_cfilter *cf,
 
   case H1_TUNNEL_ESTABLISHED:
     CURL_TRC_CF(data, cf, "new tunnel state 'established'");
-    infof(data, "CONNECT phase completed");
+    infof(data, "CONNECT%s phase completed for HTTP proxy",
+          h1_proxy_is_udp(cf) ? "-UDP" : "");
+
     data->state.authproxy.done = TRUE;
     data->state.authproxy.multipass = FALSE;
-    /* FALLTHROUGH */
+    FALLTHROUGH();
   case H1_TUNNEL_FAILED:
     if(new_state == H1_TUNNEL_FAILED)
       CURL_TRC_CF(data, cf, "new tunnel state 'failed'");
     ts->tunnel_state = new_state;
-    Curl_dyn_reset(&ts->rcvbuf);
-    Curl_dyn_reset(&ts->req);
+    curlx_dyn_reset(&ts->rcvbuf);
+    curlx_dyn_reset(&ts->request_data);
     /* restore the protocol pointer */
-    data->info.httpcode = 0; /* clear it as it might've been used for the
+    data->info.httpcode = 0; /* clear it as it might have been used for the
                                 proxy */
     /* If a proxy-authorization header was used for the proxy, then we should
-       make sure that it isn't accidentally used for the document request
-       after we've connected. So let's free and clear it here. */
-    Curl_safefree(data->state.aptr.proxyuserpwd);
-#ifdef USE_HYPER
-    data->state.hconnect = FALSE;
-#endif
+       make sure that it is not accidentally used for the document request
+       after we have connected. Let's thus free and clear it here. */
+    curlx_safefree(data->req.hd_proxy_auth);
     break;
   }
 }
 
-static void tunnel_free(struct Curl_cfilter *cf,
+static void tunnel_free(struct h1_tunnel_state *ts,
                         struct Curl_easy *data)
 {
-  struct h1_tunnel_state *ts = cf->ctx;
   if(ts) {
-    h1_tunnel_go_state(cf, ts, H1_TUNNEL_FAILED, data);
-    Curl_dyn_free(&ts->rcvbuf);
-    Curl_dyn_free(&ts->req);
-    free(ts);
-    cf->ctx = NULL;
+    Curl_peer_unlink(&ts->dest);
+    curlx_dyn_free(&ts->rcvbuf);
+    curlx_dyn_free(&ts->request_data);
+    Curl_httpchunk_free(data, &ts->ch);
+    curlx_free(ts);
   }
 }
 
-static CURLcode CONNECT_host(struct Curl_easy *data,
-                             struct connectdata *conn,
-                             const char *hostname,
-                             int remote_port,
-                             char **connecthostp,
-                             char **hostp)
+static void cf_tunnel_free(struct Curl_cfilter *cf,
+                           struct Curl_easy *data)
 {
-  char *hostheader; /* for CONNECT */
-  char *host = NULL; /* Host: */
-  bool ipv6_ip = conn->bits.ipv6_ip;
-
-  /* the hostname may be different */
-  if(hostname != conn->host.name)
-    ipv6_ip = (strchr(hostname, ':') != NULL);
-  hostheader = /* host:port with IPv6 support */
-    aprintf("%s%s%s:%d", ipv6_ip?"[":"", hostname, ipv6_ip?"]":"",
-            remote_port);
-  if(!hostheader)
-    return CURLE_OUT_OF_MEMORY;
-
-  if(!Curl_checkProxyheaders(data, conn, STRCONST("Host"))) {
-    host = aprintf("Host: %s\r\n", hostheader);
-    if(!host) {
-      free(hostheader);
-      return CURLE_OUT_OF_MEMORY;
+  if(cf) {
+    struct cf_h1_proxy_ctx *pctx = cf->ctx;
+    struct h1_tunnel_state *ts = pctx ? pctx->ts : NULL;
+    if(ts) {
+      h1_tunnel_go_state(cf, ts, H1_TUNNEL_FAILED, data);
+      tunnel_free(ts, data);
+      pctx->ts = NULL;
     }
   }
-  *connecthostp = hostheader;
-  *hostp = host;
-  return CURLE_OK;
 }
 
-#ifndef USE_HYPER
+static bool tunnel_want_send(struct h1_tunnel_state *ts)
+{
+  return ts->tunnel_state == H1_TUNNEL_CONNECT;
+}
+
 static CURLcode start_CONNECT(struct Curl_cfilter *cf,
                               struct Curl_easy *data,
                               struct h1_tunnel_state *ts)
 {
-  struct connectdata *conn = cf->conn;
-  char *hostheader = NULL;
-  char *host = NULL;
-  const char *httpv;
+  struct httpreq *req = NULL;
+  int http_minor;
   CURLcode result;
 
-  infof(data, "Establish HTTP proxy tunnel to %s:%d",
-        ts->hostname, ts->remote_port);
+  DEBUGASSERT(data);
+  /* This only happens if we have looped here due to authentication reasons,
+     and we do not really use the newly cloned URL here then. Free it. */
+  curlx_safefree(data->req.newurl);
 
-    /* This only happens if we've looped here due to authentication
-       reasons, and we don't really use the newly cloned URL here
-       then. Just free() it. */
-  Curl_safefree(data->req.newurl);
-
-  result = CONNECT_host(data, conn,
-                        ts->hostname, ts->remote_port,
-                        &hostheader, &host);
+  result = Curl_http_proxy_create_tunnel_request(&req, cf, data, ts->dest,
+                                                  PROXY_HTTP_V1,
+                                                  h1_proxy_is_udp(cf));
   if(result)
     goto out;
 
-  /* Setup the proxy-authorization header, if any */
-  result = Curl_http_output_auth(data, conn, "CONNECT", HTTPREQ_GET,
-                                 hostheader, TRUE);
-  if(result)
-    goto out;
-
-  httpv = (conn->http_proxy.proxytype == CURLPROXY_HTTP_1_0) ? "1.0" : "1.1";
-
-  result =
-      Curl_dyn_addf(&ts->req,
-                    "CONNECT %s HTTP/%s\r\n"
-                    "%s"  /* Host: */
-                    "%s", /* Proxy-Authorization */
-                    hostheader,
-                    httpv,
-                    host?host:"",
-                    data->state.aptr.proxyuserpwd?
-                    data->state.aptr.proxyuserpwd:"");
-  if(result)
-    goto out;
-
-  if(!Curl_checkProxyheaders(data, conn, STRCONST("User-Agent"))
-     && data->set.str[STRING_USERAGENT])
-    result = Curl_dyn_addf(&ts->req, "User-Agent: %s\r\n",
-                           data->set.str[STRING_USERAGENT]);
-  if(result)
-    goto out;
-
-  if(!Curl_checkProxyheaders(data, conn, STRCONST("Proxy-Connection")))
-    result = Curl_dyn_addn(&ts->req,
-                           STRCONST("Proxy-Connection: Keep-Alive\r\n"));
-  if(result)
-    goto out;
-
-  result = Curl_add_custom_headers(data, TRUE, &ts->req);
-  if(result)
-    goto out;
-
-  /* CRLF terminate the request */
-  result = Curl_dyn_addn(&ts->req, STRCONST("\r\n"));
-  if(result)
-    goto out;
-
-  /* Send the connect request to the proxy */
-  result = Curl_buffer_send(&ts->req, data, &ts->CONNECT,
-                            &data->info.request_size, 0,
-                            ts->sockindex);
+  curlx_dyn_reset(&ts->request_data);
+  ts->nsent = 0;
   ts->headerlines = 0;
+  http_minor = ts->httpversion % 10;
+
+  result = Curl_h1_req_write_head(req, http_minor, &ts->request_data);
+  if(!result)
+    result = Curl_creader_set_null(data);
 
 out:
   if(result)
     failf(data, "Failed sending CONNECT to proxy");
-  free(host);
-  free(hostheader);
+  if(req)
+    Curl_http_req_free(req);
   return result;
 }
 
-static CURLcode send_CONNECT(struct Curl_easy *data,
-                             struct connectdata *conn,
+static CURLcode send_CONNECT(struct Curl_cfilter *cf,
+                             struct Curl_easy *data,
                              struct h1_tunnel_state *ts,
                              bool *done)
 {
-  struct SingleRequest *k = &data->req;
-  struct HTTP *http = &ts->CONNECT;
+  const uint8_t *buf = curlx_dyn_uptr(&ts->request_data);
+  size_t request_len = curlx_dyn_len(&ts->request_data);
+  size_t blen = request_len;
   CURLcode result = CURLE_OK;
+  size_t nwritten;
 
-  if(http->sending != HTTPSEND_REQUEST)
+  if(blen <= ts->nsent)
+    goto out;  /* we are done */
+
+  blen -= ts->nsent;
+  buf += ts->nsent;
+
+  result = cf->next->cft->do_send(cf->next, data, buf, blen, FALSE, &nwritten);
+  if(result) {
+    if(result == CURLE_AGAIN)
+      result = CURLE_OK;
     goto out;
-
-  if(!ts->nsend) {
-    size_t fillcount;
-    k->upload_fromhere = data->state.ulbuf;
-    result = Curl_fillreadbuffer(data, data->set.upload_buffer_size,
-                                 &fillcount);
-    if(result)
-      goto out;
-    ts->nsend = fillcount;
   }
-  if(ts->nsend) {
-    ssize_t bytes_written;
-    /* write to socket (send away data) */
-    result = Curl_write(data,
-                        conn->writesockfd,  /* socket to send to */
-                        k->upload_fromhere, /* buffer pointer */
-                        ts->nsend,          /* buffer size */
-                        &bytes_written);    /* actually sent */
-    if(result)
-      goto out;
-    /* send to debug callback! */
-    Curl_debug(data, CURLINFO_HEADER_OUT,
-               k->upload_fromhere, bytes_written);
 
-    ts->nsend -= bytes_written;
-    k->upload_fromhere += bytes_written;
-  }
-  if(!ts->nsend)
-    http->sending = HTTPSEND_NADA;
+  DEBUGASSERT(blen >= nwritten);
+  ts->nsent += nwritten;
+  Curl_debug(data, CURLINFO_HEADER_OUT, (const char *)buf, nwritten);
 
 out:
   if(result)
     failf(data, "Failed sending CONNECT to proxy");
-  *done = (http->sending != HTTPSEND_REQUEST);
+  *done = (!result && (ts->nsent >= request_len));
+  return result;
+}
+
+static CURLcode on_resp_header_udp(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data,
+                                   struct h1_tunnel_state *ts,
+                                   const char *header)
+{
+  CURLcode result = CURLE_OK;
+  struct SingleRequest *k = &data->req;
+
+  if((checkprefix("WWW-Authenticate:", header) && (401 == k->httpcode)) ||
+     (checkprefix("Proxy-authenticate:", header) && (407 == k->httpcode))) {
+
+    bool proxy = (k->httpcode == 407);
+    char *auth = Curl_copy_header_value(header);
+    if(!auth)
+      return CURLE_OUT_OF_MEMORY;
+
+    CURL_TRC_CF(data, cf, "CONNECT-UDP: fwd auth header '%s'", header);
+    result = Curl_http_input_auth(data, proxy, auth);
+
+    curlx_free(auth);
+
+    if(result)
+      return result;
+  }
+  else if(checkprefix("Content-Length:", header)) {
+    if(k->httpcode / 100 == 2 || k->httpcode == 101) {
+      infof(data, "Ignoring Content-Length in CONNECT-UDP %03d response",
+            k->httpcode);
+    }
+    else {
+      const char *p = header + strlen("Content-Length:");
+      if(curlx_str_numblanks(&p, &ts->cl)) {
+        failf(data, "Unsupported Content-Length value");
+        return CURLE_WEIRD_SERVER_REPLY;
+      }
+    }
+  }
+  else if(checkprefix("Transfer-Encoding:", header)) {
+    if(k->httpcode / 100 == 2 || k->httpcode == 101) {
+      infof(data, "Ignoring Transfer-Encoding in "
+            "CONNECT-UDP %03d response", k->httpcode);
+    }
+    else if(Curl_compareheader(header,
+                               STRCONST("Transfer-Encoding:"),
+                               STRCONST("chunked"))) {
+      CURL_TRC_CF(data, cf, "CONNECT-UDP Response --> "
+                  "Transfer-Encoding: chunked");
+      ts->chunked_encoding = TRUE;
+      /* reset our chunky engine */
+      Curl_httpchunk_reset(data, &ts->ch, TRUE);
+    }
+  }
+  else if(checkprefix("Capsule-protocol:", header)) {
+    if(Curl_compareheader(header,
+                           STRCONST("Capsule-protocol:"),
+                           STRCONST("?1"))) {
+      CURL_TRC_CF(data, cf, "CONNECT-UDP Response --> Capsule-protocol: ?1");
+    }
+  }
+  else if(Curl_compareheader(header,
+                              STRCONST("Connection:"), STRCONST("close"))) {
+    ts->close_connection = TRUE;
+    CURL_TRC_CF(data, cf, "CONNECT-UDP Response --> Connection: close");
+  }
+  else if(Curl_compareheader(header,
+                             STRCONST("Proxy-Connection:"),
+                             STRCONST("close"))) {
+    ts->close_connection = TRUE;
+    CURL_TRC_CF(data, cf,
+                "CONNECT-UDP Response --> Proxy-Connection: close");
+  }
+  else if(!strncmp(header, "HTTP/1.", 7) &&
+           ((header[7] == '0') || (header[7] == '1')) &&
+           (header[8] == ' ') &&
+           ISDIGIT(header[9]) && ISDIGIT(header[10]) && ISDIGIT(header[11]) &&
+           !ISDIGIT(header[12])) {
+    /* store the HTTP code from the proxy */
+    data->info.httpproxycode = k->httpcode =
+      ((header[9] - '0') * 100) +
+      ((header[10] - '0') * 10) +
+      (header[11] - '0');
+    CURL_TRC_CF(data, cf, "CONNECT-UDP Response --> %d", k->httpcode);
+  }
   return result;
 }
 
@@ -406,12 +394,10 @@ static CURLcode on_resp_header(struct Curl_cfilter *cf,
   struct SingleRequest *k = &data->req;
   (void)cf;
 
-  if((checkprefix("WWW-Authenticate:", header) &&
-      (401 == k->httpcode)) ||
-     (checkprefix("Proxy-authenticate:", header) &&
-      (407 == k->httpcode))) {
+  if((checkprefix("WWW-Authenticate:", header) && (401 == k->httpcode)) ||
+     (checkprefix("Proxy-authenticate:", header) && (407 == k->httpcode))) {
 
-    bool proxy = (k->httpcode == 407) ? TRUE : FALSE;
+    bool proxy = (k->httpcode == 407);
     char *auth = Curl_copy_header_value(header);
     if(!auth)
       return CURLE_OUT_OF_MEMORY;
@@ -419,13 +405,13 @@ static CURLcode on_resp_header(struct Curl_cfilter *cf,
     CURL_TRC_CF(data, cf, "CONNECT: fwd auth header '%s'", header);
     result = Curl_http_input_auth(data, proxy, auth);
 
-    free(auth);
+    curlx_free(auth);
 
     if(result)
       return result;
   }
   else if(checkprefix("Content-Length:", header)) {
-    if(k->httpcode/100 == 2) {
+    if(k->httpcode / 100 == 2) {
       /* A client MUST ignore any Content-Length or Transfer-Encoding
          header fields received in a successful response to CONNECT.
          "Successful" described as: 2xx (Successful). RFC 7231 4.3.6 */
@@ -433,15 +419,18 @@ static CURLcode on_resp_header(struct Curl_cfilter *cf,
             k->httpcode);
     }
     else {
-      (void)curlx_strtoofft(header + strlen("Content-Length:"),
-                            NULL, 10, &ts->cl);
+      const char *p = header + strlen("Content-Length:");
+      if(curlx_str_numblanks(&p, &ts->cl)) {
+        failf(data, "Unsupported Content-Length value");
+        return CURLE_WEIRD_SERVER_REPLY;
+      }
     }
   }
   else if(Curl_compareheader(header,
                              STRCONST("Connection:"), STRCONST("close")))
     ts->close_connection = TRUE;
   else if(checkprefix("Transfer-Encoding:", header)) {
-    if(k->httpcode/100 == 2) {
+    if(k->httpcode / 100 == 2) {
       /* A client MUST ignore any Content-Length or Transfer-Encoding
          header fields received in a successful response to CONNECT.
          "Successful" described as: 2xx (Successful). RFC 7231 4.3.6 */
@@ -453,8 +442,8 @@ static CURLcode on_resp_header(struct Curl_cfilter *cf,
                                STRCONST("chunked"))) {
       infof(data, "CONNECT responded chunked");
       ts->chunked_encoding = TRUE;
-      /* init our chunky engine */
-      Curl_httpchunk_init(data);
+      /* reset our chunky engine */
+      Curl_httpchunk_reset(data, &ts->ch, TRUE);
     }
   }
   else if(Curl_compareheader(header,
@@ -467,22 +456,99 @@ static CURLcode on_resp_header(struct Curl_cfilter *cf,
           ISDIGIT(header[9]) && ISDIGIT(header[10]) && ISDIGIT(header[11]) &&
           !ISDIGIT(header[12])) {
     /* store the HTTP code from the proxy */
-    data->info.httpproxycode =  k->httpcode = (header[9] - '0') * 100 +
-      (header[10] - '0') * 10 + (header[11] - '0');
+    data->info.httpproxycode = k->httpcode = ((header[9] - '0') * 100) +
+      ((header[10] - '0') * 10) + (header[11] - '0');
   }
   return result;
 }
 
+static CURLcode single_header(struct Curl_cfilter *cf,
+                              struct Curl_easy *data,
+                              struct h1_tunnel_state *ts)
+{
+  CURLcode result = CURLE_OK;
+  const char *linep = curlx_dyn_ptr(&ts->rcvbuf);
+  size_t line_len = curlx_dyn_len(&ts->rcvbuf); /* bytes in this line */
+  const struct SingleRequest *k = &data->req;
+  int writetype;
+  ts->headerlines++;
+
+  /* output debug if that is requested */
+  Curl_debug(data, CURLINFO_HEADER_IN, linep, line_len);
+
+  /* a CONNECT response line is handed to the client as a header, so it must
+     pass the same checks as a regular response header before delivery */
+  result = Curl_verify_header(data, linep, line_len);
+  if(result)
+    return result;
+
+  /* send the header to the callback */
+  writetype = CLIENTWRITE_HEADER | CLIENTWRITE_CONNECT |
+    (ts->headerlines == 1 ? CLIENTWRITE_STATUS : 0);
+  result = Curl_client_write(data, writetype, linep, line_len);
+  if(result)
+    return result;
+
+  result = Curl_bump_headersize(data, line_len, TRUE);
+  if(result)
+    return result;
+
+  /* Newlines are CRLF, so the CR is ignored as the line is not
+     really terminated until the LF comes. Treat a following CR
+     as end-of-headers as well.*/
+
+  if(ISNEWLINE(linep[0])) {
+    /* end of response-headers from the proxy */
+
+    if((407 == k->httpcode) && !data->state.authproblem) {
+      /* If we get a 407 response code with content length
+         when we have no auth problem, we must ignore the
+         whole response-body */
+      ts->keepon = KEEPON_IGNORE;
+
+      if(ts->cl) {
+        infof(data, "Ignore %" FMT_OFF_T " bytes of response-body", ts->cl);
+      }
+      else if(ts->chunked_encoding) {
+        infof(data, "Ignore chunked response-body");
+      }
+      else {
+        /* without content-length or chunked encoding, we
+           cannot keep the connection alive since the close is
+           the end signal so we bail out at once instead */
+        CURL_TRC_CF(data, cf, "CONNECT: no content-length or chunked");
+        ts->keepon = KEEPON_DONE;
+      }
+    }
+    else {
+      ts->keepon = KEEPON_DONE;
+    }
+
+    DEBUGASSERT(ts->keepon == KEEPON_IGNORE ||
+                ts->keepon == KEEPON_DONE);
+    return result;
+  }
+
+  if(h1_proxy_is_udp(cf)) {
+    result = on_resp_header_udp(cf, data, ts, linep);
+  }
+  else {
+    result = on_resp_header(cf, data, ts, linep);
+  }
+
+  if(result)
+    return result;
+
+  curlx_dyn_reset(&ts->rcvbuf);
+  return result;
+}
+
 static CURLcode recv_CONNECT_resp(struct Curl_cfilter *cf,
                                   struct Curl_easy *data,
                                   struct h1_tunnel_state *ts,
                                   bool *done)
 {
   CURLcode result = CURLE_OK;
-  struct SingleRequest *k = &data->req;
-  curl_socket_t tunnelsocket = Curl_conn_cf_get_socket(cf, data);
-  char *linep;
-  size_t perline;
   int error;
 
 #define SELECT_OK      0
@@ -491,31 +557,35 @@ static CURLcode recv_CONNECT_resp(struct Curl_cfilter *cf,
   error = SELECT_OK;
   *done = FALSE;
 
-  if(!Curl_conn_data_pending(data, ts->sockindex))
-    return CURLE_OK;
-
   while(ts->keepon) {
-    ssize_t gotbytes;
+    size_t nread;
     char byte;
 
     /* Read one byte at a time to avoid a race condition. Wait at most one
        second before looping to ensure continuous pgrsUpdates. */
-    result = Curl_read(data, tunnelsocket, &byte, 1, &gotbytes);
+    result = Curl_conn_recv(data, cf->sockindex, &byte, 1, &nread);
     if(result == CURLE_AGAIN)
       /* socket buffer drained, return */
       return CURLE_OK;
 
-    if(Curl_pgrsUpdate(data))
-      return CURLE_ABORTED_BY_CALLBACK;
+    if(!result)
+      result = Curl_pgrsUpdate(data);
 
     if(result) {
       ts->keepon = KEEPON_DONE;
       break;
     }
 
-    if(gotbytes <= 0) {
+    if(!nread) {
+      if(ts->maybe_folded) {
+        /* EOF right after LF: finalize the pending header line. */
+        result = single_header(cf, data, ts);
+        if(result)
+          return result;
+        ts->maybe_folded = FALSE;
+      }
       if(data->set.proxyauth && data->state.authproxy.avail &&
-         data->state.aptr.proxyuserpwd) {
+         data->req.hd_proxy_auth) {
         /* proxy auth was requested and there was proxy auth available,
            then deem this as "mere" proxy disconnect */
         ts->close_connection = TRUE;
@@ -531,36 +601,60 @@ static CURLcode recv_CONNECT_resp(struct Curl_cfilter *cf,
 
     if(ts->keepon == KEEPON_IGNORE) {
       /* This means we are currently ignoring a response-body */
+      if(ts->chunked_encoding) {
+        /* chunked-encoded body, so we need to do the chunked dance
+           properly to know when the end of the body is reached */
+        size_t consumed = 0;
 
-      if(ts->cl) {
-        /* A Content-Length based body: simply count down the counter
-           and make sure to break out of the loop when we're done! */
+        /* now parse the chunked piece of data so that we can
+           properly tell when the stream ends */
+        result = Curl_httpchunk_read(data, &ts->ch, &byte, 1, &consumed);
+        if(result)
+          return result;
+        if(Curl_httpchunk_is_done(data, &ts->ch)) {
+          /* we are done reading chunks! */
+          infof(data, "chunk reading DONE");
+          ts->keepon = KEEPON_DONE;
+        }
+      }
+      else if(ts->cl) {
+        /* A Content-Length based body: count down the counter
+           and make sure to break out of the loop when we are done! */
         ts->cl--;
         if(ts->cl <= 0) {
           ts->keepon = KEEPON_DONE;
           break;
         }
       }
-      else {
-        /* chunked-encoded body, so we need to do the chunked dance
-           properly to know when the end of the body is reached */
-        CHUNKcode r;
-        CURLcode extra;
-        ssize_t tookcareof = 0;
-
-        /* now parse the chunked piece of data so that we can
-           properly tell when the stream ends */
-        r = Curl_httpchunk_read(data, &byte, 1, &tookcareof, &extra);
-        if(r == CHUNKE_STOP) {
-          /* we're done reading chunks! */
-          infof(data, "chunk reading DONE");
-          ts->keepon = KEEPON_DONE;
-        }
-      }
       continue;
     }
 
-    if(Curl_dyn_addn(&ts->rcvbuf, &byte, 1)) {
+    if(ts->maybe_folded) {
+      if(ISBLANK(byte)) {
+        Curl_http_to_fold(&ts->rcvbuf);
+        ts->leading_unfold = TRUE;
+      }
+      else {
+        result = single_header(cf, data, ts);
+        if(result)
+          return result;
+        /* now handle the new byte */
+      }
+      ts->maybe_folded = FALSE;
+    }
+
+    if(ts->leading_unfold) {
+      if(ISBLANK(byte))
+        /* skip a bit brother */
+        continue;
+      /* non-blank, insert a space then continue the unfolding */
+      if(curlx_dyn_addn(&ts->rcvbuf, " ", 1)) {
+        failf(data, "CONNECT response too large");
+        return CURLE_RECV_ERROR;
+      }
+      ts->leading_unfold = FALSE;
+    }
+    if(curlx_dyn_addn(&ts->rcvbuf, &byte, 1)) {
       failf(data, "CONNECT response too large");
       return CURLE_RECV_ERROR;
     }
@@ -568,100 +662,29 @@ static CURLcode recv_CONNECT_resp(struct Curl_cfilter *cf,
     /* if this is not the end of a header line then continue */
     if(byte != 0x0a)
       continue;
-
-    ts->headerlines++;
-    linep = Curl_dyn_ptr(&ts->rcvbuf);
-    perline = Curl_dyn_len(&ts->rcvbuf); /* amount of bytes in this line */
-
-    /* output debug if that is requested */
-    Curl_debug(data, CURLINFO_HEADER_IN, linep, perline);
-
-    if(!data->set.suppress_connect_headers) {
-      /* send the header to the callback */
-      int writetype = CLIENTWRITE_HEADER | CLIENTWRITE_CONNECT |
-        (data->set.include_header ? CLIENTWRITE_BODY : 0) |
-        (ts->headerlines == 1 ? CLIENTWRITE_STATUS : 0);
-
-      result = Curl_client_write(data, writetype, linep, perline);
-      if(result)
-        return result;
+    else {
+      const char *linep = curlx_dyn_ptr(&ts->rcvbuf);
+      size_t hlen = curlx_dyn_len(&ts->rcvbuf);
+      if(hlen && ISNEWLINE(linep[0])) {
+        /* end of headers */
+        result = single_header(cf, data, ts);
+        if(result)
+          return result;
+      }
+      else
+        ts->maybe_folded = TRUE;
     }
 
-    result = Curl_bump_headersize(data, perline, TRUE);
     if(result)
       return result;
-
-    /* Newlines are CRLF, so the CR is ignored as the line isn't
-       really terminated until the LF comes. Treat a following CR
-       as end-of-headers as well.*/
-
-    if(('\r' == linep[0]) ||
-       ('\n' == linep[0])) {
-      /* end of response-headers from the proxy */
-
-      if((407 == k->httpcode) && !data->state.authproblem) {
-        /* If we get a 407 response code with content length
-           when we have no auth problem, we must ignore the
-           whole response-body */
-        ts->keepon = KEEPON_IGNORE;
-
-        if(ts->cl) {
-          infof(data, "Ignore %" CURL_FORMAT_CURL_OFF_T
-                " bytes of response-body", ts->cl);
-        }
-        else if(ts->chunked_encoding) {
-          CHUNKcode r;
-          CURLcode extra;
-
-          infof(data, "Ignore chunked response-body");
-
-          /* We set ignorebody true here since the chunked decoder
-             function will acknowledge that. Pay attention so that this is
-             cleared again when this function returns! */
-          k->ignorebody = TRUE;
-
-          if(linep[1] == '\n')
-            /* this can only be a LF if the letter at index 0 was a CR */
-            linep++;
-
-          /* now parse the chunked piece of data so that we can properly
-             tell when the stream ends */
-          r = Curl_httpchunk_read(data, linep + 1, 1, &gotbytes,
-                                  &extra);
-          if(r == CHUNKE_STOP) {
-            /* we're done reading chunks! */
-            infof(data, "chunk reading DONE");
-            ts->keepon = KEEPON_DONE;
-          }
-        }
-        else {
-          /* without content-length or chunked encoding, we
-             can't keep the connection alive since the close is
-             the end signal so we bail out at once instead */
-          CURL_TRC_CF(data, cf, "CONNECT: no content-length or chunked");
-          ts->keepon = KEEPON_DONE;
-        }
-      }
-      else {
-        ts->keepon = KEEPON_DONE;
-      }
-
-      DEBUGASSERT(ts->keepon == KEEPON_IGNORE
-                  || ts->keepon == KEEPON_DONE);
-      continue;
-    }
-
-    result = on_resp_header(cf, data, ts, linep);
-    if(result)
-      return result;
-
-    Curl_dyn_reset(&ts->rcvbuf);
-  } /* while there's buffer left and loop is requested */
+  } /* while there is buffer left and loop is requested */
 
   if(error)
     result = CURLE_RECV_ERROR;
   *done = (ts->keepon == KEEPON_DONE);
-  if(!result && *done && data->info.httpproxycode/100 != 2) {
+  if(!result && *done &&
+     data->info.httpproxycode / 100 != 2 &&
+     !(h1_proxy_is_udp(cf) && data->info.httpproxycode == 101)) {
     /* Deal with the possibly already received authenticate
        headers. 'newurl' is set to a new URL if we must loop. */
     result = Curl_http_auth_act(data);
@@ -669,296 +692,6 @@ static CURLcode recv_CONNECT_resp(struct Curl_cfilter *cf,
   return result;
 }
 
-#else /* USE_HYPER */
-/* The Hyper version of CONNECT */
-static CURLcode start_CONNECT(struct Curl_cfilter *cf,
-                              struct Curl_easy *data,
-                              struct h1_tunnel_state *ts)
-{
-  struct connectdata *conn = cf->conn;
-  struct hyptransfer *h = &data->hyp;
-  curl_socket_t tunnelsocket = Curl_conn_cf_get_socket(cf, data);
-  hyper_io *io = NULL;
-  hyper_request *req = NULL;
-  hyper_headers *headers = NULL;
-  hyper_clientconn_options *options = NULL;
-  hyper_task *handshake = NULL;
-  hyper_task *task = NULL; /* for the handshake */
-  hyper_clientconn *client = NULL;
-  hyper_task *sendtask = NULL; /* for the send */
-  char *hostheader = NULL; /* for CONNECT */
-  char *host = NULL; /* Host: */
-  CURLcode result = CURLE_OUT_OF_MEMORY;
-
-  io = hyper_io_new();
-  if(!io) {
-    failf(data, "Couldn't create hyper IO");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-  /* tell Hyper how to read/write network data */
-  hyper_io_set_userdata(io, data);
-  hyper_io_set_read(io, Curl_hyper_recv);
-  hyper_io_set_write(io, Curl_hyper_send);
-  conn->sockfd = tunnelsocket;
-
-  data->state.hconnect = TRUE;
-
-  /* create an executor to poll futures */
-  if(!h->exec) {
-    h->exec = hyper_executor_new();
-    if(!h->exec) {
-      failf(data, "Couldn't create hyper executor");
-      result = CURLE_OUT_OF_MEMORY;
-      goto error;
-    }
-  }
-
-  options = hyper_clientconn_options_new();
-  if(!options) {
-    failf(data, "Couldn't create hyper client options");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-  hyper_clientconn_options_set_preserve_header_case(options, 1);
-  hyper_clientconn_options_set_preserve_header_order(options, 1);
-
-  hyper_clientconn_options_exec(options, h->exec);
-
-  /* "Both the `io` and the `options` are consumed in this function
-     call" */
-  handshake = hyper_clientconn_handshake(io, options);
-  if(!handshake) {
-    failf(data, "Couldn't create hyper client handshake");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-  io = NULL;
-  options = NULL;
-
-  if(HYPERE_OK != hyper_executor_push(h->exec, handshake)) {
-    failf(data, "Couldn't hyper_executor_push the handshake");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-  handshake = NULL; /* ownership passed on */
-
-  task = hyper_executor_poll(h->exec);
-  if(!task) {
-    failf(data, "Couldn't hyper_executor_poll the handshake");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-
-  client = hyper_task_value(task);
-  hyper_task_free(task);
-
-  req = hyper_request_new();
-  if(!req) {
-    failf(data, "Couldn't hyper_request_new");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-  if(hyper_request_set_method(req, (uint8_t *)"CONNECT",
-                              strlen("CONNECT"))) {
-    failf(data, "error setting method");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-
-  infof(data, "Establish HTTP proxy tunnel to %s:%d",
-        ts->hostname, ts->remote_port);
-
-    /* This only happens if we've looped here due to authentication
-       reasons, and we don't really use the newly cloned URL here
-       then. Just free() it. */
-  Curl_safefree(data->req.newurl);
-
-  result = CONNECT_host(data, conn, ts->hostname, ts->remote_port,
-                        &hostheader, &host);
-  if(result)
-    goto error;
-
-  if(hyper_request_set_uri(req, (uint8_t *)hostheader,
-                           strlen(hostheader))) {
-    failf(data, "error setting path");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-  if(data->set.verbose) {
-    char *se = aprintf("CONNECT %s HTTP/1.1\r\n", hostheader);
-    if(!se) {
-      result = CURLE_OUT_OF_MEMORY;
-      goto error;
-    }
-    Curl_debug(data, CURLINFO_HEADER_OUT, se, strlen(se));
-    free(se);
-  }
-  /* Setup the proxy-authorization header, if any */
-  result = Curl_http_output_auth(data, conn, "CONNECT", HTTPREQ_GET,
-                                 hostheader, TRUE);
-  if(result)
-    goto error;
-  Curl_safefree(hostheader);
-
-  /* default is 1.1 */
-  if((conn->http_proxy.proxytype == CURLPROXY_HTTP_1_0) &&
-     (HYPERE_OK != hyper_request_set_version(req,
-                                             HYPER_HTTP_VERSION_1_0))) {
-    failf(data, "error setting HTTP version");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-
-  headers = hyper_request_headers(req);
-  if(!headers) {
-    failf(data, "hyper_request_headers");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-  if(host) {
-    result = Curl_hyper_header(data, headers, host);
-    if(result)
-      goto error;
-    Curl_safefree(host);
-  }
-
-  if(data->state.aptr.proxyuserpwd) {
-    result = Curl_hyper_header(data, headers,
-                               data->state.aptr.proxyuserpwd);
-    if(result)
-      goto error;
-  }
-
-  if(!Curl_checkProxyheaders(data, conn, STRCONST("User-Agent")) &&
-     data->set.str[STRING_USERAGENT]) {
-    struct dynbuf ua;
-    Curl_dyn_init(&ua, DYN_HTTP_REQUEST);
-    result = Curl_dyn_addf(&ua, "User-Agent: %s\r\n",
-                           data->set.str[STRING_USERAGENT]);
-    if(result)
-      goto error;
-    result = Curl_hyper_header(data, headers, Curl_dyn_ptr(&ua));
-    if(result)
-      goto error;
-    Curl_dyn_free(&ua);
-  }
-
-  if(!Curl_checkProxyheaders(data, conn, STRCONST("Proxy-Connection"))) {
-    result = Curl_hyper_header(data, headers,
-                               "Proxy-Connection: Keep-Alive");
-    if(result)
-      goto error;
-  }
-
-  result = Curl_add_custom_headers(data, TRUE, headers);
-  if(result)
-    goto error;
-
-  sendtask = hyper_clientconn_send(client, req);
-  if(!sendtask) {
-    failf(data, "hyper_clientconn_send");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-  req = NULL;
-
-  if(HYPERE_OK != hyper_executor_push(h->exec, sendtask)) {
-    failf(data, "Couldn't hyper_executor_push the send");
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-  sendtask = NULL; /* ownership passed on */
-
-  hyper_clientconn_free(client);
-  client = NULL;
-
-error:
-  free(host);
-  free(hostheader);
-  if(io)
-    hyper_io_free(io);
-  if(options)
-    hyper_clientconn_options_free(options);
-  if(handshake)
-    hyper_task_free(handshake);
-  if(client)
-    hyper_clientconn_free(client);
-  if(req)
-    hyper_request_free(req);
-
-  return result;
-}
-
-static CURLcode send_CONNECT(struct Curl_easy *data,
-                             struct connectdata *conn,
-                             struct h1_tunnel_state *ts,
-                             bool *done)
-{
-  struct hyptransfer *h = &data->hyp;
-  hyper_task *task = NULL;
-  hyper_error *hypererr = NULL;
-  CURLcode result = CURLE_OK;
-
-  (void)ts;
-  (void)conn;
-  do {
-    task = hyper_executor_poll(h->exec);
-    if(task) {
-      bool error = hyper_task_type(task) == HYPER_TASK_ERROR;
-      if(error)
-        hypererr = hyper_task_value(task);
-      hyper_task_free(task);
-      if(error) {
-        /* this could probably use a better error code? */
-        result = CURLE_OUT_OF_MEMORY;
-        goto error;
-      }
-    }
-  } while(task);
-error:
-  *done = (result == CURLE_OK);
-  if(hypererr) {
-    uint8_t errbuf[256];
-    size_t errlen = hyper_error_print(hypererr, errbuf, sizeof(errbuf));
-    failf(data, "Hyper: %.*s", (int)errlen, errbuf);
-    hyper_error_free(hypererr);
-  }
-  return result;
-}
-
-static CURLcode recv_CONNECT_resp(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  struct h1_tunnel_state *ts,
-                                  bool *done)
-{
-  struct hyptransfer *h = &data->hyp;
-  CURLcode result;
-  int didwhat;
-
-  (void)ts;
-  *done = FALSE;
-  result = Curl_hyper_stream(data, cf->conn, &didwhat, done,
-                             CURL_CSELECT_IN | CURL_CSELECT_OUT);
-  if(result || !*done)
-    return result;
-  if(h->exec) {
-    hyper_executor_free(h->exec);
-    h->exec = NULL;
-  }
-  if(h->read_waker) {
-    hyper_waker_free(h->read_waker);
-    h->read_waker = NULL;
-  }
-  if(h->write_waker) {
-    hyper_waker_free(h->write_waker);
-    h->write_waker = NULL;
-  }
-  return result;
-}
-
-#endif /* USE_HYPER */
-
 static CURLcode H1_CONNECT(struct Curl_cfilter *cf,
                            struct Curl_easy *data,
                            struct h1_tunnel_state *ts)
@@ -973,10 +706,8 @@ static CURLcode H1_CONNECT(struct Curl_cfilter *cf,
     return CURLE_RECV_ERROR; /* Need a cfilter close and new bootstrap */
 
   do {
-    timediff_t check;
 
-    check = Curl_timeleft(data, NULL, TRUE);
-    if(check <= 0) {
+    if(Curl_timeleft_ms(data) < 0) {
       failf(data, "Proxy CONNECT aborted due to timeout");
       result = CURLE_OPERATION_TIMEDOUT;
       goto out;
@@ -990,31 +721,32 @@ static CURLcode H1_CONNECT(struct Curl_cfilter *cf,
       if(result)
         goto out;
       h1_tunnel_go_state(cf, ts, H1_TUNNEL_CONNECT, data);
-      /* FALLTHROUGH */
+      FALLTHROUGH();
 
     case H1_TUNNEL_CONNECT:
       /* see that the request is completely sent */
       CURL_TRC_CF(data, cf, "CONNECT send");
-      result = send_CONNECT(data, cf->conn, ts, &done);
+      result = send_CONNECT(cf, data, ts, &done);
       if(result || !done)
         goto out;
       h1_tunnel_go_state(cf, ts, H1_TUNNEL_RECEIVE, data);
-      /* FALLTHROUGH */
+      FALLTHROUGH();
 
     case H1_TUNNEL_RECEIVE:
       /* read what is there */
       CURL_TRC_CF(data, cf, "CONNECT receive");
       result = recv_CONNECT_resp(cf, data, ts, &done);
-      if(Curl_pgrsUpdate(data)) {
-        result = CURLE_ABORTED_BY_CALLBACK;
-        goto out;
-      }
+      if(result)
+        CURL_TRC_CF(data, cf, "error receiving CONNECT response: %d",
+                    (int)result);
+      if(!result)
+        result = Curl_pgrsUpdate(data);
       /* error or not complete yet. return for more multi-multi */
       if(result || !done)
         goto out;
       /* got it */
       h1_tunnel_go_state(cf, ts, H1_TUNNEL_RESPONSE, data);
-      /* FALLTHROUGH */
+      FALLTHROUGH();
 
     case H1_TUNNEL_RESPONSE:
       CURL_TRC_CF(data, cf, "CONNECT response");
@@ -1023,6 +755,7 @@ static CURLcode H1_CONNECT(struct Curl_cfilter *cf,
          * If the other side indicated a connection close, or if someone
          * else told us to close this connection, do so now.
          */
+        Curl_req_soft_reset(&data->req, data);
         if(ts->close_connection || conn->bits.close) {
           /* Close this filter and the sub-chain, re-connect the
            * sub-chain and continue. Closing this filter will
@@ -1031,10 +764,7 @@ static CURLcode H1_CONNECT(struct Curl_cfilter *cf,
            */
           CURL_TRC_CF(data, cf, "CONNECT need to close+open");
           infof(data, "Connect me again please");
-          Curl_conn_cf_close(cf, data);
-          connkeep(conn, "HTTP proxy CONNECT");
-          result = Curl_conn_cf_connect(cf->next, data, FALSE, &done);
-          goto out;
+          return CURLE_AGAIN;
         }
         else {
           /* staying on this connection, reset state */
@@ -1050,19 +780,36 @@ static CURLcode H1_CONNECT(struct Curl_cfilter *cf,
   } while(data->req.newurl);
 
   DEBUGASSERT(ts->tunnel_state == H1_TUNNEL_RESPONSE);
-  if(data->info.httpproxycode/100 != 2) {
-    /* a non-2xx response and we have no next url to try. */
-    Curl_safefree(data->req.newurl);
-    /* failure, close this connection to avoid reuse */
-    streamclose(conn, "proxy CONNECT failure");
-    h1_tunnel_go_state(cf, ts, H1_TUNNEL_FAILED, data);
-    failf(data, "CONNECT tunnel failed, response %d", data->req.httpcode);
-    return CURLE_RECV_ERROR;
+  if(h1_proxy_is_udp(cf)) {
+    /* RFC 9298: Accept 101 Upgrade for HTTP/1.1 and
+     * 2xx responses for HTTP/2 and HTTP/3 proxies. */
+    if(data->info.httpproxycode / 100 != 2 &&
+       data->info.httpproxycode != 101) {
+      curlx_safefree(data->req.newurl);
+      h1_tunnel_go_state(cf, ts, H1_TUNNEL_FAILED, data);
+      failf(data, "CONNECT-UDP tunnel failed, response %d",
+            data->req.httpcode);
+      return CURLE_COULDNT_CONNECT;
+    }
+  }
+  else {
+    if(data->info.httpproxycode / 100 != 2) {
+      /* a non-2xx response and we have no next URL to try. */
+      curlx_safefree(data->req.newurl);
+      h1_tunnel_go_state(cf, ts, H1_TUNNEL_FAILED, data);
+      failf(data, "CONNECT tunnel failed, response %d", data->req.httpcode);
+      return CURLE_COULDNT_CONNECT;
+    }
   }
   /* 2xx response, SUCCESS! */
+  /* 101 Switching Protocol for CONNECT-UDP */
   h1_tunnel_go_state(cf, ts, H1_TUNNEL_ESTABLISHED, data);
-  infof(data, "CONNECT tunnel established, response %d",
-        data->info.httpproxycode);
+  if(h1_proxy_is_udp(cf))
+    infof(data, "CONNECT-UDP tunnel established, response %d",
+                                    data->info.httpproxycode);
+  else
+    infof(data, "CONNECT tunnel established, response %d",
+                                    data->info.httpproxycode);
   result = CURLE_OK;
 
 out:
@@ -1073,10 +820,11 @@ out:
 
 static CURLcode cf_h1_proxy_connect(struct Curl_cfilter *cf,
                                     struct Curl_easy *data,
-                                    bool blocking, bool *done)
+                                    bool *done)
 {
   CURLcode result;
-  struct h1_tunnel_state *ts = cf->ctx;
+  struct cf_h1_proxy_ctx *pctx = cf->ctx;
+  struct h1_tunnel_state *ts = pctx->ts;
 
   if(cf->connected) {
     *done = TRUE;
@@ -1084,111 +832,174 @@ static CURLcode cf_h1_proxy_connect(struct Curl_cfilter *cf,
   }
 
   CURL_TRC_CF(data, cf, "connect");
-  result = cf->next->cft->do_connect(cf->next, data, blocking, done);
+  result = cf->next->cft->do_connect(cf->next, data, done);
   if(result || !*done)
     return result;
 
   *done = FALSE;
   if(!ts) {
-    result = tunnel_init(&ts, data, cf->conn, cf->sockindex);
+    result = tunnel_init(cf, data, &ts);
     if(result)
       return result;
-    cf->ctx = ts;
+    pctx->ts = ts;
   }
 
-  /* TODO: can we do blocking? */
   /* We want "seamless" operations through HTTP proxy tunnel */
 
   result = H1_CONNECT(cf, data, ts);
   if(result)
     goto out;
-  Curl_safefree(data->state.aptr.proxyuserpwd);
+  curlx_safefree(data->req.hd_proxy_auth);
 
 out:
-  *done = (result == CURLE_OK) && tunnel_is_established(cf->ctx);
+  *done = (result == CURLE_OK) && tunnel_is_established(pctx->ts);
   if(*done) {
     cf->connected = TRUE;
-    tunnel_free(cf, data);
+    /* The real request will follow the CONNECT, reset request partially */
+    Curl_req_soft_reset(&data->req, data);
+    Curl_client_reset(data);
+    Curl_pgrsReset(data);
+    cf_tunnel_free(cf, data);
   }
   return result;
 }
 
-static int cf_h1_proxy_get_select_socks(struct Curl_cfilter *cf,
-                                        struct Curl_easy *data,
-                                        curl_socket_t *socks)
+static CURLcode cf_h1_proxy_adjust_pollset(struct Curl_cfilter *cf,
+                                           struct Curl_easy *data,
+                                           struct easy_pollset *ps)
 {
-  struct h1_tunnel_state *ts = cf->ctx;
-  int fds;
+  struct cf_h1_proxy_ctx *pctx = cf->ctx;
+  struct h1_tunnel_state *ts = pctx->ts;
+  CURLcode result = CURLE_OK;
 
-  fds = cf->next->cft->get_select_socks(cf->next, data, socks);
-  if(!fds && cf->next->connected && !cf->connected) {
+  if(!cf->connected) {
     /* If we are not connected, but the filter "below" is
      * and not waiting on something, we are tunneling. */
-    socks[0] = Curl_conn_cf_get_socket(cf, data);
+    curl_socket_t sock = Curl_conn_cf_get_socket(cf, data);
     if(ts) {
-      /* when we've sent a CONNECT to a proxy, we should rather either
+      /* when we have sent a CONNECT to a proxy, we should rather either
          wait for the socket to become readable to be able to get the
-         response headers or if we're still sending the request, wait
+         response headers or if we are still sending the request, wait
          for write. */
-      if(ts->CONNECT.sending == HTTPSEND_REQUEST) {
-        return GETSOCK_WRITESOCK(0);
-      }
-      return GETSOCK_READSOCK(0);
+      if(tunnel_want_send(ts))
+        result = Curl_pollset_set_out_only(data, ps, sock);
+      else
+        result = Curl_pollset_set_in_only(data, ps, sock);
     }
-    return GETSOCK_WRITESOCK(0);
+    else
+      result = Curl_pollset_set_out_only(data, ps, sock);
   }
-  return fds;
+  else {
+    if(cf->next)
+      result = cf->next->cft->adjust_pollset(cf->next, data, ps);
+  }
+  return result;
+}
+
+static bool cf_h1_proxy_data_pending(struct Curl_cfilter *cf,
+                                     const struct Curl_easy *data)
+{
+  return cf->next ? cf->next->cft->has_data_pending(cf->next, data) : FALSE;
 }
 
 static void cf_h1_proxy_destroy(struct Curl_cfilter *cf,
                                 struct Curl_easy *data)
 {
   CURL_TRC_CF(data, cf, "destroy");
-  tunnel_free(cf, data);
+  cf_tunnel_free(cf, data);
+  curlx_safefree(cf->ctx);
 }
 
-static void cf_h1_proxy_close(struct Curl_cfilter *cf,
-                              struct Curl_easy *data)
+static CURLcode cf_h1_proxy_query(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  int query, int *pres1, void *pres2)
 {
-  CURL_TRC_CF(data, cf, "close");
-  cf->connected = FALSE;
-  if(cf->ctx) {
-    h1_tunnel_go_state(cf, cf->ctx, H1_TUNNEL_INIT, data);
+  struct cf_h1_proxy_ctx *pctx = cf->ctx;
+  struct h1_tunnel_state *ts = pctx ? pctx->ts : NULL;
+  switch(query) {
+  case CF_QUERY_HOST_PORT:
+    if(!ts || !ts->dest)
+      break;
+    *pres1 = (int)ts->dest->port;
+    *((const char **)pres2) = ts->dest->hostname;
+    return CURLE_OK;
+  case CF_QUERY_ALPN_NEGOTIATED: {
+    const char **palpn = pres2;
+    DEBUGASSERT(palpn);
+    *palpn = NULL;
+    return CURLE_OK;
   }
-  if(cf->next)
-    cf->next->cft->do_close(cf->next, data);
+  default:
+    break;
+  }
+  return cf->next ?
+    cf->next->cft->query(cf->next, data, query, pres1, pres2) :
+    CURLE_UNKNOWN_OPTION;
 }
 
-
 struct Curl_cftype Curl_cft_h1_proxy = {
   "H1-PROXY",
-  CF_TYPE_IP_CONNECT,
+  CF_TYPE_IP_CONNECT | CF_TYPE_PROXY,
   0,
   cf_h1_proxy_destroy,
   cf_h1_proxy_connect,
-  cf_h1_proxy_close,
-  Curl_cf_http_proxy_get_host,
-  cf_h1_proxy_get_select_socks,
-  Curl_cf_def_data_pending,
+  Curl_cf_def_shutdown,
+  cf_h1_proxy_adjust_pollset,
+  cf_h1_proxy_data_pending,
   Curl_cf_def_send,
   Curl_cf_def_recv,
   Curl_cf_def_cntrl,
   Curl_cf_def_conn_is_alive,
   Curl_cf_def_conn_keep_alive,
-  Curl_cf_def_query,
+  cf_h1_proxy_query,
 };
 
 CURLcode Curl_cf_h1_proxy_insert_after(struct Curl_cfilter *cf_at,
-                                       struct Curl_easy *data)
+                                       struct Curl_easy *data,
+                                       struct Curl_peer *dest,
+                                       int httpversion,
+                                       bool udp_tunnel)
 {
   struct Curl_cfilter *cf;
+  struct cf_h1_proxy_ctx *pctx;
+  struct h1_tunnel_state *ts;
   CURLcode result;
 
   (void)data;
-  result = Curl_cf_create(&cf, &Curl_cft_h1_proxy, NULL);
-  if(!result)
-    Curl_conn_cf_insert_after(cf_at, cf);
+  if(!dest)
+    return CURLE_FAILED_INIT;
+  if((httpversion < 10) || (httpversion >= 20))
+    return CURLE_FAILED_INIT;
+
+  ts = curlx_calloc(1, sizeof(*ts));
+  if(!ts) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+  Curl_peer_link(&ts->dest, dest);
+  ts->httpversion = httpversion;
+  curlx_dyn_init(&ts->rcvbuf, DYN_PROXY_CONNECT_HEADERS);
+  curlx_dyn_init(&ts->request_data, DYN_HTTP_REQUEST);
+  Curl_httpchunk_init(data, &ts->ch, TRUE);
+
+  pctx = curlx_calloc(1, sizeof(*pctx));
+  if(!pctx) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+  pctx->udp_tunnel = udp_tunnel;
+  pctx->ts = ts;
+  result = Curl_cf_create(&cf, &Curl_cft_h1_proxy, pctx);
+  if(result) {
+    curlx_free(pctx);
+    goto out;
+  }
+  ts = NULL;
+  Curl_conn_cf_insert_after(cf_at, cf);
+
+out:
+  tunnel_free(ts, data);
   return result;
 }
 
-#endif /* !CURL_DISABLE_PROXY && ! CURL_DISABLE_HTTP */
+#endif /* !CURL_DISABLE_PROXY && !CURL_DISABLE_HTTP */
diff --git a/third-party/curl/lib/cf-h1-proxy.h b/third-party/curl/lib/cf-h1-proxy.h
index ac5bed0b2b..3255bf79f2 100644
--- a/third-party/curl/lib/cf-h1-proxy.h
+++ b/third-party/curl/lib/cf-h1-proxy.h
@@ -23,17 +23,20 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if !defined(CURL_DISABLE_PROXY) && !defined(CURL_DISABLE_HTTP)
 
-CURLcode Curl_cf_h1_proxy_insert_after(struct Curl_cfilter *cf,
-                                       struct Curl_easy *data);
+struct Curl_peer;
+
+CURLcode Curl_cf_h1_proxy_insert_after(struct Curl_cfilter *cf_at,
+                                       struct Curl_easy *data,
+                                       struct Curl_peer *dest,
+                                       int httpversion,
+                                       bool udp_tunnel);
 
 extern struct Curl_cftype Curl_cft_h1_proxy;
 
-
 #endif /* !CURL_DISABLE_PROXY && !CURL_DISABLE_HTTP */
 
 #endif /* HEADER_CURL_H1_PROXY_H */
diff --git a/third-party/curl/lib/cf-h2-proxy.c b/third-party/curl/lib/cf-h2-proxy.c
index a3feefca07..be303ffd3e 100644
--- a/third-party/curl/lib/cf-h2-proxy.c
+++ b/third-party/curl/lib/cf-h2-proxy.c
@@ -21,36 +21,34 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#if defined(USE_NGHTTP2) && !defined(CURL_DISABLE_PROXY)
+#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_PROXY) && \
+  defined(USE_NGHTTP2)
 
 #include <nghttp2/nghttp2.h>
+
 #include "urldata.h"
+#include "url.h"
 #include "cfilters.h"
 #include "connect.h"
 #include "curl_trc.h"
 #include "bufq.h"
-#include "dynbuf.h"
+#include "curlx/dynbuf.h"
 #include "dynhds.h"
-#include "http1.h"
 #include "http2.h"
 #include "http_proxy.h"
 #include "multiif.h"
+#include "sendf.h"
+#include "select.h"
 #include "cf-h2-proxy.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-#define PROXY_H2_CHUNK_SIZE  (16*1024)
+#define PROXY_H2_CHUNK_SIZE  (16 * 1024)
 
 #define PROXY_HTTP2_HUGE_WINDOW_SIZE (100 * 1024 * 1024)
 #define H2_TUNNEL_WINDOW_SIZE        (10 * 1024 * 1024)
 
-#define PROXY_H2_NW_RECV_CHUNKS  (H2_TUNNEL_WINDOW_SIZE / PROXY_H2_CHUNK_SIZE)
+#define PROXY_H2_NW_RECV_CHUNKS   (H2_TUNNEL_WINDOW_SIZE / PROXY_H2_CHUNK_SIZE)
 #define PROXY_H2_NW_SEND_CHUNKS   1
 
 #define H2_TUNNEL_RECV_CHUNKS   (H2_TUNNEL_WINDOW_SIZE / PROXY_H2_CHUNK_SIZE)
@@ -58,11 +56,11 @@
 
 
 typedef enum {
-    H2_TUNNEL_INIT,     /* init/default/no tunnel state */
-    H2_TUNNEL_CONNECT,  /* CONNECT request is being send */
-    H2_TUNNEL_RESPONSE, /* CONNECT response received completely */
-    H2_TUNNEL_ESTABLISHED,
-    H2_TUNNEL_FAILED
+  H2_TUNNEL_INIT,     /* init/default/no tunnel state */
+  H2_TUNNEL_CONNECT,  /* CONNECT request is being send */
+  H2_TUNNEL_RESPONSE, /* CONNECT response received completely */
+  H2_TUNNEL_ESTABLISHED,
+  H2_TUNNEL_FAILED
 } h2_tunnel_state;
 
 struct tunnel_stream {
@@ -72,57 +70,52 @@ struct tunnel_stream {
   char *authority;
   int32_t stream_id;
   uint32_t error;
-  size_t upload_blocked_len;
   h2_tunnel_state state;
   BIT(has_final_response);
   BIT(closed);
   BIT(reset);
 };
 
-static CURLcode tunnel_stream_init(struct Curl_cfilter *cf,
-                                    struct tunnel_stream *ts)
+static CURLcode tunnel_stream_init(struct tunnel_stream *ts,
+                                   struct Curl_peer *dest)
 {
-  const char *hostname;
-  int port;
-  bool ipv6_ip = cf->conn->bits.ipv6_ip;
-
   ts->state = H2_TUNNEL_INIT;
   ts->stream_id = -1;
   Curl_bufq_init2(&ts->recvbuf, PROXY_H2_CHUNK_SIZE, H2_TUNNEL_RECV_CHUNKS,
                   BUFQ_OPT_SOFT_LIMIT);
   Curl_bufq_init(&ts->sendbuf, PROXY_H2_CHUNK_SIZE, H2_TUNNEL_SEND_CHUNKS);
 
-  if(cf->conn->bits.conn_to_host)
-    hostname = cf->conn->conn_to_host.name;
-  else if(cf->sockindex == SECONDARYSOCKET)
-    hostname = cf->conn->secondaryhostname;
-  else
-    hostname = cf->conn->host.name;
-
-  if(cf->sockindex == SECONDARYSOCKET)
-    port = cf->conn->secondary_port;
-  else if(cf->conn->bits.conn_to_port)
-    port = cf->conn->conn_to_port;
-  else
-    port = cf->conn->remote_port;
-
-  if(hostname != cf->conn->host.name)
-    ipv6_ip = (strchr(hostname, ':') != NULL);
-
-  ts->authority = /* host:port with IPv6 support */
-    aprintf("%s%s%s:%d", ipv6_ip?"[":"", hostname, ipv6_ip?"]":"", port);
+  /* host:port with IPv6 support */
+  ts->authority = curl_maprintf("%s%s%s:%u", dest->ipv6 ? "[" : "",
+                                dest->hostname,
+                                dest->ipv6 ? "]" : "",
+                                dest->port);
   if(!ts->authority)
     return CURLE_OUT_OF_MEMORY;
 
   return CURLE_OK;
 }
 
+static void tunnel_stream_reset(struct tunnel_stream *ts)
+{
+  Curl_http_resp_free(ts->resp);
+  ts->resp = NULL;
+  Curl_bufq_reset(&ts->recvbuf);
+  Curl_bufq_reset(&ts->sendbuf);
+  ts->stream_id = -1;
+  ts->error = 0;
+  ts->has_final_response = FALSE;
+  ts->closed = FALSE;
+  ts->reset = FALSE;
+  ts->state = H2_TUNNEL_INIT;
+}
+
 static void tunnel_stream_clear(struct tunnel_stream *ts)
 {
   Curl_http_resp_free(ts->resp);
   Curl_bufq_free(&ts->recvbuf);
   Curl_bufq_free(&ts->sendbuf);
-  Curl_safefree(ts->authority);
+  curlx_safefree(ts->authority);
   memset(ts, 0, sizeof(*ts));
   ts->state = H2_TUNNEL_INIT;
 }
@@ -130,9 +123,11 @@ static void tunnel_stream_clear(struct tunnel_stream *ts)
 static void h2_tunnel_go_state(struct Curl_cfilter *cf,
                                struct tunnel_stream *ts,
                                h2_tunnel_state new_state,
-                               struct Curl_easy *data)
+                               struct Curl_easy *data,
+                               bool udp_tunnel)
 {
   (void)cf;
+  (void)udp_tunnel;
 
   if(ts->state == new_state)
     return;
@@ -148,7 +143,7 @@ static void h2_tunnel_go_state(struct Curl_cfilter *cf,
   switch(new_state) {
   case H2_TUNNEL_INIT:
     CURL_TRC_CF(data, cf, "[%d] new tunnel state 'init'", ts->stream_id);
-    tunnel_stream_clear(ts);
+    tunnel_stream_reset(ts);
     break;
 
   case H2_TUNNEL_CONNECT:
@@ -164,18 +159,19 @@ static void h2_tunnel_go_state(struct Curl_cfilter *cf,
   case H2_TUNNEL_ESTABLISHED:
     CURL_TRC_CF(data, cf, "[%d] new tunnel state 'established'",
                 ts->stream_id);
-    infof(data, "CONNECT phase completed");
+    infof(data, "CONNECT%s phase completed for HTTP/2 proxy",
+          udp_tunnel ? "-UDP" : "");
     data->state.authproxy.done = TRUE;
     data->state.authproxy.multipass = FALSE;
-    /* FALLTHROUGH */
+    FALLTHROUGH();
   case H2_TUNNEL_FAILED:
     if(new_state == H2_TUNNEL_FAILED)
       CURL_TRC_CF(data, cf, "[%d] new tunnel state 'failed'", ts->stream_id);
     ts->state = new_state;
     /* If a proxy-authorization header was used for the proxy, then we should
-       make sure that it isn't accidentally used for the document request
-       after we've connected. So let's free and clear it here. */
-    Curl_safefree(data->state.aptr.proxyuserpwd);
+       make sure that it is not accidentally used for the document request
+       after we have connected. Let's thus free and clear it here. */
+    curlx_safefree(data->req.hd_proxy_auth);
     break;
   }
 }
@@ -188,18 +184,20 @@ struct cf_h2_proxy_ctx {
   struct bufq inbufq;  /* network receive buffer */
   struct bufq outbufq; /* network send buffer */
 
+  struct Curl_peer *dest; /* where to tunnel to */
   struct tunnel_stream tunnel; /* our tunnel CONNECT stream */
   int32_t goaway_error;
   int32_t last_stream_id;
   BIT(conn_closed);
-  BIT(goaway);
+  BIT(rcvd_goaway);
+  BIT(sent_goaway);
   BIT(nw_out_blocked);
+  BIT(udp_tunnel);
 };
 
 /* How to access `call_data` from a cf_h2 filter */
 #undef CF_CTX_CALL_DATA
-#define CF_CTX_CALL_DATA(cf)  \
-  ((struct cf_h2_proxy_ctx *)(cf)->ctx)->call_data
+#define CF_CTX_CALL_DATA(cf) ((struct cf_h2_proxy_ctx *)(cf)->ctx)->call_data
 
 static void cf_h2_proxy_ctx_clear(struct cf_h2_proxy_ctx *ctx)
 {
@@ -210,6 +208,7 @@ static void cf_h2_proxy_ctx_clear(struct cf_h2_proxy_ctx *ctx)
   }
   Curl_bufq_free(&ctx->inbufq);
   Curl_bufq_free(&ctx->outbufq);
+  Curl_peer_unlink(&ctx->dest);
   tunnel_stream_clear(&ctx->tunnel);
   memset(ctx, 0, sizeof(*ctx));
   ctx->call_data = save;
@@ -219,7 +218,7 @@ static void cf_h2_proxy_ctx_free(struct cf_h2_proxy_ctx *ctx)
 {
   if(ctx) {
     cf_h2_proxy_ctx_clear(ctx);
-    free(ctx);
+    curlx_free(ctx);
   }
 }
 
@@ -227,57 +226,29 @@ static void drain_tunnel(struct Curl_cfilter *cf,
                          struct Curl_easy *data,
                          struct tunnel_stream *tunnel)
 {
-  unsigned char bits;
-
+  struct cf_h2_proxy_ctx *ctx = cf->ctx;
   (void)cf;
-  bits = CURL_CSELECT_IN;
-  if(!tunnel->closed && !tunnel->reset && tunnel->upload_blocked_len)
-    bits |= CURL_CSELECT_OUT;
-  if(data->state.dselect_bits != bits || 1) {
-    CURL_TRC_CF(data, cf, "[%d] DRAIN dselect_bits=%x",
-                tunnel->stream_id, bits);
-    data->state.dselect_bits = bits;
-    Curl_expire(data, 0, EXPIRE_RUN_NOW);
-  }
+  if(!tunnel->closed && !tunnel->reset &&
+     (!Curl_bufq_is_empty(&ctx->tunnel.sendbuf) ||
+      !Curl_bufq_is_empty(&ctx->tunnel.recvbuf)))
+    Curl_multi_mark_dirty(data);
 }
 
-static ssize_t proxy_nw_in_reader(void *reader_ctx,
-                                  unsigned char *buf, size_t buflen,
-                                  CURLcode *err)
-{
-  struct Curl_cfilter *cf = reader_ctx;
-  ssize_t nread;
-
-  if(cf) {
-    struct Curl_easy *data = CF_DATA_CURRENT(cf);
-    nread = Curl_conn_cf_recv(cf->next, data, (char *)buf, buflen, err);
-    CURL_TRC_CF(data, cf, "[0] nw_in_reader(len=%zu) -> %zd, %d",
-                buflen, nread, *err);
-  }
-  else {
-    nread = 0;
-  }
-  return nread;
-}
-
-static ssize_t proxy_h2_nw_out_writer(void *writer_ctx,
-                                      const unsigned char *buf, size_t buflen,
-                                      CURLcode *err)
+static CURLcode proxy_h2_nw_out_writer(void *writer_ctx,
+                                       const uint8_t *buf, size_t buflen,
+                                       size_t *pnwritten)
 {
   struct Curl_cfilter *cf = writer_ctx;
-  ssize_t nwritten;
-
+  *pnwritten = 0;
   if(cf) {
     struct Curl_easy *data = CF_DATA_CURRENT(cf);
-    nwritten = Curl_conn_cf_send(cf->next, data, (const char *)buf, buflen,
-                                 err);
-    CURL_TRC_CF(data, cf, "[0] nw_out_writer(len=%zu) -> %zd, %d",
-                buflen, nwritten, *err);
+    CURLcode result;
+    result = Curl_conn_cf_send(cf->next, data, buf, buflen, FALSE, pnwritten);
+    CURL_TRC_CF(data, cf, "[0] nw_out_writer(len=%zu) -> %d, %zu",
+                buflen, (int)result, *pnwritten);
+    return result;
   }
-  else {
-    nwritten = 0;
-  }
-  return nwritten;
+  return CURLE_FAILED_INIT;
 }
 
 static int proxy_h2_client_new(struct Curl_cfilter *cf,
@@ -285,129 +256,24 @@ static int proxy_h2_client_new(struct Curl_cfilter *cf,
 {
   struct cf_h2_proxy_ctx *ctx = cf->ctx;
   nghttp2_option *o;
+  nghttp2_mem mem = { NULL, Curl_nghttp2_malloc, Curl_nghttp2_free,
+                      Curl_nghttp2_calloc, Curl_nghttp2_realloc };
 
   int rc = nghttp2_option_new(&o);
   if(rc)
     return rc;
   /* We handle window updates ourself to enforce buffer limits */
   nghttp2_option_set_no_auto_window_update(o, 1);
-#if NGHTTP2_VERSION_NUM >= 0x013200
-  /* with 1.50.0 */
+#if NGHTTP2_VERSION_NUM >= 0x013200 /* with 1.50.0 */
   /* turn off RFC 9113 leading and trailing white spaces validation against
      HTTP field value. */
   nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation(o, 1);
 #endif
-  rc = nghttp2_session_client_new2(&ctx->h2, cbs, cf, o);
+  rc = nghttp2_session_client_new3(&ctx->h2, cbs, cf, o, &mem);
   nghttp2_option_del(o);
   return rc;
 }
 
-static ssize_t on_session_send(nghttp2_session *h2,
-                              const uint8_t *buf, size_t blen,
-                              int flags, void *userp);
-static int proxy_h2_on_frame_recv(nghttp2_session *session,
-                                  const nghttp2_frame *frame,
-                                  void *userp);
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-static int on_frame_send(nghttp2_session *session, const nghttp2_frame *frame,
-                         void *userp);
-#endif
-static int proxy_h2_on_stream_close(nghttp2_session *session,
-                                    int32_t stream_id,
-                                    uint32_t error_code, void *userp);
-static int proxy_h2_on_header(nghttp2_session *session,
-                              const nghttp2_frame *frame,
-                              const uint8_t *name, size_t namelen,
-                              const uint8_t *value, size_t valuelen,
-                              uint8_t flags,
-                              void *userp);
-static int tunnel_recv_callback(nghttp2_session *session, uint8_t flags,
-                                int32_t stream_id,
-                                const uint8_t *mem, size_t len, void *userp);
-
-/*
- * Initialize the cfilter context
- */
-static CURLcode cf_h2_proxy_ctx_init(struct Curl_cfilter *cf,
-                                     struct Curl_easy *data)
-{
-  struct cf_h2_proxy_ctx *ctx = cf->ctx;
-  CURLcode result = CURLE_OUT_OF_MEMORY;
-  nghttp2_session_callbacks *cbs = NULL;
-  int rc;
-
-  DEBUGASSERT(!ctx->h2);
-  memset(&ctx->tunnel, 0, sizeof(ctx->tunnel));
-
-  Curl_bufq_init(&ctx->inbufq, PROXY_H2_CHUNK_SIZE, PROXY_H2_NW_RECV_CHUNKS);
-  Curl_bufq_init(&ctx->outbufq, PROXY_H2_CHUNK_SIZE, PROXY_H2_NW_SEND_CHUNKS);
-
-  if(tunnel_stream_init(cf, &ctx->tunnel))
-    goto out;
-
-  rc = nghttp2_session_callbacks_new(&cbs);
-  if(rc) {
-    failf(data, "Couldn't initialize nghttp2 callbacks");
-    goto out;
-  }
-
-  nghttp2_session_callbacks_set_send_callback(cbs, on_session_send);
-  nghttp2_session_callbacks_set_on_frame_recv_callback(
-    cbs, proxy_h2_on_frame_recv);
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-  nghttp2_session_callbacks_set_on_frame_send_callback(cbs, on_frame_send);
-#endif
-  nghttp2_session_callbacks_set_on_data_chunk_recv_callback(
-    cbs, tunnel_recv_callback);
-  nghttp2_session_callbacks_set_on_stream_close_callback(
-    cbs, proxy_h2_on_stream_close);
-  nghttp2_session_callbacks_set_on_header_callback(cbs, proxy_h2_on_header);
-
-  /* The nghttp2 session is not yet setup, do it */
-  rc = proxy_h2_client_new(cf, cbs);
-  if(rc) {
-    failf(data, "Couldn't initialize nghttp2");
-    goto out;
-  }
-
-  {
-    nghttp2_settings_entry iv[3];
-
-    iv[0].settings_id = NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS;
-    iv[0].value = Curl_multi_max_concurrent_streams(data->multi);
-    iv[1].settings_id = NGHTTP2_SETTINGS_INITIAL_WINDOW_SIZE;
-    iv[1].value = H2_TUNNEL_WINDOW_SIZE;
-    iv[2].settings_id = NGHTTP2_SETTINGS_ENABLE_PUSH;
-    iv[2].value = 0;
-    rc = nghttp2_submit_settings(ctx->h2, NGHTTP2_FLAG_NONE, iv, 3);
-    if(rc) {
-      failf(data, "nghttp2_submit_settings() failed: %s(%d)",
-            nghttp2_strerror(rc), rc);
-      result = CURLE_HTTP2;
-      goto out;
-    }
-  }
-
-  rc = nghttp2_session_set_local_window_size(ctx->h2, NGHTTP2_FLAG_NONE, 0,
-                                             PROXY_HTTP2_HUGE_WINDOW_SIZE);
-  if(rc) {
-    failf(data, "nghttp2_session_set_local_window_size() failed: %s(%d)",
-          nghttp2_strerror(rc), rc);
-    result = CURLE_HTTP2;
-    goto out;
-  }
-
-
-  /* all set, traffic will be send on connect */
-  result = CURLE_OK;
-
-out:
-  if(cbs)
-    nghttp2_session_callbacks_del(cbs);
-  CURL_TRC_CF(data, cf, "[0] init proxy ctx -> %d", result);
-  return result;
-}
-
 static int proxy_h2_should_close_session(struct cf_h2_proxy_ctx *ctx)
 {
   return !nghttp2_session_want_read(ctx->h2) &&
@@ -418,16 +284,15 @@ static CURLcode proxy_h2_nw_out_flush(struct Curl_cfilter *cf,
                                       struct Curl_easy *data)
 {
   struct cf_h2_proxy_ctx *ctx = cf->ctx;
-  ssize_t nwritten;
+  size_t nwritten;
   CURLcode result;
 
-  (void)data;
   if(Curl_bufq_is_empty(&ctx->outbufq))
     return CURLE_OK;
 
-  nwritten = Curl_bufq_pass(&ctx->outbufq, proxy_h2_nw_out_writer, cf,
-                            &result);
-  if(nwritten < 0) {
+  result = Curl_bufq_pass(&ctx->outbufq, proxy_h2_nw_out_writer, cf,
+                          &nwritten);
+  if(result) {
     if(result == CURLE_AGAIN) {
       CURL_TRC_CF(data, cf, "[0] flush nw send buffer(%zu) -> EAGAIN",
                   Curl_bufq_len(&ctx->outbufq));
@@ -436,7 +301,7 @@ static CURLcode proxy_h2_nw_out_flush(struct Curl_cfilter *cf,
     return result;
   }
   CURL_TRC_CF(data, cf, "[0] nw send buffer flushed");
-  return Curl_bufq_is_empty(&ctx->outbufq)? CURLE_OK: CURLE_AGAIN;
+  return Curl_bufq_is_empty(&ctx->outbufq) ? CURLE_OK : CURLE_AGAIN;
 }
 
 /*
@@ -444,27 +309,30 @@ static CURLcode proxy_h2_nw_out_flush(struct Curl_cfilter *cf,
  * This function returns 0 if it succeeds, or -1 and error code will
  * be assigned to *err.
  */
-static int proxy_h2_process_pending_input(struct Curl_cfilter *cf,
-                                          struct Curl_easy *data,
-                                          CURLcode *err)
+static CURLcode proxy_h2_process_pending_input(struct Curl_cfilter *cf,
+                                               struct Curl_easy *data)
 {
   struct cf_h2_proxy_ctx *ctx = cf->ctx;
   const unsigned char *buf;
-  size_t blen;
+  size_t blen, nread;
   ssize_t rv;
 
   while(Curl_bufq_peek(&ctx->inbufq, &buf, &blen)) {
 
     rv = nghttp2_session_mem_recv(ctx->h2, (const uint8_t *)buf, blen);
     CURL_TRC_CF(data, cf, "[0] %zu bytes to nghttp2 -> %zd", blen, rv);
-    if(rv < 0) {
+    if(!curlx_sztouz(rv, &nread)) {
       failf(data,
             "process_pending_input: nghttp2_session_mem_recv() returned "
             "%zd:%s", rv, nghttp2_strerror((int)rv));
-      *err = CURLE_RECV_ERROR;
-      return -1;
+      return CURLE_RECV_ERROR;
     }
-    Curl_bufq_skip(&ctx->inbufq, (size_t)rv);
+    else if(!nread) {
+      /* nghttp2 does not want to process more, but has no error. This
+       * probably cannot happen, but be safe. */
+      break;
+    }
+    Curl_bufq_skip(&ctx->inbufq, nread);
     if(Curl_bufq_is_empty(&ctx->inbufq)) {
       CURL_TRC_CF(data, cf, "[0] all data in connection buffer processed");
       break;
@@ -474,8 +342,7 @@ static int proxy_h2_process_pending_input(struct Curl_cfilter *cf,
                   "in connection buffer", Curl_bufq_len(&ctx->inbufq));
     }
   }
-
-  return 0;
+  return CURLE_OK;
 }
 
 static CURLcode proxy_h2_progress_ingress(struct Curl_cfilter *cf,
@@ -483,46 +350,45 @@ static CURLcode proxy_h2_progress_ingress(struct Curl_cfilter *cf,
 {
   struct cf_h2_proxy_ctx *ctx = cf->ctx;
   CURLcode result = CURLE_OK;
-  ssize_t nread;
+  size_t nread;
 
-  /* Process network input buffer fist */
+  /* Process network input buffer first */
   if(!Curl_bufq_is_empty(&ctx->inbufq)) {
     CURL_TRC_CF(data, cf, "[0] process %zu bytes in connection buffer",
                 Curl_bufq_len(&ctx->inbufq));
-    if(proxy_h2_process_pending_input(cf, data, &result) < 0)
+    result = proxy_h2_process_pending_input(cf, data);
+    if(result)
       return result;
   }
 
   /* Receive data from the "lower" filters, e.g. network until
    * it is time to stop or we have enough data for this stream */
-  while(!ctx->conn_closed &&               /* not closed the connection */
-        !ctx->tunnel.closed &&             /* nor the tunnel */
+  while(!ctx->conn_closed &&                /* not closed the connection */
+        !ctx->tunnel.closed &&              /* nor the tunnel */
         Curl_bufq_is_empty(&ctx->inbufq) && /* and we consumed our input */
         !Curl_bufq_is_full(&ctx->tunnel.recvbuf)) {
 
-    nread = Curl_bufq_slurp(&ctx->inbufq, proxy_nw_in_reader, cf, &result);
-    CURL_TRC_CF(data, cf, "[0] read %zu bytes nw data -> %zd, %d",
-                Curl_bufq_len(&ctx->inbufq), nread, result);
-    if(nread < 0) {
+    result = Curl_cf_recv_bufq(cf->next, data, &ctx->inbufq, 0, &nread);
+    CURL_TRC_CF(data, cf, "[0] read %zu bytes nw data -> %d, %zu",
+                Curl_bufq_len(&ctx->inbufq), (int)result, nread);
+    if(result) {
       if(result != CURLE_AGAIN) {
-        failf(data, "Failed receiving HTTP2 data");
+        failf(data, "Failed receiving HTTP2 proxy data");
         return result;
       }
       break;
     }
     else if(nread == 0) {
+      CURL_TRC_CF(data, cf, "server closed connection");
       ctx->conn_closed = TRUE;
       break;
     }
 
-    if(proxy_h2_process_pending_input(cf, data, &result))
+    result = proxy_h2_process_pending_input(cf, data);
+    if(result)
       return result;
   }
 
-  if(ctx->conn_closed && Curl_bufq_is_empty(&ctx->inbufq)) {
-    connclose(cf->conn, "GOAWAY received");
-  }
-
   return CURLE_OK;
 }
 
@@ -551,17 +417,18 @@ static ssize_t on_session_send(nghttp2_session *h2,
   struct Curl_cfilter *cf = userp;
   struct cf_h2_proxy_ctx *ctx = cf->ctx;
   struct Curl_easy *data = CF_DATA_CURRENT(cf);
-  ssize_t nwritten;
+  size_t nwritten;
   CURLcode result = CURLE_OK;
 
   (void)h2;
   (void)flags;
   DEBUGASSERT(data);
 
-  nwritten = Curl_bufq_write_pass(&ctx->outbufq, buf, blen,
-                                  proxy_h2_nw_out_writer, cf, &result);
-  if(nwritten < 0) {
+  result = Curl_bufq_write_pass(&ctx->outbufq, buf, blen,
+                                proxy_h2_nw_out_writer, cf, &nwritten);
+  if(result) {
     if(result == CURLE_AGAIN) {
+      ctx->nw_out_blocked = 1;
       return NGHTTP2_ERR_WOULDBLOCK;
     }
     failf(data, "Failed sending HTTP2 data");
@@ -571,99 +438,30 @@ static ssize_t on_session_send(nghttp2_session *h2,
   if(!nwritten)
     return NGHTTP2_ERR_WOULDBLOCK;
 
-  return nwritten;
+  return (nwritten > SSIZE_MAX) ?
+    NGHTTP2_ERR_CALLBACK_FAILURE : (ssize_t)nwritten;
 }
 
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-static int fr_print(const nghttp2_frame *frame, char *buffer, size_t blen)
-{
-  switch(frame->hd.type) {
-    case NGHTTP2_DATA: {
-      return msnprintf(buffer, blen,
-                       "FRAME[DATA, len=%d, eos=%d, padlen=%d]",
-                       (int)frame->hd.length,
-                       !!(frame->hd.flags & NGHTTP2_FLAG_END_STREAM),
-                       (int)frame->data.padlen);
-    }
-    case NGHTTP2_HEADERS: {
-      return msnprintf(buffer, blen,
-                       "FRAME[HEADERS, len=%d, hend=%d, eos=%d]",
-                       (int)frame->hd.length,
-                       !!(frame->hd.flags & NGHTTP2_FLAG_END_HEADERS),
-                       !!(frame->hd.flags & NGHTTP2_FLAG_END_STREAM));
-    }
-    case NGHTTP2_PRIORITY: {
-      return msnprintf(buffer, blen,
-                       "FRAME[PRIORITY, len=%d, flags=%d]",
-                       (int)frame->hd.length, frame->hd.flags);
-    }
-    case NGHTTP2_RST_STREAM: {
-      return msnprintf(buffer, blen,
-                       "FRAME[RST_STREAM, len=%d, flags=%d, error=%u]",
-                       (int)frame->hd.length, frame->hd.flags,
-                       frame->rst_stream.error_code);
-    }
-    case NGHTTP2_SETTINGS: {
-      if(frame->hd.flags & NGHTTP2_FLAG_ACK) {
-        return msnprintf(buffer, blen, "FRAME[SETTINGS, ack=1]");
-      }
-      return msnprintf(buffer, blen,
-                       "FRAME[SETTINGS, len=%d]", (int)frame->hd.length);
-    }
-    case NGHTTP2_PUSH_PROMISE: {
-      return msnprintf(buffer, blen,
-                       "FRAME[PUSH_PROMISE, len=%d, hend=%d]",
-                       (int)frame->hd.length,
-                       !!(frame->hd.flags & NGHTTP2_FLAG_END_HEADERS));
-    }
-    case NGHTTP2_PING: {
-      return msnprintf(buffer, blen,
-                       "FRAME[PING, len=%d, ack=%d]",
-                       (int)frame->hd.length,
-                       frame->hd.flags&NGHTTP2_FLAG_ACK);
-    }
-    case NGHTTP2_GOAWAY: {
-      char scratch[128];
-      size_t s_len = sizeof(scratch)/sizeof(scratch[0]);
-        size_t len = (frame->goaway.opaque_data_len < s_len)?
-                      frame->goaway.opaque_data_len : s_len-1;
-        if(len)
-          memcpy(scratch, frame->goaway.opaque_data, len);
-        scratch[len] = '\0';
-        return msnprintf(buffer, blen, "FRAME[GOAWAY, error=%d, reason='%s', "
-                         "last_stream=%d]", frame->goaway.error_code,
-                         scratch, frame->goaway.last_stream_id);
-    }
-    case NGHTTP2_WINDOW_UPDATE: {
-      return msnprintf(buffer, blen,
-                       "FRAME[WINDOW_UPDATE, incr=%d]",
-                       frame->window_update.window_size_increment);
-    }
-    default:
-      return msnprintf(buffer, blen, "FRAME[%d, len=%d, flags=%d]",
-                       frame->hd.type, (int)frame->hd.length,
-                       frame->hd.flags);
-  }
-}
-
-static int on_frame_send(nghttp2_session *session, const nghttp2_frame *frame,
-                         void *userp)
+#ifdef CURLVERBOSE
+static int proxy_h2_on_frame_send(nghttp2_session *session,
+                                  const nghttp2_frame *frame,
+                                  void *userp)
 {
   struct Curl_cfilter *cf = userp;
   struct Curl_easy *data = CF_DATA_CURRENT(cf);
 
   (void)session;
   DEBUGASSERT(data);
-  if(data && Curl_trc_cf_is_verbose(cf, data)) {
+  if(Curl_trc_cf_is_verbose(cf, data)) {
     char buffer[256];
     int len;
-    len = fr_print(frame, buffer, sizeof(buffer)-1);
+    len = Curl_nghttp2_fr_print(frame, buffer, sizeof(buffer) - 1);
     buffer[len] = 0;
     CURL_TRC_CF(data, cf, "[%d] -> %s", frame->hd.stream_id, buffer);
   }
   return 0;
 }
-#endif /* !CURL_DISABLE_VERBOSE_STRINGS */
+#endif /* CURLVERBOSE */
 
 static int proxy_h2_on_frame_recv(nghttp2_session *session,
                                   const nghttp2_frame *frame,
@@ -676,15 +474,15 @@ static int proxy_h2_on_frame_recv(nghttp2_session *session,
 
   (void)session;
   DEBUGASSERT(data);
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
+#ifdef CURLVERBOSE
   if(Curl_trc_cf_is_verbose(cf, data)) {
     char buffer[256];
     int len;
-    len = fr_print(frame, buffer, sizeof(buffer)-1);
+    len = Curl_nghttp2_fr_print(frame, buffer, sizeof(buffer) - 1);
     buffer[len] = 0;
-    CURL_TRC_CF(data, cf, "[%d] <- %s",frame->hd.stream_id, buffer);
+    CURL_TRC_CF(data, cf, "[%d] <- %s", frame->hd.stream_id, buffer);
   }
-#endif /* !CURL_DISABLE_VERBOSE_STRINGS */
+#endif /* CURLVERBOSE */
 
   if(!stream_id) {
     /* stream ID zero is for connection-oriented stuff */
@@ -696,16 +494,12 @@ static int proxy_h2_on_frame_recv(nghttp2_session *session,
        * window and *assume* that we treat this like a WINDOW_UPDATE. Some
        * servers send an explicit WINDOW_UPDATE, but not all seem to do that.
        * To be safe, we UNHOLD a stream in order not to stall. */
-      if((data->req.keepon & KEEP_SEND_HOLD) &&
-         (data->req.keepon & KEEP_SEND)) {
-        data->req.keepon &= ~KEEP_SEND_HOLD;
+      if(CURL_REQ_WANT_SEND(data)) {
         drain_tunnel(cf, data, &ctx->tunnel);
-        CURL_TRC_CF(data, cf, "[%d] un-holding after SETTINGS",
-                    stream_id);
       }
       break;
     case NGHTTP2_GOAWAY:
-      ctx->goaway = TRUE;
+      ctx->rcvd_goaway = TRUE;
       break;
     default:
       break;
@@ -735,14 +529,14 @@ static int proxy_h2_on_frame_recv(nghttp2_session *session,
     }
     break;
   case NGHTTP2_WINDOW_UPDATE:
-    if((data->req.keepon & KEEP_SEND_HOLD) &&
-       (data->req.keepon & KEEP_SEND)) {
-      data->req.keepon &= ~KEEP_SEND_HOLD;
-      Curl_expire(data, 0, EXPIRE_RUN_NOW);
-      CURL_TRC_CF(data, cf, "[%d] unpausing after win update",
-                  stream_id);
+    if(CURL_REQ_WANT_SEND(data)) {
+      drain_tunnel(cf, data, &ctx->tunnel);
     }
     break;
+  case NGHTTP2_RST_STREAM:
+    if(frame->rst_stream.error_code)
+      ctx->tunnel.reset = TRUE;
+    break;
   default:
     break;
   }
@@ -763,7 +557,6 @@ static int proxy_h2_on_header(nghttp2_session *session,
   CURLcode result;
 
   (void)flags;
-  (void)data;
   (void)session;
   DEBUGASSERT(stream_id); /* should never be a zero stream ID here */
   if(stream_id != ctx->tunnel.stream_id) {
@@ -782,12 +575,12 @@ static int proxy_h2_on_header(nghttp2_session *session,
   }
 
   if(namelen == sizeof(HTTP_PSEUDO_STATUS) - 1 &&
-     memcmp(HTTP_PSEUDO_STATUS, name, namelen) == 0) {
+     !memcmp(HTTP_PSEUDO_STATUS, name, namelen)) {
     int http_status;
     struct http_resp *resp;
 
     /* status: always comes first, we might get more than one response,
-     * link the previous ones for keepers */
+     * discard previous, interim responses */
     result = Curl_http_decode_status(&http_status,
                                     (const char *)value, valuelen);
     if(result)
@@ -795,7 +588,8 @@ static int proxy_h2_on_header(nghttp2_session *session,
     result = Curl_http_resp_make(&resp, http_status, NULL);
     if(result)
       return NGHTTP2_ERR_CALLBACK_FAILURE;
-    resp->prev = ctx->tunnel.resp;
+    if(ctx->tunnel.resp)
+      Curl_http_resp_free(ctx->tunnel.resp);
     ctx->tunnel.resp = resp;
     CURL_TRC_CF(data, cf, "[%d] status: HTTP/2 %03d",
                 stream_id, ctx->tunnel.resp->status);
@@ -829,10 +623,9 @@ static ssize_t tunnel_send_callback(nghttp2_session *session,
   struct Curl_easy *data = CF_DATA_CURRENT(cf);
   struct tunnel_stream *ts;
   CURLcode result;
-  ssize_t nread;
+  size_t nread;
 
   (void)source;
-  (void)data;
   (void)ctx;
 
   if(!stream_id)
@@ -843,8 +636,8 @@ static ssize_t tunnel_send_callback(nghttp2_session *session,
     return NGHTTP2_ERR_CALLBACK_FAILURE;
   DEBUGASSERT(ts == &ctx->tunnel);
 
-  nread = Curl_bufq_read(&ts->sendbuf, buf, length, &result);
-  if(nread < 0) {
+  result = Curl_bufq_read(&ts->sendbuf, buf, length, &nread);
+  if(result) {
     if(result != CURLE_AGAIN)
       return NGHTTP2_ERR_CALLBACK_FAILURE;
     return NGHTTP2_ERR_DEFERRED;
@@ -852,9 +645,10 @@ static ssize_t tunnel_send_callback(nghttp2_session *session,
   if(ts->closed && Curl_bufq_is_empty(&ts->sendbuf))
     *data_flags = NGHTTP2_DATA_FLAG_EOF;
 
-  CURL_TRC_CF(data, cf, "[%d] tunnel_send_callback -> %zd",
+  CURL_TRC_CF(data, cf, "[%d] tunnel_send_callback -> %zu",
               ts->stream_id, nread);
-  return nread;
+  return (nread  > SSIZE_MAX) ?
+    NGHTTP2_ERR_CALLBACK_FAILURE : (ssize_t)nread;
 }
 
 static int tunnel_recv_callback(nghttp2_session *session, uint8_t flags,
@@ -863,7 +657,7 @@ static int tunnel_recv_callback(nghttp2_session *session, uint8_t flags,
 {
   struct Curl_cfilter *cf = userp;
   struct cf_h2_proxy_ctx *ctx = cf->ctx;
-  ssize_t nwritten;
+  size_t nwritten;
   CURLcode result;
 
   (void)flags;
@@ -873,13 +667,16 @@ static int tunnel_recv_callback(nghttp2_session *session, uint8_t flags,
   if(stream_id != ctx->tunnel.stream_id)
     return NGHTTP2_ERR_CALLBACK_FAILURE;
 
-  nwritten = Curl_bufq_write(&ctx->tunnel.recvbuf, mem, len, &result);
-  if(nwritten < 0) {
+  result = Curl_bufq_write(&ctx->tunnel.recvbuf, mem, len, &nwritten);
+  if(result) {
     if(result != CURLE_AGAIN)
       return NGHTTP2_ERR_CALLBACK_FAILURE;
+#ifdef DEBUGBUILD
     nwritten = 0;
+#endif
   }
-  DEBUGASSERT((size_t)nwritten == len);
+  /* tunnel.recbuf has soft limit, any success MUST add all data */
+  DEBUGASSERT(nwritten == len);
   return 0;
 }
 
@@ -892,32 +689,33 @@ static int proxy_h2_on_stream_close(nghttp2_session *session,
   struct Curl_easy *data = CF_DATA_CURRENT(cf);
 
   (void)session;
-  (void)data;
 
   if(stream_id != ctx->tunnel.stream_id)
     return 0;
 
-  CURL_TRC_CF(data, cf, "[%d] proxy_h2_on_stream_close, %s (err %d)",
+  CURL_TRC_CF(data, cf, "[%d] proxy_h2_on_stream_close, %s (err %u)",
               stream_id, nghttp2_http2_strerror(error_code), error_code);
   ctx->tunnel.closed = TRUE;
   ctx->tunnel.error = error_code;
+  if(error_code)
+    ctx->tunnel.reset = TRUE;
 
   return 0;
 }
 
-static CURLcode proxy_h2_submit(int32_t *pstream_id,
-                                struct Curl_cfilter *cf,
-                                struct Curl_easy *data,
-                                nghttp2_session *h2,
-                                struct httpreq *req,
-                                const nghttp2_priority_spec *pri_spec,
-                                void *stream_user_data,
-                               nghttp2_data_source_read_callback read_callback,
-                                void *read_ctx)
+static CURLcode proxy_h2_submit(
+  int32_t *pstream_id,
+  struct Curl_cfilter *cf,
+  struct Curl_easy *data,
+  nghttp2_session *h2,
+  struct httpreq *req,
+  const nghttp2_priority_spec *pri_spec,
+  void *stream_user_data,
+  nghttp2_data_source_read_callback read_callback,
+  void *read_ctx)
 {
   struct dynhds h2_headers;
   nghttp2_nv *nva = NULL;
-  unsigned int i;
   int32_t stream_id = -1;
   size_t nheader;
   CURLcode result;
@@ -928,22 +726,12 @@ static CURLcode proxy_h2_submit(int32_t *pstream_id,
   if(result)
     goto out;
 
-  nheader = Curl_dynhds_count(&h2_headers);
-  nva = malloc(sizeof(nghttp2_nv) * nheader);
+  nva = Curl_dynhds_to_nva(&h2_headers, &nheader);
   if(!nva) {
     result = CURLE_OUT_OF_MEMORY;
     goto out;
   }
 
-  for(i = 0; i < nheader; ++i) {
-    struct dynhds_entry *e = Curl_dynhds_getn(&h2_headers, i);
-    nva[i].name = (unsigned char *)e->name;
-    nva[i].namelen = e->namelen;
-    nva[i].value = (unsigned char *)e->value;
-    nva[i].valuelen = e->valuelen;
-    nva[i].flags = NGHTTP2_NV_FLAG_NONE;
-  }
-
   if(read_callback) {
     nghttp2_data_provider data_prd;
 
@@ -966,7 +754,7 @@ static CURLcode proxy_h2_submit(int32_t *pstream_id,
   result = CURLE_OK;
 
 out:
-  free(nva);
+  curlx_free(nva);
   Curl_dynhds_free(&h2_headers);
   *pstream_id = stream_id;
   return result;
@@ -980,36 +768,12 @@ static CURLcode submit_CONNECT(struct Curl_cfilter *cf,
   CURLcode result;
   struct httpreq *req = NULL;
 
-  infof(data, "Establish HTTP/2 proxy tunnel to %s", ts->authority);
-
-  result = Curl_http_req_make(&req, "CONNECT", sizeof("CONNECT")-1,
-                              NULL, 0, ts->authority, strlen(ts->authority),
-                              NULL, 0);
+  result = Curl_http_proxy_create_tunnel_request(&req, cf, data, ctx->dest,
+                                                  PROXY_HTTP_V2,
+                                                  (bool)ctx->udp_tunnel);
   if(result)
     goto out;
-
-  /* Setup the proxy-authorization header, if any */
-  result = Curl_http_output_auth(data, cf->conn, req->method, HTTPREQ_GET,
-                                 req->authority, TRUE);
-  if(result)
-    goto out;
-
-  if(data->state.aptr.proxyuserpwd) {
-    result = Curl_dynhds_h1_cadd_line(&req->headers,
-                                      data->state.aptr.proxyuserpwd);
-    if(result)
-      goto out;
-  }
-
-  if(!Curl_checkProxyheaders(data, cf->conn, STRCONST("User-Agent"))
-     && data->set.str[STRING_USERAGENT]) {
-    result = Curl_dynhds_cadd(&req->headers, "User-Agent",
-                              data->set.str[STRING_USERAGENT]);
-    if(result)
-      goto out;
-  }
-
-  result = Curl_dynhds_add_custom(data, TRUE, &req->headers);
+  result = Curl_creader_set_null(data);
   if(result)
     goto out;
 
@@ -1032,41 +796,30 @@ static CURLcode inspect_response(struct Curl_cfilter *cf,
                                  struct Curl_easy *data,
                                  struct tunnel_stream *ts)
 {
-  CURLcode result = CURLE_OK;
-  struct dynhds_entry *auth_reply = NULL;
-  (void)cf;
+  struct cf_h2_proxy_ctx *ctx = cf->ctx;
+  proxy_inspect_result res;
+  CURLcode result;
 
-  DEBUGASSERT(ts->resp);
-  if(ts->resp->status/100 == 2) {
-    infof(data, "CONNECT tunnel established, response %d", ts->resp->status);
-    h2_tunnel_go_state(cf, ts, H2_TUNNEL_ESTABLISHED, data);
-    return CURLE_OK;
+  result = Curl_http_proxy_inspect_tunnel_response(
+      cf, data, ts->resp, (bool)ctx->udp_tunnel, &res);
+  if(result)
+    return result;
+  switch(res) {
+  case PROXY_INSPECT_OK:
+    h2_tunnel_go_state(cf, ts, H2_TUNNEL_ESTABLISHED, data,
+                       (bool)ctx->udp_tunnel);
+    break;
+  case PROXY_INSPECT_FAILED:
+    h2_tunnel_go_state(cf, ts, H2_TUNNEL_FAILED, data,
+                       (bool)ctx->udp_tunnel);
+    result = CURLE_COULDNT_CONNECT;
+    break;
+  case PROXY_INSPECT_AUTH_RETRY:
+    h2_tunnel_go_state(cf, ts, H2_TUNNEL_INIT, data,
+                       (bool)ctx->udp_tunnel);
+    break;
   }
-
-  if(ts->resp->status == 401) {
-    auth_reply = Curl_dynhds_cget(&ts->resp->headers, "WWW-Authenticate");
-  }
-  else if(ts->resp->status == 407) {
-    auth_reply = Curl_dynhds_cget(&ts->resp->headers, "Proxy-Authenticate");
-  }
-
-  if(auth_reply) {
-    CURL_TRC_CF(data, cf, "[0] CONNECT: fwd auth header '%s'",
-                auth_reply->value);
-    result = Curl_http_input_auth(data, ts->resp->status == 407,
-                                  auth_reply->value);
-    if(result)
-      return result;
-    if(data->req.newurl) {
-      /* Inidicator that we should try again */
-      Curl_safefree(data->req.newurl);
-      h2_tunnel_go_state(cf, ts, H2_TUNNEL_INIT, data);
-      return CURLE_OK;
-    }
-  }
-
-  /* Seems to have failed */
-  return CURLE_RECV_ERROR;
+  return result;
 }
 
 static CURLcode H2_CONNECT(struct Curl_cfilter *cf,
@@ -1078,6 +831,11 @@ static CURLcode H2_CONNECT(struct Curl_cfilter *cf,
 
   DEBUGASSERT(ts);
   DEBUGASSERT(ts->authority);
+  if(ctx->conn_closed) {
+    failf(data, "proxy closed connection");
+    return CURLE_COULDNT_CONNECT;
+  }
+
   do {
     switch(ts->state) {
     case H2_TUNNEL_INIT:
@@ -1086,8 +844,9 @@ static CURLcode H2_CONNECT(struct Curl_cfilter *cf,
       result = submit_CONNECT(cf, data, ts);
       if(result)
         goto out;
-      h2_tunnel_go_state(cf, ts, H2_TUNNEL_CONNECT, data);
-      /* FALLTHROUGH */
+      h2_tunnel_go_state(cf, ts, H2_TUNNEL_CONNECT, data,
+                         (bool)ctx->udp_tunnel);
+      FALLTHROUGH();
 
     case H2_TUNNEL_CONNECT:
       /* see that the request is completely sent */
@@ -1095,18 +854,20 @@ static CURLcode H2_CONNECT(struct Curl_cfilter *cf,
       if(!result)
         result = proxy_h2_progress_egress(cf, data);
       if(result && result != CURLE_AGAIN) {
-        h2_tunnel_go_state(cf, ts, H2_TUNNEL_FAILED, data);
+        h2_tunnel_go_state(cf, ts, H2_TUNNEL_FAILED, data,
+                           (bool)ctx->udp_tunnel);
         break;
       }
 
       if(ts->has_final_response) {
-        h2_tunnel_go_state(cf, ts, H2_TUNNEL_RESPONSE, data);
+        h2_tunnel_go_state(cf, ts, H2_TUNNEL_RESPONSE, data,
+                           (bool)ctx->udp_tunnel);
       }
       else {
         result = CURLE_OK;
         goto out;
       }
-      /* FALLTHROUGH */
+      FALLTHROUGH();
 
     case H2_TUNNEL_RESPONSE:
       DEBUGASSERT(ts->has_final_response);
@@ -1128,19 +889,102 @@ static CURLcode H2_CONNECT(struct Curl_cfilter *cf,
   } while(ts->state == H2_TUNNEL_INIT);
 
 out:
-  if(result || ctx->tunnel.closed)
-    h2_tunnel_go_state(cf, ts, H2_TUNNEL_FAILED, data);
+  if((result && (result != CURLE_AGAIN)) || ctx->tunnel.closed)
+    h2_tunnel_go_state(cf, ts, H2_TUNNEL_FAILED, data,
+                       (bool)ctx->udp_tunnel);
+  return result;
+}
+
+/*
+ * Initialize the cfilter context
+ */
+static CURLcode cf_h2_proxy_ctx_init(struct Curl_cfilter *cf,
+                                     struct Curl_easy *data)
+{
+  struct cf_h2_proxy_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OUT_OF_MEMORY;
+  nghttp2_session_callbacks *cbs = NULL;
+  int rc;
+
+  DEBUGASSERT(!ctx->h2);
+  memset(&ctx->tunnel, 0, sizeof(ctx->tunnel));
+
+  Curl_bufq_init(&ctx->inbufq, PROXY_H2_CHUNK_SIZE, PROXY_H2_NW_RECV_CHUNKS);
+  Curl_bufq_init(&ctx->outbufq, PROXY_H2_CHUNK_SIZE, PROXY_H2_NW_SEND_CHUNKS);
+
+  if(tunnel_stream_init(&ctx->tunnel, ctx->dest))
+    goto out;
+
+  rc = nghttp2_session_callbacks_new(&cbs);
+  if(rc) {
+    failf(data, "Could not initialize nghttp2 callbacks");
+    goto out;
+  }
+
+  nghttp2_session_callbacks_set_send_callback(cbs, on_session_send);
+  nghttp2_session_callbacks_set_on_frame_recv_callback(
+    cbs, proxy_h2_on_frame_recv);
+#ifdef CURLVERBOSE
+  nghttp2_session_callbacks_set_on_frame_send_callback(cbs,
+                                                       proxy_h2_on_frame_send);
+#endif
+  nghttp2_session_callbacks_set_on_data_chunk_recv_callback(
+    cbs, tunnel_recv_callback);
+  nghttp2_session_callbacks_set_on_stream_close_callback(
+    cbs, proxy_h2_on_stream_close);
+  nghttp2_session_callbacks_set_on_header_callback(cbs, proxy_h2_on_header);
+
+  /* The nghttp2 session is not yet setup, do it */
+  rc = proxy_h2_client_new(cf, cbs);
+  if(rc) {
+    failf(data, "Could not initialize nghttp2");
+    goto out;
+  }
+
+  {
+    nghttp2_settings_entry iv[3];
+
+    iv[0].settings_id = NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS;
+    iv[0].value = Curl_multi_max_concurrent_streams(data->multi);
+    iv[1].settings_id = NGHTTP2_SETTINGS_INITIAL_WINDOW_SIZE;
+    iv[1].value = H2_TUNNEL_WINDOW_SIZE;
+    iv[2].settings_id = NGHTTP2_SETTINGS_ENABLE_PUSH;
+    iv[2].value = 0;
+    rc = nghttp2_submit_settings(ctx->h2, NGHTTP2_FLAG_NONE, iv, 3);
+    if(rc) {
+      failf(data, "nghttp2_submit_settings() failed: %s(%d)",
+            nghttp2_strerror(rc), rc);
+      result = CURLE_HTTP2;
+      goto out;
+    }
+  }
+
+  rc = nghttp2_session_set_local_window_size(ctx->h2, NGHTTP2_FLAG_NONE, 0,
+                                             PROXY_HTTP2_HUGE_WINDOW_SIZE);
+  if(rc) {
+    failf(data, "nghttp2_session_set_local_window_size() failed: %s(%d)",
+          nghttp2_strerror(rc), rc);
+    result = CURLE_HTTP2;
+    goto out;
+  }
+
+  /* all set, traffic will be send on connect */
+  result = CURLE_OK;
+
+out:
+  if(cbs)
+    nghttp2_session_callbacks_del(cbs);
+  CURL_TRC_CF(data, cf, "[0] init proxy ctx -> %d", (int)result);
   return result;
 }
 
 static CURLcode cf_h2_proxy_connect(struct Curl_cfilter *cf,
                                     struct Curl_easy *data,
-                                    bool blocking, bool *done)
+                                    bool *done)
 {
   struct cf_h2_proxy_ctx *ctx = cf->ctx;
   CURLcode result = CURLE_OK;
   struct cf_call_data save;
-  timediff_t check;
   struct tunnel_stream *ts = &ctx->tunnel;
 
   if(cf->connected) {
@@ -1150,7 +994,7 @@ static CURLcode cf_h2_proxy_connect(struct Curl_cfilter *cf,
 
   /* Connect the lower filters first */
   if(!cf->next->connected) {
-    result = Curl_conn_cf_connect(cf->next, data, blocking, done);
+    result = Curl_conn_cf_connect(cf->next, data, done);
     if(result || !*done)
       return result;
   }
@@ -1165,8 +1009,7 @@ static CURLcode cf_h2_proxy_connect(struct Curl_cfilter *cf,
   }
   DEBUGASSERT(ts->authority);
 
-  check = Curl_timeleft(data, NULL, TRUE);
-  if(check <= 0) {
+  if(Curl_timeleft_ms(data) < 0) {
     failf(data, "Proxy CONNECT aborted due to timeout");
     result = CURLE_OPERATION_TIMEDOUT;
     goto out;
@@ -1179,24 +1022,16 @@ static CURLcode cf_h2_proxy_connect(struct Curl_cfilter *cf,
 
 out:
   *done = (result == CURLE_OK) && (ts->state == H2_TUNNEL_ESTABLISHED);
-  cf->connected = *done;
+  if(*done) {
+    cf->connected = TRUE;
+    /* The real request will follow the CONNECT, reset request partially */
+    Curl_req_soft_reset(&data->req, data);
+    Curl_client_reset(data);
+  }
   CF_DATA_RESTORE(cf, save);
   return result;
 }
 
-static void cf_h2_proxy_close(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_h2_proxy_ctx *ctx = cf->ctx;
-
-  if(ctx) {
-    struct cf_call_data save;
-
-    CF_DATA_SAVE(save, cf, data);
-    cf_h2_proxy_ctx_clear(ctx);
-    CF_DATA_RESTORE(cf, save);
-  }
-}
-
 static void cf_h2_proxy_destroy(struct Curl_cfilter *cf,
                                 struct Curl_easy *data)
 {
@@ -1209,6 +1044,50 @@ static void cf_h2_proxy_destroy(struct Curl_cfilter *cf,
   }
 }
 
+static CURLcode cf_h2_proxy_shutdown(struct Curl_cfilter *cf,
+                                     struct Curl_easy *data, bool *done)
+{
+  struct cf_h2_proxy_ctx *ctx = cf->ctx;
+  struct cf_call_data save;
+  CURLcode result;
+  int rv;
+
+  if(!cf->connected || !ctx->h2 || cf->shutdown || ctx->conn_closed) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  CF_DATA_SAVE(save, cf, data);
+
+  if(!ctx->sent_goaway) {
+    rv = nghttp2_submit_goaway(ctx->h2, NGHTTP2_FLAG_NONE,
+                               0, 0,
+                               (const uint8_t *)"shutdown",
+                               sizeof("shutdown"));
+    if(rv) {
+      failf(data, "nghttp2_submit_goaway() failed: %s(%d)",
+            nghttp2_strerror(rv), rv);
+      result = CURLE_SEND_ERROR;
+      goto out;
+    }
+    ctx->sent_goaway = TRUE;
+  }
+  /* GOAWAY submitted, process egress and ingress until nghttp2 is done. */
+  result = CURLE_OK;
+  if(nghttp2_session_want_write(ctx->h2))
+    result = proxy_h2_progress_egress(cf, data);
+  if(!result && nghttp2_session_want_read(ctx->h2))
+    result = proxy_h2_progress_ingress(cf, data);
+
+  *done = (ctx->conn_closed ||
+           (!result && !nghttp2_session_want_write(ctx->h2) &&
+            !nghttp2_session_want_read(ctx->h2)));
+out:
+  CF_DATA_RESTORE(cf, save);
+  cf->shutdown = (result || *done);
+  return result;
+}
+
 static bool cf_h2_proxy_data_pending(struct Curl_cfilter *cf,
                                      const struct Curl_easy *data)
 {
@@ -1217,301 +1096,260 @@ static bool cf_h2_proxy_data_pending(struct Curl_cfilter *cf,
      (ctx && ctx->tunnel.state == H2_TUNNEL_ESTABLISHED &&
       !Curl_bufq_is_empty(&ctx->tunnel.recvbuf)))
     return TRUE;
-  return cf->next? cf->next->cft->has_data_pending(cf->next, data) : FALSE;
+  return cf->next ? cf->next->cft->has_data_pending(cf->next, data) : FALSE;
 }
 
-static int cf_h2_proxy_get_select_socks(struct Curl_cfilter *cf,
-                                        struct Curl_easy *data,
-                                        curl_socket_t *sock)
+static CURLcode cf_h2_proxy_adjust_pollset(struct Curl_cfilter *cf,
+                                           struct Curl_easy *data,
+                                           struct easy_pollset *ps)
 {
   struct cf_h2_proxy_ctx *ctx = cf->ctx;
-  int bitmap = GETSOCK_BLANK;
   struct cf_call_data save;
+  curl_socket_t sock = Curl_conn_cf_get_socket(cf, data);
+  bool want_recv, want_send;
+  CURLcode result = CURLE_OK;
 
-  CF_DATA_SAVE(save, cf, data);
-  sock[0] = Curl_conn_cf_get_socket(cf, data);
-  bitmap |= GETSOCK_READSOCK(0);
+  if(!cf->connected && ctx->h2) {
+    want_send = nghttp2_session_want_write(ctx->h2) ||
+                !Curl_bufq_is_empty(&ctx->outbufq) ||
+                !Curl_bufq_is_empty(&ctx->tunnel.sendbuf);
+    want_recv = nghttp2_session_want_read(ctx->h2);
+  }
+  else
+    Curl_pollset_check(data, ps, sock, &want_recv, &want_send);
 
-  /* HTTP/2 layer wants to send data) AND there's a window to send data in */
-  if(nghttp2_session_want_write(ctx->h2) &&
-     nghttp2_session_get_remote_window_size(ctx->h2))
-    bitmap |= GETSOCK_WRITESOCK(0);
+  if(ctx->h2 && (want_recv || want_send)) {
+    bool c_exhaust, s_exhaust;
 
-  CF_DATA_RESTORE(cf, save);
-  return bitmap;
+    CF_DATA_SAVE(save, cf, data);
+    c_exhaust = !nghttp2_session_get_remote_window_size(ctx->h2);
+    s_exhaust = ctx->tunnel.stream_id >= 0 &&
+                !nghttp2_session_get_stream_remote_window_size(
+                  ctx->h2, ctx->tunnel.stream_id);
+    want_recv = (want_recv || c_exhaust || s_exhaust);
+    want_send = (!s_exhaust && want_send) ||
+                (!c_exhaust && nghttp2_session_want_write(ctx->h2)) ||
+                !Curl_bufq_is_empty(&ctx->outbufq) ||
+                !Curl_bufq_is_empty(&ctx->tunnel.sendbuf);
+
+    result = Curl_pollset_set(data, ps, sock, want_recv, want_send);
+    CURL_TRC_CF(data, cf, "adjust_pollset, want_recv=%d want_send=%d -> %d",
+                want_recv, want_send, (int)result);
+    CF_DATA_RESTORE(cf, save);
+  }
+  else if(ctx->sent_goaway && !cf->shutdown) {
+    /* shutdown in progress */
+    CF_DATA_SAVE(save, cf, data);
+    want_send = nghttp2_session_want_write(ctx->h2) ||
+                !Curl_bufq_is_empty(&ctx->outbufq) ||
+                !Curl_bufq_is_empty(&ctx->tunnel.sendbuf);
+    want_recv = nghttp2_session_want_read(ctx->h2);
+    result = Curl_pollset_set(data, ps, sock, want_recv, want_send);
+    CURL_TRC_CF(data, cf, "adjust_pollset, want_recv=%d want_send=%d -> %d",
+                want_recv, want_send, (int)result);
+    CF_DATA_RESTORE(cf, save);
+  }
+  return result;
 }
 
-static ssize_t h2_handle_tunnel_close(struct Curl_cfilter *cf,
-                                      struct Curl_easy *data,
-                                      CURLcode *err)
+static CURLcode h2_handle_tunnel_close(struct Curl_cfilter *cf,
+                                       struct Curl_easy *data,
+                                       size_t *pnread)
 {
   struct cf_h2_proxy_ctx *ctx = cf->ctx;
-  ssize_t rv = 0;
 
-  if(ctx->tunnel.error == NGHTTP2_REFUSED_STREAM) {
-    CURL_TRC_CF(data, cf, "[%d] REFUSED_STREAM, try again on a new "
-                "connection", ctx->tunnel.stream_id);
-    connclose(cf->conn, "REFUSED_STREAM"); /* don't use this anymore */
-    *err = CURLE_RECV_ERROR; /* trigger Curl_retry_request() later */
-    return -1;
-  }
-  else if(ctx->tunnel.error != NGHTTP2_NO_ERROR) {
-    failf(data, "HTTP/2 stream %u was not closed cleanly: %s (err %u)",
-          ctx->tunnel.stream_id, nghttp2_http2_strerror(ctx->tunnel.error),
-          ctx->tunnel.error);
-    *err = CURLE_HTTP2_STREAM;
-    return -1;
-  }
-  else if(ctx->tunnel.reset) {
-    failf(data, "HTTP/2 stream %u was reset", ctx->tunnel.stream_id);
-    *err = CURLE_RECV_ERROR;
-    return -1;
+  *pnread = 0;
+  if(ctx->tunnel.error) {
+    failf(data, "HTTP/2 stream %d reset by %s (error 0x%x %s)",
+          ctx->tunnel.stream_id, ctx->tunnel.reset ? "server" : "curl",
+          ctx->tunnel.error, nghttp2_http2_strerror(ctx->tunnel.error));
+    return CURLE_RECV_ERROR;
   }
 
-  *err = CURLE_OK;
-  rv = 0;
-  CURL_TRC_CF(data, cf, "[%d] handle_tunnel_close -> %zd, %d",
-              ctx->tunnel.stream_id, rv, *err);
-  return rv;
+  CURL_TRC_CF(data, cf, "[%d] handle_tunnel_close -> 0",
+              ctx->tunnel.stream_id);
+  return CURLE_OK;
 }
 
-static ssize_t tunnel_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
-                           char *buf, size_t len, CURLcode *err)
+static CURLcode tunnel_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
+                            char *buf, size_t len, size_t *pnread)
 {
   struct cf_h2_proxy_ctx *ctx = cf->ctx;
-  ssize_t nread = -1;
+  CURLcode result = CURLE_AGAIN;
 
-  *err = CURLE_AGAIN;
-  if(!Curl_bufq_is_empty(&ctx->tunnel.recvbuf)) {
-    nread = Curl_bufq_read(&ctx->tunnel.recvbuf,
-                           (unsigned char *)buf, len, err);
-    if(nread < 0)
-      goto out;
-    DEBUGASSERT(nread > 0);
-  }
-
-  if(nread < 0) {
+  *pnread = 0;
+  if(!Curl_bufq_is_empty(&ctx->tunnel.recvbuf))
+    result = Curl_bufq_cread(&ctx->tunnel.recvbuf, buf, len, pnread);
+  else {
     if(ctx->tunnel.closed) {
-      nread = h2_handle_tunnel_close(cf, data, err);
+      result = h2_handle_tunnel_close(cf, data, pnread);
     }
     else if(ctx->tunnel.reset ||
             (ctx->conn_closed && Curl_bufq_is_empty(&ctx->inbufq)) ||
-            (ctx->goaway && ctx->last_stream_id < ctx->tunnel.stream_id)) {
-      *err = CURLE_RECV_ERROR;
-      nread = -1;
+            (ctx->rcvd_goaway &&
+             ctx->last_stream_id < ctx->tunnel.stream_id)) {
+      result = CURLE_RECV_ERROR;
     }
-  }
-  else if(nread == 0) {
-    *err = CURLE_AGAIN;
-    nread = -1;
+    else
+      result = CURLE_AGAIN;
   }
 
-out:
-  CURL_TRC_CF(data, cf, "[%d] tunnel_recv(len=%zu) -> %zd, %d",
-              ctx->tunnel.stream_id, len, nread, *err);
-  return nread;
+  CURL_TRC_CF(data, cf, "[%d] tunnel_recv(len=%zu) -> %d, %zu",
+              ctx->tunnel.stream_id, len, (int)result, *pnread);
+  return result;
 }
 
-static ssize_t cf_h2_proxy_recv(struct Curl_cfilter *cf,
-                                struct Curl_easy *data,
-                                char *buf, size_t len, CURLcode *err)
+static CURLcode cf_h2_proxy_recv(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 char *buf, size_t len,
+                                 size_t *pnread)
 {
   struct cf_h2_proxy_ctx *ctx = cf->ctx;
-  ssize_t nread = -1;
   struct cf_call_data save;
   CURLcode result;
 
-  if(ctx->tunnel.state != H2_TUNNEL_ESTABLISHED) {
-    *err = CURLE_RECV_ERROR;
-    return -1;
-  }
+  *pnread = 0;
   CF_DATA_SAVE(save, cf, data);
 
+  if(ctx->tunnel.state != H2_TUNNEL_ESTABLISHED) {
+    result = CURLE_RECV_ERROR;
+    goto out;
+  }
+
   if(Curl_bufq_is_empty(&ctx->tunnel.recvbuf)) {
-    *err = proxy_h2_progress_ingress(cf, data);
-    if(*err)
+    result = proxy_h2_progress_ingress(cf, data);
+    if(result)
       goto out;
   }
 
-  nread = tunnel_recv(cf, data, buf, len, err);
+  result = tunnel_recv(cf, data, buf, len, pnread);
 
-  if(nread > 0) {
-    CURL_TRC_CF(data, cf, "[%d] increase window by %zd",
-                ctx->tunnel.stream_id, nread);
-    nghttp2_session_consume(ctx->h2, ctx->tunnel.stream_id, (size_t)nread);
+  if(!result) {
+    CURL_TRC_CF(data, cf, "[%d] increase window by %zu",
+                ctx->tunnel.stream_id, *pnread);
+    nghttp2_session_consume(ctx->h2, ctx->tunnel.stream_id, *pnread);
   }
 
-  result = proxy_h2_progress_egress(cf, data);
-  if(result == CURLE_AGAIN) {
-    /* pending data to send, need to be called again. Ideally, we'd
-     * monitor the socket for POLLOUT, but we might not be in SENDING
-     * transfer state any longer and are unable to make this happen.
-     */
-    CURL_TRC_CF(data, cf, "[%d] egress blocked, DRAIN",
-                ctx->tunnel.stream_id);
-    drain_tunnel(cf, data, &ctx->tunnel);
-  }
-  else if(result) {
-    *err = result;
-    nread = -1;
-  }
+  result = Curl_1st_fatal(result, proxy_h2_progress_egress(cf, data));
 
 out:
-  if(!Curl_bufq_is_empty(&ctx->tunnel.recvbuf) &&
-     (nread >= 0 || *err == CURLE_AGAIN)) {
+  if((!Curl_bufq_is_empty(&ctx->tunnel.recvbuf) ||
+      !Curl_bufq_is_empty(&ctx->tunnel.sendbuf)) &&
+     (!result || (result == CURLE_AGAIN))) {
     /* data pending and no fatal error to report. Need to trigger
      * draining to avoid stalling when no socket events happen. */
     drain_tunnel(cf, data, &ctx->tunnel);
   }
-  CURL_TRC_CF(data, cf, "[%d] cf_recv(len=%zu) -> %zd %d",
-              ctx->tunnel.stream_id, len, nread, *err);
+  CURL_TRC_CF(data, cf, "[%d] cf_recv(len=%zu) -> %d, %zu",
+              ctx->tunnel.stream_id, len, (int)result, *pnread);
   CF_DATA_RESTORE(cf, save);
-  return nread;
+  return result;
 }
 
-static ssize_t cf_h2_proxy_send(struct Curl_cfilter *cf,
-                                struct Curl_easy *data,
-                                const void *buf, size_t len, CURLcode *err)
+static CURLcode cf_h2_proxy_send(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 const uint8_t *buf, size_t len, bool eos,
+                                 size_t *pnwritten)
 {
   struct cf_h2_proxy_ctx *ctx = cf->ctx;
   struct cf_call_data save;
   int rv;
-  ssize_t nwritten;
   CURLcode result;
-  int blocked = 0;
 
-  if(ctx->tunnel.state != H2_TUNNEL_ESTABLISHED) {
-    *err = CURLE_SEND_ERROR;
-    return -1;
-  }
+  (void)eos;
+  *pnwritten = 0;
   CF_DATA_SAVE(save, cf, data);
 
-  if(ctx->tunnel.closed) {
-    nwritten = -1;
-    *err = CURLE_SEND_ERROR;
+  if(ctx->tunnel.state != H2_TUNNEL_ESTABLISHED) {
+    result = CURLE_SEND_ERROR;
     goto out;
   }
-  else if(ctx->tunnel.upload_blocked_len) {
-    /* the data in `buf` has already been submitted or added to the
-     * buffers, but have been EAGAINed on the last invocation. */
-    DEBUGASSERT(len >= ctx->tunnel.upload_blocked_len);
-    if(len < ctx->tunnel.upload_blocked_len) {
-      /* Did we get called again with a smaller `len`? This should not
-       * happen. We are not prepared to handle that. */
-      failf(data, "HTTP/2 proxy, send again with decreased length");
-      *err = CURLE_HTTP2;
-      nwritten = -1;
-      goto out;
-    }
-    nwritten = (ssize_t)ctx->tunnel.upload_blocked_len;
-    ctx->tunnel.upload_blocked_len = 0;
-    *err = CURLE_OK;
-  }
-  else {
-    nwritten = Curl_bufq_write(&ctx->tunnel.sendbuf, buf, len, err);
-    if(nwritten < 0) {
-      if(*err != CURLE_AGAIN)
-        goto out;
-      nwritten = 0;
-    }
+
+  if(ctx->tunnel.closed) {
+    result = CURLE_SEND_ERROR;
+    goto out;
   }
 
+  result = Curl_bufq_write(&ctx->tunnel.sendbuf, buf, len, pnwritten);
+  CURL_TRC_CF(data, cf, "cf_send(), bufq_write %d, %zu", (int)result,
+              *pnwritten);
+  if(result && (result != CURLE_AGAIN))
+    goto out;
+
   if(!Curl_bufq_is_empty(&ctx->tunnel.sendbuf)) {
     /* req body data is buffered, resume the potentially suspended stream */
     rv = nghttp2_session_resume_data(ctx->h2, ctx->tunnel.stream_id);
     if(nghttp2_is_fatal(rv)) {
-      *err = CURLE_SEND_ERROR;
-      nwritten = -1;
+      result = CURLE_SEND_ERROR;
       goto out;
     }
   }
 
-  result = proxy_h2_progress_ingress(cf, data);
-  if(result) {
-    *err = result;
-    nwritten = -1;
-    goto out;
-  }
+  result = Curl_1st_fatal(result, proxy_h2_progress_ingress(cf, data));
+  result = Curl_1st_fatal(result, proxy_h2_progress_egress(cf, data));
 
-  /* Call the nghttp2 send loop and flush to write ALL buffered data,
-   * headers and/or request body completely out to the network */
-  result = proxy_h2_progress_egress(cf, data);
-  if(result == CURLE_AGAIN) {
-    blocked = 1;
-  }
-  else if(result) {
-    *err = result;
-    nwritten = -1;
-    goto out;
-  }
-  else if(!Curl_bufq_is_empty(&ctx->tunnel.sendbuf)) {
-    /* although we wrote everything that nghttp2 wants to send now,
-     * there is data left in our stream send buffer unwritten. This may
-     * be due to the stream's HTTP/2 flow window being exhausted. */
-    blocked = 1;
-  }
-
-  if(blocked) {
-    /* Unable to send all data, due to connection blocked or H2 window
-     * exhaustion. Data is left in our stream buffer, or nghttp2's internal
-     * frame buffer or our network out buffer. */
-    size_t rwin = nghttp2_session_get_stream_remote_window_size(
-                    ctx->h2, ctx->tunnel.stream_id);
-    if(rwin == 0) {
-      /* H2 flow window exhaustion.
-       * FIXME: there is no way to HOLD all transfers that use this
-       * proxy connection AND to UNHOLD all of them again when the
-       * window increases.
-       * We *could* iterate over all data on this conn maybe? */
-      CURL_TRC_CF(data, cf, "[%d] remote flow "
-                  "window is exhausted", ctx->tunnel.stream_id);
-    }
-
-    /* Whatever the cause, we need to return CURL_EAGAIN for this call.
-     * We have unwritten state that needs us being invoked again and EAGAIN
-     * is the only way to ensure that. */
-    ctx->tunnel.upload_blocked_len = nwritten;
-    CURL_TRC_CF(data, cf, "[%d] cf_send(len=%zu) BLOCK: win %u/%zu "
-                "blocked_len=%zu",
-                ctx->tunnel.stream_id, len,
-                nghttp2_session_get_remote_window_size(ctx->h2), rwin,
-                nwritten);
-    drain_tunnel(cf, data, &ctx->tunnel);
-    *err = CURLE_AGAIN;
-    nwritten = -1;
-    goto out;
-  }
-  else if(proxy_h2_should_close_session(ctx)) {
+  if(!result && proxy_h2_should_close_session(ctx)) {
     /* nghttp2 thinks this session is done. If the stream has not been
      * closed, this is an error state for out transfer */
     if(ctx->tunnel.closed) {
-      *err = CURLE_SEND_ERROR;
-      nwritten = -1;
+      result = CURLE_SEND_ERROR;
     }
     else {
       CURL_TRC_CF(data, cf, "[0] send: nothing to do in this session");
-      *err = CURLE_HTTP2;
-      nwritten = -1;
+      result = CURLE_HTTP2;
     }
   }
 
 out:
-  if(!Curl_bufq_is_empty(&ctx->tunnel.recvbuf) &&
-     (nwritten >= 0 || *err == CURLE_AGAIN)) {
+  if((!Curl_bufq_is_empty(&ctx->tunnel.recvbuf) ||
+      !Curl_bufq_is_empty(&ctx->tunnel.sendbuf)) &&
+     (!result || (result == CURLE_AGAIN))) {
     /* data pending and no fatal error to report. Need to trigger
      * draining to avoid stalling when no socket events happen. */
     drain_tunnel(cf, data, &ctx->tunnel);
   }
-  CURL_TRC_CF(data, cf, "[%d] cf_send(len=%zu) -> %zd, %d, "
+  CURL_TRC_CF(data, cf, "[%d] cf_send(len=%zu) -> %d, %zu, "
               "h2 windows %d-%d (stream-conn), buffers %zu-%zu (stream-conn)",
-              ctx->tunnel.stream_id, len, nwritten, *err,
+              ctx->tunnel.stream_id, len, (int)result, *pnwritten,
               nghttp2_session_get_stream_remote_window_size(
-                  ctx->h2, ctx->tunnel.stream_id),
+                ctx->h2, ctx->tunnel.stream_id),
               nghttp2_session_get_remote_window_size(ctx->h2),
               Curl_bufq_len(&ctx->tunnel.sendbuf),
               Curl_bufq_len(&ctx->outbufq));
   CF_DATA_RESTORE(cf, save);
-  return nwritten;
+  return result;
+}
+
+static CURLcode cf_h2_proxy_flush(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data)
+{
+  struct cf_h2_proxy_ctx *ctx = cf->ctx;
+  struct cf_call_data save;
+  CURLcode result = CURLE_OK;
+
+  CF_DATA_SAVE(save, cf, data);
+  if(!Curl_bufq_is_empty(&ctx->tunnel.sendbuf)) {
+    /* resume the potentially suspended tunnel */
+    int rv = nghttp2_session_resume_data(ctx->h2, ctx->tunnel.stream_id);
+    if(nghttp2_is_fatal(rv)) {
+      result = CURLE_SEND_ERROR;
+      goto out;
+    }
+  }
+
+  result = proxy_h2_progress_egress(cf, data);
+
+out:
+  CURL_TRC_CF(data, cf, "[%d] flush -> %d, "
+              "h2 windows %d-%d (stream-conn), buffers %zu-%zu (stream-conn)",
+              ctx->tunnel.stream_id, (int)result,
+              nghttp2_session_get_stream_remote_window_size(
+                ctx->h2, ctx->tunnel.stream_id),
+              nghttp2_session_get_remote_window_size(ctx->h2),
+              Curl_bufq_len(&ctx->tunnel.sendbuf),
+              Curl_bufq_len(&ctx->outbufq));
+  CF_DATA_RESTORE(cf, save);
+  return result;
 }
 
 static bool proxy_h2_connisalive(struct Curl_cfilter *cf,
@@ -1526,16 +1364,16 @@ static bool proxy_h2_connisalive(struct Curl_cfilter *cf,
     return FALSE;
 
   if(*input_pending) {
-    /* This happens before we've sent off a request and the connection is
-       not in use by any other transfer, there shouldn't be any data here,
+    /* This happens before we have sent off a request and the connection is
+       not in use by any other transfer, there should not be any data here,
        only "protocol frames" */
     CURLcode result;
-    ssize_t nread = -1;
+    size_t nread;
 
     *input_pending = FALSE;
-    nread = Curl_bufq_slurp(&ctx->inbufq, proxy_nw_in_reader, cf, &result);
-    if(nread != -1) {
-      if(proxy_h2_process_pending_input(cf, data, &result) < 0)
+    result = Curl_cf_recv_bufq(cf->next, data, &ctx->inbufq, 0, &nread);
+    if(!result) {
+      if(proxy_h2_process_pending_input(cf, data))
         /* immediate error, considered dead */
         alive = FALSE;
       else {
@@ -1556,58 +1394,116 @@ static bool cf_h2_proxy_is_alive(struct Curl_cfilter *cf,
                                  bool *input_pending)
 {
   struct cf_h2_proxy_ctx *ctx = cf->ctx;
-  CURLcode result;
+  bool alive;
   struct cf_call_data save;
 
+  *input_pending = FALSE;
   CF_DATA_SAVE(save, cf, data);
-  result = (ctx && ctx->h2 && proxy_h2_connisalive(cf, data, input_pending));
+  alive = (ctx && ctx->h2 && proxy_h2_connisalive(cf, data, input_pending));
   CURL_TRC_CF(data, cf, "[0] conn alive -> %d, input_pending=%d",
-              result, *input_pending);
+              alive, *input_pending);
   CF_DATA_RESTORE(cf, save);
+  return alive;
+}
+
+static CURLcode cf_h2_proxy_query(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  int query, int *pres1, void *pres2)
+{
+  struct cf_h2_proxy_ctx *ctx = cf->ctx;
+
+  switch(query) {
+  case CF_QUERY_HOST_PORT:
+    *pres1 = (int)ctx->dest->port;
+    *((const char **)pres2) = ctx->dest->hostname;
+    return CURLE_OK;
+  case CF_QUERY_NEED_FLUSH: {
+    if(!Curl_bufq_is_empty(&ctx->outbufq) ||
+       !Curl_bufq_is_empty(&ctx->tunnel.sendbuf)) {
+      CURL_TRC_CF(data, cf, "needs flush");
+      *pres1 = TRUE;
+      return CURLE_OK;
+    }
+    break;
+  }
+  case CF_QUERY_ALPN_NEGOTIATED: {
+    const char **palpn = pres2;
+    DEBUGASSERT(palpn);
+    *palpn = NULL;
+    return CURLE_OK;
+  }
+  default:
+    break;
+  }
+  return cf->next ?
+    cf->next->cft->query(cf->next, data, query, pres1, pres2) :
+    CURLE_UNKNOWN_OPTION;
+}
+
+static CURLcode cf_h2_proxy_cntrl(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  int event, int arg1, void *arg2)
+{
+  CURLcode result = CURLE_OK;
+  struct cf_call_data save;
+
+  (void)arg1;
+  (void)arg2;
+
+  switch(event) {
+  case CF_CTRL_FLUSH:
+    CF_DATA_SAVE(save, cf, data);
+    result = cf_h2_proxy_flush(cf, data);
+    CF_DATA_RESTORE(cf, save);
+    break;
+  default:
+    break;
+  }
   return result;
 }
 
 struct Curl_cftype Curl_cft_h2_proxy = {
   "H2-PROXY",
-  CF_TYPE_IP_CONNECT,
+  CF_TYPE_IP_CONNECT | CF_TYPE_PROXY,
   CURL_LOG_LVL_NONE,
   cf_h2_proxy_destroy,
   cf_h2_proxy_connect,
-  cf_h2_proxy_close,
-  Curl_cf_http_proxy_get_host,
-  cf_h2_proxy_get_select_socks,
+  cf_h2_proxy_shutdown,
+  cf_h2_proxy_adjust_pollset,
   cf_h2_proxy_data_pending,
   cf_h2_proxy_send,
   cf_h2_proxy_recv,
-  Curl_cf_def_cntrl,
+  cf_h2_proxy_cntrl,
   cf_h2_proxy_is_alive,
   Curl_cf_def_conn_keep_alive,
-  Curl_cf_def_query,
+  cf_h2_proxy_query,
 };
 
 CURLcode Curl_cf_h2_proxy_insert_after(struct Curl_cfilter *cf,
-                                       struct Curl_easy *data)
+                                       struct Curl_easy *data,
+                                       struct Curl_peer *dest,
+                                       bool udp_tunnel)
 {
   struct Curl_cfilter *cf_h2_proxy = NULL;
   struct cf_h2_proxy_ctx *ctx;
   CURLcode result = CURLE_OUT_OF_MEMORY;
 
   (void)data;
-  ctx = calloc(sizeof(*ctx), 1);
+  ctx = curlx_calloc(1, sizeof(*ctx));
   if(!ctx)
     goto out;
+  Curl_peer_link(&ctx->dest, dest);
+  ctx->udp_tunnel = udp_tunnel;
 
   result = Curl_cf_create(&cf_h2_proxy, &Curl_cft_h2_proxy, ctx);
   if(result)
     goto out;
-
+  ctx = NULL;
   Curl_conn_cf_insert_after(cf, cf_h2_proxy);
-  result = CURLE_OK;
 
 out:
-  if(result)
-    cf_h2_proxy_ctx_free(ctx);
+  cf_h2_proxy_ctx_free(ctx);
   return result;
 }
 
-#endif /* defined(USE_NGHTTP2) && !defined(CURL_DISABLE_PROXY) */
+#endif /* !CURL_DISABLE_HTTP && !CURL_DISABLE_PROXY && USE_NGHTTP2 */
diff --git a/third-party/curl/lib/cf-h2-proxy.h b/third-party/curl/lib/cf-h2-proxy.h
index c01bf62133..07e3c9aedf 100644
--- a/third-party/curl/lib/cf-h2-proxy.h
+++ b/third-party/curl/lib/cf-h2-proxy.h
@@ -23,17 +23,17 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if defined(USE_NGHTTP2) && !defined(CURL_DISABLE_PROXY)
 
 CURLcode Curl_cf_h2_proxy_insert_after(struct Curl_cfilter *cf,
-                                       struct Curl_easy *data);
+                                       struct Curl_easy *data,
+                                       struct Curl_peer *dest,
+                                       bool udp_tunnel);
 
 extern struct Curl_cftype Curl_cft_h2_proxy;
 
-
-#endif /* defined(USE_NGHTTP2) && !defined(CURL_DISABLE_PROXY) */
+#endif /* USE_NGHTTP2 && !CURL_DISABLE_PROXY */
 
 #endif /* HEADER_CURL_H2_PROXY_H */
diff --git a/third-party/curl/lib/cf-haproxy.c b/third-party/curl/lib/cf-haproxy.c
index 39ac415717..16ee25066c 100644
--- a/third-party/curl/lib/cf-haproxy.c
+++ b/third-party/curl/lib/cf-haproxy.c
@@ -21,28 +21,23 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#if !defined(CURL_DISABLE_PROXY)
+#ifndef CURL_DISABLE_PROXY
 
-#include <curl/curl.h>
 #include "urldata.h"
 #include "cfilters.h"
 #include "cf-haproxy.h"
+#include "connect.h"
+#include "curl_addrinfo.h"
 #include "curl_trc.h"
-#include "multiif.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "select.h"
 
 
 typedef enum {
-    HAPROXY_INIT,     /* init/default/no tunnel state */
-    HAPROXY_SEND,     /* data_out being sent */
-    HAPROXY_DONE      /* all work done */
+  HAPROXY_INIT,     /* init/default/no tunnel state */
+  HAPROXY_SEND,     /* data_out being sent */
+  HAPROXY_DONE      /* all work done */
 } haproxy_state;
 
 struct cf_haproxy_ctx {
@@ -50,50 +45,56 @@ struct cf_haproxy_ctx {
   struct dynbuf data_out;
 };
 
-static void cf_haproxy_ctx_reset(struct cf_haproxy_ctx *ctx)
-{
-  DEBUGASSERT(ctx);
-  ctx->state = HAPROXY_INIT;
-  Curl_dyn_reset(&ctx->data_out);
-}
-
 static void cf_haproxy_ctx_free(struct cf_haproxy_ctx *ctx)
 {
   if(ctx) {
-    Curl_dyn_free(&ctx->data_out);
-    free(ctx);
+    curlx_dyn_free(&ctx->data_out);
+    curlx_free(ctx);
   }
 }
 
-static CURLcode cf_haproxy_date_out_set(struct Curl_cfilter*cf,
+static CURLcode cf_haproxy_date_out_set(struct Curl_cfilter *cf,
                                         struct Curl_easy *data)
 {
+  /* We fake a client connection report to the upstream server
+   * with the HAProxy protocol, reporting the client's source
+   * and destination IP addresses and ports.
+   * addresses: either the ones used to talk to the upstream
+   *            OR the value supplied by the user
+   * ports: the ports used in the upstream connection */
+  const char *client_source_ip;
+  const char *client_dest_ip;
   struct cf_haproxy_ctx *ctx = cf->ctx;
   CURLcode result;
-  const char *tcp_version;
-  const char *client_ip;
+  struct ip_quadruple ipquad;
+  bool is_ipv6;
 
   DEBUGASSERT(ctx);
   DEBUGASSERT(ctx->state == HAPROXY_INIT);
 #ifdef USE_UNIX_SOCKETS
-  if(cf->conn->unix_domain_socket)
+  if(Curl_conn_get_first_peer(cf->conn, cf->sockindex)->unix_socket)
     /* the buffer is large enough to hold this! */
-    result = Curl_dyn_addn(&ctx->data_out, STRCONST("PROXY UNKNOWN\r\n"));
+    result = curlx_dyn_addn(&ctx->data_out, STRCONST("PROXY UNKNOWN\r\n"));
   else {
 #endif /* USE_UNIX_SOCKETS */
-  /* Emit the correct prefix for IPv6 */
-  tcp_version = cf->conn->bits.ipv6 ? "TCP6" : "TCP4";
-  if(data->set.str[STRING_HAPROXY_CLIENT_IP])
-    client_ip = data->set.str[STRING_HAPROXY_CLIENT_IP];
-  else
-    client_ip = data->info.conn_local_ip;
+  result = Curl_conn_cf_get_ip_info(cf->next, data, &is_ipv6, &ipquad);
+  if(result)
+    return result;
 
-  result = Curl_dyn_addf(&ctx->data_out, "PROXY %s %s %s %i %i\r\n",
-                         tcp_version,
-                         client_ip,
-                         data->info.conn_primary_ip,
-                         data->info.conn_local_port,
-                         data->info.conn_primary_port);
+  if(data->set.str[STRING_HAPROXY_CLIENT_IP]) {
+    client_source_ip = data->set.str[STRING_HAPROXY_CLIENT_IP];
+    client_dest_ip = client_source_ip;
+    is_ipv6 = !Curl_is_ipv4addr(client_source_ip);
+  }
+  else {
+    client_source_ip = ipquad.local_ip;
+    client_dest_ip = ipquad.remote_ip;
+  }
+
+  result = curlx_dyn_addf(&ctx->data_out, "PROXY %s %s %s %d %d\r\n",
+                          is_ipv6 ? "TCP6" : "TCP4",
+                          client_source_ip, client_dest_ip,
+                          ipquad.local_port, ipquad.remote_port);
 
 #ifdef USE_UNIX_SOCKETS
   }
@@ -103,7 +104,7 @@ static CURLcode cf_haproxy_date_out_set(struct Curl_cfilter*cf,
 
 static CURLcode cf_haproxy_connect(struct Curl_cfilter *cf,
                                    struct Curl_easy *data,
-                                   bool blocking, bool *done)
+                                   bool *done)
 {
   struct cf_haproxy_ctx *ctx = cf->ctx;
   CURLcode result;
@@ -115,7 +116,7 @@ static CURLcode cf_haproxy_connect(struct Curl_cfilter *cf,
     return CURLE_OK;
   }
 
-  result = cf->next->cft->do_connect(cf->next, data, blocking, done);
+  result = cf->next->cft->do_connect(cf->next, data, done);
   if(result || !*done)
     return result;
 
@@ -125,25 +126,30 @@ static CURLcode cf_haproxy_connect(struct Curl_cfilter *cf,
     if(result)
       goto out;
     ctx->state = HAPROXY_SEND;
-    /* FALLTHROUGH */
+    FALLTHROUGH();
   case HAPROXY_SEND:
-    len = Curl_dyn_len(&ctx->data_out);
+    len = curlx_dyn_len(&ctx->data_out);
     if(len > 0) {
-      ssize_t written = Curl_conn_send(data, cf->sockindex,
-                                       Curl_dyn_ptr(&ctx->data_out),
-                                       len, &result);
-      if(written < 0)
-        goto out;
-      Curl_dyn_tail(&ctx->data_out, len - (size_t)written);
-      if(Curl_dyn_len(&ctx->data_out) > 0) {
+      size_t nwritten;
+      result = Curl_conn_cf_send(cf->next, data,
+                                 curlx_dyn_uptr(&ctx->data_out), len, FALSE,
+                                 &nwritten);
+      if(result) {
+        if(result != CURLE_AGAIN)
+          goto out;
+        result = CURLE_OK;
+        nwritten = 0;
+      }
+      curlx_dyn_tail(&ctx->data_out, len - nwritten);
+      if(curlx_dyn_len(&ctx->data_out) > 0) {
         result = CURLE_OK;
         goto out;
       }
     }
     ctx->state = HAPROXY_DONE;
-    /* FALLTHROUGH */
+    FALLTHROUGH();
   default:
-    Curl_dyn_free(&ctx->data_out);
+    curlx_dyn_free(&ctx->data_out);
     break;
   }
 
@@ -156,47 +162,31 @@ out:
 static void cf_haproxy_destroy(struct Curl_cfilter *cf,
                                struct Curl_easy *data)
 {
-  (void)data;
   CURL_TRC_CF(data, cf, "destroy");
   cf_haproxy_ctx_free(cf->ctx);
 }
 
-static void cf_haproxy_close(struct Curl_cfilter *cf,
-                             struct Curl_easy *data)
+static CURLcode cf_haproxy_adjust_pollset(struct Curl_cfilter *cf,
+                                          struct Curl_easy *data,
+                                          struct easy_pollset *ps)
 {
-  CURL_TRC_CF(data, cf, "close");
-  cf->connected = FALSE;
-  cf_haproxy_ctx_reset(cf->ctx);
-  if(cf->next)
-    cf->next->cft->do_close(cf->next, data);
-}
-
-static int cf_haproxy_get_select_socks(struct Curl_cfilter *cf,
-                                       struct Curl_easy *data,
-                                       curl_socket_t *socks)
-{
-  int fds;
-
-  fds = cf->next->cft->get_select_socks(cf->next, data, socks);
-  if(!fds && cf->next->connected && !cf->connected) {
+  if(cf->next->connected && !cf->connected) {
     /* If we are not connected, but the filter "below" is
      * and not waiting on something, we are sending. */
-    socks[0] = Curl_conn_cf_get_socket(cf, data);
-    return GETSOCK_WRITESOCK(0);
+    return Curl_pollset_set_out_only(
+      data, ps, Curl_conn_cf_get_socket(cf, data));
   }
-  return fds;
+  return CURLE_OK;
 }
 
-
 struct Curl_cftype Curl_cft_haproxy = {
   "HAPROXY",
-  0,
+  CF_TYPE_PROXY | CF_TYPE_SETUP,
   0,
   cf_haproxy_destroy,
   cf_haproxy_connect,
-  cf_haproxy_close,
-  Curl_cf_def_get_host,
-  cf_haproxy_get_select_socks,
+  Curl_cf_def_shutdown,
+  cf_haproxy_adjust_pollset,
   Curl_cf_def_data_pending,
   Curl_cf_def_send,
   Curl_cf_def_recv,
@@ -214,13 +204,13 @@ static CURLcode cf_haproxy_create(struct Curl_cfilter **pcf,
   CURLcode result;
 
   (void)data;
-  ctx = calloc(sizeof(*ctx), 1);
+  ctx = curlx_calloc(1, sizeof(*ctx));
   if(!ctx) {
     result = CURLE_OUT_OF_MEMORY;
     goto out;
   }
   ctx->state = HAPROXY_INIT;
-  Curl_dyn_init(&ctx->data_out, DYN_HAXPROXY);
+  curlx_dyn_init(&ctx->data_out, DYN_HAXPROXY);
 
   result = Curl_cf_create(&cf, &Curl_cft_haproxy, ctx);
   if(result)
@@ -229,7 +219,7 @@ static CURLcode cf_haproxy_create(struct Curl_cfilter **pcf,
 
 out:
   cf_haproxy_ctx_free(ctx);
-  *pcf = result? NULL : cf;
+  *pcf = result ? NULL : cf;
   return result;
 }
 
diff --git a/third-party/curl/lib/cf-haproxy.h b/third-party/curl/lib/cf-haproxy.h
index d02c323e7b..6d67597cd7 100644
--- a/third-party/curl/lib/cf-haproxy.h
+++ b/third-party/curl/lib/cf-haproxy.h
@@ -23,11 +23,11 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+
 #include "urldata.h"
 
-#if !defined(CURL_DISABLE_PROXY)
+#ifndef CURL_DISABLE_PROXY
 
 CURLcode Curl_cf_haproxy_insert_after(struct Curl_cfilter *cf_at,
                                       struct Curl_easy *data);
diff --git a/third-party/curl/lib/cf-https-connect.c b/third-party/curl/lib/cf-https-connect.c
index be54aec740..1a2e966ef6 100644
--- a/third-party/curl/lib/cf-https-connect.c
+++ b/third-party/curl/lib/cf-https-connect.c
@@ -21,28 +21,27 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#if !defined(CURL_DISABLE_HTTP) && !defined(USE_HYPER)
+#ifndef CURL_DISABLE_HTTP
 
 #include "urldata.h"
-#include <curl/curl.h>
 #include "curl_trc.h"
 #include "cfilters.h"
+#include "cf-dns.h"
+#include "cf-setup.h"
 #include "connect.h"
+#include "hostip.h"
+#include "httpsrr.h"
 #include "multiif.h"
 #include "cf-https-connect.h"
 #include "http2.h"
+#include "progress.h"
+#include "select.h"
 #include "vquic/vquic.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-
 typedef enum {
+  CF_HC_RESOLV,
   CF_HC_INIT,
   CF_HC_CONNECT,
   CF_HC_SUCCESS,
@@ -55,24 +54,23 @@ struct cf_hc_baller {
   CURLcode result;
   struct curltime started;
   int reply_ms;
-  bool enabled;
+  uint8_t transport;
+  enum alpnid alpn_id;
+  BIT(shutdown);
 };
 
-static void cf_hc_baller_reset(struct cf_hc_baller *b,
-                               struct Curl_easy *data)
+static void cf_hc_baller_discard(struct cf_hc_baller *b,
+                                 struct Curl_easy *data)
 {
   if(b->cf) {
-    Curl_conn_cf_close(b->cf, data);
     Curl_conn_cf_discard_chain(&b->cf, data);
     b->cf = NULL;
   }
-  b->result = CURLE_OK;
-  b->reply_ms = -1;
 }
 
-static bool cf_hc_baller_is_active(struct cf_hc_baller *b)
+static bool cf_hc_baller_is_connecting(struct cf_hc_baller *b)
 {
-  return b->enabled && b->cf && !b->result;
+  return b->cf && !b->result;
 }
 
 static bool cf_hc_baller_has_started(struct cf_hc_baller *b)
@@ -83,7 +81,7 @@ static bool cf_hc_baller_has_started(struct cf_hc_baller *b)
 static int cf_hc_baller_reply_ms(struct cf_hc_baller *b,
                                  struct Curl_easy *data)
 {
-  if(b->reply_ms < 0)
+  if(b->cf && (b->reply_ms < 0))
     b->cf->cft->query(b->cf, data, CF_QUERY_CONNECT_REPLY_MS,
                       &b->reply_ms, NULL);
   return b->reply_ms;
@@ -95,31 +93,95 @@ static bool cf_hc_baller_data_pending(struct cf_hc_baller *b,
   return b->cf && !b->result && b->cf->cft->has_data_pending(b->cf, data);
 }
 
+static bool cf_hc_baller_needs_flush(struct cf_hc_baller *b,
+                                     struct Curl_easy *data)
+{
+  return b->cf && !b->result && Curl_conn_cf_needs_flush(b->cf, data);
+}
+
+static CURLcode cf_hc_baller_cntrl(struct cf_hc_baller *b,
+                                   struct Curl_easy *data,
+                                   int event, int arg1, void *arg2)
+{
+  if(b->cf && !b->result)
+    return Curl_conn_cf_cntrl(b->cf, data, FALSE, event, arg1, arg2);
+  return CURLE_OK;
+}
+
 struct cf_hc_ctx {
   cf_hc_state state;
-  const struct Curl_dns_entry *remotehost;
   struct curltime started;  /* when connect started */
   CURLcode result;          /* overall result */
-  struct cf_hc_baller h3_baller;
-  struct cf_hc_baller h21_baller;
-  int soft_eyeballs_timeout_ms;
-  int hard_eyeballs_timeout_ms;
+  CURLcode check_h3_result;
+  struct cf_hc_baller ballers[2];
+  size_t baller_count;
+  timediff_t soft_eyeballs_timeout_ms;
+  timediff_t hard_eyeballs_timeout_ms;
+  uint8_t def_transport;
+  BIT(httpsrr_resolved);
+  BIT(checked_h3);
+  BIT(ballers_complete);
 };
 
+static void cf_hc_ctx_close(struct Curl_easy *data,
+                            struct cf_hc_ctx *ctx)
+{
+  if(ctx) {
+    size_t i;
+    for(i = 0; i < ctx->baller_count; ++i)
+      cf_hc_baller_discard(&ctx->ballers[i], data);
+  }
+}
+
+static void cf_hc_ctx_destroy(struct Curl_easy *data,
+                              struct cf_hc_ctx *ctx)
+{
+  if(ctx) {
+    cf_hc_ctx_close(data, ctx);
+    curlx_free(ctx);
+  }
+}
+
+static void cf_hc_baller_assign(struct cf_hc_baller *b,
+                                enum alpnid alpn_id,
+                                uint8_t def_transport)
+{
+  b->alpn_id = alpn_id;
+  b->transport = def_transport;
+  b->cf = NULL;
+  b->result = CURLE_OK;
+  b->reply_ms = -1;
+  b->shutdown = FALSE;
+  switch(b->alpn_id) {
+  case ALPN_h3:
+    b->name = "h3";
+    b->transport = TRNSPRT_QUIC;
+    break;
+  case ALPN_h2:
+    b->name = "h2";
+    break;
+  case ALPN_h1:
+    b->name = "h1";
+    break;
+  case ALPN_none:
+    b->name = "no-alpn";
+    break;
+  default:
+    b->result = CURLE_FAILED_INIT;
+    break;
+  }
+}
+
 static void cf_hc_baller_init(struct cf_hc_baller *b,
                               struct Curl_cfilter *cf,
-                              struct Curl_easy *data,
-                              const char *name,
-                              int transport)
+                              struct Curl_easy *data)
 {
-  struct cf_hc_ctx *ctx = cf->ctx;
   struct Curl_cfilter *save = cf->next;
 
-  b->name = name;
   cf->next = NULL;
-  b->started = Curl_now();
-  b->result = Curl_cf_setup_insert_after(cf, data, ctx->remotehost,
-                                         transport, CURL_CF_SSL_ENABLE);
+  b->started = *Curl_pgrs_now(data);
+  b->result = Curl_cf_setup_insert_after(cf, data, b->transport,
+                                         CURL_CF_SSL_ENABLE);
   b->cf = cf->next;
   cf->next = save;
 }
@@ -132,174 +194,369 @@ static CURLcode cf_hc_baller_connect(struct cf_hc_baller *b,
   struct Curl_cfilter *save = cf->next;
 
   cf->next = b->cf;
-  b->result = Curl_conn_cf_connect(cf->next, data, FALSE, done);
+  b->result = Curl_conn_cf_connect(cf->next, data, done);
   b->cf = cf->next; /* it might mutate */
   cf->next = save;
   return b->result;
 }
 
-static void cf_hc_reset(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_hc_ctx *ctx = cf->ctx;
-
-  if(ctx) {
-    cf_hc_baller_reset(&ctx->h3_baller, data);
-    cf_hc_baller_reset(&ctx->h21_baller, data);
-    ctx->state = CF_HC_INIT;
-    ctx->result = CURLE_OK;
-    ctx->hard_eyeballs_timeout_ms = data->set.happy_eyeballs_timeout;
-    ctx->soft_eyeballs_timeout_ms = data->set.happy_eyeballs_timeout / 2;
-  }
-}
-
 static CURLcode baller_connected(struct Curl_cfilter *cf,
                                  struct Curl_easy *data,
                                  struct cf_hc_baller *winner)
 {
   struct cf_hc_ctx *ctx = cf->ctx;
-  CURLcode result = CURLE_OK;
 
-  DEBUGASSERT(winner->cf);
-  if(winner != &ctx->h3_baller)
-    cf_hc_baller_reset(&ctx->h3_baller, data);
-  if(winner != &ctx->h21_baller)
-    cf_hc_baller_reset(&ctx->h21_baller, data);
+  /* Make the winner's connection filter out own sub-filter, check, move,
+   * close all remaining. */
+  if(cf->next) {
+    DEBUGASSERT(0);
+    return CURLE_FAILED_INIT;
+  }
+  if(!winner->cf) {
+    DEBUGASSERT(0);
+    return CURLE_FAILED_INIT;
+  }
 
-  CURL_TRC_CF(data, cf, "connect+handshake %s: %dms, 1st data: %dms",
-              winner->name, (int)Curl_timediff(Curl_now(), winner->started),
-              cf_hc_baller_reply_ms(winner, data));
   cf->next = winner->cf;
   winner->cf = NULL;
-
-  switch(cf->conn->alpn) {
-  case CURL_HTTP_VERSION_3:
-    infof(data, "using HTTP/3");
-    break;
-  case CURL_HTTP_VERSION_2:
-#ifdef USE_NGHTTP2
-    /* Using nghttp2, we add the filter "below" us, so when the conn
-     * closes, we tear it down for a fresh reconnect */
-    result = Curl_http2_switch_at(cf, data);
-    if(result) {
-      ctx->state = CF_HC_FAILURE;
-      ctx->result = result;
-      return result;
-    }
-#endif
-    infof(data, "using HTTP/2");
-    break;
-  case CURL_HTTP_VERSION_1_1:
-    infof(data, "using HTTP/1.1");
-    break;
-  default:
-    infof(data, "using HTTP/1.x");
-    break;
-  }
   ctx->state = CF_HC_SUCCESS;
   cf->connected = TRUE;
-  Curl_conn_cf_cntrl(cf->next, data, TRUE,
-                     CF_CTRL_CONN_INFO_UPDATE, 0, NULL);
-  return result;
+
+  cf_hc_ctx_close(data, ctx);
+  /* ballers may have failf()'d, the winner resets it, so our
+   * errorbuf is clean again. */
+  Curl_reset_fail(data);
+
+#ifdef USE_NGHTTP2
+  {
+    /* For a negotiated HTTP/2 connection insert the h2 filter. */
+    const char *alpn = Curl_conn_cf_get_alpn_negotiated(cf->next, data);
+    if(alpn && !strcmp("h2", alpn)) {
+      CURLcode result = Curl_http2_switch_at(cf, data);
+      if(result) {
+        ctx->state = CF_HC_FAILURE;
+        ctx->result = result;
+        return result;
+      }
+    }
+  }
+#endif
+  return CURLE_OK;
 }
 
-
-static bool time_to_start_h21(struct Curl_cfilter *cf,
-                              struct Curl_easy *data,
-                              struct curltime now)
+static bool time_to_start_baller2(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data)
 {
   struct cf_hc_ctx *ctx = cf->ctx;
   timediff_t elapsed_ms;
 
-  if(!ctx->h21_baller.enabled || cf_hc_baller_has_started(&ctx->h21_baller))
+  if(ctx->baller_count < 2)
     return FALSE;
-
-  if(!ctx->h3_baller.enabled || !cf_hc_baller_is_active(&ctx->h3_baller))
-    return TRUE;
-
-  elapsed_ms = Curl_timediff(now, ctx->started);
-  if(elapsed_ms >= ctx->hard_eyeballs_timeout_ms) {
-    CURL_TRC_CF(data, cf, "hard timeout of %dms reached, starting h21",
-                ctx->hard_eyeballs_timeout_ms);
+  else if(cf_hc_baller_has_started(&ctx->ballers[1]))
+    return FALSE;
+  else if(ctx->ballers[0].result) {
+    CURL_TRC_CF(data, cf, "%s baller failed, starting %s",
+                ctx->ballers[0].name, ctx->ballers[1].name);
     return TRUE;
   }
 
-  if(elapsed_ms >= ctx->soft_eyeballs_timeout_ms) {
-    if(cf_hc_baller_reply_ms(&ctx->h3_baller, data) < 0) {
-      CURL_TRC_CF(data, cf, "soft timeout of %dms reached, h3 has not "
-                  "seen any data, starting h21",
-                  ctx->soft_eyeballs_timeout_ms);
+  elapsed_ms = curlx_ptimediff_ms(Curl_pgrs_now(data), &ctx->started);
+  if(elapsed_ms >= ctx->hard_eyeballs_timeout_ms) {
+    CURL_TRC_CF(data, cf, "%s inconclusive after %" FMT_TIMEDIFF_T ", "
+                "starting %s", ctx->ballers[0].name,
+                ctx->hard_eyeballs_timeout_ms, ctx->ballers[1].name);
+    return TRUE;
+  }
+  else if(elapsed_ms >= ctx->soft_eyeballs_timeout_ms) {
+    if(cf_hc_baller_reply_ms(&ctx->ballers[0], data) < 0) {
+      CURL_TRC_CF(data, cf, "%s has not seen any data after %"
+                  FMT_TIMEDIFF_T "ms, starting %s",
+                  ctx->ballers[0].name, ctx->soft_eyeballs_timeout_ms,
+                  ctx->ballers[1].name);
       return TRUE;
     }
-    /* set the effective hard timeout again */
-    Curl_expire(data, ctx->hard_eyeballs_timeout_ms - elapsed_ms,
-                EXPIRE_ALPN_EYEBALLS);
   }
   return FALSE;
 }
 
-static CURLcode cf_hc_connect(struct Curl_cfilter *cf,
-                              struct Curl_easy *data,
-                              bool blocking, bool *done)
+static bool cf_hc_may_h3(struct Curl_cfilter *cf,
+                         struct Curl_easy *data)
+{
+  struct cf_hc_ctx *ctx = cf->ctx;
+  if(!ctx->checked_h3) {
+    ctx->check_h3_result =
+      Curl_conn_may_http3(data, cf->conn, ctx->def_transport);
+    ctx->checked_h3 = TRUE;
+  }
+  return !ctx->check_h3_result;
+}
+
+static enum alpnid cf_hc_get_httpsrr_alpn(struct Curl_cfilter *cf,
+                                          struct Curl_easy *data,
+                                          enum alpnid not_this_one)
+{
+#ifdef USE_HTTPSRR
+  /* Is there an HTTPSRR use its ALPNs here.
+   * We are here after having selected a connection to a host+port and
+   * can no longer change that. Any HTTPSRR advice for other hosts and ports
+   * we need to ignore. */
+  const struct Curl_https_rrinfo *rr;
+  size_t i;
+
+  /* Do we have HTTPS-RR information? */
+  rr = Curl_conn_dns_get_https(
+    data, cf->sockindex, Curl_conn_get_destination(cf->conn, cf->sockindex));
+
+  /* We do not support `rr->no_def_alpn`. */
+  if(Curl_httpsrr_applicable(data, rr) && !rr->no_def_alpn) {
+    for(i = 0; i < CURL_ARRAYSIZE(rr->alpns); ++i) {
+      enum alpnid alpn_rr = (enum alpnid)rr->alpns[i];
+      if(alpn_rr == not_this_one) /* do not want this one */
+        continue;
+      switch(alpn_rr) {
+      case ALPN_h3:
+        if((data->state.http_neg.allowed & CURL_HTTP_V3x) &&
+           cf_hc_may_h3(cf, data)) {
+          return alpn_rr;
+        }
+        break;
+      case ALPN_h2:
+        if(data->state.http_neg.allowed & CURL_HTTP_V2x) {
+          return alpn_rr;
+        }
+        break;
+      case ALPN_h1:
+        if(data->state.http_neg.allowed & CURL_HTTP_V1x) {
+          return alpn_rr;
+        }
+        break;
+      default: /* ignore */
+        break;
+      }
+    }
+  }
+#else
+  (void)cf;
+  (void)data;
+  (void)not_this_one;
+#endif
+  return ALPN_none;
+}
+
+static enum alpnid cf_hc_get_pref_alpn(struct Curl_cfilter *cf,
+                                       struct Curl_easy *data,
+                                       enum alpnid not_this_one)
+{
+  if((data->state.http_neg.preferred & data->state.http_neg.allowed)) {
+    switch(data->state.http_neg.preferred) {
+    case CURL_HTTP_V3x:
+      if(cf_hc_may_h3(cf, data) && (ALPN_h3 != not_this_one))
+        return ALPN_h3;
+      break;
+    case CURL_HTTP_V2x:
+      if(ALPN_h2 != not_this_one)
+        return ALPN_h2;
+      break;
+    case CURL_HTTP_V1x:
+      /* If we are trying h2 already, h1 is already used as fallback */
+      if((ALPN_h1 != not_this_one) && (ALPN_h2 != not_this_one))
+        return ALPN_h1;
+      break;
+    default:
+      break;
+    }
+  }
+  return ALPN_none;
+}
+
+static enum alpnid cf_hc_get_first_alpn(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data,
+                                        http_majors choices,
+                                        enum alpnid not_this_one)
+{
+  /* When told to not try h2, we also do not try h1 and vice versa */
+  bool allow_h1_or_h2 = (not_this_one != ALPN_h1) &&
+                        (not_this_one != ALPN_h2);
+  if((ALPN_h3 != not_this_one) && (choices & CURL_HTTP_V3x) &&
+     cf_hc_may_h3(cf, data)) {
+    return ALPN_h3;
+  }
+  if(allow_h1_or_h2 && (choices & CURL_HTTP_V2x)) {
+    return ALPN_h2;
+  }
+  if(allow_h1_or_h2 && (choices & CURL_HTTP_V1x)) {
+    return ALPN_h1;
+  }
+  return ALPN_none;
+}
+
+static CURLcode cf_hc_set_baller1(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data)
+{
+  struct cf_hc_ctx *ctx = cf->ctx;
+  enum alpnid alpn1 = ALPN_none;
+  VERBOSE(const char *source = "HTTPS-RR");
+
+  DEBUGASSERT(cf->conn->bits.tls_enable_alpn);
+
+  alpn1 = cf_hc_get_httpsrr_alpn(cf, data, ALPN_none);
+  if(alpn1 == ALPN_none) {
+    /* preference is configured and allowed, can we use it? */
+    VERBOSE(source = "preferred version");
+    alpn1 = cf_hc_get_pref_alpn(cf, data, ALPN_none);
+  }
+  if(alpn1 == ALPN_none) {
+    VERBOSE(source = "wanted versions");
+    alpn1 = cf_hc_get_first_alpn(cf, data,
+                                 data->state.http_neg.wanted,
+                                 ALPN_none);
+  }
+  if(alpn1 == ALPN_none) {
+    VERBOSE(source = "allowed versions");
+    alpn1 = cf_hc_get_first_alpn(cf, data,
+                                 data->state.http_neg.allowed,
+                                 ALPN_none);
+  }
+
+  if(alpn1 == ALPN_none) {
+    /* None of the wanted/allowed HTTP versions could be chosen */
+    if(ctx->check_h3_result) {
+      CURL_TRC_CF(data, cf, "unable to use HTTP/3");
+      return ctx->check_h3_result;
+    }
+    CURL_TRC_CF(data, cf, "unable to select HTTP version");
+    return CURLE_FAILED_INIT;
+  }
+
+  cf_hc_baller_assign(&ctx->ballers[0], alpn1, ctx->def_transport);
+  ctx->baller_count = 1;
+  CURL_TRC_CF(data, cf, "1st attempt uses %s from %s",
+              ctx->ballers[0].name, source);
+
+  switch(alpn1) {
+  case ALPN_h1:
+    /* We really want h1, switch off h2 to make it disappear in ALPN */
+    data->state.http_neg.wanted &= (uint8_t)~CURL_HTTP_V2x;
+    break;
+  default:
+    break;
+  }
+
+  return CURLE_OK;
+}
+
+static void cf_hc_set_baller2(struct Curl_cfilter *cf,
+                              struct Curl_easy *data)
+{
+  struct cf_hc_ctx *ctx = cf->ctx;
+  enum alpnid alpn2 = ALPN_none, alpn1 = ctx->ballers[0].alpn_id;
+  VERBOSE(const char *source = "HTTPS-RR");
+
+  if(ctx->ballers_complete)
+    return; /* already done */
+  if(!ctx->httpsrr_resolved)
+    return; /* HTTPS-RR pending */
+
+  alpn2 = cf_hc_get_httpsrr_alpn(cf, data, alpn1);
+  if(alpn2 == ALPN_none) {
+    /* preference is configured and allowed, can we use it? */
+    VERBOSE(source = "preferred version");
+    alpn2 = cf_hc_get_pref_alpn(cf, data, alpn1);
+  }
+  if(alpn2 == ALPN_none) {
+    VERBOSE(source = "wanted versions");
+    alpn2 = cf_hc_get_first_alpn(cf, data,
+                                 data->state.http_neg.wanted,
+                                 alpn1);
+  }
+
+  if(alpn2 != ALPN_none) {
+    cf_hc_baller_assign(&ctx->ballers[1], alpn2, ctx->def_transport);
+    ctx->baller_count = 2;
+    CURL_TRC_CF(data, cf, "2nd attempt uses %s from %s",
+                ctx->ballers[1].name, source);
+  }
+  ctx->ballers_complete = TRUE;
+}
+
+static CURLcode cf_hc_connect(struct Curl_cfilter *cf,
+                              struct Curl_easy *data,
+                              bool *done)
 {
   struct cf_hc_ctx *ctx = cf->ctx;
-  struct curltime now;
   CURLcode result = CURLE_OK;
 
-  (void)blocking;
   if(cf->connected) {
     *done = TRUE;
     return CURLE_OK;
   }
 
   *done = FALSE;
-  now = Curl_now();
+
+  if(!ctx->httpsrr_resolved) {
+    ctx->httpsrr_resolved = Curl_conn_dns_resolved_https(
+      data, cf->sockindex, Curl_conn_get_destination(cf->conn, cf->sockindex));
+#ifdef DEBUGBUILD
+    if(!ctx->httpsrr_resolved && getenv("CURL_DBG_AWAIT_HTTPSRR")) {
+      CURL_TRC_CF(data, cf, "awaiting HTTPS-RR");
+      return CURLE_OK;
+    }
+#endif
+  }
+
   switch(ctx->state) {
+  case CF_HC_RESOLV:
+    ctx->state = CF_HC_INIT;
+    FALLTHROUGH();
+
   case CF_HC_INIT:
-    DEBUGASSERT(!ctx->h3_baller.cf);
-    DEBUGASSERT(!ctx->h21_baller.cf);
     DEBUGASSERT(!cf->next);
     CURL_TRC_CF(data, cf, "connect, init");
-    ctx->started = now;
-    if(ctx->h3_baller.enabled) {
-      cf_hc_baller_init(&ctx->h3_baller, cf, data, "h3", TRNSPRT_QUIC);
-      if(ctx->h21_baller.enabled)
-        Curl_expire(data, ctx->soft_eyeballs_timeout_ms, EXPIRE_ALPN_EYEBALLS);
+    result = cf_hc_set_baller1(cf, data);
+    if(result) {
+      ctx->result = result;
+      ctx->state = CF_HC_FAILURE;
+      goto out;
+    }
+    cf_hc_set_baller2(cf, data);
+    ctx->started = *Curl_pgrs_now(data);
+    cf_hc_baller_init(&ctx->ballers[0], cf, data);
+    if((ctx->baller_count > 1) || !ctx->ballers_complete) {
+      Curl_expire(data, ctx->soft_eyeballs_timeout_ms, EXPIRE_ALPN_EYEBALLS);
     }
-    else if(ctx->h21_baller.enabled)
-      cf_hc_baller_init(&ctx->h21_baller, cf, data, "h21",
-                       cf->conn->transport);
     ctx->state = CF_HC_CONNECT;
-    /* FALLTHROUGH */
+    FALLTHROUGH();
 
   case CF_HC_CONNECT:
-    if(cf_hc_baller_is_active(&ctx->h3_baller)) {
-      result = cf_hc_baller_connect(&ctx->h3_baller, cf, data, done);
+    if(!ctx->ballers_complete)
+      cf_hc_set_baller2(cf, data);
+
+    if(cf_hc_baller_is_connecting(&ctx->ballers[0])) {
+      result = cf_hc_baller_connect(&ctx->ballers[0], cf, data, done);
       if(!result && *done) {
-        result = baller_connected(cf, data, &ctx->h3_baller);
+        result = baller_connected(cf, data, &ctx->ballers[0]);
         goto out;
       }
     }
 
-    if(time_to_start_h21(cf, data, now)) {
-      cf_hc_baller_init(&ctx->h21_baller, cf, data, "h21",
-                        cf->conn->transport);
+    if(time_to_start_baller2(cf, data)) {
+      cf_hc_baller_init(&ctx->ballers[1], cf, data);
     }
 
-    if(cf_hc_baller_is_active(&ctx->h21_baller)) {
-      CURL_TRC_CF(data, cf, "connect, check h21");
-      result = cf_hc_baller_connect(&ctx->h21_baller, cf, data, done);
+    if(cf_hc_baller_is_connecting(&ctx->ballers[1])) {
+      result = cf_hc_baller_connect(&ctx->ballers[1], cf, data, done);
       if(!result && *done) {
-        result = baller_connected(cf, data, &ctx->h21_baller);
+        result = baller_connected(cf, data, &ctx->ballers[1]);
         goto out;
       }
     }
 
-    if((!ctx->h3_baller.enabled || ctx->h3_baller.result) &&
-       (!ctx->h21_baller.enabled || ctx->h21_baller.result)) {
-      /* both failed or disabled. we give up */
-      CURL_TRC_CF(data, cf, "connect, all failed");
-      result = ctx->result = ctx->h3_baller.enabled?
-                              ctx->h3_baller.result : ctx->h21_baller.result;
+    if(ctx->ballers[0].result &&
+       (ctx->ballers[1].result ||
+        (ctx->ballers_complete && (ctx->baller_count < 2)))) {
+      /* all have failed. we give up */
+      CURL_TRC_CF(data, cf, "connect, all attempts failed");
+      ctx->result = result = ctx->ballers[0].result;
       ctx->state = CF_HC_FAILURE;
       goto out;
     }
@@ -321,59 +578,84 @@ static CURLcode cf_hc_connect(struct Curl_cfilter *cf,
   }
 
 out:
-  CURL_TRC_CF(data, cf, "connect -> %d, done=%d", result, *done);
+  CURL_TRC_CF(data, cf, "connect -> %d, done=%d", (int)result, *done);
   return result;
 }
 
-static int cf_hc_get_select_socks(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  curl_socket_t *socks)
+static CURLcode cf_hc_shutdown(struct Curl_cfilter *cf,
+                               struct Curl_easy *data, bool *done)
 {
   struct cf_hc_ctx *ctx = cf->ctx;
-  size_t i, j, s;
-  int brc, rc = GETSOCK_BLANK;
-  curl_socket_t bsocks[MAX_SOCKSPEREASYHANDLE];
-  struct cf_hc_baller *ballers[2];
+  size_t i;
+  CURLcode result = CURLE_OK;
 
-  if(cf->connected)
-    return cf->next->cft->get_select_socks(cf->next, data, socks);
+  DEBUGASSERT(data);
+  if(cf->connected) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
 
-  ballers[0] = &ctx->h3_baller;
-  ballers[1] = &ctx->h21_baller;
-  for(i = s = 0; i < sizeof(ballers)/sizeof(ballers[0]); i++) {
-    struct cf_hc_baller *b = ballers[i];
-    if(!cf_hc_baller_is_active(b))
+  /* shutdown all ballers that have not done so already. If one fails,
+   * continue shutting down others until all are shutdown. */
+  for(i = 0; i < ctx->baller_count; i++) {
+    struct cf_hc_baller *b = &ctx->ballers[i];
+    bool bdone = FALSE;
+    if(!cf_hc_baller_is_connecting(b) || b->shutdown)
       continue;
-    brc = Curl_conn_cf_get_select_socks(b->cf, data, bsocks);
-    CURL_TRC_CF(data, cf, "get_selected_socks(%s) -> %x", b->name, brc);
-    if(!brc)
-      continue;
-    for(j = 0; j < MAX_SOCKSPEREASYHANDLE && s < MAX_SOCKSPEREASYHANDLE; ++j) {
-      if((brc & GETSOCK_WRITESOCK(j)) || (brc & GETSOCK_READSOCK(j))) {
-        socks[s] = bsocks[j];
-        if(brc & GETSOCK_WRITESOCK(j))
-          rc |= GETSOCK_WRITESOCK(s);
-        if(brc & GETSOCK_READSOCK(j))
-          rc |= GETSOCK_READSOCK(s);
-        s++;
-      }
+    b->result = b->cf->cft->do_shutdown(b->cf, data, &bdone);
+    if(b->result || bdone)
+      b->shutdown = TRUE; /* treat a failed shutdown as done */
+  }
+
+  *done = TRUE;
+  for(i = 0; i < ctx->baller_count; i++) {
+    if(!ctx->ballers[i].shutdown)
+      *done = FALSE;
+  }
+  if(*done) {
+    for(i = 0; i < ctx->baller_count; i++) {
+      if(ctx->ballers[i].result)
+        result = ctx->ballers[i].result;
     }
   }
-  CURL_TRC_CF(data, cf, "get_selected_socks -> %x", rc);
-  return rc;
+  CURL_TRC_CF(data, cf, "shutdown -> %d, done=%d", (int)result, *done);
+  return result;
+}
+
+static CURLcode cf_hc_adjust_pollset(struct Curl_cfilter *cf,
+                                     struct Curl_easy *data,
+                                     struct easy_pollset *ps)
+{
+  CURLcode result = CURLE_OK;
+  if(!cf->connected) {
+    struct cf_hc_ctx *ctx = cf->ctx;
+    size_t i;
+
+    for(i = 0; (i < ctx->baller_count) && !result; i++) {
+      struct cf_hc_baller *b = &ctx->ballers[i];
+      if(!cf_hc_baller_is_connecting(b))
+        continue;
+      result = Curl_conn_cf_adjust_pollset(b->cf, data, ps);
+    }
+    CURL_TRC_CF(data, cf, "adjust_pollset -> %d, %u socks", (int)result,
+                ps->n);
+  }
+  return result;
 }
 
 static bool cf_hc_data_pending(struct Curl_cfilter *cf,
                                const struct Curl_easy *data)
 {
   struct cf_hc_ctx *ctx = cf->ctx;
+  size_t i;
 
   if(cf->connected)
     return cf->next->cft->has_data_pending(cf->next, data);
 
-  CURL_TRC_CF((struct Curl_easy *)data, cf, "data_pending");
-  return cf_hc_baller_data_pending(&ctx->h3_baller, data)
-         || cf_hc_baller_data_pending(&ctx->h21_baller, data);
+  for(i = 0; i < ctx->baller_count; i++)
+    if(cf_hc_baller_data_pending(&ctx->ballers[i], data))
+      return TRUE;
+  return FALSE;
 }
 
 static struct curltime cf_get_max_baller_time(struct Curl_cfilter *cf,
@@ -381,21 +663,17 @@ static struct curltime cf_get_max_baller_time(struct Curl_cfilter *cf,
                                               int query)
 {
   struct cf_hc_ctx *ctx = cf->ctx;
-  struct Curl_cfilter *cfb;
   struct curltime t, tmax;
+  size_t i;
 
   memset(&tmax, 0, sizeof(tmax));
-  memset(&t, 0, sizeof(t));
-  cfb = ctx->h21_baller.enabled? ctx->h21_baller.cf : NULL;
-  if(cfb && !cfb->cft->query(cfb, data, query, NULL, &t)) {
-    if((t.tv_sec || t.tv_usec) && Curl_timediff_us(t, tmax) > 0)
-      tmax = t;
-  }
-  memset(&t, 0, sizeof(t));
-  cfb = ctx->h3_baller.enabled? ctx->h3_baller.cf : NULL;
-  if(cfb && !cfb->cft->query(cfb, data, query, NULL, &t)) {
-    if((t.tv_sec || t.tv_usec) && Curl_timediff_us(t, tmax) > 0)
-      tmax = t;
+  for(i = 0; i < ctx->baller_count; i++) {
+    struct Curl_cfilter *cfb = ctx->ballers[i].cf;
+    memset(&t, 0, sizeof(t));
+    if(cfb && !cfb->cft->query(cfb, data, query, NULL, &t)) {
+      if((t.tv_sec || t.tv_usec) && curlx_ptimediff_us(&t, &tmax) > 0)
+        tmax = t;
+    }
   }
   return tmax;
 }
@@ -404,6 +682,9 @@ static CURLcode cf_hc_query(struct Curl_cfilter *cf,
                             struct Curl_easy *data,
                             int query, int *pres1, void *pres2)
 {
+  struct cf_hc_ctx *ctx = cf->ctx;
+  size_t i;
+
   if(!cf->connected) {
     switch(query) {
     case CF_QUERY_TIMER_CONNECT: {
@@ -416,50 +697,63 @@ static CURLcode cf_hc_query(struct Curl_cfilter *cf,
       *when = cf_get_max_baller_time(cf, data, CF_QUERY_TIMER_APPCONNECT);
       return CURLE_OK;
     }
+    case CF_QUERY_NEED_FLUSH: {
+      for(i = 0; i < ctx->baller_count; i++)
+        if(cf_hc_baller_needs_flush(&ctx->ballers[i], data)) {
+          *pres1 = TRUE;
+          return CURLE_OK;
+        }
+      break;
+    }
     default:
       break;
     }
   }
-  return cf->next?
+  return cf->next ?
     cf->next->cft->query(cf->next, data, query, pres1, pres2) :
     CURLE_UNKNOWN_OPTION;
 }
 
-static void cf_hc_close(struct Curl_cfilter *cf, struct Curl_easy *data)
+static CURLcode cf_hc_cntrl(struct Curl_cfilter *cf,
+                            struct Curl_easy *data,
+                            int event, int arg1, void *arg2)
 {
-  CURL_TRC_CF(data, cf, "close");
-  cf_hc_reset(cf, data);
-  cf->connected = FALSE;
+  struct cf_hc_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+  size_t i;
 
-  if(cf->next) {
-    cf->next->cft->do_close(cf->next, data);
-    Curl_conn_cf_discard_chain(&cf->next, data);
+  if(!cf->connected) {
+    for(i = 0; i < ctx->baller_count; i++) {
+      result = cf_hc_baller_cntrl(&ctx->ballers[i], data, event, arg1, arg2);
+      if(result && (result != CURLE_AGAIN))
+        goto out;
+    }
+    result = CURLE_OK;
   }
+out:
+  return result;
 }
 
 static void cf_hc_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
 {
   struct cf_hc_ctx *ctx = cf->ctx;
 
-  (void)data;
   CURL_TRC_CF(data, cf, "destroy");
-  cf_hc_reset(cf, data);
-  Curl_safefree(ctx);
+  cf_hc_ctx_destroy(data, ctx);
 }
 
 struct Curl_cftype Curl_cft_http_connect = {
   "HTTPS-CONNECT",
-  0,
+  CF_TYPE_SETUP | CF_TYPE_HTTPSRR,
   CURL_LOG_LVL_NONE,
   cf_hc_destroy,
   cf_hc_connect,
-  cf_hc_close,
-  Curl_cf_def_get_host,
-  cf_hc_get_select_socks,
+  cf_hc_shutdown,
+  cf_hc_adjust_pollset,
   cf_hc_data_pending,
   Curl_cf_def_send,
   Curl_cf_def_recv,
-  Curl_cf_def_cntrl,
+  cf_hc_cntrl,
   Curl_cf_def_conn_is_alive,
   Curl_cf_def_conn_keep_alive,
   cf_hc_query,
@@ -467,46 +761,42 @@ struct Curl_cftype Curl_cft_http_connect = {
 
 static CURLcode cf_hc_create(struct Curl_cfilter **pcf,
                              struct Curl_easy *data,
-                             const struct Curl_dns_entry *remotehost,
-                             bool try_h3, bool try_h21)
+                             uint8_t def_transport)
 {
   struct Curl_cfilter *cf = NULL;
   struct cf_hc_ctx *ctx;
   CURLcode result = CURLE_OK;
 
-  (void)data;
-  ctx = calloc(sizeof(*ctx), 1);
+  ctx = curlx_calloc(1, sizeof(*ctx));
   if(!ctx) {
     result = CURLE_OUT_OF_MEMORY;
     goto out;
   }
-  ctx->remotehost = remotehost;
-  ctx->h3_baller.enabled = try_h3;
-  ctx->h21_baller.enabled = try_h21;
+  ctx->def_transport = def_transport;
+  ctx->hard_eyeballs_timeout_ms = data->set.happy_eyeballs_timeout;
+  ctx->soft_eyeballs_timeout_ms = data->set.happy_eyeballs_timeout / 2;
 
   result = Curl_cf_create(&cf, &Curl_cft_http_connect, ctx);
   if(result)
     goto out;
   ctx = NULL;
-  cf_hc_reset(cf, data);
 
 out:
-  *pcf = result? NULL : cf;
-  free(ctx);
+  *pcf = result ? NULL : cf;
+  cf_hc_ctx_destroy(data, ctx);
   return result;
 }
 
-static CURLcode cf_http_connect_add(struct Curl_easy *data,
-                                    struct connectdata *conn,
-                                    int sockindex,
-                                    const struct Curl_dns_entry *remotehost,
-                                    bool try_h3, bool try_h21)
+static CURLcode cf_hc_add(struct Curl_easy *data,
+                          struct connectdata *conn,
+                          int sockindex,
+                          uint8_t def_transport)
 {
   struct Curl_cfilter *cf;
   CURLcode result = CURLE_OK;
 
   DEBUGASSERT(data);
-  result = cf_hc_create(&cf, data, remotehost, try_h3, try_h21);
+  result = cf_hc_create(&cf, data, def_transport);
   if(result)
     goto out;
   Curl_conn_cf_add(data, conn, sockindex, cf);
@@ -516,36 +806,25 @@ out:
 
 CURLcode Curl_cf_https_setup(struct Curl_easy *data,
                              struct connectdata *conn,
-                             int sockindex,
-                             const struct Curl_dns_entry *remotehost)
+                             int sockindex)
 {
-  bool try_h3 = FALSE, try_h21 = TRUE; /* defaults, for now */
   CURLcode result = CURLE_OK;
 
-  (void)sockindex;
-  (void)remotehost;
+  DEBUGASSERT(conn->scheme->protocol == CURLPROTO_HTTPS);
 
-  if(!conn->bits.tls_enable_alpn)
+  /* This filter is intended for HTTPS using ALPN and does
+   * not support HTTPS Eyeballing to a proxy. */
+  if((conn->scheme->protocol != CURLPROTO_HTTPS) ||
+#ifndef CURL_DISABLE_PROXY
+     conn->bits.origin_is_proxy ||
+#endif
+     !conn->bits.tls_enable_alpn)
     goto out;
 
-  if(data->state.httpwant == CURL_HTTP_VERSION_3ONLY) {
-    result = Curl_conn_may_http3(data, conn);
-    if(result) /* can't do it */
-      goto out;
-    try_h3 = TRUE;
-    try_h21 = FALSE;
-  }
-  else if(data->state.httpwant >= CURL_HTTP_VERSION_3) {
-    /* We assume that silently not even trying H3 is ok here */
-    /* TODO: should we fail instead? */
-    try_h3 = (Curl_conn_may_http3(data, conn) == CURLE_OK);
-    try_h21 = TRUE;
-  }
+  result = cf_hc_add(data, conn, sockindex, conn->transport_wanted);
 
-  result = cf_http_connect_add(data, conn, sockindex, remotehost,
-                               try_h3, try_h21);
 out:
   return result;
 }
 
-#endif /* !defined(CURL_DISABLE_HTTP) && !defined(USE_HYPER) */
+#endif /* !CURL_DISABLE_HTTP */
diff --git a/third-party/curl/lib/cf-https-connect.h b/third-party/curl/lib/cf-https-connect.h
index 6a39527317..3160c0382a 100644
--- a/third-party/curl/lib/cf-https-connect.h
+++ b/third-party/curl/lib/cf-https-connect.h
@@ -25,34 +25,18 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
-#if !defined(CURL_DISABLE_HTTP) && !defined(USE_HYPER)
+#ifndef CURL_DISABLE_HTTP
 
 struct Curl_cfilter;
 struct Curl_easy;
 struct connectdata;
 struct Curl_cftype;
-struct Curl_dns_entry;
 
 extern struct Curl_cftype Curl_cft_http_connect;
 
-CURLcode Curl_cf_http_connect_add(struct Curl_easy *data,
-                                  struct connectdata *conn,
-                                  int sockindex,
-                                  const struct Curl_dns_entry *remotehost,
-                                  bool try_h3, bool try_h21);
-
-CURLcode
-Curl_cf_http_connect_insert_after(struct Curl_cfilter *cf_at,
-                                  struct Curl_easy *data,
-                                  const struct Curl_dns_entry *remotehost,
-                                  bool try_h3, bool try_h21);
-
-
 CURLcode Curl_cf_https_setup(struct Curl_easy *data,
                              struct connectdata *conn,
-                             int sockindex,
-                             const struct Curl_dns_entry *remotehost);
+                             int sockindex);
 
-
-#endif /* !defined(CURL_DISABLE_HTTP) && !defined(USE_HYPER) */
+#endif /* !CURL_DISABLE_HTTP */
 #endif /* HEADER_CURL_CF_HTTP_H */
diff --git a/third-party/curl/lib/cf-ip-happy.c b/third-party/curl/lib/cf-ip-happy.c
new file mode 100644
index 0000000000..963ccea94d
--- /dev/null
+++ b/third-party/curl/lib/cf-ip-happy.c
@@ -0,0 +1,1054 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h> /* <netinet/tcp.h> may need it */
+#endif
+#ifdef HAVE_LINUX_TCP_H
+#include <linux/tcp.h>
+#elif defined(HAVE_NETINET_TCP_H)
+#include <netinet/tcp.h>
+#endif
+#ifdef HAVE_SYS_IOCTL_H
+#include <sys/ioctl.h>
+#endif
+#ifdef HAVE_NETDB_H
+#include <netdb.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+
+#ifdef __VMS
+#include <in.h>
+#include <inet.h>
+#endif
+
+#include "urldata.h"
+#include "connect.h"
+#include "cfilters.h"
+#include "cf-dns.h"
+#include "cf-ip-happy.h"
+#include "curl_addrinfo.h"
+#include "curl_trc.h"
+#include "multiif.h"
+#include "progress.h"
+#include "select.h"
+#include "sockaddr.h"
+#include "vquic/vquic.h" /* for quic cfilters */
+
+
+struct transport_provider {
+  cf_ip_connect_create *cf_create;
+  uint8_t transport;
+  bool tunnel;
+};
+
+static
+#ifndef UNITTESTS
+const
+#endif
+struct transport_provider transport_providers[] = {
+  { Curl_cf_tcp_create, TRNSPRT_TCP, FALSE },
+  { Curl_cf_tcp_create, TRNSPRT_TCP, TRUE },
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_HTTP3)
+  { Curl_cf_quic_create, TRNSPRT_QUIC, FALSE },
+#endif
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_PROXY_HTTP3)
+  { Curl_cf_h3_proxy_create, TRNSPRT_QUIC, TRUE },
+#endif
+#ifndef CURL_DISABLE_TFTP
+  { Curl_cf_udp_create, TRNSPRT_UDP, FALSE },
+#endif
+#ifdef USE_UNIX_SOCKETS
+  { Curl_cf_unix_create, TRNSPRT_UNIX, FALSE },
+  { Curl_cf_unix_create, TRNSPRT_UNIX, TRUE },
+#endif
+};
+
+static cf_ip_connect_create *get_cf_create(uint8_t transport,
+                                           bool tunnel)
+{
+  size_t i;
+  for(i = 0; i < CURL_ARRAYSIZE(transport_providers); ++i) {
+    if((transport == transport_providers[i].transport) &&
+       (tunnel == transport_providers[i].tunnel))
+      return transport_providers[i].cf_create;
+  }
+  return NULL;
+}
+
+#ifdef UNITTESTS
+/* @unittest 2600 */
+UNITTEST void debug_set_transport_provider(
+  uint8_t transport, cf_ip_connect_create *cf_create);
+UNITTEST void debug_set_transport_provider(
+  uint8_t transport, cf_ip_connect_create *cf_create)
+{
+  size_t i;
+  for(i = 0; i < CURL_ARRAYSIZE(transport_providers); ++i) {
+    if(transport == transport_providers[i].transport) {
+      transport_providers[i].cf_create = cf_create;
+    }
+  }
+}
+#endif /* UNITTESTS */
+
+struct cf_ai_iter {
+  struct Curl_cfilter *cf;
+  struct Curl_peer *peer;
+  int ai_family;
+  unsigned int n;
+};
+
+static void cf_ai_iter_init(struct cf_ai_iter *iter,
+                            struct Curl_cfilter *cf,
+                            struct Curl_peer *peer,
+                            int ai_family)
+{
+  iter->cf = cf;
+  iter->peer = peer; /* not linked, ctx->ballers owns and has same lifetime */
+  iter->ai_family = ai_family;
+  iter->n = 0;
+}
+
+static const struct Curl_addrinfo *cf_ai_iter_next(struct cf_ai_iter *iter,
+                                                   struct Curl_easy *data)
+{
+  const struct Curl_addrinfo *addr;
+
+  if(!iter->cf)
+    return NULL;
+
+  addr = Curl_conn_dns_get_ai(data, iter->peer, iter->cf->sockindex,
+                              iter->ai_family, iter->n);
+  if(addr)
+    iter->n++;
+  return addr;
+}
+
+static bool cf_ai_iter_has_more(struct cf_ai_iter *iter,
+                                struct Curl_easy *data)
+{
+  return (iter->cf &&
+          !!Curl_conn_dns_get_ai(data, iter->peer, iter->cf->sockindex,
+                                 iter->ai_family, iter->n));
+}
+
+struct cf_ip_attempt {
+  struct cf_ip_attempt *next;
+  struct Curl_peer *origin;
+  struct Curl_peer *peer;
+  struct Curl_peer *tunnel_peer;
+  struct Curl_sockaddr_ex addr;
+  struct Curl_cfilter *cf;           /* current sub-cfilter connecting */
+  cf_ip_connect_create *cf_create;
+  struct curltime started;           /* start of current attempt */
+  CURLcode result;
+  int ai_family;
+  uint8_t transport_peer;
+  uint8_t tunnel_transport;
+  int error;
+  BIT(connected);                    /* cf has connected */
+  BIT(shutdown);                     /* cf has shutdown */
+  BIT(inconclusive);                 /* connect was not a hard failure, we
+                                      * might talk to a restarting server */
+};
+
+static void cf_ip_attempt_free(struct cf_ip_attempt *a,
+                               struct Curl_easy *data)
+{
+  if(a) {
+    if(a->cf)
+      Curl_conn_cf_discard_chain(&a->cf, data);
+    Curl_peer_unlink(&a->origin);
+    Curl_peer_unlink(&a->peer);
+    Curl_peer_unlink(&a->tunnel_peer);
+    curlx_free(a);
+  }
+}
+
+static CURLcode cf_ip_attempt_new(struct cf_ip_attempt **pa,
+                                  struct Curl_easy *data,
+                                  struct Curl_cfilter *cf,
+                                  struct Curl_peer *origin,
+                                  struct Curl_peer *peer,
+                                  uint8_t transport_peer,
+                                  struct Curl_sockaddr_ex *addr,
+                                  int ai_family,
+                                  struct Curl_peer *tunnel_peer,
+                                  uint8_t tunnel_transport,
+                                  cf_ip_connect_create *cf_create)
+{
+  struct Curl_cfilter *wcf;
+  struct cf_ip_attempt *a;
+  CURLcode result = CURLE_OK;
+
+  *pa = NULL;
+  a = curlx_calloc(1, sizeof(*a));
+  if(!a)
+    return CURLE_OUT_OF_MEMORY;
+
+  Curl_peer_link(&a->origin, origin);
+  Curl_peer_link(&a->peer, peer);
+  a->transport_peer = transport_peer;
+  Curl_peer_link(&a->tunnel_peer, tunnel_peer);
+  a->tunnel_transport = tunnel_transport;
+  a->addr = *addr;
+  a->ai_family = ai_family;
+  a->result = CURLE_OK;
+  a->cf_create = cf_create;
+  *pa = a;
+
+  result = a->cf_create(&a->cf, data, a->origin, a->peer, a->transport_peer,
+                        cf->conn, &a->addr, a->tunnel_peer,
+                        a->tunnel_transport);
+  if(result)
+    goto out;
+
+  /* the new filter might have sub-filters */
+  for(wcf = a->cf; wcf; wcf = wcf->next) {
+    wcf->conn = cf->conn;
+    wcf->sockindex = cf->sockindex;
+  }
+
+out:
+  if(result) {
+    cf_ip_attempt_free(a, data);
+    *pa = NULL;
+  }
+  return result;
+}
+
+static CURLcode cf_ip_attempt_connect(struct cf_ip_attempt *a,
+                                      struct Curl_easy *data,
+                                      bool *connected)
+{
+  *connected = (bool)a->connected;
+  if(!a->result && !*connected) {
+    /* evaluate again */
+    a->result = Curl_conn_cf_connect(a->cf, data, connected);
+
+    if(!a->result) {
+      if(*connected) {
+        a->connected = TRUE;
+      }
+    }
+    else {
+      if(a->result == CURLE_WEIRD_SERVER_REPLY)
+        a->inconclusive = TRUE;
+      if(a->cf)
+        Curl_conn_cf_discard_chain(&a->cf, data);
+    }
+  }
+  return a->result;
+}
+
+struct cf_ip_ballers {
+  struct cf_ip_attempt *running;
+  struct cf_ip_attempt *winner;
+  struct cf_ai_iter addr_iter;
+#ifdef USE_IPV6
+  struct cf_ai_iter ipv6_iter;
+#endif
+  struct Curl_peer *origin;
+  struct Curl_peer *peer;
+  struct Curl_peer *tunnel_peer;
+  cf_ip_connect_create *cf_create;   /* for creating cf */
+  struct curltime started;
+  struct curltime last_attempt_started;
+  timediff_t attempt_delay_ms;
+  int last_attempt_ai_family;
+  uint32_t max_concurrent;
+  uint8_t transport_peer;
+  uint8_t tunnel_transport;
+};
+
+static CURLcode cf_ip_attempt_restart(struct cf_ip_attempt *a,
+                                      struct Curl_cfilter *cf,
+                                      struct Curl_easy *data)
+{
+  struct Curl_cfilter *wcf;
+  CURLcode result;
+
+  if(a->cf)
+    Curl_conn_cf_discard_chain(&a->cf, data);
+
+  a->result = CURLE_OK;
+  a->connected = FALSE;
+  a->inconclusive = FALSE;
+  a->cf = NULL;
+
+  result = a->cf_create(&a->cf, data, a->origin, a->peer, a->transport_peer,
+                        cf->conn, &a->addr,
+                        a->tunnel_peer, a->tunnel_transport);
+  if(!result) {
+    bool dummy;
+    /* the new filter might have sub-filters */
+    for(wcf = a->cf; wcf; wcf = wcf->next) {
+      wcf->conn = cf->conn;
+      wcf->sockindex = cf->sockindex;
+    }
+    a->result = cf_ip_attempt_connect(a, data, &dummy);
+  }
+  return result;
+}
+
+static void cf_ip_ballers_clear(struct Curl_easy *data,
+                                struct cf_ip_ballers *bs)
+{
+  while(bs->running) {
+    struct cf_ip_attempt *a = bs->running;
+    bs->running = a->next;
+    cf_ip_attempt_free(a, data);
+  }
+  cf_ip_attempt_free(bs->winner, data);
+  bs->winner = NULL;
+  Curl_peer_unlink(&bs->origin);
+  Curl_peer_unlink(&bs->peer);
+  Curl_peer_unlink(&bs->tunnel_peer);
+}
+
+static CURLcode cf_ip_ballers_init(struct cf_ip_ballers *bs,
+                                   struct Curl_easy *data,
+                                   struct Curl_peer *origin,
+                                   struct Curl_peer *peer,
+                                   uint8_t transport_peer,
+                                   struct Curl_peer *tunnel_peer,
+                                   uint8_t tunnel_transport,
+                                   timediff_t attempt_delay_ms,
+                                   uint32_t max_concurrent)
+{
+  memset(bs, 0, sizeof(*bs));
+  bs->cf_create = get_cf_create(transport_peer, !!tunnel_peer);
+  if(!bs->cf_create) {
+    failf(data, "unsupported transport type %u%s",
+          transport_peer, tunnel_peer ? " to proxy" : "");
+    return CURLE_UNSUPPORTED_PROTOCOL;
+  }
+  Curl_peer_link(&bs->origin, origin);
+  Curl_peer_link(&bs->peer, peer);
+  bs->transport_peer = transport_peer;
+  Curl_peer_link(&bs->tunnel_peer, tunnel_peer);
+  bs->tunnel_transport = tunnel_transport;
+  bs->attempt_delay_ms = attempt_delay_ms;
+  bs->max_concurrent = max_concurrent;
+  bs->last_attempt_ai_family = AF_INET; /* so AF_INET6 is next */
+  return CURLE_OK;
+}
+
+static void cf_ip_ballers_prune(struct cf_ip_ballers *bs,
+                                struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                uint32_t max_concurrent)
+{
+  struct cf_ip_attempt *a = NULL, **panchor;
+  uint32_t ongoing = 0;
+
+  for(a = bs->running; a; a = a->next) {
+    if(!a->result && !a->connected)
+      ++ongoing;
+  }
+
+  panchor = &bs->running;
+  while(*panchor && (ongoing > max_concurrent)) {
+    a = *panchor;
+    if(!a->result && !a->connected) {
+      *panchor = a->next;
+      a->next = NULL;
+      cf_ip_attempt_free(a, data);
+      --ongoing;
+      CURL_TRC_CF(data, cf, "discarding oldest attempt to keep limit");
+    }
+    else {
+      panchor = &a->next;
+    }
+  }
+}
+
+static CURLcode cf_ip_ballers_run(struct cf_ip_ballers *bs,
+                                  struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  bool dns_resolved,
+                                  bool *connected)
+{
+  CURLcode result = CURLE_OK;
+  struct cf_ip_attempt *a = NULL, **panchor;
+  bool do_more;
+  timediff_t next_expire_ms;
+  uint32_t inconclusive, ongoing;
+  VERBOSE(int i);
+
+  if(bs->winner)
+    return CURLE_OK;
+
+evaluate:
+  ongoing = inconclusive = 0;
+
+  /* check if a running baller connects now */
+  VERBOSE(i = -1);
+  for(panchor = &bs->running; *panchor; panchor = &((*panchor)->next)) {
+    VERBOSE(++i);
+    a = *panchor;
+    a->result = cf_ip_attempt_connect(a, data, connected);
+    if(!a->result) {
+      if(*connected) {
+        /* connected, declare the winner, remove from running,
+         * clear remaining running list. */
+        CURL_TRC_CF(data, cf, "connect attempt #%d successful", i);
+        bs->winner = a;
+        *panchor = a->next;
+        a->next = NULL;
+        while(bs->running) {
+          a = bs->running;
+          bs->running = a->next;
+          cf_ip_attempt_free(a, data);
+        }
+        return CURLE_OK;
+      }
+      /* still running */
+      ++ongoing;
+    }
+    else if(a->inconclusive) /* failed, but inconclusive */
+      ++inconclusive;
+  }
+  if(bs->running)
+    CURL_TRC_CF(data, cf, "checked connect attempts: "
+                "%u ongoing, %u inconclusive", ongoing, inconclusive);
+
+  /* no attempt connected yet, start another one? */
+  if(!ongoing) {
+    if(!bs->started.tv_sec && !bs->started.tv_usec)
+      bs->started = *Curl_pgrs_now(data);
+    do_more = TRUE;
+  }
+  else {
+    bool more_possible = cf_ai_iter_has_more(&bs->addr_iter, data);
+#ifdef USE_IPV6
+    if(!more_possible)
+      more_possible = cf_ai_iter_has_more(&bs->ipv6_iter, data);
+#endif
+    do_more = more_possible &&
+      (curlx_ptimediff_ms(Curl_pgrs_now(data), &bs->last_attempt_started) >=
+       bs->attempt_delay_ms);
+    if(do_more)
+      CURL_TRC_CF(data, cf, "happy eyeballs timeout expired, "
+                  "start next attempt");
+  }
+
+  if(do_more) {
+    /* start the next attempt if there is another ip address to try.
+     * Alternate between address families when possible. */
+    const struct Curl_addrinfo *ai = NULL;
+    int ai_family = 0;
+    CURL_TRC_CF(data, cf, "want to do more");
+#ifdef USE_IPV6
+    if((bs->last_attempt_ai_family == AF_INET) ||
+       !cf_ai_iter_has_more(&bs->addr_iter, data)) {
+      ai = cf_ai_iter_next(&bs->ipv6_iter, data);
+      ai_family = bs->ipv6_iter.ai_family;
+      CURL_TRC_CF(data, cf, "check for next AAAA address: %s",
+                  ai ? "found" : "none");
+    }
+#endif
+    if(!ai) {
+      ai = cf_ai_iter_next(&bs->addr_iter, data);
+      ai_family = bs->addr_iter.ai_family;
+      CURL_TRC_CF(data, cf, "check for next A address: %s",
+                  ai ? "found" : "none");
+    }
+    /* We are (re-)starting attempts. We are not interested in
+     * keeping old failure information. The new attempt will either
+     * succeed or persist new failure. */
+    Curl_reset_fail(data);
+
+    if(ai) {  /* try another address */
+      struct Curl_sockaddr_ex addr;
+
+      /* Discard oldest to make room for new attempt */
+      if(bs->max_concurrent)
+        cf_ip_ballers_prune(bs, cf, data, bs->max_concurrent - 1);
+
+      result = Curl_socket_addr_from_ai(&addr, ai, bs->transport_peer);
+      if(result)
+        goto out;
+
+      result = cf_ip_attempt_new(&a, data, cf, bs->origin, bs->peer,
+                                 bs->transport_peer, &addr, ai_family,
+                                 bs->tunnel_peer, bs->tunnel_transport,
+                                 bs->cf_create);
+      CURL_TRC_CF(data, cf, "starting %s attempt for ipv%s -> %d",
+                  bs->running ? "next" : "first",
+                  (ai_family == AF_INET) ? "4" : "6", (int)result);
+      if(result)
+        goto out;
+      DEBUGASSERT(a);
+
+      /* append to running list */
+      panchor = &bs->running;
+      while(*panchor)
+        panchor = &((*panchor)->next);
+      *panchor = a;
+      bs->last_attempt_started = *Curl_pgrs_now(data);
+      bs->last_attempt_ai_family = ai_family;
+      /* and run everything again */
+      goto evaluate;
+    }
+    else if(inconclusive) {
+      /* tried all addresses, no success but some where inconclusive.
+       * Let's restart the inconclusive ones. */
+      timediff_t since_ms =
+        curlx_ptimediff_ms(Curl_pgrs_now(data), &bs->last_attempt_started);
+      timediff_t delay_ms = bs->attempt_delay_ms - since_ms;
+      if(delay_ms <= 0) {
+        CURL_TRC_CF(data, cf, "all attempts inconclusive, restarting one");
+        VERBOSE(i = -1);
+        for(a = bs->running; a; a = a->next) {
+          VERBOSE(++i);
+          if(!a->inconclusive)
+            continue;
+          result = cf_ip_attempt_restart(a, cf, data);
+          CURL_TRC_CF(data, cf, "restarted baller %d -> %d", i, (int)result);
+          if(result) /* serious failure */
+            goto out;
+          bs->last_attempt_started = *Curl_pgrs_now(data);
+          goto evaluate;
+        }
+        DEBUGASSERT(0); /* should not come here */
+      }
+      else {
+        /* let's wait some more before restarting */
+        infof(data, "connect attempts inconclusive, retrying "
+                    "in %" FMT_TIMEDIFF_T "ms", delay_ms);
+        Curl_expire(data, delay_ms, EXPIRE_HAPPY_EYEBALLS);
+      }
+      /* attempt timeout for restart has not expired yet */
+      goto out;
+    }
+    else if(!ongoing && dns_resolved) {
+      /* no more addresses, no inconclusive attempts */
+      CURL_TRC_CF(data, cf, "no more attempts to try");
+      result = CURLE_COULDNT_CONNECT;
+      VERBOSE(i = 0);
+      for(a = bs->running; a; a = a->next) {
+        CURL_TRC_CF(data, cf, "baller %d: result=%d", i, (int)a->result);
+        if(a->result)
+          result = a->result;
+      }
+    }
+  }
+
+out:
+  if(!result) {
+    bool more_possible;
+
+    /* when do we need to be called again? */
+    next_expire_ms = Curl_timeleft_ms(data);
+    if(next_expire_ms < 0) {
+      failf(data, "Connection timeout after %" FMT_OFF_T " ms",
+            curlx_ptimediff_ms(Curl_pgrs_now(data),
+                               &data->progress.t_startsingle));
+      return CURLE_OPERATION_TIMEDOUT;
+    }
+
+    more_possible = cf_ai_iter_has_more(&bs->addr_iter, data);
+#ifdef USE_IPV6
+    if(!more_possible)
+      more_possible = cf_ai_iter_has_more(&bs->ipv6_iter, data);
+#endif
+    if(more_possible) {
+      timediff_t expire_ms, elapsed_ms;
+      elapsed_ms =
+        curlx_ptimediff_ms(Curl_pgrs_now(data), &bs->last_attempt_started);
+      expire_ms = CURLMAX(bs->attempt_delay_ms - elapsed_ms, 0);
+      next_expire_ms = CURLMIN(next_expire_ms, expire_ms);
+      if(next_expire_ms <= 0) {
+        CURL_TRC_CF(data, cf, "HAPPY_EYEBALLS timeout due, re-evaluate");
+        goto evaluate;
+      }
+      CURL_TRC_CF(data, cf, "next HAPPY_EYEBALLS timeout in %" FMT_TIMEDIFF_T
+                  "ms", next_expire_ms);
+      Curl_expire(data, next_expire_ms, EXPIRE_HAPPY_EYEBALLS);
+    }
+  }
+  return result;
+}
+
+static CURLcode cf_ip_ballers_shutdown(struct cf_ip_ballers *bs,
+                                       struct Curl_easy *data,
+                                       bool *done)
+{
+  struct cf_ip_attempt *a;
+
+  /* shutdown all ballers that have not done so already. If one fails,
+   * continue shutting down others until all are shutdown. */
+  *done = TRUE;
+  for(a = bs->running; a; a = a->next) {
+    bool bdone = FALSE;
+    if(a->shutdown || !a->cf)
+      continue;
+    a->result = a->cf->cft->do_shutdown(a->cf, data, &bdone);
+    if(a->result || bdone)
+      a->shutdown = TRUE; /* treat a failed shutdown as done */
+    else
+      *done = FALSE;
+  }
+  return CURLE_OK;
+}
+
+static CURLcode cf_ip_ballers_pollset(struct cf_ip_ballers *bs,
+                                      struct Curl_easy *data,
+                                      struct easy_pollset *ps)
+{
+  struct cf_ip_attempt *a;
+  CURLcode result = CURLE_OK;
+  for(a = bs->running; a && !result; a = a->next) {
+    if(a->result)
+      continue;
+    result = Curl_conn_cf_adjust_pollset(a->cf, data, ps);
+  }
+  return result;
+}
+
+static bool cf_ip_ballers_pending(struct cf_ip_ballers *bs,
+                                  const struct Curl_easy *data)
+{
+  struct cf_ip_attempt *a;
+
+  for(a = bs->running; a; a = a->next) {
+    if(a->result)
+      continue;
+    if(a->cf && a->cf->cft->has_data_pending(a->cf, data))
+      return TRUE;
+  }
+  return FALSE;
+}
+
+static struct curltime cf_ip_ballers_max_time(struct cf_ip_ballers *bs,
+                                              struct Curl_easy *data,
+                                              int query)
+{
+  struct curltime t, tmax;
+  struct cf_ip_attempt *a;
+
+  memset(&tmax, 0, sizeof(tmax));
+  for(a = bs->running; a; a = a->next) {
+    memset(&t, 0, sizeof(t));
+    if(a->cf && !a->cf->cft->query(a->cf, data, query, NULL, &t)) {
+      if((t.tv_sec || t.tv_usec) && curlx_ptimediff_us(&t, &tmax) > 0)
+        tmax = t;
+    }
+  }
+  return tmax;
+}
+
+static int cf_ip_ballers_min_reply_ms(struct cf_ip_ballers *bs,
+                                      struct Curl_easy *data)
+{
+  int reply_ms = -1, breply_ms;
+  struct cf_ip_attempt *a;
+
+  for(a = bs->running; a; a = a->next) {
+    if(a->cf && !a->cf->cft->query(a->cf, data, CF_QUERY_CONNECT_REPLY_MS,
+                                   &breply_ms, NULL)) {
+      if(breply_ms >= 0 && (reply_ms < 0 || breply_ms < reply_ms))
+        reply_ms = breply_ms;
+    }
+  }
+  return reply_ms;
+}
+
+typedef enum {
+  SCFST_INIT,
+  SCFST_WAITING,
+  SCFST_DONE
+} cf_connect_state;
+
+struct cf_ip_happy_ctx {
+  cf_ip_connect_create *cf_create;
+  cf_connect_state state;
+  struct cf_ip_ballers ballers;
+  struct curltime started;
+  BIT(dns_resolved);
+};
+
+static CURLcode is_connected(struct Curl_cfilter *cf,
+                             struct Curl_easy *data,
+                             bool *connected)
+{
+  struct cf_ip_happy_ctx *ctx = cf->ctx;
+  struct connectdata *conn = cf->conn;
+  CURLcode result;
+
+  result = cf_ip_ballers_run(&ctx->ballers, cf, data,
+                             (bool)ctx->dns_resolved, connected);
+
+  if(!result)
+    return CURLE_OK;
+  else {
+    struct Curl_peer *peer = NULL, *proxy_peer = NULL;
+    char viamsg[160];
+
+    peer = Curl_conn_get_first_peer(conn, cf->sockindex);
+    if(!conn->origin || !peer)
+      return CURLE_FAILED_INIT;
+
+#ifndef CURL_DISABLE_PROXY
+    if(conn->socks_proxy.peer)
+      proxy_peer = conn->socks_proxy.peer;
+    else if(conn->http_proxy.peer)
+      proxy_peer = conn->http_proxy.peer;
+#endif
+
+    viamsg[0] = 0;
+    if(!Curl_peer_equal(peer, conn->origin) &&
+       !Curl_peer_equal(peer, proxy_peer)) {
+#ifdef USE_UNIX_SOCKETS
+      if(peer->unix_socket)
+        curl_msnprintf(viamsg, sizeof(viamsg), " over unix://%s",
+                       peer->hostname);
+      else
+#endif
+      curl_msnprintf(viamsg, sizeof(viamsg), " via %s:%u",
+                     peer->hostname, peer->port);
+    }
+
+    failf(data, "Failed to connect to %s:%u%s %s%s%safter "
+          "%" FMT_TIMEDIFF_T " ms: %s",
+          conn->origin->hostname, conn->origin->port, viamsg,
+          proxy_peer ? "over proxy " : "",
+          proxy_peer ? proxy_peer->hostname : "",
+          proxy_peer ? " " : "",
+          curlx_ptimediff_ms(Curl_pgrs_now(data),
+                             &data->progress.t_startsingle),
+          curl_easy_strerror(result));
+
+#ifdef SOCKETIMEDOUT
+    if(SOCKETIMEDOUT == data->state.os_errno)
+      result = CURLE_OPERATION_TIMEDOUT;
+#endif
+
+    return result;
+  }
+}
+
+#define IP_HE_MAX_CONCURRENT_ATTEMPTS     6
+
+static CURLcode cf_ip_happy_init(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data)
+{
+  struct cf_ip_happy_ctx *ctx = cf->ctx;
+
+  if(Curl_timeleft_ms(data) < 0) {
+    /* a precaution, no need to continue if time already is up */
+    failf(data, "Connection time-out");
+    return CURLE_OPERATION_TIMEDOUT;
+  }
+
+  if(ctx->ballers.transport_peer == TRNSPRT_UNIX) {
+#ifdef USE_UNIX_SOCKETS
+    cf_ai_iter_init(&ctx->ballers.addr_iter, cf, ctx->ballers.peer, AF_UNIX);
+#else
+    return CURLE_UNSUPPORTED_PROTOCOL;
+#endif
+  }
+  else { /* TCP/UDP/QUIC */
+#ifdef USE_IPV6
+    cf_ai_iter_init(&ctx->ballers.ipv6_iter, cf, ctx->ballers.peer, AF_INET6);
+#endif
+    cf_ai_iter_init(&ctx->ballers.addr_iter, cf, ctx->ballers.peer, AF_INET);
+  }
+
+  CURL_TRC_CF(data, cf, "init ip ballers for transport %u",
+              ctx->ballers.transport_peer);
+  ctx->started = *Curl_pgrs_now(data);
+  return CURLE_OK;
+}
+
+static void cf_ip_happy_ctx_clear(struct cf_ip_happy_ctx *ctx,
+                                  struct Curl_easy *data)
+{
+  DEBUGASSERT(ctx);
+  if(ctx)
+    cf_ip_ballers_clear(data, &ctx->ballers);
+}
+
+static void cf_ip_happy_ctx_destroy(struct cf_ip_happy_ctx *ctx,
+                                    struct Curl_easy *data)
+{
+  if(ctx) {
+    cf_ip_happy_ctx_clear(ctx, data);
+    curlx_free(ctx);
+  }
+}
+
+static CURLcode cf_ip_happy_shutdown(struct Curl_cfilter *cf,
+                                     struct Curl_easy *data,
+                                     bool *done)
+{
+  struct cf_ip_happy_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  DEBUGASSERT(data);
+  if(cf->connected) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  result = cf_ip_ballers_shutdown(&ctx->ballers, data, done);
+  CURL_TRC_CF(data, cf, "shutdown -> %d, done=%d", (int)result, *done);
+  return result;
+}
+
+static CURLcode cf_ip_happy_adjust_pollset(struct Curl_cfilter *cf,
+                                           struct Curl_easy *data,
+                                           struct easy_pollset *ps)
+{
+  struct cf_ip_happy_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  if(!cf->connected) {
+    result = cf_ip_ballers_pollset(&ctx->ballers, data, ps);
+    CURL_TRC_CF(data, cf, "adjust_pollset -> %d, %u socks", (int)result,
+                ps->n);
+  }
+  return result;
+}
+
+static CURLcode cf_ip_happy_connect(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    bool *done)
+{
+  struct cf_ip_happy_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  /* -Werror=null-dereference finds false positives suddenly. */
+  if(!data)
+    return CURLE_FAILED_INIT;
+
+  if(cf->connected) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  DEBUGASSERT(ctx);
+  *done = FALSE;
+
+  if(!ctx->dns_resolved) {
+    result = Curl_conn_dns_result(cf->conn, cf->sockindex, ctx->ballers.peer);
+    if(!result)
+      ctx->dns_resolved = TRUE;
+    else if(result == CURLE_AGAIN) {
+      result = CURLE_OK;
+    }
+    else /* real error */
+      goto out;
+  }
+
+  switch(ctx->state) {
+  case SCFST_INIT:
+    DEBUGASSERT(CURL_SOCKET_BAD == Curl_conn_cf_get_socket(cf, data));
+    DEBUGASSERT(!cf->connected);
+    result = cf_ip_happy_init(cf, data);
+    if(result)
+      goto out;
+    ctx->state = SCFST_WAITING;
+    FALLTHROUGH();
+  case SCFST_WAITING:
+    result = is_connected(cf, data, done);
+    if(!result && *done) {
+      DEBUGASSERT(ctx->ballers.winner);
+      DEBUGASSERT(ctx->ballers.winner->cf);
+      DEBUGASSERT(ctx->ballers.winner->cf->connected);
+      /* we have a winner. Install and activate it.
+       * close/free all others. */
+      ctx->state = SCFST_DONE;
+      cf->connected = TRUE;
+      cf->next = ctx->ballers.winner->cf;
+      ctx->ballers.winner->cf = NULL;
+      cf_ip_happy_ctx_clear(ctx, data);
+      Curl_expire_done(data, EXPIRE_HAPPY_EYEBALLS);
+      /* whatever errors were reported by ballers, clear our errorbuf */
+      Curl_reset_fail(data);
+
+      if(cf->conn->scheme->protocol & PROTO_FAMILY_SSH)
+        Curl_pgrsTime(data, TIMER_APPCONNECT); /* we are connected already */
+#ifdef CURLVERBOSE
+      if(Curl_trc_cf_is_verbose(cf, data)) {
+        struct ip_quadruple ipquad;
+        bool is_ipv6;
+        if(!Curl_conn_cf_get_ip_info(cf->next, data, &is_ipv6, &ipquad)) {
+          const char *host;
+          Curl_conn_get_current_host(data, cf->sockindex, &host, NULL);
+          CURL_TRC_CF(data, cf, "Connected to %s (%s) port %u",
+                      host, ipquad.remote_ip, ipquad.remote_port);
+        }
+      }
+#endif
+      data->info.numconnects++; /* to track the # of connections made */
+    }
+    break;
+  case SCFST_DONE:
+    *done = TRUE;
+    break;
+  }
+out:
+  return result;
+}
+
+static bool cf_ip_happy_data_pending(struct Curl_cfilter *cf,
+                                     const struct Curl_easy *data)
+{
+  struct cf_ip_happy_ctx *ctx = cf->ctx;
+
+  if(!cf->connected) {
+    return cf_ip_ballers_pending(&ctx->ballers, data);
+  }
+  return cf->next->cft->has_data_pending(cf->next, data);
+}
+
+static CURLcode cf_ip_happy_query(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  int query, int *pres1, void *pres2)
+{
+  struct cf_ip_happy_ctx *ctx = cf->ctx;
+
+  if(!cf->connected) {
+    switch(query) {
+    case CF_QUERY_CONNECT_REPLY_MS: {
+      *pres1 = cf_ip_ballers_min_reply_ms(&ctx->ballers, data);
+      CURL_TRC_CF(data, cf, "query connect reply: %dms", *pres1);
+      return CURLE_OK;
+    }
+    case CF_QUERY_TIMER_CONNECT: {
+      struct curltime *when = pres2;
+      *when = cf_ip_ballers_max_time(&ctx->ballers, data,
+                                     CF_QUERY_TIMER_CONNECT);
+      return CURLE_OK;
+    }
+    case CF_QUERY_TIMER_APPCONNECT: {
+      struct curltime *when = pres2;
+      *when = cf_ip_ballers_max_time(&ctx->ballers, data,
+                                     CF_QUERY_TIMER_APPCONNECT);
+      return CURLE_OK;
+    }
+    default:
+      break;
+    }
+  }
+
+  return cf->next ?
+    cf->next->cft->query(cf->next, data, query, pres1, pres2) :
+    CURLE_UNKNOWN_OPTION;
+}
+
+static void cf_ip_happy_destroy(struct Curl_cfilter *cf,
+                                struct Curl_easy *data)
+{
+  struct cf_ip_happy_ctx *ctx = cf->ctx;
+
+  CURL_TRC_CF(data, cf, "destroy");
+  if(ctx) {
+    cf_ip_happy_ctx_clear(ctx, data);
+    cf_ip_happy_ctx_destroy(ctx, data);
+  }
+}
+
+struct Curl_cftype Curl_cft_ip_happy = {
+  "HAPPY-EYEBALLS",
+  CF_TYPE_SETUP,
+  CURL_LOG_LVL_NONE,
+  cf_ip_happy_destroy,
+  cf_ip_happy_connect,
+  cf_ip_happy_shutdown,
+  cf_ip_happy_adjust_pollset,
+  cf_ip_happy_data_pending,
+  Curl_cf_def_send,
+  Curl_cf_def_recv,
+  Curl_cf_def_cntrl,
+  Curl_cf_def_conn_is_alive,
+  Curl_cf_def_conn_keep_alive,
+  cf_ip_happy_query,
+};
+
+static CURLcode cf_ip_happy_create(struct Curl_cfilter **pcf,
+                                   struct Curl_easy *data,
+                                   struct Curl_peer *origin,
+                                   struct Curl_peer *peer,
+                                   uint8_t transport_peer,
+                                   struct connectdata *conn,
+                                   struct Curl_peer *tunnel_peer,
+                                   uint8_t tunnel_transport)
+{
+  struct cf_ip_happy_ctx *ctx = NULL;
+  CURLcode result;
+
+  (void)data;
+  (void)conn;
+  *pcf = NULL;
+  ctx = curlx_calloc(1, sizeof(*ctx));
+  if(!ctx) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+  result = cf_ip_ballers_init(&ctx->ballers, data,
+                              origin, peer, transport_peer,
+                              tunnel_peer, tunnel_transport,
+                              data->set.happy_eyeballs_timeout,
+                              IP_HE_MAX_CONCURRENT_ATTEMPTS);
+  if(result)
+    goto out;
+
+  result = Curl_cf_create(pcf, &Curl_cft_ip_happy, ctx);
+
+out:
+  if(result) {
+    curlx_safefree(*pcf);
+    cf_ip_happy_ctx_destroy(ctx, data);
+  }
+  return result;
+}
+
+CURLcode cf_ip_happy_insert_after(struct Curl_cfilter *cf_at,
+                                  struct Curl_easy *data,
+                                  struct Curl_peer *origin,
+                                  struct Curl_peer *peer,
+                                  uint8_t transport_peer,
+                                  struct Curl_peer *tunnel_peer,
+                                  uint8_t tunnel_transport)
+{
+  struct Curl_cfilter *cf;
+  CURLcode result;
+
+  /* Need to be first */
+  DEBUGASSERT(cf_at);
+  result = cf_ip_happy_create(&cf, data, origin, peer, transport_peer,
+                              cf_at->conn, tunnel_peer, tunnel_transport);
+  if(result)
+    return result;
+
+  Curl_conn_cf_insert_after(cf_at, cf);
+  return CURLE_OK;
+}
diff --git a/third-party/curl/lib/cf-ip-happy.h b/third-party/curl/lib/cf-ip-happy.h
new file mode 100644
index 0000000000..dd9b29ac8f
--- /dev/null
+++ b/third-party/curl/lib/cf-ip-happy.h
@@ -0,0 +1,73 @@
+#ifndef HEADER_CURL_IP_HAPPY_H
+#define HEADER_CURL_IP_HAPPY_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+struct connectdata;
+struct Curl_addrinfo;
+struct Curl_cfilter;
+struct Curl_easy;
+struct Curl_peer;
+struct Curl_sockaddr_ex;
+
+/**
+ * Create a cfilter to connect to `origin` via an optional `peer`
+ * using `transport_peer` and `addr`.
+ * With a `tunnel_peer` present, the filter will be used to proxy tunnel
+ * to it and the tunnel will use `tunnel_transport`.
+ * `pcf`: the filter created on success
+ * `data`: the transfer initiating the connect
+ * `conn`: the connection that gets connected
+ *
+ * The filter is used in "happy eyeball" scenarios. Once connected,
+ * it MAY be installed in the connection filter chain to serve transfers.
+ */
+typedef CURLcode cf_ip_connect_create(struct Curl_cfilter **pcf,
+                                      struct Curl_easy *data,
+                                      struct Curl_peer *origin,
+                                      struct Curl_peer *peer,
+                                      uint8_t transport_peer,
+                                      struct connectdata *conn,
+                                      struct Curl_sockaddr_ex *addr,
+                                      struct Curl_peer *tunnel_peer,
+                                      uint8_t tunnel_transport);
+
+/**
+ * Create an IP happy eyeball connection filter that connects to `origin`
+ * via an optional `peer` using `transport_peer`.
+ * With a `tunnel_peer` present, the filter will be used to proxy tunnel
+ * to it and the tunnel will use `tunnel_transport`.
+ */
+CURLcode cf_ip_happy_insert_after(struct Curl_cfilter *cf_at,
+                                  struct Curl_easy *data,
+                                  struct Curl_peer *origin,
+                                  struct Curl_peer *peer,
+                                  uint8_t transport_peer,
+                                  struct Curl_peer *tunnel_peer,
+                                  uint8_t tunnel_transport);
+
+extern struct Curl_cftype Curl_cft_ip_happy;
+
+#endif /* HEADER_CURL_IP_HAPPY_H */
diff --git a/third-party/curl/lib/cf-recvbuf.c b/third-party/curl/lib/cf-recvbuf.c
new file mode 100644
index 0000000000..8ccc148bd3
--- /dev/null
+++ b/third-party/curl/lib/cf-recvbuf.c
@@ -0,0 +1,157 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifndef CURL_DISABLE_WEBSOCKETS
+/* only used for this protocol, so far */
+
+#include "urldata.h"
+#include "bufq.h"
+#include "cfilters.h"
+#include "cf-recvbuf.h"
+#include "curl_trc.h"
+
+#define CURL_CF_RECVBUF_CHUNK     (16 * 1024)
+
+struct cf_recvbuf_ctx {
+  struct bufq recvbuf;
+};
+
+static void cf_recvbuf_destroy(struct Curl_cfilter *cf,
+                               struct Curl_easy *data)
+{
+  struct cf_recvbuf_ctx *ctx = cf->ctx;
+  (void)data;
+  if(ctx) {
+    Curl_bufq_free(&ctx->recvbuf);
+    curlx_free(ctx);
+  }
+}
+
+static CURLcode cf_recvbuf_recv(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                char *buf, size_t len,
+                                size_t *pnread)
+{
+  struct cf_recvbuf_ctx *ctx = cf->ctx;
+
+  if(!Curl_bufq_is_empty(&ctx->recvbuf)) {
+    return Curl_bufq_cread(&ctx->recvbuf, buf, len, pnread);
+  }
+
+  if(cf->next)
+    return cf->next->cft->do_recv(cf->next, data, buf, len, pnread);
+  *pnread = 0;
+  return CURLE_RECV_ERROR;
+}
+
+static bool cf_recvbuf_data_pending(struct Curl_cfilter *cf,
+                                    const struct Curl_easy *data)
+{
+  struct cf_recvbuf_ctx *ctx = cf->ctx;
+
+  if(!Curl_bufq_is_empty(&ctx->recvbuf))
+    return TRUE;
+
+  return cf->next ?
+    cf->next->cft->has_data_pending(cf->next, data) : FALSE;
+}
+
+struct Curl_cftype Curl_cft_recvbuf = {
+  "RECVBUF",
+  0,
+  CURL_LOG_LVL_NONE,
+  cf_recvbuf_destroy,
+  Curl_cf_def_connect,
+  Curl_cf_def_shutdown,
+  Curl_cf_def_adjust_pollset,
+  cf_recvbuf_data_pending,
+  Curl_cf_def_send,
+  cf_recvbuf_recv,
+  Curl_cf_def_cntrl,
+  Curl_cf_def_conn_is_alive,
+  Curl_cf_def_conn_keep_alive,
+  Curl_cf_def_query,
+};
+
+static CURLcode cf_recvbuf_create(struct Curl_cfilter **pcf,
+                                  struct Curl_easy *data,
+                                  const uint8_t *buf, size_t blen)
+{
+  struct Curl_cfilter *cf = NULL;
+  struct cf_recvbuf_ctx *ctx;
+  CURLcode result = CURLE_OK;
+  size_t nwritten = 0;
+
+  (void)data;
+  ctx = curlx_calloc(1, sizeof(*ctx));
+  if(!ctx) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+  Curl_bufq_init2(&ctx->recvbuf, CURL_CF_RECVBUF_CHUNK,
+                  (blen / CURL_CF_RECVBUF_CHUNK) + 1,
+                  (BUFQ_OPT_SOFT_LIMIT | BUFQ_OPT_NO_SPARES));
+  result = Curl_bufq_write(&ctx->recvbuf, buf, blen, &nwritten);
+  if(result)
+    goto out;
+  if(nwritten != blen) {
+    result = CURLE_FAILED_INIT;
+    goto out;
+  }
+
+  result = Curl_cf_create(&cf, &Curl_cft_recvbuf, ctx);
+  if(result)
+    goto out;
+  ctx = NULL;
+
+out:
+  *pcf = result ? NULL : cf;
+  if(ctx) {
+    Curl_bufq_free(&ctx->recvbuf);
+    curlx_free(ctx);
+  }
+  return result;
+}
+
+CURLcode Curl_cf_recvbuf_add(struct Curl_easy *data,
+                             struct connectdata *conn,
+                             int sockindex,
+                             const uint8_t *buf, size_t blen)
+{
+  struct Curl_cfilter *cf;
+  CURLcode result = CURLE_OK;
+
+  DEBUGASSERT(data);
+  result = cf_recvbuf_create(&cf, data, buf, blen);
+  if(result)
+    goto out;
+
+  cf->connected = Curl_conn_is_connected(conn, sockindex);
+  Curl_conn_cf_add(data, conn, sockindex, cf);
+out:
+  return result;
+}
+
+#endif /* !CURL_DISABLE_WEBSOCKETS */
diff --git a/third-party/curl/lib/cf-recvbuf.h b/third-party/curl/lib/cf-recvbuf.h
new file mode 100644
index 0000000000..1b08fcc3be
--- /dev/null
+++ b/third-party/curl/lib/cf-recvbuf.h
@@ -0,0 +1,40 @@
+#ifndef HEADER_CURL_CF_RECVBUF_H
+#define HEADER_CURL_CF_RECVBUF_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifndef CURL_DISABLE_WEBSOCKETS
+/* only used for this protocol, so far */
+
+CURLcode Curl_cf_recvbuf_add(struct Curl_easy *data,
+                             struct connectdata *conn,
+                             int sockindex,
+                             const uint8_t *buf, size_t blen);
+
+extern struct Curl_cftype Curl_cft_recvbuf;
+
+#endif /* !CURL_DISABLE_WEBSOCKETS */
+
+#endif /* HEADER_CURL_CF_RECVBUF_H */
diff --git a/third-party/curl/lib/cf-setup.c b/third-party/curl/lib/cf-setup.c
new file mode 100644
index 0000000000..119294a89a
--- /dev/null
+++ b/third-party/curl/lib/cf-setup.c
@@ -0,0 +1,476 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "urldata.h"
+#include "cfilters.h"
+#include "cf-haproxy.h"
+#include "cf-ip-happy.h"
+#include "cf-setup.h"
+#include "curl_trc.h"
+#include "connect.h"
+#include "http_proxy.h"
+#include "socks.h"
+#include "vquic/cf-capsule.h"
+#include "vquic/vquic.h"
+#include "vtls/vtls.h"
+
+
+typedef enum {
+  CF_SETUP_INIT,
+  CF_SETUP_CNNCT_EYEBALLS,
+  CF_SETUP_CNNCT_SOCKS,
+  CF_SETUP_CNNCT_HTTP_PROXY,
+  CF_SETUP_CNNCT_HAPROXY,
+  CF_SETUP_CNNCT_SSL,
+  CF_SETUP_DONE
+} cf_setup_state;
+
+struct cf_setup_ctx {
+  cf_setup_state state;
+  int ssl_mode;
+  uint8_t transport;
+  uint8_t retry_count;
+};
+
+#ifndef CURL_DISABLE_PROXY
+
+static CURLcode cf_setup_add_haproxy(struct Curl_cfilter *cf,
+                                     struct Curl_easy *data)
+{
+  struct cf_setup_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  if(ctx->state < CF_SETUP_CNNCT_HAPROXY) {
+    if(data->set.haproxyprotocol) {
+      if(ctx->transport == TRNSPRT_QUIC) {
+        failf(data, "haproxy protocol does not support QUIC");
+        return CURLE_UNSUPPORTED_PROTOCOL;
+      }
+      result = Curl_cf_haproxy_insert_after(cf, data);
+      if(result) {
+        CURL_TRC_CF(data, cf, "adding HAPROXY filter failed -> %d",
+                    (int)result);
+        return result;
+      }
+      CURL_TRC_CF(data, cf, "added HAPROXY filter");
+    }
+    ctx->state = CF_SETUP_CNNCT_HAPROXY;
+  }
+  return result;
+}
+
+static CURLcode cf_setup_add_socks(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data)
+{
+  struct cf_setup_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+  if(ctx->state < CF_SETUP_CNNCT_SOCKS && cf->conn->socks_proxy.peer) {
+    /* Add a SOCKS proxy to go through `first_peer` to `second_peer`*/
+    struct Curl_peer *second_peer;
+
+    if(cf->conn->http_proxy.peer)
+      second_peer = cf->conn->http_proxy.peer;
+    else
+      second_peer = Curl_conn_get_destination(cf->conn, cf->sockindex);
+    if(!second_peer)
+      return CURLE_FAILED_INIT;
+
+    result = Curl_cf_socks_proxy_insert_after(
+      cf, data, second_peer, cf->conn->ip_version,
+      cf->conn->socks_proxy.proxytype,
+      cf->conn->socks_proxy.creds);
+    if(result) {
+      CURL_TRC_CF(data, cf, "adding SOCKS filter failed -> %d", (int)result);
+      return result;
+    }
+
+    CURL_TRC_CF(data, cf, "added SOCKS filter to %s:%u",
+                second_peer->hostname, second_peer->port);
+    ctx->state = CF_SETUP_CNNCT_SOCKS;
+  }
+  return result;
+}
+
+#ifndef CURL_DISABLE_HTTP
+static CURLcode cf_setup_add_http_proxy(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data)
+{
+  struct cf_setup_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  if(ctx->state < CF_SETUP_CNNCT_HTTP_PROXY &&
+     cf->conn->http_proxy.peer && !cf->conn->bits.origin_is_proxy) {
+    struct Curl_peer *peer = cf->conn->http_proxy.peer;
+    struct Curl_peer *tunnel_peer =
+      Curl_conn_get_destination(cf->conn, cf->sockindex);
+
+#ifdef USE_SSL
+    if(CURL_PROXY_IS_HTTPS(cf->conn->http_proxy.proxytype) &&
+       !Curl_conn_is_ssl(cf->conn, cf->sockindex)) {
+      result = Curl_cf_ssl_proxy_insert_after(
+        cf, data, cf->conn->http_proxy.peer);
+      if(result) {
+        CURL_TRC_CF(data, cf, "adding SSL filter for HTTP proxy failed -> %d",
+                    (int)result);
+        return result;
+      }
+      CURL_TRC_CF(data, cf, "added SSL filter for HTTP proxy");
+    }
+#endif /* USE_SSL */
+
+    result = Curl_cf_http_proxy_insert_after(
+      cf, data, peer, tunnel_peer,
+      ctx->transport, cf->conn->http_proxy.proxytype);
+    if(result) {
+      CURL_TRC_CF(data, cf, "adding HTTP proxy tunnel filter failed -> %d",
+                  (int)result);
+      return result;
+    }
+    CURL_TRC_CF(data, cf, "added HTTP proxy tunnel filter");
+    ctx->state = CF_SETUP_CNNCT_HTTP_PROXY;
+  }
+  return result;
+}
+#endif /* !CURL_DISABLE_HTTP */
+#endif /* CURL_DISABLE_PROXY */
+
+/* Get the origin curl connects its socket to.
+ * Can be origin or the first proxy. */
+static struct Curl_peer *conn_get_first_origin(struct connectdata *conn,
+                                             int sockindex)
+{
+#ifndef CURL_DISABLE_PROXY
+  if(conn->socks_proxy.peer)
+    return conn->socks_proxy.peer;
+  if(conn->http_proxy.peer)
+    return conn->http_proxy.peer;
+#endif
+  return (sockindex == SECONDARYSOCKET) ? conn->origin2 : conn->origin;
+}
+
+static CURLcode cf_setup_add_ip_happy(struct Curl_cfilter *cf,
+                                      struct Curl_easy *data)
+{
+  struct cf_setup_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  if(ctx->state < CF_SETUP_CNNCT_EYEBALLS) {
+    /* What is the first hop we directly connect to and what transport
+     * do we use for it? Only on the first hop we can do Happy Eyeballs.
+     * first_origin and first_peer differ on --connect-to. */
+    struct Curl_peer *first_origin =
+      conn_get_first_origin(cf->conn, cf->sockindex);
+    struct Curl_peer *first_peer =
+      Curl_conn_get_first_peer(cf->conn, cf->sockindex);
+    struct Curl_peer *tunnel_peer = NULL;
+    uint8_t first_transport = ctx->transport;
+
+    if(!first_peer)
+      return CURLE_FAILED_INIT;
+
+#if !defined(CURL_DISABLE_PROXY) && !defined(CURL_DISABLE_HTTP)
+    if(cf->conn->http_proxy.peer && !cf->conn->bits.origin_is_proxy) {
+      first_transport =
+        Curl_http_proxy_transport(cf->conn->http_proxy.proxytype);
+      tunnel_peer = Curl_conn_get_destination(cf->conn, cf->sockindex);
+      if((first_transport == TRNSPRT_QUIC) && cf->conn->socks_proxy.peer) {
+        failf(data, "HTTP/3 proxy not possible via SOCKS");
+        return CURLE_UNSUPPORTED_PROTOCOL;
+      }
+    }
+#endif /* !CURL_DISABLE_PROXY && !CURL_DISABLE_HTTP */
+
+    result = cf_ip_happy_insert_after(cf, data, first_origin, first_peer,
+                                      first_transport,
+                                      tunnel_peer, ctx->transport);
+    if(result) {
+      CURL_TRC_CF(data, cf, "adding happy eyeballs failed -> %d", (int)result);
+      return result;
+    }
+
+    if(tunnel_peer && (first_transport == TRNSPRT_QUIC)) {
+      CURL_TRC_CF(data, cf, "happy eyeballing to HTTP/3 proxy %s:%u",
+                  first_peer->hostname, first_peer->port);
+      ctx->state = CF_SETUP_CNNCT_HTTP_PROXY;
+    }
+    else {
+      CURL_TRC_CF(data, cf, "happy eyeballing to %s %s:%u",
+                  tunnel_peer ? "proxy" : "origin",
+                  first_peer->hostname, first_peer->port);
+      ctx->state = CF_SETUP_CNNCT_EYEBALLS;
+    }
+  }
+  return result;
+}
+
+static CURLcode cf_setup_add_origin_filters(struct Curl_cfilter *cf,
+                                            struct Curl_easy *data)
+{
+  struct cf_setup_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  (void)data; /* not used in all builds */
+  if(ctx->state < CF_SETUP_CNNCT_SSL) {
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_HTTP3) && \
+    !defined(CURL_DISABLE_PROXY)
+
+    /* Wanting QUIC with an HTTP tunneling filter, we now need to add
+     * the QUIC filter on top. Without tunneling, this has already
+     * happened in the Happy Eyeball filter. */
+    if(ctx->transport == TRNSPRT_QUIC &&
+       cf->conn->http_proxy.peer && !cf->conn->bits.origin_is_proxy) {
+      struct Curl_peer *origin = Curl_conn_get_origin(cf->conn, cf->sockindex);
+      struct Curl_peer *peer =
+        Curl_conn_get_destination(cf->conn, cf->sockindex);
+
+      result = Curl_cf_capsule_insert_after(cf, data);
+      if(result) {
+        CURL_TRC_CF(data, cf, "adding capsule filter failed -> %d",
+                    (int)result);
+        return result;
+      }
+      result = Curl_cf_quic_insert_after(cf, origin, peer);
+      if(result) {
+        CURL_TRC_CF(data, cf, "adding QUIC filter failed -> %d", (int)result);
+        return result;
+      }
+      CURL_TRC_CF(data, cf, "added QUIC filter for origin");
+    }
+    else
+#endif /* !CURL_DISABLE_HTTP && USE_HTTP3 && CURL_DISABLE_PROXY */
+#ifdef USE_SSL
+    if((ctx->ssl_mode == CURL_CF_SSL_ENABLE ||
+        (ctx->ssl_mode != CURL_CF_SSL_DISABLE &&
+         cf->conn->scheme->flags & PROTOPT_SSL)) && /* we want SSL */
+       !Curl_conn_is_ssl(cf->conn, cf->sockindex)) { /* it is missing */
+
+#ifndef CURL_DISABLE_PROXY
+      if(cf->conn->bits.origin_is_proxy) {
+        result = Curl_cf_ssl_proxy_insert_after(cf, data, cf->conn->origin);
+      }
+      else
+#endif
+      {
+        /* Another FTP quirk: when adding SSL verification, to a DATA
+         * connection, always verify against the control's origin */
+        struct Curl_peer *origin = Curl_conn_get_origin(cf->conn, FIRSTSOCKET);
+        struct Curl_peer *peer =
+          Curl_conn_get_destination(cf->conn, cf->sockindex);
+        result = Curl_cf_ssl_insert_after(cf, data, origin, peer);
+      }
+      if(result) {
+        CURL_TRC_CF(data, cf, "adding SSL filter for origin failed -> %d",
+                    (int)result);
+        return result;
+      }
+      CURL_TRC_CF(data, cf, "added SSL filter for origin");
+    }
+#endif /* USE_SSL */
+    ctx->state = CF_SETUP_CNNCT_SSL;
+  }
+  return result;
+}
+
+static CURLcode cf_setup_connect_steps(struct Curl_cfilter *cf,
+                                       struct Curl_easy *data,
+                                       bool *done)
+{
+  struct cf_setup_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  if(cf->connected) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  /* connect current sub-chain */
+connect_sub_chain:
+  VERBOSE(Curl_conn_trc_filters(data, cf->sockindex, "cf_setup_connect"));
+
+  if(cf->next && !cf->next->connected) {
+    result = Curl_conn_cf_connect(cf->next, data, done);
+    if(result || !*done)
+      return result;
+  }
+
+  result = cf_setup_add_ip_happy(cf, data);
+  if(result)
+    return result;
+  if(!cf->next || !cf->next->connected)
+    goto connect_sub_chain;
+
+#ifndef CURL_DISABLE_PROXY
+  result = cf_setup_add_socks(cf, data);
+  if(result)
+    return result;
+  if(!cf->next || !cf->next->connected)
+    goto connect_sub_chain;
+
+#ifndef CURL_DISABLE_HTTP
+  result = cf_setup_add_http_proxy(cf, data);
+  if(result)
+    return result;
+  if(!cf->next || !cf->next->connected)
+    goto connect_sub_chain;
+#endif /* !CURL_DISABLE_HTTP */
+
+  result = cf_setup_add_haproxy(cf, data);
+  if(result)
+    return result;
+  if(!cf->next || !cf->next->connected)
+    goto connect_sub_chain;
+#endif /* !CURL_DISABLE_PROXY */
+
+  result = cf_setup_add_origin_filters(cf, data);
+  if(result)
+    return result;
+  if(!cf->next || !cf->next->connected)
+    goto connect_sub_chain;
+
+  ctx->state = CF_SETUP_DONE;
+  cf->connected = TRUE;
+  *done = TRUE;
+  return CURLE_OK;
+}
+
+static CURLcode cf_setup_connect(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 bool *done)
+{
+  struct cf_setup_ctx *ctx = cf->ctx;
+  CURLcode result;
+
+  /* In some situations, a server/proxy may close the connection and
+   * we need to connect again (HTTP/1.x proxy auth, for example).
+   * We used to close the filters and reuse them for another attempt,
+   * however that complicates filter code and it is simpler to tear them
+   * all down and start over. */
+retry:
+  result = cf_setup_connect_steps(cf, data, done);
+
+  if(result == CURLE_AGAIN) {
+    ++ctx->retry_count;
+    if(ctx->retry_count > 5) /* arbitrary limit, better just timeout? */
+      return CURLE_COULDNT_CONNECT;
+
+    CURL_TRC_CF(data, cf, "retrying connect, %d. time", ctx->retry_count);
+    Curl_conn_cf_discard_chain(&cf->next, data);
+    ctx->state = CF_SETUP_INIT;
+    goto retry;
+  }
+  return result;
+}
+
+static void cf_setup_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
+{
+  struct cf_setup_ctx *ctx = cf->ctx;
+
+  CURL_TRC_CF(data, cf, "destroy");
+  curlx_safefree(ctx);
+}
+
+struct Curl_cftype Curl_cft_setup = {
+  "SETUP",
+  CF_TYPE_SETUP,
+  CURL_LOG_LVL_NONE,
+  cf_setup_destroy,
+  cf_setup_connect,
+  Curl_cf_def_shutdown,
+  Curl_cf_def_adjust_pollset,
+  Curl_cf_def_data_pending,
+  Curl_cf_def_send,
+  Curl_cf_def_recv,
+  Curl_cf_def_cntrl,
+  Curl_cf_def_conn_is_alive,
+  Curl_cf_def_conn_keep_alive,
+  Curl_cf_def_query,
+};
+
+static CURLcode cf_setup_create(struct Curl_cfilter **pcf,
+                                struct Curl_easy *data,
+                                uint8_t transport,
+                                int ssl_mode)
+{
+  struct Curl_cfilter *cf = NULL;
+  struct cf_setup_ctx *ctx;
+  CURLcode result = CURLE_OK;
+
+  (void)data;
+  ctx = curlx_calloc(1, sizeof(*ctx));
+  if(!ctx) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+  ctx->state = CF_SETUP_INIT;
+  ctx->ssl_mode = ssl_mode;
+  ctx->transport = transport;
+
+  result = Curl_cf_create(&cf, &Curl_cft_setup, ctx);
+  if(result)
+    goto out;
+  ctx = NULL;
+
+out:
+  *pcf = result ? NULL : cf;
+  if(ctx) {
+    curlx_free(ctx);
+  }
+  return result;
+}
+
+CURLcode Curl_cf_setup_add(struct Curl_easy *data,
+                           struct connectdata *conn,
+                           int sockindex,
+                           uint8_t transport,
+                           int ssl_mode)
+{
+  struct Curl_cfilter *cf;
+  CURLcode result = CURLE_OK;
+
+  DEBUGASSERT(data);
+  result = cf_setup_create(&cf, data, transport, ssl_mode);
+  if(result)
+    goto out;
+  Curl_conn_cf_add(data, conn, sockindex, cf);
+out:
+  return result;
+}
+
+CURLcode Curl_cf_setup_insert_after(struct Curl_cfilter *cf_at,
+                                    struct Curl_easy *data,
+                                    uint8_t transport,
+                                    int ssl_mode)
+{
+  struct Curl_cfilter *cf;
+  CURLcode result;
+
+  DEBUGASSERT(data);
+  result = cf_setup_create(&cf, data, transport, ssl_mode);
+  if(result)
+    goto out;
+  Curl_conn_cf_insert_after(cf_at, cf);
+out:
+  return result;
+}
diff --git a/third-party/curl/lib/cf-setup.h b/third-party/curl/lib/cf-setup.h
new file mode 100644
index 0000000000..80e20064b8
--- /dev/null
+++ b/third-party/curl/lib/cf-setup.h
@@ -0,0 +1,46 @@
+#ifndef HEADER_CURL_CF_SETUP_H
+#define HEADER_CURL_CF_SETUP_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+struct Curl_dns_entry;
+struct ip_quadruple;
+struct Curl_peer;
+struct Curl_str;
+
+CURLcode Curl_cf_setup_add(struct Curl_easy *data,
+                           struct connectdata *conn,
+                           int sockindex,
+                           uint8_t transport,
+                           int ssl_mode);
+
+CURLcode Curl_cf_setup_insert_after(struct Curl_cfilter *cf_at,
+                                    struct Curl_easy *data,
+                                    uint8_t transport,
+                                    int ssl_mode);
+
+extern struct Curl_cftype Curl_cft_setup;
+
+#endif /* HEADER_CURL_CF_SETUP_H */
diff --git a/third-party/curl/lib/cf-socket.c b/third-party/curl/lib/cf-socket.c
index effe6e649d..0741f2ba41 100644
--- a/third-party/curl/lib/cf-socket.c
+++ b/third-party/curl/lib/cf-socket.c
@@ -21,7 +21,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef HAVE_NETINET_IN_H
@@ -35,256 +34,452 @@
 #elif defined(HAVE_NETINET_TCP_H)
 #include <netinet/tcp.h>
 #endif
+#ifdef HAVE_NETINET_UDP_H
+#include <netinet/udp.h>
+#endif
 #ifdef HAVE_SYS_IOCTL_H
 #include <sys/ioctl.h>
 #endif
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
 #endif
-#ifdef HAVE_FCNTL_H
-#include <fcntl.h>
-#endif
 #ifdef HAVE_ARPA_INET_H
 #include <arpa/inet.h>
 #endif
 
+#ifdef HAVE_IFADDRS_H
+#include <ifaddrs.h>
+#endif
+#ifdef HAVE_NET_IF_H
+#include <net/if.h>
+#endif
 #ifdef __VMS
 #include <in.h>
 #include <inet.h>
 #endif
 
 #include "urldata.h"
-#include "bufq.h"
-#include "sendf.h"
+#include "curl_trc.h"
 #include "if2ip.h"
-#include "strerror.h"
 #include "cfilters.h"
 #include "cf-socket.h"
 #include "connect.h"
+#include "curl_addrinfo.h"
 #include "select.h"
-#include "url.h" /* for Curl_safefree() */
 #include "multiif.h"
-#include "sockaddr.h" /* required for Curl_sockaddr_storage */
-#include "inet_ntop.h"
-#include "inet_pton.h"
+#include "curlx/inet_ntop.h"
+#include "curlx/inet_pton.h"
 #include "progress.h"
-#include "warnless.h"
 #include "conncache.h"
 #include "multihandle.h"
 #include "rand.h"
-#include "share.h"
-#include "version_win32.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "sockaddr.h"
+#include "curlx/strdup.h"
+#include "system_win32.h"
+#include "curlx/nonblock.h"
+#include "curlx/strcopy.h"
+#include "curlx/version_win32.h"
+#include "curlx/strerr.h"
+#include "curlx/strparse.h"
 
 
-#if defined(ENABLE_IPV6) && defined(IPV6_V6ONLY) && defined(WIN32)
-/* It makes support for IPv4-mapped IPv6 addresses.
- * Linux kernel, NetBSD, FreeBSD and Darwin: default is off;
- * Windows Vista and later: default is on;
- * DragonFly BSD: acts like off, and dummy setting;
- * OpenBSD and earlier Windows: unsupported.
- * Linux: controlled by /proc/sys/net/ipv6/bindv6only.
+/* retrieves ip address and port from a sockaddr structure. note it calls
+ * curlx_inet_ntop which sets errno on fail, not SOCKERRNO.
+ * @unittest 1607
  */
-static void set_ipv6_v6only(curl_socket_t sockfd, int on)
+UNITTEST bool sockaddr2string(struct sockaddr *sa, curl_socklen_t salen,
+                              char *addr, uint16_t *port);
+UNITTEST bool sockaddr2string(struct sockaddr *sa, curl_socklen_t salen,
+                              char *addr, uint16_t *port)
 {
-  (void)setsockopt(sockfd, IPPROTO_IPV6, IPV6_V6ONLY, (void *)&on, sizeof(on));
+  struct sockaddr_in *si = NULL;
+#ifdef USE_IPV6
+  struct sockaddr_in6 *si6 = NULL;
+#endif
+#ifdef USE_UNIX_SOCKETS
+  struct sockaddr_un *su = NULL;
+#else
+  (void)salen;
+#endif
+
+  switch(sa->sa_family) {
+  case AF_INET:
+    si = (struct sockaddr_in *)(void *)sa;
+    if(curlx_inet_ntop(sa->sa_family, &si->sin_addr, addr, MAX_IPADR_LEN)) {
+      *port = ntohs(si->sin_port);
+      return TRUE;
+    }
+    break;
+#ifdef USE_IPV6
+  case AF_INET6:
+    si6 = (struct sockaddr_in6 *)(void *)sa;
+    if(curlx_inet_ntop(sa->sa_family, &si6->sin6_addr, addr, MAX_IPADR_LEN)) {
+      *port = ntohs(si6->sin6_port);
+      return TRUE;
+    }
+    break;
+#endif
+#ifdef USE_UNIX_SOCKETS
+  case AF_UNIX:
+    if(salen > (curl_socklen_t)sizeof(CURL_SA_FAMILY_T)) {
+      su = (struct sockaddr_un *)sa;
+      curl_msnprintf(addr, MAX_IPADR_LEN, "%s", su->sun_path);
+    }
+    else
+      addr[0] = 0; /* socket with no name */
+    *port = 0;
+    return TRUE;
+#endif
+  default:
+    break;
+  }
+
+  addr[0] = '\0';
+  *port = 0;
+  errno = SOCKEAFNOSUPPORT;
+  return FALSE;
 }
-#else
-#define set_ipv6_v6only(x,y)
-#endif
 
-static void tcpnodelay(struct Curl_easy *data, curl_socket_t sockfd)
+static void tcpnodelay(struct Curl_cfilter *cf,
+                       struct Curl_easy *data,
+                       curl_socket_t sockfd)
 {
-#if defined(TCP_NODELAY)
-  curl_socklen_t onoff = (curl_socklen_t) 1;
+#if defined(TCP_NODELAY) && defined(CURL_TCP_NODELAY_SUPPORTED)
+  curl_socklen_t onoff = (curl_socklen_t)1;
   int level = IPPROTO_TCP;
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
-  char buffer[STRERROR_LEN];
-#else
-  (void) data;
-#endif
+  VERBOSE(char buffer[STRERROR_LEN]);
 
-  if(setsockopt(sockfd, level, TCP_NODELAY, (void *)&onoff,
-                sizeof(onoff)) < 0)
-    infof(data, "Could not set TCP_NODELAY: %s",
-          Curl_strerror(SOCKERRNO, buffer, sizeof(buffer)));
+  if(setsockopt(sockfd, level, TCP_NODELAY, (void *)&onoff, sizeof(onoff)) < 0)
+    CURL_TRC_CF(data, cf, "Could not set TCP_NODELAY: %s",
+                curlx_strerror(SOCKERRNO, buffer, sizeof(buffer)));
 #else
+  (void)cf;
   (void)data;
   (void)sockfd;
 #endif
 }
 
-#ifdef SO_NOSIGPIPE
-/* The preferred method on Mac OS X (10.2 and later) to prevent SIGPIPEs when
-   sending data to a dead peer (instead of relying on the 4th argument to send
-   being MSG_NOSIGNAL). Possibly also existing and in use on other BSD
-   systems? */
-static void nosigpipe(struct Curl_easy *data,
-                      curl_socket_t sockfd)
-{
-  int onoff = 1;
-  if(setsockopt(sockfd, SOL_SOCKET, SO_NOSIGPIPE, (void *)&onoff,
-                sizeof(onoff)) < 0) {
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
-    char buffer[STRERROR_LEN];
-    infof(data, "Could not set SO_NOSIGPIPE: %s",
-          Curl_strerror(SOCKERRNO, buffer, sizeof(buffer)));
-#endif
-  }
-}
-#else
-#define nosigpipe(x,y) Curl_nop_stmt
-#endif
-
-#if defined(__DragonFly__) || defined(HAVE_WINSOCK2_H)
-/* DragonFlyBSD and Windows use millisecond units */
-#define KEEPALIVE_FACTOR(x) (x *= 1000)
+#if defined(USE_WINSOCK) || defined(TCP_KEEPIDLE) ||               \
+  defined(TCP_KEEPALIVE) || defined(TCP_KEEPALIVE_THRESHOLD) ||    \
+  defined(TCP_KEEPINTVL) || defined(TCP_KEEPALIVE_ABORT_THRESHOLD)
+#if defined(USE_WINSOCK) || \
+  (defined(__sun) && !defined(TCP_KEEPIDLE)) || \
+  (defined(__DragonFly__) && __DragonFly_version < 500702) || \
+  (defined(_WIN32) && !defined(TCP_KEEPIDLE))
+/* Solaris < 11.4, DragonFlyBSD < 500702 and Windows < 10.0.16299
+ * use millisecond units. */
+#define KEEPALIVE_FACTOR(x) ((x) *= 1000)
 #else
 #define KEEPALIVE_FACTOR(x)
 #endif
-
-#if defined(HAVE_WINSOCK2_H) && !defined(SIO_KEEPALIVE_VALS)
-#define SIO_KEEPALIVE_VALS    _WSAIOW(IOC_VENDOR,4)
-
-struct tcp_keepalive {
-  u_long onoff;
-  u_long keepalivetime;
-  u_long keepaliveinterval;
-};
 #endif
 
-static void
-tcpkeepalive(struct Curl_easy *data,
-             curl_socket_t sockfd)
+static void tcpkeepalive(struct Curl_cfilter *cf,
+                         struct Curl_easy *data,
+                         curl_socket_t sockfd)
 {
-  int optval = data->set.tcp_keepalive?1:0;
+  int optval = data->set.tcp_keepalive ? 1 : 0;
 
   /* only set IDLE and INTVL if setting KEEPALIVE is successful */
   if(setsockopt(sockfd, SOL_SOCKET, SO_KEEPALIVE,
-        (void *)&optval, sizeof(optval)) < 0) {
-    infof(data, "Failed to set SO_KEEPALIVE on fd %d", sockfd);
+                (void *)&optval, sizeof(optval)) < 0) {
+    CURL_TRC_CF(data, cf, "Failed to set SO_KEEPALIVE on fd "
+                "%" FMT_SOCKET_T ": errno %d", sockfd, SOCKERRNO);
   }
   else {
-#if defined(SIO_KEEPALIVE_VALS)
-    struct tcp_keepalive vals;
-    DWORD dummy;
-    vals.onoff = 1;
-    optval = curlx_sltosi(data->set.tcp_keepidle);
-    KEEPALIVE_FACTOR(optval);
-    vals.keepalivetime = optval;
-    optval = curlx_sltosi(data->set.tcp_keepintvl);
-    KEEPALIVE_FACTOR(optval);
-    vals.keepaliveinterval = optval;
-    if(WSAIoctl(sockfd, SIO_KEEPALIVE_VALS, (LPVOID) &vals, sizeof(vals),
-                NULL, 0, &dummy, NULL, NULL) != 0) {
-      infof(data, "Failed to set SIO_KEEPALIVE_VALS on fd %d: %d",
-            (int)sockfd, WSAGetLastError());
+#ifdef USE_WINSOCK
+    /* Windows 10, version 1709 (10.0.16299) and later versions can use
+       setsockopt() TCP_KEEP*. Older versions return with failure. */
+    if(curlx_verify_windows_version(10, 0, 16299, PLATFORM_WINNT,
+                                    VERSION_GREATER_THAN_EQUAL)) {
+      CURL_TRC_CF(data, cf, "Set TCP_KEEP* on fd=%" FMT_SOCKET_T, sockfd);
+      optval = curlx_sltosi(data->set.tcp_keepidle);
+/* Offered by mingw-w64 v12+, MS SDK 6.0A/VS2008+ */
+#ifndef TCP_KEEPALIVE
+#define TCP_KEEPALIVE 3
+#endif
+/* Offered by mingw-w64 v12+, MS SDK 10.0.15063.0/VS2017 15.1+ */
+#ifndef TCP_KEEPCNT
+#define TCP_KEEPCNT 16
+#endif
+/* Offered by mingw-w64 v12+, MS SDK 10.0.16299.0/VS2017 15.4+ */
+#ifndef TCP_KEEPIDLE
+#define TCP_KEEPIDLE TCP_KEEPALIVE
+#endif
+#ifndef TCP_KEEPINTVL
+#define TCP_KEEPINTVL 17
+#endif
+      if(setsockopt(sockfd, IPPROTO_TCP, TCP_KEEPIDLE,
+                    (const char *)&optval, sizeof(optval)) < 0) {
+        CURL_TRC_CF(data, cf, "Failed to set TCP_KEEPIDLE on fd "
+                    "%" FMT_SOCKET_T ": errno %d", sockfd, SOCKERRNO);
+      }
+      optval = curlx_sltosi(data->set.tcp_keepintvl);
+      if(setsockopt(sockfd, IPPROTO_TCP, TCP_KEEPINTVL,
+                    (const char *)&optval, sizeof(optval)) < 0) {
+        CURL_TRC_CF(data, cf, "Failed to set TCP_KEEPINTVL on fd "
+                    "%" FMT_SOCKET_T ": errno %d", sockfd, SOCKERRNO);
+      }
+      optval = curlx_sltosi(data->set.tcp_keepcnt);
+      if(setsockopt(sockfd, IPPROTO_TCP, TCP_KEEPCNT,
+                    (const char *)&optval, sizeof(optval)) < 0) {
+        CURL_TRC_CF(data, cf, "Failed to set TCP_KEEPCNT on fd "
+                    "%" FMT_SOCKET_T ": errno %d", sockfd, SOCKERRNO);
+      }
     }
-#else
+    else {
+/* Offered by mingw-w64 and MS SDK. Latter only when targeting Win7+. */
+#ifndef SIO_KEEPALIVE_VALS
+#define SIO_KEEPALIVE_VALS  _WSAIOW(IOC_VENDOR, 4)
+      struct tcp_keepalive {
+        u_long onoff;
+        u_long keepalivetime;
+        u_long keepaliveinterval;
+      };
+#endif
+      struct tcp_keepalive vals;
+      DWORD dummy;
+      vals.onoff = 1;
+      optval = curlx_sltosi(data->set.tcp_keepidle);
+      KEEPALIVE_FACTOR(optval);
+      vals.keepalivetime = (u_long)optval;
+      optval = curlx_sltosi(data->set.tcp_keepintvl);
+      KEEPALIVE_FACTOR(optval);
+      vals.keepaliveinterval = (u_long)optval;
+      if(WSAIoctl(sockfd, SIO_KEEPALIVE_VALS, (LPVOID)&vals, sizeof(vals),
+                  NULL, 0, &dummy, NULL, NULL) != 0) {
+        CURL_TRC_CF(data, cf, "Failed to set SIO_KEEPALIVE_VALS on fd "
+                    "%" FMT_SOCKET_T ": errno %d", sockfd, SOCKERRNO);
+      }
+    }
+#else /* !USE_WINSOCK */
 #ifdef TCP_KEEPIDLE
     optval = curlx_sltosi(data->set.tcp_keepidle);
     KEEPALIVE_FACTOR(optval);
     if(setsockopt(sockfd, IPPROTO_TCP, TCP_KEEPIDLE,
-          (void *)&optval, sizeof(optval)) < 0) {
-      infof(data, "Failed to set TCP_KEEPIDLE on fd %d", sockfd);
+                  (void *)&optval, sizeof(optval)) < 0) {
+      CURL_TRC_CF(data, cf, "Failed to set TCP_KEEPIDLE on fd "
+                  "%" FMT_SOCKET_T ": errno %d", sockfd, SOCKERRNO);
     }
 #elif defined(TCP_KEEPALIVE)
-    /* Mac OS X style */
+    /* macOS style */
     optval = curlx_sltosi(data->set.tcp_keepidle);
     KEEPALIVE_FACTOR(optval);
     if(setsockopt(sockfd, IPPROTO_TCP, TCP_KEEPALIVE,
-      (void *)&optval, sizeof(optval)) < 0) {
-      infof(data, "Failed to set TCP_KEEPALIVE on fd %d", sockfd);
+                  (void *)&optval, sizeof(optval)) < 0) {
+      CURL_TRC_CF(data, cf, "Failed to set TCP_KEEPALIVE on fd "
+                  "%" FMT_SOCKET_T ": errno %d", sockfd, SOCKERRNO);
+    }
+#elif defined(TCP_KEEPALIVE_THRESHOLD)
+    /* Solaris <11.4 style */
+    optval = curlx_sltosi(data->set.tcp_keepidle);
+    KEEPALIVE_FACTOR(optval);
+    if(setsockopt(sockfd, IPPROTO_TCP, TCP_KEEPALIVE_THRESHOLD,
+                  (void *)&optval, sizeof(optval)) < 0) {
+      CURL_TRC_CF(data, cf, "Failed to set TCP_KEEPALIVE_THRESHOLD on fd "
+                  "%" FMT_SOCKET_T ": errno %d", sockfd, SOCKERRNO);
     }
 #endif
 #ifdef TCP_KEEPINTVL
     optval = curlx_sltosi(data->set.tcp_keepintvl);
     KEEPALIVE_FACTOR(optval);
     if(setsockopt(sockfd, IPPROTO_TCP, TCP_KEEPINTVL,
-          (void *)&optval, sizeof(optval)) < 0) {
-      infof(data, "Failed to set TCP_KEEPINTVL on fd %d", sockfd);
+                  (void *)&optval, sizeof(optval)) < 0) {
+      CURL_TRC_CF(data, cf, "Failed to set TCP_KEEPINTVL on fd "
+                  "%" FMT_SOCKET_T ": errno %d", sockfd, SOCKERRNO);
+    }
+#elif defined(TCP_KEEPALIVE_ABORT_THRESHOLD)
+    /* Solaris <11.4 style */
+    /* TCP_KEEPALIVE_ABORT_THRESHOLD should equal to
+     * TCP_KEEPCNT * TCP_KEEPINTVL on other platforms.
+     * The default value of TCP_KEEPCNT is 9 on Linux,
+     * 8 on *BSD/macOS, 5 or 10 on Windows. We use the
+     * default config for Solaris <11.4 because there is
+     * no default value for TCP_KEEPCNT on Solaris 11.4.
+     *
+     * Note that the consequent probes will not be sent
+     * at equal intervals on Solaris, but will be sent
+     * using the exponential backoff algorithm. */
+    {
+      int keepcnt = curlx_sltosi(data->set.tcp_keepcnt);
+      int keepintvl = curlx_sltosi(data->set.tcp_keepintvl);
+
+      if(keepcnt > 0 && keepintvl > (INT_MAX / keepcnt))
+        optval = INT_MAX;
+      else
+        optval = keepcnt * keepintvl;
+    }
+    KEEPALIVE_FACTOR(optval);
+    if(setsockopt(sockfd, IPPROTO_TCP, TCP_KEEPALIVE_ABORT_THRESHOLD,
+                  (void *)&optval, sizeof(optval)) < 0) {
+      CURL_TRC_CF(data, cf, "Failed to set TCP_KEEPALIVE_ABORT_THRESHOLD"
+                  " on fd %" FMT_SOCKET_T ": errno %d", sockfd, SOCKERRNO);
     }
 #endif
+#ifdef TCP_KEEPCNT
+    optval = curlx_sltosi(data->set.tcp_keepcnt);
+    if(setsockopt(sockfd, IPPROTO_TCP, TCP_KEEPCNT,
+                  (void *)&optval, sizeof(optval)) < 0) {
+      CURL_TRC_CF(data, cf, "Failed to set TCP_KEEPCNT on fd "
+                  "%" FMT_SOCKET_T ": errno %d", sockfd, SOCKERRNO);
+    }
 #endif
+#endif /* USE_WINSOCK */
   }
 }
 
 /**
- * Assign the address `ai` to the Curl_sockaddr_ex `dest` and
- * set the transport used.
+ * Assign the addrinfo `ai` to the Curl_sockaddr_ex `addr` with
+ * transport determining socktype and protocol.
  */
-void Curl_sock_assign_addr(struct Curl_sockaddr_ex *dest,
-                           const struct Curl_addrinfo *ai,
-                           int transport)
+CURLcode Curl_socket_addr_from_ai(struct Curl_sockaddr_ex *addr,
+                                  const struct Curl_addrinfo *ai,
+                                  uint8_t transport)
 {
   /*
-   * The Curl_sockaddr_ex structure is basically libcurl's external API
+   * The Curl_sockaddr_ex structure is libcurl's external API
    * curl_sockaddr structure with enough space available to directly hold
    * any protocol-specific address structures. The variable declared here
    * will be used to pass / receive data to/from the fopensocket callback
    * if this has been set, before that, it is initialized from parameters.
    */
-  dest->family = ai->ai_family;
-  switch(transport) {
-  case TRNSPRT_TCP:
-    dest->socktype = SOCK_STREAM;
-    dest->protocol = IPPROTO_TCP;
-    break;
-  case TRNSPRT_UNIX:
-    dest->socktype = SOCK_STREAM;
-    dest->protocol = IPPROTO_IP;
-    break;
-  default: /* UDP and QUIC */
-    dest->socktype = SOCK_DGRAM;
-    dest->protocol = IPPROTO_UDP;
-    break;
-  }
-  dest->addrlen = ai->ai_addrlen;
+  addr->family = ai->ai_family;
+  addr->socktype = Curl_socktype_for_transport(transport);
+  addr->protocol = Curl_protocol_for_transport(transport);
+  addr->addrlen = (unsigned int)ai->ai_addrlen;
 
-  if(dest->addrlen > sizeof(struct Curl_sockaddr_storage))
-    dest->addrlen = sizeof(struct Curl_sockaddr_storage);
-  memcpy(&dest->sa_addr, ai->ai_addr, dest->addrlen);
+  DEBUGASSERT(addr->addrlen <= sizeof(addr->curl_sa_addrbuf));
+  if(addr->addrlen > sizeof(addr->curl_sa_addrbuf))
+    return CURLE_TOO_LARGE;
+
+  memcpy(&addr->curl_sa_addrbuf, ai->ai_addr, addr->addrlen);
+  return CURLE_OK;
 }
 
+#ifdef USE_SO_NOSIGPIPE
+int Curl_sock_nosigpipe(curl_socket_t sockfd)
+{
+  int onoff = 1;
+  return setsockopt(sockfd, SOL_SOCKET, SO_NOSIGPIPE,
+                    (void *)&onoff, sizeof(onoff));
+}
+#endif /* USE_SO_NOSIGPIPE */
+
+#if defined(USE_IPV6) && defined(HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID)
+static uint32_t get_scope_id(struct Curl_easy *data,
+                             struct sockaddr_in6 *sa6)
+{
+  uint32_t scope_id = 0;
+  if(data->conn->scope_id)
+    return data->conn->scope_id;
+  /* NOLINTNEXTLINE(clang-analyzer-core.uninitialized.Assign) */
+  scope_id = sa6->sin6_scope_id;
+  if(!scope_id && IN6_IS_ADDR_LINKLOCAL(&sa6->sin6_addr)) {
+    /* The resolver did not set scope_id for this link-local address.
+     * Try to determine it from the system's network interfaces.
+     * Without a scope_id, connect() to a link-local address fails
+     * with EINVAL on Linux.
+     * NOTE: On multi-homed hosts with several interfaces having
+     * link-local addresses, this picks the first one found, which
+     * may not be the correct outgoing interface. */
+#if defined(HAVE_GETIFADDRS) && defined(HAVE_NET_IF_H)
+    struct ifaddrs *ifa, *ifa_list;
+    if(getifaddrs(&ifa_list) == 0) {
+      for(ifa = ifa_list; ifa; ifa = ifa->ifa_next) {
+        if(ifa->ifa_addr && ifa->ifa_addr->sa_family == AF_INET6 &&
+           (ifa->ifa_flags & IFF_UP) &&
+           !(ifa->ifa_flags & IFF_LOOPBACK)) {
+          struct sockaddr_in6 *s6 = (void *)ifa->ifa_addr;
+          if(IN6_IS_ADDR_LINKLOCAL(&s6->sin6_addr) && s6->sin6_scope_id) {
+            scope_id = s6->sin6_scope_id;
+            infof(data,
+                  "determined scope_id=%lu for link-local address "
+                  "from local interface",
+                  (unsigned long)scope_id);
+            break;
+          }
+        }
+      }
+      freeifaddrs(ifa_list);
+    }
+#endif /* HAVE_GETIFADDRS && HAVE_NET_IF_H */
+  }
+  return scope_id;
+}
+#endif
+
 static CURLcode socket_open(struct Curl_easy *data,
                             struct Curl_sockaddr_ex *addr,
                             curl_socket_t *sockfd)
 {
+  char errbuf[STRERROR_LEN];
+
+#ifdef SOCK_CLOEXEC
+  addr->socktype |= SOCK_CLOEXEC;
+#endif
+
   DEBUGASSERT(data);
   DEBUGASSERT(data->conn);
   if(data->set.fopensocket) {
-   /*
-    * If the opensocket callback is set, all the destination address
-    * information is passed to the callback. Depending on this information the
-    * callback may opt to abort the connection, this is indicated returning
-    * CURL_SOCKET_BAD; otherwise it will return a not-connected socket. When
-    * the callback returns a valid socket the destination address information
-    * might have been changed and this 'new' address will actually be used
-    * here to connect.
-    */
-    Curl_set_in_callback(data, true);
+    /*
+     * If the opensocket callback is set, all the destination address
+     * information is passed to the callback. Depending on this information the
+     * callback may opt to abort the connection, this is indicated returning
+     * CURL_SOCKET_BAD; otherwise it will return a not-connected socket. When
+     * the callback returns a valid socket the destination address information
+     * might have been changed and this 'new' address will actually be used
+     * here to connect.
+     */
+    Curl_set_in_callback(data, TRUE);
     *sockfd = data->set.fopensocket(data->set.opensocket_client,
                                     CURLSOCKTYPE_IPCXN,
                                     (struct curl_sockaddr *)addr);
-    Curl_set_in_callback(data, false);
+    Curl_set_in_callback(data, FALSE);
   }
   else {
-    /* opensocket callback not set, so simply create the socket now */
-    *sockfd = socket(addr->family, addr->socktype, addr->protocol);
+    /* opensocket callback not set, so create the socket now */
+#ifdef DEBUGBUILD
+    if((addr->family == AF_INET6) && getenv("CURL_DBG_SOCK_FAIL_IPV6")) {
+      failf(data, "CURL_DBG_SOCK_FAIL_IPV6: failed to open socket");
+      return CURLE_COULDNT_CONNECT;
+    }
+#endif
+    *sockfd = CURL_SOCKET(addr->family, addr->socktype, addr->protocol);
+    if((*sockfd == CURL_SOCKET_BAD) && (SOCKERRNO == SOCKENOMEM))
+      return CURLE_OUT_OF_MEMORY;
   }
 
-  if(*sockfd == CURL_SOCKET_BAD)
+  if(*sockfd == CURL_SOCKET_BAD) {
     /* no socket, no connection */
+    failf(data, "failed to open socket: %s",
+          curlx_strerror(SOCKERRNO, errbuf, sizeof(errbuf)));
     return CURLE_COULDNT_CONNECT;
+  }
 
-#if defined(ENABLE_IPV6) && defined(HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID)
-  if(data->conn->scope_id && (addr->family == AF_INET6)) {
-    struct sockaddr_in6 * const sa6 = (void *)&addr->sa_addr;
-    sa6->sin6_scope_id = data->conn->scope_id;
+#ifdef USE_SO_NOSIGPIPE
+  if(Curl_sock_nosigpipe(*sockfd) < 0) {
+    failf(data, "setsockopt enable SO_NOSIGPIPE: %s",
+          curlx_strerror(SOCKERRNO, errbuf, sizeof(errbuf)));
+    sclose(*sockfd);
+    *sockfd = CURL_SOCKET_BAD;
+    return CURLE_COULDNT_CONNECT;
+  }
+#endif /* USE_SO_NOSIGPIPE */
+
+#if defined(HAVE_FCNTL) && !defined(SOCK_CLOEXEC)
+  if(fcntl(*sockfd, F_SETFD, FD_CLOEXEC) < 0) {
+    failf(data, "fcntl set CLOEXEC: %s",
+          curlx_strerror(SOCKERRNO, errbuf, sizeof(errbuf)));
+    sclose(*sockfd);
+    *sockfd = CURL_SOCKET_BAD;
+    return CURLE_COULDNT_CONNECT;
+  }
+#endif
+
+#if defined(USE_IPV6) && defined(HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID)
+  if(addr->family == AF_INET6) {
+    struct sockaddr_in6 * const sa6 = (void *)&addr->curl_sa_addr;
+    sa6->sin6_scope_id = get_scope_id(data, sa6);
   }
 #endif
   return CURLE_OK;
@@ -300,36 +495,43 @@ static CURLcode socket_open(struct Curl_easy *data,
  *
  */
 CURLcode Curl_socket_open(struct Curl_easy *data,
-                            const struct Curl_addrinfo *ai,
-                            struct Curl_sockaddr_ex *addr,
-                            int transport,
-                            curl_socket_t *sockfd)
+                          const struct Curl_addrinfo *ai,
+                          struct Curl_sockaddr_ex *addr,
+                          uint8_t transport,
+                          curl_socket_t *sockfd)
 {
   struct Curl_sockaddr_ex dummy;
+  CURLcode result;
 
   if(!addr)
-    /* if the caller doesn't want info back, use a local temp copy */
+    /* if the caller does not want info back, use a local temp copy */
     addr = &dummy;
 
-  Curl_sock_assign_addr(addr, ai, transport);
+  result = Curl_socket_addr_from_ai(addr, ai, transport);
+  if(result)
+    return result;
+
   return socket_open(data, addr, sockfd);
 }
 
 static int socket_close(struct Curl_easy *data, struct connectdata *conn,
                         int use_callback, curl_socket_t sock)
 {
+  if(sock == CURL_SOCKET_BAD)
+    return 0;
+
   if(use_callback && conn && conn->fclosesocket) {
     int rc;
-    Curl_multi_closed(data, sock);
-    Curl_set_in_callback(data, true);
+    Curl_multi_will_close(data, sock);
+    Curl_set_in_callback(data, TRUE);
     rc = conn->fclosesocket(conn->closesocket_client, sock);
-    Curl_set_in_callback(data, false);
+    Curl_set_in_callback(data, FALSE);
     return rc;
   }
 
   if(conn)
     /* tell the multi-socket code about this */
-    Curl_multi_closed(data, sock);
+    Curl_multi_will_close(data, sock);
 
   sclose(sock);
 
@@ -347,59 +549,96 @@ int Curl_socket_close(struct Curl_easy *data, struct connectdata *conn,
   return socket_close(data, conn, FALSE, sock);
 }
 
-#ifdef USE_WINSOCK
-/* When you run a program that uses the Windows Sockets API, you may
-   experience slow performance when you copy data to a TCP server.
-
-   https://support.microsoft.com/kb/823764
-
-   Work-around: Make the Socket Send Buffer Size Larger Than the Program Send
-   Buffer Size
-
-   The problem described in this knowledge-base is applied only to pre-Vista
-   Windows.  Following function trying to detect OS version and skips
-   SO_SNDBUF adjustment for Windows Vista and above.
-*/
-#define DETECT_OS_NONE 0
-#define DETECT_OS_PREVISTA 1
-#define DETECT_OS_VISTA_OR_LATER 2
-
-void Curl_sndbufset(curl_socket_t sockfd)
+/*
+ * Curl_parse_interface()
+ *
+ * This is used to parse interface argument in the following formats.
+ * In all the examples, `host` can be an IP address or a hostname.
+ *
+ *   <iface_or_host> - can be either an interface name or a host.
+ *   if!<iface> - interface name.
+ *   host!<host> - hostname.
+ *   ifhost!<iface>!<host> - interface name and hostname.
+ *
+ * Parameters:
+ *
+ * input  [in]     - input string.
+ * len    [in]     - length of the input string.
+ * dev    [in/out] - address where a pointer to newly allocated memory
+ *                   holding the interface-or-host will be stored upon
+ *                   completion.
+ * iface  [in/out] - address where a pointer to newly allocated memory
+ *                   holding the interface will be stored upon completion.
+ * host   [in/out] - address where a pointer to newly allocated memory
+ *                   holding the host will be stored upon completion.
+ *
+ * Returns CURLE_OK on success.
+ */
+CURLcode Curl_parse_interface(const char *input,
+                              char **dev, char **iface, char **host)
 {
-  int val = CURL_MAX_WRITE_SIZE + 32;
-  int curval = 0;
-  int curlen = sizeof(curval);
+  static const char if_prefix[] = "if!";
+  static const char host_prefix[] = "host!";
+  static const char if_host_prefix[] = "ifhost!";
+  size_t len;
 
-  static int detectOsState = DETECT_OS_NONE;
+  DEBUGASSERT(dev);
+  DEBUGASSERT(iface);
+  DEBUGASSERT(host);
 
-  if(detectOsState == DETECT_OS_NONE) {
-    if(curlx_verify_windows_version(6, 0, 0, PLATFORM_WINNT,
-                                    VERSION_GREATER_THAN_EQUAL))
-      detectOsState = DETECT_OS_VISTA_OR_LATER;
-    else
-      detectOsState = DETECT_OS_PREVISTA;
+  len = strlen(input);
+  if(len > 512)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  if(!strncmp(if_prefix, input, strlen(if_prefix))) {
+    input += strlen(if_prefix);
+    if(!*input)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    *iface = curlx_memdup0(input, len - strlen(if_prefix));
+    return *iface ? CURLE_OK : CURLE_OUT_OF_MEMORY;
+  }
+  else if(!strncmp(host_prefix, input, strlen(host_prefix))) {
+    input += strlen(host_prefix);
+    if(!*input)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    *host = curlx_memdup0(input, len - strlen(host_prefix));
+    return *host ? CURLE_OK : CURLE_OUT_OF_MEMORY;
+  }
+  else if(!strncmp(if_host_prefix, input, strlen(if_host_prefix))) {
+    const char *host_part;
+    input += strlen(if_host_prefix);
+    len -= strlen(if_host_prefix);
+    host_part = memchr(input, '!', len);
+    if(!host_part || !*(host_part + 1))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    *iface = curlx_memdup0(input, host_part - input);
+    if(!*iface)
+      return CURLE_OUT_OF_MEMORY;
+    ++host_part;
+    *host = curlx_memdup0(host_part, len - (host_part - input));
+    if(!*host) {
+      curlx_safefree(*iface);
+      return CURLE_OUT_OF_MEMORY;
+    }
+    return CURLE_OK;
   }
 
-  if(detectOsState == DETECT_OS_VISTA_OR_LATER)
-    return;
-
-  if(getsockopt(sockfd, SOL_SOCKET, SO_SNDBUF, (char *)&curval, &curlen) == 0)
-    if(curval > val)
-      return;
-
-  setsockopt(sockfd, SOL_SOCKET, SO_SNDBUF, (const char *)&val, sizeof(val));
+  if(!*input)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  *dev = curlx_memdup0(input, len);
+  return *dev ? CURLE_OK : CURLE_OUT_OF_MEMORY;
 }
-#endif
 
 #ifndef CURL_DISABLE_BINDLOCAL
 static CURLcode bindlocal(struct Curl_easy *data, struct connectdata *conn,
-                          curl_socket_t sockfd, int af, unsigned int scope)
+                          curl_socket_t sockfd, int af, unsigned int scope,
+                          uint8_t transport)
 {
   struct Curl_sockaddr_storage sa;
   struct sockaddr *sock = (struct sockaddr *)&sa;  /* bind to this address */
   curl_socklen_t sizeof_sa = 0; /* size of the data sock points to */
   struct sockaddr_in *si4 = (struct sockaddr_in *)&sa;
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
   struct sockaddr_in6 *si6 = (struct sockaddr_in6 *)&sa;
 #endif
 
@@ -409,122 +648,117 @@ static CURLcode bindlocal(struct Curl_easy *data, struct connectdata *conn,
   /* how many port numbers to try to bind to, increasing one at a time */
   int portnum = data->set.localportrange;
   const char *dev = data->set.str[STRING_DEVICE];
-  int error;
+  const char *iface_input = data->set.str[STRING_INTERFACE];
+  const char *host_input = data->set.str[STRING_BINDHOST];
+  const char *iface = iface_input ? iface_input : dev;
+  const char *host = host_input ? host_input : dev;
+  int sockerr;
 #ifdef IP_BIND_ADDRESS_NO_PORT
   int on = 1;
 #endif
-#ifndef ENABLE_IPV6
+#ifndef USE_IPV6
   (void)scope;
 #endif
 
   /*************************************************************
    * Select device to bind socket to
    *************************************************************/
-  if(!dev && !port)
+  if(!iface && !host && !port)
     /* no local kind of binding was requested */
     return CURLE_OK;
+  else if(iface && (strlen(iface) >= 255))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
 
   memset(&sa, 0, sizeof(struct Curl_sockaddr_storage));
 
-  if(dev && (strlen(dev)<255) ) {
+  if(iface || host) {
     char myhost[256] = "";
     int done = 0; /* -1 for error, 1 for address found */
-    bool is_interface = FALSE;
-    bool is_host = FALSE;
-    static const char *if_prefix = "if!";
-    static const char *host_prefix = "host!";
+    if2ip_result_t if2ip_result = IF2IP_NOT_FOUND;
 
-    if(strncmp(if_prefix, dev, strlen(if_prefix)) == 0) {
-      dev += strlen(if_prefix);
-      is_interface = TRUE;
-    }
-    else if(strncmp(host_prefix, dev, strlen(host_prefix)) == 0) {
-      dev += strlen(host_prefix);
-      is_host = TRUE;
-    }
-
-    /* interface */
-    if(!is_host) {
 #ifdef SO_BINDTODEVICE
+    if(iface) {
       /*
        * This binds the local socket to a particular interface. This will
        * force even requests to other local interfaces to go out the external
        * interface. Only bind to the interface when specified as interface,
-       * not just as a hostname or ip address.
+       * not as a hostname or ip address.
        *
        * The interface might be a VRF, eg: vrf-blue, which means it cannot be
-       * converted to an IP address and would fail Curl_if2ip. Simply try to
+       * converted to an IP address and would fail Curl_if2ip. Try to
        * use it straight away.
        */
       if(setsockopt(sockfd, SOL_SOCKET, SO_BINDTODEVICE,
-                    dev, (curl_socklen_t)strlen(dev) + 1) == 0) {
-        /* This is often "errno 1, error: Operation not permitted" if you're
+                    iface, (curl_socklen_t)strlen(iface) + 1) == 0) {
+        /* This is often "errno 1, error: Operation not permitted" if you are
          * not running as root or another suitable privileged user. If it
          * succeeds it means the parameter was a valid interface and not an IP
          * address. Return immediately.
          */
-        infof(data, "socket successfully bound to interface '%s'", dev);
-        return CURLE_OK;
-      }
-#endif
-
-      switch(Curl_if2ip(af,
-#ifdef ENABLE_IPV6
-                        scope, conn->scope_id,
-#endif
-                        dev, myhost, sizeof(myhost))) {
-        case IF2IP_NOT_FOUND:
-          if(is_interface) {
-            /* Do not fall back to treating it as a host name */
-            failf(data, "Couldn't bind to interface '%s'", dev);
-            return CURLE_INTERFACE_FAILED;
-          }
-          break;
-        case IF2IP_AF_NOT_SUPPORTED:
-          /* Signal the caller to try another address family if available */
-          return CURLE_UNSUPPORTED_PROTOCOL;
-        case IF2IP_FOUND:
-          is_interface = TRUE;
-          /*
-           * We now have the numerical IP address in the 'myhost' buffer
-           */
-          infof(data, "Local Interface %s is ip %s using address family %i",
-                dev, myhost, af);
-          done = 1;
-          break;
+        if(!host_input) {
+          infof(data, "socket successfully bound to interface '%s'", iface);
+          return CURLE_OK;
+        }
       }
     }
-    if(!is_interface) {
+#endif
+    if(!host_input) {
+      /* Discover IP from input device, then bind to it */
+      if2ip_result = Curl_if2ip(af,
+#ifdef USE_IPV6
+                                scope, conn->scope_id,
+#endif
+                                iface, myhost, sizeof(myhost));
+    }
+    switch(if2ip_result) {
+    case IF2IP_NOT_FOUND:
+      if(iface_input && !host_input) {
+        /* Do not fall back to treating it as a hostname */
+        char buffer[STRERROR_LEN];
+        data->state.os_errno = sockerr = SOCKERRNO;
+        failf(data, "Could not bind to interface '%s' with errno %d: %s",
+              iface, sockerr, curlx_strerror(sockerr, buffer, sizeof(buffer)));
+        return CURLE_INTERFACE_FAILED;
+      }
+      break;
+    case IF2IP_AF_NOT_SUPPORTED:
+      /* Signal the caller to try another address family if available */
+      return CURLE_UNSUPPORTED_PROTOCOL;
+    case IF2IP_FOUND:
       /*
-       * This was not an interface, resolve the name as a host name
+       * We now have the numerical IP address in the 'myhost' buffer
+       */
+      host = myhost;
+      infof(data, "Local Interface %s is ip %s using address family %d",
+            iface, host, af);
+      done = 1;
+      break;
+    }
+    if(!iface_input || host_input) {
+      /*
+       * This was not an interface, resolve the name as a hostname
        * or IP number
        *
        * Temporarily force name resolution to use only the address type
        * of the connection. The resolve functions should really be changed
        * to take a type parameter instead.
        */
-      unsigned char ipver = conn->ip_version;
-      int rc;
-
-      if(af == AF_INET)
-        conn->ip_version = CURL_IPRESOLVE_V4;
-#ifdef ENABLE_IPV6
-      else if(af == AF_INET6)
-        conn->ip_version = CURL_IPRESOLVE_V6;
+      uint8_t dns_queries = (af == AF_INET) ?
+                            CURL_DNSQ_A : (CURL_DNSQ_A | CURL_DNSQ_AAAA);
+#ifdef USE_IPV6
+      if(af == AF_INET6)
+        dns_queries = CURL_DNSQ_AAAA;
 #endif
 
-      rc = Curl_resolv(data, dev, 80, FALSE, &h);
-      if(rc == CURLRESOLV_PENDING)
-        (void)Curl_resolver_wait_resolv(data, &h);
-      conn->ip_version = ipver;
-
+      (void)Curl_resolv_blocking(data, dns_queries, host, 80, transport, &h);
       if(h) {
+        int h_af = h->addr->ai_family;
         /* convert the resolved address, sizeof myhost >= INET_ADDRSTRLEN */
         Curl_printable_address(h->addr, myhost, sizeof(myhost));
-        infof(data, "Name '%s' family %i resolved to '%s' family %i",
-              dev, af, myhost, h->addr->ai_family);
-        Curl_resolv_unlock(data, h);
-        if(af != h->addr->ai_family) {
+        infof(data, "Name '%s' family %d resolved to '%s' family %d",
+              host, af, myhost, h_af);
+        Curl_dns_entry_unlink(data, &h); /* this will NULL, potential free h */
+        if(af != h_af) {
           /* bad IP version combo, signal the caller to try another address
              family if available */
           return CURLE_UNSUPPORTED_PROTOCOL;
@@ -534,14 +768,14 @@ static CURLcode bindlocal(struct Curl_easy *data, struct connectdata *conn,
       else {
         /*
          * provided dev was no interface (or interfaces are not supported
-         * e.g. solaris) no ip address and no domain we fail here
+         * e.g. Solaris) no ip address and no domain we fail here
          */
         done = -1;
       }
     }
 
     if(done > 0) {
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
       /* IPv6 address */
       if(af == AF_INET6) {
 #ifdef HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID
@@ -549,19 +783,19 @@ static CURLcode bindlocal(struct Curl_easy *data, struct connectdata *conn,
         if(scope_ptr)
           *(scope_ptr++) = '\0';
 #endif
-        if(Curl_inet_pton(AF_INET6, myhost, &si6->sin6_addr) > 0) {
+        if(curlx_inet_pton(AF_INET6, myhost, &si6->sin6_addr) > 0) {
           si6->sin6_family = AF_INET6;
           si6->sin6_port = htons(port);
 #ifdef HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID
           if(scope_ptr) {
             /* The "myhost" string either comes from Curl_if2ip or from
                Curl_printable_address. The latter returns only numeric scope
-               IDs and the former returns none at all.  So the scope ID, if
-               present, is known to be numeric */
-            unsigned long scope_id = strtoul(scope_ptr, NULL, 10);
-            if(scope_id > UINT_MAX)
+               IDs and the former returns none at all. Making the scope ID,
+               if present, known to be numeric */
+            curl_off_t scope_id;
+            if(curlx_str_number((const char **)CURL_UNCONST(&scope_ptr),
+                                &scope_id, UINT_MAX))
               return CURLE_UNSUPPORTED_PROTOCOL;
-
             si6->sin6_scope_id = (unsigned int)scope_id;
           }
 #endif
@@ -572,7 +806,7 @@ static CURLcode bindlocal(struct Curl_easy *data, struct connectdata *conn,
 #endif
       /* IPv4 address */
       if((af == AF_INET) &&
-         (Curl_inet_pton(AF_INET, myhost, &si4->sin_addr) > 0)) {
+         (curlx_inet_pton(AF_INET, myhost, &si4->sin_addr) > 0)) {
         si4->sin_family = AF_INET;
         si4->sin_port = htons(port);
         sizeof_sa = sizeof(struct sockaddr_in);
@@ -583,14 +817,17 @@ static CURLcode bindlocal(struct Curl_easy *data, struct connectdata *conn,
       /* errorbuf is set false so failf will overwrite any message already in
          the error buffer, so the user receives this error message instead of a
          generic resolve error. */
+      char buffer[STRERROR_LEN];
       data->state.errorbuf = FALSE;
-      failf(data, "Couldn't bind to '%s'", dev);
+      data->state.os_errno = sockerr = SOCKERRNO;
+      failf(data, "Could not bind to '%s' with errno %d: %s", host,
+            sockerr, curlx_strerror(sockerr, buffer, sizeof(buffer)));
       return CURLE_INTERFACE_FAILED;
     }
   }
   else {
     /* no device was given, prepare sa to match af's needs */
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
     if(af == AF_INET6) {
       si6->sin6_family = AF_INET6;
       si6->sin6_port = htons(port);
@@ -610,16 +847,6 @@ static CURLcode bindlocal(struct Curl_easy *data, struct connectdata *conn,
   for(;;) {
     if(bind(sockfd, sock, sizeof_sa) >= 0) {
       /* we succeeded to bind */
-      struct Curl_sockaddr_storage add;
-      curl_socklen_t size = sizeof(add);
-      memset(&add, 0, sizeof(struct Curl_sockaddr_storage));
-      if(getsockname(sockfd, (struct sockaddr *) &add, &size) < 0) {
-        char buffer[STRERROR_LEN];
-        data->state.os_errno = error = SOCKERRNO;
-        failf(data, "getsockname() failed with errno %d: %s",
-              error, Curl_strerror(error, buffer, sizeof(buffer)));
-        return CURLE_INTERFACE_FAILED;
-      }
       infof(data, "Local port: %hu", port);
       conn->bits.bound = TRUE;
       return CURLE_OK;
@@ -632,10 +859,10 @@ static CURLcode bindlocal(struct Curl_easy *data, struct connectdata *conn,
       infof(data, "Bind to local port %d failed, trying next", port - 1);
       /* We reuse/clobber the port variable here below */
       if(sock->sa_family == AF_INET)
-        si4->sin_port = ntohs(port);
-#ifdef ENABLE_IPV6
+        si4->sin_port = htons(port);
+#ifdef USE_IPV6
       else
-        si6->sin6_port = ntohs(port);
+        si6->sin6_port = htons(port);
 #endif
     }
     else
@@ -643,9 +870,9 @@ static CURLcode bindlocal(struct Curl_easy *data, struct connectdata *conn,
   }
   {
     char buffer[STRERROR_LEN];
-    data->state.os_errno = error = SOCKERRNO;
+    data->state.os_errno = sockerr = SOCKERRNO;
     failf(data, "bind failed with errno %d: %s",
-          error, Curl_strerror(error, buffer, sizeof(buffer)));
+          sockerr, curlx_strerror(sockerr, buffer, sizeof(buffer)));
   }
 
   return CURLE_INTERFACE_FAILED;
@@ -655,66 +882,53 @@ static CURLcode bindlocal(struct Curl_easy *data, struct connectdata *conn,
 /*
  * verifyconnect() returns TRUE if the connect really has happened.
  */
-static bool verifyconnect(curl_socket_t sockfd, int *error)
+static bool verifyconnect(curl_socket_t sockfd, int *psockerr)
 {
   bool rc = TRUE;
 #ifdef SO_ERROR
-  int err = 0;
-  curl_socklen_t errSize = sizeof(err);
+  int sockerr = 0;
+  curl_socklen_t errSize = sizeof(sockerr);
 
-#ifdef WIN32
+#ifdef _WIN32
   /*
    * In October 2003 we effectively nullified this function on Windows due to
    * problems with it using all CPU in multi-threaded cases.
    *
-   * In May 2004, we bring it back to offer more info back on connect failures.
-   * Gisle Vanem could reproduce the former problems with this function, but
+   * In May 2004, we brought it back to offer more info back on connect
+   * failures. We could reproduce the former problems with this function, but
    * could avoid them by adding this SleepEx() call below:
    *
-   *    "I don't have Rational Quantify, but the hint from his post was
-   *    ntdll::NtRemoveIoCompletion(). So I'd assume the SleepEx (or maybe
-   *    just Sleep(0) would be enough?) would release whatever
+   *    "I do not have Rational Quantify, but the hint from his post was
+   *    ntdll::NtRemoveIoCompletion(). I would assume the SleepEx (or maybe
+   *    Sleep(0) would be enough?) would release whatever
    *    mutex/critical-section the ntdll call is waiting on.
    *
    *    Someone got to verify this on Win-NT 4.0, 2000."
    */
-
-#ifdef _WIN32_WCE
-  Sleep(0);
-#else
   SleepEx(0, FALSE);
 #endif
 
-#endif
-
-  if(0 != getsockopt(sockfd, SOL_SOCKET, SO_ERROR, (void *)&err, &errSize))
-    err = SOCKERRNO;
-#ifdef _WIN32_WCE
-  /* Old WinCE versions don't support SO_ERROR */
-  if(WSAENOPROTOOPT == err) {
-    SET_SOCKERRNO(0);
-    err = 0;
-  }
-#endif
+  if(getsockopt(sockfd, SOL_SOCKET, SO_ERROR, (void *)&sockerr, &errSize))
+    sockerr = SOCKERRNO;
 #if defined(EBADIOCTL) && defined(__minix)
-  /* Minix 3.1.x doesn't support getsockopt on UDP sockets */
-  if(EBADIOCTL == err) {
+  /* Minix 3.1.x does not support getsockopt on UDP sockets */
+  if(EBADIOCTL == sockerr) {
     SET_SOCKERRNO(0);
-    err = 0;
+    sockerr = 0;
   }
 #endif
-  if((0 == err) || (EISCONN == err))
+  if((sockerr == 0) || (SOCKEISCONN == sockerr))
     /* we are connected, awesome! */
     rc = TRUE;
   else
-    /* This wasn't a successful connect */
+    /* This was not a successful connect */
     rc = FALSE;
-  if(error)
-    *error = err;
+  if(psockerr)
+    *psockerr = sockerr;
 #else
   (void)sockfd;
-  if(error)
-    *error = SOCKERRNO;
+  if(psockerr)
+    *psockerr = SOCKERRNO;
 #endif
   return rc;
 }
@@ -723,234 +937,169 @@ static bool verifyconnect(curl_socket_t sockfd, int *error)
  * Determine the curl code for a socket connect() == -1 with errno.
  */
 static CURLcode socket_connect_result(struct Curl_easy *data,
-                                      const char *ipaddress, int error)
+                                      const char *ipaddress, int sockerr)
 {
-  switch(error) {
-  case EINPROGRESS:
-  case EWOULDBLOCK:
-#if defined(EAGAIN)
-#if (EAGAIN) != (EWOULDBLOCK)
-    /* On some platforms EAGAIN and EWOULDBLOCK are the
-     * same value, and on others they are different, hence
-     * the odd #if
-     */
-  case EAGAIN:
-#endif
-#endif
+  if(sockerr == SOCKEINPROGRESS || SOCK_EAGAIN(sockerr))
     return CURLE_OK;
 
-  default:
-    /* unknown error, fallthrough and try another address! */
-#ifdef CURL_DISABLE_VERBOSE_STRINGS
-    (void)ipaddress;
-#else
-    {
-      char buffer[STRERROR_LEN];
-      infof(data, "Immediate connect fail for %s: %s",
-            ipaddress, Curl_strerror(error, buffer, sizeof(buffer)));
-    }
-#endif
-    data->state.os_errno = error;
-    /* connect failed */
-    return CURLE_COULDNT_CONNECT;
+  /* unknown error, fallthrough and try another address! */
+  {
+    VERBOSE(char buffer[STRERROR_LEN]);
+    infof(data, "Immediate connect fail for %s: %s", ipaddress,
+          curlx_strerror(sockerr, buffer, sizeof(buffer)));
+    NOVERBOSE((void)ipaddress);
   }
+  data->state.os_errno = sockerr;
+  /* connect failed */
+  return CURLE_COULDNT_CONNECT;
 }
 
-/* We have a recv buffer to enhance reads with len < NW_SMALL_READS.
- * This happens often on TLS connections where the TLS implementation
- * tries to read the head of a TLS record, determine the length of the
- * full record and then make a subsequent read for that.
- * On large reads, we will not fill the buffer to avoid the double copy. */
-#define NW_RECV_CHUNK_SIZE    (64 * 1024)
-#define NW_RECV_CHUNKS         1
-#define NW_SMALL_READS        (1024)
-
 struct cf_socket_ctx {
-  int transport;
+  struct Curl_peer *peer;
   struct Curl_sockaddr_ex addr;      /* address to connect to */
   curl_socket_t sock;                /* current attempt socket */
-  struct bufq recvbuf;               /* used when `buffer_recv` is set */
-  char r_ip[MAX_IPADR_LEN];          /* remote IP as string */
-  int r_port;                        /* remote port number */
-  char l_ip[MAX_IPADR_LEN];          /* local IP as string */
-  int l_port;                        /* local port number */
+  struct ip_quadruple ip;            /* The IP quadruple 2x(addr+port) */
   struct curltime started_at;        /* when socket was created */
   struct curltime connected_at;      /* when socket connected/got first byte */
   struct curltime first_byte_at;     /* when first byte was recvd */
-  int error;                         /* errno of last failure or 0 */
+#ifdef USE_WINSOCK
+  struct curltime last_sndbuf_query_at;  /* when SO_SNDBUF last queried */
+  ULONG sndbuf_size;                     /* the last set SO_SNDBUF size */
+#endif
+  int sockerr;                       /* socket error of last failure or 0 */
 #ifdef DEBUGBUILD
   int wblock_percent;                /* percent of writes doing EAGAIN */
   int wpartial_percent;              /* percent of bytes written in send */
+  int rblock_percent;                /* percent of reads doing EAGAIN */
+  size_t recv_max;                   /* max enforced read size */
 #endif
+  uint8_t transport;
   BIT(got_first_byte);               /* if first byte was received */
+  BIT(listening);                    /* socket is listening */
   BIT(accepted);                     /* socket was accepted, not connected */
+  BIT(sock_connected);               /* socket is "connected", e.g. in UDP */
   BIT(active);
-  BIT(buffer_recv);
 };
 
-static void cf_socket_ctx_init(struct cf_socket_ctx *ctx,
-                               const struct Curl_addrinfo *ai,
-                               int transport)
+static CURLcode cf_socket_ctx_init(struct cf_socket_ctx *ctx,
+                                   struct Curl_peer *peer,
+                                   struct Curl_sockaddr_ex *addr,
+                                   uint8_t transport)
 {
   memset(ctx, 0, sizeof(*ctx));
+  Curl_peer_link(&ctx->peer, peer);
   ctx->sock = CURL_SOCKET_BAD;
   ctx->transport = transport;
-  Curl_sock_assign_addr(&ctx->addr, ai, transport);
-  Curl_bufq_init(&ctx->recvbuf, NW_RECV_CHUNK_SIZE, NW_RECV_CHUNKS);
+  ctx->addr = *addr;
+
 #ifdef DEBUGBUILD
   {
-    char *p = getenv("CURL_DBG_SOCK_WBLOCK");
+    const char *p = getenv("CURL_DBG_SOCK_WBLOCK");
     if(p) {
-      long l = strtol(p, NULL, 10);
-      if(l >= 0 && l <= 100)
+      curl_off_t l;
+      if(!curlx_str_number(&p, &l, 100))
         ctx->wblock_percent = (int)l;
     }
     p = getenv("CURL_DBG_SOCK_WPARTIAL");
     if(p) {
-      long l = strtol(p, NULL, 10);
-      if(l >= 0 && l <= 100)
+      curl_off_t l;
+      if(!curlx_str_number(&p, &l, 100))
         ctx->wpartial_percent = (int)l;
     }
+    p = getenv("CURL_DBG_SOCK_RBLOCK");
+    if(p) {
+      curl_off_t l;
+      if(!curlx_str_number(&p, &l, 100))
+        ctx->rblock_percent = (int)l;
+    }
+    p = getenv("CURL_DBG_SOCK_RMAX");
+    if(p) {
+      curl_off_t l;
+      if(!curlx_str_number(&p, &l, CURL_OFF_T_MAX))
+        ctx->recv_max = (size_t)l;
+    }
   }
 #endif
+
+  return CURLE_OK;
 }
 
-struct reader_ctx {
-  struct Curl_cfilter *cf;
-  struct Curl_easy *data;
-};
-
-static ssize_t nw_in_read(void *reader_ctx,
-                           unsigned char *buf, size_t len,
-                           CURLcode *err)
+static void cf_socket_ctx_free(struct cf_socket_ctx *ctx)
 {
-  struct reader_ctx *rctx = reader_ctx;
-  struct cf_socket_ctx *ctx = rctx->cf->ctx;
-  ssize_t nread;
-
-  *err = CURLE_OK;
-  nread = sread(ctx->sock, buf, len);
-
-  if(-1 == nread) {
-    int sockerr = SOCKERRNO;
-
-    if(
-#ifdef WSAEWOULDBLOCK
-      /* This is how Windows does it */
-      (WSAEWOULDBLOCK == sockerr)
-#else
-      /* errno may be EWOULDBLOCK or on some systems EAGAIN when it returned
-         due to its inability to send off data without blocking. We therefore
-         treat both error codes the same here */
-      (EWOULDBLOCK == sockerr) || (EAGAIN == sockerr) || (EINTR == sockerr)
-#endif
-      ) {
-      /* this is just a case of EWOULDBLOCK */
-      *err = CURLE_AGAIN;
-      nread = -1;
-    }
-    else {
-      char buffer[STRERROR_LEN];
-
-      failf(rctx->data, "Recv failure: %s",
-            Curl_strerror(sockerr, buffer, sizeof(buffer)));
-      rctx->data->state.os_errno = sockerr;
-      *err = CURLE_RECV_ERROR;
-      nread = -1;
-    }
+  if(ctx) {
+    Curl_peer_unlink(&ctx->peer);
+    curlx_free(ctx);
   }
-  CURL_TRC_CF(rctx->data, rctx->cf, "nw_in_read(len=%zu) -> %d, err=%d",
-              len, (int)nread, *err);
-  return nread;
 }
 
-static void cf_socket_close(struct Curl_cfilter *cf, struct Curl_easy *data)
+static CURLcode cf_socket_shutdown(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data,
+                                   bool *done)
 {
-  struct cf_socket_ctx *ctx = cf->ctx;
+  if(cf->connected) {
+    struct cf_socket_ctx *ctx = cf->ctx;
 
-  if(ctx && CURL_SOCKET_BAD != ctx->sock) {
-    if(ctx->active) {
-      /* We share our socket at cf->conn->sock[cf->sockindex] when active.
-       * If it is no longer there, someone has stolen (and hopefully
-       * closed it) and we just forget about it.
-       */
-      if(ctx->sock == cf->conn->sock[cf->sockindex]) {
-        CURL_TRC_CF(data, cf, "cf_socket_close(%" CURL_FORMAT_SOCKET_T
-                    ", active)", ctx->sock);
-        socket_close(data, cf->conn, !ctx->accepted, ctx->sock);
-        cf->conn->sock[cf->sockindex] = CURL_SOCKET_BAD;
-      }
-      else {
-        CURL_TRC_CF(data, cf, "cf_socket_close(%" CURL_FORMAT_SOCKET_T
-                    ") no longer at conn->sock[], discarding", ctx->sock);
-        /* TODO: we do not want this to happen. Need to check which
-         * code is messing with conn->sock[cf->sockindex] */
-      }
-      ctx->sock = CURL_SOCKET_BAD;
-      if(cf->sockindex == FIRSTSOCKET)
-        cf->conn->remote_addr = NULL;
+    CURL_TRC_CF(data, cf, "cf_socket_shutdown, fd=%" FMT_SOCKET_T, ctx->sock);
+    /* On TCP, and when the socket looks well and non-blocking mode
+     * can be enabled, receive dangling bytes before close to avoid
+     * entering RST states unnecessarily. */
+    if(ctx->sock != CURL_SOCKET_BAD &&
+       ctx->transport == TRNSPRT_TCP &&
+       (curlx_nonblock(ctx->sock, TRUE) >= 0)) {
+      unsigned char buf[1024];
+      (void)sread(ctx->sock, buf, sizeof(buf));
     }
-    else {
-      /* this is our local socket, we did never publish it */
-      CURL_TRC_CF(data, cf, "cf_socket_close(%" CURL_FORMAT_SOCKET_T
-                  ", not active)", ctx->sock);
-      socket_close(data, cf->conn, !ctx->accepted, ctx->sock);
-      ctx->sock = CURL_SOCKET_BAD;
-    }
-    Curl_bufq_reset(&ctx->recvbuf);
-    ctx->active = FALSE;
-    ctx->buffer_recv = FALSE;
-    memset(&ctx->started_at, 0, sizeof(ctx->started_at));
-    memset(&ctx->connected_at, 0, sizeof(ctx->connected_at));
   }
-
-  cf->connected = FALSE;
+  *done = TRUE;
+  return CURLE_OK;
 }
 
 static void cf_socket_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
 {
   struct cf_socket_ctx *ctx = cf->ctx;
 
-  cf_socket_close(cf, data);
   CURL_TRC_CF(data, cf, "destroy");
-  Curl_bufq_free(&ctx->recvbuf);
-  free(ctx);
-  cf->ctx = NULL;
+  if(ctx) {
+    if(ctx->sock != CURL_SOCKET_BAD) {
+      CURL_TRC_CF(data, cf, "cf_socket_close, fd=%" FMT_SOCKET_T, ctx->sock);
+      if(ctx->sock == cf->conn->sock[cf->sockindex])
+        cf->conn->sock[cf->sockindex] = CURL_SOCKET_BAD;
+      socket_close(data, cf->conn, !ctx->accepted, ctx->sock);
+    }
+    cf_socket_ctx_free(ctx);
+  }
 }
 
-static CURLcode set_local_ip(struct Curl_cfilter *cf,
-                             struct Curl_easy *data)
+static void set_local_ip(struct Curl_cfilter *cf,
+                         struct Curl_easy *data)
 {
   struct cf_socket_ctx *ctx = cf->ctx;
+  ctx->ip.local_ip[0] = 0;
+  ctx->ip.local_port = 0;
 
 #ifdef HAVE_GETSOCKNAME
-  if(!(data->conn->handler->protocol & CURLPROTO_TFTP)) {
+  if((ctx->sock != CURL_SOCKET_BAD) &&
+     !(data->conn->scheme->protocol & CURLPROTO_TFTP)) {
     /* TFTP does not connect, so it cannot get the IP like this */
-
-    char buffer[STRERROR_LEN];
     struct Curl_sockaddr_storage ssloc;
     curl_socklen_t slen = sizeof(struct Curl_sockaddr_storage);
+    VERBOSE(char buffer[STRERROR_LEN]);
 
     memset(&ssloc, 0, sizeof(ssloc));
-    if(getsockname(ctx->sock, (struct sockaddr*) &ssloc, &slen)) {
-      int error = SOCKERRNO;
-      failf(data, "getsockname() failed with errno %d: %s",
-            error, Curl_strerror(error, buffer, sizeof(buffer)));
-      return CURLE_FAILED_INIT;
+    if(getsockname(ctx->sock, (struct sockaddr *)&ssloc, &slen)) {
+      VERBOSE(int sockerr = SOCKERRNO);
+      infof(data, "getsockname() failed with errno %d: %s",
+            sockerr, curlx_strerror(sockerr, buffer, sizeof(buffer)));
     }
-    if(!Curl_addr2string((struct sockaddr*)&ssloc, slen,
-                         ctx->l_ip, &ctx->l_port)) {
-      failf(data, "ssloc inet_ntop() failed with errno %d: %s",
-            errno, Curl_strerror(errno, buffer, sizeof(buffer)));
-      return CURLE_FAILED_INIT;
+    else if(!sockaddr2string((struct sockaddr *)&ssloc, slen,
+                             ctx->ip.local_ip, &ctx->ip.local_port)) {
+      infof(data, "ssloc inet_ntop() failed with errno %d: %s",
+            errno, curlx_strerror(errno, buffer, sizeof(buffer)));
     }
   }
 #else
   (void)data;
-  ctx->l_ip[0] = 0;
-  ctx->l_port = -1;
 #endif
-  return CURLE_OK;
 }
 
 static CURLcode set_remote_ip(struct Curl_cfilter *cf,
@@ -959,21 +1108,39 @@ static CURLcode set_remote_ip(struct Curl_cfilter *cf,
   struct cf_socket_ctx *ctx = cf->ctx;
 
   /* store remote address and port used in this connection attempt */
-  if(!Curl_addr2string(&ctx->addr.sa_addr, ctx->addr.addrlen,
-                       ctx->r_ip, &ctx->r_port)) {
+  ctx->ip.transport = ctx->transport;
+  if(!sockaddr2string(&ctx->addr.curl_sa_addr,
+                      (curl_socklen_t)ctx->addr.addrlen,
+                      ctx->ip.remote_ip, &ctx->ip.remote_port)) {
     char buffer[STRERROR_LEN];
 
-    ctx->error = errno;
+    /* using bare errno instead of SOCKERRNO is safe here, because
+       sockaddr2string() calls curlx_inet_ntop(), and they both report failures
+       via errno (even on Windows builds). */
+    ctx->sockerr = errno;
     /* malformed address or bug in inet_ntop, try next address */
-    failf(data, "sa_addr inet_ntop() failed with errno %d: %s",
-          errno, Curl_strerror(errno, buffer, sizeof(buffer)));
+    failf(data, "curl_sa_addr inet_ntop() failed with errno %d: %s",
+          errno, curlx_strerror(errno, buffer, sizeof(buffer)));
     return CURLE_FAILED_INIT;
   }
   return CURLE_OK;
 }
 
+/* to figure out the type of the socket safely, remove the possibly ORed
+   bits before comparing */
+static int cf_socktype(int x)
+{
+#ifdef SOCK_CLOEXEC
+  x &= ~SOCK_CLOEXEC;
+#endif
+#ifdef SOCK_NONBLOCK
+  x &= ~SOCK_NONBLOCK;
+#endif
+  return x;
+}
+
 static CURLcode cf_socket_open(struct Curl_cfilter *cf,
-                              struct Curl_easy *data)
+                               struct Curl_easy *data)
 {
   struct cf_socket_ctx *ctx = cf->ctx;
   int error = 0;
@@ -981,10 +1148,22 @@ static CURLcode cf_socket_open(struct Curl_cfilter *cf,
   CURLcode result = CURLE_COULDNT_CONNECT;
   bool is_tcp;
 
-  (void)data;
   DEBUGASSERT(ctx->sock == CURL_SOCKET_BAD);
-  ctx->started_at = Curl_now();
+  ctx->started_at = *Curl_pgrs_now(data);
+#ifdef SOCK_NONBLOCK
+  /* Do not tuck SOCK_NONBLOCK into socktype when opensocket callback is set
+   * because we would not know how socketype is about to be used in the
+   * callback, SOCK_NONBLOCK might get factored out before calling socket().
+   */
+  if(!data->set.fopensocket)
+    ctx->addr.socktype |= SOCK_NONBLOCK;
+#endif
   result = socket_open(data, &ctx->addr, &ctx->sock);
+#ifdef SOCK_NONBLOCK
+  /* Restore the socktype after the socket is created. */
+  if(!data->set.fopensocket)
+    ctx->addr.socktype &= ~SOCK_NONBLOCK;
+#endif
   if(result)
     goto out;
 
@@ -992,46 +1171,60 @@ static CURLcode cf_socket_open(struct Curl_cfilter *cf,
   if(result)
     goto out;
 
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-  {
-    const char *ipmsg;
-#ifdef ENABLE_IPV6
-    if(ctx->addr.family == AF_INET6) {
-      set_ipv6_v6only(ctx->sock, 0);
-      ipmsg = "  Trying [%s]:%d...";
+#ifdef USE_IPV6
+  if(ctx->addr.family == AF_INET6) {
+#ifdef USE_WINSOCK
+    /* Turn on support for IPv4-mapped IPv6 addresses.
+     * Linux kernel, NetBSD, FreeBSD, Darwin, lwIP: default is off;
+     * Windows Vista and later: default is on;
+     * DragonFly BSD: acts like off, and dummy setting;
+     * OpenBSD and earlier Windows: unsupported.
+     * Linux: controlled by /proc/sys/net/ipv6/bindv6only.
+     */
+    int on = 0;
+    (void)setsockopt(ctx->sock, IPPROTO_IPV6, IPV6_V6ONLY,
+                     (void *)&on, sizeof(on));
+#endif
+#ifdef HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID
+    {
+      struct sockaddr_in6 *sa6 = (void *)&ctx->addr.curl_sa_addr;
+      if(sa6->sin6_scope_id)
+        infof(data, "  Trying [%s]:%d scope_id=%lu...",
+              ctx->ip.remote_ip, ctx->ip.remote_port,
+              (unsigned long)sa6->sin6_scope_id);
+      else
+#endif
+        infof(data, "  Trying [%s]:%d...",
+              ctx->ip.remote_ip, ctx->ip.remote_port);
+#ifdef HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID
     }
-    else
 #endif
-      ipmsg = "  Trying %s:%d...";
-    infof(data, ipmsg, ctx->r_ip, ctx->r_port);
   }
+  else
 #endif
+    infof(data, "  Trying %s:%d...", ctx->ip.remote_ip, ctx->ip.remote_port);
 
-#ifdef ENABLE_IPV6
-  is_tcp = (ctx->addr.family == AF_INET
-            || ctx->addr.family == AF_INET6) &&
-           ctx->addr.socktype == SOCK_STREAM;
+#ifdef USE_IPV6
+  is_tcp = (ctx->addr.family == AF_INET ||
+            ctx->addr.family == AF_INET6) &&
+    cf_socktype(ctx->addr.socktype) == SOCK_STREAM;
 #else
   is_tcp = (ctx->addr.family == AF_INET) &&
-           ctx->addr.socktype == SOCK_STREAM;
+    cf_socktype(ctx->addr.socktype) == SOCK_STREAM;
 #endif
   if(is_tcp && data->set.tcp_nodelay)
-    tcpnodelay(data, ctx->sock);
-
-  nosigpipe(data, ctx->sock);
-
-  Curl_sndbufset(ctx->sock);
+    tcpnodelay(cf, data, ctx->sock);
 
   if(is_tcp && data->set.tcp_keepalive)
-    tcpkeepalive(data, ctx->sock);
+    tcpkeepalive(cf, data, ctx->sock);
 
   if(data->set.fsockopt) {
     /* activate callback for setting socket options */
-    Curl_set_in_callback(data, true);
+    Curl_set_in_callback(data, TRUE);
     error = data->set.fsockopt(data->set.sockopt_client,
                                ctx->sock,
                                CURLSOCKTYPE_IPCXN);
-    Curl_set_in_callback(data, false);
+    Curl_set_in_callback(data, FALSE);
 
     if(error == CURL_SOCKOPT_ALREADY_CONNECTED)
       isconnected = TRUE;
@@ -1044,12 +1237,13 @@ static CURLcode cf_socket_open(struct Curl_cfilter *cf,
 #ifndef CURL_DISABLE_BINDLOCAL
   /* possibly bind the local end to an IP, interface or port */
   if(ctx->addr.family == AF_INET
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
      || ctx->addr.family == AF_INET6
 #endif
     ) {
     result = bindlocal(data, cf->conn, ctx->sock, ctx->addr.family,
-                       Curl_ipv6_scope(&ctx->addr.sa_addr));
+                       Curl_ipv6_scope(&ctx->addr.curl_sa_addr),
+                       ctx->transport);
     if(result) {
       if(result == CURLE_UNSUPPORTED_PROTOCOL) {
         /* The address family is not supported on this interface.
@@ -1061,9 +1255,28 @@ static CURLcode cf_socket_open(struct Curl_cfilter *cf,
   }
 #endif
 
-  /* set socket non-blocking */
-  (void)curlx_nonblock(ctx->sock, TRUE);
-
+#ifndef SOCK_NONBLOCK
+  /* Set socket non-blocking, must be a non-blocking socket for
+   * a non-blocking connect. */
+  error = curlx_nonblock(ctx->sock, TRUE);
+  if(error < 0) {
+    result = CURLE_UNSUPPORTED_PROTOCOL;
+    ctx->sockerr = SOCKERRNO;
+    goto out;
+  }
+#else
+  if(data->set.fopensocket) {
+    /* Set socket non-blocking, must be a non-blocking socket for
+     * a non-blocking connect. */
+    error = curlx_nonblock(ctx->sock, TRUE);
+    if(error < 0) {
+      result = CURLE_UNSUPPORTED_PROTOCOL;
+      ctx->sockerr = SOCKERRNO;
+      goto out;
+    }
+  }
+#endif
+  ctx->sock_connected = (cf_socktype(ctx->addr.socktype) != SOCK_DGRAM);
 out:
   if(result) {
     if(ctx->sock != CURL_SOCKET_BAD) {
@@ -1073,11 +1286,11 @@ out:
   }
   else if(isconnected) {
     set_local_ip(cf, data);
-    ctx->connected_at = Curl_now();
+    ctx->connected_at = *Curl_pgrs_now(data);
     cf->connected = TRUE;
   }
-  CURL_TRC_CF(data, cf, "cf_socket_open() -> %d, fd=%" CURL_FORMAT_SOCKET_T,
-              result, ctx->sock);
+  CURL_TRC_CF(data, cf, "cf_socket_open() -> %d, fd=%" FMT_SOCKET_T,
+              (int)result, ctx->sock);
   return result;
 }
 
@@ -1092,8 +1305,8 @@ static int do_connect(struct Curl_cfilter *cf, struct Curl_easy *data,
 
   (void)data;
   if(is_tcp_fastopen) {
-#if defined(CONNECT_DATA_IDEMPOTENT) /* Darwin */
-#  if defined(HAVE_BUILTIN_AVAILABLE)
+#ifdef CONNECT_DATA_IDEMPOTENT /* Darwin */
+#  ifdef HAVE_BUILTIN_AVAILABLE
     /* while connectx function is available since macOS 10.11 / iOS 9,
        it did not have the interface declared correctly until
        Xcode 9 / macOS SDK 10.13 */
@@ -1102,7 +1315,7 @@ static int do_connect(struct Curl_cfilter *cf, struct Curl_easy *data,
       endpoints.sae_srcif = 0;
       endpoints.sae_srcaddr = NULL;
       endpoints.sae_srcaddrlen = 0;
-      endpoints.sae_dstaddr = &ctx->addr.sa_addr;
+      endpoints.sae_dstaddr = &ctx->addr.curl_sa_addr;
       endpoints.sae_dstaddrlen = ctx->addr.addrlen;
 
       rc = connectx(ctx->sock, &endpoints, SAE_ASSOCID_ANY,
@@ -1110,51 +1323,48 @@ static int do_connect(struct Curl_cfilter *cf, struct Curl_easy *data,
                     NULL, 0, NULL, NULL);
     }
     else {
-      rc = connect(ctx->sock, &ctx->addr.sa_addr, ctx->addr.addrlen);
+      rc = connect(ctx->sock, &ctx->addr.curl_sa_addr, ctx->addr.addrlen);
     }
 #  else
-    rc = connect(ctx->sock, &ctx->addr.sa_addr, ctx->addr.addrlen);
+    rc = connect(ctx->sock, &ctx->addr.curl_sa_addr, ctx->addr.addrlen);
 #  endif /* HAVE_BUILTIN_AVAILABLE */
 #elif defined(TCP_FASTOPEN_CONNECT) /* Linux >= 4.11 */
     if(setsockopt(ctx->sock, IPPROTO_TCP, TCP_FASTOPEN_CONNECT,
                   (void *)&optval, sizeof(optval)) < 0)
-      infof(data, "Failed to enable TCP Fast Open on fd %"
-            CURL_FORMAT_SOCKET_T, ctx->sock);
+      CURL_TRC_CF(data, cf, "Failed to enable TCP Fast Open on fd %"
+                  FMT_SOCKET_T, ctx->sock);
 
-    rc = connect(ctx->sock, &ctx->addr.sa_addr, ctx->addr.addrlen);
+    rc = connect(ctx->sock, &ctx->addr.curl_sa_addr, ctx->addr.addrlen);
 #elif defined(MSG_FASTOPEN) /* old Linux */
-    if(cf->conn->given->flags & PROTOPT_SSL)
-      rc = connect(ctx->sock, &ctx->addr.sa_addr, ctx->addr.addrlen);
+    if(Curl_conn_is_ssl(cf->conn, cf->sockindex))
+      rc = connect(ctx->sock, &ctx->addr.curl_sa_addr, ctx->addr.addrlen);
     else
       rc = 0; /* Do nothing */
 #endif
   }
   else {
-    rc = connect(ctx->sock, &ctx->addr.sa_addr, ctx->addr.addrlen);
+    rc = connect(ctx->sock, &ctx->addr.curl_sa_addr,
+                 (curl_socklen_t)ctx->addr.addrlen);
   }
   return rc;
 }
 
 static CURLcode cf_tcp_connect(struct Curl_cfilter *cf,
                                struct Curl_easy *data,
-                               bool blocking, bool *done)
+                               bool *done)
 {
   struct cf_socket_ctx *ctx = cf->ctx;
   CURLcode result = CURLE_COULDNT_CONNECT;
   int rc = 0;
 
-  (void)data;
   if(cf->connected) {
     *done = TRUE;
     return CURLE_OK;
   }
 
-  /* TODO: need to support blocking connect? */
-  if(blocking)
-    return CURLE_UNSUPPORTED_PROTOCOL;
-
-  *done = FALSE; /* a very negative world view is best */
+  *done = FALSE; /* a negative world view is best */
   if(ctx->sock == CURL_SOCKET_BAD) {
+    int sockerr;
 
     result = cf_socket_open(cf, data);
     if(result)
@@ -1166,9 +1376,14 @@ static CURLcode cf_tcp_connect(struct Curl_cfilter *cf,
     }
 
     /* Connect TCP socket */
-    rc = do_connect(cf, data, cf->conn->bits.tcp_fastopen);
-    if(-1 == rc) {
-      result = socket_connect_result(data, ctx->r_ip, SOCKERRNO);
+    rc = do_connect(cf, data, (bool)cf->conn->bits.tcp_fastopen);
+    sockerr = SOCKERRNO;
+    set_local_ip(cf, data);
+    CURL_TRC_CF(data, cf, "local address %s port %d...",
+                ctx->ip.local_ip, ctx->ip.local_port);
+    if(rc == -1) {
+      ctx->sockerr = sockerr;
+      result = socket_connect_result(data, ctx->ip.remote_ip, sockerr);
       goto out;
     }
   }
@@ -1184,113 +1399,134 @@ static CURLcode cf_tcp_connect(struct Curl_cfilter *cf,
   rc = SOCKET_WRITABLE(ctx->sock, 0);
 
   if(rc == 0) { /* no connection yet */
-    CURL_TRC_CF(data, cf, "not connected yet");
+    CURL_TRC_CF(data, cf, "not connected yet on fd=%" FMT_SOCKET_T, ctx->sock);
     return CURLE_OK;
   }
   else if(rc == CURL_CSELECT_OUT || cf->conn->bits.tcp_fastopen) {
-    if(verifyconnect(ctx->sock, &ctx->error)) {
+    if(verifyconnect(ctx->sock, &ctx->sockerr)) {
       /* we are connected with TCP, awesome! */
-      ctx->connected_at = Curl_now();
+      ctx->connected_at = *Curl_pgrs_now(data);
       set_local_ip(cf, data);
       *done = TRUE;
       cf->connected = TRUE;
-      CURL_TRC_CF(data, cf, "connected");
+      CURL_TRC_CF(data, cf, "connected on fd=%" FMT_SOCKET_T, ctx->sock);
       return CURLE_OK;
     }
   }
   else if(rc & CURL_CSELECT_ERR) {
-    (void)verifyconnect(ctx->sock, &ctx->error);
+    CURL_TRC_CF(data, cf, "poll/select error on fd=%" FMT_SOCKET_T, ctx->sock);
+    (void)verifyconnect(ctx->sock, &ctx->sockerr);
     result = CURLE_COULDNT_CONNECT;
   }
 
 out:
   if(result) {
-    if(ctx->error) {
-      data->state.os_errno = ctx->error;
-      SET_SOCKERRNO(ctx->error);
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-      {
-        char buffer[STRERROR_LEN];
-        infof(data, "connect to %s port %u failed: %s",
-              ctx->r_ip, ctx->r_port,
-              Curl_strerror(ctx->error, buffer, sizeof(buffer)));
-      }
-#endif
+    VERBOSE(char buffer[STRERROR_LEN]);
+    set_local_ip(cf, data);
+    if(ctx->sockerr) {
+      data->state.os_errno = ctx->sockerr;
+      SET_SOCKERRNO(ctx->sockerr);
+      VERBOSE(curlx_strerror(ctx->sockerr, buffer, sizeof(buffer)));
+    }
+    else {
+      VERBOSE(curlx_strcopy(buffer, sizeof(buffer), STRCONST("peer closed")));
     }
     if(ctx->sock != CURL_SOCKET_BAD) {
       socket_close(data, cf->conn, TRUE, ctx->sock);
       ctx->sock = CURL_SOCKET_BAD;
     }
+    infof(data, "connect to %s port %u from %s port %d failed: %s",
+          ctx->ip.remote_ip, ctx->ip.remote_port,
+          ctx->ip.local_ip, ctx->ip.local_port,
+          curlx_strerror(ctx->sockerr, buffer, sizeof(buffer)));
     *done = FALSE;
   }
   return result;
 }
 
-static void cf_socket_get_host(struct Curl_cfilter *cf,
-                               struct Curl_easy *data,
-                               const char **phost,
-                               const char **pdisplay_host,
-                               int *pport)
-{
-  (void)data;
-  *phost = cf->conn->host.name;
-  *pdisplay_host = cf->conn->host.dispname;
-  *pport = cf->conn->port;
-}
-
-static int cf_socket_get_select_socks(struct Curl_cfilter *cf,
-                                      struct Curl_easy *data,
-                                      curl_socket_t *socks)
+static CURLcode cf_socket_adjust_pollset(struct Curl_cfilter *cf,
+                                         struct Curl_easy *data,
+                                         struct easy_pollset *ps)
 {
   struct cf_socket_ctx *ctx = cf->ctx;
-  int rc = GETSOCK_BLANK;
+  CURLcode result = CURLE_OK;
 
-  (void)data;
-  if(!cf->connected && ctx->sock != CURL_SOCKET_BAD) {
-    socks[0] = ctx->sock;
-    rc |= GETSOCK_WRITESOCK(0);
+  if(ctx->sock != CURL_SOCKET_BAD) {
+    /* A listening socket filter needs to be connected before the accept
+     * for some weird FTP interaction. This should be rewritten, so that
+     * FTP no longer does the socket checks and accept calls and delegates
+     * all that to the filter. */
+    if(ctx->listening) {
+      result = Curl_pollset_set_in_only(data, ps, ctx->sock);
+      CURL_TRC_CF(data, cf, "adjust_pollset, listening, POLLIN fd=%"
+                  FMT_SOCKET_T, ctx->sock);
+    }
+    else if(!cf->connected) {
+      result = Curl_pollset_set_out_only(data, ps, ctx->sock);
+      CURL_TRC_CF(data, cf, "adjust_pollset, !connected, POLLOUT fd=%"
+                  FMT_SOCKET_T, ctx->sock);
+    }
+    else if(!ctx->active) {
+      result = Curl_pollset_add_in(data, ps, ctx->sock);
+      CURL_TRC_CF(data, cf, "adjust_pollset, !active, POLLIN fd=%"
+                  FMT_SOCKET_T, ctx->sock);
+    }
   }
-
-  return rc;
+  return result;
 }
 
-static bool cf_socket_data_pending(struct Curl_cfilter *cf,
-                                   const struct Curl_easy *data)
+#ifdef USE_WINSOCK
+
+/* Offered by mingw-w64 v13+, MS SDK 7.0A/VS2010+ */
+#ifndef SIO_IDEAL_SEND_BACKLOG_QUERY
+#define SIO_IDEAL_SEND_BACKLOG_QUERY 0x4004747B
+#endif
+
+static void win_update_sndbuf_size(struct Curl_easy *data,
+                                   struct cf_socket_ctx *ctx)
 {
-  struct cf_socket_ctx *ctx = cf->ctx;
-  int readable;
+  ULONG ideal;
+  DWORD ideallen;
 
-  (void)data;
-  if(!Curl_bufq_is_empty(&ctx->recvbuf))
-    return TRUE;
-
-  readable = SOCKET_READABLE(ctx->sock, 0);
-  return (readable > 0 && (readable & CURL_CSELECT_IN));
+  if(curlx_ptimediff_ms(Curl_pgrs_now(data),
+                        &ctx->last_sndbuf_query_at) > 1000) {
+    if(!WSAIoctl(ctx->sock, SIO_IDEAL_SEND_BACKLOG_QUERY, 0, 0,
+                 &ideal, sizeof(ideal), &ideallen, 0, 0) &&
+       ideal != ctx->sndbuf_size &&
+       !setsockopt(ctx->sock, SOL_SOCKET, SO_SNDBUF,
+                   (const char *)&ideal, sizeof(ideal))) {
+      ctx->sndbuf_size = ideal;
+    }
+    ctx->last_sndbuf_query_at = *Curl_pgrs_now(data);
+  }
 }
 
-static ssize_t cf_socket_send(struct Curl_cfilter *cf, struct Curl_easy *data,
-                              const void *buf, size_t len, CURLcode *err)
+#endif /* USE_WINSOCK */
+
+static CURLcode cf_socket_send(struct Curl_cfilter *cf, struct Curl_easy *data,
+                               const uint8_t *buf, size_t len, bool eos,
+                               size_t *pnwritten)
 {
   struct cf_socket_ctx *ctx = cf->ctx;
   curl_socket_t fdsave;
-  ssize_t nwritten;
-  size_t orig_len = len;
+  ssize_t rv;
+  CURLcode result = CURLE_OK;
+  VERBOSE(size_t orig_len = len);
 
-  *err = CURLE_OK;
+  (void)eos;
+  *pnwritten = 0;
   fdsave = cf->conn->sock[cf->sockindex];
   cf->conn->sock[cf->sockindex] = ctx->sock;
 
 #ifdef DEBUGBUILD
   /* simulate network blocking/partial writes */
   if(ctx->wblock_percent > 0) {
-    unsigned char c;
-    Curl_rand(data, &c, 1);
-    if(c >= ((100-ctx->wblock_percent)*256/100)) {
+    unsigned char c = 0;
+    Curl_rand_bytes(data, FALSE, &c, 1);
+    if(c >= ((100 - ctx->wblock_percent) * 256 / 100)) {
       CURL_TRC_CF(data, cf, "send(len=%zu) SIMULATE EWOULDBLOCK", orig_len);
-      *err = CURLE_AGAIN;
-      nwritten = -1;
       cf->conn->sock[cf->sockindex] = fdsave;
-      return nwritten;
+      return CURLE_AGAIN;
     }
   }
   if(cf->cft != &Curl_cft_udp && ctx->wpartial_percent > 0 && len > 8) {
@@ -1304,144 +1540,104 @@ static ssize_t cf_socket_send(struct Curl_cfilter *cf, struct Curl_easy *data,
 
 #if defined(MSG_FASTOPEN) && !defined(TCP_FASTOPEN_CONNECT) /* Linux */
   if(cf->conn->bits.tcp_fastopen) {
-    nwritten = sendto(ctx->sock, buf, len, MSG_FASTOPEN,
-                      &cf->conn->remote_addr->sa_addr,
-                      cf->conn->remote_addr->addrlen);
+    rv = sendto(ctx->sock, buf, len, MSG_FASTOPEN,
+                &ctx->addr.curl_sa_addr, ctx->addr.addrlen);
     cf->conn->bits.tcp_fastopen = FALSE;
   }
   else
 #endif
-    nwritten = swrite(ctx->sock, buf, len);
+    rv = swrite(ctx->sock, buf, len);
 
-  if(-1 == nwritten) {
+  if(!curlx_sztouz(rv, pnwritten)) {
     int sockerr = SOCKERRNO;
-
-    if(
-#ifdef WSAEWOULDBLOCK
-      /* This is how Windows does it */
-      (WSAEWOULDBLOCK == sockerr)
-#else
-      /* errno may be EWOULDBLOCK or on some systems EAGAIN when it returned
-         due to its inability to send off data without blocking. We therefore
-         treat both error codes the same here */
-      (EWOULDBLOCK == sockerr) || (EAGAIN == sockerr) || (EINTR == sockerr) ||
-      (EINPROGRESS == sockerr)
+    if(SOCK_EAGAIN(sockerr)
+#ifndef USE_WINSOCK
+       || (sockerr == SOCKEINTR) || (sockerr == SOCKEINPROGRESS)
 #endif
       ) {
-      /* this is just a case of EWOULDBLOCK */
-      *err = CURLE_AGAIN;
+      result = CURLE_AGAIN;  /* EWOULDBLOCK */
     }
     else {
       char buffer[STRERROR_LEN];
       failf(data, "Send failure: %s",
-            Curl_strerror(sockerr, buffer, sizeof(buffer)));
+            curlx_strerror(sockerr, buffer, sizeof(buffer)));
       data->state.os_errno = sockerr;
-      *err = CURLE_SEND_ERROR;
+      result = CURLE_SEND_ERROR;
     }
   }
 
-  CURL_TRC_CF(data, cf, "send(len=%zu) -> %d, err=%d",
-              orig_len, (int)nwritten, *err);
+#ifdef USE_WINSOCK
+  if(!result)
+    win_update_sndbuf_size(data, ctx);
+#endif
+
+  CURL_TRC_CF(data, cf, "send(len=%zu) -> %d, %zu",
+              orig_len, (int)result, *pnwritten);
   cf->conn->sock[cf->sockindex] = fdsave;
-  return nwritten;
+  return result;
 }
 
-static ssize_t cf_socket_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
-                              char *buf, size_t len, CURLcode *err)
+static CURLcode cf_socket_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
+                               char *buf, size_t len, size_t *pnread)
 {
   struct cf_socket_ctx *ctx = cf->ctx;
-  curl_socket_t fdsave;
-  ssize_t nread;
+  CURLcode result = CURLE_OK;
+  ssize_t rv;
 
-  *err = CURLE_OK;
-
-  fdsave = cf->conn->sock[cf->sockindex];
-  cf->conn->sock[cf->sockindex] = ctx->sock;
-
-  if(ctx->buffer_recv && !Curl_bufq_is_empty(&ctx->recvbuf)) {
-    CURL_TRC_CF(data, cf, "recv from buffer");
-    nread = Curl_bufq_read(&ctx->recvbuf, (unsigned char *)buf, len, err);
+  *pnread = 0;
+#ifdef DEBUGBUILD
+  /* simulate network blocking/partial reads */
+  if(cf->cft != &Curl_cft_udp && ctx->rblock_percent > 0) {
+    unsigned char c = 0;
+    Curl_rand(data, &c, 1);
+    if(c >= ((100 - ctx->rblock_percent) * 256 / 100)) {
+      CURL_TRC_CF(data, cf, "recv(len=%zu) SIMULATE EWOULDBLOCK", len);
+      return CURLE_AGAIN;
+    }
   }
-  else {
-    struct reader_ctx rctx;
+  if(cf->cft != &Curl_cft_udp && ctx->recv_max && ctx->recv_max < len) {
+    CURL_TRC_CF(data, cf, "recv(len=%zu) SIMULATE max read of %zu bytes",
+                len, ctx->recv_max);
+    len = ctx->recv_max;
+  }
+#endif
 
-    rctx.cf = cf;
-    rctx.data = data;
+  rv = sread(ctx->sock, buf, len);
 
-    /* "small" reads may trigger filling our buffer, "large" reads
-     * are probably not worth the additional copy */
-    if(ctx->buffer_recv && len < NW_SMALL_READS) {
-      ssize_t nwritten;
-      nwritten = Curl_bufq_slurp(&ctx->recvbuf, nw_in_read, &rctx, err);
-      if(nwritten < 0 && !Curl_bufq_is_empty(&ctx->recvbuf)) {
-        /* we have a partial read with an error. need to deliver
-         * what we got, return the error later. */
-        CURL_TRC_CF(data, cf, "partial read: empty buffer first");
-        nread = Curl_bufq_read(&ctx->recvbuf, (unsigned char *)buf, len, err);
-      }
-      else if(nwritten < 0) {
-        nread = -1;
-        goto out;
-      }
-      else if(nwritten == 0) {
-        /* eof */
-        *err = CURLE_OK;
-        nread = 0;
-      }
-      else {
-        CURL_TRC_CF(data, cf, "buffered %zd additional bytes", nwritten);
-        nread = Curl_bufq_read(&ctx->recvbuf, (unsigned char *)buf, len, err);
-      }
+  if(!curlx_sztouz(rv, pnread)) {
+    int sockerr = SOCKERRNO;
+    if(SOCK_EAGAIN(sockerr)
+#ifndef USE_WINSOCK
+       || (sockerr == SOCKEINTR)
+#endif
+      ) {
+      result = CURLE_AGAIN;  /* EWOULDBLOCK */
     }
     else {
-      nread = nw_in_read(&rctx, (unsigned char *)buf, len, err);
+      char buffer[STRERROR_LEN];
+      failf(data, "Recv failure: %s",
+            curlx_strerror(sockerr, buffer, sizeof(buffer)));
+      data->state.os_errno = sockerr;
+      result = CURLE_RECV_ERROR;
     }
   }
 
-out:
-  CURL_TRC_CF(data, cf, "recv(len=%zu) -> %d, err=%d", len, (int)nread,
-              *err);
-  if(nread > 0 && !ctx->got_first_byte) {
-    ctx->first_byte_at = Curl_now();
+  CURL_TRC_CF(data, cf, "recv(len=%zu) -> %d, %zu", len, (int)result, *pnread);
+  if(!result && !ctx->got_first_byte) {
+    ctx->first_byte_at = *Curl_pgrs_now(data);
     ctx->got_first_byte = TRUE;
   }
-  cf->conn->sock[cf->sockindex] = fdsave;
-  return nread;
+  return result;
 }
 
-static void conn_set_primary_ip(struct Curl_cfilter *cf,
-                                struct Curl_easy *data)
+static void cf_socket_update_data(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data)
 {
-#ifdef HAVE_GETPEERNAME
-  struct cf_socket_ctx *ctx = cf->ctx;
-  if(!(data->conn->handler->protocol & CURLPROTO_TFTP)) {
-    /* TFTP does not connect the endpoint: getpeername() failed with errno
-       107: Transport endpoint is not connected */
-
-    char buffer[STRERROR_LEN];
-    struct Curl_sockaddr_storage ssrem;
-    curl_socklen_t plen;
-    int port;
-
-    plen = sizeof(ssrem);
-    memset(&ssrem, 0, plen);
-    if(getpeername(ctx->sock, (struct sockaddr*) &ssrem, &plen)) {
-      int error = SOCKERRNO;
-      failf(data, "getpeername() failed with errno %d: %s",
-            error, Curl_strerror(error, buffer, sizeof(buffer)));
-      return;
-    }
-    if(!Curl_addr2string((struct sockaddr*)&ssrem, plen,
-                         cf->conn->primary_ip, &port)) {
-      failf(data, "ssrem inet_ntop() failed with errno %d: %s",
-            errno, Curl_strerror(errno, buffer, sizeof(buffer)));
-      return;
-    }
+  /* Update the IP info held in the transfer, if we have that. */
+  if(cf->connected && (cf->sockindex == FIRSTSOCKET)) {
+    struct cf_socket_ctx *ctx = cf->ctx;
+    data->info.primary = ctx->ip;
   }
-#else
-  cf->conn->primary_ip[0] = 0;
-  (void)data;
-#endif
 }
 
 static void cf_socket_active(struct Curl_cfilter *cf, struct Curl_easy *data)
@@ -1450,21 +1646,11 @@ static void cf_socket_active(struct Curl_cfilter *cf, struct Curl_easy *data)
 
   /* use this socket from now on */
   cf->conn->sock[cf->sockindex] = ctx->sock;
-  /* the first socket info gets set at conn and data */
-  if(cf->sockindex == FIRSTSOCKET) {
-    cf->conn->remote_addr = &ctx->addr;
-  #ifdef ENABLE_IPV6
-    cf->conn->bits.ipv6 = (ctx->addr.family == AF_INET6)? TRUE : FALSE;
-  #endif
-    conn_set_primary_ip(cf, data);
-    set_local_ip(cf, data);
-    Curl_persistconninfo(data, cf->conn, ctx->l_ip, ctx->l_port);
-    /* buffering is currently disabled by default because we have stalls
-     * in parallel transfers where not all buffered data is consumed and no
-     * socket events happen.
-     */
-    ctx->buffer_recv = FALSE;
-  }
+  set_local_ip(cf, data);
+#ifdef USE_IPV6
+  if(cf->sockindex == FIRSTSOCKET)
+    cf->conn->bits.ipv6 = (ctx->addr.family == AF_INET6);
+#endif
   ctx->active = TRUE;
 }
 
@@ -1479,9 +1665,13 @@ static CURLcode cf_socket_cntrl(struct Curl_cfilter *cf,
   switch(event) {
   case CF_CTRL_CONN_INFO_UPDATE:
     cf_socket_active(cf, data);
+    cf_socket_update_data(cf, data);
     break;
   case CF_CTRL_DATA_SETUP:
-    Curl_persistconninfo(data, cf->conn, ctx->l_ip, ctx->l_port);
+    cf_socket_update_data(cf, data);
+    break;
+  case CF_CTRL_FORGET_SOCKET:
+    ctx->sock = CURL_SOCKET_BAD;
     break;
   }
   return CURLE_OK;
@@ -1496,13 +1686,13 @@ static bool cf_socket_conn_is_alive(struct Curl_cfilter *cf,
   int r;
 
   *input_pending = FALSE;
-  (void)data;
+
   if(!ctx || ctx->sock == CURL_SOCKET_BAD)
     return FALSE;
 
   /* Check with 0 timeout if there are any events pending on the socket */
   pfd[0].fd = ctx->sock;
-  pfd[0].events = POLLRDNORM|POLLIN|POLLRDBAND|POLLPRI;
+  pfd[0].events = POLLRDNORM | POLLIN | POLLRDBAND | POLLPRI;
   pfd[0].revents = 0;
 
   r = Curl_poll(pfd, 1, 0);
@@ -1514,7 +1704,7 @@ static bool cf_socket_conn_is_alive(struct Curl_cfilter *cf,
     CURL_TRC_CF(data, cf, "is_alive: poll timeout, assume alive");
     return TRUE;
   }
-  else if(pfd[0].revents & (POLLERR|POLLHUP|POLLPRI|POLLNVAL)) {
+  else if(pfd[0].revents & (POLLERR | POLLHUP | POLLPRI | POLLNVAL)) {
     CURL_TRC_CF(data, cf, "is_alive: err/hup/etc events, assume dead");
     return FALSE;
   }
@@ -1535,10 +1725,20 @@ static CURLcode cf_socket_query(struct Curl_cfilter *cf,
     DEBUGASSERT(pres2);
     *((curl_socket_t *)pres2) = ctx->sock;
     return CURLE_OK;
+  case CF_QUERY_TRANSPORT:
+    DEBUGASSERT(pres1);
+    *pres1 = ctx->transport;
+    return CURLE_OK;
+  case CF_QUERY_REMOTE_ADDR:
+    DEBUGASSERT(pres2);
+    *((const struct Curl_sockaddr_ex **)pres2) = cf->connected ?
+                                                 &ctx->addr : NULL;
+    return CURLE_OK;
   case CF_QUERY_CONNECT_REPLY_MS:
     if(ctx->got_first_byte) {
-      timediff_t ms = Curl_timediff(ctx->first_byte_at, ctx->started_at);
-      *pres1 = (ms < INT_MAX)? (int)ms : INT_MAX;
+      timediff_t ms = curlx_ptimediff_ms(&ctx->first_byte_at,
+                                         &ctx->started_at);
+      *pres1 = (ms < INT_MAX) ? (int)ms : INT_MAX;
     }
     else
       *pres1 = -1;
@@ -1554,17 +1754,25 @@ static CURLcode cf_socket_query(struct Curl_cfilter *cf,
         *when = ctx->first_byte_at;
         break;
       }
-      /* FALLTHROUGH */
+      FALLTHROUGH();
     default:
       *when = ctx->connected_at;
       break;
     }
     return CURLE_OK;
   }
+  case CF_QUERY_IP_INFO:
+#ifdef USE_IPV6
+    *pres1 = (ctx->addr.family == AF_INET6);
+#else
+    *pres1 = FALSE;
+#endif
+    *(struct ip_quadruple *)pres2 = ctx->ip;
+    return CURLE_OK;
   default:
     break;
   }
-  return cf->next?
+  return cf->next ?
     cf->next->cft->query(cf->next, data, query, pres1, pres2) :
     CURLE_UNKNOWN_OPTION;
 }
@@ -1575,10 +1783,9 @@ struct Curl_cftype Curl_cft_tcp = {
   CURL_LOG_LVL_NONE,
   cf_socket_destroy,
   cf_tcp_connect,
-  cf_socket_close,
-  cf_socket_get_host,
-  cf_socket_get_select_socks,
-  cf_socket_data_pending,
+  cf_socket_shutdown,
+  cf_socket_adjust_pollset,
+  Curl_cf_def_data_pending,
   cf_socket_send,
   cf_socket_recv,
   cf_socket_cntrl,
@@ -1589,38 +1796,91 @@ struct Curl_cftype Curl_cft_tcp = {
 
 CURLcode Curl_cf_tcp_create(struct Curl_cfilter **pcf,
                             struct Curl_easy *data,
+                            struct Curl_peer *origin,
+                            struct Curl_peer *peer,
+                            uint8_t transport_peer,
                             struct connectdata *conn,
-                            const struct Curl_addrinfo *ai,
-                            int transport)
+                            struct Curl_sockaddr_ex *addr,
+                            struct Curl_peer *tunnel_peer,
+                            uint8_t tunnel_transport)
 {
   struct cf_socket_ctx *ctx = NULL;
   struct Curl_cfilter *cf = NULL;
   CURLcode result;
 
   (void)data;
+  (void)origin;
   (void)conn;
-  DEBUGASSERT(transport == TRNSPRT_TCP);
-  ctx = calloc(sizeof(*ctx), 1);
+  (void)tunnel_peer;
+  (void)tunnel_transport;
+  DEBUGASSERT(transport_peer == TRNSPRT_TCP);
+  if(!addr) {
+    result = CURLE_BAD_FUNCTION_ARGUMENT;
+    goto out;
+  }
+
+  ctx = curlx_calloc(1, sizeof(*ctx));
   if(!ctx) {
     result = CURLE_OUT_OF_MEMORY;
     goto out;
   }
-  cf_socket_ctx_init(ctx, ai, transport);
+
+  result = cf_socket_ctx_init(ctx, peer, addr, transport_peer);
+  if(result)
+    goto out;
 
   result = Curl_cf_create(&cf, &Curl_cft_tcp, ctx);
 
 out:
-  *pcf = (!result)? cf : NULL;
+  *pcf = (!result) ? cf : NULL;
   if(result) {
-    Curl_safefree(cf);
-    Curl_safefree(ctx);
+    curlx_safefree(cf);
+    cf_socket_ctx_free(ctx);
   }
 
   return result;
 }
 
+#ifdef __linux__
+static void linux_quic_mtu(struct cf_socket_ctx *ctx)
+{
+  int val;
+  switch(ctx->addr.family) {
+#ifdef IP_MTU_DISCOVER
+  case AF_INET:
+    val = IP_PMTUDISC_DO;
+    (void)setsockopt(ctx->sock, IPPROTO_IP, IP_MTU_DISCOVER, &val,
+                     sizeof(val));
+    break;
+#endif
+#ifdef IPV6_MTU_DISCOVER
+  case AF_INET6:
+    val = IPV6_PMTUDISC_DO;
+    (void)setsockopt(ctx->sock, IPPROTO_IPV6, IPV6_MTU_DISCOVER, &val,
+                     sizeof(val));
+    break;
+#endif
+  }
+}
+#else
+#define linux_quic_mtu(x)
+#endif
+
+#if defined(UDP_GRO) &&                                                 \
+  (defined(HAVE_SENDMMSG) || defined(HAVE_SENDMSG)) &&                  \
+  ((defined(USE_NGTCP2) && defined(USE_NGHTTP3)) || defined(USE_QUICHE))
+static void linux_quic_gro(struct cf_socket_ctx *ctx)
+{
+  int one = 1;
+  (void)setsockopt(ctx->sock, IPPROTO_UDP, UDP_GRO, &one,
+                   (socklen_t)sizeof(one));
+}
+#else
+#define linux_quic_gro(x)
+#endif
+
 static CURLcode cf_udp_setup_quic(struct Curl_cfilter *cf,
-                               struct Curl_easy *data)
+                                  struct Curl_easy *data)
 {
   struct cf_socket_ctx *ctx = cf->ctx;
   int rc;
@@ -1628,55 +1888,50 @@ static CURLcode cf_udp_setup_quic(struct Curl_cfilter *cf,
   /* QUIC needs a connected socket, nonblocking */
   DEBUGASSERT(ctx->sock != CURL_SOCKET_BAD);
 
-  rc = connect(ctx->sock, &ctx->addr.sa_addr, ctx->addr.addrlen);
-  if(-1 == rc) {
-    return socket_connect_result(data, ctx->r_ip, SOCKERRNO);
+  /* error: The 1st argument to 'connect' is -1 but should be >= 0
+     NOLINTNEXTLINE(clang-analyzer-unix.StdCLibraryFunctions) */
+  rc = connect(ctx->sock, &ctx->addr.curl_sa_addr,
+               (curl_socklen_t)ctx->addr.addrlen);
+  if(rc == -1) {
+    return socket_connect_result(data, ctx->ip.remote_ip, SOCKERRNO);
   }
+  ctx->sock_connected = TRUE;
   set_local_ip(cf, data);
-  CURL_TRC_CF(data, cf, "%s socket %" CURL_FORMAT_SOCKET_T
+  CURL_TRC_CF(data, cf, "%s socket %" FMT_SOCKET_T
               " connected: [%s:%d] -> [%s:%d]",
-              (ctx->transport == TRNSPRT_QUIC)? "QUIC" : "UDP",
-              ctx->sock, ctx->l_ip, ctx->l_port, ctx->r_ip, ctx->r_port);
+              (ctx->transport == TRNSPRT_QUIC) ? "QUIC" : "UDP",
+              ctx->sock, ctx->ip.local_ip, ctx->ip.local_port,
+              ctx->ip.remote_ip, ctx->ip.remote_port);
+
+  /* Currently, cf->ctx->sock is always non-blocking because the only
+   * caller to cf_udp_setup_quic() is cf_udp_connect() that passes the
+   * non-blocking socket created by cf_socket_open() to it. Thus, we
+   * do not need to call curlx_nonblock() in cf_udp_setup_quic() anymore.
+   */
+  linux_quic_mtu(ctx);
+  linux_quic_gro(ctx);
 
-  (void)curlx_nonblock(ctx->sock, TRUE);
-  switch(ctx->addr.family) {
-#if defined(__linux__) && defined(IP_MTU_DISCOVER)
-  case AF_INET: {
-    int val = IP_PMTUDISC_DO;
-    (void)setsockopt(ctx->sock, IPPROTO_IP, IP_MTU_DISCOVER, &val,
-                     sizeof(val));
-    break;
-  }
-#endif
-#if defined(__linux__) && defined(IPV6_MTU_DISCOVER)
-  case AF_INET6: {
-    int val = IPV6_PMTUDISC_DO;
-    (void)setsockopt(ctx->sock, IPPROTO_IPV6, IPV6_MTU_DISCOVER, &val,
-                     sizeof(val));
-    break;
-  }
-#endif
-  }
   return CURLE_OK;
 }
 
 static CURLcode cf_udp_connect(struct Curl_cfilter *cf,
                                struct Curl_easy *data,
-                               bool blocking, bool *done)
+                               bool *done)
 {
   struct cf_socket_ctx *ctx = cf->ctx;
   CURLcode result = CURLE_COULDNT_CONNECT;
 
-  (void)blocking;
   if(cf->connected) {
     *done = TRUE;
     return CURLE_OK;
   }
+
   *done = FALSE;
   if(ctx->sock == CURL_SOCKET_BAD) {
     result = cf_socket_open(cf, data);
     if(result) {
-      CURL_TRC_CF(data, cf, "cf_udp_connect(), open failed -> %d", result);
+      CURL_TRC_CF(data, cf, "cf_udp_connect(), open failed -> %d",
+                  (int)result);
       goto out;
     }
 
@@ -1685,12 +1940,8 @@ static CURLcode cf_udp_connect(struct Curl_cfilter *cf,
       if(result)
         goto out;
       CURL_TRC_CF(data, cf, "cf_udp_connect(), opened socket=%"
-                  CURL_FORMAT_SOCKET_T " (%s:%d)",
-                  ctx->sock, ctx->l_ip, ctx->l_port);
-    }
-    else {
-      CURL_TRC_CF(data, cf, "cf_udp_connect(), opened socket=%"
-                  CURL_FORMAT_SOCKET_T " (unconnected)", ctx->sock);
+                  FMT_SOCKET_T " (%s:%d)",
+                  ctx->sock, ctx->ip.local_ip, ctx->ip.local_port);
     }
     *done = TRUE;
     cf->connected = TRUE;
@@ -1705,10 +1956,9 @@ struct Curl_cftype Curl_cft_udp = {
   CURL_LOG_LVL_NONE,
   cf_socket_destroy,
   cf_udp_connect,
-  cf_socket_close,
-  cf_socket_get_host,
-  cf_socket_get_select_socks,
-  cf_socket_data_pending,
+  cf_socket_shutdown,
+  cf_socket_adjust_pollset,
+  Curl_cf_def_data_pending,
   cf_socket_send,
   cf_socket_recv,
   cf_socket_cntrl,
@@ -1719,31 +1969,41 @@ struct Curl_cftype Curl_cft_udp = {
 
 CURLcode Curl_cf_udp_create(struct Curl_cfilter **pcf,
                             struct Curl_easy *data,
+                            struct Curl_peer *origin,
+                            struct Curl_peer *peer,
+                            uint8_t transport_peer,
                             struct connectdata *conn,
-                            const struct Curl_addrinfo *ai,
-                            int transport)
+                            struct Curl_sockaddr_ex *addr,
+                            struct Curl_peer *tunnel_peer,
+                            uint8_t tunnel_transport)
 {
   struct cf_socket_ctx *ctx = NULL;
   struct Curl_cfilter *cf = NULL;
   CURLcode result;
 
   (void)data;
+  (void)origin;
   (void)conn;
-  DEBUGASSERT(transport == TRNSPRT_UDP || transport == TRNSPRT_QUIC);
-  ctx = calloc(sizeof(*ctx), 1);
+  (void)tunnel_peer;
+  (void)tunnel_transport;
+  DEBUGASSERT(transport_peer == TRNSPRT_UDP || transport_peer == TRNSPRT_QUIC);
+  ctx = curlx_calloc(1, sizeof(*ctx));
   if(!ctx) {
     result = CURLE_OUT_OF_MEMORY;
     goto out;
   }
-  cf_socket_ctx_init(ctx, ai, transport);
+
+  result = cf_socket_ctx_init(ctx, peer, addr, transport_peer);
+  if(result)
+    goto out;
 
   result = Curl_cf_create(&cf, &Curl_cft_udp, ctx);
 
 out:
-  *pcf = (!result)? cf : NULL;
+  *pcf = (!result) ? cf : NULL;
   if(result) {
-    Curl_safefree(cf);
-    Curl_safefree(ctx);
+    curlx_safefree(cf);
+    cf_socket_ctx_free(ctx);
   }
 
   return result;
@@ -1756,10 +2016,9 @@ struct Curl_cftype Curl_cft_unix = {
   CURL_LOG_LVL_NONE,
   cf_socket_destroy,
   cf_tcp_connect,
-  cf_socket_close,
-  cf_socket_get_host,
-  cf_socket_get_select_socks,
-  cf_socket_data_pending,
+  cf_socket_shutdown,
+  cf_socket_adjust_pollset,
+  Curl_cf_def_data_pending,
   cf_socket_send,
   cf_socket_recv,
   cf_socket_cntrl,
@@ -1769,49 +2028,222 @@ struct Curl_cftype Curl_cft_unix = {
 };
 
 CURLcode Curl_cf_unix_create(struct Curl_cfilter **pcf,
-                             struct Curl_easy *data,
-                             struct connectdata *conn,
-                             const struct Curl_addrinfo *ai,
-                             int transport)
+                            struct Curl_easy *data,
+                            struct Curl_peer *origin,
+                            struct Curl_peer *peer,
+                            uint8_t transport_peer,
+                            struct connectdata *conn,
+                            struct Curl_sockaddr_ex *addr,
+                            struct Curl_peer *tunnel_peer,
+                            uint8_t tunnel_transport)
 {
   struct cf_socket_ctx *ctx = NULL;
   struct Curl_cfilter *cf = NULL;
   CURLcode result;
 
   (void)data;
+  (void)origin;
   (void)conn;
-  DEBUGASSERT(transport == TRNSPRT_UNIX);
-  ctx = calloc(sizeof(*ctx), 1);
+  (void)tunnel_peer;
+  (void)tunnel_transport;
+  DEBUGASSERT(transport_peer == TRNSPRT_UNIX);
+  ctx = curlx_calloc(1, sizeof(*ctx));
   if(!ctx) {
     result = CURLE_OUT_OF_MEMORY;
     goto out;
   }
-  cf_socket_ctx_init(ctx, ai, transport);
+
+  result = cf_socket_ctx_init(ctx, peer, addr, transport_peer);
+  if(result)
+    goto out;
 
   result = Curl_cf_create(&cf, &Curl_cft_unix, ctx);
 
 out:
-  *pcf = (!result)? cf : NULL;
+  *pcf = (!result) ? cf : NULL;
   if(result) {
-    Curl_safefree(cf);
-    Curl_safefree(ctx);
+    curlx_safefree(cf);
+    cf_socket_ctx_free(ctx);
   }
 
   return result;
 }
 
+static timediff_t cf_tcp_accept_timeleft(struct Curl_cfilter *cf,
+                                         struct Curl_easy *data)
+{
+  struct cf_socket_ctx *ctx = cf->ctx;
+  timediff_t timeout_ms = DEFAULT_ACCEPT_TIMEOUT;
+  timediff_t other_ms;
+
+#ifndef CURL_DISABLE_FTP
+  if(data->set.accepttimeout > 0)
+    timeout_ms = data->set.accepttimeout;
+#endif
+
+  /* check if the generic timeout possibly is set shorter */
+  other_ms = Curl_timeleft_ms(data);
+  if(other_ms && (other_ms < timeout_ms))
+    /* note that this also works fine for when other_ms happens to be negative
+       due to it already having elapsed */
+    timeout_ms = other_ms;
+  else {
+    /* subtract elapsed time */
+    timeout_ms -= curlx_ptimediff_ms(Curl_pgrs_now(data), &ctx->started_at);
+    if(!timeout_ms)
+      /* avoid returning 0 as that means no timeout! */
+      timeout_ms = -1;
+  }
+  return timeout_ms;
+}
+
+static void cf_tcp_set_accepted_remote_ip(struct Curl_cfilter *cf,
+                                          struct Curl_easy *data)
+{
+  struct cf_socket_ctx *ctx = cf->ctx;
+#ifdef HAVE_GETPEERNAME
+  char buffer[STRERROR_LEN];
+  struct Curl_sockaddr_storage ssrem;
+  curl_socklen_t plen;
+
+  ctx->ip.remote_ip[0] = 0;
+  ctx->ip.remote_port = 0;
+  plen = sizeof(ssrem);
+  memset(&ssrem, 0, plen);
+  if(getpeername(ctx->sock, (struct sockaddr *)&ssrem, &plen)) {
+    int sockerr = SOCKERRNO;
+    failf(data, "getpeername() failed with errno %d: %s",
+          sockerr, curlx_strerror(sockerr, buffer, sizeof(buffer)));
+    return;
+  }
+  if(!sockaddr2string((struct sockaddr *)&ssrem, plen,
+                      ctx->ip.remote_ip, &ctx->ip.remote_port)) {
+    failf(data, "ssrem inet_ntop() failed with errno %d: %s",
+          errno, curlx_strerror(errno, buffer, sizeof(buffer)));
+    return;
+  }
+#else
+  ctx->ip.remote_ip[0] = 0;
+  ctx->ip.remote_port = 0;
+  (void)data;
+#endif
+}
+
 static CURLcode cf_tcp_accept_connect(struct Curl_cfilter *cf,
                                       struct Curl_easy *data,
-                                      bool blocking, bool *done)
+                                      bool *done)
 {
+  struct cf_socket_ctx *ctx = cf->ctx;
+  char errbuf[STRERROR_LEN];
+#ifdef USE_IPV6
+  struct Curl_sockaddr_storage add;
+#else
+  struct sockaddr_in add;
+#endif
+  curl_socklen_t size = (curl_socklen_t)sizeof(add);
+  curl_socket_t s_accepted = CURL_SOCKET_BAD;
+  timediff_t timeout_ms;
+  int socketstate = 0;
+  bool incoming = FALSE;
+
   /* we start accepted, if we ever close, we cannot go on */
   (void)data;
-  (void)blocking;
   if(cf->connected) {
     *done = TRUE;
     return CURLE_OK;
   }
-  return CURLE_FAILED_INIT;
+
+  *done = FALSE;
+  timeout_ms = cf_tcp_accept_timeleft(cf, data);
+  if(timeout_ms < 0) {
+    /* if a timeout was already reached, bail out */
+    failf(data, "Accept timeout occurred while waiting server connect");
+    return CURLE_FTP_ACCEPT_TIMEOUT;
+  }
+
+  CURL_TRC_CF(data, cf, "Checking for incoming on fd=%" FMT_SOCKET_T
+              " ip=%s:%d", ctx->sock, ctx->ip.local_ip, ctx->ip.local_port);
+  socketstate = SOCKET_READABLE(ctx->sock, 0);
+  CURL_TRC_CF(data, cf, "socket_check -> %x", (unsigned int)socketstate);
+  switch(socketstate) {
+  case -1: /* error */
+    /* let's die here */
+    failf(data, "Error while waiting for server connect");
+    return CURLE_FTP_ACCEPT_FAILED;
+  default:
+    if(socketstate & CURL_CSELECT_IN) {
+      infof(data, "Ready to accept data connection from server");
+      incoming = TRUE;
+    }
+    break;
+  }
+
+  if(!incoming) {
+    CURL_TRC_CF(data, cf, "nothing heard from the server yet");
+    return CURLE_OK;
+  }
+
+  size = sizeof(add);
+#ifdef HAVE_ACCEPT4
+  s_accepted = CURL_ACCEPT4(ctx->sock, (struct sockaddr *)&add, &size,
+                            SOCK_NONBLOCK | SOCK_CLOEXEC);
+#else
+  s_accepted = CURL_ACCEPT(ctx->sock, (struct sockaddr *)&add, &size);
+#endif
+
+  if(s_accepted == CURL_SOCKET_BAD) {
+    failf(data, "Error accept()ing server connect: %s",
+          curlx_strerror(SOCKERRNO, errbuf, sizeof(errbuf)));
+    return CURLE_FTP_ACCEPT_FAILED;
+  }
+#ifndef HAVE_ACCEPT4
+#ifdef HAVE_FCNTL
+  if(fcntl(s_accepted, F_SETFD, FD_CLOEXEC) < 0) {
+    failf(data, "fcntl set CLOEXEC: %s",
+          curlx_strerror(SOCKERRNO, errbuf, sizeof(errbuf)));
+    Curl_socket_close(data, cf->conn, s_accepted);
+    return CURLE_FTP_ACCEPT_FAILED;
+  }
+#endif /* HAVE_FCNTL */
+  if(curlx_nonblock(s_accepted, TRUE) < 0) {
+    failf(data, "set socket NONBLOCK: %s",
+          curlx_strerror(SOCKERRNO, errbuf, sizeof(errbuf)));
+    Curl_socket_close(data, cf->conn, s_accepted);
+    return CURLE_FTP_ACCEPT_FAILED;
+  }
+#endif /* !HAVE_ACCEPT4 */
+  infof(data, "Connection accepted from server");
+
+  /* Replace any filter on SECONDARY with one listening on this socket */
+  ctx->listening = FALSE;
+  ctx->accepted = TRUE;
+  socket_close(data, cf->conn, TRUE, ctx->sock);
+  ctx->sock = s_accepted;
+
+  cf->conn->sock[cf->sockindex] = ctx->sock;
+  cf_tcp_set_accepted_remote_ip(cf, data);
+  set_local_ip(cf, data);
+  ctx->active = TRUE;
+  ctx->connected_at = *Curl_pgrs_now(data);
+  cf->connected = TRUE;
+  CURL_TRC_CF(data, cf, "accepted_set(sock=%" FMT_SOCKET_T
+              ", remote=%s port=%d)",
+              ctx->sock, ctx->ip.remote_ip, ctx->ip.remote_port);
+
+  if(data->set.fsockopt) {
+    int error = 0;
+
+    /* activate callback for setting socket options */
+    Curl_set_in_callback(data, TRUE);
+    error = data->set.fsockopt(data->set.sockopt_client,
+                               ctx->sock, CURLSOCKTYPE_ACCEPT);
+    Curl_set_in_callback(data, FALSE);
+
+    if(error)
+      return CURLE_ABORTED_BY_CALLBACK;
+  }
+  *done = TRUE;
+  return CURLE_OK;
 }
 
 struct Curl_cftype Curl_cft_tcp_accept = {
@@ -1820,10 +2252,9 @@ struct Curl_cftype Curl_cft_tcp_accept = {
   CURL_LOG_LVL_NONE,
   cf_socket_destroy,
   cf_tcp_accept_connect,
-  cf_socket_close,
-  cf_socket_get_host,              /* TODO: not accurate */
-  cf_socket_get_select_socks,
-  cf_socket_data_pending,
+  cf_socket_shutdown,
+  cf_socket_adjust_pollset,
+  Curl_cf_def_data_pending,
   cf_socket_send,
   cf_socket_recv,
   cf_socket_cntrl,
@@ -1844,94 +2275,45 @@ CURLcode Curl_conn_tcp_listen_set(struct Curl_easy *data,
   Curl_conn_cf_discard_all(data, conn, sockindex);
   DEBUGASSERT(conn->sock[sockindex] == CURL_SOCKET_BAD);
 
-  ctx = calloc(sizeof(*ctx), 1);
+  ctx = curlx_calloc(1, sizeof(*ctx));
   if(!ctx) {
     result = CURLE_OUT_OF_MEMORY;
     goto out;
   }
-  ctx->transport = conn->transport;
+  ctx->transport = TRNSPRT_TCP;
   ctx->sock = *s;
+  ctx->listening = TRUE;
   ctx->accepted = FALSE;
   result = Curl_cf_create(&cf, &Curl_cft_tcp_accept, ctx);
   if(result)
     goto out;
   Curl_conn_cf_add(data, conn, sockindex, cf);
 
+  ctx->started_at = *Curl_pgrs_now(data);
   conn->sock[sockindex] = ctx->sock;
   set_local_ip(cf, data);
-  ctx->active = TRUE;
-  ctx->connected_at = Curl_now();
-  cf->connected = TRUE;
-  CURL_TRC_CF(data, cf, "Curl_conn_tcp_listen_set(%"
-              CURL_FORMAT_SOCKET_T ")", ctx->sock);
+  CURL_TRC_CF(data, cf, "set filter for listen socket fd=%" FMT_SOCKET_T
+              " ip=%s:%d", ctx->sock,
+              ctx->ip.local_ip, ctx->ip.local_port);
 
 out:
   if(result) {
-    Curl_safefree(cf);
-    Curl_safefree(ctx);
+    curlx_safefree(cf);
+    curlx_safefree(ctx);
   }
   return result;
 }
 
-static void set_accepted_remote_ip(struct Curl_cfilter *cf,
-                                   struct Curl_easy *data)
+bool Curl_conn_is_tcp_listen(struct Curl_easy *data,
+                             int sockindex)
 {
-  struct cf_socket_ctx *ctx = cf->ctx;
-#ifdef HAVE_GETPEERNAME
-  char buffer[STRERROR_LEN];
-  struct Curl_sockaddr_storage ssrem;
-  curl_socklen_t plen;
-
-  ctx->r_ip[0] = 0;
-  ctx->r_port = 0;
-  plen = sizeof(ssrem);
-  memset(&ssrem, 0, plen);
-  if(getpeername(ctx->sock, (struct sockaddr*) &ssrem, &plen)) {
-    int error = SOCKERRNO;
-    failf(data, "getpeername() failed with errno %d: %s",
-          error, Curl_strerror(error, buffer, sizeof(buffer)));
-    return;
+  struct Curl_cfilter *cf = data->conn->cfilter[sockindex];
+  while(cf) {
+    if(cf->cft == &Curl_cft_tcp_accept)
+      return TRUE;
+    cf = cf->next;
   }
-  if(!Curl_addr2string((struct sockaddr*)&ssrem, plen,
-                       ctx->r_ip, &ctx->r_port)) {
-    failf(data, "ssrem inet_ntop() failed with errno %d: %s",
-          errno, Curl_strerror(errno, buffer, sizeof(buffer)));
-    return;
-  }
-#else
-  ctx->r_ip[0] = 0;
-  ctx->r_port = 0;
-  (void)data;
-#endif
-}
-
-CURLcode Curl_conn_tcp_accepted_set(struct Curl_easy *data,
-                                    struct connectdata *conn,
-                                    int sockindex, curl_socket_t *s)
-{
-  struct Curl_cfilter *cf = NULL;
-  struct cf_socket_ctx *ctx = NULL;
-
-  cf = conn->cfilter[sockindex];
-  if(!cf || cf->cft != &Curl_cft_tcp_accept)
-    return CURLE_FAILED_INIT;
-
-  ctx = cf->ctx;
-  /* discard the listen socket */
-  socket_close(data, conn, TRUE, ctx->sock);
-  ctx->sock = *s;
-  conn->sock[sockindex] = ctx->sock;
-  set_accepted_remote_ip(cf, data);
-  set_local_ip(cf, data);
-  ctx->active = TRUE;
-  ctx->accepted = TRUE;
-  ctx->connected_at = Curl_now();
-  cf->connected = TRUE;
-  CURL_TRC_CF(data, cf, "accepted_set(sock=%" CURL_FORMAT_SOCKET_T
-              ", remote=%s port=%d)",
-              ctx->sock, ctx->r_ip, ctx->r_port);
-
-  return CURLE_OK;
+  return FALSE;
 }
 
 /**
@@ -1949,9 +2331,9 @@ CURLcode Curl_cf_socket_peek(struct Curl_cfilter *cf,
                              struct Curl_easy *data,
                              curl_socket_t *psock,
                              const struct Curl_sockaddr_ex **paddr,
-                             const char **pr_ip_str, int *pr_port,
-                             const char **pl_ip_str, int *pl_port)
+                             struct ip_quadruple *pip)
 {
+  (void)data;
   if(cf_is_socket(cf) && cf->ctx) {
     struct cf_socket_ctx *ctx = cf->ctx;
 
@@ -1959,17 +2341,8 @@ CURLcode Curl_cf_socket_peek(struct Curl_cfilter *cf,
       *psock = ctx->sock;
     if(paddr)
       *paddr = &ctx->addr;
-    if(pr_ip_str)
-      *pr_ip_str = ctx->r_ip;
-    if(pr_port)
-      *pr_port = ctx->r_port;
-    if(pl_port ||pl_ip_str) {
-      set_local_ip(cf, data);
-      if(pl_ip_str)
-        *pl_ip_str = ctx->l_ip;
-      if(pl_port)
-        *pl_port = ctx->l_port;
-    }
+    if(pip)
+      *pip = ctx->ip;
     return CURLE_OK;
   }
   return CURLE_FAILED_INIT;
diff --git a/third-party/curl/lib/cf-socket.h b/third-party/curl/lib/cf-socket.h
index 1d40df737f..37ddc02576 100644
--- a/third-party/curl/lib/cf-socket.h
+++ b/third-party/curl/lib/cf-socket.h
@@ -25,51 +25,25 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
-#include "nonblock.h" /* for curlx_nonblock(), formerly Curl_nonblock() */
-#include "sockaddr.h"
-
 struct Curl_addrinfo;
 struct Curl_cfilter;
 struct Curl_easy;
 struct connectdata;
 struct Curl_sockaddr_ex;
+struct ip_quadruple;
 
-#ifndef SIZEOF_CURL_SOCKET_T
-/* configure and cmake check and set the define */
-# ifdef _WIN64
-#  define SIZEOF_CURL_SOCKET_T 8
-# else
-/* default guess */
-#  define SIZEOF_CURL_SOCKET_T 4
-# endif
-#endif
-
-#if SIZEOF_CURL_SOCKET_T < 8
-# define CURL_FORMAT_SOCKET_T "d"
-#else
-# define CURL_FORMAT_SOCKET_T "qd"
-#endif
-
+#define curl_sa_addr    addr.sa
+#define curl_sa_addrbuf addr.buf
 
 /*
- * The Curl_sockaddr_ex structure is basically libcurl's external API
- * curl_sockaddr structure with enough space available to directly hold any
- * protocol-specific address structures. The variable declared here will be
- * used to pass / receive data to/from the fopensocket callback if this has
- * been set, before that, it is initialized from parameters.
+ * Parse interface option, and return the interface name and the host part.
  */
-struct Curl_sockaddr_ex {
-  int family;
-  int socktype;
-  int protocol;
-  unsigned int addrlen;
-  union {
-    struct sockaddr addr;
-    struct Curl_sockaddr_storage buff;
-  } _sa_ex_u;
-};
-#define sa_addr _sa_ex_u.addr
+CURLcode Curl_parse_interface(const char *input,
+                              char **dev, char **iface, char **host);
 
+CURLcode Curl_socket_addr_from_ai(struct Curl_sockaddr_ex *addr,
+                                  const struct Curl_addrinfo *ai,
+                                  uint8_t transport);
 
 /*
  * Create a socket based on info from 'conn' and 'ai'.
@@ -79,37 +53,19 @@ struct Curl_sockaddr_ex {
  *
  */
 CURLcode Curl_socket_open(struct Curl_easy *data,
-                            const struct Curl_addrinfo *ai,
-                            struct Curl_sockaddr_ex *addr,
-                            int transport,
-                            curl_socket_t *sockfd);
+                          const struct Curl_addrinfo *ai,
+                          struct Curl_sockaddr_ex *addr,
+                          uint8_t transport,
+                          curl_socket_t *sockfd);
+
+#ifdef USE_SO_NOSIGPIPE
+/* Set SO_NOSIGPIPE on socket, return < 0 on error. */
+int Curl_sock_nosigpipe(curl_socket_t sockfd);
+#endif
 
 int Curl_socket_close(struct Curl_easy *data, struct connectdata *conn,
                       curl_socket_t sock);
 
-#ifdef USE_WINSOCK
-/* When you run a program that uses the Windows Sockets API, you may
-   experience slow performance when you copy data to a TCP server.
-
-   https://support.microsoft.com/kb/823764
-
-   Work-around: Make the Socket Send Buffer Size Larger Than the Program Send
-   Buffer Size
-
-*/
-void Curl_sndbufset(curl_socket_t sockfd);
-#else
-#define Curl_sndbufset(y) Curl_nop_stmt
-#endif
-
-/**
- * Assign the address `ai` to the Curl_sockaddr_ex `dest` and
- * set the transport used.
- */
-void Curl_sock_assign_addr(struct Curl_sockaddr_ex *dest,
-                           const struct Curl_addrinfo *ai,
-                           int transport);
-
 /**
  * Creates a cfilter that opens a TCP socket to the given address
  * when calling its `connect` implementation.
@@ -119,9 +75,13 @@ void Curl_sock_assign_addr(struct Curl_sockaddr_ex *dest,
  */
 CURLcode Curl_cf_tcp_create(struct Curl_cfilter **pcf,
                             struct Curl_easy *data,
+                            struct Curl_peer *origin,
+                            struct Curl_peer *peer,
+                            uint8_t transport_peer,
                             struct connectdata *conn,
-                            const struct Curl_addrinfo *ai,
-                            int transport);
+                            struct Curl_sockaddr_ex *addr,
+                            struct Curl_peer *tunnel_peer,
+                            uint8_t tunnel_transport);
 
 /**
  * Creates a cfilter that opens a UDP socket to the given address
@@ -132,9 +92,13 @@ CURLcode Curl_cf_tcp_create(struct Curl_cfilter **pcf,
  */
 CURLcode Curl_cf_udp_create(struct Curl_cfilter **pcf,
                             struct Curl_easy *data,
+                            struct Curl_peer *origin,
+                            struct Curl_peer *peer,
+                            uint8_t transport_peer,
                             struct connectdata *conn,
-                            const struct Curl_addrinfo *ai,
-                            int transport);
+                            struct Curl_sockaddr_ex *addr,
+                            struct Curl_peer *tunnel_peer,
+                            uint8_t tunnel_transport);
 
 /**
  * Creates a cfilter that opens a UNIX socket to the given address
@@ -145,9 +109,13 @@ CURLcode Curl_cf_udp_create(struct Curl_cfilter **pcf,
  */
 CURLcode Curl_cf_unix_create(struct Curl_cfilter **pcf,
                              struct Curl_easy *data,
+                             struct Curl_peer *origin,
+                             struct Curl_peer *peer,
+                             uint8_t transport_peer,
                              struct connectdata *conn,
-                             const struct Curl_addrinfo *ai,
-                             int transport);
+                             struct Curl_sockaddr_ex *addr,
+                             struct Curl_peer *tunnel_peer,
+                             uint8_t tunnel_transport);
 
 /**
  * Creates a cfilter that keeps a listening socket.
@@ -158,30 +126,25 @@ CURLcode Curl_conn_tcp_listen_set(struct Curl_easy *data,
                                   curl_socket_t *s);
 
 /**
- * Replace the listen socket with the accept()ed one.
+ * Return TRUE iff the last filter at `sockindex` was set via
+ * Curl_conn_tcp_listen_set().
  */
-CURLcode Curl_conn_tcp_accepted_set(struct Curl_easy *data,
-                                    struct connectdata *conn,
-                                    int sockindex,
-                                    curl_socket_t *s);
+bool Curl_conn_is_tcp_listen(struct Curl_easy *data,
+                             int sockindex);
 
 /**
  * Peek at the socket and remote ip/port the socket filter is using.
  * The filter owns all returned values.
  * @param psock             pointer to hold socket descriptor or NULL
  * @param paddr             pointer to hold addr reference or NULL
- * @param pr_ip_str         pointer to hold remote addr as string or NULL
- * @param pr_port           pointer to hold remote port number or NULL
- * @param pl_ip_str         pointer to hold local addr as string or NULL
- * @param pl_port           pointer to hold local port number or NULL
+ * @param pip               pointer to get IP quadruple or NULL
  * Returns error if the filter is of invalid type.
  */
 CURLcode Curl_cf_socket_peek(struct Curl_cfilter *cf,
                              struct Curl_easy *data,
                              curl_socket_t *psock,
                              const struct Curl_sockaddr_ex **paddr,
-                             const char **pr_ip_str, int *pr_port,
-                             const char **pl_ip_str, int *pl_port);
+                             struct ip_quadruple *pip) WARN_UNUSED_RESULT;
 
 extern struct Curl_cftype Curl_cft_tcp;
 extern struct Curl_cftype Curl_cft_udp;
diff --git a/third-party/curl/lib/cfilters.c b/third-party/curl/lib/cfilters.c
index f74eb40039..fb1914d133 100644
--- a/third-party/curl/lib/cfilters.c
+++ b/third-party/curl/lib/cfilters.c
@@ -21,91 +21,90 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #include "urldata.h"
 #include "strerror.h"
 #include "cfilters.h"
 #include "connect.h"
-#include "url.h" /* for Curl_safefree() */
-#include "sendf.h"
-#include "sockaddr.h" /* required for Curl_sockaddr_storage */
-#include "multiif.h"
+#include "url.h"
+#include "curl_trc.h"
 #include "progress.h"
-#include "warnless.h"
+#include "select.h"
+#include "curlx/strparse.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-#ifndef ARRAYSIZE
-#define ARRAYSIZE(A) (sizeof(A)/sizeof((A)[0]))
-#endif
-
-#ifdef DEBUGBUILD
-/* used by unit2600.c */
-void Curl_cf_def_close(struct Curl_cfilter *cf, struct Curl_easy *data)
+CURLcode Curl_cf_def_connect(struct Curl_cfilter *cf,
+                              struct Curl_easy *data, bool *done)
 {
-  cf->connected = FALSE;
-  if(cf->next)
-    cf->next->cft->do_close(cf->next, data);
-}
-#endif
+  CURLcode result;
 
-static void conn_report_connect_stats(struct Curl_easy *data,
-                                      struct connectdata *conn);
-
-void Curl_cf_def_get_host(struct Curl_cfilter *cf, struct Curl_easy *data,
-                          const char **phost, const char **pdisplay_host,
-                          int *pport)
-{
-  if(cf->next)
-    cf->next->cft->get_host(cf->next, data, phost, pdisplay_host, pport);
-  else {
-    *phost = cf->conn->host.name;
-    *pdisplay_host = cf->conn->host.dispname;
-    *pport = cf->conn->port;
+  if(cf->connected) {
+    *done = TRUE;
+    return CURLE_OK;
   }
+
+  if(cf->next) {
+    result = cf->next->cft->do_connect(cf->next, data, done);
+    if(result || !*done)
+      return result;
+  }
+
+  cf->connected = TRUE;
+  *done = TRUE;
+  return CURLE_OK;
 }
 
-int Curl_cf_def_get_select_socks(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data,
-                                 curl_socket_t *socks)
+CURLcode Curl_cf_def_shutdown(struct Curl_cfilter *cf,
+                              struct Curl_easy *data, bool *done)
 {
-  return cf->next?
-    cf->next->cft->get_select_socks(cf->next, data, socks) : 0;
+  (void)cf;
+  (void)data;
+  *done = TRUE;
+  return CURLE_OK;
+}
+
+CURLcode Curl_cf_def_adjust_pollset(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    struct easy_pollset *ps)
+{
+  /* NOP */
+  (void)cf;
+  (void)data;
+  (void)ps;
+  return CURLE_OK;
 }
 
 bool Curl_cf_def_data_pending(struct Curl_cfilter *cf,
                               const struct Curl_easy *data)
 {
-  return cf->next?
+  return cf->next ?
     cf->next->cft->has_data_pending(cf->next, data) : FALSE;
 }
 
-ssize_t  Curl_cf_def_send(struct Curl_cfilter *cf, struct Curl_easy *data,
-                          const void *buf, size_t len, CURLcode *err)
+CURLcode Curl_cf_def_send(struct Curl_cfilter *cf, struct Curl_easy *data,
+                          const uint8_t *buf, size_t len, bool eos,
+                          size_t *pnwritten)
 {
-  return cf->next?
-    cf->next->cft->do_send(cf->next, data, buf, len, err) :
-    CURLE_RECV_ERROR;
+  if(cf->next)
+    return cf->next->cft->do_send(cf->next, data, buf, len, eos, pnwritten);
+  *pnwritten = 0;
+  return CURLE_RECV_ERROR;
 }
 
-ssize_t  Curl_cf_def_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
-                          char *buf, size_t len, CURLcode *err)
+CURLcode Curl_cf_def_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
+                          char *buf, size_t len, size_t *pnread)
 {
-  return cf->next?
-    cf->next->cft->do_recv(cf->next, data, buf, len, err) :
-    CURLE_SEND_ERROR;
+  if(cf->next)
+    return cf->next->cft->do_recv(cf->next, data, buf, len, pnread);
+  *pnread = 0;
+  return CURLE_SEND_ERROR;
 }
 
 bool Curl_cf_def_conn_is_alive(struct Curl_cfilter *cf,
                                struct Curl_easy *data,
                                bool *input_pending)
 {
-  return cf->next?
+  return cf->next ?
     cf->next->cft->is_alive(cf->next, data, input_pending) :
     FALSE; /* pessimistic in absence of data */
 }
@@ -113,7 +112,7 @@ bool Curl_cf_def_conn_is_alive(struct Curl_cfilter *cf,
 CURLcode Curl_cf_def_conn_keep_alive(struct Curl_cfilter *cf,
                                      struct Curl_easy *data)
 {
-  return cf->next?
+  return cf->next ?
     cf->next->cft->keep_alive(cf->next, data) :
     CURLE_OK;
 }
@@ -122,11 +121,41 @@ CURLcode Curl_cf_def_query(struct Curl_cfilter *cf,
                            struct Curl_easy *data,
                            int query, int *pres1, void *pres2)
 {
-  return cf->next?
+  return cf->next ?
     cf->next->cft->query(cf->next, data, query, pres1, pres2) :
     CURLE_UNKNOWN_OPTION;
 }
 
+#ifdef CURLVERBOSE
+void Curl_conn_trc_filters(struct Curl_easy *data,
+                           int sockindex, const char *info)
+{
+  if(CURL_TRC_M_is_verbose(data) && data->conn) {
+    struct Curl_cfilter *cf = data->conn->cfilter[sockindex];
+
+    if(cf) {
+      char msg[256], *buf;
+      int blen, n;
+
+      buf = msg;
+      blen = sizeof(msg) - 1;
+      n = curl_msnprintf(buf, blen, "%s [%d]", info, sockindex);
+      buf += n;
+      blen -= n;
+      for(; cf && blen; cf = cf->next) {
+        n = curl_msnprintf(buf, blen, "[%s%s]",
+                           cf->connected ? "" : "!", cf->cft->name);
+        buf += n;
+        blen -= n;
+      }
+      CURL_TRC_M(data, "%s%s", msg, blen ? "" : "...");
+    }
+    else
+      CURL_TRC_M(data, "%s [%d][-]", info, sockindex);
+  }
+}
+#endif /* CURLVERBOSE */
+
 void Curl_conn_cf_discard_chain(struct Curl_cfilter **pcf,
                                 struct Curl_easy *data)
 {
@@ -141,67 +170,170 @@ void Curl_conn_cf_discard_chain(struct Curl_cfilter **pcf,
        */
       cf->next = NULL;
       cf->cft->destroy(cf, data);
-      free(cf);
+      curlx_free(cf);
       cf = cfn;
     }
   }
 }
 
 void Curl_conn_cf_discard_all(struct Curl_easy *data,
-                              struct connectdata *conn, int index)
+                              struct connectdata *conn, int sockindex)
 {
-  Curl_conn_cf_discard_chain(&conn->cfilter[index], data);
+  struct curltime *pt = &conn->shutdown.start[sockindex];
+  memset(pt, 0, sizeof(*pt));
+  Curl_conn_cf_discard_chain(&conn->cfilter[sockindex], data);
 }
 
-void Curl_conn_close(struct Curl_easy *data, int index)
+CURLcode Curl_conn_shutdown(struct Curl_easy *data, int sockindex, bool *done)
 {
   struct Curl_cfilter *cf;
+  CURLcode result = CURLE_OK;
+  timediff_t timeout_ms;
 
   DEBUGASSERT(data->conn);
-  /* it is valid to call that without filters being present */
-  cf = data->conn->cfilter[index];
-  if(cf) {
-    cf->cft->do_close(cf, data);
+
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  /* Get the first connected filter that is not shut down already. */
+  cf = data->conn->cfilter[sockindex];
+  while(cf && (!cf->connected || cf->shutdown))
+    cf = cf->next;
+
+  if(!cf) {
+    *done = TRUE;
+    return CURLE_OK;
   }
+
+  *done = FALSE;
+  if(!Curl_shutdown_started(data, sockindex)) {
+    Curl_shutdown_start(data, sockindex, 0);
+  }
+  else {
+    timeout_ms = Curl_shutdown_timeleft(data, data->conn, sockindex);
+    if(timeout_ms < 0) {
+      /* info message, since this might be regarded as acceptable */
+      infof(data, "shutdown timeout");
+      return CURLE_OPERATION_TIMEDOUT;
+    }
+  }
+
+  while(cf) {
+    if(!cf->shutdown) {
+      bool cfdone = FALSE;
+      result = cf->cft->do_shutdown(cf, data, &cfdone);
+      if(result) {
+        CURL_TRC_CF(data, cf, "shut down failed with %d", (int)result);
+        return result;
+      }
+      else if(!cfdone) {
+        CURL_TRC_CF(data, cf, "shut down not done yet");
+        return CURLE_OK;
+      }
+      CURL_TRC_CF(data, cf, "shut down successfully");
+      cf->shutdown = TRUE;
+    }
+    cf = cf->next;
+  }
+  *done = (!result);
+  return result;
 }
 
-ssize_t Curl_conn_recv(struct Curl_easy *data, int num, char *buf,
-                       size_t len, CURLcode *code)
+CURLcode Curl_cf_recv(struct Curl_easy *data, int sockindex, char *buf,
+                      size_t len, size_t *pnread)
 {
   struct Curl_cfilter *cf;
 
   DEBUGASSERT(data);
   DEBUGASSERT(data->conn);
-  cf = data->conn->cfilter[num];
-  while(cf && !cf->connected) {
+  cf = data->conn->cfilter[sockindex];
+  while(cf && !cf->connected)
     cf = cf->next;
-  }
-  if(cf) {
-    return cf->cft->do_recv(cf, data, buf, len, code);
-  }
+  if(cf)
+    return cf->cft->do_recv(cf, data, buf, len, pnread);
   failf(data, "recv: no filter connected");
-  *code = CURLE_FAILED_INIT;
-  return -1;
+  DEBUGASSERT(0);
+  *pnread = 0;
+  return CURLE_FAILED_INIT;
 }
 
-ssize_t Curl_conn_send(struct Curl_easy *data, int num,
-                       const void *mem, size_t len, CURLcode *code)
+CURLcode Curl_cf_send(struct Curl_easy *data, int sockindex,
+                      const uint8_t *buf, size_t len, bool eos,
+                      size_t *pnwritten)
 {
   struct Curl_cfilter *cf;
 
   DEBUGASSERT(data);
   DEBUGASSERT(data->conn);
-  cf = data->conn->cfilter[num];
-  while(cf && !cf->connected) {
+  cf = data->conn->cfilter[sockindex];
+  while(cf && !cf->connected)
     cf = cf->next;
-  }
   if(cf) {
-    return cf->cft->do_send(cf, data, mem, len, code);
+    return cf->cft->do_send(cf, data, buf, len, eos, pnwritten);
   }
   failf(data, "send: no filter connected");
   DEBUGASSERT(0);
-  *code = CURLE_FAILED_INIT;
-  return -1;
+  *pnwritten = 0;
+  return CURLE_FAILED_INIT;
+}
+
+struct cf_io_ctx {
+  struct Curl_easy *data;
+  struct Curl_cfilter *cf;
+};
+
+static CURLcode cf_bufq_reader(void *writer_ctx,
+                               unsigned char *buf, size_t blen,
+                               size_t *pnread)
+{
+  struct cf_io_ctx *io = writer_ctx;
+  return Curl_conn_cf_recv(io->cf, io->data, (char *)buf, blen, pnread);
+}
+
+CURLcode Curl_cf_recv_bufq(struct Curl_cfilter *cf,
+                           struct Curl_easy *data,
+                           struct bufq *bufq,
+                           size_t maxlen,
+                           size_t *pnread)
+{
+  struct cf_io_ctx io;
+
+  if(!cf || !data) {
+    *pnread = 0;
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
+  io.data = data;
+  io.cf = cf;
+  return Curl_bufq_sipn(bufq, maxlen, cf_bufq_reader, &io, pnread);
+}
+
+static CURLcode cf_bufq_writer(void *writer_ctx,
+                               const uint8_t *buf, size_t buflen,
+                               size_t *pnwritten)
+{
+  struct cf_io_ctx *io = writer_ctx;
+  return Curl_conn_cf_send(io->cf, io->data, buf, buflen, FALSE, pnwritten);
+}
+
+CURLcode Curl_cf_send_bufq(struct Curl_cfilter *cf,
+                           struct Curl_easy *data,
+                           struct bufq *bufq,
+                           const unsigned char *buf, size_t blen,
+                           size_t *pnwritten)
+{
+  struct cf_io_ctx io;
+
+  if(!cf || !data) {
+    *pnwritten = 0;
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
+  io.data = data;
+  io.cf = cf;
+  if(buf && blen)
+    return Curl_bufq_write_pass(bufq, buf, blen, cf_bufq_writer, &io,
+                                pnwritten);
+  else
+    return Curl_bufq_pass(bufq, cf_bufq_writer, &io, pnwritten);
 }
 
 CURLcode Curl_cf_create(struct Curl_cfilter **pcf,
@@ -212,7 +344,7 @@ CURLcode Curl_cf_create(struct Curl_cfilter **pcf,
   CURLcode result = CURLE_OUT_OF_MEMORY;
 
   DEBUGASSERT(cft);
-  cf = calloc(sizeof(*cf), 1);
+  cf = curlx_calloc(1, sizeof(*cf));
   if(!cf)
     goto out;
 
@@ -226,18 +358,17 @@ out:
 
 void Curl_conn_cf_add(struct Curl_easy *data,
                       struct connectdata *conn,
-                      int index,
+                      int sockindex,
                       struct Curl_cfilter *cf)
 {
-  (void)data;
   DEBUGASSERT(conn);
   DEBUGASSERT(!cf->conn);
   DEBUGASSERT(!cf->next);
 
-  cf->next = conn->cfilter[index];
+  cf->next = conn->cfilter[sockindex];
   cf->conn = conn;
-  cf->sockindex = index;
-  conn->cfilter[index] = cf;
+  cf->sockindex = sockindex;
+  conn->cfilter[sockindex] = cf;
   CURL_TRC_CF(data, cf, "added");
 }
 
@@ -261,119 +392,126 @@ void Curl_conn_cf_insert_after(struct Curl_cfilter *cf_at,
   *pnext = tail;
 }
 
-bool Curl_conn_cf_discard_sub(struct Curl_cfilter *cf,
-                              struct Curl_cfilter *discard,
-                              struct Curl_easy *data,
-                              bool destroy_always)
+bool Curl_conn_cf_discard(struct Curl_cfilter **pcf,
+                          struct Curl_easy *data)
 {
-  struct Curl_cfilter **pprev = &cf->next;
+  struct Curl_cfilter *cf = pcf ? *pcf : NULL;
   bool found = FALSE;
-
-  /* remove from sub-chain and destroy */
-  DEBUGASSERT(cf);
-  while(*pprev) {
-    if(*pprev == cf) {
-      *pprev = discard->next;
-      discard->next = NULL;
-      found = TRUE;
-      break;
+  if(cf) {
+    if(cf->conn) {
+      /* unlink if present in connection filter chain */
+      struct Curl_cfilter **pprev = &cf->conn->cfilter[cf->sockindex];
+      while(*pprev) {
+        if(*pprev == *pcf) {
+          *pprev = (*pcf)->next;
+          cf->next = NULL;
+          found = TRUE;
+          break;
+        }
+        pprev = &((*pprev)->next);
+      }
     }
-    pprev = &((*pprev)->next);
-  }
-  if(found || destroy_always) {
-    discard->next = NULL;
-    discard->cft->destroy(discard, data);
-    free(discard);
+    Curl_conn_cf_discard_chain(pcf, data);
   }
   return found;
 }
 
 CURLcode Curl_conn_cf_connect(struct Curl_cfilter *cf,
                               struct Curl_easy *data,
-                              bool blocking, bool *done)
+                              bool *done)
 {
   if(cf)
-    return cf->cft->do_connect(cf, data, blocking, done);
+    return cf->cft->do_connect(cf, data, done);
   return CURLE_FAILED_INIT;
 }
 
-void Curl_conn_cf_close(struct Curl_cfilter *cf, struct Curl_easy *data)
+CURLcode Curl_conn_cf_send(struct Curl_cfilter *cf, struct Curl_easy *data,
+                           const uint8_t *buf, size_t len, bool eos,
+                           size_t *pnwritten)
 {
   if(cf)
-    cf->cft->do_close(cf, data);
+    return cf->cft->do_send(cf, data, buf, len, eos, pnwritten);
+  *pnwritten = 0;
+  return CURLE_SEND_ERROR;
 }
 
-int Curl_conn_cf_get_select_socks(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  curl_socket_t *socks)
+CURLcode Curl_conn_cf_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
+                           char *buf, size_t len, size_t *pnread)
 {
   if(cf)
-    return cf->cft->get_select_socks(cf, data, socks);
-  return 0;
+    return cf->cft->do_recv(cf, data, buf, len, pnread);
+  *pnread = 0;
+  return CURLE_RECV_ERROR;
 }
 
-ssize_t Curl_conn_cf_send(struct Curl_cfilter *cf, struct Curl_easy *data,
-                          const void *buf, size_t len, CURLcode *err)
+static CURLcode cf_cntrl_all(struct connectdata *conn,
+                             struct Curl_easy *data,
+                             bool ignore_result,
+                             int event, int arg1, void *arg2)
 {
-  if(cf)
-    return cf->cft->do_send(cf, data, buf, len, err);
-  *err = CURLE_SEND_ERROR;
-  return -1;
-}
-
-ssize_t Curl_conn_cf_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
-                          char *buf, size_t len, CURLcode *err)
-{
-  if(cf)
-    return cf->cft->do_recv(cf, data, buf, len, err);
-  *err = CURLE_RECV_ERROR;
-  return -1;
-}
-
-CURLcode Curl_conn_connect(struct Curl_easy *data,
-                           int sockindex,
-                           bool blocking,
-                           bool *done)
-{
-  struct Curl_cfilter *cf;
   CURLcode result = CURLE_OK;
+  size_t i;
 
-  DEBUGASSERT(data);
-  DEBUGASSERT(data->conn);
-
-  cf = data->conn->cfilter[sockindex];
-  DEBUGASSERT(cf);
-  if(!cf)
-    return CURLE_FAILED_INIT;
-
-  *done = cf->connected;
-  if(!*done) {
-    result = cf->cft->do_connect(cf, data, blocking, done);
-    if(!result && *done) {
-      Curl_conn_ev_update_info(data, data->conn);
-      conn_report_connect_stats(data, data->conn);
-      data->conn->keepalive = Curl_now();
-    }
-    else if(result) {
-      conn_report_connect_stats(data, data->conn);
-    }
+  for(i = 0; i < CURL_ARRAYSIZE(conn->cfilter); ++i) {
+    result = Curl_conn_cf_cntrl(conn->cfilter[i], data, ignore_result,
+                                event, arg1, arg2);
+    if(!ignore_result && result)
+      break;
   }
-
   return result;
 }
 
+void Curl_conn_cntrl_update_info(struct Curl_easy *data,
+                                struct connectdata *conn)
+{
+  cf_cntrl_all(conn, data, TRUE, CF_CTRL_CONN_INFO_UPDATE, 0, NULL);
+}
+
+void Curl_conn_remove_setup_filters(struct Curl_easy *data,
+                                    int sockindex)
+{
+  struct Curl_cfilter **anchor = &data->conn->cfilter[sockindex];
+  while(*anchor) {
+    struct Curl_cfilter *cf = *anchor;
+    if(cf->connected && (cf->cft->flags & CF_TYPE_SETUP)) {
+      *anchor = cf->next;
+      cf->next = NULL;
+      CURL_TRC_CF(data, cf, "removing connected setup filter");
+      cf->cft->destroy(cf, data);
+      curlx_free(cf);
+    }
+    else
+      anchor = &cf->next;
+  }
+}
+
+bool Curl_conn_is_setup(struct connectdata *conn, int sockindex)
+{
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return FALSE;
+  return !!conn->cfilter[sockindex];
+}
+
 bool Curl_conn_is_connected(struct connectdata *conn, int sockindex)
 {
   struct Curl_cfilter *cf;
 
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return FALSE;
   cf = conn->cfilter[sockindex];
-  return cf && cf->connected;
+  if(cf)
+    return (bool)cf->connected;
+  else if(conn->scheme->flags & PROTOPT_NONETWORK)
+    return TRUE;
+  return FALSE;
 }
 
 bool Curl_conn_is_ip_connected(struct Curl_easy *data, int sockindex)
 {
   struct Curl_cfilter *cf;
 
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return FALSE;
   cf = data->conn->cfilter[sockindex];
   while(cf) {
     if(cf->connected)
@@ -385,10 +523,37 @@ bool Curl_conn_is_ip_connected(struct Curl_easy *data, int sockindex)
   return FALSE;
 }
 
-bool Curl_conn_cf_is_ssl(struct Curl_cfilter *cf)
+#ifndef CURL_DISABLE_PROXY
+static bool cf_is_tunneling(struct Curl_cfilter *cf)
 {
   for(; cf; cf = cf->next) {
-    if(cf->cft->flags & CF_TYPE_SSL)
+    if((cf->cft->flags & CF_TYPE_PROXY))
+      return TRUE;
+  }
+  return FALSE;
+}
+
+bool Curl_conn_is_tunneling(struct connectdata *conn, int sockindex)
+{
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return FALSE;
+  return conn ? cf_is_tunneling(conn->cfilter[sockindex]) : FALSE;
+}
+#else
+bool Curl_conn_is_tunneling(struct connectdata *conn, int sockindex)
+{
+  (void)conn;
+  (void)sockindex;
+  return FALSE;
+}
+#endif /* CURL_DISABLE_PROXY */
+
+static bool cf_is_ssl(struct Curl_cfilter *cf)
+{
+  for(; cf; cf = cf->next) {
+    /* A tunneling proxy does not offer end2end encryption, even if
+     * it does SSL itself (e.g. QUIC H3 proxy) */
+    if((cf->cft->flags & CF_TYPE_SSL) && !(cf->cft->flags & CF_TYPE_PROXY))
       return TRUE;
     if(cf->cft->flags & CF_TYPE_IP_CONNECT)
       return FALSE;
@@ -398,23 +563,129 @@ bool Curl_conn_cf_is_ssl(struct Curl_cfilter *cf)
 
 bool Curl_conn_is_ssl(struct connectdata *conn, int sockindex)
 {
-  return conn? Curl_conn_cf_is_ssl(conn->cfilter[sockindex]) : FALSE;
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return FALSE;
+  return conn ? cf_is_ssl(conn->cfilter[sockindex]) : FALSE;
+}
+
+bool Curl_conn_get_ssl_info(struct Curl_easy *data,
+                            struct connectdata *conn, int sockindex,
+                            int query,
+                            struct curl_tlssessioninfo *info)
+{
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return FALSE;
+  if(Curl_conn_is_ssl(conn, sockindex)) {
+    struct Curl_cfilter *cf = conn->cfilter[sockindex];
+    CURLcode result = cf ?
+      cf->cft->query(cf, data, query, NULL, (void *)info) :
+      CURLE_UNKNOWN_OPTION;
+    return !result;
+  }
+  return FALSE;
+}
+
+CURLcode Curl_conn_get_ip_info(struct Curl_easy *data,
+                               struct connectdata *conn, int sockindex,
+                               bool *is_ipv6, struct ip_quadruple *ipquad)
+{
+  struct Curl_cfilter *cf;
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  cf = conn ? conn->cfilter[sockindex] : NULL;
+  return Curl_conn_cf_get_ip_info(cf, data, is_ipv6, ipquad);
 }
 
 bool Curl_conn_is_multiplex(struct connectdata *conn, int sockindex)
 {
-  struct Curl_cfilter *cf = conn? conn->cfilter[sockindex] : NULL;
+  struct Curl_cfilter *cf;
+
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return FALSE;
+  cf = conn ? conn->cfilter[sockindex] : NULL;
 
   for(; cf; cf = cf->next) {
     if(cf->cft->flags & CF_TYPE_MULTIPLEX)
       return TRUE;
-    if(cf->cft->flags & CF_TYPE_IP_CONNECT
-       || cf->cft->flags & CF_TYPE_SSL)
+    if(cf->cft->flags & (CF_TYPE_IP_CONNECT | CF_TYPE_SSL))
       return FALSE;
   }
   return FALSE;
 }
 
+unsigned char Curl_conn_get_transport(struct Curl_easy *data,
+                                      struct connectdata *conn)
+{
+  struct Curl_cfilter *cf = conn->cfilter[FIRSTSOCKET];
+  return Curl_conn_cf_get_transport(cf, data);
+}
+
+int Curl_socktype_for_transport(uint8_t transport)
+{
+  switch(transport) {
+  case TRNSPRT_TCP:
+    return SOCK_STREAM;
+  case TRNSPRT_UNIX:
+    return SOCK_STREAM;
+  default: /* UDP and QUIC */
+    return SOCK_DGRAM;
+  }
+}
+
+int Curl_protocol_for_transport(uint8_t transport)
+{
+  switch(transport) {
+  case TRNSPRT_TCP:
+    return IPPROTO_TCP;
+  case TRNSPRT_UNIX:
+    return IPPROTO_IP;
+  default: /* UDP and QUIC */
+    return IPPROTO_UDP;
+  }
+}
+
+bool Curl_conn_cf_wants_httpsrr(struct Curl_cfilter *cf,
+                                struct Curl_easy *data)
+{
+  (void)data;
+  for(; cf; cf = cf->next) {
+    if(cf->cft->flags & CF_TYPE_HTTPSRR)
+      return TRUE;
+  }
+  return FALSE;
+}
+
+const char *Curl_conn_get_alpn_negotiated(struct Curl_easy *data,
+                                          struct connectdata *conn)
+{
+  struct Curl_cfilter *cf = conn->cfilter[FIRSTSOCKET];
+  return Curl_conn_cf_get_alpn_negotiated(cf, data);
+}
+
+unsigned char Curl_conn_http_version(struct Curl_easy *data,
+                                     struct connectdata *conn)
+{
+  struct Curl_cfilter *cf;
+  CURLcode result = CURLE_UNKNOWN_OPTION;
+  unsigned char v = 0;
+
+  cf = conn->cfilter[FIRSTSOCKET];
+  for(; cf; cf = cf->next) {
+    if(cf->cft->flags & CF_TYPE_HTTP) {
+      int value = 0;
+      result = cf->cft->query(cf, data, CF_QUERY_HTTP_VERSION, &value, NULL);
+      if(!result && ((value < 0) || (value > 255)))
+        result = CURLE_FAILED_INIT;
+      else
+        v = (unsigned char)value;
+      break;
+    }
+    if(cf->cft->flags & (CF_TYPE_IP_CONNECT | CF_TYPE_SSL))
+      break;
+  }
+  return (unsigned char)(result ? 0 : v);
+}
+
 bool Curl_conn_data_pending(struct Curl_easy *data, int sockindex)
 {
   struct Curl_cfilter *cf;
@@ -422,6 +693,8 @@ bool Curl_conn_data_pending(struct Curl_easy *data, int sockindex)
   (void)data;
   DEBUGASSERT(data);
   DEBUGASSERT(data->conn);
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return FALSE;
 
   cf = data->conn->cfilter[sockindex];
   while(cf && !cf->connected) {
@@ -433,49 +706,136 @@ bool Curl_conn_data_pending(struct Curl_easy *data, int sockindex)
   return FALSE;
 }
 
-int Curl_conn_get_select_socks(struct Curl_easy *data, int sockindex,
-                               curl_socket_t *socks)
+bool Curl_conn_cf_needs_flush(struct Curl_cfilter *cf,
+                              struct Curl_easy *data)
 {
-  struct Curl_cfilter *cf;
-
-  DEBUGASSERT(data);
-  DEBUGASSERT(data->conn);
-  cf = data->conn->cfilter[sockindex];
-
-  /* if the next one is not yet connected, that's the one we want */
-  while(cf && cf->next && !cf->next->connected)
-    cf = cf->next;
-  if(cf) {
-    return cf->cft->get_select_socks(cf, data, socks);
-  }
-  return GETSOCK_BLANK;
+  CURLcode result;
+  int pending = 0;
+  result = cf ? cf->cft->query(cf, data, CF_QUERY_NEED_FLUSH,
+                               &pending, NULL) : CURLE_UNKNOWN_OPTION;
+  return (result || !pending) ? FALSE : TRUE;
 }
 
-void Curl_conn_get_host(struct Curl_easy *data, int sockindex,
-                        const char **phost, const char **pdisplay_host,
-                        int *pport)
+bool Curl_conn_needs_flush(struct Curl_easy *data, int sockindex)
 {
-  struct Curl_cfilter *cf;
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return FALSE;
+  return Curl_conn_cf_needs_flush(data->conn->cfilter[sockindex], data);
+}
 
+CURLcode Curl_conn_cf_adjust_pollset(struct Curl_cfilter *cf,
+                                     struct Curl_easy *data,
+                                     struct easy_pollset *ps)
+{
+  CURLcode result = CURLE_OK;
+  /* Get the lowest not-connected filter, if there are any */
+  while(cf && !cf->connected && cf->next && !cf->next->connected)
+    cf = cf->next;
+  /* Skip all filters that have already shut down */
+  while(cf && cf->shutdown)
+    cf = cf->next;
+  /* From there on, give all filters a chance to adjust the pollset.
+   * Lower filters are called later, so they may override */
+  while(cf && !result) {
+    result = cf->cft->adjust_pollset(cf, data, ps);
+    cf = cf->next;
+  }
+  return result;
+}
+
+CURLcode Curl_conn_adjust_pollset(struct Curl_easy *data,
+                                  struct connectdata *conn,
+                                  struct easy_pollset *ps)
+{
+  CURLcode result = CURLE_OK;
+  int i;
+
+  DEBUGASSERT(data);
+  DEBUGASSERT(conn);
+  /* During connect time, connection filters may add sockets to the pollset
+   * even when the transfer neither wants to send nor receive. And those
+   * sockets, when having events, are served.
+   * Once connected however, a transfer that neither wants to send nor receive
+   * will never call the connection filters. Any sockets added by the filters
+   * will not change state and POLLIN/POLLOUT events will trigger forever,
+   * making us busy loop. See #21671 */
+  if(ps->n || !Curl_conn_is_connected(conn, FIRSTSOCKET) ||
+     (conn->cfilter[SECONDARYSOCKET] &&
+      !Curl_conn_is_connected(conn, SECONDARYSOCKET))) {
+    for(i = 0; (i < 2) && !result && conn; ++i) {
+      result = Curl_conn_cf_adjust_pollset(conn->cfilter[i], data, ps);
+    }
+  }
+  return result;
+}
+
+/*
+ * Return values:
+ *   -1 = error
+ *    0 = timeout
+ *    N = number of structures with non zero revent fields
+ */
+int Curl_conn_cf_poll(struct Curl_cfilter *cf,
+                      struct Curl_easy *data,
+                      timediff_t timeout_ms)
+{
+  struct easy_pollset ps;
+  int rc;
+  CURLcode result;
+
+  DEBUGASSERT(cf);
+  DEBUGASSERT(data);
   DEBUGASSERT(data->conn);
-  cf = data->conn->cfilter[sockindex];
-  if(cf) {
-    cf->cft->get_host(cf, data, phost, pdisplay_host, pport);
+  Curl_pollset_init(&ps);
+
+  result = Curl_conn_cf_adjust_pollset(cf, data, &ps);
+  if(!result)
+    rc = Curl_pollset_poll(data, &ps, timeout_ms);
+  else
+    rc = -1;
+  Curl_pollset_cleanup(&ps);
+  return rc;
+}
+
+void Curl_conn_get_current_host(struct Curl_easy *data, int sockindex,
+                                const char **phost, int *pport)
+{
+  struct Curl_cfilter *cf, *cf_proxy = NULL;
+  int portarg = -1;
+
+  if(!data->conn) {
+    DEBUGASSERT(0);
+    *phost = "";
+    if(pport)
+      *pport = -1;
+    return;
   }
-  else {
-    /* Some filter ask during shutdown for this, mainly for debugging
-     * purposes. We hand out the defaults, however this is not always
-     * accurate, as the connection might be tunneled, etc. But all that
-     * state is already gone here. */
-    *phost = data->conn->host.name;
-    *pdisplay_host = data->conn->host.dispname;
-    *pport = data->conn->remote_port;
+
+  cf = CONN_SOCK_IDX_VALID(sockindex) ? data->conn->cfilter[sockindex] : NULL;
+  /* Find the "lowest" tunneling proxy filter that has not connected yet. */
+  while(cf && !cf->connected) {
+    if((cf->cft->flags & (CF_TYPE_IP_CONNECT | CF_TYPE_PROXY)) ==
+       (CF_TYPE_IP_CONNECT | CF_TYPE_PROXY))
+      cf_proxy = cf;
+    cf = cf->next;
   }
+  /* cf_proxy (!= NULL) is not connected yet. It is talking
+   * to an interim host and any authentication or other things apply
+   * to this interim host and port. */
+  if(!cf_proxy || cf_proxy->cft->query(cf_proxy, data, CF_QUERY_HOST_PORT,
+                                       &portarg, CURL_UNCONST(phost))) {
+    /* Everything connected or query unsuccessful, the overall
+     * connection's destination is the answer */
+    *phost = data->conn->origin->hostname;
+    portarg = data->conn->origin->port;
+  }
+  if(pport)
+    *pport = portarg;
 }
 
 CURLcode Curl_cf_def_cntrl(struct Curl_cfilter *cf,
-                                struct Curl_easy *data,
-                                int event, int arg1, void *arg2)
+                           struct Curl_easy *data,
+                           int event, int arg1, void *arg2)
 {
   (void)cf;
   (void)data;
@@ -493,7 +853,7 @@ CURLcode Curl_conn_cf_cntrl(struct Curl_cfilter *cf,
   CURLcode result = CURLE_OK;
 
   for(; cf; cf = cf->next) {
-    if(Curl_cf_def_cntrl == cf->cft->cntrl)
+    if(cf->cft->cntrl == Curl_cf_def_cntrl)
       continue;
     result = cf->cft->cntrl(cf, data, event, arg1, arg2);
     if(!ignore_result && result)
@@ -511,63 +871,90 @@ curl_socket_t Curl_conn_cf_get_socket(struct Curl_cfilter *cf,
   return CURL_SOCKET_BAD;
 }
 
-curl_socket_t Curl_conn_get_socket(struct Curl_easy *data, int sockindex)
+unsigned char Curl_conn_cf_get_transport(struct Curl_cfilter *cf,
+                                         struct Curl_easy *data)
 {
-  struct Curl_cfilter *cf;
-
-  cf = data->conn? data->conn->cfilter[sockindex] : NULL;
-  /* if the top filter has not connected, ask it (and its sub-filters)
-   * for the socket. Otherwise conn->sock[sockindex] should have it.
-   */
-  if(cf && !cf->connected)
-    return Curl_conn_cf_get_socket(cf, data);
-  return data->conn? data->conn->sock[sockindex] : CURL_SOCKET_BAD;
+  int transport = 0;
+  if(cf && !cf->cft->query(cf, data, CF_QUERY_TRANSPORT, &transport, NULL))
+    return (unsigned char)transport;
+  return (unsigned char)(data->conn ? data->conn->transport_wanted : 0);
 }
 
-static CURLcode cf_cntrl_all(struct connectdata *conn,
-                             struct Curl_easy *data,
-                             bool ignore_result,
-                             int event, int arg1, void *arg2)
+const char *Curl_conn_cf_get_alpn_negotiated(struct Curl_cfilter *cf,
+                                             struct Curl_easy *data)
 {
-  CURLcode result = CURLE_OK;
-  size_t i;
+  const char *alpn = NULL;
+  CURL_TRC_CF(data, cf, "query ALPN");
+  if(cf && !cf->cft->query(cf, data, CF_QUERY_ALPN_NEGOTIATED, NULL,
+                           CURL_UNCONST(&alpn)))
+    return alpn;
+  return NULL;
+}
 
-  for(i = 0; i < ARRAYSIZE(conn->cfilter); ++i) {
-    result = Curl_conn_cf_cntrl(conn->cfilter[i], data, ignore_result,
-                                event, arg1, arg2);
-    if(!ignore_result && result)
-      break;
+static const struct Curl_sockaddr_ex *cf_get_remote_addr(
+  struct Curl_cfilter *cf, struct Curl_easy *data)
+{
+  const struct Curl_sockaddr_ex *remote_addr = NULL;
+  if(cf &&
+     !cf->cft->query(cf, data, CF_QUERY_REMOTE_ADDR, NULL,
+                     CURL_UNCONST(&remote_addr)))
+    return remote_addr;
+  return NULL;
+}
+
+CURLcode Curl_conn_cf_get_ip_info(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  bool *is_ipv6, struct ip_quadruple *ipquad)
+{
+  CURLcode result = CURLE_UNKNOWN_OPTION;
+  if(cf) {
+    int ipv6 = 0;
+    result = cf->cft->query(cf, data, CF_QUERY_IP_INFO, &ipv6, ipquad);
+    *is_ipv6 = !!ipv6;
   }
   return result;
 }
 
-void Curl_conn_ev_data_attach(struct connectdata *conn,
-                              struct Curl_easy *data)
+curl_socket_t Curl_conn_get_first_socket(struct Curl_easy *data)
 {
-  cf_cntrl_all(conn, data, TRUE, CF_CTRL_DATA_ATTACH, 0, NULL);
+  struct Curl_cfilter *cf;
+
+  if(!data->conn)
+    return CURL_SOCKET_BAD;
+
+  cf = data->conn->cfilter[FIRSTSOCKET];
+  /* if the top filter has not connected, ask it (and its sub-filters)
+   * for the socket. Otherwise conn->sock[sockindex] should have it. */
+  if(cf && !cf->connected)
+    return Curl_conn_cf_get_socket(cf, data);
+  return data->conn->sock[FIRSTSOCKET];
 }
 
-void Curl_conn_ev_data_detach(struct connectdata *conn,
-                              struct Curl_easy *data)
+const struct Curl_sockaddr_ex *Curl_conn_get_remote_addr(
+  struct Curl_easy *data, int sockindex)
 {
-  cf_cntrl_all(conn, data, TRUE, CF_CTRL_DATA_DETACH, 0, NULL);
+  struct Curl_cfilter *cf =
+    (data->conn && CONN_SOCK_IDX_VALID(sockindex)) ?
+    data->conn->cfilter[sockindex] : NULL;
+  return cf ? cf_get_remote_addr(cf, data) : NULL;
 }
 
 CURLcode Curl_conn_ev_data_setup(struct Curl_easy *data)
 {
-  return cf_cntrl_all(data->conn, data, FALSE,
-                      CF_CTRL_DATA_SETUP, 0, NULL);
+  return cf_cntrl_all(data->conn, data, FALSE, CF_CTRL_DATA_SETUP, 0, NULL);
 }
 
-CURLcode Curl_conn_ev_data_idle(struct Curl_easy *data)
+CURLcode Curl_conn_flush(struct Curl_easy *data, int sockindex)
 {
-  return cf_cntrl_all(data->conn, data, FALSE,
-                      CF_CTRL_DATA_IDLE, 0, NULL);
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  return Curl_conn_cf_cntrl(data->conn->cfilter[sockindex], data, FALSE,
+                            CF_CTRL_FLUSH, 0, NULL);
 }
 
 /**
  * Notify connection filters that the transfer represented by `data`
- * is donw with sending data (e.g. has uploaded everything).
+ * is done with sending data (e.g. has uploaded everything).
  */
 void Curl_conn_ev_data_done_send(struct Curl_easy *data)
 {
@@ -589,35 +976,6 @@ CURLcode Curl_conn_ev_data_pause(struct Curl_easy *data, bool do_pause)
                       CF_CTRL_DATA_PAUSE, do_pause, NULL);
 }
 
-void Curl_conn_ev_update_info(struct Curl_easy *data,
-                              struct connectdata *conn)
-{
-  cf_cntrl_all(conn, data, TRUE, CF_CTRL_CONN_INFO_UPDATE, 0, NULL);
-}
-
-/**
- * Update connection statistics
- */
-static void conn_report_connect_stats(struct Curl_easy *data,
-                                      struct connectdata *conn)
-{
-  struct Curl_cfilter *cf = conn->cfilter[FIRSTSOCKET];
-  if(cf) {
-    struct curltime connected;
-    struct curltime appconnected;
-
-    memset(&connected, 0, sizeof(connected));
-    cf->cft->query(cf, data, CF_QUERY_TIMER_CONNECT, NULL, &connected);
-    if(connected.tv_sec || connected.tv_usec)
-      Curl_pgrsTimeWas(data, TIMER_CONNECT, connected);
-
-    memset(&appconnected, 0, sizeof(appconnected));
-    cf->cft->query(cf, data, CF_QUERY_TIMER_APPCONNECT, NULL, &appconnected);
-    if(appconnected.tv_sec || appconnected.tv_usec)
-      Curl_pgrsTimeWas(data, TIMER_APPCONNECT, appconnected);
-  }
-}
-
 bool Curl_conn_is_alive(struct Curl_easy *data, struct connectdata *conn,
                         bool *input_pending)
 {
@@ -630,19 +988,100 @@ CURLcode Curl_conn_keep_alive(struct Curl_easy *data,
                               struct connectdata *conn,
                               int sockindex)
 {
-  struct Curl_cfilter *cf = conn->cfilter[sockindex];
-  return cf? cf->cft->keep_alive(cf, data) : CURLE_OK;
+  struct Curl_cfilter *cf;
+
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  cf = conn->cfilter[sockindex];
+  return cf ? cf->cft->keep_alive(cf, data) : CURLE_OK;
 }
 
 size_t Curl_conn_get_max_concurrent(struct Curl_easy *data,
-                                     struct connectdata *conn,
-                                     int sockindex)
+                                    struct connectdata *conn,
+                                    int sockindex)
 {
+  struct Curl_cfilter *cf;
+  CURLcode result;
+  int n = -1;
+
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return 0;
+
+  cf = conn->cfilter[sockindex];
+  result = cf ? cf->cft->query(cf, data, CF_QUERY_MAX_CONCURRENT,
+                               &n, NULL) : CURLE_UNKNOWN_OPTION;
+  /* If no filter answered the query, the default is a non-multiplexed
+   * connection with limit 1. Otherwise, the query may return 0
+   * for connections that are in shutdown, e.g. server HTTP/2 GOAWAY. */
+  return (result || n < 0) ? 1 : (size_t)n;
+}
+
+int Curl_conn_get_stream_error(struct Curl_easy *data,
+                               struct connectdata *conn,
+                               int sockindex)
+{
+  struct Curl_cfilter *cf;
   CURLcode result;
   int n = 0;
 
-  struct Curl_cfilter *cf = conn->cfilter[sockindex];
-  result = cf? cf->cft->query(cf, data, CF_QUERY_MAX_CONCURRENT,
-                              &n, NULL) : CURLE_UNKNOWN_OPTION;
-  return (result || n <= 0)? 1 : (size_t)n;
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return 0;
+
+  cf = conn->cfilter[sockindex];
+  result = cf ? cf->cft->query(cf, data, CF_QUERY_STREAM_ERROR,
+                               &n, NULL) : CURLE_UNKNOWN_OPTION;
+  return (result || n < 0) ? 0 : n;
+}
+
+int Curl_conn_sockindex(struct Curl_easy *data, curl_socket_t sockfd)
+{
+  if(data && data->conn &&
+     sockfd != CURL_SOCKET_BAD && sockfd == data->conn->sock[SECONDARYSOCKET])
+    return SECONDARYSOCKET;
+  return FIRSTSOCKET;
+}
+
+CURLcode Curl_conn_recv(struct Curl_easy *data, int sockindex,
+                        char *buf, size_t len, size_t *pnread)
+{
+  DEBUGASSERT(data);
+  DEBUGASSERT(data->conn);
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  if(data && data->conn && data->conn->recv[sockindex])
+    return data->conn->recv[sockindex](data, sockindex, buf, len, pnread);
+  *pnread = 0;
+  return CURLE_FAILED_INIT;
+}
+
+CURLcode Curl_conn_send(struct Curl_easy *data, int sockindex,
+                        const void *buf, size_t len, bool eos,
+                        size_t *pnwritten)
+{
+  size_t write_len = len;
+
+  DEBUGASSERT(data);
+  DEBUGASSERT(data->conn);
+  DEBUGASSERT(CONN_SOCK_IDX_VALID(sockindex));
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+#ifdef DEBUGBUILD
+  if(write_len) {
+    /* Allow debug builds to override this logic to force short sends */
+    const char *p = getenv("CURL_SMALLSENDS");
+    if(p) {
+      curl_off_t altsize;
+      if(!curlx_str_number(&p, &altsize, write_len)) {
+        write_len = (size_t)altsize;
+        if(write_len != len)
+          eos = FALSE;
+      }
+    }
+  }
+#endif
+  if(data && data->conn && data->conn->send[sockindex])
+    return data->conn->send[sockindex](data, sockindex, buf, write_len, eos,
+                                       pnwritten);
+  *pnwritten = 0;
+  return CURLE_FAILED_INIT;
 }
diff --git a/third-party/curl/lib/cfilters.h b/third-party/curl/lib/cfilters.h
index 2c65264d98..b1aad029e0 100644
--- a/third-party/curl/lib/cfilters.h
+++ b/third-party/curl/lib/cfilters.h
@@ -23,12 +23,15 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "curlx/timediff.h"
 
-
+struct bufq;
 struct Curl_cfilter;
 struct Curl_easy;
 struct Curl_dns_entry;
 struct connectdata;
+struct ip_quadruple;
+struct curl_tlssessioninfo;
 
 /* Callback to destroy resources held by this filter instance.
  * Implementations MUST NOT chain calls to cf->next.
@@ -36,53 +39,61 @@ struct connectdata;
 typedef void     Curl_cft_destroy_this(struct Curl_cfilter *cf,
                                        struct Curl_easy *data);
 
-typedef void     Curl_cft_close(struct Curl_cfilter *cf,
-                                struct Curl_easy *data);
+/* Callback to close the connection filter gracefully, non-blocking.
+ * Implementations MUST NOT chain calls to cf->next.
+ */
+typedef CURLcode Curl_cft_shutdown(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data,
+                                   bool *done);
 
 typedef CURLcode Curl_cft_connect(struct Curl_cfilter *cf,
                                   struct Curl_easy *data,
-                                  bool blocking, bool *done);
+                                  bool *done);
 
-/* Return the hostname and port the connection goes to.
- * This may change with the connection state of filters when tunneling
- * is involved.
+struct easy_pollset;
+
+/* Passing in an easy_pollset for monitoring of sockets, let
+ * filters add or remove sockets actions (CURL_POLL_OUT, CURL_POLL_IN).
+ * This may add a socket or, in case no actions remain, remove
+ * a socket from the set.
+ *
+ * Filter implementations need to call filters "below" *after* they have
+ * made their adjustments. This allows lower filters to override "upper"
+ * actions. If a "lower" filter is unable to write, it needs to be able
+ * to disallow POLL_OUT.
+ *
+ * A filter without own restrictions/preferences should not modify
+ * the pollset. Filters, whose filter "below" is not connected, should
+ * also do no adjustments.
+ *
+ * Examples: a TLS handshake, while ongoing, might remove POLL_IN when it
+ * needs to write, or vice versa. An HTTP/2 filter might remove POLL_OUT when
+ * a stream window is exhausted and a WINDOW_UPDATE needs to be received first
+ * and add instead POLL_IN.
+ *
  * @param cf     the filter to ask
- * @param data   the easy handle currently active
- * @param phost  on return, points to the relevant, real hostname.
- *               this is owned by the connection.
- * @param pdisplay_host  on return, points to the printable hostname.
- *               this is owned by the connection.
- * @param pport  on return, contains the port number
+ * @param data   the easy handle the pollset is about
+ * @param ps     the pollset (inout) for the easy handle
  */
-typedef void     Curl_cft_get_host(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  const char **phost,
-                                  const char **pdisplay_host,
-                                  int *pport);
-
-/* Filters may return sockets and fdset flags they are waiting for.
- * The passes array has room for up to MAX_SOCKSPEREASYHANDLE sockets.
- * @return read/write fdset for index in socks
- *         or GETSOCK_BLANK when nothing to wait on
- */
-typedef int      Curl_cft_get_select_socks(struct Curl_cfilter *cf,
-                                           struct Curl_easy *data,
-                                           curl_socket_t *socks);
+typedef CURLcode Curl_cft_adjust_pollset(struct Curl_cfilter *cf,
+                                         struct Curl_easy *data,
+                                         struct easy_pollset *ps);
 
 typedef bool     Curl_cft_data_pending(struct Curl_cfilter *cf,
                                        const struct Curl_easy *data);
 
-typedef ssize_t  Curl_cft_send(struct Curl_cfilter *cf,
+typedef CURLcode Curl_cft_send(struct Curl_cfilter *cf,
                                struct Curl_easy *data, /* transfer */
-                               const void *buf,        /* data to write */
+                               const uint8_t *buf,     /* data to write */
                                size_t len,             /* amount to write */
-                               CURLcode *err);         /* error to return */
+                               bool eos,               /* last chunk */
+                               size_t *pnwritten);     /* how much sent */
 
-typedef ssize_t  Curl_cft_recv(struct Curl_cfilter *cf,
+typedef CURLcode Curl_cft_recv(struct Curl_cfilter *cf,
                                struct Curl_easy *data, /* transfer */
                                char *buf,              /* store data here */
                                size_t len,             /* amount to read */
-                               CURLcode *err);         /* error to return */
+                               size_t *pnread);        /* how much received */
 
 typedef bool     Curl_cft_conn_is_alive(struct Curl_cfilter *cf,
                                         struct Curl_easy *data,
@@ -100,16 +111,16 @@ typedef CURLcode Curl_cft_conn_keep_alive(struct Curl_cfilter *cf,
  * "ignored" meaning return values are ignored and the event is distributed
  *           to all filters in the chain. Overall result is always CURLE_OK.
  */
-/*      data event                          arg1       arg2     return */
-#define CF_CTRL_DATA_ATTACH           1  /* 0          NULL     ignored */
-#define CF_CTRL_DATA_DETACH           2  /* 0          NULL     ignored */
-#define CF_CTRL_DATA_SETUP            4  /* 0          NULL     first fail */
-#define CF_CTRL_DATA_IDLE             5  /* 0          NULL     first fail */
-#define CF_CTRL_DATA_PAUSE            6  /* on/off     NULL     first fail */
-#define CF_CTRL_DATA_DONE             7  /* premature  NULL     ignored */
-#define CF_CTRL_DATA_DONE_SEND        8  /* 0          NULL     ignored */
+/*      data event                            arg1       arg2     return */
+#define CF_CTRL_DATA_SETUP              4  /* 0          NULL     first fail */
+/* unused now                           5 */
+#define CF_CTRL_DATA_PAUSE              6  /* on/off     NULL     first fail */
+#define CF_CTRL_DATA_DONE               7  /* premature  NULL     ignored */
+#define CF_CTRL_DATA_DONE_SEND          8  /* 0          NULL     ignored */
 /* update conn info at connection and data */
-#define CF_CTRL_CONN_INFO_UPDATE (256+0) /* 0          NULL     ignored */
+#define CF_CTRL_CONN_INFO_UPDATE (256 + 0) /* 0          NULL     ignored */
+#define CF_CTRL_FORGET_SOCKET    (256 + 1) /* 0          NULL     ignored */
+#define CF_CTRL_FLUSH            (256 + 2) /* 0          NULL     first fail */
 
 /**
  * Handle event/control for the filter.
@@ -119,7 +130,6 @@ typedef CURLcode Curl_cft_cntrl(struct Curl_cfilter *cf,
                                 struct Curl_easy *data,
                                 int event, int arg1, void *arg2);
 
-
 /**
  * Queries to ask via a `Curl_cft_query *query` method on a cfilter chain.
  * - MAX_CONCURRENT: the maximum number of parallel transfers the filter
@@ -132,6 +142,20 @@ typedef CURLcode Curl_cft_cntrl(struct Curl_cfilter *cf,
  *                   were received.
  *                   -1 if not determined yet.
  * - CF_QUERY_SOCKET: the socket used by the filter chain
+ * - CF_QUERY_NEED_FLUSH: TRUE iff any of the filters have unsent data
+ * - CF_QUERY_IP_INFO: res1 says if connection used IPv6, res2 is the
+ *                   ip quadruple
+ * - CF_QUERY_HOST_PORT: the remote hostname and port a filter talks to
+ * - CF_QUERY_SSL_INFO: fill out the passed curl_tlssessioninfo with the
+ *                      internal from the SSL secured connection when
+ *                      available.
+ * - CF_QUERY_SSL_CTX_INFO: same as CF_QUERY_SSL_INFO, but give the SSL_CTX
+ *                      when available, or the same internal pointer
+ *                      when the TLS stack does not differentiate.
+ * - CF_QUERY_ALPN_NEGOTIATED: The ALPN selected by the server as
+                        null-terminated string or NULL if none
+                        selected/handshake not done. Implemented by filter
+                        types CF_TYPE_SSL or CF_TYPE_IP_CONNECT.
  */
 /*      query                             res1       res2     */
 #define CF_QUERY_MAX_CONCURRENT     1  /* number     -        */
@@ -139,6 +163,18 @@ typedef CURLcode Curl_cft_cntrl(struct Curl_cfilter *cf,
 #define CF_QUERY_SOCKET             3  /* -          curl_socket_t */
 #define CF_QUERY_TIMER_CONNECT      4  /* -          struct curltime */
 #define CF_QUERY_TIMER_APPCONNECT   5  /* -          struct curltime */
+#define CF_QUERY_STREAM_ERROR       6  /* error code - */
+#define CF_QUERY_NEED_FLUSH         7  /* TRUE/FALSE - */
+#define CF_QUERY_IP_INFO            8  /* TRUE/FALSE struct ip_quadruple */
+#define CF_QUERY_HTTP_VERSION       9  /* number (10/11/20/30)   - */
+/* pass in a `const struct Curl_sockaddr_ex **` as `pres2`. Gets set
+ * to NULL when not connected. */
+#define CF_QUERY_REMOTE_ADDR       10  /* -          `Curl_sockaddr_ex *` */
+#define CF_QUERY_HOST_PORT         11  /* port       const char * */
+#define CF_QUERY_SSL_INFO          12  /* -    struct curl_tlssessioninfo * */
+#define CF_QUERY_SSL_CTX_INFO      13  /* -    struct curl_tlssessioninfo * */
+#define CF_QUERY_TRANSPORT         14  /* TRNSPRT_*  - * */
+#define CF_QUERY_ALPN_NEGOTIATED   15  /* -          const char * */
 
 /**
  * Query the cfilter for properties. Filters ignorant of a query will
@@ -157,28 +193,36 @@ typedef CURLcode Curl_cft_query(struct Curl_cfilter *cf,
  *                     connection, etc.
  * CF_TYPE_SSL:        provide SSL/TLS
  * CF_TYPE_MULTIPLEX:  provides multiplexing of easy handles
+ * CF_TYPE_PROXY       provides proxying
+ * CF_TYPE_HTTP        implement a version of the HTTP protocol
+ * CF_TYPE_SETUP       filter is only needed for connection setup and
+ *                     can be removed once connected
+ * CF_TYPE_HTTPSRR     filter that wants HTTPS-RR information
  */
 #define CF_TYPE_IP_CONNECT  (1 << 0)
 #define CF_TYPE_SSL         (1 << 1)
 #define CF_TYPE_MULTIPLEX   (1 << 2)
+#define CF_TYPE_PROXY       (1 << 3)
+#define CF_TYPE_HTTP        (1 << 4)
+#define CF_TYPE_SETUP       (1 << 5)
+#define CF_TYPE_HTTPSRR     (1 << 6)
 
 /* A connection filter type, e.g. specific implementation. */
 struct Curl_cftype {
-  const char *name;                       /* name of the filter type */
-  int flags;                              /* flags of filter type */
-  int log_level;                          /* log level for such filters */
-  Curl_cft_destroy_this *destroy;         /* destroy resources of this cf */
-  Curl_cft_connect *do_connect;           /* establish connection */
-  Curl_cft_close *do_close;               /* close conn */
-  Curl_cft_get_host *get_host;            /* host filter talks to */
-  Curl_cft_get_select_socks *get_select_socks;/* sockets to select on */
-  Curl_cft_data_pending *has_data_pending;/* conn has data pending */
-  Curl_cft_send *do_send;                 /* send data */
-  Curl_cft_recv *do_recv;                 /* receive data */
-  Curl_cft_cntrl *cntrl;                  /* events/control */
-  Curl_cft_conn_is_alive *is_alive;       /* FALSE if conn is dead, Jim! */
-  Curl_cft_conn_keep_alive *keep_alive;   /* try to keep it alive */
-  Curl_cft_query *query;                  /* query filter chain */
+  const char *name;                        /* name of the filter type */
+  int flags;                               /* flags of filter type */
+  int log_level;                           /* log level for such filters */
+  Curl_cft_destroy_this *destroy;          /* destroy resources of this cf */
+  Curl_cft_connect *do_connect;            /* establish connection */
+  Curl_cft_shutdown *do_shutdown;          /* shutdown conn */
+  Curl_cft_adjust_pollset *adjust_pollset; /* adjust transfer poll set */
+  Curl_cft_data_pending *has_data_pending; /* conn has data pending */
+  Curl_cft_send *do_send;                  /* send data */
+  Curl_cft_recv *do_recv;                  /* receive data */
+  Curl_cft_cntrl *cntrl;                   /* events/control */
+  Curl_cft_conn_is_alive *is_alive;        /* FALSE if conn is dead, Jim! */
+  Curl_cft_conn_keep_alive *keep_alive;    /* try to keep it alive */
+  Curl_cft_query *query;                   /* query filter chain */
 };
 
 /* A connection filter instance, e.g. registered at a connection */
@@ -189,6 +233,7 @@ struct Curl_cfilter {
   struct connectdata *conn;      /* the connection this filter belongs to */
   int sockindex;                 /* the index the filter is installed at */
   BIT(connected);                /* != 0 iff this filter is connected */
+  BIT(shutdown);                 /* != 0 iff this filter has shut down */
 };
 
 /* Default implementations for the type functions, implementing nop. */
@@ -197,21 +242,19 @@ void Curl_cf_def_destroy_this(struct Curl_cfilter *cf,
 
 /* Default implementations for the type functions, implementing pass-through
  * the filter chain. */
-void     Curl_cf_def_get_host(struct Curl_cfilter *cf, struct Curl_easy *data,
-                              const char **phost, const char **pdisplay_host,
-                              int *pport);
-int      Curl_cf_def_get_select_socks(struct Curl_cfilter *cf,
-                                      struct Curl_easy *data,
-                                      curl_socket_t *socks);
+CURLcode Curl_cf_def_adjust_pollset(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    struct easy_pollset *ps);
 bool     Curl_cf_def_data_pending(struct Curl_cfilter *cf,
                                   const struct Curl_easy *data);
-ssize_t  Curl_cf_def_send(struct Curl_cfilter *cf, struct Curl_easy *data,
-                          const void *buf, size_t len, CURLcode *err);
-ssize_t  Curl_cf_def_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
-                          char *buf, size_t len, CURLcode *err);
+CURLcode Curl_cf_def_send(struct Curl_cfilter *cf, struct Curl_easy *data,
+                          const uint8_t *buf, size_t len, bool eos,
+                          size_t *pnwritten);
+CURLcode Curl_cf_def_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
+                          char *buf, size_t len, size_t *pnread);
 CURLcode Curl_cf_def_cntrl(struct Curl_cfilter *cf,
-                                struct Curl_easy *data,
-                                int event, int arg1, void *arg2);
+                           struct Curl_easy *data,
+                           int event, int arg1, void *arg2);
 bool     Curl_cf_def_conn_is_alive(struct Curl_cfilter *cf,
                                    struct Curl_easy *data,
                                    bool *input_pending);
@@ -220,6 +263,10 @@ CURLcode Curl_cf_def_conn_keep_alive(struct Curl_cfilter *cf,
 CURLcode Curl_cf_def_query(struct Curl_cfilter *cf,
                            struct Curl_easy *data,
                            int query, int *pres1, void *pres2);
+CURLcode Curl_cf_def_shutdown(struct Curl_cfilter *cf,
+                              struct Curl_easy *data, bool *done);
+CURLcode Curl_cf_def_connect(struct Curl_cfilter *cf,
+                              struct Curl_easy *data, bool *done);
 
 /**
  * Create a new filter instance, unattached to the filter chain.
@@ -250,16 +297,12 @@ void Curl_conn_cf_insert_after(struct Curl_cfilter *cf_at,
                                struct Curl_cfilter *cf_new);
 
 /**
- * Discard, e.g. remove and destroy `discard` iff
- * it still is in the filter chain below `cf`. If `discard`
- * is no longer found beneath `cf` return FALSE.
- * if `destroy_always` is TRUE, will call `discard`s destroy
- * function and free it even if not found in the subchain.
+ * Extract filter `*pcf` from its connection filter chain.
+ * Destroy `*pcf`, even if it was not part of the chain and NULL it.
+ * Returns TRUE of cf has been part of chain.
  */
-bool Curl_conn_cf_discard_sub(struct Curl_cfilter *cf,
-                              struct Curl_cfilter *discard,
-                              struct Curl_easy *data,
-                              bool destroy_always);
+bool Curl_conn_cf_discard(struct Curl_cfilter **pcf,
+                          struct Curl_easy *data);
 
 /**
  * Discard all cfilters starting with `*pcf` and clearing it afterwards.
@@ -271,32 +314,21 @@ void Curl_conn_cf_discard_chain(struct Curl_cfilter **pcf,
  * Remove and destroy all filters at chain `sockindex` on connection `conn`.
  */
 void Curl_conn_cf_discard_all(struct Curl_easy *data,
-                              struct connectdata *conn,
-                              int sockindex);
-
+                              struct connectdata *conn, int sockindex);
 
 CURLcode Curl_conn_cf_connect(struct Curl_cfilter *cf,
                               struct Curl_easy *data,
-                              bool blocking, bool *done);
-void Curl_conn_cf_close(struct Curl_cfilter *cf, struct Curl_easy *data);
-int Curl_conn_cf_get_select_socks(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  curl_socket_t *socks);
-ssize_t Curl_conn_cf_send(struct Curl_cfilter *cf, struct Curl_easy *data,
-                          const void *buf, size_t len, CURLcode *err);
-ssize_t Curl_conn_cf_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
-                          char *buf, size_t len, CURLcode *err);
+                              bool *done);
+CURLcode Curl_conn_cf_send(struct Curl_cfilter *cf, struct Curl_easy *data,
+                           const uint8_t *buf, size_t len, bool eos,
+                           size_t *pnwritten);
+CURLcode Curl_conn_cf_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
+                           char *buf, size_t len, size_t *pnread);
 CURLcode Curl_conn_cf_cntrl(struct Curl_cfilter *cf,
                             struct Curl_easy *data,
                             bool ignore_result,
                             int event, int arg1, void *arg2);
 
-/**
- * Determine if the connection filter chain is using SSL to the remote host
- * (or will be once connected).
- */
-bool Curl_conn_cf_is_ssl(struct Curl_cfilter *cf);
-
 /**
  * Get the socket used by the filter chain starting at `cf`.
  * Returns CURL_SOCKET_BAD if not available.
@@ -304,20 +336,34 @@ bool Curl_conn_cf_is_ssl(struct Curl_cfilter *cf);
 curl_socket_t Curl_conn_cf_get_socket(struct Curl_cfilter *cf,
                                       struct Curl_easy *data);
 
+CURLcode Curl_conn_cf_get_ip_info(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  bool *is_ipv6, struct ip_quadruple *ipquad);
 
-#define CURL_CF_SSL_DEFAULT  -1
+bool Curl_conn_cf_needs_flush(struct Curl_cfilter *cf,
+                              struct Curl_easy *data);
+
+unsigned char Curl_conn_cf_get_transport(struct Curl_cfilter *cf,
+                                         struct Curl_easy *data);
+
+int Curl_socktype_for_transport(uint8_t transport);
+int Curl_protocol_for_transport(uint8_t transport);
+
+const char *Curl_conn_cf_get_alpn_negotiated(struct Curl_cfilter *cf,
+                                             struct Curl_easy *data);
+
+/* The filter (or one of its sub-filters) wants HTTPS-RR information. */
+bool Curl_conn_cf_wants_httpsrr(struct Curl_cfilter *cf,
+                                struct Curl_easy *data);
+
+#define CURL_CF_SSL_DEFAULT  (-1)
 #define CURL_CF_SSL_DISABLE  0
 #define CURL_CF_SSL_ENABLE   1
 
 /**
- * Bring the filter chain at `sockindex` for connection `data->conn` into
- * connected state. Which will set `*done` to TRUE.
- * This can be called on an already connected chain with no side effects.
- * When not `blocking`, calls may return without error and `*done != TRUE`,
- * while the individual filters negotiated the connection.
+ * Check if a filter chain at `sockindex` for connection `conn` exists.
  */
-CURLcode Curl_conn_connect(struct Curl_easy *data, int sockindex,
-                           bool blocking, bool *done);
+bool Curl_conn_is_setup(struct connectdata *conn, int sockindex);
 
 /**
  * Check if the filter chain at `sockindex` for connection `conn` is
@@ -339,16 +385,56 @@ bool Curl_conn_is_ip_connected(struct Curl_easy *data, int sockindex);
  */
 bool Curl_conn_is_ssl(struct connectdata *conn, int sockindex);
 
+/* Determine if the connection has one or more proxy filters.
+ * e.g. is tunneling. */
+bool Curl_conn_is_tunneling(struct connectdata *conn, int sockindex);
+
+/*
+ * Fill `info` with information about the TLS instance securing the connection
+ * when available, otherwise e.g. when Curl_conn_is_ssl() is FALSE, return
+ * FALSE. 'query' should be CF_QUERY_SSL_INFO or CF_QUERY_SSL_CTX_INFO.
+ */
+bool Curl_conn_get_ssl_info(struct Curl_easy *data,
+                            struct connectdata *conn, int sockindex,
+                            int query,
+                            struct curl_tlssessioninfo *info);
+
+CURLcode Curl_conn_get_ip_info(struct Curl_easy *data,
+                               struct connectdata *conn, int sockindex,
+                               bool *is_ipv6, struct ip_quadruple *ipquad);
+
 /**
  * Connection provides multiplexing of easy handles at `socketindex`.
  */
 bool Curl_conn_is_multiplex(struct connectdata *conn, int sockindex);
 
 /**
- * Close the filter chain at `sockindex` for connection `data->conn`.
-  * Filters remain in place and may be connected again afterwards.
+ * Return the HTTP version used on the FIRSTSOCKET connection filters
+ * or 0 if unknown. Value otherwise is 09, 10, 11, etc.
  */
-void Curl_conn_close(struct Curl_easy *data, int sockindex);
+unsigned char Curl_conn_http_version(struct Curl_easy *data,
+                                     struct connectdata *conn);
+
+/* Get the TRNSPRT_* the connection is using */
+unsigned char Curl_conn_get_transport(struct Curl_easy *data,
+                                      struct connectdata *conn);
+
+/* Get the negotiated ALPN protocol or NULL if none in play */
+const char *Curl_conn_get_alpn_negotiated(struct Curl_easy *data,
+                                          struct connectdata *conn);
+
+void Curl_conn_cntrl_update_info(struct Curl_easy *data,
+                                 struct connectdata *conn);
+
+void Curl_conn_remove_setup_filters(struct Curl_easy *data,
+                                    int sockindex);
+
+/**
+ * Shutdown the connection at `sockindex` non-blocking, using timeout
+ * from `data->set.shutdowntimeout`, default DEFAULT_SHUTDOWN_TIMEOUT_MS.
+ * Return CURLE_OK and *done == FALSE if not finished.
+ */
+CURLcode Curl_conn_shutdown(struct Curl_easy *data, int sockindex, bool *done);
 
 /**
  * Return if data is pending in some connection filter at chain
@@ -358,53 +444,93 @@ bool Curl_conn_data_pending(struct Curl_easy *data,
                             int sockindex);
 
 /**
- * Return the socket used on data's connection for the index.
- * Returns CURL_SOCKET_BAD if not available.
+ * Return TRUE if any of the connection filters at chain `sockindex`
+ * have data still to send.
  */
-curl_socket_t Curl_conn_get_socket(struct Curl_easy *data, int sockindex);
+bool Curl_conn_needs_flush(struct Curl_easy *data, int sockindex);
 
 /**
- * Get any select fd flags and the socket filters at chain `sockindex`
- * at connection `conn` might be waiting for.
+ * Flush any pending data on the connection filters at chain `sockindex`.
  */
-int Curl_conn_get_select_socks(struct Curl_easy *data, int sockindex,
-                               curl_socket_t *socks);
+CURLcode Curl_conn_flush(struct Curl_easy *data, int sockindex);
+
+/**
+ * Return the socket used on data's connection for FIRSTSOCKET,
+ * querying filters if the whole chain has not connected yet.
+ * Returns CURL_SOCKET_BAD if not available.
+ */
+curl_socket_t Curl_conn_get_first_socket(struct Curl_easy *data);
+
+/* Return a pointer to the connected socket address or NULL. */
+const struct Curl_sockaddr_ex *
+Curl_conn_get_remote_addr(struct Curl_easy *data, int sockindex);
+
+/**
+ * Tell filters to forget about the socket at sockindex.
+ */
+void Curl_conn_forget_socket(struct Curl_easy *data, int sockindex);
+
+/**
+ * Adjust the pollset for the filter chain starting at `cf`.
+ */
+CURLcode Curl_conn_cf_adjust_pollset(struct Curl_cfilter *cf,
+                                     struct Curl_easy *data,
+                                     struct easy_pollset *ps);
+
+/**
+ * Adjust pollset from filters installed at transfer's connection.
+ */
+CURLcode Curl_conn_adjust_pollset(struct Curl_easy *data,
+                                  struct connectdata *conn,
+                                  struct easy_pollset *ps);
+
+/**
+ * Curl_poll() the filter chain at `cf` with timeout `timeout_ms`.
+ * Returns 0 on timeout, negative on error or number of sockets
+ * with requested poll events.
+ */
+int Curl_conn_cf_poll(struct Curl_cfilter *cf,
+                      struct Curl_easy *data,
+                      timediff_t timeout_ms);
 
 /**
  * Receive data through the filter chain at `sockindex` for connection
  * `data->conn`. Copy at most `len` bytes into `buf`. Return the
- * actuel number of bytes copied or a negative value on error.
- * The error code is placed into `*code`.
+ * actual number of bytes copied in `*pnread`or an error.
  */
-ssize_t Curl_conn_recv(struct Curl_easy *data, int sockindex, char *buf,
-                       size_t len, CURLcode *code);
+CURLcode Curl_cf_recv(struct Curl_easy *data, int sockindex, char *buf,
+                      size_t len, size_t *pnread);
 
 /**
  * Send `len` bytes of data from `buf` through the filter chain `sockindex`
  * at connection `data->conn`. Return the actual number of bytes written
- * or a negative value on error.
- * The error code is placed into `*code`.
+ * in `*pnwritten` or on error.
  */
-ssize_t Curl_conn_send(struct Curl_easy *data, int sockindex,
-                       const void *buf, size_t len, CURLcode *code);
+CURLcode Curl_cf_send(struct Curl_easy *data, int sockindex,
+                      const uint8_t *buf, size_t len, bool eos,
+                      size_t *pnwritten);
 
 /**
- * The easy handle `data` is being attached to `conn`. This does
- * not mean that data will actually do a transfer. Attachment is
- * also used for temporary actions on the connection.
+ * Receive bytes from connection filter `cf` into `bufq`.
+ * Convenience wrapper around `Curl_bufq_sipn()`,
+ * so users do not have to implement a callback.
  */
-void Curl_conn_ev_data_attach(struct connectdata *conn,
-                              struct Curl_easy *data);
+CURLcode Curl_cf_recv_bufq(struct Curl_cfilter *cf,
+                           struct Curl_easy *data,
+                           struct bufq *bufq,
+                           size_t maxlen,
+                           size_t *pnread);
 
 /**
- * The easy handle `data` is being detached (no longer served)
- * by connection `conn`. All filters are informed to release any resources
- * related to `data`.
- * Note: there may be several `data` attached to a connection at the same
- * time.
+ * Send bytes in `bufq` using connection filter `cf`.
+ * A convenience wrapper around `Curl_bufq_write_pass()`,
+ * so users do not have to implement a callback.
  */
-void Curl_conn_ev_data_detach(struct connectdata *conn,
-                              struct Curl_easy *data);
+CURLcode Curl_cf_send_bufq(struct Curl_cfilter *cf,
+                           struct Curl_easy *data,
+                           struct bufq *bufq,
+                           const unsigned char *buf, size_t blen,
+                           size_t *pnwritten);
 
 /**
  * Notify connection filters that they need to setup data for
@@ -412,15 +538,9 @@ void Curl_conn_ev_data_detach(struct connectdata *conn,
  */
 CURLcode Curl_conn_ev_data_setup(struct Curl_easy *data);
 
-/**
- * Notify connection filters that now would be a good time to
- * perform any idle, e.g. time related, actions.
- */
-CURLcode Curl_conn_ev_data_idle(struct Curl_easy *data);
-
 /**
  * Notify connection filters that the transfer represented by `data`
- * is donw with sending data (e.g. has uploaded everything).
+ * is done with sending data (e.g. has uploaded everything).
  */
 void Curl_conn_ev_data_done_send(struct Curl_easy *data);
 
@@ -435,12 +555,6 @@ void Curl_conn_ev_data_done(struct Curl_easy *data, bool premature);
  */
 CURLcode Curl_conn_ev_data_pause(struct Curl_easy *data, bool do_pause);
 
-/**
- * Inform connection filters to update their info in `conn`.
- */
-void Curl_conn_ev_update_info(struct Curl_easy *data,
-                              struct connectdata *conn);
-
 /**
  * Check if FIRSTSOCKET's cfilter chain deems connection alive.
  */
@@ -454,10 +568,16 @@ CURLcode Curl_conn_keep_alive(struct Curl_easy *data,
                               struct connectdata *conn,
                               int sockindex);
 
-void Curl_cf_def_close(struct Curl_cfilter *cf, struct Curl_easy *data);
-void Curl_conn_get_host(struct Curl_easy *data, int sockindex,
-                        const char **phost, const char **pdisplay_host,
-                        int *pport);
+/**
+ * Get the remote hostname and port that the connection is currently
+ * talking to (or will talk to).
+ * Once connected or before connect starts,
+ * it is `conn->origin->hostname` and `conn->origin->port`.
+ * During connect, when tunneling proxies are involved (http or socks),
+ * it will be the name and port the proxy currently negotiates with.
+ */
+void Curl_conn_get_current_host(struct Curl_easy *data, int sockindex,
+                                const char **phost, int *pport);
 
 /**
  * Get the maximum number of parallel transfers the connection
@@ -467,6 +587,39 @@ size_t Curl_conn_get_max_concurrent(struct Curl_easy *data,
                                     struct connectdata *conn,
                                     int sockindex);
 
+/**
+ * Get the underlying error code for a transfer stream or 0 if not known.
+ */
+int Curl_conn_get_stream_error(struct Curl_easy *data,
+                               struct connectdata *conn,
+                               int sockindex);
+
+#ifdef CURLVERBOSE
+void Curl_conn_trc_filters(struct Curl_easy *data,
+                           int sockindex, const char *info);
+#endif
+
+/**
+ * Get the index of the given socket in the connection's sockets.
+ * Useful in calling `Curl_conn_send()/Curl_conn_recv()` with the
+ * correct socket index.
+ */
+int Curl_conn_sockindex(struct Curl_easy *data, curl_socket_t sockfd);
+
+/*
+ * Receive data on the connection, using FIRSTSOCKET/SECONDARYSOCKET.
+ * Return CURLE_AGAIN iff blocked on receiving.
+ */
+CURLcode Curl_conn_recv(struct Curl_easy *data, int sockindex,
+                        char *buf, size_t len, size_t *pnread);
+
+/*
+ * Send data on the connection, using FIRSTSOCKET/SECONDARYSOCKET.
+ * Return CURLE_AGAIN iff blocked on sending.
+ */
+CURLcode Curl_conn_send(struct Curl_easy *data, int sockindex,
+                        const void *buf, size_t len, bool eos,
+                        size_t *pnwritten);
 
 /**
  * Types and macros used to keep the current easy handle in filter calls,
@@ -499,22 +652,22 @@ struct cf_call_data {
  * a member in the cfilter's `ctx`.
  *
  * #define CF_CTX_CALL_DATA(cf)   -> struct cf_call_data instance
-*/
+ */
 
 #ifdef DEBUGBUILD
 
 #define CF_DATA_SAVE(save, cf, data) \
   do { \
     (save) = CF_CTX_CALL_DATA(cf); \
-    DEBUGASSERT((save).data == NULL || (save).depth > 0); \
+    DEBUGASSERT(!(save).data || (save).depth > 0); \
     CF_CTX_CALL_DATA(cf).depth++;  \
-    CF_CTX_CALL_DATA(cf).data = (struct Curl_easy *)data; \
+    CF_CTX_CALL_DATA(cf).data = (struct Curl_easy *)CURL_UNCONST(data); \
   } while(0)
 
 #define CF_DATA_RESTORE(cf, save) \
   do { \
     DEBUGASSERT(CF_CTX_CALL_DATA(cf).depth == (save).depth + 1); \
-    DEBUGASSERT((save).data == NULL || (save).depth > 0); \
+    DEBUGASSERT(!(save).data || (save).depth > 0); \
     CF_CTX_CALL_DATA(cf) = (save); \
   } while(0)
 
@@ -523,7 +676,7 @@ struct cf_call_data {
 #define CF_DATA_SAVE(save, cf, data) \
   do { \
     (save) = CF_CTX_CALL_DATA(cf); \
-    CF_CTX_CALL_DATA(cf).data = (struct Curl_easy *)data; \
+    CF_CTX_CALL_DATA(cf).data = (struct Curl_easy *)CURL_UNCONST(data); \
   } while(0)
 
 #define CF_DATA_RESTORE(cf, save) \
@@ -533,7 +686,6 @@ struct cf_call_data {
 
 #endif /* !DEBUGBUILD */
 
-#define CF_DATA_CURRENT(cf) \
-  ((cf)? (CF_CTX_CALL_DATA(cf).data) : NULL)
+#define CF_DATA_CURRENT(cf) ((cf) ? (CF_CTX_CALL_DATA(cf).data) : NULL)
 
 #endif /* HEADER_CURL_CFILTERS_H */
diff --git a/third-party/curl/lib/config-amigaos.h b/third-party/curl/lib/config-amigaos.h
deleted file mode 100644
index a6a518abb3..0000000000
--- a/third-party/curl/lib/config-amigaos.h
+++ /dev/null
@@ -1,135 +0,0 @@
-#ifndef HEADER_CURL_CONFIG_AMIGAOS_H
-#define HEADER_CURL_CONFIG_AMIGAOS_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-/* ================================================================ */
-/*               Hand crafted config file for AmigaOS               */
-/* ================================================================ */
-
-#ifdef __AMIGA__ /* Any AmigaOS flavour */
-
-#define HAVE_ARPA_INET_H 1
-#define HAVE_CLOSESOCKET_CAMEL 1
-#define HAVE_INTTYPES_H 1
-#define HAVE_IOCTLSOCKET_CAMEL 1
-#define HAVE_IOCTLSOCKET_CAMEL_FIONBIO 1
-#define HAVE_LONGLONG 1
-#define HAVE_NETDB_H 1
-#define HAVE_NETINET_IN_H 1
-#define HAVE_NET_IF_H 1
-#define HAVE_PWD_H 1
-#define HAVE_SELECT 1
-#define HAVE_SETJMP_H 1
-#define HAVE_SIGNAL 1
-#define HAVE_SIGNAL_H 1
-#define HAVE_SOCKET 1
-#define HAVE_STRCASECMP 1
-#define HAVE_STRDUP 1
-#define HAVE_STRICMP 1
-#define HAVE_STRINGS_H 1
-#define HAVE_STRING_H 1
-#define HAVE_STRUCT_TIMEVAL 1
-#define HAVE_SYS_PARAM_H 1
-#define HAVE_SYS_SOCKET_H 1
-#define HAVE_SYS_SOCKIO_H 1
-#define HAVE_SYS_STAT_H 1
-#define HAVE_SYS_TIME_H 1
-#define HAVE_SYS_TYPES_H 1
-#define HAVE_TIME_H 1
-#define HAVE_UNISTD_H 1
-#define HAVE_UTIME 1
-#define HAVE_UTIME_H 1
-#define HAVE_WRITABLE_ARGV 1
-#define HAVE_SYS_IOCTL_H 1
-
-#define NEED_MALLOC_H 1
-
-#define SIZEOF_INT 4
-#define SIZEOF_SIZE_T 4
-
-#ifndef SIZEOF_CURL_OFF_T
-#define SIZEOF_CURL_OFF_T 8
-#endif
-
-#define USE_MANUAL 1
-#define CURL_DISABLE_LDAP 1
-
-#ifndef OS
-#define OS "AmigaOS"
-#endif
-
-#define PACKAGE "curl"
-#define PACKAGE_BUGREPORT "a suitable mailing list: https://curl.se/mail/"
-#define PACKAGE_NAME "curl"
-#define PACKAGE_STRING "curl -"
-#define PACKAGE_TARNAME "curl"
-#define PACKAGE_VERSION "-"
-
-#if defined(USE_AMISSL)
-#define CURL_CA_PATH "AmiSSL:Certs"
-#elif defined(__MORPHOS__)
-#define CURL_CA_BUNDLE "MOSSYS:Data/SSL/curl-ca-bundle.crt"
-#else
-#define CURL_CA_BUNDLE "s:curl-ca-bundle.crt"
-#endif
-
-#define STDC_HEADERS 1
-#define TIME_WITH_SYS_TIME 1
-
-#define in_addr_t int
-
-#ifndef F_OK
-#  define F_OK 0
-#endif
-
-#ifndef O_RDONLY
-#  define O_RDONLY 0x0000
-#endif
-
-#ifndef LONG_MAX
-#  define LONG_MAX 0x7fffffffL
-#endif
-
-#ifndef LONG_MIN
-#  define LONG_MIN (-0x7fffffffL-1)
-#endif
-
-#define HAVE_RECV 1
-#define RECV_TYPE_ARG1 long
-#define RECV_TYPE_ARG2 char *
-#define RECV_TYPE_ARG3 long
-#define RECV_TYPE_ARG4 long
-#define RECV_TYPE_RETV long
-
-#define HAVE_SEND 1
-#define SEND_TYPE_ARG1 int
-#define SEND_QUAL_ARG2 const
-#define SEND_TYPE_ARG2 char *
-#define SEND_TYPE_ARG3 int
-#define SEND_TYPE_ARG4 int
-#define SEND_TYPE_RETV int
-
-#endif /* __AMIGA__ */
-#endif /* HEADER_CURL_CONFIG_AMIGAOS_H */
diff --git a/third-party/curl/lib/config-dos.h b/third-party/curl/lib/config-dos.h
deleted file mode 100644
index 05c1a81407..0000000000
--- a/third-party/curl/lib/config-dos.h
+++ /dev/null
@@ -1,142 +0,0 @@
-#ifndef HEADER_CURL_CONFIG_DOS_H
-#define HEADER_CURL_CONFIG_DOS_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-
-/* ================================================================ */
-/*       lib/config-dos.h - Hand crafted config file for DOS        */
-/* ================================================================ */
-
-#ifndef OS
-#if defined(DJGPP)
-  #define OS  "MSDOS/djgpp"
-#elif defined(__HIGHC__)
-  #define OS  "MSDOS/HighC"
-#else
-  #define OS  "MSDOS/?"
-#endif
-#endif
-
-#define PACKAGE  "curl"
-
-#define USE_MANUAL 1
-
-#define HAVE_ARPA_INET_H       1
-#define HAVE_FCNTL_H           1
-#define HAVE_FREEADDRINFO      1
-#define HAVE_GETADDRINFO       1
-#define HAVE_GETTIMEOFDAY      1
-#define HAVE_IO_H              1
-#define HAVE_IOCTL_FIONBIO     1
-#define HAVE_IOCTLSOCKET       1
-#define HAVE_IOCTLSOCKET_FIONBIO   1
-#define HAVE_LOCALE_H          1
-#define HAVE_LONGLONG          1
-#define HAVE_NETDB_H           1
-#define HAVE_NETINET_IN_H      1
-#define HAVE_NETINET_TCP_H     1
-#define HAVE_NET_IF_H          1
-#define HAVE_RECV              1
-#define HAVE_SELECT            1
-#define HAVE_SEND              1
-#define HAVE_SETJMP_H          1
-#define HAVE_SETLOCALE         1
-#define HAVE_SETMODE           1
-#define HAVE_SIGNAL            1
-#define HAVE_SOCKET            1
-#define HAVE_STRDUP            1
-#define HAVE_STRICMP           1
-#define HAVE_STRTOLL           1
-#define HAVE_STRUCT_TIMEVAL    1
-#define HAVE_SYS_IOCTL_H       1
-#define HAVE_SYS_SOCKET_H      1
-#define HAVE_SYS_STAT_H        1
-#define HAVE_SYS_TYPES_H       1
-#define HAVE_TIME_H            1
-#define HAVE_UNISTD_H          1
-
-#define NEED_MALLOC_H          1
-
-#define SIZEOF_INT             4
-#define SIZEOF_LONG            4
-#define SIZEOF_SIZE_T          4
-#define SIZEOF_CURL_OFF_T      8
-#define STDC_HEADERS           1
-#define TIME_WITH_SYS_TIME     1
-
-/* Qualifiers for send() and recv() */
-
-#define SEND_TYPE_ARG1         int
-#define SEND_QUAL_ARG2         const
-#define SEND_TYPE_ARG2         void *
-#define SEND_TYPE_ARG3         int
-#define SEND_TYPE_ARG4         int
-#define SEND_TYPE_RETV         int
-
-#define RECV_TYPE_ARG1         int
-#define RECV_TYPE_ARG2         void *
-#define RECV_TYPE_ARG3         int
-#define RECV_TYPE_ARG4         int
-#define RECV_TYPE_RETV         int
-
-#define BSD
-
-/* CURLDEBUG definition enables memory tracking */
-/* #define CURLDEBUG */
-
-/* to disable LDAP */
-#define CURL_DISABLE_LDAP        1
-
-#define in_addr_t  u_long
-
-#if defined(__HIGHC__) || \
-    (defined(__GNUC__) && (__GNUC__ < 4))
-  #define ssize_t  int
-#endif
-
-/* Target HAVE_x section */
-
-#if defined(DJGPP)
-  #define HAVE_BASENAME   1
-  #define HAVE_STRCASECMP 1
-  #define HAVE_SIGACTION  1
-  #define HAVE_SIGSETJMP  1
-  #define HAVE_SYS_TIME_H 1
-  #define HAVE_TERMIOS_H  1
-  #define HAVE_VARIADIC_MACROS_GCC 1
-
-#elif defined(__HIGHC__)
-  #define HAVE_SYS_TIME_H 1
-  #define strerror(e) strerror_s_((e))
-#endif
-
-#ifdef MSDOS  /* Watt-32 */
-  #define HAVE_CLOSE_S    1
-#endif
-
-#undef word
-#undef byte
-
-#endif /* HEADER_CURL_CONFIG_DOS_H */
diff --git a/third-party/curl/lib/config-mac.h b/third-party/curl/lib/config-mac.h
index ff6fdb25ae..fd9d3e7b60 100644
--- a/third-party/curl/lib/config-mac.h
+++ b/third-party/curl/lib/config-mac.h
@@ -27,23 +27,19 @@
 /* =================================================================== */
 /*                Hand crafted config file for Mac OS 9                */
 /* =================================================================== */
-/*  On Mac OS X you must run configure to generate curl_config.h file  */
+/*   On macOS you must run configure to generate curl_config.h file    */
 /* =================================================================== */
 
-#ifndef OS
-#define OS "mac"
+#ifndef CURL_OS
+#define CURL_OS "mac"
 #endif
 
 #include <ConditionalMacros.h>
-#if TYPE_LONGLONG
-#define HAVE_LONGLONG           1
-#endif
 
 /* Define if you want the built-in manual */
 #define USE_MANUAL              1
 
 #define HAVE_NETINET_IN_H       1
-#define HAVE_SYS_SOCKET_H       1
 #define HAVE_NETDB_H            1
 #define HAVE_ARPA_INET_H        1
 #define HAVE_UNISTD_H           1
@@ -51,42 +47,25 @@
 #define HAVE_SYS_TYPES_H        1
 #define HAVE_GETTIMEOFDAY       1
 #define HAVE_FCNTL_H            1
-#define HAVE_SYS_STAT_H         1
-#define HAVE_STDLIB_H           1
-#define HAVE_TIME_H             1
 #define HAVE_UTIME_H            1
-#define HAVE_SYS_TIME_H         1
 #define HAVE_SYS_UTIME_H        1
 #define HAVE_SYS_IOCTL_H        1
-
-#define TIME_WITH_SYS_TIME      1
-
 #define HAVE_ALARM              1
-#define HAVE_FTRUNCATE          1
 #define HAVE_UTIME              1
 #define HAVE_SELECT             1
 #define HAVE_SOCKET             1
 #define HAVE_STRUCT_TIMEVAL     1
 
 #define HAVE_SIGACTION          1
-#define HAVE_SIGNAL_H           1
 
-#ifdef MACOS_SSL_SUPPORT
-#  define USE_OPENSSL           1
-#endif
-
-#define CURL_DISABLE_LDAP       1
+#define CURL_DISABLE_LDAP
 
 #define HAVE_IOCTL_FIONBIO      1
 
 #define SIZEOF_INT              4
 #define SIZEOF_LONG             4
 #define SIZEOF_SIZE_T           4
-#ifdef HAVE_LONGLONG
 #define SIZEOF_CURL_OFF_T       8
-#else
-#define SIZEOF_CURL_OFF_T       4
-#endif
 
 #define HAVE_RECV 1
 #define RECV_TYPE_ARG1 int
@@ -97,13 +76,9 @@
 
 #define HAVE_SEND 1
 #define SEND_TYPE_ARG1 int
-#define SEND_QUAL_ARG2 const
 #define SEND_TYPE_ARG2 void *
 #define SEND_TYPE_ARG3 size_t
 #define SEND_TYPE_ARG4 int
 #define SEND_TYPE_RETV ssize_t
 
-#define HAVE_EXTRA_STRICMP_H 1
-#define HAVE_EXTRA_STRDUP_H  1
-
 #endif /* HEADER_CURL_CONFIG_MAC_H */
diff --git a/third-party/curl/lib/config-os400.h b/third-party/curl/lib/config-os400.h
index 2d0291d16d..76841af202 100644
--- a/third-party/curl/lib/config-os400.h
+++ b/third-party/curl/lib/config-os400.h
@@ -30,326 +30,262 @@
 
 #pragma enum(int)
 
-#undef PACKAGE
+/* ---------------------------------------------------------------- */
+/* Global configuration parameters: normally generated by autoconf. */
+/* ---------------------------------------------------------------- */
 
-/* Version number of this archive. */
-#undef VERSION
-
-/* Define cpu-machine-OS */
-#ifndef OS
-#define OS "OS/400"
-#endif
-
-/* OS400 supports a 3-argument ASCII version of gethostbyaddr_r(), but its
- *  prototype is incompatible with the "standard" one (1st argument is not
- *  const). However, getaddrinfo() is supported (ASCII version defined as
- *  a local wrapper in setup-os400.h) in a threadsafe way: we can then
- *  configure getaddrinfo() as such and get rid of gethostbyname_r() without
- *  loss of threadsafeness. */
-#undef HAVE_GETHOSTBYNAME_R
-#undef HAVE_GETHOSTBYNAME_R_3
-#undef HAVE_GETHOSTBYNAME_R_5
-#undef HAVE_GETHOSTBYNAME_R_6
-#define HAVE_GETADDRINFO
-#define HAVE_GETADDRINFO_THREADSAFE
-
-/* Define if you need the _REENTRANT define for some functions */
-#undef NEED_REENTRANT
-
-/* Define if you want to enable IPv6 support */
-#define ENABLE_IPV6
-
-/* Define if struct sockaddr_in6 has the sin6_scope_id member */
-#define HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID 1
-
-/* Define this to 'int' if ssize_t is not an available typedefed type */
-#undef ssize_t
-
-/* Define this as a suitable file to read random data from */
-#undef RANDOM_FILE
-
-/* Define to 1 if you have the alarm function. */
-#define HAVE_ALARM 1
-
-/* Define if you have the <arpa/inet.h> header file. */
-#define HAVE_ARPA_INET_H
-
-/* Define if you have the `closesocket' function. */
-#undef HAVE_CLOSESOCKET
-
-/* Define if you have the <fcntl.h> header file. */
-#define HAVE_FCNTL_H
-
-/* Define if you have the `geteuid' function. */
-#define HAVE_GETEUID
-
-/* Define if you have the `gethostname' function. */
-#define HAVE_GETHOSTNAME
-
-/* Define if you have the `getpass_r' function. */
-#undef HAVE_GETPASS_R
-
-/* Define to 1 if you have the getpeername function. */
-#define HAVE_GETPEERNAME 1
-
-/* Define if you have the `getpwuid' function. */
-#define HAVE_GETPWUID
-
-/* Define to 1 if you have the getsockname function. */
-#define HAVE_GETSOCKNAME 1
-
-/* Define if you have the `gettimeofday' function. */
-#define HAVE_GETTIMEOFDAY
-
-/* Define if you have the `timeval' struct. */
-#define HAVE_STRUCT_TIMEVAL
-
-/* Define if you have the <inttypes.h> header file. */
-#define HAVE_INTTYPES_H
-
-/* Define if you have the <io.h> header file. */
-#undef HAVE_IO_H
-
-/* Define if you have the `socket' library (-lsocket). */
-#undef HAVE_LIBSOCKET
-
-/* Define if you have GSS API. */
-#define HAVE_GSSAPI
-
-/* Define if you have the GNU gssapi libraries */
-#undef HAVE_GSSGNU
-
-/* Define if you have the Heimdal gssapi libraries */
-#define HAVE_GSSHEIMDAL
-
-/* Define if you have the MIT gssapi libraries */
-#undef HAVE_GSSMIT
-
-/* Define if you need the malloc.h header file even with stdlib.h  */
-/* #define NEED_MALLOC_H 1 */
-
-/* Define if you have the <netdb.h> header file. */
-#define HAVE_NETDB_H
-
-/* Define if you have the <netinet/in.h> header file. */
-#define HAVE_NETINET_IN_H
-
-/* Define if you have the <net/if.h> header file. */
-#define HAVE_NET_IF_H
-
-/* Define if you have the <pwd.h> header file. */
-#define HAVE_PWD_H
-
-/* Define if you have the `select' function. */
-#define HAVE_SELECT
-
-/* Define if you have the `sigaction' function. */
-#define HAVE_SIGACTION
-
-/* Define if you have the `signal' function. */
-#undef HAVE_SIGNAL
-
-/* Define if you have the <signal.h> header file. */
-#define HAVE_SIGNAL_H
-
-/* Define if you have the `socket' function. */
-#define HAVE_SOCKET
-
-/* Define if you have the <stdint.h> header file. */
-#undef HAVE_STDINT_H
-
-/* Define if you have the <stdlib.h> header file. */
-#define HAVE_STDLIB_H
-
-
-/* The following define is needed on OS400 to enable strcmpi(), stricmp() and
-   strdup(). */
-#define __cplusplus__strings__
-
-/* Define if you have the `strcasecmp' function. */
-#undef HAVE_STRCASECMP
-
-/* Define if you have the `strcmpi' function. */
-#define HAVE_STRCMPI
-
-/* Define if you have the `stricmp' function. */
-#define HAVE_STRICMP
-
-/* Define if you have the `strdup' function. */
-#define HAVE_STRDUP
-
-/* Define if you have the <strings.h> header file. */
-#define HAVE_STRINGS_H
-
-/* Define if you have the <string.h> header file. */
-#define HAVE_STRING_H
-
-/* Define if you have the <stropts.h> header file. */
-#undef HAVE_STROPTS_H
-
-/* Define if you have the `strtok_r' function. */
-#define HAVE_STRTOK_R
-
-/* Define if you have the `strtoll' function. */
-#undef HAVE_STRTOLL             /* Allows ASCII compile on V5R1. */
-
-/* Define if you have the <sys/param.h> header file. */
-#define HAVE_SYS_PARAM_H
-
-/* Define if you have the <sys/select.h> header file. */
-#undef HAVE_SYS_SELECT_H
-
-/* Define if you have the <sys/socket.h> header file. */
-#define HAVE_SYS_SOCKET_H
-
-/* Define if you have the <sys/sockio.h> header file. */
-#undef HAVE_SYS_SOCKIO_H
-
-/* Define if you have the <sys/stat.h> header file. */
-#define HAVE_SYS_STAT_H
-
-/* Define if you have the <sys/time.h> header file. */
-#define HAVE_SYS_TIME_H
-
-/* Define if you have the <sys/types.h> header file. */
-#define HAVE_SYS_TYPES_H
-
-/* Define if you have the <sys/un.h> header file. */
-#define HAVE_SYS_UN_H
-
-/* Define if you have the <sys/ioctl.h> header file. */
-#define HAVE_SYS_IOCTL_H
-
-/* Define if you have the <termios.h> header file. */
-#undef HAVE_TERMIOS_H
-
-/* Define if you have the <termio.h> header file. */
-#undef HAVE_TERMIO_H
-
-/* Define if you have the <time.h> header file. */
-#define HAVE_TIME_H
-
-/* Define if you have the <unistd.h> header file. */
-#define HAVE_UNISTD_H
-
-/* Name of package */
-#undef PACKAGE
-
-/* The size of `int', as computed by sizeof. */
-#define SIZEOF_INT              4
-
-/* Define if the compiler supports the 'long long' data type. */
-#define HAVE_LONGLONG
-
-/* The size of a `long long', as computed by sizeof. */
-#define SIZEOF_LONG_LONG        8
-
-/* The size of `long', as computed by sizeof. */
-#define SIZEOF_LONG             4
-
-/* The size of `size_t', as computed by sizeof. */
-#define SIZEOF_SIZE_T           4
-
-/* The size of `curl_off_t', as computed by sizeof. */
-#define SIZEOF_CURL_OFF_T       8
-
-/* Define this if you have struct sockaddr_storage */
-#define HAVE_STRUCT_SOCKADDR_STORAGE
-
-/* Define if you have the ANSI C header files. */
-#define STDC_HEADERS
-
-/* Define if you can safely include both <sys/time.h> and <time.h>. */
-#define TIME_WITH_SYS_TIME
-
-/* Define to enable HTTP3 support (experimental, requires NGTCP2, QUICHE or
-   MSH3) */
-#undef ENABLE_QUIC
-
-/* Version number of package */
-#undef VERSION
-
-/* Number of bits in a file offset, on hosts where this is settable. */
-#undef _FILE_OFFSET_BITS
-
-/* Define for large files, on AIX-style hosts. */
-#define _LARGE_FILES
-
-/* Define to empty if `const' does not conform to ANSI C. */
-#undef const
-
-/* type to use in place of in_addr_t if not defined */
-#define in_addr_t       unsigned long
-
-/* Define to `unsigned' if <sys/types.h> does not define. */
-#undef size_t
-
-/* Define if you have a working ioctl FIONBIO function. */
-#define HAVE_IOCTL_FIONBIO
-
-/* Define if you have a working ioctl SIOCGIFADDR function. */
-#define HAVE_IOCTL_SIOCGIFADDR
-
-/* To disable LDAP */
-#undef CURL_DISABLE_LDAP
+/* Location of default CA bundle */
+/* Use the system keyring as the default CA bundle. */
+#define CURL_CA_BUNDLE          "/QIBM/UserData/ICSS/Cert/Server/DEFAULT.KDB"
 
 /* Definition to make a library symbol externally visible. */
 #define CURL_EXTERN_SYMBOL
 
-/* Define if you have the ldap_url_parse procedure. */
-/* #define HAVE_LDAP_URL_PARSE */    /* Disabled because of an IBM bug. */
+/* cpu-machine-OS */
+#ifndef CURL_OS
+#define CURL_OS                 "OS/400"
+#endif
 
-/* Define if you have the recv function. */
-#define HAVE_RECV
+/* Define to 1 if you have the alarm function. */
+#define HAVE_ALARM              1
 
-/* Define to the type of arg 1 for recv. */
-#define RECV_TYPE_ARG1 int
+/* Define if you have the <arpa/inet.h> header file. */
+#define HAVE_ARPA_INET_H        1
 
-/* Define to the type of arg 2 for recv. */
-#define RECV_TYPE_ARG2 char *
+/* if you have <dirent.h> */
+#define HAVE_DIRENT_H
 
-/* Define to the type of arg 3 for recv. */
-#define RECV_TYPE_ARG3 int
+/* Define to 1 if you have the fcntl function. */
+#define HAVE_FCNTL              1
 
-/* Define to the type of arg 4 for recv. */
-#define RECV_TYPE_ARG4 int
+/* Define to 1 if you have the <fcntl.h> header file. */
+#define HAVE_FCNTL_H            1
 
-/* Define to the function return type for recv. */
-#define RECV_TYPE_RETV int
+/* Define to 1 if you have a working fcntl O_NONBLOCK function. */
+#define HAVE_FCNTL_O_NONBLOCK   1
 
-/* Define if you have the send function. */
-#define HAVE_SEND
+/* Define to 1 if you have the freeaddrinfo function. */
+#define HAVE_FREEADDRINFO       1
 
-/* Define to the type of arg 1 for send. */
-#define SEND_TYPE_ARG1 int
+/* Define to 1 if you have a working getaddrinfo function. */
+#define HAVE_GETADDRINFO                1
 
-/* Define to the type qualifier of arg 2 for send. */
-#define SEND_QUAL_ARG2
+/* Define to 1 if the getaddrinfo function is thread-safe. */
+#define HAVE_GETADDRINFO_THREADSAFE     1
 
-/* Define to the type of arg 2 for send. */
-#define SEND_TYPE_ARG2 char *
+/* Define to 1 if you have the 'geteuid' function. */
+#define HAVE_GETEUID                    1
 
-/* Define to the type of arg 3 for send. */
-#define SEND_TYPE_ARG3 int
+/* Define to 1 if you have the gethostname function. */
+#define HAVE_GETHOSTNAME        1
 
-/* Define to the type of arg 4 for send. */
-#define SEND_TYPE_ARG4 int
+/* Define to 1 if you have the getpeername function. */
+#define HAVE_GETPEERNAME        1
 
-/* Define to the function return type for send. */
-#define SEND_TYPE_RETV int
+/* Define to 1 if you have the 'getppid' function. */
+#define HAVE_GETPPID            1
+
+/* Define to 1 if you have the 'getpwuid' function. */
+#define HAVE_GETPWUID           1
+
+/* Define to 1 if you have the getsockname function. */
+#define HAVE_GETSOCKNAME        1
+
+/* Define to 1 if you have the 'gettimeofday' function. */
+#define HAVE_GETTIMEOFDAY       1
+
+/* if you have GSS-API libraries */
+#define HAVE_GSSAPI
+
+/* Define to 1 if you have a working ioctl FIONBIO function. */
+#define HAVE_IOCTL_FIONBIO      1
+
+/* Define to 1 if you have a working ioctl SIOCGIFADDR function. */
+#define HAVE_IOCTL_SIOCGIFADDR  1
+
+/* Define to 1 if you have the lber.h header file. */
+#define HAVE_LBER_H             1
+
+/* Define to 1 if you have the ldap.h header file. */
+#define HAVE_LDAP_H             1
+
+/* Define to 1 if you have a working localtime_r function. */
+#define HAVE_LOCALTIME_R        1
+
+/* Define to 1 if you have the <netdb.h> header file. */
+#define HAVE_NETDB_H            1
+
+/* Define to 1 if you have the <netinet/in.h> header file. */
+#define HAVE_NETINET_IN_H       1
+
+/* Define to 1 if you have the <netinet/tcp.h> header file. */
+#define HAVE_NETINET_TCP_H      1
+
+/* Define to 1 if you have the <netinet/udp.h> header file. */
+#define HAVE_NETINET_UDP_H      1
+
+/* Define to 1 if you have the <net/if.h> header file. */
+#define HAVE_NET_IF_H           1
+
+/* if you have opendir */
+#define HAVE_OPENDIR
+
+/* Define to 1 if you have the 'pipe' function. */
+#define HAVE_PIPE               1
+
+/* Define to 1 if you have the <pwd.h> header file. */
+#define HAVE_PWD_H              1
+
+/* Define to 1 if you have the recv function. */
+#define HAVE_RECV               1
+
+/* Define to 1 if symbol `sa_family_t' exists */
+#define HAVE_SA_FAMILY_T        1
+
+/* Define to 1 if you have the select function. */
+#define HAVE_SELECT             1
+
+/* Define to 1 if you have the send function. */
+#define HAVE_SEND               1
+
+/* Define to 1 if you have the 'sendmsg' function. */
+#define HAVE_SENDMSG            1
+
+/* Define to 1 if you have the sigaction function. */
+#define HAVE_SIGACTION          1
+
+/* Define to 1 if struct sockaddr_in6 has the sin6_scope_id member */
+#define HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID 1
+
+/* Define to 1 if you have the socketpair function. */
+#define HAVE_SOCKET             1
+
+/* Define to 1 if you have the <stdbool.h> header file. */
+#define HAVE_STDBOOL_H          1
+
+/* Define to 1 if you have the <stdint.h> header file. */
+#define HAVE_STDINT_H           1
+
+/* Define to 1 if you have the <stdio.h> header file. */
+#define HAVE_STDIO_H            1
+
+/* Define to 1 if you have the <stdlib.h> header file. */
+#define HAVE_STDLIB_H           1
+
+/* Define to 1 if you have the stricmp function. */
+#define HAVE_STRICMP            1
+
+/* Define to 1 if you have the <strings.h> header file. */
+#define HAVE_STRINGS_H          1
+
+/* Define to 1 if you have the <string.h> header file. */
+#define HAVE_STRING_H           1
+
+/* if struct sockaddr_storage is defined */
+#define HAVE_STRUCT_SOCKADDR_STORAGE
+
+/* Define to 1 if you have the timeval struct. */
+#define HAVE_STRUCT_TIMEVAL     1
+
+/* Define to 1 if you have the <sys/ioctl.h> header file. */
+#define HAVE_SYS_IOCTL_H        1
+
+/* Define to 1 if you have the <sys/param.h> header file. */
+#define HAVE_SYS_PARAM_H        1
+
+/* Define to 1 if you have the <sys/resource.h> header file. */
+#define HAVE_SYS_RESOURCE_H     1
+
+/* Define to 1 if you have the <sys/stat.h> header file. */
+#define HAVE_SYS_STAT_H         1
+
+/* Define to 1 if you have the <sys/types.h> header file. */
+#define HAVE_SYS_TYPES_H        1
+
+/* Define to 1 if you have the <sys/un.h> header file. */
+#define HAVE_SYS_UN_H           1
+
+/* Define to 1 if you have the <unicode/uidna.h> header file. */
+#define HAVE_UNICODE_UIDNA_H    1
+
+/* Define to 1 if you have the <unistd.h> header file. */
+#define HAVE_UNISTD_H           1
+
+/* Define to 1 if you have the 'utime' function. */
+#define HAVE_UTIME              1
+
+/* Define to 1 if you have the <utime.h> header file. */
+#define HAVE_UTIME_H            1
+
+/* Size of curl_off_t in number of bytes */
+#define SIZEOF_CURL_OFF_T       8
+
+/* Size of curl_socket_t in number of bytes */
+#define SIZEOF_CURL_SOCKET_T    4
+
+/* Size of int in number of bytes */
+#define SIZEOF_INT              4
+
+/* Size of long in number of bytes */
+#define SIZEOF_LONG             4
+
+/* Size of off_t in number of bytes */
+#define SIZEOF_OFF_T            8       /* _LARGE_FILES (*IFS64IO) version. */
+
+/* Size of size_t in number of bytes */
+#define SIZEOF_SIZE_T           4
+
+/* Size of time_t in number of bytes */
+#define SIZEOF_TIME_T           4
+
+/* Define to 1 if all of the C89 standard headers exist (not only the ones
+   required in a freestanding environment). This macro is provided for
+   backward compatibility; new code need not use it. */
+#define STDC_HEADERS            1
+
+/* Define if you want to enable IPv6 support */
+#define USE_IPV6
+
+/* Use Unix domain sockets */
+#define USE_UNIX_SOCKETS
+
+/* Define to 1 if OS is AIX. */
+#ifndef _ALL_SOURCE
+#  undef _ALL_SOURCE
+#endif
+
+/* ---------------------------------------------------------------- */
+/*          recv/send parameter types (see lib/functypes.h)         */
+/* ---------------------------------------------------------------- */
+
+/* int recv(int, char *, int, int); */
+#define RECV_TYPE_ARG1          int
+#define RECV_TYPE_ARG2          char *
+#define RECV_TYPE_ARG3          int
+#define RECV_TYPE_ARG4          int
+#define RECV_TYPE_RETV          int
+
+/* int send(int, char *, int, int); */
+#define SEND_TYPE_ARG1          int
+#define SEND_NONCONST_ARG2
+#define SEND_TYPE_ARG2          char *
+#define SEND_TYPE_ARG3          int
+#define SEND_TYPE_ARG4          int
+#define SEND_TYPE_RETV          int
+
+/* ---------------------------------------------------------------- */
+/*           Additional definitions specific to OS/400              */
+/* ---------------------------------------------------------------- */
+
+/* The <gssapi.h> header file is in the main system include directory. */
+#define HAVE_GSSAPI_H
 
 /* Define to use the OS/400 crypto library. */
 #define USE_OS400CRYPTO
 
-/* Define to use Unix sockets. */
-#define USE_UNIX_SOCKETS
-
-/* Use the system keyring as the default CA bundle. */
-#define CURL_CA_BUNDLE  "/QIBM/UserData/ICSS/Cert/Server/DEFAULT.KDB"
-
-/* ---------------------------------------------------------------- */
-/*                       ADDITIONAL DEFINITIONS                     */
-/* ---------------------------------------------------------------- */
+/* The following definition is required on OS/400 to enable strcmpi(),
+   stricmp() and strdup(). */
+#define __cplusplus__strings__
 
 /* The following must be defined BEFORE system header files inclusion. */
 
diff --git a/third-party/curl/lib/config-plan9.h b/third-party/curl/lib/config-plan9.h
deleted file mode 100644
index 54f89b06cf..0000000000
--- a/third-party/curl/lib/config-plan9.h
+++ /dev/null
@@ -1,156 +0,0 @@
-#ifndef HEADER_CURL_CONFIG_PLAN9_H
-#define HEADER_CURL_CONFIG_PLAN9_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#define BUILDING_LIBCURL 1
-#define CURL_CA_BUNDLE "/sys/lib/tls/ca.pem"
-#define CURL_CA_PATH "/sys/lib/tls"
-#define CURL_STATICLIB 1
-#define ENABLE_IPV6 1
-#define CURL_DISABLE_LDAP 1
-
-#define NEED_REENTRANT 1
-#ifndef OS
-#define OS "plan9"
-#endif
-#define PACKAGE "curl"
-#define PACKAGE_NAME "curl"
-#define PACKAGE_BUGREPORT "a suitable mailing list: https://curl.se/mail/"
-#define PACKAGE_STRING "curl -"
-#define PACKAGE_TARNAME "curl"
-#define PACKAGE_VERSION "-"
-#define RANDOM_FILE "/dev/random"
-#define VERSION "0.0.0" /* TODO */
-
-#define STDC_HEADERS 1
-
-#ifdef _BITS64
-#error not implement
-#else
-#define SIZEOF_INT 4
-#define SIZEOF_LONG 4
-#define SIZEOF_OFF_T 8
-#define SIZEOF_CURL_OFF_T 4 /* curl_off_t = timediff_t = int */
-#define SIZEOF_SIZE_T 4
-#define SIZEOF_TIME_T 4
-#endif
-
-#define HAVE_RECV 1
-#define RECV_TYPE_ARG1 int
-#define RECV_TYPE_ARG2 void *
-#define RECV_TYPE_ARG3 int
-#define RECV_TYPE_ARG4 int
-#define RECV_TYPE_RETV int
-
-#define HAVE_SELECT 1
-
-#define HAVE_SEND 1
-#define SEND_TYPE_ARG1 int
-#define SEND_TYPE_ARG2 void *
-#define SEND_QUAL_ARG2
-#define SEND_TYPE_ARG3 int
-#define SEND_TYPE_ARG4 int
-#define SEND_TYPE_RETV int
-
-#define HAVE_ALARM 1
-#define HAVE_ARPA_INET_H 1
-#define HAVE_BASENAME 1
-#define HAVE_BOOL_T 1
-#define HAVE_FCNTL 1
-#define HAVE_FCNTL_H 1
-#define HAVE_FREEADDRINFO 1
-#define HAVE_FTRUNCATE 1
-#define HAVE_GETADDRINFO 1
-#define HAVE_GETEUID 1
-#define HAVE_GETHOSTNAME 1
-#define HAVE_GETPPID 1
-#define HAVE_GETPWUID 1
-#define HAVE_GETTIMEOFDAY 1
-#define HAVE_GMTIME_R 1
-#define HAVE_INET_NTOP 1
-#define HAVE_INET_PTON 1
-#define HAVE_INTTYPES_H 1
-#define HAVE_LIBGEN_H 1
-#define HAVE_LIBZ 1
-#define HAVE_LOCALE_H 1
-#define HAVE_LONGLONG 1
-#define HAVE_NETDB_H 1
-#define HAVE_NETINET_IN_H 1
-#define HAVE_NETINET_TCP_H 1
-#define HAVE_PWD_H 1
-#define HAVE_SYS_SELECT_H 1
-
-#define USE_OPENSSL 1
-
-#define HAVE_PIPE 1
-#define HAVE_POLL_FINE 1
-#define HAVE_POLL_H 1
-#define HAVE_PTHREAD_H 1
-#define HAVE_SETJMP_H 1
-#define HAVE_SETLOCALE 1
-
-#define HAVE_SIGACTION 1
-#define HAVE_SIGNAL 1
-#define HAVE_SIGNAL_H 1
-#define HAVE_SIGSETJMP 1
-#define HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID 1
-#define HAVE_SOCKET 1
-#define HAVE_SSL_GET_SHUTDOWN 1
-#define HAVE_STDBOOL_H 1
-#define HAVE_STDINT_H 1
-#define HAVE_STDLIB_H 1
-#define HAVE_STRCASECMP 1
-#define HAVE_STRDUP 1
-#define HAVE_STRING_H 1
-#define HAVE_STRTOK_R 1
-#define HAVE_STRTOLL 1
-#define HAVE_STRUCT_TIMEVAL 1
-#define HAVE_SYS_IOCTL_H 1
-#define HAVE_SYS_PARAM_H 1
-#define HAVE_SYS_RESOURCE_H 1
-#define HAVE_SYS_SOCKET_H 1
-#define HAVE_SYS_STAT_H 1
-#define HAVE_SYS_TIME_H 1
-#define HAVE_SYS_TYPES_H 1
-#define HAVE_SYS_UN_H 1
-#define HAVE_TERMIOS_H 1
-#define HAVE_TIME_H 1
-#define HAVE_UNISTD_H 1
-#define HAVE_UTIME 1
-#define HAVE_UTIME_H 1
-
-#define HAVE_POSIX_STRERROR_R 1
-#define HAVE_STRERROR_R 1
-
-#define TIME_WITH_SYS_TIME 1
-#define USE_MANUAL 1
-
-#define __attribute__(x)
-
-#ifndef __cplusplus
-#undef inline
-#endif
-
-#endif /* HEADER_CURL_CONFIG_PLAN9_H */
diff --git a/third-party/curl/lib/config-riscos.h b/third-party/curl/lib/config-riscos.h
index 94946187d8..afff218a76 100644
--- a/third-party/curl/lib/config-riscos.h
+++ b/third-party/curl/lib/config-riscos.h
@@ -28,98 +28,38 @@
 /*               Hand crafted config file for RISC OS               */
 /* ================================================================ */
 
-/* Name of this package! */
-#undef PACKAGE
-
-/* Version number of this archive. */
-#undef VERSION
-
 /* Define cpu-machine-OS */
-#ifndef OS
-#define OS "ARM-RISC OS"
+#ifndef CURL_OS
+#define CURL_OS "ARM-RISC OS"
 #endif
 
 /* Define if you want the built-in manual */
 #define USE_MANUAL
 
-/* Define if you have the gethostbyname_r() function with 3 arguments */
-#undef HAVE_GETHOSTBYNAME_R_3
-
-/* Define if you have the gethostbyname_r() function with 5 arguments */
-#undef HAVE_GETHOSTBYNAME_R_5
-
-/* Define if you have the gethostbyname_r() function with 6 arguments */
-#undef HAVE_GETHOSTBYNAME_R_6
-
-/* Define if you need the _REENTRANT define for some functions */
-#undef NEED_REENTRANT
-
-/* Define if you want to enable IPv6 support */
-#undef ENABLE_IPV6
-
 /* Define if struct sockaddr_in6 has the sin6_scope_id member */
 #define HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID 1
 
-/* Define this to 'int' if ssize_t is not an available typedefed type */
-#undef ssize_t
-
-/* Define this as a suitable file to read random data from */
-#undef RANDOM_FILE
-
-/* Define if you want to enable IPv6 support */
-#undef ENABLE_IPV6
-
 /* Define if you have the alarm function. */
 #define HAVE_ALARM
 
 /* Define if you have the <arpa/inet.h> header file. */
 #define HAVE_ARPA_INET_H
 
-/* Define if you have the `closesocket' function. */
-#undef HAVE_CLOSESOCKET
-
 /* Define if you have the <fcntl.h> header file. */
 #define HAVE_FCNTL_H
 
-/* Define if you have the `ftruncate' function. */
-#define HAVE_FTRUNCATE
-
 /* Define if getaddrinfo exists and works */
 #define HAVE_GETADDRINFO
 
-/* Define if you have the `geteuid' function. */
-#undef HAVE_GETEUID
-
-/* Define if you have the `gethostbyname_r' function. */
-#undef HAVE_GETHOSTBYNAME_R
-
 /* Define if you have the `gethostname' function. */
 #define HAVE_GETHOSTNAME
 
-/* Define if you have the `getpass_r' function. */
-#undef HAVE_GETPASS_R
-
-/* Define if you have the `getpwuid' function. */
-#undef HAVE_GETPWUID
-
 /* Define if you have the `gettimeofday' function. */
 #define HAVE_GETTIMEOFDAY
 
 /* Define if you have the `timeval' struct. */
 #define HAVE_STRUCT_TIMEVAL
 
-/* Define if you have the <inttypes.h> header file. */
-#define HAVE_INTTYPES_H
-
-/* Define if you have the <io.h> header file. */
-#undef HAVE_IO_H
-
-/* Define if you have the `socket' library (-lsocket). */
-#undef HAVE_LIBSOCKET
-
-/* Define if you need the malloc.h header file even with stdlib.h  */
-/* #define NEED_MALLOC_H 1 */
-
 /* Define if you have the <netdb.h> header file. */
 #define HAVE_NETDB_H
 
@@ -129,130 +69,33 @@
 /* Define if you have the <net/if.h> header file. */
 #define HAVE_NET_IF_H
 
-/* Define if you have the <pwd.h> header file. */
-#undef HAVE_PWD_H
-
 /* Define if you have the `select' function. */
 #define HAVE_SELECT
 
-/* Define if you have the `sigaction' function. */
-#undef HAVE_SIGACTION
-
 /* Define if you have the `signal' function. */
 #define HAVE_SIGNAL
 
-/* Define if you have the <signal.h> header file. */
-#define HAVE_SIGNAL_H
-
 /* Define if you have the `socket' function. */
 #define HAVE_SOCKET
 
-/* Define if you have the <stdint.h> header file. */
-#undef HAVE_STDINT_H
-
-/* Define if you have the <stdlib.h> header file. */
-#define HAVE_STDLIB_H
-
-/* Define if you have the `strcasecmp' function. */
-#undef HAVE_STRCASECMP
-
-/* Define if you have the `strcmpi' function. */
-#undef HAVE_STRCMPI
-
-/* Define if you have the `strdup' function. */
-#define HAVE_STRDUP
-
 /* Define if you have the `stricmp' function. */
 #define HAVE_STRICMP
 
-/* Define if you have the <strings.h> header file. */
-#undef HAVE_STRINGS_H
-
-/* Define if you have the <string.h> header file. */
-#define HAVE_STRING_H
-
-/* Define if you have the `strtok_r' function. */
-#undef HAVE_STRTOK_R
-
-/* Define if you have the `strtoll' function. */
-#undef HAVE_STRTOLL
-
-/* Define if you have the <sys/param.h> header file. */
-#undef HAVE_SYS_PARAM_H
-
-/* Define if you have the <sys/select.h> header file. */
-#undef HAVE_SYS_SELECT_H
-
-/* Define if you have the <sys/socket.h> header file. */
-#define HAVE_SYS_SOCKET_H
-
-/* Define if you have the <sys/sockio.h> header file. */
-#undef HAVE_SYS_SOCKIO_H
-
-/* Define if you have the <sys/stat.h> header file. */
-#undef HAVE_SYS_STAT_H
-
-/* Define if you have the <sys/time.h> header file. */
-#define HAVE_SYS_TIME_H
-
 /* Define if you have the <sys/types.h> header file. */
 #define HAVE_SYS_TYPES_H
 
 /* Define if you have the <termios.h> header file. */
 #define HAVE_TERMIOS_H
 
-/* Define if you have the <termio.h> header file. */
-#undef HAVE_TERMIO_H
-
-/* Define if you have the <time.h> header file. */
-#undef HAVE_TIME_H
-
 /* Define if you have the <unistd.h> header file. */
 #define HAVE_UNISTD_H
 
-/* Name of package */
-#undef PACKAGE
-
 /* The size of `int', as computed by sizeof. */
 #define SIZEOF_INT 4
 
-/* The size of `long long', as computed by sizeof. */
-#undef SIZEOF_LONG_LONG
-
 /* The size of `size_t', as computed by sizeof. */
 #define SIZEOF_SIZE_T 4
 
-/* Define if you have the ANSI C header files. */
-#undef STDC_HEADERS
-
-/* Define if you can safely include both <sys/time.h> and <time.h>. */
-#undef TIME_WITH_SYS_TIME
-
-/* Version number of package */
-#undef VERSION
-
-/* Define if on AIX 3.
-   System headers sometimes define this.
-   We just want to avoid a redefinition error message.  */
-#ifndef _ALL_SOURCE
-# undef _ALL_SOURCE
-#endif
-
-/* Number of bits in a file offset, on hosts where this is settable. */
-#undef _FILE_OFFSET_BITS
-
-/* Define for large files, on AIX-style hosts. */
-#undef _LARGE_FILES
-
-/* Define to empty if `const' does not conform to ANSI C. */
-#undef const
-
-/* Define to `unsigned' if <sys/types.h> does not define. */
-#undef size_t
-
-/* Define to `int' if <sys/types.h> does not define. */
-#undef ssize_t
-
 /* Define if you have a working ioctl FIONBIO function. */
 #define HAVE_IOCTL_FIONBIO
 
@@ -283,9 +126,6 @@
 /* Define to the type of arg 1 for send. */
 #define SEND_TYPE_ARG1 int
 
-/* Define to the type qualifier of arg 2 for send. */
-#define SEND_QUAL_ARG2 const
-
 /* Define to the type of arg 2 for send. */
 #define SEND_TYPE_ARG2 void *
 
diff --git a/third-party/curl/lib/config-win32.h b/third-party/curl/lib/config-win32.h
index fd2503668f..b1fc102209 100644
--- a/third-party/curl/lib/config-win32.h
+++ b/third-party/curl/lib/config-win32.h
@@ -32,115 +32,38 @@
 /*                          HEADER FILES                            */
 /* ---------------------------------------------------------------- */
 
-/* Define if you have the <arpa/inet.h> header file. */
-/* #define HAVE_ARPA_INET_H 1 */
-
 /* Define if you have the <fcntl.h> header file. */
 #define HAVE_FCNTL_H 1
 
-/* Define to 1 if you have the <inttypes.h> header file. */
-#if defined(__MINGW32__) || \
-    (defined(_MSC_VER) && (_MSC_VER >= 1800))
-#define HAVE_INTTYPES_H 1
-#endif
-
-/* Define to 1 if you have the <stdint.h> header file. */
-#if defined(__MINGW32__) || defined(__POCC__) || \
-    (defined(_MSC_VER) && (_MSC_VER >= 1600)) || \
-    (defined(__BORLANDC__) && (__BORLANDC__ >= 0x0582))
-#define HAVE_STDINT_H 1
-#endif
-
 /* Define if you have the <io.h> header file. */
 #define HAVE_IO_H 1
 
 /* Define if you have the <locale.h> header file. */
 #define HAVE_LOCALE_H 1
 
-/* Define if you need <malloc.h> header even with <stdlib.h> header file. */
-#if !defined(__SALFORDC__) && !defined(__POCC__)
-#define NEED_MALLOC_H 1
-#endif
-
-/* Define if you have the <netdb.h> header file. */
-/* #define HAVE_NETDB_H 1 */
-
-/* Define if you have the <netinet/in.h> header file. */
-/* #define HAVE_NETINET_IN_H 1 */
-
-/* Define if you have the <signal.h> header file. */
-#define HAVE_SIGNAL_H 1
-
 /* Define to 1 if you have the <stdbool.h> header file. */
-#if (defined(_MSC_VER) && (_MSC_VER >= 1800)) || \
-    defined(__MINGW64_VERSION_MAJOR)
+#if (defined(_MSC_VER) && (_MSC_VER >= 1800)) || defined(__MINGW32__)
 #define HAVE_STDBOOL_H 1
 #endif
 
-/* Define if you have the <stdlib.h> header file. */
-#define HAVE_STDLIB_H 1
-
 /* Define if you have the <sys/param.h> header file. */
-/* #define HAVE_SYS_PARAM_H 1 */
-
-/* Define if you have the <sys/select.h> header file. */
-/* #define HAVE_SYS_SELECT_H 1 */
-
-/* Define if you have the <sys/socket.h> header file. */
-/* #define HAVE_SYS_SOCKET_H 1 */
-
-/* Define if you have the <sys/sockio.h> header file. */
-/* #define HAVE_SYS_SOCKIO_H 1 */
-
-/* Define if you have the <sys/stat.h> header file. */
-#define HAVE_SYS_STAT_H 1
-
-/* Define if you have the <sys/time.h> header file. */
-/* #define HAVE_SYS_TIME_H 1 */
+#ifdef __MINGW32__
+#define HAVE_SYS_PARAM_H 1
+#endif
 
 /* Define if you have the <sys/types.h> header file. */
 #define HAVE_SYS_TYPES_H 1
 
 /* Define if you have the <sys/utime.h> header file. */
-#ifndef __BORLANDC__
 #define HAVE_SYS_UTIME_H 1
-#endif
-
-/* Define if you have the <termio.h> header file. */
-/* #define HAVE_TERMIO_H 1 */
-
-/* Define if you have the <termios.h> header file. */
-/* #define HAVE_TERMIOS_H 1 */
-
-/* Define if you have the <time.h> header file. */
-#define HAVE_TIME_H 1
 
 /* Define if you have the <unistd.h> header file. */
-#if defined(__MINGW32__) || defined(__LCC__) || defined(__POCC__)
+#ifdef __MINGW32__
 #define HAVE_UNISTD_H 1
 #endif
 
-/* Define if you have the <windows.h> header file. */
-#define HAVE_WINDOWS_H 1
-
-/* Define if you have the <winsock2.h> header file. */
-#ifndef __SALFORDC__
-#define HAVE_WINSOCK2_H 1
-#endif
-
-/* Define if you have the <ws2tcpip.h> header file. */
-#ifndef __SALFORDC__
-#define HAVE_WS2TCPIP_H 1
-#endif
-
-/* Define to 1 if you have the <setjmp.h> header file. */
-#define HAVE_SETJMP_H 1
-
-/* Define to 1 if you have the <string.h> header file. */
-#define HAVE_STRING_H 1
-
 /* Define to 1 if you have the <libgen.h> header file. */
-#if defined(__MINGW64_VERSION_MAJOR)
+#ifdef __MINGW32__
 #define HAVE_LIBGEN_H 1
 #endif
 
@@ -151,12 +74,8 @@
 /* Define if you have the ANSI C header files. */
 #define STDC_HEADERS 1
 
-/* Define if you can safely include both <sys/time.h> and <time.h>. */
-/* #define TIME_WITH_SYS_TIME 1 */
-
 /* Define to 1 if bool is an available type. */
-#if (defined(_MSC_VER) && (_MSC_VER >= 1800)) || \
-    defined(__MINGW64_VERSION_MAJOR)
+#if (defined(_MSC_VER) && (_MSC_VER >= 1800)) || defined(__MINGW32__)
 #define HAVE_BOOL_T 1
 #endif
 
@@ -167,11 +86,6 @@
 /* Define if you have the closesocket function. */
 #define HAVE_CLOSESOCKET 1
 
-/* Define if you have the ftruncate function. */
-#if defined(__MINGW64_VERSION_MAJOR)
-#define HAVE_FTRUNCATE 1
-#endif
-
 /* Define to 1 if you have the `getpeername' function. */
 #define HAVE_GETPEERNAME 1
 
@@ -182,7 +96,9 @@
 #define HAVE_GETHOSTNAME 1
 
 /* Define if you have the gettimeofday function. */
-/* #define HAVE_GETTIMEOFDAY 1 */
+#ifdef __MINGW32__
+#define HAVE_GETTIMEOFDAY 1
+#endif
 
 /* Define if you have the ioctlsocket function. */
 #define HAVE_IOCTLSOCKET 1
@@ -196,33 +112,11 @@
 /* Define if you have the setlocale function. */
 #define HAVE_SETLOCALE 1
 
-/* Define if you have the setmode function. */
-#define HAVE_SETMODE 1
-
 /* Define if you have the socket function. */
 #define HAVE_SOCKET 1
 
-/* Define if you have the strcasecmp function. */
-#ifdef __MINGW32__
-#define HAVE_STRCASECMP 1
-#endif
-
-/* Define if you have the strdup function. */
-#define HAVE_STRDUP 1
-
-/* Define if you have the stricmp function. */
-#define HAVE_STRICMP 1
-
-/* Define if you have the strtoll function. */
-#if defined(__MINGW32__) || defined(__POCC__) || \
-    (defined(_MSC_VER) && (_MSC_VER >= 1800))
-#define HAVE_STRTOLL 1
-#endif
-
 /* Define if you have the utime function. */
-#ifndef __BORLANDC__
 #define HAVE_UTIME 1
-#endif
 
 /* Define if you have the recv function. */
 #define HAVE_RECV 1
@@ -248,9 +142,6 @@
 /* Define to the type of arg 1 for send. */
 #define SEND_TYPE_ARG1 SOCKET
 
-/* Define to the type qualifier of arg 2 for send. */
-#define SEND_QUAL_ARG2 const
-
 /* Define to the type of arg 2 for send. */
 #define SEND_TYPE_ARG2 char *
 
@@ -263,28 +154,17 @@
 /* Define to the function return type for send. */
 #define SEND_TYPE_RETV int
 
-/* Define to 1 if you have the snprintf function. */
-#if defined(_MSC_VER) && (_MSC_VER >= 1900)
-#define HAVE_SNPRINTF 1
-#endif
-
-#if defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x600  /* Vista */
-/* Define to 1 if you have a IPv6 capable working inet_ntop function. */
-#define HAVE_INET_NTOP 1
-/* Define to 1 if you have a IPv6 capable working inet_pton function. */
-#define HAVE_INET_PTON 1
-#endif
+/* Must always use local implementations on Windows. */
+/* Define to 1 if you have an IPv6 capable working inet_ntop function. */
+/* #undef HAVE_INET_NTOP */
+/* Define to 1 if you have an IPv6 capable working inet_pton function. */
+/* #undef HAVE_INET_PTON */
 
 /* Define to 1 if you have the `basename' function. */
-#if defined(__MINGW64_VERSION_MAJOR)
+#ifdef __MINGW32__
 #define HAVE_BASENAME 1
 #endif
 
-/* Define to 1 if you have the strtok_r function. */
-#if defined(__MINGW64_VERSION_MAJOR)
-#define HAVE_STRTOK_R 1
-#endif
-
 /* Define to 1 if you have the signal function. */
 #define HAVE_SIGNAL 1
 
@@ -292,12 +172,9 @@
 /*                       TYPEDEF REPLACEMENTS                       */
 /* ---------------------------------------------------------------- */
 
-/* Define if in_addr_t is not an available 'typedefed' type. */
-#define in_addr_t unsigned long
-
 /* Define if ssize_t is not an available 'typedefed' type. */
 #ifndef _SSIZE_T_DEFINED
-#  if defined(__POCC__) || defined(__MINGW32__)
+#  ifdef __MINGW32__
 #  elif defined(_WIN64)
 #    define _SSIZE_T_DEFINED
 #    define ssize_t __int64
@@ -314,14 +191,11 @@
 /* Define to the size of `int', as computed by sizeof. */
 #define SIZEOF_INT 4
 
-/* Define to the size of `long long', as computed by sizeof. */
-/* #define SIZEOF_LONG_LONG 8 */
-
 /* Define to the size of `long', as computed by sizeof. */
 #define SIZEOF_LONG 4
 
 /* Define to the size of `size_t', as computed by sizeof. */
-#if defined(_WIN64)
+#ifdef _WIN64
 #  define SIZEOF_SIZE_T 8
 #else
 #  define SIZEOF_SIZE_T 4
@@ -330,92 +204,12 @@
 /* Define to the size of `curl_off_t', as computed by sizeof. */
 #define SIZEOF_CURL_OFF_T 8
 
-/* ---------------------------------------------------------------- */
-/*               BSD-style lwIP TCP/IP stack SPECIFIC               */
-/* ---------------------------------------------------------------- */
-
-/* Define to use BSD-style lwIP TCP/IP stack. */
-/* #define USE_LWIPSOCK 1 */
-
-#ifdef USE_LWIPSOCK
-#  undef USE_WINSOCK
-#  undef HAVE_WINSOCK2_H
-#  undef HAVE_WS2TCPIP_H
-#  undef HAVE_GETHOSTNAME
-#  undef LWIP_POSIX_SOCKETS_IO_NAMES
-#  undef RECV_TYPE_ARG1
-#  undef RECV_TYPE_ARG3
-#  undef SEND_TYPE_ARG1
-#  undef SEND_TYPE_ARG3
-#  define HAVE_FREEADDRINFO
-#  define HAVE_GETADDRINFO
-#  define HAVE_GETHOSTBYNAME_R
-#  define HAVE_GETHOSTBYNAME_R_6
-#  define LWIP_POSIX_SOCKETS_IO_NAMES 0
-#  define RECV_TYPE_ARG1 int
-#  define RECV_TYPE_ARG3 size_t
-#  define SEND_TYPE_ARG1 int
-#  define SEND_TYPE_ARG3 size_t
-#endif
-
-/* ---------------------------------------------------------------- */
-/*                        Watt-32 tcp/ip SPECIFIC                   */
-/* ---------------------------------------------------------------- */
-
-#ifdef USE_WATT32
-  #include <tcp.h>
-  #undef byte
-  #undef word
-  #undef USE_WINSOCK
-  #undef HAVE_WINSOCK2_H
-  #undef HAVE_WS2TCPIP_H
-  #define HAVE_GETADDRINFO
-  #define HAVE_SYS_IOCTL_H
-  #define HAVE_SYS_SOCKET_H
-  #define HAVE_NETINET_IN_H
-  #define HAVE_NETDB_H
-  #define HAVE_ARPA_INET_H
-  #define HAVE_FREEADDRINFO
-  #define SOCKET int
-#endif
-
-
 /* ---------------------------------------------------------------- */
 /*                        COMPILER SPECIFIC                         */
 /* ---------------------------------------------------------------- */
 
-/* Define to nothing if compiler does not support 'const' qualifier. */
-/* #define const */
-
-/* Define to nothing if compiler does not support 'volatile' qualifier. */
-/* #define volatile */
-
-/* Windows should not have HAVE_GMTIME_R defined */
-/* #undef HAVE_GMTIME_R */
-
-/* Define if the compiler supports C99 variadic macro style. */
-#if defined(_MSC_VER) && (_MSC_VER >= 1400)
-#define HAVE_VARIADIC_MACROS_C99 1
-#endif
-
-/* Define if the compiler supports the 'long long' data type. */
-#if defined(__MINGW32__) || \
-    (defined(_MSC_VER)     && (_MSC_VER     >= 1310)) || \
-    (defined(__BORLANDC__) && (__BORLANDC__ >= 0x561))
-#define HAVE_LONGLONG 1
-#endif
-
-/* Define to avoid VS2005 complaining about portable C functions. */
-#if defined(_MSC_VER) && (_MSC_VER >= 1400)
-#define _CRT_SECURE_NO_DEPRECATE 1
-#define _CRT_NONSTDC_NO_DEPRECATE 1
-#endif
-
-/* mingw-w64, mingw using >= MSVCR80, and visual studio >= 2005 (MSVCR80)
-   all default to 64-bit time_t unless _USE_32BIT_TIME_T is defined */
-#if defined(__MINGW64_VERSION_MAJOR) || \
-    (defined(__MINGW32__) && (__MSVCRT_VERSION__ >= 0x0800)) || \
-    (defined(_MSC_VER) && (_MSC_VER >= 1400))
+/* Default to 64-bit time_t unless _USE_32BIT_TIME_T is defined */
+#if defined(_MSC_VER) || defined(__MINGW32__)
 #  ifndef _USE_32BIT_TIME_T
 #    define SIZEOF_TIME_T 8
 #  else
@@ -423,115 +217,17 @@
 #  endif
 #endif
 
-/* Define some minimum and default build targets for Visual Studio */
-#if defined(_MSC_VER)
-   /* Officially, Microsoft's Windows SDK versions 6.X does not support Windows
-      2000 as a supported build target. VS2008 default installations provides
-      an embedded Windows SDK v6.0A along with the claim that Windows 2000 is a
-      valid build target for VS2008. Popular belief is that binaries built with
-      VS2008 using Windows SDK versions v6.X and Windows 2000 as a build target
-      are functional. */
-#  define VS2008_MIN_TARGET 0x0500
-
-   /* The minimum build target for VS2012 is Vista unless Update 1 is installed
-      and the v110_xp toolset is chosen. */
-#  if defined(_USING_V110_SDK71_)
-#    define VS2012_MIN_TARGET 0x0501
-#  else
-#    define VS2012_MIN_TARGET 0x0600
-#  endif
-
-   /* VS2008 default build target is Windows Vista. We override default target
-      to be Windows XP. */
-#  define VS2008_DEF_TARGET 0x0501
-
-   /* VS2012 default build target is Windows Vista unless Update 1 is installed
-      and the v110_xp toolset is chosen. */
-#  if defined(_USING_V110_SDK71_)
-#    define VS2012_DEF_TARGET 0x0501
-#  else
-#    define VS2012_DEF_TARGET 0x0600
-#  endif
-#endif
-
-/* VS2008 default target settings and minimum build target check. */
-#if defined(_MSC_VER) && (_MSC_VER >= 1500) && (_MSC_VER <= 1600)
-#  ifndef _WIN32_WINNT
-#    define _WIN32_WINNT VS2008_DEF_TARGET
-#  endif
-#  ifndef WINVER
-#    define WINVER VS2008_DEF_TARGET
-#  endif
-#  if (_WIN32_WINNT < VS2008_MIN_TARGET) || (WINVER < VS2008_MIN_TARGET)
-#    error VS2008 does not support Windows build targets prior to Windows 2000
-#  endif
-#endif
-
-/* VS2012 default target settings and minimum build target check. */
-#if defined(_MSC_VER) && (_MSC_VER >= 1700)
-#  ifndef _WIN32_WINNT
-#    define _WIN32_WINNT VS2012_DEF_TARGET
-#  endif
-#  ifndef WINVER
-#    define WINVER VS2012_DEF_TARGET
-#  endif
-#  if (_WIN32_WINNT < VS2012_MIN_TARGET) || (WINVER < VS2012_MIN_TARGET)
-#    if defined(_USING_V110_SDK71_)
-#      error VS2012 does not support Windows build targets prior to Windows XP
-#    else
-#      error VS2012 does not support Windows build targets prior to Windows \
-Vista
-#    endif
-#  endif
-#endif
-
-/* When no build target is specified Pelles C 5.00 and later default build
-   target is Windows Vista. We override default target to be Windows 2000. */
-#if defined(__POCC__) && (__POCC__ >= 500)
-#  ifndef _WIN32_WINNT
-#    define _WIN32_WINNT 0x0500
-#  endif
-#  ifndef WINVER
-#    define WINVER 0x0500
-#  endif
-#endif
-
-/* Availability of freeaddrinfo, getaddrinfo, and if_nametoindex
-   functions is quite convoluted, compiler dependent and even build target
-   dependent. */
-#if defined(HAVE_WS2TCPIP_H)
-#  if defined(__POCC__)
-#    define HAVE_FREEADDRINFO           1
-#    define HAVE_GETADDRINFO            1
-#    define HAVE_GETADDRINFO_THREADSAFE 1
-#  elif defined(_WIN32_WINNT) && (_WIN32_WINNT >= 0x0501)
-#    define HAVE_FREEADDRINFO           1
-#    define HAVE_GETADDRINFO            1
-#    define HAVE_GETADDRINFO_THREADSAFE 1
-#  elif defined(_MSC_VER) && (_MSC_VER >= 1200)
-#    define HAVE_FREEADDRINFO           1
-#    define HAVE_GETADDRINFO            1
-#    define HAVE_GETADDRINFO_THREADSAFE 1
-#  endif
-#endif
-
-#if defined(__POCC__)
-#  ifndef _MSC_VER
-#    error Microsoft extensions /Ze compiler option is required
-#  endif
-#  ifndef __POCC__OLDNAMES
-#    error Compatibility names /Go compiler option is required
-#  endif
-#endif
+/* Windows XP is required for freeaddrinfo, getaddrinfo */
+#define HAVE_FREEADDRINFO           1
+#define HAVE_GETADDRINFO            1
+#define HAVE_GETADDRINFO_THREADSAFE 1
 
 /* ---------------------------------------------------------------- */
 /*                          STRUCT RELATED                          */
 /* ---------------------------------------------------------------- */
 
 /* Define if you have struct sockaddr_storage. */
-#if !defined(__SALFORDC__) && !defined(__BORLANDC__)
 #define HAVE_STRUCT_SOCKADDR_STORAGE 1
-#endif
 
 /* Define if you have struct timeval. */
 #define HAVE_STRUCT_TIMEVAL 1
@@ -543,36 +239,14 @@ Vista
 /*                        LARGE FILE SUPPORT                        */
 /* ---------------------------------------------------------------- */
 
-#if defined(_MSC_VER) && !defined(_WIN32_WCE)
-#  if (_MSC_VER >= 900) && (_INTEGRAL_MAX_BITS >= 64)
-#    define USE_WIN32_LARGE_FILES
-#  else
-#    define USE_WIN32_SMALL_FILES
-#  endif
-#endif
-
-#if defined(__MINGW32__) && !defined(USE_WIN32_LARGE_FILES)
-#  define USE_WIN32_LARGE_FILES
-#endif
-
-#if defined(__POCC__)
-#  undef USE_WIN32_LARGE_FILES
-#endif
-
-#if !defined(USE_WIN32_LARGE_FILES) && !defined(USE_WIN32_SMALL_FILES)
-#  define USE_WIN32_SMALL_FILES
-#endif
-
 /* Number of bits in a file offset, on hosts where this is settable. */
-#if defined(USE_WIN32_LARGE_FILES) && defined(__MINGW64_VERSION_MAJOR)
-#  ifndef _FILE_OFFSET_BITS
+#ifdef __MINGW32__
+#  undef _FILE_OFFSET_BITS
 #  define _FILE_OFFSET_BITS 64
-#  endif
 #endif
 
 /* Define to the size of `off_t', as computed by sizeof. */
-#if defined(__MINGW64_VERSION_MAJOR) && \
-  defined(_FILE_OFFSET_BITS) && (_FILE_OFFSET_BITS == 64)
+#ifdef __MINGW32__
 #  define SIZEOF_OFF_T 8
 #else
 #  define SIZEOF_OFF_T 4
@@ -583,19 +257,16 @@ Vista
 /* ---------------------------------------------------------------- */
 
 /*
- * Undefine both USE_ARES and USE_THREADS_WIN32 for synchronous DNS.
+ * Undefine both USE_ARES and USE_RESOLV_THREADED for synchronous DNS.
  */
 
-/* Define to enable c-ares asynchronous DNS lookups. */
-/* #define USE_ARES 1 */
-
 /* Default define to enable threaded asynchronous DNS lookups. */
 #if !defined(USE_SYNC_DNS) && !defined(USE_ARES) && \
-    !defined(USE_THREADS_WIN32)
-#  define USE_THREADS_WIN32 1
+  !defined(USE_RESOLV_THREADED)
+#  define USE_RESOLV_THREADED 1
 #endif
 
-#if defined(USE_ARES) && defined(USE_THREADS_WIN32)
+#if defined(USE_ARES) && defined(USE_RESOLV_THREADED)
 #  error "Only one DNS lookup specialty may be defined at most"
 #endif
 
@@ -603,27 +274,13 @@ Vista
 /*                           LDAP SUPPORT                           */
 /* ---------------------------------------------------------------- */
 
-#if defined(CURL_HAS_NOVELL_LDAPSDK)
-#undef USE_WIN32_LDAP
-#define HAVE_LDAP_SSL_H 1
-#define HAVE_LDAP_URL_PARSE 1
-#elif defined(CURL_HAS_OPENLDAP_LDAPSDK)
-#undef USE_WIN32_LDAP
-#define HAVE_LDAP_URL_PARSE 1
-#else
-#undef HAVE_LDAP_URL_PARSE
-#define HAVE_LDAP_SSL 1
+#ifndef CURL_WINDOWS_UWP
+#define HAVE_LDAP_SSL  1
 #define USE_WIN32_LDAP 1
-#endif
-
-#if defined(__POCC__) && defined(USE_WIN32_LDAP)
-#  define CURL_DISABLE_LDAP 1
-#endif
 
 /* Define to use the Windows crypto library. */
-#if !defined(CURL_WINDOWS_APP)
 #define USE_WIN32_CRYPTO
-#endif
+#endif /* CURL_WINDOWS_UWP */
 
 /* Define to use Unix sockets. */
 #define USE_UNIX_SOCKETS
@@ -633,30 +290,20 @@ Vista
 /* ---------------------------------------------------------------- */
 
 /* Define cpu-machine-OS */
-#ifndef OS
-#if defined(_M_IX86) || defined(__i386__) /* x86 (MSVC or gcc) */
-#define OS "i386-pc-win32"
-#elif defined(_M_X64) || defined(__x86_64__) /* x86_64 (MSVC >=2005 or gcc) */
-#define OS "x86_64-pc-win32"
-#elif defined(_M_IA64) || defined(__ia64__) /* Itanium */
-#define OS "ia64-pc-win32"
-#elif defined(_M_ARM_NT) || defined(__arm__) /* ARMv7-Thumb2 (Windows RT) */
-#define OS "thumbv7a-pc-win32"
-#elif defined(_M_ARM64) || defined(__aarch64__) /* ARM64 (Windows 10) */
-#define OS "aarch64-pc-win32"
-#else
-#define OS "unknown-pc-win32"
-#endif
-#endif
-
-/* Name of package */
-#define PACKAGE "curl"
-
-/* If you want to build curl with the built-in manual */
-#define USE_MANUAL 1
-
-#if defined(__POCC__) || defined(USE_IPV6)
-#  define ENABLE_IPV6 1
-#endif
+#ifndef CURL_OS
+#  if defined(_M_IX86) || defined(__i386__) /* x86 (MSVC or gcc) */
+#  define CURL_OS "i386-pc-win32"
+#  elif defined(_M_X64) || defined(__x86_64__) /* x86_64 (VS2005+ or gcc) */
+#  define CURL_OS "x86_64-pc-win32"
+#  elif defined(_M_IA64) || defined(__ia64__) /* Itanium */
+#  define CURL_OS "ia64-pc-win32"
+#  elif defined(_M_ARM_NT) || defined(__arm__) /* ARMv7-Thumb2 */
+#  define CURL_OS "thumbv7a-pc-win32"
+#  elif defined(_M_ARM64) || defined(__aarch64__) /* ARM64 (Windows 10) */
+#  define CURL_OS "aarch64-pc-win32"
+#  else
+#  define CURL_OS "unknown-pc-win32"
+#  endif
+#endif /* !CURL_OS */
 
 #endif /* HEADER_CURL_CONFIG_WIN32_H */
diff --git a/third-party/curl/lib/config-win32ce.h b/third-party/curl/lib/config-win32ce.h
deleted file mode 100644
index 2f9a530524..0000000000
--- a/third-party/curl/lib/config-win32ce.h
+++ /dev/null
@@ -1,325 +0,0 @@
-#ifndef HEADER_CURL_CONFIG_WIN32CE_H
-#define HEADER_CURL_CONFIG_WIN32CE_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-/* ================================================================ */
-/*  lib/config-win32ce.h - Hand crafted config file for windows ce  */
-/* ================================================================ */
-
-/* ---------------------------------------------------------------- */
-/*                          HEADER FILES                            */
-/* ---------------------------------------------------------------- */
-
-/* Define if you have the <arpa/inet.h> header file.  */
-/* #define HAVE_ARPA_INET_H 1 */
-
-/* Define if you have the <fcntl.h> header file.  */
-#define HAVE_FCNTL_H 1
-
-/* Define if you have the <io.h> header file.  */
-#define HAVE_IO_H 1
-
-/* Define if you need the malloc.h header file even with stdlib.h  */
-#define NEED_MALLOC_H 1
-
-/* Define if you have the <netdb.h> header file.  */
-/* #define HAVE_NETDB_H 1 */
-
-/* Define if you have the <netinet/in.h> header file.  */
-/* #define HAVE_NETINET_IN_H 1 */
-
-/* Define if you have the <signal.h> header file. */
-#define HAVE_SIGNAL_H 1
-
-/* Define if you have the <stdlib.h> header file.  */
-#define HAVE_STDLIB_H 1
-
-/* Define if you have the <sys/param.h> header file.  */
-/* #define HAVE_SYS_PARAM_H 1 */
-
-/* Define if you have the <sys/select.h> header file.  */
-/* #define HAVE_SYS_SELECT_H 1 */
-
-/* Define if you have the <sys/socket.h> header file.  */
-/* #define HAVE_SYS_SOCKET_H 1 */
-
-/* Define if you have the <sys/sockio.h> header file.  */
-/* #define HAVE_SYS_SOCKIO_H 1 */
-
-/* Define if you have the <sys/stat.h> header file.  */
-#define HAVE_SYS_STAT_H 1
-
-/* Define if you have the <sys/time.h> header file */
-/* #define HAVE_SYS_TIME_H 1 */
-
-/* Define if you have the <sys/types.h> header file.  */
-/* #define HAVE_SYS_TYPES_H 1 */
-
-/* Define if you have the <sys/utime.h> header file */
-#define HAVE_SYS_UTIME_H 1
-
-/* Define if you have the <termio.h> header file.  */
-/* #define HAVE_TERMIO_H 1 */
-
-/* Define if you have the <termios.h> header file.  */
-/* #define HAVE_TERMIOS_H 1 */
-
-/* Define if you have the <time.h> header file.  */
-#define HAVE_TIME_H 1
-
-/* Define if you have the <unistd.h> header file.  */
-#if defined(__MINGW32__) || defined(__LCC__)
-#define HAVE_UNISTD_H 1
-#endif
-
-/* Define if you have the <windows.h> header file.  */
-#define HAVE_WINDOWS_H 1
-
-/* Define if you have the <winsock2.h> header file.  */
-#define HAVE_WINSOCK2_H 1
-
-/* Define if you have the <ws2tcpip.h> header file.  */
-#define HAVE_WS2TCPIP_H 1
-
-/* ---------------------------------------------------------------- */
-/*                        OTHER HEADER INFO                         */
-/* ---------------------------------------------------------------- */
-
-/* Define if you have the ANSI C header files.  */
-#define STDC_HEADERS 1
-
-/* Define if you can safely include both <sys/time.h> and <time.h>.  */
-/* #define TIME_WITH_SYS_TIME 1 */
-
-/* ---------------------------------------------------------------- */
-/*                             FUNCTIONS                            */
-/* ---------------------------------------------------------------- */
-
-/* Define if you have the closesocket function.  */
-#define HAVE_CLOSESOCKET 1
-
-/* Define if you have the gethostname function.  */
-#define HAVE_GETHOSTNAME 1
-
-/* Define if you have the gettimeofday function.  */
-/*  #define HAVE_GETTIMEOFDAY 1 */
-
-/* Define if you have the ioctlsocket function. */
-#define HAVE_IOCTLSOCKET 1
-
-/* Define if you have a working ioctlsocket FIONBIO function. */
-#define HAVE_IOCTLSOCKET_FIONBIO 1
-
-/* Define if you have the select function.  */
-#define HAVE_SELECT 1
-
-/* Define if you have the socket function.  */
-#define HAVE_SOCKET 1
-
-/* Define if you have the strcasecmp function.  */
-/* #define HAVE_STRCASECMP 1 */
-
-/* Define if you have the strdup function.  */
-/* #define HAVE_STRDUP 1 */
-
-/* Define if you have the stricmp function. */
-/* #define HAVE_STRICMP 1 */
-
-/* Define if you have the strtoll function.  */
-#if defined(__MINGW32__)
-#define HAVE_STRTOLL 1
-#endif
-
-/* Define if you have the utime function */
-#define HAVE_UTIME 1
-
-/* Define if you have the recv function. */
-#define HAVE_RECV 1
-
-/* Define to the type of arg 1 for recv. */
-#define RECV_TYPE_ARG1 SOCKET
-
-/* Define to the type of arg 2 for recv. */
-#define RECV_TYPE_ARG2 char *
-
-/* Define to the type of arg 3 for recv. */
-#define RECV_TYPE_ARG3 int
-
-/* Define to the type of arg 4 for recv. */
-#define RECV_TYPE_ARG4 int
-
-/* Define to the function return type for recv. */
-#define RECV_TYPE_RETV int
-
-/* Define if you have the send function. */
-#define HAVE_SEND 1
-
-/* Define to the type of arg 1 for send. */
-#define SEND_TYPE_ARG1 SOCKET
-
-/* Define to the type qualifier of arg 2 for send. */
-#define SEND_QUAL_ARG2 const
-
-/* Define to the type of arg 2 for send. */
-#define SEND_TYPE_ARG2 char *
-
-/* Define to the type of arg 3 for send. */
-#define SEND_TYPE_ARG3 int
-
-/* Define to the type of arg 4 for send. */
-#define SEND_TYPE_ARG4 int
-
-/* Define to the function return type for send. */
-#define SEND_TYPE_RETV int
-
-/* ---------------------------------------------------------------- */
-/*                       TYPEDEF REPLACEMENTS                       */
-/* ---------------------------------------------------------------- */
-
-/* Define this if in_addr_t is not an available 'typedefed' type */
-#define in_addr_t unsigned long
-
-/* Define ssize_t if it is not an available 'typedefed' type */
-#if defined(__POCC__)
-#elif defined(_WIN64)
-#define ssize_t __int64
-#else
-#define ssize_t int
-#endif
-
-/* ---------------------------------------------------------------- */
-/*                            TYPE SIZES                            */
-/* ---------------------------------------------------------------- */
-
-/* The size of `int', as computed by sizeof. */
-#define SIZEOF_INT 4
-
-/* The size of `long long', as computed by sizeof. */
-/* #define SIZEOF_LONG_LONG 8 */
-
-/* Define to the size of `long', as computed by sizeof. */
-#define SIZEOF_LONG 4
-
-/* The size of `size_t', as computed by sizeof. */
-#if defined(_WIN64)
-#  define SIZEOF_SIZE_T 8
-#else
-#  define SIZEOF_SIZE_T 4
-#endif
-
-/* ---------------------------------------------------------------- */
-/*                          STRUCT RELATED                          */
-/* ---------------------------------------------------------------- */
-
-/* Define this if you have struct sockaddr_storage */
-/* #define HAVE_STRUCT_SOCKADDR_STORAGE 1 */
-
-/* Define this if you have struct timeval */
-#define HAVE_STRUCT_TIMEVAL 1
-
-/* Define this if struct sockaddr_in6 has the sin6_scope_id member */
-#define HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID 1
-
-/* ---------------------------------------------------------------- */
-/*                        COMPILER SPECIFIC                         */
-/* ---------------------------------------------------------------- */
-
-/* Undef keyword 'const' if it does not work.  */
-/* #undef const */
-
-/* Define to avoid VS2005 complaining about portable C functions */
-#if defined(_MSC_VER) && (_MSC_VER >= 1400)
-#define _CRT_SECURE_NO_DEPRECATE 1
-#define _CRT_NONSTDC_NO_DEPRECATE 1
-#endif
-
-/* VS2005 and later default size for time_t is 64-bit, unless */
-/* _USE_32BIT_TIME_T has been defined to get a 32-bit time_t. */
-#if defined(_MSC_VER) && (_MSC_VER >= 1400)
-#  ifndef _USE_32BIT_TIME_T
-#    define SIZEOF_TIME_T 8
-#  else
-#    define SIZEOF_TIME_T 4
-#  endif
-#endif
-
-/* ---------------------------------------------------------------- */
-/*                        LARGE FILE SUPPORT                        */
-/* ---------------------------------------------------------------- */
-
-#if defined(_MSC_VER) && !defined(_WIN32_WCE)
-#  if (_MSC_VER >= 900) && (_INTEGRAL_MAX_BITS >= 64)
-#    define USE_WIN32_LARGE_FILES
-#  else
-#    define USE_WIN32_SMALL_FILES
-#  endif
-#endif
-
-#if !defined(USE_WIN32_LARGE_FILES) && !defined(USE_WIN32_SMALL_FILES)
-#  define USE_WIN32_SMALL_FILES
-#endif
-
-/* ---------------------------------------------------------------- */
-/*                           LDAP SUPPORT                           */
-/* ---------------------------------------------------------------- */
-
-#define USE_WIN32_LDAP 1
-#undef HAVE_LDAP_URL_PARSE
-
-/* ---------------------------------------------------------------- */
-/*                       ADDITIONAL DEFINITIONS                     */
-/* ---------------------------------------------------------------- */
-
-/* Define cpu-machine-OS */
-#ifndef OS
-#define OS "i386-pc-win32ce"
-#endif
-
-/* Name of package */
-#define PACKAGE "curl"
-
-/* ---------------------------------------------------------------- */
-/*                       WinCE                                      */
-/* ---------------------------------------------------------------- */
-
-#ifndef UNICODE
-#  define UNICODE
-#endif
-
-#ifndef _UNICODE
-#  define _UNICODE
-#endif
-
-#define CURL_DISABLE_FILE 1
-#define CURL_DISABLE_TELNET 1
-#define CURL_DISABLE_LDAP 1
-
-#define ENOSPC 1
-#define ENOMEM 2
-#define EAGAIN 3
-
-extern int stat(const char *path, struct stat *buffer);
-
-#endif /* HEADER_CURL_CONFIG_WIN32CE_H */
diff --git a/third-party/curl/lib/conncache.c b/third-party/curl/lib/conncache.c
index a21409c13f..5ba2368622 100644
--- a/third-party/curl/lib/conncache.c
+++ b/third-party/curl/lib/conncache.c
@@ -22,559 +22,887 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include <curl/curl.h>
-
 #include "urldata.h"
 #include "url.h"
+#include "cfilters.h"
 #include "progress.h"
 #include "multiif.h"
-#include "sendf.h"
+#include "curl_trc.h"
+#include "cshutdn.h"
 #include "conncache.h"
-#include "share.h"
+#include "curl_share.h"
 #include "sigpipe.h"
-#include "connect.h"
-#include "strcase.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
 
-#define HASHKEY_SIZE 128
+#define CPOOL_IS_LOCKED(c)    ((c) && (c)->locked)
 
-static CURLcode bundle_create(struct connectbundle **bundlep)
+#define CPOOL_LOCK(c, d)                                                \
+  do {                                                                  \
+    if(c) {                                                             \
+      if(CURL_SHARE_KEEP_CONNECT((c)->share))                           \
+        Curl_share_lock((d), CURL_LOCK_DATA_CONNECT,                    \
+                        CURL_LOCK_ACCESS_SINGLE);                       \
+      DEBUGASSERT(!(c)->locked);                                        \
+      (c)->locked = TRUE;                                               \
+    }                                                                   \
+  } while(0)
+
+#define CPOOL_UNLOCK(c, d)                                              \
+  do {                                                                  \
+    if(c) {                                                             \
+      DEBUGASSERT((c)->locked);                                         \
+      (c)->locked = FALSE;                                              \
+      if(CURL_SHARE_KEEP_CONNECT((c)->share))                           \
+        Curl_share_unlock((d), CURL_LOCK_DATA_CONNECT);                 \
+    }                                                                   \
+  } while(0)
+
+/* A list of connections to the same destination. */
+struct cpool_bundle {
+  struct Curl_llist conns; /* connections in the bundle */
+  size_t dest_len; /* total length of destination, including NUL */
+  char dest[1]; /* destination of bundle, allocated to keep dest_len bytes */
+};
+
+static struct cpool_bundle *cpool_bundle_create(const char *dest)
 {
-  DEBUGASSERT(*bundlep == NULL);
-  *bundlep = malloc(sizeof(struct connectbundle));
-  if(!*bundlep)
-    return CURLE_OUT_OF_MEMORY;
-
-  (*bundlep)->num_connections = 0;
-  (*bundlep)->multiuse = BUNDLE_UNKNOWN;
-
-  Curl_llist_init(&(*bundlep)->conn_list, NULL);
-  return CURLE_OK;
-}
-
-static void bundle_destroy(struct connectbundle *bundle)
-{
-  free(bundle);
-}
-
-/* Add a connection to a bundle */
-static void bundle_add_conn(struct connectbundle *bundle,
-                            struct connectdata *conn)
-{
-  Curl_llist_insert_next(&bundle->conn_list, bundle->conn_list.tail, conn,
-                         &conn->bundle_node);
-  conn->bundle = bundle;
-  bundle->num_connections++;
-}
-
-/* Remove a connection from a bundle */
-static int bundle_remove_conn(struct connectbundle *bundle,
-                              struct connectdata *conn)
-{
-  struct Curl_llist_element *curr;
-
-  curr = bundle->conn_list.head;
-  while(curr) {
-    if(curr->ptr == conn) {
-      Curl_llist_remove(&bundle->conn_list, curr, NULL);
-      bundle->num_connections--;
-      conn->bundle = NULL;
-      return 1; /* we removed a handle */
-    }
-    curr = curr->next;
-  }
-  DEBUGASSERT(0);
-  return 0;
-}
-
-static void free_bundle_hash_entry(void *freethis)
-{
-  struct connectbundle *b = (struct connectbundle *) freethis;
-
-  bundle_destroy(b);
-}
-
-int Curl_conncache_init(struct conncache *connc, int size)
-{
-  /* allocate a new easy handle to use when closing cached connections */
-  connc->closure_handle = curl_easy_init();
-  if(!connc->closure_handle)
-    return 1; /* bad */
-
-  Curl_hash_init(&connc->hash, size, Curl_hash_str,
-                 Curl_str_key_compare, free_bundle_hash_entry);
-  connc->closure_handle->state.conn_cache = connc;
-
-  return 0; /* good */
-}
-
-void Curl_conncache_destroy(struct conncache *connc)
-{
-  if(connc)
-    Curl_hash_destroy(&connc->hash);
-}
-
-/* creates a key to find a bundle for this connection */
-static void hashkey(struct connectdata *conn, char *buf, size_t len)
-{
-  const char *hostname;
-  long port = conn->remote_port;
-  DEBUGASSERT(len >= HASHKEY_SIZE);
-#ifndef CURL_DISABLE_PROXY
-  if(conn->bits.httpproxy && !conn->bits.tunnel_proxy) {
-    hostname = conn->http_proxy.host.name;
-    port = conn->port;
-  }
-  else
-#endif
-    if(conn->bits.conn_to_host)
-      hostname = conn->conn_to_host.name;
-  else
-    hostname = conn->host.name;
-
-  /* put the numbers first so that the hostname gets cut off if too long */
-#ifdef ENABLE_IPV6
-  msnprintf(buf, len, "%u/%ld/%s", conn->scope_id, port, hostname);
-#else
-  msnprintf(buf, len, "%ld/%s", port, hostname);
-#endif
-  Curl_strntolower(buf, buf, len);
-}
-
-/* Returns number of connections currently held in the connection cache.
-   Locks/unlocks the cache itself!
-*/
-size_t Curl_conncache_size(struct Curl_easy *data)
-{
-  size_t num;
-  CONNCACHE_LOCK(data);
-  num = data->state.conn_cache->num_conn;
-  CONNCACHE_UNLOCK(data);
-  return num;
-}
-
-/* Look up the bundle with all the connections to the same host this
-   connectdata struct is setup to use.
-
-   **NOTE**: When it returns, it holds the connection cache lock! */
-struct connectbundle *
-Curl_conncache_find_bundle(struct Curl_easy *data,
-                           struct connectdata *conn,
-                           struct conncache *connc)
-{
-  struct connectbundle *bundle = NULL;
-  CONNCACHE_LOCK(data);
-  if(connc) {
-    char key[HASHKEY_SIZE];
-    hashkey(conn, key, sizeof(key));
-    bundle = Curl_hash_pick(&connc->hash, key, strlen(key));
-  }
+  struct cpool_bundle *bundle;
+  size_t dest_len = strlen(dest) + 1;
 
+  bundle = curlx_calloc(1, sizeof(*bundle) + dest_len - 1);
+  if(!bundle)
+    return NULL;
+  Curl_llist_init(&bundle->conns, NULL);
+  bundle->dest_len = dest_len;
+  memcpy(bundle->dest, dest, bundle->dest_len);
   return bundle;
 }
 
-static void *conncache_add_bundle(struct conncache *connc,
-                                  char *key,
-                                  struct connectbundle *bundle)
+static void cpool_bundle_destroy(struct cpool_bundle *bundle)
 {
-  return Curl_hash_add(&connc->hash, key, strlen(key), bundle);
+  DEBUGASSERT(!Curl_llist_count(&bundle->conns));
+  curlx_free(bundle);
 }
 
-static void conncache_remove_bundle(struct conncache *connc,
-                                    struct connectbundle *bundle)
+/* Add a connection to a bundle */
+static void cpool_bundle_add(struct cpool_bundle *bundle,
+                             struct connectdata *conn)
+{
+  DEBUGASSERT(!Curl_node_llist(&conn->cpool_node));
+  Curl_llist_append(&bundle->conns, conn, &conn->cpool_node);
+  conn->bits.in_cpool = TRUE;
+}
+
+/* Remove a connection from a bundle */
+static void cpool_bundle_remove(struct cpool_bundle *bundle,
+                                struct connectdata *conn)
+{
+  (void)bundle;
+  DEBUGASSERT(Curl_node_llist(&conn->cpool_node) == &bundle->conns);
+  Curl_node_remove(&conn->cpool_node);
+  conn->bits.in_cpool = FALSE;
+}
+
+static void cpool_bundle_free_entry(void *freethis)
+{
+  cpool_bundle_destroy((struct cpool_bundle *)freethis);
+}
+
+void Curl_cpool_init(struct cpool *cpool,
+                     struct Curl_easy *idata,
+                     struct Curl_share *share,
+                     size_t size)
+{
+  Curl_hash_init(&cpool->dest2bundle, size, Curl_hash_str,
+                 curlx_str_key_compare, cpool_bundle_free_entry);
+
+  DEBUGASSERT(idata);
+
+  cpool->idata = idata;
+  cpool->share = share;
+  cpool->initialized = TRUE;
+}
+
+/* Return the "first" connection in the pool or NULL. */
+static struct connectdata *cpool_get_first(struct cpool *cpool)
 {
   struct Curl_hash_iterator iter;
   struct Curl_hash_element *he;
+  struct cpool_bundle *bundle;
+  struct Curl_llist_node *conn_node;
 
-  if(!connc)
+  Curl_hash_start_iterate(&cpool->dest2bundle, &iter);
+  for(he = Curl_hash_next_element(&iter); he;
+      he = Curl_hash_next_element(&iter)) {
+    bundle = he->ptr;
+    conn_node = Curl_llist_head(&bundle->conns);
+    if(conn_node)
+      return Curl_node_elem(conn_node);
+  }
+  return NULL;
+}
+
+static struct cpool_bundle *cpool_find_bundle(struct cpool *cpool,
+                                              struct connectdata *conn)
+{
+  return Curl_hash_pick(&cpool->dest2bundle,
+                        conn->destination, strlen(conn->destination) + 1);
+}
+
+static void cpool_remove_bundle(struct cpool *cpool,
+                                struct cpool_bundle *bundle)
+{
+  if(!cpool)
     return;
+  Curl_hash_delete(&cpool->dest2bundle, bundle->dest, bundle->dest_len);
+}
 
-  Curl_hash_start_iterate(&connc->hash, &iter);
-
-  he = Curl_hash_next_element(&iter);
-  while(he) {
-    if(he->ptr == bundle) {
-      /* The bundle is destroyed by the hash destructor function,
-         free_bundle_hash_entry() */
-      Curl_hash_delete(&connc->hash, he->key, he->key_len);
-      return;
+static void cpool_remove_conn(struct cpool *cpool,
+                              struct connectdata *conn)
+{
+  struct Curl_llist *list = Curl_node_llist(&conn->cpool_node);
+  DEBUGASSERT(cpool);
+  if(list) {
+    /* The connection is certainly in the pool, but where? */
+    struct cpool_bundle *bundle = cpool_find_bundle(cpool, conn);
+    if(bundle && (list == &bundle->conns)) {
+      cpool_bundle_remove(bundle, conn);
+      if(!Curl_llist_count(&bundle->conns))
+        cpool_remove_bundle(cpool, bundle);
+      conn->bits.in_cpool = FALSE;
+      cpool->num_conn--;
+    }
+    else {
+      /* Should have been in the bundle list */
+      DEBUGASSERT(NULL);
     }
-
-    he = Curl_hash_next_element(&iter);
   }
 }
 
-CURLcode Curl_conncache_add_conn(struct Curl_easy *data)
+static void cpool_discard_conn(struct cpool *cpool,
+                               struct Curl_easy *data,
+                               struct connectdata *conn,
+                               bool aborted)
 {
-  CURLcode result = CURLE_OK;
-  struct connectbundle *bundle = NULL;
-  struct connectdata *conn = data->conn;
-  struct conncache *connc = data->state.conn_cache;
-  DEBUGASSERT(conn);
+  bool done = FALSE;
 
-  /* *find_bundle() locks the connection cache */
-  bundle = Curl_conncache_find_bundle(data, conn, data->state.conn_cache);
-  if(!bundle) {
-    char key[HASHKEY_SIZE];
+  DEBUGASSERT(data);
+  DEBUGASSERT(!data->conn);
+  DEBUGASSERT(cpool);
+  DEBUGASSERT(!conn->bits.in_cpool);
 
-    result = bundle_create(&bundle);
-    if(result) {
-      goto unlock;
+  /*
+   * If this connection is not marked to force-close, leave it open if there
+   * are other users of it
+   */
+  if(CONN_INUSE(conn) && !aborted) {
+    CURL_TRC_M(data, "[CPOOL] not discarding #%" FMT_OFF_T
+               " still in use by %u transfers", conn->connection_id,
+               conn->attached_xfers);
+    return;
+  }
+
+  /* treat the connection as aborted in CONNECT_ONLY situations, we do
+   * not know what the APP did with it. */
+  if(conn->bits.connect_only)
+    aborted = TRUE;
+  conn->bits.aborted = aborted;
+
+  /* We do not shutdown dead connections. The term 'dead' can be misleading
+   * here, as we also mark errored connections/transfers as 'dead'.
+   * If we do a shutdown for an aborted transfer, the server might think
+   * it was successful otherwise (for example an ftps: upload). This is
+   * not what we want. */
+  if(aborted)
+    done = TRUE;
+  if(!done) {
+    /* Attempt to shutdown the connection right away. */
+    Curl_cshutdn_run_once(cpool->idata, conn, &done);
+  }
+
+  if(done || !data->multi)
+    Curl_cshutdn_terminate(cpool->idata, conn, FALSE);
+  else
+    Curl_cshutdn_add(&data->multi->cshutdn, conn, cpool->num_conn);
+}
+
+void Curl_cpool_destroy(struct cpool *cpool)
+{
+  if(cpool && cpool->initialized && cpool->idata) {
+    struct connectdata *conn;
+    struct Curl_sigpipe_ctx pipe_ctx;
+
+    CURL_TRC_M(cpool->idata, "%s[CPOOL] destroy, %zu connections",
+               cpool->share ? "[SHARE] " : "", cpool->num_conn);
+    /* Move all connections to the shutdown list */
+    sigpipe_init(&pipe_ctx);
+    CPOOL_LOCK(cpool, cpool->idata);
+    conn = cpool_get_first(cpool);
+    if(conn)
+      sigpipe_apply(cpool->idata, &pipe_ctx);
+    while(conn) {
+      cpool_remove_conn(cpool, conn);
+      cpool_discard_conn(cpool, cpool->idata, conn, FALSE);
+      conn = cpool_get_first(cpool);
     }
+    CPOOL_UNLOCK(cpool, cpool->idata);
+    sigpipe_restore(&pipe_ctx);
+    Curl_hash_destroy(&cpool->dest2bundle);
+  }
+}
 
-    hashkey(conn, key, sizeof(key));
+static struct cpool *cpool_get_instance(struct Curl_easy *data)
+{
+  if(data) {
+    if(CURL_SHARE_KEEP_CONNECT(data->share))
+      return &data->share->cpool;
+    else if(data->multi_easy)
+      return &data->multi_easy->cpool;
+    else if(data->multi)
+      return &data->multi->cpool;
+  }
+  return NULL;
+}
 
-    if(!conncache_add_bundle(data->state.conn_cache, key, bundle)) {
-      bundle_destroy(bundle);
-      result = CURLE_OUT_OF_MEMORY;
-      goto unlock;
+void Curl_cpool_xfer_init(struct Curl_easy *data)
+{
+  struct cpool *cpool = cpool_get_instance(data);
+
+  DEBUGASSERT(cpool);
+  if(cpool) {
+    CPOOL_LOCK(cpool, data);
+    /* the identifier inside the connection cache */
+    data->id = cpool->next_easy_id++;
+    if(cpool->next_easy_id <= 0)
+      cpool->next_easy_id = 0;
+    data->state.lastconnect_id = -1;
+
+    CPOOL_UNLOCK(cpool, data);
+  }
+  else {
+    /* We should not get here, but in a non-debug build, do something */
+    data->id = 0;
+    data->state.lastconnect_id = -1;
+  }
+}
+
+static struct cpool_bundle *cpool_add_bundle(struct cpool *cpool,
+                                             struct connectdata *conn)
+{
+  struct cpool_bundle *bundle;
+
+  bundle = cpool_bundle_create(conn->destination);
+  if(!bundle)
+    return NULL;
+
+  if(!Curl_hash_add(&cpool->dest2bundle,
+                    bundle->dest, bundle->dest_len, bundle)) {
+    cpool_bundle_destroy(bundle);
+    return NULL;
+  }
+  return bundle;
+}
+
+static struct connectdata *cpool_bundle_get_oldest_idle(
+  struct cpool_bundle *bundle,
+  const struct curltime *pnow)
+{
+  struct Curl_llist_node *curr;
+  timediff_t highscore = -1;
+  timediff_t score;
+  struct connectdata *oldest_idle = NULL;
+  struct connectdata *conn;
+
+  curr = Curl_llist_head(&bundle->conns);
+  while(curr) {
+    conn = Curl_node_elem(curr);
+
+    if(!CONN_INUSE(conn)) {
+      /* Set higher score for the age passed since the connection was used */
+      score = curlx_ptimediff_ms(pnow, &conn->lastused);
+
+      if(score > highscore) {
+        highscore = score;
+        oldest_idle = conn;
+      }
+    }
+    curr = Curl_node_next(curr);
+  }
+  return oldest_idle;
+}
+
+static struct connectdata *cpool_get_oldest_idle(struct cpool *cpool,
+                                                 const struct curltime *pnow)
+{
+  struct Curl_hash_iterator iter;
+  struct Curl_llist_node *curr;
+  struct Curl_hash_element *he;
+  struct connectdata *oldest_idle = NULL;
+  struct cpool_bundle *bundle;
+  timediff_t highscore = -1;
+  timediff_t score;
+
+  Curl_hash_start_iterate(&cpool->dest2bundle, &iter);
+
+  for(he = Curl_hash_next_element(&iter); he;
+      he = Curl_hash_next_element(&iter)) {
+    struct connectdata *conn;
+    bundle = he->ptr;
+
+    for(curr = Curl_llist_head(&bundle->conns); curr;
+        curr = Curl_node_next(curr)) {
+      conn = Curl_node_elem(curr);
+      if(CONN_INUSE(conn) || conn->bits.close || conn->bits.connect_only)
+        continue;
+      /* Set higher score for the age passed since the connection was used */
+      score = curlx_ptimediff_ms(pnow, &conn->lastused);
+      if(score > highscore) {
+        highscore = score;
+        oldest_idle = conn;
+      }
+    }
+  }
+  return oldest_idle;
+}
+
+int Curl_cpool_check_limits(struct Curl_easy *data,
+                            struct connectdata *conn)
+{
+  struct cpool *cpool = cpool_get_instance(data);
+  struct cpool_bundle *bundle;
+  size_t dest_limit = 0;
+  size_t total_limit = 0;
+  size_t shutdowns;
+  int res = CPOOL_LIMIT_OK;
+
+  if(!cpool)
+    return CPOOL_LIMIT_OK;
+
+  if(cpool->idata->multi) {
+    dest_limit = cpool->idata->multi->max_host_connections;
+    total_limit = cpool->idata->multi->max_total_connections;
+  }
+
+  if(!dest_limit && !total_limit)
+    return CPOOL_LIMIT_OK;
+
+  CPOOL_LOCK(cpool, cpool->idata);
+  if(dest_limit) {
+    size_t live;
+
+    bundle = cpool_find_bundle(cpool, conn);
+    live = bundle ? Curl_llist_count(&bundle->conns) : 0;
+    shutdowns = Curl_cshutdn_dest_count(data, conn->destination);
+    while((live + shutdowns) >= dest_limit) {
+      if(shutdowns) {
+        /* close one connection in shutdown right away, if we can */
+        if(!Curl_cshutdn_close_oldest(data, conn->destination))
+          break;
+      }
+      else if(!bundle)
+        break;
+      else {
+        struct connectdata *oldest_idle = NULL;
+        /* The bundle is full. Extract the oldest connection that may
+         * be removed now, if there is one. */
+        oldest_idle = cpool_bundle_get_oldest_idle(bundle,
+                                                   Curl_pgrs_now(data));
+        if(!oldest_idle)
+          break;
+        /* disconnect the old conn and continue */
+        CURL_TRC_M(data, "Discarding connection #%" FMT_OFF_T
+                   " from %zu to reach destination limit of %zu",
+                   oldest_idle->connection_id,
+                   Curl_llist_count(&bundle->conns), dest_limit);
+        Curl_conn_terminate(cpool->idata, oldest_idle, FALSE);
+
+        /* in case the bundle was destroyed in disconnect, look it up again */
+        bundle = cpool_find_bundle(cpool, conn);
+        live = bundle ? Curl_llist_count(&bundle->conns) : 0;
+      }
+      shutdowns = Curl_cshutdn_dest_count(cpool->idata, conn->destination);
+    }
+    if((live + shutdowns) >= dest_limit) {
+      res = CPOOL_LIMIT_DEST;
+      goto out;
     }
   }
 
-  bundle_add_conn(bundle, conn);
-  conn->connection_id = connc->next_connection_id++;
-  connc->num_conn++;
+  if(total_limit) {
+    shutdowns = Curl_cshutdn_count(cpool->idata);
+    while((cpool->num_conn + shutdowns) >= total_limit) {
+      if(shutdowns) {
+        /* close one connection in shutdown right away, if we can */
+        if(!Curl_cshutdn_close_oldest(data, NULL))
+          break;
+      }
+      else {
+        struct connectdata *oldest_idle =
+          cpool_get_oldest_idle(cpool, Curl_pgrs_now(data));
+        if(!oldest_idle)
+          break;
+        /* disconnect the old conn and continue */
+        CURL_TRC_M(data, "Discarding connection #%"
+                   FMT_OFF_T " from %zu to reach total "
+                   "limit of %zu",
+                   oldest_idle->connection_id, cpool->num_conn, total_limit);
+        Curl_conn_terminate(cpool->idata, oldest_idle, FALSE);
+      }
+      shutdowns = Curl_cshutdn_count(cpool->idata);
+    }
+    if((cpool->num_conn + shutdowns) >= total_limit) {
+      res = CPOOL_LIMIT_TOTAL;
+      goto out;
+    }
+  }
 
-  DEBUGF(infof(data, "Added connection %ld. "
-               "The cache now contains %zu members",
-               conn->connection_id, connc->num_conn));
+out:
+  CPOOL_UNLOCK(cpool, cpool->idata);
+  return res;
+}
 
-unlock:
-  CONNCACHE_UNLOCK(data);
+CURLcode Curl_cpool_add(struct Curl_easy *data,
+                        struct connectdata *conn)
+{
+  CURLcode result = CURLE_OK;
+  struct cpool_bundle *bundle = NULL;
+  struct cpool *cpool = cpool_get_instance(data);
+  DEBUGASSERT(conn);
+
+  DEBUGASSERT(cpool);
+  if(!cpool)
+    return CURLE_FAILED_INIT;
+
+  CPOOL_LOCK(cpool, data);
+  bundle = cpool_find_bundle(cpool, conn);
+  if(!bundle) {
+    bundle = cpool_add_bundle(cpool, conn);
+    if(!bundle) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+  }
+
+  cpool_bundle_add(bundle, conn);
+  conn->connection_id = cpool->next_connection_id++;
+  cpool->num_conn++;
+  CURL_TRC_M(data, "[CPOOL] added connection %" FMT_OFF_T ". "
+             "The cache now contains %zu members",
+             conn->connection_id, cpool->num_conn);
+out:
+  CPOOL_UNLOCK(cpool, data);
 
   return result;
 }
 
-/*
- * Removes the connectdata object from the connection cache, but the transfer
- * still owns this connection.
- *
- * Pass TRUE/FALSE in the 'lock' argument depending on if the parent function
- * already holds the lock or not.
- */
-void Curl_conncache_remove_conn(struct Curl_easy *data,
-                                struct connectdata *conn, bool lock)
-{
-  struct connectbundle *bundle = conn->bundle;
-  struct conncache *connc = data->state.conn_cache;
-
-  /* The bundle pointer can be NULL, since this function can be called
-     due to a failed connection attempt, before being added to a bundle */
-  if(bundle) {
-    if(lock) {
-      CONNCACHE_LOCK(data);
-    }
-    bundle_remove_conn(bundle, conn);
-    if(bundle->num_connections == 0)
-      conncache_remove_bundle(connc, bundle);
-    conn->bundle = NULL; /* removed from it */
-    if(connc) {
-      connc->num_conn--;
-      DEBUGF(infof(data, "The cache now contains %zu members",
-                   connc->num_conn));
-    }
-    if(lock) {
-      CONNCACHE_UNLOCK(data);
-    }
-  }
-}
-
-/* This function iterates the entire connection cache and calls the function
+/* This function iterates the entire connection pool and calls the function
    func() with the connection pointer as the first argument and the supplied
    'param' argument as the other.
 
-   The conncache lock is still held when the callback is called. It needs it,
+   The cpool lock is still held when the callback is called. It needs it,
    so that it can safely continue traversing the lists once the callback
    returns.
 
-   Returns 1 if the loop was aborted due to the callback's return code.
+   Returns TRUE if the loop was aborted due to the callback's return code.
 
    Return 0 from func() to continue the loop, return 1 to abort it.
  */
-bool Curl_conncache_foreach(struct Curl_easy *data,
-                            struct conncache *connc,
-                            void *param,
-                            int (*func)(struct Curl_easy *data,
-                                        struct connectdata *conn, void *param))
+static bool cpool_foreach(struct Curl_easy *data,
+                          struct cpool *cpool,
+                          void *param,
+                          int (*func)(struct Curl_easy *data,
+                                      struct connectdata *conn, void *param))
 {
   struct Curl_hash_iterator iter;
-  struct Curl_llist_element *curr;
   struct Curl_hash_element *he;
 
-  if(!connc)
+  if(!cpool)
     return FALSE;
 
-  CONNCACHE_LOCK(data);
-  Curl_hash_start_iterate(&connc->hash, &iter);
+  Curl_hash_start_iterate(&cpool->dest2bundle, &iter);
 
   he = Curl_hash_next_element(&iter);
   while(he) {
-    struct connectbundle *bundle;
-
-    bundle = he->ptr;
+    struct Curl_llist_node *curr;
+    struct cpool_bundle *bundle = he->ptr;
     he = Curl_hash_next_element(&iter);
 
-    curr = bundle->conn_list.head;
+    curr = Curl_llist_head(&bundle->conns);
     while(curr) {
       /* Yes, we need to update curr before calling func(), because func()
          might decide to remove the connection */
-      struct connectdata *conn = curr->ptr;
-      curr = curr->next;
+      struct connectdata *conn = Curl_node_elem(curr);
+      curr = Curl_node_next(curr);
 
-      if(1 == func(data, conn, param)) {
-        CONNCACHE_UNLOCK(data);
+      if(func(data, conn, param) == 1) {
         return TRUE;
       }
     }
   }
-  CONNCACHE_UNLOCK(data);
   return FALSE;
 }
 
-/* Return the first connection found in the cache. Used when closing all
-   connections.
-
-   NOTE: no locking is done here as this is presumably only done when cleaning
-   up a cache!
-*/
-static struct connectdata *
-conncache_find_first_connection(struct conncache *connc)
+/*
+ * A connection (already in the pool) has become idle. Do any
+ * cleanups in regard to the pool's limits.
+ *
+ * Return TRUE if idle connection kept in pool, FALSE if closed.
+ */
+bool Curl_cpool_conn_now_idle(struct Curl_easy *data,
+                              struct connectdata *conn)
 {
-  struct Curl_hash_iterator iter;
-  struct Curl_hash_element *he;
-  struct connectbundle *bundle;
+  unsigned int maxconnects;
+  struct connectdata *oldest_idle = NULL;
+  struct cpool *cpool = cpool_get_instance(data);
+  bool kept = TRUE;
 
-  Curl_hash_start_iterate(&connc->hash, &iter);
+  if(!data || !data->multi)
+    return kept;
 
-  he = Curl_hash_next_element(&iter);
-  while(he) {
-    struct Curl_llist_element *curr;
-    bundle = he->ptr;
-
-    curr = bundle->conn_list.head;
-    if(curr) {
-      return curr->ptr;
-    }
-
-    he = Curl_hash_next_element(&iter);
+  if(!data->multi->maxconnects) {
+    unsigned int running = Curl_multi_xfers_running(data->multi);
+    maxconnects = (running <= UINT_MAX / 4) ? running * 4 : UINT_MAX;
+  }
+  else {
+    maxconnects = data->multi->maxconnects;
   }
 
-  return NULL;
-}
+  conn->lastused = *Curl_pgrs_now(data); /* it was used up until now */
+  if(cpool && maxconnects) {
+    /* may be called form a callback already under lock */
+    bool do_lock = !CPOOL_IS_LOCKED(cpool);
+    if(do_lock)
+      CPOOL_LOCK(cpool, data);
+    if(cpool->num_conn > maxconnects) {
+      infof(data, "Connection pool is full, closing the oldest of %zu/%u",
+            cpool->num_conn, maxconnects);
 
-/*
- * Give ownership of a connection back to the connection cache. Might
- * disconnect the oldest existing in there to make space.
- *
- * Return TRUE if stored, FALSE if closed.
- */
-bool Curl_conncache_return_conn(struct Curl_easy *data,
-                                struct connectdata *conn)
-{
-  /* data->multi->maxconnects can be negative, deal with it. */
-  size_t maxconnects =
-    (data->multi->maxconnects < 0) ? data->multi->num_easy * 4:
-    data->multi->maxconnects;
-  struct connectdata *conn_candidate = NULL;
-
-  conn->lastused = Curl_now(); /* it was used up until now */
-  if(maxconnects > 0 &&
-     Curl_conncache_size(data) > maxconnects) {
-    infof(data, "Connection cache is full, closing the oldest one");
-
-    conn_candidate = Curl_conncache_extract_oldest(data);
-    if(conn_candidate) {
-      /* the winner gets the honour of being disconnected */
-      Curl_disconnect(data, conn_candidate, /* dead_connection */ FALSE);
-    }
-  }
-
-  return (conn_candidate == conn) ? FALSE : TRUE;
-
-}
-
-/*
- * This function finds the connection in the connection bundle that has been
- * unused for the longest time.
- *
- * Does not lock the connection cache!
- *
- * Returns the pointer to the oldest idle connection, or NULL if none was
- * found.
- */
-struct connectdata *
-Curl_conncache_extract_bundle(struct Curl_easy *data,
-                              struct connectbundle *bundle)
-{
-  struct Curl_llist_element *curr;
-  timediff_t highscore = -1;
-  timediff_t score;
-  struct curltime now;
-  struct connectdata *conn_candidate = NULL;
-  struct connectdata *conn;
-
-  (void)data;
-
-  now = Curl_now();
-
-  curr = bundle->conn_list.head;
-  while(curr) {
-    conn = curr->ptr;
-
-    if(!CONN_INUSE(conn)) {
-      /* Set higher score for the age passed since the connection was used */
-      score = Curl_timediff(now, conn->lastused);
-
-      if(score > highscore) {
-        highscore = score;
-        conn_candidate = conn;
+      oldest_idle = cpool_get_oldest_idle(cpool, Curl_pgrs_now(data));
+      kept = (oldest_idle != conn);
+      if(oldest_idle) {
+        Curl_conn_terminate(data, oldest_idle, FALSE);
       }
     }
-    curr = curr->next;
-  }
-  if(conn_candidate) {
-    /* remove it to prevent another thread from nicking it */
-    bundle_remove_conn(bundle, conn_candidate);
-    data->state.conn_cache->num_conn--;
-    DEBUGF(infof(data, "The cache now contains %zu members",
-                 data->state.conn_cache->num_conn));
+    if(do_lock)
+      CPOOL_UNLOCK(cpool, data);
   }
 
-  return conn_candidate;
+  return kept;
 }
 
-/*
- * This function finds the connection in the connection cache that has been
- * unused for the longest time and extracts that from the bundle.
- *
- * Returns the pointer to the connection, or NULL if none was found.
- */
-struct connectdata *
-Curl_conncache_extract_oldest(struct Curl_easy *data)
+bool Curl_cpool_find(struct Curl_easy *data,
+                     const char *destination,
+                     Curl_cpool_conn_match_cb *conn_cb,
+                     Curl_cpool_done_match_cb *done_cb,
+                     void *userdata)
 {
-  struct conncache *connc = data->state.conn_cache;
-  struct Curl_hash_iterator iter;
-  struct Curl_llist_element *curr;
-  struct Curl_hash_element *he;
-  timediff_t highscore =- 1;
-  timediff_t score;
-  struct curltime now;
-  struct connectdata *conn_candidate = NULL;
-  struct connectbundle *bundle;
-  struct connectbundle *bundle_candidate = NULL;
+  struct cpool *cpool = cpool_get_instance(data);
+  struct cpool_bundle *bundle;
+  bool found = FALSE;
 
-  now = Curl_now();
+  DEBUGASSERT(cpool);
+  DEBUGASSERT(conn_cb);
+  if(!cpool)
+    return FALSE;
 
-  CONNCACHE_LOCK(data);
-  Curl_hash_start_iterate(&connc->hash, &iter);
-
-  he = Curl_hash_next_element(&iter);
-  while(he) {
-    struct connectdata *conn;
-
-    bundle = he->ptr;
-
-    curr = bundle->conn_list.head;
+  CPOOL_LOCK(cpool, data);
+  bundle = Curl_hash_pick(&cpool->dest2bundle,
+                          CURL_UNCONST(destination),
+                          strlen(destination) + 1);
+  if(bundle) {
+    struct Curl_llist_node *curr = Curl_llist_head(&bundle->conns);
     while(curr) {
-      conn = curr->ptr;
+      struct connectdata *conn = Curl_node_elem(curr);
+      /* Get next node now. callback might discard current */
+      curr = Curl_node_next(curr);
 
-      if(!CONN_INUSE(conn) && !conn->bits.close &&
-         !conn->connect_only) {
-        /* Set higher score for the age passed since the connection was used */
-        score = Curl_timediff(now, conn->lastused);
-
-        if(score > highscore) {
-          highscore = score;
-          conn_candidate = conn;
-          bundle_candidate = bundle;
-        }
+      if(conn_cb(conn, userdata)) {
+        found = TRUE;
+        break;
       }
-      curr = curr->next;
     }
-
-    he = Curl_hash_next_element(&iter);
   }
-  if(conn_candidate) {
-    /* remove it to prevent another thread from nicking it */
-    bundle_remove_conn(bundle_candidate, conn_candidate);
-    connc->num_conn--;
-    DEBUGF(infof(data, "The cache now contains %zu members",
-                 connc->num_conn));
-  }
-  CONNCACHE_UNLOCK(data);
 
-  return conn_candidate;
+  if(done_cb) {
+    found = done_cb(userdata);
+  }
+  CPOOL_UNLOCK(cpool, data);
+  return found;
 }
 
-void Curl_conncache_close_all_connections(struct conncache *connc)
+void Curl_conn_terminate(struct Curl_easy *data,
+                         struct connectdata *conn,
+                         bool aborted)
 {
-  struct connectdata *conn;
-  char buffer[READBUFFER_MIN + 1];
-  SIGPIPE_VARIABLE(pipe_st);
-  if(!connc->closure_handle)
+  struct cpool *cpool = cpool_get_instance(data);
+  bool do_lock;
+
+  DEBUGASSERT(cpool);
+  DEBUGASSERT(data && !data->conn);
+  if(!cpool)
     return;
-  connc->closure_handle->state.buffer = buffer;
-  connc->closure_handle->set.buffer_size = READBUFFER_MIN;
 
-  conn = conncache_find_first_connection(connc);
-  while(conn) {
-    sigpipe_ignore(connc->closure_handle, &pipe_st);
-    /* This will remove the connection from the cache */
-    connclose(conn, "kill all");
-    Curl_conncache_remove_conn(connc->closure_handle, conn, TRUE);
-    Curl_disconnect(connc->closure_handle, conn, FALSE);
-    sigpipe_restore(&pipe_st);
-
-    conn = conncache_find_first_connection(connc);
+  /* If this connection is not marked to force-close, leave it open if there
+   * are other users of it */
+  if(CONN_INUSE(conn) && !aborted) {
+    DEBUGASSERT(0); /* does this ever happen? */
+    DEBUGF(infof(data, "conn terminate when inuse: %u", conn->attached_xfers));
+    return;
   }
 
-  connc->closure_handle->state.buffer = NULL;
-  sigpipe_ignore(connc->closure_handle, &pipe_st);
+  /* This method may be called while we are under lock, e.g. from a
+   * user callback in find. */
+  do_lock = !CPOOL_IS_LOCKED(cpool);
+  if(do_lock)
+    CPOOL_LOCK(cpool, data);
 
-  Curl_hostcache_clean(connc->closure_handle,
-                       connc->closure_handle->dns.hostcache);
-  Curl_close(&connc->closure_handle);
-  sigpipe_restore(&pipe_st);
+  if(conn->bits.in_cpool) {
+    cpool_remove_conn(cpool, conn);
+    DEBUGASSERT(!conn->bits.in_cpool);
+  }
+
+  /* treat the connection as aborted in CONNECT_ONLY situations,
+   * so no graceful shutdown is attempted. */
+  if(conn->bits.connect_only)
+    aborted = TRUE;
+
+  if(data->multi) {
+    /* Add it to the multi's cpool for shutdown handling */
+    infof(data, "%s connection #%" FMT_OFF_T,
+          aborted ? "closing" : "shutting down", conn->connection_id);
+    cpool_discard_conn(&data->multi->cpool, data, conn, aborted);
+  }
+  else {
+    /* No multi available, terminate */
+    infof(data, "closing connection #%" FMT_OFF_T, conn->connection_id);
+    Curl_cshutdn_terminate(cpool->idata, conn, !aborted);
+  }
+
+  if(do_lock)
+    CPOOL_UNLOCK(cpool, data);
+}
+
+struct cpool_reaper_ctx {
+  size_t checked;
+  size_t reaped;
+};
+
+static int cpool_reap_dead_cb(struct Curl_easy *data,
+                              struct connectdata *conn, void *param)
+{
+  struct cpool_reaper_ctx *reaper = param;
+  bool terminate = !CONN_INUSE(conn) && conn->bits.no_reuse;
+
+  if(!terminate) {
+    reaper->checked++;
+    terminate = Curl_conn_seems_dead(conn, data);
+  }
+  if(terminate) {
+    /* stop the iteration here, pass back the connection that was pruned */
+    reaper->reaped++;
+    Curl_conn_terminate(data, conn, FALSE);
+    return 1;
+  }
+  return 0; /* continue iteration */
+}
+
+/*
+ * This function scans the data's connection pool for half-open/dead
+ * connections, closes and removes them.
+ * The cleanup is done at most once per second.
+ *
+ * When called, this transfer has no connection attached.
+ */
+void Curl_cpool_prune_dead(struct Curl_easy *data)
+{
+  struct cpool *cpool = cpool_get_instance(data);
+  struct cpool_reaper_ctx reaper;
+  timediff_t elapsed;
+
+  if(!cpool)
+    return;
+
+  memset(&reaper, 0, sizeof(reaper));
+  CPOOL_LOCK(cpool, data);
+  elapsed = curlx_ptimediff_ms(Curl_pgrs_now(data), &cpool->last_cleanup);
+
+  if(elapsed >= 1000L) {
+    while(cpool_foreach(data, cpool, &reaper, cpool_reap_dead_cb))
+      ;
+    cpool->last_cleanup = *Curl_pgrs_now(data);
+  }
+  CPOOL_UNLOCK(cpool, data);
+}
+
+static int conn_upkeep(struct Curl_easy *data,
+                       struct connectdata *conn,
+                       void *param)
+{
+  (void)param;
+  Curl_conn_upkeep(data, conn);
+  return 0; /* continue iteration */
+}
+
+CURLcode Curl_cpool_upkeep(struct Curl_easy *data)
+{
+  struct cpool *cpool = cpool_get_instance(data);
+
+  if(!cpool)
+    return CURLE_OK;
+
+  CPOOL_LOCK(cpool, data);
+  cpool_foreach(data, cpool, NULL, conn_upkeep);
+  CPOOL_UNLOCK(cpool, data);
+  return CURLE_OK;
+}
+
+struct cpool_find_ctx {
+  curl_off_t id;
+  struct connectdata *conn;
+};
+
+static int cpool_find_conn(struct Curl_easy *data,
+                           struct connectdata *conn, void *param)
+{
+  struct cpool_find_ctx *fctx = param;
+  (void)data;
+  if(conn->connection_id == fctx->id) {
+    fctx->conn = conn;
+    return 1;
+  }
+  return 0;
+}
+
+struct connectdata *Curl_cpool_get_conn(struct Curl_easy *data,
+                                        curl_off_t conn_id)
+{
+  struct cpool *cpool = cpool_get_instance(data);
+  struct cpool_find_ctx fctx;
+
+  if(!cpool)
+    return NULL;
+  fctx.id = conn_id;
+  fctx.conn = NULL;
+  CPOOL_LOCK(cpool, data);
+  cpool_foreach(data, cpool, &fctx, cpool_find_conn);
+  CPOOL_UNLOCK(cpool, data);
+  return fctx.conn;
+}
+
+struct cpool_do_conn_ctx {
+  curl_off_t id;
+  Curl_cpool_conn_do_cb *cb;
+  void *cbdata;
+};
+
+static int cpool_do_conn(struct Curl_easy *data,
+                         struct connectdata *conn, void *param)
+{
+  struct cpool_do_conn_ctx *dctx = param;
+
+  if(conn->connection_id == dctx->id) {
+    dctx->cb(conn, data, dctx->cbdata);
+    return 1;
+  }
+  return 0;
+}
+
+void Curl_cpool_do_by_id(struct Curl_easy *data, curl_off_t conn_id,
+                         Curl_cpool_conn_do_cb *cb, void *cbdata)
+{
+  struct cpool *cpool = cpool_get_instance(data);
+  struct cpool_do_conn_ctx dctx;
+
+  if(!cpool)
+    return;
+  dctx.id = conn_id;
+  dctx.cb = cb;
+  dctx.cbdata = cbdata;
+  CPOOL_LOCK(cpool, data);
+  cpool_foreach(data, cpool, &dctx, cpool_do_conn);
+  CPOOL_UNLOCK(cpool, data);
+}
+
+void Curl_cpool_do_locked(struct Curl_easy *data,
+                          struct connectdata *conn,
+                          Curl_cpool_conn_do_cb *cb, void *cbdata)
+{
+  struct cpool *cpool = cpool_get_instance(data);
+  if(cpool) {
+    CPOOL_LOCK(cpool, data);
+    cb(conn, data, cbdata);
+    CPOOL_UNLOCK(cpool, data);
+  }
+  else
+    cb(conn, data, cbdata);
+}
+
+static int cpool_mark_stale(struct Curl_easy *data,
+                            struct connectdata *conn, void *param)
+{
+  (void)data;
+  (void)param;
+  conn->bits.no_reuse = TRUE;
+  return 0;
+}
+
+static int cpool_reap_no_reuse(struct Curl_easy *data,
+                               struct connectdata *conn, void *param)
+{
+  (void)param;
+  if(!CONN_INUSE(conn) && conn->bits.no_reuse) {
+    Curl_conn_terminate(data, conn, FALSE);
+    return 1;
+  }
+  return 0; /* continue iteration */
+}
+
+void Curl_cpool_nw_changed(struct Curl_easy *data)
+{
+  struct cpool *cpool = cpool_get_instance(data);
+
+  if(cpool) {
+    CPOOL_LOCK(cpool, data);
+    cpool_foreach(data, cpool, NULL, cpool_mark_stale);
+    while(cpool_foreach(data, cpool, NULL, cpool_reap_no_reuse))
+      ;
+    CPOOL_UNLOCK(cpool, data);
+  }
 }
 
 #if 0
-/* Useful for debugging the connection cache */
-void Curl_conncache_print(struct conncache *connc)
+/* Useful for debugging the connection pool */
+void Curl_cpool_print(struct cpool *cpool)
 {
   struct Curl_hash_iterator iter;
-  struct Curl_llist_element *curr;
+  struct Curl_llist_node *curr;
   struct Curl_hash_element *he;
 
-  if(!connc)
+  if(!cpool)
     return;
 
-  fprintf(stderr, "=Bundle cache=\n");
+  curl_mfprintf(stderr, "=Bundle cache=\n");
 
-  Curl_hash_start_iterate(connc->hash, &iter);
+  Curl_hash_start_iterate(cpool->dest2bundle, &iter);
 
   he = Curl_hash_next_element(&iter);
   while(he) {
-    struct connectbundle *bundle;
+    struct cpool_bundle *bundle;
     struct connectdata *conn;
 
     bundle = he->ptr;
 
-    fprintf(stderr, "%s -", he->key);
-    curr = bundle->conn_list->head;
+    curl_mfprintf(stderr, "%s -", he->key);
+    curr = Curl_llist_head(bundle->conns);
     while(curr) {
-      conn = curr->ptr;
+      conn = Curl_node_elem(curr);
 
-      fprintf(stderr, " [%p %d]", (void *)conn, conn->inuse);
-      curr = curr->next;
+      curl_mfprintf(stderr, " [%p %d]", (void *)conn, conn->refcount);
+      curr = Curl_node_next(curr);
     }
-    fprintf(stderr, "\n");
+    curl_mfprintf(stderr, "\n");
 
     he = Curl_hash_next_element(&iter);
   }
diff --git a/third-party/curl/lib/conncache.h b/third-party/curl/lib/conncache.h
index c60f8449ee..71940d724c 100644
--- a/third-party/curl/lib/conncache.h
+++ b/third-party/curl/lib/conncache.h
@@ -24,99 +24,144 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
-/*
- * All accesses to struct fields and changing of data in the connection cache
- * and connectbundles must be done with the conncache LOCKED. The cache might
- * be shared.
- */
-
-#include <curl/curl.h>
-#include "timeval.h"
+#include "curlx/timeval.h"
 
 struct connectdata;
+struct Curl_easy;
+struct curl_pollfds;
+struct Curl_waitfds;
+struct Curl_multi;
+struct Curl_share;
 
-struct conncache {
-  struct Curl_hash hash;
+/**
+ * Terminate the connection, e.g. close and destroy.
+ * If the connection is in a cpool, remove it.
+ * If a `cshutdn` is available (e.g. data has a multi handle),
+ * pass the connection to that for controlled shutdown.
+ * Otherwise terminate it right away.
+ * Takes ownership of `conn`.
+ * `data` should not be attached to a connection.
+ */
+void Curl_conn_terminate(struct Curl_easy *data,
+                         struct connectdata *conn,
+                         bool aborted);
+
+struct cpool {
+  /* the pooled connections, bundled per destination */
+  struct Curl_hash dest2bundle;
   size_t num_conn;
   curl_off_t next_connection_id;
   curl_off_t next_easy_id;
   struct curltime last_cleanup;
-  /* handle used for closing cached connections */
-  struct Curl_easy *closure_handle;
+  struct Curl_easy *idata; /* internal handle for maintenance */
+  struct Curl_share *share; /* != NULL if pool belongs to share */
+  BIT(locked);
+  BIT(initialized);
 };
 
-#define BUNDLE_NO_MULTIUSE -1
-#define BUNDLE_UNKNOWN     0  /* initial value */
-#define BUNDLE_MULTIPLEX   2
+/* Init the pool, pass multi only if pool is owned by it.
+ * Cannot fail.
+ */
+void Curl_cpool_init(struct cpool *cpool,
+                     struct Curl_easy *idata,
+                     struct Curl_share *share,
+                     size_t size);
 
-#ifdef CURLDEBUG
-/* the debug versions of these macros make extra certain that the lock is
-   never doubly locked or unlocked */
-#define CONNCACHE_LOCK(x)                                               \
-  do {                                                                  \
-    if((x)->share) {                                                    \
-      Curl_share_lock((x), CURL_LOCK_DATA_CONNECT,                      \
-                      CURL_LOCK_ACCESS_SINGLE);                         \
-      DEBUGASSERT(!(x)->state.conncache_lock);                          \
-      (x)->state.conncache_lock = TRUE;                                 \
-    }                                                                   \
-  } while(0)
+/* Destroy all connections and free all members */
+void Curl_cpool_destroy(struct cpool *cpool);
 
-#define CONNCACHE_UNLOCK(x)                                             \
-  do {                                                                  \
-    if((x)->share) {                                                    \
-      DEBUGASSERT((x)->state.conncache_lock);                           \
-      (x)->state.conncache_lock = FALSE;                                \
-      Curl_share_unlock((x), CURL_LOCK_DATA_CONNECT);                   \
-    }                                                                   \
-  } while(0)
-#else
-#define CONNCACHE_LOCK(x) if((x)->share)                                \
-    Curl_share_lock((x), CURL_LOCK_DATA_CONNECT, CURL_LOCK_ACCESS_SINGLE)
-#define CONNCACHE_UNLOCK(x) if((x)->share)              \
-    Curl_share_unlock((x), CURL_LOCK_DATA_CONNECT)
-#endif
+/* Init the transfer to be used within its connection pool.
+ * Assigns `data->id`. */
+void Curl_cpool_xfer_init(struct Curl_easy *data);
 
-struct connectbundle {
-  int multiuse;                 /* supports multi-use */
-  size_t num_connections;       /* Number of connections in the bundle */
-  struct Curl_llist conn_list;  /* The connectdata members of the bundle */
-};
+/* Get the connection with the given id from `data`'s conn pool. */
+struct connectdata *Curl_cpool_get_conn(struct Curl_easy *data,
+                                        curl_off_t conn_id);
 
-/* returns 1 on error, 0 is fine */
-int Curl_conncache_init(struct conncache *, int size);
-void Curl_conncache_destroy(struct conncache *connc);
+/* Add the connection to the pool. */
+CURLcode Curl_cpool_add(struct Curl_easy *data,
+                        struct connectdata *conn) WARN_UNUSED_RESULT;
 
-/* return the correct bundle, to a host or a proxy */
-struct connectbundle *Curl_conncache_find_bundle(struct Curl_easy *data,
-                                                 struct connectdata *conn,
-                                                 struct conncache *connc);
-/* returns number of connections currently held in the connection cache */
-size_t Curl_conncache_size(struct Curl_easy *data);
+/**
+ * Return if the pool has reached its configured limits for adding
+ * the given connection. Try to discard the oldest, idle connections
+ * to make space.
+ */
+#define CPOOL_LIMIT_OK     0
+#define CPOOL_LIMIT_DEST   1
+#define CPOOL_LIMIT_TOTAL  2
+int Curl_cpool_check_limits(struct Curl_easy *data,
+                            struct connectdata *conn);
 
-bool Curl_conncache_return_conn(struct Curl_easy *data,
-                                struct connectdata *conn);
-CURLcode Curl_conncache_add_conn(struct Curl_easy *data) WARN_UNUSED_RESULT;
-void Curl_conncache_remove_conn(struct Curl_easy *data,
-                                struct connectdata *conn,
-                                bool lock);
-bool Curl_conncache_foreach(struct Curl_easy *data,
-                            struct conncache *connc,
-                            void *param,
-                            int (*func)(struct Curl_easy *data,
-                                        struct connectdata *conn,
-                                        void *param));
+/* Return of conn is suitable. If so, stops iteration. */
+typedef bool Curl_cpool_conn_match_cb(struct connectdata *conn,
+                                      void *userdata);
 
-struct connectdata *
-Curl_conncache_find_first_connection(struct conncache *connc);
+/* Act on the result of the find, may override it. */
+typedef bool Curl_cpool_done_match_cb(void *userdata);
 
-struct connectdata *
-Curl_conncache_extract_bundle(struct Curl_easy *data,
-                              struct connectbundle *bundle);
-struct connectdata *
-Curl_conncache_extract_oldest(struct Curl_easy *data);
-void Curl_conncache_close_all_connections(struct conncache *connc);
-void Curl_conncache_print(struct conncache *connc);
+/**
+ * Find a connection in the pool matching `destination`.
+ * All callbacks are invoked while the pool's lock is held.
+ * @param data        current transfer
+ * @param destination match against `conn->destination` in pool
+ * @param conn_cb     must be present, called for each connection in the
+ *                    bundle until it returns TRUE
+ * @return combined result of last conn_db and result_cb or FALSE if no
+                      connections were present.
+ */
+bool Curl_cpool_find(struct Curl_easy *data,
+                     const char *destination,
+                     Curl_cpool_conn_match_cb *conn_cb,
+                     Curl_cpool_done_match_cb *done_cb,
+                     void *userdata);
+
+/*
+ * A connection (already in the pool) is now idle. Do any
+ * cleanups in regard to the pool's limits.
+ *
+ * Return TRUE if idle connection kept in pool, FALSE if closed.
+ */
+bool Curl_cpool_conn_now_idle(struct Curl_easy *data,
+                              struct connectdata *conn);
+
+/**
+ * This function scans the data's connection pool for half-open/dead
+ * connections, closes and removes them.
+ * The cleanup is done at most once per second.
+ *
+ * When called, this transfer has no connection attached.
+ */
+void Curl_cpool_prune_dead(struct Curl_easy *data);
+
+/**
+ * Perform upkeep actions on connections in the transfer's pool.
+ */
+CURLcode Curl_cpool_upkeep(struct Curl_easy *data);
+
+typedef void Curl_cpool_conn_do_cb(struct connectdata *conn,
+                                   struct Curl_easy *data,
+                                   void *cbdata);
+
+/**
+ * Invoke the callback on the pool's connection with the
+ * given connection id (if it exists).
+ */
+void Curl_cpool_do_by_id(struct Curl_easy *data,
+                         curl_off_t conn_id,
+                         Curl_cpool_conn_do_cb *cb, void *cbdata);
+
+/**
+ * Invoked the callback for the given data + connection under the
+ * connection pool's lock.
+ * The callback is always invoked, even if the transfer has no connection
+ * pool associated.
+ */
+void Curl_cpool_do_locked(struct Curl_easy *data,
+                          struct connectdata *conn,
+                          Curl_cpool_conn_do_cb *cb, void *cbdata);
+
+/* Close all unused connections, prevent reuse of existing ones. */
+void Curl_cpool_nw_changed(struct Curl_easy *data);
 
 #endif /* HEADER_CURL_CONNCACHE_H */
diff --git a/third-party/curl/lib/connect.c b/third-party/curl/lib/connect.c
index 033fb7b17d..a2b86c7458 100644
--- a/third-party/curl/lib/connect.c
+++ b/third-party/curl/lib/connect.c
@@ -21,254 +21,164 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h> /* <netinet/tcp.h> may need it */
-#endif
-#ifdef HAVE_SYS_UN_H
-#include <sys/un.h> /* for sockaddr_un */
-#endif
-#ifdef HAVE_LINUX_TCP_H
-#include <linux/tcp.h>
-#elif defined(HAVE_NETINET_TCP_H)
-#include <netinet/tcp.h>
-#endif
-#ifdef HAVE_SYS_IOCTL_H
-#include <sys/ioctl.h>
-#endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
-#ifdef HAVE_FCNTL_H
-#include <fcntl.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-
-#ifdef __VMS
-#include <in.h>
-#include <inet.h>
-#endif
-
 #include "urldata.h"
-#include "sendf.h"
-#include "if2ip.h"
+#include "curl_trc.h"
 #include "strerror.h"
 #include "cfilters.h"
 #include "connect.h"
-#include "cf-haproxy.h"
+#include "cf-dns.h"
 #include "cf-https-connect.h"
-#include "cf-socket.h"
-#include "select.h"
-#include "url.h" /* for Curl_safefree() */
+#include "cf-setup.h"
 #include "multiif.h"
-#include "sockaddr.h" /* required for Curl_sockaddr_storage */
-#include "inet_ntop.h"
-#include "inet_pton.h"
-#include "vtls/vtls.h" /* for vtsl cfilters */
 #include "progress.h"
-#include "warnless.h"
 #include "conncache.h"
 #include "multihandle.h"
-#include "share.h"
-#include "version_win32.h"
-#include "vquic/vquic.h" /* for quic cfilters */
-#include "http_proxy.h"
-#include "socks.h"
+#include "select.h"
+#include "curlx/strparse.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#if !defined(CURL_DISABLE_ALTSVC) || defined(USE_HTTPSRR)
 
+enum alpnid Curl_alpn2alpnid(const unsigned char *name, size_t len)
+{
+  if(len == 2) {
+    if(!memcmp(name, "h1", 2))
+      return ALPN_h1;
+    if(!memcmp(name, "h2", 2))
+      return ALPN_h2;
+    if(!memcmp(name, "h3", 2))
+      return ALPN_h3;
+  }
+  else if(len == 8) {
+    if(!memcmp(name, "http/1.1", 8))
+      return ALPN_h1;
+  }
+  return ALPN_none; /* unknown, probably rubbish input */
+}
+
+enum alpnid Curl_str2alpnid(const struct Curl_str *cstr)
+{
+  return Curl_alpn2alpnid((const unsigned char *)curlx_str(cstr),
+                          curlx_strlen(cstr));
+}
+
+#endif
 
 /*
- * Curl_timeleft() returns the amount of milliseconds left allowed for the
- * transfer/connection. If the value is 0, there's no timeout (ie there's
+ * timeleft_now_ms() returns the amount of milliseconds left allowed for the
+ * transfer/connection. If the value is 0, there is no timeout (ie there is
  * infinite time left). If the value is negative, the timeout time has already
  * elapsed.
  *
- * If 'nowp' is non-NULL, it points to the current time.
- * 'duringconnect' is FALSE if not during a connect, as then of course the
- * connect timeout is not taken into account!
- *
- * @unittest: 1303
+ * @unittest 1303
  */
-
-#define TIMEOUT_CONNECT 1
-#define TIMEOUT_MAXTIME 2
-
-timediff_t Curl_timeleft(struct Curl_easy *data,
-                         struct curltime *nowp,
-                         bool duringconnect)
+UNITTEST timediff_t timeleft_now_ms(struct Curl_easy *data,
+                                    const struct curltime *pnow);
+UNITTEST timediff_t timeleft_now_ms(struct Curl_easy *data,
+                                    const struct curltime *pnow)
 {
-  unsigned int timeout_set = 0;
-  timediff_t connect_timeout_ms = 0;
-  timediff_t maxtime_timeout_ms = 0;
-  timediff_t timeout_ms = 0;
-  struct curltime now;
+  timediff_t timeleft_ms = 0;
+  timediff_t ctimeleft_ms = 0;
 
-  /* The duration of a connect and the total transfer are calculated from two
-     different time-stamps. It can end up with the total timeout being reached
-     before the connect timeout expires and we must acknowledge whichever
-     timeout that is reached first. The total timeout is set per entire
-     operation, while the connect timeout is set per connect. */
-
-  if(data->set.timeout > 0) {
-    timeout_set = TIMEOUT_MAXTIME;
-    maxtime_timeout_ms = data->set.timeout;
-  }
-  if(duringconnect) {
-    timeout_set |= TIMEOUT_CONNECT;
-    connect_timeout_ms = (data->set.connecttimeout > 0) ?
+  if(Curl_shutdown_started(data, FIRSTSOCKET))
+    return Curl_shutdown_timeleft(data, data->conn, FIRSTSOCKET);
+  else if(Curl_is_connecting(data)) {
+    timediff_t ctimeout_ms = (data->set.connecttimeout > 0) ?
       data->set.connecttimeout : DEFAULT_CONNECT_TIMEOUT;
+    ctimeleft_ms = ctimeout_ms -
+      curlx_ptimediff_ms(pnow, &data->progress.t_startsingle);
+    if(!ctimeleft_ms)
+      ctimeleft_ms = -1; /* 0 is "no limit", fake 1 ms expiry */
   }
-  if(!timeout_set)
-    /* no timeout  */
-    return 0;
-
-  if(!nowp) {
-    now = Curl_now();
-    nowp = &now;
+  else if(!data->set.timeout || data->set.connect_only) {
+    return 0; /* no timeout in place or checked, return "no limit" */
   }
 
-  if(timeout_set & TIMEOUT_MAXTIME) {
-    maxtime_timeout_ms -= Curl_timediff(*nowp, data->progress.t_startop);
-    timeout_ms = maxtime_timeout_ms;
+  if(data->set.timeout) {
+    timeleft_ms = data->set.timeout -
+      curlx_ptimediff_ms(pnow, &data->progress.t_startop);
+    if(!timeleft_ms)
+      timeleft_ms = -1; /* 0 is "no limit", fake 1 ms expiry */
   }
 
-  if(timeout_set & TIMEOUT_CONNECT) {
-    connect_timeout_ms -= Curl_timediff(*nowp, data->progress.t_startsingle);
-
-    if(!(timeout_set & TIMEOUT_MAXTIME) ||
-       (connect_timeout_ms < maxtime_timeout_ms))
-      timeout_ms = connect_timeout_ms;
-  }
-
-  if(!timeout_ms)
-    /* avoid returning 0 as that means no timeout! */
-    return -1;
-
-  return timeout_ms;
+  if(!ctimeleft_ms)
+    return timeleft_ms;
+  else if(!timeleft_ms)
+    return ctimeleft_ms;
+  return CURLMIN(ctimeleft_ms, timeleft_ms);
 }
 
-/* Copies connection info into the transfer handle to make it available when
-   the transfer handle is no longer associated with the connection. */
-void Curl_persistconninfo(struct Curl_easy *data, struct connectdata *conn,
-                          char *local_ip, int local_port)
+timediff_t Curl_timeleft_ms(struct Curl_easy *data)
 {
-  memcpy(data->info.conn_primary_ip, conn->primary_ip, MAX_IPADR_LEN);
-  if(local_ip && local_ip[0])
-    memcpy(data->info.conn_local_ip, local_ip, MAX_IPADR_LEN);
-  else
-    data->info.conn_local_ip[0] = 0;
-  data->info.conn_scheme = conn->handler->scheme;
-  /* conn_protocol can only provide "old" protocols */
-  data->info.conn_protocol = (conn->handler->protocol) & CURLPROTO_MASK;
-  data->info.conn_primary_port = conn->port;
-  data->info.conn_remote_port = conn->remote_port;
-  data->info.conn_local_port = local_port;
+  return timeleft_now_ms(data, Curl_pgrs_now(data));
 }
 
-static const struct Curl_addrinfo *
-addr_first_match(const struct Curl_addrinfo *addr, int family)
+void Curl_shutdown_start(struct Curl_easy *data, int sockindex,
+                         int timeout_ms)
 {
-  while(addr) {
-    if(addr->ai_family == family)
-      return addr;
-    addr = addr->ai_next;
-  }
-  return NULL;
+  struct connectdata *conn = data->conn;
+
+  DEBUGASSERT(conn);
+  conn->shutdown.start[sockindex] = *Curl_pgrs_now(data);
+  conn->shutdown.timeout_ms = (timeout_ms > 0) ?
+    (timediff_t)timeout_ms :
+    ((data->set.shutdowntimeout > 0) ?
+     data->set.shutdowntimeout : DEFAULT_SHUTDOWN_TIMEOUT_MS);
+  /* Set a timer, unless we operate on the admin handle */
+  if(data->mid)
+    Curl_expire_ex(data, conn->shutdown.timeout_ms, EXPIRE_SHUTDOWN);
+  CURL_TRC_M(data, "shutdown start on%s connection",
+             sockindex ? " secondary" : "");
 }
 
-static const struct Curl_addrinfo *
-addr_next_match(const struct Curl_addrinfo *addr, int family)
+timediff_t Curl_shutdown_timeleft(struct Curl_easy *data,
+                                  struct connectdata *conn,
+                                  int sockindex)
 {
-  while(addr && addr->ai_next) {
-    addr = addr->ai_next;
-    if(addr->ai_family == family)
-      return addr;
-  }
-  return NULL;
+  timediff_t left_ms;
+
+  if(!conn->shutdown.start[sockindex].tv_sec ||
+     (conn->shutdown.timeout_ms <= 0))
+    return 0; /* not started or no limits */
+
+  left_ms = conn->shutdown.timeout_ms -
+            curlx_ptimediff_ms(Curl_pgrs_now(data),
+                               &conn->shutdown.start[sockindex]);
+  return left_ms ? left_ms : -1;
 }
 
-/* retrieves ip address and port from a sockaddr structure.
-   note it calls Curl_inet_ntop which sets errno on fail, not SOCKERRNO. */
-bool Curl_addr2string(struct sockaddr *sa, curl_socklen_t salen,
-                      char *addr, int *port)
+timediff_t Curl_conn_shutdown_timeleft(struct Curl_easy *data,
+                                       struct connectdata *conn)
 {
-  struct sockaddr_in *si = NULL;
-#ifdef ENABLE_IPV6
-  struct sockaddr_in6 *si6 = NULL;
-#endif
-#if (defined(HAVE_SYS_UN_H) || defined(WIN32_SOCKADDR_UN)) && defined(AF_UNIX)
-  struct sockaddr_un *su = NULL;
-#else
-  (void)salen;
-#endif
+  timediff_t left_ms = 0, ms;
+  int i;
 
-  switch(sa->sa_family) {
-    case AF_INET:
-      si = (struct sockaddr_in *)(void *) sa;
-      if(Curl_inet_ntop(sa->sa_family, &si->sin_addr,
-                        addr, MAX_IPADR_LEN)) {
-        unsigned short us_port = ntohs(si->sin_port);
-        *port = us_port;
-        return TRUE;
-      }
-      break;
-#ifdef ENABLE_IPV6
-    case AF_INET6:
-      si6 = (struct sockaddr_in6 *)(void *) sa;
-      if(Curl_inet_ntop(sa->sa_family, &si6->sin6_addr,
-                        addr, MAX_IPADR_LEN)) {
-        unsigned short us_port = ntohs(si6->sin6_port);
-        *port = us_port;
-        return TRUE;
-      }
-      break;
-#endif
-#if (defined(HAVE_SYS_UN_H) || defined(WIN32_SOCKADDR_UN)) && defined(AF_UNIX)
-    case AF_UNIX:
-      if(salen > (curl_socklen_t)sizeof(CURL_SA_FAMILY_T)) {
-        su = (struct sockaddr_un*)sa;
-        msnprintf(addr, MAX_IPADR_LEN, "%s", su->sun_path);
-      }
-      else
-        addr[0] = 0; /* socket with no name */
-      *port = 0;
-      return TRUE;
-#endif
-    default:
-      break;
+  for(i = 0; conn->shutdown.timeout_ms && (i < 2); ++i) {
+    if(!conn->shutdown.start[i].tv_sec)
+      continue;
+    ms = Curl_shutdown_timeleft(data, conn, i);
+    if(ms && (!left_ms || ms < left_ms))
+      left_ms = ms;
   }
+  return left_ms;
+}
 
-  addr[0] = '\0';
-  *port = 0;
-  errno = EAFNOSUPPORT;
+void Curl_shutdown_clear(struct Curl_easy *data, int sockindex)
+{
+  struct curltime *pt = &data->conn->shutdown.start[sockindex];
+  memset(pt, 0, sizeof(*pt));
+}
+
+bool Curl_shutdown_started(struct Curl_easy *data, int sockindex)
+{
+  if(data->conn) {
+    struct curltime *pt = &data->conn->shutdown.start[sockindex];
+    return (pt->tv_sec > 0) || (pt->tv_usec > 0);
+  }
   return FALSE;
 }
 
-struct connfind {
-  curl_off_t id_tofind;
-  struct connectdata *found;
-};
-
-static int conn_is_conn(struct Curl_easy *data,
-                        struct connectdata *conn, void *param)
-{
-  struct connfind *f = (struct connfind *)param;
-  (void)data;
-  if(conn->connection_id == f->id_tofind) {
-    f->found = conn;
-    return 1;
-  }
-  return 0;
-}
-
 /*
  * Used to extract socket and connectdata struct for the most recent
  * transfer on the given Curl_easy.
@@ -285,30 +195,19 @@ curl_socket_t Curl_getconnectinfo(struct Curl_easy *data,
    * - that is associated with a multi handle, and whose connection
    *   was detached with CURLOPT_CONNECT_ONLY
    */
-  if((data->state.lastconnect_id != -1) && (data->multi_easy || data->multi)) {
-    struct connectdata *c;
-    struct connfind find;
-    find.id_tofind = data->state.lastconnect_id;
-    find.found = NULL;
+  if(data->state.lastconnect_id != -1) {
+    struct connectdata *conn;
 
-    Curl_conncache_foreach(data,
-                           data->share && (data->share->specifier
-                           & (1<< CURL_LOCK_DATA_CONNECT))?
-                           &data->share->conn_cache:
-                           data->multi_easy?
-                           &data->multi_easy->conn_cache:
-                           &data->multi->conn_cache, &find, conn_is_conn);
-
-    if(!find.found) {
+    conn = Curl_cpool_get_conn(data, data->state.lastconnect_id);
+    if(!conn) {
       data->state.lastconnect_id = -1;
       return CURL_SOCKET_BAD;
     }
 
-    c = find.found;
     if(connp)
       /* only store this if the caller cares for it */
-      *connp = c;
-    return c->sock[FIRSTSOCKET];
+      *connp = conn;
+    return conn->sock[FIRSTSOCKET];
   }
   return CURL_SOCKET_BAD;
 }
@@ -318,1131 +217,278 @@ curl_socket_t Curl_getconnectinfo(struct Curl_easy *data,
  */
 void Curl_conncontrol(struct connectdata *conn,
                       int ctrl /* see defines in header */
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
                       , const char *reason
 #endif
   )
 {
-  /* close if a connection, or a stream that isn't multiplexed. */
+  /* close if a connection, or a stream that is not multiplexed. */
   /* This function will be called both before and after this connection is
      associated with a transfer. */
   bool closeit, is_multiplex;
   DEBUGASSERT(conn);
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
   (void)reason; /* useful for debugging */
 #endif
   is_multiplex = Curl_conn_is_multiplex(conn, FIRSTSOCKET);
   closeit = (ctrl == CONNCTRL_CONNECTION) ||
-    ((ctrl == CONNCTRL_STREAM) && !is_multiplex);
+            ((ctrl == CONNCTRL_STREAM) && !is_multiplex);
   if((ctrl == CONNCTRL_STREAM) && is_multiplex)
     ;  /* stream signal on multiplex conn never affects close state */
-  else if((bit)closeit != conn->bits.close) {
+  else if((curl_bit)closeit != conn->bits.close) {
     conn->bits.close = closeit; /* the only place in the source code that
                                    should assign this bit */
   }
 }
 
-/**
- * job walking the matching addr infos, creating a sub-cfilter with the
- * provided method `cf_create` and running setup/connect on it.
- */
-struct eyeballer {
-  const char *name;
-  const struct Curl_addrinfo *addr;  /* List of addresses to try, not owned */
-  int ai_family;                     /* matching address family only */
-  cf_ip_connect_create *cf_create;   /* for creating cf */
-  struct Curl_cfilter *cf;           /* current sub-cfilter connecting */
-  struct eyeballer *primary;         /* eyeballer this one is backup for */
-  timediff_t delay_ms;               /* delay until start */
-  struct curltime started;           /* start of current attempt */
-  timediff_t timeoutms;              /* timeout for current attempt */
-  expire_id timeout_id;              /* ID for Curl_expire() */
-  CURLcode result;
-  int error;
-  BIT(has_started);                  /* attempts have started */
-  BIT(is_done);                      /* out of addresses/time */
-  BIT(connected);                    /* cf has connected */
-};
-
-
-typedef enum {
-  SCFST_INIT,
-  SCFST_WAITING,
-  SCFST_DONE
-} cf_connect_state;
-
-struct cf_he_ctx {
-  int transport;
-  cf_ip_connect_create *cf_create;
-  const struct Curl_dns_entry *remotehost;
-  cf_connect_state state;
-  struct eyeballer *baller[2];
-  struct eyeballer *winner;
-  struct curltime started;
-};
-
-/* when there are more than one IP address left to use, this macro returns how
-   much of the given timeout to spend on *this* attempt */
-#define TIMEOUT_LARGE 600
-#define USETIME(ms) ((ms > TIMEOUT_LARGE) ? (ms / 2) : ms)
-
-static CURLcode eyeballer_new(struct eyeballer **pballer,
-                              cf_ip_connect_create *cf_create,
-                              const struct Curl_addrinfo *addr,
-                              int ai_family,
-                              struct eyeballer *primary,
-                              timediff_t delay_ms,
-                              timediff_t timeout_ms,
-                              expire_id timeout_id)
-{
-  struct eyeballer *baller;
-
-  *pballer = NULL;
-  baller = calloc(1, sizeof(*baller) + 1000);
-  if(!baller)
-    return CURLE_OUT_OF_MEMORY;
-
-  baller->name = ((ai_family == AF_INET)? "ipv4" : (
-#ifdef ENABLE_IPV6
-                  (ai_family == AF_INET6)? "ipv6" :
-#endif
-                  "ip"));
-  baller->cf_create = cf_create;
-  baller->addr = addr;
-  baller->ai_family = ai_family;
-  baller->primary = primary;
-  baller->delay_ms = delay_ms;
-  baller->timeoutms = addr_next_match(baller->addr, baller->ai_family)?
-    USETIME(timeout_ms) : timeout_ms;
-  baller->timeout_id = timeout_id;
-  baller->result = CURLE_COULDNT_CONNECT;
-
-  *pballer = baller;
-  return CURLE_OK;
-}
-
-static void baller_close(struct eyeballer *baller,
-                          struct Curl_easy *data)
-{
-  if(baller && baller->cf) {
-    Curl_conn_cf_discard_chain(&baller->cf, data);
-  }
-}
-
-static void baller_free(struct eyeballer *baller,
-                         struct Curl_easy *data)
-{
-  if(baller) {
-    baller_close(baller, data);
-    free(baller);
-  }
-}
-
-static void baller_next_addr(struct eyeballer *baller)
-{
-  baller->addr = addr_next_match(baller->addr, baller->ai_family);
-}
-
-/*
- * Initiate a connect attempt walk.
- *
- * Note that even on connect fail it returns CURLE_OK, but with 'sock' set to
- * CURL_SOCKET_BAD. Other errors will however return proper errors.
- */
-static void baller_initiate(struct Curl_cfilter *cf,
-                            struct Curl_easy *data,
-                            struct eyeballer *baller)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-  struct Curl_cfilter *cf_prev = baller->cf;
-  struct Curl_cfilter *wcf;
-  CURLcode result;
-
-
-  /* Don't close a previous cfilter yet to ensure that the next IP's
-     socket gets a different file descriptor, which can prevent bugs when
-     the curl_multi_socket_action interface is used with certain select()
-     replacements such as kqueue. */
-  result = baller->cf_create(&baller->cf, data, cf->conn, baller->addr,
-                             ctx->transport);
-  if(result)
-    goto out;
-
-  /* the new filter might have sub-filters */
-  for(wcf = baller->cf; wcf; wcf = wcf->next) {
-    wcf->conn = cf->conn;
-    wcf->sockindex = cf->sockindex;
-  }
-
-  if(addr_next_match(baller->addr, baller->ai_family)) {
-    Curl_expire(data, baller->timeoutms, baller->timeout_id);
-  }
-
-out:
-  if(result) {
-    CURL_TRC_CF(data, cf, "%s failed", baller->name);
-    baller_close(baller, data);
-  }
-  if(cf_prev)
-    Curl_conn_cf_discard_chain(&cf_prev, data);
-  baller->result = result;
-}
-
-/**
- * Start a connection attempt on the current baller address.
- * Will return CURLE_OK on the first address where a socket
- * could be created and the non-blocking connect started.
- * Returns error when all remaining addresses have been tried.
- */
-static CURLcode baller_start(struct Curl_cfilter *cf,
-                             struct Curl_easy *data,
-                             struct eyeballer *baller,
-                             timediff_t timeoutms)
-{
-  baller->error = 0;
-  baller->connected = FALSE;
-  baller->has_started = TRUE;
-
-  while(baller->addr) {
-    baller->started = Curl_now();
-    baller->timeoutms = addr_next_match(baller->addr, baller->ai_family) ?
-      USETIME(timeoutms) : timeoutms;
-    baller_initiate(cf, data, baller);
-    if(!baller->result)
-      break;
-    baller_next_addr(baller);
-  }
-  if(!baller->addr) {
-    baller->is_done = TRUE;
-  }
-  return baller->result;
-}
-
-
-/* Used within the multi interface. Try next IP address, returns error if no
-   more address exists or error */
-static CURLcode baller_start_next(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  struct eyeballer *baller,
-                                  timediff_t timeoutms)
-{
-  if(cf->sockindex == FIRSTSOCKET) {
-    baller_next_addr(baller);
-    baller_start(cf, data, baller, timeoutms);
-  }
-  else {
-    baller->error = 0;
-    baller->connected = FALSE;
-    baller->has_started = TRUE;
-    baller->is_done = TRUE;
-    baller->result = CURLE_COULDNT_CONNECT;
-  }
-  return baller->result;
-}
-
-static CURLcode baller_connect(struct Curl_cfilter *cf,
-                               struct Curl_easy *data,
-                               struct eyeballer *baller,
-                               struct curltime *now,
-                               bool *connected)
-{
-  (void)cf;
-  *connected = baller->connected;
-  if(!baller->result &&  !*connected) {
-    /* evaluate again */
-    baller->result = Curl_conn_cf_connect(baller->cf, data, 0, connected);
-
-    if(!baller->result) {
-      if(*connected) {
-        baller->connected = TRUE;
-        baller->is_done = TRUE;
-      }
-      else if(Curl_timediff(*now, baller->started) >= baller->timeoutms) {
-        infof(data, "%s connect timeout after %" CURL_FORMAT_TIMEDIFF_T
-              "ms, move on!", baller->name, baller->timeoutms);
-#if defined(ETIMEDOUT)
-        baller->error = ETIMEDOUT;
-#endif
-        baller->result = CURLE_OPERATION_TIMEDOUT;
-      }
-    }
-  }
-  return baller->result;
-}
-
-/*
- * is_connected() checks if the socket has connected.
- */
-static CURLcode is_connected(struct Curl_cfilter *cf,
-                             struct Curl_easy *data,
-                             bool *connected)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-  struct connectdata *conn = cf->conn;
-  CURLcode result;
-  struct curltime now;
-  size_t i;
-  int ongoing, not_started;
-  const char *hostname;
-
-  /* Check if any of the conn->tempsock we use for establishing connections
-   * succeeded and, if so, close any ongoing other ones.
-   * Transfer the successful conn->tempsock to conn->sock[sockindex]
-   * and set conn->tempsock to CURL_SOCKET_BAD.
-   * If transport is QUIC, we need to shutdown the ongoing 'other'
-   * cot ballers in a QUIC appropriate way. */
-evaluate:
-  *connected = FALSE; /* a very negative world view is best */
-  now = Curl_now();
-  ongoing = not_started = 0;
-  for(i = 0; i < sizeof(ctx->baller)/sizeof(ctx->baller[0]); i++) {
-    struct eyeballer *baller = ctx->baller[i];
-
-    if(!baller || baller->is_done)
-      continue;
-
-    if(!baller->has_started) {
-      ++not_started;
-      continue;
-    }
-    baller->result = baller_connect(cf, data, baller, &now, connected);
-    CURL_TRC_CF(data, cf, "%s connect -> %d, connected=%d",
-                baller->name, baller->result, *connected);
-
-    if(!baller->result) {
-      if(*connected) {
-        /* connected, declare the winner */
-        ctx->winner = baller;
-        ctx->baller[i] = NULL;
-        break;
-      }
-      else { /* still waiting */
-        ++ongoing;
-      }
-    }
-    else if(!baller->is_done) {
-      /* The baller failed to connect, start its next attempt */
-      if(baller->error) {
-        data->state.os_errno = baller->error;
-        SET_SOCKERRNO(baller->error);
-      }
-      baller_start_next(cf, data, baller, Curl_timeleft(data, &now, TRUE));
-      if(baller->is_done) {
-        CURL_TRC_CF(data, cf, "%s done", baller->name);
-      }
-      else {
-        /* next attempt was started */
-        CURL_TRC_CF(data, cf, "%s trying next", baller->name);
-        ++ongoing;
-      }
-    }
-  }
-
-  if(ctx->winner) {
-    *connected = TRUE;
-    return CURLE_OK;
-  }
-
-  /* Nothing connected, check the time before we might
-   * start new ballers or return ok. */
-  if((ongoing || not_started) && Curl_timeleft(data, &now, TRUE) < 0) {
-    failf(data, "Connection timeout after %ld ms",
-          Curl_timediff(now, data->progress.t_startsingle));
-    return CURLE_OPERATION_TIMEDOUT;
-  }
-
-  /* Check if we have any waiting ballers to start now. */
-  if(not_started > 0) {
-    int added = 0;
-
-    for(i = 0; i < sizeof(ctx->baller)/sizeof(ctx->baller[0]); i++) {
-      struct eyeballer *baller = ctx->baller[i];
-
-      if(!baller || baller->has_started)
-        continue;
-      /* We start its primary baller has failed to connect or if
-       * its start delay_ms have expired */
-      if((baller->primary && baller->primary->is_done) ||
-          Curl_timediff(now, ctx->started) >= baller->delay_ms) {
-        baller_start(cf, data, baller, Curl_timeleft(data, &now, TRUE));
-        if(baller->is_done) {
-          CURL_TRC_CF(data, cf, "%s done", baller->name);
-        }
-        else {
-          CURL_TRC_CF(data, cf, "%s starting (timeout=%"
-                      CURL_FORMAT_TIMEDIFF_T "ms)",
-                      baller->name, baller->timeoutms);
-          ++ongoing;
-          ++added;
-        }
-      }
-    }
-    if(added > 0)
-      goto evaluate;
-  }
-
-  if(ongoing > 0) {
-    /* We are still trying, return for more waiting */
-    *connected = FALSE;
-    return CURLE_OK;
-  }
-
-  /* all ballers have failed to connect. */
-  CURL_TRC_CF(data, cf, "all eyeballers failed");
-  result = CURLE_COULDNT_CONNECT;
-  for(i = 0; i < sizeof(ctx->baller)/sizeof(ctx->baller[0]); i++) {
-    struct eyeballer *baller = ctx->baller[i];
-    CURL_TRC_CF(data, cf, "%s assess started=%d, result=%d",
-                baller?baller->name:NULL,
-                baller?baller->has_started:0,
-                baller?baller->result:0);
-    if(baller && baller->has_started && baller->result) {
-      result = baller->result;
-      break;
-    }
-  }
-
-#ifndef CURL_DISABLE_PROXY
-  if(conn->bits.socksproxy)
-    hostname = conn->socks_proxy.host.name;
-  else if(conn->bits.httpproxy)
-    hostname = conn->http_proxy.host.name;
-  else
-#endif
-    if(conn->bits.conn_to_host)
-      hostname = conn->conn_to_host.name;
-  else
-    hostname = conn->host.name;
-
-  failf(data, "Failed to connect to %s port %u after "
-        "%" CURL_FORMAT_TIMEDIFF_T " ms: %s",
-        hostname, conn->port,
-        Curl_timediff(now, data->progress.t_startsingle),
-        curl_easy_strerror(result));
-
-#ifdef WSAETIMEDOUT
-  if(WSAETIMEDOUT == data->state.os_errno)
-    result = CURLE_OPERATION_TIMEDOUT;
-#elif defined(ETIMEDOUT)
-  if(ETIMEDOUT == data->state.os_errno)
-    result = CURLE_OPERATION_TIMEDOUT;
-#endif
-
-  return result;
-}
-
-/*
- * Connect to the given host with timeout, proxy or remote doesn't matter.
- * There might be more than one IP address to try out.
- */
-static CURLcode start_connect(struct Curl_cfilter *cf,
-                              struct Curl_easy *data,
-                              const struct Curl_dns_entry *remotehost)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-  struct connectdata *conn = cf->conn;
-  CURLcode result = CURLE_COULDNT_CONNECT;
-  int ai_family0, ai_family1;
-  timediff_t timeout_ms = Curl_timeleft(data, NULL, TRUE);
-  const struct Curl_addrinfo *addr0, *addr1;
-
-  if(timeout_ms < 0) {
-    /* a precaution, no need to continue if time already is up */
-    failf(data, "Connection time-out");
-    return CURLE_OPERATION_TIMEDOUT;
-  }
-
-  ctx->started = Curl_now();
-
-  /* remotehost->addr is the list of addresses from the resolver, each
-   * with an address family. The list has at least one entry, possibly
-   * many more.
-   * We try at most 2 at a time, until we either get a connection or
-   * run out of addresses to try. Since likelihood of success is tied
-   * to the address family (e.g. IPV6 might not work at all ), we want
-   * the 2 connect attempt ballers to try different families, if possible.
-   *
-   */
-  if(conn->ip_version == CURL_IPRESOLVE_WHATEVER) {
-    /* any IP version is allowed */
-    ai_family0 = remotehost->addr?
-      remotehost->addr->ai_family : 0;
-#ifdef ENABLE_IPV6
-    ai_family1 = ai_family0 == AF_INET6 ?
-      AF_INET : AF_INET6;
-#else
-    ai_family1 = AF_UNSPEC;
-#endif
-  }
-  else {
-    /* only one IP version is allowed */
-    ai_family0 = (conn->ip_version == CURL_IPRESOLVE_V4) ?
-      AF_INET :
-#ifdef ENABLE_IPV6
-      AF_INET6;
-#else
-      AF_UNSPEC;
-#endif
-    ai_family1 = AF_UNSPEC;
-  }
-
-  /* Get the first address in the list that matches the family,
-   * this might give NULL, if we do not have any matches. */
-  addr0 = addr_first_match(remotehost->addr, ai_family0);
-  addr1 = addr_first_match(remotehost->addr, ai_family1);
-  if(!addr0 && addr1) {
-    /* switch around, so a single baller always uses addr0 */
-    addr0 = addr1;
-    ai_family0 = ai_family1;
-    addr1 = NULL;
-  }
-
-  /* We found no address that matches our criteria, we cannot connect */
-  if(!addr0) {
-    return CURLE_COULDNT_CONNECT;
-  }
-
-  memset(ctx->baller, 0, sizeof(ctx->baller));
-  result = eyeballer_new(&ctx->baller[0], ctx->cf_create, addr0, ai_family0,
-                          NULL, 0, /* no primary/delay, start now */
-                          timeout_ms,  EXPIRE_DNS_PER_NAME);
-  if(result)
-    return result;
-  CURL_TRC_CF(data, cf, "created %s (timeout %"
-              CURL_FORMAT_TIMEDIFF_T "ms)",
-              ctx->baller[0]->name, ctx->baller[0]->timeoutms);
-  if(addr1) {
-    /* second one gets a delayed start */
-    result = eyeballer_new(&ctx->baller[1], ctx->cf_create, addr1, ai_family1,
-                            ctx->baller[0], /* wait on that to fail */
-                            /* or start this delayed */
-                            data->set.happy_eyeballs_timeout,
-                            timeout_ms,  EXPIRE_DNS_PER_NAME2);
-    if(result)
-      return result;
-    CURL_TRC_CF(data, cf, "created %s (timeout %"
-                CURL_FORMAT_TIMEDIFF_T "ms)",
-                ctx->baller[1]->name, ctx->baller[1]->timeoutms);
-  }
-
-  Curl_expire(data, data->set.happy_eyeballs_timeout,
-              EXPIRE_HAPPY_EYEBALLS);
-
-  return CURLE_OK;
-}
-
-static void cf_he_ctx_clear(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-  size_t i;
-
-  DEBUGASSERT(ctx);
-  DEBUGASSERT(data);
-  for(i = 0; i < sizeof(ctx->baller)/sizeof(ctx->baller[0]); i++) {
-    baller_free(ctx->baller[i], data);
-    ctx->baller[i] = NULL;
-  }
-  baller_free(ctx->winner, data);
-  ctx->winner = NULL;
-}
-
-static int cf_he_get_select_socks(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  curl_socket_t *socks)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-  size_t i, s;
-  int wrc, rc = GETSOCK_BLANK;
-  curl_socket_t wsocks[MAX_SOCKSPEREASYHANDLE];
-
-  if(cf->connected)
-    return cf->next->cft->get_select_socks(cf->next, data, socks);
-
-  for(i = s = 0; i < sizeof(ctx->baller)/sizeof(ctx->baller[0]); i++) {
-    struct eyeballer *baller = ctx->baller[i];
-    if(!baller || !baller->cf)
-      continue;
-
-    wrc = Curl_conn_cf_get_select_socks(baller->cf, data, wsocks);
-    if(wrc) {
-      /* TODO: we assume we get at most one socket back */
-      socks[s] = wsocks[0];
-      if(wrc & GETSOCK_WRITESOCK(0))
-        rc |= GETSOCK_WRITESOCK(s);
-      if(wrc & GETSOCK_READSOCK(0))
-        rc |= GETSOCK_READSOCK(s);
-      s++;
-    }
-  }
-  return rc;
-}
-
-static CURLcode cf_he_connect(struct Curl_cfilter *cf,
-                              struct Curl_easy *data,
-                              bool blocking, bool *done)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-  CURLcode result = CURLE_OK;
-
-  if(cf->connected) {
-    *done = TRUE;
-    return CURLE_OK;
-  }
-
-  (void)blocking; /* TODO: do we want to support this? */
-  DEBUGASSERT(ctx);
-  *done = FALSE;
-
-  switch(ctx->state) {
-    case SCFST_INIT:
-      DEBUGASSERT(CURL_SOCKET_BAD == Curl_conn_cf_get_socket(cf, data));
-      DEBUGASSERT(!cf->connected);
-      result = start_connect(cf, data, ctx->remotehost);
-      if(result)
-        return result;
-      ctx->state = SCFST_WAITING;
-      /* FALLTHROUGH */
-    case SCFST_WAITING:
-      result = is_connected(cf, data, done);
-      if(!result && *done) {
-        DEBUGASSERT(ctx->winner);
-        DEBUGASSERT(ctx->winner->cf);
-        DEBUGASSERT(ctx->winner->cf->connected);
-        /* we have a winner. Install and activate it.
-         * close/free all others. */
-        ctx->state = SCFST_DONE;
-        cf->connected = TRUE;
-        cf->next = ctx->winner->cf;
-        ctx->winner->cf = NULL;
-        cf_he_ctx_clear(cf, data);
-        Curl_conn_cf_cntrl(cf->next, data, TRUE,
-                           CF_CTRL_CONN_INFO_UPDATE, 0, NULL);
-
-        if(cf->conn->handler->protocol & PROTO_FAMILY_SSH)
-          Curl_pgrsTime(data, TIMER_APPCONNECT); /* we're connected already */
-        Curl_verboseconnect(data, cf->conn);
-        data->info.numconnects++; /* to track the # of connections made */
-      }
-      break;
-    case SCFST_DONE:
-      *done = TRUE;
-      break;
-  }
-  return result;
-}
-
-static void cf_he_close(struct Curl_cfilter *cf,
-                        struct Curl_easy *data)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-
-  CURL_TRC_CF(data, cf, "close");
-  cf_he_ctx_clear(cf, data);
-  cf->connected = FALSE;
-  ctx->state = SCFST_INIT;
-
-  if(cf->next) {
-    cf->next->cft->do_close(cf->next, data);
-    Curl_conn_cf_discard_chain(&cf->next, data);
-  }
-}
-
-static bool cf_he_data_pending(struct Curl_cfilter *cf,
-                               const struct Curl_easy *data)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-  size_t i;
-
-  if(cf->connected)
-    return cf->next->cft->has_data_pending(cf->next, data);
-
-  for(i = 0; i < sizeof(ctx->baller)/sizeof(ctx->baller[0]); i++) {
-    struct eyeballer *baller = ctx->baller[i];
-    if(!baller || !baller->cf)
-      continue;
-    if(baller->cf->cft->has_data_pending(baller->cf, data))
-      return TRUE;
-  }
-  return FALSE;
-}
-
-static struct curltime get_max_baller_time(struct Curl_cfilter *cf,
-                                          struct Curl_easy *data,
-                                          int query)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-  struct curltime t, tmax;
-  size_t i;
-
-  memset(&tmax, 0, sizeof(tmax));
-  for(i = 0; i < sizeof(ctx->baller)/sizeof(ctx->baller[0]); i++) {
-    struct eyeballer *baller = ctx->baller[i];
-
-    memset(&t, 0, sizeof(t));
-    if(baller && baller->cf &&
-       !baller->cf->cft->query(baller->cf, data, query, NULL, &t)) {
-      if((t.tv_sec || t.tv_usec) && Curl_timediff_us(t, tmax) > 0)
-        tmax = t;
-    }
-  }
-  return tmax;
-}
-
-static CURLcode cf_he_query(struct Curl_cfilter *cf,
-                            struct Curl_easy *data,
-                            int query, int *pres1, void *pres2)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-
-  if(!cf->connected) {
-    switch(query) {
-    case CF_QUERY_CONNECT_REPLY_MS: {
-      int reply_ms = -1;
-      size_t i;
-
-      for(i = 0; i < sizeof(ctx->baller)/sizeof(ctx->baller[0]); i++) {
-        struct eyeballer *baller = ctx->baller[i];
-        int breply_ms;
-
-        if(baller && baller->cf &&
-           !baller->cf->cft->query(baller->cf, data, query,
-                                   &breply_ms, NULL)) {
-          if(breply_ms >= 0 && (reply_ms < 0 || breply_ms < reply_ms))
-            reply_ms = breply_ms;
-        }
-      }
-      *pres1 = reply_ms;
-      CURL_TRC_CF(data, cf, "query connect reply: %dms", *pres1);
-      return CURLE_OK;
-    }
-    case CF_QUERY_TIMER_CONNECT: {
-      struct curltime *when = pres2;
-      *when = get_max_baller_time(cf, data, CF_QUERY_TIMER_CONNECT);
-      return CURLE_OK;
-    }
-    case CF_QUERY_TIMER_APPCONNECT: {
-      struct curltime *when = pres2;
-      *when = get_max_baller_time(cf, data, CF_QUERY_TIMER_APPCONNECT);
-      return CURLE_OK;
-    }
-    default:
-      break;
-    }
-  }
-
-  return cf->next?
-    cf->next->cft->query(cf->next, data, query, pres1, pres2) :
-    CURLE_UNKNOWN_OPTION;
-}
-
-static void cf_he_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-
-  CURL_TRC_CF(data, cf, "destroy");
-  if(ctx) {
-    cf_he_ctx_clear(cf, data);
-  }
-  /* release any resources held in state */
-  Curl_safefree(ctx);
-}
-
-struct Curl_cftype Curl_cft_happy_eyeballs = {
-  "HAPPY-EYEBALLS",
-  0,
-  CURL_LOG_LVL_NONE,
-  cf_he_destroy,
-  cf_he_connect,
-  cf_he_close,
-  Curl_cf_def_get_host,
-  cf_he_get_select_socks,
-  cf_he_data_pending,
-  Curl_cf_def_send,
-  Curl_cf_def_recv,
-  Curl_cf_def_cntrl,
-  Curl_cf_def_conn_is_alive,
-  Curl_cf_def_conn_keep_alive,
-  cf_he_query,
-};
-
-/**
- * Create a happy eyeball connection filter that uses the, once resolved,
- * address information to connect on ip families based on connection
- * configuration.
- * @param pcf        output, the created cfilter
- * @param data       easy handle used in creation
- * @param conn       connection the filter is created for
- * @param cf_create  method to create the sub-filters performing the
- *                   actual connects.
- */
-static CURLcode
-cf_happy_eyeballs_create(struct Curl_cfilter **pcf,
-                         struct Curl_easy *data,
-                         struct connectdata *conn,
-                         cf_ip_connect_create *cf_create,
-                         const struct Curl_dns_entry *remotehost,
-                         int transport)
-{
-  struct cf_he_ctx *ctx = NULL;
-  CURLcode result;
-
-  (void)data;
-  (void)conn;
-  *pcf = NULL;
-  ctx = calloc(sizeof(*ctx), 1);
-  if(!ctx) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto out;
-  }
-  ctx->transport = transport;
-  ctx->cf_create = cf_create;
-  ctx->remotehost = remotehost;
-
-  result = Curl_cf_create(pcf, &Curl_cft_happy_eyeballs, ctx);
-
-out:
-  if(result) {
-    Curl_safefree(*pcf);
-    Curl_safefree(ctx);
-  }
-  return result;
-}
-
-struct transport_provider {
-  int transport;
-  cf_ip_connect_create *cf_create;
-};
-
-static
-#ifndef DEBUGBUILD
-const
-#endif
-struct transport_provider transport_providers[] = {
-  { TRNSPRT_TCP, Curl_cf_tcp_create },
-#ifdef ENABLE_QUIC
-  { TRNSPRT_QUIC, Curl_cf_quic_create },
-#endif
-  { TRNSPRT_UDP, Curl_cf_udp_create },
-  { TRNSPRT_UNIX, Curl_cf_unix_create },
-};
-
-#ifndef ARRAYSIZE
-#define ARRAYSIZE(A) (sizeof(A)/sizeof((A)[0]))
-#endif
-
-static cf_ip_connect_create *get_cf_create(int transport)
-{
-  size_t i;
-  for(i = 0; i < ARRAYSIZE(transport_providers); ++i) {
-    if(transport == transport_providers[i].transport)
-      return transport_providers[i].cf_create;
-  }
-  return NULL;
-}
-
-static CURLcode cf_he_insert_after(struct Curl_cfilter *cf_at,
-                                   struct Curl_easy *data,
-                                   const struct Curl_dns_entry *remotehost,
-                                   int transport)
-{
-  cf_ip_connect_create *cf_create;
-  struct Curl_cfilter *cf;
-  CURLcode result;
-
-  /* Need to be first */
-  DEBUGASSERT(cf_at);
-  cf_create = get_cf_create(transport);
-  if(!cf_create) {
-    CURL_TRC_CF(data, cf_at, "unsupported transport type %d", transport);
-    return CURLE_UNSUPPORTED_PROTOCOL;
-  }
-  result = cf_happy_eyeballs_create(&cf, data, cf_at->conn,
-                                    cf_create, remotehost,
-                                    transport);
-  if(result)
-    return result;
-
-  Curl_conn_cf_insert_after(cf_at, cf);
-  return CURLE_OK;
-}
-
-typedef enum {
-  CF_SETUP_INIT,
-  CF_SETUP_CNNCT_EYEBALLS,
-  CF_SETUP_CNNCT_SOCKS,
-  CF_SETUP_CNNCT_HTTP_PROXY,
-  CF_SETUP_CNNCT_HAPROXY,
-  CF_SETUP_CNNCT_SSL,
-  CF_SETUP_DONE
-} cf_setup_state;
-
-struct cf_setup_ctx {
-  cf_setup_state state;
-  const struct Curl_dns_entry *remotehost;
-  int ssl_mode;
-  int transport;
-};
-
-static CURLcode cf_setup_connect(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data,
-                                 bool blocking, bool *done)
-{
-  struct cf_setup_ctx *ctx = cf->ctx;
-  CURLcode result = CURLE_OK;
-
-  if(cf->connected) {
-    *done = TRUE;
-    return CURLE_OK;
-  }
-
-  /* connect current sub-chain */
-connect_sub_chain:
-  if(cf->next && !cf->next->connected) {
-    result = Curl_conn_cf_connect(cf->next, data, blocking, done);
-    if(result || !*done)
-      return result;
-  }
-
-  if(ctx->state < CF_SETUP_CNNCT_EYEBALLS) {
-    result = cf_he_insert_after(cf, data, ctx->remotehost, ctx->transport);
-    if(result)
-      return result;
-    ctx->state = CF_SETUP_CNNCT_EYEBALLS;
-    if(!cf->next || !cf->next->connected)
-      goto connect_sub_chain;
-  }
-
-  /* sub-chain connected, do we need to add more? */
-#ifndef CURL_DISABLE_PROXY
-  if(ctx->state < CF_SETUP_CNNCT_SOCKS && cf->conn->bits.socksproxy) {
-    result = Curl_cf_socks_proxy_insert_after(cf, data);
-    if(result)
-      return result;
-    ctx->state = CF_SETUP_CNNCT_SOCKS;
-    if(!cf->next || !cf->next->connected)
-      goto connect_sub_chain;
-  }
-
-  if(ctx->state < CF_SETUP_CNNCT_HTTP_PROXY && cf->conn->bits.httpproxy) {
-#ifdef USE_SSL
-    if(IS_HTTPS_PROXY(cf->conn->http_proxy.proxytype)
-       && !Curl_conn_is_ssl(cf->conn, cf->sockindex)) {
-      result = Curl_cf_ssl_proxy_insert_after(cf, data);
-      if(result)
-        return result;
-    }
-#endif /* USE_SSL */
-
-#if !defined(CURL_DISABLE_HTTP)
-    if(cf->conn->bits.tunnel_proxy) {
-      result = Curl_cf_http_proxy_insert_after(cf, data);
-      if(result)
-        return result;
-    }
-#endif /* !CURL_DISABLE_HTTP */
-    ctx->state = CF_SETUP_CNNCT_HTTP_PROXY;
-    if(!cf->next || !cf->next->connected)
-      goto connect_sub_chain;
-  }
-#endif /* !CURL_DISABLE_PROXY */
-
-  if(ctx->state < CF_SETUP_CNNCT_HAPROXY) {
-#if !defined(CURL_DISABLE_PROXY)
-    if(data->set.haproxyprotocol) {
-      if(Curl_conn_is_ssl(cf->conn, cf->sockindex)) {
-        failf(data, "haproxy protocol not support with SSL "
-              "encryption in place (QUIC?)");
-        return CURLE_UNSUPPORTED_PROTOCOL;
-      }
-      result = Curl_cf_haproxy_insert_after(cf, data);
-      if(result)
-        return result;
-    }
-#endif /* !CURL_DISABLE_PROXY */
-    ctx->state = CF_SETUP_CNNCT_HAPROXY;
-    if(!cf->next || !cf->next->connected)
-      goto connect_sub_chain;
-  }
-
-  if(ctx->state < CF_SETUP_CNNCT_SSL) {
-#ifdef USE_SSL
-    if((ctx->ssl_mode == CURL_CF_SSL_ENABLE
-        || (ctx->ssl_mode != CURL_CF_SSL_DISABLE
-           && cf->conn->handler->flags & PROTOPT_SSL)) /* we want SSL */
-       && !Curl_conn_is_ssl(cf->conn, cf->sockindex)) { /* it is missing */
-      result = Curl_cf_ssl_insert_after(cf, data);
-      if(result)
-        return result;
-    }
-#endif /* USE_SSL */
-    ctx->state = CF_SETUP_CNNCT_SSL;
-    if(!cf->next || !cf->next->connected)
-      goto connect_sub_chain;
-  }
-
-  ctx->state = CF_SETUP_DONE;
-  cf->connected = TRUE;
-  *done = TRUE;
-  return CURLE_OK;
-}
-
-static void cf_setup_close(struct Curl_cfilter *cf,
-                           struct Curl_easy *data)
-{
-  struct cf_setup_ctx *ctx = cf->ctx;
-
-  CURL_TRC_CF(data, cf, "close");
-  cf->connected = FALSE;
-  ctx->state = CF_SETUP_INIT;
-
-  if(cf->next) {
-    cf->next->cft->do_close(cf->next, data);
-    Curl_conn_cf_discard_chain(&cf->next, data);
-  }
-}
-
-static void cf_setup_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_setup_ctx *ctx = cf->ctx;
-
-  (void)data;
-  CURL_TRC_CF(data, cf, "destroy");
-  Curl_safefree(ctx);
-}
-
-
-struct Curl_cftype Curl_cft_setup = {
-  "SETUP",
-  0,
-  CURL_LOG_LVL_NONE,
-  cf_setup_destroy,
-  cf_setup_connect,
-  cf_setup_close,
-  Curl_cf_def_get_host,
-  Curl_cf_def_get_select_socks,
-  Curl_cf_def_data_pending,
-  Curl_cf_def_send,
-  Curl_cf_def_recv,
-  Curl_cf_def_cntrl,
-  Curl_cf_def_conn_is_alive,
-  Curl_cf_def_conn_keep_alive,
-  Curl_cf_def_query,
-};
-
-static CURLcode cf_setup_create(struct Curl_cfilter **pcf,
-                                struct Curl_easy *data,
-                                const struct Curl_dns_entry *remotehost,
-                                int transport,
-                                int ssl_mode)
-{
-  struct Curl_cfilter *cf = NULL;
-  struct cf_setup_ctx *ctx;
-  CURLcode result = CURLE_OK;
-
-  (void)data;
-  ctx = calloc(sizeof(*ctx), 1);
-  if(!ctx) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto out;
-  }
-  ctx->state = CF_SETUP_INIT;
-  ctx->remotehost = remotehost;
-  ctx->ssl_mode = ssl_mode;
-  ctx->transport = transport;
-
-  result = Curl_cf_create(&cf, &Curl_cft_setup, ctx);
-  if(result)
-    goto out;
-  ctx = NULL;
-
-out:
-  *pcf = result? NULL : cf;
-  free(ctx);
-  return result;
-}
-
-static CURLcode cf_setup_add(struct Curl_easy *data,
-                             struct connectdata *conn,
-                             int sockindex,
-                             const struct Curl_dns_entry *remotehost,
-                             int transport,
-                             int ssl_mode)
-{
-  struct Curl_cfilter *cf;
-  CURLcode result = CURLE_OK;
-
-  DEBUGASSERT(data);
-  result = cf_setup_create(&cf, data, remotehost, transport, ssl_mode);
-  if(result)
-    goto out;
-  Curl_conn_cf_add(data, conn, sockindex, cf);
-out:
-  return result;
-}
-
-#ifdef DEBUGBUILD
-/* used by unit2600.c */
-void Curl_debug_set_transport_provider(int transport,
-                                       cf_ip_connect_create *cf_create)
-{
-  size_t i;
-  for(i = 0; i < ARRAYSIZE(transport_providers); ++i) {
-    if(transport == transport_providers[i].transport) {
-      transport_providers[i].cf_create = cf_create;
-      return;
-    }
-  }
-}
-#endif /* DEBUGBUILD */
-
-CURLcode Curl_cf_setup_insert_after(struct Curl_cfilter *cf_at,
-                                    struct Curl_easy *data,
-                                    const struct Curl_dns_entry *remotehost,
-                                    int transport,
-                                    int ssl_mode)
-{
-  struct Curl_cfilter *cf;
-  CURLcode result;
-
-  DEBUGASSERT(data);
-  result = cf_setup_create(&cf, data, remotehost, transport, ssl_mode);
-  if(result)
-    goto out;
-  Curl_conn_cf_insert_after(cf_at, cf);
-out:
-  return result;
-}
-
 CURLcode Curl_conn_setup(struct Curl_easy *data,
                          struct connectdata *conn,
                          int sockindex,
-                         const struct Curl_dns_entry *remotehost,
                          int ssl_mode)
 {
   CURLcode result = CURLE_OK;
+  struct Curl_peer *peer = Curl_conn_get_first_peer(conn, sockindex);
+  uint8_t dns_queries;
 
   DEBUGASSERT(data);
-  DEBUGASSERT(conn->handler);
+  DEBUGASSERT(conn->scheme);
+  DEBUGASSERT(!conn->cfilter[sockindex]);
 
-#if !defined(CURL_DISABLE_HTTP) && !defined(USE_HYPER)
+  if(!peer)
+    return CURLE_FAILED_INIT;
+
+#ifndef CURL_DISABLE_HTTP
   if(!conn->cfilter[sockindex] &&
-     conn->handler->protocol == CURLPROTO_HTTPS) {
+     conn->scheme->protocol == CURLPROTO_HTTPS) {
     DEBUGASSERT(ssl_mode != CURL_CF_SSL_DISABLE);
-    result = Curl_cf_https_setup(data, conn, sockindex, remotehost);
+    result = Curl_cf_https_setup(data, conn, sockindex);
     if(result)
       goto out;
   }
-#endif /* !defined(CURL_DISABLE_HTTP) && !defined(USE_HYPER) */
+#endif /* !CURL_DISABLE_HTTP */
 
   /* Still no cfilter set, apply default. */
   if(!conn->cfilter[sockindex]) {
-    result = cf_setup_add(data, conn, sockindex, remotehost,
-                          conn->transport, ssl_mode);
+    result = Curl_cf_setup_add(data, conn, sockindex,
+                               conn->transport_wanted, ssl_mode);
     if(result)
       goto out;
   }
 
+  dns_queries = Curl_resolv_dns_queries(data, conn->ip_version);
+#ifdef USE_HTTPSRR
+  if(sockindex == FIRSTSOCKET)
+    dns_queries |= CURL_DNSQ_HTTPS;
+#endif
+  result = Curl_cf_dns_add(data, conn, sockindex, peer, dns_queries,
+                           conn->transport_wanted);
   DEBUGASSERT(conn->cfilter[sockindex]);
 out:
   return result;
 }
+
+#ifdef CURLVERBOSE
+static CURLcode conn_connect_trace(struct Curl_easy *data,
+                                   struct Curl_cfilter *cf)
+{
+  if(Curl_trc_is_verbose(data)) {
+    struct ip_quadruple ipquad;
+    bool is_ipv6;
+    CURLcode result;
+
+    result = Curl_conn_cf_get_ip_info(cf, data, &is_ipv6, &ipquad);
+    if(result)
+      return result;
+
+    infof(data, "Established %sconnection to %s (%s port %u) from %s port %u ",
+          (cf->sockindex == SECONDARYSOCKET) ? "2nd " : "",
+          CURL_CONN_HOST_DISPNAME(data->conn),
+          ipquad.remote_ip, ipquad.remote_port,
+          ipquad.local_ip, ipquad.local_port);
+  }
+  return CURLE_OK;
+}
+#endif
+
+/**
+ * Update connection statistics
+ */
+static void conn_report_connect_stats(struct Curl_cfilter *cf,
+                                      struct Curl_easy *data)
+{
+  if(cf) {
+    struct curltime connected;
+    struct curltime appconnected;
+
+    memset(&connected, 0, sizeof(connected));
+    cf->cft->query(cf, data, CF_QUERY_TIMER_CONNECT, NULL, &connected);
+    if(connected.tv_sec || connected.tv_usec)
+      Curl_pgrsTimeWas(data, TIMER_CONNECT, connected);
+
+    memset(&appconnected, 0, sizeof(appconnected));
+    cf->cft->query(cf, data, CF_QUERY_TIMER_APPCONNECT, NULL, &appconnected);
+    if(appconnected.tv_sec || appconnected.tv_usec)
+      Curl_pgrsTimeWas(data, TIMER_APPCONNECT, appconnected);
+  }
+}
+
+CURLcode Curl_conn_connect(struct Curl_easy *data,
+                           int sockindex,
+                           bool blocking,
+                           bool *done)
+{
+#define CF_CONN_NUM_POLLS_ON_STACK 5
+  struct pollfd a_few_on_stack[CF_CONN_NUM_POLLS_ON_STACK];
+  struct easy_pollset ps;
+  struct curl_pollfds cpfds;
+  struct Curl_cfilter *cf;
+  CURLcode result = CURLE_OK;
+
+  DEBUGASSERT(data);
+  DEBUGASSERT(data->conn);
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  if(data->conn->scheme->flags & PROTOPT_NONETWORK) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  cf = data->conn->cfilter[sockindex];
+  if(!cf) {
+    *done = FALSE;
+    return CURLE_FAILED_INIT;
+  }
+
+  *done = (bool)cf->connected;
+  if(*done)
+    return CURLE_OK;
+
+  Curl_pollset_init(&ps);
+  Curl_pollfds_init(&cpfds, a_few_on_stack, CF_CONN_NUM_POLLS_ON_STACK);
+  while(!*done) {
+    if(Curl_conn_needs_flush(data, sockindex)) {
+      DEBUGF(infof(data, "Curl_conn_connect(index=%d), flush", sockindex));
+      result = Curl_conn_flush(data, sockindex);
+      if(result && (result != CURLE_AGAIN))
+        goto out;
+    }
+
+    result = cf->cft->do_connect(cf, data, done);
+    CURL_TRC_CF(data, cf, "Curl_conn_connect(block=%d) -> %d, done=%d",
+                blocking, (int)result, *done);
+    if(!result && *done) {
+      /* A final sanity check on connection security */
+      if((data->state.origin->scheme->flags & PROTOPT_SSL) &&
+         (sockindex == FIRSTSOCKET) &&
+         !Curl_conn_is_ssl(data->conn, FIRSTSOCKET)) {
+        DEBUGASSERT(0);
+        failf(data, "transfer requires SSL, but not connected via SSL");
+        result = CURLE_FAILED_INIT;
+        goto out;
+      }
+      /* Now that the complete filter chain is connected, let all filters
+       * persist information at the connection. E.g. cf-socket sets the
+       * socket and ip related information. */
+      Curl_conn_cntrl_update_info(data, data->conn);
+      conn_report_connect_stats(cf, data);
+      data->conn->keepalive = *Curl_pgrs_now(data);
+      VERBOSE(result = conn_connect_trace(data, cf));
+      VERBOSE(Curl_conn_trc_filters(data, sockindex, "connected"));
+      Curl_conn_remove_setup_filters(data, sockindex);
+      VERBOSE(Curl_conn_trc_filters(data, sockindex, "reduced to"));
+      goto out;
+    }
+    else if(result) {
+      CURL_TRC_CF(data, cf, "Curl_conn_connect(), filter returned %d",
+                  (int)result);
+      VERBOSE(Curl_conn_trc_filters(data, sockindex, "failed to connect"));
+      conn_report_connect_stats(cf, data);
+      goto out;
+    }
+
+    if(!blocking)
+      goto out;
+    else {
+      /* check allowed time left */
+      const timediff_t timeout_ms = Curl_timeleft_ms(data);
+      curl_socket_t sockfd = Curl_conn_cf_get_socket(cf, data);
+      int rc;
+
+      if(timeout_ms < 0) {
+        /* no need to continue if time already is up */
+        failf(data, "connect timeout");
+        result = CURLE_OPERATION_TIMEDOUT;
+        goto out;
+      }
+
+      CURL_TRC_CF(data, cf, "Curl_conn_connect(block=1), do poll");
+      Curl_pollset_reset(&ps);
+      Curl_pollfds_reset(&cpfds);
+      /* In general, we want to send after connect, wait on that. */
+      if(sockfd != CURL_SOCKET_BAD)
+        result = Curl_pollset_set_out_only(data, &ps, sockfd);
+      if(!result)
+        result = Curl_conn_adjust_pollset(data, data->conn, &ps);
+      if(result)
+        goto out;
+      result = Curl_pollfds_add_ps(&cpfds, &ps);
+      if(result)
+        goto out;
+
+      rc = Curl_poll(cpfds.pfds, cpfds.n,
+                     CURLMIN(timeout_ms, (cpfds.n ? 1000 : 10)));
+      CURL_TRC_CF(data, cf, "Curl_conn_connect(block=1), Curl_poll() -> %d",
+                  rc);
+      if(rc < 0) {
+        result = CURLE_COULDNT_CONNECT;
+        goto out;
+      }
+      /* continue iterating */
+    }
+  }
+
+out:
+  Curl_pollset_cleanup(&ps);
+  Curl_pollfds_cleanup(&cpfds);
+  return result;
+}
+
+void Curl_conn_set_multiplex(struct connectdata *conn)
+{
+  if(!conn->bits.multiplex) {
+    conn->bits.multiplex = TRUE;
+    if(conn->attached_multi) {
+      Curl_multi_connchanged(conn->attached_multi);
+    }
+  }
+}
+
+struct Curl_peer *Curl_conn_get_origin(struct connectdata *conn,
+                                       int sockindex)
+{
+  return (sockindex == SECONDARYSOCKET) ?
+    conn->origin2 : conn->origin;
+}
+
+struct Curl_peer *Curl_conn_get_destination(struct connectdata *conn,
+                                            int sockindex)
+{
+  return (sockindex == SECONDARYSOCKET) ?
+    (conn->via_peer2 ? conn->via_peer2 : conn->origin2) :
+    (conn->via_peer ? conn->via_peer : conn->origin);
+}
+
+struct Curl_peer *Curl_conn_get_first_peer(struct connectdata *conn,
+                                           int sockindex)
+{
+#ifndef CURL_DISABLE_PROXY
+  if(conn->socks_proxy.peer)
+    return conn->socks_proxy.peer;
+  if(conn->http_proxy.peer)
+    return conn->http_proxy.peer;
+#endif
+  return (sockindex == SECONDARYSOCKET) ?
+    (conn->via_peer2 ? conn->via_peer2 : conn->origin2) :
+    (conn->via_peer ? conn->via_peer : conn->origin);
+}
diff --git a/third-party/curl/lib/connect.h b/third-party/curl/lib/connect.h
index 58264bdba4..95bde1eb4c 100644
--- a/third-party/curl/lib/connect.h
+++ b/third-party/curl/lib/connect.h
@@ -25,20 +25,42 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
-#include "nonblock.h" /* for curlx_nonblock(), formerly Curl_nonblock() */
-#include "sockaddr.h"
-#include "timeval.h"
+#include "hostip.h"
+#include "curlx/timeval.h"
 
-struct Curl_dns_entry;
+struct Curl_peer;
+struct Curl_str;
 
-/* generic function that returns how much time there's left to run, according
+enum alpnid Curl_alpn2alpnid(const unsigned char *name, size_t len);
+enum alpnid Curl_str2alpnid(const struct Curl_str *cstr);
+
+/* generic function that returns how much time there is left to run, according
    to the timeouts set */
-timediff_t Curl_timeleft(struct Curl_easy *data,
-                         struct curltime *nowp,
-                         bool duringconnect);
+timediff_t Curl_timeleft_ms(struct Curl_easy *data);
 
 #define DEFAULT_CONNECT_TIMEOUT 300000 /* milliseconds == five minutes */
 
+#define DEFAULT_SHUTDOWN_TIMEOUT_MS   (2 * 1000)
+
+void Curl_shutdown_start(struct Curl_easy *data, int sockindex,
+                         int timeout_ms);
+
+/* return how much time there is left to shutdown the connection at
+ * sockindex. Returns 0 if there is no limit or shutdown has not started. */
+timediff_t Curl_shutdown_timeleft(struct Curl_easy *data,
+                                  struct connectdata *conn,
+                                  int sockindex);
+
+/* return how much time there is left to shutdown the connection.
+ * Returns 0 if there is no limit or shutdown has not started. */
+timediff_t Curl_conn_shutdown_timeleft(struct Curl_easy *data,
+                                       struct connectdata *conn);
+
+void Curl_shutdown_clear(struct Curl_easy *data, int sockindex);
+
+/* TRUE iff shutdown has been started */
+bool Curl_shutdown_started(struct Curl_easy *data, int sockindex);
+
 /*
  * Used to extract socket and connectdata struct for the most recent
  * transfer on the given Curl_easy.
@@ -48,14 +70,8 @@ timediff_t Curl_timeleft(struct Curl_easy *data,
 curl_socket_t Curl_getconnectinfo(struct Curl_easy *data,
                                   struct connectdata **connp);
 
-bool Curl_addr2string(struct sockaddr *sa, curl_socklen_t salen,
-                      char *addr, int *port);
-
-void Curl_persistconninfo(struct Curl_easy *data, struct connectdata *conn,
-                          char *local_ip, int local_port);
-
 /*
- * Curl_conncontrol() marks the end of a connection/stream. The 'closeit'
+ * Curl_conncontrol() marks the end of a connection/stream. The 'ctrl'
  * argument specifies if it is the end of a connection or a stream.
  *
  * For stream-based protocols (such as HTTP/2), a stream close will not cause
@@ -66,67 +82,63 @@ void Curl_persistconninfo(struct Curl_easy *data, struct connectdata *conn,
  * when the connection will close.
  */
 
-#define CONNCTRL_KEEP 0 /* undo a marked closure */
+#define CONNCTRL_KEEP       0 /* undo a marked closure */
 #define CONNCTRL_CONNECTION 1
-#define CONNCTRL_STREAM 2
+#define CONNCTRL_STREAM     2
 
 void Curl_conncontrol(struct connectdata *conn,
-                      int closeit
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
+                      int ctrl
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
                       , const char *reason
 #endif
   );
 
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
-#define streamclose(x,y) Curl_conncontrol(x, CONNCTRL_STREAM, y)
-#define connclose(x,y) Curl_conncontrol(x, CONNCTRL_CONNECTION, y)
-#define connkeep(x,y) Curl_conncontrol(x, CONNCTRL_KEEP, y)
-#else /* if !DEBUGBUILD || CURL_DISABLE_VERBOSE_STRINGS */
-#define streamclose(x,y) Curl_conncontrol(x, CONNCTRL_STREAM)
-#define connclose(x,y) Curl_conncontrol(x, CONNCTRL_CONNECTION)
-#define connkeep(x,y) Curl_conncontrol(x, CONNCTRL_KEEP)
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
+#define streamclose(x, y) Curl_conncontrol(x, CONNCTRL_STREAM, y)
+#define connclose(x, y)   Curl_conncontrol(x, CONNCTRL_CONNECTION, y)
+#define connkeep(x, y)    Curl_conncontrol(x, CONNCTRL_KEEP, y)
+#else /* !DEBUGBUILD || !CURLVERBOSE */
+#define streamclose(x, y) Curl_conncontrol(x, CONNCTRL_STREAM)
+#define connclose(x, y)   Curl_conncontrol(x, CONNCTRL_CONNECTION)
+#define connkeep(x, y)    Curl_conncontrol(x, CONNCTRL_KEEP)
 #endif
 
-/**
- * Create a cfilter for making an "ip" connection to the
- * given address, using parameters from `conn`. The "ip" connection
- * can be a TCP socket, a UDP socket or even a QUIC connection.
- *
- * It MUST use only the supplied `ai` for its connection attempt.
- *
- * Such a filter may be used in "happy eyeball" scenarios, and its
- * `connect` implementation needs to support non-blocking. Once connected,
- * it MAY be installed in the connection filter chain to serve transfers.
- */
-typedef CURLcode cf_ip_connect_create(struct Curl_cfilter **pcf,
-                                      struct Curl_easy *data,
-                                      struct connectdata *conn,
-                                      const struct Curl_addrinfo *ai,
-                                      int transport);
-
-CURLcode Curl_cf_setup_insert_after(struct Curl_cfilter *cf_at,
-                                    struct Curl_easy *data,
-                                    const struct Curl_dns_entry *remotehost,
-                                    int transport,
-                                    int ssl_mode);
-
 /**
  * Setup the cfilters at `sockindex` in connection `conn`.
  * If no filter chain is installed yet, inspects the configuration
- * in `data` and `conn? to install a suitable filter chain.
+ * in `data` and `conn` to install a suitable filter chain.
  */
 CURLcode Curl_conn_setup(struct Curl_easy *data,
                          struct connectdata *conn,
                          int sockindex,
-                         const struct Curl_dns_entry *remotehost,
                          int ssl_mode);
 
-extern struct Curl_cftype Curl_cft_happy_eyeballs;
-extern struct Curl_cftype Curl_cft_setup;
+/**
+ * Bring the filter chain at `sockindex` for connection `data->conn` into
+ * connected state. Which will set `*done` to TRUE.
+ * This can be called on an already connected chain with no side effects.
+ * When not `blocking`, calls may return without error and `*done != TRUE`,
+ * while the individual filters negotiated the connection.
+ */
+CURLcode Curl_conn_connect(struct Curl_easy *data, int sockindex,
+                           bool blocking, bool *done);
 
-#ifdef DEBUGBUILD
-void Curl_debug_set_transport_provider(int transport,
-                                       cf_ip_connect_create *cf_create);
-#endif
+/* Set conn to allow multiplexing. */
+void Curl_conn_set_multiplex(struct connectdata *conn);
+
+/* Get the origin peer at sockindex. */
+struct Curl_peer *Curl_conn_get_origin(struct connectdata *conn,
+                                       int sockindex);
+
+/* Get the peer the connection actually connects to at sockindex.
+ * Often the same as "origin", but can be redirected via "connect-to"
+ * or "alt-svc". May tunnel through proxies. */
+struct Curl_peer *Curl_conn_get_destination(struct connectdata *conn,
+                                            int sockindex);
+
+/* Get the peer curl connects its socket to.
+ * Can be origin, "connect-to" or the first proxy. */
+struct Curl_peer *Curl_conn_get_first_peer(struct connectdata *conn,
+                                           int sockindex);
 
 #endif /* HEADER_CURL_CONNECT_H */
diff --git a/third-party/curl/lib/content_encoding.c b/third-party/curl/lib/content_encoding.c
index efbe7cb18d..fd08077259 100644
--- a/third-party/curl/lib/content_encoding.c
+++ b/third-party/curl/lib/content_encoding.c
@@ -21,25 +21,23 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #include "urldata.h"
-#include <curl/curl.h>
-#include <stddef.h>
+#include "curlx/dynbuf.h"
 
 #ifdef HAVE_LIBZ
 #include <zlib.h>
 #endif
 
 #ifdef HAVE_BROTLI
-#if defined(__GNUC__)
+#ifdef CURL_HAVE_DIAG
 /* Ignore -Wvla warnings in brotli headers */
 #pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Wvla"
 #endif
 #include <brotli/decode.h>
-#if defined(__GNUC__)
+#ifdef CURL_HAVE_DIAG
 #pragma GCC diagnostic pop
 #endif
 #endif
@@ -48,81 +46,62 @@
 #include <zstd.h>
 #endif
 
+#include "connect.h"
 #include "sendf.h"
-#include "http.h"
+#include "curl_trc.h"
 #include "content_encoding.h"
-#include "strdup.h"
-#include "strcase.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
 
 #define CONTENT_ENCODING_DEFAULT  "identity"
 
 #ifndef CURL_DISABLE_HTTP
 
-#define DSIZ CURL_MAX_WRITE_SIZE /* buffer size for decompressed data */
+/* allow no more than 5 "chained" compression steps */
+#define MAX_ENCODE_STACK 5
 
+#if defined(HAVE_LIBZ) || defined(HAVE_BROTLI) || defined(HAVE_ZSTD)
+#define DECOMPRESS_BUFFER_SIZE 16384 /* buffer size for decompressed data */
+#endif
 
 #ifdef HAVE_LIBZ
 
-/* Comment this out if zlib is always going to be at least ver. 1.2.0.4
-   (doing so will reduce code size slightly). */
-#define OLD_ZLIB_SUPPORT 1
-
-#define GZIP_MAGIC_0 0x1f
-#define GZIP_MAGIC_1 0x8b
-
-/* gzip flag byte */
-#define ASCII_FLAG   0x01 /* bit 0 set: file probably ascii text */
-#define HEAD_CRC     0x02 /* bit 1 set: header CRC present */
-#define EXTRA_FIELD  0x04 /* bit 2 set: extra field present */
-#define ORIG_NAME    0x08 /* bit 3 set: original file name present */
-#define COMMENT      0x10 /* bit 4 set: file comment present */
-#define RESERVED     0xE0 /* bits 5..7: reserved */
+#if !defined(ZLIB_VERNUM) || (ZLIB_VERNUM < 0x1252)
+#error "requires zlib 1.2.5.2 or newer"
+#endif
 
 typedef enum {
   ZLIB_UNINIT,               /* uninitialized */
   ZLIB_INIT,                 /* initialized */
   ZLIB_INFLATING,            /* inflating started. */
   ZLIB_EXTERNAL_TRAILER,     /* reading external trailer */
-  ZLIB_GZIP_HEADER,          /* reading gzip header */
-  ZLIB_GZIP_INFLATING,       /* inflating gzip stream */
   ZLIB_INIT_GZIP             /* initialized in transparent gzip mode */
 } zlibInitState;
 
 /* Deflate and gzip writer. */
 struct zlib_writer {
-  struct contenc_writer super;
+  struct Curl_cwriter super;
   zlibInitState zlib_init;   /* zlib init state */
+  char buffer[DECOMPRESS_BUFFER_SIZE]; /* Put the decompressed data here. */
   uInt trailerlen;           /* Remaining trailer byte count. */
   z_stream z;                /* State structure for zlib. */
 };
 
-
-static voidpf
-zalloc_cb(voidpf opaque, unsigned int items, unsigned int size)
+static voidpf zalloc_cb(voidpf opaque, unsigned int items, unsigned int size)
 {
-  (void) opaque;
-  /* not a typo, keep it calloc() */
-  return (voidpf) calloc(items, size);
+  (void)opaque;
+  /* not a typo, keep it curlx_calloc() */
+  return curlx_calloc(items, size);
 }
 
-static void
-zfree_cb(voidpf opaque, voidpf ptr)
+static void zfree_cb(voidpf opaque, voidpf ptr)
 {
-  (void) opaque;
-  free(ptr);
+  (void)opaque;
+  curlx_free(ptr);
 }
 
-static CURLcode
-process_zlib_error(struct Curl_easy *data, z_stream *z)
+static CURLcode process_zlib_error(struct Curl_easy *data, z_stream *z)
 {
   if(z->msg)
-    failf(data, "Error while processing content unencoding: %s",
-          z->msg);
+    failf(data, "Error while processing content unencoding: %s", z->msg);
   else
     failf(data, "Error while processing content unencoding: "
           "Unknown failure within decompression software.");
@@ -130,13 +109,9 @@ process_zlib_error(struct Curl_easy *data, z_stream *z)
   return CURLE_BAD_CONTENT_ENCODING;
 }
 
-static CURLcode
-exit_zlib(struct Curl_easy *data,
-          z_stream *z, zlibInitState *zlib_init, CURLcode result)
+static CURLcode exit_zlib(struct Curl_easy *data, z_stream *z,
+                          zlibInitState *zlib_init, CURLcode result)
 {
-  if(*zlib_init == ZLIB_GZIP_HEADER)
-    Curl_safefree(z->next_in);
-
   if(*zlib_init != ZLIB_UNINIT) {
     if(inflateEnd(z) != Z_OK && result == CURLE_OK)
       result = process_zlib_error(data, z);
@@ -146,12 +121,11 @@ exit_zlib(struct Curl_easy *data,
   return result;
 }
 
-static CURLcode process_trailer(struct Curl_easy *data,
-                                struct zlib_writer *zp)
+static CURLcode process_trailer(struct Curl_easy *data, struct zlib_writer *zp)
 {
   z_stream *z = &zp->z;
   CURLcode result = CURLE_OK;
-  uInt len = z->avail_in < zp->trailerlen? z->avail_in: zp->trailerlen;
+  uInt len = z->avail_in < zp->trailerlen ? z->avail_in : zp->trailerlen;
 
   /* Consume expected trailer bytes. Terminate stream if exhausted.
      Issue an error if unexpected bytes follow. */
@@ -171,54 +145,50 @@ static CURLcode process_trailer(struct Curl_easy *data,
 }
 
 static CURLcode inflate_stream(struct Curl_easy *data,
-                               struct contenc_writer *writer,
+                               struct Curl_cwriter *writer, int type,
                                zlibInitState started)
 {
-  struct zlib_writer *zp = (struct zlib_writer *) writer;
+  struct zlib_writer *zp = (struct zlib_writer *)writer;
   z_stream *z = &zp->z;         /* zlib state structure */
   uInt nread = z->avail_in;
-  Bytef *orig_in = z->next_in;
+  z_const Bytef *orig_in = z->next_in;
   bool done = FALSE;
   CURLcode result = CURLE_OK;   /* Curl_client_write status */
-  char *decomp;                 /* Put the decompressed data here. */
+  int i = 0;
 
   /* Check state. */
   if(zp->zlib_init != ZLIB_INIT &&
      zp->zlib_init != ZLIB_INFLATING &&
-     zp->zlib_init != ZLIB_INIT_GZIP &&
-     zp->zlib_init != ZLIB_GZIP_INFLATING)
+     zp->zlib_init != ZLIB_INIT_GZIP)
     return exit_zlib(data, z, &zp->zlib_init, CURLE_WRITE_ERROR);
 
-  /* Dynamically allocate a buffer for decompression because it's uncommonly
-     large to hold on the stack */
-  decomp = malloc(DSIZ);
-  if(!decomp)
-    return exit_zlib(data, z, &zp->zlib_init, CURLE_OUT_OF_MEMORY);
-
   /* because the buffer size is fixed, iteratively decompress and transfer to
-     the client via downstream_write function. */
+     the client via next_write function. */
   while(!done) {
-    int status;                   /* zlib status */
+    int status; /* zlib status */
     done = TRUE;
 
-    /* (re)set buffer for decompressed output for every iteration */
-    z->next_out = (Bytef *) decomp;
-    z->avail_out = DSIZ;
+    if(++i > (1024 * 1024 / DECOMPRESS_BUFFER_SIZE)) {
+      /* check every MB of output if we are not exceeding time limit */
+      i = 0;
+      if(Curl_timeleft_ms(data) < 0) {
+        failf(data, "Operation timed out while decoding payload");
+        return exit_zlib(data, z, &zp->zlib_init, CURLE_OPERATION_TIMEDOUT);
+      }
+    }
+
+    /* (re)set buffer for decompressed output for every iteration */
+    z->next_out = (Bytef *)zp->buffer;
+    z->avail_out = DECOMPRESS_BUFFER_SIZE;
 
-#ifdef Z_BLOCK
-    /* Z_BLOCK is only available in zlib ver. >= 1.2.0.5 */
     status = inflate(z, Z_BLOCK);
-#else
-    /* fallback for zlib ver. < 1.2.0.5 */
-    status = inflate(z, Z_SYNC_FLUSH);
-#endif
 
     /* Flush output data if some. */
-    if(z->avail_out != DSIZ) {
+    if(z->avail_out != DECOMPRESS_BUFFER_SIZE) {
       if(status == Z_OK || status == Z_STREAM_END) {
-        zp->zlib_init = started;      /* Data started. */
-        result = Curl_unencode_write(data, writer->downstream, decomp,
-                                     DSIZ - z->avail_out);
+        zp->zlib_init = started; /* Data started. */
+        result = Curl_cwriter_write(data, writer->next, type, zp->buffer,
+                                    DECOMPRESS_BUFFER_SIZE - z->avail_out);
         if(result) {
           exit_zlib(data, z, &zp->zlib_init, result);
           break;
@@ -233,7 +203,7 @@ static CURLcode inflate_stream(struct Curl_easy *data,
       done = FALSE;
       break;
     case Z_BUF_ERROR:
-      /* No more data to flush: just exit loop. */
+      /* No more data to flush: exit loop. */
       break;
     case Z_STREAM_END:
       result = process_trailer(data, zp);
@@ -242,9 +212,7 @@ static CURLcode inflate_stream(struct Curl_easy *data,
       /* some servers seem to not generate zlib headers, so this is an attempt
          to fix and continue anyway */
       if(zp->zlib_init == ZLIB_INIT) {
-        /* Do not use inflateReset2(): only available since zlib 1.2.3.4. */
-        (void) inflateEnd(z);     /* don't care about the return code */
-        if(inflateInit2(z, -MAX_WBITS) == Z_OK) {
+        if(inflateReset2(z, -MAX_WBITS) == Z_OK) {
           z->next_in = orig_in;
           z->avail_in = nread;
           zp->zlib_init = ZLIB_INFLATING;
@@ -252,7 +220,7 @@ static CURLcode inflate_stream(struct Curl_easy *data,
           done = FALSE;
           break;
         }
-        zp->zlib_init = ZLIB_UNINIT;    /* inflateEnd() already called. */
+        zp->zlib_init = ZLIB_UNINIT; /* inflateEnd() already called. */
       }
       result = exit_zlib(data, z, &zp->zlib_init, process_zlib_error(data, z));
       break;
@@ -261,31 +229,26 @@ static CURLcode inflate_stream(struct Curl_easy *data,
       break;
     }
   }
-  free(decomp);
 
-  /* We're about to leave this call so the `nread' data bytes won't be seen
+  /* We are about to leave this call so the `nread' data bytes will not be seen
      again. If we are in a state that would wrongly allow restart in raw mode
      at the next call, assume output has already started. */
   if(nread && zp->zlib_init == ZLIB_INIT)
-    zp->zlib_init = started;      /* Cannot restart anymore. */
+    zp->zlib_init = started; /* Cannot restart anymore. */
 
   return result;
 }
 
-
 /* Deflate handler. */
-static CURLcode deflate_init_writer(struct Curl_easy *data,
-                                    struct contenc_writer *writer)
+static CURLcode deflate_do_init(struct Curl_easy *data,
+                                struct Curl_cwriter *writer)
 {
-  struct zlib_writer *zp = (struct zlib_writer *) writer;
-  z_stream *z = &zp->z;     /* zlib state structure */
-
-  if(!writer->downstream)
-    return CURLE_WRITE_ERROR;
+  struct zlib_writer *zp = (struct zlib_writer *)writer;
+  z_stream *z = &zp->z; /* zlib state structure */
 
   /* Initialize zlib */
-  z->zalloc = (alloc_func) zalloc_cb;
-  z->zfree = (free_func) zfree_cb;
+  z->zalloc = (alloc_func)zalloc_cb;
+  z->zfree = (free_func)zfree_cb;
 
   if(inflateInit(z) != Z_OK)
     return process_zlib_error(data, z);
@@ -293,314 +256,114 @@ static CURLcode deflate_init_writer(struct Curl_easy *data,
   return CURLE_OK;
 }
 
-static CURLcode deflate_unencode_write(struct Curl_easy *data,
-                                       struct contenc_writer *writer,
-                                       const char *buf, size_t nbytes)
+static CURLcode deflate_do_write(struct Curl_easy *data,
+                                 struct Curl_cwriter *writer, int type,
+                                 const char *buf, size_t nbytes)
 {
-  struct zlib_writer *zp = (struct zlib_writer *) writer;
-  z_stream *z = &zp->z;     /* zlib state structure */
+  struct zlib_writer *zp = (struct zlib_writer *)writer;
+  z_stream *z = &zp->z; /* zlib state structure */
+
+  if(!(type & CLIENTWRITE_BODY) || !nbytes)
+    return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
 
   /* Set the compressed input when this function is called */
-  z->next_in = (Bytef *) buf;
-  z->avail_in = (uInt) nbytes;
+  z->next_in = (z_const Bytef *)buf;
+  z->avail_in = (uInt)nbytes;
 
   if(zp->zlib_init == ZLIB_EXTERNAL_TRAILER)
     return process_trailer(data, zp);
 
   /* Now uncompress the data */
-  return inflate_stream(data, writer, ZLIB_INFLATING);
+  return inflate_stream(data, writer, type, ZLIB_INFLATING);
 }
 
-static void deflate_close_writer(struct Curl_easy *data,
-                                 struct contenc_writer *writer)
+static void deflate_do_close(struct Curl_easy *data,
+                             struct Curl_cwriter *writer)
 {
-  struct zlib_writer *zp = (struct zlib_writer *) writer;
-  z_stream *z = &zp->z;     /* zlib state structure */
+  struct zlib_writer *zp = (struct zlib_writer *)writer;
+  z_stream *z = &zp->z; /* zlib state structure */
 
   exit_zlib(data, z, &zp->zlib_init, CURLE_OK);
 }
 
-static const struct content_encoding deflate_encoding = {
+static const struct Curl_cwtype deflate_encoding = {
   "deflate",
   NULL,
-  deflate_init_writer,
-  deflate_unencode_write,
-  deflate_close_writer,
+  deflate_do_init,
+  deflate_do_write,
+  deflate_do_close,
   sizeof(struct zlib_writer)
 };
 
+/*
+ * Gzip handler.
+ */
 
-/* Gzip handler. */
-static CURLcode gzip_init_writer(struct Curl_easy *data,
-                                 struct contenc_writer *writer)
+static CURLcode gzip_do_init(struct Curl_easy *data,
+                             struct Curl_cwriter *writer)
 {
-  struct zlib_writer *zp = (struct zlib_writer *) writer;
-  z_stream *z = &zp->z;     /* zlib state structure */
-
-  if(!writer->downstream)
-    return CURLE_WRITE_ERROR;
+  struct zlib_writer *zp = (struct zlib_writer *)writer;
+  z_stream *z = &zp->z; /* zlib state structure */
 
   /* Initialize zlib */
-  z->zalloc = (alloc_func) zalloc_cb;
-  z->zfree = (free_func) zfree_cb;
+  z->zalloc = (alloc_func)zalloc_cb;
+  z->zfree = (free_func)zfree_cb;
 
-  if(strcmp(zlibVersion(), "1.2.0.4") >= 0) {
-    /* zlib ver. >= 1.2.0.4 supports transparent gzip decompressing */
-    if(inflateInit2(z, MAX_WBITS + 32) != Z_OK) {
-      return process_zlib_error(data, z);
-    }
-    zp->zlib_init = ZLIB_INIT_GZIP; /* Transparent gzip decompress state */
-  }
-  else {
-    /* we must parse the gzip header and trailer ourselves */
-    if(inflateInit2(z, -MAX_WBITS) != Z_OK) {
-      return process_zlib_error(data, z);
-    }
-    zp->trailerlen = 8; /* A CRC-32 and a 32-bit input size (RFC 1952, 2.2) */
-    zp->zlib_init = ZLIB_INIT; /* Initial call state */
-  }
+  if(inflateInit2(z, MAX_WBITS + 32) != Z_OK)
+    return process_zlib_error(data, z);
 
+  zp->zlib_init = ZLIB_INIT_GZIP; /* Transparent gzip decompress state */
   return CURLE_OK;
 }
 
-#ifdef OLD_ZLIB_SUPPORT
-/* Skip over the gzip header */
-static enum {
-  GZIP_OK,
-  GZIP_BAD,
-  GZIP_UNDERFLOW
-} check_gzip_header(unsigned char const *data, ssize_t len, ssize_t *headerlen)
+static CURLcode gzip_do_write(struct Curl_easy *data,
+                              struct Curl_cwriter *writer, int type,
+                              const char *buf, size_t nbytes)
 {
-  int method, flags;
-  const ssize_t totallen = len;
+  struct zlib_writer *zp = (struct zlib_writer *)writer;
+  z_stream *z = &zp->z; /* zlib state structure */
 
-  /* The shortest header is 10 bytes */
-  if(len < 10)
-    return GZIP_UNDERFLOW;
-
-  if((data[0] != GZIP_MAGIC_0) || (data[1] != GZIP_MAGIC_1))
-    return GZIP_BAD;
-
-  method = data[2];
-  flags = data[3];
-
-  if(method != Z_DEFLATED || (flags & RESERVED) != 0) {
-    /* Can't handle this compression method or unknown flag */
-    return GZIP_BAD;
-  }
-
-  /* Skip over time, xflags, OS code and all previous bytes */
-  len -= 10;
-  data += 10;
-
-  if(flags & EXTRA_FIELD) {
-    ssize_t extra_len;
-
-    if(len < 2)
-      return GZIP_UNDERFLOW;
-
-    extra_len = (data[1] << 8) | data[0];
-
-    if(len < (extra_len + 2))
-      return GZIP_UNDERFLOW;
-
-    len -= (extra_len + 2);
-    data += (extra_len + 2);
-  }
-
-  if(flags & ORIG_NAME) {
-    /* Skip over NUL-terminated file name */
-    while(len && *data) {
-      --len;
-      ++data;
-    }
-    if(!len || *data)
-      return GZIP_UNDERFLOW;
-
-    /* Skip over the NUL */
-    --len;
-    ++data;
-  }
-
-  if(flags & COMMENT) {
-    /* Skip over NUL-terminated comment */
-    while(len && *data) {
-      --len;
-      ++data;
-    }
-    if(!len || *data)
-      return GZIP_UNDERFLOW;
-
-    /* Skip over the NUL */
-    --len;
-  }
-
-  if(flags & HEAD_CRC) {
-    if(len < 2)
-      return GZIP_UNDERFLOW;
-
-    len -= 2;
-  }
-
-  *headerlen = totallen - len;
-  return GZIP_OK;
-}
-#endif
-
-static CURLcode gzip_unencode_write(struct Curl_easy *data,
-                                    struct contenc_writer *writer,
-                                    const char *buf, size_t nbytes)
-{
-  struct zlib_writer *zp = (struct zlib_writer *) writer;
-  z_stream *z = &zp->z;     /* zlib state structure */
+  if(!(type & CLIENTWRITE_BODY) || !nbytes)
+    return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
 
   if(zp->zlib_init == ZLIB_INIT_GZIP) {
     /* Let zlib handle the gzip decompression entirely */
-    z->next_in = (Bytef *) buf;
-    z->avail_in = (uInt) nbytes;
+    z->next_in = (z_const Bytef *)buf;
+    z->avail_in = (uInt)nbytes;
     /* Now uncompress the data */
-    return inflate_stream(data, writer, ZLIB_INIT_GZIP);
+    return inflate_stream(data, writer, type, ZLIB_INIT_GZIP);
   }
 
-#ifndef OLD_ZLIB_SUPPORT
-  /* Support for old zlib versions is compiled away and we are running with
-     an old version, so return an error. */
+  /* We are running with an old version: return error. */
   return exit_zlib(data, z, &zp->zlib_init, CURLE_WRITE_ERROR);
-
-#else
-  /* This next mess is to get around the potential case where there isn't
-   * enough data passed in to skip over the gzip header.  If that happens, we
-   * malloc a block and copy what we have then wait for the next call.  If
-   * there still isn't enough (this is definitely a worst-case scenario), we
-   * make the block bigger, copy the next part in and keep waiting.
-   *
-   * This is only required with zlib versions < 1.2.0.4 as newer versions
-   * can handle the gzip header themselves.
-   */
-
-  switch(zp->zlib_init) {
-  /* Skip over gzip header? */
-  case ZLIB_INIT:
-  {
-    /* Initial call state */
-    ssize_t hlen;
-
-    switch(check_gzip_header((unsigned char *) buf, nbytes, &hlen)) {
-    case GZIP_OK:
-      z->next_in = (Bytef *) buf + hlen;
-      z->avail_in = (uInt) (nbytes - hlen);
-      zp->zlib_init = ZLIB_GZIP_INFLATING; /* Inflating stream state */
-      break;
-
-    case GZIP_UNDERFLOW:
-      /* We need more data so we can find the end of the gzip header.  It's
-       * possible that the memory block we malloc here will never be freed if
-       * the transfer abruptly aborts after this point.  Since it's unlikely
-       * that circumstances will be right for this code path to be followed in
-       * the first place, and it's even more unlikely for a transfer to fail
-       * immediately afterwards, it should seldom be a problem.
-       */
-      z->avail_in = (uInt) nbytes;
-      z->next_in = malloc(z->avail_in);
-      if(!z->next_in) {
-        return exit_zlib(data, z, &zp->zlib_init, CURLE_OUT_OF_MEMORY);
-      }
-      memcpy(z->next_in, buf, z->avail_in);
-      zp->zlib_init = ZLIB_GZIP_HEADER;  /* Need more gzip header data state */
-      /* We don't have any data to inflate yet */
-      return CURLE_OK;
-
-    case GZIP_BAD:
-    default:
-      return exit_zlib(data, z, &zp->zlib_init, process_zlib_error(data, z));
-    }
-
-  }
-  break;
-
-  case ZLIB_GZIP_HEADER:
-  {
-    /* Need more gzip header data state */
-    ssize_t hlen;
-    z->avail_in += (uInt) nbytes;
-    z->next_in = Curl_saferealloc(z->next_in, z->avail_in);
-    if(!z->next_in) {
-      return exit_zlib(data, z, &zp->zlib_init, CURLE_OUT_OF_MEMORY);
-    }
-    /* Append the new block of data to the previous one */
-    memcpy(z->next_in + z->avail_in - nbytes, buf, nbytes);
-
-    switch(check_gzip_header(z->next_in, z->avail_in, &hlen)) {
-    case GZIP_OK:
-      /* This is the zlib stream data */
-      free(z->next_in);
-      /* Don't point into the malloced block since we just freed it */
-      z->next_in = (Bytef *) buf + hlen + nbytes - z->avail_in;
-      z->avail_in = (uInt) (z->avail_in - hlen);
-      zp->zlib_init = ZLIB_GZIP_INFLATING;   /* Inflating stream state */
-      break;
-
-    case GZIP_UNDERFLOW:
-      /* We still don't have any data to inflate! */
-      return CURLE_OK;
-
-    case GZIP_BAD:
-    default:
-      return exit_zlib(data, z, &zp->zlib_init, process_zlib_error(data, z));
-    }
-
-  }
-  break;
-
-  case ZLIB_EXTERNAL_TRAILER:
-    z->next_in = (Bytef *) buf;
-    z->avail_in = (uInt) nbytes;
-    return process_trailer(data, zp);
-
-  case ZLIB_GZIP_INFLATING:
-  default:
-    /* Inflating stream state */
-    z->next_in = (Bytef *) buf;
-    z->avail_in = (uInt) nbytes;
-    break;
-  }
-
-  if(z->avail_in == 0) {
-    /* We don't have any data to inflate; wait until next time */
-    return CURLE_OK;
-  }
-
-  /* We've parsed the header, now uncompress the data */
-  return inflate_stream(data, writer, ZLIB_GZIP_INFLATING);
-#endif
 }
 
-static void gzip_close_writer(struct Curl_easy *data,
-                              struct contenc_writer *writer)
+static void gzip_do_close(struct Curl_easy *data,
+                          struct Curl_cwriter *writer)
 {
-  struct zlib_writer *zp = (struct zlib_writer *) writer;
-  z_stream *z = &zp->z;     /* zlib state structure */
+  struct zlib_writer *zp = (struct zlib_writer *)writer;
+  z_stream *z = &zp->z; /* zlib state structure */
 
   exit_zlib(data, z, &zp->zlib_init, CURLE_OK);
 }
 
-static const struct content_encoding gzip_encoding = {
+static const struct Curl_cwtype gzip_encoding = {
   "gzip",
   "x-gzip",
-  gzip_init_writer,
-  gzip_unencode_write,
-  gzip_close_writer,
+  gzip_do_init,
+  gzip_do_write,
+  gzip_do_close,
   sizeof(struct zlib_writer)
 };
 
 #endif /* HAVE_LIBZ */
 
-
 #ifdef HAVE_BROTLI
 /* Brotli writer. */
 struct brotli_writer {
-  struct contenc_writer super;
-  BrotliDecoderState *br;    /* State structure for brotli. */
+  struct Curl_cwriter super;
+  char buffer[DECOMPRESS_BUFFER_SIZE];
+  BrotliDecoderState *br; /* State structure for brotli. */
 };
 
 static CURLcode brotli_map_error(BrotliDecoderErrorCode be)
@@ -620,12 +383,10 @@ static CURLcode brotli_map_error(BrotliDecoderErrorCode be)
   case BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS:
   case BROTLI_DECODER_ERROR_FORMAT_PADDING_1:
   case BROTLI_DECODER_ERROR_FORMAT_PADDING_2:
-#ifdef BROTLI_DECODER_ERROR_COMPOUND_DICTIONARY
+#ifdef BROTLI_DECODER_ERROR_COMPOUND_DICTIONARY  /* brotli v1.1.0+ */
   case BROTLI_DECODER_ERROR_COMPOUND_DICTIONARY:
 #endif
-#ifdef BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET
   case BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET:
-#endif
   case BROTLI_DECODER_ERROR_INVALID_ARGUMENTS:
     return CURLE_BAD_CONTENT_ENCODING;
   case BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES:
@@ -641,46 +402,52 @@ static CURLcode brotli_map_error(BrotliDecoderErrorCode be)
   return CURLE_WRITE_ERROR;
 }
 
-static CURLcode brotli_init_writer(struct Curl_easy *data,
-                                   struct contenc_writer *writer)
+static CURLcode brotli_do_init(struct Curl_easy *data,
+                               struct Curl_cwriter *writer)
 {
-  struct brotli_writer *bp = (struct brotli_writer *) writer;
-  (void) data;
-
-  if(!writer->downstream)
-    return CURLE_WRITE_ERROR;
+  struct brotli_writer *bp = (struct brotli_writer *)writer;
+  (void)data;
 
   bp->br = BrotliDecoderCreateInstance(NULL, NULL, NULL);
-  return bp->br? CURLE_OK: CURLE_OUT_OF_MEMORY;
+  return bp->br ? CURLE_OK : CURLE_OUT_OF_MEMORY;
 }
 
-static CURLcode brotli_unencode_write(struct Curl_easy *data,
-                                      struct contenc_writer *writer,
-                                      const char *buf, size_t nbytes)
+static CURLcode brotli_do_write(struct Curl_easy *data,
+                                struct Curl_cwriter *writer, int type,
+                                const char *buf, size_t nbytes)
 {
-  struct brotli_writer *bp = (struct brotli_writer *) writer;
-  const uint8_t *src = (const uint8_t *) buf;
-  char *decomp;
+  struct brotli_writer *bp = (struct brotli_writer *)writer;
+  const uint8_t *src = (const uint8_t *)buf;
   uint8_t *dst;
   size_t dstleft;
   CURLcode result = CURLE_OK;
   BrotliDecoderResult r = BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT;
+  int i = 0;
+
+  if(!(type & CLIENTWRITE_BODY) || !nbytes)
+    return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
 
   if(!bp->br)
-    return CURLE_WRITE_ERROR;  /* Stream already ended. */
-
-  decomp = malloc(DSIZ);
-  if(!decomp)
-    return CURLE_OUT_OF_MEMORY;
+    return CURLE_WRITE_ERROR; /* Stream already ended. */
 
   while((nbytes || r == BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT) &&
         result == CURLE_OK) {
-    dst = (uint8_t *) decomp;
-    dstleft = DSIZ;
+
+    if(++i > (1024 * 1024 / DECOMPRESS_BUFFER_SIZE)) {
+      /* check every MB of output if we are not exceeding time limit */
+      i = 0;
+      if(Curl_timeleft_ms(data) < 0) {
+        failf(data, "Operation timed out while decoding payload");
+        return CURLE_OPERATION_TIMEDOUT;
+      }
+    }
+
+    dst = (uint8_t *)bp->buffer;
+    dstleft = DECOMPRESS_BUFFER_SIZE;
     r = BrotliDecoderDecompressStream(bp->br,
                                       &nbytes, &src, &dstleft, &dst, NULL);
-    result = Curl_unencode_write(data, writer->downstream,
-                                 decomp, DSIZ - dstleft);
+    result = Curl_cwriter_write(data, writer->next, type,
+                                bp->buffer, DECOMPRESS_BUFFER_SIZE - dstleft);
     if(result)
       break;
     switch(r) {
@@ -698,16 +465,14 @@ static CURLcode brotli_unencode_write(struct Curl_easy *data,
       break;
     }
   }
-  free(decomp);
   return result;
 }
 
-static void brotli_close_writer(struct Curl_easy *data,
-                                struct contenc_writer *writer)
+static void brotli_do_close(struct Curl_easy *data,
+                            struct Curl_cwriter *writer)
 {
-  struct brotli_writer *bp = (struct brotli_writer *) writer;
-
-  (void) data;
+  struct brotli_writer *bp = (struct brotli_writer *)writer;
+  (void)data;
 
   if(bp->br) {
     BrotliDecoderDestroyInstance(bp->br);
@@ -715,71 +480,97 @@ static void brotli_close_writer(struct Curl_easy *data,
   }
 }
 
-static const struct content_encoding brotli_encoding = {
+static const struct Curl_cwtype brotli_encoding = {
   "br",
   NULL,
-  brotli_init_writer,
-  brotli_unencode_write,
-  brotli_close_writer,
+  brotli_do_init,
+  brotli_do_write,
+  brotli_do_close,
   sizeof(struct brotli_writer)
 };
 #endif
 
-
 #ifdef HAVE_ZSTD
 /* Zstd writer. */
 struct zstd_writer {
-  struct contenc_writer super;
-  ZSTD_DStream *zds;    /* State structure for zstd. */
-  void *decomp;
+  struct Curl_cwriter super;
+  ZSTD_DStream *zds; /* State structure for zstd. */
+  char buffer[DECOMPRESS_BUFFER_SIZE];
 };
 
-static CURLcode zstd_init_writer(struct Curl_easy *data,
-                                 struct contenc_writer *writer)
+#ifdef ZSTD_STATIC_LINKING_ONLY
+static void *Curl_zstd_alloc(void *opaque, size_t size)
 {
-  struct zstd_writer *zp = (struct zstd_writer *) writer;
+  (void)opaque;
+  return Curl_cmalloc(size);
+}
+
+static void Curl_zstd_free(void *opaque, void *address)
+{
+  (void)opaque;
+  Curl_cfree(address);
+}
+#endif
+
+static CURLcode zstd_do_init(struct Curl_easy *data,
+                             struct Curl_cwriter *writer)
+{
+  struct zstd_writer *zp = (struct zstd_writer *)writer;
 
   (void)data;
 
-  if(!writer->downstream)
-    return CURLE_WRITE_ERROR;
-
+#ifdef ZSTD_STATIC_LINKING_ONLY
+  zp->zds = ZSTD_createDStream_advanced((ZSTD_customMem) {
+    .customAlloc = Curl_zstd_alloc,
+    .customFree  = Curl_zstd_free,
+    .opaque      = NULL
+  });
+#else
   zp->zds = ZSTD_createDStream();
-  zp->decomp = NULL;
+#endif
+
   return zp->zds ? CURLE_OK : CURLE_OUT_OF_MEMORY;
 }
 
-static CURLcode zstd_unencode_write(struct Curl_easy *data,
-                                    struct contenc_writer *writer,
-                                    const char *buf, size_t nbytes)
+static CURLcode zstd_do_write(struct Curl_easy *data,
+                              struct Curl_cwriter *writer, int type,
+                              const char *buf, size_t nbytes)
 {
   CURLcode result = CURLE_OK;
-  struct zstd_writer *zp = (struct zstd_writer *) writer;
+  struct zstd_writer *zp = (struct zstd_writer *)writer;
   ZSTD_inBuffer in;
   ZSTD_outBuffer out;
   size_t errorCode;
+  int i = 0;
+
+  if(!(type & CLIENTWRITE_BODY) || !nbytes)
+    return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
 
-  if(!zp->decomp) {
-    zp->decomp = malloc(DSIZ);
-    if(!zp->decomp)
-      return CURLE_OUT_OF_MEMORY;
-  }
   in.pos = 0;
   in.src = buf;
   in.size = nbytes;
 
   for(;;) {
+    if(++i > (1024 * 1024 / DECOMPRESS_BUFFER_SIZE)) {
+      /* check every MB of output if we are not exceeding time limit */
+      i = 0;
+      if(Curl_timeleft_ms(data) < 0) {
+        failf(data, "Operation timed out while decoding payload");
+        return CURLE_OPERATION_TIMEDOUT;
+      }
+    }
+
     out.pos = 0;
-    out.dst = zp->decomp;
-    out.size = DSIZ;
+    out.dst = zp->buffer;
+    out.size = DECOMPRESS_BUFFER_SIZE;
 
     errorCode = ZSTD_decompressStream(zp->zds, &out, &in);
     if(ZSTD_isError(errorCode)) {
       return CURLE_BAD_CONTENT_ENCODING;
     }
     if(out.pos > 0) {
-      result = Curl_unencode_write(data, writer->downstream,
-                                   zp->decomp, out.pos);
+      result = Curl_cwriter_write(data, writer->next, type,
+                                  zp->buffer, out.pos);
       if(result)
         break;
     }
@@ -790,68 +581,40 @@ static CURLcode zstd_unencode_write(struct Curl_easy *data,
   return result;
 }
 
-static void zstd_close_writer(struct Curl_easy *data,
-                              struct contenc_writer *writer)
+static void zstd_do_close(struct Curl_easy *data,
+                          struct Curl_cwriter *writer)
 {
-  struct zstd_writer *zp = (struct zstd_writer *) writer;
-
+  struct zstd_writer *zp = (struct zstd_writer *)writer;
   (void)data;
 
-  if(zp->decomp) {
-    free(zp->decomp);
-    zp->decomp = NULL;
-  }
   if(zp->zds) {
     ZSTD_freeDStream(zp->zds);
     zp->zds = NULL;
   }
 }
 
-static const struct content_encoding zstd_encoding = {
+static const struct Curl_cwtype zstd_encoding = {
   "zstd",
   NULL,
-  zstd_init_writer,
-  zstd_unencode_write,
-  zstd_close_writer,
+  zstd_do_init,
+  zstd_do_write,
+  zstd_do_close,
   sizeof(struct zstd_writer)
 };
 #endif
 
-
 /* Identity handler. */
-static CURLcode identity_init_writer(struct Curl_easy *data,
-                                     struct contenc_writer *writer)
-{
-  (void) data;
-  return writer->downstream? CURLE_OK: CURLE_WRITE_ERROR;
-}
-
-static CURLcode identity_unencode_write(struct Curl_easy *data,
-                                        struct contenc_writer *writer,
-                                        const char *buf, size_t nbytes)
-{
-  return Curl_unencode_write(data, writer->downstream, buf, nbytes);
-}
-
-static void identity_close_writer(struct Curl_easy *data,
-                                  struct contenc_writer *writer)
-{
-  (void) data;
-  (void) writer;
-}
-
-static const struct content_encoding identity_encoding = {
+static const struct Curl_cwtype identity_encoding = {
   "identity",
   "none",
-  identity_init_writer,
-  identity_unencode_write,
-  identity_close_writer,
-  sizeof(struct contenc_writer)
+  Curl_cwriter_def_init,
+  Curl_cwriter_def_write,
+  Curl_cwriter_def_close,
+  sizeof(struct Curl_cwriter)
 };
 
-
-/* supported content encodings table. */
-static const struct content_encoding * const encodings[] = {
+/* supported general content decoders. */
+static const struct Curl_cwtype * const general_unencoders[] = {
   &identity_encoding,
 #ifdef HAVE_LIBZ
   &deflate_encoding,
@@ -866,203 +629,117 @@ static const struct content_encoding * const encodings[] = {
   NULL
 };
 
-
-/* Return a list of comma-separated names of supported encodings. */
-char *Curl_all_content_encodings(void)
-{
-  size_t len = 0;
-  const struct content_encoding * const *cep;
-  const struct content_encoding *ce;
-  char *ace;
-
-  for(cep = encodings; *cep; cep++) {
-    ce = *cep;
-    if(!strcasecompare(ce->name, CONTENT_ENCODING_DEFAULT))
-      len += strlen(ce->name) + 2;
-  }
-
-  if(!len)
-    return strdup(CONTENT_ENCODING_DEFAULT);
-
-  ace = malloc(len);
-  if(ace) {
-    char *p = ace;
-    for(cep = encodings; *cep; cep++) {
-      ce = *cep;
-      if(!strcasecompare(ce->name, CONTENT_ENCODING_DEFAULT)) {
-        strcpy(p, ce->name);
-        p += strlen(p);
-        *p++ = ',';
-        *p++ = ' ';
-      }
-    }
-    p[-2] = '\0';
-  }
-
-  return ace;
-}
-
-
-/* Real client writer: no downstream. */
-static CURLcode client_init_writer(struct Curl_easy *data,
-                                   struct contenc_writer *writer)
-{
-  (void) data;
-  return writer->downstream? CURLE_WRITE_ERROR: CURLE_OK;
-}
-
-static CURLcode client_unencode_write(struct Curl_easy *data,
-                                      struct contenc_writer *writer,
-                                      const char *buf, size_t nbytes)
-{
-  struct SingleRequest *k = &data->req;
-
-  (void) writer;
-
-  if(!nbytes || k->ignorebody)
-    return CURLE_OK;
-
-  return Curl_client_write(data, CLIENTWRITE_BODY, (char *) buf, nbytes);
-}
-
-static void client_close_writer(struct Curl_easy *data,
-                                struct contenc_writer *writer)
-{
-  (void) data;
-  (void) writer;
-}
-
-static const struct content_encoding client_encoding = {
-  NULL,
-  NULL,
-  client_init_writer,
-  client_unencode_write,
-  client_close_writer,
-  sizeof(struct contenc_writer)
+/* supported content decoders only for transfer encodings */
+static const struct Curl_cwtype * const transfer_unencoders[] = {
+  &Curl_httpchunk_unencoder,
+  NULL
 };
 
-
-/* Deferred error dummy writer. */
-static CURLcode error_init_writer(struct Curl_easy *data,
-                                  struct contenc_writer *writer)
+/* Return the list of comma-separated names of supported encodings.
+ */
+char *Curl_get_content_encodings(void)
 {
-  (void) data;
-  return writer->downstream? CURLE_OK: CURLE_WRITE_ERROR;
+  struct dynbuf enc;
+  const struct Curl_cwtype * const *cep;
+  CURLcode result = CURLE_OK;
+  curlx_dyn_init(&enc, 255);
+
+  for(cep = general_unencoders; *cep && !result; cep++) {
+    const struct Curl_cwtype *ce = *cep;
+    if(!curl_strequal(ce->name, CONTENT_ENCODING_DEFAULT)) {
+      if(curlx_dyn_len(&enc))
+        result = curlx_dyn_addn(&enc, ", ", 2);
+      if(!result)
+        result = curlx_dyn_add(&enc, ce->name);
+    }
+  }
+  if(!result && !curlx_dyn_len(&enc))
+    result = curlx_dyn_add(&enc, CONTENT_ENCODING_DEFAULT);
+
+  if(!result)
+    return curlx_dyn_ptr(&enc);
+  return NULL;
 }
 
-static CURLcode error_unencode_write(struct Curl_easy *data,
-                                     struct contenc_writer *writer,
-                                     const char *buf, size_t nbytes)
+/* Deferred error dummy writer. */
+static CURLcode error_do_init(struct Curl_easy *data,
+                              struct Curl_cwriter *writer)
 {
-  char *all = Curl_all_content_encodings();
+  (void)data;
+  (void)writer;
+  return CURLE_OK;
+}
 
-  (void) writer;
-  (void) buf;
-  (void) nbytes;
+static CURLcode error_do_write(struct Curl_easy *data,
+                               struct Curl_cwriter *writer, int type,
+                               const char *buf, size_t nbytes)
+{
+  (void)writer;
+  (void)buf;
+  (void)nbytes;
 
-  if(!all)
-    return CURLE_OUT_OF_MEMORY;
-  failf(data, "Unrecognized content encoding type. "
-        "libcurl understands %s content encodings.", all);
-  free(all);
+  if(!(type & CLIENTWRITE_BODY) || !nbytes)
+    return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
+  failf(data, "Unrecognized content encoding type");
   return CURLE_BAD_CONTENT_ENCODING;
 }
 
-static void error_close_writer(struct Curl_easy *data,
-                               struct contenc_writer *writer)
+static void error_do_close(struct Curl_easy *data,
+                           struct Curl_cwriter *writer)
 {
-  (void) data;
-  (void) writer;
+  (void)data;
+  (void)writer;
 }
 
-static const struct content_encoding error_encoding = {
+static const struct Curl_cwtype error_writer = {
+  "ce-error",
   NULL,
-  NULL,
-  error_init_writer,
-  error_unencode_write,
-  error_close_writer,
-  sizeof(struct contenc_writer)
+  error_do_init,
+  error_do_write,
+  error_do_close,
+  sizeof(struct Curl_cwriter)
 };
 
-/* Create an unencoding writer stage using the given handler. */
-static struct contenc_writer *
-new_unencoding_writer(struct Curl_easy *data,
-                      const struct content_encoding *handler,
-                      struct contenc_writer *downstream,
-                      int order)
+/* Find the content encoding by name. */
+static const struct Curl_cwtype *find_unencode_writer(const char *name,
+                                                      size_t len,
+                                                      Curl_cwriter_phase phase)
 {
-  struct contenc_writer *writer;
+  const struct Curl_cwtype * const *cep;
 
-  DEBUGASSERT(handler->writersize >= sizeof(struct contenc_writer));
-  writer = (struct contenc_writer *) calloc(1, handler->writersize);
-
-  if(writer) {
-    writer->handler = handler;
-    writer->downstream = downstream;
-    writer->order = order;
-    if(handler->init_writer(data, writer)) {
-      free(writer);
-      writer = NULL;
+  if(phase == CURL_CW_TRANSFER_DECODE) {
+    for(cep = transfer_unencoders; *cep; cep++) {
+      const struct Curl_cwtype *ce = *cep;
+      if((curl_strnequal(name, ce->name, len) && !ce->name[len]) ||
+         (ce->alias && curl_strnequal(name, ce->alias, len) &&
+          !ce->alias[len]))
+        return ce;
     }
   }
-
-  return writer;
-}
-
-/* Write data using an unencoding writer stack. "nbytes" is not
-   allowed to be 0. */
-CURLcode Curl_unencode_write(struct Curl_easy *data,
-                             struct contenc_writer *writer,
-                             const char *buf, size_t nbytes)
-{
-  if(!nbytes)
-    return CURLE_OK;
-  return writer->handler->unencode_write(data, writer, buf, nbytes);
-}
-
-/* Close and clean-up the connection's writer stack. */
-void Curl_unencode_cleanup(struct Curl_easy *data)
-{
-  struct SingleRequest *k = &data->req;
-  struct contenc_writer *writer = k->writer_stack;
-
-  while(writer) {
-    k->writer_stack = writer->downstream;
-    writer->handler->close_writer(data, writer);
-    free(writer);
-    writer = k->writer_stack;
-  }
-}
-
-/* Find the content encoding by name. */
-static const struct content_encoding *find_encoding(const char *name,
-                                                    size_t len)
-{
-  const struct content_encoding * const *cep;
-
-  for(cep = encodings; *cep; cep++) {
-    const struct content_encoding *ce = *cep;
-    if((strncasecompare(name, ce->name, len) && !ce->name[len]) ||
-       (ce->alias && strncasecompare(name, ce->alias, len) && !ce->alias[len]))
+  /* look among the general decoders */
+  for(cep = general_unencoders; *cep; cep++) {
+    const struct Curl_cwtype *ce = *cep;
+    if((curl_strnequal(name, ce->name, len) && !ce->name[len]) ||
+       (ce->alias && curl_strnequal(name, ce->alias, len) && !ce->alias[len]))
       return ce;
   }
   return NULL;
 }
 
-/* allow no more than 5 "chained" compression steps */
-#define MAX_ENCODE_STACK 5
-
-/* Set-up the unencoding stack from the Content-Encoding header value.
+/* Setup the unencoding stack from the Content-Encoding header value.
  * See RFC 7231 section 3.1.2.2. */
 CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
                                      const char *enclist, int is_transfer)
 {
-  struct SingleRequest *k = &data->req;
-  unsigned int order = is_transfer? 2: 1;
+  Curl_cwriter_phase phase = is_transfer ?
+    CURL_CW_TRANSFER_DECODE : CURL_CW_CONTENT_DECODE;
+  CURLcode result;
+  bool has_chunked = FALSE;
 
   do {
     const char *name;
     size_t namelen;
+    bool is_chunked = FALSE;
 
     /* Parse a single encoding name. */
     while(ISBLANK(*enclist) || *enclist == ',')
@@ -1071,56 +748,89 @@ CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
     name = enclist;
 
     for(namelen = 0; *enclist && *enclist != ','; enclist++)
-      if(!ISSPACE(*enclist))
+      if(*enclist > ' ')
         namelen = enclist - name + 1;
 
-    /* Special case: chunked encoding is handled at the reader level. */
-    if(is_transfer && namelen == 7 && strncasecompare(name, "chunked", 7)) {
-      k->chunk = TRUE;             /* chunks coming our way. */
-      Curl_httpchunk_init(data);   /* init our chunky engine. */
-    }
-    else if(namelen) {
-      const struct content_encoding *encoding;
-      struct contenc_writer *writer;
-      if(is_transfer && !data->set.http_transfer_encoding)
+    if(namelen) {
+      const struct Curl_cwtype *cwt;
+      struct Curl_cwriter *writer;
+
+      CURL_TRC_WRITE(data, "looking for %s decoder: %.*s",
+                     is_transfer ? "transfer" : "content", (int)namelen, name);
+      is_chunked = (is_transfer && (namelen == 7) &&
+                    curl_strnequal(name, "chunked", 7));
+      /* if we skip the decoding in this phase, do not look further.
+       * Exception is "chunked" transfer-encoding which always must happen */
+      if((is_transfer && !data->set.http_transfer_encoding && !is_chunked) ||
+         (!is_transfer && data->set.http_ce_skip)) {
+        bool is_identity = curl_strnequal(name, "identity", 8);
         /* not requested, ignore */
+        CURL_TRC_WRITE(data, "decoder not requested, ignored: %.*s",
+                       (int)namelen, name);
+        if(is_transfer && !data->set.http_te_skip) {
+          if(has_chunked)
+            failf(data, "A Transfer-Encoding (%.*s) was listed after chunked",
+                  (int)namelen, name);
+          else if(is_identity)
+            continue;
+          else
+            failf(data, "Unsolicited Transfer-Encoding (%.*s) found",
+                  (int)namelen, name);
+          return CURLE_BAD_CONTENT_ENCODING;
+        }
         return CURLE_OK;
-      encoding = find_encoding(name, namelen);
-
-      if(!k->writer_stack) {
-        k->writer_stack = new_unencoding_writer(data, &client_encoding,
-                                                NULL, 0);
-
-        if(!k->writer_stack)
-          return CURLE_OUT_OF_MEMORY;
       }
 
-      if(!encoding)
-        encoding = &error_encoding;  /* Defer error at stack use. */
-
-      if(k->writer_stack_depth++ >= MAX_ENCODE_STACK) {
-        failf(data, "Reject response due to more than %u content encodings",
-              MAX_ENCODE_STACK);
+      if(Curl_cwriter_count(data, phase) >= MAX_ENCODE_STACK) {
+        failf(data, "Reject response exceeding limit of %d %s encodings",
+              MAX_ENCODE_STACK,
+              is_transfer ? "transfer" : "content");
         return CURLE_BAD_CONTENT_ENCODING;
       }
-      /* Stack the unencoding stage. */
-      if(order >= k->writer_stack->order) {
-        writer = new_unencoding_writer(data, encoding,
-                                       k->writer_stack, order);
-        if(!writer)
-          return CURLE_OUT_OF_MEMORY;
-        k->writer_stack = writer;
+
+      cwt = find_unencode_writer(name, namelen, phase);
+      if(is_transfer && !is_chunked &&
+         Curl_cwriter_get_by_name(data, "chunked")) {
+        /* RFC 9112, ch. 6.1:
+         * "If any transfer coding other than chunked is applied to a
+         *  response's content, the sender MUST either apply chunked as the
+         *  final transfer coding or terminate the message by closing the
+         *  connection."
+         * "chunked" must be the last added to be the first in its phase,
+         *  reject this.
+         */
+        failf(data, "Reject response due to 'chunked' not being the last "
+              "Transfer-Encoding");
+        return CURLE_BAD_CONTENT_ENCODING;
+      }
+      if(cwt && is_chunked && Curl_cwriter_get_by_type(data, cwt)) {
+        /* A 'chunked' transfer encoding has already been added.
+         * Ignore duplicates. See #13451.
+         * Also RFC 9112, ch. 6.1:
+         * "A sender MUST NOT apply the chunked transfer coding more than
+         *  once to a message body."
+         */
+        CURL_TRC_WRITE(data, "ignoring duplicate 'chunked' decoder");
       }
       else {
-        struct contenc_writer *w = k->writer_stack;
-        while(w->downstream && order < w->downstream->order)
-          w = w->downstream;
-        writer = new_unencoding_writer(data, encoding,
-                                       w->downstream, order);
-        if(!writer)
-          return CURLE_OUT_OF_MEMORY;
-        w->downstream = writer;
+        if(!cwt)
+          cwt = &error_writer; /* Defer error at use. */
+
+        result = Curl_cwriter_create(&writer, data, cwt, phase);
+        CURL_TRC_WRITE(data, "added %s decoder %s -> %d",
+                       is_transfer ? "transfer" : "content", cwt->name,
+                       (int)result);
+        if(result)
+          return result;
+
+        result = Curl_cwriter_add(data, writer);
+        if(result) {
+          Curl_cwriter_free(data, writer);
+          return result;
+        }
       }
+      if(is_chunked)
+        has_chunked = TRUE;
     }
   } while(*enclist);
 
@@ -1132,31 +842,15 @@ CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
 CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
                                      const char *enclist, int is_transfer)
 {
-  (void) data;
-  (void) enclist;
-  (void) is_transfer;
+  (void)data;
+  (void)enclist;
+  (void)is_transfer;
   return CURLE_NOT_BUILT_IN;
 }
 
-CURLcode Curl_unencode_write(struct Curl_easy *data,
-                             struct contenc_writer *writer,
-                             const char *buf, size_t nbytes)
+char *Curl_get_content_encodings(void)
 {
-  (void) data;
-  (void) writer;
-  (void) buf;
-  (void) nbytes;
-  return CURLE_NOT_BUILT_IN;
-}
-
-void Curl_unencode_cleanup(struct Curl_easy *data)
-{
-  (void) data;
-}
-
-char *Curl_all_content_encodings(void)
-{
-  return strdup(CONTENT_ENCODING_DEFAULT);  /* Satisfy caller. */
+  return curlx_strdup(CONTENT_ENCODING_DEFAULT);
 }
 
 #endif /* CURL_DISABLE_HTTP */
diff --git a/third-party/curl/lib/content_encoding.h b/third-party/curl/lib/content_encoding.h
index 56e7f97f70..e84a739761 100644
--- a/third-party/curl/lib/content_encoding.h
+++ b/third-party/curl/lib/content_encoding.h
@@ -25,33 +25,11 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
-struct contenc_writer {
-  const struct content_encoding *handler;  /* Encoding handler. */
-  struct contenc_writer *downstream;  /* Downstream writer. */
-  unsigned int order; /* Ordering within writer stack. */
-};
-
-/* Content encoding writer. */
-struct content_encoding {
-  const char *name;        /* Encoding name. */
-  const char *alias;       /* Encoding name alias. */
-  CURLcode (*init_writer)(struct Curl_easy *data,
-                          struct contenc_writer *writer);
-  CURLcode (*unencode_write)(struct Curl_easy *data,
-                             struct contenc_writer *writer,
-                             const char *buf, size_t nbytes);
-  void (*close_writer)(struct Curl_easy *data,
-                       struct contenc_writer *writer);
-  size_t writersize;
-};
+struct Curl_cwriter;
 
+/* returns an allocated string or NULL */
+char *Curl_get_content_encodings(void);
 
 CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
                                      const char *enclist, int is_transfer);
-CURLcode Curl_unencode_write(struct Curl_easy *data,
-                             struct contenc_writer *writer,
-                             const char *buf, size_t nbytes);
-void Curl_unencode_cleanup(struct Curl_easy *data);
-char *Curl_all_content_encodings(void);
-
 #endif /* HEADER_CURL_CONTENT_ENCODING_H */
diff --git a/third-party/curl/lib/cookie.c b/third-party/curl/lib/cookie.c
index 4345a84c6f..91dc8d5fd0 100644
--- a/third-party/curl/lib/cookie.c
+++ b/third-party/curl/lib/cookie.c
@@ -21,68 +21,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
-/***
-
-
-RECEIVING COOKIE INFORMATION
-============================
-
-struct CookieInfo *Curl_cookie_init(struct Curl_easy *data,
-                    const char *file, struct CookieInfo *inc, bool newsession);
-
-        Inits a cookie struct to store data in a local file. This is always
-        called before any cookies are set.
-
-struct Cookie *Curl_cookie_add(struct Curl_easy *data,
-                 struct CookieInfo *c, bool httpheader, bool noexpire,
-                 char *lineptr, const char *domain, const char *path,
-                 bool secure);
-
-        The 'lineptr' parameter is a full "Set-cookie:" line as
-        received from a server.
-
-        The function need to replace previously stored lines that this new
-        line supersedes.
-
-        It may remove lines that are expired.
-
-        It should return an indication of success/error.
-
-
-SENDING COOKIE INFORMATION
-==========================
-
-struct Cookies *Curl_cookie_getlist(struct CookieInfo *cookie,
-                                    char *host, char *path, bool secure);
-
-        For a given host and path, return a linked list of cookies that
-        the client should send to the server if used now. The secure
-        boolean informs the cookie if a secure connection is achieved or
-        not.
-
-        It shall only return cookies that haven't expired.
-
-
-Example set of cookies:
-
-    Set-cookie: PRODUCTINFO=webxpress; domain=.fidelity.com; path=/; secure
-    Set-cookie: PERSONALIZE=none;expires=Monday, 13-Jun-1988 03:04:55 GMT;
-    domain=.fidelity.com; path=/ftgw; secure
-    Set-cookie: FidHist=none;expires=Monday, 13-Jun-1988 03:04:55 GMT;
-    domain=.fidelity.com; path=/; secure
-    Set-cookie: FidOrder=none;expires=Monday, 13-Jun-1988 03:04:55 GMT;
-    domain=.fidelity.com; path=/; secure
-    Set-cookie: DisPend=none;expires=Monday, 13-Jun-1988 03:04:55 GMT;
-    domain=.fidelity.com; path=/; secure
-    Set-cookie: FidDis=none;expires=Monday, 13-Jun-1988 03:04:55 GMT;
-    domain=.fidelity.com; path=/; secure
-    Set-cookie:
-    Session_Key@6791a9e0-901a-11d0-a1c8-9b012c88aa77=none;expires=Monday,
-    13-Jun-1988 03:04:55 GMT; domain=.fidelity.com; path=/; secure
-****/
-
-
 #include "curl_setup.h"
 
 #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_COOKIES)
@@ -90,41 +28,51 @@ Example set of cookies:
 #include "urldata.h"
 #include "cookie.h"
 #include "psl.h"
-#include "strtok.h"
-#include "sendf.h"
+#include "curl_trc.h"
+#include "transfer.h"
 #include "slist.h"
-#include "share.h"
-#include "strtoofft.h"
+#include "curl_share.h"
 #include "strcase.h"
+#include "curl_fopen.h"
 #include "curl_get_line.h"
 #include "curl_memrchr.h"
 #include "parsedate.h"
-#include "rename.h"
-#include "fopen.h"
-#include "strdup.h"
+#include "curlx/strdup.h"
+#include "llist.h"
+#include "curlx/strparse.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+/* number of seconds in 400 days */
+#define COOKIES_MAXAGE (400 * 24 * 3600)
 
-static void strstore(char **str, const char *newstr, size_t len);
+/* Make sure cookies never expire further away in time than 400 days into the
+   future. (from RFC6265bis draft-19)
 
-static void freecookie(struct Cookie *co)
+   For the sake of easier testing, align the capped time to an even 60 second
+   boundary.
+*/
+static void cap_expires(time_t now, struct Cookie *co)
 {
-  free(co->expirestr);
-  free(co->domain);
-  free(co->path);
-  free(co->spath);
-  free(co->name);
-  free(co->value);
-  free(co->maxage);
-  free(co->version);
-  free(co);
+  if(co->expires && (TIME_T_MAX - COOKIES_MAXAGE - 30) > now) {
+    timediff_t cap = now + COOKIES_MAXAGE;
+    if(co->expires > cap) {
+      cap += 30;
+      co->expires = (cap / 60) * 60;
+    }
+  }
+}
+
+static void freecookie(struct Cookie *co, bool maintoo)
+{
+  curlx_free(co->domain);
+  curlx_free(co->path);
+  curlx_free(co->name);
+  curlx_free(co->value);
+  if(maintoo)
+    curlx_free(co);
 }
 
 static bool cookie_tailmatch(const char *cookie_domain,
-                             size_t cookie_domain_len,
+                             const size_t cookie_domain_len,
                              const char *hostname)
 {
   size_t hostname_len = strlen(hostname);
@@ -132,9 +80,9 @@ static bool cookie_tailmatch(const char *cookie_domain,
   if(hostname_len < cookie_domain_len)
     return FALSE;
 
-  if(!strncasecompare(cookie_domain,
-                      hostname + hostname_len-cookie_domain_len,
-                      cookie_domain_len))
+  if(!curl_strnequal(cookie_domain,
+                     hostname + hostname_len - cookie_domain_len,
+                     cookie_domain_len))
     return FALSE;
 
   /*
@@ -153,37 +101,25 @@ static bool cookie_tailmatch(const char *cookie_domain,
 }
 
 /*
- * matching cookie path and url path
+ * matching cookie path and URL path
  * RFC6265 5.1.4 Paths and Path-Match
  */
-static bool pathmatch(const char *cookie_path, const char *request_uri)
+static bool pathmatch(const char *cookie_path, const char *uri_path)
 {
   size_t cookie_path_len;
   size_t uri_path_len;
-  char *uri_path = NULL;
-  char *pos;
   bool ret = FALSE;
 
   /* cookie_path must not have last '/' separator. ex: /sample */
   cookie_path_len = strlen(cookie_path);
-  if(1 == cookie_path_len) {
+  if(cookie_path_len == 1) {
     /* cookie_path must be '/' */
     return TRUE;
   }
 
-  uri_path = strdup(request_uri);
-  if(!uri_path)
-    return FALSE;
-  pos = strchr(uri_path, '?');
-  if(pos)
-    *pos = 0x0;
-
   /* #-fragments are already cut off! */
-  if(0 == strlen(uri_path) || uri_path[0] != '/') {
-    strstore(&uri_path, "/", 1);
-    if(!uri_path)
-      return FALSE;
-  }
+  if(strlen(uri_path) == 0 || uri_path[0] != '/')
+    uri_path = "/";
 
   /*
    * here, RFC6265 5.1.4 says
@@ -197,16 +133,12 @@ static bool pathmatch(const char *cookie_path, const char *request_uri)
 
   uri_path_len = strlen(uri_path);
 
-  if(uri_path_len < cookie_path_len) {
-    ret = FALSE;
+  if(uri_path_len < cookie_path_len)
     goto pathmatched;
-  }
 
   /* not using checkprefix() because matching should be case-sensitive */
-  if(strncmp(cookie_path, uri_path, cookie_path_len)) {
-    ret = FALSE;
+  if(strncmp(cookie_path, uri_path, cookie_path_len))
     goto pathmatched;
-  }
 
   /* The cookie-path and the uri-path are identical. */
   if(cookie_path_len == uri_path_len) {
@@ -220,10 +152,7 @@ static bool pathmatch(const char *cookie_path, const char *request_uri)
     goto pathmatched;
   }
 
-  ret = FALSE;
-
 pathmatched:
-  free(uri_path);
   return ret;
 }
 
@@ -248,7 +177,7 @@ static const char *get_top_domain(const char * const domain, size_t *outlen)
   if(outlen)
     *outlen = len;
 
-  return first? first: domain;
+  return first ? first : domain;
 }
 
 /* Avoid C1001, an "internal error" with MSVC14 */
@@ -265,8 +194,9 @@ static size_t cookie_hash_domain(const char *domain, const size_t len)
   size_t h = 5381;
 
   while(domain < end) {
+    size_t j = (size_t)Curl_raw_toupper(*domain++);
     h += h << 5;
-    h ^= Curl_raw_toupper(*domain++);
+    h ^= j;
   }
 
   return (h % COOKIE_HASH_SIZE);
@@ -294,83 +224,42 @@ static size_t cookiehash(const char * const domain)
 /*
  * cookie path sanitize
  */
-static char *sanitize_cookie_path(const char *cookie_path)
+static char *sanitize_cookie_path(const char *cookie_path, size_t len)
 {
-  size_t len;
-  char *new_path = strdup(cookie_path);
-  if(!new_path)
-    return NULL;
-
-  /* some stupid site sends path attribute with '"'. */
-  len = strlen(new_path);
-  if(new_path[0] == '\"') {
-    memmove(new_path, new_path + 1, len);
+  /* some sites send path attribute within '"'. */
+  if(len && (cookie_path[0] == '\"')) {
+    cookie_path++;
     len--;
-  }
-  if(len && (new_path[len - 1] == '\"')) {
-    new_path[--len] = 0x0;
+
+    if(len && (cookie_path[len - 1] == '\"'))
+      len--;
   }
 
   /* RFC6265 5.2.4 The Path Attribute */
-  if(new_path[0] != '/') {
+  if(!len || (cookie_path[0] != '/'))
     /* Let cookie-path be the default-path. */
-    strstore(&new_path, "/", 1);
-    return new_path;
-  }
+    return curlx_strdup("/");
 
+  /* remove trailing slash when path is non-empty */
   /* convert /hoge/ to /hoge */
-  if(len && new_path[len - 1] == '/') {
-    new_path[len - 1] = 0x0;
-  }
+  if(len > 1 && cookie_path[len - 1] == '/')
+    len--;
 
-  return new_path;
-}
-
-/*
- * Load cookies from all given cookie files (CURLOPT_COOKIEFILE).
- *
- * NOTE: OOM or cookie parsing failures are ignored.
- */
-void Curl_cookie_loadfiles(struct Curl_easy *data)
-{
-  struct curl_slist *list = data->set.cookielist;
-  if(list) {
-    Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
-    while(list) {
-      struct CookieInfo *newcookies =
-        Curl_cookie_init(data, list->data, data->cookies,
-                         data->set.cookiesession);
-      if(!newcookies)
-        /*
-         * Failure may be due to OOM or a bad cookie; both are ignored
-         * but only the first should be
-         */
-        infof(data, "ignoring failed cookie_init for %s", list->data);
-      else
-        data->cookies = newcookies;
-      list = list->next;
-    }
-    Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
-  }
+  return curlx_memdup0(cookie_path, len);
 }
 
 /*
  * strstore
  *
- * A thin wrapper around strdup which ensures that any memory allocated at
- * *str will be freed before the string allocated by strdup is stored there.
- * The intended usecase is repeated assignments to the same variable during
- * parsing in a last-wins scenario. The caller is responsible for checking
- * for OOM errors.
+ * A thin wrapper around curlx_memdup0().
  */
-static void strstore(char **str, const char *newstr, size_t len)
+static CURLcode strstore(char **str, const char *newstr, size_t len)
 {
-  DEBUGASSERT(newstr);
   DEBUGASSERT(str);
-  free(*str);
-  *str = Curl_memdup(newstr, len + 1);
-  if(*str)
-    (*str)[len] = 0;
+  *str = curlx_memdup0(newstr, len);
+  if(!*str)
+    return CURLE_OUT_OF_MEMORY;
+  return CURLE_OK;
 }
 
 /*
@@ -378,67 +267,63 @@ static void strstore(char **str, const char *newstr, size_t len)
  *
  * Remove expired cookies from the hash by inspecting the expires timestamp on
  * each cookie in the hash, freeing and deleting any where the timestamp is in
- * the past.  If the cookiejar has recorded the next timestamp at which one or
+ * the past. If the cookiejar has recorded the next timestamp at which one or
  * more cookies expire, then processing will exit early in case this timestamp
  * is in the future.
  */
-static void remove_expired(struct CookieInfo *cookies)
+static void remove_expired(struct CookieInfo *ci)
 {
-  struct Cookie *co, *nx;
+  struct Cookie *co;
   curl_off_t now = (curl_off_t)time(NULL);
   unsigned int i;
 
   /*
    * If the earliest expiration timestamp in the jar is in the future we can
-   * skip scanning the whole jar and instead exit early as there won't be any
-   * cookies to evict.  If we need to evict however, reset the next_expiration
+   * skip scanning the whole jar and instead exit early as there will not be
+   * any cookies to evict. If we need to evict, reset the next_expiration
    * counter in order to track the next one. In case the recorded first
    * expiration is the max offset, then perform the safe fallback of checking
    * all cookies.
    */
-  if(now < cookies->next_expiration &&
-      cookies->next_expiration != CURL_OFF_T_MAX)
+  if(now < ci->next_expiration &&
+     ci->next_expiration != CURL_OFF_T_MAX)
     return;
   else
-    cookies->next_expiration = CURL_OFF_T_MAX;
+    ci->next_expiration = CURL_OFF_T_MAX;
 
   for(i = 0; i < COOKIE_HASH_SIZE; i++) {
-    struct Cookie *pv = NULL;
-    co = cookies->cookies[i];
-    while(co) {
-      nx = co->next;
-      if(co->expires && co->expires < now) {
-        if(!pv) {
-          cookies->cookies[i] = co->next;
+    struct Curl_llist_node *n;
+    struct Curl_llist_node *e = NULL;
+
+    for(n = Curl_llist_head(&ci->cookielist[i]); n; n = e) {
+      co = Curl_node_elem(n);
+      e = Curl_node_next(n);
+      if(co->expires) {
+        if(co->expires < now) {
+          Curl_node_remove(n);
+          freecookie(co, TRUE);
+          ci->numcookies--;
         }
-        else {
-          pv->next = co->next;
-        }
-        cookies->numcookies--;
-        freecookie(co);
+        else if(co->expires < ci->next_expiration)
+          /*
+           * If this cookie has an expiration timestamp earlier than what we
+           * have seen so far then record it for the next round of expirations.
+           */
+          ci->next_expiration = co->expires;
       }
-      else {
-        /*
-         * If this cookie has an expiration timestamp earlier than what we've
-         * seen so far then record it for the next round of expirations.
-         */
-        if(co->expires && co->expires < cookies->next_expiration)
-          cookies->next_expiration = co->expires;
-        pv = co;
-      }
-      co = nx;
     }
   }
 }
 
+#ifndef USE_LIBPSL
 /* Make sure domain contains a dot or is localhost. */
 static bool bad_domain(const char *domain, size_t len)
 {
-  if((len == 9) && strncasecompare(domain, "localhost", 9))
+  if((len == 9) && curl_strnequal(domain, "localhost", 9))
     return FALSE;
   else {
     /* there must be a dot present, but that dot must not be a trailing dot */
-    char *dot = memchr(domain, '.', len);
+    const char *dot = memchr(domain, '.', len);
     if(dot) {
       size_t i = dot - domain;
       if((len - i) > 1)
@@ -448,639 +333,561 @@ static bool bad_domain(const char *domain, size_t len)
   }
   return TRUE;
 }
+#endif
 
 /*
   RFC 6265 section 4.1.1 says a server should accept this range:
 
   cookie-octet    = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
 
-  But Firefox and Chrome as of June 2022 accept space, comma and double-quotes
+  Yet, Firefox and Chrome as of June 2022 accept space, comma and double-quotes
   fine. The prime reason for filtering out control bytes is that some HTTP
   servers return 400 for requests that contain such.
 */
-static int invalid_octets(const char *p)
+static bool invalid_octets(const char *ptr, size_t len)
 {
-  /* Reject all bytes \x01 - \x1f (*except* \x09, TAB) + \x7f */
-  static const char badoctets[] = {
-    "\x01\x02\x03\x04\x05\x06\x07\x08\x0a"
-    "\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14"
-    "\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x7f"
-  };
-  size_t len;
-  /* scan for all the octets that are *not* in cookie-octet */
-  len = strcspn(p, badoctets);
-  return (p[len] != '\0');
+  const unsigned char *p = (const unsigned char *)ptr;
+  /* Reject all bytes \x01 - \x1f + \x7f */
+  while(len && *p) {
+    if((*p < 0x20) || (*p == 0x7f))
+      return TRUE;
+    p++;
+    len--;
+  }
+  return FALSE;
+}
+
+/* The maximum length we accept a date string for the 'expire' keyword. The
+   standard date formats are within the 30 bytes range. This adds an extra
+   margin to make sure it realistically works with what is used out there.
+*/
+#define MAX_DATE_LENGTH 80
+
+#define COOKIE_NAME   0
+#define COOKIE_VALUE  1
+#define COOKIE_DOMAIN 2
+#define COOKIE_PATH   3
+
+#define COOKIE_PIECES 4 /* the list above */
+
+static CURLcode storecookie(struct Cookie *co, const struct Curl_str *cp,
+                            const char *path, const char *domain)
+{
+  CURLcode result;
+  result = strstore(&co->name, curlx_str(&cp[COOKIE_NAME]),
+                    curlx_strlen(&cp[COOKIE_NAME]));
+  if(!result)
+    result = strstore(&co->value, curlx_str(&cp[COOKIE_VALUE]),
+                      curlx_strlen(&cp[COOKIE_VALUE]));
+  if(!result) {
+    size_t plen = 0;
+    if(curlx_strlen(&cp[COOKIE_PATH])) {
+      path = curlx_str(&cp[COOKIE_PATH]);
+      plen = curlx_strlen(&cp[COOKIE_PATH]);
+    }
+    else if(path) {
+      /* No path was given in the header line, set the default */
+      const char *endslash = strrchr(path, '/');
+      if(endslash)
+        plen = endslash - path + 1; /* include end slash */
+      else
+        plen = strlen(path);
+    }
+
+    if(path) {
+      co->path = sanitize_cookie_path(path, plen);
+      if(!co->path)
+        result = CURLE_OUT_OF_MEMORY;
+    }
+  }
+  if(!result) {
+    if(curlx_strlen(&cp[COOKIE_DOMAIN]))
+      result = strstore(&co->domain, curlx_str(&cp[COOKIE_DOMAIN]),
+                        curlx_strlen(&cp[COOKIE_DOMAIN]));
+    else if(domain) {
+      /* no domain was given in the header line, set the default */
+      co->domain = curlx_strdup(domain);
+      if(!co->domain)
+        result = CURLE_OUT_OF_MEMORY;
+    }
+  }
+  return result;
 }
 
 /*
- * Curl_cookie_add
- *
- * Add a single cookie line to the cookie keeping object. Be aware that
- * sometimes we get an IP-only host name, and that might also be a numerical
- * IPv6 address.
- *
- * Returns NULL on out of memory or invalid cookie. This is suboptimal,
- * as they should be treated separately.
+ * Parse the first name/value pair of the cookie header, which is the actual
+ * cookie name and value.
  */
-struct Cookie *
-Curl_cookie_add(struct Curl_easy *data,
-                struct CookieInfo *c,
-                bool httpheader, /* TRUE if HTTP header-style line */
-                bool noexpire, /* if TRUE, skip remove_expired() */
-                char *lineptr,   /* first character of the line */
-                const char *domain, /* default domain */
-                const char *path,   /* full path used when this cookie is set,
-                                       used to get default path for the cookie
-                                       unless set */
-                bool secure)  /* TRUE if connection is over secure origin */
+static bool parse_first_pair(struct Curl_easy *data, struct Cookie *co,
+                             struct Curl_str *cookie,
+                             struct Curl_str *name,
+                             struct Curl_str *val,
+                             bool sep)
 {
-  struct Cookie *clist;
-  struct Cookie *co;
-  struct Cookie *lastc = NULL;
-  struct Cookie *replace_co = NULL;
-  struct Cookie *replace_clist = NULL;
-  time_t now = time(NULL);
-  bool replace_old = FALSE;
-  bool badcookie = FALSE; /* cookies are good by default. mmmmm yummy */
-  size_t myhash;
+  /* The first name/value pair is the actual cookie name */
+  if(!sep || !curlx_strlen(name)) {
+    infof(data, "invalid cookie, dropped");
+    return FALSE;
+  }
 
-  DEBUGASSERT(data);
-  DEBUGASSERT(MAX_SET_COOKIE_AMOUNT <= 255); /* counter is an unsigned char */
-  if(data->req.setcookies >= MAX_SET_COOKIE_AMOUNT)
-    return NULL;
+  /*
+   * Check for too long individual name or contents. Chrome and Firefox
+   * support 4095 or 4096 bytes combo
+   */
+  if((curlx_strlen(name) + curlx_strlen(val)) > MAX_NAME) {
+    infof(data, "oversized cookie dropped, name/val %zu + %zu bytes",
+          curlx_strlen(name), curlx_strlen(val));
+    return FALSE;
+  }
 
-  /* First, alloc and init a new struct for it */
-  co = calloc(1, sizeof(struct Cookie));
-  if(!co)
-    return NULL; /* bail out if we're this low on memory */
+  /* Check if we have a reserved prefix set. */
+  if(!strncmp("__Secure-", curlx_str(name), 9))
+    co->prefix_secure = TRUE;
+  else if(!strncmp("__Host-", curlx_str(name), 7))
+    co->prefix_host = TRUE;
 
-  if(httpheader) {
-    /* This line was read off an HTTP-header */
-    const char *ptr;
+  cookie[COOKIE_NAME] = *name;
+  cookie[COOKIE_VALUE] = *val;
+  return TRUE;
+}
 
-    size_t linelength = strlen(lineptr);
-    if(linelength > MAX_COOKIE_LINE) {
-      /* discard overly long lines at once */
-      free(co);
-      return NULL;
+static bool parse_flag(struct Curl_easy *data, struct Cookie *co,
+                       const struct CookieInfo *ci,
+                       struct Curl_str *name, bool secure)
+{
+  /*
+   * secure cookies are only allowed to be set when the connection is
+   * using a secure protocol, or when the cookie is being set by
+   * reading from file
+   */
+  if(curlx_str_casecompare(name, "secure")) {
+    if(secure || !ci->running)
+      co->secure = TRUE;
+    else {
+      infof(data, "skipped cookie because not 'secure'");
+      return FALSE;
     }
+  }
+  else if(curlx_str_casecompare(name, "httponly"))
+    co->httponly = TRUE;
 
-    ptr = lineptr;
-    do {
-      size_t vlen;
-      size_t nlen;
+  return TRUE;
+}
 
-      while(*ptr && ISBLANK(*ptr))
-        ptr++;
+static bool parse_domain(struct Curl_easy *data, struct Cookie *co,
+                         struct Curl_str *cookie_domain,
+                         struct Curl_str *val,
+                         const char **domainp)
+{
+  bool is_ip;
+  const char *domain = *domainp;
+  const char *v = curlx_str(val);
+  /*
+   * Now, we make sure that our host is within the given domain, or
+   * the given domain is not valid and thus cannot be set.
+   */
 
-      /* we have a <name>=<value> pair or a stand-alone word here */
-      nlen = strcspn(ptr, ";\t\r\n=");
-      if(nlen) {
-        bool done = FALSE;
-        bool sep = FALSE;
-        const char *namep = ptr;
-        const char *valuep;
-
-        ptr += nlen;
-
-        /* trim trailing spaces and tabs after name */
-        while(nlen && ISBLANK(namep[nlen - 1]))
-          nlen--;
-
-        if(*ptr == '=') {
-          vlen = strcspn(++ptr, ";\r\n");
-          valuep = ptr;
-          sep = TRUE;
-          ptr = &valuep[vlen];
-
-          /* Strip off trailing whitespace from the value */
-          while(vlen && ISBLANK(valuep[vlen-1]))
-            vlen--;
-
-          /* Skip leading whitespace from the value */
-          while(vlen && ISBLANK(*valuep)) {
-            valuep++;
-            vlen--;
-          }
-
-          /* Reject cookies with a TAB inside the value */
-          if(memchr(valuep, '\t', vlen)) {
-            freecookie(co);
-            infof(data, "cookie contains TAB, dropping");
-            return NULL;
-          }
-        }
-        else {
-          valuep = NULL;
-          vlen = 0;
-        }
-
-        /*
-         * Check for too long individual name or contents, or too long
-         * combination of name + contents. Chrome and Firefox support 4095 or
-         * 4096 bytes combo
-         */
-        if(nlen >= (MAX_NAME-1) || vlen >= (MAX_NAME-1) ||
-           ((nlen + vlen) > MAX_NAME)) {
-          freecookie(co);
-          infof(data, "oversized cookie dropped, name/val %zu + %zu bytes",
-                nlen, vlen);
-          return NULL;
-        }
-
-        /*
-         * Check if we have a reserved prefix set before anything else, as we
-         * otherwise have to test for the prefix in both the cookie name and
-         * "the rest". Prefixes must start with '__' and end with a '-', so
-         * only test for names where that can possibly be true.
-         */
-        if(nlen >= 7 && namep[0] == '_' && namep[1] == '_') {
-          if(strncasecompare("__Secure-", namep, 9))
-            co->prefix |= COOKIE_PREFIX__SECURE;
-          else if(strncasecompare("__Host-", namep, 7))
-            co->prefix |= COOKIE_PREFIX__HOST;
-        }
-
-        /*
-         * Use strstore() below to properly deal with received cookie
-         * headers that have the same string property set more than once,
-         * and then we use the last one.
-         */
-
-        if(!co->name) {
-          /* The very first name/value pair is the actual cookie name */
-          if(!sep) {
-            /* Bad name/value pair. */
-            badcookie = TRUE;
-            break;
-          }
-          strstore(&co->name, namep, nlen);
-          strstore(&co->value, valuep, vlen);
-          done = TRUE;
-          if(!co->name || !co->value) {
-            badcookie = TRUE;
-            break;
-          }
-          if(invalid_octets(co->value) || invalid_octets(co->name)) {
-            infof(data, "invalid octets in name/value, cookie dropped");
-            badcookie = TRUE;
-            break;
-          }
-        }
-        else if(!vlen) {
-          /*
-           * this was a "<name>=" with no content, and we must allow
-           * 'secure' and 'httponly' specified this weirdly
-           */
-          done = TRUE;
-          /*
-           * secure cookies are only allowed to be set when the connection is
-           * using a secure protocol, or when the cookie is being set by
-           * reading from file
-           */
-          if((nlen == 6) && strncasecompare("secure", namep, 6)) {
-            if(secure || !c->running) {
-              co->secure = TRUE;
-            }
-            else {
-              badcookie = TRUE;
-              break;
-            }
-          }
-          else if((nlen == 8) && strncasecompare("httponly", namep, 8))
-            co->httponly = TRUE;
-          else if(sep)
-            /* there was a '=' so we're not done parsing this field */
-            done = FALSE;
-        }
-        if(done)
-          ;
-        else if((nlen == 4) && strncasecompare("path", namep, 4)) {
-          strstore(&co->path, valuep, vlen);
-          if(!co->path) {
-            badcookie = TRUE; /* out of memory bad */
-            break;
-          }
-          free(co->spath); /* if this is set again */
-          co->spath = sanitize_cookie_path(co->path);
-          if(!co->spath) {
-            badcookie = TRUE; /* out of memory bad */
-            break;
-          }
-        }
-        else if((nlen == 6) &&
-                strncasecompare("domain", namep, 6) && vlen) {
-          bool is_ip;
-
-          /*
-           * Now, we make sure that our host is within the given domain, or
-           * the given domain is not valid and thus cannot be set.
-           */
-
-          if('.' == valuep[0]) {
-            valuep++; /* ignore preceding dot */
-            vlen--;
-          }
+  if('.' == *v)
+    curlx_str_nudge(val, 1);
 
 #ifndef USE_LIBPSL
-          /*
-           * Without PSL we don't know when the incoming cookie is set on a
-           * TLD or otherwise "protected" suffix. To reduce risk, we require a
-           * dot OR the exact host name being "localhost".
-           */
-          if(bad_domain(valuep, vlen))
-            domain = ":";
+  /*
+   * Without PSL we do not know when the incoming cookie is set on a
+   * TLD or otherwise "protected" suffix. To reduce risk, we require a
+   * dot OR the exact hostname being "localhost".
+   */
+  if(bad_domain(curlx_str(val), curlx_strlen(val))) {
+    *domainp = ":";
+    domain = ":";
+  }
 #endif
 
-          is_ip = Curl_host_is_ipnum(domain ? domain : valuep);
+  is_ip = Curl_host_is_ipnum(domain ? domain : curlx_str(val));
 
-          if(!domain
-             || (is_ip && !strncmp(valuep, domain, vlen) &&
-                 (vlen == strlen(domain)))
-             || (!is_ip && cookie_tailmatch(valuep, vlen, domain))) {
-            strstore(&co->domain, valuep, vlen);
-            if(!co->domain) {
-              badcookie = TRUE;
-              break;
-            }
-            if(!is_ip)
-              co->tailmatch = TRUE; /* we always do that if the domain name was
-                                       given */
-          }
-          else {
-            /*
-             * We did not get a tailmatch and then the attempted set domain is
-             * not a domain to which the current host belongs. Mark as bad.
-             */
-            badcookie = TRUE;
-            infof(data, "skipped cookie with bad tailmatch domain: %s",
-                  valuep);
-          }
-        }
-        else if((nlen == 7) && strncasecompare("version", namep, 7)) {
-          strstore(&co->version, valuep, vlen);
-          if(!co->version) {
-            badcookie = TRUE;
-            break;
-          }
-        }
-        else if((nlen == 7) && strncasecompare("max-age", namep, 7)) {
-          /*
-           * Defined in RFC2109:
-           *
-           * Optional.  The Max-Age attribute defines the lifetime of the
-           * cookie, in seconds.  The delta-seconds value is a decimal non-
-           * negative integer.  After delta-seconds seconds elapse, the
-           * client should discard the cookie.  A value of zero means the
-           * cookie should be discarded immediately.
-           */
-          strstore(&co->maxage, valuep, vlen);
-          if(!co->maxage) {
-            badcookie = TRUE;
-            break;
-          }
-        }
-        else if((nlen == 7) && strncasecompare("expires", namep, 7)) {
-          strstore(&co->expirestr, valuep, vlen);
-          if(!co->expirestr) {
-            badcookie = TRUE;
-            break;
-          }
-        }
-
-        /*
-         * Else, this is the second (or more) name we don't know about!
-         */
-      }
-      else {
-        /* this is an "illegal" <what>=<this> pair */
-      }
-
-      while(*ptr && ISBLANK(*ptr))
-        ptr++;
-      if(*ptr == ';')
-        ptr++;
-      else
-        break;
-    } while(1);
-
-    if(co->maxage) {
-      CURLofft offt;
-      offt = curlx_strtoofft((*co->maxage == '\"')?
-                             &co->maxage[1]:&co->maxage[0], NULL, 10,
-                             &co->expires);
-      switch(offt) {
-      case CURL_OFFT_FLOW:
-        /* overflow, used max value */
-        co->expires = CURL_OFF_T_MAX;
-        break;
-      case CURL_OFFT_INVAL:
-        /* negative or otherwise bad, expire */
-        co->expires = 1;
-        break;
-      case CURL_OFFT_OK:
-        if(!co->expires)
-          /* already expired */
-          co->expires = 1;
-        else if(CURL_OFF_T_MAX - now < co->expires)
-          /* would overflow */
-          co->expires = CURL_OFF_T_MAX;
-        else
-          co->expires += now;
-        break;
-      }
-    }
-    else if(co->expirestr) {
-      /*
-       * Note that if the date couldn't get parsed for whatever reason, the
-       * cookie will be treated as a session cookie
-       */
-      co->expires = Curl_getdate_capped(co->expirestr);
-
-      /*
-       * Session cookies have expires set to 0 so if we get that back from the
-       * date parser let's add a second to make it a non-session cookie
-       */
-      if(co->expires == 0)
-        co->expires = 1;
-      else if(co->expires < 0)
-        co->expires = 0;
-    }
-
-    if(!badcookie && !co->domain) {
-      if(domain) {
-        /* no domain was given in the header line, set the default */
-        co->domain = strdup(domain);
-        if(!co->domain)
-          badcookie = TRUE;
-      }
-    }
-
-    if(!badcookie && !co->path && path) {
-      /*
-       * No path was given in the header line, set the default.  Note that the
-       * passed-in path to this function MAY have a '?' and following part that
-       * MUST NOT be stored as part of the path.
-       */
-      char *queryp = strchr(path, '?');
-
-      /*
-       * queryp is where the interesting part of the path ends, so now we
-       * want to the find the last
-       */
-      char *endslash;
-      if(!queryp)
-        endslash = strrchr(path, '/');
-      else
-        endslash = memrchr(path, '/', (queryp - path));
-      if(endslash) {
-        size_t pathlen = (endslash-path + 1); /* include end slash */
-        co->path = malloc(pathlen + 1); /* one extra for the zero byte */
-        if(co->path) {
-          memcpy(co->path, path, pathlen);
-          co->path[pathlen] = 0; /* null-terminate */
-          co->spath = sanitize_cookie_path(co->path);
-          if(!co->spath)
-            badcookie = TRUE; /* out of memory bad */
-        }
-        else
-          badcookie = TRUE;
-      }
-    }
-
-    /*
-     * If we didn't get a cookie name, or a bad one, the this is an illegal
-     * line so bail out.
-     */
-    if(badcookie || !co->name) {
-      freecookie(co);
-      return NULL;
-    }
-    data->req.setcookies++;
+  if(!domain ||
+     (is_ip &&
+      !strncmp(curlx_str(val), domain, curlx_strlen(val)) &&
+      (curlx_strlen(val) == strlen(domain))) ||
+     (!is_ip && cookie_tailmatch(curlx_str(val),
+                                  curlx_strlen(val), domain))) {
+    *cookie_domain = *val;
+    if(!is_ip)
+      co->tailmatch = TRUE; /* we always do that if the domain name was
+                               given */
   }
   else {
     /*
-     * This line is NOT an HTTP header style line, we do offer support for
-     * reading the odd netscape cookies-file format here
+     * We did not get a tailmatch and then the attempted set domain is
+     * not a domain to which the current host belongs. Mark as bad.
      */
-    char *ptr;
-    char *firstptr;
-    char *tok_buf = NULL;
-    int fields;
+    infof(data, "skipped cookie with bad tailmatch domain: %s",
+          curlx_str(val));
+    return FALSE;
+  }
+  return TRUE;
+}
 
-    /*
-     * IE introduced HTTP-only cookies to prevent XSS attacks. Cookies marked
-     * with httpOnly after the domain name are not accessible from javascripts,
-     * but since curl does not operate at javascript level, we include them
-     * anyway. In Firefox's cookie files, these lines are preceded with
-     * #HttpOnly_ and then everything is as usual, so we skip 10 characters of
-     * the line..
-     */
-    if(strncmp(lineptr, "#HttpOnly_", 10) == 0) {
-      lineptr += 10;
-      co->httponly = TRUE;
+static void parse_maxage(struct Cookie *co, struct Curl_str *val,
+                         time_t *nowp)
+{
+  int rc;
+  const char *maxage = curlx_str(val);
+  if(*maxage == '\"')
+    maxage++;
+  rc = curlx_str_number(&maxage, &co->expires, CURL_OFF_T_MAX);
+  if(!*nowp)
+    *nowp = time(NULL);
+  switch(rc) {
+  case STRE_OVERFLOW:
+    /* overflow, used max value */
+    co->expires = CURL_OFF_T_MAX;
+    break;
+  default:
+    /* negative or otherwise bad, expire */
+    co->expires = 1;
+    break;
+  case STRE_OK:
+    if(!co->expires)
+      co->expires = 1; /* expire now */
+    else if(CURL_OFF_T_MAX - *nowp < co->expires)
+      /* would overflow */
+      co->expires = CURL_OFF_T_MAX;
+    else
+      co->expires += *nowp;
+    break;
+  }
+  cap_expires(*nowp, co);
+}
+
+static void parse_expires(struct Cookie *co, struct Curl_str *val,
+                          time_t *nowp)
+{
+  /*
+   * Let max-age have priority.
+   *
+   * If the date cannot get parsed for whatever reason, the cookie
+   * will be treated as a session cookie
+   */
+  if(!co->expires && (curlx_strlen(val) < MAX_DATE_LENGTH)) {
+    char dbuf[MAX_DATE_LENGTH + 1];
+    time_t date = 0;
+    memcpy(dbuf, curlx_str(val), curlx_strlen(val));
+    dbuf[curlx_strlen(val)] = 0;
+    if(!Curl_getdate_capped(dbuf, &date)) {
+      if(!date)
+        date++;
+      co->expires = (curl_off_t)date;
     }
+    else
+      co->expires = 0;
+    if(!*nowp)
+      *nowp = time(NULL);
+    cap_expires(*nowp, co);
+  }
+}
 
-    if(lineptr[0]=='#') {
-      /* don't even try the comments */
-      free(co);
-      return NULL;
-    }
-    /* strip off the possible end-of-line characters */
-    ptr = strchr(lineptr, '\r');
-    if(ptr)
-      *ptr = 0; /* clear it */
-    ptr = strchr(lineptr, '\n');
-    if(ptr)
-      *ptr = 0; /* clear it */
+/* this function returns errors on OOM etc, not for cookie format problems */
+static CURLcode
+parse_cookie_header(struct Curl_easy *data,
+                    struct Cookie *co,
+                    const struct CookieInfo *ci,
+                    bool *okay, /* if the cookie was fine */
+                    const char *ptr, /* the header */
+                    const char *domain, /* default domain */
+                    /* full path used when this cookie is set */
+                    const char *path,
+                    bool secure_origin)
+{
+  /* This line was read off an HTTP-header */
+  time_t now = 0;
+  size_t linelength = strlen(ptr);
+  CURLcode result = CURLE_OK;
+  struct Curl_str cookie[COOKIE_PIECES];
+  *okay = FALSE;
+  if(linelength > MAX_COOKIE_LINE)
+    /* discard overly long lines at once */
+    return CURLE_OK;
 
-    firstptr = strtok_r(lineptr, "\t", &tok_buf); /* tokenize it on the TAB */
+  /* memset instead of initializer because gcc 4.8.1 is silly */
+  memset(cookie, 0, sizeof(cookie));
+  do {
+    struct Curl_str name;
 
-    /*
-     * Now loop through the fields and init the struct we already have
-     * allocated
-     */
-    for(ptr = firstptr, fields = 0; ptr && !badcookie;
-        ptr = strtok_r(NULL, "\t", &tok_buf), fields++) {
-      switch(fields) {
-      case 0:
-        if(ptr[0]=='.') /* skip preceding dots */
-          ptr++;
-        co->domain = strdup(ptr);
-        if(!co->domain)
-          badcookie = TRUE;
-        break;
-      case 1:
-        /*
-         * flag: A TRUE/FALSE value indicating if all machines within a given
-         * domain can access the variable. Set TRUE when the cookie says
-         * .domain.com and to false when the domain is complete www.domain.com
-         */
-        co->tailmatch = strcasecompare(ptr, "TRUE")?TRUE:FALSE;
-        break;
-      case 2:
-        /* The file format allows the path field to remain not filled in */
-        if(strcmp("TRUE", ptr) && strcmp("FALSE", ptr)) {
-          /* only if the path doesn't look like a boolean option! */
-          co->path = strdup(ptr);
-          if(!co->path)
-            badcookie = TRUE;
-          else {
-            co->spath = sanitize_cookie_path(co->path);
-            if(!co->spath) {
-              badcookie = TRUE; /* out of memory bad */
-            }
-          }
-          break;
-        }
-        /* this doesn't look like a path, make one up! */
-        co->path = strdup("/");
-        if(!co->path)
-          badcookie = TRUE;
-        co->spath = strdup("/");
-        if(!co->spath)
-          badcookie = TRUE;
-        fields++; /* add a field and fall down to secure */
-        /* FALLTHROUGH */
-      case 3:
-        co->secure = FALSE;
-        if(strcasecompare(ptr, "TRUE")) {
-          if(secure || c->running)
-            co->secure = TRUE;
-          else
-            badcookie = TRUE;
-        }
-        break;
-      case 4:
-        if(curlx_strtoofft(ptr, NULL, 10, &co->expires))
-          badcookie = TRUE;
-        break;
-      case 5:
-        co->name = strdup(ptr);
-        if(!co->name)
-          badcookie = TRUE;
-        else {
-          /* For Netscape file format cookies we check prefix on the name */
-          if(strncasecompare("__Secure-", co->name, 9))
-            co->prefix |= COOKIE_PREFIX__SECURE;
-          else if(strncasecompare("__Host-", co->name, 7))
-            co->prefix |= COOKIE_PREFIX__HOST;
-        }
-        break;
-      case 6:
-        co->value = strdup(ptr);
-        if(!co->value)
-          badcookie = TRUE;
-        break;
+    /* we have a <name>=<value> pair or a stand-alone word here */
+    if(!curlx_str_cspn(&ptr, &name, ";\t\r\n=")) {
+      struct Curl_str val;
+      bool sep = FALSE;
+      curlx_str_trimblanks(&name);
+
+      if(invalid_octets(curlx_str(&name), curlx_strlen(&name))) {
+        infof(data, "invalid octets in name, cookie dropped");
+        return CURLE_OK;
+      }
+
+      if(!curlx_str_single(&ptr, '=')) {
+        sep = TRUE; /* a '=' was used */
+        if(!curlx_str_cspn(&ptr, &val, ";\r\n"))
+          curlx_str_trimblanks(&val);
+
+        if(invalid_octets(curlx_str(&val), curlx_strlen(&val))) {
+          infof(data, "invalid octets in value, cookie dropped");
+          return CURLE_OK;
+        }
       }
-    }
-    if(6 == fields) {
-      /* we got a cookie with blank contents, fix it */
-      co->value = strdup("");
-      if(!co->value)
-        badcookie = TRUE;
       else
-        fields++;
-    }
-
-    if(!badcookie && (7 != fields))
-      /* we did not find the sufficient number of fields */
-      badcookie = TRUE;
-
-    if(badcookie) {
-      freecookie(co);
-      return NULL;
+        curlx_str_init(&val);
+
+      if(!curlx_strlen(&cookie[COOKIE_NAME])) {
+        if(!parse_first_pair(data, co, cookie, &name, &val, sep))
+          return CURLE_OK;
+      }
+      else if(!sep) {
+        if(!parse_flag(data, co, ci, &name, secure_origin))
+          return CURLE_OK;
+      }
+      else if(curlx_str_casecompare(&name, "path"))
+        cookie[COOKIE_PATH] = val;
+      else if(curlx_str_casecompare(&name, "domain") && curlx_strlen(&val)) {
+        if(!parse_domain(data, co, &cookie[COOKIE_DOMAIN], &val, &domain))
+          return CURLE_OK;
+      }
+      else if(curlx_str_casecompare(&name, "max-age") && curlx_strlen(&val))
+        parse_maxage(co, &val, &now);
+      else if(curlx_str_casecompare(&name, "expires") && curlx_strlen(&val))
+        parse_expires(co, &val, &now);
     }
+  } while(!curlx_str_single(&ptr, ';'));
 
+  if(curlx_strlen(&cookie[COOKIE_NAME])) {
+    /* the header was fine, now store the data */
+    result = storecookie(co, &cookie[0], path, domain);
+    if(!result)
+      *okay = TRUE;
   }
+  return result;
+}
 
-  if(co->prefix & COOKIE_PREFIX__SECURE) {
-    /* The __Secure- prefix only requires that the cookie be set secure */
-    if(!co->secure) {
-      freecookie(co);
-      return NULL;
-    }
-  }
-  if(co->prefix & COOKIE_PREFIX__HOST) {
-    /*
-     * The __Host- prefix requires the cookie to be secure, have a "/" path
-     * and not have a domain set.
-     */
-    if(co->secure && co->path && strcmp(co->path, "/") == 0 && !co->tailmatch)
-      ;
-    else {
-      freecookie(co);
-      return NULL;
-    }
-  }
-
-  if(!c->running &&    /* read from a file */
-     c->newsession &&  /* clean session cookies */
-     !co->expires) {   /* this is a session cookie since it doesn't expire! */
-    freecookie(co);
-    return NULL;
-  }
-
-  co->livecookie = c->running;
-  co->creationtime = ++c->lastct;
+static CURLcode parse_netscape(struct Cookie *co,
+                               const struct CookieInfo *ci,
+                               bool *okay,
+                               const char *lineptr,
+                               bool secure_origin)
+{
+  /*
+   * This line is NOT an HTTP header style line, we do offer support for
+   * reading the odd netscape cookies-file format here
+   */
+  const char *ptr, *next;
+  int fields;
+  size_t len;
+  *okay = FALSE;
 
   /*
-   * Now we have parsed the incoming line, we must now check if this supersedes
-   * an already existing cookie, which it may if the previous have the same
-   * domain and path as this.
+   * In 2008, Internet Explorer introduced HTTP-only cookies to prevent XSS
+   * attacks. Cookies marked httpOnly are not accessible to JavaScript. In
+   * Firefox's cookie files, they are prefixed #HttpOnly_ and the rest
+   * remains as usual, so we skip 10 characters of the line.
    */
+  if(!strncmp(lineptr, "#HttpOnly_", 10)) {
+    lineptr += 10;
+    co->httponly = TRUE;
+  }
 
-  /* at first, remove expired cookies */
-  if(!noexpire)
-    remove_expired(c);
+  if(lineptr[0] == '#')
+    /* do not even try the comments */
+    return CURLE_OK;
 
+  /*
+   * Now loop through the fields and init the struct we already have
+   * allocated
+   */
+  fields = 0;
+  for(next = lineptr; next; fields++) {
+    ptr = next;
+    len = strcspn(ptr, "\t\r\n");
+    next = (ptr[len] == '\t' ? &ptr[len + 1] : NULL);
+    switch(fields) {
+    case 0:
+      if(ptr[0] == '.') { /* skip preceding dots */
+        ptr++;
+        len--;
+      }
+      co->domain = curlx_memdup0(ptr, len);
+      if(!co->domain)
+        return CURLE_OUT_OF_MEMORY;
+      break;
+    case 1:
+      /*
+       * flag: A TRUE/FALSE value indicating if all machines within a given
+       * domain can access the variable. Set TRUE when the cookie says
+       * .example.com and to false when the domain is complete www.example.com
+       */
+      co->tailmatch = !!curl_strnequal(ptr, "TRUE", len);
+      break;
+    case 2:
+      /* The file format allows the path field to remain not filled in */
+      if(strncmp("TRUE", ptr, len) && strncmp("FALSE", ptr, len)) {
+        /* only if the path does not look like a boolean option! */
+        co->path = sanitize_cookie_path(ptr, len);
+        if(!co->path)
+          return CURLE_OUT_OF_MEMORY;
+        break;
+      }
+      else {
+        /* this does not look like a path, make one up! */
+        co->path = curlx_strdup("/");
+        if(!co->path)
+          return CURLE_OUT_OF_MEMORY;
+      }
+      fields++; /* add a field and fall down to secure */
+      FALLTHROUGH();
+    case 3:
+      co->secure = FALSE;
+      if(curl_strnequal(ptr, "TRUE", len)) {
+        if(secure_origin || ci->running)
+          co->secure = TRUE;
+        else
+          return CURLE_OK;
+      }
+      break;
+    case 4:
+      if(curlx_str_number(&ptr, &co->expires, CURL_OFF_T_MAX))
+        return CURLE_OK;
+      break;
+    case 5:
+      co->name = curlx_memdup0(ptr, len);
+      if(!co->name)
+        return CURLE_OUT_OF_MEMORY;
+      else {
+        /* For Netscape file format cookies we check prefix on the name.
+           These prefixes are matched case sensitively, same as on the
+           header path and as the 6265bis document specifies. */
+        if(!strncmp("__Secure-", co->name, 9))
+          co->prefix_secure = TRUE;
+        else if(!strncmp("__Host-", co->name, 7))
+          co->prefix_host = TRUE;
+      }
+      break;
+    case 6:
+      co->value = curlx_memdup0(ptr, len);
+      if(!co->value)
+        return CURLE_OUT_OF_MEMORY;
+      break;
+    }
+  }
+  if(fields == 6) {
+    /* we got a cookie with blank contents, fix it */
+    co->value = curlx_strdup("");
+    if(!co->value)
+      return CURLE_OUT_OF_MEMORY;
+    else
+      fields++;
+  }
+
+  if(fields != 7)
+    /* we did not find the sufficient number of fields */
+    return CURLE_OK;
+
+  /* Reject control octets in the name or value, matching the filtering done
+     for cookies set over HTTP. A cookie loaded from a file is later sent in
+     request headers, so the same bytes that make a server reject a request
+     must not slip in through the file. */
+  if(invalid_octets(co->name, strlen(co->name)) ||
+     invalid_octets(co->value, strlen(co->value)))
+    return CURLE_OK;
+
+  *okay = TRUE;
+  return CURLE_OK;
+}
+
+static bool is_public_suffix(struct Curl_easy *data,
+                             const struct Cookie *co,
+                             const char *domain)
+{
 #ifdef USE_LIBPSL
   /*
    * Check if the domain is a Public Suffix and if yes, ignore the cookie. We
-   * must also check that the data handle isn't NULL since the psl code will
+   * must also check that the data handle is not NULL since the psl code will
    * dereference it.
    */
+  DEBUGF(infof(data, "PSL check set-cookie '%s' for domain=%s in %s",
+               co->name, co->domain, domain));
   if(data && (domain && co->domain && !Curl_host_is_ipnum(co->domain))) {
-    const psl_ctx_t *psl = Curl_psl_use(data);
-    int acceptable;
+    bool acceptable = FALSE;
+    char lcase[256];
+    char lcookie[256];
+    size_t dlen = strlen(domain);
+    size_t clen = strlen(co->domain);
 
-    if(psl) {
-      acceptable = psl_is_cookie_domain_acceptable(psl, domain, co->domain);
-      Curl_psl_release(data);
+    /* trim trailing dots */
+    if(dlen && (domain[dlen - 1] == '.'))
+      dlen--;
+    if(clen && (co->domain[clen - 1] == '.'))
+      clen--;
+
+    if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) {
+      const psl_ctx_t *psl = Curl_psl_use(data);
+      if(psl) {
+        /* the PSL check requires lowercase domain name and pattern */
+        Curl_strntolower(lcase, domain, dlen);
+        lcase[dlen] = 0;
+        Curl_strntolower(lcookie, co->domain, clen);
+        lcookie[clen] = 0;
+        acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie);
+        Curl_psl_release(data);
+      }
+      else
+        infof(data, "libpsl problem, rejecting cookie for safety");
     }
-    else
-      acceptable = !bad_domain(domain, strlen(domain));
 
     if(!acceptable) {
       infof(data, "cookie '%s' dropped, domain '%s' must not "
-                  "set cookies for '%s'", co->name, domain, co->domain);
-      freecookie(co);
-      return NULL;
+            "set cookies for '%s'", co->name, domain, co->domain);
+      return TRUE;
     }
   }
+#else
+  (void)data;
+  (void)co;
+  (void)domain;
+  DEBUGF(infof(data, "NO PSL to check set-cookie '%s' for domain=%s in %s",
+               co->name, co->domain, domain));
 #endif
+  return FALSE;
+}
 
-  /* A non-secure cookie may not overlay an existing secure cookie. */
-  myhash = cookiehash(co->domain);
-  clist = c->cookies[myhash];
-  while(clist) {
-    if(strcasecompare(clist->name, co->name)) {
+/* returns TRUE when replaced */
+static bool replace_existing(struct Curl_easy *data,
+                             struct Cookie *co,
+                             const struct CookieInfo *ci,
+                             bool secure,
+                             bool *replacep)
+{
+  bool replace_old = FALSE;
+  struct Curl_llist_node *replace_n = NULL;
+  struct Curl_llist_node *n;
+  size_t myhash = cookiehash(co->domain);
+  for(n = Curl_llist_head(&ci->cookielist[myhash]); n; n = Curl_node_next(n)) {
+    struct Cookie *clist = Curl_node_elem(n);
+    if(!strcmp(clist->name, co->name)) {
       /* the names are identical */
       bool matching_domains = FALSE;
 
       if(clist->domain && co->domain) {
-        if(strcasecompare(clist->domain, co->domain))
-          /* The domains are identical */
+        if(cookie_tailmatch(clist->domain, strlen(clist->domain),
+                            co->domain) ||
+           cookie_tailmatch(co->domain, strlen(co->domain), clist->domain))
+          /* The existing one is a tail of the new or vice versa */
           matching_domains = TRUE;
       }
       else if(!clist->domain && !co->domain)
         matching_domains = TRUE;
 
       if(matching_domains && /* the domains were identical */
-         clist->spath && co->spath && /* both have paths */
+         clist->path && co->path && /* both have paths */
          clist->secure && !co->secure && !secure) {
         size_t cllen;
-        const char *sep;
+        const char *sep = NULL;
 
         /*
          * A non-secure cookie may not overlay an existing secure cookie.
@@ -1089,28 +896,28 @@ Curl_cookie_add(struct Curl_easy *data,
          * "/loginhelper" is ok.
          */
 
-        sep = strchr(clist->spath + 1, '/');
-
+        DEBUGASSERT(clist->path[0]);
+        if(clist->path[0])
+          sep = strchr(clist->path + 1, '/');
         if(sep)
-          cllen = sep - clist->spath;
+          cllen = sep - clist->path;
         else
-          cllen = strlen(clist->spath);
+          cllen = strlen(clist->path);
 
-        if(strncasecompare(clist->spath, co->spath, cllen)) {
+        if(!strncmp(clist->path, co->path, cllen)) {
           infof(data, "cookie '%s' for domain '%s' dropped, would "
                 "overlay an existing cookie", co->name, co->domain);
-          freecookie(co);
-          return NULL;
+          return FALSE;
         }
       }
     }
 
-    if(!replace_co && strcasecompare(clist->name, co->name)) {
+    if(!replace_n && !strcmp(clist->name, co->name)) {
       /* the names are identical */
 
       if(clist->domain && co->domain) {
-        if(strcasecompare(clist->domain, co->domain) &&
-          (clist->tailmatch == co->tailmatch))
+        if(curl_strequal(clist->domain, co->domain) &&
+           (clist->tailmatch == co->tailmatch))
           /* The domains are identical */
           replace_old = TRUE;
       }
@@ -1120,81 +927,161 @@ Curl_cookie_add(struct Curl_easy *data,
       if(replace_old) {
         /* the domains were identical */
 
-        if(clist->spath && co->spath &&
-           !strcasecompare(clist->spath, co->spath))
+        if(clist->path && co->path &&
+           strcmp(clist->path, co->path))
           replace_old = FALSE;
-        else if(!clist->spath != !co->spath)
+        else if(!clist->path != !co->path)
           replace_old = FALSE;
       }
 
       if(replace_old && !co->livecookie && clist->livecookie) {
         /*
-         * Both cookies matched fine, except that the already present cookie is
-         * "live", which means it was set from a header, while the new one was
-         * read from a file and thus isn't "live". "live" cookies are preferred
-         * so the new cookie is freed.
+         * Both cookies matched fine, except that the already present cookie
+         * is "live", which means it was set from a header, while the new one
+         * was read from a file and thus is not "live". "live" cookies are
+         * preferred so the new cookie is freed.
          */
-        freecookie(co);
-        return NULL;
-      }
-      if(replace_old) {
-        replace_co = co;
-        replace_clist = clist;
+        return FALSE;
       }
+      if(replace_old)
+        replace_n = n;
     }
-    lastc = clist;
-    clist = clist->next;
   }
-  if(replace_co) {
-    co = replace_co;
-    clist = replace_clist;
-    co->next = clist->next; /* get the next-pointer first */
+  if(replace_n) {
+    struct Cookie *repl = Curl_node_elem(replace_n);
 
     /* when replacing, creationtime is kept from old */
-    co->creationtime = clist->creationtime;
+    co->creationtime = repl->creationtime;
 
-    /* then free all the old pointers */
-    free(clist->name);
-    free(clist->value);
-    free(clist->domain);
-    free(clist->path);
-    free(clist->spath);
-    free(clist->expirestr);
-    free(clist->version);
-    free(clist->maxage);
+    /* unlink the old */
+    Curl_node_remove(replace_n);
 
-    *clist = *co;  /* then store all the new data */
-
-    free(co);   /* free the newly allocated memory */
-    co = clist;
+    /* free the old cookie */
+    freecookie(repl, TRUE);
   }
-
-  if(c->running)
-    /* Only show this when NOT reading the cookies from a file */
-    infof(data, "%s cookie %s=\"%s\" for domain %s, path %s, "
-          "expire %" CURL_FORMAT_CURL_OFF_T,
-          replace_old?"Replaced":"Added", co->name, co->value,
-          co->domain, co->path, co->expires);
-
-  if(!replace_old) {
-    /* then make the last item point on this new one */
-    if(lastc)
-      lastc->next = co;
-    else
-      c->cookies[myhash] = co;
-    c->numcookies++; /* one more cookie in the jar */
-  }
-
-  /*
-   * Now that we've added a new cookie to the jar, update the expiration
-   * tracker in case it is the next one to expire.
-   */
-  if(co->expires && (co->expires < c->next_expiration))
-    c->next_expiration = co->expires;
-
-  return co;
+  *replacep = replace_old;
+  return TRUE;
 }
 
+/*
+ * Curl_cookie_add
+ *
+ * Add a single cookie line to the cookie keeping object. Be aware that
+ * sometimes we get an IP-only hostname, and that might also be a numerical
+ * IPv6 address.
+ *
+ */
+CURLcode Curl_cookie_add(
+  struct Curl_easy *data,
+  struct CookieInfo *ci,
+  bool httpheader,     /* TRUE if HTTP header-style line */
+  bool noexpire,       /* if TRUE, skip remove_expired() */
+  const char *lineptr, /* first character of the line */
+  const char *domain,  /* default domain */
+  const char *path,    /* full path used when this cookie is set, used
+                          to get default path for the cookie unless set */
+  bool secure)         /* TRUE if connection is over secure origin */
+{
+  struct Cookie comem;
+  struct Cookie *co;
+  size_t myhash;
+  CURLcode result;
+  bool replaces = FALSE;
+  bool okay;
+
+  DEBUGASSERT(data);
+  DEBUGASSERT(MAX_SET_COOKIE_AMOUNT <= 255); /* counter is an unsigned char */
+  if(data->req.setcookies >= MAX_SET_COOKIE_AMOUNT)
+    return CURLE_OK; /* silently ignore */
+
+  co = &comem;
+  memset(co, 0, sizeof(comem));
+
+  if(httpheader)
+    result = parse_cookie_header(data, co, ci, &okay,
+                                 lineptr, domain, path, secure);
+  else
+    result = parse_netscape(co, ci, &okay, lineptr, secure);
+
+  if(result || !okay)
+    goto fail;
+
+  if(co->prefix_secure && !co->secure)
+    /* The __Secure- prefix only requires that the cookie be set secure */
+    goto fail;
+
+  if(co->prefix_host) {
+    /*
+     * The __Host- prefix requires the cookie to be secure, have a "/" path
+     * and not have a domain set.
+     */
+    if(co->secure && co->path && !strcmp(co->path, "/") && !co->tailmatch)
+      ;
+    else
+      goto fail;
+  }
+
+  if(!ci->running &&    /* read from a file */
+     ci->newsession &&  /* clean session cookies */
+     !co->expires)      /* this is a session cookie */
+    goto fail;
+
+  co->livecookie = ci->running;
+  co->creationtime = ++ci->lastct;
+
+  /*
+   * Now we have parsed the incoming line, we must now check if this supersedes
+   * an already existing cookie, which it may if the previous have the same
+   * domain and path as this.
+   */
+
+  /* remove expired cookies */
+  if(!noexpire)
+    remove_expired(ci);
+
+  if(is_public_suffix(data, co, domain))
+    goto fail;
+
+  if(!replace_existing(data, co, ci, secure, &replaces))
+    goto fail;
+
+  /* clone the stack struct into heap */
+  co = curlx_memdup(&comem, sizeof(comem));
+  if(!co) {
+    co = &comem;
+    result = CURLE_OUT_OF_MEMORY;
+    goto fail; /* bail out if we are this low on memory */
+  }
+
+  /* add this cookie to the list */
+  myhash = cookiehash(co->domain);
+  Curl_llist_append(&ci->cookielist[myhash], co, &co->node);
+
+  if(ci->running)
+    /* Only show this when NOT reading the cookies from a file */
+    infof(data, "%s cookie %s=\"%s\" for domain %s, path %s, "
+          "expire %" FMT_OFF_T,
+          replaces ? "Replaced" : "Added", co->name, co->value,
+          co->domain, co->path, co->expires);
+
+  if(!replaces)
+    ci->numcookies++; /* one more cookie in the jar */
+
+  /*
+   * Now that we have added a new cookie to the jar, update the expiration
+   * tracker in case it is the next one to expire.
+   */
+  if(co->expires && (co->expires < ci->next_expiration))
+    ci->next_expiration = co->expires;
+
+  if(httpheader)
+    data->req.setcookies++;
+
+  return result;
+fail:
+  freecookie(co, FALSE);
+  return result;
+}
 
 /*
  * Curl_cookie_init()
@@ -1208,102 +1095,136 @@ Curl_cookie_add(struct Curl_easy *data,
  * Note that 'data' might be called as NULL pointer. If data is NULL, 'file'
  * will be ignored.
  *
- * Returns NULL on out of memory. Invalid cookies are ignored.
+ * Returns NULL on out of memory.
  */
-struct CookieInfo *Curl_cookie_init(struct Curl_easy *data,
-                                    const char *file,
-                                    struct CookieInfo *inc,
-                                    bool newsession)
+struct CookieInfo *Curl_cookie_init(void)
+{
+  int i;
+  struct CookieInfo *ci = curlx_calloc(1, sizeof(struct CookieInfo));
+  if(!ci)
+    return NULL;
+
+  /* This does not use the destructor callback since we want to add
+     and remove to lists while keeping the cookie struct intact */
+  for(i = 0; i < COOKIE_HASH_SIZE; i++)
+    Curl_llist_init(&ci->cookielist[i], NULL);
+  /*
+   * Initialize the next_expiration time to signal that we do not have enough
+   * information yet.
+   */
+  ci->next_expiration = CURL_OFF_T_MAX;
+
+  return ci;
+}
+
+/*
+ * cookie_load()
+ *
+ * Reads cookies from a local file. This is always called before any cookies
+ * are set. If file is "-" then STDIN is read.
+ *
+ * If 'newsession' is TRUE, discard all "session cookies" on read from file.
+ *
+ */
+static CURLcode cookie_load(struct Curl_easy *data, const char *file,
+                            struct CookieInfo *ci, bool newsession)
 {
-  struct CookieInfo *c;
-  char *line = NULL;
   FILE *handle = NULL;
+  CURLcode result = CURLE_OK;
+  FILE *fp = NULL;
+  DEBUGASSERT(ci);
+  DEBUGASSERT(data);
+  DEBUGASSERT(file);
 
-  if(!inc) {
-    /* we didn't get a struct, create one */
-    c = calloc(1, sizeof(struct CookieInfo));
-    if(!c)
-      return NULL; /* failed to get memory */
-    c->filename = strdup(file?file:"none"); /* copy the name just in case */
-    if(!c->filename)
-      goto fail; /* failed to get memory */
-    /*
-     * Initialize the next_expiration time to signal that we don't have enough
-     * information yet.
-     */
-    c->next_expiration = CURL_OFF_T_MAX;
-  }
-  else {
-    /* we got an already existing one, use that */
-    c = inc;
-  }
-  c->newsession = newsession; /* new session? */
+  ci->newsession = newsession; /* new session? */
+  ci->running = FALSE; /* this is not running, this is init */
 
-  if(data) {
-    FILE *fp = NULL;
-    if(file) {
-      if(!strcmp(file, "-"))
-        fp = stdin;
+  if(file && *file) {
+    if(!strcmp(file, "-"))
+      fp = stdin;
+    else {
+      fp = curlx_fopen(file, "rb");
+      if(!fp)
+        infof(data, "WARNING: failed to open cookie file \"%s\"", file);
       else {
-        fp = fopen(file, "rb");
-        if(!fp)
-          infof(data, "WARNING: failed to open cookie file \"%s\"", file);
+        curlx_struct_stat stat;
+        if((curlx_fstat(fileno(fp), &stat) != -1) && S_ISDIR(stat.st_mode)) {
+          curlx_fclose(fp);
+          fp = NULL;
+          infof(data, "WARNING: cookie filename points to a directory: \"%s\"",
+                file);
+        }
         else
           handle = fp;
       }
     }
-
-    c->running = FALSE; /* this is not running, this is init */
-    if(fp) {
-      char *lineptr;
-      bool headerline;
-
-      line = malloc(MAX_COOKIE_LINE);
-      if(!line)
-        goto fail;
-      while(Curl_get_line(line, MAX_COOKIE_LINE, fp)) {
-        if(checkprefix("Set-Cookie:", line)) {
-          /* This is a cookie line, get it! */
-          lineptr = &line[11];
-          headerline = TRUE;
-        }
-        else {
-          lineptr = line;
-          headerline = FALSE;
-        }
-        while(*lineptr && ISBLANK(*lineptr))
-          lineptr++;
-
-        Curl_cookie_add(data, c, headerline, TRUE, lineptr, NULL, NULL, TRUE);
-      }
-      free(line); /* free the line buffer */
-
-      /*
-       * Remove expired cookies from the hash. We must make sure to run this
-       * after reading the file, and not on every cookie.
-       */
-      remove_expired(c);
-
-      if(handle)
-        fclose(handle);
-    }
-    data->state.cookie_engine = TRUE;
-    c->running = TRUE;          /* now, we're running */
   }
 
-  return c;
+  if(fp) {
+    struct dynbuf buf;
+    bool eof = FALSE;
+    curlx_dyn_init(&buf, MAX_COOKIE_LINE);
+    do {
+      result = Curl_get_line(&buf, fp, &eof);
+      if(!result) {
+        const char *lineptr = curlx_dyn_ptr(&buf);
+        bool headerline = FALSE;
+        if(checkprefix("Set-Cookie:", lineptr)) {
+          /* This is a cookie line, get it! */
+          lineptr += 11;
+          headerline = TRUE;
+          curlx_str_passblanks(&lineptr);
+        }
 
-fail:
-  free(line);
-  /*
-   * Only clean up if we allocated it here, as the original could still be in
-   * use by a share handle.
-   */
-  if(!inc)
-    Curl_cookie_cleanup(c);
-  if(handle)
-    fclose(handle);
-  return NULL; /* out of memory */
+        result = Curl_cookie_add(data, ci, headerline, TRUE, lineptr, NULL,
+                                 NULL, TRUE);
+        /* File reading cookie failures are not propagated back to the
+           caller because there is no way to do that */
+      }
+    } while(!result && !eof);
+    curlx_dyn_free(&buf); /* free the line buffer */
+
+    /*
+     * Remove expired cookies from the hash. We must make sure to run this
+     * after reading the file, and not on every cookie.
+     */
+    remove_expired(ci);
+
+    if(handle)
+      curlx_fclose(handle);
+  }
+  data->state.cookie_engine = TRUE;
+  ci->running = TRUE; /* now, we are running */
+
+  return result;
+}
+
+/*
+ * Load cookies from all given cookie files (CURLOPT_COOKIEFILE).
+ */
+CURLcode Curl_cookie_loadfiles(struct Curl_easy *data)
+{
+  CURLcode result = CURLE_OK;
+  struct curl_slist *list = data->state.cookielist;
+  if(list) {
+    Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
+    if(!data->cookies)
+      data->cookies = Curl_cookie_init();
+    if(!data->cookies)
+      result = CURLE_OUT_OF_MEMORY;
+    else {
+      data->state.cookie_engine = TRUE;
+      while(list) {
+        result = cookie_load(data, list->data, data->cookies,
+                             (bool)data->set.cookiesession);
+        if(result)
+          break;
+        list = list->next;
+      }
+    }
+    Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
+  }
+  return result;
 }
 
 /*
@@ -1316,8 +1237,8 @@ fail:
  */
 static int cookie_sort(const void *p1, const void *p2)
 {
-  struct Cookie *c1 = *(struct Cookie **)p1;
-  struct Cookie *c2 = *(struct Cookie **)p2;
+  const struct Cookie *c1 = *(const struct Cookie * const *)p1;
+  const struct Cookie *c2 = *(const struct Cookie * const *)p2;
   size_t l1, l2;
 
   /* 1 - compare cookie path lengths */
@@ -1325,14 +1246,14 @@ static int cookie_sort(const void *p1, const void *p2)
   l2 = c2->path ? strlen(c2->path) : 0;
 
   if(l1 != l2)
-    return (l2 > l1) ? 1 : -1 ; /* avoid size_t <=> int conversions */
+    return (l2 > l1) ? 1 : -1; /* avoid size_t <=> int conversions */
 
   /* 2 - compare cookie domain lengths */
   l1 = c1->domain ? strlen(c1->domain) : 0;
   l2 = c2->domain ? strlen(c2->domain) : 0;
 
   if(l1 != l2)
-    return (l2 > l1) ? 1 : -1 ;  /* avoid size_t <=> int conversions */
+    return (l2 > l1) ? 1 : -1; /* avoid size_t <=> int conversions */
 
   /* 3 - compare cookie name lengths */
   l1 = c1->name ? strlen(c1->name) : 0;
@@ -1352,88 +1273,64 @@ static int cookie_sort(const void *p1, const void *p2)
  */
 static int cookie_sort_ct(const void *p1, const void *p2)
 {
-  struct Cookie *c1 = *(struct Cookie **)p1;
-  struct Cookie *c2 = *(struct Cookie **)p2;
+  const struct Cookie *c1 = *(const struct Cookie * const *)p1;
+  const struct Cookie *c2 = *(const struct Cookie * const *)p2;
 
   return (c2->creationtime > c1->creationtime) ? 1 : -1;
 }
 
-#define CLONE(field)                     \
-  do {                                   \
-    if(src->field) {                     \
-      d->field = strdup(src->field);     \
-      if(!d->field)                      \
-        goto fail;                       \
-    }                                    \
-  } while(0)
-
-static struct Cookie *dup_cookie(struct Cookie *src)
+bool Curl_secure_context(struct Curl_easy *data, const char *host)
 {
-  struct Cookie *d = calloc(sizeof(struct Cookie), 1);
-  if(d) {
-    CLONE(expirestr);
-    CLONE(domain);
-    CLONE(path);
-    CLONE(spath);
-    CLONE(name);
-    CLONE(value);
-    CLONE(maxage);
-    CLONE(version);
-    d->expires = src->expires;
-    d->tailmatch = src->tailmatch;
-    d->secure = src->secure;
-    d->livecookie = src->livecookie;
-    d->httponly = src->httponly;
-    d->creationtime = src->creationtime;
-  }
-  return d;
-
-fail:
-  freecookie(d);
-  return NULL;
+  return Curl_xfer_is_secure(data) ||
+    curl_strequal("localhost", host) ||
+    !strcmp(host, "127.0.0.1") ||
+    !strcmp(host, "::1");
 }
 
 /*
  * Curl_cookie_getlist
  *
  * For a given host and path, return a linked list of cookies that the client
- * should send to the server if used now. The secure boolean informs the cookie
- * if a secure connection is achieved or not.
+ * should send to the server if used now.
  *
- * It shall only return cookies that haven't expired.
+ * It shall only return cookies that have not expired.
+ *
+ * 'okay' is TRUE when there is a list returned.
  */
-struct Cookie *Curl_cookie_getlist(struct Curl_easy *data,
-                                   struct CookieInfo *c,
-                                   const char *host, const char *path,
-                                   bool secure)
+CURLcode Curl_cookie_getlist(struct Curl_easy *data,
+                             bool *okay,
+                             const char *host,
+                             struct Curl_llist *list)
 {
-  struct Cookie *newco;
-  struct Cookie *co;
-  struct Cookie *mainco = NULL;
   size_t matches = 0;
-  bool is_ip;
+  const bool is_ip = Curl_host_is_ipnum(host);
   const size_t myhash = cookiehash(host);
+  struct Curl_llist_node *n;
+  const bool secure = Curl_secure_context(data, host);
+  struct CookieInfo *ci = data->cookies;
+  const char *path = data->state.up.path;
+  CURLcode result = CURLE_OK;
+  *okay = FALSE;
 
-  if(!c || !c->cookies[myhash])
-    return NULL; /* no cookie struct or no cookies in the struct */
+  Curl_llist_init(list, NULL);
+
+  if(!ci || !Curl_llist_count(&ci->cookielist[myhash]))
+    return CURLE_OK; /* no cookie struct or no cookies in the struct */
 
   /* at first, remove expired cookies */
-  remove_expired(c);
+  remove_expired(ci);
 
-  /* check if host is an IP(v4|v6) address */
-  is_ip = Curl_host_is_ipnum(host);
+  for(n = Curl_llist_head(&ci->cookielist[myhash]); n; n = Curl_node_next(n)) {
+    struct Cookie *co = Curl_node_elem(n);
 
-  co = c->cookies[myhash];
-
-  while(co) {
-    /* if the cookie requires we're secure we must only continue if we are! */
-    if(co->secure?secure:TRUE) {
+    /* if the cookie requires we are secure we must only continue if we are! */
+    if(co->secure ? secure : TRUE) {
 
       /* now check if the domain is correct */
       if(!co->domain ||
          (co->tailmatch && !is_ip &&
           cookie_tailmatch(co->domain, strlen(co->domain), host)) ||
-         ((!co->tailmatch || is_ip) && strcasecompare(host, co->domain)) ) {
+         ((!co->tailmatch || is_ip) && curl_strequal(host, co->domain))) {
         /*
          * the right part of the host matches the domain stuff in the
          * cookie data
@@ -1443,74 +1340,63 @@ struct Cookie *Curl_cookie_getlist(struct Curl_easy *data,
          * now check the left part of the path with the cookies path
          * requirement
          */
-        if(!co->spath || pathmatch(co->spath, path) ) {
+        if(!co->path || pathmatch(co->path, path)) {
 
           /*
-           * and now, we know this is a match and we should create an
-           * entry for the return-linked-list
+           * This is a match and we add it to the return-linked-list
            */
-
-          newco = dup_cookie(co);
-          if(newco) {
-            /* then modify our next */
-            newco->next = mainco;
-
-            /* point the main to us */
-            mainco = newco;
-
-            matches++;
-            if(matches >= MAX_COOKIE_SEND_AMOUNT) {
-              infof(data, "Included max number of cookies (%zu) in request!",
-                    matches);
-              break;
-            }
+          Curl_llist_append(list, co, &co->getnode);
+          matches++;
+          if(matches >= MAX_COOKIE_SEND_AMOUNT) {
+            infof(data, "Included max number of cookies (%zu) in request!",
+                  matches);
+            break;
           }
-          else
-            goto fail;
         }
       }
     }
-    co = co->next;
   }
 
   if(matches) {
     /*
      * Now we need to make sure that if there is a name appearing more than
-     * once, the longest specified path version comes first. To make this
-     * the swiftest way, we just sort them all based on path length.
+     * once, the longest specified path version comes first. To make this the
+     * swiftest way, we sort them all based on path length.
      */
     struct Cookie **array;
     size_t i;
 
     /* alloc an array and store all cookie pointers */
-    array = malloc(sizeof(struct Cookie *) * matches);
-    if(!array)
+    array = curlx_malloc(sizeof(struct Cookie *) * matches);
+    if(!array) {
+      result = CURLE_OUT_OF_MEMORY;
       goto fail;
+    }
 
-    co = mainco;
+    n = Curl_llist_head(list);
 
-    for(i = 0; co; co = co->next)
-      array[i++] = co;
+    for(i = 0; n; n = Curl_node_next(n))
+      array[i++] = Curl_node_elem(n);
 
     /* now sort the cookie pointers in path length order */
     qsort(array, matches, sizeof(struct Cookie *), cookie_sort);
 
     /* remake the linked list order according to the new order */
+    Curl_llist_destroy(list, NULL);
 
-    mainco = array[0]; /* start here */
-    for(i = 0; i<matches-1; i++)
-      array[i]->next = array[i + 1];
-    array[matches-1]->next = NULL; /* terminate the list */
+    for(i = 0; i < matches; i++)
+      Curl_llist_append(list, array[i], &array[i]->getnode);
 
-    free(array); /* remove the temporary data again */
+    curlx_free(array); /* remove the temporary data again */
   }
 
-  return mainco; /* return the new list */
+  *okay = TRUE;
+  return CURLE_OK; /* success */
 
 fail:
   /* failure, clear up the allocated chain and return NULL */
-  Curl_cookie_freelist(mainco);
-  return NULL;
+  Curl_llist_destroy(list, NULL);
+  return result; /* error */
 }
 
 /*
@@ -1518,30 +1404,21 @@ fail:
  *
  * Clear all existing cookies and reset the counter.
  */
-void Curl_cookie_clearall(struct CookieInfo *cookies)
+void Curl_cookie_clearall(struct CookieInfo *ci)
 {
-  if(cookies) {
+  if(ci) {
     unsigned int i;
     for(i = 0; i < COOKIE_HASH_SIZE; i++) {
-      Curl_cookie_freelist(cookies->cookies[i]);
-      cookies->cookies[i] = NULL;
+      struct Curl_llist_node *n;
+      for(n = Curl_llist_head(&ci->cookielist[i]); n;) {
+        struct Cookie *c = Curl_node_elem(n);
+        struct Curl_llist_node *e = Curl_node_next(n);
+        Curl_node_remove(n);
+        freecookie(c, TRUE);
+        n = e;
+      }
     }
-    cookies->numcookies = 0;
-  }
-}
-
-/*
- * Curl_cookie_freelist
- *
- * Free a list of cookies previously returned by Curl_cookie_getlist();
- */
-void Curl_cookie_freelist(struct Cookie *co)
-{
-  struct Cookie *next;
-  while(co) {
-    next = co->next;
-    freecookie(co);
-    co = next;
+    ci->numcookies = 0;
   }
 }
 
@@ -1550,39 +1427,26 @@ void Curl_cookie_freelist(struct Cookie *co)
  *
  * Free all session cookies in the cookies list.
  */
-void Curl_cookie_clearsess(struct CookieInfo *cookies)
+void Curl_cookie_clearsess(struct CookieInfo *ci)
 {
-  struct Cookie *first, *curr, *next, *prev = NULL;
   unsigned int i;
 
-  if(!cookies)
+  if(!ci)
     return;
 
   for(i = 0; i < COOKIE_HASH_SIZE; i++) {
-    if(!cookies->cookies[i])
-      continue;
+    struct Curl_llist_node *n = Curl_llist_head(&ci->cookielist[i]);
+    struct Curl_llist_node *e = NULL;
 
-    first = curr = prev = cookies->cookies[i];
-
-    for(; curr; curr = next) {
-      next = curr->next;
+    for(; n; n = e) {
+      struct Cookie *curr = Curl_node_elem(n);
+      e = Curl_node_next(n); /* in case the node is removed, get it early */
       if(!curr->expires) {
-        if(first == curr)
-          first = next;
-
-        if(prev == curr)
-          prev = next;
-        else
-          prev->next = next;
-
-        freecookie(curr);
-        cookies->numcookies--;
+        Curl_node_remove(n);
+        freecookie(curr, TRUE);
+        ci->numcookies--;
       }
-      else
-        prev = curr;
     }
-
-    cookies->cookies[i] = first;
   }
 }
 
@@ -1591,14 +1455,11 @@ void Curl_cookie_clearsess(struct CookieInfo *cookies)
  *
  * Free a "cookie object" previous created with Curl_cookie_init().
  */
-void Curl_cookie_cleanup(struct CookieInfo *c)
+void Curl_cookie_cleanup(struct CookieInfo *ci)
 {
-  if(c) {
-    unsigned int i;
-    free(c->filename);
-    for(i = 0; i < COOKIE_HASH_SIZE; i++)
-      Curl_cookie_freelist(c->cookies[i]);
-    free(c); /* free the base struct as well */
+  if(ci) {
+    Curl_cookie_clearall(ci);
+    curlx_free(ci); /* free the base struct as well */
   }
 }
 
@@ -1611,53 +1472,53 @@ void Curl_cookie_cleanup(struct CookieInfo *c)
  */
 static char *get_netscape_format(const struct Cookie *co)
 {
-  return aprintf(
-    "%s"     /* httponly preamble */
-    "%s%s\t" /* domain */
-    "%s\t"   /* tailmatch */
-    "%s\t"   /* path */
-    "%s\t"   /* secure */
-    "%" CURL_FORMAT_CURL_OFF_T "\t"   /* expires */
-    "%s\t"   /* name */
-    "%s",    /* value */
-    co->httponly?"#HttpOnly_":"",
+  return curl_maprintf(
+    "%s"               /* httponly preamble */
+    "%s%s\t"           /* domain */
+    "%s\t"             /* tailmatch */
+    "%s\t"             /* path */
+    "%s\t"             /* secure */
+    "%" FMT_OFF_T "\t" /* expires */
+    "%s\t"             /* name */
+    "%s",              /* value */
+    co->httponly ? "#HttpOnly_" : "",
     /*
      * Make sure all domains are prefixed with a dot if they allow
      * tailmatching. This is Mozilla-style.
      */
-    (co->tailmatch && co->domain && co->domain[0] != '.')? ".":"",
-    co->domain?co->domain:"unknown",
-    co->tailmatch?"TRUE":"FALSE",
-    co->path?co->path:"/",
-    co->secure?"TRUE":"FALSE",
+    (co->tailmatch && co->domain && co->domain[0] != '.') ? "." : "",
+    co->domain ? co->domain : "unknown",
+    co->tailmatch ? "TRUE" : "FALSE",
+    co->path ? co->path : "/",
+    co->secure ? "TRUE" : "FALSE",
     co->expires,
     co->name,
-    co->value?co->value:"");
+    co->value ? co->value : "");
 }
 
 /*
  * cookie_output()
  *
  * Writes all internally known cookies to the specified file. Specify
- * "-" as file name to write to stdout.
+ * "-" as filename to write to stdout.
  *
  * The function returns non-zero on write failure.
  */
 static CURLcode cookie_output(struct Curl_easy *data,
-                              struct CookieInfo *c, const char *filename)
+                              struct CookieInfo *ci,
+                              const char *filename)
 {
-  struct Cookie *co;
   FILE *out = NULL;
   bool use_stdout = FALSE;
   char *tempstore = NULL;
-  CURLcode error = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
-  if(!c)
+  if(!ci)
     /* no cookie engine alive */
     return CURLE_OK;
 
   /* at first, remove expired cookies */
-  remove_expired(c);
+  remove_expired(ci);
 
   if(!strcmp("-", filename)) {
     /* use stdout */
@@ -1665,8 +1526,8 @@ static CURLcode cookie_output(struct Curl_easy *data,
     use_stdout = TRUE;
   }
   else {
-    error = Curl_fopen(data, filename, &out, &tempstore);
-    if(error)
+    result = Curl_fopen(data, filename, &out, &tempstore);
+    if(result)
       goto error;
   }
 
@@ -1675,20 +1536,22 @@ static CURLcode cookie_output(struct Curl_easy *data,
         "# This file was generated by libcurl! Edit at your own risk.\n\n",
         out);
 
-  if(c->numcookies) {
+  if(ci->numcookies) {
     unsigned int i;
     size_t nvalid = 0;
     struct Cookie **array;
+    struct Curl_llist_node *n;
 
-    array = calloc(1, sizeof(struct Cookie *) * c->numcookies);
+    array = curlx_calloc(1, sizeof(struct Cookie *) * ci->numcookies);
     if(!array) {
-      error = CURLE_OUT_OF_MEMORY;
+      result = CURLE_OUT_OF_MEMORY;
       goto error;
     }
 
     /* only sort the cookies with a domain property */
     for(i = 0; i < COOKIE_HASH_SIZE; i++) {
-      for(co = c->cookies[i]; co; co = co->next) {
+      for(n = Curl_llist_head(&ci->cookielist[i]); n; n = Curl_node_next(n)) {
+        struct Cookie *co = Curl_node_elem(n);
         if(!co->domain)
           continue;
         array[nvalid++] = co;
@@ -1700,23 +1563,22 @@ static CURLcode cookie_output(struct Curl_easy *data,
     for(i = 0; i < nvalid; i++) {
       char *format_ptr = get_netscape_format(array[i]);
       if(!format_ptr) {
-        free(array);
-        error = CURLE_OUT_OF_MEMORY;
+        curlx_free(array);
+        result = CURLE_OUT_OF_MEMORY;
         goto error;
       }
-      fprintf(out, "%s\n", format_ptr);
-      free(format_ptr);
+      curl_mfprintf(out, "%s\n", format_ptr);
+      curlx_free(format_ptr);
     }
 
-    free(array);
+    curlx_free(array);
   }
 
   if(!use_stdout) {
-    fclose(out);
+    curlx_fclose(out);
     out = NULL;
-    if(tempstore && Curl_rename(tempstore, filename)) {
-      unlink(tempstore);
-      error = CURLE_WRITE_ERROR;
+    if(tempstore && curlx_rename(tempstore, filename)) {
+      result = CURLE_WRITE_ERROR;
       goto error;
     }
   }
@@ -1726,29 +1588,37 @@ static CURLcode cookie_output(struct Curl_easy *data,
    * no need to inspect the error, any error case should have jumped into the
    * error block below.
    */
-  free(tempstore);
+  curlx_free(tempstore);
   return CURLE_OK;
 
 error:
   if(out && !use_stdout)
-    fclose(out);
-  free(tempstore);
-  return error;
+    curlx_fclose(out);
+  if(tempstore) {
+    unlink(tempstore);
+    curlx_free(tempstore);
+  }
+  return result;
 }
 
-static struct curl_slist *cookie_list(struct Curl_easy *data)
+static struct curl_slist *cookie_list(const struct Curl_easy *data)
 {
   struct curl_slist *list = NULL;
   struct curl_slist *beg;
-  struct Cookie *c;
-  char *line;
   unsigned int i;
+  struct Curl_llist_node *n;
 
   if(!data->cookies || (data->cookies->numcookies == 0))
     return NULL;
 
+  /* at first, remove expired cookies */
+  remove_expired(data->cookies);
+
   for(i = 0; i < COOKIE_HASH_SIZE; i++) {
-    for(c = data->cookies->cookies[i]; c; c = c->next) {
+    for(n = Curl_llist_head(&data->cookies->cookielist[i]); n;
+        n = Curl_node_next(n)) {
+      struct Cookie *c = Curl_node_elem(n);
+      char *line;
       if(!c->domain)
         continue;
       line = get_netscape_format(c);
@@ -1758,7 +1628,7 @@ static struct curl_slist *cookie_list(struct Curl_easy *data)
       }
       beg = Curl_slist_append_nodup(list, line);
       if(!beg) {
-        free(line);
+        curlx_free(line);
         curl_slist_free_all(list);
         return NULL;
       }
@@ -1780,26 +1650,35 @@ struct curl_slist *Curl_cookie_list(struct Curl_easy *data)
 
 void Curl_flush_cookies(struct Curl_easy *data, bool cleanup)
 {
-  CURLcode res;
+  Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
+  /* only save the cookie file if a transfer was started (cookies->running is
+     set), as otherwise the cookies were not completely initialized and there
+     might be cookie files that were not loaded so saving the file is the
+     wrong thing. */
+  if(data->cookies) {
+    if(data->set.str[STRING_COOKIEJAR] && data->cookies->running) {
+      /* if we have a destination file for all the cookies to get dumped to */
+      CURLcode result = cookie_output(data, data->cookies,
+                                      data->set.str[STRING_COOKIEJAR]);
+      if(result)
+        infof(data, "WARNING: failed to save cookies in %s: %s",
+              data->set.str[STRING_COOKIEJAR], curl_easy_strerror(result));
+    }
 
-  if(data->set.str[STRING_COOKIEJAR]) {
-    Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
-
-    /* if we have a destination file for all the cookies to get dumped to */
-    res = cookie_output(data, data->cookies, data->set.str[STRING_COOKIEJAR]);
-    if(res)
-      infof(data, "WARNING: failed to save cookies in %s: %s",
-            data->set.str[STRING_COOKIEJAR], curl_easy_strerror(res));
-  }
-  else {
-    Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
-  }
-
-  if(cleanup && (!data->share || (data->cookies != data->share->cookies))) {
-    Curl_cookie_cleanup(data->cookies);
-    data->cookies = NULL;
+    if(cleanup && (!data->share || (data->cookies != data->share->cookies))) {
+      Curl_cookie_cleanup(data->cookies);
+      data->cookies = NULL;
+    }
   }
   Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
 }
 
+void Curl_cookie_run(struct Curl_easy *data)
+{
+  Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
+  if(data->cookies)
+    data->cookies->running = TRUE;
+  Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
+}
+
 #endif /* CURL_DISABLE_HTTP || CURL_DISABLE_COOKIES */
diff --git a/third-party/curl/lib/cookie.h b/third-party/curl/lib/cookie.h
index b3c0063b2c..b8ef8b8ea1 100644
--- a/third-party/curl/lib/cookie.h
+++ b/third-party/curl/lib/cookie.h
@@ -25,48 +25,42 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
-#include <curl/curl.h>
+#include "llist.h"
 
 struct Cookie {
-  struct Cookie *next; /* next in the chain */
-  char *name;        /* <this> = value */
-  char *value;       /* name = <this> */
-  char *path;         /* path = <this> which is in Set-Cookie: */
-  char *spath;        /* sanitized cookie path */
-  char *domain;      /* domain = <this> */
-  curl_off_t expires;  /* expires = <this> */
-  char *expirestr;   /* the plain text version */
-
-  /* RFC 2109 keywords. Version=1 means 2109-compliant cookie sending */
-  char *version;     /* Version = <value> */
-  char *maxage;      /* Max-Age = <value> */
-
-  bool tailmatch;    /* whether we do tail-matching of the domain name */
-  bool secure;       /* whether the 'secure' keyword was used */
-  bool livecookie;   /* updated from a server, not a stored file */
-  bool httponly;     /* true if the httponly directive is present */
-  int creationtime;  /* time when the cookie was written */
-  unsigned char prefix; /* bitmap fields indicating which prefix are set */
+  struct Curl_llist_node node;    /* for the main cookie list */
+  struct Curl_llist_node getnode; /* for getlist */
+  char *name;                     /* <this> = value */
+  char *value;                    /* name = <this> */
+  char *path;                     /* canonical path */
+  char *domain;                   /* domain = <this> */
+  curl_off_t expires;             /* expires = <this> */
+  unsigned int creationtime;      /* time when the cookie was written */
+  BIT(tailmatch);                 /* tail-match the domain name */
+  BIT(secure);                    /* the 'secure' keyword was used */
+  BIT(livecookie);                /* updated from server, not a stored file */
+  BIT(httponly);                  /* the httponly directive is present */
+  BIT(prefix_secure);             /* secure prefix is set */
+  BIT(prefix_host);               /* host prefix is set */
 };
 
 /*
  * Available cookie prefixes, as defined in
  * draft-ietf-httpbis-rfc6265bis-02
  */
-#define COOKIE_PREFIX__SECURE (1<<0)
-#define COOKIE_PREFIX__HOST (1<<1)
+#define COOKIE_PREFIX__SECURE (1 << 0)
+#define COOKIE_PREFIX__HOST   (1 << 1)
 
-#define COOKIE_HASH_SIZE 256
+#define COOKIE_HASH_SIZE 63
 
 struct CookieInfo {
-  /* linked list of cookies we know of */
-  struct Cookie *cookies[COOKIE_HASH_SIZE];
-  char *filename;  /* file we read from/write to */
-  long numcookies; /* number of cookies in the "jar" */
-  bool running;    /* state info, for cookie adding information */
-  bool newsession; /* new session, discard session cookies on load */
-  int lastct;      /* last creation-time used in the jar */
+  /* linked lists of cookies we know of */
+  struct Curl_llist cookielist[COOKIE_HASH_SIZE];
   curl_off_t next_expiration; /* the next time at which expiration happens */
+  unsigned int numcookies;    /* number of cookies in the "jar" */
+  unsigned int lastct;        /* last creation-time used in the jar */
+  BIT(running);               /* state info, for cookie adding information */
+  BIT(newsession); /* new session, discard session cookies on load */
 };
 
 /* The maximum sizes we accept for cookies. RFC 6265 section 6.1 says
@@ -75,7 +69,6 @@ struct CookieInfo {
 
    - At least 4096 bytes per cookie (as measured by the sum of the length of
      the cookie's name, value, and attributes).
-
    In the 6265bis draft document section 5.4 it is phrased even stronger: "If
    the sum of the lengths of the name string and the value string is more than
    4096 octets, abort these steps and ignore the set-cookie-string entirely."
@@ -83,7 +76,7 @@ struct CookieInfo {
 
 /** Limits for INCOMING cookies **/
 
-/* The longest we allow a line to be when reading a cookie from a HTTP header
+/* The longest we allow a line to be when reading a cookie from an HTTP header
    or from a cookie jar */
 #define MAX_COOKIE_LINE 5000
 
@@ -109,38 +102,42 @@ struct CookieInfo {
 #define MAX_COOKIE_SEND_AMOUNT 150
 
 struct Curl_easy;
+struct connectdata;
+
 /*
  * Add a cookie to the internal list of cookies. The domain and path arguments
  * are only used if the header boolean is TRUE.
  */
 
-struct Cookie *Curl_cookie_add(struct Curl_easy *data,
-                               struct CookieInfo *c, bool header,
-                               bool noexpiry, char *lineptr,
-                               const char *domain, const char *path,
-                               bool secure);
-
-struct Cookie *Curl_cookie_getlist(struct Curl_easy *data,
-                                   struct CookieInfo *c, const char *host,
-                                   const char *path, bool secure);
-void Curl_cookie_freelist(struct Cookie *cookies);
-void Curl_cookie_clearall(struct CookieInfo *cookies);
-void Curl_cookie_clearsess(struct CookieInfo *cookies);
+bool Curl_secure_context(struct Curl_easy *data, const char *host);
+CURLcode Curl_cookie_add(struct Curl_easy *data,
+                         struct CookieInfo *ci,
+                         bool httpheader,
+                         bool noexpire,
+                         const char *lineptr,
+                         const char *domain,
+                         const char *path,
+                         bool secure) WARN_UNUSED_RESULT;
+CURLcode Curl_cookie_getlist(struct Curl_easy *data,
+                             bool *okay, const char *host,
+                             struct Curl_llist *list) WARN_UNUSED_RESULT;
+void Curl_cookie_clearall(struct CookieInfo *ci);
+void Curl_cookie_clearsess(struct CookieInfo *ci);
 
 #if defined(CURL_DISABLE_HTTP) || defined(CURL_DISABLE_COOKIES)
-#define Curl_cookie_list(x) NULL
-#define Curl_cookie_loadfiles(x) Curl_nop_stmt
-#define Curl_cookie_init(x,y,z,w) NULL
-#define Curl_cookie_cleanup(x) Curl_nop_stmt
-#define Curl_flush_cookies(x,y) Curl_nop_stmt
+#define Curl_cookie_list(x)      NULL
+#define Curl_cookie_loadfiles(x) CURLE_OK
+#define Curl_cookie_init()       NULL
+#define Curl_cookie_run(x)       Curl_nop_stmt
+#define Curl_cookie_cleanup(x)   Curl_nop_stmt
+#define Curl_flush_cookies(x, y) Curl_nop_stmt
 #else
 void Curl_flush_cookies(struct Curl_easy *data, bool cleanup);
-void Curl_cookie_cleanup(struct CookieInfo *c);
-struct CookieInfo *Curl_cookie_init(struct Curl_easy *data,
-                                    const char *file, struct CookieInfo *inc,
-                                    bool newsession);
+void Curl_cookie_cleanup(struct CookieInfo *ci);
+struct CookieInfo *Curl_cookie_init(void);
 struct curl_slist *Curl_cookie_list(struct Curl_easy *data);
-void Curl_cookie_loadfiles(struct Curl_easy *data);
+CURLcode Curl_cookie_loadfiles(struct Curl_easy *data) WARN_UNUSED_RESULT;
+void Curl_cookie_run(struct Curl_easy *data);
 #endif
 
 #endif /* HEADER_CURL_COOKIE_H */
diff --git a/third-party/curl/lib/creds.c b/third-party/curl/lib/creds.c
new file mode 100644
index 0000000000..d22c166a42
--- /dev/null
+++ b/third-party/curl/lib/creds.c
@@ -0,0 +1,189 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include <stddef.h>  /* for offsetof() */
+
+#include "creds.h"
+#include "curl_trc.h"
+#include "strcase.h"
+#include "urldata.h"
+
+
+CURLcode Curl_creds_create(const char *user,
+                           const char *passwd,
+                           const char *oauth_bearer,
+                           const char *sasl_authzid,
+                           const char *sasl_service,
+                           uint8_t source,
+                           struct Curl_creds **pcreds)
+{
+  struct Curl_creds *creds = NULL;
+  size_t ulen = user ? strlen(user) : 0;
+  size_t plen = passwd ? strlen(passwd) : 0;
+  size_t olen = oauth_bearer ? strlen(oauth_bearer) : 0;
+  size_t salen = sasl_authzid ? strlen(sasl_authzid) : 0;
+  size_t sslen = sasl_service ? strlen(sasl_service) : 0;
+  char *s, *buf;
+  CURLcode result = CURLE_OK;
+
+  Curl_creds_unlink(pcreds);
+
+  /* Everything empty/NULL, this is the NULL credential */
+  if(!user && !passwd && !olen && !salen && !sslen)
+    goto out;
+
+  if((ulen > CURL_MAX_INPUT_LENGTH) ||
+     (plen > CURL_MAX_INPUT_LENGTH) ||
+     (olen > CURL_MAX_INPUT_LENGTH) ||
+     (salen > CURL_MAX_INPUT_LENGTH) ||
+     (sslen > CURL_MAX_INPUT_LENGTH)) {
+    result = CURLE_BAD_FUNCTION_ARGUMENT;
+    goto out;
+  }
+
+  /* null-terminator for user already part of struct */
+  creds = curlx_calloc(1, sizeof(*creds) +
+                       ulen + plen + 1 + olen + 1 + salen + 1 + sslen + 1);
+  if(!creds) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  creds->refcount = 1;
+  creds->source = source;
+  /* Some compilers try to be too smart about our dynamic struct size */
+  buf = ((char *)creds) + offsetof(struct Curl_creds, buf);
+  creds->user = s = buf;
+  if(ulen)
+    memcpy(s, user, ulen + 1);
+  creds->passwd = s = buf + ulen + 1;
+  if(plen)
+    memcpy(s, passwd, plen + 1);
+  creds->oauth_bearer = s = buf + ulen + 1 + plen + 1;
+  if(olen)
+    memcpy(s, oauth_bearer, olen + 1);
+  creds->sasl_authzid = s = buf + ulen + 1 + plen + 1 + olen + 1;
+  if(salen)
+    memcpy(s, sasl_authzid, salen + 1);
+  creds->sasl_service = s = buf + ulen + 1 + plen + 1 + olen + 1 + salen + 1;
+  if(sslen)
+    memcpy(s, sasl_service, sslen + 1);
+
+out:
+  if(!result)
+    *pcreds = creds;
+  else
+    Curl_creds_unlink(&creds);
+  return result;
+}
+
+CURLcode Curl_creds_merge(const char *user,
+                          const char *passwd,
+                          struct Curl_creds *creds_in,
+                          uint8_t source,
+                          struct Curl_creds **pcreds_out)
+{
+  struct Curl_creds *creds_out = NULL;
+  CURLcode result;
+
+  if(!creds_in) {
+    result = Curl_creds_create(user, passwd, NULL, NULL, NULL,
+                               source, &creds_out);
+  }
+  else {
+    result = Curl_creds_create(user ? user : Curl_creds_user(creds_in),
+                               passwd ? passwd : Curl_creds_passwd(creds_in),
+                               Curl_creds_oauth_bearer(creds_in),
+                               Curl_creds_sasl_authzid(creds_in),
+                               Curl_creds_sasl_service(creds_in),
+                               source, &creds_out);
+  }
+  Curl_creds_link(pcreds_out, creds_out);
+  Curl_creds_unlink(&creds_out);
+  return result;
+}
+
+void Curl_creds_link(struct Curl_creds **pdest, struct Curl_creds *src)
+{
+  if(*pdest != src) {
+    Curl_creds_unlink(pdest);
+    *pdest = src;
+    if(src) {
+      DEBUGASSERT(src->refcount < UINT32_MAX);
+      src->refcount++;
+    }
+  }
+}
+
+void Curl_creds_unlink(struct Curl_creds **pcreds)
+{
+  if(*pcreds) {
+    struct Curl_creds *creds = *pcreds;
+
+    DEBUGASSERT(creds->refcount);
+    *pcreds = NULL;
+    if(creds->refcount)
+      creds->refcount--;
+    if(!creds->refcount) {
+      curlx_free(creds);
+    }
+  }
+}
+
+bool Curl_creds_same(struct Curl_creds *c1, struct Curl_creds *c2)
+{
+  return (c1 == c2) ||
+         (c1 && c2 &&
+          !Curl_timestrcmp(c1->user, c2->user) &&
+          !Curl_timestrcmp(c1->passwd, c2->passwd) &&
+          !Curl_timestrcmp(c1->oauth_bearer, c2->oauth_bearer) &&
+          !Curl_timestrcmp(c1->sasl_authzid, c2->sasl_authzid) &&
+          !Curl_timestrcmp(c1->sasl_service, c2->sasl_service));
+}
+
+bool Curl_creds_equal(struct Curl_creds *c1, struct Curl_creds *c2)
+{
+  return Curl_creds_same(c1, c2) &&
+         ((c1 == c2) || (c1 && c2 && (c1->source == c2->source)));
+}
+
+#ifdef CURLVERBOSE
+void Curl_creds_trace(struct Curl_easy *data, struct Curl_creds *creds,
+                      const char *msg)
+{
+  if(creds) {
+    CURL_TRC_M(data, "%s: user=%s, passwd=%s, "
+               "sasl_authzid=%s, oauth_bearer=%s, source=%d",
+               msg,
+               Curl_creds_user(creds),
+               Curl_creds_has_passwd(creds) ? "***" : "",
+               Curl_creds_sasl_authzid(creds),
+               Curl_creds_has_oauth_bearer(creds) ? "***" : "",
+               creds->source);
+  }
+  else
+    CURL_TRC_M(data, "%s: -", msg);
+}
+#endif
diff --git a/third-party/curl/lib/creds.h b/third-party/curl/lib/creds.h
new file mode 100644
index 0000000000..0664d08a4f
--- /dev/null
+++ b/third-party/curl/lib/creds.h
@@ -0,0 +1,91 @@
+#ifndef HEADER_CURL_CREDS_H
+#define HEADER_CURL_CREDS_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+struct Curl_easy;
+
+#define CREDS_NONE   0 /* used for default username/passwd */
+#define CREDS_URL    1 /* username/passwd from URL */
+#define CREDS_OPTION 2 /* username/passwd set with a CURLOPT_ */
+#define CREDS_NETRC  3 /* username/passwd found in netrc */
+
+struct Curl_creds {
+  const char *user; /* non-NULL, maybe empty string */
+  const char *passwd; /* non-NULL, maybe empty string */
+  const char *oauth_bearer; /* non-NULL, maybe empty string */
+  const char *sasl_authzid; /* non-NULL, maybe empty string */
+  const char *sasl_service; /* non-NULL, maybe empty string */
+  uint32_t refcount;
+  uint8_t source; /* CREDS_* value */
+  char buf[1];
+};
+
+CURLcode Curl_creds_create(const char *user,
+                           const char *passwd,
+                           const char *oauth_bearer,
+                           const char *sasl_authzid,
+                           const char *sasl_service,
+                           uint8_t source,
+                           struct Curl_creds **pcreds);
+
+/* Create credentials by overriding `user` and/or `passwd` in `creds_in` */
+CURLcode Curl_creds_merge(const char *user,
+                          const char *passwd,
+                          struct Curl_creds *creds_in,
+                          uint8_t source,
+                          struct Curl_creds **pcreds_out);
+
+/* Unlink any creds in `*pdest`, assign src, increase src
+ * refcount when not NULL. */
+void Curl_creds_link(struct Curl_creds **pdest, struct Curl_creds *src);
+
+/* Drop a reference, creds may be passed as NULL */
+void Curl_creds_unlink(struct Curl_creds **pcreds);
+
+/* TRUE if both creds are NULL or have same values, except source. */
+bool Curl_creds_same(struct Curl_creds *c1, struct Curl_creds *c2);
+
+/* TRUE if both creds are NULL or have all values equal. */
+bool Curl_creds_equal(struct Curl_creds *c1, struct Curl_creds *c2);
+
+/* Provides properties for creds or, if creds is NULL, the empty string */
+#define Curl_creds_has_user(c)           ((c) && (c)->user[0])
+#define Curl_creds_has_passwd(c)         ((c) && (c)->passwd[0])
+#define Curl_creds_has_user_or_pass(c)   \
+                             ((c) && ((c)->user[0] || (c)->passwd[0]))
+#define Curl_creds_has_oauth_bearer(c)   ((c) && (c)->oauth_bearer[0])
+#define Curl_creds_has_sasl_service(c)   ((c) && (c)->sasl_service[0])
+#define Curl_creds_user(c)               ((c) ? (c)->user : "")
+#define Curl_creds_passwd(c)             ((c) ? (c)->passwd : "")
+#define Curl_creds_oauth_bearer(c)       ((c) ? (c)->oauth_bearer : "")
+#define Curl_creds_sasl_authzid(c)       ((c) ? (c)->sasl_authzid : "")
+#define Curl_creds_sasl_service(c)       ((c) ? (c)->sasl_service : "")
+
+#ifdef CURLVERBOSE
+void Curl_creds_trace(struct Curl_easy *data, struct Curl_creds *creds,
+                      const char *msg);
+#endif
+
+#endif /* HEADER_CURL_CREDS_H */
diff --git a/third-party/curl/lib/cshutdn.c b/third-party/curl/lib/cshutdn.c
new file mode 100644
index 0000000000..cc77e401fd
--- /dev/null
+++ b/third-party/curl/lib/cshutdn.c
@@ -0,0 +1,534 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Linus Nielsen Feltzing, <linus@haxx.se>
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "urldata.h"
+#include "url.h"
+#include "cfilters.h"
+#include "progress.h"
+#include "multiif.h"
+#include "multi_ev.h"
+#include "curl_trc.h"
+#include "cshutdn.h"
+#include "sigpipe.h"
+#include "connect.h"
+#include "select.h"
+#include "curlx/strparse.h"
+
+
+static void cshutdn_run_conn_handler(struct Curl_easy *data,
+                                     struct connectdata *conn)
+{
+  if(!conn->bits.shutdown_handler) {
+
+    if(conn->scheme && conn->scheme->run->disconnect) {
+      /* Some disconnect handlers do a blocking wait on server responses.
+       * FTP/IMAP/SMTP and SFTP are among them. When using the internal
+       * handle, set an overall short timeout so we do not hang for the
+       * default 120 seconds. */
+      if(data->state.internal) {
+        data->set.timeout = DEFAULT_SHUTDOWN_TIMEOUT_MS;
+        Curl_pgrsTime(data, TIMER_STARTOP);
+      }
+
+      /* This is set if protocol-specific cleanups should be made */
+      DEBUGF(infof(data, "connection #%" FMT_OFF_T
+                   ", shutdown protocol handler (aborted=%d)",
+                   conn->connection_id, conn->bits.aborted));
+      /* There are protocol handlers that block on retrieving
+       * server responses here (FTP). Set a short timeout. */
+      conn->scheme->run->disconnect(data, conn, (bool)conn->bits.aborted);
+    }
+
+    conn->bits.shutdown_handler = TRUE;
+  }
+}
+
+static void cshutdn_run_once(struct Curl_easy *data,
+                             struct connectdata *conn,
+                             bool *done)
+{
+  CURLcode r1, r2;
+  bool done1, done2;
+
+  /* We expect to be attached when called */
+  DEBUGASSERT(data->conn == conn);
+
+  if(!Curl_shutdown_started(data, FIRSTSOCKET)) {
+    Curl_shutdown_start(data, FIRSTSOCKET, 0);
+  }
+
+  cshutdn_run_conn_handler(data, conn);
+
+  if(conn->bits.shutdown_filters) {
+    *done = TRUE;
+    return;
+  }
+
+  if(!conn->bits.connect_only && Curl_conn_is_connected(conn, FIRSTSOCKET))
+    r1 = Curl_conn_shutdown(data, FIRSTSOCKET, &done1);
+  else {
+    r1 = CURLE_OK;
+    done1 = TRUE;
+  }
+
+  if(!conn->bits.connect_only && Curl_conn_is_connected(conn, SECONDARYSOCKET))
+    r2 = Curl_conn_shutdown(data, SECONDARYSOCKET, &done2);
+  else {
+    r2 = CURLE_OK;
+    done2 = TRUE;
+  }
+
+  /* we are done when any failed or both report success */
+  *done = (r1 || r2 || (done1 && done2));
+  if(*done)
+    conn->bits.shutdown_filters = TRUE;
+}
+
+void Curl_cshutdn_run_once(struct Curl_easy *data,
+                           struct connectdata *conn,
+                           bool *done)
+{
+  DEBUGASSERT(!data->conn);
+  Curl_attach_connection(data, conn);
+  cshutdn_run_once(data, conn, done);
+  CURL_TRC_M(data, "[SHUTDOWN] shutdown, done=%d", *done);
+  Curl_detach_connection(data);
+}
+
+void Curl_cshutdn_terminate(struct Curl_easy *data,
+                            struct connectdata *conn,
+                            bool do_shutdown)
+{
+  struct Curl_easy *admin = data;
+  bool done;
+
+  /* there must be a connection to close */
+  DEBUGASSERT(conn);
+  /* it must be removed from the connection pool */
+  DEBUGASSERT(!conn->bits.in_cpool);
+  /* the transfer must be detached from the connection */
+  DEBUGASSERT(data && !data->conn);
+
+  /* If we can obtain an internal admin handle, use that to attach
+   * and terminate the connection. Some protocol will try to mess with
+   * `data` during shutdown and we do not want that with a `data` from
+   * the application. */
+  if(data->multi && data->multi->admin)
+    admin = data->multi->admin;
+
+  Curl_attach_connection(admin, conn);
+
+  cshutdn_run_conn_handler(admin, conn);
+  if(do_shutdown) {
+    /* Make a last attempt to shutdown handlers and filters, if
+     * not done so already. */
+    cshutdn_run_once(admin, conn, &done);
+  }
+  CURL_TRC_M(admin, "[SHUTDOWN] %sclosing connection #%" FMT_OFF_T,
+             conn->bits.shutdown_filters ? "" : "force ",
+             conn->connection_id);
+  Curl_conn_cf_discard_all(admin, conn, SECONDARYSOCKET);
+  Curl_conn_cf_discard_all(admin, conn, FIRSTSOCKET);
+  Curl_detach_connection(admin);
+
+  if(data->multi)
+    Curl_multi_ev_conn_done(data->multi, data, conn);
+  Curl_conn_free(admin, conn);
+
+  if(data->multi) {
+    CURL_TRC_M(data, "[SHUTDOWN] trigger multi connchanged");
+    Curl_multi_connchanged(data->multi);
+  }
+}
+
+static bool cshutdn_destroy_oldest(struct cshutdn *cshutdn,
+                                   struct Curl_easy *data,
+                                   const char *destination)
+{
+  struct Curl_llist_node *e;
+  struct connectdata *conn;
+
+  e = Curl_llist_head(&cshutdn->list);
+  while(e) {
+    conn = Curl_node_elem(e);
+    if(!destination || !strcmp(destination, conn->destination))
+      break;
+    e = Curl_node_next(e);
+  }
+
+  if(e) {
+    struct Curl_sigpipe_ctx sigpipe_ctx;
+    conn = Curl_node_elem(e);
+    Curl_node_remove(e);
+    sigpipe_init(&sigpipe_ctx);
+    sigpipe_apply(data, &sigpipe_ctx);
+    Curl_cshutdn_terminate(data, conn, FALSE);
+    sigpipe_restore(&sigpipe_ctx);
+    return TRUE;
+  }
+  return FALSE;
+}
+
+bool Curl_cshutdn_close_oldest(struct Curl_easy *data,
+                               const char *destination)
+{
+  if(data && data->multi) {
+    struct cshutdn *csd = &data->multi->cshutdn;
+    return cshutdn_destroy_oldest(csd, data, destination);
+  }
+  return FALSE;
+}
+
+#define NUM_POLLS_ON_STACK 10
+
+static CURLcode cshutdn_wait(struct cshutdn *cshutdn,
+                             struct Curl_easy *data,
+                             int timeout_ms)
+{
+  struct pollfd a_few_on_stack[NUM_POLLS_ON_STACK];
+  struct curl_pollfds cpfds;
+  CURLcode result;
+
+  Curl_pollfds_init(&cpfds, a_few_on_stack, NUM_POLLS_ON_STACK);
+
+  result = Curl_cshutdn_add_pollfds(cshutdn, data, &cpfds);
+  if(result)
+    goto out;
+
+  Curl_poll(cpfds.pfds, cpfds.n, CURLMIN(timeout_ms, 1000));
+
+out:
+  Curl_pollfds_cleanup(&cpfds);
+  return result;
+}
+
+static void cshutdn_perform(struct cshutdn *cshutdn,
+                            struct Curl_easy *data,
+                            struct Curl_sigpipe_ctx *sigpipe_ctx)
+{
+  struct Curl_llist_node *e = Curl_llist_head(&cshutdn->list);
+  struct Curl_llist_node *enext;
+  struct connectdata *conn;
+  timediff_t next_expire_ms = 0, ms;
+  bool done;
+
+  if(!e)
+    return;
+
+  CURL_TRC_M(data, "[SHUTDOWN] perform on %zu connections",
+             Curl_llist_count(&cshutdn->list));
+  sigpipe_apply(data, sigpipe_ctx);
+  while(e) {
+    enext = Curl_node_next(e);
+    conn = Curl_node_elem(e);
+    Curl_cshutdn_run_once(data, conn, &done);
+    if(done) {
+      Curl_node_remove(e);
+      Curl_cshutdn_terminate(data, conn, FALSE);
+    }
+    else {
+      /* idata has one timer list, but maybe more than one connection.
+       * Set EXPIRE_SHUTDOWN to the smallest time left for all. */
+      ms = Curl_conn_shutdown_timeleft(data, conn);
+      if(ms && ms < next_expire_ms)
+        next_expire_ms = ms;
+    }
+    e = enext;
+  }
+
+  if(next_expire_ms)
+    Curl_expire_ex(data, next_expire_ms, EXPIRE_SHUTDOWN);
+}
+
+static void cshutdn_terminate_all(struct cshutdn *cshutdn,
+                                  struct Curl_easy *data,
+                                  int timeout_ms)
+{
+  struct curltime started = *Curl_pgrs_now(data);
+  struct Curl_llist_node *e;
+  struct Curl_sigpipe_ctx sigpipe_ctx;
+
+  DEBUGASSERT(cshutdn);
+  DEBUGASSERT(data);
+
+  CURL_TRC_M(data, "[SHUTDOWN] shutdown all");
+  sigpipe_init(&sigpipe_ctx);
+
+  while(Curl_llist_head(&cshutdn->list)) {
+    timediff_t spent_ms;
+    int remain_ms;
+
+    cshutdn_perform(cshutdn, data, &sigpipe_ctx);
+
+    if(!Curl_llist_head(&cshutdn->list)) {
+      CURL_TRC_M(data, "[SHUTDOWN] shutdown finished cleanly");
+      break;
+    }
+
+    /* wait for activity, timeout or "nothing" */
+    spent_ms = curlx_ptimediff_ms(Curl_pgrs_now(data), &started);
+    if(spent_ms >= (timediff_t)timeout_ms) {
+      CURL_TRC_M(data, "[SHUTDOWN] shutdown finished, %s",
+                 (timeout_ms > 0) ? "timeout" : "best effort done");
+      break;
+    }
+
+    remain_ms = timeout_ms - (int)spent_ms;
+    if(cshutdn_wait(cshutdn, data, remain_ms)) {
+      CURL_TRC_M(data, "[SHUTDOWN] shutdown finished, aborted");
+      break;
+    }
+  }
+
+  /* Terminate any remaining. */
+  e = Curl_llist_head(&cshutdn->list);
+  while(e) {
+    struct connectdata *conn = Curl_node_elem(e);
+    Curl_node_remove(e);
+    Curl_cshutdn_terminate(data, conn, FALSE);
+    e = Curl_llist_head(&cshutdn->list);
+  }
+  DEBUGASSERT(!Curl_llist_count(&cshutdn->list));
+
+  sigpipe_restore(&sigpipe_ctx);
+}
+
+int Curl_cshutdn_init(struct cshutdn *cshutdn,
+                      struct Curl_multi *multi)
+{
+  DEBUGASSERT(multi);
+  cshutdn->multi = multi;
+  Curl_llist_init(&cshutdn->list, NULL);
+  cshutdn->initialized = TRUE;
+  return 0; /* good */
+}
+
+void Curl_cshutdn_destroy(struct cshutdn *cshutdn,
+                          struct Curl_easy *data)
+{
+  if(cshutdn->initialized && data) {
+    int timeout_ms = 0;
+    /* for testing, run graceful shutdown */
+#ifdef DEBUGBUILD
+    {
+      const char *p = getenv("CURL_GRACEFUL_SHUTDOWN");
+      if(p) {
+        curl_off_t l;
+        if(!curlx_str_number(&p, &l, INT_MAX))
+          timeout_ms = (int)l;
+      }
+    }
+#endif
+
+    CURL_TRC_M(data, "[SHUTDOWN] destroy, %zu connections, timeout=%dms",
+               Curl_llist_count(&cshutdn->list), timeout_ms);
+    cshutdn_terminate_all(cshutdn, data, timeout_ms);
+  }
+  cshutdn->multi = NULL;
+}
+
+size_t Curl_cshutdn_count(struct Curl_easy *data)
+{
+  if(data && data->multi) {
+    struct cshutdn *csd = &data->multi->cshutdn;
+    return Curl_llist_count(&csd->list);
+  }
+  return 0;
+}
+
+size_t Curl_cshutdn_dest_count(struct Curl_easy *data,
+                               const char *destination)
+{
+  if(data && data->multi) {
+    struct cshutdn *csd = &data->multi->cshutdn;
+    size_t n = 0;
+    struct Curl_llist_node *e = Curl_llist_head(&csd->list);
+    while(e) {
+      struct connectdata *conn = Curl_node_elem(e);
+      if(!strcmp(destination, conn->destination))
+        ++n;
+      e = Curl_node_next(e);
+    }
+    return n;
+  }
+  return 0;
+}
+
+static CURLMcode cshutdn_update_ev(struct cshutdn *cshutdn,
+                                   struct Curl_easy *data,
+                                   struct connectdata *conn)
+{
+  CURLMcode mresult;
+
+  DEBUGASSERT(cshutdn);
+  DEBUGASSERT(cshutdn->multi->socket_cb);
+
+  Curl_attach_connection(data, conn);
+  mresult = Curl_multi_ev_assess_conn(cshutdn->multi, data, conn);
+  Curl_detach_connection(data);
+  return mresult;
+}
+
+void Curl_cshutdn_add(struct cshutdn *cshutdn,
+                      struct connectdata *conn,
+                      size_t conns_in_pool)
+{
+  struct Curl_easy *data = cshutdn->multi->admin;
+  size_t max_total = cshutdn->multi->max_total_connections;
+
+  /* Add the connection to our shutdown list for non-blocking shutdown
+   * during multi processing. */
+  if(max_total > 0 &&
+     (max_total <= (conns_in_pool + Curl_llist_count(&cshutdn->list)))) {
+    CURL_TRC_M(data, "[SHUTDOWN] discarding oldest shutdown connection "
+               "due to connection limit of %zu", max_total);
+    cshutdn_destroy_oldest(cshutdn, data, NULL);
+  }
+
+  if(cshutdn->multi->socket_cb) {
+    if(cshutdn_update_ev(cshutdn, data, conn)) {
+      CURL_TRC_M(data, "[SHUTDOWN] update events failed, discarding #%"
+                 FMT_OFF_T, conn->connection_id);
+      Curl_cshutdn_terminate(data, conn, FALSE);
+      return;
+    }
+  }
+
+  Curl_llist_append(&cshutdn->list, conn, &conn->cshutdn_node);
+  CURL_TRC_M(data, "[SHUTDOWN] added #%" FMT_OFF_T
+             " to shutdowns, now %zu conns in shutdown",
+             conn->connection_id, Curl_llist_count(&cshutdn->list));
+}
+
+void Curl_cshutdn_perform(struct cshutdn *cshutdn,
+                          struct Curl_easy *data,
+                          struct Curl_sigpipe_ctx *sigpipe_ctx)
+{
+  cshutdn_perform(cshutdn, data, sigpipe_ctx);
+}
+
+/* return fd_set info about the shutdown connections */
+void Curl_cshutdn_setfds(struct cshutdn *cshutdn,
+                         struct Curl_easy *data,
+                         fd_set *read_fd_set, fd_set *write_fd_set,
+                         int *maxfd)
+{
+  if(Curl_llist_head(&cshutdn->list)) {
+    struct Curl_llist_node *e;
+    struct easy_pollset ps;
+
+    Curl_pollset_init(&ps);
+    for(e = Curl_llist_head(&cshutdn->list); e; e = Curl_node_next(e)) {
+      unsigned int i;
+      struct connectdata *conn = Curl_node_elem(e);
+      CURLcode result;
+
+      Curl_pollset_reset(&ps);
+      Curl_attach_connection(data, conn);
+      result = Curl_conn_adjust_pollset(data, conn, &ps);
+      Curl_detach_connection(data);
+
+      if(result)
+        continue;
+
+      for(i = 0; i < ps.n; i++) {
+        curl_socket_t sock = ps.sockets[i];
+        if(!FDSET_SOCK(sock))
+          continue;
+        if(ps.actions[i] & CURL_POLL_IN)
+          FD_SET(sock, read_fd_set);
+        if(ps.actions[i] & CURL_POLL_OUT)
+          FD_SET(sock, write_fd_set);
+        if((ps.actions[i] & (CURL_POLL_OUT | CURL_POLL_IN)) &&
+           ((int)sock > *maxfd))
+          *maxfd = (int)sock;
+      }
+    }
+    Curl_pollset_cleanup(&ps);
+  }
+}
+
+/* return information about the shutdown connections */
+unsigned int Curl_cshutdn_add_waitfds(struct cshutdn *cshutdn,
+                                      struct Curl_easy *data,
+                                      struct Curl_waitfds *cwfds)
+{
+  unsigned int need = 0;
+
+  if(Curl_llist_head(&cshutdn->list)) {
+    struct Curl_llist_node *e;
+    struct easy_pollset ps;
+    struct connectdata *conn;
+    CURLcode result;
+
+    Curl_pollset_init(&ps);
+    for(e = Curl_llist_head(&cshutdn->list); e; e = Curl_node_next(e)) {
+      conn = Curl_node_elem(e);
+      Curl_pollset_reset(&ps);
+      Curl_attach_connection(data, conn);
+      result = Curl_conn_adjust_pollset(data, conn, &ps);
+      Curl_detach_connection(data);
+
+      if(!result)
+        need += Curl_waitfds_add_ps(cwfds, &ps);
+    }
+    Curl_pollset_cleanup(&ps);
+  }
+  return need;
+}
+
+CURLcode Curl_cshutdn_add_pollfds(struct cshutdn *cshutdn,
+                                  struct Curl_easy *data,
+                                  struct curl_pollfds *cpfds)
+{
+  CURLcode result = CURLE_OK;
+
+  if(Curl_llist_head(&cshutdn->list)) {
+    struct Curl_llist_node *e;
+    struct easy_pollset ps;
+    struct connectdata *conn;
+
+    Curl_pollset_init(&ps);
+    for(e = Curl_llist_head(&cshutdn->list); e; e = Curl_node_next(e)) {
+      conn = Curl_node_elem(e);
+      Curl_pollset_reset(&ps);
+      Curl_attach_connection(data, conn);
+      result = Curl_conn_adjust_pollset(data, conn, &ps);
+      Curl_detach_connection(data);
+
+      if(!result)
+        result = Curl_pollfds_add_ps(cpfds, &ps);
+      if(result) {
+        Curl_pollset_cleanup(&ps);
+        Curl_pollfds_cleanup(cpfds);
+        goto out;
+      }
+    }
+    Curl_pollset_cleanup(&ps);
+  }
+out:
+  return result;
+}
diff --git a/third-party/curl/lib/cshutdn.h b/third-party/curl/lib/cshutdn.h
new file mode 100644
index 0000000000..8479524993
--- /dev/null
+++ b/third-party/curl/lib/cshutdn.h
@@ -0,0 +1,106 @@
+#ifndef HEADER_CURL_CSHUTDN_H
+#define HEADER_CURL_CSHUTDN_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) Linus Nielsen Feltzing, <linus@haxx.se>
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+struct connectdata;
+struct Curl_easy;
+struct curl_pollfds;
+struct Curl_waitfds;
+struct Curl_multi;
+struct Curl_share;
+struct Curl_sigpipe_ctx;
+
+/* Run the shutdown of the connection once.
+ * Shortly attach/detach `data` to `conn` while doing so.
+ * `done` will be set TRUE if any error was encountered or if
+ * the connection was shut down completely. */
+void Curl_cshutdn_run_once(struct Curl_easy *data,
+                           struct connectdata *conn,
+                           bool *done);
+
+/* Terminates the connection, e.g. closes and destroys it.
+ * If `do_shutdown` is TRUE, the shutdown will be run once before
+ * terminating it.
+ * Takes ownership of `conn`. */
+void Curl_cshutdn_terminate(struct Curl_easy *data,
+                            struct connectdata *conn,
+                            bool do_shutdown);
+
+/* A `cshutdown` is always owned by a multi handle to maintain
+ * the connections to be shut down. It registers timers and
+ * sockets to monitor via the multi handle. */
+struct cshutdn {
+  struct Curl_llist list;    /* connections being shut down */
+  struct Curl_multi *multi;  /* the multi owning this */
+  BIT(initialized);
+};
+
+/* Init as part of the given multi handle. */
+int Curl_cshutdn_init(struct cshutdn *cshutdn,
+                      struct Curl_multi *multi);
+
+/* Terminate all remaining connections and free resources. */
+void Curl_cshutdn_destroy(struct cshutdn *cshutdn,
+                          struct Curl_easy *data);
+
+/* Number of connections being shut down. */
+size_t Curl_cshutdn_count(struct Curl_easy *data);
+
+/* Number of connections to the destination being shut down. */
+size_t Curl_cshutdn_dest_count(struct Curl_easy *data,
+                               const char *destination);
+
+/* Close the oldest connection in shutdown to destination or,
+ * when destination is NULL for any destination.
+ * Return TRUE if a connection has been closed. */
+bool Curl_cshutdn_close_oldest(struct Curl_easy *data,
+                               const char *destination);
+
+/* Add a connection to have it shut down. Terminate the oldest
+ * connection when total connection limit of multi is being reached. */
+void Curl_cshutdn_add(struct cshutdn *cshutdn,
+                      struct connectdata *conn,
+                      size_t conns_in_pool);
+
+/* Add sockets and POLLIN/OUT flags for connections being shut down. */
+CURLcode Curl_cshutdn_add_pollfds(struct cshutdn *cshutdn,
+                                  struct Curl_easy *data,
+                                  struct curl_pollfds *cpfds);
+
+unsigned int Curl_cshutdn_add_waitfds(struct cshutdn *cshutdn,
+                                      struct Curl_easy *data,
+                                      struct Curl_waitfds *cwfds);
+
+void Curl_cshutdn_setfds(struct cshutdn *cshutdn,
+                         struct Curl_easy *data,
+                         fd_set *read_fd_set, fd_set *write_fd_set,
+                         int *maxfd);
+
+/* Run maintenance on all connections. */
+void Curl_cshutdn_perform(struct cshutdn *cshutdn,
+                          struct Curl_easy *data,
+                          struct Curl_sigpipe_ctx *sigpipe_ctx);
+
+#endif /* HEADER_CURL_CSHUTDN_H */
diff --git a/third-party/curl/lib/curl_addrinfo.c b/third-party/curl/lib/curl_addrinfo.c
index f9211d3f57..a927d44c99 100644
--- a/third-party/curl/lib/curl_addrinfo.c
+++ b/third-party/curl/lib/curl_addrinfo.c
@@ -21,11 +21,8 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include <curl/curl.h>
-
 #ifdef HAVE_NETINET_IN_H
 #  include <netinet/in.h>
 #endif
@@ -47,15 +44,12 @@
 #  include <inet.h>
 #endif
 
-#include <stddef.h>
+#include <stddef.h>  /* for offsetof() */
 
 #include "curl_addrinfo.h"
-#include "inet_pton.h"
-#include "warnless.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "fake_addrinfo.h"
+#include "curlx/inet_pton.h"
+#include "curlx/strparse.h"
 
 /*
  * Curl_freeaddrinfo()
@@ -66,27 +60,25 @@
  * any function call which actually allocates a Curl_addrinfo struct.
  */
 
-#if defined(__INTEL_COMPILER) && (__INTEL_COMPILER == 910) && \
-    defined(__OPTIMIZE__) && defined(__unix__) &&  defined(__i386__)
+#if defined(__INTEL_COMPILER) && (__INTEL_COMPILER == 910) &&     \
+  defined(__OPTIMIZE__) && defined(__unix__) && defined(__i386__)
   /* workaround icc 9.1 optimizer issue */
-# define vqualifier volatile
+#  define vqualifier volatile
 #else
-# define vqualifier
+#  define vqualifier
 #endif
 
-void
-Curl_freeaddrinfo(struct Curl_addrinfo *cahead)
+void Curl_freeaddrinfo(struct Curl_addrinfo *cahead)
 {
   struct Curl_addrinfo *vqualifier canext;
   struct Curl_addrinfo *ca;
 
   for(ca = cahead; ca; ca = canext) {
     canext = ca->ai_next;
-    free(ca);
+    curlx_free(ca);
   }
 }
 
-
 #ifdef HAVE_GETADDRINFO
 /*
  * Curl_getaddrinfo_ex()
@@ -95,18 +87,16 @@ Curl_freeaddrinfo(struct Curl_addrinfo *cahead)
  * the only difference that instead of returning a linked list of
  * addrinfo structs this one returns a linked list of Curl_addrinfo
  * ones. The memory allocated by this function *MUST* be free'd with
- * Curl_freeaddrinfo().  For each successful call to this function
+ * Curl_freeaddrinfo(). For each successful call to this function
  * there must be an associated call later to Curl_freeaddrinfo().
  *
  * There should be no single call to system's getaddrinfo() in the
  * whole library, any such call should be 'routed' through this one.
  */
-
-int
-Curl_getaddrinfo_ex(const char *nodename,
-                    const char *servname,
-                    const struct addrinfo *hints,
-                    struct Curl_addrinfo **result)
+int Curl_getaddrinfo_ex(const char *nodename,
+                        const char *servname,
+                        const struct addrinfo *hints,
+                        struct Curl_addrinfo **result)
 {
   const struct addrinfo *ai;
   struct addrinfo *aihead;
@@ -118,19 +108,19 @@ Curl_getaddrinfo_ex(const char *nodename,
 
   *result = NULL; /* assume failure */
 
-  error = getaddrinfo(nodename, servname, hints, &aihead);
+  error = CURL_GETADDRINFO(nodename, servname, hints, &aihead);
   if(error)
     return error;
 
   /* traverse the addrinfo list */
 
-  for(ai = aihead; ai != NULL; ai = ai->ai_next) {
+  for(ai = aihead; ai; ai = ai->ai_next) {
     size_t namelen = ai->ai_canonname ? strlen(ai->ai_canonname) + 1 : 0;
-    /* ignore elements with unsupported address family, */
-    /* settle family-specific sockaddr structure size.  */
+    /* ignore elements with unsupported address family,
+       settle family-specific sockaddr structure size. */
     if(ai->ai_family == AF_INET)
       ss_size = sizeof(struct sockaddr_in);
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
     else if(ai->ai_family == AF_INET6)
       ss_size = sizeof(struct sockaddr_in6);
 #endif
@@ -145,14 +135,14 @@ Curl_getaddrinfo_ex(const char *nodename,
     if((size_t)ai->ai_addrlen < ss_size)
       continue;
 
-    ca = malloc(sizeof(struct Curl_addrinfo) + ss_size + namelen);
+    ca = curlx_malloc(sizeof(struct Curl_addrinfo) + ss_size + namelen);
     if(!ca) {
       error = EAI_MEMORY;
       break;
     }
 
-    /* copy each structure member individually, member ordering, */
-    /* size, or padding might be different for each platform.    */
+    /* copy each structure member individually, member ordering,
+       size, or padding might be different for each platform. */
 
     ca->ai_flags     = ai->ai_flags;
     ca->ai_family    = ai->ai_family;
@@ -179,12 +169,11 @@ Curl_getaddrinfo_ex(const char *nodename,
     if(calast)
       calast->ai_next = ca;
     calast = ca;
-
   }
 
   /* destroy the addrinfo list */
   if(aihead)
-    freeaddrinfo(aihead);
+    CURL_FREEADDRINFO(aihead);
 
   /* if we failed, also destroy the Curl_addrinfo list */
   if(error) {
@@ -211,17 +200,16 @@ Curl_getaddrinfo_ex(const char *nodename,
 }
 #endif /* HAVE_GETADDRINFO */
 
-
 /*
  * Curl_he2ai()
  *
  * This function returns a pointer to the first element of a newly allocated
  * Curl_addrinfo struct linked list filled with the data of a given hostent.
- * Curl_addrinfo is meant to work like the addrinfo struct does for a IPv6
+ * Curl_addrinfo is meant to work like the addrinfo struct does for an IPv6
  * stack, but usable also for IPv4, all hosts and environments.
  *
  * The memory allocated by this function *MUST* be free'd later on calling
- * Curl_freeaddrinfo().  For each successful call to this function there
+ * Curl_freeaddrinfo(). For each successful call to this function there
  * must be an associated call later to Curl_freeaddrinfo().
  *
  *   Curl_addrinfo defined in "lib/curl_addrinfo.h"
@@ -251,15 +239,14 @@ Curl_getaddrinfo_ex(const char *nodename,
  *
  *     #define h_addr  h_addr_list[0]
  */
-
-struct Curl_addrinfo *
-Curl_he2ai(const struct hostent *he, int port)
+#if !(defined(HAVE_GETADDRINFO) && defined(HAVE_GETADDRINFO_THREADSAFE))
+struct Curl_addrinfo *Curl_he2ai(const struct hostent *he, int port)
 {
   struct Curl_addrinfo *ai;
   struct Curl_addrinfo *prevai = NULL;
   struct Curl_addrinfo *firstai = NULL;
   struct sockaddr_in *addr;
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
   struct sockaddr_in6 *addr6;
 #endif
   CURLcode result = CURLE_OK;
@@ -270,12 +257,12 @@ Curl_he2ai(const struct hostent *he, int port)
     /* no input == no output! */
     return NULL;
 
-  DEBUGASSERT((he->h_name != NULL) && (he->h_addr_list != NULL));
+  DEBUGASSERT(he->h_name && he->h_addr_list);
 
   for(i = 0; (curr = he->h_addr_list[i]) != NULL; i++) {
     size_t ss_size;
     size_t namelen = strlen(he->h_name) + 1; /* include null-terminator */
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
     if(he->h_addrtype == AF_INET6)
       ss_size = sizeof(struct sockaddr_in6);
     else
@@ -283,7 +270,7 @@ Curl_he2ai(const struct hostent *he, int port)
       ss_size = sizeof(struct sockaddr_in);
 
     /* allocate memory to hold the struct, the address and the name */
-    ai = calloc(1, sizeof(struct Curl_addrinfo) + ss_size + namelen);
+    ai = curlx_calloc(1, sizeof(struct Curl_addrinfo) + ss_size + namelen);
     if(!ai) {
       result = CURLE_OUT_OF_MEMORY;
       break;
@@ -321,7 +308,7 @@ Curl_he2ai(const struct hostent *he, int port)
       addr->sin_port = htons((unsigned short)port);
       break;
 
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
     case AF_INET6:
       addr6 = (void *)ai->ai_addr; /* storage area for this info */
 
@@ -342,152 +329,191 @@ Curl_he2ai(const struct hostent *he, int port)
 
   return firstai;
 }
-
-
-struct namebuff {
-  struct hostent hostentry;
-  union {
-    struct in_addr  ina4;
-#ifdef ENABLE_IPV6
-    struct in6_addr ina6;
 #endif
-  } addrentry;
-  char *h_addr_list[2];
-};
-
 
 /*
- * Curl_ip2addr()
+ * ip2addr()
  *
- * This function takes an internet address, in binary form, as input parameter
+ * This function takes an Internet address, in binary form, as input parameter
  * along with its address family and the string version of the address, and it
  * returns a Curl_addrinfo chain filled in correctly with information for the
  * given address/host
  */
-
-struct Curl_addrinfo *
-Curl_ip2addr(int af, const void *inaddr, const char *hostname, int port)
+static CURLcode ip2addr(struct Curl_addrinfo **addrp, int af,
+                        const void *inaddr, const char *hostname, int port)
 {
   struct Curl_addrinfo *ai;
-
-#if defined(__VMS) && \
-    defined(__INITIAL_POINTER_SIZE) && (__INITIAL_POINTER_SIZE == 64)
-#pragma pointer_size save
-#pragma pointer_size short
-#pragma message disable PTRMISMATCH
-#endif
-
-  struct hostent  *h;
-  struct namebuff *buf;
-  char  *addrentry;
-  char  *hoststr;
   size_t addrsize;
+  size_t namelen;
+  struct sockaddr_in *addr;
+#ifdef USE_IPV6
+  struct sockaddr_in6 *addr6;
+#endif
 
   DEBUGASSERT(inaddr && hostname);
 
-  buf = malloc(sizeof(struct namebuff));
-  if(!buf)
-    return NULL;
+  namelen = strlen(hostname) + 1;
+  *addrp = NULL;
 
-  hoststr = strdup(hostname);
-  if(!hoststr) {
-    free(buf);
-    return NULL;
-  }
+  if(af == AF_INET)
+    addrsize = sizeof(struct sockaddr_in);
+#ifdef USE_IPV6
+  else if(af == AF_INET6)
+    addrsize = sizeof(struct sockaddr_in6);
+#endif
+  else
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  /* allocate memory to hold the struct, the address and the name */
+  ai = curlx_calloc(1, sizeof(struct Curl_addrinfo) + addrsize + namelen);
+  if(!ai)
+    return CURLE_OUT_OF_MEMORY;
+  /* put the address after the struct */
+  ai->ai_addr = (void *)((char *)ai + sizeof(struct Curl_addrinfo));
+  /* then put the name after the address */
+  ai->ai_canonname = (char *)ai->ai_addr + addrsize;
+  memcpy(ai->ai_canonname, hostname, namelen);
+  ai->ai_family = af;
+  ai->ai_socktype = SOCK_STREAM;
+  ai->ai_addrlen = (curl_socklen_t)addrsize;
+  /* leave the rest of the struct filled with zero */
 
   switch(af) {
   case AF_INET:
-    addrsize = sizeof(struct in_addr);
-    addrentry = (void *)&buf->addrentry.ina4;
-    memcpy(addrentry, inaddr, sizeof(struct in_addr));
+    addr = (void *)ai->ai_addr; /* storage area for this info */
+
+    memcpy(&addr->sin_addr, inaddr, sizeof(struct in_addr));
+    addr->sin_family = (CURL_SA_FAMILY_T)af;
+    addr->sin_port = htons((unsigned short)port);
     break;
-#ifdef ENABLE_IPV6
+
+#ifdef USE_IPV6
   case AF_INET6:
-    addrsize = sizeof(struct in6_addr);
-    addrentry = (void *)&buf->addrentry.ina6;
-    memcpy(addrentry, inaddr, sizeof(struct in6_addr));
+    addr6 = (void *)ai->ai_addr; /* storage area for this info */
+
+    memcpy(&addr6->sin6_addr, inaddr, sizeof(struct in6_addr));
+    addr6->sin6_family = (CURL_SA_FAMILY_T)af;
+    addr6->sin6_port = htons((unsigned short)port);
     break;
 #endif
-  default:
-    free(hoststr);
-    free(buf);
-    return NULL;
   }
-
-  h = &buf->hostentry;
-  h->h_name = hoststr;
-  h->h_aliases = NULL;
-  h->h_addrtype = (short)af;
-  h->h_length = (short)addrsize;
-  h->h_addr_list = &buf->h_addr_list[0];
-  h->h_addr_list[0] = addrentry;
-  h->h_addr_list[1] = NULL; /* terminate list of entries */
-
-#if defined(__VMS) && \
-    defined(__INITIAL_POINTER_SIZE) && (__INITIAL_POINTER_SIZE == 64)
-#pragma pointer_size restore
-#pragma message enable PTRMISMATCH
-#endif
-
-  ai = Curl_he2ai(h, port);
-
-  free(hoststr);
-  free(buf);
-
-  return ai;
+  *addrp = ai;
+  return CURLE_OK;
 }
 
 /*
  * Given an IPv4 or IPv6 dotted string address, this converts it to a proper
  * allocated Curl_addrinfo struct and returns it.
  */
-struct Curl_addrinfo *Curl_str2addr(char *address, int port)
+CURLcode Curl_str2addr(const char *dotted, uint16_t port,
+                       struct Curl_addrinfo **addrp)
 {
   struct in_addr in;
-  if(Curl_inet_pton(AF_INET, address, &in) > 0)
+  if(curlx_inet_pton(AF_INET, dotted, &in) > 0)
     /* This is a dotted IP address 123.123.123.123-style */
-    return Curl_ip2addr(AF_INET, &in, address, port);
-#ifdef ENABLE_IPV6
+    return ip2addr(addrp, AF_INET, &in, dotted, port);
+#ifdef USE_IPV6
   {
     struct in6_addr in6;
-    if(Curl_inet_pton(AF_INET6, address, &in6) > 0)
+    if(curlx_inet_pton(AF_INET6, dotted, &in6) > 0)
       /* This is a dotted IPv6 address ::1-style */
-      return Curl_ip2addr(AF_INET6, &in6, address, port);
+      return ip2addr(addrp, AF_INET6, &in6, dotted, port);
   }
 #endif
-  return NULL; /* bad input format */
+  return CURLE_BAD_FUNCTION_ARGUMENT; /* bad input format */
+}
+
+bool Curl_is_ipv4addr(const char *address)
+{
+  struct in_addr in;
+  return (curlx_inet_pton(AF_INET, address, &in) > 0);
+}
+
+bool Curl_is_ipaddr(const char *address)
+{
+  if(Curl_is_ipv4addr(address))
+    return TRUE;
+#ifdef USE_IPV6
+  {
+    struct in6_addr in6;
+    if(curlx_inet_pton(AF_INET6, address, &in6) > 0)
+      /* This is a dotted IPv6 address ::1-style */
+      return TRUE;
+  }
+#endif
+  return FALSE;
+}
+
+bool Curl_looks_like_ipv6(const char *s, size_t len, bool maybe_url_encoded,
+                          struct Curl_str *host, struct Curl_str *zone)
+{
+  const char *zonep = NULL;
+  size_t i = 0, hlen = 0, zlen = 0;
+
+  if(host)
+    memset(host, 0, sizeof(*host));
+  if(zone)
+    memset(zone, 0, sizeof(*zone));
+
+  for(i = 0; i < len; ++i, ++hlen) {
+    if(!s[i] || !(ISXDIGIT(s[i]) || (s[i] == ':') || (s[i] == '.')))
+      break;
+  }
+
+  if((i < len) && (s[i] == '%')) { /* address followed by a zone? */
+    i += 1;
+    if(maybe_url_encoded && !strncmp("25", s + i, 2))
+      i += 2;
+    zonep = s + i;
+    for(; i < len; ++i, ++zlen) {
+      /* Allow unreserved characters as defined in RFC 3986 */
+      if(!s[i] || !(ISALPHA(s[i]) || ISXDIGIT(s[i]) || (s[i] == '-') ||
+                    (s[i] == '.') || (s[i] == '_') || (s[i] == '~')))
+        break;
+    }
+  }
+
+  if(i != len)
+    return FALSE; /* invalid chars in zone */
+  if(host && hlen) {
+    host->str = s;
+    host->len = hlen;
+  }
+  if(zone && zlen) {
+    zone->str = zonep;
+    zone->len = zlen;
+  }
+  return TRUE;
 }
 
 #ifdef USE_UNIX_SOCKETS
 /**
  * Given a path to a Unix domain socket, return a newly allocated Curl_addrinfo
  * struct initialized with this path.
- * Set '*longpath' to TRUE if the error is a too long path.
+ * Returns CURLE_TOO_LARGE when path is too long.
  */
-struct Curl_addrinfo *Curl_unix2addr(const char *path, bool *longpath,
-                                     bool abstract)
+CURLcode Curl_unix2addr(const char *path, bool abstract,
+                        struct Curl_addrinfo **paddr)
 {
   struct Curl_addrinfo *ai;
   struct sockaddr_un *sa_un;
   size_t path_len;
 
-  *longpath = FALSE;
+  *paddr = NULL;
 
-  ai = calloc(1, sizeof(struct Curl_addrinfo) + sizeof(struct sockaddr_un));
-  if(!ai)
-    return NULL;
-  ai->ai_addr = (void *)((char *)ai + sizeof(struct Curl_addrinfo));
-
-  sa_un = (void *) ai->ai_addr;
-  sa_un->sun_family = AF_UNIX;
-
-  /* sun_path must be able to store the NUL-terminated path */
+  /* sun_path must be able to store the null-terminated path */
   path_len = strlen(path) + 1;
-  if(path_len > sizeof(sa_un->sun_path)) {
-    free(ai);
-    *longpath = TRUE;
-    return NULL;
-  }
+  if(path_len > sizeof(sa_un->sun_path))
+    return CURLE_TOO_LARGE;
+
+  ai = curlx_calloc(1,
+                    sizeof(struct Curl_addrinfo) + sizeof(struct sockaddr_un));
+  if(!ai)
+    return CURLE_OUT_OF_MEMORY;
+
+  ai->ai_addr = (void *)((char *)ai + sizeof(struct Curl_addrinfo));
+  sa_un = (void *)ai->ai_addr;
+  sa_un->sun_family = AF_UNIX;
 
   ai->ai_family = AF_UNIX;
   ai->ai_socktype = SOCK_STREAM; /* assume reliable transport for HTTP */
@@ -500,87 +526,101 @@ struct Curl_addrinfo *Curl_unix2addr(const char *path, bool *longpath,
   else
     memcpy(sa_un->sun_path, path, path_len); /* copy NUL byte */
 
-  return ai;
+  *paddr = ai;
+  return CURLE_OK;
 }
 #endif
 
-#if defined(CURLDEBUG) && defined(HAVE_GETADDRINFO) &&  \
+#if defined(CURL_MEMDEBUG) && defined(HAVE_GETADDRINFO) && \
   defined(HAVE_FREEADDRINFO)
 /*
  * curl_dbg_freeaddrinfo()
  *
  * This is strictly for memory tracing and are using the same style as the
  * family otherwise present in memdebug.c. I put these ones here since they
- * require a bunch of structs I didn't want to include in memdebug.c
+ * require a bunch of structs I did not want to include in memdebug.c
  */
-
-void
-curl_dbg_freeaddrinfo(struct addrinfo *freethis,
-                      int line, const char *source)
+void curl_dbg_freeaddrinfo(struct addrinfo *freethis,
+                           int line, const char *source)
 {
   curl_dbg_log("ADDR %s:%d freeaddrinfo(%p)\n",
                source, line, (void *)freethis);
 #ifdef USE_LWIPSOCK
   lwip_freeaddrinfo(freethis);
+#elif defined(USE_FAKE_GETADDRINFO)
+  {
+    const char *env = getenv("CURL_DNS_SERVER");
+    if(env)
+      r_freeaddrinfo(freethis);
+    else
+      /* !checksrc! disable BANNEDFUNC 1 */
+      freeaddrinfo(freethis);
+  }
 #else
-  (freeaddrinfo)(freethis);
+  /* !checksrc! disable BANNEDFUNC 1 */
+  freeaddrinfo(freethis);
 #endif
 }
-#endif /* defined(CURLDEBUG) && defined(HAVE_FREEADDRINFO) */
+#endif /* CURL_MEMDEBUG && HAVE_FREEADDRINFO */
 
-
-#if defined(CURLDEBUG) && defined(HAVE_GETADDRINFO)
+#if defined(CURL_MEMDEBUG) && defined(HAVE_GETADDRINFO)
 /*
  * curl_dbg_getaddrinfo()
  *
  * This is strictly for memory tracing and are using the same style as the
  * family otherwise present in memdebug.c. I put these ones here since they
- * require a bunch of structs I didn't want to include in memdebug.c
+ * require a bunch of structs I did not want to include in memdebug.c
  */
-
-int
-curl_dbg_getaddrinfo(const char *hostname,
-                    const char *service,
-                    const struct addrinfo *hints,
-                    struct addrinfo **result,
-                    int line, const char *source)
+int curl_dbg_getaddrinfo(const char *hostname,
+                         const char *service,
+                         const struct addrinfo *hints,
+                         struct addrinfo **result,
+                         int line, const char *source)
 {
 #ifdef USE_LWIPSOCK
   int res = lwip_getaddrinfo(hostname, service, hints, result);
-#else
-  int res = (getaddrinfo)(hostname, service, hints, result);
-#endif
-  if(0 == res)
-    /* success */
-    curl_dbg_log("ADDR %s:%d getaddrinfo() = %p\n",
-                 source, line, (void *)*result);
+#elif defined(USE_FAKE_GETADDRINFO)
+  int res;
+  const char *env = getenv("CURL_DNS_SERVER");
+  if(env)
+    res = r_getaddrinfo(hostname, service, hints, result);
   else
-    curl_dbg_log("ADDR %s:%d getaddrinfo() failed\n",
-                 source, line);
+    /* !checksrc! disable BANNEDFUNC 1 */
+    res = getaddrinfo(hostname, service, hints, result);
+#else
+  /* !checksrc! disable BANNEDFUNC 1 */
+  int res = getaddrinfo(hostname, service, hints, result);
+#endif
+  if(res == 0)
+    /* success */
+    curl_dbg_log("ADDR %s:%d getaddrinfo() = %p\n", source, line,
+                 (void *)*result);
+  else
+    curl_dbg_log("ADDR %s:%d getaddrinfo() failed\n", source, line);
   return res;
 }
-#endif /* defined(CURLDEBUG) && defined(HAVE_GETADDRINFO) */
+#endif /* CURL_MEMDEBUG && HAVE_GETADDRINFO */
 
 #if defined(HAVE_GETADDRINFO) && defined(USE_RESOLVE_ON_IPS)
 /*
- * Work-arounds the sin6_port is always zero bug on iOS 9.3.2 and Mac OS X
+ * Works around the sin6_port is always zero bug on iOS 9.3.2 and macOS
  * 10.11.5.
  */
 void Curl_addrinfo_set_port(struct Curl_addrinfo *addrinfo, int port)
 {
   struct Curl_addrinfo *ca;
   struct sockaddr_in *addr;
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
   struct sockaddr_in6 *addr6;
 #endif
-  for(ca = addrinfo; ca != NULL; ca = ca->ai_next) {
+  for(ca = addrinfo; ca; ca = ca->ai_next) {
     switch(ca->ai_family) {
     case AF_INET:
       addr = (void *)ca->ai_addr; /* storage area for this info */
       addr->sin_port = htons((unsigned short)port);
       break;
 
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
     case AF_INET6:
       addr6 = (void *)ca->ai_addr; /* storage area for this info */
       addr6->sin6_port = htons((unsigned short)port);
diff --git a/third-party/curl/lib/curl_addrinfo.h b/third-party/curl/lib/curl_addrinfo.h
index c757c49c5c..046be23816 100644
--- a/third-party/curl/lib/curl_addrinfo.h
+++ b/third-party/curl/lib/curl_addrinfo.h
@@ -23,7 +23,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef HAVE_NETINET_IN_H
@@ -39,14 +38,15 @@
 #ifdef __VMS
 #  include <in.h>
 #  include <inet.h>
-#  include <stdlib.h>
 #endif
 
+struct Curl_str;
+
 /*
  * Curl_addrinfo is our internal struct definition that we use to allow
- * consistent internal handling of this data. We use this even when the
- * system provides an addrinfo structure definition. And we use this for
- * all sorts of IPv4 and IPV6 builds.
+ * consistent internal handling of this data. We use this even when the system
+ * provides an addrinfo structure definition. We use this for all sorts of
+ * IPv4 and IPV6 builds.
  */
 
 struct Curl_addrinfo {
@@ -60,48 +60,50 @@ struct Curl_addrinfo {
   struct Curl_addrinfo *ai_next;
 };
 
-void
-Curl_freeaddrinfo(struct Curl_addrinfo *cahead);
+void Curl_freeaddrinfo(struct Curl_addrinfo *cahead);
 
 #ifdef HAVE_GETADDRINFO
-int
-Curl_getaddrinfo_ex(const char *nodename,
-                    const char *servname,
-                    const struct addrinfo *hints,
-                    struct Curl_addrinfo **result);
+int Curl_getaddrinfo_ex(const char *nodename,
+                        const char *servname,
+                        const struct addrinfo *hints,
+                        struct Curl_addrinfo **result);
 #endif
 
-struct Curl_addrinfo *
-Curl_he2ai(const struct hostent *he, int port);
+#if !(defined(HAVE_GETADDRINFO) && defined(HAVE_GETADDRINFO_THREADSAFE))
+struct Curl_addrinfo *Curl_he2ai(const struct hostent *he, int port);
+#endif
 
-struct Curl_addrinfo *
-Curl_ip2addr(int af, const void *inaddr, const char *hostname, int port);
+bool Curl_is_ipv4addr(const char *address);
+bool Curl_is_ipaddr(const char *address);
+bool Curl_looks_like_ipv6(const char *s, size_t len, bool maybe_url_encoded,
+                          struct Curl_str *host, struct Curl_str *zone);
 
-struct Curl_addrinfo *Curl_str2addr(char *dotted, int port);
+CURLcode Curl_str2addr(const char *dotted, uint16_t port,
+                       struct Curl_addrinfo **addrp);
 
 #ifdef USE_UNIX_SOCKETS
-struct Curl_addrinfo *Curl_unix2addr(const char *path, bool *longpath,
-                                     bool abstract);
+CURLcode Curl_unix2addr(const char *path, bool abstract,
+                        struct Curl_addrinfo **paddr);
 #endif
 
-#if defined(CURLDEBUG) && defined(HAVE_GETADDRINFO) && \
-    defined(HAVE_FREEADDRINFO)
-void
-curl_dbg_freeaddrinfo(struct addrinfo *freethis, int line, const char *source);
+#if defined(CURL_MEMDEBUG) && defined(HAVE_GETADDRINFO) && \
+  defined(HAVE_FREEADDRINFO)
+void curl_dbg_freeaddrinfo(struct addrinfo *freethis, int line,
+                           const char *source);
 #endif
 
-#if defined(CURLDEBUG) && defined(HAVE_GETADDRINFO)
-int
-curl_dbg_getaddrinfo(const char *hostname, const char *service,
-                     const struct addrinfo *hints, struct addrinfo **result,
-                     int line, const char *source);
+#if defined(CURL_MEMDEBUG) && defined(HAVE_GETADDRINFO)
+int curl_dbg_getaddrinfo(const char *hostname, const char *service,
+                         const struct addrinfo *hints,
+                         struct addrinfo **result, int line,
+                         const char *source);
 #endif
 
 #ifdef HAVE_GETADDRINFO
 #ifdef USE_RESOLVE_ON_IPS
 void Curl_addrinfo_set_port(struct Curl_addrinfo *addrinfo, int port);
 #else
-#define Curl_addrinfo_set_port(x,y)
+#define Curl_addrinfo_set_port(x, y)
 #endif
 #endif
 
diff --git a/third-party/curl/lib/curl_base64.h b/third-party/curl/lib/curl_base64.h
deleted file mode 100644
index 7f7cd1d98a..0000000000
--- a/third-party/curl/lib/curl_base64.h
+++ /dev/null
@@ -1,41 +0,0 @@
-#ifndef HEADER_CURL_BASE64_H
-#define HEADER_CURL_BASE64_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#ifndef BUILDING_LIBCURL
-/* this renames functions so that the tool code can use the same code
-   without getting symbol collisions */
-#define Curl_base64_encode(a,b,c,d) curlx_base64_encode(a,b,c,d)
-#define Curl_base64url_encode(a,b,c,d) curlx_base64url_encode(a,b,c,d)
-#define Curl_base64_decode(a,b,c) curlx_base64_decode(a,b,c)
-#endif
-
-CURLcode Curl_base64_encode(const char *inputbuff, size_t insize,
-                            char **outptr, size_t *outlen);
-CURLcode Curl_base64url_encode(const char *inputbuff, size_t insize,
-                               char **outptr, size_t *outlen);
-CURLcode Curl_base64_decode(const char *src,
-                            unsigned char **outptr, size_t *outlen);
-#endif /* HEADER_CURL_BASE64_H */
diff --git a/third-party/curl/lib/curl_config-cmake.h.in b/third-party/curl/lib/curl_config-cmake.h.in
new file mode 100644
index 0000000000..c38caa2a03
--- /dev/null
+++ b/third-party/curl/lib/curl_config-cmake.h.in
@@ -0,0 +1,801 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+/* Location of default CA bundle */
+#cmakedefine CURL_CA_BUNDLE "${CURL_CA_BUNDLE}"
+
+/* define "1" to use built-in CA store of TLS backend */
+#cmakedefine CURL_CA_FALLBACK 1
+
+/* Location of default CA path */
+#cmakedefine CURL_CA_PATH "${CURL_CA_PATH}"
+
+/* Default SSL backend */
+#cmakedefine CURL_DEFAULT_SSL_BACKEND "${CURL_DEFAULT_SSL_BACKEND}"
+
+/* Use native CA store */
+#cmakedefine CURL_CA_NATIVE 1
+
+/* disables alt-svc */
+#cmakedefine CURL_DISABLE_ALTSVC 1
+
+/* disables cookies support */
+#cmakedefine CURL_DISABLE_COOKIES 1
+
+/* disables Basic authentication */
+#cmakedefine CURL_DISABLE_BASIC_AUTH 1
+
+/* disables Bearer authentication */
+#cmakedefine CURL_DISABLE_BEARER_AUTH 1
+
+/* disables Digest authentication */
+#cmakedefine CURL_DISABLE_DIGEST_AUTH 1
+
+/* disables Kerberos authentication */
+#cmakedefine CURL_DISABLE_KERBEROS_AUTH 1
+
+/* disables negotiate authentication */
+#cmakedefine CURL_DISABLE_NEGOTIATE_AUTH 1
+
+/* disables aws-sigv4 */
+#cmakedefine CURL_DISABLE_AWS 1
+
+/* disables DICT */
+#cmakedefine CURL_DISABLE_DICT 1
+
+/* disables DNS-over-HTTPS */
+#cmakedefine CURL_DISABLE_DOH 1
+
+/* disables FILE */
+#cmakedefine CURL_DISABLE_FILE 1
+
+/* disables form api */
+#cmakedefine CURL_DISABLE_FORM_API 1
+
+/* disables FTP */
+#cmakedefine CURL_DISABLE_FTP 1
+
+/* disables curl_easy_options API for existing options to curl_easy_setopt */
+#cmakedefine CURL_DISABLE_GETOPTIONS 1
+
+/* disables GOPHER */
+#cmakedefine CURL_DISABLE_GOPHER 1
+
+/* disables headers-api support */
+#cmakedefine CURL_DISABLE_HEADERS_API 1
+
+/* disables HSTS support */
+#cmakedefine CURL_DISABLE_HSTS 1
+
+/* disables HTTP */
+#cmakedefine CURL_DISABLE_HTTP 1
+
+/* disabled all HTTP authentication methods */
+#cmakedefine CURL_DISABLE_HTTP_AUTH 1
+
+/* disables IMAP */
+#cmakedefine CURL_DISABLE_IMAP 1
+
+/* disables LDAP */
+#cmakedefine CURL_DISABLE_LDAP 1
+
+/* disables LDAPS */
+#cmakedefine CURL_DISABLE_LDAPS 1
+
+/* disables --libcurl option from the curl tool */
+#cmakedefine CURL_DISABLE_LIBCURL_OPTION 1
+
+/* disables MIME support */
+#cmakedefine CURL_DISABLE_MIME 1
+
+/* disables local binding support */
+#cmakedefine CURL_DISABLE_BINDLOCAL 1
+
+/* disables MQTT */
+#cmakedefine CURL_DISABLE_MQTT 1
+
+/* disables netrc parser */
+#cmakedefine CURL_DISABLE_NETRC 1
+
+/* enables NTLM support */
+#cmakedefine CURL_ENABLE_NTLM 1
+
+/* disables date parsing */
+#cmakedefine CURL_DISABLE_PARSEDATE 1
+
+/* disables POP3 */
+#cmakedefine CURL_DISABLE_POP3 1
+
+/* disables built-in progress meter */
+#cmakedefine CURL_DISABLE_PROGRESS_METER 1
+
+/* disables proxies */
+#cmakedefine CURL_DISABLE_PROXY 1
+
+/* disables IPFS from the curl tool */
+#cmakedefine CURL_DISABLE_IPFS 1
+
+/* disables RTSP */
+#cmakedefine CURL_DISABLE_RTSP 1
+
+/* disables SHA-512/256 hash algorithm */
+#cmakedefine CURL_DISABLE_SHA512_256 1
+
+/* disabled shuffle DNS feature */
+#cmakedefine CURL_DISABLE_SHUFFLE_DNS 1
+
+/* disables SMB */
+#cmakedefine CURL_ENABLE_SMB 1
+
+/* disables SMTP */
+#cmakedefine CURL_DISABLE_SMTP 1
+
+/* disabled WebSocket */
+#cmakedefine CURL_DISABLE_WEBSOCKETS 1
+
+/* disables use of socketpair for curl_multi_poll() */
+#cmakedefine CURL_DISABLE_SOCKETPAIR 1
+
+/* disables TELNET */
+#cmakedefine CURL_DISABLE_TELNET 1
+
+/* disables TFTP */
+#cmakedefine CURL_DISABLE_TFTP 1
+
+/* disables verbose strings */
+#cmakedefine CURL_DISABLE_VERBOSE_STRINGS 1
+
+/* disables unsafe CA bundle search on Windows from the curl tool */
+#cmakedefine CURL_DISABLE_CA_SEARCH 1
+
+/* safe CA bundle search (within the curl tool directory) on Windows */
+#cmakedefine CURL_CA_SEARCH_SAFE 1
+
+/* to make a symbol visible */
+#cmakedefine CURL_EXTERN_SYMBOL ${CURL_EXTERN_SYMBOL}
+/* Ensure using CURL_EXTERN_SYMBOL is possible */
+#ifndef CURL_EXTERN_SYMBOL
+#define CURL_EXTERN_SYMBOL
+#endif
+
+/* Allow SMB to work on Windows */
+#cmakedefine USE_WIN32_CRYPTO 1
+
+/* Use Windows LDAP implementation */
+#cmakedefine USE_WIN32_LDAP 1
+
+/* Define if you want to enable IPv6 support */
+#cmakedefine USE_IPV6 1
+
+/* Define to 1 if you have the alarm function. */
+#cmakedefine HAVE_ALARM 1
+
+/* Define to 1 if you have the arc4random function. */
+#cmakedefine HAVE_ARC4RANDOM 1
+
+/* Define to 1 if you have the <arpa/inet.h> header file. */
+#cmakedefine HAVE_ARPA_INET_H 1
+
+/* Define to 1 if you have _Atomic support. */
+#cmakedefine HAVE_ATOMIC 1
+
+/* Define to 1 if you have the `accept4' function. */
+#cmakedefine HAVE_ACCEPT4 1
+
+/* Define to 1 if you have the `fnmatch' function. */
+#cmakedefine HAVE_FNMATCH 1
+
+/* Define to 1 if you have the `basename' function. */
+#cmakedefine HAVE_BASENAME 1
+
+/* Define to 1 if bool is an available type. */
+#cmakedefine HAVE_BOOL_T 1
+
+/* Define to 1 if you have the __builtin_available function. */
+#cmakedefine HAVE_BUILTIN_AVAILABLE 1
+
+/* Define to 1 if you have the clock_gettime function and monotonic timer. */
+#cmakedefine HAVE_CLOCK_GETTIME_MONOTONIC 1
+
+/* Define to 1 if you have the clock_gettime function and raw monotonic timer.
+   */
+#cmakedefine HAVE_CLOCK_GETTIME_MONOTONIC_RAW 1
+
+/* Define to 1 if you have the `closesocket' function. */
+#cmakedefine HAVE_CLOSESOCKET 1
+
+/* Define to 1 if you have the `CloseSocket' function. */
+#cmakedefine HAVE_CLOSESOCKET_CAMEL 1
+
+/* Define to 1 if you have the <dirent.h> header file. */
+#cmakedefine HAVE_DIRENT_H 1
+
+/* Define to 1 if you have the `opendir' function. */
+#cmakedefine HAVE_OPENDIR 1
+
+/* Define to 1 if you have the memset_explicit (C23) function. */
+#cmakedefine HAVE_MEMSET_EXPLICIT 1
+
+/* Define to 1 if you have the memset_s (C11) function. */
+#cmakedefine HAVE_MEMSET_S 1
+
+/* Define to 1 if you have the fcntl function. */
+#cmakedefine HAVE_FCNTL 1
+
+/* Define to 1 if you have the <fcntl.h> header file. */
+#cmakedefine HAVE_FCNTL_H 1
+
+/* Define to 1 if you have a working fcntl O_NONBLOCK function. */
+#cmakedefine HAVE_FCNTL_O_NONBLOCK 1
+
+/* Define to 1 if you have the freeaddrinfo function. */
+#cmakedefine HAVE_FREEADDRINFO 1
+
+/* Define to 1 if you have the fseeko function. */
+#cmakedefine HAVE_FSEEKO 1
+
+/* Define to 1 if you have the fseeko declaration. */
+#cmakedefine HAVE_DECL_FSEEKO 1
+
+/* Define to 1 if you have a working getaddrinfo function. */
+#cmakedefine HAVE_GETADDRINFO 1
+
+/* Define to 1 if the getaddrinfo function is thread-safe. */
+#cmakedefine HAVE_GETADDRINFO_THREADSAFE 1
+
+/* Define to 1 if you have the `geteuid' function. */
+#cmakedefine HAVE_GETEUID 1
+
+/* Define to 1 if you have the `getppid' function. */
+#cmakedefine HAVE_GETPPID 1
+
+/* Define to 1 if you have the gethostbyname_r function. */
+#cmakedefine HAVE_GETHOSTBYNAME_R 1
+
+/* gethostbyname_r() takes 3 args */
+#cmakedefine HAVE_GETHOSTBYNAME_R_3 1
+
+/* gethostbyname_r() takes 5 args */
+#cmakedefine HAVE_GETHOSTBYNAME_R_5 1
+
+/* gethostbyname_r() takes 6 args */
+#cmakedefine HAVE_GETHOSTBYNAME_R_6 1
+
+/* Define to 1 if you have the gethostname function. */
+#cmakedefine HAVE_GETHOSTNAME 1
+
+/* Define to 1 if you have a working getifaddrs function. */
+#cmakedefine HAVE_GETIFADDRS 1
+
+/* Define to 1 if you have the `getpass_r' function. */
+#cmakedefine HAVE_GETPASS_R 1
+
+/* Define to 1 if you have the `getpeername' function. */
+#cmakedefine HAVE_GETPEERNAME 1
+
+/* Define to 1 if you have the `getsockname' function. */
+#cmakedefine HAVE_GETSOCKNAME 1
+
+/* Define to 1 if you have the `if_nametoindex' function. */
+#cmakedefine HAVE_IF_NAMETOINDEX 1
+
+/* Define to 1 if you have the `getpwuid' function. */
+#cmakedefine HAVE_GETPWUID 1
+
+/* Define to 1 if you have the `getpwuid_r' function. */
+#cmakedefine HAVE_GETPWUID_R 1
+
+/* Define to 1 if you have the `getrlimit' function. */
+#cmakedefine HAVE_GETRLIMIT 1
+
+/* Define to 1 if you have the `gettimeofday' function. */
+#cmakedefine HAVE_GETTIMEOFDAY 1
+
+/* Define to 1 if you have a working glibc-style strerror_r function. */
+#cmakedefine HAVE_GLIBC_STRERROR_R 1
+
+/* Define to 1 if you have a working gmtime_r function. */
+#cmakedefine HAVE_GMTIME_R 1
+
+/* if you have the gssapi libraries */
+#cmakedefine HAVE_GSSAPI 1
+
+/* if you have the GNU gssapi libraries */
+#cmakedefine HAVE_GSSGNU 1
+
+/* MIT Kerberos version */
+#cmakedefine CURL_KRB5_VERSION ${CURL_KRB5_VERSION}
+
+/* BoringSSL version */
+#cmakedefine CURL_BORINGSSL_VERSION ${CURL_BORINGSSL_VERSION}
+
+/* Patch stamp */
+#cmakedefine CURL_PATCHSTAMP ${CURL_PATCHSTAMP}
+
+/* Define to 1 if you have the <ifaddrs.h> header file. */
+#cmakedefine HAVE_IFADDRS_H 1
+
+/* Define to 1 if you have an IPv6 capable working inet_ntop function. */
+#cmakedefine HAVE_INET_NTOP 1
+
+/* Define to 1 if you have an IPv6 capable working inet_pton function. */
+#cmakedefine HAVE_INET_PTON 1
+
+/* Define to 1 if symbol `sa_family_t' exists */
+#cmakedefine HAVE_SA_FAMILY_T 1
+
+/* Define to 1 if you have the ioctlsocket function. */
+#cmakedefine HAVE_IOCTLSOCKET 1
+
+/* Define to 1 if you have the IoctlSocket camel case function. */
+#cmakedefine HAVE_IOCTLSOCKET_CAMEL 1
+
+/* Define to 1 if you have a working IoctlSocket camel case FIONBIO function.
+   */
+#cmakedefine HAVE_IOCTLSOCKET_CAMEL_FIONBIO 1
+
+/* Define to 1 if you have a working ioctlsocket FIONBIO function. */
+#cmakedefine HAVE_IOCTLSOCKET_FIONBIO 1
+
+/* Define to 1 if you have a working ioctl FIONBIO function. */
+#cmakedefine HAVE_IOCTL_FIONBIO 1
+
+/* Define to 1 if you have a working ioctl SIOCGIFADDR function. */
+#cmakedefine HAVE_IOCTL_SIOCGIFADDR 1
+
+/* Define to 1 if you have the <io.h> header file. */
+#cmakedefine HAVE_IO_H 1
+
+/* Define to 1 if you have the lber.h header file. */
+#cmakedefine HAVE_LBER_H 1
+
+/* Use LDAPS implementation */
+#cmakedefine HAVE_LDAP_SSL 1
+
+/* Define to 1 if you have the ldap_ssl.h header file. */
+#cmakedefine HAVE_LDAP_SSL_H 1
+
+/* Define to 1 if you have the `ldap_url_parse' function. */
+#cmakedefine HAVE_LDAP_URL_PARSE 1
+
+/* Define to 1 if you have the <libgen.h> header file. */
+#cmakedefine HAVE_LIBGEN_H 1
+
+/* Define to 1 if you have the `idn2' library (-lidn2). */
+#cmakedefine HAVE_LIBIDN2 1
+
+/* Define to 1 if you have the idn2.h header file. */
+#cmakedefine HAVE_IDN2_H 1
+
+/* if zlib is available */
+#cmakedefine HAVE_LIBZ 1
+
+/* if brotli is available */
+#cmakedefine HAVE_BROTLI 1
+
+/* if zstd is available */
+#cmakedefine HAVE_ZSTD 1
+
+/* Define to 1 if you have the <locale.h> header file. */
+#cmakedefine HAVE_LOCALE_H 1
+
+/* Define to 1 if you have a working localtime_r function. */
+#cmakedefine HAVE_LOCALTIME_R 1
+
+/* Define to 1 if you have the 'suseconds_t' data type. */
+#cmakedefine HAVE_SUSECONDS_T 1
+
+/* Define to 1 if you have the <netdb.h> header file. */
+#cmakedefine HAVE_NETDB_H 1
+
+/* Define to 1 if you have the <netinet/in.h> header file. */
+#cmakedefine HAVE_NETINET_IN_H 1
+
+/* Define to 1 if you have the <netinet/in6.h> header file. */
+#cmakedefine HAVE_NETINET_IN6_H 1
+
+/* Define to 1 if you have the <netinet/tcp.h> header file. */
+#cmakedefine HAVE_NETINET_TCP_H 1
+
+/* Define to 1 if you have the <netinet/udp.h> header file. */
+#cmakedefine HAVE_NETINET_UDP_H 1
+
+/* Define to 1 if you have the <linux/tcp.h> header file. */
+#cmakedefine HAVE_LINUX_TCP_H 1
+
+/* Define to 1 if you have the <net/if.h> header file. */
+#cmakedefine HAVE_NET_IF_H 1
+
+/* Define to 1 if you have the `pipe' function. */
+#cmakedefine HAVE_PIPE 1
+
+/* Define to 1 if you have the `pipe2' function. */
+#cmakedefine HAVE_PIPE2 1
+
+/* Define to 1 if you have the `eventfd' function. */
+#cmakedefine HAVE_EVENTFD 1
+
+/* If you have poll */
+#cmakedefine HAVE_POLL 1
+
+/* If you have realpath */
+#cmakedefine HAVE_REALPATH 1
+
+/* Define to 1 if you have the <poll.h> header file. */
+#cmakedefine HAVE_POLL_H 1
+
+/* Define to 1 if you have a working POSIX-style strerror_r function. */
+#cmakedefine HAVE_POSIX_STRERROR_R 1
+
+/* Define to 1 if you have the <pwd.h> header file. */
+#cmakedefine HAVE_PWD_H 1
+
+/* Define to 1 if OpenSSL has the `SSL_set0_wbio` function. */
+#cmakedefine HAVE_SSL_SET0_WBIO 1
+
+/* Define to 1 if you have the recv function. */
+#cmakedefine HAVE_RECV 1
+
+/* Define to 1 if you have the select function. */
+#cmakedefine HAVE_SELECT 1
+
+/* Define to 1 if you have the sched_yield function. */
+#cmakedefine HAVE_SCHED_YIELD 1
+
+/* Define to 1 if you have the send function. */
+#cmakedefine HAVE_SEND 1
+
+/* Define to 1 if you have the sendmsg function. */
+#cmakedefine HAVE_SENDMSG 1
+
+/* Define to 1 if you have the sendmmsg function. */
+#cmakedefine HAVE_SENDMMSG 1
+
+/* Define to 1 if you have the 'fsetxattr' function. */
+#cmakedefine HAVE_FSETXATTR 1
+
+/* fsetxattr() takes 5 args */
+#cmakedefine HAVE_FSETXATTR_5 1
+
+/* fsetxattr() takes 6 args */
+#cmakedefine HAVE_FSETXATTR_6 1
+
+/* Define to 1 if you have the `setlocale' function. */
+#cmakedefine HAVE_SETLOCALE 1
+
+/* Define to 1 if you have the `setrlimit' function. */
+#cmakedefine HAVE_SETRLIMIT 1
+
+/* Define to 1 if you have a working setsockopt SO_NONBLOCK function. */
+#cmakedefine HAVE_SETSOCKOPT_SO_NONBLOCK 1
+
+/* Define to 1 if you have the sigaction function. */
+#cmakedefine HAVE_SIGACTION 1
+
+/* Define to 1 if you have the siginterrupt function. */
+#cmakedefine HAVE_SIGINTERRUPT 1
+
+/* Define to 1 if you have the signal function. */
+#cmakedefine HAVE_SIGNAL 1
+
+/* Define to 1 if you have the sigsetjmp function or macro. */
+#cmakedefine HAVE_SIGSETJMP 1
+
+/* Define to 1 if struct sockaddr_in6 has the sin6_scope_id member */
+#cmakedefine HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID 1
+
+/* Define to 1 if you have the `socket' function. */
+#cmakedefine HAVE_SOCKET 1
+
+/* Define to 1 if you have the <proto/bsdsocket.h> header file. */
+#cmakedefine HAVE_PROTO_BSDSOCKET_H 1
+
+/* Define to 1 if you have the socketpair function. */
+#cmakedefine HAVE_SOCKETPAIR 1
+
+/* Define to 1 if you have the <stdatomic.h> header file. */
+#cmakedefine HAVE_STDATOMIC_H 1
+
+/* Define to 1 if you have the <stdbool.h> header file. */
+#cmakedefine HAVE_STDBOOL_H 1
+
+/* Define to 1 if you have the strcasecmp function. */
+#cmakedefine HAVE_STRCASECMP 1
+
+/* Define to 1 if you have the strcmpi function. */
+#cmakedefine HAVE_STRCMPI 1
+
+/* Define to 1 if you have the strerror_r function. */
+#cmakedefine HAVE_STRERROR_R 1
+
+/* Define to 1 if you have the stricmp function. */
+#cmakedefine HAVE_STRICMP 1
+
+/* Define to 1 if you have the <strings.h> header file. */
+#cmakedefine HAVE_STRINGS_H 1
+
+/* Define to 1 if you have the <stropts.h> header file. */
+#cmakedefine HAVE_STROPTS_H 1
+
+/* Define to 1 if you have the memrchr function. */
+#cmakedefine HAVE_MEMRCHR 1
+
+/* if struct sockaddr_storage is defined */
+#cmakedefine HAVE_STRUCT_SOCKADDR_STORAGE 1
+
+/* Define to 1 if you have the timeval struct. */
+#cmakedefine HAVE_STRUCT_TIMEVAL 1
+
+/* Define to 1 if you have the <sys/eventfd.h> header file. */
+#cmakedefine HAVE_SYS_EVENTFD_H 1
+
+/* Define to 1 if you have the <sys/filio.h> header file. */
+#cmakedefine HAVE_SYS_FILIO_H 1
+
+/* Define to 1 if you have the <sys/ioctl.h> header file. */
+#cmakedefine HAVE_SYS_IOCTL_H 1
+
+/* Define to 1 if you have the <sys/param.h> header file. */
+#cmakedefine HAVE_SYS_PARAM_H 1
+
+/* Define to 1 if you have the <sys/poll.h> header file. */
+#cmakedefine HAVE_SYS_POLL_H 1
+
+/* Define to 1 if you have the <sys/resource.h> header file. */
+#cmakedefine HAVE_SYS_RESOURCE_H 1
+
+/* Define to 1 if you have the <sys/select.h> header file. */
+#cmakedefine HAVE_SYS_SELECT_H 1
+
+/* Define to 1 if you have the <sys/sockio.h> header file. */
+#cmakedefine HAVE_SYS_SOCKIO_H 1
+
+/* Define to 1 if you have the <sys/types.h> header file. */
+#cmakedefine HAVE_SYS_TYPES_H 1
+
+/* Define to 1 if you have the <sys/un.h> header file. */
+#cmakedefine HAVE_SYS_UN_H 1
+
+/* Define to 1 if you have the <sys/utime.h> header file. */
+#cmakedefine HAVE_SYS_UTIME_H 1
+
+/* Define to 1 if you have the <termios.h> header file. */
+#cmakedefine HAVE_TERMIOS_H 1
+
+/* Define to 1 if you have the <termio.h> header file. */
+#cmakedefine HAVE_TERMIO_H 1
+
+/* Define to 1 if you have the <unistd.h> header file. */
+#cmakedefine HAVE_UNISTD_H 1
+
+/* Define to 1 if you have the `utime' function. */
+#cmakedefine HAVE_UTIME 1
+
+/* Define to 1 if you have the `utimes' function. */
+#cmakedefine HAVE_UTIMES 1
+
+/* Define to 1 if you have the <utime.h> header file. */
+#cmakedefine HAVE_UTIME_H 1
+
+/* Define this symbol if your OS supports changing the contents of argv */
+#cmakedefine HAVE_WRITABLE_ARGV 1
+
+/* Define this if time_t is unsigned */
+#cmakedefine HAVE_TIME_T_UNSIGNED 1
+
+/* Define to 1 if _REENTRANT preprocessor symbol must be defined. */
+#cmakedefine NEED_REENTRANT 1
+
+/* cpu-machine-OS */
+#cmakedefine CURL_OS ${CURL_OS}
+
+/*
+  Note: SIZEOF_* variables are fetched with CMake through check_type_size().
+  As per CMake documentation on CheckTypeSize, C preprocessor code is
+  generated by CMake into SIZEOF_*_CODE. This is what we use in the
+  following statements.
+
+  Reference: https://cmake.org/cmake/help/latest/module/CheckTypeSize.html
+*/
+
+/* The size of `int', as computed by sizeof. */
+${SIZEOF_INT_CODE}
+
+/* The size of `long', as computed by sizeof. */
+${SIZEOF_LONG_CODE}
+
+/* The size of `off_t', as computed by sizeof. */
+${SIZEOF_OFF_T_CODE}
+
+/* The size of `curl_off_t', as computed by sizeof. */
+${SIZEOF_CURL_OFF_T_CODE}
+
+/* The size of `curl_socket_t', as computed by sizeof. */
+${SIZEOF_CURL_SOCKET_T_CODE}
+
+/* The size of `size_t', as computed by sizeof. */
+${SIZEOF_SIZE_T_CODE}
+
+/* The size of `time_t', as computed by sizeof. */
+${SIZEOF_TIME_T_CODE}
+
+/* Define to 1 if you have the ANSI C header files. */
+#cmakedefine STDC_HEADERS 1
+
+/* Define if you have POSIX pthreads */
+#cmakedefine HAVE_THREADS_POSIX 1
+
+/* Define if you want to enable c-ares support */
+#cmakedefine USE_ARES 1
+
+/* Define if you want to enable c-ares DNS lookup */
+#cmakedefine USE_RESOLV_ARES 1
+
+/* Define if you want to enable threaded DNS lookup */
+#cmakedefine USE_RESOLV_THREADED 1
+
+/* if GnuTLS is enabled */
+#cmakedefine USE_GNUTLS 1
+
+/* if SSL session export support is available */
+#cmakedefine USE_SSLS_EXPORT 1
+
+/* if mbedTLS is enabled */
+#cmakedefine USE_MBEDTLS 1
+
+/* if mbedTLS <4 has the mbedtls_des_crypt_ecb function. */
+#cmakedefine HAVE_MBEDTLS_DES_CRYPT_ECB 1
+
+/* if Rustls is enabled */
+#cmakedefine USE_RUSTLS 1
+
+/* if wolfSSL is enabled */
+#cmakedefine USE_WOLFSSL 1
+
+/* if wolfSSL has the wolfSSL_get_peer_certificate function. */
+#cmakedefine HAVE_WOLFSSL_GET_PEER_CERTIFICATE 1
+
+/* if wolfSSL has the wolfSSL_UseALPN function. */
+#cmakedefine HAVE_WOLFSSL_USEALPN 1
+
+/* if wolfSSL has the wolfSSL_BIO_new function. */
+#cmakedefine HAVE_WOLFSSL_BIO_NEW 1
+
+/* if wolfSSL has the wolfSSL_BIO_set_shutdown function. */
+#cmakedefine HAVE_WOLFSSL_BIO_SET_SHUTDOWN 1
+
+/* if wolfSSL has the wc_Des_EcbEncrypt function. */
+#cmakedefine HAVE_WC_DES_ECBENCRYPT 1
+
+/* if libssh is in use */
+#cmakedefine USE_LIBSSH 1
+
+/* if libssh2 is in use */
+#cmakedefine USE_LIBSSH2 1
+
+/* if libpsl is in use */
+#cmakedefine USE_LIBPSL 1
+
+/* if you want to use OpenLDAP code instead of legacy ldap implementation */
+#cmakedefine USE_OPENLDAP 1
+
+/* if OpenSSL is in use */
+#cmakedefine USE_OPENSSL 1
+
+/* if AmiSSL is in use */
+#cmakedefine USE_AMISSL 1
+
+/* if GSASL is in use */
+#cmakedefine USE_GSASL 1
+
+/* if libuv is in use */
+#cmakedefine USE_LIBUV 1
+
+/* if HTTP/3 proxy support is available */
+#cmakedefine USE_PROXY_HTTP3 1
+
+/* Define to 1 if you have the <uv.h> header file. */
+#cmakedefine HAVE_UV_H 1
+
+/* if libbacktrace is in use */
+#cmakedefine USE_BACKTRACE 1
+
+/* Define to 1 if you do not want the OpenSSL configuration to be loaded
+   automatically */
+#cmakedefine CURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG 1
+
+/* to enable NGHTTP2 */
+#cmakedefine USE_NGHTTP2 1
+
+/* to enable NGTCP2 */
+#cmakedefine USE_NGTCP2 1
+
+/* to enable NGHTTP3 */
+#cmakedefine USE_NGHTTP3 1
+
+/* to enable quiche */
+#cmakedefine USE_QUICHE 1
+
+/* to enable openssl + ngtcp2 + nghttp3 */
+#cmakedefine OPENSSL_QUIC_API2 1
+
+/* Define to 1 if you have the quiche_conn_set_qlog_fd function. */
+#cmakedefine HAVE_QUICHE_CONN_SET_QLOG_FD 1
+
+/* if Unix domain sockets are enabled */
+#cmakedefine USE_UNIX_SOCKETS 1
+
+/* to enable SSPI support */
+#cmakedefine USE_WINDOWS_SSPI 1
+
+/* to enable Windows SSL */
+#cmakedefine USE_SCHANNEL 1
+
+/* if Watt-32 is in use */
+#cmakedefine USE_WATT32 1
+
+/* enable multiple SSL backends */
+#cmakedefine CURL_WITH_MULTI_SSL 1
+
+/* Number of bits in a file offset, on hosts where this is settable. */
+#cmakedefine _FILE_OFFSET_BITS ${_FILE_OFFSET_BITS}
+
+/* the signed version of size_t */
+#cmakedefine ssize_t ${ssize_t}
+
+/* Define to 1 if you have the mach_absolute_time function. */
+#cmakedefine HAVE_MACH_ABSOLUTE_TIME 1
+
+/* to enable Windows IDN */
+#cmakedefine USE_WIN32_IDN 1
+
+/* to enable Apple IDN */
+#cmakedefine USE_APPLE_IDN 1
+
+/* to enable Apple OS-native certificate verification */
+#cmakedefine USE_APPLE_SECTRUST 1
+
+/* Define to 1 if OpenSSL has the SSL_CTX_set_srp_username function. */
+#cmakedefine HAVE_OPENSSL_SRP 1
+
+/* Define to 1 if GnuTLS has the gnutls_srp_verifier function. */
+#cmakedefine HAVE_GNUTLS_SRP 1
+
+/* Define to 1 to enable TLS-SRP support. */
+#cmakedefine USE_TLS_SRP 1
+
+/* Define to 1 to query for HTTPSRR when using DoH */
+#cmakedefine USE_HTTPSRR 1
+
+/* if ECH support is available */
+#cmakedefine USE_ECH 1
+
+/* Define to 1 if you have the wolfSSL_CTX_GenerateEchConfig function. */
+#cmakedefine HAVE_WOLFSSL_CTX_GENERATEECHCONFIG 1
+
+/* Define to 1 if you have the SSL_set1_ech_config_list function. */
+#cmakedefine HAVE_SSL_SET1_ECH_CONFIG_LIST 1
+
+/* Define to 1 if OpenSSL has the DES_ecb_encrypt function. */
+#cmakedefine HAVE_DES_ECB_ENCRYPT 1
diff --git a/third-party/curl/lib/curl_config.h.cmake b/third-party/curl/lib/curl_config.h.cmake
deleted file mode 100644
index 65901a2b1d..0000000000
--- a/third-party/curl/lib/curl_config.h.cmake
+++ /dev/null
@@ -1,794 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-/* lib/curl_config.h.in.  Generated somehow by cmake.  */
-
-/* Location of default ca bundle */
-#cmakedefine CURL_CA_BUNDLE "${CURL_CA_BUNDLE}"
-
-/* define "1" to use built-in ca store of TLS backend */
-#cmakedefine CURL_CA_FALLBACK 1
-
-/* Location of default ca path */
-#cmakedefine CURL_CA_PATH "${CURL_CA_PATH}"
-
-/* Default SSL backend */
-#cmakedefine CURL_DEFAULT_SSL_BACKEND "${CURL_DEFAULT_SSL_BACKEND}"
-
-/* disables alt-svc */
-#cmakedefine CURL_DISABLE_ALTSVC 1
-
-/* disables cookies support */
-#cmakedefine CURL_DISABLE_COOKIES 1
-
-/* disables Basic authentication */
-#cmakedefine CURL_DISABLE_BASIC_AUTH 1
-
-/* disables Bearer authentication */
-#cmakedefine CURL_DISABLE_BEARER_AUTH 1
-
-/* disables Digest authentication */
-#cmakedefine CURL_DISABLE_DIGEST_AUTH 1
-
-/* disables Kerberos authentication */
-#cmakedefine CURL_DISABLE_KERBEROS_AUTH 1
-
-/* disables negotiate authentication */
-#cmakedefine CURL_DISABLE_NEGOTIATE_AUTH 1
-
-/* disables AWS-SIG4 */
-#cmakedefine CURL_DISABLE_AWS 1
-
-/* disables DICT */
-#cmakedefine CURL_DISABLE_DICT 1
-
-/* disables DNS-over-HTTPS */
-#cmakedefine CURL_DISABLE_DOH 1
-
-/* disables FILE */
-#cmakedefine CURL_DISABLE_FILE 1
-
-/* disables form api */
-#cmakedefine CURL_DISABLE_FORM_API 1
-
-/* disables FTP */
-#cmakedefine CURL_DISABLE_FTP 1
-
-/* disables GOPHER */
-#cmakedefine CURL_DISABLE_GOPHER 1
-
-/* disables HSTS support */
-#cmakedefine CURL_DISABLE_HSTS 1
-
-/* disables HTTP */
-#cmakedefine CURL_DISABLE_HTTP 1
-
-/* disables IMAP */
-#cmakedefine CURL_DISABLE_IMAP 1
-
-/* disables LDAP */
-#cmakedefine CURL_DISABLE_LDAP 1
-
-/* disables LDAPS */
-#cmakedefine CURL_DISABLE_LDAPS 1
-
-/* disables --libcurl option from the curl tool */
-#cmakedefine CURL_DISABLE_LIBCURL_OPTION 1
-
-/* disables MIME support */
-#cmakedefine CURL_DISABLE_MIME 1
-
-/* disables MQTT */
-#cmakedefine CURL_DISABLE_MQTT 1
-
-/* disables netrc parser */
-#cmakedefine CURL_DISABLE_NETRC 1
-
-/* disables NTLM support */
-#cmakedefine CURL_DISABLE_NTLM 1
-
-/* disables date parsing */
-#cmakedefine CURL_DISABLE_PARSEDATE 1
-
-/* disables POP3 */
-#cmakedefine CURL_DISABLE_POP3 1
-
-/* disables built-in progress meter */
-#cmakedefine CURL_DISABLE_PROGRESS_METER 1
-
-/* disables proxies */
-#cmakedefine CURL_DISABLE_PROXY 1
-
-/* disables RTSP */
-#cmakedefine CURL_DISABLE_RTSP 1
-
-/* disables SMB */
-#cmakedefine CURL_DISABLE_SMB 1
-
-/* disables SMTP */
-#cmakedefine CURL_DISABLE_SMTP 1
-
-/* disables use of socketpair for curl_multi_poll */
-#cmakedefine CURL_DISABLE_SOCKETPAIR 1
-
-/* disables TELNET */
-#cmakedefine CURL_DISABLE_TELNET 1
-
-/* disables TFTP */
-#cmakedefine CURL_DISABLE_TFTP 1
-
-/* disables verbose strings */
-#cmakedefine CURL_DISABLE_VERBOSE_STRINGS 1
-
-/* to make a symbol visible */
-#cmakedefine CURL_EXTERN_SYMBOL ${CURL_EXTERN_SYMBOL}
-/* Ensure using CURL_EXTERN_SYMBOL is possible */
-#ifndef CURL_EXTERN_SYMBOL
-#define CURL_EXTERN_SYMBOL
-#endif
-
-/* Allow SMB to work on Windows */
-#cmakedefine USE_WIN32_CRYPTO 1
-
-/* Use Windows LDAP implementation */
-#cmakedefine USE_WIN32_LDAP 1
-
-/* Define if you want to enable IPv6 support */
-#cmakedefine ENABLE_IPV6 1
-
-/* Define to 1 if you have the alarm function. */
-#cmakedefine HAVE_ALARM 1
-
-/* Define to 1 if you have the <arpa/inet.h> header file. */
-#cmakedefine HAVE_ARPA_INET_H 1
-
-/* Define to 1 if you have the <arpa/tftp.h> header file. */
-#cmakedefine HAVE_ARPA_TFTP_H 1
-
-/* Define to 1 if you have _Atomic support. */
-#cmakedefine HAVE_ATOMIC 1
-
-/* Define to 1 if you have the `fchmod' function. */
-#cmakedefine HAVE_FCHMOD 1
-
-/* Define to 1 if you have the `basename' function. */
-#cmakedefine HAVE_BASENAME 1
-
-/* Define to 1 if bool is an available type. */
-#cmakedefine HAVE_BOOL_T 1
-
-/* Define to 1 if you have the __builtin_available function. */
-#cmakedefine HAVE_BUILTIN_AVAILABLE 1
-
-/* Define to 1 if you have the clock_gettime function and monotonic timer. */
-#cmakedefine HAVE_CLOCK_GETTIME_MONOTONIC 1
-
-/* Define to 1 if you have the `closesocket' function. */
-#cmakedefine HAVE_CLOSESOCKET 1
-
-/* Define to 1 if you have the fcntl function. */
-#cmakedefine HAVE_FCNTL 1
-
-/* Define to 1 if you have the <fcntl.h> header file. */
-#cmakedefine HAVE_FCNTL_H 1
-
-/* Define to 1 if you have a working fcntl O_NONBLOCK function. */
-#cmakedefine HAVE_FCNTL_O_NONBLOCK 1
-
-/* Define to 1 if you have the freeaddrinfo function. */
-#cmakedefine HAVE_FREEADDRINFO 1
-
-/* Define to 1 if you have the ftruncate function. */
-#cmakedefine HAVE_FTRUNCATE 1
-
-/* Define to 1 if you have a working getaddrinfo function. */
-#cmakedefine HAVE_GETADDRINFO 1
-
-/* Define to 1 if the getaddrinfo function is threadsafe. */
-#cmakedefine HAVE_GETADDRINFO_THREADSAFE 1
-
-/* Define to 1 if you have the `geteuid' function. */
-#cmakedefine HAVE_GETEUID 1
-
-/* Define to 1 if you have the `getppid' function. */
-#cmakedefine HAVE_GETPPID 1
-
-/* Define to 1 if you have the gethostbyname_r function. */
-#cmakedefine HAVE_GETHOSTBYNAME_R 1
-
-/* gethostbyname_r() takes 3 args */
-#cmakedefine HAVE_GETHOSTBYNAME_R_3 1
-
-/* gethostbyname_r() takes 5 args */
-#cmakedefine HAVE_GETHOSTBYNAME_R_5 1
-
-/* gethostbyname_r() takes 6 args */
-#cmakedefine HAVE_GETHOSTBYNAME_R_6 1
-
-/* Define to 1 if you have the gethostname function. */
-#cmakedefine HAVE_GETHOSTNAME 1
-
-/* Define to 1 if you have a working getifaddrs function. */
-#cmakedefine HAVE_GETIFADDRS 1
-
-/* Define to 1 if you have the `getpass_r' function. */
-#cmakedefine HAVE_GETPASS_R 1
-
-/* Define to 1 if you have the `getppid' function. */
-#cmakedefine HAVE_GETPPID 1
-
-/* Define to 1 if you have the `getpeername' function. */
-#cmakedefine HAVE_GETPEERNAME 1
-
-/* Define to 1 if you have the `getsockname' function. */
-#cmakedefine HAVE_GETSOCKNAME 1
-
-/* Define to 1 if you have the `if_nametoindex' function. */
-#cmakedefine HAVE_IF_NAMETOINDEX 1
-
-/* Define to 1 if you have the `getpwuid' function. */
-#cmakedefine HAVE_GETPWUID 1
-
-/* Define to 1 if you have the `getpwuid_r' function. */
-#cmakedefine HAVE_GETPWUID_R 1
-
-/* Define to 1 if you have the `getrlimit' function. */
-#cmakedefine HAVE_GETRLIMIT 1
-
-/* Define to 1 if you have the `gettimeofday' function. */
-#cmakedefine HAVE_GETTIMEOFDAY 1
-
-/* Define to 1 if you have a working glibc-style strerror_r function. */
-#cmakedefine HAVE_GLIBC_STRERROR_R 1
-
-/* Define to 1 if you have a working gmtime_r function. */
-#cmakedefine HAVE_GMTIME_R 1
-
-/* if you have the gssapi libraries */
-#cmakedefine HAVE_GSSAPI 1
-
-/* Define to 1 if you have the <gssapi/gssapi_generic.h> header file. */
-#cmakedefine HAVE_GSSAPI_GSSAPI_GENERIC_H 1
-
-/* Define to 1 if you have the <gssapi/gssapi.h> header file. */
-#cmakedefine HAVE_GSSAPI_GSSAPI_H 1
-
-/* Define to 1 if you have the <gssapi/gssapi_krb5.h> header file. */
-#cmakedefine HAVE_GSSAPI_GSSAPI_KRB5_H 1
-
-/* if you have the GNU gssapi libraries */
-#cmakedefine HAVE_GSSGNU 1
-
-/* if you have the Heimdal gssapi libraries */
-#cmakedefine HAVE_GSSHEIMDAL 1
-
-/* if you have the MIT gssapi libraries */
-#cmakedefine HAVE_GSSMIT 1
-
-/* Define to 1 if you have the `idna_strerror' function. */
-#cmakedefine HAVE_IDNA_STRERROR 1
-
-/* Define to 1 if you have the <ifaddrs.h> header file. */
-#cmakedefine HAVE_IFADDRS_H 1
-
-/* Define to 1 if you have a IPv6 capable working inet_ntop function. */
-#cmakedefine HAVE_INET_NTOP 1
-
-/* Define to 1 if you have a IPv6 capable working inet_pton function. */
-#cmakedefine HAVE_INET_PTON 1
-
-/* Define to 1 if symbol `sa_family_t' exists */
-#cmakedefine HAVE_SA_FAMILY_T 1
-
-/* Define to 1 if symbol `ADDRESS_FAMILY' exists */
-#cmakedefine HAVE_ADDRESS_FAMILY 1
-
-/* Define to 1 if you have the <inttypes.h> header file. */
-#cmakedefine HAVE_INTTYPES_H 1
-
-/* Define to 1 if you have the ioctlsocket function. */
-#cmakedefine HAVE_IOCTLSOCKET 1
-
-/* Define to 1 if you have the IoctlSocket camel case function. */
-#cmakedefine HAVE_IOCTLSOCKET_CAMEL 1
-
-/* Define to 1 if you have a working IoctlSocket camel case FIONBIO function.
-   */
-#cmakedefine HAVE_IOCTLSOCKET_CAMEL_FIONBIO 1
-
-/* Define to 1 if you have a working ioctlsocket FIONBIO function. */
-#cmakedefine HAVE_IOCTLSOCKET_FIONBIO 1
-
-/* Define to 1 if you have a working ioctl FIONBIO function. */
-#cmakedefine HAVE_IOCTL_FIONBIO 1
-
-/* Define to 1 if you have a working ioctl SIOCGIFADDR function. */
-#cmakedefine HAVE_IOCTL_SIOCGIFADDR 1
-
-/* Define to 1 if you have the <io.h> header file. */
-#cmakedefine HAVE_IO_H 1
-
-/* Define to 1 if you have the lber.h header file. */
-#cmakedefine HAVE_LBER_H 1
-
-/* Define to 1 if you have the ldap.h header file. */
-#cmakedefine HAVE_LDAP_H 1
-
-/* Use LDAPS implementation */
-#cmakedefine HAVE_LDAP_SSL 1
-
-/* Define to 1 if you have the ldap_ssl.h header file. */
-#cmakedefine HAVE_LDAP_SSL_H 1
-
-/* Define to 1 if you have the `ldap_url_parse' function. */
-#cmakedefine HAVE_LDAP_URL_PARSE 1
-
-/* Define to 1 if you have the <libgen.h> header file. */
-#cmakedefine HAVE_LIBGEN_H 1
-
-/* Define to 1 if you have the `idn2' library (-lidn2). */
-#cmakedefine HAVE_LIBIDN2 1
-
-/* Define to 1 if you have the idn2.h header file. */
-#cmakedefine HAVE_IDN2_H 1
-
-/* Define to 1 if you have the `socket' library (-lsocket). */
-#cmakedefine HAVE_LIBSOCKET 1
-
-/* Define to 1 if you have the `ssh2' library (-lssh2). */
-#cmakedefine HAVE_LIBSSH2 1
-
-/* if zlib is available */
-#cmakedefine HAVE_LIBZ 1
-
-/* if brotli is available */
-#cmakedefine HAVE_BROTLI 1
-
-/* if zstd is available */
-#cmakedefine HAVE_ZSTD 1
-
-/* Define to 1 if you have the <locale.h> header file. */
-#cmakedefine HAVE_LOCALE_H 1
-
-/* Define to 1 if the compiler supports the 'long long' data type. */
-#cmakedefine HAVE_LONGLONG 1
-
-/* Define to 1 if you have the MSG_NOSIGNAL flag. */
-#cmakedefine HAVE_MSG_NOSIGNAL 1
-
-/* Define to 1 if you have the <netdb.h> header file. */
-#cmakedefine HAVE_NETDB_H 1
-
-/* Define to 1 if you have the <netinet/in.h> header file. */
-#cmakedefine HAVE_NETINET_IN_H 1
-
-/* Define to 1 if you have the <netinet/tcp.h> header file. */
-#cmakedefine HAVE_NETINET_TCP_H 1
-
-/* Define to 1 if you have the <linux/tcp.h> header file. */
-#cmakedefine HAVE_LINUX_TCP_H 1
-
-/* Define to 1 if you have the <net/if.h> header file. */
-#cmakedefine HAVE_NET_IF_H 1
-
-/* if you have an old MIT gssapi library, lacking GSS_C_NT_HOSTBASED_SERVICE */
-#cmakedefine HAVE_OLD_GSSMIT 1
-
-/* Define to 1 if you have the `pipe' function. */
-#cmakedefine HAVE_PIPE 1
-
-/* If you have a fine poll */
-#cmakedefine HAVE_POLL_FINE 1
-
-/* Define to 1 if you have the <poll.h> header file. */
-#cmakedefine HAVE_POLL_H 1
-
-/* Define to 1 if you have a working POSIX-style strerror_r function. */
-#cmakedefine HAVE_POSIX_STRERROR_R 1
-
-/* Define to 1 if you have the <pthread.h> header file */
-#cmakedefine HAVE_PTHREAD_H 1
-
-/* Define to 1 if you have the <pwd.h> header file. */
-#cmakedefine HAVE_PWD_H 1
-
-/* Define to 1 if OpenSSL has the `SSL_set0_wbio` function. */
-#cmakedefine HAVE_SSL_SET0_WBIO 1
-
-/* Define to 1 if you have the recv function. */
-#cmakedefine HAVE_RECV 1
-
-/* Define to 1 if you have the select function. */
-#cmakedefine HAVE_SELECT 1
-
-/* Define to 1 if you have the send function. */
-#cmakedefine HAVE_SEND 1
-
-/* Define to 1 if you have the 'fsetxattr' function. */
-#cmakedefine HAVE_FSETXATTR 1
-
-/* fsetxattr() takes 5 args */
-#cmakedefine HAVE_FSETXATTR_5 1
-
-/* fsetxattr() takes 6 args */
-#cmakedefine HAVE_FSETXATTR_6 1
-
-/* Define to 1 if you have the <setjmp.h> header file. */
-#cmakedefine HAVE_SETJMP_H 1
-
-/* Define to 1 if you have the `setlocale' function. */
-#cmakedefine HAVE_SETLOCALE 1
-
-/* Define to 1 if you have the `setmode' function. */
-#cmakedefine HAVE_SETMODE 1
-
-/* Define to 1 if you have the `setrlimit' function. */
-#cmakedefine HAVE_SETRLIMIT 1
-
-/* Define to 1 if you have a working setsockopt SO_NONBLOCK function. */
-#cmakedefine HAVE_SETSOCKOPT_SO_NONBLOCK 1
-
-/* Define to 1 if you have the sigaction function. */
-#cmakedefine HAVE_SIGACTION 1
-
-/* Define to 1 if you have the siginterrupt function. */
-#cmakedefine HAVE_SIGINTERRUPT 1
-
-/* Define to 1 if you have the signal function. */
-#cmakedefine HAVE_SIGNAL 1
-
-/* Define to 1 if you have the <signal.h> header file. */
-#cmakedefine HAVE_SIGNAL_H 1
-
-/* Define to 1 if you have the sigsetjmp function or macro. */
-#cmakedefine HAVE_SIGSETJMP 1
-
-/* Define to 1 if you have the `snprintf' function. */
-#cmakedefine HAVE_SNPRINTF
-
-/* Define to 1 if struct sockaddr_in6 has the sin6_scope_id member */
-#cmakedefine HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID 1
-
-/* Define to 1 if you have the `socket' function. */
-#cmakedefine HAVE_SOCKET 1
-
-/* Define to 1 if you have the socketpair function. */
-#cmakedefine HAVE_SOCKETPAIR 1
-
-/* Define to 1 if you have the <stdatomic.h> header file. */
-#cmakedefine HAVE_STDATOMIC_H 1
-
-/* Define to 1 if you have the <stdbool.h> header file. */
-#cmakedefine HAVE_STDBOOL_H 1
-
-/* Define to 1 if you have the <stdint.h> header file. */
-#cmakedefine HAVE_STDINT_H 1
-
-/* Define to 1 if you have the <stdlib.h> header file. */
-#cmakedefine HAVE_STDLIB_H 1
-
-/* Define to 1 if you have the strcasecmp function. */
-#cmakedefine HAVE_STRCASECMP 1
-
-/* Define to 1 if you have the strcmpi function. */
-#cmakedefine HAVE_STRCMPI 1
-
-/* Define to 1 if you have the strdup function. */
-#cmakedefine HAVE_STRDUP 1
-
-/* Define to 1 if you have the strerror_r function. */
-#cmakedefine HAVE_STRERROR_R 1
-
-/* Define to 1 if you have the stricmp function. */
-#cmakedefine HAVE_STRICMP 1
-
-/* Define to 1 if you have the <strings.h> header file. */
-#cmakedefine HAVE_STRINGS_H 1
-
-/* Define to 1 if you have the <string.h> header file. */
-#cmakedefine HAVE_STRING_H 1
-
-/* Define to 1 if you have the <stropts.h> header file. */
-#cmakedefine HAVE_STROPTS_H 1
-
-/* Define to 1 if you have the strtok_r function. */
-#cmakedefine HAVE_STRTOK_R 1
-
-/* Define to 1 if you have the strtoll function. */
-#cmakedefine HAVE_STRTOLL 1
-
-/* if struct sockaddr_storage is defined */
-#cmakedefine HAVE_STRUCT_SOCKADDR_STORAGE 1
-
-/* Define to 1 if you have the timeval struct. */
-#cmakedefine HAVE_STRUCT_TIMEVAL 1
-
-/* Define to 1 if you have the <sys/filio.h> header file. */
-#cmakedefine HAVE_SYS_FILIO_H 1
-
-/* Define to 1 if you have the <sys/ioctl.h> header file. */
-#cmakedefine HAVE_SYS_IOCTL_H 1
-
-/* Define to 1 if you have the <sys/param.h> header file. */
-#cmakedefine HAVE_SYS_PARAM_H 1
-
-/* Define to 1 if you have the <sys/poll.h> header file. */
-#cmakedefine HAVE_SYS_POLL_H 1
-
-/* Define to 1 if you have the <sys/resource.h> header file. */
-#cmakedefine HAVE_SYS_RESOURCE_H 1
-
-/* Define to 1 if you have the <sys/select.h> header file. */
-#cmakedefine HAVE_SYS_SELECT_H 1
-
-/* Define to 1 if you have the <sys/socket.h> header file. */
-#cmakedefine HAVE_SYS_SOCKET_H 1
-
-/* Define to 1 if you have the <sys/sockio.h> header file. */
-#cmakedefine HAVE_SYS_SOCKIO_H 1
-
-/* Define to 1 if you have the <sys/stat.h> header file. */
-#cmakedefine HAVE_SYS_STAT_H 1
-
-/* Define to 1 if you have the <sys/time.h> header file. */
-#cmakedefine HAVE_SYS_TIME_H 1
-
-/* Define to 1 if you have the <sys/types.h> header file. */
-#cmakedefine HAVE_SYS_TYPES_H 1
-
-/* Define to 1 if you have the <sys/un.h> header file. */
-#cmakedefine HAVE_SYS_UN_H 1
-
-/* Define to 1 if you have the <sys/utime.h> header file. */
-#cmakedefine HAVE_SYS_UTIME_H 1
-
-/* Define to 1 if you have the <termios.h> header file. */
-#cmakedefine HAVE_TERMIOS_H 1
-
-/* Define to 1 if you have the <termio.h> header file. */
-#cmakedefine HAVE_TERMIO_H 1
-
-/* Define to 1 if you have the <time.h> header file. */
-#cmakedefine HAVE_TIME_H 1
-
-/* Define to 1 if you have the <unistd.h> header file. */
-#cmakedefine HAVE_UNISTD_H 1
-
-/* Define to 1 if you have the `utime' function. */
-#cmakedefine HAVE_UTIME 1
-
-/* Define to 1 if you have the `utimes' function. */
-#cmakedefine HAVE_UTIMES 1
-
-/* Define to 1 if you have the <utime.h> header file. */
-#cmakedefine HAVE_UTIME_H 1
-
-/* Define to 1 if compiler supports C99 variadic macro style. */
-#cmakedefine HAVE_VARIADIC_MACROS_C99 1
-
-/* Define to 1 if compiler supports old gcc variadic macro style. */
-#cmakedefine HAVE_VARIADIC_MACROS_GCC 1
-
-/* Define to 1 if you have the windows.h header file. */
-#cmakedefine HAVE_WINDOWS_H 1
-
-/* Define to 1 if you have the winsock2.h header file. */
-#cmakedefine HAVE_WINSOCK2_H 1
-
-/* Define this symbol if your OS supports changing the contents of argv */
-#cmakedefine HAVE_WRITABLE_ARGV 1
-
-/* Define to 1 if you have the ws2tcpip.h header file. */
-#cmakedefine HAVE_WS2TCPIP_H 1
-
-/* Define to 1 if you need the lber.h header file even with ldap.h */
-#cmakedefine NEED_LBER_H 1
-
-/* Define to 1 if you need the malloc.h header file even with stdlib.h */
-#cmakedefine NEED_MALLOC_H 1
-
-/* Define to 1 if _REENTRANT preprocessor symbol must be defined. */
-#cmakedefine NEED_REENTRANT 1
-
-/* cpu-machine-OS */
-#cmakedefine OS ${OS}
-
-/* Name of package */
-#cmakedefine PACKAGE ${PACKAGE}
-
-/* Define to the address where bug reports for this package should be sent. */
-#cmakedefine PACKAGE_BUGREPORT ${PACKAGE_BUGREPORT}
-
-/* Define to the full name of this package. */
-#cmakedefine PACKAGE_NAME ${PACKAGE_NAME}
-
-/* Define to the full name and version of this package. */
-#cmakedefine PACKAGE_STRING ${PACKAGE_STRING}
-
-/* Define to the one symbol short name of this package. */
-#cmakedefine PACKAGE_TARNAME ${PACKAGE_TARNAME}
-
-/* Define to the version of this package. */
-#cmakedefine PACKAGE_VERSION ${PACKAGE_VERSION}
-
-/* a suitable file to read random data from */
-#cmakedefine RANDOM_FILE "${RANDOM_FILE}"
-
-/*
- Note: SIZEOF_* variables are fetched with CMake through check_type_size().
- As per CMake documentation on CheckTypeSize, C preprocessor code is
- generated by CMake into SIZEOF_*_CODE. This is what we use in the
- following statements.
-
- Reference: https://cmake.org/cmake/help/latest/module/CheckTypeSize.html
-*/
-
-/* The size of `int', as computed by sizeof. */
-${SIZEOF_INT_CODE}
-
-/* The size of `long', as computed by sizeof. */
-${SIZEOF_LONG_CODE}
-
-/* The size of `long long', as computed by sizeof. */
-${SIZEOF_LONG_LONG_CODE}
-
-/* The size of `off_t', as computed by sizeof. */
-${SIZEOF_OFF_T_CODE}
-
-/* The size of `curl_off_t', as computed by sizeof. */
-${SIZEOF_CURL_OFF_T_CODE}
-
-/* The size of `size_t', as computed by sizeof. */
-${SIZEOF_SIZE_T_CODE}
-
-/* The size of `time_t', as computed by sizeof. */
-${SIZEOF_TIME_T_CODE}
-
-/* Define to 1 if you have the ANSI C header files. */
-#cmakedefine STDC_HEADERS 1
-
-/* Define to 1 if you can safely include both <sys/time.h> and <time.h>. */
-#cmakedefine TIME_WITH_SYS_TIME 1
-
-/* Define if you want to enable c-ares support */
-#cmakedefine USE_ARES 1
-
-/* Define if you want to enable POSIX threaded DNS lookup */
-#cmakedefine USE_THREADS_POSIX 1
-
-/* Define if you want to enable WIN32 threaded DNS lookup */
-#cmakedefine USE_THREADS_WIN32 1
-
-/* if GnuTLS is enabled */
-#cmakedefine USE_GNUTLS 1
-
-/* if Secure Transport is enabled */
-#cmakedefine USE_SECTRANSP 1
-
-/* if mbedTLS is enabled */
-#cmakedefine USE_MBEDTLS 1
-
-/* if BearSSL is enabled */
-#cmakedefine USE_BEARSSL 1
-
-/* if WolfSSL is enabled */
-#cmakedefine USE_WOLFSSL 1
-
-/* if libSSH is in use */
-#cmakedefine USE_LIBSSH 1
-
-/* if libSSH2 is in use */
-#cmakedefine USE_LIBSSH2 1
-
-/* if libPSL is in use */
-#cmakedefine USE_LIBPSL 1
-
-/* If you want to build curl with the built-in manual */
-#cmakedefine USE_MANUAL 1
-
-/* if you want to use OpenLDAP code instead of legacy ldap implementation */
-#cmakedefine USE_OPENLDAP 1
-
-/* if OpenSSL is in use */
-#cmakedefine USE_OPENSSL 1
-
-/* Define to 1 if you don't want the OpenSSL configuration to be loaded
-   automatically */
-#cmakedefine CURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG 1
-
-/* to enable NGHTTP2  */
-#cmakedefine USE_NGHTTP2 1
-
-/* to enable NGTCP2 */
-#cmakedefine USE_NGTCP2 1
-
-/* to enable NGHTTP3  */
-#cmakedefine USE_NGHTTP3 1
-
-/* to enable quiche */
-#cmakedefine USE_QUICHE 1
-
-/* Define to 1 if you have the quiche_conn_set_qlog_fd function. */
-#cmakedefine HAVE_QUICHE_CONN_SET_QLOG_FD 1
-
-/* to enable msh3 */
-#cmakedefine USE_MSH3 1
-
-/* if Unix domain sockets are enabled  */
-#cmakedefine USE_UNIX_SOCKETS
-
-/* Define to 1 if you are building a Windows target with large file support. */
-#cmakedefine USE_WIN32_LARGE_FILES 1
-
-/* to enable SSPI support */
-#cmakedefine USE_WINDOWS_SSPI 1
-
-/* to enable Windows SSL  */
-#cmakedefine USE_SCHANNEL 1
-
-/* enable multiple SSL backends */
-#cmakedefine CURL_WITH_MULTI_SSL 1
-
-/* Version number of package */
-#cmakedefine VERSION ${VERSION}
-
-/* Define to 1 if OS is AIX. */
-#ifndef _ALL_SOURCE
-#  undef _ALL_SOURCE
-#endif
-
-/* Number of bits in a file offset, on hosts where this is settable. */
-#cmakedefine _FILE_OFFSET_BITS ${_FILE_OFFSET_BITS}
-
-/* Define for large files, on AIX-style hosts. */
-#cmakedefine _LARGE_FILES ${_LARGE_FILES}
-
-/* define this if you need it to compile thread-safe code */
-#cmakedefine _THREAD_SAFE ${_THREAD_SAFE}
-
-/* Define to empty if `const' does not conform to ANSI C. */
-#cmakedefine const ${const}
-
-/* Type to use in place of in_addr_t when system does not provide it. */
-#cmakedefine in_addr_t ${in_addr_t}
-
-/* Define to `__inline__' or `__inline' if that's what the C compiler
-   calls it, or to nothing if 'inline' is not supported under any name.  */
-#ifndef __cplusplus
-#undef inline
-#endif
-
-/* Define to `unsigned int' if <sys/types.h> does not define. */
-#cmakedefine size_t ${size_t}
-
-/* the signed version of size_t */
-#cmakedefine ssize_t ${ssize_t}
-
-/* Define to 1 if you have the mach_absolute_time function. */
-#cmakedefine HAVE_MACH_ABSOLUTE_TIME 1
-
-/* to enable Windows IDN */
-#cmakedefine USE_WIN32_IDN 1
-
-/* Define to 1 to enable websocket support. */
-#cmakedefine USE_WEBSOCKETS 1
diff --git a/third-party/curl/lib/curl_ctype.h b/third-party/curl/lib/curl_ctype.h
index 1d1d60c28d..f3291ad818 100644
--- a/third-party/curl/lib/curl_ctype.h
+++ b/third-party/curl/lib/curl_ctype.h
@@ -24,24 +24,29 @@
  *
  ***************************************************************************/
 
-#define ISLOWHEXALHA(x) (((x) >= 'a') && ((x) <= 'f'))
-#define ISUPHEXALHA(x) (((x) >= 'A') && ((x) <= 'F'))
+#define ISLOWHEXALPHA(x) (((x) >= 'a') && ((x) <= 'f'))
+#define ISUPHEXALPHA(x)  (((x) >= 'A') && ((x) <= 'F'))
 
 #define ISLOWCNTRL(x) ((unsigned char)(x) <= 0x1f)
-#define IS7F(x) ((x) == 0x7f)
+#define IS7F(x)       ((x) == 0x7f)
 
 #define ISLOWPRINT(x) (((x) >= 9) && ((x) <= 0x0d))
 
 #define ISPRINT(x)  (ISLOWPRINT(x) || (((x) >= ' ') && ((x) <= 0x7e)))
 #define ISGRAPH(x)  (ISLOWPRINT(x) || (((x) > ' ') && ((x) <= 0x7e)))
-#define ISCNTRL(x) (ISLOWCNTRL(x) || IS7F(x))
-#define ISALPHA(x) (ISLOWER(x) || ISUPPER(x))
-#define ISXDIGIT(x) (ISDIGIT(x) || ISLOWHEXALHA(x) || ISUPHEXALHA(x))
+#define ISCNTRL(x)  (ISLOWCNTRL(x) || IS7F(x))
+#define ISALPHA(x)  (ISLOWER(x) || ISUPPER(x))
+#define ISXDIGIT(x) (ISDIGIT(x) || ISLOWHEXALPHA(x) || ISUPHEXALPHA(x))
+#define ISODIGIT(x) (((x) >= '0') && ((x) <= '7'))
 #define ISALNUM(x)  (ISDIGIT(x) || ISLOWER(x) || ISUPPER(x))
 #define ISUPPER(x)  (((x) >= 'A') && ((x) <= 'Z'))
 #define ISLOWER(x)  (((x) >= 'a') && ((x) <= 'z'))
 #define ISDIGIT(x)  (((x) >= '0') && ((x) <= '9'))
 #define ISBLANK(x)  (((x) == ' ') || ((x) == '\t'))
 #define ISSPACE(x)  (ISBLANK(x) || (((x) >= 0xa) && ((x) <= 0x0d)))
+#define ISURLPUNTCS(x)                                           \
+  (((x) == '-') || ((x) == '.') || ((x) == '_') || ((x) == '~'))
+#define ISUNRESERVED(x) (ISALNUM(x) || ISURLPUNTCS(x))
+#define ISNEWLINE(x)    (((x) == '\n') || (x) == '\r')
 
 #endif /* HEADER_CURL_CTYPE_H */
diff --git a/third-party/curl/lib/curl_des.c b/third-party/curl/lib/curl_des.c
deleted file mode 100644
index b77763f268..0000000000
--- a/third-party/curl/lib/curl_des.c
+++ /dev/null
@@ -1,69 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Steve Holme, <steve_holme@hotmail.com>.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#if defined(USE_CURL_NTLM_CORE) && !defined(USE_WOLFSSL) &&     \
-  (defined(USE_GNUTLS) ||                                       \
-   defined(USE_SECTRANSP) ||                                    \
-   defined(USE_OS400CRYPTO) ||                                  \
-   defined(USE_WIN32_CRYPTO))
-
-#include "curl_des.h"
-
-/*
- * Curl_des_set_odd_parity()
- *
- * This is used to apply odd parity to the given byte array. It is typically
- * used by when a cryptography engines doesn't have it's own version.
- *
- * The function is a port of the Java based oddParity() function over at:
- *
- * https://davenport.sourceforge.net/ntlm.html
- *
- * Parameters:
- *
- * bytes       [in/out] - The data whose parity bits are to be adjusted for
- *                        odd parity.
- * len         [out]    - The length of the data.
- */
-void Curl_des_set_odd_parity(unsigned char *bytes, size_t len)
-{
-  size_t i;
-
-  for(i = 0; i < len; i++) {
-    unsigned char b = bytes[i];
-
-    bool needs_parity = (((b >> 7) ^ (b >> 6) ^ (b >> 5) ^
-                          (b >> 4) ^ (b >> 3) ^ (b >> 2) ^
-                          (b >> 1)) & 0x01) == 0;
-
-    if(needs_parity)
-      bytes[i] |= 0x01;
-    else
-      bytes[i] &= 0xfe;
-  }
-}
-
-#endif
diff --git a/third-party/curl/lib/curl_des.h b/third-party/curl/lib/curl_des.h
deleted file mode 100644
index 66525ab436..0000000000
--- a/third-party/curl/lib/curl_des.h
+++ /dev/null
@@ -1,40 +0,0 @@
-#ifndef HEADER_CURL_DES_H
-#define HEADER_CURL_DES_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Steve Holme, <steve_holme@hotmail.com>.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#if defined(USE_CURL_NTLM_CORE) && !defined(USE_WOLFSSL) &&     \
-  (defined(USE_GNUTLS) ||                                       \
-   defined(USE_SECTRANSP) ||                                    \
-   defined(USE_OS400CRYPTO) ||                                  \
-   defined(USE_WIN32_CRYPTO))
-
-/* Applies odd parity to the given byte array */
-void Curl_des_set_odd_parity(unsigned char *bytes, size_t length);
-
-#endif
-
-#endif /* HEADER_CURL_DES_H */
diff --git a/third-party/curl/lib/curl_endian.c b/third-party/curl/lib/curl_endian.c
index 11c662a4c7..b3689417a4 100644
--- a/third-party/curl/lib/curl_endian.c
+++ b/third-party/curl/lib/curl_endian.c
@@ -21,7 +21,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #include "curl_endian.h"
@@ -30,12 +29,12 @@
  * Curl_read16_le()
  *
  * This function converts a 16-bit integer from the little endian format, as
- * used in the incoming package to whatever endian format we're using
+ * used in the incoming package to whatever endian format we are using
  * natively.
  *
  * Parameters:
  *
- * buf      [in]     - A pointer to a 2 byte buffer.
+ * buf      [in]     - A pointer to a 2-byte buffer.
  *
  * Returns the integer.
  */
@@ -49,12 +48,12 @@ unsigned short Curl_read16_le(const unsigned char *buf)
  * Curl_read32_le()
  *
  * This function converts a 32-bit integer from the little endian format, as
- * used in the incoming package to whatever endian format we're using
+ * used in the incoming package to whatever endian format we are using
  * natively.
  *
  * Parameters:
  *
- * buf      [in]     - A pointer to a 4 byte buffer.
+ * buf      [in]     - A pointer to a 4-byte buffer.
  *
  * Returns the integer.
  */
@@ -68,12 +67,12 @@ unsigned int Curl_read32_le(const unsigned char *buf)
  * Curl_read16_be()
  *
  * This function converts a 16-bit integer from the big endian format, as
- * used in the incoming package to whatever endian format we're using
+ * used in the incoming package to whatever endian format we are using
  * natively.
  *
  * Parameters:
  *
- * buf      [in]     - A pointer to a 2 byte buffer.
+ * buf      [in]     - A pointer to a 2-byte buffer.
  *
  * Returns the integer.
  */
diff --git a/third-party/curl/lib/curl_fnmatch.c b/third-party/curl/lib/curl_fnmatch.c
index 5f9ca4f1be..d165554f8d 100644
--- a/third-party/curl/lib/curl_fnmatch.c
+++ b/third-party/curl/lib/curl_fnmatch.c
@@ -21,16 +21,11 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+
 #ifndef CURL_DISABLE_FTP
-#include <curl/curl.h>
 
 #include "curl_fnmatch.h"
-#include "curl_memory.h"
-
-/* The last #include file should be: */
-#include "memdebug.h"
 
 #ifndef HAVE_FNMATCH
 
@@ -71,17 +66,16 @@ typedef enum {
 #define SETCHARSET_OK     1
 #define SETCHARSET_FAIL   0
 
-static int parsekeyword(unsigned char **pattern, unsigned char *charset)
+static int parsekeyword(const unsigned char **pattern, unsigned char *charset)
 {
   parsekey_state state = CURLFNM_PKW_INIT;
-#define KEYLEN 10
-  char keyword[KEYLEN] = { 0 };
-  int i;
-  unsigned char *p = *pattern;
+  char keyword[10] = { 0 };
+  size_t i;
+  const unsigned char *p = *pattern;
   bool found = FALSE;
   for(i = 0; !found; i++) {
-    char c = *p++;
-    if(i >= KEYLEN)
+    char c = (char)*p++;
+    if(i >= sizeof(keyword))
       return SETCHARSET_FAIL;
     switch(state) {
     case CURLFNM_PKW_INIT:
@@ -102,25 +96,25 @@ static int parsekeyword(unsigned char **pattern, unsigned char *charset)
 #undef KEYLEN
 
   *pattern = p; /* move caller's pattern pointer */
-  if(strcmp(keyword, "digit") == 0)
+  if(!strcmp(keyword, "digit"))
     charset[CURLFNM_DIGIT] = 1;
-  else if(strcmp(keyword, "alnum") == 0)
+  else if(!strcmp(keyword, "alnum"))
     charset[CURLFNM_ALNUM] = 1;
-  else if(strcmp(keyword, "alpha") == 0)
+  else if(!strcmp(keyword, "alpha"))
     charset[CURLFNM_ALPHA] = 1;
-  else if(strcmp(keyword, "xdigit") == 0)
+  else if(!strcmp(keyword, "xdigit"))
     charset[CURLFNM_XDIGIT] = 1;
-  else if(strcmp(keyword, "print") == 0)
+  else if(!strcmp(keyword, "print"))
     charset[CURLFNM_PRINT] = 1;
-  else if(strcmp(keyword, "graph") == 0)
+  else if(!strcmp(keyword, "graph"))
     charset[CURLFNM_GRAPH] = 1;
-  else if(strcmp(keyword, "space") == 0)
+  else if(!strcmp(keyword, "space"))
     charset[CURLFNM_SPACE] = 1;
-  else if(strcmp(keyword, "blank") == 0)
+  else if(!strcmp(keyword, "blank"))
     charset[CURLFNM_BLANK] = 1;
-  else if(strcmp(keyword, "upper") == 0)
+  else if(!strcmp(keyword, "upper"))
     charset[CURLFNM_UPPER] = 1;
-  else if(strcmp(keyword, "lower") == 0)
+  else if(!strcmp(keyword, "lower"))
     charset[CURLFNM_LOWER] = 1;
   else
     return SETCHARSET_FAIL;
@@ -140,9 +134,9 @@ static char_class charclass(unsigned char c)
 }
 
 /* Include a character or a range in set. */
-static void setcharorrange(unsigned char **pp, unsigned char *charset)
+static void setcharorrange(const unsigned char **pp, unsigned char *charset)
 {
-  unsigned char *p = (*pp)++;
+  const unsigned char *p = (*pp)++;
   unsigned char c = *p++;
 
   charset[c] = 1;
@@ -161,8 +155,8 @@ static void setcharorrange(unsigned char **pp, unsigned char *charset)
   }
 }
 
-/* returns 1 (true) if pattern is OK, 0 if is bad ("p" is pattern pointer) */
-static int setcharset(unsigned char **p, unsigned char *charset)
+/* returns 1 (TRUE) if pattern is OK, 0 if is bad ("p" is pattern pointer) */
+static int setcharset(const unsigned char **p, unsigned char *charset)
 {
   setcharset_state state = CURLFNM_SCHS_DEFAULT;
   bool something_found = FALSE;
@@ -185,7 +179,7 @@ static int setcharset(unsigned char **p, unsigned char *charset)
         (*p)++;
       }
       else if(c == '[') {
-        unsigned char *pp = *p + 1;
+        const unsigned char *pp = *p + 1;
 
         if(*pp++ == ':' && parsekeyword(&pp, charset))
           *p = pp;
@@ -244,7 +238,7 @@ static int setcharset(unsigned char **p, unsigned char *charset)
     case CURLFNM_SCHS_RIGHTBRLEFTBR:
       if(c == ']')
         return SETCHARSET_OK;
-      state  = CURLFNM_SCHS_DEFAULT;
+      state = CURLFNM_SCHS_DEFAULT;
       charset[c] = 1;
       (*p)++;
       break;
@@ -257,12 +251,12 @@ fail:
 static int loop(const unsigned char *pattern, const unsigned char *string,
                 int maxstars)
 {
-  unsigned char *p = (unsigned char *)pattern;
-  unsigned char *s = (unsigned char *)string;
+  const unsigned char *p = pattern;
+  const unsigned char *s = string;
   unsigned char charset[CURLFNM_CHSET_SIZE] = { 0 };
 
   for(;;) {
-    unsigned char *pp;
+    const unsigned char *pp;
 
     switch(*p) {
     case '*':
@@ -293,7 +287,7 @@ static int loop(const unsigned char *pattern, const unsigned char *string,
       p++;
       break;
     case '\0':
-      return *s? CURL_FNMATCH_NOMATCH: CURL_FNMATCH_MATCH;
+      return *s ? CURL_FNMATCH_NOMATCH : CURL_FNMATCH_MATCH;
     case '\\':
       if(p[1])
         p++;
@@ -303,7 +297,7 @@ static int loop(const unsigned char *pattern, const unsigned char *string,
     case '[':
       pp = p + 1; /* Copy in case of syntax error in set. */
       if(setcharset(&pp, charset)) {
-        int found = FALSE;
+        bool found = FALSE;
         if(!*s)
           return CURL_FNMATCH_NOMATCH;
         if(charset[(unsigned int)*s])
@@ -319,7 +313,7 @@ static int loop(const unsigned char *pattern, const unsigned char *string,
         else if(charset[CURLFNM_PRINT])
           found = ISPRINT(*s);
         else if(charset[CURLFNM_SPACE])
-          found = ISSPACE(*s);
+          found = ISBLANK(*s);
         else if(charset[CURLFNM_UPPER])
           found = ISUPPER(*s);
         else if(charset[CURLFNM_LOWER])
@@ -359,9 +353,11 @@ int Curl_fnmatch(void *ptr, const char *pattern, const char *string)
   if(!pattern || !string) {
     return CURL_FNMATCH_FAIL;
   }
-  return loop((unsigned char *)pattern, (unsigned char *)string, 2);
+  return loop((const unsigned char *)pattern,
+              (const unsigned char *)string, 2);
 }
-#else
+#else /* HAVE_FNMATCH */
+
 #include <fnmatch.h>
 /*
  * @unittest: 1307
@@ -384,7 +380,6 @@ int Curl_fnmatch(void *ptr, const char *pattern, const char *string)
   }
   /* not reached */
 }
+#endif /* !HAVE_FNMATCH */
 
-#endif
-
-#endif /* if FTP is disabled */
+#endif /* !CURL_DISABLE_FTP */
diff --git a/third-party/curl/lib/curl_fnmatch.h b/third-party/curl/lib/curl_fnmatch.h
index 595646ff0d..61d2a0c4e9 100644
--- a/third-party/curl/lib/curl_fnmatch.h
+++ b/third-party/curl/lib/curl_fnmatch.h
@@ -23,7 +23,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #define CURL_FNMATCH_MATCH    0
 #define CURL_FNMATCH_NOMATCH  1
 #define CURL_FNMATCH_FAIL     2
@@ -31,7 +30,7 @@
 /* default pattern matching function
  * =================================
  * Implemented with recursive backtracking, if you want to use Curl_fnmatch,
- * please note that there is not implemented UTF/UNICODE support.
+ * please note that there is not implemented UTF/Unicode support.
  *
  * Implemented features:
  * '?' notation, does not match UTF characters
diff --git a/third-party/curl/lib/curl_fopen.c b/third-party/curl/lib/curl_fopen.c
new file mode 100644
index 0000000000..abb17eab4b
--- /dev/null
+++ b/third-party/curl/lib/curl_fopen.c
@@ -0,0 +1,165 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#if !defined(CURL_DISABLE_COOKIES) || !defined(CURL_DISABLE_ALTSVC) || \
+  !defined(CURL_DISABLE_HSTS)
+
+#include "urldata.h"
+#include "rand.h"
+#include "curl_fopen.h"
+
+/*
+  The dirslash() function breaks a null-terminated pathname string into
+  directory and filename components then returns the directory component up
+  to, *AND INCLUDING*, a final '/'. If there is no directory in the path,
+  this instead returns a "" string.
+
+  This function returns a pointer to malloc'ed memory.
+
+  The input path to this function is expected to have a filename part.
+*/
+
+#ifdef _WIN32
+#define PATHSEP   "\\"
+#define IS_SEP(x) (((x) == '/') || ((x) == '\\'))
+#elif defined(MSDOS) || defined(OS2)
+#define PATHSEP   "\\"
+#define IS_SEP(x) ((x) == '\\')
+#else
+#define PATHSEP   "/"
+#define IS_SEP(x) ((x) == '/')
+#endif
+
+static char *dirslash(const char *path)
+{
+  size_t n;
+  struct dynbuf out;
+  DEBUGASSERT(path);
+  curlx_dyn_init(&out, CURL_MAX_INPUT_LENGTH);
+  n = strlen(path);
+  if(n) {
+    /* find the rightmost path separator, if any */
+    while(n && !IS_SEP(path[n - 1]))
+      --n;
+    /* skip over all the path separators, if any */
+    while(n && IS_SEP(path[n - 1]))
+      --n;
+  }
+  if(curlx_dyn_addn(&out, path, n))
+    return NULL;
+  /* if there was a directory, append a single trailing slash */
+  if(n && curlx_dyn_addn(&out, PATHSEP, 1))
+    return NULL;
+  return curlx_dyn_ptr(&out);
+}
+
+/*
+ * Curl_fopen() opens a file for writing with a temp name, to be renamed
+ * to the final name when completed. If there is an existing file using this
+ * name at the time of the open, this function will clone the mode from that
+ * file. if 'tempname' is non-NULL, it needs a rename after the file is
+ * written.
+ */
+CURLcode Curl_fopen(struct Curl_easy *data, const char *filename,
+                    FILE **fh, char **tempname)
+{
+  CURLcode result = CURLE_WRITE_ERROR;
+  unsigned char randbuf[41];
+  char *tempstore = NULL;
+#ifndef _WIN32
+  curlx_struct_stat sb;
+#endif
+  int fd = -1;
+  char *dir = NULL;
+  *tempname = NULL;
+
+#ifndef _WIN32
+  *fh = curlx_fopen(filename, FOPEN_WRITETEXT);
+  if(!*fh)
+    goto fail;
+  if(curlx_fstat(fileno(*fh), &sb) == -1 || !S_ISREG(sb.st_mode)) {
+    return CURLE_OK;
+  }
+  curlx_fclose(*fh);
+#ifdef HAVE_GETEUID
+  /* If the existing file is not owned by the user, do not inherit
+   * its permissions at the temp file created below. The permissions
+   * might be unsuitable for holding user private data. */
+  if(sb.st_uid != geteuid())
+    sb.st_mode = 0;
+#endif
+#endif /* !_WIN32 */
+  *fh = NULL;
+
+  result = Curl_rand_alnum(data, randbuf, sizeof(randbuf));
+  if(result)
+    goto fail;
+
+  dir = dirslash(filename);
+  if(dir) {
+    /* The temp filename should not end up too long for the target file
+       system */
+    tempstore = curl_maprintf("%s%s.tmp", dir, randbuf);
+    curlx_free(dir);
+  }
+
+  if(!tempstore) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto fail;
+  }
+
+  result = CURLE_WRITE_ERROR;
+#ifdef _WIN32
+  fd = curlx_open(tempstore, _O_WRONLY | _O_CREAT | _O_EXCL,
+                  _S_IREAD | _S_IWRITE);
+#elif (defined(ANDROID) || defined(__ANDROID__)) && \
+  (defined(__i386__) || defined(__arm__))
+  fd = curlx_open(tempstore, O_WRONLY | O_CREAT | O_EXCL,
+                  (mode_t)(S_IRUSR | S_IWUSR | sb.st_mode));
+#else
+  fd = curlx_open(tempstore, O_WRONLY | O_CREAT | O_EXCL,
+                  S_IRUSR | S_IWUSR | sb.st_mode);
+#endif
+  if(fd == -1)
+    goto fail;
+
+  *fh = curlx_fdopen(fd, FOPEN_WRITETEXT);
+  if(!*fh)
+    goto fail;
+
+  *tempname = tempstore;
+  return CURLE_OK;
+
+fail:
+  if(fd != -1) {
+    curlx_close(fd);
+    unlink(tempstore);
+  }
+
+  curlx_free(tempstore);
+  return result;
+}
+
+#endif /* !disabled */
diff --git a/third-party/curl/lib/curl_fopen.h b/third-party/curl/lib/curl_fopen.h
new file mode 100644
index 0000000000..bd402d4489
--- /dev/null
+++ b/third-party/curl/lib/curl_fopen.h
@@ -0,0 +1,31 @@
+#ifndef HEADER_CURL_FOPEN_H
+#define HEADER_CURL_FOPEN_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curlx/fopen.h"
+
+CURLcode Curl_fopen(struct Curl_easy *data, const char *filename,
+                    FILE **fh, char **tempname);
+
+#endif
diff --git a/third-party/curl/lib/curl_get_line.c b/third-party/curl/lib/curl_get_line.c
index 686abe7511..6fcd043c93 100644
--- a/third-party/curl/lib/curl_get_line.c
+++ b/third-party/curl/lib/curl_get_line.c
@@ -21,66 +21,49 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#if !defined(CURL_DISABLE_COOKIES) || !defined(CURL_DISABLE_ALTSVC) ||  \
+#if !defined(CURL_DISABLE_COOKIES) || !defined(CURL_DISABLE_ALTSVC) || \
   !defined(CURL_DISABLE_HSTS) || !defined(CURL_DISABLE_NETRC)
 
 #include "curl_get_line.h"
-#include "curl_memory.h"
-/* The last #include file should be: */
-#include "memdebug.h"
 
 /*
- * Curl_get_line() makes sure to only return complete whole lines that fit in
- * 'len' bytes and end with a newline.
+ * Curl_get_line() returns only complete whole lines that end with newline.
+ * When 'eof' is set TRUE, the last line has been read.
  */
-char *Curl_get_line(char *buf, int len, FILE *input)
+CURLcode Curl_get_line(struct dynbuf *buf, FILE *input, bool *eof)
 {
-  bool partial = FALSE;
+  CURLcode result;
+  char buffer[128];
+  curlx_dyn_reset(buf);
   while(1) {
-    char *b = fgets(buf, len, input);
+    size_t rlen;
+    const char *b = fgets(buffer, sizeof(buffer), input);
+    if(!b && ferror(input))
+      return CURLE_READ_ERROR;
 
-    if(b) {
-      size_t rlen = strlen(b);
+    *eof = feof(input);
 
-      if(!rlen)
-        break;
-
-      if(b[rlen-1] == '\n') {
-        /* b is \n terminated */
-        if(partial) {
-          partial = FALSE;
-          continue;
-        }
-        return b;
-      }
-      else if(feof(input)) {
-        if(partial)
-          /* Line is already too large to return, ignore rest */
-          break;
-
-        if(rlen + 1 < (size_t) len) {
-          /* b is EOF terminated, insert missing \n */
-          b[rlen] = '\n';
-          b[rlen + 1] = '\0';
-          return b;
-        }
-        else
-          /* Maximum buffersize reached + EOF
-           * This line is impossible to add a \n to so we'll ignore it
-           */
-          break;
-      }
-      else
-        /* Maximum buffersize reached */
-        partial = TRUE;
+    rlen = b ? strlen(b) : 0;
+    if(rlen) {
+      result = curlx_dyn_addn(buf, b, rlen);
+      if(result)
+        /* too long line or out of memory */
+        return result;
     }
-    else
-      break;
+    /* now check the full line */
+    rlen = curlx_dyn_len(buf);
+    b = curlx_dyn_ptr(buf);
+    if(rlen && (b[rlen - 1] == '\n'))
+      /* LF at end of the line */
+      return CURLE_OK; /* all good */
+    if(*eof)
+      /* append a newline */
+      return curlx_dyn_addn(buf, "\n", 1);
+    /* otherwise get next line to append */
   }
-  return NULL;
+  /* UNREACHABLE */
 }
 
 #endif /* if not disabled */
diff --git a/third-party/curl/lib/curl_get_line.h b/third-party/curl/lib/curl_get_line.h
index 0ff32c5c2c..6b90ac4727 100644
--- a/third-party/curl/lib/curl_get_line.h
+++ b/third-party/curl/lib/curl_get_line.h
@@ -23,9 +23,9 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "curlx/dynbuf.h"
 
-/* get_line() makes sure to only return complete whole lines that fit in 'len'
- * bytes and end with a newline. */
-char *Curl_get_line(char *buf, int len, FILE *input);
+/* Curl_get_line() returns complete lines that end with a newline. */
+CURLcode Curl_get_line(struct dynbuf *buf, FILE *input, bool *eof);
 
 #endif /* HEADER_CURL_GET_LINE_H */
diff --git a/third-party/curl/lib/curl_gethostname.c b/third-party/curl/lib/curl_gethostname.c
index 706b2e6892..f154c837f6 100644
--- a/third-party/curl/lib/curl_gethostname.c
+++ b/third-party/curl/lib/curl_gethostname.c
@@ -21,33 +21,24 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #include "curl_gethostname.h"
+#include "curlx/strcopy.h"
 
 /*
  * Curl_gethostname() is a wrapper around gethostname() which allows
- * overriding the host name that the function would normally return.
+ * overriding the hostname that the function would normally return.
  * This capability is used by the test suite to verify exact matching
  * of NTLM authentication, which exercises libcurl's MD4 and DES code
  * as well as by the SMTP module when a hostname is not provided.
  *
- * For libcurl debug enabled builds host name overriding takes place
+ * For libcurl debug enabled builds hostname overriding takes place
  * when environment variable CURL_GETHOSTNAME is set, using the value
- * held by the variable to override returned host name.
+ * held by the variable to override returned hostname.
  *
  * Note: The function always returns the un-qualified hostname rather
  * than being provider dependent.
- *
- * For libcurl shared library release builds the test suite preloads
- * another shared library named libhostname using the LD_PRELOAD
- * mechanism which intercepts, and might override, the gethostname()
- * function call. In this case a given platform must support the
- * LD_PRELOAD mechanism and additionally have environment variable
- * CURL_GETHOSTNAME set in order to override the returned host name.
- *
- * For libcurl static library release builds no overriding takes place.
  */
 
 int Curl_gethostname(char * const name, GETHOSTNAME_TYPE_ARG2 namelen)
@@ -55,8 +46,8 @@ int Curl_gethostname(char * const name, GETHOSTNAME_TYPE_ARG2 namelen)
 #ifndef HAVE_GETHOSTNAME
 
   /* Allow compilation and return failure when unavailable */
-  (void) name;
-  (void) namelen;
+  (void)name;
+  (void)namelen;
   return -1;
 
 #else
@@ -65,10 +56,13 @@ int Curl_gethostname(char * const name, GETHOSTNAME_TYPE_ARG2 namelen)
 
 #ifdef DEBUGBUILD
 
-  /* Override host name when environment variable CURL_GETHOSTNAME is set */
+  /* Override hostname when environment variable CURL_GETHOSTNAME is set */
   const char *force_hostname = getenv("CURL_GETHOSTNAME");
   if(force_hostname) {
-    strncpy(name, force_hostname, namelen);
+    if(strlen(force_hostname) < (size_t)namelen)
+      curlx_strcopy(name, namelen, force_hostname, strlen(force_hostname));
+    else
+      return 1; /* cannot do it */
     err = 0;
   }
   else {
@@ -78,11 +72,12 @@ int Curl_gethostname(char * const name, GETHOSTNAME_TYPE_ARG2 namelen)
 
 #else /* DEBUGBUILD */
 
-  /* The call to system's gethostname() might get intercepted by the
-     libhostname library when libcurl is built as a non-debug shared
-     library when running the test suite. */
   name[0] = '\0';
+#ifdef __AMIGA__
+  err = gethostname((unsigned char *)name, namelen);
+#else
   err = gethostname(name, namelen);
+#endif
 
 #endif
 
@@ -98,5 +93,4 @@ int Curl_gethostname(char * const name, GETHOSTNAME_TYPE_ARG2 namelen)
 
   return 0;
 #endif
-
 }
diff --git a/third-party/curl/lib/curl_gssapi.c b/third-party/curl/lib/curl_gssapi.c
index c6fe1256b2..07a6c1e7ed 100644
--- a/third-party/curl/lib/curl_gssapi.c
+++ b/third-party/curl/lib/curl_gssapi.c
@@ -21,43 +21,304 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef HAVE_GSSAPI
 
 #include "curl_gssapi.h"
-#include "sendf.h"
+#include "curl_trc.h"
+#include "curlx/strcopy.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#ifdef DEBUGBUILD
+#if defined(HAVE_GSSGNU) || !defined(_WIN32)
+#define Curl_gss_alloc malloc  /* freed via the GSS API gss_release_buffer() */
+#define Curl_gss_free  free    /* pair of the above */
+#define CURL_GSS_STUB
+/* For correctness this would be required for all platforms, not only Windows,
+   but, as of v1.22.1, MIT Kerberos uses a special allocator only for Windows,
+   and the availability of 'gssapi/gssapi_alloc.h' is difficult to detect,
+   because GSS headers are not versioned, and there is also no other macro to
+   indicate 1.18+ vs. previous versions. On Windows we can use 'GSS_S_BAD_MIC'.
+ */
+#elif defined(_WIN32) && defined(GSS_S_BAD_MIC) /* MIT Kerberos 1.15+ */
+/* MIT Kerberos 1.10+ (Windows), 1.18+ (all platforms), missing from GNU GSS */
+#include <gssapi/gssapi_alloc.h>
+#define Curl_gss_alloc gssalloc_malloc
+#define Curl_gss_free  gssalloc_free
+#define CURL_GSS_STUB
+#endif
+#endif /* DEBUGBUILD */
 
-#if defined(__GNUC__)
-#define CURL_ALIGN8   __attribute__ ((aligned(8)))
+#ifdef __GNUC__
+#define CURL_ALIGN8  __attribute__((aligned(8)))
 #else
 #define CURL_ALIGN8
 #endif
 
+#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
+
 gss_OID_desc Curl_spnego_mech_oid CURL_ALIGN8 = {
-  6, (char *)"\x2b\x06\x01\x05\x05\x02"
+  6, CURL_UNCONST("\x2b\x06\x01\x05\x05\x02")
 };
 gss_OID_desc Curl_krb5_mech_oid CURL_ALIGN8 = {
-  9, (char *)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02"
+  9, CURL_UNCONST("\x2a\x86\x48\x86\xf7\x12\x01\x02\x02")
 };
 
-OM_uint32 Curl_gss_init_sec_context(
-    struct Curl_easy *data,
-    OM_uint32 *minor_status,
-    gss_ctx_id_t *context,
-    gss_name_t target_name,
-    gss_OID mech_type,
-    gss_channel_bindings_t input_chan_bindings,
-    gss_buffer_t input_token,
-    gss_buffer_t output_token,
-    const bool mutual_auth,
-    OM_uint32 *ret_flags)
+#ifdef CURL_GSS_STUB
+enum min_err_code {
+  STUB_GSS_OK = 0,
+  STUB_GSS_NO_MEMORY,
+  STUB_GSS_INVALID_ARGS,
+  STUB_GSS_INVALID_CREDS,
+  STUB_GSS_INVALID_CTX,
+  STUB_GSS_SERVER_ERR,
+  STUB_GSS_NO_MECH,
+  STUB_GSS_LAST
+};
+
+/* libcurl is also passing this struct to these functions, which are not yet
+ * stubbed:
+ *   gss_inquire_context()
+ *   gss_unwrap()
+ *   gss_wrap()
+ */
+struct stub_gss_ctx_id_t_desc {
+  enum { STUB_GSS_NONE, STUB_GSS_KRB5, STUB_GSS_NTLM1, STUB_GSS_NTLM3 } sent;
+  int have_krb5;
+  int have_ntlm;
+  OM_uint32 flags;
+  char creds[250];
+};
+
+static OM_uint32 stub_gss_init_sec_context(
+  OM_uint32 *min,
+  gss_cred_id_t initiator_cred_handle,
+  struct stub_gss_ctx_id_t_desc **context,
+  gss_name_t target_name,
+  const gss_OID mech_type,
+  OM_uint32 req_flags,
+  OM_uint32 time_req,
+  const gss_channel_bindings_t input_chan_bindings,
+  gss_buffer_desc *input_token,
+  gss_OID *actual_mech_type,
+  gss_buffer_desc *output_token,
+  OM_uint32 *ret_flags,
+  OM_uint32 *time_rec)
+{
+  struct stub_gss_ctx_id_t_desc *ctx = NULL;
+
+  /* The token will be encoded in base64 */
+  size_t length = sizeof(ctx->creds) * 3 / 4;
+  size_t used = 0;
+  char *token = NULL;
+  const char *creds = NULL;
+
+  (void)initiator_cred_handle;
+  (void)mech_type;
+  (void)time_req;
+  (void)input_chan_bindings;
+  (void)actual_mech_type;
+
+  if(!min)
+    return GSS_S_FAILURE;
+
+  *min = 0;
+
+  if(!context || !target_name || !output_token) {
+    *min = STUB_GSS_INVALID_ARGS;
+    return GSS_S_FAILURE;
+  }
+
+  creds = getenv("CURL_STUB_GSS_CREDS");
+  if(!creds || strlen(creds) >= sizeof(ctx->creds)) {
+    *min = STUB_GSS_INVALID_CREDS;
+    return GSS_S_FAILURE;
+  }
+
+  ctx = *context;
+  if(ctx && strcmp(ctx->creds, creds)) {
+    *min = STUB_GSS_INVALID_CREDS;
+    return GSS_S_FAILURE;
+  }
+
+  output_token->length = 0;
+  output_token->value = NULL;
+
+  if(input_token && input_token->length) {
+    if(!ctx) {
+      *min = STUB_GSS_INVALID_CTX;
+      return GSS_S_FAILURE;
+    }
+
+    /* Server response, either D (RA==) or C (Qw==) */
+    if(((char *)input_token->value)[0] == 'D') {
+      /* Done */
+      switch(ctx->sent) {
+      case STUB_GSS_KRB5:
+      case STUB_GSS_NTLM3:
+        if(ret_flags)
+          *ret_flags = ctx->flags;
+        if(time_rec)
+          *time_rec = GSS_C_INDEFINITE;
+        return GSS_S_COMPLETE;
+      default:
+        *min = STUB_GSS_SERVER_ERR;
+        return GSS_S_FAILURE;
+      }
+    }
+
+    if(((char *)input_token->value)[0] != 'C') {
+      /* We only support Done or Continue */
+      *min = STUB_GSS_SERVER_ERR;
+      return GSS_S_FAILURE;
+    }
+
+    /* Continue */
+    switch(ctx->sent) {
+    case STUB_GSS_KRB5:
+      /* We sent KRB5 and it failed, let's try NTLM */
+      if(ctx->have_ntlm) {
+        ctx->sent = STUB_GSS_NTLM1;
+        break;
+      }
+      else {
+        *min = STUB_GSS_SERVER_ERR;
+        return GSS_S_FAILURE;
+      }
+    case STUB_GSS_NTLM1:
+      ctx->sent = STUB_GSS_NTLM3;
+      break;
+    default:
+      *min = STUB_GSS_SERVER_ERR;
+      return GSS_S_FAILURE;
+    }
+  }
+  else {
+    if(ctx) {
+      *min = STUB_GSS_INVALID_CTX;
+      return GSS_S_FAILURE;
+    }
+
+    ctx = curlx_calloc(1, sizeof(*ctx));
+    if(!ctx) {
+      *min = STUB_GSS_NO_MEMORY;
+      return GSS_S_FAILURE;
+    }
+
+    if(strstr(creds, "KRB5"))
+      ctx->have_krb5 = 1;
+
+    if(strstr(creds, "NTLM"))
+      ctx->have_ntlm = 1;
+
+    if(ctx->have_krb5)
+      ctx->sent = STUB_GSS_KRB5;
+    else if(ctx->have_ntlm)
+      ctx->sent = STUB_GSS_NTLM1;
+    else {
+      curlx_free(ctx);
+      *min = STUB_GSS_NO_MECH;
+      return GSS_S_FAILURE;
+    }
+
+    curlx_strcopy(ctx->creds, sizeof(ctx->creds), creds, strlen(creds));
+    ctx->flags = req_flags;
+  }
+
+  token = Curl_gss_alloc(length);
+  if(!token) {
+    curlx_free(ctx);
+    *min = STUB_GSS_NO_MEMORY;
+    return GSS_S_FAILURE;
+  }
+
+  {
+    gss_buffer_desc target_desc;
+    gss_OID name_type = GSS_C_NO_OID;
+    OM_uint32 minor_status;
+    OM_uint32 major_status;
+    major_status = gss_display_name(&minor_status, target_name,
+                                    &target_desc, &name_type);
+    if(GSS_ERROR(major_status)) {
+      Curl_gss_free(token);
+      curlx_free(ctx);
+      *min = STUB_GSS_NO_MEMORY;
+      return GSS_S_FAILURE;
+    }
+
+    if(strlen(creds) + target_desc.length + 5 >= sizeof(ctx->creds)) {
+      Curl_gss_free(token);
+      curlx_free(ctx);
+      *min = STUB_GSS_NO_MEMORY;
+      return GSS_S_FAILURE;
+    }
+
+    /* Token format: creds:target:type:padding */
+    used = curl_msnprintf(token, length, "%s:%.*s:%d:", creds,
+                          (int)target_desc.length,
+                          (const char *)target_desc.value,
+                          (int)ctx->sent);
+
+    gss_release_buffer(&minor_status, &target_desc);
+  }
+
+  if(used >= length) {
+    Curl_gss_free(token);
+    curlx_free(ctx);
+    *min = STUB_GSS_NO_MEMORY;
+    return GSS_S_FAILURE;
+  }
+
+  /* Overwrite null-terminator */
+  memset(token + used, 'A', length - used);
+
+  *context = ctx;
+
+  output_token->value = token;
+  output_token->length = length;
+
+  return GSS_S_CONTINUE_NEEDED;
+}
+
+static OM_uint32 stub_gss_delete_sec_context(
+  OM_uint32 *min,
+  struct stub_gss_ctx_id_t_desc **context,
+  gss_buffer_t output_token)
+{
+  (void)output_token;
+
+  if(!min)
+    return GSS_S_FAILURE;
+
+  if(!context) {
+    *min = STUB_GSS_INVALID_CTX;
+    return GSS_S_FAILURE;
+  }
+  if(!*context) {
+    *min = STUB_GSS_INVALID_CTX;
+    return GSS_S_FAILURE;
+  }
+
+  curlx_safefree(*context);
+  *min = 0;
+
+  return GSS_S_COMPLETE;
+}
+#endif /* CURL_GSS_STUB */
+
+OM_uint32 Curl_gss_init_sec_context(struct Curl_easy *data,
+                                    OM_uint32 *minor_status,
+                                    gss_ctx_id_t *context,
+                                    gss_name_t target_name,
+                                    gss_OID mech_type,
+                                    gss_channel_bindings_t input_chan_bindings,
+                                    gss_buffer_t input_token,
+                                    gss_buffer_t output_token,
+                                    const bool mutual_auth,
+                                    OM_uint32 *ret_flags)
 {
   OM_uint32 req_flags = GSS_C_REPLAY_FLAG;
 
@@ -65,17 +326,34 @@ OM_uint32 Curl_gss_init_sec_context(
     req_flags |= GSS_C_MUTUAL_FLAG;
 
   if(data->set.gssapi_delegation & CURLGSSAPI_DELEGATION_POLICY_FLAG) {
-#ifdef GSS_C_DELEG_POLICY_FLAG
+#ifdef GSS_C_DELEG_POLICY_FLAG  /* MIT Kerberos 1.8+, missing from GNU GSS */
     req_flags |= GSS_C_DELEG_POLICY_FLAG;
 #else
     infof(data, "WARNING: support for CURLGSSAPI_DELEGATION_POLICY_FLAG not "
-        "compiled in");
+          "compiled in");
 #endif
   }
 
   if(data->set.gssapi_delegation & CURLGSSAPI_DELEGATION_FLAG)
     req_flags |= GSS_C_DELEG_FLAG;
 
+#ifdef CURL_GSS_STUB
+  if(getenv("CURL_STUB_GSS_CREDS"))
+    return stub_gss_init_sec_context(minor_status,
+                                     GSS_C_NO_CREDENTIAL, /* cred_handle */
+                                     (struct stub_gss_ctx_id_t_desc **)context,
+                                     target_name,
+                                     mech_type,
+                                     req_flags,
+                                     0, /* time_req */
+                                     input_chan_bindings,
+                                     input_token,
+                                     NULL, /* actual_mech_type */
+                                     output_token,
+                                     ret_flags,
+                                     NULL /* time_rec */);
+#endif /* CURL_GSS_STUB */
+
   return gss_init_sec_context(minor_status,
                               GSS_C_NO_CREDENTIAL, /* cred_handle */
                               context,
@@ -91,9 +369,25 @@ OM_uint32 Curl_gss_init_sec_context(
                               NULL /* time_rec */);
 }
 
+OM_uint32 Curl_gss_delete_sec_context(OM_uint32 *min,
+                                      gss_ctx_id_t *context,
+                                      gss_buffer_t output_token)
+{
+#ifdef CURL_GSS_STUB
+  if(getenv("CURL_STUB_GSS_CREDS"))
+    return stub_gss_delete_sec_context(min,
+                                     (struct stub_gss_ctx_id_t_desc **)context,
+                                     output_token);
+#endif /* CURL_GSS_STUB */
+
+  return gss_delete_sec_context(min, context, output_token);
+}
+
+#ifdef CURLVERBOSE
 #define GSS_LOG_BUFFER_LEN 1024
 static size_t display_gss_error(OM_uint32 status, int type,
-                                char *buf, size_t len) {
+                                char *buf, size_t len)
+{
   OM_uint32 maj_stat;
   OM_uint32 min_stat;
   OM_uint32 msg_ctx = 0;
@@ -108,9 +402,9 @@ static size_t display_gss_error(OM_uint32 status, int type,
                                   &status_string);
     if(maj_stat == GSS_S_COMPLETE && status_string.length > 0) {
       if(GSS_LOG_BUFFER_LEN > len + status_string.length + 3) {
-        len += msnprintf(buf + len, GSS_LOG_BUFFER_LEN - len,
-                         "%.*s. ", (int)status_string.length,
-                         (char *)status_string.value);
+        len += curl_msnprintf(buf + len, GSS_LOG_BUFFER_LEN - len,
+                              "%.*s. ", (int)status_string.length,
+                              (char *)status_string.value);
       }
     }
     gss_release_buffer(&min_stat, &status_string);
@@ -134,7 +428,7 @@ static size_t display_gss_error(OM_uint32 status, int type,
 void Curl_gss_log_error(struct Curl_easy *data, const char *prefix,
                         OM_uint32 major, OM_uint32 minor)
 {
-  char buf[GSS_LOG_BUFFER_LEN];
+  char buf[GSS_LOG_BUFFER_LEN] = "";
   size_t len = 0;
 
   if(major != GSS_S_FAILURE)
@@ -143,10 +437,11 @@ void Curl_gss_log_error(struct Curl_easy *data, const char *prefix,
   display_gss_error(minor, GSS_C_MECH_CODE, buf, len);
 
   infof(data, "%s%s", prefix, buf);
-#ifdef CURL_DISABLE_VERBOSE_STRINGS
-  (void)data;
-  (void)prefix;
-#endif
 }
+#endif /* CURLVERBOSE */
+
+#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
+#pragma GCC diagnostic pop
+#endif
 
 #endif /* HAVE_GSSAPI */
diff --git a/third-party/curl/lib/curl_gssapi.h b/third-party/curl/lib/curl_gssapi.h
index 7b9a534ea2..fc3759ebcb 100644
--- a/third-party/curl/lib/curl_gssapi.h
+++ b/third-party/curl/lib/curl_gssapi.h
@@ -23,8 +23,8 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+
 #include "urldata.h"
 
 #ifdef HAVE_GSSAPI
@@ -32,26 +32,33 @@ extern gss_OID_desc Curl_spnego_mech_oid;
 extern gss_OID_desc Curl_krb5_mech_oid;
 
 /* Common method for using GSS-API */
-OM_uint32 Curl_gss_init_sec_context(
-    struct Curl_easy *data,
-    OM_uint32 *minor_status,
-    gss_ctx_id_t *context,
-    gss_name_t target_name,
-    gss_OID mech_type,
-    gss_channel_bindings_t input_chan_bindings,
-    gss_buffer_t input_token,
-    gss_buffer_t output_token,
-    const bool mutual_auth,
-    OM_uint32 *ret_flags);
+OM_uint32 Curl_gss_init_sec_context(struct Curl_easy *data,
+                                    OM_uint32 *minor_status,
+                                    gss_ctx_id_t *context,
+                                    gss_name_t target_name,
+                                    gss_OID mech_type,
+                                    gss_channel_bindings_t input_chan_bindings,
+                                    gss_buffer_t input_token,
+                                    gss_buffer_t output_token,
+                                    const bool mutual_auth,
+                                    OM_uint32 *ret_flags);
 
+OM_uint32 Curl_gss_delete_sec_context(OM_uint32 *min,
+                                      gss_ctx_id_t *context,
+                                      gss_buffer_t output_token);
+
+#ifdef CURLVERBOSE
 /* Helper to log a GSS-API error status */
 void Curl_gss_log_error(struct Curl_easy *data, const char *prefix,
                         OM_uint32 major, OM_uint32 minor);
-
-/* Provide some definitions missing in old headers */
-#ifdef HAVE_OLD_GSSMIT
-#define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
-#define NCOMPAT 1
+#else
+#define Curl_gss_log_error(data, prefix, major, minor) \
+  do {                                                 \
+    (void)(data);                                      \
+    (void)(prefix);                                    \
+    (void)(major);                                     \
+    (void)(minor);                                     \
+  } while(0)
 #endif
 
 /* Define our privacy and integrity protection values */
diff --git a/third-party/curl/lib/curl_hmac.h b/third-party/curl/lib/curl_hmac.h
index 9438ca782a..d9a697a0a5 100644
--- a/third-party/curl/lib/curl_hmac.h
+++ b/third-party/curl/lib/curl_hmac.h
@@ -24,54 +24,48 @@
  *
  ***************************************************************************/
 
-#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) \
-    || !defined(CURL_DISABLE_AWS)
-
-#include <curl/curl.h>
+#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) ||    \
+  !defined(CURL_DISABLE_AWS) || !defined(CURL_DISABLE_DIGEST_AUTH) || \
+  defined(USE_LIBSSH2) || defined(USE_SSL)
 
 #define HMAC_MD5_LENGTH 16
 
-typedef CURLcode (* HMAC_hinit_func)(void *context);
-typedef void    (* HMAC_hupdate_func)(void *context,
-                                      const unsigned char *data,
-                                      unsigned int len);
-typedef void    (* HMAC_hfinal_func)(unsigned char *result, void *context);
-
+typedef CURLcode (*HMAC_hinit)(void *context);
+typedef void (*HMAC_hupdate)(void *context,
+                             const unsigned char *data,
+                             unsigned int len);
+typedef void (*HMAC_hfinal)(unsigned char *result, void *context);
 
 /* Per-hash function HMAC parameters. */
 struct HMAC_params {
-  HMAC_hinit_func
-  hmac_hinit;     /* Initialize context procedure. */
-  HMAC_hupdate_func     hmac_hupdate;   /* Update context with data. */
-  HMAC_hfinal_func      hmac_hfinal;    /* Get final result procedure. */
-  unsigned int          hmac_ctxtsize;  /* Context structure size. */
-  unsigned int          hmac_maxkeylen; /* Maximum key length (bytes). */
-  unsigned int          hmac_resultlen; /* Result length (bytes). */
+  HMAC_hinit  hinit;       /* Initialize context procedure. */
+  HMAC_hupdate hupdate;    /* Update context with data. */
+  HMAC_hfinal hfinal;      /* Get final result procedure. */
+  unsigned int ctxtsize;   /* Context structure size. */
+  unsigned int maxkeylen;  /* Maximum key length (bytes). */
+  unsigned int resultlen;  /* Result length (bytes). */
 };
 
-
 /* HMAC computation context. */
 struct HMAC_context {
-  const struct HMAC_params *hmac_hash; /* Hash function definition. */
-  void *hmac_hashctxt1;         /* Hash function context 1. */
-  void *hmac_hashctxt2;         /* Hash function context 2. */
+  const struct HMAC_params *hash; /* Hash function definition. */
+  void *hashctxt1;         /* Hash function context 1. */
+  void *hashctxt2;         /* Hash function context 2. */
 };
 
-
 /* Prototypes. */
 struct HMAC_context *Curl_HMAC_init(const struct HMAC_params *hashparams,
                                     const unsigned char *key,
                                     unsigned int keylen);
-int Curl_HMAC_update(struct HMAC_context *context,
-                     const unsigned char *data,
-                     unsigned int len);
-int Curl_HMAC_final(struct HMAC_context *context, unsigned char *result);
+void Curl_HMAC_update(struct HMAC_context *ctxt,
+                      const unsigned char *data,
+                      unsigned int len);
+int Curl_HMAC_final(struct HMAC_context *ctxt, unsigned char *output);
 
 CURLcode Curl_hmacit(const struct HMAC_params *hashparams,
                      const unsigned char *key, const size_t keylen,
-                     const unsigned char *data, const size_t datalen,
+                     const unsigned char *data, size_t datalen,
                      unsigned char *output);
-
 #endif
 
 #endif /* HEADER_CURL_HMAC_H */
diff --git a/third-party/curl/lib/curl_krb5.h b/third-party/curl/lib/curl_krb5.h
deleted file mode 100644
index ccf6b96a87..0000000000
--- a/third-party/curl/lib/curl_krb5.h
+++ /dev/null
@@ -1,52 +0,0 @@
-#ifndef HEADER_CURL_KRB5_H
-#define HEADER_CURL_KRB5_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-struct Curl_sec_client_mech {
-  const char *name;
-  size_t size;
-  int (*init)(void *);
-  int (*auth)(void *, struct Curl_easy *data, struct connectdata *);
-  void (*end)(void *);
-  int (*check_prot)(void *, int);
-  int (*encode)(void *, const void *, int, int, void **);
-  int (*decode)(void *, void *, int, int, struct connectdata *);
-};
-
-#define AUTH_OK         0
-#define AUTH_CONTINUE   1
-#define AUTH_ERROR      2
-
-#ifdef HAVE_GSSAPI
-int Curl_sec_read_msg(struct Curl_easy *data, struct connectdata *conn, char *,
-                      enum protection_level);
-void Curl_sec_end(struct connectdata *);
-CURLcode Curl_sec_login(struct Curl_easy *, struct connectdata *);
-int Curl_sec_request_prot(struct connectdata *conn, const char *level);
-#else
-#define Curl_sec_end(x)
-#endif
-
-#endif /* HEADER_CURL_KRB5_H */
diff --git a/third-party/curl/lib/curl_ldap.h b/third-party/curl/lib/curl_ldap.h
index 8a1d807ed9..0ccc1289e2 100644
--- a/third-party/curl/lib/curl_ldap.h
+++ b/third-party/curl/lib/curl_ldap.h
@@ -23,14 +23,8 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#ifndef CURL_DISABLE_LDAP
-extern const struct Curl_handler Curl_handler_ldap;
+extern const struct Curl_protocol Curl_protocol_ldap;
 
-#if !defined(CURL_DISABLE_LDAPS) && \
-    ((defined(USE_OPENLDAP) && defined(USE_SSL)) || \
-     (!defined(USE_OPENLDAP) && defined(HAVE_LDAP_SSL)))
-extern const struct Curl_handler Curl_handler_ldaps;
-#endif
+void Curl_ldap_version(char *buf, size_t bufsz);
 
-#endif
 #endif /* HEADER_CURL_LDAP_H */
diff --git a/third-party/curl/lib/curl_md4.h b/third-party/curl/lib/curl_md4.h
index 4706e49578..05d1624974 100644
--- a/third-party/curl/lib/curl_md4.h
+++ b/third-party/curl/lib/curl_md4.h
@@ -23,17 +23,15 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
-#include <curl/curl.h>
 
-#if defined(USE_CURL_NTLM_CORE)
+#ifdef USE_CURL_NTLM_CORE
 
 #define MD4_DIGEST_LENGTH 16
 
 CURLcode Curl_md4it(unsigned char *output, const unsigned char *input,
                     const size_t len);
 
-#endif /* defined(USE_CURL_NTLM_CORE) */
+#endif /* USE_CURL_NTLM_CORE */
 
 #endif /* HEADER_CURL_MD4_H */
diff --git a/third-party/curl/lib/curl_md5.h b/third-party/curl/lib/curl_md5.h
index 61671c306a..1beaed5e66 100644
--- a/third-party/curl/lib/curl_md5.h
+++ b/third-party/curl/lib/curl_md5.h
@@ -24,41 +24,41 @@
  *
  ***************************************************************************/
 
-#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) \
-    || !defined(CURL_DISABLE_DIGEST_AUTH)
+#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) || \
+  !defined(CURL_DISABLE_DIGEST_AUTH)
 
 #include "curl_hmac.h"
 
 #define MD5_DIGEST_LEN  16
 
-typedef CURLcode (* Curl_MD5_init_func)(void *context);
-typedef void (* Curl_MD5_update_func)(void *context,
-                                      const unsigned char *data,
-                                      unsigned int len);
-typedef void (* Curl_MD5_final_func)(unsigned char *result, void *context);
+typedef CURLcode (*Curl_MD5_init_func)(void *context);
+typedef void (*Curl_MD5_update_func)(void *context,
+                                     const unsigned char *data,
+                                     unsigned int len);
+typedef void (*Curl_MD5_final_func)(unsigned char *result, void *context);
 
 struct MD5_params {
-  Curl_MD5_init_func     md5_init_func;   /* Initialize context procedure */
-  Curl_MD5_update_func   md5_update_func; /* Update context with data */
-  Curl_MD5_final_func    md5_final_func;  /* Get final result procedure */
-  unsigned int           md5_ctxtsize;  /* Context structure size */
-  unsigned int           md5_resultlen; /* Result length (bytes) */
+  Curl_MD5_init_func md5_init_func;     /* Initialize context procedure */
+  Curl_MD5_update_func md5_update_func; /* Update context with data */
+  Curl_MD5_final_func md5_final_func;   /* Get final result procedure */
+  unsigned int md5_ctxtsize;            /* Context structure size */
+  unsigned int md5_resultlen;           /* Result length (bytes) */
 };
 
 struct MD5_context {
-  const struct MD5_params *md5_hash;    /* Hash function definition */
-  void                  *md5_hashctx;   /* Hash function context */
+  const struct MD5_params *md5_hash;  /* Hash function definition */
+  void *md5_hashctx;                  /* Hash function context */
 };
 
-extern const struct MD5_params Curl_DIGEST_MD5[1];
-extern const struct HMAC_params Curl_HMAC_MD5[1];
+extern const struct MD5_params Curl_DIGEST_MD5;
+extern const struct HMAC_params Curl_HMAC_MD5;
 
 CURLcode Curl_md5it(unsigned char *output, const unsigned char *input,
-                    const size_t len);
+                    size_t len);
 
 struct MD5_context *Curl_MD5_init(const struct MD5_params *md5params);
 CURLcode Curl_MD5_update(struct MD5_context *context,
-                         const unsigned char *data,
+                         const unsigned char *input,
                          unsigned int len);
 CURLcode Curl_MD5_final(struct MD5_context *context, unsigned char *result);
 
diff --git a/third-party/curl/lib/curl_memory.h b/third-party/curl/lib/curl_memory.h
deleted file mode 100644
index b8c46d7939..0000000000
--- a/third-party/curl/lib/curl_memory.h
+++ /dev/null
@@ -1,178 +0,0 @@
-#ifndef HEADER_CURL_MEMORY_H
-#define HEADER_CURL_MEMORY_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-/*
- * Nasty internal details ahead...
- *
- * File curl_memory.h must be included by _all_ *.c source files
- * that use memory related functions strdup, malloc, calloc, realloc
- * or free, and given source file is used to build libcurl library.
- * It should be included immediately before memdebug.h as the last files
- * included to avoid undesired interaction with other memory function
- * headers in dependent libraries.
- *
- * There is nearly no exception to above rule. All libcurl source
- * files in 'lib' subdirectory as well as those living deep inside
- * 'packages' subdirectories and linked together in order to build
- * libcurl library shall follow it.
- *
- * File lib/strdup.c is an exception, given that it provides a strdup
- * clone implementation while using malloc. Extra care needed inside
- * this one.
- *
- * The need for curl_memory.h inclusion is due to libcurl's feature
- * of allowing library user to provide memory replacement functions,
- * memory callbacks, at runtime with curl_global_init_mem()
- *
- * Any *.c source file used to build libcurl library that does not
- * include curl_memory.h and uses any memory function of the five
- * mentioned above will compile without any indication, but it will
- * trigger weird memory related issues at runtime.
- *
- */
-
-#ifdef HEADER_CURL_MEMDEBUG_H
-/* cleanup after memdebug.h */
-
-#ifdef MEMDEBUG_NODEFINES
-#ifdef CURLDEBUG
-
-#undef strdup
-#undef malloc
-#undef calloc
-#undef realloc
-#undef free
-#undef send
-#undef recv
-
-#ifdef WIN32
-#  ifdef UNICODE
-#    undef wcsdup
-#    undef _wcsdup
-#    undef _tcsdup
-#  else
-#    undef _tcsdup
-#  endif
-#endif
-
-#undef socket
-#undef accept
-#ifdef HAVE_SOCKETPAIR
-#undef socketpair
-#endif
-
-#ifdef HAVE_GETADDRINFO
-#if defined(getaddrinfo) && defined(__osf__)
-#undef ogetaddrinfo
-#else
-#undef getaddrinfo
-#endif
-#endif /* HAVE_GETADDRINFO */
-
-#ifdef HAVE_FREEADDRINFO
-#undef freeaddrinfo
-#endif /* HAVE_FREEADDRINFO */
-
-/* sclose is probably already defined, redefine it! */
-#undef sclose
-#undef fopen
-#undef fdopen
-#undef fclose
-
-#endif /* MEMDEBUG_NODEFINES */
-#endif /* CURLDEBUG */
-
-#undef HEADER_CURL_MEMDEBUG_H
-#endif /* HEADER_CURL_MEMDEBUG_H */
-
-/*
-** Following section applies even when CURLDEBUG is not defined.
-*/
-
-#undef fake_sclose
-
-#ifndef CURL_DID_MEMORY_FUNC_TYPEDEFS /* only if not already done */
-/*
- * The following memory function replacement typedef's are COPIED from
- * curl/curl.h and MUST match the originals. We copy them to avoid having to
- * include curl/curl.h here. We avoid that include since it includes stdio.h
- * and other headers that may get messed up with defines done here.
- */
-typedef void *(*curl_malloc_callback)(size_t size);
-typedef void (*curl_free_callback)(void *ptr);
-typedef void *(*curl_realloc_callback)(void *ptr, size_t size);
-typedef char *(*curl_strdup_callback)(const char *str);
-typedef void *(*curl_calloc_callback)(size_t nmemb, size_t size);
-#define CURL_DID_MEMORY_FUNC_TYPEDEFS
-#endif
-
-extern curl_malloc_callback Curl_cmalloc;
-extern curl_free_callback Curl_cfree;
-extern curl_realloc_callback Curl_crealloc;
-extern curl_strdup_callback Curl_cstrdup;
-extern curl_calloc_callback Curl_ccalloc;
-#if defined(WIN32) && defined(UNICODE)
-extern curl_wcsdup_callback Curl_cwcsdup;
-#endif
-
-#ifndef CURLDEBUG
-
-/*
- * libcurl's 'memory tracking' system defines strdup, malloc, calloc,
- * realloc and free, along with others, in memdebug.h in a different
- * way although still using memory callbacks forward declared above.
- * When using the 'memory tracking' system (CURLDEBUG defined) we do
- * not define here the five memory functions given that definitions
- * from memdebug.h are the ones that shall be used.
- */
-
-#undef strdup
-#define strdup(ptr) Curl_cstrdup(ptr)
-#undef malloc
-#define malloc(size) Curl_cmalloc(size)
-#undef calloc
-#define calloc(nbelem,size) Curl_ccalloc(nbelem, size)
-#undef realloc
-#define realloc(ptr,size) Curl_crealloc(ptr, size)
-#undef free
-#define free(ptr) Curl_cfree(ptr)
-
-#ifdef WIN32
-#  ifdef UNICODE
-#    undef wcsdup
-#    define wcsdup(ptr) Curl_cwcsdup(ptr)
-#    undef _wcsdup
-#    define _wcsdup(ptr) Curl_cwcsdup(ptr)
-#    undef _tcsdup
-#    define _tcsdup(ptr) Curl_cwcsdup(ptr)
-#  else
-#    undef _tcsdup
-#    define _tcsdup(ptr) Curl_cstrdup(ptr)
-#  endif
-#endif
-
-#endif /* CURLDEBUG */
-#endif /* HEADER_CURL_MEMORY_H */
diff --git a/third-party/curl/lib/curl_memrchr.c b/third-party/curl/lib/curl_memrchr.c
index 3f3dc6de16..59ee176bc9 100644
--- a/third-party/curl/lib/curl_memrchr.c
+++ b/third-party/curl/lib/curl_memrchr.c
@@ -21,19 +21,11 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include <curl/curl.h>
-
 #include "curl_memrchr.h"
-#include "curl_memory.h"
-
-/* The last #include file should be: */
-#include "memdebug.h"
 
 #ifndef HAVE_MEMRCHR
-
 /*
  * Curl_memrchr()
  *
@@ -42,9 +34,7 @@
  * backwards from the end of the n bytes pointed to by s instead of forward
  * from the beginning.
  */
-
-void *
-Curl_memrchr(const void *s, int c, size_t n)
+void *Curl_memrchr(const void *s, int c, size_t n)
 {
   if(n > 0) {
     const unsigned char *p = s;
@@ -54,11 +44,10 @@ Curl_memrchr(const void *s, int c, size_t n)
 
     while(p >= q) {
       if(*p == (unsigned char)c)
-        return (void *)p;
+        return CURL_UNCONST(p);
       p--;
     }
   }
   return NULL;
 }
-
 #endif /* HAVE_MEMRCHR */
diff --git a/third-party/curl/lib/curl_memrchr.h b/third-party/curl/lib/curl_memrchr.h
index a1a4ba0927..248368b25c 100644
--- a/third-party/curl/lib/curl_memrchr.h
+++ b/third-party/curl/lib/curl_memrchr.h
@@ -23,23 +23,17 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef HAVE_MEMRCHR
 
-#ifdef HAVE_STRING_H
-#  include <string.h>
-#endif
 #ifdef HAVE_STRINGS_H
 #  include <strings.h>
 #endif
 
 #else /* HAVE_MEMRCHR */
-
 void *Curl_memrchr(const void *s, int c, size_t n);
-
-#define memrchr(x,y,z) Curl_memrchr((x),(y),(z))
+#define memrchr(x, y, z)  Curl_memrchr(x, y, z)
 
 #endif /* HAVE_MEMRCHR */
 
diff --git a/third-party/curl/lib/curl_multibyte.c b/third-party/curl/lib/curl_multibyte.c
deleted file mode 100644
index 522ea34e82..0000000000
--- a/third-party/curl/lib/curl_multibyte.c
+++ /dev/null
@@ -1,179 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-/*
- * This file is 'mem-include-scan' clean, which means memdebug.h and
- * curl_memory.h are purposely not included in this file. See test 1132.
- *
- * The functions in this file are curlx functions which are not tracked by the
- * curl memory tracker memdebug.
- */
-
-#include "curl_setup.h"
-
-#if defined(WIN32)
-
-#include "curl_multibyte.h"
-
-/*
- * MultiByte conversions using Windows kernel32 library.
- */
-
-wchar_t *curlx_convert_UTF8_to_wchar(const char *str_utf8)
-{
-  wchar_t *str_w = NULL;
-
-  if(str_utf8) {
-    int str_w_len = MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS,
-                                        str_utf8, -1, NULL, 0);
-    if(str_w_len > 0) {
-      str_w = malloc(str_w_len * sizeof(wchar_t));
-      if(str_w) {
-        if(MultiByteToWideChar(CP_UTF8, 0, str_utf8, -1, str_w,
-                               str_w_len) == 0) {
-          free(str_w);
-          return NULL;
-        }
-      }
-    }
-  }
-
-  return str_w;
-}
-
-char *curlx_convert_wchar_to_UTF8(const wchar_t *str_w)
-{
-  char *str_utf8 = NULL;
-
-  if(str_w) {
-    int bytes = WideCharToMultiByte(CP_UTF8, 0, str_w, -1,
-                                    NULL, 0, NULL, NULL);
-    if(bytes > 0) {
-      str_utf8 = malloc(bytes);
-      if(str_utf8) {
-        if(WideCharToMultiByte(CP_UTF8, 0, str_w, -1, str_utf8, bytes,
-                               NULL, NULL) == 0) {
-          free(str_utf8);
-          return NULL;
-        }
-      }
-    }
-  }
-
-  return str_utf8;
-}
-
-#endif /* WIN32 */
-
-#if defined(USE_WIN32_LARGE_FILES) || defined(USE_WIN32_SMALL_FILES)
-
-int curlx_win32_open(const char *filename, int oflag, ...)
-{
-  int pmode = 0;
-
-#ifdef _UNICODE
-  int result = -1;
-  wchar_t *filename_w = curlx_convert_UTF8_to_wchar(filename);
-#endif
-
-  va_list param;
-  va_start(param, oflag);
-  if(oflag & O_CREAT)
-    pmode = va_arg(param, int);
-  va_end(param);
-
-#ifdef _UNICODE
-  if(filename_w) {
-    result = _wopen(filename_w, oflag, pmode);
-    curlx_unicodefree(filename_w);
-  }
-  else
-    errno = EINVAL;
-  return result;
-#else
-  return (_open)(filename, oflag, pmode);
-#endif
-}
-
-FILE *curlx_win32_fopen(const char *filename, const char *mode)
-{
-#ifdef _UNICODE
-  FILE *result = NULL;
-  wchar_t *filename_w = curlx_convert_UTF8_to_wchar(filename);
-  wchar_t *mode_w = curlx_convert_UTF8_to_wchar(mode);
-  if(filename_w && mode_w)
-    result = _wfopen(filename_w, mode_w);
-  else
-    errno = EINVAL;
-  curlx_unicodefree(filename_w);
-  curlx_unicodefree(mode_w);
-  return result;
-#else
-  return (fopen)(filename, mode);
-#endif
-}
-
-int curlx_win32_stat(const char *path, struct_stat *buffer)
-{
-#ifdef _UNICODE
-  int result = -1;
-  wchar_t *path_w = curlx_convert_UTF8_to_wchar(path);
-  if(path_w) {
-#if defined(USE_WIN32_SMALL_FILES)
-    result = _wstat(path_w, buffer);
-#else
-    result = _wstati64(path_w, buffer);
-#endif
-    curlx_unicodefree(path_w);
-  }
-  else
-    errno = EINVAL;
-  return result;
-#else
-#if defined(USE_WIN32_SMALL_FILES)
-  return _stat(path, buffer);
-#else
-  return _stati64(path, buffer);
-#endif
-#endif
-}
-
-int curlx_win32_access(const char *path, int mode)
-{
-#if defined(_UNICODE)
-  int result = -1;
-  wchar_t *path_w = curlx_convert_UTF8_to_wchar(path);
-  if(path_w) {
-    result = _waccess(path_w, mode);
-    curlx_unicodefree(path_w);
-  }
-  else
-    errno = EINVAL;
-  return result;
-#else
-  return _access(path, mode);
-#endif
-}
-
-#endif /* USE_WIN32_LARGE_FILES || USE_WIN32_SMALL_FILES */
diff --git a/third-party/curl/lib/curl_multibyte.h b/third-party/curl/lib/curl_multibyte.h
deleted file mode 100644
index ddac1f6382..0000000000
--- a/third-party/curl/lib/curl_multibyte.h
+++ /dev/null
@@ -1,91 +0,0 @@
-#ifndef HEADER_CURL_MULTIBYTE_H
-#define HEADER_CURL_MULTIBYTE_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "curl_setup.h"
-
-#if defined(WIN32)
-
- /*
-  * MultiByte conversions using Windows kernel32 library.
-  */
-
-wchar_t *curlx_convert_UTF8_to_wchar(const char *str_utf8);
-char *curlx_convert_wchar_to_UTF8(const wchar_t *str_w);
-#endif /* WIN32 */
-
-/*
- * Macros curlx_convert_UTF8_to_tchar(), curlx_convert_tchar_to_UTF8()
- * and curlx_unicodefree() main purpose is to minimize the number of
- * preprocessor conditional directives needed by code using these
- * to differentiate UNICODE from non-UNICODE builds.
- *
- * In the case of a non-UNICODE build the tchar strings are char strings that
- * are duplicated via strdup and remain in whatever the passed in encoding is,
- * which is assumed to be UTF-8 but may be other encoding. Therefore the
- * significance of the conversion functions is primarily for UNICODE builds.
- *
- * Allocated memory should be free'd with curlx_unicodefree().
- *
- * Note: Because these are curlx functions their memory usage is not tracked
- * by the curl memory tracker memdebug. You'll notice that curlx function-like
- * macros call free and strdup in parentheses, eg (strdup)(ptr), and that's to
- * ensure that the curl memdebug override macros do not replace them.
- */
-
-#if defined(UNICODE) && defined(WIN32)
-
-#define curlx_convert_UTF8_to_tchar(ptr) curlx_convert_UTF8_to_wchar((ptr))
-#define curlx_convert_tchar_to_UTF8(ptr) curlx_convert_wchar_to_UTF8((ptr))
-
-typedef union {
-  unsigned short       *tchar_ptr;
-  const unsigned short *const_tchar_ptr;
-  unsigned short       *tbyte_ptr;
-  const unsigned short *const_tbyte_ptr;
-} xcharp_u;
-
-#else
-
-#define curlx_convert_UTF8_to_tchar(ptr) (strdup)(ptr)
-#define curlx_convert_tchar_to_UTF8(ptr) (strdup)(ptr)
-
-typedef union {
-  char                *tchar_ptr;
-  const char          *const_tchar_ptr;
-  unsigned char       *tbyte_ptr;
-  const unsigned char *const_tbyte_ptr;
-} xcharp_u;
-
-#endif /* UNICODE && WIN32 */
-
-#define curlx_unicodefree(ptr)                          \
-  do {                                                  \
-    if(ptr) {                                           \
-      (free)(ptr);                                      \
-      (ptr) = NULL;                                     \
-    }                                                   \
-  } while(0)
-
-#endif /* HEADER_CURL_MULTIBYTE_H */
diff --git a/third-party/curl/lib/curl_ntlm_core.c b/third-party/curl/lib/curl_ntlm_core.c
index cc0ed91672..58a446c95d 100644
--- a/third-party/curl/lib/curl_ntlm_core.c
+++ b/third-party/curl/lib/curl_ntlm_core.c
@@ -21,10 +21,9 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#if defined(USE_CURL_NTLM_CORE)
+#ifdef USE_CURL_NTLM_CORE
 
 /*
  * NTLM details:
@@ -38,11 +37,9 @@
    1. USE_OPENSSL
    2. USE_WOLFSSL
    3. USE_GNUTLS
-   4. -
-   5. USE_MBEDTLS
-   6. USE_SECTRANSP
-   7. USE_OS400CRYPTO
-   8. USE_WIN32_CRYPTO
+   4. USE_MBEDTLS
+   5. USE_OS400CRYPTO
+   6. USE_WIN32_CRYPTO
 
    This ensures that:
    - the same SSL branch gets activated throughout this source
@@ -52,65 +49,45 @@
      in NTLM type-3 messages.
  */
 
-#if defined(USE_OPENSSL)
-  #include <openssl/opensslconf.h>
-  #if !defined(OPENSSL_NO_DES) && !defined(OPENSSL_NO_DEPRECATED_3_0)
-    #define USE_OPENSSL_DES
-  #endif
+#ifdef USE_GNUTLS
+#include <nettle/version.h>
+#if NETTLE_VERSION_MAJOR < 4
+#define USE_GNUTLS_DES
+#endif
 #endif
 
-#if defined(USE_OPENSSL_DES) || defined(USE_WOLFSSL)
+#if defined(USE_OPENSSL) && defined(HAVE_DES_ECB_ENCRYPT)
 
-#if defined(USE_OPENSSL)
 #  include <openssl/des.h>
-#  include <openssl/md5.h>
-#  include <openssl/ssl.h>
-#  include <openssl/rand.h>
-#else
-#  include <wolfssl/options.h>
-#  include <wolfssl/openssl/des.h>
-#  include <wolfssl/openssl/md5.h>
-#  include <wolfssl/openssl/ssl.h>
-#  include <wolfssl/openssl/rand.h>
-#endif
-
-#  if (defined(OPENSSL_VERSION_NUMBER) && \
-       (OPENSSL_VERSION_NUMBER < 0x00907001L)) && !defined(USE_WOLFSSL)
-#    define DES_key_schedule des_key_schedule
-#    define DES_cblock des_cblock
-#    define DES_set_odd_parity des_set_odd_parity
-#    define DES_set_key des_set_key
-#    define DES_ecb_encrypt des_ecb_encrypt
-#    define DESKEY(x) x
-#    define DESKEYARG(x) x
-#  elif defined(OPENSSL_IS_AWSLC)
+#  ifdef OPENSSL_IS_AWSLC  /* for versions 1.2.0 to 1.30.1 */
 #    define DES_set_key_unchecked (void)DES_set_key
-#    define DESKEYARG(x) *x
-#    define DESKEY(x) &x
-#  else
-#    define DESKEYARG(x) *x
-#    define DESKEY(x) &x
 #  endif
+#  define USE_OPENSSL_DES
 
-#elif defined(USE_GNUTLS)
+#elif defined(USE_WOLFSSL) && defined(HAVE_WC_DES_ECBENCRYPT)
 
+#  include <wolfssl/options.h>
+#  include <wolfssl/wolfcrypt/des3.h>
+#  define USE_WOLFSSL_DES
+
+#elif defined(USE_GNUTLS_DES)
 #  include <nettle/des.h>
-
-#elif defined(USE_MBEDTLS)
-
+#  define USE_CURL_DES_SET_ODD_PARITY
+#elif defined(USE_MBEDTLS) && defined(HAVE_MBEDTLS_DES_CRYPT_ECB)
+#  include <mbedtls/version.h>
+#  if MBEDTLS_VERSION_NUMBER < 0x03020000
+#  error "mbedTLS 3.2.0 or later required"
+#  endif
 #  include <mbedtls/des.h>
-
-#elif defined(USE_SECTRANSP)
-
-#  include <CommonCrypto/CommonCryptor.h>
-#  include <CommonCrypto/CommonDigest.h>
-
+#  define USE_MBEDTLS_DES
 #elif defined(USE_OS400CRYPTO)
 #  include "cipher.mih"  /* mih/cipher */
+#  define USE_CURL_DES_SET_ODD_PARITY
 #elif defined(USE_WIN32_CRYPTO)
 #  include <wincrypt.h>
+#  define USE_CURL_DES_SET_ODD_PARITY
 #else
-#  error "Can't compile NTLM support without a crypto library with DES."
+#  error "cannot compile NTLM support without a crypto library with DES."
 #endif
 
 #include "urldata.h"
@@ -118,45 +95,73 @@
 #include "curl_ntlm_core.h"
 #include "curl_md5.h"
 #include "curl_hmac.h"
-#include "warnless.h"
-#include "curl_endian.h"
-#include "curl_des.h"
 #include "curl_md4.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "vauth/vauth.h"
 
-#define NTLMv2_BLOB_SIGNATURE "\x01\x01\x00\x00"
-#define NTLMv2_BLOB_LEN       (44 -16 + ntlm->target_info_len + 4)
+#ifdef USE_CURL_DES_SET_ODD_PARITY
+/*
+ * curl_des_set_odd_parity()
+ *
+ * Copyright (C) Steve Holme, <steve_holme@hotmail.com>
+ *
+ * This is used to apply odd parity to the given byte array. It is typically
+ * used by when a cryptography engine does not have its own version.
+ *
+ * The function is a port of the Java based oddParity() function over at:
+ *
+ * https://davenport.sourceforge.net/ntlm.html
+ *
+ * Parameters:
+ *
+ * bytes       [in/out] - The data whose parity bits are to be adjusted for
+ *                        odd parity.
+ * len         [in]     - The length of the data.
+ */
+static void curl_des_set_odd_parity(unsigned char *bytes, size_t len)
+{
+  size_t i;
+
+  for(i = 0; i < len; i++) {
+    unsigned char b = bytes[i];
+
+    bool needs_parity = (((b >> 7) ^ (b >> 6) ^ (b >> 5) ^
+                          (b >> 4) ^ (b >> 3) ^ (b >> 2) ^
+                          (b >> 1)) & 0x01) == 0;
+
+    if(needs_parity)
+      bytes[i] |= 0x01;
+    else
+      bytes[i] &= 0xfe;
+  }
+}
+#endif /* USE_CURL_DES_SET_ODD_PARITY */
 
 /*
-* Turns a 56-bit key into being 64-bit wide.
-*/
+ * Turns a 56-bit key into being 64-bit wide.
+ */
 static void extend_key_56_to_64(const unsigned char *key_56, char *key)
 {
-  key[0] = key_56[0];
-  key[1] = (unsigned char)(((key_56[0] << 7) & 0xFF) | (key_56[1] >> 1));
-  key[2] = (unsigned char)(((key_56[1] << 6) & 0xFF) | (key_56[2] >> 2));
-  key[3] = (unsigned char)(((key_56[2] << 5) & 0xFF) | (key_56[3] >> 3));
-  key[4] = (unsigned char)(((key_56[3] << 4) & 0xFF) | (key_56[4] >> 4));
-  key[5] = (unsigned char)(((key_56[4] << 3) & 0xFF) | (key_56[5] >> 5));
-  key[6] = (unsigned char)(((key_56[5] << 2) & 0xFF) | (key_56[6] >> 6));
-  key[7] = (unsigned char) ((key_56[6] << 1) & 0xFF);
+  key[0] = (char)key_56[0];
+  key[1] = (char)(((key_56[0] << 7) & 0xFF) | (key_56[1] >> 1));
+  key[2] = (char)(((key_56[1] << 6) & 0xFF) | (key_56[2] >> 2));
+  key[3] = (char)(((key_56[2] << 5) & 0xFF) | (key_56[3] >> 3));
+  key[4] = (char)(((key_56[3] << 4) & 0xFF) | (key_56[4] >> 4));
+  key[5] = (char)(((key_56[4] << 3) & 0xFF) | (key_56[5] >> 5));
+  key[6] = (char)(((key_56[5] << 2) & 0xFF) | (key_56[6] >> 6));
+  key[7] = (char)((key_56[6] << 1) & 0xFF);
 }
 
-#if defined(USE_OPENSSL_DES) || defined(USE_WOLFSSL)
+#ifdef USE_OPENSSL_DES
 /*
- * Turns a 56 bit key into the 64 bit, odd parity key and sets the key.  The
+ * Turns a 56-bit key into a 64-bit, odd parity key and sets the key. The
  * key schedule ks is also set.
  */
-static void setup_des_key(const unsigned char *key_56,
-                          DES_key_schedule DESKEYARG(ks))
+static void setup_des_key(const unsigned char *key_56, DES_key_schedule *ks)
 {
   DES_cblock key;
 
-  /* Expand the 56-bit key to 64-bits */
-  extend_key_56_to_64(key_56, (char *) &key);
+  /* Expand the 56-bit key to 64 bits */
+  extend_key_56_to_64(key_56, (char *)&key);
 
   /* Set the key parity to odd */
   DES_set_odd_parity(&key);
@@ -165,68 +170,53 @@ static void setup_des_key(const unsigned char *key_56,
   DES_set_key_unchecked(&key, ks);
 }
 
-#elif defined(USE_GNUTLS)
+#elif defined(USE_WOLFSSL_DES)
+static void setup_des_key(const unsigned char *key_56, Des *des)
+{
+  byte key[8];
 
-static void setup_des_key(const unsigned char *key_56,
-                          struct des_ctx *des)
+  /* Expand the 56-bit key to 64 bits */
+  extend_key_56_to_64(key_56, (char *)key);
+
+  /* Set the key */
+  wc_Des_SetKey(des, key, NULL, 0);
+}
+
+#elif defined(USE_GNUTLS_DES)
+static void setup_des_key(const unsigned char *key_56, struct des_ctx *des)
 {
   char key[8];
 
-  /* Expand the 56-bit key to 64-bits */
+  /* Expand the 56-bit key to 64 bits */
   extend_key_56_to_64(key_56, key);
 
   /* Set the key parity to odd */
-  Curl_des_set_odd_parity((unsigned char *) key, sizeof(key));
+  curl_des_set_odd_parity((unsigned char *)key, sizeof(key));
 
   /* Set the key */
-  des_set_key(des, (const uint8_t *) key);
+  des_set_key(des, (const uint8_t *)key);
 }
 
-#elif defined(USE_MBEDTLS)
-
+#elif defined(USE_MBEDTLS_DES)
 static bool encrypt_des(const unsigned char *in, unsigned char *out,
                         const unsigned char *key_56)
 {
   mbedtls_des_context ctx;
   char key[8];
 
-  /* Expand the 56-bit key to 64-bits */
+  /* Expand the 56-bit key to 64 bits */
   extend_key_56_to_64(key_56, key);
 
   /* Set the key parity to odd */
-  mbedtls_des_key_set_parity((unsigned char *) key);
+  mbedtls_des_key_set_parity((unsigned char *)key);
 
   /* Perform the encryption */
   mbedtls_des_init(&ctx);
-  mbedtls_des_setkey_enc(&ctx, (unsigned char *) key);
+  mbedtls_des_setkey_enc(&ctx, (unsigned char *)key);
   return mbedtls_des_crypt_ecb(&ctx, in, out) == 0;
 }
 
-#elif defined(USE_SECTRANSP)
-
-static bool encrypt_des(const unsigned char *in, unsigned char *out,
-                        const unsigned char *key_56)
-{
-  char key[8];
-  size_t out_len;
-  CCCryptorStatus err;
-
-  /* Expand the 56-bit key to 64-bits */
-  extend_key_56_to_64(key_56, key);
-
-  /* Set the key parity to odd */
-  Curl_des_set_odd_parity((unsigned char *) key, sizeof(key));
-
-  /* Perform the encryption */
-  err = CCCrypt(kCCEncrypt, kCCAlgorithmDES, kCCOptionECBMode, key,
-                kCCKeySizeDES, NULL, in, 8 /* inbuflen */, out,
-                8 /* outbuflen */, &out_len);
-
-  return err == kCCSuccess;
-}
-
 #elif defined(USE_OS400CRYPTO)
-
 static bool encrypt_des(const unsigned char *in, unsigned char *out,
                         const unsigned char *key_56)
 {
@@ -237,20 +227,19 @@ static bool encrypt_des(const unsigned char *in, unsigned char *out,
   ctl.Func_ID = ENCRYPT_ONLY;
   ctl.Data_Len = sizeof(key);
 
-  /* Expand the 56-bit key to 64-bits */
+  /* Expand the 56-bit key to 64 bits */
   extend_key_56_to_64(key_56, ctl.Crypto_Key);
 
   /* Set the key parity to odd */
-  Curl_des_set_odd_parity((unsigned char *) ctl.Crypto_Key, ctl.Data_Len);
+  curl_des_set_odd_parity((unsigned char *)ctl.Crypto_Key, ctl.Data_Len);
 
   /* Perform the encryption */
-  _CIPHER((_SPCPTR *) &out, &ctl, (_SPCPTR *) &in);
+  _CIPHER((_SPCPTR *)&out, &ctl, (_SPCPTR *)&in);
 
   return TRUE;
 }
 
 #elif defined(USE_WIN32_CRYPTO)
-
 static bool encrypt_des(const unsigned char *in, unsigned char *out,
                         const unsigned char *key_56)
 {
@@ -262,6 +251,7 @@ static bool encrypt_des(const unsigned char *in, unsigned char *out,
     char key[8];
   } blob;
   DWORD len = 8;
+  BOOL res;
 
   /* Acquire the crypto provider */
   if(!CryptAcquireContext(&hprov, NULL, NULL, PROV_RSA_FULL,
@@ -275,14 +265,14 @@ static bool encrypt_des(const unsigned char *in, unsigned char *out,
   blob.hdr.aiKeyAlg = CALG_DES;
   blob.len = sizeof(blob.key);
 
-  /* Expand the 56-bit key to 64-bits */
+  /* Expand the 56-bit key to 64 bits */
   extend_key_56_to_64(key_56, blob.key);
 
   /* Set the key parity to odd */
-  Curl_des_set_odd_parity((unsigned char *) blob.key, sizeof(blob.key));
+  curl_des_set_odd_parity((unsigned char *)blob.key, sizeof(blob.key));
 
   /* Import the key */
-  if(!CryptImportKey(hprov, (BYTE *) &blob, sizeof(blob), 0, 0, &hkey)) {
+  if(!CryptImportKey(hprov, (BYTE *)&blob, sizeof(blob), 0, 0, &hkey)) {
     CryptReleaseContext(hprov, 0);
 
     return FALSE;
@@ -291,40 +281,48 @@ static bool encrypt_des(const unsigned char *in, unsigned char *out,
   memcpy(out, in, 8);
 
   /* Perform the encryption */
-  CryptEncrypt(hkey, 0, FALSE, 0, out, &len, len);
+  res = CryptEncrypt(hkey, 0, FALSE, 0, out, &len, len);
 
   CryptDestroyKey(hkey);
   CryptReleaseContext(hprov, 0);
 
-  return TRUE;
+  return res;
 }
 
-#endif /* defined(USE_WIN32_CRYPTO) */
+#endif /* crypto backends */
 
- /*
-  * takes a 21 byte array and treats it as 3 56-bit DES keys. The
-  * 8 byte plaintext is encrypted with each key and the resulting 24
-  * bytes are stored in the results array.
-  */
+/*
+ * takes a 21-byte array and treats it as 3 56-bit DES keys. The
+ * 8-byte plaintext is encrypted with each key and the resulting 24
+ * bytes are stored in the results array.
+ */
 void Curl_ntlm_core_lm_resp(const unsigned char *keys,
                             const unsigned char *plaintext,
                             unsigned char *results)
 {
-#if defined(USE_OPENSSL_DES) || defined(USE_WOLFSSL)
+#ifdef USE_OPENSSL_DES
   DES_key_schedule ks;
 
-  setup_des_key(keys, DESKEY(ks));
-  DES_ecb_encrypt((DES_cblock*) plaintext, (DES_cblock*) results,
-                  DESKEY(ks), DES_ENCRYPT);
+  setup_des_key(keys, &ks);
+  DES_ecb_encrypt((DES_cblock *)CURL_UNCONST(plaintext),
+                  (DES_cblock *)results, &ks, DES_ENCRYPT);
 
-  setup_des_key(keys + 7, DESKEY(ks));
-  DES_ecb_encrypt((DES_cblock*) plaintext, (DES_cblock*) (results + 8),
-                  DESKEY(ks), DES_ENCRYPT);
+  setup_des_key(keys + 7, &ks);
+  DES_ecb_encrypt((DES_cblock *)CURL_UNCONST(plaintext),
+                  (DES_cblock *)(results + 8), &ks, DES_ENCRYPT);
 
-  setup_des_key(keys + 14, DESKEY(ks));
-  DES_ecb_encrypt((DES_cblock*) plaintext, (DES_cblock*) (results + 16),
-                  DESKEY(ks), DES_ENCRYPT);
-#elif defined(USE_GNUTLS)
+  setup_des_key(keys + 14, &ks);
+  DES_ecb_encrypt((DES_cblock *)CURL_UNCONST(plaintext),
+                  (DES_cblock *)(results + 16), &ks, DES_ENCRYPT);
+#elif defined(USE_WOLFSSL_DES)
+  Des des;
+  setup_des_key(keys, &des);
+  wc_Des_EcbEncrypt(&des, results, plaintext, DES_KEY_SIZE);
+  setup_des_key(keys + 7, &des);
+  wc_Des_EcbEncrypt(&des, results + 8, plaintext, DES_KEY_SIZE);
+  setup_des_key(keys + 14, &des);
+  wc_Des_EcbEncrypt(&des, results + 16, plaintext, DES_KEY_SIZE);
+#elif defined(USE_GNUTLS_DES)
   struct des_ctx des;
   setup_des_key(keys, &des);
   des_encrypt(&des, 8, results, plaintext);
@@ -332,11 +330,15 @@ void Curl_ntlm_core_lm_resp(const unsigned char *keys,
   des_encrypt(&des, 8, results + 8, plaintext);
   setup_des_key(keys + 14, &des);
   des_encrypt(&des, 8, results + 16, plaintext);
-#elif defined(USE_MBEDTLS) || defined(USE_SECTRANSP)            \
-  || defined(USE_OS400CRYPTO) || defined(USE_WIN32_CRYPTO)
+#elif defined(USE_MBEDTLS_DES) || defined(USE_OS400CRYPTO) || \
+  defined(USE_WIN32_CRYPTO)
   encrypt_des(plaintext, results, keys);
   encrypt_des(plaintext, results + 8, keys + 7);
   encrypt_des(plaintext, results + 16, keys + 14);
+#else
+  (void)keys;
+  (void)plaintext;
+  (void)results;
 #endif
 }
 
@@ -357,25 +359,30 @@ CURLcode Curl_ntlm_core_mk_lm_hash(const char *password,
 
   {
     /* Create LanManager hashed password. */
-
-#if defined(USE_OPENSSL_DES) || defined(USE_WOLFSSL)
+#ifdef USE_OPENSSL_DES
     DES_key_schedule ks;
 
-    setup_des_key(pw, DESKEY(ks));
-    DES_ecb_encrypt((DES_cblock *)magic, (DES_cblock *)lmbuffer,
-                    DESKEY(ks), DES_ENCRYPT);
+    setup_des_key(pw, &ks);
+    DES_ecb_encrypt((DES_cblock *)CURL_UNCONST(magic),
+                    (DES_cblock *)lmbuffer, &ks, DES_ENCRYPT);
 
-    setup_des_key(pw + 7, DESKEY(ks));
-    DES_ecb_encrypt((DES_cblock *)magic, (DES_cblock *)(lmbuffer + 8),
-                    DESKEY(ks), DES_ENCRYPT);
-#elif defined(USE_GNUTLS)
+    setup_des_key(pw + 7, &ks);
+    DES_ecb_encrypt((DES_cblock *)CURL_UNCONST(magic),
+                    (DES_cblock *)(lmbuffer + 8), &ks, DES_ENCRYPT);
+#elif defined(USE_WOLFSSL_DES)
+    Des des;
+    setup_des_key(pw, &des);
+    wc_Des_EcbEncrypt(&des, lmbuffer, magic, DES_KEY_SIZE);
+    setup_des_key(pw + 7, &des);
+    wc_Des_EcbEncrypt(&des, lmbuffer + 8, magic, DES_KEY_SIZE);
+#elif defined(USE_GNUTLS_DES)
     struct des_ctx des;
     setup_des_key(pw, &des);
     des_encrypt(&des, 8, lmbuffer, magic);
     setup_des_key(pw + 7, &des);
     des_encrypt(&des, 8, lmbuffer + 8, magic);
-#elif defined(USE_MBEDTLS) || defined(USE_SECTRANSP)            \
-  || defined(USE_OS400CRYPTO) || defined(USE_WIN32_CRYPTO)
+#elif defined(USE_MBEDTLS_DES) || defined(USE_OS400CRYPTO) || \
+  defined(USE_WIN32_CRYPTO)
     encrypt_des(magic, lmbuffer, pw);
     encrypt_des(magic, lmbuffer + 8, pw + 7);
 #endif
@@ -392,24 +399,10 @@ static void ascii_to_unicode_le(unsigned char *dest, const char *src,
   size_t i;
   for(i = 0; i < srclen; i++) {
     dest[2 * i] = (unsigned char)src[i];
-    dest[2 * i + 1] = '\0';
+    dest[(2 * i) + 1] = '\0';
   }
 }
 
-#if !defined(USE_WINDOWS_SSPI)
-
-static void ascii_uppercase_to_unicode_le(unsigned char *dest,
-                                          const char *src, size_t srclen)
-{
-  size_t i;
-  for(i = 0; i < srclen; i++) {
-    dest[2 * i] = (unsigned char)(Curl_raw_toupper(src[i]));
-    dest[2 * i + 1] = '\0';
-  }
-}
-
-#endif /* !USE_WINDOWS_SSPI */
-
 /*
  * Set up nt hashed passwords
  * @unittest: 1600
@@ -420,9 +413,9 @@ CURLcode Curl_ntlm_core_mk_nt_hash(const char *password,
   size_t len = strlen(password);
   unsigned char *pw;
   CURLcode result;
-  if(len > SIZE_T_MAX/2) /* avoid integer overflow */
+  if(len > SIZE_MAX / 2) /* avoid integer overflow */
     return CURLE_OUT_OF_MEMORY;
-  pw = len ? malloc(len * 2) : (unsigned char *)strdup("");
+  pw = len ? curlx_malloc(len * 2) : (unsigned char *)curlx_strdup("");
   if(!pw)
     return CURLE_OUT_OF_MEMORY;
 
@@ -433,12 +426,15 @@ CURLcode Curl_ntlm_core_mk_nt_hash(const char *password,
   if(!result)
     memset(ntbuffer + 16, 0, 21 - 16);
 
-  free(pw);
+  curlx_free(pw);
 
   return result;
 }
 
-#if !defined(USE_WINDOWS_SSPI)
+#ifndef USE_WINDOWS_SSPI
+
+#define NTLMv2_BLOB_SIGNATURE "\x01\x01\x00\x00"
+#define NTLMv2_BLOB_LEN       (44 - 16 + ntlm->target_info_len + 4)
 
 /* Timestamp in tenths of a microsecond since January 1, 1601 00:00:00 UTC. */
 struct ms_filetime {
@@ -450,27 +446,27 @@ struct ms_filetime {
 static void time2filetime(struct ms_filetime *ft, time_t t)
 {
 #if SIZEOF_TIME_T > 4
-  t = (t + CURL_OFF_T_C(11644473600)) * 10000000;
-  ft->dwLowDateTime = (unsigned int) (t & 0xFFFFFFFF);
-  ft->dwHighDateTime = (unsigned int) (t >> 32);
+  t = (t + (curl_off_t)11644473600) * 10000000;
+  ft->dwLowDateTime = (unsigned int)(t & 0xFFFFFFFF);
+  ft->dwHighDateTime = (unsigned int)(t >> 32);
 #else
   unsigned int r, s;
   unsigned int i;
 
-  ft->dwLowDateTime = t & 0xFFFFFFFF;
+  ft->dwLowDateTime = (unsigned int)(t & 0xFFFFFFFF);
   ft->dwHighDateTime = 0;
 
-# ifndef HAVE_TIME_T_UNSIGNED
+#ifndef HAVE_TIME_T_UNSIGNED
   /* Extend sign if needed. */
   if(ft->dwLowDateTime & 0x80000000)
-    ft->dwHighDateTime = ~0;
-# endif
+    ft->dwHighDateTime = ~(unsigned int)0;
+#endif
 
   /* Bias seconds to Jan 1, 1601.
      134774 days = 11644473600 seconds = 0x2B6109100 */
   r = ft->dwLowDateTime;
   ft->dwLowDateTime = (ft->dwLowDateTime + 0xB6109100U) & 0xFFFFFFFF;
-  ft->dwHighDateTime += ft->dwLowDateTime < r? 0x03: 0x02;
+  ft->dwHighDateTime += ft->dwLowDateTime < r ? 0x03 : 0x02;
 
   /* Convert to tenths of microseconds. */
   ft->dwHighDateTime *= 10000000;
@@ -490,6 +486,16 @@ static void time2filetime(struct ms_filetime *ft, time_t t)
 #endif
 }
 
+static void ascii_uppercase_to_unicode_le(unsigned char *dest,
+                                          const char *src, size_t srclen)
+{
+  size_t i;
+  for(i = 0; i < srclen; i++) {
+    dest[2 * i] = (unsigned char)(Curl_raw_toupper(src[i]));
+    dest[(2 * i) + 1] = '\0';
+  }
+}
+
 /* This creates the NTLMv2 hash by using NTLM hash as the key and Unicode
  * (uppercase UserName + Domain) as the data
  */
@@ -507,7 +513,7 @@ CURLcode Curl_ntlm_core_mk_ntlmv2_hash(const char *user, size_t userlen,
     return CURLE_OUT_OF_MEMORY;
 
   identity_len = (userlen + domlen) * 2;
-  identity = malloc(identity_len + 1);
+  identity = curlx_malloc(identity_len + 1);
 
   if(!identity)
     return CURLE_OUT_OF_MEMORY;
@@ -515,9 +521,9 @@ CURLcode Curl_ntlm_core_mk_ntlmv2_hash(const char *user, size_t userlen,
   ascii_uppercase_to_unicode_le(identity, user, userlen);
   ascii_to_unicode_le(identity + (userlen << 1), domain, domlen);
 
-  result = Curl_hmacit(Curl_HMAC_MD5, ntlmhash, 16, identity, identity_len,
+  result = Curl_hmacit(&Curl_HMAC_MD5, ntlmhash, 16, identity, identity_len,
                        ntlmv2hash);
-  free(identity);
+  curlx_free(identity);
 
   return result;
 }
@@ -525,13 +531,13 @@ CURLcode Curl_ntlm_core_mk_ntlmv2_hash(const char *user, size_t userlen,
 /*
  * Curl_ntlm_core_mk_ntlmv2_resp()
  *
- * This creates the NTLMv2 response as set in the ntlm type-3 message.
+ * This creates the NTLMv2 response as set in the NTLM type-3 message.
  *
  * Parameters:
  *
- * ntlmv2hash       [in] - The ntlmv2 hash (16 bytes)
+ * ntlmv2hash       [in] - The NTLMv2 hash (16 bytes)
  * challenge_client [in] - The client nonce (8 bytes)
- * ntlm             [in] - The ntlm data struct being used to read TargetInfo
+ * ntlm             [in] - The NTLM data struct being used to read TargetInfo
                            and Server challenge received in the type-2 message
  * ntresp          [out] - The address where a pointer to newly allocated
  *                         memory holding the NTLMv2 response.
@@ -539,26 +545,26 @@ CURLcode Curl_ntlm_core_mk_ntlmv2_hash(const char *user, size_t userlen,
  *
  * Returns CURLE_OK on success.
  */
-CURLcode Curl_ntlm_core_mk_ntlmv2_resp(unsigned char *ntlmv2hash,
-                                       unsigned char *challenge_client,
-                                       struct ntlmdata *ntlm,
+CURLcode Curl_ntlm_core_mk_ntlmv2_resp(const unsigned char *ntlmv2hash,
+                                       const unsigned char *challenge_client,
+                                       const struct ntlmdata *ntlm,
                                        unsigned char **ntresp,
                                        unsigned int *ntresp_len)
 {
-/* NTLMv2 response structure :
-------------------------------------------------------------------------------
-0     HMAC MD5         16 bytes
-------BLOB--------------------------------------------------------------------
-16    Signature        0x01010000
-20    Reserved         long (0x00000000)
-24    Timestamp        LE, 64-bit signed value representing the number of
-                       tenths of a microsecond since January 1, 1601.
-32    Client Nonce     8 bytes
-40    Unknown          4 bytes
-44    Target Info      N bytes (from the type-2 message)
-44+N  Unknown          4 bytes
-------------------------------------------------------------------------------
-*/
+  /* NTLMv2 response structure :
+  -----------------------------------------------------------------------------
+  0     HMAC MD5         16 bytes
+  ------BLOB-------------------------------------------------------------------
+  16    Signature        0x01010000
+  20    Reserved         long (0x00000000)
+  24    Timestamp        LE, 64-bit signed value representing the number of
+                         tenths of a microsecond since January 1, 1601.
+  32    Client Nonce     8 bytes
+  40    Unknown          4 bytes
+  44    Target Info      N bytes (from the type-2 message)
+  44+N  Unknown          4 bytes
+  -----------------------------------------------------------------------------
+  */
 
   unsigned int len = 0;
   unsigned char *ptr = NULL;
@@ -571,7 +577,7 @@ CURLcode Curl_ntlm_core_mk_ntlmv2_resp(unsigned char *ntlmv2hash,
 #ifdef DEBUGBUILD
   char *force_timestamp = getenv("CURL_FORCETIME");
   if(force_timestamp)
-    time2filetime(&tw, (time_t) 0);
+    time2filetime(&tw, (time_t)0);
   else
 #endif
     time2filetime(&tw, time(NULL));
@@ -580,19 +586,20 @@ CURLcode Curl_ntlm_core_mk_ntlmv2_resp(unsigned char *ntlmv2hash,
   len = HMAC_MD5_LENGTH + NTLMv2_BLOB_LEN;
 
   /* Allocate the response */
-  ptr = calloc(1, len);
+  ptr = curlx_calloc(1, len);
   if(!ptr)
     return CURLE_OUT_OF_MEMORY;
 
   /* Create the BLOB structure */
-  msnprintf((char *)ptr + HMAC_MD5_LENGTH, NTLMv2_BLOB_LEN,
-            "%c%c%c%c"           /* NTLMv2_BLOB_SIGNATURE */
-            "%c%c%c%c"           /* Reserved = 0 */
-            "%c%c%c%c%c%c%c%c",  /* Timestamp */
-            NTLMv2_BLOB_SIGNATURE[0], NTLMv2_BLOB_SIGNATURE[1],
-            NTLMv2_BLOB_SIGNATURE[2], NTLMv2_BLOB_SIGNATURE[3],
-            0, 0, 0, 0,
-            LONGQUARTET(tw.dwLowDateTime), LONGQUARTET(tw.dwHighDateTime));
+  curl_msnprintf((char *)ptr + HMAC_MD5_LENGTH, NTLMv2_BLOB_LEN,
+                 "%c%c%c%c"           /* NTLMv2_BLOB_SIGNATURE */
+                 "%c%c%c%c"           /* Reserved = 0 */
+                 "%c%c%c%c%c%c%c%c",  /* Timestamp */
+                 NTLMv2_BLOB_SIGNATURE[0], NTLMv2_BLOB_SIGNATURE[1],
+                 NTLMv2_BLOB_SIGNATURE[2], NTLMv2_BLOB_SIGNATURE[3],
+                 0, 0, 0, 0,
+                 LONGQUARTET(tw.dwLowDateTime),
+                 LONGQUARTET(tw.dwHighDateTime));
 
   memcpy(ptr + 32, challenge_client, 8);
   if(ntlm->target_info_len)
@@ -600,10 +607,10 @@ CURLcode Curl_ntlm_core_mk_ntlmv2_resp(unsigned char *ntlmv2hash,
 
   /* Concatenate the Type 2 challenge with the BLOB and do HMAC MD5 */
   memcpy(ptr + 8, &ntlm->nonce[0], 8);
-  result = Curl_hmacit(Curl_HMAC_MD5, ntlmv2hash, HMAC_MD5_LENGTH, ptr + 8,
-                    NTLMv2_BLOB_LEN + 8, hmac_output);
+  result = Curl_hmacit(&Curl_HMAC_MD5, ntlmv2hash, HMAC_MD5_LENGTH, ptr + 8,
+                       NTLMv2_BLOB_LEN + 8, hmac_output);
   if(result) {
-    free(ptr);
+    curlx_free(ptr);
     return result;
   }
 
@@ -620,21 +627,21 @@ CURLcode Curl_ntlm_core_mk_ntlmv2_resp(unsigned char *ntlmv2hash,
 /*
  * Curl_ntlm_core_mk_lmv2_resp()
  *
- * This creates the LMv2 response as used in the ntlm type-3 message.
+ * This creates the LMv2 response as used in the NTLM type-3 message.
  *
  * Parameters:
  *
- * ntlmv2hash        [in] - The ntlmv2 hash (16 bytes)
+ * ntlmv2hash        [in] - The NTLMv2 hash (16 bytes)
  * challenge_client  [in] - The client nonce (8 bytes)
- * challenge_client  [in] - The server challenge (8 bytes)
+ * challenge_server  [in] - The server challenge (8 bytes)
  * lmresp           [out] - The LMv2 response (24 bytes)
  *
  * Returns CURLE_OK on success.
  */
-CURLcode  Curl_ntlm_core_mk_lmv2_resp(unsigned char *ntlmv2hash,
-                                      unsigned char *challenge_client,
-                                      unsigned char *challenge_server,
-                                      unsigned char *lmresp)
+CURLcode Curl_ntlm_core_mk_lmv2_resp(const unsigned char *ntlmv2hash,
+                                     const unsigned char *challenge_client,
+                                     const unsigned char *challenge_server,
+                                     unsigned char *lmresp)
 {
   unsigned char data[16];
   unsigned char hmac_output[16];
@@ -643,12 +650,12 @@ CURLcode  Curl_ntlm_core_mk_lmv2_resp(unsigned char *ntlmv2hash,
   memcpy(&data[0], challenge_server, 8);
   memcpy(&data[8], challenge_client, 8);
 
-  result = Curl_hmacit(Curl_HMAC_MD5, ntlmv2hash, 16, &data[0], 16,
+  result = Curl_hmacit(&Curl_HMAC_MD5, ntlmv2hash, 16, &data[0], 16,
                        hmac_output);
   if(result)
     return result;
 
-  /* Concatenate the HMAC MD5 output  with the client nonce */
+  /* Concatenate the HMAC MD5 output with the client nonce */
   memcpy(lmresp, hmac_output, 16);
   memcpy(lmresp + 16, challenge_client, 8);
 
diff --git a/third-party/curl/lib/curl_ntlm_core.h b/third-party/curl/lib/curl_ntlm_core.h
index 0c62ee052a..df24158f8e 100644
--- a/third-party/curl/lib/curl_ntlm_core.h
+++ b/third-party/curl/lib/curl_ntlm_core.h
@@ -23,20 +23,14 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#if defined(USE_CURL_NTLM_CORE)
+#ifdef USE_CURL_NTLM_CORE
 
-#if defined(USE_OPENSSL)
-#  include <openssl/ssl.h>
-#elif defined(USE_WOLFSSL)
-#  include <wolfssl/options.h>
-#  include <wolfssl/openssl/ssl.h>
-#endif
+struct ntlmdata;
 
 /* Helpers to generate function byte arguments in little endian order */
-#define SHORTPAIR(x) ((int)((x) & 0xff)), ((int)(((x) >> 8) & 0xff))
+#define SHORTPAIR(x)   ((int)((x) & 0xff)), ((int)(((x) >> 8) & 0xff))
 #define LONGQUARTET(x) ((int)((x) & 0xff)), ((int)(((x) >> 8) & 0xff)), \
   ((int)(((x) >> 16) & 0xff)), ((int)(((x) >> 24) & 0xff))
 
@@ -50,7 +44,7 @@ CURLcode Curl_ntlm_core_mk_lm_hash(const char *password,
 CURLcode Curl_ntlm_core_mk_nt_hash(const char *password,
                                    unsigned char *ntbuffer /* 21 bytes */);
 
-#if !defined(USE_WINDOWS_SSPI)
+#ifndef USE_WINDOWS_SSPI
 
 CURLcode Curl_hmac_md5(const unsigned char *key, unsigned int keylen,
                        const unsigned char *data, unsigned int datalen,
@@ -61,16 +55,16 @@ CURLcode Curl_ntlm_core_mk_ntlmv2_hash(const char *user, size_t userlen,
                                        unsigned char *ntlmhash,
                                        unsigned char *ntlmv2hash);
 
-CURLcode  Curl_ntlm_core_mk_ntlmv2_resp(unsigned char *ntlmv2hash,
-                                        unsigned char *challenge_client,
-                                        struct ntlmdata *ntlm,
-                                        unsigned char **ntresp,
-                                        unsigned int *ntresp_len);
+CURLcode Curl_ntlm_core_mk_ntlmv2_resp(const unsigned char *ntlmv2hash,
+                                       const unsigned char *challenge_client,
+                                       const struct ntlmdata *ntlm,
+                                       unsigned char **ntresp,
+                                       unsigned int *ntresp_len);
 
-CURLcode  Curl_ntlm_core_mk_lmv2_resp(unsigned char *ntlmv2hash,
-                                      unsigned char *challenge_client,
-                                      unsigned char *challenge_server,
-                                      unsigned char *lmresp);
+CURLcode Curl_ntlm_core_mk_lmv2_resp(const unsigned char *ntlmv2hash,
+                                     const unsigned char *challenge_client,
+                                     const unsigned char *challenge_server,
+                                     unsigned char *lmresp);
 
 #endif /* !USE_WINDOWS_SSPI */
 
diff --git a/third-party/curl/lib/curl_ntlm_wb.c b/third-party/curl/lib/curl_ntlm_wb.c
deleted file mode 100644
index a10e2a1b09..0000000000
--- a/third-party/curl/lib/curl_ntlm_wb.c
+++ /dev/null
@@ -1,500 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#if !defined(CURL_DISABLE_HTTP) && defined(USE_NTLM) && \
-    defined(NTLM_WB_ENABLED)
-
-/*
- * NTLM details:
- *
- * https://davenport.sourceforge.net/ntlm.html
- * https://www.innovation.ch/java/ntlm.html
- */
-
-#define DEBUG_ME 0
-
-#ifdef HAVE_SYS_WAIT_H
-#include <sys/wait.h>
-#endif
-#ifdef HAVE_SIGNAL_H
-#include <signal.h>
-#endif
-#ifdef HAVE_PWD_H
-#include <pwd.h>
-#endif
-
-#include "urldata.h"
-#include "sendf.h"
-#include "select.h"
-#include "vauth/ntlm.h"
-#include "curl_ntlm_core.h"
-#include "curl_ntlm_wb.h"
-#include "url.h"
-#include "strerror.h"
-#include "strdup.h"
-#include "strcase.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-#if DEBUG_ME
-# define DEBUG_OUT(x) x
-#else
-# define DEBUG_OUT(x) Curl_nop_stmt
-#endif
-
-/* Portable 'sclose_nolog' used only in child process instead of 'sclose'
-   to avoid fooling the socket leak detector */
-#if defined(HAVE_CLOSESOCKET)
-#  define sclose_nolog(x)  closesocket((x))
-#elif defined(HAVE_CLOSESOCKET_CAMEL)
-#  define sclose_nolog(x)  CloseSocket((x))
-#else
-#  define sclose_nolog(x)  close((x))
-#endif
-
-static void ntlm_wb_cleanup(struct ntlmdata *ntlm)
-{
-  if(ntlm->ntlm_auth_hlpr_socket != CURL_SOCKET_BAD) {
-    sclose(ntlm->ntlm_auth_hlpr_socket);
-    ntlm->ntlm_auth_hlpr_socket = CURL_SOCKET_BAD;
-  }
-
-  if(ntlm->ntlm_auth_hlpr_pid) {
-    int i;
-    for(i = 0; i < 4; i++) {
-      pid_t ret = waitpid(ntlm->ntlm_auth_hlpr_pid, NULL, WNOHANG);
-      if(ret == ntlm->ntlm_auth_hlpr_pid || errno == ECHILD)
-        break;
-      switch(i) {
-      case 0:
-        kill(ntlm->ntlm_auth_hlpr_pid, SIGTERM);
-        break;
-      case 1:
-        /* Give the process another moment to shut down cleanly before
-           bringing down the axe */
-        Curl_wait_ms(1);
-        break;
-      case 2:
-        kill(ntlm->ntlm_auth_hlpr_pid, SIGKILL);
-        break;
-      case 3:
-        break;
-      }
-    }
-    ntlm->ntlm_auth_hlpr_pid = 0;
-  }
-
-  Curl_safefree(ntlm->challenge);
-  Curl_safefree(ntlm->response);
-}
-
-static CURLcode ntlm_wb_init(struct Curl_easy *data, struct ntlmdata *ntlm,
-                             const char *userp)
-{
-  curl_socket_t sockfds[2];
-  pid_t child_pid;
-  const char *username;
-  char *slash, *domain = NULL;
-  const char *ntlm_auth = NULL;
-  char *ntlm_auth_alloc = NULL;
-#if defined(HAVE_GETPWUID_R) && defined(HAVE_GETEUID)
-  struct passwd pw, *pw_res;
-  char pwbuf[1024];
-#endif
-  char buffer[STRERROR_LEN];
-
-#if defined(CURL_DISABLE_VERBOSE_STRINGS)
-  (void) data;
-#endif
-
-  /* Return if communication with ntlm_auth already set up */
-  if(ntlm->ntlm_auth_hlpr_socket != CURL_SOCKET_BAD ||
-     ntlm->ntlm_auth_hlpr_pid)
-    return CURLE_OK;
-
-  username = userp;
-  /* The real ntlm_auth really doesn't like being invoked with an
-     empty username. It won't make inferences for itself, and expects
-     the client to do so (mostly because it's really designed for
-     servers like squid to use for auth, and client support is an
-     afterthought for it). So try hard to provide a suitable username
-     if we don't already have one. But if we can't, provide the
-     empty one anyway. Perhaps they have an implementation of the
-     ntlm_auth helper which *doesn't* need it so we might as well try */
-  if(!username || !username[0]) {
-    username = getenv("NTLMUSER");
-    if(!username || !username[0])
-      username = getenv("LOGNAME");
-    if(!username || !username[0])
-      username = getenv("USER");
-#if defined(HAVE_GETPWUID_R) && defined(HAVE_GETEUID)
-    if((!username || !username[0]) &&
-       !getpwuid_r(geteuid(), &pw, pwbuf, sizeof(pwbuf), &pw_res) &&
-       pw_res) {
-      username = pw.pw_name;
-    }
-#endif
-    if(!username || !username[0])
-      username = userp;
-  }
-  slash = strpbrk(username, "\\/");
-  if(slash) {
-    domain = strdup(username);
-    if(!domain)
-      return CURLE_OUT_OF_MEMORY;
-    slash = domain + (slash - username);
-    *slash = '\0';
-    username = username + (slash - domain) + 1;
-  }
-
-  /* For testing purposes, when DEBUGBUILD is defined and environment
-     variable CURL_NTLM_WB_FILE is set a fake_ntlm is used to perform
-     NTLM challenge/response which only accepts commands and output
-     strings pre-written in test case definitions */
-#ifdef DEBUGBUILD
-  ntlm_auth_alloc = curl_getenv("CURL_NTLM_WB_FILE");
-  if(ntlm_auth_alloc)
-    ntlm_auth = ntlm_auth_alloc;
-  else
-#endif
-    ntlm_auth = NTLM_WB_FILE;
-
-  if(access(ntlm_auth, X_OK) != 0) {
-    failf(data, "Could not access ntlm_auth: %s errno %d: %s",
-          ntlm_auth, errno, Curl_strerror(errno, buffer, sizeof(buffer)));
-    goto done;
-  }
-
-  if(Curl_socketpair(AF_UNIX, SOCK_STREAM, 0, sockfds)) {
-    failf(data, "Could not open socket pair. errno %d: %s",
-          errno, Curl_strerror(errno, buffer, sizeof(buffer)));
-    goto done;
-  }
-
-  child_pid = fork();
-  if(child_pid == -1) {
-    sclose(sockfds[0]);
-    sclose(sockfds[1]);
-    failf(data, "Could not fork. errno %d: %s",
-          errno, Curl_strerror(errno, buffer, sizeof(buffer)));
-    goto done;
-  }
-  else if(!child_pid) {
-    /*
-     * child process
-     */
-
-    /* Don't use sclose in the child since it fools the socket leak detector */
-    sclose_nolog(sockfds[0]);
-    if(dup2(sockfds[1], STDIN_FILENO) == -1) {
-      failf(data, "Could not redirect child stdin. errno %d: %s",
-            errno, Curl_strerror(errno, buffer, sizeof(buffer)));
-      exit(1);
-    }
-
-    if(dup2(sockfds[1], STDOUT_FILENO) == -1) {
-      failf(data, "Could not redirect child stdout. errno %d: %s",
-            errno, Curl_strerror(errno, buffer, sizeof(buffer)));
-      exit(1);
-    }
-
-    if(domain)
-      execl(ntlm_auth, ntlm_auth,
-            "--helper-protocol", "ntlmssp-client-1",
-            "--use-cached-creds",
-            "--username", username,
-            "--domain", domain,
-            NULL);
-    else
-      execl(ntlm_auth, ntlm_auth,
-            "--helper-protocol", "ntlmssp-client-1",
-            "--use-cached-creds",
-            "--username", username,
-            NULL);
-
-    sclose_nolog(sockfds[1]);
-    failf(data, "Could not execl(). errno %d: %s",
-          errno, Curl_strerror(errno, buffer, sizeof(buffer)));
-    exit(1);
-  }
-
-  sclose(sockfds[1]);
-  ntlm->ntlm_auth_hlpr_socket = sockfds[0];
-  ntlm->ntlm_auth_hlpr_pid = child_pid;
-  free(domain);
-  free(ntlm_auth_alloc);
-  return CURLE_OK;
-
-done:
-  free(domain);
-  free(ntlm_auth_alloc);
-  return CURLE_REMOTE_ACCESS_DENIED;
-}
-
-/* if larger than this, something is seriously wrong */
-#define MAX_NTLM_WB_RESPONSE 100000
-
-static CURLcode ntlm_wb_response(struct Curl_easy *data, struct ntlmdata *ntlm,
-                                 const char *input, curlntlm state)
-{
-  size_t len_in = strlen(input), len_out = 0;
-  struct dynbuf b;
-  char *ptr = NULL;
-  unsigned char *buf = (unsigned char *)data->state.buffer;
-  Curl_dyn_init(&b, MAX_NTLM_WB_RESPONSE);
-
-  while(len_in > 0) {
-    ssize_t written = swrite(ntlm->ntlm_auth_hlpr_socket, input, len_in);
-    if(written == -1) {
-      /* Interrupted by a signal, retry it */
-      if(errno == EINTR)
-        continue;
-      /* write failed if other errors happen */
-      goto done;
-    }
-    input += written;
-    len_in -= written;
-  }
-  /* Read one line */
-  while(1) {
-    ssize_t size =
-      sread(ntlm->ntlm_auth_hlpr_socket, buf, data->set.buffer_size);
-    if(size == -1) {
-      if(errno == EINTR)
-        continue;
-      goto done;
-    }
-    else if(size == 0)
-      goto done;
-
-    if(Curl_dyn_addn(&b, buf, size))
-      goto done;
-
-    len_out = Curl_dyn_len(&b);
-    ptr = Curl_dyn_ptr(&b);
-    if(len_out && ptr[len_out - 1] == '\n') {
-      ptr[len_out - 1] = '\0';
-      break; /* done! */
-    }
-    /* loop */
-  }
-
-  /* Samba/winbind installed but not configured */
-  if(state == NTLMSTATE_TYPE1 &&
-     len_out == 3 &&
-     ptr[0] == 'P' && ptr[1] == 'W')
-    goto done;
-  /* invalid response */
-  if(len_out < 4)
-    goto done;
-  if(state == NTLMSTATE_TYPE1 &&
-     (ptr[0]!='Y' || ptr[1]!='R' || ptr[2]!=' '))
-    goto done;
-  if(state == NTLMSTATE_TYPE2 &&
-     (ptr[0]!='K' || ptr[1]!='K' || ptr[2]!=' ') &&
-     (ptr[0]!='A' || ptr[1]!='F' || ptr[2]!=' '))
-    goto done;
-
-  ntlm->response = strdup(ptr + 3);
-  Curl_dyn_free(&b);
-  if(!ntlm->response)
-    return CURLE_OUT_OF_MEMORY;
-  return CURLE_OK;
-done:
-  Curl_dyn_free(&b);
-  return CURLE_REMOTE_ACCESS_DENIED;
-}
-
-CURLcode Curl_input_ntlm_wb(struct Curl_easy *data,
-                            struct connectdata *conn,
-                            bool proxy,
-                            const char *header)
-{
-  struct ntlmdata *ntlm = proxy ? &conn->proxyntlm : &conn->ntlm;
-  curlntlm *state = proxy ? &conn->proxy_ntlm_state : &conn->http_ntlm_state;
-
-  (void) data;  /* In case it gets unused by nop log macros. */
-
-  if(!checkprefix("NTLM", header))
-    return CURLE_BAD_CONTENT_ENCODING;
-
-  header += strlen("NTLM");
-  while(*header && ISSPACE(*header))
-    header++;
-
-  if(*header) {
-    ntlm->challenge = strdup(header);
-    if(!ntlm->challenge)
-      return CURLE_OUT_OF_MEMORY;
-
-    *state = NTLMSTATE_TYPE2; /* We got a type-2 message */
-  }
-  else {
-    if(*state == NTLMSTATE_LAST) {
-      infof(data, "NTLM auth restarted");
-      Curl_http_auth_cleanup_ntlm_wb(conn);
-    }
-    else if(*state == NTLMSTATE_TYPE3) {
-      infof(data, "NTLM handshake rejected");
-      Curl_http_auth_cleanup_ntlm_wb(conn);
-      *state = NTLMSTATE_NONE;
-      return CURLE_REMOTE_ACCESS_DENIED;
-    }
-    else if(*state >= NTLMSTATE_TYPE1) {
-      infof(data, "NTLM handshake failure (internal error)");
-      return CURLE_REMOTE_ACCESS_DENIED;
-    }
-
-    *state = NTLMSTATE_TYPE1; /* We should send away a type-1 */
-  }
-
-  return CURLE_OK;
-}
-
-/*
- * This is for creating ntlm header output by delegating challenge/response
- * to Samba's winbind daemon helper ntlm_auth.
- */
-CURLcode Curl_output_ntlm_wb(struct Curl_easy *data, struct connectdata *conn,
-                             bool proxy)
-{
-  /* point to the address of the pointer that holds the string to send to the
-     server, which is for a plain host or for an HTTP proxy */
-  char **allocuserpwd;
-  /* point to the name and password for this */
-  const char *userp;
-  struct ntlmdata *ntlm;
-  curlntlm *state;
-  struct auth *authp;
-
-  CURLcode res = CURLE_OK;
-
-  DEBUGASSERT(conn);
-  DEBUGASSERT(data);
-
-  if(proxy) {
-#ifndef CURL_DISABLE_PROXY
-    allocuserpwd = &data->state.aptr.proxyuserpwd;
-    userp = conn->http_proxy.user;
-    ntlm = &conn->proxyntlm;
-    state = &conn->proxy_ntlm_state;
-    authp = &data->state.authproxy;
-#else
-    return CURLE_NOT_BUILT_IN;
-#endif
-  }
-  else {
-    allocuserpwd = &data->state.aptr.userpwd;
-    userp = conn->user;
-    ntlm = &conn->ntlm;
-    state = &conn->http_ntlm_state;
-    authp = &data->state.authhost;
-  }
-  authp->done = FALSE;
-
-  /* not set means empty */
-  if(!userp)
-    userp = "";
-
-  switch(*state) {
-  case NTLMSTATE_TYPE1:
-  default:
-    /* Use Samba's 'winbind' daemon to support NTLM authentication,
-     * by delegating the NTLM challenge/response protocol to a helper
-     * in ntlm_auth.
-     * https://web.archive.org/web/20190925164737
-     * /devel.squid-cache.org/ntlm/squid_helper_protocol.html
-     * https://www.samba.org/samba/docs/man/manpages-3/winbindd.8.html
-     * https://www.samba.org/samba/docs/man/manpages-3/ntlm_auth.1.html
-     * Preprocessor symbol 'NTLM_WB_ENABLED' is defined when this
-     * feature is enabled and 'NTLM_WB_FILE' symbol holds absolute
-     * filename of ntlm_auth helper.
-     * If NTLM authentication using winbind fails, go back to original
-     * request handling process.
-     */
-    /* Create communication with ntlm_auth */
-    res = ntlm_wb_init(data, ntlm, userp);
-    if(res)
-      return res;
-    res = ntlm_wb_response(data, ntlm, "YR\n", *state);
-    if(res)
-      return res;
-
-    free(*allocuserpwd);
-    *allocuserpwd = aprintf("%sAuthorization: NTLM %s\r\n",
-                            proxy ? "Proxy-" : "",
-                            ntlm->response);
-    DEBUG_OUT(fprintf(stderr, "**** Header %s\n ", *allocuserpwd));
-    Curl_safefree(ntlm->response);
-    if(!*allocuserpwd)
-      return CURLE_OUT_OF_MEMORY;
-    break;
-
-  case NTLMSTATE_TYPE2: {
-    char *input = aprintf("TT %s\n", ntlm->challenge);
-    if(!input)
-      return CURLE_OUT_OF_MEMORY;
-    res = ntlm_wb_response(data, ntlm, input, *state);
-    free(input);
-    if(res)
-      return res;
-
-    free(*allocuserpwd);
-    *allocuserpwd = aprintf("%sAuthorization: NTLM %s\r\n",
-                            proxy ? "Proxy-" : "",
-                            ntlm->response);
-    DEBUG_OUT(fprintf(stderr, "**** %s\n ", *allocuserpwd));
-    *state = NTLMSTATE_TYPE3; /* we sent a type-3 */
-    authp->done = TRUE;
-    Curl_http_auth_cleanup_ntlm_wb(conn);
-    if(!*allocuserpwd)
-      return CURLE_OUT_OF_MEMORY;
-    break;
-  }
-  case NTLMSTATE_TYPE3:
-    /* connection is already authenticated,
-     * don't send a header in future requests */
-    *state = NTLMSTATE_LAST;
-    /* FALLTHROUGH */
-  case NTLMSTATE_LAST:
-    Curl_safefree(*allocuserpwd);
-    authp->done = TRUE;
-    break;
-  }
-
-  return CURLE_OK;
-}
-
-void Curl_http_auth_cleanup_ntlm_wb(struct connectdata *conn)
-{
-  ntlm_wb_cleanup(&conn->ntlm);
-  ntlm_wb_cleanup(&conn->proxyntlm);
-}
-
-#endif /* !CURL_DISABLE_HTTP && USE_NTLM && NTLM_WB_ENABLED */
diff --git a/third-party/curl/lib/curl_ntlm_wb.h b/third-party/curl/lib/curl_ntlm_wb.h
deleted file mode 100644
index 37704c0fe0..0000000000
--- a/third-party/curl/lib/curl_ntlm_wb.h
+++ /dev/null
@@ -1,45 +0,0 @@
-#ifndef HEADER_CURL_NTLM_WB_H
-#define HEADER_CURL_NTLM_WB_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#if !defined(CURL_DISABLE_HTTP) && defined(USE_NTLM) && \
-    defined(NTLM_WB_ENABLED)
-
-/* this is for ntlm header input */
-CURLcode Curl_input_ntlm_wb(struct Curl_easy *data,
-                            struct connectdata *conn, bool proxy,
-                            const char *header);
-
-/* this is for creating ntlm header output */
-CURLcode Curl_output_ntlm_wb(struct Curl_easy *data, struct connectdata *conn,
-                             bool proxy);
-
-void Curl_http_auth_cleanup_ntlm_wb(struct connectdata *conn);
-
-#endif /* !CURL_DISABLE_HTTP && USE_NTLM && NTLM_WB_ENABLED */
-
-#endif /* HEADER_CURL_NTLM_WB_H */
diff --git a/third-party/curl/lib/curl_path.c b/third-party/curl/lib/curl_path.c
deleted file mode 100644
index 856423db99..0000000000
--- a/third-party/curl/lib/curl_path.c
+++ /dev/null
@@ -1,199 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl AND ISC
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#if defined(USE_SSH)
-
-#include <curl/curl.h>
-#include "curl_memory.h"
-#include "curl_path.h"
-#include "escape.h"
-#include "memdebug.h"
-
-#define MAX_SSHPATH_LEN 100000 /* arbitrary */
-
-/* figure out the path to work with in this particular request */
-CURLcode Curl_getworkingpath(struct Curl_easy *data,
-                             char *homedir,  /* when SFTP is used */
-                             char **path) /* returns the  allocated
-                                             real path to work with */
-{
-  char *working_path;
-  size_t working_path_len;
-  struct dynbuf npath;
-  CURLcode result =
-    Curl_urldecode(data->state.up.path, 0, &working_path,
-                   &working_path_len, REJECT_ZERO);
-  if(result)
-    return result;
-
-  /* new path to switch to in case we need to */
-  Curl_dyn_init(&npath, MAX_SSHPATH_LEN);
-
-  /* Check for /~/, indicating relative to the user's home directory */
-  if((data->conn->handler->protocol & CURLPROTO_SCP) &&
-     (working_path_len > 3) && (!memcmp(working_path, "/~/", 3))) {
-    /* It is referenced to the home directory, so strip the leading '/~/' */
-    if(Curl_dyn_addn(&npath, &working_path[3], working_path_len - 3)) {
-      free(working_path);
-      return CURLE_OUT_OF_MEMORY;
-    }
-  }
-  else if((data->conn->handler->protocol & CURLPROTO_SFTP) &&
-          (!strcmp("/~", working_path) ||
-           ((working_path_len > 2) && !memcmp(working_path, "/~/", 3)))) {
-    if(Curl_dyn_add(&npath, homedir)) {
-      free(working_path);
-      return CURLE_OUT_OF_MEMORY;
-    }
-    if(working_path_len > 2) {
-      size_t len;
-      const char *p;
-      int copyfrom = 3;
-      /* Copy a separating '/' if homedir does not end with one */
-      len = Curl_dyn_len(&npath);
-      p = Curl_dyn_ptr(&npath);
-      if(len && (p[len-1] != '/'))
-        copyfrom = 2;
-
-      if(Curl_dyn_addn(&npath,
-                       &working_path[copyfrom], working_path_len - copyfrom)) {
-        free(working_path);
-        return CURLE_OUT_OF_MEMORY;
-      }
-    }
-  }
-
-  if(Curl_dyn_len(&npath)) {
-    free(working_path);
-
-    /* store the pointer for the caller to receive */
-    *path = Curl_dyn_ptr(&npath);
-  }
-  else
-    *path = working_path;
-
-  return CURLE_OK;
-}
-
-/* The get_pathname() function is being borrowed from OpenSSH sftp.c
-   version 4.6p1. */
-/*
- * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org>
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-CURLcode Curl_get_pathname(const char **cpp, char **path, char *homedir)
-{
-  const char *cp = *cpp, *end;
-  char quot;
-  unsigned int i, j;
-  size_t fullPathLength, pathLength;
-  bool relativePath = false;
-  static const char WHITESPACE[] = " \t\r\n";
-
-  DEBUGASSERT(homedir);
-  if(!*cp || !homedir) {
-    *cpp = NULL;
-    *path = NULL;
-    return CURLE_QUOTE_ERROR;
-  }
-  /* Ignore leading whitespace */
-  cp += strspn(cp, WHITESPACE);
-  /* Allocate enough space for home directory and filename + separator */
-  fullPathLength = strlen(cp) + strlen(homedir) + 2;
-  *path = malloc(fullPathLength);
-  if(!*path)
-    return CURLE_OUT_OF_MEMORY;
-
-  /* Check for quoted filenames */
-  if(*cp == '\"' || *cp == '\'') {
-    quot = *cp++;
-
-    /* Search for terminating quote, unescape some chars */
-    for(i = j = 0; i <= strlen(cp); i++) {
-      if(cp[i] == quot) {  /* Found quote */
-        i++;
-        (*path)[j] = '\0';
-        break;
-      }
-      if(cp[i] == '\0') {  /* End of string */
-        goto fail;
-      }
-      if(cp[i] == '\\') {  /* Escaped characters */
-        i++;
-        if(cp[i] != '\'' && cp[i] != '\"' &&
-            cp[i] != '\\') {
-          goto fail;
-        }
-      }
-      (*path)[j++] = cp[i];
-    }
-
-    if(j == 0) {
-      goto fail;
-    }
-    *cpp = cp + i + strspn(cp + i, WHITESPACE);
-  }
-  else {
-    /* Read to end of filename - either to whitespace or terminator */
-    end = strpbrk(cp, WHITESPACE);
-    if(!end)
-      end = strchr(cp, '\0');
-    /* return pointer to second parameter if it exists */
-    *cpp = end + strspn(end, WHITESPACE);
-    pathLength = 0;
-    relativePath = (cp[0] == '/' && cp[1] == '~' && cp[2] == '/');
-    /* Handling for relative path - prepend home directory */
-    if(relativePath) {
-      strcpy(*path, homedir);
-      pathLength = strlen(homedir);
-      (*path)[pathLength++] = '/';
-      (*path)[pathLength] = '\0';
-      cp += 3;
-    }
-    /* Copy path name up until first "whitespace" */
-    memcpy(&(*path)[pathLength], cp, (int)(end - cp));
-    pathLength += (int)(end - cp);
-    (*path)[pathLength] = '\0';
-  }
-  return CURLE_OK;
-
-fail:
-  Curl_safefree(*path);
-  return CURLE_QUOTE_ERROR;
-}
-
-#endif /* if SSH is used */
diff --git a/third-party/curl/lib/curl_path.h b/third-party/curl/lib/curl_path.h
deleted file mode 100644
index 9ed09dea83..0000000000
--- a/third-party/curl/lib/curl_path.h
+++ /dev/null
@@ -1,49 +0,0 @@
-#ifndef HEADER_CURL_PATH_H
-#define HEADER_CURL_PATH_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-#include <curl/curl.h>
-#include "urldata.h"
-
-#ifdef WIN32
-#  undef  PATH_MAX
-#  define PATH_MAX MAX_PATH
-#  ifndef R_OK
-#    define R_OK 4
-#  endif
-#endif
-
-#ifndef PATH_MAX
-#define PATH_MAX 1024 /* just an extra precaution since there are systems that
-                         have their definition hidden well */
-#endif
-
-CURLcode Curl_getworkingpath(struct Curl_easy *data,
-                             char *homedir,
-                             char **path);
-
-CURLcode Curl_get_pathname(const char **cpp, char **path, char *homedir);
-#endif /* HEADER_CURL_PATH_H */
diff --git a/third-party/curl/lib/curl_printf.h b/third-party/curl/lib/curl_printf.h
index 46ef344f76..3b1a5af3b4 100644
--- a/third-party/curl/lib/curl_printf.h
+++ b/third-party/curl/lib/curl_printf.h
@@ -24,28 +24,14 @@
  *
  ***************************************************************************/
 
-/*
- * This header should be included by ALL code in libcurl that uses any
- * *rintf() functions.
- */
+#define MERR_OK        0
+#define MERR_MEM       1
+#define MERR_TOO_LARGE 2
 
-#include <curl/mprintf.h>
+/* Lower-case digits. */
+extern const unsigned char Curl_ldigits[];
+
+/* Upper-case digits. */
+extern const unsigned char Curl_udigits[];
 
-# undef printf
-# undef fprintf
-# undef msnprintf
-# undef vprintf
-# undef vfprintf
-# undef vsnprintf
-# undef mvsnprintf
-# undef aprintf
-# undef vaprintf
-# define printf curl_mprintf
-# define fprintf curl_mfprintf
-# define msnprintf curl_msnprintf
-# define vprintf curl_mvprintf
-# define vfprintf curl_mvfprintf
-# define mvsnprintf curl_mvsnprintf
-# define aprintf curl_maprintf
-# define vaprintf curl_mvaprintf
 #endif /* HEADER_CURL_PRINTF_H */
diff --git a/third-party/curl/lib/curl_range.c b/third-party/curl/lib/curl_range.c
index d499953c9e..9bbafa40cf 100644
--- a/third-party/curl/lib/curl_range.c
+++ b/third-party/curl/lib/curl_range.c
@@ -21,49 +21,45 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
-#include <curl/curl.h>
+
 #include "curl_range.h"
-#include "sendf.h"
-#include "strtoofft.h"
+#include "curl_trc.h"
+#include "curlx/strparse.h"
 
 /* Only include this function if one or more of FTP, FILE are enabled. */
 #if !defined(CURL_DISABLE_FTP) || !defined(CURL_DISABLE_FILE)
 
- /*
-  Check if this is a range download, and if so, set the internal variables
-  properly.
- */
+/* Check if this is a range download, and if so, set the internal variables
+   properly. */
 CURLcode Curl_range(struct Curl_easy *data)
 {
-  curl_off_t from, to;
-  char *ptr;
-  char *ptr2;
-
   if(data->state.use_range && data->state.range) {
-    CURLofft from_t;
-    CURLofft to_t;
-    from_t = curlx_strtoofft(data->state.range, &ptr, 10, &from);
-    if(from_t == CURL_OFFT_FLOW)
+    curl_off_t from, to;
+    bool first_num = TRUE;
+    const char *p = data->state.range;
+    if(curlx_str_number(&p, &from, CURL_OFF_T_MAX))
+      first_num = FALSE;
+
+    if(curlx_str_single(&p, '-'))
+      /* no leading dash or after the first number is an error */
       return CURLE_RANGE_ERROR;
-    while(*ptr && (ISBLANK(*ptr) || (*ptr == '-')))
-      ptr++;
-    to_t = curlx_strtoofft(ptr, &ptr2, 10, &to);
-    if(to_t == CURL_OFFT_FLOW)
-      return CURLE_RANGE_ERROR;
-    if((to_t == CURL_OFFT_INVAL) && !from_t) {
+
+    if(curlx_str_number(&p, &to, CURL_OFF_T_MAX)) {
+      /* no second number */
       /* X - */
       data->state.resume_from = from;
-      DEBUGF(infof(data, "RANGE %" CURL_FORMAT_CURL_OFF_T " to end of file",
-                   from));
+      DEBUGF(infof(data, "RANGE %" FMT_OFF_T " to end of file", from));
     }
-    else if((from_t == CURL_OFFT_INVAL) && !to_t) {
+    else if(!first_num) {
       /* -Y */
+      if(!to)
+        /* "-0" is wrong */
+        return CURLE_RANGE_ERROR;
+
       data->req.maxdownload = to;
       data->state.resume_from = -to;
-      DEBUGF(infof(data, "RANGE the last %" CURL_FORMAT_CURL_OFF_T " bytes",
-                   to));
+      DEBUGF(infof(data, "RANGE the last %" FMT_OFF_T " bytes", to));
     }
     else {
       /* X-Y */
@@ -79,13 +75,12 @@ CURLcode Curl_range(struct Curl_easy *data)
 
       data->req.maxdownload = totalsize + 1; /* include last byte */
       data->state.resume_from = from;
-      DEBUGF(infof(data, "RANGE from %" CURL_FORMAT_CURL_OFF_T
-                   " getting %" CURL_FORMAT_CURL_OFF_T " bytes",
+      DEBUGF(infof(data, "RANGE from %" FMT_OFF_T
+                   " getting %" FMT_OFF_T " bytes",
                    from, data->req.maxdownload));
     }
-    DEBUGF(infof(data, "range-download from %" CURL_FORMAT_CURL_OFF_T
-                 " to %" CURL_FORMAT_CURL_OFF_T ", totally %"
-                 CURL_FORMAT_CURL_OFF_T " bytes",
+    DEBUGF(infof(data, "range-download from %" FMT_OFF_T
+                 " to %" FMT_OFF_T ", totally %" FMT_OFF_T " bytes",
                  from, to, data->req.maxdownload));
   }
   else
diff --git a/third-party/curl/lib/curl_range.h b/third-party/curl/lib/curl_range.h
index 77679e2b94..97354677c2 100644
--- a/third-party/curl/lib/curl_range.h
+++ b/third-party/curl/lib/curl_range.h
@@ -23,8 +23,8 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+
 #include "urldata.h"
 
 CURLcode Curl_range(struct Curl_easy *data);
diff --git a/third-party/curl/lib/curl_rtmp.c b/third-party/curl/lib/curl_rtmp.c
deleted file mode 100644
index 406fb42ac0..0000000000
--- a/third-party/curl/lib/curl_rtmp.c
+++ /dev/null
@@ -1,338 +0,0 @@
-/***************************************************************************
- *                      _   _ ____  _
- *  Project         ___| | | |  _ \| |
- *                 / __| | | | |_) | |
- *                | (__| |_| |  _ <| |___
- *                 \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- * Copyright (C) Howard Chu, <hyc@highlandsun.com>
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#ifdef USE_LIBRTMP
-
-#include "curl_rtmp.h"
-#include "urldata.h"
-#include "nonblock.h" /* for curlx_nonblock */
-#include "progress.h" /* for Curl_pgrsSetUploadSize */
-#include "transfer.h"
-#include "warnless.h"
-#include <curl/curl.h>
-#include <librtmp/rtmp.h>
-#include "curl_memory.h"
-/* The last #include file should be: */
-#include "memdebug.h"
-
-#if defined(WIN32) && !defined(USE_LWIPSOCK)
-#define setsockopt(a,b,c,d,e) (setsockopt)(a,b,c,(const char *)d,(int)e)
-#define SET_RCVTIMEO(tv,s)   int tv = s*1000
-#elif defined(LWIP_SO_SNDRCVTIMEO_NONSTANDARD)
-#define SET_RCVTIMEO(tv,s)   int tv = s*1000
-#else
-#define SET_RCVTIMEO(tv,s)   struct timeval tv = {s,0}
-#endif
-
-#define DEF_BUFTIME    (2*60*60*1000)    /* 2 hours */
-
-static CURLcode rtmp_setup_connection(struct Curl_easy *data,
-                                      struct connectdata *conn);
-static CURLcode rtmp_do(struct Curl_easy *data, bool *done);
-static CURLcode rtmp_done(struct Curl_easy *data, CURLcode, bool premature);
-static CURLcode rtmp_connect(struct Curl_easy *data, bool *done);
-static CURLcode rtmp_disconnect(struct Curl_easy *data,
-                                struct connectdata *conn, bool dead);
-
-static Curl_recv rtmp_recv;
-static Curl_send rtmp_send;
-
-/*
- * RTMP protocol handler.h, based on https://rtmpdump.mplayerhq.hu
- */
-
-const struct Curl_handler Curl_handler_rtmp = {
-  "RTMP",                               /* scheme */
-  rtmp_setup_connection,                /* setup_connection */
-  rtmp_do,                              /* do_it */
-  rtmp_done,                            /* done */
-  ZERO_NULL,                            /* do_more */
-  rtmp_connect,                         /* connect_it */
-  ZERO_NULL,                            /* connecting */
-  ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  rtmp_disconnect,                      /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_RTMP,                            /* defport */
-  CURLPROTO_RTMP,                       /* protocol */
-  CURLPROTO_RTMP,                       /* family */
-  PROTOPT_NONE                          /* flags */
-};
-
-const struct Curl_handler Curl_handler_rtmpt = {
-  "RTMPT",                              /* scheme */
-  rtmp_setup_connection,                /* setup_connection */
-  rtmp_do,                              /* do_it */
-  rtmp_done,                            /* done */
-  ZERO_NULL,                            /* do_more */
-  rtmp_connect,                         /* connect_it */
-  ZERO_NULL,                            /* connecting */
-  ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  rtmp_disconnect,                      /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_RTMPT,                           /* defport */
-  CURLPROTO_RTMPT,                      /* protocol */
-  CURLPROTO_RTMPT,                      /* family */
-  PROTOPT_NONE                          /* flags */
-};
-
-const struct Curl_handler Curl_handler_rtmpe = {
-  "RTMPE",                              /* scheme */
-  rtmp_setup_connection,                /* setup_connection */
-  rtmp_do,                              /* do_it */
-  rtmp_done,                            /* done */
-  ZERO_NULL,                            /* do_more */
-  rtmp_connect,                         /* connect_it */
-  ZERO_NULL,                            /* connecting */
-  ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  rtmp_disconnect,                      /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_RTMP,                            /* defport */
-  CURLPROTO_RTMPE,                      /* protocol */
-  CURLPROTO_RTMPE,                      /* family */
-  PROTOPT_NONE                          /* flags */
-};
-
-const struct Curl_handler Curl_handler_rtmpte = {
-  "RTMPTE",                             /* scheme */
-  rtmp_setup_connection,                /* setup_connection */
-  rtmp_do,                              /* do_it */
-  rtmp_done,                            /* done */
-  ZERO_NULL,                            /* do_more */
-  rtmp_connect,                         /* connect_it */
-  ZERO_NULL,                            /* connecting */
-  ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  rtmp_disconnect,                      /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_RTMPT,                           /* defport */
-  CURLPROTO_RTMPTE,                     /* protocol */
-  CURLPROTO_RTMPTE,                     /* family */
-  PROTOPT_NONE                          /* flags */
-};
-
-const struct Curl_handler Curl_handler_rtmps = {
-  "RTMPS",                              /* scheme */
-  rtmp_setup_connection,                /* setup_connection */
-  rtmp_do,                              /* do_it */
-  rtmp_done,                            /* done */
-  ZERO_NULL,                            /* do_more */
-  rtmp_connect,                         /* connect_it */
-  ZERO_NULL,                            /* connecting */
-  ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  rtmp_disconnect,                      /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_RTMPS,                           /* defport */
-  CURLPROTO_RTMPS,                      /* protocol */
-  CURLPROTO_RTMP,                       /* family */
-  PROTOPT_NONE                          /* flags */
-};
-
-const struct Curl_handler Curl_handler_rtmpts = {
-  "RTMPTS",                             /* scheme */
-  rtmp_setup_connection,                /* setup_connection */
-  rtmp_do,                              /* do_it */
-  rtmp_done,                            /* done */
-  ZERO_NULL,                            /* do_more */
-  rtmp_connect,                         /* connect_it */
-  ZERO_NULL,                            /* connecting */
-  ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  rtmp_disconnect,                      /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_RTMPS,                           /* defport */
-  CURLPROTO_RTMPTS,                     /* protocol */
-  CURLPROTO_RTMPT,                      /* family */
-  PROTOPT_NONE                          /* flags */
-};
-
-static CURLcode rtmp_setup_connection(struct Curl_easy *data,
-                                      struct connectdata *conn)
-{
-  RTMP *r = RTMP_Alloc();
-  if(!r)
-    return CURLE_OUT_OF_MEMORY;
-
-  RTMP_Init(r);
-  RTMP_SetBufferMS(r, DEF_BUFTIME);
-  if(!RTMP_SetupURL(r, data->state.url)) {
-    RTMP_Free(r);
-    return CURLE_URL_MALFORMAT;
-  }
-  conn->proto.rtmp = r;
-  return CURLE_OK;
-}
-
-static CURLcode rtmp_connect(struct Curl_easy *data, bool *done)
-{
-  struct connectdata *conn = data->conn;
-  RTMP *r = conn->proto.rtmp;
-  SET_RCVTIMEO(tv, 10);
-
-  r->m_sb.sb_socket = (int)conn->sock[FIRSTSOCKET];
-
-  /* We have to know if it's a write before we send the
-   * connect request packet
-   */
-  if(data->state.upload)
-    r->Link.protocol |= RTMP_FEATURE_WRITE;
-
-  /* For plain streams, use the buffer toggle trick to keep data flowing */
-  if(!(r->Link.lFlags & RTMP_LF_LIVE) &&
-     !(r->Link.protocol & RTMP_FEATURE_HTTP))
-    r->Link.lFlags |= RTMP_LF_BUFX;
-
-  (void)curlx_nonblock(r->m_sb.sb_socket, FALSE);
-  setsockopt(r->m_sb.sb_socket, SOL_SOCKET, SO_RCVTIMEO,
-             (char *)&tv, sizeof(tv));
-
-  if(!RTMP_Connect1(r, NULL))
-    return CURLE_FAILED_INIT;
-
-  /* Clients must send a periodic BytesReceived report to the server */
-  r->m_bSendCounter = true;
-
-  *done = TRUE;
-  conn->recv[FIRSTSOCKET] = rtmp_recv;
-  conn->send[FIRSTSOCKET] = rtmp_send;
-  return CURLE_OK;
-}
-
-static CURLcode rtmp_do(struct Curl_easy *data, bool *done)
-{
-  struct connectdata *conn = data->conn;
-  RTMP *r = conn->proto.rtmp;
-
-  if(!RTMP_ConnectStream(r, 0))
-    return CURLE_FAILED_INIT;
-
-  if(data->state.upload) {
-    Curl_pgrsSetUploadSize(data, data->state.infilesize);
-    Curl_setup_transfer(data, -1, -1, FALSE, FIRSTSOCKET);
-  }
-  else
-    Curl_setup_transfer(data, FIRSTSOCKET, -1, FALSE, -1);
-  *done = TRUE;
-  return CURLE_OK;
-}
-
-static CURLcode rtmp_done(struct Curl_easy *data, CURLcode status,
-                          bool premature)
-{
-  (void)data; /* unused */
-  (void)status; /* unused */
-  (void)premature; /* unused */
-
-  return CURLE_OK;
-}
-
-static CURLcode rtmp_disconnect(struct Curl_easy *data,
-                                struct connectdata *conn,
-                                bool dead_connection)
-{
-  RTMP *r = conn->proto.rtmp;
-  (void)data;
-  (void)dead_connection;
-  if(r) {
-    conn->proto.rtmp = NULL;
-    RTMP_Close(r);
-    RTMP_Free(r);
-  }
-  return CURLE_OK;
-}
-
-static ssize_t rtmp_recv(struct Curl_easy *data, int sockindex, char *buf,
-                         size_t len, CURLcode *err)
-{
-  struct connectdata *conn = data->conn;
-  RTMP *r = conn->proto.rtmp;
-  ssize_t nread;
-
-  (void)sockindex; /* unused */
-
-  nread = RTMP_Read(r, buf, curlx_uztosi(len));
-  if(nread < 0) {
-    if(r->m_read.status == RTMP_READ_COMPLETE ||
-       r->m_read.status == RTMP_READ_EOF) {
-      data->req.size = data->req.bytecount;
-      nread = 0;
-    }
-    else
-      *err = CURLE_RECV_ERROR;
-  }
-  return nread;
-}
-
-static ssize_t rtmp_send(struct Curl_easy *data, int sockindex,
-                         const void *buf, size_t len, CURLcode *err)
-{
-  struct connectdata *conn = data->conn;
-  RTMP *r = conn->proto.rtmp;
-  ssize_t num;
-
-  (void)sockindex; /* unused */
-
-  num = RTMP_Write(r, (char *)buf, curlx_uztosi(len));
-  if(num < 0)
-    *err = CURLE_SEND_ERROR;
-
-  return num;
-}
-#endif  /* USE_LIBRTMP */
diff --git a/third-party/curl/lib/curl_rtmp.h b/third-party/curl/lib/curl_rtmp.h
deleted file mode 100644
index 9b93ee060b..0000000000
--- a/third-party/curl/lib/curl_rtmp.h
+++ /dev/null
@@ -1,35 +0,0 @@
-#ifndef HEADER_CURL_RTMP_H
-#define HEADER_CURL_RTMP_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Howard Chu, <hyc@highlandsun.com>
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#ifdef USE_LIBRTMP
-extern const struct Curl_handler Curl_handler_rtmp;
-extern const struct Curl_handler Curl_handler_rtmpt;
-extern const struct Curl_handler Curl_handler_rtmpe;
-extern const struct Curl_handler Curl_handler_rtmpte;
-extern const struct Curl_handler Curl_handler_rtmps;
-extern const struct Curl_handler Curl_handler_rtmpts;
-#endif
-
-#endif /* HEADER_CURL_RTMP_H */
diff --git a/third-party/curl/lib/curl_sasl.c b/third-party/curl/lib/curl_sasl.c
index 91ddf10622..7e867d753f 100644
--- a/third-party/curl/lib/curl_sasl.c
+++ b/third-party/curl/lib/curl_sasl.c
@@ -32,30 +32,18 @@
  * Draft   LOGIN SASL Mechanism <draft-murchison-sasl-login-00.txt>
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if !defined(CURL_DISABLE_IMAP) || !defined(CURL_DISABLE_SMTP) || \
-  !defined(CURL_DISABLE_POP3) || \
+  !defined(CURL_DISABLE_POP3) ||                                  \
   (!defined(CURL_DISABLE_LDAP) && defined(USE_OPENLDAP))
 
-#include <curl/curl.h>
 #include "urldata.h"
-
-#include "curl_base64.h"
-#include "curl_md5.h"
+#include "curlx/base64.h"
 #include "vauth/vauth.h"
 #include "cfilters.h"
-#include "vtls/vtls.h"
-#include "curl_hmac.h"
 #include "curl_sasl.h"
-#include "warnless.h"
-#include "strtok.h"
-#include "sendf.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curl_trc.h"
 
 /* Supported mechanisms */
 static const struct {
@@ -77,44 +65,6 @@ static const struct {
   { ZERO_NULL,      0,  0 }
 };
 
-/*
- * Curl_sasl_cleanup()
- *
- * This is used to cleanup any libraries or curl modules used by the sasl
- * functions.
- *
- * Parameters:
- *
- * conn     [in]     - The connection data.
- * authused [in]     - The authentication mechanism used.
- */
-void Curl_sasl_cleanup(struct connectdata *conn, unsigned short authused)
-{
-  (void)conn;
-  (void)authused;
-
-#if defined(USE_KERBEROS5)
-  /* Cleanup the gssapi structure */
-  if(authused == SASL_MECH_GSSAPI) {
-    Curl_auth_cleanup_gssapi(&conn->krb5);
-  }
-#endif
-
-#if defined(USE_GSASL)
-  /* Cleanup the GSASL structure */
-  if(authused & (SASL_MECH_SCRAM_SHA_1 | SASL_MECH_SCRAM_SHA_256)) {
-    Curl_auth_gsasl_cleanup(&conn->gsasl);
-  }
-#endif
-
-#if defined(USE_NTLM)
-  /* Cleanup the NTLM structure */
-  if(authused == SASL_MECH_NTLM) {
-    Curl_auth_cleanup_ntlm(&conn->ntlm);
-  }
-#endif
-}
-
 /*
  * Curl_sasl_decode_mech()
  *
@@ -136,7 +86,7 @@ unsigned short Curl_sasl_decode_mech(const char *ptr, size_t maxlen,
 
   for(i = 0; mechtable[i].name; i++) {
     if(maxlen >= mechtable[i].len &&
-       !memcmp(ptr, mechtable[i].name, mechtable[i].len)) {
+       curl_strnequal(ptr, mechtable[i].name, mechtable[i].len)) {
       if(len)
         *len = mechtable[i].len;
 
@@ -205,18 +155,23 @@ void Curl_sasl_init(struct SASL *sasl, struct Curl_easy *data,
   sasl->force_ir = FALSE;          /* Respect external option */
 
   if(auth != CURLAUTH_BASIC) {
-    sasl->resetprefs = FALSE;
-    sasl->prefmech = SASL_AUTH_NONE;
+    unsigned short mechs = SASL_AUTH_NONE;
+
+    /* If some usable http authentication options have been set, determine
+       new defaults from them. */
     if(auth & CURLAUTH_BASIC)
-      sasl->prefmech |= SASL_MECH_PLAIN | SASL_MECH_LOGIN;
+      mechs |= SASL_MECH_PLAIN | SASL_MECH_LOGIN;
     if(auth & CURLAUTH_DIGEST)
-      sasl->prefmech |= SASL_MECH_DIGEST_MD5;
+      mechs |= SASL_MECH_DIGEST_MD5;
     if(auth & CURLAUTH_NTLM)
-      sasl->prefmech |= SASL_MECH_NTLM;
+      mechs |= SASL_MECH_NTLM;
     if(auth & CURLAUTH_BEARER)
-      sasl->prefmech |= SASL_MECH_OAUTHBEARER | SASL_MECH_XOAUTH2;
+      mechs |= SASL_MECH_OAUTHBEARER | SASL_MECH_XOAUTH2;
     if(auth & CURLAUTH_GSSAPI)
-      sasl->prefmech |= SASL_MECH_GSSAPI;
+      mechs |= SASL_MECH_GSSAPI;
+
+    if(mechs != SASL_AUTH_NONE)
+      sasl->prefmech = mechs;
   }
 }
 
@@ -228,9 +183,9 @@ void Curl_sasl_init(struct SASL *sasl, struct Curl_easy *data,
 static void sasl_state(struct SASL *sasl, struct Curl_easy *data,
                        saslstate newstate)
 {
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
   /* for debug purposes */
-  static const char * const names[]={
+  static const char * const names[] = {
     "STOP",
     "PLAIN",
     "LOGIN",
@@ -256,12 +211,14 @@ static void sasl_state(struct SASL *sasl, struct Curl_easy *data,
     infof(data, "SASL %p state change from %s to %s",
           (void *)sasl, names[sasl->state], names[newstate]);
 #else
-  (void) data;
+  (void)data;
 #endif
 
   sasl->state = newstate;
 }
 
+#if defined(USE_NTLM) || defined(USE_GSASL) || defined(USE_KERBEROS5) || \
+  !defined(CURL_DISABLE_DIGEST_AUTH)
 /* Get the SASL server message and convert it to binary. */
 static CURLcode get_server_message(struct SASL *sasl, struct Curl_easy *data,
                                    struct bufref *out)
@@ -270,20 +227,22 @@ static CURLcode get_server_message(struct SASL *sasl, struct Curl_easy *data,
 
   result = sasl->params->getmessage(data, out);
   if(!result && (sasl->params->flags & SASL_FLAG_BASE64)) {
-    unsigned char *msg;
-    size_t msglen;
-    const char *serverdata = (const char *) Curl_bufref_ptr(out);
+    const char *serverdata = Curl_bufref_ptr(out);
 
     if(!*serverdata || *serverdata == '=')
       Curl_bufref_set(out, NULL, 0, NULL);
     else {
-      result = Curl_base64_decode(serverdata, &msg, &msglen);
+      unsigned char *msg;
+      size_t msglen;
+
+      result = curlx_base64_decode(serverdata, &msg, &msglen);
       if(!result)
         Curl_bufref_set(out, msg, msglen, curl_free);
     }
   }
   return result;
 }
+#endif
 
 /* Encode the outgoing SASL message. */
 static CURLcode build_message(struct SASL *sasl, struct bufref *msg)
@@ -299,8 +258,8 @@ static CURLcode build_message(struct SASL *sasl, struct bufref *msg)
       char *base64;
       size_t base64len;
 
-      result = Curl_base64_encode((const char *) Curl_bufref_ptr(msg),
-                                  Curl_bufref_len(msg), &base64, &base64len);
+      result = curlx_base64_encode(Curl_bufref_uptr(msg),
+                                   Curl_bufref_len(msg), &base64, &base64len);
       if(!result)
         Curl_bufref_set(msg, base64, base64len, curl_free);
     }
@@ -317,16 +276,234 @@ static CURLcode build_message(struct SASL *sasl, struct bufref *msg)
 bool Curl_sasl_can_authenticate(struct SASL *sasl, struct Curl_easy *data)
 {
   /* Have credentials been provided? */
-  if(data->state.aptr.user)
+  if(data->conn->creds)
     return TRUE;
 
-  /* EXTERNAL can authenticate without a user name and/or password */
+  /* EXTERNAL can authenticate without a username and/or password */
   if(sasl->authmechs & sasl->prefmech & SASL_MECH_EXTERNAL)
     return TRUE;
 
   return FALSE;
 }
 
+struct sasl_ctx {
+  struct SASL *sasl;
+  struct connectdata *conn;
+  unsigned short enabledmechs;
+  const char *mech;
+  saslstate state1;
+  saslstate state2;
+  struct bufref resp;
+  CURLcode result;
+};
+
+static bool sasl_choose_external(struct Curl_easy *data, struct sasl_ctx *sctx)
+{
+  if((sctx->enabledmechs & SASL_MECH_EXTERNAL) &&
+     !Curl_creds_has_passwd(sctx->conn->creds)) {
+    sctx->mech = SASL_MECH_STRING_EXTERNAL;
+    sctx->state1 = SASL_EXTERNAL;
+    sctx->sasl->authused = SASL_MECH_EXTERNAL;
+
+    if(sctx->sasl->force_ir || data->set.sasl_ir)
+      Curl_auth_create_external_message(
+        Curl_creds_user(sctx->conn->creds), &sctx->resp);
+    return TRUE;
+  }
+  return FALSE;
+}
+
+#ifdef USE_KERBEROS5
+static bool sasl_choose_krb5(struct Curl_easy *data, struct sasl_ctx *sctx)
+{
+  if((sctx->enabledmechs & SASL_MECH_GSSAPI) &&
+     Curl_auth_is_gssapi_supported() &&
+     Curl_auth_user_contains_domain(sctx->conn->creds)) {
+    const char *service = Curl_creds_has_sasl_service(sctx->conn->creds) ?
+      Curl_creds_sasl_service(sctx->conn->creds) : sctx->sasl->params->service;
+
+    sctx->sasl->mutual_auth = FALSE;
+    sctx->mech = SASL_MECH_STRING_GSSAPI;
+    sctx->state1 = SASL_GSSAPI;
+    sctx->state2 = SASL_GSSAPI_TOKEN;
+    sctx->sasl->authused = SASL_MECH_GSSAPI;
+
+    if(sctx->sasl->force_ir || data->set.sasl_ir) {
+      struct kerberos5data *krb5 = Curl_auth_krb5_get(sctx->conn);
+      sctx->result = !krb5 ? CURLE_OUT_OF_MEMORY :
+        Curl_auth_create_gssapi_user_message(data, sctx->conn->creds,
+                                             service,
+                                             sctx->conn->origin->hostname,
+                                             (bool)sctx->sasl->mutual_auth,
+                                             NULL, krb5, &sctx->resp);
+    }
+    return TRUE;
+  }
+  return FALSE;
+}
+#endif /* USE_KERBEROS5 */
+
+#ifdef USE_GSASL
+static bool sasl_choose_gsasl(struct Curl_easy *data, struct sasl_ctx *sctx)
+{
+  struct gsasldata *gsasl;
+  struct bufref nullmsg;
+
+  if((sctx->enabledmechs &
+      (SASL_MECH_SCRAM_SHA_256 | SASL_MECH_SCRAM_SHA_1))) {
+    gsasl = Curl_auth_gsasl_get(sctx->conn);
+    if(!gsasl) {
+      sctx->result = CURLE_OUT_OF_MEMORY;
+      return TRUE; /* attempted, but failed */
+    }
+
+    if((sctx->enabledmechs & SASL_MECH_SCRAM_SHA_256) &&
+       Curl_auth_gsasl_is_supported(data, SASL_MECH_STRING_SCRAM_SHA_256,
+                                    gsasl)) {
+      sctx->mech = SASL_MECH_STRING_SCRAM_SHA_256;
+      sctx->sasl->authused = SASL_MECH_SCRAM_SHA_256;
+    }
+    else if((sctx->enabledmechs & SASL_MECH_SCRAM_SHA_1) &&
+            Curl_auth_gsasl_is_supported(data, SASL_MECH_STRING_SCRAM_SHA_1,
+                                         gsasl)) {
+      sctx->mech = SASL_MECH_STRING_SCRAM_SHA_1;
+      sctx->sasl->authused = SASL_MECH_SCRAM_SHA_1;
+    }
+    else
+      return FALSE;
+
+    Curl_bufref_init(&nullmsg);
+    sctx->state1 = SASL_GSASL;
+    sctx->state2 = SASL_GSASL;
+    sctx->result = Curl_auth_gsasl_start(data, sctx->conn->creds, gsasl);
+    if(!sctx->result && (sctx->sasl->force_ir || data->set.sasl_ir))
+      sctx->result = Curl_auth_gsasl_token(data, &nullmsg, gsasl, &sctx->resp);
+    return TRUE;
+  }
+  return FALSE;
+}
+
+#endif /* USE_GSASL */
+
+#ifndef CURL_DISABLE_DIGEST_AUTH
+static bool sasl_choose_digest(struct Curl_easy *data, struct sasl_ctx *sctx)
+{
+  (void)data;
+  if((sctx->enabledmechs & SASL_MECH_DIGEST_MD5) &&
+     Curl_auth_is_digest_supported()) {
+    sctx->mech = SASL_MECH_STRING_DIGEST_MD5;
+    sctx->state1 = SASL_DIGESTMD5;
+    sctx->sasl->authused = SASL_MECH_DIGEST_MD5;
+    return TRUE;
+  }
+  else if(sctx->enabledmechs & SASL_MECH_CRAM_MD5) {
+    sctx->mech = SASL_MECH_STRING_CRAM_MD5;
+    sctx->state1 = SASL_CRAMMD5;
+    sctx->sasl->authused = SASL_MECH_CRAM_MD5;
+    return TRUE;
+  }
+  return FALSE;
+}
+#endif /* !CURL_DISABLE_DIGEST_AUTH */
+
+#ifdef USE_NTLM
+static bool sasl_choose_ntlm(struct Curl_easy *data, struct sasl_ctx *sctx)
+{
+  if((sctx->enabledmechs & SASL_MECH_NTLM) &&
+     Curl_auth_is_ntlm_supported()) {
+     const char *service = Curl_creds_has_sasl_service(sctx->conn->creds) ?
+      Curl_creds_sasl_service(sctx->conn->creds) : sctx->sasl->params->service;
+    const char *hostname;
+
+    Curl_conn_get_current_host(data, FIRSTSOCKET, &hostname, NULL);
+
+    sctx->mech = SASL_MECH_STRING_NTLM;
+    sctx->state1 = SASL_NTLM;
+    sctx->state2 = SASL_NTLM_TYPE2MSG;
+    sctx->sasl->authused = SASL_MECH_NTLM;
+
+    if(sctx->sasl->force_ir || data->set.sasl_ir) {
+      struct ntlmdata *ntlm = Curl_auth_ntlm_get(sctx->conn, FALSE);
+      sctx->result = !ntlm ? CURLE_OUT_OF_MEMORY :
+        Curl_auth_create_ntlm_type1_message(data, sctx->conn->creds,
+                                            service, hostname,
+                                            ntlm, &sctx->resp);
+    }
+    return TRUE;
+  }
+  return FALSE;
+}
+#endif /* USE_NTLM */
+
+static bool sasl_choose_oauth(struct Curl_easy *data, struct sasl_ctx *sctx)
+{
+  if(Curl_creds_has_oauth_bearer(data->state.creds) &&
+     (sctx->enabledmechs & SASL_MECH_OAUTHBEARER)) {
+    const char *hostname;
+    int port;
+    Curl_conn_get_current_host(data, FIRSTSOCKET, &hostname, &port);
+
+    sctx->mech = SASL_MECH_STRING_OAUTHBEARER;
+    sctx->state1 = SASL_OAUTH2;
+    sctx->state2 = SASL_OAUTH2_RESP;
+    sctx->sasl->authused = SASL_MECH_OAUTHBEARER;
+
+    if(sctx->sasl->force_ir || data->set.sasl_ir)
+      sctx->result =
+        Curl_auth_create_oauth_bearer_message(sctx->conn->creds,
+                                              hostname, port, &sctx->resp);
+    return TRUE;
+  }
+  return FALSE;
+}
+
+static bool sasl_choose_oauth2(struct Curl_easy *data, struct sasl_ctx *sctx)
+{
+  if(Curl_creds_has_oauth_bearer(sctx->conn->creds) &&
+     (sctx->enabledmechs & SASL_MECH_XOAUTH2)) {
+    sctx->mech = SASL_MECH_STRING_XOAUTH2;
+    sctx->state1 = SASL_OAUTH2;
+    sctx->sasl->authused = SASL_MECH_XOAUTH2;
+
+    if(sctx->sasl->force_ir || data->set.sasl_ir)
+      sctx->result = Curl_auth_create_xoauth_bearer_message(
+        sctx->conn->creds, &sctx->resp);
+    return TRUE;
+  }
+  return FALSE;
+}
+
+static bool sasl_choose_plain(struct Curl_easy *data, struct sasl_ctx *sctx)
+{
+  if(sctx->enabledmechs & SASL_MECH_PLAIN) {
+    sctx->mech = SASL_MECH_STRING_PLAIN;
+    sctx->state1 = SASL_PLAIN;
+    sctx->sasl->authused = SASL_MECH_PLAIN;
+
+    if(sctx->sasl->force_ir || data->set.sasl_ir)
+      sctx->result =
+        Curl_auth_create_plain_message(sctx->conn->creds, &sctx->resp);
+    return TRUE;
+  }
+  return FALSE;
+}
+
+static bool sasl_choose_login(struct Curl_easy *data, struct sasl_ctx *sctx)
+{
+  if(sctx->enabledmechs & SASL_MECH_LOGIN) {
+    sctx->mech = SASL_MECH_STRING_LOGIN;
+    sctx->state1 = SASL_LOGIN;
+    sctx->state2 = SASL_LOGIN_PASSWD;
+    sctx->sasl->authused = SASL_MECH_LOGIN;
+
+    if(sctx->sasl->force_ir || data->set.sasl_ir)
+      Curl_auth_create_login_message(
+        Curl_creds_user(sctx->conn->creds), &sctx->resp);
+    return TRUE;
+  }
+  return FALSE;
+}
+
 /*
  * Curl_sasl_start()
  *
@@ -335,185 +512,65 @@ bool Curl_sasl_can_authenticate(struct SASL *sasl, struct Curl_easy *data)
 CURLcode Curl_sasl_start(struct SASL *sasl, struct Curl_easy *data,
                          bool force_ir, saslprogress *progress)
 {
-  CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  unsigned short enabledmechs;
-  const char *mech = NULL;
-  struct bufref resp;
-  saslstate state1 = SASL_STOP;
-  saslstate state2 = SASL_FINAL;
-  const char *hostname, *disp_hostname;
-  int port;
-#if defined(USE_KERBEROS5) || defined(USE_NTLM)
-  const char *service = data->set.str[STRING_SERVICE_NAME] ?
-    data->set.str[STRING_SERVICE_NAME] :
-    sasl->params->service;
-#endif
-  const char *oauth_bearer = data->set.str[STRING_BEARER];
-  struct bufref nullmsg;
+  struct sasl_ctx sctx;
 
-  Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &disp_hostname, &port);
-  Curl_bufref_init(&nullmsg);
-  Curl_bufref_init(&resp);
   sasl->force_ir = force_ir;    /* Latch for future use */
   sasl->authused = 0;           /* No mechanism used yet */
-  enabledmechs = sasl->authmechs & sasl->prefmech;
   *progress = SASL_IDLE;
 
+  memset(&sctx, 0, sizeof(sctx));
+  sctx.sasl = sasl;
+  sctx.conn = data->conn;
+  Curl_bufref_init(&sctx.resp);
+  sctx.enabledmechs = sasl->authmechs & sasl->prefmech;
+  sctx.state1 = SASL_STOP;
+  sctx.state2 = SASL_FINAL;
+
   /* Calculate the supported authentication mechanism, by decreasing order of
      security, as well as the initial response where appropriate */
-  if((enabledmechs & SASL_MECH_EXTERNAL) && !conn->passwd[0]) {
-    mech = SASL_MECH_STRING_EXTERNAL;
-    state1 = SASL_EXTERNAL;
-    sasl->authused = SASL_MECH_EXTERNAL;
-
-    if(force_ir || data->set.sasl_ir)
-      result = Curl_auth_create_external_message(conn->user, &resp);
-  }
-  else if(data->state.aptr.user) {
-#if defined(USE_KERBEROS5)
-    if((enabledmechs & SASL_MECH_GSSAPI) && Curl_auth_is_gssapi_supported() &&
-       Curl_auth_user_contains_domain(conn->user)) {
-      sasl->mutual_auth = FALSE;
-      mech = SASL_MECH_STRING_GSSAPI;
-      state1 = SASL_GSSAPI;
-      state2 = SASL_GSSAPI_TOKEN;
-      sasl->authused = SASL_MECH_GSSAPI;
-
-      if(force_ir || data->set.sasl_ir)
-        result = Curl_auth_create_gssapi_user_message(data, conn->user,
-                                                      conn->passwd,
-                                                      service,
-                                                      conn->host.name,
-                                                      sasl->mutual_auth,
-                                                      NULL, &conn->krb5,
-                                                      &resp);
-    }
-    else
+  if(sasl_choose_external(data, &sctx) ||
+#ifdef USE_KERBEROS5
+     sasl_choose_krb5(data, &sctx) ||
 #endif
 #ifdef USE_GSASL
-    if((enabledmechs & SASL_MECH_SCRAM_SHA_256) &&
-       Curl_auth_gsasl_is_supported(data, SASL_MECH_STRING_SCRAM_SHA_256,
-                                    &conn->gsasl)) {
-      mech = SASL_MECH_STRING_SCRAM_SHA_256;
-      sasl->authused = SASL_MECH_SCRAM_SHA_256;
-      state1 = SASL_GSASL;
-      state2 = SASL_GSASL;
-
-      result = Curl_auth_gsasl_start(data, conn->user,
-                                     conn->passwd, &conn->gsasl);
-      if(result == CURLE_OK && (force_ir || data->set.sasl_ir))
-        result = Curl_auth_gsasl_token(data, &nullmsg, &conn->gsasl, &resp);
-    }
-    else if((enabledmechs & SASL_MECH_SCRAM_SHA_1) &&
-            Curl_auth_gsasl_is_supported(data, SASL_MECH_STRING_SCRAM_SHA_1,
-                                         &conn->gsasl)) {
-      mech = SASL_MECH_STRING_SCRAM_SHA_1;
-      sasl->authused = SASL_MECH_SCRAM_SHA_1;
-      state1 = SASL_GSASL;
-      state2 = SASL_GSASL;
-
-      result = Curl_auth_gsasl_start(data, conn->user,
-                                     conn->passwd, &conn->gsasl);
-      if(result == CURLE_OK && (force_ir || data->set.sasl_ir))
-        result = Curl_auth_gsasl_token(data, &nullmsg, &conn->gsasl, &resp);
-    }
-    else
+     sasl_choose_gsasl(data, &sctx) ||
 #endif
 #ifndef CURL_DISABLE_DIGEST_AUTH
-    if((enabledmechs & SASL_MECH_DIGEST_MD5) &&
-       Curl_auth_is_digest_supported()) {
-      mech = SASL_MECH_STRING_DIGEST_MD5;
-      state1 = SASL_DIGESTMD5;
-      sasl->authused = SASL_MECH_DIGEST_MD5;
-    }
-    else if(enabledmechs & SASL_MECH_CRAM_MD5) {
-      mech = SASL_MECH_STRING_CRAM_MD5;
-      state1 = SASL_CRAMMD5;
-      sasl->authused = SASL_MECH_CRAM_MD5;
-    }
-    else
+     sasl_choose_digest(data, &sctx) ||
 #endif
 #ifdef USE_NTLM
-    if((enabledmechs & SASL_MECH_NTLM) && Curl_auth_is_ntlm_supported()) {
-      mech = SASL_MECH_STRING_NTLM;
-      state1 = SASL_NTLM;
-      state2 = SASL_NTLM_TYPE2MSG;
-      sasl->authused = SASL_MECH_NTLM;
-
-      if(force_ir || data->set.sasl_ir)
-        result = Curl_auth_create_ntlm_type1_message(data,
-                                                     conn->user, conn->passwd,
-                                                     service,
-                                                     hostname,
-                                                     &conn->ntlm, &resp);
-      }
-    else
+     sasl_choose_ntlm(data, &sctx) ||
 #endif
-    if((enabledmechs & SASL_MECH_OAUTHBEARER) && oauth_bearer) {
-      mech = SASL_MECH_STRING_OAUTHBEARER;
-      state1 = SASL_OAUTH2;
-      state2 = SASL_OAUTH2_RESP;
-      sasl->authused = SASL_MECH_OAUTHBEARER;
-
-      if(force_ir || data->set.sasl_ir)
-        result = Curl_auth_create_oauth_bearer_message(conn->user,
-                                                       hostname,
-                                                       port,
-                                                       oauth_bearer,
-                                                       &resp);
-    }
-    else if((enabledmechs & SASL_MECH_XOAUTH2) && oauth_bearer) {
-      mech = SASL_MECH_STRING_XOAUTH2;
-      state1 = SASL_OAUTH2;
-      sasl->authused = SASL_MECH_XOAUTH2;
-
-      if(force_ir || data->set.sasl_ir)
-        result = Curl_auth_create_xoauth_bearer_message(conn->user,
-                                                        oauth_bearer,
-                                                        &resp);
-    }
-    else if(enabledmechs & SASL_MECH_PLAIN) {
-      mech = SASL_MECH_STRING_PLAIN;
-      state1 = SASL_PLAIN;
-      sasl->authused = SASL_MECH_PLAIN;
-
-      if(force_ir || data->set.sasl_ir)
-        result = Curl_auth_create_plain_message(conn->sasl_authzid,
-                                                conn->user, conn->passwd,
-                                                &resp);
-    }
-    else if(enabledmechs & SASL_MECH_LOGIN) {
-      mech = SASL_MECH_STRING_LOGIN;
-      state1 = SASL_LOGIN;
-      state2 = SASL_LOGIN_PASSWD;
-      sasl->authused = SASL_MECH_LOGIN;
-
-      if(force_ir || data->set.sasl_ir)
-        result = Curl_auth_create_login_message(conn->user, &resp);
-    }
+     sasl_choose_oauth(data, &sctx) ||
+     sasl_choose_oauth2(data, &sctx) ||
+     sasl_choose_plain(data, &sctx) ||
+     sasl_choose_login(data, &sctx)) {
+    /* selected, either we have a mechanism or a failure */
+    DEBUGASSERT(sctx.mech || sctx.result);
   }
 
-  if(!result && mech) {
-    sasl->curmech = mech;
-    if(Curl_bufref_ptr(&resp))
-      result = build_message(sasl, &resp);
+  if(!sctx.result && sctx.mech) {
+    sasl->curmech = sctx.mech;
+    if(Curl_bufref_ptr(&sctx.resp))
+      sctx.result = build_message(sasl, &sctx.resp);
 
     if(sasl->params->maxirlen &&
-       strlen(mech) + Curl_bufref_len(&resp) > sasl->params->maxirlen)
-      Curl_bufref_free(&resp);
+       strlen(sctx.mech) + Curl_bufref_len(&sctx.resp) >
+         sasl->params->maxirlen)
+      Curl_bufref_free(&sctx.resp);
 
-    if(!result)
-      result = sasl->params->sendauth(data, mech, &resp);
+    if(!sctx.result)
+      sctx.result = sasl->params->sendauth(data, sctx.mech, &sctx.resp);
 
-    if(!result) {
+    if(!sctx.result) {
       *progress = SASL_INPROGRESS;
-      sasl_state(sasl, data, Curl_bufref_ptr(&resp) ? state2 : state1);
+      sasl_state(sasl, data, Curl_bufref_ptr(&sctx.resp) ?
+                 sctx.state2 : sctx.state1);
     }
   }
 
-  Curl_bufref_free(&resp);
-  return result;
+  Curl_bufref_free(&sctx.resp);
+  return sctx.result;
 }
 
 /*
@@ -528,18 +585,11 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
   struct connectdata *conn = data->conn;
   saslstate newstate = SASL_FINAL;
   struct bufref resp;
-  const char *hostname, *disp_hostname;
+  const char *hostname;
   int port;
-#if defined(USE_KERBEROS5) || defined(USE_NTLM) \
-    || !defined(CURL_DISABLE_DIGEST_AUTH)
-  const char *service = data->set.str[STRING_SERVICE_NAME] ?
-    data->set.str[STRING_SERVICE_NAME] :
-    sasl->params->service;
-#endif
-  const char *oauth_bearer = data->set.str[STRING_BEARER];
   struct bufref serverdata;
 
-  Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &disp_hostname, &port);
+  Curl_conn_get_current_host(data, FIRSTSOCKET, &hostname, &port);
   Curl_bufref_init(&serverdata);
   Curl_bufref_init(&resp);
   *progress = SASL_INPROGRESS;
@@ -564,24 +614,26 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
     *progress = SASL_DONE;
     return result;
   case SASL_PLAIN:
-    result = Curl_auth_create_plain_message(conn->sasl_authzid,
-                                            conn->user, conn->passwd, &resp);
+    result = Curl_auth_create_plain_message(conn->creds, &resp);
     break;
   case SASL_LOGIN:
-    result = Curl_auth_create_login_message(conn->user, &resp);
+    Curl_auth_create_login_message(Curl_creds_user(conn->creds), &resp);
     newstate = SASL_LOGIN_PASSWD;
     break;
   case SASL_LOGIN_PASSWD:
-    result = Curl_auth_create_login_message(conn->passwd, &resp);
+    Curl_auth_create_login_message(Curl_creds_passwd(conn->creds), &resp);
     break;
   case SASL_EXTERNAL:
-    result = Curl_auth_create_external_message(conn->user, &resp);
+    Curl_auth_create_external_message(Curl_creds_user(conn->creds), &resp);
     break;
 #ifdef USE_GSASL
   case SASL_GSASL:
     result = get_server_message(sasl, data, &serverdata);
-    if(!result)
-      result = Curl_auth_gsasl_token(data, &serverdata, &conn->gsasl, &resp);
+    if(!result) {
+      struct gsasldata *gsasl = Curl_auth_gsasl_get(conn);
+      result = !gsasl ? CURLE_OUT_OF_MEMORY :
+        Curl_auth_gsasl_token(data, &serverdata, gsasl, &resp);
+    }
     if(!result && Curl_bufref_len(&resp) > 0)
       newstate = SASL_GSASL;
     break;
@@ -590,15 +642,16 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
   case SASL_CRAMMD5:
     result = get_server_message(sasl, data, &serverdata);
     if(!result)
-      result = Curl_auth_create_cram_md5_message(&serverdata, conn->user,
-                                                 conn->passwd, &resp);
+      result = Curl_auth_create_cram_md5_message(&serverdata, conn->creds,
+                                                 &resp);
     break;
   case SASL_DIGESTMD5:
     result = get_server_message(sasl, data, &serverdata);
     if(!result)
       result = Curl_auth_create_digest_md5_message(data, &serverdata,
-                                                   conn->user, conn->passwd,
-                                                   service, &resp);
+                                                   conn->creds,
+                                                   sasl->params->service,
+                                                   &resp);
     if(!result && (sasl->params->flags & SASL_FLAG_BASE64))
       newstate = SASL_DIGESTMD5_RESP;
     break;
@@ -608,88 +661,93 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
 #endif
 
 #ifdef USE_NTLM
-  case SASL_NTLM:
+  case SASL_NTLM: {
     /* Create the type-1 message */
-    result = Curl_auth_create_ntlm_type1_message(data,
-                                                 conn->user, conn->passwd,
-                                                 service, hostname,
-                                                 &conn->ntlm, &resp);
+    struct ntlmdata *ntlm = Curl_auth_ntlm_get(conn, FALSE);
+    result = !ntlm ? CURLE_OUT_OF_MEMORY :
+      Curl_auth_create_ntlm_type1_message(data, conn->creds,
+                                          sasl->params->service, hostname,
+                                          ntlm, &resp);
     newstate = SASL_NTLM_TYPE2MSG;
     break;
-  case SASL_NTLM_TYPE2MSG:
+  }
+  case SASL_NTLM_TYPE2MSG: {
     /* Decode the type-2 message */
-    result = get_server_message(sasl, data, &serverdata);
+    struct ntlmdata *ntlm = Curl_auth_ntlm_get(conn, FALSE);
+    result = !ntlm ? CURLE_OUT_OF_MEMORY :
+      get_server_message(sasl, data, &serverdata);
     if(!result)
-      result = Curl_auth_decode_ntlm_type2_message(data, &serverdata,
-                                                   &conn->ntlm);
+      result = Curl_auth_decode_ntlm_type2_message(data, &serverdata, ntlm);
     if(!result)
-      result = Curl_auth_create_ntlm_type3_message(data, conn->user,
-                                                   conn->passwd, &conn->ntlm,
-                                                   &resp);
+      result = Curl_auth_create_ntlm_type3_message(data, conn->creds,
+                                                   ntlm, &resp);
     break;
+  }
 #endif
 
-#if defined(USE_KERBEROS5)
-  case SASL_GSSAPI:
-    result = Curl_auth_create_gssapi_user_message(data, conn->user,
-                                                  conn->passwd,
-                                                  service,
-                                                  conn->host.name,
-                                                  sasl->mutual_auth, NULL,
-                                                  &conn->krb5,
-                                                  &resp);
+#ifdef USE_KERBEROS5
+  case SASL_GSSAPI: {
+    struct kerberos5data *krb5 = Curl_auth_krb5_get(conn);
+    result = !krb5 ? CURLE_OUT_OF_MEMORY :
+      Curl_auth_create_gssapi_user_message(data, conn->creds,
+                                           sasl->params->service,
+                                           conn->origin->hostname,
+                                           (bool)sasl->mutual_auth, NULL,
+                                           krb5, &resp);
     newstate = SASL_GSSAPI_TOKEN;
     break;
+  }
   case SASL_GSSAPI_TOKEN:
     result = get_server_message(sasl, data, &serverdata);
     if(!result) {
-      if(sasl->mutual_auth) {
+      struct kerberos5data *krb5 = Curl_auth_krb5_get(conn);
+      if(!krb5)
+        result = CURLE_OUT_OF_MEMORY;
+      else if(sasl->mutual_auth) {
         /* Decode the user token challenge and create the optional response
            message */
-        result = Curl_auth_create_gssapi_user_message(data, NULL, NULL,
+        result = Curl_auth_create_gssapi_user_message(data, NULL,
                                                       NULL, NULL,
-                                                      sasl->mutual_auth,
+                                                      (bool)sasl->mutual_auth,
                                                       &serverdata,
-                                                      &conn->krb5,
-                                                      &resp);
+                                                      krb5, &resp);
         newstate = SASL_GSSAPI_NO_DATA;
       }
       else
         /* Decode the security challenge and create the response message */
-        result = Curl_auth_create_gssapi_security_message(data,
-                                                          conn->sasl_authzid,
-                                                          &serverdata,
-                                                          &conn->krb5,
-                                                          &resp);
+        result = Curl_auth_create_gssapi_security_message(
+          data, Curl_creds_sasl_authzid(conn->creds), &serverdata,
+          krb5, &resp);
     }
     break;
   case SASL_GSSAPI_NO_DATA:
     /* Decode the security challenge and create the response message */
     result = get_server_message(sasl, data, &serverdata);
-    if(!result)
-      result = Curl_auth_create_gssapi_security_message(data,
-                                                        conn->sasl_authzid,
-                                                        &serverdata,
-                                                        &conn->krb5,
-                                                        &resp);
+    if(!result) {
+      struct kerberos5data *krb5 = Curl_auth_krb5_get(conn);
+      if(!krb5)
+        result = CURLE_OUT_OF_MEMORY;
+      else
+        result = Curl_auth_create_gssapi_security_message(
+          data, Curl_creds_sasl_authzid(conn->creds), &serverdata,
+          krb5, &resp);
+    }
     break;
 #endif
 
   case SASL_OAUTH2:
     /* Create the authorization message */
     if(sasl->authused == SASL_MECH_OAUTHBEARER) {
-      result = Curl_auth_create_oauth_bearer_message(conn->user,
+      result = Curl_auth_create_oauth_bearer_message(conn->creds,
                                                      hostname,
                                                      port,
-                                                     oauth_bearer,
                                                      &resp);
 
       /* Failures maybe sent by the server as continuations for OAUTHBEARER */
       newstate = SASL_OAUTH2_RESP;
     }
     else
-      result = Curl_auth_create_xoauth_bearer_message(conn->user,
-                                                      oauth_bearer,
+      result = Curl_auth_create_xoauth_bearer_message(conn->creds,
                                                       &resp);
     break;
 
@@ -714,10 +772,12 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
 
   case SASL_CANCEL:
     /* Remove the offending mechanism from the supported list */
-    sasl->authmechs ^= sasl->authused;
+    sasl->authmechs &= (unsigned short)~sasl->authused;
+    sasl->authused = SASL_AUTH_NONE;
+    sasl->curmech = NULL;
 
     /* Start an alternative SASL authentication */
-    return Curl_sasl_start(sasl, data, sasl->force_ir, progress);
+    return Curl_sasl_start(sasl, data, (bool)sasl->force_ir, progress);
   default:
     failf(data, "Unsupported SASL authentication mechanism");
     result = CURLE_UNSUPPORTED_PROTOCOL;  /* Should not happen */
@@ -749,4 +809,102 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
 
   return result;
 }
+
+#ifdef CURLVERBOSE
+static void sasl_unchosen(struct Curl_easy *data, unsigned short mech,
+                          unsigned short enabledmechs,
+                          bool built_in, bool platform,
+                          const char *param_missing)
+{
+  const char *mname = NULL;
+  size_t i;
+
+  if(!(enabledmechs & mech))
+    return;
+
+  for(i = 0; mechtable[i].name; ++i) {
+    if(mechtable[i].bit == mech) {
+      mname = mechtable[i].name;
+      break;
+    }
+  }
+  if(!mname)  /* should not happen */
+    return;
+  if(!built_in)
+    infof(data, "SASL: %s not builtin", mname);
+  else if(!platform)
+    infof(data, "SASL: %s not supported by the platform/libraries", mname);
+  else {
+    if(param_missing)
+      infof(data, "SASL: %s is missing %s", mname, param_missing);
+    if(!Curl_creds_has_user(data->conn->creds))
+      infof(data, "SASL: %s is missing username", mname);
+  }
+}
+#endif /* CURLVERBOSE */
+
+CURLcode Curl_sasl_is_blocked(struct SASL *sasl, struct Curl_easy *data)
+{
+#ifdef CURLVERBOSE
+#ifdef USE_KERBEROS5
+#define CURL_SASL_KERBEROS5   TRUE
+#else
+#define CURL_SASL_KERBEROS5   FALSE
+#endif
+#ifdef USE_GSASL
+#define CURL_SASL_GASL        TRUE
+#else
+#define CURL_SASL_GASL        FALSE
+#endif
+#ifdef CURL_DISABLE_DIGEST_AUTH
+#define CURL_SASL_DIGEST      TRUE
+#else
+#define CURL_SASL_DIGEST      FALSE
+#endif
+#ifndef USE_NTLM
+#define CURL_SASL_NTLM        TRUE
+#else
+#define CURL_SASL_NTLM        FALSE
+#endif
+  /* Failing SASL authentication is a pain. Give a helping hand if
+   * we were unable to select an AUTH mechanism.
+   * `sasl->authmechs` are mechanisms offered by the peer
+   * `sasl->prefmech`  are mechanisms preferred by us */
+  unsigned short enabledmechs = sasl->authmechs & sasl->prefmech;
+
+  if(!sasl->authmechs)
+    infof(data, "SASL: no auth mechanism was offered or recognized");
+  else if(!enabledmechs)
+    infof(data, "SASL: no overlap between offered and configured "
+          "auth mechanisms");
+  else {
+    infof(data, "SASL: no auth mechanism offered could be selected");
+    if((enabledmechs & SASL_MECH_EXTERNAL) &&
+       Curl_creds_has_passwd(data->conn->creds))
+      infof(data, "SASL: auth EXTERNAL not chosen with password");
+    sasl_unchosen(data, SASL_MECH_GSSAPI, enabledmechs,
+                  CURL_SASL_KERBEROS5, Curl_auth_is_gssapi_supported(), NULL);
+    sasl_unchosen(data, SASL_MECH_SCRAM_SHA_256, enabledmechs,
+                  CURL_SASL_GASL, FALSE, NULL);
+    sasl_unchosen(data, SASL_MECH_SCRAM_SHA_1, enabledmechs,
+                  CURL_SASL_GASL, FALSE, NULL);
+    sasl_unchosen(data, SASL_MECH_DIGEST_MD5, enabledmechs,
+                  CURL_SASL_DIGEST, Curl_auth_is_digest_supported(), NULL);
+    sasl_unchosen(data, SASL_MECH_CRAM_MD5, enabledmechs,
+                  CURL_SASL_DIGEST, TRUE, NULL);
+    sasl_unchosen(data, SASL_MECH_NTLM, enabledmechs,
+                  CURL_SASL_NTLM, Curl_auth_is_ntlm_supported(), NULL);
+    sasl_unchosen(data, SASL_MECH_OAUTHBEARER, enabledmechs, TRUE, TRUE,
+                  Curl_creds_has_oauth_bearer(data->conn->creds) ?
+                  NULL : "CURLOPT_XOAUTH2_BEARER");
+    sasl_unchosen(data, SASL_MECH_XOAUTH2, enabledmechs, TRUE, TRUE,
+                  Curl_creds_has_oauth_bearer(data->conn->creds) ?
+                  NULL : "CURLOPT_XOAUTH2_BEARER");
+  }
+#endif /* CURLVERBOSE */
+  (void)sasl;
+  (void)data;
+  return CURLE_LOGIN_DENIED;
+}
+
 #endif /* protocols are enabled that use SASL */
diff --git a/third-party/curl/lib/curl_sasl.h b/third-party/curl/lib/curl_sasl.h
index e94e6431a2..8a97f52adc 100644
--- a/third-party/curl/lib/curl_sasl.h
+++ b/third-party/curl/lib/curl_sasl.h
@@ -23,9 +23,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
-#include <curl/curl.h>
-
 #include "bufref.h"
 
 struct Curl_easy;
@@ -132,13 +129,9 @@ struct SASL {
 
 /* This is used to test whether the line starts with the given mechanism */
 #define sasl_mech_equal(line, wordlen, mech) \
-  (wordlen == (sizeof(mech) - 1) / sizeof(char) && \
+  ((wordlen) == (sizeof(mech) - 1) / sizeof(char) && \
    !memcmp(line, mech, wordlen))
 
-/* This is used to cleanup any libraries or curl modules used by the sasl
-   functions */
-void Curl_sasl_cleanup(struct connectdata *conn, unsigned short authused);
-
 /* Convert a mechanism name to a token */
 unsigned short Curl_sasl_decode_mech(const char *ptr,
                                      size_t maxlen, size_t *len);
@@ -154,12 +147,14 @@ void Curl_sasl_init(struct SASL *sasl, struct Curl_easy *data,
 /* Check if we have enough auth data and capabilities to authenticate */
 bool Curl_sasl_can_authenticate(struct SASL *sasl, struct Curl_easy *data);
 
-/* Calculate the required login details for SASL authentication  */
+/* Calculate the required login details for SASL authentication */
 CURLcode Curl_sasl_start(struct SASL *sasl, struct Curl_easy *data,
                          bool force_ir, saslprogress *progress);
 
-/* Continue an SASL authentication  */
+/* Continue an SASL authentication */
 CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
                             int code, saslprogress *progress);
 
+CURLcode Curl_sasl_is_blocked(struct SASL *sasl, struct Curl_easy *data);
+
 #endif /* HEADER_CURL_SASL_H */
diff --git a/third-party/curl/lib/curl_setup.h b/third-party/curl/lib/curl_setup.h
index b43714da74..861e07649d 100644
--- a/third-party/curl/lib/curl_setup.h
+++ b/third-party/curl/lib/curl_setup.h
@@ -28,49 +28,106 @@
 #define CURL_NO_OLDIES
 #endif
 
-/* define mingw version macros, eg __MINGW{32,64}_{MINOR,MAJOR}_VERSION */
+/* Set default _WIN32_WINNT */
 #ifdef __MINGW32__
 #include <_mingw.h>
 #endif
 
-/*
- * Disable Visual Studio warnings:
- * 4127 "conditional expression is constant"
- */
+/* Workaround for Homebrew gcc 12.4.0, 13.3.0, 14.1.0, 14.2.0 (initial build)
+   that started advertising the `availability` attribute, which then gets used
+   by Apple SDK, but, in a way incompatible with gcc, resulting in misc errors
+   inside SDK headers, e.g.:
+     error: attributes should be specified before the declarator in a function
+            definition
+     error: expected ',' or '}' before
+   Followed by missing declarations.
+   Work it around by overriding the built-in feature-check macro used by the
+   headers to enable the problematic attributes. This makes the feature check
+   fail. Fixed in 14.2.0_1. Disable the workaround if the fix is detected. */
+#if defined(__APPLE__) && !defined(__clang__) && defined(__GNUC__) && \
+  defined(__has_attribute)
+#  if !defined(__has_feature)  /* Keep this PP check separate from others */
+#    define availability curl_pp_attribute_disabled
+#  elif !__has_feature(attribute_availability)
+#    define availability curl_pp_attribute_disabled
+#  endif
+#endif
+
+#ifdef __APPLE__
+#include <sys/types.h>
+#include <TargetConditionals.h>
+/* Fixup faulty target macro initialization in macOS SDK since v14.4 (as of
+   15.0 beta). The SDK target detection in `TargetConditionals.h` correctly
+   detects macOS, but fails to set the macro's old name `TARGET_OS_OSX`, then
+   continues to set it to a default value of 0. Other parts of the SDK still
+   rely on the old name, and with this inconsistency our builds fail due to
+   missing declarations. It happens when using mainline llvm older than v18.
+   Later versions fixed it by predefining these target macros, avoiding the
+   faulty dynamic detection. gcc is not affected (for now) because it lacks
+   the necessary dynamic detection features, so the SDK falls back to
+   a codepath that sets both the old and new macro to 1. */
+#if defined(TARGET_OS_MAC) && TARGET_OS_MAC && \
+  defined(TARGET_OS_OSX) && !TARGET_OS_OSX && \
+  (!defined(TARGET_OS_IPHONE) || !TARGET_OS_IPHONE) && \
+  (!defined(TARGET_OS_SIMULATOR) || !TARGET_OS_SIMULATOR)
+#undef TARGET_OS_OSX
+#define TARGET_OS_OSX TARGET_OS_MAC
+#endif
+#endif
+
+#if defined(__MINGW32__) && \
+  (!defined(__MINGW64_VERSION_MAJOR) || (__MINGW64_VERSION_MAJOR < 3))
+#error "Building curl requires mingw-w64 3.0 or later"
+#endif
+
+/* Visual Studio 2010 is the minimum Visual Studio version we support.
+   Workarounds for older versions of Visual Studio have been removed. */
+#if defined(_MSC_VER) && (_MSC_VER < 1600)
+#error "Ancient versions of Visual Studio are no longer supported due to bugs."
+#endif
+
 #ifdef _MSC_VER
+/* Disable Visual Studio warnings: 4127 "conditional expression is constant" */
 #pragma warning(disable:4127)
+#ifndef _CRT_SECURE_NO_WARNINGS
+#define _CRT_SECURE_NO_WARNINGS  /* for getenv(), sscanf() */
 #endif
+#endif /* _MSC_VER */
 
+#ifdef _WIN32
 /*
- * Define WIN32 when build target is Win32 API
- */
-
-#if (defined(_WIN32) || defined(__WIN32__)) && !defined(WIN32)
-#define WIN32
-#endif
-
-#ifdef WIN32
-/*
- * Don't include unneeded stuff in Windows headers to avoid compiler
+ * Do not include unneeded stuff in Windows headers to avoid compiler
  * warnings and macro clashes.
  * Make sure to define this macro before including any Windows headers.
  */
 #  ifndef WIN32_LEAN_AND_MEAN
-#    define WIN32_LEAN_AND_MEAN
+#  define WIN32_LEAN_AND_MEAN
 #  endif
 #  ifndef NOGDI
-#    define NOGDI
+#  define NOGDI
 #  endif
+
 /* Detect Windows App environment which has a restricted access
  * to the Win32 APIs. */
-# if (defined(_WIN32_WINNT) && (_WIN32_WINNT >= 0x0602)) || \
-  defined(WINAPI_FAMILY)
-#  include <winapifamily.h>
-#  if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP) &&  \
-     !WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
-#    define CURL_WINDOWS_APP
+#  if (defined(_WIN32_WINNT) && (_WIN32_WINNT >= 0x0602)) || \
+     defined(WINAPI_FAMILY)
+#    include <winapifamily.h>
+#    if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP) &&  \
+       !WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
+#      define CURL_WINDOWS_UWP
+#    endif
 #  endif
-# endif
+
+/* Mandatory to define SECURITY_WIN32 or SECURITY_KERNEL to indicating who is
+   compiling the code. */
+#undef SECURITY_KERNEL
+#undef SECURITY_WIN32
+#define SECURITY_WIN32  /* for <sspi.h> */
+#endif
+
+/* Compatibility */
+#ifdef ENABLE_IPV6
+#define USE_IPV6 1
 #endif
 
 /*
@@ -84,12 +141,8 @@
 
 #else /* HAVE_CONFIG_H */
 
-#ifdef _WIN32_WCE
-#  include "config-win32ce.h"
-#else
-#  ifdef WIN32
-#    include "config-win32.h"
-#  endif
+#ifdef _WIN32
+#  include "config-win32.h"
 #endif
 
 #ifdef macintosh
@@ -100,41 +153,46 @@
 #  include "config-riscos.h"
 #endif
 
-#ifdef __AMIGA__
-#  include "config-amigaos.h"
-#endif
-
 #ifdef __OS400__
 #  include "config-os400.h"
 #endif
 
-#ifdef __PLAN9__
-#  include "config-plan9.h"
-#endif
-
-#ifdef MSDOS
-#  include "config-dos.h"
-#endif
-
 #endif /* HAVE_CONFIG_H */
 
+#ifdef _WIN32
+#  if defined(_WIN32_WINNT) && (_WIN32_WINNT < 0x0600)
+#    error The minimum build target is Windows Vista (0x0600)
+#  endif
+
+#  if !defined(CURL_WINDOWS_UWP) && (defined(_MSC_VER) || defined(__MINGW32__))
+#    ifndef HAVE_IF_NAMETOINDEX
+#    define HAVE_IF_NAMETOINDEX
+#    endif
+#  endif
+#endif
+
 /* ================================================================ */
 /* Definition of preprocessor macros/symbols which modify compiler  */
-/* behavior or generated code characteristics must be done here,   */
+/* behavior or generated code characteristics must be done here,    */
 /* as appropriate, before any system header file is included. It is */
 /* also possible to have them defined in the config file included   */
 /* before this point. As a result of all this we frown inclusion of */
 /* system header files in our config files, avoid this at any cost. */
 /* ================================================================ */
 
+#ifdef HAVE_LIBZ
+#  ifndef ZLIB_CONST
+#  define ZLIB_CONST  /* Use z_const. Supported by v1.2.5.2 and upper. */
+#  endif
+#endif
+
 /*
  * AIX 4.3 and newer needs _THREAD_SAFE defined to build
  * proper reentrant code. Others may also need it.
  */
-
 #ifdef NEED_THREAD_SAFE
 #  ifndef _THREAD_SAFE
-#    define _THREAD_SAFE
+#  define _THREAD_SAFE
 #  endif
 #endif
 
@@ -143,17 +201,16 @@
  * things to appear in the system header files. Unixware needs it
  * to build proper reentrant code. Others may also need it.
  */
-
 #ifdef NEED_REENTRANT
 #  ifndef _REENTRANT
-#    define _REENTRANT
+#  define _REENTRANT
 #  endif
 #endif
 
 /* Solaris needs this to get a POSIX-conformant getpwuid_r */
 #if defined(sun) || defined(__sun)
 #  ifndef _POSIX_PTHREAD_SEMANTICS
-#    define _POSIX_PTHREAD_SEMANTICS 1
+#  define _POSIX_PTHREAD_SEMANTICS 1
 #  endif
 #endif
 
@@ -162,63 +219,105 @@
 /*  please, do it beyond the point further indicated in this file.  */
 /* ================================================================ */
 
+/* Give calloc a chance to be included early, so we do not redefine */
+#ifdef HAVE_THREADS_POSIX
+#  include <pthread.h>
+#endif
+
 /*
  * Disable other protocols when http is the only one desired.
  */
-
 #ifdef HTTP_ONLY
 #  ifndef CURL_DISABLE_DICT
-#    define CURL_DISABLE_DICT
+#  define CURL_DISABLE_DICT
 #  endif
 #  ifndef CURL_DISABLE_FILE
-#    define CURL_DISABLE_FILE
+#  define CURL_DISABLE_FILE
 #  endif
 #  ifndef CURL_DISABLE_FTP
-#    define CURL_DISABLE_FTP
+#  define CURL_DISABLE_FTP
 #  endif
 #  ifndef CURL_DISABLE_GOPHER
-#    define CURL_DISABLE_GOPHER
+#  define CURL_DISABLE_GOPHER
 #  endif
 #  ifndef CURL_DISABLE_IMAP
-#    define CURL_DISABLE_IMAP
+#  define CURL_DISABLE_IMAP
 #  endif
 #  ifndef CURL_DISABLE_LDAP
-#    define CURL_DISABLE_LDAP
+#  define CURL_DISABLE_LDAP
 #  endif
 #  ifndef CURL_DISABLE_LDAPS
-#    define CURL_DISABLE_LDAPS
+#  define CURL_DISABLE_LDAPS
 #  endif
 #  ifndef CURL_DISABLE_MQTT
-#    define CURL_DISABLE_MQTT
+#  define CURL_DISABLE_MQTT
 #  endif
 #  ifndef CURL_DISABLE_POP3
-#    define CURL_DISABLE_POP3
+#  define CURL_DISABLE_POP3
 #  endif
 #  ifndef CURL_DISABLE_RTSP
-#    define CURL_DISABLE_RTSP
-#  endif
-#  ifndef CURL_DISABLE_SMB
-#    define CURL_DISABLE_SMB
+#  define CURL_DISABLE_RTSP
 #  endif
 #  ifndef CURL_DISABLE_SMTP
-#    define CURL_DISABLE_SMTP
+#  define CURL_DISABLE_SMTP
 #  endif
 #  ifndef CURL_DISABLE_TELNET
-#    define CURL_DISABLE_TELNET
+#  define CURL_DISABLE_TELNET
 #  endif
 #  ifndef CURL_DISABLE_TFTP
-#    define CURL_DISABLE_TFTP
+#  define CURL_DISABLE_TFTP
+#  endif
+#  ifndef CURL_DISABLE_WEBSOCKETS
+#  define CURL_DISABLE_WEBSOCKETS
 #  endif
 #endif
 
 /*
  * When http is disabled rtsp is not supported.
  */
-
 #if defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_RTSP)
 #  define CURL_DISABLE_RTSP
 #endif
 
+/*
+ * When HTTP is disabled, disable HTTP-only features
+ */
+#ifdef CURL_DISABLE_HTTP
+#  ifndef CURL_DISABLE_ALTSVC
+#  define CURL_DISABLE_ALTSVC
+#  endif
+#  ifndef CURL_DISABLE_COOKIES
+#  define CURL_DISABLE_COOKIES
+#  endif
+#  ifndef CURL_DISABLE_BASIC_AUTH
+#  define CURL_DISABLE_BASIC_AUTH
+#  endif
+#  ifndef CURL_DISABLE_BEARER_AUTH
+#  define CURL_DISABLE_BEARER_AUTH
+#  endif
+#  ifndef CURL_DISABLE_AWS
+#  define CURL_DISABLE_AWS
+#  endif
+#  ifndef CURL_DISABLE_DOH
+#  define CURL_DISABLE_DOH
+#  endif
+#  ifndef CURL_DISABLE_FORM_API
+#  define CURL_DISABLE_FORM_API
+#  endif
+#  ifndef CURL_DISABLE_HEADERS_API
+#  define CURL_DISABLE_HEADERS_API
+#  endif
+#  ifndef CURL_DISABLE_HSTS
+#  define CURL_DISABLE_HSTS
+#  endif
+#  ifndef CURL_DISABLE_HTTP_AUTH
+#  define CURL_DISABLE_HTTP_AUTH
+#  endif
+#  ifndef CURL_DISABLE_WEBSOCKETS
+#  define CURL_DISABLE_WEBSOCKETS /* no WebSockets without HTTP present */
+#  endif
+#endif
+
 /* ================================================================ */
 /* No system header file shall be included in this file before this */
 /* point.                                                           */
@@ -227,7 +326,6 @@
 /*
  * OS/400 setup file includes some system headers.
  */
-
 #ifdef __OS400__
 #  include "setup-os400.h"
 #endif
@@ -235,7 +333,6 @@
 /*
  * VMS setup file includes some system headers.
  */
-
 #ifdef __VMS
 #  include "setup-vms.h"
 #endif
@@ -243,38 +340,90 @@
 /*
  * Windows setup file includes some system headers.
  */
-
-#ifdef HAVE_WINDOWS_H
+#ifdef _WIN32
 #  include "setup-win32.h"
 #endif
 
 #include <curl/system.h>
 
+/* Helper macro to expand and concatenate two macros.
+ * Direct macros concatenation does not work because macros
+ * are not expanded before direct concatenation.
+ */
+#define CURL_CONC_MACROS_(A, B) A ## B
+#define CURL_CONC_MACROS(A, B) CURL_CONC_MACROS_(A, B)
+
+/* curl uses its own printf() function internally. It understands the GNU
+ * format. Use this format, so that it matches the GNU format attribute we
+ * use with the MinGW compiler, allowing it to verify them at compile-time.
+ */
+#ifdef __MINGW32__
+#  undef CURL_FORMAT_CURL_OFF_T
+#  undef CURL_FORMAT_CURL_OFF_TU
+#  define CURL_FORMAT_CURL_OFF_T   "lld"
+#  define CURL_FORMAT_CURL_OFF_TU  "llu"
+#endif
+
+/* based on logic in "curl/mprintf.h" */
+#if (defined(__GNUC__) || defined(__clang__) ||                 \
+     defined(__IAR_SYSTEMS_ICC__)) &&                           \
+  defined(__STDC_VERSION__) && (__STDC_VERSION__ >= 199901L) && \
+  !defined(CURL_NO_FMT_CHECKS)
+#if defined(__MINGW32__) && !defined(__clang__)
+#define CURL_PRINTF(fmt, arg) __attribute__((format(gnu_printf, fmt, arg)))
+#else
+#define CURL_PRINTF(fmt, arg) __attribute__((format(__printf__, fmt, arg)))
+#endif
+#else
+#define CURL_PRINTF(fmt, arg)
+#endif
+
+/* Override default printf mask check rules in "curl/mprintf.h" */
+#define CURL_TEMP_PRINTF CURL_PRINTF
+
+/* Workaround for mainline llvm v16 and earlier missing a built-in macro
+   expected by macOS SDK v14 / Xcode v15 (2023) and newer.
+   gcc (as of v14) is also missing it. */
+#if defined(__APPLE__) &&                                   \
+  ((!defined(__apple_build_version__) &&                    \
+    defined(__clang__) && __clang_major__ < 17) ||          \
+   (defined(__GNUC__) && __GNUC__ <= 14)) &&                \
+  defined(__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__) && \
+  !defined(__ENVIRONMENT_OS_VERSION_MIN_REQUIRED__)
+#define __ENVIRONMENT_OS_VERSION_MIN_REQUIRED__ \
+  __ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__
+#endif
+
 /*
  * Use getaddrinfo to resolve the IPv4 address literal. If the current network
- * interface doesn't support IPv4, but supports IPv6, NAT64, and DNS64,
+ * interface does not support IPv4, but supports IPv6, NAT64, and DNS64,
  * performing this task will result in a synthesized IPv6 address.
  */
 #if defined(__APPLE__) && !defined(USE_ARES)
-#include <TargetConditionals.h>
-#define USE_RESOLVE_ON_IPS 1
+#  define USE_RESOLVE_ON_IPS 1
 #  if TARGET_OS_MAC && !(defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE) && \
-     defined(ENABLE_IPV6)
+     defined(USE_IPV6)
 #    define CURL_MACOS_CALL_COPYPROXIES 1
 #  endif
 #endif
 
+#ifdef USE_ARES
+#  ifndef CARES_NO_DEPRECATED
+#  define CARES_NO_DEPRECATED  /* for ares_getsock() */
+#  endif
+#  if defined(CURL_STATICLIB) && !defined(CARES_STATICLIB) && defined(_WIN32)
+#    define CARES_STATICLIB  /* define it before including ares.h */
+#  endif
+#endif
+
 #ifdef USE_LWIPSOCK
 #  include <lwip/init.h>
 #  include <lwip/sockets.h>
 #  include <lwip/netdb.h>
 #endif
 
-#ifdef HAVE_EXTRA_STRICMP_H
+#ifdef macintosh
 #  include <extra/stricmp.h>
-#endif
-
-#ifdef HAVE_EXTRA_STRDUP_H
 #  include <extra/strdup.h>
 #endif
 
@@ -288,7 +437,7 @@
 #    if !(defined(__NEWLIB__) || \
           (defined(__CLIB2__) && defined(__THREAD_SAFE)))
        /* disable threaded resolver with clib2 - requires newlib or clib-ts */
-#      undef USE_THREADS_POSIX
+#      undef USE_RESOLV_THREADED
 #    endif
 #  endif
 #  include <exec/types.h>
@@ -304,15 +453,15 @@
 #    ifdef __amigaos4__
        int Curl_amiga_select(int nfds, fd_set *readfds, fd_set *writefds,
                              fd_set *errorfds, struct timeval *timeout);
-#      define select(a,b,c,d,e) Curl_amiga_select(a,b,c,d,e)
+#      define select(a, b, c, d, e) Curl_amiga_select(a, b, c, d, e)
 #    else
-#      define select(a,b,c,d,e) WaitSelect(a,b,c,d,e,0)
+#      define select(a, b, c, d, e) WaitSelect(a, b, c, d, e, 0)
 #    endif
      /* must not use libc's fcntl() on bsdsocket.library sockfds! */
 #    undef HAVE_FCNTL
 #    undef HAVE_FCNTL_O_NONBLOCK
 #  else
-     /* use libc networking and hence close() and fnctl() */
+     /* use libc networking and hence close() and fcntl() */
 #    undef HAVE_CLOSESOCKET_CAMEL
 #    undef HAVE_IOCTLSOCKET_CAMEL
 #  endif
@@ -323,110 +472,105 @@
 #  define __NO_NET_API
 #endif
 
+/* Whether to use eventfd() */
+#if defined(HAVE_EVENTFD) && defined(HAVE_SYS_EVENTFD_H)
+#define USE_EVENTFD
+#endif
+
+#ifdef SO_NOSIGPIPE
+#define USE_SO_NOSIGPIPE
+#endif
+
 #include <stdio.h>
 #include <assert.h>
 
 #ifdef __TANDEM /* for ns*-tandem-nsk systems */
-# if ! defined __LP64
-#  include <floss.h> /* FLOSS is only used for 32-bit builds. */
-# endif
+#  ifndef __LP64
+#    include <floss.h> /* FLOSS is only used for 32-bit builds. */
+#  endif
 #endif
 
 #ifndef STDC_HEADERS /* no standard C headers! */
 #include <curl/stdcheaders.h>
 #endif
 
-#ifdef __POCC__
-#  include <sys/types.h>
-#  include <unistd.h>
-#  define sys_nerr EILSEQ
+#include <stdint.h>
+#define HAVE_UINTPTR_T  /* assume uintptr_t is provided by stdint.h */
+
+#ifdef __DJGPP__
+/* By default, DJGPP provides this type as a version of 'unsigned long' which
+   forces us to use a define use it in printf() format strings without
+   warnings. long and int are both 32 bits for this platform. */
+#define uint32_t unsigned int
 #endif
 
-/*
- * Salford-C kludge section (mostly borrowed from wxWidgets).
- */
-#ifdef __SALFORDC__
-  #pragma suppress 353             /* Possible nested comments */
-  #pragma suppress 593             /* Define not used */
-  #pragma suppress 61              /* enum has no name */
-  #pragma suppress 106             /* unnamed, unused parameter */
-  #include <clib.h>
+/* Disable uintptr_t for targets known to miss it from stdint.h */
+#ifdef __OS400__
+#undef HAVE_UINTPTR_T
 #endif
 
-/*
- * Large file (>2Gb) support using WIN32 functions.
- */
+#include <limits.h>
 
-#ifdef USE_WIN32_LARGE_FILES
+#ifdef _WIN32
+#  ifdef HAVE_IO_H
 #  include <io.h>
-#  include <sys/types.h>
-#  include <sys/stat.h>
-#  undef  lseek
-#  define lseek(fdes,offset,whence)  _lseeki64(fdes, offset, whence)
-#  undef  fstat
-#  define fstat(fdes,stp)            _fstati64(fdes, stp)
-#  undef  stat
-#  define stat(fname,stp)            curlx_win32_stat(fname, stp)
-#  define struct_stat                struct _stati64
-#  define LSEEK_ERROR                (__int64)-1
-#  define open                       curlx_win32_open
-#  define fopen(fname,mode)          curlx_win32_fopen(fname, mode)
-#  define access(fname,mode)         curlx_win32_access(fname, mode)
-   int curlx_win32_open(const char *filename, int oflag, ...);
-   int curlx_win32_stat(const char *path, struct_stat *buffer);
-   FILE *curlx_win32_fopen(const char *filename, const char *mode);
-   int curlx_win32_access(const char *path, int mode);
-#endif
-
-/*
- * Small file (<2Gb) support using WIN32 functions.
- */
-
-#ifdef USE_WIN32_SMALL_FILES
-#  include <io.h>
-#  include <sys/types.h>
-#  include <sys/stat.h>
-#  ifndef _WIN32_WCE
-#    undef  lseek
-#    define lseek(fdes,offset,whence)  _lseek(fdes, (long)offset, whence)
-#    define fstat(fdes,stp)            _fstat(fdes, stp)
-#    define stat(fname,stp)            curlx_win32_stat(fname, stp)
-#    define struct_stat                struct _stat
-#    define open                       curlx_win32_open
-#    define fopen(fname,mode)          curlx_win32_fopen(fname, mode)
-#    define access(fname,mode)         curlx_win32_access(fname, mode)
-     int curlx_win32_stat(const char *path, struct_stat *buffer);
-     int curlx_win32_open(const char *filename, int oflag, ...);
-     FILE *curlx_win32_fopen(const char *filename, const char *mode);
-     int curlx_win32_access(const char *path, int mode);
 #  endif
-#  define LSEEK_ERROR                (long)-1
-#endif
-
-#ifndef struct_stat
-#  define struct_stat struct stat
-#endif
-
-#ifndef LSEEK_ERROR
-#  define LSEEK_ERROR (off_t)-1
+#  include <sys/types.h>
+#  include <sys/stat.h>
+   /* Large file (>2Gb) support using Win32 functions. */
+#  define curl_lseek                      _lseeki64
+#  define LSEEK_ERROR                     ((__int64)-1)
+#elif defined(__DJGPP__)
+   /* Requires DJGPP 2.04 */
+#  include <unistd.h>
+#  define curl_lseek                      llseek
+#  define LSEEK_ERROR                     ((offset_t)-1)
+#elif defined(__AMIGA__)
+#  define curl_lseek(fd, offset, whence)  lseek(fd, (off_t)(offset), whence)
+#  define LSEEK_ERROR                     ((off_t)-1)
+#else
+#  define curl_lseek                      lseek
+#  define LSEEK_ERROR                     ((off_t)-1)
 #endif
 
 #ifndef SIZEOF_TIME_T
-/* assume default size of time_t to be 32 bit */
+/* assume default size of time_t to be 32 bits */
 #define SIZEOF_TIME_T 4
 #endif
 
+#ifndef SIZEOF_CURL_SOCKET_T
+/* configure and cmake check and set the define */
+#  if defined(USE_WINSOCK) && defined(_WIN64)
+#    define SIZEOF_CURL_SOCKET_T 8
+#  else
+/* default guess */
+#    define SIZEOF_CURL_SOCKET_T 4
+#  endif
+#endif
+
+#if SIZEOF_CURL_SOCKET_T < 8
+#ifdef USE_WINSOCK
+#  define FMT_SOCKET_T "u"
+#else
+#  define FMT_SOCKET_T "d"
+#endif
+#elif defined(USE_WINSOCK)
+#  define FMT_SOCKET_T "zu"
+#else
+#  define FMT_SOCKET_T "qd"
+#endif
+
 /*
- * Default sizeof(off_t) in case it hasn't been defined in config file.
+ * Default sizeof(off_t) in case it has not been defined in config file.
  */
 
 #ifndef SIZEOF_OFF_T
 #  if defined(__VMS) && !defined(__VAX)
-#    if defined(_LARGEFILE)
+#    ifdef _LARGEFILE
 #      define SIZEOF_OFF_T 8
 #    endif
 #  elif defined(__OS400__) && defined(__ILEC400__)
-#    if defined(_LARGE_FILES)
+#    ifdef _LARGE_FILES
 #      define SIZEOF_OFF_T 8
 #    endif
 #  elif defined(__MVS__) && defined(__IBMC__)
@@ -439,19 +583,22 @@
 #    endif
 #  endif
 #  ifndef SIZEOF_OFF_T
-#    define SIZEOF_OFF_T 4
+#  define SIZEOF_OFF_T 4
 #  endif
 #endif
 
-#if (SIZEOF_CURL_OFF_T < 8)
+#if SIZEOF_CURL_OFF_T < 8
 #error "too small curl_off_t"
 #else
    /* assume SIZEOF_CURL_OFF_T == 8 */
-#  define CURL_OFF_T_MAX CURL_OFF_T_C(0x7FFFFFFFFFFFFFFF)
+#  define CURL_OFF_T_MAX 0x7FFFFFFFFFFFFFFF
 #endif
-#define CURL_OFF_T_MIN (-CURL_OFF_T_MAX - CURL_OFF_T_C(1))
+#define CURL_OFF_T_MIN (-CURL_OFF_T_MAX - 1)
 
-#if (SIZEOF_TIME_T == 4)
+#define FMT_OFF_T  CURL_FORMAT_CURL_OFF_T
+#define FMT_OFF_TU CURL_FORMAT_CURL_OFF_TU
+
+#if SIZEOF_TIME_T == 4
 #  ifdef HAVE_TIME_T_UNSIGNED
 #  define TIME_T_MAX UINT_MAX
 #  define TIME_T_MIN 0
@@ -469,28 +616,31 @@
 #  endif
 #endif
 
-#ifndef SIZE_T_MAX
-/* some limits.h headers have this defined, some don't */
+#ifndef SIZE_MAX
+/* some limits.h headers have this defined, some do not */
 #if defined(SIZEOF_SIZE_T) && (SIZEOF_SIZE_T > 4)
-#define SIZE_T_MAX 18446744073709551615U
+#define SIZE_MAX 18446744073709551615U
 #else
-#define SIZE_T_MAX 4294967295U
+#define SIZE_MAX 4294967295U
 #endif
 #endif
 
-#ifndef SSIZE_T_MAX
-/* some limits.h headers have this defined, some don't */
+#ifndef SSIZE_MAX
+/* some limits.h headers have this defined, some do not */
 #if defined(SIZEOF_SIZE_T) && (SIZEOF_SIZE_T > 4)
-#define SSIZE_T_MAX 9223372036854775807
+#define SSIZE_MAX 9223372036854775807
 #else
-#define SSIZE_T_MAX 2147483647
+#define SSIZE_MAX 2147483647
 #endif
 #endif
 
+#if SIZEOF_LONG > SIZEOF_SIZE_T
+#error "unexpected: 'long' is larger than 'size_t'"
+#endif
+
 /*
- * Arg 2 type for gethostname in case it hasn't been defined in config file.
+ * Arg 2 type for gethostname in case it has not been defined in config file.
  */
-
 #ifndef GETHOSTNAME_TYPE_ARG2
 #  ifdef USE_WINSOCK
 #    define GETHOSTNAME_TYPE_ARG2 int
@@ -500,60 +650,44 @@
 #endif
 
 /* Below we define some functions. They should
-
    4. set the SIGALRM signal timeout
    5. set dir/file naming defines
-   */
+ */
 
-#ifdef WIN32
+#ifdef _WIN32
 
 #  define DIR_CHAR      "\\"
 
-#else /* WIN32 */
+#else /* _WIN32 */
 
 #  ifdef MSDOS  /* Watt-32 */
 
 #    include <sys/ioctl.h>
-#    define select(n,r,w,x,t) select_s(n,r,w,x,t)
-#    define ioctl(x,y,z) ioctlsocket(x,y,(char *)(z))
+#    define select(n, r, w, x, t)  select_s(n, r, w, x, t)
+#    define ioctl(x, y, z)         ioctlsocket(x, y, (char *)(z))
 #    include <tcp.h>
-#    ifdef word
-#      undef word
-#    endif
-#    ifdef byte
-#      undef byte
-#    endif
+#    undef word
+#    undef byte
 
 #  endif /* MSDOS */
 
 #  ifdef __minix
      /* Minix 3 versions up to at least 3.1.3 are missing these prototypes */
-     extern char *strtok_r(char *s, const char *delim, char **last);
      extern struct tm *gmtime_r(const time_t * const timep, struct tm *tmp);
 #  endif
 
 #  define DIR_CHAR      "/"
 
-#  ifndef fileno /* sunos 4 have this as a macro! */
-     int fileno(FILE *stream);
-#  endif
+#endif /* _WIN32 */
 
-#endif /* WIN32 */
+/* We want to use mutex when available. */
+#if defined(HAVE_THREADS_POSIX) || defined(_WIN32)
+#define USE_MUTEX
+#endif
 
-/*
- * msvc 6.0 requires PSDK in order to have INET6_ADDRSTRLEN
- * defined in ws2tcpip.h as well as to provide IPv6 support.
- * Does not apply if lwIP is used.
- */
-
-#if defined(_MSC_VER) && !defined(__POCC__) && !defined(USE_LWIPSOCK)
-#  if !defined(HAVE_WS2TCPIP_H) || \
-     ((_MSC_VER < 1300) && !defined(INET6_ADDRSTRLEN))
-#    undef HAVE_GETADDRINFO_THREADSAFE
-#    undef HAVE_FREEADDRINFO
-#    undef HAVE_GETADDRINFO
-#    undef ENABLE_IPV6
-#  endif
+/* threaded resolver is the only feature requiring threads. */
+#ifdef USE_RESOLV_THREADED
+#define USE_THREADS
 #endif
 
 /* ---------------------------------------------------------------- */
@@ -561,114 +695,76 @@
 /*         CURLRES_* defines to use in the host*.c sources          */
 /* ---------------------------------------------------------------- */
 
-/*
- * lcc-win32 doesn't have _beginthreadex(), lacks threads support.
- */
-
-#if defined(__LCC__) && defined(WIN32)
-#  undef USE_THREADS_POSIX
-#  undef USE_THREADS_WIN32
-#endif
-
-/*
- * MSVC threads support requires a multi-threaded runtime library.
- * _beginthreadex() is not available in single-threaded ones.
- */
-
-#if defined(_MSC_VER) && !defined(__POCC__) && !defined(_MT)
-#  undef USE_THREADS_POSIX
-#  undef USE_THREADS_WIN32
-#endif
-
 /*
  * Mutually exclusive CURLRES_* definitions.
  */
-
-#if defined(ENABLE_IPV6) && defined(HAVE_GETADDRINFO)
+#if defined(USE_IPV6) && defined(HAVE_GETADDRINFO)
 #  define CURLRES_IPV6
+#elif defined(USE_IPV6) && (defined(_WIN32) || defined(__CYGWIN__))
+/* assume on Windows that IPv6 without getaddrinfo is a broken build */
+#  error "Unexpected build: IPv6 is enabled but getaddrinfo was not found."
 #else
 #  define CURLRES_IPV4
 #endif
 
-#ifdef USE_ARES
+#ifdef USE_RESOLV_THREADED
 #  define CURLRES_ASYNCH
-#  define CURLRES_ARES
-/* now undef the stock libc functions just to avoid them being used */
+#elif defined(USE_RESOLV_ARES)
+#  define CURLRES_ASYNCH
+/* now undef the stock libc functions to avoid them being used */
 #  undef HAVE_GETADDRINFO
 #  undef HAVE_FREEADDRINFO
-#elif defined(USE_THREADS_POSIX) || defined(USE_THREADS_WIN32)
-#  define CURLRES_ASYNCH
-#  define CURLRES_THREADED
 #else
 #  define CURLRES_SYNCH
 #endif
 
 /* ---------------------------------------------------------------- */
 
-/*
- * msvc 6.0 does not have struct sockaddr_storage and
- * does not define IPPROTO_ESP in winsock2.h. But both
- * are available if PSDK is properly installed.
- */
-
-#if defined(_MSC_VER) && !defined(__POCC__)
-#  if !defined(HAVE_WINSOCK2_H) || ((_MSC_VER < 1300) && !defined(IPPROTO_ESP))
-#    undef HAVE_STRUCT_SOCKADDR_STORAGE
-#  endif
-#endif
-
-/*
- * Intentionally fail to build when using msvc 6.0 without PSDK installed.
- * The brave of heart can circumvent this, defining ALLOW_MSVC6_WITHOUT_PSDK
- * in lib/config-win32.h although absolutely discouraged and unsupported.
- */
-
-#if defined(_MSC_VER) && !defined(__POCC__)
-#  if !defined(HAVE_WINDOWS_H) || ((_MSC_VER < 1300) && !defined(_FILETIME_))
-#    if !defined(ALLOW_MSVC6_WITHOUT_PSDK)
-#      error MSVC 6.0 requires "February 2003 Platform SDK" a.k.a. \
-             "Windows Server 2003 PSDK"
-#    else
-#      define CURL_DISABLE_LDAP 1
-#    endif
-#  endif
-#endif
-
-#if defined(HAVE_LIBIDN2) && defined(HAVE_IDN2_H) && !defined(USE_WIN32_IDN)
+#if defined(HAVE_LIBIDN2) && defined(HAVE_IDN2_H) && \
+  !defined(USE_WIN32_IDN) && !defined(USE_APPLE_IDN)
 /* The lib and header are present */
 #define USE_LIBIDN2
 #endif
 
-#if defined(USE_LIBIDN2) && defined(USE_WIN32_IDN)
-#error "Both libidn2 and WinIDN are enabled, choose one."
+#if defined(USE_LIBIDN2) && (defined(USE_WIN32_IDN) || defined(USE_APPLE_IDN))
+#error "libidn2 cannot be enabled with WinIDN or AppleIDN, choose one."
 #endif
 
-#define LIBIDN_REQUIRED_VERSION "0.4.1"
-
 #if defined(USE_GNUTLS) || defined(USE_OPENSSL) || defined(USE_MBEDTLS) || \
-  defined(USE_WOLFSSL) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
-  defined(USE_BEARSSL) || defined(USE_RUSTLS)
+  defined(USE_WOLFSSL) || defined(USE_SCHANNEL) || defined(USE_RUSTLS)
 #define USE_SSL    /* SSL support has been enabled */
 #endif
 
+#if defined(USE_OPENSSL) && defined(USE_WOLFSSL)
+#ifndef OPENSSL_COEXIST
+#define OPENSSL_COEXIST
+#endif
+#endif
+
+#if defined(USE_WOLFSSL) && defined(USE_GNUTLS)
+/* Avoid defining unprefixed wolfSSL SHA macros colliding with nettle ones */
+#define NO_OLD_WC_NAMES
+#endif
+
 /* Single point where USE_SPNEGO definition might be defined */
-#if !defined(CURL_DISABLE_NEGOTIATE_AUTH) && \
-    (defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI))
+#if !defined(CURL_DISABLE_NEGOTIATE_AUTH) &&          \
+  (defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI))
 #define USE_SPNEGO
 #endif
 
 /* Single point where USE_KERBEROS5 definition might be defined */
-#if !defined(CURL_DISABLE_KERBEROS_AUTH) && \
-    (defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI))
+#if !defined(CURL_DISABLE_KERBEROS_AUTH) &&           \
+  (defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI))
 #define USE_KERBEROS5
 #endif
 
 /* Single point where USE_NTLM definition might be defined */
-#if !defined(CURL_DISABLE_NTLM)
-#  if defined(USE_OPENSSL) || defined(USE_MBEDTLS) ||                   \
-  defined(USE_GNUTLS) || defined(USE_SECTRANSP) ||                      \
-  defined(USE_OS400CRYPTO) || defined(USE_WIN32_CRYPTO) ||              \
-  (defined(USE_WOLFSSL) && defined(HAVE_WOLFSSL_DES_ECB_ENCRYPT))
+#ifdef CURL_ENABLE_NTLM
+#  if (defined(USE_OPENSSL) && defined(HAVE_DES_ECB_ENCRYPT)) ||   \
+  defined(USE_GNUTLS) ||                                           \
+  (defined(USE_MBEDTLS) && defined(HAVE_MBEDTLS_DES_CRYPT_ECB)) || \
+  defined(USE_OS400CRYPTO) || defined(USE_WIN32_CRYPTO) ||         \
+  (defined(USE_WOLFSSL) && defined(HAVE_WC_DES_ECBENCRYPT))
 #    define USE_CURL_NTLM_CORE
 #  endif
 #  if defined(USE_CURL_NTLM_CORE) || defined(USE_WINDOWS_SSPI)
@@ -676,12 +772,18 @@
 #  endif
 #endif
 
-#ifdef CURL_WANTS_CA_BUNDLE_ENV
-#error "No longer supported. Set CURLOPT_CAINFO at runtime instead."
+#if defined(USE_LIBSSH2) || defined(USE_LIBSSH)
+#define USE_SSH
 #endif
 
-#if defined(USE_LIBSSH2) || defined(USE_LIBSSH) || defined(USE_WOLFSSH)
-#define USE_SSH
+/* GCC <4.6 does not support '#pragma GCC diagnostic push' and does not support
+   'pragma GCC diagnostic' inside functions.
+   Use CURL_HAVE_DIAG to guard the above in the curl codebase, instead of
+   defined(__GNUC__) || defined(__clang__).
+ */
+#if defined(__clang__) || (defined(__GNUC__) && \
+  ((__GNUC__ > 4) || ((__GNUC__ == 4) && (__GNUC_MINOR__ >= 6))))
+#define CURL_HAVE_DIAG
 #endif
 
 /*
@@ -689,49 +791,416 @@
  * Parameters should of course normally not be unused, but for example when
  * we have multiple implementations of the same interface it may happen.
  */
-
 #if defined(__GNUC__) && ((__GNUC__ >= 3) || \
   ((__GNUC__ == 2) && defined(__GNUC_MINOR__) && (__GNUC_MINOR__ >= 7)))
-#  define UNUSED_PARAM __attribute__((__unused__))
+#  define WARN_UNUSED_RESULT __attribute__((warn_unused_result))
+#elif defined(__IAR_SYSTEMS_ICC__) && (__VER__ >= 9040001)
 #  define WARN_UNUSED_RESULT __attribute__((warn_unused_result))
 #else
-#  define UNUSED_PARAM /* NOTHING */
 #  define WARN_UNUSED_RESULT
 #endif
 
+/* noreturn attribute */
+
+#ifndef CURL_NORETURN
+#if (defined(__GNUC__) && (__GNUC__ >= 3)) || defined(__clang__) || \
+  defined(__IAR_SYSTEMS_ICC__)
+#  define CURL_NORETURN  __attribute__((__noreturn__))
+#elif defined(_MSC_VER)
+#  define CURL_NORETURN  __declspec(noreturn)
+#else
+#  define CURL_NORETURN
+#endif
+#endif
+
+/* fallthrough attribute */
+
+#ifndef FALLTHROUGH
+#if (defined(__GNUC__) && __GNUC__ >= 7) ||     \
+  (defined(__clang__) && __clang_major__ >= 10)
+#  define FALLTHROUGH()  __attribute__((fallthrough))
+#else
+#  define FALLTHROUGH()  do {} while(0)
+#endif
+#endif
+
 /*
- * Include macros and defines that should only be processed once.
+ * Inclusion of common header files.
  */
 
-#ifndef HEADER_CURL_SETUP_ONCE_H
-#include "curl_setup_once.h"
+#include <stdlib.h>
+#include <string.h>
+#include <stdarg.h>
+#include <time.h>
+#include <errno.h>
+
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+
+#include <sys/stat.h>
+
+#if !defined(_WIN32) || defined(__MINGW32__)
+#include <sys/time.h>
+#endif
+
+#ifdef HAVE_IO_H
+#include <io.h>
+#endif
+
+#ifdef HAVE_FCNTL_H
+#include <fcntl.h>
+#endif
+
+#if defined(HAVE_STDBOOL_H) && defined(HAVE_BOOL_T)
+#include <stdbool.h>
+#endif
+
+#ifdef HAVE_UNISTD_H
+#include <unistd.h>
+#endif
+
+/* Macro to strip 'const' without triggering a compiler warning.
+   Use it for APIs that do not or cannot support the const qualifier. */
+#ifdef HAVE_UINTPTR_T
+#define CURL_UNCONST(p) ((void *)(uintptr_t)(const void *)(p))
+#else
+#define CURL_UNCONST(p) ((void *)(p))  /* Fall back to simple cast */
+#endif
+
+#ifdef USE_SCHANNEL
+/* Must set this before <schannel.h> is included directly or indirectly by
+   another Windows header. */
+#  define SCHANNEL_USE_BLACKLISTS  /* for SCH_CREDENTIALS */
+#  include <subauth.h>  /* for [P]UNICODE_STRING in SCH_CREDENTIALS */
+#endif
+
+#ifdef __hpux
+#  if !defined(_XOPEN_SOURCE_EXTENDED) || defined(_KERNEL)
+#    ifdef _APP32_64BIT_OFF_T
+#      define OLD_APP32_64BIT_OFF_T _APP32_64BIT_OFF_T
+#      undef _APP32_64BIT_OFF_T
+#    else
+#      undef OLD_APP32_64BIT_OFF_T
+#    endif
+#  endif
+#endif
+
+#ifndef _WIN32
+#include <sys/socket.h>  /* also for MSG_NOSIGNAL */
+#endif
+
+#include "functypes.h"
+
+#ifdef __hpux
+#  if !defined(_XOPEN_SOURCE_EXTENDED) || defined(_KERNEL)
+#    ifdef OLD_APP32_64BIT_OFF_T
+#      define _APP32_64BIT_OFF_T OLD_APP32_64BIT_OFF_T
+#      undef OLD_APP32_64BIT_OFF_T
+#    endif
+#  endif
+#endif
+
+/*
+ * Definition of timeval struct for platforms that do not have it.
+ */
+#ifndef HAVE_STRUCT_TIMEVAL
+struct timeval {
+  long tv_sec;
+  long tv_usec;
+};
+#endif
+
+/*
+ * If we have the MSG_NOSIGNAL define, make sure we use
+ * it as the fourth argument of function send()
+ */
+#ifdef MSG_NOSIGNAL
+#define SEND_4TH_ARG MSG_NOSIGNAL
+#else
+#define SEND_4TH_ARG 0
+#endif
+
+#ifdef __minix
+/* Minix does not support recv on TCP sockets */
+#define sread(x, y, z) (ssize_t)read((RECV_TYPE_ARG1)(x), \
+                                     (RECV_TYPE_ARG2)(y), \
+                                     (RECV_TYPE_ARG3)(z))
+
+#elif defined(HAVE_RECV)
+/*
+ * The definitions for the return type and arguments types
+ * of functions recv() and send() belong and come from the
+ * configuration file. Do not define them in any other place.
+ *
+ * HAVE_RECV is defined if you have a function named recv()
+ * which is used to read incoming data from sockets. If your
+ * function has another name then do not define HAVE_RECV.
+ *
+ * If HAVE_RECV is defined then RECV_TYPE_ARG1, RECV_TYPE_ARG2,
+ * RECV_TYPE_ARG3, RECV_TYPE_ARG4 and RECV_TYPE_RETV must also
+ * be defined.
+ *
+ * HAVE_SEND is defined if you have a function named send()
+ * which is used to write outgoing data on a connected socket.
+ * If yours has another name then do not define HAVE_SEND.
+ *
+ * If HAVE_SEND is defined then SEND_TYPE_ARG1, SEND_TYPE_ARG2,
+ * SEND_TYPE_ARG3, SEND_TYPE_ARG4 and SEND_TYPE_RETV must also
+ * be defined. SEND_NONCONST_ARG2 must also be defined if ARG2
+ * does not accept const.
+ */
+
+#define sread(x, y, z) (ssize_t)recv((RECV_TYPE_ARG1)(x), \
+                                     (RECV_TYPE_ARG2)(y), \
+                                     (RECV_TYPE_ARG3)(z), \
+                                     (RECV_TYPE_ARG4)(0))
+#else /* HAVE_RECV */
+#ifndef sread
+#error "Missing definition of macro sread!"
+#endif
+#endif /* HAVE_RECV */
+
+#ifdef __minix
+/* Minix does not support send on TCP sockets */
+#define swrite(x, y, z) (ssize_t)write((SEND_TYPE_ARG1)(x), \
+                                       (SEND_TYPE_ARG2)CURL_UNCONST(y), \
+                                       (SEND_TYPE_ARG3)(z))
+#elif defined(HAVE_SEND)
+#ifdef SEND_NONCONST_ARG2
+#define swrite(x, y, z) (ssize_t)send((SEND_TYPE_ARG1)(x), \
+                                      (SEND_TYPE_ARG2)CURL_UNCONST(y), \
+                                      (SEND_TYPE_ARG3)(z), \
+                                      (SEND_TYPE_ARG4)(SEND_4TH_ARG))
+#else
+#define swrite(x, y, z) (ssize_t)send((SEND_TYPE_ARG1)(x), \
+                                      (const SEND_TYPE_ARG2)(y), \
+                                      (SEND_TYPE_ARG3)(z), \
+                                      (SEND_TYPE_ARG4)(SEND_4TH_ARG))
+#endif /* SEND_NONCONST_ARG2 */
+#else /* HAVE_SEND */
+#ifndef swrite
+#error "Missing definition of macro swrite!"
+#endif
+#endif /* HAVE_SEND */
+
+/*
+ * Function-like macro definition used to close a socket.
+ */
+#ifdef HAVE_CLOSESOCKET
+#  define CURL_SCLOSE(x)  closesocket(x)
+#elif defined(HAVE_CLOSESOCKET_CAMEL)
+#  define CURL_SCLOSE(x)  CloseSocket(x)
+#elif defined(MSDOS)  /* Watt-32 */
+#  define CURL_SCLOSE(x)  close_s(x)
+#elif defined(USE_LWIPSOCK)
+#  define CURL_SCLOSE(x)  lwip_close(x)
+#else
+#  define CURL_SCLOSE(x)  close(x)
+#endif
+
+/*
+ * Stack-independent version of fcntl() on sockets:
+ */
+#ifdef USE_LWIPSOCK
+#  define sfcntl  lwip_fcntl
+#else
+#  define sfcntl  fcntl
+#endif
+
+/*
+ * 'bool' stuff compatible with HP-UX headers.
+ */
+#if defined(__hpux) && !defined(HAVE_BOOL_T)
+typedef int bool;
+#  define false 0
+#  define true 1
+#  define HAVE_BOOL_T
+#endif
+
+/*
+ * 'bool' exists on platforms with <stdbool.h>, i.e. C99 platforms.
+ * On non-C99 platforms there is no bool, so define an enum for that.
+ * On C99 platforms 'false' and 'true' also exist. Enum uses a
+ * global namespace though, so use bool_false and bool_true.
+ */
+#ifndef HAVE_BOOL_T
+typedef enum {
+  bool_false = 0,
+  bool_true = 1
+} bool;
+
+/*
+ * Use a define to let 'true' and 'false' use those enums. There
+ * are currently no use of true and false in libcurl proper, but
+ * there are some in the examples. This will cater for any later
+ * code happening to use true and false.
+ */
+#  define false bool_false
+#  define true  bool_true
+#  define HAVE_BOOL_T
+#endif
+
+/* the type we use for storing a single boolean bit */
+typedef unsigned int curl_bit;
+#define BIT(x) curl_bit x:1
+
+/*
+ * Redefine TRUE and FALSE too, to catch current use. With this
+ * change, 'bool found = 1' will give a warning on MIPSPro, but
+ * 'bool found = TRUE' will not. Change tested on IRIX/MIPSPro,
+ * AIX 5.1/Xlc, Tru64 5.1/cc, w/make test too.
+ */
+#ifndef TRUE
+#define TRUE true
+#endif
+#ifndef FALSE
+#define FALSE false
+#endif
+
+#include "curl_ctype.h"
+
+/*
+ * Macro used to include code only in debug builds.
+ */
+#ifdef DEBUGBUILD
+#define DEBUGF(x) x
+#else
+#define DEBUGF(x) do {} while(0)
+#endif
+
+/*
+ * Macro used to include assertion code only in debug builds.
+ */
+#undef DEBUGASSERT
+#ifdef DEBUGBUILD
+#ifdef CURL_DEBUGASSERT
+/* External assertion handler for custom integrations */
+#define DEBUGASSERT(x) CURL_DEBUGASSERT(x)
+#else
+#define DEBUGASSERT(x) assert(x)
+#endif
+#else
+#define DEBUGASSERT(x) do {} while(0)
+#endif
+
+/*
+ * Macro SOCKERRNO / SET_SOCKERRNO() returns / sets the *socket-related* errno
+ * (or equivalent) on this platform to hide platform details to code using it.
+ */
+#ifdef USE_WINSOCK
+#define SOCKERRNO         ((int)WSAGetLastError())
+#define SET_SOCKERRNO(x)  WSASetLastError((int)(x))
+#else
+#define SOCKERRNO         errno
+#define SET_SOCKERRNO(x)  (errno = (x))
+#endif
+
+/*
+ * Portable error number symbolic names defined to Winsock error codes.
+ */
+#ifdef USE_WINSOCK
+#define SOCKEACCES        WSAEACCES
+#define SOCKEADDRINUSE    WSAEADDRINUSE
+#define SOCKEADDRNOTAVAIL WSAEADDRNOTAVAIL
+#define SOCKEAFNOSUPPORT  WSAEAFNOSUPPORT
+#define SOCKEBADF         WSAEBADF
+#define SOCKECONNREFUSED  WSAECONNREFUSED
+#define SOCKECONNRESET    WSAECONNRESET
+#define SOCKEINPROGRESS   WSAEINPROGRESS
+#define SOCKEINTR         WSAEINTR
+#define SOCKEINVAL        WSAEINVAL
+#define SOCKEISCONN       WSAEISCONN
+#define SOCKEMSGSIZE      WSAEMSGSIZE
+/* Use literal value to work around clang-tidy <=20 misreporting
+  'readability-uppercase-literal-suffix' with mingw-w64 headers */
+#define SOCKENOMEM        8L  /* WSA_NOT_ENOUGH_MEMORY */
+#define SOCKETIMEDOUT     WSAETIMEDOUT
+#define SOCKEWOULDBLOCK   WSAEWOULDBLOCK
+#else
+#define SOCKEACCES        EACCES
+#define SOCKEADDRINUSE    EADDRINUSE
+#define SOCKEADDRNOTAVAIL EADDRNOTAVAIL
+#define SOCKEAFNOSUPPORT  EAFNOSUPPORT
+#define SOCKEBADF         EBADF
+#define SOCKECONNREFUSED  ECONNREFUSED
+#define SOCKECONNRESET    ECONNRESET
+#define SOCKEINPROGRESS   EINPROGRESS
+#define SOCKEINTR         EINTR
+#define SOCKEINVAL        EINVAL
+#define SOCKEISCONN       EISCONN
+#define SOCKEMSGSIZE      EMSGSIZE
+#define SOCKENOMEM        ENOMEM
+#ifdef ETIMEDOUT
+#define SOCKETIMEDOUT     ETIMEDOUT
+#endif
+#define SOCKEWOULDBLOCK   EWOULDBLOCK
+#endif
+
+/* The socket error may be EWOULDBLOCK or on some systems EAGAIN when
+   it returned due to its inability to send/read data without blocking.
+   We treat both error codes the same here. */
+#if !defined(USE_WINSOCK) && EAGAIN != SOCKEWOULDBLOCK
+#define SOCK_EAGAIN(e) ((e) == SOCKEWOULDBLOCK || (e) == EAGAIN)
+#else
+#define SOCK_EAGAIN(e) ((e) == SOCKEWOULDBLOCK)
+#endif
+
+/*
+ * Macro argv_item_t hides platform details to code using it.
+ */
+#ifdef __VMS
+#define argv_item_t  __char_ptr32
+#elif defined(_UNICODE)
+#define argv_item_t  wchar_t *
+#else
+#define argv_item_t  char *
+#endif
+
+/*
+ * We use this ZERO_NULL to avoid picky compiler warnings,
+ * when assigning a NULL pointer to a function pointer var.
+ */
+#define ZERO_NULL 0
+
+/*
+ * Macros and functions to safely suppress warnings
+ */
+#include "curlx/warnless.h"
+
+#ifdef _WIN32
+#  undef read
+#  define read(fd, buf, count)  (ssize_t)_read(fd, buf, curlx_uztoui(count))
+#  undef write
+#  define write(fd, buf, count) (ssize_t)_write(fd, buf, curlx_uztoui(count))
+/* Avoid VS2005+ _CRT_NONSTDC_NO_DEPRECATE warnings about non-portable funcs */
+#  undef fileno
+#  define fileno(fh) _fileno(fh)
+#  undef unlink
+#  define unlink(fn) _unlink(fn)
+#  undef isatty
+#  define isatty(fd) _isatty(fd)
 #endif
 
 /*
  * Definition of our NOP statement Object-like macro
  */
-
 #ifndef Curl_nop_stmt
-#  define Curl_nop_stmt do { } while(0)
+#define Curl_nop_stmt do {} while(0)
 #endif
 
 /*
  * Ensure that Winsock and lwIP TCP/IP stacks are not mixed.
  */
-
 #if defined(__LWIP_OPT_H__) || defined(LWIP_HDR_OPT_H)
-#  if defined(SOCKET) || \
-     defined(USE_WINSOCK) || \
-     defined(HAVE_WINSOCK2_H) || \
-     defined(HAVE_WS2TCPIP_H)
-#    error "WinSock and lwIP TCP/IP stack definitions shall not coexist!"
+#  if defined(SOCKET) || defined(USE_WINSOCK)
+#    error "Winsock and lwIP TCP/IP stack definitions shall not coexist!"
 #  endif
 #endif
 
 /*
- * shutdown() flags for systems that don't define them
+ * shutdown() flags for systems that do not define them
  */
-
 #ifndef SHUT_RD
 #define SHUT_RD 0x00
 #endif
@@ -754,35 +1223,67 @@
 #define S_ISDIR(m) (((m) & S_IFMT) == S_IFDIR)
 #endif
 
+/* For MSVC (all versions as of VS2022) */
+#ifndef STDIN_FILENO
+#define STDIN_FILENO  fileno(stdin)
+#endif
+#ifndef STDOUT_FILENO
+#define STDOUT_FILENO  fileno(stdout)
+#endif
+#ifndef STDERR_FILENO
+#define STDERR_FILENO  fileno(stderr)
+#endif
+
+/* Since O_BINARY is used in bitmasks, setting it to zero makes it usable in
+   source code but yet it does not ruin anything */
+#ifdef _O_BINARY  /* for _WIN32 || MSDOS */
+#define CURL_O_BINARY _O_BINARY
+#elif defined(O_BINARY)  /* __CYGWIN__ */
+#define CURL_O_BINARY O_BINARY
+#else
+#define CURL_O_BINARY 0
+#endif
+
+/* Requires io.h when available */
+#ifdef MSDOS
+#define CURL_BINMODE(stream) (void)setmode(fileno(stream), CURL_O_BINARY)
+#elif defined(_WIN32) || defined(__CYGWIN__)
+#define CURL_BINMODE(stream) (void)_setmode(fileno(stream), CURL_O_BINARY)
+#else
+#define CURL_BINMODE(stream) (void)(stream)
+#endif
+
 /* In Windows the default file mode is text but an application can override it.
 Therefore we specify it explicitly. https://github.com/curl/curl/pull/258
 */
-#if defined(WIN32) || defined(MSDOS)
-#define FOPEN_READTEXT "rt"
-#define FOPEN_WRITETEXT "wt"
+#if defined(_WIN32) || defined(MSDOS)
+#define FOPEN_READTEXT   "rt"
+#define FOPEN_WRITETEXT  "wt"
 #define FOPEN_APPENDTEXT "at"
 #elif defined(__CYGWIN__)
-/* Cygwin has specific behavior we need to address when WIN32 is not defined.
+/* Cygwin has specific behavior we need to address when _WIN32 is not defined.
 https://cygwin.com/cygwin-ug-net/using-textbinary.html
 For write we want our output to have line endings of LF and be compatible with
 other Cygwin utilities. For read we want to handle input that may have line
 endings either CRLF or LF so 't' is appropriate.
 */
-#define FOPEN_READTEXT "rt"
-#define FOPEN_WRITETEXT "w"
+#define FOPEN_READTEXT   "rt"
+#define FOPEN_WRITETEXT  "w"
 #define FOPEN_APPENDTEXT "a"
 #else
-#define FOPEN_READTEXT "r"
-#define FOPEN_WRITETEXT "w"
+#define FOPEN_READTEXT   "r"
+#define FOPEN_WRITETEXT  "w"
 #define FOPEN_APPENDTEXT "a"
 #endif
 
-/* for systems that don't detect this in configure */
+/* for systems that do not detect this in configure */
 #ifndef CURL_SA_FAMILY_T
-#  if defined(HAVE_SA_FAMILY_T)
-#    define CURL_SA_FAMILY_T sa_family_t
-#  elif defined(HAVE_ADDRESS_FAMILY)
+#  ifdef USE_WINSOCK
 #    define CURL_SA_FAMILY_T ADDRESS_FAMILY
+#  elif defined(HAVE_SA_FAMILY_T)
+#    define CURL_SA_FAMILY_T sa_family_t
+#  elif defined(__AMIGA__)
+#    define CURL_SA_FAMILY_T unsigned char
 #  else
 /* use a sensible default */
 #    define CURL_SA_FAMILY_T unsigned short
@@ -791,65 +1292,382 @@ endings either CRLF or LF so 't' is appropriate.
 
 /* Some convenience macros to get the larger/smaller value out of two given.
    We prefix with CURL to prevent name collisions. */
-#define CURLMAX(x,y) ((x)>(y)?(x):(y))
-#define CURLMIN(x,y) ((x)<(y)?(x):(y))
+#define CURLMAX(x, y) ((x) > (y) ? (x) : (y))
+#define CURLMIN(x, y) ((x) < (y) ? (x) : (y))
 
 /* A convenience macro to provide both the string literal and the length of
    the string literal in one go, useful for functions that take "string,len"
    as their argument */
-#define STRCONST(x) x,sizeof(x)-1
+#define STRCONST(x) x, sizeof(x) - 1
 
-/* Some versions of the Android SDK is missing the declaration */
-#if defined(HAVE_GETPWUID_R) && defined(HAVE_DECL_GETPWUID_R_MISSING)
+#define CURL_ARRAYSIZE(A) (sizeof(A) / sizeof((A)[0]))
+
+/* Buffer size for error messages retrieved via
+   curlx_strerror() and Curl_sspi_strerror() */
+#define STRERROR_LEN 256
+
+#ifndef CURL_DID_MEMORY_FUNC_TYPEDEFS /* only if not already done */
+/*
+ * The following memory function replacement typedef's are COPIED from
+ * curl/curl.h and MUST match the originals. We copy them to avoid having to
+ * include curl/curl.h here. We avoid that include since it includes stdio.h
+ * and other headers that may get messed up with defines done here.
+ */
+typedef void *(*curl_malloc_callback)(size_t size);
+typedef void (*curl_free_callback)(void *ptr);
+typedef void *(*curl_realloc_callback)(void *ptr, size_t size);
+typedef char *(*curl_strdup_callback)(const char *str);
+typedef void *(*curl_calloc_callback)(size_t nmemb, size_t size);
+#define CURL_DID_MEMORY_FUNC_TYPEDEFS
+#endif
+
+extern curl_malloc_callback Curl_cmalloc;
+extern curl_free_callback Curl_cfree;
+extern curl_realloc_callback Curl_crealloc;
+extern curl_strdup_callback Curl_cstrdup;
+extern curl_calloc_callback Curl_ccalloc;
+
+/*
+ * curlx_safefree() defined as a macro to allow MemoryTracking feature
+ * to log free() calls at same location where curlx_safefree() is used.
+ * This macro also assigns NULL to given pointer when free'd.
+ */
+#define curlx_safefree(ptr) \
+  do {                      \
+    curlx_free(ptr);        \
+    (ptr) = NULL;           \
+  } while(0)
+
+/* Same as curlx_safefree() but zeroes memory before freeing */
+#define curlx_safefreezero(ptr, size) \
+  do {                                \
+    curlx_freezero(ptr, size);        \
+    (ptr) = NULL;                     \
+  } while(0)
+
+/* Same as curlx_safefreezero() but determines length with strlen() */
+#define curlx_safefreezeroz(ptr) \
+  do {                           \
+    curlx_freezeroz(ptr);        \
+    (ptr) = NULL;                \
+  } while(0)
+
+#include <curl/curl.h> /* for CURL_EXTERN, curl_socket_t, mprintf.h */
+
+#ifdef DEBUGBUILD
+#define CURL_MEMDEBUG
+#endif
+
+#ifdef CURL_MEMDEBUG
+#ifdef __clang__
+#  define ALLOC_FUNC         __attribute__((__malloc__))
+#  if __clang_major__ >= 4
+#  define ALLOC_SIZE(s)      __attribute__((__alloc_size__(s)))
+#  define ALLOC_SIZE2(n, s)  __attribute__((__alloc_size__(n, s)))
+#  else
+#  define ALLOC_SIZE(s)
+#  define ALLOC_SIZE2(n, s)
+#  endif
+#elif defined(__GNUC__) && __GNUC__ >= 3
+#  define ALLOC_FUNC         __attribute__((__malloc__))
+#  define ALLOC_SIZE(s)      __attribute__((__alloc_size__(s)))
+#  define ALLOC_SIZE2(n, s)  __attribute__((__alloc_size__(n, s)))
+#elif defined(_MSC_VER)
+#  define ALLOC_FUNC         __declspec(restrict)
+#  define ALLOC_SIZE(s)
+#  define ALLOC_SIZE2(n, s)
+#else
+#  define ALLOC_FUNC
+#  define ALLOC_SIZE(s)
+#  define ALLOC_SIZE2(n, s)
+#endif
+
+extern FILE *curl_dbg_logfile;
+
+/* memory functions */
+CURL_EXTERN void curl_dbg_free(void *ptr, int line, const char *source);
+CURL_EXTERN ALLOC_FUNC ALLOC_SIZE(1)
+  void *curl_dbg_malloc(size_t size, int line, const char *source);
+CURL_EXTERN ALLOC_FUNC ALLOC_SIZE2(1, 2)
+  void *curl_dbg_calloc(size_t n, size_t size, int line, const char *source);
+CURL_EXTERN ALLOC_SIZE(2)
+  void *curl_dbg_realloc(void *ptr, size_t size, int line, const char *source);
+CURL_EXTERN ALLOC_FUNC
+  char *curl_dbg_strdup(const char *str, int line, const char *src);
+#if defined(_WIN32) && defined(UNICODE)
+CURL_EXTERN ALLOC_FUNC
+  wchar_t *curl_dbg_wcsdup(const wchar_t *str, int line, const char *source);
+#endif
+
+CURL_EXTERN void curl_dbg_memdebug(const char *logname);
+CURL_EXTERN void curl_dbg_memlimit(long limit);
+CURL_EXTERN void curl_dbg_log(const char *format, ...) CURL_PRINTF(1, 2);
+
+/* file descriptor manipulators */
+CURL_EXTERN curl_socket_t curl_dbg_socket(int domain, int type, int protocol,
+                                          int line, const char *source);
+CURL_EXTERN void curl_dbg_mark_sclose(curl_socket_t sockfd,
+                                      int line, const char *source);
+CURL_EXTERN int curl_dbg_sclose(curl_socket_t sockfd,
+                                int line, const char *source);
+CURL_EXTERN curl_socket_t curl_dbg_accept(curl_socket_t s,
+                                          void *saddr, void *saddrlen,
+                                          int line, const char *source);
+#ifdef HAVE_ACCEPT4
+CURL_EXTERN curl_socket_t curl_dbg_accept4(curl_socket_t s, void *saddr,
+                                           void *saddrlen, int flags,
+                                           int line, const char *source);
+#endif
+#ifdef HAVE_SOCKETPAIR
+CURL_EXTERN int curl_dbg_socketpair(int domain, int type, int protocol,
+                                    curl_socket_t socket_vector[2],
+                                    int line, const char *source);
+#endif
+
+/* FILE functions */
+CURL_EXTERN int curl_dbg_fclose(FILE *file, int line, const char *source);
+CURL_EXTERN ALLOC_FUNC FILE *curl_dbg_fopen(const char *file, const char *mode,
+                                            int line, const char *source);
+CURL_EXTERN ALLOC_FUNC FILE *curl_dbg_freopen(const char *file,
+                                              const char *mode, FILE *fh,
+                                              int line, const char *source);
+CURL_EXTERN ALLOC_FUNC FILE *curl_dbg_fdopen(int filedes, const char *mode,
+                                             int line, const char *source);
+
+#define sclose(sockfd) curl_dbg_sclose(sockfd, __LINE__, __FILE__)
+#define fake_sclose(sockfd) curl_dbg_mark_sclose(sockfd, __LINE__, __FILE__)
+
+#define CURL_GETADDRINFO(host, serv, hint, res) \
+  curl_dbg_getaddrinfo(host, serv, hint, res, __LINE__, __FILE__)
+#define CURL_FREEADDRINFO(data) \
+  curl_dbg_freeaddrinfo(data, __LINE__, __FILE__)
+#define CURL_SOCKET(domain, type, protocol) \
+  curl_dbg_socket((int)(domain), type, protocol, __LINE__, __FILE__)
+#ifdef HAVE_SOCKETPAIR
+#define CURL_SOCKETPAIR(domain, type, protocol, socket_vector) \
+  curl_dbg_socketpair((int)(domain), type, protocol, socket_vector, \
+                      __LINE__, __FILE__)
+#endif
+#define CURL_ACCEPT(sock, addr, len) \
+  curl_dbg_accept(sock, addr, len, __LINE__, __FILE__)
+#ifdef HAVE_ACCEPT4
+#define CURL_ACCEPT4(sock, addr, len, flags) \
+  curl_dbg_accept4(sock, addr, len, flags, __LINE__, __FILE__)
+#endif
+
+#else /* !CURL_MEMDEBUG */
+
+#define sclose(x) CURL_SCLOSE(x)
+#define fake_sclose(x) Curl_nop_stmt
+
+#define CURL_GETADDRINFO getaddrinfo
+#define CURL_FREEADDRINFO freeaddrinfo
+#define CURL_SOCKET socket
+#ifdef HAVE_SOCKETPAIR
+#define CURL_SOCKETPAIR socketpair
+#endif
+#define CURL_ACCEPT accept
+#ifdef HAVE_ACCEPT4
+#define CURL_ACCEPT4 accept4
+#endif
+
+#endif /* CURL_MEMDEBUG */
+
+/* Allocator macros */
+
+#ifdef _WIN32
+#define CURLX_STRDUP_LOW _strdup
+#else
+#define CURLX_STRDUP_LOW strdup
+#endif
+
+#ifdef CURL_MEMDEBUG
+
+#define curlx_strdup(ptr)          curl_dbg_strdup(ptr, __LINE__, __FILE__)
+#define curlx_malloc(size)         curl_dbg_malloc(size, __LINE__, __FILE__)
+#define curlx_calloc(nbelem, size) \
+  curl_dbg_calloc(nbelem, size, __LINE__, __FILE__)
+#define curlx_realloc(ptr, size) \
+  curl_dbg_realloc(ptr, size, __LINE__, __FILE__)
+#define curlx_free(ptr)            curl_dbg_free(ptr, __LINE__, __FILE__)
+
+#ifdef _WIN32
+#ifdef UNICODE
+#define curlx_tcsdup(ptr)          curl_dbg_wcsdup(ptr, __LINE__, __FILE__)
+#else
+#define curlx_tcsdup               curlx_strdup
+#endif
+#endif /* _WIN32 */
+
+#else /* !CURL_MEMDEBUG */
+
+#ifdef BUILDING_LIBCURL
+#define curlx_strdup               Curl_cstrdup
+#define curlx_malloc               Curl_cmalloc
+#define curlx_calloc               Curl_ccalloc
+#define curlx_realloc              Curl_crealloc
+#define curlx_free                 Curl_cfree
+#else /* !BUILDING_LIBCURL */
+#define curlx_strdup               CURLX_STRDUP_LOW
+#define curlx_malloc               malloc
+#define curlx_calloc               calloc
+#define curlx_realloc              realloc
+#define curlx_free                 free
+#endif /* BUILDING_LIBCURL */
+
+#ifdef _WIN32
+#ifdef UNICODE
+#define curlx_tcsdup               curlx_wcsdup
+#else
+#define curlx_tcsdup               curlx_strdup
+#endif
+#endif /* _WIN32 */
+
+#endif /* CURL_MEMDEBUG */
+
+/* Some versions of the Android NDK is missing the declaration */
+#if defined(HAVE_GETPWUID_R) && \
+  defined(__ANDROID_API__) && (__ANDROID_API__ < 21)
 struct passwd;
 int getpwuid_r(uid_t uid, struct passwd *pwd, char *buf,
                size_t buflen, struct passwd **result);
 #endif
 
-#ifdef DEBUGBUILD
+#ifdef UNITTESTS
 #define UNITTEST
 #else
 #define UNITTEST static
 #endif
 
-#if defined(USE_NGHTTP2) || defined(USE_HYPER)
+#ifdef USE_NGHTTP2
 #define USE_HTTP2
 #endif
 
-#if (defined(USE_NGTCP2) && defined(USE_NGHTTP3)) || \
-    defined(USE_QUICHE) || defined(USE_MSH3)
-#define ENABLE_QUIC
+#if (defined(USE_NGTCP2) && defined(USE_NGHTTP3)) || defined(USE_QUICHE)
+
+#ifdef CURL_WITH_MULTI_SSL
+#error "MultiSSL combined with QUIC is not supported"
+#endif
+
 #define USE_HTTP3
 #endif
 
+/* WebAssembly builds have TCP_NODELAY, but runtime support is missing. */
+#ifndef __EMSCRIPTEN__
+#define CURL_TCP_NODELAY_SUPPORTED
+#endif
+
 /* Certain Windows implementations are not aligned with what curl expects,
    so always use the local one on this platform. E.g. the mingw-w64
    implementation can return wrong results for non-ASCII inputs. */
-#if defined(HAVE_BASENAME) && defined(WIN32)
+#if defined(HAVE_BASENAME) && defined(_WIN32)
 #undef HAVE_BASENAME
 #endif
 
-#if defined(USE_UNIX_SOCKETS) && defined(WIN32)
-#  if defined(__MINGW32__) && !defined(LUP_SECURE)
-     typedef u_short ADDRESS_FAMILY; /* Classic mingw, 11y+ old mingw-w64 */
-#  endif
-#  if !defined(UNIX_PATH_MAX)
-     /* Replicating logic present in afunix.h
-        (distributed with newer Windows 10 SDK versions only) */
-#    define UNIX_PATH_MAX 108
-     /* !checksrc! disable TYPEDEFSTRUCT 1 */
-     typedef struct sockaddr_un {
-       ADDRESS_FAMILY sun_family;
-       char sun_path[UNIX_PATH_MAX];
-     } SOCKADDR_UN, *PSOCKADDR_UN;
-#    define WIN32_SOCKADDR_UN
+#if defined(USE_UNIX_SOCKETS) && defined(_WIN32)
+/* Offered by mingw-w64 v10+, MS SDK 10.0.16299.0/VS2017 15.4+ */
+#if defined(__MINGW32__) && (__MINGW64_VERSION_MAJOR >= 10)
+#  include <afunix.h>
+#elif !defined(UNIX_PATH_MAX) /* Replicate logic present in afunix.h */
+#  define UNIX_PATH_MAX 108
+/* !checksrc! disable TYPEDEFSTRUCT 1 */
+typedef struct sockaddr_un {
+  CURL_SA_FAMILY_T sun_family;
+  char sun_path[UNIX_PATH_MAX];
+} SOCKADDR_UN, *PSOCKADDR_UN;
+#endif
+#endif
+
+#ifdef USE_OPENSSL
+/* OpenSSL 3 marks these functions deprecated but we have no replacements (yet)
+   so tell the compiler to not warn for them:
+   - DES_* (for NTLM), SSL_CTX_set_srp_* (for TLS-SRP)
+   - EVP_PKEY_get1_RSA, MD5_*, RSA_flags, RSA_free (auto-skipped for OpenSSL
+     built with no-deprecated) */
+#  define OPENSSL_SUPPRESS_DEPRECATED
+#  ifdef _WIN32
+/* Silence LibreSSL warnings about wincrypt.h collision. Works in 3.8.2+ */
+#    ifndef LIBRESSL_DISABLE_OVERRIDE_WINCRYPT_DEFINES_WARNING
+#    define LIBRESSL_DISABLE_OVERRIDE_WINCRYPT_DEFINES_WARNING
+#    endif
 #  endif
 #endif
 
-/* OpenSSLv3 marks DES, MD5 and ENGINE functions deprecated but we have no
-   replacements (yet) so tell the compiler to not warn for them. */
-#ifdef USE_OPENSSL
-#define OPENSSL_SUPPRESS_DEPRECATED
+#ifdef CURL_INLINE
+/* 'CURL_INLINE' defined, use as-is */
+#elif defined(inline)
+#  define CURL_INLINE inline /* 'inline' defined, assumed correct */
+#elif defined(__cplusplus)
+/* The code is compiled with C++ compiler.
+   C++ always supports 'inline'. */
+#  define CURL_INLINE inline /* 'inline' keyword supported */
+#elif defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901L
+/* C99 (and later) supports 'inline' keyword */
+#  define CURL_INLINE inline /* 'inline' keyword supported */
+#elif defined(__GNUC__) && __GNUC__ >= 3
+/* GCC supports '__inline__' as an extension */
+#  define CURL_INLINE __inline__
+#elif defined(_MSC_VER)
+#  define CURL_INLINE __inline
+#else
+/* Probably 'inline' is not supported by compiler.
+   Define to the empty string to be on the safe side. */
+#  define CURL_INLINE /* empty */
 #endif
 
+/* Detect if compiler supports C99 variadic macros */
+#if (defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901L) || \
+  defined(_MSC_VER)
+#define CURL_HAVE_MACRO_VARARG
+#endif
+
+#if !defined(CURL_HAVE_MACRO_VARARG) || \
+  (defined(CURL_HAVE_MACRO_VARARG) && !defined(CURL_DISABLE_VERBOSE_STRINGS))
+#define CURLVERBOSE
+#define VERBOSE(x) x
+#define NOVERBOSE(x) Curl_nop_stmt
+#else
+#define VERBOSE(x) Curl_nop_stmt
+#define NOVERBOSE(x) x
+#endif
+
+/* For FreeBSD it is included from curl/curl.h */
+#if defined(__DragonFly__) || defined(__OpenBSD__) || defined(__NetBSD__)
+#include <sys/param.h>  /* for __DragonFly_version, OpenBSD,
+                           __NetBSD_Version__ */
+#endif
+
+#ifndef _CURL_LOCAL_MEMZERO /* to be removed after a couple of releases */
+#ifdef _WIN32
+#if defined(_MSC_VER) && defined(NTDDI_VERSION) && \
+  (NTDDI_VERSION >= 0x0A000010) /* MS SDK 10.0.26100.0+ */
+#pragma comment(lib, "volatileaccessu.lib")
+#define curlx_memzero(buf, size)  SecureZeroMemory2(buf, size)
+#else
+#define curlx_memzero(buf, size)  SecureZeroMemory(buf, size)
+#endif
+#elif defined(HAVE_MEMSET_S)
+#define curlx_memzero(buf, size)  (void)memset_s(buf, size, 0, size)
+#elif defined(HAVE_MEMSET_EXPLICIT)
+#define curlx_memzero(buf, size)  (void)memset_explicit(buf, 0, size)
+#elif defined(__CYGWIN__) || \
+  (defined(__NEWLIB__) && !defined(__CLIB2__)) || \
+  (defined(__GLIBC__) && \
+    (__GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 25))) || \
+  (defined(__DragonFly__) && __DragonFly_version >= 500600 /* v5.6+ */) || \
+  (defined(__FreeBSD__) && __FreeBSD_version >= 1100037 /* v11.0+ */) || \
+  (defined(__OpenBSD__) && OpenBSD >= 201405 /* v5.5+ */)
+#define curlx_memzero(buf, size)  explicit_bzero(buf, size)
+#elif defined(__NetBSD__) && __NetBSD_Version__ >= 702000000 /* v7.2+ */
+#define curlx_memzero(buf, size)  (void)explicit_memset(buf, 0, size)
+#endif
+#endif /* !_CURL_LOCAL_MEMZERO */
+
+#ifndef curlx_memzero
+#define USE_CURLX_MEMZERO
+void curlx_memzero(void *buf, size_t size);
+#endif
+void curlx_freezero(void *buf, size_t size);
+void curlx_freezeroz(void *buf);
+
 #endif /* HEADER_CURL_SETUP_H */
diff --git a/third-party/curl/lib/curl_setup_once.h b/third-party/curl/lib/curl_setup_once.h
deleted file mode 100644
index c1ed059070..0000000000
--- a/third-party/curl/lib/curl_setup_once.h
+++ /dev/null
@@ -1,422 +0,0 @@
-#ifndef HEADER_CURL_SETUP_ONCE_H
-#define HEADER_CURL_SETUP_ONCE_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-
-/*
- * Inclusion of common header files.
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <stdarg.h>
-#include <time.h>
-#include <errno.h>
-
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-
-#ifdef NEED_MALLOC_H
-#include <malloc.h>
-#endif
-
-#ifdef NEED_MEMORY_H
-#include <memory.h>
-#endif
-
-#ifdef HAVE_SYS_STAT_H
-#include <sys/stat.h>
-#endif
-
-#ifdef HAVE_SYS_TIME_H
-#include <sys/time.h>
-#endif
-
-#ifdef WIN32
-#include <io.h>
-#include <fcntl.h>
-#endif
-
-#if defined(HAVE_STDBOOL_H) && defined(HAVE_BOOL_T)
-#include <stdbool.h>
-#endif
-
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-
-#ifdef USE_WOLFSSL
-#  if defined(HAVE_STDINT_H)
-#    include <stdint.h>
-#  elif defined(HAVE_INTTYPES_H)
-#    include <inttypes.h>
-#  endif
-#endif
-
-#ifdef USE_SCHANNEL
-/* Must set this before <schannel.h> is included directly or indirectly by
-   another Windows header. */
-#  define SCHANNEL_USE_BLACKLISTS 1
-#endif
-
-#ifdef __hpux
-#  if !defined(_XOPEN_SOURCE_EXTENDED) || defined(_KERNEL)
-#    ifdef _APP32_64BIT_OFF_T
-#      define OLD_APP32_64BIT_OFF_T _APP32_64BIT_OFF_T
-#      undef _APP32_64BIT_OFF_T
-#    else
-#      undef OLD_APP32_64BIT_OFF_T
-#    endif
-#  endif
-#endif
-
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
-
-#include "functypes.h"
-
-#ifdef __hpux
-#  if !defined(_XOPEN_SOURCE_EXTENDED) || defined(_KERNEL)
-#    ifdef OLD_APP32_64BIT_OFF_T
-#      define _APP32_64BIT_OFF_T OLD_APP32_64BIT_OFF_T
-#      undef OLD_APP32_64BIT_OFF_T
-#    endif
-#  endif
-#endif
-
-/*
- * Definition of timeval struct for platforms that don't have it.
- */
-
-#ifndef HAVE_STRUCT_TIMEVAL
-struct timeval {
- long tv_sec;
- long tv_usec;
-};
-#endif
-
-
-/*
- * If we have the MSG_NOSIGNAL define, make sure we use
- * it as the fourth argument of function send()
- */
-
-#ifdef HAVE_MSG_NOSIGNAL
-#define SEND_4TH_ARG MSG_NOSIGNAL
-#else
-#define SEND_4TH_ARG 0
-#endif
-
-
-#if defined(__minix)
-/* Minix doesn't support recv on TCP sockets */
-#define sread(x,y,z) (ssize_t)read((RECV_TYPE_ARG1)(x), \
-                                   (RECV_TYPE_ARG2)(y), \
-                                   (RECV_TYPE_ARG3)(z))
-
-#elif defined(HAVE_RECV)
-/*
- * The definitions for the return type and arguments types
- * of functions recv() and send() belong and come from the
- * configuration file. Do not define them in any other place.
- *
- * HAVE_RECV is defined if you have a function named recv()
- * which is used to read incoming data from sockets. If your
- * function has another name then don't define HAVE_RECV.
- *
- * If HAVE_RECV is defined then RECV_TYPE_ARG1, RECV_TYPE_ARG2,
- * RECV_TYPE_ARG3, RECV_TYPE_ARG4 and RECV_TYPE_RETV must also
- * be defined.
- *
- * HAVE_SEND is defined if you have a function named send()
- * which is used to write outgoing data on a connected socket.
- * If yours has another name then don't define HAVE_SEND.
- *
- * If HAVE_SEND is defined then SEND_TYPE_ARG1, SEND_QUAL_ARG2,
- * SEND_TYPE_ARG2, SEND_TYPE_ARG3, SEND_TYPE_ARG4 and
- * SEND_TYPE_RETV must also be defined.
- */
-
-#define sread(x,y,z) (ssize_t)recv((RECV_TYPE_ARG1)(x), \
-                                   (RECV_TYPE_ARG2)(y), \
-                                   (RECV_TYPE_ARG3)(z), \
-                                   (RECV_TYPE_ARG4)(0))
-#else /* HAVE_RECV */
-#ifndef sread
-  /* */
-  Error Missing_definition_of_macro_sread
-  /* */
-#endif
-#endif /* HAVE_RECV */
-
-
-#if defined(__minix)
-/* Minix doesn't support send on TCP sockets */
-#define swrite(x,y,z) (ssize_t)write((SEND_TYPE_ARG1)(x), \
-                                    (SEND_TYPE_ARG2)(y), \
-                                    (SEND_TYPE_ARG3)(z))
-
-#elif defined(HAVE_SEND)
-#define swrite(x,y,z) (ssize_t)send((SEND_TYPE_ARG1)(x), \
-                                    (SEND_QUAL_ARG2 SEND_TYPE_ARG2)(y), \
-                                    (SEND_TYPE_ARG3)(z), \
-                                    (SEND_TYPE_ARG4)(SEND_4TH_ARG))
-#else /* HAVE_SEND */
-#ifndef swrite
-  /* */
-  Error Missing_definition_of_macro_swrite
-  /* */
-#endif
-#endif /* HAVE_SEND */
-
-
-/*
- * Function-like macro definition used to close a socket.
- */
-
-#if defined(HAVE_CLOSESOCKET)
-#  define sclose(x)  closesocket((x))
-#elif defined(HAVE_CLOSESOCKET_CAMEL)
-#  define sclose(x)  CloseSocket((x))
-#elif defined(HAVE_CLOSE_S)
-#  define sclose(x)  close_s((x))
-#elif defined(USE_LWIPSOCK)
-#  define sclose(x)  lwip_close((x))
-#else
-#  define sclose(x)  close((x))
-#endif
-
-/*
- * Stack-independent version of fcntl() on sockets:
- */
-#if defined(USE_LWIPSOCK)
-#  define sfcntl  lwip_fcntl
-#else
-#  define sfcntl  fcntl
-#endif
-
-/*
- * 'bool' stuff compatible with HP-UX headers.
- */
-
-#if defined(__hpux) && !defined(HAVE_BOOL_T)
-   typedef int bool;
-#  define false 0
-#  define true 1
-#  define HAVE_BOOL_T
-#endif
-
-
-/*
- * 'bool' exists on platforms with <stdbool.h>, i.e. C99 platforms.
- * On non-C99 platforms there's no bool, so define an enum for that.
- * On C99 platforms 'false' and 'true' also exist. Enum uses a
- * global namespace though, so use bool_false and bool_true.
- */
-
-#ifndef HAVE_BOOL_T
-  typedef enum {
-      bool_false = 0,
-      bool_true  = 1
-  } bool;
-
-/*
- * Use a define to let 'true' and 'false' use those enums.  There
- * are currently no use of true and false in libcurl proper, but
- * there are some in the examples. This will cater for any later
- * code happening to use true and false.
- */
-#  define false bool_false
-#  define true  bool_true
-#  define HAVE_BOOL_T
-#endif
-
-/* the type we use for storing a single boolean bit */
-#ifdef _MSC_VER
-typedef bool bit;
-#define BIT(x) bool x
-#else
-typedef unsigned int bit;
-#define BIT(x) bit x:1
-#endif
-
-/*
- * Redefine TRUE and FALSE too, to catch current use. With this
- * change, 'bool found = 1' will give a warning on MIPSPro, but
- * 'bool found = TRUE' will not. Change tested on IRIX/MIPSPro,
- * AIX 5.1/Xlc, Tru64 5.1/cc, w/make test too.
- */
-
-#ifndef TRUE
-#define TRUE true
-#endif
-#ifndef FALSE
-#define FALSE false
-#endif
-
-#include "curl_ctype.h"
-
-
-/*
- * Macro used to include code only in debug builds.
- */
-
-#ifdef DEBUGBUILD
-#define DEBUGF(x) x
-#else
-#define DEBUGF(x) do { } while(0)
-#endif
-
-
-/*
- * Macro used to include assertion code only in debug builds.
- */
-
-#undef DEBUGASSERT
-#if defined(DEBUGBUILD)
-#define DEBUGASSERT(x) assert(x)
-#else
-#define DEBUGASSERT(x) do { } while(0)
-#endif
-
-
-/*
- * Macro SOCKERRNO / SET_SOCKERRNO() returns / sets the *socket-related* errno
- * (or equivalent) on this platform to hide platform details to code using it.
- */
-
-#ifdef USE_WINSOCK
-#define SOCKERRNO         ((int)WSAGetLastError())
-#define SET_SOCKERRNO(x)  (WSASetLastError((int)(x)))
-#else
-#define SOCKERRNO         (errno)
-#define SET_SOCKERRNO(x)  (errno = (x))
-#endif
-
-
-/*
- * Portable error number symbolic names defined to Winsock error codes.
- */
-
-#ifdef USE_WINSOCK
-#undef  EBADF            /* override definition in errno.h */
-#define EBADF            WSAEBADF
-#undef  EINTR            /* override definition in errno.h */
-#define EINTR            WSAEINTR
-#undef  EINVAL           /* override definition in errno.h */
-#define EINVAL           WSAEINVAL
-#undef  EWOULDBLOCK      /* override definition in errno.h */
-#define EWOULDBLOCK      WSAEWOULDBLOCK
-#undef  EINPROGRESS      /* override definition in errno.h */
-#define EINPROGRESS      WSAEINPROGRESS
-#undef  EALREADY         /* override definition in errno.h */
-#define EALREADY         WSAEALREADY
-#undef  ENOTSOCK         /* override definition in errno.h */
-#define ENOTSOCK         WSAENOTSOCK
-#undef  EDESTADDRREQ     /* override definition in errno.h */
-#define EDESTADDRREQ     WSAEDESTADDRREQ
-#undef  EMSGSIZE         /* override definition in errno.h */
-#define EMSGSIZE         WSAEMSGSIZE
-#undef  EPROTOTYPE       /* override definition in errno.h */
-#define EPROTOTYPE       WSAEPROTOTYPE
-#undef  ENOPROTOOPT      /* override definition in errno.h */
-#define ENOPROTOOPT      WSAENOPROTOOPT
-#undef  EPROTONOSUPPORT  /* override definition in errno.h */
-#define EPROTONOSUPPORT  WSAEPROTONOSUPPORT
-#define ESOCKTNOSUPPORT  WSAESOCKTNOSUPPORT
-#undef  EOPNOTSUPP       /* override definition in errno.h */
-#define EOPNOTSUPP       WSAEOPNOTSUPP
-#define EPFNOSUPPORT     WSAEPFNOSUPPORT
-#undef  EAFNOSUPPORT     /* override definition in errno.h */
-#define EAFNOSUPPORT     WSAEAFNOSUPPORT
-#undef  EADDRINUSE       /* override definition in errno.h */
-#define EADDRINUSE       WSAEADDRINUSE
-#undef  EADDRNOTAVAIL    /* override definition in errno.h */
-#define EADDRNOTAVAIL    WSAEADDRNOTAVAIL
-#undef  ENETDOWN         /* override definition in errno.h */
-#define ENETDOWN         WSAENETDOWN
-#undef  ENETUNREACH      /* override definition in errno.h */
-#define ENETUNREACH      WSAENETUNREACH
-#undef  ENETRESET        /* override definition in errno.h */
-#define ENETRESET        WSAENETRESET
-#undef  ECONNABORTED     /* override definition in errno.h */
-#define ECONNABORTED     WSAECONNABORTED
-#undef  ECONNRESET       /* override definition in errno.h */
-#define ECONNRESET       WSAECONNRESET
-#undef  ENOBUFS          /* override definition in errno.h */
-#define ENOBUFS          WSAENOBUFS
-#undef  EISCONN          /* override definition in errno.h */
-#define EISCONN          WSAEISCONN
-#undef  ENOTCONN         /* override definition in errno.h */
-#define ENOTCONN         WSAENOTCONN
-#define ESHUTDOWN        WSAESHUTDOWN
-#define ETOOMANYREFS     WSAETOOMANYREFS
-#undef  ETIMEDOUT        /* override definition in errno.h */
-#define ETIMEDOUT        WSAETIMEDOUT
-#undef  ECONNREFUSED     /* override definition in errno.h */
-#define ECONNREFUSED     WSAECONNREFUSED
-#undef  ELOOP            /* override definition in errno.h */
-#define ELOOP            WSAELOOP
-#ifndef ENAMETOOLONG     /* possible previous definition in errno.h */
-#define ENAMETOOLONG     WSAENAMETOOLONG
-#endif
-#define EHOSTDOWN        WSAEHOSTDOWN
-#undef  EHOSTUNREACH     /* override definition in errno.h */
-#define EHOSTUNREACH     WSAEHOSTUNREACH
-#ifndef ENOTEMPTY        /* possible previous definition in errno.h */
-#define ENOTEMPTY        WSAENOTEMPTY
-#endif
-#define EPROCLIM         WSAEPROCLIM
-#define EUSERS           WSAEUSERS
-#define EDQUOT           WSAEDQUOT
-#define ESTALE           WSAESTALE
-#define EREMOTE          WSAEREMOTE
-#endif
-
-/*
- * Macro argv_item_t hides platform details to code using it.
- */
-
-#ifdef __VMS
-#define argv_item_t  __char_ptr32
-#elif defined(_UNICODE)
-#define argv_item_t wchar_t *
-#else
-#define argv_item_t  char *
-#endif
-
-
-/*
- * We use this ZERO_NULL to avoid picky compiler warnings,
- * when assigning a NULL pointer to a function pointer var.
- */
-
-#define ZERO_NULL 0
-
-
-#endif /* HEADER_CURL_SETUP_ONCE_H */
diff --git a/third-party/curl/lib/curl_sha256.h b/third-party/curl/lib/curl_sha256.h
index d99f958f90..6c48a8e176 100644
--- a/third-party/curl/lib/curl_sha256.h
+++ b/third-party/curl/lib/curl_sha256.h
@@ -24,26 +24,21 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "curl_setup.h"
 
-#if !defined(CURL_DISABLE_AWS) || !defined(CURL_DISABLE_DIGEST_AUTH) \
-    || defined(USE_LIBSSH2)
+#if !defined(CURL_DISABLE_AWS) || !defined(CURL_DISABLE_DIGEST_AUTH) || \
+  defined(USE_LIBSSH2) || defined(USE_SSL)
 
-#include <curl/curl.h>
 #include "curl_hmac.h"
 
-extern const struct HMAC_params Curl_HMAC_SHA256[1];
+extern const struct HMAC_params Curl_HMAC_SHA256;
 
-#ifdef USE_WOLFSSL
-/* SHA256_DIGEST_LENGTH is an enum value in wolfSSL. Need to import it from
- * sha.h */
-#include <wolfssl/options.h>
-#include <wolfssl/openssl/sha.h>
-#else
-#define SHA256_DIGEST_LENGTH 32
+#ifndef CURL_SHA256_DIGEST_LENGTH
+#define CURL_SHA256_DIGEST_LENGTH 32 /* fixed size */
 #endif
 
-CURLcode Curl_sha256it(unsigned char *outbuffer, const unsigned char *input,
-                       const size_t len);
+CURLcode Curl_sha256it(unsigned char *output, const unsigned char *input,
+                       size_t len);
 
 #endif
 
diff --git a/third-party/curl/lib/curl_sha512_256.c b/third-party/curl/lib/curl_sha512_256.c
new file mode 100644
index 0000000000..c429bba8f2
--- /dev/null
+++ b/third-party/curl/lib/curl_sha512_256.c
@@ -0,0 +1,847 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Evgeny Grin (Karlson2k), <k2k@narod.ru>.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#if !defined(CURL_DISABLE_DIGEST_AUTH) && !defined(CURL_DISABLE_SHA512_256)
+
+#include "curl_sha512_256.h"
+
+/* The recommended order of the TLS backends:
+ * 1. USE_OPENSSL
+ * 2. USE_WOLFSSL
+ * 3. USE_GNUTLS
+ * 4. USE_MBEDTLS (TBD)
+ * 5. USE_RUSTLS (TBD)
+ * 6. USE_WIN32_CRYPTO (TBD)
+ * Skip the backend if it does not support the required algorithm */
+
+#ifdef USE_OPENSSL
+#  include <openssl/opensslv.h>
+#  if !defined(LIBRESSL_VERSION_NUMBER) || \
+  (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER >= 0x3080000fL)
+#    include <openssl/evp.h>
+#    define USE_OPENSSL_SHA512_256          1
+#    define HAS_SHA512_256_IMPLEMENTATION   1
+#    ifdef __NetBSD__
+/* Some NetBSD versions have a bug in SHA-512/256.
+ * See https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=58039
+ * The problematic versions:
+ * - NetBSD before 9.4
+ * - NetBSD 9 all development versions (9.99.x)
+ * - NetBSD 10 development versions (10.99.x) before 10.99.11
+ * The bug was fixed in NetBSD 9.4 release, NetBSD 10.0 release,
+ * NetBSD 10.99.11 development.
+ * It is safe to apply the workaround even if the bug is not present, as
+ * the workaround reduces performance slightly. */
+#      if  __NetBSD_Version__ <   904000000 ||  \
+          (__NetBSD_Version__ >=  999000000 &&  \
+           __NetBSD_Version__ <  1000000000) || \
+          (__NetBSD_Version__ >= 1099000000 &&  \
+           __NetBSD_Version__ <  1099001100)
+#        define NEED_NETBSD_SHA512_256_WORKAROUND 1
+#      endif
+#    endif
+#  endif
+#endif /* USE_OPENSSL */
+
+#if !defined(HAS_SHA512_256_IMPLEMENTATION) && defined(USE_WOLFSSL)
+#  include <wolfssl/options.h>
+#  ifndef WOLFSSL_NOSHA512_256
+#    define USE_WOLFSSL_SHA512_256          1
+#    define HAS_SHA512_256_IMPLEMENTATION   1
+#  endif
+#endif
+
+#if !defined(HAS_SHA512_256_IMPLEMENTATION) && defined(USE_GNUTLS)
+#  include <nettle/sha2.h>
+#  include <nettle/version.h>
+#  ifdef SHA512_256_DIGEST_SIZE
+#    define USE_GNUTLS_SHA512_256           1
+#  endif
+#endif /* !HAS_SHA512_256_IMPLEMENTATION && USE_GNUTLS */
+
+#ifdef USE_OPENSSL_SHA512_256
+
+/* OpenSSL does not provide macros for SHA-512/256 sizes */
+
+/**
+ * Size of the SHA-512/256 single processing block in bytes.
+ */
+#define CURL_SHA512_256_BLOCK_SIZE 128
+
+/**
+ * Size of the SHA-512/256 resulting digest in bytes.
+ * This is the final digest size, not intermediate hash.
+ */
+#define CURL_SHA512_256_DIGEST_SIZE CURL_SHA512_256_DIGEST_LENGTH
+
+/**
+ * Context type used for SHA-512/256 calculations
+ */
+typedef EVP_MD_CTX *Curl_sha512_256_ctx;
+
+/**
+ * Initialize structure for SHA-512/256 calculation.
+ *
+ * @param context the calculation context
+ * @return CURLE_OK if succeed,
+ *         error code otherwise
+ */
+static CURLcode Curl_sha512_256_init(void *context)
+{
+  Curl_sha512_256_ctx * const ctx = (Curl_sha512_256_ctx *)context;
+
+  *ctx = EVP_MD_CTX_create();
+  if(!*ctx)
+    return CURLE_OUT_OF_MEMORY;
+
+  if(EVP_DigestInit_ex(*ctx, EVP_sha512_256(), NULL)) {
+    /* Check whether the header and this file use the same numbers */
+    DEBUGASSERT(EVP_MD_CTX_size(*ctx) == CURL_SHA512_256_DIGEST_SIZE);
+    /* Check whether the block size is correct */
+    DEBUGASSERT(EVP_MD_CTX_block_size(*ctx) == CURL_SHA512_256_BLOCK_SIZE);
+
+    return CURLE_OK; /* Success */
+  }
+
+  /* Cleanup */
+  EVP_MD_CTX_destroy(*ctx);
+  return CURLE_FAILED_INIT;
+}
+
+/**
+ * Process portion of bytes.
+ *
+ * @param context the calculation context
+ * @param data bytes to add to hash
+ * @return CURLE_OK if succeed,
+ *         error code otherwise
+ */
+static CURLcode Curl_sha512_256_update(void *context,
+                                       const unsigned char *data,
+                                       size_t length)
+{
+  Curl_sha512_256_ctx * const ctx = (Curl_sha512_256_ctx *)context;
+
+  if(!EVP_DigestUpdate(*ctx, data, length))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  return CURLE_OK;
+}
+
+/**
+ * Finalise SHA-512/256 calculation, return digest.
+ *
+ * @param context the calculation context
+ * @param[out] digest set to the hash, must be #CURL_SHA512_256_DIGEST_SIZE
+ *             bytes
+ * @return CURLE_OK if succeed,
+ *         error code otherwise
+ */
+static CURLcode Curl_sha512_256_finish(unsigned char *digest, void *context)
+{
+  CURLcode result;
+  Curl_sha512_256_ctx * const ctx = (Curl_sha512_256_ctx *)context;
+
+#ifdef NEED_NETBSD_SHA512_256_WORKAROUND
+  /* Use a larger buffer to work around a bug in NetBSD:
+     https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=58039 */
+  unsigned char tmp_digest[CURL_SHA512_256_DIGEST_SIZE * 2];
+  result = EVP_DigestFinal_ex(*ctx, tmp_digest, NULL) ?
+    CURLE_OK : CURLE_BAD_FUNCTION_ARGUMENT;
+  if(result == CURLE_OK)
+    memcpy(digest, tmp_digest, CURL_SHA512_256_DIGEST_SIZE);
+  curlx_memzero(tmp_digest, sizeof(tmp_digest));
+#else /* !NEED_NETBSD_SHA512_256_WORKAROUND */
+  result = EVP_DigestFinal_ex(*ctx, digest, NULL) ?
+    CURLE_OK : CURLE_BAD_FUNCTION_ARGUMENT;
+#endif /* NEED_NETBSD_SHA512_256_WORKAROUND */
+
+  EVP_MD_CTX_destroy(*ctx);
+  *ctx = NULL;
+
+  return result;
+}
+
+#elif defined(USE_WOLFSSL_SHA512_256)
+#include <wolfssl/wolfcrypt/sha512.h>
+
+#define CURL_SHA512_256_DIGEST_SIZE WC_SHA512_256_DIGEST_SIZE
+#define CURL_SHA512_256_BLOCK_SIZE  WC_SHA512_256_BLOCK_SIZE
+
+typedef struct wc_Sha512 Curl_sha512_256_ctx;
+
+static CURLcode Curl_sha512_256_init(void *ctx)
+{
+  if(wc_InitSha512_256(ctx))
+    return CURLE_FAILED_INIT;
+  return CURLE_OK;
+}
+
+static CURLcode Curl_sha512_256_update(void *ctx,
+                                       const unsigned char *data,
+                                       size_t length)
+{
+  do {
+    word32 ilen = (word32)CURLMIN(length, UINT_MAX);
+    if(wc_Sha512_256Update(ctx, data, ilen))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    length -= ilen;
+    data += ilen;
+  } while(length);
+  return CURLE_OK;
+}
+
+static CURLcode Curl_sha512_256_finish(unsigned char *digest, void *ctx)
+{
+  if(wc_Sha512_256Final(ctx, digest))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  return CURLE_OK;
+}
+
+#elif defined(USE_GNUTLS_SHA512_256)
+
+#define CURL_SHA512_256_BLOCK_SIZE  SHA512_256_BLOCK_SIZE
+#define CURL_SHA512_256_DIGEST_SIZE SHA512_256_DIGEST_SIZE
+
+/**
+ * Context type used for SHA-512/256 calculations
+ */
+typedef struct sha512_256_ctx Curl_sha512_256_ctx;
+
+/**
+ * Initialize structure for SHA-512/256 calculation.
+ *
+ * @param context the calculation context
+ * @return always CURLE_OK
+ */
+static CURLcode Curl_sha512_256_init(void *context)
+{
+  Curl_sha512_256_ctx * const ctx = (Curl_sha512_256_ctx *)context;
+
+  /* Check whether the header and this file use the same numbers */
+  DEBUGASSERT(CURL_SHA512_256_DIGEST_LENGTH == CURL_SHA512_256_DIGEST_SIZE);
+
+  sha512_256_init(ctx);
+
+  return CURLE_OK;
+}
+
+/**
+ * Process portion of bytes.
+ *
+ * @param context the calculation context
+ * @param data bytes to add to hash
+ * @param length number of bytes in @a data
+ * @return always CURLE_OK
+ */
+static CURLcode Curl_sha512_256_update(void *context,
+                                       const unsigned char *data,
+                                       size_t length)
+{
+  Curl_sha512_256_ctx * const ctx = (Curl_sha512_256_ctx *)context;
+
+  DEBUGASSERT(data || (length == 0));
+
+  sha512_256_update(ctx, length, (const uint8_t *)data);
+
+  return CURLE_OK;
+}
+
+/**
+ * Finalise SHA-512/256 calculation, return digest.
+ *
+ * @param context the calculation context
+ * @param[out] digest set to the hash, must be #CURL_SHA512_256_DIGEST_SIZE
+ *             bytes
+ * @return always CURLE_OK
+ */
+static CURLcode Curl_sha512_256_finish(unsigned char *digest, void *context)
+{
+  Curl_sha512_256_ctx * const ctx = (Curl_sha512_256_ctx *)context;
+
+#if NETTLE_VERSION_MAJOR >= 4
+  sha512_256_digest(ctx, (uint8_t *)digest);
+#else
+  sha512_256_digest(ctx,
+                    (size_t)CURL_SHA512_256_DIGEST_SIZE, (uint8_t *)digest);
+#endif
+
+  return CURLE_OK;
+}
+
+#else /* No system or TLS backend SHA-512/256 implementation available */
+
+/* ** This implementation of SHA-512/256 hash calculation was originally ** *
+ * ** written by Evgeny Grin (Karlson2k) for GNU libmicrohttpd.          ** *
+ * ** The author ported the code to libcurl. The ported code is provided ** *
+ * ** under curl license.                                                ** */
+
+#ifdef __GNUC__
+#  if defined(__has_attribute) && defined(__STDC_VERSION__)
+#    if __has_attribute(always_inline) && __STDC_VERSION__ >= 199901L
+#      define CURL_FORCEINLINE CURL_INLINE __attribute__((always_inline))
+#    endif
+#  endif
+#endif
+
+#if !defined(CURL_FORCEINLINE) && \
+  defined(_MSC_VER) && !defined(__GNUC__) && !defined(__clang__)
+#define CURL_FORCEINLINE __forceinline
+#endif
+
+/* Assume that 'CURL_INLINE' keyword works or the
+ * macro was already defined correctly. */
+#ifndef CURL_FORCEINLINE
+#define CURL_FORCEINLINE CURL_INLINE
+#endif
+
+/* Bits manipulation macros and functions.
+   Can be moved to other headers to reuse. */
+
+#define CURL_GET_64BIT_BE(ptr)                       \
+  (((uint64_t)(((const uint8_t *)(ptr))[0]) << 56) | \
+   ((uint64_t)(((const uint8_t *)(ptr))[1]) << 48) | \
+   ((uint64_t)(((const uint8_t *)(ptr))[2]) << 40) | \
+   ((uint64_t)(((const uint8_t *)(ptr))[3]) << 32) | \
+   ((uint64_t)(((const uint8_t *)(ptr))[4]) << 24) | \
+   ((uint64_t)(((const uint8_t *)(ptr))[5]) << 16) | \
+   ((uint64_t)(((const uint8_t *)(ptr))[6]) << 8)  | \
+    (uint64_t)(((const uint8_t *)(ptr))[7]))
+
+#define CURL_PUT_64BIT_BE(ptr, val)                             \
+  do {                                                          \
+    ((uint8_t *)(ptr))[7] = (uint8_t)((uint64_t)(val));         \
+    ((uint8_t *)(ptr))[6] = (uint8_t)(((uint64_t)(val)) >> 8);  \
+    ((uint8_t *)(ptr))[5] = (uint8_t)(((uint64_t)(val)) >> 16); \
+    ((uint8_t *)(ptr))[4] = (uint8_t)(((uint64_t)(val)) >> 24); \
+    ((uint8_t *)(ptr))[3] = (uint8_t)(((uint64_t)(val)) >> 32); \
+    ((uint8_t *)(ptr))[2] = (uint8_t)(((uint64_t)(val)) >> 40); \
+    ((uint8_t *)(ptr))[1] = (uint8_t)(((uint64_t)(val)) >> 48); \
+    ((uint8_t *)(ptr))[0] = (uint8_t)(((uint64_t)(val)) >> 56); \
+  } while(0)
+
+/* Defined as a function. The macro version may duplicate the binary code
+ * size as each argument is used twice, so if any calculation is used
+ * as an argument, the calculation could be done twice. */
+static CURL_FORCEINLINE uint64_t Curl_rotr64(uint64_t value, unsigned int bits)
+{
+  bits %= 64;
+  if(bits == 0)
+    return value;
+  /* Defined in a form which modern compiler could optimize. */
+  return (value >> bits) | (value << (64 - bits));
+}
+
+/* SHA-512/256 specific data */
+
+/**
+ * Number of bits in a single SHA-512/256 word.
+ */
+#define SHA512_256_WORD_SIZE_BITS 64
+
+/**
+ * Number of bytes in a single SHA-512/256 word.
+ */
+#define SHA512_256_BYTES_IN_WORD (SHA512_256_WORD_SIZE_BITS / 8)
+
+/**
+ * Hash is kept internally as 8 64-bit words.
+ * This is the intermediate hash size, used during computing the final digest.
+ */
+#define SHA512_256_HASH_SIZE_WORDS 8
+
+/**
+ * Size of the SHA-512/256 resulting digest in words.
+ * This is the final digest size, not intermediate hash.
+ */
+#define SHA512_256_DIGEST_SIZE_WORDS (SHA512_256_HASH_SIZE_WORDS / 2)
+
+/**
+ * Size of the SHA-512/256 resulting digest in bytes
+ * This is the final digest size, not intermediate hash.
+ */
+#define CURL_SHA512_256_DIGEST_SIZE \
+  (SHA512_256_DIGEST_SIZE_WORDS * SHA512_256_BYTES_IN_WORD)
+
+/**
+ * Size of the SHA-512/256 single processing block in bits.
+ */
+#define SHA512_256_BLOCK_SIZE_BITS 1024
+
+/**
+ * Size of the SHA-512/256 single processing block in bytes.
+ */
+#define CURL_SHA512_256_BLOCK_SIZE (SHA512_256_BLOCK_SIZE_BITS / 8)
+
+/**
+ * Size of the SHA-512/256 single processing block in words.
+ */
+#define SHA512_256_BLOCK_SIZE_WORDS \
+  (SHA512_256_BLOCK_SIZE_BITS / SHA512_256_WORD_SIZE_BITS)
+
+/**
+ * SHA-512/256 calculation context
+ */
+struct Curl_sha512_256ctx {
+  /**
+   * Intermediate hash value. The variable is properly aligned. Smart
+   * compilers may automatically use fast load/store instruction for big
+   * endian data on little endian machine.
+   */
+  uint64_t H[SHA512_256_HASH_SIZE_WORDS];
+  /**
+   * SHA-512/256 input data buffer. The buffer is properly aligned. Smart
+   * compilers may automatically use fast load/store instruction for big
+   * endian data on little endian machine.
+   */
+  uint64_t buffer[SHA512_256_BLOCK_SIZE_WORDS];
+  /**
+   * The number of bytes, lower part
+   */
+  uint64_t count;
+  /**
+   * The number of bits, high part. Unlike lower part, this counts the number
+   * of bits, not bytes.
+   */
+  uint64_t count_bits_hi;
+};
+
+/**
+ * Context type used for SHA-512/256 calculations
+ */
+typedef struct Curl_sha512_256ctx Curl_sha512_256_ctx;
+
+/**
+ * Initialize structure for SHA-512/256 calculation.
+ *
+ * @param context the calculation context
+ * @return always CURLE_OK
+ */
+static CURLcode Curl_sha512_256_init(void *context)
+{
+  struct Curl_sha512_256ctx * const ctx = (struct Curl_sha512_256ctx *)context;
+
+  /* Check whether the header and this file use the same numbers */
+  DEBUGASSERT(CURL_SHA512_256_DIGEST_LENGTH == CURL_SHA512_256_DIGEST_SIZE);
+
+  DEBUGASSERT(sizeof(uint64_t) == 8);
+
+  /* Initial hash values, see FIPS PUB 180-4 section 5.3.6.2 */
+  /* Values generated by "IV Generation Function" as described in
+   * section 5.3.6 */
+  ctx->H[0] = UINT64_C(0x22312194FC2BF72C);
+  ctx->H[1] = UINT64_C(0x9F555FA3C84C64C2);
+  ctx->H[2] = UINT64_C(0x2393B86B6F53B151);
+  ctx->H[3] = UINT64_C(0x963877195940EABD);
+  ctx->H[4] = UINT64_C(0x96283EE2A88EFFE3);
+  ctx->H[5] = UINT64_C(0xBE5E1E2553863992);
+  ctx->H[6] = UINT64_C(0x2B0199FC2C85B8AA);
+  ctx->H[7] = UINT64_C(0x0EB72DDC81C52CA2);
+
+  /* Initialize number of bytes and high part of number of bits. */
+  ctx->count = UINT64_C(0);
+  ctx->count_bits_hi = UINT64_C(0);
+
+  return CURLE_OK;
+}
+
+/**
+ * Base of the SHA-512/256 transformation.
+ * Gets a full 128 bytes block of data and updates hash values;
+ * @param H     hash values
+ * @param data  the data buffer with #CURL_SHA512_256_BLOCK_SIZE bytes block
+ */
+static void Curl_sha512_256_transform(uint64_t H[SHA512_256_HASH_SIZE_WORDS],
+                                      const void *data)
+{
+  /* Working variables,
+     see FIPS PUB 180-4 section 6.7, 6.4. */
+  uint64_t a = H[0];
+  uint64_t b = H[1];
+  uint64_t c = H[2];
+  uint64_t d = H[3];
+  uint64_t e = H[4];
+  uint64_t f = H[5];
+  uint64_t g = H[6];
+  uint64_t h = H[7];
+
+  /* Data buffer, used as a cyclic buffer.
+     See FIPS PUB 180-4 section 5.2.2, 6.7, 6.4. */
+  uint64_t W[16];
+
+  /* 'Ch' and 'Maj' macro functions are defined with widely-used optimization.
+     See FIPS PUB 180-4 formulae 4.8, 4.9. */
+#define Sha512_Ch(x, y, z)    ((z) ^ ((x) & ((y) ^ (z))))
+#define Sha512_Maj(x, y, z)   (((x) & (y)) ^ ((z) & ((x) ^ (y))))
+
+  /* Four 'Sigma' macro functions.
+     See FIPS PUB 180-4 formulae 4.10, 4.11, 4.12, 4.13. */
+#define SIG0(x) (Curl_rotr64(x, 28) ^ Curl_rotr64(x, 34) ^ Curl_rotr64(x, 39))
+#define SIG1(x) (Curl_rotr64(x, 14) ^ Curl_rotr64(x, 18) ^ Curl_rotr64(x, 41))
+#define sig0(x) (Curl_rotr64(x,  1) ^ Curl_rotr64(x,  8) ^ ((x) >> 7))
+#define sig1(x) (Curl_rotr64(x, 19) ^ Curl_rotr64(x, 61) ^ ((x) >> 6))
+
+  if(1) {
+    unsigned int t;
+    /* K constants array.
+       See FIPS PUB 180-4 section 4.2.3 for K values. */
+    static const uint64_t K[80] = {
+      UINT64_C(0x428a2f98d728ae22), UINT64_C(0x7137449123ef65cd),
+      UINT64_C(0xb5c0fbcfec4d3b2f), UINT64_C(0xe9b5dba58189dbbc),
+      UINT64_C(0x3956c25bf348b538), UINT64_C(0x59f111f1b605d019),
+      UINT64_C(0x923f82a4af194f9b), UINT64_C(0xab1c5ed5da6d8118),
+      UINT64_C(0xd807aa98a3030242), UINT64_C(0x12835b0145706fbe),
+      UINT64_C(0x243185be4ee4b28c), UINT64_C(0x550c7dc3d5ffb4e2),
+      UINT64_C(0x72be5d74f27b896f), UINT64_C(0x80deb1fe3b1696b1),
+      UINT64_C(0x9bdc06a725c71235), UINT64_C(0xc19bf174cf692694),
+      UINT64_C(0xe49b69c19ef14ad2), UINT64_C(0xefbe4786384f25e3),
+      UINT64_C(0x0fc19dc68b8cd5b5), UINT64_C(0x240ca1cc77ac9c65),
+      UINT64_C(0x2de92c6f592b0275), UINT64_C(0x4a7484aa6ea6e483),
+      UINT64_C(0x5cb0a9dcbd41fbd4), UINT64_C(0x76f988da831153b5),
+      UINT64_C(0x983e5152ee66dfab), UINT64_C(0xa831c66d2db43210),
+      UINT64_C(0xb00327c898fb213f), UINT64_C(0xbf597fc7beef0ee4),
+      UINT64_C(0xc6e00bf33da88fc2), UINT64_C(0xd5a79147930aa725),
+      UINT64_C(0x06ca6351e003826f), UINT64_C(0x142929670a0e6e70),
+      UINT64_C(0x27b70a8546d22ffc), UINT64_C(0x2e1b21385c26c926),
+      UINT64_C(0x4d2c6dfc5ac42aed), UINT64_C(0x53380d139d95b3df),
+      UINT64_C(0x650a73548baf63de), UINT64_C(0x766a0abb3c77b2a8),
+      UINT64_C(0x81c2c92e47edaee6), UINT64_C(0x92722c851482353b),
+      UINT64_C(0xa2bfe8a14cf10364), UINT64_C(0xa81a664bbc423001),
+      UINT64_C(0xc24b8b70d0f89791), UINT64_C(0xc76c51a30654be30),
+      UINT64_C(0xd192e819d6ef5218), UINT64_C(0xd69906245565a910),
+      UINT64_C(0xf40e35855771202a), UINT64_C(0x106aa07032bbd1b8),
+      UINT64_C(0x19a4c116b8d2d0c8), UINT64_C(0x1e376c085141ab53),
+      UINT64_C(0x2748774cdf8eeb99), UINT64_C(0x34b0bcb5e19b48a8),
+      UINT64_C(0x391c0cb3c5c95a63), UINT64_C(0x4ed8aa4ae3418acb),
+      UINT64_C(0x5b9cca4f7763e373), UINT64_C(0x682e6ff3d6b2b8a3),
+      UINT64_C(0x748f82ee5defb2fc), UINT64_C(0x78a5636f43172f60),
+      UINT64_C(0x84c87814a1f0ab72), UINT64_C(0x8cc702081a6439ec),
+      UINT64_C(0x90befffa23631e28), UINT64_C(0xa4506cebde82bde9),
+      UINT64_C(0xbef9a3f7b2c67915), UINT64_C(0xc67178f2e372532b),
+      UINT64_C(0xca273eceea26619c), UINT64_C(0xd186b8c721c0c207),
+      UINT64_C(0xeada7dd6cde0eb1e), UINT64_C(0xf57d4f7fee6ed178),
+      UINT64_C(0x06f067aa72176fba), UINT64_C(0x0a637dc5a2c898a6),
+      UINT64_C(0x113f9804bef90dae), UINT64_C(0x1b710b35131c471b),
+      UINT64_C(0x28db77f523047d84), UINT64_C(0x32caab7b40c72493),
+      UINT64_C(0x3c9ebe0a15c9bebc), UINT64_C(0x431d67c49c100d4c),
+      UINT64_C(0x4cc5d4becb3e42b6), UINT64_C(0x597f299cfc657e2a),
+      UINT64_C(0x5fcb6fab3ad6faec), UINT64_C(0x6c44198c4a475817)
+    };
+
+    /* One step of SHA-512/256 computation,
+       see FIPS PUB 180-4 section 6.4.2 step 3.
+       * Note: this macro updates working variables in-place, without rotation.
+       * Note: the first (vH += SIG1(vE) + Ch(vE,vF,vG) + kt + wt) equals T1 in
+       FIPS PUB 180-4 section 6.4.2 step 3.
+       the second (vH += SIG0(vA) + Maj(vE,vF,vC) equals T1 + T2 in
+       FIPS PUB 180-4 section 6.4.2 step 3.
+       * Note: 'wt' must be used exactly one time in this macro as macro for
+       'wt' calculation may change other data as well every time when
+       used. */
+#define SHA2STEP64(vA, vB, vC, vD, vE, vF, vG, vH, kt, wt)                    \
+  do {                                                                        \
+    (vD) += ((vH) += SIG1(vE) + Sha512_Ch(vE, vF, vG) + (kt) + (wt));         \
+    (vH) += SIG0(vA) + Sha512_Maj(vA, vB, vC);                                \
+  } while(0)
+
+    /* One step of SHA-512/256 computation with working variables rotation,
+       see FIPS PUB 180-4 section 6.4.2 step 3. This macro version reassigns
+       all working variables on each step. */
+#define SHA2STEP64RV(vA, vB, vC, vD, vE, vF, vG, vH, kt, wt)                  \
+  do {                                                                        \
+    uint64_t tmp_h_ = (vH);                                                   \
+    SHA2STEP64(vA, vB, vC, vD, vE, vF, vG, tmp_h_, kt, wt);                   \
+    (vH) = (vG);                                                              \
+    (vG) = (vF);                                                              \
+    (vF) = (vE);                                                              \
+    (vE) = (vD);                                                              \
+    (vD) = (vC);                                                              \
+    (vC) = (vB);                                                              \
+    (vB) = (vA);                                                              \
+    (vA) = tmp_h_;                                                            \
+  } while(0)
+
+    /* Get value of W(t) from input data buffer for 0 <= t <= 15,
+       See FIPS PUB 180-4 section 6.2.
+       Input data must be read in big-endian bytes order,
+       see FIPS PUB 180-4 section 3.1.2. */
+#define SHA512_GET_W_FROM_DATA(buf, t) \
+  CURL_GET_64BIT_BE((const uint8_t *)(buf) + ((t) * SHA512_256_BYTES_IN_WORD))
+
+    /* During first 16 steps, before making any calculation on each step, the
+       W element is read from the input data buffer as a big-endian value and
+       stored in the array of W elements. */
+    for(t = 0; t < 16; ++t) {
+      SHA2STEP64RV(a, b, c, d, e, f, g, h, K[t],
+                   W[t] = SHA512_GET_W_FROM_DATA(data, t));
+    }
+
+    /* 'W' generation and assignment for 16 <= t <= 79.
+       See FIPS PUB 180-4 section 6.4.2.
+       As only the last 16 'W' are used in calculations, it is possible to
+       use 16 elements array of W as a cyclic buffer.
+       Note: ((t-16) & 15) have same value as (t & 15) */
+#define Wgen(w, t)                                               \
+  (uint64_t)((w)[((t) - 16) & 15] + sig1((w)[((t) -  2) & 15]) + \
+             (w)[((t) -  7) & 15] + sig0((w)[((t) - 15) & 15]))
+
+    /* During the last 64 steps, before making any calculation on each step,
+       current W element is generated from other W elements of the cyclic
+       buffer and the generated value is stored back in the cyclic buffer. */
+    for(t = 16; t < 80; ++t) {
+      SHA2STEP64RV(a, b, c, d, e, f, g, h, K[t],
+                   W[t & 15] = Wgen(W, t));
+    }
+  }
+
+  /* Compute and store the intermediate hash.
+     See FIPS PUB 180-4 section 6.4.2 step 4. */
+  H[0] += a;
+  H[1] += b;
+  H[2] += c;
+  H[3] += d;
+  H[4] += e;
+  H[5] += f;
+  H[6] += g;
+  H[7] += h;
+}
+
+/**
+ * Process portion of bytes.
+ *
+ * @param context the calculation context
+ * @param data bytes to add to hash
+ * @param length number of bytes in @a data
+ * @return always CURLE_OK
+ */
+static CURLcode Curl_sha512_256_update(void *context,
+                                       const unsigned char *data,
+                                       size_t length)
+{
+  unsigned int bytes_have; /* Number of bytes in the context buffer */
+  struct Curl_sha512_256ctx * const ctx = (struct Curl_sha512_256ctx *)context;
+  /* the void pointer here is required to mute Intel compiler warning */
+  void * const ctx_buf = ctx->buffer;
+
+  DEBUGASSERT(data || (length == 0));
+
+  if(length == 0)
+    return CURLE_OK; /* Shortcut, do nothing */
+
+  /* Note: (count & (CURL_SHA512_256_BLOCK_SIZE-1))
+     equals (count % CURL_SHA512_256_BLOCK_SIZE) for this block size. */
+  bytes_have = (unsigned int)(ctx->count & (CURL_SHA512_256_BLOCK_SIZE - 1));
+  ctx->count += length;
+  if(length > ctx->count)
+    ctx->count_bits_hi += 1U << 3; /* Value wrap */
+  ctx->count_bits_hi += ctx->count >> 61;
+  ctx->count &= UINT64_C(0x1FFFFFFFFFFFFFFF);
+
+  if(bytes_have) {
+    unsigned int bytes_left = CURL_SHA512_256_BLOCK_SIZE - bytes_have;
+    if(length >= bytes_left) {
+      /* Combine new data with data in the buffer and process the full
+         block. */
+      memcpy((unsigned char *)ctx_buf + bytes_have, data, bytes_left);
+      data += bytes_left;
+      length -= bytes_left;
+      Curl_sha512_256_transform(ctx->H, ctx->buffer);
+      bytes_have = 0;
+    }
+  }
+
+  while(CURL_SHA512_256_BLOCK_SIZE <= length) {
+    /* Process any full blocks of new data directly,
+       without copying to the buffer. */
+    Curl_sha512_256_transform(ctx->H, data);
+    data += CURL_SHA512_256_BLOCK_SIZE;
+    length -= CURL_SHA512_256_BLOCK_SIZE;
+  }
+
+  if(length) {
+    /* Copy incomplete block of new data (if any)
+       to the buffer. */
+    memcpy((unsigned char *)ctx_buf + bytes_have, data, length);
+  }
+
+  return CURLE_OK;
+}
+
+/**
+ * Size of "length" insertion in bits.
+ * See FIPS PUB 180-4 section 5.1.2.
+ */
+#define SHA512_256_SIZE_OF_LEN_ADD_BITS 128
+
+/**
+ * Size of "length" insertion in bytes.
+ */
+#define SHA512_256_SIZE_OF_LEN_ADD (SHA512_256_SIZE_OF_LEN_ADD_BITS / 8)
+
+/**
+ * Finalise SHA-512/256 calculation, return digest.
+ *
+ * @param context the calculation context
+ * @param[out] digest set to the hash, must be #CURL_SHA512_256_DIGEST_SIZE
+ *             bytes
+ * @return always CURLE_OK
+ */
+static CURLcode Curl_sha512_256_finish(unsigned char *digest, void *context)
+{
+  struct Curl_sha512_256ctx * const ctx = (struct Curl_sha512_256ctx *)context;
+  uint64_t num_bits; /* Number of processed bits */
+  unsigned int bytes_have; /* Number of bytes in the context buffer */
+  /* the void pointer here is required to mute Intel compiler warning */
+  void * const ctx_buf = ctx->buffer;
+
+  /* Memorise the number of processed bits.
+     The padding and other data added here during the postprocessing must
+     not change the amount of hashed data. */
+  num_bits = ctx->count << 3;
+
+  /* Note: (count & (CURL_SHA512_256_BLOCK_SIZE-1))
+           equals (count % CURL_SHA512_256_BLOCK_SIZE) for this block size. */
+  bytes_have = (unsigned int)(ctx->count & (CURL_SHA512_256_BLOCK_SIZE - 1));
+
+  /* Input data must be padded with a single bit "1", then with zeros and
+     the finally the length of data in bits must be added as the final bytes
+     of the last block.
+     See FIPS PUB 180-4 section 5.1.2. */
+
+  /* Data is always processed in form of bytes (not by individual bits),
+     therefore position of the first padding bit in byte is always
+     predefined (0x80). */
+  /* Buffer always have space at least for one byte (as full buffers are
+     processed when formed). */
+  ((unsigned char *)ctx_buf)[bytes_have++] = 0x80U;
+
+  if(CURL_SHA512_256_BLOCK_SIZE - bytes_have < SHA512_256_SIZE_OF_LEN_ADD) {
+    /* No space in the current block to put the total length of message.
+       Pad the current block with zeros and process it. */
+    if(bytes_have < CURL_SHA512_256_BLOCK_SIZE)
+      memset((unsigned char *)ctx_buf + bytes_have, 0,
+             CURL_SHA512_256_BLOCK_SIZE - bytes_have);
+    /* Process the full block. */
+    Curl_sha512_256_transform(ctx->H, ctx->buffer);
+    /* Start the new block. */
+    bytes_have = 0;
+  }
+
+  /* Pad the rest of the buffer with zeros. */
+  memset((unsigned char *)ctx_buf + bytes_have, 0,
+         CURL_SHA512_256_BLOCK_SIZE - SHA512_256_SIZE_OF_LEN_ADD - bytes_have);
+  /* Put high part of number of bits in processed message and then lower
+     part of number of bits as big-endian values.
+     See FIPS PUB 180-4 section 5.1.2. */
+  /* Note: the target location is predefined and buffer is always aligned */
+  CURL_PUT_64BIT_BE((unsigned char *)ctx_buf +
+                    CURL_SHA512_256_BLOCK_SIZE - SHA512_256_SIZE_OF_LEN_ADD,
+                    ctx->count_bits_hi);
+  CURL_PUT_64BIT_BE((unsigned char *)ctx_buf +
+                    CURL_SHA512_256_BLOCK_SIZE - SHA512_256_SIZE_OF_LEN_ADD +
+                    SHA512_256_BYTES_IN_WORD,
+                    num_bits);
+  /* Process the full final block. */
+  Curl_sha512_256_transform(ctx->H, ctx->buffer);
+
+  /* Put in BE mode the leftmost part of the hash as the final digest.
+     See FIPS PUB 180-4 section 6.7. */
+
+  CURL_PUT_64BIT_BE(digest + (0 * SHA512_256_BYTES_IN_WORD), ctx->H[0]);
+  CURL_PUT_64BIT_BE(digest + (1 * SHA512_256_BYTES_IN_WORD), ctx->H[1]);
+  CURL_PUT_64BIT_BE(digest + (2 * SHA512_256_BYTES_IN_WORD), ctx->H[2]);
+  CURL_PUT_64BIT_BE(digest + (3 * SHA512_256_BYTES_IN_WORD), ctx->H[3]);
+
+  /* Erase potentially sensitive data. */
+  memset(ctx, 0, sizeof(struct Curl_sha512_256ctx));
+
+  return CURLE_OK;
+}
+
+#endif /* Local SHA-512/256 code */
+
+/**
+ * Compute SHA-512/256 hash for the given data in one function call
+ * @param[out] output the pointer to put the hash
+ * @param[in] input the pointer to the data to process
+ * @param input_size the size of the data pointed by @a input
+ * @return always #CURLE_OK
+ */
+CURLcode Curl_sha512_256it(unsigned char *output, const unsigned char *input,
+                           size_t input_size)
+{
+  Curl_sha512_256_ctx ctx;
+  CURLcode result;
+
+  result = Curl_sha512_256_init(&ctx);
+  if(result != CURLE_OK)
+    return result;
+
+  result = Curl_sha512_256_update(&ctx, (const void *)input, input_size);
+
+  if(result != CURLE_OK) {
+    (void)Curl_sha512_256_finish(output, &ctx);
+    return result;
+  }
+
+  return Curl_sha512_256_finish(output, &ctx);
+}
+
+/* Wrapper function, takes 'unsigned int' as length type, returns void */
+static void Curl_sha512_256_update_i(void *context,
+                                     const unsigned char *data,
+                                     unsigned int length)
+{
+  /* Hypothetically the function may fail, but assume it does not */
+  (void)Curl_sha512_256_update(context, data, length);
+}
+
+/* Wrapper function, returns void */
+static void Curl_sha512_256_finish_v(unsigned char *result, void *context)
+{
+  /* Hypothetically the function may fail, but assume it does not */
+  (void)Curl_sha512_256_finish(result, context);
+}
+
+/* Wrapper function, takes 'unsigned int' as length type, returns void */
+
+const struct HMAC_params Curl_HMAC_SHA512_256[] = {
+  {
+    /* Initialize context procedure. */
+    Curl_sha512_256_init,
+    /* Update context with data. */
+    Curl_sha512_256_update_i,
+    /* Get final result procedure. */
+    Curl_sha512_256_finish_v,
+    /* Context structure size. */
+    sizeof(Curl_sha512_256_ctx),
+    /* Maximum key length (bytes). */
+    CURL_SHA512_256_BLOCK_SIZE,
+    /* Result length (bytes). */
+    CURL_SHA512_256_DIGEST_SIZE
+  }
+};
+
+#endif /* !CURL_DISABLE_DIGEST_AUTH && !CURL_DISABLE_SHA512_256 */
diff --git a/third-party/curl/lib/curl_sha512_256.h b/third-party/curl/lib/curl_sha512_256.h
new file mode 100644
index 0000000000..ddaf8be91d
--- /dev/null
+++ b/third-party/curl/lib/curl_sha512_256.h
@@ -0,0 +1,43 @@
+#ifndef HEADER_CURL_SHA512_256_H
+#define HEADER_CURL_SHA512_256_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Evgeny Grin (Karlson2k), <k2k@narod.ru>.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#if !defined(CURL_DISABLE_DIGEST_AUTH) && !defined(CURL_DISABLE_SHA512_256)
+
+#include "curl_hmac.h"
+
+#define CURL_HAVE_SHA512_256
+
+extern const struct HMAC_params Curl_HMAC_SHA512_256[1];
+
+#define CURL_SHA512_256_DIGEST_LENGTH 32
+
+CURLcode Curl_sha512_256it(unsigned char *output, const unsigned char *input,
+                           size_t input_size);
+
+#endif /* !CURL_DISABLE_DIGEST_AUTH && !CURL_DISABLE_SHA512_256 */
+
+#endif /* HEADER_CURL_SHA256_H */
diff --git a/third-party/curl/lib/curl_share.c b/third-party/curl/lib/curl_share.c
new file mode 100644
index 0000000000..94469bc3ef
--- /dev/null
+++ b/third-party/curl/lib/curl_share.c
@@ -0,0 +1,472 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "urldata.h"
+#include "multiif.h"
+#include "curl_threads.h"
+#include "curl_share.h"
+#include "vtls/vtls.h"
+#include "vtls/vtls_scache.h"
+#include "hsts.h"
+#include "url.h"
+
+static void share_destroy(struct Curl_share *share)
+{
+  if(share->specifier & (1 << CURL_LOCK_DATA_CONNECT)) {
+    Curl_cpool_destroy(&share->cpool);
+  }
+
+  Curl_dnscache_destroy(&share->dnscache);
+
+#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_COOKIES)
+  Curl_cookie_cleanup(share->cookies);
+#endif
+
+#ifndef CURL_DISABLE_HSTS
+  Curl_hsts_cleanup(&share->hsts);
+#endif
+
+#ifdef USE_SSL
+  if(share->ssl_scache) {
+    Curl_ssl_scache_destroy(share->ssl_scache);
+    share->ssl_scache = NULL;
+  }
+#endif
+
+  Curl_psl_destroy(&share->psl);
+  Curl_close(&share->admin);
+
+#ifdef USE_MUTEX
+  Curl_mutex_destroy(&share->lock);
+#endif
+  share->magic = 0;
+  curlx_free(share);
+}
+
+CURLSH *curl_share_init(void)
+{
+  struct Curl_share *share = curlx_calloc(1, sizeof(struct Curl_share));
+  if(share) {
+    share->magic = CURL_GOOD_SHARE;
+    share->specifier |= (1 << CURL_LOCK_DATA_SHARE);
+#ifdef USE_MUTEX
+    Curl_mutex_init(&share->lock);
+#endif
+    share->ref_count = 1;
+    Curl_dnscache_init(&share->dnscache, 23);
+    share->admin = curl_easy_init();
+    if(!share->admin) {
+      share_destroy(share);
+      return NULL;
+    }
+    /* admin handles have mid 0 */
+    share->admin->mid = 0;
+    share->admin->state.internal = TRUE;
+#ifdef DEBUGBUILD
+    if(getenv("CURL_DEBUG"))
+      share->admin->set.verbose = TRUE;
+#endif
+  }
+  return share;
+}
+
+static uint32_t share_ref_inc(struct Curl_share *share)
+{
+  uint32_t n;
+#ifdef USE_MUTEX
+  Curl_mutex_acquire(&share->lock);
+  n = ++(share->ref_count);
+  share->has_been_shared = TRUE;
+  Curl_mutex_release(&share->lock);
+#else
+  n = ++(share->ref_count);
+  share->has_been_shared = TRUE;
+#endif
+  return n;
+}
+
+static uint32_t share_ref_dec(struct Curl_share *share)
+{
+  uint32_t n;
+#ifdef USE_MUTEX
+  Curl_mutex_acquire(&share->lock);
+  DEBUGASSERT(share->ref_count);
+  n = --(share->ref_count);
+  Curl_mutex_release(&share->lock);
+#else
+  n = --(share->ref_count);
+#endif
+  return n;
+}
+
+static bool share_has_been_shared(struct Curl_share *share)
+{
+  bool was_shared;
+#ifdef USE_MUTEX
+  Curl_mutex_acquire(&share->lock);
+  was_shared = share->has_been_shared;
+  Curl_mutex_release(&share->lock);
+#else
+  was_shared = share->has_been_shared;
+#endif
+  return was_shared;
+}
+
+static bool share_lock_acquire(struct Curl_share *share,
+                               struct Curl_easy *data)
+{
+  if(share->lockfunc && share->unlockfunc &&
+     (data || share_has_been_shared(share))) {
+    share->lockfunc(data, CURL_LOCK_DATA_SHARE, CURL_LOCK_ACCESS_SINGLE,
+                    share->clientdata);
+    return TRUE;
+  }
+  return FALSE;
+}
+
+static void share_lock_release(struct Curl_share *share,
+                               struct Curl_easy *data,
+                               bool locked)
+{
+  if(locked) {
+    DEBUGASSERT(share->unlockfunc);
+    if(share->unlockfunc)
+      share->unlockfunc(data, CURL_LOCK_DATA_SHARE, share->clientdata);
+  }
+}
+
+static bool share_in_use(struct Curl_share *share)
+{
+  bool in_use;
+#ifdef USE_MUTEX
+  Curl_mutex_acquire(&share->lock);
+  in_use = (share->ref_count > 1);
+  Curl_mutex_release(&share->lock);
+#else
+  bool locked = share_lock_acquire(share, NULL);
+  in_use = (share->ref_count > 1);
+  share_lock_release(share, NULL, locked);
+#endif
+  return in_use;
+}
+
+static void share_unlink(struct Curl_share **pshare,
+                         struct Curl_easy *data,
+                         bool locked)
+{
+  struct Curl_share *share = *pshare;
+  uint32_t n;
+
+  *pshare = NULL;
+  n = share_ref_dec(share);
+  if(locked)
+    share_lock_release(share, data, locked);
+  if(!n)  /* last reference gone */
+    share_destroy(share);
+}
+
+#undef curl_share_setopt
+CURLSHcode curl_share_setopt(CURLSH *sh, CURLSHoption option, ...)
+{
+  va_list param;
+  int type;
+  curl_lock_function lockfunc;
+  curl_unlock_function unlockfunc;
+  void *ptr;
+  CURLSHcode res = CURLSHE_OK;
+  struct Curl_share *share = sh;
+
+  if(!GOOD_SHARE_HANDLE(share))
+    return CURLSHE_INVALID;
+
+  if(share_in_use(share)) {
+    /* do not allow setting options while one or more handles are already
+       using this share */
+    return CURLSHE_IN_USE;
+  }
+
+  va_start(param, option);
+
+  switch(option) {
+  case CURLSHOPT_SHARE:
+    /* this is a type this share will share */
+    type = va_arg(param, int);
+
+    switch(type) {
+    case CURL_LOCK_DATA_DNS:
+      break;
+
+    case CURL_LOCK_DATA_COOKIE:
+#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_COOKIES)
+      if(!share->cookies) {
+        share->cookies = Curl_cookie_init();
+        if(!share->cookies)
+          res = CURLSHE_NOMEM;
+      }
+#else /* CURL_DISABLE_HTTP || CURL_DISABLE_COOKIES */
+      res = CURLSHE_NOT_BUILT_IN;
+#endif
+      break;
+
+    case CURL_LOCK_DATA_HSTS:
+#ifndef CURL_DISABLE_HSTS
+      if(!share->hsts) {
+        share->hsts = Curl_hsts_init();
+        if(!share->hsts)
+          res = CURLSHE_NOMEM;
+      }
+#else /* CURL_DISABLE_HSTS */
+      res = CURLSHE_NOT_BUILT_IN;
+#endif
+      break;
+
+    case CURL_LOCK_DATA_SSL_SESSION:
+#ifdef USE_SSL
+      if(!share->ssl_scache) {
+        /* There is no way (yet) for the application to configure the
+         * session cache size, shared between many transfers. As for curl
+         * itself, a high session count will impact startup time. Also, the
+         * scache is not optimized for several hundreds of peers.
+         * Keep it at a reasonable level. */
+        if(Curl_ssl_scache_create(25, 2, &share->ssl_scache))
+          res = CURLSHE_NOMEM;
+      }
+#else
+      res = CURLSHE_NOT_BUILT_IN;
+#endif
+      break;
+
+    case CURL_LOCK_DATA_CONNECT:
+      /* It is safe to set this option several times on a share. */
+      if(!share->cpool.initialized) {
+        Curl_cpool_init(&share->cpool, share->admin, share, 103);
+      }
+      break;
+
+    case CURL_LOCK_DATA_PSL:
+#ifndef USE_LIBPSL
+      res = CURLSHE_NOT_BUILT_IN;
+#endif
+      break;
+
+    default:
+      res = CURLSHE_BAD_OPTION;
+    }
+    if(!res)
+      share->specifier |= (unsigned int)(1 << type);
+    break;
+
+  case CURLSHOPT_UNSHARE:
+    /* this is a type this share will no longer share */
+    type = va_arg(param, int);
+    switch(type) {
+    case CURL_LOCK_DATA_DNS:
+      break;
+
+    case CURL_LOCK_DATA_COOKIE:
+#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_COOKIES)
+      if(share->cookies) {
+        Curl_cookie_cleanup(share->cookies);
+        share->cookies = NULL;
+      }
+#else /* CURL_DISABLE_HTTP || CURL_DISABLE_COOKIES */
+      res = CURLSHE_NOT_BUILT_IN;
+#endif
+      break;
+
+    case CURL_LOCK_DATA_HSTS:
+#ifndef CURL_DISABLE_HSTS
+      if(share->hsts) {
+        Curl_hsts_cleanup(&share->hsts);
+      }
+#else /* CURL_DISABLE_HSTS */
+      res = CURLSHE_NOT_BUILT_IN;
+#endif
+      break;
+
+    case CURL_LOCK_DATA_SSL_SESSION:
+#ifdef USE_SSL
+      if(share->ssl_scache) {
+        Curl_ssl_scache_destroy(share->ssl_scache);
+        share->ssl_scache = NULL;
+      }
+#else
+      res = CURLSHE_NOT_BUILT_IN;
+#endif
+      break;
+
+    case CURL_LOCK_DATA_CONNECT:
+      break;
+
+    default:
+      res = CURLSHE_BAD_OPTION;
+      break;
+    }
+    if(!res)
+      share->specifier &= ~(unsigned int)(1 << type);
+    break;
+
+  case CURLSHOPT_LOCKFUNC:
+    lockfunc = va_arg(param, curl_lock_function);
+    share->lockfunc = lockfunc;
+    break;
+
+  case CURLSHOPT_UNLOCKFUNC:
+    unlockfunc = va_arg(param, curl_unlock_function);
+    share->unlockfunc = unlockfunc;
+    break;
+
+  case CURLSHOPT_USERDATA:
+    ptr = va_arg(param, void *);
+    share->clientdata = ptr;
+    break;
+
+  default:
+    res = CURLSHE_BAD_OPTION;
+    break;
+  }
+
+  va_end(param);
+
+  return res;
+}
+
+CURLSHcode curl_share_cleanup(CURLSH *sh)
+{
+  struct Curl_share *share = sh;
+  bool locked;
+  if(!GOOD_SHARE_HANDLE(share))
+    return CURLSHE_INVALID;
+
+  if(share_in_use(share))
+    return CURLSHE_IN_USE;
+
+  locked = share_lock_acquire(share, NULL);
+  share_unlink(&share, NULL, locked);
+  return CURLSHE_OK;
+}
+
+CURLSHcode Curl_share_lock(struct Curl_easy *data, curl_lock_data type,
+                           curl_lock_access accesstype)
+{
+  struct Curl_share *share = data->share;
+
+  if(!share)
+    return CURLSHE_INVALID;
+
+  if(share->specifier & (unsigned int)(1 << type)) {
+    if(share->lockfunc) /* only call this if set! */
+      share->lockfunc(data, type, accesstype, share->clientdata);
+  }
+  /* else if we do not share this, pretend successful lock */
+
+  return CURLSHE_OK;
+}
+
+CURLSHcode Curl_share_unlock(struct Curl_easy *data, curl_lock_data type)
+{
+  struct Curl_share *share = data->share;
+
+  if(!share)
+    return CURLSHE_INVALID;
+
+  if(share->specifier & (unsigned int)(1 << type)) {
+    if(share->unlockfunc) /* only call this if set! */
+      share->unlockfunc(data, type, share->clientdata);
+  }
+
+  return CURLSHE_OK;
+}
+
+CURLcode Curl_share_easy_unlink(struct Curl_easy *data)
+{
+  struct Curl_share *share = data->share;
+
+  if(share) {
+    bool locked = share_lock_acquire(share, data);
+
+    /* If data has a connection from this share, detach it. */
+    if(data->conn && (share->specifier & (1 << CURL_LOCK_DATA_CONNECT)))
+      Curl_detach_connection(data);
+
+#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_COOKIES)
+    if(share->cookies == data->cookies)
+      data->cookies = NULL;
+#endif
+
+#ifndef CURL_DISABLE_HSTS
+    if(share->hsts == data->hsts)
+      data->hsts = NULL;
+#endif
+#ifdef USE_LIBPSL
+    if(&share->psl == data->psl)
+      data->psl = data->multi ? &data->multi->psl : NULL;
+#endif
+
+    share_unlink(&data->share, data, locked);
+  }
+  return CURLE_OK;
+}
+
+CURLcode Curl_share_easy_link(struct Curl_easy *data,
+                              struct Curl_share *share)
+{
+  if(data->share) {
+    DEBUGASSERT(0);
+    return CURLE_FAILED_INIT;
+  }
+
+  if(share) {
+    bool locked = share_lock_acquire(share, data);
+
+    share_ref_inc(share);
+    data->share = share;
+
+#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_COOKIES)
+    if(share->cookies) {
+      /* use shared cookie list, first free own one if any */
+      Curl_cookie_cleanup(data->cookies);
+      /* enable cookies since we now use a share that uses cookies! */
+      data->cookies = share->cookies;
+    }
+#endif /* CURL_DISABLE_HTTP */
+#ifndef CURL_DISABLE_HSTS
+    if(share->hsts) {
+      /* first free the private one if any */
+      Curl_hsts_cleanup(&data->hsts);
+      data->hsts = share->hsts;
+    }
+#endif
+#ifdef USE_LIBPSL
+    if(share->specifier & (1 << CURL_LOCK_DATA_PSL))
+      data->psl = &share->psl;
+#endif
+
+    /* check for host cache not needed,
+     * it will be done by curl_easy_perform */
+    share_lock_release(share, data, locked);
+  }
+  return CURLE_OK;
+}
diff --git a/third-party/curl/lib/curl_share.h b/third-party/curl/lib/curl_share.h
new file mode 100644
index 0000000000..1d49a8d1dd
--- /dev/null
+++ b/third-party/curl/lib/curl_share.h
@@ -0,0 +1,92 @@
+#ifndef HEADER_CURL_SHARE_H
+#define HEADER_CURL_SHARE_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "curl_threads.h"
+#include "cookie.h"
+#include "psl.h"
+#include "urldata.h"
+#include "conncache.h"
+
+struct Curl_easy;
+struct Curl_ssl_scache;
+
+#define CURL_GOOD_SHARE 0x7e117a1e
+#define GOOD_SHARE_HANDLE(x) ((x) && (x)->magic == CURL_GOOD_SHARE)
+
+#define CURL_SHARE_KEEP_CONNECT(s)                          \
+  ((s) && ((s)->specifier & (1 << CURL_LOCK_DATA_CONNECT)))
+
+/* this struct is libcurl-private, do not export details */
+struct Curl_share {
+  unsigned int magic; /* CURL_GOOD_SHARE */
+  unsigned int specifier;
+
+  uint32_t ref_count;
+#ifdef USE_MUTEX
+   /* do `ref_count` and `has_been_shared` checks using this mutex. */
+  curl_mutex_t lock;
+  int has_been_shared;
+#else
+  /* this only ever goes from FALSE -> TRUE once. We need to check
+   * this without being able to use the `lockfunc`. */
+  volatile int has_been_shared;
+#endif
+  curl_lock_function lockfunc;
+  curl_unlock_function unlockfunc;
+  void *clientdata;
+  struct Curl_easy *admin;
+
+  struct cpool cpool;
+  struct Curl_dnscache dnscache; /* DNS cache */
+#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_COOKIES)
+  struct CookieInfo *cookies;
+#endif
+#ifdef USE_LIBPSL
+  struct PslCache psl;
+#endif
+#ifndef CURL_DISABLE_HSTS
+  struct hsts *hsts;
+#endif
+#ifdef USE_SSL
+  struct Curl_ssl_scache *ssl_scache;
+#endif
+};
+
+CURLSHcode Curl_share_lock(struct Curl_easy *data, curl_lock_data type,
+                           curl_lock_access accesstype);
+CURLSHcode Curl_share_unlock(struct Curl_easy *data, curl_lock_data type);
+
+/* convenience macro to check if this handle is using a shared SSL spool */
+#define CURL_SHARE_ssl_scache(data)                                \
+  ((data)->share &&                                                \
+   ((data)->share->specifier & (1 << CURL_LOCK_DATA_SSL_SESSION)))
+
+CURLcode Curl_share_easy_unlink(struct Curl_easy *data);
+CURLcode Curl_share_easy_link(struct Curl_easy *data,
+                              struct Curl_share *share);
+
+#endif /* HEADER_CURL_SHARE_H */
diff --git a/third-party/curl/lib/curl_sspi.c b/third-party/curl/lib/curl_sspi.c
index eb21e7e2b0..3ea17621b1 100644
--- a/third-party/curl/lib/curl_sspi.c
+++ b/third-party/curl/lib/curl_sspi.c
@@ -21,41 +21,16 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef USE_WINDOWS_SSPI
 
-#include <curl/curl.h>
 #include "curl_sspi.h"
-#include "curl_multibyte.h"
-#include "system_win32.h"
-#include "version_win32.h"
-#include "warnless.h"
-
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
-
-/* We use our own typedef here since some headers might lack these */
-typedef PSecurityFunctionTable (APIENTRY *INITSECURITYINTERFACE_FN)(VOID);
-
-/* See definition of SECURITY_ENTRYPOINT in sspi.h */
-#ifdef UNICODE
-#  ifdef _WIN32_WCE
-#    define SECURITYENTRYPOINT L"InitSecurityInterfaceW"
-#  else
-#    define SECURITYENTRYPOINT "InitSecurityInterfaceW"
-#  endif
-#else
-#  define SECURITYENTRYPOINT "InitSecurityInterfaceA"
-#endif
-
-/* Handle of security.dll or secur32.dll, depending on Windows version */
-HMODULE s_hSecDll = NULL;
+#include "curlx/strdup.h"
+#include "curlx/multibyte.h"
 
 /* Pointer to SSPI dispatch table */
-PSecurityFunctionTable s_pSecFn = NULL;
+PSecurityFunctionTable Curl_pSecFn = NULL;
 
 /*
  * Curl_sspi_global_init()
@@ -76,32 +51,11 @@ PSecurityFunctionTable s_pSecFn = NULL;
  */
 CURLcode Curl_sspi_global_init(void)
 {
-  INITSECURITYINTERFACE_FN pInitSecurityInterface;
-
   /* If security interface is not yet initialized try to do this */
-  if(!s_hSecDll) {
-    /* Security Service Provider Interface (SSPI) functions are located in
-     * security.dll on WinNT 4.0 and in secur32.dll on Win9x. Win2K and XP
-     * have both these DLLs (security.dll forwards calls to secur32.dll) */
-
-    /* Load SSPI dll into the address space of the calling process */
-    if(curlx_verify_windows_version(4, 0, 0, PLATFORM_WINNT, VERSION_EQUAL))
-      s_hSecDll = Curl_load_library(TEXT("security.dll"));
-    else
-      s_hSecDll = Curl_load_library(TEXT("secur32.dll"));
-    if(!s_hSecDll)
-      return CURLE_FAILED_INIT;
-
-    /* Get address of the InitSecurityInterfaceA function from the SSPI dll */
-    pInitSecurityInterface =
-      CURLX_FUNCTION_CAST(INITSECURITYINTERFACE_FN,
-                          (GetProcAddress(s_hSecDll, SECURITYENTRYPOINT)));
-    if(!pInitSecurityInterface)
-      return CURLE_FAILED_INIT;
-
+  if(!Curl_pSecFn) {
     /* Get pointer to Security Service Provider Interface dispatch table */
-    s_pSecFn = pInitSecurityInterface();
-    if(!s_pSecFn)
+    Curl_pSecFn = InitSecurityInterface();
+    if(!Curl_pSecFn)
       return CURLE_FAILED_INIT;
   }
 
@@ -119,22 +73,20 @@ CURLcode Curl_sspi_global_init(void)
  */
 void Curl_sspi_global_cleanup(void)
 {
-  if(s_hSecDll) {
-    FreeLibrary(s_hSecDll);
-    s_hSecDll = NULL;
-    s_pSecFn = NULL;
+  if(Curl_pSecFn) {
+    Curl_pSecFn = NULL;
   }
 }
 
 /*
  * Curl_create_sspi_identity()
  *
- * This is used to populate a SSPI identity structure based on the supplied
+ * This is used to populate an SSPI identity structure based on the supplied
  * username and password.
  *
  * Parameters:
  *
- * userp    [in]     - The user name in the format User or Domain\User.
+ * userp    [in]     - The username in the format User or Domain\User.
  * passwdp  [in]     - The user's password.
  * identity [in/out] - The identity structure.
  *
@@ -154,7 +106,7 @@ CURLcode Curl_create_sspi_identity(const char *userp, const char *passwdp,
   /* Initialize the identity */
   memset(identity, 0, sizeof(*identity));
 
-  useranddomain.tchar_ptr = curlx_convert_UTF8_to_tchar((char *)userp);
+  useranddomain.tchar_ptr = curlx_convert_UTF8_to_tchar(userp);
   if(!useranddomain.tchar_ptr)
     return CURLE_OUT_OF_MEMORY;
 
@@ -174,46 +126,62 @@ CURLcode Curl_create_sspi_identity(const char *userp, const char *passwdp,
   }
 
   /* Setup the identity's user and length */
-  dup_user.tchar_ptr = _tcsdup(user.tchar_ptr);
+  dup_user.tchar_ptr = curlx_tcsdup(user.tchar_ptr);
   if(!dup_user.tchar_ptr) {
-    curlx_unicodefree(useranddomain.tchar_ptr);
+    curlx_free(useranddomain.tchar_ptr);
     return CURLE_OUT_OF_MEMORY;
   }
-  identity->User = dup_user.tbyte_ptr;
-  identity->UserLength = curlx_uztoul(_tcslen(dup_user.tchar_ptr));
-  dup_user.tchar_ptr = NULL;
 
   /* Setup the identity's domain and length */
-  dup_domain.tchar_ptr = malloc(sizeof(TCHAR) * (domlen + 1));
+  dup_domain.tchar_ptr = curlx_malloc(sizeof(TCHAR) * (domlen + 1));
   if(!dup_domain.tchar_ptr) {
-    curlx_unicodefree(useranddomain.tchar_ptr);
+    curlx_free(dup_user.tchar_ptr);
+    curlx_free(useranddomain.tchar_ptr);
+    return CURLE_OUT_OF_MEMORY;
+  }
+  if(_tcsncpy_s(dup_domain.tchar_ptr, domlen + 1, domain.tchar_ptr, domlen)) {
+    curlx_free(dup_user.tchar_ptr);
+    curlx_free(dup_domain.tchar_ptr);
+    curlx_free(useranddomain.tchar_ptr);
     return CURLE_OUT_OF_MEMORY;
   }
-  _tcsncpy(dup_domain.tchar_ptr, domain.tchar_ptr, domlen);
-  *(dup_domain.tchar_ptr + domlen) = TEXT('\0');
-  identity->Domain = dup_domain.tbyte_ptr;
-  identity->DomainLength = curlx_uztoul(domlen);
-  dup_domain.tchar_ptr = NULL;
 
-  curlx_unicodefree(useranddomain.tchar_ptr);
+  curlx_free(useranddomain.tchar_ptr);
 
   /* Setup the identity's password and length */
-  passwd.tchar_ptr = curlx_convert_UTF8_to_tchar((char *)passwdp);
-  if(!passwd.tchar_ptr)
+  passwd.tchar_ptr = curlx_convert_UTF8_to_tchar(passwdp);
+  if(!passwd.tchar_ptr) {
+    curlx_free(dup_user.tchar_ptr);
+    curlx_free(dup_domain.tchar_ptr);
     return CURLE_OUT_OF_MEMORY;
-  dup_passwd.tchar_ptr = _tcsdup(passwd.tchar_ptr);
+  }
+  dup_passwd.tchar_ptr = curlx_tcsdup(passwd.tchar_ptr);
   if(!dup_passwd.tchar_ptr) {
-    curlx_unicodefree(passwd.tchar_ptr);
+    curlx_free(dup_user.tchar_ptr);
+    curlx_free(dup_domain.tchar_ptr);
+    curlx_free(passwd.tchar_ptr);
     return CURLE_OUT_OF_MEMORY;
   }
   identity->Password = dup_passwd.tbyte_ptr;
   identity->PasswordLength = curlx_uztoul(_tcslen(dup_passwd.tchar_ptr));
   dup_passwd.tchar_ptr = NULL;
 
-  curlx_unicodefree(passwd.tchar_ptr);
+  curlx_free(passwd.tchar_ptr);
+
+  identity->User = dup_user.tbyte_ptr;
+  identity->UserLength = curlx_uztoul(_tcslen(dup_user.tchar_ptr));
+  dup_user.tchar_ptr = NULL;
+  identity->Domain = dup_domain.tbyte_ptr;
+  identity->DomainLength = curlx_uztoul(domlen);
+  dup_domain.tchar_ptr = NULL;
 
   /* Setup the identity's flags */
-  identity->Flags = SECFLAG_WINNT_AUTH_IDENTITY;
+  identity->Flags = (unsigned long)
+#ifdef UNICODE
+    SEC_WINNT_AUTH_IDENTITY_UNICODE;
+#else
+    SEC_WINNT_AUTH_IDENTITY_ANSI;
+#endif
 
   return CURLE_OK;
 }
@@ -221,7 +189,7 @@ CURLcode Curl_create_sspi_identity(const char *userp, const char *passwdp,
 /*
  * Curl_sspi_free_identity()
  *
- * This is used to free the contents of a SSPI identifier structure.
+ * This is used to free the contents of an SSPI identifier structure.
  *
  * Parameters:
  *
@@ -230,9 +198,9 @@ CURLcode Curl_create_sspi_identity(const char *userp, const char *passwdp,
 void Curl_sspi_free_identity(SEC_WINNT_AUTH_IDENTITY *identity)
 {
   if(identity) {
-    Curl_safefree(identity->User);
-    Curl_safefree(identity->Password);
-    Curl_safefree(identity->Domain);
+    curlx_safefree(identity->User);
+    curlx_safefree(identity->Password);
+    curlx_safefree(identity->Domain);
   }
 }
 
diff --git a/third-party/curl/lib/curl_sspi.h b/third-party/curl/lib/curl_sspi.h
index 9816d59c84..2bd7eb4be8 100644
--- a/third-party/curl/lib/curl_sspi.h
+++ b/third-party/curl/lib/curl_sspi.h
@@ -23,29 +23,16 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef USE_WINDOWS_SSPI
 
-#include <curl/curl.h>
-
-/*
- * When including the following three headers, it is mandatory to define either
- * SECURITY_WIN32 or SECURITY_KERNEL, indicating who is compiling the code.
- */
-
-#undef SECURITY_WIN32
-#undef SECURITY_KERNEL
-#define SECURITY_WIN32 1
-#include <security.h>
 #include <sspi.h>
-#include <rpc.h>
 
 CURLcode Curl_sspi_global_init(void);
 void Curl_sspi_global_cleanup(void);
 
-/* This is used to populate the domain in a SSPI identity structure */
+/* This is used to populate the domain in an SSPI identity structure */
 CURLcode Curl_override_sspi_http_realm(const char *chlg,
                                        SEC_WINNT_AUTH_IDENTITY *identity);
 
@@ -57,288 +44,35 @@ CURLcode Curl_create_sspi_identity(const char *userp, const char *passwdp,
 void Curl_sspi_free_identity(SEC_WINNT_AUTH_IDENTITY *identity);
 
 /* Forward-declaration of global variables defined in curl_sspi.c */
-extern HMODULE s_hSecDll;
-extern PSecurityFunctionTable s_pSecFn;
+extern PSecurityFunctionTable Curl_pSecFn;
 
-/* Provide some definitions missing in old headers */
+/* Provide Service Principal names as macros */
 #define SP_NAME_DIGEST              "WDigest"
 #define SP_NAME_NTLM                "NTLM"
 #define SP_NAME_NEGOTIATE           "Negotiate"
 #define SP_NAME_KERBEROS            "Kerberos"
 
+/* Offered by mingw-w64 v9+, MS SDK 7.0A/VS2010+ */
 #ifndef ISC_REQ_USE_HTTP_STYLE
 #define ISC_REQ_USE_HTTP_STYLE                0x01000000
 #endif
 
-#ifndef ISC_RET_REPLAY_DETECT
-#define ISC_RET_REPLAY_DETECT                 0x00000004
-#endif
-
-#ifndef ISC_RET_SEQUENCE_DETECT
-#define ISC_RET_SEQUENCE_DETECT               0x00000008
-#endif
-
-#ifndef ISC_RET_CONFIDENTIALITY
-#define ISC_RET_CONFIDENTIALITY               0x00000010
-#endif
-
-#ifndef ISC_RET_ALLOCATED_MEMORY
-#define ISC_RET_ALLOCATED_MEMORY              0x00000100
-#endif
-
-#ifndef ISC_RET_STREAM
-#define ISC_RET_STREAM                        0x00008000
-#endif
-
-#ifndef SEC_E_INSUFFICIENT_MEMORY
-# define SEC_E_INSUFFICIENT_MEMORY            ((HRESULT)0x80090300L)
-#endif
-#ifndef SEC_E_INVALID_HANDLE
-# define SEC_E_INVALID_HANDLE                 ((HRESULT)0x80090301L)
-#endif
-#ifndef SEC_E_UNSUPPORTED_FUNCTION
-# define SEC_E_UNSUPPORTED_FUNCTION           ((HRESULT)0x80090302L)
-#endif
-#ifndef SEC_E_TARGET_UNKNOWN
-# define SEC_E_TARGET_UNKNOWN                 ((HRESULT)0x80090303L)
-#endif
-#ifndef SEC_E_INTERNAL_ERROR
-# define SEC_E_INTERNAL_ERROR                 ((HRESULT)0x80090304L)
-#endif
-#ifndef SEC_E_SECPKG_NOT_FOUND
-# define SEC_E_SECPKG_NOT_FOUND               ((HRESULT)0x80090305L)
-#endif
-#ifndef SEC_E_NOT_OWNER
-# define SEC_E_NOT_OWNER                      ((HRESULT)0x80090306L)
-#endif
-#ifndef SEC_E_CANNOT_INSTALL
-# define SEC_E_CANNOT_INSTALL                 ((HRESULT)0x80090307L)
-#endif
-#ifndef SEC_E_INVALID_TOKEN
-# define SEC_E_INVALID_TOKEN                  ((HRESULT)0x80090308L)
-#endif
-#ifndef SEC_E_CANNOT_PACK
-# define SEC_E_CANNOT_PACK                    ((HRESULT)0x80090309L)
-#endif
-#ifndef SEC_E_QOP_NOT_SUPPORTED
-# define SEC_E_QOP_NOT_SUPPORTED              ((HRESULT)0x8009030AL)
-#endif
-#ifndef SEC_E_NO_IMPERSONATION
-# define SEC_E_NO_IMPERSONATION               ((HRESULT)0x8009030BL)
-#endif
-#ifndef SEC_E_LOGON_DENIED
-# define SEC_E_LOGON_DENIED                   ((HRESULT)0x8009030CL)
-#endif
-#ifndef SEC_E_UNKNOWN_CREDENTIALS
-# define SEC_E_UNKNOWN_CREDENTIALS            ((HRESULT)0x8009030DL)
-#endif
-#ifndef SEC_E_NO_CREDENTIALS
-# define SEC_E_NO_CREDENTIALS                 ((HRESULT)0x8009030EL)
-#endif
-#ifndef SEC_E_MESSAGE_ALTERED
-# define SEC_E_MESSAGE_ALTERED                ((HRESULT)0x8009030FL)
-#endif
-#ifndef SEC_E_OUT_OF_SEQUENCE
-# define SEC_E_OUT_OF_SEQUENCE                ((HRESULT)0x80090310L)
-#endif
-#ifndef SEC_E_NO_AUTHENTICATING_AUTHORITY
-# define SEC_E_NO_AUTHENTICATING_AUTHORITY    ((HRESULT)0x80090311L)
-#endif
-#ifndef SEC_E_BAD_PKGID
-# define SEC_E_BAD_PKGID                      ((HRESULT)0x80090316L)
-#endif
-#ifndef SEC_E_CONTEXT_EXPIRED
-# define SEC_E_CONTEXT_EXPIRED                ((HRESULT)0x80090317L)
-#endif
-#ifndef SEC_E_INCOMPLETE_MESSAGE
-# define SEC_E_INCOMPLETE_MESSAGE             ((HRESULT)0x80090318L)
-#endif
-#ifndef SEC_E_INCOMPLETE_CREDENTIALS
-# define SEC_E_INCOMPLETE_CREDENTIALS         ((HRESULT)0x80090320L)
-#endif
-#ifndef SEC_E_BUFFER_TOO_SMALL
-# define SEC_E_BUFFER_TOO_SMALL               ((HRESULT)0x80090321L)
-#endif
-#ifndef SEC_E_WRONG_PRINCIPAL
-# define SEC_E_WRONG_PRINCIPAL                ((HRESULT)0x80090322L)
-#endif
-#ifndef SEC_E_TIME_SKEW
-# define SEC_E_TIME_SKEW                      ((HRESULT)0x80090324L)
-#endif
-#ifndef SEC_E_UNTRUSTED_ROOT
-# define SEC_E_UNTRUSTED_ROOT                 ((HRESULT)0x80090325L)
-#endif
-#ifndef SEC_E_ILLEGAL_MESSAGE
-# define SEC_E_ILLEGAL_MESSAGE                ((HRESULT)0x80090326L)
-#endif
-#ifndef SEC_E_CERT_UNKNOWN
-# define SEC_E_CERT_UNKNOWN                   ((HRESULT)0x80090327L)
-#endif
-#ifndef SEC_E_CERT_EXPIRED
-# define SEC_E_CERT_EXPIRED                   ((HRESULT)0x80090328L)
-#endif
-#ifndef SEC_E_ENCRYPT_FAILURE
-# define SEC_E_ENCRYPT_FAILURE                ((HRESULT)0x80090329L)
-#endif
-#ifndef SEC_E_DECRYPT_FAILURE
-# define SEC_E_DECRYPT_FAILURE                ((HRESULT)0x80090330L)
-#endif
-#ifndef SEC_E_ALGORITHM_MISMATCH
-# define SEC_E_ALGORITHM_MISMATCH             ((HRESULT)0x80090331L)
-#endif
-#ifndef SEC_E_SECURITY_QOS_FAILED
-# define SEC_E_SECURITY_QOS_FAILED            ((HRESULT)0x80090332L)
-#endif
-#ifndef SEC_E_UNFINISHED_CONTEXT_DELETED
-# define SEC_E_UNFINISHED_CONTEXT_DELETED     ((HRESULT)0x80090333L)
-#endif
-#ifndef SEC_E_NO_TGT_REPLY
-# define SEC_E_NO_TGT_REPLY                   ((HRESULT)0x80090334L)
-#endif
-#ifndef SEC_E_NO_IP_ADDRESSES
-# define SEC_E_NO_IP_ADDRESSES                ((HRESULT)0x80090335L)
-#endif
-#ifndef SEC_E_WRONG_CREDENTIAL_HANDLE
-# define SEC_E_WRONG_CREDENTIAL_HANDLE        ((HRESULT)0x80090336L)
-#endif
-#ifndef SEC_E_CRYPTO_SYSTEM_INVALID
-# define SEC_E_CRYPTO_SYSTEM_INVALID          ((HRESULT)0x80090337L)
-#endif
-#ifndef SEC_E_MAX_REFERRALS_EXCEEDED
-# define SEC_E_MAX_REFERRALS_EXCEEDED         ((HRESULT)0x80090338L)
-#endif
-#ifndef SEC_E_MUST_BE_KDC
-# define SEC_E_MUST_BE_KDC                    ((HRESULT)0x80090339L)
-#endif
-#ifndef SEC_E_STRONG_CRYPTO_NOT_SUPPORTED
-# define SEC_E_STRONG_CRYPTO_NOT_SUPPORTED    ((HRESULT)0x8009033AL)
-#endif
-#ifndef SEC_E_TOO_MANY_PRINCIPALS
-# define SEC_E_TOO_MANY_PRINCIPALS            ((HRESULT)0x8009033BL)
-#endif
-#ifndef SEC_E_NO_PA_DATA
-# define SEC_E_NO_PA_DATA                     ((HRESULT)0x8009033CL)
-#endif
-#ifndef SEC_E_PKINIT_NAME_MISMATCH
-# define SEC_E_PKINIT_NAME_MISMATCH           ((HRESULT)0x8009033DL)
-#endif
-#ifndef SEC_E_SMARTCARD_LOGON_REQUIRED
-# define SEC_E_SMARTCARD_LOGON_REQUIRED       ((HRESULT)0x8009033EL)
-#endif
-#ifndef SEC_E_SHUTDOWN_IN_PROGRESS
-# define SEC_E_SHUTDOWN_IN_PROGRESS           ((HRESULT)0x8009033FL)
-#endif
-#ifndef SEC_E_KDC_INVALID_REQUEST
-# define SEC_E_KDC_INVALID_REQUEST            ((HRESULT)0x80090340L)
-#endif
-#ifndef SEC_E_KDC_UNABLE_TO_REFER
-# define SEC_E_KDC_UNABLE_TO_REFER            ((HRESULT)0x80090341L)
-#endif
-#ifndef SEC_E_KDC_UNKNOWN_ETYPE
-# define SEC_E_KDC_UNKNOWN_ETYPE              ((HRESULT)0x80090342L)
-#endif
-#ifndef SEC_E_UNSUPPORTED_PREAUTH
-# define SEC_E_UNSUPPORTED_PREAUTH            ((HRESULT)0x80090343L)
-#endif
-#ifndef SEC_E_DELEGATION_REQUIRED
-# define SEC_E_DELEGATION_REQUIRED            ((HRESULT)0x80090345L)
-#endif
-#ifndef SEC_E_BAD_BINDINGS
-# define SEC_E_BAD_BINDINGS                   ((HRESULT)0x80090346L)
-#endif
-#ifndef SEC_E_MULTIPLE_ACCOUNTS
-# define SEC_E_MULTIPLE_ACCOUNTS              ((HRESULT)0x80090347L)
-#endif
-#ifndef SEC_E_NO_KERB_KEY
-# define SEC_E_NO_KERB_KEY                    ((HRESULT)0x80090348L)
-#endif
-#ifndef SEC_E_CERT_WRONG_USAGE
-# define SEC_E_CERT_WRONG_USAGE               ((HRESULT)0x80090349L)
-#endif
-#ifndef SEC_E_DOWNGRADE_DETECTED
-# define SEC_E_DOWNGRADE_DETECTED             ((HRESULT)0x80090350L)
-#endif
-#ifndef SEC_E_SMARTCARD_CERT_REVOKED
-# define SEC_E_SMARTCARD_CERT_REVOKED         ((HRESULT)0x80090351L)
-#endif
-#ifndef SEC_E_ISSUING_CA_UNTRUSTED
-# define SEC_E_ISSUING_CA_UNTRUSTED           ((HRESULT)0x80090352L)
-#endif
-#ifndef SEC_E_REVOCATION_OFFLINE_C
-# define SEC_E_REVOCATION_OFFLINE_C           ((HRESULT)0x80090353L)
-#endif
-#ifndef SEC_E_PKINIT_CLIENT_FAILURE
-# define SEC_E_PKINIT_CLIENT_FAILURE          ((HRESULT)0x80090354L)
-#endif
-#ifndef SEC_E_SMARTCARD_CERT_EXPIRED
-# define SEC_E_SMARTCARD_CERT_EXPIRED         ((HRESULT)0x80090355L)
-#endif
-#ifndef SEC_E_NO_S4U_PROT_SUPPORT
-# define SEC_E_NO_S4U_PROT_SUPPORT            ((HRESULT)0x80090356L)
-#endif
-#ifndef SEC_E_CROSSREALM_DELEGATION_FAILURE
-# define SEC_E_CROSSREALM_DELEGATION_FAILURE  ((HRESULT)0x80090357L)
-#endif
-#ifndef SEC_E_REVOCATION_OFFLINE_KDC
-# define SEC_E_REVOCATION_OFFLINE_KDC         ((HRESULT)0x80090358L)
-#endif
-#ifndef SEC_E_ISSUING_CA_UNTRUSTED_KDC
-# define SEC_E_ISSUING_CA_UNTRUSTED_KDC       ((HRESULT)0x80090359L)
-#endif
-#ifndef SEC_E_KDC_CERT_EXPIRED
-# define SEC_E_KDC_CERT_EXPIRED               ((HRESULT)0x8009035AL)
-#endif
-#ifndef SEC_E_KDC_CERT_REVOKED
-# define SEC_E_KDC_CERT_REVOKED               ((HRESULT)0x8009035BL)
-#endif
+/* Offered by mingw-w64 v8+, MS SDK 6.0A/VS2008+ */
 #ifndef SEC_E_INVALID_PARAMETER
-# define SEC_E_INVALID_PARAMETER              ((HRESULT)0x8009035DL)
+#define SEC_E_INVALID_PARAMETER               ((HRESULT)0x8009035DL)
 #endif
+/* Offered by mingw-w64 v8+, MS SDK 6.0A/VS2008+ */
 #ifndef SEC_E_DELEGATION_POLICY
-# define SEC_E_DELEGATION_POLICY              ((HRESULT)0x8009035EL)
+#define SEC_E_DELEGATION_POLICY               ((HRESULT)0x8009035EL)
 #endif
+/* Offered by mingw-w64 v8+, MS SDK 6.0A/VS2008+ */
 #ifndef SEC_E_POLICY_NLTM_ONLY
-# define SEC_E_POLICY_NLTM_ONLY               ((HRESULT)0x8009035FL)
+#define SEC_E_POLICY_NLTM_ONLY                ((HRESULT)0x8009035FL)
 #endif
 
-#ifndef SEC_I_CONTINUE_NEEDED
-# define SEC_I_CONTINUE_NEEDED                ((HRESULT)0x00090312L)
-#endif
-#ifndef SEC_I_COMPLETE_NEEDED
-# define SEC_I_COMPLETE_NEEDED                ((HRESULT)0x00090313L)
-#endif
-#ifndef SEC_I_COMPLETE_AND_CONTINUE
-# define SEC_I_COMPLETE_AND_CONTINUE          ((HRESULT)0x00090314L)
-#endif
-#ifndef SEC_I_LOCAL_LOGON
-# define SEC_I_LOCAL_LOGON                    ((HRESULT)0x00090315L)
-#endif
-#ifndef SEC_I_CONTEXT_EXPIRED
-# define SEC_I_CONTEXT_EXPIRED                ((HRESULT)0x00090317L)
-#endif
-#ifndef SEC_I_INCOMPLETE_CREDENTIALS
-# define SEC_I_INCOMPLETE_CREDENTIALS         ((HRESULT)0x00090320L)
-#endif
-#ifndef SEC_I_RENEGOTIATE
-# define SEC_I_RENEGOTIATE                    ((HRESULT)0x00090321L)
-#endif
-#ifndef SEC_I_NO_LSA_CONTEXT
-# define SEC_I_NO_LSA_CONTEXT                 ((HRESULT)0x00090323L)
-#endif
+/* Offered by mingw-w64 v8+, MS SDK 6.0A/VS2008+ */
 #ifndef SEC_I_SIGNATURE_NEEDED
-# define SEC_I_SIGNATURE_NEEDED               ((HRESULT)0x0009035CL)
-#endif
-
-#ifndef CRYPT_E_REVOKED
-# define CRYPT_E_REVOKED                      ((HRESULT)0x80092010L)
-#endif
-
-#ifdef UNICODE
-#  define SECFLAG_WINNT_AUTH_IDENTITY \
-     (unsigned long)SEC_WINNT_AUTH_IDENTITY_UNICODE
-#else
-#  define SECFLAG_WINNT_AUTH_IDENTITY \
-     (unsigned long)SEC_WINNT_AUTH_IDENTITY_ANSI
+#define SEC_I_SIGNATURE_NEEDED                ((HRESULT)0x0009035CL)
 #endif
 
 /*
diff --git a/third-party/curl/lib/curl_threads.c b/third-party/curl/lib/curl_threads.c
index e13e2947c2..01041f63c3 100644
--- a/third-party/curl/lib/curl_threads.c
+++ b/third-party/curl/lib/curl_threads.c
@@ -21,25 +21,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
-
-#include <curl/curl.h>
-
-#if defined(USE_THREADS_POSIX)
-#  ifdef HAVE_PTHREAD_H
-#    include <pthread.h>
-#  endif
-#elif defined(USE_THREADS_WIN32)
-#  include <process.h>
-#endif
-
 #include "curl_threads.h"
-#include "curl_memory.h"
-/* The last #include file should be: */
-#include "memdebug.h"
+#include "curlx/timeval.h"
 
-#if defined(USE_THREADS_POSIX)
+#ifdef USE_THREADS
+
+#ifdef HAVE_THREADS_POSIX
 
 struct Curl_actual_call {
   unsigned int (*func)(void *);
@@ -52,39 +40,48 @@ static void *curl_thread_create_thunk(void *arg)
   unsigned int (*func)(void *) = ac->func;
   void *real_arg = ac->arg;
 
-  free(ac);
+  curlx_free(ac);
 
   (*func)(real_arg);
 
   return 0;
 }
 
-curl_thread_t Curl_thread_create(unsigned int (*func) (void *), void *arg)
+curl_thread_t Curl_thread_create(
+  CURL_THREAD_RETURN_T(CURL_STDCALL *func)(void *), void *arg)
 {
-  curl_thread_t t = malloc(sizeof(pthread_t));
-  struct Curl_actual_call *ac = malloc(sizeof(struct Curl_actual_call));
+  curl_thread_t t = curlx_malloc(sizeof(pthread_t));
+  struct Curl_actual_call *ac = NULL;
+  int rc;
+
+  if(t)
+    ac = curlx_malloc(sizeof(struct Curl_actual_call));
   if(!(ac && t))
     goto err;
 
   ac->func = func;
   ac->arg = arg;
 
-  if(pthread_create(t, NULL, curl_thread_create_thunk, ac) != 0)
+  rc = pthread_create(t, NULL, curl_thread_create_thunk, ac);
+  if(rc) {
+    errno = rc;
     goto err;
+  }
 
   return t;
 
 err:
-  free(t);
-  free(ac);
+  curlx_free(t);
+  curlx_free(ac);
   return curl_thread_t_null;
 }
 
-void Curl_thread_destroy(curl_thread_t hnd)
+void Curl_thread_destroy(curl_thread_t *hnd)
 {
-  if(hnd != curl_thread_t_null) {
-    pthread_detach(*hnd);
-    free(hnd);
+  if(*hnd != curl_thread_t_null) {
+    pthread_detach(**hnd);
+    curlx_free(*hnd);
+    *hnd = curl_thread_t_null;
   }
 }
 
@@ -92,64 +89,126 @@ int Curl_thread_join(curl_thread_t *hnd)
 {
   int ret = (pthread_join(**hnd, NULL) == 0);
 
-  free(*hnd);
+  curlx_free(*hnd);
   *hnd = curl_thread_t_null;
 
   return ret;
 }
 
-#elif defined(USE_THREADS_WIN32)
+#elif defined(_WIN32)
 
-/* !checksrc! disable SPACEBEFOREPAREN 1 */
-curl_thread_t Curl_thread_create(unsigned int (CURL_STDCALL *func) (void *),
-                                 void *arg)
+curl_thread_t Curl_thread_create(
+  CURL_THREAD_RETURN_T(CURL_STDCALL *func)(void *), void *arg)
 {
-#ifdef _WIN32_WCE
-  typedef HANDLE curl_win_thread_handle_t;
-#elif defined(__MINGW32__) && !defined(__MINGW64_VERSION_MAJOR)
-  typedef unsigned long curl_win_thread_handle_t;
-#else
-  typedef uintptr_t curl_win_thread_handle_t;
-#endif
-  curl_thread_t t;
-  curl_win_thread_handle_t thread_handle;
-#ifdef _WIN32_WCE
-  thread_handle = CreateThread(NULL, 0, func, arg, 0, NULL);
-#else
-  thread_handle = _beginthreadex(NULL, 0, func, arg, 0, NULL);
-#endif
-  t = (curl_thread_t)thread_handle;
-  if((t == 0) || (t == LongToHandle(-1L))) {
-#ifdef _WIN32_WCE
+  curl_thread_t t = CreateThread(NULL, 0, func, arg, 0, NULL);
+  if(!t) {
     DWORD gle = GetLastError();
-    errno = ((gle == ERROR_ACCESS_DENIED ||
-              gle == ERROR_NOT_ENOUGH_MEMORY) ?
-             EACCES : EINVAL);
-#endif
+    /* !checksrc! disable ERRNOVAR 1 */
+    errno = (gle == ERROR_ACCESS_DENIED ||
+             gle == ERROR_NOT_ENOUGH_MEMORY) ?
+             EACCES : EINVAL;
     return curl_thread_t_null;
   }
   return t;
 }
 
-void Curl_thread_destroy(curl_thread_t hnd)
+void Curl_thread_destroy(curl_thread_t *hnd)
 {
-  CloseHandle(hnd);
+  if(*hnd != curl_thread_t_null) {
+    CloseHandle(*hnd);
+    *hnd = curl_thread_t_null;
+  }
 }
 
 int Curl_thread_join(curl_thread_t *hnd)
 {
-#if !defined(_WIN32_WINNT) || !defined(_WIN32_WINNT_VISTA) || \
-    (_WIN32_WINNT < _WIN32_WINNT_VISTA)
-  int ret = (WaitForSingleObject(*hnd, INFINITE) == WAIT_OBJECT_0);
-#else
   int ret = (WaitForSingleObjectEx(*hnd, INFINITE, FALSE) == WAIT_OBJECT_0);
-#endif
 
-  Curl_thread_destroy(*hnd);
-
-  *hnd = curl_thread_t_null;
+  Curl_thread_destroy(hnd);
 
   return ret;
 }
 
-#endif /* USE_THREADS_* */
+#else
+#error neither HAVE_THREADS_POSIX nor _WIN32 defined
+#endif
+#endif /* USE_THREADS */
+
+#ifdef USE_MUTEX
+
+#ifdef HAVE_THREADS_POSIX
+
+void Curl_cond_signal(pthread_cond_t *c)
+{
+  /* return code defined as always 0 */
+  (void)pthread_cond_signal(c);
+}
+
+void Curl_cond_wait(pthread_cond_t *c, pthread_mutex_t *m)
+{
+  /* return code defined as always 0 */
+  (void)pthread_cond_wait(c, m);
+}
+
+CURLcode Curl_cond_timedwait(pthread_cond_t *c, pthread_mutex_t *m,
+                             uint32_t timeout_ms)
+{
+  struct curltime now;
+  struct timespec ts;
+  timediff_t usec;
+  int rc;
+
+  /* POSIX expects an "absolute" time until the condition wait ends.
+   * We cannot use `curlx_now()` here that may run on some monotonic clock
+   * that will be most likely in the past, as far as POSIX abstime is
+   * concerned. */
+#ifdef HAVE_GETTIMEOFDAY
+  struct timeval tv;
+  (void)gettimeofday(&tv, NULL);
+  now.tv_sec = tv.tv_sec;
+  now.tv_usec = (int)tv.tv_usec;
+#else
+  now.tv_sec = time(NULL);
+  now.tv_usec = 0;
+#endif
+
+  ts.tv_sec = now.tv_sec + (timeout_ms / 1000);
+  usec = now.tv_usec + ((timeout_ms % 1000) * 1000);
+  if(usec >= 1000000) {
+    ++ts.tv_sec;
+    usec %= 1000000;
+  }
+  ts.tv_nsec = (long)usec * 1000;
+
+  rc = pthread_cond_timedwait(c, m, &ts);
+  if(rc == SOCKETIMEDOUT)
+    return CURLE_OPERATION_TIMEDOUT;
+  return rc ? CURLE_UNRECOVERABLE_POLL : CURLE_OK;
+}
+
+#elif defined(_WIN32)
+
+void Curl_cond_signal(CONDITION_VARIABLE *c)
+{
+  WakeConditionVariable(c);
+}
+
+void Curl_cond_wait(CONDITION_VARIABLE *c, CRITICAL_SECTION *m)
+{
+  SleepConditionVariableCS(c, m, INFINITE);
+}
+
+CURLcode Curl_cond_timedwait(CONDITION_VARIABLE *c, CRITICAL_SECTION *m,
+                             uint32_t timeout_ms)
+{
+  if(!SleepConditionVariableCS(c, m, (DWORD)timeout_ms)) {
+    DWORD err = GetLastError();
+    return (err == ERROR_TIMEOUT) ?
+           CURLE_OPERATION_TIMEDOUT : CURLE_UNRECOVERABLE_POLL;
+  }
+  return CURLE_OK;
+}
+#else
+#error neither HAVE_THREADS_POSIX nor _WIN32 defined
+#endif
+#endif /* USE_MUTEX */
diff --git a/third-party/curl/lib/curl_threads.h b/third-party/curl/lib/curl_threads.h
index facbc73705..081d155695 100644
--- a/third-party/curl/lib/curl_threads.h
+++ b/third-party/curl/lib/curl_threads.h
@@ -25,7 +25,9 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
-#if defined(USE_THREADS_POSIX)
+#ifdef USE_MUTEX
+#ifdef HAVE_THREADS_POSIX
+#  define CURL_THREAD_RETURN_T   unsigned int
 #  define CURL_STDCALL
 #  define curl_mutex_t           pthread_mutex_t
 #  define curl_thread_t          pthread_t *
@@ -34,33 +36,42 @@
 #  define Curl_mutex_acquire(m)  pthread_mutex_lock(m)
 #  define Curl_mutex_release(m)  pthread_mutex_unlock(m)
 #  define Curl_mutex_destroy(m)  pthread_mutex_destroy(m)
-#elif defined(USE_THREADS_WIN32)
-#  define CURL_STDCALL           __stdcall
+#  define curl_cond_t            pthread_cond_t
+#  define Curl_cond_init(c)      pthread_cond_init(c, NULL)
+#  define Curl_cond_destroy(c)   pthread_cond_destroy(c)
+#elif defined(_WIN32)
+#  define CURL_THREAD_RETURN_T   DWORD
+#  define CURL_STDCALL           WINAPI
 #  define curl_mutex_t           CRITICAL_SECTION
 #  define curl_thread_t          HANDLE
 #  define curl_thread_t_null     (HANDLE)0
-#  if !defined(_WIN32_WINNT) || !defined(_WIN32_WINNT_VISTA) || \
-      (_WIN32_WINNT < _WIN32_WINNT_VISTA) || \
-      (defined(__MINGW32__) && !defined(__MINGW64_VERSION_MAJOR))
-#    define Curl_mutex_init(m)   InitializeCriticalSection(m)
-#  else
-#    define Curl_mutex_init(m)   InitializeCriticalSectionEx(m, 0, 1)
-#  endif
+#  define Curl_mutex_init(m)     InitializeCriticalSectionEx(m, 0, 1)
 #  define Curl_mutex_acquire(m)  EnterCriticalSection(m)
 #  define Curl_mutex_release(m)  LeaveCriticalSection(m)
 #  define Curl_mutex_destroy(m)  DeleteCriticalSection(m)
+#  define curl_cond_t            CONDITION_VARIABLE
+#  define Curl_cond_init(c)      InitializeConditionVariable(c)
+#  define Curl_cond_destroy(c)   (void)(c)
+#else
+#error neither HAVE_THREADS_POSIX nor _WIN32 defined
 #endif
 
-#if defined(USE_THREADS_POSIX) || defined(USE_THREADS_WIN32)
+void Curl_cond_signal(curl_cond_t *c);
+void Curl_cond_wait(curl_cond_t *c, curl_mutex_t *m);
+/* Returns CURLE_OPERATION_TIMEDOUT on timeout */
+CURLcode Curl_cond_timedwait(curl_cond_t *c, curl_mutex_t *m,
+                             uint32_t timeout_ms);
+#endif /* USE_MUTEX */
 
-/* !checksrc! disable SPACEBEFOREPAREN 1 */
-curl_thread_t Curl_thread_create(unsigned int (CURL_STDCALL *func) (void *),
-                                 void *arg);
+#ifdef USE_THREADS
 
-void Curl_thread_destroy(curl_thread_t hnd);
+curl_thread_t Curl_thread_create(
+  CURL_THREAD_RETURN_T(CURL_STDCALL *func)(void *), void *arg);
+
+void Curl_thread_destroy(curl_thread_t *hnd);
 
 int Curl_thread_join(curl_thread_t *hnd);
 
-#endif /* USE_THREADS_POSIX || USE_THREADS_WIN32 */
+#endif /* USE_THREADS */
 
 #endif /* HEADER_CURL_THREADS_H */
diff --git a/third-party/curl/lib/curl_trc.c b/third-party/curl/lib/curl_trc.c
index 76c35ba386..f8287e420f 100644
--- a/third-party/curl/lib/curl_trc.c
+++ b/third-party/curl/lib/curl_trc.c
@@ -21,51 +21,45 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include <curl/curl.h>
-
 #include "curl_trc.h"
 #include "urldata.h"
-#include "easyif.h"
 #include "cfilters.h"
-#include "timeval.h"
 #include "multiif.h"
-#include "strcase.h"
 
+#include "cf-dns.h"
+#include "cf-recvbuf.h"
 #include "cf-socket.h"
-#include "connect.h"
+#include "cf-setup.h"
 #include "http2.h"
 #include "http_proxy.h"
 #include "cf-h1-proxy.h"
 #include "cf-h2-proxy.h"
 #include "cf-haproxy.h"
 #include "cf-https-connect.h"
+#include "cf-ip-happy.h"
+#include "progress.h"
 #include "socks.h"
-#include "strtok.h"
+#include "curlx/strparse.h"
 #include "vtls/vtls.h"
 #include "vquic/vquic.h"
+#include "curlx/strcopy.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-
-void Curl_debug(struct Curl_easy *data, curl_infotype type,
-                char *ptr, size_t size)
+static void trc_write(struct Curl_easy *data, curl_infotype type,
+                      const char *ptr, size_t size)
 {
   if(data->set.verbose) {
-    static const char s_infotype[CURLINFO_END][3] = {
-      "* ", "< ", "> ", "{ ", "} ", "{ ", "} " };
     if(data->set.fdebug) {
       bool inCallback = Curl_is_in_callback(data);
-      Curl_set_in_callback(data, true);
-      (void)(*data->set.fdebug)(data, type, ptr, size, data->set.debugdata);
+      Curl_set_in_callback(data, TRUE);
+      (void)(*data->set.fdebug)(data, type, CURL_UNCONST(ptr), size,
+                                data->set.debugdata);
       Curl_set_in_callback(data, inCallback);
     }
     else {
+      static const char s_infotype[CURLINFO_END][3] = {
+        "* ", "< ", "> ", "{ ", "} ", "{ ", "} " };
       switch(type) {
       case CURLINFO_TEXT:
       case CURLINFO_HEADER_OUT:
@@ -80,6 +74,103 @@ void Curl_debug(struct Curl_easy *data, curl_infotype type,
   }
 }
 
+/* max length we trace before ending in '...' */
+#define TRC_LINE_MAX 2048
+
+#define CURL_TRC_FMT_IDSC   "[x-%" CURL_FORMAT_CURL_OFF_T "] "
+#define CURL_TRC_FMT_IDSD   "[%" CURL_FORMAT_CURL_OFF_T "-x] "
+#define CURL_TRC_FMT_IDSDC  "[%" CURL_FORMAT_CURL_OFF_T "-%" \
+                            CURL_FORMAT_CURL_OFF_T "] "
+
+static struct curl_trc_feat Curl_trc_feat_ids = {
+  "LIB-IDS",
+  CURL_LOG_LVL_NONE,
+};
+#define CURL_TRC_IDS(data) \
+  (Curl_trc_is_verbose(data) && \
+  Curl_trc_feat_ids.log_level >= CURL_LOG_LVL_INFO)
+
+static size_t trc_print_ids(struct Curl_easy *data, char *buf, size_t maxlen)
+{
+  curl_off_t cid = data->conn ?
+                   data->conn->connection_id : data->state.recent_conn_id;
+  if(data->id >= 0) {
+    if(cid >= 0)
+      return curl_msnprintf(buf, maxlen, CURL_TRC_FMT_IDSDC, data->id, cid);
+    else
+      return curl_msnprintf(buf, maxlen, CURL_TRC_FMT_IDSD, data->id);
+  }
+  else if(cid >= 0)
+    return curl_msnprintf(buf, maxlen, CURL_TRC_FMT_IDSC, cid);
+  else {
+    return curl_msnprintf(buf, maxlen, "[x-x] ");
+  }
+}
+
+static size_t trc_end_buf(char *buf, size_t len, size_t maxlen, bool addnl)
+{
+  /* make sure we end the trace line in `buf` properly. It needs
+   * to end with a terminating '\0' or '\n\0' */
+  if(len >= (maxlen - (addnl ? 2 : 1))) {
+    len = maxlen - 5;
+    buf[len++] = '.';
+    buf[len++] = '.';
+    buf[len++] = '.';
+    buf[len++] = '\n';
+  }
+  else if(addnl)
+    buf[len++] = '\n';
+  buf[len] = '\0';
+  return len;
+}
+
+void Curl_debug(struct Curl_easy *data, curl_infotype type,
+                const char *ptr, size_t size)
+{
+  if(data->set.verbose) {
+    static const char s_infotype[CURLINFO_END][3] = {
+      "* ", "< ", "> ", "{ ", "} ", "{ ", "} " };
+    char buf[TRC_LINE_MAX];
+    size_t len;
+    if(data->set.fdebug) {
+      bool inCallback = Curl_is_in_callback(data);
+
+      if(CURL_TRC_IDS(data) && (size < TRC_LINE_MAX)) {
+        len = trc_print_ids(data, buf, TRC_LINE_MAX);
+        len += curl_msnprintf(buf + len, TRC_LINE_MAX - len, "%.*s",
+                              (int)size, ptr);
+        len = trc_end_buf(buf, len, TRC_LINE_MAX, FALSE);
+        Curl_set_in_callback(data, TRUE);
+        (void)(*data->set.fdebug)(data, type, buf, len, data->set.debugdata);
+        Curl_set_in_callback(data, inCallback);
+      }
+      else {
+        Curl_set_in_callback(data, TRUE);
+        (void)(*data->set.fdebug)(data, type, CURL_UNCONST(ptr),
+                                  size, data->set.debugdata);
+        Curl_set_in_callback(data, inCallback);
+      }
+    }
+    else {
+      switch(type) {
+      case CURLINFO_TEXT:
+      case CURLINFO_HEADER_OUT:
+      case CURLINFO_HEADER_IN:
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
+        if(CURL_TRC_IDS(data)) {
+          len = trc_print_ids(data, buf, TRC_LINE_MAX);
+          fwrite(buf, len, 1, data->set.err);
+        }
+#endif
+        fwrite(s_infotype[type], 2, 1, data->set.err);
+        fwrite(ptr, size, 1, data->set.err);
+        break;
+      default: /* nada */
+        break;
+      }
+    }
+  }
+}
 
 /* Curl_failf() is for messages stating why we failed.
  * The message SHALL NOT include any LF or CR.
@@ -89,163 +180,601 @@ void Curl_failf(struct Curl_easy *data, const char *fmt, ...)
   DEBUGASSERT(!strchr(fmt, '\n'));
   if(data->set.verbose || data->set.errorbuffer) {
     va_list ap;
-    int len;
+    size_t len;
     char error[CURL_ERROR_SIZE + 2];
     va_start(ap, fmt);
-    len = mvsnprintf(error, CURL_ERROR_SIZE, fmt, ap);
+    len = curl_mvsnprintf(error, CURL_ERROR_SIZE, fmt, ap);
 
     if(data->set.errorbuffer && !data->state.errorbuf) {
-      strcpy(data->set.errorbuffer, error);
+      curlx_strcopy(data->set.errorbuffer, CURL_ERROR_SIZE, error, len);
       data->state.errorbuf = TRUE; /* wrote error string */
     }
     error[len++] = '\n';
     error[len] = '\0';
-    Curl_debug(data, CURLINFO_TEXT, error, len);
+    trc_write(data, CURLINFO_TEXT, error, len);
     va_end(ap);
   }
 }
 
-/* Curl_infof() is for info message along the way */
-#define MAXINFO 2048
+void Curl_reset_fail(struct Curl_easy *data)
+{
+  if(data->set.errorbuffer)
+    data->set.errorbuffer[0] = 0;
+  data->state.errorbuf = FALSE;
+}
+
+#ifdef CURLVERBOSE
+struct curl_trc_feat Curl_trc_feat_multi = {
+  "MULTI",
+  CURL_LOG_LVL_NONE,
+};
+struct curl_trc_feat Curl_trc_feat_read = {
+  "READ",
+  CURL_LOG_LVL_NONE,
+};
+struct curl_trc_feat Curl_trc_feat_write = {
+  "WRITE",
+  CURL_LOG_LVL_NONE,
+};
+struct curl_trc_feat Curl_trc_feat_dns = {
+  "DNS",
+  CURL_LOG_LVL_NONE,
+};
+struct curl_trc_feat Curl_trc_feat_timer = {
+  "TIMER",
+  CURL_LOG_LVL_NONE,
+};
+#ifdef USE_THREADS
+struct curl_trc_feat Curl_trc_feat_threads = {
+  "THREADS",
+  CURL_LOG_LVL_NONE,
+};
+#endif
+#endif
+
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
+
+static void trc_infof(struct Curl_easy *data,
+                      struct curl_trc_feat *feat,
+                      const char *opt_id, int opt_id_idx,
+                      const char * const fmt, va_list ap) CURL_PRINTF(5, 0);
+
+static void trc_infof(struct Curl_easy *data,
+                      struct curl_trc_feat *feat,
+                      const char *opt_id, int opt_id_idx,
+                      const char * const fmt, va_list ap)
+{
+  size_t len = 0;
+  char buf[TRC_LINE_MAX];
+
+  if(CURL_TRC_IDS(data))
+    len += trc_print_ids(data, buf + len, TRC_LINE_MAX - len);
+  if(feat)
+    len += curl_msnprintf(buf + len, TRC_LINE_MAX - len, "[%s] ", feat->name);
+  if(opt_id) {
+    if(opt_id_idx > 0)
+      len += curl_msnprintf(buf + len, TRC_LINE_MAX - len, "[%s-%d] ",
+                            opt_id, opt_id_idx);
+    else
+      len += curl_msnprintf(buf + len, TRC_LINE_MAX - len, "[%s] ", opt_id);
+  }
+  len += curl_mvsnprintf(buf + len, TRC_LINE_MAX - len, fmt, ap);
+  len = trc_end_buf(buf, len, TRC_LINE_MAX, TRUE);
+  trc_write(data, CURLINFO_TEXT, buf, len);
+}
 
 void Curl_infof(struct Curl_easy *data, const char *fmt, ...)
 {
   DEBUGASSERT(!strchr(fmt, '\n'));
-  if(data && data->set.verbose) {
+  if(Curl_trc_is_verbose(data)) {
     va_list ap;
-    int len;
-    char buffer[MAXINFO + 2];
     va_start(ap, fmt);
-    len = mvsnprintf(buffer, MAXINFO, fmt, ap);
+    trc_infof(data, data->state.feat, NULL, 0, fmt, ap);
     va_end(ap);
-    buffer[len++] = '\n';
-    buffer[len] = '\0';
-    Curl_debug(data, CURLINFO_TEXT, buffer, len);
   }
 }
 
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
-
-void Curl_trc_cf_infof(struct Curl_easy *data, struct Curl_cfilter *cf,
+void Curl_trc_cf_infof(struct Curl_easy *data, const struct Curl_cfilter *cf,
                        const char *fmt, ...)
 {
   DEBUGASSERT(cf);
-  if(data && Curl_trc_cf_is_verbose(cf, data)) {
+  if(Curl_trc_cf_is_verbose(cf, data)) {
     va_list ap;
-    int len;
-    char buffer[MAXINFO + 2];
-    len = msnprintf(buffer, MAXINFO, "[%s] ", cf->cft->name);
     va_start(ap, fmt);
-    len += mvsnprintf(buffer + len, MAXINFO - len, fmt, ap);
+    trc_infof(data, data->state.feat, cf->cft->name, cf->sockindex, fmt, ap);
     va_end(ap);
-    buffer[len++] = '\n';
-    buffer[len] = '\0';
-    Curl_debug(data, CURLINFO_TEXT, buffer, len);
   }
 }
 
+void Curl_trc_feat_infof(struct Curl_easy *data,
+                         struct curl_trc_feat *feat,
+                         const char *fmt, ...)
+{
+  DEBUGASSERT(feat);
+  if(Curl_trc_ft_is_verbose(data, feat)) {
+    va_list ap;
+    va_start(ap, fmt);
+    trc_infof(data, feat, NULL, 0, fmt, ap);
+    va_end(ap);
+  }
+}
 
-static struct Curl_cftype *cf_types[] = {
-  &Curl_cft_tcp,
-  &Curl_cft_udp,
-  &Curl_cft_unix,
-  &Curl_cft_tcp_accept,
-  &Curl_cft_happy_eyeballs,
-  &Curl_cft_setup,
-#ifdef USE_NGHTTP2
-  &Curl_cft_nghttp2,
+static const char * const Curl_trc_timer_names[] = {
+  "100_TIMEOUT",
+  "ASYNC_NAME",
+  "CONNECTTIMEOUT",
+  "DNS_PER_NAME",
+  "DNS_PER_NAME2",
+  "HAPPY_EYEBALLS_DNS",
+  "HAPPY_EYEBALLS",
+  "MULTI_PENDING",
+  "SPEEDCHECK",
+  "TIMEOUT",
+  "TOOFAST",
+  "QUIC",
+  "FTP_ACCEPT",
+  "ALPN_EYEBALLS",
+  "SHUTDOWN",
+};
+
+static const char *trc_timer_name(int tid)
+{
+  if((tid >= 0) && ((size_t)tid < CURL_ARRAYSIZE(Curl_trc_timer_names)))
+    return Curl_trc_timer_names[(size_t)tid];
+  return "UNKNOWN?";
+}
+
+void Curl_trc_timer(struct Curl_easy *data, int tid, const char *fmt, ...)
+{
+  DEBUGASSERT(!strchr(fmt, '\n'));
+  if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_timer)) {
+    const char *tname = trc_timer_name(tid);
+    va_list ap;
+    va_start(ap, fmt);
+    trc_infof(data, &Curl_trc_feat_timer, tname, 0, fmt, ap);
+    va_end(ap);
+  }
+}
+
+void Curl_trc_easy_timers(struct Curl_easy *data)
+{
+  if(CURL_TRC_TIMER_is_verbose(data)) {
+    struct Curl_llist_node *e = Curl_llist_head(&data->state.timeoutlist);
+    if(e) {
+      const struct curltime *pnow = Curl_pgrs_now(data);
+      while(e) {
+        struct time_node *n = Curl_node_elem(e);
+        e = Curl_node_next(e);
+        CURL_TRC_TIMER(data, n->eid, "expires in %" FMT_TIMEDIFF_T "ns",
+                       curlx_ptimediff_us(&n->time, pnow));
+      }
+    }
+  }
+}
+
+static const char * const Curl_trc_mstate_names[] = {
+  "INIT",
+  "PENDING",
+  "SETUP",
+  "CONNECT",
+  "CONNECTING",
+  "PROTOCONNECT",
+  "PROTOCONNECTING",
+  "DO",
+  "DOING",
+  "DOING_MORE",
+  "DID",
+  "PERFORMING",
+  "RATELIMITING",
+  "DONE",
+  "COMPLETED",
+  "MSGSENT",
+};
+
+const char *Curl_trc_mstate_name(int state)
+{
+  if((state >= 0) && ((size_t)state < CURL_ARRAYSIZE(Curl_trc_mstate_names)))
+    return Curl_trc_mstate_names[(size_t)state];
+  return "?";
+}
+
+void Curl_trc_multi(struct Curl_easy *data, const char *fmt, ...)
+{
+  DEBUGASSERT(!strchr(fmt, '\n'));
+  if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_multi)) {
+    const char *sname = (data->id >= 0) ?
+                        Curl_trc_mstate_name(data->mstate) : NULL;
+    va_list ap;
+    va_start(ap, fmt);
+    trc_infof(data, &Curl_trc_feat_multi, sname, 0, fmt, ap);
+    va_end(ap);
+  }
+}
+
+void Curl_trc_read(struct Curl_easy *data, const char *fmt, ...)
+{
+  DEBUGASSERT(!strchr(fmt, '\n'));
+  if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_read)) {
+    va_list ap;
+    va_start(ap, fmt);
+    trc_infof(data, &Curl_trc_feat_read, NULL, 0, fmt, ap);
+    va_end(ap);
+  }
+}
+
+void Curl_trc_write(struct Curl_easy *data, const char *fmt, ...)
+{
+  DEBUGASSERT(!strchr(fmt, '\n'));
+  if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_write)) {
+    va_list ap;
+    va_start(ap, fmt);
+    trc_infof(data, &Curl_trc_feat_write, NULL, 0, fmt, ap);
+    va_end(ap);
+  }
+}
+
+void Curl_trc_dns(struct Curl_easy *data, const char *fmt, ...)
+{
+  DEBUGASSERT(!strchr(fmt, '\n'));
+  if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_dns)) {
+    va_list ap;
+    va_start(ap, fmt);
+    trc_infof(data, &Curl_trc_feat_dns, NULL, 0, fmt, ap);
+    va_end(ap);
+  }
+}
+
+#ifndef CURL_DISABLE_FTP
+struct curl_trc_feat Curl_trc_feat_ftp = {
+  "FTP",
+  CURL_LOG_LVL_NONE,
+};
+
+void Curl_trc_ftp(struct Curl_easy *data, const char *fmt, ...)
+{
+  DEBUGASSERT(!strchr(fmt, '\n'));
+  if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_ftp)) {
+    va_list ap;
+    va_start(ap, fmt);
+    trc_infof(data, &Curl_trc_feat_ftp, NULL, 0, fmt, ap);
+    va_end(ap);
+  }
+}
+#endif /* !CURL_DISABLE_FTP */
+
+#ifndef CURL_DISABLE_SMTP
+struct curl_trc_feat Curl_trc_feat_smtp = {
+  "SMTP",
+  CURL_LOG_LVL_NONE,
+};
+
+void Curl_trc_smtp(struct Curl_easy *data, const char *fmt, ...)
+{
+  DEBUGASSERT(!strchr(fmt, '\n'));
+  if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_smtp)) {
+    va_list ap;
+    va_start(ap, fmt);
+    trc_infof(data, &Curl_trc_feat_smtp, NULL, 0, fmt, ap);
+    va_end(ap);
+  }
+}
+#endif /* !CURL_DISABLE_SMTP */
+
+#ifdef USE_SSL
+struct curl_trc_feat Curl_trc_feat_ssls = {
+  "SSLS",
+  CURL_LOG_LVL_NONE,
+};
+
+void Curl_trc_ssls(struct Curl_easy *data, const char *fmt, ...)
+{
+  DEBUGASSERT(!strchr(fmt, '\n'));
+  if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_ssls)) {
+    va_list ap;
+    va_start(ap, fmt);
+    trc_infof(data, &Curl_trc_feat_ssls, NULL, 0, fmt, ap);
+    va_end(ap);
+  }
+}
+#endif /* USE_SSL */
+
+#ifdef USE_SSH
+struct curl_trc_feat Curl_trc_feat_ssh = {
+  "SSH",
+  CURL_LOG_LVL_NONE,
+};
+
+void Curl_trc_ssh(struct Curl_easy *data, const char *fmt, ...)
+{
+  DEBUGASSERT(!strchr(fmt, '\n'));
+  if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_ssh)) {
+    va_list ap;
+    va_start(ap, fmt);
+    trc_infof(data, &Curl_trc_feat_ssh, NULL, 0, fmt, ap);
+    va_end(ap);
+  }
+}
+#endif /* USE_SSH */
+
+#if !defined(CURL_DISABLE_WEBSOCKETS) && !defined(CURL_DISABLE_HTTP)
+struct curl_trc_feat Curl_trc_feat_ws = {
+  "WS",
+  CURL_LOG_LVL_NONE,
+};
+
+void Curl_trc_ws(struct Curl_easy *data, const char *fmt, ...)
+{
+  DEBUGASSERT(!strchr(fmt, '\n'));
+  if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_ws)) {
+    va_list ap;
+    va_start(ap, fmt);
+    trc_infof(data, &Curl_trc_feat_ws, NULL, 0, fmt, ap);
+    va_end(ap);
+  }
+}
+#endif /* !CURL_DISABLE_WEBSOCKETS && !CURL_DISABLE_HTTP */
+
+#define TRC_CT_NONE        0
+#define TRC_CT_PROTOCOL    (1 << 0)
+#define TRC_CT_NETWORK     (1 << 1)
+#define TRC_CT_PROXY       (1 << 2)
+#define TRC_CT_INTERNALS   (1 << 3)
+
+struct trc_feat_def {
+  struct curl_trc_feat *feat;
+  unsigned int category;
+};
+
+static struct trc_feat_def trc_feats[] = {
+  { &Curl_trc_feat_ids,       TRC_CT_INTERNALS },
+  { &Curl_trc_feat_multi,     TRC_CT_NETWORK },
+  { &Curl_trc_feat_read,      TRC_CT_NONE },
+  { &Curl_trc_feat_write,     TRC_CT_NONE },
+  { &Curl_trc_feat_dns,       TRC_CT_NETWORK },
+  { &Curl_trc_feat_timer,     TRC_CT_NETWORK },
+#ifdef USE_THREADS
+  { &Curl_trc_feat_threads,   TRC_CT_NONE },
+#endif
+#ifndef CURL_DISABLE_FTP
+  { &Curl_trc_feat_ftp,       TRC_CT_PROTOCOL },
+#endif
+#ifndef CURL_DISABLE_SMTP
+  { &Curl_trc_feat_smtp,      TRC_CT_PROTOCOL },
 #endif
 #ifdef USE_SSL
-  &Curl_cft_ssl,
-  &Curl_cft_ssl_proxy,
+  { &Curl_trc_feat_ssls,      TRC_CT_NETWORK },
 #endif
-#if !defined(CURL_DISABLE_PROXY)
-#if !defined(CURL_DISABLE_HTTP)
-  &Curl_cft_h1_proxy,
-#ifdef USE_NGHTTP2
-  &Curl_cft_h2_proxy,
+#ifdef USE_SSH
+  { &Curl_trc_feat_ssh,      TRC_CT_PROTOCOL },
 #endif
-  &Curl_cft_http_proxy,
-#endif /* !CURL_DISABLE_HTTP */
-  &Curl_cft_haproxy,
-  &Curl_cft_socks_proxy,
-#endif /* !CURL_DISABLE_PROXY */
-#ifdef ENABLE_QUIC
-  &Curl_cft_http3,
+#if !defined(CURL_DISABLE_WEBSOCKETS) && !defined(CURL_DISABLE_HTTP)
+  { &Curl_trc_feat_ws,        TRC_CT_PROTOCOL },
 #endif
-#if !defined(CURL_DISABLE_HTTP) && !defined(USE_HYPER)
-  &Curl_cft_http_connect,
-#endif
-  NULL,
 };
 
+struct trc_cft_def {
+  struct Curl_cftype *cft;
+  unsigned int category;
+};
+
+static struct trc_cft_def trc_cfts[] = {
+  { &Curl_cft_dns,            TRC_CT_NETWORK },
+  { &Curl_cft_tcp,            TRC_CT_NETWORK },
+  { &Curl_cft_udp,            TRC_CT_NETWORK },
+  { &Curl_cft_unix,           TRC_CT_NETWORK },
+  { &Curl_cft_tcp_accept,     TRC_CT_NETWORK },
+  { &Curl_cft_ip_happy,       TRC_CT_NETWORK },
+#ifndef CURL_DISABLE_WEBSOCKETS
+  { &Curl_cft_recvbuf,        TRC_CT_PROTOCOL },
+#endif
+  { &Curl_cft_setup,          TRC_CT_PROTOCOL },
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_NGHTTP2)
+  { &Curl_cft_nghttp2,        TRC_CT_PROTOCOL },
+#endif
+#ifdef USE_SSL
+  { &Curl_cft_ssl,            TRC_CT_NETWORK },
+#ifndef CURL_DISABLE_PROXY
+  { &Curl_cft_ssl_proxy,      TRC_CT_PROXY },
+#endif
+#endif
+#ifndef CURL_DISABLE_PROXY
+#ifndef CURL_DISABLE_HTTP
+  { &Curl_cft_h1_proxy,       TRC_CT_PROXY },
+#ifdef USE_NGHTTP2
+  { &Curl_cft_h2_proxy,       TRC_CT_PROXY },
+#endif
+#if defined(USE_PROXY_HTTP3) && defined(USE_NGHTTP3)
+  { &Curl_cft_h3_proxy,       TRC_CT_PROXY },
+#endif
+  { &Curl_cft_http_proxy,     TRC_CT_PROXY },
+#endif /* !CURL_DISABLE_HTTP */
+  { &Curl_cft_haproxy,        TRC_CT_PROXY },
+  { &Curl_cft_socks_proxy,    TRC_CT_PROXY },
+#endif /* !CURL_DISABLE_PROXY */
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_HTTP3)
+  { &Curl_cft_http3,          TRC_CT_PROTOCOL },
+#endif
+#ifndef CURL_DISABLE_HTTP
+  { &Curl_cft_http_connect,   TRC_CT_PROTOCOL },
+#endif
+};
+
+static void trc_apply_level_by_name(struct Curl_str *token, int lvl)
+{
+  size_t i;
+
+  for(i = 0; i < CURL_ARRAYSIZE(trc_cfts); ++i) {
+    if(curlx_str_casecompare(token, trc_cfts[i].cft->name)) {
+      trc_cfts[i].cft->log_level = lvl;
+      break;
+    }
+  }
+  for(i = 0; i < CURL_ARRAYSIZE(trc_feats); ++i) {
+    if(curlx_str_casecompare(token, trc_feats[i].feat->name)) {
+      trc_feats[i].feat->log_level = lvl;
+      break;
+    }
+  }
+}
+
+static void trc_apply_level_by_category(unsigned int category, int lvl)
+{
+  size_t i;
+
+  for(i = 0; i < CURL_ARRAYSIZE(trc_cfts); ++i) {
+    if(!category || (trc_cfts[i].category & category))
+      trc_cfts[i].cft->log_level = lvl;
+  }
+  for(i = 0; i < CURL_ARRAYSIZE(trc_feats); ++i) {
+    if(!category || (trc_feats[i].category & category))
+      trc_feats[i].feat->log_level = lvl;
+  }
+}
+
+static CURLcode trc_opt(const char *config)
+{
+  struct Curl_str out;
+  while(!curlx_str_until(&config, &out, 32, ',')) {
+    int lvl = CURL_LOG_LVL_INFO;
+    const char *token = curlx_str(&out);
+
+    if(*token == '-') {
+      lvl = CURL_LOG_LVL_NONE;
+      curlx_str_nudge(&out, 1);
+    }
+    else if(*token == '+')
+      curlx_str_nudge(&out, 1);
+
+    if(curlx_str_casecompare(&out, "all"))
+      trc_apply_level_by_category(TRC_CT_NONE, lvl);
+    else if(curlx_str_casecompare(&out, "protocol"))
+      trc_apply_level_by_category(TRC_CT_PROTOCOL, lvl);
+    else if(curlx_str_casecompare(&out, "network"))
+      trc_apply_level_by_category(TRC_CT_NETWORK, lvl);
+    else if(curlx_str_casecompare(&out, "proxy"))
+      trc_apply_level_by_category(TRC_CT_PROXY, lvl);
+    else if(curlx_str_casecompare(&out, "doh")) {
+      struct Curl_str dns = { "dns", 3 };
+      trc_apply_level_by_name(&dns, lvl);
+    }
+    else
+      trc_apply_level_by_name(&out, lvl);
+
+    if(curlx_str_single(&config, ','))
+      break;
+  }
+  return CURLE_OK;
+}
+
 CURLcode Curl_trc_opt(const char *config)
 {
-  char *token, *tok_buf, *tmp;
-  size_t i;
-  int lvl;
-
-  tmp = strdup(config);
-  if(!tmp)
-    return CURLE_OUT_OF_MEMORY;
-
-  token = strtok_r(tmp, ", ", &tok_buf);
-  while(token) {
-    switch(*token) {
-      case '-':
-        lvl = CURL_LOG_LVL_NONE;
-        ++token;
-        break;
-      case '+':
-        lvl = CURL_LOG_LVL_INFO;
-        ++token;
-        break;
-      default:
-        lvl = CURL_LOG_LVL_INFO;
-        break;
-    }
-    for(i = 0; cf_types[i]; ++i) {
-      if(strcasecompare(token, "all")) {
-        cf_types[i]->log_level = lvl;
-      }
-      else if(strcasecompare(token, cf_types[i]->name)) {
-        cf_types[i]->log_level = lvl;
-        break;
-      }
-    }
-    token = strtok_r(NULL, ", ", &tok_buf);
+  CURLcode result = config ? trc_opt(config) : CURLE_OK;
+#ifdef DEBUGBUILD
+  /* CURL_DEBUG can override anything */
+  if(!result) {
+    const char *dbg_config = getenv("CURL_DEBUG");
+    if(dbg_config)
+      result = trc_opt(dbg_config);
   }
-  free(tmp);
-  return CURLE_OK;
+#endif /* DEBUGBUILD */
+  return result;
 }
 
 CURLcode Curl_trc_init(void)
 {
 #ifdef DEBUGBUILD
-  /* WIP: we use the auto-init from an env var only in DEBUG builds for
-   * convenience. */
-  const char *config = getenv("CURL_DEBUG");
-  if(config) {
-    return Curl_trc_opt(config);
-  }
-#endif
+  return Curl_trc_opt(NULL);
+#else
   return CURLE_OK;
+#endif
 }
-#else /* !CURL_DISABLE_VERBOSE_STRINGS) */
+
+#else /* CURL_DISABLE_VERBOSE_STRINGS */
 
 CURLcode Curl_trc_init(void)
 {
   return CURLE_OK;
 }
 
-#if !defined(__STDC_VERSION__) || (__STDC_VERSION__ < 199901L)
-void Curl_trc_cf_infof(struct Curl_easy *data, struct Curl_cfilter *cf,
+void Curl_infof(struct Curl_easy *data, const char *fmt, ...)
+{
+  (void)data;
+  (void)fmt;
+}
+
+void Curl_trc_cf_infof(struct Curl_easy *data, const struct Curl_cfilter *cf,
                        const char *fmt, ...)
 {
   (void)data;
   (void)cf;
   (void)fmt;
 }
+
+void Curl_trc_multi(struct Curl_easy *data, const char *fmt, ...)
+{
+  (void)data;
+  (void)fmt;
+}
+
+void Curl_trc_write(struct Curl_easy *data, const char *fmt, ...)
+{
+  (void)data;
+  (void)fmt;
+}
+
+void Curl_trc_dns(struct Curl_easy *data, const char *fmt, ...)
+{
+  (void)data;
+  (void)fmt;
+}
+
+void Curl_trc_timer(struct Curl_easy *data, int tid, const char *fmt, ...)
+{
+  (void)data;
+  (void)tid;
+  (void)fmt;
+}
+
+void Curl_trc_read(struct Curl_easy *data, const char *fmt, ...)
+{
+  (void)data;
+  (void)fmt;
+}
+
+#ifndef CURL_DISABLE_FTP
+void Curl_trc_ftp(struct Curl_easy *data, const char *fmt, ...)
+{
+  (void)data;
+  (void)fmt;
+}
+#endif
+#ifndef CURL_DISABLE_SMTP
+void Curl_trc_smtp(struct Curl_easy *data, const char *fmt, ...)
+{
+  (void)data;
+  (void)fmt;
+}
+#endif
+#if !defined(CURL_DISABLE_WEBSOCKETS) && !defined(CURL_DISABLE_HTTP)
+void Curl_trc_ws(struct Curl_easy *data, const char *fmt, ...)
+{
+  (void)data;
+  (void)fmt;
+}
+#endif
+#ifdef USE_SSH
+void Curl_trc_ssh(struct Curl_easy *data, const char *fmt, ...)
+{
+  (void)data;
+  (void)fmt;
+}
+#endif
+#ifdef USE_SSL
+void Curl_trc_ssls(struct Curl_easy *data, const char *fmt, ...)
+{
+  (void)data;
+  (void)fmt;
+}
 #endif
 
-#endif /* !DEBUGBUILD */
+#endif /* !CURL_DISABLE_VERBOSE_STRINGS */
diff --git a/third-party/curl/lib/curl_trc.h b/third-party/curl/lib/curl_trc.h
index 84b5471d85..b4ae8e5314 100644
--- a/third-party/curl/lib/curl_trc.h
+++ b/third-party/curl/lib/curl_trc.h
@@ -23,7 +23,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 struct Curl_easy;
 struct Curl_cfilter;
 
@@ -52,99 +51,294 @@ CURLcode Curl_trc_opt(const char *config);
 
 /* the function used to output verbose information */
 void Curl_debug(struct Curl_easy *data, curl_infotype type,
-                char *ptr, size_t size);
-
-/**
- * Output an informational message when transfer's verbose logging is enabled.
- */
-void Curl_infof(struct Curl_easy *data,
-#if defined(__GNUC__) && !defined(printf) &&                    \
-  defined(__STDC_VERSION__) && (__STDC_VERSION__ >= 199901L) && \
-  !defined(__MINGW32__)
-                       const char *fmt, ...)
-                       __attribute__((format(printf, 2, 3)));
-#else
-                       const char *fmt, ...);
-#endif
+                const char *ptr, size_t size);
 
 /**
  * Output a failure message on registered callbacks for transfer.
  */
 void Curl_failf(struct Curl_easy *data,
-#if defined(__GNUC__) && !defined(printf) &&                    \
-  defined(__STDC_VERSION__) && (__STDC_VERSION__ >= 199901L) && \
-  !defined(__MINGW32__)
-                       const char *fmt, ...)
-                       __attribute__((format(printf, 2, 3)));
-#else
-                       const char *fmt, ...);
-#endif
+                const char *fmt, ...) CURL_PRINTF(2, 3);
 
 #define failf Curl_failf
 
+/* In case failf() reported into the errorbuf, clear it again.
+ * This is used to clear information from happy eyeballing attempts
+ * when ultimately a successful attempt was made. */
+void Curl_reset_fail(struct Curl_easy *data);
+
+#define CURL_LOG_LVL_NONE  0
+#define CURL_LOG_LVL_INFO  1
+
+/**
+ * Output an informational message when transfer's verbose logging is enabled.
+ */
+void Curl_infof(struct Curl_easy *data,
+                const char *fmt, ...) CURL_PRINTF(2, 3);
+
 /**
  * Output an informational message when both transfer's verbose logging
  * and connection filters verbose logging are enabled.
  */
-void Curl_trc_cf_infof(struct Curl_easy *data, struct Curl_cfilter *cf,
-#if defined(__GNUC__) && !defined(printf) &&                    \
-  defined(__STDC_VERSION__) && (__STDC_VERSION__ >= 199901L) && \
-  !defined(__MINGW32__)
-                       const char *fmt, ...)
-                       __attribute__((format(printf, 3, 4)));
-#else
-                       const char *fmt, ...);
+void Curl_trc_cf_infof(struct Curl_easy *data, const struct Curl_cfilter *cf,
+                       const char *fmt, ...) CURL_PRINTF(3, 4);
+void Curl_trc_multi(struct Curl_easy *data,
+                    const char *fmt, ...) CURL_PRINTF(2, 3);
+const char *Curl_trc_mstate_name(int state);
+const char *Curl_trc_timer_name(int tid);
+void Curl_trc_easy_timers(struct Curl_easy *data);
+
+void Curl_trc_write(struct Curl_easy *data,
+                    const char *fmt, ...) CURL_PRINTF(2, 3);
+void Curl_trc_read(struct Curl_easy *data,
+                   const char *fmt, ...) CURL_PRINTF(2, 3);
+void Curl_trc_dns(struct Curl_easy *data,
+                  const char *fmt, ...) CURL_PRINTF(2, 3);
+void Curl_trc_timer(struct Curl_easy *data, int tid,
+                    const char *fmt, ...) CURL_PRINTF(3, 4);
+
+struct curl_trc_feat {
+  const char *name;
+  int log_level;
+};
+
+void Curl_trc_feat_infof(struct Curl_easy *data,
+                         struct curl_trc_feat *feat,
+                         const char *fmt, ...) CURL_PRINTF(3, 4);
+
+#ifndef CURL_DISABLE_FTP
+extern struct curl_trc_feat Curl_trc_feat_ftp;
+void Curl_trc_ftp(struct Curl_easy *data,
+                  const char *fmt, ...) CURL_PRINTF(2, 3);
+#endif
+#ifndef CURL_DISABLE_SMTP
+extern struct curl_trc_feat Curl_trc_feat_smtp;
+void Curl_trc_smtp(struct Curl_easy *data,
+                   const char *fmt, ...) CURL_PRINTF(2, 3);
+#endif
+#ifdef USE_SSL
+extern struct curl_trc_feat Curl_trc_feat_ssls;
+void Curl_trc_ssls(struct Curl_easy *data,
+                   const char *fmt, ...) CURL_PRINTF(2, 3);
+#endif
+#ifdef USE_SSH
+extern struct curl_trc_feat Curl_trc_feat_ssh;
+void Curl_trc_ssh(struct Curl_easy *data,
+                  const char *fmt, ...) CURL_PRINTF(2, 3);
+#endif
+#if !defined(CURL_DISABLE_WEBSOCKETS) && !defined(CURL_DISABLE_HTTP)
+extern struct curl_trc_feat Curl_trc_feat_ws;
+void Curl_trc_ws(struct Curl_easy *data,
+                 const char *fmt, ...) CURL_PRINTF(2, 3);
 #endif
 
-#define CURL_LOG_LVL_NONE  0
-#define CURL_LOG_LVL_INFO  1
+#define CURL_TRC_M_is_verbose(data) \
+  Curl_trc_ft_is_verbose(data, &Curl_trc_feat_multi)
+#define CURL_TRC_DNS_is_verbose(data) \
+  Curl_trc_ft_is_verbose(data, &Curl_trc_feat_dns)
+#define CURL_TRC_TIMER_is_verbose(data) \
+  Curl_trc_ft_is_verbose(data, &Curl_trc_feat_timer)
 
+#if defined(CURL_HAVE_MACRO_VARARG) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#define infof(data, ...)             \
+  do {                               \
+    if(Curl_trc_is_verbose(data))    \
+      Curl_infof(data, __VA_ARGS__); \
+  } while(0)
+#define CURL_TRC_M(data, ...)            \
+  do {                                   \
+    if(CURL_TRC_M_is_verbose(data))      \
+      Curl_trc_multi(data, __VA_ARGS__); \
+  } while(0)
+#define CURL_TRC_CF(data, cf, ...)              \
+  do {                                          \
+    if(Curl_trc_cf_is_verbose(cf, data))        \
+      Curl_trc_cf_infof(data, cf, __VA_ARGS__); \
+  } while(0)
+#define CURL_TRC_WRITE(data, ...)                          \
+  do {                                                     \
+    if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_write)) \
+      Curl_trc_write(data, __VA_ARGS__);                   \
+  } while(0)
+#define CURL_TRC_READ(data, ...)                          \
+  do {                                                    \
+    if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_read)) \
+      Curl_trc_read(data, __VA_ARGS__);                   \
+  } while(0)
+#define CURL_TRC_DNS(data, ...)        \
+  do {                                 \
+    if(CURL_TRC_DNS_is_verbose(data))  \
+      Curl_trc_dns(data, __VA_ARGS__); \
+  } while(0)
+#define CURL_TRC_TIMER(data, tid, ...)        \
+  do {                                        \
+    if(CURL_TRC_TIMER_is_verbose(data))       \
+      Curl_trc_timer(data, tid, __VA_ARGS__); \
+  } while(0)
 
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
-/* informational messages enabled */
+#ifndef CURL_DISABLE_FTP
+#define CURL_TRC_FTP(data, ...)                          \
+  do {                                                   \
+    if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_ftp)) \
+      Curl_trc_ftp(data, __VA_ARGS__);                   \
+  } while(0)
+#endif /* !CURL_DISABLE_FTP */
+#ifndef CURL_DISABLE_SMTP
+#define CURL_TRC_SMTP(data, ...)                          \
+  do {                                                    \
+    if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_smtp)) \
+      Curl_trc_smtp(data, __VA_ARGS__);                   \
+  } while(0)
+#endif /* !CURL_DISABLE_SMTP */
+#ifdef USE_SSL
+#define CURL_TRC_SSLS(data, ...)                          \
+  do {                                                    \
+    if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_ssls)) \
+      Curl_trc_ssls(data, __VA_ARGS__);                   \
+  } while(0)
+#endif /* USE_SSL */
+#ifdef USE_SSH
+#define CURL_TRC_SSH(data, ...)                          \
+  do {                                                   \
+    if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_ssh)) \
+      Curl_trc_ssh(data, __VA_ARGS__);                   \
+  } while(0)
+#endif /* USE_SSH */
+#if !defined(CURL_DISABLE_WEBSOCKETS) && !defined(CURL_DISABLE_HTTP)
+#define CURL_TRC_WS(data, ...)                          \
+  do {                                                  \
+    if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_ws)) \
+      Curl_trc_ws(data, __VA_ARGS__);                   \
+  } while(0)
+#endif /* !CURL_DISABLE_WEBSOCKETS && !CURL_DISABLE_HTTP */
 
-#define Curl_trc_is_verbose(data)    ((data) && (data)->set.verbose)
-#define Curl_trc_cf_is_verbose(cf, data) \
-                            ((data) && (data)->set.verbose && \
-                            (cf) && (cf)->cft->log_level >= CURL_LOG_LVL_INFO)
-
-/* explainer: we have some mix configuration and werror settings
- * that define HAVE_VARIADIC_MACROS_C99 even though C89 is enforced
- * on gnuc and some other compiler. Need to treat carefully.
- */
-#if defined(HAVE_VARIADIC_MACROS_C99) && \
-    defined(__STDC_VERSION__) && (__STDC_VERSION__ >= 199901L)
+#elif defined(CURL_HAVE_MACRO_VARARG) && defined(CURL_DISABLE_VERBOSE_STRINGS)
 
 #define infof(data, ...) \
-  do { if(Curl_trc_is_verbose(data)) \
-         Curl_infof(data, __VA_ARGS__); } while(0)
+  do {                   \
+    (void)(data);        \
+  } while(0)
+#define CURL_TRC_M(data, ...) \
+  do {                        \
+    (void)(data);             \
+  } while(0)
 #define CURL_TRC_CF(data, cf, ...) \
-  do { if(Curl_trc_cf_is_verbose(cf, data)) \
-         Curl_trc_cf_infof(data, cf, __VA_ARGS__); } while(0)
-
-#else /* no variadic macro args */
-#define infof Curl_infof
-#define CURL_TRC_CF Curl_trc_cf_infof
-#endif /* variadic macro args */
-
-#else /* !CURL_DISABLE_VERBOSE_STRINGS */
-/* All informational messages are not compiled in for size savings */
-
-#define Curl_trc_is_verbose(d)        ((void)(d), FALSE)
-#define Curl_trc_cf_is_verbose(x,y)   ((void)(x), (void)(y), FALSE)
-
-#if defined(HAVE_VARIADIC_MACROS_C99)
-#define infof(...)  Curl_nop_stmt
-#define CURL_TRC_CF(...)  Curl_nop_stmt
-#define Curl_trc_cf_infof(...)  Curl_nop_stmt
-#elif defined(HAVE_VARIADIC_MACROS_GCC)
-#define infof(x...)  Curl_nop_stmt
-#define CURL_TRC_CF(x...)  Curl_nop_stmt
-#define Curl_trc_cf_infof(x...)  Curl_nop_stmt
-#else
-#error "missing VARIADIC macro define, fix and rebuild!"
+  do {                             \
+    (void)(data);                  \
+    (void)(cf);                    \
+  } while(0)
+#define CURL_TRC_WRITE(data, ...) \
+  do {                            \
+    (void)(data);                 \
+  } while(0)
+#define CURL_TRC_READ(data, ...) \
+  do {                           \
+    (void)(data);                \
+  } while(0)
+#define CURL_TRC_DNS(data, ...) \
+  do {                          \
+    (void)(data);               \
+  } while(0)
+#define CURL_TRC_TIMER(data, tid, ...) \
+  do {                                 \
+    (void)(data);                      \
+    (void)(tid);                       \
+  } while(0)
+#ifndef CURL_DISABLE_FTP
+#define CURL_TRC_FTP(data, ...) \
+  do {                          \
+    (void)(data);               \
+  } while(0)
+#endif /* !CURL_DISABLE_FTP */
+#ifndef CURL_DISABLE_SMTP
+#define CURL_TRC_SMTP(data, ...) \
+  do {                           \
+    (void)(data);                \
+  } while(0)
+#endif /* !CURL_DISABLE_SMTP */
+#ifdef USE_SSL
+#define CURL_TRC_SSLS(data, ...) \
+  do {                           \
+    (void)(data);                \
+  } while(0)
+#endif /* USE_SSL */
+#ifdef USE_SSH
+#define CURL_TRC_SSH(data, ...) \
+  do {                          \
+    (void)(data);               \
+  } while(0)
+#endif /* USE_SSH */
+#if !defined(CURL_DISABLE_WEBSOCKETS) && !defined(CURL_DISABLE_HTTP)
+#define CURL_TRC_WS(data, ...) \
+  do {                         \
+    (void)(data);              \
+  } while(0)
 #endif
 
-#endif /* CURL_DISABLE_VERBOSE_STRINGS */
+#else /* !CURL_HAVE_MACRO_VARARG */
+
+#define infof          Curl_infof
+#define CURL_TRC_M     Curl_trc_multi
+#define CURL_TRC_CF    Curl_trc_cf_infof
+#define CURL_TRC_WRITE Curl_trc_write
+#define CURL_TRC_READ  Curl_trc_read
+#define CURL_TRC_DNS   Curl_trc_dns
+#define CURL_TRC_TIMER Curl_trc_timer
+
+#ifndef CURL_DISABLE_FTP
+#define CURL_TRC_FTP   Curl_trc_ftp
+#endif
+#ifndef CURL_DISABLE_SMTP
+#define CURL_TRC_SMTP  Curl_trc_smtp
+#endif
+#ifdef USE_SSL
+#define CURL_TRC_SSLS  Curl_trc_ssls
+#endif
+#ifdef USE_SSH
+#define CURL_TRC_SSH   Curl_trc_ssh
+#endif
+#if !defined(CURL_DISABLE_WEBSOCKETS) && !defined(CURL_DISABLE_HTTP)
+#define CURL_TRC_WS    Curl_trc_ws
+#endif
+
+#endif /* CURL_HAVE_MACRO_VARARG */
+
+#ifdef CURLVERBOSE
+extern struct curl_trc_feat Curl_trc_feat_multi;
+extern struct curl_trc_feat Curl_trc_feat_read;
+extern struct curl_trc_feat Curl_trc_feat_write;
+extern struct curl_trc_feat Curl_trc_feat_dns;
+extern struct curl_trc_feat Curl_trc_feat_timer;
+#ifdef USE_THREADS
+extern struct curl_trc_feat Curl_trc_feat_threads;
+#endif
+#endif
+
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
+/* informational messages enabled */
+#define Curl_trc_is_verbose(data)                          \
+  ((data) && (data)->set.verbose &&                        \
+   (!(data)->state.feat ||                                 \
+    ((data)->state.feat->log_level >= CURL_LOG_LVL_INFO)))
+#define Curl_trc_cf_is_verbose(cf, data)              \
+  (Curl_trc_is_verbose(data) &&                       \
+   (cf) && (cf)->cft->log_level >= CURL_LOG_LVL_INFO)
+#define Curl_trc_ft_is_verbose(data, ft) \
+  (Curl_trc_is_verbose(data) &&          \
+   (ft)->log_level >= CURL_LOG_LVL_INFO)
+#define CURL_MSTATE_NAME(s)  Curl_trc_mstate_name((int)(s))
+#define CURL_TRC_EASY_TIMERS(data)      \
+  do {                                  \
+    if(CURL_TRC_TIMER_is_verbose(data)) \
+      Curl_trc_easy_timers(data);       \
+  } while(0)
+
+#else /* CURL_DISABLE_VERBOSE_STRINGS */
+/* All informational messages are not compiled in for size savings */
+#define Curl_trc_is_verbose(d)        FALSE
+#define Curl_trc_cf_is_verbose(x, y)  FALSE
+#define Curl_trc_ft_is_verbose(x, y)  FALSE
+#define CURL_MSTATE_NAME(x)           ((void)(x), "-")
+#define CURL_TRC_EASY_TIMERS(x)       Curl_nop_stmt
+#endif /* !CURL_DISABLE_VERBOSE_STRINGS */
 
 #endif /* HEADER_CURL_TRC_H */
diff --git a/third-party/curl/lib/curlx.h b/third-party/curl/lib/curlx.h
deleted file mode 100644
index 7a753d6824..0000000000
--- a/third-party/curl/lib/curlx.h
+++ /dev/null
@@ -1,118 +0,0 @@
-#ifndef HEADER_CURL_CURLX_H
-#define HEADER_CURL_CURLX_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-/*
- * Defines protos and includes all header files that provide the curlx_*
- * functions. The curlx_* functions are not part of the libcurl API, but are
- * stand-alone functions whose sources can be built and linked by apps if need
- * be.
- */
-
-#include <curl/mprintf.h>
-/* this is still a public header file that provides the curl_mprintf()
-   functions while they still are offered publicly. They will be made library-
-   private one day */
-
-#include "strcase.h"
-/* "strcase.h" provides the strcasecompare protos */
-
-#include "strtoofft.h"
-/* "strtoofft.h" provides this function: curlx_strtoofft(), returns a
-   curl_off_t number from a given string.
-*/
-
-#include "nonblock.h"
-/* "nonblock.h" provides curlx_nonblock() */
-
-#include "warnless.h"
-/* "warnless.h" provides functions:
-
-  curlx_ultous()
-  curlx_ultouc()
-  curlx_uztosi()
-*/
-
-#include "curl_multibyte.h"
-/* "curl_multibyte.h" provides these functions and macros:
-
-  curlx_convert_UTF8_to_wchar()
-  curlx_convert_wchar_to_UTF8()
-  curlx_convert_UTF8_to_tchar()
-  curlx_convert_tchar_to_UTF8()
-  curlx_unicodefree()
-*/
-
-#include "version_win32.h"
-/* "version_win32.h" provides curlx_verify_windows_version() */
-
-/* Now setup curlx_ * names for the functions that are to become curlx_ and
-   be removed from a future libcurl official API:
-   curlx_getenv
-   curlx_mprintf (and its variations)
-   curlx_strcasecompare
-   curlx_strncasecompare
-
-*/
-
-#define curlx_getenv curl_getenv
-#define curlx_mvsnprintf curl_mvsnprintf
-#define curlx_msnprintf curl_msnprintf
-#define curlx_maprintf curl_maprintf
-#define curlx_mvaprintf curl_mvaprintf
-#define curlx_msprintf curl_msprintf
-#define curlx_mprintf curl_mprintf
-#define curlx_mfprintf curl_mfprintf
-#define curlx_mvsprintf curl_mvsprintf
-#define curlx_mvprintf curl_mvprintf
-#define curlx_mvfprintf curl_mvfprintf
-
-#ifdef ENABLE_CURLX_PRINTF
-/* If this define is set, we define all "standard" printf() functions to use
-   the curlx_* version instead. It makes the source code transparent and
-   easier to understand/patch. Undefine them first. */
-# undef printf
-# undef fprintf
-# undef sprintf
-# undef msnprintf
-# undef vprintf
-# undef vfprintf
-# undef vsprintf
-# undef mvsnprintf
-# undef aprintf
-# undef vaprintf
-
-# define printf curlx_mprintf
-# define fprintf curlx_mfprintf
-# define sprintf curlx_msprintf
-# define msnprintf curlx_msnprintf
-# define vprintf curlx_mvprintf
-# define vfprintf curlx_mvfprintf
-# define mvsnprintf curlx_mvsnprintf
-# define aprintf curlx_maprintf
-# define vaprintf curlx_mvaprintf
-#endif /* ENABLE_CURLX_PRINTF */
-
-#endif /* HEADER_CURL_CURLX_H */
diff --git a/third-party/curl/lib/curlx/base64.c b/third-party/curl/lib/curlx/base64.c
new file mode 100644
index 0000000000..7f51576f50
--- /dev/null
+++ b/third-party/curl/lib/curlx/base64.c
@@ -0,0 +1,267 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+/* Base64 encoding/decoding */
+
+#include "curl_setup.h"
+
+#include "curlx/base64.h"
+
+/* ---- Base64 Encoding/Decoding Table --- */
+const char curlx_base64encdec[] =
+  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+/* The Base 64 encoding with a URL and filename safe alphabet, RFC 4648
+   section 5 */
+static const char base64url[] =
+  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+
+static const unsigned char decodetable[] = {
+  62,  255, 255, 255, 63,  52,  53, 54, 55, 56, 57, 58, 59, 60, 61, 255,
+  255, 255, 255, 255, 255, 255, 0,  1,  2,  3,  4,  5,  6,  7,  8,  9,
+  10,  11,  12,  13,  14,  15,  16, 17, 18, 19, 20, 21, 22, 23, 24, 25,
+  255, 255, 255, 255, 255, 255, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35,
+  36,  37,  38,  39,  40,  41,  42, 43, 44, 45, 46, 47, 48, 49, 50, 51
+};
+/*
+ * curlx_base64_decode()
+ *
+ * Given a base64 null-terminated string at src, decode it and return a
+ * pointer in *outptr to a newly allocated memory area holding decoded data.
+ * Size of decoded data is returned in variable pointed by outlen.
+ *
+ * Returns CURLE_OK on success, otherwise specific error code. Function
+ * output shall not be considered valid unless CURLE_OK is returned.
+ *
+ * When decoded data length is 0, returns NULL in *outptr.
+ *
+ * @unittest: 1302
+ */
+CURLcode curlx_base64_decode(const char *src,
+                             uint8_t **outptr, size_t *outlen)
+{
+  size_t srclen = 0;
+  size_t padding = 0;
+  size_t i;
+  size_t numQuantums;
+  size_t fullQuantums;
+  size_t rawlen = 0;
+  unsigned char *pos;
+  unsigned char *newstr;
+  unsigned char lookup[256];
+
+  *outptr = NULL;
+  *outlen = 0;
+  srclen = strlen(src);
+
+  /* Check the length of the input string is valid */
+  if(!srclen || srclen % 4)
+    return CURLE_BAD_CONTENT_ENCODING;
+
+  /* srclen is at least 4 here */
+  while(src[srclen - 1 - padding] == '=') {
+    /* count padding characters */
+    padding++;
+    /* A maximum of two = padding characters is allowed */
+    if(padding > 2)
+      return CURLE_BAD_CONTENT_ENCODING;
+  }
+
+  /* Calculate the number of quantums */
+  numQuantums = srclen / 4;
+  fullQuantums = numQuantums - (padding ? 1 : 0);
+
+  /* Calculate the size of the decoded string */
+  rawlen = (numQuantums * 3) - padding;
+
+  /* Allocate our buffer including room for a null-terminator */
+  newstr = curlx_malloc(rawlen + 1);
+  if(!newstr)
+    return CURLE_OUT_OF_MEMORY;
+
+  pos = newstr;
+
+  memset(lookup, 0xff, sizeof(lookup));
+  memcpy(&lookup['+'], decodetable, sizeof(decodetable));
+
+  /* Decode the complete quantums first */
+  for(i = 0; i < fullQuantums; i++) {
+    unsigned char val;
+    unsigned int x = 0;
+    int j;
+
+    for(j = 0; j < 4; j++) {
+      val = lookup[(unsigned char)*src++];
+      if(val == 0xff) /* bad symbol */
+        goto bad;
+      x = (x << 6) | val;
+    }
+    pos[2] = x & 0xff;
+    pos[1] = (x >> 8) & 0xff;
+    pos[0] = (x >> 16) & 0xff;
+    pos += 3;
+  }
+  if(padding) {
+    /* this means either 8 or 16 bits output */
+    unsigned char val;
+    unsigned int x = 0;
+    int j;
+    size_t padc = 0;
+    for(j = 0; j < 4; j++) {
+      if(*src == '=') {
+        x <<= 6;
+        src++;
+        if(++padc > padding)
+          /* this is a badly placed '=' symbol! */
+          goto bad;
+      }
+      else {
+        val = lookup[(unsigned char)*src++];
+        if(val == 0xff) /* bad symbol */
+          goto bad;
+        x = (x << 6) | val;
+      }
+    }
+    if(padding == 1)
+      pos[1] = (x >> 8) & 0xff;
+    pos[0] = (x >> 16) & 0xff;
+    pos += 3 - padding;
+  }
+
+  /* Null-terminate */
+  *pos = '\0';
+
+  /* Return the decoded data */
+  *outptr = newstr;
+  *outlen = rawlen;
+
+  return CURLE_OK;
+bad:
+  curlx_free(newstr);
+  return CURLE_BAD_CONTENT_ENCODING;
+}
+
+static CURLcode base64_encode(const char *table64,
+                              uint8_t padbyte,
+                              const uint8_t *inputbuff, size_t insize,
+                              char **outptr, size_t *outlen)
+{
+  char *output;
+  char *base64data;
+  const unsigned char *in = (const unsigned char *)inputbuff;
+
+  *outptr = NULL;
+  *outlen = 0;
+
+  if(!insize)
+    return CURLE_OK;
+
+  /* safety precaution */
+  DEBUGASSERT(insize <= CURL_MAX_BASE64_INPUT);
+  if(insize > CURL_MAX_BASE64_INPUT)
+    return CURLE_TOO_LARGE;
+
+  base64data = output = curlx_malloc(((insize + 2) / 3 * 4) + 1);
+  if(!output)
+    return CURLE_OUT_OF_MEMORY;
+
+  while(insize >= 3) {
+    *output++ = table64[in[0] >> 2];
+    *output++ = table64[((in[0] & 0x03) << 4) | (in[1] >> 4)];
+    *output++ = table64[((in[1] & 0x0F) << 2) | ((in[2] & 0xC0) >> 6)];
+    *output++ = table64[in[2] & 0x3F];
+    insize -= 3;
+    in += 3;
+  }
+  if(insize) {
+    /* this is only one or two bytes now */
+    *output++ = table64[in[0] >> 2];
+    if(insize == 1) {
+      *output++ = table64[((in[0] & 0x03) << 4)];
+      if(padbyte) {
+        *output++ = padbyte;
+        *output++ = padbyte;
+      }
+    }
+    else {
+      /* insize == 2 */
+      *output++ = table64[((in[0] & 0x03) << 4) | ((in[1] & 0xF0) >> 4)];
+      *output++ = table64[((in[1] & 0x0F) << 2)];
+      if(padbyte)
+        *output++ = padbyte;
+    }
+  }
+
+  /* Null-terminate */
+  *output = '\0';
+
+  /* Return the pointer to the new data (allocated memory) */
+  *outptr = base64data;
+
+  /* Return the length of the new data */
+  *outlen = (size_t)(output - base64data);
+
+  return CURLE_OK;
+}
+
+/*
+ * curlx_base64_encode()
+ *
+ * Given a pointer to an input buffer and an input size, encode it and
+ * return a pointer in *outptr to a newly allocated memory area holding
+ * encoded data. Size of encoded data is returned in variable pointed by
+ * outlen.
+ *
+ * Returns CURLE_OK on success, otherwise specific error code. Function
+ * output shall not be considered valid unless CURLE_OK is returned.
+ *
+ * @unittest: 1302
+ */
+CURLcode curlx_base64_encode(const uint8_t *inputbuff, size_t insize,
+                             char **outptr, size_t *outlen)
+{
+  return base64_encode(curlx_base64encdec, '=',
+                       inputbuff, insize, outptr, outlen);
+}
+
+/*
+ * curlx_base64url_encode()
+ *
+ * Given a pointer to an input buffer and an input size, encode it and
+ * return a pointer in *outptr to a newly allocated memory area holding
+ * encoded data. Size of encoded data is returned in variable pointed by
+ * outlen.
+ *
+ * Input length of 0 indicates input buffer holds a null-terminated string.
+ *
+ * Returns CURLE_OK on success, otherwise specific error code. Function
+ * output shall not be considered valid unless CURLE_OK is returned.
+ *
+ * @unittest: 1302
+ */
+CURLcode curlx_base64url_encode(const uint8_t *inputbuff, size_t insize,
+                                char **outptr, size_t *outlen)
+{
+  return base64_encode(base64url, 0, inputbuff, insize, outptr, outlen);
+}
diff --git a/third-party/curl/lib/curlx/base64.h b/third-party/curl/lib/curlx/base64.h
new file mode 100644
index 0000000000..2e77814822
--- /dev/null
+++ b/third-party/curl/lib/curlx/base64.h
@@ -0,0 +1,40 @@
+#ifndef HEADER_CURL_BASE64_H
+#define HEADER_CURL_BASE64_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+CURLcode curlx_base64_encode(const uint8_t *inputbuff, size_t insize,
+                             char **outptr, size_t *outlen);
+CURLcode curlx_base64url_encode(const uint8_t *inputbuff, size_t insize,
+                                char **outptr, size_t *outlen);
+CURLcode curlx_base64_decode(const char *src,
+                             uint8_t **outptr, size_t *outlen);
+
+extern const char curlx_base64encdec[];
+
+/* maximum input length acceptable to base64 encode, here to catch and prevent
+   mistakes */
+#define CURL_MAX_BASE64_INPUT 16000000
+
+#endif /* HEADER_CURL_BASE64_H */
diff --git a/third-party/curl/lib/curlx/basename.c b/third-party/curl/lib/curlx/basename.c
new file mode 100644
index 0000000000..d2fd160ff2
--- /dev/null
+++ b/third-party/curl/lib/curlx/basename.c
@@ -0,0 +1,74 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifndef HAVE_BASENAME
+
+#include "curlx/basename.h"
+
+/*
+  (Quote from The Open Group Base Specifications Issue 6 IEEE Std 1003.1, 2004
+  Edition)
+
+  The basename() function shall take the pathname pointed to by path and
+  return a pointer to the final component of the pathname, deleting any
+  trailing '/' characters.
+
+  If the string pointed to by path consists entirely of the '/' character,
+  basename() shall return a pointer to the string "/". If the string pointed
+  to by path is exactly "//", it is implementation-defined whether '/' or "//"
+  is returned.
+
+  If path is a null pointer or points to an empty string, basename() shall
+  return a pointer to the string ".".
+
+  The basename() function may modify the string pointed to by path, and may
+  return a pointer to static storage that may then be overwritten by a
+  subsequent call to basename().
+
+  The basename() function need not be reentrant. A function that is not
+  required to be reentrant is not required to be thread-safe.
+
+*/
+char *curlx_basename(char *path)
+{
+  /* Ignore all the details above for now and make a quick and simple
+     implementation here */
+  char *s1;
+  char *s2;
+
+  s1 = strrchr(path, '/');
+  s2 = strrchr(path, '\\');
+
+  if(s1 && s2)
+    path = ((s1 > s2) ? s1 : s2) + 1;
+  else if(s1)
+    path = s1 + 1;
+  else if(s2)
+    path = s2 + 1;
+
+  return path;
+}
+
+#endif /* !HAVE_BASENAME */
diff --git a/third-party/curl/lib/curlx/basename.h b/third-party/curl/lib/curlx/basename.h
new file mode 100644
index 0000000000..fb79fed805
--- /dev/null
+++ b/third-party/curl/lib/curlx/basename.h
@@ -0,0 +1,39 @@
+#ifndef HEADER_CURLX_BASENAME_H
+#define HEADER_CURLX_BASENAME_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifndef HAVE_BASENAME
+char *curlx_basename(char *path);
+#else
+
+#ifdef HAVE_LIBGEN_H
+#include <libgen.h>
+#endif
+
+#define curlx_basename(x) basename(x)
+#endif /* !HAVE_BASENAME */
+
+#endif /* HEADER_CURLX_BASENAME_H */
diff --git a/third-party/curl/lib/curlx/dynbuf.c b/third-party/curl/lib/curlx/dynbuf.c
new file mode 100644
index 0000000000..1e5ea5177d
--- /dev/null
+++ b/third-party/curl/lib/curlx/dynbuf.c
@@ -0,0 +1,292 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "curlx/dynbuf.h"
+#include "curl_printf.h"
+
+#define MIN_FIRST_ALLOC 32
+
+#ifdef DEBUGBUILD
+#define DYNINIT 0xbee51da /* random pattern */
+#endif
+
+/*
+ * Init a dynbuf struct.
+ */
+void curlx_dyn_init(struct dynbuf *s, size_t toobig)
+{
+  DEBUGASSERT(s);
+  DEBUGASSERT(toobig);
+  DEBUGASSERT(toobig <= MAX_DYNBUF_SIZE); /* catch crazy mistakes */
+  s->bufr = NULL;
+  s->leng = 0;
+  s->allc = 0;
+  s->toobig = toobig;
+#ifdef DEBUGBUILD
+  s->init = DYNINIT;
+#endif
+}
+
+/*
+ * free the buffer and re-init the necessary fields. It does not touch the
+ * 'init' field and thus this buffer can be reused to add data to again.
+ */
+void curlx_dyn_free(struct dynbuf *s)
+{
+  DEBUGASSERT(s);
+  DEBUGASSERT(s->init == DYNINIT);
+  curlx_safefree(s->bufr);
+  s->leng = s->allc = 0;
+}
+
+/*
+ * Store/append an chunk of memory to the dynbuf.
+ */
+static CURLcode dyn_nappend(struct dynbuf *s,
+                            const unsigned char *mem, size_t len)
+{
+  size_t idx = s->leng;
+  size_t a = s->allc;
+  size_t fit = len + idx + 1; /* new string + old string + zero byte */
+
+  /* try to detect if there is rubbish in the struct */
+  DEBUGASSERT(s->init == DYNINIT);
+  DEBUGASSERT(s->toobig);
+  DEBUGASSERT(idx < s->toobig);
+  DEBUGASSERT(!s->leng || s->bufr);
+  DEBUGASSERT(a <= s->toobig);
+  DEBUGASSERT(!len || mem);
+
+  if(fit > s->toobig) {
+    curlx_dyn_free(s);
+    return CURLE_TOO_LARGE;
+  }
+  else if(!a) {
+    DEBUGASSERT(!idx);
+    /* first invoke */
+    if(MIN_FIRST_ALLOC > s->toobig)
+      a = s->toobig;
+    else if(fit < MIN_FIRST_ALLOC)
+      a = MIN_FIRST_ALLOC;
+    else
+      a = fit;
+  }
+  else {
+    while(a < fit)
+      a *= 2;
+    if(a > s->toobig)
+      /* no point in allocating a larger buffer than this is allowed to use */
+      a = s->toobig;
+  }
+
+  if(a != s->allc) {
+    void *p = curlx_realloc(s->bufr, a);
+    if(!p) {
+      curlx_dyn_free(s);
+      return CURLE_OUT_OF_MEMORY;
+    }
+    s->bufr = p;
+    s->allc = a;
+  }
+
+  if(len)
+    memcpy(&s->bufr[idx], mem, len);
+  s->leng = idx + len;
+  s->bufr[s->leng] = 0;
+  return CURLE_OK;
+}
+
+/*
+ * Clears the string, keeps the allocation. This can also be called on a
+ * buffer that already was freed.
+ */
+void curlx_dyn_reset(struct dynbuf *s)
+{
+  DEBUGASSERT(s);
+  DEBUGASSERT(s->init == DYNINIT);
+  DEBUGASSERT(!s->leng || s->bufr);
+  if(s->leng)
+    s->bufr[0] = 0;
+  s->leng = 0;
+}
+
+/*
+ * Specify the size of the tail to keep (number of bytes from the end of the
+ * buffer). The rest is dropped.
+ */
+CURLcode curlx_dyn_tail(struct dynbuf *s, size_t trail)
+{
+  DEBUGASSERT(s);
+  DEBUGASSERT(s->init == DYNINIT);
+  DEBUGASSERT(!s->leng || s->bufr);
+  if(trail > s->leng)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  else if(trail == s->leng)
+    return CURLE_OK;
+  else if(!trail) {
+    curlx_dyn_reset(s);
+  }
+  else {
+    memmove(&s->bufr[0], &s->bufr[s->leng - trail], trail);
+    s->leng = trail;
+    s->bufr[s->leng] = 0;
+  }
+  return CURLE_OK;
+}
+
+/*
+ * Appends a buffer with length.
+ */
+CURLcode curlx_dyn_addn(struct dynbuf *s, const void *mem, size_t len)
+{
+  DEBUGASSERT(s);
+  DEBUGASSERT(s->init == DYNINIT);
+  DEBUGASSERT(!s->leng || s->bufr);
+  return dyn_nappend(s, mem, len);
+}
+
+/*
+ * Append a null-terminated string at the end.
+ */
+CURLcode curlx_dyn_add(struct dynbuf *s, const char *str)
+{
+  size_t n;
+  DEBUGASSERT(str);
+  DEBUGASSERT(s);
+  DEBUGASSERT(s->init == DYNINIT);
+  DEBUGASSERT(!s->leng || s->bufr);
+  n = strlen(str);
+  return dyn_nappend(s, (const unsigned char *)str, n);
+}
+
+/*
+ * Append a string vprintf()-style
+ */
+CURLcode curlx_dyn_vaddf(struct dynbuf *s, const char *fmt, va_list ap)
+{
+#ifdef BUILDING_LIBCURL
+  int rc;
+  DEBUGASSERT(s);
+  DEBUGASSERT(s->init == DYNINIT);
+  DEBUGASSERT(!s->leng || s->bufr);
+  DEBUGASSERT(fmt);
+  rc = curlx_dyn_vprintf(s, fmt, ap);
+
+  if(!rc)
+    return CURLE_OK;
+  else if(rc == MERR_TOO_LARGE)
+    return CURLE_TOO_LARGE;
+  return CURLE_OUT_OF_MEMORY;
+#else
+  char *str;
+  str = curl_mvaprintf(fmt, ap); /* this allocs a new string to append */
+
+  if(str) {
+    CURLcode result = dyn_nappend(s, (const unsigned char *)str, strlen(str));
+    curl_free(str);
+    return result;
+  }
+  /* If we failed, we cleanup the whole buffer and return error */
+  curlx_dyn_free(s);
+  return CURLE_OUT_OF_MEMORY;
+#endif
+}
+
+/*
+ * Append a string printf()-style
+ */
+CURLcode curlx_dyn_addf(struct dynbuf *s, const char *fmt, ...)
+{
+  CURLcode result;
+  va_list ap;
+  DEBUGASSERT(s);
+  DEBUGASSERT(s->init == DYNINIT);
+  DEBUGASSERT(!s->leng || s->bufr);
+  DEBUGASSERT(strcmp(fmt, "%s")); /* use curlx_dyn_add instead */
+  va_start(ap, fmt);
+  result = curlx_dyn_vaddf(s, fmt, ap);
+  va_end(ap);
+  return result;
+}
+
+/*
+ * Returns a pointer to the buffer.
+ */
+char *curlx_dyn_ptr(const struct dynbuf *s)
+{
+  DEBUGASSERT(s);
+  DEBUGASSERT(s->init == DYNINIT);
+  DEBUGASSERT(!s->leng || s->bufr);
+  return s->bufr;
+}
+
+char *curlx_dyn_take(struct dynbuf *s, size_t *plen)
+{
+  char *ptr = s->bufr;
+  DEBUGASSERT(s);
+  DEBUGASSERT(s->init == DYNINIT);
+  *plen = s->leng;
+  s->bufr = NULL;
+  s->leng = 0;
+  s->allc = 0;
+  return ptr;
+}
+
+/*
+ * Returns an unsigned pointer to the buffer.
+ */
+unsigned char *curlx_dyn_uptr(const struct dynbuf *s)
+{
+  DEBUGASSERT(s);
+  DEBUGASSERT(s->init == DYNINIT);
+  DEBUGASSERT(!s->leng || s->bufr);
+  return (unsigned char *)s->bufr;
+}
+
+/*
+ * Returns the length of the buffer.
+ */
+size_t curlx_dyn_len(const struct dynbuf *s)
+{
+  DEBUGASSERT(s);
+  DEBUGASSERT(s->init == DYNINIT);
+  DEBUGASSERT(!s->leng || s->bufr);
+  return s->leng;
+}
+
+/*
+ * Set a new (smaller) length.
+ */
+CURLcode curlx_dyn_setlen(struct dynbuf *s, size_t set)
+{
+  DEBUGASSERT(s);
+  DEBUGASSERT(s->init == DYNINIT);
+  DEBUGASSERT(!s->leng || s->bufr);
+  if(set > s->leng)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  s->leng = set;
+  s->bufr[s->leng] = 0;
+  return CURLE_OK;
+}
diff --git a/third-party/curl/lib/curlx/dynbuf.h b/third-party/curl/lib/curlx/dynbuf.h
new file mode 100644
index 0000000000..0cf4a2c576
--- /dev/null
+++ b/third-party/curl/lib/curlx/dynbuf.h
@@ -0,0 +1,83 @@
+#ifndef HEADER_CURL_DYNBUF_H
+#define HEADER_CURL_DYNBUF_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+struct dynbuf {
+  char *bufr;    /* point to a null-terminated allocated buffer */
+  size_t leng;   /* number of bytes *EXCLUDING* the null-terminator */
+  size_t allc;   /* size of the current allocation */
+  size_t toobig; /* size limit for the buffer */
+#ifdef DEBUGBUILD
+  int init;      /* detect API usage mistakes */
+#endif
+};
+
+void curlx_dyn_init(struct dynbuf *s, size_t toobig);
+void curlx_dyn_free(struct dynbuf *s);
+CURLcode curlx_dyn_addn(struct dynbuf *s, const void *mem, size_t len)
+  WARN_UNUSED_RESULT;
+CURLcode curlx_dyn_add(struct dynbuf *s, const char *str)
+  WARN_UNUSED_RESULT;
+CURLcode curlx_dyn_addf(struct dynbuf *s, const char *fmt, ...)
+  WARN_UNUSED_RESULT CURL_PRINTF(2, 3);
+CURLcode curlx_dyn_vaddf(struct dynbuf *s, const char *fmt, va_list ap)
+  WARN_UNUSED_RESULT CURL_PRINTF(2, 0);
+void curlx_dyn_reset(struct dynbuf *s);
+CURLcode curlx_dyn_tail(struct dynbuf *s, size_t trail);
+CURLcode curlx_dyn_setlen(struct dynbuf *s, size_t set);
+char *curlx_dyn_ptr(const struct dynbuf *s);
+unsigned char *curlx_dyn_uptr(const struct dynbuf *s);
+size_t curlx_dyn_len(const struct dynbuf *s);
+
+/* returns 0 on success, -1 on error */
+/* The implementation of this function exists in mprintf.c */
+int curlx_dyn_vprintf(struct dynbuf *dyn, const char *format, va_list args);
+
+/* Take the buffer out of the dynbuf. Caller has ownership and
+ * dynbuf resets to initial state. */
+char *curlx_dyn_take(struct dynbuf *s, size_t *plen);
+
+/* Dynamic buffer max sizes */
+#define MAX_DYNBUF_SIZE (SIZE_MAX / 2)
+
+#define DYN_DOH_RESPONSE    3000
+#define DYN_DOH_CNAME       256
+#define DYN_PAUSE_BUFFER    (64 * 1024 * 1024)
+#define DYN_HAXPROXY        2048
+#define DYN_HTTP_REQUEST    (1024 * 1024)
+#define DYN_APRINTF         8000000
+#define DYN_RTSP_REQ_HEADER (64 * 1024)
+#define DYN_TRAILERS        (64 * 1024)
+#define DYN_PROXY_CONNECT_HEADERS 16384
+#define DYN_QLOG_NAME       1024
+#define DYN_H1_TRAILER      4096
+#define DYN_PINGPPONG_CMD   (64 * 1024)
+#define DYN_IMAP_CMD        (64 * 1024)
+#define DYN_MQTT_RECV       (64 * 1024)
+#define DYN_MQTT_SEND       0xFFFFFFF
+#define DYN_CRLFILE_SIZE    (400 * 1024 * 1024) /* 400MiB */
+#define DYN_CERTFILE_SIZE   (100 * 1024) /* 100KiB */
+#define DYN_KEYFILE_SIZE    (100 * 1024) /* 100KiB */
+#endif
diff --git a/third-party/curl/lib/curlx/fopen.c b/third-party/curl/lib/curlx/fopen.c
new file mode 100644
index 0000000000..37ca02671a
--- /dev/null
+++ b/third-party/curl/lib/curlx/fopen.c
@@ -0,0 +1,508 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "curlx/fopen.h"
+
+int curlx_fseek(void *stream, curl_off_t offset, int whence)
+{
+#ifdef _WIN32
+  return _fseeki64(stream, (__int64)offset, whence);
+#elif defined(HAVE_FSEEKO) && defined(HAVE_DECL_FSEEKO)
+  return fseeko(stream, (off_t)offset, whence);
+#else
+  if(offset > LONG_MAX)
+    return -1;
+  return fseek(stream, (long)offset, whence);
+#endif
+}
+
+#ifdef _WIN32
+
+#include <share.h>  /* for _SH_DENYNO */
+
+#include "curlx/multibyte.h"
+#include "curlx/timeval.h"
+
+#ifdef CURL_MEMDEBUG
+/*
+ * Use system allocators to avoid infinite recursion when called by curl's
+ * memory tracker memdebug functions.
+ */
+#define CURLX_MALLOC(x) malloc(x)
+#define CURLX_FREE(x)   free(x)
+#else
+#define CURLX_MALLOC(x) curlx_malloc(x)
+#define CURLX_FREE(x)   curlx_free(x)
+#endif
+
+#ifdef _UNICODE
+static wchar_t *fn_convert_UTF8_to_wchar(const char *str_utf8)
+{
+  wchar_t *str_w = NULL;
+
+  if(str_utf8) {
+    int str_w_len = MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS,
+                                        str_utf8, -1, NULL, 0);
+    if(str_w_len > 0) {
+      str_w = CURLX_MALLOC(str_w_len * sizeof(wchar_t));
+      if(str_w) {
+        if(MultiByteToWideChar(CP_UTF8, 0,
+                               str_utf8, -1, str_w, str_w_len) == 0) {
+          CURLX_FREE(str_w);
+          return NULL;
+        }
+      }
+    }
+  }
+  return str_w;
+}
+#endif
+
+/* declare GetFullPathNameW for mingw-w64 UWP builds targeting old Windows */
+#if defined(CURL_WINDOWS_UWP) && defined(__MINGW32__) && \
+  (_WIN32_WINNT < _WIN32_WINNT_WIN10)
+WINBASEAPI DWORD WINAPI GetFullPathNameW(LPCWSTR, DWORD, LPWSTR, LPWSTR *);
+#endif
+
+/* Fix excessive paths (paths that exceed MAX_PATH length of 260).
+ *
+ * This is a helper function to fix paths that would exceed the MAX_PATH
+ * limitation check done by Windows APIs. It does so by normalizing the passed
+ * in filename or path 'in' to its full canonical path, and if that path is
+ * longer than MAX_PATH then setting 'out' to "\\?\" prefix + that full path.
+ *
+ * For example 'in' filename255chars in current directory C:\foo\bar is
+ * fixed as \\?\C:\foo\bar\filename255chars for 'out' which tells Windows
+ * it is ok to access that filename even though the actual full path is longer
+ * than 260 chars.
+ *
+ * For non-Unicode builds this function may fail sometimes because only the
+ * Unicode versions of some Windows API functions can access paths longer than
+ * MAX_PATH, for example GetFullPathNameW which is used in this function. When
+ * the full path is then converted from Unicode to multibyte that fails if any
+ * directories in the path contain characters not in the current codepage.
+ */
+static bool fix_excessive_path(const TCHAR *in, TCHAR **out)
+{
+  size_t needed, count;
+  const wchar_t *in_w;
+  wchar_t *fbuf = NULL;
+
+  /* MS documented "approximate" limit for the maximum path length */
+  const size_t max_path_len = 32767;
+
+#ifndef _UNICODE
+  wchar_t *ibuf = NULL;
+  char *obuf = NULL;
+#endif
+
+  *out = NULL;
+
+  /* skip paths already normalized */
+  if(!_tcsncmp(in, _T("\\\\?\\"), 4))
+    goto cleanup;
+
+#ifndef _UNICODE
+  /* convert multibyte input to unicode */
+  if(mbstowcs_s(&needed, NULL, 0, in, 0))
+    goto cleanup;
+  if(!needed || needed >= max_path_len)
+    goto cleanup;
+  ibuf = CURLX_MALLOC(needed * sizeof(wchar_t));
+  if(!ibuf)
+    goto cleanup;
+  if(mbstowcs_s(&count, ibuf, needed, in, needed - 1))
+    goto cleanup;
+  if(count != needed)
+    goto cleanup;
+  in_w = ibuf;
+#else
+  in_w = in;
+#endif
+
+  /* GetFullPathNameW returns the normalized full path in unicode. It converts
+     forward slashes to backslashes, processes .. to remove directory segments,
+     etc. Unlike GetFullPathNameA it can process paths that exceed MAX_PATH. */
+  needed = (size_t)GetFullPathNameW(in_w, 0, NULL, NULL);
+  if(!needed || needed > max_path_len)
+    goto cleanup;
+  /* skip paths that are not excessive and do not need modification */
+  if(needed <= MAX_PATH)
+    goto cleanup;
+  fbuf = CURLX_MALLOC(needed * sizeof(wchar_t));
+  if(!fbuf)
+    goto cleanup;
+  count = (size_t)GetFullPathNameW(in_w, (DWORD)needed, fbuf, NULL);
+  if(!count || count >= needed)
+    goto cleanup;
+
+  /* prepend \\?\ or \\?\UNC\ to the excessively long path.
+   *
+   * c:\longpath            --->    \\?\c:\longpath
+   * \\.\c:\longpath        --->    \\?\c:\longpath
+   * \\?\c:\longpath        --->    \\?\c:\longpath  (unchanged)
+   * \\server\c$\longpath   --->    \\?\UNC\server\c$\longpath
+   *
+   * https://learn.microsoft.com/dotnet/standard/io/file-path-formats
+   */
+  if(!wcsncmp(fbuf, L"\\\\?\\", 4))
+    ; /* do nothing */
+  else if(!wcsncmp(fbuf, L"\\\\.\\", 4))
+    fbuf[2] = '?';
+  else if(!wcsncmp(fbuf, L"\\\\.", 3) || !wcsncmp(fbuf, L"\\\\?", 3)) {
+    /* Unexpected, not UNC. The formatting doc does not allow this AFAICT. */
+    goto cleanup;
+  }
+  else {
+    wchar_t *temp;
+
+    if(!wcsncmp(fbuf, L"\\\\", 2)) {
+      /* "\\?\UNC\" + full path without "\\" + null */
+      needed = 8 + (count - 2) + 1;
+      if(needed > max_path_len)
+        goto cleanup;
+
+      temp = CURLX_MALLOC(needed * sizeof(wchar_t));
+      if(!temp)
+        goto cleanup;
+
+      if(wcsncpy_s(temp, needed, L"\\\\?\\UNC\\", 8)) {
+        CURLX_FREE(temp);
+        goto cleanup;
+      }
+      if(wcscpy_s(temp + 8, needed, fbuf + 2)) {
+        CURLX_FREE(temp);
+        goto cleanup;
+      }
+    }
+    else {
+      /* "\\?\" + full path + null */
+      needed = 4 + count + 1;
+      if(needed > max_path_len)
+        goto cleanup;
+
+      temp = CURLX_MALLOC(needed * sizeof(wchar_t));
+      if(!temp)
+        goto cleanup;
+
+      if(wcsncpy_s(temp, needed, L"\\\\?\\", 4)) {
+        CURLX_FREE(temp);
+        goto cleanup;
+      }
+      if(wcscpy_s(temp + 4, needed, fbuf)) {
+        CURLX_FREE(temp);
+        goto cleanup;
+      }
+    }
+
+    CURLX_FREE(fbuf);
+    fbuf = temp;
+  }
+
+#ifndef _UNICODE
+  /* convert unicode full path to multibyte output */
+  if(wcstombs_s(&needed, NULL, 0, fbuf, 0))
+    goto cleanup;
+  if(!needed || needed >= max_path_len)
+    goto cleanup;
+  obuf = CURLX_MALLOC(needed);
+  if(!obuf)
+    goto cleanup;
+  if(wcstombs_s(&count, obuf, needed, fbuf, needed - 1))
+    goto cleanup;
+  if(count != needed)
+    goto cleanup;
+  *out = obuf;
+  obuf = NULL;
+#else
+  *out = fbuf;
+  fbuf = NULL;
+#endif
+
+cleanup:
+  CURLX_FREE(fbuf);
+#ifndef _UNICODE
+  CURLX_FREE(ibuf);
+  CURLX_FREE(obuf);
+#endif
+  return !!*out;
+}
+
+#ifndef CURL_WINDOWS_UWP
+HANDLE curlx_CreateFile(const char *filename,
+                        DWORD dwDesiredAccess,
+                        DWORD dwShareMode,
+                        LPSECURITY_ATTRIBUTES lpSecurityAttributes,
+                        DWORD dwCreationDisposition,
+                        DWORD dwFlagsAndAttributes,
+                        HANDLE hTemplateFile)
+{
+  HANDLE handle = INVALID_HANDLE_VALUE;
+
+#ifdef UNICODE
+  TCHAR *filename_t = curlx_convert_UTF8_to_wchar(filename);
+#else
+  const TCHAR *filename_t = filename;
+#endif
+
+  if(filename_t) {
+    TCHAR *fixed = NULL;
+    const TCHAR *target = NULL;
+
+    if(fix_excessive_path(filename_t, &fixed))
+      target = fixed;
+    else
+      target = filename_t;
+    /* !checksrc! disable BANNEDFUNC 1 */
+    handle = CreateFile(target,
+                        dwDesiredAccess,
+                        dwShareMode,
+                        lpSecurityAttributes,
+                        dwCreationDisposition,
+                        dwFlagsAndAttributes,
+                        hTemplateFile);
+    CURLX_FREE(fixed);
+#ifdef UNICODE
+    curlx_free(filename_t);
+#endif
+  }
+
+  return handle;
+}
+#endif /* !CURL_WINDOWS_UWP */
+
+int curlx_win32_open(const char *filename, int oflag, ...)
+{
+  int pmode = 0;
+  int res = -1;
+  TCHAR *fixed = NULL;
+  const TCHAR *target = NULL;
+
+#ifdef _UNICODE
+  wchar_t *filename_w = fn_convert_UTF8_to_wchar(filename);
+#endif
+
+  va_list param;
+  va_start(param, oflag);
+  if(oflag & O_CREAT)
+    pmode = va_arg(param, int);
+  va_end(param);
+
+#ifdef _UNICODE
+  if(filename_w) {
+    if(fix_excessive_path(filename_w, &fixed))
+      target = fixed;
+    else
+      target = filename_w;
+    errno = _wsopen_s(&res, target, oflag, _SH_DENYNO, pmode);
+    CURLX_FREE(filename_w);
+  }
+  else
+    /* !checksrc! disable ERRNOVAR 1 */
+    errno = EINVAL;
+#else
+  if(fix_excessive_path(filename, &fixed))
+    target = fixed;
+  else
+    target = filename;
+  errno = _sopen_s(&res, target, oflag, _SH_DENYNO, pmode);
+#endif
+
+  CURLX_FREE(fixed);
+  return res;
+}
+
+FILE *curlx_win32_fopen(const char *filename, const char *mode)
+{
+  FILE *file = NULL;
+  TCHAR *fixed = NULL;
+  const TCHAR *target = NULL;
+
+#ifdef _UNICODE
+  wchar_t *filename_w = fn_convert_UTF8_to_wchar(filename);
+  wchar_t *mode_w = fn_convert_UTF8_to_wchar(mode);
+  if(filename_w && mode_w) {
+    if(fix_excessive_path(filename_w, &fixed))
+      target = fixed;
+    else
+      target = filename_w;
+    file = _wfsopen(target, mode_w, _SH_DENYNO);
+  }
+  else
+    /* !checksrc! disable ERRNOVAR 1 */
+    errno = EINVAL;
+  CURLX_FREE(filename_w);
+  CURLX_FREE(mode_w);
+#else
+  if(fix_excessive_path(filename, &fixed))
+    target = fixed;
+  else
+    target = filename;
+  file = _fsopen(target, mode, _SH_DENYNO);
+#endif
+
+  CURLX_FREE(fixed);
+  return file;
+}
+
+#if defined(__MINGW32__) && (__MINGW64_VERSION_MAJOR < 5)
+_CRTIMP errno_t __cdecl freopen_s(FILE **file, const char *filename,
+                                  const char *mode, FILE *stream);
+#endif
+
+FILE *curlx_win32_freopen(const char *filename, const char *mode, FILE *fp)
+{
+  FILE *file = NULL;
+  TCHAR *fixed = NULL;
+  const TCHAR *target = NULL;
+
+#ifdef _UNICODE
+  wchar_t *filename_w = fn_convert_UTF8_to_wchar(filename);
+  wchar_t *mode_w = fn_convert_UTF8_to_wchar(mode);
+  if(filename_w && mode_w) {
+    if(fix_excessive_path(filename_w, &fixed))
+      target = fixed;
+    else
+      target = filename_w;
+    errno = _wfreopen_s(&file, target, mode_w, fp);
+  }
+  else
+    /* !checksrc! disable ERRNOVAR 1 */
+    errno = EINVAL;
+  CURLX_FREE(filename_w);
+  CURLX_FREE(mode_w);
+#else
+  if(fix_excessive_path(filename, &fixed))
+    target = fixed;
+  else
+    target = filename;
+  errno = freopen_s(&file, target, mode, fp);
+#endif
+
+  CURLX_FREE(fixed);
+  return file;
+}
+
+int curlx_win32_stat(const char *path, curlx_struct_stat *buffer)
+{
+  int res = -1;
+  TCHAR *fixed = NULL;
+  const TCHAR *target = NULL;
+
+#ifdef _UNICODE
+  wchar_t *path_w = curlx_convert_UTF8_to_wchar(path);
+  if(path_w) {
+    if(fix_excessive_path(path_w, &fixed))
+      target = fixed;
+    else
+      target = path_w;
+    res = _wstati64(target, buffer);
+    curlx_free(path_w);
+  }
+  else
+    /* !checksrc! disable ERRNOVAR 1 */
+    errno = EINVAL;
+#else
+  if(fix_excessive_path(path, &fixed))
+    target = fixed;
+  else
+    target = path;
+  res = _stati64(target, buffer);
+#endif
+
+  CURLX_FREE(fixed);
+  return res;
+}
+
+#if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_COOKIES) || \
+  !defined(CURL_DISABLE_ALTSVC)
+/* rename() on Windows does not overwrite, so we cannot use it here.
+   MoveFileEx() does overwrite and is usually atomic but fails when there are
+   open handles to the file. */
+int curlx_win32_rename(const char *oldpath, const char *newpath)
+{
+  int res = -1; /* fail */
+
+#ifdef UNICODE
+  TCHAR *tchar_oldpath = curlx_convert_UTF8_to_wchar(oldpath);
+  TCHAR *tchar_newpath = curlx_convert_UTF8_to_wchar(newpath);
+#else
+  const TCHAR *tchar_oldpath = oldpath;
+  const TCHAR *tchar_newpath = newpath;
+#endif
+
+  if(tchar_oldpath && tchar_newpath) {
+    const int max_wait_ms = 1000;
+    struct curltime start;
+
+    TCHAR *oldpath_fixed = NULL;
+    TCHAR *newpath_fixed = NULL;
+    const TCHAR *target_oldpath;
+    const TCHAR *target_newpath;
+
+    if(fix_excessive_path(tchar_oldpath, &oldpath_fixed))
+      target_oldpath = oldpath_fixed;
+    else
+      target_oldpath = tchar_oldpath;
+
+    if(fix_excessive_path(tchar_newpath, &newpath_fixed))
+      target_newpath = newpath_fixed;
+    else
+      target_newpath = tchar_newpath;
+
+    start = curlx_now();
+
+    for(;;) {
+      timediff_t diff;
+      /* !checksrc! disable BANNEDFUNC 1 */
+      if(MoveFileEx(target_oldpath, target_newpath,
+                    MOVEFILE_REPLACE_EXISTING)) {
+        res = 0; /* success */
+        break;
+      }
+      diff = curlx_timediff_ms(curlx_now(), start);
+      if(diff < 0 || diff > max_wait_ms) {
+        break;
+      }
+      Sleep(1);
+    }
+
+    CURLX_FREE(oldpath_fixed);
+    CURLX_FREE(newpath_fixed);
+  }
+
+#ifdef UNICODE
+  curlx_free(tchar_oldpath);
+  curlx_free(tchar_newpath);
+#endif
+
+  return res;
+}
+#endif
+
+#undef CURLX_MALLOC
+#undef CURLX_FREE
+
+#endif /* _WIN32 */
diff --git a/third-party/curl/lib/curlx/fopen.h b/third-party/curl/lib/curlx/fopen.h
new file mode 100644
index 0000000000..b64fbf6514
--- /dev/null
+++ b/third-party/curl/lib/curlx/fopen.h
@@ -0,0 +1,87 @@
+#ifndef HEADER_CURLX_FOPEN_H
+#define HEADER_CURLX_FOPEN_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "curlx/multibyte.h"
+
+#ifdef HAVE_FCNTL_H
+#include <fcntl.h>  /* for open() and attributes */
+#endif
+
+int curlx_fseek(void *stream, curl_off_t offset, int whence);
+
+#ifdef _WIN32
+#include <sys/stat.h>  /* for _fstati64(), struct _stati64 */
+#ifndef CURL_WINDOWS_UWP
+HANDLE curlx_CreateFile(const char *filename,
+                        DWORD dwDesiredAccess,
+                        DWORD dwShareMode,
+                        LPSECURITY_ATTRIBUTES lpSecurityAttributes,
+                        DWORD dwCreationDisposition,
+                        DWORD dwFlagsAndAttributes,
+                        HANDLE hTemplateFile);
+#endif /* !CURL_WINDOWS_UWP */
+#define curlx_fstat             _fstati64
+#define curlx_struct_stat       struct _stati64
+FILE *curlx_win32_fopen(const char *filename, const char *mode);
+FILE *curlx_win32_freopen(const char *filename, const char *mode, FILE *fp);
+int curlx_win32_stat(const char *path, curlx_struct_stat *buffer);
+int curlx_win32_open(const char *filename, int oflag, ...);
+int curlx_win32_rename(const char *oldpath, const char *newpath);
+#define CURLX_FOPEN_LOW         curlx_win32_fopen
+#define CURLX_FREOPEN_LOW       curlx_win32_freopen
+#define CURLX_FDOPEN_LOW        _fdopen
+#define curlx_stat              curlx_win32_stat
+#define curlx_open              curlx_win32_open
+#define curlx_close             _close
+#define curlx_rename            curlx_win32_rename
+#else
+#define curlx_fstat             fstat
+#define curlx_struct_stat       struct stat
+#define CURLX_FOPEN_LOW         fopen
+#define CURLX_FREOPEN_LOW       freopen
+#define CURLX_FDOPEN_LOW        fdopen
+#define curlx_stat              stat
+#define curlx_open              open
+#define curlx_close             close
+#define curlx_rename            rename
+#endif
+
+#ifdef CURL_MEMDEBUG
+#define curlx_fopen(file, mode) curl_dbg_fopen(file, mode, __LINE__, __FILE__)
+#define curlx_freopen(file, mode, fh) \
+  curl_dbg_freopen(file, mode, fh, __LINE__, __FILE__)
+#define curlx_fdopen(file, mode) \
+  curl_dbg_fdopen(file, mode, __LINE__, __FILE__)
+#define curlx_fclose(file)      curl_dbg_fclose(file, __LINE__, __FILE__)
+#else
+#define curlx_fopen             CURLX_FOPEN_LOW
+#define curlx_freopen           CURLX_FREOPEN_LOW
+#define curlx_fdopen            CURLX_FDOPEN_LOW
+#define curlx_fclose            fclose
+#endif
+
+#endif /* HEADER_CURLX_FOPEN_H */
diff --git a/third-party/curl/lib/curlx/inet_ntop.c b/third-party/curl/lib/curlx/inet_ntop.c
new file mode 100644
index 0000000000..803b9887ac
--- /dev/null
+++ b/third-party/curl/lib/curlx/inet_ntop.c
@@ -0,0 +1,222 @@
+/*
+ * Copyright (C) 1996-2022  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+ * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+ * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * SPDX-License-Identifier: ISC
+ */
+#include "curl_setup.h"
+
+#ifndef HAVE_INET_NTOP
+
+#ifdef HAVE_SYS_PARAM_H
+#include <sys/param.h>
+#endif
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+
+#include "curlx/inet_ntop.h"
+#include "curlx/snprintf.h"
+#include "curlx/strcopy.h"
+
+#define IN6ADDRSZ       16
+/* #define INADDRSZ         4 */
+#define INT16SZ          2
+
+/*
+ * If USE_IPV6 is disabled, we still want to parse IPv6 addresses, so make
+ * sure we have _some_ value for AF_INET6 without polluting our fake value
+ * everywhere.
+ */
+#if !defined(USE_IPV6) && !defined(AF_INET6)
+#define AF_INET6 (AF_INET + 1)
+#endif
+
+/*
+ * Format an IPv4 address, more or less like inet_ntop().
+ *
+ * Returns `dst' (as a const)
+ * Note:
+ *  - uses no static variables
+ *  - takes an unsigned char* not an in_addr as input
+ */
+static char *inet_ntop4(const unsigned char *src, char *dst, size_t size)
+{
+  char tmp[sizeof("255.255.255.255")];
+  size_t len;
+
+  DEBUGASSERT(size >= 16);
+
+  /* this snprintf() does not overflow the buffer. */
+  SNPRINTF(tmp, sizeof(tmp), "%d.%d.%d.%d",
+           ((int)((unsigned char)src[0])) & 0xff,
+           ((int)((unsigned char)src[1])) & 0xff,
+           ((int)((unsigned char)src[2])) & 0xff,
+           ((int)((unsigned char)src[3])) & 0xff);
+
+  len = strlen(tmp);
+  if(len == 0 || len >= size) {
+#ifdef USE_WINSOCK
+    errno = WSAEINVAL;
+#else
+    errno = ENOSPC;
+#endif
+    return NULL;
+  }
+  curlx_strcopy(dst, size, tmp, len);
+  return dst;
+}
+
+/*
+ * Convert IPv6 binary address into presentation (printable) format.
+ */
+static char *inet_ntop6(const unsigned char *src, char *dst, size_t size)
+{
+  /*
+   * Note that int32_t and int16_t need only be "at least" large enough
+   * to contain a value of the specified size. On some systems, like
+   * Crays, there is no such thing as an integer variable with 16 bits.
+   * Keep this in mind if you think this function should have been coded
+   * to use pointer overlays. All the world's not a VAX.
+   */
+  char tmp[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")];
+  char *tp;
+  struct {
+    int base;
+    int len;
+  } best, cur;
+  unsigned int words[IN6ADDRSZ / INT16SZ];
+  int i;
+
+  /* Preprocess:
+   *  Copy the input (bytewise) array into a wordwise array.
+   *  Find the longest run of 0x00's in src[] for :: shorthanding.
+   */
+  memset(words, '\0', sizeof(words));
+  for(i = 0; i < IN6ADDRSZ; i++)
+    words[i / 2] |= ((unsigned int)src[i] << ((1 - (i % 2)) << 3));
+
+  best.base = -1;
+  cur.base = -1;
+  best.len = 0;
+  cur.len = 0;
+
+  for(i = 0; i < (IN6ADDRSZ / INT16SZ); i++) {
+    if(words[i] == 0) {
+      if(cur.base == -1) {
+        cur.base = i;
+        cur.len = 1;
+      }
+      else
+        cur.len++;
+    }
+    else if(cur.base != -1) {
+      if(best.base == -1 || cur.len > best.len)
+        best = cur;
+      cur.base = -1;
+    }
+  }
+  if((cur.base != -1) && (best.base == -1 || cur.len > best.len))
+    best = cur;
+  if(best.base != -1 && best.len < 2)
+    best.base = -1;
+  /* Format the result. */
+  tp = tmp;
+  for(i = 0; i < (IN6ADDRSZ / INT16SZ); i++) {
+    /* Are we inside the best run of 0x00's? */
+    if(best.base != -1 && i >= best.base && i < (best.base + best.len)) {
+      if(i == best.base)
+        *tp++ = ':';
+      continue;
+    }
+
+    /* Are we following an initial run of 0x00s or any real hex?
+     */
+    if(i)
+      *tp++ = ':';
+
+    /* Is this address an encapsulated IPv4?
+     */
+    if(i == 6 && best.base == 0 &&
+       (best.len == 6 || (best.len == 5 && words[5] == 0xffff))) {
+      if(!inet_ntop4(src + 12, tp, sizeof(tmp) - (tp - tmp))) {
+        return NULL;
+      }
+      tp += strlen(tp);
+      break;
+    }
+    else {
+      /* Lower-case digits. Cannot use the set from mprintf.c since this
+         needs to work as a curlx function */
+      static const unsigned char ldigits[] = "0123456789abcdef";
+
+      unsigned int w = words[i];
+      /* output lowercase 16-bit hex number but ignore leading zeroes */
+      if(w & 0xf000)
+        *tp++ = ldigits[(w & 0xf000) >> 12];
+      if(w & 0xff00)
+        *tp++ = ldigits[(w & 0x0f00) >> 8];
+      if(w & 0xfff0)
+        *tp++ = ldigits[(w & 0x00f0) >> 4];
+      *tp++ = ldigits[(w & 0x000f)];
+    }
+  }
+
+  /* Was it a trailing run of 0x00's?
+   */
+  if(best.base != -1 && (best.base + best.len) == (IN6ADDRSZ / INT16SZ))
+    *tp++ = ':';
+
+  /* Check for overflow, copy, and we are done. */
+  if((size_t)(tp - tmp) >= size) {
+#ifdef USE_WINSOCK
+    errno = WSAEINVAL;
+#else
+    errno = ENOSPC;
+#endif
+    return NULL;
+  }
+
+  curlx_strcopy(dst, size, tmp, tp - tmp);
+  return dst;
+}
+
+/*
+ * Convert a network format address to presentation format.
+ *
+ * Returns pointer to presentation format address (`buf').
+ * Returns NULL on error and errno set with the specific
+ * error, EAFNOSUPPORT or ENOSPC.
+ *
+ * On Windows we store the error in the thread errno, not in the Winsock error
+ * code. This is to avoid losing the actual last Winsock error. When this
+ * function returns NULL, check errno not SOCKERRNO.
+ */
+char *curlx_inet_ntop(int af, const void *src, char *buf, size_t size)
+{
+  switch(af) {
+  case AF_INET:
+    return inet_ntop4((const unsigned char *)src, buf, size);
+  case AF_INET6:
+    return inet_ntop6((const unsigned char *)src, buf, size);
+  default:
+    errno = SOCKEAFNOSUPPORT;
+    return NULL;
+  }
+}
+#endif /* HAVE_INET_NTOP */
diff --git a/third-party/curl/lib/curlx/inet_ntop.h b/third-party/curl/lib/curlx/inet_ntop.h
new file mode 100644
index 0000000000..ba8299fe4e
--- /dev/null
+++ b/third-party/curl/lib/curlx/inet_ntop.h
@@ -0,0 +1,50 @@
+#ifndef HEADER_CURL_INET_NTOP_H
+#define HEADER_CURL_INET_NTOP_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef HAVE_INET_NTOP
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifndef _WIN32
+#include <sys/socket.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+#ifdef __AMIGA__
+#define curlx_inet_ntop(af, src, buf, size)                            \
+  (char *)inet_ntop(af, CURL_UNCONST(src), (unsigned char *)(buf),     \
+                    (curl_socklen_t)(size))
+#else
+#define curlx_inet_ntop(af, src, buf, size)                            \
+  inet_ntop(af, src, buf, (curl_socklen_t)(size))
+#endif
+#else
+char *curlx_inet_ntop(int af, const void *src, char *buf, size_t size);
+#endif /* HAVE_INET_NTOP */
+
+#endif /* HEADER_CURL_INET_NTOP_H */
diff --git a/third-party/curl/lib/curlx/inet_pton.c b/third-party/curl/lib/curlx/inet_pton.c
new file mode 100644
index 0000000000..7994f258fe
--- /dev/null
+++ b/third-party/curl/lib/curlx/inet_pton.c
@@ -0,0 +1,221 @@
+/* This is from the BIND 4.9.4 release, modified to compile by itself */
+
+/* Copyright (c) Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+ * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+ * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ *
+ * SPDX-License-Identifier: ISC
+ */
+#include "curl_setup.h"
+
+#ifndef HAVE_INET_PTON
+
+#ifdef HAVE_SYS_PARAM_H
+#include <sys/param.h>
+#endif
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+
+#include "curlx/inet_pton.h"
+#include "curlx/strparse.h"
+
+#define IN6ADDRSZ       16
+#define INADDRSZ         4
+#define INT16SZ          2
+
+/*
+ * If USE_IPV6 is disabled, we still want to parse IPv6 addresses, so make
+ * sure we have _some_ value for AF_INET6 without polluting our fake value
+ * everywhere.
+ */
+#if !defined(USE_IPV6) && !defined(AF_INET6)
+#define AF_INET6 (AF_INET + 1)
+#endif
+
+/*
+ * WARNING: Do not even consider trying to compile this on a system where
+ * sizeof(int) < 4. sizeof(int) > 4 is fine; all the world's not a VAX.
+ */
+
+/* int inet_pton4(src, dst)
+ *      like inet_aton() but without all the hexadecimal and shorthand.
+ * return:
+ *      1 if `src' is a valid dotted quad, else 0.
+ * notice:
+ *      does not touch `dst' unless it is returning 1.
+ * author:
+ *      Paul Vixie, 1996.
+ */
+static int inet_pton4(const char *src, unsigned char *dst)
+{
+  int saw_digit, octets, ch;
+  unsigned char tmp[INADDRSZ], *tp;
+
+  saw_digit = 0;
+  octets = 0;
+  tp = tmp;
+  *tp = 0;
+  while((ch = (unsigned char)*src++) != '\0') {
+    if(ISDIGIT(ch)) {
+      unsigned int val = (*tp * 10) + (ch - '0');
+
+      if(saw_digit && *tp == 0)
+        return 0;
+      if(val > 255)
+        return 0;
+      *tp = (unsigned char)val;
+      if(!saw_digit) {
+        if(++octets > 4)
+          return 0;
+        saw_digit = 1;
+      }
+    }
+    else if(ch == '.' && saw_digit) {
+      if(octets == 4)
+        return 0;
+      *++tp = 0;
+      saw_digit = 0;
+    }
+    else
+      return 0;
+  }
+  if(octets < 4)
+    return 0;
+  memcpy(dst, tmp, INADDRSZ);
+  return 1;
+}
+
+/* int inet_pton6(src, dst)
+ *      convert presentation level address to network order binary form.
+ * return:
+ *      1 if `src' is a valid [RFC1884 2.2] address, else 0.
+ * notice:
+ *      (1) does not touch `dst' unless it is returning 1.
+ *      (2) :: in a full address is silently ignored.
+ * credit:
+ *      inspired by Mark Andrews.
+ * author:
+ *      Paul Vixie, 1996.
+ */
+static int inet_pton6(const char *src, unsigned char *dst)
+{
+  unsigned char tmp[IN6ADDRSZ], *tp, *endp, *colonp;
+  const char *curtok;
+  int ch, saw_xdigit;
+  size_t val;
+
+  memset((tp = tmp), 0, IN6ADDRSZ);
+  endp = tp + IN6ADDRSZ;
+  colonp = NULL;
+  /* Leading :: requires some special handling. */
+  if(*src == ':')
+    if(*++src != ':')
+      return 0;
+  curtok = src;
+  saw_xdigit = 0;
+  val = 0;
+  while((ch = (unsigned char)*src++) != '\0') {
+    if(ISXDIGIT(ch)) {
+      val <<= 4;
+      val |= curlx_hexval(ch);
+      if(++saw_xdigit > 4)
+        return 0;
+      continue;
+    }
+    if(ch == ':') {
+      curtok = src;
+      if(!saw_xdigit) {
+        if(colonp)
+          return 0;
+        colonp = tp;
+        continue;
+      }
+      if(tp + INT16SZ > endp)
+        return 0;
+      *tp++ = (unsigned char)((val >> 8) & 0xff);
+      *tp++ = (unsigned char)(val & 0xff);
+      saw_xdigit = 0;
+      val = 0;
+      continue;
+    }
+    if(ch == '.' && ((tp + INADDRSZ) <= endp) &&
+       inet_pton4(curtok, tp) > 0) {
+      tp += INADDRSZ;
+      saw_xdigit = 0;
+      break;    /* '\0' was seen by inet_pton4(). */
+    }
+    return 0;
+  }
+  if(saw_xdigit) {
+    if(tp + INT16SZ > endp)
+      return 0;
+    *tp++ = (unsigned char)((val >> 8) & 0xff);
+    *tp++ = (unsigned char)(val & 0xff);
+  }
+  if(colonp) {
+    /*
+     * Since some memmove()'s erroneously fail to handle
+     * overlapping regions, we do the shift by hand.
+     */
+    const ssize_t n = tp - colonp;
+    ssize_t i;
+
+    if(tp == endp)
+      return 0;
+    for(i = 1; i <= n; i++) {
+      *(endp - i) = *(colonp + n - i);
+      *(colonp + n - i) = 0;
+    }
+    tp = endp;
+  }
+  if(tp != endp)
+    return 0;
+  memcpy(dst, tmp, IN6ADDRSZ);
+  return 1;
+}
+
+/* int inet_pton(af, src, dst)
+ *      convert from presentation format (which usually means ASCII printable)
+ *      to network format (which is usually some kind of binary format).
+ * return:
+ *      1 if the address was valid for the specified address family
+ *      0 if the address was not valid (`dst' is untouched in this case)
+ *      -1 if some other error occurred (`dst' is untouched in this case, too)
+ * notice:
+ *      On Windows we store the error in the thread errno, not
+ *      in the Winsock error code. This is to avoid losing the
+ *      actual last Winsock error. When this function returns
+ *      -1, check errno not SOCKERRNO.
+ * author:
+ *      Paul Vixie, 1996.
+ */
+int curlx_inet_pton(int af, const char *src, void *dst)
+{
+  switch(af) {
+  case AF_INET:
+    return inet_pton4(src, (unsigned char *)dst);
+  case AF_INET6:
+    return inet_pton6(src, (unsigned char *)dst);
+  default:
+    errno = SOCKEAFNOSUPPORT;
+    return -1;
+  }
+  /* NOTREACHED */
+}
+
+#endif /* HAVE_INET_PTON */
diff --git a/third-party/curl/lib/inet_pton.h b/third-party/curl/lib/curlx/inet_pton.h
similarity index 77%
rename from third-party/curl/lib/inet_pton.h
rename to third-party/curl/lib/curlx/inet_pton.h
index 82fde7e2eb..02ae7f2269 100644
--- a/third-party/curl/lib/inet_pton.h
+++ b/third-party/curl/lib/curlx/inet_pton.h
@@ -23,19 +23,27 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-int Curl_inet_pton(int, const char *, void *);
-
 #ifdef HAVE_INET_PTON
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifndef _WIN32
+#include <sys/socket.h>
+#endif
 #ifdef HAVE_ARPA_INET_H
 #include <arpa/inet.h>
-#elif defined(HAVE_WS2TCPIP_H)
-/* inet_pton() exists in Vista or later */
-#include <ws2tcpip.h>
 #endif
-#define Curl_inet_pton(x,y,z) inet_pton(x,y,z)
+#ifdef __AMIGA__
+#define curlx_inet_pton(x, y, z) \
+  inet_pton(x, (unsigned char *)CURL_UNCONST(y), z)
+#else
+#define curlx_inet_pton(x, y, z) \
+  inet_pton(x, y, z)
 #endif
+#else
+int curlx_inet_pton(int af, const char *src, void *dst);
+#endif /* HAVE_INET_PTON */
 
 #endif /* HEADER_CURL_INET_PTON_H */
diff --git a/third-party/curl/lib/curlx/multibyte.c b/third-party/curl/lib/curlx/multibyte.c
new file mode 100644
index 0000000000..715d2b8dc2
--- /dev/null
+++ b/third-party/curl/lib/curlx/multibyte.c
@@ -0,0 +1,78 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#if defined(_WIN32) && defined(UNICODE)
+
+#include "curlx/multibyte.h"
+
+/*
+ * MultiByte conversions using Windows kernel32 library.
+ */
+
+wchar_t *curlx_convert_UTF8_to_wchar(const char *str_utf8)
+{
+  wchar_t *str_w = NULL;
+
+  if(str_utf8) {
+    int str_w_len = MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS,
+                                        str_utf8, -1, NULL, 0);
+    if(str_w_len > 0) {
+      str_w = curlx_malloc(str_w_len * sizeof(wchar_t));
+      if(str_w) {
+        if(MultiByteToWideChar(CP_UTF8, 0, str_utf8, -1, str_w,
+                               str_w_len) == 0) {
+          curlx_free(str_w);
+          return NULL;
+        }
+      }
+    }
+  }
+
+  return str_w;
+}
+
+char *curlx_convert_wchar_to_UTF8(const wchar_t *str_w)
+{
+  char *str_utf8 = NULL;
+
+  if(str_w) {
+    int bytes = WideCharToMultiByte(CP_UTF8, 0, str_w, -1,
+                                    NULL, 0, NULL, NULL);
+    if(bytes > 0) {
+      str_utf8 = curlx_malloc(bytes);
+      if(str_utf8) {
+        if(WideCharToMultiByte(CP_UTF8, 0, str_w, -1, str_utf8, bytes,
+                               NULL, NULL) == 0) {
+          curlx_free(str_utf8);
+          return NULL;
+        }
+      }
+    }
+  }
+
+  return str_utf8;
+}
+
+#endif /* _WIN32 && UNICODE */
diff --git a/third-party/curl/lib/curlx/multibyte.h b/third-party/curl/lib/curlx/multibyte.h
new file mode 100644
index 0000000000..8863fb0249
--- /dev/null
+++ b/third-party/curl/lib/curlx/multibyte.h
@@ -0,0 +1,73 @@
+#ifndef HEADER_CURL_MULTIBYTE_H
+#define HEADER_CURL_MULTIBYTE_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef _WIN32
+
+/*
+ * Macros curlx_convert_UTF8_to_tchar(), curlx_convert_tchar_to_UTF8()
+ * main purpose is to minimize the number of preprocessor conditional
+ * directives needed by code using these to differentiate Unicode from
+ * non-Unicode builds.
+ *
+ * In the case of a non-Unicode build the tchar strings are char strings that
+ * are duplicated via strdup and remain in whatever the passed in encoding is,
+ * which is assumed to be UTF-8 but may be other encoding. Therefore the
+ * significance of the conversion functions is primarily for Unicode builds.
+ */
+
+#ifdef UNICODE
+
+/* MultiByte conversions using Windows kernel32 library. */
+wchar_t *curlx_convert_UTF8_to_wchar(const char *str_utf8);
+char *curlx_convert_wchar_to_UTF8(const wchar_t *str_w);
+
+#define curlx_convert_UTF8_to_tchar(ptr) curlx_convert_UTF8_to_wchar(ptr)
+#define curlx_convert_tchar_to_UTF8(ptr) curlx_convert_wchar_to_UTF8(ptr)
+
+typedef union {
+  unsigned short       *tchar_ptr;
+  const unsigned short *const_tchar_ptr;
+  unsigned short       *tbyte_ptr;
+  const unsigned short *const_tbyte_ptr;
+} xcharp_u;
+
+#else /* !UNICODE */
+
+#define curlx_convert_UTF8_to_tchar(ptr) curlx_strdup(ptr)
+#define curlx_convert_tchar_to_UTF8(ptr) curlx_strdup(ptr)
+
+typedef union {
+  char                *tchar_ptr;
+  const char          *const_tchar_ptr;
+  unsigned char       *tbyte_ptr;
+  const unsigned char *const_tbyte_ptr;
+} xcharp_u;
+
+#endif /* UNICODE */
+#endif /* _WIN32 */
+
+#endif /* HEADER_CURL_MULTIBYTE_H */
diff --git a/third-party/curl/lib/nonblock.c b/third-party/curl/lib/curlx/nonblock.c
similarity index 79%
rename from third-party/curl/lib/nonblock.c
rename to third-party/curl/lib/curlx/nonblock.c
index f4eb656128..6f6458f2b3 100644
--- a/third-party/curl/lib/nonblock.c
+++ b/third-party/curl/lib/curlx/nonblock.c
@@ -21,7 +21,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef HAVE_SYS_IOCTL_H
@@ -36,7 +35,7 @@
 #include <inet.h>
 #endif
 
-#include "nonblock.h"
+#include "curlx/nonblock.h"
 
 /*
  * curlx_nonblock() set the given socket to either blocking or non-blocking
@@ -46,17 +45,32 @@
 int curlx_nonblock(curl_socket_t sockfd,    /* operate on this */
                    int nonblock   /* TRUE or FALSE */)
 {
-#if defined(HAVE_FCNTL_O_NONBLOCK)
-  /* most recent unix versions */
+#ifdef HAVE_FCNTL_O_NONBLOCK
+  /* most recent Unix versions */
   int flags;
   flags = sfcntl(sockfd, F_GETFL, 0);
+  if(flags < 0)
+    return -1;
+  /* Check if the current file status flags have already satisfied
+   * the request, if so, it is no need to call fcntl() to replicate it.
+   */
+  if(!!(flags & O_NONBLOCK) == !!nonblock)
+    return 0;
   if(nonblock)
-    return sfcntl(sockfd, F_SETFL, flags | O_NONBLOCK);
-  return sfcntl(sockfd, F_SETFL, flags & (~O_NONBLOCK));
+    flags |= O_NONBLOCK;
+  else
+    flags &= ~O_NONBLOCK;
+  return sfcntl(sockfd, F_SETFL, flags);
+
+#elif defined(HAVE_IOCTLSOCKET_CAMEL_FIONBIO)
+
+  /* Amiga */
+  long flags = nonblock ? 1L : 0L;
+  return IoctlSocket(sockfd, FIONBIO, (char *)&flags);
 
 #elif defined(HAVE_IOCTL_FIONBIO)
 
-  /* older unix versions */
+  /* older Unix versions */
   int flags = nonblock ? 1 : 0;
   return ioctl(sockfd, FIONBIO, &flags);
 
@@ -64,13 +78,7 @@ int curlx_nonblock(curl_socket_t sockfd,    /* operate on this */
 
   /* Windows */
   unsigned long flags = nonblock ? 1UL : 0UL;
-  return ioctlsocket(sockfd, FIONBIO, &flags);
-
-#elif defined(HAVE_IOCTLSOCKET_CAMEL_FIONBIO)
-
-  /* Amiga */
-  long flags = nonblock ? 1L : 0L;
-  return IoctlSocket(sockfd, FIONBIO, (char *)&flags);
+  return ioctlsocket(sockfd, (long)FIONBIO, &flags);
 
 #elif defined(HAVE_SETSOCKOPT_SO_NONBLOCK)
 
@@ -79,6 +87,6 @@ int curlx_nonblock(curl_socket_t sockfd,    /* operate on this */
   return setsockopt(sockfd, SOL_SOCKET, SO_NONBLOCK, &b, sizeof(b));
 
 #else
-#  error "no non-blocking method was found/used/set"
+#error "no non-blocking method was found/used/set"
 #endif
 }
diff --git a/third-party/curl/lib/nonblock.h b/third-party/curl/lib/curlx/nonblock.h
similarity index 96%
rename from third-party/curl/lib/nonblock.h
rename to third-party/curl/lib/curlx/nonblock.h
index 4a1a6151f2..ee2cd286a7 100644
--- a/third-party/curl/lib/nonblock.h
+++ b/third-party/curl/lib/curlx/nonblock.h
@@ -24,8 +24,6 @@
  *
  ***************************************************************************/
 
-#include <curl/curl.h> /* for curl_socket_t */
-
 int curlx_nonblock(curl_socket_t sockfd,    /* operate on this */
                    int nonblock   /* TRUE or FALSE */);
 
diff --git a/third-party/curl/lib/curlx/snprintf.c b/third-party/curl/lib/curlx/snprintf.c
new file mode 100644
index 0000000000..911c42e6ad
--- /dev/null
+++ b/third-party/curl/lib/curlx/snprintf.c
@@ -0,0 +1,49 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curlx/snprintf.h"
+
+#ifdef _WIN32
+#include <stdarg.h>
+
+/* Simplified wrapper for the Windows platform to use the correct symbol and
+   ensuring null-termination. Omit returning a length to keep it simple. */
+void curlx_win32_snprintf(char *buf, size_t maxlen, const char *fmt, ...)
+{
+  va_list ap;
+  if(!maxlen)
+    return;
+  va_start(ap, fmt);
+#ifdef CURL_HAVE_DIAG
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wformat-nonliteral"
+#endif
+  /* !checksrc! disable BANNEDFUNC 1 */
+  (void)vsnprintf(buf, maxlen, fmt, ap);
+#ifdef CURL_HAVE_DIAG
+#pragma GCC diagnostic pop
+#endif
+  buf[maxlen - 1] = 0;
+  va_end(ap);
+}
+#endif /* _WIN32 */
diff --git a/third-party/curl/lib/curlx/snprintf.h b/third-party/curl/lib/curlx/snprintf.h
new file mode 100644
index 0000000000..d6260e4e39
--- /dev/null
+++ b/third-party/curl/lib/curlx/snprintf.h
@@ -0,0 +1,45 @@
+#ifndef HEADER_CURLX_SNPRINTF_H
+#define HEADER_CURLX_SNPRINTF_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+/* Raw snprintf() for curlx */
+
+#ifdef _WIN32
+void curlx_win32_snprintf(char *buf, size_t maxlen, const char *fmt, ...)
+  CURL_PRINTF(3, 4);
+#endif
+
+#ifdef WITHOUT_LIBCURL /* when built for the test servers */
+#ifdef _WIN32
+#define SNPRINTF curlx_win32_snprintf
+#else
+#define SNPRINTF snprintf
+#endif
+#else /* !WITHOUT_LIBCURL */
+#include <curl/mprintf.h>
+#define SNPRINTF curl_msnprintf
+#endif /* WITHOUT_LIBCURL */
+#endif /* HEADER_CURLX_SNPRINTF_H */
diff --git a/third-party/curl/lib/curlx/strcopy.c b/third-party/curl/lib/curlx/strcopy.c
new file mode 100644
index 0000000000..3b80930a19
--- /dev/null
+++ b/third-party/curl/lib/curlx/strcopy.c
@@ -0,0 +1,50 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "curlx/strcopy.h"
+
+/*
+ * curlx_strcopy() is a replacement for strcpy.
+ *
+ * Provide the target buffer @dest and size of the target buffer @dsize, If
+ * the source string @src with its *string length* @slen fits in the target
+ * buffer it is copied there - including storing a null-terminator.
+ *
+ * If the target buffer is too small, the copy is not performed but if the
+ * target buffer has a non-zero size it gets a null-terminator stored.
+ */
+void curlx_strcopy(char *dest,      /* destination buffer */
+                   size_t dsize,    /* size of target buffer */
+                   const char *src, /* source string */
+                   size_t slen)     /* length of source string to copy */
+{
+  DEBUGASSERT(slen < dsize);
+  if(slen < dsize) {
+    memcpy(dest, src, slen);
+    dest[slen] = 0;
+  }
+  else if(dsize)
+    dest[0] = 0;
+}
diff --git a/third-party/curl/lib/curlx/strcopy.h b/third-party/curl/lib/curlx/strcopy.h
new file mode 100644
index 0000000000..d671149cb8
--- /dev/null
+++ b/third-party/curl/lib/curlx/strcopy.h
@@ -0,0 +1,32 @@
+#ifndef HEADER_CURLX_STRCOPY_H
+#define HEADER_CURLX_STRCOPY_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+void curlx_strcopy(char *dest,
+                   size_t dsize, /* size of target buffer */
+                   const char *src,
+                   size_t slen); /* length of string to copy */
+
+#endif /* HEADER_CURLX_STRCOPY_H */
diff --git a/third-party/curl/lib/curlx/strdup.c b/third-party/curl/lib/curlx/strdup.c
new file mode 100644
index 0000000000..8e788ea34c
--- /dev/null
+++ b/third-party/curl/lib/curlx/strdup.c
@@ -0,0 +1,125 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef _WIN32
+#include <wchar.h>
+#endif
+
+#include "curlx/strdup.h"
+
+#ifdef _WIN32
+/***************************************************************************
+ *
+ * curlx_wcsdup(source)
+ *
+ * Copies the 'source' wchar string to a newly allocated buffer (that is
+ * returned). Used by macro curlx_tcsdup().
+ *
+ * Returns the new pointer or NULL on failure.
+ *
+ ***************************************************************************/
+wchar_t *curlx_wcsdup(const wchar_t *src)
+{
+  size_t length = wcslen(src);
+
+  if(length > (SIZE_MAX / sizeof(wchar_t)) - 1)
+    return (wchar_t *)NULL; /* integer overflow */
+
+  return (wchar_t *)curlx_memdup(src, (length + 1) * sizeof(wchar_t));
+}
+#endif
+
+/***************************************************************************
+ *
+ * curlx_memdup(source, length)
+ *
+ * Copies the 'source' data to a newly allocated buffer (that is
+ * returned). Copies 'length' bytes.
+ *
+ * Returns the new pointer or NULL on failure.
+ *
+ ***************************************************************************/
+void *curlx_memdup(const void *src, size_t length)
+{
+  void *buffer = curlx_malloc(length);
+  if(!buffer)
+    return NULL; /* fail */
+
+  memcpy(buffer, src, length);
+
+  return buffer;
+}
+
+/***************************************************************************
+ *
+ * curlx_memdup0(source, length)
+ *
+ * Copies the 'source' string to a newly allocated buffer (that is returned).
+ * Copies 'length' bytes then adds a null-terminator.
+ *
+ * Returns the new pointer or NULL on failure.
+ *
+ ***************************************************************************/
+void *curlx_memdup0(const char *src, size_t length)
+{
+  char *buf = (length < SIZE_MAX) ? curlx_malloc(length + 1) : NULL;
+  if(!buf)
+    return NULL;
+  if(length) {
+    DEBUGASSERT(src); /* must never be NULL */
+    memcpy(buf, src, length);
+  }
+  buf[length] = 0;
+  return buf;
+}
+
+#ifdef USE_CURLX_MEMZERO
+static void *(* const volatile p_curlx_memset)(void *buf, int val,
+                                               size_t size) = memset;
+
+/* Local fallback in case there is no system function to securely zero a memory
+   buffer. */
+void curlx_memzero(void *buf, size_t size)
+{
+  if(buf)
+    p_curlx_memset(buf, 0, size);
+}
+#endif
+
+/* Free 'buf' after zeroing its content. */
+void curlx_freezero(void *buf, size_t size)
+{
+  if(buf)
+    curlx_memzero(buf, size);
+  curlx_free(buf);
+}
+
+/* Free 'buf' after zeroing its content, where 'buf' is null-terminated. */
+void curlx_freezeroz(void *buf)
+{
+  if(buf)
+    curlx_memzero(buf, strlen(buf));
+  curlx_free(buf);
+}
diff --git a/third-party/curl/lib/strdup.h b/third-party/curl/lib/curlx/strdup.h
similarity index 77%
rename from third-party/curl/lib/strdup.h
rename to third-party/curl/lib/curlx/strdup.h
index c3430b54d5..0c4b14161e 100644
--- a/third-party/curl/lib/strdup.h
+++ b/third-party/curl/lib/curlx/strdup.h
@@ -1,5 +1,5 @@
-#ifndef HEADER_CURL_STRDUP_H
-#define HEADER_CURL_STRDUP_H
+#ifndef HEADER_CURLX_STRDUP_H
+#define HEADER_CURLX_STRDUP_H
 /***************************************************************************
  *                                  _   _ ____  _
  *  Project                     ___| | | |  _ \| |
@@ -25,13 +25,9 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
-#ifndef HAVE_STRDUP
-char *Curl_strdup(const char *str);
+#ifdef _WIN32
+wchar_t *curlx_wcsdup(const wchar_t *src);  /* for curlx_tcsdup() */
 #endif
-#ifdef WIN32
-wchar_t* Curl_wcsdup(const wchar_t* src);
-#endif
-void *Curl_memdup(const void *src, size_t buffer_length);
-void *Curl_saferealloc(void *ptr, size_t size);
-
-#endif /* HEADER_CURL_STRDUP_H */
+void *curlx_memdup(const void *src, size_t length);
+void *curlx_memdup0(const char *src, size_t length);
+#endif /* HEADER_CURLX_STRDUP_H */
diff --git a/third-party/curl/lib/curlx/strerr.c b/third-party/curl/lib/curlx/strerr.c
new file mode 100644
index 0000000000..8e906cc6bd
--- /dev/null
+++ b/third-party/curl/lib/curlx/strerr.c
@@ -0,0 +1,329 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef HAVE_STRERROR_R
+#  if (!defined(HAVE_POSIX_STRERROR_R) && \
+       !defined(HAVE_GLIBC_STRERROR_R)) || \
+      (defined(HAVE_POSIX_STRERROR_R) && defined(HAVE_GLIBC_STRERROR_R))
+#    error "strerror_r MUST be either POSIX, glibc style"
+#  endif
+#endif
+
+#include "curlx/winapi.h"
+#include "curlx/snprintf.h"
+#include "curlx/strerr.h"
+#include "curlx/strcopy.h"
+
+#ifdef USE_WINSOCK
+/* This is a helper function for curlx_strerror that converts Winsock error
+ * codes (WSAGetLastError) to error messages.
+ * Returns NULL if no error message was found for error code.
+ */
+static const char *get_winsock_error(int err, char *buf, size_t len)
+{
+  VERBOSE(const char *p);
+
+  if(!len)
+    return NULL;
+
+  *buf = '\0';
+
+#ifndef CURLVERBOSE
+  (void)err;
+  return NULL;
+#else
+  switch(err) {
+  case WSAEINTR:
+    p = "Call interrupted";
+    break;
+  case WSAEBADF:
+    p = "Bad file";
+    break;
+  case WSAEACCES:
+    p = "Bad access";
+    break;
+  case WSAEFAULT:
+    p = "Bad argument";
+    break;
+  case WSAEINVAL:
+    p = "Invalid arguments";
+    break;
+  case WSAEMFILE:
+    p = "Out of file descriptors";
+    break;
+  case WSAEWOULDBLOCK:
+    p = "Call would block";
+    break;
+  case WSAEINPROGRESS:
+  case WSAEALREADY:
+    p = "Blocking call in progress";
+    break;
+  case WSAENOTSOCK:
+    p = "Descriptor is not a socket";
+    break;
+  case WSAEDESTADDRREQ:
+    p = "Need destination address";
+    break;
+  case WSAEMSGSIZE:
+    p = "Bad message size";
+    break;
+  case WSAEPROTOTYPE:
+    p = "Bad protocol";
+    break;
+  case WSAENOPROTOOPT:
+    p = "Protocol option is unsupported";
+    break;
+  case WSAEPROTONOSUPPORT:
+    p = "Protocol is unsupported";
+    break;
+  case WSAESOCKTNOSUPPORT:
+    p = "Socket is unsupported";
+    break;
+  case WSAEOPNOTSUPP:
+    p = "Operation not supported";
+    break;
+  case WSAEAFNOSUPPORT:
+    p = "Address family not supported";
+    break;
+  case WSAEPFNOSUPPORT:
+    p = "Protocol family not supported";
+    break;
+  case WSAEADDRINUSE:
+    p = "Address already in use";
+    break;
+  case WSAEADDRNOTAVAIL:
+    p = "Address not available";
+    break;
+  case WSAENETDOWN:
+    p = "Network down";
+    break;
+  case WSAENETUNREACH:
+    p = "Network unreachable";
+    break;
+  case WSAENETRESET:
+    p = "Network has been reset";
+    break;
+  case WSAECONNABORTED:
+    p = "Connection was aborted";
+    break;
+  case WSAECONNRESET:
+    p = "Connection was reset";
+    break;
+  case WSAENOBUFS:
+    p = "No buffer space";
+    break;
+  case WSAEISCONN:
+    p = "Socket is already connected";
+    break;
+  case WSAENOTCONN:
+    p = "Socket is not connected";
+    break;
+  case WSAESHUTDOWN:
+    p = "Socket has been shut down";
+    break;
+  case WSAETOOMANYREFS:
+    p = "Too many references";
+    break;
+  case WSAETIMEDOUT:
+    p = "Timed out";
+    break;
+  case WSAECONNREFUSED:
+    p = "Connection refused";
+    break;
+  case WSAELOOP:
+    p = "Loop??";
+    break;
+  case WSAENAMETOOLONG:
+    p = "Name too long";
+    break;
+  case WSAEHOSTDOWN:
+    p = "Host down";
+    break;
+  case WSAEHOSTUNREACH:
+    p = "Host unreachable";
+    break;
+  case WSAENOTEMPTY:
+    p = "Not empty";
+    break;
+  case WSAEPROCLIM:
+    p = "Process limit reached";
+    break;
+  case WSAEUSERS:
+    p = "Too many users";
+    break;
+  case WSAEDQUOT:
+    p = "Bad quota";
+    break;
+  case WSAESTALE:
+    p = "Something is stale";
+    break;
+  case WSAEREMOTE:
+    p = "Remote error";
+    break;
+  case WSAEDISCON:
+    p = "Disconnected";
+    break;
+    /* Extended Winsock errors */
+  case WSASYSNOTREADY:
+    p = "Winsock library is not ready";
+    break;
+  case WSANOTINITIALISED:
+    p = "Winsock library not initialized";
+    break;
+  case WSAVERNOTSUPPORTED:
+    p = "Winsock version not supported";
+    break;
+
+    /* getXbyY() errors (already handled in herrmsg):
+     * Authoritative Answer: Host not found */
+  case WSAHOST_NOT_FOUND:
+    p = "Host not found";
+    break;
+
+    /* Non-Authoritative: Host not found, or SERVERFAIL */
+  case WSATRY_AGAIN:
+    p = "Host not found, try again";
+    break;
+
+    /* Non recoverable errors, FORMERR, REFUSED, NOTIMP */
+  case WSANO_RECOVERY:
+    p = "Unrecoverable error in call to nameserver";
+    break;
+
+    /* Valid name, no data record of requested type */
+  case WSANO_DATA:
+    p = "No data record of requested type";
+    break;
+
+  default:
+    return NULL;
+  }
+  curlx_strcopy(buf, len, p, strlen(p));
+  return buf;
+#endif
+}
+#endif /* USE_WINSOCK */
+
+/*
+ * Our thread-safe and smart strerror() replacement.
+ *
+ * The 'err' argument passed in to this function MUST be a true errno number
+ * as reported on this system. We do no range checking on the number before
+ * we pass it to the "number-to-message" conversion function and there might
+ * be systems that do not do proper range checking in there themselves.
+ *
+ * We do not do range checking (on systems other than Windows) since there is
+ * no good reliable and portable way to do it.
+ *
+ * On Windows different types of error codes overlap. This function has an
+ * order of preference when trying to match error codes:
+ * CRT (errno), Winsock (WSAGetLastError), Windows API (GetLastError).
+ *
+ * It may be more correct to call one of the variant functions instead:
+ * Call Curl_sspi_strerror if the error code is definitely Windows SSPI.
+ * Call curlx_winapi_strerror if the error code is definitely Windows API.
+ */
+const char *curlx_strerror(int err, char *buf, size_t buflen)
+{
+#ifdef _WIN32
+  DWORD old_win_err = GetLastError();
+#endif
+  int old_errno = errno;
+  char *p;
+
+  if(!buflen)
+    return NULL;
+
+#ifndef _WIN32
+  DEBUGASSERT(err >= 0);
+#endif
+
+  *buf = '\0';
+
+#ifdef _WIN32
+  if((strerror_s(buf, buflen, err) || !strcmp(buf, "Unknown error")) &&
+#ifdef USE_WINSOCK
+     !get_winsock_error(err, buf, buflen) &&
+#endif
+     !curlx_get_winapi_error((DWORD)err, buf, buflen))
+    SNPRINTF(buf, buflen, "Unknown error %d (%#x)", err, (unsigned int)err);
+#else /* !_WIN32 */
+
+#if defined(HAVE_STRERROR_R) && defined(HAVE_POSIX_STRERROR_R)
+  /*
+   * The POSIX-style strerror_r() may set errno to ERANGE if insufficient
+   * storage is supplied via 'strerrbuf' and 'buflen' to hold the generated
+   * message string, or EINVAL if 'errnum' is not a valid error number.
+   */
+  if(strerror_r(err, buf, buflen) &&
+     buflen > sizeof("Unknown error ") + 20) {
+    if(buf[0] == '\0')
+      SNPRINTF(buf, buflen, "Unknown error %d", err);
+  }
+#elif defined(HAVE_STRERROR_R) && defined(HAVE_GLIBC_STRERROR_R)
+  /*
+   * The glibc-style strerror_r() only *might* use the buffer we pass to
+   * the function, but it always returns the error message as a pointer,
+   * so we must copy that string unconditionally (if non-NULL).
+   */
+  {
+    char buffer[256];
+    const char *msg = strerror_r(err, buffer, sizeof(buffer));
+    if(msg && buflen > 1)
+      SNPRINTF(buf, buflen, "%s", msg);
+    else if(buflen > sizeof("Unknown error ") + 20)
+      SNPRINTF(buf, buflen, "Unknown error %d", err);
+  }
+#else
+  {
+    /* !checksrc! disable BANNEDFUNC 1 */
+    const char *msg = strerror(err);
+    if(msg && buflen > 1)
+      SNPRINTF(buf, buflen, "%s", msg);
+    else if(buflen > sizeof("Unknown error ") + 20)
+      SNPRINTF(buf, buflen, "Unknown error %d", err);
+  }
+#endif
+
+#endif /* _WIN32 */
+
+  /* strip trailing '\r\n' or '\n'. */
+  p = strrchr(buf, '\n');
+  if(p && (p - buf) >= 2)
+    *p = '\0';
+  p = strrchr(buf, '\r');
+  if(p && (p - buf) >= 1)
+    *p = '\0';
+
+  if(errno != old_errno)
+    errno = old_errno;
+
+#ifdef _WIN32
+  if(old_win_err != GetLastError())
+    SetLastError(old_win_err);
+#endif
+
+  return buf;
+}
diff --git a/third-party/curl/lib/curlx/strerr.h b/third-party/curl/lib/curlx/strerr.h
new file mode 100644
index 0000000000..4413e6738c
--- /dev/null
+++ b/third-party/curl/lib/curlx/strerr.h
@@ -0,0 +1,29 @@
+#ifndef HEADER_CURL_STRERR_H
+#define HEADER_CURL_STRERR_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+const char *curlx_strerror(int err, char *buf, size_t buflen);
+
+#endif /* HEADER_CURL_STRERR_H */
diff --git a/third-party/curl/lib/curlx/strparse.c b/third-party/curl/lib/curlx/strparse.c
new file mode 100644
index 0000000000..736f620504
--- /dev/null
+++ b/third-party/curl/lib/curlx/strparse.c
@@ -0,0 +1,317 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curlx/strparse.h"
+
+void curlx_str_init(struct Curl_str *out)
+{
+  out->str = NULL;
+  out->len = 0;
+}
+
+void curlx_str_assign(struct Curl_str *out, const char *str, size_t len)
+{
+  out->str = str;
+  out->len = len;
+}
+
+/* remove bytes from the end of the string, never remove more bytes than what
+   the string holds! */
+void curlx_str_trim(struct Curl_str *out, size_t len)
+{
+  DEBUGASSERT(out);
+  DEBUGASSERT(out->len >= len);
+  out->len -= len;
+}
+
+/* Get a word until the first DELIM or end of string. At least one byte long.
+   return non-zero on error. If 'max' is zero, it will always return error. */
+int curlx_str_until(const char **linep, struct Curl_str *out,
+                    const size_t max, char delim)
+{
+  const char *s;
+  size_t len = 0;
+  DEBUGASSERT(linep);
+  DEBUGASSERT(*linep);
+  DEBUGASSERT(out);
+  DEBUGASSERT(delim);
+  s = *linep;
+
+  curlx_str_init(out);
+  while(*s && (*s != delim)) {
+    s++;
+    if(++len > max) {
+      return STRE_BIG;
+    }
+  }
+  if(!len)
+    return STRE_SHORT;
+  out->str = *linep;
+  out->len = len;
+  *linep = s; /* point to the first byte after the word */
+  return STRE_OK;
+}
+
+/* Get a word until the first space or end of string. At least one byte long.
+   return non-zero on error */
+int curlx_str_word(const char **linep, struct Curl_str *out, const size_t max)
+{
+  return curlx_str_until(linep, out, max, ' ');
+}
+
+/* Get a word until a newline byte or end of string. At least one byte long.
+   return non-zero on error */
+int curlx_str_untilnl(const char **linep, struct Curl_str *out,
+                      const size_t max)
+{
+  const char *s = *linep;
+  size_t len = 0;
+  DEBUGASSERT(linep && *linep && out && max);
+
+  curlx_str_init(out);
+  while(*s && !ISNEWLINE(*s)) {
+    s++;
+    if(++len > max)
+      return STRE_BIG;
+  }
+  if(!len)
+    return STRE_SHORT;
+  out->str = *linep;
+  out->len = len;
+  *linep = s; /* point to the first byte after the word */
+  return STRE_OK;
+}
+
+/* Get a "quoted" word. Escaped quotes are supported.
+   return non-zero on error */
+int curlx_str_quotedword(const char **linep, struct Curl_str *out,
+                         const size_t max)
+{
+  const char *s = *linep;
+  size_t len = 0;
+  DEBUGASSERT(linep && *linep && out && max);
+
+  curlx_str_init(out);
+  if(*s != '\"')
+    return STRE_BEGQUOTE;
+  s++;
+  while(*s && (*s != '\"')) {
+    if(*s == '\\' && s[1]) {
+      s++;
+      if(++len > max)
+        return STRE_BIG;
+    }
+    s++;
+    if(++len > max)
+      return STRE_BIG;
+  }
+  if(*s != '\"')
+    return STRE_ENDQUOTE;
+  out->str = (*linep) + 1;
+  out->len = len;
+  *linep = s + 1;
+  return STRE_OK;
+}
+
+/* Advance over a single character.
+   return non-zero on error */
+int curlx_str_single(const char **linep, char byte)
+{
+  DEBUGASSERT(linep && *linep);
+  if(**linep != byte)
+    return STRE_BYTE;
+  (*linep)++; /* move over it */
+  return STRE_OK;
+}
+
+/* Advance over a single space.
+   return non-zero on error */
+int curlx_str_singlespace(const char **linep)
+{
+  return curlx_str_single(linep, ' ');
+}
+
+/* given an ASCII character and max ascii, return TRUE if valid */
+#define valid_digit(x, m) \
+  (((x) >= '0') && ((x) <= (m)) && curlx_hexasciitable[(x) - '0'])
+
+/* We use 16 for the zero index (and the necessary bitwise AND in the loop)
+   to be able to have a non-zero value there to make valid_digit() able to
+   use the info */
+const unsigned char curlx_hexasciitable[] = {
+  16, 1, 2, 3, 4, 5, 6, 7, 8, 9, /* 0x30: 0 - 9 */
+  0, 0, 0, 0, 0, 0, 0,
+  10, 11, 12, 13, 14, 15,        /* 0x41: A - F */
+  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+  10, 11, 12, 13, 14, 15         /* 0x61: a - f */
+};
+
+/* no support for 0x prefix nor leading spaces */
+static int str_num_base(const char **linep, curl_off_t *nump, curl_off_t max,
+                        int base) /* 8, 10 or 16, nothing else */
+{
+  curl_off_t num = 0;
+  const char *p;
+  int m = (base == 10) ? '9' :   /* the largest digit possible */
+    (base == 16) ? 'f' : '7';
+  DEBUGASSERT(linep && *linep && nump);
+  DEBUGASSERT((base == 8) || (base == 10) || (base == 16));
+  DEBUGASSERT(max >= 0); /* mostly to catch SIZE_MAX, which is too large */
+  *nump = 0;
+  p = *linep;
+  if(!valid_digit(*p, m))
+    return STRE_NO_NUM;
+  if(max < base) {
+    /* special-case low max scenario because check needs to be different */
+    do {
+      int n = curlx_hexval(*p++);
+      num = (num * base) + n;
+      if(num > max)
+        return STRE_OVERFLOW;
+    } while(valid_digit(*p, m));
+  }
+  else {
+    do {
+      int n = curlx_hexval(*p++);
+      if(num > ((max - n) / base))
+        return STRE_OVERFLOW;
+      num = (num * base) + n;
+    } while(valid_digit(*p, m));
+  }
+  *nump = num;
+  *linep = p;
+  return STRE_OK;
+}
+
+/* Get an unsigned decimal number with no leading space or minus. Leading
+   zeroes are accepted. return non-zero on error */
+int curlx_str_number(const char **linep, curl_off_t *nump, curl_off_t max)
+{
+  return str_num_base(linep, nump, max, 10);
+}
+
+/* Get an unsigned hexadecimal number with no leading space or minus and no
+   "0x" support. Leading zeroes are accepted. return non-zero on error */
+int curlx_str_hex(const char **linep, curl_off_t *nump, curl_off_t max)
+{
+  return str_num_base(linep, nump, max, 16);
+}
+
+/* Get an unsigned octal number with no leading space or minus and no "0"
+   prefix support. Leading zeroes are accepted. return non-zero on error */
+int curlx_str_octal(const char **linep, curl_off_t *nump, curl_off_t max)
+{
+  return str_num_base(linep, nump, max, 8);
+}
+
+/*
+ * Parse a positive number up to 63-bit number written in ASCII. Skip leading
+ * blanks. No support for prefixes.
+ */
+int curlx_str_numblanks(const char **str, curl_off_t *num)
+{
+  curlx_str_passblanks(str);
+  return curlx_str_number(str, num, CURL_OFF_T_MAX);
+}
+
+/* CR or LF
+   return non-zero on error */
+int curlx_str_newline(const char **linep)
+{
+  DEBUGASSERT(linep && *linep);
+  if(ISNEWLINE(**linep)) {
+    (*linep)++;
+    return STRE_OK; /* yessir */
+  }
+  return STRE_NEWLINE;
+}
+
+#ifndef WITHOUT_LIBCURL
+/* case insensitive compare that the parsed string matches the given string.
+   Returns non-zero on match. */
+int curlx_str_casecompare(struct Curl_str *str, const char *check)
+{
+  size_t clen = check ? strlen(check) : 0;
+  return ((str->len == clen) && curl_strnequal(str->str, check, clen));
+}
+#endif
+
+/* case sensitive string compare. Returns non-zero on match. */
+int curlx_str_cmp(struct Curl_str *str, const char *check)
+{
+  if(check) {
+    size_t clen = strlen(check);
+    return ((str->len == clen) && !strncmp(str->str, check, clen));
+  }
+  return !!(str->len);
+}
+
+/* Trim off 'num' number of bytes from the beginning (left side) of the
+   string. If 'num' is larger than the string, return error. */
+int curlx_str_nudge(struct Curl_str *str, size_t num)
+{
+  if(num <= str->len) {
+    str->str += num;
+    str->len -= num;
+    return STRE_OK;
+  }
+  return STRE_OVERFLOW;
+}
+
+/* Get the following character sequence that consists only of bytes not
+   present in the 'reject' string. Like strcspn(). */
+int curlx_str_cspn(const char **linep, struct Curl_str *out,
+                   const char *reject)
+{
+  const char *s = *linep;
+  size_t len;
+  DEBUGASSERT(linep && *linep);
+
+  len = strcspn(s, reject);
+  if(len) {
+    out->str = s;
+    out->len = len;
+    *linep = &s[len];
+    return STRE_OK;
+  }
+  curlx_str_init(out);
+  return STRE_SHORT;
+}
+
+/* remove ISBLANK()s from both ends of the string */
+void curlx_str_trimblanks(struct Curl_str *out)
+{
+  while(out->len && ISBLANK(*out->str))
+    curlx_str_nudge(out, 1);
+
+  /* trim trailing spaces and tabs */
+  while(out->len && ISBLANK(out->str[out->len - 1]))
+    out->len--;
+}
+
+/* increase the pointer until it has moved over all blanks */
+void curlx_str_passblanks(const char **linep)
+{
+  while(ISBLANK(**linep))
+    (*linep)++; /* move over it */
+}
diff --git a/third-party/curl/lib/curlx/strparse.h b/third-party/curl/lib/curlx/strparse.h
new file mode 100644
index 0000000000..c7801b2cb3
--- /dev/null
+++ b/third-party/curl/lib/curlx/strparse.h
@@ -0,0 +1,114 @@
+#ifndef HEADER_CURL_STRPARSE_H
+#define HEADER_CURL_STRPARSE_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#define STRE_OK       0
+#define STRE_BIG      1
+#define STRE_SHORT    2
+#define STRE_BEGQUOTE 3
+#define STRE_ENDQUOTE 4
+#define STRE_BYTE     5
+#define STRE_NEWLINE  6
+#define STRE_OVERFLOW 7
+#define STRE_NO_NUM   8
+
+/* public struct, but all accesses should be done using the provided
+   functions */
+struct Curl_str {
+  const char *str;
+  size_t len;
+};
+
+void curlx_str_init(struct Curl_str *out);
+void curlx_str_assign(struct Curl_str *out, const char *str, size_t len);
+void curlx_str_trim(struct Curl_str *out, size_t len);
+
+#define curlx_str(x)    ((x)->str)
+#define curlx_strlen(x) ((x)->len)
+
+/* Get a word until the first space
+   return non-zero on error */
+int curlx_str_word(const char **linep, struct Curl_str *out, const size_t max);
+
+/* Get a word until the first DELIM or end of string
+   return non-zero on error */
+int curlx_str_until(const char **linep, struct Curl_str *out, const size_t max,
+                    char delim);
+
+/* Get a word until a newline byte or end of string. At least one byte long.
+   return non-zero on error */
+int curlx_str_untilnl(const char **linep, struct Curl_str *out,
+                      const size_t max);
+
+/* Get a "quoted" word. Escaped quotes are supported.
+   return non-zero on error */
+int curlx_str_quotedword(const char **linep, struct Curl_str *out,
+                         const size_t max);
+
+/* Advance over a single character.
+   return non-zero on error */
+int curlx_str_single(const char **linep, char byte);
+
+/* Advance over a single space.
+   return non-zero on error */
+int curlx_str_singlespace(const char **linep);
+
+/* Get an unsigned decimal number. Return non-zero on error */
+int curlx_str_number(const char **linep, curl_off_t *nump, curl_off_t max);
+
+/* As above with CURL_OFF_T_MAX but also pass leading blanks */
+int curlx_str_numblanks(const char **str, curl_off_t *num);
+
+/* Get an unsigned hexadecimal number. Return non-zero on error */
+int curlx_str_hex(const char **linep, curl_off_t *nump, curl_off_t max);
+
+/* Get an unsigned octal number. Return non-zero on error */
+int curlx_str_octal(const char **linep, curl_off_t *nump, curl_off_t max);
+
+/* Check for CR or LF
+   return non-zero on error */
+int curlx_str_newline(const char **linep);
+
+/* case insensitive compare that the parsed string matches the
+   given string. */
+int curlx_str_casecompare(struct Curl_str *str, const char *check);
+int curlx_str_cmp(struct Curl_str *str, const char *check);
+
+int curlx_str_nudge(struct Curl_str *str, size_t num);
+
+int curlx_str_cspn(const char **linep, struct Curl_str *out,
+                   const char *reject);
+void curlx_str_trimblanks(struct Curl_str *out);
+void curlx_str_passblanks(const char **linep);
+
+/* given a hexadecimal letter, return the binary value. '0' returns 0, 'a'
+   returns 10. THIS ONLY WORKS ON VALID HEXADECIMAL LETTER INPUT. Verify
+   before calling this!
+*/
+extern const unsigned char curlx_hexasciitable[];
+#define curlx_hexval(x) (unsigned char)(curlx_hexasciitable[(x) - '0'] & 0x0f)
+
+#endif /* HEADER_CURL_STRPARSE_H */
diff --git a/third-party/curl/lib/timediff.c b/third-party/curl/lib/curlx/timediff.c
similarity index 91%
rename from third-party/curl/lib/timediff.c
rename to third-party/curl/lib/curlx/timediff.c
index 1b762bbd3e..2bf786941d 100644
--- a/third-party/curl/lib/timediff.c
+++ b/third-party/curl/lib/curlx/timediff.c
@@ -21,10 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
-#include "timediff.h"
-
-#include <limits.h>
+#include "curlx/timediff.h"
 
 /*
  * Converts number of milliseconds into a timeval structure.
@@ -44,7 +41,7 @@ struct timeval *curlx_mstotv(struct timeval *tv, timediff_t ms)
 
   if(ms > 0) {
     timediff_t tv_sec = ms / 1000;
-    timediff_t tv_usec = (ms % 1000) * 1000; /* max=999999 */
+    timediff_t tv_usec = (ms % 1000) * 1000; /* max=999000 */
 #ifdef HAVE_SUSECONDS_T
 #if TIMEDIFF_T_MAX > TIME_T_MAX
     /* tv_sec overflow check in case time_t is signed */
@@ -53,7 +50,7 @@ struct timeval *curlx_mstotv(struct timeval *tv, timediff_t ms)
 #endif
     tv->tv_sec = (time_t)tv_sec;
     tv->tv_usec = (suseconds_t)tv_usec;
-#elif defined(WIN32) /* maybe also others in the future */
+#elif defined(_WIN32) /* maybe also others in the future */
 #if TIMEDIFF_T_MAX > LONG_MAX
     /* tv_sec overflow check on Windows there we know it is long */
     if(tv_sec > LONG_MAX)
@@ -84,5 +81,5 @@ struct timeval *curlx_mstotv(struct timeval *tv, timediff_t ms)
  */
 timediff_t curlx_tvtoms(struct timeval *tv)
 {
-  return (tv->tv_sec*1000) + (timediff_t)(((double)tv->tv_usec)/1000.0);
+  return (tv->tv_sec * 1000) + (timediff_t)(tv->tv_usec / 1000);
 }
diff --git a/third-party/curl/lib/timediff.h b/third-party/curl/lib/curlx/timediff.h
similarity index 93%
rename from third-party/curl/lib/timediff.h
rename to third-party/curl/lib/curlx/timediff.h
index fb318d4f2b..1081c75d1c 100644
--- a/third-party/curl/lib/timediff.h
+++ b/third-party/curl/lib/curlx/timediff.h
@@ -23,13 +23,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-/* Use a larger type even for 32 bit time_t systems so that we can keep
+/* Use a larger type even for 32-bit time_t systems so that we can keep
    microsecond accuracy in it */
 typedef curl_off_t timediff_t;
-#define CURL_FORMAT_TIMEDIFF_T CURL_FORMAT_CURL_OFF_T
+#define FMT_TIMEDIFF_T FMT_OFF_T
 
 #define TIMEDIFF_T_MAX CURL_OFF_T_MAX
 #define TIMEDIFF_T_MIN CURL_OFF_T_MIN
diff --git a/third-party/curl/lib/curlx/timeval.c b/third-party/curl/lib/curlx/timeval.c
new file mode 100644
index 0000000000..2363e60839
--- /dev/null
+++ b/third-party/curl/lib/curlx/timeval.c
@@ -0,0 +1,273 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curlx/timeval.h"
+
+#ifdef _WIN32
+
+#include "system_win32.h"
+
+LARGE_INTEGER Curl_freq;
+
+/* For tool or tests, we must initialize before calling curlx_now().
+   Providing this function here is wrong. */
+void curlx_now_init(void)
+{
+  QueryPerformanceFrequency(&Curl_freq);
+}
+
+/* In case of bug fix this function has a counterpart in tool_util.c */
+void curlx_pnow(struct curltime *pnow)
+{
+  LARGE_INTEGER count;
+  DEBUGASSERT(Curl_freq.QuadPart);
+  QueryPerformanceCounter(&count);
+  pnow->tv_sec = (time_t)(count.QuadPart / Curl_freq.QuadPart);
+  pnow->tv_usec = (int)((count.QuadPart % Curl_freq.QuadPart) * 1000000 /
+                        Curl_freq.QuadPart);
+}
+
+#elif defined(HAVE_CLOCK_GETTIME_MONOTONIC) || \
+  defined(HAVE_CLOCK_GETTIME_MONOTONIC_RAW)
+
+void curlx_pnow(struct curltime *pnow)
+{
+  /*
+   * clock_gettime() is granted to be increased monotonically when the
+   * monotonic clock is queried. Time starting point is unspecified, it
+   * could be the system start-up time, the Epoch, or something else,
+   * in any case the time starting point does not change once that the
+   * system has started up.
+   */
+  struct timespec tsnow;
+
+  /*
+   * clock_gettime() may be defined by Apple's SDK as weak symbol thus
+   * code compiles but fails during runtime if clock_gettime() is
+   * called on unsupported OS version.
+   */
+#if defined(__APPLE__) && defined(HAVE_BUILTIN_AVAILABLE) && \
+  (HAVE_BUILTIN_AVAILABLE == 1)
+  bool have_clock_gettime = FALSE;
+  if(__builtin_available(macOS 10.12, iOS 10, tvOS 10, watchOS 3, *))
+    have_clock_gettime = TRUE;
+#endif
+
+#ifdef HAVE_CLOCK_GETTIME_MONOTONIC_RAW
+  if(
+#if defined(__APPLE__) && defined(HAVE_BUILTIN_AVAILABLE) && \
+  (HAVE_BUILTIN_AVAILABLE == 1)
+    have_clock_gettime &&
+#endif
+    (clock_gettime(CLOCK_MONOTONIC_RAW, &tsnow) == 0)) {
+    pnow->tv_sec = tsnow.tv_sec;
+    pnow->tv_usec = (int)(tsnow.tv_nsec / 1000);
+  }
+  else
+#endif
+
+  if(
+#if defined(__APPLE__) && defined(HAVE_BUILTIN_AVAILABLE) && \
+  (HAVE_BUILTIN_AVAILABLE == 1)
+    have_clock_gettime &&
+#endif
+    (clock_gettime(CLOCK_MONOTONIC, &tsnow) == 0)) {
+    pnow->tv_sec = tsnow.tv_sec;
+    pnow->tv_usec = (int)(tsnow.tv_nsec / 1000);
+  }
+  /*
+   * Even when the configure process has truly detected monotonic clock
+   * availability, it might happen that it is not actually available at
+   * runtime. When this occurs, fallback to other time source.
+   */
+#ifdef HAVE_GETTIMEOFDAY
+  else {
+    struct timeval now;
+    (void)gettimeofday(&now, NULL);
+    pnow->tv_sec = now.tv_sec;
+    pnow->tv_usec = (int)now.tv_usec;
+  }
+#else
+  else {
+    pnow->tv_sec = time(NULL);
+    pnow->tv_usec = 0;
+  }
+#endif
+}
+
+#elif defined(HAVE_MACH_ABSOLUTE_TIME)
+
+#include <mach/mach_time.h>
+
+void curlx_pnow(struct curltime *pnow)
+{
+  /*
+   * Monotonic timer on macOS is provided by mach_absolute_time(), which
+   * returns time in Mach "absolute time units," which are platform-dependent.
+   * To convert to nanoseconds, one must use conversion factors specified by
+   * mach_timebase_info().
+   */
+  static mach_timebase_info_data_t timebase;
+  uint64_t usecs;
+
+  if(timebase.denom == 0)
+    (void)mach_timebase_info(&timebase);
+
+  usecs = mach_absolute_time();
+  usecs *= timebase.numer; /* spellchecker:disable-line */
+  usecs /= timebase.denom;
+  usecs /= 1000;
+
+  pnow->tv_sec = usecs / 1000000;
+  pnow->tv_usec = (int)(usecs % 1000000);
+}
+
+#elif defined(HAVE_GETTIMEOFDAY)
+
+void curlx_pnow(struct curltime *pnow)
+{
+  /*
+   * gettimeofday() is not granted to be increased monotonically, due to
+   * clock drifting and external source time synchronization it can jump
+   * forward or backward in time.
+   */
+  struct timeval now;
+  (void)gettimeofday(&now, NULL);
+  pnow->tv_sec = now.tv_sec;
+  pnow->tv_usec = (int)now.tv_usec;
+}
+
+#else
+
+void curlx_pnow(struct curltime *pnow)
+{
+  /*
+   * time() returns the value of time in seconds since the Epoch.
+   */
+  pnow->tv_sec = time(NULL);
+  pnow->tv_usec = 0;
+  if(!pnow->tv_sec) /* avoid a `now` fully zero */
+    pnow->tv_usec = 1;
+}
+
+#endif
+
+struct curltime curlx_now(void)
+{
+  struct curltime now;
+  curlx_pnow(&now);
+  return now;
+}
+
+/*
+ * Returns: time difference in number of milliseconds. For too large diffs it
+ * returns max value.
+ *
+ * @unittest: 1323
+ */
+timediff_t curlx_ptimediff_ms(const struct curltime *newer,
+                              const struct curltime *older)
+{
+  timediff_t diff = (timediff_t)newer->tv_sec - older->tv_sec;
+  if(diff >= (TIMEDIFF_T_MAX / 1000))
+    return TIMEDIFF_T_MAX;
+  else if(diff <= (TIMEDIFF_T_MIN / 1000))
+    return TIMEDIFF_T_MIN;
+  return (diff * 1000) + ((newer->tv_usec - older->tv_usec) / 1000);
+}
+
+timediff_t curlx_timediff_ms(struct curltime newer, struct curltime older)
+{
+  return curlx_ptimediff_ms(&newer, &older);
+}
+
+/*
+ * Returns: time difference in number of milliseconds, rounded up.
+ * For too large diffs it returns max value.
+ */
+timediff_t curlx_timediff_ceil_ms(struct curltime newer,
+                                  struct curltime older)
+{
+  timediff_t diff = (timediff_t)newer.tv_sec - older.tv_sec;
+  if(diff >= (TIMEDIFF_T_MAX / 1000))
+    return TIMEDIFF_T_MAX;
+  else if(diff <= (TIMEDIFF_T_MIN / 1000))
+    return TIMEDIFF_T_MIN;
+  return (diff * 1000) + ((newer.tv_usec - older.tv_usec + 999) / 1000);
+}
+
+/*
+ * Returns: time difference in number of microseconds. For too large diffs it
+ * returns max value.
+ */
+timediff_t curlx_ptimediff_us(const struct curltime *newer,
+                              const struct curltime *older)
+{
+  timediff_t diff = (timediff_t)newer->tv_sec - older->tv_sec;
+  if(diff >= (TIMEDIFF_T_MAX / 1000000))
+    return TIMEDIFF_T_MAX;
+  else if(diff <= (TIMEDIFF_T_MIN / 1000000))
+    return TIMEDIFF_T_MIN;
+  return (diff * 1000000) + newer->tv_usec - older->tv_usec;
+}
+
+timediff_t curlx_timediff_us(struct curltime newer, struct curltime older)
+{
+  return curlx_ptimediff_us(&newer, &older);
+}
+
+#if defined(__MINGW32__) && (__MINGW64_VERSION_MAJOR <= 3)
+#include <sec_api/time_s.h>  /* for _gmtime32_s(), _gmtime64_s() */
+#ifdef _USE_32BIT_TIME_T
+#define gmtime_s _gmtime32_s
+#else
+#define gmtime_s _gmtime64_s
+#endif
+#endif
+
+/*
+ * curlx_gmtime() is a gmtime() replacement for portability. Do not use
+ * the gmtime_s(), gmtime_r() or gmtime() functions anywhere else but here.
+ */
+CURLcode curlx_gmtime(time_t intime, struct tm *store)
+{
+#ifdef _WIN32
+  if(gmtime_s(store, &intime)) /* thread-safe */
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+#elif defined(HAVE_GMTIME_R)
+  const struct tm *tm;
+  tm = gmtime_r(&intime, store); /* thread-safe */
+  if(!tm)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+#else
+  const struct tm *tm;
+  /* !checksrc! disable BANNEDFUNC 1 */
+  tm = gmtime(&intime); /* not thread-safe */
+  if(tm)
+    *store = *tm; /* copy the pointed struct to the local copy */
+  else
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+#endif
+
+  return CURLE_OK;
+}
diff --git a/third-party/curl/lib/curlx/timeval.h b/third-party/curl/lib/curlx/timeval.h
new file mode 100644
index 0000000000..c01f95d87d
--- /dev/null
+++ b/third-party/curl/lib/curlx/timeval.h
@@ -0,0 +1,74 @@
+#ifndef HEADER_CURL_TIMEVAL_H
+#define HEADER_CURL_TIMEVAL_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "curlx/timediff.h"
+
+struct curltime {
+  time_t tv_sec; /* seconds */
+  int tv_usec;   /* microseconds */
+};
+
+#ifdef _WIN32
+/* For tool or tests, we must initialize before calling curlx_now() */
+void curlx_now_init(void);
+#endif
+
+struct curltime curlx_now(void);
+void curlx_pnow(struct curltime *pnow);
+
+/*
+ * Make sure that the first argument (newer) is the more recent time and older
+ * is the older time, as otherwise you get a weird negative time-diff back...
+ *
+ * Returns: the time difference in number of milliseconds.
+ */
+timediff_t curlx_timediff_ms(struct curltime newer, struct curltime older);
+timediff_t curlx_ptimediff_ms(const struct curltime *newer,
+                              const struct curltime *older);
+
+/*
+ * Make sure that the first argument (newer) is the more recent time and older
+ * is the older time, as otherwise you get a weird negative time-diff back...
+ *
+ * Returns: the time difference in number of milliseconds, rounded up.
+ */
+timediff_t curlx_timediff_ceil_ms(struct curltime newer,
+                                  struct curltime older);
+
+/*
+ * Make sure that the first argument (newer) is the more recent time and older
+ * is the older time, as otherwise you get a weird negative time-diff back...
+ *
+ * Returns: the time difference in number of microseconds.
+ */
+timediff_t curlx_timediff_us(struct curltime newer, struct curltime older);
+timediff_t curlx_ptimediff_us(const struct curltime *newer,
+                              const struct curltime *older);
+
+CURLcode curlx_gmtime(time_t intime, struct tm *store);
+
+#endif /* HEADER_CURL_TIMEVAL_H */
diff --git a/third-party/curl/lib/curlx/version_win32.c b/third-party/curl/lib/curlx/version_win32.c
new file mode 100644
index 0000000000..296a38d924
--- /dev/null
+++ b/third-party/curl/lib/curlx/version_win32.c
@@ -0,0 +1,238 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Steve Holme, <steve_holme@hotmail.com>.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef _WIN32
+
+#include "curlx/version_win32.h"
+
+#ifndef CURL_WINDOWS_UWP
+/* This Unicode version struct works for VerifyVersionInfoW (OSVERSIONINFOEXW)
+   and RtlVerifyVersionInfo (RTLOSVERSIONINFOEXW) */
+struct OUR_OSVERSIONINFOEXW {
+  ULONG  dwOSVersionInfoSize;
+  ULONG  dwMajorVersion;
+  ULONG  dwMinorVersion;
+  ULONG  dwBuildNumber;
+  ULONG  dwPlatformId;
+  WCHAR  szCSDVersion[128];
+  USHORT wServicePackMajor;
+  USHORT wServicePackMinor;
+  USHORT wSuiteMask;
+  UCHAR  wProductType;
+  UCHAR  wReserved;
+};
+
+typedef LONG (APIENTRY *RTLVERIFYVERSIONINFO_FN)
+  (struct OUR_OSVERSIONINFOEXW *, ULONG, ULONGLONG);
+static RTLVERIFYVERSIONINFO_FN s_pRtlVerifyVersionInfo;
+
+void curlx_verify_windows_init(void)
+{
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wcast-function-type-strict"
+#endif
+  s_pRtlVerifyVersionInfo = CURLX_FUNCTION_CAST(RTLVERIFYVERSIONINFO_FN,
+    GetProcAddress(GetModuleHandle(TEXT("ntdll")), "RtlVerifyVersionInfo"));
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic pop
+#endif
+}
+#endif /* !CURL_WINDOWS_UWP */
+
+/*
+ * curlx_verify_windows_version()
+ *
+ * This is used to verify if we are running on a specific Windows version.
+ *
+ * Parameters:
+ *
+ * majorVersion [in] - The major version number.
+ * minorVersion [in] - The minor version number.
+ * buildVersion [in] - The build version number. If 0, this parameter is
+ *                     ignored.
+ * platform     [in] - The optional platform identifier.
+ * condition    [in] - The test condition used to specifier whether we are
+ *                     checking a version less than, equal to or greater than
+ *                     what is specified in the major and minor version
+ *                     numbers.
+ *
+ * Returns TRUE if matched; otherwise FALSE.
+ */
+bool curlx_verify_windows_version(const unsigned int majorVersion,
+                                  const unsigned int minorVersion,
+                                  const unsigned int buildVersion,
+                                  const PlatformIdentifier platform,
+                                  const VersionCondition condition)
+{
+  bool matched = FALSE;
+
+#ifdef CURL_WINDOWS_UWP
+  /* We have no way to determine the Windows version from Windows apps,
+     so let's assume we are running on the target Windows version. */
+  const WORD fullVersion = MAKEWORD(minorVersion, majorVersion);
+  const WORD targetVersion = (WORD)_WIN32_WINNT;
+
+  (void)buildVersion;
+
+  switch(condition) {
+  case VERSION_LESS_THAN:
+    matched = targetVersion < fullVersion;
+    break;
+
+  case VERSION_LESS_THAN_EQUAL:
+    matched = targetVersion <= fullVersion;
+    break;
+
+  case VERSION_EQUAL:
+    matched = targetVersion == fullVersion;
+    break;
+
+  case VERSION_GREATER_THAN_EQUAL:
+    matched = targetVersion >= fullVersion;
+    break;
+
+  case VERSION_GREATER_THAN:
+    matched = targetVersion > fullVersion;
+    break;
+  }
+
+  if(matched && (platform == PLATFORM_WINDOWS)) {
+    /* we are always running on PLATFORM_WINNT */
+    matched = FALSE;
+  }
+#else
+  ULONGLONG cm = 0;
+  struct OUR_OSVERSIONINFOEXW osver;
+  BYTE majorCondition;
+  BYTE minorCondition;
+  BYTE buildCondition;
+  BYTE spMajorCondition;
+  BYTE spMinorCondition;
+  DWORD dwTypeMask = VER_MAJORVERSION | VER_MINORVERSION |
+                     VER_SERVICEPACKMAJOR | VER_SERVICEPACKMINOR;
+
+  switch(condition) {
+  case VERSION_LESS_THAN:
+    majorCondition = VER_LESS;
+    minorCondition = VER_LESS;
+    buildCondition = VER_LESS;
+    spMajorCondition = VER_LESS_EQUAL;
+    spMinorCondition = VER_LESS_EQUAL;
+    break;
+
+  case VERSION_LESS_THAN_EQUAL:
+    majorCondition = VER_LESS_EQUAL;
+    minorCondition = VER_LESS_EQUAL;
+    buildCondition = VER_LESS_EQUAL;
+    spMajorCondition = VER_LESS_EQUAL;
+    spMinorCondition = VER_LESS_EQUAL;
+    break;
+
+  case VERSION_EQUAL:
+    majorCondition = VER_EQUAL;
+    minorCondition = VER_EQUAL;
+    buildCondition = VER_EQUAL;
+    spMajorCondition = VER_GREATER_EQUAL;
+    spMinorCondition = VER_GREATER_EQUAL;
+    break;
+
+  case VERSION_GREATER_THAN_EQUAL:
+    majorCondition = VER_GREATER_EQUAL;
+    minorCondition = VER_GREATER_EQUAL;
+    buildCondition = VER_GREATER_EQUAL;
+    spMajorCondition = VER_GREATER_EQUAL;
+    spMinorCondition = VER_GREATER_EQUAL;
+    break;
+
+  case VERSION_GREATER_THAN:
+    majorCondition = VER_GREATER;
+    minorCondition = VER_GREATER;
+    buildCondition = VER_GREATER;
+    spMajorCondition = VER_GREATER_EQUAL;
+    spMinorCondition = VER_GREATER_EQUAL;
+    break;
+
+  default:
+    return FALSE;
+  }
+
+  memset(&osver, 0, sizeof(osver));
+  osver.dwOSVersionInfoSize = sizeof(osver);
+  osver.dwMajorVersion = majorVersion;
+  osver.dwMinorVersion = minorVersion;
+  osver.dwBuildNumber = buildVersion;
+  if(platform == PLATFORM_WINDOWS)
+    osver.dwPlatformId = VER_PLATFORM_WIN32_WINDOWS;
+  else if(platform == PLATFORM_WINNT)
+    osver.dwPlatformId = VER_PLATFORM_WIN32_NT;
+
+  cm = VerSetConditionMask(cm, VER_MAJORVERSION, majorCondition);
+  cm = VerSetConditionMask(cm, VER_MINORVERSION, minorCondition);
+  cm = VerSetConditionMask(cm, VER_SERVICEPACKMAJOR, spMajorCondition);
+  cm = VerSetConditionMask(cm, VER_SERVICEPACKMINOR, spMinorCondition);
+
+  if(platform != PLATFORM_DONT_CARE) {
+    cm = VerSetConditionMask(cm, VER_PLATFORMID, VER_EQUAL);
+    dwTypeMask |= VER_PLATFORMID;
+  }
+
+  /* Later versions of Windows have version functions that may not return the
+     real version of Windows unless the application is so manifested. We prefer
+     the real version always, so we use the Rtl variant of the function when
+     possible. Note though the function signatures have underlying fundamental
+     types that are the same, the return values are different. */
+  if(s_pRtlVerifyVersionInfo)
+    matched = !s_pRtlVerifyVersionInfo(&osver, dwTypeMask, cm);
+  else
+    matched = !!VerifyVersionInfoW((OSVERSIONINFOEXW *)&osver, dwTypeMask, cm);
+
+  /* Compare the build number separately. VerifyVersionInfo normally compares
+     major.minor in hierarchical order (eg 1.9 is less than 2.0) but does not
+     do the same for build (eg 1.9 build 222 is not less than 2.0 build 111).
+     Build comparison is only needed when build numbers are equal (eg 1.9 is
+     always less than 2.0 so build comparison is not needed). */
+  if(matched && buildVersion &&
+     (condition == VERSION_EQUAL ||
+      ((condition == VERSION_GREATER_THAN_EQUAL ||
+        condition == VERSION_LESS_THAN_EQUAL) &&
+        curlx_verify_windows_version(majorVersion, minorVersion, 0,
+                                     platform, VERSION_EQUAL)))) {
+
+    cm = VerSetConditionMask(0, VER_BUILDNUMBER, buildCondition);
+    dwTypeMask = VER_BUILDNUMBER;
+    if(s_pRtlVerifyVersionInfo)
+      matched = !s_pRtlVerifyVersionInfo(&osver, dwTypeMask, cm);
+    else
+      matched = !!VerifyVersionInfoW((OSVERSIONINFOEXW *)&osver,
+                                     dwTypeMask, cm);
+  }
+
+#endif
+
+  return matched;
+}
+
+#endif /* _WIN32 */
diff --git a/third-party/curl/lib/version_win32.h b/third-party/curl/lib/curlx/version_win32.h
similarity index 89%
rename from third-party/curl/lib/version_win32.h
rename to third-party/curl/lib/curlx/version_win32.h
index 3899174a31..c4a1c0f758 100644
--- a/third-party/curl/lib/version_win32.h
+++ b/third-party/curl/lib/curlx/version_win32.h
@@ -23,10 +23,9 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#if defined(WIN32)
+#ifdef _WIN32
 
 /* Version condition */
 typedef enum {
@@ -44,13 +43,18 @@ typedef enum {
   PLATFORM_WINNT
 } PlatformIdentifier;
 
-/* This is used to verify if we are running on a specific windows version */
+#ifdef CURL_WINDOWS_UWP
+#define curlx_verify_windows_init() Curl_nop_stmt
+#else
+void curlx_verify_windows_init(void);
+#endif
+/* This is used to verify if we are running on a specific Windows version */
 bool curlx_verify_windows_version(const unsigned int majorVersion,
                                   const unsigned int minorVersion,
                                   const unsigned int buildVersion,
                                   const PlatformIdentifier platform,
                                   const VersionCondition condition);
 
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
 #endif /* HEADER_CURL_VERSION_WIN32_H */
diff --git a/third-party/curl/lib/curlx/wait.c b/third-party/curl/lib/curlx/wait.c
new file mode 100644
index 0000000000..e50a0f0af6
--- /dev/null
+++ b/third-party/curl/lib/curlx/wait.c
@@ -0,0 +1,94 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifndef HAVE_SELECT
+#error "We cannot compile without select() support."
+#endif
+
+#ifdef HAVE_SYS_SELECT_H
+#include <sys/select.h>
+#elif defined(HAVE_UNISTD_H)
+#include <unistd.h>
+#endif
+
+#ifdef MSDOS
+#include <dos.h>  /* delay() */
+#endif
+
+#include "curlx/timediff.h"
+#include "curlx/wait.h"
+
+/*
+ * Internal function used for waiting a specific amount of ms in
+ * Curl_socket_check() and Curl_poll() when no file descriptor is provided to
+ * wait on, being used to delay execution. Winsock select() and poll() timeout
+ * mechanisms need a valid socket descriptor in a not null file descriptor set
+ * to work. Waiting indefinitely with this function is not allowed, a zero or
+ * negative timeout value is returned immediately. Timeout resolution,
+ * accuracy, as well as maximum supported value is system dependent, neither
+ * factor is a critical issue for the intended use of this function in the
+ * library.
+ *
+ * Return values:
+ *   -1 = system call error, or invalid timeout value
+ *    0 = specified timeout has elapsed, or interrupted
+ */
+int curlx_wait_ms(timediff_t timeout_ms)
+{
+  int r = 0;
+
+  if(!timeout_ms)
+    return 0;
+  if(timeout_ms < 0) {
+    SET_SOCKERRNO(SOCKEINVAL);
+    return -1;
+  }
+#ifdef MSDOS
+  delay((unsigned int)timeout_ms);
+#elif defined(_WIN32)
+  /* prevent overflow, timeout_ms is typecast to ULONG/DWORD. */
+#if TIMEDIFF_T_MAX >= ULONG_MAX
+  if(timeout_ms >= ULONG_MAX)
+    timeout_ms = ULONG_MAX - 1;
+    /* do not use ULONG_MAX, because that is equal to INFINITE */
+#endif
+  Sleep((DWORD)timeout_ms);
+#else
+  /* avoid using poll() for this since it behaves incorrectly with no sockets
+     on Apple operating systems */
+  {
+    struct timeval pending_tv;
+    r = select(0, NULL, NULL, NULL, curlx_mstotv(&pending_tv, timeout_ms));
+  }
+#endif /* _WIN32 */
+  if(r) {
+    if((r == -1) && (SOCKERRNO == SOCKEINTR))
+      /* make EINTR from select or poll not a "lethal" error */
+      r = 0;
+    else
+      r = -1;
+  }
+  return r;
+}
diff --git a/third-party/curl/lib/curlx/wait.h b/third-party/curl/lib/curlx/wait.h
new file mode 100644
index 0000000000..9b9c27386e
--- /dev/null
+++ b/third-party/curl/lib/curlx/wait.h
@@ -0,0 +1,30 @@
+#ifndef HEADER_CURL_WAIT_H
+#define HEADER_CURL_WAIT_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+int curlx_wait_ms(timediff_t timeout_ms);
+
+#endif /* HEADER_CURL_WAIT_H */
diff --git a/third-party/curl/lib/curlx/warnless.c b/third-party/curl/lib/curlx/warnless.c
new file mode 100644
index 0000000000..5fc36ac9a8
--- /dev/null
+++ b/third-party/curl/lib/curlx/warnless.c
@@ -0,0 +1,341 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "curlx/warnless.h"
+
+#if defined(__INTEL_COMPILER) && defined(__unix__)
+
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+
+#endif /* __INTEL_COMPILER && __unix__ */
+
+#define CURL_MASK_UCHAR   ((unsigned char)~0)
+
+#define CURL_MASK_USHORT  ((unsigned short)~0)
+
+#define CURL_MASK_UINT    ((unsigned int)~0)
+#define CURL_MASK_SINT    (CURL_MASK_UINT >> 1)
+
+#define CURL_MASK_ULONG   ((unsigned long)~0)
+
+#define CURL_MASK_USIZE_T ((size_t)~0)
+#define CURL_MASK_SSIZE_T (CURL_MASK_USIZE_T >> 1)
+
+/*
+ * unsigned long to unsigned char
+ */
+unsigned char curlx_ultouc(unsigned long ulnum)
+{
+#ifdef __INTEL_COMPILER
+#pragma warning(push)
+#pragma warning(disable:810) /* conversion may lose significant bits */
+#endif
+
+  DEBUGASSERT(ulnum <= (unsigned long)CURL_MASK_UCHAR);
+  return (unsigned char)(ulnum & (unsigned long)CURL_MASK_UCHAR);
+
+#ifdef __INTEL_COMPILER
+#pragma warning(pop)
+#endif
+}
+
+/*
+ * unsigned size_t to signed int
+ */
+int curlx_uztosi(size_t uznum)
+{
+#ifdef __INTEL_COMPILER
+#pragma warning(push)
+#pragma warning(disable:810) /* conversion may lose significant bits */
+#endif
+
+  DEBUGASSERT(uznum <= (size_t)CURL_MASK_SINT);
+  return (int)(uznum & (size_t)CURL_MASK_SINT);
+
+#ifdef __INTEL_COMPILER
+#pragma warning(pop)
+#endif
+}
+
+/*
+ * unsigned size_t to unsigned long
+ */
+unsigned long curlx_uztoul(size_t uznum)
+{
+#ifdef __INTEL_COMPILER
+#pragma warning(push)
+#pragma warning(disable:810) /* conversion may lose significant bits */
+#endif
+
+#if ULONG_MAX < SIZE_MAX
+  DEBUGASSERT(uznum <= (size_t)CURL_MASK_ULONG);
+#endif
+  return (unsigned long)(uznum & (size_t)CURL_MASK_ULONG);
+
+#ifdef __INTEL_COMPILER
+#pragma warning(pop)
+#endif
+}
+
+/*
+ * unsigned size_t to unsigned int
+ */
+unsigned int curlx_uztoui(size_t uznum)
+{
+#ifdef __INTEL_COMPILER
+#pragma warning(push)
+#pragma warning(disable:810) /* conversion may lose significant bits */
+#endif
+
+#if UINT_MAX < SIZE_MAX
+  DEBUGASSERT(uznum <= (size_t)CURL_MASK_UINT);
+#endif
+  return (unsigned int)(uznum & (size_t)CURL_MASK_UINT);
+
+#ifdef __INTEL_COMPILER
+#pragma warning(pop)
+#endif
+}
+
+/*
+ * signed long to signed int
+ */
+int curlx_sltosi(long slnum)
+{
+#ifdef __INTEL_COMPILER
+#pragma warning(push)
+#pragma warning(disable:810) /* conversion may lose significant bits */
+#endif
+
+  DEBUGASSERT(slnum >= 0);
+#if INT_MAX < LONG_MAX
+  DEBUGASSERT((unsigned long)slnum <= (unsigned long)CURL_MASK_SINT);
+#endif
+  return (int)(slnum & (long)CURL_MASK_SINT);
+
+#ifdef __INTEL_COMPILER
+#pragma warning(pop)
+#endif
+}
+
+/*
+ * signed long to unsigned int
+ */
+unsigned int curlx_sltoui(long slnum)
+{
+#ifdef __INTEL_COMPILER
+#pragma warning(push)
+#pragma warning(disable:810) /* conversion may lose significant bits */
+#endif
+
+  DEBUGASSERT(slnum >= 0);
+#if UINT_MAX < LONG_MAX
+  DEBUGASSERT((unsigned long)slnum <= (unsigned long)CURL_MASK_UINT);
+#endif
+  return (unsigned int)(slnum & (long)CURL_MASK_UINT);
+
+#ifdef __INTEL_COMPILER
+#pragma warning(pop)
+#endif
+}
+
+/*
+ * signed long to unsigned short
+ */
+unsigned short curlx_sltous(long slnum)
+{
+#ifdef __INTEL_COMPILER
+#pragma warning(push)
+#pragma warning(disable:810) /* conversion may lose significant bits */
+#endif
+
+  DEBUGASSERT(slnum >= 0);
+  DEBUGASSERT((unsigned long)slnum <= (unsigned long)CURL_MASK_USHORT);
+  return (unsigned short)(slnum & (long)CURL_MASK_USHORT);
+
+#ifdef __INTEL_COMPILER
+#pragma warning(pop)
+#endif
+}
+
+/*
+ * unsigned size_t to signed ssize_t
+ */
+ssize_t curlx_uztosz(size_t uznum)
+{
+#ifdef __INTEL_COMPILER
+#pragma warning(push)
+#pragma warning(disable:810) /* conversion may lose significant bits */
+#endif
+
+  DEBUGASSERT(uznum <= (size_t)CURL_MASK_SSIZE_T);
+  return (ssize_t)(uznum & (size_t)CURL_MASK_SSIZE_T);
+
+#ifdef __INTEL_COMPILER
+#pragma warning(pop)
+#endif
+}
+
+/*
+ * signed curl_off_t to unsigned size_t
+ */
+size_t curlx_sotouz(curl_off_t sonum)
+{
+#ifdef __INTEL_COMPILER
+#pragma warning(push)
+#pragma warning(disable:810) /* conversion may lose significant bits */
+#endif
+
+  DEBUGASSERT(sonum >= 0);
+  return (size_t)(sonum & (curl_off_t)CURL_MASK_USIZE_T);
+
+#ifdef __INTEL_COMPILER
+#pragma warning(pop)
+#endif
+}
+
+/*
+ * signed ssize_t to signed int
+ */
+int curlx_sztosi(ssize_t sznum)
+{
+#ifdef __INTEL_COMPILER
+#pragma warning(push)
+#pragma warning(disable:810) /* conversion may lose significant bits */
+#endif
+
+  DEBUGASSERT(sznum >= 0);
+#if INT_MAX < SSIZE_MAX
+  DEBUGASSERT((size_t)sznum <= (size_t)CURL_MASK_SINT);
+#endif
+  return (int)(sznum & (ssize_t)CURL_MASK_SINT);
+
+#ifdef __INTEL_COMPILER
+#pragma warning(pop)
+#endif
+}
+
+/*
+ * unsigned int to unsigned short
+ */
+unsigned short curlx_uitous(unsigned int uinum)
+{
+#ifdef __INTEL_COMPILER
+#pragma warning(push)
+#pragma warning(disable:810) /* conversion may lose significant bits */
+#endif
+
+  DEBUGASSERT(uinum <= (unsigned int)CURL_MASK_USHORT);
+  return (unsigned short)(uinum & (unsigned int)CURL_MASK_USHORT);
+
+#ifdef __INTEL_COMPILER
+#pragma warning(pop)
+#endif
+}
+
+/*
+ * signed int to unsigned size_t
+ */
+size_t curlx_sitouz(int sinum)
+{
+#ifdef __INTEL_COMPILER
+#pragma warning(push)
+#pragma warning(disable:810) /* conversion may lose significant bits */
+#endif
+
+  DEBUGASSERT(sinum >= 0);
+  return (size_t)sinum;
+
+#ifdef __INTEL_COMPILER
+#pragma warning(pop)
+#endif
+}
+
+size_t curlx_uitouz(unsigned int uinum)
+{
+  return (size_t)uinum;
+}
+
+size_t curlx_sotouz_range(curl_off_t sonum, size_t uzmin, size_t uzmax)
+{
+  if(sonum < 0)
+    return uzmin;
+#if SIZEOF_CURL_OFF_T > SIZEOF_SIZE_T
+  if(sonum > SIZE_MAX)
+    return uzmax;
+#endif
+  return CURLMIN(CURLMAX((size_t)sonum, uzmin), uzmax);
+}
+
+bool curlx_sztouz(ssize_t sznum, size_t *puznum)
+{
+  if(sznum < 0) {
+    *puznum = 0;
+    return FALSE;
+  }
+  *puznum = (size_t)sznum;
+  return TRUE;
+}
+
+bool curlx_sotouz_fits(curl_off_t sonum, size_t *puznum)
+{
+  if(sonum < 0) {
+    *puznum = 0;
+    return FALSE;
+  }
+#if SIZEOF_CURL_OFF_T > SIZEOF_SIZE_T
+  if(sonum > SIZE_MAX) {
+    *puznum = 0;
+    return FALSE;
+  }
+#endif
+  *puznum = (size_t)sonum;
+  return TRUE;
+}
+
+bool curlx_sltouz(long slnum, size_t *puznum)
+{
+  if(slnum < 0) {
+    *puznum = 0;
+    return FALSE;
+  }
+  /* We error in curl_setup.h if SIZEOF_LONG > SIZEOF_SIZE_T */
+  *puznum = (size_t)slnum;
+  return TRUE;
+}
+
+curl_off_t curlx_uztoso(size_t uznum)
+{
+#if SIZEOF_SIZE_T >= SIZEOF_CURL_OFF_T
+  if(uznum > (size_t)CURL_OFF_T_MAX)
+    return CURL_OFF_T_MAX;
+#endif
+  return (curl_off_t)uznum;
+}
diff --git a/third-party/curl/lib/curlx/warnless.h b/third-party/curl/lib/curlx/warnless.h
new file mode 100644
index 0000000000..3d0341e418
--- /dev/null
+++ b/third-party/curl/lib/curlx/warnless.h
@@ -0,0 +1,74 @@
+#ifndef HEADER_CURL_WARNLESS_H
+#define HEADER_CURL_WARNLESS_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+#define CURLX_FUNCTION_CAST(target_type, func) \
+  (target_type)(void (*)(void))(func)
+
+unsigned char curlx_ultouc(unsigned long ulnum);
+
+int curlx_uztosi(size_t uznum);
+
+unsigned long curlx_uztoul(size_t uznum);
+
+unsigned int curlx_uztoui(size_t uznum);
+
+int curlx_sltosi(long slnum);
+
+unsigned int curlx_sltoui(long slnum);
+
+unsigned short curlx_sltous(long slnum);
+
+ssize_t curlx_uztosz(size_t uznum);
+
+size_t curlx_sotouz(curl_off_t sonum);
+
+int curlx_sztosi(ssize_t sznum);
+
+unsigned short curlx_uitous(unsigned int uinum);
+
+size_t curlx_sitouz(int sinum);
+
+size_t curlx_uitouz(unsigned int uinum);
+
+/* Convert a curl_off_t to fit into size_t interval [uzmin, uzmax].
+ * values outside this interval give the lower/upper bound. */
+size_t curlx_sotouz_range(curl_off_t sonum, size_t uzmin, size_t uzmax);
+
+/* Convert a size_t to curl_off_t, return CURL_OFF_T_MAX if too large. */
+curl_off_t curlx_uztoso(size_t uznum);
+
+/* Convert a ssize_t to size_t, return FALSE if negative and set 0 */
+bool curlx_sztouz(ssize_t sznum, size_t *puznum);
+
+/* Convert a curl_off_t to size_t, return FALSE if negative or
+ * too large and set 0 */
+bool curlx_sotouz_fits(curl_off_t sonum, size_t *puznum);
+
+/* Convert a long to size_t, return FALSE if negative or too large
+ * and set 0 */
+bool curlx_sltouz(long slnum, size_t *puznum);
+
+#endif /* HEADER_CURL_WARNLESS_H */
diff --git a/third-party/curl/lib/curlx/winapi.c b/third-party/curl/lib/curlx/winapi.c
new file mode 100644
index 0000000000..f025ca48c9
--- /dev/null
+++ b/third-party/curl/lib/curlx/winapi.c
@@ -0,0 +1,106 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+/*
+ * curlx_winapi_strerror:
+ * Variant of curlx_strerror if the error code is definitely Windows API.
+ */
+#ifdef _WIN32
+#include "curlx/winapi.h"
+#include "curlx/snprintf.h"
+#include "curlx/strcopy.h"
+
+/* This is a helper function for curlx_strerror that converts Windows API error
+ * codes (GetLastError) to error messages.
+ * Returns NULL if no error message was found for error code.
+ */
+const char *curlx_get_winapi_error(DWORD err, char *buf, size_t buflen)
+{
+  char *p;
+
+  if(!buflen)
+    return NULL;
+
+  /* We return the local codepage version of the error string because if it is
+     output to the user's terminal, it is likely done with functions which
+     expect the local codepage (eg fprintf, failf, infof). */
+  if(!FormatMessageA((FORMAT_MESSAGE_FROM_SYSTEM |
+                      FORMAT_MESSAGE_IGNORE_INSERTS), NULL, err,
+                     LANG_NEUTRAL, buf, (DWORD)buflen, NULL)) {
+    *buf = '\0';
+    return NULL;
+  }
+
+  /* Truncate multiple lines */
+  p = strchr(buf, '\n');
+  if(p) {
+    if(p > buf && *(p - 1) == '\r')
+      *(p - 1) = '\0';
+    else
+      *p = '\0';
+  }
+
+  return *buf ? buf : NULL;
+}
+
+const char *curlx_winapi_strerror(DWORD err, char *buf, size_t buflen)
+{
+  DWORD old_win_err = GetLastError();
+  int old_errno = errno;
+
+  if(!buflen)
+    return NULL;
+
+  *buf = '\0';
+
+#ifdef CURLVERBOSE
+  if(!curlx_get_winapi_error(err, buf, buflen)) {
+#if defined(__GNUC__) && __GNUC__ >= 7
+#pragma GCC diagnostic push
+#pragma GCC diagnostic warning "-Wformat-truncation=1"
+#endif
+    /* some GCC compilers cause false positive warnings if we allow this
+       warning */
+    SNPRINTF(buf, buflen, "Unknown error %lu (0x%08lx)", err, err);
+#if defined(__GNUC__) && __GNUC__ >= 7
+#pragma GCC diagnostic pop
+#endif
+  }
+#else
+  {
+    const char *txt = (err == ERROR_SUCCESS) ? "No error" : "Error";
+    curlx_strcopy(buf, buflen, txt, strlen(txt));
+  }
+#endif
+
+  if(errno != old_errno)
+    errno = old_errno;
+
+  if(old_win_err != GetLastError())
+    SetLastError(old_win_err);
+
+  return buf;
+}
+#endif /* _WIN32 */
diff --git a/third-party/curl/lib/curlx/winapi.h b/third-party/curl/lib/curlx/winapi.h
new file mode 100644
index 0000000000..d30f5efa13
--- /dev/null
+++ b/third-party/curl/lib/curlx/winapi.h
@@ -0,0 +1,33 @@
+#ifndef HEADER_CURLX_WINAPI_H
+#define HEADER_CURLX_WINAPI_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+#ifdef _WIN32
+#define WINAPI_ERROR_LEN 100
+const char *curlx_get_winapi_error(DWORD err, char *buf, size_t buflen);
+const char *curlx_winapi_strerror(DWORD err, char *buf, size_t buflen);
+#endif
+
+#endif /* HEADER_CURLX_WINAPI_H */
diff --git a/third-party/curl/lib/cw-out.c b/third-party/curl/lib/cw-out.c
new file mode 100644
index 0000000000..fad89b392c
--- /dev/null
+++ b/third-party/curl/lib/cw-out.c
@@ -0,0 +1,522 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "urldata.h"
+#include "cfilters.h"
+#include "multiif.h"
+#include "sendf.h"
+#include "curl_trc.h"
+#include "transfer.h"
+#include "cw-out.h"
+#include "cw-pause.h"
+#include "progress.h"
+
+/**
+ * OVERALL DESIGN of this client writer
+ *
+ * The 'cw-out' writer is supposed to be the last writer in a transfer's
+ * stack. It is always added when that stack is initialized. Its purpose
+ * is to pass BODY and HEADER bytes to the client-installed callback
+ * functions.
+ *
+ * These callback may return `CURL_WRITEFUNC_PAUSE` to indicate that the
+ * data had not been written and the whole transfer should stop receiving
+ * new data. Or at least, stop calling the functions. When the transfer
+ * is "unpaused" by the client, the previous data shall be passed as
+ * if nothing happened.
+ *
+ * The `cw-out` writer therefore manages buffers for bytes that could
+ * not be written. Data that was already in flight from the server also
+ * needs buffering on paused transfer when it arrives.
+ *
+ * In addition, the writer allows buffering of "small" body writes,
+ * so client functions are called less often. That is only enabled on a
+ * number of conditions.
+ *
+ * HEADER and BODY data may arrive in any order. For paused transfers,
+ * a list of `struct cw_out_buf` is kept for `cw_out_type` types. The
+ * list may be: [BODY]->[HEADER]->[BODY]->[HEADER]....
+ * When unpausing, this list is "played back" to the client callbacks.
+ *
+ * The amount of bytes being buffered is limited by `DYN_PAUSE_BUFFER`
+ * and when that is exceeded `CURLE_TOO_LARGE` is returned as error.
+ */
+typedef enum {
+  CW_OUT_NONE,
+  CW_OUT_BODY,
+  CW_OUT_BODY_0LEN,
+  CW_OUT_HDS
+} cw_out_type;
+
+struct cw_out_buf {
+  struct cw_out_buf *next;
+  struct dynbuf b;
+  cw_out_type type;
+};
+
+static struct cw_out_buf *cw_out_buf_create(cw_out_type otype)
+{
+  struct cw_out_buf *cwbuf = curlx_calloc(1, sizeof(*cwbuf));
+  if(cwbuf) {
+    cwbuf->type = otype;
+    curlx_dyn_init(&cwbuf->b, DYN_PAUSE_BUFFER);
+  }
+  return cwbuf;
+}
+
+static void cw_out_buf_free(struct cw_out_buf *cwbuf)
+{
+  if(cwbuf) {
+    curlx_dyn_free(&cwbuf->b);
+    curlx_free(cwbuf);
+  }
+}
+
+struct cw_out_ctx {
+  struct Curl_cwriter super;
+  struct cw_out_buf *buf;
+  BIT(paused);
+  BIT(errored);
+};
+
+static CURLcode cw_out_init(struct Curl_easy *data,
+                            struct Curl_cwriter *writer)
+{
+  struct cw_out_ctx *ctx = writer->ctx;
+  (void)data;
+  ctx->buf = NULL;
+  return CURLE_OK;
+}
+
+static void cw_out_bufs_free(struct cw_out_ctx *ctx)
+{
+  while(ctx->buf) {
+    struct cw_out_buf *next = ctx->buf->next;
+    cw_out_buf_free(ctx->buf);
+    ctx->buf = next;
+  }
+}
+
+static size_t cw_out_bufs_len(struct cw_out_ctx *ctx)
+{
+  struct cw_out_buf *cwbuf = ctx->buf;
+  size_t len = 0;
+  while(cwbuf) {
+    len += curlx_dyn_len(&cwbuf->b);
+    cwbuf = cwbuf->next;
+  }
+  return len;
+}
+
+static void cw_out_close(struct Curl_easy *data, struct Curl_cwriter *writer)
+{
+  struct cw_out_ctx *ctx = writer->ctx;
+
+  (void)data;
+  cw_out_bufs_free(ctx);
+}
+
+/**
+ * Return the current curl_write_callback and user_data for the buf type
+ */
+static void cw_get_writefunc(struct Curl_easy *data, cw_out_type otype,
+                             curl_write_callback *pwcb, void **pwcb_data,
+                             size_t *pmax_write, size_t *pmin_write)
+{
+  switch(otype) {
+  case CW_OUT_BODY:
+  case CW_OUT_BODY_0LEN:
+    *pwcb = data->set.fwrite_func;
+    *pwcb_data = data->set.out;
+    *pmax_write = CURL_MAX_WRITE_SIZE;
+    /* if we ever want buffering of BODY output, we can set `min_write`
+     * the preferred size. The default should always be to pass data
+     * to the client as it comes without delay */
+    *pmin_write = 0;
+    break;
+  case CW_OUT_HDS:
+    *pwcb = data->set.fwrite_header ? data->set.fwrite_header :
+             (data->set.writeheader ? data->set.fwrite_func : NULL);
+    *pwcb_data = data->set.writeheader;
+    *pmax_write = 0; /* do not chunk-write headers, write them as they are */
+    *pmin_write = 0;
+    break;
+  default:
+    *pwcb = NULL;
+    *pwcb_data = NULL;
+    *pmax_write = CURL_MAX_WRITE_SIZE;
+    *pmin_write = 0;
+  }
+}
+
+static CURLcode cw_out_cb_write(struct cw_out_ctx *ctx,
+                                struct Curl_easy *data,
+                                curl_write_callback wcb,
+                                void *wcb_data,
+                                cw_out_type otype,
+                                const char *buf, size_t blen,
+                                size_t *pnwritten)
+{
+  size_t nwritten;
+  CURLcode result;
+
+  NOVERBOSE((void)otype);
+
+  DEBUGASSERT(data->conn);
+  *pnwritten = 0;
+  Curl_set_in_callback(data, TRUE);
+  nwritten = wcb((char *)CURL_UNCONST(buf), 1, blen, wcb_data);
+  Curl_set_in_callback(data, FALSE);
+  CURL_TRC_WRITE(data, "[OUT] wrote %zu %s bytes -> %zu",
+                 blen, (otype == CW_OUT_HDS) ? "header" : "body",
+                 nwritten);
+  if(nwritten == CURL_WRITEFUNC_PAUSE) {
+    if(data->conn->scheme->flags & PROTOPT_NONETWORK) {
+      /* Protocols that work without network cannot be paused. This is
+         actually only file:// now, and it cannot pause since the transfer is
+         not done using the "normal" procedure. */
+      failf(data, "Write callback asked for PAUSE when not supported");
+      return CURLE_WRITE_ERROR;
+    }
+    ctx->paused = TRUE;
+    CURL_TRC_WRITE(data, "[OUT] PAUSE requested by client");
+    result = Curl_xfer_pause_recv(data, TRUE);
+    return result ? result : CURLE_AGAIN;
+  }
+  else if(nwritten == CURL_WRITEFUNC_ERROR) {
+    failf(data, "client returned ERROR on write of %zu bytes", blen);
+    return CURLE_WRITE_ERROR;
+  }
+  else if(nwritten != blen) {
+    failf(data, "Failure writing output to destination, "
+          "passed %zu returned %zu", blen, nwritten);
+    return CURLE_WRITE_ERROR;
+  }
+  *pnwritten = nwritten;
+  return CURLE_OK;
+}
+
+static CURLcode cw_out_ptr_flush(struct cw_out_ctx *ctx,
+                                 struct Curl_easy *data,
+                                 cw_out_type otype,
+                                 bool flush_all,
+                                 const char *buf, size_t blen,
+                                 size_t *pconsumed)
+{
+  curl_write_callback wcb = NULL;
+  void *wcb_data;
+  size_t max_write, min_write;
+  size_t wlen, nwritten = 0;
+  CURLcode result = CURLE_OK;
+
+  /* If we errored once, we do not invoke the client callback again */
+  if(ctx->errored)
+    return CURLE_WRITE_ERROR;
+
+  /* write callbacks may get NULLed by the client between calls. */
+  cw_get_writefunc(data, otype, &wcb, &wcb_data, &max_write, &min_write);
+  if(!wcb) {
+    *pconsumed = blen;
+    return CURLE_OK;
+  }
+
+  *pconsumed = 0;
+  if(otype == CW_OUT_BODY_0LEN) {
+    DEBUGASSERT(!blen);
+    return cw_out_cb_write(ctx, data, wcb, wcb_data, otype,
+                           buf, blen, &nwritten);
+  }
+  else {
+    while(blen && !ctx->paused) {
+      if(!flush_all && blen < min_write)
+        break;
+      wlen = max_write ? CURLMIN(blen, max_write) : blen;
+      if(otype == CW_OUT_BODY)
+        result = Curl_pgrs_deliver_check(data, wlen);
+      if(!result)
+        result = cw_out_cb_write(ctx, data, wcb, wcb_data, otype,
+                                 buf, wlen, &nwritten);
+      if(result)
+        return result;
+      if(otype == CW_OUT_BODY)
+        Curl_pgrs_deliver_inc(data, nwritten);
+      *pconsumed += nwritten;
+      blen -= nwritten;
+      buf += nwritten;
+    }
+  }
+  return CURLE_OK;
+}
+
+static CURLcode cw_out_buf_flush(struct cw_out_ctx *ctx,
+                                 struct Curl_easy *data,
+                                 struct cw_out_buf *cwbuf,
+                                 bool flush_all)
+{
+  CURLcode result = CURLE_OK;
+
+  if(curlx_dyn_len(&cwbuf->b) || (cwbuf->type == CW_OUT_BODY_0LEN)) {
+    size_t consumed;
+
+    result = cw_out_ptr_flush(ctx, data, cwbuf->type, flush_all,
+                              curlx_dyn_ptr(&cwbuf->b),
+                              curlx_dyn_len(&cwbuf->b),
+                              &consumed);
+    if(result && (result != CURLE_AGAIN))
+      return result;
+    result = CURLE_OK;
+
+    if(consumed) {
+      if(consumed == curlx_dyn_len(&cwbuf->b)) {
+        curlx_dyn_free(&cwbuf->b);
+      }
+      else {
+        DEBUGASSERT(consumed < curlx_dyn_len(&cwbuf->b));
+        result = curlx_dyn_tail(&cwbuf->b,
+                                curlx_dyn_len(&cwbuf->b) - consumed);
+        if(result)
+          return result;
+      }
+    }
+  }
+  return result;
+}
+
+static CURLcode cw_out_flush_chain(struct cw_out_ctx *ctx,
+                                   struct Curl_easy *data,
+                                   struct cw_out_buf **pcwbuf,
+                                   bool flush_all)
+{
+  struct cw_out_buf *cwbuf = *pcwbuf;
+  CURLcode result;
+
+  if(!cwbuf)
+    return CURLE_OK;
+  if(ctx->paused)
+    return CURLE_OK;
+
+  /* write the end of the chain until it blocks or gets empty */
+  while(cwbuf->next) {
+    struct cw_out_buf **plast = &cwbuf->next;
+    while((*plast)->next)
+      plast = &(*plast)->next;
+    result = cw_out_flush_chain(ctx, data, plast, flush_all);
+    if(result)
+      return result;
+    if(*plast) {
+      /* could not write last, paused again? */
+      DEBUGASSERT(ctx->paused);
+      return CURLE_OK;
+    }
+  }
+
+  result = cw_out_buf_flush(ctx, data, cwbuf, flush_all);
+  if(result)
+    return result;
+  if(!curlx_dyn_len(&cwbuf->b)) {
+    cw_out_buf_free(cwbuf);
+    *pcwbuf = NULL;
+  }
+  return CURLE_OK;
+}
+
+static CURLcode cw_out_append(struct cw_out_ctx *ctx,
+                              struct Curl_easy *data,
+                              cw_out_type otype,
+                              const char *buf, size_t blen)
+{
+  CURL_TRC_WRITE(data, "[OUT] paused, buffering %zu more bytes (%zu/%d)",
+                 blen, cw_out_bufs_len(ctx), DYN_PAUSE_BUFFER);
+  if(cw_out_bufs_len(ctx) + blen > DYN_PAUSE_BUFFER) {
+    failf(data, "pause buffer not large enough -> CURLE_TOO_LARGE");
+    return CURLE_TOO_LARGE;
+  }
+
+  /* if we do not have a buffer, or it is of another type, make a new one.
+   * For CW_OUT_HDS always make a new one, so we "replay" headers exactly
+   * as they came in */
+  if(!ctx->buf || (ctx->buf->type != otype) || (otype == CW_OUT_HDS)) {
+    struct cw_out_buf *cwbuf = cw_out_buf_create(otype);
+    if(!cwbuf)
+      return CURLE_OUT_OF_MEMORY;
+    cwbuf->next = ctx->buf;
+    ctx->buf = cwbuf;
+  }
+  DEBUGASSERT(ctx->buf && (ctx->buf->type == otype));
+  return curlx_dyn_addn(&ctx->buf->b, buf, blen);
+}
+
+static CURLcode cw_out_do_write(struct cw_out_ctx *ctx,
+                                struct Curl_easy *data,
+                                cw_out_type otype,
+                                bool flush_all,
+                                const char *buf, size_t blen)
+{
+  CURLcode result = CURLE_OK;
+
+  /* if we have buffered data and it is a different type than what
+   * we are writing now, try to flush all */
+  if(ctx->buf && ctx->buf->type != otype) {
+    result = cw_out_flush_chain(ctx, data, &ctx->buf, TRUE);
+    if(result)
+      goto out;
+  }
+
+  if(ctx->buf) {
+    /* still have buffered data, append and flush */
+    result = cw_out_append(ctx, data, otype, buf, blen);
+    if(result)
+      goto out;
+    result = cw_out_flush_chain(ctx, data, &ctx->buf, flush_all);
+    if(result)
+      goto out;
+  }
+  else {
+    /* nothing buffered, try direct write */
+    size_t consumed;
+    result = cw_out_ptr_flush(ctx, data, otype, flush_all,
+                              buf, blen, &consumed);
+    if(result && (result != CURLE_AGAIN))
+      return result;
+    result = CURLE_OK;
+    if(consumed < blen) {
+      /* did not write all, append the rest */
+      result = cw_out_append(ctx, data, otype,
+                             buf + consumed, blen - consumed);
+      if(result)
+        goto out;
+    }
+  }
+
+out:
+  if(result) {
+    /* We do not want to invoked client callbacks a second time after
+     * encountering an error. See issue #13337 */
+    ctx->errored = TRUE;
+    cw_out_bufs_free(ctx);
+  }
+  return result;
+}
+
+static CURLcode cw_out_write(struct Curl_easy *data,
+                             struct Curl_cwriter *writer, int type,
+                             const char *buf, size_t blen)
+{
+  struct cw_out_ctx *ctx = writer->ctx;
+  CURLcode result;
+  bool flush_all = !!(type & CLIENTWRITE_EOS);
+
+  if((type & CLIENTWRITE_BODY) ||
+     ((type & CLIENTWRITE_HEADER) && data->set.include_header)) {
+    cw_out_type otype = (!blen && (type & CLIENTWRITE_0LEN)) ?
+                        CW_OUT_BODY_0LEN : CW_OUT_BODY;
+    result = cw_out_do_write(ctx, data, otype, flush_all, buf, blen);
+    if(result)
+      return result;
+  }
+
+  if(type & (CLIENTWRITE_HEADER | CLIENTWRITE_INFO)) {
+    result = cw_out_do_write(ctx, data, CW_OUT_HDS, flush_all, buf, blen);
+    if(result)
+      return result;
+  }
+
+  return CURLE_OK;
+}
+
+const struct Curl_cwtype Curl_cwt_out = {
+  "cw-out",
+  NULL,
+  cw_out_init,
+  cw_out_write,
+  cw_out_close,
+  sizeof(struct cw_out_ctx)
+};
+
+bool Curl_cw_out_is_paused(struct Curl_easy *data)
+{
+  struct Curl_cwriter *cw_out;
+  struct cw_out_ctx *ctx;
+
+  cw_out = Curl_cwriter_get_by_type(data, &Curl_cwt_out);
+  if(!cw_out)
+    return FALSE;
+
+  ctx = (struct cw_out_ctx *)cw_out;
+  return (bool)ctx->paused;
+}
+
+static CURLcode cw_out_flush(struct Curl_easy *data,
+                             struct Curl_cwriter *cw_out,
+                             bool flush_all)
+{
+  struct cw_out_ctx *ctx = (struct cw_out_ctx *)cw_out;
+  CURLcode result = CURLE_OK;
+
+  if(ctx->errored)
+    return CURLE_WRITE_ERROR;
+  if(ctx->paused)
+    return CURLE_OK;  /* not doing it */
+
+  result = cw_out_flush_chain(ctx, data, &ctx->buf, flush_all);
+  if(result) {
+    ctx->errored = TRUE;
+    cw_out_bufs_free(ctx);
+    return result;
+  }
+  return result;
+}
+
+CURLcode Curl_cw_out_unpause(struct Curl_easy *data)
+{
+  struct Curl_cwriter *cw_out;
+  CURLcode result = CURLE_OK;
+
+  cw_out = Curl_cwriter_get_by_type(data, &Curl_cwt_out);
+  if(cw_out) {
+    struct cw_out_ctx *ctx = (struct cw_out_ctx *)cw_out;
+    CURL_TRC_WRITE(data, "[OUT] unpause");
+    ctx->paused = FALSE;
+    result = Curl_cw_pause_flush(data);
+    if(!result)
+      result = cw_out_flush(data, cw_out, FALSE);
+  }
+  return result;
+}
+
+CURLcode Curl_cw_out_done(struct Curl_easy *data)
+{
+  struct Curl_cwriter *cw_out;
+  CURLcode result = CURLE_OK;
+
+  cw_out = Curl_cwriter_get_by_type(data, &Curl_cwt_out);
+  if(cw_out) {
+    CURL_TRC_WRITE(data, "[OUT] done");
+    result = Curl_cw_pause_flush(data);
+    if(!result)
+      result = cw_out_flush(data, cw_out, TRUE);
+  }
+  return result;
+}
diff --git a/third-party/curl/lib/cw-out.h b/third-party/curl/lib/cw-out.h
new file mode 100644
index 0000000000..7de6524bc5
--- /dev/null
+++ b/third-party/curl/lib/cw-out.h
@@ -0,0 +1,52 @@
+#ifndef HEADER_CURL_CW_OUT_H
+#define HEADER_CURL_CW_OUT_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+struct Curl_easy;
+
+/**
+ * The client writer type "cw-out" that does the actual writing to
+ * the client callbacks. Intended to be the last installed in the
+ * client writer stack of a transfer.
+ */
+extern const struct Curl_cwtype Curl_cwt_out;
+
+/**
+ * Return TRUE iff 'cw-out' client write has paused data.
+ */
+bool Curl_cw_out_is_paused(struct Curl_easy *data);
+
+/**
+ * Flush any buffered date to the client, chunk collation still applies.
+ */
+CURLcode Curl_cw_out_unpause(struct Curl_easy *data);
+
+/**
+ * Mark EndOfStream reached and flush ALL data to the client.
+ */
+CURLcode Curl_cw_out_done(struct Curl_easy *data);
+
+#endif /* HEADER_CURL_CW_OUT_H */
diff --git a/third-party/curl/lib/cw-pause.c b/third-party/curl/lib/cw-pause.c
new file mode 100644
index 0000000000..5561a8d7b7
--- /dev/null
+++ b/third-party/curl/lib/cw-pause.c
@@ -0,0 +1,227 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "urldata.h"
+#include "bufq.h"
+#include "cfilters.h"
+#include "sendf.h"
+#include "curl_trc.h"
+#include "cw-pause.h"
+
+
+/* body dynbuf sizes */
+#define CW_PAUSE_BUF_CHUNK         (16 * 1024)
+/* when content decoding, write data in chunks */
+#define CW_PAUSE_DEC_WRITE_CHUNK   4096
+
+struct cw_pause_buf {
+  struct cw_pause_buf *next;
+  struct bufq b;
+  int type;
+};
+
+static struct cw_pause_buf *cw_pause_buf_create(int type, size_t buflen)
+{
+  struct cw_pause_buf *cwbuf = curlx_calloc(1, sizeof(*cwbuf));
+  if(cwbuf) {
+    cwbuf->type = type;
+    if(type & CLIENTWRITE_BODY)
+      Curl_bufq_init2(&cwbuf->b, CW_PAUSE_BUF_CHUNK, 1,
+                      (BUFQ_OPT_SOFT_LIMIT | BUFQ_OPT_NO_SPARES));
+    else
+      Curl_bufq_init(&cwbuf->b, buflen, 1);
+  }
+  return cwbuf;
+}
+
+static void cw_pause_buf_free(struct cw_pause_buf *cwbuf)
+{
+  if(cwbuf) {
+    Curl_bufq_free(&cwbuf->b);
+    curlx_free(cwbuf);
+  }
+}
+
+struct cw_pause_ctx {
+  struct Curl_cwriter super;
+  struct cw_pause_buf *buf;
+  size_t buf_total;
+};
+
+static CURLcode cw_pause_init(struct Curl_easy *data,
+                              struct Curl_cwriter *writer)
+{
+  struct cw_pause_ctx *ctx = writer->ctx;
+  (void)data;
+  ctx->buf = NULL;
+  return CURLE_OK;
+}
+
+static void cw_pause_bufs_free(struct cw_pause_ctx *ctx)
+{
+  while(ctx->buf) {
+    struct cw_pause_buf *next = ctx->buf->next;
+    cw_pause_buf_free(ctx->buf);
+    ctx->buf = next;
+  }
+}
+
+static void cw_pause_close(struct Curl_easy *data, struct Curl_cwriter *writer)
+{
+  struct cw_pause_ctx *ctx = writer->ctx;
+
+  (void)data;
+  cw_pause_bufs_free(ctx);
+}
+
+static CURLcode cw_pause_flush(struct Curl_easy *data,
+                               struct Curl_cwriter *cw_pause)
+{
+  struct cw_pause_ctx *ctx = (struct cw_pause_ctx *)cw_pause;
+  bool decoding = Curl_cwriter_is_content_decoding(data);
+  CURLcode result = CURLE_OK;
+
+  /* write the end of the chain until it blocks or gets empty */
+  while(ctx->buf && !Curl_cwriter_is_paused(data)) {
+    struct cw_pause_buf **plast = &ctx->buf;
+    size_t blen, wlen = 0;
+    const unsigned char *buf = NULL;
+
+    while((*plast)->next) /* got to last in list */
+      plast = &(*plast)->next;
+    if(Curl_bufq_peek(&(*plast)->b, &buf, &blen)) {
+      wlen = (decoding && ((*plast)->type & CLIENTWRITE_BODY)) ?
+             CURLMIN(blen, CW_PAUSE_DEC_WRITE_CHUNK) : blen;
+      result = Curl_cwriter_write(data, cw_pause->next, (*plast)->type,
+                                  (const char *)buf, wlen);
+      CURL_TRC_WRITE(data, "[PAUSE] flushed %zu/%zu bytes, type=%x -> %d",
+                     wlen, ctx->buf_total, (unsigned int)(*plast)->type,
+                     (int)result);
+      Curl_bufq_skip(&(*plast)->b, wlen);
+      DEBUGASSERT(ctx->buf_total >= wlen);
+      ctx->buf_total -= wlen;
+      if(result)
+        return result;
+    }
+    else if((*plast)->type & CLIENTWRITE_EOS) {
+      result = Curl_cwriter_write(data, cw_pause->next, (*plast)->type,
+                                  (const char *)buf, 0);
+      CURL_TRC_WRITE(data, "[PAUSE] flushed 0/%zu bytes, type=%x -> %d",
+                     ctx->buf_total, (unsigned int)(*plast)->type,
+                     (int)result);
+    }
+
+    if(Curl_bufq_is_empty(&(*plast)->b)) {
+      cw_pause_buf_free(*plast);
+      *plast = NULL;
+    }
+  }
+  return result;
+}
+
+static CURLcode cw_pause_write(struct Curl_easy *data,
+                               struct Curl_cwriter *writer, int type,
+                               const char *buf, size_t blen)
+{
+  struct cw_pause_ctx *ctx = writer->ctx;
+  CURLcode result = CURLE_OK;
+  size_t wlen = 0;
+  bool decoding = Curl_cwriter_is_content_decoding(data);
+
+  if(ctx->buf && !Curl_cwriter_is_paused(data)) {
+    result = cw_pause_flush(data, writer);
+    if(result)
+      return result;
+  }
+
+  while(!ctx->buf && !Curl_cwriter_is_paused(data)) {
+    int wtype = type;
+    DEBUGASSERT(!ctx->buf);
+    /* content decoding might blow up size considerably, write smaller
+     * chunks to make pausing need buffer less. */
+    wlen = (decoding && (type & CLIENTWRITE_BODY)) ?
+           CURLMIN(blen, CW_PAUSE_DEC_WRITE_CHUNK) : blen;
+    if(wlen < blen)
+      wtype &= ~CLIENTWRITE_EOS;
+    result = Curl_cwriter_write(data, writer->next, wtype, buf, wlen);
+    CURL_TRC_WRITE(data, "[PAUSE] writing %zu/%zu bytes of type %x -> %d",
+                   wlen, blen, (unsigned int)wtype, (int)result);
+    if(result)
+      return result;
+    buf += wlen;
+    blen -= wlen;
+    if(!blen)
+      return result;
+  }
+
+  do {
+    size_t nwritten = 0;
+    if(ctx->buf && (ctx->buf->type == type) && (type & CLIENTWRITE_BODY)) {
+      /* same type and body, append to current buffer which has a soft
+       * limit and should take everything up to OOM. */
+      result = Curl_bufq_cwrite(&ctx->buf->b, buf, blen, &nwritten);
+    }
+    else {
+      /* Need a new buf, type changed */
+      struct cw_pause_buf *cwbuf = cw_pause_buf_create(type, blen);
+      if(!cwbuf)
+        return CURLE_OUT_OF_MEMORY;
+      cwbuf->next = ctx->buf;
+      ctx->buf = cwbuf;
+      result = Curl_bufq_cwrite(&ctx->buf->b, buf, blen, &nwritten);
+    }
+    CURL_TRC_WRITE(data, "[PAUSE] buffer %zu more bytes of type %x, "
+                   "total=%zu -> %d", nwritten, (unsigned int)type,
+                   ctx->buf_total + wlen, (int)result);
+    if(result)
+      return result;
+    buf += nwritten;
+    blen -= nwritten;
+    ctx->buf_total += nwritten;
+  } while(blen);
+
+  return result;
+}
+
+const struct Curl_cwtype Curl_cwt_pause = {
+  "cw-pause",
+  NULL,
+  cw_pause_init,
+  cw_pause_write,
+  cw_pause_close,
+  sizeof(struct cw_pause_ctx)
+};
+
+CURLcode Curl_cw_pause_flush(struct Curl_easy *data)
+{
+  struct Curl_cwriter *cw_pause;
+  CURLcode result = CURLE_OK;
+
+  cw_pause = Curl_cwriter_get_by_type(data, &Curl_cwt_pause);
+  if(cw_pause)
+    result = cw_pause_flush(data, cw_pause);
+
+  return result;
+}
diff --git a/third-party/curl/lib/cw-pause.h b/third-party/curl/lib/cw-pause.h
new file mode 100644
index 0000000000..544cbfa577
--- /dev/null
+++ b/third-party/curl/lib/cw-pause.h
@@ -0,0 +1,38 @@
+#ifndef HEADER_CURL_CW_PAUSE_H
+#define HEADER_CURL_CW_PAUSE_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+struct Curl_easy;
+
+/**
+ * The client writer type "cw-pause" that buffers writes for
+ * paused transfer writes.
+ */
+extern const struct Curl_cwtype Curl_cwt_pause;
+
+CURLcode Curl_cw_pause_flush(struct Curl_easy *data);
+
+#endif /* HEADER_CURL_CW_PAUSE_H */
diff --git a/third-party/curl/lib/dict.c b/third-party/curl/lib/dict.c
index 3172b38290..db25d5a721 100644
--- a/third-party/curl/lib/dict.c
+++ b/third-party/curl/lib/dict.c
@@ -21,8 +21,9 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+#include "urldata.h"
+#include "dict.h"
 
 #ifndef CURL_DISABLE_DICT
 
@@ -52,51 +53,16 @@
 #include <unistd.h>
 #endif
 
-#include "urldata.h"
-#include <curl/curl.h>
 #include "transfer.h"
-#include "sendf.h"
+#include "curl_trc.h"
 #include "escape.h"
-#include "progress.h"
-#include "dict.h"
-#include "curl_printf.h"
-#include "strcase.h"
-#include "curl_memory.h"
-/* The last #include file should be: */
-#include "memdebug.h"
 
-/*
- * Forward declarations.
- */
-
-static CURLcode dict_do(struct Curl_easy *data, bool *done);
-
-/*
- * DICT protocol handler.
- */
-
-const struct Curl_handler Curl_handler_dict = {
-  "DICT",                               /* scheme */
-  ZERO_NULL,                            /* setup_connection */
-  dict_do,                              /* do_it */
-  ZERO_NULL,                            /* done */
-  ZERO_NULL,                            /* do_more */
-  ZERO_NULL,                            /* connect_it */
-  ZERO_NULL,                            /* connecting */
-  ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  ZERO_NULL,                            /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_DICT,                            /* defport */
-  CURLPROTO_DICT,                       /* protocol */
-  CURLPROTO_DICT,                       /* family */
-  PROTOPT_NONE | PROTOPT_NOURLQUERY     /* flags */
-};
+#define DICT_MATCH   "/MATCH:"
+#define DICT_MATCH2  "/M:"
+#define DICT_MATCH3  "/FIND:"
+#define DICT_DEFINE  "/DEFINE:"
+#define DICT_DEFINE2 "/D:"
+#define DICT_DEFINE3 "/LOOKUP:"
 
 #define DYN_DICT_WORD 10000
 static char *unescape_word(const char *input)
@@ -104,7 +70,7 @@ static char *unescape_word(const char *input)
   struct dynbuf out;
   const char *ptr;
   CURLcode result = CURLE_OK;
-  Curl_dyn_init(&out, DYN_DICT_WORD);
+  curlx_dyn_init(&out, DYN_DICT_WORD);
 
   /* According to RFC2229 section 2.2, these letters need to be escaped with
      \[letter] */
@@ -112,27 +78,29 @@ static char *unescape_word(const char *input)
     char ch = *ptr;
     if((ch <= 32) || (ch == 127) ||
        (ch == '\'') || (ch == '\"') || (ch == '\\'))
-      result = Curl_dyn_addn(&out, "\\", 1);
+      result = curlx_dyn_addn(&out, "\\", 1);
     if(!result)
-      result = Curl_dyn_addn(&out, ptr, 1);
+      result = curlx_dyn_addn(&out, ptr, 1);
     if(result)
       return NULL;
   }
-  return Curl_dyn_ptr(&out);
+  return curlx_dyn_ptr(&out);
 }
 
 /* sendf() sends formatted data to the server */
-static CURLcode sendf(curl_socket_t sockfd, struct Curl_easy *data,
-                      const char *fmt, ...)
+static CURLcode sendf(struct Curl_easy *data,
+                      const char *fmt, ...) CURL_PRINTF(2, 3);
+
+static CURLcode sendf(struct Curl_easy *data, const char *fmt, ...)
 {
-  ssize_t bytes_written;
+  size_t bytes_written;
   size_t write_len;
   CURLcode result = CURLE_OK;
   char *s;
   char *sptr;
   va_list ap;
   va_start(ap, fmt);
-  s = vaprintf(fmt, ap); /* returns an allocated string */
+  s = curl_mvaprintf(fmt, ap); /* returns an allocated string */
   va_end(ap);
   if(!s)
     return CURLE_OUT_OF_MEMORY; /* failure */
@@ -143,14 +111,14 @@ static CURLcode sendf(curl_socket_t sockfd, struct Curl_easy *data,
 
   for(;;) {
     /* Write the buffer to the socket */
-    result = Curl_write(data, sockfd, sptr, write_len, &bytes_written);
+    result = Curl_xfer_send(data, sptr, write_len, FALSE, &bytes_written);
 
     if(result)
       break;
 
-    Curl_debug(data, CURLINFO_DATA_OUT, sptr, (size_t)bytes_written);
+    Curl_debug(data, CURLINFO_DATA_OUT, sptr, bytes_written);
 
-    if((size_t)bytes_written != write_len) {
+    if(bytes_written != write_len) {
       /* if not all was written at once, we must advance the pointer, decrease
          the size left and try again! */
       write_len -= bytes_written;
@@ -160,7 +128,7 @@ static CURLcode sendf(curl_socket_t sockfd, struct Curl_easy *data,
       break;
   }
 
-  free(s); /* free the output string */
+  curlx_free(s); /* free the output string */
 
   return result;
 }
@@ -175,21 +143,19 @@ static CURLcode dict_do(struct Curl_easy *data, bool *done)
   char *nthdef = NULL; /* This is not part of the protocol, but required
                           by RFC 2229 */
   CURLcode result;
-  struct connectdata *conn = data->conn;
-  curl_socket_t sockfd = conn->sock[FIRSTSOCKET];
 
   char *path;
 
   *done = TRUE; /* unconditionally */
 
-  /* url-decode path before further evaluation */
+  /* URL-decode path before further evaluation */
   result = Curl_urldecode(data->state.up.path, 0, &path, NULL, REJECT_CTRL);
   if(result)
     return result;
 
-  if(strncasecompare(path, DICT_MATCH, sizeof(DICT_MATCH)-1) ||
-     strncasecompare(path, DICT_MATCH2, sizeof(DICT_MATCH2)-1) ||
-     strncasecompare(path, DICT_MATCH3, sizeof(DICT_MATCH3)-1)) {
+  if(curl_strnequal(path, DICT_MATCH, sizeof(DICT_MATCH) - 1) ||
+     curl_strnequal(path, DICT_MATCH2, sizeof(DICT_MATCH2) - 1) ||
+     curl_strnequal(path, DICT_MATCH3, sizeof(DICT_MATCH3) - 1)) {
 
     word = strchr(path, ':');
     if(word) {
@@ -210,41 +176,33 @@ static CURLcode dict_do(struct Curl_easy *data, bool *done)
 
     if(!word || (*word == (char)0)) {
       infof(data, "lookup word is missing");
-      word = (char *)"default";
     }
-    if(!database || (*database == (char)0)) {
-      database = (char *)"!";
-    }
-    if(!strategy || (*strategy == (char)0)) {
-      strategy = (char *)".";
-    }
-
-    eword = unescape_word(word);
+    eword = unescape_word((!word || (*word == (char)0)) ? "default" : word);
     if(!eword) {
       result = CURLE_OUT_OF_MEMORY;
       goto error;
     }
 
-    result = sendf(sockfd, data,
+    result = sendf(data,
                    "CLIENT " LIBCURL_NAME " " LIBCURL_VERSION "\r\n"
                    "MATCH "
                    "%s "    /* database */
                    "%s "    /* strategy */
                    "%s\r\n" /* word */
                    "QUIT\r\n",
-                   database,
-                   strategy,
+                   (!database || (*database == (char)0)) ? "!" : database,
+                   (!strategy || (*strategy == (char)0)) ? "." : strategy,
                    eword);
 
     if(result) {
       failf(data, "Failed sending DICT request");
       goto error;
     }
-    Curl_setup_transfer(data, FIRSTSOCKET, -1, FALSE, -1); /* no upload */
+    Curl_xfer_setup_recv(data, FIRSTSOCKET, -1);
   }
-  else if(strncasecompare(path, DICT_DEFINE, sizeof(DICT_DEFINE)-1) ||
-          strncasecompare(path, DICT_DEFINE2, sizeof(DICT_DEFINE2)-1) ||
-          strncasecompare(path, DICT_DEFINE3, sizeof(DICT_DEFINE3)-1)) {
+  else if(curl_strnequal(path, DICT_DEFINE, sizeof(DICT_DEFINE) - 1) ||
+          curl_strnequal(path, DICT_DEFINE2, sizeof(DICT_DEFINE2) - 1) ||
+          curl_strnequal(path, DICT_DEFINE3, sizeof(DICT_DEFINE3) - 1)) {
 
     word = strchr(path, ':');
     if(word) {
@@ -261,32 +219,27 @@ static CURLcode dict_do(struct Curl_easy *data, bool *done)
 
     if(!word || (*word == (char)0)) {
       infof(data, "lookup word is missing");
-      word = (char *)"default";
     }
-    if(!database || (*database == (char)0)) {
-      database = (char *)"!";
-    }
-
-    eword = unescape_word(word);
+    eword = unescape_word((!word || (*word == (char)0)) ? "default" : word);
     if(!eword) {
       result = CURLE_OUT_OF_MEMORY;
       goto error;
     }
 
-    result = sendf(sockfd, data,
+    result = sendf(data,
                    "CLIENT " LIBCURL_NAME " " LIBCURL_VERSION "\r\n"
                    "DEFINE "
                    "%s "     /* database */
                    "%s\r\n"  /* word */
                    "QUIT\r\n",
-                   database,
+                   (!database || (*database == (char)0)) ? "!" : database,
                    eword);
 
     if(result) {
       failf(data, "Failed sending DICT request");
       goto error;
     }
-    Curl_setup_transfer(data, FIRSTSOCKET, -1, FALSE, -1);
+    Curl_xfer_setup_recv(data, FIRSTSOCKET, -1);
   }
   else {
 
@@ -299,7 +252,7 @@ static CURLcode dict_do(struct Curl_easy *data, bool *done)
         if(ppath[i] == ':')
           ppath[i] = ' ';
       }
-      result = sendf(sockfd, data,
+      result = sendf(data,
                      "CLIENT " LIBCURL_NAME " " LIBCURL_VERSION "\r\n"
                      "%s\r\n"
                      "QUIT\r\n", ppath);
@@ -308,13 +261,37 @@ static CURLcode dict_do(struct Curl_easy *data, bool *done)
         goto error;
       }
 
-      Curl_setup_transfer(data, FIRSTSOCKET, -1, FALSE, -1);
+      Curl_xfer_setup_recv(data, FIRSTSOCKET, -1);
     }
   }
 
 error:
-  free(eword);
-  free(path);
+  curlx_free(eword);
+  curlx_free(path);
   return result;
 }
+
+/*
+ * DICT protocol
+ */
+const struct Curl_protocol Curl_protocol_dict = {
+  ZERO_NULL,                            /* setup_connection */
+  dict_do,                              /* do_it */
+  ZERO_NULL,                            /* done */
+  ZERO_NULL,                            /* do_more */
+  ZERO_NULL,                            /* connect_it */
+  ZERO_NULL,                            /* connecting */
+  ZERO_NULL,                            /* doing */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
+  ZERO_NULL,                            /* disconnect */
+  ZERO_NULL,                            /* write_resp */
+  ZERO_NULL,                            /* write_resp_hd */
+  ZERO_NULL,                            /* connection_is_dead */
+  ZERO_NULL,                            /* attach connection */
+  ZERO_NULL,                            /* follow */
+};
+
 #endif /* CURL_DISABLE_DICT */
diff --git a/third-party/curl/lib/dict.h b/third-party/curl/lib/dict.h
index ba9a92719b..5bdfcff816 100644
--- a/third-party/curl/lib/dict.h
+++ b/third-party/curl/lib/dict.h
@@ -23,9 +23,8 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #ifndef CURL_DISABLE_DICT
-extern const struct Curl_handler Curl_handler_dict;
+extern const struct Curl_protocol Curl_protocol_dict;
 #endif
 
 #endif /* HEADER_CURL_DICT_H */
diff --git a/third-party/curl/lib/dllmain.c b/third-party/curl/lib/dllmain.c
new file mode 100644
index 0000000000..5aa6565010
--- /dev/null
+++ b/third-party/curl/lib/dllmain.c
@@ -0,0 +1,64 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef USE_OPENSSL
+#include <openssl/crypto.h>
+#endif
+
+/* DllMain() must only be defined for Windows DLL builds. */
+#if defined(_WIN32) && !defined(CURL_STATICLIB)
+
+#if defined(USE_OPENSSL) && \
+  !defined(OPENSSL_IS_AWSLC) && !defined(OPENSSL_IS_BORINGSSL) && \
+  !defined(LIBRESSL_VERSION_NUMBER)
+#define PREVENT_OPENSSL_MEMLEAK
+#endif
+
+#ifdef PREVENT_OPENSSL_MEMLEAK
+BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved);
+BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
+{
+  (void)hinstDLL;
+  (void)lpvReserved;
+
+  switch(fdwReason) {
+  case DLL_PROCESS_ATTACH:
+    break;
+  case DLL_PROCESS_DETACH:
+    break;
+  case DLL_THREAD_ATTACH:
+    break;
+  case DLL_THREAD_DETACH:
+    /* Call OPENSSL_thread_stop to prevent a memory leak in case OpenSSL is
+       linked statically.
+       https://github.com/curl/curl/issues/12327#issuecomment-1826405944 */
+    OPENSSL_thread_stop();
+    break;
+  }
+  return TRUE;
+}
+#endif /* USE_OPENSSL (non-fork) */
+
+#endif /* _WIN32 && !CURL_STATICLIB */
diff --git a/third-party/curl/lib/dnscache.c b/third-party/curl/lib/dnscache.c
new file mode 100644
index 0000000000..9c8341e56f
--- /dev/null
+++ b/third-party/curl/lib/dnscache.c
@@ -0,0 +1,859 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_NETINET_IN6_H
+#include <netinet/in6.h>
+#endif
+#ifdef HAVE_NETDB_H
+#include <netdb.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+#ifdef __VMS
+#include <in.h>
+#include <inet.h>
+#endif
+
+#include "urldata.h"
+#include "curl_addrinfo.h"
+#include "curl_share.h"
+#include "curl_trc.h"
+#include "dnscache.h"
+#include "hash.h"
+#include "hostip.h"
+#include "httpsrr.h"
+#include "progress.h"
+#include "rand.h"
+#include "strcase.h"
+#include "curlx/inet_ntop.h"
+#include "curlx/inet_pton.h"
+#include "curlx/strcopy.h"
+#include "curlx/strparse.h"
+
+#define MAX_HOSTCACHE_LEN (255 + 7) /* max FQDN + colon + port number + zero */
+
+#define MAX_DNS_CACHE_SIZE 29999
+
+static void dnscache_entry_free(struct Curl_dns_entry *dns)
+{
+  Curl_freeaddrinfo(dns->addr);
+#ifdef USE_HTTPSRR
+  if(dns->hinfo) {
+    Curl_httpsrr_cleanup(dns->hinfo);
+    curlx_free(dns->hinfo);
+  }
+#endif
+  curlx_free(dns);
+}
+
+/*
+ * Create a hostcache id string for the provided host + port, to be used by
+ * the DNS caching. Without alloc. Return length of the id string.
+ */
+static size_t create_dnscache_id(const char *name,
+                                 size_t nlen, /* 0 or actual name length */
+                                 uint16_t port, char *ptr, size_t buflen)
+{
+  size_t len = nlen ? nlen : strlen(name);
+  DEBUGASSERT(buflen >= MAX_HOSTCACHE_LEN);
+  if(len > (buflen - 7))
+    len = buflen - 7;
+  /* store and lower case the name */
+  Curl_strntolower(ptr, name, len);
+  return curl_msnprintf(&ptr[len], 7, ":%u", port) + len;
+}
+
+struct dnscache_prune_data {
+  struct curltime now;
+  timediff_t oldest_ms; /* oldest time in cache not pruned. */
+  timediff_t max_age_ms;
+};
+
+/*
+ * This function is set as a callback to be called for every entry in the DNS
+ * cache when we want to prune old unused entries.
+ *
+ * Returning non-zero means remove the entry, return 0 to keep it in the
+ * cache.
+ */
+static int dnscache_entry_is_stale(void *datap, void *hc)
+{
+  struct dnscache_prune_data *prune = (struct dnscache_prune_data *)datap;
+  struct Curl_dns_entry *dns = (struct Curl_dns_entry *)hc;
+
+  if(dns->timestamp.tv_sec || dns->timestamp.tv_usec) {
+    /* get age in milliseconds */
+    timediff_t age = curlx_ptimediff_ms(&prune->now, &dns->timestamp);
+    if(!dns->addr)
+      age *= 2; /* negative entries age twice as fast */
+    if(age >= prune->max_age_ms)
+      return TRUE;
+    if(age > prune->oldest_ms)
+      prune->oldest_ms = age;
+  }
+  return FALSE;
+}
+
+/*
+ * Prune the DNS cache. This assumes that a lock has already been taken.
+ * Returns the 'age' of the oldest still kept entry - in milliseconds.
+ */
+static timediff_t dnscache_prune(struct Curl_hash *hostcache,
+                                 timediff_t cache_timeout_ms,
+                                 struct curltime now)
+{
+  struct dnscache_prune_data user;
+
+  user.max_age_ms = cache_timeout_ms;
+  user.now = now;
+  user.oldest_ms = 0;
+
+  Curl_hash_clean_with_criterium(hostcache,
+                                 (void *)&user,
+                                 dnscache_entry_is_stale);
+
+  return user.oldest_ms;
+}
+
+static struct Curl_dnscache *dnscache_get(struct Curl_easy *data)
+{
+  if(data->share && data->share->specifier & (1 << CURL_LOCK_DATA_DNS))
+    return &data->share->dnscache;
+  if(data->multi)
+    return &data->multi->dnscache;
+  return NULL;
+}
+
+static void dnscache_lock(struct Curl_easy *data,
+                          struct Curl_dnscache *dnscache)
+{
+  if(data->share && dnscache == &data->share->dnscache)
+    Curl_share_lock(data, CURL_LOCK_DATA_DNS, CURL_LOCK_ACCESS_SINGLE);
+}
+
+static void dnscache_unlock(struct Curl_easy *data,
+                            struct Curl_dnscache *dnscache)
+{
+  if(data->share && dnscache == &data->share->dnscache)
+    Curl_share_unlock(data, CURL_LOCK_DATA_DNS);
+}
+
+/*
+ * Library-wide function for pruning the DNS cache. This function takes and
+ * returns the appropriate locks.
+ */
+void Curl_dnscache_prune(struct Curl_easy *data)
+{
+  struct Curl_dnscache *dnscache = dnscache_get(data);
+  /* the timeout may be set -1 (forever) */
+  timediff_t timeout_ms = data->set.dns_cache_timeout_ms;
+
+  if(!dnscache || (timeout_ms == -1))
+    /* NULL hostcache means we cannot do it */
+    return;
+
+  dnscache_lock(data, dnscache);
+
+  do {
+    /* Remove outdated and unused entries from the hostcache */
+    timediff_t oldest_ms =
+      dnscache_prune(&dnscache->entries, timeout_ms, *Curl_pgrs_now(data));
+
+    if(Curl_hash_count(&dnscache->entries) > MAX_DNS_CACHE_SIZE)
+      /* prune the ones over half this age */
+      timeout_ms = oldest_ms / 2;
+    else
+      break;
+
+    /* if the cache size is still too big, use the oldest age as new prune
+       limit */
+  } while(timeout_ms);
+
+  dnscache_unlock(data, dnscache);
+}
+
+void Curl_dnscache_clear(struct Curl_easy *data)
+{
+  struct Curl_dnscache *dnscache = dnscache_get(data);
+  if(dnscache) {
+    dnscache_lock(data, dnscache);
+    Curl_hash_clean(&dnscache->entries);
+    dnscache_unlock(data, dnscache);
+  }
+}
+
+/* lookup address, returns entry if found and not stale */
+static CURLcode fetch_addr(struct Curl_easy *data,
+                           struct Curl_dnscache *dnscache,
+                           uint8_t dns_queries,
+                           const char *hostname,
+                           uint16_t port,
+                           struct Curl_dns_entry **pdns)
+{
+  struct Curl_dns_entry *dns = NULL;
+  char entry_id[MAX_HOSTCACHE_LEN];
+  size_t entry_len;
+  CURLcode result = CURLE_OK;
+
+  *pdns = NULL;
+  if(!dnscache)
+    return CURLE_OK;
+
+  /* Create an entry id, based upon the hostname and port */
+  entry_len = create_dnscache_id(hostname, 0, port,
+                                 entry_id, sizeof(entry_id));
+
+  /* See if it is already in our dns cache */
+  dns = Curl_hash_pick(&dnscache->entries, entry_id, entry_len + 1);
+
+  /* No entry found in cache, check if we might have a wildcard entry */
+  if(!dns && data->state.wildcard_resolve) {
+    entry_len = create_dnscache_id("*", 1, port, entry_id, sizeof(entry_id));
+
+    /* See if it is already in our dns cache */
+    dns = Curl_hash_pick(&dnscache->entries, entry_id, entry_len + 1);
+  }
+
+  if(dns && (data->set.dns_cache_timeout_ms != -1)) {
+    /* See whether the returned entry is stale. Done before we release lock */
+    struct dnscache_prune_data user;
+
+    user.now = *Curl_pgrs_now(data);
+    user.max_age_ms = data->set.dns_cache_timeout_ms;
+    user.oldest_ms = 0;
+
+    if(dnscache_entry_is_stale(&user, dns)) {
+      infof(data, "Hostname in DNS cache was stale, zapped");
+      dns = NULL; /* the memory deallocation is being handled by the hash */
+      Curl_hash_delete(&dnscache->entries, entry_id, entry_len + 1);
+    }
+  }
+
+  if(dns) {
+    if((dns->dns_queries & dns_queries) != dns_queries) {
+      /* The entry does not cover all wanted DNS queries, a miss. */
+      dns = NULL;
+    }
+    else if(!(dns->dns_responses & dns_queries)) {
+      /* The entry has no responses for the wanted DNS queries. */
+      CURL_TRC_DNS(data, "cache entry does not have type=%s addresses",
+                   Curl_resolv_query_str(dns_queries));
+      dns = NULL;
+      result = CURLE_COULDNT_RESOLVE_HOST;
+    }
+  }
+
+  if(dns && !dns->addr) { /* negative entry */
+    dns = NULL;
+    result = CURLE_COULDNT_RESOLVE_HOST;
+  }
+  *pdns = dns;
+  return result;
+}
+
+/*
+ * Curl_dnscache_get() fetches a 'Curl_dns_entry' already in the DNS cache.
+ *
+ * Curl_resolv() checks initially and multi_runsingle() checks each time
+ * it discovers the handle in the state WAITRESOLVE whether the hostname
+ * has already been resolved and the address has already been stored in
+ * the DNS cache. This short circuits waiting for a lot of pending
+ * lookups for the same hostname requested by different handles.
+ *
+ * Returns the Curl_dns_entry entry pointer or NULL if not in the cache.
+ *
+ * The returned data *MUST* be "released" with Curl_dns_entry_unlink() after
+ * use, or we will leak memory!
+ */
+CURLcode Curl_dnscache_get(struct Curl_easy *data,
+                           uint8_t dns_queries,
+                           const char *hostname,
+                           uint16_t port,
+                           struct Curl_dns_entry **pentry)
+{
+  struct Curl_dnscache *dnscache = dnscache_get(data);
+  struct Curl_dns_entry *dns = NULL;
+  CURLcode result = CURLE_OK;
+
+  dnscache_lock(data, dnscache);
+  result = fetch_addr(data, dnscache, dns_queries, hostname, port, &dns);
+  if(!result && dns)
+    dns->refcount++; /* we pass out a reference */
+  else if(result) {
+    DEBUGASSERT(!dns);
+    dns = NULL;
+  }
+  dnscache_unlock(data, dnscache);
+
+  *pentry = dns;
+  return result;
+}
+
+#ifndef CURL_DISABLE_SHUFFLE_DNS
+/*
+ * Return # of addresses in a Curl_addrinfo struct
+ */
+static int num_addresses(const struct Curl_addrinfo *addr)
+{
+  int i = 0;
+  while(addr) {
+    addr = addr->ai_next;
+    i++;
+  }
+  return i;
+}
+
+/*
+ * dns_shuffle_addr() shuffles the order of addresses in a 'Curl_addrinfo'
+ * struct by re-linking its linked list.
+ *
+ * The addr argument should be the address of a pointer to the head node of a
+ * `Curl_addrinfo` list and it will be modified to point to the new head after
+ * shuffling.
+ *
+ * Not declared static only to make it easy to use in a unit test!
+ *
+ * @unittest 1608
+ */
+UNITTEST CURLcode dns_shuffle_addr(struct Curl_easy *data,
+                                   struct Curl_addrinfo **addr);
+UNITTEST CURLcode dns_shuffle_addr(struct Curl_easy *data,
+                                   struct Curl_addrinfo **addr)
+{
+  CURLcode result = CURLE_OK;
+  const int num_addrs = num_addresses(*addr);
+
+  if(num_addrs > 1) {
+    struct Curl_addrinfo **nodes;
+    CURL_TRC_DNS(data, "Shuffling %d addresses", num_addrs);
+
+    nodes = curlx_malloc(num_addrs * sizeof(*nodes));
+    if(nodes) {
+      int i;
+      unsigned int *rnd;
+      const size_t rnd_size = num_addrs * sizeof(*rnd);
+
+      /* build a plain array of Curl_addrinfo pointers */
+      nodes[0] = *addr;
+      for(i = 1; i < num_addrs; i++) {
+        nodes[i] = nodes[i - 1]->ai_next;
+      }
+
+      rnd = curlx_malloc(rnd_size);
+      if(rnd) {
+        /* Fisher-Yates shuffle */
+        if(Curl_rand(data, (unsigned char *)rnd, rnd_size) == CURLE_OK) {
+          struct Curl_addrinfo *swap_tmp;
+          for(i = num_addrs - 1; i > 0; i--) {
+            swap_tmp = nodes[rnd[i] % (unsigned int)(i + 1)];
+            nodes[rnd[i] % (unsigned int)(i + 1)] = nodes[i];
+            nodes[i] = swap_tmp;
+          }
+
+          /* relink list in the new order */
+          for(i = 1; i < num_addrs; i++) {
+            nodes[i - 1]->ai_next = nodes[i];
+          }
+
+          nodes[num_addrs - 1]->ai_next = NULL;
+          *addr = nodes[0];
+        }
+        curlx_free(rnd);
+      }
+      else
+        result = CURLE_OUT_OF_MEMORY;
+      curlx_free(nodes);
+    }
+    else
+      result = CURLE_OUT_OF_MEMORY;
+  }
+  return result;
+}
+#endif
+
+static bool dnscache_ai_has_family(struct Curl_addrinfo *ai,
+                                   int ai_family)
+{
+  for(; ai; ai = ai->ai_next) {
+    if(ai->ai_family == ai_family)
+      return TRUE;
+  }
+  return FALSE;
+}
+
+static struct Curl_dns_entry *dnscache_entry_create(
+  struct Curl_easy *data,
+  uint8_t dns_queries,
+  struct Curl_addrinfo **paddr1,
+  struct Curl_addrinfo **paddr2,
+  const char *hostname,
+  size_t hostlen,
+  uint16_t port,
+  bool permanent)
+{
+  struct Curl_dns_entry *dns = NULL;
+
+  /* Create a new cache entry, struct already has the hostname NUL */
+  dns = curlx_calloc(1, sizeof(struct Curl_dns_entry) + hostlen);
+  if(!dns)
+    goto out;
+
+  dns->refcount = 1; /* the cache has the first reference */
+  dns->dns_queries = dns_queries;
+  dns->port = port;
+  if(hostlen)
+    memcpy(dns->hostname, hostname, hostlen);
+
+  if(permanent) {
+    dns->timestamp.tv_sec = 0; /* an entry that never goes stale */
+    dns->timestamp.tv_usec = 0; /* an entry that never goes stale */
+  }
+  else {
+    dns->timestamp = *Curl_pgrs_now(data);
+  }
+
+  /* Take the given address lists into the entry */
+  if(paddr1 && *paddr1) {
+    dns->addr = *paddr1;
+    *paddr1 = NULL;
+  }
+  if(paddr2 && *paddr2) {
+    struct Curl_addrinfo **phead = &dns->addr;
+    while(*phead)
+      phead = &(*phead)->ai_next;
+    *phead = *paddr2;
+    *paddr2 = NULL;
+  }
+
+  if((dns_queries & CURL_DNSQ_A) &&
+     dnscache_ai_has_family(dns->addr, PF_INET))
+    dns->dns_responses |= CURL_DNSQ_A;
+
+#ifdef USE_IPV6
+  if((dns_queries & CURL_DNSQ_AAAA) &&
+     dnscache_ai_has_family(dns->addr, PF_INET6))
+    dns->dns_responses |= CURL_DNSQ_AAAA;
+#endif /* USE_IPV6 */
+
+#ifndef CURL_DISABLE_SHUFFLE_DNS
+  /* shuffle addresses if requested */
+  if(data->set.dns_shuffle_addresses && dns->addr) {
+    CURLcode result = dns_shuffle_addr(data, &dns->addr);
+    if(result) {
+      /* free without lock, we are the sole owner */
+      dnscache_entry_free(dns);
+      dns = NULL;
+      goto out;
+    }
+  }
+#else
+  (void)data;
+#endif
+
+out:
+  if(paddr1 && *paddr1) {
+    Curl_freeaddrinfo(*paddr1);
+    *paddr1 = NULL;
+  }
+  if(paddr2 && *paddr2) {
+    Curl_freeaddrinfo(*paddr2);
+    *paddr2 = NULL;
+  }
+  return dns;
+}
+
+struct Curl_dns_entry *Curl_dnscache_mk_entry(struct Curl_easy *data,
+                                              uint8_t dns_queries,
+                                              struct Curl_addrinfo **paddr,
+                                              const char *hostname,
+                                              uint16_t port)
+{
+  return dnscache_entry_create(data, dns_queries, paddr, NULL, hostname,
+                               hostname ? strlen(hostname) : 0,
+                               port, FALSE);
+}
+
+struct Curl_dns_entry *Curl_dnscache_mk_entry2(struct Curl_easy *data,
+                                               uint8_t dns_queries,
+                                               struct Curl_addrinfo **paddr1,
+                                               struct Curl_addrinfo **paddr2,
+                                               const char *hostname,
+                                               uint16_t port)
+{
+  return dnscache_entry_create(data, dns_queries, paddr1, paddr2, hostname,
+                               hostname ? strlen(hostname) : 0,
+                               port, FALSE);
+}
+
+#ifdef USE_HTTPSRR
+void Curl_dns_entry_set_https_rr(struct Curl_dns_entry *dns,
+                                 struct Curl_https_rrinfo *hinfo)
+{
+  /* only do this when this is the only reference */
+  DEBUGASSERT(dns->refcount == 1);
+  /* it should have been in the queries */
+  DEBUGASSERT(dns->dns_queries & CURL_DNSQ_HTTPS);
+  if(dns->hinfo) {
+    Curl_httpsrr_cleanup(dns->hinfo);
+    curlx_free(dns->hinfo);
+  }
+  dns->hinfo = hinfo;
+  dns->dns_responses |= CURL_DNSQ_HTTPS;
+}
+#endif /* USE_HTTPSRR */
+
+static struct Curl_dns_entry *dnscache_add_addr(struct Curl_easy *data,
+                                                struct Curl_dnscache *dnscache,
+                                                uint8_t dns_queries,
+                                                struct Curl_addrinfo **paddr,
+                                                const char *hostname,
+                                                size_t hlen,
+                                                uint16_t port,
+                                                bool permanent)
+{
+  char entry_id[MAX_HOSTCACHE_LEN];
+  size_t entry_len;
+  struct Curl_dns_entry *dns;
+  struct Curl_dns_entry *dns2;
+
+  dns = dnscache_entry_create(data, dns_queries, paddr, NULL,
+                              hostname, hlen, port, permanent);
+  if(!dns)
+    return NULL;
+
+  /* Create an entry id, based upon the hostname and port */
+  entry_len = create_dnscache_id(hostname, hlen, port,
+                                 entry_id, sizeof(entry_id));
+
+  /* Store the resolved data in our DNS cache. */
+  dns2 = Curl_hash_add(&dnscache->entries, entry_id, entry_len + 1,
+                       (void *)dns);
+  if(!dns2) {
+    dnscache_entry_free(dns);
+    return NULL;
+  }
+
+  dns = dns2;
+  dns->refcount++;         /* mark entry as in-use */
+  return dns;
+}
+
+CURLcode Curl_dnscache_add(struct Curl_easy *data,
+                           struct Curl_dns_entry *entry)
+{
+  struct Curl_dnscache *dnscache = dnscache_get(data);
+  char id[MAX_HOSTCACHE_LEN];
+  size_t idlen;
+
+  if(!dnscache)
+    return CURLE_FAILED_INIT;
+  /* Create an entry id, based upon the hostname and port */
+  idlen = create_dnscache_id(entry->hostname, 0, entry->port, id, sizeof(id));
+
+  /* Store the resolved data in our DNS cache and up ref count */
+  dnscache_lock(data, dnscache);
+  if(!Curl_hash_add(&dnscache->entries, id, idlen + 1, (void *)entry)) {
+    dnscache_unlock(data, dnscache);
+    return CURLE_OUT_OF_MEMORY;
+  }
+  entry->refcount++;
+  dnscache_unlock(data, dnscache);
+  return CURLE_OK;
+}
+
+CURLcode Curl_dnscache_add_negative(struct Curl_easy *data,
+                                    uint8_t dns_queries,
+                                    const char *host,
+                                    uint16_t port)
+{
+  struct Curl_dnscache *dnscache = dnscache_get(data);
+  struct Curl_dns_entry *dns;
+  DEBUGASSERT(dnscache);
+  if(!dnscache)
+    return CURLE_FAILED_INIT;
+
+  dnscache_lock(data, dnscache);
+
+  /* put this new host in the cache */
+  dns = dnscache_add_addr(data, dnscache, dns_queries, NULL,
+                          host, strlen(host), port, FALSE);
+  if(dns) {
+    /* release the returned reference; the cache itself will keep the
+     * entry alive: */
+    dns->refcount--;
+    dnscache_unlock(data, dnscache);
+    CURL_TRC_DNS(data, "cache negative name resolve for %s:%d type=%s",
+                 host, port, Curl_resolv_query_str(dns_queries));
+    return CURLE_OK;
+  }
+  dnscache_unlock(data, dnscache);
+  return CURLE_OUT_OF_MEMORY;
+}
+
+/*
+ * Curl_dns_entry_unlink() releases a reference to the given cached DNS entry.
+ * When the reference count reaches 0, the entry is destroyed. It is important
+ * that only one unlink is made for each Curl_resolv() call.
+ *
+ * May be called with 'data' == NULL for global cache.
+ */
+void Curl_dns_entry_unlink(struct Curl_easy *data,
+                           struct Curl_dns_entry **pdns)
+{
+  if(*pdns) {
+    struct Curl_dnscache *dnscache = dnscache_get(data);
+    struct Curl_dns_entry *dns = *pdns;
+    *pdns = NULL;
+    dnscache_lock(data, dnscache);
+    dns->refcount--;
+    if(dns->refcount == 0)
+      dnscache_entry_free(dns);
+    dnscache_unlock(data, dnscache);
+  }
+}
+
+static void dnscache_entry_dtor(void *entry)
+{
+  struct Curl_dns_entry *dns = (struct Curl_dns_entry *)entry;
+  DEBUGASSERT(dns && (dns->refcount > 0));
+  dns->refcount--;
+  if(dns->refcount == 0)
+    dnscache_entry_free(dns);
+}
+
+/*
+ * Curl_dnscache_init() inits a new DNS cache.
+ */
+void Curl_dnscache_init(struct Curl_dnscache *dns, size_t size)
+{
+  Curl_hash_init(&dns->entries, size, Curl_hash_str, curlx_str_key_compare,
+                 dnscache_entry_dtor);
+}
+
+void Curl_dnscache_destroy(struct Curl_dnscache *dns)
+{
+  Curl_hash_destroy(&dns->entries);
+}
+
+CURLcode Curl_loadhostpairs(struct Curl_easy *data)
+{
+  struct Curl_dnscache *dnscache = dnscache_get(data);
+  struct curl_slist *hostp;
+
+  if(!dnscache)
+    return CURLE_FAILED_INIT;
+
+  /* Default is no wildcard found */
+  data->state.wildcard_resolve = FALSE;
+
+  for(hostp = data->state.resolve; hostp; hostp = hostp->next) {
+    char entry_id[MAX_HOSTCACHE_LEN];
+    const char *host = hostp->data;
+    struct Curl_str source;
+    if(!host)
+      continue;
+    if(*host == '-') {
+      curl_off_t num = 0;
+      size_t entry_len;
+      host++;
+      if(!curlx_str_single(&host, '[')) {
+        if(curlx_str_until(&host, &source, MAX_IPADR_LEN, ']') ||
+           curlx_str_single(&host, ']') ||
+           curlx_str_single(&host, ':'))
+          continue;
+      }
+      else {
+        if(curlx_str_until(&host, &source, 4096, ':') ||
+           curlx_str_single(&host, ':')) {
+          continue;
+        }
+      }
+
+      if(!curlx_str_number(&host, &num, 0xffff)) {
+        /* Create an entry id, based upon the hostname and port */
+        entry_len = create_dnscache_id(curlx_str(&source),
+                                       curlx_strlen(&source), (uint16_t)num,
+                                       entry_id, sizeof(entry_id));
+        dnscache_lock(data, dnscache);
+        /* delete entry, ignore if it did not exist */
+        Curl_hash_delete(&dnscache->entries, entry_id, entry_len + 1);
+        dnscache_unlock(data, dnscache);
+      }
+    }
+    else {
+      struct Curl_dns_entry *dns;
+      struct Curl_addrinfo *head = NULL, *tail = NULL;
+      size_t entry_len;
+      char address[64];
+      curl_off_t tmpofft = 0;
+      uint16_t port = 0;
+      bool permanent = TRUE;
+      bool error = TRUE;
+      VERBOSE(const char *addresses = NULL);
+
+      if(*host == '+') {
+        host++;
+        permanent = FALSE;
+      }
+      if(!curlx_str_single(&host, '[')) {
+        if(curlx_str_until(&host, &source, MAX_IPADR_LEN, ']') ||
+           curlx_str_single(&host, ']'))
+          continue;
+      }
+      else {
+        if(curlx_str_until(&host, &source, 4096, ':'))
+          continue;
+      }
+      if(curlx_str_single(&host, ':') ||
+         curlx_str_number(&host, &tmpofft, 0xffff) ||
+         curlx_str_single(&host, ':'))
+        goto err;
+      port = (uint16_t)tmpofft;
+
+      VERBOSE(addresses = host);
+
+      /* start the address section */
+      while(*host) {
+        struct Curl_str target;
+        struct Curl_addrinfo *ai;
+        CURLcode result;
+
+        if(!curlx_str_single(&host, '[')) {
+          if(curlx_str_until(&host, &target, MAX_IPADR_LEN, ']') ||
+             curlx_str_single(&host, ']'))
+            goto err;
+        }
+        else {
+          if(curlx_str_until(&host, &target, 4096, ',')) {
+            if(curlx_str_single(&host, ','))
+              goto err;
+            /* survive nothing but a comma */
+            continue;
+          }
+        }
+#ifndef USE_IPV6
+        if(memchr(curlx_str(&target), ':', curlx_strlen(&target))) {
+          infof(data, "Ignoring resolve address '%.*s', missing IPv6 support.",
+                (int)curlx_strlen(&target), curlx_str(&target));
+          if(curlx_str_single(&host, ','))
+            goto err;
+          continue;
+        }
+#endif
+
+        if(curlx_strlen(&target) >= sizeof(address))
+          goto err;
+
+        memcpy(address, curlx_str(&target), curlx_strlen(&target));
+        address[curlx_strlen(&target)] = '\0';
+
+        result = Curl_str2addr(address, port, &ai);
+        if(result) {
+          infof(data, "Resolve IP address '%s' found is illegal", address);
+          goto err;
+        }
+
+        if(tail) {
+          tail->ai_next = ai;
+          tail = tail->ai_next;
+        }
+        else {
+          head = tail = ai;
+        }
+        if(curlx_str_single(&host, ','))
+          break;
+      }
+
+      if(!head)
+        goto err;
+
+      error = FALSE;
+err:
+      if(error) {
+        failf(data, "Could not parse CURLOPT_RESOLVE entry '%s'", hostp->data);
+        Curl_freeaddrinfo(head);
+        return CURLE_SETOPT_OPTION_SYNTAX;
+      }
+
+      /* Create an entry id, based upon the hostname and port */
+      entry_len = create_dnscache_id(curlx_str(&source), curlx_strlen(&source),
+                                     port, entry_id, sizeof(entry_id));
+
+      dnscache_lock(data, dnscache);
+
+      /* See if it is already in our dns cache */
+      dns = Curl_hash_pick(&dnscache->entries, entry_id, entry_len + 1);
+
+      if(dns) {
+        infof(data, "RESOLVE %.*s:%u - old addresses discarded",
+              (int)curlx_strlen(&source),
+              curlx_str(&source), port);
+        /* delete old entry, there are two reasons for this
+         1. old entry may have different addresses.
+         2. even if entry with correct addresses is already in the cache,
+            but if it is close to expire, then by the time next http
+            request is made, it can get expired and pruned because old
+            entry is not necessarily marked as permanent.
+         3. when adding a non-permanent entry, we want it to remove and
+            replace an existing permanent entry.
+         4. when adding a non-permanent entry, we want it to get a "fresh"
+            timeout that starts _now_. */
+
+        Curl_hash_delete(&dnscache->entries, entry_id, entry_len + 1);
+      }
+
+      /* put this new host in the cache, an override for ALL dns queries */
+      dns = dnscache_add_addr(data, dnscache, CURL_DNSQ_ALL,
+                              &head, curlx_str(&source),
+                              curlx_strlen(&source), port, permanent);
+      if(dns)
+        /* release the returned reference; the cache itself will keep the
+         * entry alive: */
+        dns->refcount--;
+
+      dnscache_unlock(data, dnscache);
+
+      if(!dns)
+        return CURLE_OUT_OF_MEMORY;
+
+      infof(data, "Added %.*s:%u:%s to DNS cache%s",
+            (int)curlx_strlen(&source), curlx_str(&source), port, addresses,
+            permanent ? "" : " (non-permanent)");
+
+      /* Wildcard hostname */
+      if(curlx_str_casecompare(&source, "*")) {
+        infof(data, "RESOLVE *:%u using wildcard", port);
+        data->state.wildcard_resolve = TRUE;
+      }
+    }
+  }
+  data->state.resolve = NULL; /* dealt with now */
+
+  return CURLE_OK;
+}
diff --git a/third-party/curl/lib/dnscache.h b/third-party/curl/lib/dnscache.h
new file mode 100644
index 0000000000..9239977cf8
--- /dev/null
+++ b/third-party/curl/lib/dnscache.h
@@ -0,0 +1,138 @@
+#ifndef HEADER_CURL_DNSCACHE_H
+#define HEADER_CURL_DNSCACHE_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "hash.h"
+#include "curlx/timeval.h"
+
+struct addrinfo;
+struct hostent;
+struct Curl_easy;
+struct connectdata;
+struct easy_pollset;
+struct Curl_https_rrinfo;
+struct Curl_multi;
+
+struct Curl_dns_entry {
+  struct Curl_addrinfo *addr;
+#ifdef USE_HTTPSRR
+  struct Curl_https_rrinfo *hinfo;
+#endif
+  /* timestamp == 0 -- permanent CURLOPT_RESOLVE entry (does not time out) */
+  struct curltime timestamp;
+  /* reference counter, entry is freed on reaching 0 */
+  uint32_t refcount;
+  /* hostname port number that resolved to addr. */
+  uint16_t port;
+  uint8_t dns_queries; /* CURL_DNSQ_* type of queries performed for this */
+  uint8_t dns_responses; /* CURL_DNSQ_* type this entry has responses for */
+  /* hostname that resolved to addr. may be NULL (Unix domain sockets). */
+  char hostname[1];
+};
+
+/*
+ * Create a `Curl_dns_entry` with a reference count of 1.
+ * Use `Curl_dns_entry_unlink()` to release your hold on it.
+ *
+ * The call takes ownership of `paddr`, even in case of failure, and always
+ * clears `*paddr`. It makes a copy of `hostname`.
+ *
+ * Returns entry or NULL on OOM.
+ */
+struct Curl_dns_entry *Curl_dnscache_mk_entry(struct Curl_easy *data,
+                                              uint8_t dns_queries,
+                                              struct Curl_addrinfo **paddr,
+                                              const char *hostname,
+                                              uint16_t port);
+
+struct Curl_dns_entry *Curl_dnscache_mk_entry2(struct Curl_easy *data,
+                                               uint8_t dns_queries,
+                                               struct Curl_addrinfo **paddr1,
+                                               struct Curl_addrinfo **paddr2,
+                                               const char *hostname,
+                                               uint16_t port);
+
+#ifdef USE_HTTPSRR
+void Curl_dns_entry_set_https_rr(struct Curl_dns_entry *dns,
+                                 struct Curl_https_rrinfo *hinfo);
+#endif /* USE_HTTPSRR */
+
+/* unlink a dns entry, frees all resources if it was the last reference.
+ * Always clears `*pdns`` */
+void Curl_dns_entry_unlink(struct Curl_easy *data,
+                           struct Curl_dns_entry **pdns);
+
+struct Curl_dnscache {
+  struct Curl_hash entries;
+};
+
+/* init a new dns cache */
+void Curl_dnscache_init(struct Curl_dnscache *dns, size_t size);
+
+void Curl_dnscache_destroy(struct Curl_dnscache *dns);
+
+/* prune old entries from the DNS cache */
+void Curl_dnscache_prune(struct Curl_easy *data);
+
+/* clear the DNS cache */
+void Curl_dnscache_clear(struct Curl_easy *data);
+
+/*
+ * Curl_dnscache_get() fetches a 'Curl_dns_entry' already in the DNS cache.
+ *
+ * Returns the Curl_dns_entry entry pointer or NULL if not in the cache.
+ *
+ * The returned data *MUST* be "released" with Curl_dns_entry_unlink() after
+ * use, or we will leak memory!
+ * Returns CURLE_OK or CURLE_COULDNT_RESOLVE_HOST when a negative
+ * entry was in the cache.
+ */
+CURLcode Curl_dnscache_get(struct Curl_easy *data,
+                           uint8_t dns_queries,
+                           const char *hostname,
+                           uint16_t port,
+                           struct Curl_dns_entry **pentry);
+
+/*
+ * Curl_dnscache_addr() adds `entry` to the cache, increasing its
+ * reference count on success.
+ */
+CURLcode Curl_dnscache_add(struct Curl_easy *data,
+                           struct Curl_dns_entry *entry);
+
+/* Store a "negative" entry for host:port, e.g. remember that
+ * it could not be resolved. */
+CURLcode Curl_dnscache_add_negative(struct Curl_easy *data,
+                                    uint8_t dns_queries,
+                                    const char *host,
+                                    uint16_t port);
+
+/*
+ * Populate the cache with specified entries from CURLOPT_RESOLVE.
+ */
+CURLcode Curl_loadhostpairs(struct Curl_easy *data);
+
+#endif /* HEADER_CURL_DNSCACHE_H */
diff --git a/third-party/curl/lib/doh.c b/third-party/curl/lib/doh.c
index 7a38eab01f..8b643aa0b4 100644
--- a/third-party/curl/lib/doh.c
+++ b/third-party/curl/lib/doh.c
@@ -21,7 +21,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifndef CURL_DISABLE_DOH
@@ -29,24 +28,23 @@
 #include "urldata.h"
 #include "curl_addrinfo.h"
 #include "doh.h"
-
-#include "sendf.h"
+#include "curl_trc.h"
+#include "httpsrr.h"
 #include "multiif.h"
 #include "url.h"
-#include "share.h"
-#include "curl_base64.h"
 #include "connect.h"
-#include "strdup.h"
-#include "dynbuf.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curlx/strdup.h"
+#include "curlx/dynbuf.h"
+#include "escape.h"  /* for Curl_hexencode() */
+#include "urlapi-int.h"
 
 #define DNS_CLASS_IN 0x01
 
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-static const char * const errors[]={
+static void doh_close(struct Curl_easy *data,
+                      struct Curl_resolv_async *async);
+
+#ifdef CURLVERBOSE
+static const char * const errors[] = {
   "",
   "Bad label",
   "Out of range",
@@ -69,36 +67,42 @@ static const char *doh_strerror(DOHcode code)
     return errors[code];
   return "bad error code";
 }
-#endif
+
+#endif /* CURLVERBOSE */
 
 /* @unittest 1655
  */
-UNITTEST DOHcode doh_encode(const char *host,
-                            DNStype dnstype,
-                            unsigned char *dnsp, /* buffer */
-                            size_t len,  /* buffer size */
-                            size_t *olen) /* output length */
+UNITTEST DOHcode doh_req_encode(const char *host,
+                                DNStype dnstype,
+                                unsigned char *dnsp,  /* buffer */
+                                size_t len,  /* buffer size */
+                                size_t *olen);  /* output length */
+UNITTEST DOHcode doh_req_encode(const char *host,
+                                DNStype dnstype,
+                                unsigned char *dnsp, /* buffer */
+                                size_t len,   /* buffer size */
+                                size_t *olen) /* output length */
 {
   const size_t hostlen = strlen(host);
   unsigned char *orig = dnsp;
   const char *hostp = host;
 
   /* The expected output length is 16 bytes more than the length of
-   * the QNAME-encoding of the host name.
+   * the QNAME-encoding of the hostname.
    *
    * A valid DNS name may not contain a zero-length label, except at
-   * the end.  For this reason, a name beginning with a dot, or
+   * the end. For this reason, a name beginning with a dot, or
    * containing a sequence of two or more consecutive dots, is invalid
    * and cannot be encoded as a QNAME.
    *
-   * If the host name ends with a trailing dot, the corresponding
-   * QNAME-encoding is one byte longer than the host name. If (as is
+   * If the hostname ends with a trailing dot, the corresponding
+   * QNAME-encoding is one byte longer than the hostname. If (as is
    * also valid) the hostname is shortened by the omission of the
    * trailing dot, then its QNAME-encoding will be two bytes longer
-   * than the host name.
+   * than the hostname.
    *
    * Each [ label, dot ] pair is encoded as [ length, label ],
-   * preserving overall length.  A final [ label ] without a dot is
+   * preserving overall length. A final [ label ] without a dot is
    * also encoded as [ length, label ], increasing overall length
    * by one. The encoding is completed by appending a zero byte,
    * representing the zero-length root label, again increasing
@@ -108,16 +112,16 @@ UNITTEST DOHcode doh_encode(const char *host,
   size_t expected_len;
   DEBUGASSERT(hostlen);
   expected_len = 12 + 1 + hostlen + 4;
-  if(host[hostlen-1]!='.')
+  if(host[hostlen - 1] != '.')
     expected_len++;
 
-  if(expected_len > (256 + 16)) /* RFCs 1034, 1035 */
+  if(expected_len > DOH_MAX_DNSREQ_SIZE)
     return DOH_DNS_NAME_TOO_LONG;
 
   if(len < expected_len)
     return DOH_TOO_SMALL_BUFFER;
 
-  *dnsp++ = 0; /* 16 bit id */
+  *dnsp++ = 0; /* 16-bit id */
   *dnsp++ = 0;
   *dnsp++ = 0x01; /* |QR|   Opcode  |AA|TC|RD| Set the RD bit */
   *dnsp++ = '\0'; /* |RA|   Z    |   RCODE   |                */
@@ -133,7 +137,7 @@ UNITTEST DOHcode doh_encode(const char *host,
   /* encode each label and store it in the QNAME */
   while(*hostp) {
     size_t labellen;
-    char *dot = strchr(hostp, '.');
+    const char *dot = strchr(hostp, '.');
     if(dot)
       labellen = dot - hostp;
     else
@@ -155,11 +159,11 @@ UNITTEST DOHcode doh_encode(const char *host,
 
   *dnsp++ = 0; /* append zero-length label for root */
 
-  /* There are assigned TYPE codes beyond 255: use range [1..65535]  */
-  *dnsp++ = (unsigned char)(255 & (dnstype>>8)); /* upper 8 bit TYPE */
-  *dnsp++ = (unsigned char)(255 & dnstype);      /* lower 8 bit TYPE */
+  /* There are assigned TYPE codes beyond 255: use range [1..65535] */
+  *dnsp++ = (unsigned char)(255 & (dnstype >> 8)); /* upper 8-bit TYPE */
+  *dnsp++ = (unsigned char)(255 & dnstype);        /* lower 8-bit TYPE */
 
-  *dnsp++ = '\0'; /* upper 8 bit CLASS */
+  *dnsp++ = '\0'; /* upper 8-bit CLASS */
   *dnsp++ = DNS_CLASS_IN; /* IN - "the Internet" */
 
   *olen = dnsp - orig;
@@ -170,257 +174,366 @@ UNITTEST DOHcode doh_encode(const char *host,
   return DOH_OK;
 }
 
-static size_t
-doh_write_cb(const void *contents, size_t size, size_t nmemb, void *userp)
+static size_t doh_probe_write_cb(char *contents, size_t size, size_t nmemb,
+                                 void *userp)
 {
   size_t realsize = size * nmemb;
-  struct dynbuf *mem = (struct dynbuf *)userp;
+  struct Curl_easy *data = userp;
+  struct doh_request *doh_req = Curl_meta_get(data, CURL_EZM_DOH_PROBE);
+  if(!doh_req)
+    return CURL_WRITEFUNC_ERROR;
 
-  if(Curl_dyn_addn(mem, contents, realsize))
+  if(curlx_dyn_addn(&doh_req->resp_body, contents, realsize))
     return 0;
 
   return realsize;
 }
 
-/* called from multi.c when this DoH transfer is complete */
-static int doh_done(struct Curl_easy *doh, CURLcode result)
+#if defined(USE_HTTPSRR) && defined(DEBUGBUILD) && defined(CURLVERBOSE)
+
+/* doh_print_buf truncates if the hex string will be more than this */
+#define LOCAL_PB_HEXMAX 400
+
+static void doh_print_buf(struct Curl_easy *data,
+                          const char *prefix,
+                          unsigned char *buf, size_t len)
 {
-  struct Curl_easy *data = doh->set.dohfor;
-  struct dohdata *dohp = data->req.doh;
-  /* so one of the DoH request done for the 'data' transfer is now complete! */
+  unsigned char hexstr[LOCAL_PB_HEXMAX];
+  size_t hlen = LOCAL_PB_HEXMAX;
+  bool truncated = FALSE;
+
+  if(len > (LOCAL_PB_HEXMAX / 2))
+    truncated = TRUE;
+  Curl_hexencode(buf, len, hexstr, hlen);
+  if(!truncated)
+    infof(data, "%s: len=%d, val=%s", prefix, (int)len, hexstr);
+  else
+    infof(data, "%s: len=%d (truncated)val=%s", prefix, (int)len, hexstr);
+}
+#endif
+
+/* called from multi when a sub transfer, e.g. doh probe, is done.
+ * This looks up the probe response at its meta CURL_EZM_DOH_PROBE
+ * and copies the response body over to the struct at the master's
+ * meta at CURL_EZM_DOH_MASTER. */
+static void doh_probe_done(struct Curl_easy *data,
+                           struct Curl_easy *doh, CURLcode result)
+{
+  struct Curl_resolv_async *async = NULL;
+  struct doh_probes *dohp = NULL;
+  struct doh_request *doh_req = NULL;
+  int i;
+
+  doh_req = Curl_meta_get(doh, CURL_EZM_DOH_PROBE);
+  if(!doh_req) {
+    DEBUGASSERT(0);
+    return;
+  }
+
+  async = Curl_async_get(data, doh_req->resolv_id);
+  if(!async) {
+    CURL_TRC_DNS(data, "[%u] ignoring outdated DoH response",
+                 doh_req->resolv_id);
+    return;
+  }
+  dohp = async->doh;
+
+  for(i = 0; i < DOH_SLOT_COUNT; ++i) {
+    if(dohp->probe_resp[i].probe_mid == doh->mid)
+      break;
+  }
+  /* We really should have found the slot where to store the response */
+  if(i >= DOH_SLOT_COUNT) {
+    DEBUGASSERT(0);
+    failf(data, "DoH: unknown sub request done");
+    return;
+  }
+
   dohp->pending--;
-  infof(data, "a DoH request is completed, %u to go", dohp->pending);
+  infof(doh, "a DoH request is completed, %u to go", dohp->pending);
+  dohp->probe_resp[i].result = result;
+  /* We expect either the meta data still to exist or the sub request
+   * to have already failed. */
+  if(!result) {
+    dohp->probe_resp[i].dnstype = doh_req->dnstype;
+    result = curlx_dyn_addn(&dohp->probe_resp[i].body,
+                            curlx_dyn_ptr(&doh_req->resp_body),
+                            curlx_dyn_len(&doh_req->resp_body));
+  }
+  Curl_meta_remove(doh, CURL_EZM_DOH_PROBE);
+
   if(result)
-    infof(data, "DoH request %s", curl_easy_strerror(result));
+    infof(doh, "DoH request %s", curl_easy_strerror(result));
 
   if(!dohp->pending) {
-    /* DoH completed */
-    curl_slist_free_all(dohp->headers);
-    dohp->headers = NULL;
-    Curl_expire(data, 0, EXPIRE_RUN_NOW);
+    /* DoH completed, run the transfer picking up the results */
+    Curl_multi_mark_dirty(data);
   }
-  return 0;
 }
 
-#define ERROR_CHECK_SETOPT(x,y) \
-do {                                          \
-  result = curl_easy_setopt(doh, x, y);       \
-  if(result &&                                \
-     result != CURLE_NOT_BUILT_IN &&          \
-     result != CURLE_UNKNOWN_OPTION)          \
-    goto error;                               \
-} while(0)
+static void doh_probe_dtor(void *key, size_t klen, void *e)
+{
+  (void)key;
+  (void)klen;
+  if(e) {
+    struct doh_request *doh_req = e;
+    curl_slist_free_all(doh_req->req_hds);
+    curlx_dyn_free(&doh_req->resp_body);
+    curlx_free(e);
+  }
+}
 
-static CURLcode dohprobe(struct Curl_easy *data,
-                         struct dnsprobe *p, DNStype dnstype,
-                         const char *host,
-                         const char *url, CURLM *multi,
-                         struct curl_slist *headers)
+#define ERROR_CHECK_SETOPT(x, y)                        \
+  do {                                                  \
+    result = curl_easy_setopt((CURL *)doh, x, y);       \
+    if(result &&                                        \
+       result != CURLE_NOT_BUILT_IN &&                  \
+       result != CURLE_UNKNOWN_OPTION)                  \
+      goto error;                                       \
+  } while(0)
+
+static CURLcode doh_probe_run(struct Curl_easy *data,
+                              DNStype dnstype,
+                              const char *host,
+                              const char *url, CURLM *multi,
+                              uint32_t resolv_id,
+                              uint32_t *pmid)
 {
   struct Curl_easy *doh = NULL;
-  char *nurl = NULL;
   CURLcode result = CURLE_OK;
   timediff_t timeout_ms;
-  DOHcode d = doh_encode(host, dnstype, p->dohbuffer, sizeof(p->dohbuffer),
-                         &p->dohlen);
-  if(d) {
-    failf(data, "Failed to encode DoH packet [%d]", d);
+  struct doh_request *doh_req;
+  DOHcode d;
+
+  *pmid = UINT32_MAX;
+
+  doh_req = curlx_calloc(1, sizeof(*doh_req));
+  if(!doh_req)
     return CURLE_OUT_OF_MEMORY;
+  doh_req->resolv_id = resolv_id;
+  doh_req->dnstype = dnstype;
+  curlx_dyn_init(&doh_req->resp_body, DYN_DOH_RESPONSE);
+
+  d = doh_req_encode(host, dnstype, doh_req->req_body,
+                     sizeof(doh_req->req_body),
+                     &doh_req->req_body_len);
+  if(d) {
+    failf(data, "Failed to encode DoH packet [%d]", (int)d);
+    result = CURLE_OUT_OF_MEMORY;
+    goto error;
   }
 
-  p->dnstype = dnstype;
-  Curl_dyn_init(&p->serverdoh, DYN_DOH_RESPONSE);
-
-  timeout_ms = Curl_timeleft(data, NULL, TRUE);
-  if(timeout_ms <= 0) {
+  timeout_ms = Curl_timeleft_ms(data);
+  if(timeout_ms < 0) {
     result = CURLE_OPERATION_TIMEDOUT;
     goto error;
   }
+
+  doh_req->req_hds =
+    curl_slist_append(NULL, "Content-Type: application/dns-message");
+  if(!doh_req->req_hds) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto error;
+  }
+
   /* Curl_open() is the internal version of curl_easy_init() */
   result = Curl_open(&doh);
-  if(!result) {
-    /* pass in the struct pointer via a local variable to please coverity and
-       the gcc typecheck helpers */
-    struct dynbuf *resp = &p->serverdoh;
-    ERROR_CHECK_SETOPT(CURLOPT_URL, url);
-    ERROR_CHECK_SETOPT(CURLOPT_DEFAULT_PROTOCOL, "https");
-    ERROR_CHECK_SETOPT(CURLOPT_WRITEFUNCTION, doh_write_cb);
-    ERROR_CHECK_SETOPT(CURLOPT_WRITEDATA, resp);
-    ERROR_CHECK_SETOPT(CURLOPT_POSTFIELDS, p->dohbuffer);
-    ERROR_CHECK_SETOPT(CURLOPT_POSTFIELDSIZE, (long)p->dohlen);
-    ERROR_CHECK_SETOPT(CURLOPT_HTTPHEADER, headers);
-#ifdef USE_HTTP2
-    ERROR_CHECK_SETOPT(CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2TLS);
-#endif
-#ifndef CURLDEBUG
-    /* enforce HTTPS if not debug */
-    ERROR_CHECK_SETOPT(CURLOPT_PROTOCOLS, CURLPROTO_HTTPS);
-#else
-    /* in debug mode, also allow http */
-    ERROR_CHECK_SETOPT(CURLOPT_PROTOCOLS, CURLPROTO_HTTP|CURLPROTO_HTTPS);
-#endif
-    ERROR_CHECK_SETOPT(CURLOPT_TIMEOUT_MS, (long)timeout_ms);
-    ERROR_CHECK_SETOPT(CURLOPT_SHARE, data->share);
-    if(data->set.err && data->set.err != stderr)
-      ERROR_CHECK_SETOPT(CURLOPT_STDERR, data->set.err);
-    if(data->set.verbose)
-      ERROR_CHECK_SETOPT(CURLOPT_VERBOSE, 1L);
-    if(data->set.no_signal)
-      ERROR_CHECK_SETOPT(CURLOPT_NOSIGNAL, 1L);
-
-    ERROR_CHECK_SETOPT(CURLOPT_SSL_VERIFYHOST,
-      data->set.doh_verifyhost ? 2L : 0L);
-    ERROR_CHECK_SETOPT(CURLOPT_SSL_VERIFYPEER,
-      data->set.doh_verifypeer ? 1L : 0L);
-    ERROR_CHECK_SETOPT(CURLOPT_SSL_VERIFYSTATUS,
-      data->set.doh_verifystatus ? 1L : 0L);
-
-    /* Inherit *some* SSL options from the user's transfer. This is a
-       best-guess as to which options are needed for compatibility. #3661
-
-       Note DoH does not inherit the user's proxy server so proxy SSL settings
-       have no effect and are not inherited. If that changes then two new
-       options should be added to check doh proxy insecure separately,
-       CURLOPT_DOH_PROXY_SSL_VERIFYHOST and CURLOPT_DOH_PROXY_SSL_VERIFYPEER.
-       */
-    if(data->set.ssl.falsestart)
-      ERROR_CHECK_SETOPT(CURLOPT_SSL_FALSESTART, 1L);
-    if(data->set.str[STRING_SSL_CAFILE]) {
-      ERROR_CHECK_SETOPT(CURLOPT_CAINFO,
-                         data->set.str[STRING_SSL_CAFILE]);
-    }
-    if(data->set.blobs[BLOB_CAINFO]) {
-      ERROR_CHECK_SETOPT(CURLOPT_CAINFO_BLOB,
-                         data->set.blobs[BLOB_CAINFO]);
-    }
-    if(data->set.str[STRING_SSL_CAPATH]) {
-      ERROR_CHECK_SETOPT(CURLOPT_CAPATH,
-                         data->set.str[STRING_SSL_CAPATH]);
-    }
-    if(data->set.str[STRING_SSL_CRLFILE]) {
-      ERROR_CHECK_SETOPT(CURLOPT_CRLFILE,
-                         data->set.str[STRING_SSL_CRLFILE]);
-    }
-    if(data->set.ssl.certinfo)
-      ERROR_CHECK_SETOPT(CURLOPT_CERTINFO, 1L);
-    if(data->set.ssl.fsslctx)
-      ERROR_CHECK_SETOPT(CURLOPT_SSL_CTX_FUNCTION, data->set.ssl.fsslctx);
-    if(data->set.ssl.fsslctxp)
-      ERROR_CHECK_SETOPT(CURLOPT_SSL_CTX_DATA, data->set.ssl.fsslctxp);
-    if(data->set.str[STRING_SSL_EC_CURVES]) {
-      ERROR_CHECK_SETOPT(CURLOPT_SSL_EC_CURVES,
-                         data->set.str[STRING_SSL_EC_CURVES]);
-    }
-
-    {
-      long mask =
-        (data->set.ssl.enable_beast ?
-         CURLSSLOPT_ALLOW_BEAST : 0) |
-        (data->set.ssl.no_revoke ?
-         CURLSSLOPT_NO_REVOKE : 0) |
-        (data->set.ssl.no_partialchain ?
-         CURLSSLOPT_NO_PARTIALCHAIN : 0) |
-        (data->set.ssl.revoke_best_effort ?
-         CURLSSLOPT_REVOKE_BEST_EFFORT : 0) |
-        (data->set.ssl.native_ca_store ?
-         CURLSSLOPT_NATIVE_CA : 0) |
-        (data->set.ssl.auto_client_cert ?
-         CURLSSLOPT_AUTO_CLIENT_CERT : 0);
-
-      (void)curl_easy_setopt(doh, CURLOPT_SSL_OPTIONS, mask);
-    }
-
-    doh->set.fmultidone = doh_done;
-    doh->set.dohfor = data; /* identify for which transfer this is done */
-    p->easy = doh;
-
-    /* DoH private_data must be null because the user must have a way to
-       distinguish their transfer's handle from DoH handles in user
-       callbacks (ie SSL CTX callback). */
-    DEBUGASSERT(!doh->set.private_data);
-
-    if(curl_multi_add_handle(multi, doh))
-      goto error;
-  }
-  else
+  if(result)
     goto error;
-  free(nurl);
+
+  /* pass in the struct pointer via a local variable to please coverity and
+     the gcc typecheck helpers */
+  VERBOSE(doh->state.feat = &Curl_trc_feat_dns);
+  ERROR_CHECK_SETOPT(CURLOPT_URL, url);
+  ERROR_CHECK_SETOPT(CURLOPT_DEFAULT_PROTOCOL, "https");
+  ERROR_CHECK_SETOPT(CURLOPT_WRITEFUNCTION, doh_probe_write_cb);
+  ERROR_CHECK_SETOPT(CURLOPT_WRITEDATA, doh);
+  ERROR_CHECK_SETOPT(CURLOPT_POSTFIELDS, doh_req->req_body);
+  ERROR_CHECK_SETOPT(CURLOPT_POSTFIELDSIZE, (long)doh_req->req_body_len);
+  ERROR_CHECK_SETOPT(CURLOPT_HTTPHEADER, doh_req->req_hds);
+#ifdef USE_HTTP2
+  ERROR_CHECK_SETOPT(CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2TLS);
+  ERROR_CHECK_SETOPT(CURLOPT_PIPEWAIT, 1L);
+#endif
+#ifndef DEBUGBUILD
+  /* enforce HTTPS if not debug */
+  ERROR_CHECK_SETOPT(CURLOPT_PROTOCOLS, CURLPROTO_HTTPS);
+#else
+  /* in debug mode, also allow http */
+  ERROR_CHECK_SETOPT(CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
+#endif
+  ERROR_CHECK_SETOPT(CURLOPT_TIMEOUT_MS, (long)timeout_ms);
+  ERROR_CHECK_SETOPT(CURLOPT_SHARE, (CURLSH *)data->share);
+  if(data->set.err && data->set.err != stderr)
+    ERROR_CHECK_SETOPT(CURLOPT_STDERR, data->set.err);
+  if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_dns))
+    ERROR_CHECK_SETOPT(CURLOPT_VERBOSE, 1L);
+  if(data->set.no_signal)
+    ERROR_CHECK_SETOPT(CURLOPT_NOSIGNAL, 1L);
+
+  ERROR_CHECK_SETOPT(CURLOPT_SSL_VERIFYHOST,
+                     data->set.doh_verifyhost ? 2L : 0L);
+  ERROR_CHECK_SETOPT(CURLOPT_SSL_VERIFYPEER,
+                     data->set.doh_verifypeer ? 1L : 0L);
+  ERROR_CHECK_SETOPT(CURLOPT_SSL_VERIFYSTATUS,
+                     data->set.doh_verifystatus ? 1L : 0L);
+
+  /* Inherit *some* SSL options from the user's transfer. This is a
+     best-guess as to which options are needed for compatibility. #3661
+
+     Note DoH does not inherit the user's proxy server so proxy SSL settings
+     have no effect and are not inherited. If that changes then two new
+     options should be added to check doh proxy insecure separately,
+     CURLOPT_DOH_PROXY_SSL_VERIFYHOST and CURLOPT_DOH_PROXY_SSL_VERIFYPEER.
+     */
+  doh->set.ssl.custom_cafile = data->set.ssl.custom_cafile;
+  doh->set.ssl.custom_capath = data->set.ssl.custom_capath;
+  doh->set.ssl.custom_cablob = data->set.ssl.custom_cablob;
+  if(data->set.str[STRING_SSL_CAFILE]) {
+    ERROR_CHECK_SETOPT(CURLOPT_CAINFO, data->set.str[STRING_SSL_CAFILE]);
+  }
+  if(data->set.blobs[BLOB_CAINFO]) {
+    ERROR_CHECK_SETOPT(CURLOPT_CAINFO_BLOB, data->set.blobs[BLOB_CAINFO]);
+  }
+  if(data->set.str[STRING_SSL_CAPATH]) {
+    ERROR_CHECK_SETOPT(CURLOPT_CAPATH, data->set.str[STRING_SSL_CAPATH]);
+  }
+  if(data->set.str[STRING_SSL_CRLFILE]) {
+    ERROR_CHECK_SETOPT(CURLOPT_CRLFILE, data->set.str[STRING_SSL_CRLFILE]);
+  }
+  if(data->set.ssl.certinfo)
+    ERROR_CHECK_SETOPT(CURLOPT_CERTINFO, 1L);
+  if(data->set.ssl.fsslctx)
+    ERROR_CHECK_SETOPT(CURLOPT_SSL_CTX_FUNCTION, data->set.ssl.fsslctx);
+  if(data->set.ssl.fsslctxp)
+    ERROR_CHECK_SETOPT(CURLOPT_SSL_CTX_DATA, data->set.ssl.fsslctxp);
+  if(data->set.fdebug)
+    ERROR_CHECK_SETOPT(CURLOPT_DEBUGFUNCTION, data->set.fdebug);
+  if(data->set.debugdata)
+    ERROR_CHECK_SETOPT(CURLOPT_DEBUGDATA, data->set.debugdata);
+  if(data->set.str[STRING_SSL_EC_CURVES]) {
+    ERROR_CHECK_SETOPT(CURLOPT_SSL_EC_CURVES,
+                       data->set.str[STRING_SSL_EC_CURVES]);
+  }
+
+  (void)curl_easy_setopt(doh, CURLOPT_SSL_OPTIONS,
+                         ((long)data->set.ssl.primary.ssl_options &
+                          ~CURLSSLOPT_AUTO_CLIENT_CERT));
+
+  doh->state.internal = TRUE;
+  doh->master_mid = data->mid; /* master transfer of this one */
+
+  result = Curl_meta_set(doh, CURL_EZM_DOH_PROBE, doh_req, doh_probe_dtor);
+  doh_req = NULL; /* call took ownership */
+  if(result)
+    goto error;
+
+  /* DoH handles must not inherit private_data. The handles may be passed to
+     the user via callbacks and the user will be able to identify them as
+     internal handles because private data is not set. The user can then set
+     private_data via CURLOPT_PRIVATE if they so choose. */
+  DEBUGASSERT(!doh->set.private_data);
+
+  if(curl_multi_add_handle(multi, doh))
+    goto error;
+
+  *pmid = doh->mid;
   return CURLE_OK;
 
 error:
-  free(nurl);
   Curl_close(&doh);
+  if(doh_req)
+    doh_probe_dtor(NULL, 0, doh_req);
   return result;
 }
 
 /*
- * Curl_doh() resolves a name using DoH. It resolves a name and returns a
- * 'Curl_addrinfo *' with the address information.
+ * Curl_doh() starts a name resolve using DoH. It resolves a name and returns
+ * a 'Curl_addrinfo *' with the address information.
  */
 
-struct Curl_addrinfo *Curl_doh(struct Curl_easy *data,
-                               const char *hostname,
-                               int port,
-                               int *waitp)
+CURLcode Curl_doh(struct Curl_easy *data,
+                  struct Curl_resolv_async *async)
 {
   CURLcode result = CURLE_OK;
-  int slot;
-  struct dohdata *dohp;
-  struct connectdata *conn = data->conn;
-  *waitp = TRUE; /* this never returns synchronously */
-  (void)hostname;
-  (void)port;
+  struct doh_probes *dohp = NULL;
+  size_t i;
 
-  DEBUGASSERT(!data->req.doh);
-  DEBUGASSERT(conn);
+  DEBUGASSERT(!async->doh);
+  DEBUGASSERT(async->hostname[0]);
+  if(async->doh) {
+    DEBUGASSERT(0); /* should not happen */
+    Curl_doh_cleanup(data, async);
+  }
 
   /* start clean, consider allocating this struct on demand */
-  dohp = data->req.doh = calloc(sizeof(struct dohdata), 1);
+  async->doh = dohp = curlx_calloc(1, sizeof(struct doh_probes));
   if(!dohp)
-    return NULL;
+    return CURLE_OUT_OF_MEMORY;
 
-  conn->bits.doh = TRUE;
-  dohp->host = hostname;
-  dohp->port = port;
-  dohp->headers =
-    curl_slist_append(NULL,
-                      "Content-Type: application/dns-message");
-  if(!dohp->headers)
-    goto error;
+  for(i = 0; i < DOH_SLOT_COUNT; ++i) {
+    dohp->probe_resp[i].probe_mid = UINT32_MAX;
+    curlx_dyn_init(&dohp->probe_resp[i].body, DYN_DOH_RESPONSE);
+  }
+
+  dohp->host = async->hostname;
+  dohp->port = async->port;
+  /* We are making sub easy handles and want to be called back when
+   * one is done. */
+  data->sub_xfer_done = doh_probe_done;
 
   /* create IPv4 DoH request */
-  result = dohprobe(data, &dohp->probe[DOH_PROBE_SLOT_IPADDR_V4],
-                    DNS_TYPE_A, hostname, data->set.str[STRING_DOH],
-                    data->multi, dohp->headers);
-  if(result)
-    goto error;
-  dohp->pending++;
+  if(async->dns_queries & CURL_DNSQ_A) {
+    result = doh_probe_run(data, CURL_DNS_TYPE_A,
+                           async->hostname, data->set.str[STRING_DOH],
+                           data->multi, async->id,
+                           &dohp->probe_resp[DOH_SLOT_IPV4].probe_mid);
+    if(result)
+      goto error;
+    dohp->pending++;
+  }
 
-#ifdef ENABLE_IPV6
-  if((conn->ip_version != CURL_IPRESOLVE_V4) && Curl_ipv6works(data)) {
+#ifdef USE_IPV6
+  if(async->dns_queries & CURL_DNSQ_AAAA) {
     /* create IPv6 DoH request */
-    result = dohprobe(data, &dohp->probe[DOH_PROBE_SLOT_IPADDR_V6],
-                      DNS_TYPE_AAAA, hostname, data->set.str[STRING_DOH],
-                      data->multi, dohp->headers);
+    result = doh_probe_run(data, CURL_DNS_TYPE_AAAA,
+                           async->hostname, data->set.str[STRING_DOH],
+                           data->multi, async->id,
+                           &dohp->probe_resp[DOH_SLOT_IPV6].probe_mid);
     if(result)
       goto error;
     dohp->pending++;
   }
 #endif
-  return NULL;
+
+#ifdef USE_HTTPSRR
+  if(async->dns_queries & CURL_DNSQ_HTTPS) {
+    char *qname = NULL;
+    if(async->port != PORT_HTTPS) {
+      qname = curl_maprintf("_%d._https.%s", async->port, async->hostname);
+      if(!qname)
+        goto error;
+    }
+    result = doh_probe_run(data, CURL_DNS_TYPE_HTTPS,
+                           qname ? qname : async->hostname,
+                           data->set.str[STRING_DOH], data->multi,
+                           async->id,
+                           &dohp->probe_resp[DOH_SLOT_HTTPS_RR].probe_mid);
+    curlx_free(qname);
+    if(result)
+      goto error;
+    dohp->pending++;
+  }
+#endif
+  return CURLE_OK;
 
 error:
-  curl_slist_free_all(dohp->headers);
-  data->req.doh->headers = NULL;
-  for(slot = 0; slot < DOH_PROBE_SLOTS; slot++) {
-    Curl_close(&dohp->probe[slot].easy);
-  }
-  Curl_safefree(data->req.doh);
-  return NULL;
+  Curl_doh_cleanup(data, async);
+  return result;
 }
 
-static DOHcode skipqname(const unsigned char *doh, size_t dohlen,
-                         unsigned int *indexp)
+static DOHcode doh_skipqname(const unsigned char *doh, size_t dohlen,
+                             unsigned int *indexp)
 {
   unsigned char length;
   do {
@@ -438,58 +551,73 @@ static DOHcode skipqname(const unsigned char *doh, size_t dohlen,
       return DOH_DNS_BAD_LABEL;
     if(dohlen < (*indexp + 1 + length))
       return DOH_DNS_OUT_OF_RANGE;
-    *indexp += 1 + length;
+    *indexp += (unsigned int)(1 + length);
   } while(length);
   return DOH_OK;
 }
 
-static unsigned short get16bit(const unsigned char *doh, int index)
+static unsigned short doh_get16bit(const unsigned char *doh,
+                                   unsigned int index)
 {
   return (unsigned short)((doh[index] << 8) | doh[index + 1]);
 }
 
-static unsigned int get32bit(const unsigned char *doh, int index)
+static unsigned int doh_get32bit(const unsigned char *doh, unsigned int index)
 {
-   /* make clang and gcc optimize this to bswap by incrementing
-      the pointer first. */
-   doh += index;
+  /* make clang and gcc optimize this to bswap by incrementing
+     the pointer first. */
+  doh += index;
 
-   /* avoid undefined behavior by casting to unsigned before shifting
-      24 bits, possibly into the sign bit. codegen is same, but
-      ub sanitizer won't be upset */
-  return ( (unsigned)doh[0] << 24) | (doh[1] << 16) |(doh[2] << 8) | doh[3];
+  /* avoid undefined behavior by casting to unsigned before shifting
+     24 bits, possibly into the sign bit. codegen is same, but
+     ub sanitizer will not be upset */
+  return ((unsigned)doh[0] << 24) | ((unsigned)doh[1] << 16) |
+         ((unsigned)doh[2] << 8) | doh[3];
 }
 
-static DOHcode store_a(const unsigned char *doh, int index, struct dohentry *d)
+static void doh_store_a(const unsigned char *doh, int index,
+                        struct dohentry *d)
 {
   /* silently ignore addresses over the limit */
   if(d->numaddr < DOH_MAX_ADDR) {
     struct dohaddr *a = &d->addr[d->numaddr];
-    a->type = DNS_TYPE_A;
+    a->type = CURL_DNS_TYPE_A;
     memcpy(&a->ip.v4, &doh[index], 4);
     d->numaddr++;
   }
-  return DOH_OK;
 }
 
-static DOHcode store_aaaa(const unsigned char *doh,
-                          int index,
-                          struct dohentry *d)
+static void doh_store_aaaa(const unsigned char *doh, int index,
+                           struct dohentry *d)
 {
   /* silently ignore addresses over the limit */
   if(d->numaddr < DOH_MAX_ADDR) {
     struct dohaddr *a = &d->addr[d->numaddr];
-    a->type = DNS_TYPE_AAAA;
+    a->type = CURL_DNS_TYPE_AAAA;
     memcpy(&a->ip.v6, &doh[index], 16);
     d->numaddr++;
   }
-  return DOH_OK;
 }
 
-static DOHcode store_cname(const unsigned char *doh,
-                           size_t dohlen,
-                           unsigned int index,
-                           struct dohentry *d)
+#ifdef USE_HTTPSRR
+static DOHcode doh_store_https(const unsigned char *doh, int index,
+                               struct dohentry *d, uint16_t len)
+{
+  /* silently ignore RRs over the limit */
+  if(d->numhttps_rrs < DOH_MAX_HTTPS) {
+    struct dohhttps_rr *h = &d->https_rrs[d->numhttps_rrs];
+    h->val = curlx_memdup(&doh[index], len);
+    if(!h->val)
+      return DOH_OUT_OF_MEM;
+    h->len = len;
+    d->numhttps_rrs++;
+  }
+  return DOH_OK;
+}
+#endif
+
+static DOHcode doh_store_cname(const unsigned char *doh, size_t dohlen,
+                               unsigned int index, struct dohentry *d)
 {
   struct dynbuf *c;
   unsigned int loop = 128; /* a valid DNS name can never loop this much */
@@ -511,7 +639,7 @@ static DOHcode store_cname(const unsigned char *doh,
 
       /* move to the new index */
       newpos = (length & 0x3f) << 8 | doh[index + 1];
-      index = newpos;
+      index = (unsigned int)newpos;
       continue;
     }
     else if(length & 0xc0)
@@ -520,14 +648,14 @@ static DOHcode store_cname(const unsigned char *doh,
       index++;
 
     if(length) {
-      if(Curl_dyn_len(c)) {
-        if(Curl_dyn_addn(c, STRCONST(".")))
+      if(curlx_dyn_len(c)) {
+        if(curlx_dyn_addn(c, STRCONST(".")))
           return DOH_OUT_OF_MEM;
       }
       if((index + length) > dohlen)
         return DOH_DNS_BAD_LABEL;
 
-      if(Curl_dyn_addn(c, &doh[index], length))
+      if(curlx_dyn_addn(c, &doh[index], length))
         return DOH_OUT_OF_MEM;
       index += length;
     }
@@ -538,63 +666,75 @@ static DOHcode store_cname(const unsigned char *doh,
   return DOH_OK;
 }
 
-static DOHcode rdata(const unsigned char *doh,
-                     size_t dohlen,
-                     unsigned short rdlength,
-                     unsigned short type,
-                     int index,
-                     struct dohentry *d)
+static DOHcode doh_rdata(const unsigned char *doh,
+                         size_t dohlen,
+                         unsigned short rdlength,
+                         unsigned short type,
+                         int index,
+                         struct dohentry *d)
 {
   /* RDATA
-     - A (TYPE 1):  4 bytes
+     - A (TYPE 1): 4 bytes
      - AAAA (TYPE 28): 16 bytes
-     - NS (TYPE 2): N bytes */
+     - NS (TYPE 2): N bytes
+     - HTTPS (TYPE 65): N bytes */
   DOHcode rc;
 
   switch(type) {
-  case DNS_TYPE_A:
+  case CURL_DNS_TYPE_A:
     if(rdlength != 4)
       return DOH_DNS_RDATA_LEN;
-    rc = store_a(doh, index, d);
-    if(rc)
-      return rc;
+    doh_store_a(doh, index, d);
     break;
-  case DNS_TYPE_AAAA:
+  case CURL_DNS_TYPE_AAAA:
     if(rdlength != 16)
       return DOH_DNS_RDATA_LEN;
-    rc = store_aaaa(doh, index, d);
+    doh_store_aaaa(doh, index, d);
+    break;
+#ifdef USE_HTTPSRR
+  case CURL_DNS_TYPE_HTTPS:
+    rc = doh_store_https(doh, index, d, rdlength);
     if(rc)
       return rc;
     break;
-  case DNS_TYPE_CNAME:
-    rc = store_cname(doh, dohlen, index, d);
+#endif
+  case CURL_DNS_TYPE_CNAME:
+    rc = doh_store_cname(doh, dohlen, (unsigned int)index, d);
     if(rc)
       return rc;
     break;
-  case DNS_TYPE_DNAME:
-    /* explicit for clarity; just skip; rely on synthesized CNAME  */
+  case CURL_DNS_TYPE_DNAME:
+    /* explicit for clarity; skip; rely on synthesized CNAME */
     break;
   default:
-    /* unsupported type, just skip it */
+    /* unsupported type, skip it */
     break;
   }
   return DOH_OK;
 }
 
+/* @unittest 1655 */
+UNITTEST void de_init(struct dohentry *de);
 UNITTEST void de_init(struct dohentry *de)
 {
   int i;
   memset(de, 0, sizeof(*de));
   de->ttl = INT_MAX;
   for(i = 0; i < DOH_MAX_CNAME; i++)
-    Curl_dyn_init(&de->cname[i], DYN_DOH_CNAME);
+    curlx_dyn_init(&de->cname[i], DYN_DOH_CNAME);
 }
 
-
-UNITTEST DOHcode doh_decode(const unsigned char *doh,
-                            size_t dohlen,
-                            DNStype dnstype,
-                            struct dohentry *d)
+/* TTL value cap */
+#define MAX_DNS_TTL 86400U /* 24 hours */
+/* @unittest 1650 */
+UNITTEST DOHcode doh_resp_decode(const unsigned char *doh,
+                                 size_t dohlen,
+                                 DNStype dnstype,
+                                 struct dohentry *d);
+UNITTEST DOHcode doh_resp_decode(const unsigned char *doh,
+                                 size_t dohlen,
+                                 DNStype dnstype,
+                                 struct dohentry *d)
 {
   unsigned char rcode;
   unsigned short qdcount;
@@ -614,9 +754,9 @@ UNITTEST DOHcode doh_decode(const unsigned char *doh,
   if(rcode)
     return DOH_DNS_BAD_RCODE; /* bad rcode */
 
-  qdcount = get16bit(doh, 4);
+  qdcount = doh_get16bit(doh, 4);
   while(qdcount) {
-    rc = skipqname(doh, dohlen, &index);
+    rc = doh_skipqname(doh, dohlen, &index);
     if(rc)
       return rc; /* bad qname */
     if(dohlen < (index + 4))
@@ -625,37 +765,39 @@ UNITTEST DOHcode doh_decode(const unsigned char *doh,
     qdcount--;
   }
 
-  ancount = get16bit(doh, 6);
+  ancount = doh_get16bit(doh, 6);
   while(ancount) {
-    unsigned short class;
+    unsigned short dnsclass;
     unsigned int ttl;
 
-    rc = skipqname(doh, dohlen, &index);
+    rc = doh_skipqname(doh, dohlen, &index);
     if(rc)
       return rc; /* bad qname */
 
     if(dohlen < (index + 2))
       return DOH_DNS_OUT_OF_RANGE;
 
-    type = get16bit(doh, index);
-    if((type != DNS_TYPE_CNAME)    /* may be synthesized from DNAME */
-       && (type != DNS_TYPE_DNAME) /* if present, accept and ignore */
-       && (type != dnstype))
+    type = doh_get16bit(doh, index);
+    if((type != CURL_DNS_TYPE_CNAME) &&  /* may be synthesized from DNAME */
+       (type != CURL_DNS_TYPE_DNAME) &&  /* if present, accept and ignore */
+       (type != dnstype))
       /* Not the same type as was asked for nor CNAME nor DNAME */
       return DOH_DNS_UNEXPECTED_TYPE;
     index += 2;
 
     if(dohlen < (index + 2))
       return DOH_DNS_OUT_OF_RANGE;
-    class = get16bit(doh, index);
-    if(DNS_CLASS_IN != class)
+    dnsclass = doh_get16bit(doh, index);
+    if(DNS_CLASS_IN != dnsclass)
       return DOH_DNS_UNEXPECTED_CLASS; /* unsupported */
     index += 2;
 
     if(dohlen < (index + 4))
       return DOH_DNS_OUT_OF_RANGE;
 
-    ttl = get32bit(doh, index);
+    ttl = doh_get32bit(doh, index);
+    if(ttl > MAX_DNS_TTL)
+      ttl = MAX_DNS_TTL;
     if(ttl < d->ttl)
       d->ttl = ttl;
     index += 4;
@@ -663,33 +805,33 @@ UNITTEST DOHcode doh_decode(const unsigned char *doh,
     if(dohlen < (index + 2))
       return DOH_DNS_OUT_OF_RANGE;
 
-    rdlength = get16bit(doh, index);
+    rdlength = doh_get16bit(doh, index);
     index += 2;
     if(dohlen < (index + rdlength))
       return DOH_DNS_OUT_OF_RANGE;
 
-    rc = rdata(doh, dohlen, rdlength, type, index, d);
+    rc = doh_rdata(doh, dohlen, rdlength, type, (int)index, d);
     if(rc)
-      return rc; /* bad rdata */
+      return rc; /* bad doh_rdata */
     index += rdlength;
     ancount--;
   }
 
-  nscount = get16bit(doh, 8);
+  nscount = doh_get16bit(doh, 8);
   while(nscount) {
-    rc = skipqname(doh, dohlen, &index);
+    rc = doh_skipqname(doh, dohlen, &index);
     if(rc)
       return rc; /* bad qname */
 
     if(dohlen < (index + 8))
       return DOH_DNS_OUT_OF_RANGE;
 
-    index += 2 + 2 + 4; /* type, class and ttl */
+    index += 2 + 2 + 4; /* type, dnsclass and ttl */
 
     if(dohlen < (index + 2))
       return DOH_DNS_OUT_OF_RANGE;
 
-    rdlength = get16bit(doh, index);
+    rdlength = doh_get16bit(doh, index);
     index += 2;
     if(dohlen < (index + rdlength))
       return DOH_DNS_OUT_OF_RANGE;
@@ -697,21 +839,21 @@ UNITTEST DOHcode doh_decode(const unsigned char *doh,
     nscount--;
   }
 
-  arcount = get16bit(doh, 10);
+  arcount = doh_get16bit(doh, 10);
   while(arcount) {
-    rc = skipqname(doh, dohlen, &index);
+    rc = doh_skipqname(doh, dohlen, &index);
     if(rc)
       return rc; /* bad qname */
 
     if(dohlen < (index + 8))
       return DOH_DNS_OUT_OF_RANGE;
 
-    index += 2 + 2 + 4; /* type, class and ttl */
+    index += 2 + 2 + 4; /* type, dnsclass and ttl */
 
     if(dohlen < (index + 2))
       return DOH_DNS_OUT_OF_RANGE;
 
-    rdlength = get16bit(doh, index);
+    rdlength = doh_get16bit(doh, index);
     index += 2;
     if(dohlen < (index + rdlength))
       return DOH_DNS_OUT_OF_RANGE;
@@ -722,38 +864,42 @@ UNITTEST DOHcode doh_decode(const unsigned char *doh,
   if(index != dohlen)
     return DOH_DNS_MALFORMAT; /* something is wrong */
 
-  if((type != DNS_TYPE_NS) && !d->numcname && !d->numaddr)
+#ifdef USE_HTTPSRR
+  if((type != CURL_DNS_TYPE_NS) && !d->numcname && !d->numaddr &&
+     !d->numhttps_rrs)
+#else
+  if((type != CURL_DNS_TYPE_NS) && !d->numcname && !d->numaddr)
+#endif
     /* nothing stored! */
     return DOH_NO_CONTENT;
 
   return DOH_OK; /* ok */
 }
 
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-static void showdoh(struct Curl_easy *data,
-                    const struct dohentry *d)
+#ifdef CURLVERBOSE
+static void doh_show(struct Curl_easy *data,
+                     const struct dohentry *d)
 {
   int i;
-  infof(data, "TTL: %u seconds", d->ttl);
+  infof(data, "[DoH] TTL: %u seconds", d->ttl);
   for(i = 0; i < d->numaddr; i++) {
     const struct dohaddr *a = &d->addr[i];
-    if(a->type == DNS_TYPE_A) {
-      infof(data, "DoH A: %u.%u.%u.%u",
+    if(a->type == CURL_DNS_TYPE_A) {
+      infof(data, "[DoH] A: %u.%u.%u.%u",
             a->ip.v4[0], a->ip.v4[1],
             a->ip.v4[2], a->ip.v4[3]);
     }
-    else if(a->type == DNS_TYPE_AAAA) {
+    else if(a->type == CURL_DNS_TYPE_AAAA) {
       int j;
-      char buffer[128];
-      char *ptr;
-      size_t len;
-      msnprintf(buffer, 128, "DoH AAAA: ");
-      ptr = &buffer[10];
-      len = 118;
+      char buffer[128] = "[DoH] AAAA: ";
+      size_t len = strlen(buffer);
+      char *ptr = &buffer[len];
+      len = sizeof(buffer) - len;
       for(j = 0; j < 16; j += 2) {
         size_t l;
-        msnprintf(ptr, len, "%s%02x%02x", j?":":"", d->addr[i].ip.v6[j],
-                  d->addr[i].ip.v6[j + 1]);
+        curl_msnprintf(ptr, len, "%s%02x%02x", j ? ":" : "",
+                       d->addr[i].ip.v6[j],
+                       d->addr[i].ip.v6[j + 1]);
         l = strlen(ptr);
         len -= l;
         ptr += l;
@@ -761,12 +907,21 @@ static void showdoh(struct Curl_easy *data,
       infof(data, "%s", buffer);
     }
   }
+#ifdef USE_HTTPSRR
+  for(i = 0; i < d->numhttps_rrs; i++) {
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
+    doh_print_buf(data, "DoH HTTPS", d->https_rrs[i].val, d->https_rrs[i].len);
+#else
+    infof(data, "DoH HTTPS RR: length %d", d->https_rrs[i].len);
+#endif
+  }
+#endif /* USE_HTTPSRR */
   for(i = 0; i < d->numcname; i++) {
-    infof(data, "CNAME: %s", Curl_dyn_ptr(&d->cname[i]));
+    infof(data, "CNAME: %s", curlx_dyn_ptr(&d->cname[i]));
   }
 }
 #else
-#define showdoh(x,y)
+#define doh_show(x, y)
 #endif
 
 /*
@@ -774,38 +929,39 @@ static void showdoh(struct Curl_easy *data,
  *
  * This function returns a pointer to the first element of a newly allocated
  * Curl_addrinfo struct linked list filled with the data from a set of DoH
- * lookups.  Curl_addrinfo is meant to work like the addrinfo struct does for
- * a IPv6 stack, but usable also for IPv4, all hosts and environments.
+ * lookups. Curl_addrinfo is meant to work like the addrinfo struct does for
+ * an IPv6 stack, but usable also for IPv4, all hosts and environments.
  *
  * The memory allocated by this function *MUST* be free'd later on calling
- * Curl_freeaddrinfo().  For each successful call to this function there
+ * Curl_freeaddrinfo(). For each successful call to this function there
  * must be an associated call later to Curl_freeaddrinfo().
  */
 
-static struct Curl_addrinfo *
-doh2ai(const struct dohentry *de, const char *hostname, int port)
+static CURLcode doh2ai(const struct dohentry *de, const char *hostname,
+                       int port, struct Curl_addrinfo **aip)
 {
   struct Curl_addrinfo *ai;
   struct Curl_addrinfo *prevai = NULL;
   struct Curl_addrinfo *firstai = NULL;
   struct sockaddr_in *addr;
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
   struct sockaddr_in6 *addr6;
 #endif
   CURLcode result = CURLE_OK;
   int i;
   size_t hostlen = strlen(hostname) + 1; /* include null-terminator */
 
-  if(!de)
-    /* no input == no output! */
-    return NULL;
+  DEBUGASSERT(de);
+
+  if(!de->numaddr)
+    return CURLE_COULDNT_RESOLVE_HOST;
 
   for(i = 0; i < de->numaddr; i++) {
     size_t ss_size;
     CURL_SA_FAMILY_T addrtype;
-    if(de->addr[i].type == DNS_TYPE_AAAA) {
-#ifndef ENABLE_IPV6
-      /* we can't handle IPv6 addresses */
+    if(de->addr[i].type == CURL_DNS_TYPE_AAAA) {
+#ifndef USE_IPV6
+      /* we cannot handle IPv6 addresses */
       continue;
 #else
       ss_size = sizeof(struct sockaddr_in6);
@@ -817,7 +973,7 @@ doh2ai(const struct dohentry *de, const char *hostname, int port)
       addrtype = AF_INET;
     }
 
-    ai = calloc(1, sizeof(struct Curl_addrinfo) + ss_size + hostlen);
+    ai = curlx_calloc(1, sizeof(struct Curl_addrinfo) + ss_size + hostlen);
     if(!ai) {
       result = CURLE_OUT_OF_MEMORY;
       break;
@@ -853,7 +1009,7 @@ doh2ai(const struct dohentry *de, const char *hostname, int port)
       addr->sin_port = htons((unsigned short)port);
       break;
 
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
     case AF_INET6:
       addr6 = (void *)ai->ai_addr; /* storage area for this info */
       DEBUGASSERT(sizeof(struct in6_addr) == sizeof(de->addr[i].ip.v6));
@@ -871,114 +1027,349 @@ doh2ai(const struct dohentry *de, const char *hostname, int port)
     Curl_freeaddrinfo(firstai);
     firstai = NULL;
   }
+  *aip = firstai;
 
-  return firstai;
+  return result;
 }
 
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-static const char *type2name(DNStype dnstype)
+#ifdef CURLVERBOSE
+static const char *doh_type2name(DNStype dnstype)
 {
-  return (dnstype == DNS_TYPE_A)?"A":"AAAA";
+  switch(dnstype) {
+  case CURL_DNS_TYPE_A:
+    return "A";
+  case CURL_DNS_TYPE_AAAA:
+    return "AAAA";
+#ifdef USE_HTTPSRR
+  case CURL_DNS_TYPE_HTTPS:
+    return "HTTPS";
+#endif
+  default:
+    return "unknown";
+  }
 }
 #endif
 
+/* @unittest 1655 */
+UNITTEST void de_cleanup(struct dohentry *d);
 UNITTEST void de_cleanup(struct dohentry *d)
 {
   int i = 0;
   for(i = 0; i < d->numcname; i++) {
-    Curl_dyn_free(&d->cname[i]);
+    curlx_dyn_free(&d->cname[i]);
   }
+#ifdef USE_HTTPSRR
+  for(i = 0; i < d->numhttps_rrs; i++)
+    curlx_safefree(d->https_rrs[i].val);
+#endif
 }
 
-CURLcode Curl_doh_is_resolved(struct Curl_easy *data,
-                              struct Curl_dns_entry **dnsp)
+#ifdef USE_HTTPSRR
+
+/*
+ * @brief decode the DNS name in a binary RRData
+ * @param buf points to the buffer (in/out)
+ * @param remaining points to the remaining buffer length (in/out)
+ * @param dnsname returns the string form name on success
+ * @return is 1 for success, error otherwise
+ *
+ * The encoding here is defined in
+ * https://datatracker.ietf.org/doc/html/rfc1035#section-3.1
+ *
+ * The input buffer pointer will be modified so it points to after the end of
+ * the DNS name encoding on output. (that is why it is an "unsigned char
+ * **" :-)
+ */
+static CURLcode doh_decode_rdata_name(const unsigned char **buf,
+                                      size_t *remaining, char **dnsname)
 {
-  CURLcode result;
-  struct dohdata *dohp = data->req.doh;
-  *dnsp = NULL; /* defaults to no response */
+  const unsigned char *cp = NULL;
+  size_t rem = 0;
+  unsigned char clen = 0; /* chunk len */
+  struct dynbuf thename;
+
+  DEBUGASSERT(buf && remaining && dnsname);
+  if(!buf || !remaining || !dnsname || !*remaining)
+    return CURLE_OUT_OF_MEMORY;
+  curlx_dyn_init(&thename, CURL_MAXLEN_HOST_NAME);
+  rem = *remaining;
+  cp = *buf;
+  clen = *cp++;
+  /* RFC 9460 says it must be uncompressed */
+  if(clen > 63)
+    return CURLE_WEIRD_SERVER_REPLY;
+
+  if(clen == 0) {
+    /* special case - return "." as name */
+    if(curlx_dyn_addn(&thename, ".", 1))
+      return CURLE_OUT_OF_MEMORY;
+  }
+  while(clen) {
+    if(clen >= rem) {
+      curlx_dyn_free(&thename);
+      return CURLE_OUT_OF_MEMORY;
+    }
+    if(curlx_dyn_addn(&thename, cp, clen) ||
+       curlx_dyn_addn(&thename, ".", 1))
+      return CURLE_TOO_LARGE;
+
+    cp += clen;
+    rem -= (clen + 1);
+    if(rem <= 0) {
+      curlx_dyn_free(&thename);
+      return CURLE_OUT_OF_MEMORY;
+    }
+    clen = *cp++;
+    if(clen > 63) {
+      /* invalid format */
+      curlx_dyn_free(&thename);
+      return CURLE_WEIRD_SERVER_REPLY;
+    }
+  }
+  *buf = cp;
+  *remaining = rem - 1;
+  *dnsname = curlx_dyn_ptr(&thename);
+  return CURLE_OK;
+}
+
+/* @unittest 1658 */
+UNITTEST CURLcode doh_resp_decode_httpsrr(struct Curl_easy *data,
+                                          const unsigned char *cp, size_t len,
+                                          struct Curl_https_rrinfo **hrr);
+UNITTEST CURLcode doh_resp_decode_httpsrr(struct Curl_easy *data,
+                                          const unsigned char *cp, size_t len,
+                                          struct Curl_https_rrinfo **hrr)
+{
+  uint16_t pcode = 0, plen = 0;
+  uint32_t expected_min_pcode = 0;
+  struct Curl_https_rrinfo *lhrr = NULL;
+  char *dnsname = NULL;
+  CURLcode result = CURLE_OUT_OF_MEMORY;
+  size_t olen;
+
+  (void)data;
+  *hrr = NULL;
+  if(len <= 2)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  lhrr = curlx_calloc(1, sizeof(struct Curl_https_rrinfo));
+  if(!lhrr)
+    return CURLE_OUT_OF_MEMORY;
+  lhrr->priority = doh_get16bit(cp, 0);
+  cp += 2;
+  len -= 2;
+  if(doh_decode_rdata_name(&cp, &len, &dnsname) != CURLE_OK)
+    goto err;
+  lhrr->target = dnsname;
+  if(Curl_junkscan(dnsname, &olen, FALSE)) {
+    /* unacceptable hostname content */
+    result = CURLE_WEIRD_SERVER_REPLY;
+    goto err;
+  }
+  while(len >= 4) {
+    pcode = doh_get16bit(cp, 0);
+    plen = doh_get16bit(cp, 2);
+    cp += 4;
+    len -= 4;
+    if(pcode < expected_min_pcode || plen > len) {
+      result = CURLE_WEIRD_SERVER_REPLY;
+      goto err;
+    }
+    result = Curl_httpsrr_set(lhrr, pcode, cp, plen);
+    if(result)
+      goto err;
+    Curl_httpsrr_trace(data, lhrr);
+    cp += plen;
+    len -= plen;
+    expected_min_pcode = pcode + 1;
+  }
+  DEBUGASSERT(!len);
+  *hrr = lhrr;
+  return CURLE_OK;
+err:
+  Curl_httpsrr_cleanup(lhrr);
+  curlx_safefree(lhrr);
+  return result;
+}
+
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
+static void doh_print_httpsrr(struct Curl_easy *data,
+                              struct Curl_https_rrinfo *hrr)
+{
+  DEBUGASSERT(hrr);
+  infof(data, "HTTPS RR: priority %d, target: %s", hrr->priority, hrr->target);
+  if(hrr->alpns[0] != ALPN_none)
+    infof(data, "HTTPS RR: alpns %u %u %u %u",
+          hrr->alpns[0], hrr->alpns[1], hrr->alpns[2], hrr->alpns[3]);
+  else
+    infof(data, "HTTPS RR: no alpns");
+  if(hrr->no_def_alpn)
+    infof(data, "HTTPS RR: no_def_alpn set");
+  else
+    infof(data, "HTTPS RR: no_def_alpn not set");
+  if(hrr->ipv4hints) {
+    doh_print_buf(data, "HTTPS RR: ipv4hints",
+                  hrr->ipv4hints, hrr->ipv4hints_len);
+  }
+  else
+    infof(data, "HTTPS RR: no ipv4hints");
+  if(hrr->echconfiglist) {
+    doh_print_buf(data, "HTTPS RR: ECHConfigList",
+                  hrr->echconfiglist, hrr->echconfiglist_len);
+  }
+  else
+    infof(data, "HTTPS RR: no ECHConfigList");
+  if(hrr->ipv6hints) {
+    doh_print_buf(data, "HTTPS RR: ipv6hint",
+                  hrr->ipv6hints, hrr->ipv6hints_len);
+  }
+  else
+    infof(data, "HTTPS RR: no ipv6hints");
+}
+# endif
+#endif
+
+CURLcode Curl_doh_take_result(struct Curl_easy *data,
+                              struct Curl_resolv_async *async,
+                              struct Curl_dns_entry **pdns)
+{
+  struct doh_probes *dohp = async->doh;
+  CURLcode result = CURLE_OK;
+  struct dohentry de;
+
+  *pdns = NULL; /* defaults to no response */
   if(!dohp)
     return CURLE_OUT_OF_MEMORY;
 
-  if(!dohp->probe[DOH_PROBE_SLOT_IPADDR_V4].easy &&
-     !dohp->probe[DOH_PROBE_SLOT_IPADDR_V6].easy) {
-    failf(data, "Could not DoH-resolve: %s", data->state.async.hostname);
-    return CONN_IS_PROXIED(data->conn)?CURLE_COULDNT_RESOLVE_PROXY:
-      CURLE_COULDNT_RESOLVE_HOST;
+  if(dohp->probe_resp[DOH_SLOT_IPV4].probe_mid == UINT32_MAX &&
+     dohp->probe_resp[DOH_SLOT_IPV6].probe_mid == UINT32_MAX) {
+    failf(data, "Could not DoH-resolve: %s", dohp->host);
+    return async->for_proxy ?
+      CURLE_COULDNT_RESOLVE_PROXY : CURLE_COULDNT_RESOLVE_HOST;
   }
   else if(!dohp->pending) {
-    DOHcode rc[DOH_PROBE_SLOTS] = {
-      DOH_OK, DOH_OK
-    };
-    struct dohentry de;
+    DOHcode rc[DOH_SLOT_COUNT];
     int slot;
+
+    memset(rc, 0, sizeof(rc));
     /* remove DoH handles from multi handle and close them */
-    for(slot = 0; slot < DOH_PROBE_SLOTS; slot++) {
-      curl_multi_remove_handle(data->multi, dohp->probe[slot].easy);
-      Curl_close(&dohp->probe[slot].easy);
-    }
+    doh_close(data, async);
     /* parse the responses, create the struct and return it! */
     de_init(&de);
-    for(slot = 0; slot < DOH_PROBE_SLOTS; slot++) {
-      struct dnsprobe *p = &dohp->probe[slot];
+    for(slot = 0; slot < DOH_SLOT_COUNT; slot++) {
+      struct doh_response *p = &dohp->probe_resp[slot];
       if(!p->dnstype)
         continue;
-      rc[slot] = doh_decode(Curl_dyn_uptr(&p->serverdoh),
-                            Curl_dyn_len(&p->serverdoh),
-                            p->dnstype,
-                            &de);
-      Curl_dyn_free(&p->serverdoh);
+      rc[slot] = doh_resp_decode(curlx_dyn_uptr(&p->body),
+                                 curlx_dyn_len(&p->body),
+                                 p->dnstype, &de);
       if(rc[slot]) {
-        infof(data, "DoH: %s type %s for %s", doh_strerror(rc[slot]),
-              type2name(p->dnstype), dohp->host);
+        CURL_TRC_DNS(data, "DoH: %s type %s for %s", doh_strerror(rc[slot]),
+                     doh_type2name(p->dnstype), dohp->host);
       }
     } /* next slot */
 
-    result = CURLE_COULDNT_RESOLVE_HOST; /* until we know better */
-    if(!rc[DOH_PROBE_SLOT_IPADDR_V4] || !rc[DOH_PROBE_SLOT_IPADDR_V6]) {
+    if(!rc[DOH_SLOT_IPV4] || !rc[DOH_SLOT_IPV6]) {
       /* we have an address, of one kind or other */
       struct Curl_dns_entry *dns;
       struct Curl_addrinfo *ai;
 
-      infof(data, "DoH Host name: %s", dohp->host);
-      showdoh(data, &de);
-
-      ai = doh2ai(&de, dohp->host, dohp->port);
-      if(!ai) {
-        de_cleanup(&de);
-        return CURLE_OUT_OF_MEMORY;
+      if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_dns)) {
+        CURL_TRC_DNS(data, "hostname: %s", dohp->host);
+        doh_show(data, &de);
       }
 
-      if(data->share)
-        Curl_share_lock(data, CURL_LOCK_DATA_DNS, CURL_LOCK_ACCESS_SINGLE);
-
-      /* we got a response, store it in the cache */
-      dns = Curl_cache_addr(data, ai, dohp->host, 0, dohp->port);
-
-      if(data->share)
-        Curl_share_unlock(data, CURL_LOCK_DATA_DNS);
+      result = doh2ai(&de, dohp->host, dohp->port, &ai);
+      if(result)
+        goto error;
 
+      /* we got a response, create a dns entry. */
+      dns = Curl_dnscache_mk_entry(data, async->dns_queries,
+                                   &ai, dohp->host, dohp->port);
       if(!dns) {
-        /* returned failure, bail out nicely */
-        Curl_freeaddrinfo(ai);
+        result = CURLE_OUT_OF_MEMORY;
+        goto error;
       }
-      else {
-        data->state.async.dns = dns;
-        *dnsp = dns;
-        result = CURLE_OK;      /* address resolution OK */
+
+      /* Now add and HTTPSRR information if we have */
+#ifdef USE_HTTPSRR
+      if(de.numhttps_rrs > 0 && result == CURLE_OK) {
+        struct Curl_https_rrinfo *hrr = NULL;
+        result = doh_resp_decode_httpsrr(data, de.https_rrs->val,
+                                         de.https_rrs->len, &hrr);
+        if(result) {
+          infof(data, "Failed to decode HTTPS RR");
+          Curl_dns_entry_unlink(data, &dns);
+          goto error;
+        }
+        infof(data, "Some HTTPS RR to process");
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
+        doh_print_httpsrr(data, hrr);
+#endif
+        Curl_dns_entry_set_https_rr(dns, hrr);
       }
+#endif /* USE_HTTPSRR */
+
+      /* and add the entry to the cache */
+      result = Curl_dnscache_add(data, dns);
+      *pdns = dns;
     } /* address processing done */
-
-    /* Now process any build-specific attributes retrieved from DNS */
-
-    /* All done */
-    de_cleanup(&de);
-    Curl_safefree(data->req.doh);
-    return result;
+    else {
+      result = async->for_proxy ?
+        CURLE_COULDNT_RESOLVE_PROXY : CURLE_COULDNT_RESOLVE_HOST;
+    }
 
   } /* !dohp->pending */
+  else
+    /* wait for pending DoH transactions to complete */
+    return CURLE_AGAIN;
 
-  /* else wait for pending DoH transactions to complete */
-  return CURLE_OK;
+error:
+  de_cleanup(&de);
+  Curl_doh_cleanup(data, async);
+  return result;
+}
+
+static void doh_close(struct Curl_easy *data,
+                      struct Curl_resolv_async *async)
+{
+  struct doh_probes *doh = async ? async->doh : NULL;
+  if(doh && data->multi) {
+    struct Curl_easy *probe_data;
+    uint32_t mid;
+    size_t slot;
+    for(slot = 0; slot < DOH_SLOT_COUNT; slot++) {
+      mid = doh->probe_resp[slot].probe_mid;
+      if(mid == UINT32_MAX)
+        continue;
+      doh->probe_resp[slot].probe_mid = UINT32_MAX;
+      /* should have been called before data is removed from multi handle */
+      DEBUGASSERT(data->multi);
+      probe_data = data->multi ? Curl_multi_get_easy(data->multi, mid) : NULL;
+      if(!probe_data) {
+        DEBUGF(infof(data, "Curl_doh_close: xfer for mid=%u not found!",
+                     doh->probe_resp[slot].probe_mid));
+        continue;
+      }
+      /* data->multi might already be reset at this time */
+      curl_multi_remove_handle(data->multi, probe_data);
+      Curl_close(&probe_data);
+    }
+    data->sub_xfer_done = NULL;
+  }
+}
+
+void Curl_doh_cleanup(struct Curl_easy *data,
+                      struct Curl_resolv_async *async)
+{
+  struct doh_probes *dohp = async->doh;
+  if(dohp) {
+    int i;
+    doh_close(data, async);
+    for(i = 0; i < DOH_SLOT_COUNT; ++i) {
+      curlx_dyn_free(&dohp->probe_resp[i].body);
+    }
+    curlx_safefree(async->doh);
+  }
 }
 
 #endif /* CURL_DISABLE_DOH */
diff --git a/third-party/curl/lib/doh.h b/third-party/curl/lib/doh.h
index 7d7b694f33..cd2aad9254 100644
--- a/third-party/curl/lib/doh.h
+++ b/third-party/curl/lib/doh.h
@@ -23,22 +23,23 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "urldata.h"
-#include "curl_addrinfo.h"
 
-#ifndef CURL_DISABLE_DOH
+/* enums outside of the #ifdef to make the types work in unitprotos.h even on
+   builds without DoH support */
+
+struct Curl_resolv_async;
 
 typedef enum {
   DOH_OK,
-  DOH_DNS_BAD_LABEL,    /* 1 */
-  DOH_DNS_OUT_OF_RANGE, /* 2 */
-  DOH_DNS_LABEL_LOOP,   /* 3 */
-  DOH_TOO_SMALL_BUFFER, /* 4 */
-  DOH_OUT_OF_MEM,       /* 5 */
-  DOH_DNS_RDATA_LEN,    /* 6 */
-  DOH_DNS_MALFORMAT,    /* 7 */
-  DOH_DNS_BAD_RCODE,    /* 8 - no such name */
+  DOH_DNS_BAD_LABEL,        /* 1 */
+  DOH_DNS_OUT_OF_RANGE,     /* 2 */
+  DOH_DNS_LABEL_LOOP,       /* 3 */
+  DOH_TOO_SMALL_BUFFER,     /* 4 */
+  DOH_OUT_OF_MEM,           /* 5 */
+  DOH_DNS_RDATA_LEN,        /* 6 */
+  DOH_DNS_MALFORMAT,        /* 7 */
+  DOH_DNS_BAD_RCODE,        /* 8 - no such name */
   DOH_DNS_UNEXPECTED_TYPE,  /* 9 */
   DOH_DNS_UNEXPECTED_CLASS, /* 10 */
   DOH_NO_CONTENT,           /* 11 */
@@ -47,47 +48,85 @@ typedef enum {
 } DOHcode;
 
 typedef enum {
-  DNS_TYPE_A = 1,
-  DNS_TYPE_NS = 2,
-  DNS_TYPE_CNAME = 5,
-  DNS_TYPE_AAAA = 28,
-  DNS_TYPE_DNAME = 39           /* RFC6672 */
+  CURL_DNS_TYPE_A = 1,
+  CURL_DNS_TYPE_NS = 2,
+  CURL_DNS_TYPE_CNAME = 5,
+  CURL_DNS_TYPE_AAAA = 28,
+  CURL_DNS_TYPE_DNAME = 39,           /* RFC6672 */
+  CURL_DNS_TYPE_HTTPS = 65
 } DNStype;
 
-/* one of these for each DoH request */
-struct dnsprobe {
-  CURL *easy;
-  DNStype dnstype;
-  unsigned char dohbuffer[512];
-  size_t dohlen;
-  struct dynbuf serverdoh;
+struct dohentry; /* forward-declare for non-DoH builds */
+
+#ifndef CURL_DISABLE_DOH
+
+enum doh_slot_num {
+  /* Explicit values for first two symbols so as to match hard-coded
+   * constants in existing code
+   */
+  DOH_SLOT_IPV4 = 0, /* make 'V4' stand out for readability */
+  DOH_SLOT_IPV6 = 1, /* 'V6' likewise */
+
+  /* Space here for (possibly build-specific) additional slot definitions */
+#ifdef USE_HTTPSRR
+  DOH_SLOT_HTTPS_RR = 2,     /* for HTTPS RR */
+#endif
+
+  /* for example */
+  /* #ifdef WANT_DOH_FOOBAR_TXT */
+  /*   DOH_PROBE_SLOT_FOOBAR_TXT, */
+  /* #endif */
+
+  /* AFTER all slot definitions, establish how many we have */
+  DOH_SLOT_COUNT
 };
 
-struct dohdata {
-  struct curl_slist *headers;
-  struct dnsprobe probe[DOH_PROBE_SLOTS];
-  unsigned int pending; /* still outstanding requests */
-  int port;
+#define CURL_EZM_DOH_PROBE   "ezm:doh-p"
+
+/* the largest one we can make, based on RFCs 1034, 1035 */
+#define DOH_MAX_DNSREQ_SIZE (256 + 16)
+
+/* each DoH probe request has this
+ * as easy meta for CURL_EZM_DOH_PROBE */
+struct doh_request {
+  unsigned char req_body[DOH_MAX_DNSREQ_SIZE];
+  struct curl_slist *req_hds;
+  struct dynbuf resp_body;
+  size_t req_body_len;
+  uint32_t resolv_id; /* id of the resolve operation */
+  DNStype dnstype;
+};
+
+struct doh_response {
+  uint32_t probe_mid;
+  struct dynbuf body;
+  DNStype dnstype;
+  CURLcode result;
+};
+
+/* each transfer firing off DoH requests has this
+ * as easy meta for CURL_EZM_DOH_MASTER */
+struct doh_probes {
+  struct doh_response probe_resp[DOH_SLOT_COUNT];
+  unsigned int pending; /* still outstanding probes */
+  uint16_t port;
   const char *host;
 };
 
 /*
- * Curl_doh() resolve a name using DoH (DNS-over-HTTPS). It resolves a name
- * and returns a 'Curl_addrinfo *' with the address information.
+ * Curl_doh() starts a name resolve using DoH (DNS-over-HTTPS). It resolves a
+ * name and returns a 'Curl_addrinfo *' with the address information.
  */
+CURLcode Curl_doh(struct Curl_easy *data,
+                  struct Curl_resolv_async *async);
 
-struct Curl_addrinfo *Curl_doh(struct Curl_easy *data,
-                               const char *hostname,
-                               int port,
-                               int *waitp);
+CURLcode Curl_doh_take_result(struct Curl_easy *data,
+                              struct Curl_resolv_async *async,
+                              struct Curl_dns_entry **pdns);
 
-CURLcode Curl_doh_is_resolved(struct Curl_easy *data,
-                              struct Curl_dns_entry **dns);
-
-int Curl_doh_getsock(struct connectdata *conn, curl_socket_t *socks);
-
-#define DOH_MAX_ADDR 24
+#define DOH_MAX_ADDR  24
 #define DOH_MAX_CNAME 4
+#define DOH_MAX_HTTPS 4
 
 struct dohaddr {
   int type;
@@ -97,32 +136,41 @@ struct dohaddr {
   } ip;
 };
 
+#ifdef USE_HTTPSRR
+
+/*
+ * These may need escaping when found within an ALPN string
+ * value.
+ */
+#define COMMA_CHAR                    ','
+#define BACKSLASH_CHAR                '\\'
+
+struct dohhttps_rr {
+  uint16_t len; /* raw encoded length */
+  unsigned char *val; /* raw encoded octets */
+};
+#endif
+
 struct dohentry {
   struct dynbuf cname[DOH_MAX_CNAME];
   struct dohaddr addr[DOH_MAX_ADDR];
   int numaddr;
   unsigned int ttl;
   int numcname;
+#ifdef USE_HTTPSRR
+  struct dohhttps_rr https_rrs[DOH_MAX_HTTPS];
+  int numhttps_rrs;
+#endif
 };
 
+void Curl_doh_cleanup(struct Curl_easy *data,
+                      struct Curl_resolv_async *async);
+#define Curl_doh_wanted(d)  (!!(d)->set.doh)
 
-#ifdef DEBUGBUILD
-DOHcode doh_encode(const char *host,
-                   DNStype dnstype,
-                   unsigned char *dnsp, /* buffer */
-                   size_t len,  /* buffer size */
-                   size_t *olen); /* output length */
-DOHcode doh_decode(const unsigned char *doh,
-                   size_t dohlen,
-                   DNStype dnstype,
-                   struct dohentry *d);
-void de_init(struct dohentry *d);
-void de_cleanup(struct dohentry *d);
-#endif
-
-#else /* if DoH is disabled */
-#define Curl_doh(a,b,c,d) NULL
-#define Curl_doh_is_resolved(x,y) CURLE_COULDNT_RESOLVE_HOST
-#endif
+#else /* CURL_DISABLE_DOH */
+#define Curl_doh(a, b)             NULL
+#define Curl_doh_take_result(x, y, z) CURLE_COULDNT_RESOLVE_HOST
+#define Curl_doh_wanted(d)         FALSE
+#endif /* !CURL_DISABLE_DOH */
 
 #endif /* HEADER_CURL_DOH_H */
diff --git a/third-party/curl/lib/dynbuf.c b/third-party/curl/lib/dynbuf.c
deleted file mode 100644
index 0c9c491aeb..0000000000
--- a/third-party/curl/lib/dynbuf.c
+++ /dev/null
@@ -1,275 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-#include "dynbuf.h"
-#include "curl_printf.h"
-#ifdef BUILDING_LIBCURL
-#include "curl_memory.h"
-#endif
-#include "memdebug.h"
-
-#define MIN_FIRST_ALLOC 32
-
-#define DYNINIT 0xbee51da /* random pattern */
-
-/*
- * Init a dynbuf struct.
- */
-void Curl_dyn_init(struct dynbuf *s, size_t toobig)
-{
-  DEBUGASSERT(s);
-  DEBUGASSERT(toobig);
-  s->bufr = NULL;
-  s->leng = 0;
-  s->allc = 0;
-  s->toobig = toobig;
-#ifdef DEBUGBUILD
-  s->init = DYNINIT;
-#endif
-}
-
-/*
- * free the buffer and re-init the necessary fields. It doesn't touch the
- * 'init' field and thus this buffer can be reused to add data to again.
- */
-void Curl_dyn_free(struct dynbuf *s)
-{
-  DEBUGASSERT(s);
-  Curl_safefree(s->bufr);
-  s->leng = s->allc = 0;
-}
-
-/*
- * Store/append an chunk of memory to the dynbuf.
- */
-static CURLcode dyn_nappend(struct dynbuf *s,
-                            const unsigned char *mem, size_t len)
-{
-  size_t indx = s->leng;
-  size_t a = s->allc;
-  size_t fit = len + indx + 1; /* new string + old string + zero byte */
-
-  /* try to detect if there's rubbish in the struct */
-  DEBUGASSERT(s->init == DYNINIT);
-  DEBUGASSERT(s->toobig);
-  DEBUGASSERT(indx < s->toobig);
-  DEBUGASSERT(!s->leng || s->bufr);
-  DEBUGASSERT(a <= s->toobig);
-
-  if(fit > s->toobig) {
-    Curl_dyn_free(s);
-    return CURLE_OUT_OF_MEMORY;
-  }
-  else if(!a) {
-    DEBUGASSERT(!indx);
-    /* first invoke */
-    if(MIN_FIRST_ALLOC > s->toobig)
-      a = s->toobig;
-    else if(fit < MIN_FIRST_ALLOC)
-      a = MIN_FIRST_ALLOC;
-    else
-      a = fit;
-  }
-  else {
-    while(a < fit)
-      a *= 2;
-    if(a > s->toobig)
-      /* no point in allocating a larger buffer than this is allowed to use */
-      a = s->toobig;
-  }
-
-  if(a != s->allc) {
-    /* this logic is not using Curl_saferealloc() to make the tool not have to
-       include that as well when it uses this code */
-    void *p = realloc(s->bufr, a);
-    if(!p) {
-      Curl_dyn_free(s);
-      return CURLE_OUT_OF_MEMORY;
-    }
-    s->bufr = p;
-    s->allc = a;
-  }
-
-  if(len)
-    memcpy(&s->bufr[indx], mem, len);
-  s->leng = indx + len;
-  s->bufr[s->leng] = 0;
-  return CURLE_OK;
-}
-
-/*
- * Clears the string, keeps the allocation. This can also be called on a
- * buffer that already was freed.
- */
-void Curl_dyn_reset(struct dynbuf *s)
-{
-  DEBUGASSERT(s);
-  DEBUGASSERT(s->init == DYNINIT);
-  DEBUGASSERT(!s->leng || s->bufr);
-  if(s->leng)
-    s->bufr[0] = 0;
-  s->leng = 0;
-}
-
-/*
- * Specify the size of the tail to keep (number of bytes from the end of the
- * buffer). The rest will be dropped.
- */
-CURLcode Curl_dyn_tail(struct dynbuf *s, size_t trail)
-{
-  DEBUGASSERT(s);
-  DEBUGASSERT(s->init == DYNINIT);
-  DEBUGASSERT(!s->leng || s->bufr);
-  if(trail > s->leng)
-    return CURLE_BAD_FUNCTION_ARGUMENT;
-  else if(trail == s->leng)
-    return CURLE_OK;
-  else if(!trail) {
-    Curl_dyn_reset(s);
-  }
-  else {
-    memmove(&s->bufr[0], &s->bufr[s->leng - trail], trail);
-    s->leng = trail;
-    s->bufr[s->leng] = 0;
-  }
-  return CURLE_OK;
-
-}
-
-/*
- * Appends a buffer with length.
- */
-CURLcode Curl_dyn_addn(struct dynbuf *s, const void *mem, size_t len)
-{
-  DEBUGASSERT(s);
-  DEBUGASSERT(s->init == DYNINIT);
-  DEBUGASSERT(!s->leng || s->bufr);
-  return dyn_nappend(s, mem, len);
-}
-
-/*
- * Append a null-terminated string at the end.
- */
-CURLcode Curl_dyn_add(struct dynbuf *s, const char *str)
-{
-  size_t n = strlen(str);
-  DEBUGASSERT(s);
-  DEBUGASSERT(s->init == DYNINIT);
-  DEBUGASSERT(!s->leng || s->bufr);
-  return dyn_nappend(s, (unsigned char *)str, n);
-}
-
-/*
- * Append a string vprintf()-style
- */
-CURLcode Curl_dyn_vaddf(struct dynbuf *s, const char *fmt, va_list ap)
-{
-#ifdef BUILDING_LIBCURL
-  int rc;
-  DEBUGASSERT(s);
-  DEBUGASSERT(s->init == DYNINIT);
-  DEBUGASSERT(!s->leng || s->bufr);
-  rc = Curl_dyn_vprintf(s, fmt, ap);
-
-  if(!rc)
-    return CURLE_OK;
-#else
-  char *str;
-  str = vaprintf(fmt, ap); /* this allocs a new string to append */
-
-  if(str) {
-    CURLcode result = dyn_nappend(s, (unsigned char *)str, strlen(str));
-    free(str);
-    return result;
-  }
-  /* If we failed, we cleanup the whole buffer and return error */
-  Curl_dyn_free(s);
-#endif
-  return CURLE_OUT_OF_MEMORY;
-}
-
-/*
- * Append a string printf()-style
- */
-CURLcode Curl_dyn_addf(struct dynbuf *s, const char *fmt, ...)
-{
-  CURLcode result;
-  va_list ap;
-  DEBUGASSERT(s);
-  DEBUGASSERT(s->init == DYNINIT);
-  DEBUGASSERT(!s->leng || s->bufr);
-  va_start(ap, fmt);
-  result = Curl_dyn_vaddf(s, fmt, ap);
-  va_end(ap);
-  return result;
-}
-
-/*
- * Returns a pointer to the buffer.
- */
-char *Curl_dyn_ptr(const struct dynbuf *s)
-{
-  DEBUGASSERT(s);
-  DEBUGASSERT(s->init == DYNINIT);
-  DEBUGASSERT(!s->leng || s->bufr);
-  return s->bufr;
-}
-
-/*
- * Returns an unsigned pointer to the buffer.
- */
-unsigned char *Curl_dyn_uptr(const struct dynbuf *s)
-{
-  DEBUGASSERT(s);
-  DEBUGASSERT(s->init == DYNINIT);
-  DEBUGASSERT(!s->leng || s->bufr);
-  return (unsigned char *)s->bufr;
-}
-
-/*
- * Returns the length of the buffer.
- */
-size_t Curl_dyn_len(const struct dynbuf *s)
-{
-  DEBUGASSERT(s);
-  DEBUGASSERT(s->init == DYNINIT);
-  DEBUGASSERT(!s->leng || s->bufr);
-  return s->leng;
-}
-
-/*
- * Set a new (smaller) length.
- */
-CURLcode Curl_dyn_setlen(struct dynbuf *s, size_t set)
-{
-  DEBUGASSERT(s);
-  DEBUGASSERT(s->init == DYNINIT);
-  DEBUGASSERT(!s->leng || s->bufr);
-  if(set > s->leng)
-    return CURLE_BAD_FUNCTION_ARGUMENT;
-  s->leng = set;
-  s->bufr[s->leng] = 0;
-  return CURLE_OK;
-}
diff --git a/third-party/curl/lib/dynbuf.h b/third-party/curl/lib/dynbuf.h
deleted file mode 100644
index 6291eabd37..0000000000
--- a/third-party/curl/lib/dynbuf.h
+++ /dev/null
@@ -1,92 +0,0 @@
-#ifndef HEADER_CURL_DYNBUF_H
-#define HEADER_CURL_DYNBUF_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include <curl/curl.h>
-
-#ifndef BUILDING_LIBCURL
-/* this renames the functions so that the tool code can use the same code
-   without getting symbol collisions */
-#define Curl_dyn_init(a,b) curlx_dyn_init(a,b)
-#define Curl_dyn_add(a,b) curlx_dyn_add(a,b)
-#define Curl_dyn_addn(a,b,c) curlx_dyn_addn(a,b,c)
-#define Curl_dyn_addf curlx_dyn_addf
-#define Curl_dyn_vaddf curlx_dyn_vaddf
-#define Curl_dyn_free(a) curlx_dyn_free(a)
-#define Curl_dyn_ptr(a) curlx_dyn_ptr(a)
-#define Curl_dyn_uptr(a) curlx_dyn_uptr(a)
-#define Curl_dyn_len(a) curlx_dyn_len(a)
-#define Curl_dyn_reset(a) curlx_dyn_reset(a)
-#define Curl_dyn_tail(a,b) curlx_dyn_tail(a,b)
-#define Curl_dyn_setlen(a,b) curlx_dyn_setlen(a,b)
-#define curlx_dynbuf dynbuf /* for the struct name */
-#endif
-
-struct dynbuf {
-  char *bufr;    /* point to a null-terminated allocated buffer */
-  size_t leng;   /* number of bytes *EXCLUDING* the null-terminator */
-  size_t allc;   /* size of the current allocation */
-  size_t toobig; /* size limit for the buffer */
-#ifdef DEBUGBUILD
-  int init;     /* detect API usage mistakes */
-#endif
-};
-
-void Curl_dyn_init(struct dynbuf *s, size_t toobig);
-void Curl_dyn_free(struct dynbuf *s);
-CURLcode Curl_dyn_addn(struct dynbuf *s, const void *mem, size_t len)
-  WARN_UNUSED_RESULT;
-CURLcode Curl_dyn_add(struct dynbuf *s, const char *str)
-  WARN_UNUSED_RESULT;
-CURLcode Curl_dyn_addf(struct dynbuf *s, const char *fmt, ...)
-  WARN_UNUSED_RESULT;
-CURLcode Curl_dyn_vaddf(struct dynbuf *s, const char *fmt, va_list ap)
-  WARN_UNUSED_RESULT;
-void Curl_dyn_reset(struct dynbuf *s);
-CURLcode Curl_dyn_tail(struct dynbuf *s, size_t trail);
-CURLcode Curl_dyn_setlen(struct dynbuf *s, size_t set);
-char *Curl_dyn_ptr(const struct dynbuf *s);
-unsigned char *Curl_dyn_uptr(const struct dynbuf *s);
-size_t Curl_dyn_len(const struct dynbuf *s);
-
-/* returns 0 on success, -1 on error */
-/* The implementation of this function exists in mprintf.c */
-int Curl_dyn_vprintf(struct dynbuf *dyn, const char *format, va_list ap_save);
-
-/* Dynamic buffer max sizes */
-#define DYN_DOH_RESPONSE    3000
-#define DYN_DOH_CNAME       256
-#define DYN_PAUSE_BUFFER    (64 * 1024 * 1024)
-#define DYN_HAXPROXY        2048
-#define DYN_HTTP_REQUEST    (1024*1024)
-#define DYN_APRINTF         8000000
-#define DYN_RTSP_REQ_HEADER (64*1024)
-#define DYN_TRAILERS        (64*1024)
-#define DYN_PROXY_CONNECT_HEADERS 16384
-#define DYN_QLOG_NAME       1024
-#define DYN_H1_TRAILER      4096
-#define DYN_PINGPPONG_CMD   (64*1024)
-#define DYN_IMAP_CMD        (64*1024)
-#endif
diff --git a/third-party/curl/lib/dynhds.c b/third-party/curl/lib/dynhds.c
index 007dfc588c..097306cec9 100644
--- a/third-party/curl/lib/dynhds.c
+++ b/third-party/curl/lib/dynhds.c
@@ -21,30 +21,24 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+
 #include "dynhds.h"
 #include "strcase.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-
-static struct dynhds_entry *
-entry_new(const char *name, size_t namelen,
-          const char *value, size_t valuelen, int opts)
+static struct dynhds_entry *entry_new(const char *name, size_t namelen,
+                                      const char *value, size_t valuelen,
+                                      int opts)
 {
   struct dynhds_entry *e;
   char *p;
 
   DEBUGASSERT(name);
   DEBUGASSERT(value);
-  e = calloc(1, sizeof(*e) + namelen + valuelen + 2);
+  e = curlx_calloc(1, sizeof(*e) + namelen + valuelen + 2);
   if(!e)
     return NULL;
-  e->name = p = ((char *)e) + sizeof(*e);
+  e->name = p = (char *)e + sizeof(*e);
   memcpy(p, name, namelen);
   e->namelen = namelen;
   e->value = p += namelen + 1; /* leave a \0 at the end of name */
@@ -55,33 +49,9 @@ entry_new(const char *name, size_t namelen,
   return e;
 }
 
-static struct dynhds_entry *
-entry_append(struct dynhds_entry *e,
-             const char *value, size_t valuelen)
-{
-  struct dynhds_entry *e2;
-  size_t valuelen2 = e->valuelen + 1 + valuelen;
-  char *p;
-
-  DEBUGASSERT(value);
-  e2 = calloc(1, sizeof(*e) + e->namelen + valuelen2 + 2);
-  if(!e2)
-    return NULL;
-  e2->name = p = ((char *)e2) + sizeof(*e2);
-  memcpy(p, e->name, e->namelen);
-  e2->namelen = e->namelen;
-  e2->value = p += e->namelen + 1; /* leave a \0 at the end of name */
-  memcpy(p, e->value, e->valuelen);
-  p += e->valuelen;
-  p[0] = ' ';
-  memcpy(p + 1, value, valuelen);
-  e2->valuelen = valuelen2;
-  return e2;
-}
-
 static void entry_free(struct dynhds_entry *e)
 {
-  free(e);
+  curlx_free(e);
 }
 
 void Curl_dynhds_init(struct dynhds *dynhds, size_t max_entries,
@@ -106,7 +76,7 @@ void Curl_dynhds_free(struct dynhds *dynhds)
       entry_free(dynhds->hds[i]);
     }
   }
-  Curl_safefree(dynhds->hds);
+  curlx_safefree(dynhds->hds);
   dynhds->hds_len = dynhds->hds_allc = dynhds->strs_len = 0;
 }
 
@@ -137,7 +107,7 @@ void Curl_dynhds_set_opts(struct dynhds *dynhds, int opts)
 struct dynhds_entry *Curl_dynhds_getn(struct dynhds *dynhds, size_t n)
 {
   DEBUGASSERT(dynhds);
-  return (n < dynhds->hds_len)? dynhds->hds[n] : NULL;
+  return (n < dynhds->hds_len) ? dynhds->hds[n] : NULL;
 }
 
 struct dynhds_entry *Curl_dynhds_get(struct dynhds *dynhds, const char *name,
@@ -146,7 +116,7 @@ struct dynhds_entry *Curl_dynhds_get(struct dynhds *dynhds, const char *name,
   size_t i;
   for(i = 0; i < dynhds->hds_len; ++i) {
     if(dynhds->hds[i]->namelen == namelen &&
-       strncasecompare(dynhds->hds[i]->name, name, namelen)) {
+       curl_strnequal(dynhds->hds[i]->name, name, namelen)) {
       return dynhds->hds[i];
     }
   }
@@ -171,7 +141,7 @@ CURLcode Curl_dynhds_add(struct dynhds *dynhds,
   if(dynhds->strs_len + namelen + valuelen > dynhds->max_strs_size)
     return CURLE_OUT_OF_MEMORY;
 
-entry = entry_new(name, namelen, value, valuelen, dynhds->opts);
+  entry = entry_new(name, namelen, value, valuelen, dynhds->opts);
   if(!entry)
     goto out;
 
@@ -182,13 +152,13 @@ entry = entry_new(name, namelen, value, valuelen, dynhds->opts);
     if(dynhds->max_entries && nallc > dynhds->max_entries)
       nallc = dynhds->max_entries;
 
-    nhds = calloc(nallc, sizeof(struct dynhds_entry *));
+    nhds = curlx_calloc(nallc, sizeof(struct dynhds_entry *));
     if(!nhds)
       goto out;
     if(dynhds->hds) {
       memcpy(nhds, dynhds->hds,
              dynhds->hds_len * sizeof(struct dynhds_entry *));
-      Curl_safefree(dynhds->hds);
+      curlx_safefree(dynhds->hds);
     }
     dynhds->hds = nhds;
     dynhds->hds_allc = nallc;
@@ -222,106 +192,108 @@ CURLcode Curl_dynhds_h1_add_line(struct dynhds *dynhds,
   if(!line || !line_len)
     return CURLE_OK;
 
-  if((line[0] == ' ') || (line[0] == '\t')) {
-    struct dynhds_entry *e, *e2;
-    /* header continuation, yikes! */
-    if(!dynhds->hds_len)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-
-    while(line_len && ISBLANK(line[0])) {
-      ++line;
-      --line_len;
-    }
-    if(!line_len)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    e = dynhds->hds[dynhds->hds_len-1];
-    e2 = entry_append(e, line, line_len);
-    if(!e2)
-      return CURLE_OUT_OF_MEMORY;
-    dynhds->hds[dynhds->hds_len-1] = e2;
-    entry_free(e);
-    return CURLE_OK;
+  p = memchr(line, ':', line_len);
+  if(!p)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  name = line;
+  namelen = p - line;
+  p++; /* move past the colon */
+  for(i = namelen + 1; i < line_len; ++i, ++p) {
+    if(!ISBLANK(*p))
+      break;
   }
-  else {
-    p = memchr(line, ':', line_len);
-    if(!p)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    name = line;
-    namelen = p - line;
-    p++; /* move past the colon */
-    for(i = namelen + 1; i < line_len; ++i, ++p) {
-      if(!ISBLANK(*p))
-        break;
-    }
-    value = p;
-    valuelen = line_len - i;
+  value = p;
+  valuelen = line_len - i;
 
-    p = memchr(value, '\r', valuelen);
-    if(!p)
-      p = memchr(value, '\n', valuelen);
-    if(p)
-      valuelen = (size_t)(p - value);
+  p = memchr(value, '\r', valuelen);
+  if(!p)
+    p = memchr(value, '\n', valuelen);
+  if(p)
+    valuelen = (size_t)(p - value);
 
-    return Curl_dynhds_add(dynhds, name, namelen, value, valuelen);
-  }
+  return Curl_dynhds_add(dynhds, name, namelen, value, valuelen);
 }
 
 CURLcode Curl_dynhds_h1_cadd_line(struct dynhds *dynhds, const char *line)
 {
-  return Curl_dynhds_h1_add_line(dynhds, line, line? strlen(line) : 0);
+  return Curl_dynhds_h1_add_line(dynhds, line, line ? strlen(line) : 0);
 }
 
-#ifdef DEBUGBUILD
-/* used by unit2602.c */
+#ifdef UNITTESTS
+/* @unittest 2602 */
 
-bool Curl_dynhds_contains(struct dynhds *dynhds,
-                          const char *name, size_t namelen)
+/**
+ * Return TRUE iff one or more headers with the given name exist.
+ */
+UNITTEST bool dynhds_contains(struct dynhds *dynhds,
+                              const char *name, size_t namelen);
+UNITTEST bool dynhds_contains(struct dynhds *dynhds,
+                              const char *name, size_t namelen)
 {
   return !!Curl_dynhds_get(dynhds, name, namelen);
 }
 
-bool Curl_dynhds_ccontains(struct dynhds *dynhds, const char *name)
+/* @unittest 2602 */
+UNITTEST bool dynhds_ccontains(struct dynhds *dynhds, const char *name);
+UNITTEST bool dynhds_ccontains(struct dynhds *dynhds, const char *name)
 {
-  return Curl_dynhds_contains(dynhds, name, strlen(name));
+  return dynhds_contains(dynhds, name, strlen(name));
 }
 
-size_t Curl_dynhds_count_name(struct dynhds *dynhds,
-                              const char *name, size_t namelen)
+/**
+ * Return how often the given name appears in `dynhds`.
+ * Names are case-insensitive.
+ *
+ * @unittest 2602
+ */
+UNITTEST size_t dynhds_count_name(struct dynhds *dynhds,
+                                  const char *name, size_t namelen);
+UNITTEST size_t dynhds_count_name(struct dynhds *dynhds,
+                                  const char *name, size_t namelen)
 {
   size_t n = 0;
   if(dynhds->hds_len) {
     size_t i;
     for(i = 0; i < dynhds->hds_len; ++i) {
       if((namelen == dynhds->hds[i]->namelen) &&
-         strncasecompare(name, dynhds->hds[i]->name, namelen))
+         curl_strnequal(name, dynhds->hds[i]->name, namelen))
         ++n;
     }
   }
   return n;
 }
 
-size_t Curl_dynhds_ccount_name(struct dynhds *dynhds, const char *name)
+/**
+ * Return how often the given null-terminated name appears in `dynhds`.
+ * Names are case-insensitive.
+ *
+ * @unittest 2602
+ */
+UNITTEST size_t dynhds_ccount_name(struct dynhds *dynhds,
+                                        const char *name);
+UNITTEST size_t dynhds_ccount_name(struct dynhds *dynhds,
+                                        const char *name)
 {
-  return Curl_dynhds_count_name(dynhds, name, strlen(name));
+  return dynhds_count_name(dynhds, name, strlen(name));
 }
 
-CURLcode Curl_dynhds_set(struct dynhds *dynhds,
-                         const char *name, size_t namelen,
-                         const char *value, size_t valuelen)
-{
-  Curl_dynhds_remove(dynhds, name, namelen);
-  return Curl_dynhds_add(dynhds, name, namelen, value, valuelen);
-}
-
-size_t Curl_dynhds_remove(struct dynhds *dynhds,
-                          const char *name, size_t namelen)
+/**
+ * Remove all entries with the given name.
+ * Returns number of entries removed.
+ *
+ * @unittest 2602
+ */
+UNITTEST size_t dynhds_remove(struct dynhds *dynhds,
+                              const char *name, size_t namelen);
+UNITTEST size_t dynhds_remove(struct dynhds *dynhds,
+                              const char *name, size_t namelen)
 {
   size_t n = 0;
   if(dynhds->hds_len) {
     size_t i, len;
     for(i = 0; i < dynhds->hds_len; ++i) {
       if((namelen == dynhds->hds[i]->namelen) &&
-         strncasecompare(name, dynhds->hds[i]->name, namelen)) {
+         curl_strnequal(name, dynhds->hds[i]->name, namelen)) {
         ++n;
         --dynhds->hds_len;
         dynhds->strs_len -= (dynhds->hds[i]->namelen +
@@ -339,11 +311,33 @@ size_t Curl_dynhds_remove(struct dynhds *dynhds,
   return n;
 }
 
-size_t Curl_dynhds_cremove(struct dynhds *dynhds, const char *name)
+/**
+ * Set the give header name and value, replacing any entries with
+ * the same name. The header is added at the end of all (remaining)
+ * entries.
+ *
+ * @unittest 2602
+ */
+UNITTEST CURLcode dynhds_set(struct dynhds *dynhds,
+                             const char *name, size_t namelen,
+                             const char *value, size_t valuelen);
+UNITTEST CURLcode dynhds_set(struct dynhds *dynhds,
+                             const char *name, size_t namelen,
+                             const char *value, size_t valuelen)
 {
-  return Curl_dynhds_remove(dynhds, name, strlen(name));
+  dynhds_remove(dynhds, name, namelen);
+  return Curl_dynhds_add(dynhds, name, namelen, value, valuelen);
 }
 
+/* @unittest 2602 */
+UNITTEST size_t dynhds_cremove(struct dynhds *dynhds, const char *name);
+UNITTEST size_t dynhds_cremove(struct dynhds *dynhds, const char *name)
+{
+  return dynhds_remove(dynhds, name, strlen(name));
+}
+
+#endif /* UNITTESTS */
+
 CURLcode Curl_dynhds_h1_dprint(struct dynhds *dynhds, struct dynbuf *dbuf)
 {
   CURLcode result = CURLE_OK;
@@ -353,9 +347,10 @@ CURLcode Curl_dynhds_h1_dprint(struct dynhds *dynhds, struct dynbuf *dbuf)
     return result;
 
   for(i = 0; i < dynhds->hds_len; ++i) {
-    result = Curl_dyn_addf(dbuf, "%.*s: %.*s\r\n",
-               (int)dynhds->hds[i]->namelen, dynhds->hds[i]->name,
-               (int)dynhds->hds[i]->valuelen, dynhds->hds[i]->value);
+    result = curlx_dyn_addf(dbuf, "%.*s: %.*s\r\n",
+                            (int)dynhds->hds[i]->namelen, dynhds->hds[i]->name,
+                            (int)dynhds->hds[i]->valuelen,
+                            dynhds->hds[i]->value);
     if(result)
       break;
   }
@@ -363,4 +358,28 @@ CURLcode Curl_dynhds_h1_dprint(struct dynhds *dynhds, struct dynbuf *dbuf)
   return result;
 }
 
-#endif
+#ifdef USE_NGHTTP2
+
+nghttp2_nv *Curl_dynhds_to_nva(struct dynhds *dynhds, size_t *pcount)
+{
+  nghttp2_nv *nva = curlx_calloc(1, sizeof(nghttp2_nv) * dynhds->hds_len);
+  size_t i;
+
+  *pcount = 0;
+  if(!nva)
+    return NULL;
+
+  for(i = 0; i < dynhds->hds_len; ++i) {
+    struct dynhds_entry *e = dynhds->hds[i];
+    DEBUGASSERT(e);
+    nva[i].name = (unsigned char *)e->name;
+    nva[i].namelen = e->namelen;
+    nva[i].value = (unsigned char *)e->value;
+    nva[i].valuelen = e->valuelen;
+    nva[i].flags = NGHTTP2_NV_FLAG_NONE;
+  }
+  *pcount = dynhds->hds_len;
+  return nva;
+}
+
+#endif /* USE_NGHTTP2 */
diff --git a/third-party/curl/lib/dynhds.h b/third-party/curl/lib/dynhds.h
index 8a053480e9..d5337eb353 100644
--- a/third-party/curl/lib/dynhds.h
+++ b/third-party/curl/lib/dynhds.h
@@ -25,14 +25,13 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
-#include <curl/curl.h>
-#include "dynbuf.h"
+#include "curlx/dynbuf.h"
 
 struct dynbuf;
 
 /**
  * A single header entry.
- * `name` and `value` are non-NULL and always NUL terminated.
+ * `name` and `value` are non-NULL and always null-terminated.
  */
 struct dynhds_entry {
   char *name;
@@ -51,7 +50,7 @@ struct dynhds {
   int opts;
 };
 
-#define DYNHDS_OPT_NONE          (0)
+#define DYNHDS_OPT_NONE          0
 #define DYNHDS_OPT_LOWERCASE     (1 << 0)
 
 /**
@@ -95,25 +94,8 @@ struct dynhds_entry *Curl_dynhds_get(struct dynhds *dynhds,
                                      const char *name, size_t namelen);
 struct dynhds_entry *Curl_dynhds_cget(struct dynhds *dynhds, const char *name);
 
-/**
- * Return TRUE iff one or more headers with the given name exist.
- */
-bool Curl_dynhds_contains(struct dynhds *dynhds,
-                          const char *name, size_t namelen);
-bool Curl_dynhds_ccontains(struct dynhds *dynhds, const char *name);
-
-/**
- * Return how often the given name appears in `dynhds`.
- * Names are case-insensitive.
- */
-size_t Curl_dynhds_count_name(struct dynhds *dynhds,
-                              const char *name, size_t namelen);
-
-/**
- * Return how often the given 0-terminated name appears in `dynhds`.
- * Names are case-insensitive.
- */
-size_t Curl_dynhds_ccount_name(struct dynhds *dynhds, const char *name);
+CURLcode Curl_dynhds_cset(struct dynhds *dynhds,
+                          const char *name, const char *value);
 
 /**
  * Add a header, name + value, to `dynhds` at the end. Does *not*
@@ -130,45 +112,30 @@ CURLcode Curl_dynhds_cadd(struct dynhds *dynhds,
                           const char *name, const char *value);
 
 /**
- * Remove all entries with the given name.
- * Returns number of entries removed.
- */
-size_t Curl_dynhds_remove(struct dynhds *dynhds,
-                          const char *name, size_t namelen);
-size_t Curl_dynhds_cremove(struct dynhds *dynhds, const char *name);
-
-
-/**
- * Set the give header name and value, replacing any entries with
- * the same name. The header is added at the end of all (remaining)
- * entries.
- */
-CURLcode Curl_dynhds_set(struct dynhds *dynhds,
-                         const char *name, size_t namelen,
-                         const char *value, size_t valuelen);
-
-CURLcode Curl_dynhds_cset(struct dynhds *dynhds,
-                          const char *name, const char *value);
-
-/**
- * Add a single header from a HTTP/1.1 formatted line at the end. Line
- * may contain a delimiting \r\n or just \n. Any characters after
- * that will be ignored.
+ * Add a single header from an HTTP/1.1 formatted line at the end. Line may
+ * contain a delimiting CRLF or LF. Any characters after that will be ignored.
  */
 CURLcode Curl_dynhds_h1_cadd_line(struct dynhds *dynhds, const char *line);
 
 /**
- * Add a single header from a HTTP/1.1 formatted line at the end. Line
- * may contain a delimiting \r\n or just \n. Any characters after
- * that will be ignored.
+ * Add a single header from an HTTP/1.1 formatted line at the end. Line may
+ * contain a delimiting CRLF or LF. Any characters after that will be ignored.
  */
 CURLcode Curl_dynhds_h1_add_line(struct dynhds *dynhds,
                                  const char *line, size_t line_len);
 
 /**
  * Add the headers to the given `dynbuf` in HTTP/1.1 format with
- * cr+lf line endings. Will NOT output a last empty line.
+ * CR+LF line endings. Does NOT output a last empty line.
  */
 CURLcode Curl_dynhds_h1_dprint(struct dynhds *dynhds, struct dynbuf *dbuf);
 
+#ifdef USE_NGHTTP2
+
+#include <nghttp2/nghttp2.h>
+
+nghttp2_nv *Curl_dynhds_to_nva(struct dynhds *dynhds, size_t *pcount);
+
+#endif /* USE_NGHTTP2 */
+
 #endif /* HEADER_CURL_DYNHDS_H */
diff --git a/third-party/curl/lib/easy.c b/third-party/curl/lib/easy.c
index 16bbd35251..d60bdaed7b 100644
--- a/third-party/curl/lib/easy.c
+++ b/third-party/curl/lib/easy.c
@@ -21,7 +21,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef HAVE_NETINET_IN_H
@@ -45,51 +44,47 @@
 #endif
 
 #include "urldata.h"
-#include <curl/curl.h>
 #include "transfer.h"
 #include "vtls/vtls.h"
+#include "vtls/vtls_scache.h"
+#include "vquic/vquic.h"
 #include "url.h"
 #include "getinfo.h"
 #include "hostip.h"
-#include "share.h"
-#include "strdup.h"
-#include "progress.h"
+#include "curlx/strdup.h"
 #include "easyif.h"
 #include "multiif.h"
+#include "multi_ev.h"
 #include "select.h"
 #include "cfilters.h"
-#include "sendf.h" /* for failf function prototype */
+#include "sendf.h"
+#include "curl_trc.h"
 #include "connect.h" /* for Curl_getconnectinfo */
 #include "slist.h"
 #include "mime.h"
 #include "amigaos.h"
 #include "macos.h"
-#include "warnless.h"
+#include "curlx/wait.h"
 #include "sigpipe.h"
 #include "vssh/ssh.h"
 #include "setopt.h"
 #include "http_digest.h"
 #include "system_win32.h"
-#include "http2.h"
-#include "dynbuf.h"
+#include "curlx/dynbuf.h"
+#include "bufref.h"
 #include "altsvc.h"
 #include "hsts.h"
 
 #include "easy_lock.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
 /* true globals -- for curl_global_init() and curl_global_cleanup() */
-static unsigned int  initialized;
-static long          easy_init_flags;
+static unsigned int initialized;
+static long easy_init_flags;
 
 #ifdef GLOBAL_INIT_IS_THREADSAFE
 
 static curl_simple_lock s_lock = CURL_SIMPLE_LOCK_INIT;
-#define global_init_lock() curl_simple_lock_lock(&s_lock)
+#define global_init_lock()   curl_simple_lock_lock(&s_lock)
 #define global_init_unlock() curl_simple_lock_unlock(&s_lock)
 
 #else
@@ -99,20 +94,8 @@ static curl_simple_lock s_lock = CURL_SIMPLE_LOCK_INIT;
 
 #endif
 
-/*
- * strdup (and other memory functions) is redefined in complicated
- * ways, but at this point it must be defined as the system-supplied strdup
- * so the callback pointer is initialized correctly.
- */
-#if defined(_WIN32_WCE)
-#define system_strdup _strdup
-#elif !defined(HAVE_STRDUP)
-#define system_strdup Curl_strdup
-#else
-#define system_strdup strdup
-#endif
-
-#if defined(_MSC_VER) && defined(_DLL) && !defined(__POCC__)
+#if defined(_MSC_VER) && defined(_DLL)
+#  pragma warning(push)
 #  pragma warning(disable:4232) /* MSVC extension, dllimport identity */
 #endif
 
@@ -123,14 +106,11 @@ static curl_simple_lock s_lock = CURL_SIMPLE_LOCK_INIT;
 curl_malloc_callback Curl_cmalloc = (curl_malloc_callback)malloc;
 curl_free_callback Curl_cfree = (curl_free_callback)free;
 curl_realloc_callback Curl_crealloc = (curl_realloc_callback)realloc;
-curl_strdup_callback Curl_cstrdup = (curl_strdup_callback)system_strdup;
+curl_strdup_callback Curl_cstrdup = (curl_strdup_callback)CURLX_STRDUP_LOW;
 curl_calloc_callback Curl_ccalloc = (curl_calloc_callback)calloc;
-#if defined(WIN32) && defined(UNICODE)
-curl_wcsdup_callback Curl_cwcsdup = Curl_wcsdup;
-#endif
 
-#if defined(_MSC_VER) && defined(_DLL) && !defined(__POCC__)
-#  pragma warning(default:4232) /* MSVC extension, dllimport identity */
+#if defined(_MSC_VER) && defined(_DLL)
+#  pragma warning(pop)
 #endif
 
 #ifdef DEBUGBUILD
@@ -151,62 +131,56 @@ static CURLcode global_init(long flags, bool memoryfuncs)
     Curl_cmalloc = (curl_malloc_callback)malloc;
     Curl_cfree = (curl_free_callback)free;
     Curl_crealloc = (curl_realloc_callback)realloc;
-    Curl_cstrdup = (curl_strdup_callback)system_strdup;
+    Curl_cstrdup = (curl_strdup_callback)CURLX_STRDUP_LOW;
     Curl_ccalloc = (curl_calloc_callback)calloc;
-#if defined(WIN32) && defined(UNICODE)
-    Curl_cwcsdup = (curl_wcsdup_callback)_wcsdup;
-#endif
   }
 
   if(Curl_trc_init()) {
-    DEBUGF(fprintf(stderr, "Error: Curl_trc_init failed\n"));
+    DEBUGF(curl_mfprintf(stderr, "Error: Curl_trc_init failed\n"));
     goto fail;
   }
 
   if(!Curl_ssl_init()) {
-    DEBUGF(fprintf(stderr, "Error: Curl_ssl_init failed\n"));
+    DEBUGF(curl_mfprintf(stderr, "Error: Curl_ssl_init failed\n"));
+    goto fail;
+  }
+
+  if(!Curl_vquic_init()) {
+    DEBUGF(curl_mfprintf(stderr, "Error: Curl_vquic_init failed\n"));
     goto fail;
   }
 
   if(Curl_win32_init(flags)) {
-    DEBUGF(fprintf(stderr, "Error: win32_init failed\n"));
+    DEBUGF(curl_mfprintf(stderr, "Error: win32_init failed\n"));
     goto fail;
   }
 
   if(Curl_amiga_init()) {
-    DEBUGF(fprintf(stderr, "Error: Curl_amiga_init failed\n"));
+    DEBUGF(curl_mfprintf(stderr, "Error: Curl_amiga_init failed\n"));
     goto fail;
   }
 
   if(Curl_macos_init()) {
-    DEBUGF(fprintf(stderr, "Error: Curl_macos_init failed\n"));
+    DEBUGF(curl_mfprintf(stderr, "Error: Curl_macos_init failed\n"));
     goto fail;
   }
 
-  if(Curl_resolver_global_init()) {
-    DEBUGF(fprintf(stderr, "Error: resolver_global_init failed\n"));
+  if(Curl_async_global_init()) {
+    DEBUGF(curl_mfprintf(stderr, "Error: resolver_global_init failed\n"));
     goto fail;
   }
 
-#if defined(USE_SSH)
   if(Curl_ssh_init()) {
+    DEBUGF(curl_mfprintf(stderr, "Error: Curl_ssh_init failed\n"));
     goto fail;
   }
-#endif
-
-#ifdef USE_WOLFSSH
-  if(WS_SUCCESS != wolfSSH_Init()) {
-    DEBUGF(fprintf(stderr, "Error: wolfSSH_Init failed\n"));
-    return CURLE_FAILED_INIT;
-  }
-#endif
 
   easy_init_flags = flags;
 
 #ifdef DEBUGBUILD
   if(getenv("CURL_GLOBAL_INIT"))
     /* alloc data that will leak if *cleanup() is not called! */
-    leakpointer = malloc(1);
+    leakpointer = curlx_malloc(1);
 #endif
 
   return CURLE_OK;
@@ -216,7 +190,6 @@ fail:
   return CURLE_FAILED_INIT;
 }
 
-
 /**
  * curl_global_init() globally initializes curl given a bitwise set of the
  * different features of what to initialize.
@@ -250,7 +223,7 @@ CURLcode curl_global_init_mem(long flags, curl_malloc_callback m,
   global_init_lock();
 
   if(initialized) {
-    /* Already initialized, don't do it again, but bump the variable anyway to
+    /* Already initialized, do not do it again, but bump the variable anyway to
        work like curl_global_init() and require the same amount of cleanup
        calls. */
     initialized++;
@@ -276,7 +249,8 @@ CURLcode curl_global_init_mem(long flags, curl_malloc_callback m,
 
 /**
  * curl_global_cleanup() globally cleanups curl, uses the value of
- * "easy_init_flags" to determine what needs to be cleaned up and what doesn't.
+ * "easy_init_flags" to determine what needs to be cleaned up and what does
+ * not.
  */
 void curl_global_cleanup(void)
 {
@@ -293,9 +267,9 @@ void curl_global_cleanup(void)
   }
 
   Curl_ssl_cleanup();
-  Curl_resolver_global_cleanup();
+  Curl_async_global_cleanup();
 
-#ifdef WIN32
+#ifdef _WIN32
   Curl_win32_cleanup(easy_init_flags);
 #endif
 
@@ -303,11 +277,8 @@ void curl_global_cleanup(void)
 
   Curl_ssh_cleanup();
 
-#ifdef USE_WOLFSSH
-  (void)wolfSSH_Cleanup();
-#endif
 #ifdef DEBUGBUILD
-  free(leakpointer);
+  curlx_free(leakpointer);
 #endif
 
   easy_init_flags = 0;
@@ -356,7 +327,7 @@ CURLsslset curl_global_sslset(curl_sslbackend id, const char *name,
  * curl_easy_init() is the external interface to alloc, setup and init an
  * easy handle that is returned. If anything goes wrong, NULL is returned.
  */
-struct Curl_easy *curl_easy_init(void)
+CURL *curl_easy_init(void)
 {
   CURLcode result;
   struct Curl_easy *data;
@@ -368,24 +339,24 @@ struct Curl_easy *curl_easy_init(void)
     result = global_init(CURL_GLOBAL_DEFAULT, TRUE);
     if(result) {
       /* something in the global init failed, return nothing */
-      DEBUGF(fprintf(stderr, "Error: curl_global_init failed\n"));
+      DEBUGF(curl_mfprintf(stderr, "Error: curl_global_init failed\n"));
       global_init_unlock();
       return NULL;
     }
   }
   global_init_unlock();
 
-  /* We use curl_open() with undefined URL so far */
+  /* We use Curl_open() with undefined URL so far */
   result = Curl_open(&data);
   if(result) {
-    DEBUGF(fprintf(stderr, "Error: Curl_open failed\n"));
+    DEBUGF(curl_mfprintf(stderr, "Error: Curl_open failed\n"));
     return NULL;
   }
 
   return data;
 }
 
-#ifdef CURLDEBUG
+#ifdef DEBUGBUILD
 
 struct socketmonitor {
   struct socketmonitor *next; /* the next node in the list or NULL */
@@ -400,31 +371,27 @@ struct events {
   int running_handles;  /* store the returned number */
 };
 
+#define DEBUG_EV_POLL   0
+
 /* events_timer
  *
  * Callback that gets called with a new value when the timeout should be
  * updated.
  */
-
-static int events_timer(struct Curl_multi *multi,    /* multi handle */
+static int events_timer(CURLM *multi,    /* multi handle */
                         long timeout_ms, /* see above */
-                        void *userp)    /* private callback pointer */
+                        void *userp)     /* private callback pointer */
 {
   struct events *ev = userp;
   (void)multi;
-  if(timeout_ms == -1)
-    /* timeout removed */
-    timeout_ms = 0;
-  else if(timeout_ms == 0)
-    /* timeout is already reached! */
-    timeout_ms = 1; /* trigger asap */
-
+#if DEBUG_EV_POLL
+  curl_mfprintf(stderr, "events_timer: set timeout %ldms\n", timeout_ms);
+#endif
   ev->ms = timeout_ms;
   ev->msbump = TRUE;
   return 0;
 }
 
-
 /* poll2cselect
  *
  * convert from poll() bit definitions to libcurl's CURL_CSELECT_* ones
@@ -441,7 +408,6 @@ static int poll2cselect(int pollmask)
   return omask;
 }
 
-
 /* socketcb2poll
  *
  * convert from libcurl' CURL_POLL_* bit definitions to poll()'s
@@ -461,7 +427,7 @@ static short socketcb2poll(int pollmask)
  * Callback that gets called with information about socket activity to
  * monitor.
  */
-static int events_socket(struct Curl_easy *easy,      /* easy handle */
+static int events_socket(CURL *easy,      /* easy handle */
                          curl_socket_t s, /* socket */
                          int what,        /* see above */
                          void *userp,     /* private callback
@@ -472,16 +438,18 @@ static int events_socket(struct Curl_easy *easy,      /* easy handle */
   struct events *ev = userp;
   struct socketmonitor *m;
   struct socketmonitor *prev = NULL;
+  bool found = FALSE;
+  struct Curl_easy *data = easy;
 
-#if defined(CURL_DISABLE_VERBOSE_STRINGS)
-  (void) easy;
+#ifdef CURL_DISABLE_VERBOSE_STRINGS
+  (void)easy;
 #endif
   (void)socketp;
 
   m = ev->list;
   while(m) {
     if(m->socket.fd == s) {
-
+      found = TRUE;
       if(what == CURL_POLL_REMOVE) {
         struct socketmonitor *nxt = m->next;
         /* remove this node from the list of monitored sockets */
@@ -489,41 +457,41 @@ static int events_socket(struct Curl_easy *easy,      /* easy handle */
           prev->next = nxt;
         else
           ev->list = nxt;
-        free(m);
-        m = nxt;
-        infof(easy, "socket cb: socket %d REMOVED", s);
+        curlx_free(m);
+        infof(data, "socket cb: socket %" FMT_SOCKET_T " REMOVED", s);
       }
       else {
         /* The socket 's' is already being monitored, update the activity
            mask. Convert from libcurl bitmask to the poll one. */
         m->socket.events = socketcb2poll(what);
-        infof(easy, "socket cb: socket %d UPDATED as %s%s", s,
-              (what&CURL_POLL_IN)?"IN":"",
-              (what&CURL_POLL_OUT)?"OUT":"");
+        infof(data, "socket cb: socket %" FMT_SOCKET_T " UPDATED as %s%s", s,
+              (what & CURL_POLL_IN) ? "IN" : "",
+              (what & CURL_POLL_OUT) ? "OUT" : "");
       }
       break;
     }
     prev = m;
     m = m->next; /* move to next node */
   }
-  if(!m) {
+
+  if(!found) {
     if(what == CURL_POLL_REMOVE) {
-      /* this happens a bit too often, libcurl fix perhaps? */
-      /* fprintf(stderr,
-         "%s: socket %d asked to be REMOVED but not present!\n",
-                 __func__, s); */
+      /* should not happen if our logic is correct, but is no drama. */
+      DEBUGF(infof(data, "socket cb: asked to REMOVE socket %"
+                   FMT_SOCKET_T "but not present!", s));
+      DEBUGASSERT(0);
     }
     else {
-      m = malloc(sizeof(struct socketmonitor));
+      m = curlx_malloc(sizeof(struct socketmonitor));
       if(m) {
         m->next = ev->list;
         m->socket.fd = s;
         m->socket.events = socketcb2poll(what);
         m->socket.revents = 0;
         ev->list = m;
-        infof(easy, "socket cb: socket %d ADDED as %s%s", s,
-              (what&CURL_POLL_IN)?"IN":"",
-              (what&CURL_POLL_OUT)?"OUT":"");
+        infof(data, "socket cb: socket %" FMT_SOCKET_T " ADDED as %s%s", s,
+              (what & CURL_POLL_IN) ? "IN" : "",
+              (what & CURL_POLL_OUT) ? "OUT" : "");
       }
       else
         return CURLE_OUT_OF_MEMORY;
@@ -533,7 +501,6 @@ static int events_socket(struct Curl_easy *easy,      /* easy handle */
   return 0;
 }
 
-
 /*
  * events_setup()
  *
@@ -550,91 +517,137 @@ static void events_setup(struct Curl_multi *multi, struct events *ev)
   curl_multi_setopt(multi, CURLMOPT_SOCKETDATA, ev);
 }
 
+/* populate_fds()
+ *
+ * populate the fds[] array
+ */
+static unsigned int populate_fds(struct pollfd *fds, struct events *ev)
+{
+  unsigned int numfds = 0;
+  struct pollfd *f;
+  struct socketmonitor *m;
+
+  f = &fds[0];
+  for(m = ev->list; m; m = m->next) {
+    f->fd = m->socket.fd;
+    f->events = m->socket.events;
+    f->revents = 0;
+#if DEBUG_EV_POLL
+    curl_mfprintf(stderr, "poll() %d check socket %d\n", numfds, f->fd);
+#endif
+    f++;
+    numfds++;
+  }
+  return numfds;
+}
+
+/* poll_fds()
+ *
+ * poll the fds[] array
+ */
+static CURLcode poll_fds(struct events *ev,
+                         struct pollfd *fds,
+                         const unsigned int numfds,
+                         int *pollrc)
+{
+  if(numfds) {
+    /* wait for activity or timeout */
+#if DEBUG_EV_POLL
+    curl_mfprintf(stderr, "poll(numfds=%u, timeout=%ldms)\n", numfds, ev->ms);
+#endif
+    *pollrc = Curl_poll(fds, numfds, ev->ms);
+#if DEBUG_EV_POLL
+    curl_mfprintf(stderr, "poll(numfds=%u, timeout=%ldms) -> %d\n",
+                  numfds, ev->ms, *pollrc);
+#endif
+    if(*pollrc < 0)
+      return CURLE_UNRECOVERABLE_POLL;
+  }
+  else {
+#if DEBUG_EV_POLL
+    curl_mfprintf(stderr, "poll, but no fds, wait timeout=%ldms\n", ev->ms);
+#endif
+    *pollrc = 0;
+    if(ev->ms > 0)
+      curlx_wait_ms(ev->ms);
+  }
+  return CURLE_OK;
+}
 
 /* wait_or_timeout()
  *
  * waits for activity on any of the given sockets, or the timeout to trigger.
  */
-
 static CURLcode wait_or_timeout(struct Curl_multi *multi, struct events *ev)
 {
   bool done = FALSE;
-  CURLMcode mcode = CURLM_OK;
+  CURLMcode mresult = CURLM_OK;
   CURLcode result = CURLE_OK;
 
   while(!done) {
     CURLMsg *msg;
-    struct socketmonitor *m;
-    struct pollfd *f;
     struct pollfd fds[4];
-    int numfds = 0;
     int pollrc;
-    int i;
-    struct curltime before;
-    struct curltime after;
-
-    /* populate the fds[] array */
-    for(m = ev->list, f = &fds[0]; m; m = m->next) {
-      f->fd = m->socket.fd;
-      f->events = m->socket.events;
-      f->revents = 0;
-      /* fprintf(stderr, "poll() %d check socket %d\n", numfds, f->fd); */
-      f++;
-      numfds++;
-    }
+    struct curltime start;
+    const unsigned int numfds = populate_fds(fds, ev);
 
     /* get the time stamp to use to figure out how long poll takes */
-    before = Curl_now();
+    curlx_pnow(&start);
 
-    /* wait for activity or timeout */
-    pollrc = Curl_poll(fds, numfds, ev->ms);
-    if(pollrc < 0)
-      return CURLE_UNRECOVERABLE_POLL;
-
-    after = Curl_now();
+    result = poll_fds(ev, fds, numfds, &pollrc);
+    if(result)
+      return result;
 
     ev->msbump = FALSE; /* reset here */
 
     if(!pollrc) {
       /* timeout! */
       ev->ms = 0;
-      /* fprintf(stderr, "call curl_multi_socket_action(TIMEOUT)\n"); */
-      mcode = curl_multi_socket_action(multi, CURL_SOCKET_TIMEOUT, 0,
-                                       &ev->running_handles);
+#if 0
+      curl_mfprintf(stderr, "call curl_multi_socket_action(TIMEOUT)\n");
+#endif
+      mresult = curl_multi_socket_action(multi, CURL_SOCKET_TIMEOUT, 0,
+                                         &ev->running_handles);
     }
     else {
       /* here pollrc is > 0 */
-
       /* loop over the monitored sockets to see which ones had activity */
-      for(i = 0; i< numfds; i++) {
+      unsigned int i;
+      for(i = 0; i < numfds; i++) {
         if(fds[i].revents) {
           /* socket activity, tell libcurl */
           int act = poll2cselect(fds[i].revents); /* convert */
-          infof(multi->easyp, "call curl_multi_socket_action(socket %d)",
-                fds[i].fd);
-          mcode = curl_multi_socket_action(multi, fds[i].fd, act,
-                                           &ev->running_handles);
+
+          /* sending infof "randomly" to the first easy handle */
+          infof(multi->admin, "call curl_multi_socket_action(socket "
+                "%" FMT_SOCKET_T ")", (curl_socket_t)fds[i].fd);
+          mresult = curl_multi_socket_action(multi, fds[i].fd, act,
+                                             &ev->running_handles);
         }
       }
 
-      if(!ev->msbump) {
+      if(!ev->msbump && ev->ms >= 0) {
         /* If nothing updated the timeout, we decrease it by the spent time.
          * If it was updated, it has the new timeout time stored already.
          */
-        timediff_t timediff = Curl_timediff(after, before);
-        if(timediff > 0) {
-          if(timediff > ev->ms)
+        timediff_t spent_ms = curlx_timediff_ms(curlx_now(), start);
+        if(spent_ms > 0) {
+#if DEBUG_EV_POLL
+        curl_mfprintf(stderr, "poll timeout %ldms not updated, decrease by "
+                      "time spent %ldms\n", ev->ms, (long)spent_ms);
+#endif
+          if(spent_ms > ev->ms)
             ev->ms = 0;
           else
-            ev->ms -= (long)timediff;
+            ev->ms -= (long)spent_ms;
         }
       }
     }
 
-    if(mcode)
+    if(mresult)
       return CURLE_URL_MALFORMAT;
 
-    /* we don't really care about the "msgs_in_queue" value returned in the
+    /* we do not really care about the "msgs_in_queue" value returned in the
        second argument */
     msg = curl_multi_info_read(multi, &pollrc);
     if(msg) {
@@ -646,7 +659,6 @@ static CURLcode wait_or_timeout(struct Curl_multi *multi, struct events *ev)
   return result;
 }
 
-
 /* easy_events()
  *
  * Runs a transfer in a blocking manner using the events-based API
@@ -655,34 +667,34 @@ static CURLcode easy_events(struct Curl_multi *multi)
 {
   /* this struct is made static to allow it to be used after this function
      returns and curl_multi_remove_handle() is called */
-  static struct events evs = {2, FALSE, 0, NULL, 0};
+  static struct events evs = { -1, FALSE, 0, NULL, 0 };
 
   /* if running event-based, do some further multi inits */
   events_setup(multi, &evs);
 
   return wait_or_timeout(multi, &evs);
 }
-#else /* CURLDEBUG */
-/* when not built with debug, this function doesn't exist */
+#else /* DEBUGBUILD */
+/* when not built with debug, this function does not exist */
 #define easy_events(x) CURLE_NOT_BUILT_IN
 #endif
 
 static CURLcode easy_transfer(struct Curl_multi *multi)
 {
   bool done = FALSE;
-  CURLMcode mcode = CURLM_OK;
+  CURLMcode mresult = CURLM_OK;
   CURLcode result = CURLE_OK;
 
-  while(!done && !mcode) {
+  while(!done && !mresult) {
     int still_running = 0;
 
-    mcode = curl_multi_poll(multi, NULL, 0, 1000, NULL);
+    mresult = curl_multi_poll(multi, NULL, 0, 1000, NULL);
 
-    if(!mcode)
-      mcode = curl_multi_perform(multi, &still_running);
+    if(!mresult)
+      mresult = curl_multi_perform(multi, &still_running);
 
     /* only read 'still_running' if curl_multi_perform() return OK */
-    if(!mcode && !still_running) {
+    if(!mresult && !still_running) {
       int rc;
       CURLMsg *msg = curl_multi_info_read(multi, &rc);
       if(msg) {
@@ -693,19 +705,18 @@ static CURLcode easy_transfer(struct Curl_multi *multi)
   }
 
   /* Make sure to return some kind of error if there was a multi problem */
-  if(mcode) {
-    result = (mcode == CURLM_OUT_OF_MEMORY) ? CURLE_OUT_OF_MEMORY :
-              /* The other multi errors should never happen, so return
-                 something suitably generic */
-              CURLE_BAD_FUNCTION_ARGUMENT;
+  if(mresult) {
+    result = (mresult == CURLM_OUT_OF_MEMORY) ? CURLE_OUT_OF_MEMORY :
+      /* The other multi errors should never happen, so return
+         something suitably generic */
+      CURLE_BAD_FUNCTION_ARGUMENT;
   }
 
   return result;
 }
 
-
 /*
- * easy_perform() is the external interface that performs a blocking
+ * easy_perform() is the internal interface that performs a blocking
  * transfer as previously setup.
  *
  * CONCEPT: This function creates a multi handle, adds the easy handle to it,
@@ -713,7 +724,7 @@ static CURLcode easy_transfer(struct Curl_multi *multi)
  * easy handle, destroys the multi handle and returns the easy handle's return
  * code.
  *
- * REALITY: it can't just create and destroy the multi handle that easily. It
+ * REALITY: it cannot create and destroy the multi handle that easily. It
  * needs to keep it around since if this easy handle is used again by this
  * function, the same multi handle must be reused so that the same pools and
  * caches can be used.
@@ -724,9 +735,9 @@ static CURLcode easy_transfer(struct Curl_multi *multi)
 static CURLcode easy_perform(struct Curl_easy *data, bool events)
 {
   struct Curl_multi *multi;
-  CURLMcode mcode;
+  CURLMcode mresult;
   CURLcode result = CURLE_OK;
-  SIGPIPE_VARIABLE(pipe_st);
+  struct Curl_sigpipe_ctx sigpipe_ctx;
 
   if(!data)
     return CURLE_BAD_FUNCTION_ARGUMENT;
@@ -735,85 +746,103 @@ static CURLcode easy_perform(struct Curl_easy *data, bool events)
     /* clear this as early as possible */
     data->set.errorbuffer[0] = 0;
 
+  data->state.os_errno = 0;
+
   if(data->multi) {
     failf(data, "easy handle already used in multi handle");
     return CURLE_FAILED_INIT;
   }
 
+  /* if the handle has a connection still attached (it is/was a connect-only
+     handle) then disconnect before performing */
+  if(data->conn) {
+    struct connectdata *c;
+    curl_socket_t s;
+    Curl_detach_connection(data);
+    s = Curl_getconnectinfo(data, &c);
+    if((s != CURL_SOCKET_BAD) && c) {
+      Curl_conn_terminate(data, c, TRUE);
+    }
+    DEBUGASSERT(!data->conn);
+  }
+
   if(data->multi_easy)
     multi = data->multi_easy;
   else {
-    /* this multi handle will only ever have a single easy handled attached
-       to it, so make it use minimal hashes */
-    multi = Curl_multi_handle(1, 3, 7);
+    /* this multi handle will only ever have a single easy handle attached to
+       it, so make it use minimal hash sizes */
+    multi = Curl_multi_handle(16, 1, 3, 7, 3);
     if(!multi)
       return CURLE_OUT_OF_MEMORY;
-    data->multi_easy = multi;
   }
 
   if(multi->in_callback)
     return CURLE_RECURSIVE_API_CALL;
 
-  /* Copy the MAXCONNECTS option to the multi handle */
-  curl_multi_setopt(multi, CURLMOPT_MAXCONNECTS, data->set.maxconnects);
+  /* Copy relevant easy options to the multi handle */
+  curl_multi_setopt(multi, CURLMOPT_MAXCONNECTS, (long)data->set.maxconnects);
+  curl_multi_setopt(multi, CURLMOPT_QUICK_EXIT, (long)data->set.quick_exit);
 
-  mcode = curl_multi_add_handle(multi, data);
-  if(mcode) {
+  data->multi_easy = NULL; /* pretend it does not exist */
+  mresult = curl_multi_add_handle(multi, data);
+  if(mresult) {
     curl_multi_cleanup(multi);
-    data->multi_easy = NULL;
-    if(mcode == CURLM_OUT_OF_MEMORY)
+    if(mresult == CURLM_OUT_OF_MEMORY)
       return CURLE_OUT_OF_MEMORY;
     return CURLE_FAILED_INIT;
   }
 
-  sigpipe_ignore(data, &pipe_st);
+  /* assign this after curl_multi_add_handle() */
+  data->multi_easy = multi;
+
+  sigpipe_init(&sigpipe_ctx);
+  sigpipe_apply(data, &sigpipe_ctx);
 
   /* run the transfer */
   result = events ? easy_events(multi) : easy_transfer(multi);
 
-  /* ignoring the return code isn't nice, but atm we can't really handle
+  /* ignoring the return code is not nice, but atm we cannot really handle
      a failure here, room for future improvement! */
   (void)curl_multi_remove_handle(multi, data);
 
-  sigpipe_restore(&pipe_st);
+  sigpipe_restore(&sigpipe_ctx);
 
   /* The multi handle is kept alive, owned by the easy handle */
   return result;
 }
 
-
 /*
  * curl_easy_perform() is the external interface that performs a blocking
  * transfer as previously setup.
  */
-CURLcode curl_easy_perform(struct Curl_easy *data)
+CURLcode curl_easy_perform(CURL *curl)
 {
-  return easy_perform(data, FALSE);
+  return easy_perform(curl, FALSE);
 }
 
-#ifdef CURLDEBUG
+#ifdef DEBUGBUILD
 /*
  * curl_easy_perform_ev() is the external interface that performs a blocking
  * transfer using the event-based API internally.
  */
-CURLcode curl_easy_perform_ev(struct Curl_easy *data)
+CURLcode curl_easy_perform_ev(struct Curl_easy *easy)
 {
-  return easy_perform(data, TRUE);
+  return easy_perform(easy, TRUE);
 }
-
 #endif
 
 /*
  * curl_easy_cleanup() is the external interface to cleaning/freeing the given
  * easy handle.
  */
-void curl_easy_cleanup(struct Curl_easy *data)
+void curl_easy_cleanup(CURL *curl)
 {
+  struct Curl_easy *data = curl;
   if(GOOD_EASY_HANDLE(data)) {
-    SIGPIPE_VARIABLE(pipe_st);
-    sigpipe_ignore(data, &pipe_st);
+    struct Curl_sigpipe_ctx sigpipe_ctx;
+    sigpipe_ignore(data, &sigpipe_ctx);
     Curl_close(&data);
-    sigpipe_restore(&pipe_st);
+    sigpipe_restore(&sigpipe_ctx);
   }
 }
 
@@ -822,12 +851,16 @@ void curl_easy_cleanup(struct Curl_easy *data)
  * information from a performed transfer and similar.
  */
 #undef curl_easy_getinfo
-CURLcode curl_easy_getinfo(struct Curl_easy *data, CURLINFO info, ...)
+CURLcode curl_easy_getinfo(CURL *curl, CURLINFO info, ...)
 {
+  struct Curl_easy *data = curl;
   va_list arg;
   void *paramp;
   CURLcode result;
 
+  if(!GOOD_EASY_HANDLE(data))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
   va_start(arg, info);
   paramp = va_arg(arg, void *);
 
@@ -846,20 +879,21 @@ static CURLcode dupset(struct Curl_easy *dst, struct Curl_easy *src)
   /* Copy src->set into dst->set first, then deal with the strings
      afterwards */
   dst->set = src->set;
-  Curl_mime_initpart(&dst->set.mimepost);
-
-  /* clear all string pointers first */
+#if !defined(CURL_DISABLE_MIME) || !defined(CURL_DISABLE_FORM_API)
+  dst->set.mimepostp = NULL;
+#endif
+  /* clear all dest string and blob pointers first, in case we error out
+     mid-function */
   memset(dst->set.str, 0, STRING_LAST * sizeof(char *));
+  memset(dst->set.blobs, 0, BLOB_LAST * sizeof(struct curl_blob *));
 
   /* duplicate all strings */
-  for(i = (enum dupstring)0; i< STRING_LASTZEROTERMINATED; i++) {
+  for(i = (enum dupstring)0; i < STRING_LASTZEROTERMINATED; i++) {
     result = Curl_setstropt(&dst->set.str[i], src->set.str[i]);
     if(result)
       return result;
   }
 
-  /* clear all blob pointers first */
-  memset(dst->set.blobs, 0, BLOB_LAST * sizeof(struct curl_blob *));
   /* duplicate all blobs */
   for(j = (enum dupblob)0; j < BLOB_LAST; j++) {
     result = Curl_setblobopt(&dst->set.blobs[j], src->set.blobs[j]);
@@ -869,18 +903,32 @@ static CURLcode dupset(struct Curl_easy *dst, struct Curl_easy *src)
 
   /* duplicate memory areas pointed to */
   i = STRING_COPYPOSTFIELDS;
-  if(src->set.postfieldsize && src->set.str[i]) {
-    /* postfieldsize is curl_off_t, Curl_memdup() takes a size_t ... */
-    dst->set.str[i] = Curl_memdup(src->set.str[i],
-                                  curlx_sotouz(src->set.postfieldsize));
+  if(src->set.str[i]) {
+    if(src->set.postfieldsize == -1)
+      dst->set.str[i] = curlx_strdup(src->set.str[i]);
+    else
+      /* postfieldsize is curl_off_t, curlx_memdup() takes a size_t ... */
+      dst->set.str[i] = curlx_memdup(src->set.str[i],
+                                     curlx_sotouz(src->set.postfieldsize));
     if(!dst->set.str[i])
       return CURLE_OUT_OF_MEMORY;
     /* point to the new copy */
     dst->set.postfields = dst->set.str[i];
   }
 
-  /* Duplicate mime data. */
-  result = Curl_mime_duppart(dst, &dst->set.mimepost, &src->set.mimepost);
+#if !defined(CURL_DISABLE_MIME) || !defined(CURL_DISABLE_FORM_API)
+  if(src->set.mimepostp) {
+    /* Duplicate mime data. Get a mimepost struct for the clone as well */
+    dst->set.mimepostp = curlx_malloc(sizeof(*dst->set.mimepostp));
+    if(!dst->set.mimepostp)
+      return CURLE_OUT_OF_MEMORY;
+
+    Curl_mime_initpart(dst->set.mimepostp);
+    result = Curl_mime_duppart(dst, dst->set.mimepostp, src->set.mimepostp);
+    if(result)
+      return result;
+  }
+#endif
 
   if(src->set.resolve)
     dst->state.resolve = dst->set.resolve;
@@ -888,14 +936,28 @@ static CURLcode dupset(struct Curl_easy *dst, struct Curl_easy *src)
   return result;
 }
 
+static void dupeasy_meta_freeentry(void *p)
+{
+  (void)p;
+  /* Always FALSE. Cannot use a 0 assert here since compilers
+   * are not in agreement if they then want a NORETURN attribute or
+   * not. *sigh* */
+  DEBUGASSERT(!p);
+}
+
 /*
  * curl_easy_duphandle() is an external interface to allow duplication of a
  * given input easy handle. The returned handle will be a new working handle
  * with all options set exactly as the input source handle.
  */
-struct Curl_easy *curl_easy_duphandle(struct Curl_easy *data)
+CURL *curl_easy_duphandle(CURL *curl)
 {
-  struct Curl_easy *outcurl = calloc(1, sizeof(struct Curl_easy));
+  struct Curl_easy *data = curl;
+  struct Curl_easy *outcurl = NULL;
+
+  if(!GOOD_EASY_HANDLE(data))
+    goto fail;
+  outcurl = curlx_calloc(1, sizeof(struct Curl_easy));
   if(!outcurl)
     goto fail;
 
@@ -906,52 +968,63 @@ struct Curl_easy *curl_easy_duphandle(struct Curl_easy *data)
    */
   outcurl->set.buffer_size = data->set.buffer_size;
 
+  Curl_hash_init(&outcurl->meta_hash, 23,
+                 Curl_hash_str, curlx_str_key_compare, dupeasy_meta_freeentry);
+  curlx_dyn_init(&outcurl->state.headerb, CURL_MAX_HTTP_HEADER);
+  Curl_bufref_init(&outcurl->state.url);
+  Curl_bufref_init(&outcurl->state.referer);
+  Curl_netrc_init(&outcurl->state.netrc);
+
+  /* the connection pool is setup on demand */
+  outcurl->state.lastconnect_id = -1;
+  outcurl->state.recent_conn_id = -1;
+  outcurl->id = -1;
+  outcurl->mid = UINT32_MAX;
+  outcurl->master_mid = UINT32_MAX;
+
+#ifndef CURL_DISABLE_HTTP
+  Curl_llist_init(&outcurl->state.httphdrs, NULL);
+#endif
+  Curl_initinfo(outcurl);
+
   /* copy all userdefined values */
   if(dupset(outcurl, data))
     goto fail;
 
-  Curl_dyn_init(&outcurl->state.headerb, CURL_MAX_HTTP_HEADER);
-
-  /* the connection cache is setup on demand */
-  outcurl->state.conn_cache = NULL;
-  outcurl->state.lastconnect_id = -1;
-  outcurl->state.recent_conn_id = -1;
-  outcurl->id = -1;
-
-  outcurl->progress.flags    = data->progress.flags;
+  outcurl->progress.hide     = data->progress.hide;
   outcurl->progress.callback = data->progress.callback;
 
 #ifndef CURL_DISABLE_COOKIES
-  if(data->cookies) {
+  outcurl->state.cookielist = NULL;
+  if(data->cookies && data->state.cookie_engine) {
     /* If cookies are enabled in the parent handle, we enable them
        in the clone as well! */
-    outcurl->cookies = Curl_cookie_init(data,
-                                        data->cookies->filename,
-                                        outcurl->cookies,
-                                        data->set.cookiesession);
+    outcurl->cookies = Curl_cookie_init();
     if(!outcurl->cookies)
       goto fail;
+    outcurl->state.cookie_engine = TRUE;
   }
 
-  if(data->set.cookielist) {
-    outcurl->set.cookielist = Curl_slist_duplicate(data->set.cookielist);
-    if(!outcurl->set.cookielist)
+  if(data->state.cookielist) {
+    outcurl->state.cookielist = Curl_slist_duplicate(data->state.cookielist);
+    if(!outcurl->state.cookielist)
       goto fail;
   }
 #endif
 
-  if(data->state.url) {
-    outcurl->state.url = strdup(data->state.url);
-    if(!outcurl->state.url)
+  if(Curl_bufref_ptr(&data->state.url)) {
+    Curl_bufref_set(&outcurl->state.url,
+                    Curl_bufref_dup(&data->state.url), 0,
+                    curl_free);
+    if(!Curl_bufref_ptr(&outcurl->state.url))
       goto fail;
-    outcurl->state.url_alloc = TRUE;
   }
-
-  if(data->state.referer) {
-    outcurl->state.referer = strdup(data->state.referer);
-    if(!outcurl->state.referer)
+  if(Curl_bufref_ptr(&data->state.referer)) {
+    Curl_bufref_set(&outcurl->state.referer,
+                    Curl_bufref_dup(&data->state.referer), 0,
+                    curl_free);
+    if(!Curl_bufref_ptr(&outcurl->state.referer))
       goto fail;
-    outcurl->state.referer_alloc = TRUE;
   }
 
   /* Reinitialize an SSL engine for the new handle
@@ -979,37 +1052,13 @@ struct Curl_easy *curl_easy_duphandle(struct Curl_easy *data)
       (void)Curl_hsts_loadfile(outcurl,
                                outcurl->hsts, outcurl->set.str[STRING_HSTS]);
     (void)Curl_hsts_loadcb(outcurl, outcurl->hsts);
+
+    /* Copy entries learned at runtime. (E.g. Strict-Transport-Security
+       headers.) */
+    if(Curl_hsts_copy(outcurl->hsts, data->hsts))
+      goto fail;
   }
 #endif
-  /* Clone the resolver handle, if present, for the new handle */
-  if(Curl_resolver_duphandle(outcurl,
-                             &outcurl->state.async.resolver,
-                             data->state.async.resolver))
-    goto fail;
-
-#ifdef USE_ARES
-  {
-    CURLcode rc;
-
-    rc = Curl_set_dns_servers(outcurl, data->set.str[STRING_DNS_SERVERS]);
-    if(rc && rc != CURLE_NOT_BUILT_IN)
-      goto fail;
-
-    rc = Curl_set_dns_interface(outcurl, data->set.str[STRING_DNS_INTERFACE]);
-    if(rc && rc != CURLE_NOT_BUILT_IN)
-      goto fail;
-
-    rc = Curl_set_dns_local_ip4(outcurl, data->set.str[STRING_DNS_LOCAL_IP4]);
-    if(rc && rc != CURLE_NOT_BUILT_IN)
-      goto fail;
-
-    rc = Curl_set_dns_local_ip6(outcurl, data->set.str[STRING_DNS_LOCAL_IP6]);
-    if(rc && rc != CURLE_NOT_BUILT_IN)
-      goto fail;
-  }
-#endif /* USE_ARES */
-
-  Curl_initinfo(outcurl);
 
   outcurl->magic = CURLEASY_MAGIC_NUMBER;
 
@@ -1021,17 +1070,13 @@ fail:
 
   if(outcurl) {
 #ifndef CURL_DISABLE_COOKIES
-    curl_slist_free_all(outcurl->set.cookielist);
-    outcurl->set.cookielist = NULL;
+    curlx_free(outcurl->cookies);
 #endif
-    Curl_safefree(outcurl->state.buffer);
-    Curl_dyn_free(&outcurl->state.headerb);
-    Curl_safefree(outcurl->state.url);
-    Curl_safefree(outcurl->state.referer);
+    curlx_dyn_free(&outcurl->state.headerb);
     Curl_altsvc_cleanup(&outcurl->asi);
     Curl_hsts_cleanup(&outcurl->hsts);
     Curl_freeset(outcurl);
-    free(outcurl);
+    curlx_free(outcurl);
   }
 
   return NULL;
@@ -1041,14 +1086,21 @@ fail:
  * curl_easy_reset() is an external interface that allows an app to re-
  * initialize a session handle to the default values.
  */
-void curl_easy_reset(struct Curl_easy *data)
+void curl_easy_reset(CURL *curl)
 {
-  Curl_free_request_state(data);
+  struct Curl_easy *data = curl;
+  if(!GOOD_EASY_HANDLE(data))
+    return;
 
+  Curl_req_hard_reset(&data->req, data);
+  Curl_hash_clean(&data->meta_hash);
+
+  /* clear all meta data */
+  Curl_meta_reset(data);
   /* zero out UserDefined data: */
   Curl_freeset(data);
   memset(&data->set, 0, sizeof(struct UserDefined));
-  (void)Curl_init_userdefined(data);
+  Curl_init_userdefined(data);
 
   /* zero out Progress data: */
   memset(&data->progress, 0, sizeof(struct Progress));
@@ -1056,9 +1108,9 @@ void curl_easy_reset(struct Curl_easy *data)
   /* zero out PureInfo data: */
   Curl_initinfo(data);
 
-  data->progress.flags |= PGRS_HIDE;
+  data->progress.hide = TRUE;
   data->state.current_speed = -1; /* init to negative == impossible */
-  data->state.retrycount = 0;     /* reset the retry counter */
+  data->state.recent_conn_id = -1; /* clear remembered connection id */
 
   /* zero out authentication data: */
   memset(&data->state.authhost, 0, sizeof(struct auth));
@@ -1067,6 +1119,7 @@ void curl_easy_reset(struct Curl_easy *data)
 #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_DIGEST_AUTH)
   Curl_http_auth_cleanup_digest(data);
 #endif
+  data->master_mid = UINT32_MAX;
 }
 
 /*
@@ -1082,115 +1135,72 @@ void curl_easy_reset(struct Curl_easy *data)
  * NOTE: This is one of few API functions that are allowed to be called from
  * within a callback.
  */
-CURLcode curl_easy_pause(struct Curl_easy *data, int action)
+CURLcode curl_easy_pause(CURL *curl, int action)
 {
-  struct SingleRequest *k;
   CURLcode result = CURLE_OK;
-  int oldstate;
-  int newstate;
+  bool recursive = FALSE;
+  bool changed = FALSE;
+  struct Curl_easy *data = curl;
+  bool recv_paused, recv_paused_new;
+  bool send_paused, send_paused_new;
 
   if(!GOOD_EASY_HANDLE(data) || !data->conn)
-    /* crazy input, don't continue */
+    /* crazy input, do not continue */
     return CURLE_BAD_FUNCTION_ARGUMENT;
 
-  k = &data->req;
-  oldstate = k->keepon & (KEEP_RECV_PAUSE| KEEP_SEND_PAUSE);
+  if(Curl_is_in_callback(data))
+    recursive = TRUE;
 
-  /* first switch off both pause bits then set the new pause bits */
-  newstate = (k->keepon &~ (KEEP_RECV_PAUSE| KEEP_SEND_PAUSE)) |
-    ((action & CURLPAUSE_RECV)?KEEP_RECV_PAUSE:0) |
-    ((action & CURLPAUSE_SEND)?KEEP_SEND_PAUSE:0);
+  recv_paused = Curl_xfer_recv_is_paused(data);
+  recv_paused_new = (action & CURLPAUSE_RECV);
+  send_paused = Curl_xfer_send_is_paused(data);
+  send_paused_new = (action & CURLPAUSE_SEND);
 
-  if((newstate & (KEEP_RECV_PAUSE| KEEP_SEND_PAUSE)) == oldstate) {
-    /* Not changing any pause state, return */
-    DEBUGF(infof(data, "pause: no change, early return"));
-    return CURLE_OK;
+  if((send_paused != send_paused_new) ||
+     (send_paused_new != Curl_creader_is_paused(data))) {
+    changed = TRUE;
+    result = Curl_1st_fatal(
+      result, Curl_xfer_pause_send(data, send_paused_new));
   }
 
-  /* Unpause parts in active mime tree. */
-  if((k->keepon & ~newstate & KEEP_SEND_PAUSE) &&
-     (data->mstate == MSTATE_PERFORMING ||
-      data->mstate == MSTATE_RATELIMITING) &&
-     data->state.fread_func == (curl_read_callback) Curl_mime_read) {
-    Curl_mime_unpause(data->state.in);
+  if(recv_paused != recv_paused_new) {
+    changed = TRUE;
+    result = Curl_1st_fatal(
+      result, Curl_xfer_pause_recv(data, recv_paused_new));
   }
 
-  /* put it back in the keepon */
-  k->keepon = newstate;
-
-  if(!(newstate & KEEP_RECV_PAUSE)) {
-    Curl_conn_ev_data_pause(data, FALSE);
-
-    if(data->state.tempcount) {
-      /* there are buffers for sending that can be delivered as the receive
-         pausing is lifted! */
-      unsigned int i;
-      unsigned int count = data->state.tempcount;
-      struct tempbuf writebuf[3]; /* there can only be three */
-
-      /* copy the structs to allow for immediate re-pausing */
-      for(i = 0; i < data->state.tempcount; i++) {
-        writebuf[i] = data->state.tempwrite[i];
-        Curl_dyn_init(&data->state.tempwrite[i].b, DYN_PAUSE_BUFFER);
-      }
-      data->state.tempcount = 0;
-
-      for(i = 0; i < count; i++) {
-        /* even if one function returns error, this loops through and frees
-           all buffers */
-        if(!result)
-          result = Curl_client_write(data, writebuf[i].type,
-                                     Curl_dyn_ptr(&writebuf[i].b),
-                                     Curl_dyn_len(&writebuf[i].b));
-        Curl_dyn_free(&writebuf[i].b);
-      }
-
-      if(result)
-        return result;
-    }
-  }
-
-#ifdef USE_HYPER
-  if(!(newstate & KEEP_SEND_PAUSE)) {
-    /* need to wake the send body waker */
-    if(data->hyp.send_body_waker) {
-      hyper_waker_wake(data->hyp.send_body_waker);
-      data->hyp.send_body_waker = NULL;
-    }
-  }
-#endif
-
-  /* if there's no error and we're not pausing both directions, we want
-     to have this handle checked soon */
-  if((newstate & (KEEP_RECV_PAUSE|KEEP_SEND_PAUSE)) !=
-     (KEEP_RECV_PAUSE|KEEP_SEND_PAUSE)) {
-    Curl_expire(data, 0, EXPIRE_RUN_NOW); /* get this handle going again */
-
+  /* If not completely pausing both directions now, run again in any case. */
+  if(!Curl_xfer_is_blocked(data)) {
     /* reset the too-slow time keeper */
     data->state.keeps_speed.tv_sec = 0;
-
-    if(!data->state.tempcount)
-      /* if not pausing again, force a recv/send check of this connection as
-         the data might've been read off the socket already */
-      data->conn->cselect_bits = CURL_CSELECT_IN | CURL_CSELECT_OUT;
     if(data->multi) {
-      if(Curl_update_timer(data->multi))
-        return CURLE_ABORTED_BY_CALLBACK;
+      Curl_multi_mark_dirty(data); /* make it run */
+      /* On changes, tell application to update its timers. */
+      if(changed) {
+        if(Curl_update_timer(data->multi) && !result)
+          result = CURLE_ABORTED_BY_CALLBACK;
+      }
     }
   }
 
-  if(!data->state.done)
-    /* This transfer may have been moved in or out of the bundle, update the
-       corresponding socket callback, if used */
-    result = Curl_updatesocket(data);
+  if(!result && changed && !data->state.done && data->multi)
+    /* pause/unpausing may result in multi event changes */
+    if(Curl_multi_ev_assess_xfer(data->multi, data) && !result)
+      result = CURLE_ABORTED_BY_CALLBACK;
+
+  if(recursive)
+    /* this might have called a callback recursively which might have set this
+       to false again on exit */
+    Curl_set_in_callback(data, TRUE);
 
   return result;
 }
 
-
-static CURLcode easy_connection(struct Curl_easy *data, curl_socket_t *sfd,
+static CURLcode easy_connection(struct Curl_easy *data,
                                 struct connectdata **connp)
 {
+  curl_socket_t sfd;
+
   if(!data)
     return CURLE_BAD_FUNCTION_ARGUMENT;
 
@@ -1200,9 +1210,9 @@ static CURLcode easy_connection(struct Curl_easy *data, curl_socket_t *sfd,
     return CURLE_UNSUPPORTED_PROTOCOL;
   }
 
-  *sfd = Curl_getconnectinfo(data, connp);
+  sfd = Curl_getconnectinfo(data, connp);
 
-  if(*sfd == CURL_SOCKET_BAD) {
+  if(sfd == CURL_SOCKET_BAD) {
     failf(data, "Failed to get recent socket");
     return CURLE_UNSUPPORTED_PROTOCOL;
   }
@@ -1215,18 +1225,18 @@ static CURLcode easy_connection(struct Curl_easy *data, curl_socket_t *sfd,
  * curl_easy_perform() with CURLOPT_CONNECT_ONLY option.
  * Returns CURLE_OK on success, error code on error.
  */
-CURLcode curl_easy_recv(struct Curl_easy *data, void *buffer, size_t buflen,
-                        size_t *n)
+CURLcode curl_easy_recv(CURL *curl, void *buffer, size_t buflen, size_t *n)
 {
-  curl_socket_t sfd;
   CURLcode result;
-  ssize_t n1;
   struct connectdata *c;
+  struct Curl_easy *data = curl;
 
+  if(!GOOD_EASY_HANDLE(data))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
   if(Curl_is_in_callback(data))
     return CURLE_RECURSIVE_API_CALL;
 
-  result = easy_connection(data, &sfd, &c);
+  result = easy_connection(data, &c);
   if(result)
     return result;
 
@@ -1236,23 +1246,16 @@ CURLcode curl_easy_recv(struct Curl_easy *data, void *buffer, size_t buflen,
     Curl_attach_connection(data, c);
 
   *n = 0;
-  result = Curl_read(data, sfd, buffer, buflen, &n1);
-
-  if(result)
-    return result;
-
-  *n = (size_t)n1;
-  return CURLE_OK;
+  return Curl_conn_recv(data, FIRSTSOCKET, buffer, buflen, n);
 }
 
-#ifdef USE_WEBSOCKETS
+#ifndef CURL_DISABLE_WEBSOCKETS
 CURLcode Curl_connect_only_attach(struct Curl_easy *data)
 {
-  curl_socket_t sfd;
   CURLcode result;
   struct connectdata *c = NULL;
 
-  result = easy_connection(data, &sfd, &c);
+  result = easy_connection(data, &c);
   if(result)
     return result;
 
@@ -1263,7 +1266,7 @@ CURLcode Curl_connect_only_attach(struct Curl_easy *data)
 
   return CURLE_OK;
 }
-#endif /* USE_WEBSOCKETS */
+#endif /* !CURL_DISABLE_WEBSOCKETS */
 
 /*
  * Sends data over the connected socket.
@@ -1271,15 +1274,14 @@ CURLcode Curl_connect_only_attach(struct Curl_easy *data)
  * This is the private internal version of curl_easy_send()
  */
 CURLcode Curl_senddata(struct Curl_easy *data, const void *buffer,
-                       size_t buflen, ssize_t *n)
+                       size_t buflen, size_t *n)
 {
-  curl_socket_t sfd;
   CURLcode result;
-  ssize_t n1;
   struct connectdata *c = NULL;
-  SIGPIPE_VARIABLE(pipe_st);
+  struct Curl_sigpipe_ctx sigpipe_ctx;
 
-  result = easy_connection(data, &sfd, &c);
+  *n = 0;
+  result = easy_connection(data, &c);
   if(result)
     return result;
 
@@ -1288,20 +1290,12 @@ CURLcode Curl_senddata(struct Curl_easy *data, const void *buffer,
        needs to be reattached */
     Curl_attach_connection(data, c);
 
-  *n = 0;
-  sigpipe_ignore(data, &pipe_st);
-  result = Curl_write(data, sfd, buffer, buflen, &n1);
-  sigpipe_restore(&pipe_st);
+  sigpipe_ignore(data, &sigpipe_ctx);
+  result = Curl_conn_send(data, FIRSTSOCKET, buffer, buflen, FALSE, n);
+  sigpipe_restore(&sigpipe_ctx);
 
-  if(n1 == -1)
+  if(result && result != CURLE_AGAIN)
     return CURLE_SEND_ERROR;
-
-  /* detect EAGAIN */
-  if(!result && !n1)
-    return CURLE_AGAIN;
-
-  *n = n1;
-
   return result;
 }
 
@@ -1309,75 +1303,104 @@ CURLcode Curl_senddata(struct Curl_easy *data, const void *buffer,
  * Sends data over the connected socket. Use after successful
  * curl_easy_perform() with CURLOPT_CONNECT_ONLY option.
  */
-CURLcode curl_easy_send(struct Curl_easy *data, const void *buffer,
-                        size_t buflen, size_t *n)
+CURLcode curl_easy_send(CURL *curl, const void *buffer, size_t buflen,
+                        size_t *n)
 {
-  ssize_t written = 0;
+  size_t written = 0;
   CURLcode result;
+  struct Curl_easy *data = curl;
+  if(!GOOD_EASY_HANDLE(data))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
   if(Curl_is_in_callback(data))
     return CURLE_RECURSIVE_API_CALL;
 
   result = Curl_senddata(data, buffer, buflen, &written);
-  *n = (size_t)written;
+  *n = written;
   return result;
 }
 
-/*
- * Wrapper to call functions in Curl_conncache_foreach()
- *
- * Returns always 0.
- */
-static int conn_upkeep(struct Curl_easy *data,
-                       struct connectdata *conn,
-                       void *param)
-{
-  struct curltime *now = param;
-
-  if(Curl_timediff(*now, conn->keepalive) <= data->set.upkeep_interval_ms)
-    return 0;
-
-  /* briefly attach for action */
-  Curl_attach_connection(data, conn);
-  if(conn->handler->connection_check) {
-    /* Do a protocol-specific keepalive check on the connection. */
-    conn->handler->connection_check(data, conn, CONNCHECK_KEEPALIVE);
-  }
-  else {
-    /* Do the generic action on the FIRSTSOCKE filter chain */
-    Curl_conn_keep_alive(data, conn, FIRSTSOCKET);
-  }
-  Curl_detach_connection(data);
-
-  conn->keepalive = *now;
-  return 0; /* continue iteration */
-}
-
-static CURLcode upkeep(struct conncache *conn_cache, void *data)
-{
-  struct curltime now = Curl_now();
-  /* Loop over every connection and make connection alive. */
-  Curl_conncache_foreach(data,
-                         conn_cache,
-                         &now,
-                         conn_upkeep);
-  return CURLE_OK;
-}
-
 /*
  * Performs connection upkeep for the given session handle.
  */
-CURLcode curl_easy_upkeep(struct Curl_easy *data)
+CURLcode curl_easy_upkeep(CURL *curl)
 {
+  struct Curl_easy *data = curl;
   /* Verify that we got an easy handle we can work with. */
   if(!GOOD_EASY_HANDLE(data))
     return CURLE_BAD_FUNCTION_ARGUMENT;
 
-  if(data->multi_easy) {
-    /* Use the common function to keep connections alive. */
-    return upkeep(&data->multi_easy->conn_cache, data);
-  }
-  else {
-    /* No connections, so just return success */
-    return CURLE_OK;
-  }
+  if(Curl_is_in_callback(data))
+    return CURLE_RECURSIVE_API_CALL;
+
+  /* Use the common function to keep connections alive. */
+  return Curl_cpool_upkeep(data);
+}
+
+CURLcode curl_easy_ssls_import(CURL *curl, const char *session_key,
+                               const unsigned char *shmac, size_t shmac_len,
+                               const unsigned char *sdata, size_t sdata_len)
+{
+#if defined(USE_SSL) && defined(USE_SSLS_EXPORT)
+  struct Curl_easy *data = curl;
+  if(!GOOD_EASY_HANDLE(data))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  if(Curl_is_in_callback(data) || Curl_ssl_scache_is_locked(data))
+    return CURLE_RECURSIVE_API_CALL;
+  return Curl_ssl_session_import(data, session_key,
+                                 shmac, shmac_len, sdata, sdata_len);
+#else
+  (void)curl;
+  (void)session_key;
+  (void)shmac;
+  (void)shmac_len;
+  (void)sdata;
+  (void)sdata_len;
+  return CURLE_NOT_BUILT_IN;
+#endif
+}
+
+CURLcode curl_easy_ssls_export(CURL *curl,
+                               curl_ssls_export_cb *export_fn,
+                               void *userptr)
+{
+#if defined(USE_SSL) && defined(USE_SSLS_EXPORT)
+  struct Curl_easy *data = curl;
+  if(!GOOD_EASY_HANDLE(data))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  if(Curl_is_in_callback(data) || Curl_ssl_scache_is_locked(data))
+    return CURLE_RECURSIVE_API_CALL;
+  return Curl_ssl_session_export(data, export_fn, userptr);
+#else
+  (void)curl;
+  (void)export_fn;
+  (void)userptr;
+  return CURLE_NOT_BUILT_IN;
+#endif
+}
+
+CURLcode Curl_meta_set(struct Curl_easy *data, const char *key,
+                       void *meta_data, Curl_meta_dtor *meta_dtor)
+{
+  DEBUGASSERT(meta_data); /* never set to NULL */
+  if(!Curl_hash_add2(&data->meta_hash, CURL_UNCONST(key), strlen(key) + 1,
+                     meta_data, meta_dtor)) {
+    meta_dtor(CURL_UNCONST(key), strlen(key) + 1, meta_data);
+    return CURLE_OUT_OF_MEMORY;
+  }
+  return CURLE_OK;
+}
+
+void Curl_meta_remove(struct Curl_easy *data, const char *key)
+{
+  Curl_hash_delete(&data->meta_hash, CURL_UNCONST(key), strlen(key) + 1);
+}
+
+void *Curl_meta_get(struct Curl_easy *data, const char *key)
+{
+  return Curl_hash_pick(&data->meta_hash, CURL_UNCONST(key), strlen(key) + 1);
+}
+
+void Curl_meta_reset(struct Curl_easy *data)
+{
+  Curl_hash_clean(&data->meta_hash);
 }
diff --git a/third-party/curl/lib/easy_lock.h b/third-party/curl/lib/easy_lock.h
index 6399a39bde..b8f916ff65 100644
--- a/third-party/curl/lib/easy_lock.h
+++ b/third-party/curl/lib/easy_lock.h
@@ -23,60 +23,44 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #define GLOBAL_INIT_IS_THREADSAFE
 
-#if defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x600
+#ifdef _WIN32
 
-#ifdef __MINGW32__
-#ifndef __MINGW64_VERSION_MAJOR
-#if (__MINGW32_MAJOR_VERSION < 5) || \
-    (__MINGW32_MAJOR_VERSION == 5 && __MINGW32_MINOR_VERSION == 0)
-/* mingw >= 5.0.1 defines SRWLOCK, and slightly different from MS define */
-typedef PVOID SRWLOCK, *PSRWLOCK;
-#endif
-#endif
-#ifndef SRWLOCK_INIT
-#define SRWLOCK_INIT NULL
-#endif
-#endif /* __MINGW32__ */
-
-#define curl_simple_lock SRWLOCK
+#define curl_simple_lock      SRWLOCK
 #define CURL_SIMPLE_LOCK_INIT SRWLOCK_INIT
 
-#define curl_simple_lock_lock(m) AcquireSRWLockExclusive(m)
+#define curl_simple_lock_lock(m)   AcquireSRWLockExclusive(m)
 #define curl_simple_lock_unlock(m) ReleaseSRWLockExclusive(m)
 
 #elif defined(HAVE_ATOMIC) && defined(HAVE_STDATOMIC_H)
 #include <stdatomic.h>
-#if defined(HAVE_SCHED_YIELD)
+#ifdef HAVE_SCHED_YIELD
 #include <sched.h>
 #endif
 
-#define curl_simple_lock atomic_int
+#define curl_simple_lock      atomic_int
 #define CURL_SIMPLE_LOCK_INIT 0
 
-/* a clang-thing */
-#ifndef __has_builtin
-#define __has_builtin(x) 0
-#endif
-
 #ifndef __INTEL_COMPILER
 /* The Intel compiler tries to look like GCC *and* clang *and* lies in its
    __has_builtin() function, so override it. */
 
 /* if GCC on i386/x86_64 or if the built-in is present */
-#if ( (defined(__GNUC__) && !defined(__clang__)) &&     \
-      (defined(__i386__) || defined(__x86_64__))) ||    \
-  __has_builtin(__builtin_ia32_pause)
+#if (defined(__GNUC__) && !defined(__clang__)) && \
+  (defined(__i386__) || defined(__x86_64__))
+#define HAVE_BUILTIN_IA32_PAUSE
+#elif defined(__has_builtin)  /* Keep this PP check separate from others */
+#if __has_builtin(__builtin_ia32_pause)
 #define HAVE_BUILTIN_IA32_PAUSE
 #endif
-
 #endif
 
-static inline void curl_simple_lock_lock(curl_simple_lock *lock)
+#endif /* !__INTEL_COMPILER */
+
+static CURL_INLINE void curl_simple_lock_lock(curl_simple_lock *lock)
 {
   for(;;) {
     if(!atomic_exchange_explicit(lock, true, memory_order_acquire))
@@ -95,14 +79,21 @@ static inline void curl_simple_lock_lock(curl_simple_lock *lock)
   }
 }
 
-static inline void curl_simple_lock_unlock(curl_simple_lock *lock)
+static CURL_INLINE void curl_simple_lock_unlock(curl_simple_lock *lock)
 {
   atomic_store_explicit(lock, false, memory_order_release);
 }
 
+#elif defined(HAVE_THREADS_POSIX)
+
+#define curl_simple_lock           pthread_mutex_t
+#define CURL_SIMPLE_LOCK_INIT      PTHREAD_MUTEX_INITIALIZER
+#define curl_simple_lock_lock(m)   pthread_mutex_lock(m)
+#define curl_simple_lock_unlock(m) pthread_mutex_unlock(m)
+
 #else
 
-#undef  GLOBAL_INIT_IS_THREADSAFE
+#undef GLOBAL_INIT_IS_THREADSAFE
 
 #endif
 
diff --git a/third-party/curl/lib/easygetopt.c b/third-party/curl/lib/easygetopt.c
index 2b8a521cd2..533d7e3670 100644
--- a/third-party/curl/lib/easygetopt.c
+++ b/third-party/curl/lib/easygetopt.c
@@ -1,11 +1,11 @@
 /***************************************************************************
  *                                  _   _ ____  _
- *  Project                     ___| | | |  _ | |
+ *  Project                     ___| | | |  _ \| |
  *                             / __| | | | |_) | |
  *                            | (__| |_| |  _ <| |___
- *                             ___|___/|_| ______|
+ *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) Daniel Stenberg, <daniel.se>, et al.
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -21,28 +21,27 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
-#include "strcase.h"
+
 #include "easyoptions.h"
 
 #ifndef CURL_DISABLE_GETOPTIONS
 
 /* Lookups easy options at runtime */
-static struct curl_easyoption *lookup(const char *name, CURLoption id)
+static const struct curl_easyoption *lookup(const char *name, CURLoption id)
 {
   DEBUGASSERT(name || id);
   DEBUGASSERT(!Curl_easyopts_check());
   if(name || id) {
-    struct curl_easyoption *o = &Curl_easyopts[0];
+    const struct curl_easyoption *o = &Curl_easyopts[0];
     do {
       if(name) {
-        if(strcasecompare(o->name, name))
+        if(curl_strequal(o->name, name))
           return o;
       }
       else {
         if((o->id == id) && !(o->flags & CURLOT_FLAG_ALIAS))
-          /* don't match alias options */
+          /* do not match alias options */
           return o;
       }
       o++;
@@ -63,8 +62,8 @@ const struct curl_easyoption *curl_easy_option_by_id(CURLoption id)
 }
 
 /* Iterates over available options */
-const struct curl_easyoption *
-curl_easy_option_next(const struct curl_easyoption *prev)
+const struct curl_easyoption *curl_easy_option_next(
+  const struct curl_easyoption *prev)
 {
   if(prev && prev->name) {
     prev++;
@@ -83,14 +82,14 @@ const struct curl_easyoption *curl_easy_option_by_name(const char *name)
   return NULL;
 }
 
-const struct curl_easyoption *curl_easy_option_by_id (CURLoption id)
+const struct curl_easyoption *curl_easy_option_by_id(CURLoption id)
 {
   (void)id;
   return NULL;
 }
 
-const struct curl_easyoption *
-curl_easy_option_next(const struct curl_easyoption *prev)
+const struct curl_easyoption *curl_easy_option_next(
+  const struct curl_easyoption *prev)
 {
   (void)prev;
   return NULL;
diff --git a/third-party/curl/lib/easyif.h b/third-party/curl/lib/easyif.h
index 6448952966..213fd027da 100644
--- a/third-party/curl/lib/easyif.h
+++ b/third-party/curl/lib/easyif.h
@@ -23,18 +23,17 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /*
  * Prototypes for library-wide functions provided by easy.c
  */
 CURLcode Curl_senddata(struct Curl_easy *data, const void *buffer,
-                       size_t buflen, ssize_t *n);
+                       size_t buflen, size_t *n);
 
-#ifdef USE_WEBSOCKETS
+#ifndef CURL_DISABLE_WEBSOCKETS
 CURLcode Curl_connect_only_attach(struct Curl_easy *data);
 #endif
 
-#ifdef CURLDEBUG
+#ifdef DEBUGBUILD
 CURL_EXTERN CURLcode curl_easy_perform_ev(struct Curl_easy *easy);
 #endif
 
diff --git a/third-party/curl/lib/easyoptions.c b/third-party/curl/lib/easyoptions.c
index e69c658b0c..4c0b4f0ce4 100644
--- a/third-party/curl/lib/easyoptions.c
+++ b/third-party/curl/lib/easyoptions.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) Daniel Stenberg, <daniel.se>, et al.
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -25,345 +25,357 @@
 /* This source code is generated by optiontable.pl - DO NOT EDIT BY HAND */
 
 #include "curl_setup.h"
+
 #include "easyoptions.h"
 
 /* all easy setopt options listed in alphabetical order */
-struct curl_easyoption Curl_easyopts[] = {
-  {"ABSTRACT_UNIX_SOCKET", CURLOPT_ABSTRACT_UNIX_SOCKET, CURLOT_STRING, 0},
-  {"ACCEPTTIMEOUT_MS", CURLOPT_ACCEPTTIMEOUT_MS, CURLOT_LONG, 0},
-  {"ACCEPT_ENCODING", CURLOPT_ACCEPT_ENCODING, CURLOT_STRING, 0},
-  {"ADDRESS_SCOPE", CURLOPT_ADDRESS_SCOPE, CURLOT_LONG, 0},
-  {"ALTSVC", CURLOPT_ALTSVC, CURLOT_STRING, 0},
-  {"ALTSVC_CTRL", CURLOPT_ALTSVC_CTRL, CURLOT_LONG, 0},
-  {"APPEND", CURLOPT_APPEND, CURLOT_LONG, 0},
-  {"AUTOREFERER", CURLOPT_AUTOREFERER, CURLOT_LONG, 0},
-  {"AWS_SIGV4", CURLOPT_AWS_SIGV4, CURLOT_STRING, 0},
-  {"BUFFERSIZE", CURLOPT_BUFFERSIZE, CURLOT_LONG, 0},
-  {"CAINFO", CURLOPT_CAINFO, CURLOT_STRING, 0},
-  {"CAINFO_BLOB", CURLOPT_CAINFO_BLOB, CURLOT_BLOB, 0},
-  {"CAPATH", CURLOPT_CAPATH, CURLOT_STRING, 0},
-  {"CA_CACHE_TIMEOUT", CURLOPT_CA_CACHE_TIMEOUT, CURLOT_LONG, 0},
-  {"CERTINFO", CURLOPT_CERTINFO, CURLOT_LONG, 0},
-  {"CHUNK_BGN_FUNCTION", CURLOPT_CHUNK_BGN_FUNCTION, CURLOT_FUNCTION, 0},
-  {"CHUNK_DATA", CURLOPT_CHUNK_DATA, CURLOT_CBPTR, 0},
-  {"CHUNK_END_FUNCTION", CURLOPT_CHUNK_END_FUNCTION, CURLOT_FUNCTION, 0},
-  {"CLOSESOCKETDATA", CURLOPT_CLOSESOCKETDATA, CURLOT_CBPTR, 0},
-  {"CLOSESOCKETFUNCTION", CURLOPT_CLOSESOCKETFUNCTION, CURLOT_FUNCTION, 0},
-  {"CONNECTTIMEOUT", CURLOPT_CONNECTTIMEOUT, CURLOT_LONG, 0},
-  {"CONNECTTIMEOUT_MS", CURLOPT_CONNECTTIMEOUT_MS, CURLOT_LONG, 0},
-  {"CONNECT_ONLY", CURLOPT_CONNECT_ONLY, CURLOT_LONG, 0},
-  {"CONNECT_TO", CURLOPT_CONNECT_TO, CURLOT_SLIST, 0},
-  {"CONV_FROM_NETWORK_FUNCTION", CURLOPT_CONV_FROM_NETWORK_FUNCTION,
-   CURLOT_FUNCTION, 0},
-  {"CONV_FROM_UTF8_FUNCTION", CURLOPT_CONV_FROM_UTF8_FUNCTION,
-   CURLOT_FUNCTION, 0},
-  {"CONV_TO_NETWORK_FUNCTION", CURLOPT_CONV_TO_NETWORK_FUNCTION,
-   CURLOT_FUNCTION, 0},
-  {"COOKIE", CURLOPT_COOKIE, CURLOT_STRING, 0},
-  {"COOKIEFILE", CURLOPT_COOKIEFILE, CURLOT_STRING, 0},
-  {"COOKIEJAR", CURLOPT_COOKIEJAR, CURLOT_STRING, 0},
-  {"COOKIELIST", CURLOPT_COOKIELIST, CURLOT_STRING, 0},
-  {"COOKIESESSION", CURLOPT_COOKIESESSION, CURLOT_LONG, 0},
-  {"COPYPOSTFIELDS", CURLOPT_COPYPOSTFIELDS, CURLOT_OBJECT, 0},
-  {"CRLF", CURLOPT_CRLF, CURLOT_LONG, 0},
-  {"CRLFILE", CURLOPT_CRLFILE, CURLOT_STRING, 0},
-  {"CURLU", CURLOPT_CURLU, CURLOT_OBJECT, 0},
-  {"CUSTOMREQUEST", CURLOPT_CUSTOMREQUEST, CURLOT_STRING, 0},
-  {"DEBUGDATA", CURLOPT_DEBUGDATA, CURLOT_CBPTR, 0},
-  {"DEBUGFUNCTION", CURLOPT_DEBUGFUNCTION, CURLOT_FUNCTION, 0},
-  {"DEFAULT_PROTOCOL", CURLOPT_DEFAULT_PROTOCOL, CURLOT_STRING, 0},
-  {"DIRLISTONLY", CURLOPT_DIRLISTONLY, CURLOT_LONG, 0},
-  {"DISALLOW_USERNAME_IN_URL", CURLOPT_DISALLOW_USERNAME_IN_URL,
-   CURLOT_LONG, 0},
-  {"DNS_CACHE_TIMEOUT", CURLOPT_DNS_CACHE_TIMEOUT, CURLOT_LONG, 0},
-  {"DNS_INTERFACE", CURLOPT_DNS_INTERFACE, CURLOT_STRING, 0},
-  {"DNS_LOCAL_IP4", CURLOPT_DNS_LOCAL_IP4, CURLOT_STRING, 0},
-  {"DNS_LOCAL_IP6", CURLOPT_DNS_LOCAL_IP6, CURLOT_STRING, 0},
-  {"DNS_SERVERS", CURLOPT_DNS_SERVERS, CURLOT_STRING, 0},
-  {"DNS_SHUFFLE_ADDRESSES", CURLOPT_DNS_SHUFFLE_ADDRESSES, CURLOT_LONG, 0},
-  {"DNS_USE_GLOBAL_CACHE", CURLOPT_DNS_USE_GLOBAL_CACHE, CURLOT_LONG, 0},
-  {"DOH_SSL_VERIFYHOST", CURLOPT_DOH_SSL_VERIFYHOST, CURLOT_LONG, 0},
-  {"DOH_SSL_VERIFYPEER", CURLOPT_DOH_SSL_VERIFYPEER, CURLOT_LONG, 0},
-  {"DOH_SSL_VERIFYSTATUS", CURLOPT_DOH_SSL_VERIFYSTATUS, CURLOT_LONG, 0},
-  {"DOH_URL", CURLOPT_DOH_URL, CURLOT_STRING, 0},
-  {"EGDSOCKET", CURLOPT_EGDSOCKET, CURLOT_STRING, 0},
-  {"ENCODING", CURLOPT_ACCEPT_ENCODING, CURLOT_STRING, CURLOT_FLAG_ALIAS},
-  {"ERRORBUFFER", CURLOPT_ERRORBUFFER, CURLOT_OBJECT, 0},
-  {"EXPECT_100_TIMEOUT_MS", CURLOPT_EXPECT_100_TIMEOUT_MS, CURLOT_LONG, 0},
-  {"FAILONERROR", CURLOPT_FAILONERROR, CURLOT_LONG, 0},
-  {"FILE", CURLOPT_WRITEDATA, CURLOT_CBPTR, CURLOT_FLAG_ALIAS},
-  {"FILETIME", CURLOPT_FILETIME, CURLOT_LONG, 0},
-  {"FNMATCH_DATA", CURLOPT_FNMATCH_DATA, CURLOT_CBPTR, 0},
-  {"FNMATCH_FUNCTION", CURLOPT_FNMATCH_FUNCTION, CURLOT_FUNCTION, 0},
-  {"FOLLOWLOCATION", CURLOPT_FOLLOWLOCATION, CURLOT_LONG, 0},
-  {"FORBID_REUSE", CURLOPT_FORBID_REUSE, CURLOT_LONG, 0},
-  {"FRESH_CONNECT", CURLOPT_FRESH_CONNECT, CURLOT_LONG, 0},
-  {"FTPAPPEND", CURLOPT_APPEND, CURLOT_LONG, CURLOT_FLAG_ALIAS},
-  {"FTPLISTONLY", CURLOPT_DIRLISTONLY, CURLOT_LONG, CURLOT_FLAG_ALIAS},
-  {"FTPPORT", CURLOPT_FTPPORT, CURLOT_STRING, 0},
-  {"FTPSSLAUTH", CURLOPT_FTPSSLAUTH, CURLOT_VALUES, 0},
-  {"FTP_ACCOUNT", CURLOPT_FTP_ACCOUNT, CURLOT_STRING, 0},
-  {"FTP_ALTERNATIVE_TO_USER", CURLOPT_FTP_ALTERNATIVE_TO_USER,
-   CURLOT_STRING, 0},
-  {"FTP_CREATE_MISSING_DIRS", CURLOPT_FTP_CREATE_MISSING_DIRS,
-   CURLOT_LONG, 0},
-  {"FTP_FILEMETHOD", CURLOPT_FTP_FILEMETHOD, CURLOT_VALUES, 0},
-  {"FTP_RESPONSE_TIMEOUT", CURLOPT_SERVER_RESPONSE_TIMEOUT,
-   CURLOT_LONG, CURLOT_FLAG_ALIAS},
-  {"FTP_SKIP_PASV_IP", CURLOPT_FTP_SKIP_PASV_IP, CURLOT_LONG, 0},
-  {"FTP_SSL", CURLOPT_USE_SSL, CURLOT_VALUES, CURLOT_FLAG_ALIAS},
-  {"FTP_SSL_CCC", CURLOPT_FTP_SSL_CCC, CURLOT_LONG, 0},
-  {"FTP_USE_EPRT", CURLOPT_FTP_USE_EPRT, CURLOT_LONG, 0},
-  {"FTP_USE_EPSV", CURLOPT_FTP_USE_EPSV, CURLOT_LONG, 0},
-  {"FTP_USE_PRET", CURLOPT_FTP_USE_PRET, CURLOT_LONG, 0},
-  {"GSSAPI_DELEGATION", CURLOPT_GSSAPI_DELEGATION, CURLOT_VALUES, 0},
-  {"HAPPY_EYEBALLS_TIMEOUT_MS", CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS,
-   CURLOT_LONG, 0},
-  {"HAPROXYPROTOCOL", CURLOPT_HAPROXYPROTOCOL, CURLOT_LONG, 0},
-  {"HAPROXY_CLIENT_IP", CURLOPT_HAPROXY_CLIENT_IP, CURLOT_STRING, 0},
-  {"HEADER", CURLOPT_HEADER, CURLOT_LONG, 0},
-  {"HEADERDATA", CURLOPT_HEADERDATA, CURLOT_CBPTR, 0},
-  {"HEADERFUNCTION", CURLOPT_HEADERFUNCTION, CURLOT_FUNCTION, 0},
-  {"HEADEROPT", CURLOPT_HEADEROPT, CURLOT_VALUES, 0},
-  {"HSTS", CURLOPT_HSTS, CURLOT_STRING, 0},
-  {"HSTSREADDATA", CURLOPT_HSTSREADDATA, CURLOT_CBPTR, 0},
-  {"HSTSREADFUNCTION", CURLOPT_HSTSREADFUNCTION, CURLOT_FUNCTION, 0},
-  {"HSTSWRITEDATA", CURLOPT_HSTSWRITEDATA, CURLOT_CBPTR, 0},
-  {"HSTSWRITEFUNCTION", CURLOPT_HSTSWRITEFUNCTION, CURLOT_FUNCTION, 0},
-  {"HSTS_CTRL", CURLOPT_HSTS_CTRL, CURLOT_LONG, 0},
-  {"HTTP09_ALLOWED", CURLOPT_HTTP09_ALLOWED, CURLOT_LONG, 0},
-  {"HTTP200ALIASES", CURLOPT_HTTP200ALIASES, CURLOT_SLIST, 0},
-  {"HTTPAUTH", CURLOPT_HTTPAUTH, CURLOT_VALUES, 0},
-  {"HTTPGET", CURLOPT_HTTPGET, CURLOT_LONG, 0},
-  {"HTTPHEADER", CURLOPT_HTTPHEADER, CURLOT_SLIST, 0},
-  {"HTTPPOST", CURLOPT_HTTPPOST, CURLOT_OBJECT, 0},
-  {"HTTPPROXYTUNNEL", CURLOPT_HTTPPROXYTUNNEL, CURLOT_LONG, 0},
-  {"HTTP_CONTENT_DECODING", CURLOPT_HTTP_CONTENT_DECODING, CURLOT_LONG, 0},
-  {"HTTP_TRANSFER_DECODING", CURLOPT_HTTP_TRANSFER_DECODING, CURLOT_LONG, 0},
-  {"HTTP_VERSION", CURLOPT_HTTP_VERSION, CURLOT_VALUES, 0},
-  {"IGNORE_CONTENT_LENGTH", CURLOPT_IGNORE_CONTENT_LENGTH, CURLOT_LONG, 0},
-  {"INFILE", CURLOPT_READDATA, CURLOT_CBPTR, CURLOT_FLAG_ALIAS},
-  {"INFILESIZE", CURLOPT_INFILESIZE, CURLOT_LONG, 0},
-  {"INFILESIZE_LARGE", CURLOPT_INFILESIZE_LARGE, CURLOT_OFF_T, 0},
-  {"INTERFACE", CURLOPT_INTERFACE, CURLOT_STRING, 0},
-  {"INTERLEAVEDATA", CURLOPT_INTERLEAVEDATA, CURLOT_CBPTR, 0},
-  {"INTERLEAVEFUNCTION", CURLOPT_INTERLEAVEFUNCTION, CURLOT_FUNCTION, 0},
-  {"IOCTLDATA", CURLOPT_IOCTLDATA, CURLOT_CBPTR, 0},
-  {"IOCTLFUNCTION", CURLOPT_IOCTLFUNCTION, CURLOT_FUNCTION, 0},
-  {"IPRESOLVE", CURLOPT_IPRESOLVE, CURLOT_VALUES, 0},
-  {"ISSUERCERT", CURLOPT_ISSUERCERT, CURLOT_STRING, 0},
-  {"ISSUERCERT_BLOB", CURLOPT_ISSUERCERT_BLOB, CURLOT_BLOB, 0},
-  {"KEEP_SENDING_ON_ERROR", CURLOPT_KEEP_SENDING_ON_ERROR, CURLOT_LONG, 0},
-  {"KEYPASSWD", CURLOPT_KEYPASSWD, CURLOT_STRING, 0},
-  {"KRB4LEVEL", CURLOPT_KRBLEVEL, CURLOT_STRING, CURLOT_FLAG_ALIAS},
-  {"KRBLEVEL", CURLOPT_KRBLEVEL, CURLOT_STRING, 0},
-  {"LOCALPORT", CURLOPT_LOCALPORT, CURLOT_LONG, 0},
-  {"LOCALPORTRANGE", CURLOPT_LOCALPORTRANGE, CURLOT_LONG, 0},
-  {"LOGIN_OPTIONS", CURLOPT_LOGIN_OPTIONS, CURLOT_STRING, 0},
-  {"LOW_SPEED_LIMIT", CURLOPT_LOW_SPEED_LIMIT, CURLOT_LONG, 0},
-  {"LOW_SPEED_TIME", CURLOPT_LOW_SPEED_TIME, CURLOT_LONG, 0},
-  {"MAIL_AUTH", CURLOPT_MAIL_AUTH, CURLOT_STRING, 0},
-  {"MAIL_FROM", CURLOPT_MAIL_FROM, CURLOT_STRING, 0},
-  {"MAIL_RCPT", CURLOPT_MAIL_RCPT, CURLOT_SLIST, 0},
-  {"MAIL_RCPT_ALLLOWFAILS", CURLOPT_MAIL_RCPT_ALLOWFAILS,
-   CURLOT_LONG, CURLOT_FLAG_ALIAS},
-  {"MAIL_RCPT_ALLOWFAILS", CURLOPT_MAIL_RCPT_ALLOWFAILS, CURLOT_LONG, 0},
-  {"MAXAGE_CONN", CURLOPT_MAXAGE_CONN, CURLOT_LONG, 0},
-  {"MAXCONNECTS", CURLOPT_MAXCONNECTS, CURLOT_LONG, 0},
-  {"MAXFILESIZE", CURLOPT_MAXFILESIZE, CURLOT_LONG, 0},
-  {"MAXFILESIZE_LARGE", CURLOPT_MAXFILESIZE_LARGE, CURLOT_OFF_T, 0},
-  {"MAXLIFETIME_CONN", CURLOPT_MAXLIFETIME_CONN, CURLOT_LONG, 0},
-  {"MAXREDIRS", CURLOPT_MAXREDIRS, CURLOT_LONG, 0},
-  {"MAX_RECV_SPEED_LARGE", CURLOPT_MAX_RECV_SPEED_LARGE, CURLOT_OFF_T, 0},
-  {"MAX_SEND_SPEED_LARGE", CURLOPT_MAX_SEND_SPEED_LARGE, CURLOT_OFF_T, 0},
-  {"MIMEPOST", CURLOPT_MIMEPOST, CURLOT_OBJECT, 0},
-  {"MIME_OPTIONS", CURLOPT_MIME_OPTIONS, CURLOT_LONG, 0},
-  {"NETRC", CURLOPT_NETRC, CURLOT_VALUES, 0},
-  {"NETRC_FILE", CURLOPT_NETRC_FILE, CURLOT_STRING, 0},
-  {"NEW_DIRECTORY_PERMS", CURLOPT_NEW_DIRECTORY_PERMS, CURLOT_LONG, 0},
-  {"NEW_FILE_PERMS", CURLOPT_NEW_FILE_PERMS, CURLOT_LONG, 0},
-  {"NOBODY", CURLOPT_NOBODY, CURLOT_LONG, 0},
-  {"NOPROGRESS", CURLOPT_NOPROGRESS, CURLOT_LONG, 0},
-  {"NOPROXY", CURLOPT_NOPROXY, CURLOT_STRING, 0},
-  {"NOSIGNAL", CURLOPT_NOSIGNAL, CURLOT_LONG, 0},
-  {"OPENSOCKETDATA", CURLOPT_OPENSOCKETDATA, CURLOT_CBPTR, 0},
-  {"OPENSOCKETFUNCTION", CURLOPT_OPENSOCKETFUNCTION, CURLOT_FUNCTION, 0},
-  {"PASSWORD", CURLOPT_PASSWORD, CURLOT_STRING, 0},
-  {"PATH_AS_IS", CURLOPT_PATH_AS_IS, CURLOT_LONG, 0},
-  {"PINNEDPUBLICKEY", CURLOPT_PINNEDPUBLICKEY, CURLOT_STRING, 0},
-  {"PIPEWAIT", CURLOPT_PIPEWAIT, CURLOT_LONG, 0},
-  {"PORT", CURLOPT_PORT, CURLOT_LONG, 0},
-  {"POST", CURLOPT_POST, CURLOT_LONG, 0},
-  {"POST301", CURLOPT_POSTREDIR, CURLOT_VALUES, CURLOT_FLAG_ALIAS},
-  {"POSTFIELDS", CURLOPT_POSTFIELDS, CURLOT_OBJECT, 0},
-  {"POSTFIELDSIZE", CURLOPT_POSTFIELDSIZE, CURLOT_LONG, 0},
-  {"POSTFIELDSIZE_LARGE", CURLOPT_POSTFIELDSIZE_LARGE, CURLOT_OFF_T, 0},
-  {"POSTQUOTE", CURLOPT_POSTQUOTE, CURLOT_SLIST, 0},
-  {"POSTREDIR", CURLOPT_POSTREDIR, CURLOT_VALUES, 0},
-  {"PREQUOTE", CURLOPT_PREQUOTE, CURLOT_SLIST, 0},
-  {"PREREQDATA", CURLOPT_PREREQDATA, CURLOT_CBPTR, 0},
-  {"PREREQFUNCTION", CURLOPT_PREREQFUNCTION, CURLOT_FUNCTION, 0},
-  {"PRE_PROXY", CURLOPT_PRE_PROXY, CURLOT_STRING, 0},
-  {"PRIVATE", CURLOPT_PRIVATE, CURLOT_OBJECT, 0},
-  {"PROGRESSDATA", CURLOPT_XFERINFODATA, CURLOT_CBPTR, CURLOT_FLAG_ALIAS},
-  {"PROGRESSFUNCTION", CURLOPT_PROGRESSFUNCTION, CURLOT_FUNCTION, 0},
-  {"PROTOCOLS", CURLOPT_PROTOCOLS, CURLOT_LONG, 0},
-  {"PROTOCOLS_STR", CURLOPT_PROTOCOLS_STR, CURLOT_STRING, 0},
-  {"PROXY", CURLOPT_PROXY, CURLOT_STRING, 0},
-  {"PROXYAUTH", CURLOPT_PROXYAUTH, CURLOT_VALUES, 0},
-  {"PROXYHEADER", CURLOPT_PROXYHEADER, CURLOT_SLIST, 0},
-  {"PROXYPASSWORD", CURLOPT_PROXYPASSWORD, CURLOT_STRING, 0},
-  {"PROXYPORT", CURLOPT_PROXYPORT, CURLOT_LONG, 0},
-  {"PROXYTYPE", CURLOPT_PROXYTYPE, CURLOT_VALUES, 0},
-  {"PROXYUSERNAME", CURLOPT_PROXYUSERNAME, CURLOT_STRING, 0},
-  {"PROXYUSERPWD", CURLOPT_PROXYUSERPWD, CURLOT_STRING, 0},
-  {"PROXY_CAINFO", CURLOPT_PROXY_CAINFO, CURLOT_STRING, 0},
-  {"PROXY_CAINFO_BLOB", CURLOPT_PROXY_CAINFO_BLOB, CURLOT_BLOB, 0},
-  {"PROXY_CAPATH", CURLOPT_PROXY_CAPATH, CURLOT_STRING, 0},
-  {"PROXY_CRLFILE", CURLOPT_PROXY_CRLFILE, CURLOT_STRING, 0},
-  {"PROXY_ISSUERCERT", CURLOPT_PROXY_ISSUERCERT, CURLOT_STRING, 0},
-  {"PROXY_ISSUERCERT_BLOB", CURLOPT_PROXY_ISSUERCERT_BLOB, CURLOT_BLOB, 0},
-  {"PROXY_KEYPASSWD", CURLOPT_PROXY_KEYPASSWD, CURLOT_STRING, 0},
-  {"PROXY_PINNEDPUBLICKEY", CURLOPT_PROXY_PINNEDPUBLICKEY, CURLOT_STRING, 0},
-  {"PROXY_SERVICE_NAME", CURLOPT_PROXY_SERVICE_NAME, CURLOT_STRING, 0},
-  {"PROXY_SSLCERT", CURLOPT_PROXY_SSLCERT, CURLOT_STRING, 0},
-  {"PROXY_SSLCERTTYPE", CURLOPT_PROXY_SSLCERTTYPE, CURLOT_STRING, 0},
-  {"PROXY_SSLCERT_BLOB", CURLOPT_PROXY_SSLCERT_BLOB, CURLOT_BLOB, 0},
-  {"PROXY_SSLKEY", CURLOPT_PROXY_SSLKEY, CURLOT_STRING, 0},
-  {"PROXY_SSLKEYTYPE", CURLOPT_PROXY_SSLKEYTYPE, CURLOT_STRING, 0},
-  {"PROXY_SSLKEY_BLOB", CURLOPT_PROXY_SSLKEY_BLOB, CURLOT_BLOB, 0},
-  {"PROXY_SSLVERSION", CURLOPT_PROXY_SSLVERSION, CURLOT_VALUES, 0},
-  {"PROXY_SSL_CIPHER_LIST", CURLOPT_PROXY_SSL_CIPHER_LIST, CURLOT_STRING, 0},
-  {"PROXY_SSL_OPTIONS", CURLOPT_PROXY_SSL_OPTIONS, CURLOT_LONG, 0},
-  {"PROXY_SSL_VERIFYHOST", CURLOPT_PROXY_SSL_VERIFYHOST, CURLOT_LONG, 0},
-  {"PROXY_SSL_VERIFYPEER", CURLOPT_PROXY_SSL_VERIFYPEER, CURLOT_LONG, 0},
-  {"PROXY_TLS13_CIPHERS", CURLOPT_PROXY_TLS13_CIPHERS, CURLOT_STRING, 0},
-  {"PROXY_TLSAUTH_PASSWORD", CURLOPT_PROXY_TLSAUTH_PASSWORD,
-   CURLOT_STRING, 0},
-  {"PROXY_TLSAUTH_TYPE", CURLOPT_PROXY_TLSAUTH_TYPE, CURLOT_STRING, 0},
-  {"PROXY_TLSAUTH_USERNAME", CURLOPT_PROXY_TLSAUTH_USERNAME,
-   CURLOT_STRING, 0},
-  {"PROXY_TRANSFER_MODE", CURLOPT_PROXY_TRANSFER_MODE, CURLOT_LONG, 0},
-  {"PUT", CURLOPT_PUT, CURLOT_LONG, 0},
-  {"QUICK_EXIT", CURLOPT_QUICK_EXIT, CURLOT_LONG, 0},
-  {"QUOTE", CURLOPT_QUOTE, CURLOT_SLIST, 0},
-  {"RANDOM_FILE", CURLOPT_RANDOM_FILE, CURLOT_STRING, 0},
-  {"RANGE", CURLOPT_RANGE, CURLOT_STRING, 0},
-  {"READDATA", CURLOPT_READDATA, CURLOT_CBPTR, 0},
-  {"READFUNCTION", CURLOPT_READFUNCTION, CURLOT_FUNCTION, 0},
-  {"REDIR_PROTOCOLS", CURLOPT_REDIR_PROTOCOLS, CURLOT_LONG, 0},
-  {"REDIR_PROTOCOLS_STR", CURLOPT_REDIR_PROTOCOLS_STR, CURLOT_STRING, 0},
-  {"REFERER", CURLOPT_REFERER, CURLOT_STRING, 0},
-  {"REQUEST_TARGET", CURLOPT_REQUEST_TARGET, CURLOT_STRING, 0},
-  {"RESOLVE", CURLOPT_RESOLVE, CURLOT_SLIST, 0},
-  {"RESOLVER_START_DATA", CURLOPT_RESOLVER_START_DATA, CURLOT_CBPTR, 0},
-  {"RESOLVER_START_FUNCTION", CURLOPT_RESOLVER_START_FUNCTION,
-   CURLOT_FUNCTION, 0},
-  {"RESUME_FROM", CURLOPT_RESUME_FROM, CURLOT_LONG, 0},
-  {"RESUME_FROM_LARGE", CURLOPT_RESUME_FROM_LARGE, CURLOT_OFF_T, 0},
-  {"RTSPHEADER", CURLOPT_HTTPHEADER, CURLOT_SLIST, CURLOT_FLAG_ALIAS},
-  {"RTSP_CLIENT_CSEQ", CURLOPT_RTSP_CLIENT_CSEQ, CURLOT_LONG, 0},
-  {"RTSP_REQUEST", CURLOPT_RTSP_REQUEST, CURLOT_VALUES, 0},
-  {"RTSP_SERVER_CSEQ", CURLOPT_RTSP_SERVER_CSEQ, CURLOT_LONG, 0},
-  {"RTSP_SESSION_ID", CURLOPT_RTSP_SESSION_ID, CURLOT_STRING, 0},
-  {"RTSP_STREAM_URI", CURLOPT_RTSP_STREAM_URI, CURLOT_STRING, 0},
-  {"RTSP_TRANSPORT", CURLOPT_RTSP_TRANSPORT, CURLOT_STRING, 0},
-  {"SASL_AUTHZID", CURLOPT_SASL_AUTHZID, CURLOT_STRING, 0},
-  {"SASL_IR", CURLOPT_SASL_IR, CURLOT_LONG, 0},
-  {"SEEKDATA", CURLOPT_SEEKDATA, CURLOT_CBPTR, 0},
-  {"SEEKFUNCTION", CURLOPT_SEEKFUNCTION, CURLOT_FUNCTION, 0},
-  {"SERVER_RESPONSE_TIMEOUT", CURLOPT_SERVER_RESPONSE_TIMEOUT,
-   CURLOT_LONG, 0},
-  {"SERVICE_NAME", CURLOPT_SERVICE_NAME, CURLOT_STRING, 0},
-  {"SHARE", CURLOPT_SHARE, CURLOT_OBJECT, 0},
-  {"SOCKOPTDATA", CURLOPT_SOCKOPTDATA, CURLOT_CBPTR, 0},
-  {"SOCKOPTFUNCTION", CURLOPT_SOCKOPTFUNCTION, CURLOT_FUNCTION, 0},
-  {"SOCKS5_AUTH", CURLOPT_SOCKS5_AUTH, CURLOT_LONG, 0},
-  {"SOCKS5_GSSAPI_NEC", CURLOPT_SOCKS5_GSSAPI_NEC, CURLOT_LONG, 0},
-  {"SOCKS5_GSSAPI_SERVICE", CURLOPT_SOCKS5_GSSAPI_SERVICE, CURLOT_STRING, 0},
-  {"SSH_AUTH_TYPES", CURLOPT_SSH_AUTH_TYPES, CURLOT_VALUES, 0},
-  {"SSH_COMPRESSION", CURLOPT_SSH_COMPRESSION, CURLOT_LONG, 0},
-  {"SSH_HOSTKEYDATA", CURLOPT_SSH_HOSTKEYDATA, CURLOT_CBPTR, 0},
-  {"SSH_HOSTKEYFUNCTION", CURLOPT_SSH_HOSTKEYFUNCTION, CURLOT_FUNCTION, 0},
-  {"SSH_HOST_PUBLIC_KEY_MD5", CURLOPT_SSH_HOST_PUBLIC_KEY_MD5,
-   CURLOT_STRING, 0},
-  {"SSH_HOST_PUBLIC_KEY_SHA256", CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256,
-   CURLOT_STRING, 0},
-  {"SSH_KEYDATA", CURLOPT_SSH_KEYDATA, CURLOT_CBPTR, 0},
-  {"SSH_KEYFUNCTION", CURLOPT_SSH_KEYFUNCTION, CURLOT_FUNCTION, 0},
-  {"SSH_KNOWNHOSTS", CURLOPT_SSH_KNOWNHOSTS, CURLOT_STRING, 0},
-  {"SSH_PRIVATE_KEYFILE", CURLOPT_SSH_PRIVATE_KEYFILE, CURLOT_STRING, 0},
-  {"SSH_PUBLIC_KEYFILE", CURLOPT_SSH_PUBLIC_KEYFILE, CURLOT_STRING, 0},
-  {"SSLCERT", CURLOPT_SSLCERT, CURLOT_STRING, 0},
-  {"SSLCERTPASSWD", CURLOPT_KEYPASSWD, CURLOT_STRING, CURLOT_FLAG_ALIAS},
-  {"SSLCERTTYPE", CURLOPT_SSLCERTTYPE, CURLOT_STRING, 0},
-  {"SSLCERT_BLOB", CURLOPT_SSLCERT_BLOB, CURLOT_BLOB, 0},
-  {"SSLENGINE", CURLOPT_SSLENGINE, CURLOT_STRING, 0},
-  {"SSLENGINE_DEFAULT", CURLOPT_SSLENGINE_DEFAULT, CURLOT_LONG, 0},
-  {"SSLKEY", CURLOPT_SSLKEY, CURLOT_STRING, 0},
-  {"SSLKEYPASSWD", CURLOPT_KEYPASSWD, CURLOT_STRING, CURLOT_FLAG_ALIAS},
-  {"SSLKEYTYPE", CURLOPT_SSLKEYTYPE, CURLOT_STRING, 0},
-  {"SSLKEY_BLOB", CURLOPT_SSLKEY_BLOB, CURLOT_BLOB, 0},
-  {"SSLVERSION", CURLOPT_SSLVERSION, CURLOT_VALUES, 0},
-  {"SSL_CIPHER_LIST", CURLOPT_SSL_CIPHER_LIST, CURLOT_STRING, 0},
-  {"SSL_CTX_DATA", CURLOPT_SSL_CTX_DATA, CURLOT_CBPTR, 0},
-  {"SSL_CTX_FUNCTION", CURLOPT_SSL_CTX_FUNCTION, CURLOT_FUNCTION, 0},
-  {"SSL_EC_CURVES", CURLOPT_SSL_EC_CURVES, CURLOT_STRING, 0},
-  {"SSL_ENABLE_ALPN", CURLOPT_SSL_ENABLE_ALPN, CURLOT_LONG, 0},
-  {"SSL_ENABLE_NPN", CURLOPT_SSL_ENABLE_NPN, CURLOT_LONG, 0},
-  {"SSL_FALSESTART", CURLOPT_SSL_FALSESTART, CURLOT_LONG, 0},
-  {"SSL_OPTIONS", CURLOPT_SSL_OPTIONS, CURLOT_VALUES, 0},
-  {"SSL_SESSIONID_CACHE", CURLOPT_SSL_SESSIONID_CACHE, CURLOT_LONG, 0},
-  {"SSL_VERIFYHOST", CURLOPT_SSL_VERIFYHOST, CURLOT_LONG, 0},
-  {"SSL_VERIFYPEER", CURLOPT_SSL_VERIFYPEER, CURLOT_LONG, 0},
-  {"SSL_VERIFYSTATUS", CURLOPT_SSL_VERIFYSTATUS, CURLOT_LONG, 0},
-  {"STDERR", CURLOPT_STDERR, CURLOT_OBJECT, 0},
-  {"STREAM_DEPENDS", CURLOPT_STREAM_DEPENDS, CURLOT_OBJECT, 0},
-  {"STREAM_DEPENDS_E", CURLOPT_STREAM_DEPENDS_E, CURLOT_OBJECT, 0},
-  {"STREAM_WEIGHT", CURLOPT_STREAM_WEIGHT, CURLOT_LONG, 0},
-  {"SUPPRESS_CONNECT_HEADERS", CURLOPT_SUPPRESS_CONNECT_HEADERS,
-   CURLOT_LONG, 0},
-  {"TCP_FASTOPEN", CURLOPT_TCP_FASTOPEN, CURLOT_LONG, 0},
-  {"TCP_KEEPALIVE", CURLOPT_TCP_KEEPALIVE, CURLOT_LONG, 0},
-  {"TCP_KEEPIDLE", CURLOPT_TCP_KEEPIDLE, CURLOT_LONG, 0},
-  {"TCP_KEEPINTVL", CURLOPT_TCP_KEEPINTVL, CURLOT_LONG, 0},
-  {"TCP_NODELAY", CURLOPT_TCP_NODELAY, CURLOT_LONG, 0},
-  {"TELNETOPTIONS", CURLOPT_TELNETOPTIONS, CURLOT_SLIST, 0},
-  {"TFTP_BLKSIZE", CURLOPT_TFTP_BLKSIZE, CURLOT_LONG, 0},
-  {"TFTP_NO_OPTIONS", CURLOPT_TFTP_NO_OPTIONS, CURLOT_LONG, 0},
-  {"TIMECONDITION", CURLOPT_TIMECONDITION, CURLOT_VALUES, 0},
-  {"TIMEOUT", CURLOPT_TIMEOUT, CURLOT_LONG, 0},
-  {"TIMEOUT_MS", CURLOPT_TIMEOUT_MS, CURLOT_LONG, 0},
-  {"TIMEVALUE", CURLOPT_TIMEVALUE, CURLOT_LONG, 0},
-  {"TIMEVALUE_LARGE", CURLOPT_TIMEVALUE_LARGE, CURLOT_OFF_T, 0},
-  {"TLS13_CIPHERS", CURLOPT_TLS13_CIPHERS, CURLOT_STRING, 0},
-  {"TLSAUTH_PASSWORD", CURLOPT_TLSAUTH_PASSWORD, CURLOT_STRING, 0},
-  {"TLSAUTH_TYPE", CURLOPT_TLSAUTH_TYPE, CURLOT_STRING, 0},
-  {"TLSAUTH_USERNAME", CURLOPT_TLSAUTH_USERNAME, CURLOT_STRING, 0},
-  {"TRAILERDATA", CURLOPT_TRAILERDATA, CURLOT_CBPTR, 0},
-  {"TRAILERFUNCTION", CURLOPT_TRAILERFUNCTION, CURLOT_FUNCTION, 0},
-  {"TRANSFERTEXT", CURLOPT_TRANSFERTEXT, CURLOT_LONG, 0},
-  {"TRANSFER_ENCODING", CURLOPT_TRANSFER_ENCODING, CURLOT_LONG, 0},
-  {"UNIX_SOCKET_PATH", CURLOPT_UNIX_SOCKET_PATH, CURLOT_STRING, 0},
-  {"UNRESTRICTED_AUTH", CURLOPT_UNRESTRICTED_AUTH, CURLOT_LONG, 0},
-  {"UPKEEP_INTERVAL_MS", CURLOPT_UPKEEP_INTERVAL_MS, CURLOT_LONG, 0},
-  {"UPLOAD", CURLOPT_UPLOAD, CURLOT_LONG, 0},
-  {"UPLOAD_BUFFERSIZE", CURLOPT_UPLOAD_BUFFERSIZE, CURLOT_LONG, 0},
-  {"URL", CURLOPT_URL, CURLOT_STRING, 0},
-  {"USERAGENT", CURLOPT_USERAGENT, CURLOT_STRING, 0},
-  {"USERNAME", CURLOPT_USERNAME, CURLOT_STRING, 0},
-  {"USERPWD", CURLOPT_USERPWD, CURLOT_STRING, 0},
-  {"USE_SSL", CURLOPT_USE_SSL, CURLOT_VALUES, 0},
-  {"VERBOSE", CURLOPT_VERBOSE, CURLOT_LONG, 0},
-  {"WILDCARDMATCH", CURLOPT_WILDCARDMATCH, CURLOT_LONG, 0},
-  {"WRITEDATA", CURLOPT_WRITEDATA, CURLOT_CBPTR, 0},
-  {"WRITEFUNCTION", CURLOPT_WRITEFUNCTION, CURLOT_FUNCTION, 0},
-  {"WRITEHEADER", CURLOPT_HEADERDATA, CURLOT_CBPTR, CURLOT_FLAG_ALIAS},
-  {"WS_OPTIONS", CURLOPT_WS_OPTIONS, CURLOT_LONG, 0},
-  {"XFERINFODATA", CURLOPT_XFERINFODATA, CURLOT_CBPTR, 0},
-  {"XFERINFOFUNCTION", CURLOPT_XFERINFOFUNCTION, CURLOT_FUNCTION, 0},
-  {"XOAUTH2_BEARER", CURLOPT_XOAUTH2_BEARER, CURLOT_STRING, 0},
-  {NULL, CURLOPT_LASTENTRY, CURLOT_LONG, 0} /* end of table */
+const struct curl_easyoption Curl_easyopts[] = {
+  { "ABSTRACT_UNIX_SOCKET", CURLOPT_ABSTRACT_UNIX_SOCKET, CURLOT_STRING, 0 },
+  { "ACCEPTTIMEOUT_MS", CURLOPT_ACCEPTTIMEOUT_MS, CURLOT_LONG, 0 },
+  { "ACCEPT_ENCODING", CURLOPT_ACCEPT_ENCODING, CURLOT_STRING, 0 },
+  { "ADDRESS_SCOPE", CURLOPT_ADDRESS_SCOPE, CURLOT_LONG, 0 },
+  { "ALTSVC", CURLOPT_ALTSVC, CURLOT_STRING, 0 },
+  { "ALTSVC_CTRL", CURLOPT_ALTSVC_CTRL, CURLOT_LONG, 0 },
+  { "APPEND", CURLOPT_APPEND, CURLOT_LONG, 0 },
+  { "AUTOREFERER", CURLOPT_AUTOREFERER, CURLOT_LONG, 0 },
+  { "AWS_SIGV4", CURLOPT_AWS_SIGV4, CURLOT_STRING, 0 },
+  { "BUFFERSIZE", CURLOPT_BUFFERSIZE, CURLOT_LONG, 0 },
+  { "CAINFO", CURLOPT_CAINFO, CURLOT_STRING, 0 },
+  { "CAINFO_BLOB", CURLOPT_CAINFO_BLOB, CURLOT_BLOB, 0 },
+  { "CAPATH", CURLOPT_CAPATH, CURLOT_STRING, 0 },
+  { "CA_CACHE_TIMEOUT", CURLOPT_CA_CACHE_TIMEOUT, CURLOT_LONG, 0 },
+  { "CERTINFO", CURLOPT_CERTINFO, CURLOT_LONG, 0 },
+  { "CHUNK_BGN_FUNCTION", CURLOPT_CHUNK_BGN_FUNCTION, CURLOT_FUNCTION, 0 },
+  { "CHUNK_DATA", CURLOPT_CHUNK_DATA, CURLOT_CBPTR, 0 },
+  { "CHUNK_END_FUNCTION", CURLOPT_CHUNK_END_FUNCTION, CURLOT_FUNCTION, 0 },
+  { "CLOSESOCKETDATA", CURLOPT_CLOSESOCKETDATA, CURLOT_CBPTR, 0 },
+  { "CLOSESOCKETFUNCTION", CURLOPT_CLOSESOCKETFUNCTION, CURLOT_FUNCTION, 0 },
+  { "CONNECTTIMEOUT", CURLOPT_CONNECTTIMEOUT, CURLOT_LONG, 0 },
+  { "CONNECTTIMEOUT_MS", CURLOPT_CONNECTTIMEOUT_MS, CURLOT_LONG, 0 },
+  { "CONNECT_ONLY", CURLOPT_CONNECT_ONLY, CURLOT_LONG, 0 },
+  { "CONNECT_TO", CURLOPT_CONNECT_TO, CURLOT_SLIST, 0 },
+  { "CONV_FROM_NETWORK_FUNCTION", CURLOPT_CONV_FROM_NETWORK_FUNCTION,
+    CURLOT_FUNCTION, 0 },
+  { "CONV_FROM_UTF8_FUNCTION", CURLOPT_CONV_FROM_UTF8_FUNCTION,
+    CURLOT_FUNCTION, 0 },
+  { "CONV_TO_NETWORK_FUNCTION", CURLOPT_CONV_TO_NETWORK_FUNCTION,
+    CURLOT_FUNCTION, 0 },
+  { "COOKIE", CURLOPT_COOKIE, CURLOT_STRING, 0 },
+  { "COOKIEFILE", CURLOPT_COOKIEFILE, CURLOT_STRING, 0 },
+  { "COOKIEJAR", CURLOPT_COOKIEJAR, CURLOT_STRING, 0 },
+  { "COOKIELIST", CURLOPT_COOKIELIST, CURLOT_STRING, 0 },
+  { "COOKIESESSION", CURLOPT_COOKIESESSION, CURLOT_LONG, 0 },
+  { "COPYPOSTFIELDS", CURLOPT_COPYPOSTFIELDS, CURLOT_OBJECT, 0 },
+  { "CRLF", CURLOPT_CRLF, CURLOT_LONG, 0 },
+  { "CRLFILE", CURLOPT_CRLFILE, CURLOT_STRING, 0 },
+  { "CURLU", CURLOPT_CURLU, CURLOT_OBJECT, 0 },
+  { "CUSTOMREQUEST", CURLOPT_CUSTOMREQUEST, CURLOT_STRING, 0 },
+  { "DEBUGDATA", CURLOPT_DEBUGDATA, CURLOT_CBPTR, 0 },
+  { "DEBUGFUNCTION", CURLOPT_DEBUGFUNCTION, CURLOT_FUNCTION, 0 },
+  { "DEFAULT_PROTOCOL", CURLOPT_DEFAULT_PROTOCOL, CURLOT_STRING, 0 },
+  { "DIRLISTONLY", CURLOPT_DIRLISTONLY, CURLOT_LONG, 0 },
+  { "DISALLOW_USERNAME_IN_URL", CURLOPT_DISALLOW_USERNAME_IN_URL,
+    CURLOT_LONG, 0 },
+  { "DNS_CACHE_TIMEOUT", CURLOPT_DNS_CACHE_TIMEOUT, CURLOT_LONG, 0 },
+  { "DNS_INTERFACE", CURLOPT_DNS_INTERFACE, CURLOT_STRING, 0 },
+  { "DNS_LOCAL_IP4", CURLOPT_DNS_LOCAL_IP4, CURLOT_STRING, 0 },
+  { "DNS_LOCAL_IP6", CURLOPT_DNS_LOCAL_IP6, CURLOT_STRING, 0 },
+  { "DNS_SERVERS", CURLOPT_DNS_SERVERS, CURLOT_STRING, 0 },
+  { "DNS_SHUFFLE_ADDRESSES", CURLOPT_DNS_SHUFFLE_ADDRESSES, CURLOT_LONG, 0 },
+  { "DNS_USE_GLOBAL_CACHE", CURLOPT_DNS_USE_GLOBAL_CACHE, CURLOT_LONG, 0 },
+  { "DOH_SSL_VERIFYHOST", CURLOPT_DOH_SSL_VERIFYHOST, CURLOT_LONG, 0 },
+  { "DOH_SSL_VERIFYPEER", CURLOPT_DOH_SSL_VERIFYPEER, CURLOT_LONG, 0 },
+  { "DOH_SSL_VERIFYSTATUS", CURLOPT_DOH_SSL_VERIFYSTATUS, CURLOT_LONG, 0 },
+  { "DOH_URL", CURLOPT_DOH_URL, CURLOT_STRING, 0 },
+  { "ECH", CURLOPT_ECH, CURLOT_STRING, 0 },
+  { "EGDSOCKET", CURLOPT_EGDSOCKET, CURLOT_STRING, 0 },
+  { "ENCODING", CURLOPT_ACCEPT_ENCODING, CURLOT_STRING, CURLOT_FLAG_ALIAS },
+  { "ERRORBUFFER", CURLOPT_ERRORBUFFER, CURLOT_OBJECT, 0 },
+  { "EXPECT_100_TIMEOUT_MS", CURLOPT_EXPECT_100_TIMEOUT_MS, CURLOT_LONG, 0 },
+  { "FAILONERROR", CURLOPT_FAILONERROR, CURLOT_LONG, 0 },
+  { "FILE", CURLOPT_WRITEDATA, CURLOT_CBPTR, CURLOT_FLAG_ALIAS },
+  { "FILETIME", CURLOPT_FILETIME, CURLOT_LONG, 0 },
+  { "FNMATCH_DATA", CURLOPT_FNMATCH_DATA, CURLOT_CBPTR, 0 },
+  { "FNMATCH_FUNCTION", CURLOPT_FNMATCH_FUNCTION, CURLOT_FUNCTION, 0 },
+  { "FOLLOWLOCATION", CURLOPT_FOLLOWLOCATION, CURLOT_LONG, 0 },
+  { "FORBID_REUSE", CURLOPT_FORBID_REUSE, CURLOT_LONG, 0 },
+  { "FRESH_CONNECT", CURLOPT_FRESH_CONNECT, CURLOT_LONG, 0 },
+  { "FTPAPPEND", CURLOPT_APPEND, CURLOT_LONG, CURLOT_FLAG_ALIAS },
+  { "FTPLISTONLY", CURLOPT_DIRLISTONLY, CURLOT_LONG, CURLOT_FLAG_ALIAS },
+  { "FTPPORT", CURLOPT_FTPPORT, CURLOT_STRING, 0 },
+  { "FTPSSLAUTH", CURLOPT_FTPSSLAUTH, CURLOT_VALUES, 0 },
+  { "FTP_ACCOUNT", CURLOPT_FTP_ACCOUNT, CURLOT_STRING, 0 },
+  { "FTP_ALTERNATIVE_TO_USER", CURLOPT_FTP_ALTERNATIVE_TO_USER,
+    CURLOT_STRING, 0 },
+  { "FTP_CREATE_MISSING_DIRS", CURLOPT_FTP_CREATE_MISSING_DIRS,
+    CURLOT_LONG, 0 },
+  { "FTP_FILEMETHOD", CURLOPT_FTP_FILEMETHOD, CURLOT_VALUES, 0 },
+  { "FTP_RESPONSE_TIMEOUT", CURLOPT_SERVER_RESPONSE_TIMEOUT,
+    CURLOT_LONG, CURLOT_FLAG_ALIAS },
+  { "FTP_SKIP_PASV_IP", CURLOPT_FTP_SKIP_PASV_IP, CURLOT_LONG, 0 },
+  { "FTP_SSL", CURLOPT_USE_SSL, CURLOT_VALUES, CURLOT_FLAG_ALIAS },
+  { "FTP_SSL_CCC", CURLOPT_FTP_SSL_CCC, CURLOT_LONG, 0 },
+  { "FTP_USE_EPRT", CURLOPT_FTP_USE_EPRT, CURLOT_LONG, 0 },
+  { "FTP_USE_EPSV", CURLOPT_FTP_USE_EPSV, CURLOT_LONG, 0 },
+  { "FTP_USE_PRET", CURLOPT_FTP_USE_PRET, CURLOT_LONG, 0 },
+  { "GSSAPI_DELEGATION", CURLOPT_GSSAPI_DELEGATION, CURLOT_VALUES, 0 },
+  { "HAPPY_EYEBALLS_TIMEOUT_MS", CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS,
+    CURLOT_LONG, 0 },
+  { "HAPROXYPROTOCOL", CURLOPT_HAPROXYPROTOCOL, CURLOT_LONG, 0 },
+  { "HAPROXY_CLIENT_IP", CURLOPT_HAPROXY_CLIENT_IP, CURLOT_STRING, 0 },
+  { "HEADER", CURLOPT_HEADER, CURLOT_LONG, 0 },
+  { "HEADERDATA", CURLOPT_HEADERDATA, CURLOT_CBPTR, 0 },
+  { "HEADERFUNCTION", CURLOPT_HEADERFUNCTION, CURLOT_FUNCTION, 0 },
+  { "HEADEROPT", CURLOPT_HEADEROPT, CURLOT_VALUES, 0 },
+  { "HSTS", CURLOPT_HSTS, CURLOT_STRING, 0 },
+  { "HSTSREADDATA", CURLOPT_HSTSREADDATA, CURLOT_CBPTR, 0 },
+  { "HSTSREADFUNCTION", CURLOPT_HSTSREADFUNCTION, CURLOT_FUNCTION, 0 },
+  { "HSTSWRITEDATA", CURLOPT_HSTSWRITEDATA, CURLOT_CBPTR, 0 },
+  { "HSTSWRITEFUNCTION", CURLOPT_HSTSWRITEFUNCTION, CURLOT_FUNCTION, 0 },
+  { "HSTS_CTRL", CURLOPT_HSTS_CTRL, CURLOT_LONG, 0 },
+  { "HTTP09_ALLOWED", CURLOPT_HTTP09_ALLOWED, CURLOT_LONG, 0 },
+  { "HTTP200ALIASES", CURLOPT_HTTP200ALIASES, CURLOT_SLIST, 0 },
+  { "HTTPAUTH", CURLOPT_HTTPAUTH, CURLOT_VALUES, 0 },
+  { "HTTPGET", CURLOPT_HTTPGET, CURLOT_LONG, 0 },
+  { "HTTPHEADER", CURLOPT_HTTPHEADER, CURLOT_SLIST, 0 },
+  { "HTTPPOST", CURLOPT_HTTPPOST, CURLOT_OBJECT, 0 },
+  { "HTTPPROXYTUNNEL", CURLOPT_HTTPPROXYTUNNEL, CURLOT_LONG, 0 },
+  { "HTTP_CONTENT_DECODING", CURLOPT_HTTP_CONTENT_DECODING, CURLOT_LONG, 0 },
+  { "HTTP_TRANSFER_DECODING", CURLOPT_HTTP_TRANSFER_DECODING,
+    CURLOT_LONG, 0 },
+  { "HTTP_VERSION", CURLOPT_HTTP_VERSION, CURLOT_VALUES, 0 },
+  { "IGNORE_CONTENT_LENGTH", CURLOPT_IGNORE_CONTENT_LENGTH, CURLOT_LONG, 0 },
+  { "INFILE", CURLOPT_READDATA, CURLOT_CBPTR, CURLOT_FLAG_ALIAS },
+  { "INFILESIZE", CURLOPT_INFILESIZE, CURLOT_LONG, 0 },
+  { "INFILESIZE_LARGE", CURLOPT_INFILESIZE_LARGE, CURLOT_OFF_T, 0 },
+  { "INTERFACE", CURLOPT_INTERFACE, CURLOT_STRING, 0 },
+  { "INTERLEAVEDATA", CURLOPT_INTERLEAVEDATA, CURLOT_CBPTR, 0 },
+  { "INTERLEAVEFUNCTION", CURLOPT_INTERLEAVEFUNCTION, CURLOT_FUNCTION, 0 },
+  { "IOCTLDATA", CURLOPT_IOCTLDATA, CURLOT_CBPTR, 0 },
+  { "IOCTLFUNCTION", CURLOPT_IOCTLFUNCTION, CURLOT_FUNCTION, 0 },
+  { "IPRESOLVE", CURLOPT_IPRESOLVE, CURLOT_VALUES, 0 },
+  { "ISSUERCERT", CURLOPT_ISSUERCERT, CURLOT_STRING, 0 },
+  { "ISSUERCERT_BLOB", CURLOPT_ISSUERCERT_BLOB, CURLOT_BLOB, 0 },
+  { "KEEP_SENDING_ON_ERROR", CURLOPT_KEEP_SENDING_ON_ERROR, CURLOT_LONG, 0 },
+  { "KEYPASSWD", CURLOPT_KEYPASSWD, CURLOT_STRING, 0 },
+  { "KRB4LEVEL", CURLOPT_KRBLEVEL, CURLOT_STRING, CURLOT_FLAG_ALIAS },
+  { "KRBLEVEL", CURLOPT_KRBLEVEL, CURLOT_STRING, 0 },
+  { "LOCALPORT", CURLOPT_LOCALPORT, CURLOT_LONG, 0 },
+  { "LOCALPORTRANGE", CURLOPT_LOCALPORTRANGE, CURLOT_LONG, 0 },
+  { "LOGIN_OPTIONS", CURLOPT_LOGIN_OPTIONS, CURLOT_STRING, 0 },
+  { "LOW_SPEED_LIMIT", CURLOPT_LOW_SPEED_LIMIT, CURLOT_LONG, 0 },
+  { "LOW_SPEED_TIME", CURLOPT_LOW_SPEED_TIME, CURLOT_LONG, 0 },
+  { "MAIL_AUTH", CURLOPT_MAIL_AUTH, CURLOT_STRING, 0 },
+  { "MAIL_FROM", CURLOPT_MAIL_FROM, CURLOT_STRING, 0 },
+  { "MAIL_RCPT", CURLOPT_MAIL_RCPT, CURLOT_SLIST, 0 },
+  { "MAIL_RCPT_ALLLOWFAILS", CURLOPT_MAIL_RCPT_ALLOWFAILS,
+    CURLOT_LONG, CURLOT_FLAG_ALIAS },
+  { "MAIL_RCPT_ALLOWFAILS", CURLOPT_MAIL_RCPT_ALLOWFAILS, CURLOT_LONG, 0 },
+  { "MAXAGE_CONN", CURLOPT_MAXAGE_CONN, CURLOT_LONG, 0 },
+  { "MAXCONNECTS", CURLOPT_MAXCONNECTS, CURLOT_LONG, 0 },
+  { "MAXFILESIZE", CURLOPT_MAXFILESIZE, CURLOT_LONG, 0 },
+  { "MAXFILESIZE_LARGE", CURLOPT_MAXFILESIZE_LARGE, CURLOT_OFF_T, 0 },
+  { "MAXLIFETIME_CONN", CURLOPT_MAXLIFETIME_CONN, CURLOT_LONG, 0 },
+  { "MAXREDIRS", CURLOPT_MAXREDIRS, CURLOT_LONG, 0 },
+  { "MAX_RECV_SPEED_LARGE", CURLOPT_MAX_RECV_SPEED_LARGE, CURLOT_OFF_T, 0 },
+  { "MAX_SEND_SPEED_LARGE", CURLOPT_MAX_SEND_SPEED_LARGE, CURLOT_OFF_T, 0 },
+  { "MIMEPOST", CURLOPT_MIMEPOST, CURLOT_OBJECT, 0 },
+  { "MIME_OPTIONS", CURLOPT_MIME_OPTIONS, CURLOT_LONG, 0 },
+  { "NETRC", CURLOPT_NETRC, CURLOT_VALUES, 0 },
+  { "NETRC_FILE", CURLOPT_NETRC_FILE, CURLOT_STRING, 0 },
+  { "NEW_DIRECTORY_PERMS", CURLOPT_NEW_DIRECTORY_PERMS, CURLOT_LONG, 0 },
+  { "NEW_FILE_PERMS", CURLOPT_NEW_FILE_PERMS, CURLOT_LONG, 0 },
+  { "NOBODY", CURLOPT_NOBODY, CURLOT_LONG, 0 },
+  { "NOPROGRESS", CURLOPT_NOPROGRESS, CURLOT_LONG, 0 },
+  { "NOPROXY", CURLOPT_NOPROXY, CURLOT_STRING, 0 },
+  { "NOSIGNAL", CURLOPT_NOSIGNAL, CURLOT_LONG, 0 },
+  { "OPENSOCKETDATA", CURLOPT_OPENSOCKETDATA, CURLOT_CBPTR, 0 },
+  { "OPENSOCKETFUNCTION", CURLOPT_OPENSOCKETFUNCTION, CURLOT_FUNCTION, 0 },
+  { "PASSWORD", CURLOPT_PASSWORD, CURLOT_STRING, 0 },
+  { "PATH_AS_IS", CURLOPT_PATH_AS_IS, CURLOT_LONG, 0 },
+  { "PINNEDPUBLICKEY", CURLOPT_PINNEDPUBLICKEY, CURLOT_STRING, 0 },
+  { "PIPEWAIT", CURLOPT_PIPEWAIT, CURLOT_LONG, 0 },
+  { "PORT", CURLOPT_PORT, CURLOT_LONG, 0 },
+  { "POST", CURLOPT_POST, CURLOT_LONG, 0 },
+  { "POST301", CURLOPT_POSTREDIR, CURLOT_VALUES, CURLOT_FLAG_ALIAS },
+  { "POSTFIELDS", CURLOPT_POSTFIELDS, CURLOT_OBJECT, 0 },
+  { "POSTFIELDSIZE", CURLOPT_POSTFIELDSIZE, CURLOT_LONG, 0 },
+  { "POSTFIELDSIZE_LARGE", CURLOPT_POSTFIELDSIZE_LARGE, CURLOT_OFF_T, 0 },
+  { "POSTQUOTE", CURLOPT_POSTQUOTE, CURLOT_SLIST, 0 },
+  { "POSTREDIR", CURLOPT_POSTREDIR, CURLOT_VALUES, 0 },
+  { "PREQUOTE", CURLOPT_PREQUOTE, CURLOT_SLIST, 0 },
+  { "PREREQDATA", CURLOPT_PREREQDATA, CURLOT_CBPTR, 0 },
+  { "PREREQFUNCTION", CURLOPT_PREREQFUNCTION, CURLOT_FUNCTION, 0 },
+  { "PRE_PROXY", CURLOPT_PRE_PROXY, CURLOT_STRING, 0 },
+  { "PRIVATE", CURLOPT_PRIVATE, CURLOT_OBJECT, 0 },
+  { "PROGRESSDATA", CURLOPT_XFERINFODATA, CURLOT_CBPTR, CURLOT_FLAG_ALIAS },
+  { "PROGRESSFUNCTION", CURLOPT_PROGRESSFUNCTION, CURLOT_FUNCTION, 0 },
+  { "PROTOCOLS", CURLOPT_PROTOCOLS, CURLOT_LONG, 0 },
+  { "PROTOCOLS_STR", CURLOPT_PROTOCOLS_STR, CURLOT_STRING, 0 },
+  { "PROXY", CURLOPT_PROXY, CURLOT_STRING, 0 },
+  { "PROXYAUTH", CURLOPT_PROXYAUTH, CURLOT_VALUES, 0 },
+  { "PROXYHEADER", CURLOPT_PROXYHEADER, CURLOT_SLIST, 0 },
+  { "PROXYPASSWORD", CURLOPT_PROXYPASSWORD, CURLOT_STRING, 0 },
+  { "PROXYPORT", CURLOPT_PROXYPORT, CURLOT_LONG, 0 },
+  { "PROXYTYPE", CURLOPT_PROXYTYPE, CURLOT_VALUES, 0 },
+  { "PROXYUSERNAME", CURLOPT_PROXYUSERNAME, CURLOT_STRING, 0 },
+  { "PROXYUSERPWD", CURLOPT_PROXYUSERPWD, CURLOT_STRING, 0 },
+  { "PROXY_CAINFO", CURLOPT_PROXY_CAINFO, CURLOT_STRING, 0 },
+  { "PROXY_CAINFO_BLOB", CURLOPT_PROXY_CAINFO_BLOB, CURLOT_BLOB, 0 },
+  { "PROXY_CAPATH", CURLOPT_PROXY_CAPATH, CURLOT_STRING, 0 },
+  { "PROXY_CRLFILE", CURLOPT_PROXY_CRLFILE, CURLOT_STRING, 0 },
+  { "PROXY_ISSUERCERT", CURLOPT_PROXY_ISSUERCERT, CURLOT_STRING, 0 },
+  { "PROXY_ISSUERCERT_BLOB", CURLOPT_PROXY_ISSUERCERT_BLOB, CURLOT_BLOB, 0 },
+  { "PROXY_KEYPASSWD", CURLOPT_PROXY_KEYPASSWD, CURLOT_STRING, 0 },
+  { "PROXY_PINNEDPUBLICKEY", CURLOPT_PROXY_PINNEDPUBLICKEY,
+    CURLOT_STRING, 0 },
+  { "PROXY_SERVICE_NAME", CURLOPT_PROXY_SERVICE_NAME, CURLOT_STRING, 0 },
+  { "PROXY_SSLCERT", CURLOPT_PROXY_SSLCERT, CURLOT_STRING, 0 },
+  { "PROXY_SSLCERTTYPE", CURLOPT_PROXY_SSLCERTTYPE, CURLOT_STRING, 0 },
+  { "PROXY_SSLCERT_BLOB", CURLOPT_PROXY_SSLCERT_BLOB, CURLOT_BLOB, 0 },
+  { "PROXY_SSLKEY", CURLOPT_PROXY_SSLKEY, CURLOT_STRING, 0 },
+  { "PROXY_SSLKEYTYPE", CURLOPT_PROXY_SSLKEYTYPE, CURLOT_STRING, 0 },
+  { "PROXY_SSLKEY_BLOB", CURLOPT_PROXY_SSLKEY_BLOB, CURLOT_BLOB, 0 },
+  { "PROXY_SSLVERSION", CURLOPT_PROXY_SSLVERSION, CURLOT_VALUES, 0 },
+  { "PROXY_SSL_CIPHER_LIST", CURLOPT_PROXY_SSL_CIPHER_LIST,
+    CURLOT_STRING, 0 },
+  { "PROXY_SSL_OPTIONS", CURLOPT_PROXY_SSL_OPTIONS, CURLOT_LONG, 0 },
+  { "PROXY_SSL_VERIFYHOST", CURLOPT_PROXY_SSL_VERIFYHOST, CURLOT_LONG, 0 },
+  { "PROXY_SSL_VERIFYPEER", CURLOPT_PROXY_SSL_VERIFYPEER, CURLOT_LONG, 0 },
+  { "PROXY_TLS13_CIPHERS", CURLOPT_PROXY_TLS13_CIPHERS, CURLOT_STRING, 0 },
+  { "PROXY_TLSAUTH_PASSWORD", CURLOPT_PROXY_TLSAUTH_PASSWORD,
+    CURLOT_STRING, 0 },
+  { "PROXY_TLSAUTH_TYPE", CURLOPT_PROXY_TLSAUTH_TYPE, CURLOT_STRING, 0 },
+  { "PROXY_TLSAUTH_USERNAME", CURLOPT_PROXY_TLSAUTH_USERNAME,
+    CURLOT_STRING, 0 },
+  { "PROXY_TRANSFER_MODE", CURLOPT_PROXY_TRANSFER_MODE, CURLOT_LONG, 0 },
+  { "PUT", CURLOPT_PUT, CURLOT_LONG, 0 },
+  { "QUICK_EXIT", CURLOPT_QUICK_EXIT, CURLOT_LONG, 0 },
+  { "QUOTE", CURLOPT_QUOTE, CURLOT_SLIST, 0 },
+  { "RANDOM_FILE", CURLOPT_RANDOM_FILE, CURLOT_STRING, 0 },
+  { "RANGE", CURLOPT_RANGE, CURLOT_STRING, 0 },
+  { "READDATA", CURLOPT_READDATA, CURLOT_CBPTR, 0 },
+  { "READFUNCTION", CURLOPT_READFUNCTION, CURLOT_FUNCTION, 0 },
+  { "REDIR_PROTOCOLS", CURLOPT_REDIR_PROTOCOLS, CURLOT_LONG, 0 },
+  { "REDIR_PROTOCOLS_STR", CURLOPT_REDIR_PROTOCOLS_STR, CURLOT_STRING, 0 },
+  { "REFERER", CURLOPT_REFERER, CURLOT_STRING, 0 },
+  { "REQUEST_TARGET", CURLOPT_REQUEST_TARGET, CURLOT_STRING, 0 },
+  { "RESOLVE", CURLOPT_RESOLVE, CURLOT_SLIST, 0 },
+  { "RESOLVER_START_DATA", CURLOPT_RESOLVER_START_DATA, CURLOT_CBPTR, 0 },
+  { "RESOLVER_START_FUNCTION", CURLOPT_RESOLVER_START_FUNCTION,
+    CURLOT_FUNCTION, 0 },
+  { "RESUME_FROM", CURLOPT_RESUME_FROM, CURLOT_LONG, 0 },
+  { "RESUME_FROM_LARGE", CURLOPT_RESUME_FROM_LARGE, CURLOT_OFF_T, 0 },
+  { "RTSPHEADER", CURLOPT_HTTPHEADER, CURLOT_SLIST, CURLOT_FLAG_ALIAS },
+  { "RTSP_CLIENT_CSEQ", CURLOPT_RTSP_CLIENT_CSEQ, CURLOT_LONG, 0 },
+  { "RTSP_REQUEST", CURLOPT_RTSP_REQUEST, CURLOT_VALUES, 0 },
+  { "RTSP_SERVER_CSEQ", CURLOPT_RTSP_SERVER_CSEQ, CURLOT_LONG, 0 },
+  { "RTSP_SESSION_ID", CURLOPT_RTSP_SESSION_ID, CURLOT_STRING, 0 },
+  { "RTSP_STREAM_URI", CURLOPT_RTSP_STREAM_URI, CURLOT_STRING, 0 },
+  { "RTSP_TRANSPORT", CURLOPT_RTSP_TRANSPORT, CURLOT_STRING, 0 },
+  { "SASL_AUTHZID", CURLOPT_SASL_AUTHZID, CURLOT_STRING, 0 },
+  { "SASL_IR", CURLOPT_SASL_IR, CURLOT_LONG, 0 },
+  { "SEEKDATA", CURLOPT_SEEKDATA, CURLOT_CBPTR, 0 },
+  { "SEEKFUNCTION", CURLOPT_SEEKFUNCTION, CURLOT_FUNCTION, 0 },
+  { "SERVER_RESPONSE_TIMEOUT", CURLOPT_SERVER_RESPONSE_TIMEOUT,
+    CURLOT_LONG, 0 },
+  { "SERVER_RESPONSE_TIMEOUT_MS", CURLOPT_SERVER_RESPONSE_TIMEOUT_MS,
+    CURLOT_LONG, 0 },
+  { "SERVICE_NAME", CURLOPT_SERVICE_NAME, CURLOT_STRING, 0 },
+  { "SHARE", CURLOPT_SHARE, CURLOT_OBJECT, 0 },
+  { "SOCKOPTDATA", CURLOPT_SOCKOPTDATA, CURLOT_CBPTR, 0 },
+  { "SOCKOPTFUNCTION", CURLOPT_SOCKOPTFUNCTION, CURLOT_FUNCTION, 0 },
+  { "SOCKS5_AUTH", CURLOPT_SOCKS5_AUTH, CURLOT_LONG, 0 },
+  { "SOCKS5_GSSAPI_NEC", CURLOPT_SOCKS5_GSSAPI_NEC, CURLOT_LONG, 0 },
+  { "SOCKS5_GSSAPI_SERVICE", CURLOPT_SOCKS5_GSSAPI_SERVICE,
+    CURLOT_STRING, 0 },
+  { "SSH_AUTH_TYPES", CURLOPT_SSH_AUTH_TYPES, CURLOT_VALUES, 0 },
+  { "SSH_COMPRESSION", CURLOPT_SSH_COMPRESSION, CURLOT_LONG, 0 },
+  { "SSH_HOSTKEYDATA", CURLOPT_SSH_HOSTKEYDATA, CURLOT_CBPTR, 0 },
+  { "SSH_HOSTKEYFUNCTION", CURLOPT_SSH_HOSTKEYFUNCTION, CURLOT_FUNCTION, 0 },
+  { "SSH_HOST_PUBLIC_KEY_MD5", CURLOPT_SSH_HOST_PUBLIC_KEY_MD5,
+    CURLOT_STRING, 0 },
+  { "SSH_HOST_PUBLIC_KEY_SHA256", CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256,
+    CURLOT_STRING, 0 },
+  { "SSH_KEYDATA", CURLOPT_SSH_KEYDATA, CURLOT_CBPTR, 0 },
+  { "SSH_KEYFUNCTION", CURLOPT_SSH_KEYFUNCTION, CURLOT_FUNCTION, 0 },
+  { "SSH_KNOWNHOSTS", CURLOPT_SSH_KNOWNHOSTS, CURLOT_STRING, 0 },
+  { "SSH_PRIVATE_KEYFILE", CURLOPT_SSH_PRIVATE_KEYFILE, CURLOT_STRING, 0 },
+  { "SSH_PUBLIC_KEYFILE", CURLOPT_SSH_PUBLIC_KEYFILE, CURLOT_STRING, 0 },
+  { "SSLCERT", CURLOPT_SSLCERT, CURLOT_STRING, 0 },
+  { "SSLCERTPASSWD", CURLOPT_KEYPASSWD, CURLOT_STRING, CURLOT_FLAG_ALIAS },
+  { "SSLCERTTYPE", CURLOPT_SSLCERTTYPE, CURLOT_STRING, 0 },
+  { "SSLCERT_BLOB", CURLOPT_SSLCERT_BLOB, CURLOT_BLOB, 0 },
+  { "SSLENGINE", CURLOPT_SSLENGINE, CURLOT_STRING, 0 },
+  { "SSLENGINE_DEFAULT", CURLOPT_SSLENGINE_DEFAULT, CURLOT_LONG, 0 },
+  { "SSLKEY", CURLOPT_SSLKEY, CURLOT_STRING, 0 },
+  { "SSLKEYPASSWD", CURLOPT_KEYPASSWD, CURLOT_STRING, CURLOT_FLAG_ALIAS },
+  { "SSLKEYTYPE", CURLOPT_SSLKEYTYPE, CURLOT_STRING, 0 },
+  { "SSLKEY_BLOB", CURLOPT_SSLKEY_BLOB, CURLOT_BLOB, 0 },
+  { "SSLVERSION", CURLOPT_SSLVERSION, CURLOT_VALUES, 0 },
+  { "SSL_CIPHER_LIST", CURLOPT_SSL_CIPHER_LIST, CURLOT_STRING, 0 },
+  { "SSL_CTX_DATA", CURLOPT_SSL_CTX_DATA, CURLOT_CBPTR, 0 },
+  { "SSL_CTX_FUNCTION", CURLOPT_SSL_CTX_FUNCTION, CURLOT_FUNCTION, 0 },
+  { "SSL_EC_CURVES", CURLOPT_SSL_EC_CURVES, CURLOT_STRING, 0 },
+  { "SSL_ENABLE_ALPN", CURLOPT_SSL_ENABLE_ALPN, CURLOT_LONG, 0 },
+  { "SSL_ENABLE_NPN", CURLOPT_SSL_ENABLE_NPN, CURLOT_LONG, 0 },
+  { "SSL_FALSESTART", CURLOPT_SSL_FALSESTART, CURLOT_LONG, 0 },
+  { "SSL_OPTIONS", CURLOPT_SSL_OPTIONS, CURLOT_VALUES, 0 },
+  { "SSL_SESSIONID_CACHE", CURLOPT_SSL_SESSIONID_CACHE, CURLOT_LONG, 0 },
+  { "SSL_SIGNATURE_ALGORITHMS", CURLOPT_SSL_SIGNATURE_ALGORITHMS,
+    CURLOT_STRING, 0 },
+  { "SSL_VERIFYHOST", CURLOPT_SSL_VERIFYHOST, CURLOT_LONG, 0 },
+  { "SSL_VERIFYPEER", CURLOPT_SSL_VERIFYPEER, CURLOT_LONG, 0 },
+  { "SSL_VERIFYSTATUS", CURLOPT_SSL_VERIFYSTATUS, CURLOT_LONG, 0 },
+  { "STDERR", CURLOPT_STDERR, CURLOT_OBJECT, 0 },
+  { "STREAM_DEPENDS", CURLOPT_STREAM_DEPENDS, CURLOT_OBJECT, 0 },
+  { "STREAM_DEPENDS_E", CURLOPT_STREAM_DEPENDS_E, CURLOT_OBJECT, 0 },
+  { "STREAM_WEIGHT", CURLOPT_STREAM_WEIGHT, CURLOT_LONG, 0 },
+  { "SUPPRESS_CONNECT_HEADERS", CURLOPT_SUPPRESS_CONNECT_HEADERS,
+    CURLOT_LONG, 0 },
+  { "TCP_FASTOPEN", CURLOPT_TCP_FASTOPEN, CURLOT_LONG, 0 },
+  { "TCP_KEEPALIVE", CURLOPT_TCP_KEEPALIVE, CURLOT_LONG, 0 },
+  { "TCP_KEEPCNT", CURLOPT_TCP_KEEPCNT, CURLOT_LONG, 0 },
+  { "TCP_KEEPIDLE", CURLOPT_TCP_KEEPIDLE, CURLOT_LONG, 0 },
+  { "TCP_KEEPINTVL", CURLOPT_TCP_KEEPINTVL, CURLOT_LONG, 0 },
+  { "TCP_NODELAY", CURLOPT_TCP_NODELAY, CURLOT_LONG, 0 },
+  { "TELNETOPTIONS", CURLOPT_TELNETOPTIONS, CURLOT_SLIST, 0 },
+  { "TFTP_BLKSIZE", CURLOPT_TFTP_BLKSIZE, CURLOT_LONG, 0 },
+  { "TFTP_NO_OPTIONS", CURLOPT_TFTP_NO_OPTIONS, CURLOT_LONG, 0 },
+  { "TIMECONDITION", CURLOPT_TIMECONDITION, CURLOT_VALUES, 0 },
+  { "TIMEOUT", CURLOPT_TIMEOUT, CURLOT_LONG, 0 },
+  { "TIMEOUT_MS", CURLOPT_TIMEOUT_MS, CURLOT_LONG, 0 },
+  { "TIMEVALUE", CURLOPT_TIMEVALUE, CURLOT_LONG, 0 },
+  { "TIMEVALUE_LARGE", CURLOPT_TIMEVALUE_LARGE, CURLOT_OFF_T, 0 },
+  { "TLS13_CIPHERS", CURLOPT_TLS13_CIPHERS, CURLOT_STRING, 0 },
+  { "TLSAUTH_PASSWORD", CURLOPT_TLSAUTH_PASSWORD, CURLOT_STRING, 0 },
+  { "TLSAUTH_TYPE", CURLOPT_TLSAUTH_TYPE, CURLOT_STRING, 0 },
+  { "TLSAUTH_USERNAME", CURLOPT_TLSAUTH_USERNAME, CURLOT_STRING, 0 },
+  { "TRAILERDATA", CURLOPT_TRAILERDATA, CURLOT_CBPTR, 0 },
+  { "TRAILERFUNCTION", CURLOPT_TRAILERFUNCTION, CURLOT_FUNCTION, 0 },
+  { "TRANSFERTEXT", CURLOPT_TRANSFERTEXT, CURLOT_LONG, 0 },
+  { "TRANSFER_ENCODING", CURLOPT_TRANSFER_ENCODING, CURLOT_LONG, 0 },
+  { "UNIX_SOCKET_PATH", CURLOPT_UNIX_SOCKET_PATH, CURLOT_STRING, 0 },
+  { "UNRESTRICTED_AUTH", CURLOPT_UNRESTRICTED_AUTH, CURLOT_LONG, 0 },
+  { "UPKEEP_INTERVAL_MS", CURLOPT_UPKEEP_INTERVAL_MS, CURLOT_LONG, 0 },
+  { "UPLOAD", CURLOPT_UPLOAD, CURLOT_LONG, 0 },
+  { "UPLOAD_BUFFERSIZE", CURLOPT_UPLOAD_BUFFERSIZE, CURLOT_LONG, 0 },
+  { "UPLOAD_FLAGS", CURLOPT_UPLOAD_FLAGS, CURLOT_LONG, 0 },
+  { "URL", CURLOPT_URL, CURLOT_STRING, 0 },
+  { "USERAGENT", CURLOPT_USERAGENT, CURLOT_STRING, 0 },
+  { "USERNAME", CURLOPT_USERNAME, CURLOT_STRING, 0 },
+  { "USERPWD", CURLOPT_USERPWD, CURLOT_STRING, 0 },
+  { "USE_SSL", CURLOPT_USE_SSL, CURLOT_VALUES, 0 },
+  { "VERBOSE", CURLOPT_VERBOSE, CURLOT_LONG, 0 },
+  { "WILDCARDMATCH", CURLOPT_WILDCARDMATCH, CURLOT_LONG, 0 },
+  { "WRITEDATA", CURLOPT_WRITEDATA, CURLOT_CBPTR, 0 },
+  { "WRITEFUNCTION", CURLOPT_WRITEFUNCTION, CURLOT_FUNCTION, 0 },
+  { "WRITEHEADER", CURLOPT_HEADERDATA, CURLOT_CBPTR, CURLOT_FLAG_ALIAS },
+  { "WS_OPTIONS", CURLOPT_WS_OPTIONS, CURLOT_LONG, 0 },
+  { "XFERINFODATA", CURLOPT_XFERINFODATA, CURLOT_CBPTR, 0 },
+  { "XFERINFOFUNCTION", CURLOPT_XFERINFOFUNCTION, CURLOT_FUNCTION, 0 },
+  { "XOAUTH2_BEARER", CURLOPT_XOAUTH2_BEARER, CURLOT_STRING, 0 },
+  { NULL, CURLOPT_LASTENTRY, CURLOT_LONG, 0 } /* end of table */
 };
 
 #ifdef DEBUGBUILD
@@ -373,6 +385,6 @@ struct curl_easyoption Curl_easyopts[] = {
  */
 int Curl_easyopts_check(void)
 {
-  return ((CURLOPT_LASTENTRY%10000) != (323 + 1));
+  return (CURLOPT_LASTENTRY % 10000) != (328 + 1);
 }
 #endif
diff --git a/third-party/curl/lib/easyoptions.h b/third-party/curl/lib/easyoptions.h
index 24b4cd93ed..d895653ce9 100644
--- a/third-party/curl/lib/easyoptions.h
+++ b/third-party/curl/lib/easyoptions.h
@@ -23,15 +23,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* should probably go into the public header */
 
-#include <curl/curl.h>
-
 /* generated table with all easy options */
-extern struct curl_easyoption Curl_easyopts[];
+extern const struct curl_easyoption Curl_easyopts[];
 
 #ifdef DEBUGBUILD
 int Curl_easyopts_check(void);
 #endif
-#endif
+
+#endif /* HEADER_CURL_EASYOPTIONS_H */
diff --git a/third-party/curl/lib/escape.c b/third-party/curl/lib/escape.c
index 56aa2b3988..4aff583de1 100644
--- a/third-party/curl/lib/escape.c
+++ b/third-party/curl/lib/escape.c
@@ -21,54 +21,21 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* Escape and unescape URL encoding in strings. The functions return a new
- * allocated string or NULL if an error occurred.  */
-
+ * allocated string or NULL if an error occurred. */
 #include "curl_setup.h"
 
-#include <curl/curl.h>
+struct Curl_easy;
 
 #include "urldata.h"
-#include "warnless.h"
 #include "escape.h"
-#include "strdup.h"
-/* The last 3 #include files should be in this order */
+#include "curlx/strparse.h"
 #include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-/* Portable character check (remember EBCDIC). Do not use isalnum() because
-   its behavior is altered by the current locale.
-   See https://datatracker.ietf.org/doc/html/rfc3986#section-2.3
-*/
-bool Curl_isunreserved(unsigned char in)
-{
-  switch(in) {
-    case '0': case '1': case '2': case '3': case '4':
-    case '5': case '6': case '7': case '8': case '9':
-    case 'a': case 'b': case 'c': case 'd': case 'e':
-    case 'f': case 'g': case 'h': case 'i': case 'j':
-    case 'k': case 'l': case 'm': case 'n': case 'o':
-    case 'p': case 'q': case 'r': case 's': case 't':
-    case 'u': case 'v': case 'w': case 'x': case 'y': case 'z':
-    case 'A': case 'B': case 'C': case 'D': case 'E':
-    case 'F': case 'G': case 'H': case 'I': case 'J':
-    case 'K': case 'L': case 'M': case 'N': case 'O':
-    case 'P': case 'Q': case 'R': case 'S': case 'T':
-    case 'U': case 'V': case 'W': case 'X': case 'Y': case 'Z':
-    case '-': case '.': case '_': case '~':
-      return TRUE;
-    default:
-      break;
-  }
-  return FALSE;
-}
 
 /* for ABI-compatibility with previous versions */
-char *curl_escape(const char *string, int inlength)
+char *curl_escape(const char *string, int length)
 {
-  return curl_easy_escape(NULL, string, inlength);
+  return curl_easy_escape(NULL, string, length);
 }
 
 /* for ABI-compatibility with previous versions */
@@ -80,54 +47,45 @@ char *curl_unescape(const char *string, int length)
 /* Escapes for URL the given unescaped string of given length.
  * 'data' is ignored since 7.82.0.
  */
-char *curl_easy_escape(struct Curl_easy *data, const char *string,
-                       int inlength)
+char *curl_easy_escape(CURL *curl, const char *string, int length)
 {
-  size_t length;
+  size_t len;
   struct dynbuf d;
-  (void)data;
+  (void)curl;
 
-  if(inlength < 0)
+  if(!string || (length < 0))
     return NULL;
 
-  Curl_dyn_init(&d, CURL_MAX_INPUT_LENGTH * 3);
+  len = (length ? (size_t)length : strlen(string));
+  if(!len)
+    return curlx_strdup("");
 
-  length = (inlength?(size_t)inlength:strlen(string));
-  if(!length)
-    return strdup("");
+  if(len > SIZE_MAX / 16)
+    return NULL;
 
-  while(length--) {
-    unsigned char in = *string++; /* treat the characters unsigned */
+  curlx_dyn_init(&d, (len * 3) + 1);
 
-    if(Curl_isunreserved(in)) {
+  while(len--) {
+    /* treat the characters unsigned */
+    unsigned char in = (unsigned char)*string++;
+
+    if(ISUNRESERVED(in)) {
       /* append this */
-      if(Curl_dyn_addn(&d, &in, 1))
+      if(curlx_dyn_addn(&d, &in, 1))
         return NULL;
     }
     else {
       /* encode it */
-      const char hex[] = "0123456789ABCDEF";
-      char out[3]={'%'};
-      out[1] = hex[in>>4];
-      out[2] = hex[in & 0xf];
-      if(Curl_dyn_addn(&d, out, 3))
+      unsigned char out[3] = { '%' };
+      Curl_hexbyte(&out[1], in);
+      if(curlx_dyn_addn(&d, out, 3))
         return NULL;
     }
   }
 
-  return Curl_dyn_ptr(&d);
+  return curlx_dyn_ptr(&d);
 }
 
-static const unsigned char hextable[] = {
-  0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 0, 0, 0, 0, 0,       /* 0x30 - 0x3f */
-  0, 10, 11, 12, 13, 14, 15, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x40 - 0x4f */
-  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,       /* 0x50 - 0x5f */
-  0, 10, 11, 12, 13, 14, 15                             /* 0x60 - 0x66 */
-};
-
-/* the input is a single hex digit */
-#define onehex2dec(x) hextable[x - '0']
-
 /*
  * Curl_urldecode() URL decodes the given string.
  *
@@ -154,8 +112,8 @@ CURLcode Curl_urldecode(const char *string, size_t length,
   DEBUGASSERT(string);
   DEBUGASSERT(ctrl >= REJECT_NADA); /* crash on TRUE/FALSE */
 
-  alloc = (length?length:strlen(string));
-  ns = malloc(alloc + 1);
+  alloc = (length ? length : strlen(string));
+  ns = curlx_malloc(alloc + 1);
 
   if(!ns)
     return CURLE_OUT_OF_MEMORY;
@@ -164,12 +122,12 @@ CURLcode Curl_urldecode(const char *string, size_t length,
   *ostring = ns;
 
   while(alloc) {
-    unsigned char in = *string;
+    unsigned char in = (unsigned char)*string;
     if(('%' == in) && (alloc > 2) &&
        ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
       /* this is two hexadecimal digits following a '%' */
-      in = (unsigned char)(onehex2dec(string[1]) << 4) | onehex2dec(string[2]);
-
+      in = (unsigned char)((curlx_hexval(string[1]) << 4) |
+                           curlx_hexval(string[2]));
       string += 3;
       alloc -= 3;
     }
@@ -180,11 +138,11 @@ CURLcode Curl_urldecode(const char *string, size_t length,
 
     if(((ctrl == REJECT_CTRL) && (in < 0x20)) ||
        ((ctrl == REJECT_ZERO) && (in == 0))) {
-      Curl_safefree(*ostring);
+      curlx_safefree(*ostring);
       return CURLE_URL_MALFORMAT;
     }
 
-    *ns++ = in;
+    *ns++ = (char)in;
   }
   *ns = 0; /* terminate it */
 
@@ -202,25 +160,25 @@ CURLcode Curl_urldecode(const char *string, size_t length,
  * If olen == NULL, no output length is stored.
  * 'data' is ignored since 7.82.0.
  */
-char *curl_easy_unescape(struct Curl_easy *data, const char *string,
-                         int length, int *olen)
+char *curl_easy_unescape(CURL *curl, const char *string, int inlength,
+                         int *outlength)
 {
   char *str = NULL;
-  (void)data;
-  if(length >= 0) {
-    size_t inputlen = (size_t)length;
+  (void)curl;
+  if(string && (inlength >= 0)) {
+    size_t inputlen = (size_t)inlength;
     size_t outputlen;
     CURLcode res = Curl_urldecode(string, inputlen, &str, &outputlen,
                                   REJECT_NADA);
     if(res)
       return NULL;
 
-    if(olen) {
-      if(outputlen <= (size_t) INT_MAX)
-        *olen = curlx_uztosi(outputlen);
+    if(outlength) {
+      if(outputlen <= (size_t)INT_MAX)
+        *outlength = curlx_uztosi(outputlen);
       else
         /* too large to return in an int, fail! */
-        Curl_safefree(str);
+        curlx_safefree(str);
     }
   }
   return str;
@@ -231,5 +189,40 @@ char *curl_easy_unescape(struct Curl_easy *data, const char *string,
    the library's memory system */
 void curl_free(void *p)
 {
-  free(p);
+  curlx_free(p);
+}
+
+/*
+ * Curl_hexencode()
+ *
+ * Converts binary input to lowercase hex-encoded ASCII output.
+ * Null-terminated.
+ */
+void Curl_hexencode(const unsigned char *src, size_t len, /* input length */
+                    unsigned char *out, size_t olen) /* output buffer size */
+{
+  DEBUGASSERT(src && len && (olen >= 3));
+  if(src && len && (olen >= 3)) {
+    while(len-- && (olen >= 3)) {
+      out[0] = Curl_ldigits[*src >> 4];
+      out[1] = Curl_ldigits[*src & 0x0F];
+      ++src;
+      out += 2;
+      olen -= 2;
+    }
+    *out = 0;
+  }
+  else if(olen)
+    *out = 0;
+}
+
+/* Curl_hexbyte
+ *
+ * Output a single unsigned char as a two-digit UPPERCASE hex number.
+ */
+void Curl_hexbyte(unsigned char *dest, /* must fit two bytes */
+                  unsigned char val)
+{
+  dest[0] = Curl_udigits[val >> 4];
+  dest[1] = Curl_udigits[val & 0x0F];
 }
diff --git a/third-party/curl/lib/escape.h b/third-party/curl/lib/escape.h
index cdbb712acc..9f9a89e402 100644
--- a/third-party/curl/lib/escape.h
+++ b/third-party/curl/lib/escape.h
@@ -24,9 +24,7 @@
  *
  ***************************************************************************/
 /* Escape and unescape URL encoding in strings. The functions return a new
- * allocated string or NULL if an error occurred.  */
-
-bool Curl_isunreserved(unsigned char in);
+ * allocated string or NULL if an error occurred. */
 
 enum urlreject {
   REJECT_NADA = 2,
@@ -38,4 +36,10 @@ CURLcode Curl_urldecode(const char *string, size_t length,
                         char **ostring, size_t *olen,
                         enum urlreject ctrl);
 
+void Curl_hexencode(const unsigned char *src, size_t len, /* input length */
+                    unsigned char *out, size_t olen); /* output buffer size */
+
+void Curl_hexbyte(unsigned char *dest, /* must fit two bytes */
+                  unsigned char val);
+
 #endif /* HEADER_CURL_ESCAPE_H */
diff --git a/third-party/curl/lib/fake_addrinfo.c b/third-party/curl/lib/fake_addrinfo.c
new file mode 100644
index 0000000000..6b04b5d2f5
--- /dev/null
+++ b/third-party/curl/lib/fake_addrinfo.c
@@ -0,0 +1,202 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "fake_addrinfo.h"
+
+#ifdef USE_FAKE_GETADDRINFO
+
+#include <ares.h>
+
+void r_freeaddrinfo(struct addrinfo *cahead)
+{
+  struct addrinfo *canext;
+  struct addrinfo *ca;
+
+  for(ca = cahead; ca; ca = canext) {
+    canext = ca->ai_next;
+    curlx_free(ca);
+  }
+}
+
+struct context {
+  struct ares_addrinfo *addr;
+};
+
+static void async_addrinfo_cb(void *userp, int status, int timeouts,
+                              struct ares_addrinfo *addr)
+{
+  struct context *ctx = (struct context *)userp;
+  (void)timeouts;
+  if(ARES_SUCCESS == status) {
+    ctx->addr = addr;
+  }
+}
+
+/* convert the c-ares version into the "native" version */
+static struct addrinfo *mk_getaddrinfo(const struct ares_addrinfo *aihead)
+{
+  const struct ares_addrinfo_node *ai;
+  struct addrinfo *ca;
+  struct addrinfo *cafirst = NULL;
+  struct addrinfo *calast = NULL;
+  const char *name = aihead->name;
+
+  /* traverse the addrinfo list */
+  for(ai = aihead->nodes; ai; ai = ai->ai_next) {
+    size_t ss_size;
+    size_t namelen = name ? strlen(name) + 1 : 0;
+    /* ignore elements with unsupported address family,
+       settle family-specific sockaddr structure size. */
+    if(ai->ai_family == AF_INET)
+      ss_size = sizeof(struct sockaddr_in);
+    else if(ai->ai_family == AF_INET6)
+      ss_size = sizeof(struct sockaddr_in6);
+    else
+      continue;
+
+    /* ignore elements without required address info */
+    if(!ai->ai_addr || !(ai->ai_addrlen > 0))
+      continue;
+
+    /* ignore elements with bogus address size */
+    if((size_t)ai->ai_addrlen < ss_size)
+      continue;
+
+    ca = curlx_malloc(sizeof(struct addrinfo) + ss_size + namelen);
+    if(!ca) {
+      r_freeaddrinfo(cafirst);
+      return NULL;
+    }
+
+    /* copy each structure member individually, member ordering,
+       size, or padding might be different for each platform. */
+
+    ca->ai_flags     = ai->ai_flags;
+    ca->ai_family    = ai->ai_family;
+    ca->ai_socktype  = ai->ai_socktype;
+    ca->ai_protocol  = ai->ai_protocol;
+    ca->ai_addrlen   = (curl_socklen_t)ss_size;
+    ca->ai_addr      = NULL;
+    ca->ai_canonname = NULL;
+    ca->ai_next      = NULL;
+
+    ca->ai_addr = (void *)((char *)ca + sizeof(struct addrinfo));
+    memcpy(ca->ai_addr, ai->ai_addr, ss_size);
+
+    if(namelen) {
+      ca->ai_canonname = (void *)((char *)ca->ai_addr + ss_size);
+      memcpy(ca->ai_canonname, name, namelen);
+
+      /* the name is only pointed to by the first entry in the "real"
+         addrinfo chain, so stop now */
+      name = NULL;
+    }
+
+    /* if the return list is empty, this becomes the first element */
+    if(!cafirst)
+      cafirst = ca;
+
+    /* add this element last in the return list */
+    if(calast)
+      calast->ai_next = ca;
+    calast = ca;
+  }
+
+  return cafirst;
+}
+
+/*
+  RETURN VALUE
+
+  getaddrinfo() returns 0 if it succeeds, or one of the following nonzero
+  error codes:
+
+  ...
+*/
+int r_getaddrinfo(const char *node,
+                  const char *service,
+                  const struct addrinfo *hints,
+                  struct addrinfo **res)
+{
+  int status;
+  struct context ctx;
+  struct ares_options options;
+  int optmask = 0;
+  struct ares_addrinfo_hints ahints;
+  ares_channel channel;
+  int rc = 0;
+
+  memset(&options, 0, sizeof(options));
+  optmask      |= ARES_OPT_EVENT_THREAD;
+  options.evsys = ARES_EVSYS_DEFAULT;
+
+  memset(&ahints, 0, sizeof(ahints));
+  memset(&ctx, 0, sizeof(ctx));
+
+  if(hints) {
+    ahints.ai_flags = hints->ai_flags;
+    ahints.ai_family = hints->ai_family;
+    ahints.ai_socktype = hints->ai_socktype;
+    ahints.ai_protocol = hints->ai_protocol;
+  }
+
+  status = ares_init_options(&channel, &options, optmask);
+  if(status)
+    return EAI_MEMORY; /* major problem */
+
+  else {
+    const char *env = getenv("CURL_DNS_SERVER");
+    if(env) {
+      rc = ares_set_servers_ports_csv(channel, env);
+      if(rc) {
+        curl_mfprintf(stderr, "ares_set_servers_ports_csv failed: %d", rc);
+        /* Cleanup */
+        ares_destroy(channel);
+        return EAI_MEMORY; /* we cannot run */
+      }
+    }
+  }
+
+  ares_getaddrinfo(channel, node, service, &ahints, async_addrinfo_cb, &ctx);
+
+  /* Wait until no more requests are left to be processed */
+  ares_queue_wait_empty(channel, -1);
+
+  if(ctx.addr) {
+    /* convert the c-ares version */
+    *res = mk_getaddrinfo(ctx.addr);
+    /* free the old */
+    ares_freeaddrinfo(ctx.addr);
+  }
+  else
+    rc = EAI_NONAME; /* got nothing */
+
+  /* Cleanup */
+  ares_destroy(channel);
+
+  return rc;
+}
+
+#endif /* USE_FAKE_GETADDRINFO */
diff --git a/third-party/curl/lib/fake_addrinfo.h b/third-party/curl/lib/fake_addrinfo.h
new file mode 100644
index 0000000000..07d5b6da8c
--- /dev/null
+++ b/third-party/curl/lib/fake_addrinfo.h
@@ -0,0 +1,53 @@
+#ifndef HEADER_FAKE_ADDRINFO_H
+#define HEADER_FAKE_ADDRINFO_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef USE_ARES
+#include <ares.h>
+#endif
+
+#if defined(CURL_MEMDEBUG) && defined(HAVE_GETADDRINFO) && \
+  defined(USE_ARES) && (ARES_VERSION >= 0x011a00) /* >= 1.26.0 */
+#define USE_FAKE_GETADDRINFO 1
+#endif
+
+#ifdef USE_FAKE_GETADDRINFO
+
+#ifdef HAVE_NETDB_H
+#  include <netdb.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
+#  include <arpa/inet.h>
+#endif
+
+void r_freeaddrinfo(struct addrinfo *res);
+int r_getaddrinfo(const char *node,
+                  const char *service,
+                  const struct addrinfo *hints,
+                  struct addrinfo **res);
+#endif /* USE_FAKE_GETADDRINFO */
+
+#endif /* HEADER_FAKE_ADDRINFO_H */
diff --git a/third-party/curl/lib/file.c b/third-party/curl/lib/file.c
index c751e8861a..fff8feeb92 100644
--- a/third-party/curl/lib/file.c
+++ b/third-party/curl/lib/file.c
@@ -21,8 +21,9 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+#include "urldata.h"
+#include "file.h"
 
 #ifndef CURL_DISABLE_FILE
 
@@ -46,104 +47,98 @@
 #include <sys/param.h>
 #endif
 
-#ifdef HAVE_FCNTL_H
-#include <fcntl.h>
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+
+#ifdef HAVE_DIRENT_H
+#include <dirent.h>
 #endif
 
-#include "strtoofft.h"
-#include "urldata.h"
-#include <curl/curl.h>
 #include "progress.h"
 #include "sendf.h"
+#include "curl_trc.h"
 #include "escape.h"
-#include "file.h"
-#include "speedcheck.h"
-#include "getinfo.h"
+#include "multiif.h"
 #include "transfer.h"
 #include "url.h"
 #include "parsedate.h" /* for the week day and month names */
-#include "warnless.h"
+#include "curlx/fopen.h"
 #include "curl_range.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
 
-#if defined(WIN32) || defined(MSDOS) || defined(__EMX__)
+#if defined(_WIN32) || defined(MSDOS)
 #define DOS_FILESYSTEM 1
 #elif defined(__amigaos4__)
 #define AMIGA_FILESYSTEM 1
 #endif
 
-#ifdef OPEN_NEEDS_ARG3
-#  define open_readonly(p,f) open((p),(f),(0))
-#else
-#  define open_readonly(p,f) open((p),(f))
-#endif
+/* meta key for storing protocol meta at easy handle */
+#define CURL_META_FILE_EASY   "meta:proto:file:easy"
 
-/*
- * Forward declarations.
- */
-
-static CURLcode file_do(struct Curl_easy *data, bool *done);
-static CURLcode file_done(struct Curl_easy *data,
-                          CURLcode status, bool premature);
-static CURLcode file_connect(struct Curl_easy *data, bool *done);
-static CURLcode file_disconnect(struct Curl_easy *data,
-                                struct connectdata *conn,
-                                bool dead_connection);
-static CURLcode file_setup_connection(struct Curl_easy *data,
-                                      struct connectdata *conn);
-
-/*
- * FILE scheme handler.
- */
-
-const struct Curl_handler Curl_handler_file = {
-  "FILE",                               /* scheme */
-  file_setup_connection,                /* setup_connection */
-  file_do,                              /* do_it */
-  file_done,                            /* done */
-  ZERO_NULL,                            /* do_more */
-  file_connect,                         /* connect_it */
-  ZERO_NULL,                            /* connecting */
-  ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  file_disconnect,                      /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  0,                                    /* defport */
-  CURLPROTO_FILE,                       /* protocol */
-  CURLPROTO_FILE,                       /* family */
-  PROTOPT_NONETWORK | PROTOPT_NOURLQUERY /* flags */
+struct FILEPROTO {
+  char *path; /* the path we operate on */
+  char *freepath; /* pointer to the allocated block we must free, this might
+                     differ from the 'path' pointer */
+  int fd;     /* open file descriptor to read from! */
 };
 
+static void file_cleanup(struct FILEPROTO *file)
+{
+  curlx_safefree(file->freepath);
+  file->path = NULL;
+  if(file->fd != -1) {
+    curlx_close(file->fd);
+    file->fd = -1;
+  }
+}
+
+static void file_easy_dtor(void *key, size_t klen, void *entry)
+{
+  struct FILEPROTO *file = entry;
+  (void)key;
+  (void)klen;
+  file_cleanup(file);
+  curlx_free(file);
+}
 
 static CURLcode file_setup_connection(struct Curl_easy *data,
                                       struct connectdata *conn)
 {
+  struct FILEPROTO *filep;
   (void)conn;
   /* allocate the FILE specific struct */
-  data->req.p.file = calloc(1, sizeof(struct FILEPROTO));
-  if(!data->req.p.file)
+  filep = curlx_calloc(1, sizeof(*filep));
+  if(filep)
+    filep->fd = -1;
+  if(!filep ||
+     Curl_meta_set(data, CURL_META_FILE_EASY, filep, file_easy_dtor))
     return CURLE_OUT_OF_MEMORY;
 
   return CURLE_OK;
 }
 
+static CURLcode file_done(struct Curl_easy *data,
+                          CURLcode status, bool premature)
+{
+  struct FILEPROTO *file = Curl_meta_get(data, CURL_META_FILE_EASY);
+  (void)status;
+  (void)premature;
+
+  if(file)
+    file_cleanup(file);
+
+  return CURLE_OK;
+}
+
 /*
  * file_connect() gets called from Curl_protocol_connect() to allow us to
- * do protocol-specific actions at connect-time.  We emulate a
+ * do protocol-specific actions at connect-time. We emulate a
  * connect-then-transfer protocol and "connect" to the file here
  */
 static CURLcode file_connect(struct Curl_easy *data, bool *done)
 {
   char *real_path;
-  struct FILEPROTO *file = data->req.p.file;
+  struct FILEPROTO *file = Curl_meta_get(data, CURL_META_FILE_EASY);
   int fd;
 #ifdef DOS_FILESYSTEM
   size_t i;
@@ -152,6 +147,9 @@ static CURLcode file_connect(struct Curl_easy *data, bool *done)
   size_t real_path_len;
   CURLcode result;
 
+  if(!file)
+    return CURLE_FAILED_INIT;
+
   if(file->path) {
     /* already connected.
      * the handler->connect_it() is normally only called once, but
@@ -167,18 +165,18 @@ static CURLcode file_connect(struct Curl_easy *data, bool *done)
     return result;
 
 #ifdef DOS_FILESYSTEM
-  /* If the first character is a slash, and there's
+  /* If the first character is a slash, and there is
      something that looks like a drive at the beginning of
-     the path, skip the slash.  If we remove the initial
+     the path, skip the slash. If we remove the initial
      slash in all cases, paths without drive letters end up
-     relative to the current directory which isn't how
+     relative to the current directory which is not how
      browsers work.
 
      Some browsers accept | instead of : as the drive letter
      separator, so we do too.
 
      On other platforms, we need the slash to indicate an
-     absolute pathname.  On Windows, absolute paths start
+     absolute pathname. On Windows, absolute paths start
      with a drive letter.
   */
   actual_path = real_path;
@@ -195,25 +193,25 @@ static CURLcode file_connect(struct Curl_easy *data, bool *done)
     if(actual_path[i] == '/')
       actual_path[i] = '\\';
     else if(!actual_path[i]) { /* binary zero */
-      Curl_safefree(real_path);
+      curlx_safefree(real_path);
       return CURLE_URL_MALFORMAT;
     }
 
-  fd = open_readonly(actual_path, O_RDONLY|O_BINARY);
+  fd = curlx_open(actual_path, O_RDONLY | CURL_O_BINARY);
   file->path = actual_path;
 #else
   if(memchr(real_path, 0, real_path_len)) {
     /* binary zeroes indicate foul play */
-    Curl_safefree(real_path);
+    curlx_safefree(real_path);
     return CURLE_URL_MALFORMAT;
   }
 
-  #ifdef AMIGA_FILESYSTEM
+#ifdef AMIGA_FILESYSTEM
   /*
    * A leading slash in an AmigaDOS path denotes the parent
    * directory, and hence we block this as it is relative.
    * Absolute paths start with 'volumename:', so we check for
-   * this first. Failing that, we treat the path as a real unix
+   * this first. Failing that, we treat the path as a real Unix
    * path, but only if the application was compiled with -lunix.
    */
   fd = -1;
@@ -223,25 +221,25 @@ static CURLcode file_connect(struct Curl_easy *data, bool *done)
     extern int __unix_path_semantics;
     if(strchr(real_path + 1, ':')) {
       /* Amiga absolute path */
-      fd = open_readonly(real_path + 1, O_RDONLY);
+      fd = curlx_open(real_path + 1, O_RDONLY);
       file->path++;
     }
     else if(__unix_path_semantics) {
       /* -lunix fallback */
-      fd = open_readonly(real_path, O_RDONLY);
+      fd = curlx_open(real_path, O_RDONLY);
     }
   }
-  #else
-  fd = open_readonly(real_path, O_RDONLY);
+#else
+  fd = curlx_open(real_path, O_RDONLY);
   file->path = real_path;
-  #endif
 #endif
-  Curl_safefree(file->freepath);
+#endif
+  curlx_free(file->freepath);
   file->freepath = real_path; /* free this when done */
 
   file->fd = fd;
   if(!data->state.upload && (fd == -1)) {
-    failf(data, "Couldn't open file %s", data->state.up.path);
+    failf(data, "Could not open file %s", data->state.up.path);
     file_done(data, CURLE_FILE_COULDNT_READ_FILE, FALSE);
     return CURLE_FILE_COULDNT_READ_FILE;
   }
@@ -250,29 +248,11 @@ static CURLcode file_connect(struct Curl_easy *data, bool *done)
   return CURLE_OK;
 }
 
-static CURLcode file_done(struct Curl_easy *data,
-                          CURLcode status, bool premature)
-{
-  struct FILEPROTO *file = data->req.p.file;
-  (void)status; /* not used */
-  (void)premature; /* not used */
-
-  if(file) {
-    Curl_safefree(file->freepath);
-    file->path = NULL;
-    if(file->fd != -1)
-      close(file->fd);
-    file->fd = -1;
-  }
-
-  return CURLE_OK;
-}
-
 static CURLcode file_disconnect(struct Curl_easy *data,
                                 struct connectdata *conn,
                                 bool dead_connection)
 {
-  (void)dead_connection; /* not used */
+  (void)dead_connection;
   (void)conn;
   return file_done(data, CURLE_OK, FALSE);
 }
@@ -283,23 +263,23 @@ static CURLcode file_disconnect(struct Curl_easy *data,
 #define DIRSEP '/'
 #endif
 
-static CURLcode file_upload(struct Curl_easy *data)
+static CURLcode file_upload(struct Curl_easy *data,
+                            struct FILEPROTO *file)
 {
-  struct FILEPROTO *file = data->req.p.file;
   const char *dir = strchr(file->path, DIRSEP);
   int fd;
   int mode;
   CURLcode result = CURLE_OK;
-  char *buf = data->state.buffer;
-  curl_off_t bytecount = 0;
-  struct_stat file_stat;
-  const char *buf2;
+  char *xfer_ulbuf;
+  size_t xfer_ulblen;
+  curlx_struct_stat file_stat;
+  const char *sendbuf;
+  bool eos = FALSE;
 
   /*
-   * Since FILE: doesn't do the full init, we need to provide some extra
+   * Since FILE: does not do the full init, we need to provide some extra
    * assignments here.
    */
-  data->req.upload_fromhere = buf;
 
   if(!dir)
     return CURLE_FILE_COULDNT_READ_FILE; /* fix: better error code */
@@ -307,42 +287,50 @@ static CURLcode file_upload(struct Curl_easy *data)
   if(!dir[1])
     return CURLE_FILE_COULDNT_READ_FILE; /* fix: better error code */
 
-#ifdef O_BINARY
-#define MODE_DEFAULT O_WRONLY|O_CREAT|O_BINARY
-#else
-#define MODE_DEFAULT O_WRONLY|O_CREAT
-#endif
-
+  mode = O_WRONLY | O_CREAT | CURL_O_BINARY;
   if(data->state.resume_from)
-    mode = MODE_DEFAULT|O_APPEND;
+    mode |= O_APPEND;
   else
-    mode = MODE_DEFAULT|O_TRUNC;
+    mode |= O_TRUNC;
 
-  fd = open(file->path, mode, data->set.new_file_perms);
+#ifdef _WIN32
+  fd = curlx_open(file->path, mode,
+                  data->set.new_file_perms & (_S_IREAD | _S_IWRITE));
+#elif (defined(ANDROID) || defined(__ANDROID__)) && \
+  (defined(__i386__) || defined(__arm__))
+  fd = curlx_open(file->path, mode, (mode_t)data->set.new_file_perms);
+#else
+  fd = curlx_open(file->path, mode, data->set.new_file_perms);
+#endif
   if(fd < 0) {
-    failf(data, "Can't open %s for writing", file->path);
+    failf(data, "cannot open %s for writing", file->path);
     return CURLE_WRITE_ERROR;
   }
 
-  if(-1 != data->state.infilesize)
+  if(data->state.infilesize != -1)
     /* known size of data to "upload" */
     Curl_pgrsSetUploadSize(data, data->state.infilesize);
 
   /* treat the negative resume offset value as the case of "-" */
   if(data->state.resume_from < 0) {
-    if(fstat(fd, &file_stat)) {
-      close(fd);
-      failf(data, "Can't get the size of %s", file->path);
+    if(curlx_fstat(fd, &file_stat)) {
+      curlx_close(fd);
+      failf(data, "cannot get the size of %s", file->path);
       return CURLE_WRITE_ERROR;
     }
     data->state.resume_from = (curl_off_t)file_stat.st_size;
   }
 
-  while(!result) {
-    size_t nread;
-    ssize_t nwrite;
+  result = Curl_multi_xfer_ulbuf_borrow(data, &xfer_ulbuf, &xfer_ulblen);
+  if(result)
+    goto out;
+
+  while(!result && !eos) {
+    size_t nread, nwritten;
+    ssize_t rv;
     size_t readcount;
-    result = Curl_fillreadbuffer(data, data->set.buffer_size, &readcount);
+
+    result = Curl_client_read(data, xfer_ulbuf, xfer_ulblen, &readcount, &eos);
     if(result)
       break;
 
@@ -356,37 +344,33 @@ static CURLcode file_upload(struct Curl_easy *data)
       if((curl_off_t)nread <= data->state.resume_from) {
         data->state.resume_from -= nread;
         nread = 0;
-        buf2 = buf;
+        sendbuf = xfer_ulbuf;
       }
       else {
-        buf2 = buf + data->state.resume_from;
+        sendbuf = xfer_ulbuf + data->state.resume_from;
         nread -= (size_t)data->state.resume_from;
         data->state.resume_from = 0;
       }
     }
     else
-      buf2 = buf;
+      sendbuf = xfer_ulbuf;
 
     /* write the data to the target */
-    nwrite = write(fd, buf2, nread);
-    if((size_t)nwrite != nread) {
+    rv = write(fd, sendbuf, nread);
+    if(!curlx_sztouz(rv, &nwritten) || (nwritten != nread)) {
       result = CURLE_SEND_ERROR;
       break;
     }
+    Curl_pgrs_upload_inc(data, nwritten);
 
-    bytecount += nread;
-
-    Curl_pgrsSetUploadCounter(data, bytecount);
-
-    if(Curl_pgrsUpdate(data))
-      result = CURLE_ABORTED_BY_CALLBACK;
-    else
-      result = Curl_speedcheck(data, Curl_now());
+    result = Curl_pgrsCheck(data);
   }
-  if(!result && Curl_pgrsUpdate(data))
-    result = CURLE_ABORTED_BY_CALLBACK;
+  if(!result)
+    result = Curl_pgrsUpdate(data);
 
-  close(fd);
+out:
+  curlx_close(fd);
+  Curl_multi_xfer_ulbuf_release(data, xfer_ulbuf);
 
   return result;
 }
@@ -395,43 +379,39 @@ static CURLcode file_upload(struct Curl_easy *data)
  * file_do() is the protocol-specific function for the do-phase, separated
  * from the connect-phase above. Other protocols merely setup the transfer in
  * the do-phase, to have it done in the main transfer loop but since some
- * platforms we support don't allow select()ing etc on file handles (as
+ * platforms we support do not allow select()ing etc on file handles (as
  * opposed to sockets) we instead perform the whole do-operation in this
  * function.
  */
 static CURLcode file_do(struct Curl_easy *data, bool *done)
 {
-  /* This implementation ignores the host name in conformance with
+  /* This implementation ignores the hostname in conformance with
      RFC 1738. Only local files (reachable via the standard file system)
      are supported. This means that files on remotely mounted directories
      (via NFS, Samba, NT sharing) can be accessed through a file:// URL
   */
+  struct FILEPROTO *file = Curl_meta_get(data, CURL_META_FILE_EASY);
   CURLcode result = CURLE_OK;
-  struct_stat statbuf; /* struct_stat instead of struct stat just to allow the
-                          Windows version to have a different struct without
-                          having to redefine the simple word 'stat' */
+  curlx_struct_stat statbuf;
   curl_off_t expected_size = -1;
   bool size_known;
   bool fstated = FALSE;
-  char *buf = data->state.buffer;
-  curl_off_t bytecount = 0;
   int fd;
-  struct FILEPROTO *file;
+  char *xfer_buf;
+  size_t xfer_blen;
 
   *done = TRUE; /* unconditionally */
-
-  Curl_pgrsStartNow(data);
+  if(!file)
+    return CURLE_FAILED_INIT;
 
   if(data->state.upload)
-    return file_upload(data);
-
-  file = data->req.p.file;
+    return file_upload(data, file);
 
   /* get the fd from the connection phase */
   fd = file->fd;
 
   /* VMS: This only works reliable for STREAMLF files */
-  if(-1 != fstat(fd, &statbuf)) {
+  if(curlx_fstat(fd, &statbuf) != -1) {
     if(!S_ISDIR(statbuf.st_mode))
       expected_size = statbuf.st_size;
     /* and store the modification time */
@@ -439,12 +419,9 @@ static CURLcode file_do(struct Curl_easy *data, bool *done)
     fstated = TRUE;
   }
 
-  if(fstated && !data->state.range && data->set.timecondition) {
-    if(!Curl_meets_timecondition(data, data->info.filetime)) {
-      *done = TRUE;
-      return CURLE_OK;
-    }
-  }
+  if(fstated && !data->state.range && data->set.timecondition &&
+     !Curl_meets_timecondition(data, data->info.filetime))
+    return CURLE_OK;
 
   if(fstated) {
     time_t filetime;
@@ -452,44 +429,47 @@ static CURLcode file_do(struct Curl_easy *data, bool *done)
     const struct tm *tm = &buffer;
     char header[80];
     int headerlen;
-    char accept_ranges[24]= { "Accept-ranges: bytes\r\n" };
+    static const char accept_ranges[] = { "Accept-ranges: bytes\r\n" };
     if(expected_size >= 0) {
-      headerlen = msnprintf(header, sizeof(header),
-                "Content-Length: %" CURL_FORMAT_CURL_OFF_T "\r\n",
-                expected_size);
+      headerlen =
+        curl_msnprintf(header, sizeof(header),
+                       "Content-Length: %" FMT_OFF_T "\r\n", expected_size);
       result = Curl_client_write(data, CLIENTWRITE_HEADER, header, headerlen);
       if(result)
         return result;
 
       result = Curl_client_write(data, CLIENTWRITE_HEADER,
-                                 accept_ranges, strlen(accept_ranges));
+                                 accept_ranges, sizeof(accept_ranges) - 1);
       if(result != CURLE_OK)
         return result;
     }
 
     filetime = (time_t)statbuf.st_mtime;
-    result = Curl_gmtime(filetime, &buffer);
+    result = curlx_gmtime(filetime, &buffer);
     if(result)
       return result;
 
     /* format: "Tue, 15 Nov 1994 12:45:26 GMT" */
-    headerlen = msnprintf(header, sizeof(header),
-              "Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT\r\n%s",
-              Curl_wkday[tm->tm_wday?tm->tm_wday-1:6],
-              tm->tm_mday,
-              Curl_month[tm->tm_mon],
-              tm->tm_year + 1900,
-              tm->tm_hour,
-              tm->tm_min,
-              tm->tm_sec,
-              data->req.no_body ? "": "\r\n");
+    headerlen =
+      curl_msnprintf(header, sizeof(header),
+                     "Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT\r\n",
+                     Curl_wkday[tm->tm_wday ? tm->tm_wday - 1 : 6],
+                     tm->tm_mday,
+                     Curl_month[tm->tm_mon],
+                     tm->tm_year + 1900,
+                     tm->tm_hour,
+                     tm->tm_min,
+                     tm->tm_sec);
     result = Curl_client_write(data, CLIENTWRITE_HEADER, header, headerlen);
+    if(!result)
+      /* end of headers */
+      result = Curl_client_write(data, CLIENTWRITE_HEADER, "\r\n", 2);
     if(result)
       return result;
     /* set the file size to make it available post transfer */
     Curl_pgrsSetDownloadSize(data, expected_size);
     if(data->req.no_body)
-      return result;
+      return CURLE_OK;
   }
 
   /* Check whether file range has been specified */
@@ -501,7 +481,7 @@ static CURLcode file_do(struct Curl_easy *data, bool *done)
    * of the stream if the filesize could be determined */
   if(data->state.resume_from < 0) {
     if(!fstated) {
-      failf(data, "Can't get the size of file.");
+      failf(data, "cannot get the size of file.");
       return CURLE_READ_ERROR;
     }
     data->state.resume_from += (curl_off_t)statbuf.st_size;
@@ -509,7 +489,7 @@ static CURLcode file_do(struct Curl_easy *data, bool *done)
 
   if(data->state.resume_from > 0) {
     /* We check explicitly if we have a start offset, because
-     * expected_size may be -1 if we don't know how large the file is,
+     * expected_size may be -1 if we do not know how large the file is,
      * in which case we should not adjust it. */
     if(data->state.resume_from <= expected_size)
       expected_size -= data->state.resume_from;
@@ -536,52 +516,108 @@ static CURLcode file_do(struct Curl_easy *data, bool *done)
     Curl_pgrsSetDownloadSize(data, expected_size);
 
   if(data->state.resume_from) {
-    if(data->state.resume_from !=
-       lseek(fd, data->state.resume_from, SEEK_SET))
-      return CURLE_BAD_DOWNLOAD_RESUME;
-  }
-
-  Curl_pgrsTime(data, TIMER_STARTTRANSFER);
-
-  while(!result) {
-    ssize_t nread;
-    /* Don't fill a whole buffer if we want less than all data */
-    size_t bytestoread;
-
-    if(size_known) {
-      bytestoread = (expected_size < data->set.buffer_size) ?
-        curlx_sotouz(expected_size) : (size_t)data->set.buffer_size;
+    if(!S_ISDIR(statbuf.st_mode)) {
+      if(data->state.resume_from !=
+         curl_lseek(fd, data->state.resume_from, SEEK_SET))
+        return CURLE_BAD_DOWNLOAD_RESUME;
+    }
+    else {
+      return CURLE_BAD_DOWNLOAD_RESUME;
     }
-    else
-      bytestoread = data->set.buffer_size-1;
-
-    nread = read(fd, buf, bytestoread);
-
-    if(nread > 0)
-      buf[nread] = 0;
-
-    if(nread <= 0 || (size_known && (expected_size == 0)))
-      break;
-
-    bytecount += nread;
-    if(size_known)
-      expected_size -= nread;
-
-    result = Curl_client_write(data, CLIENTWRITE_BODY, buf, nread);
-    if(result)
-      return result;
-
-    Curl_pgrsSetDownloadCounter(data, bytecount);
-
-    if(Curl_pgrsUpdate(data))
-      result = CURLE_ABORTED_BY_CALLBACK;
-    else
-      result = Curl_speedcheck(data, Curl_now());
   }
-  if(Curl_pgrsUpdate(data))
-    result = CURLE_ABORTED_BY_CALLBACK;
 
+  result = Curl_multi_xfer_buf_borrow(data, &xfer_buf, &xfer_blen);
+  if(result)
+    goto out;
+
+  if(!S_ISDIR(statbuf.st_mode)) {
+    while(!result) {
+      ssize_t nread;
+      /* Do not fill a whole buffer if we want less than all data */
+      size_t bytestoread;
+
+      if(size_known) {
+        bytestoread = (expected_size < (curl_off_t)(xfer_blen - 1)) ?
+          curlx_sotouz(expected_size) : (xfer_blen - 1);
+      }
+      else
+        bytestoread = xfer_blen - 1;
+
+      nread = read(fd, xfer_buf, bytestoread);
+
+      if(nread > 0)
+        xfer_buf[nread] = 0;
+
+      if(nread <= 0 || (size_known && (expected_size == 0)))
+        break;
+
+      if(size_known)
+        expected_size -= nread;
+
+      result = Curl_client_write(data, CLIENTWRITE_BODY, xfer_buf, nread);
+      if(result)
+        goto out;
+
+      result = Curl_pgrsCheck(data);
+      if(result)
+        goto out;
+    }
+  }
+  else {
+#ifdef HAVE_OPENDIR
+    DIR *dir = opendir(file->path);
+    struct dirent *entry;
+
+    if(!dir) {
+      result = CURLE_READ_ERROR;
+      goto out;
+    }
+    else {
+      while((entry = readdir(dir))) {
+        if(entry->d_name[0] != '.') {
+          result = Curl_client_write(data, CLIENTWRITE_BODY,
+                   entry->d_name, strlen(entry->d_name));
+          if(result)
+            break;
+          result = Curl_client_write(data, CLIENTWRITE_BODY, "\n", 1);
+          if(result)
+            break;
+        }
+      }
+      closedir(dir);
+    }
+#else
+    failf(data, "Directory listing not yet implemented on this platform.");
+    result = CURLE_READ_ERROR;
+#endif
+  }
+
+  if(!result)
+    result = Curl_pgrsUpdate(data);
+
+out:
+  Curl_multi_xfer_buf_release(data, xfer_buf);
   return result;
 }
 
+const struct Curl_protocol Curl_protocol_file = {
+  file_setup_connection,                /* setup_connection */
+  file_do,                              /* do_it */
+  file_done,                            /* done */
+  ZERO_NULL,                            /* do_more */
+  file_connect,                         /* connect_it */
+  ZERO_NULL,                            /* connecting */
+  ZERO_NULL,                            /* doing */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
+  file_disconnect,                      /* disconnect */
+  ZERO_NULL,                            /* write_resp */
+  ZERO_NULL,                            /* write_resp_hd */
+  ZERO_NULL,                            /* connection_is_dead */
+  ZERO_NULL,                            /* attach connection */
+  ZERO_NULL,                            /* follow */
+};
+
 #endif
diff --git a/third-party/curl/lib/file.h b/third-party/curl/lib/file.h
index 4565525592..0aa411b19f 100644
--- a/third-party/curl/lib/file.h
+++ b/third-party/curl/lib/file.h
@@ -23,20 +23,8 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
-
-/****************************************************************************
- * FILE unique setup
- ***************************************************************************/
-struct FILEPROTO {
-  char *path; /* the path we operate on */
-  char *freepath; /* pointer to the allocated block we must free, this might
-                     differ from the 'path' pointer */
-  int fd;     /* open file descriptor to read from! */
-};
-
 #ifndef CURL_DISABLE_FILE
-extern const struct Curl_handler Curl_handler_file;
+extern const struct Curl_protocol Curl_protocol_file;
 #endif
 
 #endif /* HEADER_CURL_FILE_H */
diff --git a/third-party/curl/lib/fileinfo.c b/third-party/curl/lib/fileinfo.c
index 2be3b3239b..33e5acde01 100644
--- a/third-party/curl/lib/fileinfo.c
+++ b/third-party/curl/lib/fileinfo.c
@@ -21,18 +21,15 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+
 #ifndef CURL_DISABLE_FTP
-#include "strdup.h"
+
 #include "fileinfo.h"
-#include "curl_memory.h"
-/* The last #include file should be: */
-#include "memdebug.h"
 
 struct fileinfo *Curl_fileinfo_alloc(void)
 {
-  return calloc(1, sizeof(struct fileinfo));
+  return curlx_calloc(1, sizeof(struct fileinfo));
 }
 
 void Curl_fileinfo_cleanup(struct fileinfo *finfo)
@@ -40,7 +37,8 @@ void Curl_fileinfo_cleanup(struct fileinfo *finfo)
   if(!finfo)
     return;
 
-  Curl_dyn_free(&finfo->buf);
-  free(finfo);
+  curlx_dyn_free(&finfo->buf);
+  curlx_free(finfo);
 }
-#endif
+
+#endif /* !CURL_DISABLE_FTP */
diff --git a/third-party/curl/lib/fileinfo.h b/third-party/curl/lib/fileinfo.h
index ce009da06d..737966788c 100644
--- a/third-party/curl/lib/fileinfo.h
+++ b/third-party/curl/lib/fileinfo.h
@@ -23,14 +23,14 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "curl_setup.h"
 
-#include <curl/curl.h>
 #include "llist.h"
-#include "dynbuf.h"
+#include "curlx/dynbuf.h"
 
 struct fileinfo {
   struct curl_fileinfo info;
-  struct Curl_llist_element list;
+  struct Curl_llist_node list;
   struct dynbuf buf;
 };
 
diff --git a/third-party/curl/lib/fopen.c b/third-party/curl/lib/fopen.c
deleted file mode 100644
index b6e3caddde..0000000000
--- a/third-party/curl/lib/fopen.c
+++ /dev/null
@@ -1,112 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#if !defined(CURL_DISABLE_COOKIES) || !defined(CURL_DISABLE_ALTSVC) ||  \
-  !defined(CURL_DISABLE_HSTS)
-
-#ifdef HAVE_FCNTL_H
-#include <fcntl.h>
-#endif
-
-#include "urldata.h"
-#include "rand.h"
-#include "fopen.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-/*
- * Curl_fopen() opens a file for writing with a temp name, to be renamed
- * to the final name when completed. If there is an existing file using this
- * name at the time of the open, this function will clone the mode from that
- * file.  if 'tempname' is non-NULL, it needs a rename after the file is
- * written.
- */
-CURLcode Curl_fopen(struct Curl_easy *data, const char *filename,
-                    FILE **fh, char **tempname)
-{
-  CURLcode result = CURLE_WRITE_ERROR;
-  unsigned char randsuffix[9];
-  char *tempstore = NULL;
-  struct_stat sb;
-  int fd = -1;
-  *tempname = NULL;
-
-  *fh = fopen(filename, FOPEN_WRITETEXT);
-  if(!*fh)
-    goto fail;
-  if(fstat(fileno(*fh), &sb) == -1 || !S_ISREG(sb.st_mode))
-    return CURLE_OK;
-  fclose(*fh);
-  *fh = NULL;
-
-  result = Curl_rand_hex(data, randsuffix, sizeof(randsuffix));
-  if(result)
-    goto fail;
-
-  tempstore = aprintf("%s.%s.tmp", filename, randsuffix);
-  if(!tempstore) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto fail;
-  }
-
-  result = CURLE_WRITE_ERROR;
-  fd = open(tempstore, O_WRONLY | O_CREAT | O_EXCL, 0600);
-  if(fd == -1)
-    goto fail;
-
-#ifdef HAVE_FCHMOD
-  {
-    struct_stat nsb;
-    if((fstat(fd, &nsb) != -1) &&
-       (nsb.st_uid == sb.st_uid) && (nsb.st_gid == sb.st_gid)) {
-      /* if the user and group are the same, clone the original mode */
-      if(fchmod(fd, (mode_t)sb.st_mode) == -1)
-        goto fail;
-    }
-  }
-#endif
-
-  *fh = fdopen(fd, FOPEN_WRITETEXT);
-  if(!*fh)
-    goto fail;
-
-  *tempname = tempstore;
-  return CURLE_OK;
-
-fail:
-  if(fd != -1) {
-    close(fd);
-    unlink(tempstore);
-  }
-
-  free(tempstore);
-
-  return result;
-}
-
-#endif /* ! disabled */
diff --git a/third-party/curl/lib/fopen.h b/third-party/curl/lib/fopen.h
deleted file mode 100644
index e3a919d073..0000000000
--- a/third-party/curl/lib/fopen.h
+++ /dev/null
@@ -1,30 +0,0 @@
-#ifndef HEADER_CURL_FOPEN_H
-#define HEADER_CURL_FOPEN_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-CURLcode Curl_fopen(struct Curl_easy *data, const char *filename,
-                    FILE **fh, char **tempname);
-
-#endif
diff --git a/third-party/curl/lib/formdata.c b/third-party/curl/lib/formdata.c
index 8984b63223..681902db71 100644
--- a/third-party/curl/lib/formdata.c
+++ b/third-party/curl/lib/formdata.c
@@ -21,39 +21,28 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include <curl/curl.h>
+struct Curl_easy;
 
 #include "formdata.h"
-#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_FORM_API)
 
-#if defined(HAVE_LIBGEN_H) && defined(HAVE_BASENAME)
-#include <libgen.h>
-#endif
+#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_FORM_API)
 
 #include "urldata.h" /* for struct Curl_easy */
 #include "mime.h"
-#include "vtls/vtls.h"
-#include "strcase.h"
-#include "sendf.h"
-#include "strdup.h"
-#include "rand.h"
-#include "warnless.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curlx/strdup.h"
+#include "bufref.h"
+#include "curlx/fopen.h"
 
 
-#define HTTPPOST_PTRNAME CURL_HTTPPOST_PTRNAME
-#define HTTPPOST_FILENAME CURL_HTTPPOST_FILENAME
+#define HTTPPOST_PTRNAME     CURL_HTTPPOST_PTRNAME
+#define HTTPPOST_FILENAME    CURL_HTTPPOST_FILENAME
 #define HTTPPOST_PTRCONTENTS CURL_HTTPPOST_PTRCONTENTS
-#define HTTPPOST_READFILE CURL_HTTPPOST_READFILE
-#define HTTPPOST_PTRBUFFER CURL_HTTPPOST_PTRBUFFER
-#define HTTPPOST_CALLBACK CURL_HTTPPOST_CALLBACK
-#define HTTPPOST_BUFFER CURL_HTTPPOST_BUFFER
+#define HTTPPOST_READFILE    CURL_HTTPPOST_READFILE
+#define HTTPPOST_PTRBUFFER   CURL_HTTPPOST_PTRBUFFER
+#define HTTPPOST_CALLBACK    CURL_HTTPPOST_CALLBACK
+#define HTTPPOST_BUFFER      CURL_HTTPPOST_BUFFER
 
 /***************************************************************************
  *
@@ -65,37 +54,31 @@
  * Returns newly allocated HttpPost on success and NULL if malloc failed.
  *
  ***************************************************************************/
-static struct curl_httppost *
-AddHttpPost(char *name, size_t namelength,
-            char *value, curl_off_t contentslength,
-            char *buffer, size_t bufferlength,
-            char *contenttype,
-            long flags,
-            struct curl_slist *contentHeader,
-            char *showfilename, char *userp,
-            struct curl_httppost *parent_post,
-            struct curl_httppost **httppost,
-            struct curl_httppost **last_post)
+static struct curl_httppost *AddHttpPost(struct FormInfo *src,
+                                         struct curl_httppost *parent_post,
+                                         struct curl_httppost **httppost,
+                                         struct curl_httppost **last_post)
 {
   struct curl_httppost *post;
-  if(!namelength && name)
-    namelength = strlen(name);
-  if((bufferlength > LONG_MAX) || (namelength > LONG_MAX))
+  size_t namelength = src->namelength;
+  if(!namelength && Curl_bufref_ptr(&src->name))
+    namelength = strlen(Curl_bufref_ptr(&src->name));
+  if((src->bufferlength > LONG_MAX) || (namelength > LONG_MAX))
     /* avoid overflow in typecasts below */
     return NULL;
-  post = calloc(1, sizeof(struct curl_httppost));
+  post = curlx_calloc(1, sizeof(struct curl_httppost));
   if(post) {
-    post->name = name;
+    post->name = CURL_UNCONST(Curl_bufref_ptr(&src->name));
     post->namelength = (long)namelength;
-    post->contents = value;
-    post->contentlen = contentslength;
-    post->buffer = buffer;
-    post->bufferlength = (long)bufferlength;
-    post->contenttype = contenttype;
-    post->contentheader = contentHeader;
-    post->showfilename = showfilename;
-    post->userp = userp;
-    post->flags = flags | CURL_HTTPPOST_LARGE;
+    post->contents = CURL_UNCONST(Curl_bufref_ptr(&src->value));
+    post->contentlen = src->contentslength;
+    post->buffer = src->buffer;
+    post->bufferlength = (long)src->bufferlength;
+    post->contenttype = CURL_UNCONST(Curl_bufref_ptr(&src->contenttype));
+    post->flags = src->flags | CURL_HTTPPOST_LARGE;
+    post->contentheader = src->contentheader;
+    post->showfilename = CURL_UNCONST(Curl_bufref_ptr(&src->showfilename));
+    post->userp = src->userp;
   }
   else
     return NULL;
@@ -119,39 +102,64 @@ AddHttpPost(char *name, size_t namelength,
   return post;
 }
 
+/* Allocate and initialize a new FormInfo structure. */
+static struct FormInfo *NewFormInfo(void)
+{
+  struct FormInfo *form_info = curlx_calloc(1, sizeof(struct FormInfo));
+
+  if(form_info) {
+    Curl_bufref_init(&form_info->name);
+    Curl_bufref_init(&form_info->value);
+    Curl_bufref_init(&form_info->contenttype);
+    Curl_bufref_init(&form_info->showfilename);
+  }
+
+  return form_info;
+}
+
+/* Replace the target field data by a dynamic copy of it. */
+static CURLcode FormInfoCopyField(struct bufref *field, size_t len)
+{
+  const char *value = Curl_bufref_ptr(field);
+  CURLcode result = CURLE_OK;
+
+  if(value) {
+    if(!len)
+      len = strlen(value);
+    result = Curl_bufref_memdup0(field, value, len);
+  }
+
+  return result;
+}
+
 /***************************************************************************
  *
  * AddFormInfo()
  *
- * Adds a FormInfo structure to the list presented by parent_form_info.
- *
- * Returns newly allocated FormInfo on success and NULL if malloc failed/
- * parent_form_info is NULL.
+ * Adds a FormInfo structure to the list presented by parent.
  *
  ***************************************************************************/
-static struct FormInfo *AddFormInfo(char *value,
-                                    char *contenttype,
-                                    struct FormInfo *parent_form_info)
+static void AddFormInfo(struct FormInfo *form_info, struct FormInfo *parent)
 {
-  struct FormInfo *form_info;
-  form_info = calloc(1, sizeof(struct FormInfo));
-  if(!form_info)
-    return NULL;
-  if(value)
-    form_info->value = value;
-  if(contenttype)
-    form_info->contenttype = contenttype;
-  form_info->flags = HTTPPOST_FILENAME;
+  form_info->flags |= HTTPPOST_FILENAME;
 
-  if(parent_form_info) {
+  if(parent) {
     /* now, point our 'more' to the original 'more' */
-    form_info->more = parent_form_info->more;
+    form_info->more = parent->more;
 
     /* then move the original 'more' to point to ourselves */
-    parent_form_info->more = form_info;
+    parent->more = form_info;
   }
+}
 
-  return form_info;
+static void free_formlist(struct FormInfo *ptr)
+{
+  for(; ptr; ptr = ptr->more) {
+    Curl_bufref_free(&ptr->name);
+    Curl_bufref_free(&ptr->value);
+    Curl_bufref_free(&ptr->contenttype);
+    Curl_bufref_free(&ptr->showfilename);
+  }
 }
 
 /***************************************************************************
@@ -160,10 +168,9 @@ static struct FormInfo *AddFormInfo(char *value,
  *
  * Stores a formpost parameter and builds the appropriate linked list.
  *
- * Has two principal functionalities: using files and byte arrays as
- * post parts. Byte arrays are either copied or just the pointer is stored
- * (as the user requests) while for files only the filename and not the
- * content is stored.
+ * Has two principal functionalities: using files and byte arrays as post
+ * parts. Byte arrays are either copied or the pointer is stored (as the user
+ * requests) while for files only the filename and not the content is stored.
  *
  * While you may have only one byte array for each name, multiple filenames
  * are allowed (and because of this feature CURLFORM_END is needed after
@@ -172,22 +179,24 @@ static struct FormInfo *AddFormInfo(char *value,
  * Examples:
  *
  * Simple name/value pair with copied contents:
- * curl_formadd (&post, &last, CURLFORM_COPYNAME, "name",
- * CURLFORM_COPYCONTENTS, "value", CURLFORM_END);
+ * curl_formadd(&post, &last, CURLFORM_COPYNAME, "name",
+ *              CURLFORM_COPYCONTENTS, "value", CURLFORM_END);
  *
  * name/value pair where only the content pointer is remembered:
- * curl_formadd (&post, &last, CURLFORM_COPYNAME, "name",
- * CURLFORM_PTRCONTENTS, ptr, CURLFORM_CONTENTSLENGTH, 10, CURLFORM_END);
+ * curl_formadd(&post, &last, CURLFORM_COPYNAME, "name",
+ *              CURLFORM_PTRCONTENTS, ptr, CURLFORM_CONTENTSLENGTH, 10L,
+ *              CURLFORM_END);
  * (if CURLFORM_CONTENTSLENGTH is missing strlen () is used)
  *
  * storing a filename (CONTENTTYPE is optional!):
- * curl_formadd (&post, &last, CURLFORM_COPYNAME, "name",
- * CURLFORM_FILE, "filename1", CURLFORM_CONTENTTYPE, "plain/text",
- * CURLFORM_END);
+ * curl_formadd(&post, &last, CURLFORM_COPYNAME, "name",
+ *              CURLFORM_FILE, "filename1", CURLFORM_CONTENTTYPE, "plain/text",
+ *              CURLFORM_END);
  *
  * storing multiple filenames:
- * curl_formadd (&post, &last, CURLFORM_COPYNAME, "name",
- * CURLFORM_FILE, "filename1", CURLFORM_FILE, "filename2", CURLFORM_END);
+ * curl_formadd(&post, &last, CURLFORM_COPYNAME, "name",
+ *              CURLFORM_FILE, "filename1", CURLFORM_FILE, "filename2",
+ *              CURLFORM_END);
  *
  * Returns:
  * CURL_FORMADD_OK             on success
@@ -203,48 +212,133 @@ static struct FormInfo *AddFormInfo(char *value,
  *
  ***************************************************************************/
 
-static
-CURLFORMcode FormAdd(struct curl_httppost **httppost,
-                     struct curl_httppost **last_post,
-                     va_list params)
+static CURLFORMcode FormAddCheck(struct FormInfo *first_form,
+                                 struct curl_httppost **httppost,
+                                 struct curl_httppost **last_post)
 {
-  struct FormInfo *first_form, *current_form, *form = NULL;
-  CURLFORMcode return_value = CURL_FORMADD_OK;
   const char *prevtype = NULL;
+  struct FormInfo *form = NULL;
   struct curl_httppost *post = NULL;
-  CURLformoption option;
-  struct curl_forms *forms = NULL;
-  char *array_value = NULL; /* value read from an array */
 
-  /* This is a state variable, that if TRUE means that we're parsing an
-     array that we got passed to us. If FALSE we're parsing the input
-     va_list arguments. */
-  bool array_state = FALSE;
+  /* go through the list, check for completeness and if everything is
+   * alright add the HttpPost item otherwise set retval accordingly */
+
+  for(form = first_form; form; form = form->more) {
+    const char *name = Curl_bufref_ptr(&form->name);
+
+    if(((!name || !Curl_bufref_ptr(&form->value)) && !post) ||
+       (form->contentslength &&
+        (form->flags & HTTPPOST_FILENAME)) ||
+       ((form->flags & HTTPPOST_FILENAME) &&
+        (form->flags & HTTPPOST_PTRCONTENTS)) ||
+
+       (!form->buffer &&
+        (form->flags & HTTPPOST_BUFFER) &&
+        (form->flags & HTTPPOST_PTRBUFFER)) ||
+
+       ((form->flags & HTTPPOST_READFILE) &&
+        (form->flags & HTTPPOST_PTRCONTENTS))
+      ) {
+      return CURL_FORMADD_INCOMPLETE;
+    }
+    if(((form->flags & HTTPPOST_FILENAME) ||
+        (form->flags & HTTPPOST_BUFFER)) &&
+       !Curl_bufref_ptr(&form->contenttype)) {
+      const char *f = Curl_bufref_ptr((form->flags & HTTPPOST_BUFFER) ?
+                                      &form->showfilename : &form->value);
+      const char *type = Curl_mime_contenttype(f);
+      if(!type)
+        type = prevtype;
+      if(!type)
+        type = FILE_CONTENTTYPE_DEFAULT;
+
+      /* our contenttype is missing */
+      if(Curl_bufref_memdup0(&form->contenttype, type, strlen(type)))
+        return CURL_FORMADD_MEMORY;
+    }
+    if(name && form->namelength) {
+      if(memchr(name, 0, form->namelength))
+        return CURL_FORMADD_NULL;
+    }
+    if(!(form->flags & HTTPPOST_PTRNAME)) {
+      /* Note that there is small risk that form->name is NULL here if the app
+         passed in a bad combo, so we check for that. */
+      if(FormInfoCopyField(&form->name, form->namelength))
+        return CURL_FORMADD_MEMORY;
+    }
+    if(!(form->flags & (HTTPPOST_FILENAME | HTTPPOST_READFILE |
+                        HTTPPOST_PTRCONTENTS | HTTPPOST_PTRBUFFER |
+                        HTTPPOST_CALLBACK))) {
+      if(FormInfoCopyField(&form->value, (size_t)form->contentslength))
+        return CURL_FORMADD_MEMORY;
+    }
+    post = AddHttpPost(form, post, httppost, last_post);
+
+    if(!post)
+      return CURL_FORMADD_MEMORY;
+
+    if(Curl_bufref_ptr(&form->contenttype))
+      prevtype = Curl_bufref_ptr(&form->contenttype);
+  }
+
+  return CURL_FORMADD_OK;
+}
+
+/* Shallow cleanup. Remove the newly created chain, the structs only and not
+   the content they point to */
+static void free_chain(struct curl_httppost *c)
+{
+  while(c) {
+    struct curl_httppost *next = c->next;
+    if(c->more)
+      free_chain(c->more);
+    curlx_free(c);
+    c = next;
+  }
+}
+
+static CURLFORMcode FormAdd(struct curl_httppost **httppost,
+                            struct curl_httppost **last_post, va_list params)
+{
+  struct FormInfo *first_form, *curr, *form = NULL;
+  CURLFORMcode retval = CURL_FORMADD_OK;
+  CURLformoption option;
+  const struct curl_forms *forms = NULL;
+  char *avalue = NULL;
+  struct curl_httppost *newchain = NULL;
+  struct curl_httppost *lastnode = NULL;
+
+#define form_ptr_arg(t) (forms ? (t)(void *)avalue : va_arg(params, t))
+#ifdef HAVE_UINTPTR_T
+#define form_int_arg(t) (forms ? (t)(uintptr_t)avalue : va_arg(params, t))
+#else
+#define form_int_arg(t) (forms ? (t)(void *)avalue : va_arg(params, t))
+#endif
 
   /*
    * We need to allocate the first struct to fill in.
    */
-  first_form = calloc(1, sizeof(struct FormInfo));
+  first_form = NewFormInfo();
   if(!first_form)
     return CURL_FORMADD_MEMORY;
 
-  current_form = first_form;
+  curr = first_form;
 
   /*
    * Loop through all the options set. Break if we have an error to report.
    */
-  while(return_value == CURL_FORMADD_OK) {
+  while(retval == CURL_FORMADD_OK) {
 
     /* first see if we have more parts of the array param */
-    if(array_state && forms) {
+    if(forms) {
       /* get the upcoming option from the given array */
       option = forms->option;
-      array_value = (char *)forms->value;
+      avalue = (char *)CURL_UNCONST(forms->value);
 
       forms++; /* advance this to next entry */
       if(CURLFORM_END == option) {
         /* end of array state */
-        array_state = FALSE;
+        forms = NULL;
         continue;
       }
     }
@@ -259,15 +353,13 @@ CURLFORMcode FormAdd(struct curl_httppost **httppost,
 
     switch(option) {
     case CURLFORM_ARRAY:
-      if(array_state)
-        /* we don't support an array from within an array */
-        return_value = CURL_FORMADD_ILLEGAL_ARRAY;
+      if(forms)
+        /* we do not support an array from within an array */
+        retval = CURL_FORMADD_ILLEGAL_ARRAY;
       else {
         forms = va_arg(params, struct curl_forms *);
-        if(forms)
-          array_state = TRUE;
-        else
-          return_value = CURL_FORMADD_NULL;
+        if(!forms)
+          retval = CURL_FORMADD_NULL;
       }
       break;
 
@@ -275,413 +367,236 @@ CURLFORMcode FormAdd(struct curl_httppost **httppost,
        * Set the Name property.
        */
     case CURLFORM_PTRNAME:
-      current_form->flags |= HTTPPOST_PTRNAME; /* fall through */
-
-      /* FALLTHROUGH */
+      curr->flags |= HTTPPOST_PTRNAME;
+      FALLTHROUGH();
     case CURLFORM_COPYNAME:
-      if(current_form->name)
-        return_value = CURL_FORMADD_OPTION_TWICE;
+      if(Curl_bufref_ptr(&curr->name))
+        retval = CURL_FORMADD_OPTION_TWICE;
       else {
-        char *name = array_state?
-          array_value:va_arg(params, char *);
-        if(name)
-          current_form->name = name; /* store for the moment */
+        avalue = form_ptr_arg(char *);
+        if(avalue)
+          Curl_bufref_set(&curr->name, avalue, 0, NULL); /* No copy yet. */
         else
-          return_value = CURL_FORMADD_NULL;
+          retval = CURL_FORMADD_NULL;
       }
       break;
     case CURLFORM_NAMELENGTH:
-      if(current_form->namelength)
-        return_value = CURL_FORMADD_OPTION_TWICE;
+      if(curr->namelength)
+        retval = CURL_FORMADD_OPTION_TWICE;
       else
-        current_form->namelength =
-          array_state?(size_t)array_value:(size_t)va_arg(params, long);
+        curr->namelength = (size_t)form_int_arg(long);
       break;
 
       /*
        * Set the contents property.
        */
     case CURLFORM_PTRCONTENTS:
-      current_form->flags |= HTTPPOST_PTRCONTENTS;
-      /* FALLTHROUGH */
+      curr->flags |= HTTPPOST_PTRCONTENTS;
+      FALLTHROUGH();
     case CURLFORM_COPYCONTENTS:
-      if(current_form->value)
-        return_value = CURL_FORMADD_OPTION_TWICE;
+      if(Curl_bufref_ptr(&curr->value))
+        retval = CURL_FORMADD_OPTION_TWICE;
       else {
-        char *value =
-          array_state?array_value:va_arg(params, char *);
-        if(value)
-          current_form->value = value; /* store for the moment */
+        avalue = form_ptr_arg(char *);
+        if(avalue)
+          Curl_bufref_set(&curr->value, avalue, 0, NULL); /* No copy yet. */
         else
-          return_value = CURL_FORMADD_NULL;
+          retval = CURL_FORMADD_NULL;
       }
       break;
     case CURLFORM_CONTENTSLENGTH:
-      current_form->contentslength =
-        array_state?(size_t)array_value:(size_t)va_arg(params, long);
+      curr->contentslength = (curl_off_t)(size_t)form_int_arg(long);
       break;
 
     case CURLFORM_CONTENTLEN:
-      current_form->flags |= CURL_HTTPPOST_LARGE;
-      current_form->contentslength =
-        array_state?(curl_off_t)(size_t)array_value:va_arg(params, curl_off_t);
+      curr->flags |= CURL_HTTPPOST_LARGE;
+      curr->contentslength = form_int_arg(curl_off_t);
       break;
 
-      /* Get contents from a given file name */
+      /* Get contents from a given filename */
     case CURLFORM_FILECONTENT:
-      if(current_form->flags & (HTTPPOST_PTRCONTENTS|HTTPPOST_READFILE))
-        return_value = CURL_FORMADD_OPTION_TWICE;
+      if(curr->flags & (HTTPPOST_PTRCONTENTS | HTTPPOST_READFILE))
+        retval = CURL_FORMADD_OPTION_TWICE;
       else {
-        const char *filename = array_state?
-          array_value:va_arg(params, char *);
-        if(filename) {
-          current_form->value = strdup(filename);
-          if(!current_form->value)
-            return_value = CURL_FORMADD_MEMORY;
-          else {
-            current_form->flags |= HTTPPOST_READFILE;
-            current_form->value_alloc = TRUE;
-          }
+        avalue = form_ptr_arg(char *);
+        if(avalue) {
+          if(Curl_bufref_memdup0(&curr->value, avalue, strlen(avalue)))
+            retval = CURL_FORMADD_MEMORY;
+          else
+            curr->flags |= HTTPPOST_READFILE;
         }
         else
-          return_value = CURL_FORMADD_NULL;
+          retval = CURL_FORMADD_NULL;
       }
       break;
 
       /* We upload a file */
     case CURLFORM_FILE:
-      {
-        const char *filename = array_state?array_value:
-          va_arg(params, char *);
-
-        if(current_form->value) {
-          if(current_form->flags & HTTPPOST_FILENAME) {
-            if(filename) {
-              char *fname = strdup(filename);
-              if(!fname)
-                return_value = CURL_FORMADD_MEMORY;
-              else {
-                form = AddFormInfo(fname, NULL, current_form);
-                if(!form) {
-                  free(fname);
-                  return_value = CURL_FORMADD_MEMORY;
-                }
-                else {
-                  form->value_alloc = TRUE;
-                  current_form = form;
-                  form = NULL;
-                }
-              }
+      avalue = form_ptr_arg(char *);
+      if(Curl_bufref_ptr(&curr->value)) {
+        if(curr->flags & HTTPPOST_FILENAME) {
+          if(avalue) {
+            form = NewFormInfo();
+            if(!form ||
+               Curl_bufref_memdup0(&form->value, avalue, strlen(avalue))) {
+              curlx_free(form);
+              retval = CURL_FORMADD_MEMORY;
             }
-            else
-              return_value = CURL_FORMADD_NULL;
-          }
-          else
-            return_value = CURL_FORMADD_OPTION_TWICE;
-        }
-        else {
-          if(filename) {
-            current_form->value = strdup(filename);
-            if(!current_form->value)
-              return_value = CURL_FORMADD_MEMORY;
             else {
-              current_form->flags |= HTTPPOST_FILENAME;
-              current_form->value_alloc = TRUE;
+              AddFormInfo(form, curr);
+              curr = form;
+              form = NULL;
             }
           }
           else
-            return_value = CURL_FORMADD_NULL;
-        }
-        break;
-      }
-
-    case CURLFORM_BUFFERPTR:
-      current_form->flags |= HTTPPOST_PTRBUFFER|HTTPPOST_BUFFER;
-      if(current_form->buffer)
-        return_value = CURL_FORMADD_OPTION_TWICE;
-      else {
-        char *buffer =
-          array_state?array_value:va_arg(params, char *);
-        if(buffer) {
-          current_form->buffer = buffer; /* store for the moment */
-          current_form->value = buffer; /* make it non-NULL to be accepted
-                                           as fine */
+            retval = CURL_FORMADD_NULL;
         }
         else
-          return_value = CURL_FORMADD_NULL;
+          retval = CURL_FORMADD_OPTION_TWICE;
+      }
+      else {
+        if(avalue) {
+          if(Curl_bufref_memdup0(&curr->value, avalue, strlen(avalue)))
+            retval = CURL_FORMADD_MEMORY;
+          else
+            curr->flags |= HTTPPOST_FILENAME;
+        }
+        else
+          retval = CURL_FORMADD_NULL;
+      }
+      break;
+
+    case CURLFORM_BUFFERPTR:
+      curr->flags |= HTTPPOST_PTRBUFFER | HTTPPOST_BUFFER;
+      if(curr->buffer)
+        retval = CURL_FORMADD_OPTION_TWICE;
+      else {
+        avalue = form_ptr_arg(char *);
+        if(avalue) {
+          curr->buffer = avalue; /* store for the moment */
+          /* Make value non-NULL to be accepted as fine */
+          Curl_bufref_set(&curr->value, avalue, 0, NULL);
+        }
+        else
+          retval = CURL_FORMADD_NULL;
       }
       break;
 
     case CURLFORM_BUFFERLENGTH:
-      if(current_form->bufferlength)
-        return_value = CURL_FORMADD_OPTION_TWICE;
+      if(curr->bufferlength)
+        retval = CURL_FORMADD_OPTION_TWICE;
       else
-        current_form->bufferlength =
-          array_state?(size_t)array_value:(size_t)va_arg(params, long);
+        curr->bufferlength = (size_t)form_int_arg(long);
       break;
 
     case CURLFORM_STREAM:
-      current_form->flags |= HTTPPOST_CALLBACK;
-      if(current_form->userp)
-        return_value = CURL_FORMADD_OPTION_TWICE;
+      curr->flags |= HTTPPOST_CALLBACK;
+      if(curr->userp)
+        retval = CURL_FORMADD_OPTION_TWICE;
       else {
-        char *userp =
-          array_state?array_value:va_arg(params, char *);
-        if(userp) {
-          current_form->userp = userp;
-          current_form->value = userp; /* this isn't strictly true but we
-                                          derive a value from this later on
-                                          and we need this non-NULL to be
-                                          accepted as a fine form part */
+        avalue = form_ptr_arg(char *);
+        if(avalue) {
+          curr->userp = avalue;
+          /* The following line is not strictly true but we derive a value
+             from this later on and we need this non-NULL to be accepted as
+             a fine form part */
+          Curl_bufref_set(&curr->value, avalue, 0, NULL);
         }
         else
-          return_value = CURL_FORMADD_NULL;
+          retval = CURL_FORMADD_NULL;
       }
       break;
 
     case CURLFORM_CONTENTTYPE:
-      {
-        const char *contenttype =
-          array_state?array_value:va_arg(params, char *);
-        if(current_form->contenttype) {
-          if(current_form->flags & HTTPPOST_FILENAME) {
-            if(contenttype) {
-              char *type = strdup(contenttype);
-              if(!type)
-                return_value = CURL_FORMADD_MEMORY;
-              else {
-                form = AddFormInfo(NULL, type, current_form);
-                if(!form) {
-                  free(type);
-                  return_value = CURL_FORMADD_MEMORY;
-                }
-                else {
-                  form->contenttype_alloc = TRUE;
-                  current_form = form;
-                  form = NULL;
-                }
-              }
+      avalue = form_ptr_arg(char *);
+      if(Curl_bufref_ptr(&curr->contenttype)) {
+        if(curr->flags & HTTPPOST_FILENAME) {
+          if(avalue) {
+            form = NewFormInfo();
+            if(!form || Curl_bufref_memdup0(&form->contenttype, avalue,
+                                            strlen(avalue))) {
+              curlx_free(form);
+              retval = CURL_FORMADD_MEMORY;
+            }
+            else {
+              AddFormInfo(form, curr);
+              curr = form;
+              form = NULL;
             }
-            else
-              return_value = CURL_FORMADD_NULL;
           }
           else
-            return_value = CURL_FORMADD_OPTION_TWICE;
+            retval = CURL_FORMADD_NULL;
         }
-        else {
-          if(contenttype) {
-            current_form->contenttype = strdup(contenttype);
-            if(!current_form->contenttype)
-              return_value = CURL_FORMADD_MEMORY;
-            else
-              current_form->contenttype_alloc = TRUE;
-          }
-          else
-            return_value = CURL_FORMADD_NULL;
-        }
-        break;
-      }
-    case CURLFORM_CONTENTHEADER:
-      {
-        /* this "cast increases required alignment of target type" but
-           we consider it OK anyway */
-        struct curl_slist *list = array_state?
-          (struct curl_slist *)(void *)array_value:
-          va_arg(params, struct curl_slist *);
-
-        if(current_form->contentheader)
-          return_value = CURL_FORMADD_OPTION_TWICE;
         else
-          current_form->contentheader = list;
-
-        break;
+          retval = CURL_FORMADD_OPTION_TWICE;
       }
+      else if(avalue) {
+        if(Curl_bufref_memdup0(&curr->contenttype, avalue, strlen(avalue)))
+          retval = CURL_FORMADD_MEMORY;
+      }
+      else
+        retval = CURL_FORMADD_NULL;
+      break;
+
+    case CURLFORM_CONTENTHEADER: {
+      /* this "cast increases required alignment of target type" but
+         we consider it OK anyway */
+      struct curl_slist *list = form_ptr_arg(struct curl_slist *);
+
+      if(curr->contentheader)
+        retval = CURL_FORMADD_OPTION_TWICE;
+      else
+        curr->contentheader = list;
+
+      break;
+    }
     case CURLFORM_FILENAME:
     case CURLFORM_BUFFER:
-      {
-        const char *filename = array_state?array_value:
-          va_arg(params, char *);
-        if(current_form->showfilename)
-          return_value = CURL_FORMADD_OPTION_TWICE;
-        else {
-          current_form->showfilename = strdup(filename);
-          if(!current_form->showfilename)
-            return_value = CURL_FORMADD_MEMORY;
-          else
-            current_form->showfilename_alloc = TRUE;
-        }
-        break;
-      }
+      avalue = form_ptr_arg(char *);
+      if(Curl_bufref_ptr(&curr->showfilename))
+        retval = CURL_FORMADD_OPTION_TWICE;
+      else if(Curl_bufref_memdup0(&curr->showfilename, avalue, strlen(avalue)))
+        retval = CURL_FORMADD_MEMORY;
+      break;
+
     default:
-      return_value = CURL_FORMADD_UNKNOWN_OPTION;
+      retval = CURL_FORMADD_UNKNOWN_OPTION;
       break;
     }
   }
 
-  if(CURL_FORMADD_OK != return_value) {
+  if(!retval)
+    retval = FormAddCheck(first_form, &newchain, &lastnode);
+
+  if(retval)
     /* On error, free allocated fields for all nodes of the FormInfo linked
        list without deallocating nodes. List nodes are deallocated later on */
-    struct FormInfo *ptr;
-    for(ptr = first_form; ptr != NULL; ptr = ptr->more) {
-      if(ptr->name_alloc) {
-        Curl_safefree(ptr->name);
-        ptr->name_alloc = FALSE;
-      }
-      if(ptr->value_alloc) {
-        Curl_safefree(ptr->value);
-        ptr->value_alloc = FALSE;
-      }
-      if(ptr->contenttype_alloc) {
-        Curl_safefree(ptr->contenttype);
-        ptr->contenttype_alloc = FALSE;
-      }
-      if(ptr->showfilename_alloc) {
-        Curl_safefree(ptr->showfilename);
-        ptr->showfilename_alloc = FALSE;
-      }
-    }
-  }
-
-  if(CURL_FORMADD_OK == return_value) {
-    /* go through the list, check for completeness and if everything is
-     * alright add the HttpPost item otherwise set return_value accordingly */
-
-    post = NULL;
-    for(form = first_form;
-        form != NULL;
-        form = form->more) {
-      if(((!form->name || !form->value) && !post) ||
-         ( (form->contentslength) &&
-           (form->flags & HTTPPOST_FILENAME) ) ||
-         ( (form->flags & HTTPPOST_FILENAME) &&
-           (form->flags & HTTPPOST_PTRCONTENTS) ) ||
-
-         ( (!form->buffer) &&
-           (form->flags & HTTPPOST_BUFFER) &&
-           (form->flags & HTTPPOST_PTRBUFFER) ) ||
-
-         ( (form->flags & HTTPPOST_READFILE) &&
-           (form->flags & HTTPPOST_PTRCONTENTS) )
-        ) {
-        return_value = CURL_FORMADD_INCOMPLETE;
-        break;
-      }
-      if(((form->flags & HTTPPOST_FILENAME) ||
-          (form->flags & HTTPPOST_BUFFER)) &&
-         !form->contenttype) {
-        char *f = (form->flags & HTTPPOST_BUFFER)?
-          form->showfilename : form->value;
-        char const *type;
-        type = Curl_mime_contenttype(f);
-        if(!type)
-          type = prevtype;
-        if(!type)
-          type = FILE_CONTENTTYPE_DEFAULT;
-
-        /* our contenttype is missing */
-        form->contenttype = strdup(type);
-        if(!form->contenttype) {
-          return_value = CURL_FORMADD_MEMORY;
-          break;
-        }
-        form->contenttype_alloc = TRUE;
-      }
-      if(form->name && form->namelength) {
-        /* Name should not contain nul bytes. */
-        size_t i;
-        for(i = 0; i < form->namelength; i++)
-          if(!form->name[i]) {
-            return_value = CURL_FORMADD_NULL;
-            break;
-          }
-        if(return_value != CURL_FORMADD_OK)
-          break;
-      }
-      if(!(form->flags & HTTPPOST_PTRNAME) &&
-         (form == first_form) ) {
-        /* Note that there's small risk that form->name is NULL here if the
-           app passed in a bad combo, so we better check for that first. */
-        if(form->name) {
-          /* copy name (without strdup; possibly not null-terminated) */
-          form->name = Curl_memdup(form->name, form->namelength?
-                                   form->namelength:
-                                   strlen(form->name) + 1);
-        }
-        if(!form->name) {
-          return_value = CURL_FORMADD_MEMORY;
-          break;
-        }
-        form->name_alloc = TRUE;
-      }
-      if(!(form->flags & (HTTPPOST_FILENAME | HTTPPOST_READFILE |
-                          HTTPPOST_PTRCONTENTS | HTTPPOST_PTRBUFFER |
-                          HTTPPOST_CALLBACK)) && form->value) {
-        /* copy value (without strdup; possibly contains null characters) */
-        size_t clen  = (size_t) form->contentslength;
-        if(!clen)
-          clen = strlen(form->value) + 1;
-
-        form->value = Curl_memdup(form->value, clen);
-
-        if(!form->value) {
-          return_value = CURL_FORMADD_MEMORY;
-          break;
-        }
-        form->value_alloc = TRUE;
-      }
-      post = AddHttpPost(form->name, form->namelength,
-                         form->value, form->contentslength,
-                         form->buffer, form->bufferlength,
-                         form->contenttype, form->flags,
-                         form->contentheader, form->showfilename,
-                         form->userp,
-                         post, httppost,
-                         last_post);
-
-      if(!post) {
-        return_value = CURL_FORMADD_MEMORY;
-        break;
-      }
-
-      if(form->contenttype)
-        prevtype = form->contenttype;
-    }
-    if(CURL_FORMADD_OK != return_value) {
-      /* On error, free allocated fields for nodes of the FormInfo linked
-         list which are not already owned by the httppost linked list
-         without deallocating nodes. List nodes are deallocated later on */
-      struct FormInfo *ptr;
-      for(ptr = form; ptr != NULL; ptr = ptr->more) {
-        if(ptr->name_alloc) {
-          Curl_safefree(ptr->name);
-          ptr->name_alloc = FALSE;
-        }
-        if(ptr->value_alloc) {
-          Curl_safefree(ptr->value);
-          ptr->value_alloc = FALSE;
-        }
-        if(ptr->contenttype_alloc) {
-          Curl_safefree(ptr->contenttype);
-          ptr->contenttype_alloc = FALSE;
-        }
-        if(ptr->showfilename_alloc) {
-          Curl_safefree(ptr->showfilename);
-          ptr->showfilename_alloc = FALSE;
-        }
-      }
-    }
-  }
+    free_formlist(first_form);
 
   /* Always deallocate FormInfo linked list nodes without touching node
      fields given that these have either been deallocated or are owned
      now by the httppost linked list */
   while(first_form) {
     struct FormInfo *ptr = first_form->more;
-    free(first_form);
+    curlx_free(first_form);
     first_form = ptr;
   }
 
-  return return_value;
+  if(!retval) {
+    /* Only if all is fine, link the new chain into the provided list */
+    if(*last_post)
+      (*last_post)->next = newchain;
+    else
+      (*httppost) = newchain;
+
+    (*last_post) = lastnode;
+  }
+  else
+    free_chain(newchain);
+
+  return retval;
+#undef form_ptr_arg
+#undef form_int_arg
 }
 
 /*
@@ -691,15 +606,14 @@ CURLFORMcode FormAdd(struct curl_httppost **httppost,
  */
 
 CURLFORMcode curl_formadd(struct curl_httppost **httppost,
-                          struct curl_httppost **last_post,
-                          ...)
+                          struct curl_httppost **last_post, ...)
 {
   va_list arg;
-  CURLFORMcode result;
+  CURLFORMcode form;
   va_start(arg, last_post);
-  result = FormAdd(httppost, last_post, arg);
+  form = FormAdd(httppost, last_post, arg);
   va_end(arg);
-  return result;
+  return form;
 }
 
 /*
@@ -715,6 +629,10 @@ int curl_formget(struct curl_httppost *form, void *arg,
   CURLcode result;
   curl_mimepart toppart;
 
+  /* Validate callback is provided */
+  if(!append)
+    return (int)CURLE_BAD_FUNCTION_ARGUMENT;
+
   Curl_mime_initpart(&toppart); /* default form is empty */
   result = Curl_getformdata(NULL, &toppart, form, NULL);
   if(!result)
@@ -736,7 +654,7 @@ int curl_formget(struct curl_httppost *form, void *arg,
   }
 
   Curl_mime_cleanpart(&toppart);
-  return (int) result;
+  return (int)result;
 }
 
 /*
@@ -748,7 +666,7 @@ void curl_formfree(struct curl_httppost *form)
   struct curl_httppost *next;
 
   if(!form)
-    /* no form to free, just get out of this */
+    /* no form to free, get out of this */
     return;
 
   do {
@@ -758,35 +676,31 @@ void curl_formfree(struct curl_httppost *form)
     curl_formfree(form->more);
 
     if(!(form->flags & HTTPPOST_PTRNAME))
-      free(form->name); /* free the name */
+      curlx_free(form->name); /* free the name */
     if(!(form->flags &
-         (HTTPPOST_PTRCONTENTS|HTTPPOST_BUFFER|HTTPPOST_CALLBACK))
-      )
-      free(form->contents); /* free the contents */
-    free(form->contenttype); /* free the content type */
-    free(form->showfilename); /* free the faked file name */
-    free(form);       /* free the struct */
+         (HTTPPOST_PTRCONTENTS | HTTPPOST_BUFFER | HTTPPOST_CALLBACK)))
+      curlx_free(form->contents); /* free the contents */
+    curlx_free(form->contenttype); /* free the content type */
+    curlx_free(form->showfilename); /* free the faked filename */
+    curlx_free(form);       /* free the struct */
     form = next;
   } while(form); /* continue */
 }
 
-
 /* Set mime part name, taking care of non null-terminated name string. */
 static CURLcode setname(curl_mimepart *part, const char *name, size_t len)
 {
   char *zname;
-  CURLcode res;
+  CURLcode result;
 
   if(!name || !len)
     return curl_mime_name(part, name);
-  zname = malloc(len + 1);
+  zname = curlx_memdup0(name, len);
   if(!zname)
     return CURLE_OUT_OF_MEMORY;
-  memcpy(zname, name, len);
-  zname[len] = '\0';
-  res = curl_mime_name(part, zname);
-  free(zname);
-  return res;
+  result = curl_mime_name(part, zname);
+  curlx_free(zname);
+  return result;
 }
 
 /*
@@ -795,11 +709,11 @@ static CURLcode setname(curl_mimepart *part, const char *name, size_t len)
  * mime part at '*finalform'.
  *
  * This function will not do a failf() for the potential memory failures but
- * should for all other errors it spots. Just note that this function MAY get
- * a NULL pointer in the 'data' argument.
+ * should for all other errors it spots. Note that this function MAY get a
+ * NULL pointer in the 'data' argument.
  */
 
-CURLcode Curl_getformdata(struct Curl_easy *data,
+CURLcode Curl_getformdata(CURL *data,
                           curl_mimepart *finalform,
                           struct curl_httppost *post,
                           curl_read_callback fread_func)
@@ -868,15 +782,21 @@ CURLcode Curl_getformdata(struct Curl_easy *data,
 
         if(post->flags & (HTTPPOST_FILENAME | HTTPPOST_READFILE)) {
           if(!strcmp(file->contents, "-")) {
-            /* There are a few cases where the code below won't work; in
+            /* There are a few cases where the code below will not work; in
                particular, freopen(stdin) by the caller is not guaranteed
                to result as expected. This feature has been kept for backward
-               compatibility: use of "-" pseudo file name should be avoided. */
-            result = curl_mime_data_cb(part, (curl_off_t) -1,
-                                       (curl_read_callback) fread,
-                                       CURLX_FUNCTION_CAST(curl_seek_callback,
-                                                           fseek),
-                                       NULL, (void *) stdin);
+               compatibility: use of "-" pseudo filename should be avoided. */
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wcast-function-type-strict"
+#endif
+            result = curl_mime_data_cb(part, (curl_off_t)-1,
+                                       (curl_read_callback)fread,
+                                       curlx_fseek,
+                                       NULL, (void *)stdin);
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic pop
+#endif
           }
           else
             result = curl_mime_filedata(part, file->contents);
@@ -885,7 +805,8 @@ CURLcode Curl_getformdata(struct Curl_easy *data,
         }
         else if(post->flags & HTTPPOST_BUFFER)
           result = curl_mime_data(part, post->buffer,
-                                  post->bufferlength? post->bufferlength: -1);
+                                  post->bufferlength ?
+                                  post->bufferlength : -1);
         else if(post->flags & HTTPPOST_CALLBACK) {
           /* the contents should be read with the callback and the size is set
              with the contentslength */
@@ -904,10 +825,10 @@ CURLcode Curl_getformdata(struct Curl_easy *data,
         }
       }
 
-      /* Set fake file name. */
+      /* Set fake filename. */
       if(!result && post->showfilename)
         if(post->more || (post->flags & (HTTPPOST_FILENAME | HTTPPOST_BUFFER |
-                                        HTTPPOST_CALLBACK)))
+                                         HTTPPOST_CALLBACK)))
           result = curl_mime_filename(part, post->showfilename);
     }
   }
@@ -918,11 +839,9 @@ CURLcode Curl_getformdata(struct Curl_easy *data,
   return result;
 }
 
-#else
-/* if disabled */
+#else /* if disabled */
 CURLFORMcode curl_formadd(struct curl_httppost **httppost,
-                          struct curl_httppost **last_post,
-                          ...)
+                          struct curl_httppost **last_post, ...)
 {
   (void)httppost;
   (void)last_post;
@@ -932,9 +851,9 @@ CURLFORMcode curl_formadd(struct curl_httppost **httppost,
 int curl_formget(struct curl_httppost *form, void *arg,
                  curl_formget_callback append)
 {
-  (void) form;
-  (void) arg;
-  (void) append;
+  (void)form;
+  (void)arg;
+  (void)append;
   return CURL_FORMADD_DISABLED;
 }
 
@@ -944,4 +863,4 @@ void curl_formfree(struct curl_httppost *form)
   /* Nothing to do. */
 }
 
-#endif  /* if disabled */
+#endif /* if disabled */
diff --git a/third-party/curl/lib/formdata.h b/third-party/curl/lib/formdata.h
index af466249fd..33d7d0ae33 100644
--- a/third-party/curl/lib/formdata.h
+++ b/third-party/curl/lib/formdata.h
@@ -23,37 +23,33 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifndef CURL_DISABLE_FORM_API
 
+#include "bufref.h"
+
 /* used by FormAdd for temporary storage */
 struct FormInfo {
-  char *name;
-  size_t namelength;
-  char *value;
-  curl_off_t contentslength;
-  char *contenttype;
-  long flags;
+  struct bufref name;
+  struct bufref value;
+  struct bufref contenttype;
+  struct bufref showfilename; /* The filename to show. If not set, the actual
+                                 filename will be used */
   char *buffer;      /* pointer to existing buffer used for file upload */
-  size_t bufferlength;
-  char *showfilename; /* The file name to show. If not set, the actual
-                         file name will be used */
   char *userp;        /* pointer for the read callback */
-  struct curl_slist *contentheader;
   struct FormInfo *more;
-  bool name_alloc;
-  bool value_alloc;
-  bool contenttype_alloc;
-  bool showfilename_alloc;
+  struct curl_slist *contentheader;
+  curl_off_t contentslength;
+  size_t namelength;
+  size_t bufferlength;
+  unsigned char flags;
 };
 
-CURLcode Curl_getformdata(struct Curl_easy *data,
-                          curl_mimepart *,
+CURLcode Curl_getformdata(CURL *data,
+                          curl_mimepart *finalform,
                           struct curl_httppost *post,
                           curl_read_callback fread_func);
 #endif /* CURL_DISABLE_FORM_API */
 
-
 #endif /* HEADER_CURL_FORMDATA_H */
diff --git a/third-party/curl/lib/ftp-int.h b/third-party/curl/lib/ftp-int.h
new file mode 100644
index 0000000000..8d7e141274
--- /dev/null
+++ b/third-party/curl/lib/ftp-int.h
@@ -0,0 +1,160 @@
+#ifndef HEADER_CURL_FTP_INT_H
+#define HEADER_CURL_FTP_INT_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "pingpong.h"
+
+#ifndef CURL_DISABLE_FTP
+
+/****************************************************************************
+ * FTP unique setup
+ ***************************************************************************/
+enum {
+  FTP_STOP,    /* do nothing state, stops the state machine */
+  FTP_WAIT220, /* waiting for the initial 220 response immediately after
+                  a connect */
+  FTP_AUTH,
+  FTP_USER,
+  FTP_PASS,
+  FTP_ACCT,
+  FTP_PBSZ,
+  FTP_PROT,
+  FTP_CCC,
+  FTP_PWD,
+  FTP_SYST,
+  FTP_NAMEFMT,
+  FTP_QUOTE, /* waiting for a response to a command sent in a quote list */
+  FTP_RETR_PREQUOTE,
+  FTP_STOR_PREQUOTE,
+  FTP_LIST_PREQUOTE,
+  FTP_POSTQUOTE,
+  FTP_CWD,  /* change directory */
+  FTP_MKD,  /* if the directory did not exist */
+  FTP_MDTM, /* to figure out the datestamp */
+  FTP_TYPE, /* to set type when doing a head-like request */
+  FTP_LIST_TYPE, /* set type when about to do a directory list */
+  FTP_RETR_LIST_TYPE,
+  FTP_RETR_TYPE, /* set type when about to RETR a file */
+  FTP_STOR_TYPE, /* set type when about to STOR a file */
+  FTP_SIZE, /* get the remote file's size for head-like request */
+  FTP_RETR_SIZE, /* get the remote file's size for RETR */
+  FTP_STOR_SIZE, /* get the size for STOR */
+  FTP_REST, /* when used to check if the server supports it in head-like */
+  FTP_RETR_REST, /* when asking for "resume" in for RETR */
+  FTP_PORT, /* generic state for PORT, LPRT and EPRT, check count1 */
+  FTP_PRET, /* generic state for PRET RETR, PRET STOR and PRET LIST/NLST */
+  FTP_PASV, /* generic state for PASV and EPSV, check count1 */
+  FTP_LIST, /* generic state for LIST, NLST or a custom list command */
+  FTP_RETR,
+  FTP_STOR, /* generic state for STOR and APPE */
+  FTP_QUIT,
+  FTP_LAST  /* never used */
+};
+typedef unsigned char ftpstate; /* use the enum values */
+
+struct ftp_parselist_data; /* defined later in ftplistparser.c */
+
+struct ftp_wc {
+  struct ftp_parselist_data *parser;
+
+  struct {
+    curl_write_callback write_function;
+    FILE *file_descriptor;
+  } backup;
+};
+
+/* This FTP struct is used in the Curl_easy. All FTP data that is
+   connection-oriented must be in FTP_conn to properly deal with the fact that
+   perhaps the Curl_easy is changed between the times the connection is
+   used. */
+struct FTP {
+  char *path;    /* points to the urlpieces struct field */
+  char *pathalloc; /* if non-NULL a pointer to an allocated path */
+
+  /* transfer a file/body or not, done as a typedefed enum to make debuggers
+     display the full symbol and not the numerical value */
+  curl_pp_transfer transfer;
+  curl_off_t downloadsize;
+};
+
+/* one struct entry for each path component (of 'rawpath') */
+struct pathcomp {
+  int start; /* start column */
+  int len;   /* length in bytes */
+};
+
+/* ftp_conn is used for struct connection-oriented data in the connectdata
+   struct */
+struct ftp_conn {
+  struct pingpong pp;
+  char *account;
+  char *alternative_to_user;
+  char *entrypath; /* the PWD reply when we logged on */
+  const char *file; /* URL-decoded filename (or path), points into rawpath */
+  char *rawpath; /* URL decoded, allocated, version of the path */
+  struct pathcomp *dirs; /* allocated array for path components */
+  char *prevpath;   /* URL-decoded conn->path from the previous transfer */
+  char transfertype; /* set by ftp_transfertype for use by Curl_client_write()a
+                        and others (A/I or zero) */
+  char *server_os;     /* The target server operating system. */
+  curl_off_t known_filesize; /* file size is different from -1, if wildcard
+                                LIST parsing was done and wc_statemach set
+                                it */
+  int count1; /* general purpose counter for the state machine */
+  int count2; /* general purpose counter for the state machine */
+  int count3; /* general purpose counter for the state machine */
+  unsigned short dirdepth;  /* number of entries used in the 'dirs' array,
+                               < FTP_MAX_DIR_DEPTH */
+  unsigned short cwdcount;  /* number of CWD commands issued,
+                               < FTP_MAX_DIR_DEPTH */
+  unsigned char state; /* (ftpstate enum) always use ftp.c:state() to change
+                          state! */
+  unsigned char use_ssl;   /* if AUTH TLS is to be attempted etc, for FTP or
+                              IMAP or POP3 or others! (type: curl_usessl)*/
+  unsigned char ccc;       /* ccc level for this connection */
+  BIT(ftp_trying_alternative);
+  BIT(dont_check);  /* Set to TRUE to prevent the final (post-transfer)
+                       file size and 226/250 status check. It should still
+                       read the line, ignore the result. */
+  BIT(ctl_valid);   /* Tells Curl_ftp_quit() whether or not to do anything. If
+                       the connection has timed out or been closed, this
+                       should be FALSE when it gets to Curl_ftp_quit() */
+  BIT(cwddone);     /* if it has been determined that the proper CWD combo
+                       already has been done */
+  BIT(cwdfail);     /* set TRUE if a CWD command fails, as then we must prevent
+                       caching the current directory */
+  BIT(wait_data_conn); /* this is set TRUE if data connection is waited */
+  BIT(shutdown);    /* connection is being shutdown, e.g. QUIT */
+};
+
+/* meta key for storing `struct FTP` as easy meta data */
+#define CURL_META_FTP_EASY   "meta:proto:ftp:easy"
+/* meta key for storing `struct ftp_conn` as connection meta data */
+#define CURL_META_FTP_CONN   "meta:proto:ftp:conn"
+
+#endif /* CURL_DISABLE_FTP */
+
+#endif /* HEADER_CURL_FTP_INT_H */
diff --git a/third-party/curl/lib/ftp.c b/third-party/curl/lib/ftp.c
index e24ae9c15d..05d17064a0 100644
--- a/third-party/curl/lib/ftp.c
+++ b/third-party/curl/lib/ftp.c
@@ -21,8 +21,8 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+#include "urldata.h"
 
 #ifndef CURL_DISABLE_FTP
 
@@ -40,42 +40,35 @@
 #include <inet.h>
 #endif
 
-#include <curl/curl.h>
-#include "urldata.h"
 #include "sendf.h"
+#include "curl_addrinfo.h"
+#include "curl_trc.h"
 #include "if2ip.h"
 #include "hostip.h"
 #include "progress.h"
 #include "transfer.h"
 #include "escape.h"
-#include "http.h" /* for HTTP proxy tunnel stuff */
 #include "ftp.h"
-#include "fileinfo.h"
+#include "ftp-int.h"
 #include "ftplistparser.h"
 #include "curl_range.h"
-#include "curl_krb5.h"
-#include "strtoofft.h"
 #include "strcase.h"
 #include "vtls/vtls.h"
 #include "cfilters.h"
 #include "cf-socket.h"
 #include "connect.h"
-#include "strerror.h"
-#include "inet_ntop.h"
-#include "inet_pton.h"
+#include "curlx/inet_ntop.h"
+#include "curlx/inet_pton.h"
 #include "select.h"
 #include "parsedate.h" /* for the week day and month names */
 #include "sockaddr.h" /* required for Curl_sockaddr_storage */
 #include "multiif.h"
 #include "url.h"
-#include "speedcheck.h"
-#include "warnless.h"
 #include "http_proxy.h"
-#include "socks.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curlx/strdup.h"
+#include "curlx/strerr.h"
+#include "curlx/strparse.h"
+#include "curl_ctype.h"
 
 #ifndef NI_MAXHOST
 #define NI_MAXHOST 1025
@@ -84,457 +77,511 @@
 #define INET_ADDRSTRLEN 16
 #endif
 
-#ifdef CURL_DISABLE_VERBOSE_STRINGS
-#define ftp_pasv_verbose(a,b,c,d)  Curl_nop_stmt
+/* macro to check for a three-digit ftp status code at the start of the
+   given string */
+#define STATUSCODE(line) \
+  (ISDIGIT((line)[0]) && ISDIGIT((line)[1]) && ISDIGIT((line)[2]))
+
+/* macro to check for the last line in an FTP server response */
+#define LASTLINE(line) (STATUSCODE(line) && (' ' == (line)[3]))
+
+#ifdef CURLVERBOSE
+/* for tracing purposes */
+static const char * const ftp_state_names[] = {
+  "STOP",
+  "WAIT220",
+  "AUTH",
+  "USER",
+  "PASS",
+  "ACCT",
+  "PBSZ",
+  "PROT",
+  "CCC",
+  "PWD",
+  "SYST",
+  "NAMEFMT",
+  "QUOTE",
+  "RETR_PREQUOTE",
+  "STOR_PREQUOTE",
+  "LIST_PREQUOTE",
+  "POSTQUOTE",
+  "CWD",
+  "MKD",
+  "MDTM",
+  "TYPE",
+  "LIST_TYPE",
+  "RETR_LIST_TYPE",
+  "RETR_TYPE",
+  "STOR_TYPE",
+  "SIZE",
+  "RETR_SIZE",
+  "STOR_SIZE",
+  "REST",
+  "RETR_REST",
+  "PORT",
+  "PRET",
+  "PASV",
+  "LIST",
+  "RETR",
+  "STOR",
+  "QUIT"
+};
+#define FTP_CSTATE(ftpc)   ((ftpc) ? ftp_state_names[(ftpc)->state] : "???")
+
+#endif /* CURLVERBOSE */
+
+/* This is the ONLY way to change FTP state! */
+static void ftp_state_low(struct Curl_easy *data,
+                          struct ftp_conn *ftpc,
+                          ftpstate newstate
+#ifdef DEBUGBUILD
+                          , int lineno
 #endif
+  )
+{
+  if(ftpc->state != newstate) {
+#ifdef DEBUGBUILD
+    NOVERBOSE((void)lineno);
+    CURL_TRC_FTP(data, "[%s] -> [%s] (line %d)", FTP_CSTATE(ftpc),
+                 ftp_state_names[newstate], lineno);
+#else
+    CURL_TRC_FTP(data, "[%s] -> [%s]", FTP_CSTATE(ftpc),
+                 ftp_state_names[newstate]);
+#endif
+  }
+  ftpc->state = newstate;
+}
 
 /* Local API functions */
 #ifndef DEBUGBUILD
-static void _ftp_state(struct Curl_easy *data,
-                       ftpstate newstate);
-#define ftp_state(x,y) _ftp_state(x,y)
-#else
-static void _ftp_state(struct Curl_easy *data,
-                       ftpstate newstate,
-                       int lineno);
-#define ftp_state(x,y) _ftp_state(x,y,__LINE__)
-#endif
+#define ftp_state(x, y, z) ftp_state_low(x, y, z)
+#else /* !DEBUGBUILD */
+#define ftp_state(x, y, z) ftp_state_low(x, y, z, __LINE__)
+#endif /* DEBUGBUILD */
 
-static CURLcode ftp_sendquote(struct Curl_easy *data,
-                              struct connectdata *conn,
-                              struct curl_slist *quote);
-static CURLcode ftp_quit(struct Curl_easy *data, struct connectdata *conn);
-static CURLcode ftp_parse_url_path(struct Curl_easy *data);
-static CURLcode ftp_regular_transfer(struct Curl_easy *data, bool *done);
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-static void ftp_pasv_verbose(struct Curl_easy *data,
-                             struct Curl_addrinfo *ai,
-                             char *newhost, /* ascii version */
-                             int port);
-#endif
-static CURLcode ftp_state_prepare_transfer(struct Curl_easy *data);
-static CURLcode ftp_state_mdtm(struct Curl_easy *data);
+static CURLcode ftp_state_mdtm(struct Curl_easy *data,
+                               struct ftp_conn *ftpc,
+                               struct FTP *ftp);
 static CURLcode ftp_state_quote(struct Curl_easy *data,
+                                struct ftp_conn *ftpc,
+                                struct FTP *ftp,
                                 bool init, ftpstate instate);
 static CURLcode ftp_nb_type(struct Curl_easy *data,
-                            struct connectdata *conn,
+                            struct ftp_conn *ftpc,
+                            struct FTP *ftp,
                             bool ascii, ftpstate newstate);
-static int ftp_need_type(struct connectdata *conn,
-                         bool ascii);
-static CURLcode ftp_do(struct Curl_easy *data, bool *done);
-static CURLcode ftp_done(struct Curl_easy *data,
-                         CURLcode, bool premature);
-static CURLcode ftp_connect(struct Curl_easy *data, bool *done);
-static CURLcode ftp_disconnect(struct Curl_easy *data,
-                               struct connectdata *conn, bool dead_connection);
-static CURLcode ftp_do_more(struct Curl_easy *data, int *completed);
-static CURLcode ftp_multi_statemach(struct Curl_easy *data, bool *done);
-static int ftp_getsock(struct Curl_easy *data, struct connectdata *conn,
-                       curl_socket_t *socks);
-static int ftp_domore_getsock(struct Curl_easy *data,
-                              struct connectdata *conn, curl_socket_t *socks);
-static CURLcode ftp_doing(struct Curl_easy *data,
-                          bool *dophase_done);
-static CURLcode ftp_setup_connection(struct Curl_easy *data,
-                                     struct connectdata *conn);
-static CURLcode init_wc_data(struct Curl_easy *data);
-static CURLcode wc_statemach(struct Curl_easy *data);
-static void wc_data_dtor(void *ptr);
-static CURLcode ftp_state_retr(struct Curl_easy *data, curl_off_t filesize);
-static CURLcode ftp_readresp(struct Curl_easy *data,
-                             curl_socket_t sockfd,
-                             struct pingpong *pp,
-                             int *ftpcode,
-                             size_t *size);
-static CURLcode ftp_dophase_done(struct Curl_easy *data,
-                                 bool connected);
-
-/*
- * FTP protocol handler.
- */
-
-const struct Curl_handler Curl_handler_ftp = {
-  "FTP",                           /* scheme */
-  ftp_setup_connection,            /* setup_connection */
-  ftp_do,                          /* do_it */
-  ftp_done,                        /* done */
-  ftp_do_more,                     /* do_more */
-  ftp_connect,                     /* connect_it */
-  ftp_multi_statemach,             /* connecting */
-  ftp_doing,                       /* doing */
-  ftp_getsock,                     /* proto_getsock */
-  ftp_getsock,                     /* doing_getsock */
-  ftp_domore_getsock,              /* domore_getsock */
-  ZERO_NULL,                       /* perform_getsock */
-  ftp_disconnect,                  /* disconnect */
-  ZERO_NULL,                       /* readwrite */
-  ZERO_NULL,                       /* connection_check */
-  ZERO_NULL,                       /* attach connection */
-  PORT_FTP,                        /* defport */
-  CURLPROTO_FTP,                   /* protocol */
-  CURLPROTO_FTP,                   /* family */
-  PROTOPT_DUAL | PROTOPT_CLOSEACTION | PROTOPT_NEEDSPWD |
-  PROTOPT_NOURLQUERY | PROTOPT_PROXY_AS_HTTP |
-  PROTOPT_WILDCARD /* flags */
-};
-
-
-#ifdef USE_SSL
-/*
- * FTPS protocol handler.
- */
-
-const struct Curl_handler Curl_handler_ftps = {
-  "FTPS",                          /* scheme */
-  ftp_setup_connection,            /* setup_connection */
-  ftp_do,                          /* do_it */
-  ftp_done,                        /* done */
-  ftp_do_more,                     /* do_more */
-  ftp_connect,                     /* connect_it */
-  ftp_multi_statemach,             /* connecting */
-  ftp_doing,                       /* doing */
-  ftp_getsock,                     /* proto_getsock */
-  ftp_getsock,                     /* doing_getsock */
-  ftp_domore_getsock,              /* domore_getsock */
-  ZERO_NULL,                       /* perform_getsock */
-  ftp_disconnect,                  /* disconnect */
-  ZERO_NULL,                       /* readwrite */
-  ZERO_NULL,                       /* connection_check */
-  ZERO_NULL,                       /* attach connection */
-  PORT_FTPS,                       /* defport */
-  CURLPROTO_FTPS,                  /* protocol */
-  CURLPROTO_FTP,                   /* family */
-  PROTOPT_SSL | PROTOPT_DUAL | PROTOPT_CLOSEACTION |
-  PROTOPT_NEEDSPWD | PROTOPT_NOURLQUERY | PROTOPT_WILDCARD /* flags */
-};
-#endif
-
-static void close_secondarysocket(struct Curl_easy *data,
-                                  struct connectdata *conn)
-{
-  Curl_conn_close(data, SECONDARYSOCKET);
-  Curl_conn_cf_discard_all(data, conn, SECONDARYSOCKET);
-}
-
-/*
- * NOTE: back in the old days, we added code in the FTP code that made NOBODY
- * requests on files respond with headers passed to the client/stdout that
- * looked like HTTP ones.
- *
- * This approach is not very elegant, it causes confusion and is error-prone.
- * It is subject for removal at the next (or at least a future) soname bump.
- * Until then you can test the effects of the removal by undefining the
- * following define named CURL_FTP_HTTPSTYLE_HEAD.
- */
-#define CURL_FTP_HTTPSTYLE_HEAD 1
+static CURLcode getftpresponse(struct Curl_easy *data, size_t *nreadp,
+                               int *ftpcodep);
 
 static void freedirs(struct ftp_conn *ftpc)
 {
-  if(ftpc->dirs) {
-    int i;
-    for(i = 0; i < ftpc->dirdepth; i++) {
-      free(ftpc->dirs[i]);
-      ftpc->dirs[i] = NULL;
-    }
-    free(ftpc->dirs);
-    ftpc->dirs = NULL;
-    ftpc->dirdepth = 0;
-  }
-  Curl_safefree(ftpc->file);
-
-  /* no longer of any use */
-  Curl_safefree(ftpc->newhost);
+  curlx_safefree(ftpc->dirs);
+  ftpc->dirdepth = 0;
+  curlx_safefree(ftpc->rawpath);
+  ftpc->file = NULL;
 }
 
+static size_t numof_slashes(const char *str)
+{
+  const char *slashPos;
+  size_t num = 0;
+  do {
+    slashPos = strchr(str, '/');
+    if(slashPos) {
+      ++num;
+      str = slashPos + 1;
+    }
+  } while(slashPos);
+  return num;
+}
+
+#define FTP_MAX_DIR_DEPTH 1000
+
 /***********************************************************************
  *
- * AcceptServerConnect()
+ * ftp_parse_url_path()
  *
- * After connection request is received from the server this function is
- * called to accept the connection and close the listening socket
+ * Parse the URL path into separate path components.
  *
  */
-static CURLcode AcceptServerConnect(struct Curl_easy *data)
+static CURLcode ftp_parse_url_path(struct Curl_easy *data,
+                                   struct ftp_conn *ftpc,
+                                   struct FTP *ftp)
 {
-  struct connectdata *conn = data->conn;
-  curl_socket_t sock = conn->sock[SECONDARYSOCKET];
-  curl_socket_t s = CURL_SOCKET_BAD;
-#ifdef ENABLE_IPV6
-  struct Curl_sockaddr_storage add;
-#else
-  struct sockaddr_in add;
-#endif
-  curl_socklen_t size = (curl_socklen_t) sizeof(add);
-  CURLcode result;
+  const char *slashPos = NULL;
+  const char *fileName = NULL;
+  CURLcode result = CURLE_OK;
+  const char *rawPath = NULL; /* URL-decoded "raw" path */
+  size_t pathLen = 0;
 
-  if(0 == getsockname(sock, (struct sockaddr *) &add, &size)) {
-    size = sizeof(add);
+  ftpc->ctl_valid = FALSE;
+  ftpc->cwdfail = FALSE;
 
-    s = accept(sock, (struct sockaddr *) &add, &size);
-  }
-
-  if(CURL_SOCKET_BAD == s) {
-    failf(data, "Error accept()ing server connect");
-    return CURLE_FTP_PORT_FAILED;
-  }
-  infof(data, "Connection accepted from server");
-  /* when this happens within the DO state it is important that we mark us as
-     not needing DO_MORE anymore */
-  conn->bits.do_more = FALSE;
-
-  (void)curlx_nonblock(s, TRUE); /* enable non-blocking */
-  /* Replace any filter on SECONDARY with one listening on this socket */
-  result = Curl_conn_tcp_accepted_set(data, conn, SECONDARYSOCKET, &s);
-  if(result)
+  if(ftpc->rawpath)
+    freedirs(ftpc);
+  /* URL-decode ftp path before further evaluation */
+  result = Curl_urldecode(ftp->path, 0, &ftpc->rawpath, &pathLen, REJECT_CTRL);
+  if(result) {
+    failf(data, "path contains control characters");
     return result;
+  }
+  rawPath = ftpc->rawpath;
 
-  if(data->set.fsockopt) {
-    int error = 0;
+  switch(data->set.ftp_filemethod) {
+  case FTPFILE_NOCWD: /* fastest, but less standard-compliant */
 
-    /* activate callback for setting socket options */
-    Curl_set_in_callback(data, true);
-    error = data->set.fsockopt(data->set.sockopt_client,
-                               s,
-                               CURLSOCKTYPE_ACCEPT);
-    Curl_set_in_callback(data, false);
+    if((pathLen > 0) && (rawPath[pathLen - 1] != '/'))
+      fileName = rawPath;  /* this is a full file path */
+    /*
+      else: ftpc->file is not used anywhere other than for operations on
+            a file. In other words, never for directory operations,
+            so we can safely leave filename as NULL here and use it as a
+            argument in dir/file decisions.
+    */
+    break;
 
-    if(error) {
-      close_secondarysocket(data, conn);
-      return CURLE_ABORTED_BY_CALLBACK;
+  case FTPFILE_SINGLECWD:
+    slashPos = strrchr(rawPath, '/');
+    if(slashPos) {
+      /* get path before last slash, except for / */
+      size_t dirlen = slashPos - rawPath;
+      if(dirlen == 0)
+        dirlen = 1;
+
+      ftpc->dirs = curlx_calloc(1, sizeof(ftpc->dirs[0]));
+      if(!ftpc->dirs)
+        return CURLE_OUT_OF_MEMORY;
+
+      ftpc->dirs[0].start = 0;
+      ftpc->dirs[0].len = (int)dirlen;
+      ftpc->dirdepth = 1; /* we consider it to be a single directory */
+      fileName = slashPos + 1; /* rest is filename */
+    }
+    else
+      fileName = rawPath; /* filename only (or empty) */
+    break;
+
+  default: /* allow pretty much anything */
+  case FTPFILE_MULTICWD: {
+    /* current position: begin of next path component */
+    const char *curPos = rawPath;
+
+    /* number of entries to allocate for the 'dirs' array */
+    size_t dirAlloc = numof_slashes(rawPath);
+
+    if(dirAlloc >= FTP_MAX_DIR_DEPTH)
+      /* suspiciously deep directory hierarchy */
+      return CURLE_URL_MALFORMAT;
+
+    if(dirAlloc) {
+      ftpc->dirs = curlx_calloc(dirAlloc, sizeof(ftpc->dirs[0]));
+      if(!ftpc->dirs)
+        return CURLE_OUT_OF_MEMORY;
+
+      /* parse the URL path into separate path components */
+      while(dirAlloc--) {
+        const char *spos = strchr(curPos, '/');
+        size_t clen = spos - curPos;
+
+        /* path starts with a slash: add that as a directory */
+        if(!clen && (ftpc->dirdepth == 0))
+          ++clen;
+
+        /* we skip empty path components, like "x//y" since the FTP command
+           CWD requires a parameter and a non-existent parameter a) does not
+           work on many servers and b) has no effect on the others. */
+        if(clen) {
+          ftpc->dirs[ftpc->dirdepth].start = (int)(curPos - rawPath);
+          ftpc->dirs[ftpc->dirdepth].len = (int)clen;
+          ftpc->dirdepth++;
+        }
+        curPos = spos + 1;
+      }
+    }
+    fileName = curPos; /* the rest is the filename (or empty) */
+  }
+    break;
+  } /* switch */
+
+  if(fileName && *fileName)
+    ftpc->file = fileName;
+  else
+    ftpc->file = NULL; /* instead of point to a zero byte,
+                          we make it a NULL pointer */
+
+  if(data->state.upload && !ftpc->file && (ftp->transfer == PPTRANSFER_BODY)) {
+    /* We need a filename when uploading. Return error! */
+    failf(data, "Uploading to a URL without a filename");
+    return CURLE_URL_MALFORMAT;
+  }
+
+  ftpc->cwddone = FALSE; /* default to not done */
+
+  if((data->set.ftp_filemethod == FTPFILE_NOCWD) && (rawPath[0] == '/'))
+    ftpc->cwddone = TRUE; /* skip CWD for absolute paths */
+  else { /* newly created FTP connections are already in entry path */
+    const char *oldPath = data->conn->bits.reuse ? ftpc->prevpath : "";
+    if(oldPath) {
+      size_t n = pathLen;
+      if(data->set.ftp_filemethod == FTPFILE_NOCWD)
+        n = 0; /* CWD to entry for relative paths */
+      else
+        n -= ftpc->file ? strlen(ftpc->file) : 0;
+
+      if((strlen(oldPath) == n) && rawPath && !strncmp(rawPath, oldPath, n)) {
+        infof(data, "Request has same path as previous transfer");
+        ftpc->cwddone = TRUE;
+      }
     }
   }
 
   return CURLE_OK;
-
 }
 
-/*
- * ftp_timeleft_accept() returns the amount of milliseconds left allowed for
- * waiting server to connect. If the value is negative, the timeout time has
- * already elapsed.
- *
- * The start time is stored in progress.t_acceptdata - as set with
- * Curl_pgrsTime(..., TIMER_STARTACCEPT);
- *
- */
-static timediff_t ftp_timeleft_accept(struct Curl_easy *data)
-{
-  timediff_t timeout_ms = DEFAULT_ACCEPT_TIMEOUT;
-  timediff_t other;
-  struct curltime now;
-
-  if(data->set.accepttimeout > 0)
-    timeout_ms = data->set.accepttimeout;
-
-  now = Curl_now();
-
-  /* check if the generic timeout possibly is set shorter */
-  other = Curl_timeleft(data, &now, FALSE);
-  if(other && (other < timeout_ms))
-    /* note that this also works fine for when other happens to be negative
-       due to it already having elapsed */
-    timeout_ms = other;
-  else {
-    /* subtract elapsed time */
-    timeout_ms -= Curl_timediff(now, data->progress.t_acceptdata);
-    if(!timeout_ms)
-      /* avoid returning 0 as that means no timeout! */
-      return -1;
-  }
-
-  return timeout_ms;
-}
-
-
 /***********************************************************************
  *
- * ReceivedServerConnect()
+ * ftp_need_type()
  *
- * After allowing server to connect to us from data port, this function
- * checks both data connection for connection establishment and ctrl
- * connection for a negative response regarding a failure in connecting
+ * Returns TRUE if we in the current situation should send TYPE
+ */
+static int ftp_need_type(struct ftp_conn *ftpc,
+                         bool ascii_wanted)
+{
+  return ftpc->transfertype != (ascii_wanted ? 'A' : 'I');
+}
+
+static void close_secondarysocket(struct Curl_easy *data,
+                                  struct ftp_conn *ftpc)
+{
+  (void)ftpc;
+  CURL_TRC_FTP(data, "[%s] closing DATA connection", FTP_CSTATE(ftpc));
+  Curl_conn_cf_discard_all(data, data->conn, SECONDARYSOCKET);
+}
+
+#ifdef CURL_PREFER_LF_LINEENDS
+/*
+ * Lineend Conversions
+ * On ASCII transfers, e.g. directory listings, we might get lines
+ * ending in '\r\n' and we prefer '\n'.
+ * We might also get a lonely '\r' which we convert into a '\n'.
+ */
+struct ftp_cw_lc_ctx {
+  struct Curl_cwriter super;
+  bool newline_pending;
+};
+
+static CURLcode ftp_cw_lc_write(struct Curl_easy *data,
+                                struct Curl_cwriter *writer, int type,
+                                const char *buf, size_t blen)
+{
+  static const char nl = '\n';
+  struct ftp_cw_lc_ctx *ctx = writer->ctx;
+  struct ftp_conn *ftpc = Curl_conn_meta_get(data->conn, CURL_META_FTP_CONN);
+
+  if(!ftpc)
+    return CURLE_FAILED_INIT;
+
+  if(!(type & CLIENTWRITE_BODY) || ftpc->transfertype != 'A')
+    return Curl_cwriter_write(data, writer->next, type, buf, blen);
+
+  /* ASCII mode BODY data, convert lineends */
+  while(blen) {
+    /* do not pass EOS when writing parts */
+    int chunk_type = (type & ~CLIENTWRITE_EOS);
+    const char *cp;
+    size_t chunk_len;
+    CURLcode result;
+
+    if(ctx->newline_pending) {
+      if(buf[0] != '\n') {
+        /* previous chunk ended in '\r' and we do not see a '\n' in this one,
+         * need to write a newline. */
+        result = Curl_cwriter_write(data, writer->next, chunk_type, &nl, 1);
+        if(result)
+          return result;
+      }
+      /* either we wrote the newline or it is part of the next chunk of bytes
+       * we write. */
+      ctx->newline_pending = FALSE;
+    }
+
+    cp = memchr(buf, '\r', blen);
+    if(!cp)
+      break;
+
+    /* write the bytes before the '\r', excluding the '\r' */
+    chunk_len = cp - buf;
+    if(chunk_len) {
+      result = Curl_cwriter_write(data, writer->next, chunk_type,
+                                  buf, chunk_len);
+      if(result)
+        return result;
+    }
+    /* skip the '\r', we now have a newline pending */
+    buf = cp + 1;
+    blen = blen - chunk_len - 1;
+    ctx->newline_pending = TRUE;
+  }
+
+  /* Any remaining data does not contain a '\r' */
+  if(blen) {
+    DEBUGASSERT(!ctx->newline_pending);
+    return Curl_cwriter_write(data, writer->next, type, buf, blen);
+  }
+  else if(type & CLIENTWRITE_EOS) {
+    /* EndOfStream, if we have a trailing cr, now is the time to write it */
+    if(ctx->newline_pending) {
+      ctx->newline_pending = FALSE;
+      return Curl_cwriter_write(data, writer->next, type, &nl, 1);
+    }
+    /* Always pass on the EOS type indicator */
+    return Curl_cwriter_write(data, writer->next, type, buf, 0);
+  }
+  return CURLE_OK;
+}
+
+static const struct Curl_cwtype ftp_cw_lc = {
+  "ftp-lineconv",
+  NULL,
+  Curl_cwriter_def_init,
+  ftp_cw_lc_write,
+  Curl_cwriter_def_close,
+  sizeof(struct ftp_cw_lc_ctx)
+};
+
+#endif /* CURL_PREFER_LF_LINEENDS */
+
+/***********************************************************************
+ *
+ * ftp_check_ctrl_on_data_wait()
  *
  */
-static CURLcode ReceivedServerConnect(struct Curl_easy *data, bool *received)
+static CURLcode ftp_check_ctrl_on_data_wait(struct Curl_easy *data,
+                                            struct ftp_conn *ftpc)
 {
   struct connectdata *conn = data->conn;
   curl_socket_t ctrl_sock = conn->sock[FIRSTSOCKET];
-  curl_socket_t data_sock = conn->sock[SECONDARYSOCKET];
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
   struct pingpong *pp = &ftpc->pp;
-  int result;
-  timediff_t timeout_ms;
-  ssize_t nread;
+  size_t nread;
   int ftpcode;
-
-  *received = FALSE;
-
-  timeout_ms = ftp_timeleft_accept(data);
-  infof(data, "Checking for server connect");
-  if(timeout_ms < 0) {
-    /* if a timeout was already reached, bail out */
-    failf(data, "Accept timeout occurred while waiting server connect");
-    return CURLE_FTP_ACCEPT_TIMEOUT;
-  }
+  bool response = FALSE;
 
   /* First check whether there is a cached response from server */
-  if(pp->cache_size && pp->cache && pp->cache[0] > '3') {
-    /* Data connection could not be established, let's return */
-    infof(data, "There is negative response in cache while serv connect");
-    (void)Curl_GetFTPResponse(data, &nread, &ftpcode);
-    return CURLE_FTP_ACCEPT_FAILED;
+  if(curlx_dyn_len(&pp->recvbuf)) {
+    const char *l = curlx_dyn_ptr(&pp->recvbuf);
+    if(!ISDIGIT(*l) || (*l > '3')) {
+      /* Data connection could not be established, let's return */
+      infof(data, "There is negative response in cache while serv connect");
+      (void)getftpresponse(data, &nread, &ftpcode);
+      return CURLE_FTP_ACCEPT_FAILED;
+    }
   }
 
-  result = Curl_socket_check(ctrl_sock, data_sock, CURL_SOCKET_BAD, 0);
-
-  /* see if the connection request is already here */
-  switch(result) {
-  case -1: /* error */
-    /* let's die here */
-    failf(data, "Error while waiting for server connect");
-    return CURLE_FTP_ACCEPT_FAILED;
-  case 0:  /* Server connect is not received yet */
-    break; /* loop */
-  default:
-
-    if(result & CURL_CSELECT_IN2) {
-      infof(data, "Ready to accept data connection from server");
-      *received = TRUE;
+  if(pp->overflow)
+    /* there is pending control data still in the buffer to read */
+    response = TRUE;
+  else {
+    int socketstate = SOCKET_READABLE(ctrl_sock, 0);
+    /* see if the connection request is already here */
+    switch(socketstate) {
+    case -1: /* error */
+      /* let's die here */
+      failf(data, "Error while waiting for server connect");
+      return CURLE_FTP_ACCEPT_FAILED;
+    default:
+      if(socketstate & CURL_CSELECT_IN)
+        response = TRUE;
+      break;
     }
-    else if(result & CURL_CSELECT_IN) {
-      infof(data, "Ctrl conn has data while waiting for data conn");
-      (void)Curl_GetFTPResponse(data, &nread, &ftpcode);
+  }
 
-      if(ftpcode/100 > 3)
-        return CURLE_FTP_ACCEPT_FAILED;
+  if(response) {
+    infof(data, "Ctrl conn has data while waiting for data conn");
+    if(pp->overflow > 3) {
+      const char *r = curlx_dyn_ptr(&pp->recvbuf);
+      size_t len = curlx_dyn_len(&pp->recvbuf);
 
-      return CURLE_WEIRD_SERVER_REPLY;
+      DEBUGASSERT((pp->overflow + pp->nfinal) <= curlx_dyn_len(&pp->recvbuf));
+      /* move over the most recently handled response line */
+      r += pp->nfinal;
+      len -= pp->nfinal;
+
+      if((len > 3) && LASTLINE(r)) {
+        curl_off_t status;
+        if(!curlx_str_number(&r, &status, 999) && (status == 226)) {
+          /* funny timing situation where we get the final message on the
+             control connection before traffic on the data connection has been
+             noticed. Leave the 226 in there and use this as a trigger to read
+             the data socket. */
+          infof(data, "Got 226 before data activity");
+          return CURLE_OK;
+        }
+      }
     }
 
-    break;
-  } /* switch() */
+    (void)getftpresponse(data, &nread, &ftpcode);
+
+    infof(data, "FTP code: %03d", ftpcode);
+
+    if(ftpcode / 100 > 3)
+      return CURLE_FTP_ACCEPT_FAILED;
+
+    return CURLE_WEIRD_SERVER_REPLY;
+  }
 
   return CURLE_OK;
 }
 
-
 /***********************************************************************
  *
- * InitiateTransfer()
+ * ftp_initiate_transfer()
  *
  * After connection from server is accepted this function is called to
  * setup transfer parameters and initiate the data transfer.
  *
  */
-static CURLcode InitiateTransfer(struct Curl_easy *data)
+static CURLcode ftp_initiate_transfer(struct Curl_easy *data,
+                                      struct ftp_conn *ftpc)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
   bool connected;
 
-  DEBUGF(infof(data, "ftp InitiateTransfer()"));
-  if(conn->bits.ftp_use_data_ssl && data->set.ftp_use_port &&
-     !Curl_conn_is_ssl(conn, SECONDARYSOCKET)) {
-    result = Curl_ssl_cfilter_add(data, conn, SECONDARYSOCKET);
-    if(result)
-      return result;
-  }
+  CURL_TRC_FTP(data, "ftp_initiate_transfer()");
   result = Curl_conn_connect(data, SECONDARYSOCKET, TRUE, &connected);
   if(result || !connected)
     return result;
 
-  if(conn->proto.ftpc.state_saved == FTP_STOR) {
-    /* When we know we're uploading a specified file, we can get the file
+  if(data->state.upload) {
+    /* When we know we are uploading a specified file, we can get the file
        size prior to the actual upload. */
     Curl_pgrsSetUploadSize(data, data->state.infilesize);
 
-    /* set the SO_SNDBUF for the secondary socket for those who need it */
-    Curl_sndbufset(conn->sock[SECONDARYSOCKET]);
-
-    Curl_setup_transfer(data, -1, -1, FALSE, SECONDARYSOCKET);
+    /* FTP upload, shutdown DATA, ignore shutdown errors, as we rely
+     * on the server response on the CONTROL connection. */
+    Curl_xfer_setup_send(data, SECONDARYSOCKET);
+    Curl_xfer_set_shutdown(data, TRUE, TRUE);
   }
   else {
-    /* FTP download: */
-    Curl_setup_transfer(data, SECONDARYSOCKET,
-                        conn->proto.ftpc.retr_size_saved, FALSE, -1);
+    /* FTP download, shutdown, do not ignore errors */
+    Curl_xfer_setup_recv(data, SECONDARYSOCKET, data->req.size);
+    Curl_xfer_set_shutdown(data, TRUE, FALSE);
   }
 
-  conn->proto.ftpc.pp.pending_resp = TRUE; /* expect server response */
-  ftp_state(data, FTP_STOP);
+  ftpc->pp.pending_resp = TRUE; /* expect server response */
+  ftp_state(data, ftpc, FTP_STOP);
 
   return CURLE_OK;
 }
 
-/***********************************************************************
- *
- * AllowServerConnect()
- *
- * When we've issue the PORT command, we have told the server to connect to
- * us. This function checks whether data connection is established if so it is
- * accepted.
- *
- */
-static CURLcode AllowServerConnect(struct Curl_easy *data, bool *connected)
-{
-  timediff_t timeout_ms;
-  CURLcode result = CURLE_OK;
-
-  *connected = FALSE;
-  infof(data, "Preparing for accepting server on data port");
-
-  /* Save the time we start accepting server connect */
-  Curl_pgrsTime(data, TIMER_STARTACCEPT);
-
-  timeout_ms = ftp_timeleft_accept(data);
-  if(timeout_ms < 0) {
-    /* if a timeout was already reached, bail out */
-    failf(data, "Accept timeout occurred while waiting server connect");
-    result = CURLE_FTP_ACCEPT_TIMEOUT;
-    goto out;
-  }
-
-  /* see if the connection request is already here */
-  result = ReceivedServerConnect(data, connected);
-  if(result)
-    goto out;
-
-  if(*connected) {
-    result = AcceptServerConnect(data);
-    if(result)
-      goto out;
-
-    result = InitiateTransfer(data);
-    if(result)
-      goto out;
-  }
-  else {
-    /* Add timeout to multi handle and break out of the loop */
-    Curl_expire(data, data->set.accepttimeout ?
-                data->set.accepttimeout: DEFAULT_ACCEPT_TIMEOUT,
-                EXPIRE_FTP_ACCEPT);
-  }
-
-out:
-  DEBUGF(infof(data, "ftp AllowServerConnect() -> %d", result));
-  return result;
-}
-
-/* macro to check for a three-digit ftp status code at the start of the
-   given string */
-#define STATUSCODE(line) (ISDIGIT(line[0]) && ISDIGIT(line[1]) &&       \
-                          ISDIGIT(line[2]))
-
-/* macro to check for the last line in an FTP server response */
-#define LASTLINE(line) (STATUSCODE(line) && (' ' == line[3]))
-
 static bool ftp_endofresp(struct Curl_easy *data, struct connectdata *conn,
-                          char *line, size_t len, int *code)
+                          const char *line, size_t len, int *code)
 {
+  curl_off_t status;
   (void)data;
   (void)conn;
 
-  if((len > 3) && LASTLINE(line)) {
-    *code = curlx_sltosi(strtol(line, NULL, 10));
+  if((len > 3) && LASTLINE(line) && !curlx_str_number(&line, &status, 999)) {
+    *code = (int)status;
     return TRUE;
   }
 
@@ -542,44 +589,23 @@ static bool ftp_endofresp(struct Curl_easy *data, struct connectdata *conn,
 }
 
 static CURLcode ftp_readresp(struct Curl_easy *data,
-                             curl_socket_t sockfd,
+                             struct ftp_conn *ftpc,
+                             int sockindex,
                              struct pingpong *pp,
-                             int *ftpcode, /* return the ftp-code if done */
+                             int *ftpcodep, /* return the ftp-code if done */
                              size_t *size) /* size of the response */
 {
   int code;
-  CURLcode result = Curl_pp_readresp(data, sockfd, pp, &code, size);
+  CURLcode result = Curl_pp_readresp(data, sockindex, pp, &code, size);
+  DEBUGASSERT(ftpcodep);
 
-#ifdef HAVE_GSSAPI
-  {
-    struct connectdata *conn = data->conn;
-    char * const buf = data->state.buffer;
+  /* store the latest code for later retrieval, except during shutdown */
+  if(!ftpc->shutdown)
+    data->info.httpcode = code;
 
-    /* handle the security-oriented responses 6xx ***/
-    switch(code) {
-    case 631:
-      code = Curl_sec_read_msg(data, conn, buf, PROT_SAFE);
-      break;
-    case 632:
-      code = Curl_sec_read_msg(data, conn, buf, PROT_PRIVATE);
-      break;
-    case 633:
-      code = Curl_sec_read_msg(data, conn, buf, PROT_CONFIDENTIAL);
-      break;
-    default:
-      /* normal ftp stuff we pass through! */
-      break;
-    }
-  }
-#endif
+  *ftpcodep = code;
 
-  /* store the latest code for later retrieval */
-  data->info.httpcode = code;
-
-  if(ftpcode)
-    *ftpcode = code;
-
-  if(421 == code) {
+  if(code == 421) {
     /* 421 means "Service not available, closing control connection." and FTP
      * servers use it to signal that idle session timeout has been exceeded.
      * If we ignored the response, it could end up hanging in some cases.
@@ -588,7 +614,7 @@ static CURLcode ftp_readresp(struct Curl_easy *data,
      * generically is a good idea.
      */
     infof(data, "We got a 421 - timeout");
-    ftp_state(data, FTP_STOP);
+    ftp_state(data, ftpc, FTP_STOP);
     return CURLE_OPERATION_TIMEDOUT;
   }
 
@@ -598,42 +624,41 @@ static CURLcode ftp_readresp(struct Curl_easy *data,
 /* --- parse FTP server responses --- */
 
 /*
- * Curl_GetFTPResponse() is a BLOCKING function to read the full response
- * from a server after a command.
+ * getftpresponse() is a BLOCKING function to read the full response from a
+ * server after a command.
  *
  */
-
-CURLcode Curl_GetFTPResponse(struct Curl_easy *data,
-                             ssize_t *nreadp, /* return number of bytes read */
-                             int *ftpcode) /* return the ftp-code */
+static CURLcode getftpresponse(struct Curl_easy *data,
+                               size_t *nreadp, /* return number of bytes
+                                                  read */
+                               int *ftpcodep) /* return the ftp-code */
 {
   /*
-   * We cannot read just one byte per read() and then go back to select() as
-   * the OpenSSL read() doesn't grok that properly.
+   * We cannot read one byte per read() and then go back to select() as the
+   * OpenSSL read() does not grok that properly.
    *
    * Alas, read as much as possible, split up into lines, use the ending
-   * line in a response or continue reading.  */
+   * line in a response or continue reading. */
 
   struct connectdata *conn = data->conn;
   curl_socket_t sockfd = conn->sock[FIRSTSOCKET];
   CURLcode result = CURLE_OK;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
+  struct ftp_conn *ftpc = Curl_conn_meta_get(data->conn, CURL_META_FTP_CONN);
   struct pingpong *pp = &ftpc->pp;
   size_t nread;
   int cache_skip = 0;
-  int value_to_be_ignored = 0;
-
-  if(ftpcode)
-    *ftpcode = 0; /* 0 for errors */
-  else
-    /* make the pointer point to something for the rest of this function */
-    ftpcode = &value_to_be_ignored;
+  DEBUGASSERT(ftpcodep);
 
+  CURL_TRC_FTP(data, "getftpresponse start");
   *nreadp = 0;
+  *ftpcodep = 0; /* 0 for errors */
 
-  while(!*ftpcode && !result) {
+  if(!ftpc)
+    return CURLE_FAILED_INIT;
+
+  while(!*ftpcodep && !result) {
     /* check and reset timeout value every lap */
-    timediff_t timeout = Curl_pp_state_timeout(data, pp, FALSE);
+    timediff_t timeout = Curl_pp_state_timeleft_ms(data, pp);
     timediff_t interval_ms;
 
     if(timeout <= 0) {
@@ -652,42 +677,47 @@ CURLcode Curl_GetFTPResponse(struct Curl_easy *data,
      *
      * A caution here is that the ftp_readresp() function has a cache that may
      * contain pieces of a response from the previous invoke and we need to
-     * make sure we don't just wait for input while there is unhandled data in
-     * that cache. But also, if the cache is there, we call ftp_readresp() and
-     * the cache wasn't good enough to continue we must not just busy-loop
-     * around this function.
+     * make sure we do not wait for input while there is unhandled data in
+     * that cache. Also, if the cache is there, we call ftp_readresp() and
+     * the cache was not good enough to continue we must not busy-loop around
+     * this function.
      *
      */
 
-    if(pp->cache && (cache_skip < 2)) {
+    if(curlx_dyn_len(&pp->recvbuf) && (cache_skip < 2)) {
       /*
-       * There's a cache left since before. We then skipping the wait for
+       * There is a cache left since before. We then skipping the wait for
        * socket action, unless this is the same cache like the previous round
        * as then the cache was deemed not enough to act on and we then need to
        * wait for more data anyway.
        */
     }
     else if(!Curl_conn_data_pending(data, FIRSTSOCKET)) {
-      switch(SOCKET_READABLE(sockfd, interval_ms)) {
-      case -1: /* select() error, stop reading */
+      curl_socket_t wsock = Curl_pp_needs_flush(data, pp) ?
+        sockfd : CURL_SOCKET_BAD;
+      int ev = Curl_socket_check(sockfd, CURL_SOCKET_BAD, wsock, interval_ms);
+      if(ev < 0) {
         failf(data, "FTP response aborted due to select/poll error: %d",
               SOCKERRNO);
         return CURLE_RECV_ERROR;
-
-      case 0: /* timeout */
-        if(Curl_pgrsUpdate(data))
-          return CURLE_ABORTED_BY_CALLBACK;
-        continue; /* just continue in our loop for the timeout duration */
-
-      default: /* for clarity */
-        break;
+      }
+      else if(ev == 0) {
+        result = Curl_pgrsUpdate(data);
+        continue; /* continue in our loop for the timeout duration */
       }
     }
-    result = ftp_readresp(data, sockfd, pp, ftpcode, &nread);
+
+    if(Curl_pp_needs_flush(data, pp)) {
+      result = Curl_pp_flushsend(data, pp);
+      if(result)
+        break;
+    }
+
+    result = ftp_readresp(data, ftpc, FIRSTSOCKET, pp, ftpcodep, &nread);
     if(result)
       break;
 
-    if(!nread && pp->cache)
+    if(!nread && curlx_dyn_len(&pp->recvbuf))
       /* bump cache skip counter as on repeated skips we must wait for more
          data */
       cache_skip++;
@@ -698,143 +728,91 @@ CURLcode Curl_GetFTPResponse(struct Curl_easy *data,
 
     *nreadp += nread;
 
-  } /* while there's buffer left and loop is requested */
+  } /* while there is buffer left and loop is requested */
 
   pp->pending_resp = FALSE;
+  CURL_TRC_FTP(data, "getftpresponse -> result=%d, nread=%zu, ftpcode=%d",
+               (int)result, *nreadp, *ftpcodep);
 
   return result;
 }
 
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
-  /* for debug purposes */
-static const char * const ftp_state_names[]={
-  "STOP",
-  "WAIT220",
-  "AUTH",
-  "USER",
-  "PASS",
-  "ACCT",
-  "PBSZ",
-  "PROT",
-  "CCC",
-  "PWD",
-  "SYST",
-  "NAMEFMT",
-  "QUOTE",
-  "RETR_PREQUOTE",
-  "STOR_PREQUOTE",
-  "POSTQUOTE",
-  "CWD",
-  "MKD",
-  "MDTM",
-  "TYPE",
-  "LIST_TYPE",
-  "RETR_TYPE",
-  "STOR_TYPE",
-  "SIZE",
-  "RETR_SIZE",
-  "STOR_SIZE",
-  "REST",
-  "RETR_REST",
-  "PORT",
-  "PRET",
-  "PASV",
-  "LIST",
-  "RETR",
-  "STOR",
-  "QUIT"
-};
-#endif
-
-/* This is the ONLY way to change FTP state! */
-static void _ftp_state(struct Curl_easy *data,
-                       ftpstate newstate
-#ifdef DEBUGBUILD
-                       , int lineno
-#endif
-  )
-{
-  struct connectdata *conn = data->conn;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
-
-#if defined(DEBUGBUILD)
-
-#if defined(CURL_DISABLE_VERBOSE_STRINGS)
-  (void) lineno;
-#else
-  if(ftpc->state != newstate)
-    infof(data, "FTP %p (line %d) state change from %s to %s",
-          (void *)ftpc, lineno, ftp_state_names[ftpc->state],
-          ftp_state_names[newstate]);
-#endif
-#endif
-
-  ftpc->state = newstate;
-}
-
 static CURLcode ftp_state_user(struct Curl_easy *data,
+                               struct ftp_conn *ftpc,
                                struct connectdata *conn)
 {
-  CURLcode result = Curl_pp_sendf(data,
-                                  &conn->proto.ftpc.pp, "USER %s",
-                                  conn->user?conn->user:"");
+  CURLcode result = Curl_pp_sendf(data, &ftpc->pp, "USER %s",
+                                  Curl_creds_user(conn->creds));
   if(!result) {
-    struct ftp_conn *ftpc = &conn->proto.ftpc;
     ftpc->ftp_trying_alternative = FALSE;
-    ftp_state(data, FTP_USER);
+    ftp_state(data, ftpc, FTP_USER);
   }
   return result;
 }
 
 static CURLcode ftp_state_pwd(struct Curl_easy *data,
-                              struct connectdata *conn)
+                              struct ftp_conn *ftpc)
 {
-  CURLcode result = Curl_pp_sendf(data, &conn->proto.ftpc.pp, "%s", "PWD");
+  CURLcode result;
+#ifdef DEBUGBUILD
+  if(!data->id && getenv("CURL_FTP_PWD_STOP"))
+    return CURLE_OK;
+#endif
+  result = Curl_pp_sendf(data, &ftpc->pp, "%s", "PWD");
   if(!result)
-    ftp_state(data, FTP_PWD);
+    ftp_state(data, ftpc, FTP_PWD);
 
   return result;
 }
 
 /* For the FTP "protocol connect" and "doing" phases only */
-static int ftp_getsock(struct Curl_easy *data,
-                       struct connectdata *conn,
-                       curl_socket_t *socks)
+static CURLcode ftp_pollset(struct Curl_easy *data,
+                            struct easy_pollset *ps)
 {
-  return Curl_pp_getsock(data, &conn->proto.ftpc.pp, socks);
+  struct ftp_conn *ftpc = Curl_conn_meta_get(data->conn, CURL_META_FTP_CONN);
+  return ftpc ? Curl_pp_pollset(data, &ftpc->pp, ps) : CURLE_OK;
 }
 
 /* For the FTP "DO_MORE" phase only */
-static int ftp_domore_getsock(struct Curl_easy *data,
-                              struct connectdata *conn, curl_socket_t *socks)
+static CURLcode ftp_domore_pollset(struct Curl_easy *data,
+                                   struct easy_pollset *ps)
 {
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
-  (void)data;
+  struct ftp_conn *ftpc = Curl_conn_meta_get(data->conn, CURL_META_FTP_CONN);
+
+  if(!ftpc)
+    return CURLE_OK;
 
   /* When in DO_MORE state, we could be either waiting for us to connect to a
-   * remote site, or we could wait for that site to connect to us. Or just
-   * handle ordinary commands.
+   * remote site, or we could wait for that site to connect to us. Or handle
+   * ordinary commands.
    */
-
-  DEBUGF(infof(data, "ftp_domore_getsock()"));
-  if(conn->cfilter[SECONDARYSOCKET]
-     && !Curl_conn_is_connected(conn, SECONDARYSOCKET))
-    return Curl_conn_get_select_socks(data, SECONDARYSOCKET, socks);
+  CURL_TRC_FTP(data, "[%s] ftp_domore_pollset()", FTP_CSTATE(ftpc));
 
   if(FTP_STOP == ftpc->state) {
-    int bits = GETSOCK_READSOCK(0);
-
-    /* if stopped and still in this state, then we're also waiting for a
+    /* if stopped and still in this state, then we are also waiting for a
        connect on the secondary connection */
-    socks[0] = conn->sock[FIRSTSOCKET];
-    if(conn->sock[SECONDARYSOCKET] != CURL_SOCKET_BAD) {
-      socks[1] = conn->sock[SECONDARYSOCKET];
-      bits |= GETSOCK_WRITESOCK(1) | GETSOCK_READSOCK(1);
-    }
-
-    return bits;
+    DEBUGASSERT(data->conn->sock[SECONDARYSOCKET] != CURL_SOCKET_BAD ||
+                (data->conn->cfilter[SECONDARYSOCKET] &&
+                 !Curl_conn_is_connected(data->conn, SECONDARYSOCKET)));
+    /* An unconnected SECONDARY will add its socket by itself
+     * via its adjust_pollset() */
+    return Curl_pollset_add_in(data, ps, data->conn->sock[FIRSTSOCKET]);
   }
-  return Curl_pp_getsock(data, &conn->proto.ftpc.pp, socks);
+  return Curl_pp_pollset(data, &ftpc->pp, ps);
+}
+
+static int pathlen(struct ftp_conn *ftpc, int num)
+{
+  DEBUGASSERT(ftpc->dirs);
+  DEBUGASSERT(ftpc->dirdepth > num);
+  return ftpc->dirs[num].len;
+}
+
+static const char *pathpiece(struct ftp_conn *ftpc, int num)
+{
+  DEBUGASSERT(ftpc->dirs);
+  DEBUGASSERT(ftpc->dirdepth > num);
+  return &ftpc->rawpath[ftpc->dirs[num].start];
 }
 
 /* This is called after the FTP_QUOTE state is passed.
@@ -844,24 +822,24 @@ static int ftp_domore_getsock(struct Curl_easy *data,
    missing ones, if that option is enabled.
 */
 static CURLcode ftp_state_cwd(struct Curl_easy *data,
-                              struct connectdata *conn)
+                              struct ftp_conn *ftpc,
+                              struct FTP *ftp)
 {
   CURLcode result = CURLE_OK;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
 
   if(ftpc->cwddone)
     /* already done and fine */
-    result = ftp_state_mdtm(data);
+    result = ftp_state_mdtm(data, ftpc, ftp);
   else {
     /* FTPFILE_NOCWD with full path: expect ftpc->cwddone! */
     DEBUGASSERT((data->set.ftp_filemethod != FTPFILE_NOCWD) ||
-                !(ftpc->dirdepth && ftpc->dirs[0][0] == '/'));
+                !(ftpc->dirdepth && ftpc->rawpath[0] == '/'));
 
     ftpc->count2 = 0; /* count2 counts failed CWDs */
 
-    if(conn->bits.reuse && ftpc->entrypath &&
+    if(data->conn->bits.reuse && ftpc->entrypath &&
        /* no need to go to entrypath when we have an absolute path */
-       !(ftpc->dirdepth && ftpc->dirs[0][0] == '/')) {
+       !(ftpc->dirdepth && ftpc->rawpath[0] == '/')) {
       /* This is a reused connection. Since we change directory to where the
          transfer is taking place, we must first get back to the original dir
          where we ended up after login: */
@@ -869,21 +847,21 @@ static CURLcode ftp_state_cwd(struct Curl_easy *data,
                              for all upcoming ones in the ftp->dirs[] array */
       result = Curl_pp_sendf(data, &ftpc->pp, "CWD %s", ftpc->entrypath);
       if(!result)
-        ftp_state(data, FTP_CWD);
+        ftp_state(data, ftpc, FTP_CWD);
     }
     else {
       if(ftpc->dirdepth) {
         ftpc->cwdcount = 1;
         /* issue the first CWD, the rest is sent when the CWD responses are
            received... */
-        result = Curl_pp_sendf(data, &ftpc->pp, "CWD %s",
-                               ftpc->dirs[ftpc->cwdcount -1]);
+        result = Curl_pp_sendf(data, &ftpc->pp, "CWD %.*s",
+                               pathlen(ftpc, 0), pathpiece(ftpc, 0));
         if(!result)
-          ftp_state(data, FTP_CWD);
+          ftp_state(data, ftpc, FTP_CWD);
       }
       else {
         /* No CWD necessary */
-        result = ftp_state_mdtm(data);
+        result = ftp_state_mdtm(data, ftpc, ftp);
       }
     }
   }
@@ -896,286 +874,370 @@ typedef enum {
   DONE
 } ftpport;
 
-static CURLcode ftp_state_use_port(struct Curl_easy *data,
-                                   ftpport fcmd) /* start with this */
+/*
+ * Parse the CURLOPT_FTPPORT string
+ * "(ipv4|ipv6|domain|interface)?(:port(-range)?)?"
+ * and extract addr/addrlen and port_min/port_max.
+ */
+static CURLcode ftp_port_parse_string(struct Curl_easy *data,
+                                      struct connectdata *conn,
+                                      const char *string_ftpport,
+                                      struct Curl_sockaddr_storage *ss,
+                                      unsigned short *port_minp,
+                                      unsigned short *port_maxp,
+                                      const char **hostp,
+                                      char *hbuf, size_t hbuflen)
 {
-  CURLcode result = CURLE_FTP_PORT_FAILED;
-  struct connectdata *conn = data->conn;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
-  curl_socket_t portsock = CURL_SOCKET_BAD;
-  char myhost[MAX_IPADR_LEN + 1] = "";
-
-  struct Curl_sockaddr_storage ss;
-  struct Curl_addrinfo *res, *ai;
-  curl_socklen_t sslen;
-  char hbuf[NI_MAXHOST];
-  struct sockaddr *sa = (struct sockaddr *)&ss;
-  struct sockaddr_in * const sa4 = (void *)sa;
-#ifdef ENABLE_IPV6
-  struct sockaddr_in6 * const sa6 = (void *)sa;
-#endif
-  static const char mode[][5] = { "EPRT", "PORT" };
-  enum resolve_t rc;
-  int error;
-  char *host = NULL;
-  char *string_ftpport = data->set.str[STRING_FTPPORT];
-  struct Curl_dns_entry *h = NULL;
+  const char *ip_end = NULL;
+  const char *addr = NULL;
+  size_t addrlen = 0;
   unsigned short port_min = 0;
   unsigned short port_max = 0;
-  unsigned short port;
-  bool possibly_non_local = TRUE;
-  char buffer[STRERROR_LEN];
-  char *addr = NULL;
-
-  /* Step 1, figure out what is requested,
-   * accepted format :
-   * (ipv4|ipv6|domain|interface)?(:port(-range)?)?
-   */
-
-  if(data->set.str[STRING_FTPPORT] &&
-     (strlen(data->set.str[STRING_FTPPORT]) > 1)) {
-
-#ifdef ENABLE_IPV6
-    size_t addrlen = INET6_ADDRSTRLEN > strlen(string_ftpport) ?
-      INET6_ADDRSTRLEN : strlen(string_ftpport);
-#else
-    size_t addrlen = INET_ADDRSTRLEN > strlen(string_ftpport) ?
-      INET_ADDRSTRLEN : strlen(string_ftpport);
+  char ipstr[50];
+#ifndef USE_IPV6
+  (void)conn;
+  (void)ss;
 #endif
-    char *ip_start = string_ftpport;
-    char *ip_end = NULL;
-    char *port_start = NULL;
-    char *port_sep = NULL;
 
-    addr = calloc(addrlen + 1, 1);
-    if(!addr) {
-      result = CURLE_OUT_OF_MEMORY;
-      goto out;
-    }
+  /* default to nothing */
+  *hostp = NULL;
+  *port_minp = *port_maxp = 0;
 
-#ifdef ENABLE_IPV6
-    if(*string_ftpport == '[') {
-      /* [ipv6]:port(-range) */
-      ip_start = string_ftpport + 1;
-      ip_end = strchr(string_ftpport, ']');
-      if(ip_end)
-        strncpy(addr, ip_start, ip_end - ip_start);
-    }
-    else
-#endif
-      if(*string_ftpport == ':') {
-        /* :port */
-        ip_end = string_ftpport;
-      }
-      else {
-        ip_end = strchr(string_ftpport, ':');
-        if(ip_end) {
-          /* either ipv6 or (ipv4|domain|interface):port(-range) */
-#ifdef ENABLE_IPV6
-          if(Curl_inet_pton(AF_INET6, string_ftpport, &sa6->sin6_addr) == 1) {
-            /* ipv6 */
-            port_min = port_max = 0;
-            strcpy(addr, string_ftpport);
-            ip_end = NULL; /* this got no port ! */
-          }
-          else
-#endif
-            /* (ipv4|domain|interface):port(-range) */
-            strncpy(addr, string_ftpport, ip_end - ip_start);
-        }
-        else
-          /* ipv4|interface */
-          strcpy(addr, string_ftpport);
-      }
+  if(!string_ftpport || (strlen(string_ftpport) <= 1))
+    goto done;
 
-    /* parse the port */
+#ifdef USE_IPV6
+  if(*string_ftpport == '[') {
+    /* [ipv6]:port(-range) */
+    const char *ip_start = string_ftpport + 1;
+    ip_end = strchr(ip_start, ']');
     if(ip_end) {
-      port_start = strchr(ip_end, ':');
-      if(port_start) {
-        port_min = curlx_ultous(strtoul(port_start + 1, NULL, 10));
-        port_sep = strchr(port_start, '-');
-        if(port_sep) {
-          port_max = curlx_ultous(strtoul(port_sep + 1, NULL, 10));
+      addrlen = ip_end - ip_start;
+      addr = ip_start;
+    }
+  }
+  else
+#endif
+    if(*string_ftpport == ':') {
+      /* :port */
+      ip_end = string_ftpport;
+    }
+    else {
+      ip_end = strchr(string_ftpport, ':');
+      addr = string_ftpport;
+      if(ip_end) {
+#ifdef USE_IPV6
+        struct sockaddr_in6 * const sa6 = (void *)ss;
+#endif
+        /* either ipv6 or (ipv4|domain|interface):port(-range) */
+        addrlen = ip_end - string_ftpport;
+#ifdef USE_IPV6
+        if(curlx_inet_pton(AF_INET6, string_ftpport, &sa6->sin6_addr) == 1) {
+          /* ipv6 */
+          addrlen = strlen(string_ftpport);
+          ip_end = NULL; /* this got no port ! */
         }
+#endif
+      }
+      else
+        /* ipv4|interface */
+        addrlen = strlen(string_ftpport);
+    }
+
+  /* parse the port */
+  if(ip_end) {
+    const char *portp = strchr(ip_end, ':');
+    if(portp) {
+      curl_off_t start;
+      curl_off_t end;
+      portp++;
+      if(!curlx_str_number(&portp, &start, 0xffff)) {
+        port_min = (unsigned short)start;
+        if(!curlx_str_single(&portp, '-') &&
+           !curlx_str_number(&portp, &end, 0xffff))
+          port_max = (unsigned short)end;
         else
           port_max = port_min;
       }
     }
-
-    /* correct errors like:
-     *  :1234-1230
-     *  :-4711,  in this case port_min is (unsigned)-1,
-     *           therefore port_min > port_max for all cases
-     *           but port_max = (unsigned)-1
-     */
-    if(port_min > port_max)
-      port_min = port_max = 0;
-
-    if(*addr != '\0') {
-      /* attempt to get the address of the given interface name */
-      switch(Curl_if2ip(conn->remote_addr->family,
-#ifdef ENABLE_IPV6
-                        Curl_ipv6_scope(&conn->remote_addr->sa_addr),
-                        conn->scope_id,
-#endif
-                        addr, hbuf, sizeof(hbuf))) {
-        case IF2IP_NOT_FOUND:
-          /* not an interface, use the given string as host name instead */
-          host = addr;
-          break;
-        case IF2IP_AF_NOT_SUPPORTED:
-          goto out;
-        case IF2IP_FOUND:
-          host = hbuf; /* use the hbuf for host name */
-      }
-    }
-    else
-      /* there was only a port(-range) given, default the host */
-      host = NULL;
-  } /* data->set.ftpport */
-
-  if(!host) {
-    const char *r;
-    /* not an interface and not a host name, get default by extracting
-       the IP from the control connection */
-    sslen = sizeof(ss);
-    if(getsockname(conn->sock[FIRSTSOCKET], sa, &sslen)) {
-      failf(data, "getsockname() failed: %s",
-            Curl_strerror(SOCKERRNO, buffer, sizeof(buffer)));
-      goto out;
-    }
-    switch(sa->sa_family) {
-#ifdef ENABLE_IPV6
-    case AF_INET6:
-      r = Curl_inet_ntop(sa->sa_family, &sa6->sin6_addr, hbuf, sizeof(hbuf));
-      break;
-#endif
-    default:
-      r = Curl_inet_ntop(sa->sa_family, &sa4->sin_addr, hbuf, sizeof(hbuf));
-      break;
-    }
-    if(!r) {
-      goto out;
-    }
-    host = hbuf; /* use this host name */
-    possibly_non_local = FALSE; /* we know it is local now */
   }
 
-  /* resolv ip/host to ip */
-  rc = Curl_resolv(data, host, 0, FALSE, &h);
-  if(rc == CURLRESOLV_PENDING)
-    (void)Curl_resolver_wait_resolv(data, &h);
-  if(h) {
-    res = h->addr;
-    /* when we return from this function, we can forget about this entry
-       to we can unlock it now already */
-    Curl_resolv_unlock(data, h);
-  } /* (h) */
-  else
-    res = NULL; /* failure! */
+  /* correct errors like :1234-1230 or :-4711 */
+  if(port_min > port_max)
+    port_min = port_max = 0;
 
-  if(!res) {
+  if(addrlen) {
+    const struct Curl_sockaddr_ex *remote_addr =
+      Curl_conn_get_remote_addr(data, FIRSTSOCKET);
+
+    DEBUGASSERT(remote_addr);
+    DEBUGASSERT(addr);
+    if(!remote_addr || (addrlen >= sizeof(ipstr)) || (addrlen >= hbuflen))
+      return CURLE_FTP_PORT_FAILED;
+    memcpy(ipstr, addr, addrlen);
+    ipstr[addrlen] = 0;
+
+    /* attempt to get the address of the given interface name */
+    switch(Curl_if2ip(remote_addr->family,
+#ifdef USE_IPV6
+                      Curl_ipv6_scope(&remote_addr->curl_sa_addr),
+                      conn->scope_id,
+#endif
+                      ipstr, hbuf, hbuflen)) {
+    case IF2IP_NOT_FOUND:
+      /* not an interface, use the string as hostname instead */
+      memcpy(hbuf, addr, addrlen);
+      hbuf[addrlen] = 0;
+      *hostp = hbuf;
+      break;
+    case IF2IP_AF_NOT_SUPPORTED:
+      return CURLE_FTP_PORT_FAILED;
+    case IF2IP_FOUND:
+      *hostp = hbuf; /* use the hbuf for hostname */
+      break;
+    }
+  }
+  /* else: only a port(-range) given, leave host as NULL */
+
+done:
+  *port_minp = port_min;
+  *port_maxp = port_max;
+  return CURLE_OK;
+}
+
+/*
+ * If no host was derived from the FTPPORT string, fall back to the IP address
+ * of the control connection's local socket.
+ */
+static CURLcode ftp_port_default_host(struct Curl_easy *data,
+                                      struct connectdata *conn,
+                                      struct Curl_sockaddr_storage *ss,
+                                      curl_socklen_t *sslenp,
+                                      const char **hostp,
+                                      char *hbuf, size_t hbuflen,
+                                      bool *non_localp)
+{
+  struct sockaddr *sa = (struct sockaddr *)ss;
+  struct sockaddr_in * const sa4 = (void *)sa;
+#ifdef USE_IPV6
+  struct sockaddr_in6 * const sa6 = (void *)sa;
+#endif
+  char buffer[STRERROR_LEN];
+  const char *r;
+
+  *sslenp = sizeof(*ss);
+  if(getsockname(conn->sock[FIRSTSOCKET], sa, sslenp)) {
+    failf(data, "getsockname() failed: %s",
+          curlx_strerror(SOCKERRNO, buffer, sizeof(buffer)));
+    return CURLE_FTP_PORT_FAILED;
+  }
+  switch(sa->sa_family) {
+#ifdef USE_IPV6
+  case AF_INET6:
+    r = curlx_inet_ntop(sa->sa_family, &sa6->sin6_addr, hbuf, hbuflen);
+    break;
+#endif
+  default:
+    r = curlx_inet_ntop(sa->sa_family, &sa4->sin_addr, hbuf, hbuflen);
+    break;
+  }
+  if(!r)
+    return CURLE_FTP_PORT_FAILED;
+
+  *hostp = hbuf;
+  *non_localp = FALSE; /* we know it is local now */
+  return CURLE_OK;
+}
+
+/*
+ * Resolve the host string to a list of addresses.
+ */
+static CURLcode ftp_port_resolve_host(struct Curl_easy *data,
+                                      struct connectdata *conn,
+                                      const char *host,
+                                      struct Curl_dns_entry **dns_entryp,
+                                      const struct Curl_addrinfo **resp)
+{
+  CURLcode result;
+
+  *resp = NULL;
+  result = Curl_resolv_blocking(
+    data, Curl_resolv_dns_queries(data, conn->ip_version),
+    host, 0, Curl_conn_get_transport(data, conn), dns_entryp);
+  if(result)
     failf(data, "failed to resolve the address provided to PORT: %s", host);
-    goto out;
+  else {
+    DEBUGASSERT(*dns_entryp);
+    *resp = (*dns_entryp)->addr;
   }
+  return result;
+}
 
-  host = NULL;
+/*
+ * Open a TCP socket for the resolved address family.
+ */
+static CURLcode ftp_port_open_socket(struct Curl_easy *data,
+                                     struct connectdata *conn,
+                                     const struct Curl_addrinfo *res,
+                                     const struct Curl_addrinfo **aip,
+                                     curl_socket_t *portsockp)
+{
+  char buffer[STRERROR_LEN];
+  int sockerr = 0;
+  const struct Curl_addrinfo *ai;
+  CURLcode result = CURLE_FTP_PORT_FAILED;
 
-  /* step 2, create a socket for the requested address */
-  error = 0;
   for(ai = res; ai; ai = ai->ai_next) {
-    if(Curl_socket_open(data, ai, NULL, conn->transport, &portsock)) {
-      error = SOCKERRNO;
+    result =
+      Curl_socket_open(data, ai, NULL,
+                       Curl_conn_get_transport(data, conn), portsockp);
+    if(result) {
+      if(result == CURLE_OUT_OF_MEMORY)
+        return result;
+      result = CURLE_FTP_PORT_FAILED;
+      sockerr = SOCKERRNO;
       continue;
     }
     break;
   }
   if(!ai) {
     failf(data, "socket failure: %s",
-          Curl_strerror(error, buffer, sizeof(buffer)));
-    goto out;
+          curlx_strerror(sockerr, buffer, sizeof(buffer)));
+    return CURLE_FTP_PORT_FAILED;
   }
-  DEBUGF(infof(data, "ftp_state_use_port(), opened socket"));
+  *aip = ai;
+  return result;
+}
 
-  /* step 3, bind to a suitable local address */
+/*
+ * Bind the socket to a local address and port within the requested range.
+ * Falls back to the control-connection address if the user-requested address
+ * is non-local.
+ */
+static CURLcode ftp_port_bind_socket(struct Curl_easy *data,
+                                     struct connectdata *conn,
+                                     curl_socket_t portsock,
+                                     const struct Curl_addrinfo *ai,
+                                     struct Curl_sockaddr_storage *ss,
+                                     curl_socklen_t *sslen_io,
+                                     unsigned short port_min,
+                                     unsigned short port_max,
+                                     bool non_local)
+{
+  struct sockaddr *sa = (struct sockaddr *)ss;
+  struct sockaddr_in * const sa4 = (void *)sa;
+#ifdef USE_IPV6
+  struct sockaddr_in6 * const sa6 = (void *)sa;
+#endif
+  char buffer[STRERROR_LEN];
+  unsigned short port;
+  int sockerr;
 
   memcpy(sa, ai->ai_addr, ai->ai_addrlen);
-  sslen = ai->ai_addrlen;
+  *sslen_io = ai->ai_addrlen;
 
   for(port = port_min; port <= port_max;) {
     if(sa->sa_family == AF_INET)
       sa4->sin_port = htons(port);
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
     else
       sa6->sin6_port = htons(port);
 #endif
-    /* Try binding the given address. */
-    if(bind(portsock, sa, sslen) ) {
-      /* It failed. */
-      error = SOCKERRNO;
-      if(possibly_non_local && (error == EADDRNOTAVAIL)) {
-        /* The requested bind address is not local.  Use the address used for
-         * the control connection instead and restart the port loop
+    if(bind(portsock, sa, *sslen_io)) {
+      sockerr = SOCKERRNO;
+      if(non_local && (sockerr == SOCKEADDRNOTAVAIL)) {
+        /* The requested bind address is not local. Use the address used for
+         * the control connection instead and restart the port loop.
          */
         infof(data, "bind(port=%hu) on non-local address failed: %s", port,
-              Curl_strerror(error, buffer, sizeof(buffer)));
+              curlx_strerror(sockerr, buffer, sizeof(buffer)));
 
-        sslen = sizeof(ss);
-        if(getsockname(conn->sock[FIRSTSOCKET], sa, &sslen)) {
+        *sslen_io = sizeof(*ss);
+        if(getsockname(conn->sock[FIRSTSOCKET], sa, sslen_io)) {
           failf(data, "getsockname() failed: %s",
-                Curl_strerror(SOCKERRNO, buffer, sizeof(buffer)));
-          goto out;
+                curlx_strerror(SOCKERRNO, buffer, sizeof(buffer)));
+          return CURLE_FTP_PORT_FAILED;
         }
         port = port_min;
-        possibly_non_local = FALSE; /* don't try this again */
+        non_local = FALSE; /* do not try this again */
         continue;
       }
-      if(error != EADDRINUSE && error != EACCES) {
+      if(sockerr != SOCKEADDRINUSE && sockerr != SOCKEACCES) {
         failf(data, "bind(port=%hu) failed: %s", port,
-              Curl_strerror(error, buffer, sizeof(buffer)));
-        goto out;
+              curlx_strerror(sockerr, buffer, sizeof(buffer)));
+        return CURLE_FTP_PORT_FAILED;
       }
     }
     else
       break;
 
+    /* check if port is the maximum value here, because it might be 0xffff
+       and then the increment below will wrap the 16-bit counter */
+    if(port == port_max) {
+      failf(data, "bind() failed, ran out of ports");
+      return CURLE_FTP_PORT_FAILED;
+    }
     port++;
   }
 
-  /* maybe all ports were in use already */
-  if(port > port_max) {
-    failf(data, "bind() failed, we ran out of ports");
-    goto out;
-  }
-
-  /* get the name again after the bind() so that we can extract the
-     port number it uses now */
-  sslen = sizeof(ss);
-  if(getsockname(portsock, sa, &sslen)) {
+  /* re-read the name so we can extract the actual port chosen */
+  *sslen_io = sizeof(*ss);
+  if(getsockname(portsock, sa, sslen_io)) {
     failf(data, "getsockname() failed: %s",
-          Curl_strerror(SOCKERRNO, buffer, sizeof(buffer)));
-    goto out;
+          curlx_strerror(SOCKERRNO, buffer, sizeof(buffer)));
+    return CURLE_FTP_PORT_FAILED;
   }
-  DEBUGF(infof(data, "ftp_state_use_port(), socket bound to port %d", port));
+  CURL_TRC_FTP(data, "ftp_port_bind_socket(), socket bound to port %d", port);
+  return CURLE_OK;
+}
 
-  /* step 4, listen on the socket */
+/*
+ * Start listening on the data socket.
+ */
+static CURLcode ftp_port_listen(struct Curl_easy *data, curl_socket_t portsock)
+{
+  char buffer[STRERROR_LEN];
 
   if(listen(portsock, 1)) {
     failf(data, "socket failure: %s",
-          Curl_strerror(SOCKERRNO, buffer, sizeof(buffer)));
-    goto out;
+          curlx_strerror(SOCKERRNO, buffer, sizeof(buffer)));
+    return CURLE_FTP_PORT_FAILED;
   }
-  DEBUGF(infof(data, "ftp_state_use_port(), listening on %d", port));
+  CURL_TRC_FTP(data, "ftp_port_listen(), listening on port");
+  return CURLE_OK;
+}
 
-  /* step 5, send the proper FTP command */
+/*
+ * Send the EPRT or PORT command to the server.
+ */
+static CURLcode ftp_port_send_command(struct Curl_easy *data,
+                                      struct ftp_conn *ftpc,
+                                      struct connectdata *conn,
+                                      struct Curl_sockaddr_storage *ss,
+                                      const struct Curl_addrinfo *ai,
+                                      ftpport fcmd)
+{
+  static const char mode[][5] = { "EPRT", "PORT" };
+  struct sockaddr *sa = (struct sockaddr *)ss;
+  struct sockaddr_in * const sa4 = (void *)sa;
+#ifdef USE_IPV6
+  struct sockaddr_in6 * const sa6 = (void *)sa;
+#endif
+  char myhost[MAX_IPADR_LEN + 1] = "";
+  unsigned short port;
+  CURLcode result;
 
-  /* get a plain printable version of the numerical address to work with
-     below */
+  /* Get a plain printable version of the numerical address to work with. This
+     logic uses the address provided by the FTPPORT option, which at times
+     might differ from the address in 'ss' used to bind to: when a user asks
+     the server to connect to a specific address knowing that it works, but
+     curl instead selects to listen to the local address because it cannot use
+     the provided address. FTP is strange. */
   Curl_printable_address(ai, myhost, sizeof(myhost));
 
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
   if(!conn->bits.ftp_use_eprt && conn->bits.ipv6)
-    /* EPRT is disabled but we are connected to a IPv6 host, so we ignore the
+    /* EPRT is disabled but we are connected to an IPv6 host, so we ignore the
        request and enable EPRT again! */
     conn->bits.ftp_use_eprt = TRUE;
 #endif
@@ -1194,7 +1256,7 @@ static CURLcode ftp_state_use_port(struct Curl_easy *data,
     case AF_INET:
       port = ntohs(sa4->sin_port);
       break;
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
     case AF_INET6:
       port = ntohs(sa6->sin6_port);
       break;
@@ -1211,25 +1273,23 @@ static CURLcode ftp_state_use_port(struct Curl_easy *data,
        *
        * EPRT |2|1080::8:800:200C:417A|5282|
        */
-
       result = Curl_pp_sendf(data, &ftpc->pp, "%s |%d|%s|%hu|", mode[fcmd],
-                             sa->sa_family == AF_INET?1:2,
-                             myhost, port);
+                             sa->sa_family == AF_INET ? 1 : 2, myhost, port);
       if(result) {
         failf(data, "Failure sending EPRT command: %s",
               curl_easy_strerror(result));
-        goto out;
+        return result;
       }
       break;
     }
     if(PORT == fcmd) {
       /* large enough for [IP address],[num],[num] */
       char target[sizeof(myhost) + 20];
-      char *source = myhost;
+      const char *source = myhost;
       char *dest = target;
 
       /* translate x.x.x.x to x,x,x,x */
-      while(source && *source) {
+      while(*source) {
         if(*source == '.')
           *dest = ',';
         else
@@ -1238,13 +1298,13 @@ static CURLcode ftp_state_use_port(struct Curl_easy *data,
         source++;
       }
       *dest = 0;
-      msnprintf(dest, 20, ",%d,%d", (int)(port>>8), (int)(port&0xff));
+      curl_msnprintf(dest, 20, ",%d,%d", (int)(port >> 8), (int)(port & 0xff));
 
       result = Curl_pp_sendf(data, &ftpc->pp, "%s %s", mode[fcmd], target);
       if(result) {
         failf(data, "Failure sending PORT command: %s",
               curl_easy_strerror(result));
-        goto out;
+        return result;
       }
       break;
     }
@@ -1252,28 +1312,107 @@ static CURLcode ftp_state_use_port(struct Curl_easy *data,
 
   /* store which command was sent */
   ftpc->count1 = fcmd;
+  ftp_state(data, ftpc, FTP_PORT);
+  return CURLE_OK;
+}
 
-  /* Replace any filter on SECONDARY with one listening on this socket */
-  result = Curl_conn_tcp_listen_set(data, conn, SECONDARYSOCKET, &portsock);
-  if(result)
-    goto out;
-  portsock = CURL_SOCKET_BAD; /* now held in filter */
-  ftp_state(data, FTP_PORT);
+/*
+ * ftp_state_use_port()
+ *
+ * Set up an active-mode FTP data connection (using PORT or EPRT) and start
+ * listening for the server's incoming connection on SECONDARYSOCKET.
+ */
+static CURLcode ftp_state_use_port(struct Curl_easy *data,
+                                   struct ftp_conn *ftpc,
+                                   ftpport fcmd) /* start with this */
+{
+  CURLcode result = CURLE_FTP_PORT_FAILED;
+  struct connectdata *conn = data->conn;
+  curl_socket_t portsock = CURL_SOCKET_BAD;
 
-out:
+  struct Curl_sockaddr_storage ss;
+  curl_socklen_t sslen;
+  char hbuf[NI_MAXHOST];
+  const char *host = NULL;
+  const char *string_ftpport = data->set.str[STRING_FTPPORT];
+  struct Curl_dns_entry *dns_entry = NULL;
+  const struct Curl_addrinfo *res = NULL;
+  const struct Curl_addrinfo *ai = NULL;
+  unsigned short port_min = 0;
+  unsigned short port_max = 0;
+  bool non_local = TRUE;
+
+  /* parse the FTPPORT string for address and port range */
+  result = ftp_port_parse_string(data, conn, string_ftpport,
+                                 &ss, &port_min, &port_max,
+                                 &host, hbuf, sizeof(hbuf));
+  if(!result && !host)
+    /* if no host was specified, use the control connection's local IP */
+    result = ftp_port_default_host(data, conn, &ss, &sslen, &host,
+                                   hbuf, sizeof(hbuf), &non_local);
+
+  /* resolve host string to address list */
+  if(!result)
+    result = ftp_port_resolve_host(data, conn, host, &dns_entry, &res);
+
+  /* Open a TCP socket for the data connection */
+  if(!result)
+    result = ftp_port_open_socket(data, conn, res, &ai, &portsock);
+  if(!result) {
+    CURL_TRC_FTP(data, "[%s] ftp_state_use_port(), opened socket",
+                 FTP_CSTATE(ftpc));
+
+    /* bind to a suitable local address / port */
+    result = ftp_port_bind_socket(data, conn, portsock, ai, &ss, &sslen,
+                                  port_min, port_max, non_local);
+  }
+
+  /* listen */
+  if(!result)
+    result = ftp_port_listen(data, portsock);
+
+  /* send the PORT / EPRT command */
+  if(!result)
+    result = ftp_port_send_command(data, ftpc, conn, &ss, ai, fcmd);
+
+  /* replace any filter on SECONDARY with one listening on this socket */
+  if(!result)
+    result = Curl_conn_tcp_listen_set(data, conn, SECONDARYSOCKET, &portsock);
+
+  if(!result)
+    portsock = CURL_SOCKET_BAD; /* now held in filter */
+
+  /* cleanup */
+
+  if(dns_entry)
+    Curl_dns_entry_unlink(data, &dns_entry);
   if(result) {
-    ftp_state(data, FTP_STOP);
+    ftp_state(data, ftpc, FTP_STOP);
+  }
+  else {
+    /* successfully set up the listen socket filter. SSL needed?
+     * Use the control connections origin for cert verification. */
+    if(conn->bits.ftp_use_data_ssl && data->set.ftp_use_port &&
+       !Curl_conn_is_ssl(conn, SECONDARYSOCKET)) {
+      result = Curl_ssl_cfilter_add(
+        data, Curl_conn_get_origin(conn, FIRSTSOCKET),
+        conn, SECONDARYSOCKET);
+    }
+    conn->bits.do_more = FALSE;
+    Curl_pgrsTime(data, TIMER_STARTACCEPT);
+    Curl_expire(data, (data->set.accepttimeout > 0) ?
+                data->set.accepttimeout: DEFAULT_ACCEPT_TIMEOUT,
+                EXPIRE_FTP_ACCEPT);
   }
   if(portsock != CURL_SOCKET_BAD)
     Curl_socket_close(data, conn, portsock);
-  free(addr);
   return result;
 }
 
 static CURLcode ftp_state_use_pasv(struct Curl_easy *data,
+                                   struct ftp_conn *ftpc,
                                    struct connectdata *conn)
 {
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
   CURLcode result = CURLE_OK;
   /*
     Here's the executive summary on what to do:
@@ -1294,17 +1433,17 @@ static CURLcode ftp_state_use_pasv(struct Curl_easy *data,
 
 #ifdef PF_INET6
   if(!conn->bits.ftp_use_epsv && conn->bits.ipv6)
-    /* EPSV is disabled but we are connected to a IPv6 host, so we ignore the
+    /* EPSV is disabled but we are connected to an IPv6 host, so we ignore the
        request and enable EPSV again! */
     conn->bits.ftp_use_epsv = TRUE;
 #endif
 
-  modeoff = conn->bits.ftp_use_epsv?0:1;
+  modeoff = conn->bits.ftp_use_epsv ? 0 : 1;
 
   result = Curl_pp_sendf(data, &ftpc->pp, "%s", mode[modeoff]);
   if(!result) {
     ftpc->count1 = modeoff;
-    ftp_state(data, FTP_PASV);
+    ftp_state(data, ftpc, FTP_PASV);
     infof(data, "Connect data stream passively");
   }
   return result;
@@ -1317,55 +1456,52 @@ static CURLcode ftp_state_use_pasv(struct Curl_easy *data,
  * request is made. Thus, if an actual transfer is to be made this is where we
  * take off for real.
  */
-static CURLcode ftp_state_prepare_transfer(struct Curl_easy *data)
+static CURLcode ftp_state_prepare_transfer(struct Curl_easy *data,
+                                           struct ftp_conn *ftpc,
+                                           struct FTP *ftp)
 {
   CURLcode result = CURLE_OK;
-  struct FTP *ftp = data->req.p.ftp;
   struct connectdata *conn = data->conn;
 
   if(ftp->transfer != PPTRANSFER_BODY) {
-    /* doesn't transfer any data */
+    /* does not transfer any data */
 
     /* still possibly do PRE QUOTE jobs */
-    ftp_state(data, FTP_RETR_PREQUOTE);
-    result = ftp_state_quote(data, TRUE, FTP_RETR_PREQUOTE);
+    ftp_state(data, ftpc, FTP_RETR_PREQUOTE);
+    result = ftp_state_quote(data, ftpc, ftp, TRUE, FTP_RETR_PREQUOTE);
   }
   else if(data->set.ftp_use_port) {
     /* We have chosen to use the PORT (or similar) command */
-    result = ftp_state_use_port(data, EPRT);
+    result = ftp_state_use_port(data, ftpc, EPRT);
   }
   else {
     /* We have chosen (this is default) to use the PASV (or similar) command */
     if(data->set.ftp_use_pret) {
       /* The user has requested that we send a PRET command
          to prepare the server for the upcoming PASV */
-      struct ftp_conn *ftpc = &conn->proto.ftpc;
-      if(!conn->proto.ftpc.file)
+      if(!ftpc->file)
         result = Curl_pp_sendf(data, &ftpc->pp, "PRET %s",
-                               data->set.str[STRING_CUSTOMREQUEST]?
-                               data->set.str[STRING_CUSTOMREQUEST]:
-                               (data->state.list_only?"NLST":"LIST"));
+                               data->set.str[STRING_CUSTOMREQUEST] ?
+                               data->set.str[STRING_CUSTOMREQUEST] :
+                               (data->state.list_only ? "NLST" : "LIST"));
       else if(data->state.upload)
-        result = Curl_pp_sendf(data, &ftpc->pp, "PRET STOR %s",
-                               conn->proto.ftpc.file);
+        result = Curl_pp_sendf(data, &ftpc->pp, "PRET STOR %s", ftpc->file);
       else
-        result = Curl_pp_sendf(data, &ftpc->pp, "PRET RETR %s",
-                               conn->proto.ftpc.file);
+        result = Curl_pp_sendf(data, &ftpc->pp, "PRET RETR %s", ftpc->file);
       if(!result)
-        ftp_state(data, FTP_PRET);
+        ftp_state(data, ftpc, FTP_PRET);
     }
     else
-      result = ftp_state_use_pasv(data, conn);
+      result = ftp_state_use_pasv(data, ftpc, conn);
   }
   return result;
 }
 
 static CURLcode ftp_state_rest(struct Curl_easy *data,
-                               struct connectdata *conn)
+                               struct ftp_conn *ftpc,
+                               struct FTP *ftp)
 {
   CURLcode result = CURLE_OK;
-  struct FTP *ftp = data->req.p.ftp;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
 
   if((ftp->transfer != PPTRANSFER_BODY) && ftpc->file) {
     /* if a "head"-like request is being made (on a file) */
@@ -1374,40 +1510,39 @@ static CURLcode ftp_state_rest(struct Curl_easy *data,
        whether it supports range */
     result = Curl_pp_sendf(data, &ftpc->pp, "REST %d", 0);
     if(!result)
-      ftp_state(data, FTP_REST);
+      ftp_state(data, ftpc, FTP_REST);
   }
   else
-    result = ftp_state_prepare_transfer(data);
+    result = ftp_state_prepare_transfer(data, ftpc, ftp);
 
   return result;
 }
 
 static CURLcode ftp_state_size(struct Curl_easy *data,
-                               struct connectdata *conn)
+                               struct ftp_conn *ftpc,
+                               struct FTP *ftp)
 {
   CURLcode result = CURLE_OK;
-  struct FTP *ftp = data->req.p.ftp;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
 
   if((ftp->transfer == PPTRANSFER_INFO) && ftpc->file) {
     /* if a "head"-like request is being made (on a file) */
 
-    /* we know ftpc->file is a valid pointer to a file name */
+    /* we know ftpc->file is a valid pointer to a filename */
     result = Curl_pp_sendf(data, &ftpc->pp, "SIZE %s", ftpc->file);
     if(!result)
-      ftp_state(data, FTP_SIZE);
+      ftp_state(data, ftpc, FTP_SIZE);
   }
   else
-    result = ftp_state_rest(data, conn);
+    result = ftp_state_rest(data, ftpc, ftp);
 
   return result;
 }
 
-static CURLcode ftp_state_list(struct Curl_easy *data)
+static CURLcode ftp_state_list(struct Curl_easy *data,
+                               struct ftp_conn *ftpc,
+                               struct FTP *ftp)
 {
   CURLcode result = CURLE_OK;
-  struct FTP *ftp = data->req.p.ftp;
-  struct connectdata *conn = data->conn;
 
   /* If this output is to be machine-parsed, the NLST command might be better
      to use, since the LIST command output is not specified or standard in any
@@ -1420,20 +1555,16 @@ static CURLcode ftp_state_list(struct Curl_easy *data)
      Whether the server will support this, is uncertain.
 
      The other ftp_filemethods will CWD into dir/dir/ first and
-     then just do LIST (in that case: nothing to do here)
+     then do LIST (in that case: nothing to do here)
   */
-  char *lstArg = NULL;
+  const char *lstArg = NULL;
+  int lstArglen = 0;
   char *cmd;
 
   if((data->set.ftp_filemethod == FTPFILE_NOCWD) && ftp->path) {
-    /* url-decode before evaluation: e.g. paths starting/ending with %2f */
-    const char *slashPos = NULL;
-    char *rawPath = NULL;
-    result = Curl_urldecode(ftp->path, 0, &rawPath, NULL, REJECT_CTRL);
-    if(result)
-      return result;
-
-    slashPos = strrchr(rawPath, '/');
+    /* URL-decode before evaluation: e.g. paths starting/ending with %2f */
+    const char *rawPath = ftpc->rawpath;
+    const char *slashPos = strrchr(rawPath, '/');
     if(slashPos) {
       /* chop off the file part if format is dir/file otherwise remove
          the trailing slash for dir/dir/ except for absolute path / */
@@ -1442,56 +1573,64 @@ static CURLcode ftp_state_list(struct Curl_easy *data)
         ++n;
 
       lstArg = rawPath;
-      lstArg[n] = '\0';
+      lstArglen = (int)n;
     }
-    else
-      free(rawPath);
   }
 
-  cmd = aprintf("%s%s%s",
-                data->set.str[STRING_CUSTOMREQUEST]?
-                data->set.str[STRING_CUSTOMREQUEST]:
-                (data->state.list_only?"NLST":"LIST"),
-                lstArg? " ": "",
-                lstArg? lstArg: "");
-  free(lstArg);
+  cmd = curl_maprintf("%s%s%.*s",
+                      data->set.str[STRING_CUSTOMREQUEST] ?
+                      data->set.str[STRING_CUSTOMREQUEST] :
+                      (data->state.list_only ? "NLST" : "LIST"),
+                      lstArg ? " " : "",
+                      lstArglen, lstArg ? lstArg : "");
 
   if(!cmd)
     return CURLE_OUT_OF_MEMORY;
 
-  result = Curl_pp_sendf(data, &conn->proto.ftpc.pp, "%s", cmd);
-  free(cmd);
+  result = Curl_pp_sendf(data, &ftpc->pp, "%s", cmd);
+  curlx_free(cmd);
 
   if(!result)
-    ftp_state(data, FTP_LIST);
+    ftp_state(data, ftpc, FTP_LIST);
 
   return result;
 }
 
-static CURLcode ftp_state_retr_prequote(struct Curl_easy *data)
+static CURLcode ftp_state_list_prequote(struct Curl_easy *data,
+                                        struct ftp_conn *ftpc,
+                                        struct FTP *ftp)
 {
-  /* We've sent the TYPE, now we must send the list of prequote strings */
-  return ftp_state_quote(data, TRUE, FTP_RETR_PREQUOTE);
+  /* We have sent the TYPE, now we must send the list of prequote strings */
+  return ftp_state_quote(data, ftpc, ftp, TRUE, FTP_LIST_PREQUOTE);
 }
 
-static CURLcode ftp_state_stor_prequote(struct Curl_easy *data)
+static CURLcode ftp_state_retr_prequote(struct Curl_easy *data,
+                                        struct ftp_conn *ftpc,
+                                        struct FTP *ftp)
 {
-  /* We've sent the TYPE, now we must send the list of prequote strings */
-  return ftp_state_quote(data, TRUE, FTP_STOR_PREQUOTE);
+  /* We have sent the TYPE, now we must send the list of prequote strings */
+  return ftp_state_quote(data, ftpc, ftp, TRUE, FTP_RETR_PREQUOTE);
 }
 
-static CURLcode ftp_state_type(struct Curl_easy *data)
+static CURLcode ftp_state_stor_prequote(struct Curl_easy *data,
+                                        struct ftp_conn *ftpc,
+                                        struct FTP *ftp)
+{
+  /* We have sent the TYPE, now we must send the list of prequote strings */
+  return ftp_state_quote(data, ftpc, ftp, TRUE, FTP_STOR_PREQUOTE);
+}
+
+static CURLcode ftp_state_type(struct Curl_easy *data,
+                               struct ftp_conn *ftpc,
+                               struct FTP *ftp)
 {
   CURLcode result = CURLE_OK;
-  struct FTP *ftp = data->req.p.ftp;
-  struct connectdata *conn = data->conn;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
 
   /* If we have selected NOBODY and HEADER, it means that we only want file
-     information. Which in FTP can't be much more than the file size and
+     information. Which in FTP cannot be much more than the file size and
      date. */
   if(data->req.no_body && ftpc->file &&
-     ftp_need_type(conn, data->state.prefer_ascii)) {
+     ftp_need_type(ftpc, (bool)data->state.prefer_ascii)) {
     /* The SIZE command is _not_ RFC 959 specified, and therefore many servers
        may not support it! It is however the only way we have to get a file's
        size! */
@@ -1501,23 +1640,24 @@ static CURLcode ftp_state_type(struct Curl_easy *data)
 
     /* Some servers return different sizes for different modes, and thus we
        must set the proper type before we check the size */
-    result = ftp_nb_type(data, conn, data->state.prefer_ascii, FTP_TYPE);
+    result = ftp_nb_type(data, ftpc, ftp, (bool)data->state.prefer_ascii,
+                         FTP_TYPE);
     if(result)
       return result;
   }
   else
-    result = ftp_state_size(data, conn);
+    result = ftp_state_size(data, ftpc, ftp);
 
   return result;
 }
 
 /* This is called after the CWD commands have been done in the beginning of
    the DO phase */
-static CURLcode ftp_state_mdtm(struct Curl_easy *data)
+static CURLcode ftp_state_mdtm(struct Curl_easy *data,
+                               struct ftp_conn *ftpc,
+                               struct FTP *ftp)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
 
   /* Requested time of file or time-depended transfer? */
   if((data->set.get_filetime || data->set.timecondition) && ftpc->file) {
@@ -1527,38 +1667,36 @@ static CURLcode ftp_state_mdtm(struct Curl_easy *data)
     result = Curl_pp_sendf(data, &ftpc->pp, "MDTM %s", ftpc->file);
 
     if(!result)
-      ftp_state(data, FTP_MDTM);
+      ftp_state(data, ftpc, FTP_MDTM);
   }
   else
-    result = ftp_state_type(data);
+    result = ftp_state_type(data, ftpc, ftp);
 
   return result;
 }
 
-
 /* This is called after the TYPE and possible quote commands have been sent */
 static CURLcode ftp_state_ul_setup(struct Curl_easy *data,
+                                   struct ftp_conn *ftpc,
+                                   struct FTP *ftp,
                                    bool sizechecked)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct FTP *ftp = data->req.p.ftp;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
-  bool append = data->set.remote_append;
+  curl_bit append = data->set.remote_append;
 
   if((data->state.resume_from && !sizechecked) ||
      ((data->state.resume_from > 0) && sizechecked)) {
-    /* we're about to continue the uploading of a file */
-    /* 1. get already existing file's size. We use the SIZE command for this
-       which may not exist in the server!  The SIZE command is not in
-       RFC959. */
+    /* we are about to continue the uploading of a file
+       1. get already existing file's size. We use the SIZE command for this
+          which may not exist in the server!  The SIZE command is not in
+          RFC959.
 
-    /* 2. This used to set REST. But since we can do append, we
-       don't another ftp command. We just skip the source file
-       offset and then we APPEND the rest on the file instead */
+       2. This used to set REST, but since we can do append, we issue no
+          another ftp command. Skip the source file offset and APPEND the rest
+          on the file instead
 
-    /* 3. pass file-size number of bytes in the source file */
-    /* 4. lower the infilesize counter */
+       3. pass file-size number of bytes in the source file
+       4. lower the infilesize counter */
     /* => transfer as usual */
     int seekerr = CURL_SEEKFUNC_OK;
 
@@ -1566,7 +1704,7 @@ static CURLcode ftp_state_ul_setup(struct Curl_easy *data,
       /* Got no given size to start from, figure it out */
       result = Curl_pp_sendf(data, &ftpc->pp, "SIZE %s", ftpc->file);
       if(!result)
-        ftp_state(data, FTP_STOR_SIZE);
+        ftp_state(data, ftpc, FTP_STOR_SIZE);
       return result;
     }
 
@@ -1574,11 +1712,11 @@ static CURLcode ftp_state_ul_setup(struct Curl_easy *data,
     append = TRUE;
 
     /* Let's read off the proper amount of bytes from the input. */
-    if(conn->seek_func) {
-      Curl_set_in_callback(data, true);
-      seekerr = conn->seek_func(conn->seek_client, data->state.resume_from,
-                                SEEK_SET);
-      Curl_set_in_callback(data, false);
+    if(data->set.seek_func) {
+      Curl_set_in_callback(data, TRUE);
+      seekerr = data->set.seek_func(data->set.seek_client,
+                                    data->state.resume_from, SEEK_SET);
+      Curl_set_in_callback(data, FALSE);
     }
 
     if(seekerr != CURL_SEEKFUNC_OK) {
@@ -1587,15 +1725,16 @@ static CURLcode ftp_state_ul_setup(struct Curl_easy *data,
         failf(data, "Could not seek stream");
         return CURLE_FTP_COULDNT_USE_REST;
       }
-      /* seekerr == CURL_SEEKFUNC_CANTSEEK (can't seek to offset) */
+      /* seekerr == CURL_SEEKFUNC_CANTSEEK (cannot seek to offset) */
       do {
+        char scratch[4 * 1024];
         size_t readthisamountnow =
-          (data->state.resume_from - passed > data->set.buffer_size) ?
-          (size_t)data->set.buffer_size :
+          (data->state.resume_from - passed > (curl_off_t)sizeof(scratch)) ?
+          sizeof(scratch) :
           curlx_sotouz(data->state.resume_from - passed);
 
         size_t actuallyread =
-          data->state.fread_func(data->state.buffer, 1, readthisamountnow,
+          data->state.fread_func(scratch, 1, readthisamountnow,
                                  data->state.in);
 
         passed += actuallyread;
@@ -1608,42 +1747,124 @@ static CURLcode ftp_state_ul_setup(struct Curl_easy *data,
       } while(passed < data->state.resume_from);
     }
     /* now, decrease the size of the read */
-    if(data->state.infilesize>0) {
+    if(data->state.infilesize > 0) {
       data->state.infilesize -= data->state.resume_from;
 
       if(data->state.infilesize <= 0) {
         infof(data, "File already completely uploaded");
 
         /* no data to transfer */
-        Curl_setup_transfer(data, -1, -1, FALSE, -1);
+        Curl_xfer_setup_nop(data);
 
-        /* Set ->transfer so that we won't get any error in
-         * ftp_done() because we didn't transfer anything! */
+        /* Set ->transfer so that we will not get any error in
+         * ftp_done() because we did not transfer anything! */
         ftp->transfer = PPTRANSFER_NONE;
 
-        ftp_state(data, FTP_STOP);
+        ftp_state(data, ftpc, FTP_STOP);
         return CURLE_OK;
       }
     }
-    /* we've passed, proceed as normal */
+    /* we have passed, proceed as normal */
   } /* resume_from */
 
-  result = Curl_pp_sendf(data, &ftpc->pp, append?"APPE %s":"STOR %s",
+  result = Curl_pp_sendf(data, &ftpc->pp, append ? "APPE %s" : "STOR %s",
                          ftpc->file);
   if(!result)
-    ftp_state(data, FTP_STOR);
+    ftp_state(data, ftpc, FTP_STOR);
+
+  return result;
+}
+
+static CURLcode ftp_state_retr(struct Curl_easy *data,
+                               struct ftp_conn *ftpc,
+                               struct FTP *ftp,
+                               curl_off_t filesize)
+{
+  CURLcode result = CURLE_OK;
+
+  CURL_TRC_FTP(data, "[%s] ftp_state_retr()", FTP_CSTATE(ftpc));
+  if(data->set.max_filesize && (filesize > data->set.max_filesize)) {
+    failf(data, "Maximum file size exceeded");
+    return CURLE_FILESIZE_EXCEEDED;
+  }
+  ftp->downloadsize = filesize;
+
+  if(data->state.resume_from) {
+    /* We always (attempt to) get the size of downloads, so it is done before
+       this even when not doing resumes. */
+    if(filesize == -1) {
+      infof(data, "ftp server does not support SIZE");
+      /* We could not get the size and therefore we cannot know if there
+         really is a part of the file left to get, although the server will
+         close the connection when we start the connection so it will not
+         cause us any harm, not make us exit as nicely. */
+    }
+    else {
+      /* We got a file size report, so we check that there actually is a
+         part of the file left to get, or else we go home. */
+      if(data->state.resume_from < 0) {
+        /* We are supposed to download the last abs(from) bytes */
+        if(filesize < -data->state.resume_from) {
+          failf(data, "Offset (%" FMT_OFF_T
+                ") was beyond file size (%" FMT_OFF_T ")",
+                data->state.resume_from, filesize);
+          return CURLE_BAD_DOWNLOAD_RESUME;
+        }
+        /* convert to size to download */
+        ftp->downloadsize = -data->state.resume_from;
+        /* download from where? */
+        data->state.resume_from = filesize - ftp->downloadsize;
+      }
+      else {
+        if(filesize < data->state.resume_from) {
+          failf(data, "Offset (%" FMT_OFF_T
+                ") was beyond file size (%" FMT_OFF_T ")",
+                data->state.resume_from, filesize);
+          return CURLE_BAD_DOWNLOAD_RESUME;
+        }
+        /* Now store the number of bytes we are expected to download */
+        ftp->downloadsize = filesize - data->state.resume_from;
+      }
+    }
+
+    if(ftp->downloadsize == 0) {
+      /* no data to transfer */
+      Curl_xfer_setup_nop(data);
+      infof(data, "File already completely downloaded");
+
+      /* Set ->transfer so that we will not get any error in ftp_done()
+       * because we did not transfer the any file */
+      ftp->transfer = PPTRANSFER_NONE;
+      ftp_state(data, ftpc, FTP_STOP);
+      return CURLE_OK;
+    }
+
+    /* Set resume file transfer offset */
+    infof(data, "Instructs server to resume from offset %" FMT_OFF_T,
+          data->state.resume_from);
+
+    result = Curl_pp_sendf(data, &ftpc->pp, "REST %" FMT_OFF_T,
+                           data->state.resume_from);
+    if(!result)
+      ftp_state(data, ftpc, FTP_RETR_REST);
+  }
+  else {
+    /* no resume */
+    result = Curl_pp_sendf(data, &ftpc->pp, "RETR %s", ftpc->file);
+    if(!result)
+      ftp_state(data, ftpc, FTP_RETR);
+  }
 
   return result;
 }
 
 static CURLcode ftp_state_quote(struct Curl_easy *data,
+                                struct ftp_conn *ftpc,
+                                struct FTP *ftp,
                                 bool init,
                                 ftpstate instate)
 {
   CURLcode result = CURLE_OK;
-  struct FTP *ftp = data->req.p.ftp;
-  struct connectdata *conn = data->conn;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
   bool quote = FALSE;
   struct curl_slist *item;
 
@@ -1654,6 +1875,7 @@ static CURLcode ftp_state_quote(struct Curl_easy *data,
     break;
   case FTP_RETR_PREQUOTE:
   case FTP_STOR_PREQUOTE:
+  case FTP_LIST_PREQUOTE:
     item = data->set.prequote;
     break;
   case FTP_POSTQUOTE:
@@ -1676,12 +1898,12 @@ static CURLcode ftp_state_quote(struct Curl_easy *data,
     int i = 0;
 
     /* Skip count1 items in the linked list */
-    while((i< ftpc->count1) && item) {
+    while((i < ftpc->count1) && item) {
       item = item->next;
       i++;
     }
     if(item) {
-      char *cmd = item->data;
+      const char *cmd = item->data;
       if(cmd[0] == '*') {
         cmd++;
         ftpc->count2 = 1; /* the sent command is allowed to fail */
@@ -1692,7 +1914,7 @@ static CURLcode ftp_state_quote(struct Curl_easy *data,
       result = Curl_pp_sendf(data, &ftpc->pp, "%s", cmd);
       if(result)
         return result;
-      ftp_state(data, instate);
+      ftp_state(data, ftpc, instate);
       quote = TRUE;
     }
   }
@@ -1702,47 +1924,51 @@ static CURLcode ftp_state_quote(struct Curl_easy *data,
     switch(instate) {
     case FTP_QUOTE:
     default:
-      result = ftp_state_cwd(data, conn);
+      result = ftp_state_cwd(data, ftpc, ftp);
       break;
     case FTP_RETR_PREQUOTE:
       if(ftp->transfer != PPTRANSFER_BODY)
-        ftp_state(data, FTP_STOP);
+        ftp_state(data, ftpc, FTP_STOP);
       else {
         if(ftpc->known_filesize != -1) {
           Curl_pgrsSetDownloadSize(data, ftpc->known_filesize);
-          result = ftp_state_retr(data, ftpc->known_filesize);
+          result = ftp_state_retr(data, ftpc, ftp, ftpc->known_filesize);
         }
         else {
           if(data->set.ignorecl || data->state.prefer_ascii) {
-            /* 'ignorecl' is used to support download of growing files.  It
+            /* 'ignorecl' is used to support download of growing files. It
                prevents the state machine from requesting the file size from
-               the server.  With an unknown file size the download continues
+               the server. With an unknown file size the download continues
                until the server terminates it, otherwise the client stops if
-               the received byte count exceeds the reported file size.  Set
+               the received byte count exceeds the reported file size. Set
                option CURLOPT_IGNORE_CONTENT_LENGTH to 1 to enable this
                behavior.
 
                In addition: asking for the size for 'TYPE A' transfers is not
-               constructive since servers don't report the converted size. So
-               skip it.
+               constructive since servers do not report the converted size.
+               Thus, skip it.
             */
             result = Curl_pp_sendf(data, &ftpc->pp, "RETR %s", ftpc->file);
             if(!result)
-              ftp_state(data, FTP_RETR);
+              ftp_state(data, ftpc, FTP_RETR);
           }
           else {
             result = Curl_pp_sendf(data, &ftpc->pp, "SIZE %s", ftpc->file);
             if(!result)
-              ftp_state(data, FTP_RETR_SIZE);
+              ftp_state(data, ftpc, FTP_RETR_SIZE);
           }
         }
       }
       break;
     case FTP_STOR_PREQUOTE:
-      result = ftp_state_ul_setup(data, FALSE);
+      result = ftp_state_ul_setup(data, ftpc, ftp, FALSE);
       break;
     case FTP_POSTQUOTE:
       break;
+    case FTP_LIST_PREQUOTE:
+      ftp_state(data, ftpc, FTP_LIST_TYPE);
+      result = ftp_state_list(data, ftpc, ftp);
+      break;
     }
   }
 
@@ -1752,16 +1978,13 @@ static CURLcode ftp_state_quote(struct Curl_easy *data,
 /* called from ftp_state_pasv_resp to switch to PASV in case of EPSV
    problems */
 static CURLcode ftp_epsv_disable(struct Curl_easy *data,
+                                 struct ftp_conn *ftpc,
                                  struct connectdata *conn)
 {
   CURLcode result = CURLE_OK;
 
-  if(conn->bits.ipv6
-#ifndef CURL_DISABLE_PROXY
-     && !(conn->bits.tunnel_proxy || conn->bits.socksproxy)
-#endif
-    ) {
-    /* We can't disable EPSV when doing IPv6, so this is instead a fail */
+  if(conn->bits.ipv6 && !Curl_conn_is_tunneling(conn, FIRSTSOCKET)) {
+    /* We cannot disable EPSV when doing IPv6, so this is instead a fail */
     failf(data, "Failed EPSV attempt, exiting");
     return CURLE_WEIRD_SERVER_REPLY;
   }
@@ -1769,31 +1992,43 @@ static CURLcode ftp_epsv_disable(struct Curl_easy *data,
   infof(data, "Failed EPSV attempt. Disabling EPSV");
   /* disable it for next transfer */
   conn->bits.ftp_use_epsv = FALSE;
-  Curl_conn_close(data, SECONDARYSOCKET);
-  Curl_conn_cf_discard_all(data, conn, SECONDARYSOCKET);
+  close_secondarysocket(data, ftpc);
   data->state.errorbuf = FALSE; /* allow error message to get
                                          rewritten */
-  result = Curl_pp_sendf(data, &conn->proto.ftpc.pp, "%s", "PASV");
+  result = Curl_pp_sendf(data, &ftpc->pp, "%s", "PASV");
   if(!result) {
-    conn->proto.ftpc.count1++;
+    ftpc->count1++;
     /* remain in/go to the FTP_PASV state */
-    ftp_state(data, FTP_PASV);
+    ftp_state(data, ftpc, FTP_PASV);
   }
   return result;
 }
 
-
-static char *control_address(struct connectdata *conn)
+static CURLcode ftp_control_addr_dup(struct Curl_easy *data, char **newhostp)
 {
+  struct connectdata *conn = data->conn;
+  struct ip_quadruple ipquad;
+  bool is_ipv6;
+
   /* Returns the control connection IP address.
-     If a proxy tunnel is used, returns the original host name instead, because
+     If a proxy tunnel is used, returns the original hostname instead, because
      the effective control connection address is the proxy address,
      not the ftp host. */
 #ifndef CURL_DISABLE_PROXY
-  if(conn->bits.tunnel_proxy || conn->bits.socksproxy)
-    return conn->host.name;
+  if(Curl_conn_is_tunneling(conn, FIRSTSOCKET))
+    *newhostp = curlx_strdup(conn->origin->hostname);
+  else
 #endif
-  return conn->primary_ip;
+  if(!Curl_conn_get_ip_info(data, conn, FIRSTSOCKET, &is_ipv6, &ipquad) &&
+     *ipquad.remote_ip)
+    *newhostp = curlx_strdup(ipquad.remote_ip);
+  else {
+    /* failed to get the remote_ip of the DATA connection */
+    failf(data, "unable to get peername of DATA connection");
+    *newhostp = NULL;
+    return CURLE_FTP_CANT_GET_HOST;
+  }
+  return *newhostp ? CURLE_OK : CURLE_OUT_OF_MEMORY;
 }
 
 static bool match_pasv_6nums(const char *p,
@@ -1801,64 +2036,50 @@ static bool match_pasv_6nums(const char *p,
 {
   int i;
   for(i = 0; i < 6; i++) {
-    unsigned long num;
-    char *endp;
+    curl_off_t num;
     if(i) {
       if(*p != ',')
         return FALSE;
       p++;
     }
-    if(!ISDIGIT(*p))
-      return FALSE;
-    num = strtoul(p, &endp, 10);
-    if(num > 255)
+    if(curlx_str_number(&p, &num, 0xff))
       return FALSE;
     array[i] = (unsigned int)num;
-    p = endp;
   }
   return TRUE;
 }
 
 static CURLcode ftp_state_pasv_resp(struct Curl_easy *data,
+                                    struct ftp_conn *ftpc,
                                     int ftpcode)
 {
   struct connectdata *conn = data->conn;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
   CURLcode result;
-  struct Curl_dns_entry *addr = NULL;
-  enum resolve_t rc;
-  unsigned short connectport; /* the local port connect() should use! */
-  char *str = &data->state.buffer[4];  /* start on the first letter */
-
-  /* if we come here again, make sure the former name is cleared */
-  Curl_safefree(ftpc->newhost);
-
+  const struct pingpong *pp = &ftpc->pp;
+  char *newhost = NULL;
+  unsigned short newport = 0;
+  const char *str = curlx_dyn_ptr(&pp->recvbuf) + 4; /* start on the first
+                                                        letter */
   if((ftpc->count1 == 0) &&
      (ftpcode == 229)) {
     /* positive EPSV response */
-    char *ptr = strchr(str, '(');
+    const char *ptr = strchr(str, '(');
     if(ptr) {
       char sep;
       ptr++;
       /* |||12345| */
       sep = ptr[0];
-      /* the ISDIGIT() check here is because strtoul() accepts leading minus
-         etc */
-      if((ptr[1] == sep) && (ptr[2] == sep) && ISDIGIT(ptr[3])) {
-        char *endp;
-        unsigned long num = strtoul(&ptr[3], &endp, 10);
-        if(*endp != sep)
-          ptr = NULL;
-        else if(num > 0xffff) {
+      if(sep && (ptr[1] == sep) && (ptr[2] == sep) && ISDIGIT(ptr[3])) {
+        const char *p = &ptr[3];
+        curl_off_t num;
+        if(curlx_str_number(&p, &num, 0xffff) || (*p != sep)) {
           failf(data, "Illegal port number in EPSV reply");
           return CURLE_FTP_WEIRD_PASV_REPLY;
         }
-        if(ptr) {
-          ftpc->newport = (unsigned short)(num & 0xffff);
-          ftpc->newhost = strdup(control_address(conn));
-          if(!ftpc->newhost)
-            return CURLE_OUT_OF_MEMORY;
-        }
+        newport = (unsigned short)num;
+        result = ftp_control_addr_dup(data, &newhost);
+        if(result)
+          return result;
       }
       else
         ptr = NULL;
@@ -1889,7 +2110,7 @@ static CURLcode ftp_state_pasv_resp(struct Curl_easy *data,
     }
 
     if(!*str) {
-      failf(data, "Couldn't interpret the 227-response");
+      failf(data, "Could not interpret the 227-response");
       return CURLE_FTP_WEIRD_227_FORMAT;
     }
 
@@ -1898,120 +2119,301 @@ static CURLcode ftp_state_pasv_resp(struct Curl_easy *data,
       /* told to ignore the remotely given IP but instead use the host we used
          for the control connection */
       infof(data, "Skip %u.%u.%u.%u for data connection, reuse %s instead",
-            ip[0], ip[1], ip[2], ip[3],
-            conn->host.name);
-      ftpc->newhost = strdup(control_address(conn));
+            ip[0], ip[1], ip[2], ip[3], conn->origin->hostname);
+      result = ftp_control_addr_dup(data, &newhost);
+      if(result)
+        return result;
     }
     else
-      ftpc->newhost = aprintf("%u.%u.%u.%u", ip[0], ip[1], ip[2], ip[3]);
+      newhost = curl_maprintf("%u.%u.%u.%u", ip[0], ip[1], ip[2], ip[3]);
 
-    if(!ftpc->newhost)
+    if(!newhost)
       return CURLE_OUT_OF_MEMORY;
 
-    ftpc->newport = (unsigned short)(((ip[4]<<8) + ip[5]) & 0xffff);
+    newport = (unsigned short)(((ip[4] << 8) + ip[5]) & 0xffff);
   }
   else if(ftpc->count1 == 0) {
     /* EPSV failed, move on to PASV */
-    return ftp_epsv_disable(data, conn);
+    return ftp_epsv_disable(data, ftpc, conn);
   }
   else {
     failf(data, "Bad PASV/EPSV response: %03d", ftpcode);
     return CURLE_FTP_WEIRD_PASV_REPLY;
   }
 
-#ifndef CURL_DISABLE_PROXY
-  if(conn->bits.proxy) {
-    /*
-     * This connection uses a proxy and we need to connect to the proxy again
-     * here. We don't want to rely on a former host lookup that might've
-     * expired now, instead we remake the lookup here and now!
-     */
-    const char * const host_name = conn->bits.socksproxy ?
-      conn->socks_proxy.host.name : conn->http_proxy.host.name;
-    rc = Curl_resolv(data, host_name, conn->port, FALSE, &addr);
-    if(rc == CURLRESOLV_PENDING)
-      /* BLOCKING, ignores the return code but 'addr' will be NULL in
-         case of failure */
-      (void)Curl_resolver_wait_resolv(data, &addr);
+  DEBUGASSERT(newhost);
+  Curl_peer_unlink(&conn->origin2);
+  result = Curl_peer_create(data, conn->scheme, newhost, newport,
+                            &conn->origin2);
+  if(result)
+    goto error;
 
-    connectport =
-      (unsigned short)conn->port; /* we connect to the proxy's port */
-
-    if(!addr) {
-      failf(data, "Can't resolve proxy host %s:%hu", host_name, connectport);
-      return CURLE_COULDNT_RESOLVE_PROXY;
-    }
-  }
-  else
-#endif
-  {
-    /* normal, direct, ftp connection */
-    DEBUGASSERT(ftpc->newhost);
-
-    /* postponed address resolution in case of tcp fastopen */
-    if(conn->bits.tcp_fastopen && !conn->bits.reuse && !ftpc->newhost[0]) {
-      Curl_conn_ev_update_info(data, conn);
-      Curl_safefree(ftpc->newhost);
-      ftpc->newhost = strdup(control_address(conn));
-      if(!ftpc->newhost)
-        return CURLE_OUT_OF_MEMORY;
-    }
-
-    rc = Curl_resolv(data, ftpc->newhost, ftpc->newport, FALSE, &addr);
-    if(rc == CURLRESOLV_PENDING)
-      /* BLOCKING */
-      (void)Curl_resolver_wait_resolv(data, &addr);
-
-    connectport = ftpc->newport; /* we connect to the remote port */
-
-    if(!addr) {
-      failf(data, "Can't resolve new host %s:%hu", ftpc->newhost, connectport);
-      return CURLE_FTP_CANT_GET_HOST;
-    }
+  /* If FIRSTSOCKET goes via another peer, SECONDARY needs as well,
+   * but with its new port. */
+  if(conn->via_peer) {
+    Curl_peer_unlink(&conn->via_peer2);
+    result = Curl_peer_create(data, conn->via_peer->scheme,
+                              conn->via_peer->hostname, newport,
+                              &conn->via_peer2);
+    if(result)
+      goto error;
   }
 
-  result = Curl_conn_setup(data, conn, SECONDARYSOCKET, addr,
-                           conn->bits.ftp_use_data_ssl?
+  result = Curl_conn_setup(data, conn, SECONDARYSOCKET,
+                           conn->bits.ftp_use_data_ssl ?
                            CURL_CF_SSL_ENABLE : CURL_CF_SSL_DISABLE);
 
   if(result) {
-    Curl_resolv_unlock(data, addr); /* we're done using this address */
-    if(ftpc->count1 == 0 && ftpcode == 229)
-      return ftp_epsv_disable(data, conn);
-
-    return result;
+    if((result != CURLE_OUT_OF_MEMORY) &&
+       (ftpc->count1 == 0) && (ftpcode == 229)) {
+      result = ftp_epsv_disable(data, ftpc, conn);
+    }
+    goto error;
   }
 
-
   /*
-   * When this is used from the multi interface, this might've returned with
+   * When this is used from the multi interface, this might have returned with
    * the 'connected' set to FALSE and thus we are now awaiting a non-blocking
    * connect to connect.
    */
 
-  if(data->set.verbose)
-    /* this just dumps information about this second connection */
-    ftp_pasv_verbose(data, addr->addr, ftpc->newhost, connectport);
-
-  Curl_resolv_unlock(data, addr); /* we're done using this address */
-
-  Curl_safefree(conn->secondaryhostname);
-  conn->secondary_port = ftpc->newport;
-  conn->secondaryhostname = strdup(ftpc->newhost);
-  if(!conn->secondaryhostname)
-    return CURLE_OUT_OF_MEMORY;
+#ifdef CURLVERBOSE
+  if(data->set.verbose) {
+    /* Dump information about this second connection when we have issued
+     * a PASV command. */
+    infof(data, "Connecting to %s port %d",
+          conn->origin2->hostname, conn->origin2->port);
+  }
+#endif
 
   conn->bits.do_more = TRUE;
-  ftp_state(data, FTP_STOP); /* this phase is completed */
+  ftp_state(data, ftpc, FTP_STOP); /* this phase is completed */
+
+error:
+  curlx_free(newhost);
+  return result;
+}
+
+/* called repeatedly until done from multi.c */
+static CURLcode ftp_statemach(struct Curl_easy *data,
+                              struct ftp_conn *ftpc,
+                              bool *done)
+{
+  CURLcode result = Curl_pp_statemach(data, &ftpc->pp, FALSE, FALSE);
+
+  /* Check for the state outside of the Curl_socket_check() return code checks
+     since at times we are in fact already in this state when this function
+     gets called. */
+  *done = (ftpc->state == FTP_STOP);
 
   return result;
 }
 
+/*
+ * ftp_do_more()
+ *
+ * This function shall be called when the second FTP (data) connection is
+ * connected.
+ *
+ * 'more' can return DOMORE_INCOMPLETE, DOMORE_DONE or DOMORE_GOBACK
+ * (which is for when PASV is being sent to retry a failed EPSV).
+ */
+static CURLcode ftp_do_more(struct Curl_easy *data, domore *more)
+{
+  struct connectdata *conn = data->conn;
+  struct ftp_conn *ftpc = Curl_conn_meta_get(data->conn, CURL_META_FTP_CONN);
+  struct FTP *ftp = Curl_meta_get(data, CURL_META_FTP_EASY);
+  CURLcode result = CURLE_OK;
+  bool connected = FALSE;
+  bool complete = FALSE;
+  /* the ftp struct is inited in ftp_connect(). If we are connecting to an HTTP
+   * proxy then the state will not be valid until after that connection is
+   * complete */
+
+  if(!ftpc || !ftp)
+    return CURLE_FAILED_INIT;
+
+  *more = DOMORE_INCOMPLETE; /* default to stay in the state */
+
+  /* if the second connection has been set up, try to connect it fully
+   * to the remote host. This may not complete at this time, for several
+   * reasons:
+   * - we do EPTR and the server will not connect to our listen socket
+   *   until we send more FTP commands
+   * - an SSL filter is in place and the server will not start the TLS
+   *   handshake until we send more FTP commands
+   */
+  if(conn->cfilter[SECONDARYSOCKET]) {
+    bool is_eptr = Curl_conn_is_tcp_listen(data, SECONDARYSOCKET);
+    result = Curl_conn_connect(data, SECONDARYSOCKET, FALSE, &connected);
+    if(result == CURLE_OUT_OF_MEMORY)
+      return result;
+    if(result || (!connected && !is_eptr &&
+                  !Curl_conn_is_ip_connected(data, SECONDARYSOCKET))) {
+      if(result && !is_eptr && (ftpc->count1 == 0)) {
+        *more = DOMORE_GOBACK; /* go back to DOING please */
+        /* this is a EPSV connect failing, try PASV instead */
+        return ftp_epsv_disable(data, ftpc, conn);
+      }
+      return result;
+    }
+  }
+
+  if(ftpc->state) {
+    /* already in a state so skip the initial commands.
+       They are only done to kickstart the do_more state */
+    result = ftp_statemach(data, ftpc, &complete);
+
+    if(complete)
+      *more = DOMORE_DONE;
+
+    /* if we got an error or if we do not wait for a data connection return
+       immediately */
+    if(result || !ftpc->wait_data_conn)
+      return result;
+
+    /* if we reach the end of the FTP state machine here, *complete will be
+       TRUE but so is ftpc->wait_data_conn, which says we need to wait for the
+       data connection and therefore we are not actually complete */
+    *more = DOMORE_INCOMPLETE;
+  }
+
+  if(ftp->transfer <= PPTRANSFER_INFO) {
+    /* a transfer is about to take place, or if not a filename was given so we
+       will do a SIZE on it later and then we need the right TYPE first */
+
+    if(ftpc->wait_data_conn) {
+      bool serv_conned;
+
+      result = Curl_conn_connect(data, SECONDARYSOCKET, FALSE, &serv_conned);
+      if(result)
+        return result; /* Failed to accept data connection */
+
+      if(serv_conned) {
+        /* It looks data connection is established */
+        ftpc->wait_data_conn = FALSE;
+        result = ftp_initiate_transfer(data, ftpc);
+
+        if(result)
+          return result;
+
+        *more = DOMORE_DONE; /* this state is now complete when the server has
+                                connected back to us */
+      }
+      else {
+        result = ftp_check_ctrl_on_data_wait(data, ftpc);
+        if(result)
+          return result;
+      }
+    }
+    else if(data->state.upload) {
+      result = ftp_nb_type(data, ftpc, ftp, (bool)data->state.prefer_ascii,
+                           FTP_STOR_TYPE);
+      if(result)
+        return result;
+
+      result = ftp_statemach(data, ftpc, &complete);
+      /* ftp_nb_type() might have skipped sending `TYPE A|I` when not
+       * deemed necessary and directly sent `STORE name`. If this was
+       * then complete, but we are still waiting on the data connection,
+       * the transfer has not been initiated yet. */
+      *more = (!ftpc->wait_data_conn && complete) ?
+        DOMORE_DONE : DOMORE_INCOMPLETE;
+    }
+    else {
+      /* download */
+      ftp->downloadsize = -1; /* unknown as of yet */
+
+      result = Curl_range(data);
+
+      if(result == CURLE_OK && data->req.maxdownload >= 0) {
+        /* Do not check for successful transfer */
+        ftpc->dont_check = TRUE;
+      }
+
+      if(result)
+        ;
+      else if((data->state.list_only || !ftpc->file) &&
+              !(data->set.prequote)) {
+        /* The specified path ends with a slash, and therefore we think this
+           is a directory that is requested, use LIST. Before that, we also
+           need to set ASCII transfer mode. */
+
+        /* Only if a body transfer was requested. */
+        if(ftp->transfer == PPTRANSFER_BODY) {
+          result = ftp_nb_type(data, ftpc, ftp, TRUE, FTP_LIST_TYPE);
+          if(result)
+            return result;
+        }
+        /* otherwise fall through */
+      }
+      else {
+        if(data->set.prequote && !ftpc->file) {
+          result = ftp_nb_type(data, ftpc, ftp, TRUE,
+                               FTP_RETR_LIST_TYPE);
+        }
+        else {
+          result = ftp_nb_type(data, ftpc, ftp, (bool)data->state.prefer_ascii,
+                               FTP_RETR_TYPE);
+        }
+        if(result)
+          return result;
+      }
+
+      result = ftp_statemach(data, ftpc, &complete);
+      if(complete)
+        *more = DOMORE_DONE;
+    }
+    return result;
+  }
+
+  /* no data to transfer */
+  Curl_xfer_setup_nop(data);
+
+  if(!ftpc->wait_data_conn) {
+    /* no waiting for the data connection so this is now complete */
+    *more = DOMORE_DONE;
+    CURL_TRC_FTP(data, "[%s] DO-MORE phase ends with %d", FTP_CSTATE(ftpc),
+                 (int)result);
+  }
+
+  return result;
+}
+
+/* call this when the DO phase has completed */
+static CURLcode ftp_dophase_done(struct Curl_easy *data,
+                                 struct ftp_conn *ftpc,
+                                 struct FTP *ftp,
+                                 bool connected)
+{
+  if(connected) {
+    domore completed;
+    CURLcode result = ftp_do_more(data, &completed);
+
+    if(result) {
+      close_secondarysocket(data, ftpc);
+      return result;
+    }
+  }
+
+  if(ftp->transfer != PPTRANSFER_BODY)
+    /* no data to transfer */
+    Curl_xfer_setup_nop(data);
+  else if(!connected)
+    /* since we did not connect now, we want do_more to get called */
+    data->conn->bits.do_more = TRUE;
+
+  ftpc->ctl_valid = TRUE; /* seems good */
+
+  return CURLE_OK;
+}
+
 static CURLcode ftp_state_port_resp(struct Curl_easy *data,
+                                    struct ftp_conn *ftpc,
+                                    struct FTP *ftp,
                                     int ftpcode)
 {
   struct connectdata *conn = data->conn;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
   ftpport fcmd = (ftpport)ftpc->count1;
   CURLcode result = CURLE_OK;
 
@@ -2032,101 +2434,141 @@ static CURLcode ftp_state_port_resp(struct Curl_easy *data,
     }
     else
       /* try next */
-      result = ftp_state_use_port(data, fcmd);
+      result = ftp_state_use_port(data, ftpc, fcmd);
   }
   else {
     infof(data, "Connect data stream actively");
-    ftp_state(data, FTP_STOP); /* end of DO phase */
-    result = ftp_dophase_done(data, FALSE);
+    ftp_state(data, ftpc, FTP_STOP); /* end of DO phase */
+    result = ftp_dophase_done(data, ftpc, ftp, FALSE);
   }
 
   return result;
 }
 
-static int twodigit(const char *p)
+/* return TRUE on error, FALSE on success */
+static bool twodigit(const char *p, int *val)
 {
-  return (p[0]-'0') * 10 + (p[1]-'0');
+  if(!ISDIGIT(p[0]) || !ISDIGIT(p[1]))
+    return TRUE;
+  /* curlx_hexval() works fine here since we make sure it is decimal above */
+  *val = (curlx_hexval(p[0]) * 10) + curlx_hexval(p[1]);
+  return FALSE;
 }
 
-static bool ftp_213_date(const char *p, int *year, int *month, int *day,
-                         int *hour, int *minute, int *second)
+/*
+ * @unittest 1668
+ */
+UNITTEST bool ftp_213_date(const char *p, int *year, int *month, int *day,
+                           int *hour, int *minute, int *second);
+UNITTEST bool ftp_213_date(const char *p, int *year, int *month, int *day,
+                           int *hour, int *minute, int *second)
 {
-  size_t len = strlen(p);
-  if(len < 14)
+  int century;
+  if((strlen(p) < 14) || twodigit(&p[0], &century) || twodigit(&p[2], year) ||
+     twodigit(&p[4], month) || twodigit(&p[6], day) ||
+     twodigit(&p[8], hour) || twodigit(&p[10], minute) ||
+     twodigit(&p[12], second))
     return FALSE;
-  *year = twodigit(&p[0]) * 100 + twodigit(&p[2]);
-  *month = twodigit(&p[4]);
-  *day = twodigit(&p[6]);
-  *hour = twodigit(&p[8]);
-  *minute = twodigit(&p[10]);
-  *second = twodigit(&p[12]);
 
+  *year += century * 100;
   if((*month > 12) || (*day > 31) || (*hour > 23) || (*minute > 59) ||
      (*second > 60))
     return FALSE;
   return TRUE;
 }
 
+static CURLcode client_write_header(struct Curl_easy *data,
+                                    char *buf, size_t blen)
+{
+  /* Some replies from an FTP server are written to the client
+   * as CLIENTWRITE_HEADER, formatted as if they came from a
+   * HTTP conversation.
+   * In all protocols, CLIENTWRITE_HEADER data is only passed to
+   * the body write callback when data->set.include_header is set
+   * via CURLOPT_HEADER.
+   * For historic reasons, FTP never played this game and expects
+   * all its headers to do that always. Set that flag during the
+   * call to Curl_client_write() so it does the right thing.
+   *
+   * Notice that we cannot enable this flag for FTP in general,
+   * as an FTP transfer might involve an HTTP proxy connection and
+   * headers from CONNECT should not automatically be part of the
+   * output. */
+  CURLcode result;
+  bool save = (bool)data->set.include_header;
+  data->set.include_header = TRUE;
+  result = Curl_client_write(data, CLIENTWRITE_HEADER, buf, blen);
+  data->set.include_header = save;
+  return result;
+}
+
 static CURLcode ftp_state_mdtm_resp(struct Curl_easy *data,
+                                    struct ftp_conn *ftpc,
+                                    struct FTP *ftp,
                                     int ftpcode)
 {
   CURLcode result = CURLE_OK;
-  struct FTP *ftp = data->req.p.ftp;
-  struct connectdata *conn = data->conn;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
 
   switch(ftpcode) {
-  case 213:
-    {
-      /* we got a time. Format should be: "YYYYMMDDHHMMSS[.sss]" where the
-         last .sss part is optional and means fractions of a second */
-      int year, month, day, hour, minute, second;
-      if(ftp_213_date(&data->state.buffer[4],
-                      &year, &month, &day, &hour, &minute, &second)) {
-        /* we have a time, reformat it */
-        char timebuf[24];
-        msnprintf(timebuf, sizeof(timebuf),
-                  "%04d%02d%02d %02d:%02d:%02d GMT",
-                  year, month, day, hour, minute, second);
-        /* now, convert this into a time() value: */
-        data->info.filetime = Curl_getdate_capped(timebuf);
-      }
-
-#ifdef CURL_FTP_HTTPSTYLE_HEAD
-      /* If we asked for a time of the file and we actually got one as well,
-         we "emulate" an HTTP-style header in our output. */
-
-      if(data->req.no_body &&
-         ftpc->file &&
-         data->set.get_filetime &&
-         (data->info.filetime >= 0) ) {
-        char headerbuf[128];
-        int headerbuflen;
-        time_t filetime = data->info.filetime;
-        struct tm buffer;
-        const struct tm *tm = &buffer;
-
-        result = Curl_gmtime(filetime, &buffer);
-        if(result)
-          return result;
-
-        /* format: "Tue, 15 Nov 1994 12:45:26" */
-        headerbuflen = msnprintf(headerbuf, sizeof(headerbuf),
-                  "Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT\r\n",
-                  Curl_wkday[tm->tm_wday?tm->tm_wday-1:6],
-                  tm->tm_mday,
-                  Curl_month[tm->tm_mon],
-                  tm->tm_year + 1900,
-                  tm->tm_hour,
-                  tm->tm_min,
-                  tm->tm_sec);
-        result = Curl_client_write(data, CLIENTWRITE_BOTH, headerbuf,
-                                   headerbuflen);
-        if(result)
-          return result;
-      } /* end of a ridiculous amount of conditionals */
-#endif
+  case 213: {
+    /* we got a time. Format should be: "YYYYMMDDHHMMSS[.sss]" where the
+       last .sss part is optional and means fractions of a second */
+    int year, month, day, hour, minute, second;
+    struct pingpong *pp = &ftpc->pp;
+    const char *resp = curlx_dyn_ptr(&pp->recvbuf) + 4;
+    bool showtime = FALSE;
+    if(ftp_213_date(resp, &year, &month, &day, &hour, &minute, &second)) {
+      /* we have a time, reformat it */
+      char timebuf[24];
+      curl_msnprintf(timebuf, sizeof(timebuf),
+                     "%04d%02d%02d %02d:%02d:%02d GMT",
+                     year, month, day, hour, minute, second);
+      /* now, convert this into a time() value: */
+      if(!Curl_getdate_capped(timebuf, &data->info.filetime))
+        showtime = TRUE;
     }
+
+    /* If we asked for a time of the file and we actually got one as well,
+       we "emulate" an HTTP-style header in our output. */
+
+#if defined(CURL_HAVE_DIAG) && (defined(__DJGPP__) || defined(__AMIGA__))
+#pragma GCC diagnostic push
+/* 'time_t' is unsigned in MSDOS and AmigaOS. Silence:
+   warning: comparison of unsigned expression in '>= 0' is always true */
+#pragma GCC diagnostic ignored "-Wtype-limits"
+#endif
+    if(data->req.no_body && ftpc->file &&
+       data->set.get_filetime && showtime) {
+#if defined(CURL_HAVE_DIAG) && (defined(__DJGPP__) || defined(__AMIGA__))
+#pragma GCC diagnostic pop
+#endif
+      char headerbuf[128];
+      int headerbuflen;
+      time_t filetime = data->info.filetime;
+      struct tm buffer;
+      const struct tm *tm = &buffer;
+
+      result = curlx_gmtime(filetime, &buffer);
+      if(result)
+        return result;
+
+      /* format: "Tue, 15 Nov 1994 12:45:26" */
+      headerbuflen =
+        curl_msnprintf(headerbuf, sizeof(headerbuf),
+                       "Last-Modified: %s, %02d %s %4d %02d:%02d:%02d "
+                       "GMT\r\n",
+                       Curl_wkday[tm->tm_wday ? tm->tm_wday-1 : 6],
+                       tm->tm_mday,
+                       Curl_month[tm->tm_mon],
+                       tm->tm_year + 1900,
+                       tm->tm_hour,
+                       tm->tm_min,
+                       tm->tm_sec);
+      result = client_write_header(data, headerbuf, headerbuflen);
+      if(result)
+        return result;
+    } /* end of a ridiculous amount of conditionals */
+  }
     break;
   default:
     infof(data, "unsupported MDTM reply format");
@@ -2148,7 +2590,7 @@ static CURLcode ftp_state_mdtm_resp(struct Curl_easy *data,
           infof(data, "The requested document is not new enough");
           ftp->transfer = PPTRANSFER_NONE; /* mark to not transfer data */
           data->info.timecond = TRUE;
-          ftp_state(data, FTP_STOP);
+          ftp_state(data, ftpc, FTP_STOP);
           return CURLE_OK;
         }
         break;
@@ -2157,7 +2599,7 @@ static CURLcode ftp_state_mdtm_resp(struct Curl_easy *data,
           infof(data, "The requested document is not old enough");
           ftp->transfer = PPTRANSFER_NONE; /* mark to not transfer data */
           data->info.timecond = TRUE;
-          ftp_state(data, FTP_STOP);
+          ftp_state(data, ftpc, FTP_STOP);
           return CURLE_OK;
         }
         break;
@@ -2169,23 +2611,24 @@ static CURLcode ftp_state_mdtm_resp(struct Curl_easy *data,
   }
 
   if(!result)
-    result = ftp_state_type(data);
+    result = ftp_state_type(data, ftpc, ftp);
 
   return result;
 }
 
 static CURLcode ftp_state_type_resp(struct Curl_easy *data,
+                                    struct ftp_conn *ftpc,
+                                    struct FTP *ftp,
                                     int ftpcode,
                                     ftpstate instate)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
 
-  if(ftpcode/100 != 2) {
+  if(ftpcode / 100 != 2) {
     /* "sasserftpd" and "(u)r(x)bot ftpd" both responds with 226 after a
        successful 'TYPE I'. While that is not as RFC959 says, it is still a
        positive response code and we allow that. */
-    failf(data, "Couldn't set desired mode");
+    failf(data, "Could not set desired mode");
     return CURLE_FTP_COULDNT_SET_TYPE;
   }
   if(ftpcode != 200)
@@ -2193,128 +2636,48 @@ static CURLcode ftp_state_type_resp(struct Curl_easy *data,
           ftpcode);
 
   if(instate == FTP_TYPE)
-    result = ftp_state_size(data, conn);
+    result = ftp_state_size(data, ftpc, ftp);
   else if(instate == FTP_LIST_TYPE)
-    result = ftp_state_list(data);
+    result = ftp_state_list(data, ftpc, ftp);
   else if(instate == FTP_RETR_TYPE)
-    result = ftp_state_retr_prequote(data);
+    result = ftp_state_retr_prequote(data, ftpc, ftp);
   else if(instate == FTP_STOR_TYPE)
-    result = ftp_state_stor_prequote(data);
-
-  return result;
-}
-
-static CURLcode ftp_state_retr(struct Curl_easy *data,
-                               curl_off_t filesize)
-{
-  CURLcode result = CURLE_OK;
-  struct FTP *ftp = data->req.p.ftp;
-  struct connectdata *conn = data->conn;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
-
-  DEBUGF(infof(data, "ftp_state_retr()"));
-  if(data->set.max_filesize && (filesize > data->set.max_filesize)) {
-    failf(data, "Maximum file size exceeded");
-    return CURLE_FILESIZE_EXCEEDED;
-  }
-  ftp->downloadsize = filesize;
-
-  if(data->state.resume_from) {
-    /* We always (attempt to) get the size of downloads, so it is done before
-       this even when not doing resumes. */
-    if(filesize == -1) {
-      infof(data, "ftp server doesn't support SIZE");
-      /* We couldn't get the size and therefore we can't know if there really
-         is a part of the file left to get, although the server will just
-         close the connection when we start the connection so it won't cause
-         us any harm, just not make us exit as nicely. */
-    }
-    else {
-      /* We got a file size report, so we check that there actually is a
-         part of the file left to get, or else we go home.  */
-      if(data->state.resume_from< 0) {
-        /* We're supposed to download the last abs(from) bytes */
-        if(filesize < -data->state.resume_from) {
-          failf(data, "Offset (%" CURL_FORMAT_CURL_OFF_T
-                ") was beyond file size (%" CURL_FORMAT_CURL_OFF_T ")",
-                data->state.resume_from, filesize);
-          return CURLE_BAD_DOWNLOAD_RESUME;
-        }
-        /* convert to size to download */
-        ftp->downloadsize = -data->state.resume_from;
-        /* download from where? */
-        data->state.resume_from = filesize - ftp->downloadsize;
-      }
-      else {
-        if(filesize < data->state.resume_from) {
-          failf(data, "Offset (%" CURL_FORMAT_CURL_OFF_T
-                ") was beyond file size (%" CURL_FORMAT_CURL_OFF_T ")",
-                data->state.resume_from, filesize);
-          return CURLE_BAD_DOWNLOAD_RESUME;
-        }
-        /* Now store the number of bytes we are expected to download */
-        ftp->downloadsize = filesize-data->state.resume_from;
-      }
-    }
-
-    if(ftp->downloadsize == 0) {
-      /* no data to transfer */
-      Curl_setup_transfer(data, -1, -1, FALSE, -1);
-      infof(data, "File already completely downloaded");
-
-      /* Set ->transfer so that we won't get any error in ftp_done()
-       * because we didn't transfer the any file */
-      ftp->transfer = PPTRANSFER_NONE;
-      ftp_state(data, FTP_STOP);
-      return CURLE_OK;
-    }
-
-    /* Set resume file transfer offset */
-    infof(data, "Instructs server to resume from offset %"
-          CURL_FORMAT_CURL_OFF_T, data->state.resume_from);
-
-    result = Curl_pp_sendf(data, &ftpc->pp, "REST %" CURL_FORMAT_CURL_OFF_T,
-                           data->state.resume_from);
-    if(!result)
-      ftp_state(data, FTP_RETR_REST);
-  }
-  else {
-    /* no resume */
-    result = Curl_pp_sendf(data, &ftpc->pp, "RETR %s", ftpc->file);
-    if(!result)
-      ftp_state(data, FTP_RETR);
-  }
+    result = ftp_state_stor_prequote(data, ftpc, ftp);
+  else if(instate == FTP_RETR_LIST_TYPE)
+    result = ftp_state_list_prequote(data, ftpc, ftp);
 
   return result;
 }
 
 static CURLcode ftp_state_size_resp(struct Curl_easy *data,
+                                    struct ftp_conn *ftpc,
+                                    struct FTP *ftp,
                                     int ftpcode,
                                     ftpstate instate)
 {
   CURLcode result = CURLE_OK;
   curl_off_t filesize = -1;
-  char *buf = data->state.buffer;
+  const char *buf = curlx_dyn_ptr(&ftpc->pp.recvbuf);
+  size_t len = ftpc->pp.nfinal;
 
   /* get the size from the ascii string: */
   if(ftpcode == 213) {
     /* To allow servers to prepend "rubbish" in the response string, we scan
        for all the digits at the end of the response and parse only those as a
        number. */
-    char *start = &buf[4];
-    char *fdigit = strchr(start, '\r');
+    const char *start = &buf[4];
+    const char *fdigit = memchr(start, '\r', len - 4);
     if(fdigit) {
-      do
+      fdigit--;
+      if(*fdigit == '\n')
+        fdigit--;
+      while(ISDIGIT(fdigit[-1]) && (fdigit > start))
         fdigit--;
-      while(ISDIGIT(*fdigit) && (fdigit > start));
-      if(!ISDIGIT(*fdigit))
-        fdigit++;
     }
     else
       fdigit = start;
-    /* ignores parsing errors, which will make the size remain unknown */
-    (void)curlx_strtoofft(fdigit, NULL, 10, &filesize);
-
+    if(curlx_str_number(&fdigit, &filesize, CURL_OFF_T_MAX))
+      filesize = -1; /* size remain unknown */
   }
   else if(ftpcode == 550) { /* "No such file or directory" */
     /* allow a SIZE failure for (resumed) uploads, when probing what command
@@ -2326,63 +2689,59 @@ static CURLcode ftp_state_size_resp(struct Curl_easy *data,
   }
 
   if(instate == FTP_SIZE) {
-#ifdef CURL_FTP_HTTPSTYLE_HEAD
-    if(-1 != filesize) {
+    if(filesize != -1) {
       char clbuf[128];
-      int clbuflen = msnprintf(clbuf, sizeof(clbuf),
-                "Content-Length: %" CURL_FORMAT_CURL_OFF_T "\r\n", filesize);
-      result = Curl_client_write(data, CLIENTWRITE_BOTH, clbuf, clbuflen);
+      int clbuflen = curl_msnprintf(clbuf, sizeof(clbuf),
+                                    "Content-Length: %" FMT_OFF_T "\r\n",
+                                    filesize);
+      result = client_write_header(data, clbuf, clbuflen);
       if(result)
         return result;
     }
-#endif
     Curl_pgrsSetDownloadSize(data, filesize);
-    result = ftp_state_rest(data, data->conn);
+    result = ftp_state_rest(data, ftpc, ftp);
   }
   else if(instate == FTP_RETR_SIZE) {
     Curl_pgrsSetDownloadSize(data, filesize);
-    result = ftp_state_retr(data, filesize);
+    result = ftp_state_retr(data, ftpc, ftp, filesize);
   }
   else if(instate == FTP_STOR_SIZE) {
     data->state.resume_from = filesize;
-    result = ftp_state_ul_setup(data, TRUE);
+    result = ftp_state_ul_setup(data, ftpc, ftp, TRUE);
   }
 
   return result;
 }
 
 static CURLcode ftp_state_rest_resp(struct Curl_easy *data,
-                                    struct connectdata *conn,
+                                    struct ftp_conn *ftpc,
+                                    struct FTP *ftp,
                                     int ftpcode,
                                     ftpstate instate)
 {
   CURLcode result = CURLE_OK;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
 
   switch(instate) {
   case FTP_REST:
   default:
-#ifdef CURL_FTP_HTTPSTYLE_HEAD
     if(ftpcode == 350) {
-      char buffer[24]= { "Accept-ranges: bytes\r\n" };
-      result = Curl_client_write(data, CLIENTWRITE_BOTH, buffer,
-                                 strlen(buffer));
+      char buffer[24] = { "Accept-ranges: bytes\r\n" };
+      result = client_write_header(data, buffer, strlen(buffer));
       if(result)
         return result;
     }
-#endif
-    result = ftp_state_prepare_transfer(data);
+    result = ftp_state_prepare_transfer(data, ftpc, ftp);
     break;
 
   case FTP_RETR_REST:
     if(ftpcode != 350) {
-      failf(data, "Couldn't use REST");
+      failf(data, "Could not use REST");
       result = CURLE_FTP_COULDNT_USE_REST;
     }
     else {
       result = Curl_pp_sendf(data, &ftpc->pp, "RETR %s", ftpc->file);
       if(!result)
-        ftp_state(data, FTP_RETR);
+        ftp_state(data, ftpc, FTP_RETR);
     }
     break;
   }
@@ -2391,49 +2750,45 @@ static CURLcode ftp_state_rest_resp(struct Curl_easy *data,
 }
 
 static CURLcode ftp_state_stor_resp(struct Curl_easy *data,
-                                    int ftpcode, ftpstate instate)
+                                    struct ftp_conn *ftpc,
+                                    int ftpcode)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
 
   if(ftpcode >= 400) {
     failf(data, "Failed FTP upload: %0d", ftpcode);
-    ftp_state(data, FTP_STOP);
-    /* oops, we never close the sockets! */
+    ftp_state(data, ftpc, FTP_STOP);
     return CURLE_UPLOAD_FAILED;
   }
 
-  conn->proto.ftpc.state_saved = instate;
-
   /* PORT means we are now awaiting the server to connect to us. */
   if(data->set.ftp_use_port) {
     bool connected;
 
-    ftp_state(data, FTP_STOP); /* no longer in STOR state */
+    ftp_state(data, ftpc, FTP_STOP); /* no longer in STOR state */
 
-    result = AllowServerConnect(data, &connected);
+    result = Curl_conn_connect(data, SECONDARYSOCKET, FALSE, &connected);
     if(result)
       return result;
 
     if(!connected) {
-      struct ftp_conn *ftpc = &conn->proto.ftpc;
       infof(data, "Data conn was not available immediately");
       ftpc->wait_data_conn = TRUE;
+      return ftp_check_ctrl_on_data_wait(data, ftpc);
     }
-
-    return CURLE_OK;
+    ftpc->wait_data_conn = FALSE;
   }
-  return InitiateTransfer(data);
+  return ftp_initiate_transfer(data, ftpc);
 }
 
 /* for LIST and RETR responses */
 static CURLcode ftp_state_get_resp(struct Curl_easy *data,
+                                   struct ftp_conn *ftpc,
+                                   struct FTP *ftp,
                                    int ftpcode,
                                    ftpstate instate)
 {
   CURLcode result = CURLE_OK;
-  struct FTP *ftp = data->req.p.ftp;
-  struct connectdata *conn = data->conn;
 
   if((ftpcode == 150) || (ftpcode == 125)) {
 
@@ -2454,8 +2809,7 @@ static CURLcode ftp_state_get_resp(struct Curl_easy *data,
       E:
       125 Data connection already open; Transfer starting. */
 
-    curl_off_t size = -1; /* default unknown size */
-
+    data->req.size = -1; /* default unknown size */
 
     /*
      * It appears that there are FTP-servers that return size 0 for files when
@@ -2471,84 +2825,69 @@ static CURLcode ftp_state_get_resp(struct Curl_easy *data,
        !data->set.ignorecl &&
        (ftp->downloadsize < 1)) {
       /*
-       * It seems directory listings either don't show the size or very
-       * often uses size 0 anyway. ASCII transfers may very well turn out
-       * that the transferred amount of data is not the same as this line
-       * tells, why using this number in those cases only confuses us.
+       * It seems directory listings either do not show the size or often uses
+       * size 0 anyway. ASCII transfers may cause that the transferred amount
+       * of data is not the same as this line tells, why using this number in
+       * those cases only confuses us.
        *
        * Example D above makes this parsing a little tricky */
-      char *bytes;
-      char *buf = data->state.buffer;
-      bytes = strstr(buf, " bytes");
-      if(bytes) {
-        long in = (long)(--bytes-buf);
-        /* this is a hint there is size information in there! ;-) */
-        while(--in) {
-          /* scan for the left parenthesis and break there */
-          if('(' == *bytes)
-            break;
-          /* skip only digits */
-          if(!ISDIGIT(*bytes)) {
-            bytes = NULL;
+      size_t len = curlx_dyn_len(&ftpc->pp.recvbuf);
+      if(len >= 7) { /* "1 bytes" is 7 characters */
+        size_t i;
+        for(i = 0; i < len - 7; i++) {
+          curl_off_t what;
+          const char *buf = curlx_dyn_ptr(&ftpc->pp.recvbuf);
+          const char *c = &buf[i];
+          if(!curlx_str_number(&c, &what, CURL_OFF_T_MAX) &&
+             !curlx_str_single(&c, ' ') &&
+             !strncmp(c, "bytes", 5)) {
+            data->req.size = what;
             break;
           }
-          /* one more estep backwards */
-          bytes--;
-        }
-        /* if we have nothing but digits: */
-        if(bytes) {
-          ++bytes;
-          /* get the number! */
-          (void)curlx_strtoofft(bytes, NULL, 10, &size);
         }
       }
     }
     else if(ftp->downloadsize > -1)
-      size = ftp->downloadsize;
+      data->req.size = ftp->downloadsize;
 
-    if(size > data->req.maxdownload && data->req.maxdownload > 0)
-      size = data->req.size = data->req.maxdownload;
+    if(data->req.size > data->req.maxdownload && data->req.maxdownload > 0)
+      data->req.size = data->req.maxdownload;
     else if((instate != FTP_LIST) && (data->state.prefer_ascii))
-      size = -1; /* kludge for servers that understate ASCII mode file size */
+      data->req.size = -1; /* for servers that understate ASCII mode file
+                              size */
 
-    infof(data, "Maxdownload = %" CURL_FORMAT_CURL_OFF_T,
-          data->req.maxdownload);
+    infof(data, "Maxdownload = %" FMT_OFF_T, data->req.maxdownload);
 
     if(instate != FTP_LIST)
-      infof(data, "Getting file with size: %" CURL_FORMAT_CURL_OFF_T,
-            size);
-
-    /* FTP download: */
-    conn->proto.ftpc.state_saved = instate;
-    conn->proto.ftpc.retr_size_saved = size;
+      infof(data, "Getting file with size: %" FMT_OFF_T, data->req.size);
 
     if(data->set.ftp_use_port) {
       bool connected;
 
-      result = AllowServerConnect(data, &connected);
+      result = Curl_conn_connect(data, SECONDARYSOCKET, FALSE, &connected);
       if(result)
         return result;
 
       if(!connected) {
-        struct ftp_conn *ftpc = &conn->proto.ftpc;
         infof(data, "Data conn was not available immediately");
-        ftp_state(data, FTP_STOP);
+        ftp_state(data, ftpc, FTP_STOP);
         ftpc->wait_data_conn = TRUE;
+        return ftp_check_ctrl_on_data_wait(data, ftpc);
       }
+      ftpc->wait_data_conn = FALSE;
     }
-    else
-      return InitiateTransfer(data);
+    return ftp_initiate_transfer(data, ftpc);
   }
   else {
     if((instate == FTP_LIST) && (ftpcode == 450)) {
-      /* simply no matching files in the dir listing */
-      ftp->transfer = PPTRANSFER_NONE; /* don't download anything */
-      ftp_state(data, FTP_STOP); /* this phase is over */
+      /* no matching files in the directory listing */
+      ftp->transfer = PPTRANSFER_NONE; /* do not download anything */
+      ftp_state(data, ftpc, FTP_STOP); /* this phase is over */
     }
     else {
       failf(data, "RETR response: %03d", ftpcode);
-      return instate == FTP_RETR && ftpcode == 550?
-        CURLE_REMOTE_FILE_NOT_FOUND:
+      return instate == FTP_RETR && ftpcode == 550 ?
+        CURLE_REMOTE_FILE_NOT_FOUND :
         CURLE_FTP_COULDNT_RETR_FILE;
     }
   }
@@ -2557,12 +2896,12 @@ static CURLcode ftp_state_get_resp(struct Curl_easy *data,
 }
 
 /* after USER, PASS and ACCT */
-static CURLcode ftp_state_loggedin(struct Curl_easy *data)
+static CURLcode ftp_state_loggedin(struct Curl_easy *data,
+                                   struct ftp_conn *ftpc)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
 
-  if(conn->bits.ftp_use_control_ssl) {
+  if(Curl_conn_is_ssl(data->conn, FIRSTSOCKET)) {
     /* PBSZ = PROTECTION BUFFER SIZE.
 
     The 'draft-murray-auth-ftp-ssl' (draft 12, page 7) says:
@@ -2577,44 +2916,43 @@ static CURLcode ftp_state_loggedin(struct Curl_easy *data)
     parameter of '0' to indicate that no buffering is taking place
     and the data connection should not be encapsulated.
     */
-    result = Curl_pp_sendf(data, &conn->proto.ftpc.pp, "PBSZ %d", 0);
+    result = Curl_pp_sendf(data, &ftpc->pp, "PBSZ %d", 0);
     if(!result)
-      ftp_state(data, FTP_PBSZ);
+      ftp_state(data, ftpc, FTP_PBSZ);
   }
   else {
-    result = ftp_state_pwd(data, conn);
+    result = ftp_state_pwd(data, ftpc);
   }
   return result;
 }
 
 /* for USER and PASS responses */
 static CURLcode ftp_state_user_resp(struct Curl_easy *data,
+                                    struct ftp_conn *ftpc,
                                     int ftpcode)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
 
-  /* some need password anyway, and others just return 2xx ignored */
+  /* some need password anyway, and others return 2xx ignored */
   if((ftpcode == 331) && (ftpc->state == FTP_USER)) {
     /* 331 Password required for ...
        (the server requires to send the user's password too) */
     result = Curl_pp_sendf(data, &ftpc->pp, "PASS %s",
-                           conn->passwd?conn->passwd:"");
+                           Curl_creds_passwd(data->conn->creds));
     if(!result)
-      ftp_state(data, FTP_PASS);
+      ftp_state(data, ftpc, FTP_PASS);
   }
-  else if(ftpcode/100 == 2) {
+  else if(ftpcode / 100 == 2) {
     /* 230 User ... logged in.
        (the user logged in with or without password) */
-    result = ftp_state_loggedin(data);
+    result = ftp_state_loggedin(data, ftpc);
   }
   else if(ftpcode == 332) {
     if(data->set.str[STRING_FTP_ACCOUNT]) {
       result = Curl_pp_sendf(data, &ftpc->pp, "ACCT %s",
                              data->set.str[STRING_FTP_ACCOUNT]);
       if(!result)
-        ftp_state(data, FTP_ACCT);
+        ftp_state(data, ftpc, FTP_ACCT);
     }
     else {
       failf(data, "ACCT requested but none available");
@@ -2629,13 +2967,12 @@ static CURLcode ftp_state_user_resp(struct Curl_easy *data,
 
     if(data->set.str[STRING_FTP_ALTERNATIVE_TO_USER] &&
        !ftpc->ftp_trying_alternative) {
-      /* Ok, USER failed.  Let's try the supplied command. */
-      result =
-        Curl_pp_sendf(data, &ftpc->pp, "%s",
-                      data->set.str[STRING_FTP_ALTERNATIVE_TO_USER]);
+      /* Ok, USER failed. Let's try the supplied command. */
+      result = Curl_pp_sendf(data, &ftpc->pp, "%s",
+                             data->set.str[STRING_FTP_ALTERNATIVE_TO_USER]);
       if(!result) {
         ftpc->ftp_trying_alternative = TRUE;
-        ftp_state(data, FTP_USER);
+        ftp_state(data, ftpc, FTP_USER);
       }
     }
     else {
@@ -2648,6 +2985,7 @@ static CURLcode ftp_state_user_resp(struct Curl_easy *data,
 
 /* for ACCT response */
 static CURLcode ftp_state_acct_resp(struct Curl_easy *data,
+                                    struct ftp_conn *ftpc,
                                     int ftpcode)
 {
   CURLcode result = CURLE_OK;
@@ -2656,494 +2994,502 @@ static CURLcode ftp_state_acct_resp(struct Curl_easy *data,
     result = CURLE_FTP_WEIRD_PASS_REPLY; /* FIX */
   }
   else
-    result = ftp_state_loggedin(data);
+    result = ftp_state_loggedin(data, ftpc);
 
   return result;
 }
 
+static CURLcode ftp_pwd_resp(struct Curl_easy *data,
+                             struct ftp_conn *ftpc,
+                             int ftpcode)
+{
+  struct pingpong *pp = &ftpc->pp;
+  CURLcode result;
 
-static CURLcode ftp_statemachine(struct Curl_easy *data,
-                                 struct connectdata *conn)
+  if(ftpcode == 257) {
+    const char *ptr = curlx_dyn_ptr(&pp->recvbuf) + 4; /* start on the first
+                                                          letter */
+    bool entry_extracted = FALSE;
+    struct dynbuf out;
+    curlx_dyn_init(&out, 1000);
+
+    /* Reply format is like
+       257<space>[rubbish]"<directory-name>"<space><commentary> and the
+       RFC959 says
+
+       The directory name can contain any character; embedded
+       double-quotes should be escaped by double-quotes (the
+       "quote-doubling" convention).
+    */
+
+    /* scan for the first double-quote for non-standard responses */
+    while(*ptr != '\n' && *ptr != '\0' && *ptr != '"')
+      ptr++;
+
+    if('\"' == *ptr) {
+      /* it started good */
+      for(ptr++; *ptr; ptr++) {
+        if('\"' == *ptr) {
+          if('\"' == ptr[1]) {
+            /* "quote-doubling" */
+            result = curlx_dyn_addn(&out, &ptr[1], 1);
+            ptr++;
+          }
+          else {
+            /* end of path */
+            if(curlx_dyn_len(&out))
+              entry_extracted = TRUE;
+            break; /* get out of this loop */
+          }
+        }
+        else {
+          if(ISCNTRL(*ptr)) {
+            /* control characters have no business in a path */
+            curlx_dyn_free(&out);
+            return CURLE_WEIRD_SERVER_REPLY;
+          }
+          result = curlx_dyn_addn(&out, ptr, 1);
+        }
+        if(result) {
+          curlx_dyn_free(&out);
+          return result;
+        }
+      }
+    }
+    if(entry_extracted) {
+      /* If the path name does not look like an absolute path (i.e.: it
+         does not start with a '/'), we probably need some server-dependent
+         adjustments. For example, this is the case when connecting to
+         an OS400 FTP server: this server supports two name syntaxes,
+         the default one being incompatible with standard paths. In
+         addition, this server switches automatically to the regular path
+         syntax when one is encountered in a command: this results in
+         having an entrypath in the wrong syntax when later used in CWD.
+         The method used here is to check the server OS: we do it only
+         if the path name looks strange to minimize overhead on other
+         systems. */
+      char *dir = curlx_dyn_ptr(&out);
+
+      if(!ftpc->server_os && dir[0] != '/') {
+        result = Curl_pp_sendf(data, &ftpc->pp, "%s", "SYST");
+        if(result) {
+          curlx_dyn_free(&out);
+          return result;
+        }
+      }
+
+      curlx_free(ftpc->entrypath);
+      ftpc->entrypath = dir; /* remember this */
+      infof(data, "Entry path is '%s'", ftpc->entrypath);
+      /* also save it where getinfo can access it: */
+      curlx_free(data->state.most_recent_ftp_entrypath);
+      data->state.most_recent_ftp_entrypath = curlx_strdup(ftpc->entrypath);
+      if(!data->state.most_recent_ftp_entrypath)
+        return CURLE_OUT_OF_MEMORY;
+
+      if(!ftpc->server_os && dir[0] != '/') {
+        ftp_state(data, ftpc, FTP_SYST);
+        return CURLE_OK;
+      }
+    }
+    else {
+      /* could not get the path */
+      curlx_dyn_free(&out);
+      infof(data, "Failed to figure out path");
+    }
+  }
+  ftp_state(data, ftpc, FTP_STOP); /* we are done with CONNECT phase! */
+  CURL_TRC_FTP(data, "[%s] protocol connect phase DONE", FTP_CSTATE(ftpc));
+  return CURLE_OK;
+}
+
+static const char * const ftpauth[] = { "SSL", "TLS" };
+
+static CURLcode ftp_wait_resp(struct Curl_easy *data,
+                              struct connectdata *conn,
+                              struct ftp_conn *ftpc,
+                              int ftpcode)
+{
+  CURLcode result = CURLE_OK;
+  if(ftpcode == 230) {
+    /* 230 User logged in - already! Take as 220 if TLS required. */
+    if(ftpc->use_ssl <= CURLUSESSL_TRY ||
+       Curl_conn_is_ssl(conn, FIRSTSOCKET))
+      return ftp_state_user_resp(data, ftpc, ftpcode);
+  }
+  else if(ftpcode != 220) {
+    failf(data, "Got a %03d ftp-server response when 220 was expected",
+          ftpcode);
+    return CURLE_WEIRD_SERVER_REPLY;
+  }
+
+  if(ftpc->use_ssl && !Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
+    /* We do not have an SSL/TLS control connection yet, but FTPS is
+       requested. Try an FTPS connection now */
+
+    ftpc->count3 = 0;
+    switch((long)data->set.ftpsslauth) {
+    case CURLFTPAUTH_DEFAULT:
+    case CURLFTPAUTH_SSL:
+      ftpc->count2 = 1; /* add one to get next */
+      ftpc->count1 = 0;
+      break;
+    case CURLFTPAUTH_TLS:
+      ftpc->count2 = -1; /* subtract one to get next */
+      ftpc->count1 = 1;
+      break;
+    default:
+      failf(data, "unsupported parameter to CURLOPT_FTPSSLAUTH: %d",
+            (int)data->set.ftpsslauth);
+      return CURLE_UNKNOWN_OPTION; /* we do not know what to do */
+    }
+    result = Curl_pp_sendf(data, &ftpc->pp, "AUTH %s", ftpauth[ftpc->count1]);
+    if(!result)
+      ftp_state(data, ftpc, FTP_AUTH);
+  }
+  else
+    result = ftp_state_user(data, ftpc, conn);
+  return result;
+}
+
+static CURLcode ftp_pp_statemachine(struct Curl_easy *data,
+                                    struct connectdata *conn)
 {
   CURLcode result;
-  curl_socket_t sock = conn->sock[FIRSTSOCKET];
   int ftpcode;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
-  struct pingpong *pp = &ftpc->pp;
-  static const char * const ftpauth[] = { "SSL", "TLS" };
+  struct ftp_conn *ftpc = Curl_conn_meta_get(conn, CURL_META_FTP_CONN);
+  struct FTP *ftp = Curl_meta_get(data, CURL_META_FTP_EASY);
+  struct pingpong *pp;
   size_t nread = 0;
 
+  if(!ftpc || !ftp)
+    return CURLE_FAILED_INIT;
+  pp = &ftpc->pp;
   if(pp->sendleft)
     return Curl_pp_flushsend(data, pp);
 
-  result = ftp_readresp(data, sock, pp, &ftpcode, &nread);
-  if(result)
+  result = ftp_readresp(data, ftpc, FIRSTSOCKET, pp, &ftpcode, &nread);
+  if(result || !ftpcode)
     return result;
 
-  if(ftpcode) {
-    /* we have now received a full FTP server response */
-    switch(ftpc->state) {
-    case FTP_WAIT220:
-      if(ftpcode == 230) {
-        /* 230 User logged in - already! Take as 220 if TLS required. */
-        if(data->set.use_ssl <= CURLUSESSL_TRY ||
-           conn->bits.ftp_use_control_ssl)
-          return ftp_state_user_resp(data, ftpcode);
-      }
-      else if(ftpcode != 220) {
-        failf(data, "Got a %03d ftp-server response when 220 was expected",
-              ftpcode);
-        return CURLE_WEIRD_SERVER_REPLY;
-      }
+  /* we have now received a full FTP server response */
+  switch(ftpc->state) {
+  case FTP_WAIT220:
+    result = ftp_wait_resp(data, conn, ftpc, ftpcode);
+    break;
 
-      /* We have received a 220 response fine, now we proceed. */
-#ifdef HAVE_GSSAPI
-      if(data->set.krb) {
-        /* If not anonymous login, try a secure login. Note that this
-           procedure is still BLOCKING. */
+  case FTP_AUTH:
+    /* we have gotten the response to a previous AUTH command */
 
-        Curl_sec_request_prot(conn, "private");
-        /* We set private first as default, in case the line below fails to
-           set a valid level */
-        Curl_sec_request_prot(conn, data->set.str[STRING_KRB_LEVEL]);
+    if(pp->overflow)
+      return CURLE_WEIRD_SERVER_REPLY; /* Forbid pipelining in response. */
 
-        if(Curl_sec_login(data, conn)) {
-          failf(data, "secure login failed");
-          return CURLE_WEIRD_SERVER_REPLY;
+    /* RFC2228 (page 5) says:
+     *
+     * If the server is willing to accept the named security mechanism,
+     * and does not require any security data, it must respond with
+     * reply code 234/334.
+     */
+
+    if((ftpcode == 234) || (ftpcode == 334)) {
+      /* this was BLOCKING, keep it so for now */
+      bool done;
+      if(!Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
+        result = Curl_ssl_cfilter_add(
+          data, Curl_conn_get_origin(conn, FIRSTSOCKET), conn, FIRSTSOCKET);
+        if(result) {
+          /* we failed and bail out */
+          return CURLE_USE_SSL_FAILED;
         }
-        infof(data, "Authentication successful");
       }
-#endif
-
-      if(data->set.use_ssl && !conn->bits.ftp_use_control_ssl) {
-        /* We don't have a SSL/TLS control connection yet, but FTPS is
-           requested. Try a FTPS connection now */
-
-        ftpc->count3 = 0;
-        switch(data->set.ftpsslauth) {
-        case CURLFTPAUTH_DEFAULT:
-        case CURLFTPAUTH_SSL:
-          ftpc->count2 = 1; /* add one to get next */
-          ftpc->count1 = 0;
-          break;
-        case CURLFTPAUTH_TLS:
-          ftpc->count2 = -1; /* subtract one to get next */
-          ftpc->count1 = 1;
-          break;
-        default:
-          failf(data, "unsupported parameter to CURLOPT_FTPSSLAUTH: %d",
-                (int)data->set.ftpsslauth);
-          return CURLE_UNKNOWN_OPTION; /* we don't know what to do */
-        }
-        result = Curl_pp_sendf(data, &ftpc->pp, "AUTH %s",
-                               ftpauth[ftpc->count1]);
-        if(!result)
-          ftp_state(data, FTP_AUTH);
+      /* BLOCKING */
+      result = Curl_conn_connect(data, FIRSTSOCKET, TRUE, &done);
+      if(!result) {
+        conn->bits.ftp_use_data_ssl = FALSE; /* clear-text data */
+        result = ftp_state_user(data, ftpc, conn);
       }
+    }
+    else if(ftpc->count3 < 1) {
+      ftpc->count3++;
+      ftpc->count1 += ftpc->count2; /* get next attempt */
+      result = Curl_pp_sendf(data, &ftpc->pp, "AUTH %s",
+                             ftpauth[ftpc->count1]);
+      /* remain in this same state */
+    }
+    else {
+      if(ftpc->use_ssl > CURLUSESSL_TRY)
+        /* we failed and CURLUSESSL_CONTROL or CURLUSESSL_ALL is set */
+        result = CURLE_USE_SSL_FAILED;
       else
-        result = ftp_state_user(data, conn);
-      break;
+        /* ignore the failure and continue */
+        result = ftp_state_user(data, ftpc, conn);
+    }
+    break;
 
-    case FTP_AUTH:
-      /* we have gotten the response to a previous AUTH command */
+  case FTP_USER:
+  case FTP_PASS:
+    result = ftp_state_user_resp(data, ftpc, ftpcode);
+    break;
 
-      if(pp->cache_size)
-        return CURLE_WEIRD_SERVER_REPLY; /* Forbid pipelining in response. */
+  case FTP_ACCT:
+    result = ftp_state_acct_resp(data, ftpc, ftpcode);
+    break;
 
-      /* RFC2228 (page 5) says:
-       *
-       * If the server is willing to accept the named security mechanism,
-       * and does not require any security data, it must respond with
-       * reply code 234/334.
+  case FTP_PBSZ:
+    result =
+      Curl_pp_sendf(data, &ftpc->pp, "PROT %c",
+                    ftpc->use_ssl == CURLUSESSL_CONTROL ? 'C' : 'P');
+    if(!result)
+      ftp_state(data, ftpc, FTP_PROT);
+    break;
+
+  case FTP_PROT:
+    if(ftpcode / 100 == 2)
+      /* We have enabled SSL for the data connection! */
+      conn->bits.ftp_use_data_ssl = (ftpc->use_ssl != CURLUSESSL_CONTROL);
+    /* FTP servers typically responds with 500 if they decide to reject
+       our 'P' request */
+    else if(ftpc->use_ssl > CURLUSESSL_CONTROL)
+      /* we failed and bails out */
+      return CURLE_USE_SSL_FAILED;
+
+    if(data->set.ftp_ccc) {
+      /* CCC - Clear Command Channel
        */
-
-      if((ftpcode == 234) || (ftpcode == 334)) {
-        /* this was BLOCKING, keep it so for now */
-        bool done;
-        if(!Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
-          result = Curl_ssl_cfilter_add(data, conn, FIRSTSOCKET);
-          if(result) {
-            /* we failed and bail out */
-            return CURLE_USE_SSL_FAILED;
-          }
-        }
-        result = Curl_conn_connect(data, FIRSTSOCKET, TRUE, &done);
-        if(!result) {
-          conn->bits.ftp_use_data_ssl = FALSE; /* clear-text data */
-          conn->bits.ftp_use_control_ssl = TRUE; /* SSL on control */
-          result = ftp_state_user(data, conn);
-        }
-      }
-      else if(ftpc->count3 < 1) {
-        ftpc->count3++;
-        ftpc->count1 += ftpc->count2; /* get next attempt */
-        result = Curl_pp_sendf(data, &ftpc->pp, "AUTH %s",
-                               ftpauth[ftpc->count1]);
-        /* remain in this same state */
-      }
-      else {
-        if(data->set.use_ssl > CURLUSESSL_TRY)
-          /* we failed and CURLUSESSL_CONTROL or CURLUSESSL_ALL is set */
-          result = CURLE_USE_SSL_FAILED;
-        else
-          /* ignore the failure and continue */
-          result = ftp_state_user(data, conn);
-      }
-      break;
-
-    case FTP_USER:
-    case FTP_PASS:
-      result = ftp_state_user_resp(data, ftpcode);
-      break;
-
-    case FTP_ACCT:
-      result = ftp_state_acct_resp(data, ftpcode);
-      break;
-
-    case FTP_PBSZ:
-      result =
-        Curl_pp_sendf(data, &ftpc->pp, "PROT %c",
-                      data->set.use_ssl == CURLUSESSL_CONTROL ? 'C' : 'P');
+      result = Curl_pp_sendf(data, &ftpc->pp, "%s", "CCC");
       if(!result)
-        ftp_state(data, FTP_PROT);
-      break;
+        ftp_state(data, ftpc, FTP_CCC);
+    }
+    else
+      result = ftp_state_pwd(data, ftpc);
+    break;
 
-    case FTP_PROT:
-      if(ftpcode/100 == 2)
-        /* We have enabled SSL for the data connection! */
-        conn->bits.ftp_use_data_ssl =
-          (data->set.use_ssl != CURLUSESSL_CONTROL) ? TRUE : FALSE;
-      /* FTP servers typically responds with 500 if they decide to reject
-         our 'P' request */
-      else if(data->set.use_ssl > CURLUSESSL_CONTROL)
-        /* we failed and bails out */
-        return CURLE_USE_SSL_FAILED;
+  case FTP_CCC:
+    if(ftpcode < 500) {
+      /* First shut down the SSL layer (note: this call will block) */
+      /* This has only been tested on the proftpd server, and the mod_tls
+       * code sends a close notify alert without waiting for a close notify
+       * alert in response. Thus we wait for a close notify alert from the
+       * server, but we do not send one. Let's hope other servers do
+       * the same... */
+      result = Curl_ssl_cfilter_remove(data, FIRSTSOCKET,
+                                       (data->set.ftp_ccc ==
+                                        (unsigned char)CURLFTPSSL_CCC_ACTIVE));
+      if(result)
+        failf(data, "Failed to clear the command channel (CCC)");
+    }
+    if(!result)
+      /* Then continue as normal */
+      result = ftp_state_pwd(data, ftpc);
+    break;
 
-      if(data->set.ftp_ccc) {
-        /* CCC - Clear Command Channel
-         */
-        result = Curl_pp_sendf(data, &ftpc->pp, "%s", "CCC");
-        if(!result)
-          ftp_state(data, FTP_CCC);
-      }
-      else
-        result = ftp_state_pwd(data, conn);
-      break;
+  case FTP_PWD:
+    result = ftp_pwd_resp(data, ftpc, ftpcode);
+    break;
 
-    case FTP_CCC:
-      if(ftpcode < 500) {
-        /* First shut down the SSL layer (note: this call will block) */
-        result = Curl_ssl_cfilter_remove(data, FIRSTSOCKET);
+  case FTP_SYST:
+    if(ftpcode == 215) {
+      const char *ptr = curlx_dyn_ptr(&pp->recvbuf) + 4; /* start on the first
+                                                            letter */
+      const char *start;
+      char *os;
 
-        if(result)
-          failf(data, "Failed to clear the command channel (CCC)");
-      }
-      if(!result)
-        /* Then continue as normal */
-        result = ftp_state_pwd(data, conn);
-      break;
+      /* Reply format is like
+         215<space><OS-name><space><commentary>
+      */
+      while(*ptr == ' ')
+        ptr++;
+      for(start = ptr; *ptr && *ptr != ' '; ptr++)
+        ;
+      os = curlx_memdup0(start, ptr - start);
+      if(!os)
+        return CURLE_OUT_OF_MEMORY;
 
-    case FTP_PWD:
-      if(ftpcode == 257) {
-        char *ptr = &data->state.buffer[4];  /* start on the first letter */
-        const size_t buf_size = data->set.buffer_size;
-        char *dir;
-        bool entry_extracted = FALSE;
-
-        dir = malloc(nread + 1);
-        if(!dir)
-          return CURLE_OUT_OF_MEMORY;
-
-        /* Reply format is like
-           257<space>[rubbish]"<directory-name>"<space><commentary> and the
-           RFC959 says
-
-           The directory name can contain any character; embedded
-           double-quotes should be escaped by double-quotes (the
-           "quote-doubling" convention).
-        */
-
-        /* scan for the first double-quote for non-standard responses */
-        while(ptr < &data->state.buffer[buf_size]
-              && *ptr != '\n' && *ptr != '\0' && *ptr != '"')
-          ptr++;
-
-        if('\"' == *ptr) {
-          /* it started good */
-          char *store;
-          ptr++;
-          for(store = dir; *ptr;) {
-            if('\"' == *ptr) {
-              if('\"' == ptr[1]) {
-                /* "quote-doubling" */
-                *store = ptr[1];
-                ptr++;
-              }
-              else {
-                /* end of path */
-                entry_extracted = TRUE;
-                break; /* get out of this loop */
-              }
-            }
-            else
-              *store = *ptr;
-            store++;
-            ptr++;
-          }
-          *store = '\0'; /* null-terminate */
+      /* Check for special servers here. */
+      if(curl_strequal(os, "OS/400")) {
+        /* Force OS400 name format 1. */
+        result = Curl_pp_sendf(data, &ftpc->pp, "%s", "SITE NAMEFMT 1");
+        if(result) {
+          curlx_free(os);
+          return result;
         }
-        if(entry_extracted) {
-          /* If the path name does not look like an absolute path (i.e.: it
-             does not start with a '/'), we probably need some server-dependent
-             adjustments. For example, this is the case when connecting to
-             an OS400 FTP server: this server supports two name syntaxes,
-             the default one being incompatible with standard paths. In
-             addition, this server switches automatically to the regular path
-             syntax when one is encountered in a command: this results in
-             having an entrypath in the wrong syntax when later used in CWD.
-               The method used here is to check the server OS: we do it only
-             if the path name looks strange to minimize overhead on other
-             systems. */
-
-          if(!ftpc->server_os && dir[0] != '/') {
-            result = Curl_pp_sendf(data, &ftpc->pp, "%s", "SYST");
-            if(result) {
-              free(dir);
-              return result;
-            }
-            Curl_safefree(ftpc->entrypath);
-            ftpc->entrypath = dir; /* remember this */
-            infof(data, "Entry path is '%s'", ftpc->entrypath);
-            /* also save it where getinfo can access it: */
-            data->state.most_recent_ftp_entrypath = ftpc->entrypath;
-            ftp_state(data, FTP_SYST);
-            break;
-          }
-
-          Curl_safefree(ftpc->entrypath);
-          ftpc->entrypath = dir; /* remember this */
-          infof(data, "Entry path is '%s'", ftpc->entrypath);
-          /* also save it where getinfo can access it: */
-          data->state.most_recent_ftp_entrypath = ftpc->entrypath;
-        }
-        else {
-          /* couldn't get the path */
-          free(dir);
-          infof(data, "Failed to figure out path");
-        }
-      }
-      ftp_state(data, FTP_STOP); /* we are done with the CONNECT phase! */
-      DEBUGF(infof(data, "protocol connect phase DONE"));
-      break;
-
-    case FTP_SYST:
-      if(ftpcode == 215) {
-        char *ptr = &data->state.buffer[4];  /* start on the first letter */
-        char *os;
-        char *store;
-
-        os = malloc(nread + 1);
-        if(!os)
-          return CURLE_OUT_OF_MEMORY;
-
-        /* Reply format is like
-           215<space><OS-name><space><commentary>
-        */
-        while(*ptr == ' ')
-          ptr++;
-        for(store = os; *ptr && *ptr != ' ';)
-          *store++ = *ptr++;
-        *store = '\0'; /* null-terminate */
-
-        /* Check for special servers here. */
-
-        if(strcasecompare(os, "OS/400")) {
-          /* Force OS400 name format 1. */
-          result = Curl_pp_sendf(data, &ftpc->pp, "%s", "SITE NAMEFMT 1");
-          if(result) {
-            free(os);
-            return result;
-          }
-          /* remember target server OS */
-          Curl_safefree(ftpc->server_os);
-          ftpc->server_os = os;
-          ftp_state(data, FTP_NAMEFMT);
-          break;
-        }
-        /* Nothing special for the target server. */
         /* remember target server OS */
-        Curl_safefree(ftpc->server_os);
+        curlx_free(ftpc->server_os);
         ftpc->server_os = os;
-      }
-      else {
-        /* Cannot identify server OS. Continue anyway and cross fingers. */
-      }
-
-      ftp_state(data, FTP_STOP); /* we are done with the CONNECT phase! */
-      DEBUGF(infof(data, "protocol connect phase DONE"));
-      break;
-
-    case FTP_NAMEFMT:
-      if(ftpcode == 250) {
-        /* Name format change successful: reload initial path. */
-        ftp_state_pwd(data, conn);
+        ftp_state(data, ftpc, FTP_NAMEFMT);
         break;
       }
+      /* Nothing special for the target server. */
+      /* remember target server OS */
+      curlx_free(ftpc->server_os);
+      ftpc->server_os = os;
+    }
+    else {
+      /* Cannot identify server OS. Continue anyway and cross fingers. */
+    }
 
-      ftp_state(data, FTP_STOP); /* we are done with the CONNECT phase! */
-      DEBUGF(infof(data, "protocol connect phase DONE"));
-      break;
+    ftp_state(data, ftpc, FTP_STOP); /* we are done with CONNECT phase! */
+    CURL_TRC_FTP(data, "[%s] protocol connect phase DONE", FTP_CSTATE(ftpc));
+    break;
 
-    case FTP_QUOTE:
-    case FTP_POSTQUOTE:
-    case FTP_RETR_PREQUOTE:
-    case FTP_STOR_PREQUOTE:
-      if((ftpcode >= 400) && !ftpc->count2) {
-        /* failure response code, and not allowed to fail */
-        failf(data, "QUOT command failed with %03d", ftpcode);
-        result = CURLE_QUOTE_ERROR;
-      }
-      else
-        result = ftp_state_quote(data, FALSE, ftpc->state);
-      break;
-
-    case FTP_CWD:
-      if(ftpcode/100 != 2) {
-        /* failure to CWD there */
-        if(data->set.ftp_create_missing_dirs &&
-           ftpc->cwdcount && !ftpc->count2) {
-          /* try making it */
-          ftpc->count2++; /* counter to prevent CWD-MKD loops */
-
-          /* count3 is set to allow MKD to fail once per dir. In the case when
-          CWD fails and then MKD fails (due to another session raced it to
-          create the dir) this then allows for a second try to CWD to it. */
-          ftpc->count3 = (data->set.ftp_create_missing_dirs == 2) ? 1 : 0;
-
-          result = Curl_pp_sendf(data, &ftpc->pp, "MKD %s",
-                                 ftpc->dirs[ftpc->cwdcount - 1]);
-          if(!result)
-            ftp_state(data, FTP_MKD);
-        }
-        else {
-          /* return failure */
-          failf(data, "Server denied you to change to the given directory");
-          ftpc->cwdfail = TRUE; /* don't remember this path as we failed
-                                   to enter it */
-          result = CURLE_REMOTE_ACCESS_DENIED;
-        }
-      }
-      else {
-        /* success */
-        ftpc->count2 = 0;
-        if(++ftpc->cwdcount <= ftpc->dirdepth)
-          /* send next CWD */
-          result = Curl_pp_sendf(data, &ftpc->pp, "CWD %s",
-                                 ftpc->dirs[ftpc->cwdcount - 1]);
-        else
-          result = ftp_state_mdtm(data);
-      }
-      break;
-
-    case FTP_MKD:
-      if((ftpcode/100 != 2) && !ftpc->count3--) {
-        /* failure to MKD the dir */
-        failf(data, "Failed to MKD dir: %03d", ftpcode);
-        result = CURLE_REMOTE_ACCESS_DENIED;
-      }
-      else {
-        ftp_state(data, FTP_CWD);
-        /* send CWD */
-        result = Curl_pp_sendf(data, &ftpc->pp, "CWD %s",
-                               ftpc->dirs[ftpc->cwdcount - 1]);
-      }
-      break;
-
-    case FTP_MDTM:
-      result = ftp_state_mdtm_resp(data, ftpcode);
-      break;
-
-    case FTP_TYPE:
-    case FTP_LIST_TYPE:
-    case FTP_RETR_TYPE:
-    case FTP_STOR_TYPE:
-      result = ftp_state_type_resp(data, ftpcode, ftpc->state);
-      break;
-
-    case FTP_SIZE:
-    case FTP_RETR_SIZE:
-    case FTP_STOR_SIZE:
-      result = ftp_state_size_resp(data, ftpcode, ftpc->state);
-      break;
-
-    case FTP_REST:
-    case FTP_RETR_REST:
-      result = ftp_state_rest_resp(data, conn, ftpcode, ftpc->state);
-      break;
-
-    case FTP_PRET:
-      if(ftpcode != 200) {
-        /* there only is this one standard OK return code. */
-        failf(data, "PRET command not accepted: %03d", ftpcode);
-        return CURLE_FTP_PRET_FAILED;
-      }
-      result = ftp_state_use_pasv(data, conn);
-      break;
-
-    case FTP_PASV:
-      result = ftp_state_pasv_resp(data, ftpcode);
-      break;
-
-    case FTP_PORT:
-      result = ftp_state_port_resp(data, ftpcode);
-      break;
-
-    case FTP_LIST:
-    case FTP_RETR:
-      result = ftp_state_get_resp(data, ftpcode, ftpc->state);
-      break;
-
-    case FTP_STOR:
-      result = ftp_state_stor_resp(data, ftpcode, ftpc->state);
-      break;
-
-    case FTP_QUIT:
-      /* fallthrough, just stop! */
-    default:
-      /* internal error */
-      ftp_state(data, FTP_STOP);
+  case FTP_NAMEFMT:
+    if(ftpcode == 250) {
+      /* Name format change successful: reload initial path. */
+      ftp_state_pwd(data, ftpc);
       break;
     }
-  } /* if(ftpcode) */
+
+    ftp_state(data, ftpc, FTP_STOP); /* we are done with CONNECT phase! */
+    CURL_TRC_FTP(data, "[%s] protocol connect phase DONE", FTP_CSTATE(ftpc));
+    break;
+
+  case FTP_QUOTE:
+  case FTP_POSTQUOTE:
+  case FTP_RETR_PREQUOTE:
+  case FTP_STOR_PREQUOTE:
+  case FTP_LIST_PREQUOTE:
+    if((ftpcode >= 400) && !ftpc->count2) {
+      /* failure response code, and not allowed to fail */
+      failf(data, "QUOT command failed with %03d", ftpcode);
+      result = CURLE_QUOTE_ERROR;
+    }
+    else
+      result = ftp_state_quote(data, ftpc, ftp, FALSE, ftpc->state);
+    break;
+
+  case FTP_CWD:
+    if(ftpcode / 100 != 2) {
+      /* failure to CWD there */
+      if(data->set.ftp_create_missing_dirs &&
+         ftpc->cwdcount && !ftpc->count2) {
+        /* try making it */
+        ftpc->count2++; /* counter to prevent CWD-MKD loops */
+
+        /* count3 is set to allow MKD to fail once per dir. In the case when
+           CWD fails and then MKD fails (due to another session raced it to
+           create the dir) this then allows for a second try to CWD to it. */
+        ftpc->count3 = (data->set.ftp_create_missing_dirs == 2) ? 1 : 0;
+
+        result = Curl_pp_sendf(data, &ftpc->pp, "MKD %.*s",
+                               pathlen(ftpc, ftpc->cwdcount - 1),
+                               pathpiece(ftpc, ftpc->cwdcount - 1));
+        if(!result)
+          ftp_state(data, ftpc, FTP_MKD);
+      }
+      else {
+        /* return failure */
+        failf(data, "Server denied you to change to the given directory");
+        ftpc->cwdfail = TRUE; /* do not remember this path as we failed
+                                 to enter it */
+        result = CURLE_REMOTE_ACCESS_DENIED;
+      }
+    }
+    else {
+      /* success */
+      ftpc->count2 = 0;
+      if(ftpc->cwdcount >= ftpc->dirdepth)
+        result = ftp_state_mdtm(data, ftpc, ftp);
+      else {
+        ftpc->cwdcount++;
+        /* send next CWD */
+        result = Curl_pp_sendf(data, &ftpc->pp, "CWD %.*s",
+                               pathlen(ftpc, ftpc->cwdcount - 1),
+                               pathpiece(ftpc, ftpc->cwdcount - 1));
+      }
+    }
+    break;
+
+  case FTP_MKD:
+    if((ftpcode / 100 != 2) && !ftpc->count3--) {
+      /* failure to MKD the directory */
+      failf(data, "Failed to MKD dir: %03d", ftpcode);
+      result = CURLE_REMOTE_ACCESS_DENIED;
+    }
+    else {
+      ftp_state(data, ftpc, FTP_CWD);
+      /* send CWD */
+      result = Curl_pp_sendf(data, &ftpc->pp, "CWD %.*s",
+                             pathlen(ftpc, ftpc->cwdcount - 1),
+                             pathpiece(ftpc, ftpc->cwdcount - 1));
+    }
+    break;
+
+  case FTP_MDTM:
+    result = ftp_state_mdtm_resp(data, ftpc, ftp, ftpcode);
+    break;
+
+  case FTP_TYPE:
+  case FTP_LIST_TYPE:
+  case FTP_RETR_TYPE:
+  case FTP_STOR_TYPE:
+  case FTP_RETR_LIST_TYPE:
+    result = ftp_state_type_resp(data, ftpc, ftp, ftpcode, ftpc->state);
+    break;
+
+  case FTP_SIZE:
+  case FTP_RETR_SIZE:
+  case FTP_STOR_SIZE:
+    result = ftp_state_size_resp(data, ftpc, ftp, ftpcode, ftpc->state);
+    break;
+
+  case FTP_REST:
+  case FTP_RETR_REST:
+    result = ftp_state_rest_resp(data, ftpc, ftp, ftpcode, ftpc->state);
+    break;
+
+  case FTP_PRET:
+    if(ftpcode != 200) {
+      /* there only is this one standard OK return code. */
+      failf(data, "PRET command not accepted: %03d", ftpcode);
+      return CURLE_FTP_PRET_FAILED;
+    }
+    result = ftp_state_use_pasv(data, ftpc, conn);
+    break;
+
+  case FTP_PASV:
+    result = ftp_state_pasv_resp(data, ftpc, ftpcode);
+    break;
+
+  case FTP_PORT:
+    result = ftp_state_port_resp(data, ftpc, ftp, ftpcode);
+    break;
+
+  case FTP_LIST:
+  case FTP_RETR:
+    result = ftp_state_get_resp(data, ftpc, ftp, ftpcode, ftpc->state);
+    break;
+
+  case FTP_STOR:
+    result = ftp_state_stor_resp(data, ftpc, ftpcode);
+    break;
+
+  case FTP_QUIT:
+  default:
+    /* internal error */
+    ftp_state(data, ftpc, FTP_STOP);
+    break;
+  }
 
   return result;
 }
 
-
 /* called repeatedly until done from multi.c */
 static CURLcode ftp_multi_statemach(struct Curl_easy *data,
                                     bool *done)
 {
-  struct connectdata *conn = data->conn;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
-  CURLcode result = Curl_pp_statemach(data, &ftpc->pp, FALSE, FALSE);
-
-  /* Check for the state outside of the Curl_socket_check() return code checks
-     since at times we are in fact already in this state when this function
-     gets called. */
-  *done = (ftpc->state == FTP_STOP) ? TRUE : FALSE;
-
-  return result;
+  struct ftp_conn *ftpc = Curl_conn_meta_get(data->conn, CURL_META_FTP_CONN);
+  return ftpc ? ftp_statemach(data, ftpc, done) : CURLE_FAILED_INIT;
 }
 
 static CURLcode ftp_block_statemach(struct Curl_easy *data,
-                                    struct connectdata *conn)
+                                    struct ftp_conn *ftpc)
 {
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
   struct pingpong *pp = &ftpc->pp;
   CURLcode result = CURLE_OK;
 
   while(ftpc->state != FTP_STOP) {
+    if(ftpc->shutdown)
+      CURL_TRC_FTP(data, "in shutdown, waiting for server response");
     result = Curl_pp_statemach(data, pp, TRUE, TRUE /* disconnecting */);
     if(result)
       break;
@@ -3165,61 +3511,92 @@ static CURLcode ftp_connect(struct Curl_easy *data,
 {
   CURLcode result;
   struct connectdata *conn = data->conn;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
-  struct pingpong *pp = &ftpc->pp;
+  struct ftp_conn *ftpc = Curl_conn_meta_get(data->conn, CURL_META_FTP_CONN);
+  struct pingpong *pp;
 
   *done = FALSE; /* default to not done yet */
+  if(!ftpc)
+    return CURLE_FAILED_INIT;
+  pp = &ftpc->pp;
+  PINGPONG_SETUP(pp, ftp_pp_statemachine, ftp_endofresp);
 
-  /* We always support persistent connections on ftp */
-  connkeep(conn, "FTP default");
-
-  PINGPONG_SETUP(pp, ftp_statemachine, ftp_endofresp);
-
-  if(conn->handler->flags & PROTOPT_SSL) {
+  if(Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
     /* BLOCKING */
     result = Curl_conn_connect(data, FIRSTSOCKET, TRUE, done);
     if(result)
       return result;
-    conn->bits.ftp_use_control_ssl = TRUE;
   }
 
-  Curl_pp_setup(pp); /* once per transfer */
-  Curl_pp_init(data, pp); /* init the generic pingpong data */
+  Curl_pp_init(pp, Curl_pgrs_now(data)); /* once per transfer */
 
   /* When we connect, we start in the state where we await the 220
      response */
-  ftp_state(data, FTP_WAIT220);
+  ftp_state(data, ftpc, FTP_WAIT220);
 
-  result = ftp_multi_statemach(data, done);
+  result = ftp_statemach(data, ftpc, done);
 
   return result;
 }
 
 /***********************************************************************
  *
- * ftp_done()
+ * ftp_sendquote()
  *
- * The DONE function. This does what needs to be done after a single DO has
- * performed.
+ * Where a 'quote' means a list of custom commands to send to the server.
+ * The quote list is passed as an argument.
  *
- * Input argument is already checked for validity.
+ * BLOCKING
  */
-static CURLcode ftp_done(struct Curl_easy *data, CURLcode status,
-                         bool premature)
+static CURLcode ftp_sendquote(struct Curl_easy *data,
+                              struct ftp_conn *ftpc,
+                              struct curl_slist *quote)
 {
-  struct connectdata *conn = data->conn;
-  struct FTP *ftp = data->req.p.ftp;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
+  struct curl_slist *item;
   struct pingpong *pp = &ftpc->pp;
-  ssize_t nread;
-  int ftpcode;
-  CURLcode result = CURLE_OK;
-  char *rawPath = NULL;
-  size_t pathLen = 0;
 
-  if(!ftp)
-    return CURLE_OK;
+  item = quote;
+  while(item) {
+    if(item->data) {
+      size_t nread;
+      const char *cmd = item->data;
+      bool acceptfail = FALSE;
+      CURLcode result;
+      int ftpcode = 0;
 
+      /* if a command starts with an asterisk, which a legal FTP command never
+         can, the command will be allowed to fail without it causing any
+         aborts or cancels etc. It will cause libcurl to act as if the command
+         is successful, whatever the server responds. */
+
+      if(cmd[0] == '*') {
+        cmd++;
+        acceptfail = TRUE;
+      }
+
+      result = Curl_pp_sendf(data, &ftpc->pp, "%s", cmd);
+      if(!result) {
+        pp->response = *Curl_pgrs_now(data); /* timeout relative now */
+        result = getftpresponse(data, &nread, &ftpcode);
+      }
+      if(result)
+        return result;
+
+      if(!acceptfail && (ftpcode >= 400)) {
+        failf(data, "QUOT string not accepted: %s", cmd);
+        return CURLE_QUOTE_ERROR;
+      }
+    }
+
+    item = item->next;
+  }
+
+  return CURLE_OK;
+}
+
+static CURLcode ftp_done_status(struct connectdata *conn,
+                                struct ftp_conn *ftpc, CURLcode status,
+                                bool premature)
+{
   switch(status) {
   case CURLE_BAD_DOWNLOAD_RESUME:
   case CURLE_FTP_WEIRD_PASV_REPLY:
@@ -3235,83 +3612,84 @@ static CURLcode ftp_done(struct Curl_easy *data, CURLcode status,
   case CURLE_REMOTE_FILE_NOT_FOUND:
   case CURLE_WRITE_ERROR:
     /* the connection stays alive fine even though this happened */
-    /* fall-through */
-  case CURLE_OK: /* doesn't affect the control connection's status */
+  case CURLE_OK: /* does not affect the control connection's status */
     if(!premature)
       break;
 
     /* until we cope better with prematurely ended requests, let them
      * fallback as if in complete failure */
-    /* FALLTHROUGH */
+    FALLTHROUGH();
   default:       /* by default, an error means the control connection is
                     wedged and should not be used anymore */
     ftpc->ctl_valid = FALSE;
     ftpc->cwdfail = TRUE; /* set this TRUE to prevent us to remember the
                              current path, as this connection is going */
     connclose(conn, "FTP ended with bad error code");
-    result = status;      /* use the already set error code */
-    break;
+    return status;      /* use the already set error code */
   }
+  return CURLE_OK;
+}
 
+static void ftp_done_wildcard(struct Curl_easy *data, struct ftp_conn *ftpc)
+{
   if(data->state.wildcardmatch) {
     if(data->set.chunk_end && ftpc->file) {
-      Curl_set_in_callback(data, true);
+      Curl_set_in_callback(data, TRUE);
       data->set.chunk_end(data->set.wildcardptr);
-      Curl_set_in_callback(data, false);
+      Curl_set_in_callback(data, FALSE);
+      freedirs(ftpc);
     }
     ftpc->known_filesize = -1;
   }
+}
 
-  if(!result)
-    /* get the url-decoded "raw" path */
-    result = Curl_urldecode(ftp->path, 0, &rawPath, &pathLen,
-                            REJECT_CTRL);
+static void ftp_done_path(struct Curl_easy *data, struct ftp_conn *ftpc,
+                          CURLcode result)
+{
+  struct connectdata *conn = data->conn;
   if(result) {
     /* We can limp along anyway (and should try to since we may already be in
      * the error path) */
     ftpc->ctl_valid = FALSE; /* mark control connection as bad */
     connclose(conn, "FTP: out of memory!"); /* mark for connection closure */
-    free(ftpc->prevpath);
-    ftpc->prevpath = NULL; /* no path remembering */
+    curlx_safefree(ftpc->prevpath); /* no path remembering */
   }
   else { /* remember working directory for connection reuse */
-    if((data->set.ftp_filemethod == FTPFILE_NOCWD) && (rawPath[0] == '/'))
-      free(rawPath); /* full path => no CWDs happened => keep ftpc->prevpath */
-    else {
-      free(ftpc->prevpath);
-
-      if(!ftpc->cwdfail) {
-        if(data->set.ftp_filemethod == FTPFILE_NOCWD)
-          pathLen = 0; /* relative path => working directory is FTP home */
-        else
-          pathLen -= ftpc->file?strlen(ftpc->file):0; /* file is url-decoded */
-
-        rawPath[pathLen] = '\0';
-        ftpc->prevpath = rawPath;
-      }
+    const char *rawPath = ftpc->rawpath;
+    if(rawPath) {
+      if((data->set.ftp_filemethod == FTPFILE_NOCWD) && (rawPath[0] == '/'))
+        ; /* full path => no CWDs happened => keep ftpc->prevpath */
       else {
-        free(rawPath);
-        ftpc->prevpath = NULL; /* no path */
+        size_t pathLen = strlen(ftpc->rawpath);
+
+        curlx_free(ftpc->prevpath);
+
+        if(!ftpc->cwdfail) {
+          if(data->set.ftp_filemethod == FTPFILE_NOCWD)
+            pathLen = 0; /* relative path => working directory is FTP home */
+          else
+            /* file is URL-decoded */
+            pathLen -= ftpc->file ? strlen(ftpc->file) : 0;
+          ftpc->prevpath = curlx_memdup0(rawPath, pathLen);
+        }
+        else
+          ftpc->prevpath = NULL; /* no path */
       }
     }
-
     if(ftpc->prevpath)
-      infof(data, "Remembering we are in dir \"%s\"", ftpc->prevpath);
+      infof(data, "Remembering we are in directory \"%s\"", ftpc->prevpath);
   }
+}
 
-  /* free the dir tree and file parts */
-  freedirs(ftpc);
-
-  /* shut down the socket to inform the server we're done */
-
-#ifdef _WIN32_WCE
-  shutdown(conn->sock[SECONDARYSOCKET], 2);  /* SD_BOTH */
-#endif
-
-  if(conn->sock[SECONDARYSOCKET] != CURL_SOCKET_BAD) {
+static CURLcode ftp_done_secondary_socket(struct Curl_easy *data,
+                                          struct ftp_conn *ftpc,
+                                          CURLcode result)
+{
+  struct connectdata *conn = data->conn;
+  if(Curl_conn_is_setup(conn, SECONDARYSOCKET)) {
     if(!result && ftpc->dont_check && data->req.maxdownload > 0) {
       /* partial download completed */
-      result = Curl_pp_sendf(data, pp, "%s", "ABOR");
+      result = Curl_pp_sendf(data, &ftpc->pp, "%s", "ABOR");
       if(result) {
         failf(data, "Failure sending ABOR command: %s",
               curl_easy_strerror(result));
@@ -3320,39 +3698,42 @@ static CURLcode ftp_done(struct Curl_easy *data, CURLcode status,
       }
     }
 
-    close_secondarysocket(data, conn);
+    close_secondarysocket(data, ftpc);
   }
+  return result;
+}
+
+static CURLcode ftp_done_control_reply(struct Curl_easy *data,
+                                       struct ftp_conn *ftpc,
+                                       struct FTP *ftp, CURLcode result,
+                                       bool premature)
+{
+  struct connectdata *conn = data->conn;
+  size_t nread;
+  int ftpcode;
 
   if(!result && (ftp->transfer == PPTRANSFER_BODY) && ftpc->ctl_valid &&
-     pp->pending_resp && !premature) {
+     ftpc->pp.pending_resp && !premature) {
     /*
-     * Let's see what the server says about the transfer we just performed,
-     * but lower the timeout as sometimes this connection has died while the
-     * data has been transferred. This happens when doing through NATs etc that
+     * Let's see what the server says about the transfer we performed, but
+     * lower the timeout as sometimes this connection has died while the data
+     * has been transferred. This happens when doing through NATs etc that
      * abandon old silent connections.
      */
-    timediff_t old_time = pp->response_time;
+    ftpc->pp.response = *Curl_pgrs_now(data); /* timeout relative now */
+    result = getftpresponse(data, &nread, &ftpcode);
 
-    pp->response_time = 60*1000; /* give it only a minute for now */
-    pp->response = Curl_now(); /* timeout relative now */
-
-    result = Curl_GetFTPResponse(data, &nread, &ftpcode);
-
-    pp->response_time = old_time; /* set this back to previous value */
-
-    if(!nread && (CURLE_OPERATION_TIMEDOUT == result)) {
+    if(!nread && (result == CURLE_OPERATION_TIMEDOUT)) {
       failf(data, "control connection looks dead");
       ftpc->ctl_valid = FALSE; /* mark control connection as bad */
       connclose(conn, "Timeout or similar in FTP DONE operation"); /* close */
     }
 
-    if(result) {
-      Curl_safefree(ftp->pathalloc);
+    if(result)
       return result;
-    }
 
     if(ftpc->dont_check && data->req.maxdownload > 0) {
-      /* we have just sent ABOR and there is no reliable way to check if it was
+      /* we have sent ABOR and there is no reliable way to check if it was
        * successful or not; we have to close the connection now */
       infof(data, "partial download completed, closing connection");
       connclose(conn, "Partial download with no ability to check");
@@ -3376,45 +3757,76 @@ static CURLcode ftp_done(struct Curl_easy *data, CURLcode status,
       }
     }
   }
+  return result;
+}
 
+static CURLcode ftp_done_check_partial(struct Curl_easy *data,
+                                       struct ftp_conn *ftpc,
+                                       struct FTP *ftp, CURLcode result,
+                                       bool premature)
+{
   if(result || premature)
     /* the response code from the transfer showed an error already so no
        use checking further */
     ;
   else if(data->state.upload) {
-    if((-1 != data->state.infilesize) &&
-       (data->state.infilesize != data->req.writebytecount) &&
-       !data->set.crlf &&
-       (ftp->transfer == PPTRANSFER_BODY)) {
-      failf(data, "Uploaded unaligned file size (%" CURL_FORMAT_CURL_OFF_T
-            " out of %" CURL_FORMAT_CURL_OFF_T " bytes)",
+    if((ftp->transfer == PPTRANSFER_BODY) &&
+       (data->state.infilesize != -1) && /* upload with known size */
+       ((!data->set.crlf && !data->state.prefer_ascii && /* no conversion */
+         (data->state.infilesize != data->req.writebytecount)) ||
+        ((data->set.crlf || data->state.prefer_ascii) && /* maybe crlf conv */
+         (data->state.infilesize > data->req.writebytecount))
+       )) {
+      failf(data, "Uploaded unaligned file size (%" FMT_OFF_T
+            " out of %" FMT_OFF_T " bytes)",
             data->req.writebytecount, data->state.infilesize);
       result = CURLE_PARTIAL_FILE;
     }
   }
   else {
-    if((-1 != data->req.size) &&
+    if((data->req.size != -1) &&
        (data->req.size != data->req.bytecount) &&
-#ifdef CURL_DO_LINEEND_CONV
-       /* Most FTP servers don't adjust their file SIZE response for CRLFs, so
-        * we'll check to see if the discrepancy can be explained by the number
-        * of CRLFs we've changed to LFs.
-        */
-       ((data->req.size + data->state.crlf_conversions) !=
-        data->req.bytecount) &&
-#endif /* CURL_DO_LINEEND_CONV */
        (data->req.maxdownload != data->req.bytecount)) {
-      failf(data, "Received only partial file: %" CURL_FORMAT_CURL_OFF_T
-            " bytes", data->req.bytecount);
+      failf(data, "Received only partial file: %" FMT_OFF_T " bytes",
+            data->req.bytecount);
       result = CURLE_PARTIAL_FILE;
     }
     else if(!ftpc->dont_check &&
             !data->req.bytecount &&
-            (data->req.size>0)) {
+            (data->req.size > 0)) {
       failf(data, "No data was received");
       result = CURLE_FTP_COULDNT_RETR_FILE;
     }
   }
+  return result;
+}
+
+/***********************************************************************
+ *
+ * ftp_done()
+ *
+ * The DONE function. This does what needs to be done after a single DO has
+ * performed.
+ *
+ * Input argument is already checked for validity.
+ */
+static CURLcode ftp_done(struct Curl_easy *data, CURLcode status,
+                         bool premature)
+{
+  struct FTP *ftp = Curl_meta_get(data, CURL_META_FTP_EASY);
+  struct ftp_conn *ftpc = Curl_conn_meta_get(data->conn, CURL_META_FTP_CONN);
+  CURLcode result;
+
+  if(!ftp || !ftpc)
+    return CURLE_OK;
+
+  result = ftp_done_status(data->conn, ftpc, status, premature);
+
+  ftp_done_wildcard(data, ftpc);
+  ftp_done_path(data, ftpc, result);
+  result = ftp_done_secondary_socket(data, ftpc, result);
+  result = ftp_done_control_reply(data, ftpc, ftp, result, premature);
+  result = ftp_done_check_partial(data, ftpc, ftp, result, premature);
 
   /* clear these for next connection */
   ftp->transfer = PPTRANSFER_BODY;
@@ -3422,80 +3834,11 @@ static CURLcode ftp_done(struct Curl_easy *data, CURLcode status,
 
   /* Send any post-transfer QUOTE strings? */
   if(!status && !result && !premature && data->set.postquote)
-    result = ftp_sendquote(data, conn, data->set.postquote);
-  Curl_safefree(ftp->pathalloc);
+    result = ftp_sendquote(data, ftpc, data->set.postquote);
+  CURL_TRC_FTP(data, "[%s] done, result=%d", FTP_CSTATE(ftpc), (int)result);
   return result;
 }
 
-/***********************************************************************
- *
- * ftp_sendquote()
- *
- * Where a 'quote' means a list of custom commands to send to the server.
- * The quote list is passed as an argument.
- *
- * BLOCKING
- */
-
-static
-CURLcode ftp_sendquote(struct Curl_easy *data,
-                       struct connectdata *conn, struct curl_slist *quote)
-{
-  struct curl_slist *item;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
-  struct pingpong *pp = &ftpc->pp;
-
-  item = quote;
-  while(item) {
-    if(item->data) {
-      ssize_t nread;
-      char *cmd = item->data;
-      bool acceptfail = FALSE;
-      CURLcode result;
-      int ftpcode = 0;
-
-      /* if a command starts with an asterisk, which a legal FTP command never
-         can, the command will be allowed to fail without it causing any
-         aborts or cancels etc. It will cause libcurl to act as if the command
-         is successful, whatever the server reponds. */
-
-      if(cmd[0] == '*') {
-        cmd++;
-        acceptfail = TRUE;
-      }
-
-      result = Curl_pp_sendf(data, &ftpc->pp, "%s", cmd);
-      if(!result) {
-        pp->response = Curl_now(); /* timeout relative now */
-        result = Curl_GetFTPResponse(data, &nread, &ftpcode);
-      }
-      if(result)
-        return result;
-
-      if(!acceptfail && (ftpcode >= 400)) {
-        failf(data, "QUOT string not accepted: %s", cmd);
-        return CURLE_QUOTE_ERROR;
-      }
-    }
-
-    item = item->next;
-  }
-
-  return CURLE_OK;
-}
-
-/***********************************************************************
- *
- * ftp_need_type()
- *
- * Returns TRUE if we in the current situation should send TYPE
- */
-static int ftp_need_type(struct connectdata *conn,
-                         bool ascii_wanted)
-{
-  return conn->proto.ftpc.transfertype != (ascii_wanted?'A':'I');
-}
-
 /***********************************************************************
  *
  * ftp_nb_type()
@@ -3505,21 +3848,21 @@ static int ftp_need_type(struct connectdata *conn,
  * If the transfer type is not sent, simulate on OK response in newstate
  */
 static CURLcode ftp_nb_type(struct Curl_easy *data,
-                            struct connectdata *conn,
+                            struct ftp_conn *ftpc,
+                            struct FTP *ftp,
                             bool ascii, ftpstate newstate)
 {
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
   CURLcode result;
-  char want = (char)(ascii?'A':'I');
+  char want = (char)(ascii ? 'A' : 'I');
 
   if(ftpc->transfertype == want) {
-    ftp_state(data, newstate);
-    return ftp_state_type_resp(data, 200, newstate);
+    ftp_state(data, ftpc, newstate);
+    return ftp_state_type_resp(data, ftpc, ftp, 200, newstate);
   }
 
   result = Curl_pp_sendf(data, &ftpc->pp, "TYPE %c", want);
   if(!result) {
-    ftp_state(data, newstate);
+    ftp_state(data, ftpc, newstate);
 
     /* keep track of our current transfer type */
     ftpc->transfertype = want;
@@ -3527,178 +3870,6 @@ static CURLcode ftp_nb_type(struct Curl_easy *data,
   return result;
 }
 
-/***************************************************************************
- *
- * ftp_pasv_verbose()
- *
- * This function only outputs some informationals about this second connection
- * when we've issued a PASV command before and thus we have connected to a
- * possibly new IP address.
- *
- */
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-static void
-ftp_pasv_verbose(struct Curl_easy *data,
-                 struct Curl_addrinfo *ai,
-                 char *newhost, /* ascii version */
-                 int port)
-{
-  char buf[256];
-  Curl_printable_address(ai, buf, sizeof(buf));
-  infof(data, "Connecting to %s (%s) port %d", newhost, buf, port);
-}
-#endif
-
-/*
- * ftp_do_more()
- *
- * This function shall be called when the second FTP (data) connection is
- * connected.
- *
- * 'complete' can return 0 for incomplete, 1 for done and -1 for go back
- * (which basically is only for when PASV is being sent to retry a failed
- * EPSV).
- */
-
-static CURLcode ftp_do_more(struct Curl_easy *data, int *completep)
-{
-  struct connectdata *conn = data->conn;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
-  CURLcode result = CURLE_OK;
-  bool connected = FALSE;
-  bool complete = FALSE;
-
-  /* the ftp struct is inited in ftp_connect(). If we are connecting to an HTTP
-   * proxy then the state will not be valid until after that connection is
-   * complete */
-  struct FTP *ftp = NULL;
-
-  /* if the second connection isn't done yet, wait for it to have
-   * connected to the remote host. When using proxy tunneling, this
-   * means the tunnel needs to have been establish. However, we
-   * can not expect the remote host to talk to us in any way yet.
-   * So, when using ftps: the SSL handshake will not start until we
-   * tell the remote server that we are there. */
-  if(conn->cfilter[SECONDARYSOCKET]) {
-    result = Curl_conn_connect(data, SECONDARYSOCKET, FALSE, &connected);
-    if(result || !Curl_conn_is_ip_connected(data, SECONDARYSOCKET)) {
-      if(result && (ftpc->count1 == 0)) {
-        *completep = -1; /* go back to DOING please */
-        /* this is a EPSV connect failing, try PASV instead */
-        return ftp_epsv_disable(data, conn);
-      }
-      return result;
-    }
-  }
-
-  /* Curl_proxy_connect might have moved the protocol state */
-  ftp = data->req.p.ftp;
-
-  if(ftpc->state) {
-    /* already in a state so skip the initial commands.
-       They are only done to kickstart the do_more state */
-    result = ftp_multi_statemach(data, &complete);
-
-    *completep = (int)complete;
-
-    /* if we got an error or if we don't wait for a data connection return
-       immediately */
-    if(result || !ftpc->wait_data_conn)
-      return result;
-
-    /* if we reach the end of the FTP state machine here, *complete will be
-       TRUE but so is ftpc->wait_data_conn, which says we need to wait for the
-       data connection and therefore we're not actually complete */
-    *completep = 0;
-  }
-
-  if(ftp->transfer <= PPTRANSFER_INFO) {
-    /* a transfer is about to take place, or if not a file name was given
-       so we'll do a SIZE on it later and then we need the right TYPE first */
-
-    if(ftpc->wait_data_conn) {
-      bool serv_conned;
-
-      result = ReceivedServerConnect(data, &serv_conned);
-      if(result)
-        return result; /* Failed to accept data connection */
-
-      if(serv_conned) {
-        /* It looks data connection is established */
-        result = AcceptServerConnect(data);
-        ftpc->wait_data_conn = FALSE;
-        if(!result)
-          result = InitiateTransfer(data);
-
-        if(result)
-          return result;
-
-        *completep = 1; /* this state is now complete when the server has
-                           connected back to us */
-      }
-    }
-    else if(data->state.upload) {
-      result = ftp_nb_type(data, conn, data->state.prefer_ascii,
-                           FTP_STOR_TYPE);
-      if(result)
-        return result;
-
-      result = ftp_multi_statemach(data, &complete);
-      *completep = (int)complete;
-    }
-    else {
-      /* download */
-      ftp->downloadsize = -1; /* unknown as of yet */
-
-      result = Curl_range(data);
-
-      if(result == CURLE_OK && data->req.maxdownload >= 0) {
-        /* Don't check for successful transfer */
-        ftpc->dont_check = TRUE;
-      }
-
-      if(result)
-        ;
-      else if(data->state.list_only || !ftpc->file) {
-        /* The specified path ends with a slash, and therefore we think this
-           is a directory that is requested, use LIST. But before that we
-           need to set ASCII transfer mode. */
-
-        /* But only if a body transfer was requested. */
-        if(ftp->transfer == PPTRANSFER_BODY) {
-          result = ftp_nb_type(data, conn, TRUE, FTP_LIST_TYPE);
-          if(result)
-            return result;
-        }
-        /* otherwise just fall through */
-      }
-      else {
-        result = ftp_nb_type(data, conn, data->state.prefer_ascii,
-                             FTP_RETR_TYPE);
-        if(result)
-          return result;
-      }
-
-      result = ftp_multi_statemach(data, &complete);
-      *completep = (int)complete;
-    }
-    return result;
-  }
-
-  /* no data to transfer */
-  Curl_setup_transfer(data, -1, -1, FALSE, -1);
-
-  if(!ftpc->wait_data_conn) {
-    /* no waiting for the data connection so this is now complete */
-    *completep = 1;
-    DEBUGF(infof(data, "DO-MORE phase ends with %d", (int)result));
-  }
-
-  return result;
-}
-
-
-
 /***********************************************************************
  *
  * ftp_perform()
@@ -3706,39 +3877,44 @@ static CURLcode ftp_do_more(struct Curl_easy *data, int *completep)
  * This is the actual DO function for FTP. Get a file/directory according to
  * the options previously setup.
  */
-
-static
-CURLcode ftp_perform(struct Curl_easy *data,
-                     bool *connected,  /* connect status after PASV / PORT */
-                     bool *dophase_done)
+static CURLcode ftp_perform(
+  struct Curl_easy *data,
+  struct ftp_conn *ftpc,
+  struct FTP *ftp,
+  bool *connected,  /* connect status after PASV / PORT */
+  bool *dophase_done)
 {
   /* this is FTP and no proxy */
   CURLcode result = CURLE_OK;
 
-  DEBUGF(infof(data, "DO phase starts"));
+  CURL_TRC_FTP(data, "[%s] DO phase starts", FTP_CSTATE(ftpc));
 
   if(data->req.no_body) {
     /* requested no body means no transfer... */
-    struct FTP *ftp = data->req.p.ftp;
     ftp->transfer = PPTRANSFER_INFO;
   }
 
   *dophase_done = FALSE; /* not done yet */
 
   /* start the first command in the DO phase */
-  result = ftp_state_quote(data, TRUE, FTP_QUOTE);
+  result = ftp_state_quote(data, ftpc, ftp, TRUE, FTP_QUOTE);
   if(result)
     return result;
 
   /* run the state-machine */
-  result = ftp_multi_statemach(data, dophase_done);
+  result = ftp_statemach(data, ftpc, dophase_done);
 
   *connected = Curl_conn_is_connected(data->conn, SECONDARYSOCKET);
 
-  infof(data, "ftp_perform ends with SECONDARY: %d", *connected);
+  if(*connected)
+    infof(data, "[FTP] [%s] perform, DATA connection established",
+          FTP_CSTATE(ftpc));
+  else
+    CURL_TRC_FTP(data, "[%s] perform, awaiting DATA connect",
+                 FTP_CSTATE(ftpc));
 
   if(*dophase_done)
-    DEBUGF(infof(data, "DO phase is complete1"));
+    CURL_TRC_FTP(data, "[%s] DO phase is complete1", FTP_CSTATE(ftpc));
 
   return result;
 }
@@ -3748,13 +3924,14 @@ static void wc_data_dtor(void *ptr)
   struct ftp_wc *ftpwc = ptr;
   if(ftpwc && ftpwc->parser)
     Curl_ftp_parselist_data_free(&ftpwc->parser);
-  free(ftpwc);
+  curlx_free(ftpwc);
 }
 
-static CURLcode init_wc_data(struct Curl_easy *data)
+static CURLcode init_wc_data(struct Curl_easy *data,
+                             struct ftp_conn *ftpc,
+                             struct FTP *ftp)
 {
   char *last_slash;
-  struct FTP *ftp = data->req.p.ftp;
   char *path = ftp->path;
   struct WildcardData *wildcard = data->wildcard;
   CURLcode result = CURLE_OK;
@@ -3765,25 +3942,23 @@ static CURLcode init_wc_data(struct Curl_easy *data)
     last_slash++;
     if(last_slash[0] == '\0') {
       wildcard->state = CURLWC_CLEAN;
-      result = ftp_parse_url_path(data);
-      return result;
+      return ftp_parse_url_path(data, ftpc, ftp);
     }
-    wildcard->pattern = strdup(last_slash);
+    wildcard->pattern = curlx_strdup(last_slash);
     if(!wildcard->pattern)
       return CURLE_OUT_OF_MEMORY;
     last_slash[0] = '\0'; /* cut file from path */
   }
   else { /* there is only 'wildcard pattern' or nothing */
     if(path[0]) {
-      wildcard->pattern = strdup(path);
+      wildcard->pattern = curlx_strdup(path);
       if(!wildcard->pattern)
         return CURLE_OUT_OF_MEMORY;
       path[0] = '\0';
     }
     else { /* only list */
       wildcard->state = CURLWC_CLEAN;
-      result = ftp_parse_url_path(data);
-      return result;
+      return ftp_parse_url_path(data, ftpc, ftp);
     }
   }
 
@@ -3791,7 +3966,7 @@ static CURLcode init_wc_data(struct Curl_easy *data)
      resources for wildcard transfer */
 
   /* allocate ftp protocol specific wildcard data */
-  ftpwc = calloc(1, sizeof(struct ftp_wc));
+  ftpwc = curlx_calloc(1, sizeof(struct ftp_wc));
   if(!ftpwc) {
     result = CURLE_OUT_OF_MEMORY;
     goto fail;
@@ -3811,13 +3986,13 @@ static CURLcode init_wc_data(struct Curl_easy *data)
   if(data->set.ftp_filemethod == FTPFILE_NOCWD)
     data->set.ftp_filemethod = FTPFILE_MULTICWD;
 
-  /* try to parse ftp url */
-  result = ftp_parse_url_path(data);
+  /* try to parse ftp URL */
+  result = ftp_parse_url_path(data, ftpc, ftp);
   if(result) {
     goto fail;
   }
 
-  wildcard->path = strdup(ftp->path);
+  wildcard->path = curlx_strdup(ftp->path);
   if(!wildcard->path) {
     result = CURLE_OUT_OF_MEMORY;
     goto fail;
@@ -3838,24 +4013,25 @@ static CURLcode init_wc_data(struct Curl_easy *data)
 fail:
   if(ftpwc) {
     Curl_ftp_parselist_data_free(&ftpwc->parser);
-    free(ftpwc);
+    curlx_free(ftpwc);
   }
-  Curl_safefree(wildcard->pattern);
+  curlx_safefree(wildcard->pattern);
   wildcard->dtor = ZERO_NULL;
   wildcard->ftpwc = NULL;
   return result;
 }
 
-static CURLcode wc_statemach(struct Curl_easy *data)
+static CURLcode wc_statemach(struct Curl_easy *data,
+                             struct ftp_conn *ftpc,
+                             struct FTP *ftp)
 {
   struct WildcardData * const wildcard = data->wildcard;
-  struct connectdata *conn = data->conn;
   CURLcode result = CURLE_OK;
 
   for(;;) {
     switch(wildcard->state) {
     case CURLWC_INIT:
-      result = init_wc_data(data);
+      result = init_wc_data(data, ftpc, ftp);
       if(wildcard->state == CURLWC_CLEAN)
         /* only listing! */
         return result;
@@ -3877,7 +4053,7 @@ static CURLcode wc_statemach(struct Curl_easy *data)
         wildcard->state = CURLWC_CLEAN;
         continue;
       }
-      if(wildcard->filelist.size == 0) {
+      if(Curl_llist_count(&wildcard->filelist) == 0) {
         /* no corresponding file */
         wildcard->state = CURLWC_CLEAN;
         return CURLE_REMOTE_FILE_NOT_FOUND;
@@ -3887,29 +4063,28 @@ static CURLcode wc_statemach(struct Curl_easy *data)
 
     case CURLWC_DOWNLOADING: {
       /* filelist has at least one file, lets get first one */
-      struct ftp_conn *ftpc = &conn->proto.ftpc;
-      struct curl_fileinfo *finfo = wildcard->filelist.head->ptr;
-      struct FTP *ftp = data->req.p.ftp;
+      struct Curl_llist_node *head = Curl_llist_head(&wildcard->filelist);
+      struct curl_fileinfo *finfo = Curl_node_elem(head);
 
-      char *tmp_path = aprintf("%s%s", wildcard->path, finfo->filename);
+      char *tmp_path = curl_maprintf("%s%s", wildcard->path, finfo->filename);
       if(!tmp_path)
         return CURLE_OUT_OF_MEMORY;
 
       /* switch default ftp->path and tmp_path */
-      free(ftp->pathalloc);
+      curlx_free(ftp->pathalloc);
       ftp->pathalloc = ftp->path = tmp_path;
 
       infof(data, "Wildcard - START of \"%s\"", finfo->filename);
       if(data->set.chunk_bgn) {
         long userresponse;
-        Curl_set_in_callback(data, true);
+        Curl_set_in_callback(data, TRUE);
         userresponse = data->set.chunk_bgn(
-          finfo, data->set.wildcardptr, (int)wildcard->filelist.size);
-        Curl_set_in_callback(data, false);
+          finfo, data->set.wildcardptr,
+          (int)Curl_llist_count(&wildcard->filelist));
+        Curl_set_in_callback(data, FALSE);
         switch(userresponse) {
         case CURL_CHUNK_BGN_FUNC_SKIP:
-          infof(data, "Wildcard - \"%s\" skipped by user",
-                finfo->filename);
+          infof(data, "Wildcard - \"%s\" skipped by user", finfo->filename);
           wildcard->state = CURLWC_SKIP;
           continue;
         case CURL_CHUNK_BGN_FUNC_FAIL:
@@ -3925,14 +4100,15 @@ static CURLcode wc_statemach(struct Curl_easy *data)
       if(finfo->flags & CURLFINFOFLAG_KNOWN_SIZE)
         ftpc->known_filesize = finfo->size;
 
-      result = ftp_parse_url_path(data);
+      result = ftp_parse_url_path(data, ftpc, ftp);
       if(result)
         return result;
 
-      /* we don't need the Curl_fileinfo of first file anymore */
-      Curl_llist_remove(&wildcard->filelist, wildcard->filelist.head, NULL);
+      /* we do not need the Curl_fileinfo of first file anymore */
+      Curl_node_remove(Curl_llist_head(&wildcard->filelist));
 
-      if(wildcard->filelist.size == 0) { /* remains only one file to down. */
+      if(Curl_llist_count(&wildcard->filelist) == 0) {
+        /* remains only one file to down. */
         wildcard->state = CURLWC_CLEAN;
         /* after that will be ftp_do called once again and no transfer
            will be done because of CURLWC_CLEAN state */
@@ -3943,12 +4119,12 @@ static CURLcode wc_statemach(struct Curl_easy *data)
 
     case CURLWC_SKIP: {
       if(data->set.chunk_end) {
-        Curl_set_in_callback(data, true);
+        Curl_set_in_callback(data, TRUE);
         data->set.chunk_end(data->set.wildcardptr);
-        Curl_set_in_callback(data, false);
+        Curl_set_in_callback(data, FALSE);
       }
-      Curl_llist_remove(&wildcard->filelist, wildcard->filelist.head, NULL);
-      wildcard->state = (wildcard->filelist.size == 0) ?
+      Curl_node_remove(Curl_llist_head(&wildcard->filelist));
+      wildcard->state = (Curl_llist_count(&wildcard->filelist) == 0) ?
         CURLWC_CLEAN : CURLWC_DOWNLOADING;
       continue;
     }
@@ -3976,6 +4152,52 @@ static CURLcode wc_statemach(struct Curl_easy *data)
   /* UNREACHABLE */
 }
 
+/***********************************************************************
+ *
+ * ftp_regular_transfer()
+ *
+ * The input argument is already checked for validity.
+ *
+ * Performs all commands done before a regular transfer between a local and a
+ * remote host.
+ *
+ * ftp->ctl_valid starts out as FALSE, and gets set to TRUE if we reach the
+ * ftp_done() function without finding any major problem.
+ */
+static CURLcode ftp_regular_transfer(struct Curl_easy *data,
+                                     struct ftp_conn *ftpc,
+                                     struct FTP *ftp,
+                                     bool *dophase_done)
+{
+  CURLcode result = CURLE_OK;
+  bool connected = FALSE;
+  data->req.size = -1; /* make sure this is unknown at this point */
+
+  Curl_pgrsReset(data);
+
+  ftpc->ctl_valid = TRUE; /* starts good */
+
+  result = ftp_perform(data, ftpc, ftp,
+                       &connected, /* have we connected after PASV/PORT */
+                       dophase_done); /* all commands in the DO-phase done? */
+
+  if(!result) {
+
+    if(!*dophase_done)
+      /* the DO phase has not completed yet */
+      return CURLE_OK;
+
+    result = ftp_dophase_done(data, ftpc, ftp, connected);
+
+    if(result)
+      return result;
+  }
+  else
+    freedirs(ftpc);
+
+  return result;
+}
+
 /***********************************************************************
  *
  * ftp_do()
@@ -3988,14 +4210,34 @@ static CURLcode wc_statemach(struct Curl_easy *data)
 static CURLcode ftp_do(struct Curl_easy *data, bool *done)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
+  struct ftp_conn *ftpc = Curl_conn_meta_get(data->conn, CURL_META_FTP_CONN);
+  struct FTP *ftp = Curl_meta_get(data, CURL_META_FTP_EASY);
 
   *done = FALSE; /* default to false */
+  if(!ftpc || !ftp)
+    return CURLE_FAILED_INIT;
   ftpc->wait_data_conn = FALSE; /* default to no such wait */
 
+#ifdef CURL_PREFER_LF_LINEENDS
+  {
+    /* FTP data may need conversion. */
+    struct Curl_cwriter *ftp_lc_writer;
+
+    result = Curl_cwriter_create(&ftp_lc_writer, data, &ftp_cw_lc,
+                                 CURL_CW_CONTENT_DECODE);
+    if(result)
+      return result;
+
+    result = Curl_cwriter_add(data, ftp_lc_writer);
+    if(result) {
+      Curl_cwriter_free(data, ftp_lc_writer);
+      return result;
+    }
+  }
+#endif /* CURL_PREFER_LF_LINEENDS */
+
   if(data->state.wildcardmatch) {
-    result = wc_statemach(data);
+    result = wc_statemach(data, ftpc, ftp);
     if(data->wildcard->state == CURLWC_SKIP ||
        data->wildcard->state == CURLWC_DONE) {
       /* do not call ftp_regular_transfer */
@@ -4005,12 +4247,12 @@ static CURLcode ftp_do(struct Curl_easy *data, bool *done)
       return result;
   }
   else { /* no wildcard FSM needed */
-    result = ftp_parse_url_path(data);
+    result = ftp_parse_url_path(data, ftpc, ftp);
     if(result)
       return result;
   }
 
-  result = ftp_regular_transfer(data, done);
+  result = ftp_regular_transfer(data, ftpc, ftp, done);
 
   return result;
 }
@@ -4025,24 +4267,26 @@ static CURLcode ftp_do(struct Curl_easy *data, bool *done)
  * connection.
  *
  */
-static CURLcode ftp_quit(struct Curl_easy *data, struct connectdata *conn)
+static CURLcode ftp_quit(struct Curl_easy *data,
+                         struct ftp_conn *ftpc)
 {
   CURLcode result = CURLE_OK;
 
-  if(conn->proto.ftpc.ctl_valid) {
-    result = Curl_pp_sendf(data, &conn->proto.ftpc.pp, "%s", "QUIT");
+  if(ftpc->ctl_valid) {
+    CURL_TRC_FTP(data, "sending QUIT to close session");
+    result = Curl_pp_sendf(data, &ftpc->pp, "%s", "QUIT");
     if(result) {
       failf(data, "Failure sending QUIT command: %s",
             curl_easy_strerror(result));
-      conn->proto.ftpc.ctl_valid = FALSE; /* mark control connection as bad */
-      connclose(conn, "QUIT command failed"); /* mark for connection closure */
-      ftp_state(data, FTP_STOP);
+      ftpc->ctl_valid = FALSE; /* mark control connection as bad */
+      connclose(data->conn, "QUIT command failed"); /* mark for closure */
+      ftp_state(data, ftpc, FTP_STOP);
       return result;
     }
 
-    ftp_state(data, FTP_QUIT);
+    ftp_state(data, ftpc, FTP_QUIT);
 
-    result = ftp_block_statemach(data, conn);
+    result = ftp_block_statemach(data, ftpc);
   }
 
   return result;
@@ -4059,226 +4303,23 @@ static CURLcode ftp_disconnect(struct Curl_easy *data,
                                struct connectdata *conn,
                                bool dead_connection)
 {
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
-  struct pingpong *pp = &ftpc->pp;
+  struct ftp_conn *ftpc = Curl_conn_meta_get(conn, CURL_META_FTP_CONN);
 
+  if(!ftpc)
+    return CURLE_FAILED_INIT;
   /* We cannot send quit unconditionally. If this connection is stale or
      bad in any way, sending quit and waiting around here will make the
      disconnect wait in vain and cause more problems than we need to.
 
-     ftp_quit() will check the state of ftp->ctl_valid. If it's ok it
-     will try to send the QUIT command, otherwise it will just return.
+     ftp_quit() will check the state of ftp->ctl_valid. If it is ok it
+     will try to send the QUIT command, otherwise it will return.
   */
-  if(dead_connection)
+  ftpc->shutdown = TRUE;
+  if(dead_connection || Curl_pp_needs_flush(data, &ftpc->pp))
     ftpc->ctl_valid = FALSE;
 
   /* The FTP session may or may not have been allocated/setup at this point! */
-  (void)ftp_quit(data, conn); /* ignore errors on the QUIT */
-
-  if(ftpc->entrypath) {
-    if(data->state.most_recent_ftp_entrypath == ftpc->entrypath) {
-      data->state.most_recent_ftp_entrypath = NULL;
-    }
-    Curl_safefree(ftpc->entrypath);
-  }
-
-  freedirs(ftpc);
-  Curl_safefree(ftpc->account);
-  Curl_safefree(ftpc->alternative_to_user);
-  Curl_safefree(ftpc->prevpath);
-  Curl_safefree(ftpc->server_os);
-  Curl_pp_disconnect(pp);
-  Curl_sec_end(conn);
-  return CURLE_OK;
-}
-
-#ifdef _MSC_VER
-/* warning C4706: assignment within conditional expression */
-#pragma warning(disable:4706)
-#endif
-
-/***********************************************************************
- *
- * ftp_parse_url_path()
- *
- * Parse the URL path into separate path components.
- *
- */
-static
-CURLcode ftp_parse_url_path(struct Curl_easy *data)
-{
-  /* the ftp struct is already inited in ftp_connect() */
-  struct FTP *ftp = data->req.p.ftp;
-  struct connectdata *conn = data->conn;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
-  const char *slashPos = NULL;
-  const char *fileName = NULL;
-  CURLcode result = CURLE_OK;
-  char *rawPath = NULL; /* url-decoded "raw" path */
-  size_t pathLen = 0;
-
-  ftpc->ctl_valid = FALSE;
-  ftpc->cwdfail = FALSE;
-
-  /* url-decode ftp path before further evaluation */
-  result = Curl_urldecode(ftp->path, 0, &rawPath, &pathLen, REJECT_CTRL);
-  if(result) {
-    failf(data, "path contains control characters");
-    return result;
-  }
-
-  switch(data->set.ftp_filemethod) {
-    case FTPFILE_NOCWD: /* fastest, but less standard-compliant */
-
-      if((pathLen > 0) && (rawPath[pathLen - 1] != '/'))
-        fileName = rawPath;  /* this is a full file path */
-      /*
-        else: ftpc->file is not used anywhere other than for operations on
-              a file. In other words, never for directory operations.
-              So we can safely leave filename as NULL here and use it as a
-              argument in dir/file decisions.
-      */
-      break;
-
-    case FTPFILE_SINGLECWD:
-      slashPos = strrchr(rawPath, '/');
-      if(slashPos) {
-        /* get path before last slash, except for / */
-        size_t dirlen = slashPos - rawPath;
-        if(dirlen == 0)
-          dirlen = 1;
-
-        ftpc->dirs = calloc(1, sizeof(ftpc->dirs[0]));
-        if(!ftpc->dirs) {
-          free(rawPath);
-          return CURLE_OUT_OF_MEMORY;
-        }
-
-        ftpc->dirs[0] = calloc(1, dirlen + 1);
-        if(!ftpc->dirs[0]) {
-          free(rawPath);
-          return CURLE_OUT_OF_MEMORY;
-        }
-
-        strncpy(ftpc->dirs[0], rawPath, dirlen);
-        ftpc->dirdepth = 1; /* we consider it to be a single dir */
-        fileName = slashPos + 1; /* rest is file name */
-      }
-      else
-        fileName = rawPath; /* file name only (or empty) */
-      break;
-
-    default: /* allow pretty much anything */
-    case FTPFILE_MULTICWD: {
-      /* current position: begin of next path component */
-      const char *curPos = rawPath;
-
-      /* number of entries allocated for the 'dirs' array */
-      size_t dirAlloc = 0;
-      const char *str = rawPath;
-      for(; *str != 0; ++str)
-        if(*str == '/')
-          ++dirAlloc;
-
-      if(dirAlloc) {
-        ftpc->dirs = calloc(dirAlloc, sizeof(ftpc->dirs[0]));
-        if(!ftpc->dirs) {
-          free(rawPath);
-          return CURLE_OUT_OF_MEMORY;
-        }
-
-        /* parse the URL path into separate path components */
-        while((slashPos = strchr(curPos, '/'))) {
-          size_t compLen = slashPos - curPos;
-
-          /* path starts with a slash: add that as a directory */
-          if((compLen == 0) && (ftpc->dirdepth == 0))
-            ++compLen;
-
-          /* we skip empty path components, like "x//y" since the FTP command
-             CWD requires a parameter and a non-existent parameter a) doesn't
-             work on many servers and b) has no effect on the others. */
-          if(compLen > 0) {
-            char *comp = calloc(1, compLen + 1);
-            if(!comp) {
-              free(rawPath);
-              return CURLE_OUT_OF_MEMORY;
-            }
-            strncpy(comp, curPos, compLen);
-            ftpc->dirs[ftpc->dirdepth++] = comp;
-          }
-          curPos = slashPos + 1;
-        }
-      }
-      DEBUGASSERT((size_t)ftpc->dirdepth <= dirAlloc);
-      fileName = curPos; /* the rest is the file name (or empty) */
-    }
-    break;
-  } /* switch */
-
-  if(fileName && *fileName)
-    ftpc->file = strdup(fileName);
-  else
-    ftpc->file = NULL; /* instead of point to a zero byte,
-                            we make it a NULL pointer */
-
-  if(data->state.upload && !ftpc->file && (ftp->transfer == PPTRANSFER_BODY)) {
-    /* We need a file name when uploading. Return error! */
-    failf(data, "Uploading to a URL without a file name");
-    free(rawPath);
-    return CURLE_URL_MALFORMAT;
-  }
-
-  ftpc->cwddone = FALSE; /* default to not done */
-
-  if((data->set.ftp_filemethod == FTPFILE_NOCWD) && (rawPath[0] == '/'))
-    ftpc->cwddone = TRUE; /* skip CWD for absolute paths */
-  else { /* newly created FTP connections are already in entry path */
-    const char *oldPath = conn->bits.reuse ? ftpc->prevpath : "";
-    if(oldPath) {
-      size_t n = pathLen;
-      if(data->set.ftp_filemethod == FTPFILE_NOCWD)
-        n = 0; /* CWD to entry for relative paths */
-      else
-        n -= ftpc->file?strlen(ftpc->file):0;
-
-      if((strlen(oldPath) == n) && !strncmp(rawPath, oldPath, n)) {
-        infof(data, "Request has same path as previous transfer");
-        ftpc->cwddone = TRUE;
-      }
-    }
-  }
-
-  free(rawPath);
-  return CURLE_OK;
-}
-
-/* call this when the DO phase has completed */
-static CURLcode ftp_dophase_done(struct Curl_easy *data, bool connected)
-{
-  struct connectdata *conn = data->conn;
-  struct FTP *ftp = data->req.p.ftp;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
-
-  if(connected) {
-    int completed;
-    CURLcode result = ftp_do_more(data, &completed);
-
-    if(result) {
-      close_secondarysocket(data, conn);
-      return result;
-    }
-  }
-
-  if(ftp->transfer != PPTRANSFER_BODY)
-    /* no data to transfer */
-    Curl_setup_transfer(data, -1, -1, FALSE, -1);
-  else if(!connected)
-    /* since we didn't connect now, we want do_more to get called */
-    conn->bits.do_more = TRUE;
-
-  ftpc->ctl_valid = TRUE; /* seems good */
-
+  (void)ftp_quit(data, ftpc); /* ignore errors on the QUIT */
   return CURLE_OK;
 }
 
@@ -4286,112 +4327,58 @@ static CURLcode ftp_dophase_done(struct Curl_easy *data, bool connected)
 static CURLcode ftp_doing(struct Curl_easy *data,
                           bool *dophase_done)
 {
-  CURLcode result = ftp_multi_statemach(data, dophase_done);
+  struct ftp_conn *ftpc = Curl_conn_meta_get(data->conn, CURL_META_FTP_CONN);
+  struct FTP *ftp = Curl_meta_get(data, CURL_META_FTP_EASY);
+  CURLcode result;
+
+  if(!ftpc || !ftp)
+    return CURLE_FAILED_INIT;
+  result = ftp_statemach(data, ftpc, dophase_done);
 
   if(result)
-    DEBUGF(infof(data, "DO phase failed"));
+    CURL_TRC_FTP(data, "[%s] DO phase failed", FTP_CSTATE(ftpc));
   else if(*dophase_done) {
-    result = ftp_dophase_done(data, FALSE /* not connected */);
+    result = ftp_dophase_done(data, ftpc, ftp, FALSE /* not connected */);
 
-    DEBUGF(infof(data, "DO phase is complete2"));
+    CURL_TRC_FTP(data, "[%s] DO phase is complete2", FTP_CSTATE(ftpc));
   }
   return result;
 }
 
-/***********************************************************************
- *
- * ftp_regular_transfer()
- *
- * The input argument is already checked for validity.
- *
- * Performs all commands done before a regular transfer between a local and a
- * remote host.
- *
- * ftp->ctl_valid starts out as FALSE, and gets set to TRUE if we reach the
- * ftp_done() function without finding any major problem.
- */
-static
-CURLcode ftp_regular_transfer(struct Curl_easy *data,
-                              bool *dophase_done)
+static void ftp_easy_dtor(void *key, size_t klen, void *entry)
 {
-  CURLcode result = CURLE_OK;
-  bool connected = FALSE;
-  struct connectdata *conn = data->conn;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
-  data->req.size = -1; /* make sure this is unknown at this point */
-
-  Curl_pgrsSetUploadCounter(data, 0);
-  Curl_pgrsSetDownloadCounter(data, 0);
-  Curl_pgrsSetUploadSize(data, -1);
-  Curl_pgrsSetDownloadSize(data, -1);
-
-  ftpc->ctl_valid = TRUE; /* starts good */
-
-  result = ftp_perform(data,
-                       &connected, /* have we connected after PASV/PORT */
-                       dophase_done); /* all commands in the DO-phase done? */
-
-  if(!result) {
-
-    if(!*dophase_done)
-      /* the DO phase has not completed yet */
-      return CURLE_OK;
-
-    result = ftp_dophase_done(data, connected);
-
-    if(result)
-      return result;
-  }
-  else
-    freedirs(ftpc);
-
-  return result;
+  struct FTP *ftp = entry;
+  (void)key;
+  (void)klen;
+  curlx_safefree(ftp->pathalloc);
+  curlx_free(ftp);
 }
 
-static CURLcode ftp_setup_connection(struct Curl_easy *data,
-                                     struct connectdata *conn)
+static void ftp_conn_dtor(void *key, size_t klen, void *entry)
 {
-  char *type;
-  struct FTP *ftp;
-  CURLcode result = CURLE_OK;
-  struct ftp_conn *ftpc = &conn->proto.ftpc;
-
-  ftp = calloc(sizeof(struct FTP), 1);
-  if(!ftp)
-    return CURLE_OUT_OF_MEMORY;
-
-  /* clone connection related data that is FTP specific */
-  if(data->set.str[STRING_FTP_ACCOUNT]) {
-    ftpc->account = strdup(data->set.str[STRING_FTP_ACCOUNT]);
-    if(!ftpc->account) {
-      free(ftp);
-      return CURLE_OUT_OF_MEMORY;
-    }
-  }
-  if(data->set.str[STRING_FTP_ALTERNATIVE_TO_USER]) {
-    ftpc->alternative_to_user =
-      strdup(data->set.str[STRING_FTP_ALTERNATIVE_TO_USER]);
-    if(!ftpc->alternative_to_user) {
-      Curl_safefree(ftpc->account);
-      free(ftp);
-      return CURLE_OUT_OF_MEMORY;
-    }
-  }
-  data->req.p.ftp = ftp;
-
-  ftp->path = &data->state.up.path[1]; /* don't include the initial slash */
+  struct ftp_conn *ftpc = entry;
+  (void)key;
+  (void)klen;
+  freedirs(ftpc);
+  curlx_safefree(ftpc->account);
+  curlx_safefree(ftpc->alternative_to_user);
+  curlx_safefree(ftpc->entrypath);
+  curlx_safefree(ftpc->prevpath);
+  curlx_safefree(ftpc->server_os);
+  Curl_pp_disconnect(&ftpc->pp);
+  curlx_free(ftpc);
+}
 
+static void type_url_check(struct Curl_easy *data, struct FTP *ftp)
+{
+  size_t len = strlen(ftp->path);
   /* FTP URLs support an extension like ";type=<typecode>" that
-   * we'll try to get now! */
-  type = strstr(ftp->path, ";type=");
+   * we will try to get now! */
+  if((len >= 7) && !memcmp(&ftp->path[len - 7], ";type=", 6)) {
+    char *type = &ftp->path[len - 7];
+    char command = Curl_raw_toupper(type[6]);
 
-  if(!type)
-    type = strstr(conn->host.rawalloc, ";type=");
-
-  if(type) {
-    char command;
-    *type = 0;                     /* it was in the middle of the hostname */
-    command = Curl_raw_toupper(type[6]);
+    *type = 0; /* cut it off */
 
     switch(command) {
     case 'A': /* ASCII mode */
@@ -4409,6 +4396,46 @@ static CURLcode ftp_setup_connection(struct Curl_easy *data,
       break;
     }
   }
+}
+
+static CURLcode ftp_setup_connection(struct Curl_easy *data,
+                                     struct connectdata *conn)
+{
+  struct FTP *ftp;
+  CURLcode result = CURLE_OK;
+  struct ftp_conn *ftpc;
+
+  ftp = curlx_calloc(1, sizeof(*ftp));
+  if(!ftp ||
+     Curl_meta_set(data, CURL_META_FTP_EASY, ftp, ftp_easy_dtor))
+    return CURLE_OUT_OF_MEMORY;
+
+  ftpc = curlx_calloc(1, sizeof(*ftpc));
+  if(!ftpc ||
+     Curl_conn_meta_set(conn, CURL_META_FTP_CONN, ftpc, ftp_conn_dtor))
+    return CURLE_OUT_OF_MEMORY;
+
+  /* clone connection related data that is FTP specific */
+  if(data->set.str[STRING_FTP_ACCOUNT]) {
+    ftpc->account = curlx_strdup(data->set.str[STRING_FTP_ACCOUNT]);
+    if(!ftpc->account) {
+      Curl_conn_meta_remove(conn, CURL_META_FTP_CONN);
+      return CURLE_OUT_OF_MEMORY;
+    }
+  }
+  if(data->set.str[STRING_FTP_ALTERNATIVE_TO_USER]) {
+    ftpc->alternative_to_user =
+      curlx_strdup(data->set.str[STRING_FTP_ALTERNATIVE_TO_USER]);
+    if(!ftpc->alternative_to_user) {
+      curlx_safefree(ftpc->account);
+      Curl_conn_meta_remove(conn, CURL_META_FTP_CONN);
+      return CURLE_OUT_OF_MEMORY;
+    }
+  }
+
+  ftp->path = &data->state.up.path[1]; /* do not include the initial slash */
+
+  type_url_check(data, ftp);
 
   /* get some initial data into the ftp struct */
   ftp->transfer = PPTRANSFER_BODY;
@@ -4417,7 +4444,55 @@ static CURLcode ftp_setup_connection(struct Curl_easy *data,
   ftpc->use_ssl = data->set.use_ssl;
   ftpc->ccc = data->set.ftp_ccc;
 
+  CURL_TRC_FTP(data, "[%s] setup connection -> %d", FTP_CSTATE(ftpc),
+               (int)result);
   return result;
 }
 
+bool ftp_conns_match(struct connectdata *needle, struct connectdata *conn)
+{
+  struct ftp_conn *nftpc = Curl_conn_meta_get(needle, CURL_META_FTP_CONN);
+  struct ftp_conn *cftpc = Curl_conn_meta_get(conn, CURL_META_FTP_CONN);
+  /* Also match ACCOUNT, ALTERNATIVE-TO-USER and CCC options */
+  if(!nftpc || !cftpc ||
+     Curl_timestrcmp(nftpc->account, cftpc->account) ||
+     Curl_timestrcmp(nftpc->alternative_to_user,
+                     cftpc->alternative_to_user) ||
+     (nftpc->ccc != cftpc->ccc))
+    return FALSE;
+  /* A mismatch on `use_ssl` MUST have been found in connection matching
+   * before we come here. This is a check on MAYBE/MUST use of STARTTLS and
+   * it only works on FTP. But IMAP/SMTP etc have the same `use_ssl` and
+   * no extra match like FTP. We lack tests in this area, so let FTP fail
+   * loudly here to help other cases. */
+  if(nftpc->use_ssl > cftpc->use_ssl) {
+    DEBUGASSERT(0);
+    return FALSE;
+  }
+  return TRUE;
+}
+
+/*
+ * FTP protocol.
+ */
+const struct Curl_protocol Curl_protocol_ftp = {
+  ftp_setup_connection,            /* setup_connection */
+  ftp_do,                          /* do_it */
+  ftp_done,                        /* done */
+  ftp_do_more,                     /* do_more */
+  ftp_connect,                     /* connect_it */
+  ftp_multi_statemach,             /* connecting */
+  ftp_doing,                       /* doing */
+  ftp_pollset,                     /* proto_pollset */
+  ftp_pollset,                     /* doing_pollset */
+  ftp_domore_pollset,              /* domore_pollset */
+  ZERO_NULL,                       /* perform_pollset */
+  ftp_disconnect,                  /* disconnect */
+  ZERO_NULL,                       /* write_resp */
+  ZERO_NULL,                       /* write_resp_hd */
+  ZERO_NULL,                       /* connection_is_dead */
+  ZERO_NULL,                       /* attach connection */
+  ZERO_NULL,                       /* follow */
+};
+
 #endif /* CURL_DISABLE_FTP */
diff --git a/third-party/curl/lib/ftp.h b/third-party/curl/lib/ftp.h
index 977fc883b1..257f595826 100644
--- a/third-party/curl/lib/ftp.h
+++ b/third-party/curl/lib/ftp.h
@@ -23,76 +23,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include "pingpong.h"
-
 #ifndef CURL_DISABLE_FTP
-extern const struct Curl_handler Curl_handler_ftp;
+extern const struct Curl_protocol Curl_protocol_ftp;
 
-#ifdef USE_SSL
-extern const struct Curl_handler Curl_handler_ftps;
-#endif
-
-CURLcode Curl_GetFTPResponse(struct Curl_easy *data, ssize_t *nread,
-                             int *ftpcode);
-#endif /* CURL_DISABLE_FTP */
-
-/****************************************************************************
- * FTP unique setup
- ***************************************************************************/
-enum {
-  FTP_STOP,    /* do nothing state, stops the state machine */
-  FTP_WAIT220, /* waiting for the initial 220 response immediately after
-                  a connect */
-  FTP_AUTH,
-  FTP_USER,
-  FTP_PASS,
-  FTP_ACCT,
-  FTP_PBSZ,
-  FTP_PROT,
-  FTP_CCC,
-  FTP_PWD,
-  FTP_SYST,
-  FTP_NAMEFMT,
-  FTP_QUOTE, /* waiting for a response to a command sent in a quote list */
-  FTP_RETR_PREQUOTE,
-  FTP_STOR_PREQUOTE,
-  FTP_POSTQUOTE,
-  FTP_CWD,  /* change dir */
-  FTP_MKD,  /* if the dir didn't exist */
-  FTP_MDTM, /* to figure out the datestamp */
-  FTP_TYPE, /* to set type when doing a head-like request */
-  FTP_LIST_TYPE, /* set type when about to do a dir list */
-  FTP_RETR_TYPE, /* set type when about to RETR a file */
-  FTP_STOR_TYPE, /* set type when about to STOR a file */
-  FTP_SIZE, /* get the remote file's size for head-like request */
-  FTP_RETR_SIZE, /* get the remote file's size for RETR */
-  FTP_STOR_SIZE, /* get the size for STOR */
-  FTP_REST, /* when used to check if the server supports it in head-like */
-  FTP_RETR_REST, /* when asking for "resume" in for RETR */
-  FTP_PORT, /* generic state for PORT, LPRT and EPRT, check count1 */
-  FTP_PRET, /* generic state for PRET RETR, PRET STOR and PRET LIST/NLST */
-  FTP_PASV, /* generic state for PASV and EPSV, check count1 */
-  FTP_LIST, /* generic state for LIST, NLST or a custom list command */
-  FTP_RETR,
-  FTP_STOR, /* generic state for STOR and APPE */
-  FTP_QUIT,
-  FTP_LAST  /* never used */
-};
-typedef unsigned char ftpstate; /* use the enum values */
-
-struct ftp_parselist_data; /* defined later in ftplistparser.c */
-
-struct ftp_wc {
-  struct ftp_parselist_data *parser;
-
-  struct {
-    curl_write_callback write_function;
-    FILE *file_descriptor;
-  } backup;
-};
+bool ftp_conns_match(struct connectdata *needle, struct connectdata *conn);
 
 typedef enum {
   FTPFILE_MULTICWD  = 1, /* as defined by RFC1738 */
@@ -101,66 +37,7 @@ typedef enum {
                             file */
 } curl_ftpfile;
 
-/* This FTP struct is used in the Curl_easy. All FTP data that is
-   connection-oriented must be in FTP_conn to properly deal with the fact that
-   perhaps the Curl_easy is changed between the times the connection is
-   used. */
-struct FTP {
-  char *path;    /* points to the urlpieces struct field */
-  char *pathalloc; /* if non-NULL a pointer to an allocated path */
-
-  /* transfer a file/body or not, done as a typedefed enum just to make
-     debuggers display the full symbol and not just the numerical value */
-  curl_pp_transfer transfer;
-  curl_off_t downloadsize;
-};
-
-
-/* ftp_conn is used for struct connection-oriented data in the connectdata
-   struct */
-struct ftp_conn {
-  struct pingpong pp;
-  char *account;
-  char *alternative_to_user;
-  char *entrypath; /* the PWD reply when we logged on */
-  char *file;    /* url-decoded file name (or path) */
-  char **dirs;   /* realloc()ed array for path components */
-  char *newhost;
-  char *prevpath;   /* url-decoded conn->path from the previous transfer */
-  char transfertype; /* set by ftp_transfertype for use by Curl_client_write()a
-                        and others (A/I or zero) */
-  curl_off_t retr_size_saved; /* Size of retrieved file saved */
-  char *server_os;     /* The target server operating system. */
-  curl_off_t known_filesize; /* file size is different from -1, if wildcard
-                                LIST parsing was done and wc_statemach set
-                                it */
-  int dirdepth;  /* number of entries used in the 'dirs' array */
-  int cwdcount;     /* number of CWD commands issued */
-  int count1; /* general purpose counter for the state machine */
-  int count2; /* general purpose counter for the state machine */
-  int count3; /* general purpose counter for the state machine */
-  /* newhost is the (allocated) IP addr or host name to connect the data
-     connection to */
-  unsigned short newport;
-  ftpstate state; /* always use ftp.c:state() to change state! */
-  ftpstate state_saved; /* transfer type saved to be reloaded after data
-                           connection is established */
-  unsigned char use_ssl;   /* if AUTH TLS is to be attempted etc, for FTP or
-                              IMAP or POP3 or others! (type: curl_usessl)*/
-  unsigned char ccc;       /* ccc level for this connection */
-  BIT(ftp_trying_alternative);
-  BIT(dont_check);  /* Set to TRUE to prevent the final (post-transfer)
-                       file size and 226/250 status check. It should still
-                       read the line, just ignore the result. */
-  BIT(ctl_valid);   /* Tells Curl_ftp_quit() whether or not to do anything. If
-                       the connection has timed out or been closed, this
-                       should be FALSE when it gets to Curl_ftp_quit() */
-  BIT(cwddone);     /* if it has been determined that the proper CWD combo
-                       already has been done */
-  BIT(cwdfail);     /* set TRUE if a CWD command fails, as then we must prevent
-                       caching the current directory */
-  BIT(wait_data_conn); /* this is set TRUE if data connection is waited */
-};
+#endif /* CURL_DISABLE_FTP */
 
 #define DEFAULT_ACCEPT_TIMEOUT   60000 /* milliseconds == one minute */
 
diff --git a/third-party/curl/lib/ftplistparser.c b/third-party/curl/lib/ftplistparser.c
index 226d9bc033..23fbd1f07c 100644
--- a/third-party/curl/lib/ftplistparser.c
+++ b/third-party/curl/lib/ftplistparser.c
@@ -21,6 +21,9 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "curl_setup.h"
+
+#ifndef CURL_DISABLE_FTP
 
 /**
  * Now implemented:
@@ -37,26 +40,15 @@
  * 01-29-97 11:32PM <DIR> prog
  */
 
-#include "curl_setup.h"
-
-#ifndef CURL_DISABLE_FTP
-
-#include <curl/curl.h>
-
 #include "urldata.h"
 #include "fileinfo.h"
 #include "llist.h"
-#include "strtoofft.h"
 #include "ftp.h"
+#include "ftp-int.h"
 #include "ftplistparser.h"
 #include "curl_fnmatch.h"
-#include "curl_memory.h"
 #include "multiif.h"
-/* The last #include file should be: */
-#include "memdebug.h"
-
-/* allocs buffer which will contain one line of LIST command response */
-#define FTP_BUFFER_ALLOCSIZE 160
+#include "curlx/strparse.h"
 
 typedef enum {
   PL_UNIX_TOTALSIZE = 0,
@@ -187,12 +179,10 @@ static void fileinfo_dtor(void *user, void *element)
   Curl_fileinfo_cleanup(element);
 }
 
-CURLcode Curl_wildcard_init(struct WildcardData *wc)
+void Curl_wildcard_init(struct WildcardData *wc)
 {
   Curl_llist_init(&wc->filelist, fileinfo_dtor);
   wc->state = CURLWC_INIT;
-
-  return CURLE_OK;
 }
 
 void Curl_wildcard_dtor(struct WildcardData **wcp)
@@ -206,40 +196,35 @@ void Curl_wildcard_dtor(struct WildcardData **wcp)
     wc->dtor = ZERO_NULL;
     wc->ftpwc = NULL;
   }
-  DEBUGASSERT(wc->ftpwc == NULL);
+  DEBUGASSERT(!wc->ftpwc);
 
   Curl_llist_destroy(&wc->filelist, NULL);
-  free(wc->path);
-  wc->path = NULL;
-  free(wc->pattern);
-  wc->pattern = NULL;
+  curlx_safefree(wc->path);
+  curlx_safefree(wc->pattern);
   wc->state = CURLWC_INIT;
-  free(wc);
+  curlx_free(wc);
   *wcp = NULL;
 }
 
 struct ftp_parselist_data *Curl_ftp_parselist_data_alloc(void)
 {
-  return calloc(1, sizeof(struct ftp_parselist_data));
+  return curlx_calloc(1, sizeof(struct ftp_parselist_data));
 }
 
-
 void Curl_ftp_parselist_data_free(struct ftp_parselist_data **parserp)
 {
   struct ftp_parselist_data *parser = *parserp;
   if(parser)
     Curl_fileinfo_cleanup(parser->file_data);
-  free(parser);
+  curlx_free(parser);
   *parserp = NULL;
 }
 
-
 CURLcode Curl_ftp_parselist_geterror(struct ftp_parselist_data *pl_data)
 {
   return pl_data->error;
 }
 
-
 #define FTP_LP_MALFORMATED_PERM 0x01000000
 
 static unsigned int ftp_pl_get_permission(const char *str)
@@ -292,7 +277,7 @@ static unsigned int ftp_pl_get_permission(const char *str)
   if(str[7] == 'w')
     permissions |= 1 << 1;
   else if(str[7] != '-')
-      permissions |= FTP_LP_MALFORMATED_PERM;
+    permissions |= FTP_LP_MALFORMATED_PERM;
   if(str[8] == 'x')
     permissions |= 1;
   else if(str[8] == 't') {
@@ -319,14 +304,15 @@ static CURLcode ftp_pl_insert_finfo(struct Curl_easy *data,
   struct curl_fileinfo *finfo = &infop->info;
 
   /* set the finfo pointers */
-  char *str = Curl_dyn_ptr(&infop->buf);
+  char *str = curlx_dyn_ptr(&infop->buf);
   finfo->filename       = str + parser->offsets.filename;
   finfo->strings.group  = parser->offsets.group ?
                           str + parser->offsets.group : NULL;
   finfo->strings.perm   = parser->offsets.perm ?
                           str + parser->offsets.perm : NULL;
-  finfo->strings.target = parser->offsets.symlink_target ?
-                          str + parser->offsets.symlink_target : NULL;
+  finfo->strings.target = parser->offsets.symlink_target &&
+    (finfo->filetype == CURLFILETYPE_SYMLINK) ?
+    str + parser->offsets.symlink_target : NULL;
   finfo->strings.time   = str + parser->offsets.time;
   finfo->strings.user   = parser->offsets.user ?
                           str + parser->offsets.user : NULL;
@@ -337,9 +323,8 @@ static CURLcode ftp_pl_insert_finfo(struct Curl_easy *data,
     compare = Curl_fnmatch;
 
   /* filter pattern-corresponding filenames */
-  Curl_set_in_callback(data, true);
-  if(compare(data->set.fnmatch_data, wc->pattern,
-             finfo->filename) == 0) {
+  Curl_set_in_callback(data, TRUE);
+  if(compare(data->set.fnmatch_data, wc->pattern, finfo->filename) == 0) {
     /* discard symlink which is containing multiple " -> " */
     if((finfo->filetype == CURLFILETYPE_SYMLINK) && finfo->strings.target &&
        (strstr(finfo->strings.target, " -> "))) {
@@ -349,10 +334,10 @@ static CURLcode ftp_pl_insert_finfo(struct Curl_easy *data,
   else {
     add = FALSE;
   }
-  Curl_set_in_callback(data, false);
+  Curl_set_in_callback(data, FALSE);
 
   if(add) {
-    Curl_llist_insert_next(llist, llist->tail, finfo, &infop->list);
+    Curl_llist_append(llist, finfo, &infop->list);
   }
   else {
     Curl_fileinfo_cleanup(infop);
@@ -364,10 +349,670 @@ static CURLcode ftp_pl_insert_finfo(struct Curl_easy *data,
 
 #define MAX_FTPLIST_BUFFER 10000 /* arbitrarily set */
 
+static CURLcode unix_filetype(const char c, curlfiletype *t)
+{
+  switch(c) {
+  case '-':
+    *t = CURLFILETYPE_FILE;
+    break;
+  case 'd':
+    *t = CURLFILETYPE_DIRECTORY;
+    break;
+  case 'l':
+    *t = CURLFILETYPE_SYMLINK;
+    break;
+  case 'p':
+    *t = CURLFILETYPE_NAMEDPIPE;
+    break;
+  case 's':
+    *t = CURLFILETYPE_SOCKET;
+    break;
+  case 'c':
+    *t = CURLFILETYPE_DEVICE_CHAR;
+    break;
+  case 'b':
+    *t = CURLFILETYPE_DEVICE_BLOCK;
+    break;
+  case 'D':
+    *t = CURLFILETYPE_DOOR;
+    break;
+  default:
+    return CURLE_FTP_BAD_FILE_LIST;
+  }
+  return CURLE_OK;
+}
+
+static CURLcode parse_unix_totalsize(struct ftp_parselist_data *parser,
+                                     struct fileinfo *infop,
+                                     const char c)
+{
+  size_t len = curlx_dyn_len(&infop->buf);
+  char *mem = curlx_dyn_ptr(&infop->buf);
+  switch(parser->state.UNIX.sub.total_dirsize) {
+  case PL_UNIX_TOTALSIZE_INIT:
+    if(c == 't') {
+      parser->state.UNIX.sub.total_dirsize = PL_UNIX_TOTALSIZE_READING;
+      parser->item_length++;
+    }
+    else {
+      parser->state.UNIX.main = PL_UNIX_FILETYPE;
+      /* continue to fall through */
+    }
+    break;
+  case PL_UNIX_TOTALSIZE_READING:
+    parser->item_length++;
+    if(c == '\r') {
+      parser->item_length--;
+      if(len)
+        curlx_dyn_setlen(&infop->buf, --len);
+    }
+    else if(c == '\n') {
+      mem[parser->item_length - 1] = 0;
+      if(!strncmp("total ", mem, 6)) {
+        const char *endptr = mem + 6;
+        /* here we can deal with directory size, pass the leading
+           whitespace and then the digits */
+        curlx_str_passblanks(&endptr);
+        while(ISDIGIT(*endptr))
+          endptr++;
+        if(*endptr) {
+          return CURLE_FTP_BAD_FILE_LIST;
+        }
+        parser->state.UNIX.main = PL_UNIX_FILETYPE;
+        curlx_dyn_reset(&infop->buf);
+      }
+      else
+        return CURLE_FTP_BAD_FILE_LIST;
+    }
+    break;
+  }
+  return CURLE_OK;
+}
+
+static CURLcode parse_unix_permission(struct ftp_parselist_data *parser,
+                                      struct fileinfo *infop,
+                                      const char c)
+{
+  char *mem = curlx_dyn_ptr(&infop->buf);
+  parser->item_length++;
+  if((parser->item_length <= 9) && !strchr("rwx-tTsS", c))
+    return CURLE_FTP_BAD_FILE_LIST;
+
+  else if(parser->item_length == 10) {
+    unsigned int perm;
+    if(c != ' ')
+      return CURLE_FTP_BAD_FILE_LIST;
+
+    mem[10] = 0; /* terminate permissions */
+    perm = ftp_pl_get_permission(mem + parser->item_offset);
+    if(perm & FTP_LP_MALFORMATED_PERM)
+      return CURLE_FTP_BAD_FILE_LIST;
+
+    parser->file_data->info.flags |= CURLFINFOFLAG_KNOWN_PERM;
+    parser->file_data->info.perm = perm;
+    parser->offsets.perm = parser->item_offset;
+
+    parser->item_length = 0;
+    parser->state.UNIX.main = PL_UNIX_HLINKS;
+    parser->state.UNIX.sub.hlinks = PL_UNIX_HLINKS_PRESPACE;
+  }
+  return CURLE_OK;
+}
+
+static CURLcode parse_unix_hlinks(struct ftp_parselist_data *parser,
+                                  struct fileinfo *infop,
+                                  const char c)
+{
+  size_t len = curlx_dyn_len(&infop->buf);
+  char *mem = curlx_dyn_ptr(&infop->buf);
+
+  switch(parser->state.UNIX.sub.hlinks) {
+  case PL_UNIX_HLINKS_PRESPACE:
+    if(c != ' ') {
+      if(ISDIGIT(c) && len) {
+        parser->item_offset = len - 1;
+        parser->item_length = 1;
+        parser->state.UNIX.sub.hlinks = PL_UNIX_HLINKS_NUMBER;
+      }
+      else
+        return CURLE_FTP_BAD_FILE_LIST;
+    }
+    break;
+  case PL_UNIX_HLINKS_NUMBER:
+    parser->item_length++;
+    if(c == ' ') {
+      const char *p = &mem[parser->item_offset];
+      curl_off_t hlinks;
+      mem[parser->item_offset + parser->item_length - 1] = 0;
+
+      if(!curlx_str_number(&p, &hlinks, LONG_MAX)) {
+        parser->file_data->info.flags |= CURLFINFOFLAG_KNOWN_HLINKCOUNT;
+        parser->file_data->info.hardlinks = (long)hlinks;
+      }
+      parser->item_length = 0;
+      parser->item_offset = 0;
+      parser->state.UNIX.main = PL_UNIX_USER;
+      parser->state.UNIX.sub.user = PL_UNIX_USER_PRESPACE;
+    }
+    else if(!ISDIGIT(c))
+      return CURLE_FTP_BAD_FILE_LIST;
+
+    break;
+  }
+  return CURLE_OK;
+}
+
+static CURLcode parse_unix_user(struct ftp_parselist_data *parser,
+                                struct fileinfo *infop,
+                                const char c)
+{
+  size_t len = curlx_dyn_len(&infop->buf);
+  char *mem = curlx_dyn_ptr(&infop->buf);
+  switch(parser->state.UNIX.sub.user) {
+  case PL_UNIX_USER_PRESPACE:
+    if(c != ' ' && len) {
+      parser->item_offset = len - 1;
+      parser->item_length = 1;
+      parser->state.UNIX.sub.user = PL_UNIX_USER_PARSING;
+    }
+    break;
+  case PL_UNIX_USER_PARSING:
+    parser->item_length++;
+    if(c == ' ') {
+      mem[parser->item_offset + parser->item_length - 1] = 0;
+      parser->offsets.user = parser->item_offset;
+      parser->state.UNIX.main = PL_UNIX_GROUP;
+      parser->state.UNIX.sub.group = PL_UNIX_GROUP_PRESPACE;
+      parser->item_offset = 0;
+      parser->item_length = 0;
+    }
+    break;
+  }
+  return CURLE_OK;
+}
+
+static CURLcode parse_unix_group(struct ftp_parselist_data *parser,
+                                 struct fileinfo *infop,
+                                 const char c)
+{
+  size_t len = curlx_dyn_len(&infop->buf);
+  char *mem = curlx_dyn_ptr(&infop->buf);
+  switch(parser->state.UNIX.sub.group) {
+  case PL_UNIX_GROUP_PRESPACE:
+    if(c != ' ' && len) {
+      parser->item_offset = len - 1;
+      parser->item_length = 1;
+      parser->state.UNIX.sub.group = PL_UNIX_GROUP_NAME;
+    }
+    break;
+  case PL_UNIX_GROUP_NAME:
+    parser->item_length++;
+    if(c == ' ') {
+      mem[parser->item_offset + parser->item_length - 1] = 0;
+      parser->offsets.group = parser->item_offset;
+      parser->state.UNIX.main = PL_UNIX_SIZE;
+      parser->state.UNIX.sub.size = PL_UNIX_SIZE_PRESPACE;
+      parser->item_offset = 0;
+      parser->item_length = 0;
+    }
+    break;
+  }
+  return CURLE_OK;
+}
+
+static CURLcode parse_unix_size(struct ftp_parselist_data *parser,
+                                struct fileinfo *infop,
+                                const char c)
+{
+  size_t len = curlx_dyn_len(&infop->buf);
+  char *mem = curlx_dyn_ptr(&infop->buf);
+  switch(parser->state.UNIX.sub.size) {
+  case PL_UNIX_SIZE_PRESPACE:
+    if(c != ' ') {
+      if(ISDIGIT(c) && len) {
+        parser->item_offset = len - 1;
+        parser->item_length = 1;
+        parser->state.UNIX.sub.size = PL_UNIX_SIZE_NUMBER;
+      }
+      else
+        return CURLE_FTP_BAD_FILE_LIST;
+    }
+    break;
+  case PL_UNIX_SIZE_NUMBER:
+    parser->item_length++;
+    if(c == ' ') {
+      const char *p = mem + parser->item_offset;
+      curl_off_t fsize;
+      mem[parser->item_offset + parser->item_length - 1] = 0;
+      if(!curlx_str_numblanks(&p, &fsize)) {
+        if(p[0] == '\0' && fsize != CURL_OFF_T_MAX) {
+          parser->file_data->info.flags |= CURLFINFOFLAG_KNOWN_SIZE;
+          parser->file_data->info.size = fsize;
+        }
+        parser->item_length = 0;
+        parser->item_offset = 0;
+        parser->state.UNIX.main = PL_UNIX_TIME;
+        parser->state.UNIX.sub.time = PL_UNIX_TIME_PREPART1;
+      }
+    }
+    else if(!ISDIGIT(c))
+      return CURLE_FTP_BAD_FILE_LIST;
+
+    break;
+  }
+  return CURLE_OK;
+}
+
+static CURLcode parse_unix_time(struct ftp_parselist_data *parser,
+                                struct fileinfo *infop,
+                                const char c)
+{
+  size_t len = curlx_dyn_len(&infop->buf);
+  char *mem = curlx_dyn_ptr(&infop->buf);
+  struct curl_fileinfo *finfo = &infop->info;
+
+  switch(parser->state.UNIX.sub.time) {
+  case PL_UNIX_TIME_PREPART1:
+    if(c != ' ') {
+      if(ISALNUM(c) && len) {
+        parser->item_offset = len - 1;
+        parser->item_length = 1;
+        parser->state.UNIX.sub.time = PL_UNIX_TIME_PART1;
+      }
+      else
+        return CURLE_FTP_BAD_FILE_LIST;
+    }
+    break;
+  case PL_UNIX_TIME_PART1:
+    parser->item_length++;
+    if(c == ' ')
+      parser->state.UNIX.sub.time = PL_UNIX_TIME_PREPART2;
+
+    else if(!ISALNUM(c) && c != '.')
+      return CURLE_FTP_BAD_FILE_LIST;
+
+    break;
+  case PL_UNIX_TIME_PREPART2:
+    parser->item_length++;
+    if(c != ' ') {
+      if(ISALNUM(c))
+        parser->state.UNIX.sub.time = PL_UNIX_TIME_PART2;
+      else
+        return CURLE_FTP_BAD_FILE_LIST;
+    }
+    break;
+  case PL_UNIX_TIME_PART2:
+    parser->item_length++;
+    if(c == ' ')
+      parser->state.UNIX.sub.time = PL_UNIX_TIME_PREPART3;
+    else if(!ISALNUM(c) && c != '.')
+      return CURLE_FTP_BAD_FILE_LIST;
+    break;
+  case PL_UNIX_TIME_PREPART3:
+    parser->item_length++;
+    if(c != ' ') {
+      if(ISALNUM(c))
+        parser->state.UNIX.sub.time = PL_UNIX_TIME_PART3;
+      else
+        return CURLE_FTP_BAD_FILE_LIST;
+    }
+    break;
+  case PL_UNIX_TIME_PART3:
+    parser->item_length++;
+    if(c == ' ') {
+      mem[parser->item_offset + parser->item_length - 1] = 0;
+      parser->offsets.time = parser->item_offset;
+      if(finfo->filetype == CURLFILETYPE_SYMLINK) {
+        parser->state.UNIX.main = PL_UNIX_SYMLINK;
+        parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_PRESPACE;
+      }
+      else {
+        parser->state.UNIX.main = PL_UNIX_FILENAME;
+        parser->state.UNIX.sub.filename = PL_UNIX_FILENAME_PRESPACE;
+      }
+    }
+    else if(!ISALNUM(c) && c != '.' && c != ':')
+      return CURLE_FTP_BAD_FILE_LIST;
+    break;
+  }
+  return CURLE_OK;
+}
+
+static CURLcode parse_unix_filename(struct Curl_easy *data,
+                                    struct ftp_parselist_data *parser,
+                                    struct fileinfo *infop,
+                                    const char c)
+{
+  size_t len = curlx_dyn_len(&infop->buf);
+  char *mem = curlx_dyn_ptr(&infop->buf);
+  CURLcode result = CURLE_OK;
+
+  switch(parser->state.UNIX.sub.filename) {
+  case PL_UNIX_FILENAME_PRESPACE:
+    if(c != ' ' && len) {
+      parser->item_offset = len - 1;
+      parser->item_length = 1;
+      parser->state.UNIX.sub.filename = PL_UNIX_FILENAME_NAME;
+    }
+    break;
+  case PL_UNIX_FILENAME_NAME:
+    parser->item_length++;
+    if(c == '\r')
+      parser->state.UNIX.sub.filename = PL_UNIX_FILENAME_WINDOWSEOL;
+
+    else if(c == '\n') {
+      mem[parser->item_offset + parser->item_length - 1] = 0;
+      parser->offsets.filename = parser->item_offset;
+      parser->state.UNIX.main = PL_UNIX_FILETYPE;
+      result = ftp_pl_insert_finfo(data, infop);
+    }
+    break;
+  case PL_UNIX_FILENAME_WINDOWSEOL:
+    if(c == '\n') {
+      mem[parser->item_offset + parser->item_length - 1] = 0;
+      parser->offsets.filename = parser->item_offset;
+      parser->state.UNIX.main = PL_UNIX_FILETYPE;
+      result = ftp_pl_insert_finfo(data, infop);
+    }
+    else
+      result = CURLE_FTP_BAD_FILE_LIST;
+    break;
+  }
+  return result;
+}
+
+static CURLcode parse_unix_symlink(struct Curl_easy *data,
+                                   struct ftp_parselist_data *parser,
+                                   struct fileinfo *infop,
+                                   const char c)
+{
+  size_t len = curlx_dyn_len(&infop->buf);
+  char *mem = curlx_dyn_ptr(&infop->buf);
+  CURLcode result = CURLE_OK;
+
+  switch(parser->state.UNIX.sub.symlink) {
+  case PL_UNIX_SYMLINK_PRESPACE:
+    if(c != ' ' && len) {
+      parser->item_offset = len - 1;
+      parser->item_length = 1;
+      parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_NAME;
+    }
+    break;
+  case PL_UNIX_SYMLINK_NAME:
+    parser->item_length++;
+    if(c == ' ')
+      parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_PRETARGET1;
+
+    else if(c == '\r' || c == '\n')
+      return CURLE_FTP_BAD_FILE_LIST;
+
+    break;
+  case PL_UNIX_SYMLINK_PRETARGET1:
+    parser->item_length++;
+    if(c == '-')
+      parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_PRETARGET2;
+
+    else if(c == '\r' || c == '\n')
+      return CURLE_FTP_BAD_FILE_LIST;
+    else
+      parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_NAME;
+    break;
+  case PL_UNIX_SYMLINK_PRETARGET2:
+    parser->item_length++;
+    if(c == '>')
+      parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_PRETARGET3;
+    else if(c == '\r' || c == '\n')
+      return CURLE_FTP_BAD_FILE_LIST;
+    else
+      parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_NAME;
+
+    break;
+  case PL_UNIX_SYMLINK_PRETARGET3:
+    parser->item_length++;
+    if(c == ' ') {
+      parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_PRETARGET4;
+      /* now place where is symlink following */
+      mem[parser->item_offset + parser->item_length - 4] = 0;
+      parser->offsets.filename = parser->item_offset;
+      parser->item_length = 0;
+      parser->item_offset = 0;
+    }
+    else if(c == '\r' || c == '\n')
+      return CURLE_FTP_BAD_FILE_LIST;
+    else
+      parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_NAME;
+    break;
+  case PL_UNIX_SYMLINK_PRETARGET4:
+    if(c != '\r' && c != '\n' && len) {
+      parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_TARGET;
+      parser->item_offset = len - 1;
+      parser->item_length = 1;
+    }
+    else
+      return CURLE_FTP_BAD_FILE_LIST;
+
+    break;
+  case PL_UNIX_SYMLINK_TARGET:
+    parser->item_length++;
+    if(c == '\r')
+      parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_WINDOWSEOL;
+
+    else if(c == '\n') {
+      mem[parser->item_offset + parser->item_length - 1] = 0;
+      parser->offsets.symlink_target = parser->item_offset;
+      result = ftp_pl_insert_finfo(data, infop);
+      if(result)
+        break;
+
+      parser->state.UNIX.main = PL_UNIX_FILETYPE;
+    }
+    break;
+  case PL_UNIX_SYMLINK_WINDOWSEOL:
+    if(c == '\n') {
+      mem[parser->item_offset + parser->item_length - 1] = 0;
+      parser->offsets.symlink_target = parser->item_offset;
+      result = ftp_pl_insert_finfo(data, infop);
+      if(result)
+        break;
+
+      parser->state.UNIX.main = PL_UNIX_FILETYPE;
+    }
+    else
+      result = CURLE_FTP_BAD_FILE_LIST;
+
+    break;
+  }
+  return result;
+}
+
+static CURLcode parse_unix(struct Curl_easy *data,
+                           struct ftp_parselist_data *parser,
+                           struct fileinfo *infop,
+                           const char c)
+{
+  struct curl_fileinfo *finfo = &infop->info;
+  CURLcode result = CURLE_OK;
+
+  switch(parser->state.UNIX.main) {
+  case PL_UNIX_TOTALSIZE:
+    result = parse_unix_totalsize(parser, infop, c);
+    if(result)
+      break;
+    if(parser->state.UNIX.main != PL_UNIX_FILETYPE)
+      break;
+    FALLTHROUGH();
+  case PL_UNIX_FILETYPE:
+    result = unix_filetype(c, &finfo->filetype);
+    if(!result) {
+      parser->state.UNIX.main = PL_UNIX_PERMISSION;
+      parser->item_length = 0;
+      parser->item_offset = 1;
+    }
+    break;
+  case PL_UNIX_PERMISSION:
+    result = parse_unix_permission(parser, infop, c);
+    break;
+  case PL_UNIX_HLINKS:
+    result = parse_unix_hlinks(parser, infop, c);
+    break;
+  case PL_UNIX_USER:
+    result = parse_unix_user(parser, infop, c);
+    break;
+  case PL_UNIX_GROUP:
+    result = parse_unix_group(parser, infop, c);
+    break;
+  case PL_UNIX_SIZE:
+    result = parse_unix_size(parser, infop, c);
+    break;
+  case PL_UNIX_TIME:
+    result = parse_unix_time(parser, infop, c);
+    break;
+  case PL_UNIX_FILENAME:
+    result = parse_unix_filename(data, parser, infop, c);
+    break;
+  case PL_UNIX_SYMLINK:
+    result = parse_unix_symlink(data, parser, infop, c);
+    break;
+  }
+  return result;
+}
+
+static CURLcode parse_winnt(struct Curl_easy *data,
+                            struct ftp_parselist_data *parser,
+                            struct fileinfo *infop,
+                            const char c)
+{
+  struct curl_fileinfo *finfo = &infop->info;
+  size_t len = curlx_dyn_len(&infop->buf);
+  char *mem = curlx_dyn_ptr(&infop->buf);
+  CURLcode result = CURLE_OK;
+
+  switch(parser->state.NT.main) {
+  case PL_WINNT_DATE:
+    parser->item_length++;
+    if(parser->item_length < 9) {
+      if(!strchr("0123456789-", c)) { /* only simple control */
+        return CURLE_FTP_BAD_FILE_LIST;
+      }
+    }
+    else if(parser->item_length == 9) {
+      if(c == ' ') {
+        parser->state.NT.main = PL_WINNT_TIME;
+        parser->state.NT.sub.time = PL_WINNT_TIME_PRESPACE;
+      }
+      else
+        return CURLE_FTP_BAD_FILE_LIST;
+    }
+    else
+      return CURLE_FTP_BAD_FILE_LIST;
+    break;
+  case PL_WINNT_TIME:
+    parser->item_length++;
+    switch(parser->state.NT.sub.time) {
+    case PL_WINNT_TIME_PRESPACE:
+      if(!ISBLANK(c))
+        parser->state.NT.sub.time = PL_WINNT_TIME_TIME;
+      break;
+    case PL_WINNT_TIME_TIME:
+      if(c == ' ') {
+        parser->offsets.time = parser->item_offset;
+        mem[parser->item_offset + parser->item_length - 1] = 0;
+        parser->state.NT.main = PL_WINNT_DIRORSIZE;
+        parser->state.NT.sub.dirorsize = PL_WINNT_DIRORSIZE_PRESPACE;
+        parser->item_length = 0;
+      }
+      else if(!strchr("APM0123456789:", c))
+        return CURLE_FTP_BAD_FILE_LIST;
+      break;
+    }
+    break;
+  case PL_WINNT_DIRORSIZE:
+    switch(parser->state.NT.sub.dirorsize) {
+    case PL_WINNT_DIRORSIZE_PRESPACE:
+      if(c != ' ' && len) {
+        parser->item_offset = len - 1;
+        parser->item_length = 1;
+        parser->state.NT.sub.dirorsize = PL_WINNT_DIRORSIZE_CONTENT;
+      }
+      break;
+    case PL_WINNT_DIRORSIZE_CONTENT:
+      parser->item_length++;
+      if(c == ' ') {
+        mem[parser->item_offset + parser->item_length - 1] = 0;
+        if(!strcmp("<DIR>", mem + parser->item_offset)) {
+          finfo->filetype = CURLFILETYPE_DIRECTORY;
+          finfo->size = 0;
+        }
+        else {
+          const char *p = mem + parser->item_offset;
+          if(curlx_str_numblanks(&p, &finfo->size)) {
+            return CURLE_FTP_BAD_FILE_LIST;
+          }
+          /* correct file type */
+          parser->file_data->info.filetype = CURLFILETYPE_FILE;
+        }
+
+        parser->file_data->info.flags |= CURLFINFOFLAG_KNOWN_SIZE;
+        parser->item_length = 0;
+        parser->state.NT.main = PL_WINNT_FILENAME;
+        parser->state.NT.sub.filename = PL_WINNT_FILENAME_PRESPACE;
+      }
+      break;
+    }
+    break;
+  case PL_WINNT_FILENAME:
+    switch(parser->state.NT.sub.filename) {
+    case PL_WINNT_FILENAME_PRESPACE:
+      if(c != ' ' && len) {
+        parser->item_offset = len - 1;
+        parser->item_length = 1;
+        parser->state.NT.sub.filename = PL_WINNT_FILENAME_CONTENT;
+      }
+      break;
+    case PL_WINNT_FILENAME_CONTENT:
+      parser->item_length++;
+      if(!len)
+        return CURLE_FTP_BAD_FILE_LIST;
+      if(c == '\r') {
+        parser->state.NT.sub.filename = PL_WINNT_FILENAME_WINEOL;
+        mem[len - 1] = 0;
+      }
+      else if(c == '\n') {
+        parser->offsets.filename = parser->item_offset;
+        mem[len - 1] = 0;
+        result = ftp_pl_insert_finfo(data, infop);
+        if(result)
+          return result;
+
+        parser->state.NT.main = PL_WINNT_DATE;
+        parser->state.NT.sub.filename = PL_WINNT_FILENAME_PRESPACE;
+      }
+      break;
+    case PL_WINNT_FILENAME_WINEOL:
+      if(c == '\n') {
+        parser->offsets.filename = parser->item_offset;
+        result = ftp_pl_insert_finfo(data, infop);
+        if(result)
+          return result;
+
+        parser->state.NT.main = PL_WINNT_DATE;
+        parser->state.NT.sub.filename = PL_WINNT_FILENAME_PRESPACE;
+      }
+      else
+        return CURLE_FTP_BAD_FILE_LIST;
+
+      break;
+    }
+    break;
+  }
+
+  return CURLE_OK;
+}
+
 size_t Curl_ftp_parselist(char *buffer, size_t size, size_t nmemb,
                           void *connptr)
 {
-  size_t bufflen = size*nmemb;
+  size_t bufflen = size * nmemb;
   struct Curl_easy *data = (struct Curl_easy *)connptr;
   struct ftp_wc *ftpwc = data->wildcard->ftpwc;
   struct ftp_parselist_data *parser = ftpwc->parser;
@@ -379,7 +1024,7 @@ size_t Curl_ftp_parselist(char *buffer, size_t size, size_t nmemb,
     /* scenario:
      * 1. call => OK..
      * 2. call => OUT_OF_MEMORY (or other error)
-     * 3. (last) call => is skipped RIGHT HERE and the error is hadled later
+     * 3. (last) call => is skipped RIGHT HERE and the error is handled later
      *    in wc_statemach()
      */
     goto fail;
@@ -391,11 +1036,8 @@ size_t Curl_ftp_parselist(char *buffer, size_t size, size_t nmemb,
   }
 
   while(i < bufflen) { /* FSM */
-    char *mem;
-    size_t len; /* number of bytes of data in the dynbuf */
     char c = buffer[i];
     struct fileinfo *infop;
-    struct curl_fileinfo *finfo;
     if(!parser->file_data) { /* tmp file data is not allocated yet */
       parser->file_data = Curl_fileinfo_alloc();
       if(!parser->file_data) {
@@ -404,627 +1046,31 @@ size_t Curl_ftp_parselist(char *buffer, size_t size, size_t nmemb,
       }
       parser->item_offset = 0;
       parser->item_length = 0;
-      Curl_dyn_init(&parser->file_data->buf, MAX_FTPLIST_BUFFER);
+      curlx_dyn_init(&parser->file_data->buf, MAX_FTPLIST_BUFFER);
     }
 
     infop = parser->file_data;
-    finfo = &infop->info;
 
-    if(Curl_dyn_addn(&infop->buf, &c, 1)) {
+    if(curlx_dyn_addn(&infop->buf, &c, 1)) {
       parser->error = CURLE_OUT_OF_MEMORY;
       goto fail;
     }
-    len = Curl_dyn_len(&infop->buf);
-    mem = Curl_dyn_ptr(&infop->buf);
 
     switch(parser->os_type) {
     case OS_TYPE_UNIX:
-      switch(parser->state.UNIX.main) {
-      case PL_UNIX_TOTALSIZE:
-        switch(parser->state.UNIX.sub.total_dirsize) {
-        case PL_UNIX_TOTALSIZE_INIT:
-          if(c == 't') {
-            parser->state.UNIX.sub.total_dirsize = PL_UNIX_TOTALSIZE_READING;
-            parser->item_length++;
-          }
-          else {
-            parser->state.UNIX.main = PL_UNIX_FILETYPE;
-            /* start FSM again not considering size of directory */
-            Curl_dyn_reset(&infop->buf);
-            continue;
-          }
-          break;
-        case PL_UNIX_TOTALSIZE_READING:
-          parser->item_length++;
-          if(c == '\r') {
-            parser->item_length--;
-            Curl_dyn_setlen(&infop->buf, --len);
-          }
-          else if(c == '\n') {
-            mem[parser->item_length - 1] = 0;
-            if(!strncmp("total ", mem, 6)) {
-              char *endptr = mem + 6;
-              /* here we can deal with directory size, pass the leading
-                 whitespace and then the digits */
-              while(ISBLANK(*endptr))
-                endptr++;
-              while(ISDIGIT(*endptr))
-                endptr++;
-              if(*endptr) {
-                parser->error = CURLE_FTP_BAD_FILE_LIST;
-                goto fail;
-              }
-              parser->state.UNIX.main = PL_UNIX_FILETYPE;
-              Curl_dyn_reset(&infop->buf);
-            }
-            else {
-              parser->error = CURLE_FTP_BAD_FILE_LIST;
-              goto fail;
-            }
-          }
-          break;
-        }
-        break;
-      case PL_UNIX_FILETYPE:
-        switch(c) {
-        case '-':
-          finfo->filetype = CURLFILETYPE_FILE;
-          break;
-        case 'd':
-          finfo->filetype = CURLFILETYPE_DIRECTORY;
-          break;
-        case 'l':
-          finfo->filetype = CURLFILETYPE_SYMLINK;
-          break;
-        case 'p':
-          finfo->filetype = CURLFILETYPE_NAMEDPIPE;
-          break;
-        case 's':
-          finfo->filetype = CURLFILETYPE_SOCKET;
-          break;
-        case 'c':
-          finfo->filetype = CURLFILETYPE_DEVICE_CHAR;
-          break;
-        case 'b':
-          finfo->filetype = CURLFILETYPE_DEVICE_BLOCK;
-          break;
-        case 'D':
-          finfo->filetype = CURLFILETYPE_DOOR;
-          break;
-        default:
-          parser->error = CURLE_FTP_BAD_FILE_LIST;
-          goto fail;
-        }
-        parser->state.UNIX.main = PL_UNIX_PERMISSION;
-        parser->item_length = 0;
-        parser->item_offset = 1;
-        break;
-      case PL_UNIX_PERMISSION:
-        parser->item_length++;
-        if(parser->item_length <= 9) {
-          if(!strchr("rwx-tTsS", c)) {
-            parser->error = CURLE_FTP_BAD_FILE_LIST;
-            goto fail;
-          }
-        }
-        else if(parser->item_length == 10) {
-          unsigned int perm;
-          if(c != ' ') {
-            parser->error = CURLE_FTP_BAD_FILE_LIST;
-            goto fail;
-          }
-          mem[10] = 0; /* terminate permissions */
-          perm = ftp_pl_get_permission(mem + parser->item_offset);
-          if(perm & FTP_LP_MALFORMATED_PERM) {
-            parser->error = CURLE_FTP_BAD_FILE_LIST;
-            goto fail;
-          }
-          parser->file_data->info.flags |= CURLFINFOFLAG_KNOWN_PERM;
-          parser->file_data->info.perm = perm;
-          parser->offsets.perm = parser->item_offset;
-
-          parser->item_length = 0;
-          parser->state.UNIX.main = PL_UNIX_HLINKS;
-          parser->state.UNIX.sub.hlinks = PL_UNIX_HLINKS_PRESPACE;
-        }
-        break;
-      case PL_UNIX_HLINKS:
-        switch(parser->state.UNIX.sub.hlinks) {
-        case PL_UNIX_HLINKS_PRESPACE:
-          if(c != ' ') {
-            if(ISDIGIT(c)) {
-              parser->item_offset = len - 1;
-              parser->item_length = 1;
-              parser->state.UNIX.sub.hlinks = PL_UNIX_HLINKS_NUMBER;
-            }
-            else {
-              parser->error = CURLE_FTP_BAD_FILE_LIST;
-              goto fail;
-            }
-          }
-          break;
-        case PL_UNIX_HLINKS_NUMBER:
-          parser->item_length ++;
-          if(c == ' ') {
-            char *p;
-            long int hlinks;
-            mem[parser->item_offset + parser->item_length - 1] = 0;
-            hlinks = strtol(mem + parser->item_offset, &p, 10);
-            if(p[0] == '\0' && hlinks != LONG_MAX && hlinks != LONG_MIN) {
-              parser->file_data->info.flags |= CURLFINFOFLAG_KNOWN_HLINKCOUNT;
-              parser->file_data->info.hardlinks = hlinks;
-            }
-            parser->item_length = 0;
-            parser->item_offset = 0;
-            parser->state.UNIX.main = PL_UNIX_USER;
-            parser->state.UNIX.sub.user = PL_UNIX_USER_PRESPACE;
-          }
-          else if(!ISDIGIT(c)) {
-            parser->error = CURLE_FTP_BAD_FILE_LIST;
-            goto fail;
-          }
-          break;
-        }
-        break;
-      case PL_UNIX_USER:
-        switch(parser->state.UNIX.sub.user) {
-        case PL_UNIX_USER_PRESPACE:
-          if(c != ' ') {
-            parser->item_offset = len - 1;
-            parser->item_length = 1;
-            parser->state.UNIX.sub.user = PL_UNIX_USER_PARSING;
-          }
-          break;
-        case PL_UNIX_USER_PARSING:
-          parser->item_length++;
-          if(c == ' ') {
-            mem[parser->item_offset + parser->item_length - 1] = 0;
-            parser->offsets.user = parser->item_offset;
-            parser->state.UNIX.main = PL_UNIX_GROUP;
-            parser->state.UNIX.sub.group = PL_UNIX_GROUP_PRESPACE;
-            parser->item_offset = 0;
-            parser->item_length = 0;
-          }
-          break;
-        }
-        break;
-      case PL_UNIX_GROUP:
-        switch(parser->state.UNIX.sub.group) {
-        case PL_UNIX_GROUP_PRESPACE:
-          if(c != ' ') {
-            parser->item_offset = len - 1;
-            parser->item_length = 1;
-            parser->state.UNIX.sub.group = PL_UNIX_GROUP_NAME;
-          }
-          break;
-        case PL_UNIX_GROUP_NAME:
-          parser->item_length++;
-          if(c == ' ') {
-            mem[parser->item_offset + parser->item_length - 1] = 0;
-            parser->offsets.group = parser->item_offset;
-            parser->state.UNIX.main = PL_UNIX_SIZE;
-            parser->state.UNIX.sub.size = PL_UNIX_SIZE_PRESPACE;
-            parser->item_offset = 0;
-            parser->item_length = 0;
-          }
-          break;
-        }
-        break;
-      case PL_UNIX_SIZE:
-        switch(parser->state.UNIX.sub.size) {
-        case PL_UNIX_SIZE_PRESPACE:
-          if(c != ' ') {
-            if(ISDIGIT(c)) {
-              parser->item_offset = len - 1;
-              parser->item_length = 1;
-              parser->state.UNIX.sub.size = PL_UNIX_SIZE_NUMBER;
-            }
-            else {
-              parser->error = CURLE_FTP_BAD_FILE_LIST;
-              goto fail;
-            }
-          }
-          break;
-        case PL_UNIX_SIZE_NUMBER:
-          parser->item_length++;
-          if(c == ' ') {
-            char *p;
-            curl_off_t fsize;
-            mem[parser->item_offset + parser->item_length - 1] = 0;
-            if(!curlx_strtoofft(mem + parser->item_offset,
-                                &p, 10, &fsize)) {
-              if(p[0] == '\0' && fsize != CURL_OFF_T_MAX &&
-                 fsize != CURL_OFF_T_MIN) {
-                parser->file_data->info.flags |= CURLFINFOFLAG_KNOWN_SIZE;
-                parser->file_data->info.size = fsize;
-              }
-              parser->item_length = 0;
-              parser->item_offset = 0;
-              parser->state.UNIX.main = PL_UNIX_TIME;
-              parser->state.UNIX.sub.time = PL_UNIX_TIME_PREPART1;
-            }
-          }
-          else if(!ISDIGIT(c)) {
-            parser->error = CURLE_FTP_BAD_FILE_LIST;
-            goto fail;
-          }
-          break;
-        }
-        break;
-      case PL_UNIX_TIME:
-        switch(parser->state.UNIX.sub.time) {
-        case PL_UNIX_TIME_PREPART1:
-          if(c != ' ') {
-            if(ISALNUM(c)) {
-              parser->item_offset = len -1;
-              parser->item_length = 1;
-              parser->state.UNIX.sub.time = PL_UNIX_TIME_PART1;
-            }
-            else {
-              parser->error = CURLE_FTP_BAD_FILE_LIST;
-              goto fail;
-            }
-          }
-          break;
-        case PL_UNIX_TIME_PART1:
-          parser->item_length++;
-          if(c == ' ') {
-            parser->state.UNIX.sub.time = PL_UNIX_TIME_PREPART2;
-          }
-          else if(!ISALNUM(c) && c != '.') {
-            parser->error = CURLE_FTP_BAD_FILE_LIST;
-            goto fail;
-          }
-          break;
-        case PL_UNIX_TIME_PREPART2:
-          parser->item_length++;
-          if(c != ' ') {
-            if(ISALNUM(c)) {
-              parser->state.UNIX.sub.time = PL_UNIX_TIME_PART2;
-            }
-            else {
-              parser->error = CURLE_FTP_BAD_FILE_LIST;
-              goto fail;
-            }
-          }
-          break;
-        case PL_UNIX_TIME_PART2:
-          parser->item_length++;
-          if(c == ' ') {
-            parser->state.UNIX.sub.time = PL_UNIX_TIME_PREPART3;
-          }
-          else if(!ISALNUM(c) && c != '.') {
-            parser->error = CURLE_FTP_BAD_FILE_LIST;
-            goto fail;
-          }
-          break;
-        case PL_UNIX_TIME_PREPART3:
-          parser->item_length++;
-          if(c != ' ') {
-            if(ISALNUM(c)) {
-              parser->state.UNIX.sub.time = PL_UNIX_TIME_PART3;
-            }
-            else {
-              parser->error = CURLE_FTP_BAD_FILE_LIST;
-              goto fail;
-            }
-          }
-          break;
-        case PL_UNIX_TIME_PART3:
-          parser->item_length++;
-          if(c == ' ') {
-            mem[parser->item_offset + parser->item_length -1] = 0;
-            parser->offsets.time = parser->item_offset;
-            /*
-              if(ftp_pl_gettime(parser, finfo->mem + parser->item_offset)) {
-                parser->file_data->flags |= CURLFINFOFLAG_KNOWN_TIME;
-              }
-            */
-            if(finfo->filetype == CURLFILETYPE_SYMLINK) {
-              parser->state.UNIX.main = PL_UNIX_SYMLINK;
-              parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_PRESPACE;
-            }
-            else {
-              parser->state.UNIX.main = PL_UNIX_FILENAME;
-              parser->state.UNIX.sub.filename = PL_UNIX_FILENAME_PRESPACE;
-            }
-          }
-          else if(!ISALNUM(c) && c != '.' && c != ':') {
-            parser->error = CURLE_FTP_BAD_FILE_LIST;
-            goto fail;
-          }
-          break;
-        }
-        break;
-      case PL_UNIX_FILENAME:
-        switch(parser->state.UNIX.sub.filename) {
-        case PL_UNIX_FILENAME_PRESPACE:
-          if(c != ' ') {
-            parser->item_offset = len - 1;
-            parser->item_length = 1;
-            parser->state.UNIX.sub.filename = PL_UNIX_FILENAME_NAME;
-          }
-          break;
-        case PL_UNIX_FILENAME_NAME:
-          parser->item_length++;
-          if(c == '\r') {
-            parser->state.UNIX.sub.filename = PL_UNIX_FILENAME_WINDOWSEOL;
-          }
-          else if(c == '\n') {
-            mem[parser->item_offset + parser->item_length - 1] = 0;
-            parser->offsets.filename = parser->item_offset;
-            parser->state.UNIX.main = PL_UNIX_FILETYPE;
-            result = ftp_pl_insert_finfo(data, infop);
-            if(result) {
-              parser->error = result;
-              goto fail;
-            }
-          }
-          break;
-        case PL_UNIX_FILENAME_WINDOWSEOL:
-          if(c == '\n') {
-            mem[parser->item_offset + parser->item_length - 1] = 0;
-            parser->offsets.filename = parser->item_offset;
-            parser->state.UNIX.main = PL_UNIX_FILETYPE;
-            result = ftp_pl_insert_finfo(data, infop);
-            if(result) {
-              parser->error = result;
-              goto fail;
-            }
-          }
-          else {
-            parser->error = CURLE_FTP_BAD_FILE_LIST;
-            goto fail;
-          }
-          break;
-        }
-        break;
-      case PL_UNIX_SYMLINK:
-        switch(parser->state.UNIX.sub.symlink) {
-        case PL_UNIX_SYMLINK_PRESPACE:
-          if(c != ' ') {
-            parser->item_offset = len - 1;
-            parser->item_length = 1;
-            parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_NAME;
-          }
-          break;
-        case PL_UNIX_SYMLINK_NAME:
-          parser->item_length++;
-          if(c == ' ') {
-            parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_PRETARGET1;
-          }
-          else if(c == '\r' || c == '\n') {
-            parser->error = CURLE_FTP_BAD_FILE_LIST;
-            goto fail;
-          }
-          break;
-        case PL_UNIX_SYMLINK_PRETARGET1:
-          parser->item_length++;
-          if(c == '-') {
-            parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_PRETARGET2;
-          }
-          else if(c == '\r' || c == '\n') {
-            parser->error = CURLE_FTP_BAD_FILE_LIST;
-            goto fail;
-          }
-          else {
-            parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_NAME;
-          }
-          break;
-        case PL_UNIX_SYMLINK_PRETARGET2:
-          parser->item_length++;
-          if(c == '>') {
-            parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_PRETARGET3;
-          }
-          else if(c == '\r' || c == '\n') {
-            parser->error = CURLE_FTP_BAD_FILE_LIST;
-            goto fail;
-          }
-          else {
-            parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_NAME;
-          }
-          break;
-        case PL_UNIX_SYMLINK_PRETARGET3:
-          parser->item_length++;
-          if(c == ' ') {
-            parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_PRETARGET4;
-            /* now place where is symlink following */
-            mem[parser->item_offset + parser->item_length - 4] = 0;
-            parser->offsets.filename = parser->item_offset;
-            parser->item_length = 0;
-            parser->item_offset = 0;
-          }
-          else if(c == '\r' || c == '\n') {
-            parser->error = CURLE_FTP_BAD_FILE_LIST;
-            goto fail;
-          }
-          else {
-            parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_NAME;
-          }
-          break;
-        case PL_UNIX_SYMLINK_PRETARGET4:
-          if(c != '\r' && c != '\n') {
-            parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_TARGET;
-            parser->item_offset = len - 1;
-            parser->item_length = 1;
-          }
-          else {
-            parser->error = CURLE_FTP_BAD_FILE_LIST;
-            goto fail;
-          }
-          break;
-        case PL_UNIX_SYMLINK_TARGET:
-          parser->item_length++;
-          if(c == '\r') {
-            parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_WINDOWSEOL;
-          }
-          else if(c == '\n') {
-            mem[parser->item_offset + parser->item_length - 1] = 0;
-            parser->offsets.symlink_target = parser->item_offset;
-            result = ftp_pl_insert_finfo(data, infop);
-            if(result) {
-              parser->error = result;
-              goto fail;
-            }
-            parser->state.UNIX.main = PL_UNIX_FILETYPE;
-          }
-          break;
-        case PL_UNIX_SYMLINK_WINDOWSEOL:
-          if(c == '\n') {
-            mem[parser->item_offset + parser->item_length - 1] = 0;
-            parser->offsets.symlink_target = parser->item_offset;
-            result = ftp_pl_insert_finfo(data, infop);
-            if(result) {
-              parser->error = result;
-              goto fail;
-            }
-            parser->state.UNIX.main = PL_UNIX_FILETYPE;
-          }
-          else {
-            parser->error = CURLE_FTP_BAD_FILE_LIST;
-            goto fail;
-          }
-          break;
-        }
-        break;
-      }
+      result = parse_unix(data, parser, infop, c);
       break;
     case OS_TYPE_WIN_NT:
-      switch(parser->state.NT.main) {
-      case PL_WINNT_DATE:
-        parser->item_length++;
-        if(parser->item_length < 9) {
-          if(!strchr("0123456789-", c)) { /* only simple control */
-            parser->error = CURLE_FTP_BAD_FILE_LIST;
-            goto fail;
-          }
-        }
-        else if(parser->item_length == 9) {
-          if(c == ' ') {
-            parser->state.NT.main = PL_WINNT_TIME;
-            parser->state.NT.sub.time = PL_WINNT_TIME_PRESPACE;
-          }
-          else {
-            parser->error = CURLE_FTP_BAD_FILE_LIST;
-            goto fail;
-          }
-        }
-        else {
-          parser->error = CURLE_FTP_BAD_FILE_LIST;
-          goto fail;
-        }
-        break;
-      case PL_WINNT_TIME:
-        parser->item_length++;
-        switch(parser->state.NT.sub.time) {
-        case PL_WINNT_TIME_PRESPACE:
-          if(!ISBLANK(c)) {
-            parser->state.NT.sub.time = PL_WINNT_TIME_TIME;
-          }
-          break;
-        case PL_WINNT_TIME_TIME:
-          if(c == ' ') {
-            parser->offsets.time = parser->item_offset;
-            mem[parser->item_offset + parser->item_length -1] = 0;
-            parser->state.NT.main = PL_WINNT_DIRORSIZE;
-            parser->state.NT.sub.dirorsize = PL_WINNT_DIRORSIZE_PRESPACE;
-            parser->item_length = 0;
-          }
-          else if(!strchr("APM0123456789:", c)) {
-            parser->error = CURLE_FTP_BAD_FILE_LIST;
-            goto fail;
-          }
-          break;
-        }
-        break;
-      case PL_WINNT_DIRORSIZE:
-        switch(parser->state.NT.sub.dirorsize) {
-        case PL_WINNT_DIRORSIZE_PRESPACE:
-          if(c != ' ') {
-            parser->item_offset = len - 1;
-            parser->item_length = 1;
-            parser->state.NT.sub.dirorsize = PL_WINNT_DIRORSIZE_CONTENT;
-          }
-          break;
-        case PL_WINNT_DIRORSIZE_CONTENT:
-          parser->item_length ++;
-          if(c == ' ') {
-            mem[parser->item_offset + parser->item_length - 1] = 0;
-            if(strcmp("<DIR>", mem + parser->item_offset) == 0) {
-              finfo->filetype = CURLFILETYPE_DIRECTORY;
-              finfo->size = 0;
-            }
-            else {
-              char *endptr;
-              if(curlx_strtoofft(mem +
-                                 parser->item_offset,
-                                 &endptr, 10, &finfo->size)) {
-                parser->error = CURLE_FTP_BAD_FILE_LIST;
-                goto fail;
-              }
-              /* correct file type */
-              parser->file_data->info.filetype = CURLFILETYPE_FILE;
-            }
-
-            parser->file_data->info.flags |= CURLFINFOFLAG_KNOWN_SIZE;
-            parser->item_length = 0;
-            parser->state.NT.main = PL_WINNT_FILENAME;
-            parser->state.NT.sub.filename = PL_WINNT_FILENAME_PRESPACE;
-          }
-          break;
-        }
-        break;
-      case PL_WINNT_FILENAME:
-        switch(parser->state.NT.sub.filename) {
-        case PL_WINNT_FILENAME_PRESPACE:
-          if(c != ' ') {
-            parser->item_offset = len -1;
-            parser->item_length = 1;
-            parser->state.NT.sub.filename = PL_WINNT_FILENAME_CONTENT;
-          }
-          break;
-        case PL_WINNT_FILENAME_CONTENT:
-          parser->item_length++;
-          if(c == '\r') {
-            parser->state.NT.sub.filename = PL_WINNT_FILENAME_WINEOL;
-            mem[len - 1] = 0;
-          }
-          else if(c == '\n') {
-            parser->offsets.filename = parser->item_offset;
-            mem[len - 1] = 0;
-            result = ftp_pl_insert_finfo(data, infop);
-            if(result) {
-              parser->error = result;
-              goto fail;
-            }
-            parser->state.NT.main = PL_WINNT_DATE;
-            parser->state.NT.sub.filename = PL_WINNT_FILENAME_PRESPACE;
-          }
-          break;
-        case PL_WINNT_FILENAME_WINEOL:
-          if(c == '\n') {
-            parser->offsets.filename = parser->item_offset;
-            result = ftp_pl_insert_finfo(data, infop);
-            if(result) {
-              parser->error = result;
-              goto fail;
-            }
-            parser->state.NT.main = PL_WINNT_DATE;
-            parser->state.NT.sub.filename = PL_WINNT_FILENAME_PRESPACE;
-          }
-          else {
-            parser->error = CURLE_FTP_BAD_FILE_LIST;
-            goto fail;
-          }
-          break;
-        }
-        break;
-      }
+      result = parse_winnt(data, parser, infop, c);
       break;
     default:
       retsize = bufflen + 1;
       goto fail;
     }
+    if(result) {
+      parser->error = result;
+      goto fail;
+    }
 
     i++;
   }
@@ -1041,4 +1087,4 @@ fail:
   return retsize;
 }
 
-#endif /* CURL_DISABLE_FTP */
+#endif /* !CURL_DISABLE_FTP */
diff --git a/third-party/curl/lib/ftplistparser.h b/third-party/curl/lib/ftplistparser.h
index 5ba1f6a97d..5d7aa492ba 100644
--- a/third-party/curl/lib/ftplistparser.h
+++ b/third-party/curl/lib/ftplistparser.h
@@ -37,7 +37,7 @@ CURLcode Curl_ftp_parselist_geterror(struct ftp_parselist_data *pl_data);
 
 struct ftp_parselist_data *Curl_ftp_parselist_data_alloc(void);
 
-void Curl_ftp_parselist_data_free(struct ftp_parselist_data **pl_data);
+void Curl_ftp_parselist_data_free(struct ftp_parselist_data **parserp);
 
 /* list of wildcard process states */
 typedef enum {
@@ -65,13 +65,13 @@ struct WildcardData {
   unsigned char state; /* wildcard_states */
 };
 
-CURLcode Curl_wildcard_init(struct WildcardData *wc);
+void Curl_wildcard_init(struct WildcardData *wc);
 void Curl_wildcard_dtor(struct WildcardData **wcp);
 
 struct Curl_easy;
 
-#else
-/* FTP is disabled */
+#else /* CURL_DISABLE_FTP */
 #define Curl_wildcard_dtor(x)
-#endif /* CURL_DISABLE_FTP */
+#endif /* !CURL_DISABLE_FTP */
+
 #endif /* HEADER_CURL_FTPLISTPARSER_H */
diff --git a/third-party/curl/lib/functypes.h b/third-party/curl/lib/functypes.h
index 075c02e54f..3938295dd1 100644
--- a/third-party/curl/lib/functypes.h
+++ b/third-party/curl/lib/functypes.h
@@ -23,9 +23,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
-#include "curl_setup.h"
-
 /* defaults:
 
    ssize_t recv(int, void *, size_t, int);
@@ -38,7 +35,7 @@
    2. For systems with config-*.h files, define them there.
 */
 
-#ifdef WIN32
+#ifdef USE_WINSOCK
 /* int recv(SOCKET, char *, int, int) */
 #define RECV_TYPE_ARG1 SOCKET
 #define RECV_TYPE_ARG2 char *
@@ -51,7 +48,7 @@
 #define SEND_TYPE_ARG3 int
 #define SEND_TYPE_RETV int
 
-#elif defined(__AMIGA__) /* Any AmigaOS flavour */
+#elif defined(__AMIGA__) /* Any AmigaOS flavor */
 
 /* long recv(long, char *, long, long); */
 #define RECV_TYPE_ARG1 long
@@ -60,14 +57,14 @@
 #define RECV_TYPE_ARG4 long
 #define RECV_TYPE_RETV long
 
-/* int send(int, const char *, int, int); */
+/* int send(int, char *, int, int); */
 #define SEND_TYPE_ARG1 int
+#define SEND_NONCONST_ARG2
 #define SEND_TYPE_ARG2 char *
 #define SEND_TYPE_ARG3 int
 #define SEND_TYPE_RETV int
 #endif
 
-
 #ifndef RECV_TYPE_ARG1
 #define RECV_TYPE_ARG1 int
 #endif
@@ -88,10 +85,6 @@
 #define RECV_TYPE_RETV ssize_t
 #endif
 
-#ifndef SEND_QUAL_ARG2
-#define SEND_QUAL_ARG2 const
-#endif
-
 #ifndef SEND_TYPE_ARG1
 #define SEND_TYPE_ARG1 int
 #endif
diff --git a/third-party/curl/lib/getenv.c b/third-party/curl/lib/getenv.c
index 8069784728..a957e6e801 100644
--- a/third-party/curl/lib/getenv.c
+++ b/third-party/curl/lib/getenv.c
@@ -21,22 +21,17 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include <curl/curl.h>
-#include "curl_memory.h"
-
-#include "memdebug.h"
-
-static char *GetEnv(const char *variable)
+char *curl_getenv(const char *variable)
 {
-#if defined(_WIN32_WCE) || defined(CURL_WINDOWS_APP)
+#if defined(CURL_WINDOWS_UWP) || \
+  defined(__ORBIS__) || defined(__PROSPERO__) /* PlayStation 4 and 5 */
   (void)variable;
   return NULL;
-#elif defined(WIN32)
+#elif defined(_WIN32)
   /* This uses Windows API instead of C runtime getenv() to get the environment
-     variable since some changes aren't always visible to the latter. #4774 */
+     variable since some changes are not always visible to the latter. #4774 */
   char *buf = NULL;
   char *tmp;
   DWORD bufsize;
@@ -44,20 +39,20 @@ static char *GetEnv(const char *variable)
   const DWORD max = 32768; /* max env var size from MSCRT source */
 
   for(;;) {
-    tmp = realloc(buf, rc);
+    tmp = curlx_realloc(buf, rc);
     if(!tmp) {
-      free(buf);
+      curlx_free(buf);
       return NULL;
     }
 
     buf = tmp;
     bufsize = rc;
 
-    /* It's possible for rc to be 0 if the variable was found but empty.
-       Since getenv doesn't make that distinction we ignore it as well. */
+    /* it is possible for rc to be 0 if the variable was found but empty.
+       Since getenv does not make that distinction we ignore it as well. */
     rc = GetEnvironmentVariableA(variable, buf, bufsize);
     if(!rc || rc == bufsize || rc > max) {
-      free(buf);
+      curlx_free(buf);
       return NULL;
     }
 
@@ -69,11 +64,6 @@ static char *GetEnv(const char *variable)
   }
 #else
   char *env = getenv(variable);
-  return (env && env[0])?strdup(env):NULL;
+  return (env && env[0]) ? curlx_strdup(env) : NULL;
 #endif
 }
-
-char *curl_getenv(const char *v)
-{
-  return GetEnv(v);
-}
diff --git a/third-party/curl/lib/getinfo.c b/third-party/curl/lib/getinfo.c
index f1574e097b..fde4aa4ef2 100644
--- a/third-party/curl/lib/getinfo.c
+++ b/third-party/curl/lib/getinfo.c
@@ -21,21 +21,15 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include <curl/curl.h>
-
 #include "urldata.h"
 #include "getinfo.h"
-
+#include "cfilters.h"
 #include "vtls/vtls.h"
 #include "connect.h" /* Curl_getconnectinfo() */
-#include "progress.h"
-
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "bufref.h"
+#include "curlx/strparse.h"
 
 /*
  * Initialize statistical and informational data.
@@ -44,7 +38,7 @@
  * beginning of a perform session. It must reset the session-info variables,
  * in particular all variables in struct PureInfo.
  */
-CURLcode Curl_initinfo(struct Curl_easy *data)
+void Curl_initinfo(struct Curl_easy *data)
 {
   struct Progress *pro = &data->progress;
   struct PureInfo *info = &data->info;
@@ -53,10 +47,11 @@ CURLcode Curl_initinfo(struct Curl_easy *data)
   pro->t_connect = 0;
   pro->t_appconnect = 0;
   pro->t_pretransfer = 0;
+  pro->t_posttransfer = 0;
   pro->t_starttransfer = 0;
   pro->timespent = 0;
   pro->t_redirect = 0;
-  pro->is_t_startransfer_set = false;
+  pro->is_t_startransfer_set = FALSE;
 
   info->httpcode = 0;
   info->httpproxycode = 0;
@@ -68,35 +63,33 @@ CURLcode Curl_initinfo(struct Curl_easy *data)
   info->request_size = 0;
   info->proxyauthavail = 0;
   info->httpauthavail = 0;
+  info->proxyauthpicked = 0;
+  info->httpauthpicked = 0;
   info->numconnects = 0;
 
-  free(info->contenttype);
-  info->contenttype = NULL;
+  curlx_safefree(info->contenttype);
+  curlx_safefree(info->wouldredirect);
 
-  free(info->wouldredirect);
-  info->wouldredirect = NULL;
-
-  info->conn_primary_ip[0] = '\0';
-  info->conn_local_ip[0] = '\0';
-  info->conn_primary_port = 0;
-  info->conn_local_port = 0;
+  memset(&info->primary, 0, sizeof(info->primary));
   info->retry_after = 0;
 
   info->conn_scheme = 0;
   info->conn_protocol = 0;
+  info->used_proxy = 0;
 
 #ifdef USE_SSL
   Curl_ssl_free_certinfo(data);
 #endif
-  return CURLE_OK;
 }
 
 static CURLcode getinfo_char(struct Curl_easy *data, CURLINFO info,
                              const char **param_charp)
 {
   switch(info) {
-  case CURLINFO_EFFECTIVE_URL:
-    *param_charp = data->state.url?data->state.url:(char *)"";
+  case CURLINFO_EFFECTIVE_URL: {
+    const char *s = Curl_bufref_ptr(&data->state.url);
+    *param_charp = s ? s : "";
+  }
     break;
   case CURLINFO_EFFECTIVE_METHOD: {
     const char *m = data->set.str[STRING_CUSTOMREQUEST];
@@ -132,12 +125,12 @@ static CURLcode getinfo_char(struct Curl_easy *data, CURLINFO info,
     *param_charp = data->info.contenttype;
     break;
   case CURLINFO_PRIVATE:
-    *param_charp = (char *) data->set.private_data;
+    *param_charp = (const char *)data->set.private_data;
     break;
   case CURLINFO_FTP_ENTRY_PATH:
     /* Return the entrypath string from the most recent connection.
        This pointer was copied from the connectdata structure by FTP.
-       The actual string may be free()ed by subsequent libcurl calls so
+       The actual string may be freed by subsequent libcurl calls so
        it must be copied to a safer area before the next libcurl call.
        Callers must never free it themselves. */
     *param_charp = data->state.most_recent_ftp_entrypath;
@@ -149,19 +142,23 @@ static CURLcode getinfo_char(struct Curl_easy *data, CURLINFO info,
     break;
   case CURLINFO_REFERER:
     /* Return the referrer header for this request, or NULL if unset */
-    *param_charp = data->state.referer;
+    *param_charp = Curl_bufref_ptr(&data->state.referer);
     break;
   case CURLINFO_PRIMARY_IP:
     /* Return the ip address of the most recent (primary) connection */
-    *param_charp = data->info.conn_primary_ip;
+    *param_charp = data->info.primary.remote_ip;
     break;
   case CURLINFO_LOCAL_IP:
     /* Return the source/local ip address of the most recent (primary)
        connection */
-    *param_charp = data->info.conn_local_ip;
+    *param_charp = data->info.primary.local_ip;
     break;
   case CURLINFO_RTSP_SESSION_ID:
+#ifndef CURL_DISABLE_RTSP
     *param_charp = data->set.str[STRING_RTSP_SESSION_ID];
+#else
+    *param_charp = NULL;
+#endif
     break;
   case CURLINFO_SCHEME:
     *param_charp = data->info.conn_scheme;
@@ -180,7 +177,6 @@ static CURLcode getinfo_char(struct Curl_easy *data, CURLINFO info,
     *param_charp = NULL;
 #endif
     break;
-
   default:
     return CURLE_UNKNOWN_OPTION;
   }
@@ -199,29 +195,31 @@ static CURLcode getinfo_long(struct Curl_easy *data, CURLINFO info,
   } lptr;
 
 #ifdef DEBUGBUILD
-  char *timestr = getenv("CURL_TIME");
-  if(timestr) {
-    unsigned long val = strtol(timestr, NULL, 10);
-    switch(info) {
-    case CURLINFO_LOCAL_PORT:
-      *param_longp = (long)val;
-      return CURLE_OK;
-    default:
-      break;
-    }
-  }
+  const char *envstr;
+
   /* use another variable for this to allow different values */
-  timestr = getenv("CURL_DEBUG_SIZE");
-  if(timestr) {
-    unsigned long val = strtol(timestr, NULL, 10);
-    switch(info) {
-    case CURLINFO_HEADER_SIZE:
-    case CURLINFO_REQUEST_SIZE:
+  switch(info) {
+  case CURLINFO_LOCAL_PORT:
+    envstr = getenv("CURL_TIME");
+    if(envstr) {
+      curl_off_t val;
+      curlx_str_number(&envstr, &val, TIME_T_MAX);
       *param_longp = (long)val;
       return CURLE_OK;
-    default:
-      break;
     }
+    break;
+  case CURLINFO_HEADER_SIZE:
+  case CURLINFO_REQUEST_SIZE:
+    envstr = getenv("CURL_DEBUG_SIZE");
+    if(envstr) {
+      curl_off_t val;
+      curlx_str_number(&envstr, &val, LONG_MAX);
+      *param_longp = (long)val;
+      return CURLE_OK;
+    }
+    break;
+  default:
+    break;
   }
 #endif
 
@@ -235,8 +233,10 @@ static CURLcode getinfo_long(struct Curl_easy *data, CURLINFO info,
   case CURLINFO_FILETIME:
     if(data->info.filetime > LONG_MAX)
       *param_longp = LONG_MAX;
+#if !defined(MSDOS) && !defined(__AMIGA__)
     else if(data->info.filetime < LONG_MIN)
       *param_longp = LONG_MIN;
+#endif
     else
       *param_longp = (long)data->info.filetime;
     break;
@@ -249,11 +249,13 @@ static CURLcode getinfo_long(struct Curl_easy *data, CURLINFO info,
   case CURLINFO_SSL_VERIFYRESULT:
     *param_longp = data->set.ssl.certverifyresult;
     break;
-#ifndef CURL_DISABLE_PROXY
   case CURLINFO_PROXY_SSL_VERIFYRESULT:
+#ifndef CURL_DISABLE_PROXY
     *param_longp = data->set.proxy_ssl.certverifyresult;
-    break;
+#else
+    *param_longp = 0;
 #endif
+    break;
   case CURLINFO_REDIRECT_COUNT:
     *param_longp = data->state.followlocation;
     break;
@@ -265,17 +267,30 @@ static CURLcode getinfo_long(struct Curl_easy *data, CURLINFO info,
     lptr.to_long = param_longp;
     *lptr.to_ulong = data->info.proxyauthavail;
     break;
+  case CURLINFO_HTTPAUTH_USED:
+    lptr.to_long = param_longp;
+    *lptr.to_ulong = data->info.httpauthpicked;
+    break;
+  case CURLINFO_PROXYAUTH_USED:
+    lptr.to_long = param_longp;
+    *lptr.to_ulong = data->info.proxyauthpicked;
+    break;
   case CURLINFO_OS_ERRNO:
     *param_longp = data->state.os_errno;
     break;
   case CURLINFO_NUM_CONNECTS:
-    *param_longp = data->info.numconnects;
+#if SIZEOF_LONG < SIZEOF_CURL_OFF_T
+    if(data->info.numconnects > LONG_MAX)
+      *param_longp = LONG_MAX;
+    else
+#endif
+      *param_longp = (long)data->info.numconnects;
     break;
   case CURLINFO_LASTSOCKET:
     sockfd = Curl_getconnectinfo(data, NULL);
 
-    /* note: this is not a good conversion for systems with 64 bit sockets and
-       32 bit longs */
+    /* note: this is not a good conversion for systems with 64-bit sockets and
+       32-bit longs */
     if(sockfd != CURL_SOCKET_BAD)
       *param_longp = (long)sockfd;
     else
@@ -285,11 +300,17 @@ static CURLcode getinfo_long(struct Curl_easy *data, CURLINFO info,
     break;
   case CURLINFO_PRIMARY_PORT:
     /* Return the (remote) port of the most recent (primary) connection */
-    *param_longp = data->info.conn_primary_port;
+    if(CUR_IP_QUAD_HAS_PORTS(&data->info.primary))
+      *param_longp = data->info.primary.remote_port;
+    else
+      *param_longp = -1;
     break;
   case CURLINFO_LOCAL_PORT:
     /* Return the local port of the most recent (primary) connection */
-    *param_longp = data->info.conn_local_port;
+    if(CUR_IP_QUAD_HAS_PORTS(&data->info.primary))
+      *param_longp = data->info.primary.local_port;
+    else
+      *param_longp = -1;
     break;
   case CURLINFO_PROXY_ERROR:
     *param_longp = (long)data->info.pxcode;
@@ -311,6 +332,12 @@ static CURLcode getinfo_long(struct Curl_easy *data, CURLINFO info,
   case CURLINFO_RTSP_CSEQ_RECV:
     *param_longp = data->state.rtsp_CSeq_recv;
     break;
+#else
+  case CURLINFO_RTSP_CLIENT_CSEQ:
+  case CURLINFO_RTSP_SERVER_CSEQ:
+  case CURLINFO_RTSP_CSEQ_RECV:
+    *param_longp = 0;
+    break;
 #endif
   case CURLINFO_HTTP_VERSION:
     switch(data->info.httpversion) {
@@ -332,7 +359,16 @@ static CURLcode getinfo_long(struct Curl_easy *data, CURLINFO info,
     }
     break;
   case CURLINFO_PROTOCOL:
-    *param_longp = data->info.conn_protocol;
+    *param_longp = (long)data->info.conn_protocol;
+    break;
+  case CURLINFO_USED_PROXY:
+    *param_longp =
+#ifdef CURL_DISABLE_PROXY
+      0
+#else
+      data->info.used_proxy
+#endif
+      ;
     break;
   default:
     return CURLE_UNKNOWN_OPTION;
@@ -341,55 +377,63 @@ static CURLcode getinfo_long(struct Curl_easy *data, CURLINFO info,
   return CURLE_OK;
 }
 
-#define DOUBLE_SECS(x) (double)(x)/1000000
+#define DOUBLE_SECS(x) ((double)(x) / 1000000)
 
 static CURLcode getinfo_offt(struct Curl_easy *data, CURLINFO info,
                              curl_off_t *param_offt)
 {
 #ifdef DEBUGBUILD
-  char *timestr = getenv("CURL_TIME");
-  if(timestr) {
-    unsigned long val = strtol(timestr, NULL, 10);
-    switch(info) {
-    case CURLINFO_TOTAL_TIME_T:
-    case CURLINFO_NAMELOOKUP_TIME_T:
-    case CURLINFO_CONNECT_TIME_T:
-    case CURLINFO_APPCONNECT_TIME_T:
-    case CURLINFO_PRETRANSFER_TIME_T:
-    case CURLINFO_STARTTRANSFER_TIME_T:
-    case CURLINFO_REDIRECT_TIME_T:
-    case CURLINFO_SPEED_DOWNLOAD_T:
-    case CURLINFO_SPEED_UPLOAD_T:
+  const char *envstr;
+  switch(info) {
+  case CURLINFO_TOTAL_TIME_T:
+  case CURLINFO_NAMELOOKUP_TIME_T:
+  case CURLINFO_CONNECT_TIME_T:
+  case CURLINFO_APPCONNECT_TIME_T:
+  case CURLINFO_PRETRANSFER_TIME_T:
+  case CURLINFO_POSTTRANSFER_TIME_T:
+  case CURLINFO_QUEUE_TIME_T:
+  case CURLINFO_STARTTRANSFER_TIME_T:
+  case CURLINFO_REDIRECT_TIME_T:
+  case CURLINFO_SPEED_DOWNLOAD_T:
+  case CURLINFO_SPEED_UPLOAD_T:
+    envstr = getenv("CURL_TIME");
+    if(envstr) {
+      curl_off_t val;
+      curlx_str_number(&envstr, &val, CURL_OFF_T_MAX);
       *param_offt = (curl_off_t)val;
       return CURLE_OK;
-    default:
-      break;
     }
+    break;
+  default:
+    break;
   }
 #endif
   switch(info) {
   case CURLINFO_FILETIME_T:
     *param_offt = (curl_off_t)data->info.filetime;
     break;
+  case CURLINFO_SIZE_DELIVERED:
+    *param_offt = data->progress.deliver;
+    break;
   case CURLINFO_SIZE_UPLOAD_T:
-    *param_offt = data->progress.uploaded;
+    *param_offt = data->progress.ul.cur_size;
     break;
   case CURLINFO_SIZE_DOWNLOAD_T:
-    *param_offt = data->progress.downloaded;
+    *param_offt = data->progress.dl.cur_size;
     break;
   case CURLINFO_SPEED_DOWNLOAD_T:
-    *param_offt = data->progress.dlspeed;
+    *param_offt = data->progress.dl.speed;
     break;
   case CURLINFO_SPEED_UPLOAD_T:
-    *param_offt = data->progress.ulspeed;
+    *param_offt = data->progress.ul.speed;
     break;
   case CURLINFO_CONTENT_LENGTH_DOWNLOAD_T:
-    *param_offt = (data->progress.flags & PGRS_DL_SIZE_KNOWN)?
-      data->progress.size_dl:-1;
+    *param_offt = data->progress.dl_size_known ?
+      data->progress.dl.total_size : -1;
     break;
   case CURLINFO_CONTENT_LENGTH_UPLOAD_T:
-    *param_offt = (data->progress.flags & PGRS_UL_SIZE_KNOWN)?
-      data->progress.size_ul:-1;
+    *param_offt = data->progress.ul_size_known ?
+      data->progress.ul.total_size : -1;
     break;
    case CURLINFO_TOTAL_TIME_T:
     *param_offt = data->progress.timespent;
@@ -406,9 +450,15 @@ static CURLcode getinfo_offt(struct Curl_easy *data, CURLINFO info,
   case CURLINFO_PRETRANSFER_TIME_T:
     *param_offt = data->progress.t_pretransfer;
     break;
+  case CURLINFO_POSTTRANSFER_TIME_T:
+    *param_offt = data->progress.t_posttransfer;
+    break;
   case CURLINFO_STARTTRANSFER_TIME_T:
     *param_offt = data->progress.t_starttransfer;
     break;
+  case CURLINFO_QUEUE_TIME_T:
+    *param_offt = data->progress.t_postqueue;
+    break;
   case CURLINFO_REDIRECT_TIME_T:
     *param_offt = data->progress.t_redirect;
     break;
@@ -419,8 +469,11 @@ static CURLcode getinfo_offt(struct Curl_easy *data, CURLINFO info,
     *param_offt = data->id;
     break;
   case CURLINFO_CONN_ID:
-    *param_offt = data->conn?
-                  data->conn->connection_id : data->state.recent_conn_id;
+    *param_offt = data->conn ?
+      data->conn->connection_id : data->state.recent_conn_id;
+    break;
+  case CURLINFO_EARLYDATA_SENT_T:
+    *param_offt = data->progress.earlydata_sent;
     break;
   default:
     return CURLE_UNKNOWN_OPTION;
@@ -433,24 +486,28 @@ static CURLcode getinfo_double(struct Curl_easy *data, CURLINFO info,
                                double *param_doublep)
 {
 #ifdef DEBUGBUILD
-  char *timestr = getenv("CURL_TIME");
-  if(timestr) {
-    unsigned long val = strtol(timestr, NULL, 10);
-    switch(info) {
-    case CURLINFO_TOTAL_TIME:
-    case CURLINFO_NAMELOOKUP_TIME:
-    case CURLINFO_CONNECT_TIME:
-    case CURLINFO_APPCONNECT_TIME:
-    case CURLINFO_PRETRANSFER_TIME:
-    case CURLINFO_STARTTRANSFER_TIME:
-    case CURLINFO_REDIRECT_TIME:
-    case CURLINFO_SPEED_DOWNLOAD:
-    case CURLINFO_SPEED_UPLOAD:
+  const char *envstr;
+
+  switch(info) {
+  case CURLINFO_TOTAL_TIME:
+  case CURLINFO_NAMELOOKUP_TIME:
+  case CURLINFO_CONNECT_TIME:
+  case CURLINFO_APPCONNECT_TIME:
+  case CURLINFO_PRETRANSFER_TIME:
+  case CURLINFO_STARTTRANSFER_TIME:
+  case CURLINFO_REDIRECT_TIME:
+  case CURLINFO_SPEED_DOWNLOAD:
+  case CURLINFO_SPEED_UPLOAD:
+    envstr = getenv("CURL_TIME");
+    if(envstr) {
+      curl_off_t val;
+      curlx_str_number(&envstr, &val, CURL_OFF_T_MAX);
       *param_doublep = (double)val;
       return CURLE_OK;
-    default:
-      break;
     }
+    break;
+  default:
+    break;
   }
 #endif
   switch(info) {
@@ -473,24 +530,24 @@ static CURLcode getinfo_double(struct Curl_easy *data, CURLINFO info,
     *param_doublep = DOUBLE_SECS(data->progress.t_starttransfer);
     break;
   case CURLINFO_SIZE_UPLOAD:
-    *param_doublep = (double)data->progress.uploaded;
+    *param_doublep = (double)data->progress.ul.cur_size;
     break;
   case CURLINFO_SIZE_DOWNLOAD:
-    *param_doublep = (double)data->progress.downloaded;
+    *param_doublep = (double)data->progress.dl.cur_size;
     break;
   case CURLINFO_SPEED_DOWNLOAD:
-    *param_doublep = (double)data->progress.dlspeed;
+    *param_doublep = (double)data->progress.dl.speed;
     break;
   case CURLINFO_SPEED_UPLOAD:
-    *param_doublep = (double)data->progress.ulspeed;
+    *param_doublep = (double)data->progress.ul.speed;
     break;
   case CURLINFO_CONTENT_LENGTH_DOWNLOAD:
-    *param_doublep = (data->progress.flags & PGRS_DL_SIZE_KNOWN)?
-      (double)data->progress.size_dl:-1;
+    *param_doublep = data->progress.dl_size_known ?
+      (double)data->progress.dl.total_size : -1;
     break;
   case CURLINFO_CONTENT_LENGTH_UPLOAD:
-    *param_doublep = (data->progress.flags & PGRS_UL_SIZE_KNOWN)?
-      (double)data->progress.size_ul:-1;
+    *param_doublep = data->progress.ul_size_known ?
+      (double)data->progress.ul.total_size : -1;
     break;
   case CURLINFO_REDIRECT_TIME:
     *param_doublep = DOUBLE_SECS(data->progress.t_redirect);
@@ -525,25 +582,21 @@ static CURLcode getinfo_slist(struct Curl_easy *data, CURLINFO info,
     *param_slistp = ptr.to_slist;
     break;
   case CURLINFO_TLS_SESSION:
-  case CURLINFO_TLS_SSL_PTR:
-    {
-      struct curl_tlssessioninfo **tsip = (struct curl_tlssessioninfo **)
-                                          param_slistp;
-      struct curl_tlssessioninfo *tsi = &data->tsi;
-#ifdef USE_SSL
-      struct connectdata *conn = data->conn;
-#endif
+  case CURLINFO_TLS_SSL_PTR: {
+    int query = (info == CURLINFO_TLS_SSL_PTR) ?
+      CF_QUERY_SSL_INFO : CF_QUERY_SSL_CTX_INFO;
+    struct curl_tlssessioninfo **tsip = (struct curl_tlssessioninfo **)
+      param_slistp;
+    struct curl_tlssessioninfo *tsi = &data->tsi;
 
-      *tsip = tsi;
+    /* we are exposing a pointer to internal memory with unknown
+     * lifetime here. */
+    *tsip = tsi;
+    if(!Curl_conn_get_ssl_info(data, data->conn, FIRSTSOCKET, query, tsi)) {
       tsi->backend = Curl_ssl_backend();
       tsi->internals = NULL;
-
-#ifdef USE_SSL
-      if(conn && tsi->backend != CURLSSLBACKEND_NONE) {
-        tsi->internals = Curl_ssl_get_internals(data, FIRSTSOCKET, info, 0);
-      }
-#endif
     }
+  }
     break;
   default:
     return CURLE_UNKNOWN_OPTION;
@@ -576,7 +629,7 @@ CURLcode Curl_getinfo(struct Curl_easy *data, CURLINFO info, ...)
   struct curl_slist **param_slistp = NULL;
   curl_socket_t *param_socketp = NULL;
   int type;
-  CURLcode result = CURLE_UNKNOWN_OPTION;
+  CURLcode result = CURLE_BAD_FUNCTION_ARGUMENT;
 
   if(!data)
     return CURLE_BAD_FUNCTION_ARGUMENT;
@@ -616,6 +669,7 @@ CURLcode Curl_getinfo(struct Curl_easy *data, CURLINFO info, ...)
       result = getinfo_socket(data, info, param_socketp);
     break;
   default:
+    result = CURLE_UNKNOWN_OPTION;
     break;
   }
 
diff --git a/third-party/curl/lib/getinfo.h b/third-party/curl/lib/getinfo.h
index 56bb440b43..f5efe4185c 100644
--- a/third-party/curl/lib/getinfo.h
+++ b/third-party/curl/lib/getinfo.h
@@ -24,6 +24,6 @@
  *
  ***************************************************************************/
 CURLcode Curl_getinfo(struct Curl_easy *data, CURLINFO info, ...);
-CURLcode Curl_initinfo(struct Curl_easy *data);
+void Curl_initinfo(struct Curl_easy *data);
 
 #endif /* HEADER_CURL_GETINFO_H */
diff --git a/third-party/curl/lib/gopher.c b/third-party/curl/lib/gopher.c
index 61e41b7e47..039697466b 100644
--- a/third-party/curl/lib/gopher.c
+++ b/third-party/curl/lib/gopher.c
@@ -21,93 +21,22 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+#include "urldata.h"
+#include "gopher.h"
 
 #ifndef CURL_DISABLE_GOPHER
 
-#include "urldata.h"
-#include <curl/curl.h>
 #include "transfer.h"
 #include "sendf.h"
+#include "curl_trc.h"
 #include "cfilters.h"
 #include "connect.h"
-#include "progress.h"
-#include "gopher.h"
 #include "select.h"
-#include "strdup.h"
-#include "vtls/vtls.h"
 #include "url.h"
 #include "escape.h"
-#include "warnless.h"
-#include "curl_printf.h"
-#include "curl_memory.h"
-/* The last #include file should be: */
-#include "memdebug.h"
-
-/*
- * Forward declarations.
- */
-
-static CURLcode gopher_do(struct Curl_easy *data, bool *done);
-#ifdef USE_SSL
-static CURLcode gopher_connect(struct Curl_easy *data, bool *done);
-static CURLcode gopher_connecting(struct Curl_easy *data, bool *done);
-#endif
-
-/*
- * Gopher protocol handler.
- * This is also a nice simple template to build off for simple
- * connect-command-download protocols.
- */
-
-const struct Curl_handler Curl_handler_gopher = {
-  "GOPHER",                             /* scheme */
-  ZERO_NULL,                            /* setup_connection */
-  gopher_do,                            /* do_it */
-  ZERO_NULL,                            /* done */
-  ZERO_NULL,                            /* do_more */
-  ZERO_NULL,                            /* connect_it */
-  ZERO_NULL,                            /* connecting */
-  ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  ZERO_NULL,                            /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_GOPHER,                          /* defport */
-  CURLPROTO_GOPHER,                     /* protocol */
-  CURLPROTO_GOPHER,                     /* family */
-  PROTOPT_NONE                          /* flags */
-};
 
 #ifdef USE_SSL
-const struct Curl_handler Curl_handler_gophers = {
-  "GOPHERS",                            /* scheme */
-  ZERO_NULL,                            /* setup_connection */
-  gopher_do,                            /* do_it */
-  ZERO_NULL,                            /* done */
-  ZERO_NULL,                            /* do_more */
-  gopher_connect,                       /* connect_it */
-  gopher_connecting,                    /* connecting */
-  ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  ZERO_NULL,                            /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_GOPHER,                          /* defport */
-  CURLPROTO_GOPHERS,                    /* protocol */
-  CURLPROTO_GOPHER,                     /* family */
-  PROTOPT_SSL                           /* flags */
-};
-
 static CURLcode gopher_connect(struct Curl_easy *data, bool *done)
 {
   (void)data;
@@ -134,13 +63,12 @@ static CURLcode gopher_do(struct Curl_easy *data, bool *done)
   struct connectdata *conn = data->conn;
   curl_socket_t sockfd = conn->sock[FIRSTSOCKET];
   char *gopherpath;
-  char *path = data->state.up.path;
-  char *query = data->state.up.query;
-  char *sel = NULL;
-  char *sel_org = NULL;
+  const char *path = data->state.up.path;
+  const char *query = data->state.up.query;
+  const char *buf = NULL;
+  char *buf_alloc = NULL;
+  size_t nwritten, buf_len;
   timediff_t timeout_ms;
-  ssize_t amount, k;
-  size_t len;
   int what;
 
   *done = TRUE; /* unconditionally */
@@ -149,57 +77,55 @@ static CURLcode gopher_do(struct Curl_easy *data, bool *done)
   DEBUGASSERT(path);
 
   if(query)
-    gopherpath = aprintf("%s?%s", path, query);
+    gopherpath = curl_maprintf("%s?%s", path, query);
   else
-    gopherpath = strdup(path);
+    gopherpath = curlx_strdup(path);
 
   if(!gopherpath)
     return CURLE_OUT_OF_MEMORY;
 
   /* Create selector. Degenerate cases: / and /1 => convert to "" */
   if(strlen(gopherpath) <= 2) {
-    sel = (char *)"";
-    len = strlen(sel);
-    free(gopherpath);
+    buf = "";
+    buf_len = 0;
+    curlx_free(gopherpath);
   }
   else {
-    char *newp;
+    const char *newp;
 
     /* Otherwise, drop / and the first character (i.e., item type) ... */
     newp = gopherpath;
     newp += 2;
 
     /* ... and finally unescape */
-    result = Curl_urldecode(newp, 0, &sel, &len, REJECT_ZERO);
-    free(gopherpath);
+    result = Curl_urldecode(newp, 0, &buf_alloc, &buf_len, REJECT_ZERO);
+    curlx_free(gopherpath);
     if(result)
       return result;
-    sel_org = sel;
+    buf = buf_alloc;
   }
 
-  k = curlx_uztosz(len);
+  for(; buf_len;) {
 
-  for(;;) {
-    /* Break out of the loop if the selector is empty because OpenSSL and/or
-       LibreSSL fail with errno 0 if this is the case. */
-    if(strlen(sel) < 1)
-      break;
-
-    result = Curl_nwrite(data, FIRSTSOCKET, sel, k, &amount);
+    result = Curl_xfer_send(data, buf, buf_len, FALSE, &nwritten);
     if(!result) { /* Which may not have written it all! */
-      result = Curl_client_write(data, CLIENTWRITE_HEADER, sel, amount);
+      result = Curl_client_write(data, CLIENTWRITE_HEADER, buf, nwritten);
       if(result)
         break;
 
-      k -= amount;
-      sel += amount;
-      if(k < 1)
+      if(nwritten > buf_len) {
+        DEBUGASSERT(0);
+        break;
+      }
+      buf_len -= nwritten;
+      buf += nwritten;
+      if(!buf_len)
         break; /* but it did write it all */
     }
     else
       break;
 
-    timeout_ms = Curl_timeleft(data, NULL, FALSE);
+    timeout_ms = Curl_timeleft_ms(data);
     if(timeout_ms < 0) {
       result = CURLE_OPERATION_TIMEDOUT;
       break;
@@ -207,9 +133,9 @@ static CURLcode gopher_do(struct Curl_easy *data, bool *done)
     if(!timeout_ms)
       timeout_ms = TIMEDIFF_T_MAX;
 
-    /* Don't busyloop. The entire loop thing is a work-around as it causes a
+    /* Do not busyloop. The entire loop thing is a workaround as it causes a
        BLOCKING behavior which is a NO-NO. This function should rather be
-       split up in a do and a doing piece where the pieces that aren't
+       split up in a do and a doing piece where the pieces that are not
        possible to send now will be sent in the doing function repeatedly
        until the entire request is sent.
     */
@@ -224,19 +150,68 @@ static CURLcode gopher_do(struct Curl_easy *data, bool *done)
     }
   }
 
-  free(sel_org);
+  curlx_free(buf_alloc);
 
   if(!result)
-    result = Curl_nwrite(data, FIRSTSOCKET, "\r\n", 2, &amount);
+    result = Curl_xfer_send(data, "\r\n", 2, FALSE, &nwritten);
   if(result) {
     failf(data, "Failed sending Gopher request");
     return result;
   }
-  result = Curl_client_write(data, CLIENTWRITE_HEADER, (char *)"\r\n", 2);
+  result = Curl_client_write(data, CLIENTWRITE_HEADER, "\r\n", 2);
   if(result)
     return result;
 
-  Curl_setup_transfer(data, FIRSTSOCKET, -1, FALSE, -1);
+  Curl_xfer_setup_recv(data, FIRSTSOCKET, -1);
   return CURLE_OK;
 }
+
+/*
+ * Gopher protocol handler.
+ * This is also a nice simple template to build off for simple
+ * connect-command-download protocols.
+ */
+
+const struct Curl_protocol Curl_protocol_gopher = {
+  ZERO_NULL,                            /* setup_connection */
+  gopher_do,                            /* do_it */
+  ZERO_NULL,                            /* done */
+  ZERO_NULL,                            /* do_more */
+  ZERO_NULL,                            /* connect_it */
+  ZERO_NULL,                            /* connecting */
+  ZERO_NULL,                            /* doing */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
+  ZERO_NULL,                            /* disconnect */
+  ZERO_NULL,                            /* write_resp */
+  ZERO_NULL,                            /* write_resp_hd */
+  ZERO_NULL,                            /* connection_is_dead */
+  ZERO_NULL,                            /* attach connection */
+  ZERO_NULL,                            /* follow */
+};
+
+#ifdef USE_SSL
+const struct Curl_protocol Curl_protocol_gophers = {
+  ZERO_NULL,                            /* setup_connection */
+  gopher_do,                            /* do_it */
+  ZERO_NULL,                            /* done */
+  ZERO_NULL,                            /* do_more */
+  gopher_connect,                       /* connect_it */
+  gopher_connecting,                    /* connecting */
+  ZERO_NULL,                            /* doing */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
+  ZERO_NULL,                            /* disconnect */
+  ZERO_NULL,                            /* write_resp */
+  ZERO_NULL,                            /* write_resp_hd */
+  ZERO_NULL,                            /* connection_is_dead */
+  ZERO_NULL,                            /* attach connection */
+  ZERO_NULL,                            /* follow */
+};
+#endif
+
 #endif /* CURL_DISABLE_GOPHER */
diff --git a/third-party/curl/lib/gopher.h b/third-party/curl/lib/gopher.h
index 9e3365b71c..1c126be16a 100644
--- a/third-party/curl/lib/gopher.h
+++ b/third-party/curl/lib/gopher.h
@@ -23,12 +23,9 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #ifndef CURL_DISABLE_GOPHER
-extern const struct Curl_handler Curl_handler_gopher;
-#ifdef USE_SSL
-extern const struct Curl_handler Curl_handler_gophers;
-#endif
+extern const struct Curl_protocol Curl_protocol_gopher;
+extern const struct Curl_protocol Curl_protocol_gophers;
 #endif
 
 #endif /* HEADER_CURL_GOPHER_H */
diff --git a/third-party/curl/lib/hash.c b/third-party/curl/lib/hash.c
index 30f28e2352..3eae1d26a7 100644
--- a/third-party/curl/lib/hash.c
+++ b/third-party/curl/lib/hash.c
@@ -21,33 +21,52 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include <curl/curl.h>
-
 #include "hash.h"
-#include "llist.h"
-#include "curl_memory.h"
 
-/* The last #include file should be: */
-#include "memdebug.h"
+/* random patterns for API verification */
+#ifdef DEBUGBUILD
+#define HASHINIT 0x7017e781
+#define ITERINIT 0x5FEDCBA9
+#endif
 
-static void
-hash_element_dtor(void *user, void *element)
+#if 0 /* useful function for debugging hashes and their contents */
+void Curl_hash_print(struct Curl_hash *h, void (*func)(void *))
 {
-  struct Curl_hash *h = (struct Curl_hash *) user;
-  struct Curl_hash_element *e = (struct Curl_hash_element *) element;
+  struct Curl_hash_iterator iter;
+  struct Curl_hash_element *he;
+  size_t last_index = UINT_MAX;
 
-  if(e->ptr) {
-    h->dtor(e->ptr);
-    e->ptr = NULL;
+  if(!h)
+    return;
+
+  curl_mfprintf(stderr, "=Hash dump=\n");
+
+  Curl_hash_start_iterate(h, &iter);
+
+  he = Curl_hash_next_element(&iter);
+  while(he) {
+    if(iter.slot_index != last_index) {
+      curl_mfprintf(stderr, "index %d:", (int)iter.slot_index);
+      if(last_index != UINT_MAX) {
+        curl_mfprintf(stderr, "\n");
+      }
+      last_index = iter.slot_index;
+    }
+
+    if(func)
+      func(he->ptr);
+    else
+      curl_mfprintf(stderr, " [key=%.*s, he=%p, ptr=%p]",
+                    (int)he->key_len, (char *)he->key,
+                    (void *)he, (void *)he->ptr);
+
+    he = Curl_hash_next_element(&iter);
   }
-
-  e->key_len = 0;
-
-  free(e);
+  curl_mfprintf(stderr, "\n");
 }
+#endif
 
 /* Initializes a hash structure.
  * Return 1 on error, 0 is fine.
@@ -55,12 +74,11 @@ hash_element_dtor(void *user, void *element)
  * @unittest: 1602
  * @unittest: 1603
  */
-void
-Curl_hash_init(struct Curl_hash *h,
-               int slots,
-               hash_function hfunc,
-               comp_function comparator,
-               Curl_hash_dtor dtor)
+void Curl_hash_init(struct Curl_hash *h,
+                    size_t slots,
+                    hash_function hfunc,
+                    comp_function comparator,
+                    Curl_hash_dtor dtor)
 {
   DEBUGASSERT(h);
   DEBUGASSERT(slots);
@@ -74,70 +92,116 @@ Curl_hash_init(struct Curl_hash *h,
   h->dtor = dtor;
   h->size = 0;
   h->slots = slots;
+#ifdef DEBUGBUILD
+  h->init = HASHINIT;
+#endif
 }
 
-static struct Curl_hash_element *
-mk_hash_element(const void *key, size_t key_len, const void *p)
+static struct Curl_hash_element *hash_elem_create(const void *key,
+                                                  size_t key_len,
+                                                  const void *p,
+                                                  Curl_hash_elem_dtor dtor)
 {
+  struct Curl_hash_element *he;
+
   /* allocate the struct plus memory after it to store the key */
-  struct Curl_hash_element *he = malloc(sizeof(struct Curl_hash_element) +
-                                        key_len);
+  he = curlx_malloc(sizeof(struct Curl_hash_element) + key_len);
   if(he) {
+    he->next = NULL;
     /* copy the key */
     memcpy(he->key, key, key_len);
     he->key_len = key_len;
-    he->ptr = (void *) p;
+    he->ptr = CURL_UNCONST(p);
+    he->dtor = dtor;
   }
   return he;
 }
 
-#define FETCH_LIST(x,y,z) &x->table[x->hash_func(y, z, x->slots)]
+static void hash_elem_clear_ptr(struct Curl_hash *h,
+                                struct Curl_hash_element *he)
+{
+  DEBUGASSERT(h);
+  DEBUGASSERT(he);
+  if(he->ptr) {
+    if(he->dtor)
+      he->dtor(he->key, he->key_len, he->ptr);
+    else
+      h->dtor(he->ptr);
+    he->ptr = NULL;
+  }
+}
+
+static void hash_elem_destroy(struct Curl_hash *h,
+                              struct Curl_hash_element *he)
+{
+  hash_elem_clear_ptr(h, he);
+  curlx_free(he);
+}
+
+static void hash_elem_unlink(struct Curl_hash *h,
+                             struct Curl_hash_element **he_anchor,
+                             struct Curl_hash_element *he)
+{
+  *he_anchor = he->next;
+  --h->size;
+}
+
+static void hash_elem_link(struct Curl_hash *h,
+                           struct Curl_hash_element **he_anchor,
+                           struct Curl_hash_element *he)
+{
+  he->next = *he_anchor;
+  *he_anchor = he;
+  ++h->size;
+}
+
+#define CURL_HASH_SLOT(x, y, z)      x->table[(x)->hash_func(y, z, (x)->slots)]
+#define CURL_HASH_SLOT_ADDR(x, y, z) &CURL_HASH_SLOT(x, y, z)
+
+void *Curl_hash_add2(struct Curl_hash *h, void *key, size_t key_len, void *p,
+                     Curl_hash_elem_dtor dtor)
+{
+  struct Curl_hash_element *he, **slot;
+
+  DEBUGASSERT(h);
+  DEBUGASSERT(h->slots);
+  DEBUGASSERT(h->init == HASHINIT);
+  if(!h->table) {
+    h->table = curlx_calloc(h->slots, sizeof(struct Curl_hash_element *));
+    if(!h->table)
+      return NULL; /* OOM */
+  }
+
+  slot = CURL_HASH_SLOT_ADDR(h, key, key_len);
+  for(he = *slot; he; he = he->next) {
+    if(h->comp_func(he->key, he->key_len, key, key_len)) {
+      /* existing key entry, overwrite by clearing old pointer */
+      hash_elem_clear_ptr(h, he);
+      he->ptr = p;
+      he->dtor = dtor;
+      return p;
+    }
+  }
+
+  he = hash_elem_create(key, key_len, p, dtor);
+  if(!he)
+    return NULL; /* OOM */
+
+  hash_elem_link(h, slot, he);
+  return p; /* return the new entry */
+}
 
 /* Insert the data in the hash. If there already was a match in the hash, that
  * data is replaced. This function also "lazily" allocates the table if
- * needed, as it isn't done in the _init function (anymore).
+ * needed, as it is not done in the _init function (anymore).
  *
  * @unittest: 1305
  * @unittest: 1602
  * @unittest: 1603
  */
-void *
-Curl_hash_add(struct Curl_hash *h, void *key, size_t key_len, void *p)
+void *Curl_hash_add(struct Curl_hash *h, void *key, size_t key_len, void *p)
 {
-  struct Curl_hash_element  *he;
-  struct Curl_llist_element *le;
-  struct Curl_llist *l;
-
-  DEBUGASSERT(h);
-  DEBUGASSERT(h->slots);
-  if(!h->table) {
-    int i;
-    h->table = malloc(h->slots * sizeof(struct Curl_llist));
-    if(!h->table)
-      return NULL; /* OOM */
-    for(i = 0; i < h->slots; ++i)
-      Curl_llist_init(&h->table[i], hash_element_dtor);
-  }
-
-  l = FETCH_LIST(h, key, key_len);
-
-  for(le = l->head; le; le = le->next) {
-    he = (struct Curl_hash_element *) le->ptr;
-    if(h->comp_func(he->key, he->key_len, key, key_len)) {
-      Curl_llist_remove(l, le, (void *)h);
-      --h->size;
-      break;
-    }
-  }
-
-  he = mk_hash_element(key, key_len, p);
-  if(he) {
-    Curl_llist_insert_next(l, l->tail, he, &he->list);
-    ++h->size;
-    return p; /* return the new entry */
-  }
-
-  return NULL; /* failure */
+  return Curl_hash_add2(h, key, key_len, p, NULL);
 }
 
 /* Remove the identified hash entry.
@@ -147,21 +211,21 @@ Curl_hash_add(struct Curl_hash *h, void *key, size_t key_len, void *p)
  */
 int Curl_hash_delete(struct Curl_hash *h, void *key, size_t key_len)
 {
-  struct Curl_llist_element *le;
-  struct Curl_llist *l;
-
   DEBUGASSERT(h);
   DEBUGASSERT(h->slots);
+  DEBUGASSERT(h->init == HASHINIT);
   if(h->table) {
-    l = FETCH_LIST(h, key, key_len);
+    struct Curl_hash_element *he, **he_anchor;
 
-    for(le = l->head; le; le = le->next) {
-      struct Curl_hash_element *he = le->ptr;
+    he_anchor = CURL_HASH_SLOT_ADDR(h, key, key_len);
+    while(*he_anchor) {
+      he = *he_anchor;
       if(h->comp_func(he->key, he->key_len, key, key_len)) {
-        Curl_llist_remove(l, le, (void *) h);
-        --h->size;
+        hash_elem_unlink(h, he_anchor, he);
+        hash_elem_destroy(h, he);
         return 0;
       }
+      he_anchor = &he->next;
     }
   }
   return 1;
@@ -171,46 +235,24 @@ int Curl_hash_delete(struct Curl_hash *h, void *key, size_t key_len)
  *
  * @unittest: 1603
  */
-void *
-Curl_hash_pick(struct Curl_hash *h, void *key, size_t key_len)
+void *Curl_hash_pick(struct Curl_hash *h, void *key, size_t key_len)
 {
-  struct Curl_llist_element *le;
-  struct Curl_llist *l;
-
   DEBUGASSERT(h);
+  DEBUGASSERT(h->init == HASHINIT);
   if(h->table) {
+    struct Curl_hash_element *he;
     DEBUGASSERT(h->slots);
-    l = FETCH_LIST(h, key, key_len);
-    for(le = l->head; le; le = le->next) {
-      struct Curl_hash_element *he = le->ptr;
+    he = CURL_HASH_SLOT(h, key, key_len);
+    while(he) {
       if(h->comp_func(he->key, he->key_len, key, key_len)) {
         return he->ptr;
       }
+      he = he->next;
     }
   }
-
   return NULL;
 }
 
-#if defined(DEBUGBUILD) && defined(AGGRESSIVE_TEST)
-void
-Curl_hash_apply(Curl_hash *h, void *user,
-                void (*cb)(void *user, void *ptr))
-{
-  struct Curl_llist_element  *le;
-  int                  i;
-
-  for(i = 0; i < h->slots; ++i) {
-    for(le = (h->table[i])->head;
-        le;
-        le = le->next) {
-      Curl_hash_element *el = le->ptr;
-      cb(user, el->ptr);
-    }
-  }
-}
-#endif
-
 /* Destroys all the entries in the given hash and resets its attributes,
  * prepping the given hash for [static|dynamic] deallocation.
  *
@@ -218,17 +260,14 @@ Curl_hash_apply(Curl_hash *h, void *user,
  * @unittest: 1602
  * @unittest: 1603
  */
-void
-Curl_hash_destroy(struct Curl_hash *h)
+void Curl_hash_destroy(struct Curl_hash *h)
 {
+  DEBUGASSERT(h->init == HASHINIT);
   if(h->table) {
-    int i;
-    for(i = 0; i < h->slots; ++i) {
-      Curl_llist_destroy(&h->table[i], (void *) h);
-    }
-    Curl_safefree(h->table);
+    Curl_hash_clean(h);
+    curlx_safefree(h->table);
   }
-  h->size = 0;
+  DEBUGASSERT(h->size == 0);
   h->slots = 0;
 }
 
@@ -236,57 +275,71 @@ Curl_hash_destroy(struct Curl_hash *h)
  *
  * @unittest: 1602
  */
-void
-Curl_hash_clean(struct Curl_hash *h)
+void Curl_hash_clean(struct Curl_hash *h)
 {
-  Curl_hash_clean_with_criterium(h, NULL, NULL);
+  if(h && h->table) {
+    struct Curl_hash_element *he, **he_anchor;
+    size_t i;
+    DEBUGASSERT(h->init == HASHINIT);
+    for(i = 0; i < h->slots; ++i) {
+      he_anchor = &h->table[i];
+      while(*he_anchor) {
+        he = *he_anchor;
+        hash_elem_unlink(h, he_anchor, he);
+        hash_elem_destroy(h, he);
+      }
+    }
+  }
+}
+
+size_t Curl_hash_count(struct Curl_hash *h)
+{
+  DEBUGASSERT(h->init == HASHINIT);
+  return h->size;
 }
 
 /* Cleans all entries that pass the comp function criteria. */
-void
-Curl_hash_clean_with_criterium(struct Curl_hash *h, void *user,
-                               int (*comp)(void *, void *))
+void Curl_hash_clean_with_criterium(struct Curl_hash *h, void *user,
+                                    int (*comp)(void *, void *))
 {
-  struct Curl_llist_element *le;
-  struct Curl_llist_element *lnext;
-  struct Curl_llist *list;
-  int i;
+  size_t i;
 
   if(!h || !h->table)
     return;
 
+  DEBUGASSERT(h->init == HASHINIT);
   for(i = 0; i < h->slots; ++i) {
-    list = &h->table[i];
-    le = list->head; /* get first list entry */
-    while(le) {
-      struct Curl_hash_element *he = le->ptr;
-      lnext = le->next;
+    struct Curl_hash_element *he, **he_anchor = &h->table[i];
+    while(*he_anchor) {
       /* ask the callback function if we shall remove this entry or not */
-      if(!comp || comp(user, he->ptr)) {
-        Curl_llist_remove(list, le, (void *) h);
-        --h->size; /* one less entry in the hash now */
+      if(!comp || comp(user, (*he_anchor)->ptr)) {
+        he = *he_anchor;
+        hash_elem_unlink(h, he_anchor, he);
+        hash_elem_destroy(h, he);
       }
-      le = lnext;
+      else
+        he_anchor = &(*he_anchor)->next;
     }
   }
 }
 
 size_t Curl_hash_str(void *key, size_t key_length, size_t slots_num)
 {
-  const char *key_str = (const char *) key;
+  const char *key_str = (const char *)key;
   const char *end = key_str + key_length;
   size_t h = 5381;
 
   while(key_str < end) {
+    size_t j = (size_t)*key_str++;
     h += h << 5;
-    h ^= *key_str++;
+    h ^= j;
   }
 
   return (h % slots_num);
 }
 
-size_t Curl_str_key_compare(void *k1, size_t key1_len,
-                            void *k2, size_t key2_len)
+size_t curlx_str_key_compare(void *k1, size_t key1_len,
+                             void *k2, size_t key2_len)
 {
   if((key1_len == key2_len) && !memcmp(k1, k2, key1_len))
     return 1;
@@ -297,74 +350,39 @@ size_t Curl_str_key_compare(void *k1, size_t key1_len,
 void Curl_hash_start_iterate(struct Curl_hash *hash,
                              struct Curl_hash_iterator *iter)
 {
+  DEBUGASSERT(hash->init == HASHINIT);
   iter->hash = hash;
   iter->slot_index = 0;
-  iter->current_element = NULL;
+  iter->current = NULL;
+#ifdef DEBUGBUILD
+  iter->init = ITERINIT;
+#endif
 }
 
-struct Curl_hash_element *
-Curl_hash_next_element(struct Curl_hash_iterator *iter)
+struct Curl_hash_element *Curl_hash_next_element(
+  struct Curl_hash_iterator *iter)
 {
-  struct Curl_hash *h = iter->hash;
-
+  struct Curl_hash *h;
+  DEBUGASSERT(iter->init == ITERINIT);
+  h = iter->hash;
   if(!h->table)
     return NULL; /* empty hash, nothing to return */
 
   /* Get the next element in the current list, if any */
-  if(iter->current_element)
-    iter->current_element = iter->current_element->next;
+  if(iter->current)
+    iter->current = iter->current->next;
 
   /* If we have reached the end of the list, find the next one */
-  if(!iter->current_element) {
-    int i;
+  if(!iter->current) {
+    size_t i;
     for(i = iter->slot_index; i < h->slots; i++) {
-      if(h->table[i].head) {
-        iter->current_element = h->table[i].head;
+      if(h->table[i]) {
+        iter->current = h->table[i];
         iter->slot_index = i + 1;
         break;
       }
     }
   }
 
-  if(iter->current_element) {
-    struct Curl_hash_element *he = iter->current_element->ptr;
-    return he;
-  }
-  return NULL;
+  return iter->current;
 }
-
-#if 0 /* useful function for debugging hashes and their contents */
-void Curl_hash_print(struct Curl_hash *h,
-                     void (*func)(void *))
-{
-  struct Curl_hash_iterator iter;
-  struct Curl_hash_element *he;
-  int last_index = -1;
-
-  if(!h)
-    return;
-
-  fprintf(stderr, "=Hash dump=\n");
-
-  Curl_hash_start_iterate(h, &iter);
-
-  he = Curl_hash_next_element(&iter);
-  while(he) {
-    if(iter.slot_index != last_index) {
-      fprintf(stderr, "index %d:", iter.slot_index);
-      if(last_index >= 0) {
-        fprintf(stderr, "\n");
-      }
-      last_index = iter.slot_index;
-    }
-
-    if(func)
-      func(he->ptr);
-    else
-      fprintf(stderr, " [%p]", (void *)he->ptr);
-
-    he = Curl_hash_next_element(&iter);
-  }
-  fprintf(stderr, "\n");
-}
-#endif
diff --git a/third-party/curl/lib/hash.h b/third-party/curl/lib/hash.h
index 9cfffc25b0..1d7d3de8ce 100644
--- a/third-party/curl/lib/hash.h
+++ b/third-party/curl/lib/hash.h
@@ -23,80 +23,83 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include <stddef.h>
-
-#include "llist.h"
-
 /* Hash function prototype */
-typedef size_t (*hash_function) (void *key,
-                                 size_t key_length,
-                                 size_t slots_num);
+typedef size_t (*hash_function)(void *key,
+                                size_t key_length,
+                                size_t slots_num);
 
 /*
    Comparator function prototype. Compares two keys.
 */
-typedef size_t (*comp_function) (void *key1,
-                                 size_t key1_len,
-                                 void *key2,
-                                 size_t key2_len);
+typedef size_t (*comp_function)(void *key1,
+                                size_t key1_len,
+                                void *key2,
+                                size_t key2_len);
 
 typedef void (*Curl_hash_dtor)(void *);
 
+typedef void (*Curl_hash_elem_dtor)(void *key, size_t key_len, void *p);
+
+struct Curl_hash_element {
+  struct Curl_hash_element *next;
+  void *ptr;
+  Curl_hash_elem_dtor dtor;
+  size_t key_len;
+  char key[1]; /* allocated memory following the struct */
+};
+
 struct Curl_hash {
-  struct Curl_llist *table;
+  struct Curl_hash_element **table;
 
   /* Hash function to be used for this hash table */
   hash_function hash_func;
-
   /* Comparator function to compare keys */
   comp_function comp_func;
-  Curl_hash_dtor   dtor;
-  int slots;
+  /* General element construct, unless element itself carries one */
+  Curl_hash_dtor dtor;
+  size_t slots;
   size_t size;
-};
-
-struct Curl_hash_element {
-  struct Curl_llist_element list;
-  void   *ptr;
-  size_t key_len;
-  char   key[1]; /* allocated memory following the struct */
+#ifdef DEBUGBUILD
+  int init;
+#endif
 };
 
 struct Curl_hash_iterator {
   struct Curl_hash *hash;
-  int slot_index;
-  struct Curl_llist_element *current_element;
+  size_t slot_index;
+  struct Curl_hash_element *current;
+#ifdef DEBUGBUILD
+  int init;
+#endif
 };
 
 void Curl_hash_init(struct Curl_hash *h,
-                    int slots,
+                    size_t slots,
                     hash_function hfunc,
                     comp_function comparator,
                     Curl_hash_dtor dtor);
 
 void *Curl_hash_add(struct Curl_hash *h, void *key, size_t key_len, void *p);
+void *Curl_hash_add2(struct Curl_hash *h, void *key, size_t key_len, void *p,
+                     Curl_hash_elem_dtor dtor);
 int Curl_hash_delete(struct Curl_hash *h, void *key, size_t key_len);
-void *Curl_hash_pick(struct Curl_hash *, void *key, size_t key_len);
-void Curl_hash_apply(struct Curl_hash *h, void *user,
-                     void (*cb)(void *user, void *ptr));
-#define Curl_hash_count(h) ((h)->size)
+void *Curl_hash_pick(struct Curl_hash *h, void *key, size_t key_len);
+
 void Curl_hash_destroy(struct Curl_hash *h);
+size_t Curl_hash_count(struct Curl_hash *h);
 void Curl_hash_clean(struct Curl_hash *h);
 void Curl_hash_clean_with_criterium(struct Curl_hash *h, void *user,
                                     int (*comp)(void *, void *));
 size_t Curl_hash_str(void *key, size_t key_length, size_t slots_num);
-size_t Curl_str_key_compare(void *k1, size_t key1_len, void *k2,
-                            size_t key2_len);
+size_t curlx_str_key_compare(void *k1, size_t key1_len, void *k2,
+                             size_t key2_len);
 void Curl_hash_start_iterate(struct Curl_hash *hash,
                              struct Curl_hash_iterator *iter);
-struct Curl_hash_element *
-Curl_hash_next_element(struct Curl_hash_iterator *iter);
-
-void Curl_hash_print(struct Curl_hash *h,
-                     void (*func)(void *));
+struct Curl_hash_element *Curl_hash_next_element(
+  struct Curl_hash_iterator *iter);
 
+void Curl_hash_print(struct Curl_hash *h, void (*func)(void *));
 
 #endif /* HEADER_CURL_HASH_H */
diff --git a/third-party/curl/lib/headers.c b/third-party/curl/lib/headers.c
index 3ff4d5eb07..b290a9e5b3 100644
--- a/third-party/curl/lib/headers.c
+++ b/third-party/curl/lib/headers.c
@@ -21,19 +21,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #include "urldata.h"
-#include "strdup.h"
-#include "strcase.h"
+#include "sendf.h"
+#include "curl_trc.h"
 #include "headers.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
 #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_HEADERS_API)
 
 /* Generate the curl_header struct for the user. This function MUST assign all
@@ -41,7 +35,7 @@
 static void copy_header_external(struct Curl_header_store *hs,
                                  size_t index,
                                  size_t amount,
-                                 struct Curl_llist_element *e,
+                                 struct Curl_llist_node *e,
                                  struct curl_header *hout)
 {
   struct curl_header *h = hout;
@@ -51,30 +45,30 @@ static void copy_header_external(struct Curl_header_store *hs,
   h->index = index;
   /* this will randomly OR a reserved bit for the sole purpose of making it
      impossible for applications to do == comparisons, as that would otherwise
-     be very tempting and then lead to the reserved bits not being reserved
+     be tempting and then lead to the reserved bits not being reserved
      anymore. */
-  h->origin = hs->type | (1<<27);
+  h->origin = (unsigned int)(hs->type | (1 << 27));
   h->anchor = e;
 }
 
 /* public API */
-CURLHcode curl_easy_header(CURL *easy,
+CURLHcode curl_easy_header(CURL *curl,
                            const char *name,
                            size_t nameindex,
-                           unsigned int type,
+                           unsigned int origin,
                            int request,
                            struct curl_header **hout)
 {
-  struct Curl_llist_element *e;
-  struct Curl_llist_element *e_pick = NULL;
-  struct Curl_easy *data = easy;
+  struct Curl_llist_node *e;
+  struct Curl_llist_node *e_pick = NULL;
+  struct Curl_easy *data = curl;
   size_t match = 0;
   size_t amount = 0;
   struct Curl_header_store *hs = NULL;
   struct Curl_header_store *pick = NULL;
   if(!name || !hout || !data ||
-     (type > (CURLH_HEADER|CURLH_TRAILER|CURLH_CONNECT|CURLH_1XX|
-              CURLH_PSEUDO)) || !type || (request < -1))
+     (origin > (CURLH_HEADER | CURLH_TRAILER | CURLH_CONNECT | CURLH_1XX |
+                CURLH_PSEUDO)) || !origin || (request < -1))
     return CURLHE_BAD_ARGUMENT;
   if(!Curl_llist_count(&data->state.httphdrs))
     return CURLHE_NOHEADERS; /* no headers available */
@@ -84,10 +78,10 @@ CURLHcode curl_easy_header(CURL *easy,
     request = data->state.requests;
 
   /* we need a first round to count amount of this header */
-  for(e = data->state.httphdrs.head; e; e = e->next) {
-    hs = e->ptr;
-    if(strcasecompare(hs->name, name) &&
-       (hs->type & type) &&
+  for(e = Curl_llist_head(&data->state.httphdrs); e; e = Curl_node_next(e)) {
+    hs = Curl_node_elem(e);
+    if(curl_strequal(hs->name, name) &&
+       (hs->type & origin) &&
        (hs->request == request)) {
       amount++;
       pick = hs;
@@ -103,17 +97,17 @@ CURLHcode curl_easy_header(CURL *easy,
     /* if the last or only occurrence is what's asked for, then we know it */
     hs = pick;
   else {
-    for(e = data->state.httphdrs.head; e; e = e->next) {
-      hs = e->ptr;
-      if(strcasecompare(hs->name, name) &&
-         (hs->type & type) &&
+    for(e = Curl_llist_head(&data->state.httphdrs); e; e = Curl_node_next(e)) {
+      hs = Curl_node_elem(e);
+      if(curl_strequal(hs->name, name) &&
+         (hs->type & origin) &&
          (hs->request == request) &&
          (match++ == nameindex)) {
         e_pick = e;
         break;
       }
     }
-    if(!e) /* this shouldn't happen */
+    if(!e) /* this should not happen */
       return CURLHE_MISSING;
   }
   /* this is the name we want */
@@ -124,14 +118,14 @@ CURLHcode curl_easy_header(CURL *easy,
 }
 
 /* public API */
-struct curl_header *curl_easy_nextheader(CURL *easy,
-                                         unsigned int type,
+struct curl_header *curl_easy_nextheader(CURL *curl,
+                                         unsigned int origin,
                                          int request,
                                          struct curl_header *prev)
 {
-  struct Curl_easy *data = easy;
-  struct Curl_llist_element *pick;
-  struct Curl_llist_element *e;
+  struct Curl_easy *data = curl;
+  struct Curl_llist_node *pick;
+  struct Curl_llist_node *e;
   struct Curl_header_store *hs;
   size_t amount = 0;
   size_t index = 0;
@@ -146,18 +140,18 @@ struct curl_header *curl_easy_nextheader(CURL *easy,
     if(!pick)
       /* something is wrong */
       return NULL;
-    pick = pick->next;
+    pick = Curl_node_next(pick);
   }
   else
-    pick = data->state.httphdrs.head;
+    pick = Curl_llist_head(&data->state.httphdrs);
 
   if(pick) {
     /* make sure it is the next header of the desired type */
     do {
-      hs = pick->ptr;
-      if((hs->type & type) && (hs->request == request))
+      hs = Curl_node_elem(pick);
+      if((hs->type & origin) && (hs->request == request))
         break;
-      pick = pick->next;
+      pick = Curl_node_next(pick);
     } while(pick);
   }
 
@@ -165,15 +159,15 @@ struct curl_header *curl_easy_nextheader(CURL *easy,
     /* no more headers available */
     return NULL;
 
-  hs = pick->ptr;
+  hs = Curl_node_elem(pick);
 
   /* count number of occurrences of this name within the mask and figure out
      the index for the currently selected entry */
-  for(e = data->state.httphdrs.head; e; e = e->next) {
-    struct Curl_header_store *check = e->ptr;
-    if(strcasecompare(hs->name, check->name) &&
+  for(e = Curl_llist_head(&data->state.httphdrs); e; e = Curl_node_next(e)) {
+    struct Curl_header_store *check = Curl_node_elem(e);
+    if(curl_strequal(hs->name, check->name) &&
        (check->request == request) &&
-       (check->type & type))
+       (check->type & origin))
       amount++;
     if(e == pick)
       index = amount - 1;
@@ -185,7 +179,7 @@ struct curl_header *curl_easy_nextheader(CURL *easy,
 }
 
 static CURLcode namevalue(char *header, size_t hlen, unsigned int type,
-                           char **name, char **value)
+                          char **name, char **value)
 {
   char *end = header + hlen - 1; /* point to the last byte */
   DEBUGASSERT(hlen);
@@ -207,159 +201,164 @@ static CURLcode namevalue(char *header, size_t hlen, unsigned int type,
   else
     return CURLE_BAD_FUNCTION_ARGUMENT;
 
-  /* skip all leading space letters */
-  while(*header && ISBLANK(*header))
+  /* skip all leading blank letters */
+  while(ISBLANK(*header))
     header++;
 
   *value = header;
 
   /* skip all trailing space letters */
-  while((end > header) && ISSPACE(*end))
-    *end-- = 0; /* nul terminate */
+  while((end > header) && ISBLANK(*end))
+    *end-- = 0; /* null-terminate */
   return CURLE_OK;
 }
 
-static CURLcode unfold_value(struct Curl_easy *data, const char *value,
-                             size_t vlen)  /* length of the incoming header */
-{
-  struct Curl_header_store *hs;
-  struct Curl_header_store *newhs;
-  size_t olen; /* length of the old value */
-  size_t oalloc; /* length of the old name + value + separator */
-  size_t offset;
-  DEBUGASSERT(data->state.prevhead);
-  hs = data->state.prevhead;
-  olen = strlen(hs->value);
-  offset = hs->value - hs->buffer;
-  oalloc = olen + offset + 1;
-
-  /* skip all trailing space letters */
-  while(vlen && ISSPACE(value[vlen - 1]))
-    vlen--;
-
-  /* save only one leading space */
-  while((vlen > 1) && ISBLANK(value[0]) && ISBLANK(value[1])) {
-    vlen--;
-    value++;
-  }
-
-  /* since this header block might move in the realloc below, it needs to
-     first be unlinked from the list and then re-added again after the
-     realloc */
-  Curl_llist_remove(&data->state.httphdrs, &hs->node, NULL);
-
-  /* new size = struct + new value length + old name+value length */
-  newhs = Curl_saferealloc(hs, sizeof(*hs) + vlen + oalloc + 1);
-  if(!newhs)
-    return CURLE_OUT_OF_MEMORY;
-  /* ->name' and ->value point into ->buffer (to keep the header allocation
-     in a single memory block), which now potentially have moved. Adjust
-     them. */
-  newhs->name = newhs->buffer;
-  newhs->value = &newhs->buffer[offset];
-
-  /* put the data at the end of the previous data, not the newline */
-  memcpy(&newhs->value[olen], value, vlen);
-  newhs->value[olen + vlen] = 0; /* null-terminate at newline */
-
-  /* insert this node into the list of headers */
-  Curl_llist_insert_next(&data->state.httphdrs, data->state.httphdrs.tail,
-                         newhs, &newhs->node);
-  data->state.prevhead = newhs;
-  return CURLE_OK;
-}
-
-
 /*
  * Curl_headers_push() gets passed a full HTTP header to store. It gets called
- * immediately before the header callback. The header is CRLF terminated.
+ * immediately before the header callback. The header is CRLF, CR or LF
+ * terminated.
  */
 CURLcode Curl_headers_push(struct Curl_easy *data, const char *header,
+                           size_t hlen, /* length of header */
                            unsigned char type)
 {
   char *value = NULL;
   char *name = NULL;
-  char *end;
-  size_t hlen; /* length of the incoming header */
   struct Curl_header_store *hs;
   CURLcode result = CURLE_OUT_OF_MEMORY;
+  const size_t ilen = hlen;
 
   if((header[0] == '\r') || (header[0] == '\n'))
     /* ignore the body separator */
     return CURLE_OK;
 
-  end = strchr(header, '\r');
-  if(!end) {
-    end = strchr(header, '\n');
-    if(!end)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-  }
-  hlen = end - header + 1;
+  /* trim off newline characters */
+  if(hlen && (header[hlen - 1] == '\n'))
+    hlen--;
+  if(hlen && (header[hlen - 1] == '\r'))
+    hlen--;
+  if(hlen == ilen)
+    /* neither CR nor LF as terminator is not a valid header */
+    return CURLE_WEIRD_SERVER_REPLY;
 
-  if((header[0] == ' ') || (header[0] == '\t')) {
-    if(data->state.prevhead)
-      /* line folding, append value to the previous header's value */
-      return unfold_value(data, header, hlen);
-    else {
-      /* Can't unfold without a previous header. Instead of erroring, just
-         pass the leading blanks. */
-      while(hlen && ISBLANK(*header)) {
-        header++;
-        hlen--;
-      }
-      if(!hlen)
-        return CURLE_WEIRD_SERVER_REPLY;
+  if(ISBLANK(header[0])) {
+    /* pass leading blanks */
+    while(hlen && ISBLANK(*header)) {
+      header++;
+      hlen--;
     }
+    if(!hlen)
+      return CURLE_WEIRD_SERVER_REPLY;
+  }
+  if(Curl_llist_count(&data->state.httphdrs) >= MAX_HTTP_RESP_HEADER_COUNT) {
+    failf(data, "Too many response headers, %d is max",
+          MAX_HTTP_RESP_HEADER_COUNT);
+    return CURLE_TOO_LARGE;
   }
 
-  hs = calloc(1, sizeof(*hs) + hlen);
+  hs = curlx_calloc(1, sizeof(*hs) + hlen);
   if(!hs)
     return CURLE_OUT_OF_MEMORY;
   memcpy(hs->buffer, header, hlen);
-  hs->buffer[hlen] = 0; /* nul terminate */
+  hs->buffer[hlen] = 0; /* null-terminate */
 
   result = namevalue(hs->buffer, hlen, type, &name, &value);
-  if(result)
-    goto fail;
+  if(!result) {
+    hs->name = name;
+    hs->value = value;
+    hs->type = type;
+    hs->request = data->state.requests;
 
-  hs->name = name;
-  hs->value = value;
-  hs->type = type;
-  hs->request = data->state.requests;
-
-  /* insert this node into the list of headers */
-  Curl_llist_insert_next(&data->state.httphdrs, data->state.httphdrs.tail,
-                         hs, &hs->node);
-  data->state.prevhead = hs;
-  return CURLE_OK;
-fail:
-  free(hs);
+    /* insert this node into the list of headers */
+    Curl_llist_append(&data->state.httphdrs, hs, &hs->node);
+    data->state.prevhead = hs;
+  }
+  else {
+    failf(data, "Invalid response header");
+    curlx_free(hs);
+  }
   return result;
 }
 
 /*
- * Curl_headers_init(). Init the headers subsystem.
+ * Curl_headers_reset(). Reset the headers subsystem.
  */
-static void headers_init(struct Curl_easy *data)
+static void headers_reset(struct Curl_easy *data)
 {
   Curl_llist_init(&data->state.httphdrs, NULL);
   data->state.prevhead = NULL;
 }
 
+struct hds_cw_collect_ctx {
+  struct Curl_cwriter super;
+};
+
+static CURLcode hds_cw_collect_write(struct Curl_easy *data,
+                                     struct Curl_cwriter *writer, int type,
+                                     const char *buf, size_t blen)
+{
+  if((type & CLIENTWRITE_HEADER) && !(type & CLIENTWRITE_STATUS)) {
+    unsigned char htype = (unsigned char)
+      (type & CLIENTWRITE_CONNECT ? CURLH_CONNECT :
+       (type & CLIENTWRITE_1XX ? CURLH_1XX :
+        (type & CLIENTWRITE_TRAILER ? CURLH_TRAILER :
+         CURLH_HEADER)));
+    CURLcode result = Curl_headers_push(data, buf, blen, htype);
+    CURL_TRC_WRITE(data, "header_collect pushed(type=%x, len=%zu) -> %d",
+                   htype, blen, (int)result);
+    if(result)
+      return result;
+  }
+  return Curl_cwriter_write(data, writer->next, type, buf, blen);
+}
+
+static const struct Curl_cwtype hds_cw_collect = {
+  "hds-collect",
+  NULL,
+  Curl_cwriter_def_init,
+  hds_cw_collect_write,
+  Curl_cwriter_def_close,
+  sizeof(struct hds_cw_collect_ctx)
+};
+
+CURLcode Curl_headers_init(struct Curl_easy *data)
+{
+  struct Curl_cwriter *writer;
+  CURLcode result;
+
+  if(data->conn && (data->conn->scheme->protocol & PROTO_FAMILY_HTTP)) {
+    /* avoid installing it twice */
+    if(Curl_cwriter_get_by_name(data, hds_cw_collect.name))
+      return CURLE_OK;
+
+    result = Curl_cwriter_create(&writer, data, &hds_cw_collect,
+                                 CURL_CW_PROTOCOL);
+    if(result)
+      return result;
+
+    result = Curl_cwriter_add(data, writer);
+    if(result) {
+      Curl_cwriter_free(data, writer);
+      return result;
+    }
+  }
+  return CURLE_OK;
+}
+
 /*
  * Curl_headers_cleanup(). Free all stored headers and associated memory.
  */
 CURLcode Curl_headers_cleanup(struct Curl_easy *data)
 {
-  struct Curl_llist_element *e;
-  struct Curl_llist_element *n;
+  struct Curl_llist_node *e;
+  struct Curl_llist_node *n;
 
-  for(e = data->state.httphdrs.head; e; e = n) {
-    struct Curl_header_store *hs = e->ptr;
-    n = e->next;
-    free(hs);
+  for(e = Curl_llist_head(&data->state.httphdrs); e; e = n) {
+    struct Curl_header_store *hs = Curl_node_elem(e);
+    n = Curl_node_next(e);
+    curlx_free(hs);
   }
-  headers_init(data);
+  headers_reset(data);
   return CURLE_OK;
 }
 
diff --git a/third-party/curl/lib/headers.h b/third-party/curl/lib/headers.h
index a5229ea22f..283179acdc 100644
--- a/third-party/curl/lib/headers.h
+++ b/third-party/curl/lib/headers.h
@@ -28,19 +28,25 @@
 #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_HEADERS_API)
 
 struct Curl_header_store {
-  struct Curl_llist_element node;
+  struct Curl_llist_node node;
   char *name; /* points into 'buffer' */
-  char *value; /* points into 'buffer */
+  char *value; /* points into 'buffer' */
   int request; /* 0 is the first request, then 1.. 2.. */
   unsigned char type; /* CURLH_* defines */
   char buffer[1]; /* this is the raw header blob */
 };
 
+/*
+ * Initialize header collecting for a transfer.
+ * Add a client writer that catches CLIENTWRITE_HEADER writes.
+ */
+CURLcode Curl_headers_init(struct Curl_easy *data);
+
 /*
  * Curl_headers_push() gets passed a full header to store.
  */
 CURLcode Curl_headers_push(struct Curl_easy *data, const char *header,
-                           unsigned char type);
+                           size_t hlen, unsigned char type);
 
 /*
  * Curl_headers_cleanup(). Free all stored headers and associated memory.
@@ -48,8 +54,10 @@ CURLcode Curl_headers_push(struct Curl_easy *data, const char *header,
 CURLcode Curl_headers_cleanup(struct Curl_easy *data);
 
 #else
-#define Curl_headers_push(x,y,z) CURLE_OK
-#define Curl_headers_cleanup(x) Curl_nop_stmt
+#define Curl_headers_init(x)          CURLE_OK
+#define Curl_headers_push(x, y, z, a) \
+  ((void)(x), (void)(y), (void)(z), (void)(a), CURLE_OK)
+#define Curl_headers_cleanup(x)       Curl_nop_stmt
 #endif
 
 #endif /* HEADER_CURL_HEADER_H */
diff --git a/third-party/curl/lib/hmac.c b/third-party/curl/lib/hmac.c
index 87e7be8c65..a4d6ebdd8a 100644
--- a/third-party/curl/lib/hmac.c
+++ b/third-party/curl/lib/hmac.c
@@ -23,38 +23,28 @@
  * RFC2104 Keyed-Hashing for Message Authentication
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) \
-    || !defined(CURL_DISABLE_AWS)
-
-#include <curl/curl.h>
+#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) ||    \
+  !defined(CURL_DISABLE_AWS) || !defined(CURL_DISABLE_DIGEST_AUTH) || \
+  defined(USE_SSL)
 
 #include "curl_hmac.h"
-#include "curl_memory.h"
-#include "warnless.h"
-
-/* The last #include file should be: */
-#include "memdebug.h"
 
 /*
  * Generic HMAC algorithm.
  *
  *   This module computes HMAC digests based on any hash function. Parameters
- * and computing procedures are set-up dynamically at HMAC computation context
+ * and computing procedures are setup dynamically at HMAC computation context
  * initialization.
  */
 
 static const unsigned char hmac_ipad = 0x36;
 static const unsigned char hmac_opad = 0x5C;
 
-
-
-struct HMAC_context *
-Curl_HMAC_init(const struct HMAC_params *hashparams,
-               const unsigned char *key,
-               unsigned int keylen)
+struct HMAC_context *Curl_HMAC_init(const struct HMAC_params *hashparams,
+                                    const unsigned char *key,
+                                    unsigned int keylen)
 {
   size_t i;
   struct HMAC_context *ctxt;
@@ -62,74 +52,74 @@ Curl_HMAC_init(const struct HMAC_params *hashparams,
   unsigned char b;
 
   /* Create HMAC context. */
-  i = sizeof(*ctxt) + 2 * hashparams->hmac_ctxtsize +
-    hashparams->hmac_resultlen;
-  ctxt = malloc(i);
+  i = sizeof(*ctxt) + (2 * hashparams->ctxtsize) + hashparams->resultlen;
+  ctxt = curlx_malloc(i);
 
   if(!ctxt)
     return ctxt;
 
-  ctxt->hmac_hash = hashparams;
-  ctxt->hmac_hashctxt1 = (void *) (ctxt + 1);
-  ctxt->hmac_hashctxt2 = (void *) ((char *) ctxt->hmac_hashctxt1 +
-      hashparams->hmac_ctxtsize);
+  ctxt->hash = hashparams;
+  ctxt->hashctxt1 = (void *)(ctxt + 1);
+  ctxt->hashctxt2 = (void *)((char *)ctxt->hashctxt1 + hashparams->ctxtsize);
 
   /* If the key is too long, replace it by its hash digest. */
-  if(keylen > hashparams->hmac_maxkeylen) {
-    (*hashparams->hmac_hinit)(ctxt->hmac_hashctxt1);
-    (*hashparams->hmac_hupdate)(ctxt->hmac_hashctxt1, key, keylen);
-    hkey = (unsigned char *) ctxt->hmac_hashctxt2 + hashparams->hmac_ctxtsize;
-    (*hashparams->hmac_hfinal)(hkey, ctxt->hmac_hashctxt1);
+  if(keylen > hashparams->maxkeylen) {
+    if(hashparams->hinit(ctxt->hashctxt1))
+      goto fail;
+    hashparams->hupdate(ctxt->hashctxt1, key, keylen);
+    hkey = (unsigned char *)ctxt->hashctxt2 + hashparams->ctxtsize;
+    hashparams->hfinal(hkey, ctxt->hashctxt1);
     key = hkey;
-    keylen = hashparams->hmac_resultlen;
+    keylen = hashparams->resultlen;
   }
 
   /* Prime the two hash contexts with the modified key. */
-  (*hashparams->hmac_hinit)(ctxt->hmac_hashctxt1);
-  (*hashparams->hmac_hinit)(ctxt->hmac_hashctxt2);
+  if(hashparams->hinit(ctxt->hashctxt1) ||
+     hashparams->hinit(ctxt->hashctxt2))
+    goto fail;
 
   for(i = 0; i < keylen; i++) {
     b = (unsigned char)(*key ^ hmac_ipad);
-    (*hashparams->hmac_hupdate)(ctxt->hmac_hashctxt1, &b, 1);
+    hashparams->hupdate(ctxt->hashctxt1, &b, 1);
     b = (unsigned char)(*key++ ^ hmac_opad);
-    (*hashparams->hmac_hupdate)(ctxt->hmac_hashctxt2, &b, 1);
+    hashparams->hupdate(ctxt->hashctxt2, &b, 1);
   }
 
-  for(; i < hashparams->hmac_maxkeylen; i++) {
-    (*hashparams->hmac_hupdate)(ctxt->hmac_hashctxt1, &hmac_ipad, 1);
-    (*hashparams->hmac_hupdate)(ctxt->hmac_hashctxt2, &hmac_opad, 1);
+  for(; i < hashparams->maxkeylen; i++) {
+    hashparams->hupdate(ctxt->hashctxt1, &hmac_ipad, 1);
+    hashparams->hupdate(ctxt->hashctxt2, &hmac_opad, 1);
   }
 
   /* Done, return pointer to HMAC context. */
   return ctxt;
+
+fail:
+  curlx_free(ctxt);
+  return NULL;
 }
 
-int Curl_HMAC_update(struct HMAC_context *ctxt,
-                     const unsigned char *data,
-                     unsigned int len)
+void Curl_HMAC_update(struct HMAC_context *ctxt,
+                      const unsigned char *data,
+                      unsigned int len)
 {
   /* Update first hash calculation. */
-  (*ctxt->hmac_hash->hmac_hupdate)(ctxt->hmac_hashctxt1, data, len);
-  return 0;
+  ctxt->hash->hupdate(ctxt->hashctxt1, data, len);
 }
 
-
-int Curl_HMAC_final(struct HMAC_context *ctxt, unsigned char *result)
+int Curl_HMAC_final(struct HMAC_context *ctxt, unsigned char *output)
 {
-  const struct HMAC_params *hashparams = ctxt->hmac_hash;
+  const struct HMAC_params *hashparams = ctxt->hash;
 
-  /* Do not get result if called with a null parameter: only release
+  /* Do not get output if called with a null parameter: only release
      storage. */
 
-  if(!result)
-    result = (unsigned char *) ctxt->hmac_hashctxt2 +
-     ctxt->hmac_hash->hmac_ctxtsize;
+  if(!output)
+    output = (unsigned char *)ctxt->hashctxt2 + ctxt->hash->ctxtsize;
 
-  (*hashparams->hmac_hfinal)(result, ctxt->hmac_hashctxt1);
-  (*hashparams->hmac_hupdate)(ctxt->hmac_hashctxt2,
-   result, hashparams->hmac_resultlen);
-  (*hashparams->hmac_hfinal)(result, ctxt->hmac_hashctxt2);
-  free((char *) ctxt);
+  hashparams->hfinal(output, ctxt->hashctxt1);
+  hashparams->hupdate(ctxt->hashctxt2, output, hashparams->resultlen);
+  hashparams->hfinal(output, ctxt->hashctxt2);
+  curlx_free(ctxt);
   return 0;
 }
 
@@ -144,25 +134,32 @@ int Curl_HMAC_final(struct HMAC_context *ctxt, unsigned char *result)
  * hashparams [in]     - The hash function (Curl_HMAC_MD5).
  * key        [in]     - The key to use.
  * keylen     [in]     - The length of the key.
- * data       [in]     - The data to encrypt.
- * datalen    [in]     - The length of the data.
+ * buf        [in]     - The data to encrypt.
+ * buflen     [in]     - The length of the data.
  * output     [in/out] - The output buffer.
  *
  * Returns CURLE_OK on success.
  */
 CURLcode Curl_hmacit(const struct HMAC_params *hashparams,
                      const unsigned char *key, const size_t keylen,
-                     const unsigned char *data, const size_t datalen,
+                     const unsigned char *data, size_t datalen,
                      unsigned char *output)
 {
-  struct HMAC_context *ctxt =
-    Curl_HMAC_init(hashparams, key, curlx_uztoui(keylen));
+  struct HMAC_context *ctxt;
+  if(keylen > UINT_MAX) /* unlikely to ever happen */
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  ctxt = Curl_HMAC_init(hashparams, key, curlx_uztoui(keylen));
 
   if(!ctxt)
     return CURLE_OUT_OF_MEMORY;
 
   /* Update the digest with the given challenge */
-  Curl_HMAC_update(ctxt, data, curlx_uztoui(datalen));
+  do {
+    unsigned int ilen = (unsigned int)CURLMIN(datalen, UINT_MAX);
+    Curl_HMAC_update(ctxt, data, ilen);
+    datalen -= ilen;
+    data += ilen;
+  } while(datalen);
 
   /* Finalise the digest */
   Curl_HMAC_final(ctxt, output);
diff --git a/third-party/curl/lib/hostasyn.c b/third-party/curl/lib/hostasyn.c
deleted file mode 100644
index 2f6762ca4e..0000000000
--- a/third-party/curl/lib/hostasyn.c
+++ /dev/null
@@ -1,123 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-/***********************************************************************
- * Only for builds using asynchronous name resolves
- **********************************************************************/
-#ifdef CURLRES_ASYNCH
-
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-#ifdef __VMS
-#include <in.h>
-#include <inet.h>
-#endif
-
-#include "urldata.h"
-#include "sendf.h"
-#include "hostip.h"
-#include "hash.h"
-#include "share.h"
-#include "url.h"
-#include "curl_memory.h"
-/* The last #include file should be: */
-#include "memdebug.h"
-
-/*
- * Curl_addrinfo_callback() gets called by ares, gethostbyname_thread()
- * or getaddrinfo_thread() when we got the name resolved (or not!).
- *
- * If the status argument is CURL_ASYNC_SUCCESS, this function takes
- * ownership of the Curl_addrinfo passed, storing the resolved data
- * in the DNS cache.
- *
- * The storage operation locks and unlocks the DNS cache.
- */
-CURLcode Curl_addrinfo_callback(struct Curl_easy *data,
-                                int status,
-                                struct Curl_addrinfo *ai)
-{
-  struct Curl_dns_entry *dns = NULL;
-  CURLcode result = CURLE_OK;
-
-  data->state.async.status = status;
-
-  if(CURL_ASYNC_SUCCESS == status) {
-    if(ai) {
-      if(data->share)
-        Curl_share_lock(data, CURL_LOCK_DATA_DNS, CURL_LOCK_ACCESS_SINGLE);
-
-      dns = Curl_cache_addr(data, ai,
-                            data->state.async.hostname, 0,
-                            data->state.async.port);
-      if(data->share)
-        Curl_share_unlock(data, CURL_LOCK_DATA_DNS);
-
-      if(!dns) {
-        /* failed to store, cleanup and return error */
-        Curl_freeaddrinfo(ai);
-        result = CURLE_OUT_OF_MEMORY;
-      }
-    }
-    else {
-      result = CURLE_OUT_OF_MEMORY;
-    }
-  }
-
-  data->state.async.dns = dns;
-
- /* Set async.done TRUE last in this function since it may be used multi-
-    threaded and once this is TRUE the other thread may read fields from the
-    async struct */
-  data->state.async.done = TRUE;
-
-  /* IPv4: The input hostent struct will be freed by ares when we return from
-     this function */
-  return result;
-}
-
-/*
- * Curl_getaddrinfo() is the generic low-level name resolve API within this
- * source file. There are several versions of this function - for different
- * name resolve layers (selected at build-time). They all take this same set
- * of arguments
- */
-struct Curl_addrinfo *Curl_getaddrinfo(struct Curl_easy *data,
-                                       const char *hostname,
-                                       int port,
-                                       int *waitp)
-{
-  return Curl_resolver_getaddrinfo(data, hostname, port, waitp);
-}
-
-#endif /* CURLRES_ASYNCH */
diff --git a/third-party/curl/lib/hostip.c b/third-party/curl/lib/hostip.c
index acb4b5140b..a18d9a62bb 100644
--- a/third-party/curl/lib/hostip.c
+++ b/third-party/curl/lib/hostip.c
@@ -21,7 +21,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef HAVE_NETINET_IN_H
@@ -41,31 +40,26 @@
 #include <inet.h>
 #endif
 
-#ifdef HAVE_SETJMP_H
-#include <setjmp.h>
-#endif
-#ifdef HAVE_SIGNAL_H
+#include <setjmp.h>  /* for sigjmp_buf, sigsetjmp() */
 #include <signal.h>
-#endif
 
 #include "urldata.h"
-#include "sendf.h"
+#include "curl_addrinfo.h"
+#include "curl_trc.h"
+#include "dnscache.h"
 #include "hostip.h"
-#include "hash.h"
-#include "rand.h"
-#include "share.h"
+#include "httpsrr.h"
 #include "url.h"
-#include "inet_ntop.h"
-#include "inet_pton.h"
 #include "multiif.h"
+#include "progress.h"
 #include "doh.h"
-#include "warnless.h"
+#include "select.h"
 #include "strcase.h"
 #include "easy_lock.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curlx/inet_ntop.h"
+#include "curlx/inet_pton.h"
+#include "curlx/strcopy.h"
+#include "curlx/strparse.h"
 
 #if defined(CURLRES_SYNCH) &&                   \
   defined(HAVE_ALARM) &&                        \
@@ -76,9 +70,20 @@
 #define USE_ALARM_TIMEOUT
 #endif
 
-#define MAX_HOSTCACHE_LEN (255 + 7) /* max FQDN + colon + port number + zero */
+#define RESOLV_FAIL(for_proxy) \
+  ((for_proxy) ? CURLE_COULDNT_RESOLVE_PROXY : CURLE_COULDNT_RESOLVE_HOST)
 
-#define MAX_DNS_CACHE_SIZE 29999
+#define IS_RESOLV_FAIL(result) \
+  (((result) == CURLE_COULDNT_RESOLVE_HOST) || \
+   ((result) == CURLE_COULDNT_RESOLVE_PROXY))
+/*
+ * ipv6works() returns TRUE if IPv6 seems to work.
+ */
+#ifdef USE_IPV6
+static bool ipv6works(struct Curl_easy *data);
+#else
+#define ipv6works(x) FALSE
+#endif
 
 /*
  * hostip.c explained
@@ -88,14 +93,14 @@
  * source file are these:
  *
  * CURLRES_IPV6 - this host has getaddrinfo() and family, and thus we use
- * that. The host may not be able to resolve IPv6, but we don't really have to
- * take that into account. Hosts that aren't IPv6-enabled have CURLRES_IPV4
+ * that. The host may not be able to resolve IPv6, but we do not really have to
+ * take that into account. Hosts that are not IPv6-enabled have CURLRES_IPV4
  * defined.
  *
- * CURLRES_ARES - is defined if libcurl is built to use c-ares for
+ * USE_RESOLV_ARES - is defined if libcurl is built to use c-ares for
  * asynchronous name resolves. This can be Windows or *nix.
  *
- * CURLRES_THREADED - is defined if libcurl is built to run under (native)
+ * USE_RESOLV_THREADED - is defined if libcurl is built to run under (native)
  * Windows, and then the name resolve will be done in a new thread, and the
  * supported API will be the same as for ares-builds.
  *
@@ -106,20 +111,59 @@
  * The host*.c sources files are split up like this:
  *
  * hostip.c   - method-independent resolver functions and utility functions
- * hostasyn.c - functions for asynchronous name resolves
- * hostsyn.c  - functions for synchronous name resolves
  * hostip4.c  - IPv4 specific functions
  * hostip6.c  - IPv6 specific functions
- *
+ * asyn.h     - common functions for all async resolvers
  * The two asynchronous name resolver backends are implemented in:
- * asyn-ares.c   - functions for ares-using name resolves
- * asyn-thread.c - functions for threaded name resolves
-
+ * asyn-ares.c - async resolver using c-ares
+ * asyn-thread.c - async resolver using POSIX threads
+ *
  * The hostip.h is the united header file for all this. It defines the
  * CURLRES_* defines based on the config*.h and curl_setup.h defines.
  */
 
-static void freednsentry(void *freethis);
+uint8_t Curl_resolv_dns_queries(struct Curl_easy *data, uint8_t ip_version)
+{
+  (void)data;
+  switch(ip_version) {
+  case CURL_IPRESOLVE_V6:
+    return CURL_DNSQ_AAAA;
+  case CURL_IPRESOLVE_V4:
+    return CURL_DNSQ_A;
+  default:
+    if(ipv6works(data))
+      return (CURL_DNSQ_A | CURL_DNSQ_AAAA);
+    else
+      return CURL_DNSQ_A;
+  }
+}
+
+#ifdef CURLVERBOSE
+const char *Curl_resolv_query_str(uint8_t dns_queries)
+{
+  switch(dns_queries) {
+  case (CURL_DNSQ_A | CURL_DNSQ_AAAA | CURL_DNSQ_HTTPS):
+    return "A+AAAA+HTTPS";
+  case (CURL_DNSQ_A | CURL_DNSQ_AAAA):
+    return "A+AAAA";
+  case (CURL_DNSQ_AAAA | CURL_DNSQ_HTTPS):
+    return "AAAA+HTTPS";
+  case (CURL_DNSQ_AAAA):
+    return "AAAA";
+  case (CURL_DNSQ_A | CURL_DNSQ_HTTPS):
+    return "A+HTTPS";
+  case (CURL_DNSQ_A):
+    return "A";
+  case (CURL_DNSQ_HTTPS):
+    return "HTTPS";
+  case 0:
+    return "-";
+  default:
+    DEBUGASSERT(0);
+    return "???";
+  }
+}
+#endif
 
 /*
  * Curl_printable_address() stores a printable version of the 1st address
@@ -138,14 +182,14 @@ void Curl_printable_address(const struct Curl_addrinfo *ai, char *buf,
   case AF_INET: {
     const struct sockaddr_in *sa4 = (const void *)ai->ai_addr;
     const struct in_addr *ipaddr4 = &sa4->sin_addr;
-    (void)Curl_inet_ntop(ai->ai_family, (const void *)ipaddr4, buf, bufsize);
+    (void)curlx_inet_ntop(ai->ai_family, (const void *)ipaddr4, buf, bufsize);
     break;
   }
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
   case AF_INET6: {
     const struct sockaddr_in6 *sa6 = (const void *)ai->ai_addr;
     const struct in6_addr *ipaddr6 = &sa6->sin6_addr;
-    (void)Curl_inet_ntop(ai->ai_family, (const void *)ipaddr6, buf, bufsize);
+    (void)curlx_inet_ntop(ai->ai_family, (const void *)ipaddr6, buf, bufsize);
     break;
   }
 #endif
@@ -154,370 +198,17 @@ void Curl_printable_address(const struct Curl_addrinfo *ai, char *buf,
   }
 }
 
-/*
- * Create a hostcache id string for the provided host + port, to be used by
- * the DNS caching. Without alloc. Return length of the id string.
- */
-static size_t
-create_hostcache_id(const char *name,
-                    size_t nlen, /* 0 or actual name length */
-                    int port, char *ptr, size_t buflen)
-{
-  size_t len = nlen ? nlen : strlen(name);
-  size_t olen = 0;
-  DEBUGASSERT(buflen >= MAX_HOSTCACHE_LEN);
-  if(len > (buflen - 7))
-    len = buflen - 7;
-  /* store and lower case the name */
-  while(len--) {
-    *ptr++ = Curl_raw_tolower(*name++);
-    olen++;
-  }
-  olen += msnprintf(ptr, 7, ":%u", port);
-  return olen;
-}
-
-struct hostcache_prune_data {
-  time_t now;
-  time_t oldest; /* oldest time in cache not pruned. */
-  int cache_timeout;
-};
-
-/*
- * This function is set as a callback to be called for every entry in the DNS
- * cache when we want to prune old unused entries.
- *
- * Returning non-zero means remove the entry, return 0 to keep it in the
- * cache.
- */
-static int
-hostcache_timestamp_remove(void *datap, void *hc)
-{
-  struct hostcache_prune_data *prune =
-    (struct hostcache_prune_data *) datap;
-  struct Curl_dns_entry *c = (struct Curl_dns_entry *) hc;
-
-  if(c->timestamp) {
-    /* age in seconds */
-    time_t age = prune->now - c->timestamp;
-    if(age >= prune->cache_timeout)
-      return TRUE;
-    if(age > prune->oldest)
-      prune->oldest = age;
-  }
-  return FALSE;
-}
-
-/*
- * Prune the DNS cache. This assumes that a lock has already been taken.
- * Returns the 'age' of the oldest still kept entry.
- */
-static time_t
-hostcache_prune(struct Curl_hash *hostcache, int cache_timeout,
-                time_t now)
-{
-  struct hostcache_prune_data user;
-
-  user.cache_timeout = cache_timeout;
-  user.now = now;
-  user.oldest = 0;
-
-  Curl_hash_clean_with_criterium(hostcache,
-                                 (void *) &user,
-                                 hostcache_timestamp_remove);
-
-  return user.oldest;
-}
-
-/*
- * Library-wide function for pruning the DNS cache. This function takes and
- * returns the appropriate locks.
- */
-void Curl_hostcache_prune(struct Curl_easy *data)
-{
-  time_t now;
-  /* the timeout may be set -1 (forever) */
-  int timeout = data->set.dns_cache_timeout;
-
-  if(!data->dns.hostcache)
-    /* NULL hostcache means we can't do it */
-    return;
-
-  if(data->share)
-    Curl_share_lock(data, CURL_LOCK_DATA_DNS, CURL_LOCK_ACCESS_SINGLE);
-
-  time(&now);
-
-  do {
-    /* Remove outdated and unused entries from the hostcache */
-    time_t oldest = hostcache_prune(data->dns.hostcache, timeout, now);
-
-    if(oldest < INT_MAX)
-      timeout = (int)oldest; /* we know it fits */
-    else
-      timeout = INT_MAX - 1;
-
-    /* if the cache size is still too big, use the oldest age as new
-       prune limit */
-  } while(timeout && (data->dns.hostcache->size > MAX_DNS_CACHE_SIZE));
-
-  if(data->share)
-    Curl_share_unlock(data, CURL_LOCK_DATA_DNS);
-}
-
 #ifdef USE_ALARM_TIMEOUT
 /* Beware this is a global and unique instance. This is used to store the
    return address that we can jump back to from inside a signal handler. This
    is not thread-safe stuff. */
 static sigjmp_buf curl_jmpenv;
-static curl_simple_lock curl_jmpenv_lock;
+static curl_simple_lock curl_jmpenv_lock = CURL_SIMPLE_LOCK_INIT;
 #endif
 
-/* lookup address, returns entry if found and not stale */
-static struct Curl_dns_entry *fetch_addr(struct Curl_easy *data,
-                                         const char *hostname,
-                                         int port)
-{
-  struct Curl_dns_entry *dns = NULL;
-  char entry_id[MAX_HOSTCACHE_LEN];
-
-  /* Create an entry id, based upon the hostname and port */
-  size_t entry_len = create_hostcache_id(hostname, 0, port,
-                                         entry_id, sizeof(entry_id));
-
-  /* See if its already in our dns cache */
-  dns = Curl_hash_pick(data->dns.hostcache, entry_id, entry_len + 1);
-
-  /* No entry found in cache, check if we might have a wildcard entry */
-  if(!dns && data->state.wildcard_resolve) {
-    entry_len = create_hostcache_id("*", 1, port, entry_id, sizeof(entry_id));
-
-    /* See if it's already in our dns cache */
-    dns = Curl_hash_pick(data->dns.hostcache, entry_id, entry_len + 1);
-  }
-
-  if(dns && (data->set.dns_cache_timeout != -1)) {
-    /* See whether the returned entry is stale. Done before we release lock */
-    struct hostcache_prune_data user;
-
-    time(&user.now);
-    user.cache_timeout = data->set.dns_cache_timeout;
-    user.oldest = 0;
-
-    if(hostcache_timestamp_remove(&user, dns)) {
-      infof(data, "Hostname in DNS cache was stale, zapped");
-      dns = NULL; /* the memory deallocation is being handled by the hash */
-      Curl_hash_delete(data->dns.hostcache, entry_id, entry_len + 1);
-    }
-  }
-
-  /* See if the returned entry matches the required resolve mode */
-  if(dns && data->conn->ip_version != CURL_IPRESOLVE_WHATEVER) {
-    int pf = PF_INET;
-    bool found = false;
-    struct Curl_addrinfo *addr = dns->addr;
-
-#ifdef PF_INET6
-    if(data->conn->ip_version == CURL_IPRESOLVE_V6)
-      pf = PF_INET6;
-#endif
-
-    while(addr) {
-      if(addr->ai_family == pf) {
-        found = true;
-        break;
-      }
-      addr = addr->ai_next;
-    }
-
-    if(!found) {
-      infof(data, "Hostname in DNS cache doesn't have needed family, zapped");
-      dns = NULL; /* the memory deallocation is being handled by the hash */
-      Curl_hash_delete(data->dns.hostcache, entry_id, entry_len + 1);
-    }
-  }
-  return dns;
-}
-
-/*
- * Curl_fetch_addr() fetches a 'Curl_dns_entry' already in the DNS cache.
- *
- * Curl_resolv() checks initially and multi_runsingle() checks each time
- * it discovers the handle in the state WAITRESOLVE whether the hostname
- * has already been resolved and the address has already been stored in
- * the DNS cache. This short circuits waiting for a lot of pending
- * lookups for the same hostname requested by different handles.
- *
- * Returns the Curl_dns_entry entry pointer or NULL if not in the cache.
- *
- * The returned data *MUST* be "unlocked" with Curl_resolv_unlock() after
- * use, or we'll leak memory!
- */
-struct Curl_dns_entry *
-Curl_fetch_addr(struct Curl_easy *data,
-                const char *hostname,
-                int port)
-{
-  struct Curl_dns_entry *dns = NULL;
-
-  if(data->share)
-    Curl_share_lock(data, CURL_LOCK_DATA_DNS, CURL_LOCK_ACCESS_SINGLE);
-
-  dns = fetch_addr(data, hostname, port);
-
-  if(dns)
-    dns->inuse++; /* we use it! */
-
-  if(data->share)
-    Curl_share_unlock(data, CURL_LOCK_DATA_DNS);
-
-  return dns;
-}
-
-#ifndef CURL_DISABLE_SHUFFLE_DNS
-/*
- * Return # of addresses in a Curl_addrinfo struct
- */
-static int num_addresses(const struct Curl_addrinfo *addr)
-{
-  int i = 0;
-  while(addr) {
-    addr = addr->ai_next;
-    i++;
-  }
-  return i;
-}
-
-UNITTEST CURLcode Curl_shuffle_addr(struct Curl_easy *data,
-                                    struct Curl_addrinfo **addr);
-/*
- * Curl_shuffle_addr() shuffles the order of addresses in a 'Curl_addrinfo'
- * struct by re-linking its linked list.
- *
- * The addr argument should be the address of a pointer to the head node of a
- * `Curl_addrinfo` list and it will be modified to point to the new head after
- * shuffling.
- *
- * Not declared static only to make it easy to use in a unit test!
- *
- * @unittest: 1608
- */
-UNITTEST CURLcode Curl_shuffle_addr(struct Curl_easy *data,
-                                    struct Curl_addrinfo **addr)
-{
-  CURLcode result = CURLE_OK;
-  const int num_addrs = num_addresses(*addr);
-
-  if(num_addrs > 1) {
-    struct Curl_addrinfo **nodes;
-    infof(data, "Shuffling %i addresses", num_addrs);
-
-    nodes = malloc(num_addrs*sizeof(*nodes));
-    if(nodes) {
-      int i;
-      unsigned int *rnd;
-      const size_t rnd_size = num_addrs * sizeof(*rnd);
-
-      /* build a plain array of Curl_addrinfo pointers */
-      nodes[0] = *addr;
-      for(i = 1; i < num_addrs; i++) {
-        nodes[i] = nodes[i-1]->ai_next;
-      }
-
-      rnd = malloc(rnd_size);
-      if(rnd) {
-        /* Fisher-Yates shuffle */
-        if(Curl_rand(data, (unsigned char *)rnd, rnd_size) == CURLE_OK) {
-          struct Curl_addrinfo *swap_tmp;
-          for(i = num_addrs - 1; i > 0; i--) {
-            swap_tmp = nodes[rnd[i] % (i + 1)];
-            nodes[rnd[i] % (i + 1)] = nodes[i];
-            nodes[i] = swap_tmp;
-          }
-
-          /* relink list in the new order */
-          for(i = 1; i < num_addrs; i++) {
-            nodes[i-1]->ai_next = nodes[i];
-          }
-
-          nodes[num_addrs-1]->ai_next = NULL;
-          *addr = nodes[0];
-        }
-        free(rnd);
-      }
-      else
-        result = CURLE_OUT_OF_MEMORY;
-      free(nodes);
-    }
-    else
-      result = CURLE_OUT_OF_MEMORY;
-  }
-  return result;
-}
-#endif
-
-/*
- * Curl_cache_addr() stores a 'Curl_addrinfo' struct in the DNS cache.
- *
- * When calling Curl_resolv() has resulted in a response with a returned
- * address, we call this function to store the information in the dns
- * cache etc
- *
- * Returns the Curl_dns_entry entry pointer or NULL if the storage failed.
- */
-struct Curl_dns_entry *
-Curl_cache_addr(struct Curl_easy *data,
-                struct Curl_addrinfo *addr,
-                const char *hostname,
-                size_t hostlen, /* length or zero */
-                int port)
-{
-  char entry_id[MAX_HOSTCACHE_LEN];
-  size_t entry_len;
-  struct Curl_dns_entry *dns;
-  struct Curl_dns_entry *dns2;
-
-#ifndef CURL_DISABLE_SHUFFLE_DNS
-  /* shuffle addresses if requested */
-  if(data->set.dns_shuffle_addresses) {
-    CURLcode result = Curl_shuffle_addr(data, &addr);
-    if(result)
-      return NULL;
-  }
-#endif
-
-  /* Create a new cache entry */
-  dns = calloc(1, sizeof(struct Curl_dns_entry));
-  if(!dns) {
-    return NULL;
-  }
-
-  /* Create an entry id, based upon the hostname and port */
-  entry_len = create_hostcache_id(hostname, hostlen, port,
-                                  entry_id, sizeof(entry_id));
-
-  dns->inuse = 1;   /* the cache has the first reference */
-  dns->addr = addr; /* this is the address(es) */
-  time(&dns->timestamp);
-  if(dns->timestamp == 0)
-    dns->timestamp = 1;   /* zero indicates permanent CURLOPT_RESOLVE entry */
-
-  /* Store the resolved data in our DNS cache. */
-  dns2 = Curl_hash_add(data->dns.hostcache, entry_id, entry_len + 1,
-                       (void *)dns);
-  if(!dns2) {
-    free(dns);
-    return NULL;
-  }
-
-  dns = dns2;
-  dns->inuse++;         /* mark entry as in-use */
-  return dns;
-}
-
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
 /* return a static IPv6 ::1 for the name */
-static struct Curl_addrinfo *get_localhost6(int port, const char *name)
+static struct Curl_addrinfo *get_localhost6(uint16_t port, const char *name)
 {
   struct Curl_addrinfo *ca;
   const size_t ss_size = sizeof(struct sockaddr_in6);
@@ -525,16 +216,15 @@ static struct Curl_addrinfo *get_localhost6(int port, const char *name)
   struct sockaddr_in6 sa6;
   unsigned char ipv6[16];
   unsigned short port16 = (unsigned short)(port & 0xffff);
-  ca = calloc(sizeof(struct Curl_addrinfo) + ss_size + hostlen + 1, 1);
+  ca = curlx_calloc(1, sizeof(struct Curl_addrinfo) + ss_size + hostlen + 1);
   if(!ca)
     return NULL;
 
+  memset(&sa6, 0, sizeof(sa6));
   sa6.sin6_family = AF_INET6;
   sa6.sin6_port = htons(port16);
-  sa6.sin6_flowinfo = 0;
-  sa6.sin6_scope_id = 0;
-  if(Curl_inet_pton(AF_INET6, "::1", ipv6) < 1)
-    return NULL;
+
+  (void)curlx_inet_pton(AF_INET6, "::1", ipv6);
   memcpy(&sa6.sin6_addr, ipv6, sizeof(ipv6));
 
   ca->ai_flags     = 0;
@@ -546,15 +236,15 @@ static struct Curl_addrinfo *get_localhost6(int port, const char *name)
   ca->ai_addr = (void *)((char *)ca + sizeof(struct Curl_addrinfo));
   memcpy(ca->ai_addr, &sa6, ss_size);
   ca->ai_canonname = (char *)ca->ai_addr + ss_size;
-  strcpy(ca->ai_canonname, name);
+  curlx_strcopy(ca->ai_canonname, hostlen + 1, name, hostlen);
   return ca;
 }
 #else
-#define get_localhost6(x,y) NULL
+#define get_localhost6(x, y) NULL
 #endif
 
 /* return a static IPv4 127.0.0.1 for the given name */
-static struct Curl_addrinfo *get_localhost(int port, const char *name)
+static struct Curl_addrinfo *get_localhost(uint16_t port, const char *name)
 {
   struct Curl_addrinfo *ca;
   struct Curl_addrinfo *ca6;
@@ -568,11 +258,11 @@ static struct Curl_addrinfo *get_localhost(int port, const char *name)
   memset(&sa, 0, sizeof(sa));
   sa.sin_family = AF_INET;
   sa.sin_port = htons(port16);
-  if(Curl_inet_pton(AF_INET, "127.0.0.1", (char *)&ipv4) < 1)
+  if(curlx_inet_pton(AF_INET, "127.0.0.1", (char *)&ipv4) < 1)
     return NULL;
   memcpy(&sa.sin_addr, &ipv4, sizeof(ipv4));
 
-  ca = calloc(sizeof(struct Curl_addrinfo) + ss_size + hostlen + 1, 1);
+  ca = curlx_calloc(1, sizeof(struct Curl_addrinfo) + ss_size + hostlen + 1);
   if(!ca)
     return NULL;
   ca->ai_flags     = 0;
@@ -583,7 +273,7 @@ static struct Curl_addrinfo *get_localhost(int port, const char *name)
   ca->ai_addr = (void *)((char *)ca + sizeof(struct Curl_addrinfo));
   memcpy(ca->ai_addr, &sa, ss_size);
   ca->ai_canonname = (char *)ca->ai_addr + ss_size;
-  strcpy(ca->ai_canonname, name);
+  curlx_strcopy(ca->ai_canonname, hostlen + 1, name, hostlen);
 
   ca6 = get_localhost6(port, name);
   if(!ca6)
@@ -592,39 +282,36 @@ static struct Curl_addrinfo *get_localhost(int port, const char *name)
   return ca6;
 }
 
-#ifdef ENABLE_IPV6
-/*
- * Curl_ipv6works() returns TRUE if IPv6 seems to work.
- */
-bool Curl_ipv6works(struct Curl_easy *data)
+#ifdef USE_IPV6
+/* the nature of most systems is that IPv6 status does not come and go during a
+   program's lifetime so we only probe the first time and then we have the
+   info kept for fast reuse */
+CURLcode Curl_probeipv6(struct Curl_multi *multi)
 {
-  if(data) {
-    /* the nature of most system is that IPv6 status doesn't come and go
-       during a program's lifetime so we only probe the first time and then we
-       have the info kept for fast reuse */
-    DEBUGASSERT(data);
-    DEBUGASSERT(data->multi);
-    if(data->multi->ipv6_up == IPV6_UNKNOWN) {
-      bool works = Curl_ipv6works(NULL);
-      data->multi->ipv6_up = works ? IPV6_WORKS : IPV6_DEAD;
-    }
-    return data->multi->ipv6_up == IPV6_WORKS;
+  /* probe to see if we have a working IPv6 stack */
+  curl_socket_t s = CURL_SOCKET(PF_INET6, SOCK_DGRAM, 0);
+  multi->ipv6_works = FALSE;
+  if(s == CURL_SOCKET_BAD) {
+    if(SOCKERRNO == SOCKENOMEM)
+      return CURLE_OUT_OF_MEMORY;
   }
   else {
-    int ipv6_works = -1;
-    /* probe to see if we have a working IPv6 stack */
-    curl_socket_t s = socket(PF_INET6, SOCK_DGRAM, 0);
-    if(s == CURL_SOCKET_BAD)
-      /* an IPv6 address was requested but we can't get/use one */
-      ipv6_works = 0;
-    else {
-      ipv6_works = 1;
-      sclose(s);
-    }
-    return (ipv6_works>0)?TRUE:FALSE;
+    multi->ipv6_works = TRUE;
+    sclose(s);
   }
+  return CURLE_OK;
 }
-#endif /* ENABLE_IPV6 */
+
+/*
+ * ipv6works() returns TRUE if IPv6 seems to work.
+ */
+static bool ipv6works(struct Curl_easy *data)
+{
+  DEBUGASSERT(data);
+  DEBUGASSERT(data->multi);
+  return data ? data->multi->ipv6_works : FALSE;
+}
+#endif /* USE_IPV6 */
 
 /*
  * Curl_host_is_ipnum() returns TRUE if the given string is a numerical IPv4
@@ -633,255 +320,488 @@ bool Curl_ipv6works(struct Curl_easy *data)
 bool Curl_host_is_ipnum(const char *hostname)
 {
   struct in_addr in;
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
   struct in6_addr in6;
 #endif
-  if(Curl_inet_pton(AF_INET, hostname, &in) > 0
-#ifdef ENABLE_IPV6
-     || Curl_inet_pton(AF_INET6, hostname, &in6) > 0
+  if(curlx_inet_pton(AF_INET, hostname, &in) > 0
+#ifdef USE_IPV6
+     || curlx_inet_pton(AF_INET6, hostname, &in6) > 0
 #endif
     )
     return TRUE;
   return FALSE;
 }
 
-
 /* return TRUE if 'part' is a case insensitive tail of 'full' */
-static bool tailmatch(const char *full, const char *part)
+static bool tailmatch(const char *full, size_t flen,
+                      const char *part, size_t plen)
 {
-  size_t plen = strlen(part);
-  size_t flen = strlen(full);
   if(plen > flen)
     return FALSE;
-  return strncasecompare(part, &full[flen - plen], plen);
+  return curl_strnequal(part, &full[flen - plen], plen);
 }
 
-/*
- * Curl_resolv() is the main name resolve function within libcurl. It resolves
- * a name and returns a pointer to the entry in the 'entry' argument (if one
- * is provided). This function might return immediately if we're using asynch
- * resolves. See the return codes.
- *
- * The cache entry we return will get its 'inuse' counter increased when this
- * function is used. You MUST call Curl_resolv_unlock() later (when you're
- * done using this struct) to decrease the counter again.
- *
- * Return codes:
- *
- * CURLRESOLV_ERROR   (-1) = error, no pointer
- * CURLRESOLV_RESOLVED (0) = OK, pointer provided
- * CURLRESOLV_PENDING  (1) = waiting for response, no pointer
- */
-
-enum resolve_t Curl_resolv(struct Curl_easy *data,
-                           const char *hostname,
-                           int port,
-                           bool allowDOH,
-                           struct Curl_dns_entry **entry)
+static CURLcode hostip_resolv_failed(struct Curl_easy *data,
+                                     const char *hostname,
+                                     bool for_proxy)
 {
-  struct Curl_dns_entry *dns = NULL;
-  CURLcode result;
-  enum resolve_t rc = CURLRESOLV_ERROR; /* default to failure */
-  struct connectdata *conn = data->conn;
-  /* We should intentionally error and not resolve .onion TLDs */
-  size_t hostname_len = strlen(hostname);
-  if(hostname_len >= 7 &&
-     (curl_strequal(&hostname[hostname_len - 6], ".onion") ||
-      curl_strequal(&hostname[hostname_len - 7], ".onion."))) {
-    failf(data, "Not resolving .onion address (RFC 7686)");
-    return CURLRESOLV_ERROR;
+  failf(data, "Could not resolve %s: %s",
+        for_proxy ? "proxy" : "host", hostname);
+  return RESOLV_FAIL(for_proxy);
+}
+
+static bool can_resolve_dns_queries(struct Curl_easy *data,
+                                    uint8_t dns_queries)
+{
+  (void)data;
+  if((CURL_DNSQ_IP(dns_queries) == CURL_DNSQ_AAAA) && !ipv6works(data))
+    return FALSE;
+  return TRUE;
+}
+
+CURLcode Curl_resolv_announce_start(struct Curl_easy *data,
+                                    void *resolver)
+{
+  if(data->set.resolver_start) {
+    int rc;
+
+    CURL_TRC_DNS(data, "announcing resolve to application");
+    Curl_set_in_callback(data, TRUE);
+    rc = data->set.resolver_start(resolver, NULL,
+                                  data->set.resolver_start_client);
+    Curl_set_in_callback(data, FALSE);
+    if(rc) {
+      CURL_TRC_DNS(data, "application aborted resolve");
+      return CURLE_ABORTED_BY_CALLBACK;
+    }
   }
-  *entry = NULL;
+  return CURLE_OK;
+}
+
+#ifdef USE_CURL_ASYNC
+
+static struct Curl_resolv_async *hostip_async_new(struct Curl_easy *data,
+                                                  uint8_t dns_queries,
+                                                  const char *hostname,
+                                                  uint16_t port,
+                                                  uint8_t transport,
+                                                  bool for_proxy,
+                                                  timediff_t timeout_ms)
+{
+  struct Curl_resolv_async *async;
+  size_t hostlen = strlen(hostname);
+
+  if(!data->multi) {
+    DEBUGASSERT(0);
+    return NULL;
+  }
+
+  /* struct size already includes the NUL for hostname */
+  async = curlx_calloc(1, sizeof(*async) + hostlen);
+  if(!async)
+    return NULL;
+
+  /* Give every async resolve operation a "unique" id. This may
+   * wrap around after a long time, making collisions highly unlikely.
+   * As we keep the async structs at the easy handle, chances of
+   * easy `mid plus resolv->id` colliding should be astronomical.
+   * `resolv_id == 0` is never used. */
+  if(data->multi->last_resolv_id == UINT32_MAX)
+    data->multi->last_resolv_id = 1; /* wrap around */
+  else
+    data->multi->last_resolv_id++;
+  async->id = data->multi->last_resolv_id;
+  async->dns_queries = dns_queries;
+  async->port = port;
+  async->transport = transport;
+  async->for_proxy = for_proxy;
+  async->start = *Curl_pgrs_now(data);
+  async->timeout_ms = timeout_ms;
+  if(hostlen) {
+    memcpy(async->hostname, hostname, hostlen);
+    async->is_ipaddr = Curl_is_ipaddr(async->hostname);
+    if(async->is_ipaddr)
+      async->is_ipv4addr = Curl_is_ipv4addr(async->hostname);
+  }
+
+  return async;
+}
+
+static CURLcode hostip_resolv_take_result(struct Curl_easy *data,
+                                          struct Curl_resolv_async *async,
+                                          struct Curl_dns_entry **pdns)
+{
+  CURLcode result;
+
+  /* If async resolving is ongoing, this must be set */
+  if(!async)
+    return CURLE_FAILED_INIT;
+
 #ifndef CURL_DISABLE_DOH
-  conn->bits.doh = FALSE; /* default is not */
+  if(async->doh)
+    result = Curl_doh_take_result(data, async, pdns);
+  else
+#endif
+  result = Curl_async_take_result(data, async, pdns);
+
+  if(result == CURLE_AGAIN) {
+    CURL_TRC_DNS(data, "resolve incomplete, queries=%s, responses=%s, "
+                 "ongoing=%d for %s:%d",
+                 Curl_resolv_query_str(async->dns_queries),
+                 Curl_resolv_query_str(async->dns_responses),
+                 async->queries_ongoing, async->hostname, async->port);
+    result = CURLE_OK;
+  }
+  else if(result) {
+    result = Curl_async_failed(data, async, NULL);
+  }
+  else {
+    CURL_TRC_DNS(data, "resolve complete for %s:%u",
+                 async->hostname, async->port);
+    DEBUGASSERT(*pdns);
+  }
+
+  return result;
+}
+
+timediff_t Curl_resolv_elapsed_ms(struct Curl_easy *data,
+                                  uint32_t resolv_id)
+{
+  struct Curl_resolv_async *async = Curl_async_get(data, resolv_id);
+  if(!async)
+    return CURL_TIMEOUT_RESOLVE_MS;
+  return curlx_ptimediff_ms(Curl_pgrs_now(data), &async->start);
+}
+
+bool Curl_resolv_has_answers(struct Curl_easy *data,
+                             uint32_t resolv_id, uint8_t dns_queries)
+{
+  struct Curl_resolv_async *async = Curl_async_get(data, resolv_id);
+  uint8_t check_queries;
+  /* a no longer existing/running resolve has all answers. */
+  if(!async || async->done)
+    return TRUE;
+  /* Relevant are only queries undertaken. Others are considered answered. */
+  check_queries = (dns_queries & async->dns_queries);
+  if((check_queries & async->dns_responses) != check_queries) {
+    return FALSE;
+  }
+  return TRUE;
+}
+
+const struct Curl_addrinfo *Curl_resolv_get_ai(struct Curl_easy *data,
+                                               uint32_t resolv_id,
+                                               int ai_family,
+                                               unsigned int index)
+{
+  struct Curl_resolv_async *async = Curl_async_get(data, resolv_id);
+  (void)index;
+  if(!async)
+    return NULL;
+  if((ai_family == AF_INET) && !(async->dns_queries & CURL_DNSQ_A))
+    return NULL;
+#ifdef USE_IPV6
+  if((ai_family == AF_INET6) && !(async->dns_queries & CURL_DNSQ_AAAA))
+    return NULL;
+#endif
+  return Curl_async_get_ai(data, async, ai_family, index);
+}
+
+#ifdef USE_HTTPSRR
+const struct Curl_https_rrinfo *
+Curl_resolv_get_https(struct Curl_easy *data, uint32_t resolv_id)
+{
+  struct Curl_resolv_async *async = Curl_async_get(data, resolv_id);
+  if(!async)
+    return NULL;
+  return Curl_async_get_https(data, async);
+}
+
+bool Curl_resolv_knows_https(struct Curl_easy *data, uint32_t resolv_id)
+{
+  struct Curl_resolv_async *async = Curl_async_get(data, resolv_id);
+  if(!async)
+    return TRUE;
+  return Curl_async_knows_https(data, async);
+}
+#endif /* USE_HTTPSRR */
+
+#endif /* USE_CURL_ASYNC */
+
+static CURLcode hostip_resolv_start(struct Curl_easy *data,
+                                    uint8_t dns_queries,
+                                    const char *hostname,
+                                    uint16_t port,
+                                    uint8_t transport,
+                                    bool for_proxy,
+                                    timediff_t timeout_ms,
+                                    bool allowDOH,
+                                    uint32_t *presolv_id,
+                                    struct Curl_dns_entry **pdns)
+{
+#ifdef USE_CURL_ASYNC
+  struct Curl_resolv_async *async = NULL;
+#endif
+  struct Curl_addrinfo *addr = NULL;
+  size_t hostname_len;
+  CURLcode result = CURLE_OK;
+
+  (void)timeout_ms; /* not in all ifdefs */
+  *presolv_id = 0;
+  *pdns = NULL;
+
+  /* Check for "known" things to resolve ourselves. */
+#ifndef USE_RESOLVE_ON_IPS
+  if(Curl_is_ipaddr(hostname)) {
+    /* test655 verifies that the announce is done, even though there
+     * is no real resolving. So, keep doing this. */
+    result = Curl_resolv_announce_start(data, NULL);
+    if(result)
+      goto out;
+    /* shortcut literal IP addresses, if we are not told to resolve them. */
+    result = Curl_str2addr(hostname, port, &addr);
+    goto out;
+  }
+#endif
+
+  hostname_len = strlen(hostname);
+  if(curl_strequal(hostname, "localhost") ||
+     curl_strequal(hostname, "localhost.") ||
+     tailmatch(hostname, hostname_len, STRCONST(".localhost")) ||
+     tailmatch(hostname, hostname_len, STRCONST(".localhost."))) {
+    result = Curl_resolv_announce_start(data, NULL);
+    if(result)
+      goto out;
+    addr = get_localhost(port, hostname);
+    if(!addr)
+      result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+#ifndef CURL_DISABLE_DOH
+  if(!Curl_is_ipaddr(hostname) && allowDOH && data->set.doh) {
+    result = Curl_resolv_announce_start(data, NULL);
+    if(result)
+      goto out;
+    if(!async) {
+      async = hostip_async_new(data, dns_queries, hostname, port,
+                               transport, for_proxy, timeout_ms);
+      if(!async) {
+        result = CURLE_OUT_OF_MEMORY;
+        goto out;
+      }
+    }
+    result = Curl_doh(data, async);
+    goto out;
+  }
 #else
   (void)allowDOH;
 #endif
 
-  if(data->share)
-    Curl_share_lock(data, CURL_LOCK_DATA_DNS, CURL_LOCK_ACCESS_SINGLE);
-
-  dns = fetch_addr(data, hostname, port);
-
-  if(dns) {
-    infof(data, "Hostname %s was found in DNS cache", hostname);
-    dns->inuse++; /* we use it! */
-    rc = CURLRESOLV_RESOLVED;
+  /* Can we provide the requested IP specifics in resolving? */
+  if(!can_resolve_dns_queries(data, dns_queries)) {
+    result = RESOLV_FAIL(for_proxy);
+    goto out;
   }
 
-  if(data->share)
-    Curl_share_unlock(data, CURL_LOCK_DATA_DNS);
-
-  if(!dns) {
-    /* The entry was not in the cache. Resolve it to IP address */
-
-    struct Curl_addrinfo *addr = NULL;
-    int respwait = 0;
-#if !defined(CURL_DISABLE_DOH) || !defined(USE_RESOLVE_ON_IPS)
-    struct in_addr in;
-#endif
-#ifndef CURL_DISABLE_DOH
-#ifndef USE_RESOLVE_ON_IPS
-    const
-#endif
-      bool ipnum = FALSE;
-#endif
-
-    /* notify the resolver start callback */
-    if(data->set.resolver_start) {
-      int st;
-      Curl_set_in_callback(data, true);
-      st = data->set.resolver_start(
-#ifdef USE_CURL_ASYNC
-        data->state.async.resolver,
+#ifdef CURLRES_ASYNCH
+  (void)addr;
+  if(!async) {
+    async = hostip_async_new(data, dns_queries, hostname, port,
+                             transport, for_proxy, timeout_ms);
+    if(!async) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+  }
+  result = Curl_async_getaddrinfo(data, async);
+  if(result == CURLE_AGAIN) {
+    /* the answer might be there already. Check. */
+    CURLcode r2 = hostip_resolv_take_result(data, async, pdns);
+    if(r2)
+      result = r2;
+    else if(*pdns)
+      result = CURLE_OK;
+  }
 #else
-        NULL,
+  result = Curl_resolv_announce_start(data, NULL);
+  if(result)
+    goto out;
+  addr = Curl_sync_getaddrinfo(data, dns_queries, hostname, port, transport);
+  if(!addr)
+    result = RESOLV_FAIL(for_proxy);
 #endif
-        NULL,
-        data->set.resolver_start_client);
-      Curl_set_in_callback(data, false);
-      if(st)
-        return CURLRESOLV_ERROR;
+
+out:
+  if(!result) {
+    if(addr) {
+      /* we got a response, create a dns entry, add to cache, return */
+      DEBUGASSERT(!*pdns);
+      *pdns = Curl_dnscache_mk_entry(data, dns_queries, &addr, hostname, port);
+      if(!*pdns)
+        result = CURLE_OUT_OF_MEMORY;
     }
+    else if(!*pdns)
+      result = CURLE_AGAIN;
+  }
+  else if(*pdns)
+    Curl_dns_entry_unlink(data, pdns);
+  else if(addr)
+    Curl_freeaddrinfo(addr);
 
-#ifndef USE_RESOLVE_ON_IPS
-    /* First check if this is an IPv4 address string */
-    if(Curl_inet_pton(AF_INET, hostname, &in) > 0)
-      /* This is a dotted IP address 123.123.123.123-style */
-      addr = Curl_ip2addr(AF_INET, &in, hostname, port);
-#ifdef ENABLE_IPV6
-    if(!addr) {
-      struct in6_addr in6;
-      /* check if this is an IPv6 address string */
-      if(Curl_inet_pton(AF_INET6, hostname, &in6) > 0)
-        /* This is an IPv6 address literal */
-        addr = Curl_ip2addr(AF_INET6, &in6, hostname, port);
-    }
-#endif /* ENABLE_IPV6 */
-
-#else /* if USE_RESOLVE_ON_IPS */
-#ifndef CURL_DISABLE_DOH
-    /* First check if this is an IPv4 address string */
-    if(Curl_inet_pton(AF_INET, hostname, &in) > 0)
-      /* This is a dotted IP address 123.123.123.123-style */
-      ipnum = TRUE;
-#ifdef ENABLE_IPV6
-    else {
-      struct in6_addr in6;
-      /* check if this is an IPv6 address string */
-      if(Curl_inet_pton(AF_INET6, hostname, &in6) > 0)
-        /* This is an IPv6 address literal */
-        ipnum = TRUE;
-    }
-#endif /* ENABLE_IPV6 */
-#endif /* CURL_DISABLE_DOH */
-
-#endif /* !USE_RESOLVE_ON_IPS */
-
-    if(!addr) {
-      if(conn->ip_version == CURL_IPRESOLVE_V6 && !Curl_ipv6works(data))
-        return CURLRESOLV_ERROR;
-
-      if(strcasecompare(hostname, "localhost") ||
-         tailmatch(hostname, ".localhost"))
-        addr = get_localhost(port, hostname);
-#ifndef CURL_DISABLE_DOH
-      else if(allowDOH && data->set.doh && !ipnum)
-        addr = Curl_doh(data, hostname, port, &respwait);
-#endif
-      else {
-        /* Check what IP specifics the app has requested and if we can provide
-         * it. If not, bail out. */
-        if(!Curl_ipvalid(data, conn))
-          return CURLRESOLV_ERROR;
-        /* If Curl_getaddrinfo() returns NULL, 'respwait' might be set to a
-           non-zero value indicating that we need to wait for the response to
-           the resolve call */
-        addr = Curl_getaddrinfo(data, hostname, port, &respwait);
-      }
-    }
-    if(!addr) {
-      if(respwait) {
-        /* the response to our resolve call will come asynchronously at
-           a later time, good or bad */
-        /* First, check that we haven't received the info by now */
-        result = Curl_resolv_check(data, &dns);
-        if(result) /* error detected */
-          return CURLRESOLV_ERROR;
-        if(dns)
-          rc = CURLRESOLV_RESOLVED; /* pointer provided */
-        else
-          rc = CURLRESOLV_PENDING; /* no info yet */
-      }
+#ifdef USE_CURL_ASYNC
+  if(async) {
+    if(result == CURLE_AGAIN) { /* still need it, link, return id. */
+      *presolv_id = async->id;
+      async->next = data->state.async;
+      data->state.async = async;
     }
     else {
-      if(data->share)
-        Curl_share_lock(data, CURL_LOCK_DATA_DNS, CURL_LOCK_ACCESS_SINGLE);
-
-      /* we got a response, store it in the cache */
-      dns = Curl_cache_addr(data, addr, hostname, 0, port);
-
-      if(data->share)
-        Curl_share_unlock(data, CURL_LOCK_DATA_DNS);
-
-      if(!dns)
-        /* returned failure, bail out nicely */
-        Curl_freeaddrinfo(addr);
-      else
-        rc = CURLRESOLV_RESOLVED;
+      Curl_async_destroy(data, async);
     }
   }
+#endif
+  return result;
+}
 
-  *entry = dns;
+static CURLcode hostip_resolv(struct Curl_easy *data,
+                              uint8_t dns_queries,
+                              const char *hostname,
+                              uint16_t port,
+                              uint8_t transport,
+                              bool for_proxy,
+                              timediff_t timeout_ms,
+                              bool allowDOH,
+                              uint32_t *presolv_id,
+                              struct Curl_dns_entry **pdns)
+{
+  size_t hostname_len;
+  CURLcode result = RESOLV_FAIL(for_proxy);
+  bool cache_dns = FALSE;
 
-  return rc;
+  (void)timeout_ms; /* not used in all ifdefs */
+  *presolv_id = 0;
+  *pdns = NULL;
+
+#ifdef CURL_DISABLE_DOH
+  (void)allowDOH;
+#endif
+
+  /* We should intentionally error and not resolve .onion TLDs */
+  hostname_len = strlen(hostname);
+  DEBUGASSERT(hostname_len);
+  if(hostname_len >= 7 &&
+     (curl_strequal(&hostname[hostname_len - 6], ".onion") ||
+      curl_strequal(&hostname[hostname_len - 7], ".onion."))) {
+    failf(data, "Not resolving .onion address (RFC 7686)");
+    goto out;
+  }
+
+#ifdef DEBUGBUILD
+  CURL_TRC_DNS(data, "hostip_resolv(%s:%u, queries=%s)",
+               hostname, port, Curl_resolv_query_str(dns_queries));
+  if((CURL_DNSQ_IP(dns_queries) == CURL_DNSQ_AAAA) &&
+     getenv("CURL_DBG_RESOLV_FAIL_IPV6")) {
+    infof(data, "DEBUG fail ipv6 resolve");
+    result = hostip_resolv_failed(data, hostname, for_proxy);
+    goto out;
+  }
+#endif
+  /* Let's check our DNS cache first */
+  result = Curl_dnscache_get(data, dns_queries, hostname, port, pdns);
+  if(*pdns) {
+    infof(data, "Hostname %s was found in DNS cache", hostname);
+    result = CURLE_OK;
+  }
+  else if(result) {
+    infof(data, "Negative DNS entry");
+    result = hostip_resolv_failed(data, hostname, for_proxy);
+  }
+  else {
+    /* No luck, we need to start resolving. */
+    cache_dns = TRUE;
+    result = hostip_resolv_start(data, dns_queries, hostname, port,
+                                 transport, for_proxy, timeout_ms, allowDOH,
+                                 presolv_id, pdns);
+  }
+
+out:
+  if(result && (result != CURLE_AGAIN)) {
+    Curl_dns_entry_unlink(data, pdns);
+    if(IS_RESOLV_FAIL(result)) {
+      if(cache_dns)
+        Curl_dnscache_add_negative(data, dns_queries, hostname, port);
+      failf(data, "Could not resolve: %s:%u", hostname, port);
+    }
+    else {
+      failf(data, "Error %d resolving %s:%u", (int)result, hostname, port);
+    }
+  }
+  else if(cache_dns && *pdns) {
+    result = Curl_dnscache_add(data, *pdns);
+    if(result)
+      Curl_dns_entry_unlink(data, pdns);
+  }
+
+  return result;
+}
+
+CURLcode Curl_resolv_blocking(struct Curl_easy *data,
+                              uint8_t dns_queries,
+                              const char *hostname,
+                              uint16_t port,
+                              uint8_t transport,
+                              struct Curl_dns_entry **pdns)
+{
+  CURLcode result;
+  uint32_t resolv_id;
+  DEBUGASSERT(hostname && *hostname);
+  *pdns = NULL;
+  /* We cannot do a blocking resolve using DoH currently */
+  result = hostip_resolv(data, dns_queries,
+                         hostname, port, transport, FALSE, 0, FALSE,
+                         &resolv_id, pdns);
+  switch(result) {
+  case CURLE_OK:
+    DEBUGASSERT(*pdns);
+    break;
+#ifdef USE_CURL_ASYNC
+  case CURLE_AGAIN:
+    DEBUGASSERT(!*pdns);
+    result = Curl_async_await(data, resolv_id, pdns);
+    Curl_resolv_destroy(data, resolv_id);
+    break;
+#endif
+  default:
+    break;
+  }
+  return result;
 }
 
 #ifdef USE_ALARM_TIMEOUT
 /*
  * This signal handler jumps back into the main libcurl code and continues
- * execution.  This effectively causes the remainder of the application to run
+ * execution. This effectively causes the remainder of the application to run
  * within a signal handler which is nonportable and could lead to problems.
  */
-static
-void alarmfunc(int sig)
+CURL_NORETURN static void alarmfunc(int sig)
 {
   (void)sig;
   siglongjmp(curl_jmpenv, 1);
 }
-#endif /* USE_ALARM_TIMEOUT */
 
-/*
- * Curl_resolv_timeout() is the same as Curl_resolv() but specifies a
- * timeout.  This function might return immediately if we're using asynch
- * resolves. See the return codes.
- *
- * The cache entry we return will get its 'inuse' counter increased when this
- * function is used. You MUST call Curl_resolv_unlock() later (when you're
- * done using this struct) to decrease the counter again.
- *
- * If built with a synchronous resolver and use of signals is not
- * disabled by the application, then a nonzero timeout will cause a
- * timeout after the specified number of milliseconds. Otherwise, timeout
- * is ignored.
- *
- * Return codes:
- *
- * CURLRESOLV_TIMEDOUT(-2) = warning, time too short or previous alarm expired
- * CURLRESOLV_ERROR   (-1) = error, no pointer
- * CURLRESOLV_RESOLVED (0) = OK, pointer provided
- * CURLRESOLV_PENDING  (1) = waiting for response, no pointer
- */
-
-enum resolve_t Curl_resolv_timeout(struct Curl_easy *data,
-                                   const char *hostname,
-                                   int port,
-                                   struct Curl_dns_entry **entry,
-                                   timediff_t timeoutms)
+static CURLcode resolv_alarm_timeout(struct Curl_easy *data,
+                                     uint8_t dns_queries,
+                                     const char *hostname,
+                                     uint16_t port,
+                                     uint8_t transport,
+                                     bool for_proxy,
+                                     timediff_t timeout_ms,
+                                     uint32_t *presolv_id,
+                                     struct Curl_dns_entry **entry)
 {
-#ifdef USE_ALARM_TIMEOUT
 #ifdef HAVE_SIGACTION
-  struct sigaction keep_sigact;   /* store the old struct here */
+  struct sigaction keep_sigact; /* store the old struct here */
   volatile bool keep_copysig = FALSE; /* whether old sigact has been saved */
   struct sigaction sigact;
 #else
@@ -891,46 +811,37 @@ enum resolve_t Curl_resolv_timeout(struct Curl_easy *data,
 #endif /* HAVE_SIGACTION */
   volatile long timeout;
   volatile unsigned int prev_alarm = 0;
-#endif /* USE_ALARM_TIMEOUT */
-  enum resolve_t rc;
+  CURLcode result;
+
+  DEBUGASSERT(hostname && *hostname);
+  DEBUGASSERT(timeout_ms > 0);
+  DEBUGASSERT(!data->set.no_signal);
+#ifndef CURL_DISABLE_DOH
+  DEBUGASSERT(!data->set.doh);
+#endif
 
   *entry = NULL;
-
-  if(timeoutms < 0)
-    /* got an already expired timeout */
-    return CURLRESOLV_TIMEDOUT;
-
-#ifdef USE_ALARM_TIMEOUT
-  if(data->set.no_signal)
-    /* Ignore the timeout when signals are disabled */
-    timeout = 0;
-  else
-    timeout = (timeoutms > LONG_MAX) ? LONG_MAX : (long)timeoutms;
-
-  if(!timeout)
-    /* USE_ALARM_TIMEOUT defined, but no timeout actually requested */
-    return Curl_resolv(data, hostname, port, TRUE, entry);
-
+  timeout = (timeout_ms > LONG_MAX) ? LONG_MAX : (long)timeout_ms;
   if(timeout < 1000) {
     /* The alarm() function only provides integer second resolution, so if
        we want to wait less than one second we must bail out already now. */
     failf(data,
-        "remaining timeout of %ld too small to resolve via SIGALRM method",
-        timeout);
-    return CURLRESOLV_TIMEDOUT;
+          "remaining timeout of %ld too small to resolve via SIGALRM method",
+          timeout);
+    return CURLE_OPERATION_TIMEDOUT;
   }
   /* This allows us to time-out from the name resolver, as the timeout
      will generate a signal and we will siglongjmp() from that here.
      This technique has problems (see alarmfunc).
      This should be the last thing we do before calling Curl_resolv(),
-     as otherwise we'd have to worry about variables that get modified
+     as otherwise we would have to worry about variables that get modified
      before we invoke Curl_resolv() (and thus use "volatile"). */
   curl_simple_lock_lock(&curl_jmpenv_lock);
 
   if(sigsetjmp(curl_jmpenv, 1)) {
     /* this is coming from a siglongjmp() after an alarm signal */
     failf(data, "name lookup timed out");
-    rc = CURLRESOLV_ERROR;
+    result = CURLE_OPERATION_TIMEDOUT;
     goto clean_up;
   }
   else {
@@ -944,7 +855,7 @@ enum resolve_t Curl_resolv_timeout(struct Curl_easy *data,
     keep_copysig = TRUE; /* yes, we have a copy */
     sigact.sa_handler = alarmfunc;
 #ifdef SA_RESTART
-    /* HPUX doesn't have SA_RESTART but defaults to that behavior! */
+    /* HP-UX does not have SA_RESTART but defaults to that behavior! */
     sigact.sa_flags &= ~SA_RESTART;
 #endif
     /* now set the new struct */
@@ -958,26 +869,15 @@ enum resolve_t Curl_resolv_timeout(struct Curl_easy *data,
 
     /* alarm() makes a signal get sent when the timeout fires off, and that
        will abort system calls */
-    prev_alarm = alarm(curlx_sltoui(timeout/1000L));
+    prev_alarm = alarm(curlx_sltoui(timeout / 1000L));
   }
 
-#else
-#ifndef CURLRES_ASYNCH
-  if(timeoutms)
-    infof(data, "timeout on name lookup is not supported");
-#else
-  (void)timeoutms; /* timeoutms not used with an async resolver */
-#endif
-#endif /* USE_ALARM_TIMEOUT */
-
   /* Perform the actual name resolution. This might be interrupted by an
-   * alarm if it takes too long.
-   */
-  rc = Curl_resolv(data, hostname, port, TRUE, entry);
+   * alarm if it takes too long. */
+  result = hostip_resolv(data, dns_queries, hostname, port, transport,
+                         for_proxy, timeout_ms, FALSE, presolv_id, entry);
 
-#ifdef USE_ALARM_TIMEOUT
 clean_up:
-
   if(!prev_alarm)
     /* deactivate a possibly active alarm before uninstalling the handler */
     alarm(0);
@@ -1001,380 +901,229 @@ clean_up:
      the time we spent until now! */
   if(prev_alarm) {
     /* there was an alarm() set before us, now put it back */
-    timediff_t elapsed_secs = Curl_timediff(Curl_now(),
-                                            data->conn->created) / 1000;
+    timediff_t elapsed_secs = curlx_ptimediff_ms(Curl_pgrs_now(data),
+                                                 &data->conn->created) / 1000;
 
     /* the alarm period is counted in even number of seconds */
     unsigned long alarm_set = (unsigned long)(prev_alarm - elapsed_secs);
 
     if(!alarm_set ||
-       ((alarm_set >= 0x80000000) && (prev_alarm < 0x80000000)) ) {
+       ((alarm_set >= 0x80000000) && (prev_alarm < 0x80000000))) {
       /* if the alarm time-left reached zero or turned "negative" (counted
          with unsigned values), we should fire off a SIGALRM here, but we
-         won't, and zero would be to switch it off so we never set it to
+         will not, and zero would be to switch it off so we never set it to
          less than 1! */
       alarm(1);
-      rc = CURLRESOLV_TIMEDOUT;
+      result = CURLE_OPERATION_TIMEDOUT;
       failf(data, "Previous alarm fired off");
     }
     else
       alarm((unsigned int)alarm_set);
   }
+
+  return result;
+}
+
 #endif /* USE_ALARM_TIMEOUT */
 
-  return rc;
-}
-
-/*
- * Curl_resolv_unlock() unlocks the given cached DNS entry. When this has been
- * made, the struct may be destroyed due to pruning. It is important that only
- * one unlock is made for each Curl_resolv() call.
- *
- * May be called with 'data' == NULL for global cache.
- */
-void Curl_resolv_unlock(struct Curl_easy *data, struct Curl_dns_entry *dns)
-{
-  if(data && data->share)
-    Curl_share_lock(data, CURL_LOCK_DATA_DNS, CURL_LOCK_ACCESS_SINGLE);
-
-  freednsentry(dns);
-
-  if(data && data->share)
-    Curl_share_unlock(data, CURL_LOCK_DATA_DNS);
-}
-
-/*
- * File-internal: release cache dns entry reference, free if inuse drops to 0
- */
-static void freednsentry(void *freethis)
-{
-  struct Curl_dns_entry *dns = (struct Curl_dns_entry *) freethis;
-  DEBUGASSERT(dns && (dns->inuse>0));
-
-  dns->inuse--;
-  if(dns->inuse == 0) {
-    Curl_freeaddrinfo(dns->addr);
-    free(dns);
-  }
-}
-
-/*
- * Curl_init_dnscache() inits a new DNS cache.
- */
-void Curl_init_dnscache(struct Curl_hash *hash, int size)
-{
-  Curl_hash_init(hash, size, Curl_hash_str, Curl_str_key_compare,
-                 freednsentry);
-}
-
-/*
- * Curl_hostcache_clean()
- *
- * This _can_ be called with 'data' == NULL but then of course no locking
- * can be done!
- */
-
-void Curl_hostcache_clean(struct Curl_easy *data,
-                          struct Curl_hash *hash)
-{
-  if(data && data->share)
-    Curl_share_lock(data, CURL_LOCK_DATA_DNS, CURL_LOCK_ACCESS_SINGLE);
-
-  Curl_hash_clean(hash);
-
-  if(data && data->share)
-    Curl_share_unlock(data, CURL_LOCK_DATA_DNS);
-}
-
-
-CURLcode Curl_loadhostpairs(struct Curl_easy *data)
-{
-  struct curl_slist *hostp;
-  char *host_end;
-
-  /* Default is no wildcard found */
-  data->state.wildcard_resolve = false;
-
-  for(hostp = data->state.resolve; hostp; hostp = hostp->next) {
-    char entry_id[MAX_HOSTCACHE_LEN];
-    if(!hostp->data)
-      continue;
-    if(hostp->data[0] == '-') {
-      unsigned long num = 0;
-      size_t entry_len;
-      size_t hlen = 0;
-      host_end = strchr(&hostp->data[1], ':');
-
-      if(host_end) {
-        hlen = host_end - &hostp->data[1];
-        num = strtoul(++host_end, NULL, 10);
-        if(!hlen || (num > 0xffff))
-          host_end = NULL;
-      }
-      if(!host_end) {
-        infof(data, "Bad syntax CURLOPT_RESOLVE removal entry '%s'",
-              hostp->data);
-        continue;
-      }
-      /* Create an entry id, based upon the hostname and port */
-      entry_len = create_hostcache_id(&hostp->data[1], hlen, (int)num,
-                                      entry_id, sizeof(entry_id));
-      if(data->share)
-        Curl_share_lock(data, CURL_LOCK_DATA_DNS, CURL_LOCK_ACCESS_SINGLE);
-
-      /* delete entry, ignore if it didn't exist */
-      Curl_hash_delete(data->dns.hostcache, entry_id, entry_len + 1);
-
-      if(data->share)
-        Curl_share_unlock(data, CURL_LOCK_DATA_DNS);
-    }
-    else {
-      struct Curl_dns_entry *dns;
-      struct Curl_addrinfo *head = NULL, *tail = NULL;
-      size_t entry_len;
-      char address[64];
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
-      char *addresses = NULL;
-#endif
-      char *addr_begin;
-      char *addr_end;
-      char *port_ptr;
-      int port = 0;
-      char *end_ptr;
-      bool permanent = TRUE;
-      unsigned long tmp_port;
-      bool error = true;
-      char *host_begin = hostp->data;
-      size_t hlen = 0;
-
-      if(host_begin[0] == '+') {
-        host_begin++;
-        permanent = FALSE;
-      }
-      host_end = strchr(host_begin, ':');
-      if(!host_end)
-        goto err;
-      hlen = host_end - host_begin;
-
-      port_ptr = host_end + 1;
-      tmp_port = strtoul(port_ptr, &end_ptr, 10);
-      if(tmp_port > USHRT_MAX || end_ptr == port_ptr || *end_ptr != ':')
-        goto err;
-
-      port = (int)tmp_port;
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
-      addresses = end_ptr + 1;
-#endif
-
-      while(*end_ptr) {
-        size_t alen;
-        struct Curl_addrinfo *ai;
-
-        addr_begin = end_ptr + 1;
-        addr_end = strchr(addr_begin, ',');
-        if(!addr_end)
-          addr_end = addr_begin + strlen(addr_begin);
-        end_ptr = addr_end;
-
-        /* allow IP(v6) address within [brackets] */
-        if(*addr_begin == '[') {
-          if(addr_end == addr_begin || *(addr_end - 1) != ']')
-            goto err;
-          ++addr_begin;
-          --addr_end;
-        }
-
-        alen = addr_end - addr_begin;
-        if(!alen)
-          continue;
-
-        if(alen >= sizeof(address))
-          goto err;
-
-        memcpy(address, addr_begin, alen);
-        address[alen] = '\0';
-
-#ifndef ENABLE_IPV6
-        if(strchr(address, ':')) {
-          infof(data, "Ignoring resolve address '%s', missing IPv6 support.",
-                address);
-          continue;
-        }
-#endif
-
-        ai = Curl_str2addr(address, port);
-        if(!ai) {
-          infof(data, "Resolve address '%s' found illegal", address);
-          goto err;
-        }
-
-        if(tail) {
-          tail->ai_next = ai;
-          tail = tail->ai_next;
-        }
-        else {
-          head = tail = ai;
-        }
-      }
-
-      if(!head)
-        goto err;
-
-      error = false;
-err:
-      if(error) {
-        failf(data, "Couldn't parse CURLOPT_RESOLVE entry '%s'",
-              hostp->data);
-        Curl_freeaddrinfo(head);
-        return CURLE_SETOPT_OPTION_SYNTAX;
-      }
-
-      /* Create an entry id, based upon the hostname and port */
-      entry_len = create_hostcache_id(host_begin, hlen, port,
-                                      entry_id, sizeof(entry_id));
-
-      if(data->share)
-        Curl_share_lock(data, CURL_LOCK_DATA_DNS, CURL_LOCK_ACCESS_SINGLE);
-
-      /* See if it's already in our dns cache */
-      dns = Curl_hash_pick(data->dns.hostcache, entry_id, entry_len + 1);
-
-      if(dns) {
-        infof(data, "RESOLVE %.*s:%d - old addresses discarded",
-              (int)hlen, host_begin, port);
-        /* delete old entry, there are two reasons for this
-         1. old entry may have different addresses.
-         2. even if entry with correct addresses is already in the cache,
-            but if it is close to expire, then by the time next http
-            request is made, it can get expired and pruned because old
-            entry is not necessarily marked as permanent.
-         3. when adding a non-permanent entry, we want it to remove and
-            replace an existing permanent entry.
-         4. when adding a non-permanent entry, we want it to get a "fresh"
-            timeout that starts _now_. */
-
-        Curl_hash_delete(data->dns.hostcache, entry_id, entry_len + 1);
-      }
-
-      /* put this new host in the cache */
-      dns = Curl_cache_addr(data, head, host_begin, hlen, port);
-      if(dns) {
-        if(permanent)
-          dns->timestamp = 0; /* mark as permanent */
-        /* release the returned reference; the cache itself will keep the
-         * entry alive: */
-        dns->inuse--;
-      }
-
-      if(data->share)
-        Curl_share_unlock(data, CURL_LOCK_DATA_DNS);
-
-      if(!dns) {
-        Curl_freeaddrinfo(head);
-        return CURLE_OUT_OF_MEMORY;
-      }
-      infof(data, "Added %.*s:%d:%s to DNS cache%s",
-            (int)hlen, host_begin, port, addresses,
-            permanent ? "" : " (non-permanent)");
-
-      /* Wildcard hostname */
-      if((hlen == 1) && (host_begin[0] == '*')) {
-        infof(data, "RESOLVE *:%d using wildcard", port);
-        data->state.wildcard_resolve = true;
-      }
-    }
-  }
-  data->state.resolve = NULL; /* dealt with now */
-
-  return CURLE_OK;
-}
-
-CURLcode Curl_resolv_check(struct Curl_easy *data,
-                           struct Curl_dns_entry **dns)
-{
-#if defined(CURL_DISABLE_DOH) && !defined(CURLRES_ASYNCH)
-  (void)data;
-  (void)dns;
-#endif
-#ifndef CURL_DISABLE_DOH
-  if(data->conn->bits.doh)
-    return Curl_doh_is_resolved(data, dns);
-#endif
-  return Curl_resolver_is_resolved(data, dns);
-}
-
-int Curl_resolv_getsock(struct Curl_easy *data,
-                        curl_socket_t *socks)
-{
-#ifdef CURLRES_ASYNCH
-#ifndef CURL_DISABLE_DOH
-  if(data->conn->bits.doh)
-    /* nothing to wait for during DoH resolve, those handles have their own
-       sockets */
-    return GETSOCK_BLANK;
-#endif
-  return Curl_resolver_getsock(data, socks);
-#else
-  (void)data;
-  (void)socks;
-  return GETSOCK_BLANK;
-#endif
-}
-
-/* Call this function after Curl_connect() has returned async=TRUE and
-   then a successful name resolve has been received.
-
-   Note: this function disconnects and frees the conn data in case of
-   resolve failure */
-CURLcode Curl_once_resolved(struct Curl_easy *data, bool *protocol_done)
+#ifdef USE_UNIX_SOCKETS
+static CURLcode resolv_unix(struct Curl_easy *data,
+                            const char *unix_path,
+                            bool abstract_path,
+                            struct Curl_dns_entry **pdns)
 {
+  struct Curl_addrinfo *addr;
   CURLcode result;
-  struct connectdata *conn = data->conn;
 
-#ifdef USE_CURL_ASYNC
-  if(data->state.async.dns) {
-    conn->dns_entry = data->state.async.dns;
-    data->state.async.dns = NULL;
-  }
-#endif
-
-  result = Curl_setup_conn(data, protocol_done);
+  DEBUGASSERT(unix_path);
+  *pdns = NULL;
 
+  result = Curl_unix2addr(unix_path, abstract_path, &addr);
   if(result) {
-    Curl_detach_connection(data);
-    Curl_conncache_remove_conn(data, conn, TRUE);
-    Curl_disconnect(data, conn, TRUE);
+    if(result == CURLE_TOO_LARGE) {
+      /* Long paths are not supported for now */
+      failf(data, "Unix socket path too long: '%s'", unix_path);
+      result = CURLE_COULDNT_RESOLVE_HOST;
+    }
+    return result;
   }
-  return result;
+
+  *pdns = Curl_dnscache_mk_entry(data, 0, &addr, NULL, 0);
+  return *pdns ? CURLE_OK : CURLE_OUT_OF_MEMORY;
 }
+#endif /* USE_UNIX_SOCKETS */
 
 /*
- * Curl_resolver_error() calls failf() with the appropriate message after a
- * resolve error
+ * Curl_resolv() is the main name resolve function within libcurl. It resolves
+ * a name and returns a pointer to the entry in the 'entry' argument. This
+ * function might return immediately if we are using asynch resolves. See the
+ * return codes.
+ *
+ * The cache entry we return will get its 'inuse' counter increased when this
+ * function is used. You MUST call Curl_dns_entry_unlink() later (when you are
+ * done using this struct) to decrease the reference counter again.
+ *
+ * If built with a synchronous resolver and use of signals is not
+ * disabled by the application, then a nonzero timeout will cause a
+ * timeout after the specified number of milliseconds. Otherwise, timeout
+ * is ignored.
+ *
+ * Return codes:
+ * CURLE_OK = success, *pdns set to non-NULL
+ * CURLE_AGAIN = resolving in progress, *pdns == NULL
+ * any other CURLcode error, *pdns == NULL
  */
+CURLcode Curl_resolv(struct Curl_easy *data,
+                     struct Curl_peer *peer,
+                     uint8_t dns_queries,
+                     uint8_t transport,
+                     bool for_proxy,
+                     timediff_t timeout_ms,
+                     uint32_t *presolv_id,
+                     struct Curl_dns_entry **pdns)
+{
+  *presolv_id = 0;
+  *pdns = NULL;
+
+  if(timeout_ms < 0)
+    /* got an already expired timeout */
+    return CURLE_OPERATION_TIMEDOUT;
+  else if(!timeout_ms)
+    timeout_ms = CURL_TIMEOUT_RESOLVE_MS;
+
+#ifdef USE_UNIX_SOCKETS
+  if(peer->unix_socket)
+    return resolv_unix(data, peer->hostname, (bool)peer->abstract_uds, pdns);
+#else
+  if(peer->unix_socket)
+    return hostip_resolv_failed(data, peer->hostname, for_proxy);
+#endif
+
+#ifdef USE_ALARM_TIMEOUT
+  if(timeout_ms && data->set.no_signal) {
+    /* Cannot use ALARM when signals are disabled */
+    timeout_ms = 0;
+  }
+  if(timeout_ms && !Curl_doh_wanted(data)) {
+    return resolv_alarm_timeout(data, dns_queries, peer->hostname, peer->port,
+                                transport, for_proxy, timeout_ms, presolv_id,
+                                pdns);
+  }
+#endif /* !USE_ALARM_TIMEOUT */
+
+#ifndef CURLRES_ASYNCH
+  if(timeout_ms)
+    infof(data, "timeout on name lookup is not supported");
+#endif
+
+  return hostip_resolv(data, dns_queries, peer->hostname, peer->port,
+                       transport, for_proxy, timeout_ms, TRUE, presolv_id,
+                       pdns);
+}
 
 #ifdef USE_CURL_ASYNC
-CURLcode Curl_resolver_error(struct Curl_easy *data)
+
+struct Curl_resolv_async *Curl_async_get(struct Curl_easy *data,
+                                         uint32_t resolv_id)
 {
-  const char *host_or_proxy;
+  struct Curl_resolv_async *async = data->state.async;
+  for(; async; async = async->next) {
+    if(async->id == resolv_id)
+      return async;
+  }
+  return NULL;
+}
+
+CURLcode Curl_resolv_take_result(struct Curl_easy *data, uint32_t resolv_id,
+                                 struct Curl_dns_entry **pdns)
+{
+  struct Curl_resolv_async *async = Curl_async_get(data, resolv_id);
   CURLcode result;
 
-#ifndef CURL_DISABLE_PROXY
-  struct connectdata *conn = data->conn;
-  if(conn->bits.httpproxy) {
-    host_or_proxy = "proxy";
-    result = CURLE_COULDNT_RESOLVE_PROXY;
+  /* If async resolving is ongoing, this must be set */
+  if(!async)
+    return CURLE_FAILED_INIT;
+
+  /* check if we have the name resolved by now (from someone else) */
+  result = Curl_dnscache_get(data, async->dns_queries,
+                             async->hostname, async->port, pdns);
+  if(*pdns) {
+    /* Tell a possibly async resolver we no longer need the results. */
+    infof(data, "Hostname '%s' was found in DNS cache", async->hostname);
+    Curl_async_shutdown(data, async);
+    return CURLE_OK;
   }
-  else
-#endif
-  {
-    host_or_proxy = "host";
-    result = CURLE_COULDNT_RESOLVE_HOST;
+  else if(result) {
+    Curl_async_shutdown(data, async);
+    return Curl_async_failed(data, async, NULL);
   }
 
-  failf(data, "Could not resolve %s: %s", host_or_proxy,
-        data->state.async.hostname);
+  result = hostip_resolv_take_result(data, async, pdns);
 
+  if(*pdns) {
+    /* Add to cache */
+    result = Curl_dnscache_add(data, *pdns);
+    if(result)
+      Curl_dns_entry_unlink(data, pdns);
+  }
+  else if(IS_RESOLV_FAIL(result)) {
+    Curl_dnscache_add_negative(data, async->dns_queries,
+                               async->hostname, async->port);
+    failf(data, "Could not resolve: %s:%u", async->hostname, async->port);
+  }
+  else if(result) {
+    failf(data, "Error %d resolving %s:%u",
+          (int)result, async->hostname, async->port);
+  }
   return result;
 }
+
+CURLcode Curl_resolv_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps)
+{
+  struct Curl_resolv_async *async = data->state.async;
+  CURLcode result = CURLE_OK;
+
+  (void)ps;
+  for(; async && !result; async = async->next) {
+#ifndef CURL_DISABLE_DOH
+    if(async->doh) /* DoH has nothing for the pollset */
+      continue;
+#endif
+    result = Curl_async_pollset(data, async, ps);
+  }
+  return result;
+}
+
+void Curl_resolv_destroy(struct Curl_easy *data, uint32_t resolv_id)
+{
+  struct Curl_resolv_async **panchor = &data->state.async;
+
+  for(; *panchor; panchor = &(*panchor)->next) {
+    struct Curl_resolv_async *async = *panchor;
+    if(async->id == resolv_id) {
+      *panchor = async->next;
+      Curl_async_destroy(data, async);
+      break;
+    }
+  }
+}
+
+void Curl_resolv_shutdown_all(struct Curl_easy *data)
+{
+  struct Curl_resolv_async *async = data->state.async;
+  for(; async; async = async->next) {
+    Curl_async_shutdown(data, async);
+  }
+}
+
+void Curl_resolv_destroy_all(struct Curl_easy *data)
+{
+  while(data->state.async) {
+    struct Curl_resolv_async *async = data->state.async;
+    data->state.async = async->next;
+    Curl_async_destroy(data, async);
+  }
+}
+
 #endif /* USE_CURL_ASYNC */
diff --git a/third-party/curl/lib/hostip.h b/third-party/curl/lib/hostip.h
index 06d0867277..45370ec48e 100644
--- a/third-party/curl/lib/hostip.h
+++ b/third-party/curl/lib/hostip.h
@@ -23,16 +23,10 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
-#include "hash.h"
-#include "curl_addrinfo.h"
-#include "timeval.h" /* for timediff_t */
-#include "asyn.h"
 
-#ifdef HAVE_SETJMP_H
-#include <setjmp.h>
-#endif
+#include "hash.h"
+#include "curlx/timeval.h" /* for curltime, timediff_t */
 
 /* Allocate enough memory to hold the full name information structs and
  * everything. OSF1 is known to require at least 8872 bytes. The buffer
@@ -41,187 +35,153 @@
  */
 #define CURL_HOSTENT_SIZE 9000
 
-#define CURL_TIMEOUT_RESOLVE 300 /* when using asynch methods, we allow this
-                                    many seconds for a name resolve */
-
-#define CURL_ASYNC_SUCCESS CURLE_OK
+#define CURL_TIMEOUT_RESOLVE_MS (300 * 1000)
 
 struct addrinfo;
 struct hostent;
 struct Curl_easy;
 struct connectdata;
+struct easy_pollset;
+struct Curl_https_rrinfo;
+struct Curl_multi;
+struct Curl_dns_entry;
+struct Curl_peer;
 
-/*
- * Curl_global_host_cache_init() initializes and sets up a global DNS cache.
- * Global DNS cache is general badness. Do not use. This will be removed in
- * a future version. Use the share interface instead!
- *
- * Returns a struct Curl_hash pointer on success, NULL on failure.
- */
-struct Curl_hash *Curl_global_host_cache_init(void);
+/* DNS query types */
+#define CURL_DNSQ_A           (1U << 0)
+#define CURL_DNSQ_AAAA        (1U << 1)
+#define CURL_DNSQ_HTTPS       (1U << 2)
 
-struct Curl_dns_entry {
-  struct Curl_addrinfo *addr;
-  /* timestamp == 0 -- permanent CURLOPT_RESOLVE entry (doesn't time out) */
-  time_t timestamp;
-  /* use-counter, use Curl_resolv_unlock to release reference */
-  long inuse;
+#define CURL_DNSQ_ALL         (CURL_DNSQ_A | CURL_DNSQ_AAAA | CURL_DNSQ_HTTPS)
+#define CURL_DNSQ_IP(x)       (uint8_t)((x)&(CURL_DNSQ_A | CURL_DNSQ_AAAA))
+
+#ifdef CURLVERBOSE
+const char *Curl_resolv_query_str(uint8_t dns_queries);
+#endif
+
+/* Return CURL_DNSQ_* bits for the transfer and ip_version. */
+uint8_t Curl_resolv_dns_queries(struct Curl_easy *data, uint8_t ip_version);
+
+enum alpnid {
+  ALPN_none = 0,
+  ALPN_h1 = CURLALTSVC_H1,
+  ALPN_h2 = CURLALTSVC_H2,
+  ALPN_h3 = CURLALTSVC_H3
 };
 
 bool Curl_host_is_ipnum(const char *hostname);
 
-/*
- * Curl_resolv() returns an entry with the info for the specified host
- * and port.
- *
- * The returned data *MUST* be "unlocked" with Curl_resolv_unlock() after
- * use, or we'll leak memory!
- */
-/* return codes */
-enum resolve_t {
-  CURLRESOLV_TIMEDOUT = -2,
-  CURLRESOLV_ERROR    = -1,
-  CURLRESOLV_RESOLVED =  0,
-  CURLRESOLV_PENDING  =  1
-};
-enum resolve_t Curl_resolv(struct Curl_easy *data,
-                           const char *hostname,
-                           int port,
-                           bool allowDOH,
-                           struct Curl_dns_entry **dnsentry);
-enum resolve_t Curl_resolv_timeout(struct Curl_easy *data,
-                                   const char *hostname, int port,
-                                   struct Curl_dns_entry **dnsentry,
-                                   timediff_t timeoutms);
-
-#ifdef ENABLE_IPV6
-/*
- * Curl_ipv6works() returns TRUE if IPv6 seems to work.
- */
-bool Curl_ipv6works(struct Curl_easy *data);
+#ifdef USE_IPV6
+/* probe if it seems to work */
+CURLcode Curl_probeipv6(struct Curl_multi *multi);
 #else
-#define Curl_ipv6works(x) FALSE
+#define Curl_probeipv6(x) CURLE_OK
 #endif
 
-/*
- * Curl_ipvalid() checks what CURL_IPRESOLVE_* requirements that might've
- * been set and returns TRUE if they are OK.
- */
-bool Curl_ipvalid(struct Curl_easy *data, struct connectdata *conn);
-
-
-/*
- * Curl_getaddrinfo() is the generic low-level name resolve API within this
- * source file. There are several versions of this function - for different
- * name resolve layers (selected at build-time). They all take this same set
- * of arguments
- */
-struct Curl_addrinfo *Curl_getaddrinfo(struct Curl_easy *data,
-                                       const char *hostname,
-                                       int port,
-                                       int *waitp);
-
-
-/* unlock a previously resolved dns entry */
-void Curl_resolv_unlock(struct Curl_easy *data,
-                        struct Curl_dns_entry *dns);
-
-/* init a new dns cache */
-void Curl_init_dnscache(struct Curl_hash *hash, int hashsize);
-
-/* prune old entries from the DNS cache */
-void Curl_hostcache_prune(struct Curl_easy *data);
-
-/* IPv4 threadsafe resolve function used for synch and asynch builds */
-struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname, int port);
-
-CURLcode Curl_once_resolved(struct Curl_easy *data, bool *protocol_connect);
-
-/*
- * Curl_addrinfo_callback() is used when we build with any asynch specialty.
- * Handles end of async request processing. Inserts ai into hostcache when
- * status is CURL_ASYNC_SUCCESS. Twiddles fields in conn to indicate async
- * request completed whether successful or failed.
- */
-CURLcode Curl_addrinfo_callback(struct Curl_easy *data,
-                                int status,
-                                struct Curl_addrinfo *ai);
+/* IPv4 thread-safe resolve function used for synch and asynch builds */
+struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname, uint16_t port);
 
 /*
  * Curl_printable_address() returns a printable version of the 1st address
- * given in the 'ip' argument. The result will be stored in the buf that is
+ * given in the 'ai' argument. The result will be stored in the buf that is
  * bufsize bytes big.
  */
-void Curl_printable_address(const struct Curl_addrinfo *ip,
+void Curl_printable_address(const struct Curl_addrinfo *ai,
                             char *buf, size_t bufsize);
 
-/*
- * Curl_fetch_addr() fetches a 'Curl_dns_entry' already in the DNS cache.
- *
- * Returns the Curl_dns_entry entry pointer or NULL if not in the cache.
- *
- * The returned data *MUST* be "unlocked" with Curl_resolv_unlock() after
- * use, or we'll leak memory!
+/* Start DNS resolving for the given parameters. Returns
+ * - CURLE_OK: `*pdns` is the resolved DNS entry (needs to be unlinked).
+    *          `*presolv_id` is 0.
+ * - CURLE_AGAIN: resolve is asynchronous and not finished yet.
+ *             `presolv_id` is the identifier for querying results later.
+ * - other: the operation failed, `*pdns` is NULL, `*presolv_id` is 0.
  */
-struct Curl_dns_entry *
-Curl_fetch_addr(struct Curl_easy *data,
-                const char *hostname,
-                int port);
+CURLcode Curl_resolv(struct Curl_easy *data,
+                     struct Curl_peer *peer,
+                     uint8_t dns_queries,
+                     uint8_t transport,
+                     bool for_proxy,
+                     timediff_t timeout_ms,
+                     uint32_t *presolv_id,
+                     struct Curl_dns_entry **pdns);
 
+CURLcode Curl_resolv_blocking(struct Curl_easy *data,
+                              uint8_t dns_queries,
+                              const char *hostname,
+                              uint16_t port,
+                              uint8_t transport,
+                              struct Curl_dns_entry **pdns);
+
+/* Announce start of a resolve operation to application callback,
+ * passing the resolver implementation (maybe NULL). */
+CURLcode Curl_resolv_announce_start(struct Curl_easy *data,
+                                    void *resolver);
+
+#ifdef USE_CURL_ASYNC
+
+CURLcode Curl_resolv_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps);
+
+/* Get the `async` struct for the given `resolv_id`, if it exists. */
+struct Curl_resolv_async *Curl_async_get(struct Curl_easy *data,
+                                         uint32_t resolv_id);
+
+/* Shut down all resolves of the given easy handle. */
+void Curl_resolv_shutdown_all(struct Curl_easy *data);
+
+/* Destroy all resolve resources of the given easy handle. */
+void Curl_resolv_destroy_all(struct Curl_easy *data);
+
+CURLcode Curl_resolv_take_result(struct Curl_easy *data, uint32_t resolv_id,
+                                 struct Curl_dns_entry **pdns);
+
+void Curl_resolv_destroy(struct Curl_easy *data, uint32_t resolv_id);
+
+/* How much time has gone by since start of resolve.
+ * Returns CURL_TIMEOUT_RESOLVE_MS if `resolv_id` is no longer valid. */
+timediff_t Curl_resolv_elapsed_ms(struct Curl_easy *data,
+                                  uint32_t resolv_id);
+
+/* Return TRUE if `resolv_id` has answers (positive or negative) to
+ * all queries in `dns_queries`.
+ * Queries not requested are considered answered. */
+bool Curl_resolv_has_answers(struct Curl_easy *data,
+                             uint32_t resolv_id, uint8_t dns_queries);
+
+const struct Curl_addrinfo *Curl_resolv_get_ai(struct Curl_easy *data,
+                                               uint32_t resolv_id,
+                                               int ai_family,
+                                               unsigned int index);
+#ifdef USE_HTTPSRR
+const struct Curl_https_rrinfo *Curl_resolv_get_https(struct Curl_easy *data,
+                                                      uint32_t resolv_id);
+bool Curl_resolv_knows_https(struct Curl_easy *data, uint32_t resolv_id);
+#endif /* USE_HTTPSRR */
+
+#else /* !USE_CURL_ASYNC */
+#define Curl_resolv_shutdown_all(x)      Curl_nop_stmt
+#define Curl_resolv_destroy_all(x)       Curl_nop_stmt
+#define Curl_resolv_take_result(x, y, z) CURLE_NOT_BUILT_IN
+#define Curl_resolv_elapsed_ms(x, y)     CURL_TIMEOUT_RESOLVE_MS
+#define Curl_resolv_has_answers(x, y, z) TRUE
+#define Curl_resolv_get_ai(x, y, z, a)   NULL
+#define Curl_resolv_get_https(x, y)      NULL
+#define Curl_resolv_knows_https(x, y)    TRUE
+#define Curl_resolv_pollset(x, y)        CURLE_OK
+#define Curl_resolv_destroy(x, y)        Curl_nop_stmt
+#endif /* USE_CURL_ASYNC */
+
+#ifdef CURLRES_SYNCH
 /*
- * Curl_cache_addr() stores a 'Curl_addrinfo' struct in the DNS cache.
- *
- * Returns the Curl_dns_entry entry pointer or NULL if the storage failed.
+ * Curl_sync_getaddrinfo() is the non-async low-level name resolve API.
+ * There are several versions of this function - depending on IPV6
+ * support and platform.
  */
-struct Curl_dns_entry *
-Curl_cache_addr(struct Curl_easy *data, struct Curl_addrinfo *addr,
-                const char *hostname, size_t hostlen, int port);
-
-#ifndef INADDR_NONE
-#define CURL_INADDR_NONE (in_addr_t) ~0
-#else
-#define CURL_INADDR_NONE INADDR_NONE
+struct Curl_addrinfo *Curl_sync_getaddrinfo(struct Curl_easy *data,
+                                            uint8_t dns_queries,
+                                            const char *hostname,
+                                            uint16_t port,
+                                            uint8_t transport);
 #endif
 
-/*
- * Function provided by the resolver backend to set DNS servers to use.
- */
-CURLcode Curl_set_dns_servers(struct Curl_easy *data, char *servers);
-
-/*
- * Function provided by the resolver backend to set
- * outgoing interface to use for DNS requests
- */
-CURLcode Curl_set_dns_interface(struct Curl_easy *data,
-                                const char *interf);
-
-/*
- * Function provided by the resolver backend to set
- * local IPv4 address to use as source address for DNS requests
- */
-CURLcode Curl_set_dns_local_ip4(struct Curl_easy *data,
-                                const char *local_ip4);
-
-/*
- * Function provided by the resolver backend to set
- * local IPv6 address to use as source address for DNS requests
- */
-CURLcode Curl_set_dns_local_ip6(struct Curl_easy *data,
-                                const char *local_ip6);
-
-/*
- * Clean off entries from the cache
- */
-void Curl_hostcache_clean(struct Curl_easy *data, struct Curl_hash *hash);
-
-/*
- * Populate the cache with specified entries from CURLOPT_RESOLVE.
- */
-CURLcode Curl_loadhostpairs(struct Curl_easy *data);
-CURLcode Curl_resolv_check(struct Curl_easy *data,
-                           struct Curl_dns_entry **dns);
-int Curl_resolv_getsock(struct Curl_easy *data,
-                        curl_socket_t *socks);
-
-CURLcode Curl_resolver_error(struct Curl_easy *data);
 #endif /* HEADER_CURL_HOSTIP_H */
diff --git a/third-party/curl/lib/hostip4.c b/third-party/curl/lib/hostip4.c
index 9140180ffd..c8cc4dc340 100644
--- a/third-party/curl/lib/hostip4.c
+++ b/third-party/curl/lib/hostip4.c
@@ -21,7 +21,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 /***********************************************************************
@@ -44,34 +43,16 @@
 #endif
 
 #include "urldata.h"
-#include "sendf.h"
+#include "curl_addrinfo.h"
+#include "curl_trc.h"
 #include "hostip.h"
-#include "hash.h"
-#include "share.h"
 #include "url.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
 
-/*
- * Curl_ipvalid() checks what CURL_IPRESOLVE_* requirements that might've
- * been set and returns TRUE if they are OK.
- */
-bool Curl_ipvalid(struct Curl_easy *data, struct connectdata *conn)
-{
-  (void)data;
-  if(conn->ip_version == CURL_IPRESOLVE_V6)
-    /* An IPv6 address was requested and we can't get/use one */
-    return FALSE;
-
-  return TRUE; /* OK, proceed */
-}
 
 #ifdef CURLRES_SYNCH
 
 /*
- * Curl_getaddrinfo() - the IPv4 synchronous version.
+ * Curl_sync_getaddrinfo() - the IPv4 synchronous version.
  *
  * The original code to this function was from the Dancer source code, written
  * by Bjorn Reese, it has since been patched and modified considerably.
@@ -82,22 +63,20 @@ bool Curl_ipvalid(struct Curl_easy *data, struct connectdata *conn)
  * detect which one this platform supports in the configure script and set up
  * the HAVE_GETHOSTBYNAME_R_3, HAVE_GETHOSTBYNAME_R_5 or
  * HAVE_GETHOSTBYNAME_R_6 defines accordingly. Note that HAVE_GETADDRBYNAME
- * has the corresponding rules. This is primarily on *nix. Note that some unix
- * flavours have thread-safe versions of the plain gethostbyname() etc.
+ * has the corresponding rules. This is primarily on *nix. Note that some Unix
+ * flavors have thread-safe versions of the plain gethostbyname() etc.
  *
  */
-struct Curl_addrinfo *Curl_getaddrinfo(struct Curl_easy *data,
-                                       const char *hostname,
-                                       int port,
-                                       int *waitp)
+struct Curl_addrinfo *Curl_sync_getaddrinfo(struct Curl_easy *data,
+                                            uint8_t dns_queries,
+                                            const char *hostname,
+                                            uint16_t port,
+                                            uint8_t transport)
 {
   struct Curl_addrinfo *ai = NULL;
 
-#ifdef CURL_DISABLE_VERBOSE_STRINGS
-  (void)data;
-#endif
-
-  *waitp = 0; /* synchronous response only */
+  (void)dns_queries;
+  (void)transport;
 
   ai = Curl_ipv4_resolve_r(hostname, port);
   if(!ai)
@@ -108,26 +87,28 @@ struct Curl_addrinfo *Curl_getaddrinfo(struct Curl_easy *data,
 #endif /* CURLRES_SYNCH */
 #endif /* CURLRES_IPV4 */
 
-#if defined(CURLRES_IPV4) && \
-   !defined(CURLRES_ARES) && !defined(CURLRES_AMIGA)
+#if defined(CURLRES_IPV4) && !defined(USE_RESOLV_ARES) && \
+  !defined(CURLRES_AMIGA)
 
 /*
- * Curl_ipv4_resolve_r() - ipv4 threadsafe resolver function.
+ * Curl_ipv4_resolve_r() - ipv4 thread-safe resolver function.
  *
  * This is used for both synchronous and asynchronous resolver builds,
- * implying that only threadsafe code and function calls may be used.
+ * implying that only thread-safe code and function calls may be used.
  *
  */
 struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname,
-                                          int port)
+                                          uint16_t port)
 {
 #if !(defined(HAVE_GETADDRINFO) && defined(HAVE_GETADDRINFO_THREADSAFE)) && \
-   defined(HAVE_GETHOSTBYNAME_R_3)
+  defined(HAVE_GETHOSTBYNAME_R_3)
   int res;
 #endif
   struct Curl_addrinfo *ai = NULL;
+#if !(defined(HAVE_GETADDRINFO) && defined(HAVE_GETADDRINFO_THREADSAFE))
   struct hostent *h = NULL;
   struct hostent *buf = NULL;
+#endif
 
 #if defined(HAVE_GETADDRINFO) && defined(HAVE_GETADDRINFO_THREADSAFE)
   struct addrinfo hints;
@@ -138,7 +119,7 @@ struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname,
   hints.ai_family = PF_INET;
   hints.ai_socktype = SOCK_STREAM;
   if(port) {
-    msnprintf(sbuf, sizeof(sbuf), "%d", port);
+    curl_msnprintf(sbuf, sizeof(sbuf), "%d", port);
     sbufptr = sbuf;
   }
 
@@ -152,16 +133,16 @@ struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname,
    */
   int h_errnop;
 
-  buf = calloc(1, CURL_HOSTENT_SIZE);
+  buf = curlx_calloc(1, CURL_HOSTENT_SIZE);
   if(!buf)
     return NULL; /* major failure */
   /*
    * The clearing of the buffer is a workaround for a gethostbyname_r bug in
-   * qnx nto and it is also _required_ for some of these functions on some
+   * QNX Neutrino and it is also _required_ for some of these functions on some
    * platforms.
    */
 
-#if defined(HAVE_GETHOSTBYNAME_R_5)
+#ifdef HAVE_GETHOSTBYNAME_R_5
   /* Solaris, IRIX and more */
   h = gethostbyname_r(hostname,
                       (struct hostent *)buf,
@@ -170,7 +151,7 @@ struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname,
                       &h_errnop);
 
   /* If the buffer is too small, it returns NULL and sets errno to
-   * ERANGE. The errno is thread safe if this is compiled with
+   * ERANGE. The errno is thread-safe if this is compiled with
    * -D_REENTRANT as then the 'errno' variable is a macro defined to get
    * used properly for threads.
    */
@@ -183,18 +164,18 @@ struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname,
   /* Linux */
 
   (void)gethostbyname_r(hostname,
-                      (struct hostent *)buf,
-                      (char *)buf + sizeof(struct hostent),
-                      CURL_HOSTENT_SIZE - sizeof(struct hostent),
-                      &h, /* DIFFERENCE */
-                      &h_errnop);
+                        (struct hostent *)buf,
+                        (char *)buf + sizeof(struct hostent),
+                        CURL_HOSTENT_SIZE - sizeof(struct hostent),
+                        &h, /* DIFFERENCE */
+                        &h_errnop);
   /* Redhat 8, using glibc 2.2.93 changed the behavior. Now all of a
    * sudden this function returns EAGAIN if the given buffer size is too
    * small. Previous versions are known to return ERANGE for the same
    * problem.
    *
-   * This wouldn't be such a big problem if older versions wouldn't
-   * sometimes return EAGAIN on a common failure case. Alas, we can't
+   * This would not be such a big problem if older versions would not
+   * sometimes return EAGAIN on a common failure case. Alas, we cannot
    * assume that EAGAIN *or* ERANGE means ERANGE for any given version of
    * glibc.
    *
@@ -210,9 +191,9 @@ struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname,
    * gethostbyname_r() in glibc:
    *
    * In glibc 2.2.5 the interface is different (this has also been
-   * discovered in glibc 2.1.1-6 as shipped by Redhat 6). What I can't
+   * discovered in glibc 2.1.1-6 as shipped by Redhat 6). What I cannot
    * explain, is that tests performed on glibc 2.2.4-34 and 2.2.4-32
-   * (shipped/upgraded by Redhat 7.2) don't show this behavior!
+   * (shipped/upgraded by Redhat 7.2) do not show this behavior!
    *
    * In this "buggy" version, the return code is -1 on error and 'errno'
    * is set to the ERANGE or EAGAIN code. Note that 'errno' is not a
@@ -221,9 +202,9 @@ struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname,
 
   if(!h) /* failure */
 #elif defined(HAVE_GETHOSTBYNAME_R_3)
-  /* AIX, Digital Unix/Tru64, HPUX 10, more? */
+  /* AIX, Digital UNIX/Tru64, HP-UX 10, more? */
 
-  /* For AIX 4.3 or later, we don't use gethostbyname_r() at all, because of
+  /* For AIX 4.3 or later, we do not use gethostbyname_r() at all, because of
    * the plain fact that it does not return unique full buffers on each
    * call, but instead several of the pointers in the hostent structs will
    * point to the same actual data! This have the unfortunate down-side that
@@ -237,7 +218,7 @@ struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname,
    *
    * Troels Walsted Hansen helped us work this out on March 3rd, 2003.
    *
-   * [*] = much later we've found out that it isn't at all "completely
+   * [*] = much later we have found out that it is not at all "completely
    * thread-safe", but at least the gethostbyname() function is.
    */
 
@@ -253,7 +234,7 @@ struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname,
                           (struct hostent *)buf,
                           (struct hostent_data *)((char *)buf +
                                                   sizeof(struct hostent)));
-    h_errnop = SOCKERRNO; /* we don't deal with this, but set it anyway */
+    h_errnop = SOCKERRNO; /* we do not deal with this, but set it anyway */
   }
   else
     res = -1; /* failure, too smallish buffer size */
@@ -263,11 +244,11 @@ struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname,
     h = buf; /* result expected in h */
 
     /* This is the worst kind of the different gethostbyname_r() interfaces.
-     * Since we don't know how big buffer this particular lookup required,
-     * we can't realloc down the huge alloc without doing closer analysis of
+     * Since we do not know how big buffer this particular lookup required,
+     * we cannot realloc down the huge alloc without doing closer analysis of
      * the returned data. Thus, we always use CURL_HOSTENT_SIZE for every
-     * name lookup. Fixing this would require an extra malloc() and then
-     * calling Curl_addrinfo_copy() that subsequent realloc()s down the new
+     * name lookup. Fixing this would require an extra allocation and then
+     * calling Curl_addrinfo_copy() that subsequent reallocation down the new
      * memory area to the actually used amount.
      */
   }
@@ -275,27 +256,28 @@ struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname,
 #endif /* HAVE_...BYNAME_R_5 || HAVE_...BYNAME_R_6 || HAVE_...BYNAME_R_3 */
   {
     h = NULL; /* set return code to NULL */
-    free(buf);
+    curlx_free(buf);
   }
 #else /* (HAVE_GETADDRINFO && HAVE_GETADDRINFO_THREADSAFE) ||
           HAVE_GETHOSTBYNAME_R */
   /*
-   * Here is code for platforms that don't have a thread safe
+   * Here is code for platforms that do not have a thread-safe
    * getaddrinfo() nor gethostbyname_r() function or for which
    * gethostbyname() is the preferred one.
    */
-  h = gethostbyname((void *)hostname);
+  h = gethostbyname(CURL_UNCONST(hostname));
 #endif /* (HAVE_GETADDRINFO && HAVE_GETADDRINFO_THREADSAFE) ||
            HAVE_GETHOSTBYNAME_R */
 
+#if !(defined(HAVE_GETADDRINFO) && defined(HAVE_GETADDRINFO_THREADSAFE))
   if(h) {
     ai = Curl_he2ai(h, port);
 
     if(buf) /* used a *_r() function */
-      free(buf);
+      curlx_free(buf);
   }
+#endif
 
   return ai;
 }
-#endif /* defined(CURLRES_IPV4) && !defined(CURLRES_ARES) &&
-                                   !defined(CURLRES_AMIGA) */
+#endif /* CURLRES_IPV4 && !USE_RESOLV_ARES && !CURLRES_AMIGA */
diff --git a/third-party/curl/lib/hostip6.c b/third-party/curl/lib/hostip6.c
index 6b0ba55e9f..7412f428a4 100644
--- a/third-party/curl/lib/hostip6.c
+++ b/third-party/curl/lib/hostip6.c
@@ -21,7 +21,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 /***********************************************************************
@@ -44,51 +43,18 @@
 #endif
 
 #include "urldata.h"
-#include "sendf.h"
+#include "cfilters.h"
+#include "curl_addrinfo.h"
+#include "curl_trc.h"
 #include "hostip.h"
-#include "hash.h"
-#include "share.h"
 #include "url.h"
-#include "inet_pton.h"
+#include "curlx/inet_pton.h"
 #include "connect.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+
+#ifdef CURLRES_SYNCH
 
 /*
- * Curl_ipvalid() checks what CURL_IPRESOLVE_* requirements that might've
- * been set and returns TRUE if they are OK.
- */
-bool Curl_ipvalid(struct Curl_easy *data, struct connectdata *conn)
-{
-  if(conn->ip_version == CURL_IPRESOLVE_V6)
-    return Curl_ipv6works(data);
-
-  return TRUE;
-}
-
-#if defined(CURLRES_SYNCH)
-
-#ifdef DEBUG_ADDRINFO
-static void dump_addrinfo(struct connectdata *conn,
-                          const struct Curl_addrinfo *ai)
-{
-  printf("dump_addrinfo:\n");
-  for(; ai; ai = ai->ai_next) {
-    char buf[INET6_ADDRSTRLEN];
-    printf("    fam %2d, CNAME %s, ",
-           ai->ai_family, ai->ai_canonname ? ai->ai_canonname : "<none>");
-    Curl_printable_address(ai, buf, sizeof(buf));
-    printf("%s\n", buf);
-  }
-}
-#else
-#define dump_addrinfo(x,y) Curl_nop_stmt
-#endif
-
-/*
- * Curl_getaddrinfo() when built IPv6-enabled (non-threading and
+ * Curl_sync_getaddrinfo() when built IPv6-enabled (non-threading and
  * non-ares version).
  *
  * Returns name information about the given hostname and port number. If
@@ -96,10 +62,11 @@ static void dump_addrinfo(struct connectdata *conn,
  * to memory we need to free after use. That memory *MUST* be freed with
  * Curl_freeaddrinfo(), nothing else.
  */
-struct Curl_addrinfo *Curl_getaddrinfo(struct Curl_easy *data,
-                                       const char *hostname,
-                                       int port,
-                                       int *waitp)
+struct Curl_addrinfo *Curl_sync_getaddrinfo(struct Curl_easy *data,
+                                            uint8_t dns_queries,
+                                            const char *hostname,
+                                            uint16_t port,
+                                            uint8_t transport)
 {
   struct addrinfo hints;
   struct Curl_addrinfo *res;
@@ -111,31 +78,28 @@ struct Curl_addrinfo *Curl_getaddrinfo(struct Curl_easy *data,
 #endif
   int pf = PF_INET;
 
-  *waitp = 0; /* synchronous response only */
-
-  if((data->conn->ip_version != CURL_IPRESOLVE_V4) && Curl_ipv6works(data))
-    /* The stack seems to be IPv6-enabled */
+  if(dns_queries & CURL_DNSQ_AAAA)
     pf = PF_UNSPEC;
 
   memset(&hints, 0, sizeof(hints));
   hints.ai_family = pf;
-  hints.ai_socktype = (data->conn->transport == TRNSPRT_TCP) ?
+  hints.ai_socktype = (transport == TRNSPRT_TCP) ?
     SOCK_STREAM : SOCK_DGRAM;
 
 #ifndef USE_RESOLVE_ON_IPS
   /*
    * The AI_NUMERICHOST must not be set to get synthesized IPv6 address from
-   * an IPv4 address on iOS and Mac OS X.
+   * an IPv4 address on iOS and macOS.
    */
-  if((1 == Curl_inet_pton(AF_INET, hostname, addrbuf)) ||
-     (1 == Curl_inet_pton(AF_INET6, hostname, addrbuf))) {
+  if((curlx_inet_pton(AF_INET, hostname, addrbuf) == 1) ||
+     (curlx_inet_pton(AF_INET6, hostname, addrbuf) == 1)) {
     /* the given address is numerical only, prevent a reverse lookup */
     hints.ai_flags = AI_NUMERICHOST;
   }
 #endif
 
   if(port) {
-    msnprintf(sbuf, sizeof(sbuf), "%d", port);
+    curl_msnprintf(sbuf, sizeof(sbuf), "%d", port);
     sbufptr = sbuf;
   }
 
@@ -149,8 +113,6 @@ struct Curl_addrinfo *Curl_getaddrinfo(struct Curl_easy *data,
     Curl_addrinfo_set_port(res, port);
   }
 
-  dump_addrinfo(conn, res);
-
   return res;
 }
 #endif /* CURLRES_SYNCH */
diff --git a/third-party/curl/lib/hostsyn.c b/third-party/curl/lib/hostsyn.c
deleted file mode 100644
index ca8b0758c4..0000000000
--- a/third-party/curl/lib/hostsyn.c
+++ /dev/null
@@ -1,104 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-/***********************************************************************
- * Only for builds using synchronous name resolves
- **********************************************************************/
-#ifdef CURLRES_SYNCH
-
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-#ifdef __VMS
-#include <in.h>
-#include <inet.h>
-#endif
-
-#include "urldata.h"
-#include "sendf.h"
-#include "hostip.h"
-#include "hash.h"
-#include "share.h"
-#include "url.h"
-#include "curl_memory.h"
-/* The last #include file should be: */
-#include "memdebug.h"
-
-/*
- * Function provided by the resolver backend to set DNS servers to use.
- */
-CURLcode Curl_set_dns_servers(struct Curl_easy *data,
-                              char *servers)
-{
-  (void)data;
-  (void)servers;
-  return CURLE_NOT_BUILT_IN;
-
-}
-
-/*
- * Function provided by the resolver backend to set
- * outgoing interface to use for DNS requests
- */
-CURLcode Curl_set_dns_interface(struct Curl_easy *data,
-                                const char *interf)
-{
-  (void)data;
-  (void)interf;
-  return CURLE_NOT_BUILT_IN;
-}
-
-/*
- * Function provided by the resolver backend to set
- * local IPv4 address to use as source address for DNS requests
- */
-CURLcode Curl_set_dns_local_ip4(struct Curl_easy *data,
-                                const char *local_ip4)
-{
-  (void)data;
-  (void)local_ip4;
-  return CURLE_NOT_BUILT_IN;
-}
-
-/*
- * Function provided by the resolver backend to set
- * local IPv6 address to use as source address for DNS requests
- */
-CURLcode Curl_set_dns_local_ip6(struct Curl_easy *data,
-                                const char *local_ip6)
-{
-  (void)data;
-  (void)local_ip6;
-  return CURLE_NOT_BUILT_IN;
-}
-
-#endif /* truly sync */
diff --git a/third-party/curl/lib/hsts.c b/third-party/curl/lib/hsts.c
index 7ecf0042a5..b8745a5195 100644
--- a/third-party/curl/lib/hsts.c
+++ b/third-party/curl/lib/hsts.c
@@ -28,44 +28,33 @@
 #include "curl_setup.h"
 
 #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_HSTS)
-#include <curl/curl.h>
 #include "urldata.h"
 #include "llist.h"
 #include "hsts.h"
+#include "curl_fopen.h"
 #include "curl_get_line.h"
-#include "strcase.h"
-#include "sendf.h"
-#include "strtoofft.h"
 #include "parsedate.h"
-#include "fopen.h"
-#include "rename.h"
-#include "share.h"
+#include "curl_share.h"
+#include "curlx/strparse.h"
+#include "curlx/strcopy.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#define MAX_HSTS_LINE    4095
+#define MAX_HSTS_HOSTLEN 2048
+#define MAX_HSTS_DATELEN 17
+#define UNLIMITED        "unlimited"
 
-#define MAX_HSTS_LINE 4095
-#define MAX_HSTS_HOSTLEN 256
-#define MAX_HSTS_HOSTLENSTR "256"
-#define MAX_HSTS_DATELEN 64
-#define MAX_HSTS_DATELENSTR "64"
-#define UNLIMITED "unlimited"
-
-#ifdef DEBUGBUILD
+#if defined(DEBUGBUILD) || defined(UNITTESTS)
 /* to play well with debug builds, we can *set* a fixed time this will
    return */
 time_t deltatime; /* allow for "adjustments" for unit test purposes */
 static time_t hsts_debugtime(void *unused)
 {
-  char *timestr = getenv("CURL_TIME");
+  const char *timestr = getenv("CURL_TIME");
   (void)unused;
   if(timestr) {
     curl_off_t val;
-    (void)curlx_strtoofft(timestr, NULL, 10, &val);
-
-    val += (curl_off_t)deltatime;
+    if(!curlx_str_number(&timestr, &val, TIME_T_MAX))
+      val += (curl_off_t)deltatime;
     return (time_t)val;
   }
   return time(NULL);
@@ -76,70 +65,146 @@ static time_t hsts_debugtime(void *unused)
 
 struct hsts *Curl_hsts_init(void)
 {
-  struct hsts *h = calloc(sizeof(struct hsts), 1);
+  struct hsts *h = curlx_calloc(1, sizeof(struct hsts));
   if(h) {
     Curl_llist_init(&h->list, NULL);
   }
   return h;
 }
 
-static void hsts_free(struct stsentry *e)
-{
-  free((char *)e->host);
-  free(e);
-}
+#define hsts_free(x) curlx_free(x)
 
 void Curl_hsts_cleanup(struct hsts **hp)
 {
   struct hsts *h = *hp;
   if(h) {
-    struct Curl_llist_element *e;
-    struct Curl_llist_element *n;
-    for(e = h->list.head; e; e = n) {
-      struct stsentry *sts = e->ptr;
-      n = e->next;
+    struct Curl_llist_node *e;
+    struct Curl_llist_node *n;
+    for(e = Curl_llist_head(&h->list); e; e = n) {
+      struct stsentry *sts = Curl_node_elem(e);
+      n = Curl_node_next(e);
       hsts_free(sts);
     }
-    free(h->filename);
-    free(h);
+    curlx_free(h->filename);
+    curlx_free(h);
     *hp = NULL;
   }
 }
 
-static struct stsentry *hsts_entry(void)
+/* append the new entry to the list after possibly removing an old entry
+   first */
+static void hsts_append(struct hsts *h, struct stsentry *sts)
 {
-  return calloc(sizeof(struct stsentry), 1);
+  if(Curl_llist_count(&h->list) == MAX_HSTS_ENTRIES) {
+    /* It is full. Remove the first entry in the list */
+    struct Curl_llist_node *e = Curl_llist_head(&h->list);
+    struct stsentry *oldsts = Curl_node_elem(e);
+    Curl_node_remove(e);
+    hsts_free(oldsts);
+  }
+  Curl_llist_append(&h->list, sts, &sts->node);
 }
 
 static CURLcode hsts_create(struct hsts *h,
                             const char *hostname,
+                            size_t hlen,
                             bool subdomains,
                             curl_off_t expires)
 {
-  struct stsentry *sts = hsts_entry();
-  char *duphost;
-  size_t hlen;
-  if(!sts)
-    return CURLE_OUT_OF_MEMORY;
+  DEBUGASSERT(h);
+  DEBUGASSERT(hostname);
 
-  duphost = strdup(hostname);
-  if(!duphost) {
-    free(sts);
-    return CURLE_OUT_OF_MEMORY;
+  if(hlen && (hostname[hlen - 1] == '.'))
+    /* strip off any trailing dot */
+    --hlen;
+  if(hlen) {
+    struct stsentry *sts = curlx_calloc(1, sizeof(struct stsentry) + hlen);
+    if(!sts)
+      return CURLE_OUT_OF_MEMORY;
+    /* the null-terminator is already there */
+    memcpy(sts->host, hostname, hlen);
+    sts->expires = expires;
+    sts->includeSubDomains = subdomains;
+    hsts_append(h, sts);
   }
-
-  hlen = strlen(duphost);
-  if(duphost[hlen - 1] == '.')
-    /* strip off trailing any dot */
-    duphost[--hlen] = 0;
-
-  sts->host = duphost;
-  sts->expires = expires;
-  sts->includeSubDomains = subdomains;
-  Curl_llist_insert_next(&h->list, h->list.tail, sts, &sts->node);
   return CURLE_OK;
 }
 
+/* Copy all live entries from src into dst. Used by curl_easy_duphandle so the
+ * clone inherits entries learned at runtime. E.g. Strict-Transport-Security.
+ */
+CURLcode Curl_hsts_copy(struct hsts *dst, struct hsts *src)
+{
+  struct Curl_llist_node *e;
+  time_t now = time(NULL);
+  for(e = Curl_llist_head(&src->list); e; e = Curl_node_next(e)) {
+    struct stsentry *sts = Curl_node_elem(e);
+    if(sts->expires > now) {
+      CURLcode result = hsts_create(dst, sts->host, strlen(sts->host),
+                                    sts->includeSubDomains != 0, sts->expires);
+      if(result)
+        return result;
+    }
+  }
+  return CURLE_OK;
+}
+
+/*
+ * Return the matching HSTS entry, or NULL if the given hostname is not
+ * currently an HSTS one.
+ *
+ * The 'subdomain' argument tells the function if subdomain matching should be
+ * attempted.
+ *
+ * @unittest 1660
+ */
+UNITTEST struct stsentry *hsts_check(struct hsts *h, const char *hostname,
+                                     size_t hlen, bool subdomain);
+UNITTEST struct stsentry *hsts_check(struct hsts *h, const char *hostname,
+                                     size_t hlen, bool subdomain)
+{
+  struct stsentry *bestsub = NULL;
+  if(h) {
+    time_t now = time(NULL);
+    struct Curl_llist_node *e;
+    struct Curl_llist_node *n;
+    size_t blen = 0;
+
+    if((hlen > MAX_HSTS_HOSTLEN) || !hlen)
+      return NULL;
+    if(hostname[hlen - 1] == '.')
+      /* remove the trailing dot */
+      --hlen;
+
+    for(e = Curl_llist_head(&h->list); e; e = n) {
+      struct stsentry *sts = Curl_node_elem(e);
+      size_t ntail;
+      n = Curl_node_next(e);
+      if(sts->expires <= now) {
+        /* remove expired entries */
+        Curl_node_remove(&sts->node);
+        hsts_free(sts);
+        continue;
+      }
+      ntail = strlen(sts->host);
+      if((subdomain && sts->includeSubDomains) && (ntail < hlen)) {
+        size_t offs = hlen - ntail;
+        if((hostname[offs - 1] == '.') &&
+           curl_strnequal(&hostname[offs], sts->host, ntail) &&
+           (ntail > blen)) {
+          /* save the tail match with the longest tail */
+          bestsub = sts;
+          blen = ntail;
+        }
+      }
+      /* avoid curl_strequal because the hostname is not null-terminated */
+      if((hlen == ntail) && curl_strnequal(hostname, sts->host, hlen))
+        return sts;
+    }
+  }
+  return bestsub;
+}
+
 CURLcode Curl_hsts_parse(struct hsts *h, const char *hostname,
                          const char *header)
 {
@@ -150,6 +215,7 @@ CURLcode Curl_hsts_parse(struct hsts *h, const char *hostname,
   bool subdomains = FALSE;
   struct stsentry *sts;
   time_t now = time(NULL);
+  size_t hlen = strlen(hostname);
 
   if(Curl_host_is_ipnum(hostname))
     /* "explicit IP address identification of all forms is excluded."
@@ -157,30 +223,30 @@ CURLcode Curl_hsts_parse(struct hsts *h, const char *hostname,
     return CURLE_OK;
 
   do {
-    while(*p && ISBLANK(*p))
-      p++;
-    if(strncasecompare("max-age=", p, 8)) {
+    curlx_str_passblanks(&p);
+    if(curl_strnequal("max-age", p, 7)) {
       bool quoted = FALSE;
-      CURLofft offt;
-      char *endp;
+      int rc;
 
       if(gotma)
         return CURLE_BAD_FUNCTION_ARGUMENT;
 
-      p += 8;
-      while(*p && ISBLANK(*p))
-        p++;
-      if(*p == '\"') {
-        p++;
+      p += 7;
+      curlx_str_passblanks(&p);
+      if(curlx_str_single(&p, '='))
+        return CURLE_BAD_FUNCTION_ARGUMENT;
+      curlx_str_passblanks(&p);
+
+      if(!curlx_str_single(&p, '\"'))
         quoted = TRUE;
-      }
-      offt = curlx_strtoofft(p, &endp, 10, &expires);
-      if(offt == CURL_OFFT_FLOW)
+
+      rc = curlx_str_number(&p, &expires, TIME_T_MAX);
+      if(rc == STRE_OVERFLOW)
         expires = CURL_OFF_T_MAX;
-      else if(offt)
+      else if(rc)
         /* invalid max-age */
         return CURLE_BAD_FUNCTION_ARGUMENT;
-      p = endp;
+
       if(quoted) {
         if(*p != '\"')
           return CURLE_BAD_FUNCTION_ARGUMENT;
@@ -188,7 +254,7 @@ CURLcode Curl_hsts_parse(struct hsts *h, const char *hostname,
       }
       gotma = TRUE;
     }
-    else if(strncasecompare("includesubdomains", p, 17)) {
+    else if(curl_strnequal("includesubdomains", p, 17)) {
       if(gotinc)
         return CURLE_BAD_FUNCTION_ARGUMENT;
       subdomains = TRUE;
@@ -201,8 +267,7 @@ CURLcode Curl_hsts_parse(struct hsts *h, const char *hostname,
         p++;
     }
 
-    while(*p && ISBLANK(*p))
-      p++;
+    curlx_str_passblanks(&p);
     if(*p == ';')
       p++;
   } while(*p);
@@ -213,9 +278,9 @@ CURLcode Curl_hsts_parse(struct hsts *h, const char *hostname,
 
   if(!expires) {
     /* remove the entry if present verbatim (without subdomain match) */
-    sts = Curl_hsts(h, hostname, FALSE);
+    sts = hsts_check(h, hostname, hlen, FALSE);
     if(sts) {
-      Curl_llist_remove(&h->list, &sts->node, NULL);
+      Curl_node_remove(&sts->node);
       hsts_free(sts);
     }
     return CURLE_OK;
@@ -228,68 +293,18 @@ CURLcode Curl_hsts_parse(struct hsts *h, const char *hostname,
     expires += now;
 
   /* check if it already exists */
-  sts = Curl_hsts(h, hostname, FALSE);
+  sts = hsts_check(h, hostname, hlen, FALSE);
   if(sts) {
-    /* just update these fields */
+    /* update these fields */
     sts->expires = expires;
     sts->includeSubDomains = subdomains;
   }
   else
-    return hsts_create(h, hostname, subdomains, expires);
+    return hsts_create(h, hostname, hlen, subdomains, expires);
 
   return CURLE_OK;
 }
 
-/*
- * Return TRUE if the given host name is currently an HSTS one.
- *
- * The 'subdomain' argument tells the function if subdomain matching should be
- * attempted.
- */
-struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
-                           bool subdomain)
-{
-  if(h) {
-    char buffer[MAX_HSTS_HOSTLEN + 1];
-    time_t now = time(NULL);
-    size_t hlen = strlen(hostname);
-    struct Curl_llist_element *e;
-    struct Curl_llist_element *n;
-
-    if((hlen > MAX_HSTS_HOSTLEN) || !hlen)
-      return NULL;
-    memcpy(buffer, hostname, hlen);
-    if(hostname[hlen-1] == '.')
-      /* remove the trailing dot */
-      --hlen;
-    buffer[hlen] = 0;
-    hostname = buffer;
-
-    for(e = h->list.head; e; e = n) {
-      struct stsentry *sts = e->ptr;
-      n = e->next;
-      if(sts->expires <= now) {
-        /* remove expired entries */
-        Curl_llist_remove(&h->list, &sts->node, NULL);
-        hsts_free(sts);
-        continue;
-      }
-      if(subdomain && sts->includeSubDomains) {
-        size_t ntail = strlen(sts->host);
-        if(ntail < hlen) {
-          size_t offs = hlen - ntail;
-          if((hostname[offs-1] == '.') &&
-             strncasecompare(&hostname[offs], sts->host, ntail))
-            return sts;
-        }
-      }
-      if(strcasecompare(hostname, sts->host))
-        return sts;
-    }
-  }
-  return NULL; /* no match */
-}
-
 /*
  * Send this HSTS entry to the write callback.
  */
@@ -308,19 +323,18 @@ static CURLcode hsts_push(struct Curl_easy *data,
   e.includeSubDomains = sts->includeSubDomains;
 
   if(sts->expires != TIME_T_MAX) {
-    result = Curl_gmtime((time_t)sts->expires, &stamp);
+    result = curlx_gmtime((time_t)sts->expires, &stamp);
     if(result)
       return result;
 
-    msnprintf(e.expire, sizeof(e.expire), "%d%02d%02d %02d:%02d:%02d",
-              stamp.tm_year + 1900, stamp.tm_mon + 1, stamp.tm_mday,
-              stamp.tm_hour, stamp.tm_min, stamp.tm_sec);
+    curl_msnprintf(e.expire, sizeof(e.expire), "%d%02d%02d %02d:%02d:%02d",
+                   stamp.tm_year + 1900, stamp.tm_mon + 1, stamp.tm_mday,
+                   stamp.tm_hour, stamp.tm_min, stamp.tm_sec);
   }
   else
-    strcpy(e.expire, UNLIMITED);
+    curlx_strcopy(e.expire, sizeof(e.expire), STRCONST(UNLIMITED));
 
-  sc = data->set.hsts_write(data, &e, i,
-                            data->set.hsts_write_userp);
+  sc = data->set.hsts_write(data, &e, i, data->set.hsts_write_userp);
   *stop = (sc != CURLSTS_OK);
   return sc == CURLSTS_FAIL ? CURLE_BAD_FUNCTION_ARGUMENT : CURLE_OK;
 }
@@ -332,29 +346,28 @@ static CURLcode hsts_out(struct stsentry *sts, FILE *fp)
 {
   struct tm stamp;
   if(sts->expires != TIME_T_MAX) {
-    CURLcode result = Curl_gmtime((time_t)sts->expires, &stamp);
+    CURLcode result = curlx_gmtime((time_t)sts->expires, &stamp);
     if(result)
       return result;
-    fprintf(fp, "%s%s \"%d%02d%02d %02d:%02d:%02d\"\n",
-            sts->includeSubDomains ? ".": "", sts->host,
-            stamp.tm_year + 1900, stamp.tm_mon + 1, stamp.tm_mday,
-            stamp.tm_hour, stamp.tm_min, stamp.tm_sec);
+    curl_mfprintf(fp, "%s%s \"%d%02d%02d %02d:%02d:%02d\"\n",
+                  sts->includeSubDomains ? "." : "", sts->host,
+                  stamp.tm_year + 1900, stamp.tm_mon + 1, stamp.tm_mday,
+                  stamp.tm_hour, stamp.tm_min, stamp.tm_sec);
   }
   else
-    fprintf(fp, "%s%s \"%s\"\n",
-            sts->includeSubDomains ? ".": "", sts->host, UNLIMITED);
+    curl_mfprintf(fp, "%s%s \"%s\"\n",
+                  sts->includeSubDomains ? "." : "", sts->host, UNLIMITED);
   return CURLE_OK;
 }
 
-
 /*
  * Curl_https_save() writes the HSTS cache to file and callback.
  */
 CURLcode Curl_hsts_save(struct Curl_easy *data, struct hsts *h,
                         const char *file)
 {
-  struct Curl_llist_element *e;
-  struct Curl_llist_element *n;
+  struct Curl_llist_node *e;
+  struct Curl_llist_node *n;
   CURLcode result = CURLE_OK;
   FILE *out;
   char *tempstore = NULL;
@@ -368,7 +381,7 @@ CURLcode Curl_hsts_save(struct Curl_easy *data, struct hsts *h,
     file = h->filename;
 
   if((h->flags & CURLHSTS_READONLYFILE) || !file || !file[0])
-    /* marked as read-only, no file or zero length file name */
+    /* marked as read-only, no file or zero length filename */
     goto skipsave;
 
   result = Curl_fopen(data, file, &out, &tempstore);
@@ -376,31 +389,31 @@ CURLcode Curl_hsts_save(struct Curl_easy *data, struct hsts *h,
     fputs("# Your HSTS cache. https://curl.se/docs/hsts.html\n"
           "# This file was generated by libcurl! Edit at your own risk.\n",
           out);
-    for(e = h->list.head; e; e = n) {
-      struct stsentry *sts = e->ptr;
-      n = e->next;
+    for(e = Curl_llist_head(&h->list); e; e = n) {
+      struct stsentry *sts = Curl_node_elem(e);
+      n = Curl_node_next(e);
       result = hsts_out(sts, out);
       if(result)
         break;
     }
-    fclose(out);
-    if(!result && tempstore && Curl_rename(tempstore, file))
+    curlx_fclose(out);
+    if(!result && tempstore && curlx_rename(tempstore, file))
       result = CURLE_WRITE_ERROR;
 
     if(result && tempstore)
       unlink(tempstore);
   }
-  free(tempstore);
+  curlx_free(tempstore);
 skipsave:
   if(data->set.hsts_write) {
-    /* if there's a write callback */
+    /* if there is a write callback */
     struct curl_index i; /* count */
-    i.total = h->list.size;
+    i.total = Curl_llist_count(&h->list);
     i.index = 0;
-    for(e = h->list.head; e; e = n) {
-      struct stsentry *sts = e->ptr;
+    for(e = Curl_llist_head(&h->list); e; e = n) {
+      struct stsentry *sts = Curl_node_elem(e);
       bool stop;
-      n = e->next;
+      n = Curl_node_next(e);
       result = hsts_push(data, &i, sts, &stop);
       if(result || stop)
         break;
@@ -411,41 +424,79 @@ skipsave:
 }
 
 /* only returns SERIOUS errors */
-static CURLcode hsts_add(struct hsts *h, char *line)
+static CURLcode hsts_add_host_expire(struct hsts *h,
+                                     const char *host, size_t hostlen,
+                                     const char *expire, size_t explen,
+                                     bool subdomain) /* default */
+{
+  CURLcode result = CURLE_OK;
+  struct stsentry *e;
+  char dbuf[MAX_HSTS_DATELEN + 1];
+  time_t expires = 0;
+  time_t now = time(NULL);
+
+  /* The date parser works on a null-terminated string. */
+  if(explen > MAX_HSTS_DATELEN)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  memcpy(dbuf, expire, explen);
+  dbuf[explen] = 0;
+
+  if(!strcmp(dbuf, UNLIMITED))
+    expires = TIME_T_MAX;
+  else
+    Curl_getdate_capped(dbuf, &expires);
+
+  if(expires <= now)
+    /* this entry already expired */
+    return CURLE_OK;
+
+  if(host[0] == '.') {
+    host++;
+    hostlen--;
+    subdomain = TRUE;
+  }
+  if(hostlen && (host[hostlen - 1] == '.'))
+    /* strip off any trailing dot */
+    hostlen--;
+
+  if(hostlen) {
+    /* only add it if not already present */
+    e = hsts_check(h, host, hostlen, subdomain);
+    if(!e)
+      result = hsts_create(h, host, hostlen, subdomain, expires);
+    /* 'host' is not necessarily null-terminated */
+    else if((hostlen == strlen(e->host) &&
+             curl_strnequal(host, e->host, hostlen))) {
+      /* the same hostname, use the largest expire time and keep the strictest
+         subdomain policy */
+      if(expires > e->expires)
+        e->expires = expires;
+      if(subdomain)
+        e->includeSubDomains = TRUE;
+    }
+  }
+  return result;
+}
+
+/* only returns SERIOUS errors */
+static CURLcode hsts_add(struct hsts *h, const char *line)
 {
   /* Example lines:
      example.com "20191231 10:00:00"
      .example.net "20191231 10:00:00"
    */
-  char host[MAX_HSTS_HOSTLEN + 1];
-  char date[MAX_HSTS_DATELEN + 1];
-  int rc;
+  struct Curl_str host;
+  struct Curl_str date;
 
-  rc = sscanf(line,
-              "%" MAX_HSTS_HOSTLENSTR "s \"%" MAX_HSTS_DATELENSTR "[^\"]\"",
-              host, date);
-  if(2 == rc) {
-    time_t expires = strcmp(date, UNLIMITED) ? Curl_getdate_capped(date) :
-      TIME_T_MAX;
-    CURLcode result = CURLE_OK;
-    char *p = host;
-    bool subdomain = FALSE;
-    struct stsentry *e;
-    if(p[0] == '.') {
-      p++;
-      subdomain = TRUE;
-    }
-    /* only add it if not already present */
-    e = Curl_hsts(h, p, subdomain);
-    if(!e)
-      result = hsts_create(h, p, subdomain, expires);
-    else {
-      /* the same host name, use the largest expire time */
-      if(expires > e->expires)
-        e->expires = expires;
-    }
-    if(result)
-      return result;
+  if(curlx_str_word(&line, &host, MAX_HSTS_HOSTLEN) ||
+     curlx_str_singlespace(&line) ||
+     curlx_str_quotedword(&line, &date, MAX_HSTS_DATELEN) ||
+     curlx_str_newline(&line))
+    ;
+  else {
+    return hsts_add_host_expire(h, curlx_str(&host), curlx_strlen(&host),
+                                curlx_str(&date), curlx_strlen(&date),
+                                FALSE);
   }
 
   return CURLE_OK;
@@ -465,25 +516,26 @@ static CURLcode hsts_pull(struct Curl_easy *data, struct hsts *h)
       char buffer[MAX_HSTS_HOSTLEN + 1];
       struct curl_hstsentry e;
       e.name = buffer;
-      e.namelen = sizeof(buffer)-1;
+      e.namelen = sizeof(buffer) - 1;
       e.includeSubDomains = FALSE; /* default */
       e.expire[0] = 0;
-      e.name[0] = 0; /* just to make it clean */
+      e.expire[MAX_HSTS_DATELEN] = 0;
+      e.name[0] = 0; /* to make it clean */
+      e.name[MAX_HSTS_HOSTLEN] = 0;
       sc = data->set.hsts_read(data, &e, data->set.hsts_read_userp);
       if(sc == CURLSTS_OK) {
-        time_t expires;
         CURLcode result;
-        if(!e.name[0])
-          /* bail out if no name was stored */
+        const char *date = e.expire;
+        if(!e.name[0] || e.expire[MAX_HSTS_DATELEN] ||
+           e.name[MAX_HSTS_HOSTLEN])
+          /* bail out if no name was stored or if a null-terminator is gone */
           return CURLE_BAD_FUNCTION_ARGUMENT;
-        if(e.expire[0])
-          expires = Curl_getdate_capped(e.expire);
-        else
-          expires = TIME_T_MAX; /* the end of time */
-        result = hsts_create(h, e.name,
-                             /* bitfield to bool conversion: */
-                             e.includeSubDomains ? TRUE : FALSE,
-                             expires);
+        if(!date[0])
+          date = UNLIMITED;
+        result = hsts_add_host_expire(h, e.name, strlen(e.name),
+                                      date, strlen(date),
+                                      /* bitfield to bool conversion: */
+                                      e.includeSubDomains ? TRUE : FALSE);
         if(result)
           return result;
       }
@@ -505,40 +557,42 @@ static CURLcode hsts_pull(struct Curl_easy *data, struct hsts *h)
 static CURLcode hsts_load(struct hsts *h, const char *file)
 {
   CURLcode result = CURLE_OK;
-  char *line = NULL;
   FILE *fp;
 
-  /* we need a private copy of the file name so that the hsts cache file
+  /* we need a private copy of the filename so that the hsts cache file
      name survives an easy handle reset */
-  free(h->filename);
-  h->filename = strdup(file);
+  curlx_free(h->filename);
+  h->filename = curlx_strdup(file);
   if(!h->filename)
     return CURLE_OUT_OF_MEMORY;
 
-  fp = fopen(file, FOPEN_READTEXT);
+  fp = curlx_fopen(file, FOPEN_READTEXT);
   if(fp) {
-    line = malloc(MAX_HSTS_LINE);
-    if(!line)
-      goto fail;
-    while(Curl_get_line(line, MAX_HSTS_LINE, fp)) {
-      char *lineptr = line;
-      while(*lineptr && ISBLANK(*lineptr))
-        lineptr++;
-      if(*lineptr == '#')
-        /* skip commented lines */
-        continue;
+    curlx_struct_stat stat;
+    if((curlx_fstat(fileno(fp), &stat) == -1) || !S_ISDIR(stat.st_mode)) {
+      struct dynbuf buf;
+      bool eof = FALSE;
+      curlx_dyn_init(&buf, MAX_HSTS_LINE);
+      do {
+        result = Curl_get_line(&buf, fp, &eof);
+        if(!result) {
+          const char *lineptr = curlx_dyn_ptr(&buf);
+          curlx_str_passblanks(&lineptr);
 
-      hsts_add(h, lineptr);
+          /* Skip empty or commented lines, since we know the line will have
+             a trailing newline from Curl_get_line we can treat length 1 as
+             empty. */
+          if((*lineptr == '#') || strlen(lineptr) <= 1)
+            continue;
+
+          hsts_add(h, lineptr);
+        }
+      } while(!result && !eof);
+      curlx_dyn_free(&buf); /* free the line buffer */
     }
-    free(line); /* free the line buffer */
-    fclose(fp);
+    curlx_fclose(fp);
   }
   return result;
-
-fail:
-  Curl_safefree(h->filename);
-  fclose(fp);
-  return CURLE_OUT_OF_MEMORY;
 }
 
 /*
@@ -562,18 +616,31 @@ CURLcode Curl_hsts_loadcb(struct Curl_easy *data, struct hsts *h)
   return CURLE_OK;
 }
 
-void Curl_hsts_loadfiles(struct Curl_easy *data)
+CURLcode Curl_hsts_loadfiles(struct Curl_easy *data)
 {
-  struct curl_slist *l = data->set.hstslist;
+  CURLcode result = CURLE_OK;
+  struct curl_slist *l = data->state.hstslist;
   if(l) {
     Curl_share_lock(data, CURL_LOCK_DATA_HSTS, CURL_LOCK_ACCESS_SINGLE);
 
     while(l) {
-      (void)Curl_hsts_loadfile(data, data->hsts, l->data);
+      result = Curl_hsts_loadfile(data, data->hsts, l->data);
+      if(result)
+        break;
       l = l->next;
     }
     Curl_share_unlock(data, CURL_LOCK_DATA_HSTS);
   }
+  return result;
 }
 
+bool Curl_hsts_applies(struct hsts *h, const struct Curl_peer *dest)
+{
+  return !!hsts_check(h, dest->hostname, strlen(dest->hostname), TRUE);
+}
+
+#if defined(DEBUGBUILD) || defined(UNITTESTS)
+#undef time
+#endif
+
 #endif /* CURL_DISABLE_HTTP || CURL_DISABLE_HSTS */
diff --git a/third-party/curl/lib/hsts.h b/third-party/curl/lib/hsts.h
index d3431a5d7a..08215f5eaa 100644
--- a/third-party/curl/lib/hsts.h
+++ b/third-party/curl/lib/hsts.h
@@ -25,22 +25,27 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
+struct hsts;
+
 #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_HSTS)
-#include <curl/curl.h>
 #include "llist.h"
 
-#ifdef DEBUGBUILD
+struct Curl_peer;
+
+#define MAX_HSTS_ENTRIES 10000
+
+#if defined(DEBUGBUILD) || defined(UNITTESTS)
 extern time_t deltatime;
 #endif
 
 struct stsentry {
-  struct Curl_llist_element node;
-  const char *host;
-  bool includeSubDomains;
+  struct Curl_llist_node node;
   curl_off_t expires; /* the timestamp of this entry's expiry */
+  BIT(includeSubDomains);
+  char host[1];
 };
 
-/* The HSTS cache. Needs to be able to tailmatch host names. */
+/* The HSTS cache. Needs to be able to tailmatch hostnames. */
 struct hsts {
   struct Curl_llist list;
   char *filename;
@@ -49,21 +54,23 @@ struct hsts {
 
 struct hsts *Curl_hsts_init(void);
 void Curl_hsts_cleanup(struct hsts **hp);
+CURLcode Curl_hsts_copy(struct hsts *dst, struct hsts *src);
 CURLcode Curl_hsts_parse(struct hsts *h, const char *hostname,
-                         const char *sts);
-struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
-                           bool subdomain);
+                         const char *header);
 CURLcode Curl_hsts_save(struct Curl_easy *data, struct hsts *h,
                         const char *file);
 CURLcode Curl_hsts_loadfile(struct Curl_easy *data,
                             struct hsts *h, const char *file);
 CURLcode Curl_hsts_loadcb(struct Curl_easy *data,
                           struct hsts *h);
-void Curl_hsts_loadfiles(struct Curl_easy *data);
+CURLcode Curl_hsts_loadfiles(struct Curl_easy *data);
+
+bool Curl_hsts_applies(struct hsts *h, const struct Curl_peer *dest);
+
 #else
 #define Curl_hsts_cleanup(x)
-#define Curl_hsts_loadcb(x,y) CURLE_OK
-#define Curl_hsts_save(x,y,z)
-#define Curl_hsts_loadfiles(x)
+#define Curl_hsts_loadcb(x, y) CURLE_OK
+#define Curl_hsts_save(x, y, z)
+#define Curl_hsts_loadfiles(x) CURLE_OK
 #endif /* CURL_DISABLE_HTTP || CURL_DISABLE_HSTS */
 #endif /* HEADER_CURL_HSTS_H */
diff --git a/third-party/curl/lib/http.c b/third-party/curl/lib/http.c
index 4344b9dae5..83d0e01152 100644
--- a/third-party/curl/lib/http.c
+++ b/third-party/curl/lib/http.c
@@ -21,8 +21,8 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+#include "urldata.h"
 
 #ifndef CURL_DISABLE_HTTP
 
@@ -47,214 +47,96 @@
 #include <sys/param.h>
 #endif
 
-#ifdef USE_HYPER
-#include <hyper.h>
-#endif
-
-#include "urldata.h"
-#include <curl/curl.h>
 #include "transfer.h"
 #include "sendf.h"
+#include "curl_trc.h"
 #include "formdata.h"
 #include "mime.h"
 #include "progress.h"
-#include "curl_base64.h"
+#include "curlx/base64.h"
 #include "cookie.h"
 #include "vauth/vauth.h"
-#include "vtls/vtls.h"
 #include "vquic/vquic.h"
 #include "http_digest.h"
 #include "http_ntlm.h"
-#include "curl_ntlm_wb.h"
 #include "http_negotiate.h"
 #include "http_aws_sigv4.h"
 #include "url.h"
-#include "share.h"
+#include "urlapi-int.h"
+#include "curl_share.h"
 #include "hostip.h"
 #include "dynhds.h"
 #include "http.h"
+#include "headers.h"
 #include "select.h"
 #include "parsedate.h" /* for the week day and month names */
-#include "strtoofft.h"
 #include "multiif.h"
 #include "strcase.h"
 #include "content_encoding.h"
 #include "http_proxy.h"
-#include "warnless.h"
 #include "http2.h"
 #include "cfilters.h"
 #include "connect.h"
-#include "strdup.h"
+#include "curlx/strdup.h"
 #include "altsvc.h"
 #include "hsts.h"
+#include "rtsp.h"
 #include "ws.h"
-#include "c-hyper.h"
-#include "curl_ctype.h"
+#include "bufref.h"
+#include "curlx/strparse.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+void Curl_http_neg_init(struct Curl_easy *data, struct http_negotiation *neg)
+{
+  memset(neg, 0, sizeof(*neg));
+  neg->accept_09 = data->set.http09_allowed;
+  switch(data->set.httpwant) {
+  case CURL_HTTP_VERSION_1_0:
+    neg->wanted = neg->allowed = (CURL_HTTP_V1x);
+    neg->only_10 = TRUE;
+    break;
+  case CURL_HTTP_VERSION_1_1:
+    neg->wanted = neg->allowed = (CURL_HTTP_V1x);
+    break;
+  case CURL_HTTP_VERSION_2_0:
+    neg->wanted = neg->allowed = (CURL_HTTP_V1x | CURL_HTTP_V2x);
+    neg->h2_upgrade = TRUE;
+    break;
+  case CURL_HTTP_VERSION_2TLS:
+    neg->wanted = neg->allowed = (CURL_HTTP_V1x | CURL_HTTP_V2x);
+    break;
+  case CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE:
+    neg->wanted = neg->allowed = (CURL_HTTP_V2x);
+    data->state.http_neg.h2_prior_knowledge = TRUE;
+    break;
+  case CURL_HTTP_VERSION_3:
+    neg->wanted = (CURL_HTTP_V1x | CURL_HTTP_V2x | CURL_HTTP_V3x);
+    neg->allowed = neg->wanted;
+    break;
+  case CURL_HTTP_VERSION_3ONLY:
+    neg->wanted = neg->allowed = (CURL_HTTP_V3x);
+    break;
+  case CURL_HTTP_VERSION_NONE:
+  default:
+    neg->wanted = (CURL_HTTP_V1x | CURL_HTTP_V2x);
+    neg->allowed = (CURL_HTTP_V1x | CURL_HTTP_V2x | CURL_HTTP_V3x);
+    break;
+  }
+}
 
-/*
- * Forward declarations.
- */
-
-static int http_getsock_do(struct Curl_easy *data,
-                           struct connectdata *conn,
-                           curl_socket_t *socks);
-static bool http_should_fail(struct Curl_easy *data);
-
-static CURLcode http_setup_conn(struct Curl_easy *data,
-                                struct connectdata *conn);
-#ifdef USE_WEBSOCKETS
-static CURLcode ws_setup_conn(struct Curl_easy *data,
-                              struct connectdata *conn);
-#endif
-
-/*
- * HTTP handler interface.
- */
-const struct Curl_handler Curl_handler_http = {
-  "HTTP",                               /* scheme */
-  http_setup_conn,                      /* setup_connection */
-  Curl_http,                            /* do_it */
-  Curl_http_done,                       /* done */
-  ZERO_NULL,                            /* do_more */
-  Curl_http_connect,                    /* connect_it */
-  ZERO_NULL,                            /* connecting */
-  ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  http_getsock_do,                      /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  ZERO_NULL,                            /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_HTTP,                            /* defport */
-  CURLPROTO_HTTP,                       /* protocol */
-  CURLPROTO_HTTP,                       /* family */
-  PROTOPT_CREDSPERREQUEST |             /* flags */
-  PROTOPT_USERPWDCTRL
-};
-
-#ifdef USE_WEBSOCKETS
-const struct Curl_handler Curl_handler_ws = {
-  "WS",                                 /* scheme */
-  ws_setup_conn,                        /* setup_connection */
-  Curl_http,                            /* do_it */
-  Curl_http_done,                       /* done */
-  ZERO_NULL,                            /* do_more */
-  Curl_http_connect,                    /* connect_it */
-  ZERO_NULL,                            /* connecting */
-  ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  http_getsock_do,                      /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  Curl_ws_disconnect,                   /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_HTTP,                            /* defport */
-  CURLPROTO_WS,                         /* protocol */
-  CURLPROTO_HTTP,                       /* family */
-  PROTOPT_CREDSPERREQUEST |             /* flags */
-  PROTOPT_USERPWDCTRL
-};
-#endif
-
-#ifdef USE_SSL
-/*
- * HTTPS handler interface.
- */
-const struct Curl_handler Curl_handler_https = {
-  "HTTPS",                              /* scheme */
-  http_setup_conn,                      /* setup_connection */
-  Curl_http,                            /* do_it */
-  Curl_http_done,                       /* done */
-  ZERO_NULL,                            /* do_more */
-  Curl_http_connect,                    /* connect_it */
-  NULL,                                 /* connecting */
-  ZERO_NULL,                            /* doing */
-  NULL,                                 /* proto_getsock */
-  http_getsock_do,                      /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  ZERO_NULL,                            /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_HTTPS,                           /* defport */
-  CURLPROTO_HTTPS,                      /* protocol */
-  CURLPROTO_HTTP,                       /* family */
-  PROTOPT_SSL | PROTOPT_CREDSPERREQUEST | PROTOPT_ALPN | /* flags */
-  PROTOPT_USERPWDCTRL
-};
-
-#ifdef USE_WEBSOCKETS
-const struct Curl_handler Curl_handler_wss = {
-  "WSS",                                /* scheme */
-  ws_setup_conn,                        /* setup_connection */
-  Curl_http,                            /* do_it */
-  Curl_http_done,                       /* done */
-  ZERO_NULL,                            /* do_more */
-  Curl_http_connect,                    /* connect_it */
-  NULL,                                 /* connecting */
-  ZERO_NULL,                            /* doing */
-  NULL,                                 /* proto_getsock */
-  http_getsock_do,                      /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  Curl_ws_disconnect,                   /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_HTTPS,                           /* defport */
-  CURLPROTO_WSS,                        /* protocol */
-  CURLPROTO_HTTP,                       /* family */
-  PROTOPT_SSL | PROTOPT_CREDSPERREQUEST | /* flags */
-  PROTOPT_USERPWDCTRL
-};
-#endif
-
-#endif
-
-static CURLcode http_setup_conn(struct Curl_easy *data,
-                                struct connectdata *conn)
+CURLcode Curl_http_setup_conn(struct Curl_easy *data,
+                              struct connectdata *conn)
 {
   /* allocate the HTTP-specific struct for the Curl_easy, only to survive
      during this request */
-  struct HTTP *http;
-  DEBUGASSERT(data->req.p.http == NULL);
-
-  http = calloc(1, sizeof(struct HTTP));
-  if(!http)
-    return CURLE_OUT_OF_MEMORY;
-
-  data->req.p.http = http;
-  connkeep(conn, "HTTP default");
-
-  if(data->state.httpwant == CURL_HTTP_VERSION_3ONLY) {
-    CURLcode result = Curl_conn_may_http3(data, conn);
+  if(data->state.http_neg.wanted == CURL_HTTP_V3x) {
+    /* only HTTP/3, needs to work */
+    CURLcode result = Curl_conn_may_http3(data, conn, conn->transport_wanted);
     if(result)
       return result;
   }
-
   return CURLE_OK;
 }
 
-#ifdef USE_WEBSOCKETS
-static CURLcode ws_setup_conn(struct Curl_easy *data,
-                              struct connectdata *conn)
-{
-  /* websockets is 1.1 only (for now) */
-  data->state.httpwant = CURL_HTTP_VERSION_1_1;
-  return http_setup_conn(data, conn);
-}
-#endif
-
 #ifndef CURL_DISABLE_PROXY
 /*
  * checkProxyHeaders() checks the linked list of custom proxy headers
@@ -272,72 +154,91 @@ char *Curl_checkProxyheaders(struct Curl_easy *data,
 {
   struct curl_slist *head;
 
-  for(head = (conn->bits.proxy && data->set.sep_headers) ?
+  for(head = (conn->http_proxy.peer && data->set.sep_headers) ?
         data->set.proxyheaders : data->set.headers;
       head; head = head->next) {
-    if(strncasecompare(head->data, thisheader, thislen) &&
+    if(curl_strnequal(head->data, thisheader, thislen) &&
        Curl_headersep(head->data[thislen]))
       return head->data;
   }
 
   return NULL;
 }
-#else
-/* disabled */
-#define Curl_checkProxyheaders(x,y,z,a) NULL
 #endif
 
+/* If the header has a value, this function returns TRUE and the value is in
+   'outp' with blanks trimmed off.
+*/
+static bool header_has_value(const char **headerp, struct Curl_str *outp)
+{
+  bool value = !curlx_str_cspn(headerp, outp, ";:") &&
+    (!curlx_str_single(headerp, ':') || !curlx_str_single(headerp, ';'));
+
+  if(value) {
+    curlx_str_untilnl(headerp, outp, MAX_HTTP_RESP_HEADER_SIZE);
+    curlx_str_trimblanks(outp);
+  }
+  return value;
+}
+
+static bool http_header_is_empty(const char *header)
+{
+  struct Curl_str out;
+
+  if(header_has_value(&header, &out)) {
+    return curlx_strlen(&out) == 0;
+  }
+  return TRUE; /* invalid header format, treat as empty */
+}
+
 /*
- * Strip off leading and trailing whitespace from the value in the
- * given HTTP header line and return a strdupped copy. Returns NULL in
- * case of allocation failure. Returns an empty string if the header value
- * consists entirely of whitespace.
+ * Strip off leading and trailing whitespace from the value in the given HTTP
+ * header line and return a strdup-ed copy in 'valp' - returns an empty
+ * string if the header value consists entirely of whitespace.
+ *
+ * If the header is provided as "name;", ending with a semicolon, it returns a
+ * blank string.
+ */
+static CURLcode copy_custom_value(const char *header, char **valp)
+{
+  struct Curl_str out;
+
+  /* find the end of the header name */
+  if(header_has_value(&header, &out)) {
+    *valp = curlx_memdup0(curlx_str(&out), curlx_strlen(&out));
+    if(*valp)
+      return CURLE_OK;
+    return CURLE_OUT_OF_MEMORY;
+  }
+  /* bad input */
+  *valp = NULL;
+  return CURLE_BAD_FUNCTION_ARGUMENT;
+}
+
+/*
+ * Strip off leading and trailing whitespace from the value in the given HTTP
+ * header line and return a strdup-ed copy in 'valp' - returns an empty
+ * string if the header value consists entirely of whitespace.
+ *
+ * This function MUST be used after the header has already been confirmed to
+ * lead with "word:".
+ *
+ * @unittest: 1626
  */
 char *Curl_copy_header_value(const char *header)
 {
-  const char *start;
-  const char *end;
-  char *value;
-  size_t len;
+  struct Curl_str out;
 
-  /* Find the end of the header name */
-  while(*header && (*header != ':'))
-    ++header;
-
-  if(*header)
-    /* Skip over colon */
-    ++header;
-
-  /* Find the first non-space letter */
-  start = header;
-  while(*start && ISSPACE(*start))
-    start++;
-
-  /* data is in the host encoding so
-     use '\r' and '\n' instead of 0x0d and 0x0a */
-  end = strchr(start, '\r');
-  if(!end)
-    end = strchr(start, '\n');
-  if(!end)
-    end = strchr(start, '\0');
-  if(!end)
-    return NULL;
-
-  /* skip all trailing space letters */
-  while((end > start) && ISSPACE(*end))
-    end--;
-
-  /* get length of the type */
-  len = end - start + 1;
-
-  value = malloc(len + 1);
-  if(!value)
-    return NULL;
-
-  memcpy(value, start, len);
-  value[len] = 0; /* null-terminate */
-
-  return value;
+  /* find the end of the header name */
+  if(!curlx_str_until(&header, &out, MAX_HTTP_RESP_HEADER_SIZE, ':') &&
+     !curlx_str_single(&header, ':')) {
+    curlx_str_untilnl(&header, &out, MAX_HTTP_RESP_HEADER_SIZE);
+    curlx_str_trimblanks(&out);
+    return curlx_memdup0(curlx_str(&out), curlx_strlen(&out));
+  }
+  /* bad input, should never happen */
+  DEBUGASSERT(0);
+  return NULL;
 }
 
 #ifndef CURL_DISABLE_HTTP_AUTH
@@ -349,38 +250,43 @@ char *Curl_copy_header_value(const char *header)
  *
  * Returns CURLcode.
  */
-static CURLcode http_output_basic(struct Curl_easy *data, bool proxy)
+static CURLcode http_output_basic(struct Curl_easy *data,
+                                  struct connectdata *conn, bool proxy)
 {
   size_t size = 0;
   char *authorization = NULL;
-  char **userp;
-  const char *user;
-  const char *pwd;
+  char **p_hd;
   CURLcode result;
+  struct Curl_creds *creds = NULL;
   char *out;
 
   /* credentials are unique per transfer for HTTP, do not use the ones for the
      connection */
   if(proxy) {
 #ifndef CURL_DISABLE_PROXY
-    userp = &data->state.aptr.proxyuserpwd;
-    user = data->state.aptr.proxyuser;
-    pwd = data->state.aptr.proxypasswd;
+    p_hd = &data->req.hd_proxy_auth;
+    creds = conn->http_proxy.creds;
 #else
+    (void)conn;
     return CURLE_NOT_BUILT_IN;
 #endif
   }
   else {
-    userp = &data->state.aptr.userpwd;
-    user = data->state.aptr.user;
-    pwd = data->state.aptr.passwd;
+    p_hd = &data->req.hd_auth;
+    creds = data->state.creds;
   }
 
-  out = aprintf("%s:%s", user ? user : "", pwd ? pwd : "");
+  if(!creds) {
+    DEBUGASSERT(0);
+    return CURLE_FAILED_INIT;
+  }
+
+  out = curl_maprintf("%s:%s", creds->user, creds->passwd);
   if(!out)
     return CURLE_OUT_OF_MEMORY;
 
-  result = Curl_base64_encode(out, strlen(out), &authorization, &size);
+  result = curlx_base64_encode((uint8_t *)out, strlen(out),
+                               &authorization, &size);
   if(result)
     goto fail;
 
@@ -389,18 +295,18 @@ static CURLcode http_output_basic(struct Curl_easy *data, bool proxy)
     goto fail;
   }
 
-  free(*userp);
-  *userp = aprintf("%sAuthorization: Basic %s\r\n",
-                   proxy ? "Proxy-" : "",
-                   authorization);
-  free(authorization);
-  if(!*userp) {
+  curlx_free(*p_hd);
+  *p_hd = curl_maprintf("%sAuthorization: Basic %s\r\n",
+                        proxy ? "Proxy-" : "",
+                        authorization);
+  curlx_free(authorization);
+  if(!*p_hd) {
     result = CURLE_OUT_OF_MEMORY;
     goto fail;
   }
 
 fail:
-  free(out);
+  curlx_free(out);
   return result;
 }
 
@@ -418,10 +324,11 @@ static CURLcode http_output_bearer(struct Curl_easy *data)
   char **userp;
   CURLcode result = CURLE_OK;
 
-  userp = &data->state.aptr.userpwd;
-  free(*userp);
-  *userp = aprintf("Authorization: Bearer %s\r\n",
-                   data->set.str[STRING_BEARER]);
+  DEBUGASSERT(Curl_creds_has_oauth_bearer(data->state.creds));
+  userp = &data->req.hd_auth;
+  curlx_free(*userp);
+  *userp = curl_maprintf("Authorization: Bearer %s\r\n",
+                         Curl_creds_oauth_bearer(data->state.creds));
 
   if(!*userp) {
     result = CURLE_OUT_OF_MEMORY;
@@ -431,18 +338,19 @@ static CURLcode http_output_bearer(struct Curl_easy *data)
 fail:
   return result;
 }
-
 #endif
 
 #endif
 
-/* pickoneauth() selects the most favourable authentication method from the
+/* pickoneauth() selects the most favorable authentication method from the
  * ones available and the ones we want.
  *
  * return TRUE if one was picked
  */
-static bool pickoneauth(struct auth *pick, unsigned long mask)
+static bool pickoneauth(struct auth *pick, unsigned long mask,
+                        struct Curl_creds *creds)
 {
+  bool have_user_pass = Curl_creds_has_user_or_pass(creds);
   bool picked;
   /* only deal with authentication we want */
   unsigned long avail = pick->avail & pick->want & mask;
@@ -450,22 +358,20 @@ static bool pickoneauth(struct auth *pick, unsigned long mask)
 
   /* The order of these checks is highly relevant, as this will be the order
      of preference in case of the existence of multiple accepted types. */
-  if(avail & CURLAUTH_NEGOTIATE)
+  if(avail & CURLAUTH_NEGOTIATE)  /* available on empty creds */
     pick->picked = CURLAUTH_NEGOTIATE;
 #ifndef CURL_DISABLE_BEARER_AUTH
-  else if(avail & CURLAUTH_BEARER)
+  else if((avail & CURLAUTH_BEARER) && Curl_creds_has_oauth_bearer(creds))
     pick->picked = CURLAUTH_BEARER;
 #endif
 #ifndef CURL_DISABLE_DIGEST_AUTH
-  else if(avail & CURLAUTH_DIGEST)
+  else if((avail & CURLAUTH_DIGEST) && have_user_pass)
     pick->picked = CURLAUTH_DIGEST;
 #endif
   else if(avail & CURLAUTH_NTLM)
     pick->picked = CURLAUTH_NTLM;
-  else if(avail & CURLAUTH_NTLM_WB)
-    pick->picked = CURLAUTH_NTLM_WB;
 #ifndef CURL_DISABLE_BASIC_AUTH
-  else if(avail & CURLAUTH_BASIC)
+  else if((avail & CURLAUTH_BASIC) && have_user_pass)
     pick->picked = CURLAUTH_BASIC;
 #endif
 #ifndef CURL_DISABLE_AWS
@@ -484,169 +390,174 @@ static bool pickoneauth(struct auth *pick, unsigned long mask)
 /*
  * http_perhapsrewind()
  *
- * If we are doing POST or PUT {
- *   If we have more data to send {
- *     If we are doing NTLM {
- *       Keep sending since we must not disconnect
- *     }
- *     else {
- *       If there is more than just a little data left to send, close
- *       the current connection by force.
- *     }
- *   }
- *   If we have sent any data {
- *     If we don't have track of all the data {
- *       call app to tell it to rewind
- *     }
- *     else {
- *       rewind internally so that the operation can restart fine
- *     }
- *   }
- * }
+ * The current request needs to be done again - maybe due to a follow
+ * or authentication negotiation. Check if:
+ * 1) a rewind of the data sent to the server is necessary
+ * 2) the current transfer should continue or be stopped early
  */
 static CURLcode http_perhapsrewind(struct Curl_easy *data,
                                    struct connectdata *conn)
 {
-  struct HTTP *http = data->req.p.http;
-  curl_off_t bytessent;
-  curl_off_t expectsend = -1; /* default is unknown */
+  curl_off_t bytessent = data->req.writebytecount;
+  curl_off_t expectsend = Curl_creader_total_length(data);
+  curl_off_t upload_remain = (expectsend >= 0) ? (expectsend - bytessent) : -1;
+  bool little_upload_remains = (upload_remain >= 0 && upload_remain < 2000);
+  bool needs_rewind = Curl_creader_needs_rewind(data);
+  /* By default, we would like to abort the transfer when little or unknown
+   * amount remains. This may be overridden by authentications further
+   * below! */
+  bool abort_upload = (!data->req.upload_done && !little_upload_remains);
+  VERBOSE(const char *ongoing_auth = NULL);
 
-  if(!http)
-    /* If this is still NULL, we have not reach very far and we can safely
-       skip this rewinding stuff */
+  /* We need a rewind before uploading client read data again. The
+   * checks below influence of the upload is to be continued
+   * or aborted early.
+   * This depends on how much remains to be sent and in what state
+   * the authentication is. Some auth schemes such as NTLM do not work
+   * for a new connection. */
+  if(needs_rewind) {
+    infof(data, "Need to rewind upload for next request");
+    Curl_creader_set_rewind(data, TRUE);
+  }
+
+  if(conn->bits.close)
+    /* If we already decided to close this connection, we cannot veto. */
     return CURLE_OK;
 
-  switch(data->state.httpreq) {
-  case HTTPREQ_GET:
-  case HTTPREQ_HEAD:
-    return CURLE_OK;
-  default:
-    break;
-  }
-
-  bytessent = data->req.writebytecount;
-
-  if(conn->bits.authneg) {
-    /* This is a state where we are known to be negotiating and we don't send
-       any data then. */
-    expectsend = 0;
-  }
-  else if(!conn->bits.protoconnstart) {
-    /* HTTP CONNECT in progress: there is no body */
-    expectsend = 0;
-  }
-  else {
-    /* figure out how much data we are expected to send */
-    switch(data->state.httpreq) {
-    case HTTPREQ_POST:
-    case HTTPREQ_PUT:
-      if(data->state.infilesize != -1)
-        expectsend = data->state.infilesize;
-      break;
-    case HTTPREQ_POST_FORM:
-    case HTTPREQ_POST_MIME:
-      expectsend = http->postsize;
-      break;
-    default:
-      break;
-    }
-  }
-
-  data->state.rewindbeforesend = FALSE; /* default */
-
-  if((expectsend == -1) || (expectsend > bytessent)) {
-#if defined(USE_NTLM)
-    /* There is still data left to send */
+  if(abort_upload) {
+    /* We would like to abort the upload - but should we? */
+#ifdef USE_NTLM
     if((data->state.authproxy.picked == CURLAUTH_NTLM) ||
-       (data->state.authhost.picked == CURLAUTH_NTLM) ||
-       (data->state.authproxy.picked == CURLAUTH_NTLM_WB) ||
-       (data->state.authhost.picked == CURLAUTH_NTLM_WB)) {
-      if(((expectsend - bytessent) < 2000) ||
-         (conn->http_ntlm_state != NTLMSTATE_NONE) ||
+       (data->state.authhost.picked == CURLAUTH_NTLM)) {
+      VERBOSE(ongoing_auth = "NTLM");
+      if((conn->http_ntlm_state != NTLMSTATE_NONE) ||
          (conn->proxy_ntlm_state != NTLMSTATE_NONE)) {
-        /* The NTLM-negotiation has started *OR* there is just a little (<2K)
-           data left to send, keep on sending. */
-
-        /* rewind data when completely done sending! */
-        if(!conn->bits.authneg && (conn->writesockfd != CURL_SOCKET_BAD)) {
-          data->state.rewindbeforesend = TRUE;
-          infof(data, "Rewind stream before next send");
-        }
-
-        return CURLE_OK;
+        /* The NTLM-negotiation has started, keep on sending.
+         * Need to do further work on same connection */
+        abort_upload = FALSE;
       }
-
-      if(conn->bits.close)
-        /* this is already marked to get closed */
-        return CURLE_OK;
-
-      infof(data, "NTLM send, close instead of sending %"
-            CURL_FORMAT_CURL_OFF_T " bytes",
-            (curl_off_t)(expectsend - bytessent));
     }
 #endif
-#if defined(USE_SPNEGO)
+#ifdef USE_SPNEGO
     /* There is still data left to send */
     if((data->state.authproxy.picked == CURLAUTH_NEGOTIATE) ||
        (data->state.authhost.picked == CURLAUTH_NEGOTIATE)) {
-      if(((expectsend - bytessent) < 2000) ||
-         (conn->http_negotiate_state != GSS_AUTHNONE) ||
+      VERBOSE(ongoing_auth = "NEGOTIATE");
+      if((conn->http_negotiate_state != GSS_AUTHNONE) ||
          (conn->proxy_negotiate_state != GSS_AUTHNONE)) {
-        /* The NEGOTIATE-negotiation has started *OR*
-        there is just a little (<2K) data left to send, keep on sending. */
-
-        /* rewind data when completely done sending! */
-        if(!conn->bits.authneg && (conn->writesockfd != CURL_SOCKET_BAD)) {
-          data->state.rewindbeforesend = TRUE;
-          infof(data, "Rewind stream before next send");
-        }
-
-        return CURLE_OK;
+        /* The NEGOTIATE-negotiation has started, keep on sending.
+         * Need to do further work on same connection */
+        abort_upload = FALSE;
       }
-
-      if(conn->bits.close)
-        /* this is already marked to get closed */
-        return CURLE_OK;
-
-      infof(data, "NEGOTIATE send, close instead of sending %"
-        CURL_FORMAT_CURL_OFF_T " bytes",
-        (curl_off_t)(expectsend - bytessent));
     }
 #endif
+  }
 
-    /* This is not NEGOTIATE/NTLM or many bytes left to send: close */
+  if(abort_upload) {
+    if(upload_remain >= 0)
+      infof(data, "%s%sclose instead of sending %" FMT_OFF_T " more bytes",
+            ongoing_auth ? ongoing_auth : "",
+            ongoing_auth ? " send, " : "",
+            upload_remain);
+    else
+      infof(data, "%s%sclose instead of sending unknown amount "
+            "of more bytes",
+            ongoing_auth ? ongoing_auth : "",
+            ongoing_auth ? " send, " : "");
+    /* We decided to abort the ongoing transfer */
     streamclose(conn, "Mid-auth HTTP and much data left to send");
-    data->req.size = 0; /* don't download any more than 0 bytes */
-
-    /* There still is data left to send, but this connection is marked for
-       closure so we can safely do the rewind right now */
+    data->req.size = 0; /* do not download any more than 0 bytes */
+    data->req.http_bodyless = TRUE;
   }
-
-  if(bytessent) {
-    /* mark for rewind since if we already sent something */
-    data->state.rewindbeforesend = TRUE;
-    infof(data, "Please rewind output before next send");
-  }
-
   return CURLE_OK;
 }
 
+/**
+ * http_should_fail() determines whether an HTTP response code has gotten us
+ * into an error state or not.
+ *
+ * @retval FALSE communications should continue
+ *
+ * @retval TRUE communications should not continue
+ */
+static bool http_should_fail(struct Curl_easy *data, int httpcode)
+{
+  DEBUGASSERT(data);
+  DEBUGASSERT(data->conn);
+
+  /*
+   * If we have not been asked to fail on error,
+   * do not fail.
+   */
+  if(!data->set.http_fail_on_error)
+    return FALSE;
+
+  /*
+   * Any code < 400 is never terminal.
+   */
+  if(httpcode < 400)
+    return FALSE;
+
+  /*
+   * A 416 response to a resume request is presumably because the file is
+   * already completely downloaded and thus not actually a fail.
+   */
+  if(data->state.resume_from && data->state.httpreq == HTTPREQ_GET &&
+     httpcode == 416)
+    return FALSE;
+
+  /*
+   * Any code >= 400 that is not 401 or 407 is always
+   * a terminal error
+   */
+  if((httpcode != 401) && (httpcode != 407))
+    return TRUE;
+
+  /*
+   * All we have left to deal with is 401 and 407
+   */
+  DEBUGASSERT((httpcode == 401) || (httpcode == 407));
+
+  /*
+   * Examine the current authentication state to see if this is an error. The
+   * idea is for this function to get called after processing all the headers
+   * in a response message. If we have been to asked to authenticate
+   * a particular stage, and we have done it, we are OK. If we are already
+   * completely authenticated, it is not OK to get another 401 or 407.
+   *
+   * It is possible for authentication to go stale such that the client needs
+   * to reauthenticate. Once that info is available, use it here.
+   */
+
+  /*
+   * Either we are not authenticating, or we are supposed to be authenticating
+   * something else. This is an error.
+   */
+  if((httpcode == 401) && !data->state.creds)
+    return TRUE;
+#ifndef CURL_DISABLE_PROXY
+  if((httpcode == 407) && !data->conn->http_proxy.creds)
+    return TRUE;
+#endif
+
+  return (bool)data->state.authproblem;
+}
+
 /*
  * Curl_http_auth_act() gets called when all HTTP headers have been received
  * and it checks what authentication methods that are available and decides
  * which one (if any) to use. It will set 'newurl' if an auth method was
  * picked.
  */
-
 CURLcode Curl_http_auth_act(struct Curl_easy *data)
 {
   struct connectdata *conn = data->conn;
   bool pickhost = FALSE;
   bool pickproxy = FALSE;
   CURLcode result = CURLE_OK;
-  unsigned long authmask = ~0ul;
+  unsigned long authmask = ~0UL;
 
-  if(!data->set.str[STRING_BEARER])
+  if(!Curl_creds_has_oauth_bearer(data->state.creds))
     authmask &= (unsigned long)~CURLAUTH_BEARER;
 
   if(100 <= data->req.httpcode && data->req.httpcode <= 199)
@@ -654,64 +565,69 @@ CURLcode Curl_http_auth_act(struct Curl_easy *data)
     return CURLE_OK;
 
   if(data->state.authproblem)
-    return data->set.http_fail_on_error?CURLE_HTTP_RETURNED_ERROR:CURLE_OK;
+    return data->set.http_fail_on_error ? CURLE_HTTP_RETURNED_ERROR : CURLE_OK;
 
-  if((data->state.aptr.user || data->set.str[STRING_BEARER]) &&
+  if(data->state.creds &&
      ((data->req.httpcode == 401) ||
-      (conn->bits.authneg && data->req.httpcode < 300))) {
-    pickhost = pickoneauth(&data->state.authhost, authmask);
+      (data->req.authneg && data->req.httpcode < 300))) {
+    pickhost = pickoneauth(&data->state.authhost, authmask, data->state.creds);
     if(!pickhost)
       data->state.authproblem = TRUE;
+    else
+      data->info.httpauthpicked = data->state.authhost.picked;
     if(data->state.authhost.picked == CURLAUTH_NTLM &&
-       conn->httpversion > 11) {
+       (data->req.httpversion_sent > 11)) {
       infof(data, "Forcing HTTP/1.1 for NTLM");
       connclose(conn, "Force HTTP/1.1 connection");
-      data->state.httpwant = CURL_HTTP_VERSION_1_1;
+      data->state.http_neg.wanted = CURL_HTTP_V1x;
+      data->state.http_neg.allowed = CURL_HTTP_V1x;
     }
   }
 #ifndef CURL_DISABLE_PROXY
-  if(conn->bits.proxy_user_passwd &&
+  if(conn->http_proxy.creds &&
      ((data->req.httpcode == 407) ||
-      (conn->bits.authneg && data->req.httpcode < 300))) {
+      (data->req.authneg && data->req.httpcode < 300))) {
     pickproxy = pickoneauth(&data->state.authproxy,
-                            authmask & ~CURLAUTH_BEARER);
+                            authmask & ~CURLAUTH_BEARER,
+                            conn->http_proxy.creds);
     if(!pickproxy)
       data->state.authproblem = TRUE;
+    else
+      data->info.proxyauthpicked = data->state.authproxy.picked;
   }
 #endif
 
   if(pickhost || pickproxy) {
-    if((data->state.httpreq != HTTPREQ_GET) &&
-       (data->state.httpreq != HTTPREQ_HEAD) &&
-       !data->state.rewindbeforesend) {
-      result = http_perhapsrewind(data, conn);
-      if(result)
-        return result;
-    }
+    result = http_perhapsrewind(data, conn);
+    if(result)
+      return result;
+
     /* In case this is GSS auth, the newurl field is already allocated so
        we must make sure to free it before allocating a new one. As figured
        out in bug #2284386 */
-    Curl_safefree(data->req.newurl);
-    data->req.newurl = strdup(data->state.url); /* clone URL */
+    curlx_free(data->req.newurl);
+    /* clone URL */
+    data->req.newurl = Curl_bufref_dup(&data->state.url);
     if(!data->req.newurl)
       return CURLE_OUT_OF_MEMORY;
   }
   else if((data->req.httpcode < 300) &&
-          (!data->state.authhost.done) &&
-          conn->bits.authneg) {
+          !data->state.authhost.done &&
+          data->req.authneg) {
     /* no (known) authentication available,
        authentication is not "done" yet and
        no authentication seems to be required and
-       we didn't try HEAD or GET */
+       we did not try HEAD or GET */
     if((data->state.httpreq != HTTPREQ_GET) &&
        (data->state.httpreq != HTTPREQ_HEAD)) {
-      data->req.newurl = strdup(data->state.url); /* clone URL */
+      /* clone URL */
+      data->req.newurl = Curl_bufref_dup(&data->state.url);
       if(!data->req.newurl)
         return CURLE_OUT_OF_MEMORY;
       data->state.authhost.done = TRUE;
     }
   }
-  if(http_should_fail(data)) {
+  if(http_should_fail(data, data->req.httpcode)) {
     failf(data, "The requested URL returned error: %d",
           data->req.httpcode);
     result = CURLE_HTTP_RETURNED_ERROR;
@@ -725,13 +641,12 @@ CURLcode Curl_http_auth_act(struct Curl_easy *data)
  * Output the correct authentication header depending on the auth type
  * and whether or not it is to a proxy.
  */
-static CURLcode
-output_auth_headers(struct Curl_easy *data,
-                    struct connectdata *conn,
-                    struct auth *authstatus,
-                    const char *request,
-                    const char *path,
-                    bool proxy)
+static CURLcode output_auth_headers(struct Curl_easy *data,
+                                    struct connectdata *conn,
+                                    struct auth *authstatus,
+                                    const char *request,
+                                    const char *path,
+                                    bool proxy)
 {
   const char *auth = NULL;
   CURLcode result = CURLE_OK;
@@ -742,9 +657,10 @@ output_auth_headers(struct Curl_easy *data,
   (void)path;
 #endif
 #ifndef CURL_DISABLE_AWS
-  if(authstatus->picked == CURLAUTH_AWS_SIGV4) {
+  if((authstatus->picked == CURLAUTH_AWS_SIGV4) && !proxy) {
+    /* this method is never for proxy */
     auth = "AWS_SIGV4";
-    result = Curl_output_aws_sigv4(data, proxy);
+    result = Curl_output_aws_sigv4(data);
     if(result)
       return result;
   }
@@ -768,15 +684,6 @@ output_auth_headers(struct Curl_easy *data,
   }
   else
 #endif
-#if defined(USE_NTLM) && defined(NTLM_WB_ENABLED)
-  if(authstatus->picked == CURLAUTH_NTLM_WB) {
-    auth = "NTLM_WB";
-    result = Curl_output_ntlm_wb(data, conn, proxy);
-    if(result)
-      return result;
-  }
-  else
-#endif
 #ifndef CURL_DISABLE_DIGEST_AUTH
   if(authstatus->picked == CURLAUTH_DIGEST) {
     auth = "Digest";
@@ -794,13 +701,16 @@ output_auth_headers(struct Curl_easy *data,
     /* Basic */
     if(
 #ifndef CURL_DISABLE_PROXY
-      (proxy && conn->bits.proxy_user_passwd &&
-       !Curl_checkProxyheaders(data, conn, STRCONST("Proxy-authorization"))) ||
+       (proxy && conn->http_proxy.creds &&
+        Curl_creds_has_user_or_pass(conn->http_proxy.creds) &&
+        !Curl_checkProxyheaders(data, conn,
+                                STRCONST("Proxy-authorization"))) ||
 #endif
-      (!proxy && data->state.aptr.user &&
-       !Curl_checkheaders(data, STRCONST("Authorization")))) {
+       (!proxy && data->state.creds &&
+        Curl_creds_has_user_or_pass(data->state.creds) &&
+        !Curl_checkheaders(data, STRCONST("Authorization")))) {
       auth = "Basic";
-      result = http_output_basic(data, proxy);
+      result = http_output_basic(data, conn, proxy);
       if(result)
         return result;
     }
@@ -813,8 +723,8 @@ output_auth_headers(struct Curl_easy *data,
 #ifndef CURL_DISABLE_BEARER_AUTH
   if(authstatus->picked == CURLAUTH_BEARER) {
     /* Bearer */
-    if((!proxy && data->set.str[STRING_BEARER] &&
-        !Curl_checkheaders(data, STRCONST("Authorization")))) {
+    if(!proxy && Curl_creds_has_oauth_bearer(data->state.creds) &&
+       !Curl_checkheaders(data, STRCONST("Authorization"))) {
       auth = "Bearer";
       result = http_output_bearer(data);
       if(result)
@@ -829,110 +739,111 @@ output_auth_headers(struct Curl_easy *data,
 
   if(auth) {
 #ifndef CURL_DISABLE_PROXY
+    if(proxy)
+      data->info.proxyauthpicked = authstatus->picked;
+    else
+      data->info.httpauthpicked = authstatus->picked;
     infof(data, "%s auth using %s with user '%s'",
           proxy ? "Proxy" : "Server", auth,
-          proxy ? (data->state.aptr.proxyuser ?
-                   data->state.aptr.proxyuser : "") :
-          (data->state.aptr.user ?
-           data->state.aptr.user : ""));
+          proxy ? (conn->http_proxy.creds ?
+                   conn->http_proxy.creds->user : "") :
+          (data->state.creds ?
+           data->state.creds->user : ""));
 #else
+    (void)proxy;
     infof(data, "Server auth using %s with user '%s'",
-          auth, data->state.aptr.user ?
-          data->state.aptr.user : "");
+          auth, data->state.creds ?
+          data->state.creds->user : "");
 #endif
-    authstatus->multipass = (!authstatus->done) ? TRUE : FALSE;
+    authstatus->multipass = !authstatus->done;
   }
-  else
+  else {
     authstatus->multipass = FALSE;
+    if(proxy)
+      data->info.proxyauthpicked = 0;
+    else
+      data->info.httpauthpicked = 0;
+  }
 
-  return CURLE_OK;
+  return result;
 }
 
-/**
- * Curl_http_output_auth() setups the authentication headers for the
- * host/proxy and the correct authentication
- * method. data->state.authdone is set to TRUE when authentication is
- * done.
- *
- * @param conn all information about the current connection
- * @param request pointer to the request keyword
- * @param path pointer to the requested path; should include query part
- * @param proxytunnel boolean if this is the request setting up a "proxy
- * tunnel"
- *
- * @returns CURLcode
- */
-CURLcode
-Curl_http_output_auth(struct Curl_easy *data,
-                      struct connectdata *conn,
-                      const char *request,
-                      Curl_HttpReq httpreq,
-                      const char *path,
-                      bool proxytunnel) /* TRUE if this is the request setting
-                                           up the proxy tunnel */
+CURLcode Curl_http_output_auth(struct Curl_easy *data,
+                               struct connectdata *conn,
+                               const char *request,
+                               Curl_HttpReq httpreq,
+                               const char *path,
+                               const char *query,
+                               bool is_connect)
 {
   CURLcode result = CURLE_OK;
   struct auth *authhost;
   struct auth *authproxy;
+  const char *path_and_query = path;
+  char *tmp_str = NULL;
 
   DEBUGASSERT(data);
-
   authhost = &data->state.authhost;
   authproxy = &data->state.authproxy;
 
   if(
 #ifndef CURL_DISABLE_PROXY
-    (conn->bits.httpproxy && conn->bits.proxy_user_passwd) ||
+    (!conn->http_proxy.peer || !conn->http_proxy.creds) &&
 #endif
-     data->state.aptr.user ||
 #ifdef USE_SPNEGO
-     authhost->want & CURLAUTH_NEGOTIATE ||
-     authproxy->want & CURLAUTH_NEGOTIATE ||
+    !(authhost->want & CURLAUTH_NEGOTIATE) &&
+    !(authproxy->want & CURLAUTH_NEGOTIATE) &&
 #endif
-     data->set.str[STRING_BEARER])
-    /* continue please */;
-  else {
+    !data->state.creds) {
+    /* no authentication with no user or password */
     authhost->done = TRUE;
     authproxy->done = TRUE;
-    return CURLE_OK; /* no authentication with no user or password */
+    result = CURLE_OK;
+    goto out;
+  }
+
+  if(query) {
+    tmp_str = curl_maprintf("%s?%s", path, query);
+    if(!tmp_str) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+    path_and_query = tmp_str;
   }
 
   if(authhost->want && !authhost->picked)
     /* The app has selected one or more methods, but none has been picked
        so far by a server round-trip. Then we set the picked one to the
-       want one, and if this is one single bit it'll be used instantly. */
+       want one, and if this is one single bit it will be used instantly. */
     authhost->picked = authhost->want;
 
   if(authproxy->want && !authproxy->picked)
     /* The app has selected one or more methods, but none has been picked so
        far by a proxy round-trip. Then we set the picked one to the want one,
-       and if this is one single bit it'll be used instantly. */
+       and if this is one single bit it will be used instantly. */
     authproxy->picked = authproxy->want;
 
 #ifndef CURL_DISABLE_PROXY
   /* Send proxy authentication header if needed */
-  if(conn->bits.httpproxy &&
-     (conn->bits.tunnel_proxy == (bit)proxytunnel)) {
-    result = output_auth_headers(data, conn, authproxy, request, path, TRUE);
+  if(conn->bits.origin_is_proxy || is_connect) {
+    result = output_auth_headers(data, conn, authproxy, request,
+                                 path_and_query, TRUE);
     if(result)
-      return result;
+      goto out;
   }
   else
 #else
-  (void)proxytunnel;
+  (void)is_connect;
 #endif /* CURL_DISABLE_PROXY */
-    /* we have no proxy so let's pretend we're done authenticating
+    /* we have no proxy so let's pretend we are done authenticating
        with it */
     authproxy->done = TRUE;
 
-  /* To prevent the user+password to get sent to other than the original host
-     due to a location-follow */
-  if(Curl_auth_allowed_to_host(data)
-#ifndef CURL_DISABLE_NETRC
-     || conn->bits.netrc
-#endif
-    )
-    result = output_auth_headers(data, conn, authhost, request, path, FALSE);
+  /* Either we have credentials for the origin we talk to or
+     performing authentication is allowed here */
+  if(data->state.creds || Curl_auth_allowed_to_host(data))
+    result = output_auth_headers(data, conn, authhost, request,
+                                 path_and_query, FALSE);
   else
     authhost->done = TRUE;
 
@@ -942,30 +853,176 @@ Curl_http_output_auth(struct Curl_easy *data,
      (httpreq != HTTPREQ_HEAD)) {
     /* Auth is required and we are not authenticated yet. Make a PUT or POST
        with content-length zero as a "probe". */
-    conn->bits.authneg = TRUE;
+    data->req.authneg = TRUE;
   }
   else
-    conn->bits.authneg = FALSE;
+    data->req.authneg = FALSE;
 
+out:
+  curlx_free(tmp_str);
   return result;
 }
 
-#else
+#else /* !CURL_DISABLE_HTTP_AUTH */
 /* when disabled */
-CURLcode
-Curl_http_output_auth(struct Curl_easy *data,
-                      struct connectdata *conn,
-                      const char *request,
-                      Curl_HttpReq httpreq,
-                      const char *path,
-                      bool proxytunnel)
+CURLcode Curl_http_output_auth(struct Curl_easy *data,
+                               struct connectdata *conn,
+                               const char *request,
+                               Curl_HttpReq httpreq,
+                               const char *path,
+                               const char *query,
+                               bool is_connect)
 {
   (void)data;
   (void)conn;
   (void)request;
   (void)httpreq;
   (void)path;
-  (void)proxytunnel;
+  (void)query;
+  (void)is_connect;
+  return CURLE_OK;
+}
+#endif /* !CURL_DISABLE_HTTP_AUTH, else */
+
+#if defined(USE_SPNEGO) || defined(USE_NTLM) || \
+  !defined(CURL_DISABLE_DIGEST_AUTH) || \
+  !defined(CURL_DISABLE_BASIC_AUTH) || \
+  !defined(CURL_DISABLE_BEARER_AUTH)
+static bool authcmp(const char *auth, const char *line)
+{
+  /* the auth string must not have an alnum following */
+  size_t n = strlen(auth);
+  return curl_strnequal(auth, line, n) && !ISALNUM(line[n]);
+}
+#endif
+
+#ifdef USE_SPNEGO
+static CURLcode auth_spnego(struct Curl_easy *data,
+                            bool proxy,
+                            const char *auth,
+                            struct auth *authp,
+                            uint32_t *availp)
+{
+  if((authp->avail & CURLAUTH_NEGOTIATE) || Curl_auth_is_spnego_supported()) {
+    *availp |= CURLAUTH_NEGOTIATE;
+    authp->avail |= CURLAUTH_NEGOTIATE;
+
+    if(authp->picked == CURLAUTH_NEGOTIATE) {
+      struct connectdata *conn = data->conn;
+      CURLcode result = Curl_input_negotiate(data, conn, proxy, auth);
+      curlnegotiate *negstate = proxy ? &conn->proxy_negotiate_state :
+        &conn->http_negotiate_state;
+      if(!result) {
+        curlx_free(data->req.newurl);
+        data->req.newurl = Curl_bufref_dup(&data->state.url);
+        if(!data->req.newurl)
+          return CURLE_OUT_OF_MEMORY;
+        data->state.authproblem = FALSE;
+        /* we received a GSS auth token and we dealt with it fine */
+        *negstate = GSS_AUTHRECV;
+      }
+      else
+        data->state.authproblem = TRUE;
+    }
+  }
+  return CURLE_OK;
+}
+#endif
+
+#ifdef USE_NTLM
+static CURLcode auth_ntlm(struct Curl_easy *data,
+                          bool proxy,
+                          const char *auth,
+                          struct auth *authp,
+                          uint32_t *availp)
+{
+  /* NTLM support requires the SSL crypto libs */
+  if((authp->avail & CURLAUTH_NTLM) || Curl_auth_is_ntlm_supported()) {
+    *availp |= CURLAUTH_NTLM;
+    authp->avail |= CURLAUTH_NTLM;
+
+    if(authp->picked == CURLAUTH_NTLM) {
+      /* NTLM authentication is picked and activated */
+      CURLcode result = Curl_input_ntlm(data, proxy, auth);
+      if(!result)
+        data->state.authproblem = FALSE;
+      else {
+        if(result == CURLE_OUT_OF_MEMORY)
+          return result;
+        infof(data, "NTLM authentication problem, ignoring.");
+        data->state.authproblem = TRUE;
+      }
+    }
+  }
+  return CURLE_OK;
+}
+#endif
+
+#ifndef CURL_DISABLE_DIGEST_AUTH
+static CURLcode auth_digest(struct Curl_easy *data,
+                            bool proxy,
+                            const char *auth,
+                            struct auth *authp,
+                            uint32_t *availp)
+{
+  if(authp->avail & CURLAUTH_DIGEST) {
+    *availp |= CURLAUTH_DIGEST;
+    infof(data, "Ignoring duplicate digest auth header.");
+  }
+  else if(Curl_auth_is_digest_supported()) {
+    CURLcode result;
+
+    *availp |= CURLAUTH_DIGEST;
+    authp->avail |= CURLAUTH_DIGEST;
+
+    /* We call this function on input Digest headers even if Digest
+     * authentication is not activated yet, as we need to store the
+     * incoming data from this header in case we are going to use
+     * Digest */
+    result = Curl_input_digest(data, proxy, auth);
+    if(result) {
+      if(result == CURLE_OUT_OF_MEMORY)
+        return result;
+      infof(data, "Digest authentication problem, ignoring.");
+      data->state.authproblem = TRUE;
+    }
+  }
+  return CURLE_OK;
+}
+#endif
+
+#ifndef CURL_DISABLE_BASIC_AUTH
+static CURLcode auth_basic(struct Curl_easy *data,
+                           struct auth *authp,
+                           uint32_t *availp)
+{
+  *availp |= CURLAUTH_BASIC;
+  authp->avail |= CURLAUTH_BASIC;
+  if(authp->picked == CURLAUTH_BASIC) {
+    /* We asked for Basic authentication but got a 40X back anyway, which
+       means our name+password is not valid. */
+    authp->avail = CURLAUTH_NONE;
+    infof(data, "Basic authentication problem, ignoring.");
+    data->state.authproblem = TRUE;
+  }
+  return CURLE_OK;
+}
+#endif
+
+#ifndef CURL_DISABLE_BEARER_AUTH
+static CURLcode auth_bearer(struct Curl_easy *data,
+                            struct auth *authp,
+                            uint32_t *availp)
+{
+  *availp |= CURLAUTH_BEARER;
+  authp->avail |= CURLAUTH_BEARER;
+  if(authp->picked == CURLAUTH_BEARER) {
+    /* We asked for Bearer authentication but got a 40X back anyway, which
+       means our token is not valid. */
+    authp->avail = CURLAUTH_NONE;
+    infof(data, "Bearer authentication problem, ignoring.");
+    data->state.authproblem = TRUE;
+  }
   return CURLE_OK;
 }
 #endif
@@ -974,28 +1031,26 @@ Curl_http_output_auth(struct Curl_easy *data,
  * Curl_http_input_auth() deals with Proxy-Authenticate: and WWW-Authenticate:
  * headers. They are dealt with both in the transfer.c main loop and in the
  * proxy CONNECT loop.
+ *
+ * The 'auth' line ends with a null byte without CR or LF present.
  */
-
-static int is_valid_auth_separator(char ch)
-{
-  return ch == '\0' || ch == ',' || ISSPACE(ch);
-}
-
 CURLcode Curl_http_input_auth(struct Curl_easy *data, bool proxy,
                               const char *auth) /* the first non-space */
 {
   /*
    * This resource requires authentication
    */
-  struct connectdata *conn = data->conn;
-#ifdef USE_SPNEGO
-  curlnegotiate *negstate = proxy ? &conn->proxy_negotiate_state :
-                                    &conn->http_negotiate_state;
-#endif
-  unsigned long *availp;
-  struct auth *authp;
+#if defined(USE_SPNEGO) ||                      \
+  defined(USE_NTLM) ||                          \
+  !defined(CURL_DISABLE_DIGEST_AUTH) ||         \
+  !defined(CURL_DISABLE_BASIC_AUTH) ||          \
+  !defined(CURL_DISABLE_BEARER_AUTH)
 
-  (void) conn; /* In case conditionals make it unused. */
+  uint32_t *availp;
+  struct auth *authp;
+  CURLcode result = CURLE_OK;
+  DEBUGASSERT(auth);
+  DEBUGASSERT(data);
 
   if(proxy) {
     availp = &data->info.proxyauthavail;
@@ -1024,566 +1079,564 @@ CURLcode Curl_http_input_auth(struct Curl_easy *data, bool proxy,
 
   while(*auth) {
 #ifdef USE_SPNEGO
-    if(checkprefix("Negotiate", auth) && is_valid_auth_separator(auth[9])) {
-      if((authp->avail & CURLAUTH_NEGOTIATE) ||
-         Curl_auth_is_spnego_supported()) {
-        *availp |= CURLAUTH_NEGOTIATE;
-        authp->avail |= CURLAUTH_NEGOTIATE;
-
-        if(authp->picked == CURLAUTH_NEGOTIATE) {
-          CURLcode result = Curl_input_negotiate(data, conn, proxy, auth);
-          if(!result) {
-            free(data->req.newurl);
-            data->req.newurl = strdup(data->state.url);
-            if(!data->req.newurl)
-              return CURLE_OUT_OF_MEMORY;
-            data->state.authproblem = FALSE;
-            /* we received a GSS auth token and we dealt with it fine */
-            *negstate = GSS_AUTHRECV;
-          }
-          else
-            data->state.authproblem = TRUE;
-        }
-      }
-    }
-    else
+    if(authcmp("Negotiate", auth))
+      result = auth_spnego(data, proxy, auth, authp, availp);
 #endif
 #ifdef USE_NTLM
-      /* NTLM support requires the SSL crypto libs */
-      if(checkprefix("NTLM", auth) && is_valid_auth_separator(auth[4])) {
-        if((authp->avail & CURLAUTH_NTLM) ||
-           (authp->avail & CURLAUTH_NTLM_WB) ||
-           Curl_auth_is_ntlm_supported()) {
-          *availp |= CURLAUTH_NTLM;
-          authp->avail |= CURLAUTH_NTLM;
-
-          if(authp->picked == CURLAUTH_NTLM ||
-             authp->picked == CURLAUTH_NTLM_WB) {
-            /* NTLM authentication is picked and activated */
-            CURLcode result = Curl_input_ntlm(data, proxy, auth);
-            if(!result) {
-              data->state.authproblem = FALSE;
-#ifdef NTLM_WB_ENABLED
-              if(authp->picked == CURLAUTH_NTLM_WB) {
-                *availp &= ~CURLAUTH_NTLM;
-                authp->avail &= ~CURLAUTH_NTLM;
-                *availp |= CURLAUTH_NTLM_WB;
-                authp->avail |= CURLAUTH_NTLM_WB;
-
-                result = Curl_input_ntlm_wb(data, conn, proxy, auth);
-                if(result) {
-                  infof(data, "Authentication problem. Ignoring this.");
-                  data->state.authproblem = TRUE;
-                }
-              }
-#endif
-            }
-            else {
-              infof(data, "Authentication problem. Ignoring this.");
-              data->state.authproblem = TRUE;
-            }
-          }
-        }
-      }
-      else
+    if(!result && authcmp("NTLM", auth))
+      result = auth_ntlm(data, proxy, auth, authp, availp);
 #endif
 #ifndef CURL_DISABLE_DIGEST_AUTH
-        if(checkprefix("Digest", auth) && is_valid_auth_separator(auth[6])) {
-          if((authp->avail & CURLAUTH_DIGEST) != 0)
-            infof(data, "Ignoring duplicate digest auth header.");
-          else if(Curl_auth_is_digest_supported()) {
-            CURLcode result;
-
-            *availp |= CURLAUTH_DIGEST;
-            authp->avail |= CURLAUTH_DIGEST;
-
-            /* We call this function on input Digest headers even if Digest
-             * authentication isn't activated yet, as we need to store the
-             * incoming data from this header in case we are going to use
-             * Digest */
-            result = Curl_input_digest(data, proxy, auth);
-            if(result) {
-              infof(data, "Authentication problem. Ignoring this.");
-              data->state.authproblem = TRUE;
-            }
-          }
-        }
-        else
+    if(!result && authcmp("Digest", auth))
+      result = auth_digest(data, proxy, auth, authp, availp);
 #endif
 #ifndef CURL_DISABLE_BASIC_AUTH
-          if(checkprefix("Basic", auth) &&
-             is_valid_auth_separator(auth[5])) {
-            *availp |= CURLAUTH_BASIC;
-            authp->avail |= CURLAUTH_BASIC;
-            if(authp->picked == CURLAUTH_BASIC) {
-              /* We asked for Basic authentication but got a 40X back
-                 anyway, which basically means our name+password isn't
-                 valid. */
-              authp->avail = CURLAUTH_NONE;
-              infof(data, "Authentication problem. Ignoring this.");
-              data->state.authproblem = TRUE;
-            }
-          }
-          else
+    if(!result && authcmp("Basic", auth))
+      result = auth_basic(data, authp, availp);
 #endif
 #ifndef CURL_DISABLE_BEARER_AUTH
-            if(checkprefix("Bearer", auth) &&
-               is_valid_auth_separator(auth[6])) {
-              *availp |= CURLAUTH_BEARER;
-              authp->avail |= CURLAUTH_BEARER;
-              if(authp->picked == CURLAUTH_BEARER) {
-                /* We asked for Bearer authentication but got a 40X back
-                  anyway, which basically means our token isn't valid. */
-                authp->avail = CURLAUTH_NONE;
-                infof(data, "Authentication problem. Ignoring this.");
-                data->state.authproblem = TRUE;
-              }
-            }
+    if(authcmp("Bearer", auth))
+      result = auth_bearer(data, authp, availp);
 #endif
 
+    if(result)
+      break;
+
     /* there may be multiple methods on one line, so keep reading */
-    while(*auth && *auth != ',') /* read up to the next comma */
-      auth++;
-    if(*auth == ',') /* if we're on a comma, skip it */
-      auth++;
-    while(*auth && ISSPACE(*auth))
+    auth = strchr(auth, ',');
+    if(auth) /* if we are on a comma, skip it */
       auth++;
+    else
+      break;
+    curlx_str_passblanks(&auth);
   }
+  return result;
+#else
+  (void)data;
+  (void)proxy;
+  (void)auth;
+  /* nothing to do when disabled */
+  return CURLE_OK;
+#endif
+}
+
+static void http_switch_to_get(struct Curl_easy *data, int code)
+{
+  const char *req = data->set.str[STRING_CUSTOMREQUEST];
+
+  if((req || data->state.httpreq != HTTPREQ_GET) &&
+     (data->set.http_follow_mode == CURLFOLLOW_OBEYCODE)) {
+    NOVERBOSE((void)code);
+    infof(data, "Switch to GET because of %d response", code);
+    data->state.http_ignorecustom = TRUE;
+  }
+  else if(req && (data->set.http_follow_mode != CURLFOLLOW_FIRSTONLY))
+    infof(data, "Stick to %s instead of GET", req);
+
+  data->state.httpreq = HTTPREQ_GET;
+  Curl_creader_set_rewind(data, FALSE);
+}
+
+#define HTTPREQ_IS_POST(data)                    \
+  ((data)->state.httpreq == HTTPREQ_POST ||      \
+   (data)->state.httpreq == HTTPREQ_POST_FORM || \
+   (data)->state.httpreq == HTTPREQ_POST_MIME)
+
+CURLcode Curl_http_follow(struct Curl_easy *data, const char *newurl,
+                          followtype type)
+{
+  bool disallowport = FALSE;
+  bool reachedmax = FALSE;
+  char *follow_url = NULL;
+  CURLUcode uc;
+  CURLcode rewind_result;
+  bool switch_to_get = FALSE;
+
+  DEBUGASSERT(type != FOLLOW_NONE);
+
+  if(type != FOLLOW_FAKE)
+    data->state.requests++; /* count all real follows */
+  if(type == FOLLOW_REDIR) {
+    if((data->set.maxredirs != -1) &&
+       (data->state.followlocation >= data->set.maxredirs)) {
+      reachedmax = TRUE;
+      type = FOLLOW_FAKE; /* switch to fake to store the would-be-redirected
+                             to URL */
+    }
+    else {
+      data->state.followlocation++; /* count redirect-followings, including
+                                       auth reloads */
+
+      if(data->set.http_auto_referer) {
+        CURLU *u;
+        char *referer = NULL;
+
+        /* We are asked to automatically set the previous URL as the referer
+           when we get the next URL. We pick the ->url field, which may or may
+           not be 100% correct */
+        Curl_bufref_free(&data->state.referer);
+
+        /* Make a copy of the URL without credentials and fragment */
+        u = curl_url();
+        if(!u)
+          return CURLE_OUT_OF_MEMORY;
+
+        uc = curl_url_set(u, CURLUPART_URL,
+                          Curl_bufref_ptr(&data->state.url), 0);
+        if(!uc)
+          uc = curl_url_set(u, CURLUPART_FRAGMENT, NULL, 0);
+        if(!uc)
+          uc = curl_url_set(u, CURLUPART_USER, NULL, 0);
+        if(!uc)
+          uc = curl_url_set(u, CURLUPART_PASSWORD, NULL, 0);
+        if(!uc)
+          uc = curl_url_get(u, CURLUPART_URL, &referer, 0);
+
+        curl_url_cleanup(u);
+
+        if(uc || !referer)
+          return CURLE_OUT_OF_MEMORY;
+
+        Curl_bufref_set(&data->state.referer, referer, 0, curl_free);
+      }
+    }
+  }
+
+  if((type != FOLLOW_RETRY) &&
+     (data->req.httpcode != 401) && (data->req.httpcode != 407) &&
+     Curl_is_absolute_url(newurl, NULL, 0, FALSE)) {
+    /* If this is not redirect due to a 401 or 407 response and an absolute
+       URL: do not allow a custom port number */
+    disallowport = TRUE;
+  }
+
+  DEBUGASSERT(data->state.uh);
+  uc = curl_url_set(data->state.uh, CURLUPART_URL, newurl, (unsigned int)
+                    ((type == FOLLOW_FAKE) ? CURLU_NON_SUPPORT_SCHEME :
+                     ((type == FOLLOW_REDIR) ? CURLU_URLENCODE : 0) |
+                     CURLU_ALLOW_SPACE |
+                     (data->set.path_as_is ? CURLU_PATH_AS_IS : 0)));
+  if(uc) {
+    if((uc == CURLUE_OUT_OF_MEMORY) || (type != FOLLOW_FAKE)) {
+      failf(data, "The redirect target URL could not be parsed: %s",
+            curl_url_strerror(uc));
+      return Curl_uc_to_curlcode(uc);
+    }
+
+    /* the URL could not be parsed for some reason, but since this is FAKE
+       mode, duplicate the field as-is */
+    follow_url = curlx_strdup(newurl);
+    if(!follow_url)
+      return CURLE_OUT_OF_MEMORY;
+  }
+  else {
+    CURLU *u = curl_url();
+    if(!u)
+      return CURLE_OUT_OF_MEMORY;
+    uc = curl_url_set(u, CURLUPART_URL,
+                      Curl_bufref_ptr(&data->state.url),
+                      CURLU_URLENCODE | CURLU_ALLOW_SPACE);
+    if(!uc)
+      uc = curl_url_get(data->state.uh, CURLUPART_URL, &follow_url, 0);
+    if(uc) {
+      curl_url_cleanup(u);
+      return Curl_uc_to_curlcode(uc);
+    }
+
+#ifndef CURL_DISABLE_DIGEST_AUTH
+    {
+      bool same_origin = Curl_url_same_origin(u, data->state.uh);
+      curl_url_cleanup(u);
+      if(!same_origin)
+        Curl_auth_digest_cleanup(&data->state.digest);
+    }
+#else
+    curl_url_cleanup(u);
+#endif
+  }
+  DEBUGASSERT(follow_url);
+
+  if(type == FOLLOW_FAKE) {
+    /* we are only figuring out the new URL if we would have followed locations
+       but now we are done so we can get out! */
+    data->info.wouldredirect = follow_url;
+
+    if(reachedmax) {
+      failf(data, "Maximum (%d) redirects followed", data->set.maxredirs);
+      return CURLE_TOO_MANY_REDIRECTS;
+    }
+    return CURLE_OK;
+  }
+
+  if(disallowport)
+    data->state.allow_port = FALSE;
+
+  Curl_bufref_set(&data->state.url, follow_url, 0, curl_free);
+  rewind_result = Curl_req_soft_reset(&data->req, data);
+  infof(data, "Issue another request to this URL: '%s'", follow_url);
+  if((data->set.http_follow_mode == CURLFOLLOW_FIRSTONLY) &&
+     data->set.str[STRING_CUSTOMREQUEST] &&
+     !data->state.http_ignorecustom) {
+    data->state.http_ignorecustom = TRUE;
+    infof(data, "Drop custom request method for next request");
+  }
+
+  /*
+   * We get here when the HTTP code is 300-399 (and 401). We need to perform
+   * differently based on exactly what return code there was.
+   *
+   * News from 7.10.6: we can also get here on a 401 or 407, in case we act on
+   * an HTTP (proxy-) authentication scheme other than Basic.
+   */
+  switch(data->info.httpcode) {
+    /* 401 - Act on a WWW-Authenticate, we keep on moving and do the
+       Authorization: XXXX header in the HTTP request code snippet */
+    /* 407 - Act on a Proxy-Authenticate, we keep on moving and do the
+       Proxy-Authorization: XXXX header in the HTTP request code snippet */
+    /* 300 - Multiple Choices */
+    /* 306 - Not used */
+    /* 307 - Temporary Redirect */
+  default: /* for all above (and the unknown ones) */
+    /* Some codes are explicitly mentioned since I have checked RFC2616 and
+     * they seem to be OK to POST to.
+     */
+    break;
+  case 301: /* Moved Permanently */
+    /* (quote from RFC7231, section 6.4.2)
+     *
+     * Note: For historical reasons, a user agent MAY change the request
+     * method from POST to GET for the subsequent request. If this
+     * behavior is undesired, the 307 (Temporary Redirect) status code
+     * can be used instead.
+     *
+     * ----
+     *
+     * Many webservers expect this, so these servers often answers to a POST
+     * request with an error page. To be sure that libcurl gets the page that
+     * most user agents would get, libcurl has to force GET.
+     *
+     * This behavior is forbidden by RFC1945 and the obsolete RFC2616, and
+     * can be overridden with CURLOPT_POSTREDIR.
+     */
+    if(HTTPREQ_IS_POST(data) && !data->set.post301) {
+      http_switch_to_get(data, 301);
+      switch_to_get = TRUE;
+    }
+    break;
+  case 302: /* Found */
+    /* (quote from RFC7231, section 6.4.3)
+     *
+     * Note: For historical reasons, a user agent MAY change the request
+     * method from POST to GET for the subsequent request. If this
+     * behavior is undesired, the 307 (Temporary Redirect) status code
+     * can be used instead.
+     *
+     * ----
+     *
+     * Many webservers expect this, so these servers often answers to a POST
+     * request with an error page. To be sure that libcurl gets the page that
+     * most user agents would get, libcurl has to force GET.
+     *
+     * This behavior is forbidden by RFC1945 and the obsolete RFC2616, and
+     * can be overridden with CURLOPT_POSTREDIR.
+     */
+    if(HTTPREQ_IS_POST(data) && !data->set.post302) {
+      http_switch_to_get(data, 302);
+      switch_to_get = TRUE;
+    }
+    break;
+
+  case 303: /* See Other */
+    /* 'See Other' location is not the resource but a substitute for the
+     * resource. In this case we switch the method to GET/HEAD, unless the
+     * method is POST and the user specified to keep it as POST.
+     */
+    if(!HTTPREQ_IS_POST(data) || !data->set.post303) {
+      http_switch_to_get(data, 303);
+      switch_to_get = TRUE;
+    }
+    break;
+  case 304: /* Not Modified */
+    /* 304 means we did a conditional request and it was "Not modified".
+     * We should not get any Location: header in this response!
+     */
+    break;
+  case 305: /* Use Proxy */
+    /* (quote from RFC2616, section 10.3.6):
+     * "The requested resource MUST be accessed through the proxy given
+     * by the Location field. The Location field gives the URI of the
+     * proxy. The recipient is expected to repeat this single request
+     * via the proxy. 305 responses MUST only be generated by origin
+     * servers."
+     */
+    break;
+  }
+
+  /* When rewind of upload data failed and we are not switching to GET,
+   * we need to fail the follow, as we cannot send the data again. */
+  if(rewind_result && !switch_to_get)
+    return rewind_result;
+
+  Curl_pgrsTime(data, TIMER_REDIRECT);
+  Curl_pgrsResetTransferSizes(data);
 
   return CURLE_OK;
 }
 
-/**
- * http_should_fail() determines whether an HTTP response has gotten us
- * into an error state or not.
- *
- * @param conn all information about the current connection
- *
- * @retval FALSE communications should continue
- *
- * @retval TRUE communications should not continue
- */
-static bool http_should_fail(struct Curl_easy *data)
-{
-  int httpcode;
-  DEBUGASSERT(data);
-  DEBUGASSERT(data->conn);
-
-  httpcode = data->req.httpcode;
-
-  /*
-  ** If we haven't been asked to fail on error,
-  ** don't fail.
-  */
-  if(!data->set.http_fail_on_error)
-    return FALSE;
-
-  /*
-  ** Any code < 400 is never terminal.
-  */
-  if(httpcode < 400)
-    return FALSE;
-
-  /*
-  ** A 416 response to a resume request is presumably because the file is
-  ** already completely downloaded and thus not actually a fail.
-  */
-  if(data->state.resume_from && data->state.httpreq == HTTPREQ_GET &&
-     httpcode == 416)
-    return FALSE;
-
-  /*
-  ** Any code >= 400 that's not 401 or 407 is always
-  ** a terminal error
-  */
-  if((httpcode != 401) && (httpcode != 407))
-    return TRUE;
-
-  /*
-  ** All we have left to deal with is 401 and 407
-  */
-  DEBUGASSERT((httpcode == 401) || (httpcode == 407));
-
-  /*
-  ** Examine the current authentication state to see if this
-  ** is an error.  The idea is for this function to get
-  ** called after processing all the headers in a response
-  ** message.  So, if we've been to asked to authenticate a
-  ** particular stage, and we've done it, we're OK.  But, if
-  ** we're already completely authenticated, it's not OK to
-  ** get another 401 or 407.
-  **
-  ** It is possible for authentication to go stale such that
-  ** the client needs to reauthenticate.  Once that info is
-  ** available, use it here.
-  */
-
-  /*
-  ** Either we're not authenticating, or we're supposed to
-  ** be authenticating something else.  This is an error.
-  */
-  if((httpcode == 401) && !data->state.aptr.user)
-    return TRUE;
-#ifndef CURL_DISABLE_PROXY
-  if((httpcode == 407) && !data->conn->bits.proxy_user_passwd)
-    return TRUE;
-#endif
-
-  return data->state.authproblem;
-}
-
-/*
- * readmoredata() is a "fread() emulation" to provide POST and/or request
- * data. It is used when a huge POST is to be made and the entire chunk wasn't
- * sent in the first send(). This function will then be called from the
- * transfer.c loop when more data is to be sent to the peer.
- *
- * Returns the amount of bytes it filled the buffer with.
- */
-static size_t readmoredata(char *buffer,
-                           size_t size,
-                           size_t nitems,
-                           void *userp)
-{
-  struct HTTP *http = (struct HTTP *)userp;
-  struct Curl_easy *data = http->backup.data;
-  size_t fullsize = size * nitems;
-
-  if(!http->postsize)
-    /* nothing to return */
-    return 0;
-
-  /* make sure that an HTTP request is never sent away chunked! */
-  data->req.forbidchunk = (http->sending == HTTPSEND_REQUEST)?TRUE:FALSE;
-
-  if(data->set.max_send_speed &&
-     (data->set.max_send_speed < (curl_off_t)fullsize) &&
-     (data->set.max_send_speed < http->postsize))
-    /* speed limit */
-    fullsize = (size_t)data->set.max_send_speed;
-
-  else if(http->postsize <= (curl_off_t)fullsize) {
-    memcpy(buffer, http->postdata, (size_t)http->postsize);
-    fullsize = (size_t)http->postsize;
-
-    if(http->backup.postsize) {
-      /* move backup data into focus and continue on that */
-      http->postdata = http->backup.postdata;
-      http->postsize = http->backup.postsize;
-      data->state.fread_func = http->backup.fread_func;
-      data->state.in = http->backup.fread_in;
-
-      http->sending++; /* move one step up */
-
-      http->backup.postsize = 0;
-    }
-    else
-      http->postsize = 0;
-
-    return fullsize;
-  }
-
-  memcpy(buffer, http->postdata, fullsize);
-  http->postdata += fullsize;
-  http->postsize -= fullsize;
-
-  return fullsize;
-}
-
-/*
- * Curl_buffer_send() sends a header buffer and frees all associated
- * memory.  Body data may be appended to the header data if desired.
- *
- * Returns CURLcode
- */
-CURLcode Curl_buffer_send(struct dynbuf *in,
-                          struct Curl_easy *data,
-                          struct HTTP *http,
-                          /* add the number of sent bytes to this
-                             counter */
-                          curl_off_t *bytes_written,
-                          /* how much of the buffer contains body data */
-                          curl_off_t included_body_bytes,
-                          int sockindex)
-{
-  ssize_t amount;
-  CURLcode result;
-  char *ptr;
-  size_t size;
-  struct connectdata *conn = data->conn;
-  size_t sendsize;
-  size_t headersize;
-
-  DEBUGASSERT(sockindex <= SECONDARYSOCKET && sockindex >= 0);
-
-  /* The looping below is required since we use non-blocking sockets, but due
-     to the circumstances we will just loop and try again and again etc */
-
-  ptr = Curl_dyn_ptr(in);
-  size = Curl_dyn_len(in);
-
-  headersize = size - (size_t)included_body_bytes; /* the initial part that
-                                                      isn't body is header */
-
-  DEBUGASSERT(size > (size_t)included_body_bytes);
-
-  if((conn->handler->flags & PROTOPT_SSL
-#ifndef CURL_DISABLE_PROXY
-      || IS_HTTPS_PROXY(conn->http_proxy.proxytype)
-#endif
-       )
-     && conn->httpversion < 20) {
-    /* Make sure this doesn't send more body bytes than what the max send
-       speed says. The request bytes do not count to the max speed.
-    */
-    if(data->set.max_send_speed &&
-       (included_body_bytes > data->set.max_send_speed)) {
-      curl_off_t overflow = included_body_bytes - data->set.max_send_speed;
-      DEBUGASSERT((size_t)overflow < size);
-      sendsize = size - (size_t)overflow;
-    }
-    else
-      sendsize = size;
-
-    /* OpenSSL is very picky and we must send the SAME buffer pointer to the
-       library when we attempt to re-send this buffer. Sending the same data
-       is not enough, we must use the exact same address. For this reason, we
-       must copy the data to the uploadbuffer first, since that is the buffer
-       we will be using if this send is retried later.
-    */
-    result = Curl_get_upload_buffer(data);
-    if(result) {
-      /* malloc failed, free memory and return to the caller */
-      Curl_dyn_free(in);
-      return result;
-    }
-    /* We never send more than upload_buffer_size bytes in one single chunk
-       when we speak HTTPS, as if only a fraction of it is sent now, this data
-       needs to fit into the normal read-callback buffer later on and that
-       buffer is using this size.
-    */
-    if(sendsize > (size_t)data->set.upload_buffer_size)
-      sendsize = (size_t)data->set.upload_buffer_size;
-
-    memcpy(data->state.ulbuf, ptr, sendsize);
-    ptr = data->state.ulbuf;
-  }
-  else {
-#ifdef CURLDEBUG
-    /* Allow debug builds to override this logic to force short initial
-       sends
-     */
-    char *p = getenv("CURL_SMALLREQSEND");
-    if(p) {
-      size_t altsize = (size_t)strtoul(p, NULL, 10);
-      if(altsize)
-        sendsize = CURLMIN(size, altsize);
-      else
-        sendsize = size;
-    }
-    else
-#endif
-    {
-      /* Make sure this doesn't send more body bytes than what the max send
-         speed says. The request bytes do not count to the max speed.
-      */
-      if(data->set.max_send_speed &&
-         (included_body_bytes > data->set.max_send_speed)) {
-        curl_off_t overflow = included_body_bytes - data->set.max_send_speed;
-        DEBUGASSERT((size_t)overflow < size);
-        sendsize = size - (size_t)overflow;
-      }
-      else
-        sendsize = size;
-    }
-
-    /* We currently cannot send more that this for http here:
-     * - if sending blocks, it return 0 as amount
-     * - we then whisk aside the `in` into the `http` struct
-     *   and install our own `data->state.fread_func` that
-     *   on subsequent calls reads `in` empty.
-     * - when the whisked away `in` is empty, the `fread_func`
-     *   is restored ot its original state.
-     * The problem is that `fread_func` can only return
-     * `upload_buffer_size` lengths. If the send we do here
-     * is larger and blocks, we do re-sending with smaller
-     * amounts of data and connection filters do not like
-     * that.
-     */
-    if(http && (sendsize > (size_t)data->set.upload_buffer_size))
-      sendsize = (size_t)data->set.upload_buffer_size;
-  }
-
-  result = Curl_nwrite(data, sockindex, ptr, sendsize, &amount);
-
-  if(!result) {
-    /*
-     * Note that we may not send the entire chunk at once, and we have a set
-     * number of data bytes at the end of the big buffer (out of which we may
-     * only send away a part).
-     */
-    /* how much of the header that was sent */
-    size_t headlen = (size_t)amount>headersize ? headersize : (size_t)amount;
-    size_t bodylen = amount - headlen;
-
-    /* this data _may_ contain binary stuff */
-    Curl_debug(data, CURLINFO_HEADER_OUT, ptr, headlen);
-    if(bodylen)
-      /* there was body data sent beyond the initial header part, pass that on
-         to the debug callback too */
-      Curl_debug(data, CURLINFO_DATA_OUT, ptr + headlen, bodylen);
-
-    /* 'amount' can never be a very large value here so typecasting it so a
-       signed 31 bit value should not cause problems even if ssize_t is
-       64bit */
-    *bytes_written += (long)amount;
-
-    if(http) {
-      /* if we sent a piece of the body here, up the byte counter for it
-         accordingly */
-      data->req.writebytecount += bodylen;
-      Curl_pgrsSetUploadCounter(data, data->req.writebytecount);
-
-      if((size_t)amount != size) {
-        /* The whole request could not be sent in one system call. We must
-           queue it up and send it later when we get the chance. We must not
-           loop here and wait until it might work again. */
-
-        size -= amount;
-
-        ptr = Curl_dyn_ptr(in) + amount;
-
-        /* backup the currently set pointers */
-        http->backup.fread_func = data->state.fread_func;
-        http->backup.fread_in = data->state.in;
-        http->backup.postdata = http->postdata;
-        http->backup.postsize = http->postsize;
-        http->backup.data = data;
-
-        /* set the new pointers for the request-sending */
-        data->state.fread_func = (curl_read_callback)readmoredata;
-        data->state.in = (void *)http;
-        http->postdata = ptr;
-        http->postsize = (curl_off_t)size;
-
-        /* this much data is remaining header: */
-        data->req.pendingheader = headersize - headlen;
-
-        http->send_buffer = *in; /* copy the whole struct */
-        http->sending = HTTPSEND_REQUEST;
-        return CURLE_OK;
-      }
-      http->sending = HTTPSEND_BODY;
-      /* the full buffer was sent, clean up and return */
-    }
-    else {
-      if((size_t)amount != size)
-        /* We have no continue-send mechanism now, fail. This can only happen
-           when this function is used from the CONNECT sending function. We
-           currently (stupidly) assume that the whole request is always sent
-           away in the first single chunk.
-
-           This needs FIXing.
-        */
-        return CURLE_SEND_ERROR;
-    }
-  }
-  Curl_dyn_free(in);
-
-  /* no remaining header data */
-  data->req.pendingheader = 0;
-  return result;
-}
-
-/* end of the add_buffer functions */
-/* ------------------------------------------------------------------------- */
-
-
-
 /*
  * Curl_compareheader()
  *
- * Returns TRUE if 'headerline' contains the 'header' with given 'content'.
- * Pass headers WITH the colon.
+ * Returns TRUE if 'headerline' contains the 'header' with given 'content'
+ * (within a comma-separated list of tokens). Pass 'header' WITH the colon.
+ *
+ * @unittest: 1625
  */
-bool
-Curl_compareheader(const char *headerline, /* line to check */
-                   const char *header,  /* header keyword _with_ colon */
-                   const size_t hlen,   /* len of the keyword in bytes */
-                   const char *content, /* content string to find */
-                   const size_t clen)   /* len of the content in bytes */
+bool Curl_compareheader(const char *headerline, /* line to check */
+                        const char *header, /* header keyword _with_ colon */
+                        const size_t hlen, /* len of the keyword in bytes */
+                        const char *content, /* content string to find */
+                        const size_t clen) /* len of the content in bytes */
 {
   /* RFC2616, section 4.2 says: "Each header field consists of a name followed
    * by a colon (":") and the field value. Field names are case-insensitive.
    * The field value MAY be preceded by any amount of LWS, though a single SP
    * is preferred." */
 
-  size_t len;
-  const char *start;
-  const char *end;
+  const char *p;
+  struct Curl_str val;
   DEBUGASSERT(hlen);
   DEBUGASSERT(clen);
   DEBUGASSERT(header);
   DEBUGASSERT(content);
 
-  if(!strncasecompare(headerline, header, hlen))
-    return FALSE; /* doesn't start with header */
+  if(!curl_strnequal(headerline, header, hlen))
+    return FALSE; /* does not start with header */
 
   /* pass the header */
-  start = &headerline[hlen];
+  p = &headerline[hlen];
 
-  /* pass all whitespace */
-  while(*start && ISSPACE(*start))
-    start++;
-
-  /* find the end of the header line */
-  end = strchr(start, '\r'); /* lines end with CRLF */
-  if(!end) {
-    /* in case there's a non-standard compliant line here */
-    end = strchr(start, '\n');
-
-    if(!end)
-      /* hm, there's no line ending here, use the zero byte! */
-      end = strchr(start, '\0');
-  }
-
-  len = end-start; /* length of the content part of the input line */
+  if(curlx_str_untilnl(&p, &val, MAX_HTTP_RESP_HEADER_SIZE))
+    return FALSE;
+  curlx_str_trimblanks(&val);
 
   /* find the content string in the rest of the line */
-  for(; len >= clen; len--, start++) {
-    if(strncasecompare(start, content, clen))
-      return TRUE; /* match! */
-  }
+  if(curlx_strlen(&val) >= clen) {
+    size_t len;
+    p = curlx_str(&val);
+    for(len = curlx_strlen(&val); len >= clen;) {
+      struct Curl_str next;
+      const char *o = p;
+      /* after a match there must be a comma, space, newline or null byte */
+      if(curl_strnequal(p, content, clen) &&
+         ((p[clen] == ',') || ISBLANK(p[clen]) || ISNEWLINE(p[clen]) ||
+          !p[clen]))
+        return TRUE; /* match! */
+      /* advance to the next comma */
+      if(curlx_str_until(&p, &next, MAX_HTTP_RESP_HEADER_SIZE, ',') ||
+         curlx_str_single(&p, ','))
+        break; /* no comma, get out */
 
+      /* if there are more dummy commas, move over them as well */
+      do
+        curlx_str_passblanks(&p);
+      while(!curlx_str_single(&p, ','));
+      len -= (p - o);
+    }
+  }
   return FALSE; /* no match */
 }
 
-/*
- * Curl_http_connect() performs HTTP stuff to do at connect-time, called from
- * the generic Curl_connect().
- */
-CURLcode Curl_http_connect(struct Curl_easy *data, bool *done)
+struct cr_exp100_ctx {
+  struct Curl_creader super;
+  struct curltime start; /* time started waiting */
+  enum expect100 state;
+};
+
+/* Expect: 100-continue client reader, blocking uploads */
+
+static void http_exp100_continue(struct Curl_easy *data,
+                                 struct Curl_creader *reader)
 {
-  struct connectdata *conn = data->conn;
+  struct cr_exp100_ctx *ctx = reader->ctx;
+  if(ctx->state > EXP100_SEND_DATA) {
+    ctx->state = EXP100_SEND_DATA;
+    Curl_expire_done(data, EXPIRE_100_TIMEOUT);
+  }
+}
 
-  /* We default to persistent connections. We set this already in this connect
-     function to make the reuse checks properly be able to check this bit. */
-  connkeep(conn, "HTTP default");
+static CURLcode cr_exp100_read(struct Curl_easy *data,
+                               struct Curl_creader *reader,
+                               char *buf, size_t blen,
+                               size_t *nread, bool *eos)
+{
+  struct cr_exp100_ctx *ctx = reader->ctx;
+  timediff_t ms;
 
-  return Curl_conn_connect(data, FIRSTSOCKET, FALSE, done);
+  switch(ctx->state) {
+  case EXP100_SENDING_REQUEST:
+    if(!Curl_req_sendbuf_empty(data)) {
+      /* The initial request data has not been fully sent yet. Do
+       * not start the timer yet. */
+      DEBUGF(infof(data, "cr_exp100_read, request not full sent yet"));
+      *nread = 0;
+      *eos = FALSE;
+      return CURLE_OK;
+    }
+    /* We are now waiting for a reply from the server or
+     * a timeout on our side IFF the request has been fully sent. */
+    DEBUGF(infof(data, "cr_exp100_read, start AWAITING_CONTINUE, "
+                 "timeout %dms", data->set.expect_100_timeout));
+    ctx->state = EXP100_AWAITING_CONTINUE;
+    ctx->start = *Curl_pgrs_now(data);
+    Curl_expire(data, data->set.expect_100_timeout, EXPIRE_100_TIMEOUT);
+    *nread = 0;
+    *eos = FALSE;
+    return CURLE_OK;
+  case EXP100_FAILED:
+    DEBUGF(infof(data, "cr_exp100_read, expectation failed, error"));
+    *nread = 0;
+    *eos = FALSE;
+    return CURLE_READ_ERROR;
+  case EXP100_AWAITING_CONTINUE:
+    ms = curlx_ptimediff_ms(Curl_pgrs_now(data), &ctx->start);
+    if(ms < data->set.expect_100_timeout) {
+      DEBUGF(infof(data, "cr_exp100_read, AWAITING_CONTINUE, not expired"));
+      *nread = 0;
+      *eos = FALSE;
+      return CURLE_OK;
+    }
+    /* we have waited long enough, continue anyway */
+    http_exp100_continue(data, reader);
+    infof(data, "Done waiting for 100-continue");
+    FALLTHROUGH();
+  default:
+    DEBUGF(infof(data, "cr_exp100_read, pass through"));
+    return Curl_creader_read(data, reader->next, buf, blen, nread, eos);
+  }
+}
+
+static void cr_exp100_done(struct Curl_easy *data,
+                           struct Curl_creader *reader, int premature)
+{
+  struct cr_exp100_ctx *ctx = reader->ctx;
+  ctx->state = premature ? EXP100_FAILED : EXP100_SEND_DATA;
+  Curl_expire_done(data, EXPIRE_100_TIMEOUT);
+}
+
+static const struct Curl_crtype cr_exp100 = {
+  "cr-exp100",
+  Curl_creader_def_init,
+  cr_exp100_read,
+  Curl_creader_def_close,
+  Curl_creader_def_needs_rewind,
+  Curl_creader_def_total_length,
+  Curl_creader_def_resume_from,
+  Curl_creader_def_cntrl,
+  Curl_creader_def_is_paused,
+  cr_exp100_done,
+  sizeof(struct cr_exp100_ctx)
+};
+
+static CURLcode http_exp100_add_reader(struct Curl_easy *data)
+{
+  struct Curl_creader *reader = NULL;
+  CURLcode result;
+
+  result = Curl_creader_create(&reader, data, &cr_exp100, CURL_CR_PROTOCOL);
+  if(!result)
+    result = Curl_creader_add(data, reader);
+  if(!result) {
+    struct cr_exp100_ctx *ctx = reader->ctx;
+    ctx->state = EXP100_SENDING_REQUEST;
+  }
+
+  if(result && reader)
+    Curl_creader_free(data, reader);
+  return result;
+}
+
+static void http_exp100_got100(struct Curl_easy *data)
+{
+  struct Curl_creader *r = Curl_creader_get_by_type(data, &cr_exp100);
+  if(r)
+    http_exp100_continue(data, r);
+}
+
+static bool http_exp100_is_waiting(struct Curl_easy *data)
+{
+  struct Curl_creader *r = Curl_creader_get_by_type(data, &cr_exp100);
+  if(r) {
+    struct cr_exp100_ctx *ctx = r->ctx;
+    return ctx->state == EXP100_AWAITING_CONTINUE;
+  }
+  return FALSE;
+}
+
+static void http_exp100_send_anyway(struct Curl_easy *data)
+{
+  struct Curl_creader *r = Curl_creader_get_by_type(data, &cr_exp100);
+  if(r)
+    http_exp100_continue(data, r);
+}
+
+static bool http_exp100_is_selected(struct Curl_easy *data)
+{
+  struct Curl_creader *r = Curl_creader_get_by_type(data, &cr_exp100);
+  return !!r;
 }
 
 /* this returns the socket to wait for in the DO and DOING state for the multi
-   interface and then we're always _sending_ a request and thus we wait for
+   interface and then we are always _sending_ a request and thus we wait for
    the single socket to become writable only */
-static int http_getsock_do(struct Curl_easy *data,
-                           struct connectdata *conn,
-                           curl_socket_t *socks)
+CURLcode Curl_http_doing_pollset(struct Curl_easy *data,
+                                 struct easy_pollset *ps)
 {
   /* write mode */
-  (void)conn;
-  socks[0] = Curl_conn_get_socket(data, FIRSTSOCKET);
-  return GETSOCK_WRITESOCK(0);
+  return Curl_pollset_add_out(data, ps, data->conn->sock[FIRSTSOCKET]);
+}
+
+CURLcode Curl_http_perform_pollset(struct Curl_easy *data,
+                                   struct easy_pollset *ps)
+{
+  struct connectdata *conn = data->conn;
+  CURLcode result = CURLE_OK;
+
+  if(CURL_REQ_WANT_RECV(data)) {
+    result = Curl_pollset_add_in(data, ps, conn->sock[FIRSTSOCKET]);
+  }
+
+  /* on a "Expect: 100-continue" timed wait, do not poll for outgoing */
+  if(!result && Curl_req_want_send(data) && !http_exp100_is_waiting(data)) {
+    result = Curl_pollset_add_out(data, ps, conn->sock[FIRSTSOCKET]);
+  }
+  return result;
+}
+
+static CURLcode http_write_header(struct Curl_easy *data,
+                                  const char *hd, size_t hdlen)
+{
+  CURLcode result;
+  int writetype;
+
+  /* now, only output this if the header AND body are requested:
+   */
+  Curl_debug(data, CURLINFO_HEADER_IN, hd, hdlen);
+
+  writetype = CLIENTWRITE_HEADER |
+    ((data->req.httpcode / 100 == 1) ? CLIENTWRITE_1XX : 0);
+
+  result = Curl_client_write(data, writetype, hd, hdlen);
+  if(result)
+    return result;
+
+  result = Curl_bump_headersize(data, hdlen, FALSE);
+  if(result)
+    return result;
+
+  data->req.deductheadercount = (100 <= data->req.httpcode &&
+                                 199 >= data->req.httpcode) ?
+    data->req.headerbytecount : 0;
+  return result;
 }
 
 /*
@@ -1595,26 +1648,17 @@ CURLcode Curl_http_done(struct Curl_easy *data,
                         CURLcode status, bool premature)
 {
   struct connectdata *conn = data->conn;
-  struct HTTP *http = data->req.p.http;
 
-  /* Clear multipass flag. If authentication isn't done yet, then it will get
+  /* Clear multipass flag. If authentication is not done yet, then it will get
    * a chance to be set back to true when we output the next auth header */
   data->state.authhost.multipass = FALSE;
   data->state.authproxy.multipass = FALSE;
 
-  Curl_unencode_cleanup(data);
-
-  /* set the proper values (possibly modified on POST) */
-  conn->seek_func = data->set.seek_func; /* restore */
-  conn->seek_client = data->set.seek_client; /* restore */
-
-  if(!http)
-    return CURLE_OK;
-
-  Curl_dyn_free(&http->send_buffer);
-  Curl_dyn_reset(&data->state.headerb);
-  Curl_hyper_done(data);
-  Curl_ws_done(data);
+  if(curlx_dyn_len(&data->state.headerb)) {
+    (void)http_write_header(data, curlx_dyn_ptr(&data->state.headerb),
+                            curlx_dyn_len(&data->state.headerb));
+  }
+  curlx_dyn_reset(&data->state.headerb);
 
   if(status)
     return status;
@@ -1626,8 +1670,8 @@ CURLcode Curl_http_done(struct Curl_easy *data,
      (data->req.bytecount +
       data->req.headerbytecount -
       data->req.deductheadercount) <= 0) {
-    /* If this connection isn't simply closed to be retried, AND nothing was
-       read from the HTTP server (that counts), this can't be right so we
+    /* If this connection is not closed to be retried, AND nothing was
+       read from the HTTP server (that counts), this cannot be right so we
        return an error here */
     failf(data, "Empty reply from server");
     /* Mark it as closed to avoid the "left intact" message */
@@ -1638,149 +1682,66 @@ CURLcode Curl_http_done(struct Curl_easy *data,
   return CURLE_OK;
 }
 
-/*
- * Determine if we should use HTTP 1.1 (OR BETTER) for this request. Reasons
- * to avoid it include:
- *
- * - if the user specifically requested HTTP 1.0
- * - if the server we are connected to only supports 1.0
- * - if any server previously contacted to handle this request only supports
- * 1.0.
- */
-bool Curl_use_http_1_1plus(const struct Curl_easy *data,
-                           const struct connectdata *conn)
+/* Determine if we may use HTTP 1.1 for this request. */
+static bool http_may_use_1_1(const struct Curl_easy *data)
 {
-  if((data->state.httpversion == 10) || (conn->httpversion == 10))
+  const struct connectdata *conn = data->conn;
+  /* We have seen a previous response for *this* transfer with 1.0,
+   * on another connection or the same one. */
+  if(data->state.http_neg.rcvd_min == 10)
     return FALSE;
-  if((data->state.httpwant == CURL_HTTP_VERSION_1_0) &&
-     (conn->httpversion <= 10))
+  /* We have seen a previous response on *this* connection with 1.0. */
+  if(conn && conn->httpversion_seen == 10)
     return FALSE;
-  return ((data->state.httpwant == CURL_HTTP_VERSION_NONE) ||
-          (data->state.httpwant >= CURL_HTTP_VERSION_1_1));
+  /* We want 1.0 and have seen no previous response on *this* connection
+     with a higher version (maybe no response at all yet). */
+  if((data->state.http_neg.only_10) &&
+     (!conn || conn->httpversion_seen <= 10))
+    return FALSE;
+  /* We are not restricted to use 1.0 only. */
+  return !data->state.http_neg.only_10;
 }
 
-#ifndef USE_HYPER
-static const char *get_http_string(const struct Curl_easy *data,
-                                   const struct connectdata *conn)
+static unsigned char http_request_version(struct Curl_easy *data)
 {
-  if(Curl_conn_is_http3(data, conn, FIRSTSOCKET))
+  unsigned char v = Curl_conn_http_version(data, data->conn);
+  if(!v) {
+    /* No specific HTTP connection filter installed. */
+    v = http_may_use_1_1(data) ? 11 : 10;
+  }
+  return v;
+}
+
+static const char *get_http_string(int httpversion)
+{
+  switch(httpversion) {
+  case 30:
     return "3";
-  if(Curl_conn_is_http2(data, conn, FIRSTSOCKET))
+  case 20:
     return "2";
-  if(Curl_use_http_1_1plus(data, conn))
+  case 11:
     return "1.1";
-
-  return "1.0";
-}
-#endif
-
-/* check and possibly add an Expect: header */
-static CURLcode expect100(struct Curl_easy *data,
-                          struct connectdata *conn,
-                          struct dynbuf *req)
-{
-  CURLcode result = CURLE_OK;
-  data->state.expect100header = FALSE; /* default to false unless it is set
-                                          to TRUE below */
-  if(!data->state.disableexpect && Curl_use_http_1_1plus(data, conn) &&
-     (conn->httpversion < 20)) {
-    /* if not doing HTTP 1.0 or version 2, or disabled explicitly, we add an
-       Expect: 100-continue to the headers which actually speeds up post
-       operations (as there is one packet coming back from the web server) */
-    const char *ptr = Curl_checkheaders(data, STRCONST("Expect"));
-    if(ptr) {
-      data->state.expect100header =
-        Curl_compareheader(ptr, STRCONST("Expect:"), STRCONST("100-continue"));
-    }
-    else {
-      result = Curl_dyn_addn(req, STRCONST("Expect: 100-continue\r\n"));
-      if(!result)
-        data->state.expect100header = TRUE;
-    }
+  default:
+    return "1.0";
   }
-
-  return result;
 }
 
-enum proxy_use {
-  HEADER_SERVER,  /* direct to server */
-  HEADER_PROXY,   /* regular request to proxy */
-  HEADER_CONNECT  /* sending CONNECT to a proxy */
-};
-
-/* used to compile the provided trailers into one buffer
-   will return an error code if one of the headers is
-   not formatted correctly */
-CURLcode Curl_http_compile_trailers(struct curl_slist *trailers,
-                                    struct dynbuf *b,
-                                    struct Curl_easy *handle)
+CURLcode Curl_add_custom_headers(struct Curl_easy *data,
+                                 bool is_connect, int httpversion,
+                                 struct dynbuf *req)
 {
-  char *ptr = NULL;
-  CURLcode result = CURLE_OK;
-  const char *endofline_native = NULL;
-  const char *endofline_network = NULL;
-
-  if(
-#ifdef CURL_DO_LINEEND_CONV
-     (handle->state.prefer_ascii) ||
-#endif
-     (handle->set.crlf)) {
-    /* \n will become \r\n later on */
-    endofline_native  = "\n";
-    endofline_network = "\x0a";
-  }
-  else {
-    endofline_native  = "\r\n";
-    endofline_network = "\x0d\x0a";
-  }
-
-  while(trailers) {
-    /* only add correctly formatted trailers */
-    ptr = strchr(trailers->data, ':');
-    if(ptr && *(ptr + 1) == ' ') {
-      result = Curl_dyn_add(b, trailers->data);
-      if(result)
-        return result;
-      result = Curl_dyn_add(b, endofline_native);
-      if(result)
-        return result;
-    }
-    else
-      infof(handle, "Malformatted trailing header, skipping trailer");
-    trailers = trailers->next;
-  }
-  result = Curl_dyn_add(b, endofline_network);
-  return result;
-}
-
-static bool hd_name_eq(const char *n1, size_t n1len,
-                       const char *n2, size_t n2len)
-{
-  if(n1len == n2len) {
-    return strncasecompare(n1, n2, n1len);
-  }
-  return FALSE;
-}
-
-CURLcode Curl_dynhds_add_custom(struct Curl_easy *data,
-                                bool is_connect,
-                                struct dynhds *hds)
-{
-  struct connectdata *conn = data->conn;
-  char *ptr;
   struct curl_slist *h[2];
   struct curl_slist *headers;
   int numlists = 1; /* by default */
   int i;
 
 #ifndef CURL_DISABLE_PROXY
-  enum proxy_use proxy;
+  enum Curl_proxy_use proxy;
 
   if(is_connect)
     proxy = HEADER_CONNECT;
   else
-    proxy = conn->bits.httpproxy && !conn->bits.tunnel_proxy?
-      HEADER_PROXY:HEADER_SERVER;
+    proxy = data->conn->bits.origin_is_proxy ? HEADER_PROXY : HEADER_SERVER;
 
   switch(proxy) {
   case HEADER_SERVER:
@@ -1799,6 +1760,12 @@ CURLcode Curl_dynhds_add_custom(struct Curl_easy *data,
     else
       h[0] = data->set.headers;
     break;
+  case HEADER_CONNECT_UDP:
+    if(data->set.sep_headers)
+      h[0] = data->set.proxyheaders;
+    else
+      h[0] = data->set.headers;
+    break;
   }
 #else
   (void)is_connect;
@@ -1808,249 +1775,78 @@ CURLcode Curl_dynhds_add_custom(struct Curl_easy *data,
   /* loop through one or two lists */
   for(i = 0; i < numlists; i++) {
     for(headers = h[i]; headers; headers = headers->next) {
-      const char *name, *value;
-      size_t namelen, valuelen;
+      CURLcode result = CURLE_OK;
+      bool blankheader = FALSE;
+      struct Curl_str name;
+      const char *p = headers->data;
+      const char *origp = p;
 
-      /* There are 2 quirks in place for custom headers:
-       * 1. setting only 'name:' to suppress a header from being sent
-       * 2. setting only 'name;' to send an empty (illegal) header
-       */
-      ptr = strchr(headers->data, ':');
-      if(ptr) {
-        name = headers->data;
-        namelen = ptr - headers->data;
-        ptr++; /* pass the colon */
-        while(*ptr && ISSPACE(*ptr))
-          ptr++;
-        if(*ptr) {
-          value = ptr;
-          valuelen = strlen(value);
-        }
-        else {
-          /* quirk #1, suppress this header */
-          continue;
-        }
-      }
+      /* explicitly asked to send header without content is done by a header
+         that ends with a semicolon, but there must be no colon present in the
+         name */
+      if(!curlx_str_until(&p, &name, MAX_HTTP_RESP_HEADER_SIZE, ';') &&
+         !curlx_str_single(&p, ';') &&
+         !curlx_str_single(&p, '\0') &&
+         !memchr(curlx_str(&name), ':', curlx_strlen(&name)))
+        blankheader = TRUE;
       else {
-        ptr = strchr(headers->data, ';');
-
-        if(!ptr) {
-          /* neither : nor ; in provided header value. We seem
-           * to ignore this silently */
+        p = origp;
+        if(!curlx_str_until(&p, &name, MAX_HTTP_RESP_HEADER_SIZE, ':') &&
+           !curlx_str_single(&p, ':')) {
+          struct Curl_str val;
+          curlx_str_untilnl(&p, &val, MAX_HTTP_RESP_HEADER_SIZE);
+          curlx_str_trimblanks(&val);
+          if(!curlx_strlen(&val))
+            /* no content, do not send this */
+            continue;
+        }
+        else
+          /* no colon */
           continue;
-        }
-
-        name = headers->data;
-        namelen = ptr - headers->data;
-        ptr++; /* pass the semicolon */
-        while(*ptr && ISSPACE(*ptr))
-          ptr++;
-        if(!*ptr) {
-          /* quirk #2, send an empty header */
-          value = "";
-          valuelen = 0;
-        }
-        else {
-          /* this may be used for something else in the future,
-           * ignore this for now */
-          continue;
-        }
       }
 
-      DEBUGASSERT(name && value);
+      /* only send this if the contents was non-blank or done special */
+
       if(data->state.aptr.host &&
-         /* a Host: header was sent already, don't pass on any custom Host:
-            header as that will produce *two* in the same request! */
-         hd_name_eq(name, namelen, STRCONST("Host:")))
+         /* a Host: header was sent already, do not pass on any custom
+            Host: header as that will produce *two* in the same
+            request! */
+         curlx_str_casecompare(&name, "Host"))
         ;
       else if(data->state.httpreq == HTTPREQ_POST_FORM &&
               /* this header (extended by formdata.c) is sent later */
-              hd_name_eq(name, namelen, STRCONST("Content-Type:")))
+              curlx_str_casecompare(&name, "Content-Type"))
         ;
       else if(data->state.httpreq == HTTPREQ_POST_MIME &&
               /* this header is sent later */
-              hd_name_eq(name, namelen, STRCONST("Content-Type:")))
+              curlx_str_casecompare(&name, "Content-Type"))
         ;
-      else if(conn->bits.authneg &&
-              /* while doing auth neg, don't allow the custom length since
+      else if(data->req.authneg &&
+              /* while doing auth neg, do not allow the custom length since
                  we will force length zero then */
-              hd_name_eq(name, namelen, STRCONST("Content-Length:")))
+              curlx_str_casecompare(&name, "Content-Length"))
         ;
-      else if(data->state.aptr.te &&
-              /* when asking for Transfer-Encoding, don't pass on a custom
-                 Connection: */
-              hd_name_eq(name, namelen, STRCONST("Connection:")))
+      else if(curlx_str_casecompare(&name, "Connection"))
+        /* Connection headers are handled specially */
         ;
-      else if((conn->httpversion >= 20) &&
-              hd_name_eq(name, namelen, STRCONST("Transfer-Encoding:")))
-        /* HTTP/2 doesn't support chunked requests */
+      else if((httpversion >= 20) &&
+              curlx_str_casecompare(&name, "Transfer-Encoding"))
+        /* HTTP/2 does not support chunked requests */
         ;
-      else if((hd_name_eq(name, namelen, STRCONST("Authorization:")) ||
-               hd_name_eq(name, namelen, STRCONST("Cookie:"))) &&
+      else if((curlx_str_casecompare(&name, "Authorization") ||
+               curlx_str_casecompare(&name, "Cookie")) &&
               /* be careful of sending this potentially sensitive header to
                  other hosts */
               !Curl_auth_allowed_to_host(data))
         ;
-      else {
-        CURLcode result;
+      else if(blankheader)
+        result = curlx_dyn_addf(req, "%.*s:\r\n", (int)curlx_strlen(&name),
+                                curlx_str(&name));
+      else
+        result = curlx_dyn_addf(req, "%s\r\n", origp);
 
-        result = Curl_dynhds_add(hds, name, namelen, value, valuelen);
-        if(result)
-          return result;
-      }
-    }
-  }
-
-  return CURLE_OK;
-}
-
-CURLcode Curl_add_custom_headers(struct Curl_easy *data,
-                                 bool is_connect,
-#ifndef USE_HYPER
-                                 struct dynbuf *req
-#else
-                                 void *req
-#endif
-  )
-{
-  struct connectdata *conn = data->conn;
-  char *ptr;
-  struct curl_slist *h[2];
-  struct curl_slist *headers;
-  int numlists = 1; /* by default */
-  int i;
-
-#ifndef CURL_DISABLE_PROXY
-  enum proxy_use proxy;
-
-  if(is_connect)
-    proxy = HEADER_CONNECT;
-  else
-    proxy = conn->bits.httpproxy && !conn->bits.tunnel_proxy?
-      HEADER_PROXY:HEADER_SERVER;
-
-  switch(proxy) {
-  case HEADER_SERVER:
-    h[0] = data->set.headers;
-    break;
-  case HEADER_PROXY:
-    h[0] = data->set.headers;
-    if(data->set.sep_headers) {
-      h[1] = data->set.proxyheaders;
-      numlists++;
-    }
-    break;
-  case HEADER_CONNECT:
-    if(data->set.sep_headers)
-      h[0] = data->set.proxyheaders;
-    else
-      h[0] = data->set.headers;
-    break;
-  }
-#else
-  (void)is_connect;
-  h[0] = data->set.headers;
-#endif
-
-  /* loop through one or two lists */
-  for(i = 0; i < numlists; i++) {
-    headers = h[i];
-
-    while(headers) {
-      char *semicolonp = NULL;
-      ptr = strchr(headers->data, ':');
-      if(!ptr) {
-        char *optr;
-        /* no colon, semicolon? */
-        ptr = strchr(headers->data, ';');
-        if(ptr) {
-          optr = ptr;
-          ptr++; /* pass the semicolon */
-          while(*ptr && ISSPACE(*ptr))
-            ptr++;
-
-          if(*ptr) {
-            /* this may be used for something else in the future */
-            optr = NULL;
-          }
-          else {
-            if(*(--ptr) == ';') {
-              /* copy the source */
-              semicolonp = strdup(headers->data);
-              if(!semicolonp) {
-#ifndef USE_HYPER
-                Curl_dyn_free(req);
-#endif
-                return CURLE_OUT_OF_MEMORY;
-              }
-              /* put a colon where the semicolon is */
-              semicolonp[ptr - headers->data] = ':';
-              /* point at the colon */
-              optr = &semicolonp [ptr - headers->data];
-            }
-          }
-          ptr = optr;
-        }
-      }
-      if(ptr && (ptr != headers->data)) {
-        /* we require a colon for this to be a true header */
-
-        ptr++; /* pass the colon */
-        while(*ptr && ISSPACE(*ptr))
-          ptr++;
-
-        if(*ptr || semicolonp) {
-          /* only send this if the contents was non-blank or done special */
-          CURLcode result = CURLE_OK;
-          char *compare = semicolonp ? semicolonp : headers->data;
-
-          if(data->state.aptr.host &&
-             /* a Host: header was sent already, don't pass on any custom Host:
-                header as that will produce *two* in the same request! */
-             checkprefix("Host:", compare))
-            ;
-          else if(data->state.httpreq == HTTPREQ_POST_FORM &&
-                  /* this header (extended by formdata.c) is sent later */
-                  checkprefix("Content-Type:", compare))
-            ;
-          else if(data->state.httpreq == HTTPREQ_POST_MIME &&
-                  /* this header is sent later */
-                  checkprefix("Content-Type:", compare))
-            ;
-          else if(conn->bits.authneg &&
-                  /* while doing auth neg, don't allow the custom length since
-                     we will force length zero then */
-                  checkprefix("Content-Length:", compare))
-            ;
-          else if(data->state.aptr.te &&
-                  /* when asking for Transfer-Encoding, don't pass on a custom
-                     Connection: */
-                  checkprefix("Connection:", compare))
-            ;
-          else if((conn->httpversion >= 20) &&
-                  checkprefix("Transfer-Encoding:", compare))
-            /* HTTP/2 doesn't support chunked requests */
-            ;
-          else if((checkprefix("Authorization:", compare) ||
-                   checkprefix("Cookie:", compare)) &&
-                  /* be careful of sending this potentially sensitive header to
-                     other hosts */
-                  !Curl_auth_allowed_to_host(data))
-            ;
-          else {
-#ifdef USE_HYPER
-            result = Curl_hyper_header(data, req, compare);
-#else
-            result = Curl_dyn_addf(req, "%s\r\n", compare);
-#endif
-          }
-          if(semicolonp)
-            free(semicolonp);
-          if(result)
-            return result;
-        }
-      }
-      headers = headers->next;
+      if(result)
+        return result;
     }
   }
 
@@ -2059,12 +1855,7 @@ CURLcode Curl_add_custom_headers(struct Curl_easy *data,
 
 #ifndef CURL_DISABLE_PARSEDATE
 CURLcode Curl_add_timecondition(struct Curl_easy *data,
-#ifndef USE_HYPER
-                                struct dynbuf *req
-#else
-                                void *req
-#endif
-  )
+                                struct dynbuf *req)
 {
   const struct tm *tm;
   struct tm keeptime;
@@ -2077,7 +1868,7 @@ CURLcode Curl_add_timecondition(struct Curl_easy *data,
     /* no condition was asked for */
     return CURLE_OK;
 
-  result = Curl_gmtime(data->set.timevalue, &keeptime);
+  result = curlx_gmtime(data->set.timevalue, &keeptime);
   if(result) {
     failf(data, "Invalid TIMEVALUE");
     return result;
@@ -2086,6 +1877,7 @@ CURLcode Curl_add_timecondition(struct Curl_easy *data,
 
   switch(data->set.timecondition) {
   default:
+    DEBUGF(infof(data, "invalid time condition"));
     return CURLE_BAD_FUNCTION_ARGUMENT;
 
   case CURL_TIMECOND_IFMODSINCE:
@@ -2115,23 +1907,18 @@ CURLcode Curl_add_timecondition(struct Curl_easy *data,
    */
 
   /* format: "Tue, 15 Nov 1994 12:45:26 GMT" */
-  msnprintf(datestr, sizeof(datestr),
-            "%s: %s, %02d %s %4d %02d:%02d:%02d GMT\r\n",
-            condp,
-            Curl_wkday[tm->tm_wday?tm->tm_wday-1:6],
-            tm->tm_mday,
-            Curl_month[tm->tm_mon],
-            tm->tm_year + 1900,
-            tm->tm_hour,
-            tm->tm_min,
-            tm->tm_sec);
-
-#ifndef USE_HYPER
-  result = Curl_dyn_add(req, datestr);
-#else
-  result = Curl_hyper_header(data, req, datestr);
-#endif
+  curl_msnprintf(datestr, sizeof(datestr),
+                 "%s: %s, %02d %s %4d %02d:%02d:%02d GMT\r\n",
+                 condp,
+                 Curl_wkday[tm->tm_wday ? tm->tm_wday - 1 : 6],
+                 tm->tm_mday,
+                 Curl_month[tm->tm_mon],
+                 tm->tm_year + 1900,
+                 tm->tm_hour,
+                 tm->tm_min,
+                 tm->tm_sec);
 
+  result = curlx_dyn_add(req, datestr);
   return result;
 }
 #else
@@ -2145,18 +1932,25 @@ CURLcode Curl_add_timecondition(struct Curl_easy *data,
 }
 #endif
 
-void Curl_http_method(struct Curl_easy *data, struct connectdata *conn,
+void Curl_http_method(struct Curl_easy *data,
                       const char **method, Curl_HttpReq *reqp)
 {
   Curl_HttpReq httpreq = (Curl_HttpReq)data->state.httpreq;
   const char *request;
-  if((conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_FTP)) &&
+#ifndef CURL_DISABLE_WEBSOCKETS
+  if(data->conn->scheme->protocol & (CURLPROTO_WS | CURLPROTO_WSS))
+    httpreq = HTTPREQ_GET;
+  else
+#endif
+  if((data->conn->scheme->protocol & (PROTO_FAMILY_HTTP | CURLPROTO_FTP)) &&
      data->state.upload)
     httpreq = HTTPREQ_PUT;
 
   /* Now set the 'request' pointer to the proper request string */
-  if(data->set.str[STRING_CUSTOMREQUEST])
+  if(data->set.str[STRING_CUSTOMREQUEST] &&
+     !data->state.http_ignorecustom) {
     request = data->set.str[STRING_CUSTOMREQUEST];
+  }
   else {
     if(data->req.no_body)
       request = "HEAD";
@@ -2185,59 +1979,52 @@ void Curl_http_method(struct Curl_easy *data, struct connectdata *conn,
   *reqp = httpreq;
 }
 
-CURLcode Curl_http_useragent(struct Curl_easy *data)
+static CURLcode http_useragent(struct Curl_easy *data)
 {
-  /* The User-Agent string might have been allocated in url.c already, because
+  /* The User-Agent string might have been allocated already, because
      it might have been used in the proxy connect, but if we have got a header
      with the user-agent string specified, we erase the previously made string
      here. */
-  if(Curl_checkheaders(data, STRCONST("User-Agent"))) {
-    free(data->state.aptr.uagent);
-    data->state.aptr.uagent = NULL;
-  }
+  if(Curl_checkheaders(data, STRCONST("User-Agent")))
+    curlx_safefree(data->state.aptr.uagent);
   return CURLE_OK;
 }
 
-
-CURLcode Curl_http_host(struct Curl_easy *data, struct connectdata *conn)
+static CURLcode http_set_aptr_host(struct Curl_easy *data)
 {
-  const char *ptr;
+  struct connectdata *conn = data->conn;
   struct dynamically_allocated_data *aptr = &data->state.aptr;
-  if(!data->state.this_is_a_follow) {
-    /* Free to avoid leaking memory on multiple requests */
-    free(data->state.first_host);
+  const char *ptr;
 
-    data->state.first_host = strdup(conn->host.name);
-    if(!data->state.first_host)
-      return CURLE_OUT_OF_MEMORY;
-
-    data->state.first_remote_port = conn->remote_port;
-    data->state.first_remote_protocol = conn->handler->protocol;
-  }
-  Curl_safefree(aptr->host);
+  curlx_safefree(aptr->host);
+#ifndef CURL_DISABLE_COOKIES
+  curlx_safefree(data->req.cookiehost);
+#endif
 
   ptr = Curl_checkheaders(data, STRCONST("Host"));
-  if(ptr && (!data->state.this_is_a_follow ||
-             strcasecompare(data->state.first_host, conn->host.name))) {
-#if !defined(CURL_DISABLE_COOKIES)
-    /* If we have a given custom Host: header, we extract the host name in
+  if(ptr &&
+     (!data->state.this_is_a_follow ||
+      Curl_peer_equal(data->state.initial_origin, data->state.origin))) {
+#ifndef CURL_DISABLE_COOKIES
+    /* If we have a given custom Host: header, we extract the hostname in
        order to possibly use it for cookie reasons later on. We only allow the
        custom Host: header if this is NOT a redirect, as setting Host: in the
-       redirected request is being out on thin ice. Except if the host name
+       redirected request is being out on thin ice. Except if the hostname
        is the same as the first one! */
-    char *cookiehost = Curl_copy_header_value(ptr);
-    if(!cookiehost)
-      return CURLE_OUT_OF_MEMORY;
+    char *cookiehost;
+    CURLcode result = copy_custom_value(ptr, &cookiehost);
+    if(result)
+      return result;
     if(!*cookiehost)
       /* ignore empty data */
-      free(cookiehost);
+      curlx_free(cookiehost);
     else {
       /* If the host begins with '[', we start searching for the port after
          the bracket has been closed */
       if(*cookiehost == '[') {
         char *closingbracket;
         /* since the 'cookiehost' is an allocated memory area that will be
-           freed later we cannot simply increment the pointer */
+           freed later we cannot increment the pointer */
         memmove(cookiehost, cookiehost + 1, strlen(cookiehost) - 1);
         closingbracket = strchr(cookiehost, ']');
         if(closingbracket)
@@ -2249,37 +2036,34 @@ CURLcode Curl_http_host(struct Curl_easy *data, struct connectdata *conn)
         if(colon)
           *colon = 0; /* The host must not include an embedded port number */
       }
-      Curl_safefree(aptr->cookiehost);
-      aptr->cookiehost = cookiehost;
+      data->req.cookiehost = cookiehost;
     }
 #endif
 
-    if(strcmp("Host:", ptr)) {
-      aptr->host = aprintf("Host:%s\r\n", &ptr[5]);
+    if(!curl_strequal("Host:", ptr)) {
+      aptr->host = curl_maprintf("Host:%s\r\n", &ptr[5]);
       if(!aptr->host)
         return CURLE_OUT_OF_MEMORY;
     }
   }
   else {
-    /* When building Host: headers, we must put the host name within
-       [brackets] if the host name is a plain IPv6-address. RFC2732-style. */
-    const char *host = conn->host.name;
+    /* Use the hostname as present in the URL if it was IPv6. */
+    char *host = (data->state.origin->user_hostname[0] == '[') ?
+       data->state.origin->user_hostname : data->state.origin->hostname;
 
-    if(((conn->given->protocol&(CURLPROTO_HTTPS|CURLPROTO_WSS)) &&
-        (conn->remote_port == PORT_HTTPS)) ||
-       ((conn->given->protocol&(CURLPROTO_HTTP|CURLPROTO_WS)) &&
-        (conn->remote_port == PORT_HTTP)) )
-      /* if(HTTPS on port 443) OR (HTTP on port 80) then don't include
+    if(((conn->given->protocol & (CURLPROTO_HTTPS | CURLPROTO_WSS)) &&
+        (data->state.origin->port == PORT_HTTPS)) ||
+       ((conn->given->protocol & (CURLPROTO_HTTP | CURLPROTO_WS)) &&
+        (data->state.origin->port == PORT_HTTP)))
+      /* if(HTTPS on port 443) OR (HTTP on port 80) then do not include
          the port number in the host string */
-      aptr->host = aprintf("Host: %s%s%s\r\n", conn->bits.ipv6_ip?"[":"",
-                           host, conn->bits.ipv6_ip?"]":"");
+      aptr->host = curl_maprintf("Host: %s\r\n", host);
     else
-      aptr->host = aprintf("Host: %s%s%s:%d\r\n", conn->bits.ipv6_ip?"[":"",
-                           host, conn->bits.ipv6_ip?"]":"",
-                           conn->remote_port);
+      aptr->host = curl_maprintf("Host: %s:%d\r\n",
+                                 host, data->state.origin->port);
 
     if(!aptr->host)
-      /* without Host: we can't make a nice request */
+      /* without Host: we cannot make a nice request */
       return CURLE_OUT_OF_MEMORY;
   }
   return CURLE_OK;
@@ -2288,13 +2072,15 @@ CURLcode Curl_http_host(struct Curl_easy *data, struct connectdata *conn)
 /*
  * Append the request-target to the HTTP request
  */
-CURLcode Curl_http_target(struct Curl_easy *data,
-                          struct connectdata *conn,
-                          struct dynbuf *r)
+static CURLcode http_target(struct Curl_easy *data,
+                            struct dynbuf *r)
 {
   CURLcode result = CURLE_OK;
   const char *path = data->state.up.path;
   const char *query = data->state.up.query;
+#ifndef CURL_DISABLE_PROXY
+  struct connectdata *conn = data->conn;
+#endif
 
   if(data->set.str[STRING_TARGET]) {
     path = data->set.str[STRING_TARGET];
@@ -2302,12 +2088,12 @@ CURLcode Curl_http_target(struct Curl_easy *data,
   }
 
 #ifndef CURL_DISABLE_PROXY
-  if(conn->bits.httpproxy && !conn->bits.tunnel_proxy) {
+  if(conn->bits.origin_is_proxy) {
     /* Using a proxy but does not tunnel through it */
 
-    /* The path sent to the proxy is in fact the entire URL. But if the remote
+    /* The path sent to the proxy is in fact the entire URL, but if the remote
        host is a IDN-name, we must make sure that the request we produce only
-       uses the encoded host name! */
+       uses the encoded hostname! */
 
     /* and no fragment part */
     CURLUcode uc;
@@ -2316,8 +2102,8 @@ CURLcode Curl_http_target(struct Curl_easy *data,
     if(!h)
       return CURLE_OUT_OF_MEMORY;
 
-    if(conn->host.dispname != conn->host.name) {
-      uc = curl_url_set(h, CURLUPART_HOST, conn->host.name, 0);
+    if(data->state.origin->user_hostname != data->state.origin->hostname) {
+      uc = curl_url_set(h, CURLUPART_HOST, data->state.origin->hostname, 0);
       if(uc) {
         curl_url_cleanup(h);
         return CURLE_OUT_OF_MEMORY;
@@ -2329,8 +2115,8 @@ CURLcode Curl_http_target(struct Curl_easy *data,
       return CURLE_OUT_OF_MEMORY;
     }
 
-    if(strcasecompare("http", data->state.up.scheme)) {
-      /* when getting HTTP, we don't want the userinfo the URL */
+    if(curl_strequal("http", data->state.up.scheme)) {
+      /* when getting HTTP, we do not want the userinfo the URL */
       uc = curl_url_set(h, CURLUPART_USER, NULL, 0);
       if(uc) {
         curl_url_cleanup(h);
@@ -2342,9 +2128,20 @@ CURLcode Curl_http_target(struct Curl_easy *data,
         return CURLE_OUT_OF_MEMORY;
       }
     }
-    /* Extract the URL to use in the request. Store in STRING_TEMP_URL for
-       clean-up reasons if the function returns before the free() further
-       down. */
+    else if(data->state.creds && (data->state.creds->source != CREDS_URL)) {
+        /* credentials not from the URL need to be set */
+      uc = curl_url_set(h, CURLUPART_USER,
+                        data->state.creds->user, CURLU_URLENCODE);
+      if(!uc)
+        uc = curl_url_set(h, CURLUPART_PASSWORD,
+                          data->state.creds->passwd, CURLU_URLENCODE);
+      if(uc) {
+        curl_url_cleanup(h);
+        return Curl_uc_to_curlcode(uc);
+      }
+    }
+
+    /* Extract the URL to use in the request. */
     uc = curl_url_get(h, CURLUPART_URL, &url, CURLU_NO_DEFAULT_PORT);
     if(uc) {
       curl_url_cleanup(h);
@@ -2353,633 +2150,190 @@ CURLcode Curl_http_target(struct Curl_easy *data,
 
     curl_url_cleanup(h);
 
-    /* target or url */
-    result = Curl_dyn_add(r, data->set.str[STRING_TARGET]?
-      data->set.str[STRING_TARGET]:url);
-    free(url);
+    /* target or URL */
+    result = curlx_dyn_add(r, data->set.str[STRING_TARGET] ?
+      data->set.str[STRING_TARGET] : url);
+    curlx_free(url);
     if(result)
-      return (result);
+      return result;
 
-    if(strcasecompare("ftp", data->state.up.scheme)) {
-      if(data->set.proxy_transfer_mode) {
-        /* when doing ftp, append ;type=<a|i> if not present */
-        char *type = strstr(path, ";type=");
-        if(type && type[6] && type[7] == 0) {
-          switch(Curl_raw_toupper(type[6])) {
-          case 'A':
-          case 'D':
-          case 'I':
-            break;
-          default:
-            type = NULL;
-          }
-        }
-        if(!type) {
-          result = Curl_dyn_addf(r, ";type=%c",
-                                 data->state.prefer_ascii ? 'a' : 'i');
-          if(result)
-            return result;
+    if(curl_strequal("ftp", data->state.up.scheme) &&
+       data->set.proxy_transfer_mode) {
+      /* when doing ftp, append ;type=<a|i> if not present */
+      size_t len = strlen(path);
+      bool type_present = FALSE;
+      if((len >= 7) && !memcmp(&path[len - 7], ";type=", 6)) {
+        switch(Curl_raw_toupper(path[len - 1])) {
+        case 'A':
+        case 'D':
+        case 'I':
+          type_present = TRUE;
+          break;
         }
       }
+      if(!type_present) {
+        result = curlx_dyn_addf(r, ";type=%c",
+                                data->state.prefer_ascii ? 'a' : 'i');
+        if(result)
+          return result;
+      }
     }
   }
 
   else
-#else
-    (void)conn; /* not used in disabled-proxy builds */
 #endif
   {
-    result = Curl_dyn_add(r, path);
+    result = curlx_dyn_add(r, path);
     if(result)
       return result;
     if(query)
-      result = Curl_dyn_addf(r, "?%s", query);
+      result = curlx_dyn_addf(r, "?%s", query);
   }
 
   return result;
 }
 
-CURLcode Curl_http_body(struct Curl_easy *data, struct connectdata *conn,
-                        Curl_HttpReq httpreq, const char **tep)
+#if !defined(CURL_DISABLE_MIME) || !defined(CURL_DISABLE_FORM_API)
+static CURLcode set_post_reader(struct Curl_easy *data, Curl_HttpReq httpreq)
 {
-  CURLcode result = CURLE_OK;
-  const char *ptr;
-  struct HTTP *http = data->req.p.http;
-  http->postsize = 0;
+  CURLcode result;
 
   switch(httpreq) {
+#ifndef CURL_DISABLE_MIME
   case HTTPREQ_POST_MIME:
-    data->state.mimepost = &data->set.mimepost;
+    data->state.mimepost = data->set.mimepostp;
     break;
+#endif
 #ifndef CURL_DISABLE_FORM_API
   case HTTPREQ_POST_FORM:
     /* Convert the form structure into a mime structure, then keep
        the conversion */
     if(!data->state.formp) {
-      data->state.formp = calloc(sizeof(curl_mimepart), 1);
+      data->state.formp = curlx_calloc(1, sizeof(curl_mimepart));
       if(!data->state.formp)
         return CURLE_OUT_OF_MEMORY;
       Curl_mime_cleanpart(data->state.formp);
       result = Curl_getformdata(data, data->state.formp, data->set.httppost,
                                 data->state.fread_func);
-      if(result)
+      if(result) {
+        curlx_safefree(data->state.formp);
         return result;
+      }
       data->state.mimepost = data->state.formp;
     }
     break;
 #endif
   default:
     data->state.mimepost = NULL;
+    break;
   }
 
-#ifndef CURL_DISABLE_MIME
-  if(data->state.mimepost) {
-    const char *cthdr = Curl_checkheaders(data, STRCONST("Content-Type"));
-
-    /* Read and seek body only. */
-    data->state.mimepost->flags |= MIME_BODY_ONLY;
-
-    /* Prepare the mime structure headers & set content type. */
-
-    if(cthdr)
-      for(cthdr += 13; *cthdr == ' '; cthdr++)
-        ;
-    else if(data->state.mimepost->kind == MIMEKIND_MULTIPART)
-      cthdr = "multipart/form-data";
-
-    curl_mime_headers(data->state.mimepost, data->set.headers, 0);
-    result = Curl_mime_prepare_headers(data, data->state.mimepost, cthdr,
-                                       NULL, MIMESTRATEGY_FORM);
-    curl_mime_headers(data->state.mimepost, NULL, 0);
-    if(!result)
-      result = Curl_mime_rewind(data->state.mimepost);
-    if(result)
-      return result;
-    http->postsize = Curl_mime_size(data->state.mimepost);
-  }
-#endif
-
-  ptr = Curl_checkheaders(data, STRCONST("Transfer-Encoding"));
-  if(ptr) {
-    /* Some kind of TE is requested, check if 'chunked' is chosen */
-    data->req.upload_chunky =
-      Curl_compareheader(ptr,
-                         STRCONST("Transfer-Encoding:"), STRCONST("chunked"));
-  }
-  else {
-    if((conn->handler->protocol & PROTO_FAMILY_HTTP) &&
-       (((httpreq == HTTPREQ_POST_MIME || httpreq == HTTPREQ_POST_FORM) &&
-         http->postsize < 0) ||
-        ((data->state.upload || httpreq == HTTPREQ_POST) &&
-         data->state.infilesize == -1))) {
-      if(conn->bits.authneg)
-        /* don't enable chunked during auth neg */
-        ;
-      else if(Curl_use_http_1_1plus(data, conn)) {
-        if(conn->httpversion < 20)
-          /* HTTP, upload, unknown file size and not HTTP 1.0 */
-          data->req.upload_chunky = TRUE;
-      }
-      else {
-        failf(data, "Chunky upload is not supported by HTTP 1.0");
-        return CURLE_UPLOAD_FAILED;
-      }
-    }
-    else {
-      /* else, no chunky upload */
-      data->req.upload_chunky = FALSE;
-    }
-
-    if(data->req.upload_chunky)
-      *tep = "Transfer-Encoding: chunked\r\n";
-  }
-  return result;
-}
-
-CURLcode Curl_http_bodysend(struct Curl_easy *data, struct connectdata *conn,
-                            struct dynbuf *r, Curl_HttpReq httpreq)
-{
-#ifndef USE_HYPER
-  /* Hyper always handles the body separately */
-  curl_off_t included_body = 0;
-#else
-  /* from this point down, this function should not be used */
-#define Curl_buffer_send(a,b,c,d,e,f) CURLE_OK
-#endif
-  CURLcode result = CURLE_OK;
-  struct HTTP *http = data->req.p.http;
-  const char *ptr;
-
-  /* If 'authdone' is FALSE, we must not set the write socket index to the
-     Curl_transfer() call below, as we're not ready to actually upload any
-     data yet. */
-
   switch(httpreq) {
-
-  case HTTPREQ_PUT: /* Let's PUT the data to the server! */
-
-    if(conn->bits.authneg)
-      http->postsize = 0;
-    else
-      http->postsize = data->state.infilesize;
-
-    if((http->postsize != -1) && !data->req.upload_chunky &&
-       (conn->bits.authneg ||
-        !Curl_checkheaders(data, STRCONST("Content-Length")))) {
-      /* only add Content-Length if not uploading chunked */
-      result = Curl_dyn_addf(r, "Content-Length: %" CURL_FORMAT_CURL_OFF_T
-                             "\r\n", http->postsize);
-      if(result)
-        return result;
-    }
-
-    /* For really small puts we don't use Expect: headers at all, and for
-       the somewhat bigger ones we allow the app to disable it. Just make
-       sure that the expect100header is always set to the preferred value
-       here. */
-    ptr = Curl_checkheaders(data, STRCONST("Expect"));
-    if(ptr) {
-      data->state.expect100header =
-        Curl_compareheader(ptr, STRCONST("Expect:"), STRCONST("100-continue"));
-    }
-    else if(http->postsize > EXPECT_100_THRESHOLD || http->postsize < 0) {
-      result = expect100(data, conn, r);
-      if(result)
-        return result;
-    }
-
-    /* end of headers */
-    result = Curl_dyn_addn(r, STRCONST("\r\n"));
-    if(result)
-      return result;
-
-    /* set the upload size to the progress meter */
-    Curl_pgrsSetUploadSize(data, http->postsize);
-
-    /* this sends the buffer and frees all the buffer resources */
-    result = Curl_buffer_send(r, data, data->req.p.http,
-                              &data->info.request_size, 0,
-                              FIRSTSOCKET);
-    if(result)
-      failf(data, "Failed sending PUT request");
-    else
-      /* prepare for transfer */
-      Curl_setup_transfer(data, FIRSTSOCKET, -1, TRUE,
-                          http->postsize?FIRSTSOCKET:-1);
-    if(result)
-      return result;
-    break;
-
   case HTTPREQ_POST_FORM:
   case HTTPREQ_POST_MIME:
     /* This is form posting using mime data. */
-    if(conn->bits.authneg) {
-      /* nothing to post! */
-      result = Curl_dyn_addn(r, STRCONST("Content-Length: 0\r\n\r\n"));
-      if(result)
-        return result;
-
-      result = Curl_buffer_send(r, data, data->req.p.http,
-                                &data->info.request_size, 0,
-                                FIRSTSOCKET);
-      if(result)
-        failf(data, "Failed sending POST request");
-      else
-        /* setup variables for the upcoming transfer */
-        Curl_setup_transfer(data, FIRSTSOCKET, -1, TRUE, -1);
-      break;
-    }
-
-    data->state.infilesize = http->postsize;
-
-    /* We only set Content-Length and allow a custom Content-Length if
-       we don't upload data chunked, as RFC2616 forbids us to set both
-       kinds of headers (Transfer-Encoding: chunked and Content-Length) */
-    if(http->postsize != -1 && !data->req.upload_chunky &&
-       (!Curl_checkheaders(data, STRCONST("Content-Length")))) {
-      /* we allow replacing this header if not during auth negotiation,
-         although it isn't very wise to actually set your own */
-      result = Curl_dyn_addf(r,
-                             "Content-Length: %" CURL_FORMAT_CURL_OFF_T
-                             "\r\n", http->postsize);
-      if(result)
-        return result;
-    }
-
 #ifndef CURL_DISABLE_MIME
-    /* Output mime-generated headers. */
-    {
-      struct curl_slist *hdr;
+    if(data->state.mimepost) {
+      const char *cthdr = Curl_checkheaders(data, STRCONST("Content-Type"));
 
-      for(hdr = data->state.mimepost->curlheaders; hdr; hdr = hdr->next) {
-        result = Curl_dyn_addf(r, "%s\r\n", hdr->data);
-        if(result)
-          return result;
-      }
+      /* Read and seek body only. */
+      data->state.mimepost->flags |= MIME_BODY_ONLY;
+
+      /* Prepare the mime structure headers & set content type. */
+
+      if(cthdr)
+        for(cthdr += 13; *cthdr == ' '; cthdr++)
+          ;
+      else if(data->state.mimepost->kind == MIMEKIND_MULTIPART)
+        cthdr = "multipart/form-data";
+
+      curl_mime_headers(data->state.mimepost, data->set.headers, 0);
+      result = Curl_mime_prepare_headers(data, data->state.mimepost, cthdr,
+                                         NULL, MIMESTRATEGY_FORM);
+      if(result)
+        return result;
+      curl_mime_headers(data->state.mimepost, NULL, 0);
+      result = Curl_creader_set_mime(data, data->state.mimepost);
+      if(result)
+        return result;
     }
+    else
+#endif
+    {
+      result = Curl_creader_set_null(data);
+    }
+    data->state.infilesize = Curl_creader_total_length(data);
+    return result;
+
+  default:
+    return Curl_creader_set_null(data);
+  }
+  /* never reached */
+}
 #endif
 
-    /* For really small posts we don't use Expect: headers at all, and for
-       the somewhat bigger ones we allow the app to disable it. Just make
-       sure that the expect100header is always set to the preferred value
-       here. */
-    ptr = Curl_checkheaders(data, STRCONST("Expect"));
-    if(ptr) {
-      data->state.expect100header =
-        Curl_compareheader(ptr, STRCONST("Expect:"), STRCONST("100-continue"));
-    }
-    else if(http->postsize > EXPECT_100_THRESHOLD || http->postsize < 0) {
-      result = expect100(data, conn, r);
-      if(result)
-        return result;
-    }
-    else
-      data->state.expect100header = FALSE;
+static CURLcode set_reader(struct Curl_easy *data, Curl_HttpReq httpreq)
+{
+  CURLcode result = CURLE_OK;
+  curl_off_t postsize = data->state.infilesize;
 
-    /* make the request end in a true CRLF */
-    result = Curl_dyn_addn(r, STRCONST("\r\n"));
-    if(result)
-      return result;
+  DEBUGASSERT(data->conn);
 
-    /* set the upload size to the progress meter */
-    Curl_pgrsSetUploadSize(data, http->postsize);
+  if(data->req.authneg) {
+    return Curl_creader_set_null(data);
+  }
 
-    /* Read from mime structure. */
-    data->state.fread_func = (curl_read_callback) Curl_mime_read;
-    data->state.in = (void *) data->state.mimepost;
-    http->sending = HTTPSEND_BODY;
+  switch(httpreq) {
+  case HTTPREQ_PUT: /* Let's PUT the data to the server! */
+    return postsize ? Curl_creader_set_fread(data, postsize) :
+      Curl_creader_set_null(data);
 
-    /* this sends the buffer and frees all the buffer resources */
-    result = Curl_buffer_send(r, data, data->req.p.http,
-                              &data->info.request_size, 0,
-                              FIRSTSOCKET);
-    if(result)
-      failf(data, "Failed sending POST request");
-    else
-      /* prepare for transfer */
-      Curl_setup_transfer(data, FIRSTSOCKET, -1, TRUE,
-                          http->postsize?FIRSTSOCKET:-1);
-    if(result)
-      return result;
-
-    break;
+#if !defined(CURL_DISABLE_MIME) || !defined(CURL_DISABLE_FORM_API)
+  case HTTPREQ_POST_FORM:
+  case HTTPREQ_POST_MIME:
+    return set_post_reader(data, httpreq);
+#endif
 
   case HTTPREQ_POST:
     /* this is the simple POST, using x-www-form-urlencoded style */
-
-    if(conn->bits.authneg)
-      http->postsize = 0;
-    else
-      /* the size of the post body */
-      http->postsize = data->state.infilesize;
-
-    /* We only set Content-Length and allow a custom Content-Length if
-       we don't upload data chunked, as RFC2616 forbids us to set both
-       kinds of headers (Transfer-Encoding: chunked and Content-Length) */
-    if((http->postsize != -1) && !data->req.upload_chunky &&
-       (conn->bits.authneg ||
-        !Curl_checkheaders(data, STRCONST("Content-Length")))) {
-      /* we allow replacing this header if not during auth negotiation,
-         although it isn't very wise to actually set your own */
-      result = Curl_dyn_addf(r, "Content-Length: %" CURL_FORMAT_CURL_OFF_T
-                             "\r\n", http->postsize);
-      if(result)
-        return result;
+    /* the size of the post body */
+    if(!postsize) {
+      result = Curl_creader_set_null(data);
     }
-
-    if(!Curl_checkheaders(data, STRCONST("Content-Type"))) {
-      result = Curl_dyn_addn(r, STRCONST("Content-Type: application/"
-                                         "x-www-form-urlencoded\r\n"));
-      if(result)
-        return result;
+    else if(data->set.postfields) {
+      size_t plen = curlx_sotouz_range(postsize, 0, SIZE_MAX);
+      if(plen == SIZE_MAX)
+        return CURLE_OUT_OF_MEMORY;
+      else if(plen)
+        result = Curl_creader_set_buf(data, data->set.postfields, plen);
+      else
+        result = Curl_creader_set_null(data);
     }
-
-    /* For really small posts we don't use Expect: headers at all, and for
-       the somewhat bigger ones we allow the app to disable it. Just make
-       sure that the expect100header is always set to the preferred value
-       here. */
-    ptr = Curl_checkheaders(data, STRCONST("Expect"));
-    if(ptr) {
-      data->state.expect100header =
-        Curl_compareheader(ptr, STRCONST("Expect:"), STRCONST("100-continue"));
-    }
-    else if(http->postsize > EXPECT_100_THRESHOLD || http->postsize < 0) {
-      result = expect100(data, conn, r);
-      if(result)
-        return result;
-    }
-    else
-      data->state.expect100header = FALSE;
-
-#ifndef USE_HYPER
-    /* With Hyper the body is always passed on separately */
-    if(data->set.postfields) {
-      if(!data->state.expect100header &&
-         (http->postsize < MAX_INITIAL_POST_SIZE)) {
-        /* if we don't use expect: 100  AND
-           postsize is less than MAX_INITIAL_POST_SIZE
-
-           then append the post data to the HTTP request header. This limit
-           is no magic limit but only set to prevent really huge POSTs to
-           get the data duplicated with malloc() and family. */
-
-        /* end of headers! */
-        result = Curl_dyn_addn(r, STRCONST("\r\n"));
-        if(result)
-          return result;
-
-        if(!data->req.upload_chunky) {
-          /* We're not sending it 'chunked', append it to the request
-             already now to reduce the number of send() calls */
-          result = Curl_dyn_addn(r, data->set.postfields,
-                                 (size_t)http->postsize);
-          included_body = http->postsize;
-        }
-        else {
-          if(http->postsize) {
-            char chunk[16];
-            /* Append the POST data chunky-style */
-            msnprintf(chunk, sizeof(chunk), "%x\r\n", (int)http->postsize);
-            result = Curl_dyn_add(r, chunk);
-            if(!result) {
-              included_body = http->postsize + strlen(chunk);
-              result = Curl_dyn_addn(r, data->set.postfields,
-                                     (size_t)http->postsize);
-              if(!result)
-                result = Curl_dyn_addn(r, STRCONST("\r\n"));
-              included_body += 2;
-            }
-          }
-          if(!result) {
-            result = Curl_dyn_addn(r, STRCONST("\x30\x0d\x0a\x0d\x0a"));
-            /* 0  CR  LF  CR  LF */
-            included_body += 5;
-          }
-        }
-        if(result)
-          return result;
-        /* Make sure the progress information is accurate */
-        Curl_pgrsSetUploadSize(data, http->postsize);
-      }
-      else {
-        /* A huge POST coming up, do data separate from the request */
-        http->postdata = data->set.postfields;
-        http->sending = HTTPSEND_BODY;
-        http->backup.data = data;
-        data->state.fread_func = (curl_read_callback)readmoredata;
-        data->state.in = (void *)http;
-
-        /* set the upload size to the progress meter */
-        Curl_pgrsSetUploadSize(data, http->postsize);
-
-        /* end of headers! */
-        result = Curl_dyn_addn(r, STRCONST("\r\n"));
-        if(result)
-          return result;
+    else {
+      /* we read the bytes from the callback. In case "chunked" encoding
+       * is forced by the application, we disregard `postsize`. This is
+       * a backward compatibility decision to earlier versions where
+       * chunking disregarded this. See issue #13229. */
+      bool chunked = FALSE;
+      char *ptr = Curl_checkheaders(data, STRCONST("Transfer-Encoding"));
+      if(ptr) {
+        /* Some kind of TE is requested, check if 'chunked' is chosen */
+        chunked = Curl_compareheader(ptr, STRCONST("Transfer-Encoding:"),
+                                     STRCONST("chunked"));
       }
+      result = Curl_creader_set_fread(data, chunked ? -1 : postsize);
     }
-    else
-#endif
-    {
-       /* end of headers! */
-      result = Curl_dyn_addn(r, STRCONST("\r\n"));
-      if(result)
-        return result;
-
-      if(data->req.upload_chunky && conn->bits.authneg) {
-        /* Chunky upload is selected and we're negotiating auth still, send
-           end-of-data only */
-        result = Curl_dyn_addn(r, (char *)STRCONST("\x30\x0d\x0a\x0d\x0a"));
-        /* 0  CR  LF  CR  LF */
-        if(result)
-          return result;
-      }
-
-      else if(data->state.infilesize) {
-        /* set the upload size to the progress meter */
-        Curl_pgrsSetUploadSize(data, http->postsize?http->postsize:-1);
-
-        /* set the pointer to mark that we will send the post body using the
-           read callback, but only if we're not in authenticate negotiation */
-        if(!conn->bits.authneg)
-          http->postdata = (char *)&http->postdata;
-      }
-    }
-    /* issue the request */
-    result = Curl_buffer_send(r, data, data->req.p.http,
-                              &data->info.request_size, included_body,
-                              FIRSTSOCKET);
-
-    if(result)
-      failf(data, "Failed sending HTTP POST request");
-    else
-      Curl_setup_transfer(data, FIRSTSOCKET, -1, TRUE,
-                          http->postdata?FIRSTSOCKET:-1);
-    break;
+    return result;
 
   default:
-    result = Curl_dyn_addn(r, STRCONST("\r\n"));
-    if(result)
-      return result;
-
-    /* issue the request */
-    result = Curl_buffer_send(r, data, data->req.p.http,
-                              &data->info.request_size, 0,
-                              FIRSTSOCKET);
-    if(result)
-      failf(data, "Failed sending HTTP request");
-#ifdef USE_WEBSOCKETS
-    else if((conn->handler->protocol & (CURLPROTO_WS|CURLPROTO_WSS)) &&
-            !(data->set.connect_only))
-      /* Set up the transfer for two-way since without CONNECT_ONLY set, this
-         request probably wants to send data too post upgrade */
-      Curl_setup_transfer(data, FIRSTSOCKET, -1, TRUE, FIRSTSOCKET);
-#endif
-    else
-      /* HTTP GET/HEAD download: */
-      Curl_setup_transfer(data, FIRSTSOCKET, -1, TRUE, -1);
+    /* HTTP GET/HEAD download, has no body, needs no Content-Length */
+    data->state.infilesize = 0;
+    return Curl_creader_set_null(data);
   }
-
-  return result;
+  /* not reached */
 }
 
-#if !defined(CURL_DISABLE_COOKIES)
-
-CURLcode Curl_http_cookies(struct Curl_easy *data,
-                           struct connectdata *conn,
-                           struct dynbuf *r)
-{
-  CURLcode result = CURLE_OK;
-  char *addcookies = NULL;
-  bool linecap = FALSE;
-  if(data->set.str[STRING_COOKIE] &&
-     !Curl_checkheaders(data, STRCONST("Cookie")))
-    addcookies = data->set.str[STRING_COOKIE];
-
-  if(data->cookies || addcookies) {
-    struct Cookie *co = NULL; /* no cookies from start */
-    int count = 0;
-
-    if(data->cookies && data->state.cookie_engine) {
-      const char *host = data->state.aptr.cookiehost ?
-        data->state.aptr.cookiehost : conn->host.name;
-      const bool secure_context =
-        conn->handler->protocol&(CURLPROTO_HTTPS|CURLPROTO_WSS) ||
-        strcasecompare("localhost", host) ||
-        !strcmp(host, "127.0.0.1") ||
-        !strcmp(host, "::1") ? TRUE : FALSE;
-      Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
-      co = Curl_cookie_getlist(data, data->cookies, host, data->state.up.path,
-                               secure_context);
-      Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
-    }
-    if(co) {
-      struct Cookie *store = co;
-      size_t clen = 8; /* hold the size of the generated Cookie: header */
-      /* now loop through all cookies that matched */
-      while(co) {
-        if(co->value) {
-          size_t add;
-          if(!count) {
-            result = Curl_dyn_addn(r, STRCONST("Cookie: "));
-            if(result)
-              break;
-          }
-          add = strlen(co->name) + strlen(co->value) + 1;
-          if(clen + add >= MAX_COOKIE_HEADER_LEN) {
-            infof(data, "Restricted outgoing cookies due to header size, "
-                  "'%s' not sent", co->name);
-            linecap = TRUE;
-            break;
-          }
-          result = Curl_dyn_addf(r, "%s%s=%s", count?"; ":"",
-                                 co->name, co->value);
-          if(result)
-            break;
-          clen += add + (count ? 2 : 0);
-          count++;
-        }
-        co = co->next; /* next cookie please */
-      }
-      Curl_cookie_freelist(store);
-    }
-    if(addcookies && !result && !linecap) {
-      if(!count)
-        result = Curl_dyn_addn(r, STRCONST("Cookie: "));
-      if(!result) {
-        result = Curl_dyn_addf(r, "%s%s", count?"; ":"", addcookies);
-        count++;
-      }
-    }
-    if(count && !result)
-      result = Curl_dyn_addn(r, STRCONST("\r\n"));
-
-    if(result)
-      return result;
-  }
-  return result;
-}
-#endif
-
-CURLcode Curl_http_range(struct Curl_easy *data,
-                         Curl_HttpReq httpreq)
-{
-  if(data->state.use_range) {
-    /*
-     * A range is selected. We use different headers whether we're downloading
-     * or uploading and we always let customized headers override our internal
-     * ones if any such are specified.
-     */
-    if(((httpreq == HTTPREQ_GET) || (httpreq == HTTPREQ_HEAD)) &&
-       !Curl_checkheaders(data, STRCONST("Range"))) {
-      /* if a line like this was already allocated, free the previous one */
-      free(data->state.aptr.rangeline);
-      data->state.aptr.rangeline = aprintf("Range: bytes=%s\r\n",
-                                           data->state.range);
-    }
-    else if((httpreq == HTTPREQ_POST || httpreq == HTTPREQ_PUT) &&
-            !Curl_checkheaders(data, STRCONST("Content-Range"))) {
-
-      /* if a line like this was already allocated, free the previous one */
-      free(data->state.aptr.rangeline);
-
-      if(data->set.set_resume_from < 0) {
-        /* Upload resume was asked for, but we don't know the size of the
-           remote part so we tell the server (and act accordingly) that we
-           upload the whole file (again) */
-        data->state.aptr.rangeline =
-          aprintf("Content-Range: bytes 0-%" CURL_FORMAT_CURL_OFF_T
-                  "/%" CURL_FORMAT_CURL_OFF_T "\r\n",
-                  data->state.infilesize - 1, data->state.infilesize);
-
-      }
-      else if(data->state.resume_from) {
-        /* This is because "resume" was selected */
-        curl_off_t total_expected_size =
-          data->state.resume_from + data->state.infilesize;
-        data->state.aptr.rangeline =
-          aprintf("Content-Range: bytes %s%" CURL_FORMAT_CURL_OFF_T
-                  "/%" CURL_FORMAT_CURL_OFF_T "\r\n",
-                  data->state.range, total_expected_size-1,
-                  total_expected_size);
-      }
-      else {
-        /* Range was selected and then we just pass the incoming range and
-           append total size */
-        data->state.aptr.rangeline =
-          aprintf("Content-Range: bytes %s/%" CURL_FORMAT_CURL_OFF_T "\r\n",
-                  data->state.range, data->state.infilesize);
-      }
-      if(!data->state.aptr.rangeline)
-        return CURLE_OUT_OF_MEMORY;
-    }
-  }
-  return CURLE_OK;
-}
-
-CURLcode Curl_http_resume(struct Curl_easy *data,
-                          struct connectdata *conn,
-                          Curl_HttpReq httpreq)
+static CURLcode http_resume(struct Curl_easy *data, Curl_HttpReq httpreq)
 {
   if((HTTPREQ_POST == httpreq || HTTPREQ_PUT == httpreq) &&
      data->state.resume_from) {
@@ -2995,83 +2349,333 @@ CURLcode Curl_http_resume(struct Curl_easy *data,
     if(data->state.resume_from < 0) {
       /*
        * This is meant to get the size of the present remote-file by itself.
-       * We don't support this now. Bail out!
+       * We do not support this now. Bail out!
        */
       data->state.resume_from = 0;
     }
 
-    if(data->state.resume_from && !data->state.followlocation) {
+    if(data->state.resume_from && !data->req.authneg) {
       /* only act on the first request */
-
-      /* Now, let's read off the proper amount of bytes from the
-         input. */
-      int seekerr = CURL_SEEKFUNC_CANTSEEK;
-      if(conn->seek_func) {
-        Curl_set_in_callback(data, true);
-        seekerr = conn->seek_func(conn->seek_client, data->state.resume_from,
-                                  SEEK_SET);
-        Curl_set_in_callback(data, false);
+      CURLcode result;
+      result = Curl_creader_resume_from(data, data->state.resume_from);
+      if(result) {
+        failf(data, "Unable to resume from offset %" FMT_OFF_T,
+              data->state.resume_from);
+        return result;
       }
-
-      if(seekerr != CURL_SEEKFUNC_OK) {
-        curl_off_t passed = 0;
-
-        if(seekerr != CURL_SEEKFUNC_CANTSEEK) {
-          failf(data, "Could not seek stream");
-          return CURLE_READ_ERROR;
-        }
-        /* when seekerr == CURL_SEEKFUNC_CANTSEEK (can't seek to offset) */
-        do {
-          size_t readthisamountnow =
-            (data->state.resume_from - passed > data->set.buffer_size) ?
-            (size_t)data->set.buffer_size :
-            curlx_sotouz(data->state.resume_from - passed);
-
-          size_t actuallyread =
-            data->state.fread_func(data->state.buffer, 1, readthisamountnow,
-                                   data->state.in);
-
-          passed += actuallyread;
-          if((actuallyread == 0) || (actuallyread > readthisamountnow)) {
-            /* this checks for greater-than only to make sure that the
-               CURL_READFUNC_ABORT return code still aborts */
-            failf(data, "Could only read %" CURL_FORMAT_CURL_OFF_T
-                  " bytes from the input", passed);
-            return CURLE_READ_ERROR;
-          }
-        } while(passed < data->state.resume_from);
-      }
-
-      /* now, decrease the size of the read */
-      if(data->state.infilesize>0) {
-        data->state.infilesize -= data->state.resume_from;
-
-        if(data->state.infilesize <= 0) {
-          failf(data, "File already completely uploaded");
-          return CURLE_PARTIAL_FILE;
-        }
-      }
-      /* we've passed, proceed as normal */
     }
   }
   return CURLE_OK;
 }
 
-CURLcode Curl_http_firstwrite(struct Curl_easy *data,
-                              struct connectdata *conn,
-                              bool *done)
+static CURLcode http_req_set_TE(struct Curl_easy *data,
+                                struct dynbuf *req,
+                                int httpversion)
 {
+  CURLcode result = CURLE_OK;
+  const char *ptr;
+
+  ptr = Curl_checkheaders(data, STRCONST("Transfer-Encoding"));
+  if(ptr) {
+    /* Some kind of TE is requested, check if 'chunked' is chosen */
+    data->req.upload_chunky =
+      Curl_compareheader(ptr,
+                         STRCONST("Transfer-Encoding:"), STRCONST("chunked"));
+    if(data->req.upload_chunky && (httpversion >= 20)) {
+      infof(data, "suppressing chunked transfer encoding on connection "
+            "using HTTP version 2 or higher");
+      data->req.upload_chunky = FALSE;
+    }
+  }
+  else {
+    curl_off_t req_clen = Curl_creader_total_length(data);
+
+    if(req_clen < 0) {
+      /* indeterminate request content length */
+      if(httpversion > 10) {
+        /* On HTTP/1.1, enable chunked, on HTTP/2 and later we do not
+         * need it */
+        data->req.upload_chunky = (httpversion < 20);
+      }
+      else {
+        failf(data, "Chunky upload is not supported by HTTP 1.0");
+        return CURLE_UPLOAD_FAILED;
+      }
+    }
+    else {
+      /* else, no chunky upload */
+      data->req.upload_chunky = FALSE;
+    }
+
+    if(data->req.upload_chunky)
+      result = curlx_dyn_add(req, "Transfer-Encoding: chunked\r\n");
+  }
+  return result;
+}
+
+static CURLcode addexpect(struct Curl_easy *data, struct dynbuf *r,
+                          int httpversion, bool *announced_exp100)
+{
+  CURLcode result;
+  char *ptr;
+
+  *announced_exp100 = FALSE;
+  /* Avoid Expect: 100-continue if Upgrade: is used */
+  if(data->req.upgr101 != UPGR101_NONE)
+    return CURLE_OK;
+
+  /* For really small puts we do not use Expect: headers at all, and for
+     the somewhat bigger ones we allow the app to disable it. Make
+     sure that the expect100header is always set to the preferred value
+     here. */
+  ptr = Curl_checkheaders(data, STRCONST("Expect"));
+  if(ptr) {
+    *announced_exp100 =
+      Curl_compareheader(ptr, STRCONST("Expect:"), STRCONST("100-continue"));
+  }
+  else if(!data->state.disableexpect && (httpversion == 11)) {
+    /* if not doing HTTP 1.0 or version 2, or disabled explicitly, we add an
+       Expect: 100-continue to the headers which actually speeds up post
+       operations (as there is one packet coming back from the web server) */
+    curl_off_t client_len = Curl_creader_client_length(data);
+    if(client_len > EXPECT_100_THRESHOLD || client_len < 0) {
+      result = curlx_dyn_addn(r, STRCONST("Expect: 100-continue\r\n"));
+      if(result)
+        return result;
+      *announced_exp100 = TRUE;
+    }
+  }
+  return CURLE_OK;
+}
+
+static CURLcode http_add_content_hds(struct Curl_easy *data,
+                                     struct dynbuf *r,
+                                     int httpversion,
+                                     Curl_HttpReq httpreq)
+{
+  CURLcode result = CURLE_OK;
+  curl_off_t req_clen;
+  bool announced_exp100 = FALSE;
+
+  DEBUGASSERT(data->conn);
+  if(data->req.upload_chunky) {
+    result = Curl_httpchunk_add_reader(data);
+    if(result)
+      return result;
+  }
+
+  /* Get the request body length that has been set up */
+  req_clen = Curl_creader_total_length(data);
+  switch(httpreq) {
+  case HTTPREQ_PUT:
+  case HTTPREQ_POST:
+#if !defined(CURL_DISABLE_MIME) || !defined(CURL_DISABLE_FORM_API)
+  case HTTPREQ_POST_FORM:
+  case HTTPREQ_POST_MIME:
+#endif
+    /* We only set Content-Length and allow a custom Content-Length if
+       we do not upload data chunked, as RFC2616 forbids us to set both
+       kinds of headers (Transfer-Encoding: chunked and Content-Length).
+       We do not override a custom "Content-Length" header, but during
+       authentication negotiation that header is suppressed.
+     */
+    if(req_clen >= 0 && !data->req.upload_chunky &&
+       (data->req.authneg ||
+        !Curl_checkheaders(data, STRCONST("Content-Length")))) {
+      /* we allow replacing this header if not during auth negotiation,
+         although it is not wise to actually set your own */
+      result = curlx_dyn_addf(r, "Content-Length: %" FMT_OFF_T "\r\n",
+                              req_clen);
+    }
+    if(result)
+      goto out;
+
+#ifndef CURL_DISABLE_MIME
+    /* Output mime-generated headers. */
+    if(data->state.mimepost &&
+       ((httpreq == HTTPREQ_POST_FORM) || (httpreq == HTTPREQ_POST_MIME))) {
+      struct curl_slist *hdr;
+
+      for(hdr = data->state.mimepost->curlheaders; hdr; hdr = hdr->next) {
+        result = curlx_dyn_addf(r, "%s\r\n", hdr->data);
+        if(result)
+          goto out;
+      }
+    }
+#endif
+    if(httpreq == HTTPREQ_POST) {
+      if(!Curl_checkheaders(data, STRCONST("Content-Type"))) {
+        result = curlx_dyn_addn(r, STRCONST("Content-Type: application/"
+                                            "x-www-form-urlencoded\r\n"));
+        if(result)
+          goto out;
+      }
+    }
+    result = addexpect(data, r, httpversion, &announced_exp100);
+    if(result)
+      goto out;
+    break;
+  default:
+    break;
+  }
+
+  Curl_pgrsSetUploadSize(data, req_clen);
+  if(announced_exp100)
+    result = http_exp100_add_reader(data);
+
+out:
+  return result;
+}
+
+#ifndef CURL_DISABLE_COOKIES
+
+static CURLcode http_cookies(struct Curl_easy *data,
+                             struct dynbuf *r)
+{
+  CURLcode result = CURLE_OK;
+  char *addcookies = NULL;
+  bool linecap = FALSE;
+  if(data->set.str[STRING_COOKIE] &&
+     !Curl_checkheaders(data, STRCONST("Cookie")) &&
+     Curl_auth_allowed_to_host(data))
+    addcookies = data->set.str[STRING_COOKIE];
+
+  if(data->cookies || addcookies) {
+    struct Curl_llist list;
+    int count = 0;
+
+    if(data->cookies && data->state.cookie_engine) {
+      bool okay;
+      const char *host = data->req.cookiehost ?
+        data->req.cookiehost : data->state.origin->hostname;
+      Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
+      result = Curl_cookie_getlist(data, &okay, host, &list);
+      if(!result && okay) {
+        struct Curl_llist_node *n;
+        size_t clen = 8; /* hold the size of the generated Cookie: header */
+
+        /* loop through all cookies that matched */
+        for(n = Curl_llist_head(&list); n; n = Curl_node_next(n)) {
+          struct Cookie *co = Curl_node_elem(n);
+          if(co->value) {
+            size_t add;
+            if(!count) {
+              result = curlx_dyn_addn(r, STRCONST("Cookie: "));
+              if(result)
+                break;
+            }
+            add = strlen(co->name) + strlen(co->value) + 1;
+            if(clen + add >= MAX_COOKIE_HEADER_LEN) {
+              infof(data, "Restricted outgoing cookies due to header size, "
+                    "'%s' not sent", co->name);
+              linecap = TRUE;
+              break;
+            }
+            result = curlx_dyn_addf(r, "%s%s=%s", count ? "; " : "",
+                                    co->name, co->value);
+            if(result)
+              break;
+            clen += add + (count ? 2 : 0);
+            count++;
+          }
+        }
+        Curl_llist_destroy(&list, NULL);
+      }
+      Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
+    }
+    if(addcookies && !result && !linecap) {
+      if(!count)
+        result = curlx_dyn_addn(r, STRCONST("Cookie: "));
+      if(!result) {
+        result = curlx_dyn_addf(r, "%s%s", count ? "; " : "", addcookies);
+        count++;
+      }
+    }
+    if(count && !result)
+      result = curlx_dyn_addn(r, STRCONST("\r\n"));
+
+    if(result)
+      return result;
+  }
+  return result;
+}
+#else
+#define http_cookies(a, b) CURLE_OK
+#endif
+
+static CURLcode http_range(struct Curl_easy *data,
+                           Curl_HttpReq httpreq)
+{
+  if(data->state.use_range) {
+    /*
+     * A range is selected. We use different headers whether we are downloading
+     * or uploading and we always let customized headers override our internal
+     * ones if any such are specified.
+     */
+    if(((httpreq == HTTPREQ_GET) || (httpreq == HTTPREQ_HEAD)) &&
+       !Curl_checkheaders(data, STRCONST("Range"))) {
+      /* if a line like this was already allocated, free the previous one */
+      curlx_free(data->state.aptr.rangeline);
+      data->state.aptr.rangeline = curl_maprintf("Range: bytes=%s\r\n",
+                                                 data->state.range);
+      if(!data->state.aptr.rangeline)
+        return CURLE_OUT_OF_MEMORY;
+    }
+    else if((httpreq == HTTPREQ_POST || httpreq == HTTPREQ_PUT) &&
+            !Curl_checkheaders(data, STRCONST("Content-Range"))) {
+      curl_off_t req_clen = Curl_creader_total_length(data);
+      /* if a line like this was already allocated, free the previous one */
+      curlx_free(data->state.aptr.rangeline);
+
+      if(data->set.set_resume_from < 0) {
+        /* Upload resume was asked for, but we do not know the size of the
+           remote part so we tell the server (and act accordingly) that we
+           upload the whole file (again) */
+        data->state.aptr.rangeline =
+          curl_maprintf("Content-Range: bytes 0-%" FMT_OFF_T "/"
+                        "%" FMT_OFF_T "\r\n", req_clen - 1, req_clen);
+      }
+      else if(data->state.resume_from) {
+        /* This is because "resume" was selected */
+        /* Not sure if we want to send this header during authentication
+         * negotiation, but test1084 checks for it. In which case we have a
+         * "null" client reader installed that gives an unexpected length. */
+        curl_off_t total_len = data->req.authneg ?
+                               data->state.infilesize :
+                               (data->state.resume_from + req_clen);
+        data->state.aptr.rangeline =
+          curl_maprintf("Content-Range: bytes %s%" FMT_OFF_T "/"
+                        "%" FMT_OFF_T "\r\n",
+                        data->state.range, total_len - 1, total_len);
+      }
+      else {
+        /* Range was selected and then we pass the incoming range and append
+           total size */
+        data->state.aptr.rangeline =
+          curl_maprintf("Content-Range: bytes %s/%" FMT_OFF_T "\r\n",
+                        data->state.range, req_clen);
+      }
+      if(!data->state.aptr.rangeline)
+        return CURLE_OUT_OF_MEMORY;
+    }
+  }
+  return CURLE_OK;
+}
+
+static CURLcode http_firstwrite(struct Curl_easy *data)
+{
+  struct connectdata *conn = data->conn;
   struct SingleRequest *k = &data->req;
 
   if(data->req.newurl) {
     if(conn->bits.close) {
       /* Abort after the headers if "follow Location" is set
-         and we're set to close anyway. */
-      k->keepon &= ~KEEP_RECV;
-      *done = TRUE;
+         and we are set to close anyway. */
+      CURL_REQ_CLEAR_RECV(data);
+      k->done = TRUE;
       return CURLE_OK;
     }
-    /* We have a new url to load, but since we want to be able to reuse this
+    /* We have a new URL to load, but since we want to be able to reuse this
        connection properly, we read the full response in "ignore more" */
     k->ignorebody = TRUE;
     infof(data, "Ignoring the response-body");
@@ -3082,19 +2686,19 @@ CURLcode Curl_http_firstwrite(struct Curl_easy *data,
 
     if(k->size == data->state.resume_from) {
       /* The resume point is at the end of file, consider this fine even if it
-         doesn't allow resume from here. */
+         does not allow resume from here. */
       infof(data, "The entire document is already downloaded");
       streamclose(conn, "already downloaded");
       /* Abort download */
-      k->keepon &= ~KEEP_RECV;
-      *done = TRUE;
+      CURL_REQ_CLEAR_RECV(data);
+      k->done = TRUE;
       return CURLE_OK;
     }
 
-    /* we wanted to resume a download, although the server doesn't seem to
-     * support this and we did this with a GET (if it wasn't a GET we did a
+    /* we wanted to resume a download, although the server does not seem to
+     * support this and we did this with a GET (if it was not a GET we did a
      * POST or PUT resume) */
-    failf(data, "HTTP server doesn't seem to support "
+    failf(data, "HTTP server does not seem to support "
           "byte ranges. Cannot resume.");
     return CURLE_RANGE_ERROR;
   }
@@ -3105,8 +2709,8 @@ CURLcode Curl_http_firstwrite(struct Curl_easy *data,
        action for an HTTP/1.1 client */
 
     if(!Curl_meets_timecondition(data, k->timeofdoc)) {
-      *done = TRUE;
-      /* We're simulating an HTTP 304 from server so we return
+      k->done = TRUE;
+      /* We are simulating an HTTP 304 from server so we return
          what should have been returned from the server */
       data->info.httpcode = 304;
       infof(data, "Simulate an HTTP 304 response");
@@ -3120,40 +2724,295 @@ CURLcode Curl_http_firstwrite(struct Curl_easy *data,
   return CURLE_OK;
 }
 
-#ifdef HAVE_LIBZ
-CURLcode Curl_transferencode(struct Curl_easy *data)
+static CURLcode http_check_new_conn(struct Curl_easy *data)
 {
-  if(!Curl_checkheaders(data, STRCONST("TE")) &&
-     data->set.http_transfer_encoding) {
-    /* When we are to insert a TE: header in the request, we must also insert
-       TE in a Connection: header, so we need to merge the custom provided
-       Connection: header and prevent the original to get sent. Note that if
-       the user has inserted his/her own TE: header we don't do this magic
-       but then assume that the user will handle it all! */
-    char *cptr = Curl_checkheaders(data, STRCONST("Connection"));
-#define TE_HEADER "TE: gzip\r\n"
+  struct connectdata *conn = data->conn;
+  const char *info_version = NULL;
+  const char *alpn;
+  CURLcode result;
 
-    Curl_safefree(data->state.aptr.te);
-
-    if(cptr) {
-      cptr = Curl_copy_header_value(cptr);
-      if(!cptr)
-        return CURLE_OUT_OF_MEMORY;
-    }
-
-    /* Create the (updated) Connection: header */
-    data->state.aptr.te = aprintf("Connection: %s%sTE\r\n" TE_HEADER,
-                                cptr ? cptr : "", (cptr && *cptr) ? ", ":"");
-
-    free(cptr);
-    if(!data->state.aptr.te)
-      return CURLE_OUT_OF_MEMORY;
+  alpn = Curl_conn_get_alpn_negotiated(data, conn);
+  if(alpn && !strcmp("h3", alpn)) {
+#ifndef CURL_DISABLE_PROXY
+    if(!conn->bits.origin_is_proxy)
+#endif
+      DEBUGASSERT(Curl_conn_http_version(data, conn) == 30);
+    info_version = "HTTP/3";
   }
+  else if(alpn && !strcmp("h2", alpn)) {
+#ifndef CURL_DISABLE_PROXY
+    if((Curl_conn_http_version(data, conn) != 20) &&
+       conn->bits.origin_is_proxy) {
+      result = Curl_http2_switch(data);
+      if(result)
+        return result;
+    }
+    else
+#endif
+    DEBUGASSERT(Curl_conn_http_version(data, conn) == 20);
+    info_version = "HTTP/2";
+  }
+  else {
+    /* Check if user wants to use HTTP/2 with clear TCP */
+    if(Curl_http2_may_switch(data)) {
+      DEBUGF(infof(data, "HTTP/2 over clean TCP"));
+      result = Curl_http2_switch(data);
+      if(result)
+        return result;
+      info_version = "HTTP/2";
+      /* There is no ALPN here, but the connection is now definitely h2 */
+      conn->httpversion_seen = 20;
+      Curl_conn_set_multiplex(conn);
+    }
+    else
+      info_version = "HTTP/1.x";
+  }
+
+  if(info_version)
+    infof(data, "using %s", info_version);
   return CURLE_OK;
 }
+
+static CURLcode http_add_connection_hd(struct Curl_easy *data,
+                                       struct dynbuf *req)
+{
+  struct curl_slist *head;
+  const char *sep = "Connection: ";
+  CURLcode result = CURLE_OK;
+  size_t rlen = curlx_dyn_len(req);
+  bool skip;
+
+  /* Add the 1st custom "Connection: " header, if there is one */
+  for(head = data->set.headers; head; head = head->next) {
+    if(curl_strnequal(head->data, "Connection", 10) &&
+       Curl_headersep(head->data[10]) &&
+       !http_header_is_empty(head->data)) {
+      char *value;
+      result = copy_custom_value(head->data, &value);
+      if(result)
+        return result;
+      result = curlx_dyn_addf(req, "%s%s", sep, value);
+      sep = ", ";
+      curlx_free(value);
+      break; /* leave, having added 1st one */
+    }
+  }
+
+  /* add our internal Connection: header values, if we have any */
+  if(!result && data->state.http_hd_te) {
+    result = curlx_dyn_addf(req, "%s%s", sep, "TE");
+    sep = ", ";
+  }
+  if(!result && data->state.http_hd_upgrade) {
+    result = curlx_dyn_addf(req, "%s%s", sep, "Upgrade");
+    sep = ", ";
+  }
+  if(!result && data->state.http_hd_h2_settings) {
+    result = curlx_dyn_addf(req, "%s%s", sep, "HTTP2-Settings");
+  }
+  if(!result && (rlen < curlx_dyn_len(req)))
+    result = curlx_dyn_addn(req, STRCONST("\r\n"));
+  if(result)
+    return result;
+
+  /* Add all user-defined Connection: headers after the first */
+  skip = TRUE;
+  for(head = data->set.headers; head; head = head->next) {
+    if(curl_strnequal(head->data, "Connection", 10) &&
+       Curl_headersep(head->data[10]) &&
+       !http_header_is_empty(head->data)) {
+      if(skip) {
+        skip = FALSE;
+        continue;
+      }
+      result = curlx_dyn_addf(req, "%s\r\n", head->data);
+      if(result)
+        return result;
+    }
+  }
+
+  return CURLE_OK;
+}
+
+/* Header identifier in order we send them by default */
+typedef enum {
+  H1_HD_REQUEST,
+  H1_HD_HOST,
+#ifndef CURL_DISABLE_PROXY
+  H1_HD_PROXY_AUTH,
+#endif
+  H1_HD_AUTH,
+  H1_HD_RANGE,
+  H1_HD_USER_AGENT,
+  H1_HD_ACCEPT,
+  H1_HD_TE,
+  H1_HD_ACCEPT_ENCODING,
+  H1_HD_REFERER,
+#ifndef CURL_DISABLE_PROXY
+  H1_HD_PROXY_CONNECTION,
+#endif
+  H1_HD_TRANSFER_ENCODING,
+#ifndef CURL_DISABLE_ALTSVC
+  H1_HD_ALT_USED,
+#endif
+  H1_HD_UPGRADE,
+  H1_HD_COOKIES,
+  H1_HD_CONDITIONALS,
+  H1_HD_CUSTOM,
+  H1_HD_CONTENT,
+  H1_HD_CONNECTION,
+  H1_HD_LAST  /* the last, empty header line */
+} http_hd_t;
+
+static CURLcode http_add_hd(struct Curl_easy *data,
+                            struct dynbuf *req,
+                            http_hd_t id,
+                            unsigned char httpversion,
+                            const char *method,
+                            Curl_HttpReq httpreq)
+{
+  CURLcode result = CURLE_OK;
+#if !defined(CURL_DISABLE_ALTSVC) || \
+  !defined(CURL_DISABLE_PROXY) || \
+  !defined(CURL_DISABLE_WEBSOCKETS)
+  struct connectdata *conn = data->conn;
+#endif
+  switch(id) {
+  case H1_HD_REQUEST:
+    /* add the main request stuff */
+    /* GET/HEAD/POST/PUT */
+    result = curlx_dyn_addf(req, "%s ", method);
+    if(!result)
+      result = http_target(data, req);
+    if(!result)
+      result = curlx_dyn_addf(req, " HTTP/%s\r\n",
+                              get_http_string(httpversion));
+    break;
+
+  case H1_HD_HOST:
+    if(data->state.aptr.host)
+      result = curlx_dyn_add(req, data->state.aptr.host);
+    break;
+
+#ifndef CURL_DISABLE_PROXY
+  case H1_HD_PROXY_AUTH:
+    if(data->req.hd_proxy_auth)
+      result = curlx_dyn_add(req, data->req.hd_proxy_auth);
+    break;
 #endif
 
-#ifndef USE_HYPER
+  case H1_HD_AUTH:
+    if(data->req.hd_auth)
+      result = curlx_dyn_add(req, data->req.hd_auth);
+    break;
+
+  case H1_HD_RANGE:
+    if(data->state.use_range && data->state.aptr.rangeline)
+      result = curlx_dyn_add(req, data->state.aptr.rangeline);
+    break;
+
+  case H1_HD_USER_AGENT:
+    if(data->set.str[STRING_USERAGENT] && /* User-Agent: */
+       *data->set.str[STRING_USERAGENT] &&
+       data->state.aptr.uagent)
+      result = curlx_dyn_add(req, data->state.aptr.uagent);
+    break;
+
+  case H1_HD_ACCEPT:
+    if(!Curl_checkheaders(data, STRCONST("Accept")))
+      result = curlx_dyn_add(req, "Accept: */*\r\n");
+    break;
+
+  case H1_HD_TE:
+#ifdef HAVE_LIBZ
+    if(!Curl_checkheaders(data, STRCONST("TE")) &&
+       data->set.http_transfer_encoding) {
+      data->state.http_hd_te = TRUE;
+      result = curlx_dyn_add(req, "TE: gzip\r\n");
+    }
+#endif
+    break;
+
+  case H1_HD_ACCEPT_ENCODING:
+    curlx_safefree(data->state.aptr.accept_encoding);
+    if(!Curl_checkheaders(data, STRCONST("Accept-Encoding")) &&
+       data->set.str[STRING_ENCODING])
+      result = curlx_dyn_addf(req, "Accept-Encoding: %s\r\n",
+                              data->set.str[STRING_ENCODING]);
+    break;
+
+  case H1_HD_REFERER:
+    curlx_safefree(data->state.aptr.ref);
+    if(Curl_bufref_ptr(&data->state.referer) &&
+       !Curl_checkheaders(data, STRCONST("Referer")))
+      result = curlx_dyn_addf(req, "Referer: %s\r\n",
+                              Curl_bufref_ptr(&data->state.referer));
+    break;
+
+#ifndef CURL_DISABLE_PROXY
+  case H1_HD_PROXY_CONNECTION:
+    if(conn->bits.origin_is_proxy &&
+       !Curl_checkheaders(data, STRCONST("Proxy-Connection")) &&
+       !Curl_checkProxyheaders(data, data->conn, STRCONST("Proxy-Connection")))
+      result = curlx_dyn_add(req, "Proxy-Connection: Keep-Alive\r\n");
+    break;
+#endif
+
+  case H1_HD_TRANSFER_ENCODING:
+    result = http_req_set_TE(data, req, httpversion);
+    break;
+
+#ifndef CURL_DISABLE_ALTSVC
+  case H1_HD_ALT_USED:
+    if(conn->bits.altused && conn->via_peer &&
+       !Curl_checkheaders(data, STRCONST("Alt-Used")))
+      result = curlx_dyn_addf(req, "Alt-Used: %s:%u\r\n",
+                              conn->via_peer->hostname, conn->via_peer->port);
+    break;
+#endif
+
+  case H1_HD_UPGRADE:
+    if(!Curl_conn_is_ssl(data->conn, FIRSTSOCKET) && (httpversion < 20) &&
+       (data->state.http_neg.wanted & CURL_HTTP_V2x) &&
+       data->state.http_neg.h2_upgrade) {
+      /* append HTTP2 upgrade magic stuff to the HTTP request if it is not done
+         over SSL */
+      result = Curl_http2_request_upgrade(req, data);
+    }
+#ifndef CURL_DISABLE_WEBSOCKETS
+    if(!result && conn->scheme->protocol & (CURLPROTO_WS | CURLPROTO_WSS))
+      result = Curl_ws_request(data, req);
+#endif
+    break;
+
+  case H1_HD_COOKIES:
+    result = http_cookies(data, req);
+    break;
+
+  case H1_HD_CONDITIONALS:
+    result = Curl_add_timecondition(data, req);
+    break;
+
+  case H1_HD_CUSTOM:
+    result = Curl_add_custom_headers(data, FALSE, httpversion, req);
+    break;
+
+  case H1_HD_CONTENT:
+    result = http_add_content_hds(data, req, httpversion, httpreq);
+    break;
+
+  case H1_HD_CONNECTION: {
+    result = http_add_connection_hd(data, req);
+    break;
+  }
+
+  case H1_HD_LAST:
+    result = curlx_dyn_addn(req, STRCONST("\r\n"));
+    break;
+  }
+  return result;
+}
+
 /*
  * Curl_http() gets called from the generic multi_do() function when an HTTP
  * request is to be performed. This creates and sends a properly constructed
@@ -3161,292 +3020,96 @@ CURLcode Curl_transferencode(struct Curl_easy *data)
  */
 CURLcode Curl_http(struct Curl_easy *data, bool *done)
 {
-  struct connectdata *conn = data->conn;
   CURLcode result = CURLE_OK;
-  struct HTTP *http;
   Curl_HttpReq httpreq;
-  const char *te = ""; /* transfer-encoding */
-  const char *request;
-  const char *httpstring;
+  const char *method;
   struct dynbuf req;
-  char *altused = NULL;
-  const char *p_accept;      /* Accept: string */
+  unsigned char httpversion;
+  size_t hd_id;
 
   /* Always consider the DO phase done after this function call, even if there
      may be parts of the request that are not yet sent, since we can deal with
      the rest of the request in the PERFORM phase. */
   *done = TRUE;
-
-  switch(conn->alpn) {
-  case CURL_HTTP_VERSION_3:
-    DEBUGASSERT(Curl_conn_is_http3(data, conn, FIRSTSOCKET));
-    break;
-  case CURL_HTTP_VERSION_2:
-#ifndef CURL_DISABLE_PROXY
-    if(!Curl_conn_is_http2(data, conn, FIRSTSOCKET) &&
-       conn->bits.proxy && !conn->bits.tunnel_proxy
-      ) {
-      result = Curl_http2_switch(data, conn, FIRSTSOCKET);
-      if(result)
-        return result;
-    }
-    else
-#endif
-      DEBUGASSERT(Curl_conn_is_http2(data, conn, FIRSTSOCKET));
-    break;
-  case CURL_HTTP_VERSION_1_1:
-    /* continue with HTTP/1.1 when explicitly requested */
-    break;
-  default:
-    /* Check if user wants to use HTTP/2 with clear TCP */
-    if(Curl_http2_may_switch(data, conn, FIRSTSOCKET)) {
-      DEBUGF(infof(data, "HTTP/2 over clean TCP"));
-      result = Curl_http2_switch(data, conn, FIRSTSOCKET);
-      if(result)
-        return result;
-    }
-    break;
-  }
-
-  http = data->req.p.http;
-  DEBUGASSERT(http);
-
-  result = Curl_http_host(data, conn);
-  if(result)
-    return result;
-
-  result = Curl_http_useragent(data);
-  if(result)
-    return result;
-
-  Curl_http_method(data, conn, &request, &httpreq);
-
-  /* setup the authentication headers */
-  {
-    char *pq = NULL;
-    if(data->state.up.query) {
-      pq = aprintf("%s?%s", data->state.up.path, data->state.up.query);
-      if(!pq)
-        return CURLE_OUT_OF_MEMORY;
-    }
-    result = Curl_http_output_auth(data, conn, request, httpreq,
-                                   (pq ? pq : data->state.up.path), FALSE);
-    free(pq);
-    if(result)
-      return result;
-  }
-
-  Curl_safefree(data->state.aptr.ref);
-  if(data->state.referer && !Curl_checkheaders(data, STRCONST("Referer"))) {
-    data->state.aptr.ref = aprintf("Referer: %s\r\n", data->state.referer);
-    if(!data->state.aptr.ref)
-      return CURLE_OUT_OF_MEMORY;
-  }
-
-  if(!Curl_checkheaders(data, STRCONST("Accept-Encoding")) &&
-     data->set.str[STRING_ENCODING]) {
-    Curl_safefree(data->state.aptr.accept_encoding);
-    data->state.aptr.accept_encoding =
-      aprintf("Accept-Encoding: %s\r\n", data->set.str[STRING_ENCODING]);
-    if(!data->state.aptr.accept_encoding)
-      return CURLE_OUT_OF_MEMORY;
-  }
-  else
-    Curl_safefree(data->state.aptr.accept_encoding);
-
-#ifdef HAVE_LIBZ
-  /* we only consider transfer-encoding magic if libz support is built-in */
-  result = Curl_transferencode(data);
-  if(result)
-    return result;
-#endif
-
-  result = Curl_http_body(data, conn, httpreq, &te);
-  if(result)
-    return result;
-
-  p_accept = Curl_checkheaders(data,
-                               STRCONST("Accept"))?NULL:"Accept: */*\r\n";
-
-  result = Curl_http_resume(data, conn, httpreq);
-  if(result)
-    return result;
-
-  result = Curl_http_range(data, httpreq);
-  if(result)
-    return result;
-
-  httpstring = get_http_string(data, conn);
-
   /* initialize a dynamic send-buffer */
-  Curl_dyn_init(&req, DYN_HTTP_REQUEST);
-
+  curlx_dyn_init(&req, DYN_HTTP_REQUEST);
   /* make sure the header buffer is reset - if there are leftovers from a
      previous transfer */
-  Curl_dyn_reset(&data->state.headerb);
+  curlx_dyn_reset(&data->state.headerb);
+  data->state.maybe_folded = FALSE;
 
-  /* add the main request stuff */
-  /* GET/HEAD/POST/PUT */
-  result = Curl_dyn_addf(&req, "%s ", request);
+  if(!data->conn->bits.reuse) {
+    result = http_check_new_conn(data);
+    if(result)
+      goto out;
+  }
+
+  /* Add collecting of headers written to client. For a new connection,
+   * we might have done that already, but reuse
+   * or multiplex needs it here as well. */
+  result = Curl_headers_init(data);
+  if(result)
+    goto out;
+
+  data->state.http_hd_te = FALSE;
+  data->state.http_hd_upgrade = FALSE;
+  data->state.http_hd_h2_settings = FALSE;
+
+  /* what kind of request do we need to send? */
+  Curl_http_method(data, &method, &httpreq);
+
+  /* select host to send */
+  result = http_set_aptr_host(data);
+  /* setup the authentication headers, how that method and host are known */
   if(!result)
-    result = Curl_http_target(data, conn, &req);
-  if(result) {
-    Curl_dyn_free(&req);
-    return result;
-  }
-
-#ifndef CURL_DISABLE_ALTSVC
-  if(conn->bits.altused && !Curl_checkheaders(data, STRCONST("Alt-Used"))) {
-    altused = aprintf("Alt-Used: %s:%d\r\n",
-                      conn->conn_to_host.name, conn->conn_to_port);
-    if(!altused) {
-      Curl_dyn_free(&req);
-      return CURLE_OUT_OF_MEMORY;
-    }
-  }
-#endif
-  result =
-    Curl_dyn_addf(&req,
-                  " HTTP/%s\r\n" /* HTTP version */
-                  "%s" /* host */
-                  "%s" /* proxyuserpwd */
-                  "%s" /* userpwd */
-                  "%s" /* range */
-                  "%s" /* user agent */
-                  "%s" /* accept */
-                  "%s" /* TE: */
-                  "%s" /* accept-encoding */
-                  "%s" /* referer */
-                  "%s" /* Proxy-Connection */
-                  "%s" /* transfer-encoding */
-                  "%s",/* Alt-Used */
-
-                  httpstring,
-                  (data->state.aptr.host?data->state.aptr.host:""),
-                  data->state.aptr.proxyuserpwd?
-                  data->state.aptr.proxyuserpwd:"",
-                  data->state.aptr.userpwd?data->state.aptr.userpwd:"",
-                  (data->state.use_range && data->state.aptr.rangeline)?
-                  data->state.aptr.rangeline:"",
-                  (data->set.str[STRING_USERAGENT] &&
-                   *data->set.str[STRING_USERAGENT] &&
-                   data->state.aptr.uagent)?
-                  data->state.aptr.uagent:"",
-                  p_accept?p_accept:"",
-                  data->state.aptr.te?data->state.aptr.te:"",
-                  (data->set.str[STRING_ENCODING] &&
-                   *data->set.str[STRING_ENCODING] &&
-                   data->state.aptr.accept_encoding)?
-                  data->state.aptr.accept_encoding:"",
-                  (data->state.referer && data->state.aptr.ref)?
-                  data->state.aptr.ref:"" /* Referer: <data> */,
-#ifndef CURL_DISABLE_PROXY
-                  (conn->bits.httpproxy &&
-                   !conn->bits.tunnel_proxy &&
-                   !Curl_checkheaders(data, STRCONST("Proxy-Connection")) &&
-                   !Curl_checkProxyheaders(data,
-                                           conn,
-                                           STRCONST("Proxy-Connection")))?
-                  "Proxy-Connection: Keep-Alive\r\n":"",
-#else
-                  "",
-#endif
-                  te,
-                  altused ? altused : ""
-      );
-
-  /* clear userpwd and proxyuserpwd to avoid reusing old credentials
-   * from reused connections */
-  Curl_safefree(data->state.aptr.userpwd);
-  Curl_safefree(data->state.aptr.proxyuserpwd);
-  free(altused);
-
-  if(result) {
-    Curl_dyn_free(&req);
-    return result;
-  }
-
-  if(!(conn->handler->flags&PROTOPT_SSL) &&
-     conn->httpversion < 20 &&
-     (data->state.httpwant == CURL_HTTP_VERSION_2)) {
-    /* append HTTP2 upgrade magic stuff to the HTTP request if it isn't done
-       over SSL */
-    result = Curl_http2_request_upgrade(&req, data);
-    if(result) {
-      Curl_dyn_free(&req);
-      return result;
-    }
-  }
-
-  result = Curl_http_cookies(data, conn, &req);
-#ifdef USE_WEBSOCKETS
-  if(!result && conn->handler->protocol&(CURLPROTO_WS|CURLPROTO_WSS))
-    result = Curl_ws_request(data, &req);
-#endif
+    result = Curl_http_output_auth(data, data->conn, method, httpreq,
+                                   data->state.up.path,
+                                   data->state.up.query, FALSE);
   if(!result)
-    result = Curl_add_timecondition(data, &req);
+    result = http_useragent(data);
+  /* Setup input reader, resume information and ranges */
   if(!result)
-    result = Curl_add_custom_headers(data, FALSE, &req);
+    result = set_reader(data, httpreq);
+  if(!result)
+    result = http_resume(data, httpreq);
+  if(!result)
+    result = http_range(data, httpreq);
+  if(result)
+    goto out;
 
-  if(!result) {
-    http->postdata = NULL;  /* nothing to post at this point */
-    if((httpreq == HTTPREQ_GET) ||
-       (httpreq == HTTPREQ_HEAD))
-      Curl_pgrsSetUploadSize(data, 0); /* nothing */
-
-    /* bodysend takes ownership of the 'req' memory on success */
-    result = Curl_http_bodysend(data, conn, &req, httpreq);
-  }
-  if(result) {
-    Curl_dyn_free(&req);
-    return result;
+  httpversion = http_request_version(data);
+  /* Add request line and all headers to `req` */
+  for(hd_id = 0; hd_id <= H1_HD_LAST; ++hd_id) {
+    result = http_add_hd(data, &req, (http_hd_t)hd_id,
+                         httpversion, method, httpreq);
+    if(result)
+      goto out;
   }
 
-  if((http->postsize > -1) &&
-     (http->postsize <= data->req.writebytecount) &&
-     (http->sending != HTTPSEND_REQUEST))
-    data->req.upload_done = TRUE;
+  /* setup variables for the upcoming transfer and send */
+  Curl_xfer_setup_sendrecv(data, FIRSTSOCKET, -1);
+  result = Curl_req_send(data, &req, httpversion);
 
-  if(data->req.writebytecount) {
-    /* if a request-body has been sent off, we make sure this progress is noted
-       properly */
-    Curl_pgrsSetUploadCounter(data, data->req.writebytecount);
-    if(Curl_pgrsUpdate(data))
-      result = CURLE_ABORTED_BY_CALLBACK;
-
-    if(!http->postsize) {
-      /* already sent the entire request body, mark the "upload" as
-         complete */
-      infof(data, "upload completely sent off: %" CURL_FORMAT_CURL_OFF_T
-            " out of %" CURL_FORMAT_CURL_OFF_T " bytes",
-            data->req.writebytecount, http->postsize);
-      data->req.upload_done = TRUE;
-      data->req.keepon &= ~KEEP_SEND; /* we're done writing */
-      data->req.exp100 = EXP100_SEND_DATA; /* already sent */
-      Curl_expire_done(data, EXPIRE_100_TIMEOUT);
-    }
-  }
-
-  if(data->req.upload_done)
-    Curl_conn_ev_data_done_send(data);
-
-  if((conn->httpversion >= 20) && data->req.upload_chunky)
+  if((httpversion >= 20) && data->req.upload_chunky)
     /* upload_chunky was set above to set up the request in a chunky fashion,
        but is disabled here again to avoid that the chunked encoded version is
        actually used when sending the request body over h2 */
     data->req.upload_chunky = FALSE;
+
+out:
+  if(result == CURLE_TOO_LARGE)
+    failf(data, "HTTP request too large");
+
+  curlx_dyn_free(&req);
   return result;
 }
 
-#endif /* USE_HYPER */
-
 typedef enum {
   STATUS_UNKNOWN, /* not enough data to tell yet */
   STATUS_DONE, /* a status line was read */
   STATUS_BAD /* not a status line */
 } statusline;
 
-
 /* Check a string for a prefix. Check no more than 'len' bytes */
 static bool checkprefixmax(const char *prefix, const char *buffer, size_t len)
 {
@@ -3459,13 +3122,12 @@ static bool checkprefixmax(const char *prefix, const char *buffer, size_t len)
  *
  * Returns TRUE if member of the list matches prefix of string
  */
-static statusline
-checkhttpprefix(struct Curl_easy *data,
-                const char *s, size_t len)
+static statusline checkhttpprefix(struct Curl_easy *data,
+                                  const char *s, size_t len)
 {
   struct curl_slist *head = data->set.http200aliases;
   statusline rc = STATUS_BAD;
-  statusline onmatch = len >= 5? STATUS_DONE : STATUS_UNKNOWN;
+  statusline onmatch = len >= 5 ? STATUS_DONE : STATUS_UNKNOWN;
 
   while(head) {
     if(checkprefixmax(head->data, s, len)) {
@@ -3482,26 +3144,25 @@ checkhttpprefix(struct Curl_easy *data,
 }
 
 #ifndef CURL_DISABLE_RTSP
-static statusline
-checkrtspprefix(struct Curl_easy *data,
-                const char *s, size_t len)
+static statusline checkrtspprefix(struct Curl_easy *data,
+                                  const char *s, size_t len)
 {
-  statusline result = STATUS_BAD;
-  statusline onmatch = len >= 5? STATUS_DONE : STATUS_UNKNOWN;
-  (void)data; /* unused */
+  statusline status = STATUS_BAD;
+  statusline onmatch = len >= 5 ? STATUS_DONE : STATUS_UNKNOWN;
+  (void)data;
   if(checkprefixmax("RTSP/", s, len))
-    result = onmatch;
+    status = onmatch;
 
-  return result;
+  return status;
 }
 #endif /* CURL_DISABLE_RTSP */
 
-static statusline
-checkprotoprefix(struct Curl_easy *data, struct connectdata *conn,
-                 const char *s, size_t len)
+static statusline checkprotoprefix(struct Curl_easy *data,
+                                   struct connectdata *conn,
+                                   const char *s, size_t len)
 {
 #ifndef CURL_DISABLE_RTSP
-  if(conn->handler->protocol & CURLPROTO_RTSP)
+  if(conn->scheme->protocol & CURLPROTO_RTSP)
     return checkrtspprefix(data, s, len);
 #else
   (void)conn;
@@ -3510,158 +3171,161 @@ checkprotoprefix(struct Curl_easy *data, struct connectdata *conn,
   return checkhttpprefix(data, s, len);
 }
 
-/*
- * Curl_http_header() parses a single response header.
- */
-CURLcode Curl_http_header(struct Curl_easy *data, struct connectdata *conn,
-                          char *headp)
-{
-  CURLcode result;
-  struct SingleRequest *k = &data->req;
-  /* Check for Content-Length: header lines to get size */
-  if(!k->http_bodyless &&
-     !data->set.ignorecl && checkprefix("Content-Length:", headp)) {
-    curl_off_t contentlength;
-    CURLofft offt = curlx_strtoofft(headp + strlen("Content-Length:"),
-                                    NULL, 10, &contentlength);
+/* HTTP header has field name `n` (a string constant) */
+#define HD_IS(hd, hdlen, n) \
+  (((hdlen) >= (sizeof(n) - 1)) && curl_strnequal(n, hd, sizeof(n) - 1))
 
-    if(offt == CURL_OFFT_OK) {
-      k->size = contentlength;
-      k->maxdownload = k->size;
-    }
-    else if(offt == CURL_OFFT_FLOW) {
-      /* out of range */
-      if(data->set.max_filesize) {
-        failf(data, "Maximum file size exceeded");
-        return CURLE_FILESIZE_EXCEEDED;
+#define HD_VAL(hd, hdlen, n) \
+  ((((hdlen) >= (sizeof(n) - 1)) && (hd) && \
+    curl_strnequal(n, hd, sizeof(n) - 1)) ? ((hd) + (sizeof(n) - 1)) : NULL)
+
+/* HTTP header has field name `n` (a string constant) and contains `v`
+ * (a string constant) in its value(s) */
+#define HD_IS_AND_SAYS(hd, hdlen, n, v) \
+  (HD_IS(hd, hdlen, n) && \
+   ((hdlen) > ((sizeof(n) - 1) + (sizeof(v) - 1))) && \
+   Curl_compareheader(hd, STRCONST(n), STRCONST(v)))
+
+/*
+ * http_header_a() parses a single response header starting with A.
+ */
+static CURLcode http_header_a(struct Curl_easy *data,
+                              const char *hd, size_t hdlen)
+{
+#ifndef CURL_DISABLE_ALTSVC
+  const char *v;
+  v = (data->asi &&
+       (Curl_xfer_is_secure(data) ||
+#ifdef DEBUGBUILD
+        /* allow debug builds to circumvent the HTTPS restriction */
+        getenv("CURL_ALTSVC_HTTP")
+#else
+        0
+#endif
+         )) ? HD_VAL(hd, hdlen, "Alt-Svc:") : NULL;
+  if(v) {
+    /* the ALPN of the current request */
+    struct SingleRequest *k = &data->req;
+    enum alpnid id = (k->httpversion == 30) ? ALPN_h3 :
+      (k->httpversion == 20) ? ALPN_h2 : ALPN_h1;
+    return Curl_altsvc_parse(
+      data, data->asi, v, id, data->state.origin->hostname,
+      curlx_uitous((unsigned int)data->state.origin->port));
+  }
+#else
+  (void)data;
+  (void)hd;
+  (void)hdlen;
+#endif
+  return CURLE_OK;
+}
+
+/*
+ * http_header_c() parses a single response header starting with C.
+ */
+static CURLcode http_header_c(struct Curl_easy *data,
+                              const char *hd, size_t hdlen)
+{
+  struct connectdata *conn = data->conn;
+  struct SingleRequest *k = &data->req;
+  const char *v;
+
+  /* Check for Content-Length: header lines to get size. Browsers insist we
+     should accept multiple Content-Length headers and that a comma separated
+     list also is fine and then we should accept them all as long as they are
+     the same value. Different values trigger error.
+   */
+  v = (!k->http_bodyless && !data->set.ignorecl) ?
+    HD_VAL(hd, hdlen, "Content-Length:") : NULL;
+  if(v) {
+    do {
+      curl_off_t contentlength;
+      int offt = curlx_str_numblanks(&v, &contentlength);
+
+      if(offt == STRE_OVERFLOW) {
+        /* out of range */
+        if(data->set.max_filesize) {
+          failf(data, "Maximum file size exceeded");
+          return CURLE_FILESIZE_EXCEEDED;
+        }
+        streamclose(conn, "overflow content-length");
+        infof(data, "Overflow Content-Length: value");
+        return CURLE_OK;
       }
-      streamclose(conn, "overflow content-length");
-      infof(data, "Overflow Content-Length: value");
-    }
-    else {
-      /* negative or just rubbish - bad HTTP */
-      failf(data, "Invalid Content-Length: value");
-      return CURLE_WEIRD_SERVER_REPLY;
-    }
+      else {
+        if((offt == STRE_OK) &&
+           ((k->size == -1) || /* not set to something before */
+            (k->size == contentlength))) { /* or the same value */
+
+          k->size = contentlength;
+          curlx_str_passblanks(&v);
+
+          /* on a comma, loop and get the next instead */
+          if(!curlx_str_single(&v, ','))
+            continue;
+
+          if(!curlx_str_newline(&v)) {
+            k->maxdownload = k->size;
+            return CURLE_OK;
+          }
+        }
+        /* negative, different value or rubbish - bad HTTP */
+        failf(data, "Invalid Content-Length: value");
+        return CURLE_WEIRD_SERVER_REPLY;
+      }
+    } while(1);
+  }
+  v = (!k->http_bodyless && data->set.str[STRING_ENCODING]) ?
+    HD_VAL(hd, hdlen, "Content-Encoding:") : NULL;
+  if(v) {
+    /*
+     * Process Content-Encoding. Look for the values: identity, gzip, deflate,
+     * compress, x-gzip and x-compress. x-gzip and x-compress are the same as
+     * gzip and compress. (Sec 3.5 RFC 2616). zlib cannot handle compress.
+     * Errors are handled further down when the response body is processed
+     */
+    return Curl_build_unencoding_stack(data, v, FALSE);
   }
   /* check for Content-Type: header lines to get the MIME-type */
-  else if(checkprefix("Content-Type:", headp)) {
-    char *contenttype = Curl_copy_header_value(headp);
+  v = HD_VAL(hd, hdlen, "Content-Type:");
+  if(v) {
+    char *contenttype = Curl_copy_header_value(hd);
     if(!contenttype)
       return CURLE_OUT_OF_MEMORY;
     if(!*contenttype)
       /* ignore empty data */
-      free(contenttype);
+      curlx_free(contenttype);
     else {
-      Curl_safefree(data->info.contenttype);
+      curlx_free(data->info.contenttype);
       data->info.contenttype = contenttype;
     }
+    return CURLE_OK;
   }
-#ifndef CURL_DISABLE_PROXY
-  else if((conn->httpversion == 10) &&
-          conn->bits.httpproxy &&
-          Curl_compareheader(headp,
-                             STRCONST("Proxy-Connection:"),
-                             STRCONST("keep-alive"))) {
-    /*
-     * When an HTTP/1.0 reply comes when using a proxy, the
-     * 'Proxy-Connection: keep-alive' line tells us the
-     * connection will be kept alive for our pleasure.
-     * Default action for 1.0 is to close.
-     */
-    connkeep(conn, "Proxy-Connection keep-alive"); /* don't close */
-    infof(data, "HTTP/1.0 proxy connection set to keep alive");
-  }
-  else if((conn->httpversion == 11) &&
-          conn->bits.httpproxy &&
-          Curl_compareheader(headp,
-                             STRCONST("Proxy-Connection:"),
-                             STRCONST("close"))) {
-    /*
-     * We get an HTTP/1.1 response from a proxy and it says it'll
-     * close down after this transfer.
-     */
-    connclose(conn, "Proxy-Connection: asked to close after done");
-    infof(data, "HTTP/1.1 proxy connection set close");
-  }
-#endif
-  else if((conn->httpversion == 10) &&
-          Curl_compareheader(headp,
-                             STRCONST("Connection:"),
-                             STRCONST("keep-alive"))) {
-    /*
-     * An HTTP/1.0 reply with the 'Connection: keep-alive' line
-     * tells us the connection will be kept alive for our
-     * pleasure.  Default action for 1.0 is to close.
-     *
-     * [RFC2068, section 19.7.1] */
-    connkeep(conn, "Connection keep-alive");
-    infof(data, "HTTP/1.0 connection set to keep alive");
-  }
-  else if(Curl_compareheader(headp,
-                             STRCONST("Connection:"), STRCONST("close"))) {
+  if((k->httpversion < 20) &&
+     HD_IS_AND_SAYS(hd, hdlen, "Connection:", "close")) {
     /*
      * [RFC 2616, section 8.1.2.1]
      * "Connection: close" is HTTP/1.1 language and means that
      * the connection will close when this request has been
      * served.
      */
-    streamclose(conn, "Connection: close used");
+    connclose(conn, "Connection: close used");
+    return CURLE_OK;
   }
-  else if(!k->http_bodyless && checkprefix("Transfer-Encoding:", headp)) {
-    /* One or more encodings. We check for chunked and/or a compression
-       algorithm. */
+  if((k->httpversion == 10) &&
+     HD_IS_AND_SAYS(hd, hdlen, "Connection:", "keep-alive")) {
     /*
-     * [RFC 2616, section 3.6.1] A 'chunked' transfer encoding
-     * means that the server will send a series of "chunks". Each
-     * chunk starts with line with info (including size of the
-     * coming block) (terminated with CRLF), then a block of data
-     * with the previously mentioned size. There can be any amount
-     * of chunks, and a chunk-data set to zero signals the
-     * end-of-chunks. */
-
-    result = Curl_build_unencoding_stack(data,
-                                         headp + strlen("Transfer-Encoding:"),
-                                         TRUE);
-    if(result)
-      return result;
-    if(!k->chunk && data->set.http_transfer_encoding) {
-      /* if this isn't chunked, only close can signal the end of this transfer
-         as Content-Length is said not to be trusted for transfer-encoding! */
-      connclose(conn, "HTTP/1.1 transfer-encoding without chunks");
-      k->ignore_cl = TRUE;
-    }
+     * An HTTP/1.0 reply with the 'Connection: keep-alive' line
+     * tells us the connection will be kept alive for our
+     * pleasure. Default action for 1.0 is to close.
+     *
+     * [RFC2068, section 19.7.1] */
+    connkeep(conn, "Connection keep-alive");
+    infof(data, "HTTP/1.0 connection set to keep alive");
+    return CURLE_OK;
   }
-  else if(!k->http_bodyless && checkprefix("Content-Encoding:", headp) &&
-          data->set.str[STRING_ENCODING]) {
-    /*
-     * Process Content-Encoding. Look for the values: identity,
-     * gzip, deflate, compress, x-gzip and x-compress. x-gzip and
-     * x-compress are the same as gzip and compress. (Sec 3.5 RFC
-     * 2616). zlib cannot handle compress.  However, errors are
-     * handled further down when the response body is processed
-     */
-    result = Curl_build_unencoding_stack(data,
-                                         headp + strlen("Content-Encoding:"),
-                                         FALSE);
-    if(result)
-      return result;
-  }
-  else if(checkprefix("Retry-After:", headp)) {
-    /* Retry-After = HTTP-date / delay-seconds */
-    curl_off_t retry_after = 0; /* zero for unknown or "now" */
-    /* Try it as a decimal number, if it works it is not a date */
-    (void)curlx_strtoofft(headp + strlen("Retry-After:"),
-                          NULL, 10, &retry_after);
-    if(!retry_after) {
-      time_t date = Curl_getdate_capped(headp + strlen("Retry-After:"));
-      if(-1 != date)
-        /* convert date to number of seconds into the future */
-        retry_after = date - time(NULL);
-    }
-    data->info.retry_after = retry_after; /* store it */
-  }
-  else if(!k->http_bodyless && checkprefix("Content-Range:", headp)) {
+  v = !k->http_bodyless ? HD_VAL(hd, hdlen, "Content-Range:") : NULL;
+  if(v) {
     /* Content-Range: bytes [num]-
        Content-Range: bytes: [num]-
        Content-Range: [num]-
@@ -3673,7 +3337,7 @@ CURLcode Curl_http_header(struct Curl_easy *data, struct connectdata *conn,
        The fourth means the requested range was unsatisfied.
     */
 
-    char *ptr = headp + strlen("Content-Range:");
+    const char *ptr = v;
 
     /* Move forward until first digit or asterisk */
     while(*ptr && !ISDIGIT(*ptr) && *ptr != '*')
@@ -3681,92 +3345,60 @@ CURLcode Curl_http_header(struct Curl_easy *data, struct connectdata *conn,
 
     /* if it truly stopped on a digit */
     if(ISDIGIT(*ptr)) {
-      if(!curlx_strtoofft(ptr, NULL, 10, &k->offset)) {
-        if(data->state.resume_from == k->offset)
-          /* we asked for a resume and we got it */
-          k->content_range = TRUE;
-      }
+      if(!curlx_str_number(&ptr, &k->offset, CURL_OFF_T_MAX) &&
+         (data->state.resume_from == k->offset))
+        /* we asked for a resume and we got it */
+        k->content_range = TRUE;
     }
-    else
+    else if(k->httpcode < 300)
       data->state.resume_from = 0; /* get everything */
   }
-#if !defined(CURL_DISABLE_COOKIES)
-  else if(data->cookies && data->state.cookie_engine &&
-          checkprefix("Set-Cookie:", headp)) {
-    /* If there is a custom-set Host: name, use it here, or else use real peer
-       host name. */
-    const char *host = data->state.aptr.cookiehost?
-      data->state.aptr.cookiehost:conn->host.name;
-    const bool secure_context =
-      conn->handler->protocol&(CURLPROTO_HTTPS|CURLPROTO_WSS) ||
-      strcasecompare("localhost", host) ||
-      !strcmp(host, "127.0.0.1") ||
-      !strcmp(host, "::1") ? TRUE : FALSE;
+  return CURLE_OK;
+}
 
-    Curl_share_lock(data, CURL_LOCK_DATA_COOKIE,
-                    CURL_LOCK_ACCESS_SINGLE);
-    Curl_cookie_add(data, data->cookies, TRUE, FALSE,
-                    headp + strlen("Set-Cookie:"), host,
-                    data->state.up.path, secure_context);
-    Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
-  }
-#endif
-  else if(!k->http_bodyless && checkprefix("Last-Modified:", headp) &&
-          (data->set.timecondition || data->set.get_filetime) ) {
-    k->timeofdoc = Curl_getdate_capped(headp + strlen("Last-Modified:"));
+/*
+ * http_header_l() parses a single response header starting with L.
+ */
+static CURLcode http_header_l(struct Curl_easy *data,
+                              const char *hd, size_t hdlen)
+{
+  struct connectdata *conn = data->conn;
+  struct SingleRequest *k = &data->req;
+  const char *v = (!k->http_bodyless &&
+                   (data->set.timecondition || data->set.get_filetime)) ?
+    HD_VAL(hd, hdlen, "Last-Modified:") : NULL;
+  if(v) {
+    if(Curl_getdate_capped(v, &k->timeofdoc))
+      k->timeofdoc = 0;
     if(data->set.get_filetime)
       data->info.filetime = k->timeofdoc;
+    return CURLE_OK;
   }
-  else if((checkprefix("WWW-Authenticate:", headp) &&
-           (401 == k->httpcode)) ||
-          (checkprefix("Proxy-authenticate:", headp) &&
-           (407 == k->httpcode))) {
-
-    bool proxy = (k->httpcode == 407) ? TRUE : FALSE;
-    char *auth = Curl_copy_header_value(headp);
-    if(!auth)
-      return CURLE_OUT_OF_MEMORY;
-
-    result = Curl_http_input_auth(data, proxy, auth);
-
-    free(auth);
-
-    if(result)
-      return result;
-  }
-#ifdef USE_SPNEGO
-  else if(checkprefix("Persistent-Auth:", headp)) {
-    struct negotiatedata *negdata = &conn->negotiate;
-    struct auth *authp = &data->state.authhost;
-    if(authp->picked == CURLAUTH_NEGOTIATE) {
-      char *persistentauth = Curl_copy_header_value(headp);
-      if(!persistentauth)
-        return CURLE_OUT_OF_MEMORY;
-      negdata->noauthpersist = checkprefix("false", persistentauth)?
-        TRUE:FALSE;
-      negdata->havenoauthpersist = TRUE;
-      infof(data, "Negotiate: noauthpersist -> %d, header part: %s",
-            negdata->noauthpersist, persistentauth);
-      free(persistentauth);
-    }
-  }
-#endif
-  else if((k->httpcode >= 300 && k->httpcode < 400) &&
-          checkprefix("Location:", headp) &&
-          !data->req.location) {
+  if(HD_IS(hd, hdlen, "Location:")) {
     /* this is the URL that the server advises us to use instead */
-    char *location = Curl_copy_header_value(headp);
+    char *location = Curl_copy_header_value(hd);
     if(!location)
       return CURLE_OUT_OF_MEMORY;
-    if(!*location)
-      /* ignore empty data */
-      free(location);
+    if(!*location ||
+       (data->req.location && !strcmp(data->req.location, location))) {
+      /* ignore empty header, or exact repeat of a previous one */
+      curlx_free(location);
+      return CURLE_OK;
+    }
     else {
+      /* has value and is not an exact repeat */
+      if(data->req.location) {
+        failf(data, "Multiple Location headers");
+        curlx_free(location);
+        return CURLE_WEIRD_SERVER_REPLY;
+      }
       data->req.location = location;
 
-      if(data->set.http_follow_location) {
+      if((k->httpcode >= 300 && k->httpcode < 400) &&
+         data->set.http_follow_mode) {
+        CURLcode result;
         DEBUGASSERT(!data->req.newurl);
-        data->req.newurl = strdup(data->req.location); /* clone */
+        data->req.newurl = curlx_strdup(data->req.location); /* clone */
         if(!data->req.newurl)
           return CURLE_OUT_OF_MEMORY;
 
@@ -3781,112 +3413,351 @@ CURLcode Curl_http_header(struct Curl_easy *data, struct connectdata *conn,
       }
     }
   }
+  return CURLE_OK;
+}
 
+/*
+ * http_header_p() parses a single response header starting with P.
+ */
+static CURLcode http_header_p(struct Curl_easy *data,
+                              const char *hd, size_t hdlen)
+{
+  struct SingleRequest *k = &data->req;
+
+#ifndef CURL_DISABLE_PROXY
+  const char *v = HD_VAL(hd, hdlen, "Proxy-Connection:");
+  if(v) {
+    struct connectdata *conn = data->conn;
+    if((k->httpversion == 10) && conn->http_proxy.peer &&
+       HD_IS_AND_SAYS(hd, hdlen, "Proxy-Connection:", "keep-alive")) {
+      /*
+       * When an HTTP/1.0 reply comes when using a proxy, the
+       * 'Proxy-Connection: keep-alive' line tells us the
+       * connection will be kept alive for our pleasure.
+       * Default action for 1.0 is to close.
+       */
+      connkeep(conn, "Proxy-Connection keep-alive"); /* do not close */
+      infof(data, "HTTP/1.0 proxy connection set to keep alive");
+    }
+    else if((k->httpversion == 11) && conn->http_proxy.peer &&
+            HD_IS_AND_SAYS(hd, hdlen, "Proxy-Connection:", "close")) {
+      /*
+       * We get an HTTP/1.1 response from a proxy and it says it will
+       * close down after this transfer.
+       */
+      connclose(conn, "Proxy-Connection: asked to close after done");
+      infof(data, "HTTP/1.1 proxy connection set close");
+    }
+    return CURLE_OK;
+  }
+#endif
+  if((407 == k->httpcode) && HD_IS(hd, hdlen, "Proxy-authenticate:")) {
+    char *auth = Curl_copy_header_value(hd);
+    CURLcode result = auth ? CURLE_OK : CURLE_OUT_OF_MEMORY;
+    if(!result) {
+      result = Curl_http_input_auth(data, TRUE, auth);
+      curlx_free(auth);
+    }
+    return result;
+  }
+#ifdef USE_SPNEGO
+  if(HD_IS(hd, hdlen, "Persistent-Auth:")) {
+    struct connectdata *conn = data->conn;
+    struct negotiatedata *negdata = Curl_auth_nego_get(conn, FALSE);
+    struct auth *authp = &data->state.authhost;
+    if(!negdata)
+      return CURLE_OUT_OF_MEMORY;
+    if(authp->picked == CURLAUTH_NEGOTIATE) {
+      char *persistentauth = Curl_copy_header_value(hd);
+      if(!persistentauth)
+        return CURLE_OUT_OF_MEMORY;
+      negdata->noauthpersist = !!checkprefix("false", persistentauth);
+      negdata->havenoauthpersist = TRUE;
+      infof(data, "Negotiate: noauthpersist -> %d, header part: %s",
+            negdata->noauthpersist, persistentauth);
+      curlx_free(persistentauth);
+    }
+  }
+#endif
+  return CURLE_OK;
+}
+
+/*
+ * http_header_r() parses a single response header starting with R.
+ */
+static CURLcode http_header_r(struct Curl_easy *data,
+                              const char *hd, size_t hdlen)
+{
+  const char *v = HD_VAL(hd, hdlen, "Retry-After:");
+  if(v) {
+    /* Retry-After = HTTP-date / delay-seconds */
+    curl_off_t retry_after = 0; /* zero for unknown or "now" */
+    time_t date = 0;
+    curlx_str_passblanks(&v);
+
+    /* try it as a date first, because a date can otherwise start with and
+       get treated as a number */
+    if(!Curl_getdate_capped(v, &date)) {
+      time_t current = time(NULL);
+      if(date >= current)
+        /* convert date to number of seconds into the future */
+        retry_after = date - current;
+    }
+    else
+      /* Try it as a decimal number, ignore errors */
+      (void)curlx_str_number(&v, &retry_after, CURL_OFF_T_MAX);
+    /* limit to 6 hours max. this is not documented so that it can be changed
+       in the future if necessary. */
+    if(retry_after > 21600)
+      retry_after = 21600;
+    data->info.retry_after = retry_after;
+  }
+  return CURLE_OK;
+}
+
+/*
+ * http_header_s() parses a single response header starting with S.
+ */
+static CURLcode http_header_s(struct Curl_easy *data,
+                              const char *hd, size_t hdlen)
+{
+#if !defined(CURL_DISABLE_COOKIES) || !defined(CURL_DISABLE_HSTS)
+  const char *v;
+#else
+  (void)data;
+  (void)hd;
+  (void)hdlen;
+#endif
+
+#ifndef CURL_DISABLE_COOKIES
+  v = (data->cookies && data->state.cookie_engine) ?
+    HD_VAL(hd, hdlen, "Set-Cookie:") : NULL;
+  if(v) {
+    /* If there is a custom-set Host: name, use it here, or else use
+     * real peer hostname. */
+    const char *host = data->req.cookiehost ?
+      data->req.cookiehost : data->state.origin->hostname;
+    const bool secure_context = Curl_secure_context(data, host);
+    CURLcode result;
+    Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
+    result = Curl_cookie_add(data, data->cookies, TRUE, FALSE, v, host,
+                             data->state.up.path, secure_context);
+    Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
+    return result;
+  }
+#endif
 #ifndef CURL_DISABLE_HSTS
   /* If enabled, the header is incoming and this is over HTTPS */
-  else if(data->hsts && checkprefix("Strict-Transport-Security:", headp) &&
-          ((conn->handler->flags & PROTOPT_SSL) ||
-#ifdef CURLDEBUG
-           /* allow debug builds to circumvent the HTTPS restriction */
-           getenv("CURL_HSTS_HTTP")
+  v = (data->hsts &&
+       (Curl_xfer_is_secure(data) ||
+#ifdef DEBUGBUILD
+        /* allow debug builds to circumvent the HTTPS restriction */
+        getenv("CURL_HSTS_HTTP")
 #else
-           0
+        0
 #endif
-            )) {
-    CURLcode check =
-      Curl_hsts_parse(data->hsts, conn->host.name,
-                      headp + strlen("Strict-Transport-Security:"));
-    if(check)
+         )
+    ) ? HD_VAL(hd, hdlen, "Strict-Transport-Security:") : NULL;
+  if(v) {
+    CURLcode result = Curl_hsts_parse(
+      data->hsts, data->state.origin->hostname, v);
+    if(result) {
+      if(result == CURLE_OUT_OF_MEMORY)
+        return result;
       infof(data, "Illegal STS header skipped");
+    }
 #ifdef DEBUGBUILD
     else
       infof(data, "Parsed STS header fine (%zu entries)",
-            data->hsts->list.size);
+            Curl_llist_count(&data->hsts->list));
 #endif
   }
 #endif
-#ifndef CURL_DISABLE_ALTSVC
-  /* If enabled, the header is incoming and this is over HTTPS */
-  else if(data->asi && checkprefix("Alt-Svc:", headp) &&
-          ((conn->handler->flags & PROTOPT_SSL) ||
-#ifdef CURLDEBUG
-           /* allow debug builds to circumvent the HTTPS restriction */
-           getenv("CURL_ALTSVC_HTTP")
-#else
-           0
-#endif
-            )) {
-    /* the ALPN of the current request */
-    enum alpnid id = (conn->httpversion == 30)? ALPN_h3 :
-                       (conn->httpversion == 20) ? ALPN_h2 : ALPN_h1;
-    result = Curl_altsvc_parse(data, data->asi,
-                               headp + strlen("Alt-Svc:"),
-                               id, conn->host.name,
-                               curlx_uitous((unsigned int)conn->remote_port));
+
+  return CURLE_OK;
+}
+
+/*
+ * http_header_t() parses a single response header starting with T.
+ */
+static CURLcode http_header_t(struct Curl_easy *data,
+                              const char *hd, size_t hdlen)
+{
+  struct connectdata *conn = data->conn;
+  struct SingleRequest *k = &data->req;
+
+  /* RFC 9112, ch. 6.1
+   * "Transfer-Encoding MAY be sent in a response to a HEAD request or
+   *  in a 304 (Not Modified) response (Section 15.4.5 of [HTTP]) to a
+   *  GET request, neither of which includes a message body, to indicate
+   *  that the origin server would have applied a transfer coding to the
+   *  message body if the request had been an unconditional GET."
+   *
+   * Read: in these cases the 'Transfer-Encoding' does not apply
+   * to any data following the response headers. Do not add any decoders.
+   */
+  const char *v = (!k->http_bodyless &&
+                   (data->state.httpreq != HTTPREQ_HEAD) &&
+                   (k->httpcode != 304)) ?
+    HD_VAL(hd, hdlen, "Transfer-Encoding:") : NULL;
+  if(v) {
+    /* One or more encodings. We check for chunked and/or a compression
+       algorithm. */
+    CURLcode result = Curl_build_unencoding_stack(data, v, TRUE);
     if(result)
       return result;
+    if(!k->chunk && data->set.http_transfer_encoding) {
+      /* if this is not chunked, only close can signal the end of this
+       * transfer as Content-Length is said not to be trusted for
+       * transfer-encoding! */
+      connclose(conn, "HTTP/1.1 transfer-encoding without chunks");
+      k->ignore_cl = TRUE;
+    }
+    return CURLE_OK;
   }
-#endif
-  else if(conn->handler->protocol & CURLPROTO_RTSP) {
-    result = Curl_rtsp_parseheader(data, headp);
-    if(result)
-      return result;
+  v = HD_VAL(hd, hdlen, "Trailer:");
+  if(v) {
+    data->req.resp_trailer = TRUE;
+    return CURLE_OK;
   }
   return CURLE_OK;
 }
 
+/*
+ * http_header_w() parses a single response header starting with W.
+ */
+static CURLcode http_header_w(struct Curl_easy *data,
+                              const char *hd, size_t hdlen)
+{
+  struct SingleRequest *k = &data->req;
+  CURLcode result = CURLE_OK;
+
+  if((401 == k->httpcode) && HD_IS(hd, hdlen, "WWW-Authenticate:")) {
+    char *auth = Curl_copy_header_value(hd);
+    if(!auth)
+      result = CURLE_OUT_OF_MEMORY;
+    else {
+      result = Curl_http_input_auth(data, FALSE, auth);
+      curlx_free(auth);
+    }
+  }
+  return result;
+}
+
+/*
+ * http_header() parses a single response header.
+ */
+static CURLcode http_header(struct Curl_easy *data,
+                            const char *hd, size_t hdlen)
+{
+  CURLcode result = CURLE_OK;
+
+  switch(hd[0]) {
+  case 'a':
+  case 'A':
+    result = http_header_a(data, hd, hdlen);
+    break;
+  case 'c':
+  case 'C':
+    result = http_header_c(data, hd, hdlen);
+    break;
+  case 'l':
+  case 'L':
+    result = http_header_l(data, hd, hdlen);
+    break;
+  case 'p':
+  case 'P':
+    result = http_header_p(data, hd, hdlen);
+    break;
+  case 'r':
+  case 'R':
+    result = http_header_r(data, hd, hdlen);
+    break;
+  case 's':
+  case 'S':
+    result = http_header_s(data, hd, hdlen);
+    break;
+  case 't':
+  case 'T':
+    result = http_header_t(data, hd, hdlen);
+    break;
+  case 'w':
+  case 'W':
+    result = http_header_w(data, hd, hdlen);
+    break;
+  }
+
+  if(!result) {
+    struct connectdata *conn = data->conn;
+    if(conn->scheme->protocol & CURLPROTO_RTSP)
+      result = Curl_rtsp_parseheader(data, hd);
+  }
+  return result;
+}
+
 /*
  * Called after the first HTTP response line (the status line) has been
  * received and parsed.
  */
-
-CURLcode Curl_http_statusline(struct Curl_easy *data,
-                              struct connectdata *conn)
+static CURLcode http_statusline(struct Curl_easy *data,
+                                struct connectdata *conn)
 {
   struct SingleRequest *k = &data->req;
-  data->info.httpcode = k->httpcode;
 
-  data->info.httpversion = conn->httpversion;
-  if(!data->state.httpversion ||
-     data->state.httpversion > conn->httpversion)
+  switch(k->httpversion) {
+  case 10:
+  case 11:
+#ifdef USE_HTTP2
+  case 20:
+#endif
+#ifdef USE_HTTP3
+  case 30:
+#endif
+    /* no major version switch mid-connection */
+    if(k->httpversion_sent &&
+       (k->httpversion / 10 != k->httpversion_sent / 10)) {
+      failf(data, "Version mismatch (from HTTP/%d to HTTP/%d)",
+            k->httpversion_sent / 10, k->httpversion / 10);
+      return CURLE_WEIRD_SERVER_REPLY;
+    }
+    break;
+  default:
+    failf(data, "Unsupported HTTP version (%d.%d) in response",
+          k->httpversion / 10, k->httpversion % 10);
+    return CURLE_UNSUPPORTED_PROTOCOL;
+  }
+
+  data->info.httpcode = k->httpcode;
+  data->info.httpversion = k->httpversion;
+  conn->httpversion_seen = k->httpversion;
+
+  if(!data->state.http_neg.rcvd_min ||
+     data->state.http_neg.rcvd_min > k->httpversion)
     /* store the lowest server version we encounter */
-    data->state.httpversion = conn->httpversion;
+    data->state.http_neg.rcvd_min = k->httpversion;
 
   /*
-   * This code executes as part of processing the header.  As a
-   * result, it's not totally clear how to interpret the
+   * This code executes as part of processing the header. As a
+   * result, it is not totally clear how to interpret the
    * response code yet as that depends on what other headers may
-   * be present.  401 and 407 may be errors, but may be OK
-   * depending on how authentication is working.  Other codes
+   * be present. 401 and 407 may be errors, but may be OK
+   * depending on how authentication is working. Other codes
    * are definitely errors, so give up here.
    */
   if(data->state.resume_from && data->state.httpreq == HTTPREQ_GET &&
      k->httpcode == 416) {
-    /* "Requested Range Not Satisfiable", just proceed and
-       pretend this is no error */
+    /* "Requested Range Not Satisfiable", proceed and pretend this is no
+       error */
     k->ignorebody = TRUE; /* Avoid appending error msg to good data. */
   }
 
-  if(conn->httpversion == 10) {
+  if(k->httpversion == 10) {
     /* Default action for HTTP/1.0 must be to close, unless
        we get one of those fancy headers that tell us the
        server keeps it open for us! */
     infof(data, "HTTP 1.0, assume close after body");
     connclose(conn, "HTTP/1.0 close after body");
   }
-  else if(conn->httpversion == 20 ||
-          (k->upgr101 == UPGR101_H2 && k->httpcode == 101)) {
-    DEBUGF(infof(data, "HTTP/2 found, allow multiplexing"));
-    /* HTTP/2 cannot avoid multiplexing since it is a core functionality
-       of the protocol */
-    conn->bundle->multiuse = BUNDLE_MULTIPLEX;
-  }
-  else if(conn->httpversion >= 11 &&
-          !conn->bits.close) {
-    /* If HTTP version is >= 1.1 and connection is persistent */
-    DEBUGF(infof(data,
-                 "HTTP 1.1 or later with persistent connection"));
-  }
 
   k->http_bodyless = k->httpcode >= 100 && k->httpcode < 200;
   switch(k->httpcode) {
@@ -3894,10 +3765,10 @@ CURLcode Curl_http_statusline(struct Curl_easy *data,
     /* (quote from RFC2616, section 10.3.5): The 304 response
      * MUST NOT contain a message-body, and thus is always
      * terminated by the first empty line after the header
-     * fields.  */
+     * fields. */
     if(data->set.timecondition)
       data->info.timecond = TRUE;
-    /* FALLTHROUGH */
+    FALLTHROUGH();
   case 204:
     /* (quote from RFC2616, section 10.2.5): The server has
      * fulfilled the request but does not need to return an
@@ -3915,11 +3786,11 @@ CURLcode Curl_http_statusline(struct Curl_easy *data,
 }
 
 /* Content-Length must be ignored if any Transfer-Encoding is present in the
-   response. Refer to RFC 7230 section 3.3.3 and RFC2616 section 4.4.  This is
+   response. Refer to RFC 7230 section 3.3.3 and RFC2616 section 4.4. This is
    figured out here after all headers have been received but before the final
    call to the user's header callback, so that a valid content length can be
    retrieved by the user in the final call. */
-CURLcode Curl_http_size(struct Curl_easy *data)
+static CURLcode http_size(struct Curl_easy *data)
 {
   struct SingleRequest *k = &data->req;
   if(data->req.ignore_cl || k->chunk) {
@@ -3927,35 +3798,45 @@ CURLcode Curl_http_size(struct Curl_easy *data)
   }
   else if(k->size != -1) {
     if(data->set.max_filesize &&
-       k->size > data->set.max_filesize) {
+       !k->ignorebody &&
+       (k->size > data->set.max_filesize)) {
       failf(data, "Maximum file size exceeded");
       return CURLE_FILESIZE_EXCEEDED;
     }
+    if(k->ignorebody)
+      infof(data, "setting size while ignoring");
     Curl_pgrsSetDownloadSize(data, k->size);
     k->maxdownload = k->size;
   }
   return CURLE_OK;
 }
 
-static CURLcode verify_header(struct Curl_easy *data)
+CURLcode Curl_verify_header(struct Curl_easy *data,
+                            const char *hd, size_t hdlen)
 {
   struct SingleRequest *k = &data->req;
-  const char *header = Curl_dyn_ptr(&data->state.headerb);
-  size_t hlen = Curl_dyn_len(&data->state.headerb);
-  char *ptr = memchr(header, 0x00, hlen);
+  const char *ptr = memchr(hd, 0x00, hdlen);
   if(ptr) {
     /* this is bad, bail out */
     failf(data, "Nul byte in header");
     return CURLE_WEIRD_SERVER_REPLY;
   }
+  if(hdlen > 2) {
+    ptr = memchr(hd, '\r', hdlen - 2);
+    if(ptr) {
+      /* CR may only precede the LF, nothing else */
+      failf(data, "Carriage return found in header");
+      return CURLE_WEIRD_SERVER_REPLY;
+    }
+  }
   if(k->headerline < 2)
     /* the first "header" is the status-line and it has no colon */
     return CURLE_OK;
-  if(((header[0] == ' ') || (header[0] == '\t')) && k->headerline > 2)
-    /* line folding, can't happen on line 2 */
+  if(((hd[0] == ' ') || (hd[0] == '\t')) && k->headerline > 2)
+    /* line folding, cannot happen on line 2 */
     ;
   else {
-    ptr = memchr(header, ':', hlen);
+    ptr = memchr(hd, ':', hdlen);
     if(!ptr) {
       /* this is bad, bail out */
       failf(data, "Header without colon");
@@ -3970,628 +3851,811 @@ CURLcode Curl_bump_headersize(struct Curl_easy *data,
                               bool connect_only)
 {
   size_t bad = 0;
+  unsigned int max = MAX_HTTP_RESP_HEADER_SIZE;
   if(delta < MAX_HTTP_RESP_HEADER_SIZE) {
+    data->info.header_size += (unsigned int)delta;
+    data->req.allheadercount += (unsigned int)delta;
     if(!connect_only)
       data->req.headerbytecount += (unsigned int)delta;
-    data->info.header_size += (unsigned int)delta;
-    if(data->info.header_size > MAX_HTTP_RESP_HEADER_SIZE)
+    if(data->req.allheadercount > max)
+      bad = data->req.allheadercount;
+    else if(data->info.header_size > (max * 20)) {
       bad = data->info.header_size;
+      max *= 20;
+    }
   }
   else
-    bad = data->info.header_size + delta;
+    bad = data->req.allheadercount + delta;
   if(bad) {
-    failf(data, "Too large response headers: %zu > %u",
-          bad, MAX_HTTP_RESP_HEADER_SIZE);
+    failf(data, "Too large response headers: %zu > %u", bad, max);
     return CURLE_RECV_ERROR;
   }
   return CURLE_OK;
 }
 
+/*
+ * Handle a 101 Switching Protocols response. Performs the actual protocol
+ * upgrade to HTTP/2 or WebSocket based on what was requested.
+ */
+static CURLcode http_on_101_upgrade(struct Curl_easy *data,
+                                    const char *buf, size_t blen,
+                                    size_t *pconsumed,
+                                    bool *conn_changed)
+{
+  struct connectdata *conn = data->conn;
+  struct SingleRequest *k = &data->req;
+
+#if !defined(USE_NGHTTP2) && defined(CURL_DISABLE_WEBSOCKETS)
+  (void)buf;
+  (void)blen;
+  (void)pconsumed;
+#else
+  CURLcode result;
+  int upgr101_requested = k->upgr101;
+#endif
+
+  if(k->httpversion_sent != 11) {
+    /* invalid for other HTTP versions */
+    failf(data, "server sent 101 response while not talking HTTP/1.1");
+    return CURLE_WEIRD_SERVER_REPLY;
+  }
+
+  /* Whatever the success, upgrade was selected. */
+  k->upgr101 = UPGR101_RECEIVED;
+  conn->bits.upgrade_in_progress = FALSE;
+  *conn_changed = TRUE;
+
+  /* To be fully compliant, we would check the "Upgrade:" response header to
+   * mention the protocol we requested. */
+#ifdef USE_NGHTTP2
+  if(upgr101_requested == UPGR101_H2) {
+    /* Switch to HTTP/2, where we will get more responses. blen bytes in buf
+     * are already h2 protocol bytes */
+    infof(data, "Received 101, Switching to HTTP/2");
+    result = Curl_http2_upgrade(data, conn, FIRSTSOCKET, buf, blen);
+    if(!result)
+      *pconsumed += blen;
+    return result;
+  }
+#endif
+#ifndef CURL_DISABLE_WEBSOCKETS
+  if(upgr101_requested == UPGR101_WS) {
+    /* Switch to WebSocket, where we now stream ws frames. blen bytes in buf
+     * are already ws protocol bytes */
+    infof(data, "Received 101, Switching to WebSocket");
+    result = Curl_ws_accept(data, buf, blen);
+    if(!result)
+      *pconsumed += blen; /* ws accept handled the data */
+    return result;
+  }
+#endif
+  /* We silently accept this as the final response. What are we switching to
+   * if we did not ask for an Upgrade? Maybe the application provided an
+   * `Upgrade: xxx` header? */
+  k->header = FALSE;
+  return CURLE_OK;
+}
+
+/*
+ * Handle 1xx intermediate HTTP responses. Sets up state for more
+ * headers and processes 100-continue and 101 upgrade responses.
+ */
+static CURLcode http_on_1xx_response(struct Curl_easy *data,
+                                     const char *buf, size_t blen,
+                                     size_t *pconsumed,
+                                     bool *conn_changed)
+{
+  struct SingleRequest *k = &data->req;
+
+  /* "A user agent MAY ignore unexpected 1xx status responses."
+   * By default, we expect to get more responses after this one. */
+  k->header = TRUE;
+  k->headerline = 0; /* restart the header line counter */
+
+  switch(k->httpcode) {
+  case 100:
+    /* We have made an HTTP PUT or POST and this is 1.1-lingo that tells us
+     * that the server is OK with this and ready to receive the data. */
+    http_exp100_got100(data);
+    break;
+  case 101:
+    return http_on_101_upgrade(data, buf, blen, pconsumed, conn_changed);
+  default:
+    /* The server may send us other 1xx responses, like informative 103. This
+     * has no influence on request processing and we expect to receive a
+     * final response eventually. */
+    break;
+  }
+  return CURLE_OK;
+}
+
+#if defined(USE_NTLM) || defined(USE_SPNEGO)
+/*
+ * Check if NTLM or SPNEGO authentication negotiation failed due to
+ * connection closure (typically on HTTP/1.0 servers).
+ */
+static void http_check_auth_closure(struct Curl_easy *data,
+                                    struct connectdata *conn)
+{
+  /* At this point we have some idea about the fate of the connection. If we
+     are closing the connection it may result auth failure. */
+#ifdef USE_NTLM
+  if(conn->bits.close &&
+     (((data->req.httpcode == 401) &&
+       (conn->http_ntlm_state == NTLMSTATE_TYPE2)) ||
+      ((data->req.httpcode == 407) &&
+       (conn->proxy_ntlm_state == NTLMSTATE_TYPE2)))) {
+    infof(data, "Connection closure while negotiating auth (HTTP 1.0?)");
+    data->state.authproblem = TRUE;
+  }
+#endif
+#ifdef USE_SPNEGO
+  if(conn->bits.close &&
+    (((data->req.httpcode == 401) &&
+      (conn->http_negotiate_state == GSS_AUTHRECV)) ||
+     ((data->req.httpcode == 407) &&
+      (conn->proxy_negotiate_state == GSS_AUTHRECV)))) {
+    infof(data, "Connection closure while negotiating auth (HTTP 1.0?)");
+    data->state.authproblem = TRUE;
+  }
+  if((conn->http_negotiate_state == GSS_AUTHDONE) &&
+     (data->req.httpcode != 401)) {
+    conn->http_negotiate_state = GSS_AUTHSUCC;
+  }
+  if((conn->proxy_negotiate_state == GSS_AUTHDONE) &&
+     (data->req.httpcode != 407)) {
+    conn->proxy_negotiate_state = GSS_AUTHSUCC;
+  }
+#endif
+}
+#else
+#define http_check_auth_closure(x, y) /* empty */
+#endif
+
+/*
+ * Handle an error response (>= 300) received while still sending the
+ * request body. Deals with 417 Expectation Failed retries, keep-sending
+ * on error, and aborting the send.
+ */
+static CURLcode http_handle_send_error(struct Curl_easy *data)
+{
+  struct connectdata *conn = data->conn;
+  struct SingleRequest *k = &data->req;
+  CURLcode result = CURLE_OK;
+
+  if(!data->req.authneg && !conn->bits.close &&
+     !Curl_creader_will_rewind(data)) {
+    /*
+     * General treatment of errors when about to send data.
+     * Including: "417 Expectation Failed", while waiting for
+     * 100-continue.
+     *
+     * The check for close above is done because if something
+     * else has already deemed the connection to get closed then
+     * something else should have considered the big picture and
+     * we avoid this check.
+     */
+
+    switch(data->state.httpreq) {
+    case HTTPREQ_PUT:
+    case HTTPREQ_POST:
+    case HTTPREQ_POST_FORM:
+    case HTTPREQ_POST_MIME:
+      /* We got an error response. If this happened before the
+       * whole request body has been sent we stop sending and
+       * mark the connection for closure after we have read the
+       * entire response. */
+      if(!Curl_req_done_sending(data)) {
+        if((k->httpcode == 417) && http_exp100_is_selected(data)) {
+          /* 417 Expectation Failed - try again without the
+             Expect header */
+          if(!k->writebytecount && http_exp100_is_waiting(data)) {
+            infof(data, "Got HTTP failure 417 while waiting for a 100");
+          }
+          else {
+            infof(data, "Got HTTP failure 417 while sending data");
+            streamclose(conn, "Stop sending data before everything sent");
+            result = http_perhapsrewind(data, conn);
+            if(result)
+              return result;
+          }
+          data->state.disableexpect = TRUE;
+          Curl_req_abort_sending(data);
+          DEBUGASSERT(!data->req.newurl);
+          data->req.newurl = Curl_bufref_dup(&data->state.url);
+          if(!data->req.newurl)
+            return CURLE_OUT_OF_MEMORY;
+        }
+        else if(data->set.http_keep_sending_on_error) {
+          infof(data, "HTTP error before end of send, keep sending");
+          http_exp100_send_anyway(data);
+        }
+        else {
+          infof(data, "HTTP error before end of send, stop sending");
+          streamclose(conn, "Stop sending data before everything sent");
+          result = Curl_req_abort_sending(data);
+          if(result)
+            return result;
+        }
+      }
+      break;
+
+    default: /* default label present to avoid compiler warnings */
+      break;
+    }
+  }
+
+  if(Curl_creader_will_rewind(data) && !Curl_req_done_sending(data)) {
+    /* We rewind before next send, continue sending now */
+    infof(data, "Keep sending data to get tossed away");
+    CURL_REQ_SET_SEND(data);
+  }
+  return result;
+}
+
+static CURLcode http_on_response(struct Curl_easy *data,
+                                 const char *last_hd, size_t last_hd_len,
+                                 const char *buf, size_t blen,
+                                 size_t *pconsumed)
+{
+  struct connectdata *conn = data->conn;
+  CURLcode result = CURLE_OK;
+  struct SingleRequest *k = &data->req;
+  bool conn_changed = FALSE;
+
+  (void)buf; /* not used without HTTP2 enabled */
+  *pconsumed = 0;
+
+  if(k->upgr101 == UPGR101_RECEIVED) {
+    /* supposedly upgraded to http2 now */
+    if(data->req.httpversion != 20)
+      infof(data, "Lying server, not serving HTTP/2");
+  }
+
+  if(k->httpcode < 200 && last_hd) {
+    /* Intermediate responses might trigger processing of more responses,
+     * write the last header to the client before proceeding. */
+    result = http_write_header(data, last_hd, last_hd_len);
+    last_hd = NULL; /* handled it */
+    if(result)
+      goto out;
+  }
+
+  if(k->httpcode < 100) {
+    failf(data, "Unsupported response code in HTTP response");
+    result = CURLE_UNSUPPORTED_PROTOCOL;
+    goto out;
+  }
+  else if(k->httpcode < 200) {
+    result = http_on_1xx_response(data, buf, blen, pconsumed, &conn_changed);
+    goto out;
+  }
+
+  /* k->httpcode >= 200, final response */
+  k->header = FALSE;
+  if(conn->bits.upgrade_in_progress) {
+    /* Asked for protocol upgrade, but it was not selected */
+    conn->bits.upgrade_in_progress = FALSE;
+    conn_changed = TRUE;
+  }
+
+  if((k->size == -1) && !k->chunk && !conn->bits.close &&
+     (k->httpversion == 11) &&
+     !(conn->scheme->protocol & CURLPROTO_RTSP) &&
+     data->state.httpreq != HTTPREQ_HEAD) {
+    /* On HTTP 1.1, when connection is not to get closed, but no
+       Content-Length nor Transfer-Encoding chunked have been received,
+       according to RFC2616 section 4.4 point 5, we assume that the server
+       will close the connection to signal the end of the document. */
+    infof(data, "no chunk, no close, no size. Assume close to signal end");
+    streamclose(conn, "HTTP: No end-of-message indicator");
+  }
+
+  http_check_auth_closure(data, conn);
+
+#ifndef CURL_DISABLE_WEBSOCKETS
+  /* All >=200 HTTP status codes are errors when wanting ws */
+  if(data->req.upgr101 == UPGR101_WS) {
+    failf(data, "Refused WebSocket upgrade: %d", k->httpcode);
+    result = CURLE_HTTP_RETURNED_ERROR;
+    goto out;
+  }
+#endif
+
+  /* Check if this response means the transfer errored. */
+  if(http_should_fail(data, data->req.httpcode)) {
+    failf(data, "The requested URL returned error: %d",
+          k->httpcode);
+    result = CURLE_HTTP_RETURNED_ERROR;
+    goto out;
+  }
+
+  /* Curl_http_auth_act() checks what authentication methods that are
+   * available and decides which one (if any) to use. It will set 'newurl' if
+   * an auth method was picked. */
+  result = Curl_http_auth_act(data);
+  if(result)
+    goto out;
+
+  if(k->httpcode >= 300) {
+    result = http_handle_send_error(data);
+    if(result)
+      goto out;
+  }
+
+  /* final response without error, prepare to receive the body */
+  result = http_firstwrite(data);
+  if(result)
+    goto out;
+
+  /* This is the last response that we get for the current request. Check on
+   * the body size and determine if the response is complete. */
+  result = http_size(data);
+  if(result)
+    goto out;
+
+  /* If we requested a "no body", this is a good time to get
+   * out and return home.
+   */
+  if(data->req.no_body)
+    k->download_done = TRUE;
+
+  /* If max download size is *zero* (nothing) we already have nothing and can
+     safely return ok now! For HTTP/2, we would like to call
+     http2_handle_stream_close to properly close a stream. In order to do
+     this, we keep reading until we close the stream. */
+  if((k->maxdownload == 0) && (k->httpversion_sent < 20))
+    k->download_done = TRUE;
+
+out:
+  if(last_hd)
+    /* if not written yet, write it now */
+    result = Curl_1st_fatal(result,
+                            http_write_header(data, last_hd, last_hd_len));
+  if(conn_changed)
+    /* poke the multi handle to allow pending pipewait to retry */
+    Curl_multi_connchanged(data->multi);
+  return result;
+}
+
+static CURLcode http_rw_hd(struct Curl_easy *data,
+                           const char *hd, size_t hdlen,
+                           const char *buf_remain, size_t blen,
+                           size_t *pconsumed)
+{
+  CURLcode result = CURLE_OK;
+  struct SingleRequest *k = &data->req;
+  int writetype;
+  DEBUGASSERT(!hd[hdlen]); /* null-terminated */
+
+  *pconsumed = 0;
+  if((0x0a == *hd) || (0x0d == *hd)) {
+    /* Empty header line means end of headers! */
+    struct dynbuf last_header;
+    size_t consumed;
+
+    curlx_dyn_init(&last_header, hdlen + 1);
+    result = curlx_dyn_addn(&last_header, hd, hdlen);
+    if(result)
+      return result;
+
+    /* analyze the response to find out what to do. */
+    /* Caveat: we clear anything in the header brigade, because a
+     * response might switch HTTP version which may call use recursively.
+     * Not nice, but that is currently the way of things. */
+    curlx_dyn_reset(&data->state.headerb);
+    result = http_on_response(data, curlx_dyn_ptr(&last_header),
+                              curlx_dyn_len(&last_header),
+                              buf_remain, blen, &consumed);
+    *pconsumed += consumed;
+    curlx_dyn_free(&last_header);
+    return result;
+  }
+
+  /*
+   * Checks for special headers coming up.
+   */
+
+  writetype = CLIENTWRITE_HEADER;
+  if(!k->headerline++) {
+    /* This is the first header, it MUST be the error code line
+       or else we consider this to be the body right away! */
+    bool fine_statusline = FALSE;
+
+    k->httpversion = 0; /* Do not know yet */
+    if(data->conn->scheme->protocol & PROTO_FAMILY_HTTP) {
+      /*
+       * https://datatracker.ietf.org/doc/html/rfc7230#section-3.1.2
+       *
+       * The response code is always a three-digit number in HTTP as the spec
+       * says. We allow any three-digit number here, but we cannot make
+       * guarantees on future behaviors since it is not within the protocol.
+       */
+      const char *p = hd;
+
+      curlx_str_passblanks(&p);
+      if(!strncmp(p, "HTTP/", 5)) {
+        p += 5;
+        switch(*p) {
+        case '1':
+          p++;
+          if((p[0] == '.') && (p[1] == '0' || p[1] == '1')) {
+            if(ISBLANK(p[2])) {
+              k->httpversion = (unsigned char)(10 + (p[1] - '0'));
+              p += 3;
+              if(ISDIGIT(p[0]) && ISDIGIT(p[1]) && ISDIGIT(p[2])) {
+                k->httpcode = ((p[0] - '0') * 100) + ((p[1] - '0') * 10) +
+                  (p[2] - '0');
+                /* RFC 9112 requires a single space following the status code,
+                   but the browsers do not so let's not insist */
+                fine_statusline = TRUE;
+              }
+            }
+          }
+          if(!fine_statusline) {
+            failf(data, "Unsupported HTTP/1 subversion in response");
+            return CURLE_UNSUPPORTED_PROTOCOL;
+          }
+          break;
+        case '2':
+        case '3':
+          if(!ISBLANK(p[1]))
+            break;
+          k->httpversion = (unsigned char)((*p - '0') * 10);
+          p += 2;
+          if(ISDIGIT(p[0]) && ISDIGIT(p[1]) && ISDIGIT(p[2])) {
+            k->httpcode = ((p[0] - '0') * 100) + ((p[1] - '0') * 10) +
+              (p[2] - '0');
+            p += 3;
+            if(!ISBLANK(*p))
+              break;
+            fine_statusline = TRUE;
+          }
+          break;
+        default: /* unsupported */
+          failf(data, "Unsupported HTTP version in response");
+          return CURLE_UNSUPPORTED_PROTOCOL;
+        }
+      }
+
+      if(!fine_statusline) {
+        /* If user has set option HTTP200ALIASES,
+           compare header line against list of aliases
+        */
+        statusline check = checkhttpprefix(data, hd, hdlen);
+        if(check == STATUS_DONE) {
+          fine_statusline = TRUE;
+          k->httpcode = 200;
+          k->httpversion = 10;
+        }
+      }
+    }
+    else if(data->conn->scheme->protocol & CURLPROTO_RTSP) {
+      const char *p = hd;
+      struct Curl_str ver;
+      curl_off_t status;
+      /* we set the max string a little excessive to forgive some leading
+         spaces */
+      if(!curlx_str_until(&p, &ver, 32, ' ') &&
+         !curlx_str_single(&p, ' ') &&
+         !curlx_str_number(&p, &status, 999)) {
+        curlx_str_trimblanks(&ver);
+        if(curlx_str_cmp(&ver, "RTSP/1.0")) {
+          k->httpcode = (int)status;
+          fine_statusline = TRUE;
+          k->httpversion = 11; /* RTSP acts like HTTP 1.1 */
+        }
+      }
+      if(!fine_statusline)
+        return CURLE_WEIRD_SERVER_REPLY;
+    }
+
+    if(fine_statusline) {
+      result = http_statusline(data, data->conn);
+      if(result)
+        return result;
+      writetype |= CLIENTWRITE_STATUS;
+    }
+    else {
+      k->header = FALSE;   /* this is not a header line */
+      return CURLE_WEIRD_SERVER_REPLY;
+    }
+  }
+
+  result = Curl_verify_header(data, hd, hdlen);
+  if(result)
+    return result;
+
+  result = http_header(data, hd, hdlen);
+  if(result)
+    return result;
+
+  /*
+   * Taken in one (more) header. Write it to the client.
+   */
+  Curl_debug(data, CURLINFO_HEADER_IN, hd, hdlen);
+
+  if(k->httpcode / 100 == 1)
+    writetype |= CLIENTWRITE_1XX;
+  result = Curl_client_write(data, writetype, hd, hdlen);
+  if(result)
+    return result;
+
+  result = Curl_bump_headersize(data, hdlen, FALSE);
+  if(result)
+    return result;
+
+  return CURLE_OK;
+}
+
+/* remove trailing CRLF then all trailing whitespace */
+void Curl_http_to_fold(struct dynbuf *bf)
+{
+  size_t len = curlx_dyn_len(bf);
+  const char *hd = curlx_dyn_ptr(bf);
+  if(len && (hd[len - 1] == '\n'))
+    len--;
+  if(len && (hd[len - 1] == '\r'))
+    len--;
+  while(len && ISBLANK(hd[len - 1])) /* strip off trailing whitespace */
+    len--;
+  curlx_dyn_setlen(bf, len);
+}
+
+static void unfold_header(struct Curl_easy *data)
+{
+  Curl_http_to_fold(&data->state.headerb);
+  data->state.leading_unfold = TRUE;
+}
 
 /*
  * Read any HTTP header lines from the server and pass them to the client app.
  */
-CURLcode Curl_http_readwrite_headers(struct Curl_easy *data,
-                                     struct connectdata *conn,
-                                     ssize_t *nread,
-                                     bool *stop_reading)
+static CURLcode http_parse_headers(struct Curl_easy *data,
+                                   const char *buf, size_t blen,
+                                   size_t *pconsumed)
 {
-  CURLcode result;
+  struct connectdata *conn = data->conn;
+  CURLcode result = CURLE_OK;
   struct SingleRequest *k = &data->req;
-  ssize_t onread = *nread;
-  char *ostr = k->str;
-  char *headp;
-  char *str_start;
-  char *end_ptr;
+  const char *end_ptr;
+  bool leftover_body = FALSE;
+
+  /* we have bytes for the next header, make sure it is not a folded header
+     before passing it on */
+  if(data->state.maybe_folded && blen) {
+    if(ISBLANK(buf[0])) {
+      /* folded, remove the trailing newlines and append the next header */
+      unfold_header(data);
+    }
+    else {
+      /* the header data we hold is a complete header, pass it on */
+      size_t ignore_this;
+      result = http_rw_hd(data, curlx_dyn_ptr(&data->state.headerb),
+                          curlx_dyn_len(&data->state.headerb),
+                          NULL, 0, &ignore_this);
+      curlx_dyn_reset(&data->state.headerb);
+      if(result)
+        return result;
+    }
+    data->state.maybe_folded = FALSE;
+  }
 
   /* header line within buffer loop */
-  do {
-    size_t rest_length;
-    size_t full_length;
-    int writetype;
+  *pconsumed = 0;
+  while(blen && k->header) {
+    size_t consumed;
+    size_t hlen;
+    const char *hd;
+    size_t unfold_len = 0;
 
-    /* str_start is start of line within buf */
-    str_start = k->str;
-
-    /* data is in network encoding so use 0x0a instead of '\n' */
-    end_ptr = memchr(str_start, 0x0a, *nread);
+    if(data->state.leading_unfold) {
+      /* immediately after an unfold, keep only a single whitespace */
+      while(blen && ISBLANK(buf[0])) {
+        buf++;
+        blen--;
+        unfold_len++;
+      }
+      if(blen) {
+        /* insert a single space */
+        result = curlx_dyn_addn(&data->state.headerb, " ", 1);
+        if(result)
+          return result;
+        data->state.leading_unfold = FALSE; /* done now */
+      }
+    }
 
+    end_ptr = memchr(buf, '\n', blen);
     if(!end_ptr) {
       /* Not a complete header line within buffer, append the data to
          the end of the headerbuff. */
-      result = Curl_dyn_addn(&data->state.headerb, str_start, *nread);
+      result = curlx_dyn_addn(&data->state.headerb, buf, blen);
       if(result)
         return result;
+      *pconsumed += blen + unfold_len;
 
       if(!k->headerline) {
         /* check if this looks like a protocol header */
         statusline st =
           checkprotoprefix(data, conn,
-                           Curl_dyn_ptr(&data->state.headerb),
-                           Curl_dyn_len(&data->state.headerb));
+                           curlx_dyn_ptr(&data->state.headerb),
+                           curlx_dyn_len(&data->state.headerb));
 
         if(st == STATUS_BAD) {
-          /* this is not the beginning of a protocol first header line */
+          /* this is not the beginning of a protocol first header line.
+           * Cannot be 0.9 if version was detected or connection was reused. */
           k->header = FALSE;
-          k->badheader = HEADER_ALLBAD;
           streamclose(conn, "bad HTTP: No end-of-message indicator");
-          if(!data->set.http09_allowed) {
+          if((k->httpversion >= 10) || conn->bits.reuse) {
+            failf(data, "Invalid status line");
+            return CURLE_WEIRD_SERVER_REPLY;
+          }
+          if(!data->state.http_neg.accept_09) {
             failf(data, "Received HTTP/0.9 when not allowed");
             return CURLE_UNSUPPORTED_PROTOCOL;
           }
-          break;
+          leftover_body = TRUE;
+          goto out;
         }
       }
-
-      break; /* read more and try again */
+      goto out; /* read more and try again */
     }
 
-    /* decrease the size of the remaining (supposed) header line */
-    rest_length = (end_ptr - k->str) + 1;
-    *nread -= (ssize_t)rest_length;
+    /* the size of the remaining header line */
+    consumed = (end_ptr - buf) + 1;
 
-    k->str = end_ptr + 1; /* move past new line */
-
-    full_length = k->str - str_start;
-
-    result = Curl_dyn_addn(&data->state.headerb, str_start, full_length);
+    result = curlx_dyn_addn(&data->state.headerb, buf, consumed);
     if(result)
       return result;
+    blen -= consumed;
+    buf += consumed;
+    *pconsumed += consumed + unfold_len;
 
     /****
      * We now have a FULL header line in 'headerb'.
      *****/
 
+    hlen = curlx_dyn_len(&data->state.headerb);
+    hd = curlx_dyn_ptr(&data->state.headerb);
+
     if(!k->headerline) {
-      /* the first read header */
-      statusline st = checkprotoprefix(data, conn,
-                                       Curl_dyn_ptr(&data->state.headerb),
-                                       Curl_dyn_len(&data->state.headerb));
+      /* the first read "header", the status line */
+      statusline st = checkprotoprefix(data, conn, hd, hlen);
       if(st == STATUS_BAD) {
         streamclose(conn, "bad HTTP: No end-of-message indicator");
-        /* this is not the beginning of a protocol first header line */
-        if(!data->set.http09_allowed) {
+        /* this is not the beginning of a protocol first header line.
+         * Cannot be 0.9 if version was detected or connection was reused. */
+        if((k->httpversion >= 10) || conn->bits.reuse) {
+          failf(data, "Invalid status line");
+          return CURLE_WEIRD_SERVER_REPLY;
+        }
+        if(!data->state.http_neg.accept_09) {
           failf(data, "Received HTTP/0.9 when not allowed");
           return CURLE_UNSUPPORTED_PROTOCOL;
         }
         k->header = FALSE;
-        if(*nread)
-          /* since there's more, this is a partial bad header */
-          k->badheader = HEADER_PARTHEADER;
-        else {
-          /* this was all we read so it's all a bad header */
-          k->badheader = HEADER_ALLBAD;
-          *nread = onread;
-          k->str = ostr;
-          return CURLE_OK;
-        }
-        break;
+        leftover_body = TRUE;
+        goto out;
       }
     }
+    else {
+      if(hlen && !ISNEWLINE(hd[0])) {
+        /* this is NOT the header separator */
 
-    /* headers are in network encoding so use 0x0a and 0x0d instead of '\n'
-       and '\r' */
-    headp = Curl_dyn_ptr(&data->state.headerb);
-    if((0x0a == *headp) || (0x0d == *headp)) {
-      size_t headerlen;
-      /* Zero-length header line means end of headers! */
-
-      if('\r' == *headp)
-        headp++; /* pass the \r byte */
-      if('\n' == *headp)
-        headp++; /* pass the \n byte */
-
-      if(100 <= k->httpcode && 199 >= k->httpcode) {
-        /* "A user agent MAY ignore unexpected 1xx status responses." */
-        switch(k->httpcode) {
-        case 100:
-          /*
-           * We have made an HTTP PUT or POST and this is 1.1-lingo
-           * that tells us that the server is OK with this and ready
-           * to receive the data.
-           * However, we'll get more headers now so we must get
-           * back into the header-parsing state!
-           */
-          k->header = TRUE;
-          k->headerline = 0; /* restart the header line counter */
-
-          /* if we did wait for this do enable write now! */
-          if(k->exp100 > EXP100_SEND_DATA) {
-            k->exp100 = EXP100_SEND_DATA;
-            k->keepon |= KEEP_SEND;
-            Curl_expire_done(data, EXPIRE_100_TIMEOUT);
-          }
-          break;
-        case 101:
-          /* Switching Protocols */
-          if(k->upgr101 == UPGR101_H2) {
-            /* Switching to HTTP/2 */
-            DEBUGASSERT(conn->httpversion < 20);
-            infof(data, "Received 101, Switching to HTTP/2");
-            k->upgr101 = UPGR101_RECEIVED;
-
-            /* we'll get more headers (HTTP/2 response) */
-            k->header = TRUE;
-            k->headerline = 0; /* restart the header line counter */
-
-            /* switch to http2 now. The bytes after response headers
-               are also processed here, otherwise they are lost. */
-            result = Curl_http2_upgrade(data, conn, FIRSTSOCKET,
-                                        k->str, *nread);
-            if(result)
-              return result;
-            *nread = 0;
-          }
-#ifdef USE_WEBSOCKETS
-          else if(k->upgr101 == UPGR101_WS) {
-            /* verify the response */
-            result = Curl_ws_accept(data, k->str, *nread);
-            if(result)
-              return result;
-            k->header = FALSE; /* no more header to parse! */
-            if(data->set.connect_only) {
-              k->keepon &= ~KEEP_RECV; /* read no more content */
-              *nread = 0;
-            }
-          }
-#endif
-          else {
-            /* Not switching to another protocol */
-            k->header = FALSE; /* no more header to parse! */
-          }
-          break;
-        default:
-          /* the status code 1xx indicates a provisional response, so
-             we'll get another set of headers */
-          k->header = TRUE;
-          k->headerline = 0; /* restart the header line counter */
+        /* if we have bytes for the next header, check for folding */
+        if(blen && ISBLANK(buf[0])) {
+          /* remove the trailing CRLF and append the next header */
+          unfold_header(data);
+          continue;
+        }
+        else if(!blen) {
+          /* this might be a folded header so deal with it in next invoke */
+          data->state.maybe_folded = TRUE;
           break;
         }
       }
-      else {
-        if(k->upgr101 == UPGR101_H2) {
-          /* A requested upgrade was denied, poke the multi handle to possibly
-             allow a pending pipewait to continue */
-          Curl_multi_connchanged(data->multi);
-        }
-        k->header = FALSE; /* no more header to parse! */
-
-        if((k->size == -1) && !k->chunk && !conn->bits.close &&
-           (conn->httpversion == 11) &&
-           !(conn->handler->protocol & CURLPROTO_RTSP) &&
-           data->state.httpreq != HTTPREQ_HEAD) {
-          /* On HTTP 1.1, when connection is not to get closed, but no
-             Content-Length nor Transfer-Encoding chunked have been
-             received, according to RFC2616 section 4.4 point 5, we
-             assume that the server will close the connection to
-             signal the end of the document. */
-          infof(data, "no chunk, no close, no size. Assume close to "
-                "signal end");
-          streamclose(conn, "HTTP: No end-of-message indicator");
-        }
-      }
-
-      if(!k->header) {
-        result = Curl_http_size(data);
-        if(result)
-          return result;
-      }
-
-      /* At this point we have some idea about the fate of the connection.
-         If we are closing the connection it may result auth failure. */
-#if defined(USE_NTLM)
-      if(conn->bits.close &&
-         (((data->req.httpcode == 401) &&
-           (conn->http_ntlm_state == NTLMSTATE_TYPE2)) ||
-          ((data->req.httpcode == 407) &&
-           (conn->proxy_ntlm_state == NTLMSTATE_TYPE2)))) {
-        infof(data, "Connection closure while negotiating auth (HTTP 1.0?)");
-        data->state.authproblem = TRUE;
-      }
-#endif
-#if defined(USE_SPNEGO)
-      if(conn->bits.close &&
-        (((data->req.httpcode == 401) &&
-          (conn->http_negotiate_state == GSS_AUTHRECV)) ||
-         ((data->req.httpcode == 407) &&
-          (conn->proxy_negotiate_state == GSS_AUTHRECV)))) {
-        infof(data, "Connection closure while negotiating auth (HTTP 1.0?)");
-        data->state.authproblem = TRUE;
-      }
-      if((conn->http_negotiate_state == GSS_AUTHDONE) &&
-         (data->req.httpcode != 401)) {
-        conn->http_negotiate_state = GSS_AUTHSUCC;
-      }
-      if((conn->proxy_negotiate_state == GSS_AUTHDONE) &&
-         (data->req.httpcode != 407)) {
-        conn->proxy_negotiate_state = GSS_AUTHSUCC;
-      }
-#endif
-
-      /* now, only output this if the header AND body are requested:
-       */
-      writetype = CLIENTWRITE_HEADER |
-        (data->set.include_header ? CLIENTWRITE_BODY : 0) |
-        ((k->httpcode/100 == 1) ? CLIENTWRITE_1XX : 0);
-
-      headerlen = Curl_dyn_len(&data->state.headerb);
-      result = Curl_client_write(data, writetype,
-                                 Curl_dyn_ptr(&data->state.headerb),
-                                 headerlen);
-      if(result)
-        return result;
-
-      result = Curl_bump_headersize(data, headerlen, FALSE);
-      if(result)
-        return result;
-
-      /*
-       * When all the headers have been parsed, see if we should give
-       * up and return an error.
-       */
-      if(http_should_fail(data)) {
-        failf(data, "The requested URL returned error: %d",
-              k->httpcode);
-        return CURLE_HTTP_RETURNED_ERROR;
-      }
-
-#ifdef USE_WEBSOCKETS
-      /* All non-101 HTTP status codes are bad when wanting to upgrade to
-         websockets */
-      if(data->req.upgr101 == UPGR101_WS) {
-        failf(data, "Refused WebSockets upgrade: %d", k->httpcode);
-        return CURLE_HTTP_RETURNED_ERROR;
-      }
-#endif
-
-
-      data->req.deductheadercount =
-        (100 <= k->httpcode && 199 >= k->httpcode)?data->req.headerbytecount:0;
-
-      /* Curl_http_auth_act() checks what authentication methods
-       * that are available and decides which one (if any) to
-       * use. It will set 'newurl' if an auth method was picked. */
-      result = Curl_http_auth_act(data);
-
-      if(result)
-        return result;
-
-      if(k->httpcode >= 300) {
-        if((!conn->bits.authneg) && !conn->bits.close &&
-           !data->state.rewindbeforesend) {
-          /*
-           * General treatment of errors when about to send data. Including :
-           * "417 Expectation Failed", while waiting for 100-continue.
-           *
-           * The check for close above is done simply because of something
-           * else has already deemed the connection to get closed then
-           * something else should've considered the big picture and we
-           * avoid this check.
-           *
-           * rewindbeforesend indicates that something has told libcurl to
-           * continue sending even if it gets discarded
-           */
-
-          switch(data->state.httpreq) {
-          case HTTPREQ_PUT:
-          case HTTPREQ_POST:
-          case HTTPREQ_POST_FORM:
-          case HTTPREQ_POST_MIME:
-            /* We got an error response. If this happened before the whole
-             * request body has been sent we stop sending and mark the
-             * connection for closure after we've read the entire response.
-             */
-            Curl_expire_done(data, EXPIRE_100_TIMEOUT);
-            if(!k->upload_done) {
-              if((k->httpcode == 417) && data->state.expect100header) {
-                /* 417 Expectation Failed - try again without the Expect
-                   header */
-                if(!k->writebytecount &&
-                   k->exp100 == EXP100_AWAITING_CONTINUE) {
-                  infof(data, "Got HTTP failure 417 while waiting for a 100");
-                }
-                else {
-                  infof(data, "Got HTTP failure 417 while sending data");
-                  streamclose(conn,
-                              "Stop sending data before everything sent");
-                  result = http_perhapsrewind(data, conn);
-                  if(result)
-                    return result;
-                }
-                data->state.disableexpect = TRUE;
-                DEBUGASSERT(!data->req.newurl);
-                data->req.newurl = strdup(data->state.url);
-                Curl_done_sending(data, k);
-              }
-              else if(data->set.http_keep_sending_on_error) {
-                infof(data, "HTTP error before end of send, keep sending");
-                if(k->exp100 > EXP100_SEND_DATA) {
-                  k->exp100 = EXP100_SEND_DATA;
-                  k->keepon |= KEEP_SEND;
-                }
-              }
-              else {
-                infof(data, "HTTP error before end of send, stop sending");
-                streamclose(conn, "Stop sending data before everything sent");
-                result = Curl_done_sending(data, k);
-                if(result)
-                  return result;
-                k->upload_done = TRUE;
-                if(data->state.expect100header)
-                  k->exp100 = EXP100_FAILED;
-              }
-            }
-            break;
-
-          default: /* default label present to avoid compiler warnings */
-            break;
-          }
-        }
-
-        if(data->state.rewindbeforesend &&
-           (conn->writesockfd != CURL_SOCKET_BAD)) {
-          /* We rewind before next send, continue sending now */
-          infof(data, "Keep sending data to get tossed away");
-          k->keepon |= KEEP_SEND;
-        }
-      }
-
-      if(!k->header) {
-        /*
-         * really end-of-headers.
-         *
-         * If we requested a "no body", this is a good time to get
-         * out and return home.
-         */
-        if(data->req.no_body)
-          *stop_reading = TRUE;
-#ifndef CURL_DISABLE_RTSP
-        else if((conn->handler->protocol & CURLPROTO_RTSP) &&
-                (data->set.rtspreq == RTSPREQ_DESCRIBE) &&
-                (k->size <= -1))
-          /* Respect section 4.4 of rfc2326: If the Content-Length header is
-             absent, a length 0 must be assumed.  It will prevent libcurl from
-             hanging on DESCRIBE request that got refused for whatever
-             reason */
-          *stop_reading = TRUE;
-#endif
-
-        /* If max download size is *zero* (nothing) we already have
-           nothing and can safely return ok now!  But for HTTP/2, we'd
-           like to call http2_handle_stream_close to properly close a
-           stream.  In order to do this, we keep reading until we
-           close the stream. */
-        if(0 == k->maxdownload
-           && !Curl_conn_is_http2(data, conn, FIRSTSOCKET)
-           && !Curl_conn_is_http3(data, conn, FIRSTSOCKET))
-          *stop_reading = TRUE;
-
-        if(*stop_reading) {
-          /* we make sure that this socket isn't read more now */
-          k->keepon &= ~KEEP_RECV;
-        }
-
-        Curl_debug(data, CURLINFO_HEADER_IN, str_start, headerlen);
-        break; /* exit header line loop */
-      }
-
-      /* We continue reading headers, reset the line-based header */
-      Curl_dyn_reset(&data->state.headerb);
-      continue;
     }
 
-    /*
-     * Checks for special headers coming up.
-     */
-
-    writetype = CLIENTWRITE_HEADER;
-    if(!k->headerline++) {
-      /* This is the first header, it MUST be the error code line
-         or else we consider this to be the body right away! */
-      bool fine_statusline = FALSE;
-      if(conn->handler->protocol & PROTO_FAMILY_HTTP) {
-        /*
-         * https://datatracker.ietf.org/doc/html/rfc7230#section-3.1.2
-         *
-         * The response code is always a three-digit number in HTTP as the spec
-         * says. We allow any three-digit number here, but we cannot make
-         * guarantees on future behaviors since it isn't within the protocol.
-         */
-        int httpversion = 0;
-        char *p = headp;
-
-        while(*p && ISBLANK(*p))
-          p++;
-        if(!strncmp(p, "HTTP/", 5)) {
-          p += 5;
-          switch(*p) {
-          case '1':
-            p++;
-            if((p[0] == '.') && (p[1] == '0' || p[1] == '1')) {
-              if(ISBLANK(p[2])) {
-                httpversion = 10 + (p[1] - '0');
-                p += 3;
-                if(ISDIGIT(p[0]) && ISDIGIT(p[1]) && ISDIGIT(p[2])) {
-                  k->httpcode = (p[0] - '0') * 100 + (p[1] - '0') * 10 +
-                    (p[2] - '0');
-                  p += 3;
-                  if(ISSPACE(*p))
-                    fine_statusline = TRUE;
-                }
-              }
-            }
-            if(!fine_statusline) {
-              failf(data, "Unsupported HTTP/1 subversion in response");
-              return CURLE_UNSUPPORTED_PROTOCOL;
-            }
-            break;
-          case '2':
-          case '3':
-            if(!ISBLANK(p[1]))
-              break;
-            httpversion = (*p - '0') * 10;
-            p += 2;
-            if(ISDIGIT(p[0]) && ISDIGIT(p[1]) && ISDIGIT(p[2])) {
-              k->httpcode = (p[0] - '0') * 100 + (p[1] - '0') * 10 +
-                (p[2] - '0');
-              p += 3;
-              if(!ISSPACE(*p))
-                break;
-              fine_statusline = TRUE;
-            }
-            break;
-          default: /* unsupported */
-            failf(data, "Unsupported HTTP version in response");
-            return CURLE_UNSUPPORTED_PROTOCOL;
-          }
-        }
-
-        if(fine_statusline) {
-          if(k->httpcode < 100) {
-            failf(data, "Unsupported response code in HTTP response");
-            return CURLE_UNSUPPORTED_PROTOCOL;
-          }
-          switch(httpversion) {
-          case 10:
-          case 11:
-#ifdef USE_HTTP2
-          case 20:
-#endif
-#ifdef ENABLE_QUIC
-          case 30:
-#endif
-            conn->httpversion = (unsigned char)httpversion;
-            break;
-          default:
-            failf(data, "Unsupported HTTP version (%u.%d) in response",
-                  httpversion/10, httpversion%10);
-            return CURLE_UNSUPPORTED_PROTOCOL;
-          }
-
-          if(k->upgr101 == UPGR101_RECEIVED) {
-            /* supposedly upgraded to http2 now */
-            if(conn->httpversion != 20)
-              infof(data, "Lying server, not serving HTTP/2");
-          }
-          if(conn->httpversion < 20) {
-            conn->bundle->multiuse = BUNDLE_NO_MULTIUSE;
-          }
-        }
-        else {
-          /* If user has set option HTTP200ALIASES,
-             compare header line against list of aliases
-          */
-          statusline check =
-            checkhttpprefix(data,
-                            Curl_dyn_ptr(&data->state.headerb),
-                            Curl_dyn_len(&data->state.headerb));
-          if(check == STATUS_DONE) {
-            fine_statusline = TRUE;
-            k->httpcode = 200;
-            conn->httpversion = 10;
-          }
-        }
-      }
-      else if(conn->handler->protocol & CURLPROTO_RTSP) {
-        char *p = headp;
-        while(*p && ISBLANK(*p))
-          p++;
-        if(!strncmp(p, "RTSP/", 5)) {
-          p += 5;
-          if(ISDIGIT(*p)) {
-            p++;
-            if((p[0] == '.') && ISDIGIT(p[1])) {
-              if(ISBLANK(p[2])) {
-                p += 3;
-                if(ISDIGIT(p[0]) && ISDIGIT(p[1]) && ISDIGIT(p[2])) {
-                  k->httpcode = (p[0] - '0') * 100 + (p[1] - '0') * 10 +
-                    (p[2] - '0');
-                  p += 3;
-                  if(ISSPACE(*p)) {
-                    fine_statusline = TRUE;
-                    conn->httpversion = 11; /* RTSP acts like HTTP 1.1 */
-                  }
-                }
-              }
-            }
-          }
-          if(!fine_statusline)
-            return CURLE_WEIRD_SERVER_REPLY;
-        }
-      }
-
-      if(fine_statusline) {
-        result = Curl_http_statusline(data, conn);
-        if(result)
-          return result;
-        writetype |= CLIENTWRITE_STATUS;
-      }
-      else {
-        k->header = FALSE;   /* this is not a header line */
-        break;
-      }
+    result = http_rw_hd(data, hd, hlen, buf, blen, &consumed);
+    /* We are done with this line. We reset because response
+     * processing might switch to HTTP/2 and that might call us
+     * directly again. */
+    curlx_dyn_reset(&data->state.headerb);
+    if(consumed) {
+      blen -= consumed;
+      buf += consumed;
+      *pconsumed += consumed;
     }
-
-    result = verify_header(data);
     if(result)
       return result;
-
-    result = Curl_http_header(data, conn, headp);
-    if(result)
-      return result;
-
-    /*
-     * End of header-checks. Write them to the client.
-     */
-    if(data->set.include_header)
-      writetype |= CLIENTWRITE_BODY;
-    if(k->httpcode/100 == 1)
-      writetype |= CLIENTWRITE_1XX;
-
-    Curl_debug(data, CURLINFO_HEADER_IN, headp,
-               Curl_dyn_len(&data->state.headerb));
-
-    result = Curl_client_write(data, writetype, headp,
-                               Curl_dyn_len(&data->state.headerb));
-    if(result)
-      return result;
-
-    result = Curl_bump_headersize(data, Curl_dyn_len(&data->state.headerb),
-                                  FALSE);
-    if(result)
-      return result;
-
-    Curl_dyn_reset(&data->state.headerb);
   }
-  while(*k->str); /* header line within buffer */
 
   /* We might have reached the end of the header part here, but
      there might be a non-header part left in the end of the read
      buffer. */
-
+out:
+  if(!k->header && !leftover_body) {
+    curlx_dyn_free(&data->state.headerb);
+  }
   return CURLE_OK;
 }
 
+CURLcode Curl_http_write_resp_hd(struct Curl_easy *data,
+                                 const char *hd, size_t hdlen,
+                                 bool is_eos)
+{
+  CURLcode result;
+  size_t consumed;
+  char tmp = 0;
+  DEBUGASSERT(!hd[hdlen]); /* null-terminated */
+
+  result = http_rw_hd(data, hd, hdlen, &tmp, 0, &consumed);
+  if(!result && is_eos) {
+    result = Curl_client_write(data, (CLIENTWRITE_BODY | CLIENTWRITE_EOS),
+                               &tmp, 0);
+  }
+  return result;
+}
+
+/*
+ * HTTP protocol `write_resp` implementation. Parse headers
+ * when not done yet and otherwise return without consuming data.
+ */
+CURLcode Curl_http_write_resp_hds(struct Curl_easy *data,
+                                  const char *buf, size_t blen,
+                                  size_t *pconsumed)
+{
+  if(!data->req.header) {
+    *pconsumed = 0;
+    return CURLE_OK;
+  }
+  else {
+    CURLcode result;
+
+    result = http_parse_headers(data, buf, blen, pconsumed);
+    if(!result && !data->req.header) {
+      if(!data->req.no_body && curlx_dyn_len(&data->state.headerb)) {
+        /* leftover from parsing something that turned out not
+         * to be a header, only happens if we allow for
+         * HTTP/0.9 like responses */
+        result = Curl_client_write(data, CLIENTWRITE_BODY,
+                                   curlx_dyn_ptr(&data->state.headerb),
+                                   curlx_dyn_len(&data->state.headerb));
+      }
+      curlx_dyn_free(&data->state.headerb);
+    }
+    return result;
+  }
+}
+
+CURLcode Curl_http_write_resp(struct Curl_easy *data,
+                              const char *buf, size_t blen,
+                              bool is_eos)
+{
+  CURLcode result;
+  size_t consumed;
+  int flags;
+
+  result = Curl_http_write_resp_hds(data, buf, blen, &consumed);
+  if(result || data->req.done)
+    goto out;
+
+  DEBUGASSERT(consumed <= blen);
+  blen -= consumed;
+  buf += consumed;
+  /* either all was consumed in header parsing, or we have data left
+   * and are done with headers, e.g. it is BODY data */
+  DEBUGASSERT(!blen || !data->req.header);
+  if(!data->req.header && (blen || is_eos)) {
+    /* BODY data after header been parsed, write and consume */
+    flags = CLIENTWRITE_BODY;
+    if(is_eos)
+      flags |= CLIENTWRITE_EOS;
+    result = Curl_client_write(data, flags, buf, blen);
+  }
+out:
+  return result;
+}
 
 /* Decode HTTP status code string. */
 CURLcode Curl_http_decode_status(int *pstatus, const char *s, size_t len)
@@ -4614,21 +4678,10 @@ CURLcode Curl_http_decode_status(int *pstatus, const char *s, size_t len)
   }
   result = CURLE_OK;
 out:
-  *pstatus = result? -1 : status;
+  *pstatus = result ? -1 : status;
   return result;
 }
 
-/* simple implementation of strndup(), which isn't portable */
-static char *my_strndup(const char *ptr, size_t len)
-{
-  char *copy = malloc(len + 1);
-  if(!copy)
-    return NULL;
-  memcpy(copy, ptr, len);
-  copy[len] = '\0';
-  return copy;
-}
-
 CURLcode Curl_http_req_make(struct httpreq **preq,
                             const char *method, size_t m_len,
                             const char *scheme, size_t s_len,
@@ -4638,26 +4691,34 @@ CURLcode Curl_http_req_make(struct httpreq **preq,
   struct httpreq *req;
   CURLcode result = CURLE_OUT_OF_MEMORY;
 
-  DEBUGASSERT(method);
-  if(m_len + 1 >= sizeof(req->method))
-    return CURLE_BAD_FUNCTION_ARGUMENT;
+  DEBUGASSERT(method && m_len);
 
-  req = calloc(1, sizeof(*req));
+  req = curlx_calloc(1, sizeof(*req) + m_len);
   if(!req)
     goto out;
+#if defined(__GNUC__) && __GNUC__ >= 13
+#pragma GCC diagnostic push
+/* error: 'memcpy' offset [137, 142] from the object at 'req' is out of
+   the bounds of referenced subobject 'method' with type 'char[1]' at
+   offset 136 */
+#pragma GCC diagnostic ignored "-Warray-bounds"
+#endif
   memcpy(req->method, method, m_len);
+#if defined(__GNUC__) && __GNUC__ >= 13
+#pragma GCC diagnostic pop
+#endif
   if(scheme) {
-    req->scheme = my_strndup(scheme, s_len);
+    req->scheme = curlx_memdup0(scheme, s_len);
     if(!req->scheme)
       goto out;
   }
   if(authority) {
-    req->authority = my_strndup(authority, a_len);
+    req->authority = curlx_memdup0(authority, a_len);
     if(!req->authority)
       goto out;
   }
   if(path) {
-    req->path = my_strndup(path, p_len);
+    req->path = curlx_memdup0(path, p_len);
     if(!req->path)
       goto out;
   }
@@ -4668,19 +4729,19 @@ CURLcode Curl_http_req_make(struct httpreq **preq,
 out:
   if(result && req)
     Curl_http_req_free(req);
-  *preq = result? NULL : req;
+  *preq = result ? NULL : req;
   return result;
 }
 
 static CURLcode req_assign_url_authority(struct httpreq *req, CURLU *url)
 {
-  char *user, *pass, *host, *port;
+  char *host, *port;
   struct dynbuf buf;
   CURLUcode uc;
   CURLcode result = CURLE_URL_MALFORMAT;
 
-  user = pass = host = port = NULL;
-  Curl_dyn_init(&buf, DYN_HTTP_REQUEST);
+  host = port = NULL;
+  curlx_dyn_init(&buf, DYN_HTTP_REQUEST);
 
   uc = curl_url_get(url, CURLUPART_HOST, &host, 0);
   if(uc && uc != CURLUE_NO_HOST)
@@ -4694,47 +4755,21 @@ static CURLcode req_assign_url_authority(struct httpreq *req, CURLU *url)
   uc = curl_url_get(url, CURLUPART_PORT, &port, CURLU_NO_DEFAULT_PORT);
   if(uc && uc != CURLUE_NO_PORT)
     goto out;
-  uc = curl_url_get(url, CURLUPART_USER, &user, 0);
-  if(uc && uc != CURLUE_NO_USER)
-    goto out;
-  if(user) {
-    uc = curl_url_get(url, CURLUPART_PASSWORD, &pass, 0);
-    if(uc && uc != CURLUE_NO_PASSWORD)
-      goto out;
-  }
 
-  if(user) {
-    result = Curl_dyn_add(&buf, user);
-    if(result)
-      goto out;
-    if(pass) {
-      result = Curl_dyn_addf(&buf, ":%s", pass);
-      if(result)
-        goto out;
-    }
-    result = Curl_dyn_add(&buf, "@");
-    if(result)
-      goto out;
-  }
-  result = Curl_dyn_add(&buf, host);
+  result = curlx_dyn_add(&buf, host);
   if(result)
     goto out;
   if(port) {
-    result = Curl_dyn_addf(&buf, ":%s", port);
+    result = curlx_dyn_addf(&buf, ":%s", port);
     if(result)
       goto out;
   }
-  req->authority = strdup(Curl_dyn_ptr(&buf));
-  if(!req->authority)
-    goto out;
-  result = CURLE_OK;
-
+  req->authority = curlx_dyn_ptr(&buf);
 out:
-  free(user);
-  free(pass);
-  free(host);
-  free(port);
-  Curl_dyn_free(&buf);
+  curlx_free(host);
+  curlx_free(port);
+  if(result)
+    curlx_dyn_free(&buf);
   return result;
 }
 
@@ -4746,43 +4781,34 @@ static CURLcode req_assign_url_path(struct httpreq *req, CURLU *url)
   CURLcode result = CURLE_URL_MALFORMAT;
 
   path = query = NULL;
-  Curl_dyn_init(&buf, DYN_HTTP_REQUEST);
+  curlx_dyn_init(&buf, DYN_HTTP_REQUEST);
 
-  uc = curl_url_get(url, CURLUPART_PATH, &path, CURLU_PATH_AS_IS);
+  uc = curl_url_get(url, CURLUPART_PATH, &path, 0);
   if(uc)
     goto out;
   uc = curl_url_get(url, CURLUPART_QUERY, &query, 0);
   if(uc && uc != CURLUE_NO_QUERY)
     goto out;
 
-  if(!path && !query) {
-    req->path = NULL;
-  }
-  else if(path && !query) {
+  if(!query) {
     req->path = path;
     path = NULL;
   }
   else {
-    if(path) {
-      result = Curl_dyn_add(&buf, path);
-      if(result)
-        goto out;
-    }
-    if(query) {
-      result = Curl_dyn_addf(&buf, "?%s", query);
-      if(result)
-        goto out;
-    }
-    req->path = strdup(Curl_dyn_ptr(&buf));
-    if(!req->path)
+    result = curlx_dyn_add(&buf, path);
+    if(!result)
+      result = curlx_dyn_addf(&buf, "?%s", query);
+    if(result)
       goto out;
+    req->path = curlx_dyn_ptr(&buf);
   }
   result = CURLE_OK;
 
 out:
-  free(path);
-  free(query);
-  Curl_dyn_free(&buf);
+  curlx_free(path);
+  curlx_free(query);
+  if(result)
+    curlx_dyn_free(&buf);
   return result;
 }
 
@@ -4794,11 +4820,9 @@ CURLcode Curl_http_req_make2(struct httpreq **preq,
   CURLcode result = CURLE_OUT_OF_MEMORY;
   CURLUcode uc;
 
-  DEBUGASSERT(method);
-  if(m_len + 1 >= sizeof(req->method))
-    return CURLE_BAD_FUNCTION_ARGUMENT;
+  DEBUGASSERT(method && m_len);
 
-  req = calloc(1, sizeof(*req));
+  req = curlx_calloc(1, sizeof(*req) + m_len);
   if(!req)
     goto out;
   memcpy(req->method, method, m_len);
@@ -4807,7 +4831,7 @@ CURLcode Curl_http_req_make2(struct httpreq **preq,
   if(uc && uc != CURLUE_NO_SCHEME)
     goto out;
   if(!req->scheme && scheme_default) {
-    req->scheme = strdup(scheme_default);
+    req->scheme = curlx_strdup(scheme_default);
     if(!req->scheme)
       goto out;
   }
@@ -4826,19 +4850,19 @@ CURLcode Curl_http_req_make2(struct httpreq **preq,
 out:
   if(result && req)
     Curl_http_req_free(req);
-  *preq = result? NULL : req;
+  *preq = result ? NULL : req;
   return result;
 }
 
 void Curl_http_req_free(struct httpreq *req)
 {
   if(req) {
-    free(req->scheme);
-    free(req->authority);
-    free(req->path);
+    curlx_free(req->scheme);
+    curlx_free(req->authority);
+    curlx_free(req->path);
     Curl_dynhds_free(&req->headers);
     Curl_dynhds_free(&req->trailers);
-    free(req);
+    curlx_free(req);
   }
 }
 
@@ -4847,7 +4871,7 @@ struct name_const {
   size_t namelen;
 };
 
-static struct name_const H2_NON_FIELD[] = {
+static const struct name_const H2_NON_FIELD[] = {
   { STRCONST("Host") },
   { STRCONST("Upgrade") },
   { STRCONST("Connection") },
@@ -4856,15 +4880,42 @@ static struct name_const H2_NON_FIELD[] = {
   { STRCONST("Transfer-Encoding") },
 };
 
-static bool h2_non_field(const char *name, size_t namelen)
+static bool h2_permissible_field(struct dynhds_entry *e)
 {
   size_t i;
-  for(i = 0; i < sizeof(H2_NON_FIELD)/sizeof(H2_NON_FIELD[0]); ++i) {
-    if(namelen < H2_NON_FIELD[i].namelen)
+  for(i = 0; i < CURL_ARRAYSIZE(H2_NON_FIELD); ++i) {
+    if(e->namelen == H2_NON_FIELD[i].namelen &&
+       curl_strnequal(H2_NON_FIELD[i].name, e->name, e->namelen))
       return FALSE;
-    if(namelen == H2_NON_FIELD[i].namelen &&
-       strcasecompare(H2_NON_FIELD[i].name, name))
+  }
+  return TRUE;
+}
+
+static bool http_TE_has_token(const char *fvalue, const char *token)
+{
+  while(*fvalue) {
+    struct Curl_str name;
+
+    /* skip to first token */
+    while(ISBLANK(*fvalue) || *fvalue == ',')
+      fvalue++;
+    if(curlx_str_cspn(&fvalue, &name, " \t\r;,"))
+      return FALSE;
+    if(curlx_str_casecompare(&name, token))
       return TRUE;
+
+    /* skip any remainder after token, e.g. parameters with quoted strings */
+    while(*fvalue && *fvalue != ',') {
+      if(*fvalue == '"') {
+        struct Curl_str qw;
+        /* if we do not cleanly find a quoted word here, the header value
+         * does not follow HTTP syntax and we reject */
+        if(curlx_str_quotedword(&fvalue, &qw, CURL_MAX_HTTP_HEADER))
+          return FALSE;
+      }
+      else
+        fvalue++;
+    }
   }
   return FALSE;
 }
@@ -4887,13 +4938,11 @@ CURLcode Curl_http_req_to_h2(struct dynhds *h2_headers,
     scheme = Curl_checkheaders(data, STRCONST(HTTP_PSEUDO_SCHEME));
     if(scheme) {
       scheme += sizeof(HTTP_PSEUDO_SCHEME);
-      while(*scheme && ISBLANK(*scheme))
-        scheme++;
+      curlx_str_passblanks(&scheme);
       infof(data, "set pseudo header %s to %s", HTTP_PSEUDO_SCHEME, scheme);
     }
     else {
-      scheme = (data->conn && data->conn->handler->flags & PROTOPT_SSL)?
-                "https" : "http";
+      scheme = data->state.origin->scheme->name;
     }
   }
 
@@ -4924,7 +4973,14 @@ CURLcode Curl_http_req_to_h2(struct dynhds *h2_headers,
   }
   for(i = 0; !result && i < Curl_dynhds_count(&req->headers); ++i) {
     e = Curl_dynhds_getn(&req->headers, i);
-    if(!h2_non_field(e->name, e->namelen)) {
+    /* "TE" is special in that it is only permissible when it
+     * has only value "trailers". RFC 9113 ch. 8.2.2 */
+    if(e->namelen == 2 && curl_strequal("TE", e->name)) {
+      if(http_TE_has_token(e->value, "trailers"))
+        result = Curl_dynhds_add(h2_headers, e->name, e->namelen,
+                                 "trailers", sizeof("trailers") - 1);
+    }
+    else if(h2_permissible_field(e)) {
       result = Curl_dynhds_add(h2_headers, e->name, e->namelen,
                                e->value, e->valuelen);
     }
@@ -4940,13 +4996,13 @@ CURLcode Curl_http_resp_make(struct http_resp **presp,
   struct http_resp *resp;
   CURLcode result = CURLE_OUT_OF_MEMORY;
 
-  resp = calloc(1, sizeof(*resp));
+  resp = curlx_calloc(1, sizeof(*resp));
   if(!resp)
     goto out;
 
   resp->status = status;
   if(description) {
-    resp->description = strdup(description);
+    resp->description = curlx_strdup(description);
     if(!resp->description)
       goto out;
   }
@@ -4957,20 +5013,43 @@ CURLcode Curl_http_resp_make(struct http_resp **presp,
 out:
   if(result && resp)
     Curl_http_resp_free(resp);
-  *presp = result? NULL : resp;
+  *presp = result ? NULL : resp;
   return result;
 }
 
 void Curl_http_resp_free(struct http_resp *resp)
 {
   if(resp) {
-    free(resp->description);
+    curlx_free(resp->description);
     Curl_dynhds_free(&resp->headers);
     Curl_dynhds_free(&resp->trailers);
     if(resp->prev)
       Curl_http_resp_free(resp->prev);
-    free(resp);
+    curlx_free(resp);
   }
 }
 
+/*
+ * HTTP handler interface.
+ */
+const struct Curl_protocol Curl_protocol_http = {
+  Curl_http_setup_conn,                 /* setup_connection */
+  Curl_http,                            /* do_it */
+  Curl_http_done,                       /* done */
+  ZERO_NULL,                            /* do_more */
+  ZERO_NULL,                            /* connect_it */
+  ZERO_NULL,                            /* connecting */
+  ZERO_NULL,                            /* doing */
+  ZERO_NULL,                            /* proto_pollset */
+  Curl_http_doing_pollset,              /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  Curl_http_perform_pollset,            /* perform_pollset */
+  ZERO_NULL,                            /* disconnect */
+  Curl_http_write_resp,                 /* write_resp */
+  Curl_http_write_resp_hd,              /* write_resp_hd */
+  ZERO_NULL,                            /* connection_is_dead */
+  ZERO_NULL,                            /* attach connection */
+  Curl_http_follow,                     /* follow */
+};
+
 #endif /* CURL_DISABLE_HTTP */
diff --git a/third-party/curl/lib/http.h b/third-party/curl/lib/http.h
index 9ee3c6537c..5050215743 100644
--- a/third-party/curl/lib/http.h
+++ b/third-party/curl/lib/http.h
@@ -25,13 +25,8 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
-#if defined(USE_MSH3) && !defined(_WIN32)
-#include <pthread.h>
-#endif
-
 #include "bufq.h"
 #include "dynhds.h"
-#include "ws.h"
 
 typedef enum {
   HTTPREQ_GET,
@@ -42,28 +37,31 @@ typedef enum {
   HTTPREQ_HEAD
 } Curl_HttpReq;
 
+#define CURL_HTTP_V1x   (1 << 0)
+#define CURL_HTTP_V2x   (1 << 1)
+#define CURL_HTTP_V3x   (1 << 2)
+/* bitmask of CURL_HTTP_V* values */
+typedef unsigned char http_majors;
+
 #ifndef CURL_DISABLE_HTTP
 
-#if defined(ENABLE_QUIC)
-#include <stdint.h>
-#endif
-
-extern const struct Curl_handler Curl_handler_http;
-
-#ifdef USE_SSL
-extern const struct Curl_handler Curl_handler_https;
-#endif
-
-#ifdef USE_WEBSOCKETS
-extern const struct Curl_handler Curl_handler_ws;
-
-#ifdef USE_SSL
-extern const struct Curl_handler Curl_handler_wss;
-#endif
-#endif /* websockets */
+extern const struct Curl_protocol Curl_protocol_http;
 
 struct dynhds;
 
+struct http_negotiation {
+  unsigned char rcvd_min; /* minimum version seen in responses, 09, 10, 11 */
+  http_majors wanted;  /* wanted major versions when talking to server */
+  http_majors allowed; /* allowed major versions when talking to server */
+  http_majors preferred; /* preferred major version when talking to server */
+  BIT(h2_upgrade);  /* Do HTTP Upgrade from 1.1 to 2 */
+  BIT(h2_prior_knowledge); /* Directly do HTTP/2 without ALPN/SSL */
+  BIT(accept_09); /* Accept an HTTP/0.9 response */
+  BIT(only_10); /* When using major version 1x, use only 1.0 */
+};
+
+void Curl_http_neg_init(struct Curl_easy *data, struct http_negotiation *neg);
+
 CURLcode Curl_bump_headersize(struct Curl_easy *data,
                               size_t delta,
                               bool connect_only);
@@ -81,86 +79,53 @@ char *Curl_checkProxyheaders(struct Curl_easy *data,
                              const struct connectdata *conn,
                              const char *thisheader,
                              const size_t thislen);
-struct HTTP; /* see below */
-CURLcode Curl_buffer_send(struct dynbuf *in,
-                          struct Curl_easy *data,
-                          struct HTTP *http,
-                          curl_off_t *bytes_written,
-                          curl_off_t included_body_bytes,
-                          int socketindex);
 
-CURLcode Curl_add_timecondition(struct Curl_easy *data,
-#ifndef USE_HYPER
-                                struct dynbuf *req
-#else
-                                void *headers
-#endif
-  );
-CURLcode Curl_add_custom_headers(struct Curl_easy *data,
-                                 bool is_connect,
-#ifndef USE_HYPER
-                                 struct dynbuf *req
-#else
-                                 void *headers
-#endif
-  );
-CURLcode Curl_dynhds_add_custom(struct Curl_easy *data,
-                                bool is_connect,
-                                struct dynhds *hds);
+CURLcode Curl_add_timecondition(struct Curl_easy *data, struct dynbuf *req);
+CURLcode Curl_add_custom_headers(struct Curl_easy *data, bool is_connect,
+                                 int httpversion, struct dynbuf *req);
 
-CURLcode Curl_http_compile_trailers(struct curl_slist *trailers,
-                                    struct dynbuf *buf,
-                                    struct Curl_easy *handle);
+void Curl_http_to_fold(struct dynbuf *bf);
 
-void Curl_http_method(struct Curl_easy *data, struct connectdata *conn,
-                      const char **method, Curl_HttpReq *);
-CURLcode Curl_http_useragent(struct Curl_easy *data);
-CURLcode Curl_http_host(struct Curl_easy *data, struct connectdata *conn);
-CURLcode Curl_http_target(struct Curl_easy *data, struct connectdata *conn,
-                          struct dynbuf *req);
-CURLcode Curl_http_statusline(struct Curl_easy *data,
-                              struct connectdata *conn);
-CURLcode Curl_http_header(struct Curl_easy *data, struct connectdata *conn,
-                          char *headp);
-CURLcode Curl_transferencode(struct Curl_easy *data);
-CURLcode Curl_http_body(struct Curl_easy *data, struct connectdata *conn,
-                        Curl_HttpReq httpreq,
-                        const char **teep);
-CURLcode Curl_http_bodysend(struct Curl_easy *data, struct connectdata *conn,
-                            struct dynbuf *r, Curl_HttpReq httpreq);
-bool Curl_use_http_1_1plus(const struct Curl_easy *data,
-                           const struct connectdata *conn);
-#ifndef CURL_DISABLE_COOKIES
-CURLcode Curl_http_cookies(struct Curl_easy *data,
-                           struct connectdata *conn,
-                           struct dynbuf *r);
-#else
-#define Curl_http_cookies(a,b,c) CURLE_OK
-#endif
-CURLcode Curl_http_resume(struct Curl_easy *data,
-                          struct connectdata *conn,
-                          Curl_HttpReq httpreq);
-CURLcode Curl_http_range(struct Curl_easy *data,
-                         Curl_HttpReq httpreq);
-CURLcode Curl_http_firstwrite(struct Curl_easy *data,
-                              struct connectdata *conn,
-                              bool *done);
+void Curl_http_method(struct Curl_easy *data,
+                      const char **method, Curl_HttpReq *reqp);
 
 /* protocol-specific functions set up to be called by the main engine */
+CURLcode Curl_http_setup_conn(struct Curl_easy *data,
+                              struct connectdata *conn);
 CURLcode Curl_http(struct Curl_easy *data, bool *done);
-CURLcode Curl_http_done(struct Curl_easy *data, CURLcode, bool premature);
-CURLcode Curl_http_connect(struct Curl_easy *data, bool *done);
+CURLcode Curl_http_done(struct Curl_easy *data,
+                        CURLcode status, bool premature);
+CURLcode Curl_http_doing_pollset(struct Curl_easy *data,
+                                 struct easy_pollset *ps);
+CURLcode Curl_http_perform_pollset(struct Curl_easy *data,
+                                   struct easy_pollset *ps);
+CURLcode Curl_http_write_resp(struct Curl_easy *data,
+                              const char *buf, size_t blen,
+                              bool is_eos);
+CURLcode Curl_http_write_resp_hd(struct Curl_easy *data,
+                                 const char *hd, size_t hdlen,
+                                 bool is_eos);
+
+/* check a received header line for forbidden bytes/format, the same checks
+   applied to regular response headers */
+CURLcode Curl_verify_header(struct Curl_easy *data,
+                            const char *hd, size_t hdlen);
 
 /* These functions are in http.c */
 CURLcode Curl_http_input_auth(struct Curl_easy *data, bool proxy,
                               const char *auth);
+
 CURLcode Curl_http_auth_act(struct Curl_easy *data);
 
+/* follow a redirect or not */
+CURLcode Curl_http_follow(struct Curl_easy *data, const char *newurl,
+                          followtype type);
+
 /* If only the PICKNONE bit is set, there has been a round-trip and we
    selected to use no auth at all. Ie, we actively select no auth, as opposed
    to not having one selected. The other CURLAUTH_* defines are present in the
    public curl/curl.h header. */
-#define CURLAUTH_PICKNONE (1<<30) /* don't use auth */
+#define CURLAUTH_PICKNONE (1 << 30) /* do not use auth */
 
 /* MAX_INITIAL_POST_SIZE indicates the number of bytes that will make the POST
    data get included in the initial data chunk sent to the server. If the
@@ -175,7 +140,7 @@ CURLcode Curl_http_auth_act(struct Curl_easy *data);
    It must not be greater than 64K to work on VMS.
 */
 #ifndef MAX_INITIAL_POST_SIZE
-#define MAX_INITIAL_POST_SIZE (64*1024)
+#define MAX_INITIAL_POST_SIZE (64 * 1024)
 #endif
 
 /* EXPECT_100_THRESHOLD is the request body size limit for when libcurl will
@@ -184,51 +149,28 @@ CURLcode Curl_http_auth_act(struct Curl_easy *data);
  *
  */
 #ifndef EXPECT_100_THRESHOLD
-#define EXPECT_100_THRESHOLD (1024*1024)
+#define EXPECT_100_THRESHOLD (1024 * 1024)
 #endif
 
 /* MAX_HTTP_RESP_HEADER_SIZE is the maximum size of all response headers
    combined that libcurl allows for a single HTTP response, any HTTP
    version. This count includes CONNECT response headers. */
-#define MAX_HTTP_RESP_HEADER_SIZE (300*1024)
+#define MAX_HTTP_RESP_HEADER_SIZE (300 * 1024)
+
+/* MAX_HTTP_RESP_HEADER_COUNT is the maximum number of response headers that
+   libcurl allows for a single HTTP response, including CONNECT and
+   redirects. */
+#define MAX_HTTP_RESP_HEADER_COUNT 5000
 
 #endif /* CURL_DISABLE_HTTP */
 
 /****************************************************************************
  * HTTP unique setup
  ***************************************************************************/
-struct HTTP {
-  curl_off_t postsize; /* off_t to handle large file sizes */
-  const char *postdata;
-  struct back {
-    curl_read_callback fread_func; /* backup storage for fread pointer */
-    void *fread_in;           /* backup storage for fread_in pointer */
-    const char *postdata;
-    curl_off_t postsize;
-    struct Curl_easy *data;
-  } backup;
 
-  enum {
-    HTTPSEND_NADA,    /* init */
-    HTTPSEND_REQUEST, /* sending a request */
-    HTTPSEND_BODY     /* sending body */
-  } sending;
-
-#ifndef CURL_DISABLE_HTTP
-  void *h2_ctx;              /* HTTP/2 implementation context */
-  void *h3_ctx;              /* HTTP/3 implementation context */
-  struct dynbuf send_buffer; /* used if the request couldn't be sent in one
-                                chunk, points to an allocated send_buffer
-                                struct */
-#endif
-};
-
-CURLcode Curl_http_size(struct Curl_easy *data);
-
-CURLcode Curl_http_readwrite_headers(struct Curl_easy *data,
-                                     struct connectdata *conn,
-                                     ssize_t *nread,
-                                     bool *stop_reading);
+CURLcode Curl_http_write_resp_hds(struct Curl_easy *data,
+                                  const char *buf, size_t blen,
+                                  size_t *pconsumed);
 
 /**
  * Curl_http_output_auth() setups the authentication headers for the
@@ -241,38 +183,37 @@ CURLcode Curl_http_readwrite_headers(struct Curl_easy *data,
  * @param request pointer to the request keyword
  * @param httpreq is the request type
  * @param path pointer to the requested path
- * @param proxytunnel boolean if this is the request setting up a "proxy
- * tunnel"
+ * @param query pointer to the requested query or NULL
+ * @param is_connect boolean if this is a CONNECT request
+ *        (where httpreq is HTTPREQ_GET since there is no HTTPREQ_CONNECT)
  *
  * @returns CURLcode
  */
-CURLcode
-Curl_http_output_auth(struct Curl_easy *data,
-                      struct connectdata *conn,
-                      const char *request,
-                      Curl_HttpReq httpreq,
-                      const char *path,
-                      bool proxytunnel); /* TRUE if this is the request setting
-                                            up the proxy tunnel */
+CURLcode Curl_http_output_auth(struct Curl_easy *data,
+                               struct connectdata *conn,
+                               const char *request,
+                               Curl_HttpReq httpreq,
+                               const char *path,
+                               const char *query,
+                               bool is_connect);
 
 /* Decode HTTP status code string. */
 CURLcode Curl_http_decode_status(int *pstatus, const char *s, size_t len);
 
-
 /**
  * All about a core HTTP request, excluding body and trailers
  */
 struct httpreq {
-  char method[12];
+  struct dynhds headers;
+  struct dynhds trailers;
   char *scheme;
   char *authority;
   char *path;
-  struct dynhds headers;
-  struct dynhds trailers;
+  char method[1];
 };
 
 /**
- * Create a HTTP request struct.
+ * Create an HTTP request struct.
  */
 CURLcode Curl_http_req_make(struct httpreq **preq,
                             const char *method, size_t m_len,
@@ -286,11 +227,11 @@ CURLcode Curl_http_req_make2(struct httpreq **preq,
 
 void Curl_http_req_free(struct httpreq *req);
 
-#define HTTP_PSEUDO_METHOD ":method"
-#define HTTP_PSEUDO_SCHEME ":scheme"
+#define HTTP_PSEUDO_METHOD    ":method"
+#define HTTP_PSEUDO_SCHEME    ":scheme"
 #define HTTP_PSEUDO_AUTHORITY ":authority"
-#define HTTP_PSEUDO_PATH ":path"
-#define HTTP_PSEUDO_STATUS ":status"
+#define HTTP_PSEUDO_PATH      ":path"
+#define HTTP_PSEUDO_STATUS    ":status"
 
 /**
  * Create the list of HTTP/2 headers which represent the request,
@@ -322,7 +263,7 @@ struct http_resp {
 };
 
 /**
- * Create a HTTP response struct.
+ * Create an HTTP response struct.
  */
 CURLcode Curl_http_resp_make(struct http_resp **presp,
                              int status,
diff --git a/third-party/curl/lib/http1.c b/third-party/curl/lib/http1.c
index 1ca7d41e8a..60ad32ce89 100644
--- a/third-party/curl/lib/http1.c
+++ b/third-party/curl/lib/http1.c
@@ -21,37 +21,30 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifndef CURL_DISABLE_HTTP
 
 #include "urldata.h"
-#include <curl/curl.h>
 #include "http.h"
 #include "http1.h"
 #include "urlapi-int.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
 
-
-#define H1_MAX_URL_LEN   (8*1024)
+#define H1_MAX_URL_LEN (8 * 1024)
 
 void Curl_h1_req_parse_init(struct h1_req_parser *parser, size_t max_line_len)
 {
   memset(parser, 0, sizeof(*parser));
   parser->max_line_len = max_line_len;
-  Curl_dyn_init(&parser->scratch, max_line_len);
+  curlx_dyn_init(&parser->scratch, max_line_len);
 }
 
 void Curl_h1_req_parse_free(struct h1_req_parser *parser)
 {
   if(parser) {
     Curl_http_req_free(parser->req);
-    Curl_dyn_free(&parser->scratch);
+    curlx_dyn_free(&parser->scratch);
     parser->req = NULL;
     parser->done = FALSE;
   }
@@ -81,62 +74,66 @@ static CURLcode trim_line(struct h1_req_parser *parser, int options)
   return CURLE_OK;
 }
 
-static ssize_t detect_line(struct h1_req_parser *parser,
-                           const char *buf, const size_t buflen,
-                           CURLcode *err)
+static CURLcode detect_line(struct h1_req_parser *parser,
+                            const uint8_t *buf, const size_t buflen,
+                            size_t *pnread)
 {
-  const char  *line_end;
+  const char *line_end;
 
   DEBUGASSERT(!parser->line);
+  *pnread = 0;
   line_end = memchr(buf, '\n', buflen);
-  if(!line_end) {
-    *err = CURLE_AGAIN;
-    return -1;
-  }
-  parser->line = buf;
-  parser->line_len = line_end - buf + 1;
-  *err = CURLE_OK;
-  return (ssize_t)parser->line_len;
+  if(!line_end)
+    return CURLE_AGAIN;
+  parser->line = (const char *)buf;
+  parser->line_len = line_end - parser->line + 1;
+  *pnread = parser->line_len;
+  return CURLE_OK;
 }
 
-static ssize_t next_line(struct h1_req_parser *parser,
-                         const char *buf, const size_t buflen, int options,
-                         CURLcode *err)
+static CURLcode next_line(struct h1_req_parser *parser,
+                          const uint8_t *buf, const size_t buflen, int options,
+                          size_t *pnread)
 {
-  ssize_t nread = 0;
+  CURLcode result;
 
+  *pnread = 0;
   if(parser->line) {
     parser->line = NULL;
     parser->line_len = 0;
-    Curl_dyn_reset(&parser->scratch);
+    curlx_dyn_reset(&parser->scratch);
   }
 
-  nread = detect_line(parser, buf, buflen, err);
-  if(nread >= 0) {
-    if(Curl_dyn_len(&parser->scratch)) {
+  result = detect_line(parser, buf, buflen, pnread);
+  if(!result) {
+    if(curlx_dyn_len(&parser->scratch)) {
       /* append detected line to scratch to have the complete line */
-      *err = Curl_dyn_addn(&parser->scratch, parser->line, parser->line_len);
-      if(*err)
-        return -1;
-      parser->line = Curl_dyn_ptr(&parser->scratch);
-      parser->line_len = Curl_dyn_len(&parser->scratch);
+      result = curlx_dyn_addn(&parser->scratch, parser->line,
+                              parser->line_len);
+      if(result)
+        return result;
+      parser->line = curlx_dyn_ptr(&parser->scratch);
+      parser->line_len = curlx_dyn_len(&parser->scratch);
     }
-    *err = trim_line(parser, options);
-    if(*err)
-      return -1;
+    result = trim_line(parser, options);
+    if(result)
+      return result;
   }
-  else if(*err == CURLE_AGAIN) {
+  else if(result == CURLE_AGAIN) {
     /* no line end in `buf`, add it to our scratch */
-    *err = Curl_dyn_addn(&parser->scratch, (const unsigned char *)buf, buflen);
-    nread = (*err)? -1 : (ssize_t)buflen;
+    result = curlx_dyn_addn(&parser->scratch, (const unsigned char *)buf,
+                            buflen);
+    *pnread = buflen;
   }
-  return nread;
+  return result;
 }
 
 static CURLcode start_req(struct h1_req_parser *parser,
-                          const char *scheme_default, int options)
+                          const char *scheme_default,
+                          const char *custom_method,
+                          int options)
 {
-  const char  *p, *m, *target, *hv, *scheme, *authority, *path;
+  const char *p, *m, *target, *hv, *scheme, *authority, *path;
   size_t m_len, target_len, hv_len, scheme_len, authority_len, path_len;
   size_t i;
   CURLU *url = NULL;
@@ -144,9 +141,15 @@ static CURLcode start_req(struct h1_req_parser *parser,
 
   DEBUGASSERT(!parser->req);
   /* line must match: "METHOD TARGET HTTP_VERSION" */
-  p = memchr(parser->line, ' ', parser->line_len);
-  if(!p || p == parser->line)
-    goto out;
+  if(custom_method && custom_method[0] &&
+     !strncmp(custom_method, parser->line, strlen(custom_method))) {
+    p = parser->line + strlen(custom_method);
+  }
+  else {
+    p = memchr(parser->line, ' ', parser->line_len);
+    if(!p || p == parser->line)
+      goto out;
+  }
 
   m = parser->line;
   m_len = p - parser->line;
@@ -167,8 +170,6 @@ static CURLcode start_req(struct h1_req_parser *parser,
   if(!target_len || !hv_len)
     goto out;
 
-  /* TODO: we do not check HTTP_VERSION for conformity, should
-   + do that when STRICT option is supplied. */
   (void)hv;
 
   /* The TARGET can be (rfc 9112, ch. 3.2):
@@ -210,22 +211,22 @@ static CURLcode start_req(struct h1_req_parser *parser,
     path = target;
     path_len = target_len;
 
-    /* URL parser wants 0-termination */
+    /* URL parser wants null-termination */
     if(target_len >= sizeof(tmp))
       goto out;
     memcpy(tmp, target, target_len);
     tmp[target_len] = '\0';
     /* See if treating TARGET as an absolute URL makes sense */
     if(Curl_is_absolute_url(tmp, NULL, 0, FALSE)) {
-      int url_options;
+      unsigned int url_options;
 
       url = curl_url();
       if(!url) {
         result = CURLE_OUT_OF_MEMORY;
         goto out;
       }
-      url_options = (CURLU_NON_SUPPORT_SCHEME|
-                     CURLU_PATH_AS_IS|
+      url_options = (CURLU_NON_SUPPORT_SCHEME |
+                     CURLU_PATH_AS_IS |
                      CURLU_NO_DEFAULT_PORT);
       if(!(options & H1_PARSE_OPT_STRICT))
         url_options |= CURLU_ALLOW_SPACE;
@@ -258,28 +259,33 @@ out:
   return result;
 }
 
-ssize_t Curl_h1_req_parse_read(struct h1_req_parser *parser,
-                               const char *buf, size_t buflen,
-                               const char *scheme_default, int options,
-                               CURLcode *err)
+CURLcode Curl_h1_req_parse_read(struct h1_req_parser *parser,
+                                const uint8_t *buf, size_t buflen,
+                                const char *scheme_default,
+                                const char *custom_method,
+                                int options, size_t *pnread)
 {
-  ssize_t nread = 0, n;
+  CURLcode result = CURLE_OK;
+  size_t nread;
+
+  *pnread = 0;
+
+  DEBUGASSERT(buf);
+  if(!buf)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
 
-  *err = CURLE_OK;
   while(!parser->done) {
-    n = next_line(parser, buf, buflen, options, err);
-    if(n < 0) {
-      if(*err != CURLE_AGAIN) {
-        nread = -1;
-      }
-      *err = CURLE_OK;
+    result = next_line(parser, buf, buflen, options, &nread);
+    if(result) {
+      if(result == CURLE_AGAIN)
+        result = CURLE_OK;
       goto out;
     }
 
     /* Consume this line */
-    nread += (size_t)n;
-    buf += (size_t)n;
-    buflen -= (size_t)n;
+    *pnread += nread;
+    buf += nread;
+    buflen -= nread;
 
     if(!parser->line) {
       /* consumed bytes, but line not complete */
@@ -287,36 +293,55 @@ ssize_t Curl_h1_req_parse_read(struct h1_req_parser *parser,
         goto out;
     }
     else if(!parser->req) {
-      *err = start_req(parser, scheme_default, options);
-      if(*err) {
-        nread = -1;
+      result = start_req(parser, scheme_default, custom_method, options);
+      if(result)
         goto out;
-      }
     }
     else if(parser->line_len == 0) {
       /* last, empty line, we are finished */
       if(!parser->req) {
-        *err = CURLE_URL_MALFORMAT;
-        nread = -1;
+        result = CURLE_URL_MALFORMAT;
         goto out;
       }
       parser->done = TRUE;
-      Curl_dyn_reset(&parser->scratch);
+      curlx_dyn_reset(&parser->scratch);
       /* last chance adjustments */
     }
     else {
-      *err = Curl_dynhds_h1_add_line(&parser->req->headers,
-                                     parser->line, parser->line_len);
-      if(*err) {
-        nread = -1;
+      result = Curl_dynhds_h1_add_line(&parser->req->headers,
+                                       parser->line, parser->line_len);
+      if(result)
         goto out;
-      }
     }
   }
 
 out:
-  return nread;
+  return result;
 }
 
+CURLcode Curl_h1_req_write_head(struct httpreq *req, int http_minor,
+                                struct dynbuf *dbuf)
+{
+  CURLcode result;
+
+  result = curlx_dyn_addf(dbuf, "%s %s%s%s%s HTTP/1.%d\r\n",
+                          req->method,
+                          req->scheme ? req->scheme : "",
+                          req->scheme ? "://" : "",
+                          req->authority ? req->authority : "",
+                          req->path ? req->path : "",
+                          http_minor);
+  if(result)
+    goto out;
+
+  result = Curl_dynhds_h1_dprint(&req->headers, dbuf);
+  if(result)
+    goto out;
+
+  result = curlx_dyn_addn(dbuf, STRCONST("\r\n"));
+
+out:
+  return result;
+}
 
 #endif /* !CURL_DISABLE_HTTP */
diff --git a/third-party/curl/lib/http1.h b/third-party/curl/lib/http1.h
index b1eaa969d9..c2894613de 100644
--- a/third-party/curl/lib/http1.h
+++ b/third-party/curl/lib/http1.h
@@ -23,14 +23,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifndef CURL_DISABLE_HTTP
 #include "bufq.h"
 #include "http.h"
 
-#define H1_PARSE_OPT_NONE       (0)
+#define H1_PARSE_OPT_NONE       0
 #define H1_PARSE_OPT_STRICT     (1 << 0)
 
 #define H1_PARSE_DEFAULT_MAX_LINE_LEN   DYN_HTTP_REQUEST
@@ -42,20 +41,23 @@ struct h1_req_parser {
   const char *line;
   size_t max_line_len;
   size_t line_len;
-  bool done;
+  BIT(done);
 };
 
 void Curl_h1_req_parse_init(struct h1_req_parser *parser, size_t max_line_len);
 void Curl_h1_req_parse_free(struct h1_req_parser *parser);
 
-ssize_t Curl_h1_req_parse_read(struct h1_req_parser *parser,
-                               const char *buf, size_t buflen,
-                               const char *scheme_default, int options,
-                               CURLcode *err);
+CURLcode Curl_h1_req_parse_read(struct h1_req_parser *parser,
+                                const uint8_t *buf, size_t buflen,
+                                const char *scheme_default,
+                                const char *custom_method,
+                                int options, size_t *pnread);
 
 CURLcode Curl_h1_req_dprint(const struct httpreq *req,
                             struct dynbuf *dbuf);
 
+CURLcode Curl_h1_req_write_head(struct httpreq *req, int http_minor,
+                                struct dynbuf *dbuf);
 
 #endif /* !CURL_DISABLE_HTTP */
 #endif /* HEADER_CURL_HTTP1_H */
diff --git a/third-party/curl/lib/http2.c b/third-party/curl/lib/http2.c
index e0cda76d28..a820439ef4 100644
--- a/third-party/curl/lib/http2.c
+++ b/third-party/curl/lib/http2.c
@@ -21,166 +21,110 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#ifdef USE_NGHTTP2
-#include <stdint.h>
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_NGHTTP2)
 #include <nghttp2/nghttp2.h>
+
 #include "urldata.h"
 #include "bufq.h"
+#include "uint-hash.h"
 #include "http1.h"
 #include "http2.h"
 #include "http.h"
 #include "sendf.h"
+#include "curl_trc.h"
 #include "select.h"
-#include "curl_base64.h"
-#include "strcase.h"
+#include "curlx/base64.h"
 #include "multiif.h"
+#include "progress.h"
 #include "url.h"
 #include "urlapi-int.h"
 #include "cfilters.h"
 #include "connect.h"
-#include "rand.h"
-#include "strtoofft.h"
-#include "strdup.h"
 #include "transfer.h"
-#include "dynbuf.h"
+#include "bufref.h"
+#include "curlx/dynbuf.h"
 #include "headers.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
 
-#if (NGHTTP2_VERSION_NUM < 0x010c00)
-#error too old nghttp2 version, upgrade!
+#if NGHTTP2_VERSION_NUM < 0x010f00
+#error "nghttp2 1.15.0 or greater required"
 #endif
 
-#ifdef CURL_DISABLE_VERBOSE_STRINGS
-#define nghttp2_session_callbacks_set_error_callback(x,y)
-#endif
-
-#if (NGHTTP2_VERSION_NUM >= 0x010c00)
 #define NGHTTP2_HAS_SET_LOCAL_WINDOW_SIZE 1
-#endif
-
 
 /* buffer dimensioning:
  * use 16K as chunk size, as that fits H2 DATA frames well */
 #define H2_CHUNK_SIZE           (16 * 1024)
-/* this is how much we want "in flight" for a stream */
-#define H2_STREAM_WINDOW_SIZE   (10 * 1024 * 1024)
+/* connection window size */
+#define H2_CONN_WINDOW_SIZE     (10 * 1024 * 1024)
 /* on receiving from TLS, we prep for holding a full stream window */
-#define H2_NW_RECV_CHUNKS       (H2_STREAM_WINDOW_SIZE / H2_CHUNK_SIZE)
-/* on send into TLS, we just want to accumulate small frames */
+#define H2_NW_RECV_CHUNKS       (H2_CONN_WINDOW_SIZE / H2_CHUNK_SIZE)
+/* on send into TLS, we want to accumulate small frames */
 #define H2_NW_SEND_CHUNKS       1
-/* stream recv/send chunks are a result of window / chunk sizes */
-#define H2_STREAM_RECV_CHUNKS   (H2_STREAM_WINDOW_SIZE / H2_CHUNK_SIZE)
+/* this is how much we want "in flight" for a stream, unthrottled */
+#define H2_STREAM_WINDOW_SIZE_MAX   (10 * 1024 * 1024)
+/* this is how much we want "in flight" for a stream, initially, IFF
+ * nghttp2 allows us to tweak the local window size. */
+#if NGHTTP2_HAS_SET_LOCAL_WINDOW_SIZE
+#define H2_STREAM_WINDOW_SIZE_INITIAL  (64 * 1024)
+#else
+#define H2_STREAM_WINDOW_SIZE_INITIAL H2_STREAM_WINDOW_SIZE_MAX
+#endif
 /* keep smaller stream upload buffer (default h2 window size) to have
  * our progress bars and "upload done" reporting closer to reality */
 #define H2_STREAM_SEND_CHUNKS   ((64 * 1024) / H2_CHUNK_SIZE)
 /* spare chunks we keep for a full window */
-#define H2_STREAM_POOL_SPARES   (H2_STREAM_WINDOW_SIZE / H2_CHUNK_SIZE)
+#define H2_STREAM_POOL_SPARES   (H2_CONN_WINDOW_SIZE / H2_CHUNK_SIZE)
 
-/* We need to accommodate the max number of streams with their window
- * sizes on the overall connection. Streams might become PAUSED which
- * will block their received QUOTA in the connection window. And if we
- * run out of space, the server is blocked from sending us any data.
- * See #10988 for an issue with this. */
-#define HTTP2_HUGE_WINDOW_SIZE (100 * H2_STREAM_WINDOW_SIZE)
+/* We need to accommodate the max number of streams with their window sizes on
+ * the overall connection. Streams might become PAUSED which will block their
+ * received QUOTA in the connection window. If we run out of space, the server
+ * is blocked from sending us any data. See #10988 for an issue with this. */
+#define HTTP2_HUGE_WINDOW_SIZE (100 * H2_STREAM_WINDOW_SIZE_MAX)
 
-#define H2_SETTINGS_IV_LEN  3
+#define H2_SETTINGS_IV_LEN 3
 #define H2_BINSETTINGS_LEN 80
 
-static int populate_settings(nghttp2_settings_entry *iv,
-                             struct Curl_easy *data)
-{
-  iv[0].settings_id = NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS;
-  iv[0].value = Curl_multi_max_concurrent_streams(data->multi);
-
-  iv[1].settings_id = NGHTTP2_SETTINGS_INITIAL_WINDOW_SIZE;
-  iv[1].value = H2_STREAM_WINDOW_SIZE;
-
-  iv[2].settings_id = NGHTTP2_SETTINGS_ENABLE_PUSH;
-  iv[2].value = data->multi->push_cb != NULL;
-
-  return 3;
-}
-
-static size_t populate_binsettings(uint8_t *binsettings,
-                                   struct Curl_easy *data)
-{
-  nghttp2_settings_entry iv[H2_SETTINGS_IV_LEN];
-  int ivlen;
-
-  ivlen = populate_settings(iv, data);
-  /* this returns number of bytes it wrote */
-  return nghttp2_pack_settings_payload(binsettings, H2_BINSETTINGS_LEN,
-                                       iv, ivlen);
-}
-
 struct cf_h2_ctx {
   nghttp2_session *h2;
-  uint32_t max_concurrent_streams;
   /* The easy handle used in the current filter call, cleared at return */
   struct cf_call_data call_data;
 
   struct bufq inbufq;           /* network input */
   struct bufq outbufq;          /* network output */
   struct bufc_pool stream_bufcp; /* spares for stream buffers */
+  struct dynbuf scratch;        /* scratch buffer for temp use */
 
+  struct uint_hash streams; /* hash of `data->mid` to `h2_stream_ctx` */
   size_t drain_total; /* sum of all stream's UrlState drain */
-  int32_t goaway_error;
-  int32_t last_stream_id;
+  uint32_t initial_win_size; /* current initial window size (settings) */
+  uint32_t max_concurrent_streams;
+  uint32_t goaway_error;        /* goaway error code from server */
+  int32_t remote_max_sid;       /* max id processed by server */
+  int32_t local_max_sid;        /* max id processed by us */
+  BIT(initialized);
+  BIT(via_h1_upgrade);
   BIT(conn_closed);
-  BIT(goaway);
+  BIT(rcvd_goaway);
+  BIT(sent_goaway);
   BIT(enable_push);
   BIT(nw_out_blocked);
 };
 
 /* How to access `call_data` from a cf_h2 filter */
 #undef CF_CTX_CALL_DATA
-#define CF_CTX_CALL_DATA(cf)  \
-  ((struct cf_h2_ctx *)(cf)->ctx)->call_data
-
-static void cf_h2_ctx_clear(struct cf_h2_ctx *ctx)
-{
-  struct cf_call_data save = ctx->call_data;
-
-  if(ctx->h2) {
-    nghttp2_session_del(ctx->h2);
-  }
-  Curl_bufq_free(&ctx->inbufq);
-  Curl_bufq_free(&ctx->outbufq);
-  Curl_bufcp_free(&ctx->stream_bufcp);
-  memset(ctx, 0, sizeof(*ctx));
-  ctx->call_data = save;
-}
-
-static void cf_h2_ctx_free(struct cf_h2_ctx *ctx)
-{
-  if(ctx) {
-    cf_h2_ctx_clear(ctx);
-    free(ctx);
-  }
-}
-
-static CURLcode h2_progress_egress(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data);
+#define CF_CTX_CALL_DATA(cf) ((struct cf_h2_ctx *)(cf)->ctx)->call_data
 
 /**
- * All about the H3 internals of a stream
+ * All about the H2 internals of a stream
  */
-struct stream_ctx {
-  /*********** for HTTP/2 we store stream-local data here *************/
-  int32_t id; /* HTTP/2 protocol identifier for stream */
-  struct bufq recvbuf; /* response buffer */
+struct h2_stream_ctx {
   struct bufq sendbuf; /* request buffer */
   struct h1_req_parser h1; /* parsing the request */
   struct dynhds resp_trailers; /* response trailer fields */
   size_t resp_hds_len; /* amount of response header bytes in recvbuf */
-  size_t upload_blocked_len;
-  curl_off_t upload_left; /* number of request bytes left to upload */
+  curl_off_t nrcvd_data;  /* number of DATA bytes received */
 
   char **push_headers;       /* allocated array */
   size_t push_headers_used;  /* number of entries filled in */
@@ -188,147 +132,319 @@ struct stream_ctx {
 
   int status_code; /* HTTP response status code */
   uint32_t error; /* stream error code */
-  uint32_t local_window_size; /* the local recv window size */
-  bool resp_hds_complete; /* we have a complete, final response */
-  bool closed; /* TRUE on stream close */
-  bool reset;  /* TRUE on stream reset */
-  bool close_handled; /* TRUE if stream closure is handled by libcurl */
-  bool bodystarted;
-  bool send_closed; /* transfer is done sending, we might have still
-                        buffered data in stream->sendbuf to upload. */
+  CURLcode xfer_result; /* Result of writing out response */
+  int32_t local_window_size; /* the local recv window size */
+  int32_t id; /* HTTP/2 protocol identifier for stream */
+  BIT(resp_hds_complete); /* we have a complete, final response */
+  BIT(closed); /* TRUE on stream close */
+  BIT(reset);  /* TRUE on stream reset */
+  BIT(reset_by_server);  /* TRUE on stream reset by server */
+  BIT(close_handled); /* TRUE if stream closure is handled by libcurl */
+  BIT(bodystarted);
+  BIT(body_eos);    /* the complete body has been added to `sendbuf` and
+                     * is being/has been processed from there. */
+  BIT(write_paused);  /* stream write is paused */
 };
 
-#define H2_STREAM_CTX(d)    ((struct stream_ctx *)(((d) && (d)->req.p.http)? \
-                             ((struct HTTP *)(d)->req.p.http)->h2_ctx \
-                               : NULL))
-#define H2_STREAM_LCTX(d)   ((struct HTTP *)(d)->req.p.http)->h2_ctx
-#define H2_STREAM_ID(d)     (H2_STREAM_CTX(d)? \
-                             H2_STREAM_CTX(d)->id : -2)
-
-/*
- * Mark this transfer to get "drained".
- */
-static void drain_stream(struct Curl_cfilter *cf,
-                         struct Curl_easy *data,
-                         struct stream_ctx *stream)
+static void free_push_headers(struct h2_stream_ctx *stream)
 {
-  unsigned char bits;
-
-  (void)cf;
-  bits = CURL_CSELECT_IN;
-  if(!stream->send_closed &&
-     (stream->upload_left || stream->upload_blocked_len))
-    bits |= CURL_CSELECT_OUT;
-  if(data->state.dselect_bits != bits) {
-    CURL_TRC_CF(data, cf, "[%d] DRAIN dselect_bits=%x",
-                stream->id, bits);
-    data->state.dselect_bits = bits;
-    Curl_expire(data, 0, EXPIRE_RUN_NOW);
-  }
+  size_t i;
+  for(i = 0; i < stream->push_headers_used; i++)
+    curlx_free(stream->push_headers[i]);
+  curlx_safefree(stream->push_headers);
+  stream->push_headers_used = 0;
 }
 
-static CURLcode http2_data_setup(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data,
-                                 struct stream_ctx **pstream)
+static void h2_stream_ctx_free(struct h2_stream_ctx *stream)
 {
-  struct cf_h2_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream;
+  Curl_bufq_free(&stream->sendbuf);
+  Curl_h1_req_parse_free(&stream->h1);
+  Curl_dynhds_free(&stream->resp_trailers);
+  free_push_headers(stream);
+  curlx_free(stream);
+}
 
-  (void)cf;
-  DEBUGASSERT(data);
-  if(!data->req.p.http) {
-    failf(data, "initialization failure, transfer not http initialized");
-    return CURLE_FAILED_INIT;
-  }
-  stream = H2_STREAM_CTX(data);
-  if(stream) {
-    *pstream = stream;
-    return CURLE_OK;
-  }
+static void h2_stream_hash_free(unsigned int id, void *stream)
+{
+  (void)id;
+  DEBUGASSERT(stream);
+  h2_stream_ctx_free((struct h2_stream_ctx *)stream);
+}
 
-  stream = calloc(1, sizeof(*stream));
+static void cf_h2_ctx_init(struct cf_h2_ctx *ctx, bool via_h1_upgrade)
+{
+  Curl_bufcp_init(&ctx->stream_bufcp, H2_CHUNK_SIZE, H2_STREAM_POOL_SPARES);
+  Curl_bufq_initp(&ctx->inbufq, &ctx->stream_bufcp, H2_NW_RECV_CHUNKS, 0);
+  Curl_bufq_initp(&ctx->outbufq, &ctx->stream_bufcp, H2_NW_SEND_CHUNKS, 0);
+  curlx_dyn_init(&ctx->scratch, CURL_MAX_HTTP_HEADER);
+  Curl_uint32_hash_init(&ctx->streams, 63, h2_stream_hash_free);
+  ctx->remote_max_sid = 2147483647;
+  ctx->via_h1_upgrade = via_h1_upgrade;
+  ctx->initialized = TRUE;
+}
+
+static void cf_h2_ctx_free(struct cf_h2_ctx *ctx)
+{
+  if(ctx && ctx->initialized) {
+    if(ctx->h2)
+      nghttp2_session_del(ctx->h2);
+    Curl_bufq_free(&ctx->inbufq);
+    Curl_bufq_free(&ctx->outbufq);
+    Curl_bufcp_free(&ctx->stream_bufcp);
+    curlx_dyn_free(&ctx->scratch);
+    Curl_uint32_hash_destroy(&ctx->streams);
+    memset(ctx, 0, sizeof(*ctx));
+  }
+  curlx_free(ctx);
+}
+
+static uint32_t cf_h2_initial_win_size(struct Curl_easy *data)
+{
+#if NGHTTP2_HAS_SET_LOCAL_WINDOW_SIZE
+  /* If the transfer has a rate-limit lower than the default initial
+   * stream window size, use that. It needs to be at least 8k or servers
+   * may be unhappy. */
+  curl_off_t rps = Curl_rlimit_per_step(&data->progress.dl.rlimit);
+  if((rps > 0) && (rps < H2_STREAM_WINDOW_SIZE_INITIAL))
+    return CURLMAX((uint32_t)rps, 8192);
+#endif
+  return H2_STREAM_WINDOW_SIZE_INITIAL;
+}
+
+static size_t populate_settings(nghttp2_settings_entry *iv,
+                                struct Curl_easy *data,
+                                struct cf_h2_ctx *ctx)
+{
+  iv[0].settings_id = NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS;
+  iv[0].value = Curl_multi_max_concurrent_streams(data->multi);
+
+  iv[1].settings_id = NGHTTP2_SETTINGS_INITIAL_WINDOW_SIZE;
+  iv[1].value = cf_h2_initial_win_size(data);
+  if(ctx)
+    ctx->initial_win_size = iv[1].value;
+  iv[2].settings_id = NGHTTP2_SETTINGS_ENABLE_PUSH;
+  iv[2].value = !!data->multi->push_cb;
+
+  return 3;
+}
+
+static ssize_t populate_binsettings(uint8_t *binsettings,
+                                    struct Curl_easy *data)
+{
+  nghttp2_settings_entry iv[H2_SETTINGS_IV_LEN];
+  size_t ivlen;
+
+  ivlen = populate_settings(iv, data, NULL);
+  /* this returns number of bytes it wrote or a negative number on error. */
+  return nghttp2_pack_settings_payload(binsettings, H2_BINSETTINGS_LEN,
+                                       iv, ivlen);
+}
+
+static CURLcode cf_h2_update_settings(struct cf_h2_ctx *ctx,
+                                      uint32_t initial_win_size)
+{
+  nghttp2_settings_entry entry;
+  entry.settings_id = NGHTTP2_SETTINGS_INITIAL_WINDOW_SIZE;
+  entry.value = initial_win_size;
+  if(nghttp2_submit_settings(ctx->h2, NGHTTP2_FLAG_NONE, &entry, 1))
+    return CURLE_SEND_ERROR;
+  ctx->initial_win_size = initial_win_size;
+  return CURLE_OK;
+}
+
+#define H2_STREAM_CTX(ctx, data)                                         \
+  ((struct h2_stream_ctx *)(                                             \
+    (data) ? Curl_uint32_hash_get(&(ctx)->streams, (data)->mid) : NULL))
+
+static struct h2_stream_ctx *h2_stream_ctx_create(struct cf_h2_ctx *ctx)
+{
+  struct h2_stream_ctx *stream;
+
+  (void)ctx;
+  stream = curlx_calloc(1, sizeof(*stream));
   if(!stream)
-    return CURLE_OUT_OF_MEMORY;
+    return NULL;
 
   stream->id = -1;
   Curl_bufq_initp(&stream->sendbuf, &ctx->stream_bufcp,
                   H2_STREAM_SEND_CHUNKS, BUFQ_OPT_NONE);
-  Curl_bufq_initp(&stream->recvbuf, &ctx->stream_bufcp,
-                  H2_STREAM_RECV_CHUNKS, BUFQ_OPT_SOFT_LIMIT);
   Curl_h1_req_parse_init(&stream->h1, H1_PARSE_DEFAULT_MAX_LINE_LEN);
   Curl_dynhds_init(&stream->resp_trailers, 0, DYN_HTTP_REQUEST);
-  stream->resp_hds_len = 0;
   stream->bodystarted = FALSE;
   stream->status_code = -1;
   stream->closed = FALSE;
   stream->close_handled = FALSE;
   stream->error = NGHTTP2_NO_ERROR;
-  stream->local_window_size = H2_STREAM_WINDOW_SIZE;
-  stream->upload_left = 0;
+  stream->local_window_size = H2_STREAM_WINDOW_SIZE_INITIAL;
+  stream->nrcvd_data = 0;
+  return stream;
+}
+
+#ifdef NGHTTP2_HAS_SET_LOCAL_WINDOW_SIZE
+static int32_t cf_h2_get_desired_local_win(struct Curl_cfilter *cf,
+                                           struct Curl_easy *data)
+{
+  curl_off_t avail = Curl_rlimit_avail(&data->progress.dl.rlimit,
+                                       Curl_pgrs_now(data));
+
+  (void)cf;
+  if(avail < CURL_OFF_T_MAX) { /* limit in place */
+    if(avail <= 0)
+      return 0;
+    else if(avail < INT32_MAX)
+      return (int32_t)avail;
+  }
+  return H2_STREAM_WINDOW_SIZE_MAX;
+}
+
+static CURLcode cf_h2_update_local_win(struct Curl_cfilter *cf,
+                                       struct Curl_easy *data,
+                                       struct h2_stream_ctx *stream)
+{
+  struct cf_h2_ctx *ctx = cf->ctx;
+  int32_t dwsize;
+  int rv;
+
+  dwsize = (stream->write_paused || stream->xfer_result) ?
+           0 : cf_h2_get_desired_local_win(cf, data);
+  if(dwsize != stream->local_window_size) {
+    int32_t wsize = nghttp2_session_get_stream_effective_local_window_size(
+                      ctx->h2, stream->id);
+    if(dwsize > wsize) {
+      rv = nghttp2_session_set_local_window_size(ctx->h2, NGHTTP2_FLAG_NONE,
+                                                 stream->id, dwsize);
+      if(rv) {
+        failf(data, "[%d] nghttp2 set_local_window_size(%d) failed: "
+              "%s(%d)", stream->id, dwsize, nghttp2_strerror(rv), rv);
+        return CURLE_HTTP2;
+      }
+      rv = nghttp2_submit_window_update(ctx->h2, NGHTTP2_FLAG_NONE,
+                                        stream->id, dwsize - wsize);
+      if(rv) {
+        failf(data, "[%d] nghttp2_submit_window_update() failed: "
+              "%s(%d)", stream->id, nghttp2_strerror(rv), rv);
+        return CURLE_HTTP2;
+      }
+      stream->local_window_size = dwsize;
+      CURL_TRC_CF(data, cf, "[%d] local window update by %d",
+                  stream->id, dwsize - wsize);
+    }
+    else {
+      rv = nghttp2_session_set_local_window_size(ctx->h2, NGHTTP2_FLAG_NONE,
+                                                 stream->id, dwsize);
+      if(rv) {
+        failf(data, "[%d] nghttp2_session_set_local_window_size() failed: "
+              "%s(%d)", stream->id, nghttp2_strerror(rv), rv);
+        return CURLE_HTTP2;
+      }
+      stream->local_window_size = dwsize;
+      CURL_TRC_CF(data, cf, "[%d] local window size now %d",
+                  stream->id, dwsize);
+    }
+  }
+  return CURLE_OK;
+}
+
+#else /* NGHTTP2_HAS_SET_LOCAL_WINDOW_SIZE */
+
+static CURLcode cf_h2_update_local_win(struct Curl_cfilter *cf,
+                                       struct Curl_easy *data,
+                                       struct h2_stream_ctx *stream)
+{
+  (void)cf;
+  (void)data;
+  (void)stream;
+  return CURLE_OK;
+}
+#endif /* !NGHTTP2_HAS_SET_LOCAL_WINDOW_SIZE */
+
+static CURLcode http2_data_setup(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 struct h2_stream_ctx **pstream)
+{
+  struct cf_h2_ctx *ctx = cf->ctx;
+  struct h2_stream_ctx *stream;
+
+  (void)cf;
+  DEBUGASSERT(data);
+
+  if(!data)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  stream = H2_STREAM_CTX(ctx, data);
+  if(stream) {
+    *pstream = stream;
+    return CURLE_OK;
+  }
+
+  stream = h2_stream_ctx_create(ctx);
+  if(!stream)
+    return CURLE_OUT_OF_MEMORY;
+
+  if(!Curl_uint32_hash_set(&ctx->streams, data->mid, stream)) {
+    h2_stream_ctx_free(stream);
+    return CURLE_OUT_OF_MEMORY;
+  }
 
-  H2_STREAM_LCTX(data) = stream;
   *pstream = stream;
   return CURLE_OK;
 }
 
-static void http2_data_done(struct Curl_cfilter *cf,
-                            struct Curl_easy *data, bool premature)
+static CURLcode nw_out_flush(struct Curl_cfilter *cf,
+                             struct Curl_easy *data)
 {
   struct cf_h2_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream = H2_STREAM_CTX(data);
+  size_t nwritten;
+  CURLcode result;
+
+  if(Curl_bufq_is_empty(&ctx->outbufq))
+    return CURLE_OK;
+
+  result = Curl_cf_send_bufq(cf->next, data, &ctx->outbufq, NULL, 0,
+                             &nwritten);
+  if(result) {
+    if(result == CURLE_AGAIN) {
+      CURL_TRC_CF(data, cf, "flush nw send buffer(%zu) -> EAGAIN",
+                  Curl_bufq_len(&ctx->outbufq));
+      ctx->nw_out_blocked = 1;
+    }
+    return result;
+  }
+  return Curl_bufq_is_empty(&ctx->outbufq) ? CURLE_OK : CURLE_AGAIN;
+}
+
+static void http2_data_done(struct Curl_cfilter *cf, struct Curl_easy *data)
+{
+  struct cf_h2_ctx *ctx = cf->ctx;
+  struct h2_stream_ctx *stream = H2_STREAM_CTX(ctx, data);
 
   DEBUGASSERT(ctx);
-  (void)premature;
-  if(!stream)
+  if(!stream || !ctx->initialized)
     return;
 
   if(ctx->h2) {
+    bool flush_egress = FALSE;
+    /* returns error if stream not known, which is fine here */
+    (void)nghttp2_session_set_stream_user_data(ctx->h2, stream->id, NULL);
+
     if(!stream->closed && stream->id > 0) {
       /* RST_STREAM */
       CURL_TRC_CF(data, cf, "[%d] premature DATA_DONE, RST stream",
                   stream->id);
-      if(!nghttp2_submit_rst_stream(ctx->h2, NGHTTP2_FLAG_NONE,
-                                    stream->id, NGHTTP2_STREAM_CLOSED))
-        (void)nghttp2_session_send(ctx->h2);
-    }
-    if(!Curl_bufq_is_empty(&stream->recvbuf)) {
-      /* Anything in the recvbuf is still being counted
-       * in stream and connection window flow control. Need
-       * to free that space or the connection window might get
-       * exhausted eventually. */
-      nghttp2_session_consume(ctx->h2, stream->id,
-                              Curl_bufq_len(&stream->recvbuf));
-      /* give WINDOW_UPATE a chance to be sent, but ignore any error */
-      (void)h2_progress_egress(cf, data);
+      stream->closed = TRUE;
+      stream->reset = TRUE;
+      nghttp2_submit_rst_stream(ctx->h2, NGHTTP2_FLAG_NONE,
+                                stream->id, NGHTTP2_STREAM_CLOSED);
+      flush_egress = TRUE;
     }
 
-    /* -1 means unassigned and 0 means cleared */
-    if(nghttp2_session_get_stream_user_data(ctx->h2, stream->id)) {
-      int rv = nghttp2_session_set_stream_user_data(ctx->h2,
-                                                    stream->id, 0);
-      if(rv) {
-        infof(data, "http/2: failed to clear user_data for stream %u",
-              stream->id);
-        DEBUGASSERT(0);
-      }
+    if(flush_egress) {
+      (void)nghttp2_session_send(ctx->h2);
+      (void)nw_out_flush(cf, data);
     }
   }
 
-  Curl_bufq_free(&stream->sendbuf);
-  Curl_bufq_free(&stream->recvbuf);
-  Curl_h1_req_parse_free(&stream->h1);
-  Curl_dynhds_free(&stream->resp_trailers);
-  if(stream->push_headers) {
-    /* if they weren't used and then freed before */
-    for(; stream->push_headers_used > 0; --stream->push_headers_used) {
-      free(stream->push_headers[stream->push_headers_used - 1]);
-    }
-    free(stream->push_headers);
-    stream->push_headers = NULL;
-  }
-
-  free(stream);
-  H2_STREAM_LCTX(data) = NULL;
+  Curl_uint32_hash_remove(&ctx->streams, data->mid);
 }
 
 static int h2_client_new(struct Curl_cfilter *cf,
@@ -336,186 +452,24 @@ static int h2_client_new(struct Curl_cfilter *cf,
 {
   struct cf_h2_ctx *ctx = cf->ctx;
   nghttp2_option *o;
+  nghttp2_mem mem = { NULL, Curl_nghttp2_malloc, Curl_nghttp2_free,
+                      Curl_nghttp2_calloc, Curl_nghttp2_realloc };
 
   int rc = nghttp2_option_new(&o);
   if(rc)
     return rc;
   /* We handle window updates ourself to enforce buffer limits */
   nghttp2_option_set_no_auto_window_update(o, 1);
-#if NGHTTP2_VERSION_NUM >= 0x013200
-  /* with 1.50.0 */
+#if NGHTTP2_VERSION_NUM >= 0x013200 /* with 1.50.0 */
   /* turn off RFC 9113 leading and trailing white spaces validation against
      HTTP field value. */
   nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation(o, 1);
 #endif
-  rc = nghttp2_session_client_new2(&ctx->h2, cbs, cf, o);
+  rc = nghttp2_session_client_new3(&ctx->h2, cbs, cf, o, &mem);
   nghttp2_option_del(o);
   return rc;
 }
 
-static ssize_t nw_in_reader(void *reader_ctx,
-                              unsigned char *buf, size_t buflen,
-                              CURLcode *err)
-{
-  struct Curl_cfilter *cf = reader_ctx;
-  struct Curl_easy *data = CF_DATA_CURRENT(cf);
-
-  return Curl_conn_cf_recv(cf->next, data, (char *)buf, buflen, err);
-}
-
-static ssize_t nw_out_writer(void *writer_ctx,
-                             const unsigned char *buf, size_t buflen,
-                             CURLcode *err)
-{
-  struct Curl_cfilter *cf = writer_ctx;
-  struct Curl_easy *data = CF_DATA_CURRENT(cf);
-  ssize_t nwritten;
-
-  nwritten = Curl_conn_cf_send(cf->next, data, (const char *)buf, buflen, err);
-  if(nwritten > 0)
-    CURL_TRC_CF(data, cf, "[0] egress: wrote %zd bytes", nwritten);
-  return nwritten;
-}
-
-static ssize_t send_callback(nghttp2_session *h2,
-                             const uint8_t *mem, size_t length, int flags,
-                             void *userp);
-static int on_frame_recv(nghttp2_session *session, const nghttp2_frame *frame,
-                         void *userp);
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-static int on_frame_send(nghttp2_session *session, const nghttp2_frame *frame,
-                         void *userp);
-#endif
-static int on_data_chunk_recv(nghttp2_session *session, uint8_t flags,
-                              int32_t stream_id,
-                              const uint8_t *mem, size_t len, void *userp);
-static int on_stream_close(nghttp2_session *session, int32_t stream_id,
-                           uint32_t error_code, void *userp);
-static int on_begin_headers(nghttp2_session *session,
-                            const nghttp2_frame *frame, void *userp);
-static int on_header(nghttp2_session *session, const nghttp2_frame *frame,
-                     const uint8_t *name, size_t namelen,
-                     const uint8_t *value, size_t valuelen,
-                     uint8_t flags,
-                     void *userp);
-static int error_callback(nghttp2_session *session, const char *msg,
-                          size_t len, void *userp);
-
-/*
- * Initialize the cfilter context
- */
-static CURLcode cf_h2_ctx_init(struct Curl_cfilter *cf,
-                               struct Curl_easy *data,
-                               bool via_h1_upgrade)
-{
-  struct cf_h2_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream;
-  CURLcode result = CURLE_OUT_OF_MEMORY;
-  int rc;
-  nghttp2_session_callbacks *cbs = NULL;
-
-  DEBUGASSERT(!ctx->h2);
-  Curl_bufcp_init(&ctx->stream_bufcp, H2_CHUNK_SIZE, H2_STREAM_POOL_SPARES);
-  Curl_bufq_initp(&ctx->inbufq, &ctx->stream_bufcp, H2_NW_RECV_CHUNKS, 0);
-  Curl_bufq_initp(&ctx->outbufq, &ctx->stream_bufcp, H2_NW_SEND_CHUNKS, 0);
-  ctx->last_stream_id = 2147483647;
-
-  rc = nghttp2_session_callbacks_new(&cbs);
-  if(rc) {
-    failf(data, "Couldn't initialize nghttp2 callbacks");
-    goto out;
-  }
-
-  nghttp2_session_callbacks_set_send_callback(cbs, send_callback);
-  nghttp2_session_callbacks_set_on_frame_recv_callback(cbs, on_frame_recv);
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-  nghttp2_session_callbacks_set_on_frame_send_callback(cbs, on_frame_send);
-#endif
-  nghttp2_session_callbacks_set_on_data_chunk_recv_callback(
-    cbs, on_data_chunk_recv);
-  nghttp2_session_callbacks_set_on_stream_close_callback(cbs, on_stream_close);
-  nghttp2_session_callbacks_set_on_begin_headers_callback(
-    cbs, on_begin_headers);
-  nghttp2_session_callbacks_set_on_header_callback(cbs, on_header);
-  nghttp2_session_callbacks_set_error_callback(cbs, error_callback);
-
-  /* The nghttp2 session is not yet setup, do it */
-  rc = h2_client_new(cf, cbs);
-  if(rc) {
-    failf(data, "Couldn't initialize nghttp2");
-    goto out;
-  }
-  ctx->max_concurrent_streams = DEFAULT_MAX_CONCURRENT_STREAMS;
-
-  if(via_h1_upgrade) {
-    /* HTTP/1.1 Upgrade issued. H2 Settings have already been submitted
-     * in the H1 request and we upgrade from there. This stream
-     * is opened implicitly as #1. */
-    uint8_t binsettings[H2_BINSETTINGS_LEN];
-    size_t  binlen; /* length of the binsettings data */
-
-    binlen = populate_binsettings(binsettings, data);
-
-    result = http2_data_setup(cf, data, &stream);
-    if(result)
-      goto out;
-    DEBUGASSERT(stream);
-    stream->id = 1;
-    /* queue SETTINGS frame (again) */
-    rc = nghttp2_session_upgrade2(ctx->h2, binsettings, binlen,
-                                  data->state.httpreq == HTTPREQ_HEAD,
-                                  NULL);
-    if(rc) {
-      failf(data, "nghttp2_session_upgrade2() failed: %s(%d)",
-            nghttp2_strerror(rc), rc);
-      result = CURLE_HTTP2;
-      goto out;
-    }
-
-    rc = nghttp2_session_set_stream_user_data(ctx->h2, stream->id,
-                                              data);
-    if(rc) {
-      infof(data, "http/2: failed to set user_data for stream %u",
-            stream->id);
-      DEBUGASSERT(0);
-    }
-    CURL_TRC_CF(data, cf, "created session via Upgrade");
-  }
-  else {
-    nghttp2_settings_entry iv[H2_SETTINGS_IV_LEN];
-    int ivlen;
-
-    ivlen = populate_settings(iv, data);
-    rc = nghttp2_submit_settings(ctx->h2, NGHTTP2_FLAG_NONE,
-                                 iv, ivlen);
-    if(rc) {
-      failf(data, "nghttp2_submit_settings() failed: %s(%d)",
-            nghttp2_strerror(rc), rc);
-      result = CURLE_HTTP2;
-      goto out;
-    }
-  }
-
-  rc = nghttp2_session_set_local_window_size(ctx->h2, NGHTTP2_FLAG_NONE, 0,
-                                             HTTP2_HUGE_WINDOW_SIZE);
-  if(rc) {
-    failf(data, "nghttp2_session_set_local_window_size() failed: %s(%d)",
-          nghttp2_strerror(rc), rc);
-    result = CURLE_HTTP2;
-    goto out;
-  }
-
-  /* all set, traffic will be send on connect */
-  result = CURLE_OK;
-  CURL_TRC_CF(data, cf, "[0] created h2 session%s",
-              via_h1_upgrade? " (via h1 upgrade)" : "");
-
-out:
-  if(cbs)
-    nghttp2_session_callbacks_del(cbs);
-  return result;
-}
-
 /*
  * Returns nonzero if current HTTP/2 session should be closed.
  */
@@ -530,26 +484,21 @@ static int should_close_session(struct cf_h2_ctx *ctx)
  * This function returns 0 if it succeeds, or -1 and error code will
  * be assigned to *err.
  */
-static int h2_process_pending_input(struct Curl_cfilter *cf,
-                                    struct Curl_easy *data,
-                                    CURLcode *err)
+static CURLcode h2_process_pending_input(struct Curl_cfilter *cf,
+                                         struct Curl_easy *data)
 {
   struct cf_h2_ctx *ctx = cf->ctx;
   const unsigned char *buf;
-  size_t blen;
+  size_t blen, nread;
   ssize_t rv;
 
   while(Curl_bufq_peek(&ctx->inbufq, &buf, &blen)) {
-
     rv = nghttp2_session_mem_recv(ctx->h2, (const uint8_t *)buf, blen);
-    if(rv < 0) {
-      failf(data,
-            "process_pending_input: nghttp2_session_mem_recv() returned "
-            "%zd:%s", rv, nghttp2_strerror((int)rv));
-      *err = CURLE_RECV_ERROR;
-      return -1;
+    if(!curlx_sztouz(rv, &nread)) {
+      failf(data, "nghttp2 recv error %zd: %s", rv, nghttp2_strerror((int)rv));
+      return CURLE_HTTP2;
     }
-    Curl_bufq_skip(&ctx->inbufq, (size_t)rv);
+    Curl_bufq_skip(&ctx->inbufq, nread);
     if(Curl_bufq_is_empty(&ctx->inbufq)) {
       break;
     }
@@ -567,12 +516,12 @@ static int h2_process_pending_input(struct Curl_cfilter *cf,
     connclose(cf->conn, "http/2: No new requests allowed");
   }
 
-  return 0;
+  return CURLE_OK;
 }
 
 /*
- * The server may send us data at any point (e.g. PING frames). Therefore,
- * we cannot assume that an HTTP/2 socket is dead just because it is readable.
+ * The server may send us data at any point (e.g. PING frames). Therefore, we
+ * cannot assume that an HTTP/2 socket is dead because it is readable.
  *
  * Check the lower filters first and, if successful, peek at the socket
  * and distinguish between closed and data.
@@ -588,18 +537,19 @@ static bool http2_connisalive(struct Curl_cfilter *cf, struct Curl_easy *data,
     return FALSE;
 
   if(*input_pending) {
-    /* This happens before we've sent off a request and the connection is
-       not in use by any other transfer, there shouldn't be any data here,
+    /* This happens before we have sent off a request and the connection is
+       not in use by any other transfer, there should not be any data here,
        only "protocol frames" */
     CURLcode result;
-    ssize_t nread = -1;
+    size_t nread;
 
     *input_pending = FALSE;
-    nread = Curl_bufq_slurp(&ctx->inbufq, nw_in_reader, cf, &result);
-    if(nread != -1) {
-      CURL_TRC_CF(data, cf, "%zd bytes stray data read before trying "
+    result = Curl_cf_recv_bufq(cf->next, data, &ctx->inbufq, 0, &nread);
+    if(!result) {
+      CURL_TRC_CF(data, cf, "%zu bytes stray data read before trying "
                   "h2 connection", nread);
-      if(h2_process_pending_input(cf, data, &result) < 0)
+      result = h2_process_pending_input(cf, data);
+      if(result)
         /* immediate error, considered dead */
         alive = FALSE;
       else {
@@ -625,7 +575,7 @@ static CURLcode http2_send_ping(struct Curl_cfilter *cf,
   if(rc) {
     failf(data, "nghttp2_submit_ping() failed: %s(%d)",
           nghttp2_strerror(rc), rc);
-   return CURLE_HTTP2;
+    return CURLE_HTTP2;
   }
 
   rc = nghttp2_session_send(ctx->h2);
@@ -643,30 +593,7 @@ static CURLcode http2_send_ping(struct Curl_cfilter *cf,
 void Curl_http2_ver(char *p, size_t len)
 {
   nghttp2_info *h2 = nghttp2_version(0);
-  (void)msnprintf(p, len, "nghttp2/%s", h2->version_str);
-}
-
-static CURLcode nw_out_flush(struct Curl_cfilter *cf,
-                             struct Curl_easy *data)
-{
-  struct cf_h2_ctx *ctx = cf->ctx;
-  ssize_t nwritten;
-  CURLcode result;
-
-  (void)data;
-  if(Curl_bufq_is_empty(&ctx->outbufq))
-    return CURLE_OK;
-
-  nwritten = Curl_bufq_pass(&ctx->outbufq, nw_out_writer, cf, &result);
-  if(nwritten < 0) {
-    if(result == CURLE_AGAIN) {
-      CURL_TRC_CF(data, cf, "flush nw send buffer(%zu) -> EAGAIN",
-                  Curl_bufq_len(&ctx->outbufq));
-      ctx->nw_out_blocked = 1;
-    }
-    return result;
-  }
-  return Curl_bufq_is_empty(&ctx->outbufq)? CURLE_OK: CURLE_AGAIN;
+  (void)curl_msnprintf(p, len, "nghttp2/%s", h2->version_str);
 }
 
 /*
@@ -681,16 +608,20 @@ static ssize_t send_callback(nghttp2_session *h2,
   struct Curl_cfilter *cf = userp;
   struct cf_h2_ctx *ctx = cf->ctx;
   struct Curl_easy *data = CF_DATA_CURRENT(cf);
-  ssize_t nwritten;
+  size_t nwritten;
   CURLcode result = CURLE_OK;
 
   (void)h2;
   (void)flags;
   DEBUGASSERT(data);
 
-  nwritten = Curl_bufq_write_pass(&ctx->outbufq, buf, blen,
-                                  nw_out_writer, cf, &result);
-  if(nwritten < 0) {
+  if(!cf->connected)
+    result = Curl_bufq_write(&ctx->outbufq, buf, blen, &nwritten);
+  else
+    result = Curl_cf_send_bufq(cf->next, data, &ctx->outbufq, buf, blen,
+                               &nwritten);
+
+  if(result) {
     if(result == CURLE_AGAIN) {
       ctx->nw_out_blocked = 1;
       return NGHTTP2_ERR_WOULDBLOCK;
@@ -703,14 +634,15 @@ static ssize_t send_callback(nghttp2_session *h2,
     ctx->nw_out_blocked = 1;
     return NGHTTP2_ERR_WOULDBLOCK;
   }
-  return nwritten;
+  return (nwritten > SSIZE_MAX) ?
+    NGHTTP2_ERR_CALLBACK_FAILURE : (ssize_t)nwritten;
 }
 
-
 /* We pass a pointer to this struct in the push callback, but the contents of
    the struct are hidden from the user. */
 struct curl_pushheaders {
   struct Curl_easy *data;
+  struct h2_stream_ctx *stream;
   const nghttp2_push_promise *frame;
 };
 
@@ -724,9 +656,8 @@ char *curl_pushheader_bynum(struct curl_pushheaders *h, size_t num)
   if(!h || !GOOD_EASY_HANDLE(h->data))
     return NULL;
   else {
-    struct stream_ctx *stream = H2_STREAM_CTX(h->data);
-    if(stream && num < stream->push_headers_used)
-      return stream->push_headers[num];
+    if(h->stream && num < h->stream->push_headers_used)
+      return h->stream->push_headers[num];
   }
   return NULL;
 }
@@ -734,28 +665,28 @@ char *curl_pushheader_bynum(struct curl_pushheaders *h, size_t num)
 /*
  * push header access function. Only to be used from within the push callback
  */
-char *curl_pushheader_byname(struct curl_pushheaders *h, const char *header)
+char *curl_pushheader_byname(struct curl_pushheaders *h, const char *name)
 {
-  struct stream_ctx *stream;
+  struct h2_stream_ctx *stream;
   size_t len;
   size_t i;
   /* Verify that we got a good easy handle in the push header struct,
      mostly to detect rubbish input fast(er). Also empty header name
-     is just a rubbish too. We have to allow ":" at the beginning of
+     is rubbish too. We have to allow ":" at the beginning of
      the header, but header == ":" must be rejected. If we have ':' in
      the middle of header, it could be matched in middle of the value,
      this is because we do prefix match.*/
-  if(!h || !GOOD_EASY_HANDLE(h->data) || !header || !header[0] ||
-     !strcmp(header, ":") || strchr(header + 1, ':'))
+  if(!h || !GOOD_EASY_HANDLE(h->data) || !name || !name[0] ||
+     !strcmp(name, ":") || strchr(name + 1, ':'))
     return NULL;
 
-  stream = H2_STREAM_CTX(h->data);
+  stream = h->stream;
   if(!stream)
     return NULL;
 
-  len = strlen(header);
-  for(i = 0; i<stream->push_headers_used; i++) {
-    if(!strncmp(header, stream->push_headers[i], len)) {
+  len = strlen(name);
+  for(i = 0; i < stream->push_headers_used; i++) {
+    if(!strncmp(name, stream->push_headers[i], len)) {
       /* sub-match, make sure that it is followed by a colon */
       if(stream->push_headers[i][len] != ':')
         continue;
@@ -770,24 +701,16 @@ static struct Curl_easy *h2_duphandle(struct Curl_cfilter *cf,
 {
   struct Curl_easy *second = curl_easy_duphandle(data);
   if(second) {
-    /* setup the request struct */
-    struct HTTP *http = calloc(1, sizeof(struct HTTP));
-    if(!http) {
-      (void)Curl_close(&second);
-    }
-    else {
-      struct stream_ctx *second_stream;
-
-      second->req.p.http = http;
-      http2_data_setup(cf, second, &second_stream);
-      second->state.priority.weight = data->state.priority.weight;
-    }
+    struct h2_stream_ctx *second_stream;
+    http2_data_setup(cf, second, &second_stream);
+    second->state.priority.weight = data->state.priority.weight;
   }
   return second;
 }
 
-static int set_transfer_url(struct Curl_easy *data,
-                            struct curl_pushheaders *hp)
+static int set_transfer_url(struct Curl_easy *newhandle,
+                            struct curl_pushheaders *hp,
+                            struct Curl_easy *data)
 {
   const char *v;
   CURLUcode uc;
@@ -809,7 +732,7 @@ static int set_transfer_url(struct Curl_easy *data,
 
   v = curl_pushheader_byname(hp, HTTP_PSEUDO_AUTHORITY);
   if(v) {
-    uc = Curl_url_set_authority(u, v, CURLU_DISALLOW_USER);
+    uc = Curl_url_set_authority(u, v);
     if(uc) {
       rc = 2;
       goto fail;
@@ -825,6 +748,13 @@ static int set_transfer_url(struct Curl_easy *data,
     }
   }
 
+  /* We can only allow PUSH of resource from the same origin, e.g.
+   * scheme + hostname + port */
+  if(!Curl_url_same_origin(data->state.uh, u)) {
+    rc = 1;
+    goto fail;
+  }
+
   uc = curl_url_get(u, CURLUPART_URL, &url, 0);
   if(uc)
     rc = 4;
@@ -833,20 +763,14 @@ fail:
   if(rc)
     return rc;
 
-  if(data->state.url_alloc)
-    free(data->state.url);
-  data->state.url_alloc = TRUE;
-  data->state.url = url;
+  Curl_bufref_set(&newhandle->state.url, url, 0, curl_free);
   return 0;
 }
 
 static void discard_newhandle(struct Curl_cfilter *cf,
                               struct Curl_easy *newhandle)
 {
-  if(!newhandle->req.p.http) {
-    http2_data_done(cf, newhandle, TRUE);
-    newhandle->req.p.http = NULL;
-  }
+  http2_data_done(cf, newhandle);
   (void)Curl_close(&newhandle);
 }
 
@@ -860,12 +784,11 @@ static int push_promise(struct Curl_cfilter *cf,
   CURL_TRC_CF(data, cf, "[%d] PUSH_PROMISE received",
               frame->promised_stream_id);
   if(data->multi->push_cb) {
-    struct stream_ctx *stream;
-    struct stream_ctx *newstream;
+    struct h2_stream_ctx *stream;
+    struct h2_stream_ctx *newstream;
     struct curl_pushheaders heads;
-    CURLMcode rc;
+    CURLMcode mresult;
     CURLcode result;
-    size_t i;
     /* clone the parent */
     struct Curl_easy *newhandle = h2_duphandle(cf, data);
     if(!newhandle) {
@@ -874,12 +797,7 @@ static int push_promise(struct Curl_cfilter *cf,
       goto fail;
     }
 
-    heads.data = data;
-    heads.frame = frame;
-    /* ask the application */
-    CURL_TRC_CF(data, cf, "Got PUSH_PROMISE, ask application");
-
-    stream = H2_STREAM_CTX(data);
+    stream = H2_STREAM_CTX(ctx, data);
     if(!stream) {
       failf(data, "Internal NULL stream");
       discard_newhandle(cf, newhandle);
@@ -887,8 +805,43 @@ static int push_promise(struct Curl_cfilter *cf,
       goto fail;
     }
 
-    rv = set_transfer_url(newhandle, &heads);
+    heads.data = data;
+    heads.stream = stream;
+    heads.frame = frame;
+
+    rv = set_transfer_url(newhandle, &heads, data);
     if(rv) {
+      CURL_TRC_CF(data, cf, "[%d] PUSH_PROMISE, failed to set URL -> %d",
+                  frame->promised_stream_id, rv);
+      discard_newhandle(cf, newhandle);
+      rv = CURL_PUSH_DENY;
+      goto fail;
+    }
+
+    Curl_set_in_callback(data, TRUE);
+    rv = data->multi->push_cb(data, newhandle,
+                              stream->push_headers_used, &heads,
+                              data->multi->push_userp);
+    Curl_set_in_callback(data, FALSE);
+
+    /* free the headers again */
+    free_push_headers(stream);
+
+    if(rv) {
+      DEBUGASSERT((rv > CURL_PUSH_OK) && (rv <= CURL_PUSH_ERROROUT));
+      /* denied, kill off the new handle again */
+      CURL_TRC_CF(data, cf, "[%d] PUSH_PROMISE, denied by application -> %d",
+                  frame->promised_stream_id, rv);
+      discard_newhandle(cf, newhandle);
+      goto fail;
+    }
+
+    /* approved, add to the multi handle for processing. This
+     * assigns newhandle->mid. For the new `mid` we assign the
+     * h2_stream instance and remember the stream_id already known. */
+    mresult = Curl_multi_add_perform(data->multi, newhandle, cf->conn);
+    if(mresult) {
+      infof(data, "failed to add handle to multi");
       discard_newhandle(cf, newhandle);
       rv = CURL_PUSH_DENY;
       goto fail;
@@ -896,57 +849,34 @@ static int push_promise(struct Curl_cfilter *cf,
 
     result = http2_data_setup(cf, newhandle, &newstream);
     if(result) {
-      failf(data, "error setting up stream: %d", result);
+      failf(data, "error setting up stream: %d", (int)result);
       discard_newhandle(cf, newhandle);
       rv = CURL_PUSH_DENY;
       goto fail;
     }
-    DEBUGASSERT(stream);
-
-    Curl_set_in_callback(data, true);
-    rv = data->multi->push_cb(data, newhandle,
-                              stream->push_headers_used, &heads,
-                              data->multi->push_userp);
-    Curl_set_in_callback(data, false);
-
-    /* free the headers again */
-    for(i = 0; i<stream->push_headers_used; i++)
-      free(stream->push_headers[i]);
-    free(stream->push_headers);
-    stream->push_headers = NULL;
-    stream->push_headers_used = 0;
-
-    if(rv) {
-      DEBUGASSERT((rv > CURL_PUSH_OK) && (rv <= CURL_PUSH_ERROROUT));
-      /* denied, kill off the new handle again */
-      discard_newhandle(cf, newhandle);
-      goto fail;
-    }
 
+    DEBUGASSERT(newstream);
     newstream->id = frame->promised_stream_id;
     newhandle->req.maxdownload = -1;
     newhandle->req.size = -1;
 
-    /* approved, add to the multi handle and immediately switch to PERFORM
-       state with the given connection !*/
-    rc = Curl_multi_add_perform(data->multi, newhandle, cf->conn);
-    if(rc) {
-      infof(data, "failed to add handle to multi");
+    CURL_TRC_CF(data, cf, "promise easy handle added to multi, mid=%u",
+                newhandle->mid);
+    rv = nghttp2_session_set_stream_user_data(ctx->h2,
+                                              newstream->id,
+                                              newhandle);
+    if(rv) {
+      infof(data, "failed to set user_data for stream %d",
+            newstream->id);
+      DEBUGASSERT(0);
       discard_newhandle(cf, newhandle);
       rv = CURL_PUSH_DENY;
       goto fail;
     }
 
-    rv = nghttp2_session_set_stream_user_data(ctx->h2,
-                                              newstream->id,
-                                              newhandle);
-    if(rv) {
-      infof(data, "failed to set user_data for stream %u",
-            newstream->id);
-      DEBUGASSERT(0);
-      rv = CURL_PUSH_DENY;
-      goto fail;
-    }
+    /* success, remember max stream id processed */
+    if(newstream->id > ctx->local_max_sid)
+      ctx->local_max_sid = newstream->id;
   }
   else {
     CURL_TRC_CF(data, cf, "Got PUSH_PROMISE, ignore it");
@@ -956,22 +886,50 @@ fail:
   return rv;
 }
 
-static CURLcode recvbuf_write_hds(struct Curl_cfilter *cf,
+static void h2_xfer_write_resp_hd(struct Curl_cfilter *cf,
                                   struct Curl_easy *data,
-                                  const char *buf, size_t blen)
+                                  struct h2_stream_ctx *stream,
+                                  const char *buf, size_t blen, bool eos)
 {
-  struct stream_ctx *stream = H2_STREAM_CTX(data);
-  ssize_t nwritten;
-  CURLcode result;
+  /* If we already encountered an error, skip further writes */
+  if(!stream->xfer_result) {
+    stream->xfer_result = Curl_xfer_write_resp_hd(data, buf, blen, eos);
+    if(!stream->xfer_result && !eos)
+      stream->xfer_result = cf_h2_update_local_win(cf, data, stream);
+    if(stream->xfer_result)
+      CURL_TRC_CF(data, cf, "[%d] error %d writing %zu bytes of headers",
+                  stream->id, (int)stream->xfer_result, blen);
+  }
+}
 
-  (void)cf;
-  nwritten = Curl_bufq_write(&stream->recvbuf,
-                             (const unsigned char *)buf, blen, &result);
-  if(nwritten < 0)
-    return result;
-  stream->resp_hds_len += (size_t)nwritten;
-  DEBUGASSERT((size_t)nwritten == blen);
-  return CURLE_OK;
+static void h2_xfer_write_resp(struct Curl_cfilter *cf,
+                               struct Curl_easy *data,
+                               struct h2_stream_ctx *stream,
+                               const char *buf, size_t blen, bool eos)
+{
+  /* If we already encountered an error, skip further writes */
+  if(!stream->xfer_result)
+    stream->xfer_result = Curl_xfer_write_resp(data, buf, blen, eos);
+  /* If the transfer write is errored, we do not want any more data */
+  if(stream->xfer_result) {
+    struct cf_h2_ctx *ctx = cf->ctx;
+    CURL_TRC_CF(data, cf, "[%d] error %d writing %zu bytes of data, "
+                "RST-ing stream",
+                stream->id, (int)stream->xfer_result, blen);
+    nghttp2_submit_rst_stream(ctx->h2, 0, stream->id,
+                              (uint32_t)NGHTTP2_ERR_CALLBACK_FAILURE);
+  }
+  else if(!stream->write_paused && Curl_xfer_write_is_paused(data)) {
+    CURL_TRC_CF(data, cf, "[%d] stream output paused", stream->id);
+    stream->write_paused = TRUE;
+  }
+  else if(stream->write_paused && !Curl_xfer_write_is_paused(data)) {
+    CURL_TRC_CF(data, cf, "[%d] stream output unpaused", stream->id);
+    stream->write_paused = FALSE;
+  }
+
+  if(!stream->xfer_result && !eos)
+    stream->xfer_result = cf_h2_update_local_win(cf, data, stream);
 }
 
 static CURLcode on_stream_frame(struct Curl_cfilter *cf,
@@ -979,10 +937,8 @@ static CURLcode on_stream_frame(struct Curl_cfilter *cf,
                                 const nghttp2_frame *frame)
 {
   struct cf_h2_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream = H2_STREAM_CTX(data);
+  struct h2_stream_ctx *stream = H2_STREAM_CTX(ctx, data);
   int32_t stream_id = frame->hd.stream_id;
-  CURLcode result;
-  size_t rbuflen;
   int rv;
 
   if(!stream) {
@@ -992,9 +948,8 @@ static CURLcode on_stream_frame(struct Curl_cfilter *cf,
 
   switch(frame->hd.type) {
   case NGHTTP2_DATA:
-    rbuflen = Curl_bufq_len(&stream->recvbuf);
-    CURL_TRC_CF(data, cf, "[%d] DATA, buffered=%zu, window=%d/%d",
-                stream_id, rbuflen,
+    CURL_TRC_CF(data, cf, "[%d] DATA, window=%d/%d",
+                stream_id,
                 nghttp2_session_get_stream_effective_recv_data_length(
                   ctx->h2, stream->id),
                 nghttp2_session_get_stream_effective_local_window_size(
@@ -1008,27 +963,10 @@ static CURLcode on_stream_frame(struct Curl_cfilter *cf,
         return CURLE_RECV_ERROR;
       }
     }
-    if(frame->hd.flags & NGHTTP2_FLAG_END_STREAM) {
-      drain_stream(cf, data, stream);
-    }
-    else if(rbuflen > stream->local_window_size) {
-      int32_t wsize = nghttp2_session_get_stream_local_window_size(
-                        ctx->h2, stream->id);
-      if(wsize > 0 && (uint32_t)wsize != stream->local_window_size) {
-        /* H2 flow control is not absolute, as the server might not have the
-         * same view, yet. When we receive more than we want, we enforce
-         * the local window size again to make nghttp2 send WINDOW_UPATEs
-         * accordingly. */
-        nghttp2_session_set_local_window_size(ctx->h2,
-                                              NGHTTP2_FLAG_NONE,
-                                              stream->id,
-                                              stream->local_window_size);
-      }
-    }
     break;
   case NGHTTP2_HEADERS:
     if(stream->bodystarted) {
-      /* Only valid HEADERS after body started is trailer HEADERS.  We
+      /* Only valid HEADERS after body started is trailer HEADERS. We
          buffer them in on_header callback. */
       break;
     }
@@ -1040,19 +978,18 @@ static CURLcode on_stream_frame(struct Curl_cfilter *cf,
       return CURLE_RECV_ERROR;
 
     /* Only final status code signals the end of header */
-    if(stream->status_code / 100 != 1) {
+    if(stream->status_code / 100 != 1)
       stream->bodystarted = TRUE;
+    else
       stream->status_code = -1;
-    }
 
-    result = recvbuf_write_hds(cf, data, STRCONST("\r\n"));
-    if(result)
-      return result;
+    h2_xfer_write_resp_hd(cf, data, stream, STRCONST("\r\n"),
+                          (bool)stream->closed);
 
     if(stream->status_code / 100 != 1) {
       stream->resp_hds_complete = TRUE;
     }
-    drain_stream(cf, data, stream);
+    Curl_multi_mark_dirty(data);
     break;
   case NGHTTP2_PUSH_PROMISE:
     rv = push_promise(cf, data, &frame->push_promise);
@@ -1071,98 +1008,113 @@ static CURLcode on_stream_frame(struct Curl_cfilter *cf,
     }
     break;
   case NGHTTP2_RST_STREAM:
-    stream->closed = TRUE;
-    if(frame->rst_stream.error_code) {
-      stream->reset = TRUE;
-    }
-    stream->send_closed = TRUE;
-    data->req.keepon &= ~KEEP_SEND_HOLD;
-    drain_stream(cf, data, stream);
+    if(frame->rst_stream.error_code)
+      stream->reset_by_server = TRUE;
+    Curl_multi_mark_dirty(data);
     break;
   case NGHTTP2_WINDOW_UPDATE:
-    if((data->req.keepon & KEEP_SEND_HOLD) &&
-       (data->req.keepon & KEEP_SEND)) {
-      data->req.keepon &= ~KEEP_SEND_HOLD;
-      drain_stream(cf, data, stream);
-      CURL_TRC_CF(data, cf, "[%d] un-holding after win update",
-                  stream_id);
+    if(CURL_REQ_WANT_SEND(data) && Curl_bufq_is_empty(&stream->sendbuf)) {
+      /* need more data, force processing of transfer */
+      Curl_multi_mark_dirty(data);
+    }
+    else if(!Curl_bufq_is_empty(&stream->sendbuf)) {
+      /* resume the potentially suspended stream */
+      rv = nghttp2_session_resume_data(ctx->h2, stream->id);
+      if(nghttp2_is_fatal(rv))
+        return CURLE_SEND_ERROR;
     }
     break;
   default:
     break;
   }
+
+  if(frame->hd.flags & NGHTTP2_FLAG_END_STREAM) {
+    if(!stream->closed && !stream->body_eos &&
+       ((stream->status_code >= 400) || (stream->status_code < 200))) {
+      /* The server did not give us a positive response and we are not
+       * done uploading the request body. We need to stop doing that and
+       * also inform the server that we aborted our side. */
+      CURL_TRC_CF(data, cf, "[%d] EOS frame with unfinished upload and "
+                  "HTTP status %d, abort upload by RST",
+                  stream_id, stream->status_code);
+      nghttp2_submit_rst_stream(ctx->h2, NGHTTP2_FLAG_NONE,
+                                stream->id, NGHTTP2_STREAM_CLOSED);
+      stream->closed = TRUE;
+    }
+    Curl_multi_mark_dirty(data);
+  }
   return CURLE_OK;
 }
 
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-static int fr_print(const nghttp2_frame *frame, char *buffer, size_t blen)
+#ifdef CURLVERBOSE
+int Curl_nghttp2_fr_print(const nghttp2_frame *frame, char *buffer,
+                          size_t blen)
 {
   switch(frame->hd.type) {
-    case NGHTTP2_DATA: {
-      return msnprintf(buffer, blen,
-                       "FRAME[DATA, len=%d, eos=%d, padlen=%d]",
-                       (int)frame->hd.length,
-                       !!(frame->hd.flags & NGHTTP2_FLAG_END_STREAM),
-                       (int)frame->data.padlen);
+  case NGHTTP2_DATA: {
+    return curl_msnprintf(buffer, blen,
+                          "FRAME[DATA, len=%d, eos=%d, padlen=%d]",
+                          (int)frame->hd.length,
+                          !!(frame->hd.flags & NGHTTP2_FLAG_END_STREAM),
+                          (int)frame->data.padlen);
+  }
+  case NGHTTP2_HEADERS: {
+    return curl_msnprintf(buffer, blen,
+                          "FRAME[HEADERS, len=%d, hend=%d, eos=%d]",
+                          (int)frame->hd.length,
+                          !!(frame->hd.flags & NGHTTP2_FLAG_END_HEADERS),
+                          !!(frame->hd.flags & NGHTTP2_FLAG_END_STREAM));
+  }
+  case NGHTTP2_PRIORITY: {
+    return curl_msnprintf(buffer, blen,
+                          "FRAME[PRIORITY, len=%d, flags=%d]",
+                          (int)frame->hd.length, frame->hd.flags);
+  }
+  case NGHTTP2_RST_STREAM: {
+    return curl_msnprintf(buffer, blen,
+                          "FRAME[RST_STREAM, len=%d, flags=%d, error=%u]",
+                          (int)frame->hd.length, frame->hd.flags,
+                          frame->rst_stream.error_code);
+  }
+  case NGHTTP2_SETTINGS: {
+    if(frame->hd.flags & NGHTTP2_FLAG_ACK) {
+      return curl_msnprintf(buffer, blen, "FRAME[SETTINGS, ack=1]");
     }
-    case NGHTTP2_HEADERS: {
-      return msnprintf(buffer, blen,
-                       "FRAME[HEADERS, len=%d, hend=%d, eos=%d]",
-                       (int)frame->hd.length,
-                       !!(frame->hd.flags & NGHTTP2_FLAG_END_HEADERS),
-                       !!(frame->hd.flags & NGHTTP2_FLAG_END_STREAM));
-    }
-    case NGHTTP2_PRIORITY: {
-      return msnprintf(buffer, blen,
-                       "FRAME[PRIORITY, len=%d, flags=%d]",
-                       (int)frame->hd.length, frame->hd.flags);
-    }
-    case NGHTTP2_RST_STREAM: {
-      return msnprintf(buffer, blen,
-                       "FRAME[RST_STREAM, len=%d, flags=%d, error=%u]",
-                       (int)frame->hd.length, frame->hd.flags,
-                       frame->rst_stream.error_code);
-    }
-    case NGHTTP2_SETTINGS: {
-      if(frame->hd.flags & NGHTTP2_FLAG_ACK) {
-        return msnprintf(buffer, blen, "FRAME[SETTINGS, ack=1]");
-      }
-      return msnprintf(buffer, blen,
-                       "FRAME[SETTINGS, len=%d]", (int)frame->hd.length);
-    }
-    case NGHTTP2_PUSH_PROMISE: {
-      return msnprintf(buffer, blen,
-                       "FRAME[PUSH_PROMISE, len=%d, hend=%d]",
-                       (int)frame->hd.length,
-                       !!(frame->hd.flags & NGHTTP2_FLAG_END_HEADERS));
-    }
-    case NGHTTP2_PING: {
-      return msnprintf(buffer, blen,
-                       "FRAME[PING, len=%d, ack=%d]",
-                       (int)frame->hd.length,
-                       frame->hd.flags&NGHTTP2_FLAG_ACK);
-    }
-    case NGHTTP2_GOAWAY: {
-      char scratch[128];
-      size_t s_len = sizeof(scratch)/sizeof(scratch[0]);
-        size_t len = (frame->goaway.opaque_data_len < s_len)?
-                      frame->goaway.opaque_data_len : s_len-1;
-        if(len)
-          memcpy(scratch, frame->goaway.opaque_data, len);
-        scratch[len] = '\0';
-        return msnprintf(buffer, blen, "FRAME[GOAWAY, error=%d, reason='%s', "
-                         "last_stream=%d]", frame->goaway.error_code,
-                         scratch, frame->goaway.last_stream_id);
-    }
-    case NGHTTP2_WINDOW_UPDATE: {
-      return msnprintf(buffer, blen,
-                       "FRAME[WINDOW_UPDATE, incr=%d]",
-                       frame->window_update.window_size_increment);
-    }
-    default:
-      return msnprintf(buffer, blen, "FRAME[%d, len=%d, flags=%d]",
-                       frame->hd.type, (int)frame->hd.length,
-                       frame->hd.flags);
+    return curl_msnprintf(buffer, blen,
+                          "FRAME[SETTINGS, len=%d]", (int)frame->hd.length);
+  }
+  case NGHTTP2_PUSH_PROMISE:
+    return curl_msnprintf(buffer, blen,
+                          "FRAME[PUSH_PROMISE, len=%d, hend=%d]",
+                          (int)frame->hd.length,
+                          !!(frame->hd.flags & NGHTTP2_FLAG_END_HEADERS));
+  case NGHTTP2_PING:
+    return curl_msnprintf(buffer, blen,
+                          "FRAME[PING, len=%d, ack=%d]",
+                          (int)frame->hd.length,
+                          frame->hd.flags & NGHTTP2_FLAG_ACK);
+  case NGHTTP2_GOAWAY: {
+    char scratch[128];
+    size_t s_len = CURL_ARRAYSIZE(scratch);
+    size_t len = (frame->goaway.opaque_data_len < s_len) ?
+      frame->goaway.opaque_data_len : s_len - 1;
+    if(len)
+      memcpy(scratch, frame->goaway.opaque_data, len);
+    scratch[len] = '\0';
+    return curl_msnprintf(buffer, blen,
+                          "FRAME[GOAWAY, error=%u, reason='%s', "
+                          "last_stream=%d]", frame->goaway.error_code,
+                          scratch, frame->goaway.last_stream_id);
+  }
+  case NGHTTP2_WINDOW_UPDATE: {
+    return curl_msnprintf(buffer, blen,
+                          "FRAME[WINDOW_UPDATE, incr=%d]",
+                          frame->window_update.window_size_increment);
+  }
+  default:
+    return curl_msnprintf(buffer, blen, "FRAME[%d, len=%d, flags=%d]",
+                          frame->hd.type, (int)frame->hd.length,
+                          frame->hd.flags);
   }
 }
 
@@ -1170,20 +1122,28 @@ static int on_frame_send(nghttp2_session *session, const nghttp2_frame *frame,
                          void *userp)
 {
   struct Curl_cfilter *cf = userp;
+  struct cf_h2_ctx *ctx = cf->ctx;
   struct Curl_easy *data = CF_DATA_CURRENT(cf);
 
   (void)session;
   DEBUGASSERT(data);
-  if(data && Curl_trc_cf_is_verbose(cf, data)) {
+  if(Curl_trc_cf_is_verbose(cf, data)) {
     char buffer[256];
     int len;
-    len = fr_print(frame, buffer, sizeof(buffer)-1);
+    len = Curl_nghttp2_fr_print(frame, buffer, sizeof(buffer) - 1);
     buffer[len] = 0;
     CURL_TRC_CF(data, cf, "[%d] -> %s", frame->hd.stream_id, buffer);
   }
+  if((frame->hd.type == NGHTTP2_GOAWAY) && !ctx->sent_goaway) {
+    /* A GOAWAY not initiated by us, but by nghttp2 itself on detecting
+     * a protocol error on the connection */
+    failf(data, "nghttp2 shuts down connection with error %u: %s",
+          frame->goaway.error_code,
+          nghttp2_http2_strerror(frame->goaway.error_code));
+  }
   return 0;
 }
-#endif /* !CURL_DISABLE_VERBOSE_STRINGS */
+#endif /* CURLVERBOSE */
 
 static int on_frame_recv(nghttp2_session *session, const nghttp2_frame *frame,
                          void *userp)
@@ -1194,15 +1154,15 @@ static int on_frame_recv(nghttp2_session *session, const nghttp2_frame *frame,
   int32_t stream_id = frame->hd.stream_id;
 
   DEBUGASSERT(data);
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
+#ifdef CURLVERBOSE
   if(Curl_trc_cf_is_verbose(cf, data)) {
     char buffer[256];
     int len;
-    len = fr_print(frame, buffer, sizeof(buffer)-1);
+    len = Curl_nghttp2_fr_print(frame, buffer, sizeof(buffer) - 1);
     buffer[len] = 0;
-    CURL_TRC_CF(data, cf, "[%d] <- %s",frame->hd.stream_id, buffer);
+    CURL_TRC_CF(data, cf, "[%d] <- %s", frame->hd.stream_id, buffer);
   }
-#endif /* !CURL_DISABLE_VERBOSE_STRINGS */
+#endif /* CURLVERBOSE */
 
   if(!stream_id) {
     /* stream ID zero is for connection-oriented stuff */
@@ -1212,10 +1172,10 @@ static int on_frame_recv(nghttp2_session *session, const nghttp2_frame *frame,
       if(!(frame->hd.flags & NGHTTP2_FLAG_ACK)) {
         uint32_t max_conn = ctx->max_concurrent_streams;
         ctx->max_concurrent_streams = nghttp2_session_get_remote_settings(
-            session, NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS);
+          session, NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS);
         ctx->enable_push = nghttp2_session_get_remote_settings(
-            session, NGHTTP2_SETTINGS_ENABLE_PUSH) != 0;
-        CURL_TRC_CF(data, cf, "[0] MAX_CONCURRENT_STREAMS: %d",
+          session, NGHTTP2_SETTINGS_ENABLE_PUSH) != 0;
+        CURL_TRC_CF(data, cf, "[0] MAX_CONCURRENT_STREAMS: %u",
                     ctx->max_concurrent_streams);
         CURL_TRC_CF(data, cf, "[0] ENABLE_PUSH: %s",
                     ctx->enable_push ? "TRUE" : "false");
@@ -1230,26 +1190,18 @@ static int on_frame_recv(nghttp2_session *session, const nghttp2_frame *frame,
          * window and *assume* that we treat this like a WINDOW_UPDATE. Some
          * servers send an explicit WINDOW_UPDATE, but not all seem to do that.
          * To be safe, we UNHOLD a stream in order not to stall. */
-        if((data->req.keepon & KEEP_SEND_HOLD) &&
-           (data->req.keepon & KEEP_SEND)) {
-          struct stream_ctx *stream = H2_STREAM_CTX(data);
-          data->req.keepon &= ~KEEP_SEND_HOLD;
-          if(stream) {
-            drain_stream(cf, data, stream);
-            CURL_TRC_CF(data, cf, "[%d] un-holding after SETTINGS",
-                        stream_id);
-          }
-        }
+        if(CURL_REQ_WANT_SEND(data))
+          Curl_multi_mark_dirty(data);
       }
       break;
     }
     case NGHTTP2_GOAWAY:
-      ctx->goaway = TRUE;
+      ctx->rcvd_goaway = TRUE;
       ctx->goaway_error = frame->goaway.error_code;
-      ctx->last_stream_id = frame->goaway.last_stream_id;
+      ctx->remote_max_sid = frame->goaway.last_stream_id;
       if(data) {
-        infof(data, "received GOAWAY, error=%d, last_stream=%u",
-                    ctx->goaway_error, ctx->last_stream_id);
+        infof(data, "received GOAWAY, error=%u, last_stream=%d",
+              ctx->goaway_error, ctx->remote_max_sid);
         Curl_multi_connchanged(data->multi);
       }
       break;
@@ -1265,7 +1217,40 @@ static int on_frame_recv(nghttp2_session *session, const nghttp2_frame *frame,
     return 0;
   }
 
-  return on_stream_frame(cf, data_s, frame)? NGHTTP2_ERR_CALLBACK_FAILURE : 0;
+  return on_stream_frame(cf, data_s, frame) ? NGHTTP2_ERR_CALLBACK_FAILURE : 0;
+}
+
+static int cf_h2_on_invalid_frame_recv(nghttp2_session *session,
+                                       const nghttp2_frame *frame,
+                                       int ngerr, void *userp)
+{
+  struct Curl_cfilter *cf = userp;
+  struct cf_h2_ctx *ctx = cf->ctx;
+  struct Curl_easy *data;
+  int32_t stream_id = frame->hd.stream_id;
+
+  data = nghttp2_session_get_stream_user_data(session, stream_id);
+  if(data) {
+    struct h2_stream_ctx *stream;
+#ifdef CURLVERBOSE
+    char buffer[256];
+    int len;
+    len = Curl_nghttp2_fr_print(frame, buffer, sizeof(buffer) - 1);
+    buffer[len] = 0;
+    failf(data, "[HTTP2] [%d] received invalid frame: %s, error %d: %s",
+          stream_id, buffer, ngerr, nghttp2_strerror(ngerr));
+#endif /* CURLVERBOSE */
+    stream = H2_STREAM_CTX(ctx, data);
+    if(stream) {
+      nghttp2_submit_rst_stream(ctx->h2, NGHTTP2_FLAG_NONE,
+                                stream->id, NGHTTP2_STREAM_CLOSED);
+      stream->error = ngerr;
+      stream->closed = TRUE;
+      stream->reset = TRUE;
+      return 0;  /* keep the connection alive */
+    }
+  }
+  return NGHTTP2_ERR_CALLBACK_FAILURE;
 }
 
 static int on_data_chunk_recv(nghttp2_session *session, uint8_t flags,
@@ -1273,10 +1258,9 @@ static int on_data_chunk_recv(nghttp2_session *session, uint8_t flags,
                               const uint8_t *mem, size_t len, void *userp)
 {
   struct Curl_cfilter *cf = userp;
-  struct stream_ctx *stream;
+  struct cf_h2_ctx *ctx = cf->ctx;
+  struct h2_stream_ctx *stream;
   struct Curl_easy *data_s;
-  ssize_t nwritten;
-  CURLcode result;
   (void)flags;
 
   DEBUGASSERT(stream_id); /* should never be a zero stream ID here */
@@ -1288,29 +1272,20 @@ static int on_data_chunk_recv(nghttp2_session *session, uint8_t flags,
     /* Receiving a Stream ID not in the hash should not happen - unless
        we have aborted a transfer artificially and there were more data
        in the pipeline. Silently ignore. */
-    CURL_TRC_CF(CF_DATA_CURRENT(cf), cf, "[%d] Data for unknown",
-                stream_id);
+    CURL_TRC_CF(CF_DATA_CURRENT(cf), cf, "[%d] Data for unknown", stream_id);
     /* consumed explicitly as no one will read it */
     nghttp2_session_consume(session, stream_id, len);
     return 0;
   }
 
-  stream = H2_STREAM_CTX(data_s);
+  stream = H2_STREAM_CTX(ctx, data_s);
   if(!stream)
     return NGHTTP2_ERR_CALLBACK_FAILURE;
 
-  nwritten = Curl_bufq_write(&stream->recvbuf, mem, len, &result);
-  if(nwritten < 0) {
-    if(result != CURLE_AGAIN)
-      return NGHTTP2_ERR_CALLBACK_FAILURE;
+  h2_xfer_write_resp(cf, data_s, stream, (const char *)mem, len, FALSE);
 
-    nwritten = 0;
-  }
-
-  /* if we receive data for another handle, wake that up */
-  drain_stream(cf, data_s, stream);
-
-  DEBUGASSERT((size_t)nwritten == len);
+  nghttp2_session_consume(ctx->h2, stream_id, len);
+  stream->nrcvd_data += (curl_off_t)len;
   return 0;
 }
 
@@ -1318,39 +1293,53 @@ static int on_stream_close(nghttp2_session *session, int32_t stream_id,
                            uint32_t error_code, void *userp)
 {
   struct Curl_cfilter *cf = userp;
-  struct Curl_easy *data_s;
-  struct stream_ctx *stream;
+  struct cf_h2_ctx *ctx = cf->ctx;
+  struct Curl_easy *data_s, *call_data = CF_DATA_CURRENT(cf);
+  struct h2_stream_ctx *stream;
   int rv;
   (void)session;
 
-  /* get the stream from the hash based on Stream ID, stream ID zero is for
-     connection-oriented stuff */
-  data_s = stream_id?
-             nghttp2_session_get_stream_user_data(session, stream_id) : NULL;
+  DEBUGASSERT(call_data);
+  /* stream id 0 is the connection, do not look there for streams. */
+  data_s = stream_id ?
+    nghttp2_session_get_stream_user_data(session, stream_id) : NULL;
   if(!data_s) {
+    CURL_TRC_CF(call_data, cf,
+                "[%d] on_stream_close, no easy set on stream", stream_id);
     return 0;
   }
-  stream = H2_STREAM_CTX(data_s);
-  if(!stream)
+  if(!GOOD_EASY_HANDLE(data_s)) {
+    /* nghttp2 still has an easy registered for the stream which has
+     * been freed be libcurl. This points to a code path that does not
+     * trigger DONE or DETACH events as it must. */
+    CURL_TRC_CF(call_data, cf,
+                "[%d] on_stream_close, not a GOOD easy on stream", stream_id);
+    (void)nghttp2_session_set_stream_user_data(session, stream_id, 0);
     return NGHTTP2_ERR_CALLBACK_FAILURE;
+  }
+  stream = H2_STREAM_CTX(ctx, data_s);
+  if(!stream) {
+    CURL_TRC_CF(data_s, cf,
+                "[%d] on_stream_close, GOOD easy but no stream", stream_id);
+    return NGHTTP2_ERR_CALLBACK_FAILURE;
+  }
 
   stream->closed = TRUE;
   stream->error = error_code;
   if(stream->error)
     stream->reset = TRUE;
-  data_s->req.keepon &= ~KEEP_SEND_HOLD;
 
   if(stream->error)
-    CURL_TRC_CF(data_s, cf, "[%d] RESET: %s (err %d)",
+    CURL_TRC_CF(data_s, cf, "[%d] RESET: %s (err %u)",
               stream_id, nghttp2_http2_strerror(error_code), error_code);
   else
     CURL_TRC_CF(data_s, cf, "[%d] CLOSED", stream_id);
-  drain_stream(cf, data_s, stream);
+  Curl_multi_mark_dirty(data_s);
 
   /* remove `data_s` from the nghttp2 stream */
   rv = nghttp2_session_set_stream_user_data(session, stream_id, 0);
   if(rv) {
-    infof(data_s, "http/2: failed to clear user_data for stream %u",
+    infof(data_s, "http/2: failed to clear user_data for stream %d",
           stream_id);
     DEBUGASSERT(0);
   }
@@ -1361,7 +1350,8 @@ static int on_begin_headers(nghttp2_session *session,
                             const nghttp2_frame *frame, void *userp)
 {
   struct Curl_cfilter *cf = userp;
-  struct stream_ctx *stream;
+  struct cf_h2_ctx *ctx = cf->ctx;
+  struct h2_stream_ctx *stream;
   struct Curl_easy *data_s = NULL;
 
   (void)cf;
@@ -1374,7 +1364,7 @@ static int on_begin_headers(nghttp2_session *session,
     return 0;
   }
 
-  stream = H2_STREAM_CTX(data_s);
+  stream = H2_STREAM_CTX(ctx, data_s);
   if(!stream || !stream->bodystarted) {
     return 0;
   }
@@ -1382,6 +1372,23 @@ static int on_begin_headers(nghttp2_session *session,
   return 0;
 }
 
+static void cf_h2_header_error(struct Curl_cfilter *cf,
+                               struct Curl_easy *data,
+                               struct h2_stream_ctx *stream,
+                               CURLcode result)
+{
+  struct cf_h2_ctx *ctx = cf->ctx;
+
+  failf(data, "Error receiving HTTP2 header: %d(%s)", (int)result,
+        curl_easy_strerror(result));
+  if(stream) {
+    nghttp2_submit_rst_stream(ctx->h2, NGHTTP2_FLAG_NONE,
+                              stream->id, NGHTTP2_STREAM_CLOSED);
+    stream->closed = TRUE;
+    stream->reset = TRUE;
+  }
+}
+
 /* frame->hd.type is either NGHTTP2_HEADERS or NGHTTP2_PUSH_PROMISE */
 static int on_header(nghttp2_session *session, const nghttp2_frame *frame,
                      const uint8_t *name, size_t namelen,
@@ -1390,8 +1397,9 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame,
                      void *userp)
 {
   struct Curl_cfilter *cf = userp;
-  struct stream_ctx *stream;
-  struct Curl_easy *data_s;
+  struct cf_h2_ctx *ctx = cf->ctx;
+  struct h2_stream_ctx *stream;
+  struct Curl_easy *data;
   int32_t stream_id = frame->hd.stream_id;
   CURLcode result;
   (void)flags;
@@ -1399,15 +1407,15 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame,
   DEBUGASSERT(stream_id); /* should never be a zero stream ID here */
 
   /* get the stream from the hash based on Stream ID */
-  data_s = nghttp2_session_get_stream_user_data(session, stream_id);
-  if(!data_s)
+  data = nghttp2_session_get_stream_user_data(session, stream_id);
+  if(!GOOD_EASY_HANDLE(data))
     /* Receiving a Stream ID not in the hash should not happen, this is an
        internal error more than anything else! */
     return NGHTTP2_ERR_CALLBACK_FAILURE;
 
-  stream = H2_STREAM_CTX(data_s);
+  stream = H2_STREAM_CTX(ctx, data);
   if(!stream) {
-    failf(data_s, "Internal NULL stream");
+    failf(data, "Internal NULL stream");
     return NGHTTP2_ERR_CALLBACK_FAILURE;
   }
 
@@ -1416,17 +1424,18 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame,
   if(frame->hd.type == NGHTTP2_PUSH_PROMISE) {
     char *h;
 
-    if(!strcmp(HTTP_PSEUDO_AUTHORITY, (const char *)name)) {
+    if((namelen == (sizeof(HTTP_PSEUDO_AUTHORITY) - 1)) &&
+       !strncmp(HTTP_PSEUDO_AUTHORITY, (const char *)name, namelen)) {
       /* pseudo headers are lower case */
       int rc = 0;
-      char *check = aprintf("%s:%d", cf->conn->host.name,
-                            cf->conn->remote_port);
+      char *check = curl_maprintf("%s:%d", data->state.origin->hostname,
+                                  data->state.origin->port);
       if(!check)
         /* no memory */
         return NGHTTP2_ERR_CALLBACK_FAILURE;
-      if(!strcasecompare(check, (const char *)value) &&
-         ((cf->conn->remote_port != cf->conn->given->defport) ||
-          !strcasecompare(cf->conn->host.name, (const char *)value))) {
+      if(!curl_strequal(check, (const char *)value) &&
+         ((data->state.origin->port != cf->conn->given->defport) ||
+          !curl_strequal(data->state.origin->hostname, (const char *)value))) {
         /* This is push is not for the same authority that was asked for in
          * the URL. RFC 7540 section 8.2 says: "A client MUST treat a
          * PUSH_PROMISE for which the server is not authoritative as a stream
@@ -1436,17 +1445,17 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame,
                                         stream_id, NGHTTP2_PROTOCOL_ERROR);
         rc = NGHTTP2_ERR_CALLBACK_FAILURE;
       }
-      free(check);
+      curlx_free(check);
       if(rc)
         return rc;
     }
 
     if(!stream->push_headers) {
       stream->push_headers_alloc = 10;
-      stream->push_headers = malloc(stream->push_headers_alloc *
-                                    sizeof(char *));
+      stream->push_headers = curlx_malloc(stream->push_headers_alloc *
+                                          sizeof(char *));
       if(!stream->push_headers)
-        return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
+        return NGHTTP2_ERR_CALLBACK_FAILURE;
       stream->push_headers_used = 0;
     }
     else if(stream->push_headers_used ==
@@ -1454,66 +1463,79 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame,
       char **headp;
       if(stream->push_headers_alloc > 1000) {
         /* this is beyond crazy many headers, bail out */
-        failf(data_s, "Too many PUSH_PROMISE headers");
-        Curl_safefree(stream->push_headers);
-        return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
+        failf(data, "Too many PUSH_PROMISE headers");
+        free_push_headers(stream);
+        return NGHTTP2_ERR_CALLBACK_FAILURE;
       }
       stream->push_headers_alloc *= 2;
-      headp = Curl_saferealloc(stream->push_headers,
-                               stream->push_headers_alloc * sizeof(char *));
+      headp = curlx_realloc(stream->push_headers,
+                            stream->push_headers_alloc * sizeof(char *));
       if(!headp) {
-        stream->push_headers = NULL;
-        return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
+        free_push_headers(stream);
+        return NGHTTP2_ERR_CALLBACK_FAILURE;
       }
       stream->push_headers = headp;
     }
-    h = aprintf("%s:%s", name, value);
-    if(h)
-      stream->push_headers[stream->push_headers_used++] = h;
+    h = curl_maprintf("%s:%s", name, value);
+    if(!h) {
+      free_push_headers(stream);
+      return NGHTTP2_ERR_CALLBACK_FAILURE;
+    }
+    stream->push_headers[stream->push_headers_used++] = h;
     return 0;
   }
 
   if(stream->bodystarted) {
     /* This is a trailer */
-    CURL_TRC_CF(data_s, cf, "[%d] trailer: %.*s: %.*s",
+    CURL_TRC_CF(data, cf, "[%d] trailer: %.*s: %.*s",
                 stream->id, (int)namelen, name, (int)valuelen, value);
     result = Curl_dynhds_add(&stream->resp_trailers,
                              (const char *)name, namelen,
                              (const char *)value, valuelen);
-    if(result)
+    if(result) {
+      cf_h2_header_error(cf, data, stream, result);
       return NGHTTP2_ERR_CALLBACK_FAILURE;
+    }
 
     return 0;
   }
 
   if(namelen == sizeof(HTTP_PSEUDO_STATUS) - 1 &&
-     memcmp(HTTP_PSEUDO_STATUS, name, namelen) == 0) {
+     !memcmp(HTTP_PSEUDO_STATUS, name, namelen)) {
     /* nghttp2 guarantees :status is received first and only once. */
     char buffer[32];
+    size_t hlen;
     result = Curl_http_decode_status(&stream->status_code,
                                      (const char *)value, valuelen);
-    if(result)
+    if(result) {
+      cf_h2_header_error(cf, data, stream, result);
       return NGHTTP2_ERR_CALLBACK_FAILURE;
-    msnprintf(buffer, sizeof(buffer), HTTP_PSEUDO_STATUS ":%u\r",
-              stream->status_code);
-    result = Curl_headers_push(data_s, buffer, CURLH_PSEUDO);
-    if(result)
+    }
+    hlen = curl_msnprintf(buffer, sizeof(buffer), HTTP_PSEUDO_STATUS ":%d\r",
+                          stream->status_code);
+    result = Curl_headers_push(data, buffer, hlen, CURLH_PSEUDO);
+    if(result) {
+      cf_h2_header_error(cf, data, stream, result);
       return NGHTTP2_ERR_CALLBACK_FAILURE;
-    result = recvbuf_write_hds(cf, data_s, STRCONST("HTTP/2 "));
-    if(result)
-      return NGHTTP2_ERR_CALLBACK_FAILURE;
-    result = recvbuf_write_hds(cf, data_s, (const char *)value, valuelen);
-    if(result)
-      return NGHTTP2_ERR_CALLBACK_FAILURE;
-    /* the space character after the status code is mandatory */
-    result = recvbuf_write_hds(cf, data_s, STRCONST(" \r\n"));
-    if(result)
+    }
+    curlx_dyn_reset(&ctx->scratch);
+    result = curlx_dyn_addn(&ctx->scratch, STRCONST("HTTP/2 "));
+    if(!result)
+      result = curlx_dyn_addn(&ctx->scratch, value, valuelen);
+    if(!result)
+      result = curlx_dyn_addn(&ctx->scratch, STRCONST(" \r\n"));
+    if(!result)
+      h2_xfer_write_resp_hd(cf, data, stream, curlx_dyn_ptr(&ctx->scratch),
+                            curlx_dyn_len(&ctx->scratch), FALSE);
+    if(result) {
+      cf_h2_header_error(cf, data, stream, result);
       return NGHTTP2_ERR_CALLBACK_FAILURE;
+    }
     /* if we receive data for another handle, wake that up */
-    if(CF_DATA_CURRENT(cf) != data_s)
-      Curl_expire(data_s, 0, EXPIRE_RUN_NOW);
+    if(CF_DATA_CURRENT(cf) != data)
+      Curl_multi_mark_dirty(data);
 
-    CURL_TRC_CF(data_s, cf, "[%d] status: HTTP/2 %03d",
+    CURL_TRC_CF(data, cf, "[%d] status: HTTP/2 %03d",
                 stream->id, stream->status_code);
     return 0;
   }
@@ -1521,23 +1543,26 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame,
   /* nghttp2 guarantees that namelen > 0, and :status was already
      received, and this is not pseudo-header field . */
   /* convert to an HTTP1-style header */
-  result = recvbuf_write_hds(cf, data_s, (const char *)name, namelen);
-  if(result)
-    return NGHTTP2_ERR_CALLBACK_FAILURE;
-  result = recvbuf_write_hds(cf, data_s, STRCONST(": "));
-  if(result)
-    return NGHTTP2_ERR_CALLBACK_FAILURE;
-  result = recvbuf_write_hds(cf, data_s, (const char *)value, valuelen);
-  if(result)
-    return NGHTTP2_ERR_CALLBACK_FAILURE;
-  result = recvbuf_write_hds(cf, data_s, STRCONST("\r\n"));
-  if(result)
+  curlx_dyn_reset(&ctx->scratch);
+  result = curlx_dyn_addn(&ctx->scratch, (const char *)name, namelen);
+  if(!result)
+    result = curlx_dyn_addn(&ctx->scratch, STRCONST(": "));
+  if(!result)
+    result = curlx_dyn_addn(&ctx->scratch, (const char *)value, valuelen);
+  if(!result)
+    result = curlx_dyn_addn(&ctx->scratch, STRCONST("\r\n"));
+  if(!result)
+    h2_xfer_write_resp_hd(cf, data, stream, curlx_dyn_ptr(&ctx->scratch),
+                          curlx_dyn_len(&ctx->scratch), FALSE);
+  if(result) {
+    cf_h2_header_error(cf, data, stream, result);
     return NGHTTP2_ERR_CALLBACK_FAILURE;
+  }
   /* if we receive data for another handle, wake that up */
-  if(CF_DATA_CURRENT(cf) != data_s)
-    Curl_expire(data_s, 0, EXPIRE_RUN_NOW);
+  if(CF_DATA_CURRENT(cf) != data)
+    Curl_multi_mark_dirty(data);
 
-  CURL_TRC_CF(data_s, cf, "[%d] header: %.*s: %.*s",
+  CURL_TRC_CF(data, cf, "[%d] header: %.*s: %.*s",
               stream->id, (int)namelen, name, (int)valuelen, value);
 
   return 0; /* 0 is successful */
@@ -1551,61 +1576,59 @@ static ssize_t req_body_read_callback(nghttp2_session *session,
                                       void *userp)
 {
   struct Curl_cfilter *cf = userp;
+  struct cf_h2_ctx *ctx = cf->ctx;
   struct Curl_easy *data_s;
-  struct stream_ctx *stream = NULL;
+  struct h2_stream_ctx *stream = NULL;
   CURLcode result;
   ssize_t nread;
+  size_t n;
   (void)source;
 
   (void)cf;
-  if(stream_id) {
-    /* get the stream from the hash based on Stream ID, stream ID zero is for
-       connection-oriented stuff */
-    data_s = nghttp2_session_get_stream_user_data(session, stream_id);
-    if(!data_s)
-      /* Receiving a Stream ID not in the hash should not happen, this is an
-         internal error more than anything else! */
-      return NGHTTP2_ERR_CALLBACK_FAILURE;
-
-    stream = H2_STREAM_CTX(data_s);
-    if(!stream)
-      return NGHTTP2_ERR_CALLBACK_FAILURE;
-  }
-  else
+  if(!stream_id)
     return NGHTTP2_ERR_INVALID_ARGUMENT;
 
-  nread = Curl_bufq_read(&stream->sendbuf, buf, length, &result);
-  if(nread < 0) {
+  /* get the stream from the hash based on Stream ID, stream ID zero is for
+     connection-oriented stuff */
+  data_s = nghttp2_session_get_stream_user_data(session, stream_id);
+  if(!data_s)
+    /* Receiving a Stream ID not in the hash should not happen, this is an
+       internal error more than anything else! */
+    return NGHTTP2_ERR_CALLBACK_FAILURE;
+
+  stream = H2_STREAM_CTX(ctx, data_s);
+  if(!stream)
+    return NGHTTP2_ERR_CALLBACK_FAILURE;
+
+  result = Curl_bufq_read(&stream->sendbuf, buf, length, &n);
+  if(result) {
     if(result != CURLE_AGAIN)
       return NGHTTP2_ERR_CALLBACK_FAILURE;
     nread = 0;
   }
+  else
+    nread = (ssize_t)n;
 
-  if(nread > 0 && stream->upload_left != -1)
-    stream->upload_left -= nread;
+  CURL_TRC_CF(data_s, cf, "[%d] req_body_read(len=%zu) eos=%d -> %zd, %d",
+              stream_id, length, stream->body_eos, nread, (int)result);
 
-  CURL_TRC_CF(data_s, cf, "[%d] req_body_read(len=%zu) left=%"
-              CURL_FORMAT_CURL_OFF_T " -> %zd, %d",
-              stream_id, length, stream->upload_left, nread, result);
-
-  if(stream->upload_left == 0)
+  if(stream->body_eos && Curl_bufq_is_empty(&stream->sendbuf)) {
     *data_flags = NGHTTP2_DATA_FLAG_EOF;
-  else if(nread == 0)
-    return NGHTTP2_ERR_DEFERRED;
-
-  return nread;
+    return nread;
+  }
+  return (nread == 0) ? NGHTTP2_ERR_DEFERRED : nread;
 }
 
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#ifdef CURLVERBOSE
 static int error_callback(nghttp2_session *session,
                           const char *msg,
                           size_t len,
                           void *userp)
 {
+  struct Curl_cfilter *cf = userp;
+  struct Curl_easy *data = CF_DATA_CURRENT(cf);
   (void)session;
-  (void)msg;
-  (void)len;
-  (void)userp;
+  failf(data, "%.*s", (int)len, msg);
   return 0;
 }
 #endif
@@ -1621,95 +1644,70 @@ CURLcode Curl_http2_request_upgrade(struct dynbuf *req,
   size_t blen;
   struct SingleRequest *k = &data->req;
   uint8_t binsettings[H2_BINSETTINGS_LEN];
-  size_t  binlen; /* length of the binsettings data */
+  ssize_t rc;
+  size_t binlen; /* length of the binsettings data */
 
-  binlen = populate_binsettings(binsettings, data);
-  if(binlen <= 0) {
+  rc = populate_binsettings(binsettings, data);
+  if(!curlx_sztouz(rc, &binlen) || !binlen) {
     failf(data, "nghttp2 unexpectedly failed on pack_settings_payload");
-    Curl_dyn_free(req);
+    curlx_dyn_free(req);
     return CURLE_FAILED_INIT;
   }
 
-  result = Curl_base64url_encode((const char *)binsettings, binlen,
-                                 &base64, &blen);
+  result = curlx_base64url_encode(binsettings, binlen, &base64, &blen);
   if(result) {
-    Curl_dyn_free(req);
+    curlx_dyn_free(req);
     return result;
   }
 
-  result = Curl_dyn_addf(req,
-                         "Connection: Upgrade, HTTP2-Settings\r\n"
-                         "Upgrade: %s\r\n"
-                         "HTTP2-Settings: %s\r\n",
-                         NGHTTP2_CLEARTEXT_PROTO_VERSION_ID, base64);
-  free(base64);
+  data->state.http_hd_upgrade = TRUE;
+  data->state.http_hd_h2_settings = TRUE;
+  result = curlx_dyn_addf(req,
+                          "Upgrade: %s\r\n"
+                          "HTTP2-Settings: %s\r\n",
+                          NGHTTP2_CLEARTEXT_PROTO_VERSION_ID, base64);
+  curlx_free(base64);
 
   k->upgr101 = UPGR101_H2;
+  data->conn->bits.upgrade_in_progress = TRUE;
 
   return result;
 }
 
-static CURLcode http2_data_done_send(struct Curl_cfilter *cf,
-                                     struct Curl_easy *data)
+static CURLcode http2_handle_stream_close(struct Curl_cfilter *cf,
+                                          struct Curl_easy *data,
+                                          struct h2_stream_ctx *stream,
+                                          size_t *pnlen)
 {
-  struct cf_h2_ctx *ctx = cf->ctx;
-  CURLcode result = CURLE_OK;
-  struct stream_ctx *stream = H2_STREAM_CTX(data);
+  CURLcode result;
 
-  if(!ctx || !ctx->h2 || !stream)
-    goto out;
-
-  CURL_TRC_CF(data, cf, "[%d] data done send", stream->id);
-  if(!stream->send_closed) {
-    stream->send_closed = TRUE;
-    if(stream->upload_left) {
-      /* we now know that everything that is buffered is all there is. */
-      stream->upload_left = Curl_bufq_len(&stream->sendbuf);
-      /* resume sending here to trigger the callback to get called again so
-         that it can signal EOF to nghttp2 */
-      (void)nghttp2_session_resume_data(ctx->h2, stream->id);
-      drain_stream(cf, data, stream);
+  *pnlen = 0;
+  if(stream->reset) {
+    if(stream->error == NGHTTP2_REFUSED_STREAM) {
+      infof(data, "HTTP/2 stream %d refused by server, try again on a new "
+                  "connection", stream->id);
+      connclose(cf->conn, "REFUSED_STREAM"); /* do not use this anymore */
+      data->state.refused_stream = TRUE;
+      return CURLE_RECV_ERROR; /* trigger Curl_retry_request() later */
     }
+    else if(stream->resp_hds_complete && data->req.no_body) {
+      CURL_TRC_CF(data, cf, "[%d] error after response headers, but we did "
+                  "not want a body anyway, ignore: %s (err %u)",
+                  stream->id, nghttp2_http2_strerror(stream->error),
+                  stream->error);
+      stream->close_handled = TRUE;
+      return CURLE_OK;
+    }
+    failf(data, "HTTP/2 stream %d reset by %s (error 0x%x %s)",
+          stream->id, stream->reset_by_server ? "server" : "curl",
+          stream->error, nghttp2_http2_strerror(stream->error));
+    return stream->error ? CURLE_HTTP2_STREAM :
+           (data->req.bytecount ? CURLE_PARTIAL_FILE : CURLE_HTTP2);
   }
-
-out:
-  return result;
-}
-
-static ssize_t http2_handle_stream_close(struct Curl_cfilter *cf,
-                                         struct Curl_easy *data,
-                                         struct stream_ctx *stream,
-                                         CURLcode *err)
-{
-  ssize_t rv = 0;
-
-  if(stream->error == NGHTTP2_REFUSED_STREAM) {
-    CURL_TRC_CF(data, cf, "[%d] REFUSED_STREAM, try again on a new "
-                "connection", stream->id);
-    connclose(cf->conn, "REFUSED_STREAM"); /* don't use this anymore */
-    data->state.refused_stream = TRUE;
-    *err = CURLE_SEND_ERROR; /* trigger Curl_retry_request() later */
-    return -1;
-  }
-  else if(stream->error != NGHTTP2_NO_ERROR) {
-    failf(data, "HTTP/2 stream %u was not closed cleanly: %s (err %u)",
-          stream->id, nghttp2_http2_strerror(stream->error),
-          stream->error);
-    *err = CURLE_HTTP2_STREAM;
-    return -1;
-  }
-  else if(stream->reset) {
-    failf(data, "HTTP/2 stream %u was reset", stream->id);
-    *err = stream->bodystarted? CURLE_PARTIAL_FILE : CURLE_RECV_ERROR;
-    return -1;
-  }
-
-  if(!stream->bodystarted) {
-    failf(data, "HTTP/2 stream %u was closed cleanly, but before getting "
-          " all response header fields, treated as error",
-          stream->id);
-    *err = CURLE_HTTP2_STREAM;
-    return -1;
+  else if(!stream->bodystarted) {
+    failf(data, "HTTP/2 stream %d was closed cleanly, but before getting "
+          "all response header fields, treated as error", stream->id);
+    return CURLE_HTTP2_STREAM;
   }
 
   if(Curl_dynhds_count(&stream->resp_trailers)) {
@@ -1717,50 +1715,50 @@ static ssize_t http2_handle_stream_close(struct Curl_cfilter *cf,
     struct dynbuf dbuf;
     size_t i;
 
-    *err = CURLE_OK;
-    Curl_dyn_init(&dbuf, DYN_TRAILERS);
+    result = CURLE_OK;
+    curlx_dyn_init(&dbuf, DYN_TRAILERS);
     for(i = 0; i < Curl_dynhds_count(&stream->resp_trailers); ++i) {
       e = Curl_dynhds_getn(&stream->resp_trailers, i);
       if(!e)
         break;
-      Curl_dyn_reset(&dbuf);
-      *err = Curl_dyn_addf(&dbuf, "%.*s: %.*s\x0d\x0a",
-                          (int)e->namelen, e->name,
-                          (int)e->valuelen, e->value);
-      if(*err)
+      curlx_dyn_reset(&dbuf);
+      result = curlx_dyn_addf(&dbuf, "%.*s: %.*s\x0d\x0a",
+                              (int)e->namelen, e->name,
+                              (int)e->valuelen, e->value);
+      if(result)
         break;
-      Curl_debug(data, CURLINFO_HEADER_IN, Curl_dyn_ptr(&dbuf),
-                 Curl_dyn_len(&dbuf));
-      *err = Curl_client_write(data, CLIENTWRITE_HEADER|CLIENTWRITE_TRAILER,
-                               Curl_dyn_ptr(&dbuf), Curl_dyn_len(&dbuf));
-      if(*err)
+      Curl_debug(data, CURLINFO_HEADER_IN, curlx_dyn_ptr(&dbuf),
+                 curlx_dyn_len(&dbuf));
+      result = Curl_client_write(data,
+                                 CLIENTWRITE_HEADER | CLIENTWRITE_TRAILER,
+                                 curlx_dyn_ptr(&dbuf), curlx_dyn_len(&dbuf));
+      if(result)
         break;
     }
-    Curl_dyn_free(&dbuf);
-    if(*err)
+    curlx_dyn_free(&dbuf);
+    if(result)
       goto out;
   }
 
   stream->close_handled = TRUE;
-  *err = CURLE_OK;
-  rv = 0;
+  result = CURLE_OK;
 
 out:
-  CURL_TRC_CF(data, cf, "handle_stream_close -> %zd, %d", rv, *err);
-  return rv;
+  CURL_TRC_CF(data, cf, "handle_stream_close -> %d, %zu", (int)result, *pnlen);
+  return result;
 }
 
 static int sweight_wanted(const struct Curl_easy *data)
 {
   /* 0 weight is not set by user and we take the nghttp2 default one */
-  return data->set.priority.weight?
+  return data->set.priority.weight ?
     data->set.priority.weight : NGHTTP2_DEFAULT_WEIGHT;
 }
 
 static int sweight_in_effect(const struct Curl_easy *data)
 {
   /* 0 weight is not set by user and we take the nghttp2 default one */
-  return data->state.priority.weight?
+  return data->state.priority.weight ?
     data->state.priority.weight : NGHTTP2_DEFAULT_WEIGHT;
 }
 
@@ -1774,31 +1772,26 @@ static void h2_pri_spec(struct Curl_easy *data,
                         nghttp2_priority_spec *pri_spec)
 {
   struct Curl_data_priority *prio = &data->set.priority;
-  struct stream_ctx *depstream = H2_STREAM_CTX(prio->parent);
-  int32_t depstream_id = depstream? depstream->id:0;
-  nghttp2_priority_spec_init(pri_spec, depstream_id,
-                             sweight_wanted(data),
-                             data->set.priority.exclusive);
+  nghttp2_priority_spec_init(pri_spec, 0,
+                             sweight_wanted(data), FALSE);
   data->state.priority = *prio;
 }
 
 /*
- * Check if there's been an update in the priority /
+ * Check if there is been an update in the priority /
  * dependency settings and if so it submits a PRIORITY frame with the updated
  * info.
  * Flush any out data pending in the network buffer.
  */
 static CURLcode h2_progress_egress(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data)
+                                   struct Curl_easy *data)
 {
   struct cf_h2_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream = H2_STREAM_CTX(data);
+  struct h2_stream_ctx *stream = H2_STREAM_CTX(ctx, data);
   int rv = 0;
 
   if(stream && stream->id > 0 &&
-     ((sweight_wanted(data) != sweight_in_effect(data)) ||
-      (data->set.priority.exclusive != data->state.priority.exclusive) ||
-      (data->set.priority.parent != data->state.priority.parent)) ) {
+     (sweight_wanted(data) != sweight_in_effect(data))) {
     /* send new weight and/or dependency */
     nghttp2_priority_spec pri_spec;
 
@@ -1821,84 +1814,97 @@ out:
                 nghttp2_strerror(rv), rv);
     return CURLE_SEND_ERROR;
   }
+  /* Defer flushing during the connect phase so that the SETTINGS and
+   * other initial frames are sent together with the first request.
+   * Unless we are 'connect_only' where the request will never come. */
+  if(!cf->connected && !cf->conn->bits.connect_only)
+    return CURLE_OK;
   return nw_out_flush(cf, data);
 }
 
-static ssize_t stream_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
-                           struct stream_ctx *stream,
-                           char *buf, size_t len, CURLcode *err)
+static CURLcode stream_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
+                            struct h2_stream_ctx *stream,
+                            char *buf, size_t len, size_t *pnread)
 {
   struct cf_h2_ctx *ctx = cf->ctx;
-  ssize_t nread = -1;
+  CURLcode result = CURLE_AGAIN;
 
-  *err = CURLE_AGAIN;
-  if(!Curl_bufq_is_empty(&stream->recvbuf)) {
-    nread = Curl_bufq_read(&stream->recvbuf,
-                           (unsigned char *)buf, len, err);
-    if(nread < 0)
-      goto out;
-    DEBUGASSERT(nread > 0);
+  (void)buf;
+  (void)len;
+  *pnread = 0;
+
+  if(!stream->xfer_result)
+    stream->xfer_result = cf_h2_update_local_win(cf, data, stream);
+
+  if(stream->xfer_result) {
+    CURL_TRC_CF(data, cf, "[%d] xfer write failed", stream->id);
+    result = stream->xfer_result;
+  }
+  else if(stream->closed) {
+    CURL_TRC_CF(data, cf, "[%d] returning CLOSE", stream->id);
+    result = http2_handle_stream_close(cf, data, stream, pnread);
+  }
+  else if(stream->reset ||
+          (ctx->conn_closed && Curl_bufq_is_empty(&ctx->inbufq)) ||
+          (ctx->rcvd_goaway && ctx->remote_max_sid < stream->id)) {
+    CURL_TRC_CF(data, cf, "[%d] returning ERR", stream->id);
+    result = data->req.bytecount ? CURLE_PARTIAL_FILE : CURLE_HTTP2;
   }
 
-  if(nread < 0) {
-    if(stream->closed) {
-      CURL_TRC_CF(data, cf, "[%d] returning CLOSE", stream->id);
-      nread = http2_handle_stream_close(cf, data, stream, err);
-    }
-    else if(stream->reset ||
-            (ctx->conn_closed && Curl_bufq_is_empty(&ctx->inbufq)) ||
-            (ctx->goaway && ctx->last_stream_id < stream->id)) {
-      CURL_TRC_CF(data, cf, "[%d] returning ERR", stream->id);
-      *err = stream->bodystarted? CURLE_PARTIAL_FILE : CURLE_RECV_ERROR;
-      nread = -1;
-    }
-  }
-  else if(nread == 0) {
-    *err = CURLE_AGAIN;
-    nread = -1;
-  }
-
-out:
-  if(nread < 0 && *err != CURLE_AGAIN)
-    CURL_TRC_CF(data, cf, "[%d] stream_recv(len=%zu) -> %zd, %d",
-                stream->id, len, nread, *err);
-  return nread;
+  if(result && (result != CURLE_AGAIN))
+    CURL_TRC_CF(data, cf, "[%d] stream_recv(len=%zu) -> %d, %zu",
+                stream->id, len, (int)result, *pnread);
+  return result;
 }
 
 static CURLcode h2_progress_ingress(struct Curl_cfilter *cf,
-                                    struct Curl_easy *data)
+                                    struct Curl_easy *data,
+                                    size_t data_max_bytes)
 {
   struct cf_h2_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream;
+  struct h2_stream_ctx *stream;
   CURLcode result = CURLE_OK;
-  ssize_t nread;
+  size_t nread;
 
-  /* Process network input buffer fist */
+  if(should_close_session(ctx)) {
+    CURL_TRC_CF(data, cf, "[0] ingress: session is closed");
+    return CURLE_HTTP2;
+  }
+
+  /* Process network input buffer first */
   if(!Curl_bufq_is_empty(&ctx->inbufq)) {
     CURL_TRC_CF(data, cf, "Process %zu bytes in connection buffer",
                 Curl_bufq_len(&ctx->inbufq));
-    if(h2_process_pending_input(cf, data, &result) < 0)
+    result = h2_process_pending_input(cf, data);
+    if(result)
       return result;
   }
 
+  if(!data_max_bytes)
+    data_max_bytes = H2_CHUNK_SIZE;
+
   /* Receive data from the "lower" filters, e.g. network until
    * it is time to stop due to connection close or us not processing
    * all network input */
   while(!ctx->conn_closed && Curl_bufq_is_empty(&ctx->inbufq)) {
-    stream = H2_STREAM_CTX(data);
-    if(stream && (stream->closed || Curl_bufq_is_full(&stream->recvbuf))) {
-      /* We would like to abort here and stop processing, so that
-       * the transfer loop can handle the data/close here. However,
-       * this may leave data in underlying buffers that will not
-       * be consumed. */
+    stream = H2_STREAM_CTX(ctx, data);
+    if(stream && (stream->closed || !data_max_bytes)) {
+      /* We would like to abort here and stop processing, so that the transfer
+       * loop can handle the data/close here. This may leave data in
+       * underlying buffers that will not be consumed. */
       if(!cf->next || !cf->next->cft->has_data_pending(cf->next, data))
-        break;
+        Curl_multi_mark_dirty(data);
+      break;
+    }
+    else if(!stream) {
+      DEBUGASSERT(0);
+      break;
     }
 
-    nread = Curl_bufq_slurp(&ctx->inbufq, nw_in_reader, cf, &result);
-    if(nread < 0) {
+    result = Curl_cf_recv_bufq(cf->next, data, &ctx->inbufq, 0, &nread);
+    if(result) {
       if(result != CURLE_AGAIN) {
-        failf(data, "Failed receiving HTTP2 data: %d(%s)", result,
+        failf(data, "Failed receiving HTTP2 data: %d(%s)", (int)result,
               curl_easy_strerror(result));
         return result;
       }
@@ -1910,97 +1916,90 @@ static CURLcode h2_progress_ingress(struct Curl_cfilter *cf,
       break;
     }
     else {
-      CURL_TRC_CF(data, cf, "[0] ingress: read %zd bytes",
-                  nread);
+      CURL_TRC_CF(data, cf, "[0] ingress: read %zu bytes", nread);
+      data_max_bytes = (data_max_bytes > nread) ? (data_max_bytes - nread) : 0;
     }
 
-    if(h2_process_pending_input(cf, data, &result))
+    result = h2_process_pending_input(cf, data);
+    if(result)
       return result;
+    CURL_TRC_CF(data, cf, "[0] ingress: nw-in buffered %zu",
+                Curl_bufq_len(&ctx->inbufq));
   }
 
   if(ctx->conn_closed && Curl_bufq_is_empty(&ctx->inbufq)) {
-    connclose(cf->conn, "GOAWAY received");
+    connclose(cf->conn, ctx->rcvd_goaway ? "server closed with GOAWAY" :
+              "server closed abruptly");
   }
 
+  CURL_TRC_CF(data, cf, "[0] ingress: done");
   return CURLE_OK;
 }
 
-static ssize_t cf_h2_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
-                          char *buf, size_t len, CURLcode *err)
+static CURLcode cf_h2_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
+                           char *buf, size_t len, size_t *pnread)
 {
   struct cf_h2_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream = H2_STREAM_CTX(data);
-  ssize_t nread = -1;
-  CURLcode result;
+  struct h2_stream_ctx *stream;
+  CURLcode result, r2;
   struct cf_call_data save;
 
+  if(!data)
+    return CURLE_HTTP2;
+
+  stream = H2_STREAM_CTX(ctx, data);
+
+  *pnread = 0;
   if(!stream) {
     /* Abnormal call sequence: either this transfer has never opened a stream
      * (unlikely) or the transfer has been done, cleaned up its resources, but
      * a read() is called anyway. It is not clear what the calling sequence
      * is for such a case. */
-    failf(data, "[%zd-%zd], http/2 recv on a transfer never opened "
-          "or already cleared", (ssize_t)data->id,
-          (ssize_t)cf->conn->connection_id);
-    *err = CURLE_HTTP2;
-    return -1;
+    failf(data, "http/2 recv on a transfer never opened "
+          "or already cleared, mid=%u", data->mid);
+    return CURLE_HTTP2;
   }
 
   CF_DATA_SAVE(save, cf, data);
 
-  nread = stream_recv(cf, data, stream, buf, len, err);
-  if(nread < 0 && *err != CURLE_AGAIN)
+  result = stream_recv(cf, data, stream, buf, len, pnread);
+  if(result && (result != CURLE_AGAIN))
     goto out;
 
-  if(nread < 0) {
-    *err = h2_progress_ingress(cf, data);
-    if(*err)
+  if(result) {
+    result = h2_progress_ingress(cf, data, len);
+    if(result)
       goto out;
 
-    nread = stream_recv(cf, data, stream, buf, len, err);
+    result = stream_recv(cf, data, stream, buf, len, pnread);
   }
 
-  if(nread > 0) {
-    size_t data_consumed = (size_t)nread;
+  if(*pnread > 0) {
     /* Now that we transferred this to the upper layer, we report
      * the actual amount of DATA consumed to the H2 session, so
      * that it adjusts stream flow control */
-    if(stream->resp_hds_len >= data_consumed) {
-      stream->resp_hds_len -= data_consumed;  /* no DATA */
-    }
-    else {
-      if(stream->resp_hds_len) {
-        data_consumed -= stream->resp_hds_len;
-        stream->resp_hds_len = 0;
-      }
-      if(data_consumed) {
-        nghttp2_session_consume(ctx->h2, stream->id, data_consumed);
-      }
-    }
-
+    nghttp2_session_consume(ctx->h2, stream->id, *pnread);
     if(stream->closed) {
       CURL_TRC_CF(data, cf, "[%d] DRAIN closed stream", stream->id);
-      drain_stream(cf, data, stream);
+      Curl_multi_mark_dirty(data);
     }
   }
 
 out:
-  result = h2_progress_egress(cf, data);
-  if(result == CURLE_AGAIN) {
-    /* pending data to send, need to be called again. Ideally, we'd
-     * monitor the socket for POLLOUT, but we might not be in SENDING
-     * transfer state any longer and are unable to make this happen.
-     */
-    drain_stream(cf, data, stream);
+  r2 = h2_progress_egress(cf, data);
+  if(r2 == CURLE_AGAIN) {
+    /* pending data to send, need to be called again. Ideally, we
+     * monitor the socket for POLLOUT, but when not SENDING
+     * any more, we force processing of the transfer. */
+    if(!CURL_REQ_WANT_SEND(data))
+      Curl_multi_mark_dirty(data);
   }
-  else if(result) {
-    *err = result;
-    nread = -1;
+  else if(r2) {
+    result = r2;
   }
-  CURL_TRC_CF(data, cf, "[%d] cf_recv(len=%zu) -> %zd %d, "
-              "buffered=%zu, window=%d/%d, connection %d/%d",
-              stream->id, len, nread, *err,
-              Curl_bufq_len(&stream->recvbuf),
+  CURL_TRC_CF(data, cf, "[%d] cf_recv(len=%zu) -> %d, %zu, "
+              "window=%d/%d, connection %d/%d",
+              stream->id, len, (int)result, *pnread,
               nghttp2_session_get_stream_effective_recv_data_length(
                 ctx->h2, stream->id),
               nghttp2_session_get_stream_effective_local_window_size(
@@ -2009,106 +2008,147 @@ out:
               HTTP2_HUGE_WINDOW_SIZE);
 
   CF_DATA_RESTORE(cf, save);
-  return nread;
+  return result;
 }
 
-static ssize_t h2_submit(struct stream_ctx **pstream,
-                         struct Curl_cfilter *cf, struct Curl_easy *data,
-                         const void *buf, size_t len, CURLcode *err)
+static CURLcode cf_h2_body_send(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                struct h2_stream_ctx *stream,
+                                const void *buf, size_t blen, bool eos,
+                                size_t *pnwritten)
 {
   struct cf_h2_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream = NULL;
+  CURLcode result;
+
+  *pnwritten = 0;
+  if(stream->closed) {
+    if(stream->resp_hds_complete) {
+      /* Server decided to close the stream after having sent us a final
+       * response. This is valid if it is not interested in the request
+       * body. This happens on 30x or 40x responses.
+       * We silently discard the data sent, since this is not a transport
+       * error situation. */
+      CURL_TRC_CF(data, cf, "[%d] discarding data"
+                  "on closed stream with response", stream->id);
+      if(eos)
+        stream->body_eos = TRUE;
+      *pnwritten = blen;
+      return CURLE_OK;
+    }
+    /* Server closed before we got a response, this is an error */
+    infof(data, "stream %d closed", stream->id);
+    return CURLE_SEND_ERROR;
+  }
+
+  result = Curl_bufq_write(&stream->sendbuf, buf, blen, pnwritten);
+  if(result)
+    return result;
+
+  if(eos && (blen == *pnwritten))
+    stream->body_eos = TRUE;
+
+  if(eos || !Curl_bufq_is_empty(&stream->sendbuf)) {
+    /* resume the potentially suspended stream */
+    int rv = nghttp2_session_resume_data(ctx->h2, stream->id);
+    if(nghttp2_is_fatal(rv))
+      return CURLE_SEND_ERROR;
+  }
+
+  return CURLE_OK;
+}
+
+static CURLcode h2_submit(struct h2_stream_ctx **pstream,
+                          struct Curl_cfilter *cf, struct Curl_easy *data,
+                          const uint8_t *buf, size_t len,
+                          bool eos, size_t *pnwritten)
+{
+  struct cf_h2_ctx *ctx = cf->ctx;
+  struct h2_stream_ctx *stream = NULL;
   struct dynhds h2_headers;
   nghttp2_nv *nva = NULL;
   const void *body = NULL;
-  size_t nheader, bodylen, i;
+  size_t nheader, bodylen;
   nghttp2_data_provider data_prd;
   int32_t stream_id;
   nghttp2_priority_spec pri_spec;
-  ssize_t nwritten;
+  size_t nwritten;
+  CURLcode result = CURLE_OK;
+  uint32_t initial_win_size;
 
+  *pnwritten = 0;
   Curl_dynhds_init(&h2_headers, 0, DYN_HTTP_REQUEST);
 
-  *err = http2_data_setup(cf, data, &stream);
-  if(*err) {
-    nwritten = -1;
+  result = http2_data_setup(cf, data, &stream);
+  if(result)
     goto out;
-  }
 
-  nwritten = Curl_h1_req_parse_read(&stream->h1, buf, len, NULL, 0, err);
-  if(nwritten < 0)
+  result = Curl_h1_req_parse_read(&stream->h1, buf, len, NULL,
+                                  !data->state.http_ignorecustom ?
+                                  data->set.str[STRING_CUSTOMREQUEST] : NULL,
+                                  0, &nwritten);
+  if(result)
     goto out;
+  *pnwritten = nwritten;
   if(!stream->h1.done) {
     /* need more data */
     goto out;
   }
   DEBUGASSERT(stream->h1.req);
 
-  *err = Curl_http_req_to_h2(&h2_headers, stream->h1.req, data);
-  if(*err) {
-    nwritten = -1;
+  result = Curl_http_req_to_h2(&h2_headers, stream->h1.req, data);
+  if(result)
     goto out;
-  }
   /* no longer needed */
   Curl_h1_req_parse_free(&stream->h1);
 
-  nheader = Curl_dynhds_count(&h2_headers);
-  nva = malloc(sizeof(nghttp2_nv) * nheader);
+  nva = Curl_dynhds_to_nva(&h2_headers, &nheader);
   if(!nva) {
-    *err = CURLE_OUT_OF_MEMORY;
-    nwritten = -1;
+    result = CURLE_OUT_OF_MEMORY;
     goto out;
   }
 
-  for(i = 0; i < nheader; ++i) {
-    struct dynhds_entry *e = Curl_dynhds_getn(&h2_headers, i);
-    nva[i].name = (unsigned char *)e->name;
-    nva[i].namelen = e->namelen;
-    nva[i].value = (unsigned char *)e->value;
-    nva[i].valuelen = e->valuelen;
-    nva[i].flags = NGHTTP2_NV_FLAG_NONE;
-  }
-
   h2_pri_spec(data, &pri_spec);
   if(!nghttp2_session_check_request_allowed(ctx->h2))
     CURL_TRC_CF(data, cf, "send request NOT allowed (via nghttp2)");
 
+  /* Check the initial windows size of the transfer (rate-limits?) and
+   * send an updated settings on changes from previous value. */
+  initial_win_size = cf_h2_initial_win_size(data);
+  if(initial_win_size != ctx->initial_win_size) {
+    result = cf_h2_update_settings(ctx, initial_win_size);
+    if(result)
+      goto out;
+  }
+
   switch(data->state.httpreq) {
   case HTTPREQ_POST:
   case HTTPREQ_POST_FORM:
   case HTTPREQ_POST_MIME:
   case HTTPREQ_PUT:
-    if(data->state.infilesize != -1)
-      stream->upload_left = data->state.infilesize;
-    else
-      /* data sending without specifying the data amount up front */
-      stream->upload_left = -1; /* unknown */
-
     data_prd.read_callback = req_body_read_callback;
     data_prd.source.ptr = NULL;
     stream_id = nghttp2_submit_request(ctx->h2, &pri_spec, nva, nheader,
                                        &data_prd, data);
     break;
   default:
-    stream->upload_left = 0; /* no request body */
     stream_id = nghttp2_submit_request(ctx->h2, &pri_spec, nva, nheader,
                                        NULL, data);
   }
 
   if(stream_id < 0) {
-    CURL_TRC_CF(data, cf, "send: nghttp2_submit_request error (%s)%u",
+    CURL_TRC_CF(data, cf, "send: nghttp2_submit_request error (%s)%d",
                 nghttp2_strerror(stream_id), stream_id);
-    *err = CURLE_SEND_ERROR;
-    nwritten = -1;
+    result = CURLE_SEND_ERROR;
     goto out;
   }
 
+#ifdef CURLVERBOSE
 #define MAX_ACC 60000  /* <64KB to account for some overhead */
   if(Curl_trc_is_verbose(data)) {
-    size_t acc = 0;
+    size_t acc = 0, i;
 
     infof(data, "[HTTP/2] [%d] OPENED stream for %s",
-          stream_id, data->state.url);
+          stream_id, Curl_bufref_ptr(&data->state.url));
     for(i = 0; i < nheader; ++i) {
       acc += nva[i].namelen + nva[i].valuelen;
 
@@ -2123,197 +2163,107 @@ static ssize_t h2_submit(struct stream_ctx **pstream,
             "stream to be rejected.", MAX_ACC);
     }
   }
+#endif
 
   stream->id = stream_id;
-  stream->local_window_size = H2_STREAM_WINDOW_SIZE;
-  if(data->set.max_recv_speed) {
-    /* We are asked to only receive `max_recv_speed` bytes per second.
-     * Let's limit our stream window size around that, otherwise the server
-     * will send in large bursts only. We make the window 50% larger to
-     * allow for data in flight and avoid stalling. */
-    curl_off_t n = (((data->set.max_recv_speed - 1) / H2_CHUNK_SIZE) + 1);
-    n += CURLMAX((n/2), 1);
-    if(n < (H2_STREAM_WINDOW_SIZE / H2_CHUNK_SIZE) &&
-       n < (UINT_MAX / H2_CHUNK_SIZE)) {
-      stream->local_window_size = (uint32_t)n * H2_CHUNK_SIZE;
-    }
-  }
 
-  body = (const char *)buf + nwritten;
-  bodylen = len - nwritten;
+  body = (const char *)buf + *pnwritten;
+  bodylen = len - *pnwritten;
 
-  if(bodylen) {
-    /* We have request body to send in DATA frame */
-    ssize_t n = Curl_bufq_write(&stream->sendbuf, body, bodylen, err);
-    if(n < 0) {
-      *err = CURLE_SEND_ERROR;
-      nwritten = -1;
-      goto out;
+  if(bodylen || eos) {
+    size_t n;
+    result = cf_h2_body_send(cf, data, stream, body, bodylen, eos, &n);
+    if(!result)
+      *pnwritten += n;
+    else if(result == CURLE_AGAIN)
+      result = CURLE_OK;
+    else {
+      result = CURLE_SEND_ERROR;
     }
-    nwritten += n;
   }
 
 out:
-  CURL_TRC_CF(data, cf, "[%d] submit -> %zd, %d",
-              stream? stream->id : -1, nwritten, *err);
-  Curl_safefree(nva);
+  CURL_TRC_CF(data, cf, "[%d] submit -> %d, %zu",
+              stream ? stream->id : -1, (int)result, *pnwritten);
+  curlx_safefree(nva);
   *pstream = stream;
   Curl_dynhds_free(&h2_headers);
-  return nwritten;
+  return result;
 }
 
-static ssize_t cf_h2_send(struct Curl_cfilter *cf, struct Curl_easy *data,
-                          const void *buf, size_t len, CURLcode *err)
+static CURLcode cf_h2_send(struct Curl_cfilter *cf, struct Curl_easy *data,
+                           const uint8_t *buf, size_t len, bool eos,
+                           size_t *pnwritten)
 {
   struct cf_h2_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream = H2_STREAM_CTX(data);
+  struct h2_stream_ctx *stream = H2_STREAM_CTX(ctx, data);
   struct cf_call_data save;
-  int rv;
-  ssize_t nwritten;
-  CURLcode result;
-  int blocked = 0, was_blocked = 0;
+  CURLcode result = CURLE_OK, r2;
 
   CF_DATA_SAVE(save, cf, data);
+  *pnwritten = 0;
 
-  if(stream && stream->id != -1) {
-    if(stream->upload_blocked_len) {
-      /* the data in `buf` has already been submitted or added to the
-       * buffers, but have been EAGAINed on the last invocation. */
-      /* TODO: this assertion triggers in OSSFuzz runs and it is not
-       * clear why. Disable for now to let OSSFuzz continue its tests. */
-      DEBUGASSERT(len >= stream->upload_blocked_len);
-      if(len < stream->upload_blocked_len) {
-        /* Did we get called again with a smaller `len`? This should not
-         * happen. We are not prepared to handle that. */
-        failf(data, "HTTP/2 send again with decreased length (%zd vs %zd)",
-              len, stream->upload_blocked_len);
-        *err = CURLE_HTTP2;
-        nwritten = -1;
-        goto out;
-      }
-      nwritten = (ssize_t)stream->upload_blocked_len;
-      stream->upload_blocked_len = 0;
-      was_blocked = 1;
-    }
-    else if(stream->closed) {
-      if(stream->resp_hds_complete) {
-        /* Server decided to close the stream after having sent us a findl
-         * response. This is valid if it is not interested in the request
-         * body. This happens on 30x or 40x responses.
-         * We silently discard the data sent, since this is not a transport
-         * error situation. */
-        CURL_TRC_CF(data, cf, "[%d] discarding data"
-                    "on closed stream with response", stream->id);
-        *err = CURLE_OK;
-        nwritten = (ssize_t)len;
-        goto out;
-      }
-      infof(data, "stream %u closed", stream->id);
-      *err = CURLE_SEND_ERROR;
-      nwritten = -1;
+  if(!stream || stream->id == -1) {
+    result = h2_submit(&stream, cf, data, buf, len, eos, pnwritten);
+    if(result)
       goto out;
-    }
-    else {
-      /* If stream_id != -1, we have dispatched request HEADERS and
-       * optionally request body, and now are going to send or sending
-       * more request body in DATA frame */
-      nwritten = Curl_bufq_write(&stream->sendbuf, buf, len, err);
-      if(nwritten < 0 && *err != CURLE_AGAIN)
-        goto out;
-    }
-
-    if(!Curl_bufq_is_empty(&stream->sendbuf)) {
-      /* req body data is buffered, resume the potentially suspended stream */
-      rv = nghttp2_session_resume_data(ctx->h2, stream->id);
-      if(nghttp2_is_fatal(rv)) {
-        *err = CURLE_SEND_ERROR;
-        nwritten = -1;
-        goto out;
-      }
-    }
+    DEBUGASSERT(stream);
+  }
+  else if(stream->body_eos) {
+    /* We already wrote this, but CURLE_AGAIN-ed the call due to not
+     * being able to flush stream->sendbuf. Make a 0-length write
+     * to trigger flushing again.
+     * If this works, we report to have written `len` bytes. */
+    size_t n;
+    DEBUGASSERT(eos);
+    result = cf_h2_body_send(cf, data, stream, buf, 0, eos, &n);
+    CURL_TRC_CF(data, cf, "[%d] cf_body_send last CHUNK -> %d, %zu, eos=%d",
+                stream->id, (int)result, n, eos);
+    if(result)
+      goto out;
+    *pnwritten = len;
   }
   else {
-    nwritten = h2_submit(&stream, cf, data, buf, len, err);
-    if(nwritten < 0) {
-      goto out;
-    }
-    DEBUGASSERT(stream);
+    result = cf_h2_body_send(cf, data, stream, buf, len, eos, pnwritten);
+    CURL_TRC_CF(data, cf, "[%d] cf_body_send(len=%zu) -> %d, %zu, eos=%d",
+                stream->id, len, (int)result, *pnwritten, eos);
   }
 
   /* Call the nghttp2 send loop and flush to write ALL buffered data,
    * headers and/or request body completely out to the network */
-  result = h2_progress_egress(cf, data);
+  r2 = h2_progress_egress(cf, data);
+
   /* if the stream has been closed in egress handling (nghttp2 does that
    * when it does not like the headers, for example */
-  if(stream && stream->closed && !was_blocked) {
-    infof(data, "stream %u closed", stream->id);
-    *err = CURLE_SEND_ERROR;
-    nwritten = -1;
+  if(stream && stream->closed) {
+    infof(data, "stream %d closed", stream->id);
+    result = CURLE_SEND_ERROR;
     goto out;
   }
-  else if(result == CURLE_AGAIN) {
-    blocked = 1;
-  }
-  else if(result) {
-    *err = result;
-    nwritten = -1;
+  else if(r2 && (r2 != CURLE_AGAIN)) {
+    result = r2;
     goto out;
   }
-  else if(stream && !Curl_bufq_is_empty(&stream->sendbuf)) {
-    /* although we wrote everything that nghttp2 wants to send now,
-     * there is data left in our stream send buffer unwritten. This may
-     * be due to the stream's HTTP/2 flow window being exhausted. */
-    blocked = 1;
-  }
 
-  if(stream && blocked && nwritten > 0) {
-    /* Unable to send all data, due to connection blocked or H2 window
-     * exhaustion. Data is left in our stream buffer, or nghttp2's internal
-     * frame buffer or our network out buffer. */
-    size_t rwin = nghttp2_session_get_stream_remote_window_size(ctx->h2,
-                                                                stream->id);
-    if(rwin == 0) {
-      /* H2 flow window exhaustion. We need to HOLD upload until we get
-       * a WINDOW_UPDATE from the server. */
-      data->req.keepon |= KEEP_SEND_HOLD;
-      CURL_TRC_CF(data, cf, "[%d] holding send as remote flow "
-                  "window is exhausted", stream->id);
-    }
-
-    /* Whatever the cause, we need to return CURL_EAGAIN for this call.
-     * We have unwritten state that needs us being invoked again and EAGAIN
-     * is the only way to ensure that. */
-    stream->upload_blocked_len = nwritten;
-    CURL_TRC_CF(data, cf, "[%d] cf_send(len=%zu) BLOCK: win %u/%zu "
-                "blocked_len=%zu",
-                stream->id, len,
-                nghttp2_session_get_remote_window_size(ctx->h2), rwin,
-                nwritten);
-    *err = CURLE_AGAIN;
-    nwritten = -1;
-    goto out;
-  }
-  else if(should_close_session(ctx)) {
+  if(should_close_session(ctx)) {
     /* nghttp2 thinks this session is done. If the stream has not been
      * closed, this is an error state for out transfer */
-    if(stream->closed) {
-      nwritten = http2_handle_stream_close(cf, data, stream, err);
+    if(stream && stream->closed) {
+      result = http2_handle_stream_close(cf, data, stream, pnwritten);
     }
     else {
       CURL_TRC_CF(data, cf, "send: nothing to do in this session");
-      *err = CURLE_HTTP2;
-      nwritten = -1;
+      result = CURLE_HTTP2;
     }
   }
 
 out:
   if(stream) {
-    CURL_TRC_CF(data, cf, "[%d] cf_send(len=%zu) -> %zd, %d, "
-                "upload_left=%" CURL_FORMAT_CURL_OFF_T ", "
-                "h2 windows %d-%d (stream-conn), "
+    CURL_TRC_CF(data, cf, "[%d] cf_send(len=%zu) -> %d, %zu, "
+                "eos=%d, h2 windows %d-%d (stream-conn), "
                 "buffers %zu-%zu (stream-conn)",
-                stream->id, len, nwritten, *err,
-                (ssize_t)stream->upload_left,
+                stream->id, len, (int)result, *pnwritten,
+                stream->body_eos,
                 nghttp2_session_get_stream_remote_window_size(
                   ctx->h2, stream->id),
                 nghttp2_session_get_remote_window_size(ctx->h2),
@@ -2321,55 +2271,229 @@ out:
                 Curl_bufq_len(&ctx->outbufq));
   }
   else {
-    CURL_TRC_CF(data, cf, "cf_send(len=%zu) -> %zd, %d, "
+    CURL_TRC_CF(data, cf, "cf_send(len=%zu) -> %d, %zu, "
                 "connection-window=%d, nw_send_buffer(%zu)",
-                len, nwritten, *err,
+                len, (int)result, *pnwritten,
                 nghttp2_session_get_remote_window_size(ctx->h2),
                 Curl_bufq_len(&ctx->outbufq));
   }
   CF_DATA_RESTORE(cf, save);
-  return nwritten;
+  return result;
 }
 
-static int cf_h2_get_select_socks(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  curl_socket_t *sock)
+static CURLcode cf_h2_flush(struct Curl_cfilter *cf,
+                            struct Curl_easy *data)
 {
   struct cf_h2_ctx *ctx = cf->ctx;
-  struct SingleRequest *k = &data->req;
-  struct stream_ctx *stream = H2_STREAM_CTX(data);
-  int bitmap = GETSOCK_BLANK;
+  struct h2_stream_ctx *stream = H2_STREAM_CTX(ctx, data);
   struct cf_call_data save;
+  CURLcode result = CURLE_OK;
 
   CF_DATA_SAVE(save, cf, data);
-  sock[0] = Curl_conn_cf_get_socket(cf, data);
+  if(stream && !Curl_bufq_is_empty(&stream->sendbuf)) {
+    /* resume the potentially suspended stream */
+    int rv = nghttp2_session_resume_data(ctx->h2, stream->id);
+    if(nghttp2_is_fatal(rv)) {
+      result = CURLE_SEND_ERROR;
+      goto out;
+    }
+  }
 
-  if(!(k->keepon & (KEEP_RECV_PAUSE|KEEP_RECV_HOLD)))
-    /* Unless paused - in an HTTP/2 connection we can basically always get a
-       frame so we should always be ready for one */
-    bitmap |= GETSOCK_READSOCK(0);
-
-  /* we're (still uploading OR the HTTP/2 layer wants to send data) AND
-     there's a window to send data in */
-  if((((k->keepon & KEEP_SENDBITS) == KEEP_SEND) ||
-      nghttp2_session_want_write(ctx->h2)) &&
-     (nghttp2_session_get_remote_window_size(ctx->h2) &&
-      nghttp2_session_get_stream_remote_window_size(ctx->h2,
-                                                    stream->id)))
-    bitmap |= GETSOCK_WRITESOCK(0);
+  result = h2_progress_egress(cf, data);
 
+out:
+  if(stream) {
+    CURL_TRC_CF(data, cf, "[%d] flush -> %d, "
+                "h2 windows %d-%d (stream-conn), "
+                "buffers %zu-%zu (stream-conn)",
+                stream->id, (int)result,
+                nghttp2_session_get_stream_remote_window_size(
+                  ctx->h2, stream->id),
+                nghttp2_session_get_remote_window_size(ctx->h2),
+                Curl_bufq_len(&stream->sendbuf),
+                Curl_bufq_len(&ctx->outbufq));
+  }
+  else {
+    CURL_TRC_CF(data, cf, "flush -> %d, "
+                "connection-window=%d, nw_send_buffer(%zu)",
+                (int)result, nghttp2_session_get_remote_window_size(ctx->h2),
+                Curl_bufq_len(&ctx->outbufq));
+  }
   CF_DATA_RESTORE(cf, save);
-  return bitmap;
+  return result;
 }
 
+static CURLcode cf_h2_adjust_pollset(struct Curl_cfilter *cf,
+                                     struct Curl_easy *data,
+                                     struct easy_pollset *ps)
+{
+  struct cf_h2_ctx *ctx = cf->ctx;
+  struct cf_call_data save;
+  curl_socket_t sock;
+  bool want_recv, want_send;
+  CURLcode result = CURLE_OK;
+
+  if(!ctx->h2)
+    return CURLE_OK;
+
+  sock = Curl_conn_cf_get_socket(cf, data);
+  Curl_pollset_check(data, ps, sock, &want_recv, &want_send);
+  if(want_recv || want_send) {
+    struct h2_stream_ctx *stream = H2_STREAM_CTX(ctx, data);
+    bool c_exhaust, s_exhaust;
+
+    CF_DATA_SAVE(save, cf, data);
+    c_exhaust = want_send && !nghttp2_session_get_remote_window_size(ctx->h2);
+    s_exhaust = want_send && stream && stream->id >= 0 &&
+                !nghttp2_session_get_stream_remote_window_size(ctx->h2,
+                                                               stream->id);
+    want_recv = (want_recv || c_exhaust || s_exhaust);
+    want_send = (!s_exhaust && want_send) ||
+                (!c_exhaust && nghttp2_session_want_write(ctx->h2)) ||
+                !Curl_bufq_is_empty(&ctx->outbufq);
+
+    result = Curl_pollset_set(data, ps, sock, want_recv, want_send);
+    CF_DATA_RESTORE(cf, save);
+  }
+  else if(ctx->sent_goaway && !cf->shutdown) {
+    /* shutdown in progress */
+    CF_DATA_SAVE(save, cf, data);
+    want_send = nghttp2_session_want_write(ctx->h2) ||
+                !Curl_bufq_is_empty(&ctx->outbufq);
+    want_recv = nghttp2_session_want_read(ctx->h2);
+    result = Curl_pollset_set(data, ps, sock, want_recv, want_send);
+    CF_DATA_RESTORE(cf, save);
+  }
+  return result;
+}
+
+static CURLcode cf_h2_ctx_open(struct Curl_cfilter *cf,
+                               struct Curl_easy *data)
+{
+  struct cf_h2_ctx *ctx = cf->ctx;
+  struct h2_stream_ctx *stream;
+  CURLcode result = CURLE_OUT_OF_MEMORY;
+  int rc;
+  nghttp2_session_callbacks *cbs = NULL;
+
+  DEBUGASSERT(!ctx->h2);
+  DEBUGASSERT(ctx->initialized);
+
+  rc = nghttp2_session_callbacks_new(&cbs);
+  if(rc) {
+    failf(data, "Could not initialize nghttp2 callbacks");
+    goto out;
+  }
+
+  nghttp2_session_callbacks_set_send_callback(cbs, send_callback);
+  nghttp2_session_callbacks_set_on_frame_recv_callback(cbs, on_frame_recv);
+  nghttp2_session_callbacks_set_on_invalid_frame_recv_callback(cbs,
+    cf_h2_on_invalid_frame_recv);
+#ifdef CURLVERBOSE
+  nghttp2_session_callbacks_set_on_frame_send_callback(cbs, on_frame_send);
+#endif
+  nghttp2_session_callbacks_set_on_data_chunk_recv_callback(
+    cbs, on_data_chunk_recv);
+  nghttp2_session_callbacks_set_on_stream_close_callback(cbs, on_stream_close);
+  nghttp2_session_callbacks_set_on_begin_headers_callback(
+    cbs, on_begin_headers);
+  nghttp2_session_callbacks_set_on_header_callback(cbs, on_header);
+#ifdef CURLVERBOSE
+  nghttp2_session_callbacks_set_error_callback(cbs, error_callback);
+#endif
+
+  /* The nghttp2 session is not yet setup, do it */
+  rc = h2_client_new(cf, cbs);
+  if(rc) {
+    failf(data, "Could not initialize nghttp2");
+    goto out;
+  }
+  ctx->max_concurrent_streams = DEFAULT_MAX_CONCURRENT_STREAMS;
+
+  if(ctx->via_h1_upgrade) {
+    /* HTTP/1.1 Upgrade issued. H2 Settings have already been submitted
+     * in the H1 request and we upgrade from there. This stream
+     * is opened implicitly as #1. */
+    uint8_t binsettings[H2_BINSETTINGS_LEN];
+    ssize_t rclen;
+    size_t binlen; /* length of the binsettings data */
+
+    rclen = populate_binsettings(binsettings, data);
+
+    if(!curlx_sztouz(rclen, &binlen) || !binlen) {
+      failf(data, "nghttp2 unexpectedly failed on pack_settings_payload");
+      result = CURLE_FAILED_INIT;
+      goto out;
+    }
+
+    result = http2_data_setup(cf, data, &stream);
+    if(result)
+      goto out;
+    DEBUGASSERT(stream);
+    stream->id = 1;
+    /* queue SETTINGS frame (again) */
+    rc = nghttp2_session_upgrade2(ctx->h2, binsettings, binlen,
+                                  data->state.httpreq == HTTPREQ_HEAD,
+                                  NULL);
+    if(rc) {
+      failf(data, "nghttp2_session_upgrade2() failed: %s(%d)",
+            nghttp2_strerror(rc), rc);
+      result = CURLE_HTTP2;
+      goto out;
+    }
+
+    rc = nghttp2_session_set_stream_user_data(ctx->h2, stream->id,
+                                              data);
+    if(rc) {
+      infof(data, "http/2: failed to set user_data for stream %d",
+            stream->id);
+      DEBUGASSERT(0);
+    }
+    CURL_TRC_CF(data, cf, "created session via Upgrade");
+  }
+  else {
+    nghttp2_settings_entry iv[H2_SETTINGS_IV_LEN];
+    size_t ivlen;
+
+    ivlen = populate_settings(iv, data, ctx);
+    rc = nghttp2_submit_settings(ctx->h2, NGHTTP2_FLAG_NONE,
+                                 iv, ivlen);
+    if(rc) {
+      failf(data, "nghttp2_submit_settings() failed: %s(%d)",
+            nghttp2_strerror(rc), rc);
+      result = CURLE_HTTP2;
+      goto out;
+    }
+  }
+
+  rc = nghttp2_session_set_local_window_size(ctx->h2, NGHTTP2_FLAG_NONE, 0,
+                                             HTTP2_HUGE_WINDOW_SIZE);
+  if(rc) {
+    failf(data, "nghttp2_session_set_local_window_size() failed: %s(%d)",
+          nghttp2_strerror(rc), rc);
+    result = CURLE_HTTP2;
+    goto out;
+  }
+
+  /* all set, traffic will be send on connect */
+  result = CURLE_OK;
+  CURL_TRC_CF(data, cf, "[0] created h2 session%s",
+              ctx->via_h1_upgrade ? " (via h1 upgrade)" : "");
+
+out:
+  if(cbs)
+    nghttp2_session_callbacks_del(cbs);
+  return result;
+}
 
 static CURLcode cf_h2_connect(struct Curl_cfilter *cf,
                               struct Curl_easy *data,
-                              bool blocking, bool *done)
+                              bool *done)
 {
   struct cf_h2_ctx *ctx = cf->ctx;
   CURLcode result = CURLE_OK;
   struct cf_call_data save;
+  bool first_time = FALSE;
 
   if(cf->connected) {
     *done = TRUE;
@@ -2378,7 +2502,7 @@ static CURLcode cf_h2_connect(struct Curl_cfilter *cf,
 
   /* Connect the lower filters first */
   if(!cf->next->connected) {
-    result = Curl_conn_cf_connect(cf->next, data, blocking, done);
+    result = Curl_conn_cf_connect(cf->next, data, done);
     if(result || !*done)
       return result;
   }
@@ -2386,22 +2510,24 @@ static CURLcode cf_h2_connect(struct Curl_cfilter *cf,
   *done = FALSE;
 
   CF_DATA_SAVE(save, cf, data);
+  DEBUGASSERT(ctx->initialized);
   if(!ctx->h2) {
-    result = cf_h2_ctx_init(cf, data, FALSE);
+    result = cf_h2_ctx_open(cf, data);
+    if(result)
+      goto out;
+    first_time = TRUE;
+  }
+
+  if(!first_time) {
+    result = h2_progress_ingress(cf, data, 0);
     if(result)
       goto out;
   }
 
-  result = h2_progress_ingress(cf, data);
-  if(result)
-    goto out;
-
   /* Send out our SETTINGS and ACKs and such. If that blocks, we
-   * have it buffered and  can count this filter as being connected */
+   * have it buffered and can count this filter as being connected */
   result = h2_progress_egress(cf, data);
-  if(result == CURLE_AGAIN)
-    result = CURLE_OK;
-  else if(result)
+  if(result && (result != CURLE_AGAIN))
     goto out;
 
   *done = TRUE;
@@ -2409,24 +2535,11 @@ static CURLcode cf_h2_connect(struct Curl_cfilter *cf,
   result = CURLE_OK;
 
 out:
-  CURL_TRC_CF(data, cf, "cf_connect() -> %d, %d, ", result, *done);
+  CURL_TRC_CF(data, cf, "cf_connect() -> %d, %d, ", (int)result, *done);
   CF_DATA_RESTORE(cf, save);
   return result;
 }
 
-static void cf_h2_close(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_h2_ctx *ctx = cf->ctx;
-
-  if(ctx) {
-    struct cf_call_data save;
-
-    CF_DATA_SAVE(save, cf, data);
-    cf_h2_ctx_clear(ctx);
-    CF_DATA_RESTORE(cf, save);
-  }
-}
-
 static void cf_h2_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
 {
   struct cf_h2_ctx *ctx = cf->ctx;
@@ -2438,30 +2551,71 @@ static void cf_h2_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
   }
 }
 
+static CURLcode cf_h2_shutdown(struct Curl_cfilter *cf,
+                               struct Curl_easy *data, bool *done)
+{
+  struct cf_h2_ctx *ctx = cf->ctx;
+  struct cf_call_data save;
+  CURLcode result;
+  int rv;
+
+  if(!cf->connected || !ctx->h2 || cf->shutdown || ctx->conn_closed) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  CF_DATA_SAVE(save, cf, data);
+
+  if(!ctx->sent_goaway) {
+    ctx->sent_goaway = TRUE;
+    rv = nghttp2_submit_goaway(ctx->h2, NGHTTP2_FLAG_NONE,
+                               ctx->local_max_sid, 0,
+                               (const uint8_t *)"shutdown",
+                               sizeof("shutdown"));
+    if(rv) {
+      failf(data, "nghttp2_submit_goaway() failed: %s(%d)",
+            nghttp2_strerror(rv), rv);
+      result = CURLE_SEND_ERROR;
+      goto out;
+    }
+  }
+  /* GOAWAY submitted, process egress and ingress until nghttp2 is done. */
+  result = CURLE_OK;
+  if(nghttp2_session_want_write(ctx->h2) ||
+     !Curl_bufq_is_empty(&ctx->outbufq))
+    result = h2_progress_egress(cf, data);
+  if(!result && nghttp2_session_want_read(ctx->h2))
+    result = h2_progress_ingress(cf, data, 0);
+
+  if(result == CURLE_AGAIN)
+    result = CURLE_OK;
+
+  *done = (ctx->conn_closed ||
+           (!result && !nghttp2_session_want_write(ctx->h2) &&
+            !nghttp2_session_want_read(ctx->h2) &&
+            Curl_bufq_is_empty(&ctx->outbufq)));
+
+out:
+  CF_DATA_RESTORE(cf, save);
+  cf->shutdown = (result || *done);
+  return result;
+}
+
 static CURLcode http2_data_pause(struct Curl_cfilter *cf,
                                  struct Curl_easy *data,
                                  bool pause)
 {
-#ifdef NGHTTP2_HAS_SET_LOCAL_WINDOW_SIZE
   struct cf_h2_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream = H2_STREAM_CTX(data);
+  struct h2_stream_ctx *stream = H2_STREAM_CTX(ctx, data);
 
   DEBUGASSERT(data);
   if(ctx && ctx->h2 && stream) {
-    uint32_t window = pause? 0 : stream->local_window_size;
+    CURLcode result;
 
-    int rv = nghttp2_session_set_local_window_size(ctx->h2,
-                                                   NGHTTP2_FLAG_NONE,
-                                                   stream->id,
-                                                   window);
-    if(rv) {
-      failf(data, "nghttp2_session_set_local_window_size() failed: %s(%d)",
-            nghttp2_strerror(rv), rv);
-      return CURLE_HTTP2;
-    }
-
-    if(!pause)
-      drain_stream(cf, data, stream);
+    stream->write_paused = pause;
+    result = cf_h2_update_local_win(cf, data, stream);
+    if(result)
+      return result;
 
     /* attempt to send the window update */
     (void)h2_progress_egress(cf, data);
@@ -2472,24 +2626,11 @@ static CURLcode http2_data_pause(struct Curl_cfilter *cf,
        * not. We may have already buffered and exhausted the new window
        * by operating on things in flight during the handling of other
        * transfers. */
-      drain_stream(cf, data, stream);
-      Curl_expire(data, 0, EXPIRE_RUN_NOW);
+      Curl_multi_mark_dirty(data);
     }
-    DEBUGF(infof(data, "Set HTTP/2 window size to %u for stream %u",
-                 window, stream->id));
-
-#ifdef DEBUGBUILD
-    {
-      /* read out the stream local window again */
-      uint32_t window2 =
-        nghttp2_session_get_stream_local_window_size(ctx->h2,
-                                                     stream->id);
-      DEBUGF(infof(data, "HTTP/2 window size is now %u for stream %u",
-                   window2, stream->id));
-    }
-#endif
+    CURL_TRC_CF(data, cf, "[%d] stream now %spaused", stream->id,
+                pause ? "" : "un");
   }
-#endif
   return CURLE_OK;
 }
 
@@ -2509,14 +2650,18 @@ static CURLcode cf_h2_cntrl(struct Curl_cfilter *cf,
   case CF_CTRL_DATA_PAUSE:
     result = http2_data_pause(cf, data, (arg1 != 0));
     break;
-  case CF_CTRL_DATA_DONE_SEND: {
-    result = http2_data_done_send(cf, data);
+  case CF_CTRL_FLUSH:
+    result = cf_h2_flush(cf, data);
     break;
-  }
-  case CF_CTRL_DATA_DONE: {
-    http2_data_done(cf, data, arg1 != 0);
+  case CF_CTRL_DATA_DONE:
+    http2_data_done(cf, data);
+    break;
+  case CF_CTRL_CONN_INFO_UPDATE:
+    if(!cf->sockindex && cf->connected) {
+      cf->conn->httpversion_seen = 20;
+      Curl_conn_set_multiplex(cf->conn);
+    }
     break;
-  }
   default:
     break;
   }
@@ -2528,13 +2673,10 @@ static bool cf_h2_data_pending(struct Curl_cfilter *cf,
                                const struct Curl_easy *data)
 {
   struct cf_h2_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream = H2_STREAM_CTX(data);
 
-  if(ctx && (!Curl_bufq_is_empty(&ctx->inbufq)
-            || (stream && !Curl_bufq_is_empty(&stream->sendbuf))
-            || (stream && !Curl_bufq_is_empty(&stream->recvbuf))))
+  if(ctx && !Curl_bufq_is_empty(&ctx->inbufq))
     return TRUE;
-  return cf->next? cf->next->cft->has_data_pending(cf->next, data) : FALSE;
+  return cf->next ? cf->next->cft->has_data_pending(cf->next, data) : FALSE;
 }
 
 static bool cf_h2_is_alive(struct Curl_cfilter *cf,
@@ -2542,15 +2684,16 @@ static bool cf_h2_is_alive(struct Curl_cfilter *cf,
                            bool *input_pending)
 {
   struct cf_h2_ctx *ctx = cf->ctx;
-  CURLcode result;
+  bool alive;
   struct cf_call_data save;
 
+  *input_pending = FALSE;
   CF_DATA_SAVE(save, cf, data);
-  result = (ctx && ctx->h2 && http2_connisalive(cf, data, input_pending));
+  alive = (ctx && ctx->h2 && http2_connisalive(cf, data, input_pending));
   CURL_TRC_CF(data, cf, "conn alive -> %d, input_pending=%d",
-              result, *input_pending);
+              alive, *input_pending);
   CF_DATA_RESTORE(cf, save);
-  return result;
+  return alive;
 }
 
 static CURLcode cf_h2_keep_alive(struct Curl_cfilter *cf,
@@ -2578,33 +2721,49 @@ static CURLcode cf_h2_query(struct Curl_cfilter *cf,
     DEBUGASSERT(pres1);
 
     CF_DATA_SAVE(save, cf, data);
-    if(nghttp2_session_check_request_allowed(ctx->h2) == 0) {
+    if(!ctx->h2 || !nghttp2_session_check_request_allowed(ctx->h2)) {
       /* the limit is what we have in use right now */
-      effective_max = CONN_INUSE(cf->conn);
+      effective_max = cf->conn->attached_xfers;
     }
     else {
       effective_max = ctx->max_concurrent_streams;
     }
-    *pres1 = (effective_max > INT_MAX)? INT_MAX : (int)effective_max;
+    *pres1 = (effective_max > INT_MAX) ? INT_MAX : (int)effective_max;
     CF_DATA_RESTORE(cf, save);
     return CURLE_OK;
+  case CF_QUERY_STREAM_ERROR: {
+    struct h2_stream_ctx *stream = H2_STREAM_CTX(ctx, data);
+    *pres1 = stream ? (int)stream->error : 0;
+    return CURLE_OK;
+  }
+  case CF_QUERY_NEED_FLUSH: {
+    struct h2_stream_ctx *stream = H2_STREAM_CTX(ctx, data);
+    if(!Curl_bufq_is_empty(&ctx->outbufq) ||
+       (stream && !Curl_bufq_is_empty(&stream->sendbuf))) {
+      *pres1 = TRUE;
+      return CURLE_OK;
+    }
+    break;
+  }
+  case CF_QUERY_HTTP_VERSION:
+    *pres1 = 20;
+    return CURLE_OK;
   default:
     break;
   }
-  return cf->next?
+  return cf->next ?
     cf->next->cft->query(cf->next, data, query, pres1, pres2) :
     CURLE_UNKNOWN_OPTION;
 }
 
 struct Curl_cftype Curl_cft_nghttp2 = {
   "HTTP/2",
-  CF_TYPE_MULTIPLEX,
+  CF_TYPE_MULTIPLEX | CF_TYPE_HTTP,
   CURL_LOG_LVL_NONE,
   cf_h2_destroy,
   cf_h2_connect,
-  cf_h2_close,
-  Curl_cf_def_get_host,
-  cf_h2_get_select_socks,
+  cf_h2_shutdown,
+  cf_h2_adjust_pollset,
   cf_h2_data_pending,
   cf_h2_send,
   cf_h2_recv,
@@ -2617,49 +2776,53 @@ struct Curl_cftype Curl_cft_nghttp2 = {
 static CURLcode http2_cfilter_add(struct Curl_cfilter **pcf,
                                   struct Curl_easy *data,
                                   struct connectdata *conn,
-                                  int sockindex)
+                                  int sockindex,
+                                  bool via_h1_upgrade)
 {
   struct Curl_cfilter *cf = NULL;
   struct cf_h2_ctx *ctx;
   CURLcode result = CURLE_OUT_OF_MEMORY;
 
   DEBUGASSERT(data->conn);
-  ctx = calloc(sizeof(*ctx), 1);
+  ctx = curlx_calloc(1, sizeof(*ctx));
   if(!ctx)
     goto out;
+  cf_h2_ctx_init(ctx, via_h1_upgrade);
 
   result = Curl_cf_create(&cf, &Curl_cft_nghttp2, ctx);
   if(result)
     goto out;
 
+  ctx = NULL;
   Curl_conn_cf_add(data, conn, sockindex, cf);
-  result = CURLE_OK;
 
 out:
   if(result)
     cf_h2_ctx_free(ctx);
-  *pcf = result? NULL : cf;
+  *pcf = result ? NULL : cf;
   return result;
 }
 
 static CURLcode http2_cfilter_insert_after(struct Curl_cfilter *cf,
-                                           struct Curl_easy *data)
+                                           struct Curl_easy *data,
+                                           bool via_h1_upgrade)
 {
   struct Curl_cfilter *cf_h2 = NULL;
   struct cf_h2_ctx *ctx;
   CURLcode result = CURLE_OUT_OF_MEMORY;
 
   (void)data;
-  ctx = calloc(sizeof(*ctx), 1);
+  ctx = curlx_calloc(1, sizeof(*ctx));
   if(!ctx)
     goto out;
+  cf_h2_ctx_init(ctx, via_h1_upgrade);
 
   result = Curl_cf_create(&cf_h2, &Curl_cft_nghttp2, ctx);
   if(result)
     goto out;
 
+  ctx = NULL;
   Curl_conn_cf_insert_after(cf, cf_h2);
-  result = CURLE_OK;
 
 out:
   if(result)
@@ -2667,37 +2830,13 @@ out:
   return result;
 }
 
-static bool Curl_cf_is_http2(struct Curl_cfilter *cf,
-                             const struct Curl_easy *data)
+bool Curl_http2_may_switch(struct Curl_easy *data)
 {
-  (void)data;
-  for(; cf; cf = cf->next) {
-    if(cf->cft == &Curl_cft_nghttp2)
-      return TRUE;
-    if(cf->cft->flags & CF_TYPE_IP_CONNECT)
-      return FALSE;
-  }
-  return FALSE;
-}
-
-bool Curl_conn_is_http2(const struct Curl_easy *data,
-                        const struct connectdata *conn,
-                        int sockindex)
-{
-  return conn? Curl_cf_is_http2(conn->cfilter[sockindex], data) : FALSE;
-}
-
-bool Curl_http2_may_switch(struct Curl_easy *data,
-                           struct connectdata *conn,
-                           int sockindex)
-{
-  (void)sockindex;
-  if(!Curl_conn_is_http2(data, conn, sockindex) &&
-     data->state.httpwant == CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE) {
+  if(Curl_conn_http_version(data, data->conn) < 20 &&
+     (data->state.http_neg.wanted & CURL_HTTP_V2x) &&
+     data->state.http_neg.h2_prior_knowledge) {
 #ifndef CURL_DISABLE_PROXY
-    if(conn->bits.httpproxy && !conn->bits.tunnel_proxy) {
-      /* We don't support HTTP/2 proxies yet. Also it's debatable
-         whether or not this setting should apply to HTTP/2 proxies. */
+    if(data->conn->bits.origin_is_proxy) {
       infof(data, "Ignoring HTTP/2 prior knowledge due to proxy");
       return FALSE;
     }
@@ -2707,31 +2846,21 @@ bool Curl_http2_may_switch(struct Curl_easy *data,
   return FALSE;
 }
 
-CURLcode Curl_http2_switch(struct Curl_easy *data,
-                           struct connectdata *conn, int sockindex)
+CURLcode Curl_http2_switch(struct Curl_easy *data)
 {
   struct Curl_cfilter *cf;
   CURLcode result;
 
-  DEBUGASSERT(!Curl_conn_is_http2(data, conn, sockindex));
-  DEBUGF(infof(data, "switching to HTTP/2"));
+  DEBUGASSERT(Curl_conn_http_version(data, data->conn) < 20);
 
-  result = http2_cfilter_add(&cf, data, conn, sockindex);
+  result = http2_cfilter_add(&cf, data, data->conn, FIRSTSOCKET, FALSE);
   if(result)
     return result;
-
-  result = cf_h2_ctx_init(cf, data, FALSE);
-  if(result)
-    return result;
-
-  conn->httpversion = 20; /* we know we're on HTTP/2 now */
-  conn->bits.multiplex = TRUE; /* at least potentially multiplexed */
-  conn->bundle->multiuse = BUNDLE_MULTIPLEX;
-  Curl_multi_connchanged(data->multi);
+  CURL_TRC_CF(data, cf, "switching connection to HTTP/2");
 
   if(cf->next) {
     bool done;
-    return Curl_conn_cf_connect(cf, data, FALSE, &done);
+    return Curl_conn_cf_connect(cf, data, &done);
   }
   return CURLE_OK;
 }
@@ -2741,25 +2870,17 @@ CURLcode Curl_http2_switch_at(struct Curl_cfilter *cf, struct Curl_easy *data)
   struct Curl_cfilter *cf_h2;
   CURLcode result;
 
-  DEBUGASSERT(!Curl_cf_is_http2(cf, data));
+  DEBUGASSERT(Curl_conn_http_version(data, data->conn) < 20);
 
-  result = http2_cfilter_insert_after(cf, data);
+  result = http2_cfilter_insert_after(cf, data, FALSE);
   if(result)
     return result;
 
   cf_h2 = cf->next;
-  result = cf_h2_ctx_init(cf_h2, data, FALSE);
-  if(result)
-    return result;
-
-  cf->conn->httpversion = 20; /* we know we're on HTTP/2 now */
-  cf->conn->bits.multiplex = TRUE; /* at least potentially multiplexed */
-  cf->conn->bundle->multiuse = BUNDLE_MULTIPLEX;
-  Curl_multi_connchanged(data->multi);
 
   if(cf_h2->next) {
     bool done;
-    return Curl_conn_cf_connect(cf_h2, data, FALSE, &done);
+    return Curl_conn_cf_connect(cf_h2, data, &done);
   }
   return CURLE_OK;
 }
@@ -2772,36 +2893,35 @@ CURLcode Curl_http2_upgrade(struct Curl_easy *data,
   struct cf_h2_ctx *ctx;
   CURLcode result;
 
-  DEBUGASSERT(!Curl_conn_is_http2(data, conn, sockindex));
-  DEBUGF(infof(data, "upgrading to HTTP/2"));
-  DEBUGASSERT(data->req.upgr101 == UPGR101_RECEIVED);
+  DEBUGASSERT(Curl_conn_http_version(data, conn) < 20);
 
-  result = http2_cfilter_add(&cf, data, conn, sockindex);
+  result = http2_cfilter_add(&cf, data, conn, sockindex, TRUE);
   if(result)
     return result;
+  CURL_TRC_CF(data, cf, "upgrading connection to HTTP/2");
 
   DEBUGASSERT(cf->cft == &Curl_cft_nghttp2);
   ctx = cf->ctx;
 
-  result = cf_h2_ctx_init(cf, data, TRUE);
-  if(result)
-    return result;
+  data->req.httpversion_sent = 20; /* it is an h2 request now */
+  data->req.header = TRUE; /* we expect the real response to come in h2 */
+  data->req.headerline = 0; /* restart the header line counter */
 
   if(nread > 0) {
     /* Remaining data from the protocol switch reply is already using
      * the switched protocol, ie. HTTP/2. We add that to the network
      * inbufq. */
-    ssize_t copied;
+    size_t copied;
 
-    copied = Curl_bufq_write(&ctx->inbufq,
-                             (const unsigned char *)mem, nread, &result);
-    if(copied < 0) {
-      failf(data, "error on copying HTTP Upgrade response: %d", result);
+    result = Curl_bufq_write(&ctx->inbufq,
+                             (const unsigned char *)mem, nread, &copied);
+    if(result) {
+      failf(data, "error on copying HTTP Upgrade response: %d", (int)result);
       return CURLE_RECV_ERROR;
     }
-    if((size_t)copied < nread) {
+    if(copied < nread) {
       failf(data, "connection buffer size could not take all data "
-            "from HTTP Upgrade response header: copied=%zd, datalen=%zu",
+            "from HTTP Upgrade response header: copied=%zu, datalen=%zu",
             copied, nread);
       return CURLE_HTTP2;
     }
@@ -2809,43 +2929,66 @@ CURLcode Curl_http2_upgrade(struct Curl_easy *data,
           " after upgrade: len=%zu", nread);
   }
 
-  conn->httpversion = 20; /* we know we're on HTTP/2 now */
-  conn->bits.multiplex = TRUE; /* at least potentially multiplexed */
-  conn->bundle->multiuse = BUNDLE_MULTIPLEX;
-  Curl_multi_connchanged(data->multi);
-
   if(cf->next) {
     bool done;
-    return Curl_conn_cf_connect(cf, data, FALSE, &done);
+    result = Curl_conn_cf_connect(cf, data, &done);
+    if(!result)
+      cf->cft->cntrl(cf, data, CF_CTRL_CONN_INFO_UPDATE, 0, NULL);
   }
-  return CURLE_OK;
+  return result;
 }
 
 /* Only call this function for a transfer that already got an HTTP/2
    CURLE_HTTP2_STREAM error! */
 bool Curl_h2_http_1_1_error(struct Curl_easy *data)
 {
-  struct stream_ctx *stream = H2_STREAM_CTX(data);
-  return (stream && stream->error == NGHTTP2_HTTP_1_1_REQUIRED);
+  if(Curl_conn_http_version(data, data->conn) == 20) {
+    int err = Curl_conn_get_stream_error(data, data->conn, FIRSTSOCKET);
+    return err == NGHTTP2_HTTP_1_1_REQUIRED;
+  }
+  return FALSE;
 }
 
-#else /* !USE_NGHTTP2 */
+void *Curl_nghttp2_malloc(size_t size, void *user_data)
+{
+  (void)user_data;
+  return Curl_cmalloc(size);
+}
+
+void Curl_nghttp2_free(void *ptr, void *user_data)
+{
+  (void)user_data;
+  Curl_cfree(ptr);
+}
+
+void *Curl_nghttp2_calloc(size_t nmemb, size_t size, void *user_data)
+{
+  (void)user_data;
+  return Curl_ccalloc(nmemb, size);
+}
+
+void *Curl_nghttp2_realloc(void *ptr, size_t size, void *user_data)
+{
+  (void)user_data;
+  return Curl_crealloc(ptr, size);
+}
+
+#else /* CURL_DISABLE_HTTP || !USE_NGHTTP2 */
 
 /* Satisfy external references even if http2 is not compiled in. */
-#include <curl/curl.h>
 
 char *curl_pushheader_bynum(struct curl_pushheaders *h, size_t num)
 {
-  (void) h;
-  (void) num;
+  (void)h;
+  (void)num;
   return NULL;
 }
 
-char *curl_pushheader_byname(struct curl_pushheaders *h, const char *header)
+char *curl_pushheader_byname(struct curl_pushheaders *h, const char *name)
 {
-  (void) h;
-  (void) header;
+  (void)h;
+  (void)name;
   return NULL;
 }
 
-#endif /* USE_NGHTTP2 */
+#endif /* !CURL_DISABLE_HTTP && USE_NGHTTP2 */
diff --git a/third-party/curl/lib/http2.h b/third-party/curl/lib/http2.h
index 80e183480a..e38dc5745c 100644
--- a/third-party/curl/lib/http2.h
+++ b/third-party/curl/lib/http2.h
@@ -23,11 +23,9 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef USE_NGHTTP2
-#include "http.h"
 
 /* value for MAX_CONCURRENT_STREAMS we use until we get an updated setting
    from the peer */
@@ -38,40 +36,41 @@
  */
 void Curl_http2_ver(char *p, size_t len);
 
+#ifdef CURLVERBOSE
+int Curl_nghttp2_fr_print(const nghttp2_frame *frame, char *buffer,
+                          size_t blen);
+#endif
+
 CURLcode Curl_http2_request_upgrade(struct dynbuf *req,
                                     struct Curl_easy *data);
 
 /* returns true if the HTTP/2 stream error was HTTP_1_1_REQUIRED */
 bool Curl_h2_http_1_1_error(struct Curl_easy *data);
 
-bool Curl_conn_is_http2(const struct Curl_easy *data,
-                        const struct connectdata *conn,
-                        int sockindex);
-bool Curl_http2_may_switch(struct Curl_easy *data,
-                           struct connectdata *conn,
-                           int sockindex);
+bool Curl_http2_may_switch(struct Curl_easy *data);
 
-CURLcode Curl_http2_switch(struct Curl_easy *data,
-                           struct connectdata *conn, int sockindex);
+CURLcode Curl_http2_switch(struct Curl_easy *data);
 
 CURLcode Curl_http2_switch_at(struct Curl_cfilter *cf, struct Curl_easy *data);
 
 CURLcode Curl_http2_upgrade(struct Curl_easy *data,
                             struct connectdata *conn, int sockindex,
-                            const char *ptr, size_t nread);
+                            const char *mem, size_t nread);
+
+void *Curl_nghttp2_malloc(size_t size, void *user_data);
+void Curl_nghttp2_free(void *ptr, void *user_data);
+void *Curl_nghttp2_calloc(size_t nmemb, size_t size, void *user_data);
+void *Curl_nghttp2_realloc(void *ptr, size_t size, void *user_data);
 
 extern struct Curl_cftype Curl_cft_nghttp2;
 
 #else /* USE_NGHTTP2 */
 
-#define Curl_cf_is_http2(a,b) FALSE
-#define Curl_conn_is_http2(a,b,c) FALSE
-#define Curl_http2_may_switch(a,b,c) FALSE
+#define Curl_http2_may_switch(a) FALSE
 
-#define Curl_http2_request_upgrade(x,y) CURLE_UNSUPPORTED_PROTOCOL
-#define Curl_http2_switch(a,b,c)        CURLE_UNSUPPORTED_PROTOCOL
-#define Curl_http2_upgrade(a,b,c,d,e)   CURLE_UNSUPPORTED_PROTOCOL
-#define Curl_h2_http_1_1_error(x) 0
+#define Curl_http2_request_upgrade(x, y)  CURLE_UNSUPPORTED_PROTOCOL
+#define Curl_http2_switch(a)              CURLE_UNSUPPORTED_PROTOCOL
+#define Curl_h2_http_1_1_error(x)         0
 #endif
 
 #endif /* HEADER_CURL_HTTP2_H */
diff --git a/third-party/curl/lib/http_aws_sigv4.c b/third-party/curl/lib/http_aws_sigv4.c
index f39d02cced..780eed67b9 100644
--- a/third-party/curl/lib/http_aws_sigv4.c
+++ b/third-party/curl/lib/http_aws_sigv4.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,53 +21,51 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_AWS)
 
 #include "urldata.h"
 #include "strcase.h"
-#include "strdup.h"
+#include "curlx/strdup.h"
 #include "http_aws_sigv4.h"
 #include "curl_sha256.h"
 #include "transfer.h"
-#include "parsedate.h"
-#include "sendf.h"
+#include "curl_trc.h"
+#include "escape.h"
+#include "curlx/strparse.h"
+#include "slist.h"
 
 #include <time.h>
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-#include "slist.h"
-
-#define HMAC_SHA256(k, kl, d, dl, o)           \
-  do {                                         \
-    result = Curl_hmacit(Curl_HMAC_SHA256,     \
-                         (unsigned char *)k,   \
-                         kl,                   \
-                         (unsigned char *)d,   \
-                         dl, o);               \
-    if(result) {                               \
-      goto fail;                               \
-    }                                          \
+#define HMAC_SHA256(k, kl, d, dl, o)                 \
+  do {                                               \
+    result = Curl_hmacit(&Curl_HMAC_SHA256,          \
+                         (const unsigned char *)(k), \
+                         kl,                         \
+                         (const unsigned char *)(d), \
+                         dl, o);                     \
+    if(result) {                                     \
+      goto fail;                                     \
+    }                                                \
   } while(0)
 
 #define TIMESTAMP_SIZE 17
 
 /* hex-encoded with trailing null */
-#define SHA256_HEX_LENGTH (2 * SHA256_DIGEST_LENGTH + 1)
+#define SHA256_HEX_LENGTH ((2 * CURL_SHA256_DIGEST_LENGTH) + 1)
+
+#define MAX_QUERY_COMPONENTS 128
+
+struct pair {
+  struct dynbuf key;
+  struct dynbuf value;
+};
 
 static void sha256_to_hex(char *dst, unsigned char *sha)
 {
-  int i;
-
-  for(i = 0; i < SHA256_DIGEST_LENGTH; ++i) {
-    msnprintf(dst + (i * 2), SHA256_HEX_LENGTH - (i * 2), "%02x", sha[i]);
-  }
+  Curl_hexencode(sha, CURL_SHA256_DIGEST_LENGTH,
+                 (unsigned char *)dst, SHA256_HEX_LENGTH);
 }
 
 static char *find_date_hdr(struct Curl_easy *data, const char *sig_hdr)
@@ -84,7 +82,7 @@ static void trim_headers(struct curl_slist *head)
 {
   struct curl_slist *l;
   for(l = head; l; l = l->next) {
-    char *value; /* to read from */
+    const char *value; /* to read from */
     char *store;
     size_t colon = strcspn(l->data, ":");
     Curl_strntolower(l->data, l->data, colon);
@@ -93,15 +91,14 @@ static void trim_headers(struct curl_slist *head)
     if(!*value)
       continue;
     ++value;
-    store = value;
+    store = (char *)CURL_UNCONST(value);
 
     /* skip leading whitespace */
-    while(*value && ISBLANK(*value))
-      value++;
+    curlx_str_passblanks(&value);
 
     while(*value) {
       int space = 0;
-      while(*value && ISBLANK(*value)) {
+      while(ISBLANK(*value)) {
         value++;
         space++;
       }
@@ -114,28 +111,269 @@ static void trim_headers(struct curl_slist *head)
       else
         *store++ = *value++;
     }
-    *store = 0; /* null terminate */
+    *store = 0; /* null-terminate */
   }
 }
 
+/*
+ * Frees all allocated strings in a dynbuf pair array, and the dynbuf itself
+ */
+static void pair_array_free(struct pair *pair_array, size_t num_elements)
+{
+  size_t index;
+
+  for(index = 0; index != num_elements; index++) {
+    curlx_dyn_free(&pair_array[index].key);
+    curlx_dyn_free(&pair_array[index].value);
+  }
+}
+
+/*
+ * Frees all allocated strings in a split dynbuf, and the dynbuf itself
+ */
+static void dyn_array_free(struct dynbuf *db, size_t num_elements)
+{
+  size_t index;
+
+  for(index = 0; index < num_elements; index++)
+    curlx_dyn_free((&db[index]));
+}
+
+/*
+ * Splits source string by SPLIT_BY, and creates an array of dynbuf in db.
+ * db is initialized by this function.
+ * Caller is responsible for freeing the array elements with dyn_array_free
+ */
+
+#define SPLIT_BY '&'
+
+static CURLcode split_to_dyn_array(const char *source,
+                                   struct dynbuf db[MAX_QUERY_COMPONENTS],
+                                   size_t *num_splits_out)
+{
+  CURLcode result = CURLE_OK;
+  size_t len = strlen(source);
+  size_t pos;         /* Position in result buffer */
+  size_t start = 0;   /* Start of current segment */
+  size_t segment_length = 0;
+  size_t index = 0;
+  size_t num_splits = 0;
+
+  /* Split source_ptr on SPLIT_BY and store the segment offsets and length in
+   * array */
+  for(pos = 0; pos < len; pos++) {
+    if(source[pos] == SPLIT_BY) {
+      if(segment_length) {
+        curlx_dyn_init(&db[index], segment_length + 1);
+        result = curlx_dyn_addn(&db[index], &source[start], segment_length);
+        if(result)
+          goto fail;
+
+        segment_length = 0;
+        index++;
+        if(++num_splits == MAX_QUERY_COMPONENTS) {
+          result = CURLE_TOO_LARGE;
+          goto fail;
+        }
+      }
+      start = pos + 1;
+    }
+    else {
+      segment_length++;
+    }
+  }
+
+  if(segment_length) {
+    curlx_dyn_init(&db[index], segment_length + 1);
+    result = curlx_dyn_addn(&db[index], &source[start], segment_length);
+    if(!result) {
+      if(++num_splits == MAX_QUERY_COMPONENTS)
+        result = CURLE_TOO_LARGE;
+    }
+  }
+fail:
+  *num_splits_out = num_splits;
+  return result;
+}
+
+static bool is_reserved_char(const char c)
+{
+  return (ISALNUM(c) || ISURLPUNTCS(c));
+}
+
+static CURLcode uri_encode_path(struct Curl_str *original_path,
+                                struct dynbuf *new_path)
+{
+  const char *p = curlx_str(original_path);
+  size_t i;
+
+  for(i = 0; i < curlx_strlen(original_path); i++) {
+    /* Do not encode slashes or unreserved chars from RFC 3986 */
+    CURLcode result = CURLE_OK;
+    unsigned char c = p[i];
+    if(is_reserved_char(c) || c == '/')
+      result = curlx_dyn_addn(new_path, &c, 1);
+    else
+      result = curlx_dyn_addf(new_path, "%%%02X", c);
+    if(result)
+      return result;
+  }
+
+  return CURLE_OK;
+}
+
+/* Normalize the query part. Make sure %2B is left percent encoded, and not
+   decoded to plus, then encoded to space.
+*/
+static CURLcode normalize_query(const char *string, size_t len,
+                                struct dynbuf *db)
+{
+  CURLcode result = CURLE_OK;
+
+  while(len && !result) {
+    unsigned char in = (unsigned char)*string;
+    if(('%' == in) && (len > 2) &&
+       ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
+      /* this is two hexadecimal digits following a '%' */
+      in = (unsigned char)((curlx_hexval(string[1]) << 4) |
+                           curlx_hexval(string[2]));
+      string += 3;
+      len -= 3;
+      if(in == '+') {
+        /* decodes to plus, so leave this encoded */
+        result = curlx_dyn_addn(db, "%2B", 3);
+        continue;
+      }
+    }
+    else {
+      string++;
+      len--;
+    }
+
+    if(is_reserved_char(in))
+      /* Escape unreserved chars from RFC 3986 */
+      result = curlx_dyn_addn(db, &in, 1);
+    else if(in == '+')
+      /* Encode '+' as space */
+      result = curlx_dyn_add(db, "%20");
+    else
+      result = curlx_dyn_addf(db, "%%%02X", in);
+  }
+
+  return result;
+}
+
+static bool should_urlencode(struct Curl_str *service_name)
+{
+  /*
+   * These services require unmodified (not additionally URL-encoded) URL
+   * paths.
+   * should_urlencode == true is equivalent to should_urlencode_uri_path
+   * from the AWS SDK. Urls are already normalized by the curl URL parser
+   */
+  if(curlx_str_cmp(service_name, "s3") ||
+     curlx_str_cmp(service_name, "s3-express") ||
+     curlx_str_cmp(service_name, "s3-outposts")) {
+    return FALSE;
+  }
+  return TRUE;
+}
+
 /* maximum length for the aws sivg4 parts */
-#define MAX_SIGV4_LEN 64
-#define MAX_SIGV4_LEN_TXT "64"
-
+#define MAX_SIGV4_LEN    64
 #define DATE_HDR_KEY_LEN (MAX_SIGV4_LEN + sizeof("X--Date"))
 
-#define MAX_HOST_LEN 255
-/* FQDN + host: */
-#define FULL_HOST_LEN (MAX_HOST_LEN + sizeof("host:"))
-
 /* string been x-PROVIDER-date:TIMESTAMP, I need +1 for ':' */
 #define DATE_FULL_HDR_LEN (DATE_HDR_KEY_LEN + TIMESTAMP_SIZE + 1)
 
+/* alphabetically compare two headers by their name, expecting
+   headers to use ':' at this point */
+static int compare_header_names(const char *a, const char *b)
+{
+  const char *colon_a;
+  const char *colon_b;
+  size_t len_a;
+  size_t len_b;
+  size_t min_len;
+  int cmp;
+
+  colon_a = strchr(a, ':');
+  colon_b = strchr(b, ':');
+
+  DEBUGASSERT(colon_a);
+  DEBUGASSERT(colon_b);
+
+  len_a = colon_a ? (size_t)(colon_a - a) : strlen(a);
+  len_b = colon_b ? (size_t)(colon_b - b) : strlen(b);
+
+  min_len = (len_a < len_b) ? len_a : len_b;
+
+  cmp = strncmp(a, b, min_len);
+
+  /* return the shorter of the two if one is shorter */
+  if(!cmp)
+    return (int)(len_a - len_b);
+
+  return cmp;
+}
+
+/* Merge duplicate header definitions by comma delimiting their values
+   in the order defined the headers are defined, expecting headers to
+   be alpha-sorted and use ':' at this point */
+static CURLcode merge_duplicate_headers(struct curl_slist *head)
+{
+  struct curl_slist *curr = head;
+  CURLcode result = CURLE_OK;
+
+  while(curr) {
+    struct curl_slist *next = curr->next;
+    if(!next)
+      break;
+
+    if(compare_header_names(curr->data, next->data) == 0) {
+      struct dynbuf buf;
+      const char *colon_next;
+      const char *val_next;
+
+      curlx_dyn_init(&buf, CURL_MAX_HTTP_HEADER);
+
+      result = curlx_dyn_add(&buf, curr->data);
+      if(result)
+        return result;
+
+      colon_next = strchr(next->data, ':');
+      DEBUGASSERT(colon_next);
+      val_next = colon_next + 1;
+
+      result = curlx_dyn_addn(&buf, ",", 1);
+      if(result)
+        return result;
+
+      result = curlx_dyn_add(&buf, val_next);
+      if(result)
+        return result;
+
+      curlx_free(curr->data);
+      curr->data = curlx_dyn_ptr(&buf);
+
+      curr->next = next->next;
+      curlx_free(next->data);
+      curlx_free(next);
+    }
+    else {
+      curr = curr->next;
+    }
+  }
+
+  return CURLE_OK;
+}
+
 /* timestamp should point to a buffer of at last TIMESTAMP_SIZE bytes */
 static CURLcode make_headers(struct Curl_easy *data,
                              const char *hostname,
                              char *timestamp,
-                             char *provider1,
+                             const char *provider1,
+                             size_t plen, /* length of provider1 */
                              char **date_header,
                              char *content_sha256_header,
                              struct dynbuf *canonical_headers,
@@ -145,53 +383,40 @@ static CURLcode make_headers(struct Curl_easy *data,
   char date_full_hdr[DATE_FULL_HDR_LEN];
   struct curl_slist *head = NULL;
   struct curl_slist *tmp_head = NULL;
-  CURLcode ret = CURLE_OUT_OF_MEMORY;
+  CURLcode result = CURLE_OUT_OF_MEMORY;
   struct curl_slist *l;
-  int again = 1;
+  bool again = TRUE;
 
-  /* provider1 mid */
-  Curl_strntolower(provider1, provider1, strlen(provider1));
-  provider1[0] = Curl_raw_toupper(provider1[0]);
-
-  msnprintf(date_hdr_key, DATE_HDR_KEY_LEN, "X-%s-Date", provider1);
+  curl_msnprintf(date_hdr_key, DATE_HDR_KEY_LEN, "X-%.*s-Date",
+                 (int)plen, provider1);
+  /* provider1 ucfirst */
+  Curl_strntolower(&date_hdr_key[2], provider1, plen);
+  date_hdr_key[2] = Curl_raw_toupper(provider1[0]);
 
+  curl_msnprintf(date_full_hdr, DATE_FULL_HDR_LEN,
+                 "x-%.*s-date:%s", (int)plen, provider1, timestamp);
   /* provider1 lowercase */
-  Curl_strntolower(provider1, provider1, 1); /* first byte only */
-  msnprintf(date_full_hdr, DATE_FULL_HDR_LEN,
-            "x-%s-date:%s", provider1, timestamp);
+  Curl_strntolower(&date_full_hdr[2], provider1, plen);
 
-  if(Curl_checkheaders(data, STRCONST("Host"))) {
-    head = NULL;
-  }
-  else {
-    char full_host[FULL_HOST_LEN + 1];
+  if(!Curl_checkheaders(data, STRCONST("Host"))) {
+    char *fullhost;
 
     if(data->state.aptr.host) {
-      size_t pos;
-
-      if(strlen(data->state.aptr.host) > FULL_HOST_LEN) {
-        ret = CURLE_URL_MALFORMAT;
-        goto fail;
-      }
-      strcpy(full_host, data->state.aptr.host);
       /* remove /r/n as the separator for canonical request must be '\n' */
-      pos = strcspn(full_host, "\n\r");
-      full_host[pos] = 0;
-    }
-    else {
-      if(strlen(hostname) > MAX_HOST_LEN) {
-        ret = CURLE_URL_MALFORMAT;
-        goto fail;
-      }
-      msnprintf(full_host, FULL_HOST_LEN, "host:%s", hostname);
+      size_t pos = strcspn(data->state.aptr.host, "\n\r");
+      fullhost = curlx_memdup0(data->state.aptr.host, pos);
     }
+    else
+      fullhost = curl_maprintf("host:%s", hostname);
 
-    head = curl_slist_append(NULL, full_host);
-    if(!head)
+    if(fullhost)
+      head = Curl_slist_append_nodup(NULL, fullhost);
+    if(!head) {
+      curlx_free(fullhost);
       goto fail;
+    }
   }
 
-
   if(*content_sha256_header) {
     tmp_head = curl_slist_append(head, content_sha256_header);
     if(!tmp_head)
@@ -215,23 +440,24 @@ static CURLcode make_headers(struct Curl_easy *data,
      semi-colon, are not added to this list.
      */
   for(l = data->set.headers; l; l = l->next) {
-    char *dupdata, *ptr;
-    char *sep = strchr(l->data, ':');
+    char *dupdata;
+    const char *ptr;
+    const char *sep = strchr(l->data, ':');
     if(!sep)
       sep = strchr(l->data, ';');
     if(!sep || (*sep == ':' && !*(sep + 1)))
       continue;
-    for(ptr = sep + 1; ISSPACE(*ptr); ++ptr)
+    for(ptr = sep + 1; ISBLANK(*ptr); ++ptr)
       ;
     if(!*ptr && ptr != sep + 1) /* a value of whitespace only */
       continue;
-    dupdata = strdup(l->data);
+    dupdata = curlx_strdup(l->data);
     if(!dupdata)
       goto fail;
     dupdata[sep - l->data] = ':';
     tmp_head = Curl_slist_append_nodup(head, dupdata);
     if(!tmp_head) {
-      free(dupdata);
+      curlx_free(dupdata);
       goto fail;
     }
     head = tmp_head;
@@ -246,45 +472,59 @@ static CURLcode make_headers(struct Curl_easy *data,
       goto fail;
     head = tmp_head;
     *date_header = curl_maprintf("%s: %s\r\n", date_hdr_key, timestamp);
+    if(!*date_header)
+      goto fail;
   }
   else {
-    char *value;
-
+    const char *value;
+    const char *endp;
     value = strchr(*date_header, ':');
     if(!value) {
       *date_header = NULL;
       goto fail;
     }
     ++value;
-    while(ISBLANK(*value))
-      ++value;
-    strncpy(timestamp, value, TIMESTAMP_SIZE - 1);
-    timestamp[TIMESTAMP_SIZE - 1] = 0;
+    curlx_str_passblanks(&value);
+    endp = value;
+    while(*endp && ISALNUM(*endp))
+      ++endp;
+    /* 16 bytes => "19700101T000000Z" */
+    if((endp - value) == TIMESTAMP_SIZE - 1) {
+      memcpy(timestamp, value, TIMESTAMP_SIZE - 1);
+      timestamp[TIMESTAMP_SIZE - 1] = 0;
+    }
+    else
+      /* bad timestamp length */
+      timestamp[0] = 0;
     *date_header = NULL;
   }
 
-  /* alpha-sort in a case sensitive manner */
+  /* alpha-sort by header name in a case sensitive manner */
   do {
-    again = 0;
+    again = FALSE;
     for(l = head; l; l = l->next) {
       struct curl_slist *next = l->next;
 
-      if(next && strcmp(l->data, next->data) > 0) {
+      if(next && compare_header_names(l->data, next->data) > 0) {
         char *tmp = l->data;
 
         l->data = next->data;
         next->data = tmp;
-        again = 1;
+        again = TRUE;
       }
     }
   } while(again);
 
+  result = merge_duplicate_headers(head);
+  if(result)
+    goto fail;
+
   for(l = head; l; l = l->next) {
     char *tmp;
 
-    if(Curl_dyn_add(canonical_headers, l->data))
+    if(curlx_dyn_add(canonical_headers, l->data))
       goto fail;
-    if(Curl_dyn_add(canonical_headers, "\n"))
+    if(curlx_dyn_add(canonical_headers, "\n"))
       goto fail;
 
     tmp = strchr(l->data, ':');
@@ -292,36 +532,37 @@ static CURLcode make_headers(struct Curl_easy *data,
       *tmp = 0;
 
     if(l != head) {
-      if(Curl_dyn_add(signed_headers, ";"))
+      if(curlx_dyn_add(signed_headers, ";"))
         goto fail;
     }
-    if(Curl_dyn_add(signed_headers, l->data))
+    if(curlx_dyn_add(signed_headers, l->data))
       goto fail;
   }
 
-  ret = CURLE_OK;
+  result = CURLE_OK;
 fail:
   curl_slist_free_all(head);
 
-  return ret;
+  return result;
 }
 
 #define CONTENT_SHA256_KEY_LEN (MAX_SIGV4_LEN + sizeof("X--Content-Sha256"))
 /* add 2 for ": " between header name and value */
-#define CONTENT_SHA256_HDR_LEN (CONTENT_SHA256_KEY_LEN + 2 + \
-                                SHA256_HEX_LENGTH)
+#define CONTENT_SHA256_HDR_LEN (CONTENT_SHA256_KEY_LEN + 2 + SHA256_HEX_LENGTH)
 
 /* try to parse a payload hash from the content-sha256 header */
-static char *parse_content_sha_hdr(struct Curl_easy *data,
-                                   const char *provider1,
-                                   size_t *value_len)
+static const char *parse_content_sha_hdr(struct Curl_easy *data,
+                                         const char *provider1,
+                                         size_t plen,
+                                         size_t *value_len)
 {
   char key[CONTENT_SHA256_KEY_LEN];
   size_t key_len;
-  char *value;
+  const char *value;
   size_t len;
 
-  key_len = msnprintf(key, sizeof(key), "x-%s-content-sha256", provider1);
+  key_len = curl_msnprintf(key, sizeof(key), "x-%.*s-content-sha256",
+                           (int)plen, provider1);
 
   value = Curl_checkheaders(data, key, key_len);
   if(!value)
@@ -332,11 +573,10 @@ static char *parse_content_sha_hdr(struct Curl_easy *data,
     return NULL;
   ++value;
 
-  while(*value && ISBLANK(*value))
-    ++value;
+  curlx_str_passblanks(&value);
 
   len = strlen(value);
-  while(len > 0 && ISBLANK(value[len-1]))
+  while(len > 0 && ISBLANK(value[len - 1]))
     --len;
 
   *value_len = len;
@@ -356,7 +596,7 @@ static CURLcode calc_payload_hash(struct Curl_easy *data,
     else
       post_data_len = (size_t)data->set.postfieldsize;
   }
-  result = Curl_sha256it(sha_hash, (const unsigned char *) post_data,
+  result = Curl_sha256it(sha_hash, (const unsigned char *)post_data,
                          post_data_len);
   if(!result)
     sha256_to_hex(sha_hex, sha_hash);
@@ -366,7 +606,9 @@ static CURLcode calc_payload_hash(struct Curl_easy *data,
 #define S3_UNSIGNED_PAYLOAD "UNSIGNED-PAYLOAD"
 
 static CURLcode calc_s3_payload_hash(struct Curl_easy *data,
-                                     Curl_HttpReq httpreq, char *provider1,
+                                     Curl_HttpReq httpreq,
+                                     const char *provider1,
+                                     size_t plen,
                                      unsigned char *sha_hash,
                                      char *sha_hex, char *header)
 {
@@ -375,12 +617,12 @@ static CURLcode calc_s3_payload_hash(struct Curl_easy *data,
   bool empty_payload = (empty_method || data->set.filesize == 0);
   /* The POST payload is in memory */
   bool post_payload = (httpreq == HTTPREQ_POST && data->set.postfields);
-  CURLcode ret = CURLE_OUT_OF_MEMORY;
+  CURLcode result = CURLE_OUT_OF_MEMORY;
 
   if(empty_payload || post_payload) {
     /* Calculate a real hash when we know the request payload */
-    ret = calc_payload_hash(data, sha_hash, sha_hex);
-    if(ret)
+    result = calc_payload_hash(data, sha_hash, sha_hex);
+    if(result)
       goto fail;
   }
   else {
@@ -392,254 +634,287 @@ static CURLcode calc_s3_payload_hash(struct Curl_easy *data,
   }
 
   /* format the required content-sha256 header */
-  msnprintf(header, CONTENT_SHA256_HDR_LEN,
-            "x-%s-content-sha256: %s", provider1, sha_hex);
+  curl_msnprintf(header, CONTENT_SHA256_HDR_LEN,
+                 "x-%.*s-content-sha256: %s", (int)plen, provider1, sha_hex);
 
-  ret = CURLE_OK;
+  result = CURLE_OK;
 fail:
-  return ret;
+  return result;
 }
 
-struct pair {
-  const char *p;
-  size_t len;
-};
-
 static int compare_func(const void *a, const void *b)
 {
   const struct pair *aa = a;
   const struct pair *bb = b;
-  return strncmp(aa->p, bb->p, aa->len < bb->len ? aa->len : bb->len);
+  const size_t aa_key_len = curlx_dyn_len(&aa->key);
+  const size_t bb_key_len = curlx_dyn_len(&bb->key);
+  const size_t aa_value_len = curlx_dyn_len(&aa->value);
+  const size_t bb_value_len = curlx_dyn_len(&bb->value);
+  int compare;
+
+  /* If one element is empty, the other is always sorted higher */
+
+  /* Compare keys */
+  if((aa_key_len == 0) && (bb_key_len == 0))
+    return 0;
+  if(aa_key_len == 0)
+    return -1;
+  if(bb_key_len == 0)
+    return 1;
+  compare = strcmp(curlx_dyn_ptr(&aa->key), curlx_dyn_ptr(&bb->key));
+  if(compare) {
+    return compare;
+  }
+
+  /* Compare values */
+  if((aa_value_len == 0) && (bb_value_len == 0))
+    return 0;
+  if(aa_value_len == 0)
+    return -1;
+  if(bb_value_len == 0)
+    return 1;
+  compare = strcmp(curlx_dyn_ptr(&aa->value), curlx_dyn_ptr(&bb->value));
+
+  return compare;
 }
 
-#define MAX_QUERYPAIRS 64
-
-static CURLcode canon_query(struct Curl_easy *data,
-                            const char *query, struct dynbuf *dq)
+/* @unittest 1979 */
+UNITTEST CURLcode canon_path(const char *q, size_t len,
+                             struct dynbuf *new_path,
+                             bool do_uri_encode);
+UNITTEST CURLcode canon_path(const char *q, size_t len,
+                             struct dynbuf *new_path,
+                             bool do_uri_encode)
 {
   CURLcode result = CURLE_OK;
-  int entry = 0;
-  int i;
-  const char *p = query;
-  struct pair array[MAX_QUERYPAIRS];
-  struct pair *ap = &array[0];
-  if(!query)
-    return result;
 
-  /* sort the name=value pairs first */
-  do {
-    char *amp;
-    entry++;
-    ap->p = p;
-    amp = strchr(p, '&');
-    if(amp)
-      ap->len = amp - p; /* excluding the ampersand */
-    else {
-      ap->len = strlen(p);
-      break;
-    }
-    ap++;
-    p = amp + 1;
-  } while(entry < MAX_QUERYPAIRS);
-  if(entry == MAX_QUERYPAIRS) {
-    /* too many query pairs for us */
-    failf(data, "aws-sigv4: too many query pairs in URL");
-    return CURLE_URL_MALFORMAT;
+  struct Curl_str original_path;
+
+  curlx_str_assign(&original_path, q, len);
+
+  /* Normalized path will be either the same or shorter than the original
+   * path, plus trailing slash */
+
+  if(do_uri_encode)
+    result = uri_encode_path(&original_path, new_path);
+  else
+    result = curlx_dyn_addn(new_path, q, len);
+
+  if(!result) {
+    if(curlx_dyn_len(new_path) == 0)
+      result = curlx_dyn_add(new_path, "/");
   }
 
-  qsort(&array[0], entry, sizeof(struct pair), compare_func);
-
-  ap = &array[0];
-  for(i = 0; !result && (i < entry); i++, ap++) {
-    size_t len;
-    const char *q = ap->p;
-    if(!ap->len)
-      continue;
-    for(len = ap->len; len && !result; q++, len--) {
-      if(ISALNUM(*q))
-        result = Curl_dyn_addn(dq, q, 1);
-      else {
-        switch(*q) {
-        case '-':
-        case '.':
-        case '_':
-        case '~':
-        case '=':
-          /* allowed as-is */
-          result = Curl_dyn_addn(dq, q, 1);
-          break;
-        case '%':
-          /* uppercase the following if hexadecimal */
-          if(ISXDIGIT(q[1]) && ISXDIGIT(q[2])) {
-            char tmp[3]="%";
-            tmp[1] = Curl_raw_toupper(q[1]);
-            tmp[2] = Curl_raw_toupper(q[2]);
-            result = Curl_dyn_addn(dq, tmp, 3);
-            q += 2;
-            len -= 2;
-          }
-          else
-            /* '%' without a following two-digit hex, encode it */
-            result = Curl_dyn_addn(dq, "%25", 3);
-          break;
-        default: {
-          /* URL encode */
-          const char hex[] = "0123456789ABCDEF";
-          char out[3]={'%'};
-          out[1] = hex[((unsigned char)*q)>>4];
-          out[2] = hex[*q & 0xf];
-          result = Curl_dyn_addn(dq, out, 3);
-          break;
-        }
-        }
-      }
-    }
-    if(i < entry - 1) {
-      /* insert ampersands between query pairs */
-      result = Curl_dyn_addn(dq, "&", 1);
-    }
-  }
   return result;
 }
 
-
-CURLcode Curl_output_aws_sigv4(struct Curl_easy *data, bool proxy)
+/* @unittest 1980 */
+UNITTEST CURLcode canon_query(const char *query, struct dynbuf *dq);
+UNITTEST CURLcode canon_query(const char *query, struct dynbuf *dq)
 {
-  CURLcode result = CURLE_OUT_OF_MEMORY;
-  struct connectdata *conn = data->conn;
-  size_t len;
-  const char *arg;
-  char provider0[MAX_SIGV4_LEN + 1]="";
-  char provider1[MAX_SIGV4_LEN + 1]="";
-  char region[MAX_SIGV4_LEN + 1]="";
-  char service[MAX_SIGV4_LEN + 1]="";
-  bool sign_as_s3 = false;
-  const char *hostname = conn->host.name;
-  time_t clock;
-  struct tm tm;
-  char timestamp[TIMESTAMP_SIZE];
-  char date[9];
-  struct dynbuf canonical_headers;
-  struct dynbuf signed_headers;
-  struct dynbuf canonical_query;
-  char *date_header = NULL;
-  Curl_HttpReq httpreq;
-  const char *method = NULL;
-  char *payload_hash = NULL;
-  size_t payload_hash_len = 0;
-  unsigned char sha_hash[SHA256_DIGEST_LENGTH];
-  char sha_hex[SHA256_HEX_LENGTH];
-  char content_sha256_hdr[CONTENT_SHA256_HDR_LEN + 2] = ""; /* add \r\n */
-  char *canonical_request = NULL;
-  char *request_type = NULL;
-  char *credential_scope = NULL;
-  char *str_to_sign = NULL;
-  const char *user = data->state.aptr.user ? data->state.aptr.user : "";
-  char *secret = NULL;
-  unsigned char sign0[SHA256_DIGEST_LENGTH] = {0};
-  unsigned char sign1[SHA256_DIGEST_LENGTH] = {0};
-  char *auth_headers = NULL;
+  CURLcode result = CURLE_OK;
 
-  DEBUGASSERT(!proxy);
-  (void)proxy;
+  struct dynbuf query_array[MAX_QUERY_COMPONENTS];
+  struct pair encoded_query_array[MAX_QUERY_COMPONENTS];
+  size_t num_query_components;
+  size_t counted_query_components = 0;
+  size_t index;
 
-  if(Curl_checkheaders(data, STRCONST("Authorization"))) {
-    /* Authorization already present, Bailing out */
-    return CURLE_OK;
+  if(!query)
+    return result;
+
+  result = split_to_dyn_array(query, &query_array[0], &num_query_components);
+  if(result) {
+    goto fail;
   }
 
-  /* we init those buffers here, so goto fail will free initialized dynbuf */
-  Curl_dyn_init(&canonical_headers, CURL_MAX_HTTP_HEADER);
-  Curl_dyn_init(&canonical_query, CURL_MAX_HTTP_HEADER);
-  Curl_dyn_init(&signed_headers, CURL_MAX_HTTP_HEADER);
+  /* Create list of pairs, each pair containing an encoded query
+   * component */
 
-  /*
-   * Parameters parsing
-   * Google and Outscale use the same OSC or GOOG,
-   * but Amazon uses AWS and AMZ for header arguments.
-   * AWS is the default because most of non-amazon providers
-   * are still using aws:amz as a prefix.
-   */
-  arg = data->set.str[STRING_AWS_SIGV4] ?
-    data->set.str[STRING_AWS_SIGV4] : "aws:amz";
+  for(index = 0; index < num_query_components; index++) {
+    const char *in_key;
+    size_t in_key_len;
+    const char *offset;
+    size_t query_part_len = curlx_dyn_len(&query_array[index]);
+    const char *query_part = curlx_dyn_ptr(&query_array[index]);
 
-  /* provider1[:provider2[:region[:service]]]
+    in_key = query_part;
+
+    offset = strchr(query_part, '=');
+    /* If there is no equals, this key has no value */
+    if(!offset) {
+      in_key_len = strlen(in_key);
+    }
+    else {
+      in_key_len = offset - in_key;
+    }
+
+    curlx_dyn_init(&encoded_query_array[index].key,
+      (query_part_len * 3) + 1);
+    curlx_dyn_init(&encoded_query_array[index].value,
+      (query_part_len * 3) + 1);
+    counted_query_components++;
+
+    /* Decode/encode the key */
+    result = normalize_query(in_key, in_key_len,
+                             &encoded_query_array[index].key);
+    if(result) {
+      goto fail;
+    }
+
+    /* Decode/encode the value if it exists */
+    if(offset && offset != (query_part + query_part_len - 1)) {
+      size_t in_value_len;
+      const char *in_value = offset + 1;
+      in_value_len = query_part + query_part_len - (offset + 1);
+      result = normalize_query(in_value, in_value_len,
+                               &encoded_query_array[index].value);
+      if(result) {
+        goto fail;
+      }
+    }
+    else {
+      /* If there is no value, the value is an empty string */
+      curlx_dyn_init(&encoded_query_array[index].value, 2);
+      result = curlx_dyn_addn(&encoded_query_array[index].value, "", 1);
+    }
+
+    if(result) {
+      goto fail;
+    }
+  }
+
+  /* Sort the encoded query components by key and value */
+  qsort(&encoded_query_array, num_query_components,
+        sizeof(struct pair), compare_func);
+
+  /* Append the query components together to make a full query string */
+  for(index = 0; index < num_query_components; index++) {
+
+    if(index)
+      result = curlx_dyn_addn(dq, "&", 1);
+    if(!result) {
+      const char *key_ptr = curlx_dyn_ptr(&encoded_query_array[index].key);
+      const char *value_ptr = curlx_dyn_ptr(&encoded_query_array[index].value);
+      size_t vlen = curlx_dyn_len(&encoded_query_array[index].value);
+      if(value_ptr && vlen) {
+        result = curlx_dyn_addf(dq, "%s=%s", key_ptr, value_ptr);
+      }
+      else {
+        /* Empty value is always encoded to key= */
+        result = curlx_dyn_addf(dq, "%s=", key_ptr);
+      }
+    }
+    if(result)
+      break;
+  }
+
+fail:
+  if(counted_query_components)
+    /* the encoded_query_array might not be initialized yet */
+    pair_array_free(&encoded_query_array[0], counted_query_components);
+  dyn_array_free(&query_array[0], num_query_components);
+  return result;
+}
+
+static CURLcode parse_sigv4_params(struct Curl_easy *data,
+                                   const char *hostname,
+                                   struct Curl_str *provider0,
+                                   struct Curl_str *provider1,
+                                   struct Curl_str *region,
+                                   struct Curl_str *service)
+{
+  const char *line = data->set.str[STRING_AWS_SIGV4];
+  if(!line || !*line)
+    line = "aws:amz";
+
+  /* provider0[:provider1[:region[:service]]]
 
      No string can be longer than N bytes of non-whitespace
   */
-  (void)sscanf(arg, "%" MAX_SIGV4_LEN_TXT "[^:]"
-               ":%" MAX_SIGV4_LEN_TXT "[^:]"
-               ":%" MAX_SIGV4_LEN_TXT "[^:]"
-               ":%" MAX_SIGV4_LEN_TXT "s",
-               provider0, provider1, region, service);
-  if(!provider0[0]) {
-    failf(data, "first aws-sigv4 provider can't be empty");
-    result = CURLE_BAD_FUNCTION_ARGUMENT;
-    goto fail;
+  if(curlx_str_until(&line, provider0, MAX_SIGV4_LEN, ':')) {
+    failf(data, "first aws-sigv4 provider cannot be empty");
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
+  if(curlx_str_single(&line, ':') ||
+     curlx_str_until(&line, provider1, MAX_SIGV4_LEN, ':')) {
+    *provider1 = *provider0;
+  }
+  else if(curlx_str_single(&line, ':') ||
+          curlx_str_until(&line, region, MAX_SIGV4_LEN, ':') ||
+          curlx_str_single(&line, ':') ||
+          curlx_str_until(&line, service, MAX_SIGV4_LEN, ':')) {
+    /* nothing to do */
   }
-  else if(!provider1[0])
-    strcpy(provider1, provider0);
 
-  if(!service[0]) {
-    char *hostdot = strchr(hostname, '.');
-    if(!hostdot) {
+  if(!curlx_strlen(service)) {
+    const char *p = hostname;
+    if(curlx_str_until(&p, service, MAX_SIGV4_LEN, '.') ||
+       curlx_str_single(&p, '.')) {
       failf(data, "aws-sigv4: service missing in parameters and hostname");
-      result = CURLE_URL_MALFORMAT;
-      goto fail;
+      return CURLE_URL_MALFORMAT;
     }
-    len = hostdot - hostname;
-    if(len > MAX_SIGV4_LEN) {
-      failf(data, "aws-sigv4: service too long in hostname");
-      result = CURLE_URL_MALFORMAT;
-      goto fail;
-    }
-    strncpy(service, hostname, len);
-    service[len] = '\0';
 
-    infof(data, "aws_sigv4: picked service %s from host", service);
+    infof(data, "aws_sigv4: picked service %.*s from host",
+          (int)curlx_strlen(service), curlx_str(service));
 
-    if(!region[0]) {
-      const char *reg = hostdot + 1;
-      const char *hostreg = strchr(reg, '.');
-      if(!hostreg) {
+    if(!curlx_strlen(region)) {
+      if(curlx_str_until(&p, region, MAX_SIGV4_LEN, '.') ||
+         curlx_str_single(&p, '.')) {
         failf(data, "aws-sigv4: region missing in parameters and hostname");
-        result = CURLE_URL_MALFORMAT;
-        goto fail;
+        return CURLE_URL_MALFORMAT;
       }
-      len = hostreg - reg;
-      if(len > MAX_SIGV4_LEN) {
-        failf(data, "aws-sigv4: region too long in hostname");
-        result = CURLE_URL_MALFORMAT;
-        goto fail;
-      }
-      strncpy(region, reg, len);
-      region[len] = '\0';
-      infof(data, "aws_sigv4: picked region %s from host", region);
+      infof(data, "aws_sigv4: picked region %.*s from host",
+            (int)curlx_strlen(region), curlx_str(region));
     }
   }
 
-  Curl_http_method(data, conn, &method, &httpreq);
+  return CURLE_OK;
+}
 
-  /* AWS S3 requires a x-amz-content-sha256 header, and supports special
-   * values like UNSIGNED-PAYLOAD */
-  sign_as_s3 = (strcasecompare(provider0, "aws") &&
-                strcasecompare(service, "s3"));
+static CURLcode get_payload_hash(struct Curl_easy *data,
+                                 Curl_HttpReq httpreq,
+                                 struct Curl_str *provider0,
+                                 struct Curl_str *provider1,
+                                 struct Curl_str *service,
+                                 unsigned char *sha_hash,
+                                 char *sha_hex,
+                                 char *content_sha256_hdr,
+                                 const char **payload_hash_out,
+                                 size_t *payload_hash_len_out)
+{
+  *payload_hash_out =
+    parse_content_sha_hdr(data, curlx_str(provider1),
+                          curlx_strlen(provider1), payload_hash_len_out);
 
-  payload_hash = parse_content_sha_hdr(data, provider1, &payload_hash_len);
+  if(!*payload_hash_out) {
+    CURLcode result;
+    /* AWS S3 requires a x-amz-content-sha256 header, and supports special
+     * values like UNSIGNED-PAYLOAD */
+    bool sign_as_s3 = curlx_str_casecompare(provider0, "aws") &&
+                      curlx_str_casecompare(service, "s3");
 
-  if(!payload_hash) {
     if(sign_as_s3)
-      result = calc_s3_payload_hash(data, httpreq, provider1, sha_hash,
+      result = calc_s3_payload_hash(data, httpreq, curlx_str(provider1),
+                                    curlx_strlen(provider1), sha_hash,
                                     sha_hex, content_sha256_hdr);
     else
       result = calc_payload_hash(data, sha_hash, sha_hex);
     if(result)
-      goto fail;
+      return result;
 
-    payload_hash = sha_hex;
+    *payload_hash_out = sha_hex;
     /* may be shorter than SHA256_HEX_LENGTH, like S3_UNSIGNED_PAYLOAD */
-    payload_hash_len = strlen(sha_hex);
+    *payload_hash_len_out = strlen(sha_hex);
   }
+  return CURLE_OK;
+}
+
+static CURLcode get_timestamp(char *timestamp, size_t stampsize)
+{
+  time_t clock;
+  struct tm tm;
+  CURLcode result;
 
 #ifdef DEBUGBUILD
   {
@@ -647,42 +922,60 @@ CURLcode Curl_output_aws_sigv4(struct Curl_easy *data, bool proxy)
     if(force_timestamp)
       clock = 0;
     else
-      time(&clock);
+      clock = time(NULL);
   }
 #else
-  time(&clock);
+  clock = time(NULL);
 #endif
-  result = Curl_gmtime(clock, &tm);
-  if(result) {
-    goto fail;
-  }
-  if(!strftime(timestamp, sizeof(timestamp), "%Y%m%dT%H%M%SZ", &tm)) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto fail;
-  }
+  result = curlx_gmtime(clock, &tm);
+  if(result)
+    return result;
 
-  result = make_headers(data, hostname, timestamp, provider1,
-                        &date_header, content_sha256_hdr,
-                        &canonical_headers, &signed_headers);
+  if(!strftime(timestamp, stampsize, "%Y%m%dT%H%M%SZ", &tm))
+    return CURLE_OUT_OF_MEMORY;
+
+  return CURLE_OK;
+}
+
+static CURLcode make_canonical_request(struct Curl_easy *data,
+                                       const char *hostname,
+                                       char *timestamp,
+                                       struct Curl_str *provider1,
+                                       struct Curl_str *service,
+                                       const char *method,
+                                       const char *payload_hash,
+                                       size_t payload_hash_len,
+                                       char **date_header_out,
+                                       char *content_sha256_hdr,
+                                       struct dynbuf *canonical_headers,
+                                       struct dynbuf *signed_headers,
+                                       char **canonical_request_out)
+{
+  struct dynbuf canonical_query;
+  struct dynbuf canonical_path;
+  CURLcode result;
+
+  curlx_dyn_init(&canonical_query, CURL_MAX_HTTP_HEADER);
+  curlx_dyn_init(&canonical_path, CURL_MAX_HTTP_HEADER);
+
+  result = make_headers(data, hostname, timestamp,
+                        curlx_str(provider1), curlx_strlen(provider1),
+                        date_header_out, content_sha256_hdr,
+                        canonical_headers, signed_headers);
   if(result)
     goto fail;
 
-  if(*content_sha256_hdr) {
-    /* make_headers() needed this without the \r\n for canonicalization */
-    size_t hdrlen = strlen(content_sha256_hdr);
-    DEBUGASSERT(hdrlen + 3 < sizeof(content_sha256_hdr));
-    memcpy(content_sha256_hdr + hdrlen, "\r\n", 3);
-  }
-
-  memcpy(date, timestamp, sizeof(date));
-  date[sizeof(date) - 1] = 0;
-
-  result = canon_query(data, data->state.up.query, &canonical_query);
+  result = canon_query(data->state.up.query, &canonical_query);
   if(result)
     goto fail;
-  result = CURLE_OUT_OF_MEMORY;
 
-  canonical_request =
+  result = canon_path(data->state.up.path, strlen(data->state.up.path),
+                      &canonical_path,
+                      should_urlencode(service));
+  if(result)
+    goto fail;
+
+  *canonical_request_out =
     curl_maprintf("%s\n" /* HTTPRequestMethod */
                   "%s\n" /* CanonicalURI */
                   "%s\n" /* CanonicalQueryString */
@@ -690,107 +983,266 @@ CURLcode Curl_output_aws_sigv4(struct Curl_easy *data, bool proxy)
                   "%s\n" /* SignedHeaders */
                   "%.*s",  /* HashedRequestPayload in hex */
                   method,
-                  data->state.up.path,
-                  Curl_dyn_ptr(&canonical_query) ?
-                  Curl_dyn_ptr(&canonical_query) : "",
-                  Curl_dyn_ptr(&canonical_headers),
-                  Curl_dyn_ptr(&signed_headers),
+                  curlx_dyn_ptr(&canonical_path),
+                  curlx_dyn_ptr(&canonical_query) ?
+                  curlx_dyn_ptr(&canonical_query) : "",
+                  curlx_dyn_ptr(canonical_headers),
+                  curlx_dyn_ptr(signed_headers),
                   (int)payload_hash_len, payload_hash);
-  if(!canonical_request)
+  if(!*canonical_request_out) {
+    result = CURLE_OUT_OF_MEMORY;
     goto fail;
+  }
 
-  DEBUGF(infof(data, "Canonical request: %s", canonical_request));
+  result = CURLE_OK;
+fail:
+  curlx_dyn_free(&canonical_query);
+  curlx_dyn_free(&canonical_path);
+  return result;
+}
 
-  /* provider 0 lowercase */
-  Curl_strntolower(provider0, provider0, strlen(provider0));
-  request_type = curl_maprintf("%s4_request", provider0);
+static CURLcode make_string_to_sign(struct Curl_easy *data,
+                                    struct Curl_str *provider0,
+                                    struct Curl_str *region,
+                                    struct Curl_str *service,
+                                    const char *date,
+                                    const char *timestamp,
+                                    const char *canonical_request,
+                                    char **request_type_out,
+                                    char **credential_scope_out,
+                                    char **str_to_sign_out)
+{
+  char *request_type;
+  char *credential_scope;
+  char *str_to_sign;
+  unsigned char sha_hash[CURL_SHA256_DIGEST_LENGTH];
+  char sha_hex[SHA256_HEX_LENGTH];
+
+  request_type = curl_maprintf("%.*s4_request",
+                               (int)curlx_strlen(provider0),
+                               curlx_str(provider0));
   if(!request_type)
-    goto fail;
+    return CURLE_OUT_OF_MEMORY;
 
-  credential_scope = curl_maprintf("%s/%s/%s/%s",
-                                   date, region, service, request_type);
-  if(!credential_scope)
-    goto fail;
+  /* provider0 is lowercased *after* curl_maprintf() so that the buffer
+     can be written to */
+  Curl_strntolower(request_type, request_type, curlx_strlen(provider0));
 
-  if(Curl_sha256it(sha_hash, (unsigned char *) canonical_request,
-                   strlen(canonical_request)))
-    goto fail;
+  credential_scope = curl_maprintf("%s/%.*s/%.*s/%s", date,
+                                   (int)curlx_strlen(region),
+                                   curlx_str(region),
+                                   (int)curlx_strlen(service),
+                                   curlx_str(service),
+                                   request_type);
+  if(!credential_scope) {
+    curlx_free(request_type);
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  if(Curl_sha256it(sha_hash, (const unsigned char *)canonical_request,
+                   strlen(canonical_request))) {
+    curlx_free(request_type);
+    curlx_free(credential_scope);
+    return CURLE_OUT_OF_MEMORY;
+  }
 
   sha256_to_hex(sha_hex, sha_hash);
 
-  /* provider 0 uppercase */
-  Curl_strntoupper(provider0, provider0, strlen(provider0));
-
   /*
    * Google allows using RSA key instead of HMAC, so this code might change
    * in the future. For now we only support HMAC.
    */
-  str_to_sign = curl_maprintf("%s4-HMAC-SHA256\n" /* Algorithm */
+  str_to_sign = curl_maprintf("%.*s4-HMAC-SHA256\n" /* Algorithm */
                               "%s\n" /* RequestDateTime */
                               "%s\n" /* CredentialScope */
                               "%s",  /* HashedCanonicalRequest in hex */
-                              provider0,
+                              (int)curlx_strlen(provider0),
+                              curlx_str(provider0),
                               timestamp,
                               credential_scope,
                               sha_hex);
   if(!str_to_sign) {
-    goto fail;
+    curlx_free(request_type);
+    curlx_free(credential_scope);
+    return CURLE_OUT_OF_MEMORY;
   }
 
-  /* provider 0 uppercase */
-  secret = curl_maprintf("%s4%s", provider0,
-                         data->state.aptr.passwd ?
-                         data->state.aptr.passwd : "");
+  /* make provider0 part done uppercase */
+  Curl_strntoupper(str_to_sign, curlx_str(provider0),
+                   curlx_strlen(provider0));
+
+  infof(data, "aws_sigv4: String to sign (enclosed in []) - [%s]",
+        str_to_sign);
+
+  *request_type_out = request_type;
+  *credential_scope_out = credential_scope;
+  *str_to_sign_out = str_to_sign;
+  return CURLE_OK;
+}
+
+static CURLcode sign_and_set_auth_headers(struct Curl_easy *data,
+                                          struct Curl_str *provider0,
+                                          struct Curl_str *region,
+                                          struct Curl_str *service,
+                                          const char *request_type,
+                                          const char *credential_scope,
+                                          const char *date,
+                                          const char *str_to_sign,
+                                          const char *date_header,
+                                          const char *content_sha256_hdr,
+                                          struct dynbuf *signed_headers)
+{
+  CURLcode result = CURLE_OUT_OF_MEMORY;
+  const char *passwd = Curl_creds_passwd(data->state.creds);
+  char *secret = NULL;
+  unsigned char sign0[CURL_SHA256_DIGEST_LENGTH] = { 0 };
+  unsigned char sign1[CURL_SHA256_DIGEST_LENGTH] = { 0 };
+  char sha_hex[SHA256_HEX_LENGTH];
+  char *auth_headers = NULL;
+  char *user = curl_escape(Curl_creds_user(data->state.creds), 0);
+  if(!user)
+    return CURLE_OUT_OF_MEMORY;
+
+  secret = curl_maprintf("%.*s4%s", (int)curlx_strlen(provider0),
+                         curlx_str(provider0), passwd);
   if(!secret)
     goto fail;
+  /* make provider0 part done uppercase */
+  Curl_strntoupper(secret, curlx_str(provider0), curlx_strlen(provider0));
 
   HMAC_SHA256(secret, strlen(secret), date, strlen(date), sign0);
-  HMAC_SHA256(sign0, sizeof(sign0), region, strlen(region), sign1);
-  HMAC_SHA256(sign1, sizeof(sign1), service, strlen(service), sign0);
-  HMAC_SHA256(sign0, sizeof(sign0), request_type, strlen(request_type), sign1);
-  HMAC_SHA256(sign1, sizeof(sign1), str_to_sign, strlen(str_to_sign), sign0);
+  HMAC_SHA256(sign0, sizeof(sign0),
+              curlx_str(region), curlx_strlen(region), sign1);
+  HMAC_SHA256(sign1, sizeof(sign1),
+              curlx_str(service), curlx_strlen(service), sign0);
+  HMAC_SHA256(sign0, sizeof(sign0),
+              request_type, strlen(request_type), sign1);
+  HMAC_SHA256(sign1, sizeof(sign1),
+              str_to_sign, strlen(str_to_sign), sign0);
 
   sha256_to_hex(sha_hex, sign0);
 
-  /* provider 0 uppercase */
-  auth_headers = curl_maprintf("Authorization: %s4-HMAC-SHA256 "
+  infof(data, "aws_sigv4: Signature - %s", sha_hex);
+
+  auth_headers = curl_maprintf("Authorization: %.*s4-HMAC-SHA256 "
                                "Credential=%s/%s, "
                                "SignedHeaders=%s, "
                                "Signature=%s\r\n"
+                               "%s"
+                               "%s%s",
+                               (int)curlx_strlen(provider0),
+                               curlx_str(provider0),
+                               user,
+                               credential_scope,
+                               curlx_dyn_ptr(signed_headers),
+                               sha_hex,
                                /*
-                                * date_header is added here, only if it wasn't
+                                * date_header is added here, only if it was not
                                 * user-specified (using CURLOPT_HTTPHEADER).
                                 * date_header includes \r\n
                                 */
-                               "%s"
-                               "%s", /* optional sha256 header includes \r\n */
-                               provider0,
-                               user,
-                               credential_scope,
-                               Curl_dyn_ptr(&signed_headers),
-                               sha_hex,
                                date_header ? date_header : "",
-                               content_sha256_hdr);
-  if(!auth_headers) {
+                               content_sha256_hdr,
+                               content_sha256_hdr[0] ? "\r\n": "");
+  if(!auth_headers)
     goto fail;
-  }
 
-  Curl_safefree(data->state.aptr.userpwd);
-  data->state.aptr.userpwd = auth_headers;
+  /* provider 0 uppercase */
+  Curl_strntoupper(&auth_headers[sizeof("Authorization: ") - 1],
+                   curlx_str(provider0), curlx_strlen(provider0));
+
+  curlx_free(data->req.hd_auth);
+  data->req.hd_auth = auth_headers;
   data->state.authhost.done = TRUE;
   result = CURLE_OK;
 
 fail:
-  Curl_dyn_free(&canonical_query);
-  Curl_dyn_free(&canonical_headers);
-  Curl_dyn_free(&signed_headers);
-  free(canonical_request);
-  free(request_type);
-  free(credential_scope);
-  free(str_to_sign);
-  free(secret);
-  free(date_header);
+  curlx_free(user);
+  curlx_free(secret);
   return result;
 }
 
-#endif /* !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_AWS) */
+CURLcode Curl_output_aws_sigv4(struct Curl_easy *data)
+{
+  CURLcode result = CURLE_OUT_OF_MEMORY;
+  struct Curl_str provider0 = { NULL, 0 };
+  struct Curl_str provider1 = { NULL, 0 };
+  struct Curl_str region = { NULL, 0 };
+  struct Curl_str service = { NULL, 0 };
+  const char *hostname = data->state.origin->hostname;
+  char timestamp[TIMESTAMP_SIZE];
+  char date[9];
+  struct dynbuf canonical_headers;
+  struct dynbuf signed_headers;
+  char *date_header = NULL;
+  Curl_HttpReq httpreq;
+  const char *method = NULL;
+  const char *payload_hash = NULL;
+  size_t payload_hash_len = 0;
+  unsigned char sha_hash[CURL_SHA256_DIGEST_LENGTH];
+  char sha_hex[SHA256_HEX_LENGTH];
+  char content_sha256_hdr[CONTENT_SHA256_HDR_LEN + 2] = ""; /* add \r\n */
+  char *canonical_request = NULL;
+  char *request_type = NULL;
+  char *credential_scope = NULL;
+  char *str_to_sign = NULL;
+
+  if(data->set.path_as_is) {
+    failf(data, "Cannot use sigv4 authentication with path-as-is flag");
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
+
+  if(Curl_checkheaders(data, STRCONST("Authorization")))
+    /* Authorization already present, Bailing out */
+    return CURLE_OK;
+
+  /* we init those buffers here, so goto fail will free initialized dynbuf */
+  curlx_dyn_init(&canonical_headers, CURL_MAX_HTTP_HEADER);
+  curlx_dyn_init(&signed_headers, CURL_MAX_HTTP_HEADER);
+
+  result = parse_sigv4_params(data, hostname, &provider0, &provider1,
+                              &region, &service);
+  if(!result) {
+    Curl_http_method(data, &method, &httpreq);
+    result = get_payload_hash(data, httpreq, &provider0, &provider1, &service,
+                              sha_hash, sha_hex, content_sha256_hdr,
+                              &payload_hash, &payload_hash_len);
+  }
+
+  if(!result)
+    result = get_timestamp(timestamp, sizeof(timestamp));
+
+  if(!result)
+    result = make_canonical_request(data, hostname, timestamp,
+                                    &provider1, &service,
+                                    method, payload_hash, payload_hash_len,
+                                    &date_header, content_sha256_hdr,
+                                    &canonical_headers, &signed_headers,
+                                    &canonical_request);
+  if(!result) {
+    /* the timestamp might have been updated in make_canonical_request */
+    memcpy(date, timestamp, sizeof(date) - 1);
+    date[sizeof(date) - 1] = 0;
+
+    result = make_string_to_sign(data, &provider0, &region, &service,
+                                 date, timestamp, canonical_request,
+                                 &request_type, &credential_scope,
+                                 &str_to_sign);
+  }
+  if(!result)
+    result = sign_and_set_auth_headers(data, &provider0, &region, &service,
+                                       request_type, credential_scope,
+                                       date, str_to_sign, date_header,
+                                       content_sha256_hdr, &signed_headers);
+
+  curlx_dyn_free(&canonical_headers);
+  curlx_dyn_free(&signed_headers);
+  curlx_free(canonical_request);
+  curlx_free(request_type);
+  curlx_free(credential_scope);
+  curlx_free(str_to_sign);
+  curlx_free(date_header);
+  return result;
+}
+
+#endif /* !CURL_DISABLE_HTTP && !CURL_DISABLE_AWS */
diff --git a/third-party/curl/lib/http_aws_sigv4.h b/third-party/curl/lib/http_aws_sigv4.h
index 57cc5706eb..7dd002476a 100644
--- a/third-party/curl/lib/http_aws_sigv4.h
+++ b/third-party/curl/lib/http_aws_sigv4.h
@@ -11,7 +11,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -25,7 +25,10 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
+#include "curlx/dynbuf.h"
+#include "urldata.h"
+
 /* this is for creating aws_sigv4 header output */
-CURLcode Curl_output_aws_sigv4(struct Curl_easy *data, bool proxy);
+CURLcode Curl_output_aws_sigv4(struct Curl_easy *data);
 
 #endif /* HEADER_CURL_HTTP_AWS_SIGV4_H */
diff --git a/third-party/curl/lib/http_chunks.c b/third-party/curl/lib/http_chunks.c
index bda00d3833..9596fc6693 100644
--- a/third-party/curl/lib/http_chunks.c
+++ b/third-party/curl/lib/http_chunks.c
@@ -21,30 +21,25 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifndef CURL_DISABLE_HTTP
 
 #include "urldata.h" /* it includes http_chunks.h */
+#include "curl_trc.h"
+#include "http.h"    /* for Curl_verify_header */
 #include "sendf.h"   /* for the client write stuff */
-#include "dynbuf.h"
-#include "content_encoding.h"
-#include "http.h"
-#include "strtoofft.h"
-#include "warnless.h"
-
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curlx/dynbuf.h"
+#include "multiif.h"
+#include "curlx/strparse.h"
 
 /*
- * Chunk format (simplified):
- *
- * <HEX SIZE>[ chunk extension ] CRLF
- * <DATA> CRLF
- *
- * Highlights from RFC2616 section 3.6 say:
+   Chunk format (simplified):
+
+   <HEX SIZE>[ chunk extension ] CRLF
+   <DATA> CRLF
+
+   Highlights from RFC2616 section 3.6 say:
 
    The chunked encoding modifies the body of a message in order to
    transfer it as a series of chunks, each with its own size indicator,
@@ -75,227 +70,307 @@
 
  */
 
-#define isxdigit_ascii(x) Curl_isxdigit(x)
-
-void Curl_httpchunk_init(struct Curl_easy *data)
+void Curl_httpchunk_init(struct Curl_easy *data, struct Curl_chunker *ch,
+                         bool ignore_body)
 {
-  struct connectdata *conn = data->conn;
-  struct Curl_chunker *chunk = &conn->chunk;
-  chunk->hexindex = 0;      /* start at 0 */
-  chunk->state = CHUNK_HEX; /* we get hex first! */
-  Curl_dyn_init(&conn->trailer, DYN_H1_TRAILER);
+  (void)data;
+  ch->hexindex = 0;      /* start at 0 */
+  ch->state = CHUNK_HEX; /* we get hex first! */
+  ch->last_code = CHUNKE_OK;
+  curlx_dyn_init(&ch->trailer, DYN_H1_TRAILER);
+  ch->ignore_body = ignore_body;
 }
 
-/*
- * chunk_read() returns a OK for normal operations, or a positive return code
- * for errors. STOP means this sequence of chunks is complete.  The 'wrote'
- * argument is set to tell the caller how many bytes we actually passed to the
- * client (for byte-counting and whatever).
- *
- * The states and the state-machine is further explained in the header file.
- *
- * This function always uses ASCII hex values to accommodate non-ASCII hosts.
- * For example, 0x0d and 0x0a are used instead of '\r' and '\n'.
- */
-CHUNKcode Curl_httpchunk_read(struct Curl_easy *data,
-                              char *datap,
-                              ssize_t datalen,
-                              ssize_t *wrote,
-                              CURLcode *extrap)
+void Curl_httpchunk_reset(struct Curl_easy *data, struct Curl_chunker *ch,
+                          bool ignore_body)
+{
+  (void)data;
+  ch->hexindex = 0;      /* start at 0 */
+  ch->state = CHUNK_HEX; /* we get hex first! */
+  ch->last_code = CHUNKE_OK;
+  curlx_dyn_reset(&ch->trailer);
+  ch->ignore_body = ignore_body;
+}
+
+void Curl_httpchunk_free(struct Curl_easy *data, struct Curl_chunker *ch)
+{
+  (void)data;
+  curlx_dyn_free(&ch->trailer);
+}
+
+bool Curl_httpchunk_is_done(struct Curl_easy *data, struct Curl_chunker *ch)
+{
+  (void)data;
+  return ch->state == CHUNK_DONE;
+}
+
+static CURLcode httpchunk_readwrite(struct Curl_easy *data,
+                                    struct Curl_chunker *ch,
+                                    struct Curl_cwriter *cw_next,
+                                    const char *buf, size_t blen,
+                                    size_t *pconsumed)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct Curl_chunker *ch = &conn->chunk;
-  struct SingleRequest *k = &data->req;
   size_t piece;
-  curl_off_t length = (curl_off_t)datalen;
 
-  *wrote = 0; /* nothing's written yet */
+  *pconsumed = 0; /* nothing's written yet */
+  /* first check terminal states that will not progress anywhere */
+  if(ch->state == CHUNK_DONE)
+    return CURLE_OK;
+  if(ch->state == CHUNK_FAILED)
+    return CURLE_RECV_ERROR;
 
   /* the original data is written to the client, but we go on with the
      chunk read process, to properly calculate the content length */
-  if(data->set.http_te_skip && !k->ignorebody) {
-    result = Curl_client_write(data, CLIENTWRITE_BODY, datap, datalen);
+  if(data->set.http_te_skip && !ch->ignore_body) {
+    if(cw_next)
+      result = Curl_cwriter_write(data, cw_next, CLIENTWRITE_BODY, buf, blen);
+    else
+      result = Curl_client_write(data, CLIENTWRITE_BODY, buf, blen);
     if(result) {
-      *extrap = result;
-      return CHUNKE_PASSTHRU_ERROR;
+      ch->state = CHUNK_FAILED;
+      ch->last_code = CHUNKE_PASSTHRU_ERROR;
+      return result;
     }
   }
 
-  while(length) {
+  while(blen) {
     switch(ch->state) {
     case CHUNK_HEX:
-      if(ISXDIGIT(*datap)) {
-        if(ch->hexindex < CHUNK_MAXNUM_LEN) {
-          ch->hexbuffer[ch->hexindex] = *datap;
-          datap++;
-          length--;
-          ch->hexindex++;
-        }
-        else {
-          return CHUNKE_TOO_LONG_HEX; /* longer hex than we support */
+      if(ISXDIGIT(*buf)) {
+        if(ch->hexindex >= CHUNK_MAXNUM_LEN) {
+          failf(data, "chunk hex-length longer than %d", CHUNK_MAXNUM_LEN);
+          ch->state = CHUNK_FAILED;
+          ch->last_code = CHUNKE_TOO_LONG_HEX; /* longer than we support */
+          return CURLE_RECV_ERROR;
         }
+        ch->hexbuffer[ch->hexindex++] = *buf;
+        buf++;
+        blen--;
+        (*pconsumed)++;
       }
       else {
-        char *endptr;
-        if(0 == ch->hexindex)
+        const char *p;
+        if(ch->hexindex == 0) {
           /* This is illegal data, we received junk where we expected
              a hexadecimal digit. */
-          return CHUNKE_ILLEGAL_HEX;
-
-        /* length and datap are unmodified */
+          failf(data, "chunk hex-length char not a hex digit: 0x%x",
+                (unsigned int)*buf);
+          ch->state = CHUNK_FAILED;
+          ch->last_code = CHUNKE_ILLEGAL_HEX;
+          return CURLE_RECV_ERROR;
+        }
+        /* blen and buf are unmodified */
         ch->hexbuffer[ch->hexindex] = 0;
-
-        if(curlx_strtoofft(ch->hexbuffer, &endptr, 16, &ch->datasize))
-          return CHUNKE_ILLEGAL_HEX;
+        p = &ch->hexbuffer[0];
+        if(curlx_str_hex(&p, &ch->datasize, CURL_OFF_T_MAX)) {
+          failf(data, "invalid chunk size: '%s'", ch->hexbuffer);
+          ch->state = CHUNK_FAILED;
+          ch->last_code = CHUNKE_ILLEGAL_HEX;
+          return CURLE_RECV_ERROR;
+        }
         ch->state = CHUNK_LF; /* now wait for the CRLF */
       }
       break;
 
     case CHUNK_LF:
       /* waiting for the LF after a chunk size */
-      if(*datap == 0x0a) {
-        /* we're now expecting data to come, unless size was zero! */
-        if(0 == ch->datasize) {
+      if(*buf == 0x0a) {
+        /* we are now expecting data to come, unless size was zero! */
+        if(ch->datasize == 0) {
           ch->state = CHUNK_TRAILER; /* now check for trailers */
         }
-        else
+        else {
           ch->state = CHUNK_DATA;
+          CURL_TRC_WRITE(data, "http_chunked, chunk start of %"
+                         FMT_OFF_T " bytes", ch->datasize);
+        }
       }
 
-      datap++;
-      length--;
+      buf++;
+      blen--;
+      (*pconsumed)++;
       break;
 
     case CHUNK_DATA:
-      /* We expect 'datasize' of data. We have 'length' right now, it can be
+      /* We expect 'datasize' of data. We have 'blen' right now, it can be
          more or less than 'datasize'. Get the smallest piece.
       */
-      piece = curlx_sotouz((ch->datasize >= length)?length:ch->datasize);
+      piece = blen;
+      if(ch->datasize < (curl_off_t)blen)
+        piece = curlx_sotouz(ch->datasize);
 
       /* Write the data portion available */
-      if(!data->set.http_te_skip && !k->ignorebody) {
-        if(!data->set.http_ce_skip && k->writer_stack)
-          result = Curl_unencode_write(data, k->writer_stack, datap, piece);
+      if(!data->set.http_te_skip && !ch->ignore_body) {
+        if(cw_next)
+          result = Curl_cwriter_write(data, cw_next, CLIENTWRITE_BODY,
+                                      buf, piece);
         else
-          result = Curl_client_write(data, CLIENTWRITE_BODY, datap, piece);
-
+          result = Curl_client_write(data, CLIENTWRITE_BODY, buf, piece);
         if(result) {
-          *extrap = result;
-          return CHUNKE_PASSTHRU_ERROR;
+          ch->state = CHUNK_FAILED;
+          ch->last_code = CHUNKE_PASSTHRU_ERROR;
+          return result;
         }
       }
 
-      *wrote += piece;
+      *pconsumed += piece;
       ch->datasize -= piece; /* decrease amount left to expect */
-      datap += piece;    /* move read pointer forward */
-      length -= piece;   /* decrease space left in this round */
+      buf += piece;    /* move read pointer forward */
+      blen -= piece;   /* decrease space left in this round */
+      CURL_TRC_WRITE(data, "http_chunked, write %zu body bytes, %"
+                     FMT_OFF_T " bytes in chunk remain",
+                     piece, ch->datasize);
 
-      if(0 == ch->datasize)
+      if(ch->datasize == 0)
         /* end of data this round, we now expect a trailing CRLF */
         ch->state = CHUNK_POSTLF;
       break;
 
     case CHUNK_POSTLF:
-      if(*datap == 0x0a) {
+      if(*buf == 0x0a) {
         /* The last one before we go back to hex state and start all over. */
-        Curl_httpchunk_init(data); /* sets state back to CHUNK_HEX */
+        Curl_httpchunk_reset(data, ch, (bool)ch->ignore_body);
       }
-      else if(*datap != 0x0d)
-        return CHUNKE_BAD_CHUNK;
-      datap++;
-      length--;
+      else if(*buf != 0x0d) {
+        ch->state = CHUNK_FAILED;
+        ch->last_code = CHUNKE_BAD_CHUNK;
+        return CURLE_RECV_ERROR;
+      }
+      buf++;
+      blen--;
+      (*pconsumed)++;
       break;
 
     case CHUNK_TRAILER:
-      if((*datap == 0x0d) || (*datap == 0x0a)) {
-        char *tr = Curl_dyn_ptr(&conn->trailer);
+      if((*buf == 0x0d) || (*buf == 0x0a)) {
+        const char *tr = curlx_dyn_ptr(&ch->trailer);
         /* this is the end of a trailer, but if the trailer was zero bytes
            there was no trailer and we move on */
 
         if(tr) {
           size_t trlen;
-          result = Curl_dyn_addn(&conn->trailer, (char *)STRCONST("\x0d\x0a"));
-          if(result)
-            return CHUNKE_OUT_OF_MEMORY;
+          result = curlx_dyn_addn(&ch->trailer, STRCONST("\x0d\x0a"));
+          if(result) {
+            ch->state = CHUNK_FAILED;
+            ch->last_code = CHUNKE_OUT_OF_MEMORY;
+            return result;
+          }
+          tr = curlx_dyn_ptr(&ch->trailer);
+          trlen = curlx_dyn_len(&ch->trailer);
+
+          /* a trailer is delivered to the client as a header, so it must pass
+             the same checks as a regular response header */
+          result = Curl_verify_header(data, tr, trlen);
+          if(result) {
+            ch->state = CHUNK_FAILED;
+            ch->last_code = CHUNKE_BAD_CHUNK;
+            return result;
+          }
 
-          tr = Curl_dyn_ptr(&conn->trailer);
-          trlen = Curl_dyn_len(&conn->trailer);
           if(!data->set.http_te_skip) {
-            result = Curl_client_write(data,
-                                       CLIENTWRITE_HEADER|CLIENTWRITE_TRAILER,
-                                       tr, trlen);
+            if(cw_next)
+              result = Curl_cwriter_write(data, cw_next,
+                                          CLIENTWRITE_HEADER |
+                                          CLIENTWRITE_TRAILER,
+                                          tr, trlen);
+            else
+              result = Curl_client_write(data,
+                                         CLIENTWRITE_HEADER |
+                                         CLIENTWRITE_TRAILER,
+                                         tr, trlen);
             if(result) {
-              *extrap = result;
-              return CHUNKE_PASSTHRU_ERROR;
+              ch->state = CHUNK_FAILED;
+              ch->last_code = CHUNKE_PASSTHRU_ERROR;
+              return result;
             }
           }
-          Curl_dyn_reset(&conn->trailer);
+          curlx_dyn_reset(&ch->trailer);
           ch->state = CHUNK_TRAILER_CR;
-          if(*datap == 0x0a)
+          if(*buf == 0x0a)
             /* already on the LF */
             break;
         }
         else {
-          /* no trailer, we're on the final CRLF pair */
+          /* no trailer, we are on the final CRLF pair */
           ch->state = CHUNK_TRAILER_POSTCR;
-          break; /* don't advance the pointer */
+          break; /* do not advance the pointer */
         }
       }
       else {
-        result = Curl_dyn_addn(&conn->trailer, datap, 1);
-        if(result)
-          return CHUNKE_OUT_OF_MEMORY;
+        result = curlx_dyn_addn(&ch->trailer, buf, 1);
+        if(result) {
+          ch->state = CHUNK_FAILED;
+          ch->last_code = CHUNKE_OUT_OF_MEMORY;
+          return result;
+        }
       }
-      datap++;
-      length--;
+      buf++;
+      blen--;
+      (*pconsumed)++;
       break;
 
     case CHUNK_TRAILER_CR:
-      if(*datap == 0x0a) {
+      if(*buf == 0x0a) {
         ch->state = CHUNK_TRAILER_POSTCR;
-        datap++;
-        length--;
+        buf++;
+        blen--;
+        (*pconsumed)++;
+      }
+      else {
+        ch->state = CHUNK_FAILED;
+        ch->last_code = CHUNKE_BAD_CHUNK;
+        return CURLE_RECV_ERROR;
       }
-      else
-        return CHUNKE_BAD_CHUNK;
       break;
 
     case CHUNK_TRAILER_POSTCR:
       /* We enter this state when a CR should arrive so we expect to
          have to first pass a CR before we wait for LF */
-      if((*datap != 0x0d) && (*datap != 0x0a)) {
+      if((*buf != 0x0d) && (*buf != 0x0a)) {
         /* not a CR then it must be another header in the trailer */
         ch->state = CHUNK_TRAILER;
         break;
       }
-      if(*datap == 0x0d) {
+      if(*buf == 0x0d) {
         /* skip if CR */
-        datap++;
-        length--;
+        buf++;
+        blen--;
+        (*pconsumed)++;
       }
       /* now wait for the final LF */
       ch->state = CHUNK_STOP;
       break;
 
     case CHUNK_STOP:
-      if(*datap == 0x0a) {
-        length--;
-
+      if(*buf == 0x0a) {
+        blen--;
+        (*pconsumed)++;
         /* Record the length of any data left in the end of the buffer
-           even if there's no more chunks to read */
-        ch->datasize = curlx_sotouz(length);
-
-        return CHUNKE_STOP; /* return stop */
+           even if there is no more chunks to read */
+        ch->datasize = blen;
+        ch->state = CHUNK_DONE;
+        CURL_TRC_WRITE(data, "http_chunk, response complete");
+        return CURLE_OK;
       }
-      else
-        return CHUNKE_BAD_CHUNK;
+      else {
+        ch->state = CHUNK_FAILED;
+        ch->last_code = CHUNKE_BAD_CHUNK;
+        CURL_TRC_WRITE(data, "http_chunk error, expected 0x0a, seeing 0x%ux",
+                       (unsigned int)*buf);
+        return CURLE_RECV_ERROR;
+      }
+    case CHUNK_DONE:
+      return CURLE_OK;
+
+    case CHUNK_FAILED:
+      return CURLE_RECV_ERROR;
     }
   }
-  return CHUNKE_OK;
+  return CURLE_OK;
 }
 
-const char *Curl_chunked_strerror(CHUNKcode code)
+static const char *Curl_chunked_strerror(CHUNKcode code)
 {
   switch(code) {
   default:
@@ -307,8 +382,7 @@ const char *Curl_chunked_strerror(CHUNKcode code)
   case CHUNKE_BAD_CHUNK:
     return "Malformed encoding found";
   case CHUNKE_PASSTHRU_ERROR:
-    DEBUGASSERT(0); /* never used */
-    return "";
+    return "Error writing data to client";
   case CHUNKE_BAD_ENCODING:
     return "Bad content-encoding found";
   case CHUNKE_OUT_OF_MEMORY:
@@ -316,4 +390,293 @@ const char *Curl_chunked_strerror(CHUNKcode code)
   }
 }
 
+CURLcode Curl_httpchunk_read(struct Curl_easy *data,
+                             struct Curl_chunker *ch,
+                             char *buf, size_t blen,
+                             size_t *pconsumed)
+{
+  return httpchunk_readwrite(data, ch, NULL, buf, blen, pconsumed);
+}
+
+struct chunked_writer {
+  struct Curl_cwriter super;
+  struct Curl_chunker ch;
+};
+
+static CURLcode cw_chunked_init(struct Curl_easy *data,
+                                struct Curl_cwriter *writer)
+{
+  struct chunked_writer *ctx = writer->ctx;
+
+  data->req.chunk = TRUE;      /* chunks coming our way. */
+  Curl_httpchunk_init(data, &ctx->ch, FALSE);
+  return CURLE_OK;
+}
+
+static void cw_chunked_close(struct Curl_easy *data,
+                             struct Curl_cwriter *writer)
+{
+  struct chunked_writer *ctx = writer->ctx;
+  Curl_httpchunk_free(data, &ctx->ch);
+}
+
+static CURLcode cw_chunked_write(struct Curl_easy *data,
+                                 struct Curl_cwriter *writer, int type,
+                                 const char *buf, size_t blen)
+{
+  struct chunked_writer *ctx = writer->ctx;
+  CURLcode result;
+  size_t consumed;
+
+  if(!(type & CLIENTWRITE_BODY))
+    return Curl_cwriter_write(data, writer->next, type, buf, blen);
+
+  consumed = 0;
+  result = httpchunk_readwrite(data, &ctx->ch, writer->next, buf, blen,
+                               &consumed);
+
+  if(result) {
+    if(CHUNKE_PASSTHRU_ERROR == ctx->ch.last_code) {
+      failf(data, "Failed reading the chunked-encoded stream");
+    }
+    else {
+      failf(data, "%s in chunked-encoding",
+            Curl_chunked_strerror(ctx->ch.last_code));
+    }
+    return result;
+  }
+
+  blen -= consumed;
+  if(CHUNK_DONE == ctx->ch.state) {
+    /* chunks read successfully, download is complete */
+    data->req.download_done = TRUE;
+    if(blen) {
+      infof(data, "Leftovers after chunking: %zu bytes", blen);
+    }
+  }
+  else if((type & CLIENTWRITE_EOS) && !data->req.no_body) {
+    failf(data, "transfer closed with outstanding read data remaining");
+    return CURLE_PARTIAL_FILE;
+  }
+
+  return CURLE_OK;
+}
+
+/* HTTP chunked Transfer-Encoding decoder */
+const struct Curl_cwtype Curl_httpchunk_unencoder = {
+  "chunked",
+  NULL,
+  cw_chunked_init,
+  cw_chunked_write,
+  cw_chunked_close,
+  sizeof(struct chunked_writer)
+};
+
+/* max length of an HTTP chunk that we want to generate */
+#define CURL_CHUNKED_MINLEN   1024
+#define CURL_CHUNKED_MAXLEN   (64 * 1024)
+
+struct chunked_reader {
+  struct Curl_creader super;
+  struct bufq chunkbuf;
+  BIT(read_eos);  /* we read an EOS from the next reader */
+  BIT(eos);       /* we have returned an EOS */
+};
+
+static CURLcode cr_chunked_init(struct Curl_easy *data,
+                                struct Curl_creader *reader)
+{
+  struct chunked_reader *ctx = reader->ctx;
+  (void)data;
+  Curl_bufq_init2(&ctx->chunkbuf, CURL_CHUNKED_MAXLEN, 2, BUFQ_OPT_SOFT_LIMIT);
+  return CURLE_OK;
+}
+
+static void cr_chunked_close(struct Curl_easy *data,
+                             struct Curl_creader *reader)
+{
+  struct chunked_reader *ctx = reader->ctx;
+  (void)data;
+  Curl_bufq_free(&ctx->chunkbuf);
+}
+
+static CURLcode add_last_chunk(struct Curl_easy *data,
+                               struct Curl_creader *reader)
+{
+  struct chunked_reader *ctx = reader->ctx;
+  struct curl_slist *trailers = NULL, *tr;
+  CURLcode result;
+  size_t n;
+  int rc;
+
+  if(!data->set.trailer_callback) {
+    CURL_TRC_READ(data, "http_chunk, added last, empty chunk");
+    return Curl_bufq_cwrite(&ctx->chunkbuf, STRCONST("0\r\n\r\n"), &n);
+  }
+
+  result = Curl_bufq_cwrite(&ctx->chunkbuf, STRCONST("0\r\n"), &n);
+  if(result)
+    goto out;
+
+  Curl_set_in_callback(data, TRUE);
+  rc = data->set.trailer_callback(&trailers, data->set.trailer_data);
+  Curl_set_in_callback(data, FALSE);
+
+  if(rc != CURL_TRAILERFUNC_OK) {
+    failf(data, "operation aborted by trailing headers callback");
+    result = CURLE_ABORTED_BY_CALLBACK;
+    goto out;
+  }
+
+  for(tr = trailers; tr; tr = tr->next) {
+    /* only add correctly formatted trailers */
+    const char *ptr = strchr(tr->data, ':');
+    if(!ptr || *(ptr + 1) != ' ') {
+      infof(data, "Malformatted trailing header, skipping trailer");
+      continue;
+    }
+
+    result = Curl_bufq_cwrite(&ctx->chunkbuf, tr->data, strlen(tr->data), &n);
+    if(!result)
+      result = Curl_bufq_cwrite(&ctx->chunkbuf, STRCONST("\r\n"), &n);
+    if(result)
+      goto out;
+  }
+
+  result = Curl_bufq_cwrite(&ctx->chunkbuf, STRCONST("\r\n"), &n);
+
+out:
+  curl_slist_free_all(trailers);
+  CURL_TRC_READ(data, "http_chunk, added last chunk with trailers "
+                "from client -> %d", (int)result);
+  return result;
+}
+
+static CURLcode add_chunk(struct Curl_easy *data,
+                          struct Curl_creader *reader,
+                          char *buf, size_t blen)
+{
+  struct chunked_reader *ctx = reader->ctx;
+  CURLcode result;
+  char tmp[CURL_CHUNKED_MINLEN];
+  size_t nread;
+  bool eos;
+
+  DEBUGASSERT(!ctx->read_eos);
+  blen = CURLMIN(blen, CURL_CHUNKED_MAXLEN); /* respect our buffer pref */
+  if(blen < sizeof(tmp)) {
+    /* small read, make a chunk of decent size */
+    buf = tmp;
+    blen = sizeof(tmp);
+  }
+  else {
+    /* larger read, make a chunk that will fit when read back */
+    blen -= (8 + 2 + 2); /* deduct max overhead, 8 hex + 2*crlf */
+  }
+
+  result = Curl_creader_read(data, reader->next, buf, blen, &nread, &eos);
+  if(result)
+    return result;
+  if(eos)
+    ctx->read_eos = TRUE;
+
+  if(nread) {
+    /* actually got bytes, wrap them into the chunkbuf */
+    char hd[11] = "";
+    int hdlen;
+    size_t n;
+
+    hdlen = curl_msnprintf(hd, sizeof(hd), "%zx\r\n", nread);
+    if(hdlen <= 0)
+      return CURLE_READ_ERROR;
+    /* On a soft-limited bufq, we do not need to check that all was written */
+    result = Curl_bufq_cwrite(&ctx->chunkbuf, hd, hdlen, &n);
+    if(!result)
+      result = Curl_bufq_cwrite(&ctx->chunkbuf, buf, nread, &n);
+    if(!result)
+      result = Curl_bufq_cwrite(&ctx->chunkbuf, "\r\n", 2, &n);
+    CURL_TRC_READ(data, "http_chunk, made chunk of %zu bytes -> %d",
+                  nread, (int)result);
+    if(result)
+      return result;
+  }
+
+  if(ctx->read_eos)
+    return add_last_chunk(data, reader);
+  return CURLE_OK;
+}
+
+static CURLcode cr_chunked_read(struct Curl_easy *data,
+                                struct Curl_creader *reader,
+                                char *buf, size_t blen,
+                                size_t *pnread, bool *peos)
+{
+  struct chunked_reader *ctx = reader->ctx;
+  CURLcode result = CURLE_READ_ERROR;
+
+  *pnread = 0;
+  *peos = (bool)ctx->eos;
+
+  if(!ctx->eos) {
+    if(!ctx->read_eos && Curl_bufq_is_empty(&ctx->chunkbuf)) {
+      /* Still getting data form the next reader, buffer is empty */
+      result = add_chunk(data, reader, buf, blen);
+      if(result)
+        return result;
+    }
+
+    if(!Curl_bufq_is_empty(&ctx->chunkbuf)) {
+      result = Curl_bufq_cread(&ctx->chunkbuf, buf, blen, pnread);
+      if(!result && ctx->read_eos && Curl_bufq_is_empty(&ctx->chunkbuf)) {
+        /* no more data, read all, done. */
+        ctx->eos = TRUE;
+        *peos = TRUE;
+      }
+      return result;
+    }
+  }
+  /* We may get here, because we are done or because callbacks paused */
+  DEBUGASSERT(ctx->eos || !ctx->read_eos);
+  return CURLE_OK;
+}
+
+static curl_off_t cr_chunked_total_length(struct Curl_easy *data,
+                                          struct Curl_creader *reader)
+{
+  /* this reader changes length depending on input */
+  (void)data;
+  (void)reader;
+  return -1;
+}
+
+/* HTTP chunked Transfer-Encoding encoder */
+const struct Curl_crtype Curl_httpchunk_encoder = {
+  "chunked",
+  cr_chunked_init,
+  cr_chunked_read,
+  cr_chunked_close,
+  Curl_creader_def_needs_rewind,
+  cr_chunked_total_length,
+  Curl_creader_def_resume_from,
+  Curl_creader_def_cntrl,
+  Curl_creader_def_is_paused,
+  Curl_creader_def_done,
+  sizeof(struct chunked_reader)
+};
+
+CURLcode Curl_httpchunk_add_reader(struct Curl_easy *data)
+{
+  struct Curl_creader *reader = NULL;
+  CURLcode result;
+
+  result = Curl_creader_create(&reader, data, &Curl_httpchunk_encoder,
+                               CURL_CR_TRANSFER_ENCODE);
+  if(!result)
+    result = Curl_creader_add(data, reader);
+
+  if(result && reader)
+    Curl_creader_free(data, reader);
+  return result;
+}
+
 #endif /* CURL_DISABLE_HTTP */
diff --git a/third-party/curl/lib/http_chunks.h b/third-party/curl/lib/http_chunks.h
index ed50713162..d8e5982e6d 100644
--- a/third-party/curl/lib/http_chunks.h
+++ b/third-party/curl/lib/http_chunks.h
@@ -23,18 +23,23 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "curl_setup.h"
+
+#ifndef CURL_DISABLE_HTTP
+
+#include "curlx/dynbuf.h"
 
 struct connectdata;
 
 /*
  * The longest possible hexadecimal number we support in a chunked transfer.
  * Neither RFC2616 nor the later HTTP specs define a maximum chunk size.
- * For 64 bit curl_off_t we support 16 digits. For 32 bit, 8 digits.
+ * For 64-bit curl_off_t we support 16 digits. For 32-bit, 8 digits.
  */
 #define CHUNK_MAXNUM_LEN (SIZEOF_CURL_OFF_T * 2)
 
 typedef enum {
-  /* await and buffer all hexadecimal digits until we get one that isn't a
+  /* await and buffer all hexadecimal digits until we get one that is not a
      hexadecimal digit. When done, we go CHUNK_LF */
   CHUNK_HEX,
 
@@ -45,14 +50,14 @@ typedef enum {
      POST_CR state. */
   CHUNK_DATA,
 
-  /* POSTLF should get a CR and then a LF and nothing else, then move back to
+  /* POSTLF should get a CR and then an LF and nothing else, then move back to
      HEX as the CRLF combination marks the end of a chunk. A missing CR is no
      big deal. */
   CHUNK_POSTLF,
 
-  /* Used to mark that we're out of the game.  NOTE: that there's a 'datasize'
-     field in the struct that will tell how many bytes that were not passed to
-     the client in the end of the last buffer! */
+  /* Used to mark that we are out of the game. NOTE: that there is a
+     'datasize' field in the struct that will tell how many bytes that were
+     not passed to the client in the end of the last buffer! */
   CHUNK_STOP,
 
   /* At this point optional trailer headers can be found, unless the next line
@@ -60,41 +65,82 @@ typedef enum {
   CHUNK_TRAILER,
 
   /* A trailer CR has been found - next state is CHUNK_TRAILER_POSTCR.
-     Next char must be a LF */
+     Next char must be an LF */
   CHUNK_TRAILER_CR,
 
   /* A trailer LF must be found now, otherwise CHUNKE_BAD_CHUNK will be
      signalled If this is an empty trailer CHUNKE_STOP will be signalled.
      Otherwise the trailer will be broadcasted via Curl_client_write() and the
      next state will be CHUNK_TRAILER */
-  CHUNK_TRAILER_POSTCR
+  CHUNK_TRAILER_POSTCR,
+
+  /* Successfully de-chunked everything */
+  CHUNK_DONE,
+
+  /* Failed on seeing a bad or not correctly terminated chunk */
+  CHUNK_FAILED
 } ChunkyState;
 
 typedef enum {
-  CHUNKE_STOP = -1,
   CHUNKE_OK = 0,
   CHUNKE_TOO_LONG_HEX = 1,
   CHUNKE_ILLEGAL_HEX,
   CHUNKE_BAD_CHUNK,
   CHUNKE_BAD_ENCODING,
   CHUNKE_OUT_OF_MEMORY,
-  CHUNKE_PASSTHRU_ERROR, /* Curl_httpchunk_read() returns a CURLcode to use */
-  CHUNKE_LAST
+  CHUNKE_PASSTHRU_ERROR /* Curl_httpchunk_read() returns a CURLcode to use */
 } CHUNKcode;
 
-const char *Curl_chunked_strerror(CHUNKcode code);
-
 struct Curl_chunker {
   curl_off_t datasize;
   ChunkyState state;
+  CHUNKcode last_code;
+  struct dynbuf trailer; /* for chunked-encoded trailer */
   unsigned char hexindex;
-  char hexbuffer[ CHUNK_MAXNUM_LEN + 1]; /* +1 for null-terminator */
+  char hexbuffer[CHUNK_MAXNUM_LEN + 1]; /* +1 for null-terminator */
+  BIT(ignore_body); /* never write response body data */
 };
 
 /* The following functions are defined in http_chunks.c */
-void Curl_httpchunk_init(struct Curl_easy *data);
-CHUNKcode Curl_httpchunk_read(struct Curl_easy *data, char *datap,
-                              ssize_t length, ssize_t *wrote,
-                              CURLcode *passthru);
+void Curl_httpchunk_init(struct Curl_easy *data, struct Curl_chunker *ch,
+                         bool ignore_body);
+void Curl_httpchunk_free(struct Curl_easy *data, struct Curl_chunker *ch);
+void Curl_httpchunk_reset(struct Curl_easy *data, struct Curl_chunker *ch,
+                          bool ignore_body);
+
+/*
+ * Read BODY bytes in HTTP/1.1 chunked encoding from `buf` and return
+ * the amount of bytes consumed. The actual response bytes and trailer
+ * headers are written out to the client.
+ * On success, this will consume all bytes up to the end of the response,
+ * e.g. the last chunk, has been processed.
+ * @param data   the transfer involved
+ * @param ch     the chunker instance keeping state across calls
+ * @param buf    the response data
+ * @param blen   amount of bytes in `buf`
+ * @param pconsumed  on successful return, the number of bytes in `buf`
+ *                   consumed
+ *
+ * This function always uses ASCII hex values to accommodate non-ASCII hosts.
+ * For example, 0x0d and 0x0a are used instead of '\r' and '\n'.
+ */
+CURLcode Curl_httpchunk_read(struct Curl_easy *data, struct Curl_chunker *ch,
+                             char *buf, size_t blen, size_t *pconsumed);
+
+/**
+ * @return TRUE iff chunked decoded has finished successfully.
+ */
+bool Curl_httpchunk_is_done(struct Curl_easy *data, struct Curl_chunker *ch);
+
+extern const struct Curl_cwtype Curl_httpchunk_unencoder;
+
+extern const struct Curl_crtype Curl_httpchunk_encoder;
+
+/**
+ * Add a transfer-encoding "chunked" reader to the transfers reader stack
+ */
+CURLcode Curl_httpchunk_add_reader(struct Curl_easy *data);
+
+#endif /* !CURL_DISABLE_HTTP */
 
 #endif /* HEADER_CURL_HTTP_CHUNKS_H */
diff --git a/third-party/curl/lib/http_digest.c b/third-party/curl/lib/http_digest.c
index 2db3125a8e..25783d0969 100644
--- a/third-party/curl/lib/http_digest.c
+++ b/third-party/curl/lib/http_digest.c
@@ -21,7 +21,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_DIGEST_AUTH)
@@ -30,11 +29,7 @@
 #include "strcase.h"
 #include "vauth/vauth.h"
 #include "http_digest.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curlx/strparse.h"
 
 /* Test example headers:
 
@@ -59,23 +54,41 @@ CURLcode Curl_input_digest(struct Curl_easy *data,
   }
 
   if(!checkprefix("Digest", header) || !ISBLANK(header[6]))
-    return CURLE_BAD_CONTENT_ENCODING;
+    return CURLE_AUTH_ERROR;
 
   header += strlen("Digest");
-  while(*header && ISBLANK(*header))
-    header++;
+  curlx_str_passblanks(&header);
 
   return Curl_auth_decode_digest_http_message(header, digest);
 }
 
+/* Flush the Digest state if it was created for a different origin or with
+   different credentials than the ones now in use, then link the current
+   ones. */
+static void digest_flush_stale(struct digestdata *digest,
+                               struct Curl_peer *peer,
+                               struct Curl_creds *creds)
+{
+  bool flush = FALSE;
+  if(digest->origin && !Curl_peer_same_destination(peer, digest->origin))
+    flush = TRUE;
+  else if(digest->creds && !Curl_creds_same(creds, digest->creds))
+    flush = TRUE;
+
+  if(flush)
+    /* flush Digest state */
+    Curl_auth_digest_cleanup(digest);
+
+  Curl_peer_link(&digest->origin, peer);
+  Curl_creds_link(&digest->creds, creds);
+}
+
 CURLcode Curl_output_digest(struct Curl_easy *data,
                             bool proxy,
                             const unsigned char *request,
                             const unsigned char *uripath)
 {
   CURLcode result;
-  unsigned char *path = NULL;
-  char *tmp = NULL;
   char *response;
   size_t len;
   bool have_chlg;
@@ -85,8 +98,7 @@ CURLcode Curl_output_digest(struct Curl_easy *data,
   char **allocuserpwd;
 
   /* Point to the name and password for this */
-  const char *userp;
-  const char *passwdp;
+  struct Curl_creds *creds = NULL;
 
   /* Point to the correct struct with this */
   struct digestdata *digest;
@@ -97,33 +109,28 @@ CURLcode Curl_output_digest(struct Curl_easy *data,
     return CURLE_NOT_BUILT_IN;
 #else
     digest = &data->state.proxydigest;
-    allocuserpwd = &data->state.aptr.proxyuserpwd;
-    userp = data->state.aptr.proxyuser;
-    passwdp = data->state.aptr.proxypasswd;
+    digest_flush_stale(digest, data->conn->http_proxy.peer,
+                       data->conn->http_proxy.creds);
+    allocuserpwd = &data->req.hd_proxy_auth;
+    creds = data->conn->http_proxy.creds;
     authp = &data->state.authproxy;
 #endif
   }
   else {
+    DEBUGASSERT(data->state.origin);
     digest = &data->state.digest;
-    allocuserpwd = &data->state.aptr.userpwd;
-    userp = data->state.aptr.user;
-    passwdp = data->state.aptr.passwd;
+    digest_flush_stale(digest, data->state.origin, data->state.creds);
+    allocuserpwd = &data->req.hd_auth;
+    creds = data->state.creds;
     authp = &data->state.authhost;
   }
 
-  Curl_safefree(*allocuserpwd);
+  curlx_safefree(*allocuserpwd);
 
-  /* not set means empty */
-  if(!userp)
-    userp = "";
-
-  if(!passwdp)
-    passwdp = "";
-
-#if defined(USE_WINDOWS_SSPI)
-  have_chlg = digest->input_token ? TRUE : FALSE;
+#ifdef USE_WINDOWS_SSPI
+  have_chlg = !!digest->input_token;
 #else
-  have_chlg = digest->nonce ? TRUE : FALSE;
+  have_chlg = !!digest->nonce;
 #endif
 
   if(!have_chlg) {
@@ -131,43 +138,15 @@ CURLcode Curl_output_digest(struct Curl_easy *data,
     return CURLE_OK;
   }
 
-  /* So IE browsers < v7 cut off the URI part at the query part when they
-     evaluate the MD5 and some (IIS?) servers work with them so we may need to
-     do the Digest IE-style. Note that the different ways cause different MD5
-     sums to get sent.
-
-     Apache servers can be set to do the Digest IE-style automatically using
-     the BrowserMatch feature:
-     https://httpd.apache.org/docs/2.2/mod/mod_auth_digest.html#msie
-
-     Further details on Digest implementation differences:
-     http://www.fngtps.com/2006/09/http-authentication
-  */
-
-  if(authp->iestyle) {
-    tmp = strchr((char *)uripath, '?');
-    if(tmp) {
-      size_t urilen = tmp - (char *)uripath;
-      /* typecast is fine here since the value is always less than 32 bits */
-      path = (unsigned char *) aprintf("%.*s", (int)urilen, uripath);
-    }
-  }
-  if(!tmp)
-    path = (unsigned char *) strdup((char *) uripath);
-
-  if(!path)
-    return CURLE_OUT_OF_MEMORY;
-
-  result = Curl_auth_create_digest_http_message(data, userp, passwdp, request,
-                                                path, digest, &response, &len);
-  free(path);
+  result = Curl_auth_create_digest_http_message(data, creds, request,
+                                                uripath, digest,
+                                                &response, &len);
   if(result)
     return result;
 
-  *allocuserpwd = aprintf("%sAuthorization: Digest %s\r\n",
-                          proxy ? "Proxy-" : "",
-                          response);
-  free(response);
+  *allocuserpwd = curl_maprintf("%sAuthorization: Digest %s\r\n",
+                                proxy ? "Proxy-" : "", response);
+  curlx_free(response);
   if(!*allocuserpwd)
     return CURLE_OUT_OF_MEMORY;
 
diff --git a/third-party/curl/lib/http_negotiate.c b/third-party/curl/lib/http_negotiate.c
index 153e3d4ab8..891369b5bc 100644
--- a/third-party/curl/lib/http_negotiate.c
+++ b/third-party/curl/lib/http_negotiate.c
@@ -21,20 +21,33 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if !defined(CURL_DISABLE_HTTP) && defined(USE_SPNEGO)
 
 #include "urldata.h"
-#include "sendf.h"
+#include "cfilters.h"
+#include "curl_trc.h"
 #include "http_negotiate.h"
 #include "vauth/vauth.h"
+#include "vtls/vtls.h"
+#include "curlx/strparse.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+
+static void http_auth_nego_reset(struct connectdata *conn,
+                                 struct negotiatedata *neg_ctx,
+                                 bool proxy)
+{
+  if(proxy)
+    conn->proxy_negotiate_state = GSS_AUTHNONE;
+  else {
+    conn->http_negotiate_state = GSS_AUTHNONE;
+    Curl_peer_unlink(&conn->creds_origin);
+    Curl_creds_unlink(&conn->creds);
+  }
+  if(neg_ctx)
+    Curl_auth_cleanup_spnego(neg_ctx);
+}
 
 CURLcode Curl_input_negotiate(struct Curl_easy *data, struct connectdata *conn,
                               bool proxy, const char *header)
@@ -42,10 +55,8 @@ CURLcode Curl_input_negotiate(struct Curl_easy *data, struct connectdata *conn,
   CURLcode result;
   size_t len;
 
-  /* Point to the username, password, service and host */
-  const char *userp;
-  const char *passwdp;
-  const char *service;
+  /* Point to credentials and host */
+  struct Curl_creds *creds = NULL;
   const char *host;
 
   /* Point to the correct struct with this */
@@ -54,50 +65,38 @@ CURLcode Curl_input_negotiate(struct Curl_easy *data, struct connectdata *conn,
 
   if(proxy) {
 #ifndef CURL_DISABLE_PROXY
-    userp = conn->http_proxy.user;
-    passwdp = conn->http_proxy.passwd;
-    service = data->set.str[STRING_PROXY_SERVICE_NAME] ?
-              data->set.str[STRING_PROXY_SERVICE_NAME] : "HTTP";
-    host = conn->http_proxy.host.name;
-    neg_ctx = &conn->proxyneg;
+    creds = conn->http_proxy.creds;
+    host = conn->http_proxy.peer->hostname;
     state = conn->proxy_negotiate_state;
 #else
     return CURLE_NOT_BUILT_IN;
 #endif
   }
   else {
-    userp = conn->user;
-    passwdp = conn->passwd;
-    service = data->set.str[STRING_SERVICE_NAME] ?
-              data->set.str[STRING_SERVICE_NAME] : "HTTP";
-    host = conn->host.name;
-    neg_ctx = &conn->negotiate;
+    creds = data->state.creds;
+    host = data->state.origin->hostname;
     state = conn->http_negotiate_state;
   }
 
-  /* Not set means empty */
-  if(!userp)
-    userp = "";
-
-  if(!passwdp)
-    passwdp = "";
+  neg_ctx = Curl_auth_nego_get(conn, proxy);
+  if(!neg_ctx)
+    return CURLE_OUT_OF_MEMORY;
 
   /* Obtain the input token, if any */
   header += strlen("Negotiate");
-  while(*header && ISBLANK(*header))
-    header++;
+  curlx_str_passblanks(&header);
 
   len = strlen(header);
   neg_ctx->havenegdata = len != 0;
   if(!len) {
     if(state == GSS_AUTHSUCC) {
       infof(data, "Negotiate auth restarted");
-      Curl_http_auth_cleanup_negotiate(conn);
+      http_auth_nego_reset(conn, neg_ctx, proxy);
     }
     else if(state != GSS_AUTHNONE) {
-      /* The server rejected our authentication and hasn't supplied any more
+      /* The server rejected our authentication and has not supplied any more
       negotiation mechanisms */
-      Curl_http_auth_cleanup_negotiate(conn);
+      http_auth_nego_reset(conn, neg_ctx, proxy);
       return CURLE_LOGIN_DENIED;
     }
   }
@@ -106,13 +105,49 @@ CURLcode Curl_input_negotiate(struct Curl_easy *data, struct connectdata *conn,
 #if defined(USE_WINDOWS_SSPI) && defined(SECPKG_ATTR_ENDPOINT_BINDINGS)
   neg_ctx->sslContext = conn->sslContext;
 #endif
+  /* Check if the connection is using SSL and get the channel binding data */
+#ifdef GSS_C_CHANNEL_BOUND_FLAG
+#ifdef USE_SSL
+  curlx_dyn_init(&neg_ctx->channel_binding_data, SSL_CB_MAX_SIZE + 1);
+  if(Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
+    result = Curl_ssl_get_channel_binding(data, FIRSTSOCKET,
+                                          &neg_ctx->channel_binding_data);
+    if(result) {
+      http_auth_nego_reset(conn, neg_ctx, proxy);
+      return result;
+    }
+  }
+#else
+  curlx_dyn_init(&neg_ctx->channel_binding_data, 1);
+#endif /* USE_SSL */
+#endif /* GSS_C_CHANNEL_BOUND_FLAG */
 
   /* Initialize the security context and decode our challenge */
-  result = Curl_auth_decode_spnego_message(data, userp, passwdp, service,
+  result = Curl_auth_decode_spnego_message(data, creds, "HTTP",
                                            host, header, neg_ctx);
 
+#ifdef GSS_C_CHANNEL_BOUND_FLAG
+  curlx_dyn_free(&neg_ctx->channel_binding_data);
+#endif
+
   if(result)
-    Curl_http_auth_cleanup_negotiate(conn);
+    http_auth_nego_reset(conn, neg_ctx, proxy);
+
+  if(!result && !proxy) {
+    /* Start it up. From this time onwards, the connection is tied
+     * tp the credentials used. */
+    if(conn->creds_origin &&
+       !Curl_peer_equal(conn->creds_origin, data->state.origin)) {
+      DEBUGASSERT(0); /* should not happen. */
+      return CURLE_FAILED_INIT;
+    }
+    if(conn->creds && !Curl_creds_same(creds, conn->creds)) {
+      DEBUGASSERT(0); /* should not happen. */
+      return CURLE_FAILED_INIT;
+    }
+    Curl_peer_link(&conn->creds_origin, data->state.origin);
+    Curl_creds_link(&conn->creds, creds);
+  }
 
   return result;
 }
@@ -120,16 +155,30 @@ CURLcode Curl_input_negotiate(struct Curl_easy *data, struct connectdata *conn,
 CURLcode Curl_output_negotiate(struct Curl_easy *data,
                                struct connectdata *conn, bool proxy)
 {
-  struct negotiatedata *neg_ctx = proxy ? &conn->proxyneg :
-    &conn->negotiate;
-  struct auth *authp = proxy ? &data->state.authproxy : &data->state.authhost;
-  curlnegotiate *state = proxy ? &conn->proxy_negotiate_state :
-    &conn->http_negotiate_state;
+  struct negotiatedata *neg_ctx;
+  struct auth *authp;
+  curlnegotiate *state;
   char *base64 = NULL;
   size_t len = 0;
   char *userp;
   CURLcode result;
 
+  if(proxy) {
+#ifndef CURL_DISABLE_PROXY
+    authp = &data->state.authproxy;
+    state = &conn->proxy_negotiate_state;
+#else
+    return CURLE_NOT_BUILT_IN;
+#endif
+  }
+  else {
+    authp = &data->state.authhost;
+    state = &conn->http_negotiate_state;
+  }
+  neg_ctx = Curl_auth_nego_get(conn, proxy);
+  if(!neg_ctx)
+    return CURLE_OUT_OF_MEMORY;
+
   authp->done = FALSE;
 
   if(*state == GSS_AUTHRECV) {
@@ -149,7 +198,7 @@ CURLcode Curl_output_negotiate(struct Curl_easy *data,
     if(neg_ctx->noauthpersist && *state == GSS_AUTHSUCC) {
       infof(data, "Curl_output_negotiate, "
             "no persistent authentication: cleanup existing context");
-      Curl_http_auth_cleanup_negotiate(conn);
+      http_auth_nego_reset(conn, neg_ctx, proxy);
     }
     if(!neg_ctx->context) {
       result = Curl_input_negotiate(data, conn, proxy, "Negotiate");
@@ -167,43 +216,45 @@ CURLcode Curl_output_negotiate(struct Curl_easy *data,
     if(result)
       return result;
 
-    userp = aprintf("%sAuthorization: Negotiate %s\r\n", proxy ? "Proxy-" : "",
-                    base64);
+    userp = curl_maprintf("%sAuthorization: Negotiate %s\r\n",
+                          proxy ? "Proxy-" : "", base64);
 
     if(proxy) {
-      Curl_safefree(data->state.aptr.proxyuserpwd);
-      data->state.aptr.proxyuserpwd = userp;
+#ifndef CURL_DISABLE_PROXY
+      curlx_free(data->req.hd_proxy_auth);
+      data->req.hd_proxy_auth = userp;
+#endif
     }
     else {
-      Curl_safefree(data->state.aptr.userpwd);
-      data->state.aptr.userpwd = userp;
+      curlx_free(data->req.hd_auth);
+      data->req.hd_auth = userp;
     }
 
-    free(base64);
+    curlx_free(base64);
 
     if(!userp) {
       return CURLE_OUT_OF_MEMORY;
     }
 
     *state = GSS_AUTHSENT;
-  #ifdef HAVE_GSSAPI
+#ifdef HAVE_GSSAPI
     if(neg_ctx->status == GSS_S_COMPLETE ||
        neg_ctx->status == GSS_S_CONTINUE_NEEDED) {
       *state = GSS_AUTHDONE;
     }
-  #else
-  #ifdef USE_WINDOWS_SSPI
+#else
+#ifdef USE_WINDOWS_SSPI
     if(neg_ctx->status == SEC_E_OK ||
        neg_ctx->status == SEC_I_CONTINUE_NEEDED) {
       *state = GSS_AUTHDONE;
     }
-  #endif
-  #endif
+#endif
+#endif
   }
 
   if(*state == GSS_AUTHDONE || *state == GSS_AUTHSUCC) {
     /* connection is already authenticated,
-     * don't send a header in future requests */
+     * do not send a header in future requests */
     authp->done = TRUE;
   }
 
@@ -212,13 +263,4 @@ CURLcode Curl_output_negotiate(struct Curl_easy *data,
   return CURLE_OK;
 }
 
-void Curl_http_auth_cleanup_negotiate(struct connectdata *conn)
-{
-  conn->http_negotiate_state = GSS_AUTHNONE;
-  conn->proxy_negotiate_state = GSS_AUTHNONE;
-
-  Curl_auth_cleanup_spnego(&conn->negotiate);
-  Curl_auth_cleanup_spnego(&conn->proxyneg);
-}
-
 #endif /* !CURL_DISABLE_HTTP && USE_SPNEGO */
diff --git a/third-party/curl/lib/http_negotiate.h b/third-party/curl/lib/http_negotiate.h
index 76d8356132..6c285f152f 100644
--- a/third-party/curl/lib/http_negotiate.h
+++ b/third-party/curl/lib/http_negotiate.h
@@ -23,6 +23,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "curl_setup.h"
 
 #if !defined(CURL_DISABLE_HTTP) && defined(USE_SPNEGO)
 
@@ -34,10 +35,6 @@ CURLcode Curl_input_negotiate(struct Curl_easy *data, struct connectdata *conn,
 CURLcode Curl_output_negotiate(struct Curl_easy *data,
                                struct connectdata *conn, bool proxy);
 
-void Curl_http_auth_cleanup_negotiate(struct connectdata *conn);
-
-#else /* !CURL_DISABLE_HTTP && USE_SPNEGO */
-#define Curl_http_auth_cleanup_negotiate(x)
 #endif
 
 #endif /* HEADER_CURL_HTTP_NEGOTIATE_H */
diff --git a/third-party/curl/lib/http_ntlm.c b/third-party/curl/lib/http_ntlm.c
index b845ddf37f..dc9911fdac 100644
--- a/third-party/curl/lib/http_ntlm.c
+++ b/third-party/curl/lib/http_ntlm.c
@@ -21,7 +21,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if !defined(CURL_DISABLE_HTTP) && defined(USE_NTLM)
@@ -33,60 +32,46 @@
  * https://www.innovation.ch/java/ntlm.html
  */
 
-#define DEBUG_ME 0
-
 #include "urldata.h"
-#include "sendf.h"
+#include "curl_trc.h"
 #include "strcase.h"
 #include "http_ntlm.h"
 #include "curl_ntlm_core.h"
-#include "curl_ntlm_wb.h"
-#include "curl_base64.h"
+#include "curlx/base64.h"
 #include "vauth/vauth.h"
 #include "url.h"
+#include "curlx/strparse.h"
 
 /* SSL backend-specific #if branches in this file must be kept in the order
    documented in curl_ntlm_core. */
-#if defined(USE_WINDOWS_SSPI)
+#ifdef USE_WINDOWS_SSPI
 #include "curl_sspi.h"
 #endif
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-#if DEBUG_ME
-# define DEBUG_OUT(x) x
-#else
-# define DEBUG_OUT(x) Curl_nop_stmt
-#endif
-
 CURLcode Curl_input_ntlm(struct Curl_easy *data,
                          bool proxy,         /* if proxy or not */
                          const char *header) /* rest of the www-authenticate:
                                                 header */
 {
   /* point to the correct struct with this */
-  struct ntlmdata *ntlm;
   curlntlm *state;
   CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
 
-  ntlm = proxy ? &conn->proxyntlm : &conn->ntlm;
   state = proxy ? &conn->proxy_ntlm_state : &conn->http_ntlm_state;
 
   if(checkprefix("NTLM", header)) {
+    struct ntlmdata *ntlm = Curl_auth_ntlm_get(conn, proxy);
+    if(!ntlm)
+      return CURLE_OUT_OF_MEMORY;
+
     header += strlen("NTLM");
-
-    while(*header && ISSPACE(*header))
-      header++;
-
+    curlx_str_passblanks(&header);
     if(*header) {
       unsigned char *hdr;
       size_t hdrlen;
 
-      result = Curl_base64_decode(header, &hdr, &hdrlen);
+      result = curlx_base64_decode(header, &hdr, &hdrlen);
       if(!result) {
         struct bufref hdrbuf;
 
@@ -103,11 +88,13 @@ CURLcode Curl_input_ntlm(struct Curl_easy *data,
     else {
       if(*state == NTLMSTATE_LAST) {
         infof(data, "NTLM auth restarted");
-        Curl_http_auth_cleanup_ntlm(conn);
+        Curl_auth_ntlm_remove(conn, proxy);
       }
       else if(*state == NTLMSTATE_TYPE3) {
         infof(data, "NTLM handshake rejected");
-        Curl_http_auth_cleanup_ntlm(conn);
+        Curl_auth_ntlm_remove(conn, proxy);
+        Curl_peer_unlink(&conn->creds_origin);
+        Curl_creds_unlink(&conn->creds);
         *state = NTLMSTATE_NONE;
         return CURLE_REMOTE_ACCESS_DENIED;
       }
@@ -124,7 +111,7 @@ CURLcode Curl_input_ntlm(struct Curl_easy *data,
 }
 
 /*
- * This is for creating ntlm header output
+ * This is for creating NTLM header output
  */
 CURLcode Curl_output_ntlm(struct Curl_easy *data, bool proxy)
 {
@@ -137,10 +124,8 @@ CURLcode Curl_output_ntlm(struct Curl_easy *data, bool proxy)
      server, which is for a plain host or for an HTTP proxy */
   char **allocuserpwd;
 
-  /* point to the username, password, service and host */
-  const char *userp;
-  const char *passwdp;
-  const char *service = NULL;
+  /* point to credentials and host */
+  struct Curl_creds *creds = NULL;
   const char *hostname = NULL;
 
   /* point to the correct struct with this */
@@ -154,13 +139,9 @@ CURLcode Curl_output_ntlm(struct Curl_easy *data, bool proxy)
 
   if(proxy) {
 #ifndef CURL_DISABLE_PROXY
-    allocuserpwd = &data->state.aptr.proxyuserpwd;
-    userp = data->state.aptr.proxyuser;
-    passwdp = data->state.aptr.proxypasswd;
-    service = data->set.str[STRING_PROXY_SERVICE_NAME] ?
-      data->set.str[STRING_PROXY_SERVICE_NAME] : "HTTP";
-    hostname = conn->http_proxy.host.name;
-    ntlm = &conn->proxyntlm;
+    allocuserpwd = &data->req.hd_proxy_auth;
+    creds = conn->http_proxy.creds;
+    hostname = conn->http_proxy.peer->hostname;
     state = &conn->proxy_ntlm_state;
     authp = &data->state.authproxy;
 #else
@@ -168,31 +149,24 @@ CURLcode Curl_output_ntlm(struct Curl_easy *data, bool proxy)
 #endif
   }
   else {
-    allocuserpwd = &data->state.aptr.userpwd;
-    userp = data->state.aptr.user;
-    passwdp = data->state.aptr.passwd;
-    service = data->set.str[STRING_SERVICE_NAME] ?
-      data->set.str[STRING_SERVICE_NAME] : "HTTP";
-    hostname = conn->host.name;
-    ntlm = &conn->ntlm;
+    allocuserpwd = &data->req.hd_auth;
+    creds = data->state.creds;
+    hostname = data->state.origin->hostname;
     state = &conn->http_ntlm_state;
     authp = &data->state.authhost;
   }
+
+  ntlm = Curl_auth_ntlm_get(conn, proxy);
+  if(!ntlm)
+    return CURLE_OUT_OF_MEMORY;
   authp->done = FALSE;
 
-  /* not set means empty */
-  if(!userp)
-    userp = "";
-
-  if(!passwdp)
-    passwdp = "";
-
 #ifdef USE_WINDOWS_SSPI
-  if(!s_hSecDll) {
-    /* not thread safe and leaks - use curl_global_init() to avoid */
-    CURLcode err = Curl_sspi_global_init();
-    if(!s_hSecDll)
-      return err;
+  if(!Curl_pSecFn) {
+    /* not thread-safe and leaks - use curl_global_init() to avoid */
+    result = Curl_sspi_global_init();
+    if(!Curl_pSecFn)
+      return result;
   }
 #ifdef SECPKG_ATTR_ENDPOINT_BINDINGS
   ntlm->sslContext = conn->sslContext;
@@ -201,28 +175,40 @@ CURLcode Curl_output_ntlm(struct Curl_easy *data, bool proxy)
 
   Curl_bufref_init(&ntlmmsg);
 
-  /* connection is already authenticated, don't send a header in future
+  /* connection is already authenticated, do not send a header in future
    * requests so go directly to NTLMSTATE_LAST */
   if(*state == NTLMSTATE_TYPE3)
     *state = NTLMSTATE_LAST;
 
   switch(*state) {
   case NTLMSTATE_TYPE1:
-  default: /* for the weird cases we (re)start here */
-    /* Create a type-1 message */
-    result = Curl_auth_create_ntlm_type1_message(data, userp, passwdp,
-                                                 service, hostname,
-                                                 ntlm, &ntlmmsg);
+  default:  /* for the weird cases we (re)start here */
+    if(!proxy) {
+      /* Start it up. From this time onwards, the connection is tied
+       * tp the credentials used. */
+      if(conn->creds_origin &&
+         !Curl_peer_equal(conn->creds_origin, data->state.origin)) {
+        DEBUGASSERT(0); /* should not happen. */
+        return CURLE_FAILED_INIT;
+      }
+      if(conn->creds && !Curl_creds_same(creds, conn->creds)) {
+        DEBUGASSERT(0); /* should not happen. */
+        return CURLE_FAILED_INIT;
+      }
+      Curl_peer_link(&conn->creds_origin, data->state.origin);
+      Curl_creds_link(&conn->creds, creds);
+    }
+    result = Curl_auth_create_ntlm_type1_message(data, creds, "HTTP",
+                                                 hostname, ntlm, &ntlmmsg);
     if(!result) {
       DEBUGASSERT(Curl_bufref_len(&ntlmmsg) != 0);
-      result = Curl_base64_encode((const char *) Curl_bufref_ptr(&ntlmmsg),
-                                  Curl_bufref_len(&ntlmmsg), &base64, &len);
+      result = curlx_base64_encode(Curl_bufref_uptr(&ntlmmsg),
+                                   Curl_bufref_len(&ntlmmsg), &base64, &len);
       if(!result) {
-        free(*allocuserpwd);
-        *allocuserpwd = aprintf("%sAuthorization: NTLM %s\r\n",
-                                proxy ? "Proxy-" : "",
-                                base64);
-        free(base64);
+        curlx_free(*allocuserpwd);
+        *allocuserpwd = curl_maprintf("%sAuthorization: NTLM %s\r\n",
+                                      proxy ? "Proxy-" : "", base64);
+        curlx_free(base64);
         if(!*allocuserpwd)
           result = CURLE_OUT_OF_MEMORY;
       }
@@ -231,17 +217,15 @@ CURLcode Curl_output_ntlm(struct Curl_easy *data, bool proxy)
 
   case NTLMSTATE_TYPE2:
     /* We already received the type-2 message, create a type-3 message */
-    result = Curl_auth_create_ntlm_type3_message(data, userp, passwdp,
-                                                 ntlm, &ntlmmsg);
+    result = Curl_auth_create_ntlm_type3_message(data, creds, ntlm, &ntlmmsg);
     if(!result && Curl_bufref_len(&ntlmmsg)) {
-      result = Curl_base64_encode((const char *) Curl_bufref_ptr(&ntlmmsg),
-                                  Curl_bufref_len(&ntlmmsg), &base64, &len);
+      result = curlx_base64_encode(Curl_bufref_uptr(&ntlmmsg),
+                                   Curl_bufref_len(&ntlmmsg), &base64, &len);
       if(!result) {
-        free(*allocuserpwd);
-        *allocuserpwd = aprintf("%sAuthorization: NTLM %s\r\n",
-                                proxy ? "Proxy-" : "",
-                                base64);
-        free(base64);
+        curlx_free(*allocuserpwd);
+        *allocuserpwd = curl_maprintf("%sAuthorization: NTLM %s\r\n",
+                                      proxy ? "Proxy-" : "", base64);
+        curlx_free(base64);
         if(!*allocuserpwd)
           result = CURLE_OUT_OF_MEMORY;
         else {
@@ -253,7 +237,13 @@ CURLcode Curl_output_ntlm(struct Curl_easy *data, bool proxy)
     break;
 
   case NTLMSTATE_LAST:
-    Curl_safefree(*allocuserpwd);
+    /* since this is a little artificial in that this is used without any
+       outgoing auth headers being set, we need to set the bit by force */
+    if(proxy)
+      data->info.proxyauthpicked = CURLAUTH_NTLM;
+    else
+      data->info.httpauthpicked = CURLAUTH_NTLM;
+    curlx_safefree(*allocuserpwd);
     authp->done = TRUE;
     break;
   }
@@ -262,14 +252,4 @@ CURLcode Curl_output_ntlm(struct Curl_easy *data, bool proxy)
   return result;
 }
 
-void Curl_http_auth_cleanup_ntlm(struct connectdata *conn)
-{
-  Curl_auth_cleanup_ntlm(&conn->ntlm);
-  Curl_auth_cleanup_ntlm(&conn->proxyntlm);
-
-#if defined(NTLM_WB_ENABLED)
-  Curl_http_auth_cleanup_ntlm_wb(conn);
-#endif
-}
-
 #endif /* !CURL_DISABLE_HTTP && USE_NTLM */
diff --git a/third-party/curl/lib/http_ntlm.h b/third-party/curl/lib/http_ntlm.h
index f37572baec..ff5218d89f 100644
--- a/third-party/curl/lib/http_ntlm.h
+++ b/third-party/curl/lib/http_ntlm.h
@@ -23,22 +23,17 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if !defined(CURL_DISABLE_HTTP) && defined(USE_NTLM)
 
-/* this is for ntlm header input */
+/* this is for NTLM header input */
 CURLcode Curl_input_ntlm(struct Curl_easy *data, bool proxy,
                          const char *header);
 
-/* this is for creating ntlm header output */
+/* this is for creating NTLM header output */
 CURLcode Curl_output_ntlm(struct Curl_easy *data, bool proxy);
 
-void Curl_http_auth_cleanup_ntlm(struct connectdata *conn);
-
-#else /* !CURL_DISABLE_HTTP && USE_NTLM */
-#define Curl_http_auth_cleanup_ntlm(x)
 #endif
 
 #endif /* HEADER_CURL_HTTP_NTLM_H */
diff --git a/third-party/curl/lib/http_proxy.c b/third-party/curl/lib/http_proxy.c
index 60bbfbe580..d019796b53 100644
--- a/third-party/curl/lib/http_proxy.c
+++ b/third-party/curl/lib/http_proxy.c
@@ -21,97 +21,631 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #include "http_proxy.h"
 
 #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_PROXY)
 
-#include <curl/curl.h>
-#ifdef USE_HYPER
-#include <hyper.h>
-#endif
-#include "sendf.h"
+#include "curl_trc.h"
 #include "http.h"
 #include "url.h"
-#include "select.h"
-#include "progress.h"
 #include "cfilters.h"
 #include "cf-h1-proxy.h"
 #include "cf-h2-proxy.h"
 #include "connect.h"
-#include "curlx.h"
-#include "vtls/vtls.h"
-#include "transfer.h"
-#include "multiif.h"
+#include "vauth/vauth.h"
+#include "vquic/vquic.h"
+#include "curlx/strparse.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+static CURLcode dynhds_add_custom(struct Curl_easy *data,
+                                  bool is_connect, int httpversion,
+                                  bool is_udp, struct dynhds *hds)
+{
+  struct connectdata *conn = data->conn;
+  struct curl_slist *h[2];
+  struct curl_slist *headers;
+  int numlists = 1; /* by default */
+  int i;
 
+  enum Curl_proxy_use proxy;
+
+  if(is_connect && !is_udp)
+    proxy = HEADER_CONNECT;
+  else if(is_connect && is_udp)
+    proxy = HEADER_CONNECT_UDP;
+  else
+    proxy = conn->bits.origin_is_proxy ? HEADER_PROXY : HEADER_SERVER;
+
+  switch(proxy) {
+  case HEADER_SERVER:
+    h[0] = data->set.headers;
+    break;
+  case HEADER_PROXY:
+    h[0] = data->set.headers;
+    if(data->set.sep_headers) {
+      h[1] = data->set.proxyheaders;
+      numlists++;
+    }
+    break;
+  case HEADER_CONNECT:
+    if(data->set.sep_headers)
+      h[0] = data->set.proxyheaders;
+    else
+      h[0] = data->set.headers;
+    break;
+  case HEADER_CONNECT_UDP:
+    if(data->set.sep_headers)
+      h[0] = data->set.proxyheaders;
+    else
+      h[0] = data->set.headers;
+    break;
+  }
+
+  /* loop through one or two lists */
+  for(i = 0; i < numlists; i++) {
+    for(headers = h[i]; headers; headers = headers->next) {
+      struct Curl_str name;
+      const char *value = NULL;
+      size_t valuelen = 0;
+      const char *ptr = headers->data;
+
+      /* There are 2 quirks in place for custom headers:
+       * 1. setting only 'name:' to suppress a header from being sent
+       * 2. setting only 'name;' to send an empty (illegal) header
+       */
+      if(!curlx_str_cspn(&ptr, &name, ";:")) {
+        if(!curlx_str_single(&ptr, ':')) {
+          curlx_str_passblanks(&ptr);
+          if(*ptr) {
+            value = ptr;
+            valuelen = strlen(value);
+          }
+          else {
+            /* quirk #1, suppress this header */
+            continue;
+          }
+        }
+        else if(!curlx_str_single(&ptr, ';')) {
+          curlx_str_passblanks(&ptr);
+          if(!*ptr) {
+            /* quirk #2, send an empty header */
+            value = "";
+            valuelen = 0;
+          }
+          else {
+            /* this may be used for something else in the future,
+             * ignore this for now */
+            continue;
+          }
+        }
+        else
+          /* neither : nor ; in provided header value. We ignore this
+           * silently */
+          continue;
+      }
+      else
+        /* no name, move on */
+        continue;
+
+      DEBUGASSERT(curlx_strlen(&name) && value);
+      if(data->state.aptr.host &&
+         /* a Host: header was sent already, do not pass on any custom Host:
+            header as that will produce *two* in the same request! */
+         curlx_str_casecompare(&name, "Host"))
+        ;
+      else if(data->state.httpreq == HTTPREQ_POST_FORM &&
+              /* this header (extended by formdata.c) is sent later */
+              curlx_str_casecompare(&name, "Content-Type"))
+        ;
+      else if(data->state.httpreq == HTTPREQ_POST_MIME &&
+              /* this header is sent later */
+              curlx_str_casecompare(&name, "Content-Type"))
+        ;
+      else if(data->req.authneg &&
+              /* while doing auth neg, do not allow the custom length since
+                 we will force length zero then */
+              curlx_str_casecompare(&name, "Content-Length"))
+        ;
+      else if((httpversion >= 20) &&
+              curlx_str_casecompare(&name, "Transfer-Encoding"))
+        ;
+      /* HTTP/2 and HTTP/3 do not support chunked requests */
+      else if((curlx_str_casecompare(&name, "Authorization") ||
+               curlx_str_casecompare(&name, "Cookie")) &&
+              /* be careful of sending this potentially sensitive header to
+                 other hosts */
+              !Curl_auth_allowed_to_host(data))
+        ;
+      else {
+        CURLcode result =
+          Curl_dynhds_add(hds, curlx_str(&name), curlx_strlen(&name),
+                          value, valuelen);
+        if(result)
+          return result;
+      }
+    }
+  }
+
+  return CURLE_OK;
+}
 
 struct cf_proxy_ctx {
-  /* the protocol specific sub-filter we install during connect */
-  struct Curl_cfilter *cf_protocol;
+  struct Curl_peer *peer; /* proxy */
+  struct Curl_peer *tunnel_peer; /* tunnel destination */
+  uint8_t proxytype;
+  uint8_t tunnel_transport;
+  BIT(sub_filter_installed);
 };
 
+static int proxy_http_ver_major(proxy_http_ver ver)
+{
+  switch(ver) {
+  case PROXY_HTTP_V1:
+    return 11;
+  case PROXY_HTTP_V2:
+    return 20;
+  case PROXY_HTTP_V3:
+    return 30;
+  }
+  return 0;
+}
+
+static CURLcode http_proxy_create_CONNECT(struct httpreq **preq,
+                                          struct Curl_cfilter *cf,
+                                          struct Curl_easy *data,
+                                          struct Curl_peer *dest,
+                                          proxy_http_ver ver)
+{
+  char *authority = NULL;
+  int httpversion = proxy_http_ver_major(ver);
+  CURLcode result;
+  struct httpreq *req = NULL;
+
+  authority = curl_maprintf("%s%s%s:%u",
+                            dest->ipv6 ? "[" : "",
+                            dest->hostname,
+                            dest->ipv6 ? "]" : "",
+                            dest->port);
+  if(!authority) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  result = Curl_http_req_make(&req, "CONNECT", sizeof("CONNECT") - 1,
+                              NULL, 0, authority, strlen(authority),
+                              NULL, 0);
+  if(result)
+    goto out;
+
+  /* Setup the proxy-authorization header, if any */
+  result = Curl_http_output_auth(data, cf->conn, req->method, HTTPREQ_GET,
+                                 req->authority, NULL, TRUE);
+  if(result)
+    goto out;
+
+  /* If user is not overriding Host: header, we add for HTTP/1.x */
+  if(ver == PROXY_HTTP_V1 &&
+     !Curl_checkProxyheaders(data, cf->conn, STRCONST("Host"))) {
+    result = Curl_dynhds_cadd(&req->headers, "Host", authority);
+    if(result)
+      goto out;
+  }
+
+  if(data->req.hd_proxy_auth) {
+    result = Curl_dynhds_h1_cadd_line(&req->headers,
+                                      data->req.hd_proxy_auth);
+    if(result)
+      goto out;
+  }
+
+  if(!Curl_checkProxyheaders(data, cf->conn, STRCONST("User-Agent")) &&
+     data->set.str[STRING_USERAGENT] && *data->set.str[STRING_USERAGENT]) {
+    result = Curl_dynhds_cadd(&req->headers, "User-Agent",
+                              data->set.str[STRING_USERAGENT]);
+    if(result)
+      goto out;
+  }
+
+  if(ver == PROXY_HTTP_V1 &&
+     !Curl_checkProxyheaders(data, cf->conn, STRCONST("Proxy-Connection"))) {
+    result = Curl_dynhds_cadd(&req->headers, "Proxy-Connection", "Keep-Alive");
+    if(result)
+      goto out;
+  }
+
+  result = dynhds_add_custom(data, TRUE, httpversion,
+                             FALSE, &req->headers);
+
+out:
+  if(result && req) {
+    Curl_http_req_free(req);
+    req = NULL;
+  }
+  curlx_free(authority);
+  *preq = req;
+  return result;
+}
+
+static CURLcode http_proxy_create_CONNECTUDP(struct httpreq **preq,
+                                             struct Curl_cfilter *cf,
+                                             struct Curl_easy *data,
+                                             struct Curl_peer *dest,
+                                             proxy_http_ver ver)
+{
+  const char *proxy_scheme = "http";
+  const char *proxy_host = cf->conn->http_proxy.peer->hostname;
+  int httpversion = proxy_http_ver_major(ver);
+  char *authority = NULL;
+  char *path = NULL;
+  char *encoded_host = NULL;
+  struct httpreq *req = NULL;
+  bool proxy_ipv6_ip;
+  CURLcode result;
+
+  if(cf->conn->http_proxy.proxytype == CURLPROXY_HTTPS ||
+     cf->conn->http_proxy.proxytype == CURLPROXY_HTTPS2 ||
+     cf->conn->http_proxy.proxytype == CURLPROXY_HTTPS3)
+    proxy_scheme = "https";
+
+  proxy_ipv6_ip = cf->conn->http_proxy.peer->ipv6 != 0;
+
+  authority = curl_maprintf("%s%s%s:%d",
+                            proxy_ipv6_ip ? "[" : "",
+                            proxy_host,
+                            proxy_ipv6_ip ? "]" : "",
+                            cf->conn->http_proxy.peer->port);
+  if(!authority) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  if(dest->ipv6) {
+    /* RFC 9298: colons in IPv6 addresses MUST be percent-encoded
+     * in the URI template (e.g. "2001:db8::1" -> "2001%3Adb8%3A%3A1") */
+    const char *s = dest->hostname;
+    char *d;
+    size_t hlen = strlen(s);
+    encoded_host = curlx_malloc(hlen * 3 + 1);
+    if(!encoded_host) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+    d = encoded_host;
+    while(*s) {
+      if(*s == ':') {
+        *d++ = '%';
+        *d++ = '3';
+        *d++ = 'A';
+      }
+      else
+        *d++ = *s;
+      s++;
+    }
+    *d = '\0';
+    path = curl_maprintf("/.well-known/masque/udp/%s/%u/",
+                         encoded_host, (unsigned int)dest->port);
+  }
+  else {
+    path = curl_maprintf("/.well-known/masque/udp/%s/%u/",
+                         dest->hostname, (unsigned int)dest->port);
+  }
+
+  if(!path) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  if(ver == PROXY_HTTP_V1) {
+    result = Curl_http_req_make(&req, "GET", sizeof("GET")-1,
+                                proxy_scheme, strlen(proxy_scheme),
+                                authority, strlen(authority),
+                                path, strlen(path));
+    if(result)
+      goto out;
+  }
+  else if(ver == PROXY_HTTP_V2 || ver == PROXY_HTTP_V3) {
+    result = Curl_http_req_make(&req, "CONNECT", sizeof("CONNECT") - 1,
+                                proxy_scheme, strlen(proxy_scheme),
+                                authority, strlen(authority),
+                                path, strlen(path));
+    if(result)
+      goto out;
+  }
+  else {
+    result = CURLE_FAILED_INIT;
+    goto out;
+  }
+
+  /* Setup the proxy-authorization header, if any */
+  result = Curl_http_output_auth(data, cf->conn, req->method, HTTPREQ_GET,
+                                 req->authority, NULL, TRUE);
+  if(result)
+    goto out;
+
+  /* If user is not overriding Host: header, we add for HTTP/1.x */
+  if(ver == PROXY_HTTP_V1 &&
+     !Curl_checkProxyheaders(data, cf->conn, STRCONST("Host"))) {
+    result = Curl_dynhds_cadd(&req->headers, "Host", authority);
+    if(result)
+      goto out;
+  }
+
+  if(data->req.hd_proxy_auth) {
+    result = Curl_dynhds_h1_cadd_line(&req->headers,
+                                      data->req.hd_proxy_auth);
+    if(result)
+      goto out;
+  }
+
+  if(ver == PROXY_HTTP_V1 &&
+     !Curl_checkProxyheaders(data, cf->conn, STRCONST("User-Agent")) &&
+     data->set.str[STRING_USERAGENT] && *data->set.str[STRING_USERAGENT]) {
+    result = Curl_dynhds_cadd(&req->headers, "User-Agent",
+                              data->set.str[STRING_USERAGENT]);
+    if(result)
+      goto out;
+  }
+
+  if(ver == PROXY_HTTP_V1 &&
+     !Curl_checkProxyheaders(data, cf->conn, STRCONST("Proxy-Connection"))) {
+    result = Curl_dynhds_cadd(&req->headers, "Proxy-Connection", "Keep-Alive");
+    if(result)
+      goto out;
+  }
+
+  if(ver == PROXY_HTTP_V1) {
+    result = Curl_dynhds_cadd(&req->headers, "Connection", "Upgrade");
+    if(result)
+      goto out;
+
+    result = Curl_dynhds_cadd(&req->headers, "Upgrade", "connect-udp");
+    if(result)
+      goto out;
+
+    result = Curl_dynhds_cadd(&req->headers, "Capsule-Protocol", "?1");
+    if(result)
+      goto out;
+  }
+  else {
+    result = Curl_dynhds_cadd(&req->headers, ":Protocol", "connect-udp");
+    if(result)
+      goto out;
+
+    if(ver >= PROXY_HTTP_V2) {
+      result = Curl_dynhds_cadd(&req->headers, "Capsule-Protocol", "?1");
+      if(result)
+        goto out;
+    }
+  }
+
+  result = dynhds_add_custom(data, TRUE, httpversion,
+                             TRUE, &req->headers);
+
+out:
+  if(result && req) {
+    Curl_http_req_free(req);
+    req = NULL;
+  }
+  curlx_free(authority);
+  curlx_free(path);
+  curlx_free(encoded_host);
+  *preq = req;
+  return result;
+}
+
+CURLcode Curl_http_proxy_create_tunnel_request(
+    struct httpreq **preq, struct Curl_cfilter *cf,
+    struct Curl_easy *data, struct Curl_peer *dest,
+    proxy_http_ver ver, bool udp_tunnel)
+{
+  CURLcode result;
+
+  if(udp_tunnel)
+    result = http_proxy_create_CONNECTUDP(preq, cf, data, dest, ver);
+  else
+    result = http_proxy_create_CONNECT(preq, cf, data, dest, ver);
+  if(result)
+    return result;
+
+  if(udp_tunnel)
+    infof(data, "Establishing %s proxy UDP tunnel to %s:%s",
+          (ver == PROXY_HTTP_V2) ? "HTTP/2" :
+          (ver == PROXY_HTTP_V3) ? "HTTP/3" : "HTTP",
+          data->state.up.hostname, data->state.up.port);
+  else
+    infof(data, "Establishing %s proxy tunnel to %s",
+          (ver == PROXY_HTTP_V2) ? "HTTP/2" :
+          (ver == PROXY_HTTP_V3) ? "HTTP/3" : "HTTP",
+          (*preq)->authority);
+  return CURLE_OK;
+}
+
+CURLcode Curl_http_proxy_inspect_tunnel_response(
+    struct Curl_cfilter *cf, struct Curl_easy *data,
+    struct http_resp *resp, bool udp_tunnel,
+    proxy_inspect_result *presult)
+{
+  struct dynhds_entry *capsule_protocol = NULL;
+  struct dynhds_entry *auth_reply = NULL;
+  size_t i, header_count;
+  CURLcode result = CURLE_OK;
+
+  DEBUGASSERT(resp);
+
+  header_count = Curl_dynhds_count(&resp->headers);
+  if(udp_tunnel)
+    infof(data, "CONNECT-UDP Response Status %d", resp->status);
+  else
+    infof(data, "CONNECT Response Status %d", resp->status);
+  infof(data, "Response Headers (%zu total):", header_count);
+  for(i = 0; i < header_count; i++) {
+    struct dynhds_entry *entry = Curl_dynhds_getn(&resp->headers, i);
+    if(entry)
+      infof(data, "  %s: %s", entry->name, entry->value);
+  }
+
+  if(resp->status == 401) {
+    auth_reply = Curl_dynhds_cget(&resp->headers, "WWW-Authenticate");
+  }
+  else if(resp->status == 407) {
+    auth_reply = Curl_dynhds_cget(&resp->headers, "Proxy-Authenticate");
+  }
+
+  if(auth_reply) {
+    CURL_TRC_CF(data, cf, "[0] CONNECT%s: fwd auth header '%s'",
+                udp_tunnel ? "-UDP" : "", auth_reply->value);
+    result = Curl_http_input_auth(data, resp->status == 407,
+                                  auth_reply->value);
+    if(result)
+      return result;
+    if(data->req.newurl) {
+      curlx_safefree(data->req.newurl);
+      *presult = PROXY_INSPECT_AUTH_RETRY;
+      return CURLE_OK;
+    }
+  }
+
+  if(udp_tunnel) {
+    if(resp->status / 100 == 2) {
+      capsule_protocol = Curl_dynhds_cget(&resp->headers,
+                                           "capsule-protocol");
+      if(capsule_protocol) {
+        if(!strncmp(capsule_protocol->value, "?1", 2) &&
+           !capsule_protocol->value[2]) {
+          infof(data, "CONNECT-UDP tunnel established, response %d",
+                resp->status);
+          *presult = PROXY_INSPECT_OK;
+          return CURLE_OK;
+        }
+        failf(data, "Failed to establish CONNECT-UDP tunnel, response %d, "
+              "unsupported capsule-protocol value '%s'",
+              resp->status, capsule_protocol->value);
+        *presult = PROXY_INSPECT_FAILED;
+        return CURLE_COULDNT_CONNECT;
+      }
+      else {
+        /* NOTE proxies may not set capsule protocol in the headers */
+        infof(data, "CONNECT-UDP tunnel established, response %d "
+                    "but no capsule-protocol header found", resp->status);
+        *presult = PROXY_INSPECT_OK;
+        return CURLE_OK;
+      }
+    }
+    else {
+      failf(data, "Failed to establish CONNECT-UDP tunnel, "
+                  "response %d", resp->status);
+      *presult = PROXY_INSPECT_FAILED;
+      return CURLE_COULDNT_CONNECT;
+    }
+  }
+
+  if(resp->status / 100 == 2) {
+    infof(data, "CONNECT tunnel established, response %d", resp->status);
+    *presult = PROXY_INSPECT_OK;
+    return CURLE_OK;
+  }
+
+  *presult = PROXY_INSPECT_FAILED;
+  return CURLE_COULDNT_CONNECT;
+}
+
 static CURLcode http_proxy_cf_connect(struct Curl_cfilter *cf,
                                       struct Curl_easy *data,
-                                      bool blocking, bool *done)
+                                      bool *done)
 {
   struct cf_proxy_ctx *ctx = cf->ctx;
   CURLcode result;
+  bool udp_tunnel = TRNSPRT_IS_DGRAM(ctx->tunnel_transport);
+  const char *tunnel_type = udp_tunnel ? "CONNECT-UDP" : "CONNECT";
 
   if(cf->connected) {
     *done = TRUE;
     return CURLE_OK;
   }
 
-  CURL_TRC_CF(data, cf, "connect");
+  CURL_TRC_CF(data, cf, "%s", tunnel_type);
 connect_sub:
-  result = cf->next->cft->do_connect(cf->next, data, blocking, done);
-  if(result || !*done)
-    return result;
+  /* in case of h3_proxy, cf->next will be NULL initially */
+  if(cf->next) {
+    result = cf->next->cft->do_connect(cf->next, data, done);
+    if(result || !*done)
+      return result;
+  }
 
   *done = FALSE;
-  if(!ctx->cf_protocol) {
-    struct Curl_cfilter *cf_protocol = NULL;
-    int alpn = Curl_conn_cf_is_ssl(cf->next)?
-      cf->conn->proxy_alpn : CURL_HTTP_VERSION_1_1;
+  if(!ctx->sub_filter_installed) {
+    const char *alpn = NULL;
 
-    /* First time call after the subchain connected */
-    switch(alpn) {
-    case CURL_HTTP_VERSION_NONE:
-    case CURL_HTTP_VERSION_1_0:
-    case CURL_HTTP_VERSION_1_1:
-      CURL_TRC_CF(data, cf, "installing subfilter for HTTP/1.1");
-      infof(data, "CONNECT tunnel: HTTP/1.%d negotiated",
-            (alpn == CURL_HTTP_VERSION_1_0)? 0 : 1);
-      result = Curl_cf_h1_proxy_insert_after(cf, data);
+    /* in case of h3_proxy, cf->next will be NULL initially */
+    if(cf->next) {
+      alpn = Curl_conn_cf_get_alpn_negotiated(cf->next, data);
+    }
+
+    if(alpn)
+      infof(data, "%s: '%s' negotiated", tunnel_type, alpn);
+    else if(!alpn) {
+      /* No ALPN, proxytype rules. Fake ALPN */
+      infof(data, "%s: no ALPN negotiated", tunnel_type);
+      switch(ctx->proxytype) {
+      case CURLPROXY_HTTP_1_0:
+        alpn = "http/1.0";
+        break;
+      case CURLPROXY_HTTPS2:
+        alpn = "h2";
+        break;
+      case CURLPROXY_HTTPS3:
+        alpn = "h3";
+        break;
+      default:
+        alpn = "http/1.1";
+        break;
+      }
+    }
+
+    if(!strcmp(alpn, "http/1.0")) {
+      CURL_TRC_CF(data, cf, "installing subfilter for HTTP/1.0");
+      result = Curl_cf_h1_proxy_insert_after(cf, data, ctx->tunnel_peer, 10,
+                                             udp_tunnel);
       if(result)
         goto out;
-      cf_protocol = cf->next;
-      break;
+    }
+    else if(!strcmp(alpn, "http/1.1")) {
+      int httpversion = (ctx->proxytype == CURLPROXY_HTTP_1_0) ? 10 : 11;
+      CURL_TRC_CF(data, cf, "installing subfilter for HTTP/1.%d",
+                  httpversion % 10);
+      result = Curl_cf_h1_proxy_insert_after(cf, data, ctx->tunnel_peer,
+                                             httpversion, udp_tunnel);
+      if(result)
+        goto out;
+    }
 #ifdef USE_NGHTTP2
-    case CURL_HTTP_VERSION_2:
+    else if(!strcmp(alpn, "h2")) {
       CURL_TRC_CF(data, cf, "installing subfilter for HTTP/2");
-      infof(data, "CONNECT tunnel: HTTP/2 negotiated");
-      result = Curl_cf_h2_proxy_insert_after(cf, data);
+      result = Curl_cf_h2_proxy_insert_after(cf, data, ctx->tunnel_peer,
+                                             udp_tunnel);
       if(result)
         goto out;
-      cf_protocol = cf->next;
-      break;
-#endif
-    default:
-      CURL_TRC_CF(data, cf, "installing subfilter for default HTTP/1.1");
-      infof(data, "CONNECT tunnel: unsupported ALPN(%d) negotiated", alpn);
+    }
+#endif /* USE_NGHTTP2 */
+#if defined(USE_PROXY_HTTP3) && defined(USE_NGHTTP3) && \
+  defined(USE_NGTCP2) && defined(USE_OPENSSL)
+    else if(!strcmp(alpn, "h3")) {
+      CURL_TRC_CF(data, cf, "installing subfilter for HTTP/3");
+      result = Curl_cf_h3_proxy_insert_after(cf, data, ctx->peer, ctx->peer,
+                                             ctx->tunnel_peer,
+                                             ctx->tunnel_transport);
+      if(result)
+        goto out;
+    }
+#endif /* USE_PROXY_HTTP3 && USE_NGHTTP3 && USE_NGTCP2 && USE_OPENSSL */
+    else {
+      failf(data, "%s: negotiated ALPN '%s' not supported", tunnel_type, alpn);
       result = CURLE_COULDNT_CONNECT;
       goto out;
     }
 
-    ctx->cf_protocol = cf_protocol;
+    ctx->sub_filter_installed = TRUE;
     /* after we installed the filter "below" us, we call connect
      * on out sub-chain again.
      */
@@ -119,9 +653,8 @@ connect_sub:
   }
   else {
     /* subchain connected and we had already installed the protocol filter.
-     * This means the protocol tunnel is established, we are done.
-     */
-    DEBUGASSERT(ctx->cf_protocol);
+     * This means the protocol tunnel is established, we are done. */
+    DEBUGASSERT(ctx->sub_filter_installed);
     result = CURLE_OK;
   }
 
@@ -133,20 +666,36 @@ out:
   return result;
 }
 
-void Curl_cf_http_proxy_get_host(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data,
-                                 const char **phost,
-                                 const char **pdisplay_host,
-                                 int *pport)
+static CURLcode cf_http_proxy_query(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    int query, int *pres1, void *pres2)
 {
-  (void)data;
-  if(!cf->connected) {
-    *phost = cf->conn->http_proxy.host.name;
-    *pdisplay_host = cf->conn->http_proxy.host.dispname;
-    *pport = (int)cf->conn->http_proxy.port;
+  struct cf_proxy_ctx *ctx = cf->ctx;
+  switch(query) {
+  case CF_QUERY_HOST_PORT:
+    *pres1 = (int)ctx->tunnel_peer->port;
+    *((const char **)pres2) = ctx->tunnel_peer->hostname;
+    return CURLE_OK;
+  case CF_QUERY_ALPN_NEGOTIATED: {
+    const char **palpn = pres2;
+    DEBUGASSERT(palpn);
+    *palpn = NULL;
+    return CURLE_OK;
   }
-  else {
-    cf->next->cft->get_host(cf->next, data, phost, pdisplay_host, pport);
+  default:
+    break;
+  }
+  return cf->next ?
+    cf->next->cft->query(cf->next, data, query, pres1, pres2) :
+    CURLE_UNKNOWN_OPTION;
+}
+
+static void cf_https_proxy_ctx_free(struct cf_proxy_ctx *ctx)
+{
+  if(ctx) {
+    Curl_peer_unlink(&ctx->peer);
+    Curl_peer_unlink(&ctx->tunnel_peer);
+    curlx_free(ctx);
   }
 }
 
@@ -154,68 +703,54 @@ static void http_proxy_cf_destroy(struct Curl_cfilter *cf,
                                   struct Curl_easy *data)
 {
   struct cf_proxy_ctx *ctx = cf->ctx;
-
-  (void)data;
-  CURL_TRC_CF(data, cf, "destroy");
-  free(ctx);
-}
-
-static void http_proxy_cf_close(struct Curl_cfilter *cf,
-                                struct Curl_easy *data)
-{
-  struct cf_proxy_ctx *ctx = cf->ctx;
-
-  CURL_TRC_CF(data, cf, "close");
-  cf->connected = FALSE;
-  if(ctx->cf_protocol) {
-    struct Curl_cfilter *f;
-    /* if someone already removed it, we assume he also
-     * took care of destroying it. */
-    for(f = cf->next; f; f = f->next) {
-      if(f == ctx->cf_protocol) {
-        /* still in our sub-chain */
-        Curl_conn_cf_discard_sub(cf, ctx->cf_protocol, data, FALSE);
-        break;
-      }
-    }
-    ctx->cf_protocol = NULL;
+  if(ctx) {
+    CURL_TRC_CF(data, cf, "destroy");
+    cf_https_proxy_ctx_free(ctx);
   }
-  if(cf->next)
-    cf->next->cft->do_close(cf->next, data);
 }
 
-
 struct Curl_cftype Curl_cft_http_proxy = {
   "HTTP-PROXY",
-  CF_TYPE_IP_CONNECT,
+  CF_TYPE_IP_CONNECT | CF_TYPE_PROXY | CF_TYPE_SETUP,
   0,
   http_proxy_cf_destroy,
   http_proxy_cf_connect,
-  http_proxy_cf_close,
-  Curl_cf_http_proxy_get_host,
-  Curl_cf_def_get_select_socks,
+  Curl_cf_def_shutdown,
+  Curl_cf_def_adjust_pollset,
   Curl_cf_def_data_pending,
   Curl_cf_def_send,
   Curl_cf_def_recv,
   Curl_cf_def_cntrl,
   Curl_cf_def_conn_is_alive,
   Curl_cf_def_conn_keep_alive,
-  Curl_cf_def_query,
+  cf_http_proxy_query,
 };
 
 CURLcode Curl_cf_http_proxy_insert_after(struct Curl_cfilter *cf_at,
-                                         struct Curl_easy *data)
+                                         struct Curl_easy *data,
+                                         struct Curl_peer *peer,
+                                         struct Curl_peer *tunnel_peer,
+                                         uint8_t tunnel_transport,
+                                         uint8_t proxytype)
 {
   struct Curl_cfilter *cf;
   struct cf_proxy_ctx *ctx = NULL;
   CURLcode result;
 
   (void)data;
-  ctx = calloc(1, sizeof(*ctx));
+  if(!peer || !tunnel_peer)
+    return CURLE_FAILED_INIT;
+
+  ctx = curlx_calloc(1, sizeof(*ctx));
   if(!ctx) {
     result = CURLE_OUT_OF_MEMORY;
     goto out;
   }
+  Curl_peer_link(&ctx->peer, peer);
+  Curl_peer_link(&ctx->tunnel_peer, tunnel_peer);
+  ctx->proxytype = proxytype;
+  ctx->tunnel_transport = tunnel_transport;
+
   result = Curl_cf_create(&cf, &Curl_cft_http_proxy, ctx);
   if(result)
     goto out;
@@ -223,8 +758,18 @@ CURLcode Curl_cf_http_proxy_insert_after(struct Curl_cfilter *cf_at,
   Curl_conn_cf_insert_after(cf_at, cf);
 
 out:
-  free(ctx);
+  cf_https_proxy_ctx_free(ctx);
   return result;
 }
 
-#endif /* ! CURL_DISABLE_HTTP && !CURL_DISABLE_PROXY */
+uint8_t Curl_http_proxy_transport(uint8_t proxytype)
+{
+  switch(proxytype) {
+  case CURLPROXY_HTTPS3:
+    return TRNSPRT_QUIC;
+  default:
+    return TRNSPRT_TCP;
+  }
+}
+
+#endif /* !CURL_DISABLE_HTTP && !CURL_DISABLE_PROXY */
diff --git a/third-party/curl/lib/http_proxy.h b/third-party/curl/lib/http_proxy.h
index a1a03720bd..86c9088093 100644
--- a/third-party/curl/lib/http_proxy.h
+++ b/third-party/curl/lib/http_proxy.h
@@ -23,30 +23,60 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if !defined(CURL_DISABLE_PROXY) && !defined(CURL_DISABLE_HTTP)
 
 #include "urldata.h"
 
-/* Default proxy timeout in milliseconds */
-#define PROXY_TIMEOUT (3600*1000)
+enum Curl_proxy_use {
+  HEADER_SERVER,  /* direct to server */
+  HEADER_PROXY,   /* regular request to proxy */
+  HEADER_CONNECT, /* sending CONNECT to a proxy */
+  HEADER_CONNECT_UDP /* sending CONNECT-UDP to a proxy */
+};
 
-void Curl_cf_http_proxy_get_host(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data,
-                                 const char **phost,
-                                 const char **pdisplay_host,
-                                 int *pport);
+/* HTTP version for proxy tunnel request creation */
+typedef enum {
+  PROXY_HTTP_V1 = 1,
+  PROXY_HTTP_V2 = 2,
+  PROXY_HTTP_V3 = 3
+} proxy_http_ver;
+
+/* Result from inspecting a proxy tunnel response */
+typedef enum {
+  PROXY_INSPECT_OK,         /* Tunnel established */
+  PROXY_INSPECT_FAILED,     /* Tunnel failed */
+  PROXY_INSPECT_AUTH_RETRY  /* Retry with auth */
+} proxy_inspect_result;
+
+/* Create CONNECT or CONNECT-UDP request */
+CURLcode Curl_http_proxy_create_tunnel_request(
+    struct httpreq **preq, struct Curl_cfilter *cf,
+    struct Curl_easy *data, struct Curl_peer *dest,
+    proxy_http_ver ver, bool udp_tunnel);
+
+/* Inspect tunnel response for H2/H3 proxy (capsule-protocol, auth) */
+struct http_resp;
+CURLcode Curl_http_proxy_inspect_tunnel_response(
+    struct Curl_cfilter *cf, struct Curl_easy *data,
+    struct http_resp *resp, bool udp_tunnel,
+    proxy_inspect_result *presult);
+
+/* Default proxy timeout in milliseconds */
+#define PROXY_TIMEOUT (3600 * 1000)
 
 CURLcode Curl_cf_http_proxy_insert_after(struct Curl_cfilter *cf_at,
-                                         struct Curl_easy *data);
+                                         struct Curl_easy *data,
+                                         struct Curl_peer *peer,
+                                         struct Curl_peer *tunnel_peer,
+                                         uint8_t tunnel_transport,
+                                         uint8_t proxytype);
 
 extern struct Curl_cftype Curl_cft_http_proxy;
 
-#endif /* !CURL_DISABLE_PROXY  && !CURL_DISABLE_HTTP */
+uint8_t Curl_http_proxy_transport(uint8_t proxytype);
 
-#define IS_HTTPS_PROXY(t) (((t) == CURLPROXY_HTTPS) ||  \
-                           ((t) == CURLPROXY_HTTPS2))
+#endif /* !CURL_DISABLE_PROXY && !CURL_DISABLE_HTTP */
 
 #endif /* HEADER_CURL_HTTP_PROXY_H */
diff --git a/third-party/curl/lib/httpsrr.c b/third-party/curl/lib/httpsrr.c
new file mode 100644
index 0000000000..53647b81ed
--- /dev/null
+++ b/third-party/curl/lib/httpsrr.c
@@ -0,0 +1,311 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef USE_HTTPSRR
+
+#include "urldata.h"
+#include "httpsrr.h"
+#include "connect.h"
+#include "curl_trc.h"
+#include "curlx/strdup.h"
+#include "curlx/inet_ntop.h"
+
+static CURLcode httpsrr_decode_alpn(const uint8_t *cp, size_t len,
+                                    unsigned char *alpns)
+{
+  /*
+   * The wire-format value for "alpn" consists of at least one alpn-id
+   * prefixed by its length as a single octet, and these length-value pairs
+   * are concatenated to form the SvcParamValue. These pairs MUST exactly fill
+   * the SvcParamValue; otherwise, the SvcParamValue is malformed.
+   */
+  int idnum = 0;
+
+  while(len > 0) {
+    size_t tlen = *cp++;
+    enum alpnid id;
+    len--;
+    if(tlen > len)
+      return CURLE_BAD_CONTENT_ENCODING;
+
+    /* we only store ALPN ids we know about */
+    id = Curl_alpn2alpnid(cp, tlen);
+    if(id != ALPN_none) {
+      if(idnum == MAX_HTTPSRR_ALPNS)
+        break;
+      if(idnum && memchr(alpns, id, idnum))
+        /* this ALPN id is already stored */
+        ;
+      else
+        alpns[idnum++] = (unsigned char)id;
+    }
+    cp += tlen;
+    len -= tlen;
+  }
+  if(idnum < MAX_HTTPSRR_ALPNS)
+    alpns[idnum] = ALPN_none; /* terminate the list */
+  return CURLE_OK;
+}
+
+#ifdef CURLVERBOSE
+
+static CURLcode httpsrr_print_addr(struct dynbuf *dyn,
+                                   int ai_family,
+                                   const uint8_t *addr,
+                                   size_t total_len)
+{
+  char buf[MAX_IPADR_LEN];
+  size_t i, alen = (ai_family == AF_INET6) ? 16 : 4;
+  const char *sep = "";
+  CURLcode result = CURLE_OK;
+
+  for(i = 0; (i < (total_len / alen)) && !result; ++i) {
+    if(!curlx_inet_ntop(ai_family, addr + (i * alen), buf, sizeof(buf)))
+      result = curlx_dyn_add(dyn, "<error parsing address>");
+    else
+      result = curlx_dyn_addf(dyn, "%s%s", sep, buf);
+    sep = ",";
+  }
+  return result;
+}
+
+void Curl_httpsrr_trace(struct Curl_easy *data,
+                        struct Curl_https_rrinfo *rr)
+{
+  struct dynbuf tmp;
+  CURLcode result;
+
+  if(!rr || !rr->complete) {
+    CURL_TRC_DNS(data, "[HTTPS-RR] not available");
+    return;
+  }
+  curlx_dyn_init(&tmp, 1024);
+  result = Curl_httpsrr_print(&tmp, rr);
+  if(!result)
+    CURL_TRC_DNS(data, "HTTPS-RR: %s", curlx_dyn_ptr(&tmp));
+  else
+    CURL_TRC_DNS(data, "Error printing HTTPS-RR information");
+  curlx_dyn_free(&tmp);
+}
+
+CURLcode Curl_httpsrr_print(struct dynbuf *tmp,
+                            struct Curl_https_rrinfo *rr)
+{
+  CURLcode result;
+  int i;
+
+  curlx_dyn_reset(tmp);
+  result = curlx_dyn_addf(tmp, "%u %s", rr->priority,
+                          rr->target ? rr->target : ".");
+  if(!result && rr->mandatory)
+    result = curlx_dyn_add(tmp, " mandatory-keys(ignored)");
+  if(!result && rr->alpns[0]) {
+    const char *sep = "", *name;
+    result = curlx_dyn_add(tmp, " alpn=");
+    for(i = 0; !result && (i < 4); ++i) {
+      switch(rr->alpns[i]) {
+      case ALPN_h1:
+        name = "http/1.1";
+        break;
+      case ALPN_h2:
+        name = "h2";
+        break;
+      case ALPN_h3:
+        name = "h3";
+        break;
+      default:
+        name = NULL;
+      }
+      if(name) {
+        result = curlx_dyn_addf(tmp, "%s%s", sep, name);
+        sep = ",";
+      }
+    }
+  }
+  if(!result && rr->port_set) {
+    result = curlx_dyn_addf(tmp, " port=%u", rr->port);
+  }
+  if(!result && rr->no_def_alpn)
+    result = curlx_dyn_add(tmp, " no-default-alpn");
+  if(!result && rr->ipv6hints_len) {
+    result = curlx_dyn_add(tmp, " ipv6hint=");
+    if(!result)
+      result = httpsrr_print_addr(
+        tmp, AF_INET6, rr->ipv6hints, rr->ipv6hints_len);
+  }
+  if(!result && rr->ipv4hints_len) {
+    result = curlx_dyn_add(tmp, " ipv4hint=");
+    if(!result)
+      result = httpsrr_print_addr(
+        tmp, AF_INET, rr->ipv4hints, rr->ipv4hints_len);
+  }
+  if(!result && rr->echconfiglist_len)
+    result = curlx_dyn_addf(tmp, " ech=<%zu bytes>", rr->echconfiglist_len);
+
+  return result;
+}
+
+#endif /* CURLVERBOSE */
+
+CURLcode Curl_httpsrr_set(struct Curl_https_rrinfo *rr,
+                          uint16_t rrkey, const uint8_t *val, size_t vlen)
+{
+  CURLcode result = CURLE_OK;
+  switch(rrkey) {
+  case HTTPS_RR_CODE_MANDATORY:
+    rr->mandatory = TRUE;
+    break;
+  case HTTPS_RR_CODE_ALPN: /* str_list */
+    result = httpsrr_decode_alpn(val, vlen, rr->alpns);
+    break;
+  case HTTPS_RR_CODE_NO_DEF_ALPN:
+    if(vlen) /* no data */
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    rr->no_def_alpn = TRUE;
+    break;
+  case HTTPS_RR_CODE_IPV4: /* addr4 list */
+    if(!vlen || (vlen & 3)) /* the size must be 4-byte aligned */
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    curlx_free(rr->ipv4hints);
+    rr->ipv4hints = curlx_memdup(val, vlen);
+    if(!rr->ipv4hints)
+      return CURLE_OUT_OF_MEMORY;
+    rr->ipv4hints_len = vlen;
+    break;
+  case HTTPS_RR_CODE_ECH:
+    if(!vlen)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    curlx_free(rr->echconfiglist);
+    rr->echconfiglist = curlx_memdup(val, vlen);
+    if(!rr->echconfiglist)
+      return CURLE_OUT_OF_MEMORY;
+    rr->echconfiglist_len = vlen;
+    break;
+  case HTTPS_RR_CODE_IPV6: /* addr6 list */
+    if(!vlen || (vlen & 15)) /* the size must be 16-byte aligned */
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    curlx_free(rr->ipv6hints);
+    rr->ipv6hints = curlx_memdup(val, vlen);
+    if(!rr->ipv6hints)
+      return CURLE_OUT_OF_MEMORY;
+    rr->ipv6hints_len = vlen;
+    break;
+  case HTTPS_RR_CODE_PORT:
+    if(vlen != 2)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    rr->port = (uint16_t)((val[0] << 8) | val[1]);
+    rr->port_set = TRUE;
+    break;
+  default:
+    /* unknown code */
+    break;
+  }
+  return result;
+}
+
+struct Curl_https_rrinfo *Curl_httpsrr_dup_move(
+  struct Curl_https_rrinfo *rrinfo)
+{
+  struct Curl_https_rrinfo *dup = curlx_memdup(rrinfo, sizeof(*rrinfo));
+  if(dup)
+    memset(rrinfo, 0, sizeof(*rrinfo));
+  return dup;
+}
+
+void Curl_httpsrr_cleanup(struct Curl_https_rrinfo *rrinfo)
+{
+  curlx_safefree(rrinfo->target);
+  curlx_safefree(rrinfo->echconfiglist);
+  curlx_safefree(rrinfo->ipv4hints);
+  curlx_safefree(rrinfo->ipv6hints);
+  curlx_safefree(rrinfo->rrname);
+  rrinfo->complete = FALSE;
+}
+
+bool Curl_httpsrr_applicable(struct Curl_easy *data,
+                             const struct Curl_https_rrinfo *rr)
+{
+  if(!data->conn || !rr)
+    return FALSE;
+  return (!rr->target || !rr->target[0] ||
+          (rr->target[0] == '.' && !rr->target[1])) &&
+         (!rr->port_set || rr->port == data->conn->origin->port);
+}
+
+#ifdef USE_ARES
+
+static CURLcode httpsrr_opt(const ares_dns_rr_t *rr,
+                            ares_dns_rr_key_t key, size_t idx,
+                            struct Curl_https_rrinfo *hinfo)
+{
+  const unsigned char *val = NULL;
+  unsigned short code;
+  size_t len = 0;
+
+  code = ares_dns_rr_get_opt(rr, key, idx, &val, &len);
+  return Curl_httpsrr_set(hinfo, code, val, len);
+}
+
+CURLcode Curl_httpsrr_from_ares(const ares_dns_record_t *dnsrec,
+                                struct Curl_https_rrinfo *hinfo)
+{
+  CURLcode result = CURLE_OK;
+  size_t i;
+
+  for(i = 0; i < ares_dns_record_rr_cnt(dnsrec, ARES_SECTION_ANSWER); i++) {
+    const char *target;
+    size_t opt;
+    const ares_dns_rr_t *rr =
+      ares_dns_record_rr_get_const(dnsrec, ARES_SECTION_ANSWER, i);
+    if(ares_dns_rr_get_type(rr) != ARES_REC_TYPE_HTTPS)
+      continue;
+    /* When SvcPriority is 0, the SVCB record is in AliasMode. Otherwise, it
+       is in ServiceMode */
+    target = ares_dns_rr_get_str(rr, ARES_RR_HTTPS_TARGET);
+    if(target && target[0]) {
+      curlx_free(hinfo->target);
+      hinfo->target = curlx_strdup(target);
+      if(!hinfo->target) {
+        result = CURLE_OUT_OF_MEMORY;
+        goto out;
+      }
+    }
+    hinfo->priority = ares_dns_rr_get_u16(rr, ARES_RR_HTTPS_PRIORITY);
+    for(opt = 0; opt < ares_dns_rr_get_opt_cnt(rr, ARES_RR_HTTPS_PARAMS);
+        opt++) {
+      result = httpsrr_opt(rr, ARES_RR_HTTPS_PARAMS, opt, hinfo);
+      if(result)
+        break;
+    }
+  }
+out:
+  hinfo->complete = !result;
+  curlx_safefree(hinfo->rrname);
+  return result;
+}
+
+#endif /* USE_ARES */
+
+#endif /* USE_HTTPSRR */
diff --git a/third-party/curl/lib/httpsrr.h b/third-party/curl/lib/httpsrr.h
new file mode 100644
index 0000000000..2ee1beab3e
--- /dev/null
+++ b/third-party/curl/lib/httpsrr.h
@@ -0,0 +1,102 @@
+#ifndef HEADER_CURL_HTTPSRR_H
+#define HEADER_CURL_HTTPSRR_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef USE_ARES
+#include <ares.h>
+#endif
+
+#ifdef USE_HTTPSRR
+
+#define CURL_MAXLEN_HOST_NAME 253
+#define MAX_HTTPSRR_ALPNS     4
+
+struct Curl_easy;
+struct dynbuf;
+
+struct Curl_https_rrinfo {
+  char *rrname; /* if NULL, the same as the URL hostname */
+  /*
+   * Fields from HTTPS RR. The only mandatory fields are priority and target.
+   * See https://datatracker.ietf.org/doc/html/rfc9460#section-14.3.2
+   */
+  char *target;
+  unsigned char *ipv4hints; /* keytag = 4 */
+  size_t ipv4hints_len;
+  unsigned char *echconfiglist; /* keytag = 5 */
+  size_t echconfiglist_len;
+  unsigned char *ipv6hints; /* keytag = 6 */
+  size_t ipv6hints_len;
+  unsigned char alpns[MAX_HTTPSRR_ALPNS]; /* keytag = 1 */
+  /* store parsed alpnid entries in the array, end with ALPN_none */
+  uint16_t port;
+  uint16_t priority;
+  BIT(no_def_alpn); /* keytag = 2 */
+  BIT(mandatory); /* keytag = 0 */
+  BIT(port_set); /* port value has been assigned */
+  BIT(complete); /* values have been successfully assigned */
+};
+
+CURLcode Curl_httpsrr_set(struct Curl_https_rrinfo *rr,
+                          uint16_t rrkey, const uint8_t *val, size_t vlen);
+
+struct Curl_https_rrinfo *Curl_httpsrr_dup_move(
+  struct Curl_https_rrinfo *rrinfo);
+
+void Curl_httpsrr_cleanup(struct Curl_https_rrinfo *rrinfo);
+
+/* TRUE if the record is applicable to the transfer and its connection. */
+bool Curl_httpsrr_applicable(struct Curl_easy *data,
+                             const struct Curl_https_rrinfo *rr);
+
+/*
+ * Code points for DNS wire format SvcParams as per RFC 9460
+ */
+#define HTTPS_RR_CODE_MANDATORY       0x00
+#define HTTPS_RR_CODE_ALPN            0x01
+#define HTTPS_RR_CODE_NO_DEF_ALPN     0x02
+#define HTTPS_RR_CODE_PORT            0x03
+#define HTTPS_RR_CODE_IPV4            0x04
+#define HTTPS_RR_CODE_ECH             0x05
+#define HTTPS_RR_CODE_IPV6            0x06
+
+#ifdef USE_ARES
+CURLcode Curl_httpsrr_from_ares(const ares_dns_record_t *dnsrec,
+                                struct Curl_https_rrinfo *hinfo);
+#endif /* USE_ARES */
+
+#ifdef CURLVERBOSE
+CURLcode Curl_httpsrr_print(struct dynbuf *tmp,
+                            struct Curl_https_rrinfo *rr);
+void Curl_httpsrr_trace(struct Curl_easy *data,
+                        struct Curl_https_rrinfo *rr);
+#else
+#define Curl_httpsrr_trace(a, b) Curl_nop_stmt
+#endif
+
+#endif /* USE_HTTPSRR */
+
+#endif /* HEADER_CURL_HTTPSRR_H */
diff --git a/third-party/curl/lib/idn.c b/third-party/curl/lib/idn.c
index 1f31a9546c..b26f251d97 100644
--- a/third-party/curl/lib/idn.c
+++ b/third-party/curl/lib/idn.c
@@ -21,105 +21,198 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
- /*
-  * IDN conversions
-  */
-
+/*
+ * IDN conversions
+ */
 #include "curl_setup.h"
+
 #include "urldata.h"
+#include "curlx/strparse.h"
 #include "idn.h"
-#include "sendf.h"
-#include "curl_multibyte.h"
-#include "warnless.h"
 
 #ifdef USE_LIBIDN2
 #include <idn2.h>
 
-#if defined(WIN32) && defined(UNICODE)
-#define IDN2_LOOKUP(name, host, flags)                                  \
+#if defined(_WIN32) && defined(UNICODE)
+#define IDN2_LOOKUP(name, host, flags)                           \
   idn2_lookup_u8((const uint8_t *)name, (uint8_t **)host, flags)
 #else
-#define IDN2_LOOKUP(name, host, flags)                          \
-  idn2_lookup_ul((const char *)name, (char **)host, flags)
+#define IDN2_LOOKUP(name, host, flags)                         \
+  idn2_lookup_ul((const char *)(name), (char **)(host), flags)
 #endif
-#endif  /* USE_LIBIDN2 */
+#endif /* USE_LIBIDN2 */
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+/* for macOS and iOS targets */
+#ifdef USE_APPLE_IDN
+#include <unicode/uidna.h>
+#include <iconv.h>
+#include <langinfo.h>
+
+#define MAX_HOST_LENGTH 512
+
+static CURLcode iconv_to_utf8(const char *in, size_t inlen,
+                              char **out, size_t *outlen)
+{
+  iconv_t cd = iconv_open("UTF-8", nl_langinfo(CODESET));
+  if(cd != (iconv_t)-1) {
+    size_t iconv_outlen = *outlen;
+    char *iconv_in = (char *)CURL_UNCONST(in);
+    size_t iconv_inlen = inlen;
+    size_t iconv_result = iconv(cd, &iconv_in, &iconv_inlen,
+                                out, &iconv_outlen);
+    *outlen -= iconv_outlen;
+    iconv_close(cd);
+    if(iconv_result == (size_t)-1) {
+      /* !checksrc! disable ERRNOVAR 1 */
+      if(errno == ENOMEM)
+        return CURLE_OUT_OF_MEMORY;
+      else
+        return CURLE_URL_MALFORMAT;
+    }
+
+    return CURLE_OK;
+  }
+  else {
+    /* !checksrc! disable ERRNOVAR 1 */
+    if(errno == ENOMEM)
+      return CURLE_OUT_OF_MEMORY;
+    else
+      return CURLE_FAILED_INIT;
+  }
+}
+
+static CURLcode mac_idn_to_ascii(const char *in, char **out)
+{
+  size_t inlen = strlen(in);
+  if(inlen < MAX_HOST_LENGTH) {
+    char iconv_buffer[MAX_HOST_LENGTH] = { 0 };
+    char *iconv_outptr = iconv_buffer;
+    size_t iconv_outlen = sizeof(iconv_buffer);
+    CURLcode iconv_result = iconv_to_utf8(in, inlen,
+                                          &iconv_outptr, &iconv_outlen);
+    if(!iconv_result) {
+      UErrorCode err = U_ZERO_ERROR;
+      UIDNA *idna = uidna_openUTS46(
+        UIDNA_CHECK_BIDI | UIDNA_NONTRANSITIONAL_TO_ASCII, &err);
+      if(!U_FAILURE(err)) {
+        UIDNAInfo info = UIDNA_INFO_INITIALIZER;
+        char buffer[MAX_HOST_LENGTH] = { 0 };
+        (void)uidna_nameToASCII_UTF8(idna, iconv_buffer, (int)iconv_outlen,
+                                     buffer, sizeof(buffer) - 1, &info, &err);
+        uidna_close(idna);
+        if(!U_FAILURE(err) && !info.errors) {
+          *out = curlx_strdup(buffer);
+          if(*out)
+            return CURLE_OK;
+          else
+            return CURLE_OUT_OF_MEMORY;
+        }
+      }
+    }
+    else
+      return iconv_result;
+  }
+  return CURLE_URL_MALFORMAT;
+}
+
+static CURLcode mac_ascii_to_idn(const char *in, char **out)
+{
+  size_t inlen = strlen(in);
+  if(inlen < MAX_HOST_LENGTH) {
+    UErrorCode err = U_ZERO_ERROR;
+    UIDNA *idna = uidna_openUTS46(
+      UIDNA_CHECK_BIDI | UIDNA_NONTRANSITIONAL_TO_UNICODE, &err);
+    if(!U_FAILURE(err)) {
+      UIDNAInfo info = UIDNA_INFO_INITIALIZER;
+      char buffer[MAX_HOST_LENGTH] = { 0 };
+      (void)uidna_nameToUnicodeUTF8(idna, in, -1, buffer,
+                                    sizeof(buffer) - 1, &info, &err);
+      uidna_close(idna);
+      if(!U_FAILURE(err)) {
+        *out = curlx_strdup(buffer);
+        if(*out)
+          return CURLE_OK;
+        else
+          return CURLE_OUT_OF_MEMORY;
+      }
+    }
+  }
+  return CURLE_URL_MALFORMAT;
+}
+#endif
 
 #ifdef USE_WIN32_IDN
 /* using Windows kernel32 and normaliz libraries. */
 
-#if !defined(_WIN32_WINNT) || _WIN32_WINNT < 0x600
-WINBASEAPI int WINAPI IdnToAscii(DWORD dwFlags,
-                                 const WCHAR *lpUnicodeCharStr,
-                                 int cchUnicodeChar,
-                                 WCHAR *lpASCIICharStr,
-                                 int cchASCIIChar);
-WINBASEAPI int WINAPI IdnToUnicode(DWORD dwFlags,
-                                   const WCHAR *lpASCIICharStr,
-                                   int cchASCIIChar,
-                                   WCHAR *lpUnicodeCharStr,
-                                   int cchUnicodeChar);
-#endif
-
 #define IDN_MAX_LENGTH 255
 
+static char *idn_curlx_convert_wchar_to_UTF8(const wchar_t *str_w, int chars)
+{
+  char *str_utf8 = NULL;
+  int bytes = WideCharToMultiByte(CP_UTF8, 0, str_w, chars, NULL, 0,
+                                  NULL, NULL);
+  if(bytes > 0) {
+    str_utf8 = curlx_malloc(bytes);
+    if(str_utf8) {
+      if(WideCharToMultiByte(CP_UTF8, 0, str_w, chars, str_utf8, bytes,
+                             NULL, NULL) == 0) {
+        curlx_free(str_utf8);
+        return NULL;
+      }
+    }
+  }
+  return str_utf8;
+}
+
 static CURLcode win32_idn_to_ascii(const char *in, char **out)
 {
-  wchar_t *in_w = curlx_convert_UTF8_to_wchar(in);
+  wchar_t in_w[IDN_MAX_LENGTH];
+  int in_w_len;
   *out = NULL;
-  if(in_w) {
+  /* Returned in_w_len includes the null-terminator, which then gets
+     preserved across the calls that follow, ending up terminating
+     the buffer returned to the caller. */
+  in_w_len = MultiByteToWideChar(CP_UTF8, 0, in, -1, in_w, IDN_MAX_LENGTH);
+  if(in_w_len) {
     wchar_t punycode[IDN_MAX_LENGTH];
-    int chars = IdnToAscii(0, in_w, (int)(wcslen(in_w) + 1), punycode,
-                           IDN_MAX_LENGTH);
-    curlx_unicodefree(in_w);
-    if(chars) {
-      char *mstr = curlx_convert_wchar_to_UTF8(punycode);
-      if(mstr) {
-        *out = strdup(mstr);
-        curlx_unicodefree(mstr);
-        if(!*out)
-          return CURLE_OUT_OF_MEMORY;
-      }
-      else
+    int chars = IdnToAscii(0, in_w, in_w_len, punycode, IDN_MAX_LENGTH);
+    if(chars > 0) {
+      *out = idn_curlx_convert_wchar_to_UTF8(punycode, chars);
+      if(!*out)
         return CURLE_OUT_OF_MEMORY;
     }
     else
       return CURLE_URL_MALFORMAT;
   }
-
-  return CURLE_OK;
-}
-
-static CURLcode win32_ascii_to_idn(const char *in, char **output)
-{
-  char *out = NULL;
-
-  wchar_t *in_w = curlx_convert_UTF8_to_wchar(in);
-  if(in_w) {
-    WCHAR idn[IDN_MAX_LENGTH]; /* stores a UTF-16 string */
-    int chars = IdnToUnicode(0, in_w, (int)(wcslen(in_w) + 1), idn,
-                             IDN_MAX_LENGTH);
-    if(chars) {
-      /* 'chars' is "the number of characters retrieved" */
-      char *mstr = curlx_convert_wchar_to_UTF8(idn);
-      if(mstr) {
-        out = strdup(mstr);
-        curlx_unicodefree(mstr);
-        if(!out)
-          return CURLE_OUT_OF_MEMORY;
-      }
-    }
-    else
-      return CURLE_URL_MALFORMAT;
-  }
   else
     return CURLE_URL_MALFORMAT;
-  *output = out;
+
+  return CURLE_OK;
+}
+
+static CURLcode win32_ascii_to_idn(const char *in, char **out)
+{
+  wchar_t in_w[IDN_MAX_LENGTH];
+  int in_w_len;
+  *out = NULL;
+  /* Returned in_w_len includes the null-terminator, which then gets
+     preserved across the calls that follow, ending up terminating
+     the buffer returned to the caller. */
+  in_w_len = MultiByteToWideChar(CP_UTF8, 0, in, -1, in_w, IDN_MAX_LENGTH);
+  if(in_w_len) {
+    WCHAR idn[IDN_MAX_LENGTH]; /* stores a UTF-16 string */
+    int chars = IdnToUnicode(0, in_w, in_w_len, idn, IDN_MAX_LENGTH);
+    if(chars > 0) {  /* 'chars' is "the number of characters retrieved" */
+      *out = idn_curlx_convert_wchar_to_UTF8(idn, chars);
+      if(!*out)
+        return CURLE_OUT_OF_MEMORY;
+    }
+    else
+      return CURLE_URL_MALFORMAT;
+  }
+  else
+    return CURLE_URL_MALFORMAT;
+
   return CURLE_OK;
 }
 
@@ -130,15 +223,24 @@ static CURLcode win32_ascii_to_idn(const char *in, char **output)
  */
 bool Curl_is_ASCII_name(const char *hostname)
 {
-  /* get an UNSIGNED local version of the pointer */
-  const unsigned char *ch = (const unsigned char *)hostname;
+  if(hostname) {
+    struct Curl_str s;
+    s.str = hostname;
+    s.len = strlen(hostname);
+    return Curl_is_ASCII_str(&s);
+  }
+  return TRUE;
+}
 
-  if(!hostname) /* bad input, consider it ASCII! */
-    return TRUE;
-
-  while(*ch) {
-    if(*ch++ & 0x80)
-      return FALSE;
+bool Curl_is_ASCII_str(struct Curl_str *s)
+{
+  if(s && s->len) {
+    const unsigned char *ch = (const unsigned char *)s->str;
+    size_t i;
+    for(i = 0; i < s->len; ++i) {
+      if(ch[i] & 0x80)
+        return FALSE;
+    }
   }
   return TRUE;
 }
@@ -148,7 +250,7 @@ bool Curl_is_ASCII_name(const char *hostname)
  * Curl_idn_decode() returns an allocated IDN decoded string if it was
  * possible. NULL on error.
  *
- * CURLE_URL_MALFORMAT - the host name could not be converted
+ * CURLE_URL_MALFORMAT - the hostname could not be converted
  * CURLE_OUT_OF_MEMORY - memory problem
  *
  */
@@ -174,8 +276,13 @@ static CURLcode idn_decode(const char *input, char **output)
     if(rc != IDN2_OK)
       result = CURLE_URL_MALFORMAT;
   }
+  else
+    /* a too old libidn2 version */
+    result = CURLE_NOT_BUILT_IN;
 #elif defined(USE_WIN32_IDN)
   result = win32_idn_to_ascii(input, &decoded);
+#elif defined(USE_APPLE_IDN)
+  result = mac_idn_to_ascii(input, &decoded);
 #endif
   if(!result)
     *output = decoded;
@@ -193,6 +300,10 @@ static CURLcode idn_encode(const char *puny, char **output)
   CURLcode result = win32_ascii_to_idn(puny, &enc);
   if(result)
     return result;
+#elif defined(USE_APPLE_IDN)
+  CURLcode result = mac_ascii_to_idn(puny, &enc);
+  if(result)
+    return result;
 #endif
   *output = enc;
   return CURLE_OK;
@@ -204,7 +315,7 @@ CURLcode Curl_idn_decode(const char *input, char **output)
   CURLcode result = idn_decode(input, &d);
 #ifdef USE_LIBIDN2
   if(!result) {
-    char *c = strdup(d);
+    char *c = curlx_strdup(d);
     idn2_free(d);
     if(c)
       d = c;
@@ -212,8 +323,14 @@ CURLcode Curl_idn_decode(const char *input, char **output)
       result = CURLE_OUT_OF_MEMORY;
   }
 #endif
-  if(!result)
-    *output = d;
+  if(!result) {
+    if(!d[0]) { /* ended up zero length, not acceptable */
+      result = CURLE_URL_MALFORMAT;
+      curlx_free(d);
+    }
+    else
+      *output = d;
+  }
   return result;
 }
 
@@ -223,7 +340,7 @@ CURLcode Curl_idn_encode(const char *puny, char **output)
   CURLcode result = idn_encode(puny, &d);
 #ifdef USE_LIBIDN2
   if(!result) {
-    char *c = strdup(d);
+    char *c = curlx_strdup(d);
     idn2_free(d);
     if(c)
       d = c;
@@ -241,11 +358,7 @@ CURLcode Curl_idn_encode(const char *puny, char **output)
  */
 void Curl_free_idnconverted_hostname(struct hostname *host)
 {
-  if(host->encalloc) {
-    /* must be freed with idn2_free() if allocated by libidn */
-    Curl_idn_free(host->encalloc);
-    host->encalloc = NULL;
-  }
+  curlx_safefree(host->encalloc);
 }
 
 #endif /* USE_IDN */
@@ -255,27 +368,18 @@ void Curl_free_idnconverted_hostname(struct hostname *host)
  */
 CURLcode Curl_idnconvert_hostname(struct hostname *host)
 {
-  /* set the name we use to display the host name */
+  /* set the name we use to display the hostname */
   host->dispname = host->name;
 
 #ifdef USE_IDN
   /* Check name for non-ASCII and convert hostname if we can */
   if(!Curl_is_ASCII_name(host->name)) {
     char *decoded;
-    CURLcode result = idn_decode(host->name, &decoded);
-    if(!result) {
-      if(!*decoded) {
-        /* zero length is a bad host name */
-        Curl_idn_free(decoded);
-        return CURLE_URL_MALFORMAT;
-      }
-      /* successful */
-      host->encalloc = decoded;
-      /* change the name pointer to point to the encoded hostname */
-      host->name = host->encalloc;
-    }
-    else
+    CURLcode result = Curl_idn_decode(host->name, &decoded);
+    if(result)
       return result;
+    /* successful */
+    host->name = host->encalloc = decoded;
   }
 #endif
   return CURLE_OK;
diff --git a/third-party/curl/lib/idn.h b/third-party/curl/lib/idn.h
index 74bbcaf498..c73b870a70 100644
--- a/third-party/curl/lib/idn.h
+++ b/third-party/curl/lib/idn.h
@@ -24,21 +24,22 @@
  *
  ***************************************************************************/
 
+struct Curl_str;
+struct hostname;
+
 bool Curl_is_ASCII_name(const char *hostname);
+bool Curl_is_ASCII_str(struct Curl_str *s);
+
 CURLcode Curl_idnconvert_hostname(struct hostname *host);
-#if defined(USE_LIBIDN2) || defined(USE_WIN32_IDN)
+
+#if defined(USE_LIBIDN2) || defined(USE_WIN32_IDN) || defined(USE_APPLE_IDN)
 #define USE_IDN
 void Curl_free_idnconverted_hostname(struct hostname *host);
 CURLcode Curl_idn_decode(const char *input, char **output);
-CURLcode Curl_idn_encode(const char *input, char **output);
-#ifdef USE_LIBIDN2
-#define Curl_idn_free(x) idn2_free(x)
-#else
-#define Curl_idn_free(x) free(x)
-#endif
-
+CURLcode Curl_idn_encode(const char *puny, char **output);
 #else
 #define Curl_free_idnconverted_hostname(x)
 #define Curl_idn_decode(x) NULL
 #endif
+
 #endif /* HEADER_CURL_IDN_H */
diff --git a/third-party/curl/lib/if2ip.c b/third-party/curl/lib/if2ip.c
index 5249f6cc7e..fd34f204b5 100644
--- a/third-party/curl/lib/if2ip.c
+++ b/third-party/curl/lib/if2ip.c
@@ -21,7 +21,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef HAVE_NETINET_IN_H
@@ -52,24 +51,20 @@
 #  include <inet.h>
 #endif
 
-#include "inet_ntop.h"
-#include "strcase.h"
+#include "curlx/inet_ntop.h"
 #include "if2ip.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
 
 /* ------------------------------------------------------------------ */
 
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
 /* Return the scope of the given address. */
 unsigned int Curl_ipv6_scope(const struct sockaddr *sa)
 {
   if(sa->sa_family == AF_INET6) {
-    const struct sockaddr_in6 * sa6 = (const struct sockaddr_in6 *)(void *) sa;
+    const struct sockaddr_in6 *sa6 =
+      (const struct sockaddr_in6 *)(const void *)sa;
     const unsigned char *b = sa6->sin6_addr.s6_addr;
-    unsigned short w = (unsigned short) ((b[0] << 8) | b[1]);
+    unsigned short w = (unsigned short)((b[0] << 8) | b[1]);
 
     if((b[0] & 0xFE) == 0xFC) /* Handle ULAs */
       return IPV6_SCOPE_UNIQUELOCAL;
@@ -92,36 +87,35 @@ unsigned int Curl_ipv6_scope(const struct sockaddr *sa)
 }
 #endif
 
-#ifndef CURL_DISABLE_BINDLOCAL
+#if !defined(CURL_DISABLE_BINDLOCAL) || !defined(CURL_DISABLE_FTP)
 
-#if defined(HAVE_GETIFADDRS)
+#ifdef HAVE_GETIFADDRS
 
 if2ip_result_t Curl_if2ip(int af,
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
                           unsigned int remote_scope,
                           unsigned int local_scope_id,
 #endif
                           const char *interf,
-                          char *buf, int buf_size)
+                          char *buf, size_t buf_size)
 {
   struct ifaddrs *iface, *head;
   if2ip_result_t res = IF2IP_NOT_FOUND;
 
-#if defined(ENABLE_IPV6) && \
-    !defined(HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID)
-  (void) local_scope_id;
+#if defined(USE_IPV6) && !defined(HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID)
+  (void)local_scope_id;
 #endif
 
   if(getifaddrs(&head) >= 0) {
-    for(iface = head; iface != NULL; iface = iface->ifa_next) {
+    for(iface = head; iface; iface = iface->ifa_next) {
       if(iface->ifa_addr) {
         if(iface->ifa_addr->sa_family == af) {
-          if(strcasecompare(iface->ifa_name, interf)) {
+          if(curl_strequal(iface->ifa_name, interf)) {
             void *addr;
             const char *ip;
             char scope[12] = "";
             char ipstr[64];
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
             if(af == AF_INET6) {
 #ifdef HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID
               unsigned int scopeid = 0;
@@ -142,7 +136,7 @@ if2ip_result_t Curl_if2ip(int af,
 #ifdef HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID
               /* Include the scope of this interface as part of the address */
               scopeid = ((struct sockaddr_in6 *)(void *)iface->ifa_addr)
-                            ->sin6_scope_id;
+                          ->sin6_scope_id;
 
               /* If given, scope id should match. */
               if(local_scope_id && scopeid != local_scope_id) {
@@ -153,7 +147,7 @@ if2ip_result_t Curl_if2ip(int af,
               }
 
               if(scopeid)
-                msnprintf(scope, sizeof(scope), "%%%u", scopeid);
+                curl_msnprintf(scope, sizeof(scope), "%%%u", scopeid);
 #endif
             }
             else
@@ -161,13 +155,13 @@ if2ip_result_t Curl_if2ip(int af,
               addr =
                 &((struct sockaddr_in *)(void *)iface->ifa_addr)->sin_addr;
             res = IF2IP_FOUND;
-            ip = Curl_inet_ntop(af, addr, ipstr, sizeof(ipstr));
-            msnprintf(buf, buf_size, "%s%s", ip, scope);
+            ip = curlx_inet_ntop(af, addr, ipstr, sizeof(ipstr));
+            curl_msnprintf(buf, buf_size, "%s%s", ip, scope);
             break;
           }
         }
         else if((res == IF2IP_NOT_FOUND) &&
-                strcasecompare(iface->ifa_name, interf)) {
+                curl_strequal(iface->ifa_name, interf)) {
           res = IF2IP_AF_NOT_SUPPORTED;
         }
       }
@@ -182,12 +176,12 @@ if2ip_result_t Curl_if2ip(int af,
 #elif defined(HAVE_IOCTL_SIOCGIFADDR)
 
 if2ip_result_t Curl_if2ip(int af,
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
                           unsigned int remote_scope,
                           unsigned int local_scope_id,
 #endif
                           const char *interf,
-                          char *buf, int buf_size)
+                          char *buf, size_t buf_size)
 {
   struct ifreq req;
   struct in_addr in;
@@ -196,7 +190,7 @@ if2ip_result_t Curl_if2ip(int af,
   size_t len;
   const char *r;
 
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
   (void)remote_scope;
   (void)local_scope_id;
 #endif
@@ -208,15 +202,23 @@ if2ip_result_t Curl_if2ip(int af,
   if(len >= sizeof(req.ifr_name))
     return IF2IP_NOT_FOUND;
 
-  dummy = socket(AF_INET, SOCK_STREAM, 0);
-  if(CURL_SOCKET_BAD == dummy)
+  dummy = CURL_SOCKET(AF_INET, SOCK_STREAM, 0);
+  if(dummy == CURL_SOCKET_BAD)
     return IF2IP_NOT_FOUND;
 
   memset(&req, 0, sizeof(req));
   memcpy(req.ifr_name, interf, len + 1);
   req.ifr_addr.sa_family = AF_INET;
 
+#if defined(CURL_HAVE_DIAG) && defined(_AIX)
+/* Suppress warning inside system headers */
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wshift-sign-overflow"
+#endif
   if(ioctl(dummy, SIOCGIFADDR, &req) < 0) {
+#if defined(CURL_HAVE_DIAG) && defined(_AIX)
+#pragma GCC diagnostic pop
+#endif
     sclose(dummy);
     /* With SIOCGIFADDR, we cannot tell the difference between an interface
        that does not exist and an interface that has no address of the
@@ -226,7 +228,7 @@ if2ip_result_t Curl_if2ip(int af,
 
   s = (struct sockaddr_in *)(void *)&req.ifr_addr;
   memcpy(&in, &s->sin_addr, sizeof(in));
-  r = Curl_inet_ntop(s->sin_family, &in, buf, buf_size);
+  r = curlx_inet_ntop(s->sin_family, &in, buf, buf_size);
 
   sclose(dummy);
   if(!r)
@@ -237,24 +239,24 @@ if2ip_result_t Curl_if2ip(int af,
 #else
 
 if2ip_result_t Curl_if2ip(int af,
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
                           unsigned int remote_scope,
                           unsigned int local_scope_id,
 #endif
                           const char *interf,
-                          char *buf, int buf_size)
+                          char *buf, size_t buf_size)
 {
-    (void) af;
-#ifdef ENABLE_IPV6
-    (void) remote_scope;
-    (void) local_scope_id;
+  (void)af;
+#ifdef USE_IPV6
+  (void)remote_scope;
+  (void)local_scope_id;
 #endif
-    (void) interf;
-    (void) buf;
-    (void) buf_size;
-    return IF2IP_NOT_FOUND;
+  (void)interf;
+  (void)buf;
+  (void)buf_size;
+  return IF2IP_NOT_FOUND;
 }
 
 #endif
 
-#endif /* CURL_DISABLE_BINDLOCAL */
+#endif /* CURL_DISABLE_BINDLOCAL && CURL_DISABLE_FTP */
diff --git a/third-party/curl/lib/if2ip.h b/third-party/curl/lib/if2ip.h
index 1f973505c0..dc79c383b7 100644
--- a/third-party/curl/lib/if2ip.h
+++ b/third-party/curl/lib/if2ip.h
@@ -32,7 +32,7 @@
 #define IPV6_SCOPE_UNIQUELOCAL  3       /* Unique local */
 #define IPV6_SCOPE_NODELOCAL    4       /* Loopback. */
 
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
 unsigned int Curl_ipv6_scope(const struct sockaddr *sa);
 #else
 #define Curl_ipv6_scope(x) 0
@@ -45,45 +45,44 @@ typedef enum {
 } if2ip_result_t;
 
 if2ip_result_t Curl_if2ip(int af,
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
                           unsigned int remote_scope,
                           unsigned int local_scope_id,
 #endif
                           const char *interf,
-                          char *buf, int buf_size);
+                          char *buf, size_t buf_size);
 
 #ifdef __INTERIX
 
-/* Nedelcho Stanev's work-around for SFU 3.0 */
+/* Nedelcho Stanev's workaround for SFU 3.0 */
 struct ifreq {
-#define IFNAMSIZ 16
+#define IFNAMSIZ    16
 #define IFHWADDRLEN 6
   union {
     char ifrn_name[IFNAMSIZ]; /* if name, e.g. "en0" */
   } ifr_ifrn;
 
- union {
-   struct sockaddr ifru_addr;
-   struct sockaddr ifru_broadaddr;
-   struct sockaddr ifru_netmask;
-   struct sockaddr ifru_hwaddr;
-   short ifru_flags;
-   int ifru_metric;
-   int ifru_mtu;
- } ifr_ifru;
+  union {
+    struct sockaddr ifru_addr;
+    struct sockaddr ifru_broadaddr;
+    struct sockaddr ifru_netmask;
+    struct sockaddr ifru_hwaddr;
+    short ifru_flags;
+    int ifru_metric;
+    int ifru_mtu;
+  } ifr_ifru;
 };
 
-/* This define was added by Daniel to avoid an extra #ifdef INTERIX in the
-   C code. */
+/* This define exists to avoid an extra #ifdef INTERIX in the C code. */
 
-#define ifr_name ifr_ifrn.ifrn_name /* interface name */
-#define ifr_addr ifr_ifru.ifru_addr /* address */
+#define ifr_name      ifr_ifrn.ifrn_name /* interface name */
+#define ifr_addr      ifr_ifru.ifru_addr /* address */
 #define ifr_broadaddr ifr_ifru.ifru_broadaddr /* broadcast address */
-#define ifr_netmask ifr_ifru.ifru_netmask /* interface net mask */
-#define ifr_flags ifr_ifru.ifru_flags /* flags */
-#define ifr_hwaddr ifr_ifru.ifru_hwaddr /* MAC address */
-#define ifr_metric ifr_ifru.ifru_metric /* metric */
-#define ifr_mtu ifr_ifru.ifru_mtu /* mtu */
+#define ifr_netmask   ifr_ifru.ifru_netmask /* interface net mask */
+#define ifr_flags     ifr_ifru.ifru_flags /* flags */
+#define ifr_hwaddr    ifr_ifru.ifru_hwaddr /* MAC address */
+#define ifr_metric    ifr_ifru.ifru_metric /* metric */
+#define ifr_mtu       ifr_ifru.ifru_mtu /* mtu */
 
 #define SIOCGIFADDR _IOW('s', 102, struct ifreq) /* Get if addr */
 
diff --git a/third-party/curl/lib/imap.c b/third-party/curl/lib/imap.c
index de64c2a7f2..976c9f573e 100644
--- a/third-party/curl/lib/imap.c
+++ b/third-party/curl/lib/imap.c
@@ -34,8 +34,9 @@
  * Draft   LOGIN SASL Mechanism <draft-murchison-sasl-login-00.txt>
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+#include "urldata.h"
+#include "imap.h"
 
 #ifndef CURL_DISABLE_IMAP
 
@@ -53,153 +54,215 @@
 #include <inet.h>
 #endif
 
-#include <curl/curl.h>
-#include "urldata.h"
+#include "curlx/dynbuf.h"
 #include "sendf.h"
+#include "curl_trc.h"
 #include "hostip.h"
 #include "progress.h"
 #include "transfer.h"
 #include "escape.h"
-#include "http.h" /* for HTTP proxy tunnel stuff */
-#include "socks.h"
-#include "imap.h"
+#include "pingpong.h"
 #include "mime.h"
-#include "strtoofft.h"
+#include "curlx/strparse.h"
 #include "strcase.h"
 #include "vtls/vtls.h"
 #include "cfilters.h"
 #include "connect.h"
 #include "select.h"
-#include "multiif.h"
 #include "url.h"
 #include "bufref.h"
 #include "curl_sasl.h"
-#include "warnless.h"
-#include "curl_ctype.h"
+#include "curlx/strcopy.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+/* meta key for storing protocol meta at easy handle */
+#define CURL_META_IMAP_EASY   "meta:proto:imap:easy"
+/* meta key for storing protocol meta at connection */
+#define CURL_META_IMAP_CONN   "meta:proto:imap:conn"
 
-/* Local API functions */
-static CURLcode imap_regular_transfer(struct Curl_easy *data, bool *done);
-static CURLcode imap_do(struct Curl_easy *data, bool *done);
-static CURLcode imap_done(struct Curl_easy *data, CURLcode status,
-                          bool premature);
-static CURLcode imap_connect(struct Curl_easy *data, bool *done);
-static CURLcode imap_disconnect(struct Curl_easy *data,
-                                struct connectdata *conn, bool dead);
-static CURLcode imap_multi_statemach(struct Curl_easy *data, bool *done);
-static int imap_getsock(struct Curl_easy *data, struct connectdata *conn,
-                        curl_socket_t *socks);
-static CURLcode imap_doing(struct Curl_easy *data, bool *dophase_done);
-static CURLcode imap_setup_connection(struct Curl_easy *data,
-                                      struct connectdata *conn);
-static char *imap_atom(const char *str, bool escape_only);
-static CURLcode imap_sendf(struct Curl_easy *data, const char *fmt, ...);
-static CURLcode imap_parse_url_options(struct connectdata *conn);
-static CURLcode imap_parse_url_path(struct Curl_easy *data);
-static CURLcode imap_parse_custom_request(struct Curl_easy *data);
-static CURLcode imap_perform_authenticate(struct Curl_easy *data,
-                                          const char *mech,
-                                          const struct bufref *initresp);
-static CURLcode imap_continue_authenticate(struct Curl_easy *data,
-                                           const char *mech,
-                                           const struct bufref *resp);
-static CURLcode imap_cancel_authenticate(struct Curl_easy *data,
-                                         const char *mech);
-static CURLcode imap_get_message(struct Curl_easy *data, struct bufref *out);
+typedef enum {
+  IMAP_STOP,         /* do nothing state, stops the state machine */
+  IMAP_SERVERGREET,  /* waiting for the initial greeting immediately after
+                        a connect */
+  IMAP_CAPABILITY,
+  IMAP_STARTTLS,
+  IMAP_UPGRADETLS,   /* asynchronously upgrade the connection to SSL/TLS
+                       (multi mode only) */
+  IMAP_AUTHENTICATE,
+  IMAP_LOGIN,
+  IMAP_LIST,
+  IMAP_SELECT,
+  IMAP_FETCH,
+  IMAP_FETCH_FINAL,
+  IMAP_APPEND,
+  IMAP_APPEND_FINAL,
+  IMAP_SEARCH,
+  IMAP_LOGOUT,
+  IMAP_LAST          /* never used */
+} imapstate;
 
-/*
- * IMAP protocol handler.
- */
-
-const struct Curl_handler Curl_handler_imap = {
-  "IMAP",                           /* scheme */
-  imap_setup_connection,            /* setup_connection */
-  imap_do,                          /* do_it */
-  imap_done,                        /* done */
-  ZERO_NULL,                        /* do_more */
-  imap_connect,                     /* connect_it */
-  imap_multi_statemach,             /* connecting */
-  imap_doing,                       /* doing */
-  imap_getsock,                     /* proto_getsock */
-  imap_getsock,                     /* doing_getsock */
-  ZERO_NULL,                        /* domore_getsock */
-  ZERO_NULL,                        /* perform_getsock */
-  imap_disconnect,                  /* disconnect */
-  ZERO_NULL,                        /* readwrite */
-  ZERO_NULL,                        /* connection_check */
-  ZERO_NULL,                        /* attach connection */
-  PORT_IMAP,                        /* defport */
-  CURLPROTO_IMAP,                   /* protocol */
-  CURLPROTO_IMAP,                   /* family */
-  PROTOPT_CLOSEACTION|              /* flags */
-  PROTOPT_URLOPTIONS
+/* imap_conn is used for struct connection-oriented data */
+struct imap_conn {
+  struct pingpong pp;
+  struct SASL sasl;           /* SASL-related parameters */
+  struct dynbuf dyn;          /* for the IMAP commands */
+  char *mailbox;              /* The last selected mailbox */
+  imapstate state;            /* Always use imap.c:state() to change state! */
+  unsigned int mb_uidvalidity; /* UIDVALIDITY parsed from select response */
+  char resptag[5];            /* Response tag to wait for */
+  unsigned char preftype;     /* Preferred authentication type */
+  unsigned char cmdid;        /* Last used command ID */
+  BIT(ssldone);               /* Is connect() over SSL done? */
+  BIT(preauth);               /* Is this connection PREAUTH? */
+  BIT(tls_supported);         /* StartTLS capability supported by server */
+  BIT(login_disabled);        /* LOGIN command disabled by server */
+  BIT(ir_supported);          /* Initial response supported by server */
+  BIT(mb_uidvalidity_set);
 };
 
-#ifdef USE_SSL
-/*
- * IMAPS protocol handler.
- */
-
-const struct Curl_handler Curl_handler_imaps = {
-  "IMAPS",                          /* scheme */
-  imap_setup_connection,            /* setup_connection */
-  imap_do,                          /* do_it */
-  imap_done,                        /* done */
-  ZERO_NULL,                        /* do_more */
-  imap_connect,                     /* connect_it */
-  imap_multi_statemach,             /* connecting */
-  imap_doing,                       /* doing */
-  imap_getsock,                     /* proto_getsock */
-  imap_getsock,                     /* doing_getsock */
-  ZERO_NULL,                        /* domore_getsock */
-  ZERO_NULL,                        /* perform_getsock */
-  imap_disconnect,                  /* disconnect */
-  ZERO_NULL,                        /* readwrite */
-  ZERO_NULL,                        /* connection_check */
-  ZERO_NULL,                        /* attach connection */
-  PORT_IMAPS,                       /* defport */
-  CURLPROTO_IMAPS,                  /* protocol */
-  CURLPROTO_IMAP,                   /* family */
-  PROTOPT_CLOSEACTION | PROTOPT_SSL | /* flags */
-  PROTOPT_URLOPTIONS
+/* This IMAP struct is used in the Curl_easy. All IMAP data that is
+   connection-oriented must be in imap_conn to properly deal with the fact that
+   perhaps the Curl_easy is changed between the times the connection is
+   used. */
+struct IMAP {
+  curl_pp_transfer transfer;
+  char *mailbox;          /* Mailbox to select */
+  char *uid;              /* Message UID to fetch */
+  char *mindex;           /* Index in mail box of mail to fetch */
+  char *section;          /* Message SECTION to fetch */
+  char *partial;          /* Message PARTIAL to fetch */
+  char *query;            /* Query to search for */
+  char *custom;           /* Custom request */
+  char *custom_params;    /* Parameters for the custom request */
+  unsigned int uidvalidity; /* UIDVALIDITY to check in select */
+  BIT(uidvalidity_set);
 };
-#endif
 
 #define IMAP_RESP_OK       1
 #define IMAP_RESP_NOT_OK   2
 #define IMAP_RESP_PREAUTH  3
 
-/* SASL parameters for the imap protocol */
-static const struct SASLproto saslimap = {
-  "imap",                     /* The service name */
-  imap_perform_authenticate,  /* Send authentication command */
-  imap_continue_authenticate, /* Send authentication continuation */
-  imap_cancel_authenticate,   /* Send authentication cancellation */
-  imap_get_message,           /* Get SASL response message */
-  0,                          /* No maximum initial response length */
-  '+',                        /* Code received when continuation is expected */
-  IMAP_RESP_OK,               /* Code to receive upon authentication success */
-  SASL_AUTH_DEFAULT,          /* Default mechanisms */
-  SASL_FLAG_BASE64            /* Configuration flags */
+struct ulbits {
+  int bit;
+  const char *flag;
 };
 
-
-#ifdef USE_SSL
-static void imap_to_imaps(struct connectdata *conn)
+/***********************************************************************
+ *
+ * imap_sendf()
+ *
+ * Sends the formatted string as an IMAP command to the server.
+ *
+ * Designed to never block.
+ */
+static CURLcode imap_sendf(struct Curl_easy *data,
+                           struct imap_conn *imapc,
+                           const char *fmt, ...) CURL_PRINTF(3, 0);
+static CURLcode imap_sendf(struct Curl_easy *data,
+                           struct imap_conn *imapc,
+                           const char *fmt, ...)
 {
-  /* Change the connection handler */
-  conn->handler = &Curl_handler_imaps;
+  CURLcode result = CURLE_OK;
 
-  /* Set the connection's upgraded to TLS flag */
-  conn->bits.tls_upgraded = TRUE;
-}
-#else
-#define imap_to_imaps(x) Curl_nop_stmt
+  DEBUGASSERT(fmt);
+
+  /* Calculate the tag based on the connection ID and command ID */
+  curl_msnprintf(imapc->resptag, sizeof(imapc->resptag), "%c%03d",
+                 'A' + curlx_sltosi((long)(data->conn->connection_id % 26)),
+                 ++imapc->cmdid);
+
+  /* start with a blank buffer */
+  curlx_dyn_reset(&imapc->dyn);
+
+  /* append tag + space + fmt */
+  result = curlx_dyn_addf(&imapc->dyn, "%s %s", imapc->resptag, fmt);
+  if(!result) {
+    va_list ap;
+    va_start(ap, fmt);
+#ifdef __clang__
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wformat-nonliteral"
 #endif
+    result = Curl_pp_vsendf(data, &imapc->pp, curlx_dyn_ptr(&imapc->dyn), ap);
+#ifdef __clang__
+#pragma clang diagnostic pop
+#endif
+    va_end(ap);
+  }
+  return result;
+}
+
+/***********************************************************************
+ *
+ * imap_atom()
+ *
+ * Checks the input string for characters that need escaping and returns an
+ * atom ready for sending to the server.
+ *
+ * The returned string needs to be freed.
+ *
+ */
+static char *imap_atom(const char *str, bool escape_only)
+{
+  struct dynbuf line;
+  size_t nclean;
+  size_t len;
+
+  if(!str)
+    return NULL;
+
+  len = strlen(str);
+  nclean = strcspn(str, "() {%*]\\\"");
+  if(len == nclean)
+    /* nothing to escape, return a strdup */
+    return curlx_strdup(str);
+
+  curlx_dyn_init(&line, 2000);
+
+  if(!escape_only && curlx_dyn_addn(&line, "\"", 1))
+    return NULL;
+
+  while(*str) {
+    if((*str == '\\' || *str == '"') &&
+       curlx_dyn_addn(&line, "\\", 1))
+      return NULL;
+    if(curlx_dyn_addn(&line, str, 1))
+      return NULL;
+    str++;
+  }
+
+  if(!escape_only && curlx_dyn_addn(&line, "\"", 1))
+    return NULL;
+
+  return curlx_dyn_ptr(&line);
+}
+
+/*
+ * Finds the start of a literal '{size}' in line, skipping over quoted strings.
+ */
+static const char *imap_find_literal(const char *line, size_t len)
+{
+  const char *end = line + len;
+  bool in_quote = FALSE;
+
+  while(line < end) {
+    if(in_quote) {
+      if(*line == '\\' && (line + 1) < end) {
+        line += 2;
+        continue;
+      }
+      if(*line == '"')
+        in_quote = FALSE;
+    }
+    else {
+      if(*line == '"')
+        in_quote = TRUE;
+      else if(*line == '{')
+        return line;
+    }
+    line++;
+  }
+  return NULL;
+}
 
 /***********************************************************************
  *
@@ -235,7 +298,7 @@ static bool imap_matchresp(const char *line, size_t len, const char *cmd)
 
   /* Does the command name match and is it followed by a space character or at
      the end of line? */
-  if(line + cmd_len <= end && strncasecompare(line, cmd, cmd_len) &&
+  if(line + cmd_len <= end && curl_strnequal(line, cmd, cmd_len) &&
      (line[cmd_len] == ' ' || line + cmd_len + 2 == end))
     return TRUE;
 
@@ -250,14 +313,21 @@ static bool imap_matchresp(const char *line, size_t len, const char *cmd)
  * response which can be processed by the response handler.
  */
 static bool imap_endofresp(struct Curl_easy *data, struct connectdata *conn,
-                           char *line, size_t len, int *resp)
+                           const char *line, size_t len, int *resp)
 {
-  struct IMAP *imap = data->req.p.imap;
-  struct imap_conn *imapc = &conn->proto.imapc;
-  const char *id = imapc->resptag;
-  size_t id_len = strlen(id);
+  struct imap_conn *imapc = Curl_conn_meta_get(conn, CURL_META_IMAP_CONN);
+  struct IMAP *imap = Curl_meta_get(data, CURL_META_IMAP_EASY);
+  const char *id;
+  size_t id_len;
+
+  DEBUGASSERT(imapc);
+  DEBUGASSERT(imap);
+  if(!imapc || !imap)
+    return FALSE;
 
   /* Do we have a tagged command response? */
+  id = imapc->resptag;
+  id_len = strlen(id);
   if(len >= id_len + 1 && !memcmp(id, line, id_len) && line[id_len] == ' ') {
     line += id_len + 1;
     len -= id_len + 1;
@@ -275,46 +345,46 @@ static bool imap_endofresp(struct Curl_easy *data, struct connectdata *conn,
   /* Do we have an untagged command response? */
   if(len >= 2 && !memcmp("* ", line, 2)) {
     switch(imapc->state) {
-      /* States which are interested in untagged responses */
-      case IMAP_CAPABILITY:
-        if(!imap_matchresp(line, len, "CAPABILITY"))
-          return FALSE;
-        break;
-
-      case IMAP_LIST:
-        if((!imap->custom && !imap_matchresp(line, len, "LIST")) ||
-          (imap->custom && !imap_matchresp(line, len, imap->custom) &&
-           (!strcasecompare(imap->custom, "STORE") ||
-            !imap_matchresp(line, len, "FETCH")) &&
-           !strcasecompare(imap->custom, "SELECT") &&
-           !strcasecompare(imap->custom, "EXAMINE") &&
-           !strcasecompare(imap->custom, "SEARCH") &&
-           !strcasecompare(imap->custom, "EXPUNGE") &&
-           !strcasecompare(imap->custom, "LSUB") &&
-           !strcasecompare(imap->custom, "UID") &&
-           !strcasecompare(imap->custom, "GETQUOTAROOT") &&
-           !strcasecompare(imap->custom, "NOOP")))
-          return FALSE;
-        break;
-
-      case IMAP_SELECT:
-        /* SELECT is special in that its untagged responses do not have a
-           common prefix so accept anything! */
-        break;
-
-      case IMAP_FETCH:
-        if(!imap_matchresp(line, len, "FETCH"))
-          return FALSE;
-        break;
-
-      case IMAP_SEARCH:
-        if(!imap_matchresp(line, len, "SEARCH"))
-          return FALSE;
-        break;
-
-      /* Ignore other untagged responses */
-      default:
+    /* States which are interested in untagged responses */
+    case IMAP_CAPABILITY:
+      if(!imap_matchresp(line, len, "CAPABILITY"))
         return FALSE;
+      break;
+
+    case IMAP_LIST:
+      if((!imap->custom && !imap_matchresp(line, len, "LIST")) ||
+         (imap->custom && !imap_matchresp(line, len, imap->custom) &&
+          (!curl_strequal(imap->custom, "STORE") ||
+           !imap_matchresp(line, len, "FETCH")) &&
+          !curl_strequal(imap->custom, "SELECT") &&
+          !curl_strequal(imap->custom, "EXAMINE") &&
+          !curl_strequal(imap->custom, "SEARCH") &&
+          !curl_strequal(imap->custom, "EXPUNGE") &&
+          !curl_strequal(imap->custom, "LSUB") &&
+          !curl_strequal(imap->custom, "UID") &&
+          !curl_strequal(imap->custom, "GETQUOTAROOT") &&
+          !curl_strequal(imap->custom, "NOOP")))
+        return FALSE;
+      break;
+
+    case IMAP_SELECT:
+      /* SELECT is special in that its untagged responses do not have a
+         common prefix so accept anything! */
+      break;
+
+    case IMAP_FETCH:
+      if(!imap_matchresp(line, len, "FETCH"))
+        return FALSE;
+      break;
+
+    case IMAP_SEARCH:
+      if(!imap_matchresp(line, len, "SEARCH"))
+        return FALSE;
+      break;
+
+    /* Ignore other untagged responses */
+    default:
+      return FALSE;
     }
 
     *resp = '*';
@@ -325,19 +395,19 @@ static bool imap_endofresp(struct Curl_easy *data, struct connectdata *conn,
      a space and optionally some text as per RFC-3501 for the AUTHENTICATE and
      APPEND commands and as outlined in Section 4. Examples of RFC-4959 but
      some email servers ignore this and only send a single + instead. */
-  if(imap && !imap->custom && ((len == 3 && line[0] == '+') ||
-     (len >= 2 && !memcmp("+ ", line, 2)))) {
+  if(!imap->custom && ((len == 3 && line[0] == '+') ||
+                       (len >= 2 && !memcmp("+ ", line, 2)))) {
     switch(imapc->state) {
-      /* States which are interested in continuation responses */
-      case IMAP_AUTHENTICATE:
-      case IMAP_APPEND:
-        *resp = '+';
-        break;
+    /* States which are interested in continuation responses */
+    case IMAP_AUTHENTICATE:
+    case IMAP_APPEND:
+      *resp = '+';
+      break;
 
-      default:
-        failf(data, "Unexpected continuation response");
-        *resp = -1;
-        break;
+    default:
+      failf(data, "Unexpected continuation response");
+      *resp = -1;
+      break;
     }
 
     return TRUE;
@@ -354,19 +424,25 @@ static bool imap_endofresp(struct Curl_easy *data, struct connectdata *conn,
  */
 static CURLcode imap_get_message(struct Curl_easy *data, struct bufref *out)
 {
-  char *message = data->state.buffer;
-  size_t len = strlen(message);
+  struct imap_conn *imapc =
+    Curl_conn_meta_get(data->conn, CURL_META_IMAP_CONN);
+  char *message;
+  size_t len;
 
+  if(!imapc)
+    return CURLE_FAILED_INIT;
+
+  message = curlx_dyn_ptr(&imapc->pp.recvbuf);
+  len = imapc->pp.nfinal;
   if(len > 2) {
     /* Find the start of the message */
     len -= 2;
-    for(message += 2; *message == ' ' || *message == '\t'; message++, len--)
+    for(message += 2; ISBLANK(*message); message++, len--)
       ;
 
     /* Find the end of the message */
     while(len--)
-      if(message[len] != '\r' && message[len] != '\n' && message[len] != ' ' &&
-         message[len] != '\t')
+      if(!ISNEWLINE(message[len]) && !ISBLANK(message[len]))
         break;
 
     /* Terminate the message */
@@ -386,12 +462,13 @@ static CURLcode imap_get_message(struct Curl_easy *data, struct bufref *out)
  *
  * This is the ONLY way to change IMAP state!
  */
-static void imap_state(struct Curl_easy *data, imapstate newstate)
+static void imap_state(struct Curl_easy *data,
+                       struct imap_conn *imapc,
+                       imapstate newstate)
 {
-  struct imap_conn *imapc = &data->conn->proto.imapc;
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
   /* for debug purposes */
-  static const char * const names[]={
+  static const char * const names[] = {
     "STOP",
     "SERVERGREET",
     "CAPABILITY",
@@ -413,8 +490,9 @@ static void imap_state(struct Curl_easy *data, imapstate newstate)
   if(imapc->state != newstate)
     infof(data, "IMAP %p state change from %s to %s",
           (void *)imapc, names[imapc->state], names[newstate]);
+#else
+  (void)data;
 #endif
-
   imapc->state = newstate;
 }
 
@@ -426,19 +504,19 @@ static void imap_state(struct Curl_easy *data, imapstate newstate)
  * supported capabilities.
  */
 static CURLcode imap_perform_capability(struct Curl_easy *data,
-                                        struct connectdata *conn)
+                                        struct imap_conn *imapc)
 {
   CURLcode result = CURLE_OK;
-  struct imap_conn *imapc = &conn->proto.imapc;
+
   imapc->sasl.authmechs = SASL_AUTH_NONE; /* No known auth. mechanisms yet */
   imapc->sasl.authused = SASL_AUTH_NONE;  /* Clear the auth. mechanism used */
   imapc->tls_supported = FALSE;           /* Clear the TLS capability */
 
   /* Send the CAPABILITY command */
-  result = imap_sendf(data, "CAPABILITY");
+  result = imap_sendf(data, imapc, "CAPABILITY");
 
   if(!result)
-    imap_state(data, IMAP_CAPABILITY);
+    imap_state(data, imapc, IMAP_CAPABILITY);
 
   return result;
 }
@@ -449,13 +527,14 @@ static CURLcode imap_perform_capability(struct Curl_easy *data,
  *
  * Sends the STARTTLS command to start the upgrade to TLS.
  */
-static CURLcode imap_perform_starttls(struct Curl_easy *data)
+static CURLcode imap_perform_starttls(struct Curl_easy *data,
+                                      struct imap_conn *imapc)
 {
   /* Send the STARTTLS command */
-  CURLcode result = imap_sendf(data, "STARTTLS");
+  CURLcode result = imap_sendf(data, imapc, "STARTTLS");
 
   if(!result)
-    imap_state(data, IMAP_STARTTLS);
+    imap_state(data, imapc, IMAP_STARTTLS);
 
   return result;
 }
@@ -467,32 +546,40 @@ static CURLcode imap_perform_starttls(struct Curl_easy *data)
  * Performs the upgrade to TLS.
  */
 static CURLcode imap_perform_upgrade_tls(struct Curl_easy *data,
+                                         struct imap_conn *imapc,
                                          struct connectdata *conn)
 {
+#ifdef USE_SSL
   /* Start the SSL connection */
-  struct imap_conn *imapc = &conn->proto.imapc;
   CURLcode result;
   bool ssldone = FALSE;
 
   if(!Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
-    result = Curl_ssl_cfilter_add(data, conn, FIRSTSOCKET);
+    result = Curl_ssl_cfilter_add(
+      data, Curl_conn_get_origin(conn, FIRSTSOCKET), conn, FIRSTSOCKET);
     if(result)
       goto out;
+    /* Change the connection handler */
+    conn->scheme = &Curl_scheme_imaps;
   }
 
+  DEBUGASSERT(!imapc->ssldone);
   result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssldone);
-  if(!result) {
+  DEBUGF(infof(data, "imap_perform_upgrade_tls, connect -> %d, %d",
+               (int)result, ssldone));
+  if(!result && ssldone) {
     imapc->ssldone = ssldone;
-    if(imapc->state != IMAP_UPGRADETLS)
-      imap_state(data, IMAP_UPGRADETLS);
-
-    if(imapc->ssldone) {
-      imap_to_imaps(conn);
-      result = imap_perform_capability(data, conn);
-    }
+    /* perform CAPA now, changes imapc->state out of IMAP_UPGRADETLS */
+    result = imap_perform_capability(data, imapc);
   }
 out:
   return result;
+#else
+  (void)data;
+  (void)imapc;
+  (void)conn;
+  return CURLE_NOT_BUILT_IN;
+#endif
 }
 
 /***********************************************************************
@@ -502,6 +589,7 @@ out:
  * Sends a clear text LOGIN command to authenticate with.
  */
 static CURLcode imap_perform_login(struct Curl_easy *data,
+                                   struct imap_conn *imapc,
                                    struct connectdata *conn)
 {
   CURLcode result = CURLE_OK;
@@ -509,26 +597,26 @@ static CURLcode imap_perform_login(struct Curl_easy *data,
   char *passwd;
 
   /* Check we have a username and password to authenticate with and end the
-     connect phase if we don't */
-  if(!data->state.aptr.user) {
-    imap_state(data, IMAP_STOP);
+     connect phase if we do not */
+  if(!conn->creds) {
+    imap_state(data, imapc, IMAP_STOP);
 
     return result;
   }
 
   /* Make sure the username and password are in the correct atom format */
-  user = imap_atom(conn->user, false);
-  passwd = imap_atom(conn->passwd, false);
+  user = imap_atom(Curl_creds_user(conn->creds), FALSE);
+  passwd = imap_atom(Curl_creds_passwd(conn->creds), FALSE);
 
   /* Send the LOGIN command */
-  result = imap_sendf(data, "LOGIN %s %s", user ? user : "",
+  result = imap_sendf(data, imapc, "LOGIN %s %s", user ? user : "",
                       passwd ? passwd : "");
 
-  free(user);
-  free(passwd);
+  curlx_free(user);
+  curlx_free(passwd);
 
   if(!result)
-    imap_state(data, IMAP_LOGIN);
+    imap_state(data, imapc, IMAP_LOGIN);
 
   return result;
 }
@@ -544,16 +632,20 @@ static CURLcode imap_perform_authenticate(struct Curl_easy *data,
                                           const char *mech,
                                           const struct bufref *initresp)
 {
+  struct imap_conn *imapc =
+    Curl_conn_meta_get(data->conn, CURL_META_IMAP_CONN);
   CURLcode result = CURLE_OK;
-  const char *ir = (const char *) Curl_bufref_ptr(initresp);
+  const char *ir = Curl_bufref_ptr(initresp);
 
+  if(!imapc)
+    return CURLE_FAILED_INIT;
   if(ir) {
     /* Send the AUTHENTICATE command with the initial response */
-    result = imap_sendf(data, "AUTHENTICATE %s %s", mech, ir);
+    result = imap_sendf(data, imapc, "AUTHENTICATE %s %s", mech, ir);
   }
   else {
     /* Send the AUTHENTICATE command */
-    result = imap_sendf(data, "AUTHENTICATE %s", mech);
+    result = imap_sendf(data, imapc, "AUTHENTICATE %s", mech);
   }
 
   return result;
@@ -569,12 +661,13 @@ static CURLcode imap_continue_authenticate(struct Curl_easy *data,
                                            const char *mech,
                                            const struct bufref *resp)
 {
-  struct imap_conn *imapc = &data->conn->proto.imapc;
+  struct imap_conn *imapc =
+    Curl_conn_meta_get(data->conn, CURL_META_IMAP_CONN);
 
   (void)mech;
-
-  return Curl_pp_sendf(data, &imapc->pp,
-                       "%s", (const char *) Curl_bufref_ptr(resp));
+  if(!imapc)
+    return CURLE_FAILED_INIT;
+  return Curl_pp_sendf(data, &imapc->pp, "%s", Curl_bufref_ptr(resp));
 }
 
 /***********************************************************************
@@ -586,10 +679,12 @@ static CURLcode imap_continue_authenticate(struct Curl_easy *data,
 static CURLcode imap_cancel_authenticate(struct Curl_easy *data,
                                          const char *mech)
 {
-  struct imap_conn *imapc = &data->conn->proto.imapc;
+  struct imap_conn *imapc =
+    Curl_conn_meta_get(data->conn, CURL_META_IMAP_CONN);
 
   (void)mech;
-
+  if(!imapc)
+    return CURLE_FAILED_INIT;
   return Curl_pp_sendf(data, &imapc->pp, "*");
 }
 
@@ -602,34 +697,30 @@ static CURLcode imap_cancel_authenticate(struct Curl_easy *data,
  * mechanism not be available between the client and server.
  */
 static CURLcode imap_perform_authentication(struct Curl_easy *data,
-                                            struct connectdata *conn)
+                                            struct imap_conn *imapc)
 {
   CURLcode result = CURLE_OK;
-  struct imap_conn *imapc = &conn->proto.imapc;
   saslprogress progress;
 
   /* Check if already authenticated OR if there is enough data to authenticate
-     with and end the connect phase if we don't */
+     with and end the connect phase if we do not */
   if(imapc->preauth ||
      !Curl_sasl_can_authenticate(&imapc->sasl, data)) {
-    imap_state(data, IMAP_STOP);
+    imap_state(data, imapc, IMAP_STOP);
     return result;
   }
 
   /* Calculate the SASL login details */
-  result = Curl_sasl_start(&imapc->sasl, data, imapc->ir_supported, &progress);
-
+  result = Curl_sasl_start(&imapc->sasl, data, (bool)imapc->ir_supported,
+                           &progress);
   if(!result) {
     if(progress == SASL_INPROGRESS)
-      imap_state(data, IMAP_AUTHENTICATE);
+      imap_state(data, imapc, IMAP_AUTHENTICATE);
     else if(!imapc->login_disabled && (imapc->preftype & IMAP_TYPE_CLEARTEXT))
       /* Perform clear text authentication */
-      result = imap_perform_login(data, conn);
-    else {
-      /* Other mechanisms not supported */
-      infof(data, "No known authentication mechanisms supported");
-      result = CURLE_LOGIN_DENIED;
-    }
+      result = imap_perform_login(data, imapc, data->conn);
+    else
+      result = Curl_sasl_is_blocked(&imapc->sasl, data);
   }
 
   return result;
@@ -641,30 +732,31 @@ static CURLcode imap_perform_authentication(struct Curl_easy *data,
  *
  * Sends a LIST command or an alternative custom request.
  */
-static CURLcode imap_perform_list(struct Curl_easy *data)
+static CURLcode imap_perform_list(struct Curl_easy *data,
+                                  struct imap_conn *imapc,
+                                  struct IMAP *imap)
 {
   CURLcode result = CURLE_OK;
-  struct IMAP *imap = data->req.p.imap;
 
   if(imap->custom)
     /* Send the custom request */
-    result = imap_sendf(data, "%s%s", imap->custom,
+    result = imap_sendf(data, imapc, "%s%s", imap->custom,
                         imap->custom_params ? imap->custom_params : "");
   else {
     /* Make sure the mailbox is in the correct atom format if necessary */
-    char *mailbox = imap->mailbox ? imap_atom(imap->mailbox, true)
-                                  : strdup("");
+    char *mailbox = imap->mailbox ? imap_atom(imap->mailbox, TRUE)
+                                  : curlx_strdup("");
     if(!mailbox)
       return CURLE_OUT_OF_MEMORY;
 
     /* Send the LIST command */
-    result = imap_sendf(data, "LIST \"%s\" *", mailbox);
+    result = imap_sendf(data, imapc, "LIST \"%s\" *", mailbox);
 
-    free(mailbox);
+    curlx_free(mailbox);
   }
 
   if(!result)
-    imap_state(data, IMAP_LIST);
+    imap_state(data, imapc, IMAP_LIST);
 
   return result;
 }
@@ -675,17 +767,16 @@ static CURLcode imap_perform_list(struct Curl_easy *data)
  *
  * Sends a SELECT command to ask the server to change the selected mailbox.
  */
-static CURLcode imap_perform_select(struct Curl_easy *data)
+static CURLcode imap_perform_select(struct Curl_easy *data,
+                                    struct imap_conn *imapc,
+                                    struct IMAP *imap)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct IMAP *imap = data->req.p.imap;
-  struct imap_conn *imapc = &conn->proto.imapc;
   char *mailbox;
 
   /* Invalidate old information as we are switching mailboxes */
-  Curl_safefree(imapc->mailbox);
-  Curl_safefree(imapc->mailbox_uidvalidity);
+  curlx_safefree(imapc->mailbox);
+  imapc->mb_uidvalidity_set = FALSE;
 
   /* Check we have a mailbox */
   if(!imap->mailbox) {
@@ -694,17 +785,17 @@ static CURLcode imap_perform_select(struct Curl_easy *data)
   }
 
   /* Make sure the mailbox is in the correct atom format */
-  mailbox = imap_atom(imap->mailbox, false);
+  mailbox = imap_atom(imap->mailbox, FALSE);
   if(!mailbox)
     return CURLE_OUT_OF_MEMORY;
 
   /* Send the SELECT command */
-  result = imap_sendf(data, "SELECT %s", mailbox);
+  result = imap_sendf(data, imapc, "SELECT %s", mailbox);
 
-  free(mailbox);
+  curlx_free(mailbox);
 
   if(!result)
-    imap_state(data, IMAP_SELECT);
+    imap_state(data, imapc, IMAP_SELECT);
 
   return result;
 }
@@ -715,30 +806,31 @@ static CURLcode imap_perform_select(struct Curl_easy *data)
  *
  * Sends a FETCH command to initiate the download of a message.
  */
-static CURLcode imap_perform_fetch(struct Curl_easy *data)
+static CURLcode imap_perform_fetch(struct Curl_easy *data,
+                                   struct imap_conn *imapc,
+                                   struct IMAP *imap)
 {
   CURLcode result = CURLE_OK;
-  struct IMAP *imap = data->req.p.imap;
   /* Check we have a UID */
   if(imap->uid) {
 
     /* Send the FETCH command */
     if(imap->partial)
-      result = imap_sendf(data, "UID FETCH %s BODY[%s]<%s>",
+      result = imap_sendf(data, imapc, "UID FETCH %s BODY[%s]<%s>",
                           imap->uid, imap->section ? imap->section : "",
                           imap->partial);
     else
-      result = imap_sendf(data, "UID FETCH %s BODY[%s]",
+      result = imap_sendf(data, imapc, "UID FETCH %s BODY[%s]",
                           imap->uid, imap->section ? imap->section : "");
   }
   else if(imap->mindex) {
     /* Send the FETCH command */
     if(imap->partial)
-      result = imap_sendf(data, "FETCH %s BODY[%s]<%s>",
+      result = imap_sendf(data, imapc, "FETCH %s BODY[%s]<%s>",
                           imap->mindex, imap->section ? imap->section : "",
                           imap->partial);
     else
-      result = imap_sendf(data, "FETCH %s BODY[%s]",
+      result = imap_sendf(data, imapc, "FETCH %s BODY[%s]",
                           imap->mindex, imap->section ? imap->section : "");
   }
   else {
@@ -746,7 +838,7 @@ static CURLcode imap_perform_fetch(struct Curl_easy *data)
     return CURLE_URL_MALFORMAT;
   }
   if(!result)
-    imap_state(data, IMAP_FETCH);
+    imap_state(data, imapc, IMAP_FETCH);
 
   return result;
 }
@@ -757,11 +849,13 @@ static CURLcode imap_perform_fetch(struct Curl_easy *data)
  *
  * Sends an APPEND command to initiate the upload of a message.
  */
-static CURLcode imap_perform_append(struct Curl_easy *data)
+static CURLcode imap_perform_append(struct Curl_easy *data,
+                                    struct imap_conn *imapc,
+                                    struct IMAP *imap)
 {
   CURLcode result = CURLE_OK;
-  struct IMAP *imap = data->req.p.imap;
   char *mailbox;
+  struct dynbuf flags;
 
   /* Check we have a mailbox */
   if(!imap->mailbox) {
@@ -769,33 +863,36 @@ static CURLcode imap_perform_append(struct Curl_easy *data)
     return CURLE_URL_MALFORMAT;
   }
 
+#ifndef CURL_DISABLE_MIME
   /* Prepare the mime data if some. */
-  if(data->set.mimepost.kind != MIMEKIND_NONE) {
+  if(IS_MIME_POST(data)) {
+    curl_mimepart *postp = data->set.mimepostp;
+
     /* Use the whole structure as data. */
-    data->set.mimepost.flags &= ~MIME_BODY_ONLY;
+    postp->flags &= ~(unsigned int)MIME_BODY_ONLY;
 
     /* Add external headers and mime version. */
-    curl_mime_headers(&data->set.mimepost, data->set.headers, 0);
-    result = Curl_mime_prepare_headers(data, &data->set.mimepost, NULL,
+    curl_mime_headers(postp, data->set.headers, 0);
+    result = Curl_mime_prepare_headers(data, postp, NULL,
                                        NULL, MIMESTRATEGY_MAIL);
 
     if(!result)
       if(!Curl_checkheaders(data, STRCONST("Mime-Version")))
-        result = Curl_mime_add_header(&data->set.mimepost.curlheaders,
+        result = Curl_mime_add_header(&postp->curlheaders,
                                       "Mime-Version: 1.0");
 
-    /* Make sure we will read the entire mime structure. */
     if(!result)
-      result = Curl_mime_rewind(&data->set.mimepost);
-
+      result = Curl_creader_set_mime(data, postp);
+    if(result)
+      return result;
+    data->state.infilesize = Curl_creader_client_length(data);
+  }
+  else
+#endif
+  {
+    result = Curl_creader_set_fread(data, data->state.infilesize);
     if(result)
       return result;
-
-    data->state.infilesize = Curl_mime_size(&data->set.mimepost);
-
-    /* Read from mime structure. */
-    data->state.fread_func = (curl_read_callback) Curl_mime_read;
-    data->state.in = (void *) &data->set.mimepost;
   }
 
   /* Check we know the size of the upload */
@@ -805,19 +902,52 @@ static CURLcode imap_perform_append(struct Curl_easy *data)
   }
 
   /* Make sure the mailbox is in the correct atom format */
-  mailbox = imap_atom(imap->mailbox, false);
+  mailbox = imap_atom(imap->mailbox, FALSE);
   if(!mailbox)
     return CURLE_OUT_OF_MEMORY;
 
-  /* Send the APPEND command */
-  result = imap_sendf(data,
-                      "APPEND %s (\\Seen) {%" CURL_FORMAT_CURL_OFF_T "}",
-                      mailbox, data->state.infilesize);
+  /* Generate flags string and send the APPEND command */
+  curlx_dyn_init(&flags, 100);
+  if(data->set.upload_flags) {
+    int i;
+    struct ulbits ulflag[] = {
+      { CURLULFLAG_ANSWERED, "Answered" },
+      { CURLULFLAG_DELETED, "Deleted" },
+      { CURLULFLAG_DRAFT, "Draft" },
+      { CURLULFLAG_FLAGGED, "Flagged" },
+      { CURLULFLAG_SEEN, "Seen" },
+      { 0, NULL }
+    };
 
-  free(mailbox);
+    result = CURLE_OUT_OF_MEMORY;
+    if(curlx_dyn_add(&flags, " (")) {
+      goto cleanup;
+    }
+
+    for(i = 0; ulflag[i].bit; i++) {
+      if(data->set.upload_flags & ulflag[i].bit) {
+        if((curlx_dyn_len(&flags) > 2 && curlx_dyn_add(&flags, " ")) ||
+           curlx_dyn_add(&flags, "\\") ||
+           curlx_dyn_add(&flags, ulflag[i].flag))
+          goto cleanup;
+      }
+    }
+
+    if(curlx_dyn_add(&flags, ")"))
+      goto cleanup;
+  }
+  else if(curlx_dyn_add(&flags, ""))
+    goto cleanup;
+
+  result = imap_sendf(data, imapc, "APPEND %s%s {%" FMT_OFF_T "}",
+                      mailbox, curlx_dyn_ptr(&flags), data->state.infilesize);
+
+cleanup:
+  curlx_dyn_free(&flags);
+  curlx_free(mailbox);
 
   if(!result)
-    imap_state(data, IMAP_APPEND);
+    imap_state(data, imapc, IMAP_APPEND);
 
   return result;
 }
@@ -828,10 +958,11 @@ static CURLcode imap_perform_append(struct Curl_easy *data)
  *
  * Sends a SEARCH command.
  */
-static CURLcode imap_perform_search(struct Curl_easy *data)
+static CURLcode imap_perform_search(struct Curl_easy *data,
+                                    struct imap_conn *imapc,
+                                    struct IMAP *imap)
 {
   CURLcode result = CURLE_OK;
-  struct IMAP *imap = data->req.p.imap;
 
   /* Check we have a query string */
   if(!imap->query) {
@@ -840,10 +971,10 @@ static CURLcode imap_perform_search(struct Curl_easy *data)
   }
 
   /* Send the SEARCH command */
-  result = imap_sendf(data, "SEARCH %s", imap->query);
+  result = imap_sendf(data, imapc, "SEARCH %s", imap->query);
 
   if(!result)
-    imap_state(data, IMAP_SEARCH);
+    imap_state(data, imapc, IMAP_SEARCH);
 
   return result;
 }
@@ -854,28 +985,28 @@ static CURLcode imap_perform_search(struct Curl_easy *data)
  *
  * Performs the logout action prior to sclose() being called.
  */
-static CURLcode imap_perform_logout(struct Curl_easy *data)
+static CURLcode imap_perform_logout(struct Curl_easy *data,
+                                    struct imap_conn *imapc)
 {
   /* Send the LOGOUT command */
-  CURLcode result = imap_sendf(data, "LOGOUT");
+  CURLcode result = imap_sendf(data, imapc, "LOGOUT");
 
   if(!result)
-    imap_state(data, IMAP_LOGOUT);
+    imap_state(data, imapc, IMAP_LOGOUT);
 
   return result;
 }
 
 /* For the initial server greeting */
 static CURLcode imap_state_servergreet_resp(struct Curl_easy *data,
+                                            struct imap_conn *imapc,
                                             int imapcode,
                                             imapstate instate)
 {
-  struct connectdata *conn = data->conn;
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(imapcode == IMAP_RESP_PREAUTH) {
     /* PREAUTH */
-    struct imap_conn *imapc = &conn->proto.imapc;
     imapc->preauth = TRUE;
     infof(data, "PREAUTH connection, already authenticated");
   }
@@ -884,58 +1015,52 @@ static CURLcode imap_state_servergreet_resp(struct Curl_easy *data,
     return CURLE_WEIRD_SERVER_REPLY;
   }
 
-  return imap_perform_capability(data, conn);
+  return imap_perform_capability(data, imapc);
 }
 
 /* For CAPABILITY responses */
 static CURLcode imap_state_capability_resp(struct Curl_easy *data,
+                                           struct imap_conn *imapc,
                                            int imapcode,
                                            imapstate instate)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct imap_conn *imapc = &conn->proto.imapc;
-  const char *line = data->state.buffer;
+  const char *line = curlx_dyn_ptr(&imapc->pp.recvbuf);
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
-  /* Do we have a untagged response? */
+  /* Do we have an untagged response? */
   if(imapcode == '*') {
     line += 2;
 
     /* Loop through the data line */
     for(;;) {
       size_t wordlen;
-      while(*line &&
-            (*line == ' ' || *line == '\t' ||
-              *line == '\r' || *line == '\n')) {
-
+      while(*line && (ISBLANK(*line) || ISNEWLINE(*line)))
         line++;
-      }
 
       if(!*line)
         break;
 
       /* Extract the word */
-      for(wordlen = 0; line[wordlen] && line[wordlen] != ' ' &&
-            line[wordlen] != '\t' && line[wordlen] != '\r' &&
-            line[wordlen] != '\n';)
+      for(wordlen = 0; line[wordlen] && !ISBLANK(line[wordlen]) &&
+                       !ISNEWLINE(line[wordlen]);)
         wordlen++;
 
       /* Does the server support the STARTTLS capability? */
-      if(wordlen == 8 && !memcmp(line, "STARTTLS", 8))
+      if(wordlen == 8 && curl_strnequal(line, "STARTTLS", 8))
         imapc->tls_supported = TRUE;
 
       /* Has the server explicitly disabled clear text authentication? */
-      else if(wordlen == 13 && !memcmp(line, "LOGINDISABLED", 13))
+      else if(wordlen == 13 && curl_strnequal(line, "LOGINDISABLED", 13))
         imapc->login_disabled = TRUE;
 
       /* Does the server support the SASL-IR capability? */
-      else if(wordlen == 7 && !memcmp(line, "SASL-IR", 7))
+      else if(wordlen == 7 && curl_strnequal(line, "SASL-IR", 7))
         imapc->ir_supported = TRUE;
 
       /* Do we have a SASL based authentication mechanism? */
-      else if(wordlen > 5 && !memcmp(line, "AUTH=", 5)) {
+      else if(wordlen > 5 && curl_strnequal(line, "AUTH=", 5)) {
         size_t llen;
         unsigned short mechbit;
 
@@ -951,37 +1076,37 @@ static CURLcode imap_state_capability_resp(struct Curl_easy *data,
       line += wordlen;
     }
   }
-  else if(data->set.use_ssl && !Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
+  else if(data->set.use_ssl && !Curl_conn_is_ssl(data->conn, FIRSTSOCKET)) {
     /* PREAUTH is not compatible with STARTTLS. */
     if(imapcode == IMAP_RESP_OK && imapc->tls_supported && !imapc->preauth) {
       /* Switch to TLS connection now */
-      result = imap_perform_starttls(data);
+      result = imap_perform_starttls(data, imapc);
     }
     else if(data->set.use_ssl <= CURLUSESSL_TRY)
-      result = imap_perform_authentication(data, conn);
+      result = imap_perform_authentication(data, imapc);
     else {
       failf(data, "STARTTLS not available.");
       result = CURLE_USE_SSL_FAILED;
     }
   }
   else
-    result = imap_perform_authentication(data, conn);
+    result = imap_perform_authentication(data, imapc);
 
   return result;
 }
 
 /* For STARTTLS responses */
 static CURLcode imap_state_starttls_resp(struct Curl_easy *data,
+                                         struct imap_conn *imapc,
                                          int imapcode,
                                          imapstate instate)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   /* Pipelining in response is forbidden. */
-  if(data->conn->proto.imapc.pp.cache_size)
+  if(imapc->pp.overflow)
     return CURLE_WEIRD_SERVER_REPLY;
 
   if(imapcode != IMAP_RESP_OK) {
@@ -990,36 +1115,35 @@ static CURLcode imap_state_starttls_resp(struct Curl_easy *data,
       result = CURLE_USE_SSL_FAILED;
     }
     else
-      result = imap_perform_authentication(data, conn);
+      result = imap_perform_authentication(data, imapc);
   }
   else
-    result = imap_perform_upgrade_tls(data, conn);
+    imap_state(data, imapc, IMAP_UPGRADETLS);
 
   return result;
 }
 
 /* For SASL authentication responses */
 static CURLcode imap_state_auth_resp(struct Curl_easy *data,
-                                     struct connectdata *conn,
+                                     struct imap_conn *imapc,
                                      int imapcode,
                                      imapstate instate)
 {
   CURLcode result = CURLE_OK;
-  struct imap_conn *imapc = &conn->proto.imapc;
   saslprogress progress;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   result = Curl_sasl_continue(&imapc->sasl, data, imapcode, &progress);
   if(!result)
     switch(progress) {
     case SASL_DONE:
-      imap_state(data, IMAP_STOP);  /* Authenticated */
+      imap_state(data, imapc, IMAP_STOP);  /* Authenticated */
       break;
     case SASL_IDLE:            /* No mechanism left after cancellation */
-      if((!imapc->login_disabled) && (imapc->preftype & IMAP_TYPE_CLEARTEXT))
+      if(!imapc->login_disabled && (imapc->preftype & IMAP_TYPE_CLEARTEXT))
         /* Perform clear text authentication */
-        result = imap_perform_login(data, conn);
+        result = imap_perform_login(data, imapc, data->conn);
       else {
         failf(data, "Authentication cancelled");
         result = CURLE_LOGIN_DENIED;
@@ -1034,11 +1158,12 @@ static CURLcode imap_state_auth_resp(struct Curl_easy *data,
 
 /* For LOGIN responses */
 static CURLcode imap_state_login_resp(struct Curl_easy *data,
+                                      struct imap_conn *imapc,
                                       int imapcode,
                                       imapstate instate)
 {
   CURLcode result = CURLE_OK;
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(imapcode != IMAP_RESP_OK) {
     failf(data, "Access denied. %c", imapcode);
@@ -1046,86 +1171,218 @@ static CURLcode imap_state_login_resp(struct Curl_easy *data,
   }
   else
     /* End of connect phase */
-    imap_state(data, IMAP_STOP);
+    imap_state(data, imapc, IMAP_STOP);
 
   return result;
 }
 
+/* Detect IMAP listings vs. downloading a single email */
+static bool is_custom_fetch_listing_match(const char *params)
+{
+  /* match " 1:* (FLAGS ..." or " 1,2,3 (FLAGS ..." */
+  if(*params++ != ' ')
+    return FALSE;
+
+  while(ISDIGIT(*params)) {
+    params++;
+    if(*params == 0)
+      return FALSE;
+  }
+  if(*params == ':')
+    return TRUE;
+  if(*params == ',')
+    return TRUE;
+  return FALSE;
+}
+
+static bool is_custom_fetch_listing(struct IMAP *imap)
+{
+  /* filter out "UID FETCH 1:* (FLAGS ..." queries to list emails */
+  if(!imap->custom)
+    return FALSE;
+  else if(curl_strequal(imap->custom, "FETCH") && imap->custom_params) {
+    const char *p = imap->custom_params;
+    return is_custom_fetch_listing_match(p);
+  }
+  else if(curl_strequal(imap->custom, "UID") && imap->custom_params) {
+    if(curl_strnequal(imap->custom_params, " FETCH ", 7)) {
+      const char *p = imap->custom_params + 6;
+      return is_custom_fetch_listing_match(p);
+    }
+  }
+  return FALSE;
+}
+
 /* For LIST and SEARCH responses */
 static CURLcode imap_state_listsearch_resp(struct Curl_easy *data,
+                                           struct imap_conn *imapc,
                                            int imapcode,
                                            imapstate instate)
 {
   CURLcode result = CURLE_OK;
-  char *line = data->state.buffer;
-  size_t len = strlen(line);
+  const char *line = curlx_dyn_ptr(&imapc->pp.recvbuf);
+  size_t len = imapc->pp.nfinal;
+  struct IMAP *imap = Curl_meta_get(data, CURL_META_IMAP_EASY);
 
-  (void)instate; /* No use for this yet */
+  DEBUGASSERT(imap);
+  if(!imap)
+    return CURLE_FAILED_INIT;
+  (void)instate;
 
-  if(imapcode == '*') {
-    /* Temporarily add the LF character back and send as body to the client */
-    line[len] = '\n';
-    result = Curl_client_write(data, CLIENTWRITE_BODY, line, len + 1);
-    line[len] = '\0';
+  if(imapcode == '*' && is_custom_fetch_listing(imap)) {
+    /* custom FETCH or UID FETCH for listing is not handled here */
+  }
+  else if(imapcode == '*') {
+    /* Check if this response contains a literal (e.g. FETCH responses with
+       body data). Literal syntax is {size}\r\n */
+    const char *cr = memchr(line, '\r', len);
+    size_t line_len = cr ? (size_t)(cr - line) : len;
+    const char *ptr = imap_find_literal(line, line_len);
+    if(ptr) {
+      curl_off_t size = 0;
+      bool parsed = FALSE;
+      ptr++;
+      if(!curlx_str_number(&ptr, &size, CURL_OFF_T_MAX) &&
+         !curlx_str_single(&ptr, '}'))
+        parsed = TRUE;
+
+      if(parsed) {
+        struct pingpong *pp = &imapc->pp;
+        size_t buffer_len = curlx_dyn_len(&pp->recvbuf);
+        size_t after_header = buffer_len - pp->nfinal;
+
+        /* This is a literal response, setup to receive the body data */
+        infof(data, "Found %" FMT_OFF_T " bytes to download", size);
+
+        /* First write the header line */
+        result = Curl_client_write(data, CLIENTWRITE_BODY, line, len);
+        if(result)
+          return result;
+
+        /* Handle data already in buffer after the header line */
+        if(after_header > 0) {
+          /* There is already data in the buffer that is part of the literal
+             body or subsequent responses */
+          size_t chunk = after_header;
+
+          /* Keep only the data after the header line */
+          curlx_dyn_tail(&pp->recvbuf, chunk);
+          pp->nfinal = 0; /* done */
+
+          /* Limit chunk to the literal size */
+          if(chunk > (size_t)size)
+            chunk = (size_t)size;
+
+          if(chunk) {
+            /* Write the literal body data */
+            result = Curl_client_write(data, CLIENTWRITE_BODY,
+                                       curlx_dyn_ptr(&pp->recvbuf), chunk);
+            if(result)
+              return result;
+          }
+
+          /* Handle remaining data in buffer (either more literal data or
+             subsequent responses) */
+          if(after_header > chunk) {
+            /* Keep the data after the literal body */
+            pp->overflow = after_header - chunk;
+            curlx_dyn_tail(&pp->recvbuf, pp->overflow);
+          }
+          else {
+            pp->overflow = 0;
+            curlx_dyn_reset(&pp->recvbuf);
+          }
+        }
+        else {
+          /* No data in buffer yet, reset overflow */
+          pp->overflow = 0;
+        }
+
+        if((CURL_OFF_T_MAX - size) < (curl_off_t)len)
+          /* unlikely to actually be a transfer this big, but avoid integer
+             overflow */
+          size = CURL_OFF_T_MAX;
+        else
+          size += len;
+
+        /* Progress size includes both header line and literal body */
+        Curl_pgrsSetDownloadSize(data, size);
+
+        if(data->req.bytecount == size)
+          /* All data already transferred (header + literal body) */
+          Curl_xfer_setup_nop(data);
+        else {
+          /* Setup to receive the literal body data.
+             maxdownload and transfer size include both header line and
+             literal body */
+          data->req.maxdownload = size;
+          Curl_xfer_setup_recv(data, FIRSTSOCKET, size);
+        }
+        /* End of DO phase */
+        imap_state(data, imapc, IMAP_STOP);
+      }
+      else {
+        /* Failed to parse literal, write the line */
+        result = Curl_client_write(data, CLIENTWRITE_BODY, line, len);
+      }
+    }
+    else {
+      /* No literal, write the line as-is */
+      result = Curl_client_write(data, CLIENTWRITE_BODY, line, len);
+    }
   }
   else if(imapcode != IMAP_RESP_OK)
     result = CURLE_QUOTE_ERROR;
   else
     /* End of DO phase */
-    imap_state(data, IMAP_STOP);
+    imap_state(data, imapc, IMAP_STOP);
 
   return result;
 }
 
 /* For SELECT responses */
-static CURLcode imap_state_select_resp(struct Curl_easy *data, int imapcode,
+static CURLcode imap_state_select_resp(struct Curl_easy *data,
+                                       struct imap_conn *imapc,
+                                       struct IMAP *imap,
+                                       int imapcode,
                                        imapstate instate)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct IMAP *imap = data->req.p.imap;
-  struct imap_conn *imapc = &conn->proto.imapc;
-  const char *line = data->state.buffer;
-
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(imapcode == '*') {
     /* See if this is an UIDVALIDITY response */
-    if(checkprefix("OK [UIDVALIDITY ", line + 2)) {
-      size_t len = 0;
+    const char *line = curlx_dyn_ptr(&imapc->pp.recvbuf);
+    size_t len = curlx_dyn_len(&imapc->pp.recvbuf);
+    if((len >= 18) && checkprefix("OK [UIDVALIDITY ", &line[2])) {
+      curl_off_t value;
       const char *p = &line[2] + strlen("OK [UIDVALIDITY ");
-      while((len < 20) && p[len] && ISDIGIT(p[len]))
-        len++;
-      if(len && (p[len] == ']')) {
-        struct dynbuf uid;
-        Curl_dyn_init(&uid, 20);
-        if(Curl_dyn_addn(&uid, p, len))
-          return CURLE_OUT_OF_MEMORY;
-        Curl_safefree(imapc->mailbox_uidvalidity);
-        imapc->mailbox_uidvalidity = Curl_dyn_ptr(&uid);
+      if(!curlx_str_number(&p, &value, UINT_MAX)) {
+        imapc->mb_uidvalidity = (unsigned int)value;
+        imapc->mb_uidvalidity_set = TRUE;
       }
     }
   }
   else if(imapcode == IMAP_RESP_OK) {
     /* Check if the UIDVALIDITY has been specified and matches */
-    if(imap->uidvalidity && imapc->mailbox_uidvalidity &&
-       !strcasecompare(imap->uidvalidity, imapc->mailbox_uidvalidity)) {
+    if(imap->uidvalidity_set && imapc->mb_uidvalidity_set &&
+       (imap->uidvalidity != imapc->mb_uidvalidity)) {
       failf(data, "Mailbox UIDVALIDITY has changed");
       result = CURLE_REMOTE_FILE_NOT_FOUND;
     }
     else {
       /* Note the currently opened mailbox on this connection */
       DEBUGASSERT(!imapc->mailbox);
-      imapc->mailbox = strdup(imap->mailbox);
+      imapc->mailbox = curlx_strdup(imap->mailbox);
       if(!imapc->mailbox)
         return CURLE_OUT_OF_MEMORY;
 
       if(imap->custom)
-        result = imap_perform_list(data);
+        result = imap_perform_list(data, imapc, imap);
       else if(imap->query)
-        result = imap_perform_search(data);
+        result = imap_perform_search(data, imapc, imap);
       else
-        result = imap_perform_fetch(data);
+        result = imap_perform_fetch(data, imapc, imap);
     }
   }
   else {
@@ -1138,130 +1395,127 @@ static CURLcode imap_state_select_resp(struct Curl_easy *data, int imapcode,
 
 /* For the (first line of the) FETCH responses */
 static CURLcode imap_state_fetch_resp(struct Curl_easy *data,
-                                      struct connectdata *conn, int imapcode,
+                                      struct imap_conn *imapc,
+                                      int imapcode,
                                       imapstate instate)
 {
   CURLcode result = CURLE_OK;
-  struct imap_conn *imapc = &conn->proto.imapc;
   struct pingpong *pp = &imapc->pp;
-  const char *ptr = data->state.buffer;
+  const char *ptr = curlx_dyn_ptr(&imapc->pp.recvbuf);
+  size_t len = imapc->pp.nfinal;
   bool parsed = FALSE;
   curl_off_t size = 0;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(imapcode != '*') {
     Curl_pgrsSetDownloadSize(data, -1);
-    imap_state(data, IMAP_STOP);
+    imap_state(data, imapc, IMAP_STOP);
     return CURLE_REMOTE_FILE_NOT_FOUND;
   }
 
   /* Something like this is received "* 1 FETCH (BODY[TEXT] {2021}\r" so parse
      the continuation data contained within the curly brackets */
-  while(*ptr && (*ptr != '{'))
+  ptr = imap_find_literal(ptr, len);
+  if(ptr) {
     ptr++;
-
-  if(*ptr == '{') {
-    char *endptr;
-    if(!curlx_strtoofft(ptr + 1, &endptr, 10, &size)) {
-      if(endptr - ptr > 1 && endptr[0] == '}' &&
-         endptr[1] == '\r' && endptr[2] == '\0')
-        parsed = TRUE;
-    }
+    if(!curlx_str_number(&ptr, &size, CURL_OFF_T_MAX) &&
+       !curlx_str_single(&ptr, '}'))
+      parsed = TRUE;
   }
 
   if(parsed) {
-    infof(data, "Found %" CURL_FORMAT_CURL_OFF_T " bytes to download",
-          size);
+    infof(data, "Found %" FMT_OFF_T " bytes to download", size);
     Curl_pgrsSetDownloadSize(data, size);
 
-    if(pp->cache) {
-      /* At this point there is a bunch of data in the header "cache" that is
-         actually body content, send it as body and then skip it. Do note
-         that there may even be additional "headers" after the body. */
-      size_t chunk = pp->cache_size;
+    if(pp->overflow) {
+      /* At this point there is a data in the receive buffer that is body
+         content, send it as body and then skip it. Do note that there may
+         even be additional "headers" after the body. */
+      size_t chunk = pp->overflow;
+
+      /* keep only the overflow */
+      curlx_dyn_tail(&pp->recvbuf, chunk);
+      pp->nfinal = 0; /* done */
 
       if(chunk > (size_t)size)
         /* The conversion from curl_off_t to size_t is always fine here */
         chunk = (size_t)size;
 
       if(!chunk) {
-        /* no size, we're done with the data */
-        imap_state(data, IMAP_STOP);
+        /* no size, we are done with the data */
+        imap_state(data, imapc, IMAP_STOP);
         return CURLE_OK;
       }
-      result = Curl_client_write(data, CLIENTWRITE_BODY, pp->cache, chunk);
+      result = Curl_client_write(data, CLIENTWRITE_BODY,
+                                 curlx_dyn_ptr(&pp->recvbuf), chunk);
       if(result)
         return result;
 
-      data->req.bytecount += chunk;
+      infof(data, "Written %zu bytes, %" FMT_OFF_T
+            " bytes are left for transfer", chunk, (curl_off_t)(size - chunk));
 
-      infof(data, "Written %zu bytes, %" CURL_FORMAT_CURL_OFF_TU
-            " bytes are left for transfer", chunk, size - chunk);
-
-      /* Have we used the entire cache or just part of it?*/
-      if(pp->cache_size > chunk) {
-        /* Only part of it so shrink the cache to fit the trailing data */
-        memmove(pp->cache, pp->cache + chunk, pp->cache_size - chunk);
-        pp->cache_size -= chunk;
+      /* Have we used the entire overflow or part of it?*/
+      if(pp->overflow > chunk) {
+        /* remember the remaining trailing overflow data */
+        pp->overflow -= chunk;
+        curlx_dyn_tail(&pp->recvbuf, pp->overflow);
       }
       else {
+        pp->overflow = 0; /* handled */
         /* Free the cache */
-        Curl_safefree(pp->cache);
-
-        /* Reset the cache size */
-        pp->cache_size = 0;
+        curlx_dyn_reset(&pp->recvbuf);
       }
     }
 
     if(data->req.bytecount == size)
       /* The entire data is already transferred! */
-      Curl_setup_transfer(data, -1, -1, FALSE, -1);
+      Curl_xfer_setup_nop(data);
     else {
       /* IMAP download */
       data->req.maxdownload = size;
-      /* force a recv/send check of this connection, as the data might've been
-       read off the socket already */
-      data->conn->cselect_bits = CURL_CSELECT_IN;
-      Curl_setup_transfer(data, FIRSTSOCKET, size, FALSE, -1);
+      Curl_xfer_setup_recv(data, FIRSTSOCKET, size);
     }
   }
   else {
-    /* We don't know how to parse this line */
+    /* We do not know how to parse this line */
     failf(data, "Failed to parse FETCH response.");
     result = CURLE_WEIRD_SERVER_REPLY;
   }
 
   /* End of DO phase */
-  imap_state(data, IMAP_STOP);
+  imap_state(data, imapc, IMAP_STOP);
 
   return result;
 }
 
 /* For final FETCH responses performed after the download */
 static CURLcode imap_state_fetch_final_resp(struct Curl_easy *data,
+                                            struct imap_conn *imapc,
                                             int imapcode,
                                             imapstate instate)
 {
   CURLcode result = CURLE_OK;
 
-  (void)instate; /* No use for this yet */
+  (void)instate;
 
   if(imapcode != IMAP_RESP_OK)
     result = CURLE_WEIRD_SERVER_REPLY;
   else
     /* End of DONE phase */
-    imap_state(data, IMAP_STOP);
+    imap_state(data, imapc, IMAP_STOP);
 
   return result;
 }
 
 /* For APPEND responses */
-static CURLcode imap_state_append_resp(struct Curl_easy *data, int imapcode,
+static CURLcode imap_state_append_resp(struct Curl_easy *data,
+                                       struct imap_conn *imapc,
+                                       int imapcode,
                                        imapstate instate)
 {
   CURLcode result = CURLE_OK;
-  (void)instate; /* No use for this yet */
+  (void)instate;
 
   if(imapcode != '+') {
     result = CURLE_UPLOAD_FAILED;
@@ -1271,10 +1525,10 @@ static CURLcode imap_state_append_resp(struct Curl_easy *data, int imapcode,
     Curl_pgrsSetUploadSize(data, data->state.infilesize);
 
     /* IMAP upload */
-    Curl_setup_transfer(data, -1, -1, FALSE, FIRSTSOCKET);
+    Curl_xfer_setup_send(data, FIRSTSOCKET);
 
     /* End of DO phase */
-    imap_state(data, IMAP_STOP);
+    imap_state(data, imapc, IMAP_STOP);
   }
 
   return result;
@@ -1282,36 +1536,43 @@ static CURLcode imap_state_append_resp(struct Curl_easy *data, int imapcode,
 
 /* For final APPEND responses performed after the upload */
 static CURLcode imap_state_append_final_resp(struct Curl_easy *data,
+                                             struct imap_conn *imapc,
                                              int imapcode,
                                              imapstate instate)
 {
   CURLcode result = CURLE_OK;
 
-  (void)instate; /* No use for this yet */
+  (void)instate;
 
   if(imapcode != IMAP_RESP_OK)
     result = CURLE_UPLOAD_FAILED;
   else
     /* End of DONE phase */
-    imap_state(data, IMAP_STOP);
+    imap_state(data, imapc, IMAP_STOP);
 
   return result;
 }
 
-static CURLcode imap_statemachine(struct Curl_easy *data,
-                                  struct connectdata *conn)
+static CURLcode imap_pp_statemachine(struct Curl_easy *data,
+                                     struct connectdata *conn)
 {
   CURLcode result = CURLE_OK;
-  curl_socket_t sock = conn->sock[FIRSTSOCKET];
   int imapcode;
-  struct imap_conn *imapc = &conn->proto.imapc;
-  struct pingpong *pp = &imapc->pp;
+  struct imap_conn *imapc = Curl_conn_meta_get(conn, CURL_META_IMAP_CONN);
+  struct IMAP *imap = Curl_meta_get(data, CURL_META_IMAP_EASY);
+  struct pingpong *pp;
   size_t nread = 0;
-  (void)data;
 
+  if(!imapc || !imap)
+    return CURLE_FAILED_INIT;
+  pp = &imapc->pp;
   /* Busy upgrading the connection; right now all I/O is SSL/TLS, not IMAP */
-  if(imapc->state == IMAP_UPGRADETLS)
-    return imap_perform_upgrade_tls(data, conn);
+upgrade_tls:
+  if(imapc->state == IMAP_UPGRADETLS) {
+    result = imap_perform_upgrade_tls(data, imapc, conn);
+    if(result || (imapc->state == IMAP_UPGRADETLS))
+      return result;
+  }
 
   /* Flush any data that needs to be sent */
   if(pp->sendleft)
@@ -1319,7 +1580,7 @@ static CURLcode imap_statemachine(struct Curl_easy *data,
 
   do {
     /* Read the response from the server */
-    result = Curl_pp_readresp(data, sock, pp, &imapcode, &nread);
+    result = Curl_pp_readresp(data, FIRSTSOCKET, pp, &imapcode, &nread);
     if(result)
       return result;
 
@@ -1333,55 +1594,62 @@ static CURLcode imap_statemachine(struct Curl_easy *data,
     /* We have now received a full IMAP server response */
     switch(imapc->state) {
     case IMAP_SERVERGREET:
-      result = imap_state_servergreet_resp(data, imapcode, imapc->state);
+      result = imap_state_servergreet_resp(data, imapc,
+                                           imapcode, imapc->state);
       break;
 
     case IMAP_CAPABILITY:
-      result = imap_state_capability_resp(data, imapcode, imapc->state);
+      result = imap_state_capability_resp(data, imapc, imapcode, imapc->state);
       break;
 
     case IMAP_STARTTLS:
-      result = imap_state_starttls_resp(data, imapcode, imapc->state);
+      result = imap_state_starttls_resp(data, imapc, imapcode, imapc->state);
+      /* During UPGRADETLS, leave the read loop as we need to connect
+       * (e.g. TLS handshake) before we continue sending/receiving. */
+      if(!result && (imapc->state == IMAP_UPGRADETLS))
+        goto upgrade_tls;
       break;
 
     case IMAP_AUTHENTICATE:
-      result = imap_state_auth_resp(data, conn, imapcode, imapc->state);
+      result = imap_state_auth_resp(data, imapc, imapcode, imapc->state);
       break;
 
     case IMAP_LOGIN:
-      result = imap_state_login_resp(data, imapcode, imapc->state);
+      result = imap_state_login_resp(data, imapc, imapcode, imapc->state);
       break;
 
     case IMAP_LIST:
     case IMAP_SEARCH:
-      result = imap_state_listsearch_resp(data, imapcode, imapc->state);
+      result = imap_state_listsearch_resp(data, imapc, imapcode, imapc->state);
       break;
 
     case IMAP_SELECT:
-      result = imap_state_select_resp(data, imapcode, imapc->state);
+      result = imap_state_select_resp(data, imapc, imap,
+                                      imapcode, imapc->state);
       break;
 
     case IMAP_FETCH:
-      result = imap_state_fetch_resp(data, conn, imapcode, imapc->state);
+      result = imap_state_fetch_resp(data, imapc, imapcode, imapc->state);
       break;
 
     case IMAP_FETCH_FINAL:
-      result = imap_state_fetch_final_resp(data, imapcode, imapc->state);
+      result = imap_state_fetch_final_resp(data, imapc,
+                                           imapcode, imapc->state);
       break;
 
     case IMAP_APPEND:
-      result = imap_state_append_resp(data, imapcode, imapc->state);
+      result = imap_state_append_resp(data, imapc, imapcode, imapc->state);
       break;
 
     case IMAP_APPEND_FINAL:
-      result = imap_state_append_final_resp(data, imapcode, imapc->state);
+      result = imap_state_append_final_resp(data, imapc,
+                                            imapcode, imapc->state);
       break;
 
     case IMAP_LOGOUT:
-      /* fallthrough, just stop! */
     default:
       /* internal error */
-      imap_state(data, IMAP_STOP);
+      imap_state(data, imapc, IMAP_STOP);
       break;
     }
   } while(!result && imapc->state != IMAP_STOP && Curl_pp_moredata(pp));
@@ -1393,29 +1661,23 @@ static CURLcode imap_statemachine(struct Curl_easy *data,
 static CURLcode imap_multi_statemach(struct Curl_easy *data, bool *done)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct imap_conn *imapc = &conn->proto.imapc;
-
-  if((conn->handler->flags & PROTOPT_SSL) && !imapc->ssldone) {
-    bool ssldone = FALSE;
-    result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssldone);
-    imapc->ssldone = ssldone;
-    if(result || !ssldone)
-      return result;
-  }
+  struct imap_conn *imapc =
+    Curl_conn_meta_get(data->conn, CURL_META_IMAP_CONN);
 
+  *done = FALSE;
+  if(!imapc)
+    return CURLE_FAILED_INIT;
   result = Curl_pp_statemach(data, &imapc->pp, FALSE, FALSE);
-  *done = (imapc->state == IMAP_STOP) ? TRUE : FALSE;
+  *done = (imapc->state == IMAP_STOP);
 
   return result;
 }
 
 static CURLcode imap_block_statemach(struct Curl_easy *data,
-                                     struct connectdata *conn,
+                                     struct imap_conn *imapc,
                                      bool disconnecting)
 {
   CURLcode result = CURLE_OK;
-  struct imap_conn *imapc = &conn->proto.imapc;
 
   while(imapc->state != IMAP_STOP && !result)
     result = Curl_pp_statemach(data, &imapc->pp, TRUE, disconnecting);
@@ -1423,429 +1685,28 @@ static CURLcode imap_block_statemach(struct Curl_easy *data,
   return result;
 }
 
-/* Allocate and initialize the struct IMAP for the current Curl_easy if
-   required */
-static CURLcode imap_init(struct Curl_easy *data)
-{
-  CURLcode result = CURLE_OK;
-  struct IMAP *imap;
-
-  imap = data->req.p.imap = calloc(sizeof(struct IMAP), 1);
-  if(!imap)
-    result = CURLE_OUT_OF_MEMORY;
-
-  return result;
-}
-
 /* For the IMAP "protocol connect" and "doing" phases only */
-static int imap_getsock(struct Curl_easy *data,
-                        struct connectdata *conn,
-                        curl_socket_t *socks)
+static CURLcode imap_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps)
 {
-  return Curl_pp_getsock(data, &conn->proto.imapc.pp, socks);
+  struct imap_conn *imapc =
+    Curl_conn_meta_get(data->conn, CURL_META_IMAP_CONN);
+  return imapc ? Curl_pp_pollset(data, &imapc->pp, ps) : CURLE_OK;
 }
 
-/***********************************************************************
- *
- * imap_connect()
- *
- * This function should do everything that is to be considered a part of the
- * connection phase.
- *
- * The variable 'done' points to will be TRUE if the protocol-layer connect
- * phase is done when this function returns, or FALSE if not.
- */
-static CURLcode imap_connect(struct Curl_easy *data, bool *done)
+static void imap_easy_reset(struct IMAP *imap)
 {
-  CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct imap_conn *imapc = &conn->proto.imapc;
-  struct pingpong *pp = &imapc->pp;
-
-  *done = FALSE; /* default to not done yet */
-
-  /* We always support persistent connections in IMAP */
-  connkeep(conn, "IMAP default");
-
-  PINGPONG_SETUP(pp, imap_statemachine, imap_endofresp);
-
-  /* Set the default preferred authentication type and mechanism */
-  imapc->preftype = IMAP_TYPE_ANY;
-  Curl_sasl_init(&imapc->sasl, data, &saslimap);
-
-  Curl_dyn_init(&imapc->dyn, DYN_IMAP_CMD);
-  /* Initialise the pingpong layer */
-  Curl_pp_setup(pp);
-  Curl_pp_init(data, pp);
-
-  /* Parse the URL options */
-  result = imap_parse_url_options(conn);
-  if(result)
-    return result;
-
-  /* Start off waiting for the server greeting response */
-  imap_state(data, IMAP_SERVERGREET);
-
-  /* Start off with an response id of '*' */
-  strcpy(imapc->resptag, "*");
-
-  result = imap_multi_statemach(data, done);
-
-  return result;
-}
-
-/***********************************************************************
- *
- * imap_done()
- *
- * The DONE function. This does what needs to be done after a single DO has
- * performed.
- *
- * Input argument is already checked for validity.
- */
-static CURLcode imap_done(struct Curl_easy *data, CURLcode status,
-                          bool premature)
-{
-  CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct IMAP *imap = data->req.p.imap;
-
-  (void)premature;
-
-  if(!imap)
-    return CURLE_OK;
-
-  if(status) {
-    connclose(conn, "IMAP done with bad status"); /* marked for closure */
-    result = status;         /* use the already set error code */
-  }
-  else if(!data->set.connect_only && !imap->custom &&
-          (imap->uid || imap->mindex || data->state.upload ||
-          data->set.mimepost.kind != MIMEKIND_NONE)) {
-    /* Handle responses after FETCH or APPEND transfer has finished */
-
-    if(!data->state.upload && data->set.mimepost.kind == MIMEKIND_NONE)
-      imap_state(data, IMAP_FETCH_FINAL);
-    else {
-      /* End the APPEND command first by sending an empty line */
-      result = Curl_pp_sendf(data, &conn->proto.imapc.pp, "%s", "");
-      if(!result)
-        imap_state(data, IMAP_APPEND_FINAL);
-    }
-
-    /* Run the state-machine */
-    if(!result)
-      result = imap_block_statemach(data, conn, FALSE);
-  }
-
-  /* Cleanup our per-request based variables */
-  Curl_safefree(imap->mailbox);
-  Curl_safefree(imap->uidvalidity);
-  Curl_safefree(imap->uid);
-  Curl_safefree(imap->mindex);
-  Curl_safefree(imap->section);
-  Curl_safefree(imap->partial);
-  Curl_safefree(imap->query);
-  Curl_safefree(imap->custom);
-  Curl_safefree(imap->custom_params);
-
+  curlx_safefree(imap->mailbox);
+  curlx_safefree(imap->uid);
+  curlx_safefree(imap->mindex);
+  curlx_safefree(imap->section);
+  curlx_safefree(imap->partial);
+  curlx_safefree(imap->query);
+  curlx_safefree(imap->custom);
+  curlx_safefree(imap->custom_params);
+  imap->uidvalidity_set = FALSE;
   /* Clear the transfer mode for the next request */
   imap->transfer = PPTRANSFER_BODY;
-
-  return result;
-}
-
-/***********************************************************************
- *
- * imap_perform()
- *
- * This is the actual DO function for IMAP. Fetch or append a message, or do
- * other things according to the options previously setup.
- */
-static CURLcode imap_perform(struct Curl_easy *data, bool *connected,
-                             bool *dophase_done)
-{
-  /* This is IMAP and no proxy */
-  CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct IMAP *imap = data->req.p.imap;
-  struct imap_conn *imapc = &conn->proto.imapc;
-  bool selected = FALSE;
-
-  DEBUGF(infof(data, "DO phase starts"));
-
-  if(data->req.no_body) {
-    /* Requested no body means no transfer */
-    imap->transfer = PPTRANSFER_INFO;
-  }
-
-  *dophase_done = FALSE; /* not done yet */
-
-  /* Determine if the requested mailbox (with the same UIDVALIDITY if set)
-     has already been selected on this connection */
-  if(imap->mailbox && imapc->mailbox &&
-     strcasecompare(imap->mailbox, imapc->mailbox) &&
-     (!imap->uidvalidity || !imapc->mailbox_uidvalidity ||
-      strcasecompare(imap->uidvalidity, imapc->mailbox_uidvalidity)))
-    selected = TRUE;
-
-  /* Start the first command in the DO phase */
-  if(data->state.upload || data->set.mimepost.kind != MIMEKIND_NONE)
-    /* APPEND can be executed directly */
-    result = imap_perform_append(data);
-  else if(imap->custom && (selected || !imap->mailbox))
-    /* Custom command using the same mailbox or no mailbox */
-    result = imap_perform_list(data);
-  else if(!imap->custom && selected && (imap->uid || imap->mindex))
-    /* FETCH from the same mailbox */
-    result = imap_perform_fetch(data);
-  else if(!imap->custom && selected && imap->query)
-    /* SEARCH the current mailbox */
-    result = imap_perform_search(data);
-  else if(imap->mailbox && !selected &&
-         (imap->custom || imap->uid || imap->mindex || imap->query))
-    /* SELECT the mailbox */
-    result = imap_perform_select(data);
-  else
-    /* LIST */
-    result = imap_perform_list(data);
-
-  if(result)
-    return result;
-
-  /* Run the state-machine */
-  result = imap_multi_statemach(data, dophase_done);
-
-  *connected = Curl_conn_is_connected(conn, FIRSTSOCKET);
-
-  if(*dophase_done)
-    DEBUGF(infof(data, "DO phase is complete"));
-
-  return result;
-}
-
-/***********************************************************************
- *
- * imap_do()
- *
- * This function is registered as 'curl_do' function. It decodes the path
- * parts etc as a wrapper to the actual DO function (imap_perform).
- *
- * The input argument is already checked for validity.
- */
-static CURLcode imap_do(struct Curl_easy *data, bool *done)
-{
-  CURLcode result = CURLE_OK;
-  *done = FALSE; /* default to false */
-
-  /* Parse the URL path */
-  result = imap_parse_url_path(data);
-  if(result)
-    return result;
-
-  /* Parse the custom request */
-  result = imap_parse_custom_request(data);
-  if(result)
-    return result;
-
-  result = imap_regular_transfer(data, done);
-
-  return result;
-}
-
-/***********************************************************************
- *
- * imap_disconnect()
- *
- * Disconnect from an IMAP server. Cleanup protocol-specific per-connection
- * resources. BLOCKING.
- */
-static CURLcode imap_disconnect(struct Curl_easy *data,
-                                struct connectdata *conn, bool dead_connection)
-{
-  struct imap_conn *imapc = &conn->proto.imapc;
-  (void)data;
-
-  /* We cannot send quit unconditionally. If this connection is stale or
-     bad in any way, sending quit and waiting around here will make the
-     disconnect wait in vain and cause more problems than we need to. */
-
-  /* The IMAP session may or may not have been allocated/setup at this
-     point! */
-  if(!dead_connection && conn->bits.protoconnstart) {
-    if(!imap_perform_logout(data))
-      (void)imap_block_statemach(data, conn, TRUE); /* ignore errors */
-  }
-
-  /* Disconnect from the server */
-  Curl_pp_disconnect(&imapc->pp);
-  Curl_dyn_free(&imapc->dyn);
-
-  /* Cleanup the SASL module */
-  Curl_sasl_cleanup(conn, imapc->sasl.authused);
-
-  /* Cleanup our connection based variables */
-  Curl_safefree(imapc->mailbox);
-  Curl_safefree(imapc->mailbox_uidvalidity);
-
-  return CURLE_OK;
-}
-
-/* Call this when the DO phase has completed */
-static CURLcode imap_dophase_done(struct Curl_easy *data, bool connected)
-{
-  struct IMAP *imap = data->req.p.imap;
-
-  (void)connected;
-
-  if(imap->transfer != PPTRANSFER_BODY)
-    /* no data to transfer */
-    Curl_setup_transfer(data, -1, -1, FALSE, -1);
-
-  return CURLE_OK;
-}
-
-/* Called from multi.c while DOing */
-static CURLcode imap_doing(struct Curl_easy *data, bool *dophase_done)
-{
-  CURLcode result = imap_multi_statemach(data, dophase_done);
-
-  if(result)
-    DEBUGF(infof(data, "DO phase failed"));
-  else if(*dophase_done) {
-    result = imap_dophase_done(data, FALSE /* not connected */);
-
-    DEBUGF(infof(data, "DO phase is complete"));
-  }
-
-  return result;
-}
-
-/***********************************************************************
- *
- * imap_regular_transfer()
- *
- * The input argument is already checked for validity.
- *
- * Performs all commands done before a regular transfer between a local and a
- * remote host.
- */
-static CURLcode imap_regular_transfer(struct Curl_easy *data,
-                                      bool *dophase_done)
-{
-  CURLcode result = CURLE_OK;
-  bool connected = FALSE;
-
-  /* Make sure size is unknown at this point */
-  data->req.size = -1;
-
-  /* Set the progress data */
-  Curl_pgrsSetUploadCounter(data, 0);
-  Curl_pgrsSetDownloadCounter(data, 0);
-  Curl_pgrsSetUploadSize(data, -1);
-  Curl_pgrsSetDownloadSize(data, -1);
-
-  /* Carry out the perform */
-  result = imap_perform(data, &connected, dophase_done);
-
-  /* Perform post DO phase operations if necessary */
-  if(!result && *dophase_done)
-    result = imap_dophase_done(data, connected);
-
-  return result;
-}
-
-static CURLcode imap_setup_connection(struct Curl_easy *data,
-                                      struct connectdata *conn)
-{
-  /* Initialise the IMAP layer */
-  CURLcode result = imap_init(data);
-  if(result)
-    return result;
-
-  /* Clear the TLS upgraded flag */
-  conn->bits.tls_upgraded = FALSE;
-
-  return CURLE_OK;
-}
-
-/***********************************************************************
- *
- * imap_sendf()
- *
- * Sends the formatted string as an IMAP command to the server.
- *
- * Designed to never block.
- */
-static CURLcode imap_sendf(struct Curl_easy *data, const char *fmt, ...)
-{
-  CURLcode result = CURLE_OK;
-  struct imap_conn *imapc = &data->conn->proto.imapc;
-
-  DEBUGASSERT(fmt);
-
-  /* Calculate the tag based on the connection ID and command ID */
-  msnprintf(imapc->resptag, sizeof(imapc->resptag), "%c%03d",
-            'A' + curlx_sltosi((long)(data->conn->connection_id % 26)),
-            ++imapc->cmdid);
-
-  /* start with a blank buffer */
-  Curl_dyn_reset(&imapc->dyn);
-
-  /* append tag + space + fmt */
-  result = Curl_dyn_addf(&imapc->dyn, "%s %s", imapc->resptag, fmt);
-  if(!result) {
-    va_list ap;
-    va_start(ap, fmt);
-    result = Curl_pp_vsendf(data, &imapc->pp, Curl_dyn_ptr(&imapc->dyn), ap);
-    va_end(ap);
-  }
-  return result;
-}
-
-/***********************************************************************
- *
- * imap_atom()
- *
- * Checks the input string for characters that need escaping and returns an
- * atom ready for sending to the server.
- *
- * The returned string needs to be freed.
- *
- */
-static char *imap_atom(const char *str, bool escape_only)
-{
-  struct dynbuf line;
-  size_t nclean;
-  size_t len;
-
-  if(!str)
-    return NULL;
-
-  len = strlen(str);
-  nclean = strcspn(str, "() {%*]\\\"");
-  if(len == nclean)
-    /* nothing to escape, return a strdup */
-    return strdup(str);
-
-  Curl_dyn_init(&line, 2000);
-
-  if(!escape_only && Curl_dyn_addn(&line, "\"", 1))
-    return NULL;
-
-  while(*str) {
-    if((*str == '\\' || *str == '"') &&
-       Curl_dyn_addn(&line, "\\", 1))
-      return NULL;
-    if(Curl_dyn_addn(&line, str, 1))
-      return NULL;
-    str++;
-  }
-
-  if(!escape_only && Curl_dyn_addn(&line, "\"", 1))
-    return NULL;
-
-  return Curl_dyn_ptr(&line);
 }
 
 /***********************************************************************
@@ -1857,28 +1718,9 @@ static char *imap_atom(const char *str, bool escape_only)
  */
 static bool imap_is_bchar(char ch)
 {
-  /* Performing the alnum check with this macro is faster because of ASCII
+  /* Performing the alnum check first with macro is faster because of ASCII
      arithmetic */
-  if(ISALNUM(ch))
-    return true;
-
-  switch(ch) {
-    /* bchar */
-    case ':': case '@': case '/':
-    /* bchar -> achar */
-    case '&': case '=':
-    /* bchar -> achar -> uchar -> unreserved (without alphanumeric) */
-    case '-': case '.': case '_': case '~':
-    /* bchar -> achar -> uchar -> sub-delims-sh */
-    case '!': case '$': case '\'': case '(': case ')': case '*':
-    case '+': case ',':
-    /* bchar -> achar -> uchar -> pct-encoded */
-    case '%': /* HEXDIG chars are already included above */
-      return true;
-
-    default:
-      return false;
-  }
+  return ch && (ISALNUM(ch) || strchr(":@/&=-._~!$\'()*+,%", ch));
 }
 
 /***********************************************************************
@@ -1887,12 +1729,12 @@ static bool imap_is_bchar(char ch)
  *
  * Parse the URL login options.
  */
-static CURLcode imap_parse_url_options(struct connectdata *conn)
+static CURLcode imap_parse_url_options(struct connectdata *conn,
+                                       struct imap_conn *imapc)
 {
   CURLcode result = CURLE_OK;
-  struct imap_conn *imapc = &conn->proto.imapc;
   const char *ptr = conn->options;
-  bool prefer_login = false;
+  bool prefer_login = FALSE;
 
   while(!result && ptr && *ptr) {
     const char *key = ptr;
@@ -1906,18 +1748,18 @@ static CURLcode imap_parse_url_options(struct connectdata *conn)
     while(*ptr && *ptr != ';')
       ptr++;
 
-    if(strncasecompare(key, "AUTH=+LOGIN", 11)) {
+    if(curl_strnequal(key, "AUTH=+LOGIN", 11)) {
       /* User prefers plaintext LOGIN over any SASL, including SASL LOGIN */
-      prefer_login = true;
+      prefer_login = TRUE;
       imapc->sasl.prefmech = SASL_AUTH_NONE;
     }
-    else if(strncasecompare(key, "AUTH=", 5)) {
-      prefer_login = false;
+    else if(curl_strnequal(key, "AUTH=", 5)) {
+      prefer_login = FALSE;
       result = Curl_sasl_parse_url_auth_option(&imapc->sasl,
                                                value, ptr - value);
     }
     else {
-      prefer_login = false;
+      prefer_login = FALSE;
       result = CURLE_URL_MALFORMAT;
     }
 
@@ -1951,11 +1793,11 @@ static CURLcode imap_parse_url_options(struct connectdata *conn)
  * Parse the URL path into separate path components.
  *
  */
-static CURLcode imap_parse_url_path(struct Curl_easy *data)
+static CURLcode imap_parse_url_path(struct Curl_easy *data,
+                                    struct IMAP *imap)
 {
-  /* The imap struct is already initialised in imap_connect() */
+  /* The imap struct is already initialized in imap_connect() */
   CURLcode result = CURLE_OK;
-  struct IMAP *imap = data->req.p.imap;
   const char *begin = &data->state.up.path[1]; /* skip leading slash */
   const char *ptr = begin;
 
@@ -2006,68 +1848,61 @@ static CURLcode imap_parse_url_path(struct Curl_easy *data)
     result = Curl_urldecode(begin, ptr - begin, &value, &valuelen,
                             REJECT_CTRL);
     if(result) {
-      free(name);
+      curlx_free(name);
       return result;
     }
 
     DEBUGF(infof(data, "IMAP URL parameter '%s' = '%s'", name, value));
 
-    /* Process the known hierarchical parameters (UIDVALIDITY, UID, SECTION and
-       PARTIAL) stripping of the trailing slash character if it is present.
+    /* Process the known hierarchical parameters (UIDVALIDITY, UID, SECTION
+       and PARTIAL) stripping of the trailing slash character if it is
+       present.
 
        Note: Unknown parameters trigger a URL_MALFORMAT error. */
-    if(strcasecompare(name, "UIDVALIDITY") && !imap->uidvalidity) {
-      if(valuelen > 0 && value[valuelen - 1] == '/')
-        value[valuelen - 1] = '\0';
-
-      imap->uidvalidity = value;
-      value = NULL;
+    if(valuelen > 0 && value[valuelen - 1] == '/')
+      value[valuelen - 1] = '\0';
+    if(valuelen) {
+      if(curl_strequal(name, "UIDVALIDITY") && !imap->uidvalidity_set) {
+        curl_off_t num;
+        const char *p = (const char *)value;
+        if(!curlx_str_number(&p, &num, UINT_MAX)) {
+          imap->uidvalidity = (unsigned int)num;
+          imap->uidvalidity_set = TRUE;
+        }
+        curlx_free(value);
+      }
+      else if(curl_strequal(name, "UID") && !imap->uid) {
+        imap->uid = value;
+      }
+      else if(curl_strequal(name, "MAILINDEX") && !imap->mindex) {
+        imap->mindex = value;
+      }
+      else if(curl_strequal(name, "SECTION") && !imap->section) {
+        imap->section = value;
+      }
+      else if(curl_strequal(name, "PARTIAL") && !imap->partial) {
+        imap->partial = value;
+      }
+      else {
+        curlx_free(name);
+        curlx_free(value);
+        return CURLE_URL_MALFORMAT;
+      }
     }
-    else if(strcasecompare(name, "UID") && !imap->uid) {
-      if(valuelen > 0 && value[valuelen - 1] == '/')
-        value[valuelen - 1] = '\0';
-
-      imap->uid = value;
-      value = NULL;
-    }
-    else if(strcasecompare(name, "MAILINDEX") && !imap->mindex) {
-      if(valuelen > 0 && value[valuelen - 1] == '/')
-        value[valuelen - 1] = '\0';
-
-      imap->mindex = value;
-      value = NULL;
-    }
-    else if(strcasecompare(name, "SECTION") && !imap->section) {
-      if(valuelen > 0 && value[valuelen - 1] == '/')
-        value[valuelen - 1] = '\0';
-
-      imap->section = value;
-      value = NULL;
-    }
-    else if(strcasecompare(name, "PARTIAL") && !imap->partial) {
-      if(valuelen > 0 && value[valuelen - 1] == '/')
-        value[valuelen - 1] = '\0';
-
-      imap->partial = value;
-      value = NULL;
-    }
-    else {
-      free(name);
-      free(value);
-
-      return CURLE_URL_MALFORMAT;
-    }
-
-    free(name);
-    free(value);
+    else
+      /* blank? */
+      curlx_free(value);
+    curlx_free(name);
   }
 
   /* Does the URL contain a query parameter? Only valid when we have a mailbox
      and no UID as per RFC-5092 */
   if(imap->mailbox && !imap->uid && !imap->mindex) {
     /* Get the query parameter, URL decoded */
-    (void)curl_url_get(data->state.uh, CURLUPART_QUERY, &imap->query,
-                       CURLU_URLDECODE);
+    CURLUcode uc = curl_url_get(data->state.uh, CURLUPART_QUERY, &imap->query,
+                                CURLU_URLDECODE);
+    if(uc == CURLUE_OUT_OF_MEMORY)
+      return CURLE_OUT_OF_MEMORY;
   }
 
   /* Any extra stuff at the end of the URL is an error */
@@ -2083,10 +1918,10 @@ static CURLcode imap_parse_url_path(struct Curl_easy *data)
  *
  * Parse the custom request.
  */
-static CURLcode imap_parse_custom_request(struct Curl_easy *data)
+static CURLcode imap_parse_custom_request(struct Curl_easy *data,
+                                          struct IMAP *imap)
 {
   CURLcode result = CURLE_OK;
-  struct IMAP *imap = data->req.p.imap;
   const char *custom = data->set.str[STRING_CUSTOMREQUEST];
 
   if(custom) {
@@ -2101,7 +1936,7 @@ static CURLcode imap_parse_custom_request(struct Curl_easy *data)
         params++;
 
       if(*params) {
-        imap->custom_params = strdup(params);
+        imap->custom_params = curlx_strdup(params);
         imap->custom[params - imap->custom] = '\0';
 
         if(!imap->custom_params)
@@ -2113,4 +1948,379 @@ static CURLcode imap_parse_custom_request(struct Curl_easy *data)
   return result;
 }
 
+/***********************************************************************
+ *
+ * imap_connect()
+ *
+ * This function should do everything that is to be considered a part of the
+ * connection phase.
+ *
+ * The variable 'done' points to will be TRUE if the protocol-layer connect
+ * phase is done when this function returns, or FALSE if not.
+ */
+static CURLcode imap_connect(struct Curl_easy *data, bool *done)
+{
+  struct imap_conn *imapc =
+    Curl_conn_meta_get(data->conn, CURL_META_IMAP_CONN);
+  CURLcode result = CURLE_OK;
+
+  *done = FALSE; /* default to not done yet */
+  if(!imapc)
+    return CURLE_FAILED_INIT;
+
+  /* Parse the URL options */
+  result = imap_parse_url_options(data->conn, imapc);
+  if(result)
+    return result;
+
+  /* Start off waiting for the server greeting response */
+  imap_state(data, imapc, IMAP_SERVERGREET);
+
+  /* Start off with an response id of '*' */
+  curlx_strcopy(imapc->resptag, sizeof(imapc->resptag), STRCONST("*"));
+
+  result = imap_multi_statemach(data, done);
+
+  return result;
+}
+
+/***********************************************************************
+ *
+ * imap_done()
+ *
+ * The DONE function. This does what needs to be done after a single DO has
+ * performed.
+ *
+ * Input argument is already checked for validity.
+ */
+static CURLcode imap_done(struct Curl_easy *data, CURLcode status,
+                          bool premature)
+{
+  CURLcode result = CURLE_OK;
+  struct connectdata *conn = data->conn;
+  struct imap_conn *imapc = Curl_conn_meta_get(conn, CURL_META_IMAP_CONN);
+  struct IMAP *imap = Curl_meta_get(data, CURL_META_IMAP_EASY);
+
+  (void)premature;
+
+  if(!imapc)
+    return CURLE_FAILED_INIT;
+  if(!imap)
+    return CURLE_OK;
+
+  if(status) {
+    connclose(conn, "IMAP done with bad status"); /* marked for closure */
+    result = status;         /* use the already set error code */
+  }
+  else if(!data->set.connect_only &&
+          ((!imap->custom && (imap->uid || imap->mindex)) ||
+           (imap->custom && data->req.maxdownload > 0) ||
+           data->state.upload || IS_MIME_POST(data))) {
+    /* Handle responses after FETCH or APPEND transfer has finished.
+       For custom commands, check if we set up a download which indicates
+       a FETCH-like command with literal data. */
+
+    if(!data->state.upload && !IS_MIME_POST(data))
+      imap_state(data, imapc, IMAP_FETCH_FINAL);
+    else {
+      /* End the APPEND command first by sending an empty line */
+      result = Curl_pp_sendf(data, &imapc->pp, "%s", "");
+      if(!result)
+        imap_state(data, imapc, IMAP_APPEND_FINAL);
+    }
+
+    /* Run the state-machine */
+    if(!result)
+      result = imap_block_statemach(data, imapc, FALSE);
+  }
+
+  imap_easy_reset(imap);
+  return result;
+}
+
+/***********************************************************************
+ *
+ * imap_perform()
+ *
+ * This is the actual DO function for IMAP. Fetch or append a message, or do
+ * other things according to the options previously setup.
+ */
+static CURLcode imap_perform(struct Curl_easy *data, bool *connected,
+                             bool *dophase_done)
+{
+  /* This is IMAP and no proxy */
+  CURLcode result = CURLE_OK;
+  struct connectdata *conn = data->conn;
+  struct imap_conn *imapc = Curl_conn_meta_get(conn, CURL_META_IMAP_CONN);
+  struct IMAP *imap = Curl_meta_get(data, CURL_META_IMAP_EASY);
+  bool selected = FALSE;
+
+  DEBUGF(infof(data, "DO phase starts"));
+  if(!imapc || !imap)
+    return CURLE_FAILED_INIT;
+
+  if(data->req.no_body) {
+    /* Requested no body means no transfer */
+    imap->transfer = PPTRANSFER_INFO;
+  }
+
+  *dophase_done = FALSE; /* not done yet */
+
+  /* Determine if the requested mailbox (with the same UIDVALIDITY if set)
+     has already been selected on this connection */
+  if(imap->mailbox && imapc->mailbox &&
+     curl_strequal(imap->mailbox, imapc->mailbox) &&
+     (!imap->uidvalidity_set || !imapc->mb_uidvalidity_set ||
+      (imap->uidvalidity == imapc->mb_uidvalidity)))
+    selected = TRUE;
+
+  /* Start the first command in the DO phase */
+  if(data->state.upload || IS_MIME_POST(data))
+    /* APPEND can be executed directly */
+    result = imap_perform_append(data, imapc, imap);
+  else if(imap->custom && (selected || !imap->mailbox))
+    /* Custom command using the same mailbox or no mailbox */
+    result = imap_perform_list(data, imapc, imap);
+  else if(!imap->custom && selected && (imap->uid || imap->mindex))
+    /* FETCH from the same mailbox */
+    result = imap_perform_fetch(data, imapc, imap);
+  else if(!imap->custom && selected && imap->query)
+    /* SEARCH the current mailbox */
+    result = imap_perform_search(data, imapc, imap);
+  else if(imap->mailbox && !selected &&
+          (imap->custom || imap->uid || imap->mindex || imap->query))
+    /* SELECT the mailbox */
+    result = imap_perform_select(data, imapc, imap);
+  else
+    /* LIST */
+    result = imap_perform_list(data, imapc, imap);
+
+  if(result)
+    return result;
+
+  /* Run the state-machine */
+  result = imap_multi_statemach(data, dophase_done);
+
+  *connected = Curl_conn_is_connected(conn, FIRSTSOCKET);
+
+  if(*dophase_done)
+    DEBUGF(infof(data, "DO phase is complete"));
+
+  return result;
+}
+
+/* Call this when the DO phase has completed */
+static CURLcode imap_dophase_done(struct Curl_easy *data,
+                                  struct IMAP *imap,
+                                  bool connected)
+{
+  (void)connected;
+
+  if(imap->transfer != PPTRANSFER_BODY)
+    /* no data to transfer */
+    Curl_xfer_setup_nop(data);
+
+  return CURLE_OK;
+}
+
+/***********************************************************************
+ *
+ * imap_regular_transfer()
+ *
+ * The input argument is already checked for validity.
+ *
+ * Performs all commands done before a regular transfer between a local and a
+ * remote host.
+ */
+static CURLcode imap_regular_transfer(struct Curl_easy *data,
+                                      struct IMAP *imap,
+                                      bool *dophase_done)
+{
+  CURLcode result = CURLE_OK;
+  bool connected = FALSE;
+
+  /* Make sure size is unknown at this point */
+  data->req.size = -1;
+
+  /* Set the progress data */
+  Curl_pgrsReset(data);
+
+  /* Carry out the perform */
+  result = imap_perform(data, &connected, dophase_done);
+
+  /* Perform post DO phase operations if necessary */
+  if(!result && *dophase_done)
+    result = imap_dophase_done(data, imap, connected);
+
+  return result;
+}
+
+/***********************************************************************
+ *
+ * imap_do()
+ *
+ * This function is registered as 'curl_do' function. It decodes the path
+ * parts etc as a wrapper to the actual DO function (imap_perform).
+ *
+ * The input argument is already checked for validity.
+ */
+static CURLcode imap_do(struct Curl_easy *data, bool *done)
+{
+  struct IMAP *imap = Curl_meta_get(data, CURL_META_IMAP_EASY);
+  CURLcode result = CURLE_OK;
+  *done = FALSE; /* default to false */
+
+  if(!imap)
+    return CURLE_FAILED_INIT;
+  /* Parse the URL path */
+  result = imap_parse_url_path(data, imap);
+  if(result)
+    return result;
+
+  /* Parse the custom request */
+  result = imap_parse_custom_request(data, imap);
+  if(result)
+    return result;
+
+  result = imap_regular_transfer(data, imap, done);
+
+  return result;
+}
+
+/***********************************************************************
+ *
+ * imap_disconnect()
+ *
+ * Disconnect from an IMAP server. Cleanup protocol-specific per-connection
+ * resources. BLOCKING.
+ */
+static CURLcode imap_disconnect(struct Curl_easy *data,
+                                struct connectdata *conn, bool dead_connection)
+{
+  struct imap_conn *imapc = Curl_conn_meta_get(conn, CURL_META_IMAP_CONN);
+
+  if(imapc) {
+    /* We cannot send quit unconditionally. If this connection is stale or
+       bad in any way (pingpong has pending data to send),
+       sending quit and waiting around here will make the
+       disconnect wait in vain and cause more problems than we need to. */
+    if(!dead_connection && conn->bits.protoconnstart &&
+       !Curl_pp_needs_flush(data, &imapc->pp)) {
+      if(!imap_perform_logout(data, imapc))
+        (void)imap_block_statemach(data, imapc, TRUE); /* ignore errors */
+    }
+  }
+  return CURLE_OK;
+}
+
+/* Called from multi.c while DOing */
+static CURLcode imap_doing(struct Curl_easy *data, bool *dophase_done)
+{
+  struct IMAP *imap = Curl_meta_get(data, CURL_META_IMAP_EASY);
+  CURLcode result;
+
+  if(!imap)
+    return CURLE_FAILED_INIT;
+
+  result = imap_multi_statemach(data, dophase_done);
+  if(result)
+    DEBUGF(infof(data, "DO phase failed"));
+  else if(*dophase_done) {
+    result = imap_dophase_done(data, imap, FALSE /* not connected */);
+
+    DEBUGF(infof(data, "DO phase is complete"));
+  }
+
+  return result;
+}
+
+static void imap_easy_dtor(void *key, size_t klen, void *entry)
+{
+  struct IMAP *imap = entry;
+  (void)key;
+  (void)klen;
+  imap_easy_reset(imap);
+  curlx_free(imap);
+}
+
+static void imap_conn_dtor(void *key, size_t klen, void *entry)
+{
+  struct imap_conn *imapc = entry;
+  (void)key;
+  (void)klen;
+  Curl_pp_disconnect(&imapc->pp);
+  curlx_dyn_free(&imapc->dyn);
+  curlx_safefree(imapc->mailbox);
+  curlx_free(imapc);
+}
+
+/* SASL parameters for the imap protocol */
+static const struct SASLproto saslimap = {
+  "imap",                     /* The service name */
+  imap_perform_authenticate,  /* Send authentication command */
+  imap_continue_authenticate, /* Send authentication continuation */
+  imap_cancel_authenticate,   /* Send authentication cancellation */
+  imap_get_message,           /* Get SASL response message */
+  0,                          /* No maximum initial response length */
+  '+',                        /* Code received when continuation is expected */
+  IMAP_RESP_OK,               /* Code to receive upon authentication success */
+  SASL_AUTH_DEFAULT,          /* Default mechanisms */
+  SASL_FLAG_BASE64            /* Configuration flags */
+};
+
+static CURLcode imap_setup_connection(struct Curl_easy *data,
+                                      struct connectdata *conn)
+{
+  struct imap_conn *imapc;
+  struct pingpong *pp;
+  struct IMAP *imap;
+
+  imapc = curlx_calloc(1, sizeof(*imapc));
+  if(!imapc)
+    return CURLE_OUT_OF_MEMORY;
+
+  pp = &imapc->pp;
+  PINGPONG_SETUP(pp, imap_pp_statemachine, imap_endofresp);
+
+  /* Set the default preferred authentication type and mechanism */
+  imapc->preftype = IMAP_TYPE_ANY;
+  Curl_sasl_init(&imapc->sasl, data, &saslimap);
+
+  curlx_dyn_init(&imapc->dyn, DYN_IMAP_CMD);
+  Curl_pp_init(pp, Curl_pgrs_now(data));
+
+  if(Curl_conn_meta_set(conn, CURL_META_IMAP_CONN, imapc, imap_conn_dtor))
+    return CURLE_OUT_OF_MEMORY;
+
+  imap = curlx_calloc(1, sizeof(struct IMAP));
+  if(!imap ||
+     Curl_meta_set(data, CURL_META_IMAP_EASY, imap, imap_easy_dtor))
+    return CURLE_OUT_OF_MEMORY;
+
+  return CURLE_OK;
+}
+
+/*
+ * IMAP protocol.
+ */
+const struct Curl_protocol Curl_protocol_imap = {
+  imap_setup_connection,            /* setup_connection */
+  imap_do,                          /* do_it */
+  imap_done,                        /* done */
+  ZERO_NULL,                        /* do_more */
+  imap_connect,                     /* connect_it */
+  imap_multi_statemach,             /* connecting */
+  imap_doing,                       /* doing */
+  imap_pollset,                     /* proto_pollset */
+  imap_pollset,                     /* doing_pollset */
+  ZERO_NULL,                        /* domore_pollset */
+  ZERO_NULL,                        /* perform_pollset */
+  imap_disconnect,                  /* disconnect */
+  ZERO_NULL,                        /* write_resp */
+  ZERO_NULL,                        /* write_resp_hd */
+  ZERO_NULL,                        /* connection_is_dead */
+  ZERO_NULL,                        /* attach connection */
+  ZERO_NULL,                        /* follow */
+};
+
 #endif /* CURL_DISABLE_IMAP */
diff --git a/third-party/curl/lib/imap.h b/third-party/curl/lib/imap.h
index 784ee97e55..ecfb1ec9b9 100644
--- a/third-party/curl/lib/imap.h
+++ b/third-party/curl/lib/imap.h
@@ -24,78 +24,16 @@
  *
  ***************************************************************************/
 
-#include "pingpong.h"
-#include "curl_sasl.h"
-
-/****************************************************************************
- * IMAP unique setup
- ***************************************************************************/
-typedef enum {
-  IMAP_STOP,         /* do nothing state, stops the state machine */
-  IMAP_SERVERGREET,  /* waiting for the initial greeting immediately after
-                        a connect */
-  IMAP_CAPABILITY,
-  IMAP_STARTTLS,
-  IMAP_UPGRADETLS,   /* asynchronously upgrade the connection to SSL/TLS
-                       (multi mode only) */
-  IMAP_AUTHENTICATE,
-  IMAP_LOGIN,
-  IMAP_LIST,
-  IMAP_SELECT,
-  IMAP_FETCH,
-  IMAP_FETCH_FINAL,
-  IMAP_APPEND,
-  IMAP_APPEND_FINAL,
-  IMAP_SEARCH,
-  IMAP_LOGOUT,
-  IMAP_LAST          /* never used */
-} imapstate;
-
-/* This IMAP struct is used in the Curl_easy. All IMAP data that is
-   connection-oriented must be in imap_conn to properly deal with the fact that
-   perhaps the Curl_easy is changed between the times the connection is
-   used. */
-struct IMAP {
-  curl_pp_transfer transfer;
-  char *mailbox;          /* Mailbox to select */
-  char *uidvalidity;      /* UIDVALIDITY to check in select */
-  char *uid;              /* Message UID to fetch */
-  char *mindex;           /* Index in mail box of mail to fetch */
-  char *section;          /* Message SECTION to fetch */
-  char *partial;          /* Message PARTIAL to fetch */
-  char *query;            /* Query to search for */
-  char *custom;           /* Custom request */
-  char *custom_params;    /* Parameters for the custom request */
-};
-
-/* imap_conn is used for struct connection-oriented data in the connectdata
-   struct */
-struct imap_conn {
-  struct pingpong pp;
-  struct SASL sasl;           /* SASL-related parameters */
-  struct dynbuf dyn;          /* for the IMAP commands */
-  char *mailbox;              /* The last selected mailbox */
-  char *mailbox_uidvalidity;  /* UIDVALIDITY parsed from select response */
-  imapstate state;            /* Always use imap.c:state() to change state! */
-  char resptag[5];            /* Response tag to wait for */
-  unsigned char preftype;     /* Preferred authentication type */
-  unsigned char cmdid;        /* Last used command ID */
-  BIT(ssldone);               /* Is connect() over SSL done? */
-  BIT(preauth);               /* Is this connection PREAUTH? */
-  BIT(tls_supported);         /* StartTLS capability supported by server */
-  BIT(login_disabled);        /* LOGIN command disabled by server */
-  BIT(ir_supported);          /* Initial response supported by server */
-};
-
-extern const struct Curl_handler Curl_handler_imap;
-extern const struct Curl_handler Curl_handler_imaps;
-
 /* Authentication type flags */
 #define IMAP_TYPE_CLEARTEXT (1 << 0)
 #define IMAP_TYPE_SASL      (1 << 1)
 
 /* Authentication type values */
 #define IMAP_TYPE_NONE      0
-#define IMAP_TYPE_ANY       (IMAP_TYPE_CLEARTEXT|IMAP_TYPE_SASL)
+#define IMAP_TYPE_ANY       (IMAP_TYPE_CLEARTEXT | IMAP_TYPE_SASL)
+
+#ifndef CURL_DISABLE_IMAP
+extern const struct Curl_protocol Curl_protocol_imap;
+#endif
 
 #endif /* HEADER_CURL_IMAP_H */
diff --git a/third-party/curl/lib/inet_ntop.c b/third-party/curl/lib/inet_ntop.c
deleted file mode 100644
index 135f4866c6..0000000000
--- a/third-party/curl/lib/inet_ntop.c
+++ /dev/null
@@ -1,205 +0,0 @@
-/*
- * Copyright (C) 1996-2022  Internet Software Consortium.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
- * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
- * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
- * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * SPDX-License-Identifier: ISC
- */
-/*
- * Original code by Paul Vixie. "curlified" by Gisle Vanem.
- */
-
-#include "curl_setup.h"
-
-#ifndef HAVE_INET_NTOP
-
-#ifdef HAVE_SYS_PARAM_H
-#include <sys/param.h>
-#endif
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-
-#include "inet_ntop.h"
-#include "curl_printf.h"
-
-#define IN6ADDRSZ       16
-#define INADDRSZ         4
-#define INT16SZ          2
-
-/*
- * If ENABLE_IPV6 is disabled, we still want to parse IPv6 addresses, so make
- * sure we have _some_ value for AF_INET6 without polluting our fake value
- * everywhere.
- */
-#if !defined(ENABLE_IPV6) && !defined(AF_INET6)
-#define AF_INET6 (AF_INET + 1)
-#endif
-
-/*
- * Format an IPv4 address, more or less like inet_ntop().
- *
- * Returns `dst' (as a const)
- * Note:
- *  - uses no statics
- *  - takes a unsigned char* not an in_addr as input
- */
-static char *inet_ntop4 (const unsigned char *src, char *dst, size_t size)
-{
-  char tmp[sizeof("255.255.255.255")];
-  size_t len;
-
-  DEBUGASSERT(size >= 16);
-
-  tmp[0] = '\0';
-  (void)msnprintf(tmp, sizeof(tmp), "%d.%d.%d.%d",
-                  ((int)((unsigned char)src[0])) & 0xff,
-                  ((int)((unsigned char)src[1])) & 0xff,
-                  ((int)((unsigned char)src[2])) & 0xff,
-                  ((int)((unsigned char)src[3])) & 0xff);
-
-  len = strlen(tmp);
-  if(len == 0 || len >= size) {
-    errno = ENOSPC;
-    return (NULL);
-  }
-  strcpy(dst, tmp);
-  return dst;
-}
-
-/*
- * Convert IPv6 binary address into presentation (printable) format.
- */
-static char *inet_ntop6 (const unsigned char *src, char *dst, size_t size)
-{
-  /*
-   * Note that int32_t and int16_t need only be "at least" large enough
-   * to contain a value of the specified size.  On some systems, like
-   * Crays, there is no such thing as an integer variable with 16 bits.
-   * Keep this in mind if you think this function should have been coded
-   * to use pointer overlays.  All the world's not a VAX.
-   */
-  char tmp[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")];
-  char *tp;
-  struct {
-    long base;
-    long len;
-  } best, cur;
-  unsigned long words[IN6ADDRSZ / INT16SZ];
-  int i;
-
-  /* Preprocess:
-   *  Copy the input (bytewise) array into a wordwise array.
-   *  Find the longest run of 0x00's in src[] for :: shorthanding.
-   */
-  memset(words, '\0', sizeof(words));
-  for(i = 0; i < IN6ADDRSZ; i++)
-    words[i/2] |= (src[i] << ((1 - (i % 2)) << 3));
-
-  best.base = -1;
-  cur.base  = -1;
-  best.len = 0;
-  cur.len = 0;
-
-  for(i = 0; i < (IN6ADDRSZ / INT16SZ); i++) {
-    if(words[i] == 0) {
-      if(cur.base == -1) {
-        cur.base = i; cur.len = 1;
-      }
-      else
-        cur.len++;
-    }
-    else if(cur.base != -1) {
-      if(best.base == -1 || cur.len > best.len)
-        best = cur;
-      cur.base = -1;
-    }
-  }
-  if((cur.base != -1) && (best.base == -1 || cur.len > best.len))
-    best = cur;
-  if(best.base != -1 && best.len < 2)
-    best.base = -1;
-  /* Format the result. */
-  tp = tmp;
-  for(i = 0; i < (IN6ADDRSZ / INT16SZ); i++) {
-    /* Are we inside the best run of 0x00's? */
-    if(best.base != -1 && i >= best.base && i < (best.base + best.len)) {
-      if(i == best.base)
-        *tp++ = ':';
-      continue;
-    }
-
-    /* Are we following an initial run of 0x00s or any real hex?
-     */
-    if(i)
-      *tp++ = ':';
-
-    /* Is this address an encapsulated IPv4?
-     */
-    if(i == 6 && best.base == 0 &&
-        (best.len == 6 || (best.len == 5 && words[5] == 0xffff))) {
-      if(!inet_ntop4(src + 12, tp, sizeof(tmp) - (tp - tmp))) {
-        errno = ENOSPC;
-        return (NULL);
-      }
-      tp += strlen(tp);
-      break;
-    }
-    tp += msnprintf(tp, 5, "%lx", words[i]);
-  }
-
-  /* Was it a trailing run of 0x00's?
-   */
-  if(best.base != -1 && (best.base + best.len) == (IN6ADDRSZ / INT16SZ))
-    *tp++ = ':';
-  *tp++ = '\0';
-
-  /* Check for overflow, copy, and we're done.
-   */
-  if((size_t)(tp - tmp) > size) {
-    errno = ENOSPC;
-    return (NULL);
-  }
-  strcpy(dst, tmp);
-  return dst;
-}
-
-/*
- * Convert a network format address to presentation format.
- *
- * Returns pointer to presentation format address (`buf').
- * Returns NULL on error and errno set with the specific
- * error, EAFNOSUPPORT or ENOSPC.
- *
- * On Windows we store the error in the thread errno, not
- * in the winsock error code. This is to avoid losing the
- * actual last winsock error. So when this function returns
- * NULL, check errno not SOCKERRNO.
- */
-char *Curl_inet_ntop(int af, const void *src, char *buf, size_t size)
-{
-  switch(af) {
-  case AF_INET:
-    return inet_ntop4((const unsigned char *)src, buf, size);
-  case AF_INET6:
-    return inet_ntop6((const unsigned char *)src, buf, size);
-  default:
-    errno = EAFNOSUPPORT;
-    return NULL;
-  }
-}
-#endif  /* HAVE_INET_NTOP */
diff --git a/third-party/curl/lib/inet_ntop.h b/third-party/curl/lib/inet_ntop.h
deleted file mode 100644
index 7c3ead4341..0000000000
--- a/third-party/curl/lib/inet_ntop.h
+++ /dev/null
@@ -1,39 +0,0 @@
-#ifndef HEADER_CURL_INET_NTOP_H
-#define HEADER_CURL_INET_NTOP_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-char *Curl_inet_ntop(int af, const void *addr, char *buf, size_t size);
-
-#ifdef HAVE_INET_NTOP
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-#define Curl_inet_ntop(af,addr,buf,size) \
-        inet_ntop(af, addr, buf, (curl_socklen_t)size)
-#endif
-
-#endif /* HEADER_CURL_INET_NTOP_H */
diff --git a/third-party/curl/lib/inet_pton.c b/third-party/curl/lib/inet_pton.c
deleted file mode 100644
index 7d3c698795..0000000000
--- a/third-party/curl/lib/inet_pton.c
+++ /dev/null
@@ -1,242 +0,0 @@
-/* This is from the BIND 4.9.4 release, modified to compile by itself */
-
-/* Copyright (c) Internet Software Consortium.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
- * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
- * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
- * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
- * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
- * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
- * SOFTWARE.
- *
- * SPDX-License-Identifier: ISC
- */
-
-#include "curl_setup.h"
-
-#ifndef HAVE_INET_PTON
-
-#ifdef HAVE_SYS_PARAM_H
-#include <sys/param.h>
-#endif
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-
-#include "inet_pton.h"
-
-#define IN6ADDRSZ       16
-#define INADDRSZ         4
-#define INT16SZ          2
-
-/*
- * If ENABLE_IPV6 is disabled, we still want to parse IPv6 addresses, so make
- * sure we have _some_ value for AF_INET6 without polluting our fake value
- * everywhere.
- */
-#if !defined(ENABLE_IPV6) && !defined(AF_INET6)
-#define AF_INET6 (AF_INET + 1)
-#endif
-
-/*
- * WARNING: Don't even consider trying to compile this on a system where
- * sizeof(int) < 4.  sizeof(int) > 4 is fine; all the world's not a VAX.
- */
-
-static int      inet_pton4(const char *src, unsigned char *dst);
-static int      inet_pton6(const char *src, unsigned char *dst);
-
-/* int
- * inet_pton(af, src, dst)
- *      convert from presentation format (which usually means ASCII printable)
- *      to network format (which is usually some kind of binary format).
- * return:
- *      1 if the address was valid for the specified address family
- *      0 if the address wasn't valid (`dst' is untouched in this case)
- *      -1 if some other error occurred (`dst' is untouched in this case, too)
- * notice:
- *      On Windows we store the error in the thread errno, not
- *      in the winsock error code. This is to avoid losing the
- *      actual last winsock error. So when this function returns
- *      -1, check errno not SOCKERRNO.
- * author:
- *      Paul Vixie, 1996.
- */
-int
-Curl_inet_pton(int af, const char *src, void *dst)
-{
-  switch(af) {
-  case AF_INET:
-    return (inet_pton4(src, (unsigned char *)dst));
-  case AF_INET6:
-    return (inet_pton6(src, (unsigned char *)dst));
-  default:
-    errno = EAFNOSUPPORT;
-    return (-1);
-  }
-  /* NOTREACHED */
-}
-
-/* int
- * inet_pton4(src, dst)
- *      like inet_aton() but without all the hexadecimal and shorthand.
- * return:
- *      1 if `src' is a valid dotted quad, else 0.
- * notice:
- *      does not touch `dst' unless it's returning 1.
- * author:
- *      Paul Vixie, 1996.
- */
-static int
-inet_pton4(const char *src, unsigned char *dst)
-{
-  static const char digits[] = "0123456789";
-  int saw_digit, octets, ch;
-  unsigned char tmp[INADDRSZ], *tp;
-
-  saw_digit = 0;
-  octets = 0;
-  tp = tmp;
-  *tp = 0;
-  while((ch = *src++) != '\0') {
-    const char *pch;
-
-    pch = strchr(digits, ch);
-    if(pch) {
-      unsigned int val = *tp * 10 + (unsigned int)(pch - digits);
-
-      if(saw_digit && *tp == 0)
-        return (0);
-      if(val > 255)
-        return (0);
-      *tp = (unsigned char)val;
-      if(!saw_digit) {
-        if(++octets > 4)
-          return (0);
-        saw_digit = 1;
-      }
-    }
-    else if(ch == '.' && saw_digit) {
-      if(octets == 4)
-        return (0);
-      *++tp = 0;
-      saw_digit = 0;
-    }
-    else
-      return (0);
-  }
-  if(octets < 4)
-    return (0);
-  memcpy(dst, tmp, INADDRSZ);
-  return (1);
-}
-
-/* int
- * inet_pton6(src, dst)
- *      convert presentation level address to network order binary form.
- * return:
- *      1 if `src' is a valid [RFC1884 2.2] address, else 0.
- * notice:
- *      (1) does not touch `dst' unless it's returning 1.
- *      (2) :: in a full address is silently ignored.
- * credit:
- *      inspired by Mark Andrews.
- * author:
- *      Paul Vixie, 1996.
- */
-static int
-inet_pton6(const char *src, unsigned char *dst)
-{
-  static const char xdigits_l[] = "0123456789abcdef",
-    xdigits_u[] = "0123456789ABCDEF";
-  unsigned char tmp[IN6ADDRSZ], *tp, *endp, *colonp;
-  const char *curtok;
-  int ch, saw_xdigit;
-  size_t val;
-
-  memset((tp = tmp), 0, IN6ADDRSZ);
-  endp = tp + IN6ADDRSZ;
-  colonp = NULL;
-  /* Leading :: requires some special handling. */
-  if(*src == ':')
-    if(*++src != ':')
-      return (0);
-  curtok = src;
-  saw_xdigit = 0;
-  val = 0;
-  while((ch = *src++) != '\0') {
-    const char *xdigits;
-    const char *pch;
-
-    pch = strchr((xdigits = xdigits_l), ch);
-    if(!pch)
-      pch = strchr((xdigits = xdigits_u), ch);
-    if(pch) {
-      val <<= 4;
-      val |= (pch - xdigits);
-      if(++saw_xdigit > 4)
-        return (0);
-      continue;
-    }
-    if(ch == ':') {
-      curtok = src;
-      if(!saw_xdigit) {
-        if(colonp)
-          return (0);
-        colonp = tp;
-        continue;
-      }
-      if(tp + INT16SZ > endp)
-        return (0);
-      *tp++ = (unsigned char) ((val >> 8) & 0xff);
-      *tp++ = (unsigned char) (val & 0xff);
-      saw_xdigit = 0;
-      val = 0;
-      continue;
-    }
-    if(ch == '.' && ((tp + INADDRSZ) <= endp) &&
-        inet_pton4(curtok, tp) > 0) {
-      tp += INADDRSZ;
-      saw_xdigit = 0;
-      break;    /* '\0' was seen by inet_pton4(). */
-    }
-    return (0);
-  }
-  if(saw_xdigit) {
-    if(tp + INT16SZ > endp)
-      return (0);
-    *tp++ = (unsigned char) ((val >> 8) & 0xff);
-    *tp++ = (unsigned char) (val & 0xff);
-  }
-  if(colonp) {
-    /*
-     * Since some memmove()'s erroneously fail to handle
-     * overlapping regions, we'll do the shift by hand.
-     */
-    const ssize_t n = tp - colonp;
-    ssize_t i;
-
-    if(tp == endp)
-      return (0);
-    for(i = 1; i <= n; i++) {
-      *(endp - i) = *(colonp + n - i);
-      *(colonp + n - i) = 0;
-    }
-    tp = endp;
-  }
-  if(tp != endp)
-    return (0);
-  memcpy(dst, tmp, IN6ADDRSZ);
-  return (1);
-}
-
-#endif /* HAVE_INET_PTON */
diff --git a/third-party/curl/lib/krb5.c b/third-party/curl/lib/krb5.c
deleted file mode 100644
index 18e73debbf..0000000000
--- a/third-party/curl/lib/krb5.c
+++ /dev/null
@@ -1,902 +0,0 @@
-/* GSSAPI/krb5 support for FTP - loosely based on old krb4.c
- *
- * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan
- * (Royal Institute of Technology, Stockholm, Sweden).
- * Copyright (C) Daniel Stenberg
- * All rights reserved.
- *
- * SPDX-License-Identifier: BSD-3-Clause
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * 3. Neither the name of the Institute nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.  */
-
-#include "curl_setup.h"
-
-#if defined(HAVE_GSSAPI) && !defined(CURL_DISABLE_FTP)
-
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-
-#include "urldata.h"
-#include "cfilters.h"
-#include "cf-socket.h"
-#include "curl_base64.h"
-#include "ftp.h"
-#include "curl_gssapi.h"
-#include "sendf.h"
-#include "curl_krb5.h"
-#include "warnless.h"
-#include "strcase.h"
-#include "strdup.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-static CURLcode ftpsend(struct Curl_easy *data, struct connectdata *conn,
-                        const char *cmd)
-{
-  ssize_t bytes_written;
-#define SBUF_SIZE 1024
-  char s[SBUF_SIZE];
-  size_t write_len;
-  char *sptr = s;
-  CURLcode result = CURLE_OK;
-#ifdef HAVE_GSSAPI
-  unsigned char data_sec = conn->data_prot;
-#endif
-
-  if(!cmd)
-    return CURLE_BAD_FUNCTION_ARGUMENT;
-
-  write_len = strlen(cmd);
-  if(!write_len || write_len > (sizeof(s) -3))
-    return CURLE_BAD_FUNCTION_ARGUMENT;
-
-  memcpy(&s, cmd, write_len);
-  strcpy(&s[write_len], "\r\n"); /* append a trailing CRLF */
-  write_len += 2;
-  bytes_written = 0;
-
-  for(;;) {
-#ifdef HAVE_GSSAPI
-    conn->data_prot = PROT_CMD;
-#endif
-    result = Curl_nwrite(data, FIRSTSOCKET, sptr, write_len,
-                        &bytes_written);
-#ifdef HAVE_GSSAPI
-    DEBUGASSERT(data_sec > PROT_NONE && data_sec < PROT_LAST);
-    conn->data_prot = data_sec;
-#endif
-
-    if(result)
-      break;
-
-    Curl_debug(data, CURLINFO_HEADER_OUT, sptr, (size_t)bytes_written);
-
-    if(bytes_written != (ssize_t)write_len) {
-      write_len -= bytes_written;
-      sptr += bytes_written;
-    }
-    else
-      break;
-  }
-
-  return result;
-}
-
-static int
-krb5_init(void *app_data)
-{
-  gss_ctx_id_t *context = app_data;
-  /* Make sure our context is initialized for krb5_end. */
-  *context = GSS_C_NO_CONTEXT;
-  return 0;
-}
-
-static int
-krb5_check_prot(void *app_data, int level)
-{
-  (void)app_data; /* unused */
-  if(level == PROT_CONFIDENTIAL)
-    return -1;
-  return 0;
-}
-
-static int
-krb5_decode(void *app_data, void *buf, int len,
-            int level UNUSED_PARAM,
-            struct connectdata *conn UNUSED_PARAM)
-{
-  gss_ctx_id_t *context = app_data;
-  OM_uint32 maj, min;
-  gss_buffer_desc enc, dec;
-
-  (void)level;
-  (void)conn;
-
-  enc.value = buf;
-  enc.length = len;
-  maj = gss_unwrap(&min, *context, &enc, &dec, NULL, NULL);
-  if(maj != GSS_S_COMPLETE)
-    return -1;
-
-  memcpy(buf, dec.value, dec.length);
-  len = curlx_uztosi(dec.length);
-  gss_release_buffer(&min, &dec);
-
-  return len;
-}
-
-static int
-krb5_encode(void *app_data, const void *from, int length, int level, void **to)
-{
-  gss_ctx_id_t *context = app_data;
-  gss_buffer_desc dec, enc;
-  OM_uint32 maj, min;
-  int state;
-  int len;
-
-  /* NOTE that the cast is safe, neither of the krb5, gnu gss and heimdal
-   * libraries modify the input buffer in gss_wrap()
-   */
-  dec.value = (void *)from;
-  dec.length = length;
-  maj = gss_wrap(&min, *context,
-                 level == PROT_PRIVATE,
-                 GSS_C_QOP_DEFAULT,
-                 &dec, &state, &enc);
-
-  if(maj != GSS_S_COMPLETE)
-    return -1;
-
-  /* malloc a new buffer, in case gss_release_buffer doesn't work as
-     expected */
-  *to = malloc(enc.length);
-  if(!*to)
-    return -1;
-  memcpy(*to, enc.value, enc.length);
-  len = curlx_uztosi(enc.length);
-  gss_release_buffer(&min, &enc);
-  return len;
-}
-
-static int
-krb5_auth(void *app_data, struct Curl_easy *data, struct connectdata *conn)
-{
-  int ret = AUTH_OK;
-  char *p;
-  const char *host = conn->host.name;
-  ssize_t nread;
-  curl_socklen_t l = sizeof(conn->local_addr);
-  CURLcode result;
-  const char *service = data->set.str[STRING_SERVICE_NAME] ?
-                        data->set.str[STRING_SERVICE_NAME] :
-                        "ftp";
-  const char *srv_host = "host";
-  gss_buffer_desc input_buffer, output_buffer, _gssresp, *gssresp;
-  OM_uint32 maj, min;
-  gss_name_t gssname;
-  gss_ctx_id_t *context = app_data;
-  struct gss_channel_bindings_struct chan;
-  size_t base64_sz = 0;
-  struct sockaddr_in *remote_addr =
-    (struct sockaddr_in *)(void *)&conn->remote_addr->sa_addr;
-  char *stringp;
-
-  if(getsockname(conn->sock[FIRSTSOCKET],
-                 (struct sockaddr *)&conn->local_addr, &l) < 0)
-    perror("getsockname()");
-
-  chan.initiator_addrtype = GSS_C_AF_INET;
-  chan.initiator_address.length = l - 4;
-  chan.initiator_address.value = &conn->local_addr.sin_addr.s_addr;
-  chan.acceptor_addrtype = GSS_C_AF_INET;
-  chan.acceptor_address.length = l - 4;
-  chan.acceptor_address.value = &remote_addr->sin_addr.s_addr;
-  chan.application_data.length = 0;
-  chan.application_data.value = NULL;
-
-  /* this loop will execute twice (once for service, once for host) */
-  for(;;) {
-    /* this really shouldn't be repeated here, but can't help it */
-    if(service == srv_host) {
-      result = ftpsend(data, conn, "AUTH GSSAPI");
-      if(result)
-        return -2;
-
-      if(Curl_GetFTPResponse(data, &nread, NULL))
-        return -1;
-
-      if(data->state.buffer[0] != '3')
-        return -1;
-    }
-
-    stringp = aprintf("%s@%s", service, host);
-    if(!stringp)
-      return -2;
-
-    input_buffer.value = stringp;
-    input_buffer.length = strlen(stringp);
-    maj = gss_import_name(&min, &input_buffer, GSS_C_NT_HOSTBASED_SERVICE,
-                          &gssname);
-    free(stringp);
-    if(maj != GSS_S_COMPLETE) {
-      gss_release_name(&min, &gssname);
-      if(service == srv_host) {
-        failf(data, "Error importing service name %s@%s", service, host);
-        return AUTH_ERROR;
-      }
-      service = srv_host;
-      continue;
-    }
-    /* We pass NULL as |output_name_type| to avoid a leak. */
-    gss_display_name(&min, gssname, &output_buffer, NULL);
-    infof(data, "Trying against %s", (char *)output_buffer.value);
-    gssresp = GSS_C_NO_BUFFER;
-    *context = GSS_C_NO_CONTEXT;
-
-    do {
-      /* Release the buffer at each iteration to avoid leaking: the first time
-         we are releasing the memory from gss_display_name. The last item is
-         taken care by a final gss_release_buffer. */
-      gss_release_buffer(&min, &output_buffer);
-      ret = AUTH_OK;
-      maj = Curl_gss_init_sec_context(data,
-                                      &min,
-                                      context,
-                                      gssname,
-                                      &Curl_krb5_mech_oid,
-                                      &chan,
-                                      gssresp,
-                                      &output_buffer,
-                                      TRUE,
-                                      NULL);
-
-      if(gssresp) {
-        free(_gssresp.value);
-        gssresp = NULL;
-      }
-
-      if(GSS_ERROR(maj)) {
-        infof(data, "Error creating security context");
-        ret = AUTH_ERROR;
-        break;
-      }
-
-      if(output_buffer.length) {
-        char *cmd;
-
-        result = Curl_base64_encode((char *)output_buffer.value,
-                                    output_buffer.length, &p, &base64_sz);
-        if(result) {
-          infof(data, "base64-encoding: %s", curl_easy_strerror(result));
-          ret = AUTH_ERROR;
-          break;
-        }
-
-        cmd = aprintf("ADAT %s", p);
-        if(cmd)
-          result = ftpsend(data, conn, cmd);
-        else
-          result = CURLE_OUT_OF_MEMORY;
-
-        free(p);
-        free(cmd);
-
-        if(result) {
-          ret = -2;
-          break;
-        }
-
-        if(Curl_GetFTPResponse(data, &nread, NULL)) {
-          ret = -1;
-          break;
-        }
-
-        if(data->state.buffer[0] != '2' && data->state.buffer[0] != '3') {
-          infof(data, "Server didn't accept auth data");
-          ret = AUTH_ERROR;
-          break;
-        }
-
-        _gssresp.value = NULL; /* make sure it is initialized */
-        p = data->state.buffer + 4;
-        p = strstr(p, "ADAT=");
-        if(p) {
-          result = Curl_base64_decode(p + 5,
-                                      (unsigned char **)&_gssresp.value,
-                                      &_gssresp.length);
-          if(result) {
-            failf(data, "base64-decoding: %s", curl_easy_strerror(result));
-            ret = AUTH_CONTINUE;
-            break;
-          }
-        }
-
-        gssresp = &_gssresp;
-      }
-    } while(maj == GSS_S_CONTINUE_NEEDED);
-
-    gss_release_name(&min, &gssname);
-    gss_release_buffer(&min, &output_buffer);
-
-    if(gssresp)
-      free(_gssresp.value);
-
-    if(ret == AUTH_OK || service == srv_host)
-      return ret;
-
-    service = srv_host;
-  }
-  return ret;
-}
-
-static void krb5_end(void *app_data)
-{
-    OM_uint32 min;
-    gss_ctx_id_t *context = app_data;
-    if(*context != GSS_C_NO_CONTEXT) {
-      OM_uint32 maj = gss_delete_sec_context(&min, context, GSS_C_NO_BUFFER);
-      (void)maj;
-      DEBUGASSERT(maj == GSS_S_COMPLETE);
-    }
-}
-
-static const struct Curl_sec_client_mech Curl_krb5_client_mech = {
-  "GSSAPI",
-  sizeof(gss_ctx_id_t),
-  krb5_init,
-  krb5_auth,
-  krb5_end,
-  krb5_check_prot,
-
-  krb5_encode,
-  krb5_decode
-};
-
-static const struct {
-  unsigned char level;
-  const char *name;
-} level_names[] = {
-  { PROT_CLEAR, "clear" },
-  { PROT_SAFE, "safe" },
-  { PROT_CONFIDENTIAL, "confidential" },
-  { PROT_PRIVATE, "private" }
-};
-
-static unsigned char name_to_level(const char *name)
-{
-  int i;
-  for(i = 0; i < (int)sizeof(level_names)/(int)sizeof(level_names[0]); i++)
-    if(curl_strequal(name, level_names[i].name))
-      return level_names[i].level;
-  return PROT_NONE;
-}
-
-/* Convert a protocol |level| to its char representation.
-   We take an int to catch programming mistakes. */
-static char level_to_char(int level)
-{
-  switch(level) {
-  case PROT_CLEAR:
-    return 'C';
-  case PROT_SAFE:
-    return 'S';
-  case PROT_CONFIDENTIAL:
-    return 'E';
-  case PROT_PRIVATE:
-    return 'P';
-  case PROT_CMD:
-    /* Fall through */
-  default:
-    /* Those 2 cases should not be reached! */
-    break;
-  }
-  DEBUGASSERT(0);
-  /* Default to the most secure alternative. */
-  return 'P';
-}
-
-/* Send an FTP command defined by |message| and the optional arguments. The
-   function returns the ftp_code. If an error occurs, -1 is returned. */
-static int ftp_send_command(struct Curl_easy *data, const char *message, ...)
-{
-  int ftp_code;
-  ssize_t nread = 0;
-  va_list args;
-  char print_buffer[50];
-
-  va_start(args, message);
-  mvsnprintf(print_buffer, sizeof(print_buffer), message, args);
-  va_end(args);
-
-  if(ftpsend(data, data->conn, print_buffer)) {
-    ftp_code = -1;
-  }
-  else {
-    if(Curl_GetFTPResponse(data, &nread, &ftp_code))
-      ftp_code = -1;
-  }
-
-  (void)nread; /* Unused */
-  return ftp_code;
-}
-
-/* Read |len| from the socket |fd| and store it in |to|. Return a CURLcode
-   saying whether an error occurred or CURLE_OK if |len| was read. */
-static CURLcode
-socket_read(struct Curl_easy *data, int sockindex, void *to, size_t len)
-{
-  char *to_p = to;
-  CURLcode result;
-  ssize_t nread = 0;
-
-  while(len > 0) {
-    nread = Curl_conn_recv(data, sockindex, to_p, len, &result);
-    if(nread > 0) {
-      len -= nread;
-      to_p += nread;
-    }
-    else {
-      if(result == CURLE_AGAIN)
-        continue;
-      return result;
-    }
-  }
-  return CURLE_OK;
-}
-
-
-/* Write |len| bytes from the buffer |to| to the socket |fd|. Return a
-   CURLcode saying whether an error occurred or CURLE_OK if |len| was
-   written. */
-static CURLcode
-socket_write(struct Curl_easy *data, int sockindex, const void *to,
-             size_t len)
-{
-  const char *to_p = to;
-  CURLcode result;
-  ssize_t written;
-
-  while(len > 0) {
-    written = Curl_conn_send(data, sockindex, to_p, len, &result);
-    if(written > 0) {
-      len -= written;
-      to_p += written;
-    }
-    else {
-      if(result == CURLE_AGAIN)
-        continue;
-      return result;
-    }
-  }
-  return CURLE_OK;
-}
-
-static CURLcode read_data(struct Curl_easy *data, int sockindex,
-                          struct krb5buffer *buf)
-{
-  struct connectdata *conn = data->conn;
-  int len;
-  CURLcode result;
-  int nread;
-
-  result = socket_read(data, sockindex, &len, sizeof(len));
-  if(result)
-    return result;
-
-  if(len) {
-    /* only realloc if there was a length */
-    len = ntohl(len);
-    if(len > CURL_MAX_INPUT_LENGTH)
-      len = 0;
-    else
-      buf->data = Curl_saferealloc(buf->data, len);
-  }
-  if(!len || !buf->data)
-    return CURLE_OUT_OF_MEMORY;
-
-  result = socket_read(data, sockindex, buf->data, len);
-  if(result)
-    return result;
-  nread = conn->mech->decode(conn->app_data, buf->data, len,
-                             conn->data_prot, conn);
-  if(nread < 0)
-    return CURLE_RECV_ERROR;
-  buf->size = (size_t)nread;
-  buf->index = 0;
-  return CURLE_OK;
-}
-
-static size_t
-buffer_read(struct krb5buffer *buf, void *data, size_t len)
-{
-  if(buf->size - buf->index < len)
-    len = buf->size - buf->index;
-  memcpy(data, (char *)buf->data + buf->index, len);
-  buf->index += len;
-  return len;
-}
-
-/* Matches Curl_recv signature */
-static ssize_t sec_recv(struct Curl_easy *data, int sockindex,
-                        char *buffer, size_t len, CURLcode *err)
-{
-  size_t bytes_read;
-  size_t total_read = 0;
-  struct connectdata *conn = data->conn;
-
-  *err = CURLE_OK;
-
-  /* Handle clear text response. */
-  if(conn->sec_complete == 0 || conn->data_prot == PROT_CLEAR)
-    return Curl_conn_recv(data, sockindex, buffer, len, err);
-
-  if(conn->in_buffer.eof_flag) {
-    conn->in_buffer.eof_flag = 0;
-    return 0;
-  }
-
-  bytes_read = buffer_read(&conn->in_buffer, buffer, len);
-  len -= bytes_read;
-  total_read += bytes_read;
-  buffer += bytes_read;
-
-  while(len > 0) {
-    if(read_data(data, sockindex, &conn->in_buffer))
-      return -1;
-    if(conn->in_buffer.size == 0) {
-      if(bytes_read > 0)
-        conn->in_buffer.eof_flag = 1;
-      return bytes_read;
-    }
-    bytes_read = buffer_read(&conn->in_buffer, buffer, len);
-    len -= bytes_read;
-    total_read += bytes_read;
-    buffer += bytes_read;
-  }
-  return total_read;
-}
-
-/* Send |length| bytes from |from| to the |fd| socket taking care of encoding
-   and negotiating with the server. |from| can be NULL. */
-static void do_sec_send(struct Curl_easy *data, struct connectdata *conn,
-                        curl_socket_t fd, const char *from, int length)
-{
-  int bytes, htonl_bytes; /* 32-bit integers for htonl */
-  char *buffer = NULL;
-  char *cmd_buffer;
-  size_t cmd_size = 0;
-  CURLcode error;
-  enum protection_level prot_level = conn->data_prot;
-  bool iscmd = (prot_level == PROT_CMD)?TRUE:FALSE;
-
-  DEBUGASSERT(prot_level > PROT_NONE && prot_level < PROT_LAST);
-
-  if(iscmd) {
-    if(!strncmp(from, "PASS ", 5) || !strncmp(from, "ACCT ", 5))
-      prot_level = PROT_PRIVATE;
-    else
-      prot_level = conn->command_prot;
-  }
-  bytes = conn->mech->encode(conn->app_data, from, length, prot_level,
-                             (void **)&buffer);
-  if(!buffer || bytes <= 0)
-    return; /* error */
-
-  if(iscmd) {
-    error = Curl_base64_encode(buffer, curlx_sitouz(bytes),
-                               &cmd_buffer, &cmd_size);
-    if(error) {
-      free(buffer);
-      return; /* error */
-    }
-    if(cmd_size > 0) {
-      static const char *enc = "ENC ";
-      static const char *mic = "MIC ";
-      if(prot_level == PROT_PRIVATE)
-        socket_write(data, fd, enc, 4);
-      else
-        socket_write(data, fd, mic, 4);
-
-      socket_write(data, fd, cmd_buffer, cmd_size);
-      socket_write(data, fd, "\r\n", 2);
-      infof(data, "Send: %s%s", prot_level == PROT_PRIVATE?enc:mic,
-            cmd_buffer);
-      free(cmd_buffer);
-    }
-  }
-  else {
-    htonl_bytes = htonl(bytes);
-    socket_write(data, fd, &htonl_bytes, sizeof(htonl_bytes));
-    socket_write(data, fd, buffer, curlx_sitouz(bytes));
-  }
-  free(buffer);
-}
-
-static ssize_t sec_write(struct Curl_easy *data, struct connectdata *conn,
-                         curl_socket_t fd, const char *buffer, size_t length)
-{
-  ssize_t tx = 0, len = conn->buffer_size;
-
-  if(len <= 0)
-    len = length;
-  while(length) {
-    if(length < (size_t)len)
-      len = length;
-
-    do_sec_send(data, conn, fd, buffer, curlx_sztosi(len));
-    length -= len;
-    buffer += len;
-    tx += len;
-  }
-  return tx;
-}
-
-/* Matches Curl_send signature */
-static ssize_t sec_send(struct Curl_easy *data, int sockindex,
-                        const void *buffer, size_t len, CURLcode *err)
-{
-  struct connectdata *conn = data->conn;
-  curl_socket_t fd = conn->sock[sockindex];
-  *err = CURLE_OK;
-  return sec_write(data, conn, fd, buffer, len);
-}
-
-int Curl_sec_read_msg(struct Curl_easy *data, struct connectdata *conn,
-                      char *buffer, enum protection_level level)
-{
-  /* decoded_len should be size_t or ssize_t but conn->mech->decode returns an
-     int */
-  int decoded_len;
-  char *buf;
-  int ret_code = 0;
-  size_t decoded_sz = 0;
-  CURLcode error;
-
-  (void) data;
-
-  if(!conn->mech)
-    /* not initialized, return error */
-    return -1;
-
-  DEBUGASSERT(level > PROT_NONE && level < PROT_LAST);
-
-  error = Curl_base64_decode(buffer + 4, (unsigned char **)&buf, &decoded_sz);
-  if(error || decoded_sz == 0)
-    return -1;
-
-  if(decoded_sz > (size_t)INT_MAX) {
-    free(buf);
-    return -1;
-  }
-  decoded_len = curlx_uztosi(decoded_sz);
-
-  decoded_len = conn->mech->decode(conn->app_data, buf, decoded_len,
-                                   level, conn);
-  if(decoded_len <= 0) {
-    free(buf);
-    return -1;
-  }
-
-  {
-    buf[decoded_len] = '\n';
-    Curl_debug(data, CURLINFO_HEADER_IN, buf, decoded_len + 1);
-  }
-
-  buf[decoded_len] = '\0';
-  if(decoded_len <= 3)
-    /* suspiciously short */
-    return 0;
-
-  if(buf[3] != '-')
-    ret_code = atoi(buf);
-
-  if(buf[decoded_len - 1] == '\n')
-    buf[decoded_len - 1] = '\0';
-  strcpy(buffer, buf);
-  free(buf);
-  return ret_code;
-}
-
-static int sec_set_protection_level(struct Curl_easy *data)
-{
-  int code;
-  struct connectdata *conn = data->conn;
-  unsigned char level = conn->request_data_prot;
-
-  DEBUGASSERT(level > PROT_NONE && level < PROT_LAST);
-
-  if(!conn->sec_complete) {
-    infof(data, "Trying to change the protection level after the"
-                " completion of the data exchange.");
-    return -1;
-  }
-
-  /* Bail out if we try to set up the same level */
-  if(conn->data_prot == level)
-    return 0;
-
-  if(level) {
-    char *pbsz;
-    unsigned int buffer_size = 1 << 20; /* 1048576 */
-
-    code = ftp_send_command(data, "PBSZ %u", buffer_size);
-    if(code < 0)
-      return -1;
-
-    if(code/100 != 2) {
-      failf(data, "Failed to set the protection's buffer size.");
-      return -1;
-    }
-    conn->buffer_size = buffer_size;
-
-    pbsz = strstr(data->state.buffer, "PBSZ=");
-    if(pbsz) {
-      /* stick to default value if the check fails */
-      if(!strncmp(pbsz, "PBSZ=", 5) && ISDIGIT(pbsz[5]))
-        buffer_size = atoi(&pbsz[5]);
-      if(buffer_size < conn->buffer_size)
-        conn->buffer_size = buffer_size;
-    }
-  }
-
-  /* Now try to negotiate the protection level. */
-  code = ftp_send_command(data, "PROT %c", level_to_char(level));
-
-  if(code < 0)
-    return -1;
-
-  if(code/100 != 2) {
-    failf(data, "Failed to set the protection level.");
-    return -1;
-  }
-
-  conn->data_prot = level;
-  if(level == PROT_PRIVATE)
-    conn->command_prot = level;
-
-  return 0;
-}
-
-int
-Curl_sec_request_prot(struct connectdata *conn, const char *level)
-{
-  unsigned char l = name_to_level(level);
-  if(l == PROT_NONE)
-    return -1;
-  DEBUGASSERT(l > PROT_NONE && l < PROT_LAST);
-  conn->request_data_prot = l;
-  return 0;
-}
-
-static CURLcode choose_mech(struct Curl_easy *data, struct connectdata *conn)
-{
-  int ret;
-  void *tmp_allocation;
-  const struct Curl_sec_client_mech *mech = &Curl_krb5_client_mech;
-
-  tmp_allocation = realloc(conn->app_data, mech->size);
-  if(!tmp_allocation) {
-    failf(data, "Failed realloc of size %zu", mech->size);
-    mech = NULL;
-    return CURLE_OUT_OF_MEMORY;
-  }
-  conn->app_data = tmp_allocation;
-
-  if(mech->init) {
-    ret = mech->init(conn->app_data);
-    if(ret) {
-      infof(data, "Failed initialization for %s. Skipping it.",
-            mech->name);
-      return CURLE_FAILED_INIT;
-    }
-  }
-
-  infof(data, "Trying mechanism %s...", mech->name);
-  ret = ftp_send_command(data, "AUTH %s", mech->name);
-  if(ret < 0)
-    return CURLE_COULDNT_CONNECT;
-
-  if(ret/100 != 3) {
-    switch(ret) {
-    case 504:
-      infof(data, "Mechanism %s is not supported by the server (server "
-            "returned ftp code: 504).", mech->name);
-      break;
-    case 534:
-      infof(data, "Mechanism %s was rejected by the server (server returned "
-            "ftp code: 534).", mech->name);
-      break;
-    default:
-      if(ret/100 == 5) {
-        infof(data, "server does not support the security extensions");
-        return CURLE_USE_SSL_FAILED;
-      }
-      break;
-    }
-    return CURLE_LOGIN_DENIED;
-  }
-
-  /* Authenticate */
-  ret = mech->auth(conn->app_data, data, conn);
-
-  if(ret != AUTH_CONTINUE) {
-    if(ret != AUTH_OK) {
-      /* Mechanism has dumped the error to stderr, don't error here. */
-      return CURLE_USE_SSL_FAILED;
-    }
-    DEBUGASSERT(ret == AUTH_OK);
-
-    conn->mech = mech;
-    conn->sec_complete = 1;
-    conn->recv[FIRSTSOCKET] = sec_recv;
-    conn->send[FIRSTSOCKET] = sec_send;
-    conn->recv[SECONDARYSOCKET] = sec_recv;
-    conn->send[SECONDARYSOCKET] = sec_send;
-    conn->command_prot = PROT_SAFE;
-    /* Set the requested protection level */
-    /* BLOCKING */
-    (void)sec_set_protection_level(data);
-  }
-
-  return CURLE_OK;
-}
-
-CURLcode
-Curl_sec_login(struct Curl_easy *data, struct connectdata *conn)
-{
-  return choose_mech(data, conn);
-}
-
-
-void
-Curl_sec_end(struct connectdata *conn)
-{
-  if(conn->mech && conn->mech->end)
-    conn->mech->end(conn->app_data);
-  free(conn->app_data);
-  conn->app_data = NULL;
-  if(conn->in_buffer.data) {
-    free(conn->in_buffer.data);
-    conn->in_buffer.data = NULL;
-    conn->in_buffer.size = 0;
-    conn->in_buffer.index = 0;
-    conn->in_buffer.eof_flag = 0;
-  }
-  conn->sec_complete = 0;
-  conn->data_prot = PROT_CLEAR;
-  conn->mech = NULL;
-}
-
-#endif /* HAVE_GSSAPI && !CURL_DISABLE_FTP */
diff --git a/third-party/curl/lib/ldap.c b/third-party/curl/lib/ldap.c
index 33a4dea0a8..a6a69eb7f1 100644
--- a/third-party/curl/lib/ldap.c
+++ b/third-party/curl/lib/ldap.c
@@ -21,11 +21,17 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+#include "urldata.h"
+#include "curl_ldap.h"
 
 #if !defined(CURL_DISABLE_LDAP) && !defined(USE_OPENLDAP)
 
+#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
+
 /*
  * Notice that USE_OPENLDAP is only a source code selection switch. When
  * libcurl is built with USE_OPENLDAP defined the libcurl source code that
@@ -37,61 +43,46 @@
  * OpenLDAP library versions, USE_OPENLDAP shall not be defined.
  */
 
-/* Wincrypt must be included before anything that could include OpenSSL. */
-#if defined(USE_WIN32_CRYPTO)
-#include <wincrypt.h>
-/* Undefine wincrypt conflicting symbols for BoringSSL. */
-#undef X509_NAME
-#undef X509_EXTENSIONS
-#undef PKCS7_ISSUER_AND_SERIAL
-#undef PKCS7_SIGNER_INFO
-#undef OCSP_REQUEST
-#undef OCSP_RESPONSE
-#endif
-
 #ifdef USE_WIN32_LDAP           /* Use Windows LDAP implementation. */
-# ifdef _MSC_VER
-#  pragma warning(push)
-#  pragma warning(disable: 4201)
-# endif
-# include <subauth.h>  /* for [P]UNICODE_STRING */
-# ifdef _MSC_VER
-#  pragma warning(pop)
-# endif
-# include <winldap.h>
-# ifndef LDAP_VENDOR_NAME
-#  error Your Platform SDK is NOT sufficient for LDAP support! \
-         Update your Platform SDK, or disable LDAP support!
-# else
+#  include <winldap.h>
+/* Undefine indirect <wincrypt.h> symbols conflicting with AWS-LC/BoringSSL. */
+#  undef X509_NAME
+#  undef X509_EXTENSIONS
+#  undef PKCS7_ISSUER_AND_SERIAL
+#  undef PKCS7_SIGNER_INFO
+#  undef OCSP_REQUEST
+#  undef OCSP_RESPONSE
 #  include <winber.h>
-# endif
 #else
-# define LDAP_DEPRECATED 1      /* Be sure ldap_init() is defined. */
-# ifdef HAVE_LBER_H
-#  include <lber.h>
-# endif
-# include <ldap.h>
-# if (defined(HAVE_LDAP_SSL) && defined(HAVE_LDAP_SSL_H))
-#  include <ldap_ssl.h>
-# endif /* HAVE_LDAP_SSL && HAVE_LDAP_SSL_H */
+#  define LDAP_DEPRECATED 1     /* Be sure ldap_init() is defined. */
+#  ifdef HAVE_LBER_H
+#    include <lber.h>
+#  endif
+#  include <ldap.h>
+#  if defined(HAVE_LDAP_SSL) && defined(HAVE_LDAP_SSL_H)
+#    include <ldap_ssl.h>
+#  endif /* HAVE_LDAP_SSL && HAVE_LDAP_SSL_H */
 #endif
 
-#include "urldata.h"
-#include <curl/curl.h>
+#include "cfilters.h"
 #include "sendf.h"
+#include "curl_trc.h"
 #include "escape.h"
 #include "progress.h"
 #include "transfer.h"
-#include "strcase.h"
-#include "strtok.h"
-#include "curl_ldap.h"
-#include "curl_multibyte.h"
-#include "curl_base64.h"
+#include "curlx/strparse.h"
+#include "bufref.h"
+#include "curlx/multibyte.h"
+#include "curlx/base64.h"
 #include "connect.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+
+#ifdef USE_WIN32_LDAP
+#define FREE_ON_WINLDAP(x) curlx_free(x)
+#define curl_ldap_num_t    ULONG
+#else
+#define FREE_ON_WINLDAP(x) do {} while(0)
+#define curl_ldap_num_t    int
+#endif
 
 #ifndef HAVE_LDAP_URL_PARSE
 
@@ -100,7 +91,7 @@
 struct ldap_urldesc {
   char   *lud_host;
   int     lud_port;
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
   TCHAR  *lud_dn;
   TCHAR **lud_attrs;
 #else
@@ -108,47 +99,49 @@ struct ldap_urldesc {
   char  **lud_attrs;
 #endif
   int     lud_scope;
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
   TCHAR  *lud_filter;
 #else
   char   *lud_filter;
 #endif
   char  **lud_exts;
-  size_t    lud_attrs_dups; /* how many were dup'ed, this field is not in the
-                               "real" struct so can only be used in code
-                               without HAVE_LDAP_URL_PARSE defined */
+  size_t  lud_attrs_dups; /* how many were dup'ed, this field is not in the
+                             "real" struct so can only be used in code
+                             without HAVE_LDAP_URL_PARSE defined */
 };
 
 #undef LDAPURLDesc
 #define LDAPURLDesc struct ldap_urldesc
 
-static int  _ldap_url_parse(struct Curl_easy *data,
-                            const struct connectdata *conn,
-                            LDAPURLDesc **ludp);
-static void _ldap_free_urldesc(LDAPURLDesc *ludp);
+static curl_ldap_num_t ldap_url_parse_low(struct Curl_easy *data,
+                                          const struct connectdata *conn,
+                                          LDAPURLDesc **ludpp);
+static void ldap_free_urldesc_low(LDAPURLDesc *ludp);
 
 #undef ldap_free_urldesc
-#define ldap_free_urldesc       _ldap_free_urldesc
-#endif
+#define ldap_free_urldesc       ldap_free_urldesc_low
+
+#endif /* !HAVE_LDAP_URL_PARSE */
 
 #ifdef DEBUG_LDAP
-  #define LDAP_TRACE(x)   do { \
-                            _ldap_trace("%u: ", __LINE__); \
-                            _ldap_trace x; \
-                          } while(0)
+#define LDAP_TRACE(x)                 \
+  do {                                \
+    ldap_trace_low("%u: ", __LINE__); \
+    ldap_trace_low x;                 \
+  } while(0)
 
-  static void _ldap_trace(const char *fmt, ...);
+static void ldap_trace_low(const char *fmt, ...) CURL_PRINTF(1, 2);
 #else
-  #define LDAP_TRACE(x)   Curl_nop_stmt
+#define LDAP_TRACE(x) Curl_nop_stmt
 #endif
 
 #if defined(USE_WIN32_LDAP) && defined(ldap_err2string)
-/* Use ansi error strings in UNICODE builds */
+/* Use ANSI error strings in Unicode builds */
 #undef ldap_err2string
 #define ldap_err2string ldap_err2stringA
 #endif
 
-#if defined(USE_WIN32_LDAP) && defined(_MSC_VER) && (_MSC_VER <= 1600)
+#if defined(USE_WIN32_LDAP) && defined(_MSC_VER) && (_MSC_VER <= 1700)
 /* Workaround for warning:
    'type cast' : conversion from 'int' to 'void *' of greater size */
 #undef LDAP_OPT_ON
@@ -157,89 +150,31 @@ static void _ldap_free_urldesc(LDAPURLDesc *ludp);
 #define LDAP_OPT_OFF  ((void *)(size_t)0)
 #endif
 
-static CURLcode ldap_do(struct Curl_easy *data, bool *done);
+#ifdef USE_WIN32_LDAP
 
-/*
- * LDAP protocol handler.
- */
-
-const struct Curl_handler Curl_handler_ldap = {
-  "LDAP",                               /* scheme */
-  ZERO_NULL,                            /* setup_connection */
-  ldap_do,                              /* do_it */
-  ZERO_NULL,                            /* done */
-  ZERO_NULL,                            /* do_more */
-  ZERO_NULL,                            /* connect_it */
-  ZERO_NULL,                            /* connecting */
-  ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  ZERO_NULL,                            /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_LDAP,                            /* defport */
-  CURLPROTO_LDAP,                       /* protocol */
-  CURLPROTO_LDAP,                       /* family */
-  PROTOPT_NONE                          /* flags */
-};
-
-#ifdef HAVE_LDAP_SSL
-/*
- * LDAPS protocol handler.
- */
-
-const struct Curl_handler Curl_handler_ldaps = {
-  "LDAPS",                              /* scheme */
-  ZERO_NULL,                            /* setup_connection */
-  ldap_do,                              /* do_it */
-  ZERO_NULL,                            /* done */
-  ZERO_NULL,                            /* do_more */
-  ZERO_NULL,                            /* connect_it */
-  ZERO_NULL,                            /* connecting */
-  ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  ZERO_NULL,                            /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_LDAPS,                           /* defport */
-  CURLPROTO_LDAPS,                      /* protocol */
-  CURLPROTO_LDAP,                       /* family */
-  PROTOPT_SSL                           /* flags */
-};
-#endif
-
-#if defined(USE_WIN32_LDAP)
-
-#if defined(USE_WINDOWS_SSPI)
-static int ldap_win_bind_auth(LDAP *server, const char *user,
-                              const char *passwd, unsigned long authflags)
+#ifdef USE_WINDOWS_SSPI
+static ULONG ldap_win_bind_auth(LDAP *server, const char *user,
+                                const char *passwd, unsigned long authflags)
 {
   ULONG method = 0;
   SEC_WINNT_AUTH_IDENTITY cred;
-  int rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
+  ULONG rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
 
   memset(&cred, 0, sizeof(cred));
 
-#if defined(USE_SPNEGO)
+#ifdef USE_SPNEGO
   if(authflags & CURLAUTH_NEGOTIATE) {
     method = LDAP_AUTH_NEGOTIATE;
   }
   else
 #endif
-#if defined(USE_NTLM)
+#ifdef USE_NTLM
   if(authflags & CURLAUTH_NTLM) {
     method = LDAP_AUTH_NTLM;
   }
   else
 #endif
-#if !defined(CURL_DISABLE_DIGEST_AUTH)
+#ifndef CURL_DISABLE_DIGEST_AUTH
   if(authflags & CURLAUTH_DIGEST) {
     method = LDAP_AUTH_DIGEST;
   }
@@ -250,11 +185,14 @@ static int ldap_win_bind_auth(LDAP *server, const char *user,
   }
 
   if(method && user && passwd) {
-    rc = Curl_create_sspi_identity(user, passwd, &cred);
-    if(!rc) {
+    CURLcode result = Curl_create_sspi_identity(user, passwd, &cred);
+    if(!result) {
       rc = ldap_bind_s(server, NULL, (TCHAR *)&cred, method);
       Curl_sspi_free_identity(&cred);
     }
+    else {
+      rc = LDAP_NO_MEMORY;
+    }
   }
   else {
     /* proceed with current user credentials */
@@ -263,26 +201,26 @@ static int ldap_win_bind_auth(LDAP *server, const char *user,
   }
   return rc;
 }
-#endif /* #if defined(USE_WINDOWS_SSPI) */
+#endif /* USE_WINDOWS_SSPI */
 
-static int ldap_win_bind(struct Curl_easy *data, LDAP *server,
-                         const char *user, const char *passwd)
+static ULONG ldap_win_bind(struct Curl_easy *data, LDAP *server,
+                           const char *user, const char *passwd)
 {
-  int rc = LDAP_INVALID_CREDENTIALS;
+  ULONG rc = LDAP_INVALID_CREDENTIALS;
 
   PTCHAR inuser = NULL;
   PTCHAR inpass = NULL;
 
   if(user && passwd && (data->set.httpauth & CURLAUTH_BASIC)) {
-    inuser = curlx_convert_UTF8_to_tchar((char *) user);
-    inpass = curlx_convert_UTF8_to_tchar((char *) passwd);
+    inuser = curlx_convert_UTF8_to_tchar(user);
+    inpass = curlx_convert_UTF8_to_tchar(passwd);
 
     rc = ldap_simple_bind_s(server, inuser, inpass);
 
-    curlx_unicodefree(inuser);
-    curlx_unicodefree(inpass);
+    curlx_free(inuser);
+    curlx_free(inpass);
   }
-#if defined(USE_WINDOWS_SSPI)
+#ifdef USE_WINDOWS_SSPI
   else {
     rc = ldap_win_bind_auth(server, user, passwd, data->set.httpauth);
   }
@@ -290,19 +228,33 @@ static int ldap_win_bind(struct Curl_easy *data, LDAP *server,
 
   return rc;
 }
-#endif /* #if defined(USE_WIN32_LDAP) */
+#endif /* USE_WIN32_LDAP */
 
-#if defined(USE_WIN32_LDAP)
-#define FREE_ON_WINLDAP(x) curlx_unicodefree(x)
-#else
-#define FREE_ON_WINLDAP(x)
-#endif
+static bool ldap_value_needs_base64(const char *attr, size_t attr_len,
+                                    const BerValue *val)
+{
+  ber_len_t j;
 
+  if((attr_len > 7) && curl_strequal(";binary", attr + attr_len - 7))
+    return TRUE;
+
+  /* check for leading or trailing whitespace */
+  if(val->bv_len && (ISBLANK(val->bv_val[0]) ||
+                     ISBLANK(val->bv_val[val->bv_len - 1])))
+    return TRUE;
+
+  /* check for unprintable characters */
+  for(j = 0; j < val->bv_len; j++)
+    if(!ISPRINT(val->bv_val[j]))
+      return TRUE;
+
+  return FALSE;
+}
 
 static CURLcode ldap_do(struct Curl_easy *data, bool *done)
 {
   CURLcode result = CURLE_OK;
-  int rc = 0;
+  curl_ldap_num_t rc = LDAP_SUCCESS;
   LDAP *server = NULL;
   LDAPURLDesc *ludp = NULL;
   LDAPMessage *ldapmsg = NULL;
@@ -311,29 +263,31 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
   struct connectdata *conn = data->conn;
   int ldap_proto = LDAP_VERSION3;
   int ldap_ssl = 0;
-  char *val_b64 = NULL;
-  size_t val_b64_sz = 0;
-  curl_off_t dlsize = 0;
 #ifdef LDAP_OPT_NETWORK_TIMEOUT
-  struct timeval ldap_timeout = {10, 0}; /* 10 sec connection/search timeout */
+  struct timeval ldap_timeout = { 10, 0 }; /* 10s connection/search timeout */
 #endif
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
   TCHAR *host = NULL;
 #else
   char *host = NULL;
 #endif
-  char *user = NULL;
-  char *passwd = NULL;
+  const char *user = Curl_creds_has_user(data->state.creds) ?
+    data->state.creds->user : NULL;
+  const char *passwd = Curl_creds_has_passwd(data->state.creds) ?
+    data->state.creds->passwd : NULL;
+  struct ip_quadruple ipquad;
+  bool is_ipv6;
+  BerElement *ber = NULL;
 
   *done = TRUE; /* unconditionally */
   infof(data, "LDAP local: LDAP Vendor = %s ; LDAP Version = %d",
-          LDAP_VENDOR_NAME, LDAP_VENDOR_VERSION);
-  infof(data, "LDAP local: %s", data->state.url);
+        LDAP_VENDOR_NAME, LDAP_VENDOR_VERSION);
+  infof(data, "LDAP local: %s", Curl_bufref_ptr(&data->state.url));
 
 #ifdef HAVE_LDAP_URL_PARSE
-  rc = ldap_url_parse(data->state.url, &ludp);
+  rc = ldap_url_parse(Curl_bufref_ptr(&data->state.url), &ludp);
 #else
-  rc = _ldap_url_parse(data, conn, &ludp);
+  rc = ldap_url_parse_low(data, conn, &ludp);
 #endif
   if(rc) {
     failf(data, "Bad LDAP URL: %s", ldap_err2string(rc));
@@ -341,95 +295,61 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
     goto quit;
   }
 
+  result = Curl_conn_get_ip_info(data, conn, FIRSTSOCKET, &is_ipv6, &ipquad);
+  if(result)
+    goto quit;
+
   /* Get the URL scheme (either ldap or ldaps) */
-  if(conn->given->flags & PROTOPT_SSL)
+  if(Curl_conn_is_ssl(conn, FIRSTSOCKET))
     ldap_ssl = 1;
   infof(data, "LDAP local: trying to establish %s connection",
-          ldap_ssl ? "encrypted" : "cleartext");
+        ldap_ssl ? "encrypted" : "cleartext");
 
-#if defined(USE_WIN32_LDAP)
-  host = curlx_convert_UTF8_to_tchar(conn->host.name);
+#ifdef USE_WIN32_LDAP
+  host = curlx_convert_UTF8_to_tchar(conn->origin->hostname);
   if(!host) {
     result = CURLE_OUT_OF_MEMORY;
 
     goto quit;
   }
 #else
-  host = conn->host.name;
+  host = conn->origin->hostname;
 #endif
 
-  if(data->state.aptr.user) {
-    user = conn->user;
-    passwd = conn->passwd;
+#ifdef USE_WIN32_LDAP
+  if(ldap_ssl)
+    server = ldap_sslinit(host, (curl_ldap_num_t)ipquad.remote_port, 1);
+  else
+#endif
+    server = ldap_init(host, (curl_ldap_num_t)ipquad.remote_port);
+  if(!server) {
+    failf(data, "LDAP: cannot setup connect to %s:%u",
+          conn->origin->user_hostname, ipquad.remote_port);
+    result = CURLE_COULDNT_CONNECT;
+    goto quit;
   }
 
 #ifdef LDAP_OPT_NETWORK_TIMEOUT
-  ldap_set_option(NULL, LDAP_OPT_NETWORK_TIMEOUT, &ldap_timeout);
+  ldap_set_option(server, LDAP_OPT_NETWORK_TIMEOUT, &ldap_timeout);
 #endif
-  ldap_set_option(NULL, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
+  ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
+
+  /* Do not chase referrals. */
+  ldap_set_option(server, LDAP_OPT_REFERRALS, LDAP_OPT_OFF);
 
   if(ldap_ssl) {
 #ifdef HAVE_LDAP_SSL
 #ifdef USE_WIN32_LDAP
-    /* Win32 LDAP SDK doesn't support insecure mode without CA! */
-    server = ldap_sslinit(host, conn->port, 1);
+    /* Win32 LDAP SDK does not support insecure mode without CA! */
     ldap_set_option(server, LDAP_OPT_SSL, LDAP_OPT_ON);
-#else
+#else /* !USE_WIN32_LDAP */
     int ldap_option;
-    char *ldap_ca = conn->ssl_config.CAfile;
-#if defined(CURL_HAS_NOVELL_LDAPSDK)
-    rc = ldapssl_client_init(NULL, NULL);
-    if(rc != LDAP_SUCCESS) {
-      failf(data, "LDAP local: ldapssl_client_init %s", ldap_err2string(rc));
-      result = CURLE_SSL_CERTPROBLEM;
-      goto quit;
-    }
-    if(conn->ssl_config.verifypeer) {
-      /* Novell SDK supports DER or BASE64 files. */
-      int cert_type = LDAPSSL_CERT_FILETYPE_B64;
-      if((data->set.ssl.cert_type) &&
-         (strcasecompare(data->set.ssl.cert_type, "DER")))
-        cert_type = LDAPSSL_CERT_FILETYPE_DER;
-      if(!ldap_ca) {
-        failf(data, "LDAP local: ERROR %s CA cert not set",
-              (cert_type == LDAPSSL_CERT_FILETYPE_DER ? "DER" : "PEM"));
-        result = CURLE_SSL_CERTPROBLEM;
-        goto quit;
-      }
-      infof(data, "LDAP local: using %s CA cert '%s'",
-            (cert_type == LDAPSSL_CERT_FILETYPE_DER ? "DER" : "PEM"),
-            ldap_ca);
-      rc = ldapssl_add_trusted_cert(ldap_ca, cert_type);
-      if(rc != LDAP_SUCCESS) {
-        failf(data, "LDAP local: ERROR setting %s CA cert: %s",
-              (cert_type == LDAPSSL_CERT_FILETYPE_DER ? "DER" : "PEM"),
-              ldap_err2string(rc));
-        result = CURLE_SSL_CERTPROBLEM;
-        goto quit;
-      }
-      ldap_option = LDAPSSL_VERIFY_SERVER;
-    }
-    else
-      ldap_option = LDAPSSL_VERIFY_NONE;
-    rc = ldapssl_set_verify_mode(ldap_option);
-    if(rc != LDAP_SUCCESS) {
-      failf(data, "LDAP local: ERROR setting cert verify mode: %s",
-              ldap_err2string(rc));
-      result = CURLE_SSL_CERTPROBLEM;
-      goto quit;
-    }
-    server = ldapssl_init(host, conn->port, 1);
-    if(!server) {
-      failf(data, "LDAP local: Cannot connect to %s:%u",
-            conn->host.dispname, conn->port);
-      result = CURLE_COULDNT_CONNECT;
-      goto quit;
-    }
-#elif defined(LDAP_OPT_X_TLS)
+    const char *ldap_ca = conn->ssl_config.CAfile;
+#ifdef LDAP_OPT_X_TLS
     if(conn->ssl_config.verifypeer) {
       /* OpenLDAP SDK supports BASE64 files. */
-      if((data->set.ssl.cert_type) &&
-         (!strcasecompare(data->set.ssl.cert_type, "PEM"))) {
+      if(data->set.ssl.primary.cert_type &&
+         !curl_strequal(data->set.ssl.primary.cert_type, "PEM")) {
         failf(data, "LDAP local: ERROR OpenLDAP only supports PEM cert-type");
         result = CURLE_SSL_CERTPROBLEM;
         goto quit;
@@ -440,10 +360,10 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
         goto quit;
       }
       infof(data, "LDAP local: using PEM CA cert: %s", ldap_ca);
-      rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, ldap_ca);
+      rc = ldap_set_option(server, LDAP_OPT_X_TLS_CACERTFILE, ldap_ca);
       if(rc != LDAP_SUCCESS) {
         failf(data, "LDAP local: ERROR setting PEM CA cert: %s",
-                ldap_err2string(rc));
+              ldap_err2string(rc));
         result = CURLE_SSL_CERTPROBLEM;
         goto quit;
       }
@@ -452,69 +372,46 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
     else
       ldap_option = LDAP_OPT_X_TLS_NEVER;
 
-    rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &ldap_option);
+    rc = ldap_set_option(server, LDAP_OPT_X_TLS_REQUIRE_CERT, &ldap_option);
     if(rc != LDAP_SUCCESS) {
       failf(data, "LDAP local: ERROR setting cert verify mode: %s",
-              ldap_err2string(rc));
+            ldap_err2string(rc));
       result = CURLE_SSL_CERTPROBLEM;
       goto quit;
     }
-    server = ldap_init(host, conn->port);
-    if(!server) {
-      failf(data, "LDAP local: Cannot connect to %s:%u",
-            conn->host.dispname, conn->port);
-      result = CURLE_COULDNT_CONNECT;
-      goto quit;
-    }
     ldap_option = LDAP_OPT_X_TLS_HARD;
     rc = ldap_set_option(server, LDAP_OPT_X_TLS, &ldap_option);
     if(rc != LDAP_SUCCESS) {
       failf(data, "LDAP local: ERROR setting SSL/TLS mode: %s",
-              ldap_err2string(rc));
+            ldap_err2string(rc));
       result = CURLE_SSL_CERTPROBLEM;
       goto quit;
     }
-/*
-    rc = ldap_start_tls_s(server, NULL, NULL);
-    if(rc != LDAP_SUCCESS) {
-      failf(data, "LDAP local: ERROR starting SSL/TLS mode: %s",
-              ldap_err2string(rc));
-      result = CURLE_SSL_CERTPROBLEM;
-      goto quit;
-    }
-*/
-#else
+#else /* !LDAP_OPT_X_TLS */
+    (void)ldap_option;
+    (void)ldap_ca;
     /* we should probably never come up to here since configure
        should check in first place if we can support LDAP SSL/TLS */
     failf(data, "LDAP local: SSL/TLS not supported with this version "
-            "of the OpenLDAP toolkit\n");
+          "of the OpenLDAP toolkit");
     result = CURLE_SSL_CERTPROBLEM;
     goto quit;
-#endif
-#endif
-#endif /* CURL_LDAP_USE_SSL */
+#endif /* LDAP_OPT_X_TLS */
+#endif /* USE_WIN32_LDAP */
+#endif /* HAVE_LDAP_SSL */
   }
   else if(data->set.use_ssl > CURLUSESSL_TRY) {
     failf(data, "LDAP local: explicit TLS not supported");
     result = CURLE_NOT_BUILT_IN;
     goto quit;
   }
-  else {
-    server = ldap_init(host, conn->port);
-    if(!server) {
-      failf(data, "LDAP local: Cannot connect to %s:%u",
-            conn->host.dispname, conn->port);
-      result = CURLE_COULDNT_CONNECT;
-      goto quit;
-    }
-  }
+
 #ifdef USE_WIN32_LDAP
-  ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
   rc = ldap_win_bind(data, server, user, passwd);
 #else
   rc = ldap_simple_bind_s(server, user, passwd);
 #endif
-  if(!ldap_ssl && rc) {
+  if(!ldap_ssl && rc != LDAP_SUCCESS) {
     ldap_proto = LDAP_VERSION2;
     ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
 #ifdef USE_WIN32_LDAP
@@ -523,7 +420,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
     rc = ldap_simple_bind_s(server, user, passwd);
 #endif
   }
-  if(rc) {
+  if(rc != LDAP_SUCCESS) {
 #ifdef USE_WIN32_LDAP
     failf(data, "LDAP local: bind via ldap_win_bind %s",
           ldap_err2string(rc));
@@ -535,20 +432,22 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
     goto quit;
   }
 
-  rc = ldap_search_s(server, ludp->lud_dn, ludp->lud_scope,
+  Curl_pgrsReset(data);
+  rc = ldap_search_s(server, ludp->lud_dn,
+                     ludp->lud_scope,
                      ludp->lud_filter, ludp->lud_attrs, 0, &ldapmsg);
 
-  if(rc && rc != LDAP_SIZELIMIT_EXCEEDED) {
+  if(rc != LDAP_SUCCESS && rc != LDAP_SIZELIMIT_EXCEEDED) {
     failf(data, "LDAP remote: %s", ldap_err2string(rc));
     result = CURLE_LDAP_SEARCH_FAILED;
     goto quit;
   }
 
-  for(num = 0, entryIterator = ldap_first_entry(server, ldapmsg);
+  num = 0;
+  for(entryIterator = ldap_first_entry(server, ldapmsg);
       entryIterator;
       entryIterator = ldap_next_entry(server, entryIterator), num++) {
-    BerElement *ber = NULL;
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
     TCHAR *attribute;
 #else
     char *attribute;
@@ -557,49 +456,29 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
 
     /* Get the DN and write it to the client */
     {
-      char *name;
-      size_t name_len;
-#if defined(USE_WIN32_LDAP)
+      char *name = NULL;
+      size_t name_len = 0;
+#ifdef USE_WIN32_LDAP
       TCHAR *dn = ldap_get_dn(server, entryIterator);
-      name = curlx_convert_tchar_to_UTF8(dn);
-      if(!name) {
-        ldap_memfree(dn);
-
-        result = CURLE_OUT_OF_MEMORY;
-
-        goto quit;
-      }
+      if(dn)
+        name = curlx_convert_tchar_to_UTF8(dn);
 #else
       char *dn = name = ldap_get_dn(server, entryIterator);
 #endif
-      name_len = strlen(name);
-
-      result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)"DN: ", 4);
-      if(result) {
-        FREE_ON_WINLDAP(name);
-        ldap_memfree(dn);
-        goto quit;
+      if(!name)
+        result = dn ? CURLE_OUT_OF_MEMORY : CURLE_FAILED_INIT;
+      else {
+        name_len = strlen(name);
+        result = Curl_client_write(data, CLIENTWRITE_BODY, "DN: ", 4);
       }
-
-      result = Curl_client_write(data, CLIENTWRITE_BODY, name, name_len);
-      if(result) {
-        FREE_ON_WINLDAP(name);
-        ldap_memfree(dn);
-        goto quit;
-      }
-
-      result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)"\n", 1);
-      if(result) {
-        FREE_ON_WINLDAP(name);
-        ldap_memfree(dn);
-
-        goto quit;
-      }
-
-      dlsize += name_len + 5;
-
+      if(!result)
+        result = Curl_client_write(data, CLIENTWRITE_BODY, name, name_len);
+      if(!result)
+        result = Curl_client_write(data, CLIENTWRITE_BODY, "\n", 1);
       FREE_ON_WINLDAP(name);
       ldap_memfree(dn);
+      if(result)
+        goto quit;
     }
 
     /* Get the attributes and write them to the client */
@@ -608,14 +487,11 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
         attribute = ldap_next_attribute(server, entryIterator, ber)) {
       BerValue **vals;
       size_t attr_len;
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
       char *attr = curlx_convert_tchar_to_UTF8(attribute);
       if(!attr) {
-        if(ber)
-          ber_free(ber, 0);
-
+        ldap_memfree(attribute);
         result = CURLE_OUT_OF_MEMORY;
-
         goto quit;
       }
 #else
@@ -625,15 +501,12 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
 
       vals = ldap_get_values_len(server, entryIterator, attribute);
       if(vals) {
-        for(i = 0; (vals[i] != NULL); i++) {
-          result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)"\t", 1);
+        for(i = 0; vals[i]; i++) {
+          result = Curl_client_write(data, CLIENTWRITE_BODY, "\t", 1);
           if(result) {
             ldap_value_free_len(vals);
             FREE_ON_WINLDAP(attr);
             ldap_memfree(attribute);
-            if(ber)
-              ber_free(ber, 0);
-
             goto quit;
           }
 
@@ -642,85 +515,83 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
             ldap_value_free_len(vals);
             FREE_ON_WINLDAP(attr);
             ldap_memfree(attribute);
-            if(ber)
-              ber_free(ber, 0);
-
             goto quit;
           }
 
-          result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)": ", 2);
+          result = Curl_client_write(data, CLIENTWRITE_BODY, ":", 1);
           if(result) {
             ldap_value_free_len(vals);
             FREE_ON_WINLDAP(attr);
             ldap_memfree(attribute);
-            if(ber)
-              ber_free(ber, 0);
-
             goto quit;
           }
 
-          dlsize += attr_len + 3;
+          if(ldap_value_needs_base64(attr, attr_len, vals[i])) {
+            char *val_b64 = NULL;
+            size_t val_b64_sz = 0;
 
-          if((attr_len > 7) &&
-             (strcmp(";binary", attr + (attr_len - 7)) == 0)) {
             /* Binary attribute, encode to base64. */
-            result = Curl_base64_encode(vals[i]->bv_val, vals[i]->bv_len,
-                                        &val_b64, &val_b64_sz);
-            if(result) {
-              ldap_value_free_len(vals);
-              FREE_ON_WINLDAP(attr);
-              ldap_memfree(attribute);
-              if(ber)
-                ber_free(ber, 0);
-
-              goto quit;
-            }
-
-            if(val_b64_sz > 0) {
-              result = Curl_client_write(data, CLIENTWRITE_BODY, val_b64,
-                                         val_b64_sz);
-              free(val_b64);
+            if(vals[i]->bv_len) {
+              result = curlx_base64_encode((uint8_t *)vals[i]->bv_val,
+                                           vals[i]->bv_len,
+                                           &val_b64, &val_b64_sz);
               if(result) {
                 ldap_value_free_len(vals);
                 FREE_ON_WINLDAP(attr);
                 ldap_memfree(attribute);
-                if(ber)
-                  ber_free(ber, 0);
-
                 goto quit;
               }
-
-              dlsize += val_b64_sz;
             }
+
+            result = Curl_client_write(data, CLIENTWRITE_BODY, ": ", 2);
+            if(result) {
+              curlx_free(val_b64);
+              ldap_value_free_len(vals);
+              FREE_ON_WINLDAP(attr);
+              ldap_memfree(attribute);
+              goto quit;
+            }
+
+            if(val_b64_sz) {
+              result = Curl_client_write(data, CLIENTWRITE_BODY, val_b64,
+                                         val_b64_sz);
+              if(result) {
+                curlx_free(val_b64);
+                ldap_value_free_len(vals);
+                FREE_ON_WINLDAP(attr);
+                ldap_memfree(attribute);
+                goto quit;
+              }
+            }
+
+            curlx_free(val_b64);
           }
           else {
-            result = Curl_client_write(data, CLIENTWRITE_BODY, vals[i]->bv_val,
-                                       vals[i]->bv_len);
+            result = Curl_client_write(data, CLIENTWRITE_BODY, " ", 1);
             if(result) {
               ldap_value_free_len(vals);
               FREE_ON_WINLDAP(attr);
               ldap_memfree(attribute);
-              if(ber)
-                ber_free(ber, 0);
-
               goto quit;
             }
 
-            dlsize += vals[i]->bv_len;
+            result = Curl_client_write(data, CLIENTWRITE_BODY,
+                                       vals[i]->bv_val, vals[i]->bv_len);
+            if(result) {
+              ldap_value_free_len(vals);
+              FREE_ON_WINLDAP(attr);
+              ldap_memfree(attribute);
+              goto quit;
+            }
           }
 
-          result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)"\n", 1);
+          result = Curl_client_write(data, CLIENTWRITE_BODY, "\n", 1);
           if(result) {
             ldap_value_free_len(vals);
             FREE_ON_WINLDAP(attr);
             ldap_memfree(attribute);
-            if(ber)
-              ber_free(ber, 0);
-
             goto quit;
           }
-
-          dlsize++;
         }
 
         /* Free memory used to store values */
@@ -731,18 +602,20 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
       FREE_ON_WINLDAP(attr);
       ldap_memfree(attribute);
 
-      result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)"\n", 1);
+      result = Curl_client_write(data, CLIENTWRITE_BODY, "\n", 1);
       if(result)
         goto quit;
-      dlsize++;
-      Curl_pgrsSetDownloadCounter(data, dlsize);
     }
 
-    if(ber)
+    if(ber) {
       ber_free(ber, 0);
+      ber = NULL;
+    }
   }
 
 quit:
+  if(ber)
+    ber_free(ber, 0);
   if(ldapmsg) {
     ldap_msgfree(ldapmsg);
     LDAP_TRACE(("Received %d entries\n", num));
@@ -753,38 +626,36 @@ quit:
     ldap_free_urldesc(ludp);
   if(server)
     ldap_unbind_s(server);
-#if defined(HAVE_LDAP_SSL) && defined(CURL_HAS_NOVELL_LDAPSDK)
-  if(ldap_ssl)
-    ldapssl_client_deinit();
-#endif /* HAVE_LDAP_SSL && CURL_HAS_NOVELL_LDAPSDK */
 
   FREE_ON_WINLDAP(host);
 
   /* no data to transfer */
-  Curl_setup_transfer(data, -1, -1, FALSE, -1);
+  Curl_xfer_setup_nop(data);
   connclose(conn, "LDAP connection always disable reuse");
 
   return result;
 }
 
 #ifdef DEBUG_LDAP
-static void _ldap_trace(const char *fmt, ...)
+static void ldap_trace_low(const char *fmt, ...)
 {
   static int do_trace = -1;
   va_list args;
 
   if(do_trace == -1) {
     const char *env = getenv("CURL_TRACE");
-    do_trace = (env && strtol(env, NULL, 10) > 0);
+    curl_off_t e = 0;
+    if(!curlx_str_number(&env, &e, INT_MAX))
+      do_trace = e > 0;
   }
   if(!do_trace)
     return;
 
   va_start(args, fmt);
-  vfprintf(stderr, fmt, args);
+  curl_mvfprintf(stderr, fmt, args);
   va_end(args);
 }
-#endif
+#endif /* DEBUG_LDAP */
 
 #ifndef HAVE_LDAP_URL_PARSE
 
@@ -793,49 +664,30 @@ static void _ldap_trace(const char *fmt, ...)
  */
 static int str2scope(const char *p)
 {
-  if(strcasecompare(p, "one"))
+  if(curl_strequal(p, "one"))
     return LDAP_SCOPE_ONELEVEL;
-  if(strcasecompare(p, "onetree"))
+  if(curl_strequal(p, "onetree"))
     return LDAP_SCOPE_ONELEVEL;
-  if(strcasecompare(p, "base"))
+  if(curl_strequal(p, "base"))
     return LDAP_SCOPE_BASE;
-  if(strcasecompare(p, "sub"))
+  if(curl_strequal(p, "sub"))
     return LDAP_SCOPE_SUBTREE;
-  if(strcasecompare(p, "subtree"))
+  if(curl_strequal(p, "subtree"))
     return LDAP_SCOPE_SUBTREE;
-  return (-1);
+  return -1;
 }
 
-/*
- * Split 'str' into strings separated by commas.
- * Note: out[] points into 'str'.
- */
-static bool split_str(char *str, char ***out, size_t *count)
+/* number of entries in the attributes list */
+static size_t num_entries(const char *s)
 {
-  char **res;
-  char *lasts;
-  char *s;
-  size_t  i;
   size_t items = 1;
 
-  s = strchr(str, ',');
+  s = strchr(s, ',');
   while(s) {
     items++;
-    s = strchr(++s, ',');
+    s = strchr(s + 1, ',');
   }
-
-  res = calloc(items, sizeof(char *));
-  if(!res)
-    return FALSE;
-
-  for(i = 0, s = strtok_r(str, ",", &lasts); s && i < items;
-      s = strtok_r(NULL, ",", &lasts), i++)
-    res[i] = s;
-
-  *out = res;
-  *count = items;
-
-  return TRUE;
+  return items;
 }
 
 /*
@@ -843,8 +695,8 @@ static bool split_str(char *str, char ***out, size_t *count)
  * Syntax:
  *   ldap://<hostname>:<port>/<base_dn>?<attributes>?<scope>?<filter>?<ext>
  *
- * <hostname> already known from 'conn->host.name'.
- * <port>     already known from 'conn->remote_port'.
+ * <hostname> already known from 'conn->origin->hostname'.
+ * <port>     already known from 'conn->origin->port'.
  * extract the rest from 'data->state.path+1'. All fields are optional.
  * e.g.
  *   ldap://<hostname>:<port>/?<attributes>?<scope>?<filter>
@@ -852,10 +704,11 @@ static bool split_str(char *str, char ***out, size_t *count)
  *
  * Defined in RFC4516 section 2.
  */
-static int _ldap_url_parse2(struct Curl_easy *data,
-                            const struct connectdata *conn, LDAPURLDesc *ludp)
+static curl_ldap_num_t ldap_url_parse2_low(struct Curl_easy *data,
+                                           const struct connectdata *conn,
+                                           LDAPURLDesc *ludp)
 {
-  int rc = LDAP_SUCCESS;
+  curl_ldap_num_t rc = LDAP_SUCCESS;
   char *p;
   char *path;
   char *q = NULL;
@@ -865,23 +718,23 @@ static int _ldap_url_parse2(struct Curl_easy *data,
   if(!data ||
      !data->state.up.path ||
      data->state.up.path[0] != '/' ||
-     !strncasecompare("LDAP", data->state.up.scheme, 4))
+     !curl_strnequal("LDAP", data->state.up.scheme, 4))
     return LDAP_INVALID_SYNTAX;
 
   ludp->lud_scope = LDAP_SCOPE_BASE;
-  ludp->lud_port  = conn->remote_port;
-  ludp->lud_host  = conn->host.name;
+  ludp->lud_port  = conn->origin->port;
+  ludp->lud_host  = conn->origin->hostname;
 
   /* Duplicate the path */
-  p = path = strdup(data->state.up.path + 1);
+  p = path = curlx_strdup(data->state.up.path + 1);
   if(!path)
     return LDAP_NO_MEMORY;
 
   /* Duplicate the query if present */
   if(data->state.up.query) {
-    q = query = strdup(data->state.up.query);
+    q = query = curlx_strdup(data->state.up.query);
     if(!query) {
-      free(path);
+      curlx_free(path);
       return LDAP_NO_MEMORY;
     }
   }
@@ -902,12 +755,12 @@ static int _ldap_url_parse2(struct Curl_easy *data,
       goto quit;
     }
 
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
     /* Convert the unescaped string to a tchar */
     ludp->lud_dn = curlx_convert_UTF8_to_tchar(unescaped);
 
     /* Free the unescaped string as we are done with it */
-    free(unescaped);
+    curlx_free(unescaped);
 
     if(!ludp->lud_dn) {
       rc = LDAP_NO_MEMORY;
@@ -929,59 +782,46 @@ static int _ldap_url_parse2(struct Curl_easy *data,
     *q++ = '\0';
 
   if(*p) {
-    char **attributes;
-    size_t count = 0;
-
-    /* Split the string into an array of attributes */
-    if(!split_str(p, &attributes, &count)) {
-      rc = LDAP_NO_MEMORY;
-
-      goto quit;
-    }
+    size_t count = num_entries(p); /* at least one */
+    const char *atp = p;
 
     /* Allocate our array (+1 for the NULL entry) */
-#if defined(USE_WIN32_LDAP)
-    ludp->lud_attrs = calloc(count + 1, sizeof(TCHAR *));
+#ifdef USE_WIN32_LDAP
+    ludp->lud_attrs = curlx_calloc(count + 1, sizeof(TCHAR *));
 #else
-    ludp->lud_attrs = calloc(count + 1, sizeof(char *));
+    ludp->lud_attrs = curlx_calloc(count + 1, sizeof(char *));
 #endif
     if(!ludp->lud_attrs) {
-      free(attributes);
-
       rc = LDAP_NO_MEMORY;
-
       goto quit;
     }
 
     for(i = 0; i < count; i++) {
       char *unescaped;
       CURLcode result;
+      struct Curl_str out;
 
-      LDAP_TRACE(("attr[%zu] '%s'\n", i, attributes[i]));
+      if(curlx_str_until(&atp, &out, 1024, ','))
+        break;
+
+      LDAP_TRACE(("attr[%zu] '%.*s'\n", i, (int)out.len, out.str));
 
       /* Unescape the attribute */
-      result = Curl_urldecode(attributes[i], 0, &unescaped, NULL,
-                              REJECT_ZERO);
+      result = Curl_urldecode(out.str, out.len, &unescaped, NULL, REJECT_ZERO);
       if(result) {
-        free(attributes);
-
         rc = LDAP_NO_MEMORY;
-
         goto quit;
       }
 
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
       /* Convert the unescaped string to a tchar */
       ludp->lud_attrs[i] = curlx_convert_UTF8_to_tchar(unescaped);
 
       /* Free the unescaped string as we are done with it */
-      free(unescaped);
+      curlx_free(unescaped);
 
       if(!ludp->lud_attrs[i]) {
-        free(attributes);
-
         rc = LDAP_NO_MEMORY;
-
         goto quit;
       }
 #else
@@ -989,9 +829,9 @@ static int _ldap_url_parse2(struct Curl_easy *data,
 #endif
 
       ludp->lud_attrs_dups++;
+      if(curlx_str_single(&atp, ','))
+        break;
     }
-
-    free(attributes);
   }
 
   p = q;
@@ -1037,12 +877,12 @@ static int _ldap_url_parse2(struct Curl_easy *data,
       goto quit;
     }
 
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
     /* Convert the unescaped string to a tchar */
     ludp->lud_filter = curlx_convert_UTF8_to_tchar(unescaped);
 
     /* Free the unescaped string as we are done with it */
-    free(unescaped);
+    curlx_free(unescaped);
 
     if(!ludp->lud_filter) {
       rc = LDAP_NO_MEMORY;
@@ -1062,58 +902,114 @@ static int _ldap_url_parse2(struct Curl_easy *data,
   }
 
 quit:
-  free(path);
-  free(query);
+  curlx_free(path);
+  curlx_free(query);
 
   return rc;
 }
 
-static int _ldap_url_parse(struct Curl_easy *data,
-                           const struct connectdata *conn,
-                           LDAPURLDesc **ludpp)
+static curl_ldap_num_t ldap_url_parse_low(struct Curl_easy *data,
+                                          const struct connectdata *conn,
+                                          LDAPURLDesc **ludpp)
 {
-  LDAPURLDesc *ludp = calloc(1, sizeof(*ludp));
-  int rc;
+  LDAPURLDesc *ludp = curlx_calloc(1, sizeof(*ludp));
+  curl_ldap_num_t rc;
 
   *ludpp = NULL;
   if(!ludp)
     return LDAP_NO_MEMORY;
 
-  rc = _ldap_url_parse2(data, conn, ludp);
+  rc = ldap_url_parse2_low(data, conn, ludp);
   if(rc != LDAP_SUCCESS) {
-    _ldap_free_urldesc(ludp);
+    ldap_free_urldesc_low(ludp);
     ludp = NULL;
   }
   *ludpp = ludp;
-  return (rc);
+  return rc;
 }
 
-static void _ldap_free_urldesc(LDAPURLDesc *ludp)
+static void ldap_free_urldesc_low(LDAPURLDesc *ludp)
 {
   if(!ludp)
     return;
 
-#if defined(USE_WIN32_LDAP)
-  curlx_unicodefree(ludp->lud_dn);
-  curlx_unicodefree(ludp->lud_filter);
-#else
-  free(ludp->lud_dn);
-  free(ludp->lud_filter);
-#endif
+  curlx_free(ludp->lud_dn);
+  curlx_free(ludp->lud_filter);
 
   if(ludp->lud_attrs) {
     size_t i;
     for(i = 0; i < ludp->lud_attrs_dups; i++) {
-#if defined(USE_WIN32_LDAP)
-      curlx_unicodefree(ludp->lud_attrs[i]);
-#else
-      free(ludp->lud_attrs[i]);
-#endif
+      curlx_free(ludp->lud_attrs[i]);
     }
-    free(ludp->lud_attrs);
+    curlx_free(ludp->lud_attrs);
   }
 
-  free(ludp);
+  curlx_free(ludp);
 }
-#endif  /* !HAVE_LDAP_URL_PARSE */
-#endif  /* !CURL_DISABLE_LDAP && !USE_OPENLDAP */
+#endif /* !HAVE_LDAP_URL_PARSE */
+
+void Curl_ldap_version(char *buf, size_t bufsz)
+{
+#ifdef USE_WIN32_LDAP
+  curl_msnprintf(buf, bufsz, "WinLDAP");
+#else
+#ifdef LDAP_OPT_X_TLS_PASSPHRASE
+  static const char *flavor = "/Apple";
+#else
+  static const char *flavor = "";
+#endif
+  LDAPAPIInfo api;
+  api.ldapai_info_version = LDAP_API_INFO_VERSION;
+
+  /* Comparing against 0, as different platforms
+     disagree on the success define name */
+  if(ldap_get_option(NULL, LDAP_OPT_API_INFO, &api) == 0) {
+    unsigned int patch = (unsigned int)(api.ldapai_vendor_version % 100);
+    unsigned int major = (unsigned int)(api.ldapai_vendor_version / 10000);
+    unsigned int minor =
+      (((unsigned int)api.ldapai_vendor_version - (major * 10000))
+       - patch) / 100;
+#ifdef __OS400__
+    curl_msnprintf(buf, bufsz, "IBMLDAP/%u.%u.%u", major, minor, patch);
+    ldap_value_free(api.ldapai_extensions);
+    (void)flavor;
+#else
+    curl_msnprintf(buf, bufsz, "%s/%u.%u.%u%s",
+                   api.ldapai_vendor_name, major, minor, patch, flavor);
+    ldap_memfree(api.ldapai_vendor_name);
+    ber_memvfree((void **)api.ldapai_extensions);
+#endif
+  }
+  else
+    curl_msnprintf(buf, bufsz, "LDAP/1");
+#endif /* USE_WIN32_LDAP */
+}
+
+/*
+ * LDAP protocol handler.
+ */
+const struct Curl_protocol Curl_protocol_ldap = {
+  ZERO_NULL,                            /* setup_connection */
+  ldap_do,                              /* do_it */
+  ZERO_NULL,                            /* done */
+  ZERO_NULL,                            /* do_more */
+  ZERO_NULL,                            /* connect_it */
+  ZERO_NULL,                            /* connecting */
+  ZERO_NULL,                            /* doing */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
+  ZERO_NULL,                            /* disconnect */
+  ZERO_NULL,                            /* write_resp */
+  ZERO_NULL,                            /* write_resp_hd */
+  ZERO_NULL,                            /* connection_is_dead */
+  ZERO_NULL,                            /* attach connection */
+  ZERO_NULL,                            /* follow */
+};
+
+#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
+#pragma GCC diagnostic pop
+#endif
+
+#endif /* !CURL_DISABLE_LDAP && !USE_OPENLDAP */
diff --git a/third-party/curl/libcurl.def b/third-party/curl/lib/libcurl.def
similarity index 89%
rename from third-party/curl/libcurl.def
rename to third-party/curl/lib/libcurl.def
index 1de609e80d..803f372041 100644
--- a/third-party/curl/libcurl.def
+++ b/third-party/curl/lib/libcurl.def
@@ -15,6 +15,8 @@ curl_easy_recv
 curl_easy_reset
 curl_easy_send
 curl_easy_setopt
+curl_easy_ssls_export
+curl_easy_ssls_import
 curl_easy_strerror
 curl_easy_unescape
 curl_easy_upkeep
@@ -51,8 +53,12 @@ curl_multi_add_handle
 curl_multi_assign
 curl_multi_cleanup
 curl_multi_fdset
+curl_multi_get_handles
+curl_multi_get_offt
 curl_multi_info_read
 curl_multi_init
+curl_multi_notify_disable
+curl_multi_notify_enable
 curl_multi_perform
 curl_multi_poll
 curl_multi_remove_handle
@@ -63,6 +69,7 @@ curl_multi_socket_all
 curl_multi_strerror
 curl_multi_timeout
 curl_multi_wait
+curl_multi_waitfds
 curl_multi_wakeup
 curl_mvaprintf
 curl_mvfprintf
@@ -91,3 +98,4 @@ curl_version_info
 curl_ws_meta
 curl_ws_recv
 curl_ws_send
+curl_ws_start_frame
diff --git a/third-party/curl/lib/libcurl.plist.in b/third-party/curl/lib/libcurl.plist.in
deleted file mode 100644
index d2e6492f69..0000000000
--- a/third-party/curl/lib/libcurl.plist.in
+++ /dev/null
@@ -1,35 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist SYSTEM "file://localhost/System/Library/DTDs/PropertyList.dtd">
-<plist version="0.9">
-<dict>
-	<key>CFBundleInfoDictionaryVersion</key>
-	<string>6.0</string>
-
-	<key>CFBundleDevelopmentRegion</key>
-	<string>English</string>
-
-	<key>CFBundleExecutable</key>
-	<string>curl</string>
-
-	<key>CFBundleIdentifier</key>
-	<string>se.curl.libcurl</string>
-
-	<key>CFBundleVersion</key>
-	<string>@CURL_PLIST_VERSION@</string>
-
-	<key>CFBundleName</key>
-	<string>libcurl</string>
-
-	<key>CFBundlePackageType</key>
-	<string>FMWK</string>
-
-	<key>CFBundleSignature</key>
-	<string>????</string>
-
-	<key>CFBundleShortVersionString</key>
-	<string>libcurl @CURL_PLIST_VERSION@</string>
-
-	<key>CFBundleGetInfoString</key>
-	<string>libcurl.plist @CURL_PLIST_VERSION@</string>
-</dict>
-</plist>
diff --git a/third-party/curl/lib/libcurl.rc b/third-party/curl/lib/libcurl.rc
index daa2d62d8a..81cd8d71b4 100644
--- a/third-party/curl/lib/libcurl.rc
+++ b/third-party/curl/lib/libcurl.rc
@@ -32,7 +32,7 @@ VS_VERSION_INFO VERSIONINFO
   FILEVERSION     RC_VERSION
   PRODUCTVERSION  RC_VERSION
   FILEFLAGSMASK   VS_FFI_FILEFLAGSMASK
-#if defined(DEBUGBUILD) || defined(_DEBUG)
+#if defined(DEBUGBUILD) || defined(UNITTESTS) || defined(_DEBUG)
   FILEFLAGS VS_FF_DEBUG
 #else
   FILEFLAGS 0L
diff --git a/third-party/curl/lib/libcurl.vers.in b/third-party/curl/lib/libcurl.vers.in
index ae978a485d..8219669993 100644
--- a/third-party/curl/lib/libcurl.vers.in
+++ b/third-party/curl/lib/libcurl.vers.in
@@ -1,12 +1,4 @@
-HIDDEN
-{
-  local:
-    __*;
-    _rest*;
-    _save*;
-};
-
-CURL_@CURL_LT_SHLIB_VERSIONED_FLAVOUR@4
+CURL_@CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX@@CURL_LIBCURL_VERSIONED_SYMBOLS_SONAME@
 {
   global: curl_*;
   local: *;
diff --git a/third-party/curl/lib/llist.c b/third-party/curl/lib/llist.c
index 5b6b0336da..ce0c59cc50 100644
--- a/third-party/curl/lib/llist.c
+++ b/third-party/curl/lib/llist.c
@@ -21,27 +21,36 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include <curl/curl.h>
-
 #include "llist.h"
-#include "curl_memory.h"
 
-/* this must be the last include file */
-#include "memdebug.h"
+#ifdef DEBUGBUILD
+#define LLISTINIT 0x100cc001 /* random pattern */
+#define NODEINIT  0x12344321 /* random pattern */
+#define NODEREM   0x54321012 /* random pattern */
 
-/*
- * @unittest: 1300
- */
-void
-Curl_llist_init(struct Curl_llist *l, Curl_llist_dtor dtor)
+#define VERIFYNODE(x) verifynode(x)
+static struct Curl_llist_node *verifynode(struct Curl_llist_node *n)
 {
-  l->size = 0;
-  l->dtor = dtor;
-  l->head = NULL;
-  l->tail = NULL;
+  DEBUGASSERT(!n || (n->_init == NODEINIT));
+  return n;
+}
+#else
+#define VERIFYNODE(x) x
+#endif
+/*
+ * @unittest 1300
+ */
+void Curl_llist_init(struct Curl_llist *l, Curl_llist_dtor dtor)
+{
+  l->_size = 0;
+  l->_dtor = dtor;
+  l->_head = NULL;
+  l->_tail = NULL;
+#ifdef DEBUGBUILD
+  l->_init = LLISTINIT;
+#endif
 }
 
 /*
@@ -53,94 +62,211 @@ Curl_llist_init(struct Curl_llist *l, Curl_llist_dtor dtor)
  *
  * The 'ne' argument should be a pointer into the object to store.
  *
- * @unittest: 1300
+ * @unittest 1300
  */
-void
-Curl_llist_insert_next(struct Curl_llist *list, struct Curl_llist_element *e,
-                       const void *p,
-                       struct Curl_llist_element *ne)
+void Curl_llist_insert_next(struct Curl_llist *list,
+                            struct Curl_llist_node *e, /* may be NULL */
+                            const void *p,
+                            struct Curl_llist_node *ne)
 {
-  ne->ptr = (void *) p;
-  if(list->size == 0) {
-    list->head = ne;
-    list->head->prev = NULL;
-    list->head->next = NULL;
-    list->tail = ne;
+  DEBUGASSERT(list);
+  DEBUGASSERT(list->_init == LLISTINIT);
+  DEBUGASSERT(ne);
+
+#ifdef DEBUGBUILD
+  ne->_init = NODEINIT;
+#endif
+  ne->_ptr = CURL_UNCONST(p);
+  ne->_list = list;
+  if(list->_size == 0) {
+    list->_head = ne;
+    list->_head->_prev = NULL;
+    list->_head->_next = NULL;
+    list->_tail = ne;
   }
   else {
     /* if 'e' is NULL here, we insert the new element first in the list */
-    ne->next = e?e->next:list->head;
-    ne->prev = e;
+    ne->_next = e ? e->_next : list->_head;
+    ne->_prev = e;
     if(!e) {
-      list->head->prev = ne;
-      list->head = ne;
+      list->_head->_prev = ne;
+      list->_head = ne;
     }
-    else if(e->next) {
-      e->next->prev = ne;
+    else if(e->_next) {
+      e->_next->_prev = ne;
     }
     else {
-      list->tail = ne;
+      list->_tail = ne;
     }
     if(e)
-      e->next = ne;
+      e->_next = ne;
   }
 
-  ++list->size;
+  ++list->_size;
 }
 
 /*
- * @unittest: 1300
+ * Curl_llist_append()
+ *
+ * Adds a new list element to the end of the list.
+ *
+ * The 'ne' argument should be a pointer into the object to store.
+ *
+ * @unittest 1300
  */
-void
-Curl_llist_remove(struct Curl_llist *list, struct Curl_llist_element *e,
-                  void *user)
+void Curl_llist_append(struct Curl_llist *list, const void *p,
+                       struct Curl_llist_node *ne)
+{
+  DEBUGASSERT(list);
+  DEBUGASSERT(list->_init == LLISTINIT);
+  DEBUGASSERT(ne);
+  Curl_llist_insert_next(list, list->_tail, p, ne);
+}
+
+void *Curl_node_take_elem(struct Curl_llist_node *e)
 {
   void *ptr;
-  if(!e || list->size == 0)
+  struct Curl_llist *list;
+  if(!e)
+    return NULL;
+
+  list = e->_list;
+  DEBUGASSERT(list);
+  DEBUGASSERT(list->_init == LLISTINIT);
+  DEBUGASSERT(list->_size);
+  DEBUGASSERT(e->_init == NODEINIT);
+  if(list) {
+    if(e == list->_head) {
+      list->_head = e->_next;
+
+      if(!list->_head)
+        list->_tail = NULL;
+      else
+        e->_next->_prev = NULL;
+    }
+    else {
+      if(e->_prev)
+        e->_prev->_next = e->_next;
+
+      if(!e->_next)
+        list->_tail = e->_prev;
+      else
+        e->_next->_prev = e->_prev;
+    }
+    --list->_size;
+  }
+  ptr = e->_ptr;
+
+  e->_list = NULL;
+  e->_ptr  = NULL;
+  e->_prev = NULL;
+  e->_next = NULL;
+#ifdef DEBUGBUILD
+  e->_init = NODEREM; /* specific pattern on remove - not zero */
+#endif
+
+  return ptr;
+}
+
+static void node_uremove(struct Curl_llist_node *e, void *user)
+{
+  struct Curl_llist *list;
+  void *ptr;
+  if(!e)
     return;
 
-  if(e == list->head) {
-    list->head = e->next;
-
-    if(!list->head)
-      list->tail = NULL;
-    else
-      e->next->prev = NULL;
+  list = e->_list;
+  DEBUGASSERT(list);
+  if(list) {
+    ptr = Curl_node_take_elem(e);
+    if(list->_dtor)
+      list->_dtor(user, ptr);
   }
-  else {
-    if(e->prev)
-      e->prev->next = e->next;
-
-    if(!e->next)
-      list->tail = e->prev;
-    else
-      e->next->prev = e->prev;
-  }
-
-  ptr = e->ptr;
-
-  e->ptr  = NULL;
-  e->prev = NULL;
-  e->next = NULL;
-
-  --list->size;
-
-  /* call the dtor() last for when it actually frees the 'e' memory itself */
-  if(list->dtor)
-    list->dtor(user, ptr);
 }
 
-void
-Curl_llist_destroy(struct Curl_llist *list, void *user)
+void Curl_node_remove(struct Curl_llist_node *e)
+{
+  node_uremove(e, NULL);
+}
+
+void Curl_llist_destroy(struct Curl_llist *list, void *user)
 {
   if(list) {
-    while(list->size > 0)
-      Curl_llist_remove(list, list->tail, user);
+    DEBUGASSERT(list->_init == LLISTINIT);
+    while(list->_size > 0)
+      node_uremove(list->_tail, user);
   }
 }
 
-size_t
-Curl_llist_count(struct Curl_llist *list)
+/* Curl_llist_head() returns the first 'struct Curl_llist_node *', which
+   might be NULL */
+struct Curl_llist_node *Curl_llist_head(const struct Curl_llist *list)
 {
-  return list->size;
+  DEBUGASSERT(list);
+  DEBUGASSERT(list->_init == LLISTINIT);
+  return VERIFYNODE(list->_head);
+}
+
+#ifdef UNITTESTS
+/* llist_tail() returns the last 'struct Curl_llist_node *', which might be
+   NULL
+
+   @unittest 1300
+*/
+UNITTEST struct Curl_llist_node *llist_tail(const struct Curl_llist *list);
+UNITTEST struct Curl_llist_node *llist_tail(const struct Curl_llist *list)
+{
+  DEBUGASSERT(list);
+  DEBUGASSERT(list->_init == LLISTINIT);
+  return VERIFYNODE(list->_tail);
+}
+#endif
+
+/* Curl_llist_count() returns a size_t the number of nodes in the list */
+size_t Curl_llist_count(const struct Curl_llist *list)
+{
+  DEBUGASSERT(list);
+  DEBUGASSERT(list->_init == LLISTINIT);
+  return list->_size;
+}
+
+/* Curl_node_elem() returns the custom data from a Curl_llist_node */
+void *Curl_node_elem(const struct Curl_llist_node *n)
+{
+  DEBUGASSERT(n);
+  DEBUGASSERT(n->_init == NODEINIT);
+  return n->_ptr;
+}
+
+/* Curl_node_next() returns the next element in a list from a given
+   Curl_llist_node */
+struct Curl_llist_node *Curl_node_next(const struct Curl_llist_node *n)
+{
+  DEBUGASSERT(n);
+  DEBUGASSERT(n->_init == NODEINIT);
+  return VERIFYNODE(n->_next);
+}
+
+#ifdef UNITTESTS
+/* llist_node_prev() returns the previous element in a list from a given
+   Curl_llist_node
+
+   @unittest 1300
+*/
+UNITTEST struct Curl_llist_node *llist_node_prev(
+  const struct Curl_llist_node *n);
+UNITTEST struct Curl_llist_node *llist_node_prev(
+  const struct Curl_llist_node *n)
+{
+  DEBUGASSERT(n);
+  DEBUGASSERT(n->_init == NODEINIT);
+  return VERIFYNODE(n->_prev);
+}
+#endif
+
+struct Curl_llist *Curl_node_llist(const struct Curl_llist_node *n)
+{
+  DEBUGASSERT(n);
+  DEBUGASSERT(!n->_list || n->_init == NODEINIT);
+  return n->_list;
 }
diff --git a/third-party/curl/lib/llist.h b/third-party/curl/lib/llist.h
index 320580e33c..de4adc972f 100644
--- a/third-party/curl/lib/llist.h
+++ b/third-party/curl/lib/llist.h
@@ -23,30 +23,60 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
-#include <stddef.h>
 
-typedef void (*Curl_llist_dtor)(void *, void *);
+typedef void (*Curl_llist_dtor)(void *user, void *elem);
 
-struct Curl_llist_element {
-  void *ptr;
-  struct Curl_llist_element *prev;
-  struct Curl_llist_element *next;
-};
+/* none of these struct members should be referenced directly, use the
+   dedicated functions */
 
 struct Curl_llist {
-  struct Curl_llist_element *head;
-  struct Curl_llist_element *tail;
-  Curl_llist_dtor dtor;
-  size_t size;
+  struct Curl_llist_node *_head;
+  struct Curl_llist_node *_tail;
+  Curl_llist_dtor _dtor;
+  size_t _size;
+#ifdef DEBUGBUILD
+  int _init;      /* detect API usage mistakes */
+#endif
 };
 
-void Curl_llist_init(struct Curl_llist *, Curl_llist_dtor);
-void Curl_llist_insert_next(struct Curl_llist *, struct Curl_llist_element *,
-                            const void *, struct Curl_llist_element *node);
-void Curl_llist_remove(struct Curl_llist *, struct Curl_llist_element *,
-                       void *);
-size_t Curl_llist_count(struct Curl_llist *);
-void Curl_llist_destroy(struct Curl_llist *, void *);
+struct Curl_llist_node {
+  struct Curl_llist *_list; /* the list where this belongs */
+  void *_ptr;
+  struct Curl_llist_node *_prev;
+  struct Curl_llist_node *_next;
+#ifdef DEBUGBUILD
+  int _init;      /* detect API usage mistakes */
+#endif
+};
+
+void Curl_llist_init(struct Curl_llist *l, Curl_llist_dtor dtor);
+void Curl_llist_insert_next(struct Curl_llist *list, struct Curl_llist_node *e,
+                            const void *p, struct Curl_llist_node *ne);
+void Curl_llist_append(struct Curl_llist *list, const void *p,
+                       struct Curl_llist_node *ne);
+void Curl_node_remove(struct Curl_llist_node *e);
+void Curl_llist_destroy(struct Curl_llist *list, void *user);
+
+/* Curl_llist_head() returns the first 'struct Curl_llist_node *', which
+   might be NULL */
+struct Curl_llist_node *Curl_llist_head(const struct Curl_llist *list);
+
+/* Curl_llist_count() returns a size_t the number of nodes in the list */
+size_t Curl_llist_count(const struct Curl_llist *list);
+
+/* Curl_node_elem() returns the custom data from a Curl_llist_node */
+void *Curl_node_elem(const struct Curl_llist_node *n);
+
+/* Remove the node from the list and return the custom data
+ * from a Curl_llist_node. Does NOT invoke a registered `dtor`. */
+void *Curl_node_take_elem(struct Curl_llist_node *e);
+
+/* Curl_node_next() returns the next element in a list from a given
+   Curl_llist_node */
+struct Curl_llist_node *Curl_node_next(const struct Curl_llist_node *n);
+
+/* Curl_node_llist() return the list the node is in or NULL. */
+struct Curl_llist *Curl_node_llist(const struct Curl_llist_node *n);
+
 #endif /* HEADER_CURL_LLIST_H */
diff --git a/third-party/curl/lib/macos.c b/third-party/curl/lib/macos.c
index 9e8e76e867..334dbc7d1d 100644
--- a/third-party/curl/lib/macos.c
+++ b/third-party/curl/lib/macos.c
@@ -21,34 +21,29 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef CURL_MACOS_CALL_COPYPROXIES
 
-#include <curl/curl.h>
-
 #include "macos.h"
 
 #include <SystemConfiguration/SCDynamicStoreCopySpecific.h>
 
 CURLcode Curl_macos_init(void)
 {
-  {
-    /*
-     * The automagic conversion from IPv4 literals to IPv6 literals only
-     * works if the SCDynamicStoreCopyProxies system function gets called
-     * first. As Curl currently doesn't support system-wide HTTP proxies, we
-     * therefore don't use any value this function might return.
-     *
-     * This function is only available on macOS and is not needed for
-     * IPv4-only builds, hence the conditions for defining
-     * CURL_MACOS_CALL_COPYPROXIES in curl_setup.h.
-     */
-    CFDictionaryRef dict = SCDynamicStoreCopyProxies(NULL);
-    if(dict)
-      CFRelease(dict);
-  }
+  /*
+   * The automagic conversion from IPv4 literals to IPv6 literals only
+   * works if the SCDynamicStoreCopyProxies system function gets called
+   * first. As curl currently does not support system-wide HTTP proxies, we
+   * therefore do not use any value this function might return.
+   *
+   * This function is only available on macOS and is not needed for
+   * IPv4-only builds, hence the conditions for defining
+   * CURL_MACOS_CALL_COPYPROXIES in curl_setup.h.
+   */
+  CFDictionaryRef dict = SCDynamicStoreCopyProxies(NULL);
+  if(dict)
+    CFRelease(dict);
   return CURLE_OK;
 }
 
diff --git a/third-party/curl/lib/macos.h b/third-party/curl/lib/macos.h
index 637860e80f..0a72a30272 100644
--- a/third-party/curl/lib/macos.h
+++ b/third-party/curl/lib/macos.h
@@ -23,17 +23,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef CURL_MACOS_CALL_COPYPROXIES
-
 CURLcode Curl_macos_init(void);
-
 #else
-
 #define Curl_macos_init() CURLE_OK
-
 #endif
 
 #endif /* HEADER_CURL_MACOS_H */
diff --git a/third-party/curl/lib/md4.c b/third-party/curl/lib/md4.c
index 30ab62e602..e030ffac30 100644
--- a/third-party/curl/lib/md4.c
+++ b/third-party/curl/lib/md4.c
@@ -21,52 +21,65 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#if defined(USE_CURL_NTLM_CORE)
-
-#include <string.h>
+#ifdef USE_CURL_NTLM_CORE
 
 #include "curl_md4.h"
-#include "warnless.h"
 
 #ifdef USE_OPENSSL
-#include <openssl/opensslconf.h>
-#if defined(OPENSSL_VERSION_MAJOR) && (OPENSSL_VERSION_MAJOR >= 3) && \
-   !defined(USE_AMISSL)
+#include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && !defined(USE_AMISSL)
 /* OpenSSL 3.0.0 marks the MD4 functions as deprecated */
 #define OPENSSL_NO_MD4
+#else
+/* Cover also OPENSSL_NO_MD4 configured in OpenSSL */
+#include <openssl/opensslconf.h>
 #endif
 #endif /* USE_OPENSSL */
 
 #ifdef USE_WOLFSSL
 #include <wolfssl/options.h>
-#define VOID_MD4_INIT
-#ifdef NO_MD4
-#define WOLFSSL_NO_MD4
-#endif
 #endif
 
-#ifdef USE_MBEDTLS
-#include <mbedtls/version.h>
-#if MBEDTLS_VERSION_NUMBER >= 0x03000000
-#include <mbedtls/mbedtls_config.h>
-#else
-#include <mbedtls/config.h>
-#endif
-#if(MBEDTLS_VERSION_NUMBER >= 0x02070000)
-  #define HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS
-#endif
-#endif /* USE_MBEDTLS */
-
-#if defined(USE_GNUTLS)
-#include <nettle/md4.h>
 /* When OpenSSL or wolfSSL is available, we use their MD4 functions. */
-#elif defined(USE_WOLFSSL) && !defined(WOLFSSL_NO_MD4)
-#include <wolfssl/openssl/md4.h>
-#elif defined(USE_OPENSSL) && !defined(OPENSSL_NO_MD4)
+
+#if defined(USE_OPENSSL) && !defined(OPENSSL_NO_MD4)
 #include <openssl/md4.h>
+
+/* Map directly to OpenSSL implementation */
+#define my_md4_ctx    MD4_CTX
+#define my_md4_init   MD4_Init
+#define my_md4_update MD4_Update
+#define my_md4_final  MD4_Final
+
+#elif defined(USE_WOLFSSL) && !defined(NO_MD4)
+#include <wolfssl/wolfcrypt/md4.h>
+#include <wolfssl/version.h>
+
+#if LIBWOLFSSL_VERSION_HEX >= 0x05007006
+typedef wc_Md4 my_md4_ctx;
+#else
+typedef Md4 my_md4_ctx;
+#endif
+
+static int my_md4_init(my_md4_ctx *ctx)
+{
+  wc_InitMd4(ctx);
+  return 1;
+}
+
+static void my_md4_update(my_md4_ctx *ctx,
+                          const void *input, unsigned long len)
+{
+  wc_Md4Update(ctx, input, (word32)len);
+}
+
+static void my_md4_final(unsigned char *digest, my_md4_ctx *ctx)
+{
+  wc_Md4Final(ctx, digest);
+}
+
 #elif (defined(__MAC_OS_X_VERSION_MAX_ALLOWED) && \
               (__MAC_OS_X_VERSION_MAX_ALLOWED >= 1040) && \
        defined(__MAC_OS_X_VERSION_MIN_REQUIRED) && \
@@ -75,71 +88,36 @@
               (__IPHONE_OS_VERSION_MAX_ALLOWED >= 20000) && \
        defined(__IPHONE_OS_VERSION_MIN_REQUIRED) && \
               (__IPHONE_OS_VERSION_MIN_REQUIRED < 130000))
-#define AN_APPLE_OS
 #include <CommonCrypto/CommonDigest.h>
-#elif defined(USE_WIN32_CRYPTO)
-#include <wincrypt.h>
-#elif(defined(USE_MBEDTLS) && defined(MBEDTLS_MD4_C))
-#include <mbedtls/md4.h>
-#endif
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+typedef CC_MD4_CTX my_md4_ctx;
 
-
-#if defined(USE_GNUTLS)
-
-typedef struct md4_ctx MD4_CTX;
-
-static int MD4_Init(MD4_CTX *ctx)
-{
-  md4_init(ctx);
-  return 1;
-}
-
-static void MD4_Update(MD4_CTX *ctx, const void *data, unsigned long size)
-{
-  md4_update(ctx, size, data);
-}
-
-static void MD4_Final(unsigned char *result, MD4_CTX *ctx)
-{
-  md4_digest(ctx, MD4_DIGEST_SIZE, result);
-}
-
-#elif defined(USE_WOLFSSL) && !defined(WOLFSSL_NO_MD4)
-
-#elif defined(USE_OPENSSL) && !defined(OPENSSL_NO_MD4)
-
-#elif defined(AN_APPLE_OS)
-typedef CC_MD4_CTX MD4_CTX;
-
-static int MD4_Init(MD4_CTX *ctx)
+static int my_md4_init(my_md4_ctx *ctx)
 {
   return CC_MD4_Init(ctx);
 }
 
-static void MD4_Update(MD4_CTX *ctx, const void *data, unsigned long size)
+static void my_md4_update(my_md4_ctx *ctx,
+                          const void *input, unsigned long len)
 {
-  (void)CC_MD4_Update(ctx, data, (CC_LONG)size);
+  (void)CC_MD4_Update(ctx, input, (CC_LONG)len);
 }
 
-static void MD4_Final(unsigned char *result, MD4_CTX *ctx)
+static void my_md4_final(unsigned char *digest, my_md4_ctx *ctx)
 {
-  (void)CC_MD4_Final(result, ctx);
+  (void)CC_MD4_Final(digest, ctx);
 }
 
 #elif defined(USE_WIN32_CRYPTO)
+#include <wincrypt.h>
 
 struct md4_ctx {
   HCRYPTPROV hCryptProv;
   HCRYPTHASH hHash;
 };
-typedef struct md4_ctx MD4_CTX;
+typedef struct md4_ctx my_md4_ctx;
 
-static int MD4_Init(MD4_CTX *ctx)
+static int my_md4_init(my_md4_ctx *ctx)
 {
   ctx->hCryptProv = 0;
   ctx->hHash = 0;
@@ -157,18 +135,19 @@ static int MD4_Init(MD4_CTX *ctx)
   return 1;
 }
 
-static void MD4_Update(MD4_CTX *ctx, const void *data, unsigned long size)
+static void my_md4_update(my_md4_ctx *ctx,
+                          const void *input, unsigned long len)
 {
-  CryptHashData(ctx->hHash, (BYTE *)data, (unsigned int) size, 0);
+  CryptHashData(ctx->hHash, (const BYTE *)input, (unsigned int)len, 0);
 }
 
-static void MD4_Final(unsigned char *result, MD4_CTX *ctx)
+static void my_md4_final(unsigned char *digest, my_md4_ctx *ctx)
 {
   unsigned long length = 0;
 
   CryptGetHashParam(ctx->hHash, HP_HASHVAL, NULL, &length, 0);
   if(length == MD4_DIGEST_LENGTH)
-    CryptGetHashParam(ctx->hHash, HP_HASHVAL, result, &length, 0);
+    CryptGetHashParam(ctx->hHash, HP_HASHVAL, digest, &length, 0);
 
   if(ctx->hHash)
     CryptDestroyHash(ctx->hHash);
@@ -177,100 +156,68 @@ static void MD4_Final(unsigned char *result, MD4_CTX *ctx)
     CryptReleaseContext(ctx->hCryptProv, 0);
 }
 
-#elif(defined(USE_MBEDTLS) && defined(MBEDTLS_MD4_C))
+#elif defined(USE_GNUTLS)
+#include <nettle/md4.h>
+#include <nettle/version.h>
 
-struct md4_ctx {
-  void *data;
-  unsigned long size;
-};
-typedef struct md4_ctx MD4_CTX;
+typedef struct md4_ctx my_md4_ctx;
 
-static int MD4_Init(MD4_CTX *ctx)
+static int my_md4_init(my_md4_ctx *ctx)
 {
-  ctx->data = NULL;
-  ctx->size = 0;
+  md4_init(ctx);
   return 1;
 }
 
-static void MD4_Update(MD4_CTX *ctx, const void *data, unsigned long size)
+static void my_md4_update(my_md4_ctx *ctx,
+                          const void *input, unsigned long len)
 {
-  if(!ctx->data) {
-    ctx->data = malloc(size);
-    if(ctx->data) {
-      memcpy(ctx->data, data, size);
-      ctx->size = size;
-    }
-  }
+  md4_update(ctx, len, input);
 }
 
-static void MD4_Final(unsigned char *result, MD4_CTX *ctx)
+static void my_md4_final(unsigned char *digest, my_md4_ctx *ctx)
 {
-  if(ctx->data) {
-#if !defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
-    mbedtls_md4(ctx->data, ctx->size, result);
+#if NETTLE_VERSION_MAJOR >= 4
+  md4_digest(ctx, digest);
 #else
-    (void) mbedtls_md4_ret(ctx->data, ctx->size, result);
+  md4_digest(ctx, MD4_DIGEST_SIZE, digest);
 #endif
-
-    Curl_safefree(ctx->data);
-    ctx->size = 0;
-  }
 }
 
 #else
-/* When no other crypto library is available, or the crypto library doesn't
+/* When no other crypto library is available, or the crypto library does not
  * support MD4, we use this code segment this implementation of it
  *
  * This is an OpenSSL-compatible implementation of the RSA Data Security, Inc.
  * MD4 Message-Digest Algorithm (RFC 1320).
  *
  * Homepage:
- https://openwall.info/wiki/people/solar/software/public-domain-source-code/md4
+ * https://openwall.info/wiki/people/solar/software/public-domain-source-code/md4
  *
  * Author:
  * Alexander Peslyak, better known as Solar Designer <solar at openwall.com>
  *
- * This software was written by Alexander Peslyak in 2001.  No copyright is
- * claimed, and the software is hereby placed in the public domain.  In case
+ * This software was written by Alexander Peslyak in 2001. No copyright is
+ * claimed, and the software is hereby placed in the public domain. In case
  * this attempt to disclaim copyright and place the software in the public
  * domain is deemed null and void, then the software is Copyright (c) 2001
- * Alexander Peslyak and it is hereby released to the general public under the
- * following terms:
+ * Alexander Peslyak and it is hereby released to the general public under
+ * the following terms:
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted.
  *
- * There's ABSOLUTELY NO WARRANTY, express or implied.
+ * There is ABSOLUTELY NO WARRANTY, express or implied.
  *
  * (This is a heavily cut-down "BSD license".)
- *
- * This differs from Colin Plumb's older public domain implementation in that
- * no exactly 32-bit integer data type is required (any 32-bit or wider
- * unsigned integer data type will do), there's no compile-time endianness
- * configuration, and the function prototypes match OpenSSL's.  No code from
- * Colin Plumb's implementation has been reused; this comment merely compares
- * the properties of the two independent implementations.
- *
- * The primary goals of this implementation are portability and ease of use.
- * It is meant to be fast, but not as fast as possible.  Some known
- * optimizations are not included to reduce source code size and avoid
- * compile-time configuration.
  */
 
-/* Any 32-bit or wider unsigned integer data type will do */
-typedef unsigned int MD4_u32plus;
-
 struct md4_ctx {
-  MD4_u32plus lo, hi;
-  MD4_u32plus a, b, c, d;
+  uint32_t lo, hi;
+  uint32_t a, b, c, d;
   unsigned char buffer[64];
-  MD4_u32plus block[16];
+  uint32_t block[16];
 };
-typedef struct md4_ctx MD4_CTX;
-
-static int MD4_Init(MD4_CTX *ctx);
-static void MD4_Update(MD4_CTX *ctx, const void *data, unsigned long size);
-static void MD4_Final(unsigned char *result, MD4_CTX *ctx);
+typedef struct md4_ctx my_md4_ctx;
 
 /*
  * The basic MD4 functions.
@@ -278,51 +225,47 @@ static void MD4_Final(unsigned char *result, MD4_CTX *ctx);
  * F and G are optimized compared to their RFC 1320 definitions, with the
  * optimization for F borrowed from Colin Plumb's MD5 implementation.
  */
-#define F(x, y, z)                      ((z) ^ ((x) & ((y) ^ (z))))
-#define G(x, y, z)                      (((x) & ((y) | (z))) | ((y) & (z)))
-#define H(x, y, z)                      ((x) ^ (y) ^ (z))
+#define MD4_F(x, y, z)                  ((z) ^ ((x) & ((y) ^ (z))))
+#define MD4_G(x, y, z)                  (((x) & ((y) | (z))) | ((y) & (z)))
+#define MD4_H(x, y, z)                  ((x) ^ (y) ^ (z))
 
 /*
  * The MD4 transformation for all three rounds.
  */
-#define STEP(f, a, b, c, d, x, s) \
-        (a) += f((b), (c), (d)) + (x); \
-        (a) = (((a) << (s)) | (((a) & 0xffffffff) >> (32 - (s))));
+#define MD4_STEP(f, a, b, c, d, x, s) \
+  (a) += f(b, c, d) + (x); \
+  (a) = (((a) << (s)) | (((a) & 0xffffffff) >> (32 - (s))));
 
 /*
  * SET reads 4 input bytes in little-endian byte order and stores them
  * in a properly aligned word in host byte order.
  *
- * The check for little-endian architectures that tolerate unaligned
- * memory accesses is just an optimization.  Nothing will break if it
- * doesn't work.
+ * The check for little-endian architectures that tolerate unaligned memory
+ * accesses is an optimization. Nothing will break if it does not work.
  */
 #if defined(__i386__) || defined(__x86_64__) || defined(__vax__)
-#define SET(n) \
-        (*(MD4_u32plus *)(void *)&ptr[(n) * 4])
-#define GET(n) \
-        SET(n)
+#define MD4_SET(n) (*(const uint32_t *)(const void *)&ptr[(n) * 4])
+#define MD4_GET(n) MD4_SET(n)
 #else
-#define SET(n) \
-        (ctx->block[(n)] = \
-        (MD4_u32plus)ptr[(n) * 4] | \
-        ((MD4_u32plus)ptr[(n) * 4 + 1] << 8) | \
-        ((MD4_u32plus)ptr[(n) * 4 + 2] << 16) | \
-        ((MD4_u32plus)ptr[(n) * 4 + 3] << 24))
-#define GET(n) \
-        (ctx->block[(n)])
+#define MD4_SET(n) (ctx->block[n] =      \
+   (uint32_t)ptr[(n) * 4]              | \
+  ((uint32_t)ptr[((n) * 4) + 1] <<  8) | \
+  ((uint32_t)ptr[((n) * 4) + 2] << 16) | \
+  ((uint32_t)ptr[((n) * 4) + 3] << 24))
+#define MD4_GET(n) ctx->block[n]
 #endif
 
 /*
  * This processes one or more 64-byte data blocks, but does NOT update
- * the bit counters.  There are no alignment requirements.
+ * the bit counters. There are no alignment requirements.
  */
-static const void *body(MD4_CTX *ctx, const void *data, unsigned long size)
+static const void *my_md4_body(my_md4_ctx *ctx,
+                               const void *input, unsigned long size)
 {
   const unsigned char *ptr;
-  MD4_u32plus a, b, c, d;
+  uint32_t a, b, c, d;
 
-  ptr = (const unsigned char *)data;
+  ptr = (const unsigned char *)input;
 
   a = ctx->a;
   b = ctx->b;
@@ -330,66 +273,66 @@ static const void *body(MD4_CTX *ctx, const void *data, unsigned long size)
   d = ctx->d;
 
   do {
-    MD4_u32plus saved_a, saved_b, saved_c, saved_d;
+    uint32_t saved_a, saved_b, saved_c, saved_d;
 
     saved_a = a;
     saved_b = b;
     saved_c = c;
     saved_d = d;
 
-/* Round 1 */
-    STEP(F, a, b, c, d, SET(0), 3)
-    STEP(F, d, a, b, c, SET(1), 7)
-    STEP(F, c, d, a, b, SET(2), 11)
-    STEP(F, b, c, d, a, SET(3), 19)
-    STEP(F, a, b, c, d, SET(4), 3)
-    STEP(F, d, a, b, c, SET(5), 7)
-    STEP(F, c, d, a, b, SET(6), 11)
-    STEP(F, b, c, d, a, SET(7), 19)
-    STEP(F, a, b, c, d, SET(8), 3)
-    STEP(F, d, a, b, c, SET(9), 7)
-    STEP(F, c, d, a, b, SET(10), 11)
-    STEP(F, b, c, d, a, SET(11), 19)
-    STEP(F, a, b, c, d, SET(12), 3)
-    STEP(F, d, a, b, c, SET(13), 7)
-    STEP(F, c, d, a, b, SET(14), 11)
-    STEP(F, b, c, d, a, SET(15), 19)
+    /* Round 1 */
+    MD4_STEP(MD4_F, a, b, c, d, MD4_SET(0), 3)
+    MD4_STEP(MD4_F, d, a, b, c, MD4_SET(1), 7)
+    MD4_STEP(MD4_F, c, d, a, b, MD4_SET(2), 11)
+    MD4_STEP(MD4_F, b, c, d, a, MD4_SET(3), 19)
+    MD4_STEP(MD4_F, a, b, c, d, MD4_SET(4), 3)
+    MD4_STEP(MD4_F, d, a, b, c, MD4_SET(5), 7)
+    MD4_STEP(MD4_F, c, d, a, b, MD4_SET(6), 11)
+    MD4_STEP(MD4_F, b, c, d, a, MD4_SET(7), 19)
+    MD4_STEP(MD4_F, a, b, c, d, MD4_SET(8), 3)
+    MD4_STEP(MD4_F, d, a, b, c, MD4_SET(9), 7)
+    MD4_STEP(MD4_F, c, d, a, b, MD4_SET(10), 11)
+    MD4_STEP(MD4_F, b, c, d, a, MD4_SET(11), 19)
+    MD4_STEP(MD4_F, a, b, c, d, MD4_SET(12), 3)
+    MD4_STEP(MD4_F, d, a, b, c, MD4_SET(13), 7)
+    MD4_STEP(MD4_F, c, d, a, b, MD4_SET(14), 11)
+    MD4_STEP(MD4_F, b, c, d, a, MD4_SET(15), 19)
 
-/* Round 2 */
-    STEP(G, a, b, c, d, GET(0) + 0x5a827999, 3)
-    STEP(G, d, a, b, c, GET(4) + 0x5a827999, 5)
-    STEP(G, c, d, a, b, GET(8) + 0x5a827999, 9)
-    STEP(G, b, c, d, a, GET(12) + 0x5a827999, 13)
-    STEP(G, a, b, c, d, GET(1) + 0x5a827999, 3)
-    STEP(G, d, a, b, c, GET(5) + 0x5a827999, 5)
-    STEP(G, c, d, a, b, GET(9) + 0x5a827999, 9)
-    STEP(G, b, c, d, a, GET(13) + 0x5a827999, 13)
-    STEP(G, a, b, c, d, GET(2) + 0x5a827999, 3)
-    STEP(G, d, a, b, c, GET(6) + 0x5a827999, 5)
-    STEP(G, c, d, a, b, GET(10) + 0x5a827999, 9)
-    STEP(G, b, c, d, a, GET(14) + 0x5a827999, 13)
-    STEP(G, a, b, c, d, GET(3) + 0x5a827999, 3)
-    STEP(G, d, a, b, c, GET(7) + 0x5a827999, 5)
-    STEP(G, c, d, a, b, GET(11) + 0x5a827999, 9)
-    STEP(G, b, c, d, a, GET(15) + 0x5a827999, 13)
+    /* Round 2 */
+    MD4_STEP(MD4_G, a, b, c, d, MD4_GET(0) + 0x5a827999, 3)
+    MD4_STEP(MD4_G, d, a, b, c, MD4_GET(4) + 0x5a827999, 5)
+    MD4_STEP(MD4_G, c, d, a, b, MD4_GET(8) + 0x5a827999, 9)
+    MD4_STEP(MD4_G, b, c, d, a, MD4_GET(12) + 0x5a827999, 13)
+    MD4_STEP(MD4_G, a, b, c, d, MD4_GET(1) + 0x5a827999, 3)
+    MD4_STEP(MD4_G, d, a, b, c, MD4_GET(5) + 0x5a827999, 5)
+    MD4_STEP(MD4_G, c, d, a, b, MD4_GET(9) + 0x5a827999, 9)
+    MD4_STEP(MD4_G, b, c, d, a, MD4_GET(13) + 0x5a827999, 13)
+    MD4_STEP(MD4_G, a, b, c, d, MD4_GET(2) + 0x5a827999, 3)
+    MD4_STEP(MD4_G, d, a, b, c, MD4_GET(6) + 0x5a827999, 5)
+    MD4_STEP(MD4_G, c, d, a, b, MD4_GET(10) + 0x5a827999, 9)
+    MD4_STEP(MD4_G, b, c, d, a, MD4_GET(14) + 0x5a827999, 13)
+    MD4_STEP(MD4_G, a, b, c, d, MD4_GET(3) + 0x5a827999, 3)
+    MD4_STEP(MD4_G, d, a, b, c, MD4_GET(7) + 0x5a827999, 5)
+    MD4_STEP(MD4_G, c, d, a, b, MD4_GET(11) + 0x5a827999, 9)
+    MD4_STEP(MD4_G, b, c, d, a, MD4_GET(15) + 0x5a827999, 13)
 
-/* Round 3 */
-    STEP(H, a, b, c, d, GET(0) + 0x6ed9eba1, 3)
-    STEP(H, d, a, b, c, GET(8) + 0x6ed9eba1, 9)
-    STEP(H, c, d, a, b, GET(4) + 0x6ed9eba1, 11)
-    STEP(H, b, c, d, a, GET(12) + 0x6ed9eba1, 15)
-    STEP(H, a, b, c, d, GET(2) + 0x6ed9eba1, 3)
-    STEP(H, d, a, b, c, GET(10) + 0x6ed9eba1, 9)
-    STEP(H, c, d, a, b, GET(6) + 0x6ed9eba1, 11)
-    STEP(H, b, c, d, a, GET(14) + 0x6ed9eba1, 15)
-    STEP(H, a, b, c, d, GET(1) + 0x6ed9eba1, 3)
-    STEP(H, d, a, b, c, GET(9) + 0x6ed9eba1, 9)
-    STEP(H, c, d, a, b, GET(5) + 0x6ed9eba1, 11)
-    STEP(H, b, c, d, a, GET(13) + 0x6ed9eba1, 15)
-    STEP(H, a, b, c, d, GET(3) + 0x6ed9eba1, 3)
-    STEP(H, d, a, b, c, GET(11) + 0x6ed9eba1, 9)
-    STEP(H, c, d, a, b, GET(7) + 0x6ed9eba1, 11)
-    STEP(H, b, c, d, a, GET(15) + 0x6ed9eba1, 15)
+    /* Round 3 */
+    MD4_STEP(MD4_H, a, b, c, d, MD4_GET(0) + 0x6ed9eba1, 3)
+    MD4_STEP(MD4_H, d, a, b, c, MD4_GET(8) + 0x6ed9eba1, 9)
+    MD4_STEP(MD4_H, c, d, a, b, MD4_GET(4) + 0x6ed9eba1, 11)
+    MD4_STEP(MD4_H, b, c, d, a, MD4_GET(12) + 0x6ed9eba1, 15)
+    MD4_STEP(MD4_H, a, b, c, d, MD4_GET(2) + 0x6ed9eba1, 3)
+    MD4_STEP(MD4_H, d, a, b, c, MD4_GET(10) + 0x6ed9eba1, 9)
+    MD4_STEP(MD4_H, c, d, a, b, MD4_GET(6) + 0x6ed9eba1, 11)
+    MD4_STEP(MD4_H, b, c, d, a, MD4_GET(14) + 0x6ed9eba1, 15)
+    MD4_STEP(MD4_H, a, b, c, d, MD4_GET(1) + 0x6ed9eba1, 3)
+    MD4_STEP(MD4_H, d, a, b, c, MD4_GET(9) + 0x6ed9eba1, 9)
+    MD4_STEP(MD4_H, c, d, a, b, MD4_GET(5) + 0x6ed9eba1, 11)
+    MD4_STEP(MD4_H, b, c, d, a, MD4_GET(13) + 0x6ed9eba1, 15)
+    MD4_STEP(MD4_H, a, b, c, d, MD4_GET(3) + 0x6ed9eba1, 3)
+    MD4_STEP(MD4_H, d, a, b, c, MD4_GET(11) + 0x6ed9eba1, 9)
+    MD4_STEP(MD4_H, c, d, a, b, MD4_GET(7) + 0x6ed9eba1, 11)
+    MD4_STEP(MD4_H, b, c, d, a, MD4_GET(15) + 0x6ed9eba1, 15)
 
     a += saved_a;
     b += saved_b;
@@ -407,7 +350,7 @@ static const void *body(MD4_CTX *ctx, const void *data, unsigned long size)
   return ptr;
 }
 
-static int MD4_Init(MD4_CTX *ctx)
+static int my_md4_init(my_md4_ctx *ctx)
 {
   ctx->a = 0x67452301;
   ctx->b = 0xefcdab89;
@@ -416,45 +359,47 @@ static int MD4_Init(MD4_CTX *ctx)
 
   ctx->lo = 0;
   ctx->hi = 0;
+
   return 1;
 }
 
-static void MD4_Update(MD4_CTX *ctx, const void *data, unsigned long size)
+static void my_md4_update(my_md4_ctx *ctx,
+                          const void *input, unsigned long len)
 {
-  MD4_u32plus saved_lo;
+  uint32_t saved_lo;
   unsigned long used;
 
   saved_lo = ctx->lo;
-  ctx->lo = (saved_lo + size) & 0x1fffffff;
+  ctx->lo = (saved_lo + len) & 0x1fffffff;
   if(ctx->lo < saved_lo)
     ctx->hi++;
-  ctx->hi += (MD4_u32plus)size >> 29;
+  ctx->hi += (uint32_t)len >> 29;
 
   used = saved_lo & 0x3f;
 
   if(used) {
     unsigned long available = 64 - used;
 
-    if(size < available) {
-      memcpy(&ctx->buffer[used], data, size);
+    if(len < available) {
+      memcpy(&ctx->buffer[used], input, len);
       return;
     }
 
-    memcpy(&ctx->buffer[used], data, available);
-    data = (const unsigned char *)data + available;
-    size -= available;
-    body(ctx, ctx->buffer, 64);
+    memcpy(&ctx->buffer[used], input, available);
+    input = (const unsigned char *)input + available;
+    len -= available;
+    my_md4_body(ctx, ctx->buffer, 64);
   }
 
-  if(size >= 64) {
-    data = body(ctx, data, size & ~(unsigned long)0x3f);
-    size &= 0x3f;
+  if(len >= 64) {
+    input = my_md4_body(ctx, input, len & ~(unsigned long)0x3f);
+    len &= 0x3f;
   }
 
-  memcpy(ctx->buffer, data, size);
+  memcpy(ctx->buffer, input, len);
 }
 
-static void MD4_Final(unsigned char *result, MD4_CTX *ctx)
+static void my_md4_final(unsigned char *digest, my_md4_ctx *ctx)
 {
   unsigned long used, available;
 
@@ -466,7 +411,7 @@ static void MD4_Final(unsigned char *result, MD4_CTX *ctx)
 
   if(available < 8) {
     memset(&ctx->buffer[used], 0, available);
-    body(ctx, ctx->buffer, 64);
+    my_md4_body(ctx, ctx->buffer, 64);
     used = 0;
     available = 64;
   }
@@ -474,53 +419,47 @@ static void MD4_Final(unsigned char *result, MD4_CTX *ctx)
   memset(&ctx->buffer[used], 0, available - 8);
 
   ctx->lo <<= 3;
-  ctx->buffer[56] = curlx_ultouc((ctx->lo)&0xff);
-  ctx->buffer[57] = curlx_ultouc((ctx->lo >> 8)&0xff);
-  ctx->buffer[58] = curlx_ultouc((ctx->lo >> 16)&0xff);
-  ctx->buffer[59] = curlx_ultouc((ctx->lo >> 24)&0xff);
-  ctx->buffer[60] = curlx_ultouc((ctx->hi)&0xff);
-  ctx->buffer[61] = curlx_ultouc((ctx->hi >> 8)&0xff);
-  ctx->buffer[62] = curlx_ultouc((ctx->hi >> 16)&0xff);
+  ctx->buffer[56] = curlx_ultouc((ctx->lo) & 0xff);
+  ctx->buffer[57] = curlx_ultouc((ctx->lo >> 8) & 0xff);
+  ctx->buffer[58] = curlx_ultouc((ctx->lo >> 16) & 0xff);
+  ctx->buffer[59] = curlx_ultouc((ctx->lo >> 24) & 0xff);
+  ctx->buffer[60] = curlx_ultouc((ctx->hi) & 0xff);
+  ctx->buffer[61] = curlx_ultouc((ctx->hi >> 8) & 0xff);
+  ctx->buffer[62] = curlx_ultouc((ctx->hi >> 16) & 0xff);
   ctx->buffer[63] = curlx_ultouc(ctx->hi >> 24);
 
-  body(ctx, ctx->buffer, 64);
+  my_md4_body(ctx, ctx->buffer, 64);
 
-  result[0] = curlx_ultouc((ctx->a)&0xff);
-  result[1] = curlx_ultouc((ctx->a >> 8)&0xff);
-  result[2] = curlx_ultouc((ctx->a >> 16)&0xff);
-  result[3] = curlx_ultouc(ctx->a >> 24);
-  result[4] = curlx_ultouc((ctx->b)&0xff);
-  result[5] = curlx_ultouc((ctx->b >> 8)&0xff);
-  result[6] = curlx_ultouc((ctx->b >> 16)&0xff);
-  result[7] = curlx_ultouc(ctx->b >> 24);
-  result[8] = curlx_ultouc((ctx->c)&0xff);
-  result[9] = curlx_ultouc((ctx->c >> 8)&0xff);
-  result[10] = curlx_ultouc((ctx->c >> 16)&0xff);
-  result[11] = curlx_ultouc(ctx->c >> 24);
-  result[12] = curlx_ultouc((ctx->d)&0xff);
-  result[13] = curlx_ultouc((ctx->d >> 8)&0xff);
-  result[14] = curlx_ultouc((ctx->d >> 16)&0xff);
-  result[15] = curlx_ultouc(ctx->d >> 24);
+  digest[0] = curlx_ultouc((ctx->a) & 0xff);
+  digest[1] = curlx_ultouc((ctx->a >> 8) & 0xff);
+  digest[2] = curlx_ultouc((ctx->a >> 16) & 0xff);
+  digest[3] = curlx_ultouc(ctx->a >> 24);
+  digest[4] = curlx_ultouc((ctx->b) & 0xff);
+  digest[5] = curlx_ultouc((ctx->b >> 8) & 0xff);
+  digest[6] = curlx_ultouc((ctx->b >> 16) & 0xff);
+  digest[7] = curlx_ultouc(ctx->b >> 24);
+  digest[8] = curlx_ultouc((ctx->c) & 0xff);
+  digest[9] = curlx_ultouc((ctx->c >> 8) & 0xff);
+  digest[10] = curlx_ultouc((ctx->c >> 16) & 0xff);
+  digest[11] = curlx_ultouc(ctx->c >> 24);
+  digest[12] = curlx_ultouc((ctx->d) & 0xff);
+  digest[13] = curlx_ultouc((ctx->d >> 8) & 0xff);
+  digest[14] = curlx_ultouc((ctx->d >> 16) & 0xff);
+  digest[15] = curlx_ultouc(ctx->d >> 24);
 
   memset(ctx, 0, sizeof(*ctx));
 }
 
 #endif /* CRYPTO LIBS */
 
-CURLcode Curl_md4it(unsigned char *output, const unsigned char *input,
-                    const size_t len)
+CURLcode Curl_md4it(unsigned char *output,
+                    const unsigned char *input, const size_t len)
 {
-  MD4_CTX ctx;
-
-#ifdef VOID_MD4_INIT
-  MD4_Init(&ctx);
-#else
-  if(!MD4_Init(&ctx))
+  my_md4_ctx ctx;
+  if(!my_md4_init(&ctx))
     return CURLE_FAILED_INIT;
-#endif
-
-  MD4_Update(&ctx, input, curlx_uztoui(len));
-  MD4_Final(output, &ctx);
+  my_md4_update(&ctx, input, curlx_uztoui(len));
+  my_md4_final(output, &ctx);
   return CURLE_OK;
 }
 
diff --git a/third-party/curl/lib/md5.c b/third-party/curl/lib/md5.c
index 01415af911..1f1b4f8ad6 100644
--- a/third-party/curl/lib/md5.c
+++ b/third-party/curl/lib/md5.c
@@ -21,50 +21,131 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) \
-    || !defined(CURL_DISABLE_DIGEST_AUTH)
-
-#include <string.h>
-#include <curl/curl.h>
+#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) || \
+  !defined(CURL_DISABLE_DIGEST_AUTH)
 
 #include "curl_md5.h"
 #include "curl_hmac.h"
-#include "warnless.h"
-
-#ifdef USE_MBEDTLS
-#include <mbedtls/version.h>
-
-#if(MBEDTLS_VERSION_NUMBER >= 0x02070000) && \
-   (MBEDTLS_VERSION_NUMBER < 0x03000000)
-  #define HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS
-#endif
-#endif /* USE_MBEDTLS */
 
 #ifdef USE_OPENSSL
-  #include <openssl/opensslconf.h>
-  #if !defined(OPENSSL_NO_MD5) && !defined(OPENSSL_NO_DEPRECATED_3_0)
-    #define USE_OPENSSL_MD5
-  #endif
+#include <openssl/opensslconf.h>
 #endif
 
 #ifdef USE_WOLFSSL
-  #include <wolfssl/options.h>
-  #ifndef NO_MD5
-    #define USE_WOLFSSL_MD5
-  #endif
+#include <wolfssl/options.h>
 #endif
 
-#if defined(USE_GNUTLS)
+#ifdef USE_MBEDTLS
+#include <mbedtls/version.h>
+#if MBEDTLS_VERSION_NUMBER < 0x03020000
+#error "mbedTLS 3.2.0 or later required"
+#endif
+#include <psa/crypto_config.h>
+#endif
+
+#ifdef USE_GNUTLS
 #include <nettle/md5.h>
-#elif defined(USE_OPENSSL_MD5)
+#include <nettle/version.h>
+
+typedef struct md5_ctx my_md5_ctx;
+
+static CURLcode my_md5_init(void *ctx)
+{
+  md5_init(ctx);
+  return CURLE_OK;
+}
+
+static void my_md5_update(void *ctx,
+                          const unsigned char *input, unsigned int len)
+{
+  md5_update(ctx, len, input);
+}
+
+static void my_md5_final(unsigned char *digest, void *ctx)
+{
+#if NETTLE_VERSION_MAJOR >= 4
+  md5_digest(ctx, digest);
+#else
+  md5_digest(ctx, 16, digest);
+#endif
+}
+
+#elif defined(USE_OPENSSL) && \
+  !defined(OPENSSL_NO_MD5) && !defined(OPENSSL_NO_DEPRECATED_3_0)
 #include <openssl/md5.h>
-#elif defined(USE_WOLFSSL_MD5)
-#include <wolfssl/openssl/md5.h>
-#elif defined(USE_MBEDTLS)
-#include <mbedtls/md5.h>
+
+typedef MD5_CTX my_md5_ctx;
+
+static CURLcode my_md5_init(void *ctx)
+{
+  if(!MD5_Init(ctx))
+    return CURLE_OUT_OF_MEMORY;
+
+  return CURLE_OK;
+}
+
+static void my_md5_update(void *ctx,
+                          const unsigned char *input, unsigned int len)
+{
+  (void)MD5_Update(ctx, input, len);
+}
+
+static void my_md5_final(unsigned char *digest, void *ctx)
+{
+  (void)MD5_Final(digest, ctx);
+}
+
+#elif defined(USE_WOLFSSL) && !defined(NO_MD5)
+#include <wolfssl/wolfcrypt/md5.h>
+
+typedef wc_Md5 my_md5_ctx;
+
+static CURLcode my_md5_init(void *ctx)
+{
+  if(wc_InitMd5(ctx))
+    return CURLE_OUT_OF_MEMORY;
+  return CURLE_OK;
+}
+
+static void my_md5_update(void *ctx,
+                          const unsigned char *input, unsigned int len)
+{
+  (void)wc_Md5Update(ctx, input, (word32)len);
+}
+
+static void my_md5_final(unsigned char *digest, void *ctx)
+{
+  (void)wc_Md5Final(ctx, digest);
+}
+
+#elif defined(USE_MBEDTLS) && \
+  defined(PSA_WANT_ALG_MD5) && PSA_WANT_ALG_MD5
+#include <psa/crypto.h>
+
+typedef psa_hash_operation_t my_md5_ctx;
+
+static CURLcode my_md5_init(void *ctx)
+{
+  memset(ctx, 0, sizeof(my_md5_ctx));
+  if(psa_hash_setup(ctx, PSA_ALG_MD5) != PSA_SUCCESS)
+    return CURLE_OUT_OF_MEMORY;
+  return CURLE_OK;
+}
+
+static void my_md5_update(void *ctx,
+                          const unsigned char *input, unsigned int len)
+{
+  (void)psa_hash_update(ctx, input, len);
+}
+
+static void my_md5_final(unsigned char *digest, void *ctx)
+{
+  size_t actual_length;
+  (void)psa_hash_finish(ctx, digest, 16, &actual_length);
+}
+
 #elif (defined(__MAC_OS_X_VERSION_MAX_ALLOWED) && \
               (__MAC_OS_X_VERSION_MAX_ALLOWED >= 1040) && \
        defined(__MAC_OS_X_VERSION_MIN_REQUIRED) && \
@@ -73,112 +154,17 @@
               (__IPHONE_OS_VERSION_MAX_ALLOWED >= 20000) && \
        defined(__IPHONE_OS_VERSION_MIN_REQUIRED) && \
               (__IPHONE_OS_VERSION_MIN_REQUIRED < 130000))
-#define AN_APPLE_OS
 #include <CommonCrypto/CommonDigest.h>
-#elif defined(USE_WIN32_CRYPTO)
-#include <wincrypt.h>
-#endif
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-#if defined(USE_GNUTLS)
-
-typedef struct md5_ctx my_md5_ctx;
-
-static CURLcode my_md5_init(my_md5_ctx *ctx)
-{
-  md5_init(ctx);
-  return CURLE_OK;
-}
-
-static void my_md5_update(my_md5_ctx *ctx,
-                          const unsigned char *input,
-                          unsigned int inputLen)
-{
-  md5_update(ctx, inputLen, input);
-}
-
-static void my_md5_final(unsigned char *digest, my_md5_ctx *ctx)
-{
-  md5_digest(ctx, 16, digest);
-}
-
-#elif defined(USE_OPENSSL_MD5) || defined(USE_WOLFSSL_MD5)
-
-typedef MD5_CTX my_md5_ctx;
-
-static CURLcode my_md5_init(my_md5_ctx *ctx)
-{
-  if(!MD5_Init(ctx))
-    return CURLE_OUT_OF_MEMORY;
-
-  return CURLE_OK;
-}
-
-static void my_md5_update(my_md5_ctx *ctx,
-                          const unsigned char *input,
-                          unsigned int len)
-{
-  (void)MD5_Update(ctx, input, len);
-}
-
-static void my_md5_final(unsigned char *digest, my_md5_ctx *ctx)
-{
-  (void)MD5_Final(digest, ctx);
-}
-
-#elif defined(USE_MBEDTLS)
-
-typedef mbedtls_md5_context my_md5_ctx;
-
-static CURLcode my_md5_init(my_md5_ctx *ctx)
-{
-#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
-  if(mbedtls_md5_starts(ctx))
-    return CURLE_OUT_OF_MEMORY;
-#elif defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
-  if(mbedtls_md5_starts_ret(ctx))
-    return CURLE_OUT_OF_MEMORY;
-#else
-  (void)mbedtls_md5_starts(ctx);
-#endif
-  return CURLE_OK;
-}
-
-static void my_md5_update(my_md5_ctx *ctx,
-                          const unsigned char *data,
-                          unsigned int length)
-{
-#if !defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
-  (void) mbedtls_md5_update(ctx, data, length);
-#else
-  (void) mbedtls_md5_update_ret(ctx, data, length);
-#endif
-}
-
-static void my_md5_final(unsigned char *digest, my_md5_ctx *ctx)
-{
-#if !defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
-  (void) mbedtls_md5_finish(ctx, digest);
-#else
-  (void) mbedtls_md5_finish_ret(ctx, digest);
-#endif
-}
-
-#elif defined(AN_APPLE_OS)
 
 /* For Apple operating systems: CommonCrypto has the functions we need.
    These functions are available on Tiger and later, as well as iOS 2.0
-   and later. If you're building for an older cat, well, sorry.
+   and later. If you are building for an older cat, well, sorry.
 
    Declaring the functions as static like this seems to be a bit more
    reliable than defining COMMON_DIGEST_FOR_OPENSSL on older cats. */
 #  define my_md5_ctx CC_MD5_CTX
 
-static CURLcode my_md5_init(my_md5_ctx *ctx)
+static CURLcode my_md5_init(void *ctx)
 {
   if(!CC_MD5_Init(ctx))
     return CURLE_OUT_OF_MEMORY;
@@ -186,19 +172,19 @@ static CURLcode my_md5_init(my_md5_ctx *ctx)
   return CURLE_OK;
 }
 
-static void my_md5_update(my_md5_ctx *ctx,
-                          const unsigned char *input,
-                          unsigned int inputLen)
+static void my_md5_update(void *ctx,
+                          const unsigned char *input, unsigned int len)
 {
-  CC_MD5_Update(ctx, input, inputLen);
+  CC_MD5_Update(ctx, input, len);
 }
 
-static void my_md5_final(unsigned char *digest, my_md5_ctx *ctx)
+static void my_md5_final(unsigned char *digest, void *ctx)
 {
   CC_MD5_Final(digest, ctx);
 }
 
 #elif defined(USE_WIN32_CRYPTO)
+#include <wincrypt.h>
 
 struct md5_ctx {
   HCRYPTPROV hCryptProv;
@@ -206,8 +192,9 @@ struct md5_ctx {
 };
 typedef struct md5_ctx my_md5_ctx;
 
-static CURLcode my_md5_init(my_md5_ctx *ctx)
+static CURLcode my_md5_init(void *in)
 {
+  my_md5_ctx *ctx = (my_md5_ctx *)in;
   if(!CryptAcquireContext(&ctx->hCryptProv, NULL, NULL, PROV_RSA_FULL,
                           CRYPT_VERIFYCONTEXT | CRYPT_SILENT))
     return CURLE_OUT_OF_MEMORY;
@@ -221,15 +208,16 @@ static CURLcode my_md5_init(my_md5_ctx *ctx)
   return CURLE_OK;
 }
 
-static void my_md5_update(my_md5_ctx *ctx,
-                          const unsigned char *input,
-                          unsigned int inputLen)
+static void my_md5_update(void *in,
+                          const unsigned char *input, unsigned int len)
 {
-  CryptHashData(ctx->hHash, (unsigned char *)input, inputLen, 0);
+  my_md5_ctx *ctx = in;
+  CryptHashData(ctx->hHash, (const BYTE *)input, len, 0);
 }
 
-static void my_md5_final(unsigned char *digest, my_md5_ctx *ctx)
+static void my_md5_final(unsigned char *digest, void *in)
 {
+  my_md5_ctx *ctx = (my_md5_ctx *)in;
   unsigned long length = 0;
   CryptGetHashParam(ctx->hHash, HP_HASHVAL, NULL, &length, 0);
   if(length == 16)
@@ -249,107 +237,83 @@ static void my_md5_final(unsigned char *digest, my_md5_ctx *ctx)
  * MD5 Message-Digest Algorithm (RFC 1321).
  *
  * Homepage:
- https://openwall.info/wiki/people/solar/software/public-domain-source-code/md5
+ * https://openwall.info/wiki/people/solar/software/public-domain-source-code/md5
  *
  * Author:
  * Alexander Peslyak, better known as Solar Designer <solar at openwall.com>
  *
- * This software was written by Alexander Peslyak in 2001.  No copyright is
- * claimed, and the software is hereby placed in the public domain.
- * In case this attempt to disclaim copyright and place the software in the
- * public domain is deemed null and void, then the software is
- * Copyright (c) 2001 Alexander Peslyak and it is hereby released to the
- * general public under the following terms:
+ * This software was written by Alexander Peslyak in 2001. No copyright is
+ * claimed, and the software is hereby placed in the public domain. In case
+ * this attempt to disclaim copyright and place the software in the public
+ * domain is deemed null and void, then the software is Copyright (c) 2001
+ * Alexander Peslyak and it is hereby released to the general public under
+ * the following terms:
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted.
  *
- * There's ABSOLUTELY NO WARRANTY, express or implied.
+ * There is ABSOLUTELY NO WARRANTY, express or implied.
  *
  * (This is a heavily cut-down "BSD license".)
- *
- * This differs from Colin Plumb's older public domain implementation in that
- * no exactly 32-bit integer data type is required (any 32-bit or wider
- * unsigned integer data type will do), there's no compile-time endianness
- * configuration, and the function prototypes match OpenSSL's.  No code from
- * Colin Plumb's implementation has been reused; this comment merely compares
- * the properties of the two independent implementations.
- *
- * The primary goals of this implementation are portability and ease of use.
- * It is meant to be fast, but not as fast as possible.  Some known
- * optimizations are not included to reduce source code size and avoid
- * compile-time configuration.
  */
 
-/* Any 32-bit or wider unsigned integer data type will do */
-typedef unsigned int MD5_u32plus;
-
 struct md5_ctx {
-  MD5_u32plus lo, hi;
-  MD5_u32plus a, b, c, d;
+  uint32_t lo, hi;
+  uint32_t a, b, c, d;
   unsigned char buffer[64];
-  MD5_u32plus block[16];
+  uint32_t block[16];
 };
 typedef struct md5_ctx my_md5_ctx;
 
-static CURLcode my_md5_init(my_md5_ctx *ctx);
-static void my_md5_update(my_md5_ctx *ctx, const void *data,
-                          unsigned long size);
-static void my_md5_final(unsigned char *result, my_md5_ctx *ctx);
-
 /*
  * The basic MD5 functions.
  *
  * F and G are optimized compared to their RFC 1321 definitions for
- * architectures that lack an AND-NOT instruction, just like in Colin Plumb's
+ * architectures that lack an AND-NOT instruction, like in Colin Plumb's
  * implementation.
  */
-#define F(x, y, z)                      ((z) ^ ((x) & ((y) ^ (z))))
-#define G(x, y, z)                      ((y) ^ ((z) & ((x) ^ (y))))
-#define H(x, y, z)                      (((x) ^ (y)) ^ (z))
-#define H2(x, y, z)                     ((x) ^ ((y) ^ (z)))
-#define I(x, y, z)                      ((y) ^ ((x) | ~(z)))
+#define MD5_F(x, y, z)                  ((z) ^ ((x) & ((y) ^ (z))))
+#define MD5_G(x, y, z)                  ((y) ^ ((z) & ((x) ^ (y))))
+#define MD5_H(x, y, z)                  (((x) ^ (y)) ^ (z))
+#define MD5_H2(x, y, z)                 ((x) ^ ((y) ^ (z)))
+#define MD5_I(x, y, z)                  ((y) ^ ((x) | ~(z)))
 
 /*
  * The MD5 transformation for all four rounds.
  */
-#define STEP(f, a, b, c, d, x, t, s) \
-        (a) += f((b), (c), (d)) + (x) + (t); \
-        (a) = (((a) << (s)) | (((a) & 0xffffffff) >> (32 - (s)))); \
-        (a) += (b);
+#define MD5_STEP(f, a, b, c, d, x, t, s) \
+  (a) += f(b, c, d) + (x) + (t); \
+  (a) = (((a) << (s)) | (((a) & 0xffffffff) >> (32 - (s)))); \
+  (a) += (b);
 
 /*
  * SET reads 4 input bytes in little-endian byte order and stores them
  * in a properly aligned word in host byte order.
  *
- * The check for little-endian architectures that tolerate unaligned
- * memory accesses is just an optimization.  Nothing will break if it
- * doesn't work.
+ * The check for little-endian architectures that tolerate unaligned memory
+ * accesses is an optimization. Nothing will break if it does not work.
  */
 #if defined(__i386__) || defined(__x86_64__) || defined(__vax__)
-#define SET(n) \
-        (*(MD5_u32plus *)(void *)&ptr[(n) * 4])
-#define GET(n) \
-        SET(n)
+#define MD5_SET(n) (*(const uint32_t *)(const void *)&ptr[(n) * 4])
+#define MD5_GET(n) MD5_SET(n)
 #else
-#define SET(n) \
-        (ctx->block[(n)] = \
-        (MD5_u32plus)ptr[(n) * 4] | \
-        ((MD5_u32plus)ptr[(n) * 4 + 1] << 8) | \
-        ((MD5_u32plus)ptr[(n) * 4 + 2] << 16) | \
-        ((MD5_u32plus)ptr[(n) * 4 + 3] << 24))
-#define GET(n) \
-        (ctx->block[(n)])
+#define MD5_SET(n) (ctx->block[n] =      \
+   (uint32_t)ptr[(n) * 4]              | \
+  ((uint32_t)ptr[((n) * 4) + 1] <<  8) | \
+  ((uint32_t)ptr[((n) * 4) + 2] << 16) | \
+  ((uint32_t)ptr[((n) * 4) + 3] << 24))
+#define MD5_GET(n) ctx->block[n]
 #endif
 
 /*
  * This processes one or more 64-byte data blocks, but does NOT update
- * the bit counters.  There are no alignment requirements.
+ * the bit counters. There are no alignment requirements.
  */
-static const void *body(my_md5_ctx *ctx, const void *data, unsigned long size)
+static const void *my_md5_body(my_md5_ctx *ctx,
+                               const void *data, unsigned long size)
 {
   const unsigned char *ptr;
-  MD5_u32plus a, b, c, d;
+  uint32_t a, b, c, d;
 
   ptr = (const unsigned char *)data;
 
@@ -359,84 +323,84 @@ static const void *body(my_md5_ctx *ctx, const void *data, unsigned long size)
   d = ctx->d;
 
   do {
-    MD5_u32plus saved_a, saved_b, saved_c, saved_d;
+    uint32_t saved_a, saved_b, saved_c, saved_d;
 
     saved_a = a;
     saved_b = b;
     saved_c = c;
     saved_d = d;
 
-/* Round 1 */
-    STEP(F, a, b, c, d, SET(0), 0xd76aa478, 7)
-    STEP(F, d, a, b, c, SET(1), 0xe8c7b756, 12)
-    STEP(F, c, d, a, b, SET(2), 0x242070db, 17)
-    STEP(F, b, c, d, a, SET(3), 0xc1bdceee, 22)
-    STEP(F, a, b, c, d, SET(4), 0xf57c0faf, 7)
-    STEP(F, d, a, b, c, SET(5), 0x4787c62a, 12)
-    STEP(F, c, d, a, b, SET(6), 0xa8304613, 17)
-    STEP(F, b, c, d, a, SET(7), 0xfd469501, 22)
-    STEP(F, a, b, c, d, SET(8), 0x698098d8, 7)
-    STEP(F, d, a, b, c, SET(9), 0x8b44f7af, 12)
-    STEP(F, c, d, a, b, SET(10), 0xffff5bb1, 17)
-    STEP(F, b, c, d, a, SET(11), 0x895cd7be, 22)
-    STEP(F, a, b, c, d, SET(12), 0x6b901122, 7)
-    STEP(F, d, a, b, c, SET(13), 0xfd987193, 12)
-    STEP(F, c, d, a, b, SET(14), 0xa679438e, 17)
-    STEP(F, b, c, d, a, SET(15), 0x49b40821, 22)
+    /* Round 1 */
+    MD5_STEP(MD5_F, a, b, c, d, MD5_SET(0), 0xd76aa478, 7)
+    MD5_STEP(MD5_F, d, a, b, c, MD5_SET(1), 0xe8c7b756, 12)
+    MD5_STEP(MD5_F, c, d, a, b, MD5_SET(2), 0x242070db, 17)
+    MD5_STEP(MD5_F, b, c, d, a, MD5_SET(3), 0xc1bdceee, 22)
+    MD5_STEP(MD5_F, a, b, c, d, MD5_SET(4), 0xf57c0faf, 7)
+    MD5_STEP(MD5_F, d, a, b, c, MD5_SET(5), 0x4787c62a, 12)
+    MD5_STEP(MD5_F, c, d, a, b, MD5_SET(6), 0xa8304613, 17)
+    MD5_STEP(MD5_F, b, c, d, a, MD5_SET(7), 0xfd469501, 22)
+    MD5_STEP(MD5_F, a, b, c, d, MD5_SET(8), 0x698098d8, 7)
+    MD5_STEP(MD5_F, d, a, b, c, MD5_SET(9), 0x8b44f7af, 12)
+    MD5_STEP(MD5_F, c, d, a, b, MD5_SET(10), 0xffff5bb1, 17)
+    MD5_STEP(MD5_F, b, c, d, a, MD5_SET(11), 0x895cd7be, 22)
+    MD5_STEP(MD5_F, a, b, c, d, MD5_SET(12), 0x6b901122, 7)
+    MD5_STEP(MD5_F, d, a, b, c, MD5_SET(13), 0xfd987193, 12)
+    MD5_STEP(MD5_F, c, d, a, b, MD5_SET(14), 0xa679438e, 17)
+    MD5_STEP(MD5_F, b, c, d, a, MD5_SET(15), 0x49b40821, 22)
 
-/* Round 2 */
-    STEP(G, a, b, c, d, GET(1), 0xf61e2562, 5)
-    STEP(G, d, a, b, c, GET(6), 0xc040b340, 9)
-    STEP(G, c, d, a, b, GET(11), 0x265e5a51, 14)
-    STEP(G, b, c, d, a, GET(0), 0xe9b6c7aa, 20)
-    STEP(G, a, b, c, d, GET(5), 0xd62f105d, 5)
-    STEP(G, d, a, b, c, GET(10), 0x02441453, 9)
-    STEP(G, c, d, a, b, GET(15), 0xd8a1e681, 14)
-    STEP(G, b, c, d, a, GET(4), 0xe7d3fbc8, 20)
-    STEP(G, a, b, c, d, GET(9), 0x21e1cde6, 5)
-    STEP(G, d, a, b, c, GET(14), 0xc33707d6, 9)
-    STEP(G, c, d, a, b, GET(3), 0xf4d50d87, 14)
-    STEP(G, b, c, d, a, GET(8), 0x455a14ed, 20)
-    STEP(G, a, b, c, d, GET(13), 0xa9e3e905, 5)
-    STEP(G, d, a, b, c, GET(2), 0xfcefa3f8, 9)
-    STEP(G, c, d, a, b, GET(7), 0x676f02d9, 14)
-    STEP(G, b, c, d, a, GET(12), 0x8d2a4c8a, 20)
+    /* Round 2 */
+    MD5_STEP(MD5_G, a, b, c, d, MD5_GET(1), 0xf61e2562, 5)
+    MD5_STEP(MD5_G, d, a, b, c, MD5_GET(6), 0xc040b340, 9)
+    MD5_STEP(MD5_G, c, d, a, b, MD5_GET(11), 0x265e5a51, 14)
+    MD5_STEP(MD5_G, b, c, d, a, MD5_GET(0), 0xe9b6c7aa, 20)
+    MD5_STEP(MD5_G, a, b, c, d, MD5_GET(5), 0xd62f105d, 5)
+    MD5_STEP(MD5_G, d, a, b, c, MD5_GET(10), 0x02441453, 9)
+    MD5_STEP(MD5_G, c, d, a, b, MD5_GET(15), 0xd8a1e681, 14)
+    MD5_STEP(MD5_G, b, c, d, a, MD5_GET(4), 0xe7d3fbc8, 20)
+    MD5_STEP(MD5_G, a, b, c, d, MD5_GET(9), 0x21e1cde6, 5)
+    MD5_STEP(MD5_G, d, a, b, c, MD5_GET(14), 0xc33707d6, 9)
+    MD5_STEP(MD5_G, c, d, a, b, MD5_GET(3), 0xf4d50d87, 14)
+    MD5_STEP(MD5_G, b, c, d, a, MD5_GET(8), 0x455a14ed, 20)
+    MD5_STEP(MD5_G, a, b, c, d, MD5_GET(13), 0xa9e3e905, 5)
+    MD5_STEP(MD5_G, d, a, b, c, MD5_GET(2), 0xfcefa3f8, 9)
+    MD5_STEP(MD5_G, c, d, a, b, MD5_GET(7), 0x676f02d9, 14)
+    MD5_STEP(MD5_G, b, c, d, a, MD5_GET(12), 0x8d2a4c8a, 20)
 
-/* Round 3 */
-    STEP(H, a, b, c, d, GET(5), 0xfffa3942, 4)
-    STEP(H2, d, a, b, c, GET(8), 0x8771f681, 11)
-    STEP(H, c, d, a, b, GET(11), 0x6d9d6122, 16)
-    STEP(H2, b, c, d, a, GET(14), 0xfde5380c, 23)
-    STEP(H, a, b, c, d, GET(1), 0xa4beea44, 4)
-    STEP(H2, d, a, b, c, GET(4), 0x4bdecfa9, 11)
-    STEP(H, c, d, a, b, GET(7), 0xf6bb4b60, 16)
-    STEP(H2, b, c, d, a, GET(10), 0xbebfbc70, 23)
-    STEP(H, a, b, c, d, GET(13), 0x289b7ec6, 4)
-    STEP(H2, d, a, b, c, GET(0), 0xeaa127fa, 11)
-    STEP(H, c, d, a, b, GET(3), 0xd4ef3085, 16)
-    STEP(H2, b, c, d, a, GET(6), 0x04881d05, 23)
-    STEP(H, a, b, c, d, GET(9), 0xd9d4d039, 4)
-    STEP(H2, d, a, b, c, GET(12), 0xe6db99e5, 11)
-    STEP(H, c, d, a, b, GET(15), 0x1fa27cf8, 16)
-    STEP(H2, b, c, d, a, GET(2), 0xc4ac5665, 23)
+    /* Round 3 */
+    MD5_STEP(MD5_H, a, b, c, d, MD5_GET(5), 0xfffa3942, 4)
+    MD5_STEP(MD5_H2, d, a, b, c, MD5_GET(8), 0x8771f681, 11)
+    MD5_STEP(MD5_H, c, d, a, b, MD5_GET(11), 0x6d9d6122, 16)
+    MD5_STEP(MD5_H2, b, c, d, a, MD5_GET(14), 0xfde5380c, 23)
+    MD5_STEP(MD5_H, a, b, c, d, MD5_GET(1), 0xa4beea44, 4)
+    MD5_STEP(MD5_H2, d, a, b, c, MD5_GET(4), 0x4bdecfa9, 11)
+    MD5_STEP(MD5_H, c, d, a, b, MD5_GET(7), 0xf6bb4b60, 16)
+    MD5_STEP(MD5_H2, b, c, d, a, MD5_GET(10), 0xbebfbc70, 23)
+    MD5_STEP(MD5_H, a, b, c, d, MD5_GET(13), 0x289b7ec6, 4)
+    MD5_STEP(MD5_H2, d, a, b, c, MD5_GET(0), 0xeaa127fa, 11)
+    MD5_STEP(MD5_H, c, d, a, b, MD5_GET(3), 0xd4ef3085, 16)
+    MD5_STEP(MD5_H2, b, c, d, a, MD5_GET(6), 0x04881d05, 23)
+    MD5_STEP(MD5_H, a, b, c, d, MD5_GET(9), 0xd9d4d039, 4)
+    MD5_STEP(MD5_H2, d, a, b, c, MD5_GET(12), 0xe6db99e5, 11)
+    MD5_STEP(MD5_H, c, d, a, b, MD5_GET(15), 0x1fa27cf8, 16)
+    MD5_STEP(MD5_H2, b, c, d, a, MD5_GET(2), 0xc4ac5665, 23)
 
-/* Round 4 */
-    STEP(I, a, b, c, d, GET(0), 0xf4292244, 6)
-    STEP(I, d, a, b, c, GET(7), 0x432aff97, 10)
-    STEP(I, c, d, a, b, GET(14), 0xab9423a7, 15)
-    STEP(I, b, c, d, a, GET(5), 0xfc93a039, 21)
-    STEP(I, a, b, c, d, GET(12), 0x655b59c3, 6)
-    STEP(I, d, a, b, c, GET(3), 0x8f0ccc92, 10)
-    STEP(I, c, d, a, b, GET(10), 0xffeff47d, 15)
-    STEP(I, b, c, d, a, GET(1), 0x85845dd1, 21)
-    STEP(I, a, b, c, d, GET(8), 0x6fa87e4f, 6)
-    STEP(I, d, a, b, c, GET(15), 0xfe2ce6e0, 10)
-    STEP(I, c, d, a, b, GET(6), 0xa3014314, 15)
-    STEP(I, b, c, d, a, GET(13), 0x4e0811a1, 21)
-    STEP(I, a, b, c, d, GET(4), 0xf7537e82, 6)
-    STEP(I, d, a, b, c, GET(11), 0xbd3af235, 10)
-    STEP(I, c, d, a, b, GET(2), 0x2ad7d2bb, 15)
-    STEP(I, b, c, d, a, GET(9), 0xeb86d391, 21)
+    /* Round 4 */
+    MD5_STEP(MD5_I, a, b, c, d, MD5_GET(0), 0xf4292244, 6)
+    MD5_STEP(MD5_I, d, a, b, c, MD5_GET(7), 0x432aff97, 10)
+    MD5_STEP(MD5_I, c, d, a, b, MD5_GET(14), 0xab9423a7, 15)
+    MD5_STEP(MD5_I, b, c, d, a, MD5_GET(5), 0xfc93a039, 21)
+    MD5_STEP(MD5_I, a, b, c, d, MD5_GET(12), 0x655b59c3, 6)
+    MD5_STEP(MD5_I, d, a, b, c, MD5_GET(3), 0x8f0ccc92, 10)
+    MD5_STEP(MD5_I, c, d, a, b, MD5_GET(10), 0xffeff47d, 15)
+    MD5_STEP(MD5_I, b, c, d, a, MD5_GET(1), 0x85845dd1, 21)
+    MD5_STEP(MD5_I, a, b, c, d, MD5_GET(8), 0x6fa87e4f, 6)
+    MD5_STEP(MD5_I, d, a, b, c, MD5_GET(15), 0xfe2ce6e0, 10)
+    MD5_STEP(MD5_I, c, d, a, b, MD5_GET(6), 0xa3014314, 15)
+    MD5_STEP(MD5_I, b, c, d, a, MD5_GET(13), 0x4e0811a1, 21)
+    MD5_STEP(MD5_I, a, b, c, d, MD5_GET(4), 0xf7537e82, 6)
+    MD5_STEP(MD5_I, d, a, b, c, MD5_GET(11), 0xbd3af235, 10)
+    MD5_STEP(MD5_I, c, d, a, b, MD5_GET(2), 0x2ad7d2bb, 15)
+    MD5_STEP(MD5_I, b, c, d, a, MD5_GET(9), 0xeb86d391, 21)
 
     a += saved_a;
     b += saved_b;
@@ -454,8 +418,9 @@ static const void *body(my_md5_ctx *ctx, const void *data, unsigned long size)
   return ptr;
 }
 
-static CURLcode my_md5_init(my_md5_ctx *ctx)
+static CURLcode my_md5_init(void *in)
 {
+  my_md5_ctx *ctx = (my_md5_ctx *)in;
   ctx->a = 0x67452301;
   ctx->b = 0xefcdab89;
   ctx->c = 0x98badcfe;
@@ -467,45 +432,47 @@ static CURLcode my_md5_init(my_md5_ctx *ctx)
   return CURLE_OK;
 }
 
-static void my_md5_update(my_md5_ctx *ctx, const void *data,
-                          unsigned long size)
+static void my_md5_update(void *in,
+                          const unsigned char *input, unsigned int len)
 {
-  MD5_u32plus saved_lo;
-  unsigned long used;
+  uint32_t saved_lo;
+  unsigned int used;
+  my_md5_ctx *ctx = (my_md5_ctx *)in;
 
   saved_lo = ctx->lo;
-  ctx->lo = (saved_lo + size) & 0x1fffffff;
+  ctx->lo = (saved_lo + len) & 0x1fffffff;
   if(ctx->lo < saved_lo)
     ctx->hi++;
-  ctx->hi += (MD5_u32plus)size >> 29;
+  ctx->hi += (uint32_t)len >> 29;
 
   used = saved_lo & 0x3f;
 
   if(used) {
-    unsigned long available = 64 - used;
+    unsigned int available = 64 - used;
 
-    if(size < available) {
-      memcpy(&ctx->buffer[used], data, size);
+    if(len < available) {
+      memcpy(&ctx->buffer[used], input, len);
       return;
     }
 
-    memcpy(&ctx->buffer[used], data, available);
-    data = (const unsigned char *)data + available;
-    size -= available;
-    body(ctx, ctx->buffer, 64);
+    memcpy(&ctx->buffer[used], input, available);
+    input = (const unsigned char *)input + available;
+    len -= available;
+    my_md5_body(ctx, ctx->buffer, 64);
   }
 
-  if(size >= 64) {
-    data = body(ctx, data, size & ~(unsigned long)0x3f);
-    size &= 0x3f;
+  if(len >= 64) {
+    input = my_md5_body(ctx, input, len & ~(unsigned long)0x3f);
+    len &= 0x3f;
   }
 
-  memcpy(ctx->buffer, data, size);
+  memcpy(ctx->buffer, input, len);
 }
 
-static void my_md5_final(unsigned char *result, my_md5_ctx *ctx)
+static void my_md5_final(unsigned char *digest, void *in)
 {
-  unsigned long used, available;
+  unsigned int used, available;
+  my_md5_ctx *ctx = (my_md5_ctx *)in;
 
   used = ctx->lo & 0x3f;
 
@@ -515,7 +482,7 @@ static void my_md5_final(unsigned char *result, my_md5_ctx *ctx)
 
   if(available < 8) {
     memset(&ctx->buffer[used], 0, available);
-    body(ctx, ctx->buffer, 64);
+    my_md5_body(ctx, ctx->buffer, 64);
     used = 0;
     available = 64;
   }
@@ -523,85 +490,75 @@ static void my_md5_final(unsigned char *result, my_md5_ctx *ctx)
   memset(&ctx->buffer[used], 0, available - 8);
 
   ctx->lo <<= 3;
-  ctx->buffer[56] = curlx_ultouc((ctx->lo)&0xff);
-  ctx->buffer[57] = curlx_ultouc((ctx->lo >> 8)&0xff);
-  ctx->buffer[58] = curlx_ultouc((ctx->lo >> 16)&0xff);
+  ctx->buffer[56] = curlx_ultouc((ctx->lo) & 0xff);
+  ctx->buffer[57] = curlx_ultouc((ctx->lo >> 8) & 0xff);
+  ctx->buffer[58] = curlx_ultouc((ctx->lo >> 16) & 0xff);
   ctx->buffer[59] = curlx_ultouc(ctx->lo >> 24);
-  ctx->buffer[60] = curlx_ultouc((ctx->hi)&0xff);
-  ctx->buffer[61] = curlx_ultouc((ctx->hi >> 8)&0xff);
-  ctx->buffer[62] = curlx_ultouc((ctx->hi >> 16)&0xff);
+  ctx->buffer[60] = curlx_ultouc((ctx->hi) & 0xff);
+  ctx->buffer[61] = curlx_ultouc((ctx->hi >> 8) & 0xff);
+  ctx->buffer[62] = curlx_ultouc((ctx->hi >> 16) & 0xff);
   ctx->buffer[63] = curlx_ultouc(ctx->hi >> 24);
 
-  body(ctx, ctx->buffer, 64);
+  my_md5_body(ctx, ctx->buffer, 64);
 
-  result[0] = curlx_ultouc((ctx->a)&0xff);
-  result[1] = curlx_ultouc((ctx->a >> 8)&0xff);
-  result[2] = curlx_ultouc((ctx->a >> 16)&0xff);
-  result[3] = curlx_ultouc(ctx->a >> 24);
-  result[4] = curlx_ultouc((ctx->b)&0xff);
-  result[5] = curlx_ultouc((ctx->b >> 8)&0xff);
-  result[6] = curlx_ultouc((ctx->b >> 16)&0xff);
-  result[7] = curlx_ultouc(ctx->b >> 24);
-  result[8] = curlx_ultouc((ctx->c)&0xff);
-  result[9] = curlx_ultouc((ctx->c >> 8)&0xff);
-  result[10] = curlx_ultouc((ctx->c >> 16)&0xff);
-  result[11] = curlx_ultouc(ctx->c >> 24);
-  result[12] = curlx_ultouc((ctx->d)&0xff);
-  result[13] = curlx_ultouc((ctx->d >> 8)&0xff);
-  result[14] = curlx_ultouc((ctx->d >> 16)&0xff);
-  result[15] = curlx_ultouc(ctx->d >> 24);
+  digest[0] = curlx_ultouc((ctx->a) & 0xff);
+  digest[1] = curlx_ultouc((ctx->a >> 8) & 0xff);
+  digest[2] = curlx_ultouc((ctx->a >> 16) & 0xff);
+  digest[3] = curlx_ultouc(ctx->a >> 24);
+  digest[4] = curlx_ultouc((ctx->b) & 0xff);
+  digest[5] = curlx_ultouc((ctx->b >> 8) & 0xff);
+  digest[6] = curlx_ultouc((ctx->b >> 16) & 0xff);
+  digest[7] = curlx_ultouc(ctx->b >> 24);
+  digest[8] = curlx_ultouc((ctx->c) & 0xff);
+  digest[9] = curlx_ultouc((ctx->c >> 8) & 0xff);
+  digest[10] = curlx_ultouc((ctx->c >> 16) & 0xff);
+  digest[11] = curlx_ultouc(ctx->c >> 24);
+  digest[12] = curlx_ultouc((ctx->d) & 0xff);
+  digest[13] = curlx_ultouc((ctx->d >> 8) & 0xff);
+  digest[14] = curlx_ultouc((ctx->d >> 16) & 0xff);
+  digest[15] = curlx_ultouc(ctx->d >> 24);
 
   memset(ctx, 0, sizeof(*ctx));
 }
 
 #endif /* CRYPTO LIBS */
 
-const struct HMAC_params Curl_HMAC_MD5[] = {
-  {
-    /* Hash initialization function. */
-    CURLX_FUNCTION_CAST(HMAC_hinit_func, my_md5_init),
-    /* Hash update function. */
-    CURLX_FUNCTION_CAST(HMAC_hupdate_func, my_md5_update),
-    /* Hash computation end function. */
-    CURLX_FUNCTION_CAST(HMAC_hfinal_func, my_md5_final),
-    /* Size of hash context structure. */
-    sizeof(my_md5_ctx),
-    /* Maximum key length. */
-    64,
-    /* Result size. */
-    16
-  }
+const struct HMAC_params Curl_HMAC_MD5 = {
+  my_md5_init,        /* Hash initialization function. */
+  my_md5_update,      /* Hash update function. */
+  my_md5_final,       /* Hash computation end function. */
+  sizeof(my_md5_ctx), /* Size of hash context structure. */
+  64,                 /* Maximum key length. */
+  16                  /* Result size. */
 };
 
-const struct MD5_params Curl_DIGEST_MD5[] = {
-  {
-    /* Digest initialization function */
-    CURLX_FUNCTION_CAST(Curl_MD5_init_func, my_md5_init),
-    /* Digest update function */
-    CURLX_FUNCTION_CAST(Curl_MD5_update_func, my_md5_update),
-    /* Digest computation end function */
-    CURLX_FUNCTION_CAST(Curl_MD5_final_func, my_md5_final),
-    /* Size of digest context struct */
-    sizeof(my_md5_ctx),
-    /* Result size */
-    16
-  }
+const struct MD5_params Curl_DIGEST_MD5 = {
+  my_md5_init,        /* Digest initialization function */
+  my_md5_update,      /* Digest update function */
+  my_md5_final,       /* Digest computation end function */
+  sizeof(my_md5_ctx), /* Size of digest context struct */
+  16                  /* Result size */
 };
 
 /*
  * @unittest: 1601
  * Returns CURLE_OK on success.
  */
-CURLcode Curl_md5it(unsigned char *outbuffer, const unsigned char *input,
-                    const size_t len)
+CURLcode Curl_md5it(unsigned char *output,
+                    const unsigned char *input, size_t len)
 {
   CURLcode result;
   my_md5_ctx ctx;
 
   result = my_md5_init(&ctx);
   if(!result) {
-    my_md5_update(&ctx, input, curlx_uztoui(len));
-    my_md5_final(outbuffer, &ctx);
+    do {
+      unsigned int ilen = (unsigned int)CURLMIN(len, UINT_MAX);
+      my_md5_update(&ctx, input, ilen);
+      input += ilen;
+      len -= ilen;
+    } while(len);
+    my_md5_final(output, &ctx);
   }
   return result;
 }
@@ -611,23 +568,23 @@ struct MD5_context *Curl_MD5_init(const struct MD5_params *md5params)
   struct MD5_context *ctxt;
 
   /* Create MD5 context */
-  ctxt = malloc(sizeof(*ctxt));
+  ctxt = curlx_malloc(sizeof(*ctxt));
 
   if(!ctxt)
     return ctxt;
 
-  ctxt->md5_hashctx = malloc(md5params->md5_ctxtsize);
+  ctxt->md5_hashctx = curlx_malloc(md5params->md5_ctxtsize);
 
   if(!ctxt->md5_hashctx) {
-    free(ctxt);
+    curlx_free(ctxt);
     return NULL;
   }
 
   ctxt->md5_hash = md5params;
 
   if((*md5params->md5_init_func)(ctxt->md5_hashctx)) {
-    free(ctxt->md5_hashctx);
-    free(ctxt);
+    curlx_free(ctxt->md5_hashctx);
+    curlx_free(ctxt);
     return NULL;
   }
 
@@ -635,10 +592,9 @@ struct MD5_context *Curl_MD5_init(const struct MD5_params *md5params)
 }
 
 CURLcode Curl_MD5_update(struct MD5_context *context,
-                         const unsigned char *data,
-                         unsigned int len)
+                         const unsigned char *input, unsigned int len)
 {
-  (*context->md5_hash->md5_update_func)(context->md5_hashctx, data, len);
+  (*context->md5_hash->md5_update_func)(context->md5_hashctx, input, len);
 
   return CURLE_OK;
 }
@@ -647,8 +603,8 @@ CURLcode Curl_MD5_final(struct MD5_context *context, unsigned char *result)
 {
   (*context->md5_hash->md5_final_func)(result, context->md5_hashctx);
 
-  free(context->md5_hashctx);
-  free(context);
+  curlx_free(context->md5_hashctx);
+  curlx_free(context);
 
   return CURLE_OK;
 }
diff --git a/third-party/curl/lib/memdebug.c b/third-party/curl/lib/memdebug.c
index d6952a07a1..b6af2c6d35 100644
--- a/third-party/curl/lib/memdebug.c
+++ b/third-party/curl/lib/memdebug.c
@@ -21,21 +21,19 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#ifdef CURLDEBUG
+#ifdef CURL_MEMDEBUG
 
-#include <curl/curl.h>
+#include <stddef.h>  /* for offsetof() */
 
 #include "urldata.h"
+#include "curl_threads.h"
+#include "curlx/fopen.h"  /* for CURLX_FOPEN_LOW(), CURLX_FREOPEN_LOW() */
 
-#define MEMDEBUG_NODEFINES /* don't redefine the standard functions */
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#ifdef USE_BACKTRACE
+#include <backtrace.h>
+#endif
 
 struct memdebug {
   size_t size;
@@ -44,22 +42,56 @@ struct memdebug {
     double d;
     void *p;
   } mem[1];
-  /* I'm hoping this is the thing with the strictest alignment
-   * requirements.  That also means we waste some space :-( */
+  /* I am hoping this is the thing with the strictest alignment
+   * requirements. That also means we waste some space :-( */
 };
 
 /*
- * Note that these debug functions are very simple and they are meant to
- * remain so. For advanced analysis, record a log file and write perl scripts
- * to analyze them!
+ * Note that these debug functions are simple and they are meant to remain so.
+ * For advanced analysis, record a log file and write perl scripts to analyze
+ * them!
  *
- * Don't use these with multithreaded test programs!
+ * Do not use these with multi-threaded test programs!
  */
 
 FILE *curl_dbg_logfile = NULL;
 static bool registered_cleanup = FALSE; /* atexit registered cleanup */
 static bool memlimit = FALSE; /* enable memory limit */
 static long memsize = 0;  /* set number of mallocs allowed */
+#ifdef USE_BACKTRACE
+static struct backtrace_state *btstate;
+#endif
+
+static char membuf[10000];
+static size_t memwidx = 0; /* write index */
+
+#ifdef USE_MUTEX
+static bool dbg_mutex_init = 0;
+static curl_mutex_t dbg_mutex;
+#endif
+
+static bool curl_dbg_lock(void)
+{
+#ifdef USE_MUTEX
+  if(dbg_mutex_init) {
+    Curl_mutex_acquire(&dbg_mutex);
+    return TRUE;
+  }
+#endif
+  return FALSE;
+}
+
+static void curl_dbg_unlock(bool was_locked)
+{
+#ifdef USE_MUTEX
+  if(was_locked)
+    Curl_mutex_release(&dbg_mutex);
+#else
+  (void)was_locked;
+#endif
+}
+
+static void curl_dbg_log_locked(const char *format, ...) CURL_PRINTF(1, 2);
 
 /* LeakSantizier (LSAN) calls _exit() instead of exit() when a leak is detected
    on exit so the logfile must be closed explicitly or data could be lost.
@@ -67,28 +99,75 @@ static long memsize = 0;  /* set number of mallocs allowed */
    _exit() comes after the atexit handlers are called. curl/curl#6620 */
 static void curl_dbg_cleanup(void)
 {
+  bool locked = curl_dbg_lock();
   if(curl_dbg_logfile &&
      curl_dbg_logfile != stderr &&
      curl_dbg_logfile != stdout) {
+    if(memwidx)
+      fwrite(membuf, 1, memwidx, curl_dbg_logfile);
+    /* !checksrc! disable BANNEDFUNC 1 */
     fclose(curl_dbg_logfile);
   }
   curl_dbg_logfile = NULL;
+  curl_dbg_unlock(locked);
+#ifdef USE_MUTEX
+  if(dbg_mutex_init) {
+    Curl_mutex_destroy(&dbg_mutex);
+    dbg_mutex_init = FALSE;
+  }
+#endif
 }
 
-/* this sets the log file name */
+#ifdef USE_BACKTRACE
+static void error_bt_callback(void *data, const char *message,
+                              int error_number)
+{
+  (void)data;
+  if(error_number == -1)
+    curl_dbg_log("compile with -g\n\n");
+  else
+    curl_dbg_log("Backtrace error %d: %s\n", error_number, message);
+}
+
+static int full_callback(void *data, uintptr_t pc, const char *pathname,
+                         int line_number, const char *function)
+{
+  (void)data;
+  (void)pc;
+  if(pathname || function || line_number)
+    curl_dbg_log("BT %s:%d -- %s\n", pathname, line_number, function);
+  return 0;
+}
+
+static void dump_bt(void)
+{
+  backtrace_full(btstate, 0, full_callback, error_bt_callback, NULL);
+}
+#else
+#define dump_bt() /* nothing to do */
+#endif
+
+/* this sets the log filename */
 void curl_dbg_memdebug(const char *logname)
 {
   if(!curl_dbg_logfile) {
     if(logname && *logname)
-      curl_dbg_logfile = fopen(logname, FOPEN_WRITETEXT);
-    else
-      curl_dbg_logfile = stderr;
+      curl_dbg_logfile = CURLX_FOPEN_LOW(logname, FOPEN_WRITETEXT);
 #ifdef MEMDEBUG_LOG_SYNC
-    /* Flush the log file after every line so the log isn't lost in a crash */
+    /* Flush the log file after every line so the log is not lost in a crash */
     if(curl_dbg_logfile)
       setbuf(curl_dbg_logfile, (char *)NULL);
 #endif
   }
+#ifdef USE_MUTEX
+  if(!dbg_mutex_init) {
+    dbg_mutex_init = TRUE;
+    Curl_mutex_init(&dbg_mutex);
+  }
+#endif
+#ifdef USE_BACKTRACE
+  btstate = backtrace_create_state(NULL, 0, error_bt_callback, NULL);
+#endif
   if(!registered_cleanup)
     registered_cleanup = !atexit(curl_dbg_cleanup);
 }
@@ -103,7 +182,7 @@ void curl_dbg_memlimit(long limit)
   }
 }
 
-/* returns TRUE if this isn't allowed! */
+/* returns TRUE if this is not allowed! */
 static bool countcheck(const char *func, int line, const char *source)
 {
   /* if source is NULL, then the call is made internally and this check
@@ -111,26 +190,25 @@ static bool countcheck(const char *func, int line, const char *source)
   if(memlimit && source) {
     if(!memsize) {
       /* log to file */
-      curl_dbg_log("LIMIT %s:%d %s reached memlimit\n",
-                   source, line, func);
+      curl_dbg_log("LIMIT %s:%d %s reached memlimit\n", source, line, func);
       /* log to stderr also */
-      fprintf(stderr, "LIMIT %s:%d %s reached memlimit\n",
-              source, line, func);
+      curl_mfprintf(stderr, "LIMIT %s:%d %s reached memlimit\n",
+                    source, line, func);
+      dump_bt();
       fflush(curl_dbg_logfile); /* because it might crash now */
+      /* !checksrc! disable ERRNOVAR 1 */
       errno = ENOMEM;
       return TRUE; /* RETURN ERROR! */
     }
     else
       memsize--; /* countdown */
-
-
   }
 
   return FALSE; /* allow this */
 }
 
-ALLOC_FUNC void *curl_dbg_malloc(size_t wantedsize,
-                                 int line, const char *source)
+ALLOC_FUNC
+void *curl_dbg_malloc(size_t wantedsize, int line, const char *source)
 {
   struct memdebug *mem;
   size_t size;
@@ -143,7 +221,7 @@ ALLOC_FUNC void *curl_dbg_malloc(size_t wantedsize,
   /* alloc at least 64 bytes */
   size = sizeof(struct memdebug) + wantedsize;
 
-  mem = (Curl_cmalloc)(size);
+  mem = Curl_cmalloc(size);
   if(mem) {
     mem->size = wantedsize;
   }
@@ -153,11 +231,12 @@ ALLOC_FUNC void *curl_dbg_malloc(size_t wantedsize,
                  source, line, wantedsize,
                  mem ? (void *)mem->mem : (void *)0);
 
-  return (mem ? mem->mem : NULL);
+  return mem ? mem->mem : NULL;
 }
 
-ALLOC_FUNC void *curl_dbg_calloc(size_t wanted_elements, size_t wanted_size,
-                                 int line, const char *source)
+ALLOC_FUNC
+void *curl_dbg_calloc(size_t wanted_elements, size_t wanted_size,
+                      int line, const char *source)
 {
   struct memdebug *mem;
   size_t size, user_size;
@@ -172,7 +251,7 @@ ALLOC_FUNC void *curl_dbg_calloc(size_t wanted_elements, size_t wanted_size,
   user_size = wanted_size * wanted_elements;
   size = sizeof(struct memdebug) + user_size;
 
-  mem = (Curl_ccalloc)(1, size);
+  mem = Curl_ccalloc(1, size);
   if(mem)
     mem->size = user_size;
 
@@ -181,16 +260,16 @@ ALLOC_FUNC void *curl_dbg_calloc(size_t wanted_elements, size_t wanted_size,
                  source, line, wanted_elements, wanted_size,
                  mem ? (void *)mem->mem : (void *)0);
 
-  return (mem ? mem->mem : NULL);
+  return mem ? mem->mem : NULL;
 }
 
-ALLOC_FUNC char *curl_dbg_strdup(const char *str,
-                                 int line, const char *source)
+ALLOC_FUNC
+char *curl_dbg_strdup(const char *str, int line, const char *source)
 {
   char *mem;
   size_t len;
 
-  DEBUGASSERT(str != NULL);
+  DEBUGASSERT(str);
 
   if(countcheck("strdup", line, source))
     return NULL;
@@ -208,14 +287,14 @@ ALLOC_FUNC char *curl_dbg_strdup(const char *str,
   return mem;
 }
 
-#if defined(WIN32) && defined(UNICODE)
-ALLOC_FUNC wchar_t *curl_dbg_wcsdup(const wchar_t *str,
-                                    int line, const char *source)
+#if defined(_WIN32) && defined(UNICODE)
+ALLOC_FUNC
+wchar_t *curl_dbg_wcsdup(const wchar_t *str, int line, const char *source)
 {
   wchar_t *mem;
   size_t wsiz, bsiz;
 
-  DEBUGASSERT(str != NULL);
+  DEBUGASSERT(str);
 
   if(countcheck("wcsdup", line, source))
     return NULL;
@@ -229,7 +308,7 @@ ALLOC_FUNC wchar_t *curl_dbg_wcsdup(const wchar_t *str,
 
   if(source)
     curl_dbg_log("MEM %s:%d wcsdup(%p) (%zu) = %p\n",
-                source, line, (void *)str, bsiz, (void *)mem);
+                source, line, (const void *)str, bsiz, (void *)mem);
 
   return mem;
 }
@@ -238,9 +317,10 @@ ALLOC_FUNC wchar_t *curl_dbg_wcsdup(const wchar_t *str,
 /* We provide a realloc() that accepts a NULL as pointer, which then
    performs a malloc(). In order to work with ares. */
 void *curl_dbg_realloc(void *ptr, size_t wantedsize,
-                      int line, const char *source)
+                       int line, const char *source)
 {
   struct memdebug *mem = NULL;
+  bool was_locked;
 
   size_t size = sizeof(struct memdebug) + wantedsize;
 
@@ -249,6 +329,10 @@ void *curl_dbg_realloc(void *ptr, size_t wantedsize,
   if(countcheck("realloc", line, source))
     return NULL;
 
+  /* need to realloc under lock, as we get out-of-order log
+   * entries otherwise, since another thread might alloc the
+   * memory released by realloc() before otherwise would log it. */
+  was_locked = curl_dbg_lock();
 #ifdef __INTEL_COMPILER
 #  pragma warning(push)
 #  pragma warning(disable:1684)
@@ -262,12 +346,13 @@ void *curl_dbg_realloc(void *ptr, size_t wantedsize,
 #  pragma warning(pop)
 #endif
 
-  mem = (Curl_crealloc)(mem, size);
+  mem = Curl_crealloc(mem, size);
   if(source)
-    curl_dbg_log("MEM %s:%d realloc(%p, %zu) = %p\n",
-                source, line, (void *)ptr, wantedsize,
-                mem ? (void *)mem->mem : (void *)0);
+    curl_dbg_log_locked("MEM %s:%d realloc(%p, %zu) = %p\n",
+                        source, line, (void *)ptr, wantedsize,
+                        mem ? (void *)mem->mem : (void *)0);
 
+  curl_dbg_unlock(was_locked);
   if(mem) {
     mem->size = wantedsize;
     return mem->mem;
@@ -281,6 +366,9 @@ void curl_dbg_free(void *ptr, int line, const char *source)
   if(ptr) {
     struct memdebug *mem;
 
+    if(source)
+      curl_dbg_log("MEM %s:%d free(%p)\n", source, line, (void *)ptr);
+
 #ifdef __INTEL_COMPILER
 #  pragma warning(push)
 #  pragma warning(disable:1684)
@@ -294,141 +382,124 @@ void curl_dbg_free(void *ptr, int line, const char *source)
 #endif
 
     /* free for real */
-    (Curl_cfree)(mem);
+    Curl_cfree(mem);
   }
-
-  if(source && ptr)
-    curl_dbg_log("MEM %s:%d free(%p)\n", source, line, (void *)ptr);
 }
 
 curl_socket_t curl_dbg_socket(int domain, int type, int protocol,
-                             int line, const char *source)
+                              int line, const char *source)
 {
-  const char *fmt = (sizeof(curl_socket_t) == sizeof(int)) ?
-    "FD %s:%d socket() = %d\n" :
-    (sizeof(curl_socket_t) == sizeof(long)) ?
-    "FD %s:%d socket() = %ld\n" :
-    "FD %s:%d socket() = %zd\n";
-
   curl_socket_t sockfd;
 
   if(countcheck("socket", line, source))
     return CURL_SOCKET_BAD;
 
+  /* !checksrc! disable BANNEDFUNC 1 */
   sockfd = socket(domain, type, protocol);
 
   if(source && (sockfd != CURL_SOCKET_BAD))
-    curl_dbg_log(fmt, source, line, sockfd);
+    curl_dbg_log("FD %s:%d socket() = %" FMT_SOCKET_T "\n",
+                 source, line, sockfd);
 
   return sockfd;
 }
 
-SEND_TYPE_RETV curl_dbg_send(SEND_TYPE_ARG1 sockfd,
-                            SEND_QUAL_ARG2 SEND_TYPE_ARG2 buf,
-                            SEND_TYPE_ARG3 len, SEND_TYPE_ARG4 flags, int line,
-                            const char *source)
-{
-  SEND_TYPE_RETV rc;
-  if(countcheck("send", line, source))
-    return -1;
-  rc = send(sockfd, buf, len, flags);
-  if(source)
-    curl_dbg_log("SEND %s:%d send(%lu) = %ld\n",
-                source, line, (unsigned long)len, (long)rc);
-  return rc;
-}
-
-RECV_TYPE_RETV curl_dbg_recv(RECV_TYPE_ARG1 sockfd, RECV_TYPE_ARG2 buf,
-                            RECV_TYPE_ARG3 len, RECV_TYPE_ARG4 flags, int line,
-                            const char *source)
-{
-  RECV_TYPE_RETV rc;
-  if(countcheck("recv", line, source))
-    return -1;
-  rc = recv(sockfd, buf, len, flags);
-  if(source)
-    curl_dbg_log("RECV %s:%d recv(%lu) = %ld\n",
-                source, line, (unsigned long)len, (long)rc);
-  return rc;
-}
-
 #ifdef HAVE_SOCKETPAIR
 int curl_dbg_socketpair(int domain, int type, int protocol,
-                       curl_socket_t socket_vector[2],
-                       int line, const char *source)
+                        curl_socket_t socket_vector[2],
+                        int line, const char *source)
 {
-  const char *fmt = (sizeof(curl_socket_t) == sizeof(int)) ?
-    "FD %s:%d socketpair() = %d %d\n" :
-    (sizeof(curl_socket_t) == sizeof(long)) ?
-    "FD %s:%d socketpair() = %ld %ld\n" :
-    "FD %s:%d socketpair() = %zd %zd\n";
-
+  /* !checksrc! disable BANNEDFUNC 1 */
   int res = socketpair(domain, type, protocol, socket_vector);
 
-  if(source && (0 == res))
-    curl_dbg_log(fmt, source, line, socket_vector[0], socket_vector[1]);
+  if(source && (res == 0))
+    curl_dbg_log("FD %s:%d socketpair() = "
+                 "%" FMT_SOCKET_T " %" FMT_SOCKET_T "\n",
+                 source, line, socket_vector[0], socket_vector[1]);
 
   return res;
 }
 #endif
 
 curl_socket_t curl_dbg_accept(curl_socket_t s, void *saddr, void *saddrlen,
-                             int line, const char *source)
+                              int line, const char *source)
 {
-  const char *fmt = (sizeof(curl_socket_t) == sizeof(int)) ?
-    "FD %s:%d accept() = %d\n" :
-    (sizeof(curl_socket_t) == sizeof(long)) ?
-    "FD %s:%d accept() = %ld\n" :
-    "FD %s:%d accept() = %zd\n";
-
   struct sockaddr *addr = (struct sockaddr *)saddr;
   curl_socklen_t *addrlen = (curl_socklen_t *)saddrlen;
 
+  /* !checksrc! disable BANNEDFUNC 1 */
   curl_socket_t sockfd = accept(s, addr, addrlen);
 
   if(source && (sockfd != CURL_SOCKET_BAD))
-    curl_dbg_log(fmt, source, line, sockfd);
+    curl_dbg_log("FD %s:%d accept() = %" FMT_SOCKET_T "\n",
+                 source, line, sockfd);
 
   return sockfd;
 }
 
+#ifdef HAVE_ACCEPT4
+curl_socket_t curl_dbg_accept4(curl_socket_t s, void *saddr, void *saddrlen,
+                               int flags,
+                               int line, const char *source)
+{
+  struct sockaddr *addr = (struct sockaddr *)saddr;
+  curl_socklen_t *addrlen = (curl_socklen_t *)saddrlen;
+
+  /* !checksrc! disable BANNEDFUNC 1 */
+  curl_socket_t sockfd = accept4(s, addr, addrlen, flags);
+
+  if(source && (sockfd != CURL_SOCKET_BAD))
+    curl_dbg_log("FD %s:%d accept() = %" FMT_SOCKET_T "\n",
+                 source, line, sockfd);
+
+  return sockfd;
+}
+#endif
+
 /* separate function to allow libcurl to mark a "faked" close */
 void curl_dbg_mark_sclose(curl_socket_t sockfd, int line, const char *source)
 {
-  const char *fmt = (sizeof(curl_socket_t) == sizeof(int)) ?
-    "FD %s:%d sclose(%d)\n":
-    (sizeof(curl_socket_t) == sizeof(long)) ?
-    "FD %s:%d sclose(%ld)\n":
-    "FD %s:%d sclose(%zd)\n";
-
   if(source)
-    curl_dbg_log(fmt, source, line, sockfd);
+    curl_dbg_log("FD %s:%d sclose(%" FMT_SOCKET_T ")\n",
+                 source, line, sockfd);
 }
 
 /* this is our own defined way to close sockets on *ALL* platforms */
 int curl_dbg_sclose(curl_socket_t sockfd, int line, const char *source)
 {
-  int res = sclose(sockfd);
   curl_dbg_mark_sclose(sockfd, line, source);
-  return res;
+  return CURL_SCLOSE(sockfd);
 }
 
-ALLOC_FUNC FILE *curl_dbg_fopen(const char *file, const char *mode,
-                                int line, const char *source)
+ALLOC_FUNC
+FILE *curl_dbg_fopen(const char *file, const char *mode,
+                     int line, const char *source)
 {
-  FILE *res = fopen(file, mode);
-
+  FILE *res = CURLX_FOPEN_LOW(file, mode);
   if(source)
     curl_dbg_log("FILE %s:%d fopen(\"%s\",\"%s\") = %p\n",
-                source, line, file, mode, (void *)res);
+                 source, line, file, mode, (void *)res);
 
   return res;
 }
 
-ALLOC_FUNC FILE *curl_dbg_fdopen(int filedes, const char *mode,
-                                 int line, const char *source)
+ALLOC_FUNC
+FILE *curl_dbg_freopen(const char *file, const char *mode, FILE *fh,
+                       int line, const char *source)
 {
-  FILE *res = fdopen(filedes, mode);
+  FILE *res = CURLX_FREOPEN_LOW(file, mode, fh);
+  if(source)
+    curl_dbg_log("FILE %s:%d freopen(\"%s\",\"%s\",%p) = %p\n",
+                 source, line, file, mode, (void *)fh, (void *)res);
+
+  return res;
+}
+
+ALLOC_FUNC
+FILE *curl_dbg_fdopen(int filedes, const char *mode,
+                      int line, const char *source)
+{
+  FILE *res = CURLX_FDOPEN_LOW(filedes, mode);
   if(source)
     curl_dbg_log("FILE %s:%d fdopen(\"%d\",\"%s\") = %p\n",
                  source, line, filedes, mode, (void *)res);
@@ -439,44 +510,70 @@ int curl_dbg_fclose(FILE *file, int line, const char *source)
 {
   int res;
 
-  DEBUGASSERT(file != NULL);
+  DEBUGASSERT(file);
 
   if(source)
-    curl_dbg_log("FILE %s:%d fclose(%p)\n",
-                 source, line, (void *)file);
+    curl_dbg_log("FILE %s:%d fclose(%p)\n", source, line, (void *)file);
 
+  /* !checksrc! disable BANNEDFUNC 1 */
   res = fclose(file);
 
   return res;
 }
 
-#define LOGLINE_BUFSIZE  1024
+static void curl_dbg_vlog(const char * const fmt,
+                          va_list ap) CURL_PRINTF(1, 0);
 
-/* this does the writing to the memory tracking log file */
-void curl_dbg_log(const char *format, ...)
+static void curl_dbg_vlog(const char * const fmt, va_list ap)
+{
+  char buf[1024];
+  size_t nchars = curl_mvsnprintf(buf, sizeof(buf), fmt, ap);
+
+  if(nchars > (int)sizeof(buf) - 1)
+    nchars = (int)sizeof(buf) - 1;
+
+  if(nchars > 0) {
+    if(sizeof(membuf) - nchars < memwidx) {
+      /* flush */
+      fwrite(membuf, 1, memwidx, curl_dbg_logfile);
+      fflush(curl_dbg_logfile);
+      memwidx = 0;
+    }
+    if(memwidx) {
+      /* the previous line ends with a newline */
+      DEBUGASSERT(membuf[memwidx - 1] == '\n');
+    }
+    memcpy(&membuf[memwidx], buf, nchars);
+    memwidx += nchars;
+  }
+}
+
+static void curl_dbg_log_locked(const char *format, ...)
 {
-  char *buf;
-  int nchars;
   va_list ap;
 
   if(!curl_dbg_logfile)
     return;
 
-  buf = (Curl_cmalloc)(LOGLINE_BUFSIZE);
-  if(!buf)
-    return;
-
   va_start(ap, format);
-  nchars = mvsnprintf(buf, LOGLINE_BUFSIZE, format, ap);
+  curl_dbg_vlog(format, ap);
   va_end(ap);
-
-  if(nchars > LOGLINE_BUFSIZE - 1)
-    nchars = LOGLINE_BUFSIZE - 1;
-
-  if(nchars > 0)
-    fwrite(buf, 1, (size_t)nchars, curl_dbg_logfile);
-
-  (Curl_cfree)(buf);
 }
 
-#endif /* CURLDEBUG */
+/* this does the writing to the memory tracking log file */
+void curl_dbg_log(const char *format, ...)
+{
+  bool was_locked;
+  va_list ap;
+
+  if(!curl_dbg_logfile)
+    return;
+
+  was_locked = curl_dbg_lock();
+  va_start(ap, format);
+  curl_dbg_vlog(format, ap);
+  va_end(ap);
+  curl_dbg_unlock(was_locked);
+}
+
+#endif /* CURL_MEMDEBUG */
diff --git a/third-party/curl/lib/memdebug.h b/third-party/curl/lib/memdebug.h
deleted file mode 100644
index c9eb5dc37c..0000000000
--- a/third-party/curl/lib/memdebug.h
+++ /dev/null
@@ -1,202 +0,0 @@
-#ifndef HEADER_CURL_MEMDEBUG_H
-#define HEADER_CURL_MEMDEBUG_H
-#ifdef CURLDEBUG
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-/*
- * CAUTION: this header is designed to work when included by the app-side
- * as well as the library. Do not mix with library internals!
- */
-
-#include <curl/curl.h>
-#include "functypes.h"
-
-#if defined(__GNUC__) && __GNUC__ >= 3
-#  define ALLOC_FUNC __attribute__((malloc))
-#  define ALLOC_SIZE(s) __attribute__((alloc_size(s)))
-#  define ALLOC_SIZE2(n, s) __attribute__((alloc_size(n, s)))
-#elif defined(_MSC_VER)
-#  define ALLOC_FUNC __declspec(restrict)
-#  define ALLOC_SIZE(s)
-#  define ALLOC_SIZE2(n, s)
-#else
-#  define ALLOC_FUNC
-#  define ALLOC_SIZE(s)
-#  define ALLOC_SIZE2(n, s)
-#endif
-
-#define CURL_MT_LOGFNAME_BUFSIZE 512
-
-extern FILE *curl_dbg_logfile;
-
-/* memory functions */
-CURL_EXTERN ALLOC_FUNC ALLOC_SIZE(1) void *curl_dbg_malloc(size_t size,
-                                                           int line,
-                                                           const char *source);
-CURL_EXTERN ALLOC_FUNC ALLOC_SIZE2(1, 2) void *curl_dbg_calloc(size_t elements,
-                                   size_t size, int line, const char *source);
-CURL_EXTERN ALLOC_SIZE(2) void *curl_dbg_realloc(void *ptr,
-                                                 size_t size,
-                                                 int line,
-                                                 const char *source);
-CURL_EXTERN void curl_dbg_free(void *ptr, int line, const char *source);
-CURL_EXTERN ALLOC_FUNC char *curl_dbg_strdup(const char *str, int line,
-                                             const char *src);
-#if defined(WIN32) && defined(UNICODE)
-CURL_EXTERN ALLOC_FUNC wchar_t *curl_dbg_wcsdup(const wchar_t *str,
-                                                int line,
-                                                const char *source);
-#endif
-
-CURL_EXTERN void curl_dbg_memdebug(const char *logname);
-CURL_EXTERN void curl_dbg_memlimit(long limit);
-CURL_EXTERN void curl_dbg_log(const char *format, ...);
-
-/* file descriptor manipulators */
-CURL_EXTERN curl_socket_t curl_dbg_socket(int domain, int type, int protocol,
-                                          int line, const char *source);
-CURL_EXTERN void curl_dbg_mark_sclose(curl_socket_t sockfd,
-                                      int line, const char *source);
-CURL_EXTERN int curl_dbg_sclose(curl_socket_t sockfd,
-                                int line, const char *source);
-CURL_EXTERN curl_socket_t curl_dbg_accept(curl_socket_t s, void *a, void *alen,
-                                          int line, const char *source);
-#ifdef HAVE_SOCKETPAIR
-CURL_EXTERN int curl_dbg_socketpair(int domain, int type, int protocol,
-                                    curl_socket_t socket_vector[2],
-                                    int line, const char *source);
-#endif
-
-/* send/receive sockets */
-CURL_EXTERN SEND_TYPE_RETV curl_dbg_send(SEND_TYPE_ARG1 sockfd,
-                                         SEND_QUAL_ARG2 SEND_TYPE_ARG2 buf,
-                                         SEND_TYPE_ARG3 len,
-                                         SEND_TYPE_ARG4 flags, int line,
-                                         const char *source);
-CURL_EXTERN RECV_TYPE_RETV curl_dbg_recv(RECV_TYPE_ARG1 sockfd,
-                                         RECV_TYPE_ARG2 buf,
-                                         RECV_TYPE_ARG3 len,
-                                         RECV_TYPE_ARG4 flags, int line,
-                                         const char *source);
-
-/* FILE functions */
-CURL_EXTERN ALLOC_FUNC FILE *curl_dbg_fopen(const char *file, const char *mode,
-                                  int line, const char *source);
-CURL_EXTERN ALLOC_FUNC FILE *curl_dbg_fdopen(int filedes, const char *mode,
-                                             int line, const char *source);
-
-CURL_EXTERN int curl_dbg_fclose(FILE *file, int line, const char *source);
-
-#ifndef MEMDEBUG_NODEFINES
-
-/* Set this symbol on the command-line, recompile all lib-sources */
-#undef strdup
-#define strdup(ptr) curl_dbg_strdup(ptr, __LINE__, __FILE__)
-#define malloc(size) curl_dbg_malloc(size, __LINE__, __FILE__)
-#define calloc(nbelem,size) curl_dbg_calloc(nbelem, size, __LINE__, __FILE__)
-#define realloc(ptr,size) curl_dbg_realloc(ptr, size, __LINE__, __FILE__)
-#define free(ptr) curl_dbg_free(ptr, __LINE__, __FILE__)
-#define send(a,b,c,d) curl_dbg_send(a,b,c,d, __LINE__, __FILE__)
-#define recv(a,b,c,d) curl_dbg_recv(a,b,c,d, __LINE__, __FILE__)
-
-#ifdef WIN32
-#  ifdef UNICODE
-#    undef wcsdup
-#    define wcsdup(ptr) curl_dbg_wcsdup(ptr, __LINE__, __FILE__)
-#    undef _wcsdup
-#    define _wcsdup(ptr) curl_dbg_wcsdup(ptr, __LINE__, __FILE__)
-#    undef _tcsdup
-#    define _tcsdup(ptr) curl_dbg_wcsdup(ptr, __LINE__, __FILE__)
-#  else
-#    undef _tcsdup
-#    define _tcsdup(ptr) curl_dbg_strdup(ptr, __LINE__, __FILE__)
-#  endif
-#endif
-
-#undef socket
-#define socket(domain,type,protocol)\
- curl_dbg_socket(domain, type, protocol, __LINE__, __FILE__)
-#undef accept /* for those with accept as a macro */
-#define accept(sock,addr,len)\
- curl_dbg_accept(sock, addr, len, __LINE__, __FILE__)
-#ifdef HAVE_SOCKETPAIR
-#define socketpair(domain,type,protocol,socket_vector)\
- curl_dbg_socketpair(domain, type, protocol, socket_vector, __LINE__, __FILE__)
-#endif
-
-#ifdef HAVE_GETADDRINFO
-#if defined(getaddrinfo) && defined(__osf__)
-/* OSF/1 and Tru64 have getaddrinfo as a define already, so we cannot define
-   our macro as for other platforms. Instead, we redefine the new name they
-   define getaddrinfo to become! */
-#define ogetaddrinfo(host,serv,hint,res) \
-  curl_dbg_getaddrinfo(host, serv, hint, res, __LINE__, __FILE__)
-#else
-#undef getaddrinfo
-#define getaddrinfo(host,serv,hint,res) \
-  curl_dbg_getaddrinfo(host, serv, hint, res, __LINE__, __FILE__)
-#endif
-#endif /* HAVE_GETADDRINFO */
-
-#ifdef HAVE_FREEADDRINFO
-#undef freeaddrinfo
-#define freeaddrinfo(data) \
-  curl_dbg_freeaddrinfo(data, __LINE__, __FILE__)
-#endif /* HAVE_FREEADDRINFO */
-
-/* sclose is probably already defined, redefine it! */
-#undef sclose
-#define sclose(sockfd) curl_dbg_sclose(sockfd,__LINE__,__FILE__)
-
-#define fake_sclose(sockfd) curl_dbg_mark_sclose(sockfd,__LINE__,__FILE__)
-
-#undef fopen
-#define fopen(file,mode) curl_dbg_fopen(file,mode,__LINE__,__FILE__)
-#undef fdopen
-#define fdopen(file,mode) curl_dbg_fdopen(file,mode,__LINE__,__FILE__)
-#define fclose(file) curl_dbg_fclose(file,__LINE__,__FILE__)
-
-#endif /* MEMDEBUG_NODEFINES */
-
-#endif /* CURLDEBUG */
-
-/*
-** Following section applies even when CURLDEBUG is not defined.
-*/
-
-#ifndef fake_sclose
-#define fake_sclose(x)  Curl_nop_stmt
-#endif
-
-/*
- * Curl_safefree defined as a macro to allow MemoryTracking feature
- * to log free() calls at same location where Curl_safefree is used.
- * This macro also assigns NULL to given pointer when free'd.
- */
-
-#define Curl_safefree(ptr) \
-  do { free((ptr)); (ptr) = NULL;} while(0)
-
-#endif /* HEADER_CURL_MEMDEBUG_H */
diff --git a/third-party/curl/lib/mime.c b/third-party/curl/lib/mime.c
index 842b2da7e6..077e599e43 100644
--- a/third-party/curl/lib/mime.c
+++ b/third-party/curl/lib/mime.c
@@ -21,117 +21,81 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include <curl/curl.h>
+struct Curl_easy;
 
 #include "mime.h"
-#include "warnless.h"
 #include "urldata.h"
 #include "sendf.h"
+#include "curl_trc.h"
+#include "transfer.h"
+#include "curlx/strdup.h"
+#include "curlx/basename.h"
+#include "curlx/strcopy.h"
+#include "curlx/fopen.h"
+#include "curlx/base64.h"
 
 #if !defined(CURL_DISABLE_MIME) && (!defined(CURL_DISABLE_HTTP) ||      \
                                     !defined(CURL_DISABLE_SMTP) ||      \
                                     !defined(CURL_DISABLE_IMAP))
 
-#if defined(HAVE_LIBGEN_H) && defined(HAVE_BASENAME)
-#include <libgen.h>
-#endif
-
 #include "rand.h"
 #include "slist.h"
-#include "strcase.h"
-#include "dynbuf.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curlx/dynbuf.h"
 
-#ifdef WIN32
-# ifndef R_OK
-#  define R_OK 4
-# endif
-#endif
+#define MAX_MIME_LEVELS 40 /* avoid deep nesting */
 
-
-#define READ_ERROR                      ((size_t) -1)
-#define STOP_FILLING                    ((size_t) -2)
+#define READ_ERROR   ((size_t)-1)
+#define STOP_FILLING ((size_t)-2)
 
 static size_t mime_subparts_read(char *buffer, size_t size, size_t nitems,
-                                 void *instream, bool *hasread);
-
-/* Encoders. */
-static size_t encoder_nop_read(char *buffer, size_t size, bool ateof,
-                                curl_mimepart *part);
-static curl_off_t encoder_nop_size(curl_mimepart *part);
-static size_t encoder_7bit_read(char *buffer, size_t size, bool ateof,
-                                curl_mimepart *part);
-static size_t encoder_base64_read(char *buffer, size_t size, bool ateof,
-                                curl_mimepart *part);
-static curl_off_t encoder_base64_size(curl_mimepart *part);
-static size_t encoder_qp_read(char *buffer, size_t size, bool ateof,
-                              curl_mimepart *part);
-static curl_off_t encoder_qp_size(curl_mimepart *part);
-
-static const struct mime_encoder encoders[] = {
-  {"binary", encoder_nop_read, encoder_nop_size},
-  {"8bit", encoder_nop_read, encoder_nop_size},
-  {"7bit", encoder_7bit_read, encoder_nop_size},
-  {"base64", encoder_base64_read, encoder_base64_size},
-  {"quoted-printable", encoder_qp_read, encoder_qp_size},
-  {ZERO_NULL, ZERO_NULL, ZERO_NULL}
-};
-
-/* Base64 encoding table */
-static const char base64enc[] =
-  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+                                 void *instream, bool *hasread,
+                                 size_t call_depth);
+static curl_off_t mime_size(curl_mimepart *part);
 
 /* Quoted-printable character class table.
  *
  * We cannot rely on ctype functions since quoted-printable input data
- * is assumed to be ascii-compatible, even on non-ascii platforms. */
+ * is assumed to be ASCII-compatible, even on non-ASCII platforms. */
 #define QP_OK           1       /* Can be represented by itself. */
 #define QP_SP           2       /* Space or tab. */
 #define QP_CR           3       /* Carriage return. */
 #define QP_LF           4       /* Line-feed. */
 static const unsigned char qp_class[] = {
- 0,     0,     0,     0,     0,     0,     0,     0,            /* 00 - 07 */
- 0,     QP_SP, QP_LF, 0,     0,     QP_CR, 0,     0,            /* 08 - 0F */
- 0,     0,     0,     0,     0,     0,     0,     0,            /* 10 - 17 */
- 0,     0,     0,     0,     0,     0,     0,     0,            /* 18 - 1F */
- QP_SP, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 20 - 27 */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 28 - 2F */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 30 - 37 */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, 0    , QP_OK, QP_OK,        /* 38 - 3F */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 40 - 47 */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 48 - 4F */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 50 - 57 */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 58 - 5F */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 60 - 67 */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 68 - 6F */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 70 - 77 */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, 0,            /* 78 - 7F */
- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* 80 - 8F */
- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* 90 - 9F */
- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* A0 - AF */
- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* B0 - BF */
- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* C0 - CF */
- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* D0 - DF */
- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* E0 - EF */
- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0                 /* F0 - FF */
+  0,     0,     0,     0,     0,     0,     0,     0,            /* 00 - 07 */
+  0,     QP_SP, QP_LF, 0,     0,     QP_CR, 0,     0,            /* 08 - 0F */
+  0,     0,     0,     0,     0,     0,     0,     0,            /* 10 - 17 */
+  0,     0,     0,     0,     0,     0,     0,     0,            /* 18 - 1F */
+  QP_SP, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 20 - 27 */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 28 - 2F */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 30 - 37 */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, 0    , QP_OK, QP_OK,        /* 38 - 3F */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 40 - 47 */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 48 - 4F */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 50 - 57 */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 58 - 5F */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 60 - 67 */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 68 - 6F */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 70 - 77 */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, 0,            /* 78 - 7F */
+  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* 80 - 8F */
+  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* 90 - 9F */
+  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* A0 - AF */
+  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* B0 - BF */
+  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* C0 - CF */
+  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* D0 - DF */
+  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* E0 - EF */
+  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0                 /* F0 - FF */
 };
 
-
 /* Binary --> hexadecimal ASCII table. */
 static const char aschex[] =
   "\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x41\x42\x43\x44\x45\x46";
 
-
-
 #ifndef __VMS
-#define filesize(name, stat_data) (stat_data.st_size)
-#define fopen_read fopen
+#define filesize(name, stat_data) stat_data.st_size
+#define fopen_read                curlx_fopen
 
 #else
 
@@ -146,15 +110,14 @@ static const char aschex[] =
  * and CD/DVD images should be either a STREAM_LF format or a fixed format.
  *
  */
-curl_off_t VmsRealFileSize(const char *name,
-                           const struct_stat *stat_buf)
+curl_off_t VmsRealFileSize(const char *name, const curlx_struct_stat *stat_buf)
 {
   char buffer[8192];
   curl_off_t count;
   int ret_stat;
-  FILE * file;
+  FILE *file;
 
-  file = fopen(name, FOPEN_READTEXT); /* VMS */
+  file = curlx_fopen(name, FOPEN_READTEXT); /* VMS */
   if(!file)
     return 0;
 
@@ -165,7 +128,7 @@ curl_off_t VmsRealFileSize(const char *name,
     if(ret_stat)
       count += ret_stat;
   }
-  fclose(file);
+  curlx_fclose(file);
 
   return count;
 }
@@ -177,7 +140,7 @@ curl_off_t VmsRealFileSize(const char *name,
  *
  */
 static curl_off_t VmsSpecialSize(const char *name,
-                                 const struct_stat *stat_buf)
+                                 const curlx_struct_stat *stat_buf)
 {
   switch(stat_buf->st_fab_rfm) {
   case FAB$C_VAR:
@@ -199,77 +162,27 @@ static curl_off_t VmsSpecialSize(const char *name,
  * record format of the file.
  *
  */
-static FILE * vmsfopenread(const char *file, const char *mode)
+static FILE *vmsfopenread(const char *file, const char *mode)
 {
-  struct_stat statbuf;
-  int result;
+  curlx_struct_stat statbuf;
+  int res = curlx_stat(file, &statbuf);
 
-  result = stat(file, &statbuf);
-
-  switch(statbuf.st_fab_rfm) {
-  case FAB$C_VAR:
-  case FAB$C_VFC:
-  case FAB$C_STMCR:
-    return fopen(file, FOPEN_READTEXT); /* VMS */
-    break;
-  default:
-    return fopen(file, FOPEN_READTEXT, "rfm=stmlf", "ctx=stm");
+  if(res != -1) {
+    switch(statbuf.st_fab_rfm) {
+    case FAB$C_VAR:
+    case FAB$C_VFC:
+    case FAB$C_STMCR:
+      return curlx_fopen(file, FOPEN_READTEXT); /* VMS */
+      break;
+    default:
+      return curlx_fopen(file, FOPEN_READTEXT, "rfm=stmlf", "ctx=stm");
+    }
   }
+  return NULL;
 }
 
 #define fopen_read vmsfopenread
-#endif
-
-
-#ifndef HAVE_BASENAME
-/*
-  (Quote from The Open Group Base Specifications Issue 6 IEEE Std 1003.1, 2004
-  Edition)
-
-  The basename() function shall take the pathname pointed to by path and
-  return a pointer to the final component of the pathname, deleting any
-  trailing '/' characters.
-
-  If the string pointed to by path consists entirely of the '/' character,
-  basename() shall return a pointer to the string "/". If the string pointed
-  to by path is exactly "//", it is implementation-defined whether '/' or "//"
-  is returned.
-
-  If path is a null pointer or points to an empty string, basename() shall
-  return a pointer to the string ".".
-
-  The basename() function may modify the string pointed to by path, and may
-  return a pointer to static storage that may then be overwritten by a
-  subsequent call to basename().
-
-  The basename() function need not be reentrant. A function that is not
-  required to be reentrant is not required to be thread-safe.
-
-*/
-static char *Curl_basename(char *path)
-{
-  /* Ignore all the details above for now and make a quick and simple
-     implementation here */
-  char *s1;
-  char *s2;
-
-  s1 = strrchr(path, '/');
-  s2 = strrchr(path, '\\');
-
-  if(s1 && s2) {
-    path = (s1 > s2? s1 : s2) + 1;
-  }
-  else if(s1)
-    path = s1 + 1;
-  else if(s2)
-    path = s2 + 1;
-
-  return path;
-}
-
-#define basename(x)  Curl_basename((x))
-#endif
-
+#endif /* !__VMS */
 
 /* Set readback state. */
 static void mimesetstate(struct mime_state *state,
@@ -280,7 +193,6 @@ static void mimesetstate(struct mime_state *state,
   state->offset = 0;
 }
 
-
 /* Escape header string into allocated memory. */
 static char *escape_string(struct Curl_easy *data,
                            const char *src, enum mimestrategy strategy)
@@ -311,23 +223,22 @@ static char *escape_string(struct Curl_easy *data,
   table = formtable;
   /* data can be NULL when this function is called indirectly from
      curl_formget(). */
-  if(strategy == MIMESTRATEGY_MAIL ||
-     (data && (data->set.mime_options & CURLMIMEOPT_FORMESCAPE)))
+  if(strategy == MIMESTRATEGY_MAIL || (data && (data->set.mime_formescape)))
     table = mimetable;
 
-  Curl_dyn_init(&db, CURL_MAX_INPUT_LENGTH);
+  curlx_dyn_init(&db, CURL_MAX_INPUT_LENGTH);
 
-  for(result = Curl_dyn_addn(&db, STRCONST("")); !result && *src; src++) {
+  for(result = curlx_dyn_addn(&db, STRCONST("")); !result && *src; src++) {
     for(p = table; *p && **p != *src; p++)
       ;
 
     if(*p)
-      result = Curl_dyn_add(&db, *p + 1);
+      result = curlx_dyn_add(&db, *p + 1);
     else
-      result = Curl_dyn_addn(&db, src, 1);
+      result = curlx_dyn_addn(&db, src, 1);
   }
 
-  return Curl_dyn_ptr(&db);
+  return curlx_dyn_ptr(&db);
 }
 
 /* Check if header matches. */
@@ -335,7 +246,7 @@ static char *match_header(struct curl_slist *hdr, const char *lbl, size_t len)
 {
   char *value = NULL;
 
-  if(strncasecompare(hdr->data, lbl, len) && hdr->data[len] == ':')
+  if(curl_strnequal(hdr->data, lbl, len) && hdr->data[len] == ':')
     for(value = hdr->data + len + 1; *value == ' '; value++)
       ;
   return value;
@@ -357,13 +268,13 @@ static char *strippath(const char *fullfile)
 {
   char *filename;
   char *base;
-  filename = strdup(fullfile); /* duplicate since basename() may ruin the
-                                  buffer it works on */
+  filename = curlx_strdup(fullfile); /* duplicate since basename() may ruin
+                                        the buffer it works on */
   if(!filename)
     return NULL;
-  base = strdup(basename(filename));
+  base = curlx_strdup(curlx_basename(filename));
 
-  free(filename); /* free temporary buffer */
+  curlx_free(filename); /* free temporary buffer */
 
   return base; /* returns an allocated string or NULL ! */
 }
@@ -376,15 +287,14 @@ static void cleanup_encoder_state(struct mime_encoder_state *p)
   p->bufend = 0;
 }
 
-
-/* Dummy encoder. This is used for 8bit and binary content encodings. */
+/* Dummy encoder. This is used for 8-bit and binary content encodings. */
 static size_t encoder_nop_read(char *buffer, size_t size, bool ateof,
                                struct curl_mimepart *part)
 {
   struct mime_encoder_state *st = &part->encstate;
   size_t insize = st->bufend - st->bufbeg;
 
-  (void) ateof;
+  (void)ateof;
 
   if(!size)
     return STOP_FILLING;
@@ -404,15 +314,14 @@ static curl_off_t encoder_nop_size(curl_mimepart *part)
   return part->datasize;
 }
 
-
-/* 7bit encoder: the encoder is just a data validity check. */
+/* 7-bit encoder: the encoder is a data validity check. */
 static size_t encoder_7bit_read(char *buffer, size_t size, bool ateof,
                                 curl_mimepart *part)
 {
   struct mime_encoder_state *st = &part->encstate;
   size_t cursize = st->bufend - st->bufbeg;
 
-  (void) ateof;
+  (void)ateof;
 
   if(!size)
     return STOP_FILLING;
@@ -423,17 +332,16 @@ static size_t encoder_7bit_read(char *buffer, size_t size, bool ateof,
   for(cursize = 0; cursize < size; cursize++) {
     *buffer = st->buf[st->bufbeg];
     if(*buffer++ & 0x80)
-      return cursize? cursize: READ_ERROR;
+      return cursize ? cursize : READ_ERROR;
     st->bufbeg++;
   }
 
   return cursize;
 }
 
-
 /* Base64 content encoder. */
 static size_t encoder_base64_read(char *buffer, size_t size, bool ateof,
-                                curl_mimepart *part)
+                                  curl_mimepart *part)
 {
   struct mime_encoder_state *st = &part->encstate;
   size_t cursize = 0;
@@ -469,10 +377,10 @@ static size_t encoder_base64_read(char *buffer, size_t size, bool ateof,
     i = st->buf[st->bufbeg++] & 0xFF;
     i = (i << 8) | (st->buf[st->bufbeg++] & 0xFF);
     i = (i << 8) | (st->buf[st->bufbeg++] & 0xFF);
-    *ptr++ = base64enc[(i >> 18) & 0x3F];
-    *ptr++ = base64enc[(i >> 12) & 0x3F];
-    *ptr++ = base64enc[(i >> 6) & 0x3F];
-    *ptr++ = base64enc[i & 0x3F];
+    *ptr++ = curlx_base64encdec[(i >> 18) & 0x3F];
+    *ptr++ = curlx_base64encdec[(i >> 12) & 0x3F];
+    *ptr++ = curlx_base64encdec[(i >> 6) & 0x3F];
+    *ptr++ = curlx_base64encdec[i & 0x3F];
     cursize += 4;
     st->pos += 4;
     size -= 4;
@@ -496,10 +404,10 @@ static size_t encoder_base64_read(char *buffer, size_t size, bool ateof,
           i = (st->buf[st->bufbeg + 1] & 0xFF) << 8;
 
         i |= (st->buf[st->bufbeg] & 0xFF) << 16;
-        ptr[0] = base64enc[(i >> 18) & 0x3F];
-        ptr[1] = base64enc[(i >> 12) & 0x3F];
+        ptr[0] = curlx_base64encdec[(i >> 18) & 0x3F];
+        ptr[1] = curlx_base64encdec[(i >> 12) & 0x3F];
         if(++st->bufbeg != st->bufend) {
-          ptr[2] = base64enc[(i >> 6) & 0x3F];
+          ptr[2] = curlx_base64encdec[(i >> 6) & 0x3F];
           st->bufbeg++;
         }
         cursize += 4;
@@ -519,13 +427,12 @@ static curl_off_t encoder_base64_size(curl_mimepart *part)
     return size;    /* Unknown size or no data. */
 
   /* Compute base64 character count. */
-  size = 4 * (1 + (size - 1) / 3);
+  size = 4 * (1 + ((size - 1) / 3));
 
   /* Effective character count must include CRLFs. */
-  return size + 2 * ((size - 1) / MAX_ENCODED_LINE_LENGTH);
+  return size + (2 * ((size - 1) / MAX_ENCODED_LINE_LENGTH));
 }
 
-
 /* Quoted-printable lookahead.
  *
  * Check if a CRLF or end of data is in input buffer at current position + n.
@@ -537,7 +444,7 @@ static int qp_lookahead_eol(struct mime_encoder_state *st, int ateof, size_t n)
   if(n >= st->bufend && ateof)
     return 1;
   if(n + 2 > st->bufend)
-    return ateof? 0: -1;
+    return ateof ? 0 : -1;
   if(qp_class[st->buf[n] & 0xFF] == QP_CR &&
      qp_class[st->buf[n + 1] & 0xFF] == QP_LF)
     return 1;
@@ -556,13 +463,13 @@ static size_t encoder_qp_read(char *buffer, size_t size, bool ateof,
 
   /* On all platforms, input is supposed to be ASCII compatible: for this
      reason, we use hexadecimal ASCII codes in this function rather than
-     character constants that can be interpreted as non-ascii on some
+     character constants that can be interpreted as non-ASCII on some
      platforms. Preserve ASCII encoding on output too. */
   while(st->bufbeg < st->bufend) {
     size_t len = 1;
     size_t consumed = 1;
-    int i = st->buf[st->bufbeg];
-    buf[0] = (char) i;
+    int i = (unsigned char)st->buf[st->bufbeg];
+    buf[0] = (char)i;
     buf[1] = aschex[(i >> 4) & 0xF];
     buf[2] = aschex[i & 0xF];
 
@@ -619,7 +526,7 @@ static size_t encoder_qp_read(char *buffer, size_t size, bool ateof,
         }
       }
       if(softlinebreak) {
-        strcpy(buf, "\x3D\x0D\x0A");    /* "=\r\n" */
+        curlx_strcopy(buf, sizeof(buf), STRCONST("\x3D\x0D\x0A")); /* =\r\n */
         len = 3;
         consumed = 0;
       }
@@ -650,18 +557,17 @@ static curl_off_t encoder_qp_size(curl_mimepart *part)
 {
   /* Determining the size can only be done by reading the data: unless the
      data size is 0, we return it as unknown (-1). */
-  return part->datasize? -1: 0;
+  return part->datasize ? -1 : 0;
 }
 
-
 /* In-memory data callbacks. */
 /* Argument is a pointer to the mime part. */
 static size_t mime_mem_read(char *buffer, size_t size, size_t nitems,
                             void *instream)
 {
-  curl_mimepart *part = (curl_mimepart *) instream;
+  curl_mimepart *part = (curl_mimepart *)instream;
   size_t sz = curlx_sotouz(part->datasize - part->state.offset);
-  (void) size;   /* Always 1.*/
+  (void)size;  /* Always 1 */
 
   if(!nitems)
     return STOP_FILLING;
@@ -677,7 +583,7 @@ static size_t mime_mem_read(char *buffer, size_t size, size_t nitems,
 
 static int mime_mem_seek(void *instream, curl_off_t offset, int whence)
 {
-  curl_mimepart *part = (curl_mimepart *) instream;
+  curl_mimepart *part = (curl_mimepart *)instream;
 
   switch(whence) {
   case SEEK_CUR:
@@ -697,26 +603,25 @@ static int mime_mem_seek(void *instream, curl_off_t offset, int whence)
 
 static void mime_mem_free(void *ptr)
 {
-  Curl_safefree(((curl_mimepart *) ptr)->data);
+  curlx_safefree(((curl_mimepart *)ptr)->data);
 }
 
-
 /* Named file callbacks. */
 /* Argument is a pointer to the mime part. */
-static int mime_open_file(curl_mimepart *part)
+static bool mime_open_file(curl_mimepart *part)
 {
   /* Open a MIMEKIND_FILE part. */
 
   if(part->fp)
-    return 0;
+    return FALSE;
   part->fp = fopen_read(part->data, "rb");
-  return part->fp? 0: -1;
+  return part->fp ? FALSE : TRUE;
 }
 
 static size_t mime_file_read(char *buffer, size_t size, size_t nitems,
                              void *instream)
 {
-  curl_mimepart *part = (curl_mimepart *) instream;
+  curl_mimepart *part = (curl_mimepart *)instream;
 
   if(!nitems)
     return STOP_FILLING;
@@ -729,7 +634,7 @@ static size_t mime_file_read(char *buffer, size_t size, size_t nitems,
 
 static int mime_file_seek(void *instream, curl_off_t offset, int whence)
 {
-  curl_mimepart *part = (curl_mimepart *) instream;
+  curl_mimepart *part = (curl_mimepart *)instream;
 
   if(whence == SEEK_SET && !offset && !part->fp)
     return CURL_SEEKFUNC_OK;   /* Not open: implicitly already at BOF. */
@@ -737,22 +642,21 @@ static int mime_file_seek(void *instream, curl_off_t offset, int whence)
   if(mime_open_file(part))
     return CURL_SEEKFUNC_FAIL;
 
-  return fseek(part->fp, (long) offset, whence)?
-               CURL_SEEKFUNC_CANTSEEK: CURL_SEEKFUNC_OK;
+  return curlx_fseek(part->fp, offset, whence) ?
+    CURL_SEEKFUNC_CANTSEEK : CURL_SEEKFUNC_OK;
 }
 
 static void mime_file_free(void *ptr)
 {
-  curl_mimepart *part = (curl_mimepart *) ptr;
+  curl_mimepart *part = (curl_mimepart *)ptr;
 
   if(part->fp) {
-    fclose(part->fp);
+    curlx_fclose(part->fp);
     part->fp = NULL;
   }
-  Curl_safefree(part->data);
+  curlx_safefree(part->data);
 }
 
-
 /* Subparts callbacks. */
 /* Argument is a pointer to the mime structure. */
 
@@ -786,11 +690,16 @@ static size_t readback_bytes(struct mime_state *state,
 }
 
 /* Read a non-encoded part content. */
-static size_t read_part_content(curl_mimepart *part,
-                                char *buffer, size_t bufsize, bool *hasread)
+
+static size_t read_part_content(curl_mimepart *part, char *buffer,
+                                size_t bufsize, bool *hasread,
+                                size_t call_depth)
 {
   size_t sz = 0;
 
+  if(++call_depth > MAX_MIME_LEVELS)
+    return READ_ERROR;
+
   switch(part->lastreadstatus) {
   case 0:
   case CURL_READFUNC_ABORT:
@@ -802,7 +711,7 @@ static size_t read_part_content(curl_mimepart *part,
   }
 
   /* If we can determine we are at end of part data, spare a read. */
-  if(part->datasize != (curl_off_t) -1 &&
+  if(part->datasize != (curl_off_t)-1 &&
      part->state.offset >= part->datasize) {
     /* sz is already zero. */
   }
@@ -813,12 +722,13 @@ static size_t read_part_content(curl_mimepart *part,
        * Cannot be processed as other kinds since read function requires
        * an additional parameter and is highly recursive.
        */
-       sz = mime_subparts_read(buffer, 1, bufsize, part->arg, hasread);
-       break;
+      sz = mime_subparts_read(buffer, 1, bufsize, part->arg, hasread,
+                              call_depth);
+      break;
     case MIMEKIND_FILE:
       if(part->fp && feof(part->fp))
         break;  /* At EOF. */
-      /* FALLTHROUGH */
+      FALLTHROUGH();
     default:
       if(part->readfunc) {
         if(!(part->flags & MIME_FAST_READ)) {
@@ -852,13 +762,17 @@ static size_t read_part_content(curl_mimepart *part,
 
 /* Read and encode part content. */
 static size_t read_encoded_part_content(curl_mimepart *part, char *buffer,
-                                        size_t bufsize, bool *hasread)
+                                        size_t bufsize, bool *hasread,
+                                        size_t call_depth)
 {
   struct mime_encoder_state *st = &part->encstate;
   size_t cursize = 0;
   size_t sz;
   bool ateof = FALSE;
 
+  if(++call_depth > MAX_MIME_LEVELS)
+    return READ_ERROR;
+
   for(;;) {
     if(st->bufbeg < st->bufend || ateof) {
       /* Encode buffered data. */
@@ -870,7 +784,7 @@ static size_t read_encoded_part_content(curl_mimepart *part, char *buffer,
         break;
       case READ_ERROR:
       case STOP_FILLING:
-        return cursize? cursize: sz;
+        return cursize ? cursize : sz;
       default:
         cursize += sz;
         buffer += sz;
@@ -889,9 +803,9 @@ static size_t read_encoded_part_content(curl_mimepart *part, char *buffer,
       st->bufend = len;
     }
     if(st->bufend >= sizeof(st->buf))
-      return cursize? cursize: READ_ERROR;    /* Buffer full. */
+      return cursize ? cursize : READ_ERROR;    /* Buffer full. */
     sz = read_part_content(part, st->buf + st->bufend,
-                           sizeof(st->buf) - st->bufend, hasread);
+                           sizeof(st->buf) - st->bufend, hasread, call_depth);
     switch(sz) {
     case 0:
       ateof = TRUE;
@@ -900,7 +814,7 @@ static size_t read_encoded_part_content(curl_mimepart *part, char *buffer,
     case CURL_READFUNC_PAUSE:
     case READ_ERROR:
     case STOP_FILLING:
-      return cursize? cursize: sz;
+      return cursize ? cursize : sz;
     default:
       st->bufend += sz;
       break;
@@ -912,20 +826,23 @@ static size_t read_encoded_part_content(curl_mimepart *part, char *buffer,
 
 /* Readback a mime part. */
 static size_t readback_part(curl_mimepart *part,
-                            char *buffer, size_t bufsize, bool *hasread)
+                            char *buffer, size_t bufsize, bool *hasread,
+                            size_t call_depth)
 {
   size_t cursize = 0;
 
-  /* Readback from part. */
+  if(++call_depth > MAX_MIME_LEVELS)
+    return READ_ERROR;
 
+  /* Readback from part. */
   while(bufsize) {
     size_t sz = 0;
-    struct curl_slist *hdr = (struct curl_slist *) part->state.ptr;
+    struct curl_slist *hdr = (struct curl_slist *)part->state.ptr;
     switch(part->state.state) {
     case MIMESTATE_BEGIN:
       mimesetstate(&part->state,
-                   (part->flags & MIME_BODY_ONLY)?
-                     MIMESTATE_BODY: MIMESTATE_CURLHEADERS,
+                   (part->flags & MIME_BODY_ONLY) ?
+                   MIMESTATE_BODY : MIMESTATE_CURLHEADERS,
                    part->curlheaders);
       break;
     case MIMESTATE_USERHEADERS:
@@ -937,7 +854,7 @@ static size_t readback_part(curl_mimepart *part,
         mimesetstate(&part->state, MIMESTATE_USERHEADERS, hdr->next);
         break;
       }
-      /* FALLTHROUGH */
+      FALLTHROUGH();
     case MIMESTATE_CURLHEADERS:
       if(!hdr)
         mimesetstate(&part->state, MIMESTATE_USERHEADERS, part->userheaders);
@@ -960,23 +877,24 @@ static size_t readback_part(curl_mimepart *part,
       break;
     case MIMESTATE_CONTENT:
       if(part->encoder)
-        sz = read_encoded_part_content(part, buffer, bufsize, hasread);
+        sz = read_encoded_part_content(part, buffer, bufsize, hasread,
+                                       call_depth);
       else
-        sz = read_part_content(part, buffer, bufsize, hasread);
+        sz = read_part_content(part, buffer, bufsize, hasread, call_depth);
       switch(sz) {
       case 0:
         mimesetstate(&part->state, MIMESTATE_END, NULL);
         /* Try sparing open file descriptors. */
         if(part->kind == MIMEKIND_FILE && part->fp) {
-          fclose(part->fp);
+          curlx_fclose(part->fp);
           part->fp = NULL;
         }
-        /* FALLTHROUGH */
+        FALLTHROUGH();
       case CURL_READFUNC_ABORT:
       case CURL_READFUNC_PAUSE:
       case READ_ERROR:
       case STOP_FILLING:
-        return cursize? cursize: sz;
+        return cursize ? cursize : sz;
       }
       break;
     case MIMESTATE_END:
@@ -996,11 +914,15 @@ static size_t readback_part(curl_mimepart *part,
 
 /* Readback from mime. Warning: not a read callback function. */
 static size_t mime_subparts_read(char *buffer, size_t size, size_t nitems,
-                                 void *instream, bool *hasread)
+                                 void *instream, bool *hasread,
+                                 size_t call_depth)
 {
-  curl_mime *mime = (curl_mime *) instream;
+  curl_mime *mime = (curl_mime *)instream;
   size_t cursize = 0;
-  (void) size;   /* Always 1. */
+  (void)size;  /* Always 1 */
+
+  if(++call_depth > MAX_MIME_LEVELS)
+    return READ_ERROR;
 
   while(nitems) {
     size_t sz = 0;
@@ -1036,13 +958,13 @@ static size_t mime_subparts_read(char *buffer, size_t size, size_t nitems,
         mimesetstate(&mime->state, MIMESTATE_END, NULL);
         break;
       }
-      sz = readback_part(part, buffer, nitems, hasread);
+      sz = readback_part(part, buffer, nitems, hasread, call_depth);
       switch(sz) {
       case CURL_READFUNC_ABORT:
       case CURL_READFUNC_PAUSE:
       case READ_ERROR:
       case STOP_FILLING:
-        return cursize? cursize: sz;
+        return cursize ? cursize : sz;
       case 0:
         mimesetstate(&mime->state, MIMESTATE_BOUNDARY1, part->nextpart);
         break;
@@ -1074,7 +996,7 @@ static int mime_part_rewind(curl_mimepart *part)
   if(part->state.state > targetstate) {
     res = CURL_SEEKFUNC_CANTSEEK;
     if(part->seekfunc) {
-      res = part->seekfunc(part->arg, (curl_off_t) 0, SEEK_SET);
+      res = part->seekfunc(part->arg, (curl_off_t)0, SEEK_SET);
       switch(res) {
       case CURL_SEEKFUNC_OK:
       case CURL_SEEKFUNC_FAIL:
@@ -1099,9 +1021,9 @@ static int mime_part_rewind(curl_mimepart *part)
 
 static int mime_subparts_seek(void *instream, curl_off_t offset, int whence)
 {
-  curl_mime *mime = (curl_mime *) instream;
+  curl_mime *mime = (curl_mime *)instream;
   curl_mimepart *part;
-  int result = CURL_SEEKFUNC_OK;
+  int rc = CURL_SEEKFUNC_OK;
 
   if(whence != SEEK_SET || offset)
     return CURL_SEEKFUNC_CANTSEEK;    /* Only support full rewind. */
@@ -1112,13 +1034,13 @@ static int mime_subparts_seek(void *instream, curl_off_t offset, int whence)
   for(part = mime->firstpart; part; part = part->nextpart) {
     int res = mime_part_rewind(part);
     if(res != CURL_SEEKFUNC_OK)
-      result = res;
+      rc = res;
   }
 
-  if(result == CURL_SEEKFUNC_OK)
+  if(rc == CURL_SEEKFUNC_OK)
     mimesetstate(&mime->state, MIMESTATE_BEGIN, NULL);
 
-  return result;
+  return rc;
 }
 
 /* Release part content. */
@@ -1130,23 +1052,23 @@ static void cleanup_part_content(curl_mimepart *part)
   part->readfunc = NULL;
   part->seekfunc = NULL;
   part->freefunc = NULL;
-  part->arg = (void *) part;          /* Defaults to part itself. */
+  part->arg = (void *)part;           /* Defaults to part itself. */
   part->data = NULL;
   part->fp = NULL;
-  part->datasize = (curl_off_t) 0;    /* No size yet. */
+  part->datasize = (curl_off_t)0;     /* No size yet. */
   cleanup_encoder_state(&part->encstate);
   part->kind = MIMEKIND_NONE;
-  part->flags &= ~MIME_FAST_READ;
+  part->flags &= ~(unsigned int)MIME_FAST_READ;
   part->lastreadstatus = 1; /* Successful read status. */
   part->state.state = MIMESTATE_BEGIN;
 }
 
 static void mime_subparts_free(void *ptr)
 {
-  curl_mime *mime = (curl_mime *) ptr;
+  curl_mime *mime = (curl_mime *)ptr;
 
   if(mime && mime->parent) {
-    mime->parent->freefunc = NULL;  /* Be sure we won't be called again. */
+    mime->parent->freefunc = NULL;  /* Be sure we will not be called again. */
     cleanup_part_content(mime->parent);  /* Avoid dangling pointer in part. */
   }
   curl_mime_free(mime);
@@ -1155,16 +1077,15 @@ static void mime_subparts_free(void *ptr)
 /* Do not free subparts: unbind them. This is used for the top level only. */
 static void mime_subparts_unbind(void *ptr)
 {
-  curl_mime *mime = (curl_mime *) ptr;
+  curl_mime *mime = (curl_mime *)ptr;
 
   if(mime && mime->parent) {
-    mime->parent->freefunc = NULL;  /* Be sure we won't be called again. */
+    mime->parent->freefunc = NULL;  /* Be sure we will not be called again. */
     cleanup_part_content(mime->parent);  /* Avoid dangling pointer in part. */
     mime->parent = NULL;
   }
 }
 
-
 void Curl_mime_cleanpart(curl_mimepart *part)
 {
   if(part) {
@@ -1172,9 +1093,9 @@ void Curl_mime_cleanpart(curl_mimepart *part)
     curl_slist_free_all(part->curlheaders);
     if(part->flags & MIME_USERHEADERS_OWNER)
       curl_slist_free_all(part->userheaders);
-    Curl_safefree(part->mimetype);
-    Curl_safefree(part->name);
-    Curl_safefree(part->filename);
+    curlx_safefree(part->mimetype);
+    curlx_safefree(part->name);
+    curlx_safefree(part->filename);
     Curl_mime_initpart(part);
   }
 }
@@ -1185,14 +1106,14 @@ void curl_mime_free(curl_mime *mime)
   curl_mimepart *part;
 
   if(mime) {
-    mime_subparts_unbind(mime);  /* Be sure it's not referenced anymore. */
+    mime_subparts_unbind(mime);  /* Be sure it is not referenced anymore. */
     while(mime->firstpart) {
       part = mime->firstpart;
       mime->firstpart = part->nextpart;
       Curl_mime_cleanpart(part);
-      free(part);
+      curlx_free(part);
     }
-    free(mime);
+    curlx_free(mime);
   }
 }
 
@@ -1202,7 +1123,7 @@ CURLcode Curl_mime_duppart(struct Curl_easy *data,
   curl_mime *mime;
   curl_mimepart *d;
   const curl_mimepart *s;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   DEBUGASSERT(dst);
 
@@ -1211,65 +1132,67 @@ CURLcode Curl_mime_duppart(struct Curl_easy *data,
   case MIMEKIND_NONE:
     break;
   case MIMEKIND_DATA:
-    res = curl_mime_data(dst, src->data, (size_t) src->datasize);
+    result = curl_mime_data(dst, src->data, (size_t)src->datasize);
     break;
   case MIMEKIND_FILE:
-    res = curl_mime_filedata(dst, src->data);
+    result = curl_mime_filedata(dst, src->data);
     /* Do not abort duplication if file is not readable. */
-    if(res == CURLE_READ_ERROR)
-      res = CURLE_OK;
+    if(result == CURLE_READ_ERROR)
+      result = CURLE_OK;
     break;
   case MIMEKIND_CALLBACK:
-    res = curl_mime_data_cb(dst, src->datasize, src->readfunc,
-                            src->seekfunc, src->freefunc, src->arg);
+    result = curl_mime_data_cb(dst, src->datasize, src->readfunc,
+                               src->seekfunc, src->freefunc, src->arg);
     break;
   case MIMEKIND_MULTIPART:
     /* No one knows about the cloned subparts, thus always attach ownership
        to the part. */
     mime = curl_mime_init(data);
-    res = mime? curl_mime_subparts(dst, mime): CURLE_OUT_OF_MEMORY;
+    result = mime ? curl_mime_subparts(dst, mime) : CURLE_OUT_OF_MEMORY;
 
     /* Duplicate subparts. */
-    for(s = ((curl_mime *) src->arg)->firstpart; !res && s; s = s->nextpart) {
+    for(s = ((curl_mime *)src->arg)->firstpart; !result && s;
+        s = s->nextpart) {
       d = curl_mime_addpart(mime);
-      res = d? Curl_mime_duppart(data, d, s): CURLE_OUT_OF_MEMORY;
+      result = d ? Curl_mime_duppart(data, d, s) : CURLE_OUT_OF_MEMORY;
     }
     break;
   default:  /* Invalid kind: should not occur. */
-    res = CURLE_BAD_FUNCTION_ARGUMENT;  /* Internal error? */
+    DEBUGF(infof(data, "invalid MIMEKIND* attempt"));
+    result = CURLE_BAD_FUNCTION_ARGUMENT;  /* Internal error? */
     break;
   }
 
   /* Duplicate headers. */
-  if(!res && src->userheaders) {
+  if(!result && src->userheaders) {
     struct curl_slist *hdrs = Curl_slist_duplicate(src->userheaders);
 
     if(!hdrs)
-      res = CURLE_OUT_OF_MEMORY;
+      result = CURLE_OUT_OF_MEMORY;
     else {
       /* No one but this procedure knows about the new header list,
          so always take ownership. */
-      res = curl_mime_headers(dst, hdrs, TRUE);
-      if(res)
+      result = curl_mime_headers(dst, hdrs, TRUE);
+      if(result)
         curl_slist_free_all(hdrs);
     }
   }
 
-  if(!res) {
+  if(!result) {
     /* Duplicate other fields. */
     dst->encoder = src->encoder;
-    res = curl_mime_type(dst, src->mimetype);
+    result = curl_mime_type(dst, src->mimetype);
   }
-  if(!res)
-    res = curl_mime_name(dst, src->name);
-  if(!res)
-    res = curl_mime_filename(dst, src->filename);
+  if(!result)
+    result = curl_mime_name(dst, src->name);
+  if(!result)
+    result = curl_mime_filename(dst, src->filename);
 
   /* If an error occurred, rollback. */
-  if(res)
+  if(result)
     Curl_mime_cleanpart(dst);
 
-  return res;
+  return result;
 }
 
 /*
@@ -1277,11 +1200,9 @@ CURLcode Curl_mime_duppart(struct Curl_easy *data,
  */
 
 /* Create a mime handle. */
-curl_mime *curl_mime_init(struct Curl_easy *easy)
+curl_mime *curl_mime_init(void *easy)
 {
-  curl_mime *mime;
-
-  mime = (curl_mime *) malloc(sizeof(*mime));
+  curl_mime *mime = curlx_malloc(sizeof(*mime));
 
   if(mime) {
     mime->parent = NULL;
@@ -1289,11 +1210,11 @@ curl_mime *curl_mime_init(struct Curl_easy *easy)
     mime->lastpart = NULL;
 
     memset(mime->boundary, '-', MIME_BOUNDARY_DASHES);
-    if(Curl_rand_hex(easy,
-                     (unsigned char *) &mime->boundary[MIME_BOUNDARY_DASHES],
-                     MIME_RAND_BOUNDARY_CHARS + 1)) {
+    if(Curl_rand_alnum(easy,
+                       (unsigned char *)&mime->boundary[MIME_BOUNDARY_DASHES],
+                       MIME_RAND_BOUNDARY_CHARS + 1)) {
       /* failed to get random separator, bail out */
-      free(mime);
+      curlx_free(mime);
       return NULL;
     }
     mimesetstate(&mime->state, MIMESTATE_BEGIN, NULL);
@@ -1305,7 +1226,7 @@ curl_mime *curl_mime_init(struct Curl_easy *easy)
 /* Initialize a mime part. */
 void Curl_mime_initpart(curl_mimepart *part)
 {
-  memset((char *) part, 0, sizeof(*part));
+  memset(part, 0, sizeof(*part));
   part->lastreadstatus = 1; /* Successful read status. */
   mimesetstate(&part->state, MIMESTATE_BEGIN, NULL);
 }
@@ -1318,7 +1239,7 @@ curl_mimepart *curl_mime_addpart(curl_mime *mime)
   if(!mime)
     return NULL;
 
-  part = (curl_mimepart *) malloc(sizeof(*part));
+  part = curlx_malloc(sizeof(*part));
 
   if(part) {
     Curl_mime_initpart(part);
@@ -1341,10 +1262,10 @@ CURLcode curl_mime_name(curl_mimepart *part, const char *name)
   if(!part)
     return CURLE_BAD_FUNCTION_ARGUMENT;
 
-  Curl_safefree(part->name);
+  curlx_safefree(part->name);
 
   if(name) {
-    part->name = strdup(name);
+    part->name = curlx_strdup(name);
     if(!part->name)
       return CURLE_OUT_OF_MEMORY;
   }
@@ -1352,16 +1273,16 @@ CURLcode curl_mime_name(curl_mimepart *part, const char *name)
   return CURLE_OK;
 }
 
-/* Set mime part remote file name. */
+/* Set mime part remote filename. */
 CURLcode curl_mime_filename(curl_mimepart *part, const char *filename)
 {
   if(!part)
     return CURLE_BAD_FUNCTION_ARGUMENT;
 
-  Curl_safefree(part->filename);
+  curlx_safefree(part->filename);
 
   if(filename) {
-    part->filename = strdup(filename);
+    part->filename = curlx_strdup(filename);
     if(!part->filename)
       return CURLE_OUT_OF_MEMORY;
   }
@@ -1370,8 +1291,7 @@ CURLcode curl_mime_filename(curl_mimepart *part, const char *filename)
 }
 
 /* Set mime part content from memory data. */
-CURLcode curl_mime_data(curl_mimepart *part,
-                        const char *data, size_t datasize)
+CURLcode curl_mime_data(curl_mimepart *part, const char *data, size_t datasize)
 {
   if(!part)
     return CURLE_BAD_FUNCTION_ARGUMENT;
@@ -1382,16 +1302,11 @@ CURLcode curl_mime_data(curl_mimepart *part,
     if(datasize == CURL_ZERO_TERMINATED)
       datasize = strlen(data);
 
-    part->data = malloc(datasize + 1);
+    part->data = curlx_memdup0(data, datasize);
     if(!part->data)
       return CURLE_OUT_OF_MEMORY;
 
     part->datasize = datasize;
-
-    if(datasize)
-      memcpy(part->data, data, datasize);
-    part->data[datasize] = '\0';    /* Set a null terminator as sentinel. */
-
     part->readfunc = mime_mem_read;
     part->seekfunc = mime_mem_seek;
     part->freefunc = mime_mem_free;
@@ -1414,38 +1329,37 @@ CURLcode curl_mime_filedata(curl_mimepart *part, const char *filename)
 
   if(filename) {
     char *base;
-    struct_stat sbuf;
+    curlx_struct_stat sbuf;
 
-    if(stat(filename, &sbuf) || access(filename, R_OK))
+    if(curlx_stat(filename, &sbuf))
       result = CURLE_READ_ERROR;
-
-    part->data = strdup(filename);
-    if(!part->data)
-      result = CURLE_OUT_OF_MEMORY;
-
-    part->datasize = -1;
-    if(!result && S_ISREG(sbuf.st_mode)) {
-      part->datasize = filesize(filename, sbuf);
-      part->seekfunc = mime_file_seek;
-    }
-
-    part->readfunc = mime_file_read;
-    part->freefunc = mime_file_free;
-    part->kind = MIMEKIND_FILE;
-
-    /* As a side effect, set the filename to the current file's base name.
-       It is possible to withdraw this by explicitly calling
-       curl_mime_filename() with a NULL filename argument after the current
-       call. */
-    base = strippath(filename);
-    if(!base)
-      result = CURLE_OUT_OF_MEMORY;
     else {
-      CURLcode res = curl_mime_filename(part, base);
+      part->data = curlx_strdup(filename);
+      if(!part->data)
+        result = CURLE_OUT_OF_MEMORY;
+      else {
+        part->datasize = -1;
+        if(S_ISREG(sbuf.st_mode)) {
+          part->datasize = filesize(filename, sbuf);
+          part->seekfunc = mime_file_seek;
+        }
 
-      if(res)
-        result = res;
-      free(base);
+        part->readfunc = mime_file_read;
+        part->freefunc = mime_file_free;
+        part->kind = MIMEKIND_FILE;
+
+        /* As a side effect, set the filename to the current file's base name.
+           It is possible to withdraw this by explicitly calling
+           curl_mime_filename() with a NULL filename argument after the current
+           call. */
+        base = strippath(filename);
+        if(!base)
+          result = CURLE_OUT_OF_MEMORY;
+        else {
+          result = curl_mime_filename(part, base);
+          curlx_free(base);
+        }
+      }
     }
   }
   return result;
@@ -1457,10 +1371,10 @@ CURLcode curl_mime_type(curl_mimepart *part, const char *mimetype)
   if(!part)
     return CURLE_BAD_FUNCTION_ARGUMENT;
 
-  Curl_safefree(part->mimetype);
+  curlx_safefree(part->mimetype);
 
   if(mimetype) {
-    part->mimetype = strdup(mimetype);
+    part->mimetype = curlx_strdup(mimetype);
     if(!part->mimetype)
       return CURLE_OUT_OF_MEMORY;
   }
@@ -1468,6 +1382,15 @@ CURLcode curl_mime_type(curl_mimepart *part, const char *mimetype)
   return CURLE_OK;
 }
 
+static const struct mime_encoder encoders[] = {
+  { "binary", encoder_nop_read, encoder_nop_size },
+  { "8bit", encoder_nop_read, encoder_nop_size },
+  { "7bit", encoder_7bit_read, encoder_nop_size },
+  { "base64", encoder_base64_read, encoder_base64_size },
+  { "quoted-printable", encoder_qp_read, encoder_qp_size },
+  { ZERO_NULL, ZERO_NULL, ZERO_NULL }
+};
+
 /* Set mime data transfer encoder. */
 CURLcode curl_mime_encoder(curl_mimepart *part, const char *encoding)
 {
@@ -1483,7 +1406,7 @@ CURLcode curl_mime_encoder(curl_mimepart *part, const char *encoding)
     return CURLE_OK;    /* Removing current encoder. */
 
   for(mep = encoders; mep->name; mep++)
-    if(strcasecompare(encoding, mep->name)) {
+    if(curl_strequal(encoding, mep->name)) {
       part->encoder = mep;
       result = CURLE_OK;
     }
@@ -1501,7 +1424,7 @@ CURLcode curl_mime_headers(curl_mimepart *part,
   if(part->flags & MIME_USERHEADERS_OWNER) {
     if(part->userheaders != headers)  /* Allow setting twice the same list. */
       curl_slist_free_all(part->userheaders);
-    part->flags &= ~MIME_USERHEADERS_OWNER;
+    part->flags &= ~(unsigned int)MIME_USERHEADERS_OWNER;
   }
   part->userheaders = headers;
   if(headers && take_ownership)
@@ -1558,15 +1481,24 @@ CURLcode Curl_mime_set_subparts(curl_mimepart *part,
       while(root->parent && root->parent->parent)
         root = root->parent->parent;
       if(subparts == root) {
-        /* Can't add as a subpart of itself. */
+        /* cannot add as a subpart of itself. */
         return CURLE_BAD_FUNCTION_ARGUMENT;
       }
     }
 
+    /* If subparts have already been used as a top-level MIMEPOST,
+       they might not be positioned at start. Rewind them now, as
+       a future check while rewinding the parent may cause this
+       content to be skipped. */
+    if(mime_subparts_seek(subparts, (curl_off_t)0, SEEK_SET) !=
+       CURL_SEEKFUNC_OK)
+      return CURLE_SEND_FAIL_REWIND;
+
     subparts->parent = part;
     /* Subparts are processed internally: no read callback. */
     part->seekfunc = mime_subparts_seek;
-    part->freefunc = take_ownership? mime_subparts_free: mime_subparts_unbind;
+    part->freefunc = take_ownership ? mime_subparts_free :
+      mime_subparts_unbind;
     part->arg = subparts;
     part->datasize = -1;
     part->kind = MIMEKIND_MULTIPART;
@@ -1580,20 +1512,21 @@ CURLcode curl_mime_subparts(curl_mimepart *part, curl_mime *subparts)
   return Curl_mime_set_subparts(part, subparts, TRUE);
 }
 
-
 /* Readback from top mime. */
 /* Argument is the dummy top part. */
 size_t Curl_mime_read(char *buffer, size_t size, size_t nitems, void *instream)
 {
-  curl_mimepart *part = (curl_mimepart *) instream;
+  curl_mimepart *part = (curl_mimepart *)instream;
   size_t ret;
   bool hasread;
 
-  (void) size;   /* Always 1. */
+  (void)size;  /* Always 1 */
 
+  /* If `nitems` is <= 4, some encoders will return STOP_FILLING without
+   * adding any data and this loops infinitely. */
   do {
     hasread = FALSE;
-    ret = readback_part(part, buffer, nitems, &hasread);
+    ret = readback_part(part, buffer, nitems, &hasread, 0);
     /*
      * If this is not possible to get some data without calling more than
      * one read callback (probably because a content encoder is not able to
@@ -1606,10 +1539,10 @@ size_t Curl_mime_read(char *buffer, size_t size, size_t nitems, void *instream)
 }
 
 /* Rewind mime stream. */
-CURLcode Curl_mime_rewind(curl_mimepart *part)
+static CURLcode mime_rewind(curl_mimepart *part)
 {
-  return mime_part_rewind(part) == CURL_SEEKFUNC_OK?
-         CURLE_OK: CURLE_SEND_FAIL_REWIND;
+  return mime_part_rewind(part) == CURL_SEEKFUNC_OK ?
+         CURLE_OK : CURLE_SEND_FAIL_REWIND;
 }
 
 /* Compute header list size. */
@@ -1638,7 +1571,7 @@ static curl_off_t multipart_size(curl_mime *mime)
   size = boundarysize;  /* Final boundary - CRLF after headers. */
 
   for(part = mime->firstpart; part; part = part->nextpart) {
-    curl_off_t sz = Curl_mime_size(part);
+    curl_off_t sz = mime_size(part);
 
     if(sz < 0)
       size = sz;
@@ -1651,7 +1584,7 @@ static curl_off_t multipart_size(curl_mime *mime)
 }
 
 /* Get/compute mime size. */
-curl_off_t Curl_mime_size(curl_mimepart *part)
+static curl_off_t mime_size(curl_mimepart *part)
 {
   curl_off_t size;
 
@@ -1689,10 +1622,10 @@ CURLcode Curl_mime_add_header(struct curl_slist **slp, const char *fmt, ...)
     if(hdr)
       *slp = hdr;
     else
-      free(s);
+      curlx_free(s);
   }
 
-  return hdr? CURLE_OK: CURLE_OUT_OF_MEMORY;
+  return hdr ? CURLE_OK : CURLE_OUT_OF_MEMORY;
 }
 
 /* Add a content type header. */
@@ -1700,8 +1633,8 @@ static CURLcode add_content_type(struct curl_slist **slp,
                                  const char *type, const char *boundary)
 {
   return Curl_mime_add_header(slp, "Content-Type: %s%s%s", type,
-                              boundary? "; boundary=": "",
-                              boundary? boundary: "");
+                              boundary ? "; boundary=" : "",
+                              boundary ? boundary : "");
 }
 
 const char *Curl_mime_contenttype(const char *filename)
@@ -1715,16 +1648,16 @@ const char *Curl_mime_contenttype(const char *filename)
     const char *type;
   };
   static const struct ContentType ctts[] = {
-    {".gif",  "image/gif"},
-    {".jpg",  "image/jpeg"},
-    {".jpeg", "image/jpeg"},
-    {".png",  "image/png"},
-    {".svg",  "image/svg+xml"},
-    {".txt",  "text/plain"},
-    {".htm",  "text/html"},
-    {".html", "text/html"},
-    {".pdf",  "application/pdf"},
-    {".xml",  "application/xml"}
+    { ".gif",  "image/gif" },
+    { ".jpg",  "image/jpeg" },
+    { ".jpeg", "image/jpeg" },
+    { ".png",  "image/png" },
+    { ".svg",  "image/svg+xml" },
+    { ".txt",  "text/plain" },
+    { ".htm",  "text/html" },
+    { ".html", "text/html" },
+    { ".pdf",  "application/pdf" },
+    { ".xml",  "application/xml" }
   };
 
   if(filename) {
@@ -1732,10 +1665,10 @@ const char *Curl_mime_contenttype(const char *filename)
     const char *nameend = filename + len1;
     unsigned int i;
 
-    for(i = 0; i < sizeof(ctts) / sizeof(ctts[0]); i++) {
+    for(i = 0; i < CURL_ARRAYSIZE(ctts); i++) {
       size_t len2 = strlen(ctts[i].extension);
 
-      if(len1 >= len2 && strcasecompare(nameend - len2, ctts[i].extension))
+      if(len1 >= len2 && curl_strequal(nameend - len2, ctts[i].extension))
         return ctts[i].type;
     }
   }
@@ -1745,7 +1678,7 @@ const char *Curl_mime_contenttype(const char *filename)
 static bool content_type_match(const char *contenttype,
                                const char *target, size_t len)
 {
-  if(contenttype && strncasecompare(contenttype, target, len))
+  if(contenttype && curl_strnequal(contenttype, target, len))
     switch(contenttype[len]) {
     case '\0':
     case '\t':
@@ -1758,6 +1691,52 @@ static bool content_type_match(const char *contenttype,
   return FALSE;
 }
 
+static CURLcode add_content_disposition(struct Curl_easy *data,
+                                        curl_mimepart *part,
+                                        const char *disposition,
+                                        const char *contenttype,
+                                        enum mimestrategy strategy)
+{
+  if(!disposition)
+    if(part->filename || part->name ||
+       (contenttype && !curl_strnequal(contenttype, "multipart/", 10)))
+      disposition = DISPOSITION_DEFAULT;
+  if(disposition && curl_strequal(disposition, "attachment") &&
+     !part->name && !part->filename)
+    disposition = NULL;
+  if(disposition) {
+    CURLcode result = CURLE_OK;
+    char *name = NULL;
+    char *filename = NULL;
+
+    if(part->name) {
+      name = escape_string(data, part->name, strategy);
+      if(!name)
+        return CURLE_OUT_OF_MEMORY;
+    }
+    if(part->filename) {
+      filename = escape_string(data, part->filename, strategy);
+      if(!filename)
+        result = CURLE_OUT_OF_MEMORY;
+    }
+    if(!result)
+      result = Curl_mime_add_header(&part->curlheaders,
+                                    "Content-Disposition: %s%s%s%s%s%s%s",
+                                    disposition,
+                                    name ? "; name=\"" : "",
+                                    name ? name : "",
+                                    name ? "\"" : "",
+                                    filename ? "; filename=\"" : "",
+                                    filename ? filename : "",
+                                    filename ? "\"" : "");
+    curlx_safefree(name);
+    curlx_safefree(filename);
+    if(result)
+      return result;
+  }
+  return CURLE_OK;
+}
+
 CURLcode Curl_mime_prepare_headers(struct Curl_easy *data,
                                    curl_mimepart *part,
                                    const char *contenttype,
@@ -1768,13 +1747,13 @@ CURLcode Curl_mime_prepare_headers(struct Curl_easy *data,
   const char *boundary = NULL;
   char *customct;
   const char *cte = NULL;
-  CURLcode ret = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   /* Get rid of previously prepared headers. */
   curl_slist_free_all(part->curlheaders);
   part->curlheaders = NULL;
 
-  /* Be sure we won't access old headers later. */
+  /* Be sure we will not access old headers later. */
   if(part->state.state == MIMESTATE_CURLHEADERS)
     mimesetstate(&part->state, MIMESTATE_CURLHEADERS, NULL);
 
@@ -1805,7 +1784,7 @@ CURLcode Curl_mime_prepare_headers(struct Curl_easy *data,
   }
 
   if(part->kind == MIMEKIND_MULTIPART) {
-    mime = (curl_mime *) part->arg;
+    mime = (curl_mime *)part->arg;
     if(mime)
       boundary = mime->boundary;
   }
@@ -1816,49 +1795,17 @@ CURLcode Curl_mime_prepare_headers(struct Curl_easy *data,
 
   /* Issue content-disposition header only if not already set by caller. */
   if(!search_header(part->userheaders, STRCONST("Content-Disposition"))) {
-    if(!disposition)
-      if(part->filename || part->name ||
-        (contenttype && !strncasecompare(contenttype, "multipart/", 10)))
-          disposition = DISPOSITION_DEFAULT;
-    if(disposition && curl_strequal(disposition, "attachment") &&
-     !part->name && !part->filename)
-      disposition = NULL;
-    if(disposition) {
-      char *name = NULL;
-      char *filename = NULL;
-
-      if(part->name) {
-        name = escape_string(data, part->name, strategy);
-        if(!name)
-          ret = CURLE_OUT_OF_MEMORY;
-      }
-      if(!ret && part->filename) {
-        filename = escape_string(data, part->filename, strategy);
-        if(!filename)
-          ret = CURLE_OUT_OF_MEMORY;
-      }
-      if(!ret)
-        ret = Curl_mime_add_header(&part->curlheaders,
-                                   "Content-Disposition: %s%s%s%s%s%s%s",
-                                   disposition,
-                                   name? "; name=\"": "",
-                                   name? name: "",
-                                   name? "\"": "",
-                                   filename? "; filename=\"": "",
-                                   filename? filename: "",
-                                   filename? "\"": "");
-      Curl_safefree(name);
-      Curl_safefree(filename);
-      if(ret)
-        return ret;
-      }
-    }
+    result = add_content_disposition(data, part, disposition,
+                                     contenttype, strategy);
+    if(result)
+      return result;
+  }
 
   /* Issue Content-Type header. */
   if(contenttype) {
-    ret = add_content_type(&part->curlheaders, contenttype, boundary);
-    if(ret)
-      return ret;
+    result = add_content_type(&part->curlheaders, contenttype, boundary);
+    if(result)
+      return result;
   }
 
   /* Content-Transfer-Encoding header. */
@@ -1867,13 +1814,13 @@ CURLcode Curl_mime_prepare_headers(struct Curl_easy *data,
     if(part->encoder)
       cte = part->encoder->name;
     else if(contenttype && strategy == MIMESTRATEGY_MAIL &&
-     part->kind != MIMEKIND_MULTIPART)
+            part->kind != MIMEKIND_MULTIPART)
       cte = "8bit";
     if(cte) {
-      ret = Curl_mime_add_header(&part->curlheaders,
-                                 "Content-Transfer-Encoding: %s", cte);
-      if(ret)
-        return ret;
+      result = Curl_mime_add_header(&part->curlheaders,
+                                    "Content-Transfer-Encoding: %s", cte);
+      if(result)
+        return result;
     }
   }
 
@@ -1890,129 +1837,419 @@ CURLcode Curl_mime_prepare_headers(struct Curl_easy *data,
     if(content_type_match(contenttype, STRCONST("multipart/form-data")))
       disposition = "form-data";
     for(subpart = mime->firstpart; subpart; subpart = subpart->nextpart) {
-      ret = Curl_mime_prepare_headers(data, subpart, NULL,
-                                      disposition, strategy);
-      if(ret)
-        return ret;
+      result = Curl_mime_prepare_headers(data, subpart, NULL,
+                                         disposition, strategy);
+      if(result)
+        return result;
     }
   }
-  return ret;
+  return result;
 }
 
 /* Recursively reset paused status in the given part. */
-void Curl_mime_unpause(curl_mimepart *part)
+static void mime_unpause(curl_mimepart *part)
 {
   if(part) {
     if(part->lastreadstatus == CURL_READFUNC_PAUSE)
       part->lastreadstatus = 1; /* Successful read status. */
     if(part->kind == MIMEKIND_MULTIPART) {
-      curl_mime *mime = (curl_mime *) part->arg;
+      curl_mime *mime = (curl_mime *)part->arg;
 
       if(mime) {
         curl_mimepart *subpart;
 
         for(subpart = mime->firstpart; subpart; subpart = subpart->nextpart)
-          Curl_mime_unpause(subpart);
+          mime_unpause(subpart);
       }
     }
   }
 }
 
+struct cr_mime_ctx {
+  struct Curl_creader super;
+  curl_mimepart *part;
+  curl_off_t total_len;
+  curl_off_t read_len;
+  CURLcode error_result;
+  struct bufq tmpbuf;
+  BIT(seen_eos);
+  BIT(errored);
+};
+
+static CURLcode cr_mime_init(struct Curl_easy *data,
+                             struct Curl_creader *reader)
+{
+  struct cr_mime_ctx *ctx = reader->ctx;
+  (void)data;
+  ctx->total_len = -1;
+  ctx->read_len = 0;
+  Curl_bufq_init2(&ctx->tmpbuf, 1024, 1, BUFQ_OPT_NO_SPARES);
+  return CURLE_OK;
+}
+
+static void cr_mime_close(struct Curl_easy *data,
+                          struct Curl_creader *reader)
+{
+  struct cr_mime_ctx *ctx = reader->ctx;
+  (void)data;
+  Curl_bufq_free(&ctx->tmpbuf);
+}
+
+/* Real client reader to installed client callbacks. */
+static CURLcode cr_mime_read(struct Curl_easy *data,
+                             struct Curl_creader *reader,
+                             char *buf, size_t blen,
+                             size_t *pnread, bool *peos)
+{
+  struct cr_mime_ctx *ctx = reader->ctx;
+  CURLcode result = CURLE_OK;
+  size_t nread;
+  char tmp[256];
+
+  /* Once we have errored, we will return the same error forever */
+  if(ctx->errored) {
+    CURL_TRC_READ(data, "cr_mime_read(len=%zu) is errored -> %d, eos=0",
+                  blen, (int)ctx->error_result);
+    *pnread = 0;
+    *peos = FALSE;
+    return ctx->error_result;
+  }
+  if(ctx->seen_eos) {
+    CURL_TRC_READ(data, "cr_mime_read(len=%zu) seen eos -> 0, eos=1", blen);
+    *pnread = 0;
+    *peos = TRUE;
+    return CURLE_OK;
+  }
+  /* respect length limitations */
+  if(ctx->total_len >= 0) {
+    curl_off_t remain = ctx->total_len - ctx->read_len;
+    if(remain <= 0)
+      blen = 0;
+    else if(remain < (curl_off_t)blen)
+      blen = (size_t)remain;
+  }
+
+  if(!Curl_bufq_is_empty(&ctx->tmpbuf)) {
+    result = Curl_bufq_read(&ctx->tmpbuf, (unsigned char *)buf, blen, &nread);
+    if(result) {
+      ctx->errored = TRUE;
+      ctx->error_result = result;
+      return result;
+    }
+  }
+  else if(blen <= 4) {
+    /* Curl_mime_read() may go into an infinite loop when reading
+     * via a base64 encoder, as it stalls when the read buffer is too small
+     * to contain a complete 3-byte encoding. Read into a larger buffer
+     * and use that until empty. */
+    CURL_TRC_READ(data, "cr_mime_read(len=%zu), small read, using tmp", blen);
+    nread = Curl_mime_read(tmp, 1, sizeof(tmp), ctx->part);
+    if(nread <= sizeof(tmp)) {
+      size_t n;
+      result = Curl_bufq_write(&ctx->tmpbuf, (unsigned char *)tmp, nread, &n);
+      if(result) {
+        ctx->errored = TRUE;
+        ctx->error_result = result;
+        return result;
+      }
+      /* stored it, read again */
+      result = Curl_bufq_cread(&ctx->tmpbuf, buf, blen, &nread);
+      if(result) {
+        ctx->errored = TRUE;
+        ctx->error_result = result;
+        return result;
+      }
+    }
+  }
+  else
+    nread = Curl_mime_read(buf, 1, blen, ctx->part);
+
+  CURL_TRC_READ(data, "cr_mime_read(len=%zu), mime_read() -> %zu",
+                blen, nread);
+
+  switch(nread) {
+  case 0:
+    if((ctx->total_len >= 0) && (ctx->read_len < ctx->total_len)) {
+      failf(data, "client mime read EOF fail, "
+            "only %" FMT_OFF_T "/%" FMT_OFF_T
+            " of needed bytes read", ctx->read_len, ctx->total_len);
+      return CURLE_READ_ERROR;
+    }
+    *pnread = 0;
+    *peos = TRUE;
+    ctx->seen_eos = TRUE;
+    break;
+
+  case CURL_READFUNC_ABORT:
+    failf(data, "operation aborted by callback");
+    *pnread = 0;
+    *peos = FALSE;
+    ctx->errored = TRUE;
+    ctx->error_result = CURLE_ABORTED_BY_CALLBACK;
+    result = CURLE_ABORTED_BY_CALLBACK;
+    break;
+
+  case CURL_READFUNC_PAUSE:
+    /* CURL_READFUNC_PAUSE pauses read callbacks that feed socket writes */
+    CURL_TRC_READ(data, "cr_mime_read(len=%zu), paused by callback", blen);
+    *pnread = 0;
+    *peos = FALSE;
+    result = Curl_xfer_pause_send(data, TRUE);
+    break; /* nothing was read */
+
+  case STOP_FILLING:
+  case READ_ERROR:
+    failf(data, "read error getting mime data");
+    *pnread = 0;
+    *peos = FALSE;
+    ctx->errored = TRUE;
+    ctx->error_result = CURLE_READ_ERROR;
+    result = CURLE_READ_ERROR;
+    break;
+
+  default:
+    if(nread > blen) {
+      /* the read function returned a too large value */
+      failf(data, "read function returned funny value");
+      *pnread = 0;
+      *peos = FALSE;
+      ctx->errored = TRUE;
+      ctx->error_result = CURLE_READ_ERROR;
+      return CURLE_READ_ERROR;
+    }
+    ctx->read_len += nread;
+    if(ctx->total_len >= 0)
+      ctx->seen_eos = (ctx->read_len >= ctx->total_len);
+    *pnread = nread;
+    *peos = (bool)ctx->seen_eos;
+    break;
+  }
+
+  CURL_TRC_READ(data, "cr_mime_read(len=%zu, total=%" FMT_OFF_T
+                ", read=%" FMT_OFF_T ") -> %d, %zu, %d", blen,
+                ctx->total_len, ctx->read_len, (int)result, *pnread, *peos);
+  return result;
+}
+
+static bool cr_mime_needs_rewind(struct Curl_easy *data,
+                                 struct Curl_creader *reader)
+{
+  struct cr_mime_ctx *ctx = reader->ctx;
+  (void)data;
+  return ctx->read_len > 0;
+}
+
+static curl_off_t cr_mime_total_length(struct Curl_easy *data,
+                                       struct Curl_creader *reader)
+{
+  struct cr_mime_ctx *ctx = reader->ctx;
+  (void)data;
+  return ctx->total_len;
+}
+
+static CURLcode cr_mime_resume_from(struct Curl_easy *data,
+                                    struct Curl_creader *reader,
+                                    curl_off_t offset)
+{
+  struct cr_mime_ctx *ctx = reader->ctx;
+
+  if(offset > 0) {
+    curl_off_t passed = 0;
+
+    do {
+      char scratch[4 * 1024];
+      size_t readthisamountnow =
+        (offset - passed > (curl_off_t)sizeof(scratch)) ?
+        sizeof(scratch) :
+        curlx_sotouz(offset - passed);
+      size_t nread;
+
+      nread = Curl_mime_read(scratch, 1, readthisamountnow, ctx->part);
+      passed += (curl_off_t)nread;
+      if((nread == 0) || (nread > readthisamountnow)) {
+        /* this checks for greater-than only to make sure that the
+           CURL_READFUNC_ABORT return code still aborts */
+        failf(data, "Could only read %" FMT_OFF_T
+              " bytes from the mime post", passed);
+        return CURLE_READ_ERROR;
+      }
+    } while(passed < offset);
+
+    /* now, decrease the size of the read */
+    if(ctx->total_len > 0) {
+      ctx->total_len -= offset;
+
+      if(ctx->total_len <= 0) {
+        failf(data, "Mime post already completely uploaded");
+        return CURLE_PARTIAL_FILE;
+      }
+    }
+    /* we have passed, proceed as normal */
+  }
+  return CURLE_OK;
+}
+
+static CURLcode cr_mime_cntrl(struct Curl_easy *data,
+                              struct Curl_creader *reader,
+                              Curl_creader_cntrl opcode)
+{
+  struct cr_mime_ctx *ctx = reader->ctx;
+  switch(opcode) {
+  case CURL_CRCNTRL_REWIND: {
+    CURLcode result = mime_rewind(ctx->part);
+    if(result)
+      failf(data, "Cannot rewind mime/post data");
+    return result;
+  }
+  case CURL_CRCNTRL_UNPAUSE:
+    mime_unpause(ctx->part);
+    break;
+  case CURL_CRCNTRL_CLEAR_EOS:
+    ctx->seen_eos = FALSE;
+    break;
+  default:
+    break;
+  }
+  return CURLE_OK;
+}
+
+static bool cr_mime_is_paused(struct Curl_easy *data,
+                              struct Curl_creader *reader)
+{
+  struct cr_mime_ctx *ctx = reader->ctx;
+  (void)data;
+  return ctx->part && ctx->part->lastreadstatus == CURL_READFUNC_PAUSE;
+}
+
+static const struct Curl_crtype cr_mime = {
+  "cr-mime",
+  cr_mime_init,
+  cr_mime_read,
+  cr_mime_close,
+  cr_mime_needs_rewind,
+  cr_mime_total_length,
+  cr_mime_resume_from,
+  cr_mime_cntrl,
+  cr_mime_is_paused,
+  Curl_creader_def_done,
+  sizeof(struct cr_mime_ctx)
+};
+
+CURLcode Curl_creader_set_mime(struct Curl_easy *data, curl_mimepart *part)
+{
+  struct Curl_creader *r;
+  struct cr_mime_ctx *ctx;
+  CURLcode result;
+
+  result = Curl_creader_create(&r, data, &cr_mime, CURL_CR_CLIENT);
+  if(result)
+    return result;
+  ctx = r->ctx;
+  ctx->part = part;
+  /* Make sure we will read the entire mime structure. */
+  result = mime_rewind(ctx->part);
+  if(result) {
+    Curl_creader_free(data, r);
+    return result;
+  }
+  ctx->total_len = mime_size(ctx->part);
+
+  return Curl_creader_set(data, r);
+}
 
 #else /* !CURL_DISABLE_MIME && (!CURL_DISABLE_HTTP ||
-                                !CURL_DISABLE_SMTP || !CURL_DISABLE_IMAP) */
+                                !CURL_DISABLE_SMTP ||
+                                !CURL_DISABLE_IMAP) */
 
 /* Mime not compiled in: define stubs for externally-referenced functions. */
 curl_mime *curl_mime_init(CURL *easy)
 {
-  (void) easy;
+  (void)easy;
   return NULL;
 }
 
 void curl_mime_free(curl_mime *mime)
 {
-  (void) mime;
+  (void)mime;
 }
 
 curl_mimepart *curl_mime_addpart(curl_mime *mime)
 {
-  (void) mime;
+  (void)mime;
   return NULL;
 }
 
 CURLcode curl_mime_name(curl_mimepart *part, const char *name)
 {
-  (void) part;
-  (void) name;
+  (void)part;
+  (void)name;
   return CURLE_NOT_BUILT_IN;
 }
 
 CURLcode curl_mime_filename(curl_mimepart *part, const char *filename)
 {
-  (void) part;
-  (void) filename;
+  (void)part;
+  (void)filename;
   return CURLE_NOT_BUILT_IN;
 }
 
 CURLcode curl_mime_type(curl_mimepart *part, const char *mimetype)
 {
-  (void) part;
-  (void) mimetype;
+  (void)part;
+  (void)mimetype;
   return CURLE_NOT_BUILT_IN;
 }
 
 CURLcode curl_mime_encoder(curl_mimepart *part, const char *encoding)
 {
-  (void) part;
-  (void) encoding;
+  (void)part;
+  (void)encoding;
   return CURLE_NOT_BUILT_IN;
 }
 
-CURLcode curl_mime_data(curl_mimepart *part,
-                        const char *data, size_t datasize)
+CURLcode curl_mime_data(curl_mimepart *part, const char *data, size_t datasize)
 {
-  (void) part;
-  (void) data;
-  (void) datasize;
+  (void)part;
+  (void)data;
+  (void)datasize;
   return CURLE_NOT_BUILT_IN;
 }
 
 CURLcode curl_mime_filedata(curl_mimepart *part, const char *filename)
 {
-  (void) part;
-  (void) filename;
+  (void)part;
+  (void)filename;
   return CURLE_NOT_BUILT_IN;
 }
 
-CURLcode curl_mime_data_cb(curl_mimepart *part,
-                           curl_off_t datasize,
+CURLcode curl_mime_data_cb(curl_mimepart *part, curl_off_t datasize,
                            curl_read_callback readfunc,
                            curl_seek_callback seekfunc,
                            curl_free_callback freefunc,
                            void *arg)
 {
-  (void) part;
-  (void) datasize;
-  (void) readfunc;
-  (void) seekfunc;
-  (void) freefunc;
-  (void) arg;
+  (void)part;
+  (void)datasize;
+  (void)readfunc;
+  (void)seekfunc;
+  (void)freefunc;
+  (void)arg;
   return CURLE_NOT_BUILT_IN;
 }
 
 CURLcode curl_mime_subparts(curl_mimepart *part, curl_mime *subparts)
 {
-  (void) part;
-  (void) subparts;
+  (void)part;
+  (void)subparts;
   return CURLE_NOT_BUILT_IN;
 }
 
 CURLcode curl_mime_headers(curl_mimepart *part,
                            struct curl_slist *headers, int take_ownership)
 {
-  (void) part;
-  (void) headers;
-  (void) take_ownership;
+  (void)part;
+  (void)headers;
+  (void)take_ownership;
   return CURLE_NOT_BUILT_IN;
 }
 
diff --git a/third-party/curl/lib/mime.h b/third-party/curl/lib/mime.h
index 04adf2d247..e84f04051b 100644
--- a/third-party/curl/lib/mime.h
+++ b/third-party/curl/lib/mime.h
@@ -23,11 +23,10 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #define MIME_BOUNDARY_DASHES            24  /* leading boundary dashes */
-#define MIME_RAND_BOUNDARY_CHARS        16  /* Nb. of random boundary chars. */
+#define MIME_RAND_BOUNDARY_CHARS        22  /* Nb. of random boundary chars. */
 #define MAX_ENCODED_LINE_LENGTH         76  /* Maximum encoded line length. */
 #define ENCODING_BUFFER_SIZE            256 /* Encoding temp buffers size. */
 
@@ -112,7 +111,7 @@ struct curl_mimepart {
   curl_mimepart *nextpart;         /* Forward linked list. */
   enum mimekind kind;              /* The part kind. */
   unsigned int flags;              /* Flags. */
-  char *data;                      /* Memory data or file name. */
+  char *data;                      /* Memory data or filename. */
   curl_read_callback readfunc;     /* Read function. */
   curl_seek_callback seekfunc;     /* Seek function. */
   curl_free_callback freefunc;     /* Argument free function. */
@@ -121,7 +120,7 @@ struct curl_mimepart {
   struct curl_slist *curlheaders;  /* Part headers. */
   struct curl_slist *userheaders;  /* Part headers. */
   char *mimetype;                  /* Part mime type. */
-  char *filename;                  /* Remote file name. */
+  char *filename;                  /* Remote filename. */
   char *name;                      /* Data name. */
   curl_off_t datasize;             /* Expected data size. */
   struct mime_state state;         /* Current readback state. */
@@ -130,7 +129,8 @@ struct curl_mimepart {
   size_t lastreadstatus;           /* Last read callback returned status. */
 };
 
-CURLcode Curl_mime_add_header(struct curl_slist **slp, const char *fmt, ...);
+CURLcode Curl_mime_add_header(struct curl_slist **slp, const char *fmt, ...)
+  CURL_PRINTF(2, 3);
 
 #if !defined(CURL_DISABLE_MIME) && (!defined(CURL_DISABLE_HTTP) ||      \
                                     !defined(CURL_DISABLE_SMTP) ||      \
@@ -150,25 +150,24 @@ CURLcode Curl_mime_prepare_headers(struct Curl_easy *data,
                                    const char *contenttype,
                                    const char *disposition,
                                    enum mimestrategy strategy);
-curl_off_t Curl_mime_size(struct curl_mimepart *part);
 size_t Curl_mime_read(char *buffer, size_t size, size_t nitems,
                       void *instream);
-CURLcode Curl_mime_rewind(struct curl_mimepart *part);
 const char *Curl_mime_contenttype(const char *filename);
-void Curl_mime_unpause(struct curl_mimepart *part);
 
-#else
-/* if disabled */
+/**
+ * Install a client reader as upload source that reads the given
+ * mime part.
+ */
+CURLcode Curl_creader_set_mime(struct Curl_easy *data, curl_mimepart *part);
+
+#else /* if disabled */
 #define Curl_mime_initpart(x)
 #define Curl_mime_cleanpart(x)
-#define Curl_mime_duppart(x,y,z) CURLE_OK /* Nothing to duplicate. Succeed */
-#define Curl_mime_set_subparts(a,b,c) CURLE_NOT_BUILT_IN
-#define Curl_mime_prepare_headers(a,b,c,d,e) CURLE_NOT_BUILT_IN
-#define Curl_mime_size(x) (curl_off_t) -1
-#define Curl_mime_read NULL
-#define Curl_mime_rewind(x) ((void)x, CURLE_NOT_BUILT_IN)
-#define Curl_mime_unpause(x)
+#define Curl_mime_duppart(x, y, z) CURLE_OK /* Nothing to duplicate. Succeed */
+#define Curl_mime_set_subparts(a, b, c)          CURLE_NOT_BUILT_IN
+#define Curl_mime_prepare_headers(a, b, c, d, e) CURLE_NOT_BUILT_IN
+#define Curl_mime_read                           NULL
+#define Curl_creader_set_mime(x, y) ((void)(x), CURLE_NOT_BUILT_IN)
 #endif
 
-
 #endif /* HEADER_CURL_MIME_H */
diff --git a/third-party/curl/lib/mprintf.c b/third-party/curl/lib/mprintf.c
index af5d753d6a..230b554191 100644
--- a/third-party/curl/lib/mprintf.c
+++ b/third-party/curl/lib/mprintf.c
@@ -20,147 +20,104 @@
  *
  * SPDX-License-Identifier: curl
  *
- *
- * Purpose:
- *  A merge of Bjorn Reese's format() function and Daniel's dsprintf()
- *  1.0. A full blooded printf() clone with full support for <num>$
- *  everywhere (parameters, widths and precisions) including variabled
- *  sized parameters (like doubles, long longs, long doubles and even
- *  void * in 64-bit architectures).
- *
- * Current restrictions:
- * - Max 128 parameters
- * - No 'long double' support.
- *
- * If you ever want truly portable and good *printf() clones, the project that
- * took on from here is named 'Trio' and you find more details on the trio web
- * page at https://daniel.haxx.se/projects/trio/
- */
-
+ ***************************************************************************/
 #include "curl_setup.h"
-#include "dynbuf.h"
-#include <curl/mprintf.h>
 
-#include "curl_memory.h"
-/* The last #include file should be: */
-#include "memdebug.h"
-
-/*
- * If SIZEOF_SIZE_T has not been defined, default to the size of long.
- */
-
-#ifdef HAVE_LONGLONG
-#  define LONG_LONG_TYPE long long
-#  define HAVE_LONG_LONG_TYPE
-#else
-#  if defined(_MSC_VER) && (_MSC_VER >= 900) && (_INTEGRAL_MAX_BITS >= 64)
-#    define LONG_LONG_TYPE __int64
-#    define HAVE_LONG_LONG_TYPE
-#  else
-#    undef LONG_LONG_TYPE
-#    undef HAVE_LONG_LONG_TYPE
-#  endif
-#endif
-
-/*
- * Non-ANSI integer extensions
- */
-
-#if (defined(__BORLANDC__) && (__BORLANDC__ >= 0x520)) || \
-    (defined(__POCC__) && defined(_MSC_VER)) || \
-    (defined(_WIN32_WCE)) || \
-    (defined(__MINGW32__)) || \
-    (defined(_MSC_VER) && (_MSC_VER >= 900) && (_INTEGRAL_MAX_BITS >= 64))
-#  define MP_HAVE_INT_EXTENSIONS
-#endif
-
-/*
- * Max integer data types that mprintf.c is capable
- */
-
-#ifdef HAVE_LONG_LONG_TYPE
-#  define mp_intmax_t LONG_LONG_TYPE
-#  define mp_uintmax_t unsigned LONG_LONG_TYPE
-#else
-#  define mp_intmax_t long
-#  define mp_uintmax_t unsigned long
-#endif
+#include "curlx/dynbuf.h"
+#include "curl_printf.h"
+#include "curlx/strparse.h"
+#include "curlx/snprintf.h"  /* for curlx_win32_snprintf() */
 
 #define BUFFSIZE 326 /* buffer for long-to-str and float-to-str calcs, should
                         fit negative DBL_MAX (317 letters) */
-#define MAX_PARAMETERS 128 /* lame static limit */
+#define MAX_PARAMETERS 128 /* number of input arguments */
+#define MAX_SEGMENTS   128 /* number of output segments */
 
-#ifdef __AMIGA__
-# undef FORMAT_INT
-#endif
+/* Lower-case digits. */
+const unsigned char Curl_ldigits[] = "0123456789abcdef";
 
-/* Lower-case digits.  */
-static const char lower_digits[] = "0123456789abcdefghijklmnopqrstuvwxyz";
+/* Upper-case digits. */
+const unsigned char Curl_udigits[] = "0123456789ABCDEF";
 
-/* Upper-case digits.  */
-static const char upper_digits[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ";
-
-#define OUTCHAR(x)                                     \
-  do {                                                 \
-    if(stream((unsigned char)(x), (FILE *)data) != -1) \
-      done++;                                          \
-    else                                               \
-      return done; /* return immediately on failure */ \
+#define OUTCHAR(x)                        \
+  do {                                    \
+    if(stream((unsigned char)(x), userp)) \
+      return TRUE;                        \
+    (*donep)++;                           \
   } while(0)
 
 /* Data type to read from the arglist */
 typedef enum {
-  FORMAT_UNKNOWN = 0,
-  FORMAT_STRING,
-  FORMAT_PTR,
-  FORMAT_INT,
-  FORMAT_INTPTR,
-  FORMAT_LONG,
-  FORMAT_LONGLONG,
-  FORMAT_DOUBLE,
-  FORMAT_LONGDOUBLE,
-  FORMAT_WIDTH /* For internal use */
+  MTYPE_STRING,
+  MTYPE_PTR,
+  MTYPE_INTPTR,
+  MTYPE_INT,
+  MTYPE_LONG,
+  MTYPE_LONGLONG,
+  MTYPE_INTU,
+  MTYPE_LONGU,
+  MTYPE_LONGLONGU,
+  MTYPE_DOUBLE,
+  MTYPE_LONGDOUBLE,
+  MTYPE_WIDTH,
+  MTYPE_PRECISION
 } FormatType;
 
 /* conversion and display flags */
 enum {
-  FLAGS_NEW        = 0,
-  FLAGS_SPACE      = 1<<0,
-  FLAGS_SHOWSIGN   = 1<<1,
-  FLAGS_LEFT       = 1<<2,
-  FLAGS_ALT        = 1<<3,
-  FLAGS_SHORT      = 1<<4,
-  FLAGS_LONG       = 1<<5,
-  FLAGS_LONGLONG   = 1<<6,
-  FLAGS_LONGDOUBLE = 1<<7,
-  FLAGS_PAD_NIL    = 1<<8,
-  FLAGS_UNSIGNED   = 1<<9,
-  FLAGS_OCTAL      = 1<<10,
-  FLAGS_HEX        = 1<<11,
-  FLAGS_UPPER      = 1<<12,
-  FLAGS_WIDTH      = 1<<13, /* '*' or '*<num>$' used */
-  FLAGS_WIDTHPARAM = 1<<14, /* width PARAMETER was specified */
-  FLAGS_PREC       = 1<<15, /* precision was specified */
-  FLAGS_PRECPARAM  = 1<<16, /* precision PARAMETER was specified */
-  FLAGS_CHAR       = 1<<17, /* %c story */
-  FLAGS_FLOATE     = 1<<18, /* %e or %E */
-  FLAGS_FLOATG     = 1<<19  /* %g or %G */
+  FLAGS_SPACE      = 1 << 0,
+  FLAGS_SHOWSIGN   = 1 << 1,
+  FLAGS_LEFT       = 1 << 2,
+  FLAGS_ALT        = 1 << 3,
+  FLAGS_SHORT      = 1 << 4,
+  FLAGS_LONG       = 1 << 5,
+  FLAGS_LONGLONG   = 1 << 6,
+  FLAGS_LONGDOUBLE = 1 << 7,
+  FLAGS_PAD_NIL    = 1 << 8,
+  FLAGS_UNSIGNED   = 1 << 9,
+  FLAGS_OCTAL      = 1 << 10,
+  FLAGS_HEX        = 1 << 11,
+  FLAGS_UPPER      = 1 << 12,
+  FLAGS_WIDTH      = 1 << 13, /* '*' or '*<num>$' used */
+  FLAGS_WIDTHPARAM = 1 << 14, /* width PARAMETER was specified */
+  FLAGS_PREC       = 1 << 15, /* precision was specified */
+  FLAGS_PRECPARAM  = 1 << 16, /* precision PARAMETER was specified */
+  FLAGS_CHAR       = 1 << 17, /* %c story */
+  FLAGS_FLOATE     = 1 << 18, /* %e or %E */
+  FLAGS_FLOATG     = 1 << 19, /* %g or %G */
+  FLAGS_SUBSTR     = 1 << 20  /* no input, only substring */
 };
 
-struct va_stack {
-  FormatType type;
-  int flags;
-  long width;     /* width OR width parameter number */
-  long precision; /* precision OR precision parameter number */
+enum {
+  DOLLAR_UNKNOWN,
+  DOLLAR_NOPE,
+  DOLLAR_USE
+};
+
+/*
+ * Describes an input va_arg type and hold its value.
+ */
+struct va_input {
+  FormatType type; /* FormatType */
   union {
-    char *str;
+    const char *str;
     void *ptr;
-    union {
-      mp_intmax_t as_signed;
-      mp_uintmax_t as_unsigned;
-    } num;
+    int64_t nums; /* signed */
+    uint64_t numu; /* unsigned */
     double dnum;
-  } data;
+  } val;
+};
+
+/*
+ * Describes an output segment.
+ */
+struct outsegment {
+  int width;     /* width OR width parameter number */
+  int precision; /* precision OR precision parameter number */
+  unsigned int flags;
+  unsigned int input; /* input argument array index */
+  const char *start; /* format string start to output */
+  size_t outlen;     /* number of bytes from the format string to output */
 };
 
 struct nsprintf {
@@ -171,860 +128,981 @@ struct nsprintf {
 
 struct asprintf {
   struct dynbuf *b;
-  bool fail; /* if an alloc has failed and thus the output is not the complete
-                data */
+  char merr;
 };
 
-static long dprintf_DollarString(char *input, char **end)
-{
-  int number = 0;
-  while(ISDIGIT(*input)) {
-    if(number < MAX_PARAMETERS) {
-      number *= 10;
-      number += *input - '0';
-    }
-    input++;
-  }
-  if(number <= MAX_PARAMETERS && ('$' == *input)) {
-    *end = ++input;
-    return number;
-  }
-  return 0;
-}
-
-static bool dprintf_IsQualifierNoDollar(const char *fmt)
-{
-#if defined(MP_HAVE_INT_EXTENSIONS)
-  if(!strncmp(fmt, "I32", 3) || !strncmp(fmt, "I64", 3)) {
-    return TRUE;
-  }
-#endif
-
-  switch(*fmt) {
-  case '-': case '+': case ' ': case '#': case '.':
-  case '0': case '1': case '2': case '3': case '4':
-  case '5': case '6': case '7': case '8': case '9':
-  case 'h': case 'l': case 'L': case 'z': case 'q':
-  case '*': case 'O':
-#if defined(MP_HAVE_INT_EXTENSIONS)
-  case 'I':
-#endif
-    return TRUE;
-
-  default:
-    return FALSE;
-  }
-}
-
-/******************************************************************
+/* the provided input number is 1-based but this returns the number 0-based.
  *
- * Pass 1:
- * Create an index with the type of each parameter entry and its
- * value (may vary in size)
+ * returns -1 if no valid number was provided.
+ */
+static int dollarstring(const char *p, const char **end)
+{
+  curl_off_t num;
+  if(curlx_str_number(&p, &num, MAX_PARAMETERS) ||
+     curlx_str_single(&p, '$') || !num)
+    return -1;
+  *end = p;
+  return (int)num - 1;
+}
+
+#define is_arg_used(x, y)   ((x)[(y) / 8] & (1 << ((y) & 7)))
+#define mark_arg_used(x, y) ((x)[(y) / 8] |= (unsigned char)(1 << ((y) & 7)))
+
+/*
+ * Parse the format string.
+ *
+ * Create two arrays. One describes the inputs, one describes the outputs.
  *
  * Returns zero on success.
- *
- ******************************************************************/
+ */
 
-static int dprintf_Pass1(const char *format, struct va_stack *vto,
-                         char **endpos, va_list arglist)
+#define PFMT_OK          0
+#define PFMT_DOLLAR      1 /* bad dollar for main param */
+#define PFMT_DOLLARWIDTH 2 /* bad dollar use for width */
+#define PFMT_DOLLARPREC  3 /* bad dollar use for precision */
+#define PFMT_MANYARGS    4 /* too many input arguments used */
+#define PFMT_PREC        5 /* precision overflow */
+#define PFMT_PRECMIX     6 /* bad mix of precision specifiers */
+#define PFMT_WIDTH       7 /* width overflow */
+#define PFMT_INPUTGAP    8 /* gap in arguments */
+#define PFMT_WIDTHARG    9 /* attempted to use same arg twice, for width */
+#define PFMT_PRECARG    10 /* attempted to use same arg twice, for prec */
+#define PFMT_MANYSEGS   11 /* maxed out output segments */
+
+static int parse_flags(const char **fmtp, unsigned int *flagsp, int use_dollar,
+                       int *precp, int *widthp)
 {
-  char *fmt = (char *)format;
+  const char *fmt = *fmtp;
+  bool loopit = TRUE;
+  unsigned int flags = 0;
+  int width = 0;
+  int precision = 0;
+
+  /* Handle the flags */
+  do {
+    switch(*fmt++) {
+    case ' ':
+      flags |= FLAGS_SPACE;
+      break;
+    case '+':
+      flags |= FLAGS_SHOWSIGN;
+      break;
+    case '-':
+      flags |= FLAGS_LEFT;
+      flags &= ~(unsigned int)FLAGS_PAD_NIL;
+      break;
+    case '#':
+      flags |= FLAGS_ALT;
+      break;
+    case '.':
+      if('*' == *fmt) {
+        /* The precision is picked from a specified parameter */
+        flags |= FLAGS_PRECPARAM;
+        fmt++;
+
+        if(use_dollar == DOLLAR_USE) {
+          precision = dollarstring(fmt, &fmt);
+          if(precision < 0)
+            /* illegal combo */
+            return PFMT_DOLLARPREC;
+        }
+        else
+          /* get it from the next argument */
+          precision = -1;
+      }
+      else {
+        bool is_neg;
+        curl_off_t num;
+        flags |= FLAGS_PREC;
+        is_neg = ('-' == *fmt);
+        if(is_neg)
+          fmt++;
+        if(curlx_str_number(&fmt, &num, INT_MAX))
+          return PFMT_PREC;
+        precision = (int)num;
+        if(is_neg)
+          precision = -precision;
+      }
+      if((flags & (FLAGS_PREC | FLAGS_PRECPARAM)) ==
+         (FLAGS_PREC | FLAGS_PRECPARAM))
+        /* it is not permitted to use both kinds of precision for the same
+           argument */
+        return PFMT_PRECMIX;
+      break;
+    case 'h':
+      flags |= FLAGS_SHORT;
+      break;
+#ifdef _WIN32
+    case 'I':
+      /* Non-ANSI integer extensions I32 I64 */
+      if((fmt[0] == '3') && (fmt[1] == '2')) {
+        flags |= FLAGS_LONG;
+        fmt += 2;
+      }
+      else if((fmt[0] == '6') && (fmt[1] == '4')) {
+        flags |= FLAGS_LONGLONG;
+        fmt += 2;
+      }
+      else {
+#if SIZEOF_CURL_OFF_T > SIZEOF_LONG
+        flags |= FLAGS_LONGLONG;
+#else
+        flags |= FLAGS_LONG;
+#endif
+      }
+      break;
+#endif /* _WIN32 */
+    case 'l':
+      if(flags & FLAGS_LONG)
+        flags |= FLAGS_LONGLONG;
+      else
+        flags |= FLAGS_LONG;
+      break;
+    case 'L':
+      flags |= FLAGS_LONGDOUBLE;
+      break;
+    case 'q':
+      flags |= FLAGS_LONGLONG;
+      break;
+    case 'z':
+      /* the code below generates a warning if -Wunreachable-code is
+         used */
+#if SIZEOF_SIZE_T > SIZEOF_LONG
+      flags |= FLAGS_LONGLONG;
+#else
+      flags |= FLAGS_LONG;
+#endif
+      break;
+    case 'O':
+#if SIZEOF_CURL_OFF_T > SIZEOF_LONG
+      flags |= FLAGS_LONGLONG;
+#else
+      flags |= FLAGS_LONG;
+#endif
+      break;
+    case '0':
+      if(!(flags & FLAGS_LEFT))
+        flags |= FLAGS_PAD_NIL;
+      FALLTHROUGH();
+    case '1':
+    case '2':
+    case '3':
+    case '4':
+    case '5':
+    case '6':
+    case '7':
+    case '8':
+    case '9': {
+      curl_off_t num;
+      flags |= FLAGS_WIDTH;
+      fmt--;
+      if(curlx_str_number(&fmt, &num, INT_MAX))
+        return PFMT_WIDTH;
+      width = (int)num;
+      break;
+    }
+    case '*':  /* read width from argument list */
+      flags |= FLAGS_WIDTHPARAM;
+      if(use_dollar == DOLLAR_USE) {
+        width = dollarstring(fmt, &fmt);
+        if(width < 0)
+          /* illegal combo */
+          return PFMT_DOLLARWIDTH;
+      }
+      else
+        /* pick from the next argument */
+        width = -1;
+      break;
+    default:
+      loopit = FALSE;
+      fmt--;
+      break;
+    } /* switch */
+  } while(loopit); /* do */
+  *flagsp = flags;
+  *precp = precision;
+  *widthp = width;
+  *fmtp = fmt;
+  return PFMT_OK;
+}
+
+static bool parse_conversion(const char f, unsigned int *flagp,
+                             FormatType *typep)
+{
+  unsigned int flags = *flagp;
+  FormatType type;
+  switch(f) {
+  case 'S':
+    flags |= FLAGS_ALT;
+    type = MTYPE_STRING;
+    break;
+  case 's':
+    type = MTYPE_STRING;
+    break;
+  case 'n':
+    type = MTYPE_INTPTR;
+    break;
+  case 'p':
+    type = MTYPE_PTR;
+    break;
+  case 'd':
+  case 'i':
+    if(flags & FLAGS_LONGLONG)
+      type = MTYPE_LONGLONG;
+    else if(flags & FLAGS_LONG)
+      type = MTYPE_LONG;
+    else
+      type = MTYPE_INT;
+    break;
+  case 'u':
+    if(flags & FLAGS_LONGLONG)
+      type = MTYPE_LONGLONGU;
+    else if(flags & FLAGS_LONG)
+      type = MTYPE_LONGU;
+    else
+      type = MTYPE_INTU;
+    flags |= FLAGS_UNSIGNED;
+    break;
+  case 'o':
+    if(flags & FLAGS_LONGLONG)
+      type = MTYPE_LONGLONGU;
+    else if(flags & FLAGS_LONG)
+      type = MTYPE_LONGU;
+    else
+      type = MTYPE_INTU;
+    flags |= FLAGS_OCTAL | FLAGS_UNSIGNED;
+    break;
+  case 'x':
+    if(flags & FLAGS_LONGLONG)
+      type = MTYPE_LONGLONGU;
+    else if(flags & FLAGS_LONG)
+      type = MTYPE_LONGU;
+    else
+      type = MTYPE_INTU;
+    flags |= FLAGS_HEX | FLAGS_UNSIGNED;
+    break;
+  case 'X':
+    if(flags & FLAGS_LONGLONG)
+      type = MTYPE_LONGLONGU;
+    else if(flags & FLAGS_LONG)
+      type = MTYPE_LONGU;
+    else
+      type = MTYPE_INTU;
+    flags |= FLAGS_HEX | FLAGS_UPPER | FLAGS_UNSIGNED;
+    break;
+  case 'c':
+    type = MTYPE_INT;
+    flags |= FLAGS_CHAR;
+    break;
+  case 'f':
+    type = MTYPE_DOUBLE;
+    break;
+  case 'e':
+    type = MTYPE_DOUBLE;
+    flags |= FLAGS_FLOATE;
+    break;
+  case 'E':
+    type = MTYPE_DOUBLE;
+    flags |= FLAGS_FLOATE | FLAGS_UPPER;
+    break;
+  case 'g':
+    type = MTYPE_DOUBLE;
+    flags |= FLAGS_FLOATG;
+    break;
+  case 'G':
+    type = MTYPE_DOUBLE;
+    flags |= FLAGS_FLOATG | FLAGS_UPPER;
+    break;
+  default:
+    /* invalid instruction, disregard and continue */
+    return TRUE;
+  } /* switch */
+
+  *flagp |= flags;
+  *typep = type;
+  return FALSE;
+}
+
+static int parsefmt(const char *format,
+                    struct outsegment *out,
+                    struct va_input *in,
+                    int *opieces,
+                    int *ipieces, va_list arglist)
+{
+  const char *fmt = format;
   int param_num = 0;
-  long this_param;
-  long width;
-  long precision;
-  int flags;
-  long max_param = 0;
-  long i;
+  int max_param = -1;
+  int i;
+  int ocount = 0;
+  unsigned char usedinput[MAX_PARAMETERS / 8];
+  size_t outlen = 0;
+  struct outsegment *optr;
+  int use_dollar = DOLLAR_UNKNOWN;
+  const char *start = fmt;
+
+  /* clear, set a bit for each used input */
+  memset(usedinput, 0, sizeof(usedinput));
 
   while(*fmt) {
-    if(*fmt++ == '%') {
+    if(*fmt == '%') {
+      struct va_input *iptr;
+      FormatType type;
+      unsigned int flags = 0;
+      int width = 0;
+      int precision = 0;
+      int param = -1;
+      int rc;
+      fmt++;
+      outlen = (size_t)(fmt - start - 1);
       if(*fmt == '%') {
+        /* this means a %% that should be output only as %. Create an output
+           segment. */
+        if(outlen) {
+          optr = &out[ocount++];
+          if(ocount > MAX_SEGMENTS)
+            return PFMT_MANYSEGS;
+          optr->input = 0;
+          optr->flags = FLAGS_SUBSTR;
+          optr->start = start;
+          optr->outlen = outlen;
+        }
+        start = fmt;
         fmt++;
         continue; /* while */
       }
 
-      flags = FLAGS_NEW;
+      if(use_dollar != DOLLAR_NOPE) {
+        param = dollarstring(fmt, &fmt);
+        if(param < 0) {
+          if(use_dollar == DOLLAR_USE)
+            /* illegal combo */
+            return PFMT_DOLLAR;
 
-      /* Handle the positional case (N$) */
-
-      param_num++;
-
-      this_param = dprintf_DollarString(fmt, &fmt);
-      if(0 == this_param)
-        /* we got no positional, get the next counter */
-        this_param = param_num;
-
-      if(this_param > max_param)
-        max_param = this_param;
-
-      /*
-       * The parameter with number 'i' should be used. Next, we need
-       * to get SIZE and TYPE of the parameter. Add the information
-       * to our array.
-       */
-
-      width = 0;
-      precision = 0;
-
-      /* Handle the flags */
-
-      while(dprintf_IsQualifierNoDollar(fmt)) {
-#if defined(MP_HAVE_INT_EXTENSIONS)
-        if(!strncmp(fmt, "I32", 3)) {
-          flags |= FLAGS_LONG;
-          fmt += 3;
-        }
-        else if(!strncmp(fmt, "I64", 3)) {
-          flags |= FLAGS_LONGLONG;
-          fmt += 3;
+          /* we got no positional, get the next arg */
+          param = -1;
+          use_dollar = DOLLAR_NOPE;
         }
         else
-#endif
+          use_dollar = DOLLAR_USE;
+      }
 
-        switch(*fmt++) {
-        case ' ':
-          flags |= FLAGS_SPACE;
-          break;
-        case '+':
-          flags |= FLAGS_SHOWSIGN;
-          break;
-        case '-':
-          flags |= FLAGS_LEFT;
-          flags &= ~FLAGS_PAD_NIL;
-          break;
-        case '#':
-          flags |= FLAGS_ALT;
-          break;
-        case '.':
-          if('*' == *fmt) {
-            /* The precision is picked from a specified parameter */
+      rc = parse_flags(&fmt, &flags, use_dollar, &precision, &width);
+      if(rc)
+        return rc;
 
-            flags |= FLAGS_PRECPARAM;
-            fmt++;
-            param_num++;
-
-            i = dprintf_DollarString(fmt, &fmt);
-            if(i)
-              precision = i;
-            else
-              precision = param_num;
-
-            if(precision > max_param)
-              max_param = precision;
-          }
-          else {
-            flags |= FLAGS_PREC;
-            precision = strtol(fmt, &fmt, 10);
-          }
-          if((flags & (FLAGS_PREC | FLAGS_PRECPARAM)) ==
-             (FLAGS_PREC | FLAGS_PRECPARAM))
-            /* it is not permitted to use both kinds of precision for the same
-               argument */
-            return 1;
-          break;
-        case 'h':
-          flags |= FLAGS_SHORT;
-          break;
-#if defined(MP_HAVE_INT_EXTENSIONS)
-        case 'I':
-#if (SIZEOF_CURL_OFF_T > SIZEOF_LONG)
-          flags |= FLAGS_LONGLONG;
-#else
-          flags |= FLAGS_LONG;
-#endif
-          break;
-#endif
-        case 'l':
-          if(flags & FLAGS_LONG)
-            flags |= FLAGS_LONGLONG;
-          else
-            flags |= FLAGS_LONG;
-          break;
-        case 'L':
-          flags |= FLAGS_LONGDOUBLE;
-          break;
-        case 'q':
-          flags |= FLAGS_LONGLONG;
-          break;
-        case 'z':
-          /* the code below generates a warning if -Wunreachable-code is
-             used */
-#if (SIZEOF_SIZE_T > SIZEOF_LONG)
-          flags |= FLAGS_LONGLONG;
-#else
-          flags |= FLAGS_LONG;
-#endif
-          break;
-        case 'O':
-#if (SIZEOF_CURL_OFF_T > SIZEOF_LONG)
-          flags |= FLAGS_LONGLONG;
-#else
-          flags |= FLAGS_LONG;
-#endif
-          break;
-        case '0':
-          if(!(flags & FLAGS_LEFT))
-            flags |= FLAGS_PAD_NIL;
-          /* FALLTHROUGH */
-        case '1': case '2': case '3': case '4':
-        case '5': case '6': case '7': case '8': case '9':
-          flags |= FLAGS_WIDTH;
-          width = strtol(fmt-1, &fmt, 10);
-          break;
-        case '*':  /* Special case */
-          flags |= FLAGS_WIDTHPARAM;
-          param_num++;
-
-          i = dprintf_DollarString(fmt, &fmt);
-          if(i)
-            width = i;
-          else
-            width = param_num;
-          if(width > max_param)
-            max_param = width;
-          break;
-        case '\0':
-          fmt--;
-        default:
-          break;
-        }
-      } /* switch */
-
-      /* Handle the specifier */
-
-      i = this_param - 1;
-
-      if((i < 0) || (i >= MAX_PARAMETERS))
-        /* out of allowed range */
-        return 1;
-
-      switch(*fmt) {
-      case 'S':
-        flags |= FLAGS_ALT;
-        /* FALLTHROUGH */
-      case 's':
-        vto[i].type = FORMAT_STRING;
-        break;
-      case 'n':
-        vto[i].type = FORMAT_INTPTR;
-        break;
-      case 'p':
-        vto[i].type = FORMAT_PTR;
-        break;
-      case 'd': case 'i':
-        vto[i].type = FORMAT_INT;
-        break;
-      case 'u':
-        vto[i].type = FORMAT_INT;
-        flags |= FLAGS_UNSIGNED;
-        break;
-      case 'o':
-        vto[i].type = FORMAT_INT;
-        flags |= FLAGS_OCTAL;
-        break;
-      case 'x':
-        vto[i].type = FORMAT_INT;
-        flags |= FLAGS_HEX|FLAGS_UNSIGNED;
-        break;
-      case 'X':
-        vto[i].type = FORMAT_INT;
-        flags |= FLAGS_HEX|FLAGS_UPPER|FLAGS_UNSIGNED;
-        break;
-      case 'c':
-        vto[i].type = FORMAT_INT;
-        flags |= FLAGS_CHAR;
-        break;
-      case 'f':
-        vto[i].type = FORMAT_DOUBLE;
-        break;
-      case 'e':
-        vto[i].type = FORMAT_DOUBLE;
-        flags |= FLAGS_FLOATE;
-        break;
-      case 'E':
-        vto[i].type = FORMAT_DOUBLE;
-        flags |= FLAGS_FLOATE|FLAGS_UPPER;
-        break;
-      case 'g':
-        vto[i].type = FORMAT_DOUBLE;
-        flags |= FLAGS_FLOATG;
-        break;
-      case 'G':
-        vto[i].type = FORMAT_DOUBLE;
-        flags |= FLAGS_FLOATG|FLAGS_UPPER;
-        break;
-      default:
-        vto[i].type = FORMAT_UNKNOWN;
-        break;
-      } /* switch */
-
-      vto[i].flags = flags;
-      vto[i].width = width;
-      vto[i].precision = precision;
+      if(parse_conversion(*fmt, &flags, &type))
+        continue;
 
       if(flags & FLAGS_WIDTHPARAM) {
-        /* we have the width specified from a parameter, so we make that
-           parameter's info setup properly */
-        long k = width - 1;
-        if((k < 0) || (k >= MAX_PARAMETERS))
-          /* out of allowed range */
-          return 1;
-        vto[i].width = k;
-        vto[k].type = FORMAT_WIDTH;
-        vto[k].flags = FLAGS_NEW;
-        /* can't use width or precision of width! */
-        vto[k].width = 0;
-        vto[k].precision = 0;
+        if(width < 0)
+          width = param_num++;
+        else {
+          /* if this identifies a parameter already used, this is illegal */
+          if(is_arg_used(usedinput, width))
+            return PFMT_WIDTHARG;
+        }
+        if(width >= MAX_PARAMETERS)
+          return PFMT_MANYARGS;
+        if(width >= max_param)
+          max_param = width;
+
+        in[width].type = MTYPE_WIDTH;
+        /* mark as used */
+        mark_arg_used(usedinput, width);
       }
+
       if(flags & FLAGS_PRECPARAM) {
-        /* we have the precision specified from a parameter, so we make that
-           parameter's info setup properly */
-        long k = precision - 1;
-        if((k < 0) || (k >= MAX_PARAMETERS))
-          /* out of allowed range */
-          return 1;
-        vto[i].precision = k;
-        vto[k].type = FORMAT_WIDTH;
-        vto[k].flags = FLAGS_NEW;
-        /* can't use width or precision of width! */
-        vto[k].width = 0;
-        vto[k].precision = 0;
+        if(precision < 0)
+          precision = param_num++;
+        else {
+          /* if this identifies a parameter already used, this is illegal */
+          if(is_arg_used(usedinput, precision))
+            return PFMT_PRECARG;
+        }
+        if(precision >= MAX_PARAMETERS)
+          return PFMT_MANYARGS;
+        if(precision >= max_param)
+          max_param = precision;
+
+        in[precision].type = MTYPE_PRECISION;
+        mark_arg_used(usedinput, precision);
       }
-      *endpos++ = fmt + ((*fmt == '\0') ? 0 : 1); /* end of this sequence */
+
+      /* Handle the specifier */
+      if(param < 0)
+        param = param_num++;
+      if(param >= MAX_PARAMETERS)
+        return PFMT_MANYARGS;
+      if(param >= max_param)
+        max_param = param;
+
+      iptr = &in[param];
+      iptr->type = type;
+
+      /* mark this input as used */
+      mark_arg_used(usedinput, param);
+
+      fmt++;
+      optr = &out[ocount++];
+      if(ocount > MAX_SEGMENTS)
+        return PFMT_MANYSEGS;
+      optr->input = (unsigned int)param;
+      optr->flags = flags;
+      optr->width = width;
+      optr->precision = precision;
+      optr->start = start;
+      optr->outlen = outlen;
+      start = fmt;
     }
+    else
+      fmt++;
+  }
+
+  /* is there a trailing piece */
+  outlen = (size_t)(fmt - start);
+  if(outlen) {
+    optr = &out[ocount++];
+    if(ocount > MAX_SEGMENTS)
+      return PFMT_MANYSEGS;
+    optr->input = 0;
+    optr->flags = FLAGS_SUBSTR;
+    optr->start = start;
+    optr->outlen = outlen;
   }
 
   /* Read the arg list parameters into our data list */
-  for(i = 0; i<max_param; i++) {
-    /* Width/precision arguments must be read before the main argument
-       they are attached to */
-    if(vto[i].flags & FLAGS_WIDTHPARAM) {
-      vto[vto[i].width].data.num.as_signed =
-        (mp_intmax_t)va_arg(arglist, int);
-    }
-    if(vto[i].flags & FLAGS_PRECPARAM) {
-      vto[vto[i].precision].data.num.as_signed =
-        (mp_intmax_t)va_arg(arglist, int);
-    }
+  for(i = 0; i < max_param + 1; i++) {
+    struct va_input *iptr = &in[i];
+    if(!is_arg_used(usedinput, i))
+      /* bad input */
+      return PFMT_INPUTGAP;
 
-    switch(vto[i].type) {
-    case FORMAT_STRING:
-      vto[i].data.str = va_arg(arglist, char *);
+    /* based on the type, read the correct argument */
+    switch(iptr->type) {
+    case MTYPE_STRING:
+      iptr->val.str = va_arg(arglist, const char *);
       break;
 
-    case FORMAT_INTPTR:
-    case FORMAT_UNKNOWN:
-    case FORMAT_PTR:
-      vto[i].data.ptr = va_arg(arglist, void *);
+    case MTYPE_INTPTR:
+    case MTYPE_PTR:
+      iptr->val.ptr = va_arg(arglist, void *);
       break;
 
-    case FORMAT_INT:
-#ifdef HAVE_LONG_LONG_TYPE
-      if((vto[i].flags & FLAGS_LONGLONG) && (vto[i].flags & FLAGS_UNSIGNED))
-        vto[i].data.num.as_unsigned =
-          (mp_uintmax_t)va_arg(arglist, mp_uintmax_t);
-      else if(vto[i].flags & FLAGS_LONGLONG)
-        vto[i].data.num.as_signed =
-          (mp_intmax_t)va_arg(arglist, mp_intmax_t);
-      else
-#endif
-      {
-        if((vto[i].flags & FLAGS_LONG) && (vto[i].flags & FLAGS_UNSIGNED))
-          vto[i].data.num.as_unsigned =
-            (mp_uintmax_t)va_arg(arglist, unsigned long);
-        else if(vto[i].flags & FLAGS_LONG)
-          vto[i].data.num.as_signed =
-            (mp_intmax_t)va_arg(arglist, long);
-        else if(vto[i].flags & FLAGS_UNSIGNED)
-          vto[i].data.num.as_unsigned =
-            (mp_uintmax_t)va_arg(arglist, unsigned int);
-        else
-          vto[i].data.num.as_signed =
-            (mp_intmax_t)va_arg(arglist, int);
-      }
+    case MTYPE_LONGLONGU:
+      iptr->val.numu = va_arg(arglist, uint64_t);
       break;
 
-    case FORMAT_DOUBLE:
-      vto[i].data.dnum = va_arg(arglist, double);
+    case MTYPE_LONGLONG:
+      iptr->val.nums = va_arg(arglist, int64_t);
       break;
 
-    case FORMAT_WIDTH:
-      /* Argument has been read. Silently convert it into an integer
-       * for later use
-       */
-      vto[i].type = FORMAT_INT;
+    case MTYPE_LONGU:
+      iptr->val.numu = va_arg(arglist, unsigned long);
+      break;
+
+    case MTYPE_LONG:
+      iptr->val.nums = va_arg(arglist, long);
+      break;
+
+    case MTYPE_INTU:
+      iptr->val.numu = va_arg(arglist, unsigned int);
+      break;
+
+    case MTYPE_INT:
+    case MTYPE_WIDTH:
+    case MTYPE_PRECISION:
+      iptr->val.nums = va_arg(arglist, int);
+      break;
+
+    case MTYPE_DOUBLE:
+      iptr->val.dnum = va_arg(arglist, double);
       break;
 
     default:
+      DEBUGASSERT(NULL); /* unexpected */
       break;
     }
   }
+  *ipieces = max_param + 1;
+  *opieces = ocount;
 
-  return 0;
-
+  return PFMT_OK;
 }
 
-static int dprintf_formatf(
-  void *data, /* untouched by format(), just sent to the stream() function in
-                 the second argument */
-  /* function pointer called for each output character */
-  int (*stream)(int, FILE *),
-  const char *format,    /* %-formatted string */
-  va_list ap_save) /* list of parameters */
+struct mproperty {
+  int width;            /* Width of a field. */
+  int prec;             /* Precision of a field. */
+  unsigned int flags;
+};
+
+static bool out_double(void *userp,
+                       int (*stream)(unsigned char, void *),
+                       struct mproperty *p,
+                       double dnum,
+                       char *work, int *donep)
 {
-  /* Base-36 digits for numbers.  */
-  const char *digits = lower_digits;
+  char fmt[32] = "%";
+  char *fptr = &fmt[1];
+  size_t left = sizeof(fmt) - strlen(fmt);
+  int flags = p->flags;
+  int width = p->width;
+  int prec = p->prec;
 
-  /* Pointer into the format string.  */
-  char *f;
+  if(flags & FLAGS_LEFT)
+    *fptr++ = '-';
+  if(flags & FLAGS_SHOWSIGN)
+    *fptr++ = '+';
+  if(flags & FLAGS_SPACE)
+    *fptr++ = ' ';
+  if(flags & FLAGS_ALT)
+    *fptr++ = '#';
 
-  /* Number of characters written.  */
-  int done = 0;
+  *fptr = 0;
 
-  long param; /* current parameter to read */
-  long param_num = 0; /* parameter counter */
+  if(width >= 0) {
+    size_t dlen;
+    if(width >= BUFFSIZE)
+      width = BUFFSIZE - 1;
+    /* RECURSIVE USAGE */
+    dlen = (size_t)curl_msnprintf(fptr, left, "%d", width);
+    fptr += dlen;
+    left -= dlen;
+  }
+  if(prec >= 0) {
+    /* for each digit in the integer part, we can have one less
+       precision */
+    int maxprec = BUFFSIZE - 1;
+    double val = dnum;
+    int len;
+    if(prec > maxprec)
+      prec = maxprec - 1;
+    if(width > 0 && prec <= width)
+      maxprec -= width;
+    while(val >= 10.0) {
+      val /= 10;
+      maxprec--;
+    }
 
-  struct va_stack vto[MAX_PARAMETERS];
-  char *endpos[MAX_PARAMETERS];
-  char **end;
-  char work[BUFFSIZE];
-  struct va_stack *p;
+    if(prec > maxprec)
+      prec = maxprec - 1;
+    if(prec < 0)
+      prec = 0;
+    /* RECURSIVE USAGE */
+    len = curl_msnprintf(fptr, left, ".%d", prec);
+    fptr += len;
+  }
+  if(flags & FLAGS_LONG)
+    *fptr++ = 'l';
+
+  if(flags & FLAGS_FLOATE)
+    *fptr++ = (char)((flags & FLAGS_UPPER) ? 'E' : 'e');
+  else if(flags & FLAGS_FLOATG)
+    *fptr++ = (char)((flags & FLAGS_UPPER) ? 'G' : 'g');
+  else
+    *fptr++ = 'f';
+
+  *fptr = 0; /* and a final null-termination */
+
+  /* NOTE NOTE NOTE!! Not all sprintf implementations return number of
+     output characters */
+#ifdef CURL_HAVE_DIAG
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wformat-nonliteral"
+#endif
+#ifdef _WIN32
+  curlx_win32_snprintf(work, BUFFSIZE, fmt, dnum);
+#else
+  /* !checksrc! disable BANNEDFUNC 1 */
+  /* !checksrc! disable LONGLINE */
+  /* NOLINTNEXTLINE(clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling) */
+  snprintf(work, BUFFSIZE, fmt, dnum);
+#endif
+#ifdef CURL_HAVE_DIAG
+#pragma GCC diagnostic pop
+#endif
+  DEBUGASSERT(strlen(work) < BUFFSIZE);
+  while(*work) {
+    if(stream(*work++, userp))
+      return TRUE;
+    (*donep)++;
+  }
+  return 0;
+}
+
+static bool out_number(void *userp,
+                       int (*stream)(unsigned char, void *),
+                       struct mproperty *p,
+                       uint64_t num,
+                       int64_t nums,
+                       char *work, int *donep)
+{
+  const unsigned char *digits = Curl_ldigits;
+  int flags = p->flags;
+  int width = p->width;
+  int prec = p->prec;
+  bool is_alt = flags & FLAGS_ALT;
+  bool is_neg = FALSE;
+  int base = 10;
 
   /* 'workend' points to the final buffer byte position, but with an extra
-     byte as margin to avoid the (false?) warning Coverity gives us
+     byte as margin to avoid the (FALSE?) warning Coverity gives us
      otherwise */
-  char *workend = &work[sizeof(work) - 2];
+  char *workend = &work[BUFFSIZE - 2];
+  char *w;
 
-  /* Do the actual %-code parsing */
-  if(dprintf_Pass1(format, vto, endpos, ap_save))
+  if(flags & FLAGS_CHAR) {
+    /* Character. */
+    if(!(flags & FLAGS_LEFT))
+      while(--width > 0)
+        OUTCHAR(' ');
+    OUTCHAR((char)num);
+    if(flags & FLAGS_LEFT)
+      while(--width > 0)
+        OUTCHAR(' ');
+    return FALSE;
+  }
+  if(flags & FLAGS_OCTAL)
+    /* Octal unsigned integer */
+    base = 8;
+
+  else if(flags & FLAGS_HEX) {
+    /* Hexadecimal unsigned integer */
+    digits = (flags & FLAGS_UPPER) ? Curl_udigits : Curl_ldigits;
+    base = 16;
+  }
+  else if(flags & FLAGS_UNSIGNED)
+    /* Decimal unsigned integer */
+    ;
+
+  else {
+    /* Decimal integer. */
+    is_neg = (nums < 0);
+    if(is_neg) {
+      /* signed_num might fail to hold absolute negative minimum by 1 */
+      int64_t signed_num; /* Used to convert negative in positive. */
+      signed_num = nums + (int64_t)1;
+      signed_num = -signed_num;
+      num = (uint64_t)signed_num;
+      num += (uint64_t)1;
+    }
+  }
+
+  /* Supply a default precision if none was given. */
+  if(prec == -1)
+    prec = 1;
+
+  /* Put the number in WORK. */
+  w = workend;
+  DEBUGASSERT(base <= 16);
+  switch(base) {
+  case 10:
+    while(num > 0) {
+      *w-- = (char)('0' + (num % 10));
+      num /= 10;
+    }
+    break;
+  default:
+    while(num > 0) {
+      *w-- = digits[num % base];
+      num /= base;
+    }
+    break;
+  }
+  width -= (int)(workend - w);
+  prec -= (int)(workend - w);
+
+  if(is_alt && base == 8 && prec <= 0) {
+    *w-- = '0';
+    --width;
+  }
+
+  if(prec > 0) {
+    width -= prec;
+    while(prec-- > 0 && w >= work)
+      *w-- = '0';
+  }
+
+  if(is_alt && base == 16)
+    width -= 2;
+
+  if(is_neg || (flags & FLAGS_SHOWSIGN) || (flags & FLAGS_SPACE))
+    --width;
+
+  if(!(flags & FLAGS_LEFT) && !(flags & FLAGS_PAD_NIL))
+    while(width-- > 0)
+      OUTCHAR(' ');
+
+  if(is_neg)
+    OUTCHAR('-');
+  else if(flags & FLAGS_SHOWSIGN)
+    OUTCHAR('+');
+  else if(flags & FLAGS_SPACE)
+    OUTCHAR(' ');
+
+  if(is_alt && base == 16) {
+    OUTCHAR('0');
+    if(flags & FLAGS_UPPER)
+      OUTCHAR('X');
+    else
+      OUTCHAR('x');
+  }
+
+  if(!(flags & FLAGS_LEFT) && (flags & FLAGS_PAD_NIL))
+    while(width-- > 0)
+      OUTCHAR('0');
+
+  /* Write the number. */
+  while(++w <= workend) {
+    OUTCHAR(*w);
+  }
+
+  if(flags & FLAGS_LEFT)
+    while(width-- > 0)
+      OUTCHAR(' ');
+
+  return FALSE;
+}
+
+static const char nilstr[] = "(nil)";
+
+static bool out_string(void *userp,
+                       int (*stream)(unsigned char, void *),
+                       struct mproperty *p,
+                       const char *str,
+                       int *donep)
+{
+  int flags = p->flags;
+  int width = p->width;
+  int prec = p->prec;
+  size_t len;
+
+  if(!str) {
+    /* Write null string if there is space. */
+    if(prec == -1 || prec >= (int)sizeof(nilstr) - 1) {
+      str = nilstr;
+      len = sizeof(nilstr) - 1;
+      /* Disable quotes around (nil) */
+      flags &= ~(unsigned int)FLAGS_ALT;
+    }
+    else {
+      str = "";
+      len = 0;
+    }
+  }
+  else if(prec != -1)
+    len = (size_t)prec;
+  else if(*str == '\0')
+    len = 0;
+  else
+    len = strlen(str);
+
+  width -= (len > INT_MAX) ? INT_MAX : (int)len;
+
+  if(flags & FLAGS_ALT)
+    OUTCHAR('"');
+
+  if(!(flags & FLAGS_LEFT))
+    while(width-- > 0)
+      OUTCHAR(' ');
+
+  for(; len && *str; len--)
+    OUTCHAR(*str++);
+  if(flags & FLAGS_LEFT)
+    while(width-- > 0)
+      OUTCHAR(' ');
+
+  if(flags & FLAGS_ALT)
+    OUTCHAR('"');
+
+  return FALSE;
+}
+
+static bool out_pointer(void *userp,
+                        int (*stream)(unsigned char, void *),
+                        struct mproperty *p,
+                        const char *ptr,
+                        char *work,
+                        int *donep)
+{
+  /* Generic pointer. */
+  if(ptr) {
+    size_t num = (size_t)ptr;
+
+    /* If the pointer is not NULL, write it as a %#x spec. */
+    p->flags |= FLAGS_HEX | FLAGS_ALT;
+    if(out_number(userp, stream, p, num, 0, work, donep))
+      return TRUE;
+  }
+  else {
+    /* Write "(nil)" for a nil pointer. */
+    const char *point;
+    int width = p->width;
+    int flags = p->flags;
+
+    width -= (int)(sizeof(nilstr) - 1);
+    if(flags & FLAGS_LEFT)
+      while(width-- > 0)
+        OUTCHAR(' ');
+    for(point = nilstr; *point; ++point)
+      OUTCHAR(*point);
+    if(!(flags & FLAGS_LEFT))
+      while(width-- > 0)
+        OUTCHAR(' ');
+  }
+  return FALSE;
+}
+
+/*
+ * formatf() - the general printf function.
+ *
+ * It calls parsefmt() to parse the format string. It populates two arrays;
+ * one that describes the input arguments and one that describes a number of
+ * output segments.
+ *
+ * On success, the input array describes the type of all arguments and their
+ * values.
+ *
+ * The function then iterates over the output segments and outputs them one
+ * by one until done. Using the appropriate input arguments (if any).
+ *
+ * All output is sent to the 'stream()' callback, one byte at a time.
+ */
+static int formatf(void *userp, /* untouched by format(), sent to the
+                                   stream() function in the second argument */
+                   /* function pointer called for each output character */
+                   int (*stream)(unsigned char, void *),
+                   const char *format, /* %-formatted string */
+                   va_list ap_save) /* list of parameters */
+{
+  int done = 0;   /* number of characters written */
+  int i;
+  int ocount = 0; /* number of output segments */
+  int icount = 0; /* number of input arguments */
+
+  struct outsegment output[MAX_SEGMENTS];
+  struct va_input input[MAX_PARAMETERS];
+  char work[BUFFSIZE + 2];
+
+  /* Parse the format string */
+  if(parsefmt(format, output, input, &ocount, &icount, ap_save))
     return 0;
 
-  end = &endpos[0]; /* the initial end-position from the list dprintf_Pass1()
-                       created for us */
+  for(i = 0; i < ocount; i++) {
+    struct outsegment *optr = &output[i];
+    struct va_input *iptr = &input[optr->input];
+    struct mproperty p;
+    size_t outlen = optr->outlen;
 
-  f = (char *)format;
-  while(*f != '\0') {
-    /* Format spec modifiers.  */
-    int is_alt;
-
-    /* Width of a field.  */
-    long width;
-
-    /* Precision of a field.  */
-    long prec;
-
-    /* Decimal integer is negative.  */
-    int is_neg;
-
-    /* Base of a number to be written.  */
-    unsigned long base;
-
-    /* Integral values to be written.  */
-    mp_uintmax_t num;
-
-    /* Used to convert negative in positive.  */
-    mp_intmax_t signed_num;
-
-    char *w;
-
-    if(*f != '%') {
-      /* This isn't a format spec, so write everything out until the next one
-         OR end of string is reached.  */
-      do {
-        OUTCHAR(*f);
-      } while(*++f && ('%' != *f));
-      continue;
+    if(outlen) {
+      const char *str = optr->start;
+      for(; outlen && *str; outlen--) {
+        if(stream(*str++, userp))
+          return done;
+        done++;
+      }
+      if(optr->flags & FLAGS_SUBSTR)
+        /* this is a substring */
+        continue;
     }
 
-    ++f;
-
-    /* Check for "%%".  Note that although the ANSI standard lists
-       '%' as a conversion specifier, it says "The complete format
-       specification shall be `%%'," so we can avoid all the width
-       and precision processing.  */
-    if(*f == '%') {
-      ++f;
-      OUTCHAR('%');
-      continue;
-    }
-
-    /* If this is a positional parameter, the position must follow immediately
-       after the %, thus create a %<num>$ sequence */
-    param = dprintf_DollarString(f, &f);
-
-    if(!param)
-      param = param_num;
-    else
-      --param;
-
-    param_num++; /* increase this always to allow "%2$s %1$s %s" and then the
-                    third %s will pick the 3rd argument */
-
-    p = &vto[param];
+    p.flags = optr->flags;
 
     /* pick up the specified width */
-    if(p->flags & FLAGS_WIDTHPARAM) {
-      width = (long)vto[p->width].data.num.as_signed;
-      param_num++; /* since the width is extracted from a parameter, we
-                      must skip that to get to the next one properly */
-      if(width < 0) {
+    if(p.flags & FLAGS_WIDTHPARAM) {
+      p.width = (int)input[optr->width].val.nums;
+      if(p.width < 0) {
         /* "A negative field width is taken as a '-' flag followed by a
            positive field width." */
-        width = -width;
-        p->flags |= FLAGS_LEFT;
-        p->flags &= ~FLAGS_PAD_NIL;
+        if(p.width == INT_MIN)
+          p.width = INT_MAX;
+        else
+          p.width = -p.width;
+        p.flags |= FLAGS_LEFT;
+        p.flags &= ~(unsigned int)FLAGS_PAD_NIL;
       }
     }
     else
-      width = p->width;
+      p.width = optr->width;
 
     /* pick up the specified precision */
-    if(p->flags & FLAGS_PRECPARAM) {
-      prec = (long)vto[p->precision].data.num.as_signed;
-      param_num++; /* since the precision is extracted from a parameter, we
-                      must skip that to get to the next one properly */
-      if(prec < 0)
+    if(p.flags & FLAGS_PRECPARAM) {
+      p.prec = (int)input[optr->precision].val.nums;
+      if(p.prec < 0)
         /* "A negative precision is taken as if the precision were
            omitted." */
-        prec = -1;
+        p.prec = -1;
     }
-    else if(p->flags & FLAGS_PREC)
-      prec = p->precision;
+    else if(p.flags & FLAGS_PREC)
+      p.prec = optr->precision;
     else
-      prec = -1;
+      p.prec = -1;
 
-    is_alt = (p->flags & FLAGS_ALT) ? 1 : 0;
-
-    switch(p->type) {
-    case FORMAT_INT:
-      num = p->data.num.as_unsigned;
-      if(p->flags & FLAGS_CHAR) {
-        /* Character.  */
-        if(!(p->flags & FLAGS_LEFT))
-          while(--width > 0)
-            OUTCHAR(' ');
-        OUTCHAR((char) num);
-        if(p->flags & FLAGS_LEFT)
-          while(--width > 0)
-            OUTCHAR(' ');
-        break;
-      }
-      if(p->flags & FLAGS_OCTAL) {
-        /* Octal unsigned integer.  */
-        base = 8;
-        goto unsigned_number;
-      }
-      else if(p->flags & FLAGS_HEX) {
-        /* Hexadecimal unsigned integer.  */
-
-        digits = (p->flags & FLAGS_UPPER)? upper_digits : lower_digits;
-        base = 16;
-        goto unsigned_number;
-      }
-      else if(p->flags & FLAGS_UNSIGNED) {
-        /* Decimal unsigned integer.  */
-        base = 10;
-        goto unsigned_number;
-      }
-
-      /* Decimal integer.  */
-      base = 10;
-
-      is_neg = (p->data.num.as_signed < (mp_intmax_t)0) ? 1 : 0;
-      if(is_neg) {
-        /* signed_num might fail to hold absolute negative minimum by 1 */
-        signed_num = p->data.num.as_signed + (mp_intmax_t)1;
-        signed_num = -signed_num;
-        num = (mp_uintmax_t)signed_num;
-        num += (mp_uintmax_t)1;
-      }
-
-      goto number;
-
-unsigned_number:
-      /* Unsigned number of base BASE.  */
-      is_neg = 0;
-
-number:
-      /* Number of base BASE.  */
-
-      /* Supply a default precision if none was given.  */
-      if(prec == -1)
-        prec = 1;
-
-      /* Put the number in WORK.  */
-      w = workend;
-      while(num > 0) {
-        *w-- = digits[num % base];
-        num /= base;
-      }
-      width -= (long)(workend - w);
-      prec -= (long)(workend - w);
-
-      if(is_alt && base == 8 && prec <= 0) {
-        *w-- = '0';
-        --width;
-      }
-
-      if(prec > 0) {
-        width -= prec;
-        while(prec-- > 0 && w >= work)
-          *w-- = '0';
-      }
-
-      if(is_alt && base == 16)
-        width -= 2;
-
-      if(is_neg || (p->flags & FLAGS_SHOWSIGN) || (p->flags & FLAGS_SPACE))
-        --width;
-
-      if(!(p->flags & FLAGS_LEFT) && !(p->flags & FLAGS_PAD_NIL))
-        while(width-- > 0)
-          OUTCHAR(' ');
-
-      if(is_neg)
-        OUTCHAR('-');
-      else if(p->flags & FLAGS_SHOWSIGN)
-        OUTCHAR('+');
-      else if(p->flags & FLAGS_SPACE)
-        OUTCHAR(' ');
-
-      if(is_alt && base == 16) {
-        OUTCHAR('0');
-        if(p->flags & FLAGS_UPPER)
-          OUTCHAR('X');
-        else
-          OUTCHAR('x');
-      }
-
-      if(!(p->flags & FLAGS_LEFT) && (p->flags & FLAGS_PAD_NIL))
-        while(width-- > 0)
-          OUTCHAR('0');
-
-      /* Write the number.  */
-      while(++w <= workend) {
-        OUTCHAR(*w);
-      }
-
-      if(p->flags & FLAGS_LEFT)
-        while(width-- > 0)
-          OUTCHAR(' ');
+    switch(iptr->type) {
+    case MTYPE_INTU:
+    case MTYPE_LONGU:
+    case MTYPE_LONGLONGU:
+      p.flags |= FLAGS_UNSIGNED;
+      if(out_number(userp, stream, &p, iptr->val.numu, 0, work, &done))
+        return done;
       break;
 
-    case FORMAT_STRING:
-            /* String.  */
-      {
-        static const char null[] = "(nil)";
-        const char *str;
-        size_t len;
-
-        str = (char *) p->data.str;
-        if(!str) {
-          /* Write null[] if there's space.  */
-          if(prec == -1 || prec >= (long) sizeof(null) - 1) {
-            str = null;
-            len = sizeof(null) - 1;
-            /* Disable quotes around (nil) */
-            p->flags &= (~FLAGS_ALT);
-          }
-          else {
-            str = "";
-            len = 0;
-          }
-        }
-        else if(prec != -1)
-          len = (size_t)prec;
-        else if(*str == '\0')
-          len = 0;
-        else
-          len = strlen(str);
-
-        width -= (len > LONG_MAX) ? LONG_MAX : (long)len;
-
-        if(p->flags & FLAGS_ALT)
-          OUTCHAR('"');
-
-        if(!(p->flags&FLAGS_LEFT))
-          while(width-- > 0)
-            OUTCHAR(' ');
-
-        for(; len && *str; len--)
-          OUTCHAR(*str++);
-        if(p->flags&FLAGS_LEFT)
-          while(width-- > 0)
-            OUTCHAR(' ');
-
-        if(p->flags & FLAGS_ALT)
-          OUTCHAR('"');
-      }
+    case MTYPE_INT:
+    case MTYPE_LONG:
+    case MTYPE_LONGLONG:
+      if(out_number(userp, stream, &p, iptr->val.numu,
+                    iptr->val.nums, work, &done))
+        return done;
       break;
 
-    case FORMAT_PTR:
-      /* Generic pointer.  */
-      {
-        void *ptr;
-        ptr = (void *) p->data.ptr;
-        if(ptr) {
-          /* If the pointer is not NULL, write it as a %#x spec.  */
-          base = 16;
-          digits = (p->flags & FLAGS_UPPER)? upper_digits : lower_digits;
-          is_alt = 1;
-          num = (size_t) ptr;
-          is_neg = 0;
-          goto number;
-        }
-        else {
-          /* Write "(nil)" for a nil pointer.  */
-          static const char strnil[] = "(nil)";
-          const char *point;
-
-          width -= (long)(sizeof(strnil) - 1);
-          if(p->flags & FLAGS_LEFT)
-            while(width-- > 0)
-              OUTCHAR(' ');
-          for(point = strnil; *point != '\0'; ++point)
-            OUTCHAR(*point);
-          if(!(p->flags & FLAGS_LEFT))
-            while(width-- > 0)
-              OUTCHAR(' ');
-        }
-      }
+    case MTYPE_STRING:
+      if(out_string(userp, stream, &p, iptr->val.str, &done))
+        return done;
       break;
 
-    case FORMAT_DOUBLE:
-      {
-        char formatbuf[32]="%";
-        char *fptr = &formatbuf[1];
-        size_t left = sizeof(formatbuf)-strlen(formatbuf);
-        int len;
-
-        width = -1;
-        if(p->flags & FLAGS_WIDTH)
-          width = p->width;
-        else if(p->flags & FLAGS_WIDTHPARAM)
-          width = (long)vto[p->width].data.num.as_signed;
-
-        prec = -1;
-        if(p->flags & FLAGS_PREC)
-          prec = p->precision;
-        else if(p->flags & FLAGS_PRECPARAM)
-          prec = (long)vto[p->precision].data.num.as_signed;
-
-        if(p->flags & FLAGS_LEFT)
-          *fptr++ = '-';
-        if(p->flags & FLAGS_SHOWSIGN)
-          *fptr++ = '+';
-        if(p->flags & FLAGS_SPACE)
-          *fptr++ = ' ';
-        if(p->flags & FLAGS_ALT)
-          *fptr++ = '#';
-
-        *fptr = 0;
-
-        if(width >= 0) {
-          if(width >= (long)sizeof(work))
-            width = sizeof(work)-1;
-          /* RECURSIVE USAGE */
-          len = curl_msnprintf(fptr, left, "%ld", width);
-          fptr += len;
-          left -= len;
-        }
-        if(prec >= 0) {
-          /* for each digit in the integer part, we can have one less
-             precision */
-          size_t maxprec = sizeof(work) - 2;
-          double val = p->data.dnum;
-          if(width > 0 && prec <= width)
-            maxprec -= width;
-          while(val >= 10.0) {
-            val /= 10;
-            maxprec--;
-          }
-
-          if(prec > (long)maxprec)
-            prec = (long)maxprec-1;
-          if(prec < 0)
-            prec = 0;
-          /* RECURSIVE USAGE */
-          len = curl_msnprintf(fptr, left, ".%ld", prec);
-          fptr += len;
-        }
-        if(p->flags & FLAGS_LONG)
-          *fptr++ = 'l';
-
-        if(p->flags & FLAGS_FLOATE)
-          *fptr++ = (char)((p->flags & FLAGS_UPPER) ? 'E':'e');
-        else if(p->flags & FLAGS_FLOATG)
-          *fptr++ = (char)((p->flags & FLAGS_UPPER) ? 'G' : 'g');
-        else
-          *fptr++ = 'f';
-
-        *fptr = 0; /* and a final null-termination */
-
-#ifdef __clang__
-#pragma clang diagnostic push
-#pragma clang diagnostic ignored "-Wformat-nonliteral"
-#endif
-        /* NOTE NOTE NOTE!! Not all sprintf implementations return number of
-           output characters */
-#ifdef HAVE_SNPRINTF
-        (snprintf)(work, sizeof(work), formatbuf, p->data.dnum);
-#else
-        (sprintf)(work, formatbuf, p->data.dnum);
-#endif
-#ifdef __clang__
-#pragma clang diagnostic pop
-#endif
-        DEBUGASSERT(strlen(work) <= sizeof(work));
-        for(fptr = work; *fptr; fptr++)
-          OUTCHAR(*fptr);
-      }
+    case MTYPE_PTR:
+      if(out_pointer(userp, stream, &p, iptr->val.ptr, work, &done))
+        return done;
       break;
 
-    case FORMAT_INTPTR:
-      /* Answer the count of characters written.  */
-#ifdef HAVE_LONG_LONG_TYPE
-      if(p->flags & FLAGS_LONGLONG)
-        *(LONG_LONG_TYPE *) p->data.ptr = (LONG_LONG_TYPE)done;
+    case MTYPE_DOUBLE:
+      if(out_double(userp, stream, &p, iptr->val.dnum, work, &done))
+        return done;
+      break;
+
+    case MTYPE_INTPTR:
+      /* Answer the count of characters written. */
+      if(p.flags & FLAGS_LONGLONG)
+        *(int64_t *)iptr->val.ptr = (int64_t)done;
+      else if(p.flags & FLAGS_LONG)
+        *(long *)iptr->val.ptr = (long)done;
+      else if(!(p.flags & FLAGS_SHORT))
+        *(int *)iptr->val.ptr = done;
       else
-#endif
-        if(p->flags & FLAGS_LONG)
-          *(long *) p->data.ptr = (long)done;
-      else if(!(p->flags & FLAGS_SHORT))
-        *(int *) p->data.ptr = (int)done;
-      else
-        *(short *) p->data.ptr = (short)done;
+        *(short *)iptr->val.ptr = (short)done;
       break;
 
     default:
       break;
     }
-    f = *end++; /* goto end of %-code */
-
   }
   return done;
 }
 
 /* fputc() look-alike */
-static int addbyter(int output, FILE *data)
+static int addbyter(unsigned char outc, void *f)
 {
-  struct nsprintf *infop = (struct nsprintf *)data;
-  unsigned char outc = (unsigned char)output;
-
+  struct nsprintf *infop = f;
   if(infop->length < infop->max) {
-    /* only do this if we haven't reached max length yet */
-    infop->buffer[0] = outc; /* store */
-    infop->buffer++; /* increase pointer */
+    /* only do this if we have not reached max length yet */
+    *infop->buffer++ = (char)outc; /* store */
     infop->length++; /* we are now one byte larger */
-    return outc;     /* fputc() returns like this on success */
+    return 0;     /* fputc() returns like this on success */
   }
-  return -1;
+  return 1;
 }
 
 int curl_mvsnprintf(char *buffer, size_t maxlength, const char *format,
-                    va_list ap_save)
+                    va_list args)
 {
   int retcode;
   struct nsprintf info;
@@ -1033,14 +1111,14 @@ int curl_mvsnprintf(char *buffer, size_t maxlength, const char *format,
   info.length = 0;
   info.max = maxlength;
 
-  retcode = dprintf_formatf(&info, addbyter, format, ap_save);
+  retcode = formatf(&info, addbyter, format, args);
   if(info.max) {
     /* we terminate this with a zero byte */
     if(info.max == info.length) {
-      /* we're at maximum, scrap the last letter */
+      /* we are at maximum, scrap the last letter */
       info.buffer[-1] = 0;
       DEBUGASSERT(retcode);
-      retcode--; /* don't count the nul byte */
+      retcode--; /* do not count the nul byte */
     }
     else
       info.buffer[0] = 0;
@@ -1051,127 +1129,128 @@ int curl_mvsnprintf(char *buffer, size_t maxlength, const char *format,
 int curl_msnprintf(char *buffer, size_t maxlength, const char *format, ...)
 {
   int retcode;
-  va_list ap_save; /* argument pointer */
-  va_start(ap_save, format);
-  retcode = curl_mvsnprintf(buffer, maxlength, format, ap_save);
-  va_end(ap_save);
+  va_list args; /* argument pointer */
+  va_start(args, format);
+  retcode = curl_mvsnprintf(buffer, maxlength, format, args);
+  va_end(args);
   return retcode;
 }
 
 /* fputc() look-alike */
-static int alloc_addbyter(int output, FILE *data)
+static int alloc_addbyter(unsigned char outc, void *f)
 {
-  struct asprintf *infop = (struct asprintf *)data;
-  unsigned char outc = (unsigned char)output;
-
-  if(Curl_dyn_addn(infop->b, &outc, 1)) {
-    infop->fail = 1;
-    return -1; /* fail */
-  }
-  return outc; /* fputc() returns like this on success */
-}
-
-extern int Curl_dyn_vprintf(struct dynbuf *dyn,
-                            const char *format, va_list ap_save);
-
-/* appends the formatted string, returns 0 on success, 1 on error */
-int Curl_dyn_vprintf(struct dynbuf *dyn, const char *format, va_list ap_save)
-{
-  struct asprintf info;
-  info.b = dyn;
-  info.fail = 0;
-
-  (void)dprintf_formatf(&info, alloc_addbyter, format, ap_save);
-  if(info.fail) {
-    Curl_dyn_free(info.b);
-    return 1;
+  struct asprintf *infop = f;
+  CURLcode result = curlx_dyn_addn(infop->b, &outc, 1);
+  if(result) {
+    infop->merr = result == CURLE_TOO_LARGE ? MERR_TOO_LARGE : MERR_MEM;
+    return 1; /* fail */
   }
   return 0;
 }
 
-char *curl_mvaprintf(const char *format, va_list ap_save)
+/* appends the formatted string, returns MERR error code */
+int curlx_dyn_vprintf(struct dynbuf *dyn, const char *format, va_list args)
+{
+  struct asprintf info;
+  info.b = dyn;
+  info.merr = MERR_OK;
+
+  (void)formatf(&info, alloc_addbyter, format, args);
+  if(info.merr) {
+    curlx_dyn_free(info.b);
+    return info.merr;
+  }
+  return 0;
+}
+
+char *curl_mvaprintf(const char *format, va_list args)
 {
   struct asprintf info;
   struct dynbuf dyn;
   info.b = &dyn;
-  Curl_dyn_init(info.b, DYN_APRINTF);
-  info.fail = 0;
+  curlx_dyn_init(info.b, DYN_APRINTF);
+  info.merr = MERR_OK;
 
-  (void)dprintf_formatf(&info, alloc_addbyter, format, ap_save);
-  if(info.fail) {
-    Curl_dyn_free(info.b);
+  (void)formatf(&info, alloc_addbyter, format, args);
+  if(info.merr) {
+    curlx_dyn_free(info.b);
     return NULL;
   }
-  if(Curl_dyn_len(info.b))
-    return Curl_dyn_ptr(info.b);
-  return strdup("");
+  if(curlx_dyn_len(info.b))
+    return curlx_dyn_ptr(info.b);
+  return curlx_strdup("");
 }
 
 char *curl_maprintf(const char *format, ...)
 {
-  va_list ap_save;
+  va_list args;
   char *s;
-  va_start(ap_save, format);
-  s = curl_mvaprintf(format, ap_save);
-  va_end(ap_save);
+  va_start(args, format);
+  s = curl_mvaprintf(format, args);
+  va_end(args);
   return s;
 }
 
-static int storebuffer(int output, FILE *data)
+static int storebuffer(unsigned char outc, void *f)
 {
-  char **buffer = (char **)data;
-  unsigned char outc = (unsigned char)output;
-  **buffer = outc;
+  char **buffer = f;
+  **buffer = (char)outc;
   (*buffer)++;
-  return outc; /* act like fputc() ! */
+  return 0;
 }
 
 int curl_msprintf(char *buffer, const char *format, ...)
 {
-  va_list ap_save; /* argument pointer */
+  va_list args; /* argument pointer */
   int retcode;
-  va_start(ap_save, format);
-  retcode = dprintf_formatf(&buffer, storebuffer, format, ap_save);
-  va_end(ap_save);
+  va_start(args, format);
+  retcode = formatf(&buffer, storebuffer, format, args);
+  va_end(args);
   *buffer = 0; /* we terminate this with a zero byte */
   return retcode;
 }
 
+static int fputc_wrapper(unsigned char outc, void *f)
+{
+  int out = outc;
+  FILE *s = f;
+  int rc = fputc(out, s);
+  return rc == EOF;
+}
+
 int curl_mprintf(const char *format, ...)
 {
   int retcode;
-  va_list ap_save; /* argument pointer */
-  va_start(ap_save, format);
-
-  retcode = dprintf_formatf(stdout, fputc, format, ap_save);
-  va_end(ap_save);
+  va_list args; /* argument pointer */
+  va_start(args, format);
+  retcode = formatf(stdout, fputc_wrapper, format, args);
+  va_end(args);
   return retcode;
 }
 
-int curl_mfprintf(FILE *whereto, const char *format, ...)
+int curl_mfprintf(FILE *fd, const char *format, ...)
 {
   int retcode;
-  va_list ap_save; /* argument pointer */
-  va_start(ap_save, format);
-  retcode = dprintf_formatf(whereto, fputc, format, ap_save);
-  va_end(ap_save);
+  va_list args; /* argument pointer */
+  va_start(args, format);
+  retcode = formatf(fd, fputc_wrapper, format, args);
+  va_end(args);
   return retcode;
 }
 
-int curl_mvsprintf(char *buffer, const char *format, va_list ap_save)
+int curl_mvsprintf(char *buffer, const char *format, va_list args)
 {
-  int retcode;
-  retcode = dprintf_formatf(&buffer, storebuffer, format, ap_save);
+  int retcode = formatf(&buffer, storebuffer, format, args);
   *buffer = 0; /* we terminate this with a zero byte */
   return retcode;
 }
 
-int curl_mvprintf(const char *format, va_list ap_save)
+int curl_mvprintf(const char *format, va_list args)
 {
-  return dprintf_formatf(stdout, fputc, format, ap_save);
+  return formatf(stdout, fputc_wrapper, format, args);
 }
 
-int curl_mvfprintf(FILE *whereto, const char *format, va_list ap_save)
+int curl_mvfprintf(FILE *fd, const char *format, va_list args)
 {
-  return dprintf_formatf(whereto, fputc, format, ap_save);
+  return formatf(fd, fputc_wrapper, format, args);
 }
diff --git a/third-party/curl/lib/mqtt.c b/third-party/curl/lib/mqtt.c
index 30edf3dd8a..8482477b97 100644
--- a/third-party/curl/lib/mqtt.c
+++ b/third-party/curl/lib/mqtt.c
@@ -22,145 +22,164 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+#include "urldata.h"
 
 #ifndef CURL_DISABLE_MQTT
 
-#include "urldata.h"
-#include <curl/curl.h>
 #include "transfer.h"
 #include "sendf.h"
+#include "curl_trc.h"
 #include "progress.h"
 #include "mqtt.h"
 #include "select.h"
-#include "strdup.h"
 #include "url.h"
 #include "escape.h"
-#include "warnless.h"
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "multiif.h"
 #include "rand.h"
+#include "cfilters.h"
+#include "connect.h"
 
-/* The last #include file should be: */
-#include "memdebug.h"
-
-#define MQTT_MSG_CONNECT   0x10
-#define MQTT_MSG_CONNACK   0x20
-#define MQTT_MSG_PUBLISH   0x30
-#define MQTT_MSG_SUBSCRIBE 0x82
-#define MQTT_MSG_SUBACK    0x90
+/* first byte is command.
+   second byte is for flags. */
+#define MQTT_MSG_CONNECT    0x10
+/* #define MQTT_MSG_CONNACK    0x20 */
+#define MQTT_MSG_PUBLISH    0x30
+#define MQTT_MSG_SUBSCRIBE  0x82
+#define MQTT_MSG_SUBACK     0x90
 #define MQTT_MSG_DISCONNECT 0xe0
+/* #define MQTT_MSG_PINGREQ    0xC0 */
+#define MQTT_MSG_PINGRESP   0xD0
 
-#define MQTT_CONNACK_LEN 2
-#define MQTT_SUBACK_LEN 3
+#define MQTT_CONNACK_LEN  2
+#define MQTT_SUBACK_LEN   3
 #define MQTT_CLIENTID_LEN 12 /* "curl0123abcd" */
 
-/*
- * Forward declarations.
- */
+/* meta key for storing protocol meta at easy handle */
+#define CURL_META_MQTT_EASY   "meta:proto:mqtt:easy"
+/* meta key for storing protocol meta at connection */
+#define CURL_META_MQTT_CONN   "meta:proto:mqtt:conn"
 
-static CURLcode mqtt_do(struct Curl_easy *data, bool *done);
-static CURLcode mqtt_done(struct Curl_easy *data,
-                          CURLcode status, bool premature);
-static CURLcode mqtt_doing(struct Curl_easy *data, bool *done);
-static int mqtt_getsock(struct Curl_easy *data, struct connectdata *conn,
-                        curl_socket_t *sock);
-static CURLcode mqtt_setup_conn(struct Curl_easy *data,
-                                struct connectdata *conn);
+enum mqttstate {
+  MQTT_FIRST,             /* 0 */
+  MQTT_REMAINING_LENGTH,  /* 1 */
+  MQTT_CONNACK,           /* 2 */
+  MQTT_SUBACK,            /* 3 */
+  MQTT_SUBACK_COMING,     /* 4 - the SUBACK remainder */
+  MQTT_PUBWAIT,    /* 5 - wait for publish */
+  MQTT_PUB_REMAIN,  /* 6 - wait for the remainder of the publish */
 
-/*
- * MQTT protocol handler.
- */
-
-const struct Curl_handler Curl_handler_mqtt = {
-  "MQTT",                             /* scheme */
-  mqtt_setup_conn,                    /* setup_connection */
-  mqtt_do,                            /* do_it */
-  mqtt_done,                          /* done */
-  ZERO_NULL,                          /* do_more */
-  ZERO_NULL,                          /* connect_it */
-  ZERO_NULL,                          /* connecting */
-  mqtt_doing,                         /* doing */
-  ZERO_NULL,                          /* proto_getsock */
-  mqtt_getsock,                       /* doing_getsock */
-  ZERO_NULL,                          /* domore_getsock */
-  ZERO_NULL,                          /* perform_getsock */
-  ZERO_NULL,                          /* disconnect */
-  ZERO_NULL,                          /* readwrite */
-  ZERO_NULL,                          /* connection_check */
-  ZERO_NULL,                          /* attach connection */
-  PORT_MQTT,                          /* defport */
-  CURLPROTO_MQTT,                     /* protocol */
-  CURLPROTO_MQTT,                     /* family */
-  PROTOPT_NONE                        /* flags */
+  MQTT_NOSTATE /* 7 - never used an actual state */
 };
 
+struct mqtt_conn {
+  enum mqttstate state;
+  enum mqttstate nextstate; /* switch to this after remaining length is
+                               done */
+  unsigned int packetid;
+};
+
+/* protocol-specific transfer-related data */
+struct MQTT {
+  struct dynbuf sendbuf;
+  /* when receiving */
+  struct dynbuf recvbuf;
+  size_t npacket; /* byte counter */
+  size_t remaining_length;
+  unsigned char pkt_hd[4]; /* for decoding the arriving packet length */
+  struct curltime lastTime; /* last time we sent or received data */
+  unsigned char firstbyte;
+  BIT(pingsent); /* 1 while we wait for ping response */
+};
+
+static void mqtt_easy_dtor(void *key, size_t klen, void *entry)
+{
+  struct MQTT *mq = entry;
+  (void)key;
+  (void)klen;
+  curlx_dyn_free(&mq->sendbuf);
+  curlx_dyn_free(&mq->recvbuf);
+  curlx_free(mq);
+}
+
+static void mqtt_conn_dtor(void *key, size_t klen, void *entry)
+{
+  (void)key;
+  (void)klen;
+  curlx_free(entry);
+}
+
 static CURLcode mqtt_setup_conn(struct Curl_easy *data,
                                 struct connectdata *conn)
 {
-  /* allocate the HTTP-specific struct for the Curl_easy, only to survive
-     during this request */
+  /* setup MQTT specific meta data at easy handle and connection */
+  struct mqtt_conn *mqtt;
   struct MQTT *mq;
-  (void)conn;
-  DEBUGASSERT(data->req.p.mqtt == NULL);
 
-  mq = calloc(1, sizeof(struct MQTT));
+  mqtt = curlx_calloc(1, sizeof(*mqtt));
+  if(!mqtt ||
+     Curl_conn_meta_set(conn, CURL_META_MQTT_CONN, mqtt, mqtt_conn_dtor))
+    return CURLE_OUT_OF_MEMORY;
+
+  mq = curlx_calloc(1, sizeof(struct MQTT));
   if(!mq)
     return CURLE_OUT_OF_MEMORY;
-  data->req.p.mqtt = mq;
+  curlx_dyn_init(&mq->recvbuf, DYN_MQTT_RECV);
+  curlx_dyn_init(&mq->sendbuf, DYN_MQTT_SEND);
+  if(Curl_meta_set(data, CURL_META_MQTT_EASY, mq, mqtt_easy_dtor))
+    return CURLE_OUT_OF_MEMORY;
   return CURLE_OK;
 }
 
 static CURLcode mqtt_send(struct Curl_easy *data,
-                          char *buf, size_t len)
+                          const char *buf, size_t len)
 {
-  CURLcode result = CURLE_OK;
-  struct MQTT *mq = data->req.p.mqtt;
-  ssize_t n;
-  result = Curl_nwrite(data, FIRSTSOCKET, buf, len, &n);
+  size_t n;
+  CURLcode result;
+  struct MQTT *mq = Curl_meta_get(data, CURL_META_MQTT_EASY);
+
+  if(!mq)
+    return CURLE_FAILED_INIT;
+
+  result = Curl_xfer_send(data, buf, len, FALSE, &n);
   if(result)
     return result;
-  Curl_debug(data, CURLINFO_HEADER_OUT, buf, (size_t)n);
-  if(len != (size_t)n) {
+  mq->lastTime = *Curl_pgrs_now(data);
+  Curl_debug(data, CURLINFO_HEADER_OUT, buf, n);
+  if(len != n) {
     size_t nsend = len - n;
-    char *sendleftovers = Curl_memdup(&buf[n], nsend);
-    if(!sendleftovers)
-      return CURLE_OUT_OF_MEMORY;
-    mq->sendleftovers = sendleftovers;
-    mq->nsend = nsend;
-  }
-  else {
-    mq->sendleftovers = NULL;
-    mq->nsend = 0;
+    if(curlx_dyn_len(&mq->sendbuf)) {
+      DEBUGASSERT(curlx_dyn_len(&mq->sendbuf) >= nsend);
+      result = curlx_dyn_tail(&mq->sendbuf, nsend); /* keep this much */
+    }
+    else {
+      result = curlx_dyn_addn(&mq->sendbuf, &buf[n], nsend);
+    }
   }
+  else
+    curlx_dyn_reset(&mq->sendbuf);
   return result;
 }
 
 /* Generic function called by the multi interface to figure out what socket(s)
    to wait for and for what actions during the DOING and PROTOCONNECT
    states */
-static int mqtt_getsock(struct Curl_easy *data,
-                        struct connectdata *conn,
-                        curl_socket_t *sock)
+static CURLcode mqtt_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps)
 {
-  (void)data;
-  sock[0] = conn->sock[FIRSTSOCKET];
-  return GETSOCK_READSOCK(FIRSTSOCKET);
+  return Curl_pollset_add_in(data, ps, data->conn->sock[FIRSTSOCKET]);
 }
 
 static int mqtt_encode_len(char *buf, size_t len)
 {
-  unsigned char encoded;
   int i;
 
-  for(i = 0; (len > 0) && (i<4); i++) {
+  for(i = 0; (len > 0) && (i < 4); i++) {
+    unsigned char encoded;
     encoded = len % 0x80;
     len /= 0x80;
     if(len)
       encoded |= 0x80;
-    buf[i] = encoded;
+    buf[i] = (char)encoded;
   }
 
   return i;
@@ -168,7 +187,7 @@ static int mqtt_encode_len(char *buf, size_t len)
 
 /* add the passwd to the CONNECT packet */
 static int add_passwd(const char *passwd, const size_t plen,
-                       char *pkt, const size_t start, int remain_pos)
+                      char *pkt, const size_t start, int remain_pos)
 {
   /* magic number that need to be set properly */
   const size_t conn_flags_pos = remain_pos + 8;
@@ -252,9 +271,8 @@ static CURLcode mqtt_connect(struct Curl_easy *data)
   int rc = 0;
   /* remain length */
   int remain_pos = 0;
-  char remain[4] = {0};
+  char remain[4] = { 0 };
   size_t packetlen = 0;
-  size_t payloadlen = 0;
   size_t start_user = 0;
   size_t start_pwd = 0;
   char client_id[MQTT_CLIENTID_LEN + 1] = "curl";
@@ -262,21 +280,14 @@ static CURLcode mqtt_connect(struct Curl_easy *data)
   char *packet = NULL;
 
   /* extracting username from request */
-  const char *username = data->state.aptr.user ?
-    data->state.aptr.user : "";
-  const size_t ulen = strlen(username);
-  /* extracting password from request */
-  const char *passwd = data->state.aptr.passwd ?
-    data->state.aptr.passwd : "";
-  const size_t plen = strlen(passwd);
-
-  payloadlen = ulen + plen + MQTT_CLIENTID_LEN + 2;
-  /* The plus 2 are for the MSB and LSB describing the length of the string to
-   * be added on the payload. Refer to spec 1.5.2 and 1.5.4 */
-  if(ulen)
-    payloadlen += 2;
-  if(plen)
-    payloadlen += 2;
+  struct Curl_creds *creds = data->state.creds;
+  const size_t ulen = creds ? strlen(creds->user) : 0;
+  const size_t plen = creds ? strlen(creds->passwd) : 0;
+  const size_t payloadlen = ulen + plen + MQTT_CLIENTID_LEN + 2 +
+  /* The plus 2s below are for the MSB and LSB describing the length of the
+     string to be added on the payload. Refer to spec 1.5.2 and 1.5.4 */
+    (ulen ? 2 : 0) +
+    (plen ? 2 : 0);
 
   /* getting how much occupy the remain length */
   remain_pos = mqtt_encode_len(remain, payloadlen + 10);
@@ -285,39 +296,38 @@ static CURLcode mqtt_connect(struct Curl_easy *data)
   packetlen = payloadlen + 10 + remain_pos + 1;
 
   /* allocating packet */
-  if(packetlen > 268435455)
+  if(packetlen > 0xFFFFFFF)
     return CURLE_WEIRD_SERVER_REPLY;
-  packet = malloc(packetlen);
+  packet = curlx_calloc(1, packetlen);
   if(!packet)
     return CURLE_OUT_OF_MEMORY;
-  memset(packet, 0, packetlen);
 
   /* set initial values for the CONNECT packet */
   pos = init_connpack(packet, remain, remain_pos);
 
-  result = Curl_rand_hex(data, (unsigned char *)&client_id[clen],
-                         MQTT_CLIENTID_LEN - clen + 1);
+  result = Curl_rand_alnum(data, (unsigned char *)&client_id[clen],
+                           MQTT_CLIENTID_LEN - clen + 1);
   /* add client id */
   rc = add_client_id(client_id, strlen(client_id), packet, pos + 1);
   if(rc) {
-    failf(data, "Client ID length mismatched: [%lu]", strlen(client_id));
+    failf(data, "Client ID length mismatched: [%zu]", strlen(client_id));
     result = CURLE_WEIRD_SERVER_REPLY;
     goto end;
   }
   infof(data, "Using client id '%s'", client_id);
 
-  /* position where starts the user payload */
+  /* position where the user payload starts */
   start_user = pos + 3 + MQTT_CLIENTID_LEN;
-  /* position where starts the password payload */
+  /* position where the password payload starts */
   start_pwd = start_user + ulen;
-  /* if user name was provided, add it to the packet */
+  /* if username was provided, add it to the packet */
   if(ulen) {
     start_pwd += 2;
 
-    rc = add_user(username, ulen,
+    rc = add_user(creds->user, ulen,
                   (unsigned char *)packet, start_user, remain_pos);
     if(rc) {
-      failf(data, "Username is too large: [%lu]", ulen);
+      failf(data, "Username too long: [%zu]", ulen);
       result = CURLE_WEIRD_SERVER_REPLY;
       goto end;
     }
@@ -325,9 +335,9 @@ static CURLcode mqtt_connect(struct Curl_easy *data)
 
   /* if passwd was provided, add it to the packet */
   if(plen) {
-    rc = add_passwd(passwd, plen, packet, start_pwd, remain_pos);
+    rc = add_passwd(creds->passwd, plen, packet, start_pwd, remain_pos);
     if(rc) {
-      failf(data, "Password is too large: [%lu]", plen);
+      failf(data, "Password too long: [%zu]", plen);
       result = CURLE_WEIRD_SERVER_REPLY;
       goto end;
     }
@@ -338,56 +348,94 @@ static CURLcode mqtt_connect(struct Curl_easy *data)
 
 end:
   if(packet)
-    free(packet);
-  Curl_safefree(data->state.aptr.user);
-  Curl_safefree(data->state.aptr.passwd);
+    curlx_free(packet);
+  Curl_creds_unlink(&data->state.creds);
   return result;
 }
 
 static CURLcode mqtt_disconnect(struct Curl_easy *data)
 {
-  CURLcode result = CURLE_OK;
-  struct MQTT *mq = data->req.p.mqtt;
-  result = mqtt_send(data, (char *)"\xe0\x00", 2);
-  Curl_safefree(mq->sendleftovers);
-  return result;
+  return mqtt_send(data, "\xe0\x00", 2);
+}
+
+static CURLcode mqtt_recv_atleast(struct Curl_easy *data, size_t nbytes)
+{
+  struct MQTT *mq = Curl_meta_get(data, CURL_META_MQTT_EASY);
+  size_t rlen;
+  CURLcode result;
+
+  if(!mq)
+    return CURLE_FAILED_INIT;
+  rlen = curlx_dyn_len(&mq->recvbuf);
+
+  if(rlen < nbytes) {
+    unsigned char readbuf[1024];
+    size_t nread;
+
+    DEBUGASSERT(nbytes - rlen < sizeof(readbuf));
+    result = Curl_xfer_recv(data, (char *)readbuf, nbytes - rlen, &nread);
+    if(result)
+      return result;
+    if(!nread) /* EOF */
+       return CURLE_RECV_ERROR;
+    if(curlx_dyn_addn(&mq->recvbuf, readbuf, nread))
+      return CURLE_OUT_OF_MEMORY;
+    rlen = curlx_dyn_len(&mq->recvbuf);
+  }
+  return (rlen >= nbytes) ? CURLE_OK : CURLE_AGAIN;
+}
+
+static void mqtt_recv_consume(struct Curl_easy *data, size_t nbytes)
+{
+  struct MQTT *mq = Curl_meta_get(data, CURL_META_MQTT_EASY);
+  DEBUGASSERT(mq);
+  if(mq) {
+    size_t rlen = curlx_dyn_len(&mq->recvbuf);
+    if(rlen <= nbytes)
+      curlx_dyn_reset(&mq->recvbuf);
+    else
+      curlx_dyn_tail(&mq->recvbuf, rlen - nbytes);
+  }
 }
 
 static CURLcode mqtt_verify_connack(struct Curl_easy *data)
 {
+  struct MQTT *mq = Curl_meta_get(data, CURL_META_MQTT_EASY);
   CURLcode result;
-  struct connectdata *conn = data->conn;
-  curl_socket_t sockfd = conn->sock[FIRSTSOCKET];
-  unsigned char readbuf[MQTT_CONNACK_LEN];
-  ssize_t nread;
+  const char *ptr;
 
-  result = Curl_read(data, sockfd, (char *)readbuf, MQTT_CONNACK_LEN, &nread);
-  if(result)
-    goto fail;
-
-  Curl_debug(data, CURLINFO_HEADER_IN, (char *)readbuf, (size_t)nread);
-
-  /* fixme */
-  if(nread < MQTT_CONNACK_LEN) {
-    result = CURLE_WEIRD_SERVER_REPLY;
-    goto fail;
+  DEBUGASSERT(mq);
+  if(!mq)
+    return CURLE_FAILED_INIT;
+  if(mq->remaining_length != 2) {
+    failf(data, "CONNACK expected Remaining Length 2, got %zu",
+          mq->remaining_length);
+    return CURLE_WEIRD_SERVER_REPLY;
   }
 
+  result = mqtt_recv_atleast(data, MQTT_CONNACK_LEN);
+  if(result)
+    return result;
+
   /* verify CONNACK */
-  if(readbuf[0] != 0x00 || readbuf[1] != 0x00) {
-    failf(data, "Expected %02x%02x but got %02x%02x",
-          0x00, 0x00, readbuf[0], readbuf[1]);
-    result = CURLE_WEIRD_SERVER_REPLY;
-  }
+  DEBUGASSERT(curlx_dyn_len(&mq->recvbuf) >= MQTT_CONNACK_LEN);
+  ptr = curlx_dyn_ptr(&mq->recvbuf);
+  Curl_debug(data, CURLINFO_HEADER_IN, ptr, MQTT_CONNACK_LEN);
 
-fail:
-  return result;
+  if(ptr[0] != 0x00 || ptr[1] != 0x00) {
+    failf(data, "Expected %02x%02x but got %02x%02x",
+          0x00U, 0x00U, (unsigned char)ptr[0], (unsigned char)ptr[1]);
+    curlx_dyn_reset(&mq->recvbuf);
+    return CURLE_WEIRD_SERVER_REPLY;
+  }
+  mqtt_recv_consume(data, MQTT_CONNACK_LEN);
+  return CURLE_OK;
 }
 
 static CURLcode mqtt_get_topic(struct Curl_easy *data,
                                char **topic, size_t *topiclen)
 {
-  char *path = data->state.up.path;
+  const char *path = data->state.up.path;
   CURLcode result = CURLE_URL_MALFORMAT;
   if(strlen(path) > 1) {
     result = Curl_urldecode(path + 1, 0, topic, topiclen, REJECT_NADA);
@@ -412,19 +460,23 @@ static CURLcode mqtt_subscribe(struct Curl_easy *data)
   char encodedsize[4];
   size_t n;
   struct connectdata *conn = data->conn;
+  struct mqtt_conn *mqtt = Curl_conn_meta_get(conn, CURL_META_MQTT_CONN);
+
+  if(!mqtt)
+    return CURLE_FAILED_INIT;
 
   result = mqtt_get_topic(data, &topic, &topiclen);
   if(result)
     goto fail;
 
-  conn->proto.mqtt.packetid++;
+  mqtt->packetid++;
 
   packetlen = topiclen + 5; /* packetid + topic (has a two byte length field)
                                + 2 bytes topic length + QoS byte */
   n = mqtt_encode_len((char *)encodedsize, packetlen);
   packetlen += n + 1; /* add one for the control packet type byte */
 
-  packet = malloc(packetlen);
+  packet = curlx_malloc(packetlen);
   if(!packet) {
     result = CURLE_OUT_OF_MEMORY;
     goto fail;
@@ -432,18 +484,18 @@ static CURLcode mqtt_subscribe(struct Curl_easy *data)
 
   packet[0] = MQTT_MSG_SUBSCRIBE;
   memcpy(&packet[1], encodedsize, n);
-  packet[1 + n] = (conn->proto.mqtt.packetid >> 8) & 0xff;
-  packet[2 + n] = conn->proto.mqtt.packetid & 0xff;
+  packet[1 + n] = (mqtt->packetid >> 8) & 0xff;
+  packet[2 + n] = mqtt->packetid & 0xff;
   packet[3 + n] = (topiclen >> 8) & 0xff;
-  packet[4 + n ] = topiclen & 0xff;
+  packet[4 + n] = topiclen & 0xff;
   memcpy(&packet[5 + n], topic, topiclen);
   packet[5 + n + topiclen] = 0; /* QoS zero */
 
-  result = mqtt_send(data, (char *)packet, packetlen);
+  result = mqtt_send(data, (const char *)packet, packetlen);
 
 fail:
-  free(topic);
-  free(packet);
+  curlx_free(topic);
+  curlx_free(packet);
   return result;
 }
 
@@ -452,35 +504,44 @@ fail:
  */
 static CURLcode mqtt_verify_suback(struct Curl_easy *data)
 {
-  CURLcode result;
+  struct MQTT *mq = Curl_meta_get(data, CURL_META_MQTT_EASY);
   struct connectdata *conn = data->conn;
-  curl_socket_t sockfd = conn->sock[FIRSTSOCKET];
-  unsigned char readbuf[MQTT_SUBACK_LEN];
-  ssize_t nread;
-  struct mqtt_conn *mqtt = &conn->proto.mqtt;
+  struct mqtt_conn *mqtt = Curl_conn_meta_get(conn, CURL_META_MQTT_CONN);
+  CURLcode result;
+  const char *ptr;
 
-  result = Curl_read(data, sockfd, (char *)readbuf, MQTT_SUBACK_LEN, &nread);
+  if(!mqtt || !mq)
+    return CURLE_FAILED_INIT;
+
+  if(mq->remaining_length != 3) {
+    failf(data, "SUBACK expected Remaining Length 3, got %zu",
+          mq->remaining_length);
+    return CURLE_WEIRD_SERVER_REPLY;
+  }
+
+  result = mqtt_recv_atleast(data, MQTT_SUBACK_LEN);
   if(result)
     goto fail;
 
-  Curl_debug(data, CURLINFO_HEADER_IN, (char *)readbuf, (size_t)nread);
+  /* verify SUBACK */
+  DEBUGASSERT(curlx_dyn_len(&mq->recvbuf) >= MQTT_SUBACK_LEN);
+  ptr = curlx_dyn_ptr(&mq->recvbuf);
+  Curl_debug(data, CURLINFO_HEADER_IN, ptr, MQTT_SUBACK_LEN);
 
-  /* fixme */
-  if(nread < MQTT_SUBACK_LEN) {
+  if(((unsigned char)ptr[0]) != ((mqtt->packetid >> 8) & 0xff) ||
+     ((unsigned char)ptr[1]) != (mqtt->packetid & 0xff) ||
+     ptr[2] != 0x00) {
+    curlx_dyn_reset(&mq->recvbuf);
     result = CURLE_WEIRD_SERVER_REPLY;
     goto fail;
   }
-
-  /* verify SUBACK */
-  if(readbuf[0] != ((mqtt->packetid >> 8) & 0xff) ||
-     readbuf[1] != (mqtt->packetid & 0xff) ||
-     readbuf[2] != 0x00)
-    result = CURLE_WEIRD_SERVER_REPLY;
-
+  mqtt_recv_consume(data, MQTT_SUBACK_LEN);
 fail:
   return result;
 }
 
+#define MAX_MQTT_MESSAGE_SIZE 0xFFFFFFF
+
 static CURLcode mqtt_publish(struct Curl_easy *data)
 {
   CURLcode result;
@@ -495,12 +556,15 @@ static CURLcode mqtt_publish(struct Curl_easy *data)
   char encodedbytes[4];
   curl_off_t postfieldsize = data->set.postfieldsize;
 
-  if(!payload)
+  if(!payload) {
+    DEBUGF(infof(data, "mqtt_publish without payload, return bad arg"));
     return CURLE_BAD_FUNCTION_ARGUMENT;
-  if(postfieldsize < 0)
+  }
+  if(!curlx_sotouz_fits(postfieldsize, &payloadlen)) {
+    if(postfieldsize > 0) /* off_t does not fit into size_t */
+      return CURLE_BAD_FUNCTION_ARGUMENT;
     payloadlen = strlen(payload);
-  else
-    payloadlen = (size_t)postfieldsize;
+  }
 
   result = mqtt_get_topic(data, &topic, &topiclen);
   if(result)
@@ -508,9 +572,13 @@ static CURLcode mqtt_publish(struct Curl_easy *data)
 
   remaininglength = payloadlen + 2 + topiclen;
   encodelen = mqtt_encode_len(encodedbytes, remaininglength);
+  if(remaininglength > (MAX_MQTT_MESSAGE_SIZE - encodelen - 1)) {
+    result = CURLE_TOO_LARGE;
+    goto fail;
+  }
 
   /* add the control byte and the encoded remaining length */
-  pkt = malloc(remaininglength + 1 + encodelen);
+  pkt = curlx_malloc(remaininglength + 1 + encodelen);
   if(!pkt) {
     result = CURLE_OUT_OF_MEMORY;
     goto fail;
@@ -526,16 +594,17 @@ static CURLcode mqtt_publish(struct Curl_easy *data)
   i += topiclen;
   memcpy(&pkt[i], payload, payloadlen);
   i += payloadlen;
-  result = mqtt_send(data, (char *)pkt, i);
+  result = mqtt_send(data, (const char *)pkt, i);
 
 fail:
-  free(pkt);
-  free(topic);
+  curlx_free(pkt);
+  curlx_free(topic);
   return result;
 }
 
-static size_t mqtt_decode_len(unsigned char *buf,
-                              size_t buflen, size_t *lenbytes)
+/* return FALSE on success, TRUE on error */
+static bool mqtt_decode_len(size_t *lenp, const unsigned char *buf,
+                            size_t buflen)
 {
   size_t len = 0;
   size_t mult = 1;
@@ -543,19 +612,22 @@ static size_t mqtt_decode_len(unsigned char *buf,
   unsigned char encoded = 128;
 
   for(i = 0; (i < buflen) && (encoded & 128); i++) {
+    if(i == 4)
+      return TRUE; /* bad size */
     encoded = buf[i];
     len += (encoded & 127) * mult;
     mult *= 128;
   }
+  if(encoded & 128)
+    /* truncated size */
+    return TRUE;
 
-  if(lenbytes)
-    *lenbytes = i;
-
-  return len;
+  *lenp = len;
+  return FALSE;
 }
 
-#ifdef CURLDEBUG
-static const char *statenames[]={
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
+static const char *statenames[] = {
   "MQTT_FIRST",
   "MQTT_REMAINING_LENGTH",
   "MQTT_CONNACK",
@@ -574,34 +646,35 @@ static void mqstate(struct Curl_easy *data,
                     enum mqttstate nextstate) /* used if state == FIRST */
 {
   struct connectdata *conn = data->conn;
-  struct mqtt_conn *mqtt = &conn->proto.mqtt;
-#ifdef CURLDEBUG
+  struct mqtt_conn *mqtt = Curl_conn_meta_get(conn, CURL_META_MQTT_CONN);
+  DEBUGASSERT(mqtt);
+  if(!mqtt)
+    return;
+#ifdef DEBUGBUILD
   infof(data, "%s (from %s) (next is %s)",
         statenames[state],
         statenames[mqtt->state],
-        (state == MQTT_FIRST)? statenames[nextstate] : "");
+        (state == MQTT_FIRST) ? statenames[nextstate] : "");
 #endif
   mqtt->state = state;
   if(state == MQTT_FIRST)
     mqtt->nextstate = nextstate;
 }
 
-
-/* for the publish packet */
-#define MQTT_HEADER_LEN 5    /* max 5 bytes */
-
 static CURLcode mqtt_read_publish(struct Curl_easy *data, bool *done)
 {
   CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
-  curl_socket_t sockfd = conn->sock[FIRSTSOCKET];
-  ssize_t nread;
-  unsigned char *pkt = (unsigned char *)data->state.buffer;
+  size_t nread;
   size_t remlen;
-  struct mqtt_conn *mqtt = &conn->proto.mqtt;
-  struct MQTT *mq = data->req.p.mqtt;
+  struct mqtt_conn *mqtt = Curl_conn_meta_get(conn, CURL_META_MQTT_CONN);
+  struct MQTT *mq = Curl_meta_get(data, CURL_META_MQTT_EASY);
   unsigned char packet;
 
+  DEBUGASSERT(mqtt);
+  if(!mqtt || !mq)
+    return CURLE_FAILED_INIT;
+
   switch(mqtt->state) {
 MQTT_SUBACK_COMING:
   case MQTT_SUBACK_COMING:
@@ -645,16 +718,16 @@ MQTT_SUBACK_COMING:
     data->req.bytecount = 0;
     data->req.size = remlen;
     mq->npacket = remlen; /* get this many bytes */
-    /* FALLTHROUGH */
+    FALLTHROUGH();
   case MQTT_PUB_REMAIN: {
     /* read rest of packet, but no more. Cap to buffer size */
-    struct SingleRequest *k = &data->req;
+    char buffer[4 * 1024];
     size_t rest = mq->npacket;
-    if(rest > (size_t)data->set.buffer_size)
-      rest = (size_t)data->set.buffer_size;
-    result = Curl_read(data, sockfd, (char *)pkt, rest, &nread);
+    if(rest > sizeof(buffer))
+      rest = sizeof(buffer);
+    result = Curl_xfer_recv(data, buffer, rest, &nread);
     if(result) {
-      if(CURLE_AGAIN == result) {
+      if(result == CURLE_AGAIN) {
         infof(data, "EEEE AAAAGAIN");
       }
       goto end;
@@ -664,18 +737,16 @@ MQTT_SUBACK_COMING:
       result = CURLE_PARTIAL_FILE;
       goto end;
     }
-    Curl_debug(data, CURLINFO_DATA_IN, (char *)pkt, (size_t)nread);
 
-    mq->npacket -= nread;
-    k->bytecount += nread;
-    Curl_pgrsSetDownloadCounter(data, k->bytecount);
+    /* we received something */
+    mq->lastTime = *Curl_pgrs_now(data);
 
     /* if QoS is set, message contains packet id */
-
-    result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)pkt, nread);
+    result = Curl_client_write(data, CLIENTWRITE_BODY, buffer, nread);
     if(result)
       goto end;
 
+    mq->npacket -= nread;
     if(!mq->npacket)
       /* no more PUBLISH payload, back to subscribe wait state */
       mqstate(data, MQTT_FIRST, MQTT_PUBWAIT);
@@ -692,12 +763,18 @@ end:
 
 static CURLcode mqtt_do(struct Curl_easy *data, bool *done)
 {
+  struct MQTT *mq = Curl_meta_get(data, CURL_META_MQTT_EASY);
   CURLcode result = CURLE_OK;
   *done = FALSE; /* unconditionally */
 
+  if(!mq)
+    return CURLE_FAILED_INIT;
+  mq->lastTime = *Curl_pgrs_now(data);
+  mq->pingsent = FALSE;
+
   result = mqtt_connect(data);
   if(result) {
-    failf(data, "Error %d sending MQTT CONNECT request", result);
+    failf(data, "Error %d sending MQTT CONNECT request", (int)result);
     return result;
   }
   mqstate(data, MQTT_FIRST, MQTT_CONNACK);
@@ -707,40 +784,78 @@ static CURLcode mqtt_do(struct Curl_easy *data, bool *done)
 static CURLcode mqtt_done(struct Curl_easy *data,
                           CURLcode status, bool premature)
 {
-  struct MQTT *mq = data->req.p.mqtt;
+  struct MQTT *mq = Curl_meta_get(data, CURL_META_MQTT_EASY);
   (void)status;
   (void)premature;
-  Curl_safefree(mq->sendleftovers);
+  if(mq) {
+    curlx_dyn_free(&mq->sendbuf);
+    curlx_dyn_free(&mq->recvbuf);
+  }
   return CURLE_OK;
 }
 
+/* we ping regularly to avoid being disconnected by the server */
+static CURLcode mqtt_ping(struct Curl_easy *data)
+{
+  struct MQTT *mq = Curl_meta_get(data, CURL_META_MQTT_EASY);
+  CURLcode result = CURLE_OK;
+  struct connectdata *conn = data->conn;
+  struct mqtt_conn *mqtt = Curl_conn_meta_get(conn, CURL_META_MQTT_CONN);
+
+  if(!mqtt || !mq)
+    return CURLE_FAILED_INIT;
+
+  if(mqtt->state == MQTT_FIRST &&
+     !mq->pingsent &&
+     data->set.upkeep_interval_ms > 0) {
+    struct curltime t = *Curl_pgrs_now(data);
+    timediff_t diff = curlx_ptimediff_ms(&t, &mq->lastTime);
+
+    if(diff > data->set.upkeep_interval_ms) {
+      /* 0xC0 is PINGREQ, and 0x00 is remaining length */
+      unsigned char packet[2] = { 0xC0, 0x00 };
+      size_t packetlen = sizeof(packet);
+
+      result = mqtt_send(data, (char *)packet, packetlen);
+      if(!result) {
+        mq->pingsent = TRUE;
+      }
+      infof(data, "mqtt_ping: sent ping request.");
+    }
+  }
+  return result;
+}
+
 static CURLcode mqtt_doing(struct Curl_easy *data, bool *done)
 {
+  struct MQTT *mq = Curl_meta_get(data, CURL_META_MQTT_EASY);
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct mqtt_conn *mqtt = &conn->proto.mqtt;
-  struct MQTT *mq = data->req.p.mqtt;
-  ssize_t nread;
-  curl_socket_t sockfd = conn->sock[FIRSTSOCKET];
-  unsigned char *pkt = (unsigned char *)data->state.buffer;
-  unsigned char byte;
+  size_t nread;
+  unsigned char recvbyte;
+  struct mqtt_conn *mqtt = Curl_conn_meta_get(data->conn, CURL_META_MQTT_CONN);
+
+  if(!mqtt || !mq)
+    return CURLE_FAILED_INIT;
 
   *done = FALSE;
 
-  if(mq->nsend) {
+  if(curlx_dyn_len(&mq->sendbuf)) {
     /* send the remainder of an outgoing packet */
-    char *ptr = mq->sendleftovers;
-    result = mqtt_send(data, mq->sendleftovers, mq->nsend);
-    free(ptr);
+    result = mqtt_send(data, curlx_dyn_ptr(&mq->sendbuf),
+                       curlx_dyn_len(&mq->sendbuf));
     if(result)
       return result;
   }
 
-  infof(data, "mqtt_doing: state [%d]", (int) mqtt->state);
+  result = mqtt_ping(data);
+  if(result)
+    return result;
+
+  infof(data, "mqtt_doing: state [%d]", (int)mqtt->state);
   switch(mqtt->state) {
   case MQTT_FIRST:
     /* Read the initial byte only */
-    result = Curl_read(data, sockfd, (char *)&mq->firstbyte, 1, &nread);
+    result = Curl_xfer_recv(data, (char *)&mq->firstbyte, 1, &nread);
     if(result)
       break;
     else if(!nread) {
@@ -749,27 +864,52 @@ static CURLcode mqtt_doing(struct Curl_easy *data, bool *done)
       result = CURLE_RECV_ERROR;
       break;
     }
-    Curl_debug(data, CURLINFO_HEADER_IN, (char *)&mq->firstbyte, 1);
+    Curl_debug(data, CURLINFO_HEADER_IN, (const char *)&mq->firstbyte, 1);
+
+    /* we received something */
+    mq->lastTime = *Curl_pgrs_now(data);
+
     /* remember the first byte */
     mq->npacket = 0;
     mqstate(data, MQTT_REMAINING_LENGTH, MQTT_NOSTATE);
-    /* FALLTHROUGH */
+    FALLTHROUGH();
   case MQTT_REMAINING_LENGTH:
     do {
-      result = Curl_read(data, sockfd, (char *)&byte, 1, &nread);
-      if(!nread)
+      result = Curl_xfer_recv(data, (char *)&recvbyte, 1, &nread);
+      if(result || !nread)
         break;
-      Curl_debug(data, CURLINFO_HEADER_IN, (char *)&byte, 1);
-      pkt[mq->npacket++] = byte;
-    } while((byte & 0x80) && (mq->npacket < 4));
-    if(nread && (byte & 0x80))
+      Curl_debug(data, CURLINFO_HEADER_IN, (const char *)&recvbyte, 1);
+      mq->pkt_hd[mq->npacket++] = recvbyte;
+    } while((recvbyte & 0x80) && (mq->npacket < 4));
+    if(!result && nread && (recvbyte & 0x80))
       /* MQTT supports up to 127 * 128^0 + 127 * 128^1 + 127 * 128^2 +
          127 * 128^3 bytes. server tried to send more */
       result = CURLE_WEIRD_SERVER_REPLY;
     if(result)
       break;
-    mq->remaining_length = mqtt_decode_len(&pkt[0], mq->npacket, NULL);
+    if(mqtt_decode_len(&mq->remaining_length, mq->pkt_hd, mq->npacket)) {
+      result = CURLE_WEIRD_SERVER_REPLY;
+      break;
+    }
     mq->npacket = 0;
+    /* PINGRESP and DISCONNECT must have remaining_length == 0 and
+     * reserved bits (low nibble) must be zero per MQTT 3.1.1
+     * sections 2.2.2, 3.13.1 and 3.14.1. Reject before state
+     * dispatch to prevent nextstate confusion. */
+    {
+      const unsigned char type = mq->firstbyte & 0xF0;
+      const unsigned char reserved = mq->firstbyte & 0x0F;
+      if((type == MQTT_MSG_DISCONNECT || type == MQTT_MSG_PINGRESP) &&
+         (mq->remaining_length || reserved)) {
+        failf(data,
+              "Broker sent malformed %s "
+              "(remaining_length=%zu, header byte=0x%02x)",
+              type == MQTT_MSG_DISCONNECT ? "DISCONNECT" : "PINGRESP",
+              mq->remaining_length, mq->firstbyte);
+        result = CURLE_WEIRD_SERVER_REPLY;
+        break;
+      }
+    }
     if(mq->remaining_length) {
       mqstate(data, mqtt->nextstate, MQTT_NOSTATE);
       break;
@@ -780,6 +920,13 @@ static CURLcode mqtt_doing(struct Curl_easy *data, bool *done)
       infof(data, "Got DISCONNECT");
       *done = TRUE;
     }
+
+    /* ping response */
+    if(mq->firstbyte == MQTT_MSG_PINGRESP) {
+      infof(data, "Received ping response.");
+      mq->pingsent = FALSE;
+      mqstate(data, MQTT_FIRST, MQTT_PUBWAIT);
+    }
     break;
   case MQTT_CONNACK:
     result = mqtt_verify_connack(data);
@@ -819,4 +966,65 @@ static CURLcode mqtt_doing(struct Curl_easy *data, bool *done)
   return result;
 }
 
+#ifdef USE_SSL
+
+static CURLcode mqtts_connecting(struct Curl_easy *data, bool *done)
+{
+  struct connectdata *conn = data->conn;
+  CURLcode result;
+
+  result = Curl_conn_connect(data, FIRSTSOCKET, TRUE, done);
+  if(result)
+    connclose(conn, "Failed TLS connection");
+  return result;
+}
+
+/*
+ * MQTTS protocol.
+ */
+const struct Curl_protocol Curl_protocol_mqtts = {
+  mqtt_setup_conn,                    /* setup_connection */
+  mqtt_do,                            /* do_it */
+  mqtt_done,                          /* done */
+  ZERO_NULL,                          /* do_more */
+  ZERO_NULL,                          /* connect_it */
+  mqtts_connecting,                   /* connecting */
+  mqtt_doing,                         /* doing */
+  ZERO_NULL,                          /* proto_pollset */
+  mqtt_pollset,                       /* doing_pollset */
+  ZERO_NULL,                          /* domore_pollset */
+  ZERO_NULL,                          /* perform_pollset */
+  ZERO_NULL,                          /* disconnect */
+  ZERO_NULL,                          /* write_resp */
+  ZERO_NULL,                          /* write_resp_hd */
+  ZERO_NULL,                          /* connection_is_dead */
+  ZERO_NULL,                          /* attach connection */
+  ZERO_NULL,                          /* follow */
+};
+
+#endif
+
+/*
+ * MQTT protocol.
+ */
+const struct Curl_protocol Curl_protocol_mqtt = {
+  mqtt_setup_conn,                    /* setup_connection */
+  mqtt_do,                            /* do_it */
+  mqtt_done,                          /* done */
+  ZERO_NULL,                          /* do_more */
+  ZERO_NULL,                          /* connect_it */
+  ZERO_NULL,                          /* connecting */
+  mqtt_doing,                         /* doing */
+  ZERO_NULL,                          /* proto_pollset */
+  mqtt_pollset,                       /* doing_pollset */
+  ZERO_NULL,                          /* domore_pollset */
+  ZERO_NULL,                          /* perform_pollset */
+  ZERO_NULL,                          /* disconnect */
+  ZERO_NULL,                          /* write_resp */
+  ZERO_NULL,                          /* write_resp_hd */
+  ZERO_NULL,                          /* connection_is_dead */
+  ZERO_NULL,                          /* attach connection */
+  ZERO_NULL,                          /* follow */
+};
+
 #endif /* CURL_DISABLE_MQTT */
diff --git a/third-party/curl/lib/mqtt.h b/third-party/curl/lib/mqtt.h
index 63961366fc..3d95293f12 100644
--- a/third-party/curl/lib/mqtt.h
+++ b/third-party/curl/lib/mqtt.h
@@ -23,39 +23,11 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #ifndef CURL_DISABLE_MQTT
-extern const struct Curl_handler Curl_handler_mqtt;
+extern const struct Curl_protocol Curl_protocol_mqtt;
+#ifdef USE_SSL
+extern const struct Curl_protocol Curl_protocol_mqtts;
+#endif
 #endif
 
-enum mqttstate {
-  MQTT_FIRST,             /* 0 */
-  MQTT_REMAINING_LENGTH,  /* 1 */
-  MQTT_CONNACK,           /* 2 */
-  MQTT_SUBACK,            /* 3 */
-  MQTT_SUBACK_COMING,     /* 4 - the SUBACK remainder */
-  MQTT_PUBWAIT,    /* 5 - wait for publish */
-  MQTT_PUB_REMAIN,  /* 6 - wait for the remainder of the publish */
-
-  MQTT_NOSTATE /* 7 - never used an actual state */
-};
-
-struct mqtt_conn {
-  enum mqttstate state;
-  enum mqttstate nextstate; /* switch to this after remaining length is
-                               done */
-  unsigned int packetid;
-};
-
-/* protocol-specific transfer-related data */
-struct MQTT {
-  char *sendleftovers;
-  size_t nsend; /* size of sendleftovers */
-
-  /* when receiving */
-  size_t npacket; /* byte counter */
-  unsigned char firstbyte;
-  size_t remaining_length;
-};
-
 #endif /* HEADER_CURL_MQTT_H */
diff --git a/third-party/curl/lib/multi.c b/third-party/curl/lib/multi.c
index bb57dbceee..d6ae111d8e 100644
--- a/third-party/curl/lib/multi.c
+++ b/third-party/curl/lib/multi.c
@@ -21,60 +21,40 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include <curl/curl.h>
-
 #include "urldata.h"
 #include "transfer.h"
 #include "url.h"
 #include "cfilters.h"
 #include "connect.h"
 #include "progress.h"
-#include "easyif.h"
-#include "share.h"
+#include "curl_share.h"
 #include "psl.h"
 #include "multiif.h"
+#include "multi_ev.h"
 #include "sendf.h"
-#include "timeval.h"
+#include "curl_trc.h"
 #include "http.h"
 #include "select.h"
-#include "warnless.h"
-#include "speedcheck.h"
+#include "curlx/wait.h"
 #include "conncache.h"
 #include "multihandle.h"
 #include "sigpipe.h"
 #include "vtls/vtls.h"
+#include "vtls/vtls_scache.h"
 #include "http_proxy.h"
 #include "http2.h"
 #include "socketpair.h"
-#include "socks.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "bufref.h"
 
-#ifdef __APPLE__
-
-#define wakeup_write  write
-#define wakeup_read   read
-#define wakeup_close  close
-#define wakeup_create pipe
-
-#else /* __APPLE__ */
-
-#define wakeup_write     swrite
-#define wakeup_read      sread
-#define wakeup_close     sclose
-#define wakeup_create(p) Curl_socketpair(AF_UNIX, SOCK_STREAM, 0, p)
-
-#endif /* __APPLE__ */
+/* initial multi->xfers table size for a full multi */
+#define CURL_XFER_TABLE_SIZE 512
 
 /*
   CURL_SOCKET_HASH_TABLE_SIZE should be a prime number. Increasing it from 97
-  to 911 takes on a 32-bit machine 4 x 804 = 3211 more bytes.  Still, every
-  CURL handle takes 45-50 K memory, therefore this 3K are not significant.
+  to 911 takes on a 32-bit machine 4 x 804 = 3211 more bytes. Still, every
+  curl handle takes 6K memory, therefore this 3K are not significant.
 */
 #ifndef CURL_SOCKET_HASH_TABLE_SIZE
 #define CURL_SOCKET_HASH_TABLE_SIZE 911
@@ -88,66 +68,95 @@
 #define CURL_DNS_HASH_SIZE 71
 #endif
 
+#ifndef CURL_TLS_SESSION_SIZE
+#define CURL_TLS_SESSION_SIZE 25
+#endif
+
 #define CURL_MULTI_HANDLE 0x000bab1e
 
 #ifdef DEBUGBUILD
 /* On a debug build, we want to fail hard on multi handles that
  * are not NULL, but no longer have the MAGIC touch. This gives
  * us early warning on things only discovered by valgrind otherwise. */
-#define GOOD_MULTI_HANDLE(x) \
-  (((x) && (x)->magic == CURL_MULTI_HANDLE)? TRUE: \
+#define GOOD_MULTI_HANDLE(x)                         \
+  (((x) && (x)->magic == CURL_MULTI_HANDLE) ? TRUE : \
   (DEBUGASSERT(!(x)), FALSE))
 #else
 #define GOOD_MULTI_HANDLE(x) \
   ((x) && (x)->magic == CURL_MULTI_HANDLE)
 #endif
 
-static CURLMcode singlesocket(struct Curl_multi *multi,
-                              struct Curl_easy *data);
-static CURLMcode add_next_timeout(struct curltime now,
+static void move_pending_to_connect(struct Curl_multi *multi,
+                                    struct Curl_easy *data);
+static CURLMcode add_next_timeout(const struct curltime *pnow,
                                   struct Curl_multi *multi,
                                   struct Curl_easy *d);
-static CURLMcode multi_timeout(struct Curl_multi *multi,
-                               long *timeout_ms);
+static void multi_timeout(struct Curl_multi *multi,
+                          struct curltime *expire_time,
+                          long *timeout_ms);
 static void process_pending_handles(struct Curl_multi *multi);
-
+static void multi_xfer_bufs_free(struct Curl_multi *multi);
 #ifdef DEBUGBUILD
-static const char * const multi_statename[]={
-  "INIT",
-  "PENDING",
-  "CONNECT",
-  "RESOLVING",
-  "CONNECTING",
-  "TUNNELING",
-  "PROTOCONNECT",
-  "PROTOCONNECTING",
-  "DO",
-  "DOING",
-  "DOING_MORE",
-  "DID",
-  "PERFORMING",
-  "RATELIMITING",
-  "DONE",
-  "COMPLETED",
-  "MSGSENT",
-};
+static void multi_xfer_tbl_dump(struct Curl_multi *multi);
 #endif
 
-/* function pointer called once when switching TO a state */
-typedef void (*init_multistate_func)(struct Curl_easy *data);
-
-/* called in DID state, before PERFORMING state */
-static void before_perform(struct Curl_easy *data)
+static const struct curltime *multi_now(struct Curl_multi *multi)
 {
-  data->req.chunk = FALSE;
-  Curl_pgrsTime(data, TIMER_PRETRANSFER);
+  curlx_pnow(&multi->now);
+  return &multi->now;
 }
 
-static void init_completed(struct Curl_easy *data)
-{
-  /* this is a completed transfer */
+/* function pointer called once when entering a state */
+typedef void (*mstate_enter_func)(struct Curl_easy *data,
+                                  CURLMstate from_state);
 
-  /* Important: reset the conn pointer so that we don't point to memory
+static void mstate_enter_connect(struct Curl_easy *data,
+                                 CURLMstate from_state)
+{
+  (void)from_state;
+  Curl_init_CONNECT(data);
+}
+
+static void mstate_enter_did(struct Curl_easy *data,
+                             CURLMstate from_state)
+{
+  (void)from_state;
+  data->req.chunk = FALSE;
+  Curl_pgrsTime(data, TIMER_PRETRANSFER);
+  if(!CURL_REQ_WANT_SEND(data))
+    Curl_pgrsTime(data, TIMER_POSTRANSFER);
+}
+
+static void mstate_enter_done(struct Curl_easy *data,
+                              CURLMstate from_state)
+{
+  (void)from_state;
+  CURLM_NTFY(data, CURLMNOTIFY_EASY_DONE);
+}
+
+static void mstate_enter_completed(struct Curl_easy *data,
+                                   CURLMstate from_state)
+{
+  /* we sometimes directly jump to COMPLETED, trigger things
+   * we then missed. */
+  if(from_state < MSTATE_DID) {
+    Curl_pgrsTime(data, TIMER_PRETRANSFER);
+    Curl_pgrsTime(data, TIMER_POSTRANSFER);
+    Curl_pgrsTime(data, TIMER_STARTTRANSFER);
+  }
+  Curl_pgrsCompleted(data);
+  if(from_state < MSTATE_DONE)
+    CURLM_NTFY(data, CURLMNOTIFY_EASY_DONE);
+  /* changing to COMPLETED means it is in process and needs to go */
+  DEBUGASSERT(Curl_uint32_bset_contains(&data->multi->process, data->mid));
+  Curl_uint32_bset_remove(&data->multi->process, data->mid);
+  Curl_uint32_bset_remove(&data->multi->pending, data->mid); /* to be sure */
+
+  if(Curl_uint32_bset_empty(&data->multi->process)) {
+    /* free the transfer buffer when we have no more active transfers */
+    multi_xfer_bufs_free(data->multi);
+  }
+  /* Important: reset the conn pointer so that we do not point to memory
      that could be freed anytime */
   Curl_detach_connection(data);
   Curl_expire_clear(data); /* stop all timers */
@@ -161,224 +170,57 @@ static void mstate(struct Curl_easy *data, CURLMstate state
 )
 {
   CURLMstate oldstate = data->mstate;
-  static const init_multistate_func finit[MSTATE_LAST] = {
-    NULL,              /* INIT */
-    NULL,              /* PENDING */
-    Curl_init_CONNECT, /* CONNECT */
-    NULL,              /* RESOLVING */
-    NULL,              /* CONNECTING */
-    NULL,              /* TUNNELING */
-    NULL,              /* PROTOCONNECT */
-    NULL,              /* PROTOCONNECTING */
-    NULL,              /* DO */
-    NULL,              /* DOING */
-    NULL,              /* DOING_MORE */
-    before_perform,    /* DID */
-    NULL,              /* PERFORMING */
-    NULL,              /* RATELIMITING */
-    NULL,              /* DONE */
-    init_completed,    /* COMPLETED */
-    NULL               /* MSGSENT */
+  static const mstate_enter_func state_enter[MSTATE_LAST] = {
+    NULL,                      /* INIT */
+    NULL,                      /* PENDING */
+    NULL,                      /* SETUP */
+    mstate_enter_connect,      /* CONNECT */
+    NULL,                      /* CONNECTING */
+    NULL,                      /* PROTOCONNECT */
+    NULL,                      /* PROTOCONNECTING */
+    NULL,                      /* DO */
+    NULL,                      /* DOING */
+    NULL,                      /* DOING_MORE */
+    mstate_enter_did,          /* DID */
+    NULL,                      /* PERFORMING */
+    NULL,                      /* RATELIMITING */
+    mstate_enter_done,         /* DONE */
+    mstate_enter_completed,    /* COMPLETED */
+    NULL                       /* MSGSENT */
   };
 
-#if defined(DEBUGBUILD) && defined(CURL_DISABLE_VERBOSE_STRINGS)
-  (void) lineno;
-#endif
-
   if(oldstate == state)
-    /* don't bother when the new state is the same as the old state */
+    /* do not bother when the new state is the same as the old state */
     return;
 
-  data->mstate = state;
-
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
-  if(data->mstate >= MSTATE_PENDING &&
-     data->mstate < MSTATE_COMPLETED) {
-    infof(data,
-          "STATE: %s => %s handle %p; line %d",
-          multi_statename[oldstate], multi_statename[data->mstate],
-          (void *)data, lineno);
-  }
+#ifdef DEBUGBUILD
+  NOVERBOSE((void)lineno);
+  CURL_TRC_M(data, "-> [%s] (line %d)", CURL_MSTATE_NAME(state), lineno);
+#else
+  CURL_TRC_M(data, "-> [%s]", CURL_MSTATE_NAME(state));
 #endif
 
-  if(state == MSTATE_COMPLETED) {
-    /* changing to COMPLETED means there's one less easy handle 'alive' */
-    DEBUGASSERT(data->multi->num_alive > 0);
-    data->multi->num_alive--;
-  }
-
-  /* if this state has an init-function, run it */
-  if(finit[state])
-    finit[state](data);
+  /* really switching state */
+  data->mstate = state;
+  if(state_enter[state])
+    state_enter[state](data, oldstate);
 }
 
 #ifndef DEBUGBUILD
-#define multistate(x,y) mstate(x,y)
+#define multistate(x, y) mstate(x, y)
 #else
-#define multistate(x,y) mstate(x,y, __LINE__)
+#define multistate(x, y) mstate(x, y, __LINE__)
 #endif
 
-/*
- * We add one of these structs to the sockhash for each socket
- */
-
-struct Curl_sh_entry {
-  struct Curl_hash transfers; /* hash of transfers using this socket */
-  unsigned int action;  /* what combined action READ/WRITE this socket waits
-                           for */
-  unsigned int users; /* number of transfers using this */
-  void *socketp; /* settable by users with curl_multi_assign() */
-  unsigned int readers; /* this many transfers want to read */
-  unsigned int writers; /* this many transfers want to write */
-};
-/* bits for 'action' having no bits means this socket is not expecting any
-   action */
-#define SH_READ  1
-#define SH_WRITE 2
-
-/* look up a given socket in the socket hash, skip invalid sockets */
-static struct Curl_sh_entry *sh_getentry(struct Curl_hash *sh,
-                                         curl_socket_t s)
+/* multi->proto_hash destructor. Should never be called as elements
+ * MUST be added with their own destructor */
+static void ph_freeentry(void *p)
 {
-  if(s != CURL_SOCKET_BAD) {
-    /* only look for proper sockets */
-    return Curl_hash_pick(sh, (char *)&s, sizeof(curl_socket_t));
-  }
-  return NULL;
-}
-
-#define TRHASH_SIZE 13
-static size_t trhash(void *key, size_t key_length, size_t slots_num)
-{
-  size_t keyval = (size_t)*(struct Curl_easy **)key;
-  (void) key_length;
-
-  return (keyval % slots_num);
-}
-
-static size_t trhash_compare(void *k1, size_t k1_len, void *k2, size_t k2_len)
-{
-  (void)k1_len;
-  (void)k2_len;
-
-  return *(struct Curl_easy **)k1 == *(struct Curl_easy **)k2;
-}
-
-static void trhash_dtor(void *nada)
-{
-  (void)nada;
-}
-
-/*
- * The sockhash has its own separate subhash in each entry that need to be
- * safely destroyed first.
- */
-static void sockhash_destroy(struct Curl_hash *h)
-{
-  struct Curl_hash_iterator iter;
-  struct Curl_hash_element *he;
-
-  DEBUGASSERT(h);
-  Curl_hash_start_iterate(h, &iter);
-  he = Curl_hash_next_element(&iter);
-  while(he) {
-    struct Curl_sh_entry *sh = (struct Curl_sh_entry *)he->ptr;
-    Curl_hash_destroy(&sh->transfers);
-    he = Curl_hash_next_element(&iter);
-  }
-  Curl_hash_destroy(h);
-}
-
-
-/* make sure this socket is present in the hash for this handle */
-static struct Curl_sh_entry *sh_addentry(struct Curl_hash *sh,
-                                         curl_socket_t s)
-{
-  struct Curl_sh_entry *there = sh_getentry(sh, s);
-  struct Curl_sh_entry *check;
-
-  if(there) {
-    /* it is present, return fine */
-    return there;
-  }
-
-  /* not present, add it */
-  check = calloc(1, sizeof(struct Curl_sh_entry));
-  if(!check)
-    return NULL; /* major failure */
-
-  Curl_hash_init(&check->transfers, TRHASH_SIZE, trhash, trhash_compare,
-                 trhash_dtor);
-
-  /* make/add new hash entry */
-  if(!Curl_hash_add(sh, (char *)&s, sizeof(curl_socket_t), check)) {
-    Curl_hash_destroy(&check->transfers);
-    free(check);
-    return NULL; /* major failure */
-  }
-
-  return check; /* things are good in sockhash land */
-}
-
-
-/* delete the given socket + handle from the hash */
-static void sh_delentry(struct Curl_sh_entry *entry,
-                        struct Curl_hash *sh, curl_socket_t s)
-{
-  Curl_hash_destroy(&entry->transfers);
-
-  /* We remove the hash entry. This will end up in a call to
-     sh_freeentry(). */
-  Curl_hash_delete(sh, (char *)&s, sizeof(curl_socket_t));
-}
-
-/*
- * free a sockhash entry
- */
-static void sh_freeentry(void *freethis)
-{
-  struct Curl_sh_entry *p = (struct Curl_sh_entry *) freethis;
-
-  free(p);
-}
-
-static size_t fd_key_compare(void *k1, size_t k1_len, void *k2, size_t k2_len)
-{
-  (void) k1_len; (void) k2_len;
-
-  return (*((curl_socket_t *) k1)) == (*((curl_socket_t *) k2));
-}
-
-static size_t hash_fd(void *key, size_t key_length, size_t slots_num)
-{
-  curl_socket_t fd = *((curl_socket_t *) key);
-  (void) key_length;
-
-  return (fd % slots_num);
-}
-
-/*
- * sh_init() creates a new socket hash and returns the handle for it.
- *
- * Quote from README.multi_socket:
- *
- * "Some tests at 7000 and 9000 connections showed that the socket hash lookup
- * is somewhat of a bottle neck. Its current implementation may be a bit too
- * limiting. It simply has a fixed-size array, and on each entry in the array
- * it has a linked list with entries. So the hash only checks which list to
- * scan through. The code I had used so for used a list with merely 7 slots
- * (as that is what the DNS hash uses) but with 7000 connections that would
- * make an average of 1000 nodes in each list to run through. I upped that to
- * 97 slots (I believe a prime is suitable) and noticed a significant speed
- * increase.  I need to reconsider the hash implementation or use a rather
- * large default value like this. At 9000 connections I was still below 10us
- * per call."
- *
- */
-static void sh_init(struct Curl_hash *hash, int hashsize)
-{
-  Curl_hash_init(hash, hashsize, hash_fd, fd_key_compare,
-                 sh_freeentry);
+  (void)p;
+  /* Always FALSE. Cannot use a 0 assert here since compilers
+   * are not in agreement if they then want a NORETURN attribute or
+   * not. *sigh* */
+  DEBUGASSERT(!p);
 }
 
 /*
@@ -389,140 +231,244 @@ static void sh_init(struct Curl_hash *hash, int hashsize)
  */
 static void multi_addmsg(struct Curl_multi *multi, struct Curl_message *msg)
 {
-  Curl_llist_insert_next(&multi->msglist, multi->msglist.tail, msg,
-                         &msg->list);
+  if(!Curl_llist_count(&multi->msglist))
+    CURLM_NTFY(multi->admin, CURLMNOTIFY_INFO_READ);
+  Curl_llist_append(&multi->msglist, msg, &msg->list);
 }
 
-struct Curl_multi *Curl_multi_handle(int hashsize, /* socket hash */
-                                     int chashsize, /* connection hash */
-                                     int dnssize) /* dns hash */
+struct Curl_multi *Curl_multi_handle(uint32_t xfer_table_size,
+                                     size_t ev_hashsize,  /* event hash */
+                                     size_t chashsize, /* connection hash */
+                                     size_t dnssize,   /* dns hash */
+                                     size_t sesssize)  /* TLS session cache */
 {
-  struct Curl_multi *multi = calloc(1, sizeof(struct Curl_multi));
+  struct Curl_multi *multi = curlx_calloc(1, sizeof(struct Curl_multi));
 
   if(!multi)
     return NULL;
 
   multi->magic = CURL_MULTI_HANDLE;
 
-  Curl_init_dnscache(&multi->hostcache, dnssize);
-
-  sh_init(&multi->sockhash, hashsize);
-
-  if(Curl_conncache_init(&multi->conn_cache, chashsize))
-    goto error;
-
+  Curl_dnscache_init(&multi->dnscache, dnssize);
+  Curl_mntfy_init(multi);
+  Curl_multi_ev_init(multi, ev_hashsize);
+  Curl_uint32_tbl_init(&multi->xfers, NULL);
+  Curl_uint32_bset_init(&multi->process);
+  Curl_uint32_bset_init(&multi->dirty);
+  Curl_uint32_bset_init(&multi->pending);
+  Curl_uint32_bset_init(&multi->msgsent);
+  Curl_hash_init(&multi->proto_hash, 23,
+                 Curl_hash_str, curlx_str_key_compare, ph_freeentry);
   Curl_llist_init(&multi->msglist, NULL);
-  Curl_llist_init(&multi->pending, NULL);
-  Curl_llist_init(&multi->msgsent, NULL);
 
   multi->multiplexing = TRUE;
-
-  /* -1 means it not set by user, use the default value */
-  multi->maxconnects = -1;
   multi->max_concurrent_streams = 100;
+  multi->last_timeout_ms = -1;
+#ifdef ENABLE_WAKEUP
+  multi->wakeup_pair[0] = CURL_SOCKET_BAD;
+  multi->wakeup_pair[1] = CURL_SOCKET_BAD;
+#endif
+
+  if(Curl_mntfy_resize(multi) ||
+     Curl_uint32_bset_resize(&multi->process, xfer_table_size) ||
+     Curl_uint32_bset_resize(&multi->pending, xfer_table_size) ||
+     Curl_uint32_bset_resize(&multi->dirty, xfer_table_size) ||
+     Curl_uint32_bset_resize(&multi->msgsent, xfer_table_size) ||
+     Curl_uint32_tbl_resize(&multi->xfers, xfer_table_size))
+    goto error;
+
+  multi->admin = curl_easy_init();
+  if(!multi->admin)
+    goto error;
+  /* Initialize admin handle to operate inside this multi */
+  multi->admin->multi = multi;
+  multi->admin->state.internal = TRUE;
+  Curl_llist_init(&multi->admin->state.timeoutlist, NULL);
+
+#ifdef DEBUGBUILD
+  if(getenv("CURL_DEBUG"))
+    multi->admin->set.verbose = TRUE;
+#endif
+  Curl_uint32_tbl_add(&multi->xfers, multi->admin, &multi->admin->mid);
+  Curl_uint32_bset_add(&multi->process, multi->admin->mid);
+
+  if(Curl_cshutdn_init(&multi->cshutdn, multi))
+    goto error;
+
+  Curl_cpool_init(&multi->cpool, multi->admin, NULL, chashsize);
+
+#ifdef USE_SSL
+  if(Curl_ssl_scache_create(sesssize, 2, &multi->ssl_scache))
+    goto error;
+#else
+  (void)sesssize;
+#endif
 
 #ifdef USE_WINSOCK
   multi->wsa_event = WSACreateEvent();
   if(multi->wsa_event == WSA_INVALID_EVENT)
     goto error;
-#else
-#ifdef ENABLE_WAKEUP
-  if(wakeup_create(multi->wakeup_pair) < 0) {
-    multi->wakeup_pair[0] = CURL_SOCKET_BAD;
-    multi->wakeup_pair[1] = CURL_SOCKET_BAD;
-  }
-  else if(curlx_nonblock(multi->wakeup_pair[0], TRUE) < 0 ||
-          curlx_nonblock(multi->wakeup_pair[1], TRUE) < 0) {
-    wakeup_close(multi->wakeup_pair[0]);
-    wakeup_close(multi->wakeup_pair[1]);
-    multi->wakeup_pair[0] = CURL_SOCKET_BAD;
-    multi->wakeup_pair[1] = CURL_SOCKET_BAD;
-  }
 #endif
+#ifdef ENABLE_WAKEUP
+  /* When enabled, rely on this to work. We ignore this in previous
+   * versions, but that seems an unnecessary complication. */
+  if(Curl_wakeup_init(multi->wakeup_pair, TRUE) < 0)
+    goto error;
+#endif
+
+  if(Curl_probeipv6(multi))
+    goto error;
+
+#ifdef USE_RESOLV_THREADED
+  if(xfer_table_size < CURL_XFER_TABLE_SIZE) { /* easy multi */
+    if(Curl_async_thrdd_multi_init(multi, 0, 2, 10))
+      goto error;
+  }
+  else { /* real multi handle */
+    if(Curl_async_thrdd_multi_init(multi, 0, 20, 2000))
+      goto error;
+  }
 #endif
 
   return multi;
 
 error:
 
-  sockhash_destroy(&multi->sockhash);
-  Curl_hash_destroy(&multi->hostcache);
-  Curl_conncache_destroy(&multi->conn_cache);
-  free(multi);
+#ifdef USE_RESOLV_THREADED
+  Curl_async_thrdd_multi_destroy(multi, TRUE);
+#endif
+  Curl_multi_ev_cleanup(multi);
+  Curl_hash_destroy(&multi->proto_hash);
+  Curl_dnscache_destroy(&multi->dnscache);
+  Curl_cpool_destroy(&multi->cpool);
+  Curl_cshutdn_destroy(&multi->cshutdn, multi->admin);
+#ifdef USE_SSL
+  Curl_ssl_scache_destroy(multi->ssl_scache);
+#endif
+  if(multi->admin) {
+    Curl_multi_ev_xfer_done(multi, multi->admin);
+    multi->admin->multi = NULL;
+    Curl_close(&multi->admin);
+  }
+  Curl_mntfy_cleanup(multi);
+
+  Curl_uint32_bset_destroy(&multi->process);
+  Curl_uint32_bset_destroy(&multi->dirty);
+  Curl_uint32_bset_destroy(&multi->pending);
+  Curl_uint32_bset_destroy(&multi->msgsent);
+  Curl_uint32_tbl_destroy(&multi->xfers);
+#ifdef ENABLE_WAKEUP
+  Curl_wakeup_destroy(multi->wakeup_pair);
+#endif
+
+  curlx_free(multi);
   return NULL;
 }
 
-struct Curl_multi *curl_multi_init(void)
+CURLM *curl_multi_init(void)
 {
-  return Curl_multi_handle(CURL_SOCKET_HASH_TABLE_SIZE,
+  return Curl_multi_handle(CURL_XFER_TABLE_SIZE,
+                           CURL_SOCKET_HASH_TABLE_SIZE,
                            CURL_CONNECTION_HASH_SIZE,
-                           CURL_DNS_HASH_SIZE);
+                           CURL_DNS_HASH_SIZE,
+                           CURL_TLS_SESSION_SIZE);
 }
 
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
 static void multi_warn_debug(struct Curl_multi *multi, struct Curl_easy *data)
 {
   if(!multi->warned) {
     infof(data, "!!! WARNING !!!");
     infof(data, "This is a debug build of libcurl, "
-          "do not use in production.");
-    multi->warned = true;
+                "do not use in production.");
+    multi->warned = TRUE;
   }
 }
 #else
-#define multi_warn_debug(x,y) Curl_nop_stmt
+#define multi_warn_debug(x, y) Curl_nop_stmt
 #endif
 
-/* returns TRUE if the easy handle is supposed to be present in the main link
-   list */
-static bool in_main_list(struct Curl_easy *data)
+bool Curl_is_connecting(struct Curl_easy *data)
 {
-  return ((data->mstate != MSTATE_PENDING) &&
-          (data->mstate != MSTATE_MSGSENT));
+  return data->mstate < MSTATE_DO;
 }
 
-static void link_easy(struct Curl_multi *multi,
-                      struct Curl_easy *data)
+static CURLMcode multi_assess_wakeup(struct Curl_multi *multi)
 {
-  /* We add the new easy entry last in the list. */
-  data->next = NULL; /* end of the line */
-  if(multi->easyp) {
-    struct Curl_easy *last = multi->easylp;
-    last->next = data;
-    data->prev = last;
-    multi->easylp = data; /* the new last node */
+#ifdef ENABLE_WAKEUP
+  if(multi->socket_cb)
+    return Curl_multi_ev_assess_xfer(multi, multi->admin);
+#else
+  (void)multi;
+#endif
+  return CURLM_OK;
+}
+
+static CURLMcode multi_xfers_add(struct Curl_multi *multi,
+                                 struct Curl_easy *data)
+{
+  uint32_t capacity = Curl_uint32_tbl_capacity(&multi->xfers);
+  uint32_t new_size = 0;
+  /* Prepare to make this into a CURLMOPT_MAX_TRANSFERS, because some
+   * applications may want to prevent a run-away of their memory use. */
+  /* UINT_MAX is our "invalid" id, do not let the table grow up to that. */
+  const uint32_t max_capacity = UINT_MAX - 1;
+
+  if(capacity < max_capacity) {
+    /* We want `multi->xfers` to have "sufficient" free rows, so that we do
+     * not have to reuse the `mid` from a removed easy right away.
+     * Since uint_tbl and uint_bset are memory efficient,
+     * regard less than 25% free as insufficient.
+     * (for low capacities, e.g. multi_easy, 4 or less). */
+    uint32_t used = Curl_uint32_tbl_count(&multi->xfers);
+    uint32_t unused = capacity - used;
+    uint32_t min_unused = CURLMAX(capacity >> 2, 4);
+    if(unused <= min_unused) {
+      /* Make sure the uint arithmetic here works on the corner
+       * cases where we are close to max_capacity or UINT_MAX */
+      if((min_unused >= max_capacity) ||
+         ((max_capacity - min_unused) <= capacity) ||
+         ((UINT_MAX - min_unused - 63) <= capacity)) {
+        new_size = max_capacity; /* can not be larger than this */
+      }
+      else {
+        /* make it a 64 multiple, since our bitsets grow by that and
+         * small (easy_multi) grows to at least 64 on first resize. */
+        new_size = (((used + min_unused) + 63) / 64) * 64;
+      }
+    }
   }
-  else {
-    /* first node, make prev NULL! */
-    data->prev = NULL;
-    multi->easylp = multi->easyp = data; /* both first and last */
+
+  if(new_size > capacity) {
+    /* Grow the bitsets first. Should one fail, we do not need
+     * to downsize the already resized ones. The sets continue
+     * to work properly when larger than the table, but not
+     * the other way around. */
+    CURL_TRC_M(data, "increasing xfer table size to %u", new_size);
+    if(Curl_uint32_bset_resize(&multi->process, new_size) ||
+       Curl_uint32_bset_resize(&multi->dirty, new_size) ||
+       Curl_uint32_bset_resize(&multi->pending, new_size) ||
+       Curl_uint32_bset_resize(&multi->msgsent, new_size) ||
+       Curl_uint32_tbl_resize(&multi->xfers, new_size))
+      return CURLM_OUT_OF_MEMORY;
   }
+
+  /* Insert the easy into the table now */
+  if(!Curl_uint32_tbl_add(&multi->xfers, data, &data->mid)) {
+    /* MUST only happen when table is full */
+    DEBUGASSERT(Curl_uint32_tbl_capacity(&multi->xfers) <=
+                Curl_uint32_tbl_count(&multi->xfers));
+    return CURLM_OUT_OF_MEMORY;
+  }
+  return CURLM_OK;
 }
 
-/* unlink the given easy handle from the linked list of easy handles */
-static void unlink_easy(struct Curl_multi *multi,
-                        struct Curl_easy *data)
+CURLMcode curl_multi_add_handle(CURLM *m, CURL *curl)
 {
-  /* make the previous node point to our next */
-  if(data->prev)
-    data->prev->next = data->next;
-  else
-    multi->easyp = data->next; /* point to first node */
+  CURLMcode mresult;
+  struct Curl_multi *multi = m;
+  struct Curl_easy *data = curl;
 
-  /* make our next point to our previous node */
-  if(data->next)
-    data->next->prev = data->prev;
-  else
-    multi->easylp = data->prev; /* point to last node */
-
-  data->prev = data->next = NULL;
-}
-
-
-CURLMcode curl_multi_add_handle(struct Curl_multi *multi,
-                                struct Curl_easy *data)
-{
-  CURLMcode rc;
   /* First, make some basic checks that the CURLM handle is a good handle */
   if(!GOOD_MULTI_HANDLE(multi))
     return CURLM_BAD_HANDLE;
@@ -542,69 +488,51 @@ CURLMcode curl_multi_add_handle(struct Curl_multi *multi,
   if(multi->dead) {
     /* a "dead" handle cannot get added transfers while any existing easy
        handles are still alive - but if there are none alive anymore, it is
-       fine to start over and unmark the "deadness" of this handle */
-    if(multi->num_alive)
+       fine to start over and unmark the "deadness" of this handle.
+       This means only the admin handle MUST be present. */
+    if((Curl_uint32_tbl_count(&multi->xfers) != 1) ||
+       !Curl_uint32_tbl_contains(&multi->xfers, 0))
       return CURLM_ABORTED_BY_CALLBACK;
     multi->dead = FALSE;
+    Curl_uint32_bset_clear(&multi->process);
+    Curl_uint32_bset_clear(&multi->dirty);
+    Curl_uint32_bset_clear(&multi->pending);
+    Curl_uint32_bset_clear(&multi->msgsent);
   }
 
+  if(data->multi_easy) {
+    /* if this easy handle was previously used for curl_easy_perform(), there
+       is a private multi handle here that we can kill */
+    curl_multi_cleanup(data->multi_easy);
+    data->multi_easy = NULL;
+  }
+
+  /* Insert the easy into the multi->xfers table, assigning it a `mid`. */
+  if(multi_xfers_add(multi, data))
+    return CURLM_OUT_OF_MEMORY;
+
   /* Initialize timeout list for this handle */
   Curl_llist_init(&data->state.timeoutlist, NULL);
 
   /*
-   * No failure allowed in this function beyond this point. And no
-   * modification of easy nor multi handle allowed before this except for
-   * potential multi's connection cache growing which won't be undone in this
-   * function no matter what.
+   * No failure allowed in this function beyond this point. No modification of
+   * easy nor multi handle allowed before this except for potential multi's
+   * connection pool growing which will not be undone in this function no
+   * matter what.
    */
   if(data->set.errorbuffer)
     data->set.errorbuffer[0] = 0;
 
+  data->state.os_errno = 0;
+
   /* make the Curl_easy refer back to this multi handle - before Curl_expire()
      is called. */
   data->multi = multi;
 
-  /* Set the timeout for this handle to expire really soon so that it will
-     be taken care of even when this handle is added in the midst of operation
-     when only the curl_multi_socket() API is used. During that flow, only
-     sockets that time-out or have actions will be dealt with. Since this
-     handle has no action yet, we make sure it times out to get things to
-     happen. */
-  Curl_expire(data, 0, EXPIRE_RUN_NOW);
-
-  /* A somewhat crude work-around for a little glitch in Curl_update_timer()
-     that happens if the lastcall time is set to the same time when the handle
-     is removed as when the next handle is added, as then the check in
-     Curl_update_timer() that prevents calling the application multiple times
-     with the same timer info will not trigger and then the new handle's
-     timeout will not be notified to the app.
-
-     The work-around is thus simply to clear the 'lastcall' variable to force
-     Curl_update_timer() to always trigger a callback to the app when a new
-     easy handle is added */
-  memset(&multi->timer_lastcall, 0, sizeof(multi->timer_lastcall));
-
-  rc = Curl_update_timer(multi);
-  if(rc)
-    return rc;
-
   /* set the easy handle */
   multistate(data, MSTATE_INIT);
-
-  /* for multi interface connections, we share DNS cache automatically if the
-     easy handle's one is currently not set. */
-  if(!data->dns.hostcache ||
-     (data->dns.hostcachetype == HCACHE_NONE)) {
-    data->dns.hostcache = &multi->hostcache;
-    data->dns.hostcachetype = HCACHE_MULTI;
-  }
-
-  /* Point to the shared or multi handle connection cache */
-  if(data->share && (data->share->specifier & (1<< CURL_LOCK_DATA_CONNECT)))
-    data->state.conn_cache = &data->share->conn_cache;
-  else
-    data->state.conn_cache = &multi->conn_cache;
-  data->state.lastconnect_id = -1;
+  /* not yet passed INIT state */
+  data->state.really_alive = FALSE;
 
 #ifdef USE_LIBPSL
   /* Do the same for PSL. */
@@ -614,31 +542,39 @@ CURLMcode curl_multi_add_handle(struct Curl_multi *multi,
     data->psl = &multi->psl;
 #endif
 
-  link_easy(multi, data);
-
-  /* increase the node-counter */
-  multi->num_easy++;
-
-  /* increase the alive-counter */
-  multi->num_alive++;
-
-  CONNCACHE_LOCK(data);
-  /* The closure handle only ever has default timeouts set. To improve the
-     state somewhat we clone the timeouts from each added handle so that the
-     closure handle always has the same timeouts as the most recently added
-     easy handle. */
-  data->state.conn_cache->closure_handle->set.timeout = data->set.timeout;
-  data->state.conn_cache->closure_handle->set.server_response_timeout =
-    data->set.server_response_timeout;
-  data->state.conn_cache->closure_handle->set.no_signal =
-    data->set.no_signal;
-  data->id = data->state.conn_cache->next_easy_id++;
-  if(data->state.conn_cache->next_easy_id <= 0)
-    data->state.conn_cache->next_easy_id = 0;
-  CONNCACHE_UNLOCK(data);
+  /* add the easy handle to the process set */
+  Curl_uint32_bset_add(&multi->process, data->mid);
+  ++multi->xfers_alive;
+  ++multi->xfers_total_ever;
 
+  Curl_cpool_xfer_init(data);
   multi_warn_debug(multi, data);
 
+  /* Make sure the new handle will run */
+  Curl_multi_mark_dirty(data);
+
+  /* Necessary in event based processing, where dirty handles trigger
+   * a timeout callback invocation. */
+  mresult = Curl_update_timer(multi);
+  if(mresult) {
+    data->multi = NULL; /* not anymore */
+    Curl_uint32_tbl_remove(&multi->xfers, data->mid);
+    data->mid = UINT32_MAX;
+    return mresult;
+  }
+
+  /* The admin handle only ever has default timeouts set. To improve the
+     state somewhat we clone the timeouts from each added handle so that the
+     admin handle always has the same timeouts as the most recently added
+     easy handle. */
+  multi->admin->set.timeout = data->set.timeout;
+  multi->admin->set.server_response_timeout =
+    data->set.server_response_timeout;
+  multi->admin->set.no_signal = data->set.no_signal;
+
+  CURL_TRC_M(data, "added to multi, mid=%u, running=%u, total=%u",
+             data->mid, Curl_multi_xfers_running(multi),
+             Curl_uint32_tbl_count(&multi->xfers));
   return CURLM_OK;
 }
 
@@ -653,11 +589,108 @@ static void debug_print_sock_hash(void *p)
 {
   struct Curl_sh_entry *sh = (struct Curl_sh_entry *)p;
 
-  fprintf(stderr, " [readers %u][writers %u]",
-          sh->readers, sh->writers);
+  curl_mfprintf(stderr, " [readers %u][writers %u]",
+                sh->readers, sh->writers);
 }
 #endif
 
+struct multi_done_ctx {
+  BIT(premature);
+};
+
+static bool multi_conn_should_close(struct connectdata *conn,
+                                    struct Curl_easy *data,
+                                    bool premature)
+{
+  /* if conn->bits.close is TRUE, it means that the connection should be
+     closed in spite of everything else. */
+  if(conn->bits.close)
+    return TRUE;
+
+  /* if data->set.reuse_forbid is TRUE, it means the libcurl client has
+     forced us to close this connection. This is ignored for requests taking
+     place in a NTLM/NEGOTIATE authentication handshake. */
+  if(data->set.reuse_forbid
+#ifdef USE_NTLM
+     && !(conn->http_ntlm_state == NTLMSTATE_TYPE2 ||
+          conn->proxy_ntlm_state == NTLMSTATE_TYPE2)
+#endif
+#ifdef USE_SPNEGO
+     && !(conn->http_negotiate_state == GSS_AUTHRECV ||
+          conn->proxy_negotiate_state == GSS_AUTHRECV)
+#endif
+    )
+    return TRUE;
+
+  /* Unless this connection is for a "connect-only" transfer, it
+   * needs to be closed if the protocol handler does not support reuse. */
+  if(!data->set.connect_only && conn->scheme &&
+     !(conn->scheme->flags & PROTOPT_CONN_REUSE))
+    return TRUE;
+
+  /* if premature is TRUE, it means this connection was said to be DONE before
+     the entire request operation is complete and thus we cannot know in what
+     state it is for reusing, so we are forced to close it. In a perfect world
+     we can add code that keep track of if we really must close it here or not,
+     but currently we have no such detail knowledge. */
+  if(premature && !Curl_conn_is_multiplex(conn, FIRSTSOCKET))
+    return TRUE;
+
+  return FALSE;
+}
+
+static void multi_done_locked(struct connectdata *conn,
+                              struct Curl_easy *data,
+                              void *userdata)
+{
+  struct multi_done_ctx *mdctx = userdata;
+
+  Curl_detach_connection(data);
+
+  CURL_TRC_M(data, "multi_done_locked, in use=%u", conn->attached_xfers);
+  if(CONN_INUSE(conn)) {
+    /* Stop if still used. */
+    CURL_TRC_M(data, "Connection still in use %u, no more multi_done now!",
+               conn->attached_xfers);
+    return;
+  }
+
+  data->state.done = TRUE; /* called now! */
+  data->state.recent_conn_id = conn->connection_id;
+
+  Curl_dnscache_prune(data);
+
+  if(multi_conn_should_close(conn, data, (bool)mdctx->premature)) {
+    CURL_TRC_M(data, "multi_done, terminating conn #%" FMT_OFF_T " to %s, "
+               "forbid=%d, close=%d, premature=%d, conn_multiplex=%d",
+               conn->connection_id, conn->destination,
+               data->set.reuse_forbid, conn->bits.close, mdctx->premature,
+               Curl_conn_is_multiplex(conn, FIRSTSOCKET));
+    connclose(conn, "disconnecting");
+    Curl_conn_terminate(data, conn, (bool)mdctx->premature);
+  }
+  else if(!Curl_conn_get_max_concurrent(data, conn, FIRSTSOCKET)) {
+    CURL_TRC_M(data, "multi_done, conn #%" FMT_OFF_T " to %s was shutdown"
+               " by server, not reusing", conn->connection_id,
+               conn->destination);
+    connclose(conn, "server shutdown");
+    Curl_conn_terminate(data, conn, (bool)mdctx->premature);
+  }
+  else {
+    /* the connection is no longer in use by any transfer */
+    if(Curl_cpool_conn_now_idle(data, conn)) {
+      /* connection kept in the cpool */
+      data->state.lastconnect_id = conn->connection_id;
+      infof(data, "Connection #%" FMT_OFF_T " to host %s left intact",
+            conn->connection_id, conn->destination);
+    }
+    else {
+      /* connection was removed from the cpool and destroyed. */
+      data->state.lastconnect_id = -1;
+    }
+  }
+}
+
 static CURLcode multi_done(struct Curl_easy *data,
                            CURLcode status,  /* an error if this is called
                                                 after an error was detected */
@@ -665,179 +698,97 @@ static CURLcode multi_done(struct Curl_easy *data,
 {
   CURLcode result;
   struct connectdata *conn = data->conn;
-  unsigned int i;
 
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
-  DEBUGF(infof(data, "multi_done[%s]: status: %d prem: %d done: %d",
-               multi_statename[data->mstate],
-               (int)status, (int)premature, data->state.done));
-#else
-  DEBUGF(infof(data, "multi_done: status: %d prem: %d done: %d",
-               (int)status, (int)premature, data->state.done));
-#endif
+  CURL_TRC_M(data, "multi_done: status: %d prem: %d done: %d",
+             (int)status, (int)premature, data->state.done);
 
   if(data->state.done)
     /* Stop if multi_done() has already been called */
     return CURLE_OK;
 
-  /* Stop the resolver and free its own resources (but not dns_entry yet). */
-  Curl_resolver_kill(data);
+  /* Shut down any ongoing async resolver operation. */
+  Curl_resolv_shutdown_all(data);
 
   /* Cleanup possible redirect junk */
-  Curl_safefree(data->req.newurl);
-  Curl_safefree(data->req.location);
+  curlx_safefree(data->req.newurl);
+  curlx_safefree(data->req.location);
 
   switch(status) {
   case CURLE_ABORTED_BY_CALLBACK:
   case CURLE_READ_ERROR:
   case CURLE_WRITE_ERROR:
-    /* When we're aborted due to a callback return code it basically have to
-       be counted as premature as there is trouble ahead if we don't. We have
-       many callbacks and protocols work differently, we could potentially do
-       this more fine-grained in the future. */
+    /* When we are aborted due to a callback return code it has to be counted
+       as premature as there is trouble ahead if we do not. We have many
+       callbacks and protocols work differently, we could potentially do this
+       more fine-grained in the future. */
     premature = TRUE;
+    FALLTHROUGH();
   default:
     break;
   }
 
   /* this calls the protocol-specific function pointer previously set */
-  if(conn->handler->done)
-    result = conn->handler->done(data, status, premature);
+  if(conn && conn->scheme->run->done && (data->mstate >= MSTATE_PROTOCONNECT))
+    result = conn->scheme->run->done(data, status, premature);
   else
     result = status;
 
-  if(CURLE_ABORTED_BY_CALLBACK != result) {
-    /* avoid this if we already aborted by callback to avoid this calling
-       another callback */
+  if(data->mstate > MSTATE_CONNECTING &&
+     (result != CURLE_ABORTED_BY_CALLBACK)) {
+    /* avoid this if
+     * - the transfer has not connected
+     * - we already aborted by callback to avoid this calling another callback
+     */
     int rc = Curl_pgrsDone(data);
     if(!result && rc)
       result = CURLE_ABORTED_BY_CALLBACK;
   }
 
+  /* Make sure that transfer client writes are really done now. */
+  result = Curl_1st_fatal(result, Curl_xfer_write_done(data, premature));
+
   /* Inform connection filters that this transfer is done */
-  Curl_conn_ev_data_done(data, premature);
+  if(conn)
+    Curl_conn_ev_data_done(data, premature);
 
   process_pending_handles(data->multi); /* connection / multiplex */
 
-  Curl_safefree(data->state.ulbuf);
+  if(!result)
+    result = Curl_req_done(&data->req, data, premature);
 
-  /* if the transfer was completed in a paused state there can be buffered
-     data left to free */
-  for(i = 0; i < data->state.tempcount; i++) {
-    Curl_dyn_free(&data->state.tempwrite[i].b);
-  }
-  data->state.tempcount = 0;
+  if(conn) {
+    /* Under the potential connection pool's share lock, decide what to
+     * do with the transfer's connection. */
+    struct multi_done_ctx mdctx;
 
-  CONNCACHE_LOCK(data);
-  Curl_detach_connection(data);
-  if(CONN_INUSE(conn)) {
-    /* Stop if still used. */
-    CONNCACHE_UNLOCK(data);
-    DEBUGF(infof(data, "Connection still in use %zu, "
-                 "no more multi_done now!",
-                 conn->easyq.size));
-    return CURLE_OK;
+    memset(&mdctx, 0, sizeof(mdctx));
+    mdctx.premature = premature;
+    Curl_cpool_do_locked(data, data->conn, multi_done_locked, &mdctx);
   }
 
-  data->state.done = TRUE; /* called just now! */
-
-  if(conn->dns_entry) {
-    Curl_resolv_unlock(data, conn->dns_entry); /* done with this */
-    conn->dns_entry = NULL;
-  }
-  Curl_hostcache_prune(data);
-
-  /* if data->set.reuse_forbid is TRUE, it means the libcurl client has
-     forced us to close this connection. This is ignored for requests taking
-     place in a NTLM/NEGOTIATE authentication handshake
-
-     if conn->bits.close is TRUE, it means that the connection should be
-     closed in spite of all our efforts to be nice, due to protocol
-     restrictions in our or the server's end
-
-     if premature is TRUE, it means this connection was said to be DONE before
-     the entire request operation is complete and thus we can't know in what
-     state it is for reusing, so we're forced to close it. In a perfect world
-     we can add code that keep track of if we really must close it here or not,
-     but currently we have no such detail knowledge.
-  */
-
-  data->state.recent_conn_id = conn->connection_id;
-  if((data->set.reuse_forbid
-#if defined(USE_NTLM)
-      && !(conn->http_ntlm_state == NTLMSTATE_TYPE2 ||
-           conn->proxy_ntlm_state == NTLMSTATE_TYPE2)
-#endif
-#if defined(USE_SPNEGO)
-      && !(conn->http_negotiate_state == GSS_AUTHRECV ||
-           conn->proxy_negotiate_state == GSS_AUTHRECV)
-#endif
-     ) || conn->bits.close
-       || (premature && !Curl_conn_is_multiplex(conn, FIRSTSOCKET))) {
-    DEBUGF(infof(data, "multi_done, not reusing connection=%"
-                       CURL_FORMAT_CURL_OFF_T ", forbid=%d"
-                       ", close=%d, premature=%d, conn_multiplex=%d",
-                 conn->connection_id,
-                 data->set.reuse_forbid, conn->bits.close, premature,
-                 Curl_conn_is_multiplex(conn, FIRSTSOCKET)));
-    connclose(conn, "disconnecting");
-    Curl_conncache_remove_conn(data, conn, FALSE);
-    CONNCACHE_UNLOCK(data);
-    Curl_disconnect(data, conn, premature);
-  }
-  else {
-    char buffer[256];
-    const char *host =
-#ifndef CURL_DISABLE_PROXY
-      conn->bits.socksproxy ?
-      conn->socks_proxy.host.dispname :
-      conn->bits.httpproxy ? conn->http_proxy.host.dispname :
-#endif
-      conn->bits.conn_to_host ? conn->conn_to_host.dispname :
-      conn->host.dispname;
-    /* create string before returning the connection */
-    curl_off_t connection_id = conn->connection_id;
-    msnprintf(buffer, sizeof(buffer),
-              "Connection #%" CURL_FORMAT_CURL_OFF_T " to host %s left intact",
-              connection_id, host);
-    /* the connection is no longer in use by this transfer */
-    CONNCACHE_UNLOCK(data);
-    if(Curl_conncache_return_conn(data, conn)) {
-      /* remember the most recently used connection */
-      data->state.lastconnect_id = connection_id;
-      data->state.recent_conn_id = connection_id;
-      infof(data, "%s", buffer);
-    }
-    else
-      data->state.lastconnect_id = -1;
-  }
-
-  Curl_safefree(data->state.buffer);
+  /* flush the netrc cache */
+  Curl_netrc_cleanup(&data->state.netrc);
   return result;
 }
 
-static int close_connect_only(struct Curl_easy *data,
-                              struct connectdata *conn, void *param)
+static void close_connect_only(struct connectdata *conn,
+                               struct Curl_easy *data,
+                               void *userdata)
 {
-  (void)param;
-  if(data->state.lastconnect_id != conn->connection_id)
-    return 0;
-
-  if(!conn->connect_only)
-    return 1;
-
-  connclose(conn, "Removing connect-only easy handle");
-
-  return 1;
+  (void)userdata;
+  (void)data;
+  if(conn->bits.connect_only)
+    connclose(conn, "Removing connect-only easy handle");
 }
 
-CURLMcode curl_multi_remove_handle(struct Curl_multi *multi,
-                                   struct Curl_easy *data)
+CURLMcode curl_multi_remove_handle(CURLM *m, CURL *curl)
 {
-  struct Curl_easy *easy = data;
+  struct Curl_multi *multi = m;
+  struct Curl_easy *data = curl;
   bool premature;
-  struct Curl_llist_element *e;
-  CURLMcode rc;
+  struct Curl_llist_node *e;
+  CURLMcode mresult;
+  uint32_t mid;
 
   /* First, make some basic checks that the CURLM handle is a good handle */
   if(!GOOD_MULTI_HANDLE(multi))
@@ -855,23 +806,26 @@ CURLMcode curl_multi_remove_handle(struct Curl_multi *multi,
   if(data->multi != multi)
     return CURLM_BAD_EASY_HANDLE;
 
+  if(data->mid == UINT32_MAX) {
+    DEBUGASSERT(0);
+    return CURLM_INTERNAL_ERROR;
+  }
+  if(Curl_uint32_tbl_get(&multi->xfers, data->mid) != data) {
+    DEBUGASSERT(0);
+    return CURLM_INTERNAL_ERROR;
+  }
+
   if(multi->in_callback)
     return CURLM_RECURSIVE_API_CALL;
 
-  premature = (data->mstate < MSTATE_COMPLETED) ? TRUE : FALSE;
+  premature = (data->mstate < MSTATE_COMPLETED);
 
   /* If the 'state' is not INIT or COMPLETED, we might need to do something
      nice to put the easy_handle in a good known state when this returns. */
-  if(premature) {
-    /* this handle is "alive" so we need to count down the total number of
-       alive connections when this is removed */
-    multi->num_alive--;
-  }
-
   if(data->conn &&
      data->mstate > MSTATE_DO &&
      data->mstate < MSTATE_COMPLETED) {
-    /* Set connection owner so that the DONE function closes it.  We can
+    /* Set connection owner so that the DONE function closes it. We can
        safely do this here since connection is killed. */
     streamclose(data->conn, "Removed with partial response");
   }
@@ -880,7 +834,7 @@ CURLMcode curl_multi_remove_handle(struct Curl_multi *multi,
     /* multi_done() clears the association between the easy handle and the
        connection.
 
-       Note that this ignores the return code simply because there's
+       Note that this ignores the return code because there is
        nothing really useful to do with it anyway! */
     (void)multi_done(data, data->result, premature);
   }
@@ -890,43 +844,31 @@ CURLMcode curl_multi_remove_handle(struct Curl_multi *multi,
      called. Do it after multi_done() in case that sets another time! */
   Curl_expire_clear(data);
 
-  if(data->connect_queue.ptr) {
-    /* the handle is in the pending or msgsent lists, so go ahead and remove
-       it */
-    if(data->mstate == MSTATE_PENDING)
-      Curl_llist_remove(&multi->pending, &data->connect_queue, NULL);
-    else
-      Curl_llist_remove(&multi->msgsent, &data->connect_queue, NULL);
-  }
-  if(in_main_list(data))
-    unlink_easy(multi, data);
-
-  if(data->dns.hostcachetype == HCACHE_MULTI) {
-    /* stop using the multi handle's DNS cache, *after* the possible
-       multi_done() call above */
-    data->dns.hostcache = NULL;
-    data->dns.hostcachetype = HCACHE_NONE;
+  /* If in `msgsent`, it was deducted from `multi->xfers_alive` already. */
+  if(!Curl_uint32_bset_contains(&multi->msgsent, data->mid))
+    --multi->xfers_alive;
+  if(data->state.really_alive) {
+    data->state.really_alive = FALSE;
+    --multi->xfers_really_alive;
+    if(!multi->xfers_really_alive)
+      (void)multi_assess_wakeup(multi);
   }
 
   Curl_wildcard_dtor(&data->wildcard);
 
-  /* change state without using multistate(), only to make singlesocket() do
-     what we want */
   data->mstate = MSTATE_COMPLETED;
 
-  /* This ignores the return code even in case of problems because there's
-     nothing more to do about that, here */
-  (void)singlesocket(multi, easy); /* to let the application know what sockets
-                                      that vanish with this handle */
-
   /* Remove the association between the connection and the handle */
   Curl_detach_connection(data);
 
+  /* Tell event handling that this transfer is definitely going away */
+  Curl_multi_ev_xfer_done(multi, data);
+
   if(data->set.connect_only && !data->multi_easy) {
     /* This removes a handle that was part the multi interface that used
        CONNECT_ONLY, that connection is now left alive but since this handle
        has bits.close set nothing can use that transfer anymore and it is
-       forbidden from reuse. And this easy handle cannot find the connection
+       forbidden from reuse. This easy handle cannot find the connection
        anymore once removed from the multi handle
 
        Better close the connection here, at once.
@@ -935,15 +877,14 @@ CURLMcode curl_multi_remove_handle(struct Curl_multi *multi,
     curl_socket_t s;
     s = Curl_getconnectinfo(data, &c);
     if((s != CURL_SOCKET_BAD) && c) {
-      Curl_conncache_remove_conn(data, c, TRUE);
-      Curl_disconnect(data, c, TRUE);
+      Curl_conn_terminate(data, c, TRUE);
     }
   }
 
   if(data->state.lastconnect_id != -1) {
     /* Mark any connect-only connection for closure */
-    Curl_conncache_foreach(data, data->state.conn_cache,
-                           NULL, close_connect_only);
+    Curl_cpool_do_by_id(data, data->state.lastconnect_id,
+                        close_connect_only, NULL);
   }
 
 #ifdef USE_LIBPSL
@@ -952,40 +893,54 @@ CURLMcode curl_multi_remove_handle(struct Curl_multi *multi,
     data->psl = NULL;
 #endif
 
-  /* as this was using a shared connection cache we clear the pointer to that
-     since we're not part of that multi handle anymore */
-  data->state.conn_cache = NULL;
-
-  data->multi = NULL; /* clear the association to this multi handle */
-
-  /* make sure there's no pending message in the queue sent from this easy
+  /* make sure there is no pending message in the queue sent from this easy
      handle */
-  for(e = multi->msglist.head; e; e = e->next) {
-    struct Curl_message *msg = e->ptr;
+  for(e = Curl_llist_head(&multi->msglist); e; e = Curl_node_next(e)) {
+    struct Curl_message *msg = Curl_node_elem(e);
 
-    if(msg->extmsg.easy_handle == easy) {
-      Curl_llist_remove(&multi->msglist, e, NULL);
+    if(msg->extmsg.easy_handle == data) {
+      Curl_node_remove(e);
       /* there can only be one from this specific handle */
       break;
     }
   }
 
+  /* clear the association to this multi handle */
+  mid = data->mid;
+  DEBUGASSERT(Curl_uint32_tbl_contains(&multi->xfers, mid));
+  Curl_uint32_tbl_remove(&multi->xfers, mid);
+  Curl_uint32_bset_remove(&multi->process, mid);
+  Curl_uint32_bset_remove(&multi->dirty, mid);
+  Curl_uint32_bset_remove(&multi->pending, mid);
+  Curl_uint32_bset_remove(&multi->msgsent, mid);
+  data->multi = NULL;
+  data->mid = UINT32_MAX;
+  data->master_mid = UINT32_MAX;
+
   /* NOTE NOTE NOTE
      We do not touch the easy handle here! */
-  multi->num_easy--; /* one less to care about now */
-
   process_pending_handles(multi);
 
-  rc = Curl_update_timer(multi);
-  if(rc)
-    return rc;
+  mresult = Curl_update_timer(multi);
+  if(mresult)
+    return mresult;
+
+  mresult = multi_assess_wakeup(multi);
+  if(mresult) {
+    failf(data, "error enabling wakeup listening: %d", mresult);
+    return mresult;
+  }
+
+  CURL_TRC_M(data, "removed from multi, mid=%u, running=%u, total=%u",
+             mid, Curl_multi_xfers_running(multi),
+             Curl_uint32_tbl_count(&multi->xfers));
   return CURLM_OK;
 }
 
 /* Return TRUE if the application asked for multiplexing */
 bool Curl_multiplex_wanted(const struct Curl_multi *multi)
 {
-  return (multi && (multi->multiplexing));
+  return multi && multi->multiplexing;
 }
 
 /*
@@ -998,8 +953,13 @@ void Curl_detach_connection(struct Curl_easy *data)
 {
   struct connectdata *conn = data->conn;
   if(conn) {
-    Curl_conn_ev_data_detach(conn, data);
-    Curl_llist_remove(&conn->easyq, &data->conn_queue, NULL);
+    /* this should never happen, prevent underflow */
+    DEBUGASSERT(conn->attached_xfers);
+    if(conn->attached_xfers) {
+      conn->attached_xfers--;
+      if(!conn->attached_xfers)
+        conn->attached_multi = NULL;
+    }
   }
   data->conn = NULL;
 }
@@ -1010,99 +970,310 @@ void Curl_detach_connection(struct Curl_easy *data)
  * This is the only function that should assign data->conn
  */
 void Curl_attach_connection(struct Curl_easy *data,
-                             struct connectdata *conn)
+                            struct connectdata *conn)
 {
+  DEBUGASSERT(data);
   DEBUGASSERT(!data->conn);
   DEBUGASSERT(conn);
+  DEBUGASSERT(conn->attached_xfers < UINT32_MAX);
   data->conn = conn;
-  Curl_llist_insert_next(&conn->easyq, conn->easyq.tail, data,
-                         &data->conn_queue);
-  if(conn->handler && conn->handler->attach)
-    conn->handler->attach(data, conn);
-  Curl_conn_ev_data_attach(conn, data);
+  conn->attached_xfers++;
+  /* all attached transfers must be from the same multi */
+  if(!conn->attached_multi)
+    conn->attached_multi = data->multi;
+  DEBUGASSERT(conn->attached_multi == data->multi);
+
+  if(conn->scheme && conn->scheme->run->attach)
+    conn->scheme->run->attach(data, conn);
 }
 
-static int domore_getsock(struct Curl_easy *data,
-                          struct connectdata *conn,
-                          curl_socket_t *socks)
+/* adjust pollset for rate limits/pauses */
+static CURLcode multi_adjust_pollset(struct Curl_easy *data,
+                                     struct easy_pollset *ps)
 {
-  if(conn && conn->handler->domore_getsock)
-    return conn->handler->domore_getsock(data, conn, socks);
-  return GETSOCK_BLANK;
+  CURLcode result = CURLE_OK;
+
+  if(ps->n) {
+    const struct curltime *pnow = Curl_pgrs_now(data);
+    bool send_blocked, recv_blocked;
+
+    recv_blocked = (Curl_rlimit_avail(&data->progress.dl.rlimit, pnow) <= 0);
+    send_blocked = (Curl_rlimit_avail(&data->progress.ul.rlimit, pnow) <= 0);
+    if(send_blocked || recv_blocked) {
+      int i;
+      for(i = 0; i <= SECONDARYSOCKET; ++i) {
+        curl_socket_t sock = data->conn->sock[i];
+        if(sock == CURL_SOCKET_BAD)
+          continue;
+        if(recv_blocked && Curl_pollset_want_recv(data, ps, sock)) {
+          result = Curl_pollset_remove_in(data, ps, sock);
+          if(result)
+            break;
+        }
+        if(send_blocked && Curl_pollset_want_send(data, ps, sock)) {
+          result = Curl_pollset_remove_out(data, ps, sock);
+          if(result)
+            break;
+        }
+      }
+    }
+
+    /* Not blocked and wanting to receive. If there is data pending
+     * in the connection filters, make transfer run again. */
+    if(!recv_blocked &&
+       ((Curl_pollset_want_recv(data, ps, data->conn->sock[FIRSTSOCKET]) &&
+         Curl_conn_data_pending(data, FIRSTSOCKET)) ||
+        (Curl_pollset_want_recv(data, ps, data->conn->sock[SECONDARYSOCKET]) &&
+         Curl_conn_data_pending(data, SECONDARYSOCKET)))) {
+      CURL_TRC_M(data, "pollset[] has POLLIN, but there is still "
+                 "buffered input -> mark as dirty");
+      Curl_multi_mark_dirty(data);
+    }
+  }
+  return result;
 }
 
-static int doing_getsock(struct Curl_easy *data,
-                         struct connectdata *conn,
-                         curl_socket_t *socks)
-{
-  if(conn && conn->handler->doing_getsock)
-    return conn->handler->doing_getsock(data, conn, socks);
-  return GETSOCK_BLANK;
-}
-
-static int protocol_getsock(struct Curl_easy *data,
-                            struct connectdata *conn,
-                            curl_socket_t *socks)
-{
-  if(conn->handler->proto_getsock)
-    return conn->handler->proto_getsock(data, conn, socks);
-  return Curl_conn_get_select_socks(data, FIRSTSOCKET, socks);
-}
-
-/* returns bitmapped flags for this handle and its sockets. The 'socks[]'
-   array contains MAX_SOCKSPEREASYHANDLE entries. */
-static int multi_getsock(struct Curl_easy *data,
-                         curl_socket_t *socks)
+static CURLcode mstate_connecting_pollset(struct Curl_easy *data,
+                                          struct easy_pollset *ps)
 {
   struct connectdata *conn = data->conn;
-  /* The no connection case can happen when this is called from
-     curl_multi_remove_handle() => singlesocket() => multi_getsock().
-  */
-  if(!conn)
-    return 0;
+  curl_socket_t sockfd;
+  CURLcode result = CURLE_OK;
 
-  switch(data->mstate) {
-  default:
-    return 0;
-
-  case MSTATE_RESOLVING:
-    return Curl_resolv_getsock(data, socks);
-
-  case MSTATE_PROTOCONNECTING:
-  case MSTATE_PROTOCONNECT:
-    return protocol_getsock(data, conn, socks);
-
-  case MSTATE_DO:
-  case MSTATE_DOING:
-    return doing_getsock(data, conn, socks);
-
-  case MSTATE_TUNNELING:
-  case MSTATE_CONNECTING:
-    return Curl_conn_get_select_socks(data, FIRSTSOCKET, socks);
-
-  case MSTATE_DOING_MORE:
-    return domore_getsock(data, conn, socks);
-
-  case MSTATE_DID: /* since is set after DO is completed, we switch to
-                        waiting for the same as the PERFORMING state */
-  case MSTATE_PERFORMING:
-    return Curl_single_getsock(data, conn, socks);
+  if(Curl_xfer_recv_is_paused(data))
+    return CURLE_OK;
+  /* If a socket is set, receiving is default. If the socket
+   * has not been determined yet (eyeballing), always ask the
+   * connection filters for what to monitor. */
+  sockfd = Curl_conn_get_first_socket(data);
+  if(sockfd != CURL_SOCKET_BAD) {
+    result = Curl_pollset_change(data, ps, sockfd, CURL_POLL_IN, 0);
+    if(!result)
+      result = multi_adjust_pollset(data, ps);
   }
-
+  if(!result)
+    result = Curl_conn_adjust_pollset(data, conn, ps);
+  return result;
 }
 
-CURLMcode curl_multi_fdset(struct Curl_multi *multi,
+static CURLcode mstate_protocol_pollset(struct Curl_easy *data,
+                                        struct easy_pollset *ps)
+{
+  struct connectdata *conn = data->conn;
+  CURLcode result = CURLE_OK;
+
+  if(conn->scheme->run->proto_pollset)
+    result = conn->scheme->run->proto_pollset(data, ps);
+  else {
+    curl_socket_t sockfd = conn->sock[FIRSTSOCKET];
+    if(sockfd != CURL_SOCKET_BAD) {
+      /* Default is to wait to something from the server */
+      result = Curl_pollset_change(data, ps, sockfd, CURL_POLL_IN, 0);
+    }
+  }
+  if(!result)
+    result = multi_adjust_pollset(data, ps);
+  if(!result)
+    result = Curl_conn_adjust_pollset(data, conn, ps);
+  return result;
+}
+
+static CURLcode mstate_do_pollset(struct Curl_easy *data,
+                                  struct easy_pollset *ps)
+{
+  struct connectdata *conn = data->conn;
+  CURLcode result = CURLE_OK;
+
+  if(conn->scheme->run->doing_pollset)
+    result = conn->scheme->run->doing_pollset(data, ps);
+  else if(CONN_SOCK_IDX_VALID(conn->send_idx)) {
+    /* Default is that we want to send something to the server */
+    result = Curl_pollset_add_out(data, ps, conn->sock[conn->send_idx]);
+  }
+  if(!result)
+    result = multi_adjust_pollset(data, ps);
+  if(!result)
+    result = Curl_conn_adjust_pollset(data, conn, ps);
+  return result;
+}
+
+static CURLcode mstate_domore_pollset(struct Curl_easy *data,
+                                      struct easy_pollset *ps)
+{
+  struct connectdata *conn = data->conn;
+  CURLcode result = CURLE_OK;
+
+  if(conn->scheme->run->domore_pollset)
+    result = conn->scheme->run->domore_pollset(data, ps);
+  else if(CONN_SOCK_IDX_VALID(conn->send_idx)) {
+    /* Default is that we want to send something to the server */
+    result = Curl_pollset_add_out(data, ps, conn->sock[conn->send_idx]);
+  }
+  if(!result)
+    result = multi_adjust_pollset(data, ps);
+  if(!result)
+    result = Curl_conn_adjust_pollset(data, conn, ps);
+  return result;
+}
+
+static CURLcode mstate_perform_pollset(struct Curl_easy *data,
+                                       struct easy_pollset *ps)
+{
+  struct connectdata *conn = data->conn;
+  CURLcode result = CURLE_OK;
+
+  if(conn->scheme->run->perform_pollset)
+    result = conn->scheme->run->perform_pollset(data, ps);
+  else {
+    /* Default is to obey the request flags for send/recv */
+    if(Curl_req_want_recv(data) && CONN_SOCK_IDX_VALID(conn->recv_idx)) {
+      result = Curl_pollset_add_in(data, ps, conn->sock[conn->recv_idx]);
+    }
+    if(!result && Curl_req_want_send(data) &&
+       CONN_SOCK_IDX_VALID(conn->send_idx)) {
+      result = Curl_pollset_add_out(data, ps, conn->sock[conn->send_idx]);
+    }
+  }
+  if(!result)
+    result = multi_adjust_pollset(data, ps);
+  if(!result)
+    result = Curl_conn_adjust_pollset(data, conn, ps);
+  return result;
+}
+
+/* Initializes `poll_set` with the current socket poll actions needed
+ * for transfer `data`. */
+CURLMcode Curl_multi_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps)
+{
+  CURLcode result = CURLE_OK;
+
+  Curl_pollset_reset(ps);
+#ifdef ENABLE_WAKEUP
+  /* The admin handle always listens on the wakeup socket when there
+   * are transfers alive. */
+  if(data->multi && (data == data->multi->admin) &&
+     data->multi->xfers_really_alive) {
+    CURL_TRC_M(data, "adding wakeup, %u xfers really alive",
+               data->multi->xfers_really_alive);
+    result = Curl_pollset_add_in(data, ps, data->multi->wakeup_pair[0]);
+  }
+#endif
+  /* If the transfer has no connection, this is fine. Happens when
+     called via curl_multi_remove_handle() => Curl_multi_ev_assess() =>
+     Curl_multi_pollset(). */
+  if(!result && data->conn) {
+    switch(data->mstate) {
+    case MSTATE_INIT:
+    case MSTATE_PENDING:
+    case MSTATE_SETUP:
+    case MSTATE_CONNECT:
+      /* nothing to poll for yet */
+      break;
+
+    case MSTATE_CONNECTING:
+      if(data->conn && !data->conn->bits.dns_resolved)
+        result = Curl_resolv_pollset(data, ps);
+      if(!result)
+        result = mstate_connecting_pollset(data, ps);
+      break;
+
+    case MSTATE_PROTOCONNECT:
+    case MSTATE_PROTOCONNECTING:
+      result = mstate_protocol_pollset(data, ps);
+      break;
+
+    case MSTATE_DO:
+    case MSTATE_DOING:
+      result = mstate_do_pollset(data, ps);
+      break;
+
+    case MSTATE_DOING_MORE:
+      result = mstate_domore_pollset(data, ps);
+      break;
+
+    case MSTATE_DID: /* same as PERFORMING in regard to polling */
+    case MSTATE_PERFORMING:
+      result = mstate_perform_pollset(data, ps);
+      break;
+
+    case MSTATE_RATELIMITING:
+      /* we need to let time pass, ignore socket(s) */
+      break;
+
+    case MSTATE_DONE:
+    case MSTATE_COMPLETED:
+    case MSTATE_MSGSENT:
+      /* nothing more to poll for */
+      break;
+
+    default:
+      failf(data, "multi_getsock: unexpected multi state %d",
+            (int)data->mstate);
+      DEBUGASSERT(0);
+      break;
+    }
+  }
+
+  if(result) {
+    if(result == CURLE_OUT_OF_MEMORY)
+      return CURLM_OUT_OF_MEMORY;
+    failf(data, "error determining pollset: %d", (int)result);
+    return CURLM_INTERNAL_ERROR;
+  }
+
+#ifdef CURLVERBOSE
+  if(CURL_TRC_M_is_verbose(data)) {
+    size_t timeout_count = Curl_llist_count(&data->state.timeoutlist);
+    switch(ps->n) {
+    case 0:
+      CURL_TRC_M(data, "pollset[], timeouts=%zu, paused %d/%d (r/w)",
+                 timeout_count,
+                 Curl_xfer_send_is_paused(data),
+                 Curl_xfer_recv_is_paused(data));
+      break;
+    case 1:
+      CURL_TRC_M(data, "pollset[fd=%" FMT_SOCKET_T " %s%s], timeouts=%zu",
+                 ps->sockets[0],
+                 (ps->actions[0] & CURL_POLL_IN) ? "IN" : "",
+                 (ps->actions[0] & CURL_POLL_OUT) ? "OUT" : "",
+                 timeout_count);
+      break;
+    case 2:
+      CURL_TRC_M(data, "pollset[fd=%" FMT_SOCKET_T " %s%s, "
+                 "fd=%" FMT_SOCKET_T " %s%s], timeouts=%zu",
+                 ps->sockets[0],
+                 (ps->actions[0] & CURL_POLL_IN) ? "IN" : "",
+                 (ps->actions[0] & CURL_POLL_OUT) ? "OUT" : "",
+                 ps->sockets[1],
+                 (ps->actions[1] & CURL_POLL_IN) ? "IN" : "",
+                 (ps->actions[1] & CURL_POLL_OUT) ? "OUT" : "",
+                 timeout_count);
+      break;
+    default:
+      CURL_TRC_M(data, "pollset[fds=%u], timeouts=%zu", ps->n, timeout_count);
+      break;
+    }
+    CURL_TRC_EASY_TIMERS(data);
+  }
+#endif
+
+  return CURLM_OK;
+}
+
+CURLMcode curl_multi_fdset(CURLM *m,
                            fd_set *read_fd_set, fd_set *write_fd_set,
                            fd_set *exc_fd_set, int *max_fd)
 {
   /* Scan through all the easy handles to get the file descriptors set.
      Some easy handles may not have connected to the remote host yet,
      and then we must make sure that is done. */
-  struct Curl_easy *data;
   int this_max_fd = -1;
-  curl_socket_t sockbunch[MAX_SOCKSPEREASYHANDLE];
-  int i;
-  (void)exc_fd_set; /* not used */
+  struct Curl_multi *multi = m;
+  struct easy_pollset ps;
+  unsigned int i;
+  uint32_t mid;
+  (void)exc_fd_set;
 
   if(!GOOD_MULTI_HANDLE(multi))
     return CURLM_BAD_HANDLE;
@@ -1110,39 +1281,90 @@ CURLMcode curl_multi_fdset(struct Curl_multi *multi,
   if(multi->in_callback)
     return CURLM_RECURSIVE_API_CALL;
 
-  for(data = multi->easyp; data; data = data->next) {
-    int bitmap;
-#ifdef __clang_analyzer_
-    /* to prevent "The left operand of '>=' is a garbage value" warnings */
-    memset(sockbunch, 0, sizeof(sockbunch));
-#endif
-    bitmap = multi_getsock(data, sockbunch);
+  Curl_pollset_init(&ps);
+  if(Curl_uint32_bset_first(&multi->process, &mid)) {
+    do {
+      struct Curl_easy *data = Curl_multi_get_easy(multi, mid);
 
-    for(i = 0; i< MAX_SOCKSPEREASYHANDLE; i++) {
-      if((bitmap & GETSOCK_MASK_RW(i)) && VALID_SOCK((sockbunch[i]))) {
-        if(!FDSET_SOCK(sockbunch[i]))
-          /* pretend it doesn't exist */
+      if(!data) {
+        DEBUGASSERT(0);
+        continue;
+      }
+
+      Curl_multi_pollset(data, &ps);
+      for(i = 0; i < ps.n; i++) {
+        if(!FDSET_SOCK(ps.sockets[i]))
+          /* pretend it does not exist */
           continue;
-        if(bitmap & GETSOCK_READSOCK(i))
-          FD_SET(sockbunch[i], read_fd_set);
-        if(bitmap & GETSOCK_WRITESOCK(i))
-          FD_SET(sockbunch[i], write_fd_set);
-        if((int)sockbunch[i] > this_max_fd)
-          this_max_fd = (int)sockbunch[i];
+        if(ps.actions[i] & CURL_POLL_IN)
+          FD_SET(ps.sockets[i], read_fd_set);
+        if(ps.actions[i] & CURL_POLL_OUT)
+          FD_SET(ps.sockets[i], write_fd_set);
+        if((int)ps.sockets[i] > this_max_fd)
+          this_max_fd = (int)ps.sockets[i];
       }
-      else {
-        break;
-      }
-    }
+    } while(Curl_uint32_bset_next(&multi->process, mid, &mid));
   }
 
+  Curl_cshutdn_setfds(&multi->cshutdn, multi->admin,
+                      read_fd_set, write_fd_set, &this_max_fd);
+
   *max_fd = this_max_fd;
+  Curl_pollset_cleanup(&ps);
 
   return CURLM_OK;
 }
 
+CURLMcode curl_multi_waitfds(CURLM *m,
+                             struct curl_waitfd *ufds,
+                             unsigned int size,
+                             unsigned int *fd_count)
+{
+  struct Curl_waitfds cwfds;
+  CURLMcode mresult = CURLM_OK;
+  struct Curl_multi *multi = m;
+  struct easy_pollset ps;
+  unsigned int need = 0;
+  uint32_t mid;
+
+  if(!ufds && (size || !fd_count))
+    return CURLM_BAD_FUNCTION_ARGUMENT;
+
+  if(!GOOD_MULTI_HANDLE(multi))
+    return CURLM_BAD_HANDLE;
+
+  if(multi->in_callback)
+    return CURLM_RECURSIVE_API_CALL;
+
+  Curl_pollset_init(&ps);
+  Curl_waitfds_init(&cwfds, ufds, size);
+  if(Curl_uint32_bset_first(&multi->process, &mid)) {
+    do {
+      struct Curl_easy *data = Curl_multi_get_easy(multi, mid);
+      if(!data) {
+        DEBUGASSERT(0);
+        Curl_uint32_bset_remove(&multi->process, mid);
+        Curl_uint32_bset_remove(&multi->dirty, mid);
+        continue;
+      }
+      Curl_multi_pollset(data, &ps);
+      need += Curl_waitfds_add_ps(&cwfds, &ps);
+    } while(Curl_uint32_bset_next(&multi->process, mid, &mid));
+  }
+
+  need += Curl_cshutdn_add_waitfds(&multi->cshutdn, multi->admin, &cwfds);
+
+  if(need != cwfds.n && ufds)
+    mresult = CURLM_OUT_OF_MEMORY;
+
+  if(fd_count)
+    *fd_count = need;
+  Curl_pollset_cleanup(&ps);
+  return mresult;
+}
+
 #ifdef USE_WINSOCK
-/* Reset FD_WRITE for TCP sockets. Nothing is actually sent. UDP sockets can't
+/* Reset FD_WRITE for TCP sockets. Nothing is actually sent. UDP sockets cannot
  * be reset this way because an empty datagram would be sent. #9203
  *
  * "On Windows the internal state of FD_WRITE as returned from
@@ -1153,9 +1375,169 @@ static void reset_socket_fdwrite(curl_socket_t s)
   int t;
   int l = (int)sizeof(t);
   if(!getsockopt(s, SOL_SOCKET, SO_TYPE, (char *)&t, &l) && t == SOCK_STREAM)
-    send(s, NULL, 0, 0);
+    swrite(s, NULL, 0);
 }
-#endif
+
+static CURLMcode multi_winsock_select(struct Curl_multi *multi,
+                                      struct curl_pollfds *cpfds,
+                                      unsigned int curl_nfds,
+                                      struct curl_waitfd extra_fds[],
+                                      unsigned int extra_nfds,
+                                      int timeout_ms,
+                                      bool extrawait,
+                                      int *pnevents)
+{
+  CURLMcode mresult = CURLM_OK;
+  WSANETWORKEVENTS wsa_events;
+  int nevents = 0;
+  size_t i;
+
+  DEBUGASSERT(multi->wsa_event != WSA_INVALID_EVENT);
+
+  /* Set the WSA events based on the collected pollds */
+  for(i = 0; i < cpfds->n; i++) {
+    long mask = 0;
+    if(cpfds->pfds[i].events & POLLIN)
+      mask |= FD_READ | FD_ACCEPT | FD_CLOSE;
+    if(cpfds->pfds[i].events & POLLPRI)
+      mask |= FD_OOB;
+    if(cpfds->pfds[i].events & POLLOUT) {
+      mask |= FD_WRITE | FD_CONNECT | FD_CLOSE;
+      reset_socket_fdwrite(cpfds->pfds[i].fd);
+    }
+    if(mask) {
+      if(WSAEventSelect(cpfds->pfds[i].fd, multi->wsa_event, mask) != 0) {
+        mresult = CURLM_OUT_OF_MEMORY;
+        goto out;
+      }
+    }
+  }
+
+  if(cpfds->n || extrawait) {
+    int pollrc = 0;
+
+    if(cpfds->n) {         /* pre-check with Winsock */
+      pollrc = Curl_poll(cpfds->pfds, cpfds->n, 0);
+      if(pollrc < 0) {
+        mresult = CURLM_UNRECOVERABLE_POLL;
+        goto out;
+      }
+      nevents = pollrc;
+    }
+
+    if(!nevents) {
+      /* now wait... if not ready during the pre-check (pollrc == 0) */
+      WSAWaitForMultipleEvents(1, &multi->wsa_event, FALSE, (DWORD)timeout_ms,
+                               FALSE);
+    }
+
+    /* With Winsock, we have to run the following section unconditionally
+       to call WSAEventSelect(fd, event, 0) on all the sockets */
+    /* copy revents results from the poll to the curl_multi_wait poll
+       struct, the bit values of the actual underlying poll() implementation
+       may not be the same as the ones in the public libcurl API! */
+    for(i = 0; i < extra_nfds; i++) {
+      unsigned short mask = 0;
+      curl_socket_t s = extra_fds[i].fd;
+
+      wsa_events.lNetworkEvents = 0;
+      if(WSAEnumNetworkEvents(s, NULL, &wsa_events) == 0) {
+        if(wsa_events.lNetworkEvents & (FD_READ | FD_ACCEPT | FD_CLOSE))
+          mask |= CURL_WAIT_POLLIN;
+        if(wsa_events.lNetworkEvents & (FD_WRITE | FD_CONNECT | FD_CLOSE))
+          mask |= CURL_WAIT_POLLOUT;
+        if(wsa_events.lNetworkEvents & FD_OOB)
+          mask |= CURL_WAIT_POLLPRI;
+        if(!pollrc && wsa_events.lNetworkEvents)
+          nevents++;
+      }
+      WSAEventSelect(s, multi->wsa_event, 0);
+      if(!pollrc) {
+        extra_fds[i].revents = (short)mask;
+        continue;
+      }
+      else {
+        unsigned r = (unsigned)cpfds->pfds[curl_nfds + i].revents;
+        if(r & POLLIN)
+          mask |= CURL_WAIT_POLLIN;
+        if(r & POLLOUT)
+          mask |= CURL_WAIT_POLLOUT;
+        if(r & POLLPRI)
+          mask |= CURL_WAIT_POLLPRI;
+        extra_fds[i].revents = (short)mask;
+      }
+    }
+
+    /* Count up all our own sockets that had activity,
+       and remove them from the event. */
+    for(i = 0; i < curl_nfds; ++i) {
+      wsa_events.lNetworkEvents = 0;
+      if(WSAEnumNetworkEvents(cpfds->pfds[i].fd, NULL, &wsa_events) == 0) {
+        if(!pollrc && wsa_events.lNetworkEvents)
+          nevents++;
+      }
+      WSAEventSelect(cpfds->pfds[i].fd, multi->wsa_event, 0);
+    }
+    WSAResetEvent(multi->wsa_event);
+  }
+
+out:
+  *pnevents = nevents;
+  return mresult;
+}
+
+#else /* USE_WINSOCK */
+
+static CURLMcode multi_posix_poll(struct Curl_multi *multi,
+                                  struct curl_pollfds *cpfds,
+                                  unsigned int curl_nfds,
+                                  struct curl_waitfd extra_fds[],
+                                  unsigned int extra_nfds,
+                                  int timeout_ms,
+                                  bool extrawait,
+                                  int *pnevents)
+{
+  CURLMcode mresult = CURLM_OK;
+  int nevents = 0;
+  size_t i;
+
+  (void)multi;
+  if(cpfds->n) {
+    int pollrc = Curl_poll(cpfds->pfds, cpfds->n, timeout_ms); /* wait... */
+    if(pollrc < 0) {
+      mresult = CURLM_UNRECOVERABLE_POLL;
+      goto out;
+    }
+    nevents = pollrc;
+
+    /* copy revents results from the poll to the curl_multi_wait poll
+       struct, the bit values of the actual underlying poll() implementation
+       may not be the same as the ones in the public libcurl API! */
+    for(i = 0; i < extra_nfds; i++) {
+      unsigned r = (unsigned)cpfds->pfds[curl_nfds + i].revents;
+      unsigned short mask = 0;
+      if(r & POLLIN)
+        mask |= CURL_WAIT_POLLIN;
+      if(r & POLLOUT)
+        mask |= CURL_WAIT_POLLOUT;
+      if(r & POLLPRI)
+        mask |= CURL_WAIT_POLLPRI;
+      extra_fds[i].revents = (short)mask;
+    }
+  }
+  else if(extrawait) {
+    /* No fds to poll, but asked to obey timeout_ms anyway. We cannot
+     * use Curl_poll() as it, on some platforms, returns immediately
+     * without fds. */
+    curlx_wait_ms(timeout_ms);
+  }
+
+out:
+  *pnevents = nevents;
+  return mresult;
+}
+
+#endif /* !USE_WINSOCK */
 
 #define NUM_POLLS_ON_STACK 10
 
@@ -1164,26 +1546,21 @@ static CURLMcode multi_wait(struct Curl_multi *multi,
                             unsigned int extra_nfds,
                             int timeout_ms,
                             int *ret,
-                            bool extrawait, /* when no socket, wait */
-                            bool use_wakeup)
+                            bool extrawait)  /* when no socket, wait */
 {
-  struct Curl_easy *data;
-  curl_socket_t sockbunch[MAX_SOCKSPEREASYHANDLE];
-  int bitmap;
-  unsigned int i;
-  unsigned int nfds = 0;
-  unsigned int curlfds;
+  size_t i;
+  struct curltime expire_time;
   long timeout_internal;
-  int retcode = 0;
+  int nevents = 0;
+  struct easy_pollset ps;
   struct pollfd a_few_on_stack[NUM_POLLS_ON_STACK];
-  struct pollfd *ufds = &a_few_on_stack[0];
-  bool ufds_malloc = FALSE;
-#ifdef USE_WINSOCK
-  WSANETWORKEVENTS wsa_events;
-  DEBUGASSERT(multi->wsa_event != WSA_INVALID_EVENT);
-#endif
-#ifndef ENABLE_WAKEUP
-  (void)use_wakeup;
+  struct curl_pollfds cpfds;
+  unsigned int curl_nfds = 0; /* how many pfds are for curl transfers */
+  struct Curl_easy *data = NULL;
+  CURLMcode mresult = CURLM_OK;
+  uint32_t mid;
+#ifdef ENABLE_WAKEUP
+  int wakeup_idx = -1;
 #endif
 
   if(!GOOD_MULTI_HANDLE(multi))
@@ -1195,346 +1572,146 @@ static CURLMcode multi_wait(struct Curl_multi *multi,
   if(timeout_ms < 0)
     return CURLM_BAD_FUNCTION_ARGUMENT;
 
-  /* Count up how many fds we have from the multi handle */
-  for(data = multi->easyp; data; data = data->next) {
-    bitmap = multi_getsock(data, sockbunch);
+  Curl_pollset_init(&ps);
+  Curl_pollfds_init(&cpfds, a_few_on_stack, NUM_POLLS_ON_STACK);
 
-    for(i = 0; i < MAX_SOCKSPEREASYHANDLE; i++) {
-      if((bitmap & GETSOCK_MASK_RW(i)) && VALID_SOCK((sockbunch[i]))) {
-        ++nfds;
+  /* Add the curl handles to our pollfds first */
+  if(Curl_uint32_bset_first(&multi->process, &mid)) {
+    do {
+      data = Curl_multi_get_easy(multi, mid);
+      if(!data) {
+        DEBUGASSERT(0);
+        Curl_uint32_bset_remove(&multi->process, mid);
+        Curl_uint32_bset_remove(&multi->dirty, mid);
+        continue;
       }
-      else {
-        break;
+      Curl_multi_pollset(data, &ps);
+      if(Curl_pollfds_add_ps(&cpfds, &ps)) {
+        mresult = CURLM_OUT_OF_MEMORY;
+        goto out;
       }
+    } while(Curl_uint32_bset_next(&multi->process, mid, &mid));
+  }
+
+  if(Curl_cshutdn_add_pollfds(&multi->cshutdn, multi->admin, &cpfds)) {
+    mresult = CURLM_OUT_OF_MEMORY;
+    goto out;
+  }
+
+#ifdef ENABLE_WAKEUP
+  /* If `extrawait` is TRUE *or* we have `extra_fds`to poll *or* we
+   * have transfer sockets to poll, we obey `timeout_ms`.
+   * Then we need to also monitor the multi's wakeup
+   * socket to catch calls to `curl_multi_wakeup()` during the wait. */
+  if(extrawait || cpfds.n || extra_nfds) {
+    wakeup_idx = cpfds.n;
+    if(Curl_pollfds_add_sock(&cpfds, multi->wakeup_pair[0], POLLIN)) {
+      mresult = CURLM_OUT_OF_MEMORY;
+      goto out;
+    }
+  }
+#endif
+
+  curl_nfds = cpfds.n; /* what curl internally uses in cpfds */
+  /* Add external file descriptions from poll-like struct curl_waitfd */
+  for(i = 0; i < extra_nfds; i++) {
+    unsigned short events = 0;
+    if(extra_fds[i].events & CURL_WAIT_POLLIN)
+      events |= POLLIN;
+    if(extra_fds[i].events & CURL_WAIT_POLLPRI)
+      events |= POLLPRI;
+    if(extra_fds[i].events & CURL_WAIT_POLLOUT)
+      events |= POLLOUT;
+    if(Curl_pollfds_add_sock(&cpfds, extra_fds[i].fd, events)) {
+      mresult = CURLM_OUT_OF_MEMORY;
+      goto out;
     }
   }
 
-  /* If the internally desired timeout is actually shorter than requested from
-     the outside, then use the shorter time! But only if the internal timer
-     is actually larger than -1! */
-  (void)multi_timeout(multi, &timeout_internal);
+  /* We check the internal timeout *AFTER* we collected all sockets to
+   * poll. Collecting the sockets may install new timers by protocols
+   * and connection filters.
+   * Use the shorter one of the internal and the caller requested timeout.
+   * If we are called with `!extrawait` and multi_timeout() reports no
+   * timeouts exist, do not wait. */
+  multi_timeout(multi, &expire_time, &timeout_internal);
   if((timeout_internal >= 0) && (timeout_internal < (long)timeout_ms))
     timeout_ms = (int)timeout_internal;
 
-  curlfds = nfds; /* number of internal file descriptors */
-  nfds += extra_nfds; /* add the externally provided ones */
+  if(data)
+    CURL_TRC_M(data, "multi_wait(fds=%u, timeout=%d) tinternal=%ld",
+               cpfds.n, timeout_ms, timeout_internal);
+
+#ifdef USE_WINSOCK
+  mresult = multi_winsock_select(multi, &cpfds, curl_nfds,
+                                 extra_fds, extra_nfds,
+                                 timeout_ms, extrawait, &nevents);
+#else
+  mresult = multi_posix_poll(multi, &cpfds, curl_nfds,
+                             extra_fds, extra_nfds,
+                             timeout_ms, extrawait, &nevents);
+#endif
 
 #ifdef ENABLE_WAKEUP
-#ifdef USE_WINSOCK
-  if(use_wakeup) {
-#else
-  if(use_wakeup && multi->wakeup_pair[0] != CURL_SOCKET_BAD) {
-#endif
-    ++nfds;
-  }
-#endif
-
-  if(nfds > NUM_POLLS_ON_STACK) {
-    /* 'nfds' is a 32 bit value and 'struct pollfd' is typically 8 bytes
-       big, so at 2^29 sockets this value might wrap. When a process gets
-       the capability to actually handle over 500 million sockets this
-       calculation needs a integer overflow check. */
-    ufds = malloc(nfds * sizeof(struct pollfd));
-    if(!ufds)
-      return CURLM_OUT_OF_MEMORY;
-    ufds_malloc = TRUE;
-  }
-  nfds = 0;
-
-  /* only do the second loop if we found descriptors in the first stage run
-     above */
-
-  if(curlfds) {
-    /* Add the curl handles to our pollfds first */
-    for(data = multi->easyp; data; data = data->next) {
-      bitmap = multi_getsock(data, sockbunch);
-
-      for(i = 0; i < MAX_SOCKSPEREASYHANDLE; i++) {
-        if((bitmap & GETSOCK_MASK_RW(i)) && VALID_SOCK((sockbunch[i]))) {
-          struct pollfd *ufd = &ufds[nfds++];
-#ifdef USE_WINSOCK
-          long mask = 0;
-#endif
-          ufd->fd = sockbunch[i];
-          ufd->events = 0;
-          if(bitmap & GETSOCK_READSOCK(i)) {
-#ifdef USE_WINSOCK
-            mask |= FD_READ|FD_ACCEPT|FD_CLOSE;
-#endif
-            ufd->events |= POLLIN;
-          }
-          if(bitmap & GETSOCK_WRITESOCK(i)) {
-#ifdef USE_WINSOCK
-            mask |= FD_WRITE|FD_CONNECT|FD_CLOSE;
-            reset_socket_fdwrite(sockbunch[i]);
-#endif
-            ufd->events |= POLLOUT;
-          }
-#ifdef USE_WINSOCK
-          if(WSAEventSelect(sockbunch[i], multi->wsa_event, mask) != 0) {
-            if(ufds_malloc)
-              free(ufds);
-            return CURLM_INTERNAL_ERROR;
-          }
-#endif
-        }
-        else {
-          break;
-        }
+    if(nevents && (wakeup_idx >= 0)) {
+      if(cpfds.pfds[wakeup_idx].revents & POLLIN) {
+        (void)Curl_wakeup_consume(multi->wakeup_pair, TRUE);
+        /* do not count the wakeup socket into the returned value */
+        nevents--;
       }
     }
-  }
-
-  /* Add external file descriptions from poll-like struct curl_waitfd */
-  for(i = 0; i < extra_nfds; i++) {
-#ifdef USE_WINSOCK
-    long mask = 0;
-    if(extra_fds[i].events & CURL_WAIT_POLLIN)
-      mask |= FD_READ|FD_ACCEPT|FD_CLOSE;
-    if(extra_fds[i].events & CURL_WAIT_POLLPRI)
-      mask |= FD_OOB;
-    if(extra_fds[i].events & CURL_WAIT_POLLOUT) {
-      mask |= FD_WRITE|FD_CONNECT|FD_CLOSE;
-      reset_socket_fdwrite(extra_fds[i].fd);
-    }
-    if(WSAEventSelect(extra_fds[i].fd, multi->wsa_event, mask) != 0) {
-      if(ufds_malloc)
-        free(ufds);
-      return CURLM_INTERNAL_ERROR;
-    }
-#endif
-    ufds[nfds].fd = extra_fds[i].fd;
-    ufds[nfds].events = 0;
-    if(extra_fds[i].events & CURL_WAIT_POLLIN)
-      ufds[nfds].events |= POLLIN;
-    if(extra_fds[i].events & CURL_WAIT_POLLPRI)
-      ufds[nfds].events |= POLLPRI;
-    if(extra_fds[i].events & CURL_WAIT_POLLOUT)
-      ufds[nfds].events |= POLLOUT;
-    ++nfds;
-  }
-
-#ifdef ENABLE_WAKEUP
-#ifndef USE_WINSOCK
-  if(use_wakeup && multi->wakeup_pair[0] != CURL_SOCKET_BAD) {
-    ufds[nfds].fd = multi->wakeup_pair[0];
-    ufds[nfds].events = POLLIN;
-    ++nfds;
-  }
-#endif
 #endif
 
-#if defined(ENABLE_WAKEUP) && defined(USE_WINSOCK)
-  if(nfds || use_wakeup) {
-#else
-  if(nfds) {
-#endif
-    int pollrc;
-#ifdef USE_WINSOCK
-    if(nfds)
-      pollrc = Curl_poll(ufds, nfds, 0); /* just pre-check with WinSock */
-    else
-      pollrc = 0;
-#else
-    pollrc = Curl_poll(ufds, nfds, timeout_ms); /* wait... */
-#endif
-    if(pollrc < 0)
-      return CURLM_UNRECOVERABLE_POLL;
-
-    if(pollrc > 0) {
-      retcode = pollrc;
-#ifdef USE_WINSOCK
-    }
-    else { /* now wait... if not ready during the pre-check (pollrc == 0) */
-      WSAWaitForMultipleEvents(1, &multi->wsa_event, FALSE, timeout_ms, FALSE);
-    }
-    /* With WinSock, we have to run the following section unconditionally
-       to call WSAEventSelect(fd, event, 0) on all the sockets */
-    {
-#endif
-      /* copy revents results from the poll to the curl_multi_wait poll
-         struct, the bit values of the actual underlying poll() implementation
-         may not be the same as the ones in the public libcurl API! */
-      for(i = 0; i < extra_nfds; i++) {
-        unsigned r = ufds[curlfds + i].revents;
-        unsigned short mask = 0;
-#ifdef USE_WINSOCK
-        curl_socket_t s = extra_fds[i].fd;
-        wsa_events.lNetworkEvents = 0;
-        if(WSAEnumNetworkEvents(s, NULL, &wsa_events) == 0) {
-          if(wsa_events.lNetworkEvents & (FD_READ|FD_ACCEPT|FD_CLOSE))
-            mask |= CURL_WAIT_POLLIN;
-          if(wsa_events.lNetworkEvents & (FD_WRITE|FD_CONNECT|FD_CLOSE))
-            mask |= CURL_WAIT_POLLOUT;
-          if(wsa_events.lNetworkEvents & FD_OOB)
-            mask |= CURL_WAIT_POLLPRI;
-          if(ret && !pollrc && wsa_events.lNetworkEvents)
-            retcode++;
-        }
-        WSAEventSelect(s, multi->wsa_event, 0);
-        if(!pollrc) {
-          extra_fds[i].revents = mask;
-          continue;
-        }
-#endif
-        if(r & POLLIN)
-          mask |= CURL_WAIT_POLLIN;
-        if(r & POLLOUT)
-          mask |= CURL_WAIT_POLLOUT;
-        if(r & POLLPRI)
-          mask |= CURL_WAIT_POLLPRI;
-        extra_fds[i].revents = mask;
-      }
-
-#ifdef USE_WINSOCK
-      /* Count up all our own sockets that had activity,
-         and remove them from the event. */
-      if(curlfds) {
-
-        for(data = multi->easyp; data; data = data->next) {
-          bitmap = multi_getsock(data, sockbunch);
-
-          for(i = 0; i < MAX_SOCKSPEREASYHANDLE; i++) {
-            if(bitmap & (GETSOCK_READSOCK(i) | GETSOCK_WRITESOCK(i))) {
-              wsa_events.lNetworkEvents = 0;
-              if(WSAEnumNetworkEvents(sockbunch[i], NULL, &wsa_events) == 0) {
-                if(ret && !pollrc && wsa_events.lNetworkEvents)
-                  retcode++;
-              }
-              WSAEventSelect(sockbunch[i], multi->wsa_event, 0);
-            }
-            else {
-              /* break on entry not checked for being readable or writable */
-              break;
-            }
-          }
-        }
-      }
-
-      WSAResetEvent(multi->wsa_event);
-#else
-#ifdef ENABLE_WAKEUP
-      if(use_wakeup && multi->wakeup_pair[0] != CURL_SOCKET_BAD) {
-        if(ufds[curlfds + extra_nfds].revents & POLLIN) {
-          char buf[64];
-          ssize_t nread;
-          while(1) {
-            /* the reading socket is non-blocking, try to read
-               data from it until it receives an error (except EINTR).
-               In normal cases it will get EAGAIN or EWOULDBLOCK
-               when there is no more data, breaking the loop. */
-            nread = wakeup_read(multi->wakeup_pair[0], buf, sizeof(buf));
-            if(nread <= 0) {
-              if(nread < 0 && EINTR == SOCKERRNO)
-                continue;
-              break;
-            }
-          }
-          /* do not count the wakeup socket into the returned value */
-          retcode--;
-        }
-      }
-#endif
-#endif
-    }
-  }
-
-  if(ufds_malloc)
-    free(ufds);
+out:
+  Curl_pollset_cleanup(&ps);
+  Curl_pollfds_cleanup(&cpfds);
   if(ret)
-    *ret = retcode;
-#if defined(ENABLE_WAKEUP) && defined(USE_WINSOCK)
-  if(extrawait && !nfds && !use_wakeup) {
-#else
-  if(extrawait && !nfds) {
-#endif
-    long sleep_ms = 0;
-
-    /* Avoid busy-looping when there's nothing particular to wait for */
-    if(!curl_multi_timeout(multi, &sleep_ms) && sleep_ms) {
-      if(sleep_ms > timeout_ms)
-        sleep_ms = timeout_ms;
-      /* when there are no easy handles in the multi, this holds a -1
-         timeout */
-      else if(sleep_ms < 0)
-        sleep_ms = timeout_ms;
-      Curl_wait_ms(sleep_ms);
-    }
-  }
-
-  return CURLM_OK;
+    *ret = nevents;
+  return mresult;
 }
 
-CURLMcode curl_multi_wait(struct Curl_multi *multi,
+CURLMcode curl_multi_wait(CURLM *m,
                           struct curl_waitfd extra_fds[],
                           unsigned int extra_nfds,
                           int timeout_ms,
                           int *ret)
 {
-  return multi_wait(multi, extra_fds, extra_nfds, timeout_ms, ret, FALSE,
-                    FALSE);
+  return multi_wait(m, extra_fds, extra_nfds, timeout_ms, ret, FALSE);
 }
 
-CURLMcode curl_multi_poll(struct Curl_multi *multi,
+CURLMcode curl_multi_poll(CURLM *m,
                           struct curl_waitfd extra_fds[],
                           unsigned int extra_nfds,
                           int timeout_ms,
                           int *ret)
 {
-  return multi_wait(multi, extra_fds, extra_nfds, timeout_ms, ret, TRUE,
-                    TRUE);
+  return multi_wait(m, extra_fds, extra_nfds, timeout_ms, ret, TRUE);
 }
 
-CURLMcode curl_multi_wakeup(struct Curl_multi *multi)
+CURLMcode curl_multi_wakeup(CURLM *m)
 {
   /* this function is usually called from another thread,
      it has to be careful only to access parts of the
      Curl_multi struct that are constant */
+  struct Curl_multi *multi = m;
+  CURLMcode mresult = CURLM_WAKEUP_FAILURE;
 
   /* GOOD_MULTI_HANDLE can be safely called */
   if(!GOOD_MULTI_HANDLE(multi))
     return CURLM_BAD_HANDLE;
 
 #ifdef ENABLE_WAKEUP
-#ifdef USE_WINSOCK
-  if(WSASetEvent(multi->wsa_event))
-    return CURLM_OK;
-#else
   /* the wakeup_pair variable is only written during init and cleanup,
      making it safe to access from another thread after the init part
      and before cleanup */
-  if(multi->wakeup_pair[1] != CURL_SOCKET_BAD) {
-    char buf[1];
-    buf[0] = 1;
-    while(1) {
-      /* swrite() is not thread-safe in general, because concurrent calls
-         can have their messages interleaved, but in this case the content
-         of the messages does not matter, which makes it ok to call.
-
-         The write socket is set to non-blocking, this way this function
-         cannot block, making it safe to call even from the same thread
-         that will call curl_multi_wait(). If swrite() returns that it
-         would block, it's considered successful because it means that
-         previous calls to this function will wake up the poll(). */
-      if(wakeup_write(multi->wakeup_pair[1], buf, sizeof(buf)) < 0) {
-        int err = SOCKERRNO;
-        int return_success;
+  if(!Curl_wakeup_signal(multi->wakeup_pair))
+    mresult = CURLM_OK;
+#endif
 #ifdef USE_WINSOCK
-        return_success = WSAEWOULDBLOCK == err;
-#else
-        if(EINTR == err)
-          continue;
-        return_success = EWOULDBLOCK == err || EAGAIN == err;
+  if(WSASetEvent(multi->wsa_event))
+    mresult = CURLM_OK;
 #endif
-        if(!return_success)
-          return CURLM_WAKEUP_FAILURE;
-      }
-      return CURLM_OK;
-    }
-  }
-#endif
-#endif
-  return CURLM_WAKEUP_FAILURE;
+  return mresult;
 }
 
 /*
@@ -1547,9 +1724,13 @@ CURLMcode curl_multi_wakeup(struct Curl_multi *multi)
  */
 static bool multi_ischanged(struct Curl_multi *multi, bool clear)
 {
-  bool retval = multi->recheckstate;
-  if(clear)
-    multi->recheckstate = FALSE;
+  bool retval = FALSE;
+  DEBUGASSERT(multi);
+  if(multi) {
+    retval = (bool)multi->recheckstate;
+    if(clear)
+      multi->recheckstate = FALSE;
+  }
   return retval;
 }
 
@@ -1569,25 +1750,29 @@ CURLMcode Curl_multi_add_perform(struct Curl_multi *multi,
                                  struct Curl_easy *data,
                                  struct connectdata *conn)
 {
-  CURLMcode rc;
+  CURLMcode mresult;
 
   if(multi->in_callback)
     return CURLM_RECURSIVE_API_CALL;
 
-  rc = curl_multi_add_handle(multi, data);
-  if(!rc) {
-    struct SingleRequest *k = &data->req;
+  mresult = curl_multi_add_handle(multi, data);
+  if(!mresult) {
+    CURLcode result;
 
-    /* pass in NULL for 'conn' here since we don't want to init the
+    /* pass in NULL for 'conn' here since we do not want to init the
        connection, only this transfer */
-    Curl_init_do(data, NULL);
+    result = Curl_init_do(data, NULL);
+    if(result) {
+      curl_multi_remove_handle(multi, data);
+      return CURLM_INTERNAL_ERROR;
+    }
 
     /* take this handle to the perform state right away */
     multistate(data, MSTATE_PERFORMING);
     Curl_attach_connection(data, conn);
-    k->keepon |= KEEP_RECV; /* setup to receive! */
+    CURL_REQ_SET_RECV(data);
   }
-  return rc;
+  return mresult;
 }
 
 static CURLcode multi_do(struct Curl_easy *data, bool *done)
@@ -1596,32 +1781,32 @@ static CURLcode multi_do(struct Curl_easy *data, bool *done)
   struct connectdata *conn = data->conn;
 
   DEBUGASSERT(conn);
-  DEBUGASSERT(conn->handler);
+  DEBUGASSERT(conn->scheme);
 
-  if(conn->handler->do_it)
-    result = conn->handler->do_it(data, done);
+  if(conn->scheme->run->do_it)
+    result = conn->scheme->run->do_it(data, done);
 
   return result;
 }
 
 /*
- * multi_do_more() is called during the DO_MORE multi state. It is basically a
- * second stage DO state which (wrongly) was introduced to support FTP's
- * second connection.
+ * multi_do_more() is called during the DO_MORE multi state. It is a second
+ * stage DO state which (wrongly) was introduced to support FTP's second
+ * connection.
  *
- * 'complete' can return 0 for incomplete, 1 for done and -1 for go back to
- * DOING state there's more work to do!
+ * 'complete' can return DOMORE_INCOMPLETE, DOMORE_DONE or DOMORE_GOBACK
+ * (to DOING state when there is more work to do)
  */
 
-static CURLcode multi_do_more(struct Curl_easy *data, int *complete)
+static CURLcode multi_do_more(struct Curl_easy *data, domore *complete)
 {
   CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
 
-  *complete = 0;
+  *complete = DOMORE_INCOMPLETE;
 
-  if(conn->handler->do_more)
-    result = conn->handler->do_more(data, complete);
+  if(conn->scheme->run->do_more)
+    result = conn->scheme->run->do_more(data, complete);
 
   return result;
 }
@@ -1630,52 +1815,52 @@ static CURLcode multi_do_more(struct Curl_easy *data, int *complete)
  * Check whether a timeout occurred, and handle it if it did
  */
 static bool multi_handle_timeout(struct Curl_easy *data,
-                                 struct curltime *now,
                                  bool *stream_error,
-                                 CURLcode *result,
-                                 bool connect_timeout)
+                                 CURLcode *result)
 {
   timediff_t timeout_ms;
-  timeout_ms = Curl_timeleft(data, now, connect_timeout);
 
+  timeout_ms = Curl_timeleft_ms(data);
   if(timeout_ms < 0) {
     /* Handle timed out */
-    if(data->mstate == MSTATE_RESOLVING)
-      failf(data, "Resolving timed out after %" CURL_FORMAT_TIMEDIFF_T
-            " milliseconds",
-            Curl_timediff(*now, data->progress.t_startsingle));
-    else if(data->mstate == MSTATE_CONNECTING)
-      failf(data, "Connection timed out after %" CURL_FORMAT_TIMEDIFF_T
-            " milliseconds",
-            Curl_timediff(*now, data->progress.t_startsingle));
+    struct curltime since;
+    if(Curl_is_connecting(data))
+      since = data->progress.t_startsingle;
+    else
+      since = data->progress.t_startop;
+    if(data->mstate == MSTATE_CONNECTING)
+      failf(data, "%s timed out after %" FMT_TIMEDIFF_T " milliseconds",
+            data->conn->bits.dns_resolved ? "Connection" : "Resolving",
+            curlx_ptimediff_ms(Curl_pgrs_now(data), &since));
     else {
       struct SingleRequest *k = &data->req;
       if(k->size != -1) {
-        failf(data, "Operation timed out after %" CURL_FORMAT_TIMEDIFF_T
-              " milliseconds with %" CURL_FORMAT_CURL_OFF_T " out of %"
-              CURL_FORMAT_CURL_OFF_T " bytes received",
-              Curl_timediff(*now, data->progress.t_startsingle),
+        failf(data, "Operation timed out after %" FMT_TIMEDIFF_T
+              " milliseconds with %" FMT_OFF_T " out of %"
+              FMT_OFF_T " bytes received",
+              curlx_ptimediff_ms(Curl_pgrs_now(data), &since),
               k->bytecount, k->size);
       }
       else {
-        failf(data, "Operation timed out after %" CURL_FORMAT_TIMEDIFF_T
-              " milliseconds with %" CURL_FORMAT_CURL_OFF_T
-              " bytes received",
-              Curl_timediff(*now, data->progress.t_startsingle),
+        failf(data, "Operation timed out after %" FMT_TIMEDIFF_T
+              " milliseconds with %" FMT_OFF_T " bytes received",
+              curlx_ptimediff_ms(Curl_pgrs_now(data), &since),
               k->bytecount);
       }
     }
-
-    /* Force connection closed if the connection has indeed been used */
-    if(data->mstate > MSTATE_DO) {
-      streamclose(data->conn, "Disconnected with pending data");
-      *stream_error = TRUE;
-    }
     *result = CURLE_OPERATION_TIMEDOUT;
-    (void)multi_done(data, *result, TRUE);
+    if(data->conn) {
+      /* Force connection closed if the connection has indeed been used */
+      if(data->mstate > MSTATE_DO) {
+        streamclose(data->conn, "Disconnect due to timeout");
+        *stream_error = TRUE;
+      }
+      (void)multi_done(data, *result, TRUE);
+    }
+    return TRUE;
   }
 
-  return (timeout_ms < 0);
+  return FALSE;
 }
 
 /*
@@ -1689,9 +1874,9 @@ static CURLcode protocol_connecting(struct Curl_easy *data, bool *done)
   CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
 
-  if(conn && conn->handler->connecting) {
+  if(conn && conn->scheme->run->connecting) {
     *done = FALSE;
-    result = conn->handler->connecting(data, done);
+    result = conn->scheme->run->connecting(data, done);
   }
   else
     *done = TRUE;
@@ -1709,9 +1894,9 @@ static CURLcode protocol_doing(struct Curl_easy *data, bool *done)
   CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
 
-  if(conn && conn->handler->doing) {
+  if(conn && conn->scheme->run->doing) {
     *done = FALSE;
-    result = conn->handler->doing(data, done);
+    result = conn->scheme->run->doing(data, done);
   }
   else
     *done = TRUE;
@@ -1724,145 +1909,30 @@ static CURLcode protocol_doing(struct Curl_easy *data, bool *done)
  * proceed with some action.
  *
  */
-static CURLcode protocol_connect(struct Curl_easy *data,
-                                 bool *protocol_done)
+static CURLcode protocol_connect(struct Curl_easy *data, bool *protocol_done)
 {
-  CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
+  CURLcode result = CURLE_OK;
+
   DEBUGASSERT(conn);
   DEBUGASSERT(protocol_done);
+  DEBUGASSERT(Curl_conn_is_connected(conn, FIRSTSOCKET));
 
   *protocol_done = FALSE;
-
-  if(Curl_conn_is_connected(conn, FIRSTSOCKET)
-     && conn->bits.protoconnstart) {
-    /* We already are connected, get back. This may happen when the connect
-       worked fine in the first call, like when we connect to a local server
-       or proxy. Note that we don't know if the protocol is actually done.
-
-       Unless this protocol doesn't have any protocol-connect callback, as
-       then we know we're done. */
-    if(!conn->handler->connecting)
-      *protocol_done = TRUE;
-
-    return CURLE_OK;
-  }
-
   if(!conn->bits.protoconnstart) {
-    if(conn->handler->connect_it) {
-      /* is there a protocol-specific connect() procedure? */
-
+    if(conn->scheme->run->connect_it) {
       /* Call the protocol-specific connect function */
-      result = conn->handler->connect_it(data, protocol_done);
+      result = conn->scheme->run->connect_it(data, protocol_done);
+      if(result)
+        return result;
     }
-    else
-      *protocol_done = TRUE;
-
-    /* it has started, possibly even completed but that knowledge isn't stored
-       in this bit! */
-    if(!result)
-      conn->bits.protoconnstart = TRUE;
-  }
-
-  return result; /* pass back status */
-}
-
-/*
- * readrewind() rewinds the read stream. This is typically used for HTTP
- * POST/PUT with multi-pass authentication when a sending was denied and a
- * resend is necessary.
- */
-static CURLcode readrewind(struct Curl_easy *data)
-{
-  curl_mimepart *mimepart = &data->set.mimepost;
-  DEBUGASSERT(data->conn);
-
-  data->state.rewindbeforesend = FALSE; /* we rewind now */
-
-  /* explicitly switch off sending data on this connection now since we are
-     about to restart a new transfer and thus we want to avoid inadvertently
-     sending more data on the existing connection until the next transfer
-     starts */
-  data->req.keepon &= ~KEEP_SEND;
-
-  /* We have sent away data. If not using CURLOPT_POSTFIELDS or
-     CURLOPT_HTTPPOST, call app to rewind
-  */
-#ifndef CURL_DISABLE_HTTP
-  if(data->conn->handler->protocol & PROTO_FAMILY_HTTP) {
-    if(data->state.mimepost)
-      mimepart = data->state.mimepost;
-  }
-#endif
-  if(data->set.postfields ||
-     (data->state.httpreq == HTTPREQ_GET) ||
-     (data->state.httpreq == HTTPREQ_HEAD))
-    ; /* no need to rewind */
-  else if(data->state.httpreq == HTTPREQ_POST_MIME ||
-          data->state.httpreq == HTTPREQ_POST_FORM) {
-    CURLcode result = Curl_mime_rewind(mimepart);
-    if(result) {
-      failf(data, "Cannot rewind mime/post data");
-      return result;
-    }
-  }
-  else {
-    if(data->set.seek_func) {
-      int err;
-
-      Curl_set_in_callback(data, true);
-      err = (data->set.seek_func)(data->set.seek_client, 0, SEEK_SET);
-      Curl_set_in_callback(data, false);
-      if(err) {
-        failf(data, "seek callback returned error %d", (int)err);
-        return CURLE_SEND_FAIL_REWIND;
-      }
-    }
-    else if(data->set.ioctl_func) {
-      curlioerr err;
-
-      Curl_set_in_callback(data, true);
-      err = (data->set.ioctl_func)(data, CURLIOCMD_RESTARTREAD,
-                                   data->set.ioctl_client);
-      Curl_set_in_callback(data, false);
-      infof(data, "the ioctl callback returned %d", (int)err);
-
-      if(err) {
-        failf(data, "ioctl callback returned error %d", (int)err);
-        return CURLE_SEND_FAIL_REWIND;
-      }
-    }
-    else {
-      /* If no CURLOPT_READFUNCTION is used, we know that we operate on a
-         given FILE * stream and we can actually attempt to rewind that
-         ourselves with fseek() */
-      if(data->state.fread_func == (curl_read_callback)fread) {
-        if(-1 != fseek(data->state.in, 0, SEEK_SET))
-          /* successful rewind */
-          return CURLE_OK;
-      }
-
-      /* no callback set or failure above, makes us fail at once */
-      failf(data, "necessary data rewind wasn't possible");
-      return CURLE_SEND_FAIL_REWIND;
-    }
-  }
-  return CURLE_OK;
-}
-
-/*
- * Curl_preconnect() is called immediately before a connect starts. When a
- * redirect is followed, this is then called multiple times during a single
- * transfer.
- */
-CURLcode Curl_preconnect(struct Curl_easy *data)
-{
-  if(!data->state.buffer) {
-    data->state.buffer = malloc(data->set.buffer_size + 1);
-    if(!data->state.buffer)
-      return CURLE_OUT_OF_MEMORY;
+    conn->bits.protoconnstart = TRUE;
   }
 
+  /* Unless this protocol does not have any protocol-connect callback, as
+     then we know we are done. */
+  if(!conn->scheme->run->connecting)
+    *protocol_done = TRUE;
   return CURLE_OK;
 }
 
@@ -1871,21 +1941,785 @@ static void set_in_callback(struct Curl_multi *multi, bool value)
   multi->in_callback = value;
 }
 
-static CURLMcode multi_runsingle(struct Curl_multi *multi,
-                                 struct curltime *nowp,
-                                 struct Curl_easy *data)
+/*
+ * posttransfer() is called immediately after a transfer ends
+ */
+static void multi_posttransfer(struct Curl_easy *data)
 {
-  struct Curl_message *msg = NULL;
-  bool connected;
-  bool async;
-  bool protocol_connected = FALSE;
-  bool dophase_done = FALSE;
-  bool done = FALSE;
-  CURLMcode rc;
+#if defined(HAVE_SIGNAL) && defined(SIGPIPE) && !defined(MSG_NOSIGNAL)
+  /* restore the signal handler for SIGPIPE before we get back */
+  if(!data->set.no_signal)
+    signal(SIGPIPE, data->state.prev_signal);
+#else
+  (void)data;
+#endif
+}
+
+/*
+ * multi_follow() handles the URL redirect magic. Pass in the 'newurl' string
+ * as given by the remote server and set up the new URL to request.
+ *
+ * This function DOES NOT FREE the given URL.
+ */
+static CURLcode multi_follow(struct Curl_easy *data,
+                             const struct Curl_scheme *handler,
+                             const char *newurl, /* the Location: string */
+                             followtype type) /* see transfer.h */
+{
+  if(handler && handler->run->follow)
+    return handler->run->follow(data, newurl, type);
+
+  if(type == FOLLOW_RETRY)
+    /* Retries are generic and do not require protocol-specific redirect
+       handling. */
+    return CURLE_OK;
+
+  return CURLE_TOO_MANY_REDIRECTS;
+}
+
+static CURLcode mspeed_check(struct Curl_easy *data)
+{
+  if(Curl_rlimit_active(&data->progress.dl.rlimit) ||
+     Curl_rlimit_active(&data->progress.ul.rlimit)) {
+    /* check if our send/recv limits require idle waits */
+    const struct curltime *pnow = Curl_pgrs_now(data);
+    timediff_t recv_ms, send_ms;
+
+    send_ms = Curl_rlimit_wait_ms(&data->progress.ul.rlimit, pnow);
+    recv_ms = Curl_rlimit_wait_ms(&data->progress.dl.rlimit, pnow);
+
+    if(send_ms || recv_ms) {
+      if(data->mstate != MSTATE_RATELIMITING) {
+        multistate(data, MSTATE_RATELIMITING);
+      }
+      Curl_expire(data, CURLMAX(send_ms, recv_ms), EXPIRE_TOOFAST);
+      Curl_multi_clear_dirty(data);
+      CURL_TRC_M(data, "[RLIMIT] waiting %" FMT_TIMEDIFF_T "ms",
+                 CURLMAX(send_ms, recv_ms));
+      return CURLE_AGAIN;
+    }
+    else {
+      /* when will the rate limits increase next? The transfer needs
+       * to run again at that time or it may stall. */
+      send_ms = Curl_rlimit_next_step_ms(&data->progress.ul.rlimit, pnow);
+      recv_ms = Curl_rlimit_next_step_ms(&data->progress.dl.rlimit, pnow);
+      if(send_ms || recv_ms) {
+        timediff_t next_ms = CURLMIN(send_ms, recv_ms);
+        if(!next_ms)
+          next_ms = CURLMAX(send_ms, recv_ms);
+        Curl_expire(data, next_ms, EXPIRE_TOOFAST);
+        CURL_TRC_M(data, "[RLIMIT] next token update in %" FMT_TIMEDIFF_T "ms",
+                   next_ms);
+      }
+    }
+  }
+
+  if(data->mstate != MSTATE_PERFORMING) {
+    CURL_TRC_M(data, "[RLIMIT] wait over, continue");
+    multistate(data, MSTATE_PERFORMING);
+  }
+  return CURLE_OK;
+}
+
+static CURLMcode multistate_performing(struct Curl_easy *data,
+                                       bool *stream_errorp,
+                                       CURLcode *resultp)
+{
+  char *newurl = NULL;
+  bool retry = FALSE;
+  CURLMcode mresult = CURLM_OK;
+  CURLcode result = *resultp = CURLE_OK;
+  *stream_errorp = FALSE;
+
+  if(mspeed_check(data) == CURLE_AGAIN)
+    return CURLM_OK;
+
+  /* read/write data if it is ready to do so */
+  result = Curl_sendrecv(data);
+
+  if(data->req.done || (result == CURLE_RECV_ERROR)) {
+    /* If CURLE_RECV_ERROR happens early enough, we assume it was a race
+     * condition and the server closed the reused connection exactly when we
+     * wanted to use it, so figure out if that is indeed the case.
+     */
+    CURLcode ret = Curl_retry_request(data, &newurl);
+    if(!ret)
+      retry = !!newurl;
+    else if(!result)
+      result = ret;
+
+    if(retry) {
+      /* if we are to retry, set the result to OK and consider the
+         request as done */
+      result = CURLE_OK;
+      data->req.done = TRUE;
+    }
+  }
+#ifndef CURL_DISABLE_HTTP
+  else if((result == CURLE_HTTP2_STREAM) &&
+          Curl_h2_http_1_1_error(data)) {
+    CURLcode ret = Curl_retry_request(data, &newurl);
+
+    if(!ret) {
+      infof(data, "Downgrades to HTTP/1.1");
+      streamclose(data->conn, "Disconnect HTTP/2 for HTTP/1");
+      data->state.http_neg.wanted = CURL_HTTP_V1x;
+      data->state.http_neg.allowed = CURL_HTTP_V1x;
+      /* clear the error message bit too as we ignore the one we got */
+      data->state.errorbuf = FALSE;
+      if(!newurl)
+        /* typically for HTTP_1_1_REQUIRED error on first flight */
+        newurl = Curl_bufref_dup(&data->state.url);
+      if(!newurl) {
+        result = CURLE_OUT_OF_MEMORY;
+      }
+      else {
+        /* if we are to retry, set the result to OK and consider the request
+          as done */
+        retry = TRUE;
+        result = CURLE_OK;
+        data->req.done = TRUE;
+      }
+    }
+    else
+      result = ret;
+  }
+#endif
+
+  if(result) {
+    /*
+     * The transfer phase returned error, we mark the connection to get closed
+     * to prevent being reused. This is because we cannot possibly know if the
+     * connection is in a good shape or not now. Unless it is a protocol which
+     * uses two "channels" like FTP, as then the error happened in the data
+     * connection.
+     */
+
+    if(!(data->conn->scheme->flags & PROTOPT_DUAL) &&
+       result != CURLE_HTTP2_STREAM)
+      streamclose(data->conn, "Transfer returned error");
+
+    multi_posttransfer(data);
+    multi_done(data, result, TRUE);
+  }
+  else if(data->req.done && !Curl_cwriter_is_paused(data)) {
+    const struct Curl_scheme *handler = data->conn->scheme;
+
+    /* call this even if the readwrite function returned error */
+    multi_posttransfer(data);
+
+    /* When we follow redirects or is set to retry the connection, we must to
+       go back to the CONNECT state */
+    if(data->req.newurl || retry) {
+      followtype follow = FOLLOW_NONE;
+      if(!retry) {
+        /* if the URL is a follow-location and not a retried request then
+           figure out the URL here */
+        curlx_free(newurl);
+        newurl = data->req.newurl;
+        data->req.newurl = NULL;
+        follow = FOLLOW_REDIR;
+      }
+      else
+        follow = FOLLOW_RETRY;
+      (void)multi_done(data, CURLE_OK, FALSE);
+      /* multi_done() might return CURLE_GOT_NOTHING */
+      result = multi_follow(data, handler, newurl, follow);
+      if(!result) {
+        multistate(data, MSTATE_SETUP);
+        mresult = CURLM_CALL_MULTI_PERFORM;
+      }
+    }
+    else {
+      /* after the transfer is done, go DONE */
+
+      /* but first check to see if we got a location info even though we are
+         not following redirects */
+      if(data->req.location) {
+        curlx_free(newurl);
+        newurl = data->req.location;
+        data->req.location = NULL;
+        result = multi_follow(data, handler, newurl, FOLLOW_FAKE);
+        if(result) {
+          *stream_errorp = TRUE;
+          result = multi_done(data, result, TRUE);
+        }
+      }
+
+      if(!result) {
+        multistate(data, MSTATE_DONE);
+        mresult = CURLM_CALL_MULTI_PERFORM;
+      }
+    }
+  }
+  else { /* not errored, not done */
+    mspeed_check(data);
+  }
+  curlx_free(newurl);
+  *resultp = result;
+  return mresult;
+}
+
+static CURLMcode multistate_do(struct Curl_easy *data,
+                               bool *stream_errorp,
+                               CURLcode *resultp)
+{
+  CURLMcode mresult = CURLM_OK;
+  CURLcode result = CURLE_OK;
+  if(data->set.fprereq) {
+    int prereq_rc;
+
+    /* call the prerequest callback function */
+    Curl_set_in_callback(data, TRUE);
+    prereq_rc = data->set.fprereq(data->set.prereq_userp,
+                                  data->info.primary.remote_ip,
+                                  data->info.primary.local_ip,
+                                  data->info.primary.remote_port,
+                                  data->info.primary.local_port);
+    Curl_set_in_callback(data, FALSE);
+    if(prereq_rc != CURL_PREREQFUNC_OK) {
+      failf(data, "operation aborted by pre-request callback");
+      /* failure in pre-request callback - do not do any other processing */
+      result = CURLE_ABORTED_BY_CALLBACK;
+      multi_posttransfer(data);
+      multi_done(data, result, FALSE);
+      *stream_errorp = TRUE;
+      goto end;
+    }
+  }
+
+  if(data->set.connect_only && !data->set.connect_only_ws) {
+    multistate(data, MSTATE_DONE);
+    mresult = CURLM_CALL_MULTI_PERFORM;
+  }
+  else {
+    bool dophase_done = FALSE;
+    /* Perform the protocol's DO action */
+    result = multi_do(data, &dophase_done);
+
+    if(!result) {
+      if(!dophase_done) {
+#ifndef CURL_DISABLE_FTP
+        /* some steps needed for wildcard matching */
+        if(data->state.wildcardmatch) {
+          struct WildcardData *wc = data->wildcard;
+          if(wc->state == CURLWC_DONE || wc->state == CURLWC_SKIP) {
+            /* skip some states if it is important */
+            multi_done(data, CURLE_OK, FALSE);
+
+            /* if there is no connection left, skip the DONE state */
+            multistate(data, data->conn ? MSTATE_DONE : MSTATE_COMPLETED);
+            mresult = CURLM_CALL_MULTI_PERFORM;
+            goto end;
+          }
+        }
+#endif
+        /* DO was not completed in one function call, we must continue
+           DOING... */
+        multistate(data, MSTATE_DOING);
+        mresult = CURLM_CALL_MULTI_PERFORM;
+      }
+
+      /* after DO, go DO_DONE... or DO_MORE */
+      else if(data->conn->bits.do_more) {
+        /* we are supposed to do more, but we need to sit down, relax and wait
+           a little while first */
+        multistate(data, MSTATE_DOING_MORE);
+        mresult = CURLM_CALL_MULTI_PERFORM;
+      }
+      else {
+        /* we are done with the DO, now DID */
+        multistate(data, MSTATE_DID);
+        mresult = CURLM_CALL_MULTI_PERFORM;
+      }
+    }
+    else if((result == CURLE_SEND_ERROR) &&
+            data->conn->bits.reuse) {
+      /*
+       * In this situation, a connection that we were trying to use may have
+       * unexpectedly died. If possible, send the connection back to the
+       * CONNECT phase so we can try again.
+       */
+      const struct Curl_scheme *handler = data->conn->scheme;
+      char *newurl = NULL;
+      followtype follow = FOLLOW_NONE;
+      CURLcode drc;
+
+      drc = Curl_retry_request(data, &newurl);
+      if(drc) {
+        /* a failure here pretty much implies an out of memory */
+        result = drc;
+        *stream_errorp = TRUE;
+      }
+
+      multi_posttransfer(data);
+      drc = multi_done(data, result, FALSE);
+
+      /* When set to retry the connection, we must go back to the CONNECT
+       * state */
+      if(newurl) {
+        if(!drc || (drc == CURLE_SEND_ERROR)) {
+          follow = FOLLOW_RETRY;
+          drc = multi_follow(data, handler, newurl, follow);
+          if(!drc) {
+            multistate(data, MSTATE_SETUP);
+            mresult = CURLM_CALL_MULTI_PERFORM;
+            result = CURLE_OK;
+          }
+          else {
+            /* Follow failed */
+            result = drc;
+          }
+        }
+        else {
+          /* done did not return OK or SEND_ERROR */
+          result = drc;
+        }
+      }
+      else {
+        /* Have error handler disconnect conn if we cannot retry */
+        *stream_errorp = TRUE;
+      }
+      curlx_free(newurl);
+    }
+    else {
+      /* failure detected */
+      multi_posttransfer(data);
+      if(data->conn)
+        multi_done(data, result, FALSE);
+      *stream_errorp = TRUE;
+    }
+  }
+end:
+  *resultp = result;
+  return mresult;
+}
+
+static CURLMcode multistate_ratelimiting(struct Curl_easy *data,
+                                         CURLcode *resultp)
+{
+  CURLcode result = CURLE_OK;
+  CURLMcode mresult = CURLM_OK;
+  DEBUGASSERT(data->conn);
+  /* if both rates are within spec, resume transfer */
+  result = Curl_pgrsCheck(data);
+
+  if(result) {
+    if(!(data->conn->scheme->flags & PROTOPT_DUAL) &&
+       result != CURLE_HTTP2_STREAM)
+      streamclose(data->conn, "Transfer returned error");
+
+    multi_posttransfer(data);
+    multi_done(data, result, TRUE);
+  }
+  else {
+    if(!mspeed_check(data))
+      mresult = CURLM_CALL_MULTI_PERFORM;
+  }
+  *resultp = result;
+  return mresult;
+}
+
+static CURLMcode multistate_connect(struct Curl_multi *multi,
+                                    struct Curl_easy *data,
+                                    CURLcode *resultp)
+{
+  /* Connect. We want to get a connection identifier filled in. This state can
+     be entered from SETUP and from PENDING. */
+  bool connected;
+  CURLMcode mresult = CURLM_OK;
+  CURLcode result = Curl_connect(data, &connected);
+  if(result == CURLE_NO_CONNECTION_AVAILABLE) {
+    /* There was no connection available. We will go to the pending state and
+       wait for an available connection. */
+    multistate(data, MSTATE_PENDING);
+    /* move from process to pending set */
+    Curl_uint32_bset_remove(&multi->process, data->mid);
+    Curl_uint32_bset_remove(&multi->dirty, data->mid);
+    Curl_uint32_bset_add(&multi->pending, data->mid);
+    *resultp = CURLE_OK;
+    return mresult;
+  }
+  else
+    process_pending_handles(data->multi);
+
+  if(!result) {
+    /* after the connect has been sent off, go WAITCONNECT unless the
+       protocol connect is already done and we can go directly to WAITDO or
+       DO! */
+    mresult = CURLM_CALL_MULTI_PERFORM;
+
+    if(connected) {
+      if(!data->conn->bits.reuse &&
+         Curl_conn_is_multiplex(data->conn, FIRSTSOCKET)) {
+        /* new connection, can multiplex, wake pending handles */
+        process_pending_handles(data->multi);
+      }
+      multistate(data, MSTATE_PROTOCONNECT);
+    }
+    else {
+      multistate(data, MSTATE_CONNECTING);
+    }
+  }
+  *resultp = result;
+  return mresult;
+}
+
+/* returns the possibly updated result */
+static CURLcode is_finished(struct Curl_multi *multi,
+                            struct Curl_easy *data,
+                            bool stream_error,
+                            CURLcode result)
+{
+  if(data->mstate < MSTATE_COMPLETED) {
+    if(result) {
+      /*
+       * If an error was returned, and we are not in completed state now,
+       * then we go to completed and consider this transfer aborted.
+       */
+
+      /* No attempt to disconnect connections must be made before this -
+         connection detach and termination happens only here */
+
+      /* Check if we can move pending requests to send pipe */
+      process_pending_handles(multi); /* connection */
+
+      if(data->conn) {
+        if(stream_error) {
+          /* Do not attempt to send data over a connection that timed out */
+          bool dead_connection = result == CURLE_OPERATION_TIMEDOUT;
+          struct connectdata *conn = data->conn;
+
+          /* This is where we make sure that the conn pointer is reset.
+             We do not have to do this in every case block above where a
+             failure is detected */
+          Curl_detach_connection(data);
+          Curl_conn_terminate(data, conn, dead_connection);
+        }
+      }
+      else if(data->mstate == MSTATE_CONNECT) {
+        /* Curl_connect() failed */
+        multi_posttransfer(data);
+        Curl_pgrsUpdate_nometer(data);
+      }
+
+      multistate(data, MSTATE_COMPLETED);
+      return result;
+    }
+    /* if there is still a connection to use, call the progress function */
+    else if(data->conn && Curl_conn_is_connected(data->conn, FIRSTSOCKET)) {
+      result = Curl_pgrsUpdate(data);
+      if(result) {
+        /* aborted due to progress callback return code must close the
+           connection */
+        streamclose(data->conn, "Aborted by callback");
+
+        /* if not yet in DONE state, go there, otherwise COMPLETED */
+        multistate(data, (data->mstate < MSTATE_DONE) ?
+                   MSTATE_DONE : MSTATE_COMPLETED);
+        return result;
+      }
+    }
+  }
+  return result;
+}
+
+static void handle_completed(struct Curl_multi *multi,
+                             struct Curl_easy *data,
+                             CURLcode result)
+{
+  if(data->master_mid != UINT32_MAX) {
+    /* A sub transfer, not for msgsent to application */
+    struct Curl_easy *mdata;
+
+    CURL_TRC_M(data, "sub xfer done for master %u", data->master_mid);
+    mdata = Curl_multi_get_easy(multi, data->master_mid);
+    if(mdata) {
+      if(mdata->sub_xfer_done)
+        mdata->sub_xfer_done(mdata, data, result);
+      else
+        CURL_TRC_M(data, "master easy %u without sub_xfer_done callback.",
+                   data->master_mid);
+    }
+    else {
+      CURL_TRC_M(data, "master easy %u already gone.", data->master_mid);
+    }
+  }
+  else {
+    /* now fill in the Curl_message with this info */
+    struct Curl_message *msg = &data->msg;
+
+    msg->extmsg.msg = CURLMSG_DONE;
+    msg->extmsg.easy_handle = data;
+    msg->extmsg.data.result = result;
+
+    multi_addmsg(multi, msg);
+    DEBUGASSERT(!data->conn);
+  }
+  multistate(data, MSTATE_MSGSENT);
+
+  /* remove from the other sets, add to msgsent */
+  Curl_uint32_bset_remove(&multi->process, data->mid);
+  Curl_uint32_bset_remove(&multi->dirty, data->mid);
+  Curl_uint32_bset_remove(&multi->pending, data->mid);
+  Curl_uint32_bset_add(&multi->msgsent, data->mid);
+  if(data->state.really_alive) {
+    data->state.really_alive = FALSE;
+    --multi->xfers_really_alive;
+    if(!multi->xfers_really_alive)
+      (void)multi_assess_wakeup(multi);
+  }
+  --multi->xfers_alive;
+  if(!multi->xfers_alive)
+    multi_assess_wakeup(multi);
+}
+
+static CURLMcode multistate_init(struct Curl_easy *data, CURLcode *result)
+{
+  if(!data->state.really_alive) {
+    data->state.really_alive = TRUE;
+    ++data->multi->xfers_really_alive;
+    if(data->multi->xfers_really_alive == 1) {
+      CURLMcode mresult = multi_assess_wakeup(data->multi);
+      if(mresult) {
+        failf(data, "error enabling wakeup listening: %d", mresult);
+        return mresult;
+      }
+    }
+  }
+
+  *result = Curl_pretransfer(data);
+  if(*result)
+    return CURLM_OK;
+
+  /* after init, go SETUP */
+  multistate(data, MSTATE_SETUP);
+  Curl_pgrsTime(data, TIMER_STARTOP);
+  return CURLM_CALL_MULTI_PERFORM;
+}
+
+static CURLMcode multistate_setup(struct Curl_easy *data)
+{
+  Curl_pgrsTime(data, TIMER_STARTSINGLE);
+  if(data->set.timeout)
+    Curl_expire(data, data->set.timeout, EXPIRE_TIMEOUT);
+  if(data->set.connecttimeout)
+    /* Since a connection might go to pending and back to CONNECT several
+       times before it actually takes off, we need to set the timeout once
+       in SETUP before we enter CONNECT the first time. */
+    Curl_expire(data, data->set.connecttimeout, EXPIRE_CONNECTTIMEOUT);
+
+  multistate(data, MSTATE_CONNECT);
+  return CURLM_CALL_MULTI_PERFORM;
+}
+
+static CURLMcode multistate_connecting(struct Curl_easy *data,
+                                       bool *stream_error,
+                                       CURLcode *result)
+{
+  bool connected;
+
+  if(!data->conn) {
+    DEBUGASSERT(0);
+    *result = CURLE_FAILED_INIT;
+    return CURLM_OK;
+  }
+  if(!Curl_xfer_recv_is_paused(data)) {
+    *result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &connected);
+    if(connected && !*result) {
+      if(!data->conn->bits.reuse &&
+         Curl_conn_is_multiplex(data->conn, FIRSTSOCKET)) {
+        /* new connection, can multiplex, wake pending handles */
+        process_pending_handles(data->multi);
+      }
+      multistate(data, MSTATE_PROTOCONNECT);
+      return CURLM_CALL_MULTI_PERFORM;
+    }
+    else if(*result) {
+      /* failure detected */
+      CURL_TRC_M(data, "connect failed -> %d", (int)*result);
+      multi_posttransfer(data);
+      multi_done(data, *result, TRUE);
+      *stream_error = TRUE;
+      return CURLM_OK;
+    }
+  }
+  return CURLM_OK;
+}
+
+static CURLMcode multistate_protoconnect(struct Curl_easy *data,
+                                         bool *stream_error,
+                                         CURLcode *result)
+{
+  bool protocol_connected = FALSE;
+
+  if(!*result && data->conn->bits.reuse) {
+    /* ftp seems to hang when protoconnect on reused connection since we
+     * handle PROTOCONNECT in general inside the filters, it seems wrong to
+     * restart this on a reused connection.
+     */
+    multistate(data, MSTATE_DO);
+    return CURLM_CALL_MULTI_PERFORM;
+  }
+  if(!*result)
+    *result = protocol_connect(data, &protocol_connected);
+  if(!*result && !protocol_connected) {
+    /* switch to waiting state */
+    multistate(data, MSTATE_PROTOCONNECTING);
+    return CURLM_CALL_MULTI_PERFORM;
+  }
+  else if(!*result) {
+    /* protocol connect has completed, go WAITDO or DO */
+    multistate(data, MSTATE_DO);
+    return CURLM_CALL_MULTI_PERFORM;
+  }
+
+  /* failure detected */
+  multi_posttransfer(data);
+  multi_done(data, *result, TRUE);
+  *stream_error = TRUE;
+  return CURLM_OK;
+}
+
+static CURLMcode multistate_protoconnecting(struct Curl_easy *data,
+                                            bool *stream_error,
+                                            CURLcode *result)
+{
+  bool protocol_connected = FALSE;
+
+  /* protocol-specific connect phase */
+  *result = protocol_connecting(data, &protocol_connected);
+  if(!*result && protocol_connected) {
+    /* after the connect has completed, go WAITDO or DO */
+    multistate(data, MSTATE_DO);
+    return CURLM_CALL_MULTI_PERFORM;
+  }
+  else if(*result) {
+    /* failure detected */
+    multi_posttransfer(data);
+    multi_done(data, *result, TRUE);
+    *stream_error = TRUE;
+  }
+  return CURLM_OK;
+}
+
+static CURLMcode multistate_doing(struct Curl_easy *data,
+                                  bool *stream_error,
+                                  CURLcode *result)
+{
+  bool dophase_done = FALSE;
+
+  /* we continue DOING until the DO phase is complete */
+  DEBUGASSERT(data->conn);
+  *result = protocol_doing(data, &dophase_done);
+  if(!*result) {
+    if(dophase_done) {
+      /* after DO, go DO_DONE or DO_MORE */
+      multistate(data, data->conn->bits.do_more ?
+                 MSTATE_DOING_MORE : MSTATE_DID);
+      return CURLM_CALL_MULTI_PERFORM;
+    } /* dophase_done */
+  }
+  else {
+    /* failure detected */
+    multi_posttransfer(data);
+    multi_done(data, *result, FALSE);
+    *stream_error = TRUE;
+  }
+  return CURLM_OK;
+}
+
+static CURLMcode multistate_doing_more(struct Curl_easy *data,
+                                       bool *stream_error,
+                                       CURLcode *result)
+{
+  domore control;
+
+  /*
+   * When we are connected, DOING MORE and then go DID
+   */
+  DEBUGASSERT(data->conn);
+  *result = multi_do_more(data, &control);
+
+  if(!*result) {
+    if(control != DOMORE_INCOMPLETE) {
+      /* if DONE, advance to DO_DONE
+         if GOBACK, go back to DOING */
+      multistate(data, control == DOMORE_DONE ? MSTATE_DID : MSTATE_DOING);
+      return CURLM_CALL_MULTI_PERFORM;
+    }
+    /* else
+       stay in DO_MORE */
+  }
+  else {
+    /* failure detected */
+    multi_posttransfer(data);
+    multi_done(data, *result, FALSE);
+    *stream_error = TRUE;
+  }
+  return CURLM_OK;
+}
+
+static CURLMcode multistate_did(struct Curl_multi *multi,
+                                struct Curl_easy *data)
+{
+  DEBUGASSERT(data->conn);
+  if(data->conn->bits.multiplex)
+    /* Check if we can move pending requests to send pipe */
+    process_pending_handles(multi); /* multiplexed */
+
+  /* Only perform the transfer if there is a good socket to work with.
+     Having both BAD is a signal to skip immediately to DONE */
+  if(CONN_SOCK_IDX_VALID(data->conn->recv_idx) ||
+     CONN_SOCK_IDX_VALID(data->conn->send_idx))
+    multistate(data, MSTATE_PERFORMING);
+  else {
+#ifndef CURL_DISABLE_FTP
+    if(data->state.wildcardmatch &&
+       ((data->conn->scheme->flags & PROTOPT_WILDCARD) == 0)) {
+      data->wildcard->state = CURLWC_DONE;
+    }
+#endif
+    multistate(data, MSTATE_DONE);
+  }
+  return CURLM_CALL_MULTI_PERFORM;
+}
+
+static CURLMcode multistate_done(struct Curl_easy *data, CURLcode *presult)
+{
+  if(data->conn) {
+    CURLcode result;
+
+    /* post-transfer command */
+    result = multi_done(data, *presult, FALSE);
+
+    /* allow a previously set error code take precedence */
+    if(!(*presult))
+      *presult = result;
+  }
+
+#ifndef CURL_DISABLE_FTP
+  if(data->state.wildcardmatch) {
+    if(data->wildcard->state != CURLWC_DONE) {
+      /* if a wildcard is set and we are not ending -> lets start again
+         with MSTATE_INIT */
+      multistate(data, MSTATE_INIT);
+      return CURLM_CALL_MULTI_PERFORM;
+    }
+  }
+#endif
+  /* after we have DONE what we are supposed to do, go COMPLETED, and
+     it does not matter what the multi_done() returned! */
+  multistate(data, MSTATE_COMPLETED);
+  return CURLM_CALL_MULTI_PERFORM;
+}
+
+static CURLMcode multi_runsingle(struct Curl_multi *multi,
+                                 struct Curl_easy *data,
+                                 struct Curl_sigpipe_ctx *sigpipe_ctx)
+{
+  CURLMcode mresult;
   CURLcode result = CURLE_OK;
-  timediff_t recv_timeout_ms;
-  timediff_t send_timeout_ms;
-  int control;
 
   if(!GOOD_EASY_HANDLE(data))
     return CURLM_BAD_EASY_HANDLE;
@@ -1894,21 +2728,39 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
     /* a multi-level callback returned error before, meaning every individual
      transfer now has failed */
     result = CURLE_ABORTED_BY_CALLBACK;
-    Curl_posttransfer(data);
+    multi_posttransfer(data);
     multi_done(data, result, FALSE);
     multistate(data, MSTATE_COMPLETED);
   }
 
   multi_warn_debug(multi, data);
 
+  /* transfer runs now, clear the dirty bit. This may be set
+   * again during processing, triggering a re-run later. */
+  Curl_uint32_bset_remove(&multi->dirty, data->mid);
+
+  if(data == multi->admin) {
+#ifdef ENABLE_WAKEUP
+    /* Consume any pending wakeup signals before processing.
+     * This is necessary for event based processing. See #21547 */
+    (void)Curl_wakeup_consume(multi->wakeup_pair, TRUE);
+#endif
+#ifdef USE_RESOLV_THREADED
+    Curl_async_thrdd_multi_process(multi);
+#endif
+    Curl_cshutdn_perform(&multi->cshutdn, multi->admin, sigpipe_ctx);
+    return CURLM_OK;
+  }
+
+  sigpipe_apply(data, sigpipe_ctx);
   do {
     /* A "stream" here is a logical stream if the protocol can handle that
        (HTTP/2), or the full connection for older protocols */
     bool stream_error = FALSE;
-    rc = CURLM_OK;
+    mresult = CURLM_OK;
 
     if(multi_ischanged(multi, TRUE)) {
-      DEBUGF(infof(data, "multi changed, check CONNECT_PEND queue"));
+      CURL_TRC_M(data, "multi changed, check CONNECT_PEND queue");
       process_pending_handles(multi); /* multiplexed */
     }
 
@@ -1920,679 +2772,74 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
         return CURLM_INTERNAL_ERROR;
     }
 
-    if(data->conn &&
-       (data->mstate >= MSTATE_CONNECT) &&
-       (data->mstate < MSTATE_COMPLETED)) {
-      /* Check for overall operation timeout here but defer handling the
-       * connection timeout to later, to allow for a connection to be set up
-       * in the window since we last checked timeout. This prevents us
-       * tearing down a completed connection in the case where we were slow
-       * to check the timeout (e.g. process descheduled during this loop).
-       * We set connect_timeout=FALSE to do this. */
-
-      /* we need to wait for the connect state as only then is the start time
-         stored, but we must not check already completed handles */
-      if(multi_handle_timeout(data, nowp, &stream_error, &result, FALSE)) {
-        /* Skip the statemachine and go directly to error handling section. */
-        goto statemachine_end;
-      }
-    }
+    /* Wait for the connect state as only then is the start time stored, but
+       we must not check already completed handles */
+    if((data->mstate >= MSTATE_CONNECT) && (data->mstate < MSTATE_COMPLETED) &&
+       multi_handle_timeout(data, &stream_error, &result))
+      /* Skip the statemachine and go directly to error handling section. */
+      goto statemachine_end;
 
     switch(data->mstate) {
     case MSTATE_INIT:
-      /* init this transfer. */
-      result = Curl_pretransfer(data);
+      /* Transitional state. init this transfer. A handle never comes back to
+         this state. */
+      mresult = multistate_init(data, &result);
+      break;
 
-      if(!result) {
-        /* after init, go CONNECT */
-        multistate(data, MSTATE_CONNECT);
-        *nowp = Curl_pgrsTime(data, TIMER_STARTOP);
-        rc = CURLM_CALL_MULTI_PERFORM;
-      }
+    case MSTATE_SETUP:
+      /* Transitional state. Setup things for a new transfer. The handle
+         can come back to this state on a redirect. */
+      mresult = multistate_setup(data);
       break;
 
     case MSTATE_CONNECT:
-      /* Connect. We want to get a connection identifier filled in. */
-      /* init this transfer. */
-      result = Curl_preconnect(data);
-      if(result)
-        break;
-
-      *nowp = Curl_pgrsTime(data, TIMER_STARTSINGLE);
-      if(data->set.timeout)
-        Curl_expire(data, data->set.timeout, EXPIRE_TIMEOUT);
-
-      if(data->set.connecttimeout)
-        Curl_expire(data, data->set.connecttimeout, EXPIRE_CONNECTTIMEOUT);
-
-      result = Curl_connect(data, &async, &connected);
-      if(CURLE_NO_CONNECTION_AVAILABLE == result) {
-        /* There was no connection available. We will go to the pending
-           state and wait for an available connection. */
-        multistate(data, MSTATE_PENDING);
-
-        /* add this handle to the list of connect-pending handles */
-        Curl_llist_insert_next(&multi->pending, multi->pending.tail, data,
-                               &data->connect_queue);
-        /* unlink from the main list */
-        unlink_easy(multi, data);
-        result = CURLE_OK;
-        break;
-      }
-      else if(data->state.previouslypending) {
-        /* this transfer comes from the pending queue so try move another */
-        infof(data, "Transfer was pending, now try another");
-        process_pending_handles(data->multi);
-      }
-
-      if(!result) {
-        if(async)
-          /* We're now waiting for an asynchronous name lookup */
-          multistate(data, MSTATE_RESOLVING);
-        else {
-          /* after the connect has been sent off, go WAITCONNECT unless the
-             protocol connect is already done and we can go directly to
-             WAITDO or DO! */
-          rc = CURLM_CALL_MULTI_PERFORM;
-
-          if(connected)
-            multistate(data, MSTATE_PROTOCONNECT);
-          else {
-            multistate(data, MSTATE_CONNECTING);
-          }
-        }
-      }
+      mresult = multistate_connect(multi, data, &result);
       break;
 
-    case MSTATE_RESOLVING:
-      /* awaiting an asynch name resolve to complete */
-    {
-      struct Curl_dns_entry *dns = NULL;
-      struct connectdata *conn = data->conn;
-      const char *hostname;
-
-      DEBUGASSERT(conn);
-#ifndef CURL_DISABLE_PROXY
-      if(conn->bits.httpproxy)
-        hostname = conn->http_proxy.host.name;
-      else
-#endif
-        if(conn->bits.conn_to_host)
-          hostname = conn->conn_to_host.name;
-      else
-        hostname = conn->host.name;
-
-      /* check if we have the name resolved by now */
-      dns = Curl_fetch_addr(data, hostname, (int)conn->port);
-
-      if(dns) {
-#ifdef CURLRES_ASYNCH
-        data->state.async.dns = dns;
-        data->state.async.done = TRUE;
-#endif
-        result = CURLE_OK;
-        infof(data, "Hostname '%s' was found in DNS cache", hostname);
-      }
-
-      if(!dns)
-        result = Curl_resolv_check(data, &dns);
-
-      /* Update sockets here, because the socket(s) may have been
-         closed and the application thus needs to be told, even if it
-         is likely that the same socket(s) will again be used further
-         down.  If the name has not yet been resolved, it is likely
-         that new sockets have been opened in an attempt to contact
-         another resolver. */
-      rc = singlesocket(multi, data);
-      if(rc)
-        return rc;
-
-      if(dns) {
-        /* Perform the next step in the connection phase, and then move on
-           to the WAITCONNECT state */
-        result = Curl_once_resolved(data, &connected);
-
-        if(result)
-          /* if Curl_once_resolved() returns failure, the connection struct
-             is already freed and gone */
-          data->conn = NULL; /* no more connection */
-        else {
-          /* call again please so that we get the next socket setup */
-          rc = CURLM_CALL_MULTI_PERFORM;
-          if(connected)
-            multistate(data, MSTATE_PROTOCONNECT);
-          else {
-            multistate(data, MSTATE_CONNECTING);
-          }
-        }
-      }
-
-      if(result) {
-        /* failure detected */
-        stream_error = TRUE;
-        break;
-      }
-    }
-    break;
-
-#ifndef CURL_DISABLE_HTTP
-    case MSTATE_TUNNELING:
-      /* this is HTTP-specific, but sending CONNECT to a proxy is HTTP... */
-      DEBUGASSERT(data->conn);
-      result = Curl_http_connect(data, &protocol_connected);
-#ifndef CURL_DISABLE_PROXY
-      if(data->conn->bits.proxy_connect_closed) {
-        rc = CURLM_CALL_MULTI_PERFORM;
-        /* connect back to proxy again */
-        result = CURLE_OK;
-        multi_done(data, CURLE_OK, FALSE);
-        multistate(data, MSTATE_CONNECT);
-      }
-      else
-#endif
-        if(!result) {
-          rc = CURLM_CALL_MULTI_PERFORM;
-          /* initiate protocol connect phase */
-          multistate(data, MSTATE_PROTOCONNECT);
-        }
-      else
-        stream_error = TRUE;
-      break;
-#endif
-
     case MSTATE_CONNECTING:
       /* awaiting a completion of an asynch TCP connect */
-      DEBUGASSERT(data->conn);
-      result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &connected);
-      if(connected && !result) {
-        rc = CURLM_CALL_MULTI_PERFORM;
-        multistate(data, MSTATE_PROTOCONNECT);
-      }
-      else if(result) {
-        /* failure detected */
-        Curl_posttransfer(data);
-        multi_done(data, result, TRUE);
-        stream_error = TRUE;
-        break;
-      }
+      mresult = multistate_connecting(data, &stream_error, &result);
       break;
 
     case MSTATE_PROTOCONNECT:
-      if(data->state.rewindbeforesend)
-        result = readrewind(data);
-
-      if(!result && data->conn->bits.reuse) {
-        /* ftp seems to hang when protoconnect on reused connection
-         * since we handle PROTOCONNECT in general inside the filers, it
-         * seems wrong to restart this on a reused connection. */
-        multistate(data, MSTATE_DO);
-        rc = CURLM_CALL_MULTI_PERFORM;
-        break;
-      }
-      if(!result)
-        result = protocol_connect(data, &protocol_connected);
-      if(!result && !protocol_connected)
-        /* switch to waiting state */
-        multistate(data, MSTATE_PROTOCONNECTING);
-      else if(!result) {
-        /* protocol connect has completed, go WAITDO or DO */
-        multistate(data, MSTATE_DO);
-        rc = CURLM_CALL_MULTI_PERFORM;
-      }
-      else {
-        /* failure detected */
-        Curl_posttransfer(data);
-        multi_done(data, result, TRUE);
-        stream_error = TRUE;
-      }
+      mresult = multistate_protoconnect(data, &stream_error, &result);
       break;
 
     case MSTATE_PROTOCONNECTING:
       /* protocol-specific connect phase */
-      result = protocol_connecting(data, &protocol_connected);
-      if(!result && protocol_connected) {
-        /* after the connect has completed, go WAITDO or DO */
-        multistate(data, MSTATE_DO);
-        rc = CURLM_CALL_MULTI_PERFORM;
-      }
-      else if(result) {
-        /* failure detected */
-        Curl_posttransfer(data);
-        multi_done(data, result, TRUE);
-        stream_error = TRUE;
-      }
+      mresult = multistate_protoconnecting(data, &stream_error, &result);
       break;
 
     case MSTATE_DO:
-      if(data->set.fprereq) {
-        int prereq_rc;
-
-        /* call the prerequest callback function */
-        Curl_set_in_callback(data, true);
-        prereq_rc = data->set.fprereq(data->set.prereq_userp,
-                                      data->info.conn_primary_ip,
-                                      data->info.conn_local_ip,
-                                      data->info.conn_primary_port,
-                                      data->info.conn_local_port);
-        Curl_set_in_callback(data, false);
-        if(prereq_rc != CURL_PREREQFUNC_OK) {
-          failf(data, "operation aborted by pre-request callback");
-          /* failure in pre-request callback - don't do any other processing */
-          result = CURLE_ABORTED_BY_CALLBACK;
-          Curl_posttransfer(data);
-          multi_done(data, result, FALSE);
-          stream_error = TRUE;
-          break;
-        }
-      }
-
-      if(data->set.connect_only == 1) {
-        /* keep connection open for application to use the socket */
-        connkeep(data->conn, "CONNECT_ONLY");
-        multistate(data, MSTATE_DONE);
-        result = CURLE_OK;
-        rc = CURLM_CALL_MULTI_PERFORM;
-      }
-      else {
-        /* Perform the protocol's DO action */
-        result = multi_do(data, &dophase_done);
-
-        /* When multi_do() returns failure, data->conn might be NULL! */
-
-        if(!result) {
-          if(!dophase_done) {
-#ifndef CURL_DISABLE_FTP
-            /* some steps needed for wildcard matching */
-            if(data->state.wildcardmatch) {
-              struct WildcardData *wc = data->wildcard;
-              if(wc->state == CURLWC_DONE || wc->state == CURLWC_SKIP) {
-                /* skip some states if it is important */
-                multi_done(data, CURLE_OK, FALSE);
-
-                /* if there's no connection left, skip the DONE state */
-                multistate(data, data->conn ?
-                           MSTATE_DONE : MSTATE_COMPLETED);
-                rc = CURLM_CALL_MULTI_PERFORM;
-                break;
-              }
-            }
-#endif
-            /* DO was not completed in one function call, we must continue
-               DOING... */
-            multistate(data, MSTATE_DOING);
-          }
-
-          /* after DO, go DO_DONE... or DO_MORE */
-          else if(data->conn->bits.do_more) {
-            /* we're supposed to do more, but we need to sit down, relax
-               and wait a little while first */
-            multistate(data, MSTATE_DOING_MORE);
-          }
-          else {
-            /* we're done with the DO, now DID */
-            multistate(data, MSTATE_DID);
-            rc = CURLM_CALL_MULTI_PERFORM;
-          }
-        }
-        else if((CURLE_SEND_ERROR == result) &&
-                data->conn->bits.reuse) {
-          /*
-           * In this situation, a connection that we were trying to use
-           * may have unexpectedly died.  If possible, send the connection
-           * back to the CONNECT phase so we can try again.
-           */
-          char *newurl = NULL;
-          followtype follow = FOLLOW_NONE;
-          CURLcode drc;
-
-          drc = Curl_retry_request(data, &newurl);
-          if(drc) {
-            /* a failure here pretty much implies an out of memory */
-            result = drc;
-            stream_error = TRUE;
-          }
-
-          Curl_posttransfer(data);
-          drc = multi_done(data, result, FALSE);
-
-          /* When set to retry the connection, we must go back to the CONNECT
-           * state */
-          if(newurl) {
-            if(!drc || (drc == CURLE_SEND_ERROR)) {
-              follow = FOLLOW_RETRY;
-              drc = Curl_follow(data, newurl, follow);
-              if(!drc) {
-                multistate(data, MSTATE_CONNECT);
-                rc = CURLM_CALL_MULTI_PERFORM;
-                result = CURLE_OK;
-              }
-              else {
-                /* Follow failed */
-                result = drc;
-              }
-            }
-            else {
-              /* done didn't return OK or SEND_ERROR */
-              result = drc;
-            }
-          }
-          else {
-            /* Have error handler disconnect conn if we can't retry */
-            stream_error = TRUE;
-          }
-          free(newurl);
-        }
-        else {
-          /* failure detected */
-          Curl_posttransfer(data);
-          if(data->conn)
-            multi_done(data, result, FALSE);
-          stream_error = TRUE;
-        }
-      }
+      mresult = multistate_do(data, &stream_error, &result);
       break;
 
     case MSTATE_DOING:
       /* we continue DOING until the DO phase is complete */
-      DEBUGASSERT(data->conn);
-      result = protocol_doing(data, &dophase_done);
-      if(!result) {
-        if(dophase_done) {
-          /* after DO, go DO_DONE or DO_MORE */
-          multistate(data, data->conn->bits.do_more?
-                     MSTATE_DOING_MORE : MSTATE_DID);
-          rc = CURLM_CALL_MULTI_PERFORM;
-        } /* dophase_done */
-      }
-      else {
-        /* failure detected */
-        Curl_posttransfer(data);
-        multi_done(data, result, FALSE);
-        stream_error = TRUE;
-      }
+      mresult = multistate_doing(data, &stream_error, &result);
       break;
 
     case MSTATE_DOING_MORE:
       /*
        * When we are connected, DOING MORE and then go DID
        */
-      DEBUGASSERT(data->conn);
-      result = multi_do_more(data, &control);
-
-      if(!result) {
-        if(control) {
-          /* if positive, advance to DO_DONE
-             if negative, go back to DOING */
-          multistate(data, control == 1?
-                     MSTATE_DID : MSTATE_DOING);
-          rc = CURLM_CALL_MULTI_PERFORM;
-        }
-        /* else
-           stay in DO_MORE */
-      }
-      else {
-        /* failure detected */
-        Curl_posttransfer(data);
-        multi_done(data, result, FALSE);
-        stream_error = TRUE;
-      }
+      mresult = multistate_doing_more(data, &stream_error, &result);
       break;
 
     case MSTATE_DID:
-      DEBUGASSERT(data->conn);
-      if(data->conn->bits.multiplex)
-        /* Check if we can move pending requests to send pipe */
-        process_pending_handles(multi); /*  multiplexed */
-
-      /* Only perform the transfer if there's a good socket to work with.
-         Having both BAD is a signal to skip immediately to DONE */
-      if((data->conn->sockfd != CURL_SOCKET_BAD) ||
-         (data->conn->writesockfd != CURL_SOCKET_BAD))
-        multistate(data, MSTATE_PERFORMING);
-      else {
-#ifndef CURL_DISABLE_FTP
-        if(data->state.wildcardmatch &&
-           ((data->conn->handler->flags & PROTOPT_WILDCARD) == 0)) {
-          data->wildcard->state = CURLWC_DONE;
-        }
-#endif
-        multistate(data, MSTATE_DONE);
-      }
-      rc = CURLM_CALL_MULTI_PERFORM;
+      mresult = multistate_did(multi, data);
       break;
 
     case MSTATE_RATELIMITING: /* limit-rate exceeded in either direction */
-      DEBUGASSERT(data->conn);
-      /* if both rates are within spec, resume transfer */
-      if(Curl_pgrsUpdate(data))
-        result = CURLE_ABORTED_BY_CALLBACK;
-      else
-        result = Curl_speedcheck(data, *nowp);
-
-      if(result) {
-        if(!(data->conn->handler->flags & PROTOPT_DUAL) &&
-           result != CURLE_HTTP2_STREAM)
-          streamclose(data->conn, "Transfer returned error");
-
-        Curl_posttransfer(data);
-        multi_done(data, result, TRUE);
-      }
-      else {
-        send_timeout_ms = 0;
-        if(data->set.max_send_speed)
-          send_timeout_ms =
-            Curl_pgrsLimitWaitTime(data->progress.uploaded,
-                                   data->progress.ul_limit_size,
-                                   data->set.max_send_speed,
-                                   data->progress.ul_limit_start,
-                                   *nowp);
-
-        recv_timeout_ms = 0;
-        if(data->set.max_recv_speed)
-          recv_timeout_ms =
-            Curl_pgrsLimitWaitTime(data->progress.downloaded,
-                                   data->progress.dl_limit_size,
-                                   data->set.max_recv_speed,
-                                   data->progress.dl_limit_start,
-                                   *nowp);
-
-        if(!send_timeout_ms && !recv_timeout_ms) {
-          multistate(data, MSTATE_PERFORMING);
-          Curl_ratelimit(data, *nowp);
-        }
-        else if(send_timeout_ms >= recv_timeout_ms)
-          Curl_expire(data, send_timeout_ms, EXPIRE_TOOFAST);
-        else
-          Curl_expire(data, recv_timeout_ms, EXPIRE_TOOFAST);
-      }
+      mresult = multistate_ratelimiting(data, &result);
       break;
 
     case MSTATE_PERFORMING:
-    {
-      char *newurl = NULL;
-      bool retry = FALSE;
-      bool comeback = FALSE;
-      DEBUGASSERT(data->state.buffer);
-      /* check if over send speed */
-      send_timeout_ms = 0;
-      if(data->set.max_send_speed)
-        send_timeout_ms = Curl_pgrsLimitWaitTime(data->progress.uploaded,
-                                                 data->progress.ul_limit_size,
-                                                 data->set.max_send_speed,
-                                                 data->progress.ul_limit_start,
-                                                 *nowp);
-
-      /* check if over recv speed */
-      recv_timeout_ms = 0;
-      if(data->set.max_recv_speed)
-        recv_timeout_ms = Curl_pgrsLimitWaitTime(data->progress.downloaded,
-                                                 data->progress.dl_limit_size,
-                                                 data->set.max_recv_speed,
-                                                 data->progress.dl_limit_start,
-                                                 *nowp);
-
-      if(send_timeout_ms || recv_timeout_ms) {
-        Curl_ratelimit(data, *nowp);
-        multistate(data, MSTATE_RATELIMITING);
-        if(send_timeout_ms >= recv_timeout_ms)
-          Curl_expire(data, send_timeout_ms, EXPIRE_TOOFAST);
-        else
-          Curl_expire(data, recv_timeout_ms, EXPIRE_TOOFAST);
-        break;
-      }
-
-      /* read/write data if it is ready to do so */
-      result = Curl_readwrite(data->conn, data, &done, &comeback);
-
-      if(done || (result == CURLE_RECV_ERROR)) {
-        /* If CURLE_RECV_ERROR happens early enough, we assume it was a race
-         * condition and the server closed the reused connection exactly when
-         * we wanted to use it, so figure out if that is indeed the case.
-         */
-        CURLcode ret = Curl_retry_request(data, &newurl);
-        if(!ret)
-          retry = (newurl)?TRUE:FALSE;
-        else if(!result)
-          result = ret;
-
-        if(retry) {
-          /* if we are to retry, set the result to OK and consider the
-             request as done */
-          result = CURLE_OK;
-          done = TRUE;
-        }
-      }
-      else if((CURLE_HTTP2_STREAM == result) &&
-              Curl_h2_http_1_1_error(data)) {
-        CURLcode ret = Curl_retry_request(data, &newurl);
-
-        if(!ret) {
-          infof(data, "Downgrades to HTTP/1.1");
-          streamclose(data->conn, "Disconnect HTTP/2 for HTTP/1");
-          data->state.httpwant = CURL_HTTP_VERSION_1_1;
-          /* clear the error message bit too as we ignore the one we got */
-          data->state.errorbuf = FALSE;
-          if(!newurl)
-            /* typically for HTTP_1_1_REQUIRED error on first flight */
-            newurl = strdup(data->state.url);
-          /* if we are to retry, set the result to OK and consider the request
-             as done */
-          retry = TRUE;
-          result = CURLE_OK;
-          done = TRUE;
-        }
-        else
-          result = ret;
-      }
-
-      if(result) {
-        /*
-         * The transfer phase returned error, we mark the connection to get
-         * closed to prevent being reused. This is because we can't possibly
-         * know if the connection is in a good shape or not now.  Unless it is
-         * a protocol which uses two "channels" like FTP, as then the error
-         * happened in the data connection.
-         */
-
-        if(!(data->conn->handler->flags & PROTOPT_DUAL) &&
-           result != CURLE_HTTP2_STREAM)
-          streamclose(data->conn, "Transfer returned error");
-
-        Curl_posttransfer(data);
-        multi_done(data, result, TRUE);
-      }
-      else if(done) {
-
-        /* call this even if the readwrite function returned error */
-        Curl_posttransfer(data);
-
-        /* When we follow redirects or is set to retry the connection, we must
-           to go back to the CONNECT state */
-        if(data->req.newurl || retry) {
-          followtype follow = FOLLOW_NONE;
-          if(!retry) {
-            /* if the URL is a follow-location and not just a retried request
-               then figure out the URL here */
-            free(newurl);
-            newurl = data->req.newurl;
-            data->req.newurl = NULL;
-            follow = FOLLOW_REDIR;
-          }
-          else
-            follow = FOLLOW_RETRY;
-          (void)multi_done(data, CURLE_OK, FALSE);
-          /* multi_done() might return CURLE_GOT_NOTHING */
-          result = Curl_follow(data, newurl, follow);
-          if(!result) {
-            multistate(data, MSTATE_CONNECT);
-            rc = CURLM_CALL_MULTI_PERFORM;
-          }
-          free(newurl);
-        }
-        else {
-          /* after the transfer is done, go DONE */
-
-          /* but first check to see if we got a location info even though we're
-             not following redirects */
-          if(data->req.location) {
-            free(newurl);
-            newurl = data->req.location;
-            data->req.location = NULL;
-            result = Curl_follow(data, newurl, FOLLOW_FAKE);
-            free(newurl);
-            if(result) {
-              stream_error = TRUE;
-              result = multi_done(data, result, TRUE);
-            }
-          }
-
-          if(!result) {
-            multistate(data, MSTATE_DONE);
-            rc = CURLM_CALL_MULTI_PERFORM;
-          }
-        }
-      }
-      else if(comeback) {
-        /* This avoids CURLM_CALL_MULTI_PERFORM so that a very fast transfer
-           won't get stuck on this transfer at the expense of other concurrent
-           transfers */
-        Curl_expire(data, 0, EXPIRE_RUN_NOW);
-      }
+      mresult = multistate_performing(data, &stream_error, &result);
       break;
-    }
 
     case MSTATE_DONE:
-      /* this state is highly transient, so run another loop after this */
-      rc = CURLM_CALL_MULTI_PERFORM;
-
-      if(data->conn) {
-        CURLcode res;
-
-        if(data->conn->bits.multiplex)
-          /* Check if we can move pending requests to connection */
-          process_pending_handles(multi); /* multiplexing */
-
-        /* post-transfer command */
-        res = multi_done(data, result, FALSE);
-
-        /* allow a previously set error code take precedence */
-        if(!result)
-          result = res;
-      }
-
-#ifndef CURL_DISABLE_FTP
-      if(data->state.wildcardmatch) {
-        if(data->wildcard->state != CURLWC_DONE) {
-          /* if a wildcard is set and we are not ending -> lets start again
-             with MSTATE_INIT */
-          multistate(data, MSTATE_INIT);
-          break;
-        }
-      }
-#endif
-      /* after we have DONE what we're supposed to do, go COMPLETED, and
-         it doesn't matter what the multi_done() returned! */
-      multistate(data, MSTATE_COMPLETED);
+      mresult = multistate_done(data, &result);
       break;
 
     case MSTATE_COMPLETED:
@@ -2601,154 +2848,85 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
     case MSTATE_PENDING:
     case MSTATE_MSGSENT:
       /* handles in these states should NOT be in this list */
-      DEBUGASSERT(0);
       break;
 
     default:
       return CURLM_INTERNAL_ERROR;
     }
 
-    if(data->conn &&
-       data->mstate >= MSTATE_CONNECT &&
+    if(data->mstate >= MSTATE_CONNECT &&
        data->mstate < MSTATE_DO &&
-       rc != CURLM_CALL_MULTI_PERFORM &&
-       !multi_ischanged(multi, false)) {
+       mresult != CURLM_CALL_MULTI_PERFORM &&
+       !multi_ischanged(multi, FALSE)) {
       /* We now handle stream timeouts if and only if this will be the last
        * loop iteration. We only check this on the last iteration to ensure
        * that if we know we have additional work to do immediately
        * (i.e. CURLM_CALL_MULTI_PERFORM == TRUE) then we should do that before
        * declaring the connection timed out as we may almost have a completed
        * connection. */
-      multi_handle_timeout(data, nowp, &stream_error, &result, TRUE);
+      multi_handle_timeout(data, &stream_error, &result);
     }
 
 statemachine_end:
 
-    if(data->mstate < MSTATE_COMPLETED) {
-      if(result) {
-        /*
-         * If an error was returned, and we aren't in completed state now,
-         * then we go to completed and consider this transfer aborted.
-         */
-
-        /* NOTE: no attempt to disconnect connections must be made
-           in the case blocks above - cleanup happens only here */
-
-        /* Check if we can move pending requests to send pipe */
-        process_pending_handles(multi); /* connection */
-
-        if(data->conn) {
-          if(stream_error) {
-            /* Don't attempt to send data over a connection that timed out */
-            bool dead_connection = result == CURLE_OPERATION_TIMEDOUT;
-            struct connectdata *conn = data->conn;
-
-            /* This is where we make sure that the conn pointer is reset.
-               We don't have to do this in every case block above where a
-               failure is detected */
-            Curl_detach_connection(data);
-
-            /* remove connection from cache */
-            Curl_conncache_remove_conn(data, conn, TRUE);
-
-            /* disconnect properly */
-            Curl_disconnect(data, conn, dead_connection);
-          }
-        }
-        else if(data->mstate == MSTATE_CONNECT) {
-          /* Curl_connect() failed */
-          (void)Curl_posttransfer(data);
-        }
-
-        multistate(data, MSTATE_COMPLETED);
-        rc = CURLM_CALL_MULTI_PERFORM;
-      }
-      /* if there's still a connection to use, call the progress function */
-      else if(data->conn && Curl_pgrsUpdate(data)) {
-        /* aborted due to progress callback return code must close the
-           connection */
-        result = CURLE_ABORTED_BY_CALLBACK;
-        streamclose(data->conn, "Aborted by callback");
-
-        /* if not yet in DONE state, go there, otherwise COMPLETED */
-        multistate(data, (data->mstate < MSTATE_DONE)?
-                   MSTATE_DONE: MSTATE_COMPLETED);
-        rc = CURLM_CALL_MULTI_PERFORM;
-      }
-    }
+    result = is_finished(multi, data, stream_error, result);
+    if(result)
+      mresult = CURLM_CALL_MULTI_PERFORM;
 
     if(MSTATE_COMPLETED == data->mstate) {
-      if(data->set.fmultidone) {
-        /* signal via callback instead */
-        data->set.fmultidone(data, result);
-      }
-      else {
-        /* now fill in the Curl_message with this info */
-        msg = &data->msg;
-
-        msg->extmsg.msg = CURLMSG_DONE;
-        msg->extmsg.easy_handle = data;
-        msg->extmsg.data.result = result;
-
-        multi_addmsg(multi, msg);
-        DEBUGASSERT(!data->conn);
-      }
-      multistate(data, MSTATE_MSGSENT);
-
-      /* add this handle to the list of msgsent handles */
-      Curl_llist_insert_next(&multi->msgsent, multi->msgsent.tail, data,
-                             &data->connect_queue);
-      /* unlink from the main list */
-      unlink_easy(multi, data);
+      handle_completed(multi, data, result);
       return CURLM_OK;
     }
-  } while((rc == CURLM_CALL_MULTI_PERFORM) || multi_ischanged(multi, FALSE));
+  } while((mresult == CURLM_CALL_MULTI_PERFORM) ||
+          multi_ischanged(multi, FALSE));
 
   data->result = result;
-  return rc;
+  return mresult;
 }
 
-
-CURLMcode curl_multi_perform(struct Curl_multi *multi, int *running_handles)
+static CURLMcode multi_perform(struct Curl_multi *multi,
+                               int *running_handles)
 {
-  struct Curl_easy *data;
   CURLMcode returncode = CURLM_OK;
-  struct Curl_tree *t;
-  struct curltime now = Curl_now();
-
-  if(!GOOD_MULTI_HANDLE(multi))
-    return CURLM_BAD_HANDLE;
+  struct curltime start = *multi_now(multi);
+  uint32_t mid;
+  struct Curl_sigpipe_ctx sigpipe_ctx;
 
   if(multi->in_callback)
     return CURLM_RECURSIVE_API_CALL;
 
-  data = multi->easyp;
-  if(data) {
-    CURLMcode result;
-    bool nosig = data->set.no_signal;
-    SIGPIPE_VARIABLE(pipe_st);
-    sigpipe_ignore(data, &pipe_st);
-    /* Do the loop and only alter the signal ignore state if the next handle
-       has a different NO_SIGNAL state than the previous */
+  if(multi->in_ntfy_callback)
+    return CURLM_RECURSIVE_API_CALL;
+
+  sigpipe_init(&sigpipe_ctx);
+
+  if(Curl_uint32_bset_first(&multi->process, &mid)) {
+    CURL_TRC_M(multi->admin, "multi_perform(running=%u)",
+               Curl_multi_xfers_running(multi));
     do {
-      /* the current node might be unlinked in multi_runsingle(), get the next
-         pointer now */
-      struct Curl_easy *datanext = data->next;
-      if(data->set.no_signal != nosig) {
-        sigpipe_restore(&pipe_st);
-        sigpipe_ignore(data, &pipe_st);
-        nosig = data->set.no_signal;
+      struct Curl_easy *data = Curl_multi_get_easy(multi, mid);
+      CURLMcode mresult;
+      if(!data) {
+        DEBUGASSERT(0);
+        Curl_uint32_bset_remove(&multi->process, mid);
+        Curl_uint32_bset_remove(&multi->dirty, mid);
+        continue;
       }
-      result = multi_runsingle(multi, &now, data);
-      if(result)
-        returncode = result;
-      data = datanext; /* operate on next handle */
-    } while(data);
-    sigpipe_restore(&pipe_st);
+      mresult = multi_runsingle(multi, data, &sigpipe_ctx);
+      if(mresult)
+        returncode = mresult;
+    } while(Curl_uint32_bset_next(&multi->process, mid, &mid));
   }
+  sigpipe_restore(&sigpipe_ctx);
+
+  if(multi_ischanged(multi, TRUE))
+    process_pending_handles(multi);
+
+  if(!returncode && CURL_MNTFY_HAS_ENTRIES(multi))
+    returncode = Curl_mntfy_dispatch_all(multi);
 
   /*
-   * Simply remove all expired timers from the splay since handles are dealt
+   * Remove all expired timers from the splay since handles are dealt
    * with unconditionally by this function and curl_multi_timeout() requires
    * that already passed/handled expire times are removed from the splay.
    *
@@ -2757,15 +2935,30 @@ CURLMcode curl_multi_perform(struct Curl_multi *multi, int *running_handles)
    * then and then we risk this loop to remove timers that actually have not
    * been handled!
    */
-  do {
-    multi->timetree = Curl_splaygetbest(now, multi->timetree, &t);
-    if(t)
-      /* the removed may have another timeout in queue */
-      (void)add_next_timeout(now, multi, t->payload);
+  if(multi->timetree) {
+    struct Curl_tree *t = NULL;
+    do {
+      multi->timetree = Curl_splaygetbest(&start, multi->timetree, &t);
+      if(t) {
+        /* the removed may have another timeout in queue */
+        struct Curl_easy *data = Curl_splayget(t);
+        (void)add_next_timeout(&start, multi, data);
+        if(data->mstate == MSTATE_PENDING) {
+          bool stream_unused;
+          CURLcode result_unused;
+          if(multi_handle_timeout(data, &stream_unused, &result_unused)) {
+            infof(data, "PENDING handle timeout");
+            move_pending_to_connect(multi, data);
+          }
+        }
+      }
+    } while(t);
+  }
 
-  } while(t);
-
-  *running_handles = multi->num_alive;
+  if(running_handles) {
+    unsigned int running = Curl_multi_xfers_running(multi);
+    *running_handles = (running < INT_MAX) ? (int)running : INT_MAX;
+  }
 
   if(CURLM_OK >= returncode)
     returncode = Curl_update_timer(multi);
@@ -2773,79 +2966,106 @@ CURLMcode curl_multi_perform(struct Curl_multi *multi, int *running_handles)
   return returncode;
 }
 
-/* unlink_all_msgsent_handles() detaches all those easy handles from this
-   multi handle */
-static void unlink_all_msgsent_handles(struct Curl_multi *multi)
+CURLMcode curl_multi_perform(CURLM *m, int *running_handles)
 {
-  struct Curl_llist_element *e = multi->msgsent.head;
-  if(e) {
-    struct Curl_easy *data = e->ptr;
-    DEBUGASSERT(data->mstate == MSTATE_MSGSENT);
-    data->multi = NULL;
-  }
+  struct Curl_multi *multi = m;
+
+  if(!GOOD_MULTI_HANDLE(multi))
+    return CURLM_BAD_HANDLE;
+
+  return multi_perform(multi, running_handles);
 }
 
-CURLMcode curl_multi_cleanup(struct Curl_multi *multi)
+CURLMcode curl_multi_cleanup(CURLM *m)
 {
-  struct Curl_easy *data;
-  struct Curl_easy *nextdata;
-
+  struct Curl_multi *multi = m;
   if(GOOD_MULTI_HANDLE(multi)) {
+    void *entry;
+    uint32_t mid;
     if(multi->in_callback)
       return CURLM_RECURSIVE_API_CALL;
+    if(multi->in_ntfy_callback)
+      return CURLM_RECURSIVE_API_CALL;
+
+    /* First remove all remaining easy handles,
+     * close internal ones. admin handle is special */
+    if(Curl_uint32_tbl_first(&multi->xfers, &mid, &entry)) {
+      do {
+        struct Curl_easy *data = entry;
+        if(!GOOD_EASY_HANDLE(data))
+          return CURLM_BAD_HANDLE;
+
+#ifdef DEBUGBUILD
+        if(mid != data->mid) {
+          CURL_TRC_M(data, "multi_cleanup: still present with mid=%u, "
+                     "but unexpected data->mid=%u\n", mid, data->mid);
+          DEBUGASSERT(0);
+        }
+#endif
+
+        if(data == multi->admin)
+          continue;
+
+        if(!data->state.done && data->conn)
+          /* if DONE was never called for this handle */
+          (void)multi_done(data, CURLE_OK, TRUE);
+
+        data->multi = NULL; /* clear the association */
+        Curl_uint32_tbl_remove(&multi->xfers, mid);
+        data->mid = UINT32_MAX;
+
+#ifdef USE_LIBPSL
+        if(data->psl == &multi->psl)
+          data->psl = NULL;
+#endif
+        if(data->state.internal)
+          Curl_close(&data);
+      } while(Curl_uint32_tbl_next(&multi->xfers, mid, &mid, &entry));
+    }
+
+#ifdef USE_RESOLV_THREADED
+    Curl_async_thrdd_multi_destroy(multi, !multi->quick_exit);
+#endif
+    Curl_cpool_destroy(&multi->cpool);
+    Curl_cshutdn_destroy(&multi->cshutdn, multi->admin);
+    if(multi->admin) {
+      CURL_TRC_M(multi->admin, "multi_cleanup, closing admin handle, done");
+      multi->admin->multi = NULL;
+      Curl_uint32_tbl_remove(&multi->xfers, multi->admin->mid);
+      Curl_close(&multi->admin);
+    }
 
     multi->magic = 0; /* not good anymore */
 
-    unlink_all_msgsent_handles(multi);
-    process_pending_handles(multi);
-    /* First remove all remaining easy handles */
-    data = multi->easyp;
-    while(data) {
-      nextdata = data->next;
-      if(!data->state.done && data->conn)
-        /* if DONE was never called for this handle */
-        (void)multi_done(data, CURLE_OK, TRUE);
-      if(data->dns.hostcachetype == HCACHE_MULTI) {
-        /* clear out the usage of the shared DNS cache */
-        Curl_hostcache_clean(data, data->dns.hostcache);
-        data->dns.hostcache = NULL;
-        data->dns.hostcachetype = HCACHE_NONE;
-      }
-
-      /* Clear the pointer to the connection cache */
-      data->state.conn_cache = NULL;
-      data->multi = NULL; /* clear the association */
-
-#ifdef USE_LIBPSL
-      if(data->psl == &multi->psl)
-        data->psl = NULL;
-#endif
-
-      data = nextdata;
-    }
-
-    /* Close all the connections in the connection cache */
-    Curl_conncache_close_all_connections(&multi->conn_cache);
-
-    sockhash_destroy(&multi->sockhash);
-    Curl_conncache_destroy(&multi->conn_cache);
-    Curl_hash_destroy(&multi->hostcache);
+    Curl_multi_ev_cleanup(multi);
+    Curl_hash_destroy(&multi->proto_hash);
+    Curl_dnscache_destroy(&multi->dnscache);
     Curl_psl_destroy(&multi->psl);
+#ifdef USE_SSL
+    Curl_ssl_scache_destroy(multi->ssl_scache);
+#endif
 
 #ifdef USE_WINSOCK
     WSACloseEvent(multi->wsa_event);
-#else
+#endif
 #ifdef ENABLE_WAKEUP
-    wakeup_close(multi->wakeup_pair[0]);
-    wakeup_close(multi->wakeup_pair[1]);
-#endif
+  Curl_wakeup_destroy(multi->wakeup_pair);
 #endif
 
-#ifdef USE_SSL
-    Curl_free_multi_ssl_backend_data(multi->ssl_backend_data);
+    multi_xfer_bufs_free(multi);
+    Curl_mntfy_cleanup(multi);
+#ifdef DEBUGBUILD
+    if(Curl_uint32_tbl_count(&multi->xfers)) {
+      multi_xfer_tbl_dump(multi);
+      DEBUGASSERT(0);
+    }
 #endif
-
-    free(multi);
+    Curl_uint32_bset_destroy(&multi->process);
+    Curl_uint32_bset_destroy(&multi->dirty);
+    Curl_uint32_bset_destroy(&multi->pending);
+    Curl_uint32_bset_destroy(&multi->msgsent);
+    Curl_uint32_tbl_destroy(&multi->xfers);
+    curlx_free(multi);
 
     return CURLM_OK;
   }
@@ -2862,9 +3082,10 @@ CURLMcode curl_multi_cleanup(struct Curl_multi *multi)
  * beyond. The current design is fully O(1).
  */
 
-CURLMsg *curl_multi_info_read(struct Curl_multi *multi, int *msgs_in_queue)
+CURLMsg *curl_multi_info_read(CURLM *m, int *msgs_in_queue)
 {
   struct Curl_message *msg;
+  struct Curl_multi *multi = m;
 
   *msgs_in_queue = 0; /* default to none */
 
@@ -2872,15 +3093,15 @@ CURLMsg *curl_multi_info_read(struct Curl_multi *multi, int *msgs_in_queue)
      !multi->in_callback &&
      Curl_llist_count(&multi->msglist)) {
     /* there is one or more messages in the list */
-    struct Curl_llist_element *e;
+    struct Curl_llist_node *e;
 
     /* extract the head of the list to return */
-    e = multi->msglist.head;
+    e = Curl_llist_head(&multi->msglist);
 
-    msg = e->ptr;
+    msg = Curl_node_elem(e);
 
     /* remove the extracted entry */
-    Curl_llist_remove(&multi->msglist, e, NULL);
+    Curl_node_remove(e);
 
     *msgs_in_queue = curlx_uztosi(Curl_llist_count(&multi->msglist));
 
@@ -2889,224 +3110,13 @@ CURLMsg *curl_multi_info_read(struct Curl_multi *multi, int *msgs_in_queue)
   return NULL;
 }
 
-/*
- * singlesocket() checks what sockets we deal with and their "action state"
- * and if we have a different state in any of those sockets from last time we
- * call the callback accordingly.
- */
-static CURLMcode singlesocket(struct Curl_multi *multi,
-                              struct Curl_easy *data)
-{
-  curl_socket_t socks[MAX_SOCKSPEREASYHANDLE];
-  int i;
-  struct Curl_sh_entry *entry;
-  curl_socket_t s;
-  int num;
-  unsigned int curraction;
-  unsigned char actions[MAX_SOCKSPEREASYHANDLE];
-  int rc;
-
-  for(i = 0; i< MAX_SOCKSPEREASYHANDLE; i++)
-    socks[i] = CURL_SOCKET_BAD;
-
-  /* Fill in the 'current' struct with the state as it is now: what sockets to
-     supervise and for what actions */
-  curraction = multi_getsock(data, socks);
-
-  /* We have 0 .. N sockets already and we get to know about the 0 .. M
-     sockets we should have from now on. Detect the differences, remove no
-     longer supervised ones and add new ones */
-
-  /* walk over the sockets we got right now */
-  for(i = 0; (i< MAX_SOCKSPEREASYHANDLE) &&
-      (curraction & GETSOCK_MASK_RW(i));
-      i++) {
-    unsigned char action = CURL_POLL_NONE;
-    unsigned char prevaction = 0;
-    int comboaction;
-    bool sincebefore = FALSE;
-
-    s = socks[i];
-
-    /* get it from the hash */
-    entry = sh_getentry(&multi->sockhash, s);
-
-    if(curraction & GETSOCK_READSOCK(i))
-      action |= CURL_POLL_IN;
-    if(curraction & GETSOCK_WRITESOCK(i))
-      action |= CURL_POLL_OUT;
-
-    actions[i] = action;
-    if(entry) {
-      /* check if new for this transfer */
-      int j;
-      for(j = 0; j< data->numsocks; j++) {
-        if(s == data->sockets[j]) {
-          prevaction = data->actions[j];
-          sincebefore = TRUE;
-          break;
-        }
-      }
-    }
-    else {
-      /* this is a socket we didn't have before, add it to the hash! */
-      entry = sh_addentry(&multi->sockhash, s);
-      if(!entry)
-        /* fatal */
-        return CURLM_OUT_OF_MEMORY;
-    }
-    if(sincebefore && (prevaction != action)) {
-      /* Socket was used already, but different action now */
-      if(prevaction & CURL_POLL_IN)
-        entry->readers--;
-      if(prevaction & CURL_POLL_OUT)
-        entry->writers--;
-      if(action & CURL_POLL_IN)
-        entry->readers++;
-      if(action & CURL_POLL_OUT)
-        entry->writers++;
-    }
-    else if(!sincebefore) {
-      /* a new user */
-      entry->users++;
-      if(action & CURL_POLL_IN)
-        entry->readers++;
-      if(action & CURL_POLL_OUT)
-        entry->writers++;
-
-      /* add 'data' to the transfer hash on this socket! */
-      if(!Curl_hash_add(&entry->transfers, (char *)&data, /* hash key */
-                        sizeof(struct Curl_easy *), data)) {
-        Curl_hash_destroy(&entry->transfers);
-        return CURLM_OUT_OF_MEMORY;
-      }
-    }
-
-    comboaction = (entry->writers? CURL_POLL_OUT : 0) |
-                   (entry->readers ? CURL_POLL_IN : 0);
-
-    /* socket existed before and has the same action set as before */
-    if(sincebefore && ((int)entry->action == comboaction))
-      /* same, continue */
-      continue;
-
-    if(multi->socket_cb) {
-      set_in_callback(multi, TRUE);
-      rc = multi->socket_cb(data, s, comboaction, multi->socket_userp,
-                            entry->socketp);
-      set_in_callback(multi, FALSE);
-      if(rc == -1) {
-        multi->dead = TRUE;
-        return CURLM_ABORTED_BY_CALLBACK;
-      }
-    }
-
-    entry->action = comboaction; /* store the current action state */
-  }
-
-  num = i; /* number of sockets */
-
-  /* when we've walked over all the sockets we should have right now, we must
-     make sure to detect sockets that are removed */
-  for(i = 0; i< data->numsocks; i++) {
-    int j;
-    bool stillused = FALSE;
-    s = data->sockets[i];
-    for(j = 0; j < num; j++) {
-      if(s == socks[j]) {
-        /* this is still supervised */
-        stillused = TRUE;
-        break;
-      }
-    }
-    if(stillused)
-      continue;
-
-    entry = sh_getentry(&multi->sockhash, s);
-    /* if this is NULL here, the socket has been closed and notified so
-       already by Curl_multi_closed() */
-    if(entry) {
-      unsigned char oldactions = data->actions[i];
-      /* this socket has been removed. Decrease user count */
-      entry->users--;
-      if(oldactions & CURL_POLL_OUT)
-        entry->writers--;
-      if(oldactions & CURL_POLL_IN)
-        entry->readers--;
-      if(!entry->users) {
-        if(multi->socket_cb) {
-          set_in_callback(multi, TRUE);
-          rc = multi->socket_cb(data, s, CURL_POLL_REMOVE,
-                                multi->socket_userp, entry->socketp);
-          set_in_callback(multi, FALSE);
-          if(rc == -1) {
-            multi->dead = TRUE;
-            return CURLM_ABORTED_BY_CALLBACK;
-          }
-        }
-        sh_delentry(entry, &multi->sockhash, s);
-      }
-      else {
-        /* still users, but remove this handle as a user of this socket */
-        if(Curl_hash_delete(&entry->transfers, (char *)&data,
-                            sizeof(struct Curl_easy *))) {
-          DEBUGASSERT(NULL);
-        }
-      }
-    }
-  } /* for loop over numsocks */
-
-  memcpy(data->sockets, socks, num*sizeof(curl_socket_t));
-  memcpy(data->actions, actions, num*sizeof(char));
-  data->numsocks = num;
-  return CURLM_OK;
-}
-
-CURLcode Curl_updatesocket(struct Curl_easy *data)
-{
-  if(singlesocket(data->multi, data))
-    return CURLE_ABORTED_BY_CALLBACK;
-  return CURLE_OK;
-}
-
-
-/*
- * Curl_multi_closed()
- *
- * Used by the connect code to tell the multi_socket code that one of the
- * sockets we were using is about to be closed.  This function will then
- * remove it from the sockethash for this handle to make the multi_socket API
- * behave properly, especially for the case when libcurl will create another
- * socket again and it gets the same file descriptor number.
- */
-
-void Curl_multi_closed(struct Curl_easy *data, curl_socket_t s)
+void Curl_multi_will_close(struct Curl_easy *data, curl_socket_t s)
 {
   if(data) {
-    /* if there's still an easy handle associated with this connection */
     struct Curl_multi *multi = data->multi;
     if(multi) {
-      /* this is set if this connection is part of a handle that is added to
-         a multi handle, and only then this is necessary */
-      struct Curl_sh_entry *entry = sh_getentry(&multi->sockhash, s);
-
-      if(entry) {
-        int rc = 0;
-        if(multi->socket_cb) {
-          set_in_callback(multi, TRUE);
-          rc = multi->socket_cb(data, s, CURL_POLL_REMOVE,
-                                multi->socket_userp, entry->socketp);
-          set_in_callback(multi, FALSE);
-        }
-
-        /* now remove it from the socket hash */
-        sh_delentry(entry, &multi->sockhash, s);
-        if(rc == -1)
-          /* This just marks the multi handle as "dead" without returning an
-             error code primarily because this function is used from many
-             places where propagating an error back is tricky. */
-          multi->dead = TRUE;
-      }
+      CURL_TRC_M(data, "Curl_multi_will_close fd=%" FMT_SOCKET_T, s);
+      Curl_multi_ev_socket_done(multi, data, s);
     }
   }
 }
@@ -3115,7 +3125,7 @@ void Curl_multi_closed(struct Curl_easy *data, curl_socket_t s)
  * add_next_timeout()
  *
  * Each Curl_easy has a list of timeouts. The add_next_timeout() is called
- * when it has just been removed from the splay tree because the timeout has
+ * when it has been removed from the splay tree because the timeout has
  * expired. This function is then to advance in the list to pick the next
  * timeout to use (skip the already expired ones) and add this node back to
  * the splay tree again.
@@ -3123,32 +3133,30 @@ void Curl_multi_closed(struct Curl_easy *data, curl_socket_t s)
  * The splay tree only has each sessionhandle as a single node and the nearest
  * timeout is used to sort it on.
  */
-static CURLMcode add_next_timeout(struct curltime now,
+static CURLMcode add_next_timeout(const struct curltime *pnow,
                                   struct Curl_multi *multi,
                                   struct Curl_easy *d)
 {
   struct curltime *tv = &d->state.expiretime;
   struct Curl_llist *list = &d->state.timeoutlist;
-  struct Curl_llist_element *e;
-  struct time_node *node = NULL;
+  struct Curl_llist_node *e;
 
   /* move over the timeout list for this specific handle and remove all
      timeouts that are now passed tense and store the next pending
      timeout in *tv */
-  for(e = list->head; e;) {
-    struct Curl_llist_element *n = e->next;
-    timediff_t diff;
-    node = (struct time_node *)e->ptr;
-    diff = Curl_timediff(node->time, now);
+  for(e = Curl_llist_head(list); e;) {
+    struct Curl_llist_node *n = Curl_node_next(e);
+    struct time_node *node = Curl_node_elem(e);
+    timediff_t diff = curlx_ptimediff_us(&node->time, pnow);
     if(diff <= 0)
       /* remove outdated entry */
-      Curl_llist_remove(list, e, NULL);
+      Curl_node_remove(e);
     else
       /* the list is sorted so get out on the first mismatch */
       break;
     e = n;
   }
-  e = list->head;
+  e = Curl_llist_head(list);
   if(!e) {
     /* clear the expire times within the handles that we remove from the
        splay tree */
@@ -3156,148 +3164,181 @@ static CURLMcode add_next_timeout(struct curltime now,
     tv->tv_usec = 0;
   }
   else {
+    struct time_node *node = Curl_node_elem(e);
     /* copy the first entry to 'tv' */
     memcpy(tv, &node->time, sizeof(*tv));
 
-    /* Insert this node again into the splay.  Keep the timer in the list in
+    /* Insert this node again into the splay. Keep the timer in the list in
        case we need to recompute future timers. */
-    multi->timetree = Curl_splayinsert(*tv, multi->timetree,
+    multi->timetree = Curl_splayinsert(tv, multi->timetree,
                                        &d->state.timenode);
   }
   return CURLM_OK;
 }
 
+static void multi_mark_expired_as_dirty(struct Curl_multi *multi,
+                                        const struct curltime *ts)
+{
+  struct Curl_easy *data = NULL;
+  struct Curl_tree *t = NULL;
+
+  /*
+   * The loop following here will go on as long as there are expire-times left
+   * to process (compared to `ts`) in the splay and 'data' will be
+   * re-assigned for every expired handle we deal with.
+   */
+  while(1) {
+    /* Check if there is one (more) expired timer to deal with! This function
+       extracts a matching node if there is one */
+    multi->timetree = Curl_splaygetbest(ts, multi->timetree, &t);
+    if(!t)
+      return;
+
+    data = Curl_splayget(t); /* assign this for next loop */
+    if(!data)
+      continue;
+#ifdef CURLVERBOSE
+    if(CURL_TRC_TIMER_is_verbose(data)) {
+      struct Curl_llist_node *e = Curl_llist_head(&data->state.timeoutlist);
+      if(e) {
+        struct time_node *n = Curl_node_elem(e);
+        CURL_TRC_TIMER(data, n->eid, "has expired");
+      }
+    }
+#endif
+    (void)add_next_timeout(ts, multi, data);
+    Curl_multi_mark_dirty(data);
+  }
+}
+
+static CURLMcode multi_run_dirty(struct Curl_multi *multi,
+                                 struct Curl_sigpipe_ctx *sigpipe_ctx,
+                                 uint32_t *pnum)
+{
+  CURLMcode mresult = CURLM_OK;
+  uint32_t mid;
+
+  *pnum = 0;
+  if(Curl_uint32_bset_first(&multi->dirty, &mid)) {
+    do {
+      struct Curl_easy *data = Curl_multi_get_easy(multi, mid);
+      if(data) {
+        CURL_TRC_M(data, "multi_run_dirty");
+
+        if(!Curl_uint32_bset_contains(&multi->process, mid)) {
+          /* We are no longer processing this transfer */
+          Curl_uint32_bset_remove(&multi->dirty, mid);
+          continue;
+        }
+
+        (*pnum)++;
+        /* runsingle() clears the dirty mid */
+        mresult = multi_runsingle(multi, data, sigpipe_ctx);
+
+        if(CURLM_OK >= mresult) {
+          /* reassess event handling of data */
+          mresult = Curl_multi_ev_assess_xfer(multi, data);
+          if(mresult)
+            goto out;
+        }
+      }
+      else {
+        CURL_TRC_M(multi->admin, "multi_run_dirty, %u no longer found", mid);
+        Curl_uint32_bset_remove(&multi->dirty, mid);
+      }
+    } while(Curl_uint32_bset_next(&multi->dirty, mid, &mid));
+  }
+
+out:
+  return mresult;
+}
+
 static CURLMcode multi_socket(struct Curl_multi *multi,
                               bool checkall,
                               curl_socket_t s,
                               int ev_bitmask,
                               int *running_handles)
 {
-  CURLMcode result = CURLM_OK;
-  struct Curl_easy *data = NULL;
-  struct Curl_tree *t;
-  struct curltime now = Curl_now();
-  bool first = FALSE;
-  bool nosig = FALSE;
-  SIGPIPE_VARIABLE(pipe_st);
+  CURLMcode mresult = CURLM_OK;
+  struct Curl_sigpipe_ctx pipe_ctx;
+  uint32_t run_xfers;
+
+  (void)ev_bitmask;
+  sigpipe_init(&pipe_ctx);
 
   if(checkall) {
     /* *perform() deals with running_handles on its own */
-    result = curl_multi_perform(multi, running_handles);
+    mresult = multi_perform(multi, running_handles);
 
-    /* walk through each easy handle and do the socket state change magic
-       and callbacks */
-    if(result != CURLM_BAD_HANDLE) {
-      data = multi->easyp;
-      while(data && !result) {
-        result = singlesocket(multi, data);
-        data = data->next;
-      }
+    if(mresult != CURLM_BAD_HANDLE) {
+      /* Reassess event status of all active transfers */
+      mresult = Curl_multi_ev_assess_xfer_bset(multi, &multi->process);
     }
-
-    /* or should we fall-through and do the timer-based stuff? */
-    return result;
+    goto out;
   }
+
   if(s != CURL_SOCKET_TIMEOUT) {
-    struct Curl_sh_entry *entry = sh_getentry(&multi->sockhash, s);
-
-    if(!entry)
-      /* Unmatched socket, we can't act on it but we ignore this fact.  In
-         real-world tests it has been proved that libevent can in fact give
-         the application actions even though the socket was just previously
-         asked to get removed, so thus we better survive stray socket actions
-         and just move on. */
-      ;
-    else {
-      struct Curl_hash_iterator iter;
-      struct Curl_hash_element *he;
-
-      /* the socket can be shared by many transfers, iterate */
-      Curl_hash_start_iterate(&entry->transfers, &iter);
-      for(he = Curl_hash_next_element(&iter); he;
-          he = Curl_hash_next_element(&iter)) {
-        data = (struct Curl_easy *)he->ptr;
-        DEBUGASSERT(data);
-        DEBUGASSERT(data->magic == CURLEASY_MAGIC_NUMBER);
-
-        if(data->conn && !(data->conn->handler->flags & PROTOPT_DIRLOCK))
-          /* set socket event bitmask if they're not locked */
-          data->conn->cselect_bits = (unsigned char)ev_bitmask;
-
-        Curl_expire(data, 0, EXPIRE_RUN_NOW);
-      }
-
-      /* Now we fall-through and do the timer-based stuff, since we don't want
-         to force the user to have to deal with timeouts as long as at least
-         one connection in fact has traffic. */
-
-      data = NULL; /* set data to NULL again to avoid calling
-                      multi_runsingle() in case there's no need to */
-      now = Curl_now(); /* get a newer time since the multi_runsingle() loop
-                           may have taken some time */
-    }
+    /* Mark all transfers of that socket as dirty */
+    Curl_multi_ev_dirty_xfers(multi, s);
   }
   else {
-    /* Asked to run due to time-out. Clear the 'lastcall' variable to force
-       Curl_update_timer() to trigger a callback to the app again even if the
-       same timeout is still the one to run after this call. That handles the
-       case when the application asks libcurl to run the timeout
+    /* Asked to run due to time-out. Clear the 'last_expire_ts' variable to
+       force Curl_update_timer() to trigger a callback to the app again even
+       if the same timeout is still the one to run after this call. That
+       handles the case when the application asks libcurl to run the timeout
        prematurely. */
-    memset(&multi->timer_lastcall, 0, sizeof(multi->timer_lastcall));
+    memset(&multi->last_expire_ts, 0, sizeof(multi->last_expire_ts));
+
+    /* Applications may set `socket_cb` *after* having added transfers
+     * first. *Then* kick off processing with a
+     * curl_multi_socket_action(TIMEOUT) afterwards. Make sure our
+     * admin handle registers its pollset with the callbacks present. */
+    mresult = multi_assess_wakeup(multi);
+    if(mresult)
+      goto out;
   }
 
-  /*
-   * The loop following here will go on as long as there are expire-times left
-   * to process in the splay and 'data' will be re-assigned for every expired
-   * handle we deal with.
-   */
-  do {
-    /* the first loop lap 'data' can be NULL */
-    if(data) {
-      if(!first) {
-        first = TRUE;
-        nosig = data->set.no_signal; /* initial state */
-        sigpipe_ignore(data, &pipe_st);
-      }
-      else if(data->set.no_signal != nosig) {
-        sigpipe_restore(&pipe_st);
-        sigpipe_ignore(data, &pipe_st);
-        nosig = data->set.no_signal; /* remember new state */
-      }
-      result = multi_runsingle(multi, &now, data);
+  multi_mark_expired_as_dirty(multi, multi_now(multi));
+  mresult = multi_run_dirty(multi, &pipe_ctx, &run_xfers);
+  if(mresult)
+    goto out;
 
-      if(CURLM_OK >= result) {
-        /* get the socket(s) and check if the state has been changed since
-           last */
-        result = singlesocket(multi, data);
-        if(result)
-          break;
-      }
-    }
+  if(run_xfers) {
+    /* Running transfers takes time. With a new timestamp, we might catch
+     * other expires which are due now. Instead of telling the application
+     * to set a 0 timeout and call us again, we run them here.
+     * Do that only once or it might be unfair to transfers on other
+     * sockets. */
+    multi_mark_expired_as_dirty(multi, &multi->now);
+    mresult = multi_run_dirty(multi, &pipe_ctx, &run_xfers);
+  }
 
-    /* Check if there's one (more) expired timer to deal with! This function
-       extracts a matching node if there is one */
+out:
+  sigpipe_restore(&pipe_ctx);
 
-    multi->timetree = Curl_splaygetbest(now, multi->timetree, &t);
-    if(t) {
-      data = t->payload; /* assign this for next loop */
-      (void)add_next_timeout(now, multi, t->payload);
-    }
+  if(multi_ischanged(multi, TRUE))
+    process_pending_handles(multi);
 
-  } while(t);
-  if(first)
-    sigpipe_restore(&pipe_st);
+  if(!mresult && CURL_MNTFY_HAS_ENTRIES(multi))
+    mresult = Curl_mntfy_dispatch_all(multi);
 
-  *running_handles = multi->num_alive;
-  return result;
+  if(running_handles) {
+    unsigned int running = Curl_multi_xfers_running(multi);
+    *running_handles = (running < INT_MAX) ? (int)running : INT_MAX;
+  }
+
+  if(CURLM_OK >= mresult)
+    mresult = Curl_update_timer(multi);
+  return mresult;
 }
 
 #undef curl_multi_setopt
-CURLMcode curl_multi_setopt(struct Curl_multi *multi,
-                            CURLMoption option, ...)
+CURLMcode curl_multi_setopt(CURLM *m, CURLMoption option, ...)
 {
-  CURLMcode res = CURLM_OK;
+  CURLMcode mresult = CURLM_OK;
   va_list param;
+  unsigned long uarg;
+  struct Curl_multi *multi = m;
 
   if(!GOOD_MULTI_HANDLE(multi))
     return CURLM_BAD_HANDLE;
@@ -3330,13 +3371,17 @@ CURLMcode curl_multi_setopt(struct Curl_multi *multi,
     multi->timer_userp = va_arg(param, void *);
     break;
   case CURLMOPT_MAXCONNECTS:
-    multi->maxconnects = va_arg(param, long);
+    uarg = va_arg(param, unsigned long);
+    if(uarg <= UINT_MAX)
+      multi->maxconnects = (unsigned int)uarg;
     break;
   case CURLMOPT_MAX_HOST_CONNECTIONS:
-    multi->max_host_connections = va_arg(param, long);
+    if(!curlx_sltouz(va_arg(param, long), &multi->max_host_connections))
+      mresult = CURLM_BAD_FUNCTION_ARGUMENT;
     break;
   case CURLMOPT_MAX_TOTAL_CONNECTIONS:
-    multi->max_total_connections = va_arg(param, long);
+    if(!curlx_sltouz(va_arg(param, long), &multi->max_total_connections))
+      mresult = CURLM_BAD_FUNCTION_ARGUMENT;
     break;
     /* options formerly used for pipelining */
   case CURLMOPT_MAX_PIPELINE_LENGTH:
@@ -3349,107 +3394,192 @@ CURLMcode curl_multi_setopt(struct Curl_multi *multi,
     break;
   case CURLMOPT_PIPELINING_SERVER_BL:
     break;
-  case CURLMOPT_MAX_CONCURRENT_STREAMS:
-    {
-      long streams = va_arg(param, long);
-      if(streams < 1)
-        streams = 100;
-      multi->max_concurrent_streams = curlx_sltoui(streams);
+  case CURLMOPT_MAX_CONCURRENT_STREAMS: {
+    long streams = va_arg(param, long);
+    if((streams < 1) || (streams > INT_MAX))
+      streams = 100;
+    multi->max_concurrent_streams = (unsigned int)streams;
+    break;
+  }
+  case CURLMOPT_NETWORK_CHANGED: {
+    long val = va_arg(param, long);
+    if(val & CURLMNWC_CLEAR_ALL)
+      /* In the beginning, all values available to set were 1 by mistake. We
+         converted this to mean "all", thus setting all the bits
+         automatically */
+      val = CURLMNWC_CLEAR_DNS | CURLMNWC_CLEAR_CONNS;
+    if(val & CURLMNWC_CLEAR_DNS) {
+      Curl_dnscache_clear(multi->admin);
+    }
+    if(val & CURLMNWC_CLEAR_CONNS) {
+      Curl_cpool_nw_changed(multi->admin);
     }
     break;
+  }
+  case CURLMOPT_NOTIFYFUNCTION:
+    multi->ntfy.ntfy_cb = va_arg(param, curl_notify_callback);
+    break;
+  case CURLMOPT_NOTIFYDATA:
+    multi->ntfy.ntfy_cb_data = va_arg(param, void *);
+    break;
+  case CURLMOPT_RESOLVE_THREADS_MAX:
+#ifdef USE_RESOLV_THREADED
+    uarg = va_arg(param, long);
+    if((uarg <= 0) || (uarg > UINT32_MAX))
+      mresult = CURLM_BAD_FUNCTION_ARGUMENT;
+    else {
+      CURLcode result = Curl_async_thrdd_multi_set_props(
+        multi, 0, (uint32_t)uarg, 2000);
+      switch(result) {
+      case CURLE_OK:
+        mresult = CURLM_OK;
+        break;
+      case CURLE_BAD_FUNCTION_ARGUMENT:
+        mresult = CURLM_BAD_FUNCTION_ARGUMENT;
+        break;
+      case CURLE_OUT_OF_MEMORY:
+        mresult = CURLM_OUT_OF_MEMORY;
+        break;
+      default:
+        mresult = CURLM_INTERNAL_ERROR;
+        break;
+      }
+    }
+#endif
+    break;
+  case CURLMOPT_QUICK_EXIT:
+    multi->quick_exit = va_arg(param, long) ? 1 : 0;
+    break;
   default:
-    res = CURLM_UNKNOWN_OPTION;
+    mresult = CURLM_UNKNOWN_OPTION;
     break;
   }
   va_end(param);
-  return res;
+  return mresult;
 }
 
 /* we define curl_multi_socket() in the public multi.h header */
 #undef curl_multi_socket
 
-CURLMcode curl_multi_socket(struct Curl_multi *multi, curl_socket_t s,
-                            int *running_handles)
+CURLMcode curl_multi_socket(CURLM *m, curl_socket_t s, int *running_handles)
 {
-  CURLMcode result;
+  struct Curl_multi *multi = m;
   if(multi->in_callback)
     return CURLM_RECURSIVE_API_CALL;
-  result = multi_socket(multi, FALSE, s, 0, running_handles);
-  if(CURLM_OK >= result)
-    result = Curl_update_timer(multi);
-  return result;
+  if(multi->in_ntfy_callback)
+    return CURLM_RECURSIVE_API_CALL;
+  return multi_socket(multi, FALSE, s, 0, running_handles);
 }
 
-CURLMcode curl_multi_socket_action(struct Curl_multi *multi, curl_socket_t s,
+CURLMcode curl_multi_socket_action(CURLM *m, curl_socket_t s,
                                    int ev_bitmask, int *running_handles)
 {
-  CURLMcode result;
+  struct Curl_multi *multi = m;
   if(multi->in_callback)
     return CURLM_RECURSIVE_API_CALL;
-  result = multi_socket(multi, FALSE, s, ev_bitmask, running_handles);
-  if(CURLM_OK >= result)
-    result = Curl_update_timer(multi);
-  return result;
+  if(multi->in_ntfy_callback)
+    return CURLM_RECURSIVE_API_CALL;
+  return multi_socket(multi, FALSE, s, ev_bitmask, running_handles);
 }
 
-CURLMcode curl_multi_socket_all(struct Curl_multi *multi, int *running_handles)
+CURLMcode curl_multi_socket_all(CURLM *m, int *running_handles)
 {
-  CURLMcode result;
+  struct Curl_multi *multi = m;
   if(multi->in_callback)
     return CURLM_RECURSIVE_API_CALL;
-  result = multi_socket(multi, TRUE, CURL_SOCKET_BAD, 0, running_handles);
-  if(CURLM_OK >= result)
-    result = Curl_update_timer(multi);
-  return result;
+  if(multi->in_ntfy_callback)
+    return CURLM_RECURSIVE_API_CALL;
+  return multi_socket(multi, TRUE, CURL_SOCKET_BAD, 0, running_handles);
 }
 
-static CURLMcode multi_timeout(struct Curl_multi *multi,
-                               long *timeout_ms)
+static bool multi_has_dirties(struct Curl_multi *multi)
 {
-  static const struct curltime tv_zero = {0, 0};
+  uint32_t mid;
+  if(Curl_uint32_bset_first(&multi->dirty, &mid)) {
+    do {
+      struct Curl_easy *data = Curl_multi_get_easy(multi, mid);
+      if(data) {
+        if(Curl_uint32_bset_contains(&multi->process, mid))
+          return TRUE;
+        /* We are no longer processing this transfer */
+        Curl_uint32_bset_remove(&multi->dirty, mid);
+      }
+      else {
+        CURL_TRC_M(multi->admin, "dirty transfer %u no longer found", mid);
+        Curl_uint32_bset_remove(&multi->dirty, mid);
+      }
+    } while(Curl_uint32_bset_next(&multi->dirty, mid, &mid));
+  }
+  return FALSE;
+}
+
+static void multi_timeout(struct Curl_multi *multi,
+                          struct curltime *expire_time,
+                          long *timeout_ms)
+{
+  static const struct curltime tv_zero = { 0, 0 };
+  VERBOSE(struct Curl_easy *data = NULL);
 
   if(multi->dead) {
     *timeout_ms = 0;
-    return CURLM_OK;
+    return;
   }
 
-  if(multi->timetree) {
-    /* we have a tree of expire times */
-    struct curltime now = Curl_now();
-
+  if(multi_has_dirties(multi)) {
+    *expire_time = *multi_now(multi);
+    *timeout_ms = 0;
+    return;
+  }
+  else if(multi->timetree) {
+    const struct curltime *pnow = multi_now(multi);
     /* splay the lowest to the bottom */
-    multi->timetree = Curl_splay(tv_zero, multi->timetree);
+    multi->timetree = Curl_splay(&tv_zero, multi->timetree);
+    /* this will not return NULL from a non-empty tree, but some compilers
+     * are not convinced of that. Analyzers are hard. */
+    *expire_time = multi->timetree ? multi->timetree->key : tv_zero;
 
-    if(Curl_splaycomparekeys(multi->timetree->key, now) > 0) {
+    /* 'multi->timetree' will be non-NULL here but the compilers sometimes
+       yell at us if we assume so */
+    if(multi->timetree &&
+       curlx_ptimediff_us(&multi->timetree->key, pnow) > 0) {
       /* some time left before expiration */
-      timediff_t diff = Curl_timediff(multi->timetree->key, now);
-      if(diff <= 0)
-        /*
-         * Since we only provide millisecond resolution on the returned value
-         * and the diff might be less than one millisecond here, we don't
-         * return zero as that may cause short bursts of busyloops on fast
-         * processors while the diff is still present but less than one
-         * millisecond! instead we return 1 until the time is ripe.
-         */
-        *timeout_ms = 1;
-      else
-        /* this should be safe even on 64 bit archs, as we don't use that
-           overly long timeouts */
-        *timeout_ms = (long)diff;
+      timediff_t diff_ms =
+        curlx_timediff_ceil_ms(multi->timetree->key, *pnow);
+      VERBOSE(data = Curl_splayget(multi->timetree));
+      /* this should be safe even on 32-bit archs, as we do not use that
+         overly long timeouts */
+      *timeout_ms = (long)diff_ms;
     }
-    else
+    else {
+      if(multi->timetree)
+        VERBOSE(data = Curl_splayget(multi->timetree));
       /* 0 means immediately */
       *timeout_ms = 0;
+    }
   }
-  else
+  else {
+    *expire_time = tv_zero;
     *timeout_ms = -1;
+  }
 
-  return CURLM_OK;
+#ifdef CURLVERBOSE
+  if(CURL_TRC_TIMER_is_verbose(data)) {
+    struct Curl_llist_node *e = Curl_llist_head(&data->state.timeoutlist);
+    if(e) {
+      struct time_node *n = Curl_node_elem(e);
+      CURL_TRC_TIMER(data, n->eid, "gives multi timeout in %ldms",
+                     *timeout_ms);
+    }
+  }
+#endif
 }
 
-CURLMcode curl_multi_timeout(struct Curl_multi *multi,
+CURLMcode curl_multi_timeout(CURLM *m,
                              long *timeout_ms)
 {
+  struct curltime expire_time;
+  struct Curl_multi *multi = m;
+
   /* First, make some basic checks that the CURLM handle is a good handle */
   if(!GOOD_MULTI_HANDLE(multi))
     return CURLM_BAD_HANDLE;
@@ -3457,7 +3587,8 @@ CURLMcode curl_multi_timeout(struct Curl_multi *multi,
   if(multi->in_callback)
     return CURLM_RECURSIVE_API_CALL;
 
-  return multi_timeout(multi, timeout_ms);
+  multi_timeout(multi, &expire_time, timeout_ms);
+  return CURLM_OK;
 }
 
 /*
@@ -3466,47 +3597,52 @@ CURLMcode curl_multi_timeout(struct Curl_multi *multi,
  */
 CURLMcode Curl_update_timer(struct Curl_multi *multi)
 {
+  struct curltime expire_ts;
   long timeout_ms;
   int rc;
+  bool set_value = FALSE;
 
   if(!multi->timer_cb || multi->dead)
     return CURLM_OK;
-  if(multi_timeout(multi, &timeout_ms)) {
-    return CURLM_OK;
+  multi_timeout(multi, &expire_ts, &timeout_ms);
+
+  if(timeout_ms < 0 && multi->last_timeout_ms < 0) {
+    /* nothing to do */
   }
-  if(timeout_ms < 0) {
-    static const struct curltime none = {0, 0};
-    if(Curl_splaycomparekeys(none, multi->timer_lastcall)) {
-      multi->timer_lastcall = none;
-      /* there's no timeout now but there was one previously, tell the app to
-         disable it */
-      set_in_callback(multi, TRUE);
-      rc = multi->timer_cb(multi, -1, multi->timer_userp);
-      set_in_callback(multi, FALSE);
-      if(rc == -1) {
-        multi->dead = TRUE;
-        return CURLM_ABORTED_BY_CALLBACK;
-      }
-      return CURLM_OK;
+  else if(timeout_ms < 0) {
+    /* there is no timeout now but there was one previously */
+    CURL_TRC_M(multi->admin, "[TIMER] clear");
+    timeout_ms = -1; /* normalize */
+    set_value = TRUE;
+  }
+  else if(multi->last_timeout_ms < 0) {
+    CURL_TRC_M(multi->admin, "[TIMER] set %ldms, none before", timeout_ms);
+    set_value = TRUE;
+  }
+  else if(curlx_ptimediff_us(&multi->last_expire_ts, &expire_ts)) {
+    /* We had a timeout before and have one now, the absolute timestamp
+     * differs. The relative timeout_ms may be the same, but the starting
+     * point differs. Let the application restart its timer. */
+    CURL_TRC_M(multi->admin, "[TIMER] set %ldms, replace previous",
+               timeout_ms);
+    set_value = TRUE;
+  }
+  else {
+    /* We have same expire time as previously. Our relative 'timeout_ms'
+     * may be different now, but the application has the timer running
+     * and we do not to tell it to start this again. */
+  }
+
+  if(set_value) {
+    multi->last_expire_ts = expire_ts;
+    multi->last_timeout_ms = timeout_ms;
+    set_in_callback(multi, TRUE);
+    rc = multi->timer_cb(multi, timeout_ms, multi->timer_userp);
+    set_in_callback(multi, FALSE);
+    if(rc == -1) {
+      multi->dead = TRUE;
+      return CURLM_ABORTED_BY_CALLBACK;
     }
-    return CURLM_OK;
-  }
-
-  /* When multi_timeout() is done, multi->timetree points to the node with the
-   * timeout we got the (relative) time-out time for. We can thus easily check
-   * if this is the same (fixed) time as we got in a previous call and then
-   * avoid calling the callback again. */
-  if(Curl_splaycomparekeys(multi->timetree->key, multi->timer_lastcall) == 0)
-    return CURLM_OK;
-
-  multi->timer_lastcall = multi->timetree->key;
-
-  set_in_callback(multi, TRUE);
-  rc = multi->timer_cb(multi, timeout_ms, multi->timer_userp);
-  set_in_callback(multi, FALSE);
-  if(rc == -1) {
-    multi->dead = TRUE;
-    return CURLM_ABORTED_BY_CALLBACK;
   }
   return CURLM_OK;
 }
@@ -3516,16 +3652,15 @@ CURLMcode Curl_update_timer(struct Curl_multi *multi)
  *
  * Remove a given timestamp from the list of timeouts.
  */
-static void
-multi_deltimeout(struct Curl_easy *data, expire_id eid)
+static void multi_deltimeout(struct Curl_easy *data, expire_id eid)
 {
-  struct Curl_llist_element *e;
+  struct Curl_llist_node *e;
   struct Curl_llist *timeoutlist = &data->state.timeoutlist;
   /* find and remove the specific node from the list */
-  for(e = timeoutlist->head; e; e = e->next) {
-    struct time_node *n = (struct time_node *)e->ptr;
+  for(e = Curl_llist_head(timeoutlist); e; e = Curl_node_next(e)) {
+    struct time_node *n = Curl_node_elem(e);
     if(n->eid == eid) {
-      Curl_llist_remove(timeoutlist, e, NULL);
+      Curl_node_remove(e);
       return;
     }
   }
@@ -3538,14 +3673,13 @@ multi_deltimeout(struct Curl_easy *data, expire_id eid)
  * of list is always the timeout nearest in time.
  *
  */
-static CURLMcode
-multi_addtimeout(struct Curl_easy *data,
-                 struct curltime *stamp,
-                 expire_id eid)
+static CURLMcode multi_addtimeout(struct Curl_easy *data,
+                                  struct curltime *stamp,
+                                  expire_id eid)
 {
-  struct Curl_llist_element *e;
+  struct Curl_llist_node *e;
   struct time_node *node;
-  struct Curl_llist_element *prev = NULL;
+  struct Curl_llist_node *prev = NULL;
   size_t n;
   struct Curl_llist *timeoutlist = &data->state.timeoutlist;
 
@@ -3558,22 +3692,82 @@ multi_addtimeout(struct Curl_easy *data,
   n = Curl_llist_count(timeoutlist);
   if(n) {
     /* find the correct spot in the list */
-    for(e = timeoutlist->head; e; e = e->next) {
-      struct time_node *check = (struct time_node *)e->ptr;
-      timediff_t diff = Curl_timediff(check->time, node->time);
+    for(e = Curl_llist_head(timeoutlist); e; e = Curl_node_next(e)) {
+      struct time_node *check = Curl_node_elem(e);
+      timediff_t diff = curlx_ptimediff_ms(&check->time, &node->time);
       if(diff > 0)
         break;
       prev = e;
     }
-
   }
   /* else
      this is the first timeout on the list */
 
   Curl_llist_insert_next(timeoutlist, prev, node, &node->list);
+  CURL_TRC_TIMER(data, eid, "set for %" FMT_TIMEDIFF_T "ns",
+                 curlx_ptimediff_us(&node->time, Curl_pgrs_now(data)));
   return CURLM_OK;
 }
 
+void Curl_expire_ex(struct Curl_easy *data,
+                    timediff_t milli, expire_id id)
+{
+  struct Curl_multi *multi = data->multi;
+  struct curltime *curr_expire = &data->state.expiretime;
+  struct curltime set;
+
+  /* this is only interesting while there is still an associated multi struct
+     remaining! */
+  if(!multi)
+    return;
+
+  DEBUGASSERT(id < EXPIRE_LAST);
+
+  set = *Curl_pgrs_now(data);
+  set.tv_sec += (time_t)(milli / 1000); /* may be a 64 to 32-bit conversion */
+  set.tv_usec += (int)(milli % 1000) * 1000;
+
+  if(set.tv_usec >= 1000000) {
+    set.tv_sec++;
+    set.tv_usec -= 1000000;
+  }
+
+  /* Remove any timer with the same id */
+  multi_deltimeout(data, id);
+
+  /* Add it to the timer list. It must stay in the list until it has expired
+     in case we need to recompute the minimum timer later. */
+  multi_addtimeout(data, &set, id);
+
+  if(curr_expire->tv_sec || curr_expire->tv_usec) {
+    /* This means that the struct is added as a node in the splay tree.
+       Compare if the new time is earlier, and only remove-old/add-new if it
+       is. */
+    timediff_t diff = curlx_ptimediff_ms(&set, curr_expire);
+    int rc;
+
+    if(diff > 0) {
+      /* The current splay tree entry is sooner than this new expiry time.
+         We do not need to update our splay tree entry. */
+      return;
+    }
+
+    /* Since this is an updated time, we must remove the previous entry from
+       the splay tree first and then re-add the new value */
+    rc = Curl_splayremove(multi->timetree, &data->state.timenode,
+                          &multi->timetree);
+    if(rc)
+      infof(data, "Internal error removing splay node = %d", rc);
+  }
+
+  /* Indicate that we are in the splay tree and insert the new timer expiry
+     value since it is our local minimum. */
+  *curr_expire = set;
+  Curl_splayset(&data->state.timenode, data);
+  multi->timetree = Curl_splayinsert(curr_expire, multi->timetree,
+                                     &data->state.timenode);
+}
+
 /*
  * Curl_expire()
  *
@@ -3587,60 +3781,7 @@ multi_addtimeout(struct Curl_easy *data,
  */
 void Curl_expire(struct Curl_easy *data, timediff_t milli, expire_id id)
 {
-  struct Curl_multi *multi = data->multi;
-  struct curltime *nowp = &data->state.expiretime;
-  struct curltime set;
-
-  /* this is only interesting while there is still an associated multi struct
-     remaining! */
-  if(!multi)
-    return;
-
-  DEBUGASSERT(id < EXPIRE_LAST);
-
-  set = Curl_now();
-  set.tv_sec += (time_t)(milli/1000); /* might be a 64 to 32 bit conversion */
-  set.tv_usec += (unsigned int)(milli%1000)*1000;
-
-  if(set.tv_usec >= 1000000) {
-    set.tv_sec++;
-    set.tv_usec -= 1000000;
-  }
-
-  /* Remove any timer with the same id just in case. */
-  multi_deltimeout(data, id);
-
-  /* Add it to the timer list.  It must stay in the list until it has expired
-     in case we need to recompute the minimum timer later. */
-  multi_addtimeout(data, &set, id);
-
-  if(nowp->tv_sec || nowp->tv_usec) {
-    /* This means that the struct is added as a node in the splay tree.
-       Compare if the new time is earlier, and only remove-old/add-new if it
-       is. */
-    timediff_t diff = Curl_timediff(set, *nowp);
-    int rc;
-
-    if(diff > 0) {
-      /* The current splay tree entry is sooner than this new expiry time.
-         We don't need to update our splay tree entry. */
-      return;
-    }
-
-    /* Since this is an updated time, we must remove the previous entry from
-       the splay tree first and then re-add the new value */
-    rc = Curl_splayremove(multi->timetree, &data->state.timenode,
-                          &multi->timetree);
-    if(rc)
-      infof(data, "Internal error removing splay node = %d", rc);
-  }
-
-  /* Indicate that we are in the splay tree and insert the new timer expiry
-     value since it is our local minimum. */
-  *nowp = set;
-  data->state.timenode.payload = data;
-  multi->timetree = Curl_splayinsert(*nowp, multi->timetree,
-                                     &data->state.timenode);
+  Curl_expire_ex(data, milli, id);
 }
 
 /*
@@ -3653,6 +3794,7 @@ void Curl_expire_done(struct Curl_easy *data, expire_id id)
 {
   /* remove the timer, if there */
   multi_deltimeout(data, id);
+  CURL_TRC_TIMER(data, id, "cleared");
 }
 
 /*
@@ -3681,143 +3823,420 @@ void Curl_expire_clear(struct Curl_easy *data)
     if(rc)
       infof(data, "Internal error clearing splay node = %d", rc);
 
-    /* flush the timeout list too */
-    while(list->size > 0) {
-      Curl_llist_remove(list, list->tail, NULL);
-    }
+    /* clear the timeout list too */
+    Curl_llist_destroy(list, NULL);
 
-#ifdef DEBUGBUILD
-    infof(data, "Expire cleared");
-#endif
+    if(data->id >= 0)
+      CURL_TRC_M(data, "[TIMEOUT] all cleared");
     nowp->tv_sec = 0;
     nowp->tv_usec = 0;
   }
 }
 
-
-
-
-CURLMcode curl_multi_assign(struct Curl_multi *multi, curl_socket_t s,
-                            void *hashp)
+CURLMcode curl_multi_assign(CURLM *m, curl_socket_t sockfd,
+                            void *sockp)
 {
-  struct Curl_sh_entry *there = NULL;
+  struct Curl_multi *multi = m;
+  if(!GOOD_MULTI_HANDLE(multi))
+    return CURLM_BAD_HANDLE;
 
-  there = sh_getentry(&multi->sockhash, s);
-
-  if(!there)
-    return CURLM_BAD_SOCKET;
-
-  there->socketp = hashp;
-
-  return CURLM_OK;
+  return Curl_multi_ev_assign(multi, sockfd, sockp);
 }
 
-size_t Curl_multi_max_host_connections(struct Curl_multi *multi)
+static void move_pending_to_connect(struct Curl_multi *multi,
+                                    struct Curl_easy *data)
 {
-  return multi ? multi->max_host_connections : 0;
+  DEBUGASSERT(data->mstate == MSTATE_PENDING);
+
+  /* Remove this node from the pending set, add into process set */
+  Curl_uint32_bset_remove(&multi->pending, data->mid);
+  Curl_uint32_bset_add(&multi->process, data->mid);
+
+  multistate(data, MSTATE_CONNECT);
+  Curl_multi_mark_dirty(data); /* make it run */
 }
 
-size_t Curl_multi_max_total_connections(struct Curl_multi *multi)
-{
-  return multi ? multi->max_total_connections : 0;
-}
+/* process_pending_handles() moves a handle from PENDING back into the process
+   list and change state to CONNECT.
 
-/*
- * When information about a connection has appeared, call this!
- */
+   We do not move all transfers because that can be a significant amount.
+   Since this is tried every now and then doing too many too often becomes a
+   performance problem.
 
-void Curl_multiuse_state(struct Curl_easy *data,
-                         int bundlestate) /* use BUNDLE_* defines */
-{
-  struct connectdata *conn;
-  DEBUGASSERT(data);
-  DEBUGASSERT(data->multi);
-  conn = data->conn;
-  DEBUGASSERT(conn);
-  DEBUGASSERT(conn->bundle);
+   When there is a change for connection limits like max host connections etc,
+   this likely only allows one new transfer. When there is a pipewait change,
+   it can potentially allow hundreds of new transfers.
 
-  conn->bundle->multiuse = bundlestate;
-  process_pending_handles(data->multi);
-}
-
-/* process_pending_handles() moves all handles from PENDING
-   back into the main list and change state to CONNECT */
+   We could consider an improvement where we store the queue reason and allow
+   more pipewait rechecks than others.
+*/
 static void process_pending_handles(struct Curl_multi *multi)
 {
-  struct Curl_llist_element *e = multi->pending.head;
-  if(e) {
-    struct Curl_easy *data = e->ptr;
+  uint32_t mid = multi->last_pending_mid;
 
-    DEBUGASSERT(data->mstate == MSTATE_PENDING);
+  if(mid) {
+    while(Curl_uint32_bset_next(&multi->pending, mid, &mid)) {
+      struct Curl_easy *data = Curl_multi_get_easy(multi, mid);
+      if(data) {
+        move_pending_to_connect(multi, data);
+        multi->last_pending_mid = mid;
+        return;
+      }
+      /* transfer no longer known, should not happen */
+      Curl_uint32_bset_remove(&multi->pending, mid);
+      DEBUGASSERT(0);
+    }
+    /* found no pending transfers with `mid` larger than `last_pending_mid`.
+     * Start at the beginning of the pending set again. */
+    multi->last_pending_mid = 0;
+  }
 
-    /* put it back into the main list */
-    link_easy(multi, data);
-
-    multistate(data, MSTATE_CONNECT);
-
-    /* Remove this node from the list */
-    Curl_llist_remove(&multi->pending, e, NULL);
-
-    /* Make sure that the handle will be processed soonish. */
-    Curl_expire(data, 0, EXPIRE_RUN_NOW);
-
-    /* mark this as having been in the pending queue */
-    data->state.previouslypending = TRUE;
+  if(Curl_uint32_bset_first(&multi->pending, &mid)) {
+    do {
+      struct Curl_easy *data = Curl_multi_get_easy(multi, mid);
+      if(data) {
+        move_pending_to_connect(multi, data);
+        multi->last_pending_mid = mid;
+        return;
+      }
+      /* transfer no longer known, should not happen */
+      Curl_uint32_bset_remove(&multi->pending, mid);
+      DEBUGASSERT(0);
+    } while(Curl_uint32_bset_next(&multi->pending, mid, &mid));
   }
 }
 
 void Curl_set_in_callback(struct Curl_easy *data, bool value)
 {
-  /* might get called when there is no data pointer! */
-  if(data) {
-    if(data->multi_easy)
-      data->multi_easy->in_callback = value;
-    else if(data->multi)
-      data->multi->in_callback = value;
-  }
+  if(data && data->multi)
+    data->multi->in_callback = value;
 }
 
-bool Curl_is_in_callback(struct Curl_easy *easy)
+bool Curl_is_in_callback(struct Curl_easy *data)
 {
-  return ((easy->multi && easy->multi->in_callback) ||
-          (easy->multi_easy && easy->multi_easy->in_callback));
+  return data && data->multi && data->multi->in_callback;
 }
 
-#ifdef DEBUGBUILD
-void Curl_multi_dump(struct Curl_multi *multi)
-{
-  struct Curl_easy *data;
-  int i;
-  fprintf(stderr, "* Multi status: %d handles, %d alive\n",
-          multi->num_easy, multi->num_alive);
-  for(data = multi->easyp; data; data = data->next) {
-    if(data->mstate < MSTATE_COMPLETED) {
-      /* only display handles that are not completed */
-      fprintf(stderr, "handle %p, state %s, %d sockets\n",
-              (void *)data,
-              multi_statename[data->mstate], data->numsocks);
-      for(i = 0; i < data->numsocks; i++) {
-        curl_socket_t s = data->sockets[i];
-        struct Curl_sh_entry *entry = sh_getentry(&multi->sockhash, s);
-
-        fprintf(stderr, "%d ", (int)s);
-        if(!entry) {
-          fprintf(stderr, "INTERNAL CONFUSION\n");
-          continue;
-        }
-        fprintf(stderr, "[%s %s] ",
-                (entry->action&CURL_POLL_IN)?"RECVING":"",
-                (entry->action&CURL_POLL_OUT)?"SENDING":"");
-      }
-      if(data->numsocks)
-        fprintf(stderr, "\n");
-    }
-  }
-}
-#endif
-
 unsigned int Curl_multi_max_concurrent_streams(struct Curl_multi *multi)
 {
   DEBUGASSERT(multi);
   return multi->max_concurrent_streams;
 }
+
+CURL **curl_multi_get_handles(CURLM *m)
+{
+  struct Curl_multi *multi = m;
+  void *entry;
+  size_t count = Curl_uint32_tbl_count(&multi->xfers);
+  CURL **a = curlx_malloc(sizeof(struct Curl_easy *) * (count + 1));
+  if(a) {
+    unsigned int i = 0;
+    uint32_t mid;
+
+    if(Curl_uint32_tbl_first(&multi->xfers, &mid, &entry)) {
+      do {
+        struct Curl_easy *data = entry;
+        DEBUGASSERT(i < count);
+        if(!data->state.internal)
+          a[i++] = data;
+      } while(Curl_uint32_tbl_next(&multi->xfers, mid, &mid, &entry));
+    }
+    a[i] = NULL; /* last entry is a NULL */
+  }
+  return a;
+}
+
+CURLMcode curl_multi_get_offt(CURLM *m,
+                              CURLMinfo_offt info,
+                              curl_off_t *pvalue)
+{
+  struct Curl_multi *multi = m;
+  uint32_t n;
+
+  if(!GOOD_MULTI_HANDLE(multi))
+    return CURLM_BAD_HANDLE;
+  if(!pvalue)
+    return CURLM_BAD_FUNCTION_ARGUMENT;
+
+  switch(info) {
+  case CURLMINFO_XFERS_CURRENT:
+    n = Curl_uint32_tbl_count(&multi->xfers);
+    if(n && multi->admin)
+      --n;
+    *pvalue = (curl_off_t)n;
+    return CURLM_OK;
+  case CURLMINFO_XFERS_RUNNING:
+    n = Curl_uint32_bset_count(&multi->process);
+    if(n && Curl_uint32_bset_contains(&multi->process, multi->admin->mid))
+      --n;
+    *pvalue = (curl_off_t)n;
+    return CURLM_OK;
+  case CURLMINFO_XFERS_PENDING:
+    *pvalue = (curl_off_t)Curl_uint32_bset_count(&multi->pending);
+    return CURLM_OK;
+  case CURLMINFO_XFERS_DONE:
+    *pvalue = (curl_off_t)Curl_uint32_bset_count(&multi->msgsent);
+    return CURLM_OK;
+  case CURLMINFO_XFERS_ADDED:
+    *pvalue = multi->xfers_total_ever;
+    return CURLM_OK;
+  default:
+    *pvalue = -1;
+    return CURLM_UNKNOWN_OPTION;
+  }
+}
+
+CURLcode Curl_multi_xfer_buf_borrow(struct Curl_easy *data,
+                                    char **pbuf, size_t *pbuflen)
+{
+  DEBUGASSERT(data);
+  DEBUGASSERT(data->multi);
+  *pbuf = NULL;
+  *pbuflen = 0;
+  if(!data->multi) {
+    failf(data, "transfer has no multi handle");
+    return CURLE_FAILED_INIT;
+  }
+  if(!data->set.buffer_size) {
+    failf(data, "transfer buffer size is 0");
+    return CURLE_FAILED_INIT;
+  }
+  if(data->multi->xfer_buf_borrowed) {
+    failf(data, "attempt to borrow xfer_buf when already borrowed");
+    return CURLE_AGAIN;
+  }
+
+  if(data->multi->xfer_buf &&
+     data->set.buffer_size > data->multi->xfer_buf_len) {
+    /* not large enough, get a new one */
+    curlx_safefree(data->multi->xfer_buf);
+    data->multi->xfer_buf_len = 0;
+  }
+
+  if(!data->multi->xfer_buf) {
+    data->multi->xfer_buf = curlx_malloc(curlx_uitouz(data->set.buffer_size));
+    if(!data->multi->xfer_buf) {
+      failf(data, "could not allocate xfer_buf of %u bytes",
+            data->set.buffer_size);
+      return CURLE_OUT_OF_MEMORY;
+    }
+    data->multi->xfer_buf_len = data->set.buffer_size;
+  }
+
+  data->multi->xfer_buf_borrowed = TRUE;
+  *pbuf = data->multi->xfer_buf;
+  *pbuflen = data->multi->xfer_buf_len;
+  return CURLE_OK;
+}
+
+void Curl_multi_xfer_buf_release(struct Curl_easy *data, char *buf)
+{
+  (void)buf;
+  DEBUGASSERT(data);
+  DEBUGASSERT(data->multi);
+  DEBUGASSERT(!buf || data->multi->xfer_buf == buf);
+  data->multi->xfer_buf_borrowed = FALSE;
+}
+
+CURLcode Curl_multi_xfer_ulbuf_borrow(struct Curl_easy *data,
+                                      char **pbuf, size_t *pbuflen)
+{
+  DEBUGASSERT(data);
+  DEBUGASSERT(data->multi);
+  *pbuf = NULL;
+  *pbuflen = 0;
+  if(!data->multi) {
+    failf(data, "transfer has no multi handle");
+    return CURLE_FAILED_INIT;
+  }
+  if(!data->set.upload_buffer_size) {
+    failf(data, "transfer upload buffer size is 0");
+    return CURLE_FAILED_INIT;
+  }
+  if(data->multi->xfer_ulbuf_borrowed) {
+    failf(data, "attempt to borrow xfer_ulbuf when already borrowed");
+    return CURLE_AGAIN;
+  }
+
+  if(data->multi->xfer_ulbuf &&
+     data->set.upload_buffer_size > data->multi->xfer_ulbuf_len) {
+    /* not large enough, get a new one */
+    curlx_safefree(data->multi->xfer_ulbuf);
+    data->multi->xfer_ulbuf_len = 0;
+  }
+
+  if(!data->multi->xfer_ulbuf) {
+    data->multi->xfer_ulbuf =
+      curlx_malloc(curlx_uitouz(data->set.upload_buffer_size));
+    if(!data->multi->xfer_ulbuf) {
+      failf(data, "could not allocate xfer_ulbuf of %u bytes",
+            data->set.upload_buffer_size);
+      return CURLE_OUT_OF_MEMORY;
+    }
+    data->multi->xfer_ulbuf_len = data->set.upload_buffer_size;
+  }
+
+  data->multi->xfer_ulbuf_borrowed = TRUE;
+  *pbuf = data->multi->xfer_ulbuf;
+  *pbuflen = data->multi->xfer_ulbuf_len;
+  return CURLE_OK;
+}
+
+void Curl_multi_xfer_ulbuf_release(struct Curl_easy *data, char *buf)
+{
+  (void)buf;
+  DEBUGASSERT(data);
+  DEBUGASSERT(data->multi);
+  DEBUGASSERT(!buf || data->multi->xfer_ulbuf == buf);
+  data->multi->xfer_ulbuf_borrowed = FALSE;
+}
+
+CURLcode Curl_multi_xfer_sockbuf_borrow(struct Curl_easy *data,
+                                        size_t blen, char **pbuf)
+{
+  DEBUGASSERT(data);
+  *pbuf = NULL;
+  if(!data->multi) {
+    /* When a SHARE gets destroyed and has a connection pool, we get
+     * call with share->admin which does not have a multi handle. */
+    *pbuf = curlx_malloc(blen);
+    return *pbuf ? CURLE_OK : CURLE_OUT_OF_MEMORY;
+  }
+  if(data->multi->xfer_sockbuf_borrowed) {
+    failf(data, "attempt to borrow xfer_sockbuf when already borrowed");
+    return CURLE_AGAIN;
+  }
+
+  if(data->multi->xfer_sockbuf && blen > data->multi->xfer_sockbuf_len) {
+    /* not large enough, get a new one */
+    curlx_safefree(data->multi->xfer_sockbuf);
+    data->multi->xfer_sockbuf_len = 0;
+  }
+
+  if(!data->multi->xfer_sockbuf) {
+    data->multi->xfer_sockbuf = curlx_malloc(blen);
+    if(!data->multi->xfer_sockbuf) {
+      failf(data, "could not allocate xfer_sockbuf of %zu bytes", blen);
+      return CURLE_OUT_OF_MEMORY;
+    }
+    data->multi->xfer_sockbuf_len = blen;
+  }
+
+  data->multi->xfer_sockbuf_borrowed = TRUE;
+  *pbuf = data->multi->xfer_sockbuf;
+  return CURLE_OK;
+}
+
+void Curl_multi_xfer_sockbuf_release(struct Curl_easy *data, char *buf)
+{
+  DEBUGASSERT(data);
+  if(!data->multi) {
+    /* When a SHARE gets destroyed and has a connection pool, we get
+     * call with share->admin which does not have a multi handle. */
+    curlx_free(buf);
+  }
+  else {
+    DEBUGASSERT(!buf || data->multi->xfer_sockbuf == buf);
+    data->multi->xfer_sockbuf_borrowed = FALSE;
+  }
+}
+
+static void multi_xfer_bufs_free(struct Curl_multi *multi)
+{
+  DEBUGASSERT(multi);
+  curlx_safefree(multi->xfer_buf);
+  multi->xfer_buf_len = 0;
+  multi->xfer_buf_borrowed = FALSE;
+  curlx_safefree(multi->xfer_ulbuf);
+  multi->xfer_ulbuf_len = 0;
+  multi->xfer_ulbuf_borrowed = FALSE;
+  curlx_safefree(multi->xfer_sockbuf);
+  multi->xfer_sockbuf_len = 0;
+  multi->xfer_sockbuf_borrowed = FALSE;
+}
+
+struct Curl_easy *Curl_multi_get_easy(struct Curl_multi *multi,
+                                      uint32_t mid)
+{
+  struct Curl_easy *data = Curl_uint32_tbl_get(&multi->xfers, mid);
+  if(GOOD_EASY_HANDLE(data))
+    return data;
+  CURL_TRC_M(multi->admin, "invalid easy handle in xfer table for mid=%u",
+             mid);
+  Curl_uint32_tbl_remove(&multi->xfers, mid);
+  return NULL;
+}
+
+unsigned int Curl_multi_xfers_running(struct Curl_multi *multi)
+{
+  DEBUGASSERT(multi);
+  if(!multi)
+    return 0;
+  return multi->xfers_alive;
+}
+
+void Curl_multi_mark_dirty(struct Curl_easy *data)
+{
+  if(data->multi && data->mid != UINT32_MAX)
+    Curl_uint32_bset_add(&data->multi->dirty, data->mid);
+}
+
+void Curl_multi_clear_dirty(struct Curl_easy *data)
+{
+  if(data->multi && data->mid != UINT32_MAX)
+    Curl_uint32_bset_remove(&data->multi->dirty, data->mid);
+}
+
+CURLMcode curl_multi_notify_enable(CURLM *m, unsigned int notification)
+{
+  struct Curl_multi *multi = m;
+
+  if(!GOOD_MULTI_HANDLE(multi))
+    return CURLM_BAD_HANDLE;
+  return Curl_mntfy_enable(multi, notification);
+}
+
+CURLMcode curl_multi_notify_disable(CURLM *m, unsigned int notification)
+{
+  struct Curl_multi *multi = m;
+
+  if(!GOOD_MULTI_HANDLE(multi))
+    return CURLM_BAD_HANDLE;
+  return Curl_mntfy_disable(multi, notification);
+}
+
+#ifdef DEBUGBUILD
+static void multi_xfer_dump(struct Curl_multi *multi, uint32_t mid,
+                            void *entry)
+{
+  struct Curl_easy *data = entry;
+
+  (void)multi;
+  if(!data) {
+    curl_mfprintf(stderr, "mid=%u, entry=NULL, bug in xfer table?\n", mid);
+  }
+  else {
+    curl_mfprintf(stderr, "mid=%u, magic=%s, p=%p, id=%" FMT_OFF_T
+                  ", url=%s\n",
+                  mid,
+                  (data->magic == CURLEASY_MAGIC_NUMBER) ? "GOOD" : "BAD!",
+                  (void *)data, data->id, Curl_bufref_ptr(&data->state.url));
+  }
+}
+
+static void multi_xfer_tbl_dump(struct Curl_multi *multi)
+{
+  uint32_t mid;
+  void *entry;
+  curl_mfprintf(stderr, "=== multi xfer table (count=%u, capacity=%u\n",
+                Curl_uint32_tbl_count(&multi->xfers),
+                Curl_uint32_tbl_capacity(&multi->xfers));
+  if(Curl_uint32_tbl_first(&multi->xfers, &mid, &entry)) {
+    multi_xfer_dump(multi, mid, entry);
+    while(Curl_uint32_tbl_next(&multi->xfers, mid, &mid, &entry))
+      multi_xfer_dump(multi, mid, entry);
+  }
+  curl_mfprintf(stderr, "===\n");
+  fflush(stderr);
+}
+#endif /* DEBUGBUILD */
diff --git a/third-party/curl/lib/multi_ev.c b/third-party/curl/lib/multi_ev.c
new file mode 100644
index 0000000000..0da5b0e904
--- /dev/null
+++ b/third-party/curl/lib/multi_ev.c
@@ -0,0 +1,646 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "urldata.h"
+#include "url.h"
+#include "cfilters.h"
+#include "curl_trc.h"
+#include "multiif.h"
+#include "multi_ev.h"
+#include "select.h"
+#include "uint-bset.h"
+#include "uint-spbset.h"
+#include "multihandle.h"
+
+
+static void mev_in_callback(struct Curl_multi *multi, bool value)
+{
+  multi->in_callback = value;
+}
+
+#ifdef DEBUGBUILD
+#define SH_ENTRY_MAGIC 0x570091d
+#endif
+
+/* Information about a socket for which we inform the libcurl application
+ * what to supervise (CURL_POLL_IN/CURL_POLL_OUT/CURL_POLL_REMOVE)
+ */
+struct mev_sh_entry {
+  struct uint32_spbset xfers; /* bitset of transfers `mid`s on this socket */
+  struct connectdata *conn; /* connection using this socket or NULL */
+  void *user_data;      /* libcurl app data via curl_multi_assign() */
+  unsigned int action;  /* CURL_POLL_IN/CURL_POLL_OUT we last told the
+                         * libcurl application to watch out for */
+  unsigned int readers; /* this many transfers want to read */
+  unsigned int writers; /* this many transfers want to write */
+#ifdef DEBUGBUILD
+  unsigned int magic;
+#endif
+  BIT(announced);       /* this socket has been passed to the socket
+                           callback at least once */
+};
+
+static size_t mev_sh_entry_hash(void *key, size_t key_length, size_t slots_num)
+{
+  curl_socket_t fd = *((curl_socket_t *)key);
+  (void)key_length;
+  return (fd % (curl_socket_t)slots_num);
+}
+
+static size_t mev_sh_entry_compare(void *k1, size_t k1_len,
+                                   void *k2, size_t k2_len)
+{
+  (void)k1_len;
+  (void)k2_len;
+  return (*((curl_socket_t *)k1)) == (*((curl_socket_t *)k2));
+}
+
+/* sockhash entry destructor callback */
+static void mev_sh_entry_dtor(void *freethis)
+{
+  struct mev_sh_entry *entry = (struct mev_sh_entry *)freethis;
+  Curl_uint32_spbset_destroy(&entry->xfers);
+#ifdef DEBUGBUILD
+  entry->magic = 0;
+#endif
+  curlx_free(entry);
+}
+
+/* look up a given socket in the socket hash, skip invalid sockets */
+static struct mev_sh_entry *mev_sh_entry_get(struct Curl_hash *sh,
+                                             curl_socket_t s)
+{
+  if(s != CURL_SOCKET_BAD) {
+    /* only look for proper sockets */
+    return Curl_hash_pick(sh, (char *)&s, sizeof(curl_socket_t));
+  }
+  return NULL;
+}
+
+/* make sure this socket is present in the hash for this handle */
+static struct mev_sh_entry *mev_sh_entry_add(struct Curl_hash *sh,
+                                             curl_socket_t s)
+{
+  struct mev_sh_entry *there = mev_sh_entry_get(sh, s);
+  struct mev_sh_entry *check;
+
+  if(there) {
+    /* it is present, return fine */
+    return there;
+  }
+
+  /* not present, add it */
+  check = curlx_calloc(1, sizeof(struct mev_sh_entry));
+  if(!check)
+    return NULL; /* major failure */
+
+  Curl_uint32_spbset_init(&check->xfers);
+
+  /* make/add new hash entry */
+  if(!Curl_hash_add(sh, (char *)&s, sizeof(curl_socket_t), check)) {
+    mev_sh_entry_dtor(check);
+    return NULL; /* major failure */
+  }
+#ifdef DEBUGBUILD
+  check->magic = SH_ENTRY_MAGIC;
+#endif
+  return check; /* things are good in sockhash land */
+}
+
+/* delete the given socket entry from the hash */
+static void mev_sh_entry_kill(struct Curl_multi *multi, curl_socket_t s)
+{
+  Curl_hash_delete(&multi->ev.sh_entries, (char *)&s, sizeof(curl_socket_t));
+}
+
+static size_t mev_sh_entry_user_count(struct mev_sh_entry *e)
+{
+  return Curl_uint32_spbset_count(&e->xfers) + (e->conn ? 1 : 0);
+}
+
+static bool mev_sh_entry_xfer_known(struct mev_sh_entry *e,
+                                    struct Curl_easy *data)
+{
+  return Curl_uint32_spbset_contains(&e->xfers, data->mid);
+}
+
+static bool mev_sh_entry_conn_known(struct mev_sh_entry *e,
+                                    struct connectdata *conn)
+{
+  return (e->conn == conn);
+}
+
+static bool mev_sh_entry_xfer_add(struct mev_sh_entry *e,
+                                  struct Curl_easy *data)
+{
+   /* detect weird values */
+  DEBUGASSERT(mev_sh_entry_user_count(e) < 100000);
+  return Curl_uint32_spbset_add(&e->xfers, data->mid);
+}
+
+static bool mev_sh_entry_conn_add(struct mev_sh_entry *e,
+                                  struct connectdata *conn)
+{
+   /* detect weird values */
+  DEBUGASSERT(mev_sh_entry_user_count(e) < 100000);
+  DEBUGASSERT(!e->conn);
+  if(e->conn)
+    return FALSE;
+  e->conn = conn;
+  return TRUE;
+}
+
+static bool mev_sh_entry_xfer_remove(struct mev_sh_entry *e,
+                                     struct Curl_easy *data)
+{
+  bool present = Curl_uint32_spbset_contains(&e->xfers, data->mid);
+  if(present)
+    Curl_uint32_spbset_remove(&e->xfers, data->mid);
+  return present;
+}
+
+static bool mev_sh_entry_conn_remove(struct mev_sh_entry *e,
+                                     struct connectdata *conn)
+{
+  DEBUGASSERT(e->conn == conn);
+  if(e->conn == conn) {
+    e->conn = NULL;
+    return TRUE;
+  }
+  return FALSE;
+}
+
+/* Purge any information about socket `s`.
+ * Let the socket callback know as well when necessary */
+static CURLMcode mev_forget_socket(struct Curl_multi *multi,
+                                   struct Curl_easy *data,
+                                   curl_socket_t s,
+                                   const char *cause)
+{
+  struct mev_sh_entry *entry = mev_sh_entry_get(&multi->ev.sh_entries, s);
+  int rc = 0;
+
+  if(!entry) /* we never knew or already forgot about this socket */
+    return CURLM_OK;
+
+  /* We managed this socket before, tell the socket callback to forget it. */
+  if(entry->announced && multi->socket_cb) {
+    NOVERBOSE((void)cause);
+    CURL_TRC_M(data, "ev %s, call(fd=%" FMT_SOCKET_T ", ev=REMOVE)", cause, s);
+    mev_in_callback(multi, TRUE);
+    rc = multi->socket_cb(data, s, CURL_POLL_REMOVE,
+                          multi->socket_userp, entry->user_data);
+    mev_in_callback(multi, FALSE);
+    entry->announced = FALSE;
+  }
+
+  mev_sh_entry_kill(multi, s);
+  if(rc == -1) {
+    multi->dead = TRUE;
+    return CURLM_ABORTED_BY_CALLBACK;
+  }
+  return CURLM_OK;
+}
+
+static CURLMcode mev_sh_entry_update(struct Curl_multi *multi,
+                                     struct Curl_easy *data,
+                                     struct mev_sh_entry *entry,
+                                     curl_socket_t s,
+                                     unsigned char last_action,
+                                     unsigned char cur_action)
+{
+  int rc, comboaction;
+
+  /* we should only be called when the callback exists */
+  DEBUGASSERT(multi->socket_cb);
+  DEBUGASSERT(entry->magic == SH_ENTRY_MAGIC);
+  if(!multi->socket_cb)
+    return CURLM_OK;
+
+  /* Transfer `data` goes from `last_action` to `cur_action` on socket `s`
+   * with `multi->ev.sh_entries` entry `entry`. Update `entry` and trigger
+   * `multi->socket_cb` on change, if the callback is set. */
+  if(last_action == cur_action)  /* nothing from `data` changed */
+    return CURLM_OK;
+
+  if(last_action & CURL_POLL_IN) {
+    DEBUGASSERT(entry->readers);
+    if(!(cur_action & CURL_POLL_IN))
+      entry->readers--;
+  }
+  else if(cur_action & CURL_POLL_IN)
+    entry->readers++;
+
+  if(last_action & CURL_POLL_OUT) {
+    DEBUGASSERT(entry->writers);
+    if(!(cur_action & CURL_POLL_OUT))
+      entry->writers--;
+  }
+  else if(cur_action & CURL_POLL_OUT)
+    entry->writers++;
+
+  DEBUGASSERT(entry->readers <= mev_sh_entry_user_count(entry));
+  DEBUGASSERT(entry->writers <= mev_sh_entry_user_count(entry));
+  DEBUGASSERT(entry->writers + entry->readers);
+
+  CURL_TRC_M(data, "ev update fd=%" FMT_SOCKET_T ", action '%s%s' -> '%s%s'"
+             " (%u/%u r/w)", s,
+             (last_action & CURL_POLL_IN) ? "IN" : "",
+             (last_action & CURL_POLL_OUT) ? "OUT" : "",
+             (cur_action & CURL_POLL_IN) ? "IN" : "",
+             (cur_action & CURL_POLL_OUT) ? "OUT" : "",
+             entry->readers, entry->writers);
+
+  comboaction = (entry->writers ? CURL_POLL_OUT : 0) |
+                (entry->readers ? CURL_POLL_IN : 0);
+  if(((int)entry->action == comboaction)) /* nothing for socket changed */
+    return CURLM_OK;
+
+  CURL_TRC_M(data, "ev update call(fd=%" FMT_SOCKET_T ", ev=%s%s)",
+             s, (comboaction & CURL_POLL_IN) ? "IN" : "",
+             (comboaction & CURL_POLL_OUT) ? "OUT" : "");
+  mev_in_callback(multi, TRUE);
+  rc = multi->socket_cb(data, s, comboaction, multi->socket_userp,
+                        entry->user_data);
+  mev_in_callback(multi, FALSE);
+  if(rc == -1) {
+    multi->dead = TRUE;
+    return CURLM_ABORTED_BY_CALLBACK;
+  }
+  /* curl_easy_pause() is documented as callable from any callback; it
+   * re-enters mev_assess() which may free this 'entry'. Re-fetch. */
+  entry = mev_sh_entry_get(&multi->ev.sh_entries, s);
+  if(entry) {
+    DEBUGASSERT(entry->magic == SH_ENTRY_MAGIC);
+    entry->announced = TRUE;
+    entry->action = (unsigned int)comboaction;
+  }
+  return CURLM_OK;
+}
+
+static CURLMcode mev_pollset_diff(struct Curl_multi *multi,
+                                  struct Curl_easy *data,
+                                  struct connectdata *conn,
+                                  struct easy_pollset *ps,
+                                  struct easy_pollset *prev_ps)
+{
+  struct mev_sh_entry *entry;
+  curl_socket_t s;
+  unsigned int i, j;
+  CURLMcode mresult;
+
+  /* The transfer `data` reports in `ps` the sockets it is interested
+   * in and which combination of CURL_POLL_IN/CURL_POLL_OUT it wants
+   * to have monitored for events.
+   * There can be more than 1 transfer interested in the same socket
+   * and 1 transfer might be interested in more than 1 socket.
+   * `prev_ps` is the pollset copy from the previous call here. On
+   * the 1st call it will be empty.
+   */
+  DEBUGASSERT(ps);
+  DEBUGASSERT(prev_ps);
+
+  /* Handle changes to sockets the transfer is interested in. */
+  for(i = 0; i < ps->n; i++) {
+    unsigned char last_action;
+    bool first_time = FALSE; /* data/conn appears first time on socket */
+
+    s = ps->sockets[i];
+    /* Have we handled this socket before? */
+    entry = mev_sh_entry_get(&multi->ev.sh_entries, s);
+    if(!entry) {
+      /* new socket, add new entry */
+      first_time = TRUE;
+      entry = mev_sh_entry_add(&multi->ev.sh_entries, s);
+      if(!entry) /* fatal */
+        return CURLM_OUT_OF_MEMORY;
+      CURL_TRC_M(data, "ev new entry fd=%" FMT_SOCKET_T, s);
+    }
+    else if(conn) {
+      first_time = !mev_sh_entry_conn_known(entry, conn);
+    }
+    else {
+      first_time = !mev_sh_entry_xfer_known(entry, data);
+    }
+
+    /* What was the previous action the transfer had regarding this socket?
+     * If the transfer is new to the socket, disregard the information
+     * in `last_poll`, because the socket might have been destroyed and
+     * reopened. We would have cleared the sh_entry for that, but the socket
+     * might still be mentioned in the hashed pollsets. */
+    last_action = 0;
+    if(first_time) {
+      if(conn) {
+        if(!mev_sh_entry_conn_add(entry, conn))
+          return CURLM_OUT_OF_MEMORY;
+      }
+      else {
+        if(!mev_sh_entry_xfer_add(entry, data))
+          return CURLM_OUT_OF_MEMORY;
+      }
+      CURL_TRC_M(data, "ev entry fd=%" FMT_SOCKET_T ", added %s #%" FMT_OFF_T
+                 ", total=%u/%d (xfer/conn)", s,
+                 conn ? "connection" : "transfer",
+                 conn ? conn->connection_id : data->mid,
+                 Curl_uint32_spbset_count(&entry->xfers),
+                 entry->conn ? 1 : 0);
+    }
+    else {
+      for(j = 0; j < prev_ps->n; j++) {
+        if(s == prev_ps->sockets[j]) {
+          last_action = prev_ps->actions[j];
+          break;
+        }
+      }
+    }
+    /* track readers/writers changes and report to socket callback */
+    mresult = mev_sh_entry_update(multi, data, entry, s,
+                                  last_action, ps->actions[i]);
+    if(mresult)
+      return mresult;
+  }
+
+  /* Handle changes to sockets the transfer is NO LONGER interested in. */
+  for(i = 0; i < prev_ps->n; i++) {
+    bool stillused = FALSE;
+
+    s = prev_ps->sockets[i];
+    for(j = 0; j < ps->n; j++) {
+      if(s == ps->sockets[j]) {
+        /* socket is still supervised */
+        stillused = TRUE;
+        break;
+      }
+    }
+    if(stillused)
+      continue;
+
+    entry = mev_sh_entry_get(&multi->ev.sh_entries, s);
+    /* if entry does not exist, we were either never told about it or
+     * have already cleaned up this socket via Curl_multi_ev_socket_done().
+     * In other words: this is perfectly normal */
+    if(!entry)
+      continue;
+
+    if(conn && !mev_sh_entry_conn_remove(entry, conn)) {
+      /* `conn` says in `prev_ps` that it had been using a socket,
+       * but `conn` has not been registered for it.
+       * This should not happen if our book-keeping is correct? */
+      CURL_TRC_M(data, "ev entry fd=%" FMT_SOCKET_T ", conn lost "
+                 "interest but is not registered", s);
+      DEBUGASSERT(NULL);
+      continue;
+    }
+
+    if(!conn && !mev_sh_entry_xfer_remove(entry, data)) {
+      /* `data` says in `prev_ps` that it had been using a socket,
+       * but `data` has not been registered for it.
+       * This should not happen if our book-keeping is correct? */
+      CURL_TRC_M(data, "ev entry fd=%" FMT_SOCKET_T ", transfer lost "
+                 "interest but is not registered", s);
+      DEBUGASSERT(NULL);
+      continue;
+    }
+
+    if(mev_sh_entry_user_count(entry)) {
+      /* track readers/writers changes and report to socket callback */
+      mresult = mev_sh_entry_update(multi, data, entry, s,
+                                    prev_ps->actions[i], 0);
+      if(mresult)
+        return mresult;
+      CURL_TRC_M(data, "ev entry fd=%" FMT_SOCKET_T ", removed transfer, "
+                 "total=%u/%d (xfer/conn)", s,
+                 Curl_uint32_spbset_count(&entry->xfers),
+                 entry->conn ? 1 : 0);
+    }
+    else {
+      mresult = mev_forget_socket(multi, data, s, "last user gone");
+      if(mresult)
+        return mresult;
+    }
+  } /* for loop over num */
+
+  /* Remember for next time */
+  Curl_pollset_move(prev_ps, ps);
+  return CURLM_OK;
+}
+
+static void mev_pollset_dtor(void *key, size_t klen, void *entry)
+{
+  struct easy_pollset *ps = entry;
+  (void)key;
+  (void)klen;
+  if(ps) {
+    Curl_pollset_cleanup(ps);
+    curlx_free(ps);
+  }
+}
+
+static struct easy_pollset *mev_add_new_conn_pollset(struct connectdata *conn)
+{
+  struct easy_pollset *ps;
+
+  ps = Curl_pollset_create();
+  if(!ps)
+    return NULL;
+  if(Curl_conn_meta_set(conn, CURL_META_MEV_POLLSET, ps, mev_pollset_dtor))
+    return NULL;
+  return ps;
+}
+
+static struct easy_pollset *mev_add_new_xfer_pollset(struct Curl_easy *data)
+{
+  struct easy_pollset *ps;
+
+  ps = Curl_pollset_create();
+  if(!ps)
+    return NULL;
+  if(Curl_meta_set(data, CURL_META_MEV_POLLSET, ps, mev_pollset_dtor))
+    return NULL;
+  return ps;
+}
+
+static struct easy_pollset *mev_get_last_pollset(struct Curl_easy *data,
+                                                 struct connectdata *conn)
+{
+  if(data) {
+    if(conn)
+      return Curl_conn_meta_get(conn, CURL_META_MEV_POLLSET);
+    return Curl_meta_get(data, CURL_META_MEV_POLLSET);
+  }
+  return NULL;
+}
+
+static CURLMcode mev_assess(struct Curl_multi *multi,
+                            struct Curl_easy *data,
+                            struct connectdata *conn)
+{
+  struct easy_pollset ps, *last_ps;
+  CURLMcode mresult = CURLM_OK;
+
+  if(!multi || !multi->socket_cb)
+    return CURLM_OK;
+
+  Curl_pollset_init(&ps);
+  if(conn) {
+    CURLcode result = Curl_conn_adjust_pollset(data, conn, &ps);
+    if(result) {
+      mresult = (result == CURLE_OUT_OF_MEMORY) ?
+        CURLM_OUT_OF_MEMORY : CURLM_INTERNAL_ERROR;
+      goto out;
+    }
+  }
+  else
+    Curl_multi_pollset(data, &ps);
+  last_ps = mev_get_last_pollset(data, conn);
+
+  if(!last_ps && ps.n) {
+    if(conn)
+      last_ps = mev_add_new_conn_pollset(conn);
+    else
+      last_ps = mev_add_new_xfer_pollset(data);
+    if(!last_ps) {
+      mresult = CURLM_OUT_OF_MEMORY;
+      goto out;
+    }
+  }
+
+  if(last_ps)
+    mresult = mev_pollset_diff(multi, data, conn, &ps, last_ps);
+  else
+    DEBUGASSERT(!ps.n);
+out:
+  Curl_pollset_cleanup(&ps);
+  return mresult;
+}
+
+CURLMcode Curl_multi_ev_assess_xfer(struct Curl_multi *multi,
+                                    struct Curl_easy *data)
+{
+  return mev_assess(multi, data, NULL);
+}
+
+CURLMcode Curl_multi_ev_assess_conn(struct Curl_multi *multi,
+                                    struct Curl_easy *data,
+                                    struct connectdata *conn)
+{
+  return mev_assess(multi, data, conn);
+}
+
+CURLMcode Curl_multi_ev_assess_xfer_bset(struct Curl_multi *multi,
+                                         struct uint32_bset *set)
+{
+  uint32_t mid;
+  CURLMcode mresult = CURLM_OK;
+
+  if(multi && multi->socket_cb && Curl_uint32_bset_first(set, &mid)) {
+    do {
+      struct Curl_easy *data = Curl_multi_get_easy(multi, mid);
+      if(data) {
+        mresult = Curl_multi_ev_assess_xfer(multi, data);
+      }
+    } while(!mresult && Curl_uint32_bset_next(set, mid, &mid));
+  }
+  return mresult;
+}
+
+CURLMcode Curl_multi_ev_assign(struct Curl_multi *multi,
+                               curl_socket_t s,
+                               void *user_data)
+{
+  struct mev_sh_entry *e = mev_sh_entry_get(&multi->ev.sh_entries, s);
+  if(!e)
+    return CURLM_BAD_SOCKET;
+  e->user_data = user_data;
+  return CURLM_OK;
+}
+
+void Curl_multi_ev_dirty_xfers(struct Curl_multi *multi,
+                               curl_socket_t s)
+{
+  struct mev_sh_entry *entry;
+
+  DEBUGASSERT(s != CURL_SOCKET_TIMEOUT);
+  entry = mev_sh_entry_get(&multi->ev.sh_entries, s);
+
+  /* Unmatched socket, we cannot act on it but we ignore this fact. In
+     real-world tests it has been proved that libevent can in fact give
+     the application actions even though the socket was previously
+     asked to get removed, so thus we better survive stray socket actions
+     and move on. */
+  if(entry) {
+    struct Curl_easy *data;
+    uint32_t mid;
+
+    if(Curl_uint32_spbset_first(&entry->xfers, &mid)) {
+      do {
+        data = Curl_multi_get_easy(multi, mid);
+        if(data) {
+          Curl_multi_mark_dirty(data);
+        }
+        else {
+          CURL_TRC_M(multi->admin, "socket transfer %u no longer found", mid);
+          Curl_uint32_spbset_remove(&entry->xfers, mid);
+        }
+      } while(Curl_uint32_spbset_next(&entry->xfers, mid, &mid));
+    }
+
+    if(entry->conn)
+      Curl_multi_mark_dirty(multi->admin);
+  }
+}
+
+void Curl_multi_ev_socket_done(struct Curl_multi *multi,
+                               struct Curl_easy *data, curl_socket_t s)
+{
+  mev_forget_socket(multi, data, s, "socket done");
+}
+
+void Curl_multi_ev_xfer_done(struct Curl_multi *multi,
+                             struct Curl_easy *data)
+{
+  DEBUGASSERT(!data->conn); /* transfer should have been detached */
+  (void)mev_assess(multi, data, NULL);
+  Curl_meta_remove(data, CURL_META_MEV_POLLSET);
+}
+
+void Curl_multi_ev_conn_done(struct Curl_multi *multi,
+                             struct Curl_easy *data,
+                             struct connectdata *conn)
+{
+  (void)mev_assess(multi, data, conn);
+  Curl_conn_meta_remove(conn, CURL_META_MEV_POLLSET);
+}
+
+void Curl_multi_ev_init(struct Curl_multi *multi, size_t hashsize)
+{
+  Curl_hash_init(&multi->ev.sh_entries, hashsize, mev_sh_entry_hash,
+                 mev_sh_entry_compare, mev_sh_entry_dtor);
+}
+
+void Curl_multi_ev_cleanup(struct Curl_multi *multi)
+{
+  Curl_hash_destroy(&multi->ev.sh_entries);
+}
diff --git a/third-party/curl/lib/multi_ev.h b/third-party/curl/lib/multi_ev.h
new file mode 100644
index 0000000000..ddbb9331d3
--- /dev/null
+++ b/third-party/curl/lib/multi_ev.h
@@ -0,0 +1,80 @@
+#ifndef HEADER_CURL_MULTI_EV_H
+#define HEADER_CURL_MULTI_EV_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "hash.h"
+
+struct Curl_easy;
+struct Curl_multi;
+struct easy_pollset;
+struct uint32_bset;
+
+/* meta key for event pollset at easy handle or connection */
+#define CURL_META_MEV_POLLSET   "meta:mev:ps"
+
+struct curl_multi_ev {
+  struct Curl_hash sh_entries;
+};
+
+/* Setup/teardown of multi event book-keeping. */
+void Curl_multi_ev_init(struct Curl_multi *multi, size_t hashsize);
+void Curl_multi_ev_cleanup(struct Curl_multi *multi);
+
+/* Assign a 'user_data' to be passed to the socket callback when
+ * invoked with the given socket. This will fail if this socket
+ * is not active, e.g. the application has not been told to monitor it. */
+CURLMcode Curl_multi_ev_assign(struct Curl_multi *multi, curl_socket_t s,
+                               void *user_data);
+
+/* Assess the transfer by getting its current pollset, compute
+ * any changes to the last one and inform the application's socket
+ * callback if things have changed. */
+CURLMcode Curl_multi_ev_assess_xfer(struct Curl_multi *multi,
+                                    struct Curl_easy *data);
+/* Assess all easy handles on the list */
+CURLMcode Curl_multi_ev_assess_xfer_bset(struct Curl_multi *multi,
+                                         struct uint32_bset *set);
+/* Assess the connection by getting its current pollset */
+CURLMcode Curl_multi_ev_assess_conn(struct Curl_multi *multi,
+                                    struct Curl_easy *data,
+                                    struct connectdata *conn);
+
+/* Mark all transfers tied to the given socket as dirty */
+void Curl_multi_ev_dirty_xfers(struct Curl_multi *multi,
+                               curl_socket_t s);
+
+/* Socket will be closed, forget anything we know about it. */
+void Curl_multi_ev_socket_done(struct Curl_multi *multi,
+                               struct Curl_easy *data, curl_socket_t s);
+
+/* Transfer is removed from the multi */
+void Curl_multi_ev_xfer_done(struct Curl_multi *multi,
+                             struct Curl_easy *data);
+
+/* Connection is being destroyed */
+void Curl_multi_ev_conn_done(struct Curl_multi *multi,
+                             struct Curl_easy *data,
+                             struct connectdata *conn);
+
+#endif /* HEADER_CURL_MULTI_EV_H */
diff --git a/third-party/curl/lib/multi_ntfy.c b/third-party/curl/lib/multi_ntfy.c
new file mode 100644
index 0000000000..1319aaec07
--- /dev/null
+++ b/third-party/curl/lib/multi_ntfy.c
@@ -0,0 +1,207 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "urldata.h"
+#include "curl_trc.h"
+#include "multihandle.h"
+#include "multiif.h"
+#include "multi_ntfy.h"
+
+
+struct mntfy_entry {
+  uint32_t mid;
+  uint32_t type;
+};
+
+#define CURL_MNTFY_CHUNK_SIZE 128
+
+struct mntfy_chunk {
+  struct mntfy_chunk *next;
+  size_t r_offset;
+  size_t w_offset;
+  struct mntfy_entry entries[CURL_MNTFY_CHUNK_SIZE];
+};
+
+static struct mntfy_chunk *mnfty_chunk_create(void)
+{
+  return curlx_calloc(1, sizeof(struct mntfy_chunk));
+}
+
+static void mnfty_chunk_destroy(struct mntfy_chunk *chunk)
+{
+  curlx_free(chunk);
+}
+
+static void mnfty_chunk_reset(struct mntfy_chunk *chunk)
+{
+  memset(chunk, 0, sizeof(*chunk));
+}
+
+static bool mntfy_chunk_append(struct mntfy_chunk *chunk,
+                               struct Curl_easy *data,
+                               uint32_t type)
+{
+  struct mntfy_entry *e;
+
+  if(chunk->w_offset >= CURL_MNTFY_CHUNK_SIZE)
+    return FALSE;
+  e = &chunk->entries[chunk->w_offset++];
+  e->mid = data->mid;
+  e->type = type;
+  return TRUE;
+}
+
+static struct mntfy_chunk *mntfy_non_full_tail(struct curl_multi_ntfy *mntfy)
+{
+  struct mntfy_chunk *chunk;
+  if(!mntfy->tail) {
+    chunk = mnfty_chunk_create();
+    if(!chunk)
+      return NULL;
+    DEBUGASSERT(!mntfy->head);
+    mntfy->head = mntfy->tail = chunk;
+    return chunk;
+  }
+  else if(mntfy->tail->w_offset < CURL_MNTFY_CHUNK_SIZE)
+    return mntfy->tail;
+  else { /* tail is full. */
+    chunk = mnfty_chunk_create();
+    if(!chunk)
+      return NULL;
+    DEBUGASSERT(mntfy->head);
+    mntfy->tail->next = chunk;
+    mntfy->tail = chunk;
+    return chunk;
+  }
+}
+
+static void mntfy_chunk_dispatch_all(struct Curl_multi *multi,
+                                     struct mntfy_chunk *chunk)
+{
+  struct mntfy_entry *e;
+  struct Curl_easy *data;
+
+  if(multi->ntfy.ntfy_cb) {
+    while((chunk->r_offset < chunk->w_offset) && !multi->ntfy.failure) {
+      e = &chunk->entries[chunk->r_offset];
+      data = e->mid ? Curl_multi_get_easy(multi, e->mid) : multi->admin;
+      /* only when notification has not been disabled in the meantime */
+      if(data && Curl_uint32_bset_contains(&multi->ntfy.enabled, e->type)) {
+        /* this may cause new notifications to be added! */
+        CURL_TRC_M(multi->admin, "[NTFY] dispatch %u to xfer %u",
+                   e->type, e->mid);
+        multi->ntfy.ntfy_cb(multi, e->type, data, multi->ntfy.ntfy_cb_data);
+      }
+      /* once dispatched, safe to increment */
+      chunk->r_offset++;
+    }
+  }
+  mnfty_chunk_reset(chunk);
+}
+
+void Curl_mntfy_init(struct Curl_multi *multi)
+{
+  memset(&multi->ntfy, 0, sizeof(multi->ntfy));
+  Curl_uint32_bset_init(&multi->ntfy.enabled);
+}
+
+CURLMcode Curl_mntfy_resize(struct Curl_multi *multi)
+{
+  if(Curl_uint32_bset_resize(&multi->ntfy.enabled, CURLMNOTIFY_EASY_DONE + 1))
+    return CURLM_OUT_OF_MEMORY;
+  return CURLM_OK;
+}
+
+void Curl_mntfy_cleanup(struct Curl_multi *multi)
+{
+  while(multi->ntfy.head) {
+    struct mntfy_chunk *chunk = multi->ntfy.head;
+    multi->ntfy.head = chunk->next;
+    mnfty_chunk_destroy(chunk);
+  }
+  multi->ntfy.tail = NULL;
+  Curl_uint32_bset_destroy(&multi->ntfy.enabled);
+}
+
+CURLMcode Curl_mntfy_enable(struct Curl_multi *multi, unsigned int type)
+{
+  if(type > CURLMNOTIFY_EASY_DONE)
+    return CURLM_UNKNOWN_OPTION;
+  Curl_uint32_bset_add(&multi->ntfy.enabled, type);
+  return CURLM_OK;
+}
+
+CURLMcode Curl_mntfy_disable(struct Curl_multi *multi, unsigned int type)
+{
+  if(type > CURLMNOTIFY_EASY_DONE)
+    return CURLM_UNKNOWN_OPTION;
+  Curl_uint32_bset_remove(&multi->ntfy.enabled, (uint32_t)type);
+  return CURLM_OK;
+}
+
+void Curl_mntfy_add(struct Curl_easy *data, unsigned int type)
+{
+  struct Curl_multi *multi = data ? data->multi : NULL;
+  if(multi && multi->ntfy.ntfy_cb && !multi->ntfy.failure &&
+     Curl_uint32_bset_contains(&multi->ntfy.enabled, (uint32_t)type)) {
+    /* append to list of outstanding notifications */
+    struct mntfy_chunk *tail = mntfy_non_full_tail(&multi->ntfy);
+    CURL_TRC_M(data, "[NTFY] add %u for xfer %u", type, data->mid);
+    if(tail)
+      mntfy_chunk_append(tail, data, (uint32_t)type);
+    else
+      multi->ntfy.failure = CURLM_OUT_OF_MEMORY;
+    multi->ntfy.has_entries = TRUE;
+  }
+}
+
+CURLMcode Curl_mntfy_dispatch_all(struct Curl_multi *multi)
+{
+  DEBUGASSERT(!multi->in_ntfy_callback);
+  multi->in_ntfy_callback = TRUE;
+  while(multi->ntfy.head && !multi->ntfy.failure) {
+    struct mntfy_chunk *chunk = multi->ntfy.head;
+    /* this may cause new notifications to be added! */
+    mntfy_chunk_dispatch_all(multi, chunk);
+    DEBUGASSERT(chunk->r_offset == chunk->w_offset);
+
+    if(chunk == multi->ntfy.tail) /* last one, keep */
+      break;
+    DEBUGASSERT(chunk->next);
+    DEBUGASSERT(multi->ntfy.head != multi->ntfy.tail);
+    multi->ntfy.head = chunk->next;
+    mnfty_chunk_destroy(chunk);
+  }
+  multi->in_ntfy_callback = FALSE;
+
+  if(multi->ntfy.failure) {
+    CURLMcode mresult = multi->ntfy.failure;
+    multi->ntfy.failure = CURLM_OK; /* reset, once delivered */
+    return mresult;
+  }
+  else
+    multi->ntfy.has_entries = FALSE;
+  return CURLM_OK;
+}
diff --git a/third-party/curl/lib/multi_ntfy.h b/third-party/curl/lib/multi_ntfy.h
new file mode 100644
index 0000000000..05df2d6681
--- /dev/null
+++ b/third-party/curl/lib/multi_ntfy.h
@@ -0,0 +1,60 @@
+#ifndef HEADER_CURL_MULTI_NTFY_H
+#define HEADER_CURL_MULTI_NTFY_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "uint-bset.h"
+
+struct Curl_easy;
+struct Curl_multi;
+
+struct curl_multi_ntfy {
+  curl_notify_callback ntfy_cb;
+  void *ntfy_cb_data;
+  struct uint32_bset enabled;
+  struct mntfy_chunk *head;
+  struct mntfy_chunk *tail;
+  CURLMcode failure;
+  BIT(has_entries);
+};
+
+void Curl_mntfy_init(struct Curl_multi *multi);
+CURLMcode Curl_mntfy_resize(struct Curl_multi *multi);
+void Curl_mntfy_cleanup(struct Curl_multi *multi);
+
+CURLMcode Curl_mntfy_enable(struct Curl_multi *multi, unsigned int type);
+CURLMcode Curl_mntfy_disable(struct Curl_multi *multi, unsigned int type);
+
+void Curl_mntfy_add(struct Curl_easy *data, unsigned int type);
+
+#define CURLM_NTFY(d, t)                              \
+  do {                                                \
+    if((d) && (d)->multi && (d)->multi->ntfy.ntfy_cb) \
+      Curl_mntfy_add((d), (t));                       \
+  } while(0)
+
+#define CURL_MNTFY_HAS_ENTRIES(m)       ((m)->ntfy.has_entries)
+
+CURLMcode Curl_mntfy_dispatch_all(struct Curl_multi *multi);
+
+#endif /* HEADER_CURL_MULTI_NTFY_H */
diff --git a/third-party/curl/lib/multihandle.h b/third-party/curl/lib/multihandle.h
index 5b16bb605f..19dd2ffcdf 100644
--- a/third-party/curl/lib/multihandle.h
+++ b/third-party/curl/lib/multihandle.h
@@ -23,86 +23,82 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "llist.h"
 #include "hash.h"
 #include "conncache.h"
+#include "cshutdn.h"
+#include "dnscache.h"
+#include "multi_ev.h"
+#include "multi_ntfy.h"
 #include "psl.h"
 #include "socketpair.h"
+#include "uint-bset.h"
+#include "uint-spbset.h"
+#include "uint-table.h"
 
 struct connectdata;
+struct Curl_easy;
 
 struct Curl_message {
-  struct Curl_llist_element list;
+  struct Curl_llist_node list;
   /* the 'CURLMsg' is the part that is visible to the external user */
   struct CURLMsg extmsg;
 };
 
-/* NOTE: if you add a state here, add the name to the statename[] array as
-   well!
-*/
+/* NOTE: if you add a state here, add the name to the statenames[] array
+ * in curl_trc.c as well!
+ */
 typedef enum {
   MSTATE_INIT,         /* 0 - start in this state */
-  MSTATE_PENDING,      /* 1 - no connections, waiting for one */
-  MSTATE_CONNECT,      /* 2 - resolve/connect has been sent off */
-  MSTATE_RESOLVING,    /* 3 - awaiting the resolve to finalize */
-  MSTATE_CONNECTING,   /* 4 - awaiting the TCP connect to finalize */
-  MSTATE_TUNNELING,    /* 5 - awaiting HTTPS proxy SSL initialization to
-                          complete and/or proxy CONNECT to finalize */
-  MSTATE_PROTOCONNECT, /* 6 - initiate protocol connect procedure */
-  MSTATE_PROTOCONNECTING, /* 7 - completing the protocol-specific connect
-                             phase */
-  MSTATE_DO,           /* 8 - start send off the request (part 1) */
-  MSTATE_DOING,        /* 9 - sending off the request (part 1) */
-  MSTATE_DOING_MORE,   /* 10 - send off the request (part 2) */
-  MSTATE_DID,          /* 11 - done sending off request */
-  MSTATE_PERFORMING,   /* 12 - transfer data */
-  MSTATE_RATELIMITING, /* 13 - wait because limit-rate exceeded */
-  MSTATE_DONE,         /* 14 - post data transfer operation */
-  MSTATE_COMPLETED,    /* 15 - operation complete */
-  MSTATE_MSGSENT,      /* 16 - the operation complete message is sent */
-  MSTATE_LAST          /* 17 - not a true state, never use this */
+  MSTATE_PENDING,      /* no connections, waiting for one */
+  MSTATE_SETUP,        /* start a new transfer */
+  MSTATE_CONNECT,      /* resolve/connect has been sent off */
+  MSTATE_CONNECTING,   /* awaiting the TCP connect to finalize */
+  MSTATE_PROTOCONNECT, /* initiate protocol connect procedure */
+  MSTATE_PROTOCONNECTING, /* completing the protocol-specific connect phase */
+  MSTATE_DO,           /* start send off the request (part 1) */
+  MSTATE_DOING,        /* sending off the request (part 1) */
+  MSTATE_DOING_MORE,   /* send off the request (part 2) */
+  MSTATE_DID,          /* done sending off request */
+  MSTATE_PERFORMING,   /* transfer data */
+  MSTATE_RATELIMITING, /* wait because limit-rate exceeded */
+  MSTATE_DONE,         /* post data transfer operation */
+  MSTATE_COMPLETED,    /* operation complete */
+  MSTATE_MSGSENT,      /* the operation complete message is sent */
+  MSTATE_LAST          /* not a true state, never use this */
 } CURLMstate;
 
-/* we support N sockets per easy handle. Set the corresponding bit to what
-   action we should wait for */
-#define MAX_SOCKSPEREASYHANDLE 5
-#define GETSOCK_READABLE (0x00ff)
-#define GETSOCK_WRITABLE (0xff00)
-
 #define CURLPIPE_ANY (CURLPIPE_MULTIPLEX)
 
-#if !defined(CURL_DISABLE_SOCKETPAIR)
+#if !defined(CURL_DISABLE_SOCKETPAIR) && !defined(USE_WINSOCK)
 #define ENABLE_WAKEUP
 #endif
 
 /* value for MAXIMUM CONCURRENT STREAMS upper limit */
 #define INITIAL_MAX_CONCURRENT_STREAMS ((1U << 31) - 1)
 
-/* Curl_multi SSL backend-specific data; declared differently by each SSL
-   backend */
-struct multi_ssl_backend_data;
-
 /* This is the struct known as CURLM on the outside */
 struct Curl_multi {
   /* First a simple identifier to easier detect if a user mix up
      this multi handle with an easy handle. Set this to CURL_MULTI_HANDLE. */
   unsigned int magic;
 
-  /* We have a doubly-linked list with easy handles */
-  struct Curl_easy *easyp;
-  struct Curl_easy *easylp; /* last node */
-
-  int num_easy; /* amount of entries in the linked list above. */
-  int num_alive; /* amount of easy handles that are added but have not yet
-                    reached COMPLETE state */
+  unsigned int xfers_alive; /* amount of added transfers that have
+                               not yet reached COMPLETE state */
+  unsigned int xfers_really_alive; /* amount of added transfers that have
+                               passed INIT state but are not COMPLETE yet */
+  curl_off_t xfers_total_ever; /* total of added transfers, ever. */
+  struct uint32_tbl xfers; /* transfers added to this multi */
+  /* Each transfer's mid may be present in at most one of these */
+  struct uint32_bset process; /* transfer being processed */
+  struct uint32_bset dirty; /* transfer to be run NOW, e.g. ASAP. */
+  struct uint32_bset pending; /* transfers in waiting (conn limit etc.) */
+  struct uint32_bset msgsent; /* transfers done with message for application */
 
   struct Curl_llist msglist; /* a list of messages from completed transfers */
 
-  struct Curl_llist pending; /* Curl_easys that are in the
-                                MSTATE_PENDING state */
-  struct Curl_llist msgsent; /* Curl_easys that are in the
-                                MSTATE_MSGSENT state */
+  struct Curl_easy *admin; /* internal easy handle for admin operations.
+                              gets assigned `mid` 0 on multi init */
 
   /* callback function and user data pointer for the *socket() API */
   curl_socket_callback socket_cb;
@@ -112,66 +108,91 @@ struct Curl_multi {
   curl_push_callback push_cb;
   void *push_userp;
 
-  /* Hostname cache */
-  struct Curl_hash hostcache;
+  struct Curl_dnscache dnscache; /* DNS cache */
+  struct Curl_ssl_scache *ssl_scache; /* TLS session pool */
+#ifdef USE_RESOLV_THREADED
+  struct curl_thrdq *resolv_thrdq;
+#endif
 
 #ifdef USE_LIBPSL
   /* PSL cache. */
   struct PslCache psl;
 #endif
 
+  /* current time for transfers running in this multi handle */
+  struct curltime now;
   /* timetree points to the splay-tree of time nodes to figure out expire
      times of all currently set timers */
   struct Curl_tree *timetree;
 
-#if defined(USE_SSL)
-  struct multi_ssl_backend_data *ssl_backend_data;
-#endif
+  /* buffer used for transfer data, lazy initialized */
+  char *xfer_buf; /* the actual buffer */
+  size_t xfer_buf_len;      /* the allocated length */
+  /* buffer used for upload data, lazy initialized */
+  char *xfer_ulbuf; /* the actual buffer */
+  size_t xfer_ulbuf_len;      /* the allocated length */
+  /* buffer used for socket I/O operations, lazy initialized */
+  char *xfer_sockbuf; /* the actual buffer */
+  size_t xfer_sockbuf_len; /* the allocated length */
 
-  /* 'sockhash' is the lookup hash for socket descriptor => easy handles (note
-     the pluralis form, there can be more than one easy handle waiting on the
-     same actual socket) */
-  struct Curl_hash sockhash;
+  /* multi event related things */
+  struct curl_multi_ev ev;
+  /* multi notification related things */
+  struct curl_multi_ntfy ntfy;
 
-  /* Shared connection cache (bundles)*/
-  struct conncache conn_cache;
+  /* `proto_hash` is a general key-value store for protocol implementations
+   * with the lifetime of the multi handle. The number of elements kept here
+   * should be in the order of supported protocols (and sub-protocols like
+   * TLS), *not* in the order of connections or current transfers!
+   * Elements need to be added with their own destructor to be invoked when
+   * the multi handle is cleaned up (see Curl_hash_add2()).*/
+  struct Curl_hash proto_hash;
 
-  long maxconnects; /* if >0, a fixed limit of the maximum number of entries
-                       we're allowed to grow the connection cache to */
+  struct cshutdn cshutdn; /* connection shutdown handling */
+  struct cpool cpool;     /* connection pool (bundles) */
 
-  long max_host_connections; /* if >0, a fixed limit of the maximum number
-                                of connections per host */
-
-  long max_total_connections; /* if >0, a fixed limit of the maximum number
-                                 of connections in total */
+  size_t max_host_connections; /* if >0, a fixed limit of the maximum number
+                                  of connections per host */
+  size_t max_total_connections; /* if >0, a fixed limit of the maximum number
+                                   of connections in total */
 
   /* timer callback and user data pointer for the *socket() API */
   curl_multi_timer_callback timer_cb;
   void *timer_userp;
-  struct curltime timer_lastcall; /* the fixed time for the timeout for the
-                                    previous callback */
-  unsigned int max_concurrent_streams;
+  long last_timeout_ms;        /* the last timeout value set via timer_cb */
+  struct curltime last_expire_ts; /* timestamp of last expiry */
 
 #ifdef USE_WINSOCK
-  WSAEVENT wsa_event; /* winsock event used for waits */
-#else
+  WSAEVENT wsa_event; /* Winsock event used for waits */
+#endif
 #ifdef ENABLE_WAKEUP
-  curl_socket_t wakeup_pair[2]; /* socketpair() used for wakeup
-                                   0 is used for read, 1 is used for write */
+  curl_socket_t wakeup_pair[2]; /* eventfd()/pipe()/socketpair() used for
+                                   wakeup 0 is used for read, 1 is used
+                                   for write */
 #endif
+  unsigned int max_concurrent_streams;
+  unsigned int maxconnects; /* if >0, a fixed limit of the maximum number of
+                               entries we are allowed to grow the connection
+                               cache to */
+#ifdef DEBUGBUILD
+  unsigned int now_access_count;
 #endif
-#define IPV6_UNKNOWN 0
-#define IPV6_DEAD    1
-#define IPV6_WORKS   2
-  unsigned char ipv6_up;       /* IPV6_* defined */
+  uint32_t last_pending_mid; /* mid of last pending transfer rescheduled */
+  uint32_t last_resolv_id; /* id of the last DNS resolve operation */
+  BIT(ipv6_works);
   BIT(multiplexing);           /* multiplexing wanted */
   BIT(recheckstate);           /* see Curl_multi_connchanged */
   BIT(in_callback);            /* true while executing a callback */
+  BIT(in_ntfy_callback);       /* true while dispatching notifications */
 #ifdef USE_OPENSSL
   BIT(ssl_seeded);
 #endif
   BIT(dead); /* a callback returned error, everything needs to crash and
                 burn */
+  BIT(xfer_buf_borrowed);      /* xfer_buf is currently being borrowed */
+  BIT(xfer_ulbuf_borrowed);    /* xfer_ulbuf is currently being borrowed */
+  BIT(xfer_sockbuf_borrowed);  /* xfer_sockbuf is currently being borrowed */
+  BIT(quick_exit);             /* do not join threads on cleanup */
 #ifdef DEBUGBUILD
   BIT(warned);                 /* true after user warned of DEBUGBUILD */
 #endif
diff --git a/third-party/curl/lib/multiif.h b/third-party/curl/lib/multiif.h
index 7f08ecc614..039db269e0 100644
--- a/third-party/curl/lib/multiif.h
+++ b/third-party/curl/lib/multiif.h
@@ -23,74 +23,42 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /*
  * Prototypes for library-wide functions provided by multi.c
  */
 
-CURLcode Curl_updatesocket(struct Curl_easy *data);
-void Curl_expire(struct Curl_easy *data, timediff_t milli, expire_id);
+void Curl_expire(struct Curl_easy *data, timediff_t milli, expire_id id);
+void Curl_expire_ex(struct Curl_easy *data,
+                    timediff_t milli, expire_id id);
 void Curl_expire_clear(struct Curl_easy *data);
 void Curl_expire_done(struct Curl_easy *data, expire_id id);
 CURLMcode Curl_update_timer(struct Curl_multi *multi) WARN_UNUSED_RESULT;
 void Curl_attach_connection(struct Curl_easy *data,
-                             struct connectdata *conn);
+                            struct connectdata *conn);
 void Curl_detach_connection(struct Curl_easy *data);
 bool Curl_multiplex_wanted(const struct Curl_multi *multi);
 void Curl_set_in_callback(struct Curl_easy *data, bool value);
-bool Curl_is_in_callback(struct Curl_easy *easy);
+bool Curl_is_in_callback(struct Curl_easy *data);
 CURLcode Curl_preconnect(struct Curl_easy *data);
+bool Curl_is_connecting(struct Curl_easy *data);
 
 void Curl_multi_connchanged(struct Curl_multi *multi);
 
 /* Internal version of curl_multi_init() accepts size parameters for the
    socket, connection and dns hashes */
-struct Curl_multi *Curl_multi_handle(int hashsize, int chashsize,
-                                     int dnssize);
+struct Curl_multi *Curl_multi_handle(uint32_t xfer_table_size,
+                                     size_t ev_hashsize,
+                                     size_t chashsize,
+                                     size_t dnssize,
+                                     size_t sesssize);
 
-/* the write bits start at bit 16 for the *getsock() bitmap */
-#define GETSOCK_WRITEBITSTART 16
-
-#define GETSOCK_BLANK 0 /* no bits set */
-
-/* set the bit for the given sock number to make the bitmap for writable */
-#define GETSOCK_WRITESOCK(x) (1 << (GETSOCK_WRITEBITSTART + (x)))
-
-/* set the bit for the given sock number to make the bitmap for readable */
-#define GETSOCK_READSOCK(x) (1 << (x))
-
-/* mask for checking if read and/or write is set for index x */
-#define GETSOCK_MASK_RW(x) (GETSOCK_READSOCK(x)|GETSOCK_WRITESOCK(x))
-
-#ifdef DEBUGBUILD
- /*
-  * Curl_multi_dump is not a stable public function, this is only meant to
-  * allow easier tracking of the internal handle's state and what sockets
-  * they use. Only for research and development DEBUGBUILD enabled builds.
-  */
-void Curl_multi_dump(struct Curl_multi *multi);
-#endif
-
-/* Return the value of the CURLMOPT_MAX_HOST_CONNECTIONS option */
-size_t Curl_multi_max_host_connections(struct Curl_multi *multi);
-
-/* Return the value of the CURLMOPT_MAX_TOTAL_CONNECTIONS option */
-size_t Curl_multi_max_total_connections(struct Curl_multi *multi);
-
-void Curl_multiuse_state(struct Curl_easy *data,
-                         int bundlestate); /* use BUNDLE_* defines */
-
-/*
- * Curl_multi_closed()
- *
- * Used by the connect code to tell the multi_socket code that one of the
- * sockets we were using is about to be closed.  This function will then
- * remove it from the sockethash for this handle to make the multi_socket API
- * behave properly, especially for the case when libcurl will create another
- * socket again and it gets the same file descriptor number.
+/**
+ * Let the multi handle know that the socket is about to be closed.
+ * The multi will then remove anything it knows about the socket, so
+ * when the OS is using this socket (number) again subsequently,
+ * the internal book keeping will not get confused.
  */
-
-void Curl_multi_closed(struct Curl_easy *data, curl_socket_t s);
+void Curl_multi_will_close(struct Curl_easy *data, curl_socket_t s);
 
 /*
  * Add a handle and move it into PERFORM state at once. For pushed streams.
@@ -99,8 +67,101 @@ CURLMcode Curl_multi_add_perform(struct Curl_multi *multi,
                                  struct Curl_easy *data,
                                  struct connectdata *conn);
 
-
 /* Return the value of the CURLMOPT_MAX_CONCURRENT_STREAMS option */
 unsigned int Curl_multi_max_concurrent_streams(struct Curl_multi *multi);
 
+CURLMcode Curl_multi_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps);
+
+/**
+ * Borrow the transfer buffer from the multi, suitable
+ * for the given transfer `data`. The buffer may only be used in one
+ * multi processing of the easy handle. It MUST be returned to the
+ * multi before it can be borrowed again.
+ * Pointers into the buffer remain only valid as long as it is borrowed.
+ *
+ * @param data    the easy handle
+ * @param pbuf    on return, the buffer to use or NULL on error
+ * @param pbuflen on return, the size of *pbuf or 0 on error
+ * @return CURLE_OK when buffer is available and is returned.
+ *         CURLE_OUT_OF_MEMORy on failure to allocate the buffer,
+ *         CURLE_FAILED_INIT if the easy handle is without multi.
+ *         CURLE_AGAIN if the buffer is borrowed already.
+ */
+CURLcode Curl_multi_xfer_buf_borrow(struct Curl_easy *data,
+                                    char **pbuf, size_t *pbuflen);
+/**
+ * Release the borrowed buffer. All references into the buffer become
+ * invalid after this.
+ * @param buf the buffer pointer borrowed for coding error checks.
+ */
+void Curl_multi_xfer_buf_release(struct Curl_easy *data, char *buf);
+
+/**
+ * Borrow the upload buffer from the multi, suitable
+ * for the given transfer `data`. The buffer may only be used in one
+ * multi processing of the easy handle. It MUST be returned to the
+ * multi before it can be borrowed again.
+ * Pointers into the buffer remain only valid as long as it is borrowed.
+ *
+ * @param data    the easy handle
+ * @param pbuf    on return, the buffer to use or NULL on error
+ * @param pbuflen on return, the size of *pbuf or 0 on error
+ * @return CURLE_OK when buffer is available and is returned.
+ *         CURLE_OUT_OF_MEMORy on failure to allocate the buffer,
+ *         CURLE_FAILED_INIT if the easy handle is without multi.
+ *         CURLE_AGAIN if the buffer is borrowed already.
+ */
+CURLcode Curl_multi_xfer_ulbuf_borrow(struct Curl_easy *data,
+                                      char **pbuf, size_t *pbuflen);
+
+/**
+ * Release the borrowed upload buffer. All references into the buffer become
+ * invalid after this.
+ * @param buf the upload buffer pointer borrowed for coding error checks.
+ */
+void Curl_multi_xfer_ulbuf_release(struct Curl_easy *data, char *buf);
+
+/**
+ * Borrow the socket scratch buffer from the multi, suitable
+ * for the given transfer `data`. The buffer may only be used for
+ * direct socket I/O operation by one connection at a time and MUST be
+ * returned to the multi before the I/O call returns.
+ * Pointers into the buffer remain only valid as long as it is borrowed.
+ *
+ * @param data    the easy handle
+ * @param blen    requested length of the buffer
+ * @param pbuf    on return, the buffer to use or NULL on error
+ * @return CURLE_OK when buffer is available and is returned.
+ *         CURLE_OUT_OF_MEMORy on failure to allocate the buffer,
+ *         CURLE_FAILED_INIT if the easy handle is without multi.
+ *         CURLE_AGAIN if the buffer is borrowed already.
+ */
+CURLcode Curl_multi_xfer_sockbuf_borrow(struct Curl_easy *data,
+                                        size_t blen, char **pbuf);
+/**
+ * Release the borrowed buffer. All references into the buffer become
+ * invalid after this.
+ * @param buf the buffer pointer borrowed for coding error checks.
+ */
+void Curl_multi_xfer_sockbuf_release(struct Curl_easy *data, char *buf);
+
+/**
+ * Get the easy handle for the given mid.
+ * Returns NULL if not found.
+ */
+struct Curl_easy *Curl_multi_get_easy(struct Curl_multi *multi,
+                                      uint32_t mid);
+
+/* Get the # of transfers current in process/pending. */
+unsigned int Curl_multi_xfers_running(struct Curl_multi *multi);
+
+/* Mark a transfer as dirty, e.g. to be rerun at earliest convenience.
+ * A cheap operation, can be done many times repeatedly. */
+void Curl_multi_mark_dirty(struct Curl_easy *data);
+/* Clear transfer from the dirty set. */
+void Curl_multi_clear_dirty(struct Curl_easy *data);
+
+void Curl_multi_set_now(struct Curl_multi *multi);
+
 #endif /* HEADER_CURL_MULTIIF_H */
diff --git a/third-party/curl/lib/netrc.c b/third-party/curl/lib/netrc.c
index e6a09b187a..7c8e1fb2ab 100644
--- a/third-party/curl/lib/netrc.c
+++ b/third-party/curl/lib/netrc.c
@@ -21,329 +21,674 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+
 #ifndef CURL_DISABLE_NETRC
 
 #ifdef HAVE_PWD_H
+#ifdef __AMIGA__
+#undef __NO_NET_API /* required for AmigaOS to declare getpwuid() */
+#endif
 #include <pwd.h>
+#ifdef __AMIGA__
+#define __NO_NET_API
+#endif
 #endif
 
-#include <curl/curl.h>
 #include "netrc.h"
-#include "strtok.h"
+#include "urldata.h"
+#include "creds.h"
+#include "curl_trc.h"
 #include "strcase.h"
 #include "curl_get_line.h"
+#include "curlx/fopen.h"
+#include "curlx/strparse.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
 
-/* Get user and password from .netrc when given a machine name */
+/* .netrc is not really a standard. The GNU definition can be found here:
+ * https://www.gnu.org/software/inetutils/manual/html_node/The-_002enetrc-file.html
+ * This gives grammar like:
+ *
+ * LITERAL := \S+ | QUOTED
+ * QUOTED  := "(\\[rnt\]|[^"])*"
+ * ANYTHING := .
+ * EMPTY_LINE := \r*\n\r*\n
+ * MACHINE := machine         # case-insensitive
+ * LOGIN   := login           # case-insensitive
+ * PASSWD  := password        # case-insensitive
+ * ACCOUNT := account         # case-insensitive
+ * MACDEF  := macdef          # case-insensitive
+ * DEFAULT := default         # case-insensitive
+ *
+ * MACRO   := MACDEF ANYTHING* EMPTY_LINE
+ * JUNK    := LITERAL
+ * LKEY     := ( LOGIN | PASSWD | ACCOUNT ) LITERAL
+ * MENTRY   := MACHINE LITERAL LKEY*
+ * DENTRY   := DEFAULT LKEY*
+ * NETRC   := (MENTRY | DENTRY | MACRO | JUNK )* EOF
+ *
+ * Tokens are separated by whitespace or newlines. which have otherwise
+ * no special meaning, apart from the empty line ending a MACRO.
+ *
+ * Parsing is not strict, unmatched LITERALs are ignored
+ */
 
-enum host_lookup_state {
-  NOTHING,
-  HOSTFOUND,    /* the 'machine' keyword was found */
-  HOSTVALID,    /* this is "our" machine! */
-  MACDEF
+#define MAX_NETRC_LINE  16384
+#define MAX_NETRC_FILE  (128 * 1024)
+#define MAX_NETRC_TOKEN 4096
+
+#define NETRC_DEBUG   0
+
+/* convert a dynbuf call CURLcode error to a NETRCcode error */
+#define curl2netrc(r)                                  \
+  ((!(r)) ? NETRC_OK : (((r) == CURLE_OUT_OF_MEMORY) ? \
+   NETRC_OUT_OF_MEMORY : NETRC_SYNTAX_ERROR))
+
+typedef enum {
+  NETRC_TOK_EOF,
+  NETRC_TOK_LITERAL,
+  NETRC_TOK_MACHINE,
+  NETRC_TOK_DEFAULT,
+  NETRC_TOK_ACCOUNT,
+  NETRC_TOK_LOGIN,
+  NETRC_TOK_PASSWD,
+  NETRC_TOK_MACDEF,
+  NETRC_TOK_JUNK
+} curl_netrc_token;
+
+struct netrc_lexer {
+  struct Curl_easy *data;
+  const char *content;
+  const char *pos;
+  struct dynbuf literal;
+  curl_netrc_token token;
+  bool pushed;
 };
 
-#define NETRC_FILE_MISSING 1
-#define NETRC_FAILED -1
-#define NETRC_SUCCESS 0
+#if NETRC_DEBUG
+static const char *netrc_tokenstr(curl_netrc_token token)
+{
+  switch(token) {
+  case NETRC_TOK_EOF:
+    return "[EOF]";
+  case NETRC_TOK_LITERAL:
+    return "[LITERAL]";
+  case NETRC_TOK_MACHINE:
+    return "[MACHINE]";
+  case NETRC_TOK_DEFAULT:
+    return "[DEFAULT]";
+  case NETRC_TOK_ACCOUNT:
+    return "[ACCOUNT]";
+  case NETRC_TOK_LOGIN:
+    return "[LOGIN]";
+  case NETRC_TOK_PASSWD:
+    return "[PASSWORD]";
+  case NETRC_TOK_MACDEF:
+    return "[MACDEF]";
+  case NETRC_TOK_JUNK:
+    return "[JUNK]";
+  default:
+    return "[???]";
+  }
+}
+#endif
+
+static void netrc_lexer_init(struct netrc_lexer *lexer,
+                             struct Curl_easy *data,
+                             const char *content)
+{
+  curlx_dyn_init(&lexer->literal, MAX_NETRC_TOKEN);
+  lexer->data = data;
+  lexer->content = lexer->pos = content;
+}
+
+static void netrc_lexer_cleanup(struct netrc_lexer *lexer)
+{
+  lexer->content = lexer->pos = NULL;
+  lexer->data = NULL;
+  curlx_dyn_free(&lexer->literal);
+}
+
+static void netrc_skip_blanks(struct netrc_lexer *lexer)
+{
+  const char *s = lexer->pos;
+  while(*s) {
+    curlx_str_passblanks(&s);
+    while(*s == '\r')
+      ++s;
+    if(*s == '\n') {
+      ++s;
+    }
+    else
+      break;
+  }
+  lexer->pos = s;
+}
+
+static void netrc_skip_to_empty_line(struct netrc_lexer *lexer)
+{
+  const char *s = lexer->pos;
+  while(*s) {
+    if(*s == '\r')
+      ++s;
+    else if(*s == '\n') {
+      ++s;
+      while(*s == '\r')
+        ++s;
+      if(*s == '\n')
+        goto out;
+    }
+    else
+      ++s;
+  }
+out:
+  lexer->pos = s;
+}
 
 /*
- * Returns zero on success.
+ * Parse a quoted token starting after the opening '"'. Handles \n, \r, \t
+ * escape sequences. Advances *tok_endp past the closing '"'.
+ *
+ * Returns NETRC_OK or error.
  */
-static int parsenetrc(const char *host,
-                      char **loginp,
-                      char **passwordp,
-                      char *netrcfile)
+static NETRCcode netrc_lexer_quoted(struct netrc_lexer *lexer)
 {
-  FILE *file;
-  int retcode = NETRC_FILE_MISSING;
-  char *login = *loginp;
-  char *password = *passwordp;
-  bool specific_login = (login && *login != 0);
-  bool login_alloc = FALSE;
-  bool password_alloc = FALSE;
-  enum host_lookup_state state = NOTHING;
+  NETRCcode rc = NETRC_SYNTAX_ERROR;
+  const char *s = lexer->pos;
+  bool escape = FALSE;
+  CURLcode result;
 
-  char state_login = 0;      /* Found a login keyword */
-  char state_password = 0;   /* Found a password keyword */
-  int state_our_login = TRUE;  /* With specific_login, found *our* login
-                                  name (or login-less line) */
-
-  DEBUGASSERT(netrcfile);
-
-  file = fopen(netrcfile, FOPEN_READTEXT);
-  if(file) {
-    bool done = FALSE;
-    char netrcbuffer[4096];
-    int  netrcbuffsize = (int)sizeof(netrcbuffer);
-
-    while(!done && Curl_get_line(netrcbuffer, netrcbuffsize, file)) {
-      char *tok;
-      char *tok_end;
-      bool quoted;
-      if(state == MACDEF) {
-        if((netrcbuffer[0] == '\n') || (netrcbuffer[0] == '\r'))
-          state = NOTHING;
-        else
-          continue;
+  DEBUGASSERT(*s == '\"');
+  ++s; /* pass the leading quote */
+  while(*s) {
+    char c = *s;
+    if(escape) {
+      escape = FALSE;
+      switch(c) {
+      case 'n':
+        c = '\n';
+        break;
+      case 'r':
+        c = '\r';
+        break;
+      case 't':
+        c = '\t';
+        break;
       }
-      tok = netrcbuffer;
-      while(tok) {
-        while(ISBLANK(*tok))
-          tok++;
-        /* tok is first non-space letter */
-        if(!*tok || (*tok == '#'))
-          /* end of line or the rest is a comment */
-          break;
-
-        /* leading double-quote means quoted string */
-        quoted = (*tok == '\"');
-
-        tok_end = tok;
-        if(!quoted) {
-          while(!ISSPACE(*tok_end))
-            tok_end++;
-          *tok_end = 0;
-        }
-        else {
-          bool escape = FALSE;
-          bool endquote = FALSE;
-          char *store = tok;
-          tok_end++; /* pass the leading quote */
-          while(*tok_end) {
-            char s = *tok_end;
-            if(escape) {
-              escape = FALSE;
-              switch(s) {
-              case 'n':
-                s = '\n';
-                break;
-              case 'r':
-                s = '\r';
-                break;
-              case 't':
-                s = '\t';
-                break;
-              }
-            }
-            else if(s == '\\') {
-              escape = TRUE;
-              tok_end++;
-              continue;
-            }
-            else if(s == '\"') {
-              tok_end++; /* pass the ending quote */
-              endquote = TRUE;
-              break;
-            }
-            *store++ = s;
-            tok_end++;
-          }
-          *store = 0;
-          if(escape || !endquote) {
-            /* bad syntax, get out */
-            retcode = NETRC_FAILED;
-            goto out;
-          }
-        }
-
-        if((login && *login) && (password && *password)) {
-          done = TRUE;
-          break;
-        }
-
-        switch(state) {
-        case NOTHING:
-          if(strcasecompare("macdef", tok)) {
-            /* Define a macro. A macro is defined with the specified name; its
-               contents begin with the next .netrc line and continue until a
-               null line (consecutive new-line characters) is encountered. */
-            state = MACDEF;
-          }
-          else if(strcasecompare("machine", tok)) {
-            /* the next tok is the machine name, this is in itself the
-               delimiter that starts the stuff entered for this machine,
-               after this we need to search for 'login' and
-               'password'. */
-            state = HOSTFOUND;
-          }
-          else if(strcasecompare("default", tok)) {
-            state = HOSTVALID;
-            retcode = NETRC_SUCCESS; /* we did find our host */
-          }
-          break;
-        case MACDEF:
-          if(!strlen(tok)) {
-            state = NOTHING;
-          }
-          break;
-        case HOSTFOUND:
-          if(strcasecompare(host, tok)) {
-            /* and yes, this is our host! */
-            state = HOSTVALID;
-            retcode = NETRC_SUCCESS; /* we did find our host */
-          }
-          else
-            /* not our host */
-            state = NOTHING;
-          break;
-        case HOSTVALID:
-          /* we are now parsing sub-keywords concerning "our" host */
-          if(state_login) {
-            if(specific_login) {
-              state_our_login = !Curl_timestrcmp(login, tok);
-            }
-            else if(!login || Curl_timestrcmp(login, tok)) {
-              if(login_alloc) {
-                free(login);
-                login_alloc = FALSE;
-              }
-              login = strdup(tok);
-              if(!login) {
-                retcode = NETRC_FAILED; /* allocation failed */
-                goto out;
-              }
-              login_alloc = TRUE;
-            }
-            state_login = 0;
-          }
-          else if(state_password) {
-            if((state_our_login || !specific_login)
-               && (!password || Curl_timestrcmp(password, tok))) {
-              if(password_alloc) {
-                free(password);
-                password_alloc = FALSE;
-              }
-              password = strdup(tok);
-              if(!password) {
-                retcode = NETRC_FAILED; /* allocation failed */
-                goto out;
-              }
-              password_alloc = TRUE;
-            }
-            state_password = 0;
-          }
-          else if(strcasecompare("login", tok))
-            state_login = 1;
-          else if(strcasecompare("password", tok))
-            state_password = 1;
-          else if(strcasecompare("machine", tok)) {
-            /* ok, there's machine here go => */
-            state = HOSTFOUND;
-            state_our_login = FALSE;
-          }
-          break;
-        } /* switch (state) */
-        tok = ++tok_end;
-      }
-    } /* while Curl_get_line() */
-
+    }
+    else if(c == '\\') {
+      escape = TRUE;
+      ++s;
+      continue;
+    }
+    else if(c == '\"') {
+      ++s; /* pass the ending quote */
+      rc = NETRC_OK;
+      goto out;
+    }
+    result = curlx_dyn_addn(&lexer->literal, &c, 1);
+    if(result) {
+      rc = curl2netrc(result);
+      goto out;
+    }
+    ++s;
+  }
 out:
-    if(!retcode) {
-      /* success */
-      if(login_alloc) {
-        if(*loginp)
-          free(*loginp);
-        *loginp = login;
-      }
-      if(password_alloc) {
-        if(*passwordp)
-          free(*passwordp);
-        *passwordp = password;
-      }
-    }
-    else {
-      if(login_alloc)
-        free(login);
-      if(password_alloc)
-        free(password);
-    }
-    fclose(file);
+  lexer->pos = s;
+  return rc;
+}
+
+static void netrc_lexer_push(struct netrc_lexer *lexer)
+{
+  lexer->pushed = TRUE;
+}
+
+static NETRCcode netrc_lexer_next(struct netrc_lexer *lexer,
+                                  bool want_literal)
+{
+  const char *s = lexer->pos, *start;
+  NETRCcode rc = NETRC_OK;
+  size_t slen;
+  CURLcode result;
+
+  if(lexer->pushed) {
+    lexer->pushed = FALSE;
+    goto out;
   }
 
-  return retcode;
+  curlx_dyn_reset(&lexer->literal);
+  netrc_skip_blanks(lexer);
+  s = lexer->pos;
+
+  switch(*s) {
+  case 0:
+    lexer->token = NETRC_TOK_EOF;
+    break;
+  case '\"':
+    rc = netrc_lexer_quoted(lexer);
+    lexer->token = NETRC_TOK_LITERAL;
+    s = lexer->pos;
+    break;
+  default:
+    /* unquoted token */
+    start = s;
+    while(*s && !ISBLANK(*s) && !ISNEWLINE(*s))
+      ++s;
+    slen = s - start;
+    if(!slen) {
+      rc = NETRC_SYNTAX_ERROR;
+    }
+    if(want_literal) {
+      lexer->token = NETRC_TOK_LITERAL;
+      result = curlx_dyn_addn(&lexer->literal, start, slen);
+      rc = curl2netrc(result);
+    }
+    else if((slen == 7) && curl_strnequal(start, "machine", slen)) {
+      lexer->token = NETRC_TOK_MACHINE;
+    }
+    else if((slen == 7) && curl_strnequal(start, "default", slen)) {
+      lexer->token = NETRC_TOK_DEFAULT;
+    }
+    else if((slen == 7) && curl_strnequal(start, "account", slen)) {
+      lexer->token = NETRC_TOK_ACCOUNT;
+    }
+    else if((slen == 5) && curl_strnequal(start, "login", slen)) {
+      lexer->token = NETRC_TOK_LOGIN;
+    }
+    else if((slen == 8) && curl_strnequal(start, "password", slen)) {
+      lexer->token = NETRC_TOK_PASSWD;
+    }
+    else if((slen == 6) && curl_strnequal(start, "macdef", slen)) {
+      lexer->token = NETRC_TOK_MACDEF;
+    }
+    else {
+      lexer->token = NETRC_TOK_JUNK;
+    }
+    break;
+  }
+
+out:
+#if NETRC_DEBUG
+  CURL_TRC_M(lexer->data, "[NETRC] token %s '%s', rc=%d",
+             netrc_tokenstr(lexer->token),
+             curlx_dyn_ptr(&lexer->literal), rc);
+#endif
+  lexer->pos = s;
+  return rc;
+}
+
+struct netrc_scanner {
+  struct netrc_lexer lexer;
+  const char *hostname; /* non-NULL, machine to scan for */
+  const char *user; /* maybe NULL, login to scan for */
+  char *login;
+  char *passwd;
+  struct Curl_creds *creds;
+  bool matches_host;
+  bool found;
+};
+
+static void netrc_scan_reset(struct netrc_scanner *sc)
+{
+  curlx_safefree(sc->login);
+  curlx_safefree(sc->passwd);
+  sc->matches_host = FALSE;
+}
+
+static void netrc_scan_init(struct netrc_scanner *sc,
+                            struct Curl_easy *data,
+                            const char *content,
+                            const char *hostname,
+                            const char *user)
+{
+  memset(sc, 0, sizeof(*sc));
+  netrc_lexer_init(&sc->lexer, data, content);
+  sc->hostname = hostname;
+  sc->user = (user && user[0]) ? user : NULL;
+  netrc_scan_reset(sc);
+}
+
+static void netrc_scan_cleanup(struct netrc_scanner *sc)
+{
+  netrc_scan_reset(sc);
+  sc->hostname = NULL;
+  sc->user = NULL;
+  Curl_creds_unlink(&sc->creds);
+  netrc_lexer_cleanup(&sc->lexer);
+}
+
+static NETRCcode netrc_scan_literal(struct netrc_scanner *sc,
+                                    char **pdest)
+{
+  NETRCcode rc = netrc_lexer_next(&sc->lexer, TRUE);
+  if(!rc) {
+    if(sc->lexer.token == NETRC_TOK_LITERAL) {
+      if(pdest && sc->matches_host) {
+        curlx_free(*pdest);
+        *pdest = curlx_strdup(curlx_dyn_ptr(&sc->lexer.literal));
+        if(!*pdest)
+          rc = NETRC_OUT_OF_MEMORY;
+      }
+    }
+    else
+      netrc_lexer_push(&sc->lexer);
+  }
+  return rc;
+}
+
+static NETRCcode netrc_scan_end_entry(struct netrc_scanner *sc)
+{
+  NETRCcode rc = NETRC_OK;
+#if NETRC_DEBUG
+  CURL_TRC_M(sc->lexer.data,
+             "[NETRC] entry matches_host=%d, login='%s', passwd='%s'",
+             sc->matches_host, sc->login, sc->passwd);
+#endif
+  if(sc->matches_host) {
+    if(sc->login) {
+      if(sc->user) {
+        if(Curl_timestrcmp(sc->user, sc->login))
+          goto out;
+        /* We look for a specific user,
+         * entry is only interesting with password */
+        sc->found = !!sc->passwd;
+      }
+      else {
+        sc->found = TRUE;
+      }
+    }
+    else if(sc->passwd) {
+      /* found a passwd that applies to any user */
+      sc->found = TRUE;
+    }
+    else {
+      /* entry has nothing interesting */
+    }
+    if(sc->found) {
+#if NETRC_DEBUG
+      CURL_TRC_M(sc->lexer.data, "[NETRC] entry match found");
+#endif
+      if(Curl_creds_create(sc->user ? sc->user : sc->login, sc->passwd,
+                           NULL, NULL, NULL, CREDS_NETRC, &sc->creds))
+        rc = NETRC_OUT_OF_MEMORY;
+    }
+  }
+out:
+  netrc_scan_reset(sc);
+  return rc;
+}
+
+static NETRCcode netrc_scan(struct Curl_easy *data,
+                            const char *content,
+                            const char *hostname,
+                            const char *user,
+                            struct Curl_creds **pcreds)
+{
+  struct netrc_scanner sc;
+  NETRCcode rc = NETRC_OK;
+
+  Curl_creds_unlink(pcreds);
+  netrc_scan_init(&sc, data, content, hostname, user);
+
+  while(!rc && !sc.found) {
+    rc = netrc_lexer_next(&sc.lexer, FALSE);
+    if(!rc) {
+      /* Does this token end any previous entry? */
+      switch(sc.lexer.token) {
+      case NETRC_TOK_EOF:
+      case NETRC_TOK_MACHINE:
+      case NETRC_TOK_DEFAULT:
+      case NETRC_TOK_MACDEF:
+        rc = netrc_scan_end_entry(&sc);
+        if(rc || sc.found)
+          goto out;
+        break;
+      default:
+        break;
+      }
+
+      switch(sc.lexer.token) {
+      case NETRC_TOK_EOF:
+        goto out;
+      case NETRC_TOK_MACHINE:
+        rc = netrc_lexer_next(&sc.lexer, TRUE);
+        if(!rc) {
+          if(sc.lexer.token == NETRC_TOK_LITERAL) {
+            sc.matches_host = curl_strequal(
+              sc.hostname, curlx_dyn_ptr(&sc.lexer.literal));
+          }
+          else {
+            sc.matches_host = FALSE;
+            netrc_lexer_push(&sc.lexer);
+          }
+        }
+        break;
+      case NETRC_TOK_DEFAULT:
+        sc.matches_host = TRUE;
+        break;
+      case NETRC_TOK_ACCOUNT:
+        rc = netrc_scan_literal(&sc, NULL); /* ignore, not used */
+        break;
+      case NETRC_TOK_LOGIN:
+        rc = netrc_scan_literal(&sc, &sc.login);
+        break;
+      case NETRC_TOK_PASSWD:
+        rc = netrc_scan_literal(&sc, &sc.passwd);
+        break;
+      case NETRC_TOK_MACDEF:
+        netrc_skip_to_empty_line(&sc.lexer);
+        break;
+      case NETRC_TOK_LITERAL:
+      case NETRC_TOK_JUNK:
+      default:
+        /* skip this */
+        break;
+      }
+    }
+  }
+
+out:
+  if(!rc) {
+    if(sc.creds)
+      Curl_creds_link(pcreds, sc.creds);
+    else
+      rc = NETRC_NO_MATCH;
+  }
+  netrc_scan_cleanup(&sc);
+  return rc;
+}
+
+static NETRCcode file2memory(const char *filename, struct dynbuf *filebuf)
+{
+  NETRCcode ret = NETRC_FILE_MISSING; /* if it cannot open the file */
+  FILE *file = curlx_fopen(filename, FOPEN_READTEXT);
+
+  curlx_dyn_reset(filebuf);
+  if(file) {
+    curlx_struct_stat stat;
+    if((curlx_fstat(fileno(file), &stat) == -1) || !S_ISDIR(stat.st_mode)) {
+      CURLcode result = CURLE_OK;
+      bool eof;
+      struct dynbuf linebuf;
+      curlx_dyn_init(&linebuf, MAX_NETRC_LINE);
+      ret = NETRC_OK;
+      do {
+        const char *line;
+        /* Curl_get_line always returns lines ending with a newline */
+        result = Curl_get_line(&linebuf, file, &eof);
+        if(!result) {
+          line = curlx_dyn_ptr(&linebuf);
+          /* skip comments on load */
+          curlx_str_passblanks(&line);
+          if(*line == '#')
+            continue;
+          result = curlx_dyn_add(filebuf, line);
+        }
+        if(result) {
+          curlx_dyn_free(filebuf);
+          ret = curl2netrc(result);
+          break;
+        }
+      } while(!eof);
+      curlx_dyn_free(&linebuf);
+    }
+    curlx_fclose(file);
+  }
+  return ret;
+}
+
+static NETRCcode netrc_scan_file(struct Curl_easy *data,
+                                 struct store_netrc *store,
+                                 const char *hostname,
+                                 const char *user,
+                                 const char *netrcfile,
+                                 struct Curl_creds **pcreds)
+{
+  struct dynbuf *filebuf = &store->filebuf;
+
+  if(!store->loaded || strcmp(netrcfile, store->filename)) {
+    NETRCcode ret;
+    store->loaded = FALSE;
+    ret = file2memory(netrcfile, filebuf);
+    if(ret) {
+      CURL_TRC_M(data, "[NETRC] could not load '%s'", netrcfile);
+      return ret;
+    }
+    curlx_free(store->filename);
+    store->filename = curlx_strdup(netrcfile);
+    if(!store->filename) {
+      curlx_dyn_reset(&store->filebuf);
+      return NETRC_OUT_OF_MEMORY;
+    }
+    store->loaded = TRUE;
+  }
+
+  return netrc_scan(data, curlx_dyn_ptr(filebuf), hostname, user, pcreds);
 }
 
 /*
  * @unittest: 1304
  *
- * *loginp and *passwordp MUST be allocated if they aren't NULL when passed
+ * *loginp and *passwordp MUST be allocated if they are not NULL when passed
  * in.
  */
-int Curl_parsenetrc(const char *host, char **loginp, char **passwordp,
-                    char *netrcfile)
+NETRCcode Curl_netrc_scan(struct Curl_easy *data,
+                          struct store_netrc *store,
+                          const char *hostname,
+                          const char *user,
+                          const char *netrcfile,
+                          struct Curl_creds **pcreds)
 {
-  int retcode = 1;
-  char *filealloc = NULL;
+  NETRCcode retcode = NETRC_OK;
 
+  CURL_TRC_M(data, "[NETRC] scanning '%s' for host '%s' user '%s'",
+             netrcfile, hostname, user);
+  Curl_creds_unlink(pcreds);
   if(!netrcfile) {
+    char *home = NULL;
+    char *homea = NULL;
+    char *filealloc = NULL;
 #if defined(HAVE_GETPWUID_R) && defined(HAVE_GETEUID)
     char pwbuf[1024];
 #endif
-    char *home = NULL;
-    char *homea = curl_getenv("HOME"); /* portable environment reader */
-    if(homea) {
-      home = homea;
-#if defined(HAVE_GETPWUID_R) && defined(HAVE_GETEUID)
-    }
-    else {
-      struct passwd pw, *pw_res;
-      if(!getpwuid_r(geteuid(), &pw, pwbuf, sizeof(pwbuf), &pw_res)
-         && pw_res) {
-        home = pw.pw_dir;
-      }
-#elif defined(HAVE_GETPWUID) && defined(HAVE_GETEUID)
-    }
-    else {
-      struct passwd *pw;
-      pw = getpwuid(geteuid());
-      if(pw) {
-        home = pw->pw_dir;
-      }
-#elif defined(_WIN32)
-    }
-    else {
-      homea = curl_getenv("USERPROFILE");
+    filealloc = curl_getenv("NETRC");
+    if(!filealloc) {
+      homea = curl_getenv("HOME"); /* portable environment reader */
       if(homea) {
         home = homea;
+#if defined(HAVE_GETPWUID_R) && defined(HAVE_GETEUID)
       }
+      else {
+        struct passwd pw, *pw_res;
+        if(!getpwuid_r(geteuid(), &pw, pwbuf, sizeof(pwbuf), &pw_res) &&
+           pw_res) {
+          home = pw.pw_dir;
+        }
+#elif defined(HAVE_GETPWUID) && defined(HAVE_GETEUID)
+      }
+      else {
+        struct passwd *pw;
+        pw = getpwuid(geteuid());
+        if(pw) {
+          home = pw->pw_dir;
+        }
+#elif defined(_WIN32)
+      }
+      else {
+        homea = curl_getenv("USERPROFILE");
+        if(homea) {
+          home = homea;
+        }
 #endif
-    }
+      }
 
-    if(!home)
-      return retcode; /* no home directory found (or possibly out of
-                         memory) */
+      if(!home)
+        return NETRC_FILE_MISSING; /* no home directory found (or possibly out
+                                      of memory) */
 
-    filealloc = curl_maprintf("%s%s.netrc", home, DIR_CHAR);
-    if(!filealloc) {
-      free(homea);
-      return -1;
+      filealloc = curl_maprintf("%s%s.netrc", home, DIR_CHAR);
+      if(!filealloc) {
+        curlx_free(homea);
+        retcode = NETRC_OUT_OF_MEMORY;
+        goto out;
+      }
     }
-    retcode = parsenetrc(host, loginp, passwordp, filealloc);
-    free(filealloc);
-#ifdef WIN32
+    retcode = netrc_scan_file(
+      data, store, hostname, user, filealloc, pcreds);
+    curlx_free(filealloc);
+#ifdef _WIN32
     if(retcode == NETRC_FILE_MISSING) {
       /* fallback to the old-style "_netrc" file */
       filealloc = curl_maprintf("%s%s_netrc", home, DIR_CHAR);
       if(!filealloc) {
-        free(homea);
-        return -1;
+        curlx_free(homea);
+        return NETRC_OUT_OF_MEMORY;
       }
-      retcode = parsenetrc(host, loginp, passwordp, filealloc);
-      free(filealloc);
+      retcode = netrc_scan_file(
+        data, store, hostname, user, filealloc, pcreds);
+      curlx_free(filealloc);
     }
 #endif
-    free(homea);
+    curlx_free(homea);
   }
   else
-    retcode = parsenetrc(host, loginp, passwordp, netrcfile);
+    retcode = netrc_scan_file(
+      data, store, hostname, user, netrcfile, pcreds);
+
+out:
+  if(retcode)
+    Curl_creds_unlink(pcreds);
   return retcode;
 }
 
-#endif
+void Curl_netrc_init(struct store_netrc *store)
+{
+  curlx_dyn_init(&store->filebuf, MAX_NETRC_FILE);
+  store->loaded = FALSE;
+  store->filename = NULL;
+}
+void Curl_netrc_cleanup(struct store_netrc *store)
+{
+  curlx_dyn_free(&store->filebuf);
+  curlx_safefree(store->filename);
+  store->loaded = FALSE;
+}
+
+const char *Curl_netrc_strerror(NETRCcode ret)
+{
+  switch(ret) {
+  default:
+    return ""; /* not a legit error */
+  case NETRC_FILE_MISSING:
+    return "no such file";
+  case NETRC_NO_MATCH:
+    return "no matching entry";
+  case NETRC_OUT_OF_MEMORY:
+    return "out of memory";
+  case NETRC_SYNTAX_ERROR:
+    return "syntax error";
+  }
+  /* never reached */
+}
+
+#endif /* !CURL_DISABLE_NETRC */
diff --git a/third-party/curl/lib/netrc.h b/third-party/curl/lib/netrc.h
index 9f2815f3bb..6be9b83316 100644
--- a/third-party/curl/lib/netrc.h
+++ b/third-party/curl/lib/netrc.h
@@ -23,21 +23,46 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+
 #ifndef CURL_DISABLE_NETRC
 
-/* returns -1 on failure, 0 if the host is found, 1 is the host isn't found */
-int Curl_parsenetrc(const char *host, char **loginp,
-                    char **passwordp, char *filename);
-  /* Assume: (*passwordp)[0]=0, host[0] != 0.
-   * If (*loginp)[0] = 0, search for login and password within a machine
-   * section in the netrc.
-   * If (*loginp)[0] != 0, search for password within machine and login.
-   */
+#include "curlx/dynbuf.h"
+
+struct Curl_easy;
+struct Curl_creds;
+
+struct store_netrc {
+  struct dynbuf filebuf;
+  char *filename;
+  BIT(loaded);
+};
+
+typedef enum {
+  NETRC_OK,
+  NETRC_NO_MATCH,      /* no matching entry in the file */
+  NETRC_SYNTAX_ERROR,  /* in the netrc file */
+  NETRC_FILE_MISSING,  /* the netrc file does not exist */
+  NETRC_OUT_OF_MEMORY, /* while parsing netrc */
+  NETRC_LAST /* never used */
+} NETRCcode;
+
+const char *Curl_netrc_strerror(NETRCcode ret);
+void Curl_netrc_init(struct store_netrc *store);
+void Curl_netrc_cleanup(struct store_netrc *store);
+
+/* Scan a netrc file for credentials matching hostname
+ * and optional user. */
+NETRCcode Curl_netrc_scan(struct Curl_easy *data,
+                          struct store_netrc *store,
+                          const char *hostname,
+                          const char *user,
+                          const char *netrcfile,
+                          struct Curl_creds **pcreds);
 #else
 /* disabled */
-#define Curl_parsenetrc(a,b,c,d,e,f) 1
+#define Curl_netrc_init(x)
+#define Curl_netrc_cleanup(x)
 #endif
 
 #endif /* HEADER_CURL_NETRC_H */
diff --git a/third-party/curl/lib/noproxy.c b/third-party/curl/lib/noproxy.c
deleted file mode 100644
index 2b9908d894..0000000000
--- a/third-party/curl/lib/noproxy.c
+++ /dev/null
@@ -1,266 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#ifndef CURL_DISABLE_PROXY
-
-#include "inet_pton.h"
-#include "strcase.h"
-#include "noproxy.h"
-
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-
-/*
- * Curl_cidr4_match() returns TRUE if the given IPv4 address is within the
- * specified CIDR address range.
- */
-UNITTEST bool Curl_cidr4_match(const char *ipv4,    /* 1.2.3.4 address */
-                               const char *network, /* 1.2.3.4 address */
-                               unsigned int bits)
-{
-  unsigned int address = 0;
-  unsigned int check = 0;
-
-  if(bits > 32)
-    /* strange input */
-    return FALSE;
-
-  if(1 != Curl_inet_pton(AF_INET, ipv4, &address))
-    return FALSE;
-  if(1 != Curl_inet_pton(AF_INET, network, &check))
-    return FALSE;
-
-  if(bits && (bits != 32)) {
-    unsigned int mask = 0xffffffff << (32 - bits);
-    unsigned int haddr = htonl(address);
-    unsigned int hcheck = htonl(check);
-#if 0
-    fprintf(stderr, "Host %s (%x) network %s (%x) bits %u mask %x => %x\n",
-            ipv4, haddr, network, hcheck, bits, mask,
-            (haddr ^ hcheck) & mask);
-#endif
-    if((haddr ^ hcheck) & mask)
-      return FALSE;
-    return TRUE;
-  }
-  return (address == check);
-}
-
-UNITTEST bool Curl_cidr6_match(const char *ipv6,
-                               const char *network,
-                               unsigned int bits)
-{
-#ifdef ENABLE_IPV6
-  int bytes;
-  int rest;
-  unsigned char address[16];
-  unsigned char check[16];
-
-  if(!bits)
-    bits = 128;
-
-  bytes = bits/8;
-  rest = bits & 0x07;
-  if(1 != Curl_inet_pton(AF_INET6, ipv6, address))
-    return FALSE;
-  if(1 != Curl_inet_pton(AF_INET6, network, check))
-    return FALSE;
-  if((bytes > 16) || ((bytes == 16) && rest))
-    return FALSE;
-  if(bytes && memcmp(address, check, bytes))
-    return FALSE;
-  if(rest && !((address[bytes] ^ check[bytes]) & (0xff << (8 - rest))))
-    return FALSE;
-
-  return TRUE;
-#else
-  (void)ipv6;
-  (void)network;
-  (void)bits;
-  return FALSE;
-#endif
-}
-
-enum nametype {
-  TYPE_HOST,
-  TYPE_IPV4,
-  TYPE_IPV6
-};
-
-/****************************************************************
-* Checks if the host is in the noproxy list. returns TRUE if it matches and
-* therefore the proxy should NOT be used.
-****************************************************************/
-bool Curl_check_noproxy(const char *name, const char *no_proxy,
-                        bool *spacesep)
-{
-  char hostip[128];
-  *spacesep = FALSE;
-  /*
-   * If we don't have a hostname at all, like for example with a FILE
-   * transfer, we have nothing to interrogate the noproxy list with.
-   */
-  if(!name || name[0] == '\0')
-    return FALSE;
-
-  /* no_proxy=domain1.dom,host.domain2.dom
-   *   (a comma-separated list of hosts which should
-   *   not be proxied, or an asterisk to override
-   *   all proxy variables)
-   */
-  if(no_proxy && no_proxy[0]) {
-    const char *p = no_proxy;
-    size_t namelen;
-    enum nametype type = TYPE_HOST;
-    if(!strcmp("*", no_proxy))
-      return TRUE;
-
-    /* NO_PROXY was specified and it wasn't just an asterisk */
-
-    if(name[0] == '[') {
-      char *endptr;
-      /* IPv6 numerical address */
-      endptr = strchr(name, ']');
-      if(!endptr)
-        return FALSE;
-      name++;
-      namelen = endptr - name;
-      if(namelen >= sizeof(hostip))
-        return FALSE;
-      memcpy(hostip, name, namelen);
-      hostip[namelen] = 0;
-      name = hostip;
-      type = TYPE_IPV6;
-    }
-    else {
-      unsigned int address;
-      namelen = strlen(name);
-      if(1 == Curl_inet_pton(AF_INET, name, &address))
-        type = TYPE_IPV4;
-      else {
-        /* ignore trailing dots in the host name */
-        if(name[namelen - 1] == '.')
-          namelen--;
-      }
-    }
-
-    while(*p) {
-      const char *token;
-      size_t tokenlen = 0;
-      bool match = FALSE;
-
-      /* pass blanks */
-      while(*p && ISBLANK(*p))
-        p++;
-
-      token = p;
-      /* pass over the pattern */
-      while(*p && !ISBLANK(*p) && (*p != ',')) {
-        p++;
-        tokenlen++;
-      }
-
-      if(tokenlen) {
-        switch(type) {
-        case TYPE_HOST:
-          /* ignore trailing dots in the token to check */
-          if(token[tokenlen - 1] == '.')
-            tokenlen--;
-
-          if(tokenlen && (*token == '.')) {
-            /* ignore leading token dot as well */
-            token++;
-            tokenlen--;
-          }
-          /* A: example.com matches 'example.com'
-             B: www.example.com matches 'example.com'
-             C: nonexample.com DOES NOT match 'example.com'
-          */
-          if(tokenlen == namelen)
-            /* case A, exact match */
-            match = strncasecompare(token, name, namelen);
-          else if(tokenlen < namelen) {
-            /* case B, tailmatch domain */
-            match = (name[namelen - tokenlen - 1] == '.') &&
-              strncasecompare(token, name + (namelen - tokenlen),
-                              tokenlen);
-          }
-          /* case C passes through, not a match */
-          break;
-        case TYPE_IPV4:
-          /* FALLTHROUGH */
-        case TYPE_IPV6: {
-          const char *check = token;
-          char *slash;
-          unsigned int bits = 0;
-          char checkip[128];
-          if(tokenlen >= sizeof(checkip))
-            /* this cannot match */
-            break;
-          /* copy the check name to a temp buffer */
-          memcpy(checkip, check, tokenlen);
-          checkip[tokenlen] = 0;
-          check = checkip;
-
-          slash = strchr(check, '/');
-          /* if the slash is part of this token, use it */
-          if(slash) {
-            bits = atoi(slash + 1);
-            *slash = 0; /* null terminate there */
-          }
-          if(type == TYPE_IPV6)
-            match = Curl_cidr6_match(name, check, bits);
-          else
-            match = Curl_cidr4_match(name, check, bits);
-          break;
-        }
-        }
-        if(match)
-          return TRUE;
-      } /* if(tokenlen) */
-      /* pass blanks after pattern */
-      while(ISBLANK(*p))
-        p++;
-      /* if not a comma! */
-      if(*p && (*p != ',')) {
-        *spacesep = TRUE;
-        continue;
-      }
-      /* pass any number of commas */
-      while(*p == ',')
-        p++;
-    } /* while(*p) */
-  } /* NO_PROXY was specified and it wasn't just an asterisk */
-
-  return FALSE;
-}
-
-#endif /* CURL_DISABLE_PROXY */
diff --git a/third-party/curl/lib/noproxy.h b/third-party/curl/lib/noproxy.h
deleted file mode 100644
index a3a6807722..0000000000
--- a/third-party/curl/lib/noproxy.h
+++ /dev/null
@@ -1,45 +0,0 @@
-#ifndef HEADER_CURL_NOPROXY_H
-#define HEADER_CURL_NOPROXY_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "curl_setup.h"
-
-#ifndef CURL_DISABLE_PROXY
-
-#ifdef DEBUGBUILD
-
-UNITTEST bool Curl_cidr4_match(const char *ipv4,    /* 1.2.3.4 address */
-                               const char *network, /* 1.2.3.4 address */
-                               unsigned int bits);
-UNITTEST bool Curl_cidr6_match(const char *ipv6,
-                               const char *network,
-                               unsigned int bits);
-#endif
-
-bool Curl_check_noproxy(const char *name, const char *no_proxy,
-                        bool *spacesep);
-
-#endif
-
-#endif /* HEADER_CURL_NOPROXY_H */
diff --git a/third-party/curl/lib/openldap.c b/third-party/curl/lib/openldap.c
index 41fecf9143..8ec6bb27cd 100644
--- a/third-party/curl/lib/openldap.c
+++ b/third-party/curl/lib/openldap.c
@@ -22,7 +22,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if !defined(CURL_DISABLE_LDAP) && defined(USE_OPENLDAP)
@@ -41,20 +40,18 @@
 #include <ldap.h>
 
 #include "urldata.h"
-#include <curl/curl.h>
+#include "url.h"
 #include "sendf.h"
+#include "curl_trc.h"
 #include "vtls/vtls.h"
 #include "transfer.h"
 #include "curl_ldap.h"
-#include "curl_base64.h"
+#include "curlx/base64.h"
 #include "cfilters.h"
 #include "connect.h"
 #include "curl_sasl.h"
 #include "strcase.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "bufref.h"
 
 /*
  * Uncommenting this will enable the built-in debug logging of the openldap
@@ -94,94 +91,8 @@ extern int ldap_init_fd(ber_socket_t fd, int proto, const char *url,
                         LDAP **ld);
 #endif
 
-static CURLcode oldap_setup_connection(struct Curl_easy *data,
-                                       struct connectdata *conn);
-static CURLcode oldap_do(struct Curl_easy *data, bool *done);
-static CURLcode oldap_done(struct Curl_easy *data, CURLcode, bool);
-static CURLcode oldap_connect(struct Curl_easy *data, bool *done);
-static CURLcode oldap_connecting(struct Curl_easy *data, bool *done);
-static CURLcode oldap_disconnect(struct Curl_easy *data,
-                                 struct connectdata *conn, bool dead);
-
-static CURLcode oldap_perform_auth(struct Curl_easy *data, const char *mech,
-                                   const struct bufref *initresp);
-static CURLcode oldap_continue_auth(struct Curl_easy *data, const char *mech,
-                                    const struct bufref *resp);
-static CURLcode oldap_cancel_auth(struct Curl_easy *data, const char *mech);
-static CURLcode oldap_get_message(struct Curl_easy *data, struct bufref *out);
-
 static Curl_recv oldap_recv;
 
-/*
- * LDAP protocol handler.
- */
-
-const struct Curl_handler Curl_handler_ldap = {
-  "LDAP",                               /* scheme */
-  oldap_setup_connection,               /* setup_connection */
-  oldap_do,                             /* do_it */
-  oldap_done,                           /* done */
-  ZERO_NULL,                            /* do_more */
-  oldap_connect,                        /* connect_it */
-  oldap_connecting,                     /* connecting */
-  ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  oldap_disconnect,                     /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_LDAP,                            /* defport */
-  CURLPROTO_LDAP,                       /* protocol */
-  CURLPROTO_LDAP,                       /* family */
-  PROTOPT_NONE                          /* flags */
-};
-
-#ifdef USE_SSL
-/*
- * LDAPS protocol handler.
- */
-
-const struct Curl_handler Curl_handler_ldaps = {
-  "LDAPS",                              /* scheme */
-  oldap_setup_connection,               /* setup_connection */
-  oldap_do,                             /* do_it */
-  oldap_done,                           /* done */
-  ZERO_NULL,                            /* do_more */
-  oldap_connect,                        /* connect_it */
-  oldap_connecting,                     /* connecting */
-  ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  oldap_disconnect,                     /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_LDAPS,                           /* defport */
-  CURLPROTO_LDAPS,                      /* protocol */
-  CURLPROTO_LDAP,                       /* family */
-  PROTOPT_SSL                           /* flags */
-};
-#endif
-
-/* SASL parameters for the ldap protocol */
-static const struct SASLproto saslldap = {
-  "ldap",                     /* The service name */
-  oldap_perform_auth,         /* Send authentication command */
-  oldap_continue_auth,        /* Send authentication continuation */
-  oldap_cancel_auth,          /* Send authentication cancellation */
-  oldap_get_message,          /* Get SASL response message */
-  0,                          /* Maximum initial response length (no max) */
-  LDAP_SASL_BIND_IN_PROGRESS, /* Code received when continuation is expected */
-  LDAP_SUCCESS,               /* Code to receive upon authentication success */
-  SASL_AUTH_NONE,             /* Default mechanisms */
-  0                           /* Configuration flags */
-};
-
 struct ldapconninfo {
   struct SASL sasl;          /* SASL-related parameters */
   LDAP *ld;                  /* Openldap connection handle. */
@@ -198,16 +109,20 @@ struct ldapreqinfo {
   int nument;
 };
 
+/* meta key for storing ldapconninfo at easy handle */
+#define CURL_META_LDAP_EASY   "meta:proto:ldap:easy"
+/* meta key for storing ldapconninfo at connection */
+#define CURL_META_LDAP_CONN   "meta:proto:ldap:conn"
+
 /*
- * state()
+ * oldap_state()
  *
  * This is the ONLY way to change LDAP state!
  */
-static void state(struct Curl_easy *data, ldapstate newstate)
+static void oldap_state(struct Curl_easy *data, struct ldapconninfo *li,
+                        ldapstate newstate)
 {
-  struct ldapconninfo *ldapc = data->conn->proto.ldapc;
-
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
   /* for debug purposes */
   static const char * const names[] = {
     "STOP",
@@ -221,12 +136,13 @@ static void state(struct Curl_easy *data, ldapstate newstate)
     /* LAST */
   };
 
-  if(ldapc->state != newstate)
+  if(li->state != newstate)
     infof(data, "LDAP %p state change from %s to %s",
-          (void *)ldapc, names[ldapc->state], names[newstate]);
+          (void *)li, names[li->state], names[newstate]);
+#else
+  (void)data;
 #endif
-
-  ldapc->state = newstate;
+  li->state = newstate;
 }
 
 /* Map some particular LDAP error codes to CURLcode values. */
@@ -234,17 +150,13 @@ static CURLcode oldap_map_error(int rc, CURLcode result)
 {
   switch(rc) {
   case LDAP_NO_MEMORY:
-    result = CURLE_OUT_OF_MEMORY;
-    break;
+    return CURLE_OUT_OF_MEMORY;
   case LDAP_INVALID_CREDENTIALS:
-    result = CURLE_LOGIN_DENIED;
-    break;
+    return CURLE_LOGIN_DENIED;
   case LDAP_PROTOCOL_ERROR:
-    result = CURLE_UNSUPPORTED_PROTOCOL;
-    break;
+    return CURLE_UNSUPPORTED_PROTOCOL;
   case LDAP_INSUFFICIENT_ACCESS:
-    result = CURLE_REMOTE_ACCESS_DENIED;
-    break;
+    return CURLE_REMOTE_ACCESS_DENIED;
   }
   return result;
 }
@@ -270,13 +182,14 @@ static CURLcode oldap_url_parse(struct Curl_easy *data, LDAPURLDesc **ludp)
   *ludp = NULL;
   if(!data->state.up.user && !data->state.up.password &&
      !data->state.up.options)
-    rc = ldap_url_parse(data->state.url, ludp);
+    rc = ldap_url_parse(Curl_bufref_ptr(&data->state.url), ludp);
   if(rc != LDAP_URL_SUCCESS) {
     const char *msg = "url parsing problem";
 
-    result = rc == LDAP_URL_ERR_MEM? CURLE_OUT_OF_MEMORY: CURLE_URL_MALFORMAT;
+    result = rc == LDAP_URL_ERR_MEM ? CURLE_OUT_OF_MEMORY :
+      CURLE_URL_MALFORMAT;
     rc -= LDAP_URL_SUCCESS;
-    if((size_t) rc < sizeof(url_errs) / sizeof(url_errs[0]))
+    if((size_t)rc < CURL_ARRAYSIZE(url_errs))
       msg = url_errs[rc];
     failf(data, "LDAP local: %s", msg);
   }
@@ -287,9 +200,13 @@ static CURLcode oldap_url_parse(struct Curl_easy *data, LDAPURLDesc **ludp)
 static CURLcode oldap_parse_login_options(struct connectdata *conn)
 {
   CURLcode result = CURLE_OK;
-  struct ldapconninfo *li = conn->proto.ldapc;
+  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
   const char *ptr = conn->options;
 
+  DEBUGASSERT(li);
+  if(!li)
+    return CURLE_FAILED_INIT;
+
   while(!result && ptr && *ptr) {
     const char *key = ptr;
     const char *value;
@@ -311,7 +228,7 @@ static CURLcode oldap_parse_login_options(struct connectdata *conn)
       ptr++;
   }
 
-  return result == CURLE_URL_MALFORMAT? CURLE_SETOPT_OPTION_SYNTAX: result;
+  return result == CURLE_URL_MALFORMAT ? CURLE_SETOPT_OPTION_SYNTAX : result;
 }
 
 static CURLcode oldap_setup_connection(struct Curl_easy *data,
@@ -319,31 +236,12 @@ static CURLcode oldap_setup_connection(struct Curl_easy *data,
 {
   CURLcode result;
   LDAPURLDesc *lud;
-  struct ldapconninfo *li;
+  (void)conn;
 
   /* Early URL syntax check. */
   result = oldap_url_parse(data, &lud);
   ldap_free_urldesc(lud);
 
-  if(!result) {
-    li = calloc(1, sizeof(struct ldapconninfo));
-    if(!li)
-      result = CURLE_OUT_OF_MEMORY;
-    else {
-      li->proto = ldap_pvt_url_scheme2proto(data->state.up.scheme);
-      conn->proto.ldapc = li;
-      connkeep(conn, "OpenLDAP default");
-
-      /* Initialize the SASL storage */
-      Curl_sasl_init(&li->sasl, data, &saslldap);
-
-      /* Clear the TLS upgraded flag */
-      conn->bits.tls_upgraded = FALSE;
-
-      result = oldap_parse_login_options(conn);
-    }
-  }
-
   return result;
 }
 
@@ -352,7 +250,12 @@ static CURLcode oldap_setup_connection(struct Curl_easy *data,
  */
 static CURLcode oldap_get_message(struct Curl_easy *data, struct bufref *out)
 {
-  struct berval *servercred = data->conn->proto.ldapc->servercred;
+  struct ldapconninfo *li =
+    Curl_conn_meta_get(data->conn, CURL_META_LDAP_CONN);
+  struct berval *servercred = li ? li->servercred : NULL;
+  DEBUGASSERT(li);
+  if(!li)
+    return CURLE_FAILED_INIT;
 
   if(!servercred || !servercred->bv_val)
     return CURLE_WEIRD_SERVER_REPLY;
@@ -367,20 +270,22 @@ static CURLcode oldap_perform_auth(struct Curl_easy *data, const char *mech,
                                    const struct bufref *initresp)
 {
   struct connectdata *conn = data->conn;
-  struct ldapconninfo *li = conn->proto.ldapc;
-  CURLcode result = CURLE_OK;
+  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
   struct berval cred;
   struct berval *pcred = &cred;
   int rc;
 
-  cred.bv_val = (char *) Curl_bufref_ptr(initresp);
+  DEBUGASSERT(li);
+  if(!li)
+    return CURLE_FAILED_INIT;
+  cred.bv_val = (char *)CURL_UNCONST(Curl_bufref_ptr(initresp));
   cred.bv_len = Curl_bufref_len(initresp);
   if(!cred.bv_val)
     pcred = NULL;
   rc = ldap_sasl_bind(li->ld, NULL, mech, pcred, NULL, NULL, &li->msgid);
   if(rc != LDAP_SUCCESS)
-    result = oldap_map_error(rc, CURLE_LDAP_CANNOT_BIND);
-  return result;
+    return oldap_map_error(rc, CURLE_LDAP_CANNOT_BIND);
+  return CURLE_OK;
 }
 
 /*
@@ -390,20 +295,21 @@ static CURLcode oldap_continue_auth(struct Curl_easy *data, const char *mech,
                                     const struct bufref *resp)
 {
   struct connectdata *conn = data->conn;
-  struct ldapconninfo *li = conn->proto.ldapc;
-  CURLcode result = CURLE_OK;
+  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
   struct berval cred;
   struct berval *pcred = &cred;
   int rc;
 
-  cred.bv_val = (char *) Curl_bufref_ptr(resp);
+  if(!li)
+    return CURLE_FAILED_INIT;
+  cred.bv_val = (char *)CURL_UNCONST(Curl_bufref_ptr(resp));
   cred.bv_len = Curl_bufref_len(resp);
   if(!cred.bv_val)
     pcred = NULL;
   rc = ldap_sasl_bind(li->ld, NULL, mech, pcred, NULL, NULL, &li->msgid);
   if(rc != LDAP_SUCCESS)
-    result = oldap_map_error(rc, CURLE_LDAP_CANNOT_BIND);
-  return result;
+    return oldap_map_error(rc, CURLE_LDAP_CANNOT_BIND);
+  return CURLE_OK;
 }
 
 /*
@@ -411,109 +317,214 @@ static CURLcode oldap_continue_auth(struct Curl_easy *data, const char *mech,
  */
 static CURLcode oldap_cancel_auth(struct Curl_easy *data, const char *mech)
 {
-  struct ldapconninfo *li = data->conn->proto.ldapc;
-  CURLcode result = CURLE_OK;
-  int rc = ldap_sasl_bind(li->ld, NULL, LDAP_SASL_NULL, NULL, NULL, NULL,
-                          &li->msgid);
+  struct ldapconninfo *li =
+    Curl_conn_meta_get(data->conn, CURL_META_LDAP_CONN);
+  int rc;
 
   (void)mech;
+  if(!li)
+    return CURLE_FAILED_INIT;
+  rc = ldap_sasl_bind(li->ld, NULL, LDAP_SASL_NULL, NULL, NULL, NULL,
+                      &li->msgid);
   if(rc != LDAP_SUCCESS)
-    result = oldap_map_error(rc, CURLE_LDAP_CANNOT_BIND);
-  return result;
+    return oldap_map_error(rc, CURLE_LDAP_CANNOT_BIND);
+  return CURLE_OK;
 }
 
 /* Starts LDAP simple bind. */
 static CURLcode oldap_perform_bind(struct Curl_easy *data, ldapstate newstate)
 {
-  CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
-  struct ldapconninfo *li = conn->proto.ldapc;
-  char *binddn = NULL;
+  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
+  const char *binddn = NULL;
   struct berval passwd;
   int rc;
 
+  if(!li)
+    return CURLE_FAILED_INIT;
   passwd.bv_val = NULL;
   passwd.bv_len = 0;
 
-  if(data->state.aptr.user) {
-    binddn = conn->user;
-    passwd.bv_val = conn->passwd;
+  if(conn->creds) {
+    binddn = Curl_creds_user(conn->creds);
+    passwd.bv_val = CURL_UNCONST(Curl_creds_passwd(conn->creds));
     passwd.bv_len = strlen(passwd.bv_val);
   }
 
   rc = ldap_sasl_bind(li->ld, binddn, LDAP_SASL_SIMPLE, &passwd,
                       NULL, NULL, &li->msgid);
-  if(rc == LDAP_SUCCESS)
-    state(data, newstate);
-  else
-    result = oldap_map_error(rc,
-                             data->state.aptr.user?
-                             CURLE_LOGIN_DENIED: CURLE_LDAP_CANNOT_BIND);
-  return result;
+  if(rc != LDAP_SUCCESS)
+    return oldap_map_error(rc,
+                           data->state.creds ?
+                           CURLE_LOGIN_DENIED : CURLE_LDAP_CANNOT_BIND);
+  oldap_state(data, li, newstate);
+  return CURLE_OK;
 }
 
 /* Query the supported SASL authentication mechanisms. */
 static CURLcode oldap_perform_mechs(struct Curl_easy *data)
 {
-  CURLcode result = CURLE_OK;
-  struct ldapconninfo *li = data->conn->proto.ldapc;
+  struct ldapconninfo *li =
+    Curl_conn_meta_get(data->conn, CURL_META_LDAP_CONN);
   int rc;
   static const char * const supportedSASLMechanisms[] = {
     "supportedSASLMechanisms",
     NULL
   };
 
+  if(!li)
+    return CURLE_FAILED_INIT;
+  /* Casting away the const for the 3rd parameter that the LDAP API expects as
+     a non-const char ** is potentially unsafe but we believe the lack of
+     const in the API was an oversight and that no LDAP implementation
+     actually modifies the input. */
   rc = ldap_search_ext(li->ld, "", LDAP_SCOPE_BASE, "(objectclass=*)",
-                       (char **) supportedSASLMechanisms, 0,
+                       (char **)CURL_UNCONST(supportedSASLMechanisms), 0,
                        NULL, NULL, NULL, 0, &li->msgid);
-  if(rc == LDAP_SUCCESS)
-    state(data, OLDAP_MECHS);
-  else
-    result = oldap_map_error(rc, CURLE_LOGIN_DENIED);
-  return result;
+  if(rc != LDAP_SUCCESS)
+    return oldap_map_error(rc, CURLE_LOGIN_DENIED);
+  oldap_state(data, li, OLDAP_MECHS);
+  return CURLE_OK;
 }
 
 /* Starts SASL bind. */
 static CURLcode oldap_perform_sasl(struct Curl_easy *data)
 {
+  struct ldapconninfo *li =
+    Curl_conn_meta_get(data->conn, CURL_META_LDAP_CONN);
   saslprogress progress = SASL_IDLE;
-  struct ldapconninfo *li = data->conn->proto.ldapc;
-  CURLcode result = Curl_sasl_start(&li->sasl, data, TRUE, &progress);
+  CURLcode result;
 
-  state(data, OLDAP_SASL);
+  if(!li)
+    return CURLE_FAILED_INIT;
+  result = Curl_sasl_start(&li->sasl, data, TRUE, &progress);
+
+  oldap_state(data, li, OLDAP_SASL);
   if(!result && progress != SASL_INPROGRESS)
-    result = CURLE_LOGIN_DENIED;
+    result = Curl_sasl_is_blocked(&li->sasl, data);
   return result;
 }
 
 #ifdef USE_SSL
-static Sockbuf_IO ldapsb_tls;
+static int ldapsb_tls_setup(Sockbuf_IO_Desc *sbiod, void *arg)
+{
+  sbiod->sbiod_pvt = arg;
+  return 0;
+}
+
+static int ldapsb_tls_remove(Sockbuf_IO_Desc *sbiod)
+{
+  sbiod->sbiod_pvt = NULL;
+  return 0;
+}
+
+/* We do not need to do anything because libcurl does it already */
+static int ldapsb_tls_close(Sockbuf_IO_Desc *sbiod)
+{
+  (void)sbiod;
+  return 0;
+}
+
+static int ldapsb_tls_ctrl(Sockbuf_IO_Desc *sbiod, int opt, void *arg)
+{
+  (void)arg;
+  if(opt == LBER_SB_OPT_DATA_READY) {
+    struct Curl_easy *data = sbiod->sbiod_pvt;
+    return Curl_conn_data_pending(data, FIRSTSOCKET);
+  }
+  return 0;
+}
+
+static ber_slen_t ldapsb_tls_read(Sockbuf_IO_Desc *sbiod, void *buf,
+                                  ber_len_t len)
+{
+  struct Curl_easy *data = sbiod->sbiod_pvt;
+  ber_slen_t ret = 0;
+  if(data) {
+    struct connectdata *conn = data->conn;
+    if(conn) {
+      struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
+      CURLcode result = CURLE_RECV_ERROR;
+      size_t nread;
+
+      if(!li) {
+        SET_SOCKERRNO(SOCKEINVAL);
+        return -1;
+      }
+      result = (li->recv)(data, FIRSTSOCKET, buf, len, &nread);
+      if(result == CURLE_AGAIN) {
+        SET_SOCKERRNO(SOCKEWOULDBLOCK);
+      }
+      ret = result ? -1 : (ber_slen_t)nread;
+    }
+  }
+  return ret;
+}
+
+static ber_slen_t ldapsb_tls_write(Sockbuf_IO_Desc *sbiod, void *buf,
+                                   ber_len_t len)
+{
+  struct Curl_easy *data = sbiod->sbiod_pvt;
+  ber_slen_t ret = 0;
+  if(data) {
+    struct connectdata *conn = data->conn;
+    if(conn) {
+      struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
+      CURLcode result = CURLE_SEND_ERROR;
+      size_t nwritten;
+
+      if(!li) {
+        SET_SOCKERRNO(SOCKEINVAL);
+        return -1;
+      }
+      result = (li->send)(data, FIRSTSOCKET, buf, len, FALSE, &nwritten);
+      if(result == CURLE_AGAIN) {
+        SET_SOCKERRNO(SOCKEWOULDBLOCK);
+      }
+      ret = result ? -1 : (ber_slen_t)nwritten;
+    }
+  }
+  return ret;
+}
+
+static Sockbuf_IO ldapsb_tls = {
+  ldapsb_tls_setup,
+  ldapsb_tls_remove,
+  ldapsb_tls_ctrl,
+  ldapsb_tls_read,
+  ldapsb_tls_write,
+  ldapsb_tls_close
+};
 
 static bool ssl_installed(struct connectdata *conn)
 {
-  return conn->proto.ldapc->recv != NULL;
+  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
+  return li && li->recv;
 }
 
 static CURLcode oldap_ssl_connect(struct Curl_easy *data, ldapstate newstate)
 {
-  CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
-  struct ldapconninfo *li = conn->proto.ldapc;
-  bool ssldone = 0;
+  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
+  bool ssldone = FALSE;
+  CURLcode result;
 
+  if(!li)
+    return CURLE_FAILED_INIT;
   result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssldone);
-  if(!result) {
-    state(data, newstate);
+  if(result)
+    return result;
+  oldap_state(data, li, newstate);
 
-    if(ssldone) {
-      Sockbuf *sb;
+  if(ssldone) {
+    Sockbuf *sb;
 
-      /* Install the libcurl SSL handlers into the sockbuf. */
-      ldap_get_option(li->ld, LDAP_OPT_SOCKBUF, &sb);
-      ber_sockbuf_add_io(sb, &ldapsb_tls, LBER_SBIOD_LEVEL_TRANSPORT, data);
-      li->recv = conn->recv[FIRSTSOCKET];
-      li->send = conn->send[FIRSTSOCKET];
-    }
+    /* Install the libcurl SSL handlers into the sockbuf. */
+    if((ldap_get_option(li->ld, LDAP_OPT_SOCKBUF, &sb) != LDAP_OPT_SUCCESS) ||
+       ber_sockbuf_add_io(sb, &ldapsb_tls, LBER_SBIOD_LEVEL_TRANSPORT, data))
+      return CURLE_FAILED_INIT;
+    li->recv = conn->recv[FIRSTSOCKET];
+    li->send = conn->send[FIRSTSOCKET];
   }
 
   return result;
@@ -522,51 +533,111 @@ static CURLcode oldap_ssl_connect(struct Curl_easy *data, ldapstate newstate)
 /* Send the STARTTLS request */
 static CURLcode oldap_perform_starttls(struct Curl_easy *data)
 {
-  CURLcode result = CURLE_OK;
-  struct ldapconninfo *li = data->conn->proto.ldapc;
-  int rc = ldap_start_tls(li->ld, NULL, NULL, &li->msgid);
+  struct ldapconninfo *li =
+    Curl_conn_meta_get(data->conn, CURL_META_LDAP_CONN);
+  int rc;
 
-  if(rc == LDAP_SUCCESS)
-    state(data, OLDAP_STARTTLS);
-  else
-    result = oldap_map_error(rc, CURLE_USE_SSL_FAILED);
-  return result;
+  if(!li)
+    return CURLE_FAILED_INIT;
+  rc = ldap_start_tls(li->ld, NULL, NULL, &li->msgid);
+  if(rc != LDAP_SUCCESS)
+    return oldap_map_error(rc, CURLE_USE_SSL_FAILED);
+  oldap_state(data, li, OLDAP_STARTTLS);
+  return CURLE_OK;
 }
 #endif
 
+static void oldap_easy_dtor(void *key, size_t klen, void *entry)
+{
+  struct ldapreqinfo *lr = entry;
+  (void)key;
+  (void)klen;
+  curlx_free(lr);
+}
+
+static void oldap_conn_dtor(void *key, size_t klen, void *entry)
+{
+  struct ldapconninfo *li = entry;
+  (void)key;
+  (void)klen;
+  if(li->ld) {
+    ldap_unbind_ext(li->ld, NULL, NULL);
+    li->ld = NULL;
+  }
+  curlx_free(li);
+}
+
+/* SASL parameters for the ldap protocol */
+static const struct SASLproto saslldap = {
+  "ldap",                     /* The service name */
+  oldap_perform_auth,         /* Send authentication command */
+  oldap_continue_auth,        /* Send authentication continuation */
+  oldap_cancel_auth,          /* Send authentication cancellation */
+  oldap_get_message,          /* Get SASL response message */
+  0,                          /* Maximum initial response length (no max) */
+  LDAP_SASL_BIND_IN_PROGRESS, /* Code received when continuation is expected */
+  LDAP_SUCCESS,               /* Code to receive upon authentication success */
+  SASL_AUTH_NONE,             /* Default mechanisms */
+  0                           /* Configuration flags */
+};
+
 static CURLcode oldap_connect(struct Curl_easy *data, bool *done)
 {
   struct connectdata *conn = data->conn;
-  struct ldapconninfo *li = conn->proto.ldapc;
+  struct ldapconninfo *li;
   static const int version = LDAP_VERSION3;
+  char *hosturl = NULL;
+  CURLcode result;
   int rc;
-  char *hosturl;
 #ifdef CURL_OPENLDAP_DEBUG
   static int do_trace = -1;
 #endif
 
   (void)done;
 
-  hosturl = aprintf("ldap%s://%s:%d",
-                    conn->handler->flags & PROTOPT_SSL? "s": "",
-                    conn->host.name, conn->remote_port);
-  if(!hosturl)
-    return CURLE_OUT_OF_MEMORY;
+  li = curlx_calloc(1, sizeof(struct ldapconninfo));
+  if(!li) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  result = Curl_conn_meta_set(conn, CURL_META_LDAP_CONN, li, oldap_conn_dtor);
+  if(result)
+    goto out;
+
+  li->proto = ldap_pvt_url_scheme2proto(data->state.up.scheme);
+
+  /* Initialize the SASL storage */
+  Curl_sasl_init(&li->sasl, data, &saslldap);
+
+  result = oldap_parse_login_options(conn);
+  if(result)
+    goto out;
+
+  hosturl = curl_maprintf("%s://%s:%d",
+                          conn->scheme->name,
+                          (data->state.up.hostname[0] == '[') ?
+                          data->state.up.hostname : conn->origin->hostname,
+                          conn->origin->port);
+  if(!hosturl) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
 
   rc = ldap_init_fd(conn->sock[FIRSTSOCKET], li->proto, hosturl, &li->ld);
   if(rc) {
     failf(data, "LDAP local: Cannot connect to %s, %s",
           hosturl, ldap_err2string(rc));
-    free(hosturl);
-    return CURLE_COULDNT_CONNECT;
+    result = CURLE_COULDNT_CONNECT;
+    goto out;
   }
 
-  free(hosturl);
-
 #ifdef CURL_OPENLDAP_DEBUG
   if(do_trace < 0) {
     const char *env = getenv("CURL_OPENLDAP_TRACE");
-    do_trace = (env && strtol(env, NULL, 10) > 0);
+    curl_off_t e = 0;
+    if(!curlx_str_number(&env, &e, INT_MAX))
+      do_trace = e > 0;
   }
   if(do_trace)
     ldap_set_option(li->ld, LDAP_OPT_DEBUG_LEVEL, &do_trace);
@@ -578,37 +649,65 @@ static CURLcode oldap_connect(struct Curl_easy *data, bool *done)
   /* Do not chase referrals. */
   ldap_set_option(li->ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF);
 
+  {
+    ber_len_t max = 256 * 1024;
+    Sockbuf *sb;
+    if((ldap_get_option(li->ld, LDAP_OPT_SOCKBUF, &sb) != LDAP_OPT_SUCCESS) ||
+       /* Set the maximum allowed size of an incoming message, which to
+          OpenLDAP means that it will malloc() memory up to this size. If not
+          set, there is no limit and we instead risk a malloc() failure. */
+       !ber_sockbuf_ctrl(sb, LBER_SB_OPT_SET_MAX_INCOMING, &max)) {
+      result = CURLE_FAILED_INIT;
+      goto out;
+    }
+  }
+
 #ifdef USE_SSL
-  if(conn->handler->flags & PROTOPT_SSL)
-    return oldap_ssl_connect(data, OLDAP_SSL);
+  if(Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
+    result = oldap_ssl_connect(data, OLDAP_SSL);
+    goto out;
+  }
 
   if(data->set.use_ssl) {
-    CURLcode result = oldap_perform_starttls(data);
-
+    result = oldap_perform_starttls(data);
     if(!result || data->set.use_ssl != CURLUSESSL_TRY)
-      return result;
+      goto out;
   }
 #endif
 
-  if(li->sasl.prefmech != SASL_AUTH_NONE)
-    return oldap_perform_mechs(data);
+  if(li->sasl.prefmech != SASL_AUTH_NONE) {
+    result = oldap_perform_mechs(data);
+    goto out;
+  }
 
   /* Force bind even if anonymous bind is not needed in protocol version 3
      to detect missing version 3 support. */
-  return oldap_perform_bind(data, OLDAP_BIND);
+  result = oldap_perform_bind(data, OLDAP_BIND);
+
+out:
+  curlx_free(hosturl);
+  return result;
 }
 
 /* Handle the supported SASL mechanisms query response */
 static CURLcode oldap_state_mechs_resp(struct Curl_easy *data,
                                        LDAPMessage *msg, int code)
 {
-  struct connectdata *conn = data->conn;
-  struct ldapconninfo *li = conn->proto.ldapc;
+  struct connectdata *conn;
+  struct ldapconninfo *li;
   int rc;
   BerElement *ber = NULL;
   CURLcode result = CURLE_OK;
   struct berval bv, *bvals;
 
+  if(!data)
+    return CURLE_FAILED_INIT;
+
+  conn = data->conn;
+  li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
+
+  if(!li)
+    return CURLE_FAILED_INIT;
   switch(ldap_msgtype(msg)) {
   case LDAP_RES_SEARCH_ENTRY:
     /* Got a list of supported SASL mechanisms. */
@@ -629,8 +728,9 @@ static CURLcode oldap_state_mechs_resp(struct Curl_easy *data,
       if(bvals) {
         for(i = 0; bvals[i].bv_val; i++) {
           size_t llen;
-          unsigned short mech = Curl_sasl_decode_mech((char *) bvals[i].bv_val,
-                                                      bvals[i].bv_len, &llen);
+          unsigned short mech =
+            Curl_sasl_decode_mech((const char *)bvals[i].bv_val,
+                                  bvals[i].bv_len, &llen);
           if(bvals[i].bv_len == llen)
             li->sasl.authmechs |= mech;
         }
@@ -643,8 +743,8 @@ static CURLcode oldap_state_mechs_resp(struct Curl_easy *data,
   case LDAP_RES_SEARCH_RESULT:
     switch(code) {
     case LDAP_SIZELIMIT_EXCEEDED:
-      infof(data, "Too many authentication mechanisms\n");
-      /* FALLTHROUGH */
+      infof(data, "Too many authentication mechanisms");
+      FALLTHROUGH();
     case LDAP_SUCCESS:
     case LDAP_NO_RESULTS_RETURNED:
       if(Curl_sasl_can_authenticate(&li->sasl, data))
@@ -668,11 +768,13 @@ static CURLcode oldap_state_sasl_resp(struct Curl_easy *data,
                                       LDAPMessage *msg, int code)
 {
   struct connectdata *conn = data->conn;
-  struct ldapconninfo *li = conn->proto.ldapc;
+  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
   CURLcode result = CURLE_OK;
   saslprogress progress;
   int rc;
 
+  if(!li)
+    return CURLE_FAILED_INIT;
   li->servercred = NULL;
   rc = ldap_parse_sasl_bind_result(li->ld, msg, &li->servercred, 0);
   if(rc != LDAP_SUCCESS) {
@@ -682,7 +784,7 @@ static CURLcode oldap_state_sasl_resp(struct Curl_easy *data,
   else {
     result = Curl_sasl_continue(&li->sasl, data, code, &progress);
     if(!result && progress != SASL_INPROGRESS)
-      state(data, OLDAP_STOP);
+      oldap_state(data, li, OLDAP_STOP);
   }
 
   if(li->servercred)
@@ -695,11 +797,14 @@ static CURLcode oldap_state_bind_resp(struct Curl_easy *data, LDAPMessage *msg,
                                       int code)
 {
   struct connectdata *conn = data->conn;
-  struct ldapconninfo *li = conn->proto.ldapc;
+  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
   CURLcode result = CURLE_OK;
   struct berval *bv = NULL;
   int rc;
 
+  if(!li)
+    return CURLE_FAILED_INIT;
+
   if(code != LDAP_SUCCESS)
     return oldap_map_error(code, CURLE_LDAP_CANNOT_BIND);
 
@@ -710,7 +815,7 @@ static CURLcode oldap_state_bind_resp(struct Curl_easy *data, LDAPMessage *msg,
     result = oldap_map_error(rc, CURLE_LDAP_CANNOT_BIND);
   }
   else
-    state(data, OLDAP_STOP);
+    oldap_state(data, li, OLDAP_STOP);
 
   if(bv)
     ber_bvfree(bv);
@@ -721,12 +826,15 @@ static CURLcode oldap_connecting(struct Curl_easy *data, bool *done)
 {
   CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
-  struct ldapconninfo *li = conn->proto.ldapc;
+  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
   LDAPMessage *msg = NULL;
-  struct timeval tv = {0, 0};
+  struct timeval tv = { 0, 0 };
   int code = LDAP_SUCCESS;
   int rc;
 
+  if(!li)
+    return CURLE_FAILED_INIT;
+
   if(li->state != OLDAP_SSL && li->state != OLDAP_TLS) {
     /* Get response to last command. */
     rc = ldap_result(li->ld, li->msgid, LDAP_MSG_ONE, &tv, &msg);
@@ -792,19 +900,23 @@ static CURLcode oldap_connecting(struct Curl_easy *data, bool *done)
         result = oldap_perform_bind(data, OLDAP_BIND);
       break;
     }
-    /* FALLTHROUGH */
+    result = Curl_ssl_cfilter_add(
+      data, Curl_conn_get_origin(conn, FIRSTSOCKET), conn, FIRSTSOCKET);
+    if(result)
+      break;
+    FALLTHROUGH();
   case OLDAP_TLS:
     result = oldap_ssl_connect(data, OLDAP_TLS);
-    if(result && data->set.use_ssl != CURLUSESSL_TRY)
+    if(result)
       result = oldap_map_error(code, CURLE_USE_SSL_FAILED);
     else if(ssl_installed(conn)) {
-      conn->bits.tls_upgraded = TRUE;
       if(li->sasl.prefmech != SASL_AUTH_NONE)
         result = oldap_perform_mechs(data);
-      else if(data->state.aptr.user)
+      else if(data->state.creds)
         result = oldap_perform_bind(data, OLDAP_BIND);
       else {
-        state(data, OLDAP_STOP); /* Version 3 supported: no bind required */
+        /* Version 3 supported: no bind required */
+        oldap_state(data, li, OLDAP_STOP);
         result = CURLE_OK;
       }
     }
@@ -844,27 +956,23 @@ static CURLcode oldap_disconnect(struct Curl_easy *data,
                                  struct connectdata *conn,
                                  bool dead_connection)
 {
-  struct ldapconninfo *li = conn->proto.ldapc;
-  (void) dead_connection;
+  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
+  (void)dead_connection;
 #ifndef USE_SSL
   (void)data;
 #endif
 
-  if(li) {
-    if(li->ld) {
+  if(li && li->ld) {
 #ifdef USE_SSL
-      if(ssl_installed(conn)) {
-        Sockbuf *sb;
-        ldap_get_option(li->ld, LDAP_OPT_SOCKBUF, &sb);
-        ber_sockbuf_add_io(sb, &ldapsb_tls, LBER_SBIOD_LEVEL_TRANSPORT, data);
-      }
-#endif
-      ldap_unbind_ext(li->ld, NULL, NULL);
-      li->ld = NULL;
+    if(ssl_installed(conn)) {
+      Sockbuf *sb;
+      if(ldap_get_option(li->ld, LDAP_OPT_SOCKBUF, &sb) != LDAP_OPT_SUCCESS ||
+         ber_sockbuf_add_io(sb, &ldapsb_tls, LBER_SBIOD_LEVEL_TRANSPORT, data))
+        return CURLE_FAILED_INIT;
     }
-    Curl_sasl_cleanup(conn, li->sasl.authused);
-    conn->proto.ldapc = NULL;
-    free(li);
+#endif
+    ldap_unbind_ext(li->ld, NULL, NULL);
+    li->ld = NULL;
   }
   return CURLE_OK;
 }
@@ -872,41 +980,57 @@ static CURLcode oldap_disconnect(struct Curl_easy *data,
 static CURLcode oldap_do(struct Curl_easy *data, bool *done)
 {
   struct connectdata *conn = data->conn;
-  struct ldapconninfo *li = conn->proto.ldapc;
+  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
   struct ldapreqinfo *lr;
   CURLcode result;
   int rc;
   LDAPURLDesc *lud;
   int msgid;
 
-  connkeep(conn, "OpenLDAP do");
+  if(!li)
+    return CURLE_FAILED_INIT;
 
-  infof(data, "LDAP local: %s", data->state.url);
+  infof(data, "LDAP local: %s", Curl_bufref_ptr(&data->state.url));
 
   result = oldap_url_parse(data, &lud);
-  if(!result) {
-    rc = ldap_search_ext(li->ld, lud->lud_dn, lud->lud_scope,
-                         lud->lud_filter, lud->lud_attrs, 0,
-                         NULL, NULL, NULL, 0, &msgid);
-    ldap_free_urldesc(lud);
-    if(rc != LDAP_SUCCESS) {
-      failf(data, "LDAP local: ldap_search_ext %s", ldap_err2string(rc));
-      result = CURLE_LDAP_SEARCH_FAILED;
-    }
-    else {
-      lr = calloc(1, sizeof(struct ldapreqinfo));
-      if(!lr) {
-        ldap_abandon_ext(li->ld, msgid, NULL, NULL);
-        result = CURLE_OUT_OF_MEMORY;
-      }
-      else {
-        lr->msgid = msgid;
-        data->req.p.ldap = lr;
-        Curl_setup_transfer(data, FIRSTSOCKET, -1, FALSE, -1);
-        *done = TRUE;
-      }
+  if(result)
+    goto out;
+
+#ifdef USE_SSL
+  if(ssl_installed(conn)) {
+    Sockbuf *sb;
+    /* re-install the libcurl SSL handlers into the sockbuf. */
+    if((ldap_get_option(li->ld, LDAP_OPT_SOCKBUF, &sb) != LDAP_OPT_SUCCESS) ||
+       ber_sockbuf_add_io(sb, &ldapsb_tls, LBER_SBIOD_LEVEL_TRANSPORT, data)) {
+      ldap_free_urldesc(lud);
+      return CURLE_FAILED_INIT;
     }
   }
+#endif
+
+  rc = ldap_search_ext(li->ld, lud->lud_dn, lud->lud_scope,
+                       lud->lud_filter, lud->lud_attrs, 0,
+                       NULL, NULL, NULL, 0, &msgid);
+  ldap_free_urldesc(lud);
+  if(rc != LDAP_SUCCESS) {
+    failf(data, "LDAP local: ldap_search_ext %s", ldap_err2string(rc));
+    result = CURLE_LDAP_SEARCH_FAILED;
+    goto out;
+  }
+
+  lr = curlx_calloc(1, sizeof(struct ldapreqinfo));
+  if(!lr ||
+     Curl_meta_set(data, CURL_META_LDAP_EASY, lr, oldap_easy_dtor)) {
+    ldap_abandon_ext(li->ld, msgid, NULL, NULL);
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  lr->msgid = msgid;
+  Curl_xfer_setup_recv(data, FIRSTSOCKET, -1);
+  *done = TRUE;
+
+out:
   return result;
 }
 
@@ -914,7 +1038,7 @@ static CURLcode oldap_done(struct Curl_easy *data, CURLcode res,
                            bool premature)
 {
   struct connectdata *conn = data->conn;
-  struct ldapreqinfo *lr = data->req.p.ldap;
+  struct ldapreqinfo *lr = Curl_meta_get(data, CURL_META_LDAP_EASY);
 
   (void)res;
   (void)premature;
@@ -922,12 +1046,13 @@ static CURLcode oldap_done(struct Curl_easy *data, CURLcode res,
   if(lr) {
     /* if there was a search in progress, abandon it */
     if(lr->msgid) {
-      struct ldapconninfo *li = conn->proto.ldapc;
-      ldap_abandon_ext(li->ld, lr->msgid, NULL, NULL);
+      struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
+      if(li && li->ld) {
+        ldap_abandon_ext(li->ld, lr->msgid, NULL, NULL);
+      }
       lr->msgid = 0;
     }
-    data->req.p.ldap = NULL;
-    free(lr);
+    Curl_meta_remove(data, CURL_META_LDAP_EASY);
   }
 
   return CURLE_OK;
@@ -945,35 +1070,28 @@ static CURLcode client_write(struct Curl_easy *data,
        separator, drop the latter. */
     if(!len && plen && prefix[plen - 1] == ' ')
       plen--;
-    result = Curl_client_write(data, CLIENTWRITE_BODY, (char *) prefix, plen);
-    if(!result)
-      data->req.bytecount += plen;
+    result = Curl_client_write(data, CLIENTWRITE_BODY, prefix, plen);
   }
   if(!result && value) {
-    result = Curl_client_write(data, CLIENTWRITE_BODY, (char *) value, len);
-    if(!result)
-      data->req.bytecount += len;
+    result = Curl_client_write(data, CLIENTWRITE_BODY, value, len);
   }
   if(!result && suffix) {
-    result = Curl_client_write(data, CLIENTWRITE_BODY, (char *) suffix, slen);
-    if(!result)
-      data->req.bytecount += slen;
+    result = Curl_client_write(data, CLIENTWRITE_BODY, suffix, slen);
   }
   return result;
 }
 
-static ssize_t oldap_recv(struct Curl_easy *data, int sockindex, char *buf,
-                          size_t len, CURLcode *err)
+static CURLcode oldap_recv(struct Curl_easy *data, int sockindex, char *buf,
+                           size_t len, size_t *pnread)
 {
   struct connectdata *conn = data->conn;
-  struct ldapconninfo *li = conn->proto.ldapc;
-  struct ldapreqinfo *lr = data->req.p.ldap;
+  struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
+  struct ldapreqinfo *lr = Curl_meta_get(data, CURL_META_LDAP_EASY);
   int rc;
   LDAPMessage *msg = NULL;
   BerElement *ber = NULL;
-  struct timeval tv = {0, 0};
+  struct timeval tv = { 0, 0 };
   struct berval bv, *bvals;
-  int binary = 0;
   CURLcode result = CURLE_AGAIN;
   int code;
   char *info = NULL;
@@ -981,6 +1099,9 @@ static ssize_t oldap_recv(struct Curl_easy *data, int sockindex, char *buf,
   (void)len;
   (void)buf;
   (void)sockindex;
+  *pnread = 0;
+  if(!li || !lr)
+    return CURLE_FAILED_INIT;
 
   rc = ldap_result(li->ld, lr->msgid, LDAP_MSG_ONE, &tv, &msg);
   if(rc < 0) {
@@ -988,11 +1109,9 @@ static ssize_t oldap_recv(struct Curl_easy *data, int sockindex, char *buf,
     result = CURLE_RECV_ERROR;
   }
 
-  *err = result;
-
   /* error or timed out */
   if(!msg)
-    return -1;
+    return result;
 
   result = CURLE_OK;
 
@@ -1013,7 +1132,7 @@ static ssize_t oldap_recv(struct Curl_easy *data, int sockindex, char *buf,
     switch(code) {
     case LDAP_SIZELIMIT_EXCEEDED:
       infof(data, "There are more than %d entries", lr->nument);
-      /* FALLTHROUGH */
+      FALLTHROUGH();
     case LDAP_SUCCESS:
       data->req.size = data->req.bytecount;
       break;
@@ -1043,6 +1162,7 @@ static ssize_t oldap_recv(struct Curl_easy *data, int sockindex, char *buf,
         rc == LDAP_SUCCESS;
         rc = ldap_get_attribute_ber(li->ld, msg, ber, &bv, &bvals)) {
       int i;
+      bool binary;
 
       if(!bv.bv_val)
         break;
@@ -1056,10 +1176,10 @@ static ssize_t oldap_recv(struct Curl_easy *data, int sockindex, char *buf,
       }
 
       binary = bv.bv_len > 7 &&
-               !strncmp(bv.bv_val + bv.bv_len - 7, ";binary", 7);
+        curl_strnequal(bv.bv_val + bv.bv_len - 7, ";binary", 7);
 
-      for(i = 0; bvals[i].bv_val != NULL; i++) {
-        int binval = 0;
+      for(i = 0; bvals[i].bv_val; i++) {
+        bool binval = FALSE;
 
         result = client_write(data, STRCONST("\t"), bv.bv_val, bv.bv_len,
                               STRCONST(":"));
@@ -1068,15 +1188,16 @@ static ssize_t oldap_recv(struct Curl_easy *data, int sockindex, char *buf,
 
         if(!binary) {
           /* check for leading or trailing whitespace */
-          if(ISBLANK(bvals[i].bv_val[0]) ||
-             ISBLANK(bvals[i].bv_val[bvals[i].bv_len - 1]))
-            binval = 1;
+          if(bvals[i].bv_len &&
+             (ISBLANK(bvals[i].bv_val[0]) ||
+              ISBLANK(bvals[i].bv_val[bvals[i].bv_len - 1])))
+            binval = TRUE;
           else {
             /* check for unprintable characters */
             unsigned int j;
             for(j = 0; j < bvals[i].bv_len; j++)
               if(!ISPRINT(bvals[i].bv_val[j])) {
-                binval = 1;
+                binval = TRUE;
                 break;
               }
           }
@@ -1087,12 +1208,13 @@ static ssize_t oldap_recv(struct Curl_easy *data, int sockindex, char *buf,
 
           /* Binary value, encode to base64. */
           if(bvals[i].bv_len)
-            result = Curl_base64_encode(bvals[i].bv_val, bvals[i].bv_len,
-                                        &val_b64, &val_b64_sz);
+            result = curlx_base64_encode((uint8_t *)bvals[i].bv_val,
+                                         bvals[i].bv_len,
+                                         &val_b64, &val_b64_sz);
           if(!result)
             result = client_write(data, STRCONST(": "), val_b64, val_b64_sz,
                                   STRCONST("\n"));
-          free(val_b64);
+          curlx_free(val_b64);
         }
         else
           result = client_write(data, STRCONST(" "),
@@ -1110,8 +1232,6 @@ static ssize_t oldap_recv(struct Curl_easy *data, int sockindex, char *buf,
         break;
     }
 
-    ber_free(ber, 0);
-
     if(!result)
       result = client_write(data, STRCONST("\n"), NULL, 0, NULL, 0);
     if(!result)
@@ -1119,93 +1239,54 @@ static ssize_t oldap_recv(struct Curl_easy *data, int sockindex, char *buf,
     break;
   }
 
+  ber_free(ber, 0);
   ldap_msgfree(msg);
-  *err = result;
-  return result? -1: 0;
+  return result;
 }
 
-#ifdef USE_SSL
-static int
-ldapsb_tls_setup(Sockbuf_IO_Desc *sbiod, void *arg)
+void Curl_ldap_version(char *buf, size_t bufsz)
 {
-  sbiod->sbiod_pvt = arg;
-  return 0;
-}
+  LDAPAPIInfo api;
+  api.ldapai_info_version = LDAP_API_INFO_VERSION;
 
-static int
-ldapsb_tls_remove(Sockbuf_IO_Desc *sbiod)
-{
-  sbiod->sbiod_pvt = NULL;
-  return 0;
-}
-
-/* We don't need to do anything because libcurl does it already */
-static int
-ldapsb_tls_close(Sockbuf_IO_Desc *sbiod)
-{
-  (void)sbiod;
-  return 0;
-}
-
-static int
-ldapsb_tls_ctrl(Sockbuf_IO_Desc *sbiod, int opt, void *arg)
-{
-  (void)arg;
-  if(opt == LBER_SB_OPT_DATA_READY) {
-    struct Curl_easy *data = sbiod->sbiod_pvt;
-    return Curl_conn_data_pending(data, FIRSTSOCKET);
+  if(ldap_get_option(NULL, LDAP_OPT_API_INFO, &api) == LDAP_OPT_SUCCESS) {
+    unsigned int patch = (unsigned int)(api.ldapai_vendor_version % 100);
+    unsigned int major = (unsigned int)(api.ldapai_vendor_version / 10000);
+    unsigned int minor =
+      (((unsigned int)api.ldapai_vendor_version - (major * 10000))
+       - patch) / 100;
+    curl_msnprintf(buf, bufsz, "%s/%u.%u.%u",
+                   api.ldapai_vendor_name, major, minor, patch);
+    ldap_memfree(api.ldapai_vendor_name);
+    ber_memvfree((void **)api.ldapai_extensions);
   }
-  return 0;
+  else
+    curl_msnprintf(buf, bufsz, "OpenLDAP");
 }
 
-static ber_slen_t
-ldapsb_tls_read(Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len)
-{
-  struct Curl_easy *data = sbiod->sbiod_pvt;
-  ber_slen_t ret = 0;
-  if(data) {
-    struct connectdata *conn = data->conn;
-    if(conn) {
-      struct ldapconninfo *li = conn->proto.ldapc;
-      CURLcode err = CURLE_RECV_ERROR;
-
-      ret = (li->recv)(data, FIRSTSOCKET, buf, len, &err);
-      if(ret < 0 && err == CURLE_AGAIN) {
-        SET_SOCKERRNO(EWOULDBLOCK);
-      }
-    }
-  }
-  return ret;
-}
-
-static ber_slen_t
-ldapsb_tls_write(Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len)
-{
-  struct Curl_easy *data = sbiod->sbiod_pvt;
-  ber_slen_t ret = 0;
-  if(data) {
-    struct connectdata *conn = data->conn;
-    if(conn) {
-      struct ldapconninfo *li = conn->proto.ldapc;
-      CURLcode err = CURLE_SEND_ERROR;
-      ret = (li->send)(data, FIRSTSOCKET, buf, len, &err);
-      if(ret < 0 && err == CURLE_AGAIN) {
-        SET_SOCKERRNO(EWOULDBLOCK);
-      }
-    }
-  }
-  return ret;
-}
-
-static Sockbuf_IO ldapsb_tls =
-{
-  ldapsb_tls_setup,
-  ldapsb_tls_remove,
-  ldapsb_tls_ctrl,
-  ldapsb_tls_read,
-  ldapsb_tls_write,
-  ldapsb_tls_close
+/*
+ * LDAP protocol handler.
+ */
+const struct Curl_protocol Curl_protocol_ldap = {
+  oldap_setup_connection,               /* setup_connection */
+  oldap_do,                             /* do_it */
+  oldap_done,                           /* done */
+  ZERO_NULL,                            /* do_more */
+  oldap_connect,                        /* connect_it */
+  oldap_connecting,                     /* connecting */
+  ZERO_NULL,                            /* doing */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
+  oldap_disconnect,                     /* disconnect */
+  ZERO_NULL,                            /* write_resp */
+  ZERO_NULL,                            /* write_resp_hd */
+  ZERO_NULL,                            /* connection_is_dead */
+  ZERO_NULL,                            /* attach connection */
+  ZERO_NULL,                            /* follow */
 };
-#endif /* USE_SSL */
 
 #endif /* !CURL_DISABLE_LDAP && USE_OPENLDAP */
+
+/* The LDAP scheme structs are in ldap.c */
diff --git a/third-party/curl/lib/optiontable.pl b/third-party/curl/lib/optiontable.pl
index 25d6a66deb..de6fb55151 100644
--- a/third-party/curl/lib/optiontable.pl
+++ b/third-party/curl/lib/optiontable.pl
@@ -1,5 +1,8 @@
 #!/usr/bin/env perl
 
+use strict;
+use warnings;
+
 print <<HEAD
 /***************************************************************************
  *                                  _   _ ____  _
@@ -8,7 +11,7 @@ print <<HEAD
  *                            | (__| |_| |  _ <| |___
  *                             \\___|\\___/|_| \\_\\_____|
  *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) Daniel Stenberg, <daniel\@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -28,40 +31,46 @@ print <<HEAD
 /* This source code is generated by optiontable.pl - DO NOT EDIT BY HAND */
 
 #include "curl_setup.h"
+
 #include "easyoptions.h"
 
 /* all easy setopt options listed in alphabetical order */
-struct curl_easyoption Curl_easyopts[] = {
+const struct curl_easyoption Curl_easyopts[] = {
 HEAD
     ;
 
-my $lastnum=0;
+my $lastnum = 0;
+
+my %opt;
+my %type;
+my @names;
+my %alias;
 
 sub add {
-    my($opt, $type, $num)=@_;
+    my($optstr, $typestr, $num) = @_;
     my $name;
     # remove all spaces from the type
-    $type =~ s/ //g;
-    my $ext = $type;
+    $typestr =~ s/ //g;
+    my $ext = $typestr;
 
-    if($opt =~ /OBSOLETE/) {
+    if($optstr =~ /OBSOLETE/) {
         # skip obsolete options
         next;
     }
 
-    if($opt =~ /^CURLOPT_(.*)/) {
-        $name=$1;
+    if($optstr =~ /^CURLOPT_(.*)/) {
+        $name = $1;
     }
     $ext =~ s/CURLOPTTYPE_//;
     $ext =~ s/CBPOINT/CBPTR/;
     $ext =~ s/POINT\z//;
-    $type = "CURLOT_$ext";
+    $typestr = "CURLOT_$ext";
 
-    $opt{$name} = $opt;
-    $type{$name} = $type;
+    $opt{$name} = $optstr;
+    $type{$name} = $typestr;
     push @names, $name;
     if($num < $lastnum) {
-        print STDERR "ERROR: $opt has bad number: $num < $lastnum\n";
+        print STDERR "ERROR: $optstr has bad number: $num < $lastnum\n";
         exit 2;
     }
     else {
@@ -69,9 +78,10 @@ sub add {
     }
 }
 
-
 my $fl;
-while(<STDIN>) {
+my $file = shift @ARGV;
+open(CURL_H, '<', $file) or die;
+while(<CURL_H>) {
     my $l = $_;
     if($fl) {
         # continued deprecation
@@ -79,7 +89,7 @@ while(<STDIN>) {
             $fl .= $1;
 
             # the end
-            my @p=split(/, */, $fl);
+            my @p = split(/, */, $fl);
             add($p[0], $p[1], $p[2]);
             undef $fl;
         }
@@ -96,24 +106,24 @@ while(<STDIN>) {
     }
 
     if(/^ *CURLOPT\(([^,]*), ([^,]*), (\d+)\)/) {
-        my($opt, $type, $num)=($1,$2,$3);
+        my($opt, $type, $num) = ($1, $2, $3);
         add($opt, $type, $num);
     }
 
     # alias for an older option
     # old = new
     if(/^#define (CURLOPT_[^ ]*) *(CURLOPT_\S*)/) {
-        my ($o, $n)=($1, $2);
+        my ($o, $n) = ($1, $2);
         # skip obsolete ones
-        if($n !~ /OBSOLETE/) {
+        if(($n !~ /OBSOLETE/) && ($o !~ /OBSOLETE/)) {
             $o =~ s/^CURLOPT_//;
             $n =~ s/^CURLOPT_//;
             $alias{$o} = $n;
-            push @names, $o,
+            push @names, $o;
         }
     }
 }
-
+close(CURL_H);
 
 for my $name (sort @names) {
     my $oname = $name;
@@ -123,19 +133,19 @@ for my $name (sort @names) {
         $name = $alias{$name};
         $flag = "CURLOT_FLAG_ALIAS";
     }
-    $o = sprintf("  {\"%s\", %s, %s, %s},\n",
-                 $oname, $opt{$name}, $type{$name}, $flag);
+    my $o = sprintf("  { \"%s\", %s, %s, %s },\n",
+                    $oname, $opt{$name}, $type{$name}, $flag);
     if(length($o) < 80) {
         print $o;
     }
     else {
-        printf("  {\"%s\", %s,\n   %s, %s},\n",
-                 $oname, $opt{$name}, $type{$name}, $flag);
+        printf("  { \"%s\", %s,\n    %s, %s },\n",
+               $oname, $opt{$name}, $type{$name}, $flag);
     }
 }
 
 print <<FOOT
-  {NULL, CURLOPT_LASTENTRY, CURLOT_LONG, 0} /* end of table */
+  { NULL, CURLOPT_LASTENTRY, CURLOT_LONG, 0 } /* end of table */
 };
 
 #ifdef DEBUGBUILD
@@ -145,7 +155,7 @@ print <<FOOT
  */
 int Curl_easyopts_check(void)
 {
-  return ((CURLOPT_LASTENTRY%10000) != ($lastnum + 1));
+  return (CURLOPT_LASTENTRY % 10000) != ($lastnum + 1);
 }
 #endif
 FOOT
diff --git a/third-party/curl/lib/parsedate.c b/third-party/curl/lib/parsedate.c
index 1a7195b16a..b19423169a 100644
--- a/third-party/curl/lib/parsedate.c
+++ b/third-party/curl/lib/parsedate.c
@@ -21,6 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "curl_setup.h"
+
+#include "parsedate.h"
+#include "curlx/strparse.h"
+#include "curlx/strcopy.h"
+
 /*
   A brief summary of the date string formats this parser groks:
 
@@ -75,132 +81,113 @@
 
 */
 
-#include "curl_setup.h"
-
-#include <limits.h>
-
-#include <curl/curl.h>
-#include "strcase.h"
-#include "warnless.h"
-#include "parsedate.h"
-
-/*
- * parsedate()
- *
- * Returns:
- *
- * PARSEDATE_OK     - a fine conversion
- * PARSEDATE_FAIL   - failed to convert
- * PARSEDATE_LATER  - time overflow at the far end of time_t
- * PARSEDATE_SOONER - time underflow at the low end of time_t
- */
-
-static int parsedate(const char *date, time_t *output);
-
-#define PARSEDATE_OK     0
-#define PARSEDATE_FAIL   -1
-#define PARSEDATE_LATER  1
-#define PARSEDATE_SOONER 2
-
 #if !defined(CURL_DISABLE_PARSEDATE) || !defined(CURL_DISABLE_FTP) || \
-  !defined(CURL_DISABLE_FILE)
+  !defined(CURL_DISABLE_FILE) || defined(USE_GNUTLS)
 /* These names are also used by FTP and FILE code */
-const char * const Curl_wkday[] =
-{"Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"};
-const char * const Curl_month[]=
-{ "Jan", "Feb", "Mar", "Apr", "May", "Jun",
-  "Jul", "Aug", "Sep", "Oct", "Nov", "Dec" };
+const char * const Curl_wkday[] = {
+  "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"
+};
+const char * const Curl_month[] = {
+  "Jan", "Feb", "Mar", "Apr", "May", "Jun",
+  "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"
+};
 #endif
 
+#define PARSEDATE_OK     0
+#define PARSEDATE_FAIL   (-1)
+
 #ifndef CURL_DISABLE_PARSEDATE
-static const char * const weekday[] =
-{ "Monday", "Tuesday", "Wednesday", "Thursday",
-  "Friday", "Saturday", "Sunday" };
+
+#if SIZEOF_TIME_T < 5
+#define PARSEDATE_LATER  1
+#endif
+#if SIZEOF_TIME_T < 5 || defined(HAVE_TIME_T_UNSIGNED)
+#define PARSEDATE_SOONER 2
+#endif
+
+static const char * const weekday[] = {
+  "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday"
+};
 
 struct tzinfo {
   char name[5];
-  int offset; /* +/- in minutes */
+  int16_t offset; /* +/- in minutes */
 };
 
-/* Here's a bunch of frequently used time zone names. These were supported
-   by the old getdate parser. */
-#define tDAYZONE -60       /* offset for daylight savings time */
-static const struct tzinfo tz[]= {
-  {"GMT", 0},              /* Greenwich Mean */
-  {"UT",  0},              /* Universal Time */
-  {"UTC", 0},              /* Universal (Coordinated) */
-  {"WET", 0},              /* Western European */
-  {"BST", 0 tDAYZONE},     /* British Summer */
-  {"WAT", 60},             /* West Africa */
-  {"AST", 240},            /* Atlantic Standard */
-  {"ADT", 240 tDAYZONE},   /* Atlantic Daylight */
-  {"EST", 300},            /* Eastern Standard */
-  {"EDT", 300 tDAYZONE},   /* Eastern Daylight */
-  {"CST", 360},            /* Central Standard */
-  {"CDT", 360 tDAYZONE},   /* Central Daylight */
-  {"MST", 420},            /* Mountain Standard */
-  {"MDT", 420 tDAYZONE},   /* Mountain Daylight */
-  {"PST", 480},            /* Pacific Standard */
-  {"PDT", 480 tDAYZONE},   /* Pacific Daylight */
-  {"YST", 540},            /* Yukon Standard */
-  {"YDT", 540 tDAYZONE},   /* Yukon Daylight */
-  {"HST", 600},            /* Hawaii Standard */
-  {"HDT", 600 tDAYZONE},   /* Hawaii Daylight */
-  {"CAT", 600},            /* Central Alaska */
-  {"AHST", 600},           /* Alaska-Hawaii Standard */
-  {"NT",  660},            /* Nome */
-  {"IDLW", 720},           /* International Date Line West */
-  {"CET", -60},            /* Central European */
-  {"MET", -60},            /* Middle European */
-  {"MEWT", -60},           /* Middle European Winter */
-  {"MEST", -60 tDAYZONE},  /* Middle European Summer */
-  {"CEST", -60 tDAYZONE},  /* Central European Summer */
-  {"MESZ", -60 tDAYZONE},  /* Middle European Summer */
-  {"FWT", -60},            /* French Winter */
-  {"FST", -60 tDAYZONE},   /* French Summer */
-  {"EET", -120},           /* Eastern Europe, USSR Zone 1 */
-  {"WAST", -420},          /* West Australian Standard */
-  {"WADT", -420 tDAYZONE}, /* West Australian Daylight */
-  {"CCT", -480},           /* China Coast, USSR Zone 7 */
-  {"JST", -540},           /* Japan Standard, USSR Zone 8 */
-  {"EAST", -600},          /* Eastern Australian Standard */
-  {"EADT", -600 tDAYZONE}, /* Eastern Australian Daylight */
-  {"GST", -600},           /* Guam Standard, USSR Zone 9 */
-  {"NZT", -720},           /* New Zealand */
-  {"NZST", -720},          /* New Zealand Standard */
-  {"NZDT", -720 tDAYZONE}, /* New Zealand Daylight */
-  {"IDLE", -720},          /* International Date Line East */
-  /* Next up: Military timezone names. RFC822 allowed these, but (as noted in
-     RFC 1123) had their signs wrong. Here we use the correct signs to match
-     actual military usage.
-   */
-  {"A",  1 * 60},         /* Alpha */
-  {"B",  2 * 60},         /* Bravo */
-  {"C",  3 * 60},         /* Charlie */
-  {"D",  4 * 60},         /* Delta */
-  {"E",  5 * 60},         /* Echo */
-  {"F",  6 * 60},         /* Foxtrot */
-  {"G",  7 * 60},         /* Golf */
-  {"H",  8 * 60},         /* Hotel */
-  {"I",  9 * 60},         /* India */
-  /* "J", Juliet is not used as a timezone, to indicate the observer's local
-     time */
-  {"K", 10 * 60},         /* Kilo */
-  {"L", 11 * 60},         /* Lima */
-  {"M", 12 * 60},         /* Mike */
-  {"N",  -1 * 60},         /* November */
-  {"O",  -2 * 60},         /* Oscar */
-  {"P",  -3 * 60},         /* Papa */
-  {"Q",  -4 * 60},         /* Quebec */
-  {"R",  -5 * 60},         /* Romeo */
-  {"S",  -6 * 60},         /* Sierra */
-  {"T",  -7 * 60},         /* Tango */
-  {"U",  -8 * 60},         /* Uniform */
-  {"V",  -9 * 60},         /* Victor */
-  {"W", -10 * 60},         /* Whiskey */
-  {"X", -11 * 60},         /* X-ray */
-  {"Y", -12 * 60},         /* Yankee */
-  {"Z", 0},                /* Zulu, zero meridian, a.k.a. UTC */
+#define tDAYZONE (-60)         /* offset for daylight savings time */
+
+/* alpha-sorted list of time zones */
+static const struct tzinfo tz[] = {
+  { "A", -1 * 60 },            /* Alpha */
+  { "ADT",   240 + tDAYZONE }, /* Atlantic Daylight */
+  { "AHST",  600 },            /* Alaska-Hawaii Standard */
+  { "AST",   240 },            /* Atlantic Standard */
+  { "B", -2 * 60 },            /* Bravo */
+  { "BST",     0 + tDAYZONE }, /* British Summer */
+  { "C", -3 * 60 },            /* Charlie */
+  { "CAT",   600 },            /* Central Alaska */
+  { "CCT",  -480 },            /* China Coast, USSR Zone 7 */
+  { "CDT",   360 + tDAYZONE }, /* Central Daylight */
+  { "CEST",  -60 + tDAYZONE }, /* Central European Summer */
+  { "CET",   -60 },            /* Central European */
+  { "CST",   360 },            /* Central Standard */
+  { "D", -4 * 60 },            /* Delta */
+  { "E", -5 * 60 },            /* Echo */
+  { "EADT", -600 + tDAYZONE }, /* Eastern Australian Daylight */
+  { "EAST", -600 },            /* Eastern Australian Standard */
+  { "EDT",   300 + tDAYZONE }, /* Eastern Daylight */
+  { "EET",  -120 },            /* Eastern Europe, USSR Zone 1 */
+  { "EST",   300 },            /* Eastern Standard */
+  { "F", -6 * 60 },            /* Foxtrot */
+  { "FST",   -60 + tDAYZONE }, /* French Summer */
+  { "FWT",   -60 },            /* French Winter */
+  { "G", -7 * 60 },            /* Golf */
+  { "GMT",     0 },            /* Greenwich Mean */
+  { "GST",  -600 },            /* Guam Standard, USSR Zone 9 */
+  { "H", -8 * 60 },            /* Hotel */
+  { "HDT",   600 + tDAYZONE }, /* Hawaii Daylight */
+  { "HST",   600 },            /* Hawaii Standard */
+  { "I", -9 * 60 },            /* India */
+  { "IDLE", -720 },            /* International Date Line East */
+  { "IDLW",  720 },            /* International Date Line West */
+  { "JST",  -540 },            /* Japan Standard, USSR Zone 8 */
+  { "K", -10 * 60 },           /* Kilo */
+  { "L", -11 * 60 },           /* Lima */
+  { "M", -12 * 60 },           /* Mike */
+  { "MDT",   420 + tDAYZONE }, /* Mountain Daylight */
+  { "MEST",  -60 + tDAYZONE }, /* Middle European Summer */
+  { "MESZ",  -60 + tDAYZONE }, /* Middle European Summer */
+  { "MET",   -60 },            /* Middle European */
+  { "MEWT",  -60 },            /* Middle European Winter */
+  { "MST",   420 },            /* Mountain Standard */
+  { "N",      60 },            /* November */
+  { "NT",    660 },            /* Nome */ /* spellchecker:disable-line */
+  { "NZDT", -720 + tDAYZONE }, /* New Zealand Daylight */
+  { "NZST", -720 },            /* New Zealand Standard */
+  { "NZT",  -720 },            /* New Zealand */
+  { "O",  2 * 60 },            /* Oscar */
+  { "P",  3 * 60 },            /* Papa */
+  { "PDT",   480 + tDAYZONE }, /* Pacific Daylight */
+  { "PST",   480 },            /* Pacific Standard */
+  { "Q",  4 * 60 },            /* Quebec */
+  { "R",  5 * 60 },            /* Romeo */
+  { "S",  6 * 60 },            /* Sierra */
+  { "T",  7 * 60 },            /* Tango */
+  { "U",  8 * 60 },            /* Uniform */
+  { "UT",      0 },            /* Universal Time */
+  { "UTC",     0 },            /* Universal (Coordinated) */
+  { "V",  9 * 60 },            /* Victor */
+  { "W", 10 * 60 },            /* Whiskey */
+  { "WADT", -420 + tDAYZONE }, /* West Australian Daylight */
+  { "WAST", -420 }, /* spellchecker:disable-line */
+                               /* West Australian Standard */
+  { "WAT",    60 },            /* West Africa */
+  { "WET",     0 },            /* Western European */
+  { "X", 11 * 60 },            /* X-ray */
+  { "Y", 12 * 60 },            /* Yankee */
+  { "YDT",   540 + tDAYZONE }, /* Yukon Daylight */
+  { "YST",   540 },            /* Yukon Standard */
+  { "Z",       0 },            /* Zulu, zero meridian, a.k.a. UTC */
 };
 
 /* returns:
@@ -218,10 +205,10 @@ static int checkday(const char *check, size_t len)
     what = &Curl_wkday[0];
   else
     return -1; /* too short */
-  for(i = 0; i<7; i++) {
+  for(i = 0; i < 7; i++) {
     size_t ilen = strlen(what[0]);
     if((ilen == len) &&
-       strncasecompare(check, what[0], len))
+       curl_strnequal(check, what[0], len))
       return i;
     what++;
   }
@@ -235,62 +222,79 @@ static int checkmonth(const char *check, size_t len)
   if(len != 3)
     return -1; /* not a month */
 
-  for(i = 0; i<12; i++) {
-    if(strncasecompare(check, what[0], 3))
+  for(i = 0; i < 12; i++) {
+    if(curl_strnequal(check, what[0], 3))
       return i;
     what++;
   }
   return -1; /* return the offset or -1, no real offset is -1 */
 }
 
-/* return the time zone offset between GMT and the input one, in number
-   of seconds or -1 if the timezone wasn't found/legal */
+static int tzcompare(const void *m1, const void *m2)
+{
+  const struct tzinfo *tz1 = m1;
+  const struct tzinfo *tz2 = m2;
+  return strcmp(tz1->name, tz2->name);
+}
 
+/* return the time zone offset between GMT and the input one, in number of
+   seconds or -1 if the timezone was not found/legal */
 static int checktz(const char *check, size_t len)
 {
-  unsigned int i;
-  const struct tzinfo *what = tz;
-  if(len > 4) /* longer than any valid timezone */
-    return -1;
-
-  for(i = 0; i< sizeof(tz)/sizeof(tz[0]); i++) {
-    size_t ilen = strlen(what->name);
-    if((ilen == len) &&
-       strncasecompare(check, what->name, len))
-      return what->offset*60;
-    what++;
+  if(len <= 4) {
+    const struct tzinfo *what;
+    struct tzinfo find;
+    curlx_strcopy(find.name, sizeof(find.name), check, len);
+    what = bsearch(&find, tz, CURL_ARRAYSIZE(tz), sizeof(tz[0]), tzcompare);
+    if(what)
+      return what->offset * 60;
   }
   return -1;
 }
 
 static void skip(const char **date)
 {
-  /* skip everything that aren't letters or digits */
+  /* skip everything that are not letters or digits */
   while(**date && !ISALNUM(**date))
     (*date)++;
 }
 
+/* each field is exactly -1 when unknown */
+struct when {
+  int wday;  /* day of the week, 0-6 (mon-sun) */
+  int mon;   /* month of the year, 0-11 */
+  int mday;  /* day of month, 1 - 31 */
+  int hour;  /* hour of day, 0 - 23 */
+  int min;   /* minute of hour, 0 - 59 */
+  int sec;   /* second of minute, 0 - 60 (leap second) */
+  int year;  /* year, >= 1583 */
+  int tzoff; /* time zone offset in seconds */
+};
+
 enum assume {
   DATE_MDAY,
   DATE_YEAR,
   DATE_TIME
 };
 
+/* (1969 / 4) - (1969 / 100) + (1969 / 400) = 492 - 19 + 4 = 477 */
+#define LEAP_DAYS_BEFORE_1969 477
+
 /*
- * time2epoch: time stamp to seconds since epoch in GMT time zone.  Similar to
+ * time2epoch: time stamp to seconds since epoch in GMT time zone. Similar to
  * mktime but for GMT only.
  */
-static time_t time2epoch(int sec, int min, int hour,
-                         int mday, int mon, int year)
+static curl_off_t time2epoch(struct when *w)
 {
-  static const int month_days_cumulative [12] =
-    { 0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334 };
-  int leap_days = year - (mon <= 1);
-  leap_days = ((leap_days / 4) - (leap_days / 100) + (leap_days / 400)
-               - (1969 / 4) + (1969 / 100) - (1969 / 400));
-  return ((((time_t) (year - 1970) * 365
-            + leap_days + month_days_cumulative[mon] + mday - 1) * 24
-           + hour) * 60 + min) * 60 + sec;
+  static const int cumulative_days[12] = {
+    0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334
+  };
+  int y = w->year - (w->mon <= 1);
+  int leap_days = (y / 4) - (y / 100) + (y / 400) - LEAP_DAYS_BEFORE_1969;
+  curl_off_t days = (curl_off_t)(w->year - 1970) * 365 + leap_days +
+    cumulative_days[w->mon] + w->mday - 1;
+
+  return (((days * 24 + w->hour) * 60 + w->min) * 60) + w->sec;
 }
 
 /* Returns the value of a single-digit or two-digit decimal number, return
@@ -301,16 +305,14 @@ static int oneortwodigit(const char *date, const char **endp)
   int num = date[0] - '0';
   if(ISDIGIT(date[1])) {
     *endp = &date[2];
-    return num*10 + (date[1] - '0');
+    return (num * 10) + (date[1] - '0');
   }
   *endp = &date[1];
   return num;
 }
 
-
 /* HH:MM:SS or HH:MM and accept single-digits too */
-static bool match_time(const char *date,
-                       int *h, int *m, int *s, char **endp)
+static bool match_time(const char *date, struct when *w, char **endp)
 {
   const char *p;
   int hh, mm, ss = 0;
@@ -333,10 +335,10 @@ static bool match_time(const char *date,
   }
   return FALSE; /* not a time string */
 match:
-  *h = hh;
-  *m = mm;
-  *s = ss;
-  *endp = (char *)p;
+  w->hour = hh;
+  w->min = mm;
+  w->sec = ss;
+  *endp = (char *)CURL_UNCONST(p);
   return TRUE;
 }
 
@@ -354,220 +356,221 @@ match:
 /* Wednesday is the longest name this parser knows about */
 #define NAME_LEN 12
 
+static void initwhen(struct when *w)
+{
+  w->wday = w->mon = w->mday = w->hour = w->min = w->sec = w->year = w->tzoff =
+    -1;
+}
+
+static int datestring(const char **datep, struct when *w)
+{
+  /* a name coming up */
+  size_t len = 0;
+  const char *p = *datep;
+  bool found = FALSE;
+  while(ISALPHA(*p) && (len < NAME_LEN)) {
+    p++;
+    len++;
+  }
+
+  if(len != NAME_LEN) {
+    if(w->wday == -1) {
+      w->wday = checkday(*datep, len);
+      if(w->wday != -1)
+        found = TRUE;
+    }
+    if(!found && (w->mon == -1)) {
+      w->mon = checkmonth(*datep, len);
+      if(w->mon != -1)
+        found = TRUE;
+    }
+
+    if(!found && (w->tzoff == -1)) {
+      /* this must be a time zone string */
+      w->tzoff = checktz(*datep, len);
+      if(w->tzoff != -1)
+        found = TRUE;
+    }
+  }
+  if(!found)
+    return PARSEDATE_FAIL; /* bad string */
+
+  *datep += len;
+  return PARSEDATE_OK;
+}
+
+static int datenum(const char *indate, const char **datep, struct when *w,
+                   enum assume *dignextp)
+{
+  /* a digit */
+  unsigned int val;
+  char *end;
+  const char *date = *datep;
+  enum assume dignext = *dignextp;
+
+  if((w->sec == -1) && match_time(date, w, &end)) {
+    /* time stamp */
+    date = end;
+  }
+  else {
+    bool found = FALSE;
+    curl_off_t lval;
+    int num_digits = 0;
+    const char *p = *datep;
+    if(curlx_str_number(&p, &lval, 99999999))
+      return PARSEDATE_FAIL;
+
+    /* we know num_digits cannot be larger than 8 */
+    num_digits = (int)(p - *datep);
+    val = (unsigned int)lval;
+
+    if((w->tzoff == -1) &&
+       (num_digits == 4) &&
+       (val <= 1400) &&
+       (indate < date) &&
+       (date[-1] == '+' || date[-1] == '-')) {
+      /* four digits and a value less than or equal to 1400 (to take into
+         account all sorts of funny time zone diffs) and it is preceded
+         with a plus or minus. This is a time zone indication. 1400 is
+         picked since +1300 is frequently used and +1400 is mentioned as
+         an edge number in the document "ISO C 200X Proposal: Timezone
+         Functions" at http://david.tribble.com/text/c0xtimezone.html If
+         anyone has a more authoritative source for the exact maximum time
+         zone offsets, please speak up! */
+      found = TRUE;
+      w->tzoff = ((val / 100 * 60) + (val % 100)) * 60;
+
+      /* the + and - prefix indicates the local time compared to GMT,
+         this we need their reversed math to get what we want */
+      w->tzoff = date[-1] == '+' ? -w->tzoff : w->tzoff;
+    }
+
+    else if((num_digits == 8) && (w->year == -1) &&
+            (w->mon == -1) && (w->mday == -1)) {
+      /* 8 digits, no year, month or day yet. This is YYYYMMDD */
+      found = TRUE;
+      w->year = val / 10000;
+      w->mon = ((val % 10000) / 100) - 1; /* month is 0 - 11 */
+      w->mday = val % 100;
+    }
+
+    if(!found && (dignext == DATE_MDAY) && (w->mday == -1)) {
+      if((val > 0) && (val < 32)) {
+        w->mday = val;
+        found = TRUE;
+      }
+      dignext = DATE_YEAR;
+    }
+
+    if(!found && (dignext == DATE_YEAR) && (w->year == -1)) {
+      w->year = val;
+      found = TRUE;
+      if(w->year < 100) {
+        if(w->year > 70)
+          w->year += 1900;
+        else
+          w->year += 2000;
+      }
+      if(w->mday == -1)
+        dignext = DATE_MDAY;
+    }
+
+    if(!found)
+      return PARSEDATE_FAIL;
+
+    date = p;
+  }
+  *datep = date;
+  *dignextp = dignext;
+  return PARSEDATE_OK;
+}
+
+static int datecheck(struct when *w)
+{
+  if(w->sec == -1)
+    w->sec = w->min = w->hour = 0; /* no time, make it zero */
+
+  if((w->mday == -1) || (w->mon == -1) || (w->year == -1))
+    /* lacks vital info, fail */
+    return PARSEDATE_FAIL;
+
+  /* The Gregorian calendar was introduced 1582 */
+  else if(w->year < 1583)
+    return PARSEDATE_FAIL;
+
+  else if((w->mday > 31) || (w->mon > 11) || (w->hour > 23) ||
+          (w->min > 59) || (w->sec > 60))
+    return PARSEDATE_FAIL; /* clearly an illegal date */
+
+  return PARSEDATE_OK;
+}
+
+static void tzadjust(curl_off_t *tp, struct when *w)
+{
+  if(w->tzoff == -1) /* unknown tz means no offset */
+    w->tzoff = 0;
+
+  /* Add the time zone diff between local time zone and GMT. */
+  if((w->tzoff > 0) && (*tp > (curl_off_t)(CURL_OFF_T_MAX - w->tzoff)))
+    *tp = CURL_OFF_T_MAX;
+  else
+    *tp += w->tzoff;
+  /* this needs no minimum check since we require a year > 1582 */
+}
+
+static int mktimet(curl_off_t seconds, time_t *output)
+{
+#if SIZEOF_TIME_T < 5
+  if(seconds > TIME_T_MAX) {
+    *output = TIME_T_MAX;
+    return PARSEDATE_LATER;
+  }
+  else if(seconds < TIME_T_MIN) {
+    *output = TIME_T_MIN;
+    return PARSEDATE_SOONER;
+  }
+#elif defined(HAVE_TIME_T_UNSIGNED)
+  if(seconds < 0) {
+    *output = 0;
+    return PARSEDATE_SOONER;
+  }
+#endif
+  *output = (time_t)seconds;
+  return PARSEDATE_OK;
+}
+
 static int parsedate(const char *date, time_t *output)
 {
-  time_t t = 0;
-  int wdaynum = -1;  /* day of the week number, 0-6 (mon-sun) */
-  int monnum = -1;   /* month of the year number, 0-11 */
-  int mdaynum = -1; /* day of month, 1 - 31 */
-  int hournum = -1;
-  int minnum = -1;
-  int secnum = -1;
-  int yearnum = -1;
-  int tzoff = -1;
+  curl_off_t seconds = 0;
   enum assume dignext = DATE_MDAY;
   const char *indate = date; /* save the original pointer */
   int part = 0; /* max 6 parts */
+  int rc = 0;
+  struct when w;
+  initwhen(&w);
 
   while(*date && (part < 6)) {
-    bool found = FALSE;
-
     skip(&date);
 
-    if(ISALPHA(*date)) {
-      /* a name coming up */
-      size_t len = 0;
-      const char *p = date;
-      while(ISALPHA(*p) && (len < NAME_LEN)) {
-        p++;
-        len++;
-      }
-
-      if(len != NAME_LEN) {
-        if(wdaynum == -1) {
-          wdaynum = checkday(date, len);
-          if(wdaynum != -1)
-            found = TRUE;
-        }
-        if(!found && (monnum == -1)) {
-          monnum = checkmonth(date, len);
-          if(monnum != -1)
-            found = TRUE;
-        }
-
-        if(!found && (tzoff == -1)) {
-          /* this just must be a time zone string */
-          tzoff = checktz(date, len);
-          if(tzoff != -1)
-            found = TRUE;
-        }
-      }
-      if(!found)
-        return PARSEDATE_FAIL; /* bad string */
-
-      date += len;
-    }
-    else if(ISDIGIT(*date)) {
-      /* a digit */
-      int val;
-      char *end;
-      if((secnum == -1) &&
-         match_time(date, &hournum, &minnum, &secnum, &end)) {
-        /* time stamp */
-        date = end;
-      }
-      else {
-        long lval;
-        int error;
-        int old_errno;
-
-        old_errno = errno;
-        errno = 0;
-        lval = strtol(date, &end, 10);
-        error = errno;
-        if(errno != old_errno)
-          errno = old_errno;
-
-        if(error)
-          return PARSEDATE_FAIL;
-
-#if LONG_MAX != INT_MAX
-        if((lval > (long)INT_MAX) || (lval < (long)INT_MIN))
-          return PARSEDATE_FAIL;
-#endif
-
-        val = curlx_sltosi(lval);
-
-        if((tzoff == -1) &&
-           ((end - date) == 4) &&
-           (val <= 1400) &&
-           (indate< date) &&
-           ((date[-1] == '+' || date[-1] == '-'))) {
-          /* four digits and a value less than or equal to 1400 (to take into
-             account all sorts of funny time zone diffs) and it is preceded
-             with a plus or minus. This is a time zone indication.  1400 is
-             picked since +1300 is frequently used and +1400 is mentioned as
-             an edge number in the document "ISO C 200X Proposal: Timezone
-             Functions" at http://david.tribble.com/text/c0xtimezone.html If
-             anyone has a more authoritative source for the exact maximum time
-             zone offsets, please speak up! */
-          found = TRUE;
-          tzoff = (val/100 * 60 + val%100)*60;
-
-          /* the + and - prefix indicates the local time compared to GMT,
-             this we need their reversed math to get what we want */
-          tzoff = date[-1]=='+'?-tzoff:tzoff;
-        }
-
-        if(((end - date) == 8) &&
-           (yearnum == -1) &&
-           (monnum == -1) &&
-           (mdaynum == -1)) {
-          /* 8 digits, no year, month or day yet. This is YYYYMMDD */
-          found = TRUE;
-          yearnum = val/10000;
-          monnum = (val%10000)/100-1; /* month is 0 - 11 */
-          mdaynum = val%100;
-        }
-
-        if(!found && (dignext == DATE_MDAY) && (mdaynum == -1)) {
-          if((val > 0) && (val<32)) {
-            mdaynum = val;
-            found = TRUE;
-          }
-          dignext = DATE_YEAR;
-        }
-
-        if(!found && (dignext == DATE_YEAR) && (yearnum == -1)) {
-          yearnum = val;
-          found = TRUE;
-          if(yearnum < 100) {
-            if(yearnum > 70)
-              yearnum += 1900;
-            else
-              yearnum += 2000;
-          }
-          if(mdaynum == -1)
-            dignext = DATE_MDAY;
-        }
-
-        if(!found)
-          return PARSEDATE_FAIL;
-
-        date = end;
-      }
-    }
+    if(ISALPHA(*date))
+      rc = datestring(&date, &w);
+    else if(ISDIGIT(*date))
+      rc = datenum(indate, &date, &w, &dignext);
+    if(rc)
+      return rc;
 
     part++;
   }
 
-  if(-1 == secnum)
-    secnum = minnum = hournum = 0; /* no time, make it zero */
+  rc = datecheck(&w);
+  if(rc)
+    return rc;
 
-  if((-1 == mdaynum) ||
-     (-1 == monnum) ||
-     (-1 == yearnum))
-    /* lacks vital info, fail */
-    return PARSEDATE_FAIL;
+  seconds = time2epoch(&w); /* get number of seconds */
+  tzadjust(&seconds, &w); /* handle the time zone offset */
+  rc = mktimet(seconds, output); /* squeeze seconds into a time_t */
 
-#ifdef HAVE_TIME_T_UNSIGNED
-  if(yearnum < 1970) {
-    /* only positive numbers cannot return earlier */
-    *output = TIME_T_MIN;
-    return PARSEDATE_SOONER;
-  }
-#endif
-
-#if (SIZEOF_TIME_T < 5)
-
-#ifdef HAVE_TIME_T_UNSIGNED
-  /* an unsigned 32 bit time_t can only hold dates to 2106 */
-  if(yearnum > 2105) {
-    *output = TIME_T_MAX;
-    return PARSEDATE_LATER;
-  }
-#else
-  /* a signed 32 bit time_t can only hold dates to the beginning of 2038 */
-  if(yearnum > 2037) {
-    *output = TIME_T_MAX;
-    return PARSEDATE_LATER;
-  }
-  if(yearnum < 1903) {
-    *output = TIME_T_MIN;
-    return PARSEDATE_SOONER;
-  }
-#endif
-
-#else
-  /* The Gregorian calendar was introduced 1582 */
-  if(yearnum < 1583)
-    return PARSEDATE_FAIL;
-#endif
-
-  if((mdaynum > 31) || (monnum > 11) ||
-     (hournum > 23) || (minnum > 59) || (secnum > 60))
-    return PARSEDATE_FAIL; /* clearly an illegal date */
-
-  /* time2epoch() returns a time_t. time_t is often 32 bits, sometimes even on
-     architectures that feature 64 bit 'long' but ultimately time_t is the
-     correct data type to use.
-  */
-  t = time2epoch(secnum, minnum, hournum, mdaynum, monnum, yearnum);
-
-  /* Add the time zone diff between local time zone and GMT. */
-  if(tzoff == -1)
-    tzoff = 0;
-
-  if((tzoff > 0) && (t > TIME_T_MAX - tzoff)) {
-    *output = TIME_T_MAX;
-    return PARSEDATE_LATER; /* time_t overflow */
-  }
-
-  t += tzoff;
-
-  *output = t;
-
-  return PARSEDATE_OK;
+  return rc;
 }
 #else
 /* disabled */
@@ -579,14 +582,14 @@ static int parsedate(const char *date, time_t *output)
 }
 #endif
 
-time_t curl_getdate(const char *p, const time_t *now)
+time_t curl_getdate(const char *p, const time_t *unused)
 {
   time_t parsed = -1;
   int rc = parsedate(p, &parsed);
-  (void)now; /* legacy argument from the past that we ignore */
+  (void)unused; /* legacy argument from the past that we ignore */
 
   if(rc == PARSEDATE_OK) {
-    if(parsed == -1)
+    if(parsed == (time_t)-1)
       /* avoid returning -1 for a working scenario */
       parsed++;
     return parsed;
@@ -597,48 +600,10 @@ time_t curl_getdate(const char *p, const time_t *now)
 
 /* Curl_getdate_capped() differs from curl_getdate() in that this will return
    TIME_T_MAX in case the parsed time value was too big, instead of an
-   error. */
+   error. Returns non-zero on error. */
 
-time_t Curl_getdate_capped(const char *p)
+int Curl_getdate_capped(const char *p, time_t *tp)
 {
-  time_t parsed = -1;
-  int rc = parsedate(p, &parsed);
-
-  switch(rc) {
-  case PARSEDATE_OK:
-    if(parsed == -1)
-      /* avoid returning -1 for a working scenario */
-      parsed++;
-    return parsed;
-  case PARSEDATE_LATER:
-    /* this returns the maximum time value */
-    return parsed;
-  default:
-    return -1; /* everything else is fail */
-  }
-  /* UNREACHABLE */
-}
-
-/*
- * Curl_gmtime() is a gmtime() replacement for portability. Do not use the
- * gmtime_r() or gmtime() functions anywhere else but here.
- *
- */
-
-CURLcode Curl_gmtime(time_t intime, struct tm *store)
-{
-  const struct tm *tm;
-#ifdef HAVE_GMTIME_R
-  /* thread-safe version */
-  tm = (struct tm *)gmtime_r(&intime, store);
-#else
-  /* !checksrc! disable BANNEDFUNC 1 */
-  tm = gmtime(&intime);
-  if(tm)
-    *store = *tm; /* copy the pointed struct to the local copy */
-#endif
-
-  if(!tm)
-    return CURLE_BAD_FUNCTION_ARGUMENT;
-  return CURLE_OK;
+  int rc = parsedate(p, tp);
+  return (rc == PARSEDATE_FAIL);
 }
diff --git a/third-party/curl/lib/parsedate.h b/third-party/curl/lib/parsedate.h
index 84c37f1675..ea136bd301 100644
--- a/third-party/curl/lib/parsedate.h
+++ b/third-party/curl/lib/parsedate.h
@@ -23,16 +23,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 extern const char * const Curl_wkday[7];
 extern const char * const Curl_month[12];
 
-CURLcode Curl_gmtime(time_t intime, struct tm *store);
-
-/* Curl_getdate_capped() differs from curl_getdate() in that this will return
+/* Curl_getdate_capped() differs from curl_getdate() in that this returns
    TIME_T_MAX in case the parsed time value was too big, instead of an
    error. */
 
-time_t Curl_getdate_capped(const char *p);
+int Curl_getdate_capped(const char *p, time_t *tp);
 
 #endif /* HEADER_CURL_PARSEDATE_H */
diff --git a/third-party/curl/lib/peer.c b/third-party/curl/lib/peer.c
new file mode 100644
index 0000000000..44bcb52f23
--- /dev/null
+++ b/third-party/curl/lib/peer.c
@@ -0,0 +1,740 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/*
+ * IDN conversions
+ */
+#include "curl_setup.h"
+
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_NETDB_H
+#include <netdb.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+#ifdef HAVE_NET_IF_H
+#include <net/if.h>
+#endif
+#ifdef HAVE_IPHLPAPI_H
+#include <Iphlpapi.h>
+#endif
+#ifdef HAVE_SYS_IOCTL_H
+#include <sys/ioctl.h>
+#endif
+#ifdef HAVE_SYS_PARAM_H
+#include <sys/param.h>
+#endif
+
+#ifdef __VMS
+#include <in.h>
+#include <inet.h>
+#endif
+
+#ifdef HAVE_SYS_UN_H
+#include <sys/un.h>
+#endif
+
+#if defined(HAVE_IF_NAMETOINDEX) && defined(USE_WINSOCK)
+#if defined(__MINGW32__) && (__MINGW64_VERSION_MAJOR <= 5)
+#include <wincrypt.h>  /* workaround for old mingw-w64 missing to include it */
+#endif
+#include <iphlpapi.h>
+#endif
+
+#include "curl_addrinfo.h"
+#include "curl_trc.h"
+#include "protocol.h"
+#include "http_proxy.h"
+#include "idn.h"
+#include "curlx/strdup.h"
+#include "curlx/strparse.h"
+#include "peer.h"
+#include "urldata.h"
+#include "url.h"
+#include "vtls/vtls.h"
+
+struct peer_parse {
+  const struct Curl_scheme *scheme;
+  struct Curl_str host_user;
+  struct Curl_str host;
+  struct Curl_str zoneid;
+  char *tmp_host_user;
+  char *tmp_host;
+  char *tmp_zoneid;
+  uint32_t scopeid;
+  uint16_t port;
+  bool ipv6;
+  bool unix_socket;
+  bool abstract_uds;
+};
+
+static void peer_parse_clear(struct peer_parse *pp)
+{
+  curlx_free(pp->tmp_host_user);
+  curlx_free(pp->tmp_host);
+  curlx_free(pp->tmp_zoneid);
+  memset(pp, 0, sizeof(*pp));
+}
+
+static CURLcode peer_create(struct peer_parse *pp,
+                            struct Curl_peer **ppeer)
+{
+  struct Curl_peer *peer = NULL;
+  CURLcode result = CURLE_OK;
+  size_t zone_alen = 0, host_alen = 0;
+
+  if(!pp || !pp->scheme)
+    return CURLE_FAILED_INIT;
+  if(!pp->host.len && !(pp->scheme->flags & PROTOPT_NONETWORK))
+    return CURLE_FAILED_INIT;
+
+  if((pp->host.str != pp->host_user.str) ||
+     (pp->host.len != pp->host_user.len)) {
+    host_alen = pp->host.len + 1;
+  }
+  zone_alen = pp->zoneid.len ? (pp->zoneid.len + 1) : 0;
+
+  /* null-terminator already part of struct */
+  peer = curlx_calloc(1, sizeof(*peer) +
+                         pp->host_user.len + host_alen + zone_alen);
+  if(!peer) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  peer->refcount = 1;
+  peer->scheme = pp->scheme;
+  peer->hostname = peer->user_hostname;
+  peer->port = pp->port;
+  peer->scopeid = pp->scopeid;
+  peer->ipv6 = pp->ipv6;
+  peer->unix_socket = pp->unix_socket;
+  peer->abstract_uds = pp->abstract_uds;
+
+  if(pp->host_user.len)
+    memcpy(peer->user_hostname, pp->host_user.str, pp->host_user.len);
+
+  if(host_alen) {
+    peer->hostname = peer->user_hostname + pp->host_user.len + 1;
+    memcpy(peer->hostname, pp->host.str, pp->host.len);
+  }
+
+  if(zone_alen) {
+    peer->zoneid = peer->user_hostname + pp->host_user.len + 1 + host_alen;
+    memcpy(peer->zoneid, pp->zoneid.str, pp->zoneid.len);
+#ifdef USE_IPV6
+    /* Determine scope_id if not already provided */
+    if(!peer->scopeid) {
+      const char *p = peer->zoneid;
+      curl_off_t scope;
+      if(!curlx_str_number(&p, &scope, UINT_MAX)) {
+        /* A plain number, use it directly as a scope id. */
+        peer->scopeid = (uint32_t)scope;
+      }
+#ifdef HAVE_IF_NAMETOINDEX
+      else {
+        /* Zone identifier is not numeric */
+        unsigned int idx = 0;
+        idx = if_nametoindex(peer->zoneid);
+        if(idx) {
+          peer->scopeid = (uint32_t)idx;
+        }
+        else {
+          /* Do we want to return an error here? */
+        }
+      }
+#endif /* HAVE_IF_NAMETOINDEX */
+    }
+#endif /* USE_IPV6 */
+  }
+
+out:
+  if(!result)
+    *ppeer = peer;
+  else
+    Curl_peer_unlink(&peer);
+  return result;
+}
+
+static CURLcode peer_parse_host(struct Curl_easy *data,
+                                struct peer_parse *pp,
+                                bool scan_for_ipv6)
+{
+  if(!pp || !pp->host_user.str || !pp->host_user.len)
+    return CURLE_FAILED_INIT;
+
+  if(pp->host_user.str[0] == '[') {
+    const char *s = pp->host_user.str + 1;
+    struct Curl_str tmp;
+    if(curlx_str_until(&s, &tmp, pp->host_user.len - 1, ']'))
+      return CURLE_URL_MALFORMAT;
+
+    if(!Curl_looks_like_ipv6(tmp.str, tmp.len, TRUE,
+                             &pp->host, &pp->zoneid)) {
+      failf(data, "Invalid IPv6 address format in '%.*s'",
+            (int)pp->host_user.len, pp->host_user.str);
+      return CURLE_URL_MALFORMAT;
+    }
+    pp->ipv6 = TRUE;
+  }
+  else {
+#ifdef USE_IDN
+    if(!Curl_is_ASCII_str(&pp->host_user)) {
+      CURLcode result;
+      if(!pp->tmp_host_user) {
+        /* need a null-terminated string for IDN */
+        pp->tmp_host_user = curlx_memdup0(pp->host_user.str,
+                                          pp->host_user.len);
+        if(!pp->tmp_host_user)
+          return CURLE_OUT_OF_MEMORY;
+      }
+      result = Curl_idn_decode(pp->tmp_host_user, &pp->tmp_host);
+      if(result)
+        return result;
+      pp->host.str = pp->tmp_host;
+      pp->host.len = strlen(pp->host.str);
+    }
+    else
+#endif
+    if(scan_for_ipv6 &&
+       Curl_looks_like_ipv6(pp->host_user.str, pp->host_user.len, TRUE,
+                            &pp->host, &pp->zoneid)) {
+      if(pp->host_user.len < MAX_IPADR_LEN) {
+        char tmp[MAX_IPADR_LEN];
+        memcpy(tmp, pp->host_user.str, pp->host_user.len);
+        tmp[pp->host_user.len] = 0;
+        pp->ipv6 = !Curl_is_ipv4addr(tmp);
+      }
+      else
+        pp->ipv6 = TRUE;
+    }
+    else
+      pp->host = pp->host_user;
+  }
+  return CURLE_OK;
+}
+
+CURLcode Curl_peer_create(struct Curl_easy *data,
+                          const struct Curl_scheme *scheme,
+                          const char *hostname,
+                          uint16_t port,
+                          struct Curl_peer **ppeer)
+{
+  struct peer_parse pp;
+  CURLcode result;
+
+  Curl_peer_unlink(ppeer);
+  memset(&pp, 0, sizeof(pp));
+  pp.scheme = scheme;
+  pp.host_user.str = hostname;
+  pp.host_user.len = strlen(hostname);
+  pp.port = port;
+
+  result = peer_parse_host(data, &pp, TRUE);
+  if(!result)
+    result = peer_create(&pp, ppeer);
+
+  peer_parse_clear(&pp);
+  return result;
+}
+
+#ifdef USE_UNIX_SOCKETS
+CURLcode Curl_peer_uds_create(const struct Curl_scheme *scheme,
+                              const char *path,
+                              bool abstract_unix_socket,
+                              struct Curl_peer **ppeer)
+{
+  struct peer_parse pp;
+  size_t pathlen = path ? strlen(path) : 0;
+  CURLcode result = CURLE_OK;
+
+  Curl_peer_unlink(ppeer);
+  memset(&pp, 0, sizeof(pp));
+  if(!scheme)
+    return CURLE_FAILED_INIT;
+  if(!pathlen)
+    return CURLE_FAILED_INIT;
+
+  pp.scheme = scheme;
+  pp.host_user.str = pp.host.str = path;
+  pp.host_user.len = pp.host.len = pathlen;
+  pp.unix_socket = TRUE;
+  pp.abstract_uds = abstract_unix_socket;
+
+  result = peer_create(&pp, ppeer);
+  peer_parse_clear(&pp);
+  return result;
+}
+#endif /* USE_UNIX_SOCKETS */
+
+void Curl_peer_link(struct Curl_peer **pdest, struct Curl_peer *src)
+{
+  if(*pdest != src) {
+    Curl_peer_unlink(pdest);
+    *pdest = src;
+    if(src) {
+      DEBUGASSERT(src->refcount < UINT32_MAX);
+      src->refcount++;
+    }
+  }
+}
+
+void Curl_peer_unlink(struct Curl_peer **ppeer)
+{
+  if(*ppeer) {
+    struct Curl_peer *peer = *ppeer;
+
+    DEBUGASSERT(peer->refcount);
+    *ppeer = NULL;
+    if(peer->refcount)
+      peer->refcount--;
+    if(!peer->refcount) {
+      curlx_free(peer);
+    }
+  }
+}
+
+bool Curl_peer_equal(struct Curl_peer *p1, struct Curl_peer *p2)
+{
+  return (p1 == p2) ||
+         (p1 && p2 &&
+          (p1->scheme == p2->scheme) &&
+          Curl_peer_same_destination(p1, p2));
+}
+
+static bool peer_same_hostname(struct Curl_peer *p1, struct Curl_peer *p2)
+{
+  /* UNIX domain socket paths must be compared case-sensitive,
+   * as many filesystem are like that. */
+  return (p1->unix_socket == p2->unix_socket) &&
+         (p1->abstract_uds == p2->abstract_uds) &&
+         (p1->ipv6 == p2->ipv6) &&
+         (p1->unix_socket ?
+          !strcmp(p1->hostname, p2->hostname) :
+          curl_strequal(p1->hostname, p2->hostname));
+}
+
+bool Curl_peer_same_destination(struct Curl_peer *p1, struct Curl_peer *p2)
+{
+  return (p1 == p2) ||
+         (p1 && p2 &&
+          (p1->port == p2->port) &&
+          peer_same_hostname(p1, p2) &&
+          (p1->scopeid == p2->scopeid) &&
+          (p1->scopeid || curl_strequal(p1->zoneid, p2->zoneid)));
+}
+
+CURLcode Curl_peer_from_url(CURLU *uh, struct Curl_easy *data,
+                            uint16_t port_override,
+                            uint32_t scopeid_override,
+                            struct urlpieces *up,
+                            struct Curl_peer **ppeer)
+{
+  struct peer_parse pp;
+  char *zoneid = NULL;
+  CURLUcode uc;
+  CURLcode result;
+
+  Curl_peer_unlink(ppeer);
+  memset(&pp, 0, sizeof(pp));
+
+  curlx_safefree(up->scheme);
+  uc = curl_url_get(uh, CURLUPART_SCHEME, &up->scheme, 0);
+  if(uc)
+    return Curl_uc_to_curlcode(uc);
+  pp.scheme = Curl_get_scheme(up->scheme);
+  if(!pp.scheme) {
+    failf(data, "Protocol \"%s\" not supported%s", up->scheme,
+          data->state.this_is_a_follow ? " (in redirect)" : "");
+    result = CURLE_UNSUPPORTED_PROTOCOL;
+    goto out;
+  }
+
+  curlx_safefree(up->hostname);
+  uc = curl_url_get(uh, CURLUPART_HOST, &up->hostname, 0);
+  if(uc) {
+    if((uc == CURLUE_NO_HOST) && (pp.scheme->flags & PROTOPT_NONETWORK))
+      ; /* acceptable */
+    else {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+  }
+  else if(strlen(up->hostname) > MAX_URL_LEN) {
+    failf(data, "Too long hostname (maximum is %d)", MAX_URL_LEN);
+    result = CURLE_URL_MALFORMAT;
+    goto out;
+  }
+
+  pp.host_user.str = up->hostname ? up->hostname : "";
+  pp.host_user.len = strlen(pp.host_user.str);
+  if(pp.host_user.len) {
+    result = peer_parse_host(data, &pp, FALSE);
+    if(result)
+      goto out;
+  }
+  else
+    pp.host = pp.host_user;
+
+  curlx_safefree(up->port);
+  if(port_override) {
+    /* if set, we use this instead of the port possibly given in the URL */
+    char portbuf[16];
+    curl_msnprintf(portbuf, sizeof(portbuf), "%d", port_override);
+    uc = curl_url_set(uh, CURLUPART_PORT, portbuf, 0);
+    if(uc) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+    else
+      pp.port = port_override;
+  }
+  else {
+    uc = curl_url_get(uh, CURLUPART_PORT, &up->port, CURLU_DEFAULT_PORT);
+    if(uc) {
+      if(uc == CURLUE_OUT_OF_MEMORY) {
+        result = CURLE_OUT_OF_MEMORY;
+        goto out;
+      }
+      else if(!(pp.scheme->flags & PROTOPT_NONETWORK)) {
+        result = CURLE_URL_MALFORMAT;
+        goto out;
+      }
+      /* no port ok when not a network scheme */
+    }
+    else {
+      const char *p = up->port;
+      curl_off_t offt;
+      if(curlx_str_number(&p, &offt, 0xffff))
+        return CURLE_URL_MALFORMAT;
+      pp.port = (uint16_t)offt;
+    }
+  }
+
+  if(scopeid_override)
+    /* Override any scope id from an URL zone. */
+    pp.scopeid = scopeid_override;
+  else {
+    if(curl_url_get(uh, CURLUPART_ZONEID, &zoneid, 0) ==
+       CURLUE_OUT_OF_MEMORY) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+    if(zoneid) {
+      pp.zoneid.str = zoneid;
+      pp.zoneid.len = strlen(zoneid);
+    }
+  }
+
+  result = peer_create(&pp, ppeer);
+  if(result)
+    failf(data, "Error %d creating peer for %s:%u",
+          (int)result, pp.host_user.str, pp.port);
+
+out:
+  peer_parse_clear(&pp);
+  curlx_free(zoneid);
+  return result;
+}
+
+/* Parse a "host:port" string to connect to into a peer.
+ * IPv6 addresses might appear in brackets or without them. */
+CURLcode Curl_peer_from_connect_to(struct Curl_easy *data,
+                                   const struct Curl_peer *dest,
+                                   const char *connect_to,
+                                   struct Curl_peer **ppeer)
+{
+  struct peer_parse pp;
+  const char *portstr = NULL;
+  CURLcode result;
+
+  Curl_peer_unlink(ppeer);
+  memset(&pp, 0, sizeof(pp));
+  if(!connect_to || !*connect_to)
+    return CURLE_FAILED_INIT;
+
+  pp.scheme = dest->scheme;
+
+  /* detect and extract RFC6874-style IPv6-addresses */
+  if(connect_to[0] == '[') {
+    const char *s = strchr(connect_to + 1, ']');
+    if(!s) {
+      failf(data, "Invalid IPv6 address format in '%s'", connect_to);
+      result = CURLE_SETOPT_OPTION_SYNTAX;
+      goto out;
+    }
+    portstr = strchr(s, ':');
+    pp.host_user.str = connect_to;
+    pp.host_user.len = s - pp.host_user.str + 1;
+    pp.ipv6 = TRUE;
+  }
+  else {
+    portstr = strchr(connect_to, ':');
+    pp.host_user.str = connect_to;
+    pp.host_user.len = portstr ?
+      (size_t)(portstr - connect_to) : strlen(connect_to);
+  }
+
+  if(!pp.host_user.len) { /* no hostname found, only port switch */
+    pp.host_user.str = dest->user_hostname;
+    pp.host_user.len = strlen(dest->user_hostname);
+  }
+
+  result = peer_parse_host(data, &pp, FALSE);
+  if(result)
+    goto out;
+
+  if(portstr && portstr[1]) {
+    const char *p = portstr + 1;
+    curl_off_t portparse;
+    if(curlx_str_number(&p, &portparse, 0xffff)) {
+      failf(data, "No valid port number in '%s'", connect_to);
+      result = CURLE_SETOPT_OPTION_SYNTAX;
+      goto out;
+    }
+    pp.port = (uint16_t)portparse; /* we know it will fit */
+  }
+  else
+    pp.port = dest->port;
+
+#ifndef USE_IPV6
+  if(pp.ipv6) {
+    failf(data, "Use of IPv6 in *_CONNECT_TO without IPv6 support built-in");
+    result = CURLE_NOT_BUILT_IN;
+    goto out;
+  }
+#endif
+
+  result = peer_create(&pp, ppeer);
+  CURL_TRC_M(data, "connect-to peer_create2 -> %d", (int)result);
+
+out:
+  CURL_TRC_M(data, "parse connect_to peer: %s -> %d", connect_to, (int)result);
+  peer_parse_clear(&pp);
+  return result;
+}
+
+#ifndef CURL_DISABLE_PROXY
+
+#ifdef USE_UNIX_SOCKETS
+#define UNIX_SOCKET_PREFIX "localhost"
+#endif
+
+CURLcode Curl_scheme_to_proxytype(struct Curl_easy *data,
+                                  const char *scheme,
+                                  uint8_t *proxytype, const char *url)
+{
+  if(!scheme)
+    return CURLE_OK;
+
+  if(curl_strequal("https", scheme)) {
+    if(*proxytype != CURLPROXY_HTTPS2 && *proxytype != CURLPROXY_HTTPS3)
+      *proxytype = CURLPROXY_HTTPS;
+  }
+  else if(curl_strequal("socks5h", scheme))
+    *proxytype = CURLPROXY_SOCKS5_HOSTNAME;
+  else if(curl_strequal("socks5", scheme))
+    *proxytype = CURLPROXY_SOCKS5;
+  else if(curl_strequal("socks4a", scheme))
+    *proxytype = CURLPROXY_SOCKS4A;
+  else if(curl_strequal("socks4", scheme) || curl_strequal("socks", scheme))
+    *proxytype = CURLPROXY_SOCKS4;
+  else if(curl_strequal("http", scheme)) {
+    if(*proxytype != CURLPROXY_HTTP_1_0)
+      *proxytype = CURLPROXY_HTTP;
+  }
+  else {
+    /* Any other xxx:// reject! */
+    failf(data, "Unsupported proxy scheme for \'%s\'", url);
+    return CURLE_COULDNT_CONNECT;
+  }
+  return CURLE_OK;
+}
+
+CURLcode Curl_peer_from_proxy_url(CURLU *uh,
+                                  struct Curl_easy *data,
+                                  const char *url,
+                                  uint8_t proxytype,
+                                  struct Curl_peer **ppeer,
+                                  uint8_t *pproxytype)
+{
+  struct peer_parse pp;
+  char *scheme = NULL;
+  char *portptr = NULL;
+#ifdef USE_UNIX_SOCKETS
+  bool is_socks = FALSE;
+#endif
+  CURLUcode uc;
+  CURLcode result = CURLE_OK;
+
+  Curl_peer_unlink(ppeer);
+  memset(&pp, 0, sizeof(pp));
+  pp.port = CURL_DEFAULT_PROXY_PORT;
+  uc = curl_url_get(uh, CURLUPART_SCHEME, &scheme,
+                    CURLU_NON_SUPPORT_SCHEME | CURLU_NO_GUESS_SCHEME);
+  if(uc) {
+    if(uc == CURLUE_OUT_OF_MEMORY) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+    /* URL came without scheme, the passed `proxytype` determines it */
+    switch(proxytype) {
+    case CURLPROXY_HTTP:
+    case CURLPROXY_HTTP_1_0:
+      pp.scheme = &Curl_scheme_http;
+      break;
+    case CURLPROXY_HTTPS:
+    case CURLPROXY_HTTPS2:
+    case CURLPROXY_HTTPS3:
+      pp.scheme = &Curl_scheme_https;
+      break;
+    case CURLPROXY_SOCKS4:
+      pp.scheme = &Curl_scheme_socks4;
+      break;
+    case CURLPROXY_SOCKS4A:
+      pp.scheme = &Curl_scheme_socks4a;
+      break;
+    case CURLPROXY_SOCKS5:
+      pp.scheme = &Curl_scheme_socks5;
+      break;
+    case CURLPROXY_SOCKS5_HOSTNAME:
+      pp.scheme = &Curl_scheme_socks5h;
+      break;
+    default:
+      failf(data, "Unsupported proxy type %u for \'%s\'", proxytype, url);
+      result = CURLE_COULDNT_RESOLVE_PROXY;
+      goto out;
+    }
+  }
+  else {
+    pp.scheme = Curl_get_scheme(scheme);
+    result = Curl_scheme_to_proxytype(data, scheme, &proxytype, url);
+    if(result)
+      goto out;
+  }
+  DEBUGASSERT(pp.scheme);
+
+  if(CURL_PROXY_IS_HTTPS(proxytype) &&
+     !Curl_ssl_supports(data, SSLSUPP_HTTPS_PROXY)) {
+    failf(data, "Unsupported proxy \'%s\', libcurl is built without the "
+          "HTTPS-proxy support.", url);
+    result = CURLE_NOT_BUILT_IN;
+    goto out;
+  }
+
+  switch(pp.scheme->family) {
+  case CURLPROTO_SOCKS:
+#ifdef USE_UNIX_SOCKETS
+    is_socks = TRUE;
+#endif
+    break;
+  case CURLPROTO_HTTP:
+    break;
+  default:
+    failf(data, "Unsupported proxy protocol for \'%s\'", url);
+    result = CURLE_COULDNT_CONNECT;
+    goto out;
+  }
+
+  uc = curl_url_get(uh, CURLUPART_PORT, &portptr, CURLU_NO_DEFAULT_PORT);
+  if(uc == CURLUE_OUT_OF_MEMORY) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+  if(portptr) {
+    curl_off_t num;
+    const char *p = portptr;
+    if(!curlx_str_number(&p, &num, UINT16_MAX))
+      pp.port = (uint16_t)num;
+    /* Should we not error out when the port number is invalid? */
+    curlx_free(portptr);
+  }
+  else {
+    /* No port in URL, take the set one or the scheme's default */
+    if(data->set.proxyport)
+      pp.port = data->set.proxyport;
+    else
+      pp.port = pp.scheme->defport;
+  }
+
+  /* now, clone the proxy hostname */
+  uc = curl_url_get(uh, CURLUPART_HOST, &pp.tmp_host_user, CURLU_URLDECODE);
+  if(uc) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+  pp.host_user.str = pp.tmp_host_user;
+  pp.host_user.len = strlen(pp.tmp_host_user);
+
+#ifdef USE_UNIX_SOCKETS
+  if(is_socks && curl_strequal(UNIX_SOCKET_PREFIX, pp.tmp_host_user)) {
+    uc = curl_url_get(uh, CURLUPART_PATH, &pp.tmp_host, CURLU_URLDECODE);
+    if(uc) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+    /* path will be "/", if no path was found */
+    if(strcmp("/", pp.tmp_host)) {
+      pp.host.str = pp.tmp_host;
+      pp.host.len = strlen(pp.tmp_host);
+      pp.unix_socket = TRUE;
+    }
+    else {
+      pp.host = pp.host_user;
+    }
+  }
+#endif /* USE_UNIX_SOCKETS */
+
+  if(!pp.host.len) {
+    result = peer_parse_host(data, &pp, FALSE);
+    if(result)
+      goto out;
+  }
+
+  uc = curl_url_get(uh, CURLUPART_ZONEID, &pp.tmp_zoneid, 0);
+  if(uc == CURLUE_OUT_OF_MEMORY) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+  if(pp.tmp_zoneid) {
+    pp.zoneid.str = pp.tmp_zoneid;
+    pp.zoneid.len = strlen(pp.tmp_zoneid);
+  }
+
+  *pproxytype = proxytype;
+  result = peer_create(&pp, ppeer);
+
+out:
+  peer_parse_clear(&pp);
+  curlx_free(scheme);
+#ifdef DEBUGBUILD
+  if(!result)
+    DEBUGASSERT(*ppeer);
+#endif
+  return result;
+}
+
+#endif /* !CURL_DISABLE_PROXY */
diff --git a/third-party/curl/lib/peer.h b/third-party/curl/lib/peer.h
new file mode 100644
index 0000000000..1ceb230739
--- /dev/null
+++ b/third-party/curl/lib/peer.h
@@ -0,0 +1,110 @@
+#ifndef HEADER_CURL_PEER_H
+#define HEADER_CURL_PEER_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+struct Curl_scheme;
+struct urlpieces;
+
+/* if peer hostname starts with this, the peer is a unix domain socket
+ * path, e.g. the remainder after 'localhost'. */
+#define CURL_PEER_UDS_PREFIX "localhost/"
+
+struct Curl_peer {
+  const struct Curl_scheme *scheme; /* url scheme */
+  char *hostname; /* normalized hostname (IDN decoded when supported) */
+  char *zoneid; /* NULL or ipv6 zone identifier */
+  uint32_t refcount;  /* created with 1, freed when dropping to 0 */
+  uint32_t scopeid;  /* != 0, ipv6 scope to use */
+  uint16_t port;
+  BIT(unix_socket); /* hostname is a UDS path without the prefix */
+  BIT(abstract_uds); /* only TRUE when `unix_socket` also TRUE */
+  BIT(ipv6); /* hostname is an IPv6 address stripped of '[]' */
+  char user_hostname[1]; /* hostname supplied by user/url */
+};
+
+/* Create a new peer:
+ * - `peer->user_hostname` is the passed `hostname`
+ * - `peer->hostname` is the normalized `hostname` via
+ *    + IDN conversion if it has non-ASCII characters
+ *    + stripping of surrounding '[]' for URL formatted ipv6 addresses
+ *    + the path alone in case of a unix domain socket, e.g. hostname
+ *      starts with CURL_PEER_UDS_PREFIX and is longer
+ *   Scans for IPv6 addresses even without surrounding '[]'.
+ * - `zoneid` ipv6 zone identifier or NULL
+ * - `scopeid` ipv6 scopeid of zoneid, when known.
+ */
+CURLcode Curl_peer_create(struct Curl_easy *data,
+                          const struct Curl_scheme *scheme,
+                          const char *hostname,
+                          uint16_t port,
+                          struct Curl_peer **ppeer);
+
+#ifdef USE_UNIX_SOCKETS
+CURLcode Curl_peer_uds_create(const struct Curl_scheme *scheme,
+                              const char *path,
+                              bool abstract_unix_socket,
+                              struct Curl_peer **ppeer);
+#endif
+
+/* Unlink any peer in `*pdest`, assign src, increase src
+ * refcount when not NULL. */
+void Curl_peer_link(struct Curl_peer **pdest, struct Curl_peer *src);
+
+/* Drop a reference, peer may be passed as NULL */
+void Curl_peer_unlink(struct Curl_peer **ppeer);
+
+/* TRUE if both peers are NULL or have completely same properties. */
+bool Curl_peer_equal(struct Curl_peer *p1, struct Curl_peer *p2);
+
+/* TRUE if both peers are NULL or have same properties except the scheme. */
+bool Curl_peer_same_destination(struct Curl_peer *p1, struct Curl_peer *p2);
+
+CURLcode Curl_peer_from_url(CURLU *uh, struct Curl_easy *data,
+                            uint16_t port_override,
+                            uint32_t scopeid_override,
+                            struct urlpieces *up,
+                            struct Curl_peer **ppeer);
+
+CURLcode Curl_peer_from_connect_to(struct Curl_easy *data,
+                                   const struct Curl_peer *dest,
+                                   const char *connect_to,
+                                   struct Curl_peer **ppeer);
+
+#ifndef CURL_DISABLE_PROXY
+
+CURLcode Curl_scheme_to_proxytype(struct Curl_easy *data,
+                                  const char *scheme,
+                                  uint8_t *proxytype,
+                                  const char *url);
+
+CURLcode Curl_peer_from_proxy_url(CURLU *uh,
+                                  struct Curl_easy *data,
+                                  const char *url,
+                                  uint8_t proxytype,
+                                  struct Curl_peer **ppeer,
+                                  uint8_t *pproxytype);
+#endif /* !CURL_DISABLE_PROXY */
+
+#endif /* HEADER_CURL_PEER_H */
diff --git a/third-party/curl/lib/pingpong.c b/third-party/curl/lib/pingpong.c
index 136985fc92..b40d968b3f 100644
--- a/third-party/curl/lib/pingpong.c
+++ b/third-party/curl/lib/pingpong.c
@@ -24,56 +24,36 @@
  *   IMAP, POP3, SMTP and whatever more that likes them.
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #include "urldata.h"
-#include "cfilters.h"
-#include "sendf.h"
-#include "select.h"
-#include "progress.h"
-#include "speedcheck.h"
 #include "pingpong.h"
-#include "multiif.h"
-#include "vtls/vtls.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
 
 #ifdef USE_PINGPONG
 
-/* Returns timeout in ms. 0 or negative number means the timeout has already
-   triggered */
-timediff_t Curl_pp_state_timeout(struct Curl_easy *data,
-                                 struct pingpong *pp, bool disconnecting)
+#include "cfilters.h"
+#include "connect.h"
+#include "multiif.h"
+#include "sendf.h"
+#include "curl_trc.h"
+#include "select.h"
+#include "progress.h"
+
+timediff_t Curl_pp_state_timeleft_ms(struct Curl_easy *data,
+                                     struct pingpong *pp)
 {
-  struct connectdata *conn = data->conn;
-  timediff_t timeout_ms; /* in milliseconds */
-  timediff_t response_time = (data->set.server_response_timeout)?
-    data->set.server_response_timeout: pp->response_time;
+  timediff_t xfer_remain_ms;
+  timediff_t remain_ms = data->set.server_response_timeout ?
+    data->set.server_response_timeout : PINGPONG_TIMEOUT_MS;
 
-  /* if CURLOPT_SERVER_RESPONSE_TIMEOUT is set, use that to determine
-     remaining time, or use pp->response because SERVER_RESPONSE_TIMEOUT is
-     supposed to govern the response for any given server response, not for
-     the time from connect to the given server response. */
-
-  /* Without a requested timeout, we only wait 'response_time' seconds for the
-     full response to arrive before we bail out */
-  timeout_ms = response_time -
-    Curl_timediff(Curl_now(), pp->response); /* spent time */
-
-  if(data->set.timeout && !disconnecting) {
-    /* if timeout is requested, find out how much remaining time we have */
-    timediff_t timeout2_ms = data->set.timeout - /* timeout time */
-      Curl_timediff(Curl_now(), conn->now); /* spent time */
-
-    /* pick the lowest number */
-    timeout_ms = CURLMIN(timeout_ms, timeout2_ms);
-  }
-
-  return timeout_ms;
+  /* If the overall transfer has less time remaining than pingpong
+   * has otherwise for the state, return that. */
+  remain_ms -= curlx_ptimediff_ms(Curl_pgrs_now(data), &pp->response);
+  /* transfer remaining time is 0, when it has no timeout. */
+  xfer_remain_ms = Curl_timeleft_ms(data);
+  if(xfer_remain_ms)
+    return CURLMIN(remain_ms, xfer_remain_ms);
+  return remain_ms;
 }
 
 /*
@@ -87,7 +67,7 @@ CURLcode Curl_pp_statemach(struct Curl_easy *data,
   curl_socket_t sock = conn->sock[FIRSTSOCKET];
   int rc;
   timediff_t interval_ms;
-  timediff_t timeout_ms = Curl_pp_state_timeout(data, pp, disconnecting);
+  timediff_t timeout_ms = Curl_pp_state_timeleft_ms(data, pp);
   CURLcode result = CURLE_OK;
 
   if(timeout_ms <= 0) {
@@ -105,25 +85,22 @@ CURLcode Curl_pp_statemach(struct Curl_easy *data,
 
   if(Curl_conn_data_pending(data, FIRSTSOCKET))
     rc = 1;
-  else if(Curl_pp_moredata(pp))
-    /* We are receiving and there is data in the cache so just read it */
+  else if(pp->overflow)
+    /* We are receiving and there is data in the cache so read it */
     rc = 1;
   else if(!pp->sendleft && Curl_conn_data_pending(data, FIRSTSOCKET))
     /* We are receiving and there is data ready in the SSL library */
     rc = 1;
-  else
-    rc = Curl_socket_check(pp->sendleft?CURL_SOCKET_BAD:sock, /* reading */
+  else {
+    rc = Curl_socket_check(pp->sendleft ? CURL_SOCKET_BAD : sock, /* reading */
                            CURL_SOCKET_BAD,
-                           pp->sendleft?sock:CURL_SOCKET_BAD, /* writing */
+                           pp->sendleft ? sock : CURL_SOCKET_BAD, /* writing */
                            interval_ms);
+  }
 
   if(block) {
-    /* if we didn't wait, we don't have to spend time on this now */
-    if(Curl_pgrsUpdate(data))
-      result = CURLE_ABORTED_BY_CALLBACK;
-    else
-      result = Curl_speedcheck(data, Curl_now());
-
+    /* if we did not wait, we do not have to spend time on this now */
+    result = Curl_pgrsCheck(data);
     if(result)
       return result;
   }
@@ -134,24 +111,22 @@ CURLcode Curl_pp_statemach(struct Curl_easy *data,
   }
   else if(rc)
     result = pp->statemachine(data, data->conn);
+  else if(disconnecting)
+    return CURLE_OPERATION_TIMEDOUT;
 
   return result;
 }
 
 /* initialize stuff to prepare for reading a fresh new response */
-void Curl_pp_init(struct Curl_easy *data, struct pingpong *pp)
+void Curl_pp_init(struct pingpong *pp, const struct curltime *pnow)
 {
-  DEBUGASSERT(data);
+  DEBUGASSERT(!pp->initialized);
   pp->nread_resp = 0;
-  pp->linestart_resp = data->state.buffer;
+  pp->response = *pnow; /* start response time-out */
   pp->pending_resp = TRUE;
-  pp->response = Curl_now(); /* start response time-out now! */
-}
-
-/* setup for the coming transfer */
-void Curl_pp_setup(struct pingpong *pp)
-{
-  Curl_dyn_init(&pp->sendbuf, DYN_PINGPPONG_CMD);
+  curlx_dyn_init(&pp->sendbuf, DYN_PINGPPONG_CMD);
+  curlx_dyn_init(&pp->recvbuf, DYN_PINGPPONG_CMD);
+  pp->initialized = TRUE;
 }
 
 /***********************************************************************
@@ -169,53 +144,45 @@ CURLcode Curl_pp_vsendf(struct Curl_easy *data,
                         const char *fmt,
                         va_list args)
 {
-  ssize_t bytes_written = 0;
+  size_t bytes_written = 0;
   size_t write_len;
   char *s;
   CURLcode result;
   struct connectdata *conn = data->conn;
 
-#ifdef HAVE_GSSAPI
-  enum protection_level data_sec;
-#endif
-
   DEBUGASSERT(pp->sendleft == 0);
   DEBUGASSERT(pp->sendsize == 0);
-  DEBUGASSERT(pp->sendthis == NULL);
+  DEBUGASSERT(!pp->sendthis);
 
   if(!conn)
-    /* can't send without a connection! */
+    /* cannot send without a connection! */
     return CURLE_SEND_ERROR;
 
-  Curl_dyn_reset(&pp->sendbuf);
-  result = Curl_dyn_vaddf(&pp->sendbuf, fmt, args);
+  curlx_dyn_reset(&pp->sendbuf);
+  result = curlx_dyn_vaddf(&pp->sendbuf, fmt, args);
   if(result)
     return result;
 
   /* append CRLF */
-  result = Curl_dyn_addn(&pp->sendbuf, "\r\n", 2);
+  result = curlx_dyn_addn(&pp->sendbuf, "\r\n", 2);
   if(result)
     return result;
 
-  write_len = Curl_dyn_len(&pp->sendbuf);
-  s = Curl_dyn_ptr(&pp->sendbuf);
-  Curl_pp_init(data, pp);
+  pp->pending_resp = TRUE;
+  write_len = curlx_dyn_len(&pp->sendbuf);
+  s = curlx_dyn_ptr(&pp->sendbuf);
 
-#ifdef HAVE_GSSAPI
-  conn->data_prot = PROT_CMD;
-#endif
-  result = Curl_nwrite(data, FIRSTSOCKET, s, write_len, &bytes_written);
-  if(result)
+  result = Curl_conn_send(data, FIRSTSOCKET, s, write_len, FALSE,
+                          &bytes_written);
+  if(result == CURLE_AGAIN) {
+    bytes_written = 0;
+  }
+  else if(result)
     return result;
-#ifdef HAVE_GSSAPI
-  data_sec = conn->data_prot;
-  DEBUGASSERT(data_sec > PROT_NONE && data_sec < PROT_LAST);
-  conn->data_prot = (unsigned char)data_sec;
-#endif
 
-  Curl_debug(data, CURLINFO_HEADER_OUT, s, (size_t)bytes_written);
+  Curl_debug(data, CURLINFO_HEADER_OUT, s, bytes_written);
 
-  if(bytes_written != (ssize_t)write_len) {
+  if(bytes_written != write_len) {
     /* the whole chunk was not sent, keep it around and adjust sizes */
     pp->sendthis = s;
     pp->sendsize = write_len;
@@ -224,13 +191,12 @@ CURLcode Curl_pp_vsendf(struct Curl_easy *data,
   else {
     pp->sendthis = NULL;
     pp->sendleft = pp->sendsize = 0;
-    pp->response = Curl_now();
+    pp->response = *Curl_pgrs_now(data);
   }
 
   return CURLE_OK;
 }
 
-
 /***********************************************************************
  *
  * Curl_pp_sendf()
@@ -255,247 +221,192 @@ CURLcode Curl_pp_sendf(struct Curl_easy *data, struct pingpong *pp,
   return result;
 }
 
+static CURLcode pingpong_read(struct Curl_easy *data,
+                              int sockindex,
+                              char *buffer,
+                              size_t buflen,
+                              size_t *nread)
+{
+  return Curl_conn_recv(data, sockindex, buffer, buflen, nread);
+}
+
 /*
  * Curl_pp_readresp()
  *
  * Reads a piece of a server response.
  */
 CURLcode Curl_pp_readresp(struct Curl_easy *data,
-                          curl_socket_t sockfd,
+                          int sockindex,
                           struct pingpong *pp,
                           int *code, /* return the server code if done */
                           size_t *size) /* size of the response */
 {
-  ssize_t perline; /* count bytes per line */
-  bool keepon = TRUE;
-  ssize_t gotbytes;
-  char *ptr;
   struct connectdata *conn = data->conn;
-  char * const buf = data->state.buffer;
   CURLcode result = CURLE_OK;
+  size_t gotbytes;
+  char buffer[900];
 
   *code = 0; /* 0 for errors or not done */
   *size = 0;
 
-  ptr = buf + pp->nread_resp;
+  do {
+    gotbytes = 0;
+    if(pp->nfinal) {
+      /* a previous call left this many bytes in the beginning of the buffer as
+         that was the final line; now ditch that */
+      size_t full = curlx_dyn_len(&pp->recvbuf);
 
-  /* number of bytes in the current line, so far */
-  perline = (ssize_t)(ptr-pp->linestart_resp);
+      /* trim off the "final" leading part */
+      curlx_dyn_tail(&pp->recvbuf, full - pp->nfinal);
 
-  while((pp->nread_resp < (size_t)data->set.buffer_size) &&
-        (keepon && !result)) {
-
-    if(pp->cache) {
-      /* we had data in the "cache", copy that instead of doing an actual
-       * read
-       *
-       * pp->cache_size is cast to ssize_t here.  This should be safe, because
-       * it would have been populated with something of size int to begin
-       * with, even though its datatype may be larger than an int.
-       */
-      if((ptr + pp->cache_size) > (buf + data->set.buffer_size + 1)) {
-        failf(data, "cached response data too big to handle");
-        return CURLE_WEIRD_SERVER_REPLY;
-      }
-      memcpy(ptr, pp->cache, pp->cache_size);
-      gotbytes = (ssize_t)pp->cache_size;
-      free(pp->cache);    /* free the cache */
-      pp->cache = NULL;   /* clear the pointer */
-      pp->cache_size = 0; /* zero the size just in case */
+      pp->nfinal = 0; /* now gone */
     }
-    else {
-#ifdef HAVE_GSSAPI
-      enum protection_level prot = conn->data_prot;
-      conn->data_prot = PROT_CLEAR;
-#endif
-      DEBUGASSERT((ptr + data->set.buffer_size - pp->nread_resp) <=
-                  (buf + data->set.buffer_size + 1));
-      result = Curl_read(data, sockfd, ptr,
-                         data->set.buffer_size - pp->nread_resp,
-                         &gotbytes);
-#ifdef HAVE_GSSAPI
-      DEBUGASSERT(prot  > PROT_NONE && prot < PROT_LAST);
-      conn->data_prot = (unsigned char)prot;
-#endif
+    if(!pp->overflow) {
+      result = pingpong_read(data, sockindex, buffer, sizeof(buffer),
+                             &gotbytes);
       if(result == CURLE_AGAIN)
-        return CURLE_OK; /* return */
+        return CURLE_OK;
 
       if(result)
-        /* Set outer result variable to this error. */
-        keepon = FALSE;
-    }
+        return result;
 
-    if(!keepon)
-      ;
-    else if(gotbytes <= 0) {
-      keepon = FALSE;
-      result = CURLE_RECV_ERROR;
-      failf(data, "response reading failed (errno: %d)", SOCKERRNO);
-    }
-    else {
-      /* we got a whole chunk of data, which can be anything from one
-       * byte to a set of lines and possible just a piece of the last
-       * line */
-      ssize_t i;
-      ssize_t clipamount = 0;
-      bool restart = FALSE;
+      if(!gotbytes) {
+        failf(data, "response reading failed (errno: %d)", SOCKERRNO);
+        return CURLE_RECV_ERROR;
+      }
+
+      result = curlx_dyn_addn(&pp->recvbuf, buffer, gotbytes);
+      if(result)
+        return result;
 
       data->req.headerbytecount += (unsigned int)gotbytes;
 
       pp->nread_resp += gotbytes;
-      for(i = 0; i < gotbytes; ptr++, i++) {
-        perline++;
-        if(*ptr == '\n') {
-          /* a newline is CRLF in pp-talk, so the CR is ignored as
-             the line isn't really terminated until the LF comes */
+    }
 
-          /* output debug output if that is requested */
-#ifdef HAVE_GSSAPI
-          if(!conn->sec_complete)
-#endif
-            Curl_debug(data, CURLINFO_HEADER_IN,
-                       pp->linestart_resp, (size_t)perline);
+    do {
+      const char *line = curlx_dyn_ptr(&pp->recvbuf);
+      const char *nl = memchr(line, '\n', curlx_dyn_len(&pp->recvbuf));
+      if(nl) {
+        /* a newline is CRLF in pp-talk, so the CR is ignored as
+           the line is not really terminated until the LF comes */
+        size_t length = nl - line + 1;
 
-          /*
-           * We pass all response-lines to the callback function registered
-           * for "headers". The response lines can be seen as a kind of
-           * headers.
-           */
-          result = Curl_client_write(data, CLIENTWRITE_HEADER,
-                                     pp->linestart_resp, perline);
-          if(result)
-            return result;
-
-          if(pp->endofresp(data, conn, pp->linestart_resp, perline, code)) {
-            /* This is the end of the last line, copy the last line to the
-               start of the buffer and null-terminate, for old times sake */
-            size_t n = ptr - pp->linestart_resp;
-            memmove(buf, pp->linestart_resp, n);
-            buf[n] = 0; /* null-terminate */
-            keepon = FALSE;
-            pp->linestart_resp = ptr + 1; /* advance pointer */
-            i++; /* skip this before getting out */
-
-            *size = pp->nread_resp; /* size of the response */
-            pp->nread_resp = 0; /* restart */
-            break;
-          }
-          perline = 0; /* line starts over here */
-          pp->linestart_resp = ptr + 1;
+        if(memchr(line, 0, length)) {
+          /* The response line is passed on as a "header" below, so reject an
+             embedded nul the same way verify_header() does for HTTP. */
+          failf(data, "Nul byte in server response line");
+          return CURLE_WEIRD_SERVER_REPLY;
         }
-      }
 
-      if(!keepon && (i != gotbytes)) {
-        /* We found the end of the response lines, but we didn't parse the
-           full chunk of data we have read from the server. We therefore need
-           to store the rest of the data to be checked on the next invoke as
-           it may actually contain another end of response already! */
-        clipamount = gotbytes - i;
-        restart = TRUE;
-        DEBUGF(infof(data, "Curl_pp_readresp_ %d bytes of trailing "
-                     "server response left",
-                     (int)clipamount));
-      }
-      else if(keepon) {
+        /* output debug output if that is requested */
+        Curl_debug(data, CURLINFO_HEADER_IN, line, length);
 
-        if((perline == gotbytes) &&
-           (gotbytes > (ssize_t)data->set.buffer_size/2)) {
-          /* We got an excessive line without newlines and we need to deal
-             with it. We keep the first bytes of the line then we throw
-             away the rest. */
-          infof(data, "Excessive server response line length received, "
-                "%zd bytes. Stripping", gotbytes);
-          restart = TRUE;
+        /*
+         * Pass all response-lines to the callback function registered for
+         * "headers". The response lines can be seen as a kind of headers.
+         */
+        result = Curl_client_write(data, CLIENTWRITE_INFO, line, length);
+        if(result)
+          return result;
 
-          /* we keep 40 bytes since all our pingpong protocols are only
-             interested in the first piece */
-          clipamount = 40;
+        if(pp->endofresp(data, conn, line, length, code)) {
+          /* When at "end of response", keep the endofresp line first in the
+             buffer since it will be accessed outside (by pingpong
+             parsers). Store the overflow counter to inform about additional
+             data in this buffer after the endofresp line. */
+          pp->nfinal = length;
+          if(curlx_dyn_len(&pp->recvbuf) > length)
+            pp->overflow = curlx_dyn_len(&pp->recvbuf) - length;
+          else
+            pp->overflow = 0;
+          *size = pp->nread_resp; /* size of the response */
+          pp->nread_resp = 0; /* restart */
+          gotbytes = 0; /* force break out of outer loop */
+          break;
         }
-        else if(pp->nread_resp > (size_t)data->set.buffer_size/2) {
-          /* We got a large chunk of data and there's potentially still
-             trailing data to take care of, so we put any such part in the
-             "cache", clear the buffer to make space and restart. */
-          clipamount = perline;
-          restart = TRUE;
-        }
-      }
-      else if(i == gotbytes)
-        restart = TRUE;
-
-      if(clipamount) {
-        pp->cache_size = clipamount;
-        pp->cache = malloc(pp->cache_size);
-        if(pp->cache)
-          memcpy(pp->cache, pp->linestart_resp, pp->cache_size);
+        if(curlx_dyn_len(&pp->recvbuf) > length)
+          /* keep the remaining piece */
+          curlx_dyn_tail((&pp->recvbuf), curlx_dyn_len(&pp->recvbuf) - length);
         else
-          return CURLE_OUT_OF_MEMORY;
+          curlx_dyn_reset(&pp->recvbuf);
       }
-      if(restart) {
-        /* now reset a few variables to start over nicely from the start of
-           the big buffer */
-        pp->nread_resp = 0; /* start over from scratch in the buffer */
-        ptr = pp->linestart_resp = buf;
-        perline = 0;
+      else {
+        /* without a newline, there is no overflow */
+        pp->overflow = 0;
+        break;
       }
 
-    } /* there was data */
+    } while(1); /* while there is buffer left to scan */
 
-  } /* while there's buffer left and loop is requested */
+  } while(gotbytes == sizeof(buffer));
 
   pp->pending_resp = FALSE;
 
   return result;
 }
 
-int Curl_pp_getsock(struct Curl_easy *data,
-                    struct pingpong *pp, curl_socket_t *socks)
+CURLcode Curl_pp_pollset(struct Curl_easy *data,
+                         struct pingpong *pp,
+                         struct easy_pollset *ps)
 {
-  struct connectdata *conn = data->conn;
-  socks[0] = conn->sock[FIRSTSOCKET];
+  int flags = pp->sendleft ? CURL_POLL_OUT : CURL_POLL_IN;
+  return Curl_pollset_change(data, ps, data->conn->sock[FIRSTSOCKET],
+                             flags, 0);
+}
 
-  if(pp->sendleft) {
-    /* write mode */
-    return GETSOCK_WRITESOCK(0);
-  }
-
-  /* read mode */
-  return GETSOCK_READSOCK(0);
+bool Curl_pp_needs_flush(struct Curl_easy *data,
+                         struct pingpong *pp)
+{
+  (void)data;
+  return pp->sendleft > 0;
 }
 
 CURLcode Curl_pp_flushsend(struct Curl_easy *data,
                            struct pingpong *pp)
 {
   /* we have a piece of a command still left to send */
-  ssize_t written;
-  CURLcode result = Curl_nwrite(data, FIRSTSOCKET,
-                                pp->sendthis + pp->sendsize - pp->sendleft,
-                                pp->sendleft, &written);
+  size_t written;
+  CURLcode result;
+
+  if(!Curl_pp_needs_flush(data, pp))
+    return CURLE_OK;
+
+  result = Curl_conn_send(data, FIRSTSOCKET,
+                          pp->sendthis + pp->sendsize - pp->sendleft,
+                          pp->sendleft, FALSE, &written);
+  if(result == CURLE_AGAIN) {
+    result = CURLE_OK;
+    written = 0;
+  }
   if(result)
     return result;
 
-  if(written != (ssize_t)pp->sendleft) {
+  if(written != pp->sendleft) {
     /* only a fraction was sent */
     pp->sendleft -= written;
   }
   else {
     pp->sendthis = NULL;
     pp->sendleft = pp->sendsize = 0;
-    pp->response = Curl_now();
+    pp->response = *Curl_pgrs_now(data);
   }
   return CURLE_OK;
 }
 
 CURLcode Curl_pp_disconnect(struct pingpong *pp)
 {
-  Curl_dyn_free(&pp->sendbuf);
-  Curl_safefree(pp->cache);
+  if(pp->initialized) {
+    curlx_dyn_free(&pp->sendbuf);
+    curlx_dyn_free(&pp->recvbuf);
+    memset(pp, 0, sizeof(*pp));
+  }
   return CURLE_OK;
 }
 
 bool Curl_pp_moredata(struct pingpong *pp)
 {
-  return (!pp->sendleft && pp->cache && pp->nread_resp < pp->cache_size) ?
-    TRUE : FALSE;
+  return !pp->sendleft && curlx_dyn_len(&pp->recvbuf) > pp->nfinal;
 }
 
 #endif
diff --git a/third-party/curl/lib/pingpong.h b/third-party/curl/lib/pingpong.h
index 80d3f7718c..02f4961230 100644
--- a/third-party/curl/lib/pingpong.h
+++ b/third-party/curl/lib/pingpong.h
@@ -23,7 +23,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if !defined(CURL_DISABLE_IMAP) || !defined(CURL_DISABLE_FTP) || \
@@ -37,7 +36,7 @@ struct connectdata;
 typedef enum {
   PPTRANSFER_BODY, /* yes do transfer a body */
   PPTRANSFER_INFO, /* do still go through to get info/headers */
-  PPTRANSFER_NONE  /* don't get anything and don't get info */
+  PPTRANSFER_NONE  /* do not get anything and do not get info */
 } curl_pp_transfer;
 
 /*
@@ -47,59 +46,56 @@ typedef enum {
  * It holds response cache and non-blocking sending data.
  */
 struct pingpong {
-  char *cache;     /* data cache between getresponse()-calls */
-  size_t cache_size;  /* size of cache in bytes */
   size_t nread_resp;  /* number of bytes currently read of a server response */
-  char *linestart_resp; /* line start pointer for the server response
-                           reader function */
-  bool pending_resp;  /* set TRUE when a server response is pending or in
-                         progress, and is cleared once the last response is
-                         read */
-  char *sendthis; /* allocated pointer to a buffer that is to be sent to the
-                     server */
+  char *sendthis; /* pointer to a buffer that is to be sent to the server */
   size_t sendleft; /* number of bytes left to send from the sendthis buffer */
   size_t sendsize; /* total size of the sendthis buffer */
   struct curltime response; /* set to Curl_now() when a command has been sent
                                off, used to time-out response reading */
-  timediff_t response_time; /* When no timeout is given, this is the amount of
-                               milliseconds we await for a server response. */
   struct dynbuf sendbuf;
+  struct dynbuf recvbuf;
+  size_t overflow; /* number of bytes left after a final response line */
+  size_t nfinal;   /* number of bytes in the final response line, which
+                      after a match is first in the receive buffer */
 
   /* Function pointers the protocols MUST implement and provide for the
      pingpong layer to function */
 
   CURLcode (*statemachine)(struct Curl_easy *data, struct connectdata *conn);
   bool (*endofresp)(struct Curl_easy *data, struct connectdata *conn,
-                    char *ptr, size_t len, int *code);
+                    const char *ptr, size_t len, int *code);
+  BIT(initialized);
+  BIT(pending_resp);  /* set TRUE when a server response is pending or in
+                         progress, and is cleared once the last response is
+                         read */
 };
 
-#define PINGPONG_SETUP(pp,s,e)                   \
-  do {                                           \
-    pp->response_time = RESP_TIMEOUT;            \
-    pp->statemachine = s;                        \
-    pp->endofresp = e;                           \
+/* Default pingpong response timeout in milliseconds, unless a transfer
+ * has CURLOPT_SERVER_RESPONSE_TIMEOUT(_MS) set. */
+#define PINGPONG_TIMEOUT_MS      (60 * 1000)
+
+#define PINGPONG_SETUP(pp, s, e) \
+  do {                           \
+    (pp)->statemachine = s;      \
+    (pp)->endofresp = e;         \
   } while(0)
 
 /*
  * Curl_pp_statemach()
  *
  * called repeatedly until done. Set 'wait' to make it wait a while on the
- * socket if there's no traffic.
+ * socket if there is no traffic.
  */
 CURLcode Curl_pp_statemach(struct Curl_easy *data, struct pingpong *pp,
                            bool block, bool disconnecting);
 
 /* initialize stuff to prepare for reading a fresh new response */
-void Curl_pp_init(struct Curl_easy *data, struct pingpong *pp);
-
-/* setup for the transfer */
-void Curl_pp_setup(struct pingpong *pp);
-
-/* Returns timeout in ms. 0 or negative number means the timeout has already
-   triggered */
-timediff_t Curl_pp_state_timeout(struct Curl_easy *data,
-                                 struct pingpong *pp, bool disconnecting);
+void Curl_pp_init(struct pingpong *pp, const struct curltime *pnow);
 
+/* Returns time remaining in ms. 0 or negative number means the
+  timeout has already triggered */
+timediff_t Curl_pp_state_timeleft_ms(struct Curl_easy *data,
+                                     struct pingpong *pp);
 
 /***********************************************************************
  *
@@ -113,7 +109,7 @@ timediff_t Curl_pp_state_timeout(struct Curl_easy *data,
  */
 CURLcode Curl_pp_sendf(struct Curl_easy *data,
                        struct pingpong *pp,
-                       const char *fmt, ...);
+                       const char *fmt, ...) CURL_PRINTF(3, 4);
 
 /***********************************************************************
  *
@@ -128,7 +124,7 @@ CURLcode Curl_pp_sendf(struct Curl_easy *data,
 CURLcode Curl_pp_vsendf(struct Curl_easy *data,
                         struct pingpong *pp,
                         const char *fmt,
-                        va_list args);
+                        va_list args) CURL_PRINTF(3, 0);
 
 /*
  * Curl_pp_readresp()
@@ -136,11 +132,13 @@ CURLcode Curl_pp_vsendf(struct Curl_easy *data,
  * Reads a piece of a server response.
  */
 CURLcode Curl_pp_readresp(struct Curl_easy *data,
-                          curl_socket_t sockfd,
+                          int sockindex,
                           struct pingpong *pp,
                           int *code, /* return the server code if done */
                           size_t *size); /* size of the response */
 
+bool Curl_pp_needs_flush(struct Curl_easy *data,
+                         struct pingpong *pp);
 
 CURLcode Curl_pp_flushsend(struct Curl_easy *data,
                            struct pingpong *pp);
@@ -148,9 +146,9 @@ CURLcode Curl_pp_flushsend(struct Curl_easy *data,
 /* call this when a pingpong connection is disconnected */
 CURLcode Curl_pp_disconnect(struct pingpong *pp);
 
-int Curl_pp_getsock(struct Curl_easy *data, struct pingpong *pp,
-                    curl_socket_t *socks);
-
+CURLcode Curl_pp_pollset(struct Curl_easy *data,
+                         struct pingpong *pp,
+                         struct easy_pollset *ps);
 
 /***********************************************************************
  *
diff --git a/third-party/curl/lib/pop3.c b/third-party/curl/lib/pop3.c
index a9d5fdd698..d609b4c2b3 100644
--- a/third-party/curl/lib/pop3.c
+++ b/third-party/curl/lib/pop3.c
@@ -36,8 +36,9 @@
  * Draft   LOGIN SASL Mechanism <draft-murchison-sasl-login-00.txt>
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+#include "urldata.h"
+#include "pop3.h"
 
 #ifndef CURL_DISABLE_POP3
 
@@ -55,141 +56,230 @@
 #include <inet.h>
 #endif
 
-#include <curl/curl.h>
-#include "urldata.h"
 #include "sendf.h"
+#include "curl_trc.h"
 #include "hostip.h"
 #include "progress.h"
 #include "transfer.h"
 #include "escape.h"
-#include "http.h" /* for HTTP proxy tunnel stuff */
-#include "socks.h"
-#include "pop3.h"
-#include "strtoofft.h"
-#include "strcase.h"
+#include "pingpong.h"
 #include "vtls/vtls.h"
 #include "cfilters.h"
 #include "connect.h"
 #include "select.h"
-#include "multiif.h"
 #include "url.h"
 #include "bufref.h"
 #include "curl_sasl.h"
 #include "curl_md5.h"
-#include "warnless.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curlx/strdup.h"
 
-/* Local API functions */
-static CURLcode pop3_regular_transfer(struct Curl_easy *data, bool *done);
-static CURLcode pop3_do(struct Curl_easy *data, bool *done);
-static CURLcode pop3_done(struct Curl_easy *data, CURLcode status,
-                          bool premature);
-static CURLcode pop3_connect(struct Curl_easy *data, bool *done);
-static CURLcode pop3_disconnect(struct Curl_easy *data,
-                                struct connectdata *conn, bool dead);
-static CURLcode pop3_multi_statemach(struct Curl_easy *data, bool *done);
-static int pop3_getsock(struct Curl_easy *data,
-                        struct connectdata *conn, curl_socket_t *socks);
-static CURLcode pop3_doing(struct Curl_easy *data, bool *dophase_done);
-static CURLcode pop3_setup_connection(struct Curl_easy *data,
-                                      struct connectdata *conn);
-static CURLcode pop3_parse_url_options(struct connectdata *conn);
-static CURLcode pop3_parse_url_path(struct Curl_easy *data);
-static CURLcode pop3_parse_custom_request(struct Curl_easy *data);
-static CURLcode pop3_perform_auth(struct Curl_easy *data, const char *mech,
-                                  const struct bufref *initresp);
-static CURLcode pop3_continue_auth(struct Curl_easy *data, const char *mech,
-                                   const struct bufref *resp);
-static CURLcode pop3_cancel_auth(struct Curl_easy *data, const char *mech);
-static CURLcode pop3_get_message(struct Curl_easy *data, struct bufref *out);
+/* Authentication type flags */
+#define POP3_TYPE_CLEARTEXT (1 << 0)
+#define POP3_TYPE_APOP      (1 << 1)
+#define POP3_TYPE_SASL      (1 << 2)
+
+/* Authentication type values */
+#define POP3_TYPE_NONE 0
+#define POP3_TYPE_ANY  (POP3_TYPE_CLEARTEXT | POP3_TYPE_APOP | POP3_TYPE_SASL)
+
+/* This is the 5-bytes End-Of-Body marker for POP3 */
+#define POP3_EOB     "\x0d\x0a\x2e\x0d\x0a"
+#define POP3_EOB_LEN 5
+
+/* meta key for storing protocol meta at easy handle */
+#define CURL_META_POP3_EASY   "meta:proto:pop3:easy"
+/* meta key for storing protocol meta at connection */
+#define CURL_META_POP3_CONN   "meta:proto:pop3:conn"
 
 /*
- * POP3 protocol handler.
+ * POP3 easy handle state
  */
-
-const struct Curl_handler Curl_handler_pop3 = {
-  "POP3",                           /* scheme */
-  pop3_setup_connection,            /* setup_connection */
-  pop3_do,                          /* do_it */
-  pop3_done,                        /* done */
-  ZERO_NULL,                        /* do_more */
-  pop3_connect,                     /* connect_it */
-  pop3_multi_statemach,             /* connecting */
-  pop3_doing,                       /* doing */
-  pop3_getsock,                     /* proto_getsock */
-  pop3_getsock,                     /* doing_getsock */
-  ZERO_NULL,                        /* domore_getsock */
-  ZERO_NULL,                        /* perform_getsock */
-  pop3_disconnect,                  /* disconnect */
-  ZERO_NULL,                        /* readwrite */
-  ZERO_NULL,                        /* connection_check */
-  ZERO_NULL,                        /* attach connection */
-  PORT_POP3,                        /* defport */
-  CURLPROTO_POP3,                   /* protocol */
-  CURLPROTO_POP3,                   /* family */
-  PROTOPT_CLOSEACTION | PROTOPT_NOURLQUERY | /* flags */
-  PROTOPT_URLOPTIONS
+struct POP3 {
+  curl_pp_transfer transfer;
+  char *id;               /* Message ID */
+  char *custom;           /* Custom Request */
 };
 
-#ifdef USE_SSL
 /*
- * POP3S protocol handler.
+ * POP3 connection state
  */
+typedef enum {
+  POP3_STOP,         /* do nothing state, stops the state machine */
+  POP3_SERVERGREET,  /* waiting for the initial greeting immediately after
+                        a connect */
+  POP3_CAPA,
+  POP3_STARTTLS,
+  POP3_UPGRADETLS,   /* asynchronously upgrade the connection to SSL/TLS
+                       (multi mode only) */
+  POP3_AUTH,
+  POP3_APOP,
+  POP3_USER,
+  POP3_PASS,
+  POP3_COMMAND,
+  POP3_QUIT,
+  POP3_LAST          /* never used */
+} pop3state;
 
-const struct Curl_handler Curl_handler_pop3s = {
-  "POP3S",                          /* scheme */
-  pop3_setup_connection,            /* setup_connection */
-  pop3_do,                          /* do_it */
-  pop3_done,                        /* done */
-  ZERO_NULL,                        /* do_more */
-  pop3_connect,                     /* connect_it */
-  pop3_multi_statemach,             /* connecting */
-  pop3_doing,                       /* doing */
-  pop3_getsock,                     /* proto_getsock */
-  pop3_getsock,                     /* doing_getsock */
-  ZERO_NULL,                        /* domore_getsock */
-  ZERO_NULL,                        /* perform_getsock */
-  pop3_disconnect,                  /* disconnect */
-  ZERO_NULL,                        /* readwrite */
-  ZERO_NULL,                        /* connection_check */
-  ZERO_NULL,                        /* attach connection */
-  PORT_POP3S,                       /* defport */
-  CURLPROTO_POP3S,                  /* protocol */
-  CURLPROTO_POP3,                   /* family */
-  PROTOPT_CLOSEACTION | PROTOPT_SSL
-  | PROTOPT_NOURLQUERY | PROTOPT_URLOPTIONS /* flags */
-};
-#endif
-
-/* SASL parameters for the pop3 protocol */
-static const struct SASLproto saslpop3 = {
-  "pop",                /* The service name */
-  pop3_perform_auth,    /* Send authentication command */
-  pop3_continue_auth,   /* Send authentication continuation */
-  pop3_cancel_auth,     /* Send authentication cancellation */
-  pop3_get_message,     /* Get SASL response message */
-  255 - 8,              /* Max line len - strlen("AUTH ") - 1 space - crlf */
-  '*',                  /* Code received when continuation is expected */
-  '+',                  /* Code to receive upon authentication success */
-  SASL_AUTH_DEFAULT,    /* Default mechanisms */
-  SASL_FLAG_BASE64      /* Configuration flags */
+struct pop3_conn {
+  struct pingpong pp;
+  pop3state state;        /* Always use pop3.c:state() to change state! */
+  size_t eob;             /* Number of bytes of the EOB (End Of Body) that
+                             have been received so far */
+  size_t strip;           /* Number of bytes from the start to ignore as
+                             non-body */
+  struct SASL sasl;       /* SASL-related storage */
+  char *apoptimestamp;    /* APOP timestamp from the server greeting */
+  unsigned char authtypes; /* Accepted authentication types */
+  unsigned char preftype;  /* Preferred authentication type */
+  BIT(ssldone);           /* Is connect() over SSL done? */
+  BIT(tls_supported);     /* StartTLS capability supported by server */
 };
 
-#ifdef USE_SSL
-static void pop3_to_pop3s(struct connectdata *conn)
+struct pop3_cmd {
+  const char *name;
+  unsigned short nlen;
+  BIT(multiline); /* response is multi-line with last '.' line */
+  BIT(multiline_with_args); /* is multi-line when command has args */
+};
+
+static const struct pop3_cmd pop3cmds[] = {
+  { "APOP", 4, FALSE, FALSE },
+  { "AUTH", 4, FALSE, FALSE },
+  { "CAPA", 4, TRUE, TRUE },
+  { "DELE", 4, FALSE, FALSE },
+  { "LIST", 4, TRUE, FALSE },
+  { "MSG",  3, TRUE, TRUE },
+  { "NOOP", 4, FALSE, FALSE },
+  { "PASS", 4, FALSE, FALSE },
+  { "QUIT", 4, FALSE, FALSE },
+  { "RETR", 4, TRUE, TRUE },
+  { "RSET", 4, FALSE, FALSE },
+  { "STAT", 4, FALSE, FALSE },
+  { "STLS", 4, FALSE, FALSE },
+  { "TOP",  3, TRUE, TRUE },
+  { "UIDL", 4, TRUE, FALSE },
+  { "USER", 4, FALSE, FALSE },
+  { "UTF8", 4, FALSE, FALSE },
+  { "XTND", 4, TRUE, TRUE },
+};
+
+/***********************************************************************
+ *
+ * pop3_parse_url_options()
+ *
+ * Parse the URL login options.
+ */
+static CURLcode pop3_parse_url_options(struct connectdata *conn)
 {
-  /* Change the connection handler */
-  conn->handler = &Curl_handler_pop3s;
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
+  CURLcode result = CURLE_OK;
+  const char *ptr = conn->options;
 
-  /* Set the connection's upgraded to TLS flag */
-  conn->bits.tls_upgraded = TRUE;
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
+
+  while(!result && ptr && *ptr) {
+    const char *key = ptr;
+    const char *value;
+
+    while(*ptr && *ptr != '=')
+      ptr++;
+
+    value = ptr + 1;
+
+    while(*ptr && *ptr != ';')
+      ptr++;
+
+    if(curl_strnequal(key, "AUTH=", 5)) {
+      result = Curl_sasl_parse_url_auth_option(&pop3c->sasl,
+                                               value, ptr - value);
+
+      if(result && curl_strnequal(value, "+APOP", ptr - value)) {
+        pop3c->preftype = POP3_TYPE_APOP;
+        pop3c->sasl.prefmech = SASL_AUTH_NONE;
+        result = CURLE_OK;
+      }
+    }
+    else
+      result = CURLE_URL_MALFORMAT;
+
+    if(*ptr == ';')
+      ptr++;
+  }
+
+  if(pop3c->preftype != POP3_TYPE_APOP)
+    switch(pop3c->sasl.prefmech) {
+    case SASL_AUTH_NONE:
+      pop3c->preftype = POP3_TYPE_NONE;
+      break;
+    case SASL_AUTH_DEFAULT:
+      pop3c->preftype = POP3_TYPE_ANY;
+      break;
+    default:
+      pop3c->preftype = POP3_TYPE_SASL;
+      break;
+    }
+
+  return result;
+}
+
+/***********************************************************************
+ *
+ * pop3_parse_url_path()
+ *
+ * Parse the URL path into separate path components.
+ */
+static CURLcode pop3_parse_url_path(struct Curl_easy *data)
+{
+  /* The POP3 struct is already initialized in pop3_connect() */
+  struct POP3 *pop3 = Curl_meta_get(data, CURL_META_POP3_EASY);
+  const char *path = &data->state.up.path[1]; /* skip leading path */
+
+  if(!pop3)
+    return CURLE_FAILED_INIT;
+  /* URL decode the path for the message ID */
+  return Curl_urldecode(path, 0, &pop3->id, NULL, REJECT_CTRL);
+}
+
+/***********************************************************************
+ *
+ * pop3_parse_custom_request()
+ *
+ * Parse the custom request.
+ */
+static CURLcode pop3_parse_custom_request(struct Curl_easy *data)
+{
+  CURLcode result = CURLE_OK;
+  struct POP3 *pop3 = Curl_meta_get(data, CURL_META_POP3_EASY);
+  const char *custom = data->set.str[STRING_CUSTOMREQUEST];
+
+  if(!pop3)
+    return CURLE_FAILED_INIT;
+  /* URL decode the custom request */
+  if(custom)
+    result = Curl_urldecode(custom, 0, &pop3->custom, NULL, REJECT_CTRL);
+
+  return result;
+}
+
+/* Return iff a command is defined as "multi-line" (RFC 1939),
+ * has a response terminated by a last line with a '.'.
+ */
+static bool pop3_is_multiline(const char *cmdline)
+{
+  size_t i;
+  for(i = 0; i < CURL_ARRAYSIZE(pop3cmds); ++i) {
+    if(curl_strnequal(pop3cmds[i].name, cmdline, pop3cmds[i].nlen)) {
+      if(!cmdline[pop3cmds[i].nlen])
+        return (bool)pop3cmds[i].multiline;
+      else if(cmdline[pop3cmds[i].nlen] == ' ')
+        return (bool)pop3cmds[i].multiline_with_args;
+    }
+  }
+  /* Unknown command, assume multi-line for backward compatibility with
+   * earlier curl versions that only could do multi-line responses. */
+  return TRUE;
 }
-#else
-#define pop3_to_pop3s(x) Curl_nop_stmt
-#endif
 
 /***********************************************************************
  *
@@ -201,10 +291,13 @@ static void pop3_to_pop3s(struct connectdata *conn)
  * types and allowed SASL mechanisms.
  */
 static bool pop3_endofresp(struct Curl_easy *data, struct connectdata *conn,
-                           char *line, size_t len, int *resp)
+                           const char *line, size_t len, int *resp)
 {
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
   (void)data;
+  DEBUGASSERT(pop3c);
+  if(!pop3c) /* internal error */
+    return TRUE;
 
   /* Do we have an error response? */
   if(len >= 4 && !memcmp("-ERR", line, 4)) {
@@ -215,8 +308,10 @@ static bool pop3_endofresp(struct Curl_easy *data, struct connectdata *conn,
 
   /* Are we processing CAPA command responses? */
   if(pop3c->state == POP3_CAPA) {
-    /* Do we have the terminating line? */
-    if(len >= 1 && line[0] == '.')
+    /* Do we have the terminating line? Per RFC 2449 this is a line
+       containing only a single dot */
+    if((len == 3 && line[0] == '.' && line[1] == '\r') ||
+       (len == 2 && line[0] == '.' && line[1] == '\n'))
       /* Treat the response as a success */
       *resp = '+';
     else
@@ -251,19 +346,24 @@ static bool pop3_endofresp(struct Curl_easy *data, struct connectdata *conn,
  */
 static CURLcode pop3_get_message(struct Curl_easy *data, struct bufref *out)
 {
-  char *message = data->state.buffer;
-  size_t len = strlen(message);
+  struct pop3_conn *pop3c =
+    Curl_conn_meta_get(data->conn, CURL_META_POP3_CONN);
+  char *message;
+  size_t len;
 
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
+  message = curlx_dyn_ptr(&pop3c->pp.recvbuf);
+  len = pop3c->pp.nfinal;
   if(len > 2) {
     /* Find the start of the message */
     len -= 2;
-    for(message += 2; *message == ' ' || *message == '\t'; message++, len--)
+    for(message += 2; ISBLANK(*message); message++, len--)
       ;
 
     /* Find the end of the message */
     while(len--)
-      if(message[len] != '\r' && message[len] != '\n' && message[len] != ' ' &&
-         message[len] != '\t')
+      if(!ISBLANK(message[len]) && !ISNEWLINE(message[len]))
         break;
 
     /* Terminate the message */
@@ -285,30 +385,33 @@ static CURLcode pop3_get_message(struct Curl_easy *data, struct bufref *out)
  */
 static void pop3_state(struct Curl_easy *data, pop3state newstate)
 {
-  struct pop3_conn *pop3c = &data->conn->proto.pop3c;
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
-  /* for debug purposes */
-  static const char * const names[] = {
-    "STOP",
-    "SERVERGREET",
-    "CAPA",
-    "STARTTLS",
-    "UPGRADETLS",
-    "AUTH",
-    "APOP",
-    "USER",
-    "PASS",
-    "COMMAND",
-    "QUIT",
-    /* LAST */
-  };
+  struct pop3_conn *pop3c =
+    Curl_conn_meta_get(data->conn, CURL_META_POP3_CONN);
+  if(pop3c) {
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
+    /* for debug purposes */
+    static const char * const names[] = {
+      "STOP",
+      "SERVERGREET",
+      "CAPA",
+      "STARTTLS",
+      "UPGRADETLS",
+      "AUTH",
+      "APOP",
+      "USER",
+      "PASS",
+      "COMMAND",
+      "QUIT",
+      /* LAST */
+    };
 
-  if(pop3c->state != newstate)
-    infof(data, "POP3 %p state change from %s to %s",
-          (void *)pop3c, names[pop3c->state], names[newstate]);
+    if(pop3c->state != newstate)
+      infof(data, "POP3 %p state change from %s to %s",
+            (void *)pop3c, names[pop3c->state], names[newstate]);
 #endif
 
-  pop3c->state = newstate;
+    pop3c->state = newstate;
+  }
 }
 
 /***********************************************************************
@@ -321,8 +424,11 @@ static void pop3_state(struct Curl_easy *data, pop3state newstate)
 static CURLcode pop3_perform_capa(struct Curl_easy *data,
                                   struct connectdata *conn)
 {
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
   CURLcode result = CURLE_OK;
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
+
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
 
   pop3c->sasl.authmechs = SASL_AUTH_NONE; /* No known auth. mechanisms yet */
   pop3c->sasl.authused = SASL_AUTH_NONE;  /* Clear the auth. mechanism used */
@@ -346,9 +452,14 @@ static CURLcode pop3_perform_capa(struct Curl_easy *data,
 static CURLcode pop3_perform_starttls(struct Curl_easy *data,
                                       struct connectdata *conn)
 {
-  /* Send the STLS command */
-  CURLcode result = Curl_pp_sendf(data, &conn->proto.pop3c.pp, "%s", "STLS");
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
+  CURLcode result;
 
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
+
+  /* Send the STLS command */
+  result = Curl_pp_sendf(data, &pop3c->pp, "%s", "STLS");
   if(!result)
     pop3_state(data, POP3_STARTTLS);
 
@@ -364,31 +475,40 @@ static CURLcode pop3_perform_starttls(struct Curl_easy *data,
 static CURLcode pop3_perform_upgrade_tls(struct Curl_easy *data,
                                          struct connectdata *conn)
 {
+#ifdef USE_SSL
   /* Start the SSL connection */
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
   CURLcode result;
   bool ssldone = FALSE;
 
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
+
   if(!Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
-    result = Curl_ssl_cfilter_add(data, conn, FIRSTSOCKET);
+    result = Curl_ssl_cfilter_add(
+      data, Curl_conn_get_origin(conn, FIRSTSOCKET), conn, FIRSTSOCKET);
     if(result)
       goto out;
+    /* Change the connection handler */
+    conn->scheme = &Curl_scheme_pop3s;
   }
 
+  DEBUGASSERT(!pop3c->ssldone);
   result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssldone);
-
-  if(!result) {
+  DEBUGF(infof(data, "pop3_perform_upgrade_tls, connect -> %d, %d",
+               (int)result, ssldone));
+  if(!result && ssldone) {
     pop3c->ssldone = ssldone;
-    if(pop3c->state != POP3_UPGRADETLS)
-      pop3_state(data, POP3_UPGRADETLS);
-
-    if(pop3c->ssldone) {
-      pop3_to_pop3s(conn);
-      result = pop3_perform_capa(data, conn);
-    }
+    /* perform CAPA now, changes pop3c->state out of POP3_UPGRADETLS */
+    result = pop3_perform_capa(data, conn);
   }
 out:
   return result;
+#else
+  (void)data;
+  (void)conn;
+  return CURLE_NOT_BUILT_IN;
+#endif
 }
 
 /***********************************************************************
@@ -400,19 +520,23 @@ out:
 static CURLcode pop3_perform_user(struct Curl_easy *data,
                                   struct connectdata *conn)
 {
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
   CURLcode result = CURLE_OK;
 
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
+
   /* Check we have a username and password to authenticate with and end the
-     connect phase if we don't */
-  if(!data->state.aptr.user) {
+     connect phase if we do not */
+  if(!conn->creds) {
     pop3_state(data, POP3_STOP);
 
     return result;
   }
 
   /* Send the USER command */
-  result = Curl_pp_sendf(data, &conn->proto.pop3c.pp, "USER %s",
-                         conn->user ? conn->user : "");
+  result = Curl_pp_sendf(data, &pop3c->pp, "USER %s",
+                         Curl_creds_user(conn->creds));
   if(!result)
     pop3_state(data, POP3_USER);
 
@@ -429,40 +553,44 @@ static CURLcode pop3_perform_user(struct Curl_easy *data,
 static CURLcode pop3_perform_apop(struct Curl_easy *data,
                                   struct connectdata *conn)
 {
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
   CURLcode result = CURLE_OK;
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
   size_t i;
   struct MD5_context *ctxt;
   unsigned char digest[MD5_DIGEST_LEN];
-  char secret[2 * MD5_DIGEST_LEN + 1];
+  char secret[(2 * MD5_DIGEST_LEN) + 1];
+
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
 
   /* Check we have a username and password to authenticate with and end the
-     connect phase if we don't */
-  if(!data->state.aptr.user) {
+     connect phase if we do not */
+  if(!data->state.creds) {
     pop3_state(data, POP3_STOP);
 
     return result;
   }
 
   /* Create the digest */
-  ctxt = Curl_MD5_init(Curl_DIGEST_MD5);
+  ctxt = Curl_MD5_init(&Curl_DIGEST_MD5);
   if(!ctxt)
     return CURLE_OUT_OF_MEMORY;
 
-  Curl_MD5_update(ctxt, (const unsigned char *) pop3c->apoptimestamp,
+  Curl_MD5_update(ctxt, (const unsigned char *)pop3c->apoptimestamp,
                   curlx_uztoui(strlen(pop3c->apoptimestamp)));
 
-  Curl_MD5_update(ctxt, (const unsigned char *) conn->passwd,
-                  curlx_uztoui(strlen(conn->passwd)));
+  Curl_MD5_update(ctxt, (const unsigned char *)Curl_creds_passwd(conn->creds),
+                  curlx_uztoui(strlen(Curl_creds_passwd(conn->creds))));
 
   /* Finalise the digest */
   Curl_MD5_final(ctxt, digest);
 
-  /* Convert the calculated 16 octet digest into a 32 byte hex string */
+  /* Convert the calculated 16 octet digest into a 32-byte hex string */
   for(i = 0; i < MD5_DIGEST_LEN; i++)
-    msnprintf(&secret[2 * i], 3, "%02x", digest[i]);
+    curl_msnprintf(&secret[2 * i], 3, "%02x", digest[i]);
 
-  result = Curl_pp_sendf(data, &pop3c->pp, "APOP %s %s", conn->user, secret);
+  result = Curl_pp_sendf(data, &pop3c->pp, "APOP %s %s",
+                         Curl_creds_user(conn->creds), secret);
 
   if(!result)
     pop3_state(data, POP3_APOP);
@@ -482,9 +610,13 @@ static CURLcode pop3_perform_auth(struct Curl_easy *data,
                                   const char *mech,
                                   const struct bufref *initresp)
 {
+  struct pop3_conn *pop3c =
+    Curl_conn_meta_get(data->conn, CURL_META_POP3_CONN);
   CURLcode result = CURLE_OK;
-  struct pop3_conn *pop3c = &data->conn->proto.pop3c;
-  const char *ir = (const char *) Curl_bufref_ptr(initresp);
+  const char *ir = Curl_bufref_ptr(initresp);
+
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
 
   if(ir) {                                  /* AUTH <mech> ...<crlf> */
     /* Send the AUTH command with the initial response */
@@ -508,12 +640,14 @@ static CURLcode pop3_continue_auth(struct Curl_easy *data,
                                    const char *mech,
                                    const struct bufref *resp)
 {
-  struct pop3_conn *pop3c = &data->conn->proto.pop3c;
+  struct pop3_conn *pop3c =
+    Curl_conn_meta_get(data->conn, CURL_META_POP3_CONN);
 
   (void)mech;
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
 
-  return Curl_pp_sendf(data, &pop3c->pp,
-                       "%s", (const char *) Curl_bufref_ptr(resp));
+  return Curl_pp_sendf(data, &pop3c->pp, "%s", Curl_bufref_ptr(resp));
 }
 
 /***********************************************************************
@@ -524,9 +658,12 @@ static CURLcode pop3_continue_auth(struct Curl_easy *data,
  */
 static CURLcode pop3_cancel_auth(struct Curl_easy *data, const char *mech)
 {
-  struct pop3_conn *pop3c = &data->conn->proto.pop3c;
+  struct pop3_conn *pop3c =
+    Curl_conn_meta_get(data->conn, CURL_META_POP3_CONN);
 
   (void)mech;
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
 
   return Curl_pp_sendf(data, &pop3c->pp, "*");
 }
@@ -542,12 +679,15 @@ static CURLcode pop3_cancel_auth(struct Curl_easy *data, const char *mech)
 static CURLcode pop3_perform_authentication(struct Curl_easy *data,
                                             struct connectdata *conn)
 {
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
   CURLcode result = CURLE_OK;
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
   saslprogress progress = SASL_IDLE;
 
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
+
   /* Check we have enough data to authenticate with and end the
-     connect phase if we don't */
+     connect phase if we do not */
   if(!Curl_sasl_can_authenticate(&pop3c->sasl, data)) {
     pop3_state(data, POP3_STOP);
     return result;
@@ -572,11 +712,8 @@ static CURLcode pop3_perform_authentication(struct Curl_easy *data,
     if(pop3c->authtypes & pop3c->preftype & POP3_TYPE_CLEARTEXT)
       /* Perform clear text authentication */
       result = pop3_perform_user(data, conn);
-    else {
-      /* Other mechanisms not supported */
-      infof(data, "No known authentication mechanisms supported");
-      result = CURLE_LOGIN_DENIED;
-    }
+    else
+      result = Curl_sasl_is_blocked(&pop3c->sasl, data);
   }
 
   return result;
@@ -592,9 +729,13 @@ static CURLcode pop3_perform_command(struct Curl_easy *data)
 {
   CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
-  struct POP3 *pop3 = data->req.p.pop3;
+  struct POP3 *pop3 = Curl_meta_get(data, CURL_META_POP3_EASY);
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
   const char *command = NULL;
 
+  if(!pop3 || !pop3c)
+    return CURLE_FAILED_INIT;
+
   /* Calculate the default command */
   if(pop3->id[0] == '\0' || data->set.list_only) {
     command = "LIST";
@@ -606,18 +747,19 @@ static CURLcode pop3_perform_command(struct Curl_easy *data)
   else
     command = "RETR";
 
+  if(pop3->custom && pop3->custom[0] != '\0')
+    command = pop3->custom;
+
   /* Send the command */
   if(pop3->id[0] != '\0')
-    result = Curl_pp_sendf(data, &conn->proto.pop3c.pp, "%s %s",
-                           (pop3->custom && pop3->custom[0] != '\0' ?
-                            pop3->custom : command), pop3->id);
+    result = Curl_pp_sendf(data, &pop3c->pp, "%s %s", command, pop3->id);
   else
-    result = Curl_pp_sendf(data, &conn->proto.pop3c.pp, "%s",
-                           (pop3->custom && pop3->custom[0] != '\0' ?
-                            pop3->custom : command));
+    result = Curl_pp_sendf(data, &pop3c->pp, "%s", command);
 
-  if(!result)
+  if(!result) {
     pop3_state(data, POP3_COMMAND);
+    data->req.no_body = !pop3_is_multiline(command);
+  }
 
   return result;
 }
@@ -631,9 +773,14 @@ static CURLcode pop3_perform_command(struct Curl_easy *data)
 static CURLcode pop3_perform_quit(struct Curl_easy *data,
                                   struct connectdata *conn)
 {
-  /* Send the QUIT command */
-  CURLcode result = Curl_pp_sendf(data, &conn->proto.pop3c.pp, "%s", "QUIT");
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
+  CURLcode result;
 
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
+
+  /* Send the QUIT command */
+  result = Curl_pp_sendf(data, &pop3c->pp, "%s", "QUIT");
   if(!result)
     pop3_state(data, POP3_QUIT);
 
@@ -647,54 +794,50 @@ static CURLcode pop3_state_servergreet_resp(struct Curl_easy *data,
 {
   CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
-  const char *line = data->state.buffer;
-  size_t len = strlen(line);
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
+  const char *line;
+  size_t len;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
+
+  line = curlx_dyn_ptr(&pop3c->pp.recvbuf);
+  len = pop3c->pp.nfinal;
 
   if(pop3code != '+') {
     failf(data, "Got unexpected pop3-server response");
     result = CURLE_WEIRD_SERVER_REPLY;
   }
-  else {
+  else if(len > 3) {
     /* Does the server support APOP authentication? */
-    if(len >= 4 && line[len - 2] == '>') {
-      /* Look for the APOP timestamp */
-      size_t i;
-      for(i = 3; i < len - 2; ++i) {
-        if(line[i] == '<') {
-          /* Calculate the length of the timestamp */
-          size_t timestamplen = len - 1 - i;
-          char *at;
-          if(!timestamplen)
-            break;
+    const char *lt;
+    const char *gt = NULL;
 
-          /* Allocate some memory for the timestamp */
-          pop3c->apoptimestamp = (char *)calloc(1, timestamplen + 1);
-
-          if(!pop3c->apoptimestamp)
-            break;
-
-          /* Copy the timestamp */
-          memcpy(pop3c->apoptimestamp, line + i, timestamplen);
-          pop3c->apoptimestamp[timestamplen] = '\0';
-
-          /* If the timestamp does not contain '@' it is not (as required by
-             RFC-1939) conformant to the RFC-822 message id syntax, and we
-             therefore do not use APOP authentication. */
-          at = strchr(pop3c->apoptimestamp, '@');
-          if(!at)
-            Curl_safefree(pop3c->apoptimestamp);
-          else
-            /* Store the APOP capability */
-            pop3c->authtypes |= POP3_TYPE_APOP;
-          break;
-        }
+    /* Look for the APOP timestamp */
+    lt = memchr(line, '<', len);
+    if(lt)
+      /* search the remainder for '>' */
+      gt = memchr(lt, '>', len - (lt - line));
+    if(gt) {
+      /* the length of the timestamp, including the brackets */
+      size_t timestamplen = gt - lt + 1;
+      const char *at = memchr(lt, '@', timestamplen);
+      /* If the timestamp does not contain '@' it is not (as required by
+         RFC-1939) conformant to the RFC-822 message id syntax, and we
+         therefore do not use APOP authentication. */
+      if(at) {
+        /* dupe the timestamp */
+        pop3c->apoptimestamp = curlx_memdup0(lt, timestamplen);
+        if(!pop3c->apoptimestamp)
+          return CURLE_OUT_OF_MEMORY;
+        /* Store the APOP capability */
+        pop3c->authtypes |= POP3_TYPE_APOP;
       }
     }
 
-    result = pop3_perform_capa(data, conn);
+    if(!result)
+      result = pop3_perform_capa(data, conn);
   }
 
   return result;
@@ -706,24 +849,29 @@ static CURLcode pop3_state_capa_resp(struct Curl_easy *data, int pop3code,
 {
   CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
-  const char *line = data->state.buffer;
-  size_t len = strlen(line);
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
+  const char *line;
+  size_t len;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
 
-  /* Do we have a untagged continuation response? */
+  line = curlx_dyn_ptr(&pop3c->pp.recvbuf);
+  len = pop3c->pp.nfinal;
+
+  /* Do we have an untagged continuation response? */
   if(pop3code == '*') {
     /* Does the server support the STLS capability? */
-    if(len >= 4 && !memcmp(line, "STLS", 4))
+    if(len >= 4 && curl_strnequal(line, "STLS", 4))
       pop3c->tls_supported = TRUE;
 
     /* Does the server support clear text authentication? */
-    else if(len >= 4 && !memcmp(line, "USER", 4))
+    else if(len >= 4 && curl_strnequal(line, "USER", 4))
       pop3c->authtypes |= POP3_TYPE_CLEARTEXT;
 
     /* Does the server support SASL based authentication? */
-    else if(len >= 5 && !memcmp(line, "SASL ", 5)) {
+    else if(len >= 5 && curl_strnequal(line, "SASL ", 5)) {
       pop3c->authtypes |= POP3_TYPE_SASL;
 
       /* Advance past the SASL keyword */
@@ -733,13 +881,10 @@ static CURLcode pop3_state_capa_resp(struct Curl_easy *data, int pop3code,
       /* Loop through the data line */
       for(;;) {
         size_t llen;
-        size_t wordlen;
+        size_t wordlen = 0;
         unsigned short mechbit;
 
-        while(len &&
-              (*line == ' ' || *line == '\t' ||
-               *line == '\r' || *line == '\n')) {
-
+        while(len && (ISBLANK(*line) || ISNEWLINE(*line))) {
           line++;
           len--;
         }
@@ -748,9 +893,8 @@ static CURLcode pop3_state_capa_resp(struct Curl_easy *data, int pop3code,
           break;
 
         /* Extract the word */
-        for(wordlen = 0; wordlen < len && line[wordlen] != ' ' &&
-              line[wordlen] != '\t' && line[wordlen] != '\r' &&
-              line[wordlen] != '\n';)
+        while(wordlen < len && !ISBLANK(line[wordlen]) &&
+              !ISNEWLINE(line[wordlen]))
           wordlen++;
 
         /* Test the word for a matching authentication mechanism */
@@ -764,7 +908,7 @@ static CURLcode pop3_state_capa_resp(struct Curl_easy *data, int pop3code,
     }
   }
   else {
-    /* Clear text is supported when CAPA isn't recognised */
+    /* Clear text is supported when CAPA is not recognised */
     if(pop3code != '+')
       pop3c->authtypes |= POP3_TYPE_CLEARTEXT;
 
@@ -791,11 +935,15 @@ static CURLcode pop3_state_starttls_resp(struct Curl_easy *data,
                                          int pop3code,
                                          pop3state instate)
 {
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
   CURLcode result = CURLE_OK;
-  (void)instate; /* no use for this yet */
+  (void)instate;
+
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
 
   /* Pipelining in response is forbidden. */
-  if(data->conn->proto.pop3c.pp.cache_size)
+  if(pop3c->pp.overflow)
     return CURLE_WEIRD_SERVER_REPLY;
 
   if(pop3code != '+') {
@@ -807,7 +955,7 @@ static CURLcode pop3_state_starttls_resp(struct Curl_easy *data,
       result = pop3_perform_authentication(data, conn);
   }
   else
-    result = pop3_perform_upgrade_tls(data, conn);
+    pop3_state(data, POP3_UPGRADETLS);
 
   return result;
 }
@@ -819,10 +967,12 @@ static CURLcode pop3_state_auth_resp(struct Curl_easy *data,
 {
   CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
   saslprogress progress;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
 
   result = Curl_sasl_continue(&pop3c->sasl, data, pop3code, &progress);
   if(!result)
@@ -858,7 +1008,7 @@ static CURLcode pop3_state_apop_resp(struct Curl_easy *data, int pop3code,
                                      pop3state instate)
 {
   CURLcode result = CURLE_OK;
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(pop3code != '+') {
     failf(data, "Authentication failed: %d", pop3code);
@@ -878,7 +1028,11 @@ static CURLcode pop3_state_user_resp(struct Curl_easy *data, int pop3code,
 {
   CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
-  (void)instate; /* no use for this yet */
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
+  (void)instate;
+
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
 
   if(pop3code != '+') {
     failf(data, "Access denied. %c", pop3code);
@@ -886,8 +1040,8 @@ static CURLcode pop3_state_user_resp(struct Curl_easy *data, int pop3code,
   }
   else
     /* Send the PASS command */
-    result = Curl_pp_sendf(data, &conn->proto.pop3c.pp, "PASS %s",
-                           conn->passwd ? conn->passwd : "");
+    result = Curl_pp_sendf(data, &pop3c->pp, "PASS %s",
+                           Curl_creds_passwd(conn->creds));
   if(!result)
     pop3_state(data, POP3_PASS);
 
@@ -899,7 +1053,7 @@ static CURLcode pop3_state_pass_resp(struct Curl_easy *data, int pop3code,
                                      pop3state instate)
 {
   CURLcode result = CURLE_OK;
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(pop3code != '+') {
     failf(data, "Access denied. %c", pop3code);
@@ -912,6 +1066,145 @@ static CURLcode pop3_state_pass_resp(struct Curl_easy *data, int pop3code,
   return result;
 }
 
+/***********************************************************************
+ *
+ * pop3_write()
+ *
+ * This function scans the body after the end-of-body and writes everything
+ * until the end is found.
+ */
+static CURLcode pop3_write(struct Curl_easy *data, const char *str,
+                           size_t nread, bool is_eos)
+{
+  /* This code could be made into a special function in the handler struct */
+  CURLcode result = CURLE_OK;
+  struct connectdata *conn = data->conn;
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
+  bool strip_dot = FALSE;
+  size_t last = 0;
+  size_t i;
+  (void)is_eos;
+
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
+
+  /* Search through the buffer looking for the end-of-body marker which is
+     5 bytes (0d 0a 2e 0d 0a). Note that a line starting with a dot matches
+     the eob so the server will have prefixed it with an extra dot which we
+     need to strip out. Additionally the marker could of course be spread out
+     over 5 different data chunks. */
+  for(i = 0; i < nread; i++) {
+    size_t prev = pop3c->eob;
+
+    switch(str[i]) {
+    case 0x0d:
+      if(pop3c->eob == 0) {
+        pop3c->eob++;
+
+        if(i) {
+          /* Write out the body part that did not match */
+          result = Curl_client_write(data, CLIENTWRITE_BODY, &str[last],
+                                     i - last);
+
+          if(result)
+            return result;
+
+          last = i;
+        }
+      }
+      else if(pop3c->eob == 3)
+        pop3c->eob++;
+      else
+        /* If the character match was not at position 0 or 3 then restart the
+           pattern matching */
+        pop3c->eob = 1;
+      break;
+
+    case 0x0a:
+      if(pop3c->eob == 1 || pop3c->eob == 4)
+        pop3c->eob++;
+      else
+        /* If the character match was not at position 1 or 4 then start the
+           search again */
+        pop3c->eob = 0;
+      break;
+
+    case 0x2e:
+      if(pop3c->eob == 2)
+        pop3c->eob++;
+      else if(pop3c->eob == 3) {
+        /* We have an extra dot after the CRLF which we need to strip off */
+        strip_dot = TRUE;
+        pop3c->eob = 0;
+      }
+      else
+        /* If the character match was not at position 2 then start the search
+           again */
+        pop3c->eob = 0;
+      break;
+
+    default:
+      pop3c->eob = 0;
+      break;
+    }
+
+    /* Did we have a partial match which has subsequently failed? */
+    if(prev && prev >= pop3c->eob) {
+      /* Strip can only be non-zero for the first mismatch after CRLF and
+         then both prev and strip are equal and nothing will be output below */
+      while(prev && pop3c->strip) {
+        prev--;
+        pop3c->strip--;
+      }
+
+      if(prev) {
+        /* If the partial match was the CRLF and dot then only write the CRLF
+           as the server would have inserted the dot */
+        if(strip_dot && prev - 1 > 0) {
+          result = Curl_client_write(data, CLIENTWRITE_BODY, POP3_EOB,
+                                     prev - 1);
+        }
+        else if(!strip_dot) {
+          result = Curl_client_write(data, CLIENTWRITE_BODY, POP3_EOB,
+                                     prev);
+        }
+        else {
+          result = CURLE_OK;
+        }
+
+        if(result)
+          return result;
+
+        last = i;
+        strip_dot = FALSE;
+      }
+    }
+  }
+
+  if(pop3c->eob == POP3_EOB_LEN) {
+    /* We have a full match so the transfer is done, however we must transfer
+    the CRLF at the start of the EOB as this is considered to be part of the
+    message as per RFC-1939, sect. 3 */
+    result = Curl_client_write(data, CLIENTWRITE_BODY, POP3_EOB, 2);
+
+    CURL_REQ_CLEAR_RECV(data);
+    pop3c->eob = 0;
+
+    return result;
+  }
+
+  if(pop3c->eob)
+    /* While EOB is matching nothing should be output */
+    return CURLE_OK;
+
+  if(nread - last) {
+    result = Curl_client_write(data, CLIENTWRITE_BODY, &str[last],
+                               nread - last);
+  }
+
+  return result;
+}
+
 /* For command responses */
 static CURLcode pop3_state_command_resp(struct Curl_easy *data,
                                         int pop3code,
@@ -919,12 +1212,15 @@ static CURLcode pop3_state_command_resp(struct Curl_easy *data,
 {
   CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
-  struct POP3 *pop3 = data->req.p.pop3;
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
-  struct pingpong *pp = &pop3c->pp;
+  struct POP3 *pop3 = Curl_meta_get(data, CURL_META_POP3_EASY);
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
+  struct pingpong *pp;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
+  if(!pop3 || !pop3c)
+    return CURLE_FAILED_INIT;
 
+  pp = &pop3c->pp;
   if(pop3code != '+') {
     pop3_state(data, POP3_STOP);
     return CURLE_WEIRD_SERVER_REPLY;
@@ -936,32 +1232,37 @@ static CURLcode pop3_state_command_resp(struct Curl_easy *data,
      when there is no body to return. */
   pop3c->eob = 2;
 
-  /* But since this initial CR LF pair is not part of the actual body, we set
-     the strip counter here so that these bytes won't be delivered. */
+  /* Since this initial CR LF pair is not part of the actual body, we set
+     the strip counter here so that these bytes will not be delivered. */
   pop3c->strip = 2;
 
   if(pop3->transfer == PPTRANSFER_BODY) {
     /* POP3 download */
-    Curl_setup_transfer(data, FIRSTSOCKET, -1, FALSE, -1);
+    Curl_xfer_setup_recv(data, FIRSTSOCKET, -1);
 
-    if(pp->cache) {
-      /* The header "cache" contains a bunch of data that is actually body
-         content so send it as such. Note that there may even be additional
-         "headers" after the body */
+    if(pp->overflow) {
+      /* The recv buffer contains data that is actually body content so send
+         it as such. Note that there may even be additional "headers" after
+         the body */
+
+      /* keep only the overflow */
+      curlx_dyn_tail(&pp->recvbuf, pp->overflow);
+      pp->nfinal = 0; /* done */
 
       if(!data->req.no_body) {
-        result = Curl_pop3_write(data, pp->cache, pp->cache_size);
+        result = pop3_write(data, curlx_dyn_ptr(&pp->recvbuf),
+                            curlx_dyn_len(&pp->recvbuf), FALSE);
         if(result)
           return result;
       }
 
-      /* Free the cache */
-      Curl_safefree(pp->cache);
-
-      /* Reset the cache size */
-      pp->cache_size = 0;
+      /* reset the buffer */
+      curlx_dyn_reset(&pp->recvbuf);
+      pp->overflow = 0;
     }
   }
+  else
+    pp->overflow = 0;
 
   /* End of DO phase */
   pop3_state(data, POP3_STOP);
@@ -972,27 +1273,34 @@ static CURLcode pop3_state_command_resp(struct Curl_easy *data,
 static CURLcode pop3_statemachine(struct Curl_easy *data,
                                   struct connectdata *conn)
 {
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
   CURLcode result = CURLE_OK;
-  curl_socket_t sock = conn->sock[FIRSTSOCKET];
   int pop3code;
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
-  struct pingpong *pp = &pop3c->pp;
+  struct pingpong *pp;
   size_t nread = 0;
   (void)data;
 
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
+
+  pp = &pop3c->pp;
   /* Busy upgrading the connection; right now all I/O is SSL/TLS, not POP3 */
-  if(pop3c->state == POP3_UPGRADETLS)
-    return pop3_perform_upgrade_tls(data, conn);
+upgrade_tls:
+  if(pop3c->state == POP3_UPGRADETLS) {
+    result = pop3_perform_upgrade_tls(data, conn);
+    if(result || (pop3c->state == POP3_UPGRADETLS))
+      return result;
+  }
 
   /* Flush any data that needs to be sent */
   if(pp->sendleft)
     return Curl_pp_flushsend(data, pp);
 
- do {
-    /* Read the response from the server */
-   result = Curl_pp_readresp(data, sock, pp, &pop3code, &nread);
-   if(result)
-     return result;
+  do {
+     /* Read the response from the server */
+    result = Curl_pp_readresp(data, FIRSTSOCKET, pp, &pop3code, &nread);
+    if(result)
+      return result;
 
     if(!pop3code)
       break;
@@ -1009,6 +1317,10 @@ static CURLcode pop3_statemachine(struct Curl_easy *data,
 
     case POP3_STARTTLS:
       result = pop3_state_starttls_resp(data, conn, pop3code, pop3c->state);
+      /* During UPGRADETLS, leave the read loop as we need to connect
+       * (e.g. TLS handshake) before we continue sending/receiving. */
+      if(!result && (pop3c->state == POP3_UPGRADETLS))
+        goto upgrade_tls;
       break;
 
     case POP3_AUTH:
@@ -1052,18 +1364,12 @@ static CURLcode pop3_multi_statemach(struct Curl_easy *data, bool *done)
 {
   CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
-
-  if((conn->handler->flags & PROTOPT_SSL) && !pop3c->ssldone) {
-    bool ssldone = FALSE;
-    result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssldone);
-    pop3c->ssldone = ssldone;
-    if(result || !pop3c->ssldone)
-      return result;
-  }
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
 
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
   result = Curl_pp_statemach(data, &pop3c->pp, FALSE, FALSE);
-  *done = (pop3c->state == POP3_STOP) ? TRUE : FALSE;
+  *done = (pop3c->state == POP3_STOP);
 
   return result;
 }
@@ -1073,7 +1379,10 @@ static CURLcode pop3_block_statemach(struct Curl_easy *data,
                                      bool disconnecting)
 {
   CURLcode result = CURLE_OK;
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
+
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
 
   while(pop3c->state != POP3_STOP && !result)
     result = Curl_pp_statemach(data, &pop3c->pp, TRUE, disconnecting);
@@ -1081,27 +1390,29 @@ static CURLcode pop3_block_statemach(struct Curl_easy *data,
   return result;
 }
 
-/* Allocate and initialize the POP3 struct for the current Curl_easy if
-   required */
-static CURLcode pop3_init(struct Curl_easy *data)
-{
-  CURLcode result = CURLE_OK;
-  struct POP3 *pop3;
-
-  pop3 = data->req.p.pop3 = calloc(sizeof(struct POP3), 1);
-  if(!pop3)
-    result = CURLE_OUT_OF_MEMORY;
-
-  return result;
-}
-
 /* For the POP3 "protocol connect" and "doing" phases only */
-static int pop3_getsock(struct Curl_easy *data,
-                        struct connectdata *conn, curl_socket_t *socks)
+static CURLcode pop3_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps)
 {
-  return Curl_pp_getsock(data, &conn->proto.pop3c.pp, socks);
+  struct pop3_conn *pop3c =
+    Curl_conn_meta_get(data->conn, CURL_META_POP3_CONN);
+  return pop3c ? Curl_pp_pollset(data, &pop3c->pp, ps) : CURLE_OK;
 }
 
+/* SASL parameters for the pop3 protocol */
+static const struct SASLproto saslpop3 = {
+  "pop",                /* The service name */
+  pop3_perform_auth,    /* Send authentication command */
+  pop3_continue_auth,   /* Send authentication continuation */
+  pop3_cancel_auth,     /* Send authentication cancellation */
+  pop3_get_message,     /* Get SASL response message */
+  255 - 8,              /* Max line len - strlen("AUTH ") - 1 space - crlf */
+  '*',                  /* Code received when continuation is expected */
+  '+',                  /* Code to receive upon authentication success */
+  SASL_AUTH_DEFAULT,    /* Default mechanisms */
+  SASL_FLAG_BASE64      /* Configuration flags */
+};
+
 /***********************************************************************
  *
  * pop3_connect()
@@ -1116,13 +1427,12 @@ static CURLcode pop3_connect(struct Curl_easy *data, bool *done)
 {
   CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
-  struct pingpong *pp = &pop3c->pp;
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
+  struct pingpong *pp = pop3c ? &pop3c->pp : NULL;
 
   *done = FALSE; /* default to not done yet */
-
-  /* We always support persistent connections in POP3 */
-  connkeep(conn, "POP3 default");
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
 
   PINGPONG_SETUP(pp, pop3_statemachine, pop3_endofresp);
 
@@ -1130,9 +1440,8 @@ static CURLcode pop3_connect(struct Curl_easy *data, bool *done)
   pop3c->preftype = POP3_TYPE_ANY;
   Curl_sasl_init(&pop3c->sasl, data, &saslpop3);
 
-  /* Initialise the pingpong layer */
-  Curl_pp_setup(pp);
-  Curl_pp_init(data, pp);
+  /* Initialize the pingpong layer */
+  Curl_pp_init(pp, Curl_pgrs_now(data));
 
   /* Parse the URL options */
   result = pop3_parse_url_options(conn);
@@ -1160,7 +1469,7 @@ static CURLcode pop3_done(struct Curl_easy *data, CURLcode status,
                           bool premature)
 {
   CURLcode result = CURLE_OK;
-  struct POP3 *pop3 = data->req.p.pop3;
+  struct POP3 *pop3 = Curl_meta_get(data, CURL_META_POP3_EASY);
 
   (void)premature;
 
@@ -1173,8 +1482,8 @@ static CURLcode pop3_done(struct Curl_easy *data, CURLcode status,
   }
 
   /* Cleanup our per-request based variables */
-  Curl_safefree(pop3->id);
-  Curl_safefree(pop3->custom);
+  curlx_safefree(pop3->id);
+  curlx_safefree(pop3->custom);
 
   /* Clear the transfer mode for the next request */
   pop3->transfer = PPTRANSFER_BODY;
@@ -1194,22 +1503,24 @@ static CURLcode pop3_perform(struct Curl_easy *data, bool *connected,
 {
   /* This is POP3 and no proxy */
   CURLcode result = CURLE_OK;
-  struct POP3 *pop3 = data->req.p.pop3;
+  struct POP3 *pop3 = Curl_meta_get(data, CURL_META_POP3_EASY);
+
+  if(!pop3)
+    return CURLE_FAILED_INIT;
 
   DEBUGF(infof(data, "DO phase starts"));
 
-  if(data->req.no_body) {
-    /* Requested no body means no transfer */
-    pop3->transfer = PPTRANSFER_INFO;
-  }
-
-  *dophase_done = FALSE; /* not done yet */
-
-  /* Start the first command in the DO phase */
+  /* Start the first command in the DO phase, may alter data->req.no_body */
   result = pop3_perform_command(data);
   if(result)
     return result;
 
+  if(data->req.no_body)
+    /* Requested no body means no transfer */
+    pop3->transfer = PPTRANSFER_INFO;
+
+  *dophase_done = FALSE; /* not done yet */
+
   /* Run the state-machine */
   result = pop3_multi_statemach(data, dophase_done);
   *connected = Curl_conn_is_connected(data->conn, FIRSTSOCKET);
@@ -1220,6 +1531,46 @@ static CURLcode pop3_perform(struct Curl_easy *data, bool *connected,
   return result;
 }
 
+/* Call this when the DO phase has completed */
+static CURLcode pop3_dophase_done(struct Curl_easy *data, bool connected)
+{
+  (void)data;
+  (void)connected;
+
+  return CURLE_OK;
+}
+
+/***********************************************************************
+ *
+ * pop3_regular_transfer()
+ *
+ * The input argument is already checked for validity.
+ *
+ * Performs all commands done before a regular transfer between a local and a
+ * remote host.
+ */
+static CURLcode pop3_regular_transfer(struct Curl_easy *data,
+                                      bool *dophase_done)
+{
+  CURLcode result = CURLE_OK;
+  bool connected = FALSE;
+
+  /* Make sure size is unknown at this point */
+  data->req.size = -1;
+
+  /* Set the progress data */
+  Curl_pgrsReset(data);
+
+  /* Carry out the perform */
+  result = pop3_perform(data, &connected, dophase_done);
+
+  /* Perform post DO phase operations if necessary */
+  if(!result && *dophase_done)
+    result = pop3_dophase_done(data, connected);
+
+  return result;
+}
+
 /***********************************************************************
  *
  * pop3_do()
@@ -1259,14 +1610,18 @@ static CURLcode pop3_do(struct Curl_easy *data, bool *done)
 static CURLcode pop3_disconnect(struct Curl_easy *data,
                                 struct connectdata *conn, bool dead_connection)
 {
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
+  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
   (void)data;
 
+  if(!pop3c)
+    return CURLE_FAILED_INIT;
+
   /* We cannot send quit unconditionally. If this connection is stale or
      bad in any way, sending quit and waiting around here will make the
      disconnect wait in vain and cause more problems than we need to. */
 
-  if(!dead_connection && conn->bits.protoconnstart) {
+  if(!dead_connection && conn->bits.protoconnstart &&
+     !Curl_pp_needs_flush(data, &pop3c->pp)) {
     if(!pop3_perform_quit(data, conn))
       (void)pop3_block_statemach(data, conn, TRUE); /* ignore errors on QUIT */
   }
@@ -1274,20 +1629,8 @@ static CURLcode pop3_disconnect(struct Curl_easy *data,
   /* Disconnect from the server */
   Curl_pp_disconnect(&pop3c->pp);
 
-  /* Cleanup the SASL module */
-  Curl_sasl_cleanup(conn, pop3c->sasl.authused);
-
   /* Cleanup our connection based variables */
-  Curl_safefree(pop3c->apoptimestamp);
-
-  return CURLE_OK;
-}
-
-/* Call this when the DO phase has completed */
-static CURLcode pop3_dophase_done(struct Curl_easy *data, bool connected)
-{
-  (void)data;
-  (void)connected;
+  curlx_safefree(pop3c->apoptimestamp);
 
   return CURLE_OK;
 }
@@ -1308,280 +1651,67 @@ static CURLcode pop3_doing(struct Curl_easy *data, bool *dophase_done)
   return result;
 }
 
-/***********************************************************************
- *
- * pop3_regular_transfer()
- *
- * The input argument is already checked for validity.
- *
- * Performs all commands done before a regular transfer between a local and a
- * remote host.
- */
-static CURLcode pop3_regular_transfer(struct Curl_easy *data,
-                                      bool *dophase_done)
+static void pop3_easy_dtor(void *key, size_t klen, void *entry)
 {
-  CURLcode result = CURLE_OK;
-  bool connected = FALSE;
+  struct POP3 *pop3 = entry;
+  (void)key;
+  (void)klen;
+  DEBUGASSERT(pop3);
+  /* Cleanup our per-request based variables */
+  curlx_safefree(pop3->id);
+  curlx_safefree(pop3->custom);
+  curlx_free(pop3);
+}
 
-  /* Make sure size is unknown at this point */
-  data->req.size = -1;
-
-  /* Set the progress data */
-  Curl_pgrsSetUploadCounter(data, 0);
-  Curl_pgrsSetDownloadCounter(data, 0);
-  Curl_pgrsSetUploadSize(data, -1);
-  Curl_pgrsSetDownloadSize(data, -1);
-
-  /* Carry out the perform */
-  result = pop3_perform(data, &connected, dophase_done);
-
-  /* Perform post DO phase operations if necessary */
-  if(!result && *dophase_done)
-    result = pop3_dophase_done(data, connected);
-
-  return result;
+static void pop3_conn_dtor(void *key, size_t klen, void *entry)
+{
+  struct pop3_conn *pop3c = entry;
+  (void)key;
+  (void)klen;
+  DEBUGASSERT(pop3c);
+  Curl_pp_disconnect(&pop3c->pp);
+  curlx_safefree(pop3c->apoptimestamp);
+  curlx_free(pop3c);
 }
 
 static CURLcode pop3_setup_connection(struct Curl_easy *data,
                                       struct connectdata *conn)
 {
-  /* Initialise the POP3 layer */
-  CURLcode result = pop3_init(data);
-  if(result)
-    return result;
+  struct pop3_conn *pop3c;
+  struct POP3 *pop3 = curlx_calloc(1, sizeof(*pop3));
+  if(!pop3 ||
+     Curl_meta_set(data, CURL_META_POP3_EASY, pop3, pop3_easy_dtor))
+    return CURLE_OUT_OF_MEMORY;
 
-  /* Clear the TLS upgraded flag */
-  conn->bits.tls_upgraded = FALSE;
+  pop3c = curlx_calloc(1, sizeof(*pop3c));
+  if(!pop3c ||
+     Curl_conn_meta_set(conn, CURL_META_POP3_CONN, pop3c, pop3_conn_dtor))
+    return CURLE_OUT_OF_MEMORY;
 
   return CURLE_OK;
 }
 
-/***********************************************************************
- *
- * pop3_parse_url_options()
- *
- * Parse the URL login options.
+/*
+ * POP3 protocol.
  */
-static CURLcode pop3_parse_url_options(struct connectdata *conn)
-{
-  CURLcode result = CURLE_OK;
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
-  const char *ptr = conn->options;
-
-  while(!result && ptr && *ptr) {
-    const char *key = ptr;
-    const char *value;
-
-    while(*ptr && *ptr != '=')
-      ptr++;
-
-    value = ptr + 1;
-
-    while(*ptr && *ptr != ';')
-      ptr++;
-
-    if(strncasecompare(key, "AUTH=", 5)) {
-      result = Curl_sasl_parse_url_auth_option(&pop3c->sasl,
-                                               value, ptr - value);
-
-      if(result && strncasecompare(value, "+APOP", ptr - value)) {
-        pop3c->preftype = POP3_TYPE_APOP;
-        pop3c->sasl.prefmech = SASL_AUTH_NONE;
-        result = CURLE_OK;
-      }
-    }
-    else
-      result = CURLE_URL_MALFORMAT;
-
-    if(*ptr == ';')
-      ptr++;
-  }
-
-  if(pop3c->preftype != POP3_TYPE_APOP)
-    switch(pop3c->sasl.prefmech) {
-    case SASL_AUTH_NONE:
-      pop3c->preftype = POP3_TYPE_NONE;
-      break;
-    case SASL_AUTH_DEFAULT:
-      pop3c->preftype = POP3_TYPE_ANY;
-      break;
-    default:
-      pop3c->preftype = POP3_TYPE_SASL;
-      break;
-    }
-
-  return result;
-}
-
-/***********************************************************************
- *
- * pop3_parse_url_path()
- *
- * Parse the URL path into separate path components.
- */
-static CURLcode pop3_parse_url_path(struct Curl_easy *data)
-{
-  /* The POP3 struct is already initialised in pop3_connect() */
-  struct POP3 *pop3 = data->req.p.pop3;
-  const char *path = &data->state.up.path[1]; /* skip leading path */
-
-  /* URL decode the path for the message ID */
-  return Curl_urldecode(path, 0, &pop3->id, NULL, REJECT_CTRL);
-}
-
-/***********************************************************************
- *
- * pop3_parse_custom_request()
- *
- * Parse the custom request.
- */
-static CURLcode pop3_parse_custom_request(struct Curl_easy *data)
-{
-  CURLcode result = CURLE_OK;
-  struct POP3 *pop3 = data->req.p.pop3;
-  const char *custom = data->set.str[STRING_CUSTOMREQUEST];
-
-  /* URL decode the custom request */
-  if(custom)
-    result = Curl_urldecode(custom, 0, &pop3->custom, NULL, REJECT_CTRL);
-
-  return result;
-}
-
-/***********************************************************************
- *
- * Curl_pop3_write()
- *
- * This function scans the body after the end-of-body and writes everything
- * until the end is found.
- */
-CURLcode Curl_pop3_write(struct Curl_easy *data, char *str, size_t nread)
-{
-  /* This code could be made into a special function in the handler struct */
-  CURLcode result = CURLE_OK;
-  struct SingleRequest *k = &data->req;
-  struct connectdata *conn = data->conn;
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
-  bool strip_dot = FALSE;
-  size_t last = 0;
-  size_t i;
-
-  /* Search through the buffer looking for the end-of-body marker which is
-     5 bytes (0d 0a 2e 0d 0a). Note that a line starting with a dot matches
-     the eob so the server will have prefixed it with an extra dot which we
-     need to strip out. Additionally the marker could of course be spread out
-     over 5 different data chunks. */
-  for(i = 0; i < nread; i++) {
-    size_t prev = pop3c->eob;
-
-    switch(str[i]) {
-    case 0x0d:
-      if(pop3c->eob == 0) {
-        pop3c->eob++;
-
-        if(i) {
-          /* Write out the body part that didn't match */
-          result = Curl_client_write(data, CLIENTWRITE_BODY, &str[last],
-                                     i - last);
-
-          if(result)
-            return result;
-
-          last = i;
-        }
-      }
-      else if(pop3c->eob == 3)
-        pop3c->eob++;
-      else
-        /* If the character match wasn't at position 0 or 3 then restart the
-           pattern matching */
-        pop3c->eob = 1;
-      break;
-
-    case 0x0a:
-      if(pop3c->eob == 1 || pop3c->eob == 4)
-        pop3c->eob++;
-      else
-        /* If the character match wasn't at position 1 or 4 then start the
-           search again */
-        pop3c->eob = 0;
-      break;
-
-    case 0x2e:
-      if(pop3c->eob == 2)
-        pop3c->eob++;
-      else if(pop3c->eob == 3) {
-        /* We have an extra dot after the CRLF which we need to strip off */
-        strip_dot = TRUE;
-        pop3c->eob = 0;
-      }
-      else
-        /* If the character match wasn't at position 2 then start the search
-           again */
-        pop3c->eob = 0;
-      break;
-
-    default:
-      pop3c->eob = 0;
-      break;
-    }
-
-    /* Did we have a partial match which has subsequently failed? */
-    if(prev && prev >= pop3c->eob) {
-      /* Strip can only be non-zero for the very first mismatch after CRLF
-         and then both prev and strip are equal and nothing will be output
-         below */
-      while(prev && pop3c->strip) {
-        prev--;
-        pop3c->strip--;
-      }
-
-      if(prev) {
-        /* If the partial match was the CRLF and dot then only write the CRLF
-           as the server would have inserted the dot */
-        if(strip_dot && prev - 1 > 0) {
-          result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)POP3_EOB,
-                                     prev - 1);
-        }
-        else if(!strip_dot) {
-          result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)POP3_EOB,
-                                     prev);
-        }
-        else {
-          result = CURLE_OK;
-        }
-
-        if(result)
-          return result;
-
-        last = i;
-        strip_dot = FALSE;
-      }
-    }
-  }
-
-  if(pop3c->eob == POP3_EOB_LEN) {
-    /* We have a full match so the transfer is done, however we must transfer
-    the CRLF at the start of the EOB as this is considered to be part of the
-    message as per RFC-1939, sect. 3 */
-    result = Curl_client_write(data, CLIENTWRITE_BODY, (char *)POP3_EOB, 2);
-
-    k->keepon &= ~KEEP_RECV;
-    pop3c->eob = 0;
-
-    return result;
-  }
-
-  if(pop3c->eob)
-    /* While EOB is matching nothing should be output */
-    return CURLE_OK;
-
-  if(nread - last) {
-    result = Curl_client_write(data, CLIENTWRITE_BODY, &str[last],
-                               nread - last);
-  }
-
-  return result;
-}
+const struct Curl_protocol Curl_protocol_pop3 = {
+  pop3_setup_connection,            /* setup_connection */
+  pop3_do,                          /* do_it */
+  pop3_done,                        /* done */
+  ZERO_NULL,                        /* do_more */
+  pop3_connect,                     /* connect_it */
+  pop3_multi_statemach,             /* connecting */
+  pop3_doing,                       /* doing */
+  pop3_pollset,                     /* proto_pollset */
+  pop3_pollset,                     /* doing_pollset */
+  ZERO_NULL,                        /* domore_pollset */
+  ZERO_NULL,                        /* perform_pollset */
+  pop3_disconnect,                  /* disconnect */
+  pop3_write,                       /* write_resp */
+  ZERO_NULL,                        /* write_resp_hd */
+  ZERO_NULL,                        /* connection_is_dead */
+  ZERO_NULL,                        /* attach connection */
+  ZERO_NULL,                        /* follow */
+};
 
 #endif /* CURL_DISABLE_POP3 */
diff --git a/third-party/curl/lib/pop3.h b/third-party/curl/lib/pop3.h
index 83f0f831e6..75c3a67da7 100644
--- a/third-party/curl/lib/pop3.h
+++ b/third-party/curl/lib/pop3.h
@@ -23,75 +23,8 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
-#include "pingpong.h"
-#include "curl_sasl.h"
-
-/****************************************************************************
- * POP3 unique setup
- ***************************************************************************/
-typedef enum {
-  POP3_STOP,         /* do nothing state, stops the state machine */
-  POP3_SERVERGREET,  /* waiting for the initial greeting immediately after
-                        a connect */
-  POP3_CAPA,
-  POP3_STARTTLS,
-  POP3_UPGRADETLS,   /* asynchronously upgrade the connection to SSL/TLS
-                       (multi mode only) */
-  POP3_AUTH,
-  POP3_APOP,
-  POP3_USER,
-  POP3_PASS,
-  POP3_COMMAND,
-  POP3_QUIT,
-  POP3_LAST          /* never used */
-} pop3state;
-
-/* This POP3 struct is used in the Curl_easy. All POP3 data that is
-   connection-oriented must be in pop3_conn to properly deal with the fact that
-   perhaps the Curl_easy is changed between the times the connection is
-   used. */
-struct POP3 {
-  curl_pp_transfer transfer;
-  char *id;               /* Message ID */
-  char *custom;           /* Custom Request */
-};
-
-/* pop3_conn is used for struct connection-oriented data in the connectdata
-   struct */
-struct pop3_conn {
-  struct pingpong pp;
-  pop3state state;        /* Always use pop3.c:state() to change state! */
-  size_t eob;             /* Number of bytes of the EOB (End Of Body) that
-                             have been received so far */
-  size_t strip;           /* Number of bytes from the start to ignore as
-                             non-body */
-  struct SASL sasl;       /* SASL-related storage */
-  char *apoptimestamp;    /* APOP timestamp from the server greeting */
-  unsigned char authtypes; /* Accepted authentication types */
-  unsigned char preftype;  /* Preferred authentication type */
-  BIT(ssldone);           /* Is connect() over SSL done? */
-  BIT(tls_supported);     /* StartTLS capability supported by server */
-};
-
-extern const struct Curl_handler Curl_handler_pop3;
-extern const struct Curl_handler Curl_handler_pop3s;
-
-/* Authentication type flags */
-#define POP3_TYPE_CLEARTEXT (1 << 0)
-#define POP3_TYPE_APOP      (1 << 1)
-#define POP3_TYPE_SASL      (1 << 2)
-
-/* Authentication type values */
-#define POP3_TYPE_NONE      0
-#define POP3_TYPE_ANY       (POP3_TYPE_CLEARTEXT|POP3_TYPE_APOP|POP3_TYPE_SASL)
-
-/* This is the 5-bytes End-Of-Body marker for POP3 */
-#define POP3_EOB "\x0d\x0a\x2e\x0d\x0a"
-#define POP3_EOB_LEN 5
-
-/* This function scans the body after the end-of-body and writes everything
- * until the end is found */
-CURLcode Curl_pop3_write(struct Curl_easy *data, char *str, size_t nread);
+#ifndef CURL_DISABLE_POP3
+extern const struct Curl_protocol Curl_protocol_pop3;
+#endif
 
 #endif /* HEADER_CURL_POP3_H */
diff --git a/third-party/curl/lib/progress.c b/third-party/curl/lib/progress.c
index 6092b782c7..969b29a275 100644
--- a/third-party/curl/lib/progress.c
+++ b/third-party/curl/lib/progress.c
@@ -21,103 +21,164 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #include "urldata.h"
-#include "sendf.h"
+#include "curl_trc.h"
 #include "multiif.h"
 #include "progress.h"
-#include "timeval.h"
-#include "curl_printf.h"
-
-/* check rate limits within this many recent milliseconds, at minimum. */
-#define MIN_RATE_LIMIT_PERIOD 3000
+#include "transfer.h"
+#include "curlx/strcopy.h"
 
 #ifndef CURL_DISABLE_PROGRESS_METER
-/* Provide a string that is 2 + 1 + 2 + 1 + 2 = 8 letters long (plus the zero
-   byte) */
-static void time2str(char *r, curl_off_t seconds)
+/* Provide a string that is 7 letters long (plus the zero byte).
+
+   @unittest 1636
+*/
+UNITTEST void time2str(char *r, size_t rsize, curl_off_t seconds);
+UNITTEST void time2str(char *r, size_t rsize, curl_off_t seconds)
 {
   curl_off_t h;
   if(seconds <= 0) {
-    strcpy(r, "--:--:--");
+    curlx_strcopy(r, rsize, STRCONST("       "));
     return;
   }
-  h = seconds / CURL_OFF_T_C(3600);
-  if(h <= CURL_OFF_T_C(99)) {
-    curl_off_t m = (seconds - (h*CURL_OFF_T_C(3600))) / CURL_OFF_T_C(60);
-    curl_off_t s = (seconds - (h*CURL_OFF_T_C(3600))) - (m*CURL_OFF_T_C(60));
-    msnprintf(r, 9, "%2" CURL_FORMAT_CURL_OFF_T ":%02" CURL_FORMAT_CURL_OFF_T
-              ":%02" CURL_FORMAT_CURL_OFF_T, h, m, s);
+  h = seconds / 3600;
+  if(h <= 99) {
+    curl_off_t m = (seconds - (h * 3600)) / 60;
+    if(h <= 9) {
+      curl_off_t s = (seconds - (h * 3600)) - (m * 60);
+      if(h)
+        curl_msnprintf(r, rsize, "%" FMT_OFF_T ":%02" FMT_OFF_T ":"
+                       "%02" FMT_OFF_T, h, m, s);
+      else
+        curl_msnprintf(r, rsize, "  %02" FMT_OFF_T ":%02" FMT_OFF_T, m, s);
+    }
+    else
+      curl_msnprintf(r, rsize, "%" FMT_OFF_T "h %02" FMT_OFF_T "m", h, m);
   }
   else {
-    /* this equals to more than 99 hours, switch to a more suitable output
-       format to fit within the limits. */
-    curl_off_t d = seconds / CURL_OFF_T_C(86400);
-    h = (seconds - (d*CURL_OFF_T_C(86400))) / CURL_OFF_T_C(3600);
-    if(d <= CURL_OFF_T_C(999))
-      msnprintf(r, 9, "%3" CURL_FORMAT_CURL_OFF_T
-                "d %02" CURL_FORMAT_CURL_OFF_T "h", d, h);
-    else
-      msnprintf(r, 9, "%7" CURL_FORMAT_CURL_OFF_T "d", d);
+    curl_off_t d = seconds / 86400;
+    h = (seconds - (d * 86400)) / 3600;
+    if(d <= 99)
+      curl_msnprintf(r, rsize, "%2" FMT_OFF_T "d %02" FMT_OFF_T "h", d, h);
+    else if(d <= 999)
+      curl_msnprintf(r, rsize, "%6" FMT_OFF_T "d", d);
+    else { /* more than 999 days */
+      curl_off_t m = d / 30;
+      if(m <= 999)
+        curl_msnprintf(r, rsize, "%6" FMT_OFF_T "m", m);
+      else { /* more than 999 months */
+        curl_off_t y = d / 365;
+        if(y <= 99999)
+          curl_msnprintf(r, rsize, "%6" FMT_OFF_T "y", y);
+        else
+          curlx_strcopy(r, rsize, STRCONST(">99999y"));
+      }
+    }
   }
 }
 
 /* The point of this function would be to return a string of the input data,
-   but never longer than 5 columns (+ one zero byte).
-   Add suffix k, M, G when suitable... */
-static char *max5data(curl_off_t bytes, char *max5)
+   but never longer than 6 columns (+ one zero byte).
+   Add suffix k, M, G when suitable...
+
+   @unittest 1636
+*/
+UNITTEST char *max6out(curl_off_t bytes, char *max6, size_t mlen);
+UNITTEST char *max6out(curl_off_t bytes, char *max6, size_t mlen)
 {
-#define ONE_KILOBYTE  CURL_OFF_T_C(1024)
-#define ONE_MEGABYTE (CURL_OFF_T_C(1024) * ONE_KILOBYTE)
-#define ONE_GIGABYTE (CURL_OFF_T_C(1024) * ONE_MEGABYTE)
-#define ONE_TERABYTE (CURL_OFF_T_C(1024) * ONE_GIGABYTE)
-#define ONE_PETABYTE (CURL_OFF_T_C(1024) * ONE_TERABYTE)
-
-  if(bytes < CURL_OFF_T_C(100000))
-    msnprintf(max5, 6, "%5" CURL_FORMAT_CURL_OFF_T, bytes);
-
-  else if(bytes < CURL_OFF_T_C(10000) * ONE_KILOBYTE)
-    msnprintf(max5, 6, "%4" CURL_FORMAT_CURL_OFF_T "k", bytes/ONE_KILOBYTE);
-
-  else if(bytes < CURL_OFF_T_C(100) * ONE_MEGABYTE)
-    /* 'XX.XM' is good as long as we're less than 100 megs */
-    msnprintf(max5, 6, "%2" CURL_FORMAT_CURL_OFF_T ".%0"
-              CURL_FORMAT_CURL_OFF_T "M", bytes/ONE_MEGABYTE,
-              (bytes%ONE_MEGABYTE) / (ONE_MEGABYTE/CURL_OFF_T_C(10)) );
-
-  else if(bytes < CURL_OFF_T_C(10000) * ONE_MEGABYTE)
-    /* 'XXXXM' is good until we're at 10000MB or above */
-    msnprintf(max5, 6, "%4" CURL_FORMAT_CURL_OFF_T "M", bytes/ONE_MEGABYTE);
-
-  else if(bytes < CURL_OFF_T_C(100) * ONE_GIGABYTE)
-    /* 10000 MB - 100 GB, we show it as XX.XG */
-    msnprintf(max5, 6, "%2" CURL_FORMAT_CURL_OFF_T ".%0"
-              CURL_FORMAT_CURL_OFF_T "G", bytes/ONE_GIGABYTE,
-              (bytes%ONE_GIGABYTE) / (ONE_GIGABYTE/CURL_OFF_T_C(10)) );
-
-  else if(bytes < CURL_OFF_T_C(10000) * ONE_GIGABYTE)
-    /* up to 10000GB, display without decimal: XXXXG */
-    msnprintf(max5, 6, "%4" CURL_FORMAT_CURL_OFF_T "G", bytes/ONE_GIGABYTE);
-
-  else if(bytes < CURL_OFF_T_C(10000) * ONE_TERABYTE)
-    /* up to 10000TB, display without decimal: XXXXT */
-    msnprintf(max5, 6, "%4" CURL_FORMAT_CURL_OFF_T "T", bytes/ONE_TERABYTE);
-
-  else
-    /* up to 10000PB, display without decimal: XXXXP */
-    msnprintf(max5, 6, "%4" CURL_FORMAT_CURL_OFF_T "P", bytes/ONE_PETABYTE);
-
-  /* 16384 petabytes (16 exabytes) is the maximum a 64 bit unsigned number can
-     hold, but our data type is signed so 8192PB will be the maximum. */
-
-  return max5;
+  /* a signed 64-bit value is 8192 petabytes maximum, shown as
+     8.0E (exabytes)*/
+  if(bytes < 100000)
+    curl_msnprintf(max6, mlen, "%6" CURL_FORMAT_CURL_OFF_T, bytes);
+  else {
+    const char unit[] = { 'k', 'M', 'G', 'T', 'P', 'E', 0 };
+    int k = 0;
+    curl_off_t nbytes;
+    curl_off_t rest;
+    do {
+      nbytes = bytes / 1024;
+      if(nbytes < 1000)
+        break;
+      bytes = nbytes;
+      k++;
+      DEBUGASSERT(unit[k]);
+    } while(unit[k]);
+    rest = bytes % 1024;
+    if(nbytes <= 99)
+      /* xx.yyU */
+      curl_msnprintf(max6, mlen, "%2" CURL_FORMAT_CURL_OFF_T
+                     ".%02" CURL_FORMAT_CURL_OFF_T "%c", nbytes,
+                     rest * 100 / 1024, unit[k]);
+    else
+      /* xxx.yU */
+      curl_msnprintf(max6, mlen, "%3" CURL_FORMAT_CURL_OFF_T
+                     ".%" CURL_FORMAT_CURL_OFF_T "%c", nbytes,
+                     rest * 10 / 1024, unit[k]);
+  }
+  return max6;
 }
 #endif
 
-/*
+static void pgrs_speedinit(struct Curl_easy *data)
+{
+  memset(&data->state.keeps_speed, 0, sizeof(struct curltime));
+}
 
+/*
+ * @unittest 1606
+ */
+UNITTEST CURLcode pgrs_speedcheck(struct Curl_easy *data,
+                                  const struct curltime *pnow);
+UNITTEST CURLcode pgrs_speedcheck(struct Curl_easy *data,
+                                  const struct curltime *pnow)
+{
+  if(!data->set.low_speed_time || !data->set.low_speed_limit ||
+     Curl_xfer_recv_is_paused(data) || Curl_xfer_send_is_paused(data))
+    /* A paused transfer is not qualified for speed checks */
+    return CURLE_OK;
+
+  if(data->progress.current_speed >= 0) {
+    if(data->progress.current_speed < data->set.low_speed_limit) {
+      if(!data->state.keeps_speed.tv_sec)
+        /* under the limit at this moment */
+        data->state.keeps_speed = *pnow;
+      else {
+        /* how long has it been under the limit */
+        timediff_t howlong =
+          curlx_ptimediff_ms(pnow, &data->state.keeps_speed);
+
+        if(howlong >= data->set.low_speed_time * 1000) {
+          /* too long */
+          failf(data, "Operation too slow. Less than %" FMT_OFF_T
+                " bytes/sec transferred the last %u seconds",
+                data->set.low_speed_limit, data->set.low_speed_time);
+          return CURLE_OPERATION_TIMEDOUT;
+        }
+      }
+    }
+    else
+      /* faster right now */
+      data->state.keeps_speed.tv_sec = 0;
+  }
+
+  /* since low speed limit is enabled, set the expire timer to make this
+     connection's speed get checked again in a second */
+  Curl_expire(data, 1000, EXPIRE_SPEEDCHECK);
+
+  return CURLE_OK;
+}
+
+const struct curltime *Curl_pgrs_now(struct Curl_easy *data)
+{
+  struct curltime *pnow = data->multi ?
+                          &data->multi->now : &data->progress.now;
+  curlx_pnow(pnow);
+  return pnow;
+}
+
+/*
    New proposed interface, 9th of February 2000:
 
    pgrsStartNow() - sets start time
@@ -127,7 +188,6 @@ static char *max5data(curl_off_t bytes, char *max5)
    pgrsSetUploadCounter() - amount of data currently uploaded
    pgrsUpdate() - show progress
    pgrsDone() - transfer complete
-
 */
 
 int Curl_pgrsDone(struct Curl_easy *data)
@@ -138,16 +198,25 @@ int Curl_pgrsDone(struct Curl_easy *data)
   if(rc)
     return rc;
 
-  if(!(data->progress.flags & PGRS_HIDE) &&
-     !data->progress.callback)
-    /* only output if we don't use a progress callback and we're not
+  if(!data->progress.hide && !data->progress.callback)
+    /* only output if we do not use a progress callback and we are not
      * hidden */
-    fprintf(data->set.err, "\n");
+    curl_mfprintf(data->set.err, "\n");
 
-  data->progress.speeder_c = 0; /* reset the progress meter display */
   return 0;
 }
 
+void Curl_pgrsReset(struct Curl_easy *data)
+{
+  Curl_pgrsSetUploadCounter(data, 0);
+  data->progress.dl.cur_size = 0;
+  Curl_pgrsSetUploadSize(data, -1);
+  Curl_pgrsSetDownloadSize(data, -1);
+  data->progress.speeder_c = 0; /* reset speed records */
+  data->progress.deliver = 0;
+  pgrs_speedinit(data);
+}
+
 /* reset the known transfer sizes */
 void Curl_pgrsResetTransferSizes(struct Curl_easy *data)
 {
@@ -155,8 +224,47 @@ void Curl_pgrsResetTransferSizes(struct Curl_easy *data)
   Curl_pgrsSetUploadSize(data, -1);
 }
 
+void Curl_pgrsRecvPause(struct Curl_easy *data, bool enable)
+{
+  if(!enable) {
+    data->progress.speeder_c = 0; /* reset speed records */
+    pgrs_speedinit(data); /* reset low speed measurements */
+  }
+}
+
+void Curl_pgrsSendPause(struct Curl_easy *data, bool enable)
+{
+  if(!enable) {
+    data->progress.speeder_c = 0; /* reset speed records */
+    pgrs_speedinit(data); /* reset low speed measurements */
+  }
+}
+
+#ifdef CURLVERBOSE
+static const char * const pgrs_timer_names[] = {
+  "PGRS-NONE",
+  "PGRS-STARTOP",
+  "PGRS-STARTSINGLE",
+  "PGRS-POSTQUEUE",
+  "PGRS-NAMELOOKUP",
+  "PGRS-CONNECT",
+  "PGRS-APPCONNECT",
+  "PGRS-PRETRANSFER",
+  "PGRS-STARTTRANSFER",
+  "PGRS-POSTRANSFER",
+  "PGRS-STARTACCEPT",
+  "PGRS-REDIRECT",
+};
+
+static const char *pgrs_timer_name(timerid timer)
+{
+  if((size_t)timer < CURL_ARRAYSIZE(pgrs_timer_names))
+    return pgrs_timer_names[(size_t)timer];
+  return "?";
+}
+#endif /* CURLVERBOSE */
+
 /*
- *
  * Curl_pgrsTimeWas(). Store the timestamp time at the given label.
  */
 void Curl_pgrsTimeWas(struct Curl_easy *data, timerid timer,
@@ -172,11 +280,18 @@ void Curl_pgrsTimeWas(struct Curl_easy *data, timerid timer,
   case TIMER_STARTOP:
     /* This is set at the start of a transfer */
     data->progress.t_startop = timestamp;
+    data->progress.t_startqueue = timestamp;
+    data->progress.t_postqueue = 0;
     break;
   case TIMER_STARTSINGLE:
-    /* This is set at the start of each single fetch */
+    /* This is set at the start of each single transfer */
     data->progress.t_startsingle = timestamp;
-    data->progress.is_t_startransfer_set = false;
+    data->progress.is_t_startransfer_set = FALSE;
+    break;
+  case TIMER_POSTQUEUE:
+    /* Queue time is accumulative from all involved redirects */
+    data->progress.t_postqueue +=
+      curlx_ptimediff_us(&timestamp, &data->progress.t_startqueue);
     break;
   case TIMER_STARTACCEPT:
     data->progress.t_acceptdata = timestamp;
@@ -194,153 +309,98 @@ void Curl_pgrsTimeWas(struct Curl_easy *data, timerid timer,
     delta = &data->progress.t_pretransfer;
     break;
   case TIMER_STARTTRANSFER:
-    delta = &data->progress.t_starttransfer;
     /* prevent updating t_starttransfer unless:
-     *   1) this is the first time we're setting t_starttransfer
-     *   2) a redirect has occurred since the last time t_starttransfer was set
+     *   1. this is the first time we are setting t_starttransfer
+     *   2. a redirect has occurred since the last time t_starttransfer was set
      * This prevents repeated invocations of the function from incorrectly
      * changing the t_starttransfer time.
      */
     if(data->progress.is_t_startransfer_set) {
+      CURL_TRC_M(data, "[%s] ignored", pgrs_timer_name(timer));
       return;
     }
-    else {
-      data->progress.is_t_startransfer_set = true;
-      break;
-    }
+    data->progress.is_t_startransfer_set = TRUE;
+    delta = &data->progress.t_starttransfer;
+    break;
   case TIMER_POSTRANSFER:
-    /* this is the normal end-of-transfer thing */
+    delta = &data->progress.t_posttransfer;
     break;
   case TIMER_REDIRECT:
-    data->progress.t_redirect = Curl_timediff_us(timestamp,
-                                                 data->progress.start);
+    data->progress.t_redirect = curlx_ptimediff_us(&timestamp,
+                                                   &data->progress.start);
+    data->progress.t_startqueue = timestamp;
     break;
   }
   if(delta) {
-    timediff_t us = Curl_timediff_us(timestamp, data->progress.t_startsingle);
+    timediff_t us = curlx_ptimediff_us(&timestamp,
+                                       &data->progress.t_startsingle);
     if(us < 1)
       us = 1; /* make sure at least one microsecond passed */
     *delta += us;
+    CURL_TRC_M(data, "[%s] added %" FMT_TIMEDIFF_T "ns",
+               pgrs_timer_name(timer), us);
   }
+  else
+    CURL_TRC_M(data, "[%s] set", pgrs_timer_name(timer));
 }
 
 /*
- *
  * Curl_pgrsTime(). Store the current time at the given label. This fetches a
  * fresh "now" and returns it.
  *
  * @unittest: 1399
  */
-struct curltime Curl_pgrsTime(struct Curl_easy *data, timerid timer)
+void Curl_pgrsTime(struct Curl_easy *data, timerid timer)
 {
-  struct curltime now = Curl_now();
-
-  Curl_pgrsTimeWas(data, timer, now);
-  return now;
+  Curl_pgrsTimeWas(data, timer, *Curl_pgrs_now(data));
 }
 
 void Curl_pgrsStartNow(struct Curl_easy *data)
 {
-  data->progress.speeder_c = 0; /* reset the progress meter display */
-  data->progress.start = Curl_now();
-  data->progress.is_t_startransfer_set = false;
-  data->progress.ul_limit_start = data->progress.start;
-  data->progress.dl_limit_start = data->progress.start;
-  data->progress.ul_limit_size = 0;
-  data->progress.dl_limit_size = 0;
-  data->progress.downloaded = 0;
-  data->progress.uploaded = 0;
-  /* clear all bits except HIDE and HEADERS_OUT */
-  data->progress.flags &= PGRS_HIDE|PGRS_HEADERS_OUT;
-  Curl_ratelimit(data, data->progress.start);
+  struct Progress *p = &data->progress;
+
+  p->speeder_c = 0; /* reset the progress meter display */
+  p->start = *Curl_pgrs_now(data);
+  p->is_t_startransfer_set = FALSE;
+  p->dl.cur_size = 0;
+  p->ul.cur_size = 0;
+  /* the sizes are unknown at start */
+  p->dl_size_known = FALSE;
+  p->ul_size_known = FALSE;
 }
 
-/*
- * This is used to handle speed limits, calculating how many milliseconds to
- * wait until we're back under the speed limit, if needed.
- *
- * The way it works is by having a "starting point" (time & amount of data
- * transferred by then) used in the speed computation, to be used instead of
- * the start of the transfer.  This starting point is regularly moved as
- * transfer goes on, to keep getting accurate values (instead of average over
- * the entire transfer).
- *
- * This function takes the current amount of data transferred, the amount at
- * the starting point, the limit (in bytes/s), the time of the starting point
- * and the current time.
- *
- * Returns 0 if no waiting is needed or when no waiting is needed but the
- * starting point should be reset (to current); or the number of milliseconds
- * to wait to get back under the speed limit.
- */
-timediff_t Curl_pgrsLimitWaitTime(curl_off_t cursize,
-                                  curl_off_t startsize,
-                                  curl_off_t limit,
-                                  struct curltime start,
-                                  struct curltime now)
+/* check that the 'delta' amount of bytes are okay to deliver to the
+   application, or return error if not. */
+CURLcode Curl_pgrs_deliver_check(struct Curl_easy *data, size_t delta)
 {
-  curl_off_t size = cursize - startsize;
-  timediff_t minimum;
-  timediff_t actual;
-
-  if(!limit || !size)
-    return 0;
-
-  /*
-   * 'minimum' is the number of milliseconds 'size' should take to download to
-   * stay below 'limit'.
-   */
-  if(size < CURL_OFF_T_MAX/1000)
-    minimum = (timediff_t) (CURL_OFF_T_C(1000) * size / limit);
-  else {
-    minimum = (timediff_t) (size / limit);
-    if(minimum < TIMEDIFF_T_MAX/1000)
-      minimum *= 1000;
-    else
-      minimum = TIMEDIFF_T_MAX;
+  if(data->set.max_filesize &&
+     ((curl_off_t)delta > data->set.max_filesize - data->progress.deliver)) {
+    failf(data, "Would have exceeded max file size");
+    return CURLE_FILESIZE_EXCEEDED;
   }
-
-  /*
-   * 'actual' is the time in milliseconds it took to actually download the
-   * last 'size' bytes.
-   */
-  actual = Curl_timediff(now, start);
-  if(actual < minimum) {
-    /* if it downloaded the data faster than the limit, make it wait the
-       difference */
-    return (minimum - actual);
-  }
-
-  return 0;
+  return CURLE_OK;
 }
 
-/*
- * Set the number of downloaded bytes so far.
- */
-void Curl_pgrsSetDownloadCounter(struct Curl_easy *data, curl_off_t size)
+/* this counts how much data is delivered to the application, which
+   in compressed cases may differ from downloaded amount */
+void Curl_pgrs_deliver_inc(struct Curl_easy *data, size_t delta)
 {
-  data->progress.downloaded = size;
+  data->progress.deliver += delta;
 }
 
-/*
- * Update the timestamp and sizestamp to use for rate limit calculations.
- */
-void Curl_ratelimit(struct Curl_easy *data, struct curltime now)
+void Curl_pgrs_download_inc(struct Curl_easy *data, size_t delta)
 {
-  /* don't set a new stamp unless the time since last update is long enough */
-  if(data->set.max_recv_speed) {
-    if(Curl_timediff(now, data->progress.dl_limit_start) >=
-       MIN_RATE_LIMIT_PERIOD) {
-      data->progress.dl_limit_start = now;
-      data->progress.dl_limit_size = data->progress.downloaded;
-    }
+  if(delta) {
+    data->progress.dl.cur_size += delta;
+    Curl_rlimit_drain(&data->progress.dl.rlimit, delta, Curl_pgrs_now(data));
   }
-  if(data->set.max_send_speed) {
-    if(Curl_timediff(now, data->progress.ul_limit_start) >=
-       MIN_RATE_LIMIT_PERIOD) {
-      data->progress.ul_limit_start = now;
-      data->progress.ul_limit_size = data->progress.uploaded;
-    }
+}
+
+void Curl_pgrs_upload_inc(struct Curl_easy *data, size_t delta)
+{
+  if(delta) {
+    data->progress.ul.cur_size += delta;
+    Curl_rlimit_drain(&data->progress.ul.rlimit, delta, Curl_pgrs_now(data));
   }
 }
 
@@ -349,40 +409,45 @@ void Curl_ratelimit(struct Curl_easy *data, struct curltime now)
  */
 void Curl_pgrsSetUploadCounter(struct Curl_easy *data, curl_off_t size)
 {
-  data->progress.uploaded = size;
+  data->progress.ul.cur_size = size;
 }
 
 void Curl_pgrsSetDownloadSize(struct Curl_easy *data, curl_off_t size)
 {
   if(size >= 0) {
-    data->progress.size_dl = size;
-    data->progress.flags |= PGRS_DL_SIZE_KNOWN;
+    data->progress.dl.total_size = size;
+    data->progress.dl_size_known = TRUE;
   }
   else {
-    data->progress.size_dl = 0;
-    data->progress.flags &= ~PGRS_DL_SIZE_KNOWN;
+    data->progress.dl.total_size = 0;
+    data->progress.dl_size_known = FALSE;
   }
 }
 
 void Curl_pgrsSetUploadSize(struct Curl_easy *data, curl_off_t size)
 {
   if(size >= 0) {
-    data->progress.size_ul = size;
-    data->progress.flags |= PGRS_UL_SIZE_KNOWN;
+    data->progress.ul.total_size = size;
+    data->progress.ul_size_known = TRUE;
   }
   else {
-    data->progress.size_ul = 0;
-    data->progress.flags &= ~PGRS_UL_SIZE_KNOWN;
+    data->progress.ul.total_size = 0;
+    data->progress.ul_size_known = FALSE;
   }
 }
 
+void Curl_pgrsEarlyData(struct Curl_easy *data, curl_off_t sent)
+{
+  data->progress.earlydata_sent = sent;
+}
+
 /* returns the average speed in bytes / second */
 static curl_off_t trspeed(curl_off_t size, /* number of bytes */
                           curl_off_t us)   /* microseconds */
 {
   if(us < 1)
     return size * 1000000;
-  else if(size < CURL_OFF_T_MAX/1000000)
+  else if(size < CURL_OFF_T_MAX / 1000000)
     return (size * 1000000) / us;
   else if(us >= 1000000)
     return size / (us / 1000000);
@@ -390,229 +455,242 @@ static curl_off_t trspeed(curl_off_t size, /* number of bytes */
     return CURL_OFF_T_MAX;
 }
 
-/* returns TRUE if it's time to show the progress meter */
-static bool progress_calc(struct Curl_easy *data, struct curltime now)
+/* returns TRUE if it is time to show the progress meter */
+static bool progress_calc(struct Curl_easy *data,
+                          const struct curltime *pnow)
 {
-  bool timetoshow = FALSE;
   struct Progress * const p = &data->progress;
+  int i_next, i_oldest, i_latest;
+  timediff_t duration_us;
+  curl_off_t amount;
 
   /* The time spent so far (from the start) in microseconds */
-  p->timespent = Curl_timediff_us(now, p->start);
-  p->dlspeed = trspeed(p->downloaded, p->timespent);
-  p->ulspeed = trspeed(p->uploaded, p->timespent);
+  p->timespent = curlx_ptimediff_us(pnow, &p->start);
+  p->dl.speed = trspeed(p->dl.cur_size, p->timespent);
+  p->ul.speed = trspeed(p->ul.cur_size, p->timespent);
 
-  /* Calculations done at most once a second, unless end is reached */
-  if(p->lastshow != now.tv_sec) {
-    int countindex; /* amount of seconds stored in the speeder array */
-    int nowindex = p->speeder_c% CURR_TIME;
-    p->lastshow = now.tv_sec;
-    timetoshow = TRUE;
-
-    /* Let's do the "current speed" thing, with the dl + ul speeds
-       combined. Store the speed at entry 'nowindex'. */
-    p->speeder[ nowindex ] = p->downloaded + p->uploaded;
-
-    /* remember the exact time for this moment */
-    p->speeder_time [ nowindex ] = now;
-
-    /* advance our speeder_c counter, which is increased every time we get
-       here and we expect it to never wrap as 2^32 is a lot of seconds! */
+  if(!p->speeder_c) { /* no previous record exists */
+    p->speed_amount[0] = p->dl.cur_size + p->ul.cur_size;
+    p->speed_time[0] = *pnow;
     p->speeder_c++;
+    /* use the overall average at the start */
+    p->current_speed = p->ul.speed + p->dl.speed;
+    p->lastshow = pnow->tv_sec;
+    return TRUE;
+  }
+  /* We have at least one record now. Where to put the next and
+   * where is the latest one? */
+  i_next = p->speeder_c % CURL_SPEED_RECORDS;
+  i_latest = (i_next > 0) ? (i_next - 1) : (CURL_SPEED_RECORDS - 1);
 
-    /* figure out how many index entries of data we have stored in our speeder
-       array. With N_ENTRIES filled in, we have about N_ENTRIES-1 seconds of
-       transfer. Imagine, after one second we have filled in two entries,
-       after two seconds we've filled in three entries etc. */
-    countindex = ((p->speeder_c >= CURR_TIME)? CURR_TIME:p->speeder_c) - 1;
-
-    /* first of all, we don't do this if there's no counted seconds yet */
-    if(countindex) {
-      int checkindex;
-      timediff_t span_ms;
-      curl_off_t amount;
-
-      /* Get the index position to compare with the 'nowindex' position.
-         Get the oldest entry possible. While we have less than CURR_TIME
-         entries, the first entry will remain the oldest. */
-      checkindex = (p->speeder_c >= CURR_TIME)? p->speeder_c%CURR_TIME:0;
-
-      /* Figure out the exact time for the time span */
-      span_ms = Curl_timediff(now, p->speeder_time[checkindex]);
-      if(0 == span_ms)
-        span_ms = 1; /* at least one millisecond MUST have passed */
-
-      /* Calculate the average speed the last 'span_ms' milliseconds */
-      amount = p->speeder[nowindex]- p->speeder[checkindex];
-
-      if(amount > CURL_OFF_T_C(4294967) /* 0xffffffff/1000 */)
-        /* the 'amount' value is bigger than would fit in 32 bits if
-           multiplied with 1000, so we use the double math for this */
-        p->current_speed = (curl_off_t)
-          ((double)amount/((double)span_ms/1000.0));
-      else
-        /* the 'amount' value is small enough to fit within 32 bits even
-           when multiplied with 1000 */
-        p->current_speed = amount*CURL_OFF_T_C(1000)/span_ms;
+  /* Make a new record only when some time has passed.
+   * Too frequent calls otherwise ruin the history. */
+  if(curlx_ptimediff_ms(pnow, &p->speed_time[i_latest]) >= 1000) {
+    p->speeder_c++;
+    i_latest = i_next;
+    p->speed_amount[i_latest] = p->dl.cur_size + p->ul.cur_size;
+    p->speed_time[i_latest] = *pnow;
+  }
+  else if(data->req.done) {
+    /* When a transfer is done, and we did not have a current speed
+     * already, update the last record. Otherwise, stay at the speed
+     * we have. The last chunk of data, when rate limiting, would increase
+     * reported speed since it no longer measures a full second. */
+    if(!p->current_speed) {
+      p->speed_amount[i_latest] = p->dl.cur_size + p->ul.cur_size;
+      p->speed_time[i_latest] = *pnow;
     }
-    else
-      /* the first second we use the average */
-      p->current_speed = p->ulspeed + p->dlspeed;
+  }
+  else {
+    /* transfer ongoing, wait for more time to pass. */
+    return FALSE;
+  }
 
-  } /* Calculations end */
-  return timetoshow;
+  i_oldest = (p->speeder_c < CURL_SPEED_RECORDS) ? 0 :
+             ((i_latest + 1) % CURL_SPEED_RECORDS);
+
+  /* How much we transferred between oldest and current records */
+  amount = p->speed_amount[i_latest] - p->speed_amount[i_oldest];
+  /* How long this took */
+  duration_us = curlx_ptimediff_us(&p->speed_time[i_latest],
+                                   &p->speed_time[i_oldest]);
+  if(duration_us <= 0)
+    duration_us = 1;
+
+  if(amount > (CURL_OFF_T_MAX / 1000000)) {
+    /* the 'amount' value is bigger than would fit in 64 bits if
+       multiplied with 1000000, so we use the double math for this */
+    p->current_speed =
+      (curl_off_t)(((double)amount * 1000000.0) / (double)duration_us);
+  }
+  else {
+    p->current_speed = amount * 1000000 / duration_us;
+  }
+
+  if((p->lastshow == pnow->tv_sec) && !data->req.done)
+    return FALSE;
+  p->lastshow = pnow->tv_sec;
+  return TRUE;
 }
 
 #ifndef CURL_DISABLE_PROGRESS_METER
+
+struct pgrs_estimate {
+  curl_off_t secs;
+  curl_off_t percent;
+};
+
+static curl_off_t pgrs_est_percent(curl_off_t total, curl_off_t cur)
+{
+  if(total > 10000)
+    return cur / (total / 100);
+  else if(total > 0)
+    return (cur * 100) / total;
+  return 0;
+}
+
+static void pgrs_estimates(struct pgrs_dir *d,
+                           bool total_known,
+                           struct pgrs_estimate *est)
+{
+  est->secs = 0;
+  est->percent = 0;
+  if(total_known && (d->speed > 0)) {
+    est->secs = d->total_size / d->speed;
+    est->percent = pgrs_est_percent(d->total_size, d->cur_size);
+  }
+}
+
 static void progress_meter(struct Curl_easy *data)
 {
-  char max5[6][10];
-  curl_off_t dlpercen = 0;
-  curl_off_t ulpercen = 0;
-  curl_off_t total_percen = 0;
-  curl_off_t total_transfer;
-  curl_off_t total_expected_transfer;
-  char time_left[10];
-  char time_total[10];
-  char time_spent[10];
-  curl_off_t ulestimate = 0;
-  curl_off_t dlestimate = 0;
-  curl_off_t total_estimate;
-  curl_off_t timespent =
-    (curl_off_t)data->progress.timespent/1000000; /* seconds */
+  struct Progress *p = &data->progress;
+  char max6[6][7];
+  struct pgrs_estimate dl_estm;
+  struct pgrs_estimate ul_estm;
+  struct pgrs_estimate total_estm;
+  curl_off_t total_cur_size;
+  curl_off_t total_expected_size;
+  curl_off_t dl_size;
+  char time_left[8];
+  char time_total[8];
+  char time_spent[8];
+  curl_off_t cur_secs = (curl_off_t)p->timespent / 1000000; /* seconds */
 
-  if(!(data->progress.flags & PGRS_HEADERS_OUT)) {
+  if(!p->headers_out) {
     if(data->state.resume_from) {
-      fprintf(data->set.err,
-              "** Resuming transfer from byte position %"
-              CURL_FORMAT_CURL_OFF_T "\n", data->state.resume_from);
+      curl_mfprintf(data->set.err,
+                    "** Resuming transfer from byte position %" FMT_OFF_T "\n",
+                    data->state.resume_from);
     }
-    fprintf(data->set.err,
-            "  %% Total    %% Received %% Xferd  Average Speed   "
-            "Time    Time     Time  Current\n"
-            "                                 Dload  Upload   "
-            "Total   Spent    Left  Speed\n");
-    data->progress.flags |= PGRS_HEADERS_OUT; /* headers are shown */
+    curl_mfprintf(data->set.err,
+                  "  %% Total    %% Received %% Xferd  Average Speed  "
+                  "Time    Time    Time   Current\n"
+                  "                                 Dload  Upload  "
+                  "Total   Spent   Left   Speed\n");
+    p->headers_out = TRUE; /* headers are shown */
   }
 
-  /* Figure out the estimated time of arrival for the upload */
-  if((data->progress.flags & PGRS_UL_SIZE_KNOWN) &&
-     (data->progress.ulspeed > CURL_OFF_T_C(0))) {
-    ulestimate = data->progress.size_ul / data->progress.ulspeed;
-
-    if(data->progress.size_ul > CURL_OFF_T_C(10000))
-      ulpercen = data->progress.uploaded /
-        (data->progress.size_ul/CURL_OFF_T_C(100));
-    else if(data->progress.size_ul > CURL_OFF_T_C(0))
-      ulpercen = (data->progress.uploaded*100) /
-        data->progress.size_ul;
-  }
-
-  /* ... and the download */
-  if((data->progress.flags & PGRS_DL_SIZE_KNOWN) &&
-     (data->progress.dlspeed > CURL_OFF_T_C(0))) {
-    dlestimate = data->progress.size_dl / data->progress.dlspeed;
-
-    if(data->progress.size_dl > CURL_OFF_T_C(10000))
-      dlpercen = data->progress.downloaded /
-        (data->progress.size_dl/CURL_OFF_T_C(100));
-    else if(data->progress.size_dl > CURL_OFF_T_C(0))
-      dlpercen = (data->progress.downloaded*100) /
-        data->progress.size_dl;
-  }
-
-  /* Now figure out which of them is slower and use that one for the
-     total estimate! */
-  total_estimate = ulestimate>dlestimate?ulestimate:dlestimate;
+  /* Figure out the estimated time of arrival for upload and download */
+  pgrs_estimates(&p->ul, (bool)p->ul_size_known, &ul_estm);
+  pgrs_estimates(&p->dl, (bool)p->dl_size_known, &dl_estm);
 
+  /* Since both happen at the same time, total expected duration is max. */
+  total_estm.secs = CURLMAX(ul_estm.secs, dl_estm.secs);
   /* create the three time strings */
-  time2str(time_left, total_estimate > 0?(total_estimate - timespent):0);
-  time2str(time_total, total_estimate);
-  time2str(time_spent, timespent);
+  time2str(time_left, sizeof(time_left),
+           total_estm.secs > 0 ? (total_estm.secs - cur_secs) : 0);
+  time2str(time_total, sizeof(time_total), total_estm.secs);
+  time2str(time_spent, sizeof(time_spent), cur_secs);
 
   /* Get the total amount of data expected to get transferred */
-  total_expected_transfer =
-    ((data->progress.flags & PGRS_UL_SIZE_KNOWN)?
-     data->progress.size_ul:data->progress.uploaded)+
-    ((data->progress.flags & PGRS_DL_SIZE_KNOWN)?
-     data->progress.size_dl:data->progress.downloaded);
+  total_expected_size = p->ul_size_known ? p->ul.total_size : p->ul.cur_size;
+
+  dl_size = p->dl_size_known ? p->dl.total_size : p->dl.cur_size;
+
+  /* integer overflow check */
+  if((CURL_OFF_T_MAX - total_expected_size) < dl_size)
+    total_expected_size = CURL_OFF_T_MAX; /* capped */
+  else
+    total_expected_size += dl_size;
 
   /* We have transferred this much so far */
-  total_transfer = data->progress.downloaded + data->progress.uploaded;
+  total_cur_size = p->dl.cur_size + p->ul.cur_size;
 
   /* Get the percentage of data transferred so far */
-  if(total_expected_transfer > CURL_OFF_T_C(10000))
-    total_percen = total_transfer /
-      (total_expected_transfer/CURL_OFF_T_C(100));
-  else if(total_expected_transfer > CURL_OFF_T_C(0))
-    total_percen = (total_transfer*100) / total_expected_transfer;
+  total_estm.percent = pgrs_est_percent(total_expected_size, total_cur_size);
 
-  fprintf(data->set.err,
-          "\r"
-          "%3" CURL_FORMAT_CURL_OFF_T " %s  "
-          "%3" CURL_FORMAT_CURL_OFF_T " %s  "
-          "%3" CURL_FORMAT_CURL_OFF_T " %s  %s  %s %s %s %s %s",
-          total_percen,  /* 3 letters */                /* total % */
-          max5data(total_expected_transfer, max5[2]),   /* total size */
-          dlpercen,      /* 3 letters */                /* rcvd % */
-          max5data(data->progress.downloaded, max5[0]), /* rcvd size */
-          ulpercen,      /* 3 letters */                /* xfer % */
-          max5data(data->progress.uploaded, max5[1]),   /* xfer size */
-          max5data(data->progress.dlspeed, max5[3]),    /* avrg dl speed */
-          max5data(data->progress.ulspeed, max5[4]),    /* avrg ul speed */
-          time_total,    /* 8 letters */                /* total time */
-          time_spent,    /* 8 letters */                /* time spent */
-          time_left,     /* 8 letters */                /* time left */
-          max5data(data->progress.current_speed, max5[5])
+  curl_mfprintf(data->set.err,
+                "\r"
+                "%3" FMT_OFF_T " %s "
+                "%3" FMT_OFF_T " %s "
+                "%3" FMT_OFF_T " %s %s %s %s %s %s %s",
+                total_estm.percent, /* 3 letters */    /* total % */
+                max6out(total_expected_size, max6[2],
+                        sizeof(max6[2])),              /* total size */
+                dl_estm.percent, /* 3 letters */       /* rcvd % */
+                max6out(p->dl.cur_size, max6[0],
+                        sizeof(max6[0])),              /* rcvd size */
+                ul_estm.percent, /* 3 letters */       /* xfer % */
+                max6out(p->ul.cur_size, max6[1],
+                        sizeof(max6[1])),              /* xfer size */
+                max6out(p->dl.speed, max6[3],
+                        sizeof(max6[3])),              /* avrg dl speed */
+                max6out(p->ul.speed, max6[4],
+                        sizeof(max6[4])),              /* avrg ul speed */
+                time_total,    /* 7 letters */         /* total time */
+                time_spent,    /* 7 letters */         /* time spent */
+                time_left,     /* 7 letters */         /* time left */
+                max6out(p->current_speed, max6[5],
+                        sizeof(max6[5]))               /* current speed */
     );
 
   /* we flush the output stream to make it appear as soon as possible */
   fflush(data->set.err);
 }
-#else
- /* progress bar disabled */
+#else /* CURL_DISABLE_PROGRESS_METER */
 #define progress_meter(x) Curl_nop_stmt
 #endif
 
-
 /*
  * Curl_pgrsUpdate() returns 0 for success or the value returned by the
  * progress callback!
  */
-int Curl_pgrsUpdate(struct Curl_easy *data)
+static CURLcode pgrsupdate(struct Curl_easy *data, bool showprogress)
 {
-  struct curltime now = Curl_now(); /* what time is it */
-  bool showprogress = progress_calc(data, now);
-  if(!(data->progress.flags & PGRS_HIDE)) {
+  if(!data->progress.hide) {
+    int rc;
     if(data->set.fxferinfo) {
-      int result;
-      /* There's a callback set, call that */
-      Curl_set_in_callback(data, true);
-      result = data->set.fxferinfo(data->set.progress_client,
-                                   data->progress.size_dl,
-                                   data->progress.downloaded,
-                                   data->progress.size_ul,
-                                   data->progress.uploaded);
-      Curl_set_in_callback(data, false);
-      if(result != CURL_PROGRESSFUNC_CONTINUE) {
-        if(result)
+      /* There is a callback set, call that */
+      Curl_set_in_callback(data, TRUE);
+      rc = data->set.fxferinfo(data->set.progress_client,
+                               data->progress.dl.total_size,
+                               data->progress.dl.cur_size,
+                               data->progress.ul.total_size,
+                               data->progress.ul.cur_size);
+      Curl_set_in_callback(data, FALSE);
+      if(rc != CURL_PROGRESSFUNC_CONTINUE) {
+        if(rc) {
           failf(data, "Callback aborted");
-        return result;
+          return CURLE_ABORTED_BY_CALLBACK;
+        }
+        return CURLE_OK;
       }
     }
     else if(data->set.fprogress) {
-      int result;
       /* The older deprecated callback is set, call that */
-      Curl_set_in_callback(data, true);
-      result = data->set.fprogress(data->set.progress_client,
-                                   (double)data->progress.size_dl,
-                                   (double)data->progress.downloaded,
-                                   (double)data->progress.size_ul,
-                                   (double)data->progress.uploaded);
-      Curl_set_in_callback(data, false);
-      if(result != CURL_PROGRESSFUNC_CONTINUE) {
-        if(result)
+      Curl_set_in_callback(data, TRUE);
+      rc = data->set.fprogress(data->set.progress_client,
+                               (double)data->progress.dl.total_size,
+                               (double)data->progress.dl.cur_size,
+                               (double)data->progress.ul.total_size,
+                               (double)data->progress.ul.cur_size);
+      Curl_set_in_callback(data, FALSE);
+      if(rc != CURL_PROGRESSFUNC_CONTINUE) {
+        if(rc) {
           failf(data, "Callback aborted");
-        return result;
+          return CURLE_ABORTED_BY_CALLBACK;
+        }
+        return CURLE_OK;
       }
     }
 
@@ -620,5 +698,41 @@ int Curl_pgrsUpdate(struct Curl_easy *data)
       progress_meter(data);
   }
 
-  return 0;
+  return CURLE_OK;
+}
+
+static CURLcode pgrs_update(struct Curl_easy *data,
+                            const struct curltime *pnow)
+{
+  bool showprogress = progress_calc(data, pnow);
+  return pgrsupdate(data, showprogress);
+}
+
+CURLcode Curl_pgrsUpdate(struct Curl_easy *data)
+{
+  return pgrs_update(data, Curl_pgrs_now(data));
+}
+
+CURLcode Curl_pgrsCheck(struct Curl_easy *data)
+{
+  CURLcode result;
+
+  result = pgrs_update(data, Curl_pgrs_now(data));
+  if(!result && !data->req.done)
+    result = pgrs_speedcheck(data, Curl_pgrs_now(data));
+  return result;
+}
+
+/*
+ * Update all progress, do not do progress meter/callbacks.
+ */
+void Curl_pgrsUpdate_nometer(struct Curl_easy *data)
+{
+  (void)progress_calc(data, Curl_pgrs_now(data));
+}
+
+void Curl_pgrsCompleted(struct Curl_easy *data)
+{
+  struct Progress * const p = &data->progress;
+  p->timespent = curlx_ptimediff_us(Curl_pgrs_now(data), &p->start);
 }
diff --git a/third-party/curl/lib/progress.h b/third-party/curl/lib/progress.h
index 0049cd04be..1f2a4e71c3 100644
--- a/third-party/curl/lib/progress.h
+++ b/third-party/curl/lib/progress.h
@@ -23,14 +23,15 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "curlx/timeval.h"
 
-#include "timeval.h"
-
+struct Curl_easy;
 
 typedef enum {
   TIMER_NONE,
   TIMER_STARTOP,
-  TIMER_STARTSINGLE,
+  TIMER_STARTSINGLE, /* start of transfer, might get queued */
+  TIMER_POSTQUEUE,   /* start, immediately after dequeue */
   TIMER_NAMELOOKUP,
   TIMER_CONNECT,
   TIMER_APPCONNECT,
@@ -42,21 +43,36 @@ typedef enum {
   TIMER_LAST /* must be last */
 } timerid;
 
+/* Get the current timestamp of the transfer */
+const struct curltime *Curl_pgrs_now(struct Curl_easy *data);
+
 int Curl_pgrsDone(struct Curl_easy *data);
 void Curl_pgrsStartNow(struct Curl_easy *data);
 void Curl_pgrsSetDownloadSize(struct Curl_easy *data, curl_off_t size);
 void Curl_pgrsSetUploadSize(struct Curl_easy *data, curl_off_t size);
-void Curl_pgrsSetDownloadCounter(struct Curl_easy *data, curl_off_t size);
+CURLcode Curl_pgrs_deliver_check(struct Curl_easy *data, size_t delta);
+void Curl_pgrs_deliver_inc(struct Curl_easy *data, size_t delta);
+void Curl_pgrs_download_inc(struct Curl_easy *data, size_t delta);
+void Curl_pgrs_upload_inc(struct Curl_easy *data, size_t delta);
 void Curl_pgrsSetUploadCounter(struct Curl_easy *data, curl_off_t size);
-void Curl_ratelimit(struct Curl_easy *data, struct curltime now);
-int Curl_pgrsUpdate(struct Curl_easy *data);
+
+/* perform progress update, invoking callbacks at intervals */
+CURLcode Curl_pgrsUpdate(struct Curl_easy *data);
+/* perform progress update, no callbacks invoked */
+void Curl_pgrsUpdate_nometer(struct Curl_easy *data);
+/* perform progress update with callbacks and speed checks */
+CURLcode Curl_pgrsCheck(struct Curl_easy *data);
+
+/* Inform progress/speedcheck about receive/send pausing */
+void Curl_pgrsRecvPause(struct Curl_easy *data, bool enable);
+void Curl_pgrsSendPause(struct Curl_easy *data, bool enable);
+
+/* Reset sizes and counters for up- and download. */
+void Curl_pgrsReset(struct Curl_easy *data);
+/* Reset sizes for up- and download. */
 void Curl_pgrsResetTransferSizes(struct Curl_easy *data);
-struct curltime Curl_pgrsTime(struct Curl_easy *data, timerid timer);
-timediff_t Curl_pgrsLimitWaitTime(curl_off_t cursize,
-                                  curl_off_t startsize,
-                                  curl_off_t limit,
-                                  struct curltime start,
-                                  struct curltime now);
+
+void Curl_pgrsTime(struct Curl_easy *data, timerid timer);
 /**
  * Update progress timer with the elapsed time from its start to `timestamp`.
  * This allows updating timers later and is used by happy eyeballing, where
@@ -65,9 +81,8 @@ timediff_t Curl_pgrsLimitWaitTime(curl_off_t cursize,
 void Curl_pgrsTimeWas(struct Curl_easy *data, timerid timer,
                       struct curltime timestamp);
 
-#define PGRS_HIDE    (1<<4)
-#define PGRS_UL_SIZE_KNOWN (1<<5)
-#define PGRS_DL_SIZE_KNOWN (1<<6)
-#define PGRS_HEADERS_OUT (1<<7) /* set when the headers have been written */
+void Curl_pgrsEarlyData(struct Curl_easy *data, curl_off_t sent);
+
+void Curl_pgrsCompleted(struct Curl_easy *data);
 
 #endif /* HEADER_CURL_PROGRESS_H */
diff --git a/third-party/curl/lib/protocol.c b/third-party/curl/lib/protocol.c
new file mode 100644
index 0000000000..8d57c058c6
--- /dev/null
+++ b/third-party/curl/lib/protocol.c
@@ -0,0 +1,536 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "protocol.h"
+#include "strcase.h"
+
+#include "dict.h"
+#include "file.h"
+#include "ftp.h"
+#include "gopher.h"
+#include "http.h"
+#include "imap.h"
+#include "curl_ldap.h"
+#include "mqtt.h"
+#include "pop3.h"
+#include "rtsp.h"
+#include "smb.h"
+#include "smtp.h"
+#include "telnet.h"
+#include "tftp.h"
+#include "ws.h"
+#include "vssh/ssh.h"
+
+
+/* All URI schemes known to libcurl, but not necessarily implemented
+ * by protocol handlers. */
+const struct Curl_scheme Curl_scheme_dict = {
+  "dict",                               /* scheme */
+#ifdef CURL_DISABLE_DICT
+  ZERO_NULL,
+#else
+  &Curl_protocol_dict,
+#endif
+  CURLPROTO_DICT,                       /* protocol */
+  CURLPROTO_DICT,                       /* family */
+  PROTOPT_NONE | PROTOPT_NOURLQUERY,    /* flags */
+  PORT_DICT,                            /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_file = {
+  "file",                               /* scheme */
+#ifdef CURL_DISABLE_FILE
+  ZERO_NULL,
+#else
+  &Curl_protocol_file,
+#endif
+  CURLPROTO_FILE,                       /* protocol */
+  CURLPROTO_FILE,                       /* family */
+  PROTOPT_NONETWORK | PROTOPT_NOURLQUERY, /* flags */
+  0                                     /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_ftp = {
+  "ftp",                           /* scheme */
+#ifdef CURL_DISABLE_FTP
+  ZERO_NULL,
+#else
+  &Curl_protocol_ftp,
+#endif
+  CURLPROTO_FTP,                   /* protocol */
+  CURLPROTO_FTP,                   /* family */
+  PROTOPT_DUAL | PROTOPT_CLOSEACTION | PROTOPT_NEEDSPWD |
+  PROTOPT_NOURLQUERY | PROTOPT_PROXY_AS_HTTP |
+  PROTOPT_WILDCARD | PROTOPT_SSL_REUSE |
+  PROTOPT_CONN_REUSE, /* flags */
+  PORT_FTP,                        /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_ftps = {
+  "ftps",                          /* scheme */
+#if defined(CURL_DISABLE_FTP) || !defined(USE_SSL)
+  ZERO_NULL,
+#else
+  &Curl_protocol_ftp,
+#endif
+  CURLPROTO_FTPS,                  /* protocol */
+  CURLPROTO_FTP,                   /* family */
+  PROTOPT_SSL | PROTOPT_DUAL | PROTOPT_CLOSEACTION |
+  PROTOPT_NEEDSPWD | PROTOPT_NOURLQUERY | PROTOPT_WILDCARD |
+  PROTOPT_CONN_REUSE, /* flags */
+  PORT_FTPS,                       /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_gopher = {
+  "gopher",                             /* scheme */
+#ifdef CURL_DISABLE_GOPHER
+  ZERO_NULL,
+#else
+  &Curl_protocol_gopher,
+#endif
+  CURLPROTO_GOPHER,                     /* protocol */
+  CURLPROTO_GOPHER,                     /* family */
+  PROTOPT_NONE,                         /* flags */
+  PORT_GOPHER,                          /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_gophers = {
+  "gophers",                            /* scheme */
+#if defined(CURL_DISABLE_GOPHER) || !defined(USE_SSL)
+  ZERO_NULL,
+#else
+  &Curl_protocol_gophers,
+#endif
+  CURLPROTO_GOPHERS,                    /* protocol */
+  CURLPROTO_GOPHER,                     /* family */
+  PROTOPT_SSL,                          /* flags */
+  PORT_GOPHER,                          /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_http = {
+  "http",                               /* scheme */
+#ifdef CURL_DISABLE_HTTP
+  ZERO_NULL,
+#else
+  &Curl_protocol_http,
+#endif
+  CURLPROTO_HTTP,                       /* protocol */
+  CURLPROTO_HTTP,                       /* family */
+  PROTOPT_CREDSPERREQUEST |             /* flags */
+  PROTOPT_USERPWDCTRL | PROTOPT_CONN_REUSE,
+  PORT_HTTP,                            /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_https = {
+  "https",                              /* scheme */
+#if defined(CURL_DISABLE_HTTP) || !defined(USE_SSL)
+  ZERO_NULL,
+#else
+  &Curl_protocol_http,
+#endif
+  CURLPROTO_HTTPS,                      /* protocol */
+  CURLPROTO_HTTP,                       /* family */
+  PROTOPT_SSL | PROTOPT_CREDSPERREQUEST | PROTOPT_ALPN | /* flags */
+  PROTOPT_USERPWDCTRL | PROTOPT_CONN_REUSE |
+  PROTOPT_HTTP_PROXY_TUNNEL,
+  PORT_HTTPS,                           /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_imap = {
+  "imap",                           /* scheme */
+#ifdef CURL_DISABLE_IMAP
+  ZERO_NULL,
+#else
+  &Curl_protocol_imap,
+#endif
+  CURLPROTO_IMAP,                   /* protocol */
+  CURLPROTO_IMAP,                   /* family */
+  PROTOPT_CLOSEACTION |             /* flags */
+  PROTOPT_URLOPTIONS | PROTOPT_SSL_REUSE |
+  PROTOPT_CONN_REUSE,
+  PORT_IMAP,                        /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_imaps = {
+  "imaps",                          /* scheme */
+#if defined(CURL_DISABLE_IMAP) || !defined(USE_SSL)
+  ZERO_NULL,
+#else
+  &Curl_protocol_imap,
+#endif
+  CURLPROTO_IMAPS,                  /* protocol */
+  CURLPROTO_IMAP,                   /* family */
+  PROTOPT_CLOSEACTION | PROTOPT_SSL | /* flags */
+  PROTOPT_URLOPTIONS | PROTOPT_CONN_REUSE,
+  PORT_IMAPS,                       /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_ldap = {
+  "ldap",                               /* scheme */
+#ifdef CURL_DISABLE_LDAP
+  ZERO_NULL,
+#else
+  &Curl_protocol_ldap,
+#endif
+  CURLPROTO_LDAP,                       /* protocol */
+  CURLPROTO_LDAP,                       /* family */
+  PROTOPT_SSL_REUSE,                    /* flags */
+  PORT_LDAP,                            /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_ldaps = {
+  "ldaps",                              /* scheme */
+#if defined(CURL_DISABLE_LDAP) || !defined(HAVE_LDAP_SSL)
+  ZERO_NULL,
+#else
+  &Curl_protocol_ldap,
+#endif
+  CURLPROTO_LDAPS,                      /* protocol */
+  CURLPROTO_LDAP,                       /* family */
+  PROTOPT_SSL,                          /* flags */
+  PORT_LDAPS,                           /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_mqtt = {
+  "mqtt",                             /* scheme */
+#ifdef CURL_DISABLE_MQTT
+  ZERO_NULL,
+#else
+  &Curl_protocol_mqtt,
+#endif
+  CURLPROTO_MQTT,                     /* protocol */
+  CURLPROTO_MQTT,                     /* family */
+  PROTOPT_NONE,                       /* flags */
+  PORT_MQTT,                          /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_mqtts = {
+  "mqtts",                            /* scheme */
+#if defined(CURL_DISABLE_MQTT) || !defined(USE_SSL)
+  ZERO_NULL,
+#else
+  &Curl_protocol_mqtts,
+#endif
+  CURLPROTO_MQTTS,                    /* protocol */
+  CURLPROTO_MQTT,                     /* family */
+  PROTOPT_SSL,                        /* flags */
+  PORT_MQTTS,                         /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_pop3 = {
+  "pop3",                           /* scheme */
+#ifdef CURL_DISABLE_POP3
+  ZERO_NULL,
+#else
+  &Curl_protocol_pop3,
+#endif
+  CURLPROTO_POP3,                   /* protocol */
+  CURLPROTO_POP3,                   /* family */
+  PROTOPT_CLOSEACTION | PROTOPT_NOURLQUERY | /* flags */
+  PROTOPT_URLOPTIONS | PROTOPT_SSL_REUSE | PROTOPT_CONN_REUSE,
+  PORT_POP3,                        /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_pop3s = {
+  "pop3s",                          /* scheme */
+#if defined(CURL_DISABLE_POP3) || !defined(USE_SSL)
+  ZERO_NULL,
+#else
+  &Curl_protocol_pop3,
+#endif
+  CURLPROTO_POP3S,                  /* protocol */
+  CURLPROTO_POP3,                   /* family */
+  PROTOPT_CLOSEACTION | PROTOPT_SSL | /* flags */
+  PROTOPT_NOURLQUERY | PROTOPT_URLOPTIONS | PROTOPT_CONN_REUSE,
+  PORT_POP3S,                       /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_rtsp = {
+  "rtsp",                               /* scheme */
+#ifdef CURL_DISABLE_RTSP
+  ZERO_NULL,
+#else
+  &Curl_protocol_rtsp,
+#endif
+  CURLPROTO_RTSP,                       /* protocol */
+  CURLPROTO_RTSP,                       /* family */
+  PROTOPT_CONN_REUSE,                   /* flags */
+  PORT_RTSP,                            /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_sftp = {
+  "sftp",                               /* scheme */
+#ifndef USE_SSH
+  NULL,
+#else
+  &Curl_protocol_sftp,
+#endif
+  CURLPROTO_SFTP,                       /* protocol */
+  CURLPROTO_SFTP,                       /* family */
+  PROTOPT_DIRLOCK | PROTOPT_CLOSEACTION | /* flags */
+  PROTOPT_NOURLQUERY | PROTOPT_CONN_REUSE,
+  PORT_SSH                              /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_scp = {
+  "scp",                                /* scheme */
+#ifndef USE_SSH
+  NULL,
+#else
+  &Curl_protocol_scp,
+#endif
+  CURLPROTO_SCP,                        /* protocol */
+  CURLPROTO_SCP,                        /* family */
+  PROTOPT_DIRLOCK | PROTOPT_CLOSEACTION | /* flags */
+  PROTOPT_NOURLQUERY | PROTOPT_CONN_REUSE,
+  PORT_SSH,                             /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_smb = {
+  "smb",                                /* scheme */
+#if defined(CURL_ENABLE_SMB) && defined(USE_CURL_NTLM_CORE)
+  &Curl_protocol_smb,
+#else
+  ZERO_NULL,
+#endif
+  CURLPROTO_SMB,                        /* protocol */
+  CURLPROTO_SMB,                        /* family */
+  PROTOPT_NONE,                         /* flags */
+  PORT_SMB,                             /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_smbs = {
+  "smbs",                               /* scheme */
+#if defined(CURL_ENABLE_SMB) && defined(USE_CURL_NTLM_CORE) && defined(USE_SSL)
+  &Curl_protocol_smb,
+#else
+  ZERO_NULL,
+#endif
+  CURLPROTO_SMBS,                       /* protocol */
+  CURLPROTO_SMB,                        /* family */
+  PROTOPT_SSL,                          /* flags */
+  PORT_SMBS,                            /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_smtp = {
+  "smtp",                           /* scheme */
+#ifdef CURL_DISABLE_SMTP
+  ZERO_NULL,
+#else
+  &Curl_protocol_smtp,
+#endif
+  CURLPROTO_SMTP,                   /* protocol */
+  CURLPROTO_SMTP,                   /* family */
+  PROTOPT_CLOSEACTION | PROTOPT_NOURLQUERY | /* flags */
+  PROTOPT_URLOPTIONS | PROTOPT_SSL_REUSE | PROTOPT_CONN_REUSE,
+  PORT_SMTP,                        /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_smtps = {
+  "smtps",                          /* scheme */
+#if defined(CURL_DISABLE_SMTP) || !defined(USE_SSL)
+  ZERO_NULL,
+#else
+  &Curl_protocol_smtp,
+#endif
+  CURLPROTO_SMTPS,                  /* protocol */
+  CURLPROTO_SMTP,                   /* family */
+  PROTOPT_CLOSEACTION | PROTOPT_SSL | /* flags */
+  PROTOPT_NOURLQUERY | PROTOPT_URLOPTIONS | PROTOPT_CONN_REUSE,
+  PORT_SMTPS,                       /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_socks = {
+  "socks",                          /* scheme */
+  ZERO_NULL,
+  CURLPROTO_SOCKS,                  /* protocol */
+  CURLPROTO_SOCKS,                  /* family */
+  PROTOPT_NO_TRANSFER,              /* flags */
+  PORT_SOCKS,                       /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_socks4 = {
+  "socks4",                         /* scheme */
+  ZERO_NULL,
+  CURLPROTO_SOCKS,                  /* protocol */
+  CURLPROTO_SOCKS,                  /* family */
+  PROTOPT_NO_TRANSFER,              /* flags */
+  PORT_SOCKS,                       /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_socks4a = {
+  "socks4a",                        /* scheme */
+  ZERO_NULL,
+  CURLPROTO_SOCKS,                  /* protocol */
+  CURLPROTO_SOCKS,                  /* family */
+  PROTOPT_NO_TRANSFER,              /* flags */
+  PORT_SOCKS,                       /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_socks5 = {
+  "socks5",                         /* scheme */
+  ZERO_NULL,
+  CURLPROTO_SOCKS,                  /* protocol */
+  CURLPROTO_SOCKS,                  /* family */
+  PROTOPT_NO_TRANSFER,              /* flags */
+  PORT_SOCKS,                       /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_socks5h = {
+  "socks5h",                         /* scheme */
+  ZERO_NULL,
+  CURLPROTO_SOCKS,                  /* protocol */
+  CURLPROTO_SOCKS,                  /* family */
+  PROTOPT_NO_TRANSFER,              /* flags */
+  PORT_SOCKS,                       /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_telnet = {
+  "telnet",                             /* scheme */
+#ifdef CURL_DISABLE_TELNET
+  ZERO_NULL,
+#else
+  &Curl_protocol_telnet,
+#endif
+  CURLPROTO_TELNET,                     /* protocol */
+  CURLPROTO_TELNET,                     /* family */
+  PROTOPT_NONE | PROTOPT_NOURLQUERY,    /* flags */
+  PORT_TELNET,                          /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_tftp = {
+  "tftp",                               /* scheme */
+#ifdef CURL_DISABLE_TFTP
+  ZERO_NULL,
+#else
+  &Curl_protocol_tftp,
+#endif
+  CURLPROTO_TFTP,                       /* protocol */
+  CURLPROTO_TFTP,                       /* family */
+  PROTOPT_NOTCPPROXY | PROTOPT_NOURLQUERY, /* flags */
+  PORT_TFTP,                            /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_ws = {
+  "ws",                                 /* scheme */
+#if defined(CURL_DISABLE_WEBSOCKETS) || defined(CURL_DISABLE_HTTP)
+  ZERO_NULL,
+#else
+  &Curl_protocol_ws,
+#endif
+  CURLPROTO_WS,                         /* protocol */
+  CURLPROTO_HTTP,                       /* family */
+  PROTOPT_CREDSPERREQUEST |             /* flags */
+  PROTOPT_USERPWDCTRL | PROTOPT_HTTP_PROXY_TUNNEL,
+  PORT_HTTP                             /* defport */
+};
+
+const struct Curl_scheme Curl_scheme_wss = {
+  "wss",                                /* scheme */
+#if defined(CURL_DISABLE_WEBSOCKETS) || defined(CURL_DISABLE_HTTP) || \
+  !defined(USE_SSL)
+  ZERO_NULL,
+#else
+  &Curl_protocol_ws,
+#endif
+  CURLPROTO_WSS,                        /* protocol */
+  CURLPROTO_HTTP,                       /* family */
+  PROTOPT_SSL | PROTOPT_CREDSPERREQUEST | /* flags */
+  PROTOPT_USERPWDCTRL | PROTOPT_HTTP_PROXY_TUNNEL,
+  PORT_HTTPS                            /* defport */
+};
+
+/* Returns a struct scheme pointer if the name is a known scheme. Check the
+   ->run struct field for non-NULL to figure out if an implementation is
+   present. */
+const struct Curl_scheme *Curl_getn_scheme(const char *scheme, size_t len)
+{
+  /* table generated by schemetable.c:
+     1. gcc schemetable.c && ./a.out
+     2. check how small the table gets
+     3. tweak the hash algorithm, then rerun from 1
+     4. when the table is good enough
+     5. copy the table into this source code
+     6. make sure this function uses the same hash function that worked for
+     schemetable.c
+     */
+  static const struct Curl_scheme * const all_schemes[59] = { NULL,
+    &Curl_scheme_pop3, NULL,
+    &Curl_scheme_smtps,
+    &Curl_scheme_socks,
+    &Curl_scheme_socks4,
+    &Curl_scheme_socks5, NULL, NULL,
+    &Curl_scheme_gophers,
+    &Curl_scheme_ws,
+    &Curl_scheme_sftp,
+    &Curl_scheme_socks4a,
+    &Curl_scheme_scp,
+    &Curl_scheme_rtsp,
+    &Curl_scheme_dict, NULL, NULL,
+    &Curl_scheme_gopher, NULL, NULL, NULL,
+    &Curl_scheme_wss, NULL,
+    &Curl_scheme_smb, NULL,
+    &Curl_scheme_ldap,
+    &Curl_scheme_ldaps,
+    &Curl_scheme_imap, NULL, NULL, NULL,
+    &Curl_scheme_imaps,
+    &Curl_scheme_https,
+    &Curl_scheme_tftp,
+    &Curl_scheme_telnet, NULL, NULL, NULL,
+    &Curl_scheme_file,
+    &Curl_scheme_smtp, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+    &Curl_scheme_ftp,
+    &Curl_scheme_mqtt, NULL,
+    &Curl_scheme_socks5h,
+    &Curl_scheme_http,
+    &Curl_scheme_pop3s, NULL,
+    &Curl_scheme_mqtts, NULL,
+    &Curl_scheme_smbs,
+    &Curl_scheme_ftps,
+  };
+
+  if(len && (len <= 7)) {
+    const char *s = scheme;
+    size_t l = len;
+    const struct Curl_scheme *h;
+    unsigned int c = 443;
+    while(l) {
+      c <<= 5;
+      c += (unsigned int)Curl_raw_tolower(*s);
+      s++;
+      l--;
+    }
+
+    h = all_schemes[c % 59];
+    if(h && curl_strnequal(scheme, h->name, len) && !h->name[len])
+      return h;
+  }
+  return NULL;
+}
+
+const struct Curl_scheme *Curl_get_scheme(const char *scheme)
+{
+  return Curl_getn_scheme(scheme, strlen(scheme));
+}
diff --git a/third-party/curl/lib/protocol.h b/third-party/curl/lib/protocol.h
new file mode 100644
index 0000000000..50e320d0f6
--- /dev/null
+++ b/third-party/curl/lib/protocol.h
@@ -0,0 +1,296 @@
+#ifndef HEADER_CURL_PROTOCOL_H
+#define HEADER_CURL_PROTOCOL_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/* This file is for lib internal stuff */
+#include "curl_setup.h"
+
+struct Curl_easy;
+struct connectdata;
+struct easy_pollset;
+
+/* Known protocol default port numbers */
+#define PORT_FTP    21
+#define PORT_FTPS   990
+#define PORT_TELNET 23
+#define PORT_HTTP   80
+#define PORT_HTTPS  443
+#define PORT_DICT   2628
+#define PORT_LDAP   389
+#define PORT_LDAPS  636
+#define PORT_TFTP   69
+#define PORT_SSH    22
+#define PORT_IMAP   143
+#define PORT_IMAPS  993
+#define PORT_POP3   110
+#define PORT_POP3S  995
+#define PORT_SMB    445
+#define PORT_SMBS   445
+#define PORT_SMTP   25
+#define PORT_SMTPS  465 /* sometimes called SSMTP */
+#define PORT_RTSP   554
+#define PORT_GOPHER 70
+#define PORT_SOCKS  1080
+#define PORT_MQTT   1883
+#define PORT_MQTTS  8883
+
+/* CURLPROTO_GOPHERS (29) is the highest publicly used protocol bit number,
+ * the rest are internal information. If we use higher bits we only do this on
+ * platforms that have a >= 64-bit type and then we use such a type for the
+ * protocol fields in the scheme definition.
+ */
+#define CURLPROTO_WS     (1L << 30)
+#define CURLPROTO_WSS    ((curl_prot_t)1 << 31)
+#define CURLPROTO_MQTTS  (1LL << 32)
+#define CURLPROTO_SOCKS  (1LL << 33)
+
+#define CURLPROTO_64ALL ((uint64_t)0xffffffffffffffff)
+
+/* the default protocols accepting a redirect to */
+#define CURLPROTO_REDIR (CURLPROTO_HTTP | CURLPROTO_HTTPS | CURLPROTO_FTP | \
+                         CURLPROTO_FTPS)
+
+typedef curl_off_t curl_prot_t;
+
+/* This mask is for all the old protocols that are provided and defined in the
+   public header and shall exclude protocols added since which are not exposed
+   in the API */
+#define CURLPROTO_MASK   0x3fffffff
+
+/* Convenience defines for checking protocols or their SSL based version. Each
+   protocol scheme should only ever have a single CURLPROTO_ in its protocol
+   field. */
+#define PROTO_FAMILY_HTTP (CURLPROTO_HTTP | CURLPROTO_HTTPS | CURLPROTO_WS | \
+                           CURLPROTO_WSS)
+#define PROTO_FAMILY_FTP  (CURLPROTO_FTP | CURLPROTO_FTPS)
+#define PROTO_FAMILY_POP3 (CURLPROTO_POP3 | CURLPROTO_POP3S)
+#define PROTO_FAMILY_SMB  (CURLPROTO_SMB | CURLPROTO_SMBS)
+#define PROTO_FAMILY_SMTP (CURLPROTO_SMTP | CURLPROTO_SMTPS)
+#define PROTO_FAMILY_SSH  (CURLPROTO_SCP | CURLPROTO_SFTP)
+
+#if !defined(CURL_DISABLE_FTP) || defined(USE_SSH) || \
+  !defined(CURL_DISABLE_POP3)
+/* these protocols support CURLOPT_DIRLISTONLY */
+#define CURL_LIST_ONLY_PROTOCOL 1
+#endif
+
+/* When redirecting transfers. */
+typedef enum {
+  FOLLOW_NONE,  /* not used within the function, a placeholder to allow
+                   initing to this */
+  FOLLOW_FAKE,  /* only records stuff, not actually following */
+  FOLLOW_RETRY, /* set if this is a request retry as opposed to a real
+                   redirect following */
+  FOLLOW_REDIR /* a full true redirect */
+} followtype;
+
+typedef enum {
+  DOMORE_GOBACK = -1,
+  DOMORE_INCOMPLETE = 0,
+  DOMORE_DONE = 1
+} domore;
+
+/*
+ * Specific protocol handler, an implementation of one or more URI schemes.
+ */
+struct Curl_protocol {
+  /* Complement to setup_connection_internals(). This is done before the
+     transfer "owns" the connection. */
+  CURLcode (*setup_connection)(struct Curl_easy *data,
+                               struct connectdata *conn);
+
+  /* These two functions MUST be set to be protocol dependent */
+  CURLcode (*do_it)(struct Curl_easy *data, bool *done);
+  CURLcode (*done)(struct Curl_easy *, CURLcode, bool);
+
+  /* If the curl_do() function is better made in two halves, this
+   * curl_do_more() function will be called afterwards, if set. For example
+   * for doing the FTP stuff after the PASV/PORT command. The second
+   * argument is an output parameter that MUST be set to one of the
+   * DOMORE_* values: DOMORE_INCOMPLETE if more do_more work remains,
+   * DOMORE_DONE when the second phase is complete, or DOMORE_GOBACK
+   * to return to the regular DO/DOING handling.
+   */
+  CURLcode (*do_more)(struct Curl_easy *, domore *);
+
+  /* This function *MAY* be set to a protocol-dependent function that is run
+   * after the connect() and everything is done, as a step in the connection.
+   * The 'done' pointer points to a bool that should be set to TRUE if the
+   * function completes before return. If it does not complete, the caller
+   * should call the ->connecting() function until it is.
+   */
+  CURLcode (*connect_it)(struct Curl_easy *data, bool *done);
+
+  /* See above. */
+  CURLcode (*connecting)(struct Curl_easy *data, bool *done);
+  CURLcode (*doing)(struct Curl_easy *data, bool *done);
+
+  /* Called from the multi interface during the PROTOCONNECT phase, and it
+     should then return a proper fd set */
+  CURLcode (*proto_pollset)(struct Curl_easy *data,
+                            struct easy_pollset *ps);
+
+  /* Called from the multi interface during the DOING phase, and it should
+     then return a proper fd set */
+  CURLcode (*doing_pollset)(struct Curl_easy *data,
+                            struct easy_pollset *ps);
+
+  /* Called from the multi interface during the DO_MORE phase, and it should
+     then return a proper fd set */
+  CURLcode (*domore_pollset)(struct Curl_easy *data,
+                            struct easy_pollset *ps);
+
+  /* Called from the multi interface during the DO_DONE, PERFORM and
+     WAITPERFORM phases, and it should then return a proper fd set. Not setting
+     this will make libcurl use the generic default one. */
+  CURLcode (*perform_pollset)(struct Curl_easy *data,
+                              struct easy_pollset *ps);
+
+  /* This function *MAY* be set to a protocol-dependent function that is run
+   * by the curl_disconnect(), as a step in the disconnection. If the handler
+   * is called because the connection has been considered dead,
+   * dead_connection is set to TRUE. The connection is (again) associated with
+   * the transfer here.
+   */
+  CURLcode (*disconnect)(struct Curl_easy *, struct connectdata *,
+                         bool dead_connection);
+
+  /* If used, this function gets called from transfer.c to
+     allow the protocol to do extra handling in writing response to
+     the client. */
+  CURLcode (*write_resp)(struct Curl_easy *data, const char *buf, size_t blen,
+                         bool is_eos);
+
+  /* If used, this function gets called from transfer.c to
+     allow the protocol to do extra handling in writing a single response
+     header line to the client. */
+  CURLcode (*write_resp_hd)(struct Curl_easy *data,
+                            const char *hd, size_t hdlen, bool is_eos);
+
+  /* If used, this function checks for a connection managed by this
+    protocol and currently not in use, if it should be considered dead. */
+  bool (*connection_is_dead)(struct Curl_easy *data,
+                             struct connectdata *conn);
+
+  /* attach() attaches this transfer to this connection */
+  void (*attach)(struct Curl_easy *data, struct connectdata *conn);
+
+  /* return CURLE_OK if a redirect to `newurl` should be followed,
+     CURLE_TOO_MANY_REDIRECTS otherwise. May alter `data` to change
+     the way the follow request is performed. */
+  CURLcode (*follow)(struct Curl_easy *data, const char *newurl,
+                     followtype type);
+};
+
+#define PROTOPT_NONE 0             /* nothing extra */
+#define PROTOPT_SSL (1 << 0)       /* uses SSL */
+#define PROTOPT_DUAL (1 << 1)      /* this protocol uses two connections */
+#define PROTOPT_CLOSEACTION (1 << 2) /* need action before socket close */
+/* some protocols will have to call the underlying functions without regard to
+   what exact state the socket signals. IE even if the socket says "readable",
+   the send function might need to be called while uploading, or vice versa.
+*/
+#define PROTOPT_DIRLOCK (1 << 3)
+#define PROTOPT_NONETWORK (1 << 4) /* protocol does not use the network! */
+#define PROTOPT_NEEDSPWD (1 << 5)  /* needs a password, and if none is set it
+                                      gets a default */
+#define PROTOPT_NOURLQUERY (1 << 6)  /* protocol cannot handle
+                                        URL query strings (?foo=bar) ! */
+#define PROTOPT_CREDSPERREQUEST (1 << 7) /* requires login credentials per
+                                            request instead of per
+                                            connection */
+#define PROTOPT_ALPN (1 << 8) /* set ALPN for this */
+/* (1 << 9) was PROTOPT_STREAM, now free */
+#define PROTOPT_URLOPTIONS (1 << 10) /* allow options part in the userinfo
+                                        field of the URL */
+#define PROTOPT_PROXY_AS_HTTP (1 << 11) /* allow this non-HTTP scheme over a
+                                           HTTP proxy as HTTP proxies may know
+                                           this protocol and act as
+                                           a gateway */
+#define PROTOPT_WILDCARD (1 << 12)  /* protocol supports wildcard matching */
+#define PROTOPT_USERPWDCTRL (1 << 13) /* Allow "control bytes" (< 32 ASCII) in
+                                         username and password */
+#define PROTOPT_NOTCPPROXY (1 << 14)  /* this protocol cannot proxy over TCP */
+#define PROTOPT_SSL_REUSE (1 << 15)   /* this protocol may reuse an existing
+                                         SSL connection in the same family
+                                         without having PROTOPT_SSL. */
+#define PROTOPT_CONN_REUSE (1 << 16)  /* this protocol can reuse connections */
+#define PROTOPT_NO_TRANSFER (1 << 17) /* this protocol is not for transfers */
+#define PROTOPT_HTTP_PROXY_TUNNEL (1 << 18) /* Using this protocol with a
+                                             * HTTP proxy requires tunneling */
+
+/* Everything about a URI scheme. */
+struct Curl_scheme {
+  const char *name;       /* URL scheme name in lowercase */
+  const struct Curl_protocol *run; /* implementation, optional */
+  curl_prot_t protocol;   /* See CURLPROTO_* - this needs to be the single
+                             specific protocol bit */
+  curl_prot_t family;     /* single bit for protocol family; the non-TLS name
+                             of the protocol this is */
+  uint32_t flags;         /* Extra particular characteristics, see PROTOPT_* */
+  uint16_t defport;       /* Default port. */
+};
+
+/* Get scheme definition for a URI scheme name
+ * @param scheme URI scheme name, case-insensitive
+ * @return NULL if scheme is not known
+ */
+const struct Curl_scheme *Curl_get_scheme(const char *scheme);
+const struct Curl_scheme *Curl_getn_scheme(const char *scheme, size_t len);
+
+/* For direct access to a URI scheme */
+extern const struct Curl_scheme Curl_scheme_dict;
+extern const struct Curl_scheme Curl_scheme_file;
+extern const struct Curl_scheme Curl_scheme_ftp;
+extern const struct Curl_scheme Curl_scheme_ftps;
+extern const struct Curl_scheme Curl_scheme_gopher;
+extern const struct Curl_scheme Curl_scheme_gophers;
+extern const struct Curl_scheme Curl_scheme_http;
+extern const struct Curl_scheme Curl_scheme_https;
+extern const struct Curl_scheme Curl_scheme_imap;
+extern const struct Curl_scheme Curl_scheme_imaps;
+extern const struct Curl_scheme Curl_scheme_ldap;
+extern const struct Curl_scheme Curl_scheme_ldaps;
+extern const struct Curl_scheme Curl_scheme_mqtt;
+extern const struct Curl_scheme Curl_scheme_mqtts;
+extern const struct Curl_scheme Curl_scheme_pop3;
+extern const struct Curl_scheme Curl_scheme_pop3s;
+extern const struct Curl_scheme Curl_scheme_rtsp;
+extern const struct Curl_scheme Curl_scheme_scp;
+extern const struct Curl_scheme Curl_scheme_sftp;
+extern const struct Curl_scheme Curl_scheme_smb;
+extern const struct Curl_scheme Curl_scheme_smbs;
+extern const struct Curl_scheme Curl_scheme_smtp;
+extern const struct Curl_scheme Curl_scheme_smtps;
+extern const struct Curl_scheme Curl_scheme_socks;
+extern const struct Curl_scheme Curl_scheme_socks4;
+extern const struct Curl_scheme Curl_scheme_socks4a;
+extern const struct Curl_scheme Curl_scheme_socks5;
+extern const struct Curl_scheme Curl_scheme_socks5h;
+extern const struct Curl_scheme Curl_scheme_telnet;
+extern const struct Curl_scheme Curl_scheme_tftp;
+extern const struct Curl_scheme Curl_scheme_ws;
+extern const struct Curl_scheme Curl_scheme_wss;
+
+#endif /* HEADER_CURL_PROTOCOL_H */
diff --git a/third-party/curl/lib/proxy.c b/third-party/curl/lib/proxy.c
new file mode 100644
index 0000000000..920dc45598
--- /dev/null
+++ b/third-party/curl/lib/proxy.c
@@ -0,0 +1,673 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifndef CURL_DISABLE_PROXY
+
+#include "urldata.h"
+#include "curl_trc.h"
+#include "protocol.h"
+#include "proxy.h"
+#include "http_proxy.h"
+#include "strcase.h"
+#include "url.h"
+#include "vauth/vauth.h"
+#include "curlx/inet_pton.h"
+#include "curlx/strparse.h"
+
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+
+/*
+ * cidr4_match() returns TRUE if the given IPv4 address is within the
+ * specified CIDR address range.
+ *
+ * @unittest 1614
+ */
+UNITTEST bool cidr4_match(const char *ipv4,    /* 1.2.3.4 address */
+                          const char *network, /* 1.2.3.4 address */
+                          unsigned int bits);
+UNITTEST bool cidr4_match(const char *ipv4,    /* 1.2.3.4 address */
+                          const char *network, /* 1.2.3.4 address */
+                          unsigned int bits)
+{
+  unsigned int address = 0;
+  unsigned int check = 0;
+
+  if(bits > 32)
+    /* strange input */
+    return FALSE;
+
+  if(curlx_inet_pton(AF_INET, ipv4, &address) != 1)
+    return FALSE;
+  if(curlx_inet_pton(AF_INET, network, &check) != 1)
+    return FALSE;
+
+  if(bits && (bits != 32)) {
+    unsigned int mask = 0xffffffff << (32 - bits);
+    unsigned int haddr = htonl(address);
+    unsigned int hcheck = htonl(check);
+#if 0
+    curl_mfprintf(stderr, "Host %s (%x) network %s (%x) "
+                  "bits %u mask %x => %x\n",
+                  ipv4, haddr, network, hcheck, bits, mask,
+                  (haddr ^ hcheck) & mask);
+#endif
+    if((haddr ^ hcheck) & mask)
+      return FALSE;
+    return TRUE;
+  }
+  return address == check;
+}
+
+/* @unittest 1614 */
+UNITTEST bool cidr6_match(const char *ipv6, const char *network,
+                          unsigned int bits);
+UNITTEST bool cidr6_match(const char *ipv6, const char *network,
+                          unsigned int bits)
+{
+#ifdef USE_IPV6
+  unsigned int bytes;
+  unsigned int rest;
+  unsigned char address[16];
+  unsigned char check[16];
+
+  if(!bits)
+    bits = 128;
+
+  bytes = bits / 8;
+  rest = bits & 0x07;
+  if((bytes > 16) || ((bytes == 16) && rest))
+    return FALSE;
+  if(curlx_inet_pton(AF_INET6, ipv6, address) != 1)
+    return FALSE;
+  if(curlx_inet_pton(AF_INET6, network, check) != 1)
+    return FALSE;
+  if(bytes && memcmp(address, check, bytes))
+    return FALSE;
+  if(rest && ((address[bytes] ^ check[bytes]) & (0xff << (8 - rest))))
+    return FALSE;
+
+  return TRUE;
+#else
+  (void)ipv6;
+  (void)network;
+  (void)bits;
+  return FALSE;
+#endif
+}
+
+enum nametype {
+  TYPE_HOST,
+  TYPE_IPV4,
+  TYPE_IPV6
+};
+
+static bool match_host(const char *token, size_t tokenlen,
+                       const char *name, size_t namelen)
+{
+  bool match = FALSE;
+
+  /* ignore trailing dots in the token to check */
+  if(token[tokenlen - 1] == '.')
+    tokenlen--;
+
+  if(tokenlen && (*token == '.')) {
+    /* ignore leading token dot as well */
+    token++;
+    tokenlen--;
+  }
+  /* A: example.com matches 'example.com'
+     B: www.example.com matches 'example.com'
+     C: nonexample.com DOES NOT match 'example.com'
+  */
+  if(tokenlen == namelen)
+    /* case A, exact match */
+    match = curl_strnequal(token, name, namelen);
+  else if(tokenlen < namelen) {
+    /* case B, tailmatch domain */
+    match = (name[namelen - tokenlen - 1] == '.') &&
+            curl_strnequal(token, name + (namelen - tokenlen), tokenlen);
+  }
+  /* case C passes through, not a match */
+  return match;
+}
+
+static bool match_ip(int type, const char *token, size_t tokenlen,
+                     const char *name)
+{
+  char *slash;
+  unsigned int bits = 0;
+  char checkip[128];
+  if(tokenlen >= sizeof(checkip))
+    /* this cannot match */
+    return FALSE;
+  /* copy the check name to a temp buffer */
+  memcpy(checkip, token, tokenlen);
+  checkip[tokenlen] = 0;
+
+  slash = strchr(checkip, '/');
+  /* if the slash is part of this token, use it */
+  if(slash) {
+    curl_off_t value;
+    const char *p = &slash[1];
+    if(curlx_str_number(&p, &value, 128) || *p)
+      return FALSE;
+    /* a too large value is rejected in the cidr function below */
+    bits = (unsigned int)value;
+    *slash = 0; /* null-terminate there */
+  }
+  if(type == TYPE_IPV6)
+    return cidr6_match(name, checkip, bits);
+  else
+    return cidr4_match(name, checkip, bits);
+}
+
+/****************************************************************
+ * Checks if the host is in the noproxy list. returns TRUE if it matches and
+ * therefore the proxy should NOT be used.
+ ****************************************************************/
+/* @unittest 1614 */
+UNITTEST bool proxy_check_noproxy(const char *name, const char *no_proxy);
+UNITTEST bool proxy_check_noproxy(const char *name, const char *no_proxy)
+{
+  /*
+   * If we do not have a hostname at all, like for example with a FILE
+   * transfer, we have nothing to interrogate the noproxy list with.
+   */
+  if(!name || name[0] == '\0')
+    return FALSE;
+
+  /* no_proxy=domain1.dom,host.domain2.dom
+   *   (a comma-separated list of hosts which should
+   *   not be proxied, or an asterisk to override
+   *   all proxy variables)
+   */
+  if(no_proxy && no_proxy[0]) {
+    const char *p = no_proxy;
+    size_t namelen;
+    char address[16];
+    enum nametype type = TYPE_HOST;
+    if(!strcmp("*", no_proxy))
+      return TRUE;
+
+    /* NO_PROXY was specified and it was not only an asterisk */
+
+    /* Check if name is an IP address; if not, assume it being a hostname. */
+    namelen = strlen(name);
+    if(curlx_inet_pton(AF_INET, name, &address) == 1)
+      type = TYPE_IPV4;
+#ifdef USE_IPV6
+    else if(curlx_inet_pton(AF_INET6, name, &address) == 1)
+      type = TYPE_IPV6;
+#endif
+    else {
+      /* ignore trailing dots in the hostname */
+      if(name[namelen - 1] == '.')
+        namelen--;
+    }
+
+    while(*p) {
+      const char *token;
+      size_t tokenlen = 0;
+
+      /* pass blanks */
+      curlx_str_passblanks(&p);
+
+      token = p;
+      /* pass over the pattern */
+      while(*p && !ISBLANK(*p) && (*p != ',')) {
+        p++;
+        tokenlen++;
+      }
+
+      if(tokenlen) {
+        bool match = FALSE;
+        if(type == TYPE_HOST)
+          match = match_host(token, tokenlen, name, namelen);
+        else
+          match = match_ip(type, token, tokenlen, name);
+
+        if(match)
+          return TRUE;
+      }
+
+      /* pass blanks after pattern */
+      curlx_str_passblanks(&p);
+      /* if not a comma, this ends the loop */
+      if(*p != ',')
+        break;
+      /* pass any number of commas */
+      while(*p == ',')
+        p++;
+    } /* while(*p) */
+  } /* NO_PROXY was specified and it was not only an asterisk */
+
+  return FALSE;
+}
+
+#ifndef CURL_DISABLE_HTTP
+
+/****************************************************************
+ * Detect what (if any) proxy to use. Remember that this selects a host
+ * name and is not limited to HTTP proxies only.
+ * The returned pointer must be freed by the caller.
+ ****************************************************************/
+static char *proxy_detect_proxy(struct Curl_easy *data,
+                                const struct Curl_scheme *scheme)
+{
+  char *proxy = NULL;
+
+  /* If proxy was not specified, we check for default proxy environment
+   * variables, to enable i.e Lynx compliance:
+   *
+   * http_proxy=http://some.server.dom:port/
+   * https_proxy=http://some.server.dom:port/
+   * ftp_proxy=http://some.server.dom:port/
+   * no_proxy=domain1.dom,host.domain2.dom
+   *   (a comma-separated list of hosts which should
+   *   not be proxied, or an asterisk to override
+   *   all proxy variables)
+   * all_proxy=http://some.server.dom:port/
+   *   (seems to exist for the CERN www lib. Probably
+   *   the first to check for.)
+   *
+   * For compatibility, the all-uppercase versions of these variables are
+   * checked if the lowercase versions do not exist.
+   */
+  char proxy_env[20];
+  const char *envp;
+  VERBOSE(envp = proxy_env);
+
+  curl_msnprintf(proxy_env, sizeof(proxy_env), "%s_proxy", scheme->name);
+
+  /* read the protocol proxy: */
+  proxy = curl_getenv(proxy_env);
+
+  /*
+   * We do not try the uppercase version of HTTP_PROXY because of
+   * security reasons:
+   *
+   * When curl is used in a webserver application
+   * environment (cgi or php), this environment variable can
+   * be controlled by the web server user by setting the
+   * http header 'Proxy:' to some value.
+   *
+   * This can cause 'internal' http/ftp requests to be
+   * arbitrarily redirected by any external attacker.
+   */
+  if(!proxy && !curl_strequal("http_proxy", proxy_env)) {
+    /* There was no lowercase variable, try the uppercase version: */
+    Curl_strntoupper(proxy_env, proxy_env, sizeof(proxy_env));
+    proxy = curl_getenv(proxy_env);
+  }
+
+  if(!proxy) {
+#ifndef CURL_DISABLE_WEBSOCKETS
+    /* websocket proxy fallbacks */
+    if(curl_strequal("ws_proxy", proxy_env)) {
+      proxy = curl_getenv("http_proxy");
+    }
+    else if(curl_strequal("wss_proxy", proxy_env)) {
+      proxy = curl_getenv("https_proxy");
+      if(!proxy)
+        proxy = curl_getenv("HTTPS_PROXY");
+    }
+    if(!proxy) {
+#endif
+      envp = "all_proxy";
+      proxy = curl_getenv(envp); /* default proxy to use */
+      if(!proxy) {
+        envp = "ALL_PROXY";
+        proxy = curl_getenv(envp);
+      }
+#ifndef CURL_DISABLE_WEBSOCKETS
+    }
+#endif
+  }
+  if(proxy)
+    infof(data, "Uses proxy env variable %s == '%s'", envp, proxy);
+
+  return proxy;
+}
+#endif /* CURL_DISABLE_HTTP */
+
+/*
+ * If this is supposed to use a proxy, we need to figure out the proxy
+ * hostname, so that we can reuse an existing connection
+ * that may exist registered to the same proxy host.
+ */
+static CURLcode parse_proxy(struct Curl_easy *data,
+                            const char *proxy,
+                            bool for_pre_proxy,
+                            struct proxy_info *proxyinfo)
+{
+  char *proxyuser = NULL;
+  char *proxypasswd = NULL;
+  char *scheme = NULL;
+  CURLcode result = CURLE_OK;
+  /* Set the start proxy type for URL scheme guessing */
+  uint8_t proxytype = for_pre_proxy ? CURLPROXY_SOCKS4 : data->set.proxytype;
+  CURLU *uhp = curl_url();
+  CURLUcode uc;
+
+  if(!uhp) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto error;
+  }
+  /* When parsing the proxy, allowing non-supported schemes since we have
+     these made up ones for proxies. Guess scheme for URLs without it. */
+  uc = curl_url_set(uhp, CURLUPART_URL, proxy,
+                    CURLU_NON_SUPPORT_SCHEME | CURLU_GUESS_SCHEME);
+  if(!uc) {
+    /* parsed okay as a URL - only update proxytype when scheme was explicit */
+    uc = curl_url_get(uhp, CURLUPART_SCHEME, &scheme, CURLU_NO_GUESS_SCHEME);
+    if(!uc) {
+      result = Curl_scheme_to_proxytype(data, scheme, &proxytype, proxy);
+      if(result)
+        goto error;
+    }
+    else if(uc != CURLUE_NO_SCHEME) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto error;
+    }
+    /* else: no explicit scheme, keep the configured proxytype */
+  }
+  else {
+    failf(data, "Unsupported proxy syntax in \'%s\': %s", proxy,
+          curl_url_strerror(uc));
+    result = CURLE_COULDNT_RESOLVE_PROXY;
+    goto error;
+  }
+
+  result = Curl_peer_from_proxy_url(uhp, data, proxy, proxytype,
+                                    &proxyinfo->peer, &proxytype);
+  if(result)
+    goto error;
+
+  switch(proxytype) {
+    case CURLPROXY_HTTP:
+    case CURLPROXY_HTTP_1_0:
+    case CURLPROXY_HTTPS:
+    case CURLPROXY_HTTPS2:
+    case CURLPROXY_HTTPS3:
+      if(for_pre_proxy) {
+        failf(data, "Unsupported pre-proxy type for \'%s\'", proxy);
+        result = CURLE_COULDNT_RESOLVE_PROXY;
+        goto error;
+      }
+      break;
+    case CURLPROXY_SOCKS4:
+    case CURLPROXY_SOCKS4A:
+    case CURLPROXY_SOCKS5:
+    case CURLPROXY_SOCKS5_HOSTNAME:
+      break;
+    default:
+      failf(data, "Unsupported proxy type %u for \'%s\'", proxytype, proxy);
+      result = CURLE_COULDNT_RESOLVE_PROXY;
+      goto error;
+  }
+
+  /* Is there a username and password given in this proxy URL? */
+  uc = curl_url_get(uhp, CURLUPART_USER, &proxyuser, CURLU_URLDECODE);
+  if(uc && (uc != CURLUE_NO_USER)) {
+    result = Curl_uc_to_curlcode(uc);
+    goto error;
+  }
+  uc = curl_url_get(uhp, CURLUPART_PASSWORD, &proxypasswd, CURLU_URLDECODE);
+  if(uc && (uc != CURLUE_NO_PASSWORD)) {
+    result = Curl_uc_to_curlcode(uc);
+    goto error;
+  }
+
+  if(proxyuser || proxypasswd) {
+    result = Curl_creds_create(proxyuser, proxypasswd, NULL, NULL,
+                               data->set.str[STRING_PROXY_SERVICE_NAME],
+                               CREDS_URL, &proxyinfo->creds);
+    if(result)
+      goto error;
+  }
+  else if(!for_pre_proxy &&
+          (data->set.str[STRING_PROXYUSERNAME] ||
+           data->set.str[STRING_PROXYPASSWORD] ||
+           data->set.str[STRING_PROXY_SERVICE_NAME])) {
+    /* No user/passwd in URL, if this is not a pre-proxy, the
+     * CURLOPT_PROXY* settings apply. */
+    result = Curl_creds_create(data->set.str[STRING_PROXYUSERNAME],
+                               data->set.str[STRING_PROXYPASSWORD],
+                               NULL, NULL,
+                               data->set.str[STRING_PROXY_SERVICE_NAME],
+                               CREDS_OPTION, &proxyinfo->creds);
+  }
+  else
+    Curl_creds_unlink(&proxyinfo->creds);
+
+  proxyinfo->proxytype = proxytype;
+
+error:
+  curlx_free(scheme);
+  curlx_free(proxyuser);
+  curlx_free(proxypasswd);
+  curl_url_cleanup(uhp);
+#ifdef DEBUGBUILD
+  if(!result) {
+    DEBUGASSERT(proxyinfo);
+    DEBUGASSERT(proxyinfo->peer);
+  }
+#endif
+  return result;
+}
+
+/* Is transfer's origin exempted from proxy use? */
+static bool proxy_do_not_proxy(struct Curl_easy *data)
+{
+  const char *no_proxy;
+  char *env_no_proxy = NULL;
+  bool do_not_proxy;
+
+  /* no proxying if the transfer does not use the network */
+  if(data->state.origin->scheme->flags & PROTOPT_NONETWORK)
+    return TRUE;
+
+  no_proxy = data->set.str[STRING_NOPROXY];
+  if(!no_proxy) {
+    const char *p = "no_proxy";
+    env_no_proxy = curl_getenv(p);
+    if(!env_no_proxy) {
+      p = "NO_PROXY";
+      env_no_proxy = curl_getenv(p);
+    }
+    if(env_no_proxy)
+      infof(data, "Uses proxy env variable %s == '%s'", p, env_no_proxy);
+    no_proxy = env_no_proxy;
+  }
+
+  do_not_proxy = proxy_check_noproxy(data->state.origin->hostname, no_proxy);
+  curlx_safefree(env_no_proxy);
+  return do_not_proxy;
+}
+
+CURLcode Curl_proxy_init_conn(struct Curl_easy *data,
+                              struct connectdata *conn)
+{
+  char *proxy = NULL;
+  char *pre_proxy = NULL;
+  bool do_env_detect = TRUE;
+  CURLcode result = CURLE_OK;
+
+  /* Enforce no proxy use unless we decide to use one */
+  conn->bits.origin_is_proxy = FALSE;
+  DEBUGASSERT(!conn->socks_proxy.peer);
+  DEBUGASSERT(!conn->http_proxy.peer);
+
+  if(proxy_do_not_proxy(data))
+    goto out;
+
+  /*************************************************************
+   * Detect what (if any) proxy to use
+   *************************************************************/
+  /* the empty config strings disable proxy use and env detects */
+  if(data->set.str[STRING_PROXY]) {
+    if(*data->set.str[STRING_PROXY]) {
+      proxy = curlx_strdup(data->set.str[STRING_PROXY]);
+      /* if global proxy is set, this is it */
+      if(!proxy) {
+        failf(data, "memory shortage");
+        result = CURLE_OUT_OF_MEMORY;
+        goto out;
+      }
+    }
+    else
+      do_env_detect = FALSE;
+  }
+
+  if(data->set.str[STRING_PRE_PROXY]) {
+    if(*data->set.str[STRING_PRE_PROXY]) {
+      pre_proxy = curlx_strdup(data->set.str[STRING_PRE_PROXY]);
+      /* if global socks proxy is set, this is it */
+      if(!pre_proxy) {
+        failf(data, "memory shortage");
+        result = CURLE_OUT_OF_MEMORY;
+        goto out;
+      }
+    }
+    else
+      do_env_detect = FALSE;
+  }
+
+#ifndef CURL_DISABLE_HTTP
+  /* None configured, detect possible proxy from environment. */
+  if(!proxy && !pre_proxy && do_env_detect)
+    proxy = proxy_detect_proxy(data, conn->scheme);
+#else
+  (void)do_env_detect;
+#endif /* CURL_DISABLE_HTTP */
+
+  if(!proxy && !pre_proxy)
+    goto out;
+
+  if(pre_proxy) {
+    result = parse_proxy(data, pre_proxy, TRUE, &conn->socks_proxy);
+    if(result)
+      goto out;
+  }
+
+  if(proxy) {
+    result = parse_proxy(data, proxy, FALSE, &conn->http_proxy);
+    if(result)
+      goto out;
+
+    switch(conn->http_proxy.proxytype) {
+    case CURLPROXY_SOCKS4:
+    case CURLPROXY_SOCKS4A:
+    case CURLPROXY_SOCKS5:
+    case CURLPROXY_SOCKS5_HOSTNAME:
+      /* Whoops, it is not an HTTP proxy */
+      if(pre_proxy) {
+        /* and we already have a SOCKS pre-proxy. Cannot have both */
+        failf(data, "Having a SOCKS pre-proxy and proxy is not "
+              "supported with \'%s\'", proxy);
+        result = CURLE_COULDNT_RESOLVE_PROXY;
+        goto out;
+      }
+      /* switch */
+      conn->socks_proxy = conn->http_proxy;
+      memset(&conn->http_proxy, 0, sizeof(conn->http_proxy));
+      break;
+    default:
+      /* all other types are HTTP */
+      break;
+    }
+  }
+
+  if(conn->socks_proxy.peer) {
+    DEBUGASSERT(!CURL_PROXY_IS_ANY_HTTP(conn->socks_proxy.proxytype));
+  }
+
+#ifdef CURL_DISABLE_HTTP
+  if(conn->http_proxy.peer) {
+    /* asking for an HTTP proxy is a bit funny when HTTP is disabled... */
+    result = CURLE_UNSUPPORTED_PROTOCOL;
+    goto out;
+  }
+
+#else /* CURL_DISABLE_HTTP */
+  if(conn->http_proxy.peer) {
+    const struct Curl_scheme *scheme = data->state.origin->scheme;
+    bool tunnel_proxy = (bool)data->set.tunnel_thru_httpproxy;
+    DEBUGASSERT(CURL_PROXY_IS_ANY_HTTP(conn->http_proxy.proxytype));
+
+    if(!tunnel_proxy) {
+      /* Decide if we tunnel through proxy automatically */
+      if(conn->via_peer) {
+        /* With connect-to, we always tunnel */
+        tunnel_proxy = TRUE;
+      }
+      else if(scheme->flags & PROTOPT_SSL) {
+        /* If the transfer is supposed to be secure, we tunnel */
+        tunnel_proxy = TRUE;
+      }
+      else if(scheme->flags & PROTOPT_HTTP_PROXY_TUNNEL) {
+        /* transfer scheme required tunneling */
+        tunnel_proxy = TRUE;
+      }
+      else if(!(scheme->protocol & PROTO_FAMILY_HTTP) &&
+              !(scheme->flags & PROTOPT_PROXY_AS_HTTP)) {
+        /* Cannot delegate transfer URL to HTTP proxy */
+        tunnel_proxy = TRUE;
+      }
+    }
+
+    if(!tunnel_proxy) {
+      /* HTTP proxy used in forwarding mode. This means the connection
+       * is really to the proxy and NOT the origin of the transfer. */
+      DEBUGASSERT(!conn->via_peer);
+      Curl_peer_link(&conn->origin, conn->http_proxy.peer);
+      conn->scheme = conn->http_proxy.peer->scheme;
+      conn->bits.origin_is_proxy = TRUE;
+    }
+
+#ifndef CURL_DISABLE_DIGEST_AUTH
+    if(!Curl_safecmp(data->state.envproxy, proxy)) {
+      /* proxy changed */
+      Curl_auth_digest_cleanup(&data->state.proxydigest);
+      curlx_free(data->state.envproxy);
+      data->state.envproxy = curlx_strdup(proxy);
+    }
+#endif
+  }
+#endif /* !CURL_DISABLE_HTTP */
+
+out:
+  curlx_free(pre_proxy);
+  curlx_free(proxy);
+  return result;
+}
+
+#endif /* CURL_DISABLE_PROXY */
diff --git a/third-party/curl/lib/proxy.h b/third-party/curl/lib/proxy.h
new file mode 100644
index 0000000000..307ee003e6
--- /dev/null
+++ b/third-party/curl/lib/proxy.h
@@ -0,0 +1,59 @@
+#ifndef HEADER_CURL_PROXY_H
+#define HEADER_CURL_PROXY_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifndef CURL_DISABLE_PROXY
+
+struct Curl_easy;
+struct Curl_peer;
+struct Curl_creds;
+struct connectdata;
+
+struct proxy_info {
+  struct Curl_peer *peer; /* proxy to this peer */
+  struct Curl_creds *creds; /* use these credentials, maybe NULL */
+  uint8_t proxytype; /* what kind of proxy that is in use */
+};
+
+#define CURL_PROXY_IS_HTTPS(t)  \
+  (((t) == CURLPROXY_HTTPS) ||  \
+   ((t) == CURLPROXY_HTTPS2) || \
+   ((t) == CURLPROXY_HTTPS3))
+
+#define CURL_PROXY_IS_HTTP(t)   \
+  (((t) == CURLPROXY_HTTP) ||   \
+   ((t) == CURLPROXY_HTTP_1_0))
+
+#define CURL_PROXY_IS_ANY_HTTP(t) \
+  (CURL_PROXY_IS_HTTP(t) ||       \
+   CURL_PROXY_IS_HTTPS(t))
+
+CURLcode Curl_proxy_init_conn(struct Curl_easy *data,
+                              struct connectdata *conn);
+
+#endif /* !CURL_DISABLE_PROXY */
+
+#endif /* HEADER_CURL_PROXY_H */
diff --git a/third-party/curl/lib/psl.c b/third-party/curl/lib/psl.c
index 626a203a6d..195841f3a3 100644
--- a/third-party/curl/lib/psl.c
+++ b/third-party/curl/lib/psl.c
@@ -21,50 +21,40 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include <curl/curl.h>
-
 #ifdef USE_LIBPSL
 
 #include "psl.h"
-#include "share.h"
+#include "progress.h"
+#include "curl_share.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#if !defined(PSL_VERSION_NUMBER) || PSL_VERSION_NUMBER < 0x001000
+#error "libpsl 0.16.0 or greater required"
+#endif
 
 void Curl_psl_destroy(struct PslCache *pslcache)
 {
   if(pslcache->psl) {
     if(pslcache->dynamic)
-      psl_free((psl_ctx_t *) pslcache->psl);
+      psl_free((psl_ctx_t *)CURL_UNCONST(pslcache->psl));
     pslcache->psl = NULL;
     pslcache->dynamic = FALSE;
   }
 }
 
-static time_t now_seconds(void)
-{
-  struct curltime now = Curl_now();
-
-  return now.tv_sec;
-}
-
 const psl_ctx_t *Curl_psl_use(struct Curl_easy *easy)
 {
   struct PslCache *pslcache = easy->psl;
   const psl_ctx_t *psl;
-  time_t now;
+  time_t now_sec;
 
   if(!pslcache)
     return NULL;
 
   Curl_share_lock(easy, CURL_LOCK_DATA_PSL, CURL_LOCK_ACCESS_SHARED);
-  now = now_seconds();
-  if(!pslcache->psl || pslcache->expires <= now) {
+  now_sec = Curl_pgrs_now(easy)->tv_sec;
+  if(!pslcache->psl || pslcache->expires <= now_sec) {
     /* Let a chance to other threads to do the job: avoids deadlock. */
     Curl_share_unlock(easy, CURL_LOCK_DATA_PSL);
 
@@ -72,21 +62,21 @@ const psl_ctx_t *Curl_psl_use(struct Curl_easy *easy)
     Curl_share_lock(easy, CURL_LOCK_DATA_PSL, CURL_LOCK_ACCESS_SINGLE);
 
     /* Recheck in case another thread did the job. */
-    now = now_seconds();
-    if(!pslcache->psl || pslcache->expires <= now) {
+    if(pslcache->expires <= now_sec) {
+      now_sec = Curl_pgrs_now(easy)->tv_sec;
+    }
+    if(!pslcache->psl || pslcache->expires <= now_sec) {
       bool dynamic = FALSE;
       time_t expires = TIME_T_MAX;
 
-#if defined(PSL_VERSION_NUMBER) && PSL_VERSION_NUMBER >= 0x001000
       psl = psl_latest(NULL);
-      dynamic = psl != NULL;
+      dynamic = !!psl;
       /* Take care of possible time computation overflow. */
-      expires = now < TIME_T_MAX - PSL_TTL? now + PSL_TTL: TIME_T_MAX;
+      expires = (now_sec < TIME_T_MAX - PSL_TTL) ?
+                (now_sec + PSL_TTL) : TIME_T_MAX;
 
       /* Only get the built-in PSL if we do not already have the "latest". */
       if(!psl && !pslcache->dynamic)
-#endif
-
         psl = psl_builtin();
 
       if(psl) {
@@ -96,7 +86,7 @@ const psl_ctx_t *Curl_psl_use(struct Curl_easy *easy)
         pslcache->expires = expires;
       }
     }
-    Curl_share_unlock(easy, CURL_LOCK_DATA_PSL);  /* Release exclusive lock. */
+    Curl_share_unlock(easy, CURL_LOCK_DATA_PSL); /* Release exclusive lock. */
     Curl_share_lock(easy, CURL_LOCK_DATA_PSL, CURL_LOCK_ACCESS_SHARED);
   }
   psl = pslcache->psl;
diff --git a/third-party/curl/lib/psl.h b/third-party/curl/lib/psl.h
index 23cfa921c4..97871f9634 100644
--- a/third-party/curl/lib/psl.h
+++ b/third-party/curl/lib/psl.h
@@ -23,16 +23,18 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #ifdef USE_LIBPSL
+
 #include <libpsl.h>
 
+struct Curl_easy;
+
 #define PSL_TTL (72 * 3600)     /* PSL time to live before a refresh. */
 
 struct PslCache {
   const psl_ctx_t *psl; /* The PSL. */
   time_t expires; /* Time this PSL life expires. */
-  bool dynamic; /* PSL should be released when no longer needed. */
+  BIT(dynamic); /* PSL should be released when no longer needed. */
 };
 
 const psl_ctx_t *Curl_psl_use(struct Curl_easy *easy);
diff --git a/third-party/curl/lib/rand.c b/third-party/curl/lib/rand.c
index a5620ea6eb..3260fe3345 100644
--- a/third-party/curl/lib/rand.c
+++ b/third-party/curl/lib/rand.c
@@ -21,195 +21,155 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#ifdef HAVE_FCNTL_H
-#include <fcntl.h>
-#endif
 #ifdef HAVE_ARPA_INET_H
 #include <arpa/inet.h>
 #endif
-#ifdef HAVE_ARC4RANDOM
-/* Some platforms might have the prototype missing (ubuntu + libressl) */
-uint32_t arc4random(void);
-#endif
 
-#include <curl/curl.h>
 #include "urldata.h"
 #include "vtls/vtls.h"
-#include "sendf.h"
-#include "timeval.h"
+#include "curl_trc.h"
 #include "rand.h"
+#include "escape.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-#ifdef WIN32
-
-#if defined(__MINGW32__) && !defined(__MINGW64_VERSION_MAJOR)
-#  define HAVE_MINGW_ORIGINAL
-#endif
-
-#if defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x600 && \
-  !defined(HAVE_MINGW_ORIGINAL)
-#  define HAVE_WIN_BCRYPTGENRANDOM
-#  include <bcrypt.h>
-#  ifdef _MSC_VER
-#    pragma comment(lib, "bcrypt.lib")
-#  endif
-#  ifndef BCRYPT_USE_SYSTEM_PREFERRED_RNG
-#  define BCRYPT_USE_SYSTEM_PREFERRED_RNG 0x00000002
-#  endif
-#  ifndef STATUS_SUCCESS
-#  define STATUS_SUCCESS ((NTSTATUS)0x00000000L)
-#  endif
-#elif defined(USE_WIN32_CRYPTO)
-#  include <wincrypt.h>
-#  ifdef _MSC_VER
-#    pragma comment(lib, "advapi32.lib")
-#  endif
+#ifdef _WIN32
+#include <bcrypt.h>
+#ifndef STATUS_SUCCESS
+#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)
 #endif
 
 CURLcode Curl_win32_random(unsigned char *entropy, size_t length)
 {
   memset(entropy, 0, length);
 
-#if defined(HAVE_WIN_BCRYPTGENRANDOM)
   if(BCryptGenRandom(NULL, entropy, (ULONG)length,
                      BCRYPT_USE_SYSTEM_PREFERRED_RNG) != STATUS_SUCCESS)
     return CURLE_FAILED_INIT;
 
   return CURLE_OK;
-#elif defined(USE_WIN32_CRYPTO)
-  {
-    HCRYPTPROV hCryptProv = 0;
-
-    if(!CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL,
-                            CRYPT_VERIFYCONTEXT | CRYPT_SILENT))
-      return CURLE_FAILED_INIT;
-
-    if(!CryptGenRandom(hCryptProv, (DWORD)length, entropy)) {
-      CryptReleaseContext(hCryptProv, 0UL);
-      return CURLE_FAILED_INIT;
-    }
-
-    CryptReleaseContext(hCryptProv, 0UL);
-  }
-  return CURLE_OK;
-#else
-  return CURLE_NOT_BUILT_IN;
-#endif
 }
 #endif
 
-static CURLcode randit(struct Curl_easy *data, unsigned int *rnd)
+#ifndef USE_SSL
+/* ---- possibly non-cryptographic version following ---- */
+static CURLcode weak_random(struct Curl_easy *data,
+                            unsigned char *entropy,
+                            size_t length) /* always 4, size of int */
 {
   unsigned int r;
-  CURLcode result = CURLE_OK;
-  static unsigned int randseed;
-  static bool seeded = FALSE;
+  DEBUGASSERT(length == sizeof(int));
 
-#ifdef CURLDEBUG
-  char *force_entropy = getenv("CURL_ENTROPY");
-  if(force_entropy) {
-    if(!seeded) {
-      unsigned int seed = 0;
-      size_t elen = strlen(force_entropy);
-      size_t clen = sizeof(seed);
-      size_t min = elen < clen ? elen : clen;
-      memcpy((char *)&seed, force_entropy, min);
-      randseed = ntohl(seed);
-      seeded = TRUE;
-    }
-    else
-      randseed++;
-    *rnd = randseed;
-    return CURLE_OK;
-  }
-#endif
-
-  /* data may be NULL! */
-  result = Curl_ssl_random(data, (unsigned char *)rnd, sizeof(*rnd));
-  if(result != CURLE_NOT_BUILT_IN)
-    /* only if there is no random function in the TLS backend do the non crypto
-       version, otherwise return result */
-    return result;
-
-  /* ---- non-cryptographic version following ---- */
-
-#ifdef WIN32
-  if(!seeded) {
-    result = Curl_win32_random((unsigned char *)rnd, sizeof(*rnd));
+  /* Trying cryptographically secure functions first */
+#ifdef _WIN32
+  (void)data;
+  {
+    CURLcode result = Curl_win32_random(entropy, length);
     if(result != CURLE_NOT_BUILT_IN)
       return result;
   }
 #endif
 
 #ifdef HAVE_ARC4RANDOM
-  *rnd = (unsigned int)arc4random();
+  (void)data;
+  r = (unsigned int)arc4random();
+  memcpy(entropy, &r, length);
+#else
+  infof(data, "WARNING: using weak random seed");
+  {
+    static unsigned int randseed;
+    static bool seeded = FALSE;
+    unsigned int rnd;
+    if(!seeded) {
+      struct curltime now;
+      curlx_pnow(&now);
+      randseed += (unsigned int)now.tv_usec + (unsigned int)now.tv_sec;
+      randseed = randseed * 1103515245 + 12345;
+      randseed = randseed * 1103515245 + 12345;
+      randseed = randseed * 1103515245 + 12345;
+      seeded = TRUE;
+    }
+
+    /* Return an unsigned 32-bit pseudo-random number. */
+    r = randseed = randseed * 1103515245 + 12345;
+    rnd = (r << 16) | ((r >> 16) & 0xFFFF);
+    memcpy(entropy, &rnd, length);
+  }
+#endif
   return CURLE_OK;
+}
 #endif
 
-#if defined(RANDOM_FILE) && !defined(WIN32)
-  if(!seeded) {
-    /* if there's a random file to read a seed from, use it */
-    int fd = open(RANDOM_FILE, O_RDONLY);
-    if(fd > -1) {
-      /* read random data into the randseed variable */
-      ssize_t nread = read(fd, &randseed, sizeof(randseed));
-      if(nread == sizeof(randseed))
+static CURLcode randit(struct Curl_easy *data, unsigned int *rnd,
+                       bool env_override)
+{
+#ifdef DEBUGBUILD
+  if(env_override) {
+    char *force_entropy = getenv("CURL_ENTROPY");
+    if(force_entropy) {
+      static unsigned int randseed;
+      static bool seeded = FALSE;
+
+      if(!seeded) {
+        unsigned int seed = 0;
+        size_t elen = strlen(force_entropy);
+        size_t clen = sizeof(seed);
+        size_t min = elen < clen ? elen : clen;
+        memcpy((char *)&seed, force_entropy, min);
+        randseed = ntohl(seed);
         seeded = TRUE;
-      close(fd);
+      }
+      else
+        randseed++;
+      *rnd = randseed;
+      return CURLE_OK;
     }
   }
+#else
+  (void)env_override;
 #endif
 
-  if(!seeded) {
-    struct curltime now = Curl_now();
-    infof(data, "WARNING: using weak random seed");
-    randseed += (unsigned int)now.tv_usec + (unsigned int)now.tv_sec;
-    randseed = randseed * 1103515245 + 12345;
-    randseed = randseed * 1103515245 + 12345;
-    randseed = randseed * 1103515245 + 12345;
-    seeded = TRUE;
-  }
-
-  /* Return an unsigned 32-bit pseudo-random number. */
-  r = randseed = randseed * 1103515245 + 12345;
-  *rnd = (r << 16) | ((r >> 16) & 0xFFFF);
-  return CURLE_OK;
+  /* data may be NULL! */
+#ifdef USE_SSL
+  return Curl_ssl_random(data, (unsigned char *)rnd, sizeof(*rnd));
+#else
+  return weak_random(data, (unsigned char *)rnd, sizeof(*rnd));
+#endif
 }
 
 /*
  * Curl_rand() stores 'num' number of random unsigned characters in the buffer
  * 'rnd' points to.
  *
- * If libcurl is built without TLS support or with a TLS backend that lacks a
- * proper random API (rustls or mbedTLS), this function will use "weak"
- * random.
+ * If libcurl is built without TLS support or arc4random, this function will
+ * use "weak" random.
  *
- * When built *with* TLS support and a backend that offers strong random, it
- * will return error if it cannot provide strong random values.
+ * When built *with* TLS support, it will return error if it cannot provide
+ * strong random values.
  *
  * NOTE: 'data' may be passed in as NULL when coming from external API without
  * easy handle!
  *
  */
 
-CURLcode Curl_rand(struct Curl_easy *data, unsigned char *rnd, size_t num)
+CURLcode Curl_rand_bytes(struct Curl_easy *data,
+#ifdef DEBUGBUILD
+                         bool env_override,
+#endif
+                         unsigned char *rnd, size_t num)
 {
   CURLcode result = CURLE_BAD_FUNCTION_ARGUMENT;
+#ifndef DEBUGBUILD
+  const bool env_override = FALSE;
+#endif
 
-  DEBUGASSERT(num > 0);
+  DEBUGASSERT(num);
 
   while(num) {
     unsigned int r;
     size_t left = num < sizeof(unsigned int) ? num : sizeof(unsigned int);
 
-    result = randit(data, &r);
+    result = randit(data, &r, env_override);
     if(result)
       return result;
 
@@ -226,42 +186,59 @@ CURLcode Curl_rand(struct Curl_easy *data, unsigned char *rnd, size_t num)
 
 /*
  * Curl_rand_hex() fills the 'rnd' buffer with a given 'num' size with random
- * hexadecimal digits PLUS a null-terminating byte. It must be an odd number
+ * hexadecimal digits PLUS a null-terminator byte. It must be an odd number
  * size.
  */
 
-CURLcode Curl_rand_hex(struct Curl_easy *data, unsigned char *rnd,
-                       size_t num)
+CURLcode Curl_rand_hex(struct Curl_easy *data, unsigned char *rnd, size_t num)
 {
   CURLcode result = CURLE_BAD_FUNCTION_ARGUMENT;
-  const char *hex = "0123456789abcdef";
   unsigned char buffer[128];
-  unsigned char *bufp = buffer;
   DEBUGASSERT(num > 1);
 
-#ifdef __clang_analyzer__
-  /* This silences a scan-build warning about accessing this buffer with
-     uninitialized memory. */
-  memset(buffer, 0, sizeof(buffer));
-#endif
-
-  if((num/2 >= sizeof(buffer)) || !(num&1))
+  if((num / 2 >= sizeof(buffer)) || !(num & 1)) {
     /* make sure it fits in the local buffer and that it is an odd number! */
+    DEBUGF(infof(data, "invalid buffer size with Curl_rand_hex"));
     return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
 
   num--; /* save one for null-termination */
 
-  result = Curl_rand(data, buffer, num/2);
+  result = Curl_rand(data, buffer, num / 2);
   if(result)
     return result;
 
+  Curl_hexencode(buffer, num / 2, rnd, num + 1);
+  return result;
+}
+
+/*
+ * Curl_rand_alnum() fills the 'rnd' buffer with a given 'num' size with random
+ * alphanumerical chars PLUS a null-terminator byte.
+ */
+
+static const char alnum[] =
+  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+
+CURLcode Curl_rand_alnum(struct Curl_easy *data, unsigned char *rnd,
+                         size_t num)
+{
+  CURLcode result = CURLE_OK;
+  const unsigned int alnumspace = sizeof(alnum) - 1;
+  unsigned int r;
+  DEBUGASSERT(num > 1);
+
+  num--; /* save one for null-termination */
+
   while(num) {
-    /* clang-tidy warns on this line without this comment: */
-    /* NOLINTNEXTLINE(clang-analyzer-core.UndefinedBinaryOperatorResult) */
-    *rnd++ = hex[(*bufp & 0xF0)>>4];
-    *rnd++ = hex[*bufp & 0x0F];
-    bufp++;
-    num -= 2;
+    do {
+      result = randit(data, &r, TRUE);
+      if(result)
+        return result;
+    } while(r >= (UINT_MAX - UINT_MAX % alnumspace));
+
+    *rnd++ = (unsigned char)alnum[r % alnumspace];
+    num--;
   }
   *rnd = 0;
 
diff --git a/third-party/curl/lib/rand.h b/third-party/curl/lib/rand.h
index 45ce3e7c4e..a02717074f 100644
--- a/third-party/curl/lib/rand.h
+++ b/third-party/curl/lib/rand.h
@@ -23,18 +23,33 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+CURLcode Curl_rand_bytes(struct Curl_easy *data,
+#ifdef DEBUGBUILD
+                         bool env_override,
+#endif
+                         unsigned char *rnd, size_t num);
 
-CURLcode Curl_rand(struct Curl_easy *data, unsigned char *rnd, size_t num);
+#ifdef DEBUGBUILD
+#define Curl_rand(a, b, c) Curl_rand_bytes(a, TRUE, b, c)
+#else
+#define Curl_rand(a, b, c) Curl_rand_bytes(a, b, c)
+#endif
 
 /*
  * Curl_rand_hex() fills the 'rnd' buffer with a given 'num' size with random
- * hexadecimal digits PLUS a null-terminating byte. It must be an odd number
+ * hexadecimal digits PLUS a null-terminator byte. It must be an odd number
  * size.
  */
-CURLcode Curl_rand_hex(struct Curl_easy *data, unsigned char *rnd,
-                       size_t num);
+CURLcode Curl_rand_hex(struct Curl_easy *data, unsigned char *rnd, size_t num);
 
-#ifdef WIN32
+/*
+ * Curl_rand_alnum() fills the 'rnd' buffer with a given 'num' size with random
+ * alphanumerical chars PLUS a null-terminator byte.
+ */
+CURLcode Curl_rand_alnum(struct Curl_easy *data, unsigned char *rnd,
+                         size_t num);
+
+#ifdef _WIN32
 /* Random generator shared between the Schannel vtls and Curl_rand*()
    functions */
 CURLcode Curl_win32_random(unsigned char *entropy, size_t length);
diff --git a/third-party/curl/lib/ratelimit.c b/third-party/curl/lib/ratelimit.c
new file mode 100644
index 0000000000..97af01c788
--- /dev/null
+++ b/third-party/curl/lib/ratelimit.c
@@ -0,0 +1,295 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "urldata.h"
+#include "ratelimit.h"
+
+#define CURL_US_PER_SEC         1000000
+#define CURL_RLIMIT_MIN_RATE    (4 * 1024)  /* minimum step rate */
+#define CURL_RLIMIT_STEP_MIN_MS 2  /* minimum step duration */
+
+static void rlimit_update(struct Curl_rlimit *r,
+                          const struct curltime *pts)
+{
+  timediff_t elapsed_us, elapsed_steps;
+  int64_t token_gain;
+
+  DEBUGASSERT(r->rate_per_step);
+  if((r->ts.tv_sec == pts->tv_sec) && (r->ts.tv_usec == pts->tv_usec))
+    return;
+
+  elapsed_us = curlx_ptimediff_us(pts, &r->ts);
+  if(elapsed_us < 0) { /* not going back in time */
+    DEBUGASSERT(0);
+    return;
+  }
+
+  elapsed_us += r->spare_us;
+  if(elapsed_us < r->step_us)
+    return;
+
+  /* we do the update */
+  r->ts = *pts;
+  elapsed_steps = elapsed_us / r->step_us;
+  r->spare_us = elapsed_us % r->step_us;
+
+  /* How many tokens did we gain since the last update? */
+  if(r->rate_per_step > (INT64_MAX / elapsed_steps))
+    token_gain = INT64_MAX;
+  else {
+    token_gain = r->rate_per_step * elapsed_steps;
+  }
+
+  if((INT64_MAX - token_gain) > r->tokens)
+    r->tokens += token_gain;
+  else
+    r->tokens = INT64_MAX;
+
+  /* Limit the token again by the burst rate (if set), so we
+   * do not suddenly have a huge number of tokens after inactivity. */
+  if(r->burst_per_step && (r->tokens > r->burst_per_step)) {
+    r->tokens = r->burst_per_step;
+  }
+}
+
+static void rlimit_tune_steps(struct Curl_rlimit *r,
+                              int64_t tokens_total)
+{
+  int64_t tokens_last, tokens_main, msteps;
+
+  /* Tune the ratelimit at the start *if* we know how many tokens
+   * are expected to be consumed in total.
+   * The reason for tuning is that rlimit provides tokens to be consumed
+   * per "step" which starts out to be a second. The tokens may be consumed
+   * in full at the beginning of a step. The remainder of the second will
+   * have no tokens available, effectively blocking the consumption and
+   * so keeping the "step average" in line.
+   * This works will up to the last step. When no more tokens are needed,
+   * no wait will happen and the last step would be too fast. This is
+   * especially noticeable when only a few steps are needed.
+   *
+   * Example: downloading 1.5kb with a ratelimit of 1k could be done in
+   * roughly 1 second (1k in the first second and the 0.5 at the start of
+   * the second one).
+   *
+   * The tuning tries to make the last step small, using only
+   * 1 percent of the total tokens (at least 1). The rest of the tokens
+   * are to be consumed in the steps before by adjusting the duration of
+   * the step and the amount of tokens it provides. */
+  if(!r->rate_per_step ||
+     (tokens_total <= 1) ||
+     (tokens_total > (INT64_MAX / 1000)))
+    return;
+
+  /* Calculate tokens for the last step and the ones before. */
+  tokens_last = tokens_total / 100;
+  if(!tokens_last) /* less than 100 total, use 1 */
+    tokens_last = 1;
+  else if(tokens_last > CURL_RLIMIT_MIN_RATE)
+    tokens_last = CURL_RLIMIT_MIN_RATE;
+  DEBUGASSERT(tokens_last);
+  tokens_main = tokens_total - tokens_last;
+  DEBUGASSERT(tokens_main);
+
+  /* how many milli-steps will it take to consume those, give the
+  * original rate limit per second? */
+  DEBUGASSERT(r->step_us == CURL_US_PER_SEC);
+
+  msteps = (tokens_main * 1000 / r->rate_per_step);
+  if(msteps < CURL_RLIMIT_STEP_MIN_MS) {
+    /* Steps this small will not work. Do not tune. */
+    return;
+  }
+  else if(msteps < 1000) {
+    /* It needs less than one step to provide the needed tokens.
+     * Make it exactly that long and with exactly those tokens. */
+    r->step_us = (timediff_t)msteps * 1000;
+    r->rate_per_step = tokens_main;
+    r->tokens = r->rate_per_step;
+  }
+  else {
+    /* More than 1 step. Spread the remainder milli steps and
+     * the tokens they need to provide across all steps. If integer
+     * arithmetic can do it. */
+    curl_off_t ms_unaccounted = (msteps % 1000);
+    curl_off_t mstep_inc = (ms_unaccounted / (msteps / 1000));
+    if(mstep_inc) {
+      curl_off_t rate_inc = ((r->rate_per_step * mstep_inc) / 1000);
+      if(rate_inc) {
+        r->step_us = CURL_US_PER_SEC + ((timediff_t)mstep_inc * 1000);
+        r->rate_per_step += rate_inc;
+        r->tokens = r->rate_per_step;
+        if(r->burst_per_step) {
+          curl_off_t burst_inc = ((r->burst_per_step * mstep_inc) / 1000);
+          if(burst_inc)
+            r->burst_per_step += burst_inc;
+        }
+      }
+    }
+  }
+}
+
+void Curl_rlimit_init(struct Curl_rlimit *r,
+                      int64_t rate_per_sec,
+                      int64_t burst_per_sec,
+                      const struct curltime *pts)
+{
+  DEBUGASSERT(rate_per_sec >= 0);
+  DEBUGASSERT(burst_per_sec >= rate_per_sec || !burst_per_sec);
+  DEBUGASSERT(pts);
+  r->rate_per_step = r->rate_per_sec = rate_per_sec;
+  r->burst_per_step = r->burst_per_sec = burst_per_sec;
+  r->step_us = CURL_US_PER_SEC;
+  r->spare_us = 0;
+  r->tokens = r->rate_per_step;
+  r->ts = *pts;
+  r->blocked = FALSE;
+}
+
+void Curl_rlimit_start(struct Curl_rlimit *r, const struct curltime *pts,
+                       int64_t total_tokens)
+{
+  /* A start always resets the values to initial defaults, then
+   * fine tunes the intervals for the total_tokens expected. */
+  r->rate_per_step = r->rate_per_sec;
+  r->burst_per_step = r->burst_per_sec;
+  r->step_us = CURL_US_PER_SEC;
+  r->spare_us = 0;
+  r->tokens = r->rate_per_step;
+  r->ts = *pts;
+  rlimit_tune_steps(r, total_tokens);
+}
+
+int64_t Curl_rlimit_per_step(struct Curl_rlimit *r)
+{
+  return r->rate_per_step;
+}
+
+bool Curl_rlimit_active(struct Curl_rlimit *r)
+{
+  return (r->rate_per_step > 0) || r->blocked;
+}
+
+bool Curl_rlimit_is_blocked(struct Curl_rlimit *r)
+{
+  return (bool)r->blocked;
+}
+
+int64_t Curl_rlimit_avail(struct Curl_rlimit *r,
+                          const struct curltime *pts)
+{
+  if(r->blocked)
+    return 0;
+  else if(r->rate_per_step) {
+    rlimit_update(r, pts);
+    return r->tokens;
+  }
+  else
+    return INT64_MAX;
+}
+
+void Curl_rlimit_drain(struct Curl_rlimit *r,
+                       size_t tokens,
+                       const struct curltime *pts)
+{
+  if(r->blocked || !r->rate_per_step)
+    return;
+
+  rlimit_update(r, pts);
+#if 8 <= SIZEOF_SIZE_T
+  if(tokens > INT64_MAX) {
+    r->tokens = INT64_MAX;
+  }
+  else
+#endif
+  {
+    int64_t val = (int64_t)tokens;
+    if((INT64_MIN + val) < r->tokens)
+      r->tokens -= val;
+    else
+      r->tokens = INT64_MIN;
+  }
+}
+
+timediff_t Curl_rlimit_wait_ms(struct Curl_rlimit *r,
+                               const struct curltime *pts)
+{
+  timediff_t wait_us, elapsed_us;
+
+  if(r->blocked || !r->rate_per_step)
+    return 0;
+  rlimit_update(r, pts);
+  if(r->tokens > 0)
+    return 0;
+
+  /* How much time will it take tokens to become positive again?
+   * Deduct `spare_us` and check against already elapsed time */
+  wait_us = r->step_us - r->spare_us;
+  if(r->tokens < 0) {
+    curl_off_t debt_pct = ((-r->tokens) * 100 / r->rate_per_step);
+    if(debt_pct)
+      wait_us += (r->step_us * debt_pct / 100);
+  }
+
+  elapsed_us = curlx_ptimediff_us(pts, &r->ts);
+  if(elapsed_us >= wait_us)
+    return 0;
+  wait_us -= elapsed_us;
+  return (wait_us + 999) / 1000; /* in milliseconds */
+}
+
+timediff_t Curl_rlimit_next_step_ms(struct Curl_rlimit *r,
+                                    const struct curltime *pts)
+{
+  if(!r->blocked && r->rate_per_step) {
+    timediff_t elapsed_us, next_us;
+
+    elapsed_us = curlx_ptimediff_us(pts, &r->ts) + r->spare_us;
+    if(r->step_us > elapsed_us) {
+      next_us = r->step_us - elapsed_us;
+      return (next_us + 999) / 1000; /* in milliseconds */
+    }
+  }
+  return 0;
+}
+
+void Curl_rlimit_block(struct Curl_rlimit *r,
+                       bool activate,
+                       const struct curltime *pts)
+{
+  if(!activate == !r->blocked)
+    return;
+
+  r->ts = *pts;
+  r->blocked = activate;
+  if(!r->blocked) {
+    /* Start rate limiting fresh. The amount of time this was blocked
+     * does not generate extra tokens. */
+    Curl_rlimit_start(r, pts, -1);
+  }
+  else {
+    r->tokens = 0;
+  }
+}
diff --git a/third-party/curl/lib/ratelimit.h b/third-party/curl/lib/ratelimit.h
new file mode 100644
index 0000000000..3c3e38b895
--- /dev/null
+++ b/third-party/curl/lib/ratelimit.h
@@ -0,0 +1,108 @@
+#ifndef HEADER_CURL_RLIMIT_H
+#define HEADER_CURL_RLIMIT_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curlx/timeval.h"
+
+struct Curl_easy;
+
+/* This is a rate limiter that provides "tokens" to be consumed
+ * per second. In the literature, this is referred to as a
+ * "token bucket" (https://en.wikipedia.org/wiki/Token_bucket).
+ * Example:
+ * A rate limit of 1 megabyte per second.
+ * - initially 1 million tokens are available.
+ * - these are drained in the first second.
+ * - checking available tokens before the 2nd second will return 0.
+ * - at/after the 2nd second, 1 million tokens are available again.
+ * - nothing happens for a second, the 1 million tokens would grow
+ *   to 2 million, however the burst limit caps those at 1.5 million.
+ * Thus:
+ * - setting "burst" to CURL_OFF_T_MAX would average tokens over the
+ *   complete lifetime. E.g. for a download, at the *end* of it, the
+ *   average rate from start to finish would be the rate limit.
+ * - setting "burst" to the same value as "rate" would make a
+ *   download always try to stay *at/below* the rate and slow times will
+ *   not generate extra tokens.
+ *
+ * A rate limit can be blocked, causing the available tokens to become
+ * always 0 until unblocked. After unblocking, the rate limiting starts
+ * again with no history of the past.
+ *
+ * Finally, a rate limiter with rate 0 will always have CURL_OFF_T_MAX
+ * tokens available, unless blocked.
+ */
+
+struct Curl_rlimit {
+  int64_t rate_per_sec; /* rate tokens generated per second */
+  int64_t burst_per_sec; /* burst rate of tokens per second */
+  int64_t rate_per_step; /* rate tokens generated per step us */
+  int64_t burst_per_step; /* burst rate of tokens per step us */
+  timediff_t step_us;     /* microseconds between token increases */
+  int64_t tokens;         /* tokens available in the next second */
+  timediff_t spare_us;    /* microseconds unaffecting tokens */
+  struct curltime ts;     /* time of the last update */
+  BIT(blocked);           /* blocking sets available tokens to 0 */
+};
+
+void Curl_rlimit_init(struct Curl_rlimit *r,
+                      int64_t rate_per_sec,
+                      int64_t burst_per_sec,
+                      const struct curltime *pts);
+
+/* Start ratelimiting with the given timestamp. Resets available tokens.
+ * `total_tokens` is either -1 or the number of total tokens expected
+ * to be consumed. */
+void Curl_rlimit_start(struct Curl_rlimit *r, const struct curltime *pts,
+                       int64_t total_tokens);
+
+/* How many milliseconds to wait until token are available again. */
+timediff_t Curl_rlimit_wait_ms(struct Curl_rlimit *r,
+                               const struct curltime *pts);
+
+/* When the rate limit will update its tokens again */
+timediff_t Curl_rlimit_next_step_ms(struct Curl_rlimit *r,
+                                    const struct curltime *pts);
+
+/* Return if rate limiting of tokens is active */
+bool Curl_rlimit_active(struct Curl_rlimit *r);
+bool Curl_rlimit_is_blocked(struct Curl_rlimit *r);
+int64_t Curl_rlimit_per_step(struct Curl_rlimit *r);
+
+/* Return how many tokens are available to spend, may be negative */
+int64_t Curl_rlimit_avail(struct Curl_rlimit *r,
+                          const struct curltime *pts);
+
+/* Drain tokens from the ratelimit, give an estimate of how many tokens
+ * remain to be drained in the future (-1 for unknown). */
+void Curl_rlimit_drain(struct Curl_rlimit *r,
+                       size_t tokens,
+                       const struct curltime *pts);
+
+/* Block/unblock ratelimiting. A blocked ratelimit has 0 tokens available. */
+void Curl_rlimit_block(struct Curl_rlimit *r,
+                       bool activate,
+                       const struct curltime *pts);
+
+#endif /* HEADER_CURL_RLIMIT_H */
diff --git a/third-party/curl/lib/rename.c b/third-party/curl/lib/rename.c
deleted file mode 100644
index 97a66e947e..0000000000
--- a/third-party/curl/lib/rename.c
+++ /dev/null
@@ -1,73 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "rename.h"
-
-#include "curl_setup.h"
-
-#if (!defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_COOKIES)) || \
-  !defined(CURL_DISABLE_ALTSVC)
-
-#include "curl_multibyte.h"
-#include "timeval.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-/* return 0 on success, 1 on error */
-int Curl_rename(const char *oldpath, const char *newpath)
-{
-#ifdef WIN32
-  /* rename() on Windows doesn't overwrite, so we can't use it here.
-     MoveFileEx() will overwrite and is usually atomic, however it fails
-     when there are open handles to the file. */
-  const int max_wait_ms = 1000;
-  struct curltime start = Curl_now();
-  TCHAR *tchar_oldpath = curlx_convert_UTF8_to_tchar((char *)oldpath);
-  TCHAR *tchar_newpath = curlx_convert_UTF8_to_tchar((char *)newpath);
-  for(;;) {
-    timediff_t diff;
-    if(MoveFileEx(tchar_oldpath, tchar_newpath, MOVEFILE_REPLACE_EXISTING)) {
-      curlx_unicodefree(tchar_oldpath);
-      curlx_unicodefree(tchar_newpath);
-      break;
-    }
-    diff = Curl_timediff(Curl_now(), start);
-    if(diff < 0 || diff > max_wait_ms) {
-      curlx_unicodefree(tchar_oldpath);
-      curlx_unicodefree(tchar_newpath);
-      return 1;
-    }
-    Sleep(1);
-  }
-#else
-  if(rename(oldpath, newpath))
-    return 1;
-#endif
-  return 0;
-}
-
-#endif
diff --git a/third-party/curl/lib/rename.h b/third-party/curl/lib/rename.h
deleted file mode 100644
index 04440820c5..0000000000
--- a/third-party/curl/lib/rename.h
+++ /dev/null
@@ -1,29 +0,0 @@
-#ifndef HEADER_CURL_RENAME_H
-#define HEADER_CURL_RENAME_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-int Curl_rename(const char *oldpath, const char *newpath);
-
-#endif /* HEADER_CURL_RENAME_H */
diff --git a/third-party/curl/lib/request.c b/third-party/curl/lib/request.c
new file mode 100644
index 0000000000..56dd2c4a15
--- /dev/null
+++ b/third-party/curl/lib/request.c
@@ -0,0 +1,503 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "urldata.h"
+#include "cfilters.h"
+#include "curlx/dynbuf.h"
+#include "doh.h"
+#include "progress.h"
+#include "request.h"
+#include "sendf.h"
+#include "curl_trc.h"
+#include "transfer.h"
+#include "url.h"
+#include "curlx/strparse.h"
+
+void Curl_req_init(struct SingleRequest *req)
+{
+  memset(req, 0, sizeof(*req));
+}
+
+CURLcode Curl_req_soft_reset(struct SingleRequest *req,
+                             struct Curl_easy *data)
+{
+  CURLcode result;
+
+  req->done = FALSE;
+  req->upload_done = FALSE;
+  req->upload_aborted = FALSE;
+  req->download_done = FALSE;
+  req->eos_written = FALSE;
+  req->eos_read = FALSE;
+  req->eos_sent = FALSE;
+  req->ignorebody = FALSE;
+  req->shutdown = FALSE;
+  req->bytecount = 0;
+  req->writebytecount = 0;
+  req->header = FALSE;
+  req->headerline = 0;
+  req->headerbytecount = 0;
+  req->allheadercount = 0;
+  req->deductheadercount = 0;
+  req->httpversion_sent = 0;
+  req->httpversion = 0;
+  req->sendbuf_hds_len = 0;
+
+  curlx_safefree(req->hd_auth);
+#ifndef CURL_DISABLE_PROXY
+  curlx_safefree(req->hd_proxy_auth);
+#endif
+
+  result = Curl_client_start(data);
+  if(result)
+    return result;
+
+  if(!req->sendbuf_init) {
+    Curl_bufq_init2(&req->sendbuf, data->set.upload_buffer_size, 1,
+                    BUFQ_OPT_SOFT_LIMIT);
+    req->sendbuf_init = TRUE;
+  }
+  else {
+    Curl_bufq_reset(&req->sendbuf);
+    if(data->set.upload_buffer_size != req->sendbuf.chunk_size) {
+      Curl_bufq_free(&req->sendbuf);
+      Curl_bufq_init2(&req->sendbuf, data->set.upload_buffer_size, 1,
+                      BUFQ_OPT_SOFT_LIMIT);
+    }
+  }
+
+  return CURLE_OK;
+}
+
+CURLcode Curl_req_start(struct SingleRequest *req,
+                        struct Curl_easy *data)
+{
+  req->start = *Curl_pgrs_now(data);
+  return Curl_req_soft_reset(req, data);
+}
+
+static CURLcode req_flush(struct Curl_easy *data);
+
+CURLcode Curl_req_done(struct SingleRequest *req,
+                       struct Curl_easy *data, bool aborted)
+{
+  (void)req;
+  if(!aborted)
+    (void)req_flush(data);
+  Curl_client_reset(data);
+  return CURLE_OK;
+}
+
+void Curl_req_hard_reset(struct SingleRequest *req, struct Curl_easy *data)
+{
+  struct curltime t0 = { 0, 0 };
+
+  curlx_safefree(req->newurl);
+  curlx_safefree(req->hd_auth);
+#ifndef CURL_DISABLE_PROXY
+  curlx_safefree(req->hd_proxy_auth);
+#endif
+#ifndef CURL_DISABLE_COOKIES
+  curlx_safefree(req->cookiehost);
+#endif
+  Curl_client_reset(data);
+  if(req->sendbuf_init)
+    Curl_bufq_reset(&req->sendbuf);
+
+  /* clear any resolve data */
+  Curl_resolv_destroy_all(data);
+  /* Can no longer memset() this struct as we need to keep some state */
+  req->size = -1;
+  req->maxdownload = -1;
+  req->bytecount = 0;
+  req->writebytecount = 0;
+  req->start = t0;
+  req->headerbytecount = 0;
+  req->allheadercount = 0;
+  req->deductheadercount = 0;
+  req->headerline = 0;
+  req->offset = 0;
+  req->httpcode = 0;
+  req->io_flags = 0;
+  req->upgr101 = UPGR101_NONE;
+  req->sendbuf_hds_len = 0;
+  req->timeofdoc = 0;
+  req->location = NULL;
+  req->newurl = NULL;
+#ifndef CURL_DISABLE_COOKIES
+  req->setcookies = 0;
+#endif
+  req->header = FALSE;
+  req->content_range = FALSE;
+  req->download_done = FALSE;
+  req->eos_written = FALSE;
+  req->eos_read = FALSE;
+  req->eos_sent = FALSE;
+  req->rewind_read = FALSE;
+  req->upload_done = FALSE;
+  req->upload_aborted = FALSE;
+  req->ignorebody = FALSE;
+  req->http_bodyless = FALSE;
+  req->chunk = FALSE;
+  req->resp_trailer = FALSE;
+  req->ignore_cl = FALSE;
+  req->upload_chunky = FALSE;
+  req->no_body = data->set.opt_no_body;
+  req->authneg = FALSE;
+  req->shutdown = FALSE;
+  /* Unpause all directions */
+  Curl_rlimit_block(&data->progress.dl.rlimit, FALSE, &t0);
+  Curl_rlimit_block(&data->progress.ul.rlimit, FALSE, &t0);
+}
+
+void Curl_req_free(struct SingleRequest *req, struct Curl_easy *data)
+{
+  curlx_safefree(req->newurl);
+  curlx_safefree(req->hd_auth);
+#ifndef CURL_DISABLE_PROXY
+  curlx_safefree(req->hd_proxy_auth);
+#endif
+  if(req->sendbuf_init)
+    Curl_bufq_free(&req->sendbuf);
+  Curl_client_cleanup(data);
+}
+
+static CURLcode xfer_send(struct Curl_easy *data,
+                          const char *buf, size_t blen,
+                          size_t hds_len, size_t *pnwritten)
+{
+  CURLcode result = CURLE_OK;
+  bool eos = FALSE;
+
+  *pnwritten = 0;
+  DEBUGASSERT(hds_len <= blen);
+#ifdef DEBUGBUILD
+  {
+    /* Allow debug builds to override this logic to force short initial
+       sends */
+    size_t body_len = blen - hds_len;
+    if(body_len) {
+      const char *p = getenv("CURL_SMALLREQSEND");
+      if(p) {
+        curl_off_t body_small;
+        if(!curlx_str_number(&p, &body_small, body_len))
+          blen = hds_len + (size_t)body_small;
+      }
+    }
+  }
+#endif
+  /* Make sure this does not send more body bytes than what the max send
+     speed says. The headers do not count to the max speed. */
+  if(data->set.max_send_speed) {
+    size_t body_bytes = blen - hds_len;
+    if((curl_off_t)body_bytes > data->set.max_send_speed)
+      blen = hds_len + (size_t)data->set.max_send_speed;
+  }
+
+  if(data->req.eos_read &&
+    (Curl_bufq_is_empty(&data->req.sendbuf) ||
+     Curl_bufq_len(&data->req.sendbuf) == blen)) {
+    DEBUGF(infof(data, "sending last upload chunk of %zu bytes", blen));
+    eos = TRUE;
+  }
+  result = Curl_xfer_send(data, buf, blen, eos, pnwritten);
+  if(!result) {
+    if(eos && (blen == *pnwritten))
+      data->req.eos_sent = TRUE;
+    if(*pnwritten) {
+      if(hds_len)
+        Curl_debug(data, CURLINFO_HEADER_OUT, buf,
+                   CURLMIN(hds_len, *pnwritten));
+      if(*pnwritten > hds_len) {
+        size_t body_len = *pnwritten - hds_len;
+        Curl_debug(data, CURLINFO_DATA_OUT, buf + hds_len, body_len);
+        data->req.writebytecount += body_len;
+        Curl_pgrs_upload_inc(data, body_len);
+      }
+    }
+  }
+  return result;
+}
+
+static CURLcode req_send_buffer_flush(struct Curl_easy *data)
+{
+  CURLcode result = CURLE_OK;
+  const unsigned char *buf;
+  size_t blen;
+
+  while(Curl_bufq_peek(&data->req.sendbuf, &buf, &blen)) {
+    size_t nwritten, hds_len = CURLMIN(data->req.sendbuf_hds_len, blen);
+    result = xfer_send(data, (const char *)buf, blen, hds_len, &nwritten);
+    if(result)
+      break;
+
+    Curl_bufq_skip(&data->req.sendbuf, nwritten);
+    if(hds_len) {
+      data->req.sendbuf_hds_len -= CURLMIN(hds_len, nwritten);
+    }
+    /* leave if we could not send all. Maybe network blocking or
+     * speed limits on transfer */
+    if(nwritten < blen)
+      break;
+  }
+  return result;
+}
+
+static CURLcode req_set_upload_done(struct Curl_easy *data)
+{
+  DEBUGASSERT(!data->req.upload_done);
+  data->req.upload_done = TRUE;
+  CURL_REQ_CLEAR_SEND(data);
+
+  if(data->mstate >= MSTATE_DID)
+    Curl_pgrsTime(data, TIMER_POSTRANSFER);
+  Curl_creader_done(data, data->req.upload_aborted);
+
+  if(data->req.upload_aborted) {
+    Curl_bufq_reset(&data->req.sendbuf);
+    if(data->req.writebytecount)
+      infof(data, "abort upload after having sent %" FMT_OFF_T " bytes",
+            data->req.writebytecount);
+    else
+      infof(data, "abort upload");
+  }
+  else if(data->req.writebytecount)
+    infof(data, "upload completely sent off: %" FMT_OFF_T " bytes",
+          data->req.writebytecount);
+  else if(!data->req.download_done) {
+    DEBUGASSERT(Curl_bufq_is_empty(&data->req.sendbuf));
+    infof(data, Curl_creader_total_length(data) ?
+          "We are completely uploaded and fine" :
+          "Request completely sent off");
+  }
+
+  return Curl_xfer_send_close(data);
+}
+
+static CURLcode req_flush(struct Curl_easy *data)
+{
+  CURLcode result;
+
+  if(!data || !data->conn)
+    return CURLE_FAILED_INIT;
+
+  if(!Curl_bufq_is_empty(&data->req.sendbuf)) {
+    result = req_send_buffer_flush(data);
+    if(result)
+      return result;
+    if(!Curl_bufq_is_empty(&data->req.sendbuf)) {
+      DEBUGF(infof(data, "Curl_req_flush(len=%zu) -> EAGAIN",
+                   Curl_bufq_len(&data->req.sendbuf)));
+      return CURLE_AGAIN;
+    }
+  }
+  else if(Curl_xfer_needs_flush(data)) {
+    DEBUGF(infof(data, "Curl_req_flush(), xfer send_pending"));
+    return Curl_xfer_flush(data);
+  }
+
+  if(data->req.eos_read && !data->req.eos_sent) {
+    char tmp = 0;
+    size_t nwritten;
+    result = xfer_send(data, &tmp, 0, 0, &nwritten);
+    if(result)
+      return result;
+    DEBUGASSERT(data->req.eos_sent);
+  }
+
+  if(!data->req.upload_done && data->req.eos_read && data->req.eos_sent) {
+    DEBUGASSERT(Curl_bufq_is_empty(&data->req.sendbuf));
+    if(data->req.shutdown) {
+      bool done;
+      result = Curl_xfer_send_shutdown(data, &done);
+      if(result && data->req.shutdown_err_ignore) {
+        infof(data, "Shutdown send direction error: %d. Broken server? "
+              "Proceeding as if everything is ok.", (int)result);
+        result = CURLE_OK;
+        done = TRUE;
+      }
+
+      if(result)
+        return result;
+      if(!done)
+        return CURLE_AGAIN;
+    }
+    return req_set_upload_done(data);
+  }
+  return CURLE_OK;
+}
+
+static CURLcode add_from_client(void *reader_ctx,
+                                unsigned char *buf, size_t buflen,
+                                size_t *pnread)
+{
+  struct Curl_easy *data = reader_ctx;
+  CURLcode result;
+  bool eos;
+
+  result = Curl_client_read(data, (char *)buf, buflen, pnread, &eos);
+  if(!result && eos)
+    data->req.eos_read = TRUE;
+  return result;
+}
+
+static CURLcode req_send_buffer_add(struct Curl_easy *data,
+                                    const char *buf, size_t blen,
+                                    size_t hds_len)
+{
+  CURLcode result = CURLE_OK;
+  size_t n;
+  result = Curl_bufq_cwrite(&data->req.sendbuf, buf, blen, &n);
+  if(result)
+    return result;
+  /* We rely on a SOFTLIMIT on sendbuf, so it can take all data in */
+  DEBUGASSERT(n == blen);
+  data->req.sendbuf_hds_len += hds_len;
+  return CURLE_OK;
+}
+
+CURLcode Curl_req_send(struct Curl_easy *data, struct dynbuf *req,
+                       unsigned char httpversion)
+{
+  CURLcode result;
+  const char *buf;
+  size_t blen, nwritten;
+
+  if(!data || !data->conn)
+    return CURLE_FAILED_INIT;
+
+  data->req.httpversion_sent = httpversion;
+  buf = curlx_dyn_ptr(req);
+  blen = curlx_dyn_len(req);
+  /* if the sendbuf is empty and the request without body and
+   * the length to send fits info a sendbuf chunk, we send it directly.
+   * If `blen` is larger than `chunk_size`, we can not. Because we
+   * might have to retry a blocked send later from sendbuf and that
+   * would result in retry sends with a shrunken length. That is trouble. */
+  if(Curl_bufq_is_empty(&data->req.sendbuf) &&
+     !Curl_creader_total_length(data) &&
+     (blen <= data->req.sendbuf.chunk_size)) {
+    data->req.eos_read = TRUE;
+    result = xfer_send(data, buf, blen, blen, &nwritten);
+    if(result)
+      return result;
+    buf += nwritten;
+    blen -= nwritten;
+    if(!blen) {
+      result = req_set_upload_done(data);
+      if(result)
+        return result;
+    }
+  }
+
+  if(blen) {
+    /* Either we have a request body, or we could not send the complete
+     * request in one go. Buffer the remainder and try to add as much
+     * body bytes as room is left in the buffer. Then flush. */
+    result = req_send_buffer_add(data, buf, blen, blen);
+    if(result)
+      return result;
+
+    return Curl_req_send_more(data);
+  }
+  return CURLE_OK;
+}
+
+bool Curl_req_sendbuf_empty(struct Curl_easy *data)
+{
+  return !data->req.sendbuf_init || Curl_bufq_is_empty(&data->req.sendbuf);
+}
+
+bool Curl_req_want_send(struct Curl_easy *data)
+{
+  /* Not done and upload not blocked and either one of
+   * - REQ_IO_SEND
+   * - request has buffered data to send
+   * - connection has pending data to send */
+  return !data->req.done &&
+         !Curl_rlimit_is_blocked(&data->progress.ul.rlimit) &&
+         (CURL_REQ_WANT_SEND(data) ||
+          !Curl_req_sendbuf_empty(data) ||
+          Curl_xfer_needs_flush(data));
+}
+
+bool Curl_req_want_recv(struct Curl_easy *data)
+{
+  /* Not done and download not blocked and want RECV */
+  return !data->req.done &&
+         !Curl_rlimit_is_blocked(&data->progress.dl.rlimit) &&
+         CURL_REQ_WANT_RECV(data);
+}
+
+bool Curl_req_done_sending(struct Curl_easy *data)
+{
+  return data->req.upload_done && !Curl_req_want_send(data);
+}
+
+CURLcode Curl_req_send_more(struct Curl_easy *data)
+{
+  CURLcode result;
+
+  /* Fill our send buffer if more from client can be read. */
+  if(!data->req.upload_aborted &&
+     !data->req.eos_read &&
+     !Curl_xfer_send_is_paused(data) &&
+     !Curl_bufq_is_full(&data->req.sendbuf)) {
+    size_t nread;
+    result = Curl_bufq_sipn(&data->req.sendbuf, 0,
+                            add_from_client, data, &nread);
+    if(result && result != CURLE_AGAIN)
+      return result;
+  }
+
+  result = req_flush(data);
+  if(result == CURLE_AGAIN)
+    result = CURLE_OK;
+
+  return result;
+}
+
+CURLcode Curl_req_abort_sending(struct Curl_easy *data)
+{
+  if(!data->req.upload_done) {
+    Curl_bufq_reset(&data->req.sendbuf);
+    data->req.upload_aborted = TRUE;
+    CURL_REQ_CLEAR_SEND(data);
+    return req_set_upload_done(data);
+  }
+  return CURLE_OK;
+}
+
+CURLcode Curl_req_stop_send_recv(struct Curl_easy *data)
+{
+  /* stop receiving and ALL sending as well, including PAUSE and HOLD.
+   * We might still be paused on receive client writes though, so
+   * keep those bits around. */
+  CURLcode result = CURLE_OK;
+  if(CURL_REQ_WANT_SEND(data))
+    result = Curl_req_abort_sending(data);
+  CURL_REQ_CLEAR_IO(data);
+  return result;
+}
diff --git a/third-party/curl/lib/request.h b/third-party/curl/lib/request.h
new file mode 100644
index 0000000000..e67865a984
--- /dev/null
+++ b/third-party/curl/lib/request.h
@@ -0,0 +1,251 @@
+#ifndef HEADER_CURL_REQUEST_H
+#define HEADER_CURL_REQUEST_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/* This file is for lib internal stuff */
+#include "curl_setup.h"
+
+#include "bufq.h"
+
+/* forward declarations */
+struct UserDefined;
+
+/* Bits on the io_flags member of SingleRequest */
+#define REQ_IO_RECV       (1 << 0) /* there is or may be data to read */
+#define REQ_IO_SEND       (1 << 1) /* there is or may be data to write */
+
+/* Low level request receive/send io_flags checks. */
+#define CURL_REQ_WANT_SEND(d)  ((d)->req.io_flags & REQ_IO_SEND)
+#define CURL_REQ_WANT_RECV(d)  ((d)->req.io_flags & REQ_IO_RECV)
+#define CURL_REQ_WANT_IO(d)    \
+  ((d)->req.io_flags & (REQ_IO_RECV | REQ_IO_SEND))
+/* Low level request receive/send io_flags manipulations. */
+#define CURL_REQ_SET_SEND(d)   ((d)->req.io_flags |= REQ_IO_SEND)
+#define CURL_REQ_SET_RECV(d)   ((d)->req.io_flags |= REQ_IO_RECV)
+#define CURL_REQ_CLEAR_SEND(d) \
+  ((d)->req.io_flags &= (uint8_t)~REQ_IO_SEND)
+#define CURL_REQ_CLEAR_RECV(d) \
+  ((d)->req.io_flags &= (uint8_t)~REQ_IO_RECV)
+#define CURL_REQ_CLEAR_IO(d)  \
+  ((d)->req.io_flags &= (uint8_t)~(REQ_IO_RECV | REQ_IO_SEND))
+
+enum expect100 {
+  EXP100_SEND_DATA,           /* enough waiting, send the body now */
+  EXP100_AWAITING_CONTINUE,   /* waiting for the 100 Continue header */
+  EXP100_SENDING_REQUEST,     /* still sending the request but will wait for
+                                 the 100 header once done with the request */
+  EXP100_FAILED               /* used on 417 Expectation Failed */
+};
+
+enum upgrade101 {
+  UPGR101_NONE,               /* default state */
+  UPGR101_WS,                 /* upgrade to WebSocket requested */
+  UPGR101_H2,                 /* upgrade to HTTP/2 requested */
+  UPGR101_RECEIVED            /* 101 response received */
+};
+
+/*
+ * Request specific data in the easy handle (Curl_easy). Previously,
+ * these members were on the connectdata struct but since a conn struct may
+ * now be shared between different Curl_easys, we store connection-specific
+ * data here. This struct only keeps stuff that is interesting for *this*
+ * request, as it will be cleared between multiple ones
+ */
+struct SingleRequest {
+  curl_off_t size;        /* -1 if unknown at this point */
+  curl_off_t maxdownload; /* in bytes, the maximum amount of data to fetch,
+                             -1 means unlimited */
+  curl_off_t bytecount;         /* total number of bytes read */
+  curl_off_t writebytecount;    /* number of bytes written */
+  curl_off_t offset;            /* possible resume offset read from the
+                                   Content-Range: header */
+
+  struct curltime start;         /* transfer started at this time */
+  unsigned int headerbytecount;  /* received server headers (not CONNECT
+                                    headers) */
+  unsigned int allheadercount;   /* all received headers (server + CONNECT) */
+  unsigned int deductheadercount; /* this amount of bytes does not count when
+                                     we check if anything has been transferred
+                                     at the end of a connection. We use this
+                                     counter to make only a 100 reply (without
+                                     a following second response code) result
+                                     in a CURLE_GOT_NOTHING error code */
+  int headerline;               /* counts header lines to better track the
+                                   first one */
+  int httpcode;                 /* error code from the 'HTTP/1.? XXX' or
+                                   'RTSP/1.? XXX' line */
+  unsigned char httpversion_sent; /* Version in request (09, 10, 11, etc.) */
+  unsigned char httpversion;    /* Version in response (09, 10, 11, etc.) */
+  enum upgrade101 upgr101;      /* 101 upgrade state */
+
+  /* Client Writer stack, handles transfer- and content-encodings, protocol
+   * checks, pausing by client callbacks. */
+  struct Curl_cwriter *writer_stack;
+  /* Client Reader stack, handles transfer- and content-encodings, protocol
+   * checks, pausing by client callbacks. */
+  struct Curl_creader *reader_stack;
+  struct bufq sendbuf; /* data which needs to be send to the server */
+  size_t sendbuf_hds_len; /* amount of header bytes in sendbuf */
+  time_t timeofdoc;
+  char *location;   /* This points to an allocated version of the Location:
+                       header data */
+  char *newurl;     /* Set to the new URL to use when a redirect or a retry is
+                       wanted */
+  uint8_t io_flags; /* REQ_IO_RECV | REQ_IO_SEND */
+
+  char *hd_auth;      /* Authorization header, full HTTP/1.x line */
+#ifndef CURL_DISABLE_PROXY
+  char *hd_proxy_auth; /* Proxy-Authorization header, full HTTP/1.x line */
+#endif
+#ifndef CURL_DISABLE_COOKIES
+  char *cookiehost;
+#endif
+#ifndef CURL_DISABLE_COOKIES
+  unsigned char setcookies;
+#endif
+  BIT(header);        /* incoming data has HTTP header */
+  BIT(done);          /* request is done, e.g. no more send/recv should
+                       * happen. This can be TRUE before `upload_done` or
+                       * `download_done` is TRUE. */
+  BIT(content_range); /* set TRUE if Content-Range: was found */
+  BIT(download_done); /* set to TRUE when download is complete */
+  BIT(eos_written);   /* iff EOS has been written to client */
+  BIT(eos_read);      /* iff EOS has been read from the client */
+  BIT(eos_sent);      /* iff EOS has been sent to the server */
+  BIT(rewind_read);   /* iff reader needs rewind at next start */
+  BIT(upload_done);   /* set to TRUE when all request data has been sent */
+  BIT(upload_aborted); /* set to TRUE when upload was aborted. Also
+                        * shows `upload_done` as TRUE. */
+  BIT(ignorebody);    /* we read a response-body but we ignore it! */
+  BIT(http_bodyless); /* HTTP response status code is between 100 and 199,
+                         204 or 304 */
+  BIT(chunk);         /* if set, this is a chunked transfer-encoding */
+  BIT(resp_trailer);  /* response carried 'Trailer:' header field */
+  BIT(ignore_cl);     /* ignore content-length */
+  BIT(upload_chunky); /* set TRUE if we are doing chunked transfer-encoding
+                         on upload */
+  BIT(no_body);      /* the response has no body */
+  BIT(authneg);      /* TRUE when the auth phase has started, which means
+                        that we are creating a request with an auth header,
+                        but it is not the final request in the auth
+                        negotiation. */
+  BIT(sendbuf_init); /* sendbuf is initialized */
+  BIT(shutdown);     /* request end will shutdown connection */
+  BIT(shutdown_err_ignore); /* errors in shutdown will not fail request */
+  BIT(reader_started); /* client reads have started */
+};
+
+/**
+ * Initialize the state of the request for first use.
+ */
+void Curl_req_init(struct SingleRequest *req);
+
+/**
+ * The request is about to start. Record time and do a soft reset.
+ */
+CURLcode Curl_req_start(struct SingleRequest *req,
+                        struct Curl_easy *data);
+
+/**
+ * The request may continue with a follow up. Reset
+ * members, but keep start time for overall duration calc.
+ */
+CURLcode Curl_req_soft_reset(struct SingleRequest *req,
+                             struct Curl_easy *data);
+
+/**
+ * The request is done. If not aborted, make sure that buffers are
+ * flushed to the client.
+ * @param req        the request
+ * @param data       the transfer
+ * @param aborted    TRUE iff the request was aborted/errored
+ */
+CURLcode Curl_req_done(struct SingleRequest *req,
+                       struct Curl_easy *data, bool aborted);
+
+/**
+ * Free the state of the request, not usable afterwards.
+ */
+void Curl_req_free(struct SingleRequest *req, struct Curl_easy *data);
+
+/**
+ * Hard reset the state of the request to virgin state base on
+ * transfer settings.
+ */
+void Curl_req_hard_reset(struct SingleRequest *req, struct Curl_easy *data);
+
+/**
+ * Send request headers. If not all could be sent
+ * they will be buffered. Use `Curl_req_flush()` to make sure
+ * bytes are really send.
+ * @param data      the transfer making the request
+ * @param req       the complete header bytes, no body
+ * @param httpversion version used in request (09, 10, 11, etc.)
+ * @return CURLE_OK (on blocking with *pnwritten == 0) or error.
+ */
+CURLcode Curl_req_send(struct Curl_easy *data, struct dynbuf *req,
+                       unsigned char httpversion);
+
+/**
+ * TRUE iff the request has sent all request headers and data.
+ */
+bool Curl_req_done_sending(struct Curl_easy *data);
+
+/*
+ * Read more from client and flush all buffered request bytes.
+ * @return CURLE_OK on success or the error on the sending.
+ *         Never returns CURLE_AGAIN.
+ */
+CURLcode Curl_req_send_more(struct Curl_easy *data);
+
+/* TRUE if the request wants to send, e.g. is not done sending
+ * and is not blocked. */
+bool Curl_req_want_send(struct Curl_easy *data);
+
+/* TRUE if the request wants to receive and is not blocked. */
+bool Curl_req_want_recv(struct Curl_easy *data);
+
+/**
+ * TRUE iff the request has no buffered bytes yet to send.
+ */
+bool Curl_req_sendbuf_empty(struct Curl_easy *data);
+
+/**
+ * Stop sending any more request data to the server.
+ * Clear the send buffer and mark request sending as done.
+ */
+CURLcode Curl_req_abort_sending(struct Curl_easy *data);
+
+/**
+ * Stop sending and receiving any more request data.
+ * Abort sending if not done.
+ */
+CURLcode Curl_req_stop_send_recv(struct Curl_easy *data);
+
+/**
+ * Invoked when all request data has been uploaded.
+ */
+CURLcode Curl_req_set_upload_done(struct Curl_easy *data);
+
+#endif /* HEADER_CURL_REQUEST_H */
diff --git a/third-party/curl/lib/rtsp.c b/third-party/curl/lib/rtsp.c
index ccd7264b00..8c5cdd5643 100644
--- a/third-party/curl/lib/rtsp.c
+++ b/third-party/curl/lib/rtsp.c
@@ -21,146 +21,127 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
-
-#if !defined(CURL_DISABLE_RTSP) && !defined(USE_HYPER)
-
 #include "urldata.h"
-#include <curl/curl.h>
+#include "rtsp.h"
+
+#ifndef CURL_DISABLE_RTSP
+
 #include "transfer.h"
 #include "sendf.h"
+#include "curl_trc.h"
 #include "multiif.h"
 #include "http.h"
 #include "url.h"
 #include "progress.h"
-#include "rtsp.h"
 #include "strcase.h"
 #include "select.h"
 #include "connect.h"
 #include "cfilters.h"
-#include "strdup.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curlx/strdup.h"
+#include "bufref.h"
+#include "curlx/strparse.h"
 
-#define RTP_PKT_LENGTH(p)  ((((int)((unsigned char)((p)[2]))) << 8) | \
-                             ((int)((unsigned char)((p)[3]))))
+/* meta key for storing protocol meta at easy handle */
+#define CURL_META_RTSP_EASY   "meta:proto:rtsp:easy"
+/* meta key for storing protocol meta at connection */
+#define CURL_META_RTSP_CONN   "meta:proto:rtsp:conn"
 
-/* protocol-specific functions set up to be called by the main engine */
-static CURLcode rtsp_do(struct Curl_easy *data, bool *done);
-static CURLcode rtsp_done(struct Curl_easy *data, CURLcode, bool premature);
-static CURLcode rtsp_connect(struct Curl_easy *data, bool *done);
-static CURLcode rtsp_disconnect(struct Curl_easy *data,
-                                struct connectdata *conn, bool dead);
-static int rtsp_getsock_do(struct Curl_easy *data,
-                           struct connectdata *conn, curl_socket_t *socks);
+typedef enum {
+  RTP_PARSE_SKIP,
+  RTP_PARSE_CHANNEL,
+  RTP_PARSE_LEN,
+  RTP_PARSE_DATA
+} rtp_parse_st;
 
-/*
- * Parse and write out any available RTP data.
- *
- * nread: amount of data left after k->str. will be modified if RTP
- *        data is parsed and k->str is moved up
- * readmore: whether or not the RTP parser needs more data right away
- */
-static CURLcode rtsp_rtp_readwrite(struct Curl_easy *data,
-                                   struct connectdata *conn,
-                                   ssize_t *nread,
-                                   bool *readmore);
-
-static CURLcode rtsp_setup_connection(struct Curl_easy *data,
-                                      struct connectdata *conn);
-static unsigned int rtsp_conncheck(struct Curl_easy *data,
-                                   struct connectdata *check,
-                                   unsigned int checks_to_perform);
-
-/* this returns the socket to wait for in the DO and DOING state for the multi
-   interface and then we're always _sending_ a request and thus we wait for
-   the single socket to become writable only */
-static int rtsp_getsock_do(struct Curl_easy *data, struct connectdata *conn,
-                           curl_socket_t *socks)
-{
-  /* write mode */
-  (void)data;
-  socks[0] = conn->sock[FIRSTSOCKET];
-  return GETSOCK_WRITESOCK(0);
-}
-
-static
-CURLcode rtp_client_write(struct Curl_easy *data, char *ptr, size_t len);
-static
-CURLcode rtsp_parse_transport(struct Curl_easy *data, char *transport);
-
-
-/*
- * RTSP handler interface.
- */
-const struct Curl_handler Curl_handler_rtsp = {
-  "RTSP",                               /* scheme */
-  rtsp_setup_connection,                /* setup_connection */
-  rtsp_do,                              /* do_it */
-  rtsp_done,                            /* done */
-  ZERO_NULL,                            /* do_more */
-  rtsp_connect,                         /* connect_it */
-  ZERO_NULL,                            /* connecting */
-  ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  rtsp_getsock_do,                      /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  rtsp_disconnect,                      /* disconnect */
-  rtsp_rtp_readwrite,                   /* readwrite */
-  rtsp_conncheck,                       /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_RTSP,                            /* defport */
-  CURLPROTO_RTSP,                       /* protocol */
-  CURLPROTO_RTSP,                       /* family */
-  PROTOPT_NONE                          /* flags */
+/* RTSP Connection data
+ * Currently, only used for tracking incomplete RTP data reads */
+struct rtsp_conn {
+  struct dynbuf buf;
+  int rtp_channel;
+  size_t rtp_len;
+  rtp_parse_st state;
+  BIT(in_header);
 };
 
+/* RTSP transfer data */
+struct RTSP {
+  uint32_t CSeq_sent; /* CSeq of this request */
+  uint32_t CSeq_recv; /* CSeq received */
+};
+
+#define RTP_PKT_LENGTH(p) ((((unsigned int)((unsigned char)((p)[2]))) << 8) | \
+                            ((unsigned int)((unsigned char)((p)[3]))))
+
+/* this returns the socket to wait for in the DO and DOING state for the multi
+   interface and then we are always _sending_ a request and thus we wait for
+   the single socket to become writable only */
+static CURLcode rtsp_do_pollset(struct Curl_easy *data,
+                                struct easy_pollset *ps)
+{
+  /* write mode */
+  return Curl_pollset_add_out(data, ps, data->conn->sock[FIRSTSOCKET]);
+}
+
 #define MAX_RTP_BUFFERSIZE 1000000 /* arbitrary */
 
+static void rtsp_easy_dtor(void *key, size_t klen, void *entry)
+{
+  struct RTSP *rtsp = entry;
+  (void)key;
+  (void)klen;
+  curlx_free(rtsp);
+}
+
+static void rtsp_conn_dtor(void *key, size_t klen, void *entry)
+{
+  struct rtsp_conn *rtspc = entry;
+  (void)key;
+  (void)klen;
+  curlx_dyn_free(&rtspc->buf);
+  curlx_free(rtspc);
+}
+
 static CURLcode rtsp_setup_connection(struct Curl_easy *data,
                                       struct connectdata *conn)
 {
+  struct rtsp_conn *rtspc;
   struct RTSP *rtsp;
-  (void)conn;
 
-  data->req.p.rtsp = rtsp = calloc(1, sizeof(struct RTSP));
-  if(!rtsp)
+  rtspc = curlx_calloc(1, sizeof(*rtspc));
+  if(!rtspc)
+    return CURLE_OUT_OF_MEMORY;
+  curlx_dyn_init(&rtspc->buf, MAX_RTP_BUFFERSIZE);
+  if(Curl_conn_meta_set(conn, CURL_META_RTSP_CONN, rtspc, rtsp_conn_dtor))
+    return CURLE_OUT_OF_MEMORY;
+
+  rtsp = curlx_calloc(1, sizeof(struct RTSP));
+  if(!rtsp ||
+     Curl_meta_set(data, CURL_META_RTSP_EASY, rtsp, rtsp_easy_dtor))
     return CURLE_OUT_OF_MEMORY;
 
-  Curl_dyn_init(&conn->proto.rtspc.buf, MAX_RTP_BUFFERSIZE);
   return CURLE_OK;
 }
 
-
 /*
  * Function to check on various aspects of a connection.
  */
-static unsigned int rtsp_conncheck(struct Curl_easy *data,
-                                   struct connectdata *conn,
-                                   unsigned int checks_to_perform)
+static bool rtsp_conn_is_dead(struct Curl_easy *data,
+                              struct connectdata *conn)
 {
-  unsigned int ret_val = CONNRESULT_NONE;
-  (void)data;
-
-  if(checks_to_perform & CONNCHECK_ISDEAD) {
-    bool input_pending;
-    if(!Curl_conn_is_alive(data, conn, &input_pending))
-      ret_val |= CONNRESULT_DEAD;
-  }
-
-  return ret_val;
+  bool input_pending;
+  /* Contrary to default handling, this protocol allows pending
+   * input on an unused connection. */
+  return !Curl_conn_is_alive(data, conn, &input_pending);
 }
 
-
 static CURLcode rtsp_connect(struct Curl_easy *data, bool *done)
 {
-  CURLcode httpStatus;
+  struct rtsp_conn *rtspc =
+    Curl_conn_meta_get(data->conn, CURL_META_RTSP_CONN);
 
-  httpStatus = Curl_http_connect(data, done);
+  if(!rtspc)
+    return CURLE_FAILED_INIT;
 
   /* Initialize the CSeq if not already done */
   if(data->state.rtsp_next_client_CSeq == 0)
@@ -168,62 +149,136 @@ static CURLcode rtsp_connect(struct Curl_easy *data, bool *done)
   if(data->state.rtsp_next_server_CSeq == 0)
     data->state.rtsp_next_server_CSeq = 1;
 
-  data->conn->proto.rtspc.rtp_channel = -1;
-
-  return httpStatus;
-}
-
-static CURLcode rtsp_disconnect(struct Curl_easy *data,
-                                struct connectdata *conn, bool dead)
-{
-  (void) dead;
-  (void) data;
-  Curl_dyn_free(&conn->proto.rtspc.buf);
+  rtspc->rtp_channel = -1;
+  *done = TRUE;
   return CURLE_OK;
 }
 
-
 static CURLcode rtsp_done(struct Curl_easy *data,
                           CURLcode status, bool premature)
 {
-  struct RTSP *rtsp = data->req.p.rtsp;
-  CURLcode httpStatus;
+  struct rtsp_conn *rtspc =
+    Curl_conn_meta_get(data->conn, CURL_META_RTSP_CONN);
+  struct RTSP *rtsp = Curl_meta_get(data, CURL_META_RTSP_EASY);
+  CURLcode result;
+
+  if(!rtspc || !rtsp)
+    return CURLE_FAILED_INIT;
 
   /* Bypass HTTP empty-reply checks on receive */
   if(data->set.rtspreq == RTSPREQ_RECEIVE)
     premature = TRUE;
 
-  httpStatus = Curl_http_done(data, status, premature);
+  result = Curl_http_done(data, status, premature);
 
-  if(rtsp && !status && !httpStatus) {
+  if(!status && !result) {
     /* Check the sequence numbers */
-    long CSeq_sent = rtsp->CSeq_sent;
-    long CSeq_recv = rtsp->CSeq_recv;
+    uint32_t CSeq_sent = rtsp->CSeq_sent;
+    uint32_t CSeq_recv = rtsp->CSeq_recv;
     if((data->set.rtspreq != RTSPREQ_RECEIVE) && (CSeq_sent != CSeq_recv)) {
       failf(data,
-            "The CSeq of this request %ld did not match the response %ld",
+            "The CSeq of this request %u did not match the response %u",
             CSeq_sent, CSeq_recv);
       return CURLE_RTSP_CSEQ_ERROR;
     }
+    if(data->set.rtspreq == RTSPREQ_RECEIVE && (rtspc->rtp_channel == -1)) {
+      infof(data, "Got an RTP Receive with a CSeq of %u", CSeq_recv);
+    }
     if(data->set.rtspreq == RTSPREQ_RECEIVE &&
-       (data->conn->proto.rtspc.rtp_channel == -1)) {
-      infof(data, "Got an RTP Receive with a CSeq of %ld", CSeq_recv);
+       data->req.eos_written) {
+      failf(data, "Server prematurely closed the RTSP connection.");
+      return CURLE_RECV_ERROR;
     }
   }
 
-  return httpStatus;
+  return result;
+}
+
+static CURLcode rtsp_setup_body(struct Curl_easy *data,
+                                Curl_RtspReq rtspreq,
+                                struct dynbuf *reqp)
+{
+  CURLcode result;
+  if(rtspreq == RTSPREQ_ANNOUNCE ||
+     rtspreq == RTSPREQ_SET_PARAMETER ||
+     rtspreq == RTSPREQ_GET_PARAMETER) {
+    curl_off_t req_clen; /* request content length */
+
+    if(data->state.upload) {
+      req_clen = data->state.infilesize;
+      data->state.httpreq = HTTPREQ_PUT;
+      result = Curl_creader_set_fread(data, req_clen);
+      if(result)
+        return result;
+    }
+    else {
+      if(data->set.postfields) {
+        size_t plen = (data->set.postfieldsize >= 0) ?
+          (size_t)data->set.postfieldsize : strlen(data->set.postfields);
+        req_clen = (curl_off_t)plen;
+        result = Curl_creader_set_buf(data, data->set.postfields, plen);
+      }
+      else if(data->state.infilesize >= 0) {
+        req_clen = data->state.infilesize;
+        result = Curl_creader_set_fread(data, req_clen);
+      }
+      else {
+        req_clen = 0;
+        result = Curl_creader_set_null(data);
+      }
+      if(result)
+        return result;
+    }
+
+    if(req_clen > 0) {
+      /* As stated in the http comments, it is probably not wise to
+       * actually set a custom Content-Length in the headers */
+      if(!Curl_checkheaders(data, STRCONST("Content-Length"))) {
+        result = curlx_dyn_addf(reqp, "Content-Length: %" FMT_OFF_T "\r\n",
+                                req_clen);
+        if(result)
+          return result;
+      }
+
+      if(rtspreq == RTSPREQ_SET_PARAMETER ||
+         rtspreq == RTSPREQ_GET_PARAMETER) {
+        if(!Curl_checkheaders(data, STRCONST("Content-Type"))) {
+          result = curlx_dyn_addn(reqp, STRCONST("Content-Type: "
+                                                 "text/parameters\r\n"));
+          if(result)
+            return result;
+        }
+      }
+
+      if(rtspreq == RTSPREQ_ANNOUNCE) {
+        if(!Curl_checkheaders(data, STRCONST("Content-Type"))) {
+          result = curlx_dyn_addn(reqp, STRCONST("Content-Type: "
+                                                 "application/sdp\r\n"));
+          if(result)
+            return result;
+        }
+      }
+    }
+    else if(rtspreq == RTSPREQ_GET_PARAMETER) {
+      /* Check for an empty GET_PARAMETER (heartbeat) request */
+      data->state.httpreq = HTTPREQ_HEAD;
+      data->req.no_body = TRUE;
+    }
+  }
+  else
+    result = Curl_creader_set_null(data);
+  return result;
 }
 
 static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
 {
   struct connectdata *conn = data->conn;
   CURLcode result = CURLE_OK;
-  Curl_RtspReq rtspreq = data->set.rtspreq;
-  struct RTSP *rtsp = data->req.p.rtsp;
+  const Curl_RtspReq rtspreq = data->set.rtspreq;
+  struct RTSP *rtsp = Curl_meta_get(data, CURL_META_RTSP_EASY);
   struct dynbuf req_buffer;
-  curl_off_t postsize = 0; /* for ANNOUNCE and SET_PARAMETER */
-  curl_off_t putsize = 0; /* for ANNOUNCE and SET_PARAMETER */
-
+  const unsigned char httpversion = 11; /* RTSP is close to HTTP/1.1, sort
+                                           of... */
   const char *p_request = NULL;
   const char *p_session_id = NULL;
   const char *p_accept = NULL;
@@ -233,31 +288,24 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
   const char *p_stream_uri = NULL;
   const char *p_transport = NULL;
   const char *p_uagent = NULL;
-  const char *p_proxyuserpwd = NULL;
-  const char *p_userpwd = NULL;
+  const char *p_hd_proxy_auth = NULL;
+  const char *p_hd_auth = NULL;
 
   *done = TRUE;
+  if(!rtsp)
+    return CURLE_FAILED_INIT;
+
+  /* Initialize a dynamic send buffer */
+  curlx_dyn_init(&req_buffer, DYN_RTSP_REQ_HEADER);
 
   rtsp->CSeq_sent = data->state.rtsp_next_client_CSeq;
   rtsp->CSeq_recv = 0;
 
-  /* Setup the first_* fields to allow auth details get sent
-     to this origin */
-
-  if(!data->state.first_host) {
-    data->state.first_host = strdup(conn->host.name);
-    if(!data->state.first_host)
-      return CURLE_OUT_OF_MEMORY;
-
-    data->state.first_remote_port = conn->remote_port;
-    data->state.first_remote_protocol = conn->handler->protocol;
-  }
-
   /* Setup the 'p_request' pointer to the proper p_request string
    * Since all RTSP requests are included here, there is no need to
    * support custom requests like HTTP.
    **/
-  data->req.no_body = TRUE; /* most requests don't contain a body */
+  data->req.no_body = TRUE; /* most requests do not contain a body */
   switch(rtspreq) {
   default:
     failf(data, "Got invalid RTSP request");
@@ -306,17 +354,19 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
   }
 
   if(rtspreq == RTSPREQ_RECEIVE) {
-    Curl_setup_transfer(data, FIRSTSOCKET, -1, TRUE, -1);
-
-    return result;
+    Curl_xfer_setup_recv(data, FIRSTSOCKET, -1);
+    goto out;
   }
 
   p_session_id = data->set.str[STRING_RTSP_SESSION_ID];
   if(!p_session_id &&
-     (rtspreq & ~(RTSPREQ_OPTIONS | RTSPREQ_DESCRIBE | RTSPREQ_SETUP))) {
+     (rtspreq & ~(Curl_RtspReq)(RTSPREQ_OPTIONS |
+                                RTSPREQ_DESCRIBE |
+                                RTSPREQ_SETUP))) {
     failf(data, "Refusing to issue an RTSP request [%s] without a session ID.",
           p_request);
-    return CURLE_BAD_FUNCTION_ARGUMENT;
+    result = CURLE_BAD_FUNCTION_ARGUMENT;
+    goto out;
   }
 
   /* Stream URI. Default to server '*' if not specified */
@@ -332,18 +382,18 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
   if(rtspreq == RTSPREQ_SETUP && !p_transport) {
     /* New Transport: setting? */
     if(data->set.str[STRING_RTSP_TRANSPORT]) {
-      Curl_safefree(data->state.aptr.rtsp_transport);
-
+      curlx_free(data->state.aptr.rtsp_transport);
       data->state.aptr.rtsp_transport =
-        aprintf("Transport: %s\r\n",
-                data->set.str[STRING_RTSP_TRANSPORT]);
+        curl_maprintf("Transport: %s\r\n",
+                      data->set.str[STRING_RTSP_TRANSPORT]);
       if(!data->state.aptr.rtsp_transport)
         return CURLE_OUT_OF_MEMORY;
     }
     else {
       failf(data,
             "Refusing to issue an RTSP SETUP without a Transport: header.");
-      return CURLE_BAD_FUNCTION_ARGUMENT;
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+      goto out;
     }
 
     p_transport = data->state.aptr.rtsp_transport;
@@ -352,30 +402,32 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
   /* Accept Headers for DESCRIBE requests */
   if(rtspreq == RTSPREQ_DESCRIBE) {
     /* Accept Header */
-    p_accept = Curl_checkheaders(data, STRCONST("Accept"))?
-      NULL:"Accept: application/sdp\r\n";
+    p_accept = Curl_checkheaders(data, STRCONST("Accept")) ?
+      NULL : "Accept: application/sdp\r\n";
 
     /* Accept-Encoding header */
     if(!Curl_checkheaders(data, STRCONST("Accept-Encoding")) &&
        data->set.str[STRING_ENCODING]) {
-      Curl_safefree(data->state.aptr.accept_encoding);
+      curlx_free(data->state.aptr.accept_encoding);
       data->state.aptr.accept_encoding =
-        aprintf("Accept-Encoding: %s\r\n", data->set.str[STRING_ENCODING]);
-
-      if(!data->state.aptr.accept_encoding)
-        return CURLE_OUT_OF_MEMORY;
+        curl_maprintf("Accept-Encoding: %s\r\n",
+                      data->set.str[STRING_ENCODING]);
 
+      if(!data->state.aptr.accept_encoding) {
+        result = CURLE_OUT_OF_MEMORY;
+        goto out;
+      }
       p_accept_encoding = data->state.aptr.accept_encoding;
     }
   }
 
-  /* The User-Agent string might have been allocated in url.c already, because
+  /* The User-Agent string might have been allocated already, because
      it might have been used in the proxy connect, but if we have got a header
      with the user-agent string specified, we erase the previously made string
      here. */
   if(Curl_checkheaders(data, STRCONST("User-Agent")) &&
      data->state.aptr.uagent) {
-    Curl_safefree(data->state.aptr.uagent);
+    curlx_safefree(data->state.aptr.uagent);
   }
   else if(!Curl_checkheaders(data, STRCONST("User-Agent")) &&
           data->set.str[STRING_USERAGENT]) {
@@ -384,17 +436,21 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
 
   /* setup the authentication headers */
   result = Curl_http_output_auth(data, conn, p_request, HTTPREQ_GET,
-                                 p_stream_uri, FALSE);
+                                 p_stream_uri, NULL, FALSE);
   if(result)
-    return result;
+    goto out;
 
-  p_proxyuserpwd = data->state.aptr.proxyuserpwd;
-  p_userpwd = data->state.aptr.userpwd;
+#ifndef CURL_DISABLE_PROXY
+  p_hd_proxy_auth = data->req.hd_proxy_auth;
+#endif
+  p_hd_auth = data->req.hd_auth;
 
   /* Referrer */
-  Curl_safefree(data->state.aptr.ref);
-  if(data->state.referer && !Curl_checkheaders(data, STRCONST("Referer")))
-    data->state.aptr.ref = aprintf("Referer: %s\r\n", data->state.referer);
+  curlx_safefree(data->state.aptr.ref);
+  if(Curl_bufref_ptr(&data->state.referer) &&
+     !Curl_checkheaders(data, STRCONST("Referer")))
+    data->state.aptr.ref =
+      curl_maprintf("Referer: %s\r\n", Curl_bufref_ptr(&data->state.referer));
 
   p_referrer = data->state.aptr.ref;
 
@@ -405,12 +461,13 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
    * Go ahead and use the Range stuff supplied for HTTP
    */
   if(data->state.use_range &&
-     (rtspreq  & (RTSPREQ_PLAY | RTSPREQ_PAUSE | RTSPREQ_RECORD))) {
+     (rtspreq & (RTSPREQ_PLAY | RTSPREQ_PAUSE | RTSPREQ_RECORD))) {
 
     /* Check to see if there is a range set in the custom headers */
     if(!Curl_checkheaders(data, STRCONST("Range")) && data->state.range) {
-      Curl_safefree(data->state.aptr.rangeline);
-      data->state.aptr.rangeline = aprintf("Range: %s\r\n", data->state.range);
+      curlx_free(data->state.aptr.rangeline);
+      data->state.aptr.rangeline = curl_maprintf("Range: %s\r\n",
+                                                 data->state.range);
       p_range = data->state.aptr.rangeline;
     }
   }
@@ -420,157 +477,86 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
    */
   if(Curl_checkheaders(data, STRCONST("CSeq"))) {
     failf(data, "CSeq cannot be set as a custom header.");
-    return CURLE_RTSP_CSEQ_ERROR;
+    result = CURLE_RTSP_CSEQ_ERROR;
+    goto out;
   }
   if(Curl_checkheaders(data, STRCONST("Session"))) {
     failf(data, "Session ID cannot be set as a custom header.");
-    return CURLE_BAD_FUNCTION_ARGUMENT;
+    result = CURLE_BAD_FUNCTION_ARGUMENT;
+    goto out;
   }
 
-  /* Initialize a dynamic send buffer */
-  Curl_dyn_init(&req_buffer, DYN_RTSP_REQ_HEADER);
-
   result =
-    Curl_dyn_addf(&req_buffer,
-                  "%s %s RTSP/1.0\r\n" /* Request Stream-URI RTSP/1.0 */
-                  "CSeq: %ld\r\n", /* CSeq */
-                  p_request, p_stream_uri, rtsp->CSeq_sent);
+    curlx_dyn_addf(&req_buffer,
+                   "%s %s RTSP/1.0\r\n" /* Request Stream-URI RTSP/1.0 */
+                   "CSeq: %u\r\n", /* CSeq */
+                   p_request, p_stream_uri, rtsp->CSeq_sent);
   if(result)
-    return result;
+    goto out;
 
   /*
    * Rather than do a normal alloc line, keep the session_id unformatted
    * to make comparison easier
    */
   if(p_session_id) {
-    result = Curl_dyn_addf(&req_buffer, "Session: %s\r\n", p_session_id);
+    result = curlx_dyn_addf(&req_buffer, "Session: %s\r\n", p_session_id);
     if(result)
-      return result;
+      goto out;
   }
 
   /*
    * Shared HTTP-like options
    */
-  result = Curl_dyn_addf(&req_buffer,
-                         "%s" /* transport */
-                         "%s" /* accept */
-                         "%s" /* accept-encoding */
-                         "%s" /* range */
-                         "%s" /* referrer */
-                         "%s" /* user-agent */
-                         "%s" /* proxyuserpwd */
-                         "%s" /* userpwd */
-                         ,
-                         p_transport ? p_transport : "",
-                         p_accept ? p_accept : "",
-                         p_accept_encoding ? p_accept_encoding : "",
-                         p_range ? p_range : "",
-                         p_referrer ? p_referrer : "",
-                         p_uagent ? p_uagent : "",
-                         p_proxyuserpwd ? p_proxyuserpwd : "",
-                         p_userpwd ? p_userpwd : "");
-
-  /*
-   * Free userpwd now --- cannot reuse this for Negotiate and possibly NTLM
-   * with basic and digest, it will be freed anyway by the next request
-   */
-  Curl_safefree(data->state.aptr.userpwd);
+  result = curlx_dyn_addf(&req_buffer,
+                          "%s" /* transport */
+                          "%s" /* accept */
+                          "%s" /* accept-encoding */
+                          "%s" /* range */
+                          "%s" /* referrer */
+                          "%s" /* user-agent */
+                          "%s" /* hd_proxy_auth */
+                          "%s" /* hd_auth */
+                          ,
+                          p_transport ? p_transport : "",
+                          p_accept ? p_accept : "",
+                          p_accept_encoding ? p_accept_encoding : "",
+                          p_range ? p_range : "",
+                          p_referrer ? p_referrer : "",
+                          p_uagent ? p_uagent : "",
+                          p_hd_proxy_auth ? p_hd_proxy_auth : "",
+                          p_hd_auth ? p_hd_auth : "");
 
   if(result)
-    return result;
+    goto out;
 
   if((rtspreq == RTSPREQ_SETUP) || (rtspreq == RTSPREQ_DESCRIBE)) {
     result = Curl_add_timecondition(data, &req_buffer);
     if(result)
-      return result;
+      goto out;
   }
 
-  result = Curl_add_custom_headers(data, FALSE, &req_buffer);
+  result = Curl_add_custom_headers(data, FALSE, httpversion, &req_buffer);
   if(result)
-    return result;
+    goto out;
 
-  if(rtspreq == RTSPREQ_ANNOUNCE ||
-     rtspreq == RTSPREQ_SET_PARAMETER ||
-     rtspreq == RTSPREQ_GET_PARAMETER) {
+  result = rtsp_setup_body(data, rtspreq, &req_buffer);
+  if(result)
+    goto out;
 
-    if(data->state.upload) {
-      putsize = data->state.infilesize;
-      data->state.httpreq = HTTPREQ_PUT;
-
-    }
-    else {
-      postsize = (data->state.infilesize != -1)?
-        data->state.infilesize:
-        (data->set.postfields? (curl_off_t)strlen(data->set.postfields):0);
-      data->state.httpreq = HTTPREQ_POST;
-    }
-
-    if(putsize > 0 || postsize > 0) {
-      /* As stated in the http comments, it is probably not wise to
-       * actually set a custom Content-Length in the headers */
-      if(!Curl_checkheaders(data, STRCONST("Content-Length"))) {
-        result =
-          Curl_dyn_addf(&req_buffer,
-                        "Content-Length: %" CURL_FORMAT_CURL_OFF_T"\r\n",
-                        (data->state.upload ? putsize : postsize));
-        if(result)
-          return result;
-      }
-
-      if(rtspreq == RTSPREQ_SET_PARAMETER ||
-         rtspreq == RTSPREQ_GET_PARAMETER) {
-        if(!Curl_checkheaders(data, STRCONST("Content-Type"))) {
-          result = Curl_dyn_addn(&req_buffer,
-                                 STRCONST("Content-Type: "
-                                          "text/parameters\r\n"));
-          if(result)
-            return result;
-        }
-      }
-
-      if(rtspreq == RTSPREQ_ANNOUNCE) {
-        if(!Curl_checkheaders(data, STRCONST("Content-Type"))) {
-          result = Curl_dyn_addn(&req_buffer,
-                                 STRCONST("Content-Type: "
-                                          "application/sdp\r\n"));
-          if(result)
-            return result;
-        }
-      }
-
-      data->state.expect100header = FALSE; /* RTSP posts are simple/small */
-    }
-    else if(rtspreq == RTSPREQ_GET_PARAMETER) {
-      /* Check for an empty GET_PARAMETER (heartbeat) request */
-      data->state.httpreq = HTTPREQ_HEAD;
-      data->req.no_body = TRUE;
-    }
-  }
-
-  /* RTSP never allows chunked transfer */
-  data->req.forbidchunk = TRUE;
   /* Finish the request buffer */
-  result = Curl_dyn_addn(&req_buffer, STRCONST("\r\n"));
+  result = curlx_dyn_addn(&req_buffer, STRCONST("\r\n"));
   if(result)
-    return result;
+    goto out;
 
-  if(postsize > 0) {
-    result = Curl_dyn_addn(&req_buffer, data->set.postfields,
-                           (size_t)postsize);
-    if(result)
-      return result;
-  }
+  Curl_xfer_setup_sendrecv(data, FIRSTSOCKET, -1);
 
   /* issue the request */
-  result = Curl_buffer_send(&req_buffer, data, data->req.p.http,
-                            &data->info.request_size, 0, FIRSTSOCKET);
+  result = Curl_req_send(data, &req_buffer, httpversion);
   if(result) {
     failf(data, "Failed sending RTSP request");
-    return result;
+    goto out;
   }
 
-  Curl_setup_transfer(data, FIRSTSOCKET, -1, TRUE, putsize?FIRSTSOCKET:-1);
-
   /* Increment the CSeq on success */
   data->state.rtsp_next_client_CSeq++;
 
@@ -578,160 +564,39 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
     /* if a request-body has been sent off, we make sure this progress is
        noted properly */
     Curl_pgrsSetUploadCounter(data, data->req.writebytecount);
-    if(Curl_pgrsUpdate(data))
-      result = CURLE_ABORTED_BY_CALLBACK;
+    result = Curl_pgrsUpdate(data);
   }
-
+out:
+  curlx_dyn_free(&req_buffer);
   return result;
 }
 
+/**
+ * write any BODY bytes missing to the client, ignore the rest.
+ */
+static CURLcode rtp_write_body_junk(struct Curl_easy *data,
+                                    struct rtsp_conn *rtspc,
+                                    const char *buf,
+                                    size_t blen)
+{
+  curl_off_t body_remain;
+  bool in_body;
 
-static CURLcode rtsp_rtp_readwrite(struct Curl_easy *data,
-                                   struct connectdata *conn,
-                                   ssize_t *nread,
-                                   bool *readmore) {
-  struct SingleRequest *k = &data->req;
-  struct rtsp_conn *rtspc = &(conn->proto.rtspc);
-  unsigned char *rtp_channel_mask = data->state.rtp_channel_mask;
-
-  char *rtp; /* moving pointer to rtp data */
-  ssize_t rtp_dataleft; /* how much data left to parse in this round */
-  CURLcode result;
-  bool interleaved = false;
-  size_t skip_size = 0;
-
-  if(Curl_dyn_len(&rtspc->buf)) {
-    /* There was some leftover data the last time. Append new buffers */
-    if(Curl_dyn_addn(&rtspc->buf, k->str, *nread))
-      return CURLE_OUT_OF_MEMORY;
-    rtp = Curl_dyn_ptr(&rtspc->buf);
-    rtp_dataleft = Curl_dyn_len(&rtspc->buf);
+  in_body = (data->req.headerline && !rtspc->in_header) &&
+            (data->req.size >= 0) &&
+            (data->req.bytecount < data->req.size);
+  body_remain = in_body ? (data->req.size - data->req.bytecount) : 0;
+  DEBUGASSERT(body_remain >= 0);
+  if(body_remain) {
+    if((curl_off_t)blen > body_remain)
+      blen = (size_t)body_remain;
+    return Curl_client_write(data, CLIENTWRITE_BODY, buf, blen);
   }
-  else {
-    /* Just parse the request buffer directly */
-    rtp = k->str;
-    rtp_dataleft = *nread;
-  }
-
-  while(rtp_dataleft > 0) {
-    if(rtp[0] == '$') {
-      if(rtp_dataleft > 4) {
-        unsigned char rtp_channel;
-        int rtp_length;
-        int idx;
-        int off;
-
-        /* Parse the header */
-        /* The channel identifier immediately follows and is 1 byte */
-        rtp_channel = (unsigned char)rtp[1];
-        idx = rtp_channel / 8;
-        off = rtp_channel % 8;
-        if(!(rtp_channel_mask[idx] & (1 << off))) {
-          /* invalid channel number, maybe not an RTP packet */
-          rtp++;
-          rtp_dataleft--;
-          skip_size++;
-          continue;
-        }
-        if(skip_size > 0) {
-          DEBUGF(infof(data, "Skip the malformed interleaved data %lu "
-                       "bytes", skip_size));
-        }
-        skip_size = 0;
-        rtspc->rtp_channel = rtp_channel;
-
-        /* The length is two bytes */
-        rtp_length = RTP_PKT_LENGTH(rtp);
-
-        if(rtp_dataleft < rtp_length + 4) {
-          /* Need more - incomplete payload */
-          *readmore = TRUE;
-          break;
-        }
-        interleaved = true;
-        /* We have the full RTP interleaved packet
-         * Write out the header including the leading '$' */
-        DEBUGF(infof(data, "RTP write channel %d rtp_length %d",
-                     rtspc->rtp_channel, rtp_length));
-        result = rtp_client_write(data, &rtp[0], rtp_length + 4);
-        if(result) {
-          *readmore = FALSE;
-          return result;
-        }
-
-        /* Move forward in the buffer */
-        rtp_dataleft -= rtp_length + 4;
-        rtp += rtp_length + 4;
-
-        if(data->set.rtspreq == RTSPREQ_RECEIVE) {
-          /* If we are in a passive receive, give control back
-           * to the app as often as we can.
-           */
-          k->keepon &= ~KEEP_RECV;
-        }
-      }
-      else {
-        /* Need more - incomplete header */
-        *readmore = TRUE;
-        break;
-      }
-    }
-    else {
-      /* If the following data begins with 'RTSP/', which might be an RTSP
-         message, we should stop skipping the data. */
-      /* If `k-> headerline> 0 && !interleaved` is true, we are maybe in the
-         middle of an RTSP message. It is difficult to determine this, so we
-         stop skipping. */
-      size_t prefix_len = (rtp_dataleft < 5) ? rtp_dataleft : 5;
-      if((k->headerline > 0 && !interleaved) ||
-         strncmp(rtp, "RTSP/", prefix_len) == 0) {
-        if(skip_size > 0) {
-          DEBUGF(infof(data, "Skip the malformed interleaved data %lu "
-                       "bytes", skip_size));
-        }
-        break; /* maybe is an RTSP message */
-      }
-      /* Skip incorrect data util the next RTP packet or RTSP message */
-      do {
-        rtp++;
-        rtp_dataleft--;
-        skip_size++;
-      } while(rtp_dataleft > 0 && rtp[0] != '$' && rtp[0] != 'R');
-    }
-  }
-
-  if(rtp_dataleft && rtp[0] == '$') {
-    DEBUGF(infof(data, "RTP Rewinding %zd %s", rtp_dataleft,
-                 *readmore ? "(READMORE)" : ""));
-
-    /* Store the incomplete RTP packet for a "rewind" */
-    if(!Curl_dyn_len(&rtspc->buf)) {
-      /* nothing was stored, add this data */
-      if(Curl_dyn_addn(&rtspc->buf, rtp, rtp_dataleft))
-        return CURLE_OUT_OF_MEMORY;
-    }
-    else {
-      /* keep the remainder */
-      Curl_dyn_tail(&rtspc->buf, rtp_dataleft);
-    }
-
-    /* As far as the transfer is concerned, this data is consumed */
-    *nread = 0;
-    return CURLE_OK;
-  }
-  /* Fix up k->str to point just after the last RTP packet */
-  k->str += *nread - rtp_dataleft;
-
-  *nread = rtp_dataleft;
-
-  /* If we get here, we have finished with the leftover/merge buffer */
-  Curl_dyn_free(&rtspc->buf);
-
   return CURLE_OK;
 }
 
-static
-CURLcode rtp_client_write(struct Curl_easy *data, char *ptr, size_t len)
+static CURLcode rtp_client_write(struct Curl_easy *data, const char *ptr,
+                                 size_t len)
 {
   size_t wrote;
   curl_write_callback writeit;
@@ -755,11 +620,11 @@ CURLcode rtp_client_write(struct Curl_easy *data, char *ptr, size_t len)
     user_ptr = data->set.out;
   }
 
-  Curl_set_in_callback(data, true);
-  wrote = writeit(ptr, 1, len, user_ptr);
-  Curl_set_in_callback(data, false);
+  Curl_set_in_callback(data, TRUE);
+  wrote = writeit((char *)CURL_UNCONST(ptr), 1, len, user_ptr);
+  Curl_set_in_callback(data, FALSE);
 
-  if(CURL_WRITEFUNC_PAUSE == wrote) {
+  if(wrote == CURL_WRITEFUNC_PAUSE) {
     failf(data, "Cannot pause RTP");
     return CURLE_WRITE_ERROR;
   }
@@ -772,117 +637,316 @@ CURLcode rtp_client_write(struct Curl_easy *data, char *ptr, size_t len)
   return CURLE_OK;
 }
 
-CURLcode Curl_rtsp_parseheader(struct Curl_easy *data, char *header)
+static CURLcode rtsp_filter_rtp(struct Curl_easy *data,
+                                struct rtsp_conn *rtspc,
+                                const char *buf,
+                                size_t blen,
+                                size_t *pconsumed)
 {
-  if(checkprefix("CSeq:", header)) {
-    long CSeq = 0;
-    char *endp;
-    char *p = &header[5];
-    while(ISBLANK(*p))
-      p++;
-    CSeq = strtol(p, &endp, 10);
-    if(p != endp) {
-      struct RTSP *rtsp = data->req.p.rtsp;
-      rtsp->CSeq_recv = CSeq; /* mark the request */
-      data->state.rtsp_CSeq_recv = CSeq; /* update the handle */
-    }
-    else {
-      failf(data, "Unable to read the CSeq header: [%s]", header);
-      return CURLE_RTSP_CSEQ_ERROR;
-    }
-  }
-  else if(checkprefix("Session:", header)) {
-    char *start;
-    char *end;
-    size_t idlen;
+  CURLcode result = CURLE_OK;
+  size_t skip_len = 0;
 
-    /* Find the first non-space letter */
-    start = header + 8;
-    while(*start && ISBLANK(*start))
-      start++;
+  *pconsumed = 0;
+  while(blen) {
+    bool in_body = (data->req.headerline && !rtspc->in_header) &&
+                   (data->req.size >= 0) &&
+                   (data->req.bytecount < data->req.size);
+    switch(rtspc->state) {
 
-    if(!*start) {
-      failf(data, "Got a blank Session ID");
-      return CURLE_RTSP_SESSION_ERROR;
-    }
-
-    /* Find the end of Session ID
-     *
-     * Allow any non whitespace content, up to the field separator or end of
-     * line. RFC 2326 isn't 100% clear on the session ID and for example
-     * gstreamer does url-encoded session ID's not covered by the standard.
-     */
-    end = start;
-    while(*end && *end != ';' && !ISSPACE(*end))
-      end++;
-    idlen = end - start;
-
-    if(data->set.str[STRING_RTSP_SESSION_ID]) {
-
-      /* If the Session ID is set, then compare */
-      if(strlen(data->set.str[STRING_RTSP_SESSION_ID]) != idlen ||
-         strncmp(start, data->set.str[STRING_RTSP_SESSION_ID], idlen) != 0) {
-        failf(data, "Got RTSP Session ID Line [%s], but wanted ID [%s]",
-              start, data->set.str[STRING_RTSP_SESSION_ID]);
-        return CURLE_RTSP_SESSION_ERROR;
+    case RTP_PARSE_SKIP: {
+      DEBUGASSERT(curlx_dyn_len(&rtspc->buf) == 0);
+      while(blen && buf[0] != '$') {
+        if(!in_body && buf[0] == 'R' &&
+           data->set.rtspreq != RTSPREQ_RECEIVE) {
+          if(!strncmp(buf, "RTSP/", (blen < 5) ? blen : 5)) {
+            /* This could be the next response, no consume and return */
+            if(*pconsumed) {
+              DEBUGF(infof(data, "RTP rtsp_filter_rtp[SKIP] RTSP/ prefix, "
+                           "skipping %zu bytes of junk", *pconsumed));
+            }
+            rtspc->state = RTP_PARSE_SKIP;
+            rtspc->in_header = TRUE;
+            goto out;
+          }
+        }
+        /* junk/BODY, consume without buffering */
+        *pconsumed += 1;
+        ++buf;
+        --blen;
+        ++skip_len;
       }
+      if(blen && buf[0] == '$') {
+        /* possible start of an RTP message, buffer */
+        if(skip_len) {
+          /* end of junk/BODY bytes, flush */
+          result = rtp_write_body_junk(data, rtspc, buf - skip_len, skip_len);
+          skip_len = 0;
+          if(result)
+            goto out;
+        }
+        if(curlx_dyn_addn(&rtspc->buf, buf, 1)) {
+          result = CURLE_OUT_OF_MEMORY;
+          goto out;
+        }
+        *pconsumed += 1;
+        ++buf;
+        --blen;
+        rtspc->state = RTP_PARSE_CHANNEL;
+      }
+      break;
     }
-    else {
-      /* If the Session ID is not set, and we find it in a response, then set
-       * it.
-       */
 
-      /* Copy the id substring into a new buffer */
-      data->set.str[STRING_RTSP_SESSION_ID] = malloc(idlen + 1);
-      if(!data->set.str[STRING_RTSP_SESSION_ID])
-        return CURLE_OUT_OF_MEMORY;
-      memcpy(data->set.str[STRING_RTSP_SESSION_ID], start, idlen);
-      (data->set.str[STRING_RTSP_SESSION_ID])[idlen] = '\0';
+    case RTP_PARSE_CHANNEL: {
+      int idx = ((unsigned char)buf[0]) / 8;
+      int off = ((unsigned char)buf[0]) % 8;
+      DEBUGASSERT(curlx_dyn_len(&rtspc->buf) == 1);
+      if(!(data->state.rtp_channel_mask[idx] & (1 << off))) {
+        /* invalid channel number, junk or BODY data */
+        rtspc->state = RTP_PARSE_SKIP;
+        DEBUGASSERT(skip_len == 0);
+        /* we do not consume this byte, it is BODY data */
+        DEBUGF(infof(data, "RTSP: invalid RTP channel %d, skipping", idx));
+        if(*pconsumed == 0) {
+          /* We did not consume the initial '$' in our buffer, but had
+           * it from an earlier call. We cannot un-consume it and have
+           * to write it directly as BODY data */
+          result = rtp_write_body_junk(data, rtspc,
+                                       curlx_dyn_ptr(&rtspc->buf), 1);
+          if(result)
+            goto out;
+        }
+        else {
+          /* count the '$' as skip and continue */
+          skip_len = 1;
+        }
+        curlx_dyn_free(&rtspc->buf);
+        break;
+      }
+      /* a valid channel, so we expect this to be a real RTP message */
+      rtspc->rtp_channel = (unsigned char)buf[0];
+      if(curlx_dyn_addn(&rtspc->buf, buf, 1)) {
+        result = CURLE_OUT_OF_MEMORY;
+        goto out;
+      }
+      *pconsumed += 1;
+      ++buf;
+      --blen;
+      rtspc->state = RTP_PARSE_LEN;
+      break;
+    }
+
+    case RTP_PARSE_LEN: {
+      size_t rtp_len = curlx_dyn_len(&rtspc->buf);
+      const char *rtp_buf;
+      DEBUGASSERT(rtp_len >= 2 && rtp_len < 4);
+      if(curlx_dyn_addn(&rtspc->buf, buf, 1)) {
+        result = CURLE_OUT_OF_MEMORY;
+        goto out;
+      }
+      *pconsumed += 1;
+      ++buf;
+      --blen;
+      if(rtp_len == 2)
+        break;
+      rtp_buf = curlx_dyn_ptr(&rtspc->buf);
+      rtspc->rtp_len = RTP_PKT_LENGTH(rtp_buf) + 4;
+      if(rtspc->rtp_len == 4) {
+        /* zero-length payload, the 4-byte header is the complete RTP
+           message. Dispatch immediately without entering RTP_PARSE_DATA. */
+        DEBUGF(infof(data, "RTP write channel %d rtp_len %zu (no payload)",
+                     rtspc->rtp_channel, rtspc->rtp_len));
+        result = rtp_client_write(data, rtp_buf, rtspc->rtp_len);
+        curlx_dyn_free(&rtspc->buf);
+        rtspc->state = RTP_PARSE_SKIP;
+        if(result)
+          goto out;
+        break;
+      }
+      rtspc->state = RTP_PARSE_DATA;
+      break;
+    }
+
+    case RTP_PARSE_DATA: {
+      size_t rtp_len = curlx_dyn_len(&rtspc->buf);
+      size_t needed;
+      DEBUGASSERT(rtp_len < rtspc->rtp_len);
+      needed = rtspc->rtp_len - rtp_len;
+      if(needed <= blen) {
+        if(curlx_dyn_addn(&rtspc->buf, buf, needed)) {
+          result = CURLE_OUT_OF_MEMORY;
+          goto out;
+        }
+        *pconsumed += needed;
+        buf += needed;
+        blen -= needed;
+        /* complete RTP message in buffer */
+        DEBUGF(infof(data, "RTP write channel %d rtp_len %zu",
+                     rtspc->rtp_channel, rtspc->rtp_len));
+        result = rtp_client_write(data, curlx_dyn_ptr(&rtspc->buf),
+                                  rtspc->rtp_len);
+        curlx_dyn_free(&rtspc->buf);
+        rtspc->state = RTP_PARSE_SKIP;
+        if(result)
+          goto out;
+      }
+      else {
+        if(curlx_dyn_addn(&rtspc->buf, buf, blen)) {
+          result = CURLE_OUT_OF_MEMORY;
+          goto out;
+        }
+        *pconsumed += blen;
+        buf += blen;
+        blen = 0;
+      }
+      break;
+    }
+
+    default:
+      DEBUGASSERT(0);
+      return CURLE_RECV_ERROR;
     }
   }
-  else if(checkprefix("Transport:", header)) {
-    CURLcode result;
-    result = rtsp_parse_transport(data, header + 10);
-    if(result)
-      return result;
-  }
-  return CURLE_OK;
+out:
+  if(!result && skip_len)
+    result = rtp_write_body_junk(data, rtspc, buf - skip_len, skip_len);
+  return result;
 }
 
-static
-CURLcode rtsp_parse_transport(struct Curl_easy *data, char *transport)
+/*
+ * Parse and write out an RTSP response.
+ * @param data     the transfer
+ * @param conn     the connection
+ * @param buf      data read from connection
+ * @param blen     amount of data in buf
+ * @param is_eos   TRUE iff this is the last write
+ * @param readmore out, TRUE iff complete buf was consumed and more data
+ *                 is needed
+ */
+static CURLcode rtsp_rtp_write_resp(struct Curl_easy *data,
+                                    const char *buf,
+                                    size_t blen,
+                                    bool is_eos)
 {
-  /* If we receive multiple Transport response-headers, the linterleaved
+  struct rtsp_conn *rtspc =
+    Curl_conn_meta_get(data->conn, CURL_META_RTSP_CONN);
+  CURLcode result = CURLE_OK;
+  size_t consumed = 0;
+
+  if(!rtspc)
+    return CURLE_FAILED_INIT;
+
+  if(!data->req.header)
+    rtspc->in_header = FALSE;
+  if(!blen) {
+    goto out;
+  }
+
+  DEBUGF(infof(data, "rtsp_rtp_write_resp(len=%zu, in_header=%d, eos=%d)",
+               blen, rtspc->in_header, is_eos));
+
+  /* If header parsing is not ongoing, extract RTP messages */
+  if(!rtspc->in_header) {
+    result = rtsp_filter_rtp(data, rtspc, buf, blen, &consumed);
+    if(result)
+      goto out;
+    buf += consumed;
+    blen -= consumed;
+    /* either we consumed all or are at the start of header parsing */
+    if(blen && !data->req.header)
+      DEBUGF(infof(data, "RTSP: %zu bytes, possibly excess in response body",
+                   blen));
+  }
+
+  /* we want to parse headers, do so */
+  if(data->req.header && blen) {
+    rtspc->in_header = TRUE;
+    result = Curl_http_write_resp_hds(data, buf, blen, &consumed);
+    if(result)
+      goto out;
+
+    buf += consumed;
+    blen -= consumed;
+
+    if(!data->req.header)
+      rtspc->in_header = FALSE;
+
+    if(!rtspc->in_header) {
+      /* If header parsing is done, extract interleaved RTP messages */
+      if(data->req.size <= -1) {
+        /* Respect section 4.4 of rfc2326: If the Content-Length header is
+           absent, a length 0 must be assumed. */
+        data->req.size = 0;
+        data->req.download_done = TRUE;
+      }
+      result = rtsp_filter_rtp(data, rtspc, buf, blen, &consumed);
+      if(result)
+        goto out;
+      buf += consumed;
+      blen -= consumed;
+    }
+  }
+
+  if(rtspc->state != RTP_PARSE_SKIP)
+    data->req.done = FALSE;
+  /* we SHOULD have consumed all bytes, unless the response is borked.
+   * In which case we write out the left over bytes, letting the client
+   * writer deal with it (it will report EXCESS and fail the transfer). */
+  DEBUGF(infof(data, "rtsp_rtp_write_resp(len=%zu, in_header=%d, done=%d, "
+               "rtspc->state=%d, req.size=%" FMT_OFF_T ")",
+               blen, rtspc->in_header, data->req.done, (int)rtspc->state,
+               data->req.size));
+  if(!result && (is_eos || blen)) {
+    result = Curl_client_write(data, CLIENTWRITE_BODY |
+                               (is_eos ? CLIENTWRITE_EOS : 0), buf, blen);
+  }
+
+out:
+  if((data->set.rtspreq == RTSPREQ_RECEIVE) &&
+     (rtspc->state == RTP_PARSE_SKIP)) {
+    /* In special mode RECEIVE, we process one chunk of network
+     * data, so we stop the transfer here, if we have no incomplete
+     * RTP message pending. */
+    data->req.download_done = TRUE;
+  }
+  return result;
+}
+
+static CURLcode rtsp_rtp_write_resp_hd(struct Curl_easy *data,
+                                       const char *buf,
+                                       size_t blen,
+                                       bool is_eos)
+{
+  return rtsp_rtp_write_resp(data, buf, blen, is_eos);
+}
+
+static CURLcode rtsp_parse_transport(struct Curl_easy *data,
+                                     const char *transport)
+{
+  /* If we receive multiple Transport response-headers, the interleaved
      channels of each response header is recorded and used together for
      subsequent data validity checks.*/
   /* e.g.: ' RTP/AVP/TCP;unicast;interleaved=5-6' */
-  char *start;
-  char *end;
+  const char *start, *end;
   start = transport;
   while(start && *start) {
-    while(*start && ISBLANK(*start) )
-      start++;
+    curlx_str_passblanks(&start);
     end = strchr(start, ';');
     if(checkprefix("interleaved=", start)) {
-      long chan1, chan2, chan;
-      char *endp;
-      char *p = start + 12;
-      chan1 = strtol(p, &endp, 10);
-      if(p != endp && chan1 >= 0 && chan1 <= 255) {
+      curl_off_t chan1, chan2, chan;
+      const char *p = start + 12;
+      if(!curlx_str_number(&p, &chan1, 255)) {
         unsigned char *rtp_channel_mask = data->state.rtp_channel_mask;
         chan2 = chan1;
-        if(*endp == '-') {
-          p = endp + 1;
-          chan2 = strtol(p, &endp, 10);
-          if(p == endp || chan2 < 0 || chan2 > 255) {
+        if(!curlx_str_single(&p, '-')) {
+          if(curlx_str_number(&p, &chan2, 255)) {
             infof(data, "Unable to read the interleaved parameter from "
                   "Transport header: [%s]", transport);
             chan2 = chan1;
           }
         }
         for(chan = chan1; chan <= chan2; chan++) {
-          long idx = chan / 8;
-          long off = chan % 8;
+          int idx = (int)chan / 8;
+          int off = (int)chan % 8;
           rtp_channel_mask[idx] |= (unsigned char)(1 << off);
         }
       }
@@ -898,5 +962,96 @@ CURLcode rtsp_parse_transport(struct Curl_easy *data, char *transport)
   return CURLE_OK;
 }
 
+CURLcode Curl_rtsp_parseheader(struct Curl_easy *data, const char *header)
+{
+  if(checkprefix("CSeq:", header)) {
+    curl_off_t CSeq = 0;
+    struct RTSP *rtsp = Curl_meta_get(data, CURL_META_RTSP_EASY);
+    const char *p = &header[5];
+    if(!rtsp)
+      return CURLE_FAILED_INIT;
+    curlx_str_passblanks(&p);
+    if(curlx_str_number(&p, &CSeq, UINT_MAX)) {
+      failf(data, "Unable to read the CSeq header: [%s]", header);
+      return CURLE_RTSP_CSEQ_ERROR;
+    }
+    data->state.rtsp_CSeq_recv = rtsp->CSeq_recv = (uint32_t)CSeq;
+  }
+  else if(checkprefix("Session:", header)) {
+    const char *start, *end;
+    size_t idlen;
 
-#endif /* CURL_DISABLE_RTSP or using Hyper */
+    /* Find the first non-space letter */
+    start = header + 8;
+    curlx_str_passblanks(&start);
+
+    if(!*start) {
+      failf(data, "Got a blank Session ID");
+      return CURLE_RTSP_SESSION_ERROR;
+    }
+
+    /* Find the end of Session ID
+     *
+     * Allow any non whitespace content, up to the field separator or end of
+     * line. RFC 2326 is not 100% clear on the session ID and for example
+     * gstreamer does URL-encoded session ID's not covered by the standard.
+     */
+    end = start;
+    while((*end > ' ') && (*end != ';'))
+      end++;
+    idlen = end - start;
+
+    if(data->set.str[STRING_RTSP_SESSION_ID]) {
+
+      /* If the Session ID is set, then compare */
+      if(strlen(data->set.str[STRING_RTSP_SESSION_ID]) != idlen ||
+         strncmp(start, data->set.str[STRING_RTSP_SESSION_ID], idlen)) {
+        failf(data, "Got RTSP Session ID Line [%s], but wanted ID [%s]",
+              start, data->set.str[STRING_RTSP_SESSION_ID]);
+        return CURLE_RTSP_SESSION_ERROR;
+      }
+    }
+    else {
+      /* If the Session ID is not set, and we find it in a response, then set
+       * it.
+       */
+
+      /* Copy the id substring into a new buffer */
+      data->set.str[STRING_RTSP_SESSION_ID] = curlx_memdup0(start, idlen);
+      if(!data->set.str[STRING_RTSP_SESSION_ID])
+        return CURLE_OUT_OF_MEMORY;
+    }
+  }
+  else if(checkprefix("Transport:", header)) {
+    CURLcode result;
+    result = rtsp_parse_transport(data, header + 10);
+    if(result)
+      return result;
+  }
+  return CURLE_OK;
+}
+
+/*
+ * RTSP handler interface.
+ */
+const struct Curl_protocol Curl_protocol_rtsp = {
+  rtsp_setup_connection,                /* setup_connection */
+  rtsp_do,                              /* do_it */
+  rtsp_done,                            /* done */
+  ZERO_NULL,                            /* do_more */
+  rtsp_connect,                         /* connect_it */
+  ZERO_NULL,                            /* connecting */
+  ZERO_NULL,                            /* doing */
+  ZERO_NULL,                            /* proto_pollset */
+  rtsp_do_pollset,                      /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  Curl_http_perform_pollset,            /* perform_pollset */
+  ZERO_NULL,                            /* disconnect */
+  rtsp_rtp_write_resp,                  /* write_resp */
+  rtsp_rtp_write_resp_hd,               /* write_resp_hd */
+  rtsp_conn_is_dead,                    /* connection_is_dead */
+  ZERO_NULL,                            /* attach connection */
+  Curl_http_follow,                     /* follow */
+};
+
+#endif /* CURL_DISABLE_RTSP */
diff --git a/third-party/curl/lib/rtsp.h b/third-party/curl/lib/rtsp.h
index 111bac2a61..dd5df3ff73 100644
--- a/third-party/curl/lib/rtsp.h
+++ b/third-party/curl/lib/rtsp.h
@@ -23,49 +23,11 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#ifdef USE_HYPER
-#define CURL_DISABLE_RTSP 1
+#ifndef CURL_DISABLE_RTSP
+CURLcode Curl_rtsp_parseheader(struct Curl_easy *data, const char *header);
+extern const struct Curl_protocol Curl_protocol_rtsp;
+#else
+#define Curl_rtsp_parseheader(x, y) CURLE_NOT_BUILT_IN
 #endif
 
-#ifndef CURL_DISABLE_RTSP
-
-extern const struct Curl_handler Curl_handler_rtsp;
-
-CURLcode Curl_rtsp_parseheader(struct Curl_easy *data, char *header);
-
-#else
-/* disabled */
-#define Curl_rtsp_parseheader(x,y) CURLE_NOT_BUILT_IN
-
-#endif /* CURL_DISABLE_RTSP */
-
-/*
- * RTSP Connection data
- *
- * Currently, only used for tracking incomplete RTP data reads
- */
-struct rtsp_conn {
-  struct dynbuf buf;
-  int rtp_channel;
-};
-
-/****************************************************************************
- * RTSP unique setup
- ***************************************************************************/
-struct RTSP {
-  /*
-   * http_wrapper MUST be the first element of this structure for the wrap
-   * logic to work. In this way, we get a cheap polymorphism because
-   * &(data->state.proto.rtsp) == &(data->state.proto.http) per the C spec
-   *
-   * HTTP functions can safely treat this as an HTTP struct, but RTSP aware
-   * functions can also index into the later elements.
-   */
-  struct HTTP http_wrapper; /* wrap HTTP to do the heavy lifting */
-
-  long CSeq_sent; /* CSeq of this request */
-  long CSeq_recv; /* CSeq received */
-};
-
-
 #endif /* HEADER_CURL_RTSP_H */
diff --git a/third-party/curl/lib/select.c b/third-party/curl/lib/select.c
index cae9beb6c7..888490f2c9 100644
--- a/third-party/curl/lib/select.c
+++ b/third-party/curl/lib/select.c
@@ -21,10 +21,11 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include <limits.h>
+#if !defined(HAVE_SELECT) && !defined(HAVE_POLL)
+#error "We cannot compile without select() or poll() support."
+#endif
 
 #ifdef HAVE_SYS_SELECT_H
 #include <sys/select.h>
@@ -32,89 +33,19 @@
 #include <unistd.h>
 #endif
 
-#if !defined(HAVE_SELECT) && !defined(HAVE_POLL_FINE)
-#error "We can't compile without select() or poll() support."
-#endif
-
-#ifdef MSDOS
-#include <dos.h>  /* delay() */
-#endif
-
-#include <curl/curl.h>
-
 #include "urldata.h"
 #include "connect.h"
 #include "select.h"
-#include "timediff.h"
-#include "warnless.h"
+#include "curl_trc.h"
+#include "curlx/timediff.h"
+#include "curlx/wait.h"
 
+#ifndef HAVE_POLL
 /*
- * Internal function used for waiting a specific amount of ms
- * in Curl_socket_check() and Curl_poll() when no file descriptor
- * is provided to wait on, just being used to delay execution.
- * WinSock select() and poll() timeout mechanisms need a valid
- * socket descriptor in a not null file descriptor set to work.
- * Waiting indefinitely with this function is not allowed, a
- * zero or negative timeout value will return immediately.
- * Timeout resolution, accuracy, as well as maximum supported
- * value is system dependent, neither factor is a critical issue
- * for the intended use of this function in the library.
- *
- * Return values:
- *   -1 = system call error, or invalid timeout value
- *    0 = specified timeout has elapsed, or interrupted
- */
-int Curl_wait_ms(timediff_t timeout_ms)
-{
-  int r = 0;
-
-  if(!timeout_ms)
-    return 0;
-  if(timeout_ms < 0) {
-    SET_SOCKERRNO(EINVAL);
-    return -1;
-  }
-#if defined(MSDOS)
-  delay(timeout_ms);
-#elif defined(WIN32)
-  /* prevent overflow, timeout_ms is typecast to ULONG/DWORD. */
-#if TIMEDIFF_T_MAX >= ULONG_MAX
-  if(timeout_ms >= ULONG_MAX)
-    timeout_ms = ULONG_MAX-1;
-    /* don't use ULONG_MAX, because that is equal to INFINITE */
-#endif
-  Sleep((ULONG)timeout_ms);
-#else
-#if defined(HAVE_POLL_FINE)
-  /* prevent overflow, timeout_ms is typecast to int. */
-#if TIMEDIFF_T_MAX > INT_MAX
-  if(timeout_ms > INT_MAX)
-    timeout_ms = INT_MAX;
-#endif
-  r = poll(NULL, 0, (int)timeout_ms);
-#else
-  {
-    struct timeval pending_tv;
-    r = select(0, NULL, NULL, NULL, curlx_mstotv(&pending_tv, timeout_ms));
-  }
-#endif /* HAVE_POLL_FINE */
-#endif /* USE_WINSOCK */
-  if(r) {
-    if((r == -1) && (SOCKERRNO == EINTR))
-      /* make EINTR from select or poll not a "lethal" error */
-      r = 0;
-    else
-      r = -1;
-  }
-  return r;
-}
-
-#ifndef HAVE_POLL_FINE
-/*
- * This is a wrapper around select() to aid in Windows compatibility.
- * A negative timeout value makes this function wait indefinitely,
- * unless no valid file descriptor is given, when this happens the
- * negative timeout is ignored and the function times out immediately.
+ * This is a wrapper around select() to aid in Windows compatibility. A
+ * negative timeout value makes this function wait indefinitely, unless no
+ * valid file descriptor is given, when this happens the negative timeout is
+ * ignored and the function times out immediately.
  *
  * Return values:
  *   -1 = system call error or fd >= FD_SETSIZE
@@ -131,30 +62,30 @@ static int our_select(curl_socket_t maxfd,   /* highest socket number */
   struct timeval *ptimeout;
 
 #ifdef USE_WINSOCK
-  /* WinSock select() can't handle zero events.  See the comment below. */
+  /* Winsock select() cannot handle zero events. See the comment below. */
   if((!fds_read || fds_read->fd_count == 0) &&
      (!fds_write || fds_write->fd_count == 0) &&
      (!fds_err || fds_err->fd_count == 0)) {
-    /* no sockets, just wait */
-    return Curl_wait_ms(timeout_ms);
+    /* no sockets, wait */
+    return curlx_wait_ms(timeout_ms);
   }
 #endif
 
   ptimeout = curlx_mstotv(&pending_tv, timeout_ms);
 
 #ifdef USE_WINSOCK
-  /* WinSock select() must not be called with an fd_set that contains zero
-    fd flags, or it will return WSAEINVAL.  But, it also can't be called
-    with no fd_sets at all!  From the documentation:
+  /* Winsock select() must not be called with an fd_set that contains zero
+     fd flags, or it will return WSAEINVAL. It also cannot be called with
+     no fd_sets at all!  From the documentation:
 
-    Any two of the parameters, readfds, writefds, or exceptfds, can be
-    given as null. At least one must be non-null, and any non-null
-    descriptor set must contain at least one handle to a socket.
+     Any two of the parameters, readfds, writefds, or exceptfds, can be
+     given as null. At least one must be non-null, and any non-null
+     descriptor set must contain at least one handle to a socket.
 
-    It is unclear why WinSock doesn't just handle this for us instead of
-    calling this an error. Luckily, with WinSock, we can _also_ ask how
-    many bits are set on an fd_set. So, let's just check it beforehand.
-  */
+     It is unclear why Winsock does not handle this for us instead of
+     calling this an error. Luckily, with Winsock, we can _also_ ask how
+     many bits are set on an fd_set. Therefore, let's check it beforehand.
+   */
   return select((int)maxfd + 1,
                 fds_read && fds_read->fd_count ? fds_read : NULL,
                 fds_write && fds_write->fd_count ? fds_write : NULL,
@@ -168,13 +99,13 @@ static int our_select(curl_socket_t maxfd,   /* highest socket number */
 
 /*
  * Wait for read or write events on a set of file descriptors. It uses poll()
- * when a fine poll() is available, in order to avoid limits with FD_SETSIZE,
- * otherwise select() is used.  An error is returned if select() is being used
+ * when poll() is available, in order to avoid limits with FD_SETSIZE,
+ * otherwise select() is used. An error is returned if select() is being used
  * and a file descriptor is too large for FD_SETSIZE.
  *
- * A negative timeout value makes this function wait indefinitely,
- * unless no valid file descriptor is given, when this happens the
- * negative timeout is ignored and the function times out immediately.
+ * A negative timeout value makes this function wait indefinitely, unless no
+ * valid file descriptor is given, when this happens the negative timeout is
+ * ignored and the function times out immediately.
  *
  * Return values:
  *   -1 = system call error or fd >= FD_SETSIZE
@@ -197,11 +128,11 @@ int Curl_socket_check(curl_socket_t readfd0, /* two sockets to read from */
 
   if((readfd0 == CURL_SOCKET_BAD) && (readfd1 == CURL_SOCKET_BAD) &&
      (writefd == CURL_SOCKET_BAD)) {
-    /* no sockets, just wait */
-    return Curl_wait_ms(timeout_ms);
+    /* no sockets, wait */
+    return curlx_wait_ms(timeout_ms);
   }
 
-  /* Avoid initial timestamp, avoid Curl_now() call, when elapsed
+  /* Avoid initial timestamp, avoid curlx_now() call, when elapsed
      time in this function does not need to be measured. This happens
      when function is called with a zero timeout or a negative timeout
      value indicating a blocking call should be performed. */
@@ -209,47 +140,47 @@ int Curl_socket_check(curl_socket_t readfd0, /* two sockets to read from */
   num = 0;
   if(readfd0 != CURL_SOCKET_BAD) {
     pfd[num].fd = readfd0;
-    pfd[num].events = POLLRDNORM|POLLIN|POLLRDBAND|POLLPRI;
+    pfd[num].events = POLLRDNORM | POLLIN | POLLRDBAND | POLLPRI;
     pfd[num].revents = 0;
     num++;
   }
   if(readfd1 != CURL_SOCKET_BAD) {
     pfd[num].fd = readfd1;
-    pfd[num].events = POLLRDNORM|POLLIN|POLLRDBAND|POLLPRI;
+    pfd[num].events = POLLRDNORM | POLLIN | POLLRDBAND | POLLPRI;
     pfd[num].revents = 0;
     num++;
   }
   if(writefd != CURL_SOCKET_BAD) {
     pfd[num].fd = writefd;
-    pfd[num].events = POLLWRNORM|POLLOUT|POLLPRI;
+    pfd[num].events = POLLWRNORM | POLLOUT | POLLPRI;
     pfd[num].revents = 0;
     num++;
   }
 
-  r = Curl_poll(pfd, num, timeout_ms);
+  r = Curl_poll(pfd, (unsigned int)num, timeout_ms);
   if(r <= 0)
     return r;
 
   r = 0;
   num = 0;
   if(readfd0 != CURL_SOCKET_BAD) {
-    if(pfd[num].revents & (POLLRDNORM|POLLIN|POLLERR|POLLHUP))
+    if(pfd[num].revents & (POLLRDNORM | POLLIN | POLLERR | POLLHUP))
       r |= CURL_CSELECT_IN;
-    if(pfd[num].revents & (POLLPRI|POLLNVAL))
+    if(pfd[num].revents & (POLLPRI | POLLNVAL))
       r |= CURL_CSELECT_ERR;
     num++;
   }
   if(readfd1 != CURL_SOCKET_BAD) {
-    if(pfd[num].revents & (POLLRDNORM|POLLIN|POLLERR|POLLHUP))
+    if(pfd[num].revents & (POLLRDNORM | POLLIN | POLLERR | POLLHUP))
       r |= CURL_CSELECT_IN2;
-    if(pfd[num].revents & (POLLPRI|POLLNVAL))
+    if(pfd[num].revents & (POLLPRI | POLLNVAL))
       r |= CURL_CSELECT_ERR;
     num++;
   }
   if(writefd != CURL_SOCKET_BAD) {
-    if(pfd[num].revents & (POLLWRNORM|POLLOUT))
+    if(pfd[num].revents & (POLLWRNORM | POLLOUT))
       r |= CURL_CSELECT_OUT;
-    if(pfd[num].revents & (POLLERR|POLLHUP|POLLPRI|POLLNVAL))
+    if(pfd[num].revents & (POLLERR | POLLHUP | POLLPRI | POLLNVAL))
       r |= CURL_CSELECT_ERR;
   }
 
@@ -257,8 +188,8 @@ int Curl_socket_check(curl_socket_t readfd0, /* two sockets to read from */
 }
 
 /*
- * This is a wrapper around poll().  If poll() does not exist, then
- * select() is used instead.  An error is returned if select() is
+ * This is a wrapper around poll(). If poll() does not exist, then
+ * select() is used instead. An error is returned if select() is
  * being used and a file descriptor is too large for FD_SETSIZE.
  * A negative timeout value makes this function wait indefinitely,
  * unless no valid file descriptor is given, when this happens the
@@ -271,7 +202,7 @@ int Curl_socket_check(curl_socket_t readfd0, /* two sockets to read from */
  */
 int Curl_poll(struct pollfd ufds[], unsigned int nfds, timediff_t timeout_ms)
 {
-#ifdef HAVE_POLL_FINE
+#ifdef HAVE_POLL
   int pending_ms;
 #else
   fd_set fds_read;
@@ -292,16 +223,16 @@ int Curl_poll(struct pollfd ufds[], unsigned int nfds, timediff_t timeout_ms)
     }
   }
   if(fds_none) {
-    /* no sockets, just wait */
-    return Curl_wait_ms(timeout_ms);
+    /* no sockets, wait */
+    return curlx_wait_ms(timeout_ms);
   }
 
-  /* Avoid initial timestamp, avoid Curl_now() call, when elapsed
+  /* Avoid initial timestamp, avoid curlx_now() call, when elapsed
      time in this function does not need to be measured. This happens
      when function is called with a zero timeout or a negative timeout
      value indicating a blocking call should be performed. */
 
-#ifdef HAVE_POLL_FINE
+#ifdef HAVE_POLL
 
   /* prevent overflow, timeout_ms is typecast to int. */
 #if TIMEDIFF_T_MAX > INT_MAX
@@ -316,7 +247,7 @@ int Curl_poll(struct pollfd ufds[], unsigned int nfds, timediff_t timeout_ms)
     pending_ms = 0;
   r = poll(ufds, nfds, pending_ms);
   if(r <= 0) {
-    if((r == -1) && (SOCKERRNO == EINTR))
+    if((r == -1) && (SOCKERRNO == SOCKEINTR))
       /* make EINTR from select or poll not a "lethal" error */
       r = 0;
     return r;
@@ -328,10 +259,10 @@ int Curl_poll(struct pollfd ufds[], unsigned int nfds, timediff_t timeout_ms)
     if(ufds[i].revents & POLLHUP)
       ufds[i].revents |= POLLIN;
     if(ufds[i].revents & POLLERR)
-      ufds[i].revents |= POLLIN|POLLOUT;
+      ufds[i].revents |= POLLIN | POLLOUT;
   }
 
-#else  /* HAVE_POLL_FINE */
+#else /* !HAVE_POLL */
 
   FD_ZERO(&fds_read);
   FD_ZERO(&fds_write);
@@ -343,28 +274,28 @@ int Curl_poll(struct pollfd ufds[], unsigned int nfds, timediff_t timeout_ms)
     if(ufds[i].fd == CURL_SOCKET_BAD)
       continue;
     VERIFY_SOCK(ufds[i].fd);
-    if(ufds[i].events & (POLLIN|POLLOUT|POLLPRI|
-                         POLLRDNORM|POLLWRNORM|POLLRDBAND)) {
+    if(ufds[i].events & (POLLIN | POLLOUT | POLLPRI |
+                         POLLRDNORM | POLLWRNORM | POLLRDBAND)) {
       if(ufds[i].fd > maxfd)
         maxfd = ufds[i].fd;
-      if(ufds[i].events & (POLLRDNORM|POLLIN))
+      if(ufds[i].events & (POLLRDNORM | POLLIN))
         FD_SET(ufds[i].fd, &fds_read);
-      if(ufds[i].events & (POLLWRNORM|POLLOUT))
+      if(ufds[i].events & (POLLWRNORM | POLLOUT))
         FD_SET(ufds[i].fd, &fds_write);
-      if(ufds[i].events & (POLLRDBAND|POLLPRI))
+      if(ufds[i].events & (POLLRDBAND | POLLPRI))
         FD_SET(ufds[i].fd, &fds_err);
     }
   }
 
   /*
-     Note also that WinSock ignores the first argument, so we don't worry
-     about the fact that maxfd is computed incorrectly with WinSock (since
+     Note also that Winsock ignores the first argument, so we do not worry
+     about the fact that maxfd is computed incorrectly with Winsock (since
      curl_socket_t is unsigned in such cases and thus -1 is the largest
      value).
   */
   r = our_select(maxfd, &fds_read, &fds_write, &fds_err, timeout_ms);
   if(r <= 0) {
-    if((r == -1) && (SOCKERRNO == EINTR))
+    if((r == -1) && (SOCKERRNO == SOCKEINTR))
       /* make EINTR from select or poll not a "lethal" error */
       r = 0;
     return r;
@@ -397,7 +328,406 @@ int Curl_poll(struct pollfd ufds[], unsigned int nfds, timediff_t timeout_ms)
       r++;
   }
 
-#endif  /* HAVE_POLL_FINE */
+#endif /* HAVE_POLL */
 
   return r;
 }
+
+void Curl_pollfds_init(struct curl_pollfds *cpfds,
+                       struct pollfd *static_pfds,
+                       unsigned int static_count)
+{
+  DEBUGASSERT(cpfds);
+  memset(cpfds, 0, sizeof(*cpfds));
+  if(static_pfds && static_count) {
+    cpfds->pfds = static_pfds;
+    cpfds->count = static_count;
+  }
+}
+
+void Curl_pollfds_reset(struct curl_pollfds *cpfds)
+{
+  cpfds->n = 0;
+}
+
+void Curl_pollfds_cleanup(struct curl_pollfds *cpfds)
+{
+  DEBUGASSERT(cpfds);
+  if(cpfds->allocated_pfds) {
+    curlx_free(cpfds->pfds);
+  }
+  memset(cpfds, 0, sizeof(*cpfds));
+}
+
+static CURLcode cpfds_increase(struct curl_pollfds *cpfds, unsigned int inc)
+{
+  struct pollfd *new_fds;
+  unsigned int new_count = cpfds->count + inc;
+
+  new_fds = curlx_calloc(new_count, sizeof(struct pollfd));
+  if(!new_fds)
+    return CURLE_OUT_OF_MEMORY;
+
+  memcpy(new_fds, cpfds->pfds, cpfds->count * sizeof(struct pollfd));
+  if(cpfds->allocated_pfds)
+    curlx_free(cpfds->pfds);
+  cpfds->pfds = new_fds;
+  cpfds->count = new_count;
+  cpfds->allocated_pfds = TRUE;
+  return CURLE_OK;
+}
+
+static CURLcode cpfds_add_sock(struct curl_pollfds *cpfds,
+                               curl_socket_t sock, short events, bool fold)
+{
+  int i;
+
+  if(fold && cpfds->n <= INT_MAX) {
+    for(i = (int)cpfds->n - 1; i >= 0; --i) {
+      if(sock == cpfds->pfds[i].fd) {
+        cpfds->pfds[i].events |= events;
+        return CURLE_OK;
+      }
+    }
+  }
+  /* not folded, add new entry */
+  if(cpfds->n >= cpfds->count) {
+    if(cpfds_increase(cpfds, 100))
+      return CURLE_OUT_OF_MEMORY;
+  }
+  cpfds->pfds[cpfds->n].fd = sock;
+  cpfds->pfds[cpfds->n].events = events;
+  ++cpfds->n;
+  return CURLE_OK;
+}
+
+CURLcode Curl_pollfds_add_sock(struct curl_pollfds *cpfds,
+                               curl_socket_t sock, short events)
+{
+  return cpfds_add_sock(cpfds, sock, events, FALSE);
+}
+
+CURLcode Curl_pollfds_add_ps(struct curl_pollfds *cpfds,
+                             struct easy_pollset *ps)
+{
+  size_t i;
+
+  DEBUGASSERT(cpfds);
+  DEBUGASSERT(ps);
+  for(i = 0; i < ps->n; i++) {
+    short events = 0;
+    if(ps->actions[i] & CURL_POLL_IN)
+      events |= POLLIN;
+    if(ps->actions[i] & CURL_POLL_OUT)
+      events |= POLLOUT;
+    if(events) {
+      if(cpfds_add_sock(cpfds, ps->sockets[i], events, TRUE))
+        return CURLE_OUT_OF_MEMORY;
+    }
+  }
+  return CURLE_OK;
+}
+
+void Curl_waitfds_init(struct Curl_waitfds *cwfds,
+                       struct curl_waitfd *static_wfds,
+                       unsigned int static_count)
+{
+  DEBUGASSERT(cwfds);
+  DEBUGASSERT(static_wfds || !static_count);
+  memset(cwfds, 0, sizeof(*cwfds));
+  cwfds->wfds = static_wfds;
+  cwfds->count = static_count;
+}
+
+static unsigned int cwfds_add_sock(struct Curl_waitfds *cwfds,
+                                   curl_socket_t sock, short events)
+{
+  int i;
+  if(!cwfds->wfds) {
+    DEBUGASSERT(!cwfds->count && !cwfds->n);
+    return 1;
+  }
+  if(cwfds->n <= INT_MAX) {
+    for(i = (int)cwfds->n - 1; i >= 0; --i) {
+      if(sock == cwfds->wfds[i].fd) {
+        cwfds->wfds[i].events |= events;
+        return 0;
+      }
+    }
+  }
+  /* not folded, add new entry */
+  if(cwfds->n < cwfds->count) {
+    cwfds->wfds[cwfds->n].fd = sock;
+    cwfds->wfds[cwfds->n].events = events;
+    ++cwfds->n;
+  }
+  return 1;
+}
+
+unsigned int Curl_waitfds_add_ps(struct Curl_waitfds *cwfds,
+                                 struct easy_pollset *ps)
+{
+  size_t i;
+  unsigned int need = 0;
+
+  DEBUGASSERT(cwfds);
+  DEBUGASSERT(ps);
+  for(i = 0; i < ps->n; i++) {
+    short events = 0;
+    if(ps->actions[i] & CURL_POLL_IN)
+      events |= CURL_WAIT_POLLIN;
+    if(ps->actions[i] & CURL_POLL_OUT)
+      events |= CURL_WAIT_POLLOUT;
+    if(events)
+      need += cwfds_add_sock(cwfds, ps->sockets[i], events);
+  }
+  return need;
+}
+
+void Curl_pollset_reset(struct easy_pollset *ps)
+{
+  unsigned int i;
+  ps->n = 0;
+#ifdef DEBUGBUILD
+  DEBUGASSERT(ps->init == CURL_EASY_POLLSET_MAGIC);
+#endif
+  DEBUGASSERT(ps->count);
+  for(i = 0; i < ps->count; i++)
+    ps->sockets[i] = CURL_SOCKET_BAD;
+  memset(ps->actions, 0, ps->count * sizeof(ps->actions[0]));
+}
+
+void Curl_pollset_init(struct easy_pollset *ps)
+{
+#ifdef DEBUGBUILD
+  ps->init = CURL_EASY_POLLSET_MAGIC;
+#endif
+  ps->sockets = ps->def_sockets;
+  ps->actions = ps->def_actions;
+  ps->count = CURL_ARRAYSIZE(ps->def_sockets);
+  ps->n = 0;
+  Curl_pollset_reset(ps);
+}
+
+struct easy_pollset *Curl_pollset_create(void)
+{
+  struct easy_pollset *ps = curlx_calloc(1, sizeof(*ps));
+  if(ps)
+    Curl_pollset_init(ps);
+  return ps;
+}
+
+void Curl_pollset_cleanup(struct easy_pollset *ps)
+{
+#ifdef DEBUGBUILD
+  DEBUGASSERT(ps->init == CURL_EASY_POLLSET_MAGIC);
+#endif
+  if(ps->sockets != ps->def_sockets) {
+    curlx_free(ps->sockets);
+    ps->sockets = ps->def_sockets;
+  }
+  if(ps->actions != ps->def_actions) {
+    curlx_free(ps->actions);
+    ps->actions = ps->def_actions;
+  }
+  ps->count = CURL_ARRAYSIZE(ps->def_sockets);
+  Curl_pollset_reset(ps);
+}
+
+void Curl_pollset_move(struct easy_pollset *to, struct easy_pollset *from)
+{
+  Curl_pollset_cleanup(to); /* deallocate anything in to */
+  if(from->sockets != from->def_sockets) {
+    DEBUGASSERT(from->actions != from->def_actions);
+    to->sockets = from->sockets;
+    to->actions = from->actions;
+    to->count = from->count;
+    to->n = from->n;
+    Curl_pollset_init(from);
+  }
+  else {
+    DEBUGASSERT(to->sockets == to->def_sockets);
+    DEBUGASSERT(to->actions == to->def_actions);
+    memcpy(to->sockets, from->sockets, to->count * sizeof(to->sockets[0]));
+    memcpy(to->actions, from->actions, to->count * sizeof(to->actions[0]));
+    to->n = from->n;
+    Curl_pollset_init(from);
+  }
+}
+
+/**
+ *
+ */
+CURLcode Curl_pollset_change(struct Curl_easy *data,
+                             struct easy_pollset *ps, curl_socket_t sock,
+                             int add_flags, int remove_flags)
+{
+  unsigned int i;
+
+#ifdef DEBUGBUILD
+  DEBUGASSERT(ps->init == CURL_EASY_POLLSET_MAGIC);
+#endif
+
+  DEBUGASSERT(VALID_SOCK(sock));
+  if(!VALID_SOCK(sock))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  DEBUGASSERT(add_flags <= (CURL_POLL_IN | CURL_POLL_OUT));
+  DEBUGASSERT(remove_flags <= (CURL_POLL_IN | CURL_POLL_OUT));
+  DEBUGASSERT((add_flags & remove_flags) == 0); /* no overlap */
+  for(i = 0; i < ps->n; ++i) {
+    if(ps->sockets[i] == sock) {
+      ps->actions[i] &= (unsigned char)(~remove_flags);
+      ps->actions[i] |= (unsigned char)add_flags;
+      /* all gone? remove socket */
+      if(!ps->actions[i]) {
+        if((i + 1) < ps->n) {
+          memmove(&ps->sockets[i], &ps->sockets[i + 1],
+                  (ps->n - (i + 1)) * sizeof(ps->sockets[0]));
+          memmove(&ps->actions[i], &ps->actions[i + 1],
+                  (ps->n - (i + 1)) * sizeof(ps->actions[0]));
+        }
+        --ps->n;
+      }
+      return CURLE_OK;
+    }
+  }
+  /* not present */
+  if(add_flags) {
+    if(i >= ps->count) { /* need to grow */
+      unsigned int new_count = CURLMAX(ps->count * 2, 8);
+      curl_socket_t *nsockets;
+      unsigned char *nactions;
+
+      CURL_TRC_M(data, "growing pollset capacity from %u to %u",
+                 ps->count, new_count);
+      if(new_count <= ps->count)
+        return CURLE_OUT_OF_MEMORY;
+      nsockets = curlx_calloc(new_count, sizeof(nsockets[0]));
+      if(!nsockets)
+        return CURLE_OUT_OF_MEMORY;
+      nactions = curlx_calloc(new_count, sizeof(nactions[0]));
+      if(!nactions) {
+        curlx_free(nsockets);
+        return CURLE_OUT_OF_MEMORY;
+      }
+      memcpy(nsockets, ps->sockets, ps->count * sizeof(ps->sockets[0]));
+      memcpy(nactions, ps->actions, ps->count * sizeof(ps->actions[0]));
+      if(ps->sockets != ps->def_sockets)
+        curlx_free(ps->sockets);
+      ps->sockets = nsockets;
+      if(ps->actions != ps->def_actions)
+        curlx_free(ps->actions);
+      ps->actions = nactions;
+      ps->count = new_count;
+    }
+    DEBUGASSERT(i < ps->count);
+    if(i < ps->count) {
+      ps->sockets[i] = sock;
+      ps->actions[i] = (unsigned char)add_flags;
+      ps->n = i + 1;
+    }
+  }
+  return CURLE_OK;
+}
+
+CURLcode Curl_pollset_set(struct Curl_easy *data,
+                          struct easy_pollset *ps, curl_socket_t sock,
+                          bool do_in, bool do_out)
+{
+  return Curl_pollset_change(data, ps, sock,
+                             (do_in ? CURL_POLL_IN : 0) |
+                             (do_out ? CURL_POLL_OUT : 0),
+                             (!do_in ? CURL_POLL_IN : 0) |
+                             (!do_out ? CURL_POLL_OUT : 0));
+}
+
+/*
+ * Return values:
+ *   -1 = error
+ *    0 = timeout
+ *    N = number of structures with non zero revent fields
+ */
+int Curl_pollset_poll(struct Curl_easy *data,
+                      struct easy_pollset *ps,
+                      timediff_t timeout_ms)
+{
+  struct pollfd *pfds;
+  unsigned int i, npfds;
+  int rc;
+
+  (void)data;
+  DEBUGASSERT(data);
+  DEBUGASSERT(data->conn);
+
+  if(!ps->n)
+    return curlx_wait_ms(timeout_ms);
+
+  pfds = curlx_calloc(ps->n, sizeof(*pfds));
+  if(!pfds)
+    return -1;
+
+  npfds = 0;
+  for(i = 0; i < ps->n; ++i) {
+    short events = 0;
+    if(ps->actions[i] & CURL_POLL_IN) {
+      events |= POLLIN;
+    }
+    if(ps->actions[i] & CURL_POLL_OUT) {
+      events |= POLLOUT;
+    }
+    if(events) {
+      pfds[npfds].fd = ps->sockets[i];
+      pfds[npfds].events = events;
+      ++npfds;
+    }
+  }
+
+  rc = Curl_poll(pfds, npfds, timeout_ms);
+  curlx_free(pfds);
+  return rc;
+}
+
+void Curl_pollset_check(struct Curl_easy *data,
+                        struct easy_pollset *ps, curl_socket_t sock,
+                        bool *pwant_read, bool *pwant_write)
+{
+  unsigned int i;
+
+  (void)data;
+  DEBUGASSERT(VALID_SOCK(sock));
+  for(i = 0; i < ps->n; ++i) {
+    if(ps->sockets[i] == sock) {
+      *pwant_read = !!(ps->actions[i] & CURL_POLL_IN);
+      *pwant_write = !!(ps->actions[i] & CURL_POLL_OUT);
+      return;
+    }
+  }
+  *pwant_read = *pwant_write = FALSE;
+}
+
+bool Curl_pollset_want_recv(struct Curl_easy *data,
+                            struct easy_pollset *ps,
+                            curl_socket_t sock)
+{
+  unsigned int i;
+  (void)data;
+  for(i = 0; i < ps->n; ++i) {
+    if((ps->sockets[i] == sock) && (ps->actions[i] & CURL_POLL_IN))
+      return TRUE;
+  }
+  return FALSE;
+}
+
+bool Curl_pollset_want_send(struct Curl_easy *data,
+                            struct easy_pollset *ps,
+                            curl_socket_t sock)
+{
+  unsigned int i;
+  (void)data;
+  for(i = 0; i < ps->n; ++i) {
+    if((ps->sockets[i] == sock) && (ps->actions[i] & CURL_POLL_OUT))
+      return TRUE;
+  }
+  return FALSE;
+}
diff --git a/third-party/curl/lib/select.h b/third-party/curl/lib/select.h
index 5b1ca23eb1..dbbace4527 100644
--- a/third-party/curl/lib/select.h
+++ b/third-party/curl/lib/select.h
@@ -23,7 +23,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef HAVE_POLL_H
@@ -36,9 +35,7 @@
  * Definition of pollfd struct and constants for platforms lacking them.
  */
 
-#if !defined(HAVE_SYS_POLL_H) && \
-    !defined(HAVE_POLL_H) && \
-    !defined(POLLIN)
+#if !defined(HAVE_SYS_POLL_H) && !defined(HAVE_POLL_H) && !defined(POLLIN)
 
 #define POLLIN      0x01
 #define POLLPRI     0x02
@@ -47,11 +44,10 @@
 #define POLLHUP     0x10
 #define POLLNVAL    0x20
 
-struct pollfd
-{
-    curl_socket_t fd;
-    short   events;
-    short   revents;
+struct pollfd {
+  curl_socket_t fd;
+  short events;
+  short revents;
 };
 
 #endif
@@ -73,42 +69,164 @@ struct pollfd
    therefore defined here */
 #define CURL_CSELECT_IN2 (CURL_CSELECT_ERR << 1)
 
-int Curl_socket_check(curl_socket_t readfd, curl_socket_t readfd2,
+int Curl_socket_check(curl_socket_t readfd0,
+                      curl_socket_t readfd1,
                       curl_socket_t writefd,
                       timediff_t timeout_ms);
-#define SOCKET_READABLE(x,z) \
+#define SOCKET_READABLE(x, z)                               \
   Curl_socket_check(x, CURL_SOCKET_BAD, CURL_SOCKET_BAD, z)
-#define SOCKET_WRITABLE(x,z) \
+#define SOCKET_WRITABLE(x, z)                               \
   Curl_socket_check(CURL_SOCKET_BAD, CURL_SOCKET_BAD, x, z)
 
 int Curl_poll(struct pollfd ufds[], unsigned int nfds, timediff_t timeout_ms);
-int Curl_wait_ms(timediff_t timeout_ms);
 
 /*
    With Winsock the valid range is [0..INVALID_SOCKET-1] according to
-   https://docs.microsoft.com/en-us/windows/win32/winsock/socket-data-type-2
+   https://learn.microsoft.com/windows/win32/winsock/socket-data-type-2
 */
 #ifdef USE_WINSOCK
 #define VALID_SOCK(s) ((s) < INVALID_SOCKET)
 #define FDSET_SOCK(x) 1
-#define VERIFY_SOCK(x) do { \
-  if(!VALID_SOCK(x)) { \
-    SET_SOCKERRNO(WSAEINVAL); \
-    return -1; \
-  } \
-} while(0)
+#define VERIFY_SOCK(x)           \
+  do {                           \
+    if(!VALID_SOCK(x)) {         \
+      SET_SOCKERRNO(SOCKEINVAL); \
+      return -1;                 \
+    }                            \
+  } while(0)
 #else
 #define VALID_SOCK(s) ((s) >= 0)
 
 /* If the socket is small enough to get set or read from an fdset */
 #define FDSET_SOCK(s) ((s) < FD_SETSIZE)
 
-#define VERIFY_SOCK(x) do {                     \
-    if(!VALID_SOCK(x) || !FDSET_SOCK(x)) {      \
-      SET_SOCKERRNO(EINVAL);                    \
-      return -1;                                \
-    }                                           \
+#define VERIFY_SOCK(x)                     \
+  do {                                     \
+    if(!VALID_SOCK(x) || !FDSET_SOCK(x)) { \
+      SET_SOCKERRNO(SOCKEINVAL);           \
+      return -1;                           \
+    }                                      \
   } while(0)
 #endif
 
+/* Keep the sockets to poll for an easy handle.
+ * `actions` are bitmaps of CURL_POLL_IN and CURL_POLL_OUT.
+ * Starts with small capacity, grows on demand.
+ */
+#define EZ_POLLSET_DEF_COUNT 2
+
+struct easy_pollset {
+  curl_socket_t *sockets;
+  unsigned char *actions;
+  unsigned int n;
+  unsigned int count;
+#ifdef DEBUGBUILD
+  int init;
+#endif
+  curl_socket_t def_sockets[EZ_POLLSET_DEF_COUNT];
+  unsigned char def_actions[EZ_POLLSET_DEF_COUNT];
+};
+
+#ifdef DEBUGBUILD
+#define CURL_EASY_POLLSET_MAGIC  0x7a657370
+#endif
+
+/* allocate and initialize */
+struct easy_pollset *Curl_pollset_create(void);
+
+/* Initialize before first use */
+void Curl_pollset_init(struct easy_pollset *ps);
+/* Free any allocated resources */
+void Curl_pollset_cleanup(struct easy_pollset *ps);
+/* Reset to an empty pollset */
+void Curl_pollset_reset(struct easy_pollset *ps);
+/* Move pollset from to pollset to, replacing all in to,
+ * leaving from empty. */
+void Curl_pollset_move(struct easy_pollset *to, struct easy_pollset *from);
+
+/* Change the poll flags (CURL_POLL_IN/CURL_POLL_OUT) to the poll set for
+ * socket `sock`. If the socket is not already part of the poll set, it
+ * will be added.
+ * If the socket is present and all poll flags are cleared, it will be removed.
+ */
+CURLcode Curl_pollset_change(struct Curl_easy *data,
+                             struct easy_pollset *ps, curl_socket_t sock,
+                             int add_flags,
+                             int remove_flags) WARN_UNUSED_RESULT;
+
+CURLcode Curl_pollset_set(struct Curl_easy *data,
+                          struct easy_pollset *ps, curl_socket_t sock,
+                          bool do_in, bool do_out) WARN_UNUSED_RESULT;
+
+#define Curl_pollset_add_in(data, ps, sock) \
+  Curl_pollset_change(data, ps, sock, CURL_POLL_IN, 0)
+#define Curl_pollset_remove_in(data, ps, sock) \
+  Curl_pollset_change(data, ps, sock, 0, CURL_POLL_IN)
+#define Curl_pollset_add_out(data, ps, sock) \
+  Curl_pollset_change(data, ps, sock, CURL_POLL_OUT, 0)
+#define Curl_pollset_remove_out(data, ps, sock) \
+  Curl_pollset_change(data, ps, sock, 0, CURL_POLL_OUT)
+#define Curl_pollset_add_inout(data, ps, sock) \
+  Curl_pollset_change(data, ps, sock, CURL_POLL_IN | CURL_POLL_OUT, 0)
+#define Curl_pollset_set_in_only(data, ps, sock) \
+  Curl_pollset_change(data, ps, sock, CURL_POLL_IN, CURL_POLL_OUT)
+#define Curl_pollset_set_out_only(data, ps, sock) \
+  Curl_pollset_change(data, ps, sock, CURL_POLL_OUT, CURL_POLL_IN)
+
+/* return < = on error, 0 on timeout or how many sockets are ready */
+int Curl_pollset_poll(struct Curl_easy *data,
+                      struct easy_pollset *ps,
+                      timediff_t timeout_ms);
+
+/**
+ * Check if the pollset, as is, wants to read and/or write regarding
+ * the given socket.
+ */
+void Curl_pollset_check(struct Curl_easy *data,
+                        struct easy_pollset *ps, curl_socket_t sock,
+                        bool *pwant_read, bool *pwant_write);
+
+/* TRUE if the pollset contains socket with CURL_POLL_IN. */
+bool Curl_pollset_want_recv(struct Curl_easy *data,
+                            struct easy_pollset *ps,
+                            curl_socket_t sock);
+/* TRUE if the pollset contains socket with CURL_POLL_OUT. */
+bool Curl_pollset_want_send(struct Curl_easy *data,
+                            struct easy_pollset *ps,
+                            curl_socket_t sock);
+
+struct curl_pollfds {
+  struct pollfd *pfds;
+  unsigned int n;
+  unsigned int count;
+  BIT(allocated_pfds);
+};
+
+void Curl_pollfds_init(struct curl_pollfds *cpfds,
+                       struct pollfd *static_pfds,
+                       unsigned int static_count);
+
+void Curl_pollfds_reset(struct curl_pollfds *cpfds);
+
+void Curl_pollfds_cleanup(struct curl_pollfds *cpfds);
+
+CURLcode Curl_pollfds_add_ps(struct curl_pollfds *cpfds,
+                             struct easy_pollset *ps);
+
+CURLcode Curl_pollfds_add_sock(struct curl_pollfds *cpfds,
+                               curl_socket_t sock, short events);
+
+struct Curl_waitfds {
+  struct curl_waitfd *wfds;
+  unsigned int n;
+  unsigned int count;
+};
+
+void Curl_waitfds_init(struct Curl_waitfds *cwfds,
+                       struct curl_waitfd *static_wfds,
+                       unsigned int static_count);
+
+unsigned int Curl_waitfds_add_ps(struct Curl_waitfds *cwfds,
+                                 struct easy_pollset *ps);
+
 #endif /* HEADER_CURL_SELECT_H */
diff --git a/third-party/curl/lib/sendf.c b/third-party/curl/lib/sendf.c
index d79ad08fa5..7559f64f84 100644
--- a/third-party/curl/lib/sendf.c
+++ b/third-party/curl/lib/sendf.c
@@ -21,7 +21,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef HAVE_NETINET_IN_H
@@ -34,406 +33,1446 @@
 #include <netinet/tcp.h>
 #endif
 
-#include <curl/curl.h>
-
 #include "urldata.h"
 #include "sendf.h"
+#include "curl_trc.h"
+#include "transfer.h"
 #include "cfilters.h"
 #include "connect.h"
-#include "vtls/vtls.h"
-#include "vssh/ssh.h"
-#include "easyif.h"
+#include "cw-out.h"
+#include "cw-pause.h"
 #include "multiif.h"
-#include "strerror.h"
-#include "select.h"
-#include "strdup.h"
-#include "http2.h"
-#include "headers.h"
-#include "ws.h"
+#include "progress.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-#if defined(CURL_DO_LINEEND_CONV) && !defined(CURL_DISABLE_FTP)
-/*
- * convert_lineends() changes CRLF (\r\n) end-of-line markers to a single LF
- * (\n), with special processing for CRLF sequences that are split between two
- * blocks of data.  Remaining, bare CRs are changed to LFs.  The possibly new
- * size of the data is returned.
- */
-static size_t convert_lineends(struct Curl_easy *data,
-                               char *startPtr, size_t size)
+static void cl_reset_writer(struct Curl_easy *data)
 {
-  char *inPtr, *outPtr;
-
-  /* sanity check */
-  if(!startPtr || (size < 1)) {
-    return size;
+  struct Curl_cwriter *writer = data->req.writer_stack;
+  while(writer) {
+    data->req.writer_stack = writer->next;
+    writer->cwt->do_close(data, writer);
+    curlx_free(writer);
+    writer = data->req.writer_stack;
   }
-
-  if(data->state.prev_block_had_trailing_cr) {
-    /* The previous block of incoming data
-       had a trailing CR, which was turned into a LF. */
-    if(*startPtr == '\n') {
-      /* This block of incoming data starts with the
-         previous block's LF so get rid of it */
-      memmove(startPtr, startPtr + 1, size-1);
-      size--;
-      /* and it wasn't a bare CR but a CRLF conversion instead */
-      data->state.crlf_conversions++;
-    }
-    data->state.prev_block_had_trailing_cr = FALSE; /* reset the flag */
-  }
-
-  /* find 1st CR, if any */
-  inPtr = outPtr = memchr(startPtr, '\r', size);
-  if(inPtr) {
-    /* at least one CR, now look for CRLF */
-    while(inPtr < (startPtr + size-1)) {
-      /* note that it's size-1, so we'll never look past the last byte */
-      if(memcmp(inPtr, "\r\n", 2) == 0) {
-        /* CRLF found, bump past the CR and copy the NL */
-        inPtr++;
-        *outPtr = *inPtr;
-        /* keep track of how many CRLFs we converted */
-        data->state.crlf_conversions++;
-      }
-      else {
-        if(*inPtr == '\r') {
-          /* lone CR, move LF instead */
-          *outPtr = '\n';
-        }
-        else {
-          /* not a CRLF nor a CR, just copy whatever it is */
-          *outPtr = *inPtr;
-        }
-      }
-      outPtr++;
-      inPtr++;
-    } /* end of while loop */
-
-    if(inPtr < startPtr + size) {
-      /* handle last byte */
-      if(*inPtr == '\r') {
-        /* deal with a CR at the end of the buffer */
-        *outPtr = '\n'; /* copy a NL instead */
-        /* note that a CRLF might be split across two blocks */
-        data->state.prev_block_had_trailing_cr = TRUE;
-      }
-      else {
-        /* copy last byte */
-        *outPtr = *inPtr;
-      }
-      outPtr++;
-    }
-    if(outPtr < startPtr + size)
-      /* tidy up by null terminating the now shorter data */
-      *outPtr = '\0';
-
-    return (outPtr - startPtr);
-  }
-  return size;
 }
-#endif /* CURL_DO_LINEEND_CONV && !CURL_DISABLE_FTP */
 
-/*
- * Curl_nwrite() is an internal write function that sends data to the
- * server. Works with a socket index for the connection.
- *
- * If the write would block (CURLE_AGAIN), it returns CURLE_OK and
- * (*nwritten == 0). Otherwise we return regular CURLcode value.
- */
-CURLcode Curl_nwrite(struct Curl_easy *data,
-                     int sockindex,
-                     const void *buf,
-                     size_t blen,
-                     ssize_t *pnwritten)
+static void cl_reset_reader(struct Curl_easy *data)
 {
-  ssize_t nwritten;
-  CURLcode result = CURLE_OK;
-  struct connectdata *conn;
+  struct Curl_creader *reader = data->req.reader_stack;
+  data->req.reader_started = FALSE;
+  while(reader) {
+    data->req.reader_stack = reader->next;
+    reader->crt->do_close(data, reader);
+    curlx_free(reader);
+    reader = data->req.reader_stack;
+  }
+}
 
-  DEBUGASSERT(sockindex >= 0 && sockindex < 2);
-  DEBUGASSERT(pnwritten);
-  DEBUGASSERT(data);
-  DEBUGASSERT(data->conn);
-  conn = data->conn;
-#ifdef CURLDEBUG
-  {
-    /* Allow debug builds to override this logic to force short sends
-    */
-    char *p = getenv("CURL_SMALLSENDS");
-    if(p) {
-      size_t altsize = (size_t)strtoul(p, NULL, 10);
-      if(altsize)
-        blen = CURLMIN(blen, altsize);
-    }
-  }
-#endif
-  nwritten = conn->send[sockindex](data, sockindex, buf, blen, &result);
-  if(result == CURLE_AGAIN) {
-    nwritten = 0;
-    result = CURLE_OK;
-  }
-  else if(result) {
-    nwritten = -1; /* make sure */
+void Curl_client_cleanup(struct Curl_easy *data)
+{
+  cl_reset_reader(data);
+  cl_reset_writer(data);
+
+  data->req.bytecount = 0;
+  data->req.headerline = 0;
+}
+
+void Curl_client_reset(struct Curl_easy *data)
+{
+  if(data->req.rewind_read) {
+    /* already requested */
+    CURL_TRC_READ(data, "client_reset, will rewind reader");
   }
   else {
-    DEBUGASSERT(nwritten >= 0);
+    CURL_TRC_READ(data, "client_reset, clear readers");
+    cl_reset_reader(data);
   }
+  cl_reset_writer(data);
 
-  *pnwritten = nwritten;
-  return result;
+  data->req.bytecount = 0;
+  data->req.headerline = 0;
 }
 
-/*
- * Curl_write() is an internal write function that sends data to the
- * server. Works with plain sockets, SCP, SSL or kerberos.
- *
- * If the write would block (CURLE_AGAIN), we return CURLE_OK and
- * (*written == 0). Otherwise we return regular CURLcode value.
- */
-CURLcode Curl_write(struct Curl_easy *data,
-                    curl_socket_t sockfd,
-                    const void *mem,
-                    size_t len,
-                    ssize_t *written)
+CURLcode Curl_client_start(struct Curl_easy *data)
 {
-  struct connectdata *conn;
-  int num;
+  if(data->req.rewind_read) {
+    struct Curl_creader *r = data->req.reader_stack;
+    CURLcode result = CURLE_OK;
 
-  DEBUGASSERT(data);
-  DEBUGASSERT(data->conn);
-  conn = data->conn;
-  num = (sockfd != CURL_SOCKET_BAD && sockfd == conn->sock[SECONDARYSOCKET]);
-  return Curl_nwrite(data, num, mem, len, written);
-}
-
-static CURLcode pausewrite(struct Curl_easy *data,
-                           int type, /* what type of data */
-                           const char *ptr,
-                           size_t len)
-{
-  /* signalled to pause sending on this connection, but since we have data
-     we want to send we need to dup it to save a copy for when the sending
-     is again enabled */
-  struct SingleRequest *k = &data->req;
-  struct UrlState *s = &data->state;
-  unsigned int i;
-  bool newtype = TRUE;
-
-  Curl_conn_ev_data_pause(data, TRUE);
-
-  if(s->tempcount) {
-    for(i = 0; i< s->tempcount; i++) {
-      if(s->tempwrite[i].type == type) {
-        /* data for this type exists */
-        newtype = FALSE;
-        break;
+    CURL_TRC_READ(data, "client start, rewind readers");
+    while(r) {
+      result = r->crt->cntrl(data, r, CURL_CRCNTRL_REWIND);
+      if(result) {
+        failf(data, "rewind of client reader '%s' failed: %d",
+              r->crt->name, (int)result);
+        return result;
       }
+      r = r->next;
     }
-    DEBUGASSERT(i < 3);
-    if(i >= 3)
-      /* There are more types to store than what fits: very bad */
-      return CURLE_OUT_OF_MEMORY;
+    data->req.rewind_read = FALSE;
+    cl_reset_reader(data);
   }
-  else
-    i = 0;
-
-  if(newtype) {
-    /* store this information in the state struct for later use */
-    Curl_dyn_init(&s->tempwrite[i].b, DYN_PAUSE_BUFFER);
-    s->tempwrite[i].type = type;
-    s->tempcount++;
-  }
-
-  if(Curl_dyn_addn(&s->tempwrite[i].b, (unsigned char *)ptr, len))
-    return CURLE_OUT_OF_MEMORY;
-
-  /* mark the connection as RECV paused */
-  k->keepon |= KEEP_RECV_PAUSE;
-
   return CURLE_OK;
 }
 
-
-/* chop_write() writes chunks of data not larger than CURL_MAX_WRITE_SIZE via
- * client write callback(s) and takes care of pause requests from the
- * callbacks.
- */
-static CURLcode chop_write(struct Curl_easy *data,
-                           int type,
-                           char *optr,
-                           size_t olen)
+bool Curl_creader_will_rewind(struct Curl_easy *data)
 {
-  struct connectdata *conn = data->conn;
-  curl_write_callback writeheader = NULL;
-  curl_write_callback writebody = NULL;
-  char *ptr = optr;
-  size_t len = olen;
-  void *writebody_ptr = data->set.out;
+  return (bool)data->req.rewind_read;
+}
 
-  if(!len)
-    return CURLE_OK;
+void Curl_creader_set_rewind(struct Curl_easy *data, bool enable)
+{
+  data->req.rewind_read = !!enable;
+}
 
-  /* If reading is paused, append this data to the already held data for this
-     type. */
-  if(data->req.keepon & KEEP_RECV_PAUSE)
-    return pausewrite(data, type, ptr, len);
+/* Write data using an unencoding writer stack. */
+CURLcode Curl_cwriter_write(struct Curl_easy *data,
+                            struct Curl_cwriter *writer, int type,
+                            const char *buf, size_t nbytes)
+{
+  if(!writer)
+    return CURLE_WRITE_ERROR;
+  return writer->cwt->do_write(data, writer, type, buf, nbytes);
+}
 
-  /* Determine the callback(s) to use. */
-  if(type & CLIENTWRITE_BODY) {
-#ifdef USE_WEBSOCKETS
-    if(conn->handler->protocol & (CURLPROTO_WS|CURLPROTO_WSS)) {
-      writebody = Curl_ws_writecb;
-      writebody_ptr = data;
-    }
-    else
-#endif
-    writebody = data->set.fwrite_func;
+CURLcode Curl_cwriter_def_init(struct Curl_easy *data,
+                               struct Curl_cwriter *writer)
+{
+  (void)data;
+  (void)writer;
+  return CURLE_OK;
+}
+
+CURLcode Curl_cwriter_def_write(struct Curl_easy *data,
+                                struct Curl_cwriter *writer, int type,
+                                const char *buf, size_t nbytes)
+{
+  return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
+}
+
+void Curl_cwriter_def_close(struct Curl_easy *data,
+                            struct Curl_cwriter *writer)
+{
+  (void)data;
+  (void)writer;
+}
+
+static size_t get_max_body_write_len(struct Curl_easy *data, curl_off_t limit)
+{
+  if(limit != -1) {
+    /* How much more are we allowed to write? */
+    return curlx_sotouz_range(limit - data->req.bytecount, 0, SIZE_MAX);
   }
-  if((type & CLIENTWRITE_HEADER) &&
-     (data->set.fwrite_header || data->set.writeheader)) {
-    /*
-     * Write headers to the same callback or to the especially setup
-     * header callback function (added after version 7.7.1).
-     */
-    writeheader =
-      data->set.fwrite_header? data->set.fwrite_header: data->set.fwrite_func;
+  return SIZE_MAX;
+}
+
+struct cw_download_ctx {
+  struct Curl_cwriter super;
+  BIT(started_response);
+  BIT(started_body);
+};
+
+/* Download client writer in phase CURL_CW_PROTOCOL that
+ * sees the "real" download body data. */
+static CURLcode cw_download_write(struct Curl_easy *data,
+                                  struct Curl_cwriter *writer, int type,
+                                  const char *buf, size_t nbytes)
+{
+  struct cw_download_ctx *ctx = writer->ctx;
+  CURLcode result;
+  size_t nwrite, excess_len = 0;
+  bool is_connect = !!(type & CLIENTWRITE_CONNECT);
+
+  if(!ctx->started_response &&
+     !(type & CLIENTWRITE_CONNECT) &&
+     (!(type & CLIENTWRITE_INFO) || data->req.upload_done)) {
+    Curl_pgrsTime(data, TIMER_STARTTRANSFER);
+    ctx->started_response = TRUE;
   }
 
-  /* Chop data, write chunks. */
-  while(len) {
-    size_t chunklen = len <= CURL_MAX_WRITE_SIZE? len: CURL_MAX_WRITE_SIZE;
+  if(!(type & CLIENTWRITE_BODY)) {
+    if(is_connect && data->set.suppress_connect_headers)
+      return CURLE_OK;
+    result = Curl_cwriter_write(data, writer->next, type, buf, nbytes);
+    CURL_TRC_WRITE(data, "download_write header(type=%x, blen=%zu) -> %d",
+                   (unsigned int)type, nbytes, (int)result);
+    return result;
+  }
 
-    if(writebody) {
-      size_t wrote;
-      Curl_set_in_callback(data, true);
-      wrote = writebody(ptr, 1, chunklen, writebody_ptr);
-      Curl_set_in_callback(data, false);
+  if(!ctx->started_body &&
+     !(type & (CLIENTWRITE_INFO | CLIENTWRITE_CONNECT))) {
+    Curl_rlimit_start(&data->progress.dl.rlimit, Curl_pgrs_now(data),
+                      data->req.size);
+    ctx->started_body = TRUE;
+  }
 
-      if(CURL_WRITEFUNC_PAUSE == wrote) {
-        if(conn->handler->flags & PROTOPT_NONETWORK) {
-          /* Protocols that work without network cannot be paused. This is
-             actually only FILE:// just now, and it can't pause since the
-             transfer isn't done using the "normal" procedure. */
-          failf(data, "Write callback asked for PAUSE when not supported");
-          return CURLE_WRITE_ERROR;
-        }
-        return pausewrite(data, type, ptr, len);
-      }
-      if(wrote != chunklen) {
-        failf(data, "Failure writing output to destination");
-        return CURLE_WRITE_ERROR;
-      }
+  /* Here, we deal with REAL BODY bytes. All filtering and transfer
+   * encodings have been applied and only the true content, e.g. BODY,
+   * bytes are passed here.
+   * This allows us to check sizes, update stats, etc. independent
+   * from the protocol in play. */
+
+  if(data->req.no_body && nbytes > 0) {
+    /* BODY arrives although we want none, bail out */
+    streamclose(data->conn, "ignoring body");
+    CURL_TRC_WRITE(data, "download_write body(type=%x, blen=%zu), "
+                   "did not want a BODY", (unsigned int)type, nbytes);
+    data->req.download_done = TRUE;
+    if(data->info.header_size)
+      /* if headers have been received, this is fine */
+      return CURLE_OK;
+    return CURLE_WEIRD_SERVER_REPLY;
+  }
+
+  /* Determine if we see any bytes in excess to what is allowed.
+   * We write the allowed bytes and handle excess further below.
+   * This gives deterministic BODY writes on varying buffer receive
+   * lengths. */
+  nwrite = nbytes;
+  if(data->req.maxdownload != -1) {
+    size_t wmax = get_max_body_write_len(data, data->req.maxdownload);
+    if(nwrite > wmax) {
+      excess_len = nbytes - wmax;
+      nwrite = wmax;
     }
 
-    ptr += chunklen;
-    len -= chunklen;
+    if(nwrite == wmax) {
+      data->req.download_done = TRUE;
+    }
+
+    if((type & CLIENTWRITE_EOS) && !data->req.no_body &&
+       (data->req.size > data->req.bytecount)) {
+      failf(data, "end of response with %" FMT_OFF_T " bytes missing",
+            data->req.size - data->req.bytecount);
+      return CURLE_PARTIAL_FILE;
+    }
   }
 
-#ifndef CURL_DISABLE_HTTP
-  /* HTTP header, but not status-line */
-  if((conn->handler->protocol & PROTO_FAMILY_HTTP) &&
-     (type & CLIENTWRITE_HEADER) && !(type & CLIENTWRITE_STATUS) ) {
-    unsigned char htype = (unsigned char)
-      (type & CLIENTWRITE_CONNECT ? CURLH_CONNECT :
-       (type & CLIENTWRITE_1XX ? CURLH_1XX :
-        (type & CLIENTWRITE_TRAILER ? CURLH_TRAILER :
-         CURLH_HEADER)));
-    CURLcode result = Curl_headers_push(data, optr, htype);
+  /* Error on too large filesize is handled below, after writing
+   * the permitted bytes */
+  if(data->set.max_filesize && !data->req.ignorebody) {
+    size_t wmax = get_max_body_write_len(data, data->set.max_filesize);
+    if(nwrite > wmax) {
+      nwrite = wmax;
+    }
+  }
+
+  if(!data->req.ignorebody && (nwrite || (type & CLIENTWRITE_EOS))) {
+    result = Curl_cwriter_write(data, writer->next, type, buf, nwrite);
+    CURL_TRC_WRITE(data, "download_write body(type=%x, blen=%zu) -> %d",
+                   (unsigned int)type, nbytes, (int)result);
     if(result)
       return result;
   }
-#endif
 
-  if(writeheader) {
-    size_t wrote;
+  /* Update stats, write and report progress */
+  if(nwrite) {
+    data->req.bytecount += nwrite;
+    Curl_pgrs_download_inc(data, nwrite);
+  }
 
-    Curl_set_in_callback(data, true);
-    wrote = writeheader(optr, 1, olen, data->set.writeheader);
-    Curl_set_in_callback(data, false);
-
-    if(CURL_WRITEFUNC_PAUSE == wrote)
-      /* here we pass in the HEADER bit only since if this was body as well
-         then it was passed already and clearly that didn't trigger the
-         pause, so this is saved for later with the HEADER bit only */
-      return pausewrite(data, CLIENTWRITE_HEADER |
-                        (type & (CLIENTWRITE_STATUS|CLIENTWRITE_CONNECT|
-                                 CLIENTWRITE_1XX|CLIENTWRITE_TRAILER)),
-                        optr, olen);
-    if(wrote != olen) {
-      failf(data, "Failed writing header");
-      return CURLE_WRITE_ERROR;
+  if(excess_len) {
+    if(!data->req.ignorebody) {
+      infof(data,
+            "Excess found writing body:"
+            " excess = %zu"
+            ", size = %" FMT_OFF_T
+            ", maxdownload = %" FMT_OFF_T
+            ", bytecount = %" FMT_OFF_T,
+            excess_len, data->req.size, data->req.maxdownload,
+            data->req.bytecount);
+      connclose(data->conn, "excess found in a read");
     }
   }
+  else if((nwrite < nbytes) && !data->req.ignorebody) {
+    failf(data, "Exceeded the maximum allowed file size "
+          "(%" FMT_OFF_T ") with %" FMT_OFF_T " bytes",
+          data->set.max_filesize, data->req.bytecount);
+    return CURLE_FILESIZE_EXCEEDED;
+  }
 
   return CURLE_OK;
 }
 
+static const struct Curl_cwtype cw_download = {
+  "protocol",
+  NULL,
+  Curl_cwriter_def_init,
+  cw_download_write,
+  Curl_cwriter_def_close,
+  sizeof(struct cw_download_ctx)
+};
+
+/* RAW client writer in phase CURL_CW_RAW that
+ * enabled tracing of raw data. */
+static CURLcode cw_raw_write(struct Curl_easy *data,
+                             struct Curl_cwriter *writer, int type,
+                             const char *buf, size_t nbytes)
+{
+  if(type & CLIENTWRITE_BODY && data->set.verbose && !data->req.ignorebody) {
+    Curl_debug(data, CURLINFO_DATA_IN, buf, nbytes);
+  }
+  return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
+}
+
+static const struct Curl_cwtype cw_raw = {
+  "raw",
+  NULL,
+  Curl_cwriter_def_init,
+  cw_raw_write,
+  Curl_cwriter_def_close,
+  sizeof(struct Curl_cwriter)
+};
+
+static CURLcode do_init_writer_stack(struct Curl_easy *data)
+{
+  struct Curl_cwriter *writer;
+  CURLcode result;
+
+  DEBUGASSERT(!data->req.writer_stack);
+  result = Curl_cwriter_create(&data->req.writer_stack,
+                               data, &Curl_cwt_out, CURL_CW_CLIENT);
+  if(result)
+    return result;
+
+  /* This places the "pause" writer behind the "download" writer that
+   * is added below. Meaning the "download" can do checks on content length
+   * and other things *before* write outs are buffered for paused transfers. */
+  result = Curl_cwriter_create(&writer, data, &Curl_cwt_pause,
+                               CURL_CW_PROTOCOL);
+  if(!result) {
+    result = Curl_cwriter_add(data, writer);
+    if(result)
+      Curl_cwriter_free(data, writer);
+  }
+  if(result)
+    return result;
+
+  result = Curl_cwriter_create(&writer, data, &cw_download, CURL_CW_PROTOCOL);
+  if(!result) {
+    result = Curl_cwriter_add(data, writer);
+    if(result)
+      Curl_cwriter_free(data, writer);
+  }
+  if(result)
+    return result;
+
+  result = Curl_cwriter_create(&writer, data, &cw_raw, CURL_CW_RAW);
+  if(!result) {
+    result = Curl_cwriter_add(data, writer);
+    if(result)
+      Curl_cwriter_free(data, writer);
+  }
+  if(result)
+    return result;
+
+  return result;
+}
 
 /* Curl_client_write() sends data to the write callback(s)
 
    The bit pattern defines to what "streams" to write to. Body and/or header.
    The defines are in sendf.h of course.
-
-   If CURL_DO_LINEEND_CONV is enabled, data is converted IN PLACE to the
-   local character encoding.  This is a problem and should be changed in
-   the future to leave the original data alone.
  */
-CURLcode Curl_client_write(struct Curl_easy *data,
-                           int type,
-                           char *ptr,
+CURLcode Curl_client_write(struct Curl_easy *data, int type, const char *buf,
                            size_t len)
 {
-#if !defined(CURL_DISABLE_FTP) && defined(CURL_DO_LINEEND_CONV)
-  /* FTP data may need conversion. */
-  if((type & CLIENTWRITE_BODY) &&
-     (data->conn->handler->protocol & PROTO_FAMILY_FTP) &&
-     data->conn->proto.ftpc.transfertype == 'A') {
-    /* convert end-of-line markers */
-    len = convert_lineends(data, ptr, len);
+  CURLcode result;
+
+  /* it is one of those, at least */
+  DEBUGASSERT(type &
+              (CLIENTWRITE_BODY | CLIENTWRITE_HEADER | CLIENTWRITE_INFO));
+  /* BODY is only BODY (with optional EOS) */
+  DEBUGASSERT(!(type & CLIENTWRITE_BODY) ||
+              ((type & ~(CLIENTWRITE_BODY | CLIENTWRITE_EOS)) == 0));
+  /* INFO is only INFO (with optional EOS) */
+  DEBUGASSERT(!(type & CLIENTWRITE_INFO) ||
+              ((type & ~(CLIENTWRITE_INFO | CLIENTWRITE_EOS)) == 0));
+
+  if(!data->req.writer_stack) {
+    result = do_init_writer_stack(data);
+    if(result)
+      return result;
+    DEBUGASSERT(data->req.writer_stack);
   }
-#endif
-  return chop_write(data, type, ptr, len);
-}
 
-/*
- * Internal read-from-socket function. This is meant to deal with plain
- * sockets, SSL sockets and kerberos sockets.
- *
- * Returns a regular CURLcode value.
- */
-CURLcode Curl_read(struct Curl_easy *data,   /* transfer */
-                   curl_socket_t sockfd,     /* read from this socket */
-                   char *buf,                /* store read data here */
-                   size_t sizerequested,     /* max amount to read */
-                   ssize_t *n)               /* amount bytes read */
-{
-  CURLcode result = CURLE_RECV_ERROR;
-  ssize_t nread = 0;
-  size_t bytesfromsocket = 0;
-  char *buffertofill = NULL;
-  struct connectdata *conn = data->conn;
-
-  /* Set 'num' to 0 or 1, depending on which socket that has been sent here.
-     If it is the second socket, we set num to 1. Otherwise to 0. This lets
-     us use the correct ssl handle. */
-  int num = (sockfd == conn->sock[SECONDARYSOCKET]);
-
-  *n = 0; /* reset amount to zero */
-
-  bytesfromsocket = CURLMIN(sizerequested, (size_t)data->set.buffer_size);
-  buffertofill = buf;
-
-  nread = conn->recv[num](data, num, buffertofill, bytesfromsocket, &result);
-  if(nread < 0)
-    goto out;
-
-  *n += nread;
-  result = CURLE_OK;
-out:
+  result = Curl_cwriter_write(data, data->req.writer_stack, type, buf, len);
+  CURL_TRC_WRITE(data, "client_write(type=%x, len=%zu) -> %d",
+                 (unsigned int)type, len, (int)result);
   return result;
 }
+
+/* Create an unencoding writer stage using the given handler. */
+CURLcode Curl_cwriter_create(struct Curl_cwriter **pwriter,
+                             struct Curl_easy *data,
+                             const struct Curl_cwtype *cwt,
+                             Curl_cwriter_phase phase)
+{
+  struct Curl_cwriter *writer = NULL;
+  CURLcode result = CURLE_OUT_OF_MEMORY;
+  void *p;
+
+  DEBUGASSERT(cwt->cwriter_size >= sizeof(struct Curl_cwriter));
+  p = curlx_calloc(1, cwt->cwriter_size);
+  if(!p)
+    goto out;
+
+  writer = (struct Curl_cwriter *)p;
+  writer->cwt = cwt;
+  writer->ctx = p;
+  writer->phase = phase;
+  result = cwt->do_init(data, writer);
+
+out:
+  *pwriter = result ? NULL : writer;
+  if(result)
+    curlx_free(writer);
+  return result;
+}
+
+void Curl_cwriter_free(struct Curl_easy *data,
+                       struct Curl_cwriter *writer)
+{
+  if(writer) {
+    writer->cwt->do_close(data, writer);
+    curlx_free(writer);
+  }
+}
+
+size_t Curl_cwriter_count(struct Curl_easy *data, Curl_cwriter_phase phase)
+{
+  struct Curl_cwriter *w;
+  size_t n = 0;
+
+  for(w = data->req.writer_stack; w; w = w->next) {
+    if(w->phase == phase)
+      ++n;
+  }
+  return n;
+}
+
+CURLcode Curl_cwriter_add(struct Curl_easy *data,
+                          struct Curl_cwriter *writer)
+{
+  CURLcode result;
+  struct Curl_cwriter **anchor = &data->req.writer_stack;
+
+  if(!*anchor) {
+    result = do_init_writer_stack(data);
+    if(result)
+      return result;
+  }
+
+  /* Insert the writer as first in its phase.
+   * Skip existing writers of lower phases. */
+  while(*anchor && (*anchor)->phase < writer->phase)
+    anchor = &((*anchor)->next);
+  writer->next = *anchor;
+  *anchor = writer;
+  return CURLE_OK;
+}
+
+struct Curl_cwriter *Curl_cwriter_get_by_name(struct Curl_easy *data,
+                                              const char *name)
+{
+  struct Curl_cwriter *writer;
+  for(writer = data->req.writer_stack; writer; writer = writer->next) {
+    if(!strcmp(name, writer->cwt->name))
+      return writer;
+  }
+  return NULL;
+}
+
+struct Curl_cwriter *Curl_cwriter_get_by_type(struct Curl_easy *data,
+                                              const struct Curl_cwtype *cwt)
+{
+  struct Curl_cwriter *writer;
+  for(writer = data->req.writer_stack; writer; writer = writer->next) {
+    if(writer->cwt == cwt)
+      return writer;
+  }
+  return NULL;
+}
+
+bool Curl_cwriter_is_content_decoding(struct Curl_easy *data)
+{
+  struct Curl_cwriter *writer;
+  for(writer = data->req.writer_stack; writer; writer = writer->next) {
+    if(writer->phase == CURL_CW_CONTENT_DECODE)
+      return TRUE;
+  }
+  return FALSE;
+}
+
+bool Curl_cwriter_is_paused(struct Curl_easy *data)
+{
+  return Curl_cw_out_is_paused(data);
+}
+
+CURLcode Curl_cwriter_unpause(struct Curl_easy *data)
+{
+  return Curl_cw_out_unpause(data);
+}
+
+CURLcode Curl_creader_read(struct Curl_easy *data,
+                           struct Curl_creader *reader,
+                           char *buf, size_t blen, size_t *nread, bool *eos)
+{
+  *nread = 0;
+  *eos = FALSE;
+  if(!reader)
+    return CURLE_READ_ERROR;
+  return reader->crt->do_read(data, reader, buf, blen, nread, eos);
+}
+
+void Curl_creader_clear_eos(struct Curl_easy *data,
+                            struct Curl_creader *reader)
+{
+  while(reader) {
+    (void)reader->crt->cntrl(data, reader, CURL_CRCNTRL_CLEAR_EOS);
+    reader = reader->next;
+  }
+}
+
+CURLcode Curl_creader_def_init(struct Curl_easy *data,
+                               struct Curl_creader *reader)
+{
+  (void)data;
+  (void)reader;
+  return CURLE_OK;
+}
+
+void Curl_creader_def_close(struct Curl_easy *data,
+                            struct Curl_creader *reader)
+{
+  (void)data;
+  (void)reader;
+}
+
+CURLcode Curl_creader_def_read(struct Curl_easy *data,
+                               struct Curl_creader *reader,
+                               char *buf, size_t blen,
+                               size_t *nread, bool *eos)
+{
+  if(reader->next)
+    return reader->next->crt->do_read(data, reader->next, buf, blen,
+                                      nread, eos);
+  else {
+    *nread = 0;
+    *eos = FALSE;
+    return CURLE_READ_ERROR;
+  }
+}
+
+bool Curl_creader_def_needs_rewind(struct Curl_easy *data,
+                                   struct Curl_creader *reader)
+{
+  (void)data;
+  (void)reader;
+  return FALSE;
+}
+
+curl_off_t Curl_creader_def_total_length(struct Curl_easy *data,
+                                         struct Curl_creader *reader)
+{
+  return reader->next ?
+         reader->next->crt->total_length(data, reader->next) : -1;
+}
+
+CURLcode Curl_creader_def_resume_from(struct Curl_easy *data,
+                                      struct Curl_creader *reader,
+                                      curl_off_t offset)
+{
+  (void)data;
+  (void)reader;
+  (void)offset;
+  return CURLE_READ_ERROR;
+}
+
+CURLcode Curl_creader_def_cntrl(struct Curl_easy *data,
+                                struct Curl_creader *reader,
+                                Curl_creader_cntrl opcode)
+{
+  (void)data;
+  (void)reader;
+  (void)opcode;
+  return CURLE_OK;
+}
+
+bool Curl_creader_def_is_paused(struct Curl_easy *data,
+                                struct Curl_creader *reader)
+{
+  (void)data;
+  (void)reader;
+  return FALSE;
+}
+
+void Curl_creader_def_done(struct Curl_easy *data,
+                           struct Curl_creader *reader, int premature)
+{
+  (void)data;
+  (void)reader;
+  (void)premature;
+}
+
+struct cr_in_ctx {
+  struct Curl_creader super;
+  curl_read_callback read_cb;
+  void *cb_user_data;
+  curl_off_t total_len;
+  curl_off_t read_len;
+  CURLcode error_result;
+  BIT(seen_eos);
+  BIT(errored);
+  BIT(has_used_cb);
+  BIT(is_paused);
+};
+
+static CURLcode cr_in_init(struct Curl_easy *data, struct Curl_creader *reader)
+{
+  struct cr_in_ctx *ctx = reader->ctx;
+  ctx->read_cb = data->state.fread_func;
+  ctx->cb_user_data = data->state.in;
+  ctx->total_len = -1;
+  ctx->read_len = 0;
+  return CURLE_OK;
+}
+
+/* Real client reader to installed client callbacks. */
+static CURLcode cr_in_read(struct Curl_easy *data,
+                           struct Curl_creader *reader,
+                           char *buf, size_t blen,
+                           size_t *pnread, bool *peos)
+{
+  struct cr_in_ctx *ctx = reader->ctx;
+  CURLcode result = CURLE_OK;
+  size_t nread;
+
+  ctx->is_paused = FALSE;
+
+  /* Once we have errored, we will return the same error forever */
+  if(ctx->errored) {
+    *pnread = 0;
+    *peos = FALSE;
+    return ctx->error_result;
+  }
+  if(ctx->seen_eos) {
+    *pnread = 0;
+    *peos = TRUE;
+    return CURLE_OK;
+  }
+  /* respect length limitations */
+  if(ctx->total_len >= 0) {
+    blen = curlx_sotouz_range(ctx->total_len - ctx->read_len, 0, blen);
+  }
+  nread = 0;
+  if(ctx->read_cb && blen) {
+    Curl_set_in_callback(data, TRUE);
+    nread = ctx->read_cb(buf, 1, blen, ctx->cb_user_data);
+    Curl_set_in_callback(data, FALSE);
+    ctx->has_used_cb = TRUE;
+  }
+
+  switch(nread) {
+  case 0:
+    if((ctx->total_len >= 0) && (ctx->read_len < ctx->total_len)) {
+      failf(data, "client read function EOF fail, "
+            "only %" FMT_OFF_T "/%" FMT_OFF_T " of needed bytes read",
+            ctx->read_len, ctx->total_len);
+      result = CURLE_READ_ERROR;
+      break;
+    }
+    *pnread = 0;
+    *peos = TRUE;
+    ctx->seen_eos = TRUE;
+    break;
+
+  case CURL_READFUNC_ABORT:
+    failf(data, "operation aborted by callback");
+    *pnread = 0;
+    *peos = FALSE;
+    ctx->errored = TRUE;
+    ctx->error_result = CURLE_ABORTED_BY_CALLBACK;
+    result = CURLE_ABORTED_BY_CALLBACK;
+    break;
+
+  case CURL_READFUNC_PAUSE:
+    if(data->conn->scheme->flags & PROTOPT_NONETWORK) {
+      /* protocols that work without network cannot be paused. This is
+         actually only file:// now, and it cannot pause since the transfer
+         is not done using the "normal" procedure. */
+      failf(data, "Read callback asked for PAUSE when not supported");
+      result = CURLE_READ_ERROR;
+      break;
+    }
+    /* CURL_READFUNC_PAUSE pauses read callbacks that feed socket writes */
+    CURL_TRC_READ(data, "cr_in_read, callback returned CURL_READFUNC_PAUSE");
+    ctx->is_paused = TRUE;
+    *pnread = 0;
+    *peos = FALSE;
+    result = Curl_xfer_pause_send(data, TRUE);
+    break; /* nothing was read */
+
+  default:
+    if(nread > blen) {
+      /* the read function returned a too large value */
+      failf(data, "read function returned funny value");
+      *pnread = 0;
+      *peos = FALSE;
+      ctx->errored = TRUE;
+      ctx->error_result = CURLE_READ_ERROR;
+      result = CURLE_READ_ERROR;
+      break;
+    }
+    ctx->read_len += nread;
+    if(ctx->total_len >= 0)
+      ctx->seen_eos = (ctx->read_len >= ctx->total_len);
+    *pnread = nread;
+    *peos = (bool)ctx->seen_eos;
+    break;
+  }
+  CURL_TRC_READ(data, "cr_in_read(len=%zu, total=%" FMT_OFF_T
+                ", read=%" FMT_OFF_T ") -> %d, nread=%zu, eos=%d",
+                blen, ctx->total_len, ctx->read_len, (int)result,
+                *pnread, *peos);
+  return result;
+}
+
+static bool cr_in_needs_rewind(struct Curl_easy *data,
+                               struct Curl_creader *reader)
+{
+  struct cr_in_ctx *ctx = reader->ctx;
+  (void)data;
+  return (bool)ctx->has_used_cb;
+}
+
+static curl_off_t cr_in_total_length(struct Curl_easy *data,
+                                     struct Curl_creader *reader)
+{
+  struct cr_in_ctx *ctx = reader->ctx;
+  (void)data;
+  return ctx->total_len;
+}
+
+static CURLcode cr_in_resume_from(struct Curl_easy *data,
+                                  struct Curl_creader *reader,
+                                  curl_off_t offset)
+{
+  struct cr_in_ctx *ctx = reader->ctx;
+  int seekerr = CURL_SEEKFUNC_CANTSEEK;
+
+  DEBUGASSERT(data->conn);
+  /* already started reading? */
+  if(ctx->read_len)
+    return CURLE_READ_ERROR;
+
+  if(data->set.seek_func) {
+    Curl_set_in_callback(data, TRUE);
+    seekerr = data->set.seek_func(data->set.seek_client, offset, SEEK_SET);
+    Curl_set_in_callback(data, FALSE);
+  }
+
+  if(seekerr != CURL_SEEKFUNC_OK) {
+    curl_off_t passed = 0;
+
+    if(seekerr != CURL_SEEKFUNC_CANTSEEK) {
+      failf(data, "Could not seek stream");
+      return CURLE_READ_ERROR;
+    }
+    /* when seekerr == CURL_SEEKFUNC_CANTSEEK (cannot seek to offset) */
+    do {
+      char scratch[4 * 1024];
+      size_t readthisamountnow =
+        (offset - passed > (curl_off_t)sizeof(scratch)) ?
+        sizeof(scratch) :
+        curlx_sotouz(offset - passed);
+      size_t actuallyread;
+
+      Curl_set_in_callback(data, TRUE);
+      actuallyread = ctx->read_cb(scratch, 1, readthisamountnow,
+                                  ctx->cb_user_data);
+      Curl_set_in_callback(data, FALSE);
+
+      passed += actuallyread;
+      if((actuallyread == 0) || (actuallyread > readthisamountnow)) {
+        /* this checks for greater-than only to make sure that the
+           CURL_READFUNC_ABORT return code still aborts */
+        failf(data, "Could only read %" FMT_OFF_T " bytes from the input",
+              passed);
+        return CURLE_READ_ERROR;
+      }
+    } while(passed < offset);
+  }
+
+  /* now, decrease the size of the read */
+  if(ctx->total_len > 0) {
+    ctx->total_len -= offset;
+
+    if(ctx->total_len <= 0) {
+      failf(data, "File already completely uploaded");
+      return CURLE_PARTIAL_FILE;
+    }
+  }
+  /* we have passed, proceed as normal */
+  return CURLE_OK;
+}
+
+static CURLcode cr_in_rewind(struct Curl_easy *data,
+                             struct Curl_creader *reader)
+{
+  struct cr_in_ctx *ctx = reader->ctx;
+
+  /* If we never invoked the callback, there is noting to rewind */
+  if(!ctx->has_used_cb)
+    return CURLE_OK;
+
+  if(data->set.seek_func) {
+    int err;
+
+    Curl_set_in_callback(data, TRUE);
+    err = (data->set.seek_func)(data->set.seek_client, 0, SEEK_SET);
+    Curl_set_in_callback(data, FALSE);
+    CURL_TRC_READ(data, "cr_in, rewind via set.seek_func -> %d", err);
+    if(err) {
+      failf(data, "seek callback returned error %d", err);
+      return CURLE_SEND_FAIL_REWIND;
+    }
+  }
+  else if(data->set.ioctl_func) {
+    curlioerr err;
+
+    Curl_set_in_callback(data, TRUE);
+    err = (data->set.ioctl_func)(data, CURLIOCMD_RESTARTREAD,
+                                 data->set.ioctl_client);
+    Curl_set_in_callback(data, FALSE);
+    CURL_TRC_READ(data, "cr_in, rewind via set.ioctl_func -> %d", (int)err);
+    if(err) {
+      failf(data, "ioctl callback returned error %d", (int)err);
+      return CURLE_SEND_FAIL_REWIND;
+    }
+  }
+  else {
+    /* If no CURLOPT_READFUNCTION is used, we know that we operate on a
+       given FILE * stream and we can actually attempt to rewind that
+       ourselves with fseek() */
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wcast-function-type-strict"
+#endif
+    if(data->state.fread_func == (curl_read_callback)fread) {
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic pop
+#endif
+      int err = fseek(data->state.in, 0, SEEK_SET);
+      CURL_TRC_READ(data, "cr_in, rewind via fseek -> %d(%d)",
+                    (int)err, (int)errno);
+      if(err != -1)
+        /* successful rewind */
+        return CURLE_OK;
+    }
+
+    /* no callback set or failure above, makes us fail at once */
+    failf(data, "necessary data rewind was not possible");
+    return CURLE_SEND_FAIL_REWIND;
+  }
+  return CURLE_OK;
+}
+
+static CURLcode cr_in_cntrl(struct Curl_easy *data,
+                            struct Curl_creader *reader,
+                            Curl_creader_cntrl opcode)
+{
+  struct cr_in_ctx *ctx = reader->ctx;
+
+  switch(opcode) {
+  case CURL_CRCNTRL_REWIND:
+    return cr_in_rewind(data, reader);
+  case CURL_CRCNTRL_UNPAUSE:
+    ctx->is_paused = FALSE;
+    break;
+  case CURL_CRCNTRL_CLEAR_EOS:
+    ctx->seen_eos = FALSE;
+    break;
+  default:
+    break;
+  }
+  return CURLE_OK;
+}
+
+static bool cr_in_is_paused(struct Curl_easy *data,
+                            struct Curl_creader *reader)
+{
+  struct cr_in_ctx *ctx = reader->ctx;
+  (void)data;
+  return (bool)ctx->is_paused;
+}
+
+static const struct Curl_crtype cr_in = {
+  "cr-in",
+  cr_in_init,
+  cr_in_read,
+  Curl_creader_def_close,
+  cr_in_needs_rewind,
+  cr_in_total_length,
+  cr_in_resume_from,
+  cr_in_cntrl,
+  cr_in_is_paused,
+  Curl_creader_def_done,
+  sizeof(struct cr_in_ctx)
+};
+
+CURLcode Curl_creader_create(struct Curl_creader **preader,
+                             struct Curl_easy *data,
+                             const struct Curl_crtype *crt,
+                             Curl_creader_phase phase)
+{
+  struct Curl_creader *reader = NULL;
+  CURLcode result = CURLE_OUT_OF_MEMORY;
+  void *p;
+
+  DEBUGASSERT(crt->creader_size >= sizeof(struct Curl_creader));
+  p = curlx_calloc(1, crt->creader_size);
+  if(!p)
+    goto out;
+
+  reader = (struct Curl_creader *)p;
+  reader->crt = crt;
+  reader->ctx = p;
+  reader->phase = phase;
+  result = crt->do_init(data, reader);
+
+out:
+  *preader = result ? NULL : reader;
+  if(result)
+    curlx_free(reader);
+  return result;
+}
+
+void Curl_creader_free(struct Curl_easy *data, struct Curl_creader *reader)
+{
+  if(reader) {
+    reader->crt->do_close(data, reader);
+    curlx_free(reader);
+  }
+}
+
+struct cr_lc_ctx {
+  struct Curl_creader super;
+  struct bufq buf;
+  BIT(read_eos);  /* we read an EOS from the next reader */
+  BIT(eos);       /* we have returned an EOS */
+  BIT(prev_cr);   /* the last byte was a CR */
+};
+
+static CURLcode cr_lc_init(struct Curl_easy *data, struct Curl_creader *reader)
+{
+  struct cr_lc_ctx *ctx = reader->ctx;
+  (void)data;
+  Curl_bufq_init2(&ctx->buf, (16 * 1024), 1, BUFQ_OPT_SOFT_LIMIT);
+  return CURLE_OK;
+}
+
+static void cr_lc_close(struct Curl_easy *data, struct Curl_creader *reader)
+{
+  struct cr_lc_ctx *ctx = reader->ctx;
+  (void)data;
+  Curl_bufq_free(&ctx->buf);
+}
+
+/* client reader doing line end conversions. */
+static CURLcode cr_lc_read(struct Curl_easy *data,
+                           struct Curl_creader *reader,
+                           char *buf, size_t blen,
+                           size_t *pnread, bool *peos)
+{
+  struct cr_lc_ctx *ctx = reader->ctx;
+  CURLcode result;
+  size_t nread, i, start, n;
+  bool eos;
+
+  if(ctx->eos) {
+    *pnread = 0;
+    *peos = TRUE;
+    return CURLE_OK;
+  }
+
+  if(Curl_bufq_is_empty(&ctx->buf)) {
+    if(ctx->read_eos) {
+      ctx->eos = TRUE;
+      *pnread = 0;
+      *peos = TRUE;
+      return CURLE_OK;
+    }
+    /* Still getting data form the next reader, ctx->buf is empty */
+    result = Curl_creader_read(data, reader->next, buf, blen, &nread, &eos);
+    if(result)
+      return result;
+    ctx->read_eos = eos;
+
+    if(!nread || !memchr(buf, '\n', nread)) {
+      /* nothing to convert, return this right away */
+      if(nread)
+        ctx->prev_cr = (buf[nread - 1] == '\r');
+      if(ctx->read_eos)
+        ctx->eos = TRUE;
+      *pnread = nread;
+      *peos = (bool)ctx->eos;
+      goto out;
+    }
+
+    /* at least one \n might need conversion to '\r\n', place into ctx->buf */
+    for(i = start = 0; i < nread; ++i) {
+      /* if this byte is not an LF character, or if the preceding character is
+         a CR (meaning this already is a CRLF pair), go to next */
+      if((buf[i] != '\n') || ctx->prev_cr) {
+        ctx->prev_cr = (buf[i] == '\r');
+        continue;
+      }
+      ctx->prev_cr = FALSE;
+      /* on a soft limit bufq, we do not need to check length */
+      result = Curl_bufq_cwrite(&ctx->buf, buf + start, i - start, &n);
+      if(!result)
+        result = Curl_bufq_cwrite(&ctx->buf, STRCONST("\r\n"), &n);
+      if(result)
+        return result;
+      start = i + 1;
+    }
+
+    if(start < i) { /* leftover */
+      result = Curl_bufq_cwrite(&ctx->buf, buf + start, i - start, &n);
+      if(result)
+        return result;
+    }
+  }
+
+  DEBUGASSERT(!Curl_bufq_is_empty(&ctx->buf));
+  *peos = FALSE;
+  result = Curl_bufq_cread(&ctx->buf, buf, blen, pnread);
+  if(!result && ctx->read_eos && Curl_bufq_is_empty(&ctx->buf)) {
+    /* no more data, read all, done. */
+    ctx->eos = TRUE;
+    *peos = TRUE;
+  }
+
+out:
+  CURL_TRC_READ(data, "cr_lc_read(len=%zu) -> %d, nread=%zu, eos=%d",
+                blen, (int)result, *pnread, *peos);
+  return result;
+}
+
+static curl_off_t cr_lc_total_length(struct Curl_easy *data,
+                                     struct Curl_creader *reader)
+{
+  /* this reader changes length depending on input */
+  (void)data;
+  (void)reader;
+  return -1;
+}
+
+static const struct Curl_crtype cr_lc = {
+  "cr-lineconv",
+  cr_lc_init,
+  cr_lc_read,
+  cr_lc_close,
+  Curl_creader_def_needs_rewind,
+  cr_lc_total_length,
+  Curl_creader_def_resume_from,
+  Curl_creader_def_cntrl,
+  Curl_creader_def_is_paused,
+  Curl_creader_def_done,
+  sizeof(struct cr_lc_ctx)
+};
+
+static CURLcode cr_lc_add(struct Curl_easy *data)
+{
+  struct Curl_creader *reader = NULL;
+  CURLcode result;
+
+  result = Curl_creader_create(&reader, data, &cr_lc, CURL_CR_CONTENT_ENCODE);
+  if(!result)
+    result = Curl_creader_add(data, reader);
+
+  if(result && reader)
+    Curl_creader_free(data, reader);
+  return result;
+}
+
+static CURLcode do_init_reader_stack(struct Curl_easy *data,
+                                     struct Curl_creader *r)
+{
+  CURLcode result = CURLE_OK;
+  curl_off_t clen;
+
+  DEBUGASSERT(r);
+  DEBUGASSERT(r->crt);
+  DEBUGASSERT(r->phase == CURL_CR_CLIENT);
+  DEBUGASSERT(!data->req.reader_stack);
+
+  data->req.reader_stack = r;
+  clen = r->crt->total_length(data, r);
+  /* if we do not have 0 length init, and crlf conversion is wanted,
+   * add the reader for it */
+  if(clen && (data->set.crlf
+#ifdef CURL_PREFER_LF_LINEENDS
+     || data->state.prefer_ascii
+#endif
+    )) {
+    result = cr_lc_add(data);
+    if(result)
+      return result;
+  }
+
+  return result;
+}
+
+CURLcode Curl_creader_set_fread(struct Curl_easy *data, curl_off_t len)
+{
+  CURLcode result;
+  struct Curl_creader *r;
+  struct cr_in_ctx *ctx;
+
+  result = Curl_creader_create(&r, data, &cr_in, CURL_CR_CLIENT);
+  if(result || !r)
+    goto out;
+  ctx = r->ctx;
+  ctx->total_len = len;
+
+  cl_reset_reader(data);
+  result = do_init_reader_stack(data, r);
+out:
+  CURL_TRC_READ(data, "add fread reader, len=%" FMT_OFF_T " -> %d",
+                len, (int)result);
+  return result;
+}
+
+CURLcode Curl_creader_add(struct Curl_easy *data,
+                          struct Curl_creader *reader)
+{
+  CURLcode result;
+  struct Curl_creader **anchor = &data->req.reader_stack;
+
+  if(!*anchor) {
+    result = Curl_creader_set_fread(data, data->state.infilesize);
+    if(result)
+      return result;
+  }
+
+  /* Insert the writer as first in its phase.
+   * Skip existing readers of lower phases. */
+  while(*anchor && (*anchor)->phase < reader->phase)
+    anchor = &((*anchor)->next);
+  reader->next = *anchor;
+  *anchor = reader;
+  return CURLE_OK;
+}
+
+CURLcode Curl_creader_set(struct Curl_easy *data, struct Curl_creader *r)
+{
+  CURLcode result;
+
+  DEBUGASSERT(r);
+  DEBUGASSERT(r->crt);
+  DEBUGASSERT(r->phase == CURL_CR_CLIENT);
+
+  cl_reset_reader(data);
+  result = do_init_reader_stack(data, r);
+  if(result)
+    Curl_creader_free(data, r);
+  return result;
+}
+
+CURLcode Curl_client_read(struct Curl_easy *data, char *buf, size_t blen,
+                          size_t *nread, bool *eos)
+{
+  CURLcode result;
+
+  DEBUGASSERT(buf);
+  DEBUGASSERT(blen);
+  DEBUGASSERT(nread);
+  DEBUGASSERT(eos);
+  *nread = 0;
+
+  if(!data->req.reader_stack) {
+    result = Curl_creader_set_fread(data, data->state.infilesize);
+    if(result)
+      return result;
+    DEBUGASSERT(data->req.reader_stack);
+  }
+  if(!data->req.reader_started) {
+    Curl_rlimit_start(&data->progress.ul.rlimit, Curl_pgrs_now(data), -1);
+    data->req.reader_started = TRUE;
+  }
+
+  if(Curl_rlimit_active(&data->progress.ul.rlimit)) {
+    curl_off_t ul_avail = Curl_rlimit_avail(&data->progress.ul.rlimit,
+                                            Curl_pgrs_now(data));
+    if(ul_avail <= 0) {
+      result = CURLE_OK;
+      *eos = FALSE;
+      goto out;
+    }
+    if(ul_avail < (curl_off_t)blen)
+      blen = (size_t)ul_avail;
+  }
+  result = Curl_creader_read(data, data->req.reader_stack, buf, blen,
+                             nread, eos);
+
+out:
+  CURL_TRC_READ(data, "client_read(len=%zu) -> %d, nread=%zu, eos=%d",
+                blen, (int)result, *nread, *eos);
+  return result;
+}
+
+bool Curl_creader_needs_rewind(struct Curl_easy *data)
+{
+  struct Curl_creader *reader = data->req.reader_stack;
+  while(reader) {
+    if(reader->crt->needs_rewind(data, reader)) {
+      CURL_TRC_READ(data, "client reader needs rewind before next request");
+      return TRUE;
+    }
+    reader = reader->next;
+  }
+  return FALSE;
+}
+
+static CURLcode cr_null_read(struct Curl_easy *data,
+                             struct Curl_creader *reader,
+                             char *buf, size_t blen,
+                             size_t *pnread, bool *peos)
+{
+  (void)data;
+  (void)reader;
+  (void)buf;
+  (void)blen;
+  *pnread = 0;
+  *peos = TRUE;
+  return CURLE_OK;
+}
+
+static curl_off_t cr_null_total_length(struct Curl_easy *data,
+                                       struct Curl_creader *reader)
+{
+  /* this reader changes length depending on input */
+  (void)data;
+  (void)reader;
+  return 0;
+}
+
+static const struct Curl_crtype cr_null = {
+  "cr-null",
+  Curl_creader_def_init,
+  cr_null_read,
+  Curl_creader_def_close,
+  Curl_creader_def_needs_rewind,
+  cr_null_total_length,
+  Curl_creader_def_resume_from,
+  Curl_creader_def_cntrl,
+  Curl_creader_def_is_paused,
+  Curl_creader_def_done,
+  sizeof(struct Curl_creader)
+};
+
+CURLcode Curl_creader_set_null(struct Curl_easy *data)
+{
+  struct Curl_creader *r;
+  CURLcode result;
+
+  result = Curl_creader_create(&r, data, &cr_null, CURL_CR_CLIENT);
+  if(result)
+    return result;
+
+  cl_reset_reader(data);
+  return do_init_reader_stack(data, r);
+}
+
+struct cr_buf_ctx {
+  struct Curl_creader super;
+  const char *buf;
+  size_t blen;
+  size_t index;
+};
+
+static CURLcode cr_buf_read(struct Curl_easy *data,
+                            struct Curl_creader *reader,
+                            char *buf, size_t blen,
+                            size_t *pnread, bool *peos)
+{
+  struct cr_buf_ctx *ctx = reader->ctx;
+  size_t nread = ctx->blen - ctx->index;
+
+  if(!nread || !ctx->buf) {
+    *pnread = 0;
+    *peos = TRUE;
+  }
+  else {
+    if(nread > blen)
+      nread = blen;
+    memcpy(buf, ctx->buf + ctx->index, nread);
+    *pnread = nread;
+    ctx->index += nread;
+    *peos = (ctx->index == ctx->blen);
+  }
+  CURL_TRC_READ(data, "cr_buf_read(len=%zu) -> 0, nread=%zu, eos=%d",
+                blen, *pnread, *peos);
+  return CURLE_OK;
+}
+
+static bool cr_buf_needs_rewind(struct Curl_easy *data,
+                                struct Curl_creader *reader)
+{
+  struct cr_buf_ctx *ctx = reader->ctx;
+  (void)data;
+  return ctx->index > 0;
+}
+
+static CURLcode cr_buf_cntrl(struct Curl_easy *data,
+                             struct Curl_creader *reader,
+                             Curl_creader_cntrl opcode)
+{
+  struct cr_buf_ctx *ctx = reader->ctx;
+  (void)data;
+  switch(opcode) {
+  case CURL_CRCNTRL_REWIND:
+    ctx->index = 0;
+    break;
+  default:
+    break;
+  }
+  return CURLE_OK;
+}
+
+static curl_off_t cr_buf_total_length(struct Curl_easy *data,
+                                      struct Curl_creader *reader)
+{
+  struct cr_buf_ctx *ctx = reader->ctx;
+  (void)data;
+  return (curl_off_t)ctx->blen;
+}
+
+static CURLcode cr_buf_resume_from(struct Curl_easy *data,
+                                   struct Curl_creader *reader,
+                                   curl_off_t offset)
+{
+  struct cr_buf_ctx *ctx = reader->ctx;
+  size_t boffset;
+
+  (void)data;
+  DEBUGASSERT(data->conn);
+  /* already started reading? */
+  if(ctx->index)
+    return CURLE_READ_ERROR;
+  boffset = curlx_sotouz_range(offset, 0, SIZE_MAX);
+  if(!boffset)
+    return CURLE_OK;
+  if(boffset > ctx->blen)
+    return CURLE_READ_ERROR;
+
+  ctx->buf += boffset;
+  ctx->blen -= boffset;
+  return CURLE_OK;
+}
+
+static const struct Curl_crtype cr_buf = {
+  "cr-buf",
+  Curl_creader_def_init,
+  cr_buf_read,
+  Curl_creader_def_close,
+  cr_buf_needs_rewind,
+  cr_buf_total_length,
+  cr_buf_resume_from,
+  cr_buf_cntrl,
+  Curl_creader_def_is_paused,
+  Curl_creader_def_done,
+  sizeof(struct cr_buf_ctx)
+};
+
+CURLcode Curl_creader_set_buf(struct Curl_easy *data,
+                              const char *buf, size_t blen)
+{
+  CURLcode result;
+  struct Curl_creader *r;
+  struct cr_buf_ctx *ctx;
+
+  result = Curl_creader_create(&r, data, &cr_buf, CURL_CR_CLIENT);
+  if(result)
+    goto out;
+  ctx = r->ctx;
+  ctx->buf = buf;
+  ctx->blen = blen;
+  ctx->index = 0;
+
+  cl_reset_reader(data);
+  result = do_init_reader_stack(data, r);
+out:
+  CURL_TRC_READ(data, "add buf reader, len=%zu -> %d", blen, (int)result);
+  return result;
+}
+
+curl_off_t Curl_creader_total_length(struct Curl_easy *data)
+{
+  struct Curl_creader *r = data->req.reader_stack;
+  return r ? r->crt->total_length(data, r) : -1;
+}
+
+curl_off_t Curl_creader_client_length(struct Curl_easy *data)
+{
+  struct Curl_creader *r = data->req.reader_stack;
+  while(r && r->phase != CURL_CR_CLIENT)
+    r = r->next;
+  return r ? r->crt->total_length(data, r) : -1;
+}
+
+CURLcode Curl_creader_resume_from(struct Curl_easy *data, curl_off_t offset)
+{
+  struct Curl_creader *r = data->req.reader_stack;
+  while(r && r->phase != CURL_CR_CLIENT)
+    r = r->next;
+  return r ? r->crt->resume_from(data, r, offset) : CURLE_READ_ERROR;
+}
+
+CURLcode Curl_creader_unpause(struct Curl_easy *data)
+{
+  struct Curl_creader *reader = data->req.reader_stack;
+  CURLcode result = CURLE_OK;
+
+  while(reader) {
+    result = reader->crt->cntrl(data, reader, CURL_CRCNTRL_UNPAUSE);
+    CURL_TRC_READ(data, "unpausing %s -> %d", reader->crt->name, (int)result);
+    if(result)
+      break;
+    reader = reader->next;
+  }
+  return result;
+}
+
+bool Curl_creader_is_paused(struct Curl_easy *data)
+{
+  struct Curl_creader *reader = data->req.reader_stack;
+
+  while(reader) {
+    if(reader->crt->is_paused(data, reader))
+      return TRUE;
+    reader = reader->next;
+  }
+  return FALSE;
+}
+
+void Curl_creader_done(struct Curl_easy *data, int premature)
+{
+  struct Curl_creader *reader = data->req.reader_stack;
+  while(reader) {
+    reader->crt->done(data, reader, premature);
+    reader = reader->next;
+  }
+}
+
+struct Curl_creader *Curl_creader_get_by_type(struct Curl_easy *data,
+                                              const struct Curl_crtype *crt)
+{
+  struct Curl_creader *r;
+  for(r = data->req.reader_stack; r; r = r->next) {
+    if(r->crt == crt)
+      return r;
+  }
+  return NULL;
+}
diff --git a/third-party/curl/lib/sendf.h b/third-party/curl/lib/sendf.h
index 5ef2b91df7..787fe7ff69 100644
--- a/third-party/curl/lib/sendf.h
+++ b/third-party/curl/lib/sendf.h
@@ -23,39 +23,401 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include "curl_trc.h"
+/**
+ * Type of data that is being written to the client (application)
+ * - data written can be either BODY or META data
+ * - META data is either INFO or HEADER
+ * - INFO is meta information, e.g. not BODY, that cannot be interpreted
+ *   as headers of a response. Example FTP/IMAP pingpong answers.
+ * - HEADER can have additional bits set (more than one)
+ *   - STATUS special "header", e.g. response status line in HTTP
+ *   - CONNECT header was received during proxying the connection
+ *   - 1XX header is part of an intermediate response, e.g. HTTP 1xx code
+ *   - TRAILER header is trailing response data, e.g. HTTP trailers
+ * BODY, INFO and HEADER should not be mixed, as this would lead to
+ * confusion on how to interpret/format/convert the data.
+ */
+#define CLIENTWRITE_BODY    (1 << 0) /* non-meta information, BODY */
+#define CLIENTWRITE_INFO    (1 << 1) /* meta information, not a HEADER */
+#define CLIENTWRITE_HEADER  (1 << 2) /* meta information, HEADER */
+#define CLIENTWRITE_STATUS  (1 << 3) /* a special status HEADER */
+#define CLIENTWRITE_CONNECT (1 << 4) /* a CONNECT related HEADER */
+#define CLIENTWRITE_1XX     (1 << 5) /* a 1xx response related HEADER */
+#define CLIENTWRITE_TRAILER (1 << 6) /* a trailer HEADER */
+#define CLIENTWRITE_EOS     (1 << 7) /* End Of transfer download Stream */
+#define CLIENTWRITE_0LEN    (1 << 8) /* write even 0-length buffers */
 
+/* Forward declarations */
+struct Curl_creader;
+struct Curl_cwriter;
+struct Curl_easy;
 
-#define CLIENTWRITE_BODY    (1<<0)
-#define CLIENTWRITE_HEADER  (1<<1)
-#define CLIENTWRITE_STATUS  (1<<2) /* the first "header" is the status line */
-#define CLIENTWRITE_CONNECT (1<<3) /* a CONNECT response */
-#define CLIENTWRITE_1XX     (1<<4) /* a 1xx response */
-#define CLIENTWRITE_TRAILER (1<<5) /* a trailer header */
-#define CLIENTWRITE_BOTH   (CLIENTWRITE_BODY|CLIENTWRITE_HEADER)
-
-CURLcode Curl_client_write(struct Curl_easy *data, int type, char *ptr,
+/**
+ * Write `len` bytes at `buf` to the client. `type` indicates what
+ * kind of data is being written.
+ */
+CURLcode Curl_client_write(struct Curl_easy *data, int type, const char *buf,
                            size_t len) WARN_UNUSED_RESULT;
 
-/* internal read-function, does plain socket, SSL and krb4 */
-CURLcode Curl_read(struct Curl_easy *data, curl_socket_t sockfd,
-                   char *buf, size_t buffersize,
-                   ssize_t *n);
+/**
+ * Free all resources related to client writing.
+ */
+void Curl_client_cleanup(struct Curl_easy *data);
 
-/* internal write-function, does plain socket, SSL, SCP, SFTP and krb4 */
-CURLcode Curl_write(struct Curl_easy *data,
-                    curl_socket_t sockfd,
-                    const void *mem, size_t len,
-                    ssize_t *written);
+/**
+ * Reset readers and writer chains, keep rewind information
+ * when necessary.
+ */
+void Curl_client_reset(struct Curl_easy *data);
 
-/* internal write-function, using sockindex for connection destination */
-CURLcode Curl_nwrite(struct Curl_easy *data,
-                     int sockindex,
-                     const void *buf,
-                     size_t blen,
-                     ssize_t *pnwritten);
+/**
+ * A new request is starting, perform any ops like rewinding
+ * previous readers when needed.
+ */
+CURLcode Curl_client_start(struct Curl_easy *data);
+
+/**
+ * Client Writers - a chain passing transfer BODY data to the client.
+ * Main application: HTTP and related protocols
+ * Other uses: monitoring of download progress
+ *
+ * Writers in the chain are order by their `phase`. First come all
+ * writers in CURL_CW_RAW, followed by any in CURL_CW_TRANSFER_DECODE,
+ * followed by any in CURL_CW_PROTOCOL, etc.
+ *
+ * When adding a writer, it is inserted as first in its phase. This means
+ * the order of adding writers of the same phase matters, but writers for
+ * different phases may be added in any order.
+ *
+ * Writers which do modify the BODY data written are expected to be of
+ * phases TRANSFER_DECODE or CONTENT_DECODE. The other phases are intended
+ * for monitoring writers. Which do *not* modify the data but gather
+ * statistics or update progress reporting.
+ */
+
+/* Phase a writer operates at. */
+typedef enum {
+  CURL_CW_RAW,  /* raw data written, before any decoding */
+  CURL_CW_TRANSFER_DECODE, /* remove transfer-encodings */
+  CURL_CW_PROTOCOL, /* after transfer, but before content decoding */
+  CURL_CW_CONTENT_DECODE, /* remove content-encodings */
+  CURL_CW_CLIENT  /* data written to client */
+} Curl_cwriter_phase;
+
+/* Client Writer Type, provides the implementation */
+struct Curl_cwtype {
+  const char *name;        /* writer name. */
+  const char *alias;       /* writer name alias, maybe NULL. */
+  CURLcode (*do_init)(struct Curl_easy *data,
+                      struct Curl_cwriter *writer);
+  CURLcode (*do_write)(struct Curl_easy *data,
+                       struct Curl_cwriter *writer, int type,
+                       const char *buf, size_t nbytes);
+  void (*do_close)(struct Curl_easy *data,
+                   struct Curl_cwriter *writer);
+  size_t cwriter_size;  /* sizeof() allocated struct Curl_cwriter */
+};
+
+/* Client writer instance, allocated on creation.
+ * `void *ctx` is the pointer from the allocation of
+ * the `struct Curl_cwriter` itself. This is suitable for "downcasting"
+ * by the writers implementation. See https://github.com/curl/curl/pull/13054
+ * for the alignment problems that arise otherwise.
+ */
+struct Curl_cwriter {
+  const struct Curl_cwtype *cwt;  /* type implementation */
+  struct Curl_cwriter *next;  /* Downstream writer. */
+  void *ctx;                  /* allocated instance pointer */
+  Curl_cwriter_phase phase; /* phase at which it operates */
+};
+
+/**
+ * Create a new cwriter instance with given type and phase. Is not
+ * inserted into the writer chain by this call.
+ * Invokes `writer->do_init()`.
+ */
+CURLcode Curl_cwriter_create(struct Curl_cwriter **pwriter,
+                             struct Curl_easy *data,
+                             const struct Curl_cwtype *cwt,
+                             Curl_cwriter_phase phase);
+
+/**
+ * Free a cwriter instance.
+ * Invokes `writer->do_close()`.
+ */
+void Curl_cwriter_free(struct Curl_easy *data,
+                       struct Curl_cwriter *writer);
+
+/**
+ * Count the number of writers installed of the given phase.
+ */
+size_t Curl_cwriter_count(struct Curl_easy *data, Curl_cwriter_phase phase);
+
+/**
+ * Adds a writer to the transfer's writer chain.
+ * The writers `phase` determines where in the chain it is inserted.
+ */
+CURLcode Curl_cwriter_add(struct Curl_easy *data,
+                          struct Curl_cwriter *writer);
+
+/**
+ * Look up an installed client writer on `data` by its type.
+ * @return first writer with that type or NULL
+ */
+struct Curl_cwriter *Curl_cwriter_get_by_type(struct Curl_easy *data,
+                                              const struct Curl_cwtype *cwt);
+
+struct Curl_cwriter *Curl_cwriter_get_by_name(struct Curl_easy *data,
+                                              const char *name);
+
+/**
+ * Convenience method for calling `writer->do_write()` that
+ * checks for NULL writer.
+ */
+CURLcode Curl_cwriter_write(struct Curl_easy *data,
+                            struct Curl_cwriter *writer, int type,
+                            const char *buf, size_t nbytes);
+
+/**
+ * Return TRUE iff client writer is paused.
+ */
+bool Curl_cwriter_is_paused(struct Curl_easy *data);
+
+bool Curl_cwriter_is_content_decoding(struct Curl_easy *data);
+
+/**
+ * Unpause client writer and flush any buffered date to the client.
+ */
+CURLcode Curl_cwriter_unpause(struct Curl_easy *data);
+
+/**
+ * Default implementations for do_init, do_write, do_close that
+ * do nothing and pass the data through.
+ */
+CURLcode Curl_cwriter_def_init(struct Curl_easy *data,
+                               struct Curl_cwriter *writer);
+CURLcode Curl_cwriter_def_write(struct Curl_easy *data,
+                                struct Curl_cwriter *writer, int type,
+                                const char *buf, size_t nbytes);
+void Curl_cwriter_def_close(struct Curl_easy *data,
+                            struct Curl_cwriter *writer);
+
+typedef enum {
+  CURL_CRCNTRL_REWIND,
+  CURL_CRCNTRL_UNPAUSE,
+  CURL_CRCNTRL_CLEAR_EOS
+} Curl_creader_cntrl;
+
+/* Client Reader Type, provides the implementation */
+struct Curl_crtype {
+  const char *name;        /* writer name. */
+  CURLcode (*do_init)(struct Curl_easy *data, struct Curl_creader *reader);
+  CURLcode (*do_read)(struct Curl_easy *data, struct Curl_creader *reader,
+                      char *buf, size_t blen, size_t *nread, bool *eos);
+  void (*do_close)(struct Curl_easy *data, struct Curl_creader *reader);
+  bool (*needs_rewind)(struct Curl_easy *data, struct Curl_creader *reader);
+  curl_off_t (*total_length)(struct Curl_easy *data,
+                             struct Curl_creader *reader);
+  CURLcode (*resume_from)(struct Curl_easy *data,
+                          struct Curl_creader *reader, curl_off_t offset);
+  CURLcode (*cntrl)(struct Curl_easy *data, struct Curl_creader *reader,
+                    Curl_creader_cntrl opcode);
+  bool (*is_paused)(struct Curl_easy *data, struct Curl_creader *reader);
+  void (*done)(struct Curl_easy *data,
+               struct Curl_creader *reader, int premature);
+  size_t creader_size;  /* sizeof() allocated struct Curl_creader */
+};
+
+/* Phase a reader operates at. */
+typedef enum {
+  CURL_CR_NET,  /* data send to the network (connection filters) */
+  CURL_CR_TRANSFER_ENCODE, /* add transfer-encodings */
+  CURL_CR_PROTOCOL, /* before transfer, but after content decoding */
+  CURL_CR_CONTENT_ENCODE, /* add content-encodings */
+  CURL_CR_CLIENT  /* data read from client */
+} Curl_creader_phase;
+
+/* Client reader instance, allocated on creation.
+ * `void *ctx` is the pointer from the allocation of
+ * the `struct Curl_cwriter` itself. This is suitable for "downcasting"
+ * by the writers implementation. See https://github.com/curl/curl/pull/13054
+ * for the alignment problems that arise otherwise.
+ */
+struct Curl_creader {
+  const struct Curl_crtype *crt;  /* type implementation */
+  struct Curl_creader *next;  /* Downstream reader. */
+  void *ctx;
+  Curl_creader_phase phase; /* phase at which it operates */
+};
+
+/**
+ * Default implementations for do_init, do_write, do_close that
+ * do nothing and pass the data through.
+ */
+CURLcode Curl_creader_def_init(struct Curl_easy *data,
+                               struct Curl_creader *reader);
+void Curl_creader_def_close(struct Curl_easy *data,
+                            struct Curl_creader *reader);
+CURLcode Curl_creader_def_read(struct Curl_easy *data,
+                               struct Curl_creader *reader,
+                               char *buf, size_t blen,
+                               size_t *nread, bool *eos);
+bool Curl_creader_def_needs_rewind(struct Curl_easy *data,
+                                   struct Curl_creader *reader);
+curl_off_t Curl_creader_def_total_length(struct Curl_easy *data,
+                                         struct Curl_creader *reader);
+CURLcode Curl_creader_def_resume_from(struct Curl_easy *data,
+                                      struct Curl_creader *reader,
+                                      curl_off_t offset);
+CURLcode Curl_creader_def_cntrl(struct Curl_easy *data,
+                                struct Curl_creader *reader,
+                                Curl_creader_cntrl opcode);
+bool Curl_creader_def_is_paused(struct Curl_easy *data,
+                                struct Curl_creader *reader);
+void Curl_creader_def_done(struct Curl_easy *data,
+                           struct Curl_creader *reader, int premature);
+
+/**
+ * Convenience method for calling `reader->do_read()` that
+ * checks for NULL reader.
+ */
+CURLcode Curl_creader_read(struct Curl_easy *data,
+                           struct Curl_creader *reader,
+                           char *buf, size_t blen, size_t *nread, bool *eos);
+
+/* Tell the reader and all below that any EOS state is to be cleared */
+void Curl_creader_clear_eos(struct Curl_easy *data,
+                            struct Curl_creader *reader);
+
+/**
+ * Create a new creader instance with given type and phase. Is not
+ * inserted into the writer chain by this call.
+ * Invokes `reader->do_init()`.
+ */
+CURLcode Curl_creader_create(struct Curl_creader **preader,
+                             struct Curl_easy *data,
+                             const struct Curl_crtype *crt,
+                             Curl_creader_phase phase);
+
+/**
+ * Free a creader instance.
+ * Invokes `reader->do_close()`.
+ */
+void Curl_creader_free(struct Curl_easy *data, struct Curl_creader *reader);
+
+/**
+ * Adds a reader to the transfer's reader chain.
+ * The readers `phase` determines where in the chain it is inserted.
+ */
+CURLcode Curl_creader_add(struct Curl_easy *data,
+                          struct Curl_creader *reader);
+
+/**
+ * Set the given reader, which needs to be of type CURL_CR_CLIENT,
+ * as the new first reader. Discard any installed readers and init
+ * the reader chain anew.
+ * The function takes ownership of `r`.
+ */
+CURLcode Curl_creader_set(struct Curl_easy *data, struct Curl_creader *r);
+
+/**
+ * Read at most `blen` bytes at `buf` from the client.
+ * @param data    the transfer to read client bytes for
+ * @param buf     the memory location to read to
+ * @param blen    the amount of memory at `buf`
+ * @param nread   on return the number of bytes read into `buf`
+ * @param eos     TRUE iff bytes are the end of data from client
+ * @return CURLE_OK on successful read (even 0 length) or error
+ */
+CURLcode Curl_client_read(struct Curl_easy *data, char *buf, size_t blen,
+                          size_t *nread, bool *eos) WARN_UNUSED_RESULT;
+
+/**
+ * TRUE iff client reader needs rewing before it can be used for
+ * a retry request.
+ */
+bool Curl_creader_needs_rewind(struct Curl_easy *data);
+
+/**
+ * TRUE iff client reader will rewind at next start
+ */
+bool Curl_creader_will_rewind(struct Curl_easy *data);
+
+/**
+ * En-/disable rewind of client reader at next start.
+ */
+void Curl_creader_set_rewind(struct Curl_easy *data, bool enable);
+
+/**
+ * Get the total length of bytes provided by the installed readers.
+ * This is independent of the amount already delivered and is calculated
+ * by all readers in the stack. If a reader like "chunked" or
+ * "crlf conversion" is installed, the returned length will be -1.
+ * @return -1 if length is indeterminate
+ */
+curl_off_t Curl_creader_total_length(struct Curl_easy *data);
+
+/**
+ * Get the total length of bytes provided by the reader at phase
+ * CURL_CR_CLIENT. This may not match the amount of bytes read
+ * for a request, depending if other, encoding readers are also installed.
+ * However it allows for rough estimation of the overall length.
+ * @return -1 if length is indeterminate
+ */
+curl_off_t Curl_creader_client_length(struct Curl_easy *data);
+
+/**
+ * Ask the installed reader at phase CURL_CR_CLIENT to start
+ * reading from the given offset. On success, this will reduce
+ * the `total_length()` by the amount.
+ * @param data    the transfer to read client bytes for
+ * @param offset  the offset where to start reads from, negative
+ *                values will be ignored.
+ * @return CURLE_OK if offset could be set
+ *         CURLE_READ_ERROR if not supported by reader or seek/read failed
+ *                          of offset larger than total length
+ *         CURLE_PARTIAL_FILE if offset led to 0 total length
+ */
+CURLcode Curl_creader_resume_from(struct Curl_easy *data, curl_off_t offset);
+
+/**
+ * Unpause all installed readers.
+ */
+CURLcode Curl_creader_unpause(struct Curl_easy *data);
+
+/**
+ * Return TRUE iff any of the installed readers is paused.
+ */
+bool Curl_creader_is_paused(struct Curl_easy *data);
+
+/**
+ * Tell all client readers that they are done.
+ */
+void Curl_creader_done(struct Curl_easy *data, int premature);
+
+/**
+ * Look up an installed client reader on `data` by its type.
+ * @return first reader with that type or NULL
+ */
+struct Curl_creader *Curl_creader_get_by_type(struct Curl_easy *data,
+                                              const struct Curl_crtype *crt);
+
+/**
+ * Set the client reader to provide 0 bytes, immediate EOS.
+ */
+CURLcode Curl_creader_set_null(struct Curl_easy *data);
+
+/**
+ * Set the client reader the reads from fread callback.
+ */
+CURLcode Curl_creader_set_fread(struct Curl_easy *data, curl_off_t len);
+
+/**
+ * Set the client reader the reads from the supplied buf (NOT COPIED).
+ */
+CURLcode Curl_creader_set_buf(struct Curl_easy *data,
+                              const char *buf, size_t blen);
 
 #endif /* HEADER_CURL_SENDF_H */
diff --git a/third-party/curl/lib/setopt.c b/third-party/curl/lib/setopt.c
index 2cef1b3d82..eb9ff2e396 100644
--- a/third-party/curl/lib/setopt.c
+++ b/third-party/curl/lib/setopt.c
@@ -21,11 +21,8 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include <limits.h>
-
 #ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
 #endif
@@ -41,33 +38,59 @@
 #include "progress.h"
 #include "content_encoding.h"
 #include "strcase.h"
-#include "share.h"
+#include "curl_share.h"
 #include "vtls/vtls.h"
-#include "warnless.h"
-#include "sendf.h"
-#include "http2.h"
+#include "curl_trc.h"
+#include "hostip.h"
 #include "setopt.h"
-#include "multiif.h"
 #include "altsvc.h"
 #include "hsts.h"
+#include "tftp.h"
+#include "curlx/strdup.h"
+#include "escape.h"
+#include "bufref.h"
+#include "vauth/vauth.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+static CURLcode setopt_set_timeout_sec(timediff_t *ptimeout_ms, long secs)
+{
+  if(secs < 0)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+#if LONG_MAX > (TIMEDIFF_T_MAX / 1000)
+  if(secs > (TIMEDIFF_T_MAX / 1000)) {
+    *ptimeout_ms = TIMEDIFF_T_MAX;
+    return CURLE_OK;
+  }
+#endif
+  *ptimeout_ms = (timediff_t)secs * 1000;
+  return CURLE_OK;
+}
+
+static CURLcode setopt_set_timeout_ms(timediff_t *ptimeout_ms, long ms)
+{
+  if(ms < 0)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+#if LONG_MAX > TIMEDIFF_T_MAX
+  if(ms > TIMEDIFF_T_MAX) {
+    *ptimeout_ms = TIMEDIFF_T_MAX;
+    return CURLE_OK;
+  }
+#endif
+  *ptimeout_ms = (timediff_t)ms;
+  return CURLE_OK;
+}
 
 CURLcode Curl_setstropt(char **charp, const char *s)
 {
   /* Release the previous storage at `charp' and replace by a dynamic storage
      copy of `s'. Return CURLE_OK or CURLE_OUT_OF_MEMORY. */
 
-  Curl_safefree(*charp);
+  curlx_safefree(*charp);
 
   if(s) {
     if(strlen(s) > CURL_MAX_INPUT_LENGTH)
       return CURLE_BAD_FUNCTION_ARGUMENT;
 
-    *charp = strdup(s);
+    *charp = curlx_strdup(s);
     if(!*charp)
       return CURLE_OUT_OF_MEMORY;
   }
@@ -81,15 +104,15 @@ CURLcode Curl_setblobopt(struct curl_blob **blobp,
   /* free the previous storage at `blobp' and replace by a dynamic storage
      copy of blob. If CURL_BLOB_COPY is set, the data is copied. */
 
-  Curl_safefree(*blobp);
+  curlx_safefree(*blobp);
 
   if(blob) {
     struct curl_blob *nblob;
-    if(blob->len > CURL_MAX_INPUT_LENGTH)
+    if(!blob->data || !blob->len || (blob->len > CURL_MAX_INPUT_LENGTH))
       return CURLE_BAD_FUNCTION_ARGUMENT;
     nblob = (struct curl_blob *)
-      malloc(sizeof(struct curl_blob) +
-             ((blob->flags & CURL_BLOB_COPY) ? blob->len : 0));
+      curlx_malloc(sizeof(struct curl_blob) +
+                   ((blob->flags & CURL_BLOB_COPY) ? blob->len : 0));
     if(!nblob)
       return CURLE_OUT_OF_MEMORY;
     *nblob = *blob;
@@ -106,74 +129,98 @@ CURLcode Curl_setblobopt(struct curl_blob **blobp,
   return CURLE_OK;
 }
 
-static CURLcode setstropt_userpwd(char *option, char **userp, char **passwdp)
+static CURLcode setstropt_userpwd(const char *option, char **userp,
+                                  char **passwdp)
 {
-  CURLcode result = CURLE_OK;
   char *user = NULL;
   char *passwd = NULL;
 
-  /* Parse the login details if specified. It not then we treat NULL as a hint
-     to clear the existing data */
+  DEBUGASSERT(userp);
+  DEBUGASSERT(passwdp);
+
+  /* Parse the login details if specified. If not, then we treat NULL as a
+     hint to clear the existing data */
   if(option) {
     size_t len = strlen(option);
+    CURLcode result;
     if(len > CURL_MAX_INPUT_LENGTH)
       return CURLE_BAD_FUNCTION_ARGUMENT;
 
-    result = Curl_parse_login_details(option, len,
-                                      (userp ? &user : NULL),
-                                      (passwdp ? &passwd : NULL),
-                                      NULL);
+    result = Curl_parse_login_details(option, len, &user, &passwd, NULL);
+    if(result)
+      return result;
   }
 
-  if(!result) {
-    /* Store the username part of option if required */
-    if(userp) {
-      if(!user && option && option[0] == ':') {
-        /* Allocate an empty string instead of returning NULL as user name */
-        user = strdup("");
-        if(!user)
-          result = CURLE_OUT_OF_MEMORY;
-      }
+  curlx_free(*userp);
+  *userp = user;
 
-      Curl_safefree(*userp);
-      *userp = user;
-    }
+  curlx_free(*passwdp);
+  *passwdp = passwd;
 
-    /* Store the password part of option if required */
-    if(passwdp) {
-      Curl_safefree(*passwdp);
-      *passwdp = passwd;
-    }
-  }
-
-  return result;
+  return CURLE_OK;
 }
 
-#define C_SSLVERSION_VALUE(x) (x & 0xffff)
-#define C_SSLVERSION_MAX_VALUE(x) (x & 0xffff0000)
+static CURLcode setstropt_interface(char *option, char **devp,
+                                    char **ifacep, char **hostp)
+{
+  char *dev = NULL;
+  char *iface = NULL;
+  char *host = NULL;
+  CURLcode result;
+
+  DEBUGASSERT(devp);
+  DEBUGASSERT(ifacep);
+  DEBUGASSERT(hostp);
+
+  if(option) {
+    /* Parse the interface details if set, otherwise clear them all */
+    result = Curl_parse_interface(option, &dev, &iface, &host);
+    if(result)
+      return result;
+  }
+  curlx_free(*devp);
+  *devp = dev;
+
+  curlx_free(*ifacep);
+  *ifacep = iface;
+
+  curlx_free(*hostp);
+  *hostp = host;
+
+  return CURLE_OK;
+}
+
+#ifdef USE_SSL
+#define C_SSLVERSION_VALUE(x)     ((x) & 0xffff)
+#define C_SSLVERSION_MAX_VALUE(x) ((unsigned long)(x) & 0xffff0000)
+#endif
 
 static CURLcode protocol2num(const char *str, curl_prot_t *val)
 {
+  /*
+   * We are asked to cherry-pick protocols, so play it safe and disallow all
+   * protocols to start with, and re-add the wanted ones back in.
+   */
+  *val = 0;
+
   if(!str)
     return CURLE_BAD_FUNCTION_ARGUMENT;
 
   if(curl_strequal(str, "all")) {
-    *val = ~(curl_prot_t) 0;
+    *val = ~(curl_prot_t)0;
     return CURLE_OK;
   }
 
-  *val = 0;
-
   do {
     const char *token = str;
     size_t tlen;
 
     str = strchr(str, ',');
-    tlen = str? (size_t) (str - token): strlen(token);
+    tlen = str ? (size_t)(str - token) : strlen(token);
     if(tlen) {
-      const struct Curl_handler *h = Curl_builtin_scheme(token, tlen);
+      const struct Curl_scheme *h = Curl_getn_scheme(token, tlen);
 
-      if(!h)
+      if(!h || !h->run)
         return CURLE_UNSUPPORTED_PROTOCOL;
 
       *val |= h->protocol;
@@ -186,185 +233,410 @@ static CURLcode protocol2num(const char *str, curl_prot_t *val)
   return CURLE_OK;
 }
 
-/*
- * Do not make Curl_vsetopt() static: it is called from
- * packages/OS400/ccsidcurl.c.
- */
-CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
+#if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_PROXY)
+static CURLcode httpauth(struct Curl_easy *data, bool proxy,
+                         unsigned long auth)
 {
-  char *argptr;
-  CURLcode result = CURLE_OK;
-  long arg;
-  unsigned long uarg;
-  curl_off_t bigsize;
+  if(auth != CURLAUTH_NONE) {
+    int bitcheck = 0;
+    bool authbits = FALSE;
+    if(auth & CURLAUTH_DIGEST_IE) {
+      auth |= CURLAUTH_DIGEST; /* set standard digest bit */
+      auth &= ~CURLAUTH_DIGEST_IE; /* drop the legacy bit */
+    }
 
+    /* switch off bits we cannot support */
+#ifndef USE_NTLM
+    auth &= ~CURLAUTH_NTLM; /* no NTLM support */
+#endif
+#ifndef USE_SPNEGO
+    auth &= ~CURLAUTH_NEGOTIATE; /* no Negotiate (SPNEGO) auth without GSS-API
+                                    or SSPI */
+#endif
+
+    /* check if any auth bit lower than CURLAUTH_ONLY is still set */
+    while(bitcheck < 31) {
+      if(auth & (1UL << bitcheck++)) {
+        authbits = TRUE;
+        break;
+      }
+    }
+    if(!authbits)
+      return CURLE_NOT_BUILT_IN; /* no supported types left! */
+  }
+  if(proxy)
+    data->set.proxyauth = (uint32_t)auth;
+  else
+    data->set.httpauth = (uint32_t)auth;
+  return CURLE_OK;
+}
+#endif /* !CURL_DISABLE_HTTP || !CURL_DISABLE_PROXY */
+
+#ifndef CURL_DISABLE_HTTP
+static CURLcode setopt_HTTP_VERSION(struct Curl_easy *data, long arg)
+{
+  /*
+   * This sets a requested HTTP version to be used. The value is one of
+   * the listed enums in curl/curl.h.
+   */
+  switch(arg) {
+  case CURL_HTTP_VERSION_NONE:
+    /* accepted */
+    break;
+  case CURL_HTTP_VERSION_1_0:
+  case CURL_HTTP_VERSION_1_1:
+    /* accepted */
+    break;
+#ifdef USE_HTTP2
+  case CURL_HTTP_VERSION_2_0:
+  case CURL_HTTP_VERSION_2TLS:
+  case CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE:
+    /* accepted */
+    break;
+#endif
+#ifdef USE_HTTP3
+  case CURL_HTTP_VERSION_3:
+  case CURL_HTTP_VERSION_3ONLY:
+    /* accepted */
+    break;
+#endif
+  default:
+    /* not accepted */
+    if(arg < CURL_HTTP_VERSION_NONE)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    return CURLE_UNSUPPORTED_PROTOCOL;
+  }
+  data->set.httpwant = (unsigned char)arg;
+  return CURLE_OK;
+}
+#endif /* !CURL_DISABLE_HTTP */
+
+#ifdef USE_SSL
+CURLcode Curl_setopt_SSLVERSION(struct Curl_easy *data, CURLoption option,
+                                long arg)
+{
+  /*
+   * Set explicit SSL version to try to connect with, as some SSL
+   * implementations are lame.
+   */
+  {
+    long version, version_max;
+    struct ssl_primary_config *primary = &data->set.ssl.primary;
+#ifndef CURL_DISABLE_PROXY
+    if(option != CURLOPT_SSLVERSION)
+      primary = &data->set.proxy_ssl.primary;
+#else
+    (void)option; /* unused */
+#endif
+    version = C_SSLVERSION_VALUE(arg);
+    version_max = (long)C_SSLVERSION_MAX_VALUE(arg);
+
+    if(version < CURL_SSLVERSION_DEFAULT ||
+       version == CURL_SSLVERSION_SSLv2 ||
+       version == CURL_SSLVERSION_SSLv3 ||
+       version >= CURL_SSLVERSION_LAST ||
+       version_max < CURL_SSLVERSION_MAX_NONE ||
+       version_max >= CURL_SSLVERSION_MAX_LAST)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    if(version == CURL_SSLVERSION_DEFAULT)
+      version = CURL_SSLVERSION_TLSv1_2;
+
+    primary->version = (unsigned char)version;
+    primary->version_max = (unsigned int)version_max;
+  }
+  return CURLE_OK;
+}
+#endif /* !USE_SSL */
+
+#ifndef CURL_DISABLE_RTSP
+static CURLcode setopt_RTSP_REQUEST(struct Curl_easy *data, long arg)
+{
+  /*
+   * Set the RTSP request method (OPTIONS, SETUP, PLAY, etc...) Would this be
+   * better if the RTSPREQ_* were moved into here?
+   */
+  Curl_RtspReq rtspreq = RTSPREQ_NONE;
+  switch(arg) {
+  case CURL_RTSPREQ_OPTIONS:
+    rtspreq = RTSPREQ_OPTIONS;
+    break;
+  case CURL_RTSPREQ_DESCRIBE:
+    rtspreq = RTSPREQ_DESCRIBE;
+    break;
+  case CURL_RTSPREQ_ANNOUNCE:
+    rtspreq = RTSPREQ_ANNOUNCE;
+    break;
+  case CURL_RTSPREQ_SETUP:
+    rtspreq = RTSPREQ_SETUP;
+    break;
+  case CURL_RTSPREQ_PLAY:
+    rtspreq = RTSPREQ_PLAY;
+    break;
+  case CURL_RTSPREQ_PAUSE:
+    rtspreq = RTSPREQ_PAUSE;
+    break;
+  case CURL_RTSPREQ_TEARDOWN:
+    rtspreq = RTSPREQ_TEARDOWN;
+    break;
+  case CURL_RTSPREQ_GET_PARAMETER:
+    rtspreq = RTSPREQ_GET_PARAMETER;
+    break;
+  case CURL_RTSPREQ_SET_PARAMETER:
+    rtspreq = RTSPREQ_SET_PARAMETER;
+    break;
+  case CURL_RTSPREQ_RECORD:
+    rtspreq = RTSPREQ_RECORD;
+    break;
+  case CURL_RTSPREQ_RECEIVE:
+    rtspreq = RTSPREQ_RECEIVE;
+    break;
+  default:
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
+
+  data->set.rtspreq = rtspreq;
+  return CURLE_OK;
+}
+#endif /* !CURL_DISABLE_RTSP */
+
+static CURLcode setopt_long_bool(struct Curl_easy *data, CURLoption option,
+                                 long arg)
+{
+  bool enabled = !!arg;
+  int ok = 1;
+  struct UserDefined *s = &data->set;
   switch(option) {
-  case CURLOPT_DNS_CACHE_TIMEOUT:
-    arg = va_arg(param, long);
-    if(arg < -1)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    else if(arg > INT_MAX)
-      arg = INT_MAX;
-
-    data->set.dns_cache_timeout = (int)arg;
-    break;
-  case CURLOPT_CA_CACHE_TIMEOUT:
-    arg = va_arg(param, long);
-    if(arg < -1)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    else if(arg > INT_MAX)
-      arg = INT_MAX;
-
-    data->set.general_ssl.ca_cache_timeout = (int)arg;
-    break;
-  case CURLOPT_DNS_USE_GLOBAL_CACHE:
-    /* deprecated */
-    break;
-  case CURLOPT_SSL_CIPHER_LIST:
-    /* set a list of cipher we want to use in the SSL connection */
-    result = Curl_setstropt(&data->set.str[STRING_SSL_CIPHER_LIST],
-                            va_arg(param, char *));
-    break;
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXY_SSL_CIPHER_LIST:
-    /* set a list of cipher we want to use in the SSL connection for proxy */
-    result = Curl_setstropt(&data->set.str[STRING_SSL_CIPHER_LIST_PROXY],
-                            va_arg(param, char *));
-    break;
-#endif
-  case CURLOPT_TLS13_CIPHERS:
-    if(Curl_ssl_supports(data, SSLSUPP_TLS13_CIPHERSUITES)) {
-      /* set preferred list of TLS 1.3 cipher suites */
-      result = Curl_setstropt(&data->set.str[STRING_SSL_CIPHER13_LIST],
-                              va_arg(param, char *));
-    }
-    else
-      return CURLE_NOT_BUILT_IN;
-    break;
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXY_TLS13_CIPHERS:
-    if(Curl_ssl_supports(data, SSLSUPP_TLS13_CIPHERSUITES)) {
-      /* set preferred list of TLS 1.3 cipher suites for proxy */
-      result = Curl_setstropt(&data->set.str[STRING_SSL_CIPHER13_LIST_PROXY],
-                              va_arg(param, char *));
-    }
-    else
-      return CURLE_NOT_BUILT_IN;
-    break;
-#endif
-  case CURLOPT_RANDOM_FILE:
-    break;
-  case CURLOPT_EGDSOCKET:
-    break;
-  case CURLOPT_MAXCONNECTS:
-    /*
-     * Set the absolute number of maximum simultaneous alive connection that
-     * libcurl is allowed to have.
-     */
-    arg = va_arg(param, long);
-    if(arg < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.maxconnects = arg;
-    break;
   case CURLOPT_FORBID_REUSE:
     /*
      * When this transfer is done, it must not be left to be reused by a
      * subsequent transfer but shall be closed immediately.
      */
-    data->set.reuse_forbid = (0 != va_arg(param, long)) ? TRUE : FALSE;
+    s->reuse_forbid = enabled;
     break;
   case CURLOPT_FRESH_CONNECT:
     /*
      * This transfer shall not use a previously cached connection but
      * should be made with a fresh new connect!
      */
-    data->set.reuse_fresh = (0 != va_arg(param, long)) ? TRUE : FALSE;
+    s->reuse_fresh = enabled;
     break;
   case CURLOPT_VERBOSE:
     /*
      * Verbose means infof() calls that give a lot of information about
      * the connection and transfer procedures as well as internal choices.
      */
-    data->set.verbose = (0 != va_arg(param, long)) ? TRUE : FALSE;
+    s->verbose = enabled;
     break;
   case CURLOPT_HEADER:
     /*
      * Set to include the header in the general data output stream.
      */
-    data->set.include_header = (0 != va_arg(param, long)) ? TRUE : FALSE;
+    s->include_header = enabled;
     break;
   case CURLOPT_NOPROGRESS:
     /*
      * Shut off the internal supported progress meter
      */
-    data->set.hide_progress = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    if(data->set.hide_progress)
-      data->progress.flags |= PGRS_HIDE;
-    else
-      data->progress.flags &= ~PGRS_HIDE;
+    data->progress.hide = enabled;
     break;
   case CURLOPT_NOBODY:
     /*
      * Do not include the body part in the output data stream.
      */
-    data->set.opt_no_body = (0 != va_arg(param, long)) ? TRUE : FALSE;
+    s->opt_no_body = enabled;
 #ifndef CURL_DISABLE_HTTP
-    if(data->set.opt_no_body)
+    if(s->opt_no_body)
       /* in HTTP lingo, no body means using the HEAD request... */
-      data->set.method = HTTPREQ_HEAD;
-    else if(data->set.method == HTTPREQ_HEAD)
-      data->set.method = HTTPREQ_GET;
+      s->method = HTTPREQ_HEAD;
+    else if(s->method == HTTPREQ_HEAD)
+      s->method = HTTPREQ_GET;
 #endif
     break;
   case CURLOPT_FAILONERROR:
     /*
-     * Don't output the >=400 error code HTML-page, but instead only
+     * Do not output the >=400 error code HTML-page, but instead only
      * return error.
      */
-    data->set.http_fail_on_error = (0 != va_arg(param, long)) ? TRUE : FALSE;
+    s->http_fail_on_error = enabled;
     break;
   case CURLOPT_KEEP_SENDING_ON_ERROR:
-    data->set.http_keep_sending_on_error = (0 != va_arg(param, long)) ?
-      TRUE : FALSE;
+    s->http_keep_sending_on_error = enabled;
     break;
   case CURLOPT_UPLOAD:
   case CURLOPT_PUT:
     /*
-     * We want to sent data to the remote host. If this is HTTP, that equals
+     * We want to send data to the remote host. If this is HTTP, that equals
      * using the PUT request.
      */
-    arg = va_arg(param, long);
-    if(arg) {
+    if(enabled) {
       /* If this is HTTP, PUT is what's needed to "upload" */
-      data->set.method = HTTPREQ_PUT;
-      data->set.opt_no_body = FALSE; /* this is implied */
+      s->method = HTTPREQ_PUT;
+      s->opt_no_body = FALSE; /* this is implied */
     }
     else
       /* In HTTP, the opposite of upload is GET (unless NOBODY is true as
          then this can be changed to HEAD later on) */
-      data->set.method = HTTPREQ_GET;
-    break;
-  case CURLOPT_REQUEST_TARGET:
-    result = Curl_setstropt(&data->set.str[STRING_TARGET],
-                            va_arg(param, char *));
+      s->method = HTTPREQ_GET;
     break;
   case CURLOPT_FILETIME:
     /*
      * Try to get the file time of the remote document. The time will
      * later (possibly) become available using curl_easy_getinfo().
      */
-    data->set.get_filetime = (0 != va_arg(param, long)) ? TRUE : FALSE;
+    s->get_filetime = enabled;
     break;
-  case CURLOPT_SERVER_RESPONSE_TIMEOUT:
+#ifndef CURL_DISABLE_HTTP
+  case CURLOPT_HTTP09_ALLOWED:
+    s->http09_allowed = enabled;
+    break;
+#ifndef CURL_DISABLE_COOKIES
+  case CURLOPT_COOKIESESSION:
     /*
-     * Option that specifies how quickly a server response must be obtained
-     * before it is considered failure. For pingpong protocols.
+     * Set this option to TRUE to start a new "cookie session". It will
+     * prevent the forthcoming read-cookies-from-file actions to accept
+     * cookies that are marked as being session cookies, as they belong to a
+     * previous session.
      */
-    arg = va_arg(param, long);
-    if((arg >= 0) && (arg <= (INT_MAX/1000)))
-      data->set.server_response_timeout = (unsigned int)arg * 1000;
+    s->cookiesession = enabled;
+    break;
+#endif
+  case CURLOPT_AUTOREFERER:
+    /*
+     * Switch on automatic referer that gets set if curl follows locations.
+     */
+    s->http_auto_referer = enabled;
+    break;
+  case CURLOPT_TRANSFER_ENCODING:
+    s->http_transfer_encoding = enabled;
+    break;
+  case CURLOPT_UNRESTRICTED_AUTH:
+    /*
+     * Send authentication (user+password) when following locations, even when
+     * hostname changed.
+     */
+    s->allow_auth_to_other_hosts = enabled;
+    break;
+  case CURLOPT_HTTP_TRANSFER_DECODING:
+    /*
+     * disable libcurl transfer encoding is used
+     */
+    s->http_te_skip = !enabled; /* reversed */
+    break;
+  case CURLOPT_HTTP_CONTENT_DECODING:
+    /*
+     * raw data passed to the application when content encoding is used
+     */
+    s->http_ce_skip = !enabled; /* reversed */
+    break;
+  case CURLOPT_HTTPGET:
+    /*
+     * Set to force us do HTTP GET
+     */
+    if(enabled) {
+      s->method = HTTPREQ_GET;
+      s->opt_no_body = FALSE; /* this is implied */
+    }
+    break;
+  case CURLOPT_POST:
+    /* Does this option serve a purpose anymore? Yes it does, when
+       CURLOPT_POSTFIELDS is not used and the POST data is read off the
+       callback! */
+    if(enabled) {
+      s->method = HTTPREQ_POST;
+      s->opt_no_body = FALSE; /* this is implied */
+    }
     else
-      return CURLE_BAD_FUNCTION_ARGUMENT;
+      s->method = HTTPREQ_GET;
+    break;
+#endif /* !CURL_DISABLE_HTTP */
+#ifndef CURL_DISABLE_PROXY
+  case CURLOPT_HTTPPROXYTUNNEL:
+    /*
+     * Tunnel operations through the proxy instead of normal proxy use
+     */
+    s->tunnel_thru_httpproxy = enabled;
+    break;
+  case CURLOPT_HAPROXYPROTOCOL:
+    /*
+     * Set to send the HAProxy Proxy Protocol header
+     */
+    s->haproxyprotocol = enabled;
+    break;
+  case CURLOPT_PROXY_SSL_VERIFYPEER:
+    /*
+     * Enable peer SSL verifying for proxy.
+     */
+    s->proxy_ssl.primary.verifypeer = enabled;
+
+    /* Update the current connection proxy_ssl_config. */
+    Curl_ssl_conn_config_update(data, TRUE);
+    break;
+  case CURLOPT_PROXY_SSL_VERIFYHOST:
+    /*
+     * Enable verification of the hostname in the peer certificate for proxy
+     */
+    s->proxy_ssl.primary.verifyhost = enabled;
+    ok = 2;
+    /* Update the current connection proxy_ssl_config. */
+    Curl_ssl_conn_config_update(data, TRUE);
+    break;
+  case CURLOPT_PROXY_TRANSFER_MODE:
+    /*
+     * set transfer mode (;type=<a|i>) when doing FTP via an HTTP proxy
+     */
+    s->proxy_transfer_mode = enabled;
+    break;
+#endif /* !CURL_DISABLE_PROXY */
+#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
+  case CURLOPT_SOCKS5_GSSAPI_NEC:
+    /*
+     * Set flag for NEC SOCKS5 support
+     */
+    s->socks5_gssapi_nec = enabled;
+    break;
+#endif
+#ifdef CURL_LIST_ONLY_PROTOCOL
+  case CURLOPT_DIRLISTONLY:
+    /*
+     * An option that changes the command to one that asks for a list only, no
+     * file info details. Used for FTP, POP3 and SFTP.
+     */
+    s->list_only = enabled;
+    break;
+#endif
+  case CURLOPT_APPEND:
+    /*
+     * We want to upload and append to an existing file. Used for FTP and
+     * SFTP.
+     */
+    s->remote_append = enabled;
+    break;
+#ifndef CURL_DISABLE_FTP
+  case CURLOPT_FTP_USE_EPRT:
+    s->ftp_use_eprt = enabled;
+    break;
+  case CURLOPT_FTP_USE_EPSV:
+    s->ftp_use_epsv = enabled;
+    break;
+  case CURLOPT_FTP_USE_PRET:
+    s->ftp_use_pret = enabled;
+    break;
+  case CURLOPT_FTP_SKIP_PASV_IP:
+    /*
+     * Enable or disable FTP_SKIP_PASV_IP, which will disable/enable the
+     * bypass of the IP address in PASV responses.
+     */
+    s->ftp_skip_ip = enabled;
+    break;
+  case CURLOPT_WILDCARDMATCH:
+    s->wildcard_enabled = enabled;
+    break;
+#endif
+  case CURLOPT_CRLF:
+    /*
+     * Kludgy option to enable CRLF conversions. Subject for removal.
+     */
+    s->crlf = enabled;
     break;
 #ifndef CURL_DISABLE_TFTP
   case CURLOPT_TFTP_NO_OPTIONS:
@@ -372,36 +644,9 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
      * Option that prevents libcurl from sending TFTP option requests to the
      * server.
      */
-    data->set.tftp_no_options = va_arg(param, long) != 0;
+    s->tftp_no_options = enabled;
     break;
-  case CURLOPT_TFTP_BLKSIZE:
-    /*
-     * TFTP option that specifies the block size to use for data transmission.
-     */
-    arg = va_arg(param, long);
-    if(arg < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.tftp_blksize = arg;
-    break;
-#endif
-#ifndef CURL_DISABLE_NETRC
-  case CURLOPT_NETRC:
-    /*
-     * Parse the $HOME/.netrc file
-     */
-    arg = va_arg(param, long);
-    if((arg < CURL_NETRC_IGNORED) || (arg >= CURL_NETRC_LAST))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.use_netrc = (unsigned char)arg;
-    break;
-  case CURLOPT_NETRC_FILE:
-    /*
-     * Use this file instead of the $HOME/.netrc file
-     */
-    result = Curl_setstropt(&data->set.str[STRING_NETRC_FILE],
-                            va_arg(param, char *));
-    break;
-#endif
+#endif /* !CURL_DISABLE_TFTP */
   case CURLOPT_TRANSFERTEXT:
     /*
      * This option was previously named 'FTPASCII'. Renamed to work with
@@ -409,313 +654,678 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
      *
      * Transfer using ASCII (instead of BINARY).
      */
-    data->set.prefer_ascii = (0 != va_arg(param, long)) ? TRUE : FALSE;
+    s->prefer_ascii = enabled;
     break;
-  case CURLOPT_TIMECONDITION:
+  case CURLOPT_SSL_VERIFYPEER:
     /*
-     * Set HTTP time condition. This must be one of the defines in the
-     * curl/curl.h header file.
+     * Enable peer SSL verifying.
      */
-    arg = va_arg(param, long);
-    if((arg < CURL_TIMECOND_NONE) || (arg >= CURL_TIMECOND_LAST))
+    s->ssl.primary.verifypeer = enabled;
+
+    /* Update the current connection ssl_config. */
+    Curl_ssl_conn_config_update(data, FALSE);
+    break;
+#ifndef CURL_DISABLE_DOH
+  case CURLOPT_DOH_SSL_VERIFYPEER:
+    /*
+     * Enable peer SSL verifying for DoH.
+     */
+    s->doh_verifypeer = enabled;
+    break;
+  case CURLOPT_DOH_SSL_VERIFYHOST:
+    /*
+     * Enable verification of the hostname in the peer certificate for DoH
+     */
+    s->doh_verifyhost = enabled;
+    ok = 2;
+    break;
+  case CURLOPT_DOH_SSL_VERIFYSTATUS:
+    /*
+     * Enable certificate status verifying for DoH.
+     */
+    if(!Curl_ssl_cert_status_request())
+      return CURLE_NOT_BUILT_IN;
+
+    s->doh_verifystatus = enabled;
+    ok = 2;
+    break;
+#endif /* !CURL_DISABLE_DOH */
+  case CURLOPT_SSL_VERIFYHOST:
+    /*
+     * Enable verification of the hostname in the peer certificate
+     */
+
+    /* Obviously people are not reading documentation and too many thought
+       this argument took a boolean when it was not and misused it.
+       Treat 1 and 2 the same */
+    s->ssl.primary.verifyhost = enabled;
+    ok = 2;
+
+    /* Update the current connection ssl_config. */
+    Curl_ssl_conn_config_update(data, FALSE);
+    break;
+  case CURLOPT_SSL_VERIFYSTATUS:
+    /*
+     * Enable certificate status verifying.
+     */
+    if(!Curl_ssl_cert_status_request())
+      return CURLE_NOT_BUILT_IN;
+
+    s->ssl.primary.verifystatus = enabled;
+
+    /* Update the current connection ssl_config. */
+    Curl_ssl_conn_config_update(data, FALSE);
+    break;
+  case CURLOPT_CERTINFO:
+#ifdef USE_SSL
+    if(Curl_ssl_supports(data, SSLSUPP_CERTINFO))
+      s->ssl.certinfo = enabled;
+    else
+#endif
+      return CURLE_NOT_BUILT_IN;
+    break;
+  case CURLOPT_NOSIGNAL:
+    /*
+     * The application asks not to set any signal() or alarm() handlers,
+     * even when using a timeout.
+     */
+    s->no_signal = enabled;
+    break;
+  case CURLOPT_TCP_NODELAY:
+    /*
+     * Enable or disable TCP_NODELAY, which will disable/enable the Nagle
+     * algorithm
+     */
+    s->tcp_nodelay = enabled;
+    break;
+  case CURLOPT_IGNORE_CONTENT_LENGTH:
+    s->ignorecl = enabled;
+    break;
+  case CURLOPT_SSL_SESSIONID_CACHE:
+    s->ssl.primary.cache_session = enabled;
+#ifndef CURL_DISABLE_PROXY
+    s->proxy_ssl.primary.cache_session = s->ssl.primary.cache_session;
+#endif
+    break;
+#ifdef USE_SSH
+  case CURLOPT_SSH_COMPRESSION:
+    s->ssh_compression = enabled;
+    break;
+#endif /* !USE_SSH */
+#ifndef CURL_DISABLE_SMTP
+  case CURLOPT_MAIL_RCPT_ALLOWFAILS:
+    /* allow RCPT TO command to fail for some recipients */
+    s->mail_rcpt_allowfails = enabled;
+    break;
+#endif /* !CURL_DISABLE_SMTP */
+  case CURLOPT_SASL_IR:
+    /* Enable/disable SASL initial response */
+    s->sasl_ir = enabled;
+    break;
+  case CURLOPT_TCP_KEEPALIVE:
+    s->tcp_keepalive = enabled;
+    break;
+  case CURLOPT_TCP_FASTOPEN:
+#if defined(CONNECT_DATA_IDEMPOTENT) || defined(MSG_FASTOPEN) || \
+  defined(TCP_FASTOPEN_CONNECT)
+    s->tcp_fastopen = enabled;
+    break;
+#else
+    return CURLE_NOT_BUILT_IN;
+#endif
+  case CURLOPT_SSL_ENABLE_ALPN:
+    s->ssl_enable_alpn = enabled;
+    break;
+  case CURLOPT_PATH_AS_IS:
+    s->path_as_is = enabled;
+    break;
+  case CURLOPT_PIPEWAIT:
+    s->pipewait = enabled;
+    break;
+  case CURLOPT_SUPPRESS_CONNECT_HEADERS:
+    s->suppress_connect_headers = enabled;
+    break;
+#ifndef CURL_DISABLE_SHUFFLE_DNS
+  case CURLOPT_DNS_SHUFFLE_ADDRESSES:
+    s->dns_shuffle_addresses = enabled;
+    break;
+#endif
+  case CURLOPT_DISALLOW_USERNAME_IN_URL:
+    s->disallow_username_in_url = enabled;
+    break;
+  case CURLOPT_QUICK_EXIT:
+    s->quick_exit = enabled;
+    break;
+  default:
+    return CURLE_UNKNOWN_OPTION;
+  }
+  if((arg > ok) || (arg < 0))
+    /* reserve other values for future use */
+    infof(data, "boolean setopt(%d) got unsupported argument %ld,"
+          " treated as %d", (int)option, arg, enabled);
+
+  return CURLE_OK;
+}
+
+static CURLcode value_range(long *value, long below_error, long min, long max)
+{
+  if(*value < below_error)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  else if(*value < min)
+    *value = min;
+  else if(*value > max)
+    *value = max;
+  return CURLE_OK;
+}
+
+static CURLcode setopt_long_net(struct Curl_easy *data, CURLoption option,
+                                long arg)
+{
+  CURLcode result = CURLE_OK;
+  struct UserDefined *s = &data->set;
+
+  switch(option) {
+  case CURLOPT_DNS_CACHE_TIMEOUT:
+    if(arg != -1)
+      return setopt_set_timeout_sec(&s->dns_cache_timeout_ms, arg);
+    s->dns_cache_timeout_ms = -1;
+    break;
+  case CURLOPT_MAXCONNECTS:
+    result = value_range(&arg, 0, 0, INT_MAX);
+    if(!result)
+      s->maxconnects = arg ? (uint32_t)arg : DEFAULT_CONNCACHE_SIZE;
+    break;
+  case CURLOPT_SERVER_RESPONSE_TIMEOUT:
+    return setopt_set_timeout_sec(&s->server_response_timeout, arg);
+  case CURLOPT_SERVER_RESPONSE_TIMEOUT_MS:
+    return setopt_set_timeout_ms(&s->server_response_timeout, arg);
+  case CURLOPT_LOW_SPEED_LIMIT:
+    if(arg < 0)
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+    else
+      s->low_speed_limit = arg;
+    break;
+  case CURLOPT_LOW_SPEED_TIME:
+    result = value_range(&arg, 0, 0, USHRT_MAX);
+    if(!result)
+      s->low_speed_time = (uint16_t)arg;
+    break;
+  case CURLOPT_PORT:
+    if((arg < 0) || (arg > 65535))
       return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.timecondition = (unsigned char)(curl_TimeCond)arg;
+    s->use_port = (unsigned short)arg;
     break;
-  case CURLOPT_TIMEVALUE:
-    /*
-     * This is the value to compare with the remote document with the
-     * method set with CURLOPT_TIMECONDITION
-     */
-    data->set.timevalue = (time_t)va_arg(param, long);
+  case CURLOPT_TIMEOUT:
+    return setopt_set_timeout_sec(&s->timeout, arg);
+  case CURLOPT_TIMEOUT_MS:
+    return setopt_set_timeout_ms(&s->timeout, arg);
+  case CURLOPT_CONNECTTIMEOUT:
+    return setopt_set_timeout_sec(&s->connecttimeout, arg);
+  case CURLOPT_CONNECTTIMEOUT_MS:
+    return setopt_set_timeout_ms(&s->connecttimeout, arg);
+#ifndef CURL_DISABLE_BINDLOCAL
+  case CURLOPT_LOCALPORT:
+    if((arg < 0) || (arg > 65535))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->localport = curlx_sltous(arg);
     break;
+  case CURLOPT_LOCALPORTRANGE:
+    if((arg < 0) || (arg > 65535))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->localportrange = curlx_sltous(arg);
+    break;
+#endif
+  case CURLOPT_BUFFERSIZE:
+    result = value_range(&arg, 0, READBUFFER_MIN, READBUFFER_MAX);
+    if(!result)
+      s->buffer_size = (unsigned int)arg;
+    break;
+  case CURLOPT_UPLOAD_BUFFERSIZE:
+    result = value_range(&arg, 0, UPLOADBUFFER_MIN, UPLOADBUFFER_MAX);
+    if(!result)
+      s->upload_buffer_size = (unsigned int)arg;
+    break;
+  case CURLOPT_MAXFILESIZE:
+    if(arg < 0)
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+    else
+      s->max_filesize = arg;
+    break;
+  case CURLOPT_IPRESOLVE:
+    if((arg < CURL_IPRESOLVE_WHATEVER) || (arg > CURL_IPRESOLVE_V6))
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+    else
+      s->ipver = (unsigned char)arg;
+    break;
+  case CURLOPT_CONNECT_ONLY:
+    if(arg < 0 || arg > 2)
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+    else {
+      s->connect_only = !!arg;
+      s->connect_only_ws = (arg == 2);
+    }
+    break;
+#ifdef USE_IPV6
+  case CURLOPT_ADDRESS_SCOPE:
+#if SIZEOF_LONG > 4
+    if((unsigned long)arg > UINT_MAX)
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+    else
+#endif
+    s->scope_id = (unsigned int)arg;
+    break;
+#endif
+  case CURLOPT_TCP_KEEPIDLE:
+    result = value_range(&arg, 0, 0, INT_MAX);
+    if(!result)
+      s->tcp_keepidle = (int)arg;
+    break;
+  case CURLOPT_TCP_KEEPINTVL:
+    result = value_range(&arg, 0, 0, INT_MAX);
+    if(!result)
+      s->tcp_keepintvl = (int)arg;
+    break;
+  case CURLOPT_TCP_KEEPCNT:
+    result = value_range(&arg, 0, 0, INT_MAX);
+    if(!result)
+      s->tcp_keepcnt = (int)arg;
+    break;
+  case CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS:
+    return setopt_set_timeout_ms(&s->happy_eyeballs_timeout, arg);
+  case CURLOPT_UPKEEP_INTERVAL_MS:
+    return setopt_set_timeout_ms(&s->upkeep_interval_ms, arg);
+  case CURLOPT_MAXAGE_CONN:
+    return setopt_set_timeout_sec(&s->conn_max_idle_ms, arg);
+  case CURLOPT_MAXLIFETIME_CONN:
+    return setopt_set_timeout_sec(&s->conn_max_age_ms, arg);
+  case CURLOPT_DNS_USE_GLOBAL_CACHE:
+    /* deprecated */
+    break;
+  default:
+    return CURLE_UNKNOWN_OPTION;
+  }
+  return result;
+}
 
-  case CURLOPT_TIMEVALUE_LARGE:
-    /*
-     * This is the value to compare with the remote document with the
-     * method set with CURLOPT_TIMECONDITION
-     */
-    data->set.timevalue = (time_t)va_arg(param, curl_off_t);
+static CURLcode setopt_long_ssl(struct Curl_easy *data, CURLoption option,
+                                long arg)
+{
+#ifdef USE_SSL
+  CURLcode result = CURLE_OK;
+  struct UserDefined *s = &data->set;
+  switch(option) {
+  case CURLOPT_CA_CACHE_TIMEOUT:
+    if(Curl_ssl_supports(data, SSLSUPP_CA_CACHE)) {
+      result = value_range(&arg, -1, -1, INT_MAX);
+      if(!result)
+        s->general_ssl.ca_cache_timeout = (int)arg;
+    }
+    else
+      result = CURLE_NOT_BUILT_IN;
     break;
-
   case CURLOPT_SSLVERSION:
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXY_SSLVERSION:
 #endif
-    /*
-     * Set explicit SSL version to try to connect with, as some SSL
-     * implementations are lame.
-     */
-#ifdef USE_SSL
-    {
-      long version, version_max;
-      struct ssl_primary_config *primary = &data->set.ssl.primary;
+    return Curl_setopt_SSLVERSION(data, option, arg);
+  case CURLOPT_SSL_FALSESTART:
+    result = CURLE_NOT_BUILT_IN;
+    break;
+  case CURLOPT_USE_SSL:
+    if((arg < CURLUSESSL_NONE) || (arg >= CURLUSESSL_LAST))
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+    else
+      s->use_ssl = (unsigned char)arg;
+    break;
+  case CURLOPT_SSL_OPTIONS:
+    s->ssl.primary.ssl_options = (unsigned char)(arg & 0xff);
+    break;
 #ifndef CURL_DISABLE_PROXY
-      if(option != CURLOPT_SSLVERSION)
-        primary = &data->set.proxy_ssl.primary;
+  case CURLOPT_PROXY_SSL_OPTIONS:
+    s->proxy_ssl.primary.ssl_options = (unsigned char)(arg & 0xff);
+    break;
+#endif
+  case CURLOPT_SSL_ENABLE_NPN:
+    break;
+  case CURLOPT_SSLENGINE_DEFAULT:
+    curlx_safefree(s->str[STRING_SSL_ENGINE]);
+    result = Curl_ssl_set_engine_default(data);
+    break;
+  default:
+    return CURLE_UNKNOWN_OPTION;
+  }
+  return result;
+#else  /* USE_SSL */
+  (void)data;
+  (void)option;
+  (void)arg;
+  return CURLE_UNKNOWN_OPTION;
+#endif /* !USE_SSL */
+}
+
+#ifndef CURL_DISABLE_PROXY
+static void changeproxy(struct Curl_easy *data)
+{
+  Curl_auth_digest_cleanup(&data->state.proxydigest);
+  memset(&data->state.authproxy, 0, sizeof(data->state.authproxy));
+}
+
+static CURLcode setopt_long_proxy(struct Curl_easy *data, CURLoption option,
+                                  long arg)
+{
+  struct UserDefined *s = &data->set;
+
+  switch(option) {
+  case CURLOPT_PROXYPORT:
+    if((arg < 0) || (arg > UINT16_MAX))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    if(arg != s->proxyport)
+      changeproxy(data);
+    s->proxyport = (uint16_t)arg;
+    break;
+  case CURLOPT_PROXYAUTH:
+    return httpauth(data, TRUE, (unsigned long)arg);
+  case CURLOPT_PROXYTYPE:
+    if((arg < CURLPROXY_HTTP) || (arg > CURLPROXY_HTTPS3))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+#ifndef USE_PROXY_HTTP3
+    if(arg == CURLPROXY_HTTPS3)
+      return CURLE_NOT_BUILT_IN;
+#endif
+    s->proxytype = (unsigned char)arg;
+    break;
+  case CURLOPT_SOCKS5_AUTH:
+    if(arg & ~(CURLAUTH_BASIC | CURLAUTH_GSSAPI))
+      return CURLE_NOT_BUILT_IN;
+    s->socks5auth = (unsigned char)arg;
+    break;
+  default:
+    return CURLE_UNKNOWN_OPTION;
+  }
+  return CURLE_OK;
+}
+#else
+static CURLcode setopt_long_proxy(struct Curl_easy *data, CURLoption option,
+                                  long arg)
+{
+  (void)data;
+  (void)option;
+  (void)arg;
+  return CURLE_UNKNOWN_OPTION;
+}
 #endif
 
-      arg = va_arg(param, long);
+static CURLcode setopt_long_http(struct Curl_easy *data, CURLoption option,
+                                 long arg)
+{
+#ifndef CURL_DISABLE_HTTP
+  CURLcode result = CURLE_OK;
+  struct UserDefined *s = &data->set;
 
-      version = C_SSLVERSION_VALUE(arg);
-      version_max = C_SSLVERSION_MAX_VALUE(arg);
-
-      if(version < CURL_SSLVERSION_DEFAULT ||
-         version == CURL_SSLVERSION_SSLv2 ||
-         version == CURL_SSLVERSION_SSLv3 ||
-         version >= CURL_SSLVERSION_LAST ||
-         version_max < CURL_SSLVERSION_MAX_NONE ||
-         version_max >= CURL_SSLVERSION_MAX_LAST)
-        return CURLE_BAD_FUNCTION_ARGUMENT;
-
-      primary->version = (unsigned char)version;
-      primary->version_max = (unsigned int)version_max;
+  switch(option) {
+  case CURLOPT_FOLLOWLOCATION:
+    if((unsigned long)arg > 3)
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+    else
+      s->http_follow_mode = (unsigned char)arg;
+    break;
+  case CURLOPT_MAXREDIRS:
+    result = value_range(&arg, -1, -1, 0x7fff);
+    if(!result)
+      s->maxredirs = (short)arg;
+    break;
+  case CURLOPT_POSTREDIR:
+    if(arg < CURL_REDIR_GET_ALL)
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+    else {
+      s->post301 = !!(arg & CURL_REDIR_POST_301);
+      s->post302 = !!(arg & CURL_REDIR_POST_302);
+      s->post303 = !!(arg & CURL_REDIR_POST_303);
     }
+    break;
+  case CURLOPT_HEADEROPT:
+    s->sep_headers = !!(arg & CURLHEADER_SEPARATE);
+    break;
+  case CURLOPT_HTTPAUTH:
+    return httpauth(data, FALSE, (unsigned long)arg);
+  case CURLOPT_HTTP_VERSION:
+    return setopt_HTTP_VERSION(data, arg);
+  case CURLOPT_EXPECT_100_TIMEOUT_MS:
+    result = value_range(&arg, 0, 0, 0xffff);
+    if(!result)
+      s->expect_100_timeout = (unsigned short)arg;
+    break;
+  case CURLOPT_STREAM_WEIGHT:
+#if defined(USE_HTTP2) || defined(USE_HTTP3)
+    if((arg >= 1) && (arg <= 256))
+      s->priority.weight = (int)arg;
+    break;
 #else
     result = CURLE_NOT_BUILT_IN;
-#endif
-    break;
-
-    /* MQTT "borrows" some of the HTTP options */
-#if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_MQTT)
-  case CURLOPT_COPYPOSTFIELDS:
-    /*
-     * A string with POST data. Makes curl HTTP POST. Even if it is NULL.
-     * If needed, CURLOPT_POSTFIELDSIZE must have been set prior to
-     *  CURLOPT_COPYPOSTFIELDS and not altered later.
-     */
-    argptr = va_arg(param, char *);
-
-    if(!argptr || data->set.postfieldsize == -1)
-      result = Curl_setstropt(&data->set.str[STRING_COPYPOSTFIELDS], argptr);
-    else {
-      /*
-       *  Check that requested length does not overflow the size_t type.
-       */
-
-      if((data->set.postfieldsize < 0) ||
-         ((sizeof(curl_off_t) != sizeof(size_t)) &&
-          (data->set.postfieldsize > (curl_off_t)((size_t)-1))))
-        result = CURLE_OUT_OF_MEMORY;
-      else {
-        char *p;
-
-        (void) Curl_setstropt(&data->set.str[STRING_COPYPOSTFIELDS], NULL);
-
-        /* Allocate even when size == 0. This satisfies the need of possible
-           later address compare to detect the COPYPOSTFIELDS mode, and
-           to mark that postfields is used rather than read function or
-           form data.
-        */
-        p = malloc((size_t)(data->set.postfieldsize?
-                            data->set.postfieldsize:1));
-
-        if(!p)
-          result = CURLE_OUT_OF_MEMORY;
-        else {
-          if(data->set.postfieldsize)
-            memcpy(p, argptr, (size_t)data->set.postfieldsize);
-
-          data->set.str[STRING_COPYPOSTFIELDS] = p;
-        }
-      }
-    }
-
-    data->set.postfields = data->set.str[STRING_COPYPOSTFIELDS];
-    data->set.method = HTTPREQ_POST;
-    break;
-
-  case CURLOPT_POSTFIELDS:
-    /*
-     * Like above, but use static data instead of copying it.
-     */
-    data->set.postfields = va_arg(param, void *);
-    /* Release old copied data. */
-    (void) Curl_setstropt(&data->set.str[STRING_COPYPOSTFIELDS], NULL);
-    data->set.method = HTTPREQ_POST;
-    break;
-
-  case CURLOPT_POSTFIELDSIZE:
-    /*
-     * The size of the POSTFIELD data to prevent libcurl to do strlen() to
-     * figure it out. Enables binary posts.
-     */
-    bigsize = va_arg(param, long);
-    if(bigsize < -1)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-
-    if(data->set.postfieldsize < bigsize &&
-       data->set.postfields == data->set.str[STRING_COPYPOSTFIELDS]) {
-      /* Previous CURLOPT_COPYPOSTFIELDS is no longer valid. */
-      (void) Curl_setstropt(&data->set.str[STRING_COPYPOSTFIELDS], NULL);
-      data->set.postfields = NULL;
-    }
-
-    data->set.postfieldsize = bigsize;
-    break;
-
-  case CURLOPT_POSTFIELDSIZE_LARGE:
-    /*
-     * The size of the POSTFIELD data to prevent libcurl to do strlen() to
-     * figure it out. Enables binary posts.
-     */
-    bigsize = va_arg(param, curl_off_t);
-    if(bigsize < -1)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-
-    if(data->set.postfieldsize < bigsize &&
-       data->set.postfields == data->set.str[STRING_COPYPOSTFIELDS]) {
-      /* Previous CURLOPT_COPYPOSTFIELDS is no longer valid. */
-      (void) Curl_setstropt(&data->set.str[STRING_COPYPOSTFIELDS], NULL);
-      data->set.postfields = NULL;
-    }
-
-    data->set.postfieldsize = bigsize;
     break;
 #endif
-#ifndef CURL_DISABLE_HTTP
-  case CURLOPT_AUTOREFERER:
-    /*
-     * Switch on automatic referer that gets set if curl follows locations.
-     */
-    data->set.http_auto_referer = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
+  default:
+    return CURLE_UNKNOWN_OPTION;
+  }
+  return result;
+#else
+  (void)data;
+  (void)option;
+  (void)arg;
+  return CURLE_UNKNOWN_OPTION;
+#endif
+}
 
-  case CURLOPT_ACCEPT_ENCODING:
-    /*
-     * String to use at the value of Accept-Encoding header.
-     *
-     * If the encoding is set to "" we use an Accept-Encoding header that
-     * encompasses all the encodings we support.
-     * If the encoding is set to NULL we don't send an Accept-Encoding header
-     * and ignore an received Content-Encoding header.
-     *
-     */
-    argptr = va_arg(param, char *);
-    if(argptr && !*argptr) {
-      argptr = Curl_all_content_encodings();
-      if(!argptr)
-        result = CURLE_OUT_OF_MEMORY;
-      else {
-        result = Curl_setstropt(&data->set.str[STRING_ENCODING], argptr);
-        free(argptr);
-      }
-    }
+static CURLcode setopt_long_proto(struct Curl_easy *data, CURLoption option,
+                                  long arg)
+{
+  CURLcode result = CURLE_OK;
+  struct UserDefined *s = &data->set;
+
+  switch(option) {
+#ifndef CURL_DISABLE_TFTP
+  case CURLOPT_TFTP_BLKSIZE:
+    result = value_range(&arg, 0, TFTP_BLKSIZE_MIN, TFTP_BLKSIZE_MAX);
+    if(!result)
+      s->tftp_blksize = (unsigned short)arg;
+    break;
+#endif
+#ifndef CURL_DISABLE_NETRC
+  case CURLOPT_NETRC:
+    if((arg < CURL_NETRC_IGNORED) || (arg >= CURL_NETRC_LAST))
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
     else
-      result = Curl_setstropt(&data->set.str[STRING_ENCODING], argptr);
+      s->use_netrc = (unsigned char)arg;
     break;
-
-  case CURLOPT_TRANSFER_ENCODING:
-    data->set.http_transfer_encoding = (0 != va_arg(param, long)) ?
-      TRUE : FALSE;
+#endif
+#ifndef CURL_DISABLE_FTP
+  case CURLOPT_FTP_FILEMETHOD:
+    if((arg < CURLFTPMETHOD_DEFAULT) || (arg >= CURLFTPMETHOD_LAST))
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+    else
+      s->ftp_filemethod = (unsigned char)arg;
     break;
-
-  case CURLOPT_FOLLOWLOCATION:
-    /*
-     * Follow Location: header hints on an HTTP-server.
-     */
-    data->set.http_follow_location = (0 != va_arg(param, long)) ? TRUE : FALSE;
+  case CURLOPT_FTP_SSL_CCC:
+    if((arg < CURLFTPSSL_CCC_NONE) || (arg >= CURLFTPSSL_CCC_LAST))
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+    else
+      s->ftp_ccc = (unsigned char)arg;
     break;
-
-  case CURLOPT_UNRESTRICTED_AUTH:
-    /*
-     * Send authentication (user+password) when following locations, even when
-     * hostname changed.
-     */
-    data->set.allow_auth_to_other_hosts =
-      (0 != va_arg(param, long)) ? TRUE : FALSE;
+  case CURLOPT_FTPSSLAUTH:
+    if((arg < CURLFTPAUTH_DEFAULT) || (arg >= CURLFTPAUTH_LAST))
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+    else
+      s->ftpsslauth = (unsigned char)arg;
     break;
+  case CURLOPT_ACCEPTTIMEOUT_MS:
+    return setopt_set_timeout_ms(&s->accepttimeout, arg);
+#endif
+#if !defined(CURL_DISABLE_FTP) || defined(USE_SSH)
+  case CURLOPT_FTP_CREATE_MISSING_DIRS:
+    if((arg < CURLFTP_CREATE_DIR_NONE) || (arg > CURLFTP_CREATE_DIR_RETRY))
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+    else
+      s->ftp_create_missing_dirs = (unsigned char)arg;
+    break;
+  case CURLOPT_NEW_FILE_PERMS:
+    if((arg < 0) || (arg > 0777))
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+    else
+      s->new_file_perms = (unsigned int)arg;
+    break;
+#endif
+#ifndef CURL_DISABLE_RTSP
+  case CURLOPT_RTSP_REQUEST:
+    return setopt_RTSP_REQUEST(data, arg);
+  case CURLOPT_RTSP_CLIENT_CSEQ:
+    result = value_range(&arg, 0, 0, INT_MAX);
+    if(!result)
+      data->state.rtsp_next_client_CSeq = (uint32_t)arg;
+    break;
+  case CURLOPT_RTSP_SERVER_CSEQ:
+    result = value_range(&arg, 0, 0, INT_MAX);
+    if(!result)
+      data->state.rtsp_next_server_CSeq = (uint32_t)arg;
+    break;
+#endif
+#ifdef USE_SSH
+  case CURLOPT_SSH_AUTH_TYPES:
+    s->ssh_auth_types = (uint32_t)arg;
+    break;
+  case CURLOPT_NEW_DIRECTORY_PERMS:
+    if((arg < 0) || (arg > 0777))
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+    else
+      s->new_directory_perms = (unsigned int)arg;
+    break;
+#endif
+  case CURLOPT_PROTOCOLS:
+    s->allowed_protocols = (curl_prot_t)arg;
+    break;
+  case CURLOPT_REDIR_PROTOCOLS:
+    s->redir_protocols = (curl_prot_t)arg;
+    break;
+#ifndef CURL_DISABLE_WEBSOCKETS
+  case CURLOPT_WS_OPTIONS:
+    s->ws_raw_mode = (bool)(arg & CURLWS_RAW_MODE);
+    s->ws_no_auto_pong = (bool)(arg & CURLWS_NOAUTOPONG);
+    break;
+#endif
+  default:
+    return CURLE_UNKNOWN_OPTION;
+  }
+  return result;
+}
 
-  case CURLOPT_MAXREDIRS:
-    /*
-     * The maximum amount of hops you allow curl to follow Location:
-     * headers. This should mostly be used to detect never-ending loops.
-     */
-    arg = va_arg(param, long);
+static CURLcode setopt_long_misc(struct Curl_easy *data, CURLoption option,
+                                 long arg)
+{
+  struct UserDefined *s = &data->set;
+
+  switch(option) {
+  case CURLOPT_TIMECONDITION:
+    if((arg < CURL_TIMECOND_NONE) || (arg >= CURL_TIMECOND_LAST))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->timecondition = (unsigned char)arg;
+    break;
+  case CURLOPT_TIMEVALUE:
+    s->timevalue = (time_t)arg;
+    break;
+  case CURLOPT_POSTFIELDSIZE:
     if(arg < -1)
       return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.maxredirs = arg;
+    if(s->postfieldsize < arg &&
+       s->postfields == s->str[STRING_COPYPOSTFIELDS]) {
+      curlx_safefree(s->str[STRING_COPYPOSTFIELDS]);
+      s->postfields = NULL;
+    }
+    s->postfieldsize = arg;
     break;
-
-  case CURLOPT_POSTREDIR:
-    /*
-     * Set the behavior of POST when redirecting
-     * CURL_REDIR_GET_ALL - POST is changed to GET after 301 and 302
-     * CURL_REDIR_POST_301 - POST is kept as POST after 301
-     * CURL_REDIR_POST_302 - POST is kept as POST after 302
-     * CURL_REDIR_POST_303 - POST is kept as POST after 303
-     * CURL_REDIR_POST_ALL - POST is kept as POST after 301, 302 and 303
-     * other - POST is kept as POST after 301 and 302
-     */
-    arg = va_arg(param, long);
-    if(arg < CURL_REDIR_GET_ALL)
-      /* no return error on too high numbers since the bitmask could be
-         extended in a future */
+  case CURLOPT_INFILESIZE:
+    if(arg < -1)
       return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.keep_post = arg & CURL_REDIR_POST_ALL;
+    s->filesize = arg;
     break;
-
-  case CURLOPT_POST:
-    /* Does this option serve a purpose anymore? Yes it does, when
-       CURLOPT_POSTFIELDS isn't used and the POST data is read off the
-       callback! */
-    if(va_arg(param, long)) {
-      data->set.method = HTTPREQ_POST;
-      data->set.opt_no_body = FALSE; /* this is implied */
+  case CURLOPT_RESUME_FROM:
+    if(arg < -1)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->set_resume_from = arg;
+    break;
+  case CURLOPT_UPLOAD_FLAGS:
+    s->upload_flags = (unsigned char)arg;
+    break;
+#ifndef CURL_DISABLE_MIME
+  case CURLOPT_MIME_OPTIONS:
+    s->mime_formescape = !!(arg & CURLMIMEOPT_FORMESCAPE);
+    break;
+#endif
+#ifndef CURL_DISABLE_HSTS
+  case CURLOPT_HSTS_CTRL:
+    if(arg & CURLHSTS_ENABLE) {
+      if(!data->hsts) {
+        data->hsts = Curl_hsts_init();
+        if(!data->hsts)
+          return CURLE_OUT_OF_MEMORY;
+      }
+    }
+    else if(!data->share || !data->share->hsts) {
+      /* throw away the HSTS cache unless shared */
+      Curl_hsts_cleanup(&data->hsts);
+      /* flush all the entries */
+      curl_slist_free_all(data->state.hstslist);
+      data->state.hstslist = NULL;
     }
     else
-      data->set.method = HTTPREQ_GET;
-    break;
-
-#ifndef CURL_DISABLE_FORM_API
-  case CURLOPT_HTTPPOST:
-    /*
-     * Set to make us do HTTP POST. Legacy API-style.
-     */
-    data->set.httppost = va_arg(param, struct curl_httppost *);
-    data->set.method = HTTPREQ_POST_FORM;
-    data->set.opt_no_body = FALSE; /* this is implied */
-    Curl_mime_cleanpart(data->state.formp);
-    Curl_safefree(data->state.formp);
+      /* detach from shared HSTS cache without freeing it */
+      data->hsts = NULL;
     break;
 #endif
-
-#if !defined(CURL_DISABLE_AWS)
-  case CURLOPT_AWS_SIGV4:
-    /*
-     * String that is merged to some authentication
-     * parameters are used by the algorithm.
-     */
-    result = Curl_setstropt(&data->set.str[STRING_AWS_SIGV4],
-                            va_arg(param, char *));
-    /*
-     * Basic been set by default it need to be unset here
-     */
-    if(data->set.str[STRING_AWS_SIGV4])
-      data->set.httpauth = CURLAUTH_AWS_SIGV4;
+#ifndef CURL_DISABLE_ALTSVC
+  case CURLOPT_ALTSVC_CTRL:
+    return Curl_altsvc_ctrl(data, arg);
+#endif
+#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
+  case CURLOPT_GSSAPI_DELEGATION:
+    s->gssapi_delegation = (unsigned char)arg &
+      (CURLGSSAPI_DELEGATION_POLICY_FLAG | CURLGSSAPI_DELEGATION_FLAG);
     break;
 #endif
+  default:
+    return CURLE_UNKNOWN_OPTION;
+  }
+  return CURLE_OK;
+}
 
-  case CURLOPT_REFERER:
-    /*
-     * String to set in the HTTP Referer: field.
-     */
-    if(data->state.referer_alloc) {
-      Curl_safefree(data->state.referer);
-      data->state.referer_alloc = FALSE;
-    }
-    result = Curl_setstropt(&data->set.str[STRING_SET_REFERER],
-                            va_arg(param, char *));
-    data->state.referer = data->set.str[STRING_SET_REFERER];
-    break;
+static CURLcode setopt_long(struct Curl_easy *data, CURLoption option,
+                            long arg)
+{
+  typedef CURLcode (*setoptfunc)(struct Curl_easy *data,
+                                 CURLoption option, long arg);
+  static const setoptfunc setopt_call[] = {
+    setopt_long_bool,
+    setopt_long_net,
+    setopt_long_http,
+    setopt_long_proxy,
+    setopt_long_ssl,
+    setopt_long_proto,
+    setopt_long_misc
+  };
+  size_t i;
 
-  case CURLOPT_USERAGENT:
-    /*
-     * String to use in the HTTP User-Agent field
-     */
-    result = Curl_setstropt(&data->set.str[STRING_USERAGENT],
-                            va_arg(param, char *));
-    break;
+  for(i = 0; i < CURL_ARRAYSIZE(setopt_call); i++) {
+    CURLcode result = setopt_call[i](data, option, arg);
+    if(result != CURLE_UNKNOWN_OPTION)
+      return result;
+  }
+  return CURLE_UNKNOWN_OPTION;
+}
 
+static CURLcode setopt_slist(struct Curl_easy *data, CURLoption option,
+                             struct curl_slist *slist)
+{
+  CURLcode result = CURLE_OK;
+  struct UserDefined *s = &data->set;
+  switch(option) {
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXYHEADER:
     /*
@@ -728,855 +1338,1207 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
      *
      * Set this option to NULL to restore the previous behavior.
      */
-    data->set.proxyheaders = va_arg(param, struct curl_slist *);
+    s->proxyheaders = slist;
     break;
 #endif
-  case CURLOPT_HEADEROPT:
-    /*
-     * Set header option.
-     */
-    arg = va_arg(param, long);
-    data->set.sep_headers = (bool)((arg & CURLHEADER_SEPARATE)? TRUE: FALSE);
-    break;
-
-#if !defined(CURL_DISABLE_COOKIES)
-  case CURLOPT_COOKIE:
-    /*
-     * Cookie string to send to the remote server in the request.
-     */
-    result = Curl_setstropt(&data->set.str[STRING_COOKIE],
-                            va_arg(param, char *));
-    break;
-
-  case CURLOPT_COOKIEFILE:
-    /*
-     * Set cookie file to read and parse. Can be used multiple times.
-     */
-    argptr = (char *)va_arg(param, void *);
-    if(argptr) {
-      struct curl_slist *cl;
-      /* general protection against mistakes and abuse */
-      if(strlen(argptr) > CURL_MAX_INPUT_LENGTH)
-        return CURLE_BAD_FUNCTION_ARGUMENT;
-      /* append the cookie file name to the list of file names, and deal with
-         them later */
-      cl = curl_slist_append(data->set.cookielist, argptr);
-      if(!cl) {
-        curl_slist_free_all(data->set.cookielist);
-        data->set.cookielist = NULL;
-        return CURLE_OUT_OF_MEMORY;
-      }
-      data->set.cookielist = cl; /* store the list for later use */
-    }
-    else {
-      /* clear the list of cookie files */
-      curl_slist_free_all(data->set.cookielist);
-      data->set.cookielist = NULL;
-
-      if(!data->share || !data->share->cookies) {
-        /* throw away all existing cookies if this isn't a shared cookie
-           container */
-        Curl_cookie_clearall(data->cookies);
-        Curl_cookie_cleanup(data->cookies);
-      }
-      /* disable the cookie engine */
-      data->cookies = NULL;
-    }
-    break;
-
-  case CURLOPT_COOKIEJAR:
-    /*
-     * Set cookie file name to dump all cookies to when we're done.
-     */
-  {
-    struct CookieInfo *newcookies;
-    result = Curl_setstropt(&data->set.str[STRING_COOKIEJAR],
-                            va_arg(param, char *));
-
-    /*
-     * Activate the cookie parser. This may or may not already
-     * have been made.
-     */
-    newcookies = Curl_cookie_init(data, NULL, data->cookies,
-                                  data->set.cookiesession);
-    if(!newcookies)
-      result = CURLE_OUT_OF_MEMORY;
-    data->cookies = newcookies;
-  }
-  break;
-
-  case CURLOPT_COOKIESESSION:
-    /*
-     * Set this option to TRUE to start a new "cookie session". It will
-     * prevent the forthcoming read-cookies-from-file actions to accept
-     * cookies that are marked as being session cookies, as they belong to a
-     * previous session.
-     *
-     * In the original Netscape cookie spec, "session cookies" are cookies
-     * with no expire date set. RFC2109 describes the same action if no
-     * 'Max-Age' is set and RFC2965 includes the RFC2109 description and adds
-     * a 'Discard' action that can enforce the discard even for cookies that
-     * have a Max-Age.
-     *
-     * We run mostly with the original cookie spec, as hardly anyone implements
-     * anything else.
-     */
-    data->set.cookiesession = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-
-  case CURLOPT_COOKIELIST:
-    argptr = va_arg(param, char *);
-
-    if(!argptr)
-      break;
-
-    if(strcasecompare(argptr, "ALL")) {
-      /* clear all cookies */
-      Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
-      Curl_cookie_clearall(data->cookies);
-      Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
-    }
-    else if(strcasecompare(argptr, "SESS")) {
-      /* clear session cookies */
-      Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
-      Curl_cookie_clearsess(data->cookies);
-      Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
-    }
-    else if(strcasecompare(argptr, "FLUSH")) {
-      /* flush cookies to file, takes care of the locking */
-      Curl_flush_cookies(data, FALSE);
-    }
-    else if(strcasecompare(argptr, "RELOAD")) {
-      /* reload cookies from file */
-      Curl_cookie_loadfiles(data);
-      break;
-    }
-    else {
-      if(!data->cookies)
-        /* if cookie engine was not running, activate it */
-        data->cookies = Curl_cookie_init(data, NULL, NULL, TRUE);
-
-      /* general protection against mistakes and abuse */
-      if(strlen(argptr) > CURL_MAX_INPUT_LENGTH)
-        return CURLE_BAD_FUNCTION_ARGUMENT;
-      argptr = strdup(argptr);
-      if(!argptr || !data->cookies) {
-        result = CURLE_OUT_OF_MEMORY;
-        free(argptr);
-      }
-      else {
-        Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
-
-        if(checkprefix("Set-Cookie:", argptr))
-          /* HTTP Header format line */
-          Curl_cookie_add(data, data->cookies, TRUE, FALSE, argptr + 11, NULL,
-                          NULL, TRUE);
-
-        else
-          /* Netscape format line */
-          Curl_cookie_add(data, data->cookies, FALSE, FALSE, argptr, NULL,
-                          NULL, TRUE);
-
-        Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
-        free(argptr);
-      }
-    }
-
-    break;
-#endif /* !CURL_DISABLE_COOKIES */
-
-  case CURLOPT_HTTPGET:
-    /*
-     * Set to force us do HTTP GET
-     */
-    if(va_arg(param, long)) {
-      data->set.method = HTTPREQ_GET;
-      data->set.opt_no_body = FALSE; /* this is implied */
-    }
-    break;
-
-  case CURLOPT_HTTP_VERSION:
-    /*
-     * This sets a requested HTTP version to be used. The value is one of
-     * the listed enums in curl/curl.h.
-     */
-    arg = va_arg(param, long);
-    switch(arg) {
-    case CURL_HTTP_VERSION_NONE:
-#ifdef USE_HTTP2
-      /* TODO: this seems an undesirable quirk to force a behaviour on
-       * lower implementations that they should recognize independently? */
-      arg = CURL_HTTP_VERSION_2TLS;
-#endif
-      /* accepted */
-      break;
-    case CURL_HTTP_VERSION_1_0:
-    case CURL_HTTP_VERSION_1_1:
-      /* accepted */
-      break;
-#ifdef USE_HTTP2
-    case CURL_HTTP_VERSION_2_0:
-    case CURL_HTTP_VERSION_2TLS:
-    case CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE:
-      /* accepted */
-      break;
-#endif
-#ifdef ENABLE_QUIC
-    case CURL_HTTP_VERSION_3:
-    case CURL_HTTP_VERSION_3ONLY:
-      /* accepted */
-      break;
-#endif
-    default:
-      /* not accepted */
-      if(arg < CURL_HTTP_VERSION_NONE)
-        return CURLE_BAD_FUNCTION_ARGUMENT;
-      return CURLE_UNSUPPORTED_PROTOCOL;
-    }
-    data->set.httpwant = (unsigned char)arg;
-    break;
-
-  case CURLOPT_EXPECT_100_TIMEOUT_MS:
-    /*
-     * Time to wait for a response to an HTTP request containing an
-     * Expect: 100-continue header before sending the data anyway.
-     */
-    arg = va_arg(param, long);
-    if(arg < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.expect_100_timeout = arg;
-    break;
-
-  case CURLOPT_HTTP09_ALLOWED:
-    arg = va_arg(param, unsigned long);
-    if(arg > 1L)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-#ifdef USE_HYPER
-    /* Hyper does not support HTTP/0.9 */
-    if(arg)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-#else
-    data->set.http09_allowed = arg ? TRUE : FALSE;
-#endif
-    break;
-
+#ifndef CURL_DISABLE_HTTP
   case CURLOPT_HTTP200ALIASES:
     /*
      * Set a list of aliases for HTTP 200 in response header
      */
-    data->set.http200aliases = va_arg(param, struct curl_slist *);
-    break;
-#endif   /* CURL_DISABLE_HTTP */
-
-#if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_SMTP) ||       \
-    !defined(CURL_DISABLE_IMAP)
-# if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_MIME)
-  case CURLOPT_HTTPHEADER:
-    /*
-     * Set a list with HTTP headers to use (or replace internals with)
-     */
-    data->set.headers = va_arg(param, struct curl_slist *);
-    break;
-# endif
-
-# ifndef CURL_DISABLE_MIME
-  case CURLOPT_MIMEPOST:
-    /*
-     * Set to make us do MIME POST
-     */
-    result = Curl_mime_set_subparts(&data->set.mimepost,
-                                    va_arg(param, curl_mime *), FALSE);
-    if(!result) {
-      data->set.method = HTTPREQ_POST_MIME;
-      data->set.opt_no_body = FALSE; /* this is implied */
-#ifndef CURL_DISABLE_FORM_API
-      Curl_mime_cleanpart(data->state.formp);
-      Curl_safefree(data->state.formp);
-#endif
-    }
-    break;
-
-  case CURLOPT_MIME_OPTIONS:
-    data->set.mime_options = (unsigned int)va_arg(param, long);
-    break;
-# endif
-#endif
-
-  case CURLOPT_HTTPAUTH:
-    /*
-     * Set HTTP Authentication type BITMASK.
-     */
-  {
-    int bitcheck;
-    bool authbits;
-    unsigned long auth = va_arg(param, unsigned long);
-
-    if(auth == CURLAUTH_NONE) {
-      data->set.httpauth = auth;
-      break;
-    }
-
-    /* the DIGEST_IE bit is only used to set a special marker, for all the
-       rest we need to handle it as normal DIGEST */
-    data->state.authhost.iestyle =
-      (bool)((auth & CURLAUTH_DIGEST_IE) ? TRUE : FALSE);
-
-    if(auth & CURLAUTH_DIGEST_IE) {
-      auth |= CURLAUTH_DIGEST; /* set standard digest bit */
-      auth &= ~CURLAUTH_DIGEST_IE; /* unset ie digest bit */
-    }
-
-    /* switch off bits we can't support */
-#ifndef USE_NTLM
-    auth &= ~CURLAUTH_NTLM;    /* no NTLM support */
-    auth &= ~CURLAUTH_NTLM_WB; /* no NTLM_WB support */
-#elif !defined(NTLM_WB_ENABLED)
-    auth &= ~CURLAUTH_NTLM_WB; /* no NTLM_WB support */
-#endif
-#ifndef USE_SPNEGO
-    auth &= ~CURLAUTH_NEGOTIATE; /* no Negotiate (SPNEGO) auth without
-                                    GSS-API or SSPI */
-#endif
-
-    /* check if any auth bit lower than CURLAUTH_ONLY is still set */
-    bitcheck = 0;
-    authbits = FALSE;
-    while(bitcheck < 31) {
-      if(auth & (1UL << bitcheck++)) {
-        authbits = TRUE;
-        break;
-      }
-    }
-    if(!authbits)
-      return CURLE_NOT_BUILT_IN; /* no supported types left! */
-
-    data->set.httpauth = auth;
-  }
-  break;
-
-  case CURLOPT_CUSTOMREQUEST:
-    /*
-     * Set a custom string to use as request
-     */
-    result = Curl_setstropt(&data->set.str[STRING_CUSTOMREQUEST],
-                            va_arg(param, char *));
-
-    /* we don't set
-       data->set.method = HTTPREQ_CUSTOM;
-       here, we continue as if we were using the already set type
-       and this just changes the actual request keyword */
-    break;
-
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_HTTPPROXYTUNNEL:
-    /*
-     * Tunnel operations through the proxy instead of normal proxy use
-     */
-    data->set.tunnel_thru_httpproxy = (0 != va_arg(param, long)) ?
-      TRUE : FALSE;
-    break;
-
-  case CURLOPT_PROXYPORT:
-    /*
-     * Explicitly set HTTP proxy port number.
-     */
-    arg = va_arg(param, long);
-    if((arg < 0) || (arg > 65535))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.proxyport = (unsigned short)arg;
-    break;
-
-  case CURLOPT_PROXYAUTH:
-    /*
-     * Set HTTP Authentication type BITMASK.
-     */
-  {
-    int bitcheck;
-    bool authbits;
-    unsigned long auth = va_arg(param, unsigned long);
-
-    if(auth == CURLAUTH_NONE) {
-      data->set.proxyauth = auth;
-      break;
-    }
-
-    /* the DIGEST_IE bit is only used to set a special marker, for all the
-       rest we need to handle it as normal DIGEST */
-    data->state.authproxy.iestyle =
-      (bool)((auth & CURLAUTH_DIGEST_IE) ? TRUE : FALSE);
-
-    if(auth & CURLAUTH_DIGEST_IE) {
-      auth |= CURLAUTH_DIGEST; /* set standard digest bit */
-      auth &= ~CURLAUTH_DIGEST_IE; /* unset ie digest bit */
-    }
-    /* switch off bits we can't support */
-#ifndef USE_NTLM
-    auth &= ~CURLAUTH_NTLM;    /* no NTLM support */
-    auth &= ~CURLAUTH_NTLM_WB; /* no NTLM_WB support */
-#elif !defined(NTLM_WB_ENABLED)
-    auth &= ~CURLAUTH_NTLM_WB; /* no NTLM_WB support */
-#endif
-#ifndef USE_SPNEGO
-    auth &= ~CURLAUTH_NEGOTIATE; /* no Negotiate (SPNEGO) auth without
-                                    GSS-API or SSPI */
-#endif
-
-    /* check if any auth bit lower than CURLAUTH_ONLY is still set */
-    bitcheck = 0;
-    authbits = FALSE;
-    while(bitcheck < 31) {
-      if(auth & (1UL << bitcheck++)) {
-        authbits = TRUE;
-        break;
-      }
-    }
-    if(!authbits)
-      return CURLE_NOT_BUILT_IN; /* no supported types left! */
-
-    data->set.proxyauth = auth;
-  }
-  break;
-
-  case CURLOPT_PROXY:
-    /*
-     * Set proxy server:port to use as proxy.
-     *
-     * If the proxy is set to "" (and CURLOPT_SOCKS_PROXY is set to "" or NULL)
-     * we explicitly say that we don't want to use a proxy
-     * (even though there might be environment variables saying so).
-     *
-     * Setting it to NULL, means no proxy but allows the environment variables
-     * to decide for us (if CURLOPT_SOCKS_PROXY setting it to NULL).
-     */
-    result = Curl_setstropt(&data->set.str[STRING_PROXY],
-                            va_arg(param, char *));
-    break;
-
-  case CURLOPT_PRE_PROXY:
-    /*
-     * Set proxy server:port to use as SOCKS proxy.
-     *
-     * If the proxy is set to "" or NULL we explicitly say that we don't want
-     * to use the socks proxy.
-     */
-    result = Curl_setstropt(&data->set.str[STRING_PRE_PROXY],
-                            va_arg(param, char *));
-    break;
-
-  case CURLOPT_PROXYTYPE:
-    /*
-     * Set proxy type.
-     */
-    arg = va_arg(param, long);
-    if((arg < CURLPROXY_HTTP) || (arg > CURLPROXY_SOCKS5_HOSTNAME))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.proxytype = (unsigned char)(curl_proxytype)arg;
-    break;
-
-  case CURLOPT_PROXY_TRANSFER_MODE:
-    /*
-     * set transfer mode (;type=<a|i>) when doing FTP via an HTTP proxy
-     */
-    switch(va_arg(param, long)) {
-    case 0:
-      data->set.proxy_transfer_mode = FALSE;
-      break;
-    case 1:
-      data->set.proxy_transfer_mode = TRUE;
-      break;
-    default:
-      /* reserve other values for future use */
-      result = CURLE_BAD_FUNCTION_ARGUMENT;
-      break;
-    }
-    break;
-
-  case CURLOPT_SOCKS5_AUTH:
-    data->set.socks5auth = (unsigned char)va_arg(param, unsigned long);
-    if(data->set.socks5auth & ~(CURLAUTH_BASIC | CURLAUTH_GSSAPI))
-      result = CURLE_NOT_BUILT_IN;
-    break;
-#endif   /* CURL_DISABLE_PROXY */
-
-#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
-  case CURLOPT_SOCKS5_GSSAPI_NEC:
-    /*
-     * Set flag for NEC SOCK5 support
-     */
-    data->set.socks5_gssapi_nec = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-#endif
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_SOCKS5_GSSAPI_SERVICE:
-  case CURLOPT_PROXY_SERVICE_NAME:
-    /*
-     * Set proxy authentication service name for Kerberos 5 and SPNEGO
-     */
-    result = Curl_setstropt(&data->set.str[STRING_PROXY_SERVICE_NAME],
-                            va_arg(param, char *));
-    break;
-#endif
-  case CURLOPT_SERVICE_NAME:
-    /*
-     * Set authentication service name for DIGEST-MD5, Kerberos 5 and SPNEGO
-     */
-    result = Curl_setstropt(&data->set.str[STRING_SERVICE_NAME],
-                            va_arg(param, char *));
-    break;
-
-  case CURLOPT_HEADERDATA:
-    /*
-     * Custom pointer to pass the header write callback function
-     */
-    data->set.writeheader = (void *)va_arg(param, void *);
-    break;
-  case CURLOPT_ERRORBUFFER:
-    /*
-     * Error buffer provided by the caller to get the human readable
-     * error string in.
-     */
-    data->set.errorbuffer = va_arg(param, char *);
-    break;
-  case CURLOPT_WRITEDATA:
-    /*
-     * FILE pointer to write to. Or possibly
-     * used as argument to the write callback.
-     */
-    data->set.out = va_arg(param, void *);
-    break;
-
-#ifdef CURL_LIST_ONLY_PROTOCOL
-  case CURLOPT_DIRLISTONLY:
-    /*
-     * An option that changes the command to one that asks for a list only, no
-     * file info details. Used for FTP, POP3 and SFTP.
-     */
-    data->set.list_only = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-#endif
-  case CURLOPT_APPEND:
-    /*
-     * We want to upload and append to an existing file. Used for FTP and
-     * SFTP.
-     */
-    data->set.remote_append = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-
-#ifndef CURL_DISABLE_FTP
-  case CURLOPT_FTP_FILEMETHOD:
-    /*
-     * How do access files over FTP.
-     */
-    arg = va_arg(param, long);
-    if((arg < CURLFTPMETHOD_DEFAULT) || (arg >= CURLFTPMETHOD_LAST))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.ftp_filemethod = (unsigned char)(curl_ftpfile)arg;
-    break;
-  case CURLOPT_FTPPORT:
-    /*
-     * Use FTP PORT, this also specifies which IP address to use
-     */
-    result = Curl_setstropt(&data->set.str[STRING_FTPPORT],
-                            va_arg(param, char *));
-    data->set.ftp_use_port = (data->set.str[STRING_FTPPORT]) ? TRUE : FALSE;
-    break;
-
-  case CURLOPT_FTP_USE_EPRT:
-    data->set.ftp_use_eprt = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-
-  case CURLOPT_FTP_USE_EPSV:
-    data->set.ftp_use_epsv = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-
-  case CURLOPT_FTP_USE_PRET:
-    data->set.ftp_use_pret = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-
-  case CURLOPT_FTP_SSL_CCC:
-    arg = va_arg(param, long);
-    if((arg < CURLFTPSSL_CCC_NONE) || (arg >= CURLFTPSSL_CCC_LAST))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.ftp_ccc = (unsigned char)(curl_ftpccc)arg;
-    break;
-
-  case CURLOPT_FTP_SKIP_PASV_IP:
-    /*
-     * Enable or disable FTP_SKIP_PASV_IP, which will disable/enable the
-     * bypass of the IP address in PASV responses.
-     */
-    data->set.ftp_skip_ip = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-
-  case CURLOPT_FTP_ACCOUNT:
-    result = Curl_setstropt(&data->set.str[STRING_FTP_ACCOUNT],
-                            va_arg(param, char *));
-    break;
-
-  case CURLOPT_FTP_ALTERNATIVE_TO_USER:
-    result = Curl_setstropt(&data->set.str[STRING_FTP_ALTERNATIVE_TO_USER],
-                            va_arg(param, char *));
-    break;
-
-  case CURLOPT_FTPSSLAUTH:
-    /*
-     * Set a specific auth for FTP-SSL transfers.
-     */
-    arg = va_arg(param, long);
-    if((arg < CURLFTPAUTH_DEFAULT) || (arg >= CURLFTPAUTH_LAST))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.ftpsslauth = (unsigned char)(curl_ftpauth)arg;
-    break;
-  case CURLOPT_KRBLEVEL:
-    /*
-     * A string that defines the kerberos security level.
-     */
-    result = Curl_setstropt(&data->set.str[STRING_KRB_LEVEL],
-                            va_arg(param, char *));
-    data->set.krb = (data->set.str[STRING_KRB_LEVEL]) ? TRUE : FALSE;
+    s->http200aliases = slist;
     break;
 #endif
 #if !defined(CURL_DISABLE_FTP) || defined(USE_SSH)
-  case CURLOPT_FTP_CREATE_MISSING_DIRS:
-    /*
-     * An FTP/SFTP option that modifies an upload to create missing
-     * directories on the server.
-     */
-    arg = va_arg(param, long);
-    /* reserve other values for future use */
-    if((arg < CURLFTP_CREATE_DIR_NONE) ||
-       (arg > CURLFTP_CREATE_DIR_RETRY))
-      result = CURLE_BAD_FUNCTION_ARGUMENT;
-    else
-      data->set.ftp_create_missing_dirs = (unsigned char)arg;
-    break;
-
   case CURLOPT_POSTQUOTE:
     /*
      * List of RAW FTP commands to use after a transfer
      */
-    data->set.postquote = va_arg(param, struct curl_slist *);
+    s->postquote = slist;
     break;
   case CURLOPT_PREQUOTE:
     /*
      * List of RAW FTP commands to use prior to RETR (Wesley Laxton)
      */
-    data->set.prequote = va_arg(param, struct curl_slist *);
+    s->prequote = slist;
     break;
   case CURLOPT_QUOTE:
     /*
      * List of RAW FTP commands to use before a transfer
      */
-    data->set.quote = va_arg(param, struct curl_slist *);
+    s->quote = slist;
     break;
 #endif
-  case CURLOPT_READDATA:
-    /*
-     * FILE pointer to read the file to be uploaded from. Or possibly
-     * used as argument to the read callback.
-     */
-    data->set.in_set = va_arg(param, void *);
-    break;
-  case CURLOPT_INFILESIZE:
-    /*
-     * If known, this should inform curl about the file size of the
-     * to-be-uploaded file.
-     */
-    arg = va_arg(param, long);
-    if(arg < -1)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.filesize = arg;
-    break;
-  case CURLOPT_INFILESIZE_LARGE:
-    /*
-     * If known, this should inform curl about the file size of the
-     * to-be-uploaded file.
-     */
-    bigsize = va_arg(param, curl_off_t);
-    if(bigsize < -1)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.filesize = bigsize;
-    break;
-  case CURLOPT_LOW_SPEED_LIMIT:
-    /*
-     * The low speed limit that if transfers are below this for
-     * CURLOPT_LOW_SPEED_TIME, the transfer is aborted.
-     */
-    arg = va_arg(param, long);
-    if(arg < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.low_speed_limit = arg;
-    break;
-  case CURLOPT_MAX_SEND_SPEED_LARGE:
-    /*
-     * When transfer uploads are faster then CURLOPT_MAX_SEND_SPEED_LARGE
-     * bytes per second the transfer is throttled..
-     */
-    bigsize = va_arg(param, curl_off_t);
-    if(bigsize < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.max_send_speed = bigsize;
-    break;
-  case CURLOPT_MAX_RECV_SPEED_LARGE:
-    /*
-     * When receiving data faster than CURLOPT_MAX_RECV_SPEED_LARGE bytes per
-     * second the transfer is throttled..
-     */
-    bigsize = va_arg(param, curl_off_t);
-    if(bigsize < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.max_recv_speed = bigsize;
-    break;
-  case CURLOPT_LOW_SPEED_TIME:
-    /*
-     * The low speed time that if transfers are below the set
-     * CURLOPT_LOW_SPEED_LIMIT during this time, the transfer is aborted.
-     */
-    arg = va_arg(param, long);
-    if(arg < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.low_speed_time = arg;
-    break;
-  case CURLOPT_CURLU:
-    /*
-     * pass CURLU to set URL
-     */
-    data->set.uh = va_arg(param, CURLU *);
-    break;
-  case CURLOPT_URL:
-    /*
-     * The URL to fetch.
-     */
-    if(data->state.url_alloc) {
-      /* the already set URL is allocated, free it first! */
-      Curl_safefree(data->state.url);
-      data->state.url_alloc = FALSE;
-    }
-    result = Curl_setstropt(&data->set.str[STRING_SET_URL],
-                            va_arg(param, char *));
-    data->state.url = data->set.str[STRING_SET_URL];
-    break;
-  case CURLOPT_PORT:
-    /*
-     * The port number to use when getting the URL. 0 disables it.
-     */
-    arg = va_arg(param, long);
-    if((arg < 0) || (arg > 65535))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.use_port = (unsigned short)arg;
-    break;
-  case CURLOPT_TIMEOUT:
-    /*
-     * The maximum time you allow curl to use for a single transfer
-     * operation.
-     */
-    arg = va_arg(param, long);
-    if((arg >= 0) && (arg <= (INT_MAX/1000)))
-      data->set.timeout = (unsigned int)arg * 1000;
-    else
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    break;
-
-  case CURLOPT_TIMEOUT_MS:
-    uarg = va_arg(param, unsigned long);
-    if(uarg > UINT_MAX)
-      uarg = UINT_MAX;
-    data->set.timeout = (unsigned int)uarg;
-    break;
-
-  case CURLOPT_CONNECTTIMEOUT:
-    /*
-     * The maximum time you allow curl to use to connect.
-     */
-    arg = va_arg(param, long);
-    if((arg >= 0) && (arg <= (INT_MAX/1000)))
-      data->set.connecttimeout = (unsigned int)arg * 1000;
-    else
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    break;
-
-  case CURLOPT_CONNECTTIMEOUT_MS:
-    uarg = va_arg(param, unsigned long);
-    if(uarg > UINT_MAX)
-      uarg = UINT_MAX;
-    data->set.connecttimeout = (unsigned int)uarg;
-    break;
-
-#ifndef CURL_DISABLE_FTP
-  case CURLOPT_ACCEPTTIMEOUT_MS:
-    /*
-     * The maximum time for curl to wait for FTP server connect
-     */
-    uarg = va_arg(param, unsigned long);
-    if(uarg > UINT_MAX)
-      uarg = UINT_MAX;
-    data->set.accepttimeout = (unsigned int)uarg;
-    break;
-#endif
-
-  case CURLOPT_USERPWD:
-    /*
-     * user:password to use in the operation
-     */
-    result = setstropt_userpwd(va_arg(param, char *),
-                               &data->set.str[STRING_USERNAME],
-                               &data->set.str[STRING_PASSWORD]);
-    break;
-
-  case CURLOPT_USERNAME:
-    /*
-     * authentication user name to use in the operation
-     */
-    result = Curl_setstropt(&data->set.str[STRING_USERNAME],
-                            va_arg(param, char *));
-    break;
-  case CURLOPT_PASSWORD:
-    /*
-     * authentication password to use in the operation
-     */
-    result = Curl_setstropt(&data->set.str[STRING_PASSWORD],
-                            va_arg(param, char *));
-    break;
-
-  case CURLOPT_LOGIN_OPTIONS:
-    /*
-     * authentication options to use in the operation
-     */
-    result = Curl_setstropt(&data->set.str[STRING_OPTIONS],
-                            va_arg(param, char *));
-    break;
-
-  case CURLOPT_XOAUTH2_BEARER:
-    /*
-     * OAuth 2.0 bearer token to use in the operation
-     */
-    result = Curl_setstropt(&data->set.str[STRING_BEARER],
-                            va_arg(param, char *));
-    break;
-
   case CURLOPT_RESOLVE:
     /*
      * List of HOST:PORT:[addresses] strings to populate the DNS cache with
      * Entries added this way will remain in the cache until explicitly
      * removed or the handle is cleaned up.
      *
-     * Prefix the HOST with plus sign (+) to have the entry expire just like
+     * Prefix the HOST with plus sign (+) to have the entry expire like
      * automatically added entries.
      *
      * Prefix the HOST with dash (-) to _remove_ the entry from the cache.
      *
      * This API can remove any entry from the DNS cache, but only entries
-     * that aren't actually in use right now will be pruned immediately.
+     * that are not actually in use right now will be pruned immediately.
      */
-    data->set.resolve = va_arg(param, struct curl_slist *);
-    data->state.resolve = data->set.resolve;
+    s->resolve = slist;
+    data->state.resolve = s->resolve;
     break;
+#if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_MIME)
+  case CURLOPT_HTTPHEADER:
+    /*
+     * Set a list with HTTP headers to use (or replace internals with)
+     */
+    s->headers = slist;
+    break;
+#endif
+#ifndef CURL_DISABLE_TELNET
+  case CURLOPT_TELNETOPTIONS:
+    /*
+     * Set a linked list of telnet options
+     */
+    s->telnet_options = slist;
+    break;
+#endif
+#ifndef CURL_DISABLE_SMTP
+  case CURLOPT_MAIL_RCPT:
+    /* Set the list of mail recipients */
+    s->mail_rcpt = slist;
+    break;
+#endif
+  case CURLOPT_CONNECT_TO:
+    s->connect_to = slist;
+    break;
+  default:
+    return CURLE_UNKNOWN_OPTION;
+  }
+  return result;
+}
+
+#if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_SMTP) ||       \
+  !defined(CURL_DISABLE_IMAP)
+#ifndef CURL_DISABLE_MIME
+static CURLcode setopt_mimepost(struct Curl_easy *data, curl_mime *mimep)
+{
+  /*
+   * Set to make us do MIME POST
+   */
+  CURLcode result;
+  struct UserDefined *s = &data->set;
+  if(!s->mimepostp) {
+    s->mimepostp = curlx_malloc(sizeof(*s->mimepostp));
+    if(!s->mimepostp)
+      return CURLE_OUT_OF_MEMORY;
+    Curl_mime_initpart(s->mimepostp);
+  }
+
+  result = Curl_mime_set_subparts(s->mimepostp, mimep, FALSE);
+  if(!result) {
+    s->method = HTTPREQ_POST_MIME;
+    s->opt_no_body = FALSE; /* this is implied */
+#ifndef CURL_DISABLE_FORM_API
+    Curl_mime_cleanpart(data->state.formp);
+    curlx_safefree(data->state.formp);
+    data->state.mimepost = NULL;
+#endif
+  }
+  return result;
+}
+#endif /* !CURL_DISABLE_MIME */
+#endif /* !CURL_DISABLE_HTTP || !CURL_DISABLE_SMTP || !CURL_DISABLE_IMAP */
+
+/* assorted pointer type arguments */
+static CURLcode setopt_pointers(struct Curl_easy *data, CURLoption option,
+                                va_list param)
+{
+  CURLcode result = CURLE_OK;
+  struct UserDefined *s = &data->set;
+  switch(option) {
+  case CURLOPT_CURLU:
+    /*
+     * pass CURLU to set URL
+     */
+    Curl_bufref_free(&data->state.url);
+    curlx_safefree(s->str[STRING_SET_URL]);
+    s->uh = va_arg(param, CURLU *);
+    break;
+#ifndef CURL_DISABLE_HTTP
+#ifndef CURL_DISABLE_FORM_API
+  case CURLOPT_HTTPPOST:
+    /*
+     * Set to make us do HTTP POST. Legacy API-style.
+     */
+    s->httppost = va_arg(param, struct curl_httppost *);
+    s->method = HTTPREQ_POST_FORM;
+    s->opt_no_body = FALSE; /* this is implied */
+    Curl_mime_cleanpart(data->state.formp);
+    curlx_safefree(data->state.formp);
+    data->state.mimepost = NULL;
+    break;
+#endif /* !CURL_DISABLE_FORM_API */
+#endif /* !CURL_DISABLE_HTTP */
+#if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_SMTP) ||       \
+  !defined(CURL_DISABLE_IMAP)
+#ifndef CURL_DISABLE_MIME
+  case CURLOPT_MIMEPOST:
+    result = setopt_mimepost(data, va_arg(param, curl_mime *));
+    break;
+#endif /* !CURL_DISABLE_MIME */
+#endif /* !CURL_DISABLE_HTTP || !CURL_DISABLE_SMTP || !CURL_DISABLE_IMAP */
+  case CURLOPT_STDERR:
+    /*
+     * Set to a FILE * that should receive all error writes. This
+     * defaults to stderr for normal operations.
+     */
+    s->err = va_arg(param, FILE *);
+    if(!s->err)
+      s->err = stderr;
+    break;
+  case CURLOPT_SHARE: {
+    struct Curl_share *set = va_arg(param, struct Curl_share *);
+
+    /* disconnect from old share, if any and possible */
+    result = Curl_share_easy_unlink(data);
+    if(result)
+      return result;
+
+    /* use new share if it set */
+    if(GOOD_SHARE_HANDLE(set)) {
+      result = Curl_share_easy_link(data, set);
+      if(result)
+        return result;
+    }
+    break;
+  }
+
+#ifdef USE_HTTP2
+  case CURLOPT_STREAM_DEPENDS:
+  case CURLOPT_STREAM_DEPENDS_E:
+    /* not doing stream dependencies any longer, but accept options
+     * for backward compatibility */
+    break;
+#endif
+
+  default:
+    return CURLE_UNKNOWN_OPTION;
+  }
+  return result;
+}
+
+#ifndef CURL_DISABLE_COOKIES
+static CURLcode cookielist(struct Curl_easy *data, const char *ptr)
+{
+  CURLcode result = CURLE_OK;
+  if(!ptr)
+    return CURLE_OK;
+
+  if(curl_strequal(ptr, "ALL")) {
+    /* clear all cookies */
+    Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
+    Curl_cookie_clearall(data->cookies);
+    Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
+  }
+  else if(curl_strequal(ptr, "SESS")) {
+    /* clear session cookies */
+    Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
+    Curl_cookie_clearsess(data->cookies);
+    Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
+  }
+  else if(curl_strequal(ptr, "FLUSH")) {
+    /* flush cookies to file, takes care of the locking */
+    Curl_flush_cookies(data, FALSE);
+  }
+  else if(curl_strequal(ptr, "RELOAD")) {
+    /* reload cookies from file */
+    return Curl_cookie_loadfiles(data);
+  }
+  else {
+    if(!data->cookies) {
+      /* if cookie engine was not running, activate it */
+      data->cookies = Curl_cookie_init();
+      if(!data->cookies)
+        return CURLE_OUT_OF_MEMORY;
+      data->state.cookie_engine = TRUE;
+    }
+
+    /* general protection against mistakes and abuse */
+    if(strlen(ptr) > CURL_MAX_INPUT_LENGTH)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+
+    Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
+    if(checkprefix("Set-Cookie:", ptr))
+      /* HTTP Header format line */
+      result = Curl_cookie_add(data, data->cookies, TRUE, FALSE, ptr + 11,
+                               NULL, NULL, TRUE);
+    else
+      /* Netscape format line */
+      result = Curl_cookie_add(data, data->cookies, FALSE, FALSE, ptr, NULL,
+                               NULL, TRUE);
+    Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
+  }
+  return result;
+}
+
+static CURLcode cookiefile(struct Curl_easy *data, const char *ptr)
+{
+  /*
+   * Set cookie file to read and parse. Can be used multiple times.
+   */
+  if(ptr) {
+    struct curl_slist *cl;
+    /* general protection against mistakes and abuse */
+    if(strlen(ptr) > CURL_MAX_INPUT_LENGTH)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    /* append the cookie filename to the list of filenames, and deal with
+       them later */
+    cl = curl_slist_append(data->state.cookielist, ptr);
+    if(!cl) {
+      curl_slist_free_all(data->state.cookielist);
+      data->state.cookielist = NULL;
+      return CURLE_OUT_OF_MEMORY;
+    }
+    data->state.cookielist = cl; /* store the list for later use */
+  }
+  else {
+    /* clear the list of cookie files */
+    curl_slist_free_all(data->state.cookielist);
+    data->state.cookielist = NULL;
+
+    if(!data->share || !data->share->cookies) {
+      /* throw away all existing cookies if this is not a shared cookie
+         container */
+      Curl_cookie_clearall(data->cookies);
+      Curl_cookie_cleanup(data->cookies);
+    }
+    /* disable the cookie engine */
+    data->cookies = NULL;
+  }
+  return CURLE_OK;
+}
+#endif
+
+#ifndef CURL_DISABLE_PROXY
+static CURLcode setproxy(struct Curl_easy *data, const char *proxy)
+{
+  if((data->set.str[STRING_PROXY] && proxy) &&
+     /* there was one set, is this a new one? */
+     !strcmp(data->set.str[STRING_PROXY], proxy))
+    return CURLE_OK; /* same one as before */
+
+  changeproxy(data);
+  return Curl_setstropt(&data->set.str[STRING_PROXY], proxy);
+}
+
+static CURLcode setopt_cptr_proxy(struct Curl_easy *data, CURLoption option,
+                                  char *ptr)
+{
+  CURLcode result = CURLE_OK;
+  struct UserDefined *s = &data->set;
+  switch(option) {
+  case CURLOPT_PROXYUSERPWD: {
+    /*
+     * user:password needed to use the proxy
+     */
+    char *u = NULL;
+    char *p = NULL;
+    result = setstropt_userpwd(ptr, &u, &p);
+
+    /* URL decode the components */
+    if(!result) {
+      curlx_safefree(s->str[STRING_PROXYUSERNAME]);
+      curlx_safefree(s->str[STRING_PROXYPASSWORD]);
+      if(u)
+        result = Curl_urldecode(u, 0, &s->str[STRING_PROXYUSERNAME], NULL,
+                                REJECT_ZERO);
+    }
+    if(!result && p)
+      result = Curl_urldecode(p, 0, &s->str[STRING_PROXYPASSWORD], NULL,
+                              REJECT_ZERO);
+    curlx_free(u);
+    curlx_free(p);
+    break;
+  }
+  case CURLOPT_PROXYUSERNAME:
+    /*
+     * authentication username to use in the operation
+     */
+    return Curl_setstropt(&s->str[STRING_PROXYUSERNAME], ptr);
+
+  case CURLOPT_PROXYPASSWORD:
+    /*
+     * authentication password to use in the operation
+     */
+    return Curl_setstropt(&s->str[STRING_PROXYPASSWORD], ptr);
+
+  case CURLOPT_NOPROXY:
+    /*
+     * proxy exception list
+     */
+    return Curl_setstropt(&s->str[STRING_NOPROXY], ptr);
+  case CURLOPT_PROXY_SSLCERT:
+    /*
+     * String that holds filename of the SSL certificate to use for proxy
+     */
+    return Curl_setstropt(&s->str[STRING_CERT_PROXY], ptr);
+  case CURLOPT_PROXY_SSLCERTTYPE:
+    /*
+     * String that holds file type of the SSL certificate to use for proxy
+     */
+    return Curl_setstropt(&s->str[STRING_CERT_TYPE_PROXY], ptr);
+  case CURLOPT_PROXY_SSLKEY:
+    /*
+     * String that holds filename of the SSL key to use for proxy
+     */
+    return Curl_setstropt(&s->str[STRING_KEY_PROXY], ptr);
+  case CURLOPT_PROXY_KEYPASSWD:
+    /*
+     * String that holds the SSL private key password for proxy.
+     */
+    return Curl_setstropt(&s->str[STRING_KEY_PASSWD_PROXY], ptr);
+  case CURLOPT_PROXY_SSLKEYTYPE:
+    /*
+     * String that holds file type of the SSL key to use for proxy
+     */
+    return Curl_setstropt(&s->str[STRING_KEY_TYPE_PROXY], ptr);
+  case CURLOPT_PROXY_SSL_CIPHER_LIST:
+    if(Curl_ssl_supports(data, SSLSUPP_CIPHER_LIST)) {
+      /* set a list of cipher we want to use in the SSL connection for proxy */
+      return Curl_setstropt(&s->str[STRING_SSL_CIPHER_LIST_PROXY], ptr);
+    }
+    else
+      return CURLE_NOT_BUILT_IN;
+  case CURLOPT_PROXY_TLS13_CIPHERS:
+    if(Curl_ssl_supports(data, SSLSUPP_TLS13_CIPHERSUITES))
+      /* set preferred list of TLS 1.3 cipher suites for proxy */
+      return Curl_setstropt(&s->str[STRING_SSL_CIPHER13_LIST_PROXY], ptr);
+    else
+      return CURLE_NOT_BUILT_IN;
+  case CURLOPT_PROXY:
+    /*
+     * Set proxy server:port to use as proxy.
+     *
+     * If the proxy is set to "" (and CURLOPT_PRE_PROXY is set to "" or NULL)
+     * we explicitly say that we do not want to use a proxy (even though there
+     * might be environment variables saying so).
+     *
+     * Setting it to NULL, means no proxy but allows the environment variables
+     * to decide for us (if CURLOPT_PRE_PROXY setting it to NULL).
+     */
+    return setproxy(data, ptr);
+  case CURLOPT_PRE_PROXY:
+    /*
+     * Set proxy server:port to use as SOCKS proxy.
+     *
+     * If the proxy is set to "" or NULL we explicitly say that we do not want
+     * to use the socks proxy.
+     */
+    return Curl_setstropt(&s->str[STRING_PRE_PROXY], ptr);
+  case CURLOPT_SOCKS5_GSSAPI_SERVICE:
+  case CURLOPT_PROXY_SERVICE_NAME:
+    /*
+     * Set proxy authentication service name for Kerberos 5 and SPNEGO
+     */
+    return Curl_setstropt(&s->str[STRING_PROXY_SERVICE_NAME], ptr);
+  case CURLOPT_PROXY_PINNEDPUBLICKEY:
+    /*
+     * Set pinned public key for SSL connection.
+     * Specify filename of the public key in DER format.
+     */
+#ifdef USE_SSL
+    if(Curl_ssl_supports(data, SSLSUPP_PINNEDPUBKEY))
+      return Curl_setstropt(&s->str[STRING_SSL_PINNEDPUBLICKEY_PROXY], ptr);
+#endif
+    return CURLE_NOT_BUILT_IN;
+
+  case CURLOPT_HAPROXY_CLIENT_IP:
+    /*
+     * Set the client IP to send through HAProxy PROXY protocol
+     */
+    result = Curl_setstropt(&s->str[STRING_HAPROXY_CLIENT_IP], ptr);
+
+    /* enable the HAProxy protocol if an IP is provided */
+    s->haproxyprotocol = !!s->str[STRING_HAPROXY_CLIENT_IP];
+    break;
+  case CURLOPT_PROXY_CAINFO:
+    /*
+     * Set CA info SSL connection for proxy. Specify filename of the
+     * CA certificate
+     */
+    result = Curl_setstropt(&s->str[STRING_SSL_CAFILE_PROXY], ptr);
+    s->proxy_ssl.custom_cafile = !!s->str[STRING_SSL_CAFILE_PROXY];
+    return result;
+  case CURLOPT_PROXY_CRLFILE:
+    /*
+     * Set CRL file info for SSL connection for proxy. Specify filename of the
+     * CRL to check certificates revocation
+     */
+    if(Curl_ssl_supports(data, SSLSUPP_CRLFILE))
+      return Curl_setstropt(&s->str[STRING_SSL_CRLFILE_PROXY], ptr);
+    return CURLE_NOT_BUILT_IN;
+  case CURLOPT_PROXY_ISSUERCERT:
+    /*
+     * Set Issuer certificate file to check certificates issuer
+     */
+    if(Curl_ssl_supports(data, SSLSUPP_ISSUERCERT))
+      return Curl_setstropt(&s->str[STRING_SSL_ISSUERCERT_PROXY], ptr);
+    return CURLE_NOT_BUILT_IN;
+  case CURLOPT_PROXY_CAPATH:
+    /*
+     * Set CA path info for SSL connection proxy. Specify directory name of the
+     * CA certificates which have been prepared using openssl c_rehash utility.
+     */
+#ifdef USE_SSL
+    if(Curl_ssl_supports(data, SSLSUPP_CA_PATH)) {
+      /* This does not work on Windows. */
+      result = Curl_setstropt(&s->str[STRING_SSL_CAPATH_PROXY], ptr);
+      s->proxy_ssl.custom_capath = !!s->str[STRING_SSL_CAPATH_PROXY];
+      return result;
+    }
+#endif
+    return CURLE_NOT_BUILT_IN;
+  default:
+    return CURLE_UNKNOWN_OPTION;
+  }
+  return result;
+}
+#endif
+
+#if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_MQTT)
+/*
+ * A string with POST data. Makes curl HTTP POST. Even if it is NULL. If
+ * needed, CURLOPT_POSTFIELDSIZE must have been set prior to
+ * CURLOPT_COPYPOSTFIELDS and not altered later.
+ */
+static CURLcode setopt_copypostfields(const char *ptr, struct UserDefined *s)
+{
+  CURLcode result = CURLE_OK;
+  if(s->postfieldsize < -1)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  if(!ptr || s->postfieldsize == -1)
+    result = Curl_setstropt(&s->str[STRING_COPYPOSTFIELDS], ptr);
+  else {
+    size_t pflen = curlx_sotouz_range(s->postfieldsize, 0, SIZE_MAX);
+    if(pflen == SIZE_MAX)
+      return CURLE_OUT_OF_MEMORY;
+    else {
+      /* Allocate even when size == 0. This satisfies the need of possible
+         later address compare to detect the COPYPOSTFIELDS mode, and to mark
+         that postfields is used rather than read function or form data.
+      */
+      char *p = curlx_memdup0(ptr, pflen);
+      if(!p)
+        return CURLE_OUT_OF_MEMORY;
+      else {
+        curlx_free(s->str[STRING_COPYPOSTFIELDS]);
+        s->str[STRING_COPYPOSTFIELDS] = p;
+      }
+    }
+  }
+
+  s->postfields = s->str[STRING_COPYPOSTFIELDS];
+  s->method = HTTPREQ_POST;
+  return result;
+}
+#endif
+
+#ifdef USE_ECH
+static CURLcode setopt_ech(struct Curl_easy *data, const char *ptr)
+{
+  struct UserDefined *s = &data->set;
+  CURLcode result = CURLE_OK;
+
+  if(!ptr || !strcmp(ptr, "false"))
+    s->tls_ech = CURLECH_DISABLE;
+  else {
+    size_t plen = strlen(ptr);
+    if(plen > CURL_MAX_INPUT_LENGTH)
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+    else {
+      if(!strcmp(ptr, "grease"))
+        s->tls_ech = CURLECH_GREASE;
+      else if(!strcmp(ptr, "true"))
+        s->tls_ech = CURLECH_ENABLE;
+      else if(!strcmp(ptr, "hard"))
+        s->tls_ech = CURLECH_HARD;
+      else if(plen > 4 && !strncmp(ptr, "ecl:", 4)) {
+        if(!s->tls_ech)
+          s->tls_ech = CURLECH_HARD;
+        result = Curl_setstropt(&s->str[STRING_ECH_CONFIG], ptr + 4);
+      }
+      else if(plen > 3 && !strncmp(ptr, "pn:", 3)) {
+        if(!s->tls_ech)
+          s->tls_ech = CURLECH_HARD;
+        result = Curl_setstropt(&s->str[STRING_ECH_PUBLIC], ptr + 3);
+      }
+      else
+        result = CURLE_BAD_FUNCTION_ARGUMENT;
+    }
+  }
+  return result;
+}
+#else
+#define setopt_ech(x,y) CURLE_NOT_BUILT_IN
+#endif
+
+#if defined(USE_SSL) || defined(USE_SSH)
+/* One of the options is used for both TLS and SSH */
+static CURLcode setopt_cptr_ssl(struct Curl_easy *data, CURLoption option,
+                                char *ptr)
+{
+  CURLcode result = CURLE_OK;
+  struct UserDefined *s = &data->set;
+
+  switch(option) {
+  case CURLOPT_KEYPASSWD:
+    /*
+     * String that holds the SSL or SSH private key password.
+     */
+    result = Curl_setstropt(&s->str[STRING_KEY_PASSWD], ptr);
+    break;
+#ifdef USE_SSL
+  case CURLOPT_CAINFO:
+    /*
+     * Set CA info for SSL connection. Specify filename of the CA certificate
+     */
+    result = Curl_setstropt(&s->str[STRING_SSL_CAFILE], ptr);
+    s->ssl.custom_cafile = !!s->str[STRING_SSL_CAFILE];
+    return result;
+  case CURLOPT_CAPATH:
+    /*
+     * Set CA path info for SSL connection. Specify directory name of the CA
+     * certificates which have been prepared using openssl c_rehash utility.
+     */
+    if(Curl_ssl_supports(data, SSLSUPP_CA_PATH)) {
+      /* This does not work on Windows. */
+      result = Curl_setstropt(&s->str[STRING_SSL_CAPATH], ptr);
+      s->ssl.custom_capath = !!s->str[STRING_SSL_CAPATH];
+      return result;
+    }
+    return CURLE_NOT_BUILT_IN;
+  case CURLOPT_CRLFILE:
+    /*
+     * Set CRL file info for SSL connection. Specify filename of the CRL
+     * to check certificates revocation
+     */
+    if(Curl_ssl_supports(data, SSLSUPP_CRLFILE))
+      return Curl_setstropt(&s->str[STRING_SSL_CRLFILE], ptr);
+    return CURLE_NOT_BUILT_IN;
+  case CURLOPT_SSL_CIPHER_LIST:
+    if(Curl_ssl_supports(data, SSLSUPP_CIPHER_LIST))
+      /* set a list of cipher we want to use in the SSL connection */
+      return Curl_setstropt(&s->str[STRING_SSL_CIPHER_LIST], ptr);
+    else
+      return CURLE_NOT_BUILT_IN;
+  case CURLOPT_TLS13_CIPHERS:
+    if(Curl_ssl_supports(data, SSLSUPP_TLS13_CIPHERSUITES))
+      /* set preferred list of TLS 1.3 cipher suites */
+      return Curl_setstropt(&s->str[STRING_SSL_CIPHER13_LIST], ptr);
+    else
+      return CURLE_NOT_BUILT_IN;
+  case CURLOPT_RANDOM_FILE:
+    break;
+  case CURLOPT_EGDSOCKET:
+    break;
+  case CURLOPT_SSL_CTX_DATA:
+    /*
+     * Set an SSL_CTX callback parameter pointer
+     */
+    if(Curl_ssl_supports(data, SSLSUPP_SSL_CTX)) {
+      s->ssl.fsslctxp = ptr;
+      break;
+    }
+    else
+      return CURLE_NOT_BUILT_IN;
+  case CURLOPT_SSLCERT:
+    /*
+     * String that holds filename of the SSL certificate to use
+     */
+    return Curl_setstropt(&s->str[STRING_CERT], ptr);
+  case CURLOPT_SSLCERTTYPE:
+    /*
+     * String that holds file type of the SSL certificate to use
+     */
+    return Curl_setstropt(&s->str[STRING_CERT_TYPE], ptr);
+  case CURLOPT_SSLKEY:
+    /*
+     * String that holds filename of the SSL key to use
+     */
+    return Curl_setstropt(&s->str[STRING_KEY], ptr);
+  case CURLOPT_SSLKEYTYPE:
+    /*
+     * String that holds file type of the SSL key to use
+     */
+    return Curl_setstropt(&s->str[STRING_KEY_TYPE], ptr);
+  case CURLOPT_SSLENGINE:
+    /*
+     * String that holds the SSL crypto engine.
+     */
+    if(ptr && ptr[0]) {
+      result = Curl_setstropt(&s->str[STRING_SSL_ENGINE], ptr);
+      if(!result) {
+        result = Curl_ssl_set_engine(data, ptr);
+      }
+    }
+    break;
+  case CURLOPT_ISSUERCERT:
+    /*
+     * Set Issuer certificate file
+     * to check certificates issuer
+     */
+    if(Curl_ssl_supports(data, SSLSUPP_ISSUERCERT))
+      return Curl_setstropt(&s->str[STRING_SSL_ISSUERCERT], ptr);
+    return CURLE_NOT_BUILT_IN;
+  case CURLOPT_SSL_EC_CURVES:
+    /*
+     * Set accepted curves in SSL connection setup.
+     * Specify colon-delimited list of curve algorithm names.
+     */
+    if(Curl_ssl_supports(data, SSLSUPP_SSL_EC_CURVES))
+      return Curl_setstropt(&s->str[STRING_SSL_EC_CURVES], ptr);
+    return CURLE_NOT_BUILT_IN;
+  case CURLOPT_SSL_SIGNATURE_ALGORITHMS:
+    /*
+     * Set accepted signature algorithms.
+     * Specify colon-delimited list of signature scheme names.
+     */
+    if(Curl_ssl_supports(data, SSLSUPP_SIGNATURE_ALGORITHMS))
+      return Curl_setstropt(&s->str[STRING_SSL_SIGNATURE_ALGORITHMS], ptr);
+    return CURLE_NOT_BUILT_IN;
+  case CURLOPT_PINNEDPUBLICKEY:
+    /*
+     * Set pinned public key for SSL connection.
+     * Specify filename of the public key in DER format.
+     */
+    if(Curl_ssl_supports(data, SSLSUPP_PINNEDPUBKEY))
+      return Curl_setstropt(&s->str[STRING_SSL_PINNEDPUBLICKEY], ptr);
+    return CURLE_NOT_BUILT_IN;
+  case CURLOPT_ECH:
+    return setopt_ech(data, ptr);
+#endif
+  default:
+    return CURLE_UNKNOWN_OPTION;
+  }
+  return result;
+}
+#endif
+
+#if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_MQTT)
+static CURLcode setopt_cptr_http_mqtt(struct Curl_easy *data,
+                                      CURLoption option, char *ptr)
+{
+  CURLcode result = CURLE_OK;
+  struct UserDefined *s = &data->set;
+
+  switch(option) {
+  case CURLOPT_COPYPOSTFIELDS:
+    return setopt_copypostfields(ptr, s);
+
+  case CURLOPT_POSTFIELDS:
+    /*
+     * Like above, but use static data instead of copying it.
+     */
+    s->postfields = ptr;
+    /* Release old copied data. */
+    curlx_safefree(s->str[STRING_COPYPOSTFIELDS]);
+    s->method = HTTPREQ_POST;
+    break;
+
+#ifndef CURL_DISABLE_HTTP
+  case CURLOPT_TRAILERDATA:
+    s->trailer_data = ptr;
+    break;
+  case CURLOPT_ACCEPT_ENCODING:
+    /*
+     * String to use at the value of Accept-Encoding header.
+     *
+     * If the encoding is set to "" we use an Accept-Encoding header that
+     * encompasses all the encodings we support.
+     * If the encoding is set to NULL we do not send an Accept-Encoding header
+     * and ignore an received Content-Encoding header.
+     *
+     */
+    if(ptr && !*ptr) {
+      ptr = Curl_get_content_encodings();
+      if(ptr) {
+        curlx_free(s->str[STRING_ENCODING]);
+        s->str[STRING_ENCODING] = ptr;
+      }
+      else
+        result = CURLE_OUT_OF_MEMORY;
+      return result;
+    }
+    return Curl_setstropt(&s->str[STRING_ENCODING], ptr);
+
+#ifndef CURL_DISABLE_AWS
+  case CURLOPT_AWS_SIGV4:
+    /*
+     * String that is merged to some authentication
+     * parameters are used by the algorithm.
+     */
+    result = Curl_setstropt(&s->str[STRING_AWS_SIGV4], ptr);
+    /*
+     * Basic been set by default it need to be unset here
+     */
+    if(s->str[STRING_AWS_SIGV4])
+      s->httpauth = CURLAUTH_AWS_SIGV4;
+    break;
+#endif
+  case CURLOPT_REFERER:
+    /*
+     * String to set in the HTTP Referer: field.
+     */
+    Curl_bufref_free(&data->state.referer);
+    result = Curl_setstropt(&s->str[STRING_SET_REFERER], ptr);
+    break;
+
+  case CURLOPT_USERAGENT:
+    /*
+     * String to use in the HTTP User-Agent field
+     */
+    return Curl_setstropt(&s->str[STRING_USERAGENT], ptr);
+
+#ifndef CURL_DISABLE_COOKIES
+  case CURLOPT_COOKIE:
+    /*
+     * Cookie string to send to the remote server in the request.
+     */
+    return Curl_setstropt(&s->str[STRING_COOKIE], ptr);
+
+  case CURLOPT_COOKIEFILE:
+    return cookiefile(data, ptr);
+
+  case CURLOPT_COOKIEJAR:
+    /*
+     * Set cookie filename to dump all cookies to when we are done.
+     */
+    result = Curl_setstropt(&s->str[STRING_COOKIEJAR], ptr);
+    if(!result) {
+      /*
+       * Activate the cookie parser. This may or may not already
+       * have been made.
+       */
+      if(!data->cookies)
+        data->cookies = Curl_cookie_init();
+      if(!data->cookies)
+        result = CURLE_OUT_OF_MEMORY;
+      else
+        data->state.cookie_engine = TRUE;
+    }
+    break;
+
+  case CURLOPT_COOKIELIST:
+    return cookielist(data, ptr);
+#endif /* !CURL_DISABLE_COOKIES */
+
+#endif /* !CURL_DISABLE_HTTP */
+  default:
+    return CURLE_UNKNOWN_OPTION;
+  }
+  return result;
+}
+#endif /* !CURL_DISABLE_HTTP || !CURL_DISABLE_MQTT */
+
+#ifdef USE_SSH
+static CURLcode setopt_cptr_ssh(struct Curl_easy *data, CURLoption option,
+                                char *ptr)
+{
+  struct UserDefined *s = &data->set;
+  switch(option) {
+  case CURLOPT_SSH_PUBLIC_KEYFILE:
+    /*
+     * Use this file instead of the $HOME/.ssh/id_dsa.pub file
+     */
+    return Curl_setstropt(&s->str[STRING_SSH_PUBLIC_KEY], ptr);
+  case CURLOPT_SSH_PRIVATE_KEYFILE:
+    /*
+     * Use this file instead of the $HOME/.ssh/id_dsa file
+     */
+    return Curl_setstropt(&s->str[STRING_SSH_PRIVATE_KEY], ptr);
+  case CURLOPT_SSH_KEYDATA:
+    /*
+     * Custom client data to pass to the SSH keyfunc callback
+     */
+    s->ssh_keyfunc_userp = ptr;
+    break;
+  case CURLOPT_SSH_HOST_PUBLIC_KEY_MD5:
+    /*
+     * Option to allow for the MD5 of the host public key to be checked
+     * for validation purposes.
+     */
+    return Curl_setstropt(&s->str[STRING_SSH_HOST_PUBLIC_KEY_MD5], ptr);
+  case CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256:
+    /*
+     * Option to allow for the SHA256 of the host public key to be checked
+     * for validation purposes.
+     */
+    return Curl_setstropt(&s->str[STRING_SSH_HOST_PUBLIC_KEY_SHA256], ptr);
+  case CURLOPT_SSH_KNOWNHOSTS:
+    /*
+     * Store the filename to read known hosts from.
+     */
+    return Curl_setstropt(&s->str[STRING_SSH_KNOWNHOSTS], ptr);
+#ifdef USE_LIBSSH2
+  case CURLOPT_SSH_HOSTKEYDATA:
+    /*
+     * Custom client data to pass to the SSH keyfunc callback
+     */
+    s->ssh_hostkeyfunc_userp = ptr;
+    break;
+#endif /* USE_LIBSSH2 */
+  default:
+    return CURLE_UNKNOWN_OPTION;
+  }
+  return CURLE_OK;
+}
+#endif /* USE_SSH */
+
+#ifndef CURL_DISABLE_FTP
+static CURLcode setopt_cptr_ftp(struct Curl_easy *data, CURLoption option,
+                                char *ptr)
+{
+  CURLcode result = CURLE_OK;
+  struct UserDefined *s = &data->set;
+  switch(option) {
+  case CURLOPT_FTPPORT:
+    /*
+     * Use FTP PORT, this also specifies which IP address to use
+     */
+    result = Curl_setstropt(&s->str[STRING_FTPPORT], ptr);
+    s->ftp_use_port = !!(s->str[STRING_FTPPORT]);
+    break;
+
+  case CURLOPT_FTP_ACCOUNT:
+    return Curl_setstropt(&s->str[STRING_FTP_ACCOUNT], ptr);
+
+  case CURLOPT_FTP_ALTERNATIVE_TO_USER:
+    return Curl_setstropt(&s->str[STRING_FTP_ALTERNATIVE_TO_USER], ptr);
+
+  case CURLOPT_KRBLEVEL:
+    return CURLE_NOT_BUILT_IN; /* removed in 8.17.0 */
+  case CURLOPT_CHUNK_DATA:
+    s->wildcardptr = ptr;
+    break;
+  case CURLOPT_FNMATCH_DATA:
+    s->fnmatch_data = ptr;
+    break;
+  default:
+    return CURLE_UNKNOWN_OPTION;
+  }
+  return result;
+}
+#endif /* !CURL_DISABLE_FTP */
+
+static CURLcode setopt_cptr_net(struct Curl_easy *data, CURLoption option,
+                                char *ptr)
+{
+  struct UserDefined *s = &data->set;
+  switch(option) {
+  case CURLOPT_INTERFACE:
+    /*
+     * Set what interface or address/hostname to bind the socket to when
+     * performing an operation and thus what from-IP your connection will use.
+     */
+    return setstropt_interface(ptr,
+                               &s->str[STRING_DEVICE],
+                               &s->str[STRING_INTERFACE],
+                               &s->str[STRING_BINDHOST]);
+#ifdef USE_RESOLV_ARES
+  case CURLOPT_DNS_SERVERS:
+    return Curl_setstropt(&s->str[STRING_DNS_SERVERS], ptr);
+
+  case CURLOPT_DNS_INTERFACE:
+    return Curl_setstropt(&s->str[STRING_DNS_INTERFACE], ptr);
+
+  case CURLOPT_DNS_LOCAL_IP4:
+    return Curl_setstropt(&s->str[STRING_DNS_LOCAL_IP4], ptr);
+
+  case CURLOPT_DNS_LOCAL_IP6:
+    return Curl_setstropt(&s->str[STRING_DNS_LOCAL_IP6], ptr);
+#endif
+#ifdef USE_UNIX_SOCKETS
+  case CURLOPT_UNIX_SOCKET_PATH:
+    s->abstract_unix_socket = FALSE;
+    return Curl_setstropt(&s->str[STRING_UNIX_SOCKET_PATH], ptr);
+
+  case CURLOPT_ABSTRACT_UNIX_SOCKET:
+    s->abstract_unix_socket = TRUE;
+    return Curl_setstropt(&s->str[STRING_UNIX_SOCKET_PATH], ptr);
+#endif
+#ifndef CURL_DISABLE_DOH
+  case CURLOPT_DOH_URL:
+    {
+      CURLcode result = Curl_setstropt(&s->str[STRING_DOH], ptr);
+      s->doh = !!(s->str[STRING_DOH]);
+      return result;
+    }
+#endif
+  default:
+    return CURLE_UNKNOWN_OPTION;
+  }
+}
+
+static CURLcode setopt_cptr_misc(struct Curl_easy *data, CURLoption option,
+                                 char *ptr)
+{
+  CURLcode result = CURLE_OK;
+  struct UserDefined *s = &data->set;
+
+  switch(option) {
+  case CURLOPT_REQUEST_TARGET:
+    return Curl_setstropt(&s->str[STRING_TARGET], ptr);
+#ifndef CURL_DISABLE_NETRC
+  case CURLOPT_NETRC_FILE:
+    return Curl_setstropt(&s->str[STRING_NETRC_FILE], ptr);
+#endif
+  case CURLOPT_CUSTOMREQUEST:
+    return Curl_setstropt(&s->str[STRING_CUSTOMREQUEST], ptr);
+
+    /* we do not set s->method = HTTPREQ_CUSTOM; here, we continue as if we
+       were using the already set type and this changes the actual request
+       keyword */
+  case CURLOPT_SERVICE_NAME:
+    return Curl_setstropt(&s->str[STRING_SERVICE_NAME], ptr);
+
+  case CURLOPT_HEADERDATA:
+    s->writeheader = ptr;
+    break;
+  case CURLOPT_READDATA:
+    s->in_set = ptr;
+    break;
+  case CURLOPT_WRITEDATA:
+    s->out = ptr;
+    break;
+  case CURLOPT_DEBUGDATA:
+    s->debugdata = ptr;
+    break;
+  case CURLOPT_PROGRESSDATA:
+    s->progress_client = ptr;
+    break;
+  case CURLOPT_SEEKDATA:
+    s->seek_client = ptr;
+    break;
+  case CURLOPT_IOCTLDATA:
+    s->ioctl_client = ptr;
+    break;
+  case CURLOPT_SOCKOPTDATA:
+    s->sockopt_client = ptr;
+    break;
+  case CURLOPT_OPENSOCKETDATA:
+    s->opensocket_client = ptr;
+    break;
+  case CURLOPT_RESOLVER_START_DATA:
+    s->resolver_start_client = ptr;
+    break;
+  case CURLOPT_CLOSESOCKETDATA:
+    s->closesocket_client = ptr;
+    break;
+  case CURLOPT_PREREQDATA:
+    s->prereq_userp = ptr;
+    break;
+  case CURLOPT_ERRORBUFFER:
+    s->errorbuffer = ptr;
+    break;
+  case CURLOPT_URL:
+    result = Curl_setstropt(&s->str[STRING_SET_URL], ptr);
+    Curl_bufref_set(&data->state.url, s->str[STRING_SET_URL], 0, NULL);
+    break;
+
+  case CURLOPT_USERPWD:
+    return setstropt_userpwd(ptr, &s->str[STRING_USERNAME],
+                             &s->str[STRING_PASSWORD]);
+
+  case CURLOPT_USERNAME:
+    return Curl_setstropt(&s->str[STRING_USERNAME], ptr);
+
+  case CURLOPT_PASSWORD:
+    return Curl_setstropt(&s->str[STRING_PASSWORD], ptr);
+
+  case CURLOPT_LOGIN_OPTIONS:
+    return Curl_setstropt(&s->str[STRING_OPTIONS], ptr);
+
+  case CURLOPT_XOAUTH2_BEARER:
+    return Curl_setstropt(&s->str[STRING_BEARER], ptr);
+  case CURLOPT_RANGE:
+    return Curl_setstropt(&s->str[STRING_SET_RANGE], ptr);
+  case CURLOPT_PRIVATE:
+    s->private_data = ptr;
+    break;
+  case CURLOPT_PROTOCOLS_STR:
+    if(ptr) {
+      curl_prot_t protos;
+      result = protocol2num(ptr, &protos);
+      if(!result)
+        s->allowed_protocols = protos;
+    }
+    else
+      /* make a NULL argument reset to default */
+      s->allowed_protocols = (curl_prot_t)CURLPROTO_64ALL;
+    break;
+  case CURLOPT_REDIR_PROTOCOLS_STR:
+    if(ptr) {
+      curl_prot_t protos;
+      result = protocol2num(ptr, &protos);
+      if(!result)
+        s->redir_protocols = protos;
+    }
+    else
+      /* make a NULL argument reset to default */
+      s->redir_protocols = (curl_prot_t)CURLPROTO_REDIR;
+    break;
+  case CURLOPT_DEFAULT_PROTOCOL:
+    /* Set the protocol to use when the URL does not include any protocol */
+    return Curl_setstropt(&s->str[STRING_DEFAULT_PROTOCOL], ptr);
+#ifndef CURL_DISABLE_SMTP
+  case CURLOPT_MAIL_FROM:
+    /* Set the SMTP mail originator */
+    return Curl_setstropt(&s->str[STRING_MAIL_FROM], ptr);
+  case CURLOPT_MAIL_AUTH:
+    /* Set the SMTP auth originator */
+    return Curl_setstropt(&s->str[STRING_MAIL_AUTH], ptr);
+#endif
+  case CURLOPT_SASL_AUTHZID:
+    /* Authorization identity (identity to act as) */
+    return Curl_setstropt(&s->str[STRING_SASL_AUTHZID], ptr);
+#ifndef CURL_DISABLE_RTSP
+  case CURLOPT_RTSP_SESSION_ID:
+    return Curl_setstropt(&s->str[STRING_RTSP_SESSION_ID], ptr);
+  case CURLOPT_RTSP_STREAM_URI:
+    return Curl_setstropt(&s->str[STRING_RTSP_STREAM_URI], ptr);
+  case CURLOPT_RTSP_TRANSPORT:
+    return Curl_setstropt(&s->str[STRING_RTSP_TRANSPORT], ptr);
+  case CURLOPT_INTERLEAVEDATA:
+    s->rtp_out = ptr;
+    break;
+#endif /* !CURL_DISABLE_RTSP */
+#ifdef USE_TLS_SRP
+  case CURLOPT_TLSAUTH_USERNAME:
+    return Curl_setstropt(&s->str[STRING_TLSAUTH_USERNAME], ptr);
+  case CURLOPT_TLSAUTH_PASSWORD:
+    return Curl_setstropt(&s->str[STRING_TLSAUTH_PASSWORD], ptr);
+  case CURLOPT_TLSAUTH_TYPE:
+    if(ptr && !curl_strequal(ptr, "SRP"))
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+    break;
+#ifndef CURL_DISABLE_PROXY
+  case CURLOPT_PROXY_TLSAUTH_USERNAME:
+    return Curl_setstropt(&s->str[STRING_TLSAUTH_USERNAME_PROXY], ptr);
+  case CURLOPT_PROXY_TLSAUTH_PASSWORD:
+    return Curl_setstropt(&s->str[STRING_TLSAUTH_PASSWORD_PROXY], ptr);
+  case CURLOPT_PROXY_TLSAUTH_TYPE:
+    if(ptr && !curl_strequal(ptr, "SRP"))
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+    break;
+#endif
+#endif
+#ifndef CURL_DISABLE_HSTS
+  case CURLOPT_HSTSREADDATA:
+    s->hsts_read_userp = ptr;
+    break;
+  case CURLOPT_HSTSWRITEDATA:
+    s->hsts_write_userp = ptr;
+    break;
+  case CURLOPT_HSTS: {
+    struct curl_slist *h;
+    if(!data->hsts) {
+      data->hsts = Curl_hsts_init();
+      if(!data->hsts)
+        return CURLE_OUT_OF_MEMORY;
+    }
+    if(ptr) {
+      result = Curl_setstropt(&s->str[STRING_HSTS], ptr);
+      if(result)
+        return result;
+      /* this needs to build a list of filenames to read from, so that it can
+         read them later, as we might get a shared HSTS handle to load them
+         into */
+      h = curl_slist_append(data->state.hstslist, ptr);
+      if(!h) {
+        curl_slist_free_all(data->state.hstslist);
+        data->state.hstslist = NULL;
+        return CURLE_OUT_OF_MEMORY;
+      }
+      data->state.hstslist = h; /* store the list for later use */
+    }
+    else {
+      /* clear the list of HSTS files */
+      curl_slist_free_all(data->state.hstslist);
+      data->state.hstslist = NULL;
+      if(!data->share || !data->share->hsts)
+        /* throw away the HSTS cache unless shared */
+        Curl_hsts_cleanup(&data->hsts);
+    }
+    break;
+  }
+#endif /* !CURL_DISABLE_HSTS */
+#ifndef CURL_DISABLE_ALTSVC
+  case CURLOPT_ALTSVC:
+    if(!data->asi) {
+      data->asi = Curl_altsvc_init();
+      if(!data->asi)
+        return CURLE_OUT_OF_MEMORY;
+    }
+    result = Curl_setstropt(&s->str[STRING_ALTSVC], ptr);
+    if(result)
+      break;
+    if(ptr)
+      return Curl_altsvc_load(data->asi, ptr);
+    break;
+#endif /* !CURL_DISABLE_ALTSVC */
+  case CURLOPT_ECH:
+    return setopt_ech(data, ptr);
+  default:
+    return CURLE_UNKNOWN_OPTION;
+  }
+  return result;
+}
+
+static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
+                            char *ptr)
+{
+  typedef CURLcode (*ptrfunc)(struct Curl_easy *data, CURLoption option,
+                              char *ptr);
+  static const ptrfunc setopt_call[] = {
+#ifndef CURL_DISABLE_PROXY
+    setopt_cptr_proxy,
+#endif
+#if defined(USE_SSL) || defined(USE_SSH)
+    setopt_cptr_ssl,
+#endif
+#ifdef USE_SSH
+    setopt_cptr_ssh,
+#endif
+#ifndef CURL_DISABLE_FTP
+    setopt_cptr_ftp,
+#endif
+#if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_MQTT)
+    setopt_cptr_http_mqtt,
+#endif
+    setopt_cptr_net,
+    setopt_cptr_misc,
+  };
+  size_t i;
+
+  for(i = 0; i < CURL_ARRAYSIZE(setopt_call); i++) {
+    CURLcode result = setopt_call[i](data, option, ptr);
+    if(result != CURLE_UNKNOWN_OPTION)
+      return result;
+  }
+  return CURLE_UNKNOWN_OPTION;
+}
+
+static CURLcode setopt_func(struct Curl_easy *data, CURLoption option,
+                            va_list param)
+{
+  struct UserDefined *s = &data->set;
+  switch(option) {
   case CURLOPT_PROGRESSFUNCTION:
     /*
      * Progress callback function
      */
-    data->set.fprogress = va_arg(param, curl_progress_callback);
-    if(data->set.fprogress)
+    s->fprogress = va_arg(param, curl_progress_callback);
+    if(s->fprogress)
       data->progress.callback = TRUE; /* no longer internal */
     else
       data->progress.callback = FALSE; /* NULL enforces internal */
@@ -1586,904 +2548,94 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
     /*
      * Transfer info callback function
      */
-    data->set.fxferinfo = va_arg(param, curl_xferinfo_callback);
-    if(data->set.fxferinfo)
+    s->fxferinfo = va_arg(param, curl_xferinfo_callback);
+    if(s->fxferinfo)
       data->progress.callback = TRUE; /* no longer internal */
     else
       data->progress.callback = FALSE; /* NULL enforces internal */
 
     break;
-
-  case CURLOPT_PROGRESSDATA:
-    /*
-     * Custom client data to pass to the progress callback
-     */
-    data->set.progress_client = va_arg(param, void *);
-    break;
-
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXYUSERPWD:
-    /*
-     * user:password needed to use the proxy
-     */
-    result = setstropt_userpwd(va_arg(param, char *),
-                               &data->set.str[STRING_PROXYUSERNAME],
-                               &data->set.str[STRING_PROXYPASSWORD]);
-    break;
-  case CURLOPT_PROXYUSERNAME:
-    /*
-     * authentication user name to use in the operation
-     */
-    result = Curl_setstropt(&data->set.str[STRING_PROXYUSERNAME],
-                            va_arg(param, char *));
-    break;
-  case CURLOPT_PROXYPASSWORD:
-    /*
-     * authentication password to use in the operation
-     */
-    result = Curl_setstropt(&data->set.str[STRING_PROXYPASSWORD],
-                            va_arg(param, char *));
-    break;
-  case CURLOPT_NOPROXY:
-    /*
-     * proxy exception list
-     */
-    result = Curl_setstropt(&data->set.str[STRING_NOPROXY],
-                            va_arg(param, char *));
-    break;
-#endif
-
-  case CURLOPT_RANGE:
-    /*
-     * What range of the file you want to transfer
-     */
-    result = Curl_setstropt(&data->set.str[STRING_SET_RANGE],
-                            va_arg(param, char *));
-    break;
-  case CURLOPT_RESUME_FROM:
-    /*
-     * Resume transfer at the given file position
-     */
-    arg = va_arg(param, long);
-    if(arg < -1)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.set_resume_from = arg;
-    break;
-  case CURLOPT_RESUME_FROM_LARGE:
-    /*
-     * Resume transfer at the given file position
-     */
-    bigsize = va_arg(param, curl_off_t);
-    if(bigsize < -1)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.set_resume_from = bigsize;
-    break;
   case CURLOPT_DEBUGFUNCTION:
     /*
      * stderr write callback.
      */
-    data->set.fdebug = va_arg(param, curl_debug_callback);
+    s->fdebug = va_arg(param, curl_debug_callback);
     /*
-     * if the callback provided is NULL, it'll use the default callback
+     * if the callback provided is NULL, it will use the default callback
      */
     break;
-  case CURLOPT_DEBUGDATA:
-    /*
-     * Set to a void * that should receive all error writes. This
-     * defaults to CURLOPT_STDERR for normal operations.
-     */
-    data->set.debugdata = va_arg(param, void *);
-    break;
-  case CURLOPT_STDERR:
-    /*
-     * Set to a FILE * that should receive all error writes. This
-     * defaults to stderr for normal operations.
-     */
-    data->set.err = va_arg(param, FILE *);
-    if(!data->set.err)
-      data->set.err = stderr;
-    break;
   case CURLOPT_HEADERFUNCTION:
     /*
      * Set header write callback
      */
-    data->set.fwrite_header = va_arg(param, curl_write_callback);
+    s->fwrite_header = va_arg(param, curl_write_callback);
     break;
   case CURLOPT_WRITEFUNCTION:
     /*
      * Set data write callback
      */
-    data->set.fwrite_func = va_arg(param, curl_write_callback);
-    if(!data->set.fwrite_func)
+    s->fwrite_func = va_arg(param, curl_write_callback);
+    if(!s->fwrite_func)
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wcast-function-type-strict"
+#endif
       /* When set to NULL, reset to our internal default function */
-      data->set.fwrite_func = (curl_write_callback)fwrite;
+      s->fwrite_func = (curl_write_callback)fwrite;
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic pop
+#endif
     break;
   case CURLOPT_READFUNCTION:
     /*
      * Read data callback
      */
-    data->set.fread_func_set = va_arg(param, curl_read_callback);
-    if(!data->set.fread_func_set) {
-      data->set.is_fread_set = 0;
+    s->fread_func_set = va_arg(param, curl_read_callback);
+    if(!s->fread_func_set) {
+      s->is_fread_set = 0;
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wcast-function-type-strict"
+#endif
       /* When set to NULL, reset to our internal default function */
-      data->set.fread_func_set = (curl_read_callback)fread;
+      s->fread_func_set = (curl_read_callback)fread;
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic pop
+#endif
     }
     else
-      data->set.is_fread_set = 1;
+      s->is_fread_set = 1;
     break;
   case CURLOPT_SEEKFUNCTION:
     /*
      * Seek callback. Might be NULL.
      */
-    data->set.seek_func = va_arg(param, curl_seek_callback);
-    break;
-  case CURLOPT_SEEKDATA:
-    /*
-     * Seek control callback. Might be NULL.
-     */
-    data->set.seek_client = va_arg(param, void *);
+    s->seek_func = va_arg(param, curl_seek_callback);
     break;
   case CURLOPT_IOCTLFUNCTION:
     /*
      * I/O control callback. Might be NULL.
      */
-    data->set.ioctl_func = va_arg(param, curl_ioctl_callback);
+    s->ioctl_func = va_arg(param, curl_ioctl_callback);
     break;
-  case CURLOPT_IOCTLDATA:
-    /*
-     * I/O control data pointer. Might be NULL.
-     */
-    data->set.ioctl_client = va_arg(param, void *);
-    break;
-  case CURLOPT_SSLCERT:
-    /*
-     * String that holds file name of the SSL certificate to use
-     */
-    result = Curl_setstropt(&data->set.str[STRING_CERT],
-                            va_arg(param, char *));
-    break;
-  case CURLOPT_SSLCERT_BLOB:
-    /*
-     * Blob that holds file content of the SSL certificate to use
-     */
-    result = Curl_setblobopt(&data->set.blobs[BLOB_CERT],
-                             va_arg(param, struct curl_blob *));
-    break;
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXY_SSLCERT:
-    /*
-     * String that holds file name of the SSL certificate to use for proxy
-     */
-    result = Curl_setstropt(&data->set.str[STRING_CERT_PROXY],
-                            va_arg(param, char *));
-    break;
-  case CURLOPT_PROXY_SSLCERT_BLOB:
-    /*
-     * Blob that holds file content of the SSL certificate to use for proxy
-     */
-    result = Curl_setblobopt(&data->set.blobs[BLOB_CERT_PROXY],
-                             va_arg(param, struct curl_blob *));
-    break;
-#endif
-  case CURLOPT_SSLCERTTYPE:
-    /*
-     * String that holds file type of the SSL certificate to use
-     */
-    result = Curl_setstropt(&data->set.str[STRING_CERT_TYPE],
-                            va_arg(param, char *));
-    break;
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXY_SSLCERTTYPE:
-    /*
-     * String that holds file type of the SSL certificate to use for proxy
-     */
-    result = Curl_setstropt(&data->set.str[STRING_CERT_TYPE_PROXY],
-                            va_arg(param, char *));
-    break;
-#endif
-  case CURLOPT_SSLKEY:
-    /*
-     * String that holds file name of the SSL key to use
-     */
-    result = Curl_setstropt(&data->set.str[STRING_KEY],
-                            va_arg(param, char *));
-    break;
-  case CURLOPT_SSLKEY_BLOB:
-    /*
-     * Blob that holds file content of the SSL key to use
-     */
-    result = Curl_setblobopt(&data->set.blobs[BLOB_KEY],
-                             va_arg(param, struct curl_blob *));
-    break;
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXY_SSLKEY:
-    /*
-     * String that holds file name of the SSL key to use for proxy
-     */
-    result = Curl_setstropt(&data->set.str[STRING_KEY_PROXY],
-                            va_arg(param, char *));
-    break;
-  case CURLOPT_PROXY_SSLKEY_BLOB:
-    /*
-     * Blob that holds file content of the SSL key to use for proxy
-     */
-    result = Curl_setblobopt(&data->set.blobs[BLOB_KEY_PROXY],
-                             va_arg(param, struct curl_blob *));
-    break;
-#endif
-  case CURLOPT_SSLKEYTYPE:
-    /*
-     * String that holds file type of the SSL key to use
-     */
-    result = Curl_setstropt(&data->set.str[STRING_KEY_TYPE],
-                            va_arg(param, char *));
-    break;
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXY_SSLKEYTYPE:
-    /*
-     * String that holds file type of the SSL key to use for proxy
-     */
-    result = Curl_setstropt(&data->set.str[STRING_KEY_TYPE_PROXY],
-                            va_arg(param, char *));
-    break;
-#endif
-  case CURLOPT_KEYPASSWD:
-    /*
-     * String that holds the SSL or SSH private key password.
-     */
-    result = Curl_setstropt(&data->set.str[STRING_KEY_PASSWD],
-                            va_arg(param, char *));
-    break;
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXY_KEYPASSWD:
-    /*
-     * String that holds the SSL private key password for proxy.
-     */
-    result = Curl_setstropt(&data->set.str[STRING_KEY_PASSWD_PROXY],
-                            va_arg(param, char *));
-    break;
-#endif
-  case CURLOPT_SSLENGINE:
-    /*
-     * String that holds the SSL crypto engine.
-     */
-    argptr = va_arg(param, char *);
-    if(argptr && argptr[0]) {
-      result = Curl_setstropt(&data->set.str[STRING_SSL_ENGINE], argptr);
-      if(!result) {
-        result = Curl_ssl_set_engine(data, argptr);
-      }
-    }
-    break;
-
-  case CURLOPT_SSLENGINE_DEFAULT:
-    /*
-     * flag to set engine as default.
-     */
-    Curl_setstropt(&data->set.str[STRING_SSL_ENGINE], NULL);
-    result = Curl_ssl_set_engine_default(data);
-    break;
-  case CURLOPT_CRLF:
-    /*
-     * Kludgy option to enable CRLF conversions. Subject for removal.
-     */
-    data->set.crlf = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_HAPROXYPROTOCOL:
-    /*
-     * Set to send the HAProxy Proxy Protocol header
-     */
-    data->set.haproxyprotocol = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-  case CURLOPT_HAPROXY_CLIENT_IP:
-    /*
-     * Set the client IP to send through HAProxy PROXY protocol
-     */
-    result = Curl_setstropt(&data->set.str[STRING_HAPROXY_CLIENT_IP],
-                            va_arg(param, char *));
-    /* We enable implicitly the HAProxy protocol if we use this flag. */
-    data->set.haproxyprotocol = TRUE;
-    break;
-#endif
-  case CURLOPT_INTERFACE:
-    /*
-     * Set what interface or address/hostname to bind the socket to when
-     * performing an operation and thus what from-IP your connection will use.
-     */
-    result = Curl_setstropt(&data->set.str[STRING_DEVICE],
-                            va_arg(param, char *));
-    break;
-#ifndef CURL_DISABLE_BINDLOCAL
-  case CURLOPT_LOCALPORT:
-    /*
-     * Set what local port to bind the socket to when performing an operation.
-     */
-    arg = va_arg(param, long);
-    if((arg < 0) || (arg > 65535))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.localport = curlx_sltous(arg);
-    break;
-  case CURLOPT_LOCALPORTRANGE:
-    /*
-     * Set number of local ports to try, starting with CURLOPT_LOCALPORT.
-     */
-    arg = va_arg(param, long);
-    if((arg < 0) || (arg > 65535))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.localportrange = curlx_sltous(arg);
-    break;
-#endif
-  case CURLOPT_GSSAPI_DELEGATION:
-    /*
-     * GSS-API credential delegation bitmask
-     */
-    uarg = va_arg(param, unsigned long);
-    data->set.gssapi_delegation = (unsigned char)uarg&
-      (CURLGSSAPI_DELEGATION_POLICY_FLAG|CURLGSSAPI_DELEGATION_FLAG);
-    break;
-  case CURLOPT_SSL_VERIFYPEER:
-    /*
-     * Enable peer SSL verifying.
-     */
-    data->set.ssl.primary.verifypeer = (0 != va_arg(param, long)) ?
-      TRUE : FALSE;
-
-    /* Update the current connection ssl_config. */
-    if(data->conn) {
-      data->conn->ssl_config.verifypeer =
-        data->set.ssl.primary.verifypeer;
-    }
-    break;
-#ifndef CURL_DISABLE_DOH
-  case CURLOPT_DOH_SSL_VERIFYPEER:
-    /*
-     * Enable peer SSL verifying for DoH.
-     */
-    data->set.doh_verifypeer = (0 != va_arg(param, long)) ?
-      TRUE : FALSE;
-    break;
-#endif
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXY_SSL_VERIFYPEER:
-    /*
-     * Enable peer SSL verifying for proxy.
-     */
-    data->set.proxy_ssl.primary.verifypeer =
-      (0 != va_arg(param, long))?TRUE:FALSE;
-
-    /* Update the current connection proxy_ssl_config. */
-    if(data->conn) {
-      data->conn->proxy_ssl_config.verifypeer =
-        data->set.proxy_ssl.primary.verifypeer;
-    }
-    break;
-#endif
-  case CURLOPT_SSL_VERIFYHOST:
-    /*
-     * Enable verification of the host name in the peer certificate
-     */
-    arg = va_arg(param, long);
-
-    /* Obviously people are not reading documentation and too many thought
-       this argument took a boolean when it wasn't and misused it.
-       Treat 1 and 2 the same */
-    data->set.ssl.primary.verifyhost = (bool)((arg & 3) ? TRUE : FALSE);
-
-    /* Update the current connection ssl_config. */
-    if(data->conn) {
-      data->conn->ssl_config.verifyhost =
-        data->set.ssl.primary.verifyhost;
-    }
-    break;
-#ifndef CURL_DISABLE_DOH
-  case CURLOPT_DOH_SSL_VERIFYHOST:
-    /*
-     * Enable verification of the host name in the peer certificate for DoH
-     */
-    arg = va_arg(param, long);
-
-    /* Treat both 1 and 2 as TRUE */
-    data->set.doh_verifyhost = (bool)((arg & 3) ? TRUE : FALSE);
-    break;
-#endif
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXY_SSL_VERIFYHOST:
-    /*
-     * Enable verification of the host name in the peer certificate for proxy
-     */
-    arg = va_arg(param, long);
-
-    /* Treat both 1 and 2 as TRUE */
-    data->set.proxy_ssl.primary.verifyhost = (bool)((arg & 3)?TRUE:FALSE);
-
-    /* Update the current connection proxy_ssl_config. */
-    if(data->conn) {
-      data->conn->proxy_ssl_config.verifyhost =
-        data->set.proxy_ssl.primary.verifyhost;
-    }
-    break;
-#endif
-  case CURLOPT_SSL_VERIFYSTATUS:
-    /*
-     * Enable certificate status verifying.
-     */
-    if(!Curl_ssl_cert_status_request()) {
-      result = CURLE_NOT_BUILT_IN;
-      break;
-    }
-
-    data->set.ssl.primary.verifystatus = (0 != va_arg(param, long)) ?
-      TRUE : FALSE;
-
-    /* Update the current connection ssl_config. */
-    if(data->conn) {
-      data->conn->ssl_config.verifystatus =
-        data->set.ssl.primary.verifystatus;
-    }
-    break;
-#ifndef CURL_DISABLE_DOH
-  case CURLOPT_DOH_SSL_VERIFYSTATUS:
-    /*
-     * Enable certificate status verifying for DoH.
-     */
-    if(!Curl_ssl_cert_status_request()) {
-      result = CURLE_NOT_BUILT_IN;
-      break;
-    }
-
-    data->set.doh_verifystatus = (0 != va_arg(param, long)) ?
-      TRUE : FALSE;
-    break;
-#endif
   case CURLOPT_SSL_CTX_FUNCTION:
     /*
-     * Set a SSL_CTX callback
+     * Set an SSL_CTX callback
      */
 #ifdef USE_SSL
-    if(Curl_ssl_supports(data, SSLSUPP_SSL_CTX))
-      data->set.ssl.fsslctx = va_arg(param, curl_ssl_ctx_callback);
-    else
-#endif
-      result = CURLE_NOT_BUILT_IN;
-    break;
-  case CURLOPT_SSL_CTX_DATA:
-    /*
-     * Set a SSL_CTX callback parameter pointer
-     */
-#ifdef USE_SSL
-    if(Curl_ssl_supports(data, SSLSUPP_SSL_CTX))
-      data->set.ssl.fsslctxp = va_arg(param, void *);
-    else
-#endif
-      result = CURLE_NOT_BUILT_IN;
-    break;
-  case CURLOPT_SSL_FALSESTART:
-    /*
-     * Enable TLS false start.
-     */
-    if(!Curl_ssl_false_start(data)) {
-      result = CURLE_NOT_BUILT_IN;
+    if(Curl_ssl_supports(data, SSLSUPP_SSL_CTX)) {
+      s->ssl.fsslctx = va_arg(param, curl_ssl_ctx_callback);
       break;
     }
-
-    data->set.ssl.falsestart = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-  case CURLOPT_CERTINFO:
-#ifdef USE_SSL
-    if(Curl_ssl_supports(data, SSLSUPP_CERTINFO))
-      data->set.ssl.certinfo = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    else
-#endif
-      result = CURLE_NOT_BUILT_IN;
-        break;
-  case CURLOPT_PINNEDPUBLICKEY:
-    /*
-     * Set pinned public key for SSL connection.
-     * Specify file name of the public key in DER format.
-     */
-#ifdef USE_SSL
-    if(Curl_ssl_supports(data, SSLSUPP_PINNEDPUBKEY))
-      result = Curl_setstropt(&data->set.str[STRING_SSL_PINNEDPUBLICKEY],
-                              va_arg(param, char *));
-    else
-#endif
-      result = CURLE_NOT_BUILT_IN;
-    break;
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXY_PINNEDPUBLICKEY:
-    /*
-     * Set pinned public key for SSL connection.
-     * Specify file name of the public key in DER format.
-     */
-#ifdef USE_SSL
-    if(Curl_ssl_supports(data, SSLSUPP_PINNEDPUBKEY))
-      result = Curl_setstropt(&data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY],
-                              va_arg(param, char *));
-    else
-#endif
-      result = CURLE_NOT_BUILT_IN;
-    break;
-#endif
-  case CURLOPT_CAINFO:
-    /*
-     * Set CA info for SSL connection. Specify file name of the CA certificate
-     */
-    result = Curl_setstropt(&data->set.str[STRING_SSL_CAFILE],
-                            va_arg(param, char *));
-    break;
-  case CURLOPT_CAINFO_BLOB:
-    /*
-     * Blob that holds CA info for SSL connection.
-     * Specify entire PEM of the CA certificate
-     */
-#ifdef USE_SSL
-    if(Curl_ssl_supports(data, SSLSUPP_CAINFO_BLOB))
-      result = Curl_setblobopt(&data->set.blobs[BLOB_CAINFO],
-                               va_arg(param, struct curl_blob *));
     else
 #endif
       return CURLE_NOT_BUILT_IN;
 
-    break;
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXY_CAINFO:
-    /*
-     * Set CA info SSL connection for proxy. Specify file name of the
-     * CA certificate
-     */
-    result = Curl_setstropt(&data->set.str[STRING_SSL_CAFILE_PROXY],
-                            va_arg(param, char *));
-    break;
-  case CURLOPT_PROXY_CAINFO_BLOB:
-    /*
-     * Blob that holds CA info for SSL connection proxy.
-     * Specify entire PEM of the CA certificate
-     */
-#ifdef USE_SSL
-    if(Curl_ssl_supports(data, SSLSUPP_CAINFO_BLOB))
-      result = Curl_setblobopt(&data->set.blobs[BLOB_CAINFO_PROXY],
-                               va_arg(param, struct curl_blob *));
-    else
-#endif
-      return CURLE_NOT_BUILT_IN;
-    break;
-#endif
-  case CURLOPT_CAPATH:
-    /*
-     * Set CA path info for SSL connection. Specify directory name of the CA
-     * certificates which have been prepared using openssl c_rehash utility.
-     */
-#ifdef USE_SSL
-    if(Curl_ssl_supports(data, SSLSUPP_CA_PATH))
-      /* This does not work on windows. */
-      result = Curl_setstropt(&data->set.str[STRING_SSL_CAPATH],
-                              va_arg(param, char *));
-    else
-#endif
-      result = CURLE_NOT_BUILT_IN;
-    break;
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXY_CAPATH:
-    /*
-     * Set CA path info for SSL connection proxy. Specify directory name of the
-     * CA certificates which have been prepared using openssl c_rehash utility.
-     */
-#ifdef USE_SSL
-    if(Curl_ssl_supports(data, SSLSUPP_CA_PATH))
-      /* This does not work on windows. */
-      result = Curl_setstropt(&data->set.str[STRING_SSL_CAPATH_PROXY],
-                              va_arg(param, char *));
-    else
-#endif
-      result = CURLE_NOT_BUILT_IN;
-    break;
-#endif
-  case CURLOPT_CRLFILE:
-    /*
-     * Set CRL file info for SSL connection. Specify file name of the CRL
-     * to check certificates revocation
-     */
-    result = Curl_setstropt(&data->set.str[STRING_SSL_CRLFILE],
-                            va_arg(param, char *));
-    break;
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXY_CRLFILE:
-    /*
-     * Set CRL file info for SSL connection for proxy. Specify file name of the
-     * CRL to check certificates revocation
-     */
-    result = Curl_setstropt(&data->set.str[STRING_SSL_CRLFILE_PROXY],
-                            va_arg(param, char *));
-    break;
-#endif
-  case CURLOPT_ISSUERCERT:
-    /*
-     * Set Issuer certificate file
-     * to check certificates issuer
-     */
-    result = Curl_setstropt(&data->set.str[STRING_SSL_ISSUERCERT],
-                            va_arg(param, char *));
-    break;
-  case CURLOPT_ISSUERCERT_BLOB:
-    /*
-     * Blob that holds Issuer certificate to check certificates issuer
-     */
-    result = Curl_setblobopt(&data->set.blobs[BLOB_SSL_ISSUERCERT],
-                             va_arg(param, struct curl_blob *));
-    break;
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXY_ISSUERCERT:
-    /*
-     * Set Issuer certificate file
-     * to check certificates issuer
-     */
-    result = Curl_setstropt(&data->set.str[STRING_SSL_ISSUERCERT_PROXY],
-                            va_arg(param, char *));
-    break;
-  case CURLOPT_PROXY_ISSUERCERT_BLOB:
-    /*
-     * Blob that holds Issuer certificate to check certificates issuer
-     */
-    result = Curl_setblobopt(&data->set.blobs[BLOB_SSL_ISSUERCERT_PROXY],
-                             va_arg(param, struct curl_blob *));
-    break;
-#endif
-#ifndef CURL_DISABLE_TELNET
-  case CURLOPT_TELNETOPTIONS:
-    /*
-     * Set a linked list of telnet options
-     */
-    data->set.telnet_options = va_arg(param, struct curl_slist *);
-    break;
-#endif
-  case CURLOPT_BUFFERSIZE:
-    /*
-     * The application kindly asks for a differently sized receive buffer.
-     * If it seems reasonable, we'll use it.
-     */
-    if(data->state.buffer)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-
-    arg = va_arg(param, long);
-
-    if(arg > READBUFFER_MAX)
-      arg = READBUFFER_MAX;
-    else if(arg < 1)
-      arg = READBUFFER_SIZE;
-    else if(arg < READBUFFER_MIN)
-      arg = READBUFFER_MIN;
-
-    data->set.buffer_size = (unsigned int)arg;
-    break;
-
-  case CURLOPT_UPLOAD_BUFFERSIZE:
-    /*
-     * The application kindly asks for a differently sized upload buffer.
-     * Cap it to sensible.
-     */
-    arg = va_arg(param, long);
-
-    if(arg > UPLOADBUFFER_MAX)
-      arg = UPLOADBUFFER_MAX;
-    else if(arg < UPLOADBUFFER_MIN)
-      arg = UPLOADBUFFER_MIN;
-
-    data->set.upload_buffer_size = (unsigned int)arg;
-    Curl_safefree(data->state.ulbuf); /* force a realloc next opportunity */
-    break;
-
-  case CURLOPT_NOSIGNAL:
-    /*
-     * The application asks not to set any signal() or alarm() handlers,
-     * even when using a timeout.
-     */
-    data->set.no_signal = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-
-  case CURLOPT_SHARE:
-  {
-    struct Curl_share *set;
-    set = va_arg(param, struct Curl_share *);
-
-    /* disconnect from old share, if any */
-    if(data->share) {
-      Curl_share_lock(data, CURL_LOCK_DATA_SHARE, CURL_LOCK_ACCESS_SINGLE);
-
-      if(data->dns.hostcachetype == HCACHE_SHARED) {
-        data->dns.hostcache = NULL;
-        data->dns.hostcachetype = HCACHE_NONE;
-      }
-
-#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_COOKIES)
-      if(data->share->cookies == data->cookies)
-        data->cookies = NULL;
-#endif
-
-#ifndef CURL_DISABLE_HSTS
-      if(data->share->hsts == data->hsts)
-        data->hsts = NULL;
-#endif
-#ifdef USE_SSL
-      if(data->share->sslsession == data->state.session)
-        data->state.session = NULL;
-#endif
-#ifdef USE_LIBPSL
-      if(data->psl == &data->share->psl)
-        data->psl = data->multi? &data->multi->psl: NULL;
-#endif
-
-      data->share->dirty--;
-
-      Curl_share_unlock(data, CURL_LOCK_DATA_SHARE);
-      data->share = NULL;
-    }
-
-    if(GOOD_SHARE_HANDLE(set))
-      /* use new share if it set */
-      data->share = set;
-    if(data->share) {
-
-      Curl_share_lock(data, CURL_LOCK_DATA_SHARE, CURL_LOCK_ACCESS_SINGLE);
-
-      data->share->dirty++;
-
-      if(data->share->specifier & (1<< CURL_LOCK_DATA_DNS)) {
-        /* use shared host cache */
-        data->dns.hostcache = &data->share->hostcache;
-        data->dns.hostcachetype = HCACHE_SHARED;
-      }
-#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_COOKIES)
-      if(data->share->cookies) {
-        /* use shared cookie list, first free own one if any */
-        Curl_cookie_cleanup(data->cookies);
-        /* enable cookies since we now use a share that uses cookies! */
-        data->cookies = data->share->cookies;
-      }
-#endif   /* CURL_DISABLE_HTTP */
-#ifndef CURL_DISABLE_HSTS
-      if(data->share->hsts) {
-        /* first free the private one if any */
-        Curl_hsts_cleanup(&data->hsts);
-        data->hsts = data->share->hsts;
-      }
-#endif   /* CURL_DISABLE_HTTP */
-#ifdef USE_SSL
-      if(data->share->sslsession) {
-        data->set.general_ssl.max_ssl_sessions = data->share->max_ssl_sessions;
-        data->state.session = data->share->sslsession;
-      }
-#endif
-#ifdef USE_LIBPSL
-      if(data->share->specifier & (1 << CURL_LOCK_DATA_PSL))
-        data->psl = &data->share->psl;
-#endif
-
-      Curl_share_unlock(data, CURL_LOCK_DATA_SHARE);
-    }
-    /* check for host cache not needed,
-     * it will be done by curl_easy_perform */
-  }
-  break;
-
-  case CURLOPT_PRIVATE:
-    /*
-     * Set private data pointer.
-     */
-    data->set.private_data = va_arg(param, void *);
-    break;
-
-  case CURLOPT_MAXFILESIZE:
-    /*
-     * Set the maximum size of a file to download.
-     */
-    arg = va_arg(param, long);
-    if(arg < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.max_filesize = arg;
-    break;
-
-#ifdef USE_SSL
-  case CURLOPT_USE_SSL:
-    /*
-     * Make transfers attempt to use SSL/TLS.
-     */
-    arg = va_arg(param, long);
-    if((arg < CURLUSESSL_NONE) || (arg >= CURLUSESSL_LAST))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.use_ssl = (unsigned char)arg;
-    break;
-
-  case CURLOPT_SSL_OPTIONS:
-    arg = va_arg(param, long);
-    data->set.ssl.primary.ssl_options = (unsigned char)(arg & 0xff);
-    data->set.ssl.enable_beast = !!(arg & CURLSSLOPT_ALLOW_BEAST);
-    data->set.ssl.no_revoke = !!(arg & CURLSSLOPT_NO_REVOKE);
-    data->set.ssl.no_partialchain = !!(arg & CURLSSLOPT_NO_PARTIALCHAIN);
-    data->set.ssl.revoke_best_effort = !!(arg & CURLSSLOPT_REVOKE_BEST_EFFORT);
-    data->set.ssl.native_ca_store = !!(arg & CURLSSLOPT_NATIVE_CA);
-    data->set.ssl.auto_client_cert = !!(arg & CURLSSLOPT_AUTO_CLIENT_CERT);
-    /* If a setting is added here it should also be added in dohprobe()
-       which sets its own CURLOPT_SSL_OPTIONS based on these settings. */
-    break;
-
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXY_SSL_OPTIONS:
-    arg = va_arg(param, long);
-    data->set.proxy_ssl.primary.ssl_options = (unsigned char)(arg & 0xff);
-    data->set.proxy_ssl.enable_beast = !!(arg & CURLSSLOPT_ALLOW_BEAST);
-    data->set.proxy_ssl.no_revoke = !!(arg & CURLSSLOPT_NO_REVOKE);
-    data->set.proxy_ssl.no_partialchain = !!(arg & CURLSSLOPT_NO_PARTIALCHAIN);
-    data->set.proxy_ssl.revoke_best_effort =
-      !!(arg & CURLSSLOPT_REVOKE_BEST_EFFORT);
-    data->set.proxy_ssl.native_ca_store = !!(arg & CURLSSLOPT_NATIVE_CA);
-    data->set.proxy_ssl.auto_client_cert =
-      !!(arg & CURLSSLOPT_AUTO_CLIENT_CERT);
-    break;
-#endif
-
-  case CURLOPT_SSL_EC_CURVES:
-    /*
-     * Set accepted curves in SSL connection setup.
-     * Specify colon-delimited list of curve algorithm names.
-     */
-    result = Curl_setstropt(&data->set.str[STRING_SSL_EC_CURVES],
-                            va_arg(param, char *));
-    break;
-#endif
-  case CURLOPT_IPRESOLVE:
-    arg = va_arg(param, long);
-    if((arg < CURL_IPRESOLVE_WHATEVER) || (arg > CURL_IPRESOLVE_V6))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.ipver = (unsigned char) arg;
-    break;
-
-  case CURLOPT_MAXFILESIZE_LARGE:
-    /*
-     * Set the maximum size of a file to download.
-     */
-    bigsize = va_arg(param, curl_off_t);
-    if(bigsize < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.max_filesize = bigsize;
-    break;
-
-  case CURLOPT_TCP_NODELAY:
-    /*
-     * Enable or disable TCP_NODELAY, which will disable/enable the Nagle
-     * algorithm
-     */
-    data->set.tcp_nodelay = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-
-  case CURLOPT_IGNORE_CONTENT_LENGTH:
-    data->set.ignorecl = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-
-  case CURLOPT_CONNECT_ONLY:
-    /*
-     * No data transfer.
-     * (1) - only do connection
-     * (2) - do first get request but get no content
-     */
-    arg = va_arg(param, long);
-    if(arg > 2)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.connect_only = (unsigned char)arg;
-    break;
-
   case CURLOPT_SOCKOPTFUNCTION:
     /*
      * socket callback function: called after socket() but before connect()
      */
-    data->set.fsockopt = va_arg(param, curl_sockopt_callback);
-    break;
-
-  case CURLOPT_SOCKOPTDATA:
-    /*
-     * socket callback data pointer. Might be NULL.
-     */
-    data->set.sockopt_client = va_arg(param, void *);
+    s->fsockopt = va_arg(param, curl_sockopt_callback);
     break;
 
   case CURLOPT_OPENSOCKETFUNCTION:
@@ -2491,14 +2643,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
      * open/create socket callback function: called instead of socket(),
      * before connect()
      */
-    data->set.fopensocket = va_arg(param, curl_opensocket_callback);
-    break;
-
-  case CURLOPT_OPENSOCKETDATA:
-    /*
-     * socket callback data pointer. Might be NULL.
-     */
-    data->set.opensocket_client = va_arg(param, void *);
+    s->fopensocket = va_arg(param, curl_opensocket_callback);
     break;
 
   case CURLOPT_CLOSESOCKETFUNCTION:
@@ -2506,7 +2651,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
      * close socket callback function: called instead of close()
      * when shutting down a connection
      */
-    data->set.fclosesocket = va_arg(param, curl_closesocket_callback);
+    s->fclosesocket = va_arg(param, curl_closesocket_callback);
     break;
 
   case CURLOPT_RESOLVER_START_FUNCTION:
@@ -2514,669 +2659,268 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
      * resolver start callback function: called before a new resolver request
      * is started
      */
-    data->set.resolver_start = va_arg(param, curl_resolver_start_callback);
-    break;
-
-  case CURLOPT_RESOLVER_START_DATA:
-    /*
-     * resolver start callback data pointer. Might be NULL.
-     */
-    data->set.resolver_start_client = va_arg(param, void *);
-    break;
-
-  case CURLOPT_CLOSESOCKETDATA:
-    /*
-     * socket callback data pointer. Might be NULL.
-     */
-    data->set.closesocket_client = va_arg(param, void *);
-    break;
-
-  case CURLOPT_SSL_SESSIONID_CACHE:
-    data->set.ssl.primary.sessionid = (0 != va_arg(param, long)) ?
-      TRUE : FALSE;
-#ifndef CURL_DISABLE_PROXY
-    data->set.proxy_ssl.primary.sessionid = data->set.ssl.primary.sessionid;
-#endif
+    s->resolver_start = va_arg(param, curl_resolver_start_callback);
     break;
 
 #ifdef USE_SSH
-    /* we only include SSH options if explicitly built to support SSH */
-  case CURLOPT_SSH_AUTH_TYPES:
-    data->set.ssh_auth_types = (unsigned int)va_arg(param, long);
-    break;
-
-  case CURLOPT_SSH_PUBLIC_KEYFILE:
-    /*
-     * Use this file instead of the $HOME/.ssh/id_dsa.pub file
-     */
-    result = Curl_setstropt(&data->set.str[STRING_SSH_PUBLIC_KEY],
-                            va_arg(param, char *));
-    break;
-
-  case CURLOPT_SSH_PRIVATE_KEYFILE:
-    /*
-     * Use this file instead of the $HOME/.ssh/id_dsa file
-     */
-    result = Curl_setstropt(&data->set.str[STRING_SSH_PRIVATE_KEY],
-                            va_arg(param, char *));
-    break;
-  case CURLOPT_SSH_HOST_PUBLIC_KEY_MD5:
-    /*
-     * Option to allow for the MD5 of the host public key to be checked
-     * for validation purposes.
-     */
-    result = Curl_setstropt(&data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5],
-                            va_arg(param, char *));
-    break;
-
-  case CURLOPT_SSH_KNOWNHOSTS:
-    /*
-     * Store the file name to read known hosts from.
-     */
-    result = Curl_setstropt(&data->set.str[STRING_SSH_KNOWNHOSTS],
-                            va_arg(param, char *));
-    break;
 #ifdef USE_LIBSSH2
-  case CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256:
-    /*
-     * Option to allow for the SHA256 of the host public key to be checked
-     * for validation purposes.
-     */
-    result = Curl_setstropt(&data->set.str[STRING_SSH_HOST_PUBLIC_KEY_SHA256],
-                            va_arg(param, char *));
-    break;
-
   case CURLOPT_SSH_HOSTKEYFUNCTION:
     /* the callback to check the hostkey without the knownhost file */
-    data->set.ssh_hostkeyfunc = va_arg(param, curl_sshhostkeycallback);
-    break;
-
-  case CURLOPT_SSH_HOSTKEYDATA:
-    /*
-     * Custom client data to pass to the SSH keyfunc callback
-     */
-    data->set.ssh_hostkeyfunc_userp = va_arg(param, void *);
+    s->ssh_hostkeyfunc = va_arg(param, curl_sshhostkeycallback);
     break;
 #endif
 
   case CURLOPT_SSH_KEYFUNCTION:
     /* setting to NULL is fine since the ssh.c functions themselves will
        then revert to use the internal default */
-    data->set.ssh_keyfunc = va_arg(param, curl_sshkeycallback);
+    s->ssh_keyfunc = va_arg(param, curl_sshkeycallback);
     break;
 
-  case CURLOPT_SSH_KEYDATA:
-    /*
-     * Custom client data to pass to the SSH keyfunc callback
-     */
-    data->set.ssh_keyfunc_userp = va_arg(param, void *);
-    break;
-
-  case CURLOPT_SSH_COMPRESSION:
-    data->set.ssh_compression = (0 != va_arg(param, long))?TRUE:FALSE;
-    break;
 #endif /* USE_SSH */
 
-  case CURLOPT_HTTP_TRANSFER_DECODING:
-    /*
-     * disable libcurl transfer encoding is used
-     */
-#ifndef USE_HYPER
-    data->set.http_te_skip = (0 == va_arg(param, long)) ? TRUE : FALSE;
-    break;
-#else
-    return CURLE_NOT_BUILT_IN; /* hyper doesn't support */
-#endif
-
-  case CURLOPT_HTTP_CONTENT_DECODING:
-    /*
-     * raw data passed to the application when content encoding is used
-     */
-    data->set.http_ce_skip = (0 == va_arg(param, long)) ? TRUE : FALSE;
-    break;
-
-#if !defined(CURL_DISABLE_FTP) || defined(USE_SSH)
-  case CURLOPT_NEW_FILE_PERMS:
-    /*
-     * Uses these permissions instead of 0644
-     */
-    arg = va_arg(param, long);
-    if((arg < 0) || (arg > 0777))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.new_file_perms = (unsigned int)arg;
-    break;
-#endif
-#ifdef USE_SSH
-  case CURLOPT_NEW_DIRECTORY_PERMS:
-    /*
-     * Uses these permissions instead of 0755
-     */
-    arg = va_arg(param, long);
-    if((arg < 0) || (arg > 0777))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.new_directory_perms = (unsigned int)arg;
-    break;
-#endif
-
-#ifdef ENABLE_IPV6
-  case CURLOPT_ADDRESS_SCOPE:
-    /*
-     * Use this scope id when using IPv6
-     * We always get longs when passed plain numericals so we should check
-     * that the value fits into an unsigned 32 bit integer.
-     */
-    uarg = va_arg(param, unsigned long);
-#if SIZEOF_LONG > 4
-    if(uarg > UINT_MAX)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-#endif
-    data->set.scope_id = (unsigned int)uarg;
-    break;
-#endif
-
-  case CURLOPT_PROTOCOLS:
-    /* set the bitmask for the protocols that are allowed to be used for the
-       transfer, which thus helps the app which takes URLs from users or other
-       external inputs and want to restrict what protocol(s) to deal
-       with. Defaults to CURLPROTO_ALL. */
-    data->set.allowed_protocols = (curl_prot_t)va_arg(param, long);
-    break;
-
-  case CURLOPT_REDIR_PROTOCOLS:
-    /* set the bitmask for the protocols that libcurl is allowed to follow to,
-       as a subset of the CURLOPT_PROTOCOLS ones. That means the protocol needs
-       to be set in both bitmasks to be allowed to get redirected to. */
-    data->set.redir_protocols = (curl_prot_t)va_arg(param, long);
-    break;
-
-  case CURLOPT_PROTOCOLS_STR: {
-    curl_prot_t prot;
-    argptr = va_arg(param, char *);
-    result = protocol2num(argptr, &prot);
-    if(result)
-      return result;
-    data->set.allowed_protocols = prot;
-    break;
-  }
-
-  case CURLOPT_REDIR_PROTOCOLS_STR: {
-    curl_prot_t prot;
-    argptr = va_arg(param, char *);
-    result = protocol2num(argptr, &prot);
-    if(result)
-      return result;
-    data->set.redir_protocols = prot;
-    break;
-  }
-
-  case CURLOPT_DEFAULT_PROTOCOL:
-    /* Set the protocol to use when the URL doesn't include any protocol */
-    result = Curl_setstropt(&data->set.str[STRING_DEFAULT_PROTOCOL],
-                            va_arg(param, char *));
-    break;
-#ifndef CURL_DISABLE_SMTP
-  case CURLOPT_MAIL_FROM:
-    /* Set the SMTP mail originator */
-    result = Curl_setstropt(&data->set.str[STRING_MAIL_FROM],
-                            va_arg(param, char *));
-    break;
-
-  case CURLOPT_MAIL_AUTH:
-    /* Set the SMTP auth originator */
-    result = Curl_setstropt(&data->set.str[STRING_MAIL_AUTH],
-                            va_arg(param, char *));
-    break;
-
-  case CURLOPT_MAIL_RCPT:
-    /* Set the list of mail recipients */
-    data->set.mail_rcpt = va_arg(param, struct curl_slist *);
-    break;
-  case CURLOPT_MAIL_RCPT_ALLOWFAILS:
-    /* allow RCPT TO command to fail for some recipients */
-    data->set.mail_rcpt_allowfails = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-#endif
-
-  case CURLOPT_SASL_AUTHZID:
-    /* Authorization identity (identity to act as) */
-    result = Curl_setstropt(&data->set.str[STRING_SASL_AUTHZID],
-                            va_arg(param, char *));
-    break;
-
-  case CURLOPT_SASL_IR:
-    /* Enable/disable SASL initial response */
-    data->set.sasl_ir = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
 #ifndef CURL_DISABLE_RTSP
-  case CURLOPT_RTSP_REQUEST:
-  {
-    /*
-     * Set the RTSP request method (OPTIONS, SETUP, PLAY, etc...)
-     * Would this be better if the RTSPREQ_* were just moved into here?
-     */
-    long in_rtspreq = va_arg(param, long);
-    Curl_RtspReq rtspreq = RTSPREQ_NONE;
-    switch(in_rtspreq) {
-    case CURL_RTSPREQ_OPTIONS:
-      rtspreq = RTSPREQ_OPTIONS;
-      break;
-
-    case CURL_RTSPREQ_DESCRIBE:
-      rtspreq = RTSPREQ_DESCRIBE;
-      break;
-
-    case CURL_RTSPREQ_ANNOUNCE:
-      rtspreq = RTSPREQ_ANNOUNCE;
-      break;
-
-    case CURL_RTSPREQ_SETUP:
-      rtspreq = RTSPREQ_SETUP;
-      break;
-
-    case CURL_RTSPREQ_PLAY:
-      rtspreq = RTSPREQ_PLAY;
-      break;
-
-    case CURL_RTSPREQ_PAUSE:
-      rtspreq = RTSPREQ_PAUSE;
-      break;
-
-    case CURL_RTSPREQ_TEARDOWN:
-      rtspreq = RTSPREQ_TEARDOWN;
-      break;
-
-    case CURL_RTSPREQ_GET_PARAMETER:
-      rtspreq = RTSPREQ_GET_PARAMETER;
-      break;
-
-    case CURL_RTSPREQ_SET_PARAMETER:
-      rtspreq = RTSPREQ_SET_PARAMETER;
-      break;
-
-    case CURL_RTSPREQ_RECORD:
-      rtspreq = RTSPREQ_RECORD;
-      break;
-
-    case CURL_RTSPREQ_RECEIVE:
-      rtspreq = RTSPREQ_RECEIVE;
-      break;
-    default:
-      rtspreq = RTSPREQ_NONE;
-    }
-
-    data->set.rtspreq = rtspreq;
-    break;
-  }
-
-
-  case CURLOPT_RTSP_SESSION_ID:
-    /*
-     * Set the RTSP Session ID manually. Useful if the application is
-     * resuming a previously established RTSP session
-     */
-    result = Curl_setstropt(&data->set.str[STRING_RTSP_SESSION_ID],
-                            va_arg(param, char *));
-    break;
-
-  case CURLOPT_RTSP_STREAM_URI:
-    /*
-     * Set the Stream URI for the RTSP request. Unless the request is
-     * for generic server options, the application will need to set this.
-     */
-    result = Curl_setstropt(&data->set.str[STRING_RTSP_STREAM_URI],
-                            va_arg(param, char *));
-    break;
-
-  case CURLOPT_RTSP_TRANSPORT:
-    /*
-     * The content of the Transport: header for the RTSP request
-     */
-    result = Curl_setstropt(&data->set.str[STRING_RTSP_TRANSPORT],
-                            va_arg(param, char *));
-    break;
-
-  case CURLOPT_RTSP_CLIENT_CSEQ:
-    /*
-     * Set the CSEQ number to issue for the next RTSP request. Useful if the
-     * application is resuming a previously broken connection. The CSEQ
-     * will increment from this new number henceforth.
-     */
-    data->state.rtsp_next_client_CSeq = va_arg(param, long);
-    break;
-
-  case CURLOPT_RTSP_SERVER_CSEQ:
-    /* Same as the above, but for server-initiated requests */
-    data->state.rtsp_next_server_CSeq = va_arg(param, long);
-    break;
-
-  case CURLOPT_INTERLEAVEDATA:
-    data->set.rtp_out = va_arg(param, void *);
-    break;
   case CURLOPT_INTERLEAVEFUNCTION:
     /* Set the user defined RTP write function */
-    data->set.fwrite_rtp = va_arg(param, curl_write_callback);
+    s->fwrite_rtp = va_arg(param, curl_write_callback);
     break;
 #endif
 #ifndef CURL_DISABLE_FTP
-  case CURLOPT_WILDCARDMATCH:
-    data->set.wildcard_enabled = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
   case CURLOPT_CHUNK_BGN_FUNCTION:
-    data->set.chunk_bgn = va_arg(param, curl_chunk_bgn_callback);
+    s->chunk_bgn = va_arg(param, curl_chunk_bgn_callback);
     break;
   case CURLOPT_CHUNK_END_FUNCTION:
-    data->set.chunk_end = va_arg(param, curl_chunk_end_callback);
+    s->chunk_end = va_arg(param, curl_chunk_end_callback);
     break;
   case CURLOPT_FNMATCH_FUNCTION:
-    data->set.fnmatch = va_arg(param, curl_fnmatch_callback);
-    break;
-  case CURLOPT_CHUNK_DATA:
-    data->set.wildcardptr = va_arg(param, void *);
-    break;
-  case CURLOPT_FNMATCH_DATA:
-    data->set.fnmatch_data = va_arg(param, void *);
+    s->fnmatch = va_arg(param, curl_fnmatch_callback);
     break;
 #endif
-#ifdef USE_TLS_SRP
-  case CURLOPT_TLSAUTH_USERNAME:
-    result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_USERNAME],
-                            va_arg(param, char *));
-    break;
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXY_TLSAUTH_USERNAME:
-    result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_USERNAME_PROXY],
-                            va_arg(param, char *));
-    break;
-#endif
-  case CURLOPT_TLSAUTH_PASSWORD:
-    result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_PASSWORD],
-                            va_arg(param, char *));
-    break;
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXY_TLSAUTH_PASSWORD:
-    result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_PASSWORD_PROXY],
-                            va_arg(param, char *));
-    break;
-#endif
-  case CURLOPT_TLSAUTH_TYPE:
-    argptr = va_arg(param, char *);
-    if(argptr && !strncasecompare(argptr, "SRP", strlen("SRP")))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    break;
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXY_TLSAUTH_TYPE:
-    argptr = va_arg(param, char *);
-    if(argptr || !strncasecompare(argptr, "SRP", strlen("SRP")))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    break;
-#endif
-#endif
-#ifdef USE_ARES
-  case CURLOPT_DNS_SERVERS:
-    result = Curl_setstropt(&data->set.str[STRING_DNS_SERVERS],
-                            va_arg(param, char *));
-    if(result)
-      return result;
-    result = Curl_set_dns_servers(data, data->set.str[STRING_DNS_SERVERS]);
-    break;
-  case CURLOPT_DNS_INTERFACE:
-    result = Curl_setstropt(&data->set.str[STRING_DNS_INTERFACE],
-                            va_arg(param, char *));
-    if(result)
-      return result;
-    result = Curl_set_dns_interface(data, data->set.str[STRING_DNS_INTERFACE]);
-    break;
-  case CURLOPT_DNS_LOCAL_IP4:
-    result = Curl_setstropt(&data->set.str[STRING_DNS_LOCAL_IP4],
-                            va_arg(param, char *));
-    if(result)
-      return result;
-    result = Curl_set_dns_local_ip4(data, data->set.str[STRING_DNS_LOCAL_IP4]);
-    break;
-  case CURLOPT_DNS_LOCAL_IP6:
-    result = Curl_setstropt(&data->set.str[STRING_DNS_LOCAL_IP6],
-                            va_arg(param, char *));
-    if(result)
-      return result;
-    result = Curl_set_dns_local_ip6(data, data->set.str[STRING_DNS_LOCAL_IP6]);
-    break;
-#endif
-  case CURLOPT_TCP_KEEPALIVE:
-    data->set.tcp_keepalive = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-  case CURLOPT_TCP_KEEPIDLE:
-    arg = va_arg(param, long);
-    if(arg < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    else if(arg > INT_MAX)
-      arg = INT_MAX;
-    data->set.tcp_keepidle = (int)arg;
-    break;
-  case CURLOPT_TCP_KEEPINTVL:
-    arg = va_arg(param, long);
-    if(arg < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    else if(arg > INT_MAX)
-      arg = INT_MAX;
-    data->set.tcp_keepintvl = (int)arg;
-    break;
-  case CURLOPT_TCP_FASTOPEN:
-#if defined(CONNECT_DATA_IDEMPOTENT) || defined(MSG_FASTOPEN) || \
-   defined(TCP_FASTOPEN_CONNECT)
-    data->set.tcp_fastopen = (0 != va_arg(param, long))?TRUE:FALSE;
-#else
-    result = CURLE_NOT_BUILT_IN;
-#endif
-    break;
-  case CURLOPT_SSL_ENABLE_NPN:
-    break;
-  case CURLOPT_SSL_ENABLE_ALPN:
-    data->set.ssl_enable_alpn = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-#ifdef USE_UNIX_SOCKETS
-  case CURLOPT_UNIX_SOCKET_PATH:
-    data->set.abstract_unix_socket = FALSE;
-    result = Curl_setstropt(&data->set.str[STRING_UNIX_SOCKET_PATH],
-                            va_arg(param, char *));
-    break;
-  case CURLOPT_ABSTRACT_UNIX_SOCKET:
-    data->set.abstract_unix_socket = TRUE;
-    result = Curl_setstropt(&data->set.str[STRING_UNIX_SOCKET_PATH],
-                            va_arg(param, char *));
-    break;
-#endif
-
-  case CURLOPT_PATH_AS_IS:
-    data->set.path_as_is = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-  case CURLOPT_PIPEWAIT:
-    data->set.pipewait = (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-  case CURLOPT_STREAM_WEIGHT:
-#if defined(USE_HTTP2) || defined(USE_HTTP3)
-    arg = va_arg(param, long);
-    if((arg >= 1) && (arg <= 256))
-      data->set.priority.weight = (int)arg;
-    break;
-#else
-    return CURLE_NOT_BUILT_IN;
-#endif
-  case CURLOPT_STREAM_DEPENDS:
-  case CURLOPT_STREAM_DEPENDS_E:
-  {
-    struct Curl_easy *dep = va_arg(param, struct Curl_easy *);
-    if(!dep || GOOD_EASY_HANDLE(dep)) {
-      return Curl_data_priority_add_child(dep, data,
-                                          option == CURLOPT_STREAM_DEPENDS_E);
-    }
-    break;
-  }
-  case CURLOPT_CONNECT_TO:
-    data->set.connect_to = va_arg(param, struct curl_slist *);
-    break;
-  case CURLOPT_SUPPRESS_CONNECT_HEADERS:
-    data->set.suppress_connect_headers = (0 != va_arg(param, long))?TRUE:FALSE;
-    break;
-  case CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS:
-    uarg = va_arg(param, unsigned long);
-    if(uarg > UINT_MAX)
-      uarg = UINT_MAX;
-    data->set.happy_eyeballs_timeout = (unsigned int)uarg;
-    break;
-#ifndef CURL_DISABLE_SHUFFLE_DNS
-  case CURLOPT_DNS_SHUFFLE_ADDRESSES:
-    data->set.dns_shuffle_addresses = (0 != va_arg(param, long)) ? TRUE:FALSE;
-    break;
-#endif
-  case CURLOPT_DISALLOW_USERNAME_IN_URL:
-    data->set.disallow_username_in_url =
-      (0 != va_arg(param, long)) ? TRUE : FALSE;
-    break;
-#ifndef CURL_DISABLE_DOH
-  case CURLOPT_DOH_URL:
-    result = Curl_setstropt(&data->set.str[STRING_DOH],
-                            va_arg(param, char *));
-    data->set.doh = data->set.str[STRING_DOH]?TRUE:FALSE;
-    break;
-#endif
-  case CURLOPT_UPKEEP_INTERVAL_MS:
-    arg = va_arg(param, long);
-    if(arg < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.upkeep_interval_ms = arg;
-    break;
-  case CURLOPT_MAXAGE_CONN:
-    arg = va_arg(param, long);
-    if(arg < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.maxage_conn = arg;
-    break;
-  case CURLOPT_MAXLIFETIME_CONN:
-    arg = va_arg(param, long);
-    if(arg < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.maxlifetime_conn = arg;
-    break;
+#ifndef CURL_DISABLE_HTTP
   case CURLOPT_TRAILERFUNCTION:
-#ifndef CURL_DISABLE_HTTP
-    data->set.trailer_callback = va_arg(param, curl_trailer_callback);
-#endif
+    s->trailer_callback = va_arg(param, curl_trailer_callback);
     break;
-  case CURLOPT_TRAILERDATA:
-#ifndef CURL_DISABLE_HTTP
-    data->set.trailer_data = va_arg(param, void *);
 #endif
-    break;
 #ifndef CURL_DISABLE_HSTS
   case CURLOPT_HSTSREADFUNCTION:
-    data->set.hsts_read = va_arg(param, curl_hstsread_callback);
-    break;
-  case CURLOPT_HSTSREADDATA:
-    data->set.hsts_read_userp = va_arg(param, void *);
+    s->hsts_read = va_arg(param, curl_hstsread_callback);
     break;
   case CURLOPT_HSTSWRITEFUNCTION:
-    data->set.hsts_write = va_arg(param, curl_hstswrite_callback);
-    break;
-  case CURLOPT_HSTSWRITEDATA:
-    data->set.hsts_write_userp = va_arg(param, void *);
-    break;
-  case CURLOPT_HSTS: {
-    struct curl_slist *h;
-    if(!data->hsts) {
-      data->hsts = Curl_hsts_init();
-      if(!data->hsts)
-        return CURLE_OUT_OF_MEMORY;
-    }
-    argptr = va_arg(param, char *);
-    if(argptr) {
-      result = Curl_setstropt(&data->set.str[STRING_HSTS], argptr);
-      if(result)
-        return result;
-      /* this needs to build a list of file names to read from, so that it can
-         read them later, as we might get a shared HSTS handle to load them
-         into */
-      h = curl_slist_append(data->set.hstslist, argptr);
-      if(!h) {
-        curl_slist_free_all(data->set.hstslist);
-        data->set.hstslist = NULL;
-        return CURLE_OUT_OF_MEMORY;
-      }
-      data->set.hstslist = h; /* store the list for later use */
-    }
-    else {
-      /* clear the list of HSTS files */
-      curl_slist_free_all(data->set.hstslist);
-      data->set.hstslist = NULL;
-      if(!data->share || !data->share->hsts)
-        /* throw away the HSTS cache unless shared */
-        Curl_hsts_cleanup(&data->hsts);
-    }
-    break;
-  }
-  case CURLOPT_HSTS_CTRL:
-    arg = va_arg(param, long);
-    if(arg & CURLHSTS_ENABLE) {
-      if(!data->hsts) {
-        data->hsts = Curl_hsts_init();
-        if(!data->hsts)
-          return CURLE_OUT_OF_MEMORY;
-      }
-    }
-    else
-      Curl_hsts_cleanup(&data->hsts);
-    break;
-#endif
-#ifndef CURL_DISABLE_ALTSVC
-  case CURLOPT_ALTSVC:
-    if(!data->asi) {
-      data->asi = Curl_altsvc_init();
-      if(!data->asi)
-        return CURLE_OUT_OF_MEMORY;
-    }
-    argptr = va_arg(param, char *);
-    result = Curl_setstropt(&data->set.str[STRING_ALTSVC], argptr);
-    if(result)
-      return result;
-    if(argptr)
-      (void)Curl_altsvc_load(data->asi, argptr);
-    break;
-  case CURLOPT_ALTSVC_CTRL:
-    if(!data->asi) {
-      data->asi = Curl_altsvc_init();
-      if(!data->asi)
-        return CURLE_OUT_OF_MEMORY;
-    }
-    arg = va_arg(param, long);
-    result = Curl_altsvc_ctrl(data->asi, arg);
-    if(result)
-      return result;
+    s->hsts_write = va_arg(param, curl_hstswrite_callback);
     break;
 #endif
   case CURLOPT_PREREQFUNCTION:
-    data->set.fprereq = va_arg(param, curl_prereq_callback);
-    break;
-  case CURLOPT_PREREQDATA:
-    data->set.prereq_userp = va_arg(param, void *);
-    break;
-#ifdef USE_WEBSOCKETS
-  case CURLOPT_WS_OPTIONS: {
-    bool raw;
-    arg = va_arg(param, long);
-    raw = (arg & CURLWS_RAW_MODE);
-    data->set.ws_raw_mode = raw;
-    break;
-  }
-#endif
-  case CURLOPT_QUICK_EXIT:
-    data->set.quick_exit = (0 != va_arg(param, long)) ? 1L:0L;
+    s->fprereq = va_arg(param, curl_prereq_callback);
     break;
   default:
-    /* unknown tag and its companion, just ignore: */
-    result = CURLE_UNKNOWN_OPTION;
-    break;
+    return CURLE_UNKNOWN_OPTION;
   }
+  return CURLE_OK;
+}
 
-  return result;
+static CURLcode setopt_offt(struct Curl_easy *data, CURLoption option,
+                            curl_off_t offt)
+{
+  struct UserDefined *s = &data->set;
+  switch(option) {
+  case CURLOPT_TIMEVALUE_LARGE:
+    /*
+     * This is the value to compare with the remote document with the
+     * method set with CURLOPT_TIMECONDITION
+     */
+    s->timevalue = (time_t)offt;
+    break;
+
+    /* MQTT "borrows" some of the HTTP options */
+  case CURLOPT_POSTFIELDSIZE_LARGE:
+    /*
+     * The size of the POSTFIELD data to prevent libcurl to do strlen() to
+     * figure it out. Enables binary posts.
+     */
+    if(offt < -1)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+
+    if(s->postfieldsize < offt &&
+       s->postfields == s->str[STRING_COPYPOSTFIELDS]) {
+      /* Previous CURLOPT_COPYPOSTFIELDS is no longer valid. */
+      curlx_safefree(s->str[STRING_COPYPOSTFIELDS]);
+      s->postfields = NULL;
+    }
+    s->postfieldsize = offt;
+    break;
+  case CURLOPT_INFILESIZE_LARGE:
+    /*
+     * If known, this should inform curl about the file size of the
+     * to-be-uploaded file.
+     */
+    if(offt < -1)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->filesize = offt;
+    break;
+  case CURLOPT_MAX_SEND_SPEED_LARGE:
+    /*
+     * When transfer uploads are faster than CURLOPT_MAX_SEND_SPEED_LARGE
+     * bytes per second the transfer is throttled..
+     */
+    if(offt < 0)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->max_send_speed = offt;
+    /* use minimal burst rate of 32k. some protocol batch IO */
+    Curl_rlimit_init(&data->progress.ul.rlimit, offt,
+                     CURLMAX(offt, (32 * 1024)),
+                     Curl_pgrs_now(data));
+    break;
+  case CURLOPT_MAX_RECV_SPEED_LARGE:
+    /*
+     * When receiving data faster than CURLOPT_MAX_RECV_SPEED_LARGE bytes per
+     * second the transfer is throttled..
+     */
+    if(offt < 0)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->max_recv_speed = offt;
+    /* use minimal burst rate of 32k. some protocol batch IO */
+    Curl_rlimit_init(&data->progress.dl.rlimit, offt,
+                     CURLMAX(offt, (32 * 1024)),
+                     Curl_pgrs_now(data));
+    break;
+  case CURLOPT_RESUME_FROM_LARGE:
+    /*
+     * Resume transfer at the given file position
+     */
+    if(offt < -1)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->set_resume_from = offt;
+    break;
+  case CURLOPT_MAXFILESIZE_LARGE:
+    /*
+     * Set the maximum size of a file to download.
+     */
+    if(offt < 0)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->max_filesize = offt;
+    break;
+
+  default:
+    return CURLE_UNKNOWN_OPTION;
+  }
+  return CURLE_OK;
+}
+
+static CURLcode setopt_blob(struct Curl_easy *data, CURLoption option,
+                            struct curl_blob *blob)
+{
+  struct UserDefined *s = &data->set;
+  switch(option) {
+  case CURLOPT_SSLCERT_BLOB:
+    /*
+     * Blob that holds file content of the SSL certificate to use
+     */
+    return Curl_setblobopt(&s->blobs[BLOB_CERT], blob);
+#ifndef CURL_DISABLE_PROXY
+  case CURLOPT_PROXY_SSLCERT_BLOB:
+    /*
+     * Blob that holds file content of the SSL certificate to use for proxy
+     */
+    return Curl_setblobopt(&s->blobs[BLOB_CERT_PROXY], blob);
+  case CURLOPT_PROXY_SSLKEY_BLOB:
+    /*
+     * Blob that holds file content of the SSL key to use for proxy
+     */
+    return Curl_setblobopt(&s->blobs[BLOB_KEY_PROXY], blob);
+  case CURLOPT_PROXY_CAINFO_BLOB:
+    /*
+     * Blob that holds CA info for SSL connection proxy.
+     * Specify entire PEM of the CA certificate
+     */
+#ifdef USE_SSL
+    if(Curl_ssl_supports(data, SSLSUPP_CAINFO_BLOB)) {
+      CURLcode result = Curl_setblobopt(&s->blobs[BLOB_CAINFO_PROXY], blob);
+      s->proxy_ssl.custom_cablob = !!s->blobs[BLOB_CAINFO_PROXY];
+      return result;
+    }
+#endif
+    return CURLE_NOT_BUILT_IN;
+  case CURLOPT_PROXY_ISSUERCERT_BLOB:
+    /*
+     * Blob that holds Issuer certificate to check certificates issuer
+     */
+    if(Curl_ssl_supports(data, SSLSUPP_ISSUERCERT_BLOB))
+      return Curl_setblobopt(&s->blobs[BLOB_SSL_ISSUERCERT_PROXY], blob);
+    return CURLE_NOT_BUILT_IN;
+#endif
+  case CURLOPT_SSLKEY_BLOB:
+    /*
+     * Blob that holds file content of the SSL key to use
+     */
+    return Curl_setblobopt(&s->blobs[BLOB_KEY], blob);
+  case CURLOPT_CAINFO_BLOB:
+    /*
+     * Blob that holds CA info for SSL connection.
+     * Specify entire PEM of the CA certificate
+     */
+#ifdef USE_SSL
+    if(Curl_ssl_supports(data, SSLSUPP_CAINFO_BLOB)) {
+      CURLcode result = Curl_setblobopt(&s->blobs[BLOB_CAINFO], blob);
+      s->ssl.custom_cablob = !!s->blobs[BLOB_CAINFO];
+      return result;
+    }
+#endif
+    return CURLE_NOT_BUILT_IN;
+  case CURLOPT_ISSUERCERT_BLOB:
+    /*
+     * Blob that holds Issuer certificate to check certificates issuer
+     */
+    if(Curl_ssl_supports(data, SSLSUPP_ISSUERCERT_BLOB))
+      return Curl_setblobopt(&s->blobs[BLOB_SSL_ISSUERCERT], blob);
+    return CURLE_NOT_BUILT_IN;
+
+  default:
+    return CURLE_UNKNOWN_OPTION;
+  }
+  /* unreachable */
+}
+
+/*
+ * Do not make Curl_vsetopt() static: it is called from
+ * projects/OS400/ccsidcurl.c.
+ */
+CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
+{
+  if(option < CURLOPTTYPE_OBJECTPOINT)
+    return setopt_long(data, option, va_arg(param, long));
+  else if(option < CURLOPTTYPE_FUNCTIONPOINT) {
+    /* unfortunately, different pointer types cannot be identified any other
+       way than being listed explicitly */
+    switch(option) {
+    case CURLOPT_HTTPHEADER:
+    case CURLOPT_QUOTE:
+    case CURLOPT_POSTQUOTE:
+    case CURLOPT_TELNETOPTIONS:
+    case CURLOPT_PREQUOTE:
+    case CURLOPT_HTTP200ALIASES:
+    case CURLOPT_MAIL_RCPT:
+    case CURLOPT_RESOLVE:
+    case CURLOPT_PROXYHEADER:
+    case CURLOPT_CONNECT_TO:
+      return setopt_slist(data, option, va_arg(param, struct curl_slist *));
+    case CURLOPT_HTTPPOST:         /* curl_httppost * */
+    case CURLOPT_MIMEPOST:         /* curl_mime * */
+    case CURLOPT_STDERR:           /* FILE * */
+    case CURLOPT_SHARE:            /* CURLSH * */
+    case CURLOPT_STREAM_DEPENDS:   /* CURL * */
+    case CURLOPT_STREAM_DEPENDS_E: /* CURL * */
+    case CURLOPT_CURLU:            /* CURLU * */
+      return setopt_pointers(data, option, param);
+    default:
+      break;
+    }
+    /* the char pointer options */
+    return setopt_cptr(data, option, va_arg(param, char *));
+  }
+  else if(option < CURLOPTTYPE_OFF_T)
+    return setopt_func(data, option, param);
+  else if(option < CURLOPTTYPE_BLOB)
+    return setopt_offt(data, option, va_arg(param, curl_off_t));
+  return setopt_blob(data, option, va_arg(param, struct curl_blob *));
 }
 
 /*
@@ -3188,18 +2932,21 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
  */
 
 #undef curl_easy_setopt
-CURLcode curl_easy_setopt(struct Curl_easy *data, CURLoption tag, ...)
+CURLcode curl_easy_setopt(CURL *curl, CURLoption option, ...)
 {
   va_list arg;
   CURLcode result;
+  struct Curl_easy *data = curl;
 
   if(!data)
     return CURLE_BAD_FUNCTION_ARGUMENT;
 
-  va_start(arg, tag);
+  va_start(arg, option);
 
-  result = Curl_vsetopt(data, tag, arg);
+  result = Curl_vsetopt(data, option, arg);
 
   va_end(arg);
+  if(result == CURLE_BAD_FUNCTION_ARGUMENT)
+    failf(data, "setopt 0x%x got bad argument", (unsigned int)option);
   return result;
 }
diff --git a/third-party/curl/lib/setopt.h b/third-party/curl/lib/setopt.h
index 3c14a05e37..c421f5c5e5 100644
--- a/third-party/curl/lib/setopt.h
+++ b/third-party/curl/lib/setopt.h
@@ -24,9 +24,17 @@
  *
  ***************************************************************************/
 
-CURLcode Curl_setstropt(char **charp, const char *s);
+#ifdef USE_SSL
+CURLcode Curl_setopt_SSLVERSION(struct Curl_easy *data, CURLoption option,
+                                long arg);
+#else
+#define Curl_setopt_SSLVERSION(a, b, c) CURLE_NOT_BUILT_IN
+#endif
+
+CURLcode Curl_setstropt(char **charp, const char *s) WARN_UNUSED_RESULT;
 CURLcode Curl_setblobopt(struct curl_blob **blobp,
-                         const struct curl_blob *blob);
-CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list arg);
+                         const struct curl_blob *blob) WARN_UNUSED_RESULT;
+CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
+  WARN_UNUSED_RESULT;
 
 #endif /* HEADER_CURL_SETOPT_H */
diff --git a/third-party/curl/lib/setup-os400.h b/third-party/curl/lib/setup-os400.h
index 53e91777ec..b5bd733672 100644
--- a/third-party/curl/lib/setup-os400.h
+++ b/third-party/curl/lib/setup-os400.h
@@ -24,19 +24,22 @@
  *
  ***************************************************************************/
 
-
 /* OS/400 netdb.h does not define NI_MAXHOST. */
 #define NI_MAXHOST      1025
 
 /* OS/400 netdb.h does not define NI_MAXSERV. */
 #define NI_MAXSERV      32
 
-/* No OS/400 header file defines u_int32_t. */
-typedef unsigned long   u_int32_t;
-
 /* OS/400 has no idea of a tty! */
 #define isatty(fd)      0
 
+/* Workaround bug in IBM QADRT runtime library:
+ * function puts() does not output the implicit trailing newline.
+ */
+
+#include <stdio.h>      /* Be sure it is loaded. */
+#undef puts
+#define puts(s) (fputs(s, stdout) == EOF ? EOF : putchar('\n'))
 
 /* System API wrapper prototypes & definitions to support ASCII parameters. */
 
@@ -46,6 +49,8 @@ typedef unsigned long   u_int32_t;
 #include <qsoasync.h>
 #include <gssapi.h>
 
+#ifdef BUILDING_LIBCURL
+
 extern int Curl_getaddrinfo_a(const char *nodename,
                               const char *servname,
                               const struct addrinfo *hints,
@@ -62,24 +67,22 @@ extern int Curl_getnameinfo_a(const struct sockaddr *sa,
 
 /* GSSAPI wrappers. */
 
-extern OM_uint32 Curl_gss_import_name_a(OM_uint32 * minor_status,
+extern OM_uint32 Curl_gss_import_name_a(OM_uint32 *minor_status,
                                         gss_buffer_t in_name,
                                         gss_OID in_name_type,
-                                        gss_name_t * out_name);
+                                        gss_name_t *out_name);
 #define gss_import_name         Curl_gss_import_name_a
 
-
-extern OM_uint32 Curl_gss_display_status_a(OM_uint32 * minor_status,
+extern OM_uint32 Curl_gss_display_status_a(OM_uint32 *minor_status,
                                            OM_uint32 status_value,
                                            int status_type, gss_OID mech_type,
-                                           gss_msg_ctx_t * message_context,
+                                           gss_msg_ctx_t *message_context,
                                            gss_buffer_t status_string);
 #define gss_display_status      Curl_gss_display_status_a
 
-
-extern OM_uint32 Curl_gss_init_sec_context_a(OM_uint32 * minor_status,
+extern OM_uint32 Curl_gss_init_sec_context_a(OM_uint32 *minor_status,
                                              gss_cred_id_t cred_handle,
-                                             gss_ctx_id_t * context_handle,
+                                             gss_ctx_id_t *context_handle,
                                              gss_name_t target_name,
                                              gss_OID mech_type,
                                              gss_flags_t req_flags,
@@ -87,19 +90,17 @@ extern OM_uint32 Curl_gss_init_sec_context_a(OM_uint32 * minor_status,
                                              gss_channel_bindings_t
                                              input_chan_bindings,
                                              gss_buffer_t input_token,
-                                             gss_OID * actual_mech_type,
+                                             gss_OID *actual_mech_type,
                                              gss_buffer_t output_token,
-                                             gss_flags_t * ret_flags,
-                                             OM_uint32 * time_rec);
+                                             gss_flags_t *ret_flags,
+                                             OM_uint32 *time_rec);
 #define gss_init_sec_context    Curl_gss_init_sec_context_a
 
-
-extern OM_uint32 Curl_gss_delete_sec_context_a(OM_uint32 * minor_status,
-                                               gss_ctx_id_t * context_handle,
+extern OM_uint32 Curl_gss_delete_sec_context_a(OM_uint32 *minor_status,
+                                               gss_ctx_id_t *context_handle,
                                                gss_buffer_t output_token);
 #define gss_delete_sec_context  Curl_gss_delete_sec_context_a
 
-
 /* LDAP wrappers. */
 
 #define BerValue                struct berval
@@ -141,4 +142,6 @@ extern int Curl_os400_getsockname(int sd, struct sockaddr *addr, int *addrlen);
 #define inflateEnd              Curl_os400_inflateEnd
 #endif
 
+#endif /* BUILDING_LIBCURL */
+
 #endif /* HEADER_CURL_SETUP_OS400_H */
diff --git a/third-party/curl/lib/setup-vms.h b/third-party/curl/lib/setup-vms.h
index 645cc1a9cd..35d12f0b42 100644
--- a/third-party/curl/lib/setup-vms.h
+++ b/third-party/curl/lib/setup-vms.h
@@ -24,11 +24,10 @@
  *
  ***************************************************************************/
 
-/*                                                                         */
-/* JEM, 12/30/12, VMS now generates config.h, so only define wrappers for  */
-/*                getenv(), getpwuid() and provide is_vms_shell()          */
-/*                Also need upper case symbols for system services, and    */
-/*                OpenSSL, and some Kerberos image                         */
+/* JEM, 2012-12-30, VMS now generates config.h, so only define wrappers for */
+/*                  getenv(), getpwuid() and provide is_vms_shell()         */
+/*                  Also need upper case symbols for system services, and   */
+/*                  OpenSSL, and some Kerberos image                        */
 
 #ifdef __DECC
 #pragma message save
@@ -38,9 +37,9 @@
 /* Hide the stuff we are overriding */
 #define getenv decc_getenv
 #ifdef __DECC
-#   if __INITIAL_POINTER_SIZE != 64
-#       define getpwuid decc_getpwuid
-#   endif
+#  if __INITIAL_POINTER_SIZE != 64
+#    define getpwuid decc_getpwuid
+#  endif
 #endif
 #include <stdlib.h>
 char *decc$getenv(const char *__name);
@@ -51,34 +50,34 @@ char *decc$getenv(const char *__name);
 
 #undef getenv
 #undef getpwuid
-#define getenv vms_getenv
+#define getenv   vms_getenv
 #define getpwuid vms_getpwuid
 
 /* VAX needs these in upper case when compiling exact case */
 #define sys$assign SYS$ASSIGN
 #define sys$dassgn SYS$DASSGN
-#define sys$qiow SYS$QIOW
+#define sys$qiow   SYS$QIOW
 
 #ifdef __DECC
-#   if __INITIAL_POINTER_SIZE
-#       pragma __pointer_size __save
-#   endif
+#  if __INITIAL_POINTER_SIZE
+#    pragma __pointer_size __save
+#  endif
 #endif
 
 #if __USE_LONG_GID_T
-#   define decc_getpwuid DECC$__LONG_GID_GETPWUID
+#  define decc_getpwuid DECC$__LONG_GID_GETPWUID
 #else
-#   if __INITIAL_POINTER_SIZE
-#       define decc_getpwuid decc$__32_getpwuid
-#   else
-#       define decc_getpwuid decc$getpwuid
-#   endif
+#  if __INITIAL_POINTER_SIZE
+#    define decc_getpwuid decc$__32_getpwuid
+#  else
+#    define decc_getpwuid decc$getpwuid
+#  endif
 #endif
 
-    struct passwd *decc_getpwuid(uid_t uid);
+struct passwd *decc_getpwuid(uid_t uid);
 
 #ifdef __DECC
-#   if __INITIAL_POINTER_SIZE == 32
+#  if __INITIAL_POINTER_SIZE == 32
 /* Translate the path, but only if the path is a VMS file specification */
 /* The translation is usually only needed for older versions of VMS */
 static char *vms_translate_path(const char *path)
@@ -87,7 +86,7 @@ static char *vms_translate_path(const char *path)
   char *test_str;
 
   /* See if the result is in VMS format, if not, we are done */
-  /* Assume that this is a PATH, not just some data */
+  /* Assume that this is a PATH, not some data */
   test_str = strpbrk(path, ":[<^");
   if(!test_str) {
     return (char *)path;
@@ -100,18 +99,18 @@ static char *vms_translate_path(const char *path)
     return (char *)path;
   }
 }
-#   else
-    /* VMS translate path is actually not needed on the current 64 bit */
-    /* VMS platforms, so instead of figuring out the pointer settings */
-    /* Change it to a noop */
-#   define vms_translate_path(__path) __path
-#   endif
+#  else
+   /* VMS translate path is actually not needed on the current 64-bit */
+   /* VMS platforms, so instead of figuring out the pointer settings */
+   /* Change it to a noop */
+#  define vms_translate_path(__path) __path
+#  endif
 #endif
 
 #ifdef __DECC
-#   if __INITIAL_POINTER_SIZE
-#       pragma __pointer_size __restore
-#   endif
+#  if __INITIAL_POINTER_SIZE
+#    pragma __pointer_size __restore
+#  endif
 #endif
 
 static char *vms_getenv(const char *envvar)
@@ -137,20 +136,19 @@ static char *vms_getenv(const char *envvar)
   return result;
 }
 
-
 static struct passwd vms_passwd_cache;
 
 static struct passwd *vms_getpwuid(uid_t uid)
 {
   struct passwd *my_passwd;
 
-/* Hack needed to support 64 bit builds, decc_getpwnam is 32 bit only */
+/* Hack needed to support 64-bit builds, decc_getpwnam is 32-bit only */
 #ifdef __DECC
-#   if __INITIAL_POINTER_SIZE
+#  if __INITIAL_POINTER_SIZE
   __char_ptr32 unix_path;
-#   else
+#  else
   char *unix_path;
-#   endif
+#  endif
 #else
   char *unix_path;
 #endif
@@ -167,7 +165,7 @@ static struct passwd *vms_getpwuid(uid_t uid)
     return my_passwd;
   }
 
-  /* If no changes needed just return it */
+  /* If no changes needed, return it */
   if(unix_path == my_passwd->pw_dir) {
     return my_passwd;
   }
@@ -191,202 +189,196 @@ static struct passwd *vms_getpwuid(uid_t uid)
 /* Bug - VMS OpenSSL and Kerberos universal symbols are in uppercase only */
 /* VMS libraries should have universal symbols in exact and uppercase */
 
-#define ASN1_INTEGER_get ASN1_INTEGER_GET
-#define ASN1_STRING_data ASN1_STRING_DATA
-#define ASN1_STRING_length ASN1_STRING_LENGTH
-#define ASN1_STRING_print ASN1_STRING_PRINT
-#define ASN1_STRING_to_UTF8 ASN1_STRING_TO_UTF8
-#define ASN1_STRING_type ASN1_STRING_TYPE
-#define BIO_ctrl BIO_CTRL
-#define BIO_free BIO_FREE
-#define BIO_new BIO_NEW
-#define BIO_s_mem BIO_S_MEM
-#define BN_bn2bin BN_BN2BIN
-#define BN_num_bits BN_NUM_BITS
+#define ASN1_INTEGER_get           ASN1_INTEGER_GET
+#define ASN1_STRING_data           ASN1_STRING_DATA
+#define ASN1_STRING_length         ASN1_STRING_LENGTH
+#define ASN1_STRING_print          ASN1_STRING_PRINT
+#define ASN1_STRING_to_UTF8        ASN1_STRING_TO_UTF8
+#define ASN1_STRING_type           ASN1_STRING_TYPE
+#define BIO_ctrl                   BIO_CTRL
+#define BIO_free                   BIO_FREE
+#define BIO_new                    BIO_NEW
+#define BIO_s_mem                  BIO_S_MEM
+#define BN_bn2bin                  BN_BN2BIN
+#define BN_num_bits                BN_NUM_BITS
 #define CRYPTO_cleanup_all_ex_data CRYPTO_CLEANUP_ALL_EX_DATA
-#define CRYPTO_free CRYPTO_FREE
-#define CRYPTO_malloc CRYPTO_MALLOC
-#define CONF_modules_load_file CONF_MODULES_LOAD_FILE
+#define CRYPTO_free                CRYPTO_FREE
+#define CRYPTO_malloc              CRYPTO_MALLOC
+#define CONF_modules_load_file     CONF_MODULES_LOAD_FILE
 #ifdef __VAX
 #  ifdef VMS_OLD_SSL
   /* Ancient OpenSSL on VAX/VMS missing this constant */
 #    define CONF_MFLAGS_IGNORE_MISSING_FILE 0x10
 #    undef CONF_modules_load_file
-     static int CONF_modules_load_file(const char *filename,
-                                       const char *appname,
-                                       unsigned long flags) {
-             return 1;
-     }
+static int CONF_modules_load_file(const char *filename,
+                                  const char *appname,
+                                  unsigned long flags) {
+  return 1;
+}
 #  endif
 #endif
-#define DES_ecb_encrypt DES_ECB_ENCRYPT
-#define DES_set_key DES_SET_KEY
-#define DES_set_odd_parity DES_SET_ODD_PARITY
-#define ENGINE_ctrl ENGINE_CTRL
-#define ENGINE_ctrl_cmd ENGINE_CTRL_CMD
-#define ENGINE_finish ENGINE_FINISH
-#define ENGINE_free ENGINE_FREE
-#define ENGINE_get_first ENGINE_GET_FIRST
-#define ENGINE_get_id ENGINE_GET_ID
-#define ENGINE_get_next ENGINE_GET_NEXT
-#define ENGINE_init ENGINE_INIT
+#define DES_ecb_encrypt             DES_ECB_ENCRYPT
+#define DES_set_key                 DES_SET_KEY
+#define DES_set_odd_parity          DES_SET_ODD_PARITY
+#define ENGINE_ctrl                 ENGINE_CTRL
+#define ENGINE_ctrl_cmd             ENGINE_CTRL_CMD
+#define ENGINE_finish               ENGINE_FINISH
+#define ENGINE_free                 ENGINE_FREE
+#define ENGINE_get_first            ENGINE_GET_FIRST
+#define ENGINE_get_id               ENGINE_GET_ID
+#define ENGINE_get_next             ENGINE_GET_NEXT
+#define ENGINE_init                 ENGINE_INIT
 #define ENGINE_load_builtin_engines ENGINE_LOAD_BUILTIN_ENGINES
-#define ENGINE_load_private_key ENGINE_LOAD_PRIVATE_KEY
-#define ENGINE_set_default ENGINE_SET_DEFAULT
-#define ERR_clear_error ERR_CLEAR_ERROR
-#define ERR_error_string ERR_ERROR_STRING
-#define ERR_error_string_n ERR_ERROR_STRING_N
-#define ERR_free_strings ERR_FREE_STRINGS
-#define ERR_get_error ERR_GET_ERROR
-#define ERR_peek_error ERR_PEEK_ERROR
-#define ERR_remove_state ERR_REMOVE_STATE
-#define EVP_PKEY_copy_parameters EVP_PKEY_COPY_PARAMETERS
-#define EVP_PKEY_free EVP_PKEY_FREE
-#define EVP_cleanup EVP_CLEANUP
-#define GENERAL_NAMES_free GENERAL_NAMES_FREE
-#define i2d_X509_PUBKEY I2D_X509_PUBKEY
-#define MD4_Final MD4_FINAL
-#define MD4_Init MD4_INIT
-#define MD4_Update MD4_UPDATE
-#define MD5_Final MD5_FINAL
-#define MD5_Init MD5_INIT
-#define MD5_Update MD5_UPDATE
+#define ENGINE_load_private_key     ENGINE_LOAD_PRIVATE_KEY
+#define ENGINE_set_default          ENGINE_SET_DEFAULT
+#define ERR_clear_error             ERR_CLEAR_ERROR
+#define ERR_error_string            ERR_ERROR_STRING
+#define ERR_error_string_n          ERR_ERROR_STRING_N
+#define ERR_free_strings            ERR_FREE_STRINGS
+#define ERR_get_error               ERR_GET_ERROR
+#define ERR_peek_error              ERR_PEEK_ERROR
+#define ERR_remove_state            ERR_REMOVE_STATE
+#define EVP_PKEY_copy_parameters    EVP_PKEY_COPY_PARAMETERS
+#define EVP_PKEY_free               EVP_PKEY_FREE
+#define EVP_cleanup                 EVP_CLEANUP
+#define GENERAL_NAMES_free          GENERAL_NAMES_FREE
+#define i2d_X509_PUBKEY             I2D_X509_PUBKEY
+#define MD4_Final                   MD4_FINAL
+#define MD4_Init                    MD4_INIT
+#define MD4_Update                  MD4_UPDATE
+#define MD5_Final                   MD5_FINAL
+#define MD5_Init                    MD5_INIT
+#define MD5_Update                  MD5_UPDATE
 #define OPENSSL_add_all_algo_noconf OPENSSL_ADD_ALL_ALGO_NOCONF
 #ifndef __VAX
 #define OPENSSL_load_builtin_modules OPENSSL_LOAD_BUILTIN_MODULES
 #endif
-#define PEM_read_X509 PEM_READ_X509
-#define PEM_write_bio_X509 PEM_WRITE_BIO_X509
-#define PKCS12_PBE_add PKCS12_PBE_ADD
-#define PKCS12_free PKCS12_FREE
-#define PKCS12_parse PKCS12_PARSE
-#define RAND_add RAND_ADD
-#define RAND_bytes RAND_BYTES
-#define RAND_file_name RAND_FILE_NAME
-#define RAND_load_file RAND_LOAD_FILE
-#define RAND_status RAND_STATUS
-#define SSL_CIPHER_get_name SSL_CIPHER_GET_NAME
-#define SSL_CTX_add_client_CA SSL_CTX_ADD_CLIENT_CA
-#define SSL_CTX_callback_ctrl SSL_CTX_CALLBACK_CTRL
-#define SSL_CTX_check_private_key SSL_CTX_CHECK_PRIVATE_KEY
-#define SSL_CTX_ctrl SSL_CTX_CTRL
-#define SSL_CTX_free SSL_CTX_FREE
-#define SSL_CTX_get_cert_store SSL_CTX_GET_CERT_STORE
-#define SSL_CTX_load_verify_locations SSL_CTX_LOAD_VERIFY_LOCATIONS
-#define SSL_CTX_new SSL_CTX_NEW
-#define SSL_CTX_set_cipher_list SSL_CTX_SET_CIPHER_LIST
-#define SSL_CTX_set_def_passwd_cb_ud SSL_CTX_SET_DEF_PASSWD_CB_UD
-#define SSL_CTX_set_default_passwd_cb SSL_CTX_SET_DEFAULT_PASSWD_CB
-#define SSL_CTX_set_msg_callback SSL_CTX_SET_MSG_CALLBACK
-#define SSL_CTX_set_verify SSL_CTX_SET_VERIFY
-#define SSL_CTX_use_PrivateKey SSL_CTX_USE_PRIVATEKEY
-#define SSL_CTX_use_PrivateKey_file SSL_CTX_USE_PRIVATEKEY_FILE
-#define SSL_CTX_use_cert_chain_file SSL_CTX_USE_CERT_CHAIN_FILE
-#define SSL_CTX_use_certificate SSL_CTX_USE_CERTIFICATE
-#define SSL_CTX_use_certificate_file SSL_CTX_USE_CERTIFICATE_FILE
-#define SSL_SESSION_free SSL_SESSION_FREE
-#define SSL_connect SSL_CONNECT
-#define SSL_free SSL_FREE
-#define SSL_get1_session SSL_GET1_SESSION
-#define SSL_get_certificate SSL_GET_CERTIFICATE
-#define SSL_get_current_cipher SSL_GET_CURRENT_CIPHER
-#define SSL_get_error SSL_GET_ERROR
-#define SSL_get_peer_cert_chain SSL_GET_PEER_CERT_CHAIN
-#define SSL_get_peer_certificate SSL_GET_PEER_CERTIFICATE
-#define SSL_get_privatekey SSL_GET_PRIVATEKEY
-#define SSL_get_session SSL_GET_SESSION
-#define SSL_get_shutdown SSL_GET_SHUTDOWN
-#define SSL_get_verify_result SSL_GET_VERIFY_RESULT
-#define SSL_library_init SSL_LIBRARY_INIT
-#define SSL_load_error_strings SSL_LOAD_ERROR_STRINGS
-#define SSL_new SSL_NEW
-#define SSL_peek SSL_PEEK
-#define SSL_pending SSL_PENDING
-#define SSL_read SSL_READ
-#define SSL_set_connect_state SSL_SET_CONNECT_STATE
-#define SSL_set_fd SSL_SET_FD
-#define SSL_set_session SSL_SET_SESSION
-#define SSL_shutdown SSL_SHUTDOWN
-#define SSL_version SSL_VERSION
-#define SSL_write SSL_WRITE
-#define SSLeay SSLEAY
-#define SSLv23_client_method SSLV23_CLIENT_METHOD
-#define SSLv3_client_method SSLV3_CLIENT_METHOD
-#define TLSv1_client_method TLSV1_CLIENT_METHOD
-#define UI_create_method UI_CREATE_METHOD
-#define UI_destroy_method UI_DESTROY_METHOD
-#define UI_get0_user_data UI_GET0_USER_DATA
-#define UI_get_input_flags UI_GET_INPUT_FLAGS
-#define UI_get_string_type UI_GET_STRING_TYPE
-#define UI_create_method UI_CREATE_METHOD
-#define UI_destroy_method UI_DESTROY_METHOD
-#define UI_method_get_closer UI_METHOD_GET_CLOSER
-#define UI_method_get_opener UI_METHOD_GET_OPENER
-#define UI_method_get_reader UI_METHOD_GET_READER
-#define UI_method_get_writer UI_METHOD_GET_WRITER
-#define UI_method_set_closer UI_METHOD_SET_CLOSER
-#define UI_method_set_opener UI_METHOD_SET_OPENER
-#define UI_method_set_reader UI_METHOD_SET_READER
-#define UI_method_set_writer UI_METHOD_SET_WRITER
-#define UI_OpenSSL UI_OPENSSL
-#define UI_set_result UI_SET_RESULT
-#define X509V3_EXT_print X509V3_EXT_PRINT
-#define X509_EXTENSION_get_critical X509_EXTENSION_GET_CRITICAL
-#define X509_EXTENSION_get_data X509_EXTENSION_GET_DATA
-#define X509_EXTENSION_get_object X509_EXTENSION_GET_OBJECT
-#define X509_LOOKUP_file X509_LOOKUP_FILE
-#define X509_NAME_ENTRY_get_data X509_NAME_ENTRY_GET_DATA
-#define X509_NAME_get_entry X509_NAME_GET_ENTRY
-#define X509_NAME_get_index_by_NID X509_NAME_GET_INDEX_BY_NID
-#define X509_NAME_print_ex X509_NAME_PRINT_EX
+#define PEM_read_X509                   PEM_READ_X509
+#define PEM_write_bio_X509              PEM_WRITE_BIO_X509
+#define PKCS12_free                     PKCS12_FREE
+#define PKCS12_parse                    PKCS12_PARSE
+#define RAND_add                        RAND_ADD
+#define RAND_bytes                      RAND_BYTES
+#define RAND_file_name                  RAND_FILE_NAME
+#define RAND_load_file                  RAND_LOAD_FILE
+#define RAND_status                     RAND_STATUS
+#define SSL_CIPHER_get_name             SSL_CIPHER_GET_NAME
+#define SSL_CTX_add_client_CA           SSL_CTX_ADD_CLIENT_CA
+#define SSL_CTX_callback_ctrl           SSL_CTX_CALLBACK_CTRL
+#define SSL_CTX_check_private_key       SSL_CTX_CHECK_PRIVATE_KEY
+#define SSL_CTX_ctrl                    SSL_CTX_CTRL
+#define SSL_CTX_free                    SSL_CTX_FREE
+#define SSL_CTX_get_cert_store          SSL_CTX_GET_CERT_STORE
+#define SSL_CTX_load_verify_locations   SSL_CTX_LOAD_VERIFY_LOCATIONS
+#define SSL_CTX_new                     SSL_CTX_NEW
+#define SSL_CTX_set_cipher_list         SSL_CTX_SET_CIPHER_LIST
+#define SSL_CTX_set_def_passwd_cb_ud    SSL_CTX_SET_DEF_PASSWD_CB_UD
+#define SSL_CTX_set_default_passwd_cb   SSL_CTX_SET_DEFAULT_PASSWD_CB
+#define SSL_CTX_set_msg_callback        SSL_CTX_SET_MSG_CALLBACK
+#define SSL_CTX_set_verify              SSL_CTX_SET_VERIFY
+#define SSL_CTX_use_PrivateKey          SSL_CTX_USE_PRIVATEKEY
+#define SSL_CTX_use_PrivateKey_file     SSL_CTX_USE_PRIVATEKEY_FILE
+#define SSL_CTX_use_cert_chain_file     SSL_CTX_USE_CERT_CHAIN_FILE
+#define SSL_CTX_use_certificate         SSL_CTX_USE_CERTIFICATE
+#define SSL_CTX_use_certificate_file    SSL_CTX_USE_CERTIFICATE_FILE
+#define SSL_SESSION_free                SSL_SESSION_FREE
+#define SSL_connect                     SSL_CONNECT
+#define SSL_free                        SSL_FREE
+#define SSL_get1_session                SSL_GET1_SESSION
+#define SSL_get_certificate             SSL_GET_CERTIFICATE
+#define SSL_get_current_cipher          SSL_GET_CURRENT_CIPHER
+#define SSL_get_error                   SSL_GET_ERROR
+#define SSL_get_peer_cert_chain         SSL_GET_PEER_CERT_CHAIN
+#define SSL_get_peer_certificate        SSL_GET_PEER_CERTIFICATE
+#define SSL_get_privatekey              SSL_GET_PRIVATEKEY
+#define SSL_get_session                 SSL_GET_SESSION
+#define SSL_get_shutdown                SSL_GET_SHUTDOWN
+#define SSL_get_verify_result           SSL_GET_VERIFY_RESULT
+#define SSL_library_init                SSL_LIBRARY_INIT
+#define SSL_load_error_strings          SSL_LOAD_ERROR_STRINGS
+#define SSL_new                         SSL_NEW
+#define SSL_peek                        SSL_PEEK
+#define SSL_pending                     SSL_PENDING
+#define SSL_read                        SSL_READ
+#define SSL_set_connect_state           SSL_SET_CONNECT_STATE
+#define SSL_set_fd                      SSL_SET_FD
+#define SSL_set_session                 SSL_SET_SESSION
+#define SSL_shutdown                    SSL_SHUTDOWN
+#define SSL_version                     SSL_VERSION
+#define SSL_write                       SSL_WRITE
+#define SSLeay                          SSLEAY
+#define SSLv23_client_method            SSLV23_CLIENT_METHOD
+#define SSLv3_client_method             SSLV3_CLIENT_METHOD
+#define TLSv1_client_method             TLSV1_CLIENT_METHOD
+#define UI_create_method                UI_CREATE_METHOD
+#define UI_destroy_method               UI_DESTROY_METHOD
+#define UI_get0_user_data               UI_GET0_USER_DATA
+#define UI_get_input_flags              UI_GET_INPUT_FLAGS
+#define UI_get_string_type              UI_GET_STRING_TYPE
+#define UI_create_method                UI_CREATE_METHOD
+#define UI_destroy_method               UI_DESTROY_METHOD
+#define UI_method_get_closer            UI_METHOD_GET_CLOSER
+#define UI_method_get_opener            UI_METHOD_GET_OPENER
+#define UI_method_get_reader            UI_METHOD_GET_READER
+#define UI_method_get_writer            UI_METHOD_GET_WRITER
+#define UI_method_set_closer            UI_METHOD_SET_CLOSER
+#define UI_method_set_opener            UI_METHOD_SET_OPENER
+#define UI_method_set_reader            UI_METHOD_SET_READER
+#define UI_method_set_writer            UI_METHOD_SET_WRITER
+#define UI_OpenSSL                      UI_OPENSSL
+#define UI_set_result                   UI_SET_RESULT
+#define X509V3_EXT_print                X509V3_EXT_PRINT
+#define X509_EXTENSION_get_critical     X509_EXTENSION_GET_CRITICAL
+#define X509_EXTENSION_get_data         X509_EXTENSION_GET_DATA
+#define X509_EXTENSION_get_object       X509_EXTENSION_GET_OBJECT
+#define X509_LOOKUP_file                X509_LOOKUP_FILE
+#define X509_NAME_ENTRY_get_data        X509_NAME_ENTRY_GET_DATA
+#define X509_NAME_get_entry             X509_NAME_GET_ENTRY
+#define X509_NAME_get_index_by_NID      X509_NAME_GET_INDEX_BY_NID
+#define X509_NAME_print_ex              X509_NAME_PRINT_EX
 #define X509_STORE_CTX_get_current_cert X509_STORE_CTX_GET_CURRENT_CERT
-#define X509_STORE_add_lookup X509_STORE_ADD_LOOKUP
-#define X509_STORE_set_flags X509_STORE_SET_FLAGS
-#define X509_check_issued X509_CHECK_ISSUED
-#define X509_free X509_FREE
-#define X509_get_ext_d2i X509_GET_EXT_D2I
-#define X509_get_issuer_name X509_GET_ISSUER_NAME
-#define X509_get_pubkey X509_GET_PUBKEY
-#define X509_get_serialNumber X509_GET_SERIALNUMBER
-#define X509_get_subject_name X509_GET_SUBJECT_NAME
-#define X509_load_crl_file X509_LOAD_CRL_FILE
-#define X509_verify_cert_error_string X509_VERIFY_CERT_ERROR_STRING
-#define d2i_PKCS12_fp D2I_PKCS12_FP
-#define i2t_ASN1_OBJECT I2T_ASN1_OBJECT
-#define sk_num SK_NUM
-#define sk_pop SK_POP
-#define sk_pop_free SK_POP_FREE
-#define sk_value SK_VALUE
-#ifdef __VAX
-#define OPENSSL_NO_SHA256
-#endif
-#define SHA256_Final SHA256_FINAL
-#define SHA256_Init SHA256_INIT
+#define X509_STORE_add_lookup           X509_STORE_ADD_LOOKUP
+#define X509_STORE_set_flags            X509_STORE_SET_FLAGS
+#define X509_check_issued               X509_CHECK_ISSUED
+#define X509_free                       X509_FREE
+#define X509_get_ext_d2i                X509_GET_EXT_D2I
+#define X509_get_issuer_name            X509_GET_ISSUER_NAME
+#define X509_get_pubkey                 X509_GET_PUBKEY
+#define X509_get_serialNumber           X509_GET_SERIALNUMBER
+#define X509_get_subject_name           X509_GET_SUBJECT_NAME
+#define X509_load_crl_file              X509_LOAD_CRL_FILE
+#define X509_verify_cert_error_string   X509_VERIFY_CERT_ERROR_STRING
+#define d2i_PKCS12_fp                   D2I_PKCS12_FP
+#define i2t_ASN1_OBJECT                 I2T_ASN1_OBJECT
+#define sk_num                          SK_NUM
+#define sk_pop                          SK_POP
+#define sk_pop_free                     SK_POP_FREE
+#define sk_value                        SK_VALUE
+#define SHA256_Final  SHA256_FINAL
+#define SHA256_Init   SHA256_INIT
 #define SHA256_Update SHA256_UPDATE
 
 #define USE_UPPERCASE_GSSAPI 1
-#define gss_seal GSS_SEAL
-#define gss_unseal GSS_UNSEAL
+#define gss_seal             GSS_SEAL
+#define gss_unseal           GSS_UNSEAL
 
 #define USE_UPPERCASE_KRBAPI 1
 
-/* AI_NUMERICHOST needed for IP V6 support in Curl */
+/* AI_NUMERICHOST needed for IP V6 support in curl */
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
 #ifndef AI_NUMERICHOST
-#ifdef ENABLE_IPV6
-#undef ENABLE_IPV6
-#endif
+#undef USE_IPV6
 #endif
 #endif
 
 /* VAX symbols are always in uppercase */
 #ifdef __VAX
-#define inflate INFLATE
-#define inflateEnd INFLATEEND
+#define inflate       INFLATE
+#define inflateEnd    INFLATEEND
 #define inflateInit2_ INFLATEINIT2_
-#define inflateInit_ INFLATEINIT_
-#define zlibVersion ZLIBVERSION
+#define inflateInit_  INFLATEINIT_
+#define zlibVersion   ZLIBVERSION
 #endif
 
 /* Older VAX OpenSSL port defines these as Macros */
@@ -394,51 +386,11 @@ static struct passwd *vms_getpwuid(uid_t uid)
 /* that way a newer port will also work if some one has one */
 #ifdef __VAX
 
-#   if (OPENSSL_VERSION_NUMBER < 0x00907001L)
-#       define des_set_odd_parity DES_SET_ODD_PARITY
-#       define des_set_key DES_SET_KEY
-#       define des_ecb_encrypt DES_ECB_ENCRYPT
-
-#   endif
-#   include <openssl/evp.h>
-#   ifndef OpenSSL_add_all_algorithms
-#       define OpenSSL_add_all_algorithms OPENSSL_ADD_ALL_ALGORITHMS
-        void OPENSSL_ADD_ALL_ALGORITHMS(void);
-#   endif
-
-    /* Curl defines these to lower case and VAX needs them in upper case */
-    /* So we need static routines */
-#   if (OPENSSL_VERSION_NUMBER < 0x00907001L)
-
-#       undef des_set_odd_parity
-#       undef DES_set_odd_parity
-#       undef des_set_key
-#       undef DES_set_key
-#       undef des_ecb_encrypt
-#       undef DES_ecb_encrypt
-
-        static void des_set_odd_parity(des_cblock *key) {
-            DES_SET_ODD_PARITY(key);
-        }
-
-        static int des_set_key(const_des_cblock *key,
-                               des_key_schedule schedule) {
-            return DES_SET_KEY(key, schedule);
-        }
-
-        static void des_ecb_encrypt(const_des_cblock *input,
-                                    des_cblock *output,
-                                    des_key_schedule ks, int enc) {
-            DES_ECB_ENCRYPT(input, output, ks, enc);
-        }
-#endif
-/* Need this to stop a macro redefinition error */
-#if OPENSSL_VERSION_NUMBER < 0x00907000L
-#   ifdef X509_STORE_set_flags
-#       undef X509_STORE_set_flags
-#       define X509_STORE_set_flags(x,y) Curl_nop_stmt
-#   endif
-#endif
+#  include <openssl/evp.h>
+#  ifndef OpenSSL_add_all_algorithms
+#    define OpenSSL_add_all_algorithms OPENSSL_ADD_ALL_ALGORITHMS
+     void OPENSSL_ADD_ALL_ALGORITHMS(void);
+#  endif
 #endif
 
 #endif /* HEADER_CURL_SETUP_VMS_H */
diff --git a/third-party/curl/lib/setup-win32.h b/third-party/curl/lib/setup-win32.h
index 13948389a4..6a89b966de 100644
--- a/third-party/curl/lib/setup-win32.h
+++ b/third-party/curl/lib/setup-win32.h
@@ -24,58 +24,63 @@
  *
  ***************************************************************************/
 
-/*
- * Include header files for windows builds before redefining anything.
- * Use this preprocessor block only to include or exclude windows.h,
- * winsock2.h or ws2tcpip.h. Any other windows thing belongs
- * to any other further and independent block.  Under Cygwin things work
- * just as under linux (e.g. <sys/socket.h>) and the winsock headers should
- * never be included when __CYGWIN__ is defined.  configure script takes
- * care of this, not defining HAVE_WINDOWS_H, HAVE_WINSOCK2_H,
- * neither HAVE_WS2TCPIP_H when __CYGWIN__ is defined.
- */
+#undef USE_WINSOCK
+/* ---------------------------------------------------------------- */
+/*                     Watt-32 TCP/IP SPECIFIC                      */
+/* ---------------------------------------------------------------- */
+#ifdef USE_WATT32
+#  include <tcp.h>
+#  include <sys/socket.h>
+#  undef byte
+#  undef word
+#  define HAVE_SYS_IOCTL_H
+#  define HAVE_NETINET_IN_H
+#  define HAVE_NETDB_H
+#  define HAVE_ARPA_INET_H
+#  define SOCKET int
+/* ---------------------------------------------------------------- */
+/*               BSD-style lwIP TCP/IP stack SPECIFIC               */
+/* ---------------------------------------------------------------- */
+#elif defined(USE_LWIPSOCK)
+  /* Define to use BSD-style lwIP TCP/IP stack. */
+  /* #define USE_LWIPSOCK 1 */
+#  undef HAVE_GETHOSTNAME
+#  define HAVE_GETHOSTBYNAME_R
+#  define HAVE_GETHOSTBYNAME_R_6
+#  undef LWIP_POSIX_SOCKETS_IO_NAMES
+#  define LWIP_POSIX_SOCKETS_IO_NAMES 0
+#  undef RECV_TYPE_ARG1
+#  define RECV_TYPE_ARG1 int
+#  undef RECV_TYPE_ARG3
+#  define RECV_TYPE_ARG3 size_t
+#  undef SEND_TYPE_ARG1
+#  define SEND_TYPE_ARG1 int
+#  undef SEND_TYPE_ARG3
+#  define SEND_TYPE_ARG3 size_t
+#elif defined(_WIN32)
+#  define USE_WINSOCK 2
+#  include <winsock2.h>
+#  include <ws2tcpip.h>
+#endif
 
-#ifdef HAVE_WINDOWS_H
+/*
+ * Include header files for Windows builds before redefining anything. Use
+ * this preprocessor block only to include or exclude windows.h, winsock2.h or
+ * ws2tcpip.h. Any other Windows thing belongs to any other further and
+ * independent block. Under Cygwin things work as under Linux (e.g.
+ * <sys/socket.h>) and the Winsock headers should never be included when
+ * __CYGWIN__ is defined.
+ */
+#ifdef _WIN32
 #  if defined(UNICODE) && !defined(_UNICODE)
 #    error "UNICODE is defined but _UNICODE is not defined"
 #  endif
 #  if defined(_UNICODE) && !defined(UNICODE)
 #    error "_UNICODE is defined but UNICODE is not defined"
 #  endif
-/*
- * Don't include unneeded stuff in Windows headers to avoid compiler
- * warnings and macro clashes.
- * Make sure to define this macro before including any Windows headers.
- */
-#  ifndef WIN32_LEAN_AND_MEAN
-#    define WIN32_LEAN_AND_MEAN
-#  endif
-#  ifndef NOGDI
-#    define NOGDI
-#  endif
-#  include <winerror.h>
 #  include <windows.h>
-#  ifdef HAVE_WINSOCK2_H
-#    include <winsock2.h>
-#    ifdef HAVE_WS2TCPIP_H
-#      include <ws2tcpip.h>
-#    endif
-#  endif
+#  include <winerror.h>
 #  include <tchar.h>
-#  ifdef UNICODE
-     typedef wchar_t *(*curl_wcsdup_callback)(const wchar_t *str);
-#  endif
-#endif
-
-/*
- * Define USE_WINSOCK to 2 if we have and use WINSOCK2 API, else
- * undefine USE_WINSOCK.
- */
-
-#undef USE_WINSOCK
-
-#ifdef HAVE_WINSOCK2_H
-#  define USE_WINSOCK 2
 #endif
 
 /*
@@ -83,31 +88,12 @@
  * those symbols to compare against, and even those that do may be missing
  * newer symbols.
  */
-
-#ifndef _WIN32_WINNT_NT4
-#define _WIN32_WINNT_NT4            0x0400   /* Windows NT 4.0 */
-#endif
-#ifndef _WIN32_WINNT_WIN2K
-#define _WIN32_WINNT_WIN2K          0x0500   /* Windows 2000 */
-#endif
-#ifndef _WIN32_WINNT_WINXP
-#define _WIN32_WINNT_WINXP          0x0501   /* Windows XP */
-#endif
-#ifndef _WIN32_WINNT_WS03
-#define _WIN32_WINNT_WS03           0x0502   /* Windows Server 2003 */
-#endif
-#ifndef _WIN32_WINNT_WIN6
-#define _WIN32_WINNT_WIN6           0x0600   /* Windows Vista */
-#endif
 #ifndef _WIN32_WINNT_VISTA
 #define _WIN32_WINNT_VISTA          0x0600   /* Windows Vista */
 #endif
 #ifndef _WIN32_WINNT_WS08
 #define _WIN32_WINNT_WS08           0x0600   /* Windows Server 2008 */
 #endif
-#ifndef _WIN32_WINNT_LONGHORN
-#define _WIN32_WINNT_LONGHORN       0x0600   /* Windows Vista */
-#endif
 #ifndef _WIN32_WINNT_WIN7
 #define _WIN32_WINNT_WIN7           0x0601   /* Windows 7 */
 #endif
@@ -117,9 +103,6 @@
 #ifndef _WIN32_WINNT_WINBLUE
 #define _WIN32_WINNT_WINBLUE        0x0603   /* Windows 8.1 */
 #endif
-#ifndef _WIN32_WINNT_WINTHRESHOLD
-#define _WIN32_WINNT_WINTHRESHOLD   0x0A00   /* Windows 10 */
-#endif
 #ifndef _WIN32_WINNT_WIN10
 #define _WIN32_WINNT_WIN10          0x0A00   /* Windows 10 */
 #endif
diff --git a/third-party/curl/lib/sha256.c b/third-party/curl/lib/sha256.c
index 4a02045d26..047119044b 100644
--- a/third-party/curl/lib/sha256.c
+++ b/third-party/curl/lib/sha256.c
@@ -22,91 +22,45 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#if !defined(CURL_DISABLE_AWS) || !defined(CURL_DISABLE_DIGEST_AUTH) \
-    || defined(USE_LIBSSH2)
+#if !defined(CURL_DISABLE_AWS) || !defined(CURL_DISABLE_DIGEST_AUTH) || \
+  defined(USE_LIBSSH2) || defined(USE_SSL)
 
-#include "warnless.h"
 #include "curl_sha256.h"
-#include "curl_hmac.h"
-
-#ifdef USE_WOLFSSL
-#include <wolfssl/options.h>
-#ifndef NO_SHA256
-#define USE_OPENSSL_SHA256
-#endif
-#endif
-
-#if defined(USE_OPENSSL)
-
-#include <openssl/opensslv.h>
-
-#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL)
-#define USE_OPENSSL_SHA256
-#endif
-
-#endif /* USE_OPENSSL */
 
 #ifdef USE_MBEDTLS
 #include <mbedtls/version.h>
-
-#if(MBEDTLS_VERSION_NUMBER >= 0x02070000) && \
-   (MBEDTLS_VERSION_NUMBER < 0x03000000)
-  #define HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS
+#if MBEDTLS_VERSION_NUMBER < 0x03020000
+#error "mbedTLS 3.2.0 or later required"
 #endif
-#endif /* USE_MBEDTLS */
-
-#if defined(USE_OPENSSL_SHA256)
-
-/* When OpenSSL or wolfSSL is available we use their SHA256-functions. */
-#if defined(USE_OPENSSL)
-#include <openssl/evp.h>
-#elif defined(USE_WOLFSSL)
-#include <wolfssl/openssl/evp.h>
+#include <psa/crypto_config.h>
 #endif
 
-#elif defined(USE_GNUTLS)
-#include <nettle/sha.h>
-#elif defined(USE_MBEDTLS)
-#include <mbedtls/sha256.h>
-#elif (defined(__MAC_OS_X_VERSION_MAX_ALLOWED) && \
-              (__MAC_OS_X_VERSION_MAX_ALLOWED >= 1040)) || \
-      (defined(__IPHONE_OS_VERSION_MAX_ALLOWED) && \
-              (__IPHONE_OS_VERSION_MAX_ALLOWED >= 20000))
-#include <CommonCrypto/CommonDigest.h>
-#define AN_APPLE_OS
-#elif defined(USE_WIN32_CRYPTO)
-#include <wincrypt.h>
-#endif
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
 /* Please keep the SSL backend-specific #if branches in this order:
  *
  * 1. USE_OPENSSL
- * 2. USE_GNUTLS
- * 3. USE_MBEDTLS
- * 4. USE_COMMON_CRYPTO
+ * 2. USE_WOLFSSL
+ * 3. USE_GNUTLS
+ * 4. USE_MBEDTLS
  * 5. USE_WIN32_CRYPTO
+ * 6. USE_COMMON_CRYPTO
  *
  * This ensures that the same SSL branch gets activated throughout this source
  * file even if multiple backends are enabled at the same time.
  */
 
-#if defined(USE_OPENSSL_SHA256)
+#ifdef USE_OPENSSL
+#include <openssl/evp.h>
 
-struct sha256_ctx {
+struct ossl_sha256_ctx {
   EVP_MD_CTX *openssl_ctx;
 };
-typedef struct sha256_ctx my_sha256_ctx;
+typedef struct ossl_sha256_ctx my_sha256_ctx;
 
-static CURLcode my_sha256_init(my_sha256_ctx *ctx)
+static CURLcode my_sha256_init(void *in)
 {
+  my_sha256_ctx *ctx = (my_sha256_ctx *)in;
   ctx->openssl_ctx = EVP_MD_CTX_create();
   if(!ctx->openssl_ctx)
     return CURLE_OUT_OF_MEMORY;
@@ -118,97 +72,130 @@ static CURLcode my_sha256_init(my_sha256_ctx *ctx)
   return CURLE_OK;
 }
 
-static void my_sha256_update(my_sha256_ctx *ctx,
+static void my_sha256_update(void *in,
                              const unsigned char *data,
                              unsigned int length)
 {
+  my_sha256_ctx *ctx = (my_sha256_ctx *)in;
   EVP_DigestUpdate(ctx->openssl_ctx, data, length);
 }
 
-static void my_sha256_final(unsigned char *digest, my_sha256_ctx *ctx)
+static void my_sha256_final(unsigned char *digest, void *in)
 {
+  my_sha256_ctx *ctx = (my_sha256_ctx *)in;
   EVP_DigestFinal_ex(ctx->openssl_ctx, digest, NULL);
   EVP_MD_CTX_destroy(ctx->openssl_ctx);
 }
 
+#elif defined(USE_WOLFSSL)
+#include <wolfssl/options.h>
+#include <wolfssl/wolfcrypt/sha256.h>
+
+typedef struct wc_Sha256 my_sha256_ctx;
+
+static CURLcode my_sha256_init(void *in)
+{
+  if(wc_InitSha256(in))
+    return CURLE_FAILED_INIT;
+  return CURLE_OK;
+}
+
+static void my_sha256_update(void *in,
+                             const unsigned char *data,
+                             unsigned int length)
+{
+  (void)wc_Sha256Update(in, data, (word32)length);
+}
+
+static void my_sha256_final(unsigned char *digest, void *in)
+{
+  (void)wc_Sha256Final(in, digest);
+}
+
 #elif defined(USE_GNUTLS)
+#include <nettle/sha2.h>
+#include <nettle/version.h>
 
 typedef struct sha256_ctx my_sha256_ctx;
 
-static CURLcode my_sha256_init(my_sha256_ctx *ctx)
+static CURLcode my_sha256_init(void *ctx)
 {
   sha256_init(ctx);
   return CURLE_OK;
 }
 
-static void my_sha256_update(my_sha256_ctx *ctx,
+static void my_sha256_update(void *ctx,
                              const unsigned char *data,
                              unsigned int length)
 {
   sha256_update(ctx, length, data);
 }
 
-static void my_sha256_final(unsigned char *digest, my_sha256_ctx *ctx)
+static void my_sha256_final(unsigned char *digest, void *ctx)
 {
+#if NETTLE_VERSION_MAJOR >= 4
+  sha256_digest(ctx, digest);
+#else
   sha256_digest(ctx, SHA256_DIGEST_SIZE, digest);
+#endif
 }
 
-#elif defined(USE_MBEDTLS)
+#elif defined(USE_MBEDTLS) && \
+  defined(PSA_WANT_ALG_SHA_256) && PSA_WANT_ALG_SHA_256
+#include <psa/crypto.h>
 
-typedef mbedtls_sha256_context my_sha256_ctx;
+typedef psa_hash_operation_t my_sha256_ctx;
 
-static CURLcode my_sha256_init(my_sha256_ctx *ctx)
+static CURLcode my_sha256_init(void *ctx)
 {
-#if !defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
-  (void) mbedtls_sha256_starts(ctx, 0);
-#else
-  (void) mbedtls_sha256_starts_ret(ctx, 0);
-#endif
+  memset(ctx, 0, sizeof(my_sha256_ctx));
+  if(psa_hash_setup(ctx, PSA_ALG_SHA_256) != PSA_SUCCESS)
+    return CURLE_OUT_OF_MEMORY;
   return CURLE_OK;
 }
 
-static void my_sha256_update(my_sha256_ctx *ctx,
+static void my_sha256_update(void *ctx,
                              const unsigned char *data,
                              unsigned int length)
 {
-#if !defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
-  (void) mbedtls_sha256_update(ctx, data, length);
-#else
-  (void) mbedtls_sha256_update_ret(ctx, data, length);
-#endif
+  (void)psa_hash_update(ctx, data, length);
 }
 
-static void my_sha256_final(unsigned char *digest, my_sha256_ctx *ctx)
+static void my_sha256_final(unsigned char *digest, void *ctx)
 {
-#if !defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
-  (void) mbedtls_sha256_finish(ctx, digest);
-#else
-  (void) mbedtls_sha256_finish_ret(ctx, digest);
-#endif
+  size_t actual_length;
+  (void)psa_hash_finish(ctx, digest, CURL_SHA256_DIGEST_LENGTH,
+                        &actual_length);
 }
 
-#elif defined(AN_APPLE_OS)
+#elif (defined(__MAC_OS_X_VERSION_MAX_ALLOWED) && \
+              (__MAC_OS_X_VERSION_MAX_ALLOWED >= 1040)) || \
+      (defined(__IPHONE_OS_VERSION_MAX_ALLOWED) && \
+              (__IPHONE_OS_VERSION_MAX_ALLOWED >= 20000))
+#include <CommonCrypto/CommonDigest.h>
+
 typedef CC_SHA256_CTX my_sha256_ctx;
 
-static CURLcode my_sha256_init(my_sha256_ctx *ctx)
+static CURLcode my_sha256_init(void *ctx)
 {
-  (void) CC_SHA256_Init(ctx);
+  (void)CC_SHA256_Init(ctx);
   return CURLE_OK;
 }
 
-static void my_sha256_update(my_sha256_ctx *ctx,
+static void my_sha256_update(void *ctx,
                              const unsigned char *data,
                              unsigned int length)
 {
-  (void) CC_SHA256_Update(ctx, data, length);
+  (void)CC_SHA256_Update(ctx, data, length);
 }
 
-static void my_sha256_final(unsigned char *digest, my_sha256_ctx *ctx)
+static void my_sha256_final(unsigned char *digest, void *ctx)
 {
-  (void) CC_SHA256_Final(digest, ctx);
+  (void)CC_SHA256_Final(digest, ctx);
 }
 
 #elif defined(USE_WIN32_CRYPTO)
+#include <wincrypt.h>
 
 struct sha256_ctx {
   HCRYPTPROV hCryptProv;
@@ -216,14 +203,11 @@ struct sha256_ctx {
 };
 typedef struct sha256_ctx my_sha256_ctx;
 
-#if !defined(CALG_SHA_256)
-#define CALG_SHA_256 0x0000800c
-#endif
-
-static CURLcode my_sha256_init(my_sha256_ctx *ctx)
+static CURLcode my_sha256_init(void *in)
 {
+  my_sha256_ctx *ctx = (my_sha256_ctx *)in;
   if(!CryptAcquireContext(&ctx->hCryptProv, NULL, NULL, PROV_RSA_AES,
-                         CRYPT_VERIFYCONTEXT | CRYPT_SILENT))
+                          CRYPT_VERIFYCONTEXT | CRYPT_SILENT))
     return CURLE_OUT_OF_MEMORY;
 
   if(!CryptCreateHash(ctx->hCryptProv, CALG_SHA_256, 0, 0, &ctx->hHash)) {
@@ -235,19 +219,21 @@ static CURLcode my_sha256_init(my_sha256_ctx *ctx)
   return CURLE_OK;
 }
 
-static void my_sha256_update(my_sha256_ctx *ctx,
+static void my_sha256_update(void *in,
                              const unsigned char *data,
                              unsigned int length)
 {
-  CryptHashData(ctx->hHash, (unsigned char *) data, length, 0);
+  my_sha256_ctx *ctx = (my_sha256_ctx *)in;
+  CryptHashData(ctx->hHash, (const BYTE *)data, length, 0);
 }
 
-static void my_sha256_final(unsigned char *digest, my_sha256_ctx *ctx)
+static void my_sha256_final(unsigned char *digest, void *in)
 {
+  my_sha256_ctx *ctx = (my_sha256_ctx *)in;
   unsigned long length = 0;
 
   CryptGetHashParam(ctx->hHash, HP_HASHVAL, NULL, &length, 0);
-  if(length == SHA256_DIGEST_LENGTH)
+  if(length == CURL_SHA256_DIGEST_LENGTH)
     CryptGetHashParam(ctx->hHash, HP_HASHVAL, digest, &length, 0);
 
   if(ctx->hHash)
@@ -261,53 +247,36 @@ static void my_sha256_final(unsigned char *digest, my_sha256_ctx *ctx)
 
 /* When no other crypto library is available we use this code segment */
 
-/* This is based on SHA256 implementation in LibTomCrypt that was released into
- * public domain by Tom St Denis. */
+/* This is based on the SHA256 implementation in LibTomCrypt that was released
+ * into public domain. */
 
-#define WPA_GET_BE32(a) ((((unsigned long)(a)[0]) << 24) | \
-                         (((unsigned long)(a)[1]) << 16) | \
-                         (((unsigned long)(a)[2]) <<  8) | \
-                          ((unsigned long)(a)[3]))
-#define WPA_PUT_BE32(a, val)                                        \
-do {                                                                \
-  (a)[0] = (unsigned char)((((unsigned long) (val)) >> 24) & 0xff); \
-  (a)[1] = (unsigned char)((((unsigned long) (val)) >> 16) & 0xff); \
-  (a)[2] = (unsigned char)((((unsigned long) (val)) >> 8) & 0xff);  \
-  (a)[3] = (unsigned char)(((unsigned long) (val)) & 0xff);         \
-} while(0)
+#define WPA_GET_BE32(a)              \
+  ((((unsigned long)(a)[0]) << 24) | \
+   (((unsigned long)(a)[1]) << 16) | \
+   (((unsigned long)(a)[2]) <<  8) | \
+    ((unsigned long)(a)[3]))
+#define WPA_PUT_BE32(a, val)                                         \
+  do {                                                               \
+    (a)[0] = (unsigned char)((((unsigned long)(val)) >> 24) & 0xff); \
+    (a)[1] = (unsigned char)((((unsigned long)(val)) >> 16) & 0xff); \
+    (a)[2] = (unsigned char)((((unsigned long)(val)) >>  8) & 0xff); \
+    (a)[3] = (unsigned char)(((unsigned long)(val)) & 0xff);         \
+  } while(0)
 
-#ifdef HAVE_LONGLONG
-#define WPA_PUT_BE64(a, val)                                    \
-do {                                                            \
-  (a)[0] = (unsigned char)(((unsigned long long)(val)) >> 56);  \
-  (a)[1] = (unsigned char)(((unsigned long long)(val)) >> 48);  \
-  (a)[2] = (unsigned char)(((unsigned long long)(val)) >> 40);  \
-  (a)[3] = (unsigned char)(((unsigned long long)(val)) >> 32);  \
-  (a)[4] = (unsigned char)(((unsigned long long)(val)) >> 24);  \
-  (a)[5] = (unsigned char)(((unsigned long long)(val)) >> 16);  \
-  (a)[6] = (unsigned char)(((unsigned long long)(val)) >> 8);   \
-  (a)[7] = (unsigned char)(((unsigned long long)(val)) & 0xff); \
-} while(0)
-#else
-#define WPA_PUT_BE64(a, val)                                  \
-do {                                                          \
-  (a)[0] = (unsigned char)(((unsigned __int64)(val)) >> 56);  \
-  (a)[1] = (unsigned char)(((unsigned __int64)(val)) >> 48);  \
-  (a)[2] = (unsigned char)(((unsigned __int64)(val)) >> 40);  \
-  (a)[3] = (unsigned char)(((unsigned __int64)(val)) >> 32);  \
-  (a)[4] = (unsigned char)(((unsigned __int64)(val)) >> 24);  \
-  (a)[5] = (unsigned char)(((unsigned __int64)(val)) >> 16);  \
-  (a)[6] = (unsigned char)(((unsigned __int64)(val)) >> 8);   \
-  (a)[7] = (unsigned char)(((unsigned __int64)(val)) & 0xff); \
-} while(0)
-#endif
+#define WPA_PUT_BE64(a, val)                            \
+  do {                                                  \
+    (a)[0] = (unsigned char)(((uint64_t)(val)) >> 56);  \
+    (a)[1] = (unsigned char)(((uint64_t)(val)) >> 48);  \
+    (a)[2] = (unsigned char)(((uint64_t)(val)) >> 40);  \
+    (a)[3] = (unsigned char)(((uint64_t)(val)) >> 32);  \
+    (a)[4] = (unsigned char)(((uint64_t)(val)) >> 24);  \
+    (a)[5] = (unsigned char)(((uint64_t)(val)) >> 16);  \
+    (a)[6] = (unsigned char)(((uint64_t)(val)) >>  8);  \
+    (a)[7] = (unsigned char)(((uint64_t)(val)) & 0xff); \
+  } while(0)
 
 struct sha256_state {
-#ifdef HAVE_LONGLONG
-  unsigned long long length;
-#else
-  unsigned __int64 length;
-#endif
+  uint64_t length;
   unsigned long state[8], curlen;
   unsigned char buf[64];
 };
@@ -332,20 +301,21 @@ static const unsigned long K[64] = {
 
 /* Various logical functions */
 #define RORc(x, y) \
-(((((unsigned long)(x) & 0xFFFFFFFFUL) >> (unsigned long)((y) & 31)) | \
-   ((unsigned long)(x) << (unsigned long)(32 - ((y) & 31)))) & 0xFFFFFFFFUL)
-#define Ch(x,y,z)   (z ^ (x & (y ^ z)))
-#define Maj(x,y,z)  (((x | y) & z) | (x & y))
-#define S(x, n)     RORc((x), (n))
-#define R(x, n)     (((x)&0xFFFFFFFFUL)>>(n))
-#define Sigma0(x)   (S(x, 2) ^ S(x, 13) ^ S(x, 22))
-#define Sigma1(x)   (S(x, 6) ^ S(x, 11) ^ S(x, 25))
-#define Gamma0(x)   (S(x, 7) ^ S(x, 18) ^ R(x, 3))
-#define Gamma1(x)   (S(x, 17) ^ S(x, 19) ^ R(x, 10))
+  (((((unsigned long)(x) & 0xFFFFFFFFUL) >> (unsigned long)((y) & 31)) | \
+     ((unsigned long)(x) << (unsigned long)(32 - ((y) & 31)))) & 0xFFFFFFFFUL)
 
-/* Compress 512-bits */
-static int sha256_compress(struct sha256_state *md,
-                           unsigned char *buf)
+#define Sha256_Ch(x, y, z)  (z ^ (x & (y ^ z)))
+#define Sha256_Maj(x, y, z) (((x | y) & z) | (x & y))
+#define Sha256_S(x, n)      RORc(x, n)
+#define Sha256_R(x, n)      (((x) & 0xFFFFFFFFUL) >> (n))
+
+#define Sigma0(x)         (Sha256_S(x, 2) ^ Sha256_S(x, 13) ^ Sha256_S(x, 22))
+#define Sigma1(x)         (Sha256_S(x, 6) ^ Sha256_S(x, 11) ^ Sha256_S(x, 25))
+#define Gamma0(x)         (Sha256_S(x, 7) ^ Sha256_S(x, 18) ^ Sha256_R(x, 3))
+#define Gamma1(x)         (Sha256_S(x, 17) ^ Sha256_S(x, 19) ^ Sha256_R(x, 10))
+
+/* Compress 512 bits */
+static int sha256_compress(struct sha256_state *md, const unsigned char *buf)
 {
   unsigned long S[8], W[64];
   int i;
@@ -354,29 +324,35 @@ static int sha256_compress(struct sha256_state *md,
   for(i = 0; i < 8; i++) {
     S[i] = md->state[i];
   }
-  /* copy the state into 512-bits into W[0..15] */
+  /* copy the state into 512 bits into W[0..15] */
   for(i = 0; i < 16; i++)
     W[i] = WPA_GET_BE32(buf + (4 * i));
   /* fill W[16..63] */
   for(i = 16; i < 64; i++) {
-    W[i] = Gamma1(W[i - 2]) + W[i - 7] + Gamma0(W[i - 15]) +
-      W[i - 16];
+    W[i] = Gamma1(W[i - 2]) + W[i - 7] + Gamma0(W[i - 15]) + W[i - 16];
   }
 
   /* Compress */
-#define RND(a,b,c,d,e,f,g,h,i)                                          \
-  do {                                                                  \
-    unsigned long t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i];       \
-    unsigned long t1 = Sigma0(a) + Maj(a, b, c);                        \
-    d += t0;                                                            \
-    h = t0 + t1;                                                        \
+#define RND(a, b, c, d, e, f, g, h, i)                                   \
+  do {                                                                   \
+    unsigned long t0 = h + Sigma1(e) + Sha256_Ch(e, f, g) + K[i] + W[i]; \
+    unsigned long t1 = Sigma0(a) + Sha256_Maj(a, b, c);                  \
+    d += t0;                                                             \
+    h = t0 + t1;                                                         \
   } while(0)
 
   for(i = 0; i < 64; ++i) {
     unsigned long t;
     RND(S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7], i);
-    t = S[7]; S[7] = S[6]; S[6] = S[5]; S[5] = S[4];
-    S[4] = S[3]; S[3] = S[2]; S[2] = S[1]; S[1] = S[0]; S[0] = t;
+    t = S[7];
+    S[7] = S[6];
+    S[6] = S[5];
+    S[5] = S[4];
+    S[4] = S[3];
+    S[3] = S[2];
+    S[2] = S[1];
+    S[1] = S[0];
+    S[0] = t;
   }
 
   /* Feedback */
@@ -388,8 +364,9 @@ static int sha256_compress(struct sha256_state *md,
 }
 
 /* Initialize the hash state */
-static CURLcode my_sha256_init(struct sha256_state *md)
+static CURLcode my_sha256_init(void *in)
 {
+  struct sha256_state *md = (struct sha256_state *)in;
   md->curlen = 0;
   md->length = 0;
   md->state[0] = 0x6A09E667UL;
@@ -409,41 +386,39 @@ static CURLcode my_sha256_init(struct sha256_state *md)
    @param md     The hash state
    @param in     The data to hash
    @param inlen  The length of the data (octets)
-   @return 0 if successful
 */
-static int my_sha256_update(struct sha256_state *md,
-                            const unsigned char *in,
-                            unsigned long inlen)
+static void my_sha256_update(void *ctx,
+                             const unsigned char *in,
+                             unsigned int len)
 {
+  unsigned long inlen = len;
   unsigned long n;
-
-#define block_size 64
+  struct sha256_state *md = (struct sha256_state *)ctx;
+#define CURL_SHA256_BLOCK_SIZE 64
   if(md->curlen > sizeof(md->buf))
-    return -1;
+    return;
   while(inlen > 0) {
-    if(md->curlen == 0 && inlen >= block_size) {
-      if(sha256_compress(md, (unsigned char *)in) < 0)
-        return -1;
-      md->length += block_size * 8;
-      in += block_size;
-      inlen -= block_size;
+    if(md->curlen == 0 && inlen >= CURL_SHA256_BLOCK_SIZE) {
+      if(sha256_compress(md, in) < 0)
+        return;
+      md->length += CURL_SHA256_BLOCK_SIZE * 8;
+      in += CURL_SHA256_BLOCK_SIZE;
+      inlen -= CURL_SHA256_BLOCK_SIZE;
     }
     else {
-      n = CURLMIN(inlen, (block_size - md->curlen));
+      n = CURLMIN(inlen, (CURL_SHA256_BLOCK_SIZE - md->curlen));
       memcpy(md->buf + md->curlen, in, n);
       md->curlen += n;
       in += n;
       inlen -= n;
-      if(md->curlen == block_size) {
+      if(md->curlen == CURL_SHA256_BLOCK_SIZE) {
         if(sha256_compress(md, md->buf) < 0)
-          return -1;
-        md->length += 8 * block_size;
+          return;
+        md->length += 8 * CURL_SHA256_BLOCK_SIZE;
         md->curlen = 0;
       }
     }
   }
-
-  return 0;
 }
 
 /*
@@ -452,13 +427,13 @@ static int my_sha256_update(struct sha256_state *md,
    @param out [out] The destination of the hash (32 bytes)
    @return 0 if successful
 */
-static int my_sha256_final(unsigned char *out,
-                           struct sha256_state *md)
+static void my_sha256_final(unsigned char *out, void *ctx)
 {
+  struct sha256_state *md = ctx;
   int i;
 
   if(md->curlen >= sizeof(md->buf))
-    return -1;
+    return;
 
   /* Increase the length of the message */
   md->length += md->curlen * 8;
@@ -467,12 +442,12 @@ static int my_sha256_final(unsigned char *out,
   md->buf[md->curlen++] = (unsigned char)0x80;
 
   /* If the length is currently above 56 bytes we append zeros
-   * then compress.  Then we can fall back to padding zeros and length
+   * then compress. Then we can fall back to padding zeros and length
    * encoding like normal.
    */
   if(md->curlen > 56) {
     while(md->curlen < 64) {
-      md->buf[md->curlen++] = (unsigned char)0;
+      md->buf[md->curlen++] = 0;
     }
     sha256_compress(md, md->buf);
     md->curlen = 0;
@@ -480,7 +455,7 @@ static int my_sha256_final(unsigned char *out,
 
   /* Pad up to 56 bytes of zeroes */
   while(md->curlen < 56) {
-    md->buf[md->curlen++] = (unsigned char)0;
+    md->buf[md->curlen++] = 0;
   }
 
   /* Store length */
@@ -490,8 +465,6 @@ static int my_sha256_final(unsigned char *out,
   /* Copy output */
   for(i = 0; i < 8; i++)
     WPA_PUT_BE32(out + (4 * i), md->state[i]);
-
-  return 0;
 }
 
 #endif /* CRYPTO LIBS */
@@ -510,36 +483,31 @@ static int my_sha256_final(unsigned char *out,
  * Returns CURLE_OK on success.
  */
 CURLcode Curl_sha256it(unsigned char *output, const unsigned char *input,
-                   const size_t length)
+                       size_t len)
 {
   CURLcode result;
   my_sha256_ctx ctx;
 
   result = my_sha256_init(&ctx);
   if(!result) {
-    my_sha256_update(&ctx, input, curlx_uztoui(length));
+    do {
+      unsigned int ilen = (unsigned int)CURLMIN(len, UINT_MAX);
+      my_sha256_update(&ctx, input, ilen);
+      len -= ilen;
+      input += ilen;
+    } while(len);
     my_sha256_final(output, &ctx);
   }
   return result;
 }
 
-
-const struct HMAC_params Curl_HMAC_SHA256[] = {
-  {
-    /* Hash initialization function. */
-    CURLX_FUNCTION_CAST(HMAC_hinit_func, my_sha256_init),
-    /* Hash update function. */
-    CURLX_FUNCTION_CAST(HMAC_hupdate_func, my_sha256_update),
-    /* Hash computation end function. */
-    CURLX_FUNCTION_CAST(HMAC_hfinal_func, my_sha256_final),
-    /* Size of hash context structure. */
-    sizeof(my_sha256_ctx),
-    /* Maximum key length. */
-    64,
-    /* Result size. */
-    32
-  }
+const struct HMAC_params Curl_HMAC_SHA256 = {
+  my_sha256_init,        /* Hash initialization function. */
+  my_sha256_update,      /* Hash update function. */
+  my_sha256_final,       /* Hash computation end function. */
+  sizeof(my_sha256_ctx), /* Size of hash context structure. */
+  64,                    /* Maximum key length. */
+  32                     /* Result size. */
 };
 
-
-#endif /* AWS, DIGEST, or libSSH2 */
+#endif /* AWS, DIGEST, or libssh2 */
diff --git a/third-party/curl/lib/share.c b/third-party/curl/lib/share.c
deleted file mode 100644
index c0a8d806f3..0000000000
--- a/third-party/curl/lib/share.c
+++ /dev/null
@@ -1,290 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#include <curl/curl.h>
-#include "urldata.h"
-#include "share.h"
-#include "psl.h"
-#include "vtls/vtls.h"
-#include "hsts.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-struct Curl_share *
-curl_share_init(void)
-{
-  struct Curl_share *share = calloc(1, sizeof(struct Curl_share));
-  if(share) {
-    share->magic = CURL_GOOD_SHARE;
-    share->specifier |= (1<<CURL_LOCK_DATA_SHARE);
-    Curl_init_dnscache(&share->hostcache, 23);
-  }
-
-  return share;
-}
-
-#undef curl_share_setopt
-CURLSHcode
-curl_share_setopt(struct Curl_share *share, CURLSHoption option, ...)
-{
-  va_list param;
-  int type;
-  curl_lock_function lockfunc;
-  curl_unlock_function unlockfunc;
-  void *ptr;
-  CURLSHcode res = CURLSHE_OK;
-
-  if(!GOOD_SHARE_HANDLE(share))
-    return CURLSHE_INVALID;
-
-  if(share->dirty)
-    /* don't allow setting options while one or more handles are already
-       using this share */
-    return CURLSHE_IN_USE;
-
-  va_start(param, option);
-
-  switch(option) {
-  case CURLSHOPT_SHARE:
-    /* this is a type this share will share */
-    type = va_arg(param, int);
-
-    switch(type) {
-    case CURL_LOCK_DATA_DNS:
-      break;
-
-    case CURL_LOCK_DATA_COOKIE:
-#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_COOKIES)
-      if(!share->cookies) {
-        share->cookies = Curl_cookie_init(NULL, NULL, NULL, TRUE);
-        if(!share->cookies)
-          res = CURLSHE_NOMEM;
-      }
-#else   /* CURL_DISABLE_HTTP */
-      res = CURLSHE_NOT_BUILT_IN;
-#endif
-      break;
-
-    case CURL_LOCK_DATA_HSTS:
-#ifndef CURL_DISABLE_HSTS
-      if(!share->hsts) {
-        share->hsts = Curl_hsts_init();
-        if(!share->hsts)
-          res = CURLSHE_NOMEM;
-      }
-#else   /* CURL_DISABLE_HSTS */
-      res = CURLSHE_NOT_BUILT_IN;
-#endif
-      break;
-
-    case CURL_LOCK_DATA_SSL_SESSION:
-#ifdef USE_SSL
-      if(!share->sslsession) {
-        share->max_ssl_sessions = 8;
-        share->sslsession = calloc(share->max_ssl_sessions,
-                                   sizeof(struct Curl_ssl_session));
-        share->sessionage = 0;
-        if(!share->sslsession)
-          res = CURLSHE_NOMEM;
-      }
-#else
-      res = CURLSHE_NOT_BUILT_IN;
-#endif
-      break;
-
-    case CURL_LOCK_DATA_CONNECT:
-      if(Curl_conncache_init(&share->conn_cache, 103))
-        res = CURLSHE_NOMEM;
-      break;
-
-    case CURL_LOCK_DATA_PSL:
-#ifndef USE_LIBPSL
-      res = CURLSHE_NOT_BUILT_IN;
-#endif
-      break;
-
-    default:
-      res = CURLSHE_BAD_OPTION;
-    }
-    if(!res)
-      share->specifier |= (1<<type);
-    break;
-
-  case CURLSHOPT_UNSHARE:
-    /* this is a type this share will no longer share */
-    type = va_arg(param, int);
-    share->specifier &= ~(1<<type);
-    switch(type) {
-    case CURL_LOCK_DATA_DNS:
-      break;
-
-    case CURL_LOCK_DATA_COOKIE:
-#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_COOKIES)
-      if(share->cookies) {
-        Curl_cookie_cleanup(share->cookies);
-        share->cookies = NULL;
-      }
-#else   /* CURL_DISABLE_HTTP */
-      res = CURLSHE_NOT_BUILT_IN;
-#endif
-      break;
-
-    case CURL_LOCK_DATA_HSTS:
-#ifndef CURL_DISABLE_HSTS
-      if(share->hsts) {
-        Curl_hsts_cleanup(&share->hsts);
-      }
-#else   /* CURL_DISABLE_HSTS */
-      res = CURLSHE_NOT_BUILT_IN;
-#endif
-      break;
-
-    case CURL_LOCK_DATA_SSL_SESSION:
-#ifdef USE_SSL
-      Curl_safefree(share->sslsession);
-#else
-      res = CURLSHE_NOT_BUILT_IN;
-#endif
-      break;
-
-    case CURL_LOCK_DATA_CONNECT:
-      break;
-
-    default:
-      res = CURLSHE_BAD_OPTION;
-      break;
-    }
-    break;
-
-  case CURLSHOPT_LOCKFUNC:
-    lockfunc = va_arg(param, curl_lock_function);
-    share->lockfunc = lockfunc;
-    break;
-
-  case CURLSHOPT_UNLOCKFUNC:
-    unlockfunc = va_arg(param, curl_unlock_function);
-    share->unlockfunc = unlockfunc;
-    break;
-
-  case CURLSHOPT_USERDATA:
-    ptr = va_arg(param, void *);
-    share->clientdata = ptr;
-    break;
-
-  default:
-    res = CURLSHE_BAD_OPTION;
-    break;
-  }
-
-  va_end(param);
-
-  return res;
-}
-
-CURLSHcode
-curl_share_cleanup(struct Curl_share *share)
-{
-  if(!GOOD_SHARE_HANDLE(share))
-    return CURLSHE_INVALID;
-
-  if(share->lockfunc)
-    share->lockfunc(NULL, CURL_LOCK_DATA_SHARE, CURL_LOCK_ACCESS_SINGLE,
-                    share->clientdata);
-
-  if(share->dirty) {
-    if(share->unlockfunc)
-      share->unlockfunc(NULL, CURL_LOCK_DATA_SHARE, share->clientdata);
-    return CURLSHE_IN_USE;
-  }
-
-  Curl_conncache_close_all_connections(&share->conn_cache);
-  Curl_conncache_destroy(&share->conn_cache);
-  Curl_hash_destroy(&share->hostcache);
-
-#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_COOKIES)
-  Curl_cookie_cleanup(share->cookies);
-#endif
-
-#ifndef CURL_DISABLE_HSTS
-  Curl_hsts_cleanup(&share->hsts);
-#endif
-
-#ifdef USE_SSL
-  if(share->sslsession) {
-    size_t i;
-    for(i = 0; i < share->max_ssl_sessions; i++)
-      Curl_ssl_kill_session(&(share->sslsession[i]));
-    free(share->sslsession);
-  }
-#endif
-
-  Curl_psl_destroy(&share->psl);
-
-  if(share->unlockfunc)
-    share->unlockfunc(NULL, CURL_LOCK_DATA_SHARE, share->clientdata);
-  share->magic = 0;
-  free(share);
-
-  return CURLSHE_OK;
-}
-
-
-CURLSHcode
-Curl_share_lock(struct Curl_easy *data, curl_lock_data type,
-                curl_lock_access accesstype)
-{
-  struct Curl_share *share = data->share;
-
-  if(!share)
-    return CURLSHE_INVALID;
-
-  if(share->specifier & (1<<type)) {
-    if(share->lockfunc) /* only call this if set! */
-      share->lockfunc(data, type, accesstype, share->clientdata);
-  }
-  /* else if we don't share this, pretend successful lock */
-
-  return CURLSHE_OK;
-}
-
-CURLSHcode
-Curl_share_unlock(struct Curl_easy *data, curl_lock_data type)
-{
-  struct Curl_share *share = data->share;
-
-  if(!share)
-    return CURLSHE_INVALID;
-
-  if(share->specifier & (1<<type)) {
-    if(share->unlockfunc) /* only call this if set! */
-      share->unlockfunc (data, type, share->clientdata);
-  }
-
-  return CURLSHE_OK;
-}
diff --git a/third-party/curl/lib/share.h b/third-party/curl/lib/share.h
deleted file mode 100644
index 7f55aac853..0000000000
--- a/third-party/curl/lib/share.h
+++ /dev/null
@@ -1,76 +0,0 @@
-#ifndef HEADER_CURL_SHARE_H
-#define HEADER_CURL_SHARE_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-#include <curl/curl.h>
-#include "cookie.h"
-#include "psl.h"
-#include "urldata.h"
-#include "conncache.h"
-
-/* SalfordC says "A structure member may not be volatile". Hence:
- */
-#ifdef __SALFORDC__
-#define CURL_VOLATILE
-#else
-#define CURL_VOLATILE volatile
-#endif
-
-#define CURL_GOOD_SHARE 0x7e117a1e
-#define GOOD_SHARE_HANDLE(x) ((x) && (x)->magic == CURL_GOOD_SHARE)
-
-/* this struct is libcurl-private, don't export details */
-struct Curl_share {
-  unsigned int magic; /* CURL_GOOD_SHARE */
-  unsigned int specifier;
-  CURL_VOLATILE unsigned int dirty;
-
-  curl_lock_function lockfunc;
-  curl_unlock_function unlockfunc;
-  void *clientdata;
-  struct conncache conn_cache;
-  struct Curl_hash hostcache;
-#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_COOKIES)
-  struct CookieInfo *cookies;
-#endif
-#ifdef USE_LIBPSL
-  struct PslCache psl;
-#endif
-#ifndef CURL_DISABLE_HSTS
-  struct hsts *hsts;
-#endif
-#ifdef USE_SSL
-  struct Curl_ssl_session *sslsession;
-  size_t max_ssl_sessions;
-  long sessionage;
-#endif
-};
-
-CURLSHcode Curl_share_lock(struct Curl_easy *, curl_lock_data,
-                           curl_lock_access);
-CURLSHcode Curl_share_unlock(struct Curl_easy *, curl_lock_data);
-
-#endif /* HEADER_CURL_SHARE_H */
diff --git a/third-party/curl/lib/sigpipe.h b/third-party/curl/lib/sigpipe.h
index 48761ad0fd..b489796953 100644
--- a/third-party/curl/lib/sigpipe.h
+++ b/third-party/curl/lib/sigpipe.h
@@ -25,24 +25,27 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
-#if defined(HAVE_SIGNAL_H) && defined(HAVE_SIGACTION) &&        \
-  (defined(USE_OPENSSL) || defined(USE_MBEDTLS) || defined(USE_WOLFSSL))
+#if defined(HAVE_SIGACTION) && !defined(USE_SO_NOSIGPIPE)
 #include <signal.h>
 
-struct sigpipe_ignore {
+struct Curl_sigpipe_ctx {
   struct sigaction old_pipe_act;
-  bool no_signal;
+  BIT(no_signal);
 };
 
-#define SIGPIPE_VARIABLE(x) struct sigpipe_ignore x
+static CURL_INLINE void sigpipe_init(struct Curl_sigpipe_ctx *ig)
+{
+  memset(ig, 0, sizeof(*ig));
+  ig->no_signal = TRUE;
+}
 
 /*
  * sigpipe_ignore() makes sure we ignore SIGPIPE while running libcurl
  * internals, and then sigpipe_restore() will restore the situation when we
  * return from libcurl again.
  */
-static void sigpipe_ignore(struct Curl_easy *data,
-                           struct sigpipe_ignore *ig)
+static CURL_INLINE void sigpipe_ignore(struct Curl_easy *data,
+                                       struct Curl_sigpipe_ctx *ig)
 {
   /* get a local copy of no_signal because the Curl_easy might not be
      around when we restore */
@@ -54,6 +57,10 @@ static void sigpipe_ignore(struct Curl_easy *data,
     action = ig->old_pipe_act;
     /* ignore this signal */
     action.sa_handler = SIG_IGN;
+#ifdef SA_SIGINFO
+    /* clear SA_SIGINFO flag since we are using sa_handler */
+    action.sa_flags &= ~SA_SIGINFO;
+#endif
     sigaction(SIGPIPE, &action, NULL);
   }
 }
@@ -63,18 +70,33 @@ static void sigpipe_ignore(struct Curl_easy *data,
  * and SIGPIPE handling. It MUST only be called after a corresponding
  * sigpipe_ignore() was used.
  */
-static void sigpipe_restore(struct sigpipe_ignore *ig)
+static CURL_INLINE void sigpipe_restore(struct Curl_sigpipe_ctx *ig)
 {
   if(!ig->no_signal)
     /* restore the outside state */
     sigaction(SIGPIPE, &ig->old_pipe_act, NULL);
 }
 
-#else
-/* for systems without sigaction */
-#define sigpipe_ignore(x,y) Curl_nop_stmt
-#define sigpipe_restore(x)  Curl_nop_stmt
-#define SIGPIPE_VARIABLE(x)
-#endif
+static CURL_INLINE void sigpipe_apply(struct Curl_easy *data,
+                                      struct Curl_sigpipe_ctx *ig)
+{
+  if(data && (data->set.no_signal != ig->no_signal)) {
+    sigpipe_restore(ig);
+    sigpipe_ignore(data, ig);
+  }
+}
+
+#else /* !HAVE_SIGACTION || USE_SO_NOSIGPIPE */
+/* for systems without sigaction or where SO_NOSIGPIPE is used. */
+#define sigpipe_ignore(x, y) do { (void)(x); (void)(y); } while(0)
+#define sigpipe_apply(x, y)  do { (void)(x); (void)(y); } while(0)
+#define sigpipe_init(x)      do { (void)(x); } while(0)
+#define sigpipe_restore(x)   do { (void)(x); } while(0)
+
+struct Curl_sigpipe_ctx {
+  bool dummy;
+};
+
+#endif /* else HAVE_SIGACTION && !USE_SO_NOSIGPIPE */
 
 #endif /* HEADER_CURL_SIGPIPE_H */
diff --git a/third-party/curl/lib/slist.c b/third-party/curl/lib/slist.c
index 366b247609..83fd2918c6 100644
--- a/third-party/curl/lib/slist.c
+++ b/third-party/curl/lib/slist.c
@@ -21,21 +21,14 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include <curl/curl.h>
-
 #include "slist.h"
 
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
-
 /* returns last node in linked list */
 static struct curl_slist *slist_get_last(struct curl_slist *list)
 {
-  struct curl_slist     *item;
+  struct curl_slist *item;
 
   /* if caller passed us a NULL, return now */
   if(!list)
@@ -58,19 +51,20 @@ static struct curl_slist *slist_get_last(struct curl_slist *list)
  * If an error occurs, NULL is returned and the string argument is NOT
  * released.
  */
-struct curl_slist *Curl_slist_append_nodup(struct curl_slist *list, char *data)
+struct curl_slist *Curl_slist_append_nodup(struct curl_slist *list,
+                                           const char *data)
 {
-  struct curl_slist     *last;
-  struct curl_slist     *new_item;
+  struct curl_slist *last;
+  struct curl_slist *new_item;
 
   DEBUGASSERT(data);
 
-  new_item = malloc(sizeof(struct curl_slist));
+  new_item = curlx_malloc(sizeof(struct curl_slist));
   if(!new_item)
     return NULL;
 
   new_item->next = NULL;
-  new_item->data = data;
+  new_item->data = CURL_UNCONST(data);
 
   /* if this is the first item, then new_item *is* the list */
   if(!list)
@@ -85,20 +79,19 @@ struct curl_slist *Curl_slist_append_nodup(struct curl_slist *list, char *data)
  * curl_slist_append() appends a string to the linked list. It always returns
  * the address of the first record, so that you can use this function as an
  * initialization function as well as an append function. If you find this
- * bothersome, then simply create a separate _init function and call it
+ * bothersome, then create a separate _init function and call it
  * appropriately from within the program.
  */
-struct curl_slist *curl_slist_append(struct curl_slist *list,
-                                     const char *data)
+struct curl_slist *curl_slist_append(struct curl_slist *list, const char *data)
 {
-  char *dupdata = strdup(data);
+  char *dupdata = curlx_strdup(data);
 
   if(!dupdata)
     return NULL;
 
   list = Curl_slist_append_nodup(list, dupdata);
   if(!list)
-    free(dupdata);
+    curlx_free(dupdata);
 
   return list;
 }
@@ -130,8 +123,8 @@ struct curl_slist *Curl_slist_duplicate(struct curl_slist *inlist)
 /* be nice and clean up resources */
 void curl_slist_free_all(struct curl_slist *list)
 {
-  struct curl_slist     *next;
-  struct curl_slist     *item;
+  struct curl_slist *next;
+  struct curl_slist *item;
 
   if(!list)
     return;
@@ -139,8 +132,8 @@ void curl_slist_free_all(struct curl_slist *list)
   item = list;
   do {
     next = item->next;
-    Curl_safefree(item->data);
-    free(item);
+    curlx_safefree(item->data);
+    curlx_free(item);
     item = next;
   } while(next);
 }
diff --git a/third-party/curl/lib/slist.h b/third-party/curl/lib/slist.h
index 9561fd0226..47a30824db 100644
--- a/third-party/curl/lib/slist.h
+++ b/third-party/curl/lib/slist.h
@@ -36,6 +36,6 @@ struct curl_slist *Curl_slist_duplicate(struct curl_slist *inlist);
  * it to the list.
  */
 struct curl_slist *Curl_slist_append_nodup(struct curl_slist *list,
-                                           char *data);
+                                           const char *data);
 
 #endif /* HEADER_CURL_SLIST_H */
diff --git a/third-party/curl/lib/smb.c b/third-party/curl/lib/smb.c
index afcc99de24..70af8d5970 100644
--- a/third-party/curl/lib/smb.c
+++ b/third-party/curl/lib/smb.c
@@ -22,31 +22,79 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+#include "urldata.h"
 
-#if !defined(CURL_DISABLE_SMB) && defined(USE_CURL_NTLM_CORE)
+#if defined(CURL_ENABLE_SMB) && defined(USE_CURL_NTLM_CORE)
 
-#ifdef WIN32
-#define getpid GetCurrentProcessId
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>  /* for htons() */
 #endif
 
 #include "smb.h"
-#include "urldata.h"
+#include "url.h"
 #include "sendf.h"
-#include "multiif.h"
+#include "curl_trc.h"
 #include "cfilters.h"
 #include "connect.h"
 #include "progress.h"
 #include "transfer.h"
-#include "vtls/vtls.h"
+#include "select.h"
 #include "curl_ntlm_core.h"
 #include "escape.h"
 #include "curl_endian.h"
+#include "curlx/strcopy.h"
 
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
+/* meta key for storing protocol meta at easy handle */
+#define CURL_META_SMB_EASY   "meta:proto:smb:easy"
+/* meta key for storing protocol meta at connection */
+#define CURL_META_SMB_CONN   "meta:proto:smb:conn"
+
+enum smb_conn_state {
+  SMB_NOT_CONNECTED = 0,
+  SMB_CONNECTING,
+  SMB_NEGOTIATE,
+  SMB_SETUP,
+  SMB_CONNECTED
+};
+
+/* SMB connection data, kept at connection */
+struct smb_conn {
+  enum smb_conn_state state;
+  const char *user;
+  char *domain;
+  char *share;
+  unsigned char challenge[8];
+  unsigned int session_key;
+  unsigned short uid;
+  char *recv_buf;
+  char *send_buf;
+  size_t upload_size;
+  size_t send_size;
+  size_t sent;
+  size_t got;
+};
+
+/* SMB request state */
+enum smb_req_state {
+  SMB_REQUESTING,
+  SMB_TREE_CONNECT,
+  SMB_OPEN,
+  SMB_DOWNLOAD,
+  SMB_UPLOAD,
+  SMB_CLOSE,
+  SMB_TREE_DISCONNECT,
+  SMB_DONE
+};
+
+/* SMB request data, kept at easy handle */
+struct smb_request {
+  enum smb_req_state state;
+  char *path;
+  unsigned short tid; /* Even if we connect to the same tree as another */
+  unsigned short fid; /* request, the tid will be different */
+  CURLcode result;
+};
 
 /*
  * Definitions for SMB protocol data structures
@@ -80,7 +128,7 @@
 
 #define SMB_FLAGS_CANONICAL_PATHNAMES 0x10
 #define SMB_FLAGS_CASELESS_PATHNAMES  0x08
-#define SMB_FLAGS2_UNICODE_STRINGS    0x8000
+/* #define SMB_FLAGS2_UNICODE_STRINGS    0x8000 */
 #define SMB_FLAGS2_IS_LONG_NAME       0x0040
 #define SMB_FLAGS2_KNOWS_LONG_NAME    0x0001
 
@@ -241,99 +289,17 @@ struct smb_tree_disconnect {
 #  pragma pack(pop)
 #endif
 
-/* Local API functions */
-static CURLcode smb_setup_connection(struct Curl_easy *data,
-                                     struct connectdata *conn);
-static CURLcode smb_connect(struct Curl_easy *data, bool *done);
-static CURLcode smb_connection_state(struct Curl_easy *data, bool *done);
-static CURLcode smb_do(struct Curl_easy *data, bool *done);
-static CURLcode smb_request_state(struct Curl_easy *data, bool *done);
-static CURLcode smb_disconnect(struct Curl_easy *data,
-                               struct connectdata *conn, bool dead);
-static int smb_getsock(struct Curl_easy *data, struct connectdata *conn,
-                       curl_socket_t *socks);
-static CURLcode smb_parse_url_path(struct Curl_easy *data,
-                                   struct connectdata *conn);
-
-/*
- * SMB handler interface
- */
-const struct Curl_handler Curl_handler_smb = {
-  "SMB",                                /* scheme */
-  smb_setup_connection,                 /* setup_connection */
-  smb_do,                               /* do_it */
-  ZERO_NULL,                            /* done */
-  ZERO_NULL,                            /* do_more */
-  smb_connect,                          /* connect_it */
-  smb_connection_state,                 /* connecting */
-  smb_request_state,                    /* doing */
-  smb_getsock,                          /* proto_getsock */
-  smb_getsock,                          /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  smb_disconnect,                       /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_SMB,                             /* defport */
-  CURLPROTO_SMB,                        /* protocol */
-  CURLPROTO_SMB,                        /* family */
-  PROTOPT_NONE                          /* flags */
-};
-
-#ifdef USE_SSL
-/*
- * SMBS handler interface
- */
-const struct Curl_handler Curl_handler_smbs = {
-  "SMBS",                               /* scheme */
-  smb_setup_connection,                 /* setup_connection */
-  smb_do,                               /* do_it */
-  ZERO_NULL,                            /* done */
-  ZERO_NULL,                            /* do_more */
-  smb_connect,                          /* connect_it */
-  smb_connection_state,                 /* connecting */
-  smb_request_state,                    /* doing */
-  smb_getsock,                          /* proto_getsock */
-  smb_getsock,                          /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  smb_disconnect,                       /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_SMBS,                            /* defport */
-  CURLPROTO_SMBS,                       /* protocol */
-  CURLPROTO_SMB,                        /* family */
-  PROTOPT_SSL                           /* flags */
-};
-#endif
-
 #define MAX_PAYLOAD_SIZE  0x8000
 #define MAX_MESSAGE_SIZE  (MAX_PAYLOAD_SIZE + 0x1000)
 #define CLIENTNAME        "curl"
 #define SERVICENAME       "?????"
 
-/* Append a string to an SMB message */
-#define MSGCAT(str)                             \
-  do {                                          \
-    strcpy(p, (str));                           \
-    p += strlen(str);                           \
-  } while(0)
-
-/* Append a null-terminated string to an SMB message */
-#define MSGCATNULL(str)                         \
-  do {                                          \
-    strcpy(p, (str));                           \
-    p += strlen(str) + 1;                       \
-  } while(0)
-
 /* SMB is mostly little endian */
 #if (defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__) || \
   defined(__OS400__)
 static unsigned short smb_swap16(unsigned short x)
 {
-  return (unsigned short) ((x << 8) | ((x >> 8) & 0xff));
+  return (unsigned short)((x << 8) | ((x >> 8) & 0xff));
 }
 
 static unsigned int smb_swap32(unsigned int x)
@@ -344,8 +310,8 @@ static unsigned int smb_swap32(unsigned int x)
 
 static curl_off_t smb_swap64(curl_off_t x)
 {
-  return ((curl_off_t) smb_swap32((unsigned int) x) << 32) |
-    smb_swap32((unsigned int) (x >> 32));
+  return ((curl_off_t)smb_swap32((unsigned int)x) << 32) |
+    smb_swap32((unsigned int)(x >> 32));
 }
 
 #else
@@ -354,31 +320,10 @@ static curl_off_t smb_swap64(curl_off_t x)
 #  define smb_swap64(x) (x)
 #endif
 
-/* SMB request state */
-enum smb_req_state {
-  SMB_REQUESTING,
-  SMB_TREE_CONNECT,
-  SMB_OPEN,
-  SMB_DOWNLOAD,
-  SMB_UPLOAD,
-  SMB_CLOSE,
-  SMB_TREE_DISCONNECT,
-  SMB_DONE
-};
-
-/* SMB request data */
-struct smb_request {
-  enum smb_req_state state;
-  char *path;
-  unsigned short tid; /* Even if we connect to the same tree as another */
-  unsigned short fid; /* request, the tid will be different */
-  CURLcode result;
-};
-
-static void conn_state(struct Curl_easy *data, enum smb_conn_state newstate)
+static void conn_state(struct Curl_easy *data, struct smb_conn *smbc,
+                       enum smb_conn_state newstate)
 {
-  struct smb_conn *smbc = &data->conn->proto.smbc;
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
   /* For debug purposes */
   static const char * const names[] = {
     "SMB_NOT_CONNECTED",
@@ -392,35 +337,106 @@ static void conn_state(struct Curl_easy *data, enum smb_conn_state newstate)
   if(smbc->state != newstate)
     infof(data, "SMB conn %p state change from %s to %s",
           (void *)smbc, names[smbc->state], names[newstate]);
+#else
+  (void)data;
 #endif
-
   smbc->state = newstate;
 }
 
 static void request_state(struct Curl_easy *data,
                           enum smb_req_state newstate)
 {
-  struct smb_request *req = data->req.p.smb;
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
-  /* For debug purposes */
-  static const char * const names[] = {
-    "SMB_REQUESTING",
-    "SMB_TREE_CONNECT",
-    "SMB_OPEN",
-    "SMB_DOWNLOAD",
-    "SMB_UPLOAD",
-    "SMB_CLOSE",
-    "SMB_TREE_DISCONNECT",
-    "SMB_DONE",
-    /* LAST */
-  };
+  struct smb_request *req = Curl_meta_get(data, CURL_META_SMB_EASY);
+  if(req) {
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
+    /* For debug purposes */
+    static const char * const names[] = {
+      "SMB_REQUESTING",
+      "SMB_TREE_CONNECT",
+      "SMB_OPEN",
+      "SMB_DOWNLOAD",
+      "SMB_UPLOAD",
+      "SMB_CLOSE",
+      "SMB_TREE_DISCONNECT",
+      "SMB_DONE",
+      /* LAST */
+    };
 
-  if(req->state != newstate)
-    infof(data, "SMB request %p state change from %s to %s",
-          (void *)req, names[req->state], names[newstate]);
+    if(req->state != newstate)
+      infof(data, "SMB request %p state change from %s to %s",
+            (void *)req, names[req->state], names[newstate]);
 #endif
 
-  req->state = newstate;
+    req->state = newstate;
+  }
+}
+
+static void smb_easy_dtor(void *key, size_t klen, void *entry)
+{
+  struct smb_request *req = entry;
+  (void)key;
+  (void)klen;
+  curlx_safefree(req->path);
+  curlx_free(req);
+}
+
+static void smb_conn_dtor(void *key, size_t klen, void *entry)
+{
+  struct smb_conn *smbc = entry;
+  (void)key;
+  (void)klen;
+  curlx_safefree(smbc->share);
+  curlx_safefree(smbc->domain);
+  curlx_safefree(smbc->recv_buf);
+  curlx_safefree(smbc->send_buf);
+  curlx_free(smbc);
+}
+
+static CURLcode smb_parse_url_path(struct Curl_easy *data,
+                                   struct smb_conn *smbc,
+                                   struct smb_request *req)
+{
+  char *path;
+  char *slash, *s;
+  CURLcode result;
+
+  /* URL decode the path */
+  result = Curl_urldecode(data->state.up.path, 0, &path, NULL, REJECT_CTRL);
+  if(result)
+    return result;
+
+  /* Parse the path for the share */
+  curlx_safefree(smbc->share);
+  smbc->share = curlx_strdup((*path == '/' || *path == '\\')
+                             ? path + 1 : path);
+  curlx_free(path);
+  if(!smbc->share)
+    return CURLE_OUT_OF_MEMORY;
+
+  slash = strchr(smbc->share, '/');
+  if(!slash)
+    slash = strchr(smbc->share, '\\');
+
+  /* The share must be present */
+  if(!slash) {
+    curlx_safefree(smbc->share);
+    failf(data, "missing share in URL path for SMB");
+    return CURLE_URL_MALFORMAT;
+  }
+
+  /* Parse the path for the file path converting any forward slashes into
+     backslashes */
+  *slash++ = 0;
+  for(s = slash; *s; s++) {
+    if(*s == '/')
+      *s = '\\';
+  }
+  /* keep a copy at easy struct to not share this with connection state */
+  req->path = curlx_strdup(slash);
+  if(!req->path)
+    return CURLE_OUT_OF_MEMORY;
+
+  return CURLE_OK;
 }
 
 /* this should setup things in the connection, not in the easy
@@ -428,53 +444,64 @@ static void request_state(struct Curl_easy *data,
 static CURLcode smb_setup_connection(struct Curl_easy *data,
                                      struct connectdata *conn)
 {
+  struct smb_conn *smbc;
   struct smb_request *req;
 
+  /* Initialize the connection state */
+  smbc = curlx_calloc(1, sizeof(*smbc));
+  if(!smbc ||
+     Curl_conn_meta_set(conn, CURL_META_SMB_CONN, smbc, smb_conn_dtor))
+    return CURLE_OUT_OF_MEMORY;
+
   /* Initialize the request state */
-  data->req.p.smb = req = calloc(1, sizeof(struct smb_request));
-  if(!req)
+  req = curlx_calloc(1, sizeof(*req));
+  if(!req ||
+     Curl_meta_set(data, CURL_META_SMB_EASY, req, smb_easy_dtor))
     return CURLE_OUT_OF_MEMORY;
 
   /* Parse the URL path */
-  return smb_parse_url_path(data, conn);
+  return smb_parse_url_path(data, smbc, req);
 }
 
 static CURLcode smb_connect(struct Curl_easy *data, bool *done)
 {
   struct connectdata *conn = data->conn;
-  struct smb_conn *smbc = &conn->proto.smbc;
-  char *slash;
+  struct smb_conn *smbc = Curl_conn_meta_get(conn, CURL_META_SMB_CONN);
+  const char *slash;
+  const char *user = Curl_creds_user(conn->creds);
 
-  (void) done;
+  (void)done;
+  if(!smbc)
+    return CURLE_FAILED_INIT;
 
   /* Check we have a username and password to authenticate with */
-  if(!data->state.aptr.user)
+  if(!Curl_creds_has_user(data->state.creds))
     return CURLE_LOGIN_DENIED;
 
   /* Initialize the connection state */
   smbc->state = SMB_CONNECTING;
-  smbc->recv_buf = malloc(MAX_MESSAGE_SIZE);
+  smbc->recv_buf = curlx_malloc(MAX_MESSAGE_SIZE);
   if(!smbc->recv_buf)
     return CURLE_OUT_OF_MEMORY;
-
-  /* Multiple requests are allowed with this connection */
-  connkeep(conn, "SMB default");
+  smbc->send_buf = curlx_malloc(MAX_MESSAGE_SIZE);
+  if(!smbc->send_buf)
+    return CURLE_OUT_OF_MEMORY;
 
   /* Parse the username, domain, and password */
-  slash = strchr(conn->user, '/');
+  slash = strchr(user, '/');
   if(!slash)
-    slash = strchr(conn->user, '\\');
+    slash = strchr(user, '\\');
 
   if(slash) {
     smbc->user = slash + 1;
-    smbc->domain = strdup(conn->user);
+    smbc->domain = curlx_strdup(user);
     if(!smbc->domain)
       return CURLE_OUT_OF_MEMORY;
-    smbc->domain[slash - conn->user] = 0;
+    smbc->domain[slash - user] = 0;
   }
   else {
-    smbc->user = conn->user;
-    smbc->domain = strdup(conn->host.name);
+    smbc->user = user;
+    smbc->domain = curlx_strdup(conn->origin->hostname);
     if(!smbc->domain)
       return CURLE_OUT_OF_MEMORY;
   }
@@ -482,19 +509,18 @@ static CURLcode smb_connect(struct Curl_easy *data, bool *done)
   return CURLE_OK;
 }
 
-static CURLcode smb_recv_message(struct Curl_easy *data, void **msg)
+static CURLcode smb_recv_message(struct Curl_easy *data,
+                                 struct smb_conn *smbc,
+                                 void **msg)
 {
-  struct connectdata *conn = data->conn;
-  curl_socket_t sockfd = conn->sock[FIRSTSOCKET];
-  struct smb_conn *smbc = &conn->proto.smbc;
   char *buf = smbc->recv_buf;
-  ssize_t bytes_read;
+  size_t bytes_read;
   size_t nbt_size;
-  size_t msg_size;
+  size_t msg_size = sizeof(struct smb_header);
   size_t len = MAX_MESSAGE_SIZE - smbc->got;
   CURLcode result;
 
-  result = Curl_read(data, sockfd, buf + smbc->got, len, &bytes_read);
+  result = Curl_xfer_recv(data, buf + smbc->got, len, &bytes_read);
   if(result)
     return result;
 
@@ -510,19 +536,28 @@ static CURLcode smb_recv_message(struct Curl_easy *data, void **msg)
   nbt_size = Curl_read16_be((const unsigned char *)
                             (buf + sizeof(unsigned short))) +
     sizeof(unsigned int);
+  if(nbt_size > MAX_MESSAGE_SIZE) {
+    failf(data, "too large NetBIOS frame size %zu", nbt_size);
+    return CURLE_RECV_ERROR;
+  }
+  else if(nbt_size < msg_size) {
+    /* Each SMB message must be at least this large, e.g. 32 bytes */
+    failf(data, "too small NetBIOS frame size %zu", nbt_size);
+    return CURLE_RECV_ERROR;
+  }
+
   if(smbc->got < nbt_size)
     return CURLE_OK;
 
-  msg_size = sizeof(struct smb_header);
   if(nbt_size >= msg_size + 1) {
     /* Add the word count */
-    msg_size += 1 + ((unsigned char) buf[msg_size]) * sizeof(unsigned short);
+    msg_size += 1 + (((unsigned char)buf[msg_size]) * sizeof(unsigned short));
     if(nbt_size >= msg_size + sizeof(unsigned short)) {
       /* Add the byte count */
       msg_size += sizeof(unsigned short) +
         Curl_read16_le((const unsigned char *)&buf[msg_size]);
       if(nbt_size < msg_size)
-        return CURLE_READ_ERROR;
+        return CURLE_RECV_ERROR;
     }
   }
 
@@ -531,45 +566,38 @@ static CURLcode smb_recv_message(struct Curl_easy *data, void **msg)
   return CURLE_OK;
 }
 
-static void smb_pop_message(struct connectdata *conn)
+static void smb_pop_message(struct smb_conn *smbc)
 {
-  struct smb_conn *smbc = &conn->proto.smbc;
-
   smbc->got = 0;
 }
 
-static void smb_format_message(struct Curl_easy *data, struct smb_header *h,
+static void smb_format_message(struct smb_conn *smbc,
+                               struct smb_request *req,
+                               struct smb_header *h,
                                unsigned char cmd, size_t len)
 {
-  struct connectdata *conn = data->conn;
-  struct smb_conn *smbc = &conn->proto.smbc;
-  struct smb_request *req = data->req.p.smb;
-  unsigned int pid;
+  const unsigned int pid = 0xbad71d; /* made up */
 
   memset(h, 0, sizeof(*h));
-  h->nbt_length = htons((unsigned short) (sizeof(*h) - sizeof(unsigned int) +
-                                          len));
+  h->nbt_length = htons((unsigned short)(sizeof(*h) - sizeof(unsigned int) +
+                                         len));
   memcpy((char *)h->magic, "\xffSMB", 4);
   h->command = cmd;
   h->flags = SMB_FLAGS_CANONICAL_PATHNAMES | SMB_FLAGS_CASELESS_PATHNAMES;
   h->flags2 = smb_swap16(SMB_FLAGS2_IS_LONG_NAME | SMB_FLAGS2_KNOWS_LONG_NAME);
   h->uid = smb_swap16(smbc->uid);
   h->tid = smb_swap16(req->tid);
-  pid = getpid();
   h->pid_high = smb_swap16((unsigned short)(pid >> 16));
-  h->pid = smb_swap16((unsigned short) pid);
+  h->pid = smb_swap16((unsigned short)pid);
 }
 
-static CURLcode smb_send(struct Curl_easy *data, ssize_t len,
-                         size_t upload_size)
+static CURLcode smb_send(struct Curl_easy *data, struct smb_conn *smbc,
+                         size_t len, size_t upload_size)
 {
-  struct connectdata *conn = data->conn;
-  struct smb_conn *smbc = &conn->proto.smbc;
-  ssize_t bytes_written;
+  size_t bytes_written;
   CURLcode result;
 
-  result = Curl_nwrite(data, FIRSTSOCKET, data->state.ulbuf,
-                      len, &bytes_written);
+  result = Curl_xfer_send(data, smbc->send_buf, len, FALSE, &bytes_written);
   if(result)
     return result;
 
@@ -583,20 +611,17 @@ static CURLcode smb_send(struct Curl_easy *data, ssize_t len,
   return CURLE_OK;
 }
 
-static CURLcode smb_flush(struct Curl_easy *data)
+static CURLcode smb_flush(struct Curl_easy *data, struct smb_conn *smbc)
 {
-  struct connectdata *conn = data->conn;
-  struct smb_conn *smbc = &conn->proto.smbc;
-  ssize_t bytes_written;
-  ssize_t len = smbc->send_size - smbc->sent;
+  size_t bytes_written;
+  size_t len = smbc->send_size - smbc->sent;
   CURLcode result;
 
   if(!smbc->send_size)
     return CURLE_OK;
 
-  result = Curl_nwrite(data, FIRSTSOCKET,
-                       data->state.ulbuf + smbc->sent,
-                       len, &bytes_written);
+  result = Curl_xfer_send(data, smbc->send_buf + smbc->sent, len, FALSE,
+                          &bytes_written);
   if(result)
     return result;
 
@@ -608,50 +633,61 @@ static CURLcode smb_flush(struct Curl_easy *data)
   return CURLE_OK;
 }
 
-static CURLcode smb_send_message(struct Curl_easy *data, unsigned char cmd,
+static CURLcode smb_send_message(struct Curl_easy *data,
+                                 struct smb_conn *smbc,
+                                 struct smb_request *req,
+                                 unsigned char cmd,
                                  const void *msg, size_t msg_len)
 {
-  CURLcode result = Curl_get_upload_buffer(data);
-  if(result)
-    return result;
-  smb_format_message(data, (struct smb_header *)data->state.ulbuf,
+  if((MAX_MESSAGE_SIZE - sizeof(struct smb_header)) < msg_len) {
+    DEBUGASSERT(0);
+    return CURLE_SEND_ERROR;
+  }
+  smb_format_message(smbc, req, (struct smb_header *)smbc->send_buf,
                      cmd, msg_len);
-  memcpy(data->state.ulbuf + sizeof(struct smb_header),
-         msg, msg_len);
+  memcpy(smbc->send_buf + sizeof(struct smb_header), msg, msg_len);
 
-  return smb_send(data, sizeof(struct smb_header) + msg_len, 0);
+  return smb_send(data, smbc, sizeof(struct smb_header) + msg_len, 0);
 }
 
-static CURLcode smb_send_negotiate(struct Curl_easy *data)
+static CURLcode smb_send_negotiate(struct Curl_easy *data,
+                                   struct smb_conn *smbc,
+                                   struct smb_request *req)
 {
   const char *msg = "\x00\x0c\x00\x02NT LM 0.12";
 
-  return smb_send_message(data, SMB_COM_NEGOTIATE, msg, 15);
+  return smb_send_message(data, smbc, req, SMB_COM_NEGOTIATE, msg, 15);
 }
 
 static CURLcode smb_send_setup(struct Curl_easy *data)
 {
   struct connectdata *conn = data->conn;
-  struct smb_conn *smbc = &conn->proto.smbc;
+  struct smb_conn *smbc = Curl_conn_meta_get(conn, CURL_META_SMB_CONN);
+  struct smb_request *req = Curl_meta_get(data, CURL_META_SMB_EASY);
   struct smb_setup msg;
   char *p = msg.bytes;
   unsigned char lm_hash[21];
   unsigned char lm[24];
   unsigned char nt_hash[21];
   unsigned char nt[24];
+  size_t byte_count;
+  const char *passwd = Curl_creds_passwd(conn->creds);
 
-  size_t byte_count = sizeof(lm) + sizeof(nt);
-  byte_count += strlen(smbc->user) + strlen(smbc->domain);
-  byte_count += strlen(OS) + strlen(CLIENTNAME) + 4; /* 4 null chars */
+  if(!smbc || !req)
+    return CURLE_FAILED_INIT;
+
+  byte_count = sizeof(lm) + sizeof(nt) +
+    strlen(smbc->user) + strlen(smbc->domain) +
+    strlen(CURL_OS) + strlen(CLIENTNAME) + 4; /* 4 null chars */
   if(byte_count > sizeof(msg.bytes))
     return CURLE_FILESIZE_EXCEEDED;
 
-  Curl_ntlm_core_mk_lm_hash(conn->passwd, lm_hash);
+  Curl_ntlm_core_mk_lm_hash(passwd, lm_hash);
   Curl_ntlm_core_lm_resp(lm_hash, smbc->challenge, lm);
-  Curl_ntlm_core_mk_nt_hash(conn->passwd, nt_hash);
+  Curl_ntlm_core_mk_nt_hash(passwd, nt_hash);
   Curl_ntlm_core_lm_resp(nt_hash, smbc->challenge, nt);
 
-  memset(&msg, 0, sizeof(msg));
+  memset(&msg, 0, sizeof(msg) - sizeof(msg.bytes));
   msg.word_count = SMB_WC_SETUP_ANDX;
   msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
   msg.max_buffer_size = smb_swap16(MAX_MESSAGE_SIZE);
@@ -665,59 +701,66 @@ static CURLcode smb_send_setup(struct Curl_easy *data)
   p += sizeof(lm);
   memcpy(p, nt, sizeof(nt));
   p += sizeof(nt);
-  MSGCATNULL(smbc->user);
-  MSGCATNULL(smbc->domain);
-  MSGCATNULL(OS);
-  MSGCATNULL(CLIENTNAME);
-  byte_count = p - msg.bytes;
+  p += curl_msnprintf(p, byte_count - sizeof(nt) - sizeof(lm),
+                      "%s%c"  /* user */
+                      "%s%c"  /* domain */
+                      "%s%c"  /* OS */
+                      "%s", /* client name */
+                      smbc->user, 0, smbc->domain, 0, CURL_OS, 0, CLIENTNAME);
+  p++; /* count the final null-termination */
+  DEBUGASSERT(byte_count == (size_t)(p - msg.bytes));
   msg.byte_count = smb_swap16((unsigned short)byte_count);
 
-  return smb_send_message(data, SMB_COM_SETUP_ANDX, &msg,
+  return smb_send_message(data, smbc, req, SMB_COM_SETUP_ANDX, &msg,
                           sizeof(msg) - sizeof(msg.bytes) + byte_count);
 }
 
-static CURLcode smb_send_tree_connect(struct Curl_easy *data)
+static CURLcode smb_send_tree_connect(struct Curl_easy *data,
+                                      struct smb_conn *smbc,
+                                      struct smb_request *req)
 {
   struct smb_tree_connect msg;
   struct connectdata *conn = data->conn;
-  struct smb_conn *smbc = &conn->proto.smbc;
   char *p = msg.bytes;
+  const size_t byte_count = strlen(conn->origin->hostname) +
+    strlen(smbc->share) +
+    strlen(SERVICENAME) + 5; /* 2 nulls and 3 backslashes */
 
-  size_t byte_count = strlen(conn->host.name) + strlen(smbc->share);
-  byte_count += strlen(SERVICENAME) + 5; /* 2 nulls and 3 backslashes */
   if(byte_count > sizeof(msg.bytes))
     return CURLE_FILESIZE_EXCEEDED;
 
-  memset(&msg, 0, sizeof(msg));
+  memset(&msg, 0, sizeof(msg) - sizeof(msg.bytes));
   msg.word_count = SMB_WC_TREE_CONNECT_ANDX;
   msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
   msg.pw_len = 0;
-  MSGCAT("\\\\");
-  MSGCAT(conn->host.name);
-  MSGCAT("\\");
-  MSGCATNULL(smbc->share);
-  MSGCATNULL(SERVICENAME); /* Match any type of service */
-  byte_count = p - msg.bytes;
+
+  p += curl_msnprintf(p, byte_count,
+                      "\\\\%s\\"  /* hostname */
+                      "%s%c"      /* share */
+                      "%s",       /* service */
+                      conn->origin->hostname, smbc->share, 0, SERVICENAME);
+  p++; /* count the final null-termination */
+  DEBUGASSERT(byte_count == (size_t)(p - msg.bytes));
   msg.byte_count = smb_swap16((unsigned short)byte_count);
 
-  return smb_send_message(data, SMB_COM_TREE_CONNECT_ANDX, &msg,
+  return smb_send_message(data, smbc, req, SMB_COM_TREE_CONNECT_ANDX, &msg,
                           sizeof(msg) - sizeof(msg.bytes) + byte_count);
 }
 
-static CURLcode smb_send_open(struct Curl_easy *data)
+static CURLcode smb_send_open(struct Curl_easy *data,
+                              struct smb_conn *smbc,
+                              struct smb_request *req)
 {
-  struct smb_request *req = data->req.p.smb;
   struct smb_nt_create msg;
-  size_t byte_count;
+  const size_t byte_count = strlen(req->path) + 1;
 
-  if((strlen(req->path) + 1) > sizeof(msg.bytes))
+  if(byte_count > sizeof(msg.bytes))
     return CURLE_FILESIZE_EXCEEDED;
 
-  memset(&msg, 0, sizeof(msg));
+  memset(&msg, 0, sizeof(msg) - sizeof(msg.bytes));
   msg.word_count = SMB_WC_NT_CREATE_ANDX;
   msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
-  byte_count = strlen(req->path);
-  msg.name_length = smb_swap16((unsigned short)byte_count);
+  msg.name_length = smb_swap16((unsigned short)(byte_count - 1));
   msg.share_access = smb_swap32(SMB_FILE_SHARE_ALL);
   if(data->state.upload) {
     msg.access = smb_swap32(SMB_GENERIC_READ | SMB_GENERIC_WRITE);
@@ -727,37 +770,40 @@ static CURLcode smb_send_open(struct Curl_easy *data)
     msg.access = smb_swap32(SMB_GENERIC_READ);
     msg.create_disposition = smb_swap32(SMB_FILE_OPEN);
   }
-  msg.byte_count = smb_swap16((unsigned short) ++byte_count);
-  strcpy(msg.bytes, req->path);
+  msg.byte_count = smb_swap16((unsigned short)byte_count);
+  curlx_strcopy(msg.bytes, sizeof(msg.bytes), req->path, byte_count - 1);
 
-  return smb_send_message(data, SMB_COM_NT_CREATE_ANDX, &msg,
+  return smb_send_message(data, smbc, req, SMB_COM_NT_CREATE_ANDX, &msg,
                           sizeof(msg) - sizeof(msg.bytes) + byte_count);
 }
 
-static CURLcode smb_send_close(struct Curl_easy *data)
+static CURLcode smb_send_close(struct Curl_easy *data,
+                               struct smb_conn *smbc,
+                               struct smb_request *req)
 {
-  struct smb_request *req = data->req.p.smb;
   struct smb_close msg;
 
   memset(&msg, 0, sizeof(msg));
   msg.word_count = SMB_WC_CLOSE;
   msg.fid = smb_swap16(req->fid);
 
-  return smb_send_message(data, SMB_COM_CLOSE, &msg, sizeof(msg));
+  return smb_send_message(data, smbc, req, SMB_COM_CLOSE, &msg, sizeof(msg));
 }
 
-static CURLcode smb_send_tree_disconnect(struct Curl_easy *data)
+static CURLcode smb_send_tree_disconnect(struct Curl_easy *data,
+                                         struct smb_conn *smbc,
+                                         struct smb_request *req)
 {
   struct smb_tree_disconnect msg;
-
   memset(&msg, 0, sizeof(msg));
-
-  return smb_send_message(data, SMB_COM_TREE_DISCONNECT, &msg, sizeof(msg));
+  return smb_send_message(data, smbc, req, SMB_COM_TREE_DISCONNECT,
+                          &msg, sizeof(msg));
 }
 
-static CURLcode smb_send_read(struct Curl_easy *data)
+static CURLcode smb_send_read(struct Curl_easy *data,
+                              struct smb_conn *smbc,
+                              struct smb_request *req)
 {
-  struct smb_request *req = data->req.p.smb;
   curl_off_t offset = data->req.offset;
   struct smb_read msg;
 
@@ -765,25 +811,24 @@ static CURLcode smb_send_read(struct Curl_easy *data)
   msg.word_count = SMB_WC_READ_ANDX;
   msg.andx.command = SMB_COM_NO_ANDX_COMMAND;
   msg.fid = smb_swap16(req->fid);
-  msg.offset = smb_swap32((unsigned int) offset);
-  msg.offset_high = smb_swap32((unsigned int) (offset >> 32));
+  msg.offset = smb_swap32((unsigned int)offset);
+  msg.offset_high = smb_swap32((unsigned int)(offset >> 32));
   msg.min_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
   msg.max_bytes = smb_swap16(MAX_PAYLOAD_SIZE);
 
-  return smb_send_message(data, SMB_COM_READ_ANDX, &msg, sizeof(msg));
+  return smb_send_message(data, smbc, req, SMB_COM_READ_ANDX,
+                          &msg, sizeof(msg));
 }
 
-static CURLcode smb_send_write(struct Curl_easy *data)
+static CURLcode smb_send_write(struct Curl_easy *data,
+                               struct smb_conn *smbc,
+                               struct smb_request *req)
 {
   struct smb_write *msg;
-  struct smb_request *req = data->req.p.smb;
   curl_off_t offset = data->req.offset;
   curl_off_t upload_size = data->req.size - data->req.bytecount;
-  CURLcode result = Curl_get_upload_buffer(data);
-  if(result)
-    return result;
-  msg = (struct smb_write *)data->state.ulbuf;
 
+  msg = (struct smb_write *)smbc->send_buf;
   if(upload_size >= MAX_PAYLOAD_SIZE - 1) /* There is one byte of padding */
     upload_size = MAX_PAYLOAD_SIZE - 1;
 
@@ -791,31 +836,31 @@ static CURLcode smb_send_write(struct Curl_easy *data)
   msg->word_count = SMB_WC_WRITE_ANDX;
   msg->andx.command = SMB_COM_NO_ANDX_COMMAND;
   msg->fid = smb_swap16(req->fid);
-  msg->offset = smb_swap32((unsigned int) offset);
-  msg->offset_high = smb_swap32((unsigned int) (offset >> 32));
-  msg->data_length = smb_swap16((unsigned short) upload_size);
+  msg->offset = smb_swap32((unsigned int)offset);
+  msg->offset_high = smb_swap32((unsigned int)(offset >> 32));
+  msg->data_length = smb_swap16((unsigned short)upload_size);
   msg->data_offset = smb_swap16(sizeof(*msg) - sizeof(unsigned int));
-  msg->byte_count = smb_swap16((unsigned short) (upload_size + 1));
+  msg->byte_count = smb_swap16((unsigned short)(upload_size + 1));
 
-  smb_format_message(data, &msg->h, SMB_COM_WRITE_ANDX,
-                     sizeof(*msg) - sizeof(msg->h) + (size_t) upload_size);
+  smb_format_message(smbc, req, &msg->h, SMB_COM_WRITE_ANDX,
+                     sizeof(*msg) - sizeof(msg->h) + (size_t)upload_size);
 
-  return smb_send(data, sizeof(*msg), (size_t) upload_size);
+  return smb_send(data, smbc, sizeof(*msg), (size_t)upload_size);
 }
 
-static CURLcode smb_send_and_recv(struct Curl_easy *data, void **msg)
+static CURLcode smb_send_and_recv(struct Curl_easy *data,
+                                  struct smb_conn *smbc, void **msg)
 {
-  struct connectdata *conn = data->conn;
-  struct smb_conn *smbc = &conn->proto.smbc;
   CURLcode result;
   *msg = NULL; /* if it returns early */
 
   /* Check if there is data in the transfer buffer */
   if(!smbc->send_size && smbc->upload_size) {
-    size_t nread = smbc->upload_size > (size_t)data->set.upload_buffer_size ?
-      (size_t)data->set.upload_buffer_size : smbc->upload_size;
-    data->req.upload_fromhere = data->state.ulbuf;
-    result = Curl_fillreadbuffer(data, nread, &nread);
+    size_t nread = smbc->upload_size > (size_t)MAX_MESSAGE_SIZE ?
+      (size_t)MAX_MESSAGE_SIZE : smbc->upload_size;
+    bool eos;
+
+    result = Curl_client_read(data, smbc->send_buf, nread, &nread, &eos);
     if(result && result != CURLE_AGAIN)
       return result;
     if(!nread)
@@ -828,7 +873,7 @@ static CURLcode smb_send_and_recv(struct Curl_easy *data, void **msg)
 
   /* Check if there is data to send */
   if(smbc->send_size) {
-    result = smb_flush(data);
+    result = smb_flush(data, smbc);
     if(result)
       return result;
   }
@@ -837,21 +882,25 @@ static CURLcode smb_send_and_recv(struct Curl_easy *data, void **msg)
   if(smbc->send_size || smbc->upload_size)
     return CURLE_AGAIN;
 
-  return smb_recv_message(data, msg);
+  return smb_recv_message(data, smbc, msg);
 }
 
 static CURLcode smb_connection_state(struct Curl_easy *data, bool *done)
 {
   struct connectdata *conn = data->conn;
-  struct smb_conn *smbc = &conn->proto.smbc;
+  struct smb_conn *smbc = Curl_conn_meta_get(conn, CURL_META_SMB_CONN);
+  struct smb_request *req = Curl_meta_get(data, CURL_META_SMB_EASY);
   struct smb_negotiate_response *nrsp;
   struct smb_header *h;
   CURLcode result;
   void *msg = NULL;
 
+  if(!smbc || !req)
+    return CURLE_FAILED_INIT;
+
   if(smbc->state == SMB_CONNECTING) {
 #ifdef USE_SSL
-    if((conn->handler->flags & PROTOPT_SSL)) {
+    if(Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
       bool ssl_done = FALSE;
       result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssl_done);
       if(result && result != CURLE_AGAIN)
@@ -861,17 +910,17 @@ static CURLcode smb_connection_state(struct Curl_easy *data, bool *done)
     }
 #endif
 
-    result = smb_send_negotiate(data);
+    result = smb_send_negotiate(data, smbc, req);
     if(result) {
       connclose(conn, "SMB: failed to send negotiate message");
       return result;
     }
 
-    conn_state(data, SMB_NEGOTIATE);
+    conn_state(data, smbc, SMB_NEGOTIATE);
   }
 
   /* Send the previous message and check for a response */
-  result = smb_send_and_recv(data, &msg);
+  result = smb_send_and_recv(data, smbc, &msg);
   if(result && result != CURLE_AGAIN) {
     connclose(conn, "SMB: failed to communicate");
     return result;
@@ -890,14 +939,23 @@ static CURLcode smb_connection_state(struct Curl_easy *data, bool *done)
       return CURLE_COULDNT_CONNECT;
     }
     nrsp = msg;
+#if defined(__GNUC__) && __GNUC__ >= 13
+#pragma GCC diagnostic push
+/* error: 'memcpy' offset [74, 80] from the object at '<unknown>' is out of
+   the bounds of referenced subobject 'bytes' with type 'char[1]' */
+#pragma GCC diagnostic ignored "-Warray-bounds"
+#endif
     memcpy(smbc->challenge, nrsp->bytes, sizeof(smbc->challenge));
+#if defined(__GNUC__) && __GNUC__ >= 13
+#pragma GCC diagnostic pop
+#endif
     smbc->session_key = smb_swap32(nrsp->session_key);
     result = smb_send_setup(data);
     if(result) {
       connclose(conn, "SMB: failed to send setup message");
       return result;
     }
-    conn_state(data, SMB_SETUP);
+    conn_state(data, smbc, SMB_SETUP);
     break;
 
   case SMB_SETUP:
@@ -906,51 +964,58 @@ static CURLcode smb_connection_state(struct Curl_easy *data, bool *done)
       return CURLE_LOGIN_DENIED;
     }
     smbc->uid = smb_swap16(h->uid);
-    conn_state(data, SMB_CONNECTED);
-    *done = true;
+    conn_state(data, smbc, SMB_CONNECTED);
+    *done = TRUE;
     break;
 
   default:
-    smb_pop_message(conn);
+    smb_pop_message(smbc);
     return CURLE_OK; /* ignore */
   }
 
-  smb_pop_message(conn);
+  smb_pop_message(smbc);
 
   return CURLE_OK;
 }
 
 /*
  * Convert a timestamp from the Windows world (100 nsec units from 1 Jan 1601)
- * to Posix time. Cap the output to fit within a time_t.
+ * to POSIX time. Cap the output to fit within a time_t.
  */
 static void get_posix_time(time_t *out, curl_off_t timestamp)
 {
-  timestamp -= 116444736000000000;
-  timestamp /= 10000000;
+  if(timestamp >= (curl_off_t)116444736000000000) {
+    timestamp -= (curl_off_t)116444736000000000;
+    timestamp /= 10000000;
 #if SIZEOF_TIME_T < SIZEOF_CURL_OFF_T
-  if(timestamp > TIME_T_MAX)
-    *out = TIME_T_MAX;
-  else if(timestamp < TIME_T_MIN)
-    *out = TIME_T_MIN;
-  else
+    if(timestamp > TIME_T_MAX)
+      *out = TIME_T_MAX;
+    else if(timestamp < TIME_T_MIN)
+      *out = TIME_T_MIN;
+    else
 #endif
-    *out = (time_t) timestamp;
+      *out = (time_t)timestamp;
+  }
+  else
+    *out = 0;
 }
 
 static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
 {
   struct connectdata *conn = data->conn;
-  struct smb_request *req = data->req.p.smb;
+  struct smb_conn *smbc = Curl_conn_meta_get(conn, CURL_META_SMB_CONN);
+  struct smb_request *req = Curl_meta_get(data, CURL_META_SMB_EASY);
   struct smb_header *h;
-  struct smb_conn *smbc = &conn->proto.smbc;
   enum smb_req_state next_state = SMB_DONE;
-  unsigned short len;
-  unsigned short off;
+  size_t len;
+  size_t off;
   CURLcode result;
   void *msg = NULL;
   const struct smb_nt_create_response *smb_m;
 
+  if(!smbc || !req)
+    return CURLE_FAILED_INIT;
+
   if(data->state.upload && (data->state.infilesize < 0)) {
     failf(data, "SMB upload needs to know the size up front");
     return CURLE_SEND_ERROR;
@@ -958,7 +1023,7 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
 
   /* Start the request */
   if(req->state == SMB_REQUESTING) {
-    result = smb_send_tree_connect(data);
+    result = smb_send_tree_connect(data, smbc, req);
     if(result) {
       connclose(conn, "SMB: failed to send tree connect message");
       return result;
@@ -968,7 +1033,7 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
   }
 
   /* Send the previous message and check for a response */
-  result = smb_send_and_recv(data, &msg);
+  result = smb_send_and_recv(data, smbc, &msg);
   if(result && result != CURLE_AGAIN) {
     connclose(conn, "SMB: failed to communicate");
     return result;
@@ -999,7 +1064,7 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
       next_state = SMB_TREE_DISCONNECT;
       break;
     }
-    smb_m = (const struct smb_nt_create_response*) msg;
+    smb_m = (const struct smb_nt_create_response *)msg;
     req->fid = smb_swap16(smb_m->fid);
     data->req.offset = 0;
     if(data->state.upload) {
@@ -1023,14 +1088,14 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
     break;
 
   case SMB_DOWNLOAD:
-    if(h->status || smbc->got < sizeof(struct smb_header) + 14) {
+    if(h->status || smbc->got < sizeof(struct smb_header) + 15) {
       req->result = CURLE_RECV_ERROR;
       next_state = SMB_CLOSE;
       break;
     }
-    len = Curl_read16_le(((const unsigned char *) msg) +
+    len = Curl_read16_le((const unsigned char *)msg +
                          sizeof(struct smb_header) + 11);
-    off = Curl_read16_le(((const unsigned char *) msg) +
+    off = Curl_read16_le((const unsigned char *)msg +
                          sizeof(struct smb_header) + 13);
     if(len > 0) {
       if(off + sizeof(unsigned int) + len > smbc->got) {
@@ -1047,23 +1112,21 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
         break;
       }
     }
-    data->req.bytecount += len;
     data->req.offset += len;
-    Curl_pgrsSetDownloadCounter(data, data->req.bytecount);
     next_state = (len < MAX_PAYLOAD_SIZE) ? SMB_CLOSE : SMB_DOWNLOAD;
     break;
 
   case SMB_UPLOAD:
-    if(h->status || smbc->got < sizeof(struct smb_header) + 6) {
+    if(h->status || smbc->got < sizeof(struct smb_header) + 7) {
       req->result = CURLE_UPLOAD_FAILED;
       next_state = SMB_CLOSE;
       break;
     }
-    len = Curl_read16_le(((const unsigned char *) msg) +
+    len = Curl_read16_le((const unsigned char *)msg +
                          sizeof(struct smb_header) + 5);
     data->req.bytecount += len;
     data->req.offset += len;
-    Curl_pgrsSetUploadCounter(data, data->req.bytecount);
+    Curl_pgrs_upload_inc(data, len);
     if(data->req.bytecount >= data->req.size)
       next_state = SMB_CLOSE;
     else
@@ -1071,7 +1134,7 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
     break;
 
   case SMB_CLOSE:
-    /* We don't care if the close failed, proceed to tree disconnect anyway */
+    /* We do not care if the close failed, proceed to tree disconnect anyway */
     next_state = SMB_TREE_DISCONNECT;
     break;
 
@@ -1080,36 +1143,36 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
     break;
 
   default:
-    smb_pop_message(conn);
+    smb_pop_message(smbc);
     return CURLE_OK; /* ignore */
   }
 
-  smb_pop_message(conn);
+  smb_pop_message(smbc);
 
   switch(next_state) {
   case SMB_OPEN:
-    result = smb_send_open(data);
+    result = smb_send_open(data, smbc, req);
     break;
 
   case SMB_DOWNLOAD:
-    result = smb_send_read(data);
+    result = smb_send_read(data, smbc, req);
     break;
 
   case SMB_UPLOAD:
-    result = smb_send_write(data);
+    result = smb_send_write(data, smbc, req);
     break;
 
   case SMB_CLOSE:
-    result = smb_send_close(data);
+    result = smb_send_close(data, smbc, req);
     break;
 
   case SMB_TREE_DISCONNECT:
-    result = smb_send_tree_disconnect(data);
+    result = smb_send_tree_disconnect(data, smbc, req);
     break;
 
   case SMB_DONE:
     result = req->result;
-    *done = true;
+    *done = TRUE;
     break;
 
   default:
@@ -1126,80 +1189,46 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
   return CURLE_OK;
 }
 
-static CURLcode smb_disconnect(struct Curl_easy *data,
-                               struct connectdata *conn, bool dead)
+static CURLcode smb_pollset(struct Curl_easy *data,
+                            struct easy_pollset *ps)
 {
-  struct smb_conn *smbc = &conn->proto.smbc;
-  (void) dead;
-  (void) data;
-  Curl_safefree(smbc->share);
-  Curl_safefree(smbc->domain);
-  Curl_safefree(smbc->recv_buf);
-  return CURLE_OK;
-}
-
-static int smb_getsock(struct Curl_easy *data,
-                       struct connectdata *conn, curl_socket_t *socks)
-{
-  (void)data;
-  socks[0] = conn->sock[FIRSTSOCKET];
-  return GETSOCK_READSOCK(0) | GETSOCK_WRITESOCK(0);
+  return Curl_pollset_add_inout(data, ps, data->conn->sock[FIRSTSOCKET]);
 }
 
 static CURLcode smb_do(struct Curl_easy *data, bool *done)
 {
   struct connectdata *conn = data->conn;
-  struct smb_conn *smbc = &conn->proto.smbc;
+  struct smb_conn *smbc = Curl_conn_meta_get(conn, CURL_META_SMB_CONN);
 
   *done = FALSE;
-  if(smbc->share) {
+  if(!smbc)
+    return CURLE_FAILED_INIT;
+  if(smbc->share)
     return CURLE_OK;
-  }
   return CURLE_URL_MALFORMAT;
 }
 
-static CURLcode smb_parse_url_path(struct Curl_easy *data,
-                                   struct connectdata *conn)
-{
-  struct smb_request *req = data->req.p.smb;
-  struct smb_conn *smbc = &conn->proto.smbc;
-  char *path;
-  char *slash;
+/*
+ * SMB handler interface
+ */
+const struct Curl_protocol Curl_protocol_smb = {
+  smb_setup_connection,                 /* setup_connection */
+  smb_do,                               /* do_it */
+  ZERO_NULL,                            /* done */
+  ZERO_NULL,                            /* do_more */
+  smb_connect,                          /* connect_it */
+  smb_connection_state,                 /* connecting */
+  smb_request_state,                    /* doing */
+  smb_pollset,                          /* proto_pollset */
+  smb_pollset,                          /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
+  ZERO_NULL,                            /* disconnect */
+  ZERO_NULL,                            /* write_resp */
+  ZERO_NULL,                            /* write_resp_hd */
+  ZERO_NULL,                            /* connection_is_dead */
+  ZERO_NULL,                            /* attach connection */
+  ZERO_NULL,                            /* follow */
+};
 
-  /* URL decode the path */
-  CURLcode result = Curl_urldecode(data->state.up.path, 0, &path, NULL,
-                                   REJECT_CTRL);
-  if(result)
-    return result;
-
-  /* Parse the path for the share */
-  smbc->share = strdup((*path == '/' || *path == '\\') ? path + 1 : path);
-  free(path);
-  if(!smbc->share)
-    return CURLE_OUT_OF_MEMORY;
-
-  slash = strchr(smbc->share, '/');
-  if(!slash)
-    slash = strchr(smbc->share, '\\');
-
-  /* The share must be present */
-  if(!slash) {
-    Curl_safefree(smbc->share);
-    failf(data, "missing share in URL path for SMB");
-    return CURLE_URL_MALFORMAT;
-  }
-
-  /* Parse the path for the file path converting any forward slashes into
-     backslashes */
-  *slash++ = 0;
-  req->path = slash;
-
-  for(; *slash; slash++) {
-    if(*slash == '/')
-      *slash = '\\';
-  }
-  return CURLE_OK;
-}
-
-#endif /* CURL_DISABLE_SMB && USE_CURL_NTLM_CORE &&
-          SIZEOF_CURL_OFF_T > 4 */
+#endif /* CURL_ENABLE_SMB && USE_CURL_NTLM_CORE */
diff --git a/third-party/curl/lib/smb.h b/third-party/curl/lib/smb.h
index 437f4a58a8..5a92ad13db 100644
--- a/third-party/curl/lib/smb.h
+++ b/third-party/curl/lib/smb.h
@@ -24,37 +24,8 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
-enum smb_conn_state {
-  SMB_NOT_CONNECTED = 0,
-  SMB_CONNECTING,
-  SMB_NEGOTIATE,
-  SMB_SETUP,
-  SMB_CONNECTED
-};
-
-struct smb_conn {
-  enum smb_conn_state state;
-  char *user;
-  char *domain;
-  char *share;
-  unsigned char challenge[8];
-  unsigned int session_key;
-  unsigned short uid;
-  char *recv_buf;
-  size_t upload_size;
-  size_t send_size;
-  size_t sent;
-  size_t got;
-};
-
-#if !defined(CURL_DISABLE_SMB) && defined(USE_CURL_NTLM_CORE) && \
-    (SIZEOF_CURL_OFF_T > 4)
-
-extern const struct Curl_handler Curl_handler_smb;
-extern const struct Curl_handler Curl_handler_smbs;
-
-#endif /* CURL_DISABLE_SMB && USE_CURL_NTLM_CORE &&
-          SIZEOF_CURL_OFF_T > 4 */
+#if defined(CURL_ENABLE_SMB) && defined(USE_CURL_NTLM_CORE)
+extern const struct Curl_protocol Curl_protocol_smb;
+#endif
 
 #endif /* HEADER_CURL_SMB_H */
diff --git a/third-party/curl/lib/smtp.c b/third-party/curl/lib/smtp.c
index 81a17e38db..2283f5e87d 100644
--- a/third-party/curl/lib/smtp.c
+++ b/third-party/curl/lib/smtp.c
@@ -38,8 +38,9 @@
  * Draft   LOGIN SASL Mechanism <draft-murchison-sasl-login-00.txt>
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+#include "urldata.h"
+#include "smtp.h"
 
 #ifndef CURL_DISABLE_SMTP
 
@@ -57,145 +58,420 @@
 #include <inet.h>
 #endif
 
-#include <curl/curl.h>
-#include "urldata.h"
 #include "sendf.h"
+#include "curl_trc.h"
 #include "hostip.h"
 #include "progress.h"
 #include "transfer.h"
 #include "escape.h"
-#include "http.h" /* for HTTP proxy tunnel stuff */
+#include "pingpong.h"
 #include "mime.h"
-#include "socks.h"
-#include "smtp.h"
-#include "strtoofft.h"
-#include "strcase.h"
 #include "vtls/vtls.h"
 #include "cfilters.h"
 #include "connect.h"
 #include "select.h"
-#include "multiif.h"
 #include "url.h"
 #include "curl_gethostname.h"
 #include "bufref.h"
 #include "curl_sasl.h"
-#include "warnless.h"
 #include "idn.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curlx/strparse.h"
 
-/* Local API functions */
-static CURLcode smtp_regular_transfer(struct Curl_easy *data, bool *done);
-static CURLcode smtp_do(struct Curl_easy *data, bool *done);
-static CURLcode smtp_done(struct Curl_easy *data, CURLcode status,
-                          bool premature);
-static CURLcode smtp_connect(struct Curl_easy *data, bool *done);
-static CURLcode smtp_disconnect(struct Curl_easy *data,
-                                struct connectdata *conn, bool dead);
-static CURLcode smtp_multi_statemach(struct Curl_easy *data, bool *done);
-static int smtp_getsock(struct Curl_easy *data,
-                        struct connectdata *conn, curl_socket_t *socks);
-static CURLcode smtp_doing(struct Curl_easy *data, bool *dophase_done);
-static CURLcode smtp_setup_connection(struct Curl_easy *data,
-                                      struct connectdata *conn);
-static CURLcode smtp_parse_url_options(struct connectdata *conn);
-static CURLcode smtp_parse_url_path(struct Curl_easy *data);
-static CURLcode smtp_parse_custom_request(struct Curl_easy *data);
-static CURLcode smtp_parse_address(const char *fqma,
-                                   char **address, struct hostname *host);
-static CURLcode smtp_perform_auth(struct Curl_easy *data, const char *mech,
-                                  const struct bufref *initresp);
-static CURLcode smtp_continue_auth(struct Curl_easy *data, const char *mech,
-                                   const struct bufref *resp);
-static CURLcode smtp_cancel_auth(struct Curl_easy *data, const char *mech);
-static CURLcode smtp_get_message(struct Curl_easy *data, struct bufref *out);
+/* meta key for storing protocol meta at easy handle */
+#define CURL_META_SMTP_EASY   "meta:proto:smtp:easy"
+/* meta key for storing protocol meta at connection */
+#define CURL_META_SMTP_CONN   "meta:proto:smtp:conn"
 
-/*
- * SMTP protocol handler.
+/****************************************************************************
+ * SMTP unique setup
+ ***************************************************************************/
+typedef enum {
+  SMTP_STOP,        /* do nothing state, stops the state machine */
+  SMTP_SERVERGREET, /* waiting for the initial greeting immediately after
+                       a connect */
+  SMTP_EHLO,
+  SMTP_HELO,
+  SMTP_STARTTLS,
+  SMTP_UPGRADETLS,  /* asynchronously upgrade the connection to SSL/TLS
+                       (multi mode only) */
+  SMTP_AUTH,
+  SMTP_COMMAND,     /* VRFY, EXPN, NOOP, RSET and HELP */
+  SMTP_MAIL,        /* MAIL FROM */
+  SMTP_RCPT,        /* RCPT TO */
+  SMTP_DATA,
+  SMTP_POSTDATA,
+  SMTP_QUIT,
+  SMTP_LAST         /* never used */
+} smtpstate;
+
+/* smtp_conn is used for struct connection-oriented data in the connectdata
+   struct */
+struct smtp_conn {
+  struct pingpong pp;
+  struct SASL sasl;        /* SASL-related storage */
+  smtpstate state;         /* Always use smtp.c:state() to change state! */
+  char *domain;            /* Client address/name to send in the EHLO */
+  BIT(ssldone);            /* Is connect() over SSL done? */
+  BIT(tls_supported);      /* StartTLS capability supported by server */
+  BIT(size_supported);     /* If server supports SIZE extension according to
+                              RFC 1870 */
+  BIT(utf8_supported);     /* If server supports SMTPUTF8 extension according
+                              to RFC 6531 */
+  BIT(auth_supported);     /* AUTH capability supported by server */
+};
+
+/* This SMTP struct is used in the Curl_easy. All SMTP data that is
+   connection-oriented must be in smtp_conn to properly deal with the fact that
+   perhaps the Curl_easy is changed between the times the connection is
+   used. */
+struct SMTP {
+  curl_pp_transfer transfer;
+  char *custom;            /* Custom Request */
+  struct curl_slist *rcpt; /* Recipient list */
+  int rcpt_last_error;     /* The last error received for RCPT TO command */
+  size_t eob;              /* Number of bytes of the EOB (End Of Body) that
+                              have been received so far */
+  BIT(rcpt_had_ok);        /* Whether any of RCPT TO commands (depends on
+                              total number of recipients) succeeded so far */
+  BIT(trailing_crlf);      /* Specifies if the trailing CRLF is present */
+};
+
+/***********************************************************************
+ *
+ * smtp_parse_url_options()
+ *
+ * Parse the URL login options.
  */
-
-const struct Curl_handler Curl_handler_smtp = {
-  "SMTP",                           /* scheme */
-  smtp_setup_connection,            /* setup_connection */
-  smtp_do,                          /* do_it */
-  smtp_done,                        /* done */
-  ZERO_NULL,                        /* do_more */
-  smtp_connect,                     /* connect_it */
-  smtp_multi_statemach,             /* connecting */
-  smtp_doing,                       /* doing */
-  smtp_getsock,                     /* proto_getsock */
-  smtp_getsock,                     /* doing_getsock */
-  ZERO_NULL,                        /* domore_getsock */
-  ZERO_NULL,                        /* perform_getsock */
-  smtp_disconnect,                  /* disconnect */
-  ZERO_NULL,                        /* readwrite */
-  ZERO_NULL,                        /* connection_check */
-  ZERO_NULL,                        /* attach connection */
-  PORT_SMTP,                        /* defport */
-  CURLPROTO_SMTP,                   /* protocol */
-  CURLPROTO_SMTP,                   /* family */
-  PROTOPT_CLOSEACTION | PROTOPT_NOURLQUERY | /* flags */
-  PROTOPT_URLOPTIONS
-};
-
-#ifdef USE_SSL
-/*
- * SMTPS protocol handler.
- */
-
-const struct Curl_handler Curl_handler_smtps = {
-  "SMTPS",                          /* scheme */
-  smtp_setup_connection,            /* setup_connection */
-  smtp_do,                          /* do_it */
-  smtp_done,                        /* done */
-  ZERO_NULL,                        /* do_more */
-  smtp_connect,                     /* connect_it */
-  smtp_multi_statemach,             /* connecting */
-  smtp_doing,                       /* doing */
-  smtp_getsock,                     /* proto_getsock */
-  smtp_getsock,                     /* doing_getsock */
-  ZERO_NULL,                        /* domore_getsock */
-  ZERO_NULL,                        /* perform_getsock */
-  smtp_disconnect,                  /* disconnect */
-  ZERO_NULL,                        /* readwrite */
-  ZERO_NULL,                        /* connection_check */
-  ZERO_NULL,                        /* attach connection */
-  PORT_SMTPS,                       /* defport */
-  CURLPROTO_SMTPS,                  /* protocol */
-  CURLPROTO_SMTP,                   /* family */
-  PROTOPT_CLOSEACTION | PROTOPT_SSL
-  | PROTOPT_NOURLQUERY | PROTOPT_URLOPTIONS /* flags */
-};
-#endif
-
-/* SASL parameters for the smtp protocol */
-static const struct SASLproto saslsmtp = {
-  "smtp",               /* The service name */
-  smtp_perform_auth,    /* Send authentication command */
-  smtp_continue_auth,   /* Send authentication continuation */
-  smtp_cancel_auth,     /* Cancel authentication */
-  smtp_get_message,     /* Get SASL response message */
-  512 - 8,              /* Max line len - strlen("AUTH ") - 1 space - crlf */
-  334,                  /* Code received when continuation is expected */
-  235,                  /* Code to receive upon authentication success */
-  SASL_AUTH_DEFAULT,    /* Default mechanisms */
-  SASL_FLAG_BASE64      /* Configuration flags */
-};
-
-#ifdef USE_SSL
-static void smtp_to_smtps(struct connectdata *conn)
+static CURLcode smtp_parse_url_options(struct connectdata *conn,
+                                       struct smtp_conn *smtpc)
 {
-  /* Change the connection handler */
-  conn->handler = &Curl_handler_smtps;
+  CURLcode result = CURLE_OK;
+  const char *ptr = conn->options;
 
-  /* Set the connection's upgraded to TLS flag */
-  conn->bits.tls_upgraded = TRUE;
+  while(!result && ptr && *ptr) {
+    const char *key = ptr;
+    const char *value;
+
+    while(*ptr && *ptr != '=')
+      ptr++;
+
+    value = ptr + 1;
+
+    while(*ptr && *ptr != ';')
+      ptr++;
+
+    if(curl_strnequal(key, "AUTH=", 5))
+      result = Curl_sasl_parse_url_auth_option(&smtpc->sasl,
+                                               value, ptr - value);
+    else
+      result = CURLE_URL_MALFORMAT;
+
+    if(*ptr == ';')
+      ptr++;
+  }
+
+  return result;
+}
+
+/***********************************************************************
+ *
+ * smtp_parse_url_path()
+ *
+ * Parse the URL path into separate path components.
+ */
+static CURLcode smtp_parse_url_path(struct Curl_easy *data,
+                                    struct smtp_conn *smtpc)
+{
+  /* The SMTP struct is already initialized in smtp_connect() */
+  const char *path = &data->state.up.path[1]; /* skip leading path */
+  char localhost[HOSTNAME_MAX + 1];
+
+  /* Calculate the path if necessary */
+  if(!*path) {
+    if(!Curl_gethostname(localhost, sizeof(localhost)))
+      path = localhost;
+    else
+      path = "localhost";
+  }
+
+  /* URL decode the path and use it as the domain in our EHLO */
+  return Curl_urldecode(path, 0, &smtpc->domain, NULL, REJECT_CTRL);
+}
+
+/***********************************************************************
+ *
+ * smtp_parse_custom_request()
+ *
+ * Parse the custom request.
+ */
+static CURLcode smtp_parse_custom_request(struct Curl_easy *data,
+                                          struct SMTP *smtp)
+{
+  CURLcode result = CURLE_OK;
+  const char *custom = data->set.str[STRING_CUSTOMREQUEST];
+
+  /* URL decode the custom request */
+  if(custom)
+    result = Curl_urldecode(custom, 0, &smtp->custom, NULL, REJECT_CTRL);
+
+  return result;
+}
+
+/***********************************************************************
+ *
+ * smtp_parse_address()
+ *
+ * Parse the fully qualified mailbox address into a local address part and the
+ * hostname, converting the hostname to an IDN A-label, as per RFC-5890, if
+ * necessary.
+ *
+ * Parameters:
+ *
+ * fqma           [in]     - The fully qualified mailbox address (which may or
+ *                           may not contain UTF-8 characters).
+ * address        [in/out] - A new allocated buffer which holds the local
+ *                           address part of the mailbox. This buffer must be
+ *                           free'ed by the caller.
+ * host           [in/out] - The hostname structure that holds the original,
+ *                           and optionally encoded, hostname.
+ *                           Curl_free_idnconverted_hostname() must be called
+ *                           once the caller has finished with the structure.
+ *
+ * Returns CURLE_OK on success.
+ *
+ * Notes:
+ *
+ * Should a UTF-8 hostname require conversion to IDN ACE and we cannot honor
+ * that conversion then we shall return success. This allow the caller to send
+ * the data to the server as a U-label (as per RFC-6531 sect. 3.2).
+ *
+ * If an mailbox '@' separator cannot be located then the mailbox is considered
+ * to be either a local mailbox or an invalid mailbox (depending on what the
+ * calling function deems it to be) then the input will be returned in
+ * the address part with the hostname being NULL.
+ */
+static CURLcode smtp_parse_address(const char *fqma, char **address,
+                                   struct hostname *host, const char **suffix)
+{
+  CURLcode result = CURLE_OK;
+  size_t length;
+  char *addressend;
+
+  /* Duplicate the fully qualified email address so we can manipulate it,
+     ensuring it does not contain the delimiters if specified */
+  char *dup = curlx_strdup(fqma[0] == '<' ? fqma + 1 : fqma);
+  if(!dup)
+    return CURLE_OUT_OF_MEMORY;
+
+  if(fqma[0] != '<') {
+    length = strlen(dup);
+    if(length) {
+      if(dup[length - 1] == '>')
+        dup[length - 1] = '\0';
+    }
+  }
+  else {
+    addressend = strrchr(dup, '>');
+    if(addressend) {
+      *addressend = '\0';
+      *suffix = addressend + 1;
+    }
+  }
+
+  /* Extract the hostname from the address (if we can) */
+  host->name = strpbrk(dup, "@");
+  if(host->name) {
+    *host->name = '\0';
+    host->name = host->name + 1;
+
+    /* Attempt to convert the hostname to IDN ACE */
+    (void)Curl_idnconvert_hostname(host);
+
+    /* If Curl_idnconvert_hostname() fails then we shall attempt to continue
+       and send the hostname using UTF-8 rather than as 7-bit ACE (which is
+       our preference) */
+  }
+
+  /* Extract the local address from the mailbox */
+  *address = dup;
+
+  return result;
+}
+
+struct cr_eob_ctx {
+  struct Curl_creader super;
+  struct bufq buf;
+  size_t n_eob; /* how many EOB bytes we matched so far */
+  size_t eob;       /* Number of bytes of the EOB (End Of Body) that
+                       have been received so far */
+  BIT(read_eos);  /* we read an EOS from the next reader */
+  BIT(processed_eos);  /* we read and processed an EOS */
+  BIT(eos);       /* we have returned an EOS */
+};
+
+static CURLcode cr_eob_init(struct Curl_easy *data,
+                            struct Curl_creader *reader)
+{
+  struct cr_eob_ctx *ctx = reader->ctx;
+  (void)data;
+  /* The first char we read is the first on a line, as if we had
+   * read CRLF before */
+  ctx->n_eob = 2;
+  Curl_bufq_init2(&ctx->buf, (16 * 1024), 1, BUFQ_OPT_SOFT_LIMIT);
+  return CURLE_OK;
+}
+
+static void cr_eob_close(struct Curl_easy *data, struct Curl_creader *reader)
+{
+  struct cr_eob_ctx *ctx = reader->ctx;
+  (void)data;
+  Curl_bufq_free(&ctx->buf);
+}
+
+/* this is the 5-bytes End-Of-Body marker for SMTP */
+#define SMTP_EOB          "\r\n.\r\n"
+#define SMTP_EOB_FIND_LEN 3
+
+/* client reader doing SMTP End-Of-Body escaping. */
+static CURLcode cr_eob_read(struct Curl_easy *data,
+                            struct Curl_creader *reader,
+                            char *buf, size_t blen,
+                            size_t *pnread, bool *peos)
+{
+  struct cr_eob_ctx *ctx = reader->ctx;
+  CURLcode result = CURLE_OK;
+  size_t nread, i, start, n;
+  bool eos;
+
+  if(!ctx->read_eos && Curl_bufq_is_empty(&ctx->buf)) {
+    /* Get more and convert it when needed */
+    result = Curl_creader_read(data, reader->next, buf, blen, &nread, &eos);
+    CURL_TRC_SMTP(data, "cr_eob_read, next_read(len=%zu) -> %d, %zu eos=%d",
+                  blen, (int)result, nread, eos);
+    if(result)
+      return result;
+
+    ctx->read_eos = eos;
+    if(nread) {
+      if(!ctx->n_eob && !memchr(buf, SMTP_EOB[0], nread)) {
+        /* not in the middle of a match, no EOB start found, pass */
+        *pnread = nread;
+        *peos = FALSE;
+        return CURLE_OK;
+      }
+      /* scan for EOB (continuation) and convert */
+      for(i = start = 0; i < nread; ++i) {
+        if(ctx->n_eob >= SMTP_EOB_FIND_LEN) {
+          /* matched the EOB prefix and seeing additional char, add '.' */
+          result = Curl_bufq_cwrite(&ctx->buf, buf + start, i - start, &n);
+          if(result)
+            return result;
+          result = Curl_bufq_cwrite(&ctx->buf, ".", 1, &n);
+          if(result)
+            return result;
+          ctx->n_eob = 0;
+          start = i;
+          if(data->state.infilesize > 0)
+            data->state.infilesize++;
+        }
+
+        if(buf[i] != SMTP_EOB[ctx->n_eob])
+          ctx->n_eob = 0;
+
+        if(buf[i] == SMTP_EOB[ctx->n_eob]) {
+          /* matching another char of the EOB */
+          ++ctx->n_eob;
+        }
+      }
+
+      /* add any remainder to buf */
+      if(start < nread) {
+        result = Curl_bufq_cwrite(&ctx->buf, buf + start, nread - start, &n);
+        if(result)
+          return result;
+      }
+    }
+  }
+
+  *peos = FALSE;
+
+  if(ctx->read_eos && !ctx->processed_eos) {
+    /* if we last matched a CRLF or if the data was empty, add ".\r\n"
+     * to end the body. If we sent something and it did not end with "\r\n",
+     * add "\r\n.\r\n" to end the body */
+    const char *eob = SMTP_EOB;
+    CURL_TRC_SMTP(data, "auto-ending mail body with '\\r\\n.\\r\\n'");
+    switch(ctx->n_eob) {
+    case 2:
+      /* seen a CRLF at the end, add the remainder */
+      eob = &SMTP_EOB[2];
+      break;
+    case 3:
+      /* ended with '\r\n.', we should escape the last '.' */
+      eob = "." SMTP_EOB;
+      break;
+    default:
+      break;
+    }
+    result = Curl_bufq_cwrite(&ctx->buf, eob, strlen(eob), &n);
+    if(result)
+      return result;
+    ctx->processed_eos = TRUE;
+  }
+
+  if(!Curl_bufq_is_empty(&ctx->buf)) {
+    result = Curl_bufq_cread(&ctx->buf, buf, blen, pnread);
+  }
+  else
+    *pnread = 0;
+
+  if(ctx->read_eos && Curl_bufq_is_empty(&ctx->buf)) {
+    /* no more data, read all, done. */
+    CURL_TRC_SMTP(data, "mail body complete, returning EOS");
+    ctx->eos = TRUE;
+  }
+  *peos = (bool)ctx->eos;
+  DEBUGF(infof(data, "cr_eob_read(%zu) -> %d, %zu, %d",
+               blen, (int)result, *pnread, *peos));
+  return result;
+}
+
+static curl_off_t cr_eob_total_length(struct Curl_easy *data,
+                                      struct Curl_creader *reader)
+{
+  /* this reader changes length depending on input */
+  (void)data;
+  (void)reader;
+  return -1;
+}
+
+static const struct Curl_crtype cr_eob = {
+  "cr-smtp-eob",
+  cr_eob_init,
+  cr_eob_read,
+  cr_eob_close,
+  Curl_creader_def_needs_rewind,
+  cr_eob_total_length,
+  Curl_creader_def_resume_from,
+  Curl_creader_def_cntrl,
+  Curl_creader_def_is_paused,
+  Curl_creader_def_done,
+  sizeof(struct cr_eob_ctx)
+};
+
+static CURLcode cr_eob_add(struct Curl_easy *data)
+{
+  struct Curl_creader *reader = NULL;
+  CURLcode result;
+
+  result = Curl_creader_create(&reader, data, &cr_eob, CURL_CR_CONTENT_ENCODE);
+  if(!result)
+    result = Curl_creader_add(data, reader);
+
+  if(result && reader)
+    Curl_creader_free(data, reader);
+  return result;
 }
-#else
-#define smtp_to_smtps(x) Curl_nop_stmt
-#endif
 
 /***********************************************************************
  *
@@ -206,12 +482,16 @@ static void smtp_to_smtps(struct connectdata *conn)
  * supported authentication mechanisms.
  */
 static bool smtp_endofresp(struct Curl_easy *data, struct connectdata *conn,
-                           char *line, size_t len, int *resp)
+                           const char *line, size_t len, int *resp)
 {
-  struct smtp_conn *smtpc = &conn->proto.smtpc;
-  bool result = FALSE;
+  struct smtp_conn *smtpc = Curl_conn_meta_get(conn, CURL_META_SMTP_CONN);
+  bool end = FALSE;
   (void)data;
 
+  DEBUGASSERT(smtpc);
+  if(!smtpc)
+    return FALSE;
+
   /* Nothing for us */
   if(len < 4 || !ISDIGIT(line[0]) || !ISDIGIT(line[1]) || !ISDIGIT(line[2]))
     return FALSE;
@@ -222,11 +502,14 @@ static bool smtp_endofresp(struct Curl_easy *data, struct connectdata *conn,
      only send the response code instead as per Section 4.2. */
   if(line[3] == ' ' || len == 5) {
     char tmpline[6];
-
-    result = TRUE;
-    memset(tmpline, '\0', sizeof(tmpline));
+    curl_off_t code;
+    const char *p = tmpline;
+    end = TRUE;
     memcpy(tmpline, line, (len == 5 ? 5 : 3));
-    *resp = curlx_sltosi(strtol(tmpline, NULL, 10));
+    tmpline[len == 5 ? 5 : 3] = 0;
+    if(curlx_str_number(&p, &code, len == 5 ? 99999 : 999))
+      return FALSE;
+    *resp = (int)code;
 
     /* Make sure real server never sends internal value */
     if(*resp == 1)
@@ -235,11 +518,11 @@ static bool smtp_endofresp(struct Curl_easy *data, struct connectdata *conn,
   /* Do we have a multiline (continuation) response? */
   else if(line[3] == '-' &&
           (smtpc->state == SMTP_EHLO || smtpc->state == SMTP_COMMAND)) {
-    result = TRUE;
+    end = TRUE;
     *resp = 1;  /* Internal response code */
   }
 
-  return result;
+  return end;
 }
 
 /***********************************************************************
@@ -250,19 +533,25 @@ static bool smtp_endofresp(struct Curl_easy *data, struct connectdata *conn,
  */
 static CURLcode smtp_get_message(struct Curl_easy *data, struct bufref *out)
 {
-  char *message = data->state.buffer;
-  size_t len = strlen(message);
+  struct smtp_conn *smtpc =
+    Curl_conn_meta_get(data->conn, CURL_META_SMTP_CONN);
+  char *message;
+  size_t len;
 
+  if(!smtpc)
+    return CURLE_FAILED_INIT;
+
+  message = curlx_dyn_ptr(&smtpc->pp.recvbuf);
+  len = smtpc->pp.nfinal;
   if(len > 4) {
     /* Find the start of the message */
     len -= 4;
-    for(message += 4; *message == ' ' || *message == '\t'; message++, len--)
+    for(message += 4; ISBLANK(*message); message++, len--)
       ;
 
     /* Find the end of the message */
     while(len--)
-      if(message[len] != '\r' && message[len] != '\n' && message[len] != ' ' &&
-         message[len] != '\t')
+      if(!ISNEWLINE(message[len]) && !ISBLANK(message[len]))
         break;
 
     /* Terminate the message */
@@ -282,10 +571,11 @@ static CURLcode smtp_get_message(struct Curl_easy *data, struct bufref *out)
  *
  * This is the ONLY way to change SMTP state!
  */
-static void smtp_state(struct Curl_easy *data, smtpstate newstate)
+static void smtp_state(struct Curl_easy *data,
+                       struct smtp_conn *smtpc,
+                       smtpstate newstate)
 {
-  struct smtp_conn *smtpc = &data->conn->proto.smtpc;
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#ifdef CURLVERBOSE
   /* for debug purposes */
   static const char * const names[] = {
     "STOP",
@@ -305,8 +595,10 @@ static void smtp_state(struct Curl_easy *data, smtpstate newstate)
   };
 
   if(smtpc->state != newstate)
-    infof(data, "SMTP %p state change from %s to %s",
-          (void *)smtpc, names[smtpc->state], names[newstate]);
+    CURL_TRC_SMTP(data, "state change from %s to %s",
+                  names[smtpc->state], names[newstate]);
+#else
+  (void)data;
 #endif
 
   smtpc->state = newstate;
@@ -316,14 +608,13 @@ static void smtp_state(struct Curl_easy *data, smtpstate newstate)
  *
  * smtp_perform_ehlo()
  *
- * Sends the EHLO command to not only initialise communication with the ESMTP
+ * Sends the EHLO command to not only initialize communication with the ESMTP
  * server but to also obtain a list of server side supported capabilities.
  */
-static CURLcode smtp_perform_ehlo(struct Curl_easy *data)
+static CURLcode smtp_perform_ehlo(struct Curl_easy *data,
+                                  struct smtp_conn *smtpc)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct smtp_conn *smtpc = &conn->proto.smtpc;
 
   smtpc->sasl.authmechs = SASL_AUTH_NONE; /* No known auth. mechanism yet */
   smtpc->sasl.authused = SASL_AUTH_NONE;  /* Clear the authentication mechanism
@@ -335,7 +626,7 @@ static CURLcode smtp_perform_ehlo(struct Curl_easy *data)
   result = Curl_pp_sendf(data, &smtpc->pp, "EHLO %s", smtpc->domain);
 
   if(!result)
-    smtp_state(data, SMTP_EHLO);
+    smtp_state(data, smtpc, SMTP_EHLO);
 
   return result;
 }
@@ -344,13 +635,12 @@ static CURLcode smtp_perform_ehlo(struct Curl_easy *data)
  *
  * smtp_perform_helo()
  *
- * Sends the HELO command to initialise communication with the SMTP server.
+ * Sends the HELO command to initialize communication with the SMTP server.
  */
 static CURLcode smtp_perform_helo(struct Curl_easy *data,
-                                  struct connectdata *conn)
+                                  struct smtp_conn *smtpc)
 {
   CURLcode result = CURLE_OK;
-  struct smtp_conn *smtpc = &conn->proto.smtpc;
 
   smtpc->sasl.authused = SASL_AUTH_NONE; /* No authentication mechanism used
                                             in smtp connections */
@@ -359,7 +649,7 @@ static CURLcode smtp_perform_helo(struct Curl_easy *data,
   result = Curl_pp_sendf(data, &smtpc->pp, "HELO %s", smtpc->domain);
 
   if(!result)
-    smtp_state(data, SMTP_HELO);
+    smtp_state(data, smtpc, SMTP_HELO);
 
   return result;
 }
@@ -371,14 +661,13 @@ static CURLcode smtp_perform_helo(struct Curl_easy *data,
  * Sends the STLS command to start the upgrade to TLS.
  */
 static CURLcode smtp_perform_starttls(struct Curl_easy *data,
-                                      struct connectdata *conn)
+                                      struct smtp_conn *smtpc)
 {
   /* Send the STARTTLS command */
-  CURLcode result = Curl_pp_sendf(data, &conn->proto.smtpc.pp,
-                                  "%s", "STARTTLS");
+  CURLcode result = Curl_pp_sendf(data, &smtpc->pp, "%s", "STARTTLS");
 
   if(!result)
-    smtp_state(data, SMTP_STARTTLS);
+    smtp_state(data, smtpc, SMTP_STARTTLS);
 
   return result;
 }
@@ -389,33 +678,41 @@ static CURLcode smtp_perform_starttls(struct Curl_easy *data,
  *
  * Performs the upgrade to TLS.
  */
-static CURLcode smtp_perform_upgrade_tls(struct Curl_easy *data)
+static CURLcode smtp_perform_upgrade_tls(struct Curl_easy *data,
+                                         struct smtp_conn *smtpc)
 {
+#ifdef USE_SSL
   /* Start the SSL connection */
   struct connectdata *conn = data->conn;
-  struct smtp_conn *smtpc = &conn->proto.smtpc;
   CURLcode result;
   bool ssldone = FALSE;
 
+  DEBUGASSERT(smtpc->state == SMTP_UPGRADETLS);
   if(!Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
-    result = Curl_ssl_cfilter_add(data, conn, FIRSTSOCKET);
+    result = Curl_ssl_cfilter_add(
+      data, Curl_conn_get_origin(conn, FIRSTSOCKET), conn, FIRSTSOCKET);
     if(result)
       goto out;
+    /* Change the connection handler and SMTP state */
+    conn->scheme = &Curl_scheme_smtps;
   }
 
+  DEBUGASSERT(!smtpc->ssldone);
   result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssldone);
-  if(!result) {
+  DEBUGF(infof(data, "smtp_perform_upgrade_tls, connect -> %d, %d",
+               (int)result, ssldone));
+  if(!result && ssldone) {
     smtpc->ssldone = ssldone;
-    if(smtpc->state != SMTP_UPGRADETLS)
-      smtp_state(data, SMTP_UPGRADETLS);
-
-    if(smtpc->ssldone) {
-      smtp_to_smtps(conn);
-      result = smtp_perform_ehlo(data);
-    }
+    /* perform EHLO now, changes smtp->state out of SMTP_UPGRADETLS */
+    result = smtp_perform_ehlo(data, smtpc);
   }
 out:
   return result;
+#else
+  (void)data;
+  (void)smtpc;
+  return CURLE_NOT_BUILT_IN;
+#endif
 }
 
 /***********************************************************************
@@ -430,8 +727,12 @@ static CURLcode smtp_perform_auth(struct Curl_easy *data,
                                   const struct bufref *initresp)
 {
   CURLcode result = CURLE_OK;
-  struct smtp_conn *smtpc = &data->conn->proto.smtpc;
-  const char *ir = (const char *) Curl_bufref_ptr(initresp);
+  struct smtp_conn *smtpc =
+    Curl_conn_meta_get(data->conn, CURL_META_SMTP_CONN);
+  const char *ir = Curl_bufref_ptr(initresp);
+
+  if(!smtpc)
+    return CURLE_FAILED_INIT;
 
   if(ir) {                                  /* AUTH <mech> ...<crlf> */
     /* Send the AUTH command with the initial response */
@@ -455,12 +756,13 @@ static CURLcode smtp_continue_auth(struct Curl_easy *data,
                                    const char *mech,
                                    const struct bufref *resp)
 {
-  struct smtp_conn *smtpc = &data->conn->proto.smtpc;
+  struct smtp_conn *smtpc =
+    Curl_conn_meta_get(data->conn, CURL_META_SMTP_CONN);
 
   (void)mech;
-
-  return Curl_pp_sendf(data, &smtpc->pp,
-                       "%s", (const char *) Curl_bufref_ptr(resp));
+  if(!smtpc)
+    return CURLE_FAILED_INIT;
+  return Curl_pp_sendf(data, &smtpc->pp, "%s", Curl_bufref_ptr(resp));
 }
 
 /***********************************************************************
@@ -471,10 +773,12 @@ static CURLcode smtp_continue_auth(struct Curl_easy *data,
  */
 static CURLcode smtp_cancel_auth(struct Curl_easy *data, const char *mech)
 {
-  struct smtp_conn *smtpc = &data->conn->proto.smtpc;
+  struct smtp_conn *smtpc =
+    Curl_conn_meta_get(data->conn, CURL_META_SMTP_CONN);
 
   (void)mech;
-
+  if(!smtpc)
+    return CURLE_FAILED_INIT;
   return Curl_pp_sendf(data, &smtpc->pp, "*");
 }
 
@@ -485,18 +789,17 @@ static CURLcode smtp_cancel_auth(struct Curl_easy *data, const char *mech)
  * Initiates the authentication sequence, with the appropriate SASL
  * authentication mechanism.
  */
-static CURLcode smtp_perform_authentication(struct Curl_easy *data)
+static CURLcode smtp_perform_authentication(struct Curl_easy *data,
+                                            struct smtp_conn *smtpc)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct smtp_conn *smtpc = &conn->proto.smtpc;
   saslprogress progress;
 
   /* Check we have enough data to authenticate with, and the
      server supports authentication, and end the connect phase if not */
   if(!smtpc->auth_supported ||
      !Curl_sasl_can_authenticate(&smtpc->sasl, data)) {
-    smtp_state(data, SMTP_STOP);
+    smtp_state(data, smtpc, SMTP_STOP);
     return result;
   }
 
@@ -505,12 +808,9 @@ static CURLcode smtp_perform_authentication(struct Curl_easy *data)
 
   if(!result) {
     if(progress == SASL_INPROGRESS)
-      smtp_state(data, SMTP_AUTH);
-    else {
-      /* Other mechanisms not supported */
-      infof(data, "No known authentication mechanisms supported");
-      result = CURLE_LOGIN_DENIED;
-    }
+      smtp_state(data, smtpc, SMTP_AUTH);
+    else
+      result = Curl_sasl_is_blocked(&smtpc->sasl, data);
   }
 
   return result;
@@ -520,57 +820,58 @@ static CURLcode smtp_perform_authentication(struct Curl_easy *data)
  *
  * smtp_perform_command()
  *
- * Sends a SMTP based command.
+ * Sends an SMTP based command.
  */
-static CURLcode smtp_perform_command(struct Curl_easy *data)
+static CURLcode smtp_perform_command(struct Curl_easy *data,
+                                     struct smtp_conn *smtpc,
+                                     struct SMTP *smtp)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct SMTP *smtp = data->req.p.smtp;
 
   if(smtp->rcpt) {
     /* We notify the server we are sending UTF-8 data if a) it supports the
        SMTPUTF8 extension and b) The mailbox contains UTF-8 characters, in
-       either the local address or host name parts. This is regardless of
-       whether the host name is encoded using IDN ACE */
+       either the local address or hostname parts. This is regardless of
+       whether the hostname is encoded using IDN ACE */
     bool utf8 = FALSE;
 
-    if((!smtp->custom) || (!smtp->custom[0])) {
+    if(!smtp->custom || !smtp->custom[0]) {
       char *address = NULL;
       struct hostname host = { NULL, NULL, NULL, NULL };
+      const char *suffix = "";
 
-      /* Parse the mailbox to verify into the local address and host name
-         parts, converting the host name to an IDN A-label if necessary */
+      /* Parse the mailbox to verify into the local address and hostname
+         parts, converting the hostname to an IDN A-label if necessary */
       result = smtp_parse_address(smtp->rcpt->data,
-                                  &address, &host);
+                                  &address, &host, &suffix);
       if(result)
         return result;
 
       /* Establish whether we should report SMTPUTF8 to the server for this
          mailbox as per RFC-6531 sect. 3.1 point 6 */
-      utf8 = (conn->proto.smtpc.utf8_supported) &&
-             ((host.encalloc) || (!Curl_is_ASCII_name(address)) ||
-              (!Curl_is_ASCII_name(host.name)));
+      utf8 = smtpc->utf8_supported &&
+             (host.encalloc ||
+              !Curl_is_ASCII_name(address) ||
+              !Curl_is_ASCII_name(host.name));
 
-      /* Send the VRFY command (Note: The host name part may be absent when the
+      /* Send the VRFY command (Note: The hostname part may be absent when the
          host is a local system) */
-      result = Curl_pp_sendf(data, &conn->proto.smtpc.pp, "VRFY %s%s%s%s",
+      result = Curl_pp_sendf(data, &smtpc->pp, "VRFY %s%s%s%s",
                              address,
                              host.name ? "@" : "",
                              host.name ? host.name : "",
                              utf8 ? " SMTPUTF8" : "");
 
       Curl_free_idnconverted_hostname(&host);
-      free(address);
+      curlx_free(address);
     }
     else {
       /* Establish whether we should report that we support SMTPUTF8 for EXPN
          commands to the server as per RFC-6531 sect. 3.1 point 6 */
-      utf8 = (conn->proto.smtpc.utf8_supported) &&
-             (!strcmp(smtp->custom, "EXPN"));
+      utf8 = (smtpc->utf8_supported) && (!strcmp(smtp->custom, "EXPN"));
 
       /* Send the custom recipient based command such as the EXPN command */
-      result = Curl_pp_sendf(data, &conn->proto.smtpc.pp,
+      result = Curl_pp_sendf(data, &smtpc->pp,
                              "%s %s%s", smtp->custom,
                              smtp->rcpt->data,
                              utf8 ? " SMTPUTF8" : "");
@@ -578,12 +879,12 @@ static CURLcode smtp_perform_command(struct Curl_easy *data)
   }
   else
     /* Send the non-recipient based command such as HELP */
-    result = Curl_pp_sendf(data, &conn->proto.smtpc.pp, "%s",
+    result = Curl_pp_sendf(data, &smtpc->pp, "%s",
                            smtp->custom && smtp->custom[0] != '\0' ?
                            smtp->custom : "HELP");
 
   if(!result)
-    smtp_state(data, SMTP_COMMAND);
+    smtp_state(data, smtpc, SMTP_COMMAND);
 
   return result;
 }
@@ -594,157 +895,156 @@ static CURLcode smtp_perform_command(struct Curl_easy *data)
  *
  * Sends an MAIL command to initiate the upload of a message.
  */
-static CURLcode smtp_perform_mail(struct Curl_easy *data)
+static CURLcode smtp_perform_mail(struct Curl_easy *data,
+                                  struct smtp_conn *smtpc,
+                                  struct SMTP *smtp)
 {
   char *from = NULL;
   char *auth = NULL;
   char *size = NULL;
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
 
   /* We notify the server we are sending UTF-8 data if a) it supports the
      SMTPUTF8 extension and b) The mailbox contains UTF-8 characters, in
-     either the local address or host name parts. This is regardless of
-     whether the host name is encoded using IDN ACE */
+     either the local address or hostname parts. This is regardless of
+     whether the hostname is encoded using IDN ACE */
   bool utf8 = FALSE;
 
   /* Calculate the FROM parameter */
   if(data->set.str[STRING_MAIL_FROM]) {
     char *address = NULL;
     struct hostname host = { NULL, NULL, NULL, NULL };
+    const char *suffix = "";
 
-    /* Parse the FROM mailbox into the local address and host name parts,
-       converting the host name to an IDN A-label if necessary */
+    /* Parse the FROM mailbox into the local address and hostname parts,
+       converting the hostname to an IDN A-label if necessary */
     result = smtp_parse_address(data->set.str[STRING_MAIL_FROM],
-                                &address, &host);
+                                &address, &host, &suffix);
     if(result)
-      return result;
+      goto out;
 
     /* Establish whether we should report SMTPUTF8 to the server for this
        mailbox as per RFC-6531 sect. 3.1 point 4 and sect. 3.4 */
-    utf8 = (conn->proto.smtpc.utf8_supported) &&
-           ((host.encalloc) || (!Curl_is_ASCII_name(address)) ||
-            (!Curl_is_ASCII_name(host.name)));
+    utf8 = smtpc->utf8_supported &&
+           (host.encalloc ||
+            !Curl_is_ASCII_name(address) ||
+            !Curl_is_ASCII_name(host.name));
 
     if(host.name) {
-      from = aprintf("<%s@%s>", address, host.name);
+      from = curl_maprintf("<%s@%s>%s", address, host.name, suffix);
 
       Curl_free_idnconverted_hostname(&host);
     }
     else
-      /* An invalid mailbox was provided but we'll simply let the server worry
+      /* An invalid mailbox was provided but we let the server worry
          about that and reply with a 501 error */
-      from = aprintf("<%s>", address);
+      from = curl_maprintf("<%s>%s", address, suffix);
 
-    free(address);
+    curlx_free(address);
   }
   else
     /* Null reverse-path, RFC-5321, sect. 3.6.3 */
-    from = strdup("<>");
+    from = curlx_strdup("<>");
 
-  if(!from)
-    return CURLE_OUT_OF_MEMORY;
+  if(!from) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
 
   /* Calculate the optional AUTH parameter */
-  if(data->set.str[STRING_MAIL_AUTH] && conn->proto.smtpc.sasl.authused) {
+  if(data->set.str[STRING_MAIL_AUTH] && smtpc->sasl.authused) {
     if(data->set.str[STRING_MAIL_AUTH][0] != '\0') {
       char *address = NULL;
       struct hostname host = { NULL, NULL, NULL, NULL };
+      const char *suffix = "";
 
-      /* Parse the AUTH mailbox into the local address and host name parts,
-         converting the host name to an IDN A-label if necessary */
+      /* Parse the AUTH mailbox into the local address and hostname parts,
+         converting the hostname to an IDN A-label if necessary */
       result = smtp_parse_address(data->set.str[STRING_MAIL_AUTH],
-                                  &address, &host);
-      if(result) {
-        free(from);
-        return result;
-      }
+                                  &address, &host, &suffix);
+      if(result)
+        goto out;
 
       /* Establish whether we should report SMTPUTF8 to the server for this
          mailbox as per RFC-6531 sect. 3.1 point 4 and sect. 3.4 */
-      if((!utf8) && (conn->proto.smtpc.utf8_supported) &&
-         ((host.encalloc) || (!Curl_is_ASCII_name(address)) ||
-          (!Curl_is_ASCII_name(host.name))))
+      if(!utf8 && smtpc->utf8_supported &&
+         (host.encalloc ||
+          !Curl_is_ASCII_name(address) ||
+          !Curl_is_ASCII_name(host.name)))
         utf8 = TRUE;
 
       if(host.name) {
-        auth = aprintf("<%s@%s>", address, host.name);
+        auth = curl_maprintf("<%s@%s>%s", address, host.name, suffix);
 
         Curl_free_idnconverted_hostname(&host);
       }
       else
-        /* An invalid mailbox was provided but we'll simply let the server
-           worry about it */
-        auth = aprintf("<%s>", address);
-
-      free(address);
+        /* An invalid mailbox was provided but we let the server worry
+           about it */
+        auth = curl_maprintf("<%s>%s", address, suffix);
+      curlx_free(address);
     }
     else
       /* Empty AUTH, RFC-2554, sect. 5 */
-      auth = strdup("<>");
+      auth = curlx_strdup("<>");
 
     if(!auth) {
-      free(from);
-
-      return CURLE_OUT_OF_MEMORY;
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
     }
   }
 
+#ifndef CURL_DISABLE_MIME
   /* Prepare the mime data if some. */
-  if(data->set.mimepost.kind != MIMEKIND_NONE) {
+  if(IS_MIME_POST(data)) {
+    curl_mimepart *postp = data->set.mimepostp;
+
     /* Use the whole structure as data. */
-    data->set.mimepost.flags &= ~MIME_BODY_ONLY;
+    postp->flags &= ~(unsigned int)MIME_BODY_ONLY;
 
     /* Add external headers and mime version. */
-    curl_mime_headers(&data->set.mimepost, data->set.headers, 0);
-    result = Curl_mime_prepare_headers(data, &data->set.mimepost, NULL,
+    curl_mime_headers(postp, data->set.headers, 0);
+    result = Curl_mime_prepare_headers(data, postp, NULL,
                                        NULL, MIMESTRATEGY_MAIL);
 
     if(!result)
       if(!Curl_checkheaders(data, STRCONST("Mime-Version")))
-        result = Curl_mime_add_header(&data->set.mimepost.curlheaders,
+        result = Curl_mime_add_header(&postp->curlheaders,
                                       "Mime-Version: 1.0");
 
-    /* Make sure we will read the entire mime structure. */
     if(!result)
-      result = Curl_mime_rewind(&data->set.mimepost);
-
-    if(result) {
-      free(from);
-      free(auth);
-
-      return result;
-    }
-
-    data->state.infilesize = Curl_mime_size(&data->set.mimepost);
-
-    /* Read from mime structure. */
-    data->state.fread_func = (curl_read_callback) Curl_mime_read;
-    data->state.in = (void *) &data->set.mimepost;
+      result = Curl_creader_set_mime(data, postp);
+    if(result)
+      goto out;
+    data->state.infilesize = Curl_creader_total_length(data);
+  }
+  else
+#endif
+  {
+    result = Curl_creader_set_fread(data, data->state.infilesize);
+    if(result)
+      goto out;
   }
 
   /* Calculate the optional SIZE parameter */
-  if(conn->proto.smtpc.size_supported && data->state.infilesize > 0) {
-    size = aprintf("%" CURL_FORMAT_CURL_OFF_T, data->state.infilesize);
+  if(smtpc->size_supported && data->state.infilesize > 0) {
+    size = curl_maprintf("%" FMT_OFF_T, data->state.infilesize);
 
     if(!size) {
-      free(from);
-      free(auth);
-
-      return CURLE_OUT_OF_MEMORY;
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
     }
   }
 
-  /* If the mailboxes in the FROM and AUTH parameters don't include a UTF-8
+  /* If the mailboxes in the FROM and AUTH parameters do not include a UTF-8
      based address then quickly scan through the recipient list and check if
      any there do, as we need to correctly identify our support for SMTPUTF8
      in the envelope, as per RFC-6531 sect. 3.4 */
-  if(conn->proto.smtpc.utf8_supported && !utf8) {
-    struct SMTP *smtp = data->req.p.smtp;
+  if(smtpc->utf8_supported && !utf8) {
     struct curl_slist *rcpt = smtp->rcpt;
 
     while(rcpt && !utf8) {
-      /* Does the host name contain non-ASCII characters? */
+      /* Does the hostname contain non-ASCII characters? */
       if(!Curl_is_ASCII_name(rcpt->data))
         utf8 = TRUE;
 
@@ -752,23 +1052,29 @@ static CURLcode smtp_perform_mail(struct Curl_easy *data)
     }
   }
 
+  /* Add the client reader doing STMP EOB escaping */
+  result = cr_eob_add(data);
+  if(result)
+    goto out;
+
   /* Send the MAIL command */
-  result = Curl_pp_sendf(data, &conn->proto.smtpc.pp,
+  result = Curl_pp_sendf(data, &smtpc->pp,
                          "MAIL FROM:%s%s%s%s%s%s",
                          from,                 /* Mandatory                 */
                          auth ? " AUTH=" : "", /* Optional on AUTH support  */
-                         auth ? auth : "",     /*                           */
+                         auth ? auth : "",
                          size ? " SIZE=" : "", /* Optional on SIZE support  */
-                         size ? size : "",     /*                           */
+                         size ? size : "",
                          utf8 ? " SMTPUTF8"    /* Internationalised mailbox */
                                : "");          /* included in our envelope  */
 
-  free(from);
-  free(auth);
-  free(size);
+out:
+  curlx_free(from);
+  curlx_free(auth);
+  curlx_free(size);
 
   if(!result)
-    smtp_state(data, SMTP_MAIL);
+    smtp_state(data, smtpc, SMTP_MAIL);
 
   return result;
 }
@@ -780,36 +1086,37 @@ static CURLcode smtp_perform_mail(struct Curl_easy *data)
  * Sends a RCPT TO command for a given recipient as part of the message upload
  * process.
  */
-static CURLcode smtp_perform_rcpt_to(struct Curl_easy *data)
+static CURLcode smtp_perform_rcpt_to(struct Curl_easy *data,
+                                     struct smtp_conn *smtpc,
+                                     struct SMTP *smtp)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct SMTP *smtp = data->req.p.smtp;
   char *address = NULL;
   struct hostname host = { NULL, NULL, NULL, NULL };
+  const char *suffix = "";
 
-  /* Parse the recipient mailbox into the local address and host name parts,
-     converting the host name to an IDN A-label if necessary */
+  /* Parse the recipient mailbox into the local address and hostname parts,
+     converting the hostname to an IDN A-label if necessary */
   result = smtp_parse_address(smtp->rcpt->data,
-                              &address, &host);
+                              &address, &host, &suffix);
   if(result)
     return result;
 
   /* Send the RCPT TO command */
   if(host.name)
-    result = Curl_pp_sendf(data, &conn->proto.smtpc.pp, "RCPT TO:<%s@%s>",
-                           address, host.name);
+    result = Curl_pp_sendf(data, &smtpc->pp, "RCPT TO:<%s@%s>%s",
+                           address, host.name, suffix);
   else
-    /* An invalid mailbox was provided but we'll simply let the server worry
-       about that and reply with a 501 error */
-    result = Curl_pp_sendf(data, &conn->proto.smtpc.pp, "RCPT TO:<%s>",
-                           address);
+    /* An invalid mailbox was provided but we let the server worry about
+       that and reply with a 501 error */
+    result = Curl_pp_sendf(data, &smtpc->pp, "RCPT TO:<%s>%s",
+                           address, suffix);
 
   Curl_free_idnconverted_hostname(&host);
-  free(address);
+  curlx_free(address);
 
   if(!result)
-    smtp_state(data, SMTP_RCPT);
+    smtp_state(data, smtpc, SMTP_RCPT);
 
   return result;
 }
@@ -821,45 +1128,47 @@ static CURLcode smtp_perform_rcpt_to(struct Curl_easy *data)
  * Performs the quit action prior to sclose() being called.
  */
 static CURLcode smtp_perform_quit(struct Curl_easy *data,
-                                  struct connectdata *conn)
+                                  struct smtp_conn *smtpc)
 {
   /* Send the QUIT command */
-  CURLcode result = Curl_pp_sendf(data, &conn->proto.smtpc.pp, "%s", "QUIT");
+  CURLcode result = Curl_pp_sendf(data, &smtpc->pp, "%s", "QUIT");
 
   if(!result)
-    smtp_state(data, SMTP_QUIT);
+    smtp_state(data, smtpc, SMTP_QUIT);
 
   return result;
 }
 
 /* For the initial server greeting */
 static CURLcode smtp_state_servergreet_resp(struct Curl_easy *data,
+                                            struct smtp_conn *smtpc,
                                             int smtpcode,
                                             smtpstate instate)
 {
   CURLcode result = CURLE_OK;
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
-  if(smtpcode/100 != 2) {
+  if(smtpcode / 100 != 2) {
     failf(data, "Got unexpected smtp-server response: %d", smtpcode);
     result = CURLE_WEIRD_SERVER_REPLY;
   }
   else
-    result = smtp_perform_ehlo(data);
+    result = smtp_perform_ehlo(data, smtpc);
 
   return result;
 }
 
 /* For STARTTLS responses */
 static CURLcode smtp_state_starttls_resp(struct Curl_easy *data,
+                                         struct smtp_conn *smtpc,
                                          int smtpcode,
                                          smtpstate instate)
 {
   CURLcode result = CURLE_OK;
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   /* Pipelining in response is forbidden. */
-  if(data->conn->proto.smtpc.pp.cache_size)
+  if(smtpc->pp.overflow)
     return CURLE_WEIRD_SERVER_REPLY;
 
   if(smtpcode != 220) {
@@ -868,30 +1177,30 @@ static CURLcode smtp_state_starttls_resp(struct Curl_easy *data,
       result = CURLE_USE_SSL_FAILED;
     }
     else
-      result = smtp_perform_authentication(data);
+      result = smtp_perform_authentication(data, smtpc);
   }
   else
-    result = smtp_perform_upgrade_tls(data);
+    smtp_state(data, smtpc, SMTP_UPGRADETLS);
 
   return result;
 }
 
 /* For EHLO responses */
 static CURLcode smtp_state_ehlo_resp(struct Curl_easy *data,
-                                     struct connectdata *conn, int smtpcode,
+                                     struct smtp_conn *smtpc,
+                                     int smtpcode,
                                      smtpstate instate)
 {
   CURLcode result = CURLE_OK;
-  struct smtp_conn *smtpc = &conn->proto.smtpc;
-  const char *line = data->state.buffer;
-  size_t len = strlen(line);
+  const char *line = curlx_dyn_ptr(&smtpc->pp.recvbuf);
+  size_t len = smtpc->pp.nfinal;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
-  if(smtpcode/100 != 2 && smtpcode != 1) {
-    if(data->set.use_ssl <= CURLUSESSL_TRY
-       || Curl_conn_is_ssl(conn, FIRSTSOCKET))
-      result = smtp_perform_helo(data, conn);
+  if(smtpcode / 100 != 2 && smtpcode != 1) {
+    if(data->set.use_ssl <= CURLUSESSL_TRY ||
+       Curl_conn_is_ssl(data->conn, FIRSTSOCKET))
+      result = smtp_perform_helo(data, smtpc);
     else {
       failf(data, "Remote access denied: %d", smtpcode);
       result = CURLE_REMOTE_ACCESS_DENIED;
@@ -902,19 +1211,19 @@ static CURLcode smtp_state_ehlo_resp(struct Curl_easy *data,
     len -= 4;
 
     /* Does the server support the STARTTLS capability? */
-    if(len >= 8 && !memcmp(line, "STARTTLS", 8))
+    if(len >= 8 && curl_strnequal(line, "STARTTLS", 8))
       smtpc->tls_supported = TRUE;
 
     /* Does the server support the SIZE capability? */
-    else if(len >= 4 && !memcmp(line, "SIZE", 4))
+    else if(len >= 4 && curl_strnequal(line, "SIZE", 4))
       smtpc->size_supported = TRUE;
 
     /* Does the server support the UTF-8 capability? */
-    else if(len >= 8 && !memcmp(line, "SMTPUTF8", 8))
+    else if(len >= 8 && curl_strnequal(line, "SMTPUTF8", 8))
       smtpc->utf8_supported = TRUE;
 
     /* Does the server support authentication? */
-    else if(len >= 5 && !memcmp(line, "AUTH ", 5)) {
+    else if(len >= 5 && curl_strnequal(line, "AUTH ", 5)) {
       smtpc->auth_supported = TRUE;
 
       /* Advance past the AUTH keyword */
@@ -927,10 +1236,7 @@ static CURLcode smtp_state_ehlo_resp(struct Curl_easy *data,
         size_t wordlen;
         unsigned short mechbit;
 
-        while(len &&
-              (*line == ' ' || *line == '\t' ||
-               *line == '\r' || *line == '\n')) {
-
+        while(len && (ISBLANK(*line) || ISNEWLINE(*line))) {
           line++;
           len--;
         }
@@ -939,9 +1245,8 @@ static CURLcode smtp_state_ehlo_resp(struct Curl_easy *data,
           break;
 
         /* Extract the word */
-        for(wordlen = 0; wordlen < len && line[wordlen] != ' ' &&
-              line[wordlen] != '\t' && line[wordlen] != '\r' &&
-              line[wordlen] != '\n';)
+        for(wordlen = 0; wordlen < len && !ISBLANK(line[wordlen]) &&
+              !ISNEWLINE(line[wordlen]);)
           wordlen++;
 
         /* Test the word for a matching authentication mechanism */
@@ -955,21 +1260,21 @@ static CURLcode smtp_state_ehlo_resp(struct Curl_easy *data,
     }
 
     if(smtpcode != 1) {
-      if(data->set.use_ssl && !Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
-        /* We don't have a SSL/TLS connection yet, but SSL is requested */
+      if(data->set.use_ssl && !Curl_conn_is_ssl(data->conn, FIRSTSOCKET)) {
+        /* We do not have an SSL/TLS connection yet, but SSL is requested */
         if(smtpc->tls_supported)
           /* Switch to TLS connection now */
-          result = smtp_perform_starttls(data, conn);
+          result = smtp_perform_starttls(data, smtpc);
         else if(data->set.use_ssl == CURLUSESSL_TRY)
           /* Fallback and carry on with authentication */
-          result = smtp_perform_authentication(data);
+          result = smtp_perform_authentication(data, smtpc);
         else {
           failf(data, "STARTTLS not supported.");
           result = CURLE_USE_SSL_FAILED;
         }
       }
       else
-        result = smtp_perform_authentication(data);
+        result = smtp_perform_authentication(data, smtpc);
     }
   }
   else {
@@ -981,40 +1286,41 @@ static CURLcode smtp_state_ehlo_resp(struct Curl_easy *data,
 }
 
 /* For HELO responses */
-static CURLcode smtp_state_helo_resp(struct Curl_easy *data, int smtpcode,
+static CURLcode smtp_state_helo_resp(struct Curl_easy *data,
+                                     struct smtp_conn *smtpc,
+                                     int smtpcode,
                                      smtpstate instate)
 {
   CURLcode result = CURLE_OK;
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
-  if(smtpcode/100 != 2) {
+  if(smtpcode / 100 != 2) {
     failf(data, "Remote access denied: %d", smtpcode);
     result = CURLE_REMOTE_ACCESS_DENIED;
   }
   else
     /* End of connect phase */
-    smtp_state(data, SMTP_STOP);
+    smtp_state(data, smtpc, SMTP_STOP);
 
   return result;
 }
 
 /* For SASL authentication responses */
 static CURLcode smtp_state_auth_resp(struct Curl_easy *data,
+                                     struct smtp_conn *smtpc,
                                      int smtpcode,
                                      smtpstate instate)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct smtp_conn *smtpc = &conn->proto.smtpc;
   saslprogress progress;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   result = Curl_sasl_continue(&smtpc->sasl, data, smtpcode, &progress);
   if(!result)
     switch(progress) {
     case SASL_DONE:
-      smtp_state(data, SMTP_STOP);  /* Authenticated */
+      smtp_state(data, smtpc, SMTP_STOP);  /* Authenticated */
       break;
     case SASL_IDLE:            /* No mechanism left after cancellation */
       failf(data, "Authentication cancelled");
@@ -1028,44 +1334,42 @@ static CURLcode smtp_state_auth_resp(struct Curl_easy *data,
 }
 
 /* For command responses */
-static CURLcode smtp_state_command_resp(struct Curl_easy *data, int smtpcode,
+static CURLcode smtp_state_command_resp(struct Curl_easy *data,
+                                        struct smtp_conn *smtpc,
+                                        struct SMTP *smtp,
+                                        int smtpcode,
                                         smtpstate instate)
 {
   CURLcode result = CURLE_OK;
-  struct SMTP *smtp = data->req.p.smtp;
-  char *line = data->state.buffer;
-  size_t len = strlen(line);
+  const char *line = curlx_dyn_ptr(&smtpc->pp.recvbuf);
+  size_t len = smtpc->pp.nfinal;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
-  if((smtp->rcpt && smtpcode/100 != 2 && smtpcode != 553 && smtpcode != 1) ||
-     (!smtp->rcpt && smtpcode/100 != 2 && smtpcode != 1)) {
+  if((smtp->rcpt && smtpcode / 100 != 2 && smtpcode != 553 && smtpcode != 1) ||
+     (!smtp->rcpt && smtpcode / 100 != 2 && smtpcode != 1)) {
     failf(data, "Command failed: %d", smtpcode);
     result = CURLE_WEIRD_SERVER_REPLY;
   }
   else {
-    /* Temporarily add the LF character back and send as body to the client */
-    if(!data->req.no_body) {
-      line[len] = '\n';
-      result = Curl_client_write(data, CLIENTWRITE_BODY, line, len + 1);
-      line[len] = '\0';
-    }
+    if(!data->req.no_body)
+      result = Curl_client_write(data, CLIENTWRITE_BODY, line, len);
 
-    if(smtpcode != 1) {
+    if(!result && (smtpcode != 1)) {
       if(smtp->rcpt) {
         smtp->rcpt = smtp->rcpt->next;
 
         if(smtp->rcpt) {
           /* Send the next command */
-          result = smtp_perform_command(data);
+          result = smtp_perform_command(data, smtpc, smtp);
         }
         else
           /* End of DO phase */
-          smtp_state(data, SMTP_STOP);
+          smtp_state(data, smtpc, SMTP_STOP);
       }
       else
         /* End of DO phase */
-        smtp_state(data, SMTP_STOP);
+        smtp_state(data, smtpc, SMTP_STOP);
     }
   }
 
@@ -1073,41 +1377,44 @@ static CURLcode smtp_state_command_resp(struct Curl_easy *data, int smtpcode,
 }
 
 /* For MAIL responses */
-static CURLcode smtp_state_mail_resp(struct Curl_easy *data, int smtpcode,
+static CURLcode smtp_state_mail_resp(struct Curl_easy *data,
+                                     struct smtp_conn *smtpc,
+                                     struct SMTP *smtp,
+                                     int smtpcode,
                                      smtpstate instate)
 {
   CURLcode result = CURLE_OK;
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
-  if(smtpcode/100 != 2) {
+  if(smtpcode / 100 != 2) {
     failf(data, "MAIL failed: %d", smtpcode);
     result = CURLE_SEND_ERROR;
   }
   else
     /* Start the RCPT TO command */
-    result = smtp_perform_rcpt_to(data);
+    result = smtp_perform_rcpt_to(data, smtpc, smtp);
 
   return result;
 }
 
 /* For RCPT responses */
 static CURLcode smtp_state_rcpt_resp(struct Curl_easy *data,
-                                     struct connectdata *conn, int smtpcode,
+                                     struct smtp_conn *smtpc,
+                                     struct SMTP *smtp,
+                                     int smtpcode,
                                      smtpstate instate)
 {
   CURLcode result = CURLE_OK;
-  struct SMTP *smtp = data->req.p.smtp;
   bool is_smtp_err = FALSE;
   bool is_smtp_blocking_err = FALSE;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
-  is_smtp_err = (smtpcode/100 != 2) ? TRUE : FALSE;
+  is_smtp_err = (smtpcode / 100 != 2);
 
-  /* If there's multiple RCPT TO to be issued, it's possible to ignore errors
+  /* If there is multiple RCPT TO to be issued, it is possible to ignore errors
      and proceed with only the valid addresses. */
-  is_smtp_blocking_err =
-    (is_smtp_err && !data->set.mail_rcpt_allowfails) ? TRUE : FALSE;
+  is_smtp_blocking_err = (is_smtp_err && !data->set.mail_rcpt_allowfails);
 
   if(is_smtp_err) {
     /* Remembering the last failure which we can report if all "RCPT TO" have
@@ -1129,9 +1436,9 @@ static CURLcode smtp_state_rcpt_resp(struct Curl_easy *data,
 
     if(smtp->rcpt)
       /* Send the next RCPT TO command */
-      result = smtp_perform_rcpt_to(data);
+      result = smtp_perform_rcpt_to(data, smtpc, smtp);
     else {
-      /* We weren't able to issue a successful RCPT TO command while going
+      /* We were not able to issue a successful RCPT TO command while going
          over recipients (potentially multiple). Sending back last error. */
       if(!smtp->rcpt_had_ok) {
         failf(data, "RCPT failed: %d (last error)", smtp->rcpt_last_error);
@@ -1139,10 +1446,10 @@ static CURLcode smtp_state_rcpt_resp(struct Curl_easy *data,
       }
       else {
         /* Send the DATA command */
-        result = Curl_pp_sendf(data, &conn->proto.smtpc.pp, "%s", "DATA");
+        result = Curl_pp_sendf(data, &smtpc->pp, "%s", "DATA");
 
         if(!result)
-          smtp_state(data, SMTP_DATA);
+          smtp_state(data, smtpc, SMTP_DATA);
       }
     }
   }
@@ -1151,11 +1458,13 @@ static CURLcode smtp_state_rcpt_resp(struct Curl_easy *data,
 }
 
 /* For DATA response */
-static CURLcode smtp_state_data_resp(struct Curl_easy *data, int smtpcode,
+static CURLcode smtp_state_data_resp(struct Curl_easy *data,
+                                     struct smtp_conn *smtpc,
+                                     int smtpcode,
                                      smtpstate instate)
 {
   CURLcode result = CURLE_OK;
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(smtpcode != 354) {
     failf(data, "DATA failed: %d", smtpcode);
@@ -1166,10 +1475,10 @@ static CURLcode smtp_state_data_resp(struct Curl_easy *data, int smtpcode,
     Curl_pgrsSetUploadSize(data, data->state.infilesize);
 
     /* SMTP upload */
-    Curl_setup_transfer(data, -1, -1, FALSE, FIRSTSOCKET);
+    Curl_xfer_setup_send(data, FIRSTSOCKET);
 
     /* End of DO phase */
-    smtp_state(data, SMTP_STOP);
+    smtp_state(data, smtpc, SMTP_STOP);
   }
 
   return result;
@@ -1178,43 +1487,51 @@ static CURLcode smtp_state_data_resp(struct Curl_easy *data, int smtpcode,
 /* For POSTDATA responses, which are received after the entire DATA
    part has been sent to the server */
 static CURLcode smtp_state_postdata_resp(struct Curl_easy *data,
+                                         struct smtp_conn *smtpc,
                                          int smtpcode,
                                          smtpstate instate)
 {
   CURLcode result = CURLE_OK;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(smtpcode != 250)
     result = CURLE_WEIRD_SERVER_REPLY;
 
   /* End of DONE phase */
-  smtp_state(data, SMTP_STOP);
+  smtp_state(data, smtpc, SMTP_STOP);
 
   return result;
 }
 
-static CURLcode smtp_statemachine(struct Curl_easy *data,
-                                  struct connectdata *conn)
+static CURLcode smtp_pp_statemachine(struct Curl_easy *data,
+                                     struct connectdata *conn)
 {
   CURLcode result = CURLE_OK;
-  curl_socket_t sock = conn->sock[FIRSTSOCKET];
   int smtpcode;
-  struct smtp_conn *smtpc = &conn->proto.smtpc;
-  struct pingpong *pp = &smtpc->pp;
+  struct smtp_conn *smtpc = Curl_conn_meta_get(conn, CURL_META_SMTP_CONN);
+  struct SMTP *smtp = Curl_meta_get(data, CURL_META_SMTP_EASY);
   size_t nread = 0;
 
+  if(!smtpc || !smtp)
+    return CURLE_FAILED_INIT;
+
   /* Busy upgrading the connection; right now all I/O is SSL/TLS, not SMTP */
-  if(smtpc->state == SMTP_UPGRADETLS)
-    return smtp_perform_upgrade_tls(data);
+upgrade_tls:
+  if(smtpc->state == SMTP_UPGRADETLS) {
+    result = smtp_perform_upgrade_tls(data, smtpc);
+    if(result || (smtpc->state == SMTP_UPGRADETLS))
+      return result;
+  }
 
   /* Flush any data that needs to be sent */
-  if(pp->sendleft)
-    return Curl_pp_flushsend(data, pp);
+  if(smtpc->pp.sendleft)
+    return Curl_pp_flushsend(data, &smtpc->pp);
 
   do {
     /* Read the response from the server */
-    result = Curl_pp_readresp(data, sock, pp, &smtpcode, &nread);
+    result = Curl_pp_readresp(data, FIRSTSOCKET, &smtpc->pp,
+                              &smtpcode, &nread);
     if(result)
       return result;
 
@@ -1228,53 +1545,59 @@ static CURLcode smtp_statemachine(struct Curl_easy *data,
     /* We have now received a full SMTP server response */
     switch(smtpc->state) {
     case SMTP_SERVERGREET:
-      result = smtp_state_servergreet_resp(data, smtpcode, smtpc->state);
+      result = smtp_state_servergreet_resp(data, smtpc,
+                                           smtpcode, smtpc->state);
       break;
 
     case SMTP_EHLO:
-      result = smtp_state_ehlo_resp(data, conn, smtpcode, smtpc->state);
+      result = smtp_state_ehlo_resp(data, smtpc, smtpcode, smtpc->state);
       break;
 
     case SMTP_HELO:
-      result = smtp_state_helo_resp(data, smtpcode, smtpc->state);
+      result = smtp_state_helo_resp(data, smtpc, smtpcode, smtpc->state);
       break;
 
     case SMTP_STARTTLS:
-      result = smtp_state_starttls_resp(data, smtpcode, smtpc->state);
+      result = smtp_state_starttls_resp(data, smtpc, smtpcode, smtpc->state);
+      /* During UPGRADETLS, leave the read loop as we need to connect
+       * (e.g. TLS handshake) before we continue sending/receiving. */
+      if(!result && (smtpc->state == SMTP_UPGRADETLS))
+        goto upgrade_tls;
       break;
 
     case SMTP_AUTH:
-      result = smtp_state_auth_resp(data, smtpcode, smtpc->state);
+      result = smtp_state_auth_resp(data, smtpc, smtpcode, smtpc->state);
       break;
 
     case SMTP_COMMAND:
-      result = smtp_state_command_resp(data, smtpcode, smtpc->state);
+      result = smtp_state_command_resp(data, smtpc, smtp,
+                                       smtpcode, smtpc->state);
       break;
 
     case SMTP_MAIL:
-      result = smtp_state_mail_resp(data, smtpcode, smtpc->state);
+      result = smtp_state_mail_resp(data, smtpc, smtp, smtpcode, smtpc->state);
       break;
 
     case SMTP_RCPT:
-      result = smtp_state_rcpt_resp(data, conn, smtpcode, smtpc->state);
+      result = smtp_state_rcpt_resp(data, smtpc, smtp, smtpcode, smtpc->state);
       break;
 
     case SMTP_DATA:
-      result = smtp_state_data_resp(data, smtpcode, smtpc->state);
+      result = smtp_state_data_resp(data, smtpc, smtpcode, smtpc->state);
       break;
 
     case SMTP_POSTDATA:
-      result = smtp_state_postdata_resp(data, smtpcode, smtpc->state);
+      result = smtp_state_postdata_resp(data, smtpc, smtpcode, smtpc->state);
       break;
 
     case SMTP_QUIT:
-      /* fallthrough, just stop! */
     default:
       /* internal error */
-      smtp_state(data, SMTP_STOP);
+      smtp_state(data, smtpc, SMTP_STOP);
       break;
     }
-  } while(!result && smtpc->state != SMTP_STOP && Curl_pp_moredata(pp));
+  } while(!result && smtpc->state != SMTP_STOP &&
+          Curl_pp_moredata(&smtpc->pp));
 
   return result;
 }
@@ -1283,29 +1606,23 @@ static CURLcode smtp_statemachine(struct Curl_easy *data,
 static CURLcode smtp_multi_statemach(struct Curl_easy *data, bool *done)
 {
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct smtp_conn *smtpc = &conn->proto.smtpc;
+  struct smtp_conn *smtpc =
+    Curl_conn_meta_get(data->conn, CURL_META_SMTP_CONN);
 
-  if((conn->handler->flags & PROTOPT_SSL) && !smtpc->ssldone) {
-    bool ssldone = FALSE;
-    result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssldone);
-    smtpc->ssldone = ssldone;
-    if(result || !smtpc->ssldone)
-      return result;
-  }
+  *done = FALSE;
+  if(!smtpc)
+    return CURLE_FAILED_INIT;
 
   result = Curl_pp_statemach(data, &smtpc->pp, FALSE, FALSE);
-  *done = (smtpc->state == SMTP_STOP) ? TRUE : FALSE;
-
+  *done = (smtpc->state == SMTP_STOP);
   return result;
 }
 
 static CURLcode smtp_block_statemach(struct Curl_easy *data,
-                                     struct connectdata *conn,
+                                     struct smtp_conn *smtpc,
                                      bool disconnecting)
 {
   CURLcode result = CURLE_OK;
-  struct smtp_conn *smtpc = &conn->proto.smtpc;
 
   while(smtpc->state != SMTP_STOP && !result)
     result = Curl_pp_statemach(data, &smtpc->pp, TRUE, disconnecting);
@@ -1313,27 +1630,29 @@ static CURLcode smtp_block_statemach(struct Curl_easy *data,
   return result;
 }
 
-/* Allocate and initialize the SMTP struct for the current Curl_easy if
-   required */
-static CURLcode smtp_init(struct Curl_easy *data)
-{
-  CURLcode result = CURLE_OK;
-  struct SMTP *smtp;
-
-  smtp = data->req.p.smtp = calloc(sizeof(struct SMTP), 1);
-  if(!smtp)
-    result = CURLE_OUT_OF_MEMORY;
-
-  return result;
-}
-
 /* For the SMTP "protocol connect" and "doing" phases only */
-static int smtp_getsock(struct Curl_easy *data,
-                        struct connectdata *conn, curl_socket_t *socks)
+static CURLcode smtp_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps)
 {
-  return Curl_pp_getsock(data, &conn->proto.smtpc.pp, socks);
+  struct smtp_conn *smtpc =
+    Curl_conn_meta_get(data->conn, CURL_META_SMTP_CONN);
+  return smtpc ? Curl_pp_pollset(data, &smtpc->pp, ps) : CURLE_OK;
 }
 
+/* SASL parameters for the smtp protocol */
+static const struct SASLproto saslsmtp = {
+  "smtp",               /* The service name */
+  smtp_perform_auth,    /* Send authentication command */
+  smtp_continue_auth,   /* Send authentication continuation */
+  smtp_cancel_auth,     /* Cancel authentication */
+  smtp_get_message,     /* Get SASL response message */
+  512 - 8,              /* Max line len - strlen("AUTH ") - 1 space - crlf */
+  334,                  /* Code received when continuation is expected */
+  235,                  /* Code to receive upon authentication success */
+  SASL_AUTH_DEFAULT,    /* Default mechanisms */
+  SASL_FLAG_BASE64      /* Configuration flags */
+};
+
 /***********************************************************************
  *
  * smtp_connect()
@@ -1346,37 +1665,34 @@ static int smtp_getsock(struct Curl_easy *data,
  */
 static CURLcode smtp_connect(struct Curl_easy *data, bool *done)
 {
+  struct smtp_conn *smtpc =
+    Curl_conn_meta_get(data->conn, CURL_META_SMTP_CONN);
   CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct smtp_conn *smtpc = &conn->proto.smtpc;
-  struct pingpong *pp = &smtpc->pp;
 
   *done = FALSE; /* default to not done yet */
+  if(!smtpc)
+    return CURLE_FAILED_INIT;
 
-  /* We always support persistent connections in SMTP */
-  connkeep(conn, "SMTP default");
-
-  PINGPONG_SETUP(pp, smtp_statemachine, smtp_endofresp);
+  PINGPONG_SETUP(&smtpc->pp, smtp_pp_statemachine, smtp_endofresp);
 
   /* Initialize the SASL storage */
   Curl_sasl_init(&smtpc->sasl, data, &saslsmtp);
 
-  /* Initialise the pingpong layer */
-  Curl_pp_setup(pp);
-  Curl_pp_init(data, pp);
+  /* Initialize the pingpong layer */
+  Curl_pp_init(&smtpc->pp, Curl_pgrs_now(data));
 
   /* Parse the URL options */
-  result = smtp_parse_url_options(conn);
+  result = smtp_parse_url_options(data->conn, smtpc);
   if(result)
     return result;
 
   /* Parse the URL path */
-  result = smtp_parse_url_path(data);
+  result = smtp_parse_url_path(data, smtpc);
   if(result)
     return result;
 
   /* Start off waiting for the server greeting response */
-  smtp_state(data, SMTP_SERVERGREET);
+  smtp_state(data, smtpc, SMTP_SERVERGREET);
 
   result = smtp_multi_statemach(data, done);
 
@@ -1395,78 +1711,39 @@ static CURLcode smtp_connect(struct Curl_easy *data, bool *done)
 static CURLcode smtp_done(struct Curl_easy *data, CURLcode status,
                           bool premature)
 {
+  struct smtp_conn *smtpc =
+    Curl_conn_meta_get(data->conn, CURL_META_SMTP_CONN);
   CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
-  struct SMTP *smtp = data->req.p.smtp;
-  struct pingpong *pp = &conn->proto.smtpc.pp;
-  char *eob;
-  ssize_t len;
-  ssize_t bytes_written;
+  struct SMTP *smtp = Curl_meta_get(data, CURL_META_SMTP_EASY);
 
   (void)premature;
 
+  if(!smtpc)
+    return CURLE_FAILED_INIT;
   if(!smtp)
     return CURLE_OK;
 
   /* Cleanup our per-request based variables */
-  Curl_safefree(smtp->custom);
+  curlx_safefree(smtp->custom);
 
   if(status) {
     connclose(conn, "SMTP done with bad status"); /* marked for closure */
     result = status;         /* use the already set error code */
   }
   else if(!data->set.connect_only && data->set.mail_rcpt &&
-          (data->state.upload || data->set.mimepost.kind)) {
-    /* Calculate the EOB taking into account any terminating CRLF from the
-       previous line of the email or the CRLF of the DATA command when there
-       is "no mail data". RFC-5321, sect. 4.1.1.4.
+          (data->state.upload || IS_MIME_POST(data))) {
 
-       Note: As some SSL backends, such as OpenSSL, will cause Curl_write() to
-       fail when using a different pointer following a previous write, that
-       returned CURLE_AGAIN, we duplicate the EOB now rather than when the
-       bytes written doesn't equal len. */
-    if(smtp->trailing_crlf || !data->state.infilesize) {
-      eob = strdup(&SMTP_EOB[2]);
-      len = SMTP_EOB_LEN - 2;
-    }
-    else {
-      eob = strdup(SMTP_EOB);
-      len = SMTP_EOB_LEN;
-    }
-
-    if(!eob)
-      return CURLE_OUT_OF_MEMORY;
-
-    /* Send the end of block data */
-    result = Curl_write(data, conn->writesockfd, eob, len, &bytes_written);
-    if(result) {
-      free(eob);
-      return result;
-    }
-
-    if(bytes_written != len) {
-      /* The whole chunk was not sent so keep it around and adjust the
-         pingpong structure accordingly */
-      pp->sendthis = eob;
-      pp->sendsize = len;
-      pp->sendleft = len - bytes_written;
-    }
-    else {
-      /* Successfully sent so adjust the response timeout relative to now */
-      pp->response = Curl_now();
-
-      free(eob);
-    }
-
-    smtp_state(data, SMTP_POSTDATA);
+    smtp_state(data, smtpc, SMTP_POSTDATA);
 
     /* Run the state-machine */
-    result = smtp_block_statemach(data, conn, FALSE);
+    result = smtp_block_statemach(data, smtpc, FALSE);
   }
 
   /* Clear the transfer mode for the next request */
   smtp->transfer = PPTRANSFER_BODY;
-
+  CURL_TRC_SMTP(data, "smtp_done(status=%d, premature=%d) -> %d",
+                (int)status, premature, (int)result);
   return result;
 }
 
@@ -1477,14 +1754,16 @@ static CURLcode smtp_done(struct Curl_easy *data, CURLcode status,
  * This is the actual DO function for SMTP. Transfer a mail, send a command
  * or get some data according to the options previously setup.
  */
-static CURLcode smtp_perform(struct Curl_easy *data, bool *connected,
+static CURLcode smtp_perform(struct Curl_easy *data,
+                             struct smtp_conn *smtpc,
+                             struct SMTP *smtp,
+                             bool *connected,
                              bool *dophase_done)
 {
   /* This is SMTP and no proxy */
   CURLcode result = CURLE_OK;
-  struct SMTP *smtp = data->req.p.smtp;
 
-  DEBUGF(infof(data, "DO phase starts"));
+  CURL_TRC_SMTP(data, "smtp_perform(), start");
 
   if(data->req.no_body) {
     /* Requested no body means no transfer */
@@ -1496,10 +1775,10 @@ static CURLcode smtp_perform(struct Curl_easy *data, bool *connected,
   /* Store the first recipient (or NULL if not specified) */
   smtp->rcpt = data->set.mail_rcpt;
 
-  /* Track of whether we've successfully sent at least one RCPT TO command */
+  /* Track of whether we have successfully sent at least one RCPT TO command */
   smtp->rcpt_had_ok = FALSE;
 
-  /* Track of the last error we've received by sending RCPT TO command */
+  /* Track of the last error we have received by sending RCPT TO command */
   smtp->rcpt_last_error = 0;
 
   /* Initial data character is the first character in line: it is implicitly
@@ -1508,24 +1787,73 @@ static CURLcode smtp_perform(struct Curl_easy *data, bool *connected,
   smtp->eob = 2;
 
   /* Start the first command in the DO phase */
-  if((data->state.upload || data->set.mimepost.kind) && data->set.mail_rcpt)
+  if((data->state.upload || IS_MIME_POST(data)) && data->set.mail_rcpt)
     /* MAIL transfer */
-    result = smtp_perform_mail(data);
+    result = smtp_perform_mail(data, smtpc, smtp);
   else
     /* SMTP based command (VRFY, EXPN, NOOP, RSET or HELP) */
-    result = smtp_perform_command(data);
+    result = smtp_perform_command(data, smtpc, smtp);
 
   if(result)
-    return result;
+    goto out;
 
   /* Run the state-machine */
   result = smtp_multi_statemach(data, dophase_done);
 
   *connected = Curl_conn_is_connected(data->conn, FIRSTSOCKET);
 
-  if(*dophase_done)
-    DEBUGF(infof(data, "DO phase is complete"));
+out:
+  CURL_TRC_SMTP(data, "smtp_perform() -> %d, connected=%d, done=%d",
+                (int)result, *connected, *dophase_done);
+  return result;
+}
 
+/* Call this when the DO phase has completed */
+static CURLcode smtp_dophase_done(struct Curl_easy *data,
+                                  struct SMTP *smtp,
+                                  bool connected)
+{
+  (void)connected;
+
+  if(smtp->transfer != PPTRANSFER_BODY)
+    /* no data to transfer */
+    Curl_xfer_setup_nop(data);
+
+  return CURLE_OK;
+}
+
+/***********************************************************************
+ *
+ * smtp_regular_transfer()
+ *
+ * The input argument is already checked for validity.
+ *
+ * Performs all commands done before a regular transfer between a local and a
+ * remote host.
+ */
+static CURLcode smtp_regular_transfer(struct Curl_easy *data,
+                                      struct smtp_conn *smtpc,
+                                      struct SMTP *smtp,
+                                      bool *dophase_done)
+{
+  CURLcode result = CURLE_OK;
+  bool connected = FALSE;
+
+  /* Make sure size is unknown at this point */
+  data->req.size = -1;
+
+  /* Set the progress data */
+  Curl_pgrsReset(data);
+
+  /* Carry out the perform */
+  result = smtp_perform(data, smtpc, smtp, &connected, dophase_done);
+
+  /* Perform post DO phase operations if necessary */
+  if(!result && *dophase_done)
+    result = smtp_dophase_done(data, smtp, connected);
+
+  CURL_TRC_SMTP(data, "smtp_regular_transfer() -> %d, done=%d",
+                (int)result, *dophase_done);
   return result;
 }
 
@@ -1540,16 +1868,24 @@ static CURLcode smtp_perform(struct Curl_easy *data, bool *connected,
  */
 static CURLcode smtp_do(struct Curl_easy *data, bool *done)
 {
+  struct smtp_conn *smtpc =
+    Curl_conn_meta_get(data->conn, CURL_META_SMTP_CONN);
+  struct SMTP *smtp = Curl_meta_get(data, CURL_META_SMTP_EASY);
   CURLcode result = CURLE_OK;
+
+  DEBUGASSERT(data);
+  DEBUGASSERT(data->conn);
   *done = FALSE; /* default to false */
+  if(!smtpc || !smtp)
+    return CURLE_FAILED_INIT;
 
   /* Parse the custom request */
-  result = smtp_parse_custom_request(data);
+  result = smtp_parse_custom_request(data, smtp);
   if(result)
     return result;
 
-  result = smtp_regular_transfer(data, done);
-
+  result = smtp_regular_transfer(data, smtpc, smtp, done);
+  CURL_TRC_SMTP(data, "smtp_do() -> %d, done=%d", (int)result, *done);
   return result;
 }
 
@@ -1564,366 +1900,110 @@ static CURLcode smtp_disconnect(struct Curl_easy *data,
                                 struct connectdata *conn,
                                 bool dead_connection)
 {
-  struct smtp_conn *smtpc = &conn->proto.smtpc;
-  (void)data;
+  struct smtp_conn *smtpc = Curl_conn_meta_get(conn, CURL_META_SMTP_CONN);
+
+  if(!smtpc)
+    return CURLE_FAILED_INIT;
 
   /* We cannot send quit unconditionally. If this connection is stale or
      bad in any way, sending quit and waiting around here will make the
      disconnect wait in vain and cause more problems than we need to. */
 
-  if(!dead_connection && conn->bits.protoconnstart) {
-    if(!smtp_perform_quit(data, conn))
-      (void)smtp_block_statemach(data, conn, TRUE); /* ignore errors on QUIT */
+  if(!dead_connection && conn->bits.protoconnstart &&
+     !Curl_pp_needs_flush(data, &smtpc->pp)) {
+    if(!smtp_perform_quit(data, smtpc))
+      (void)smtp_block_statemach(data, smtpc, TRUE); /* ignore on QUIT */
   }
 
-  /* Disconnect from the server */
-  Curl_pp_disconnect(&smtpc->pp);
-
-  /* Cleanup the SASL module */
-  Curl_sasl_cleanup(conn, smtpc->sasl.authused);
-
-  /* Cleanup our connection based variables */
-  Curl_safefree(smtpc->domain);
-
-  return CURLE_OK;
-}
-
-/* Call this when the DO phase has completed */
-static CURLcode smtp_dophase_done(struct Curl_easy *data, bool connected)
-{
-  struct SMTP *smtp = data->req.p.smtp;
-
-  (void)connected;
-
-  if(smtp->transfer != PPTRANSFER_BODY)
-    /* no data to transfer */
-    Curl_setup_transfer(data, -1, -1, FALSE, -1);
-
+  CURL_TRC_SMTP(data, "smtp_disconnect(), finished");
   return CURLE_OK;
 }
 
 /* Called from multi.c while DOing */
 static CURLcode smtp_doing(struct Curl_easy *data, bool *dophase_done)
 {
-  CURLcode result = smtp_multi_statemach(data, dophase_done);
+  struct SMTP *smtp = Curl_meta_get(data, CURL_META_SMTP_EASY);
+  CURLcode result;
 
+  if(!smtp)
+    return CURLE_FAILED_INIT;
+  result = smtp_multi_statemach(data, dophase_done);
   if(result)
     DEBUGF(infof(data, "DO phase failed"));
   else if(*dophase_done) {
-    result = smtp_dophase_done(data, FALSE /* not connected */);
+    result = smtp_dophase_done(data, smtp, FALSE /* not connected */);
 
     DEBUGF(infof(data, "DO phase is complete"));
   }
 
+  CURL_TRC_SMTP(data, "smtp_doing() -> %d, done=%d", (int)result,
+                *dophase_done);
   return result;
 }
 
-/***********************************************************************
- *
- * smtp_regular_transfer()
- *
- * The input argument is already checked for validity.
- *
- * Performs all commands done before a regular transfer between a local and a
- * remote host.
- */
-static CURLcode smtp_regular_transfer(struct Curl_easy *data,
-                                      bool *dophase_done)
+static void smtp_easy_dtor(void *key, size_t klen, void *entry)
 {
-  CURLcode result = CURLE_OK;
-  bool connected = FALSE;
+  struct SMTP *smtp = entry;
+  (void)key;
+  (void)klen;
+  curlx_free(smtp);
+}
 
-  /* Make sure size is unknown at this point */
-  data->req.size = -1;
-
-  /* Set the progress data */
-  Curl_pgrsSetUploadCounter(data, 0);
-  Curl_pgrsSetDownloadCounter(data, 0);
-  Curl_pgrsSetUploadSize(data, -1);
-  Curl_pgrsSetDownloadSize(data, -1);
-
-  /* Carry out the perform */
-  result = smtp_perform(data, &connected, dophase_done);
-
-  /* Perform post DO phase operations if necessary */
-  if(!result && *dophase_done)
-    result = smtp_dophase_done(data, connected);
-
-  return result;
+static void smtp_conn_dtor(void *key, size_t klen, void *entry)
+{
+  struct smtp_conn *smtpc = entry;
+  (void)key;
+  (void)klen;
+  Curl_pp_disconnect(&smtpc->pp);
+  curlx_safefree(smtpc->domain);
+  curlx_free(smtpc);
 }
 
 static CURLcode smtp_setup_connection(struct Curl_easy *data,
                                       struct connectdata *conn)
 {
-  CURLcode result;
-
-  /* Clear the TLS upgraded flag */
-  conn->bits.tls_upgraded = FALSE;
-
-  /* Initialise the SMTP layer */
-  result = smtp_init(data);
-  if(result)
-    return result;
-
-  return CURLE_OK;
-}
-
-/***********************************************************************
- *
- * smtp_parse_url_options()
- *
- * Parse the URL login options.
- */
-static CURLcode smtp_parse_url_options(struct connectdata *conn)
-{
+  struct smtp_conn *smtpc;
+  struct SMTP *smtp;
   CURLcode result = CURLE_OK;
-  struct smtp_conn *smtpc = &conn->proto.smtpc;
-  const char *ptr = conn->options;
 
-  while(!result && ptr && *ptr) {
-    const char *key = ptr;
-    const char *value;
-
-    while(*ptr && *ptr != '=')
-      ptr++;
-
-    value = ptr + 1;
-
-    while(*ptr && *ptr != ';')
-      ptr++;
-
-    if(strncasecompare(key, "AUTH=", 5))
-      result = Curl_sasl_parse_url_auth_option(&smtpc->sasl,
-                                               value, ptr - value);
-    else
-      result = CURLE_URL_MALFORMAT;
-
-    if(*ptr == ';')
-      ptr++;
+  smtpc = curlx_calloc(1, sizeof(*smtpc));
+  if(!smtpc ||
+     Curl_conn_meta_set(conn, CURL_META_SMTP_CONN, smtpc, smtp_conn_dtor)) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
   }
 
+  smtp = curlx_calloc(1, sizeof(*smtp));
+  if(!smtp ||
+     Curl_meta_set(data, CURL_META_SMTP_EASY, smtp, smtp_easy_dtor))
+    result = CURLE_OUT_OF_MEMORY;
+
+out:
+  CURL_TRC_SMTP(data, "smtp_setup_connection() -> %d", (int)result);
   return result;
 }
 
-/***********************************************************************
- *
- * smtp_parse_url_path()
- *
- * Parse the URL path into separate path components.
+/*
+ * SMTP protocol handler.
  */
-static CURLcode smtp_parse_url_path(struct Curl_easy *data)
-{
-  /* The SMTP struct is already initialised in smtp_connect() */
-  struct connectdata *conn = data->conn;
-  struct smtp_conn *smtpc = &conn->proto.smtpc;
-  const char *path = &data->state.up.path[1]; /* skip leading path */
-  char localhost[HOSTNAME_MAX + 1];
-
-  /* Calculate the path if necessary */
-  if(!*path) {
-    if(!Curl_gethostname(localhost, sizeof(localhost)))
-      path = localhost;
-    else
-      path = "localhost";
-  }
-
-  /* URL decode the path and use it as the domain in our EHLO */
-  return Curl_urldecode(path, 0, &smtpc->domain, NULL, REJECT_CTRL);
-}
-
-/***********************************************************************
- *
- * smtp_parse_custom_request()
- *
- * Parse the custom request.
- */
-static CURLcode smtp_parse_custom_request(struct Curl_easy *data)
-{
-  CURLcode result = CURLE_OK;
-  struct SMTP *smtp = data->req.p.smtp;
-  const char *custom = data->set.str[STRING_CUSTOMREQUEST];
-
-  /* URL decode the custom request */
-  if(custom)
-    result = Curl_urldecode(custom, 0, &smtp->custom, NULL, REJECT_CTRL);
-
-  return result;
-}
-
-/***********************************************************************
- *
- * smtp_parse_address()
- *
- * Parse the fully qualified mailbox address into a local address part and the
- * host name, converting the host name to an IDN A-label, as per RFC-5890, if
- * necessary.
- *
- * Parameters:
- *
- * conn  [in]              - The connection handle.
- * fqma  [in]              - The fully qualified mailbox address (which may or
- *                           may not contain UTF-8 characters).
- * address        [in/out] - A new allocated buffer which holds the local
- *                           address part of the mailbox. This buffer must be
- *                           free'ed by the caller.
- * host           [in/out] - The host name structure that holds the original,
- *                           and optionally encoded, host name.
- *                           Curl_free_idnconverted_hostname() must be called
- *                           once the caller has finished with the structure.
- *
- * Returns CURLE_OK on success.
- *
- * Notes:
- *
- * Should a UTF-8 host name require conversion to IDN ACE and we cannot honor
- * that conversion then we shall return success. This allow the caller to send
- * the data to the server as a U-label (as per RFC-6531 sect. 3.2).
- *
- * If an mailbox '@' separator cannot be located then the mailbox is considered
- * to be either a local mailbox or an invalid mailbox (depending on what the
- * calling function deems it to be) then the input will simply be returned in
- * the address part with the host name being NULL.
- */
-static CURLcode smtp_parse_address(const char *fqma, char **address,
-                                   struct hostname *host)
-{
-  CURLcode result = CURLE_OK;
-  size_t length;
-
-  /* Duplicate the fully qualified email address so we can manipulate it,
-     ensuring it doesn't contain the delimiters if specified */
-  char *dup = strdup(fqma[0] == '<' ? fqma + 1  : fqma);
-  if(!dup)
-    return CURLE_OUT_OF_MEMORY;
-
-  length = strlen(dup);
-  if(length) {
-    if(dup[length - 1] == '>')
-      dup[length - 1] = '\0';
-  }
-
-  /* Extract the host name from the address (if we can) */
-  host->name = strpbrk(dup, "@");
-  if(host->name) {
-    *host->name = '\0';
-    host->name = host->name + 1;
-
-    /* Attempt to convert the host name to IDN ACE */
-    (void) Curl_idnconvert_hostname(host);
-
-    /* If Curl_idnconvert_hostname() fails then we shall attempt to continue
-       and send the host name using UTF-8 rather than as 7-bit ACE (which is
-       our preference) */
-  }
-
-  /* Extract the local address from the mailbox */
-  *address = dup;
-
-  return result;
-}
-
-CURLcode Curl_smtp_escape_eob(struct Curl_easy *data,
-                              const ssize_t nread,
-                              const ssize_t offset)
-{
-  /* When sending a SMTP payload we must detect CRLF. sequences making sure
-     they are sent as CRLF.. instead, as a . on the beginning of a line will
-     be deleted by the server when not part of an EOB terminator and a
-     genuine CRLF.CRLF which isn't escaped will wrongly be detected as end of
-     data by the server
-  */
-  ssize_t i;
-  ssize_t si;
-  struct SMTP *smtp = data->req.p.smtp;
-  char *scratch = data->state.scratch;
-  char *newscratch = NULL;
-  char *oldscratch = NULL;
-  size_t eob_sent;
-
-  /* Do we need to allocate a scratch buffer? */
-  if(!scratch || data->set.crlf) {
-    oldscratch = scratch;
-
-    scratch = newscratch = malloc(2 * data->set.upload_buffer_size);
-    if(!newscratch) {
-      failf(data, "Failed to alloc scratch buffer");
-
-      return CURLE_OUT_OF_MEMORY;
-    }
-  }
-  DEBUGASSERT((size_t)data->set.upload_buffer_size >= (size_t)nread);
-
-  /* Have we already sent part of the EOB? */
-  eob_sent = smtp->eob;
-
-  /* This loop can be improved by some kind of Boyer-Moore style of
-     approach but that is saved for later... */
-  if(offset)
-    memcpy(scratch, data->req.upload_fromhere, offset);
-  for(i = offset, si = offset; i < nread; i++) {
-    if(SMTP_EOB[smtp->eob] == data->req.upload_fromhere[i]) {
-      smtp->eob++;
-
-      /* Is the EOB potentially the terminating CRLF? */
-      if(2 == smtp->eob || SMTP_EOB_LEN == smtp->eob)
-        smtp->trailing_crlf = TRUE;
-      else
-        smtp->trailing_crlf = FALSE;
-    }
-    else if(smtp->eob) {
-      /* A previous substring matched so output that first */
-      memcpy(&scratch[si], &SMTP_EOB[eob_sent], smtp->eob - eob_sent);
-      si += smtp->eob - eob_sent;
-
-      /* Then compare the first byte */
-      if(SMTP_EOB[0] == data->req.upload_fromhere[i])
-        smtp->eob = 1;
-      else
-        smtp->eob = 0;
-
-      eob_sent = 0;
-
-      /* Reset the trailing CRLF flag as there was more data */
-      smtp->trailing_crlf = FALSE;
-    }
-
-    /* Do we have a match for CRLF. as per RFC-5321, sect. 4.5.2 */
-    if(SMTP_EOB_FIND_LEN == smtp->eob) {
-      /* Copy the replacement data to the target buffer */
-      memcpy(&scratch[si], &SMTP_EOB_REPL[eob_sent],
-             SMTP_EOB_REPL_LEN - eob_sent);
-      si += SMTP_EOB_REPL_LEN - eob_sent;
-      smtp->eob = 0;
-      eob_sent = 0;
-    }
-    else if(!smtp->eob)
-      scratch[si++] = data->req.upload_fromhere[i];
-  }
-
-  if(smtp->eob - eob_sent) {
-    /* A substring matched before processing ended so output that now */
-    memcpy(&scratch[si], &SMTP_EOB[eob_sent], smtp->eob - eob_sent);
-    si += smtp->eob - eob_sent;
-  }
-
-  /* Only use the new buffer if we replaced something */
-  if(si != nread) {
-    /* Upload from the new (replaced) buffer instead */
-    data->req.upload_fromhere = scratch;
-
-    /* Save the buffer so it can be freed later */
-    data->state.scratch = scratch;
-
-    /* Free the old scratch buffer */
-    free(oldscratch);
-
-    /* Set the new amount too */
-    data->req.upload_present = si;
-  }
-  else
-    free(newscratch);
-
-  return CURLE_OK;
-}
+const struct Curl_protocol Curl_protocol_smtp = {
+  smtp_setup_connection,            /* setup_connection */
+  smtp_do,                          /* do_it */
+  smtp_done,                        /* done */
+  ZERO_NULL,                        /* do_more */
+  smtp_connect,                     /* connect_it */
+  smtp_multi_statemach,             /* connecting */
+  smtp_doing,                       /* doing */
+  smtp_pollset,                     /* proto_pollset */
+  smtp_pollset,                     /* doing_pollset */
+  ZERO_NULL,                        /* domore_pollset */
+  ZERO_NULL,                        /* perform_pollset */
+  smtp_disconnect,                  /* disconnect */
+  ZERO_NULL,                        /* write_resp */
+  ZERO_NULL,                        /* write_resp_hd */
+  ZERO_NULL,                        /* connection_is_dead */
+  ZERO_NULL,                        /* attach connection */
+  ZERO_NULL,                        /* follow */
+};
 
 #endif /* CURL_DISABLE_SMTP */
diff --git a/third-party/curl/lib/smtp.h b/third-party/curl/lib/smtp.h
index 7a04c21549..75b81979c2 100644
--- a/third-party/curl/lib/smtp.h
+++ b/third-party/curl/lib/smtp.h
@@ -23,78 +23,8 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
-#include "pingpong.h"
-#include "curl_sasl.h"
-
-/****************************************************************************
- * SMTP unique setup
- ***************************************************************************/
-typedef enum {
-  SMTP_STOP,        /* do nothing state, stops the state machine */
-  SMTP_SERVERGREET, /* waiting for the initial greeting immediately after
-                       a connect */
-  SMTP_EHLO,
-  SMTP_HELO,
-  SMTP_STARTTLS,
-  SMTP_UPGRADETLS,  /* asynchronously upgrade the connection to SSL/TLS
-                       (multi mode only) */
-  SMTP_AUTH,
-  SMTP_COMMAND,     /* VRFY, EXPN, NOOP, RSET and HELP */
-  SMTP_MAIL,        /* MAIL FROM */
-  SMTP_RCPT,        /* RCPT TO */
-  SMTP_DATA,
-  SMTP_POSTDATA,
-  SMTP_QUIT,
-  SMTP_LAST         /* never used */
-} smtpstate;
-
-/* This SMTP struct is used in the Curl_easy. All SMTP data that is
-   connection-oriented must be in smtp_conn to properly deal with the fact that
-   perhaps the Curl_easy is changed between the times the connection is
-   used. */
-struct SMTP {
-  curl_pp_transfer transfer;
-  char *custom;            /* Custom Request */
-  struct curl_slist *rcpt; /* Recipient list */
-  int rcpt_last_error;     /* The last error received for RCPT TO command */
-  size_t eob;              /* Number of bytes of the EOB (End Of Body) that
-                              have been received so far */
-  BIT(rcpt_had_ok);        /* Whether any of RCPT TO commands (depends on
-                              total number of recipients) succeeded so far */
-  BIT(trailing_crlf);      /* Specifies if the trailing CRLF is present */
-};
-
-/* smtp_conn is used for struct connection-oriented data in the connectdata
-   struct */
-struct smtp_conn {
-  struct pingpong pp;
-  struct SASL sasl;        /* SASL-related storage */
-  smtpstate state;         /* Always use smtp.c:state() to change state! */
-  char *domain;            /* Client address/name to send in the EHLO */
-  BIT(ssldone);            /* Is connect() over SSL done? */
-  BIT(tls_supported);      /* StartTLS capability supported by server */
-  BIT(size_supported);     /* If server supports SIZE extension according to
-                              RFC 1870 */
-  BIT(utf8_supported);     /* If server supports SMTPUTF8 extension according
-                              to RFC 6531 */
-  BIT(auth_supported);     /* AUTH capability supported by server */
-};
-
-extern const struct Curl_handler Curl_handler_smtp;
-extern const struct Curl_handler Curl_handler_smtps;
-
-/* this is the 5-bytes End-Of-Body marker for SMTP */
-#define SMTP_EOB "\x0d\x0a\x2e\x0d\x0a"
-#define SMTP_EOB_LEN 5
-#define SMTP_EOB_FIND_LEN 3
-
-/* if found in data, replace it with this string instead */
-#define SMTP_EOB_REPL "\x0d\x0a\x2e\x2e"
-#define SMTP_EOB_REPL_LEN 4
-
-CURLcode Curl_smtp_escape_eob(struct Curl_easy *data,
-                              const ssize_t nread,
-                              const ssize_t offset);
+#ifndef CURL_DISABLE_SMTP
+extern const struct Curl_protocol Curl_protocol_smtp;
+#endif
 
 #endif /* HEADER_CURL_SMTP_H */
diff --git a/third-party/curl/lib/sockaddr.h b/third-party/curl/lib/sockaddr.h
index 5a6bb207dc..916360d089 100644
--- a/third-party/curl/lib/sockaddr.h
+++ b/third-party/curl/lib/sockaddr.h
@@ -23,14 +23,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 struct Curl_sockaddr_storage {
   union {
     struct sockaddr sa;
     struct sockaddr_in sa_in;
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
     struct sockaddr_in6 sa_in6;
 #endif
 #ifdef HAVE_STRUCT_SOCKADDR_STORAGE
@@ -41,4 +40,22 @@ struct Curl_sockaddr_storage {
   } buffer;
 };
 
+/*
+ * The Curl_sockaddr_ex structure is libcurl's external API curl_sockaddr
+ * structure with enough space available to directly hold any
+ * protocol-specific address structures. The variable declared here will be
+ * used to pass / receive data to/from the fopensocket callback if this has
+ * been set, before that, it is initialized from parameters.
+ */
+struct Curl_sockaddr_ex {
+  int family;
+  int socktype;
+  int protocol;
+  unsigned int addrlen;
+  union {
+    struct sockaddr sa;
+    struct Curl_sockaddr_storage buf;
+  } addr;
+};
+
 #endif /* HEADER_CURL_SOCKADDR_H */
diff --git a/third-party/curl/lib/socketpair.c b/third-party/curl/lib/socketpair.c
index 963e1406f6..39a0e319b0 100644
--- a/third-party/curl/lib/socketpair.c
+++ b/third-party/curl/lib/socketpair.c
@@ -21,48 +21,130 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+
 #include "socketpair.h"
 #include "urldata.h"
 #include "rand.h"
+#include "curlx/nonblock.h"
 
-#if !defined(HAVE_SOCKETPAIR) && !defined(CURL_DISABLE_SOCKETPAIR)
-#ifdef WIN32
-/*
- * This is a socketpair() implementation for Windows.
- */
-#include <string.h>
-#include <winsock2.h>
-#include <ws2tcpip.h>
-#include <windows.h>
-#include <io.h>
+#ifndef CURL_DISABLE_SOCKETPAIR
+
+/* choose implementation */
+#ifdef USE_EVENTFD
+
+#include <sys/eventfd.h>
+
+static int wakeup_eventfd(curl_socket_t socks[2], bool nonblocking)
+{
+  int efd = eventfd(0, nonblocking ? EFD_CLOEXEC | EFD_NONBLOCK : EFD_CLOEXEC);
+  if(efd == -1) {
+    socks[0] = socks[1] = CURL_SOCKET_BAD;
+    return -1;
+  }
+  socks[0] = socks[1] = efd;
+  return 0;
+}
+
+#elif defined(HAVE_PIPE)
+
+#ifdef HAVE_FCNTL
+#include <fcntl.h>
+#endif
+
+static int wakeup_pipe(curl_socket_t socks[2], bool nonblocking)
+{
+#ifdef HAVE_PIPE2
+  int flags = nonblocking ? O_NONBLOCK | O_CLOEXEC : O_CLOEXEC;
+  if(pipe2(socks, flags))
+    return -1;
 #else
+  if(pipe(socks))
+    return -1;
+#ifdef HAVE_FCNTL
+  if(fcntl(socks[0], F_SETFD, FD_CLOEXEC) ||
+     fcntl(socks[1], F_SETFD, FD_CLOEXEC)) {
+    sclose(socks[0]);
+    sclose(socks[1]);
+    socks[0] = socks[1] = CURL_SOCKET_BAD;
+    return -1;
+  }
+#endif
+  if(nonblocking) {
+    if(curlx_nonblock(socks[0], TRUE) < 0 ||
+       curlx_nonblock(socks[1], TRUE) < 0) {
+      sclose(socks[0]);
+      sclose(socks[1]);
+      socks[0] = socks[1] = CURL_SOCKET_BAD;
+      return -1;
+    }
+  }
+#endif
+
+  return 0;
+}
+
+#elif defined(HAVE_SOCKETPAIR)  /* !USE_EVENTFD && !HAVE_PIPE */
+
+#ifndef USE_UNIX_SOCKETS
+#error "unsupported Unix domain and socketpair build combo"
+#endif
+
+static int wakeup_socketpair(curl_socket_t socks[2], bool nonblocking)
+{
+  int type = SOCK_STREAM;
+#ifdef SOCK_CLOEXEC
+  type |= SOCK_CLOEXEC;
+#endif
+#ifdef SOCK_NONBLOCK
+  if(nonblocking)
+    type |= SOCK_NONBLOCK;
+#endif
+
+  if(CURL_SOCKETPAIR(AF_UNIX, type, 0, socks))
+    return -1;
+#ifndef SOCK_NONBLOCK
+  if(nonblocking) {
+    if(curlx_nonblock(socks[0], TRUE) < 0 ||
+       curlx_nonblock(socks[1], TRUE) < 0) {
+      sclose(socks[0]);
+      sclose(socks[1]);
+      socks[0] = socks[1] = CURL_SOCKET_BAD;
+      return -1;
+    }
+  }
+#endif
+#ifdef USE_SO_NOSIGPIPE
+  if(Curl_sock_nosigpipe(socks[1]) < 0) {
+    sclose(socks[0]);
+    sclose(socks[1]);
+    socks[0] = socks[1] = CURL_SOCKET_BAD;
+    return -1;
+  }
+#endif /* USE_SO_NOSIGPIPE */
+
+  return 0;
+}
+
+#else /* !USE_EVENTFD && !HAVE_PIPE && !HAVE_SOCKETPAIR */
+
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
 #endif
 #ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h> /* IPPROTO_TCP */
+#include <netinet/in.h> /* for IPPROTO_TCP */
 #endif
 #ifdef HAVE_ARPA_INET_H
 #include <arpa/inet.h>
 #endif
+
 #ifndef INADDR_LOOPBACK
 #define INADDR_LOOPBACK 0x7f000001
-#endif /* !INADDR_LOOPBACK */
-#endif /* !WIN32 */
+#endif
 
-#include "nonblock.h" /* for curlx_nonblock */
-#include "timeval.h"  /* needed before select.h */
 #include "select.h"   /* for Curl_poll */
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-int Curl_socketpair(int domain, int type, int protocol,
-                    curl_socket_t socks[2])
+static int wakeup_inet(curl_socket_t socks[2], bool nonblocking)
 {
   union {
     struct sockaddr_in inaddr;
@@ -72,11 +154,8 @@ int Curl_socketpair(int domain, int type, int protocol,
   curl_socklen_t addrlen = sizeof(a.inaddr);
   int reuse = 1;
   struct pollfd pfd[1];
-  (void)domain;
-  (void)type;
-  (void)protocol;
 
-  listener = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+  listener = CURL_SOCKET(AF_INET, SOCK_STREAM, IPPROTO_TCP);
   if(listener == CURL_SOCKET_BAD)
     return -1;
 
@@ -87,8 +166,8 @@ int Curl_socketpair(int domain, int type, int protocol,
 
   socks[0] = socks[1] = CURL_SOCKET_BAD;
 
-#if defined(WIN32) || defined(__CYGWIN__)
-  /* don't set SO_REUSEADDR on Windows */
+#if defined(_WIN32) || defined(__CYGWIN__)
+  /* do not set SO_REUSEADDR on Windows */
   (void)reuse;
 #ifdef SO_EXCLUSIVEADDRUSE
   {
@@ -110,24 +189,24 @@ int Curl_socketpair(int domain, int type, int protocol,
     goto error;
   if(listen(listener, 1) == -1)
     goto error;
-  socks[0] = socket(AF_INET, SOCK_STREAM, 0);
+  socks[0] = CURL_SOCKET(AF_INET, SOCK_STREAM, 0);
   if(socks[0] == CURL_SOCKET_BAD)
     goto error;
   if(connect(socks[0], &a.addr, sizeof(a.inaddr)) == -1)
     goto error;
 
-  /* use non-blocking accept to make sure we don't block forever */
+  /* use non-blocking accept to make sure we do not block forever */
   if(curlx_nonblock(listener, TRUE) < 0)
     goto error;
   pfd[0].fd = listener;
   pfd[0].events = POLLIN;
   pfd[0].revents = 0;
   (void)Curl_poll(pfd, 1, 1000); /* one second */
-  socks[1] = accept(listener, NULL, NULL);
+  socks[1] = CURL_ACCEPT(listener, NULL, NULL);
   if(socks[1] == CURL_SOCKET_BAD)
     goto error;
   else {
-    struct curltime start = Curl_now();
+    struct curltime start = curlx_now();
     char rnd[9];
     char check[sizeof(rnd)];
     char *p = &check[0];
@@ -150,19 +229,12 @@ int Curl_socketpair(int domain, int type, int protocol,
       nread = sread(socks[1], p, s);
       if(nread == -1) {
         int sockerr = SOCKERRNO;
-        /* Don't block forever */
-        if(Curl_timediff(Curl_now(), start) > (60 * 1000))
+        /* Do not block forever */
+        if(curlx_timediff_ms(curlx_now(), start) > (60 * 1000))
           goto error;
-        if(
-#ifdef WSAEWOULDBLOCK
-          /* This is how Windows does it */
-          (WSAEWOULDBLOCK == sockerr)
-#else
-          /* errno may be EWOULDBLOCK or on some systems EAGAIN when it
-             returned due to its inability to send off data without
-             blocking. We therefore treat both error codes the same here */
-          (EWOULDBLOCK == sockerr) || (EAGAIN == sockerr) ||
-          (EINTR == sockerr) || (EINPROGRESS == sockerr)
+        if(SOCK_EAGAIN(sockerr)
+#ifndef USE_WINSOCK
+           || (sockerr == SOCKEINTR) || (sockerr == SOCKEINPROGRESS)
 #endif
           ) {
           continue;
@@ -180,6 +252,14 @@ int Curl_socketpair(int domain, int type, int protocol,
     } while(1);
   }
 
+  if(nonblocking)
+    if(curlx_nonblock(socks[0], TRUE) < 0 ||
+       curlx_nonblock(socks[1], TRUE) < 0)
+      goto error;
+#ifdef USE_SO_NOSIGPIPE
+  if(Curl_sock_nosigpipe(socks[1]) < 0)
+    goto error;
+#endif
   sclose(listener);
   return 0;
 
@@ -187,7 +267,98 @@ error:
   sclose(listener);
   sclose(socks[0]);
   sclose(socks[1]);
+  socks[0] = socks[1] = CURL_SOCKET_BAD;
   return -1;
 }
 
-#endif /* ! HAVE_SOCKETPAIR */
+#endif /* choose implementation */
+
+int Curl_wakeup_init(curl_socket_t socks[2], bool nonblocking)
+{
+#ifdef USE_EVENTFD
+  return wakeup_eventfd(socks, nonblocking);
+#elif defined(HAVE_PIPE)
+  return wakeup_pipe(socks, nonblocking);
+#elif defined(HAVE_SOCKETPAIR)
+  return wakeup_socketpair(socks, nonblocking);
+#else
+  return wakeup_inet(socks, nonblocking);
+#endif
+}
+
+#if defined(USE_EVENTFD) || defined(HAVE_PIPE)
+
+#define wakeup_write        write
+#define wakeup_read         read
+#define wakeup_close        close
+
+#else /* !USE_EVENTFD && !HAVE_PIPE */
+
+#define wakeup_write        swrite
+#define wakeup_read         sread
+#define wakeup_close        sclose
+
+#endif
+
+int Curl_wakeup_signal(curl_socket_t socks[2])
+{
+  int sockerr = 0;
+#ifdef USE_EVENTFD
+  const uint64_t buf[1] = { 1 };
+#else
+  const char buf[1] = { 1 };
+#endif
+
+  while(1) {
+    sockerr = 0;
+    if(wakeup_write(socks[1], buf, sizeof(buf)) < 0) {
+      sockerr = SOCKERRNO;
+#ifndef USE_WINSOCK
+      if(sockerr == SOCKEINTR)
+        continue;
+#endif
+      if(SOCK_EAGAIN(sockerr))
+        sockerr = 0; /* wakeup is already ongoing */
+    }
+    break;
+  }
+  return sockerr;
+}
+
+CURLcode Curl_wakeup_consume(curl_socket_t socks[2], bool all)
+{
+  char buf[64];
+  ssize_t rc;
+  CURLcode result = CURLE_OK;
+
+  do {
+    rc = wakeup_read(socks[0], buf, sizeof(buf));
+    if(!rc)
+      break;
+    else if(rc < 0) {
+      int sockerr = SOCKERRNO;
+#ifndef USE_WINSOCK
+      if(sockerr == SOCKEINTR)
+        continue;
+#endif
+      if(SOCK_EAGAIN(sockerr))
+        break;
+      result = CURLE_READ_ERROR;
+      break;
+    }
+  } while(all);
+  return result;
+}
+
+void Curl_wakeup_destroy(curl_socket_t socks[2])
+{
+#ifndef USE_EVENTFD
+  if(socks[1] != CURL_SOCKET_BAD)
+    wakeup_close(socks[1]);
+#endif
+  if(socks[0] != CURL_SOCKET_BAD)
+    wakeup_close(socks[0]);
+  socks[0] = socks[1] = CURL_SOCKET_BAD;
+}
+
+#endif /* !CURL_DISABLE_SOCKETPAIR */
diff --git a/third-party/curl/lib/socketpair.h b/third-party/curl/lib/socketpair.h
index 306ab5dc4c..fd08c879da 100644
--- a/third-party/curl/lib/socketpair.h
+++ b/third-party/curl/lib/socketpair.h
@@ -23,15 +23,21 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
-#ifndef HAVE_SOCKETPAIR
-#include <curl/curl.h>
 
-int Curl_socketpair(int domain, int type, int protocol,
-                    curl_socket_t socks[2]);
+#ifndef CURL_DISABLE_SOCKETPAIR
+
+/* return < 0 for failure to initialize */
+int Curl_wakeup_init(curl_socket_t socks[2], bool nonblocking);
+void Curl_wakeup_destroy(curl_socket_t socks[2]);
+
+/* return 0 on success or errno on failure */
+int Curl_wakeup_signal(curl_socket_t socks[2]);
+
+CURLcode Curl_wakeup_consume(curl_socket_t socks[2], bool all);
+
 #else
-#define Curl_socketpair(a,b,c,d) socketpair(a,b,c,d)
+#define Curl_wakeup_destroy(x) Curl_nop_stmt
 #endif
 
 #endif /* HEADER_CURL_SOCKETPAIR_H */
diff --git a/third-party/curl/lib/socks.c b/third-party/curl/lib/socks.c
index c492d663c4..6c458c505d 100644
--- a/third-party/curl/lib/socks.c
+++ b/third-party/curl/lib/socks.c
@@ -21,10 +21,9 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#if !defined(CURL_DISABLE_PROXY)
+#ifndef CURL_DISABLE_PROXY
 
 #ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
@@ -34,52 +33,80 @@
 #endif
 
 #include "urldata.h"
-#include "sendf.h"
+#include "bufq.h"
+#include "curl_addrinfo.h"
+#include "curl_trc.h"
 #include "select.h"
 #include "cfilters.h"
+#include "cf-dns.h"
 #include "connect.h"
-#include "timeval.h"
 #include "socks.h"
-#include "multiif.h" /* for getsock macros */
-#include "inet_pton.h"
-#include "url.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curlx/inet_pton.h"
 
 /* for the (SOCKS) connect state machine */
-enum connect_t {
-  CONNECT_INIT,
-  CONNECT_SOCKS_INIT, /* 1 */
-  CONNECT_SOCKS_SEND, /* 2 waiting to send more first data */
-  CONNECT_SOCKS_READ_INIT, /* 3 set up read */
-  CONNECT_SOCKS_READ, /* 4 read server response */
-  CONNECT_GSSAPI_INIT, /* 5 */
-  CONNECT_AUTH_INIT, /* 6 setup outgoing auth buffer */
-  CONNECT_AUTH_SEND, /* 7 send auth */
-  CONNECT_AUTH_READ, /* 8 read auth response */
-  CONNECT_REQ_INIT,  /* 9 init SOCKS "request" */
-  CONNECT_RESOLVING, /* 10 */
-  CONNECT_RESOLVED,  /* 11 */
-  CONNECT_RESOLVE_REMOTE, /* 12 */
-  CONNECT_REQ_SEND,  /* 13 */
-  CONNECT_REQ_SENDING, /* 14 */
-  CONNECT_REQ_READ,  /* 15 */
-  CONNECT_REQ_READ_MORE, /* 16 */
-  CONNECT_DONE /* 17 connected fine to the remote or the SOCKS proxy */
+enum socks_state_t {
+  SOCKS_ST_INIT,
+  /* SOCKS Version 4 states */
+  SOCKS4_ST_START,
+  SOCKS4_ST_RESOLVING,
+  SOCKS4_ST_SEND,
+  SOCKS4_ST_RECV,
+  /* SOCKS Version 5 states */
+  SOCKS5_ST_START,
+  SOCKS5_ST_REQ0_SEND,
+  SOCKS5_ST_RESP0_RECV, /* set up read */
+  SOCKS5_ST_GSSAPI_INIT,
+  SOCKS5_ST_AUTH_INIT, /* setup outgoing auth buffer */
+  SOCKS5_ST_AUTH_SEND, /* send auth */
+  SOCKS5_ST_AUTH_RECV, /* read auth response */
+  SOCKS5_ST_REQ1_INIT,  /* init SOCKS "request" */
+  SOCKS5_ST_RESOLVING,
+  SOCKS5_ST_REQ1_SEND,
+  SOCKS5_ST_RESP1_RECV,
+  /* Terminal states, all SOCKS versions */
+  SOCKS_ST_SUCCESS,
+  SOCKS_ST_FAILED
 };
 
-struct socks_state {
-  enum connect_t state;
-  ssize_t outstanding;  /* send this many bytes more */
-  unsigned char *outp; /* send from this pointer */
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
+static const char * const cf_socks_statename[] = {
+  "SOCKS_INIT",
+  "SOCKS4_START",
+  "SOCKS4_RESOLVING",
+  "SOCKS4_SEND",
+  "SOCKS4_RECV",
+  "SOCKS5_START",
+  "SOCKS5_REQ0_SEND",
+  "SOCKS5_RESP0_RECV",
+  "SOCKS5_GSSAPI_INIT",
+  "SOCKS5_AUTH_INIT",
+  "SOCKS5_AUTH_SEND",
+  "SOCKS5_AUTH_RECV",
+  "SOCKS5_REQ1_INIT",
+  "SOCKS5_RESOLVING",
+  "SOCKS5_REQ1_SEND",
+  "SOCKS5_RESP1_RECV",
+  "SOCKS_SUCCESS",
+  "SOCKS_FAILED"
+};
+#endif
 
-  const char *hostname;
-  int remote_port;
-  const char *proxy_user;
-  const char *proxy_password;
+#define SOCKS_CHUNK_SIZE    1024
+#define SOCKS_CHUNKS        1
+
+struct socks_ctx {
+  enum socks_state_t state;
+  struct bufq iobuf;
+  struct Curl_peer *dest;
+  struct Curl_creds *creds;
+  CURLproxycode presult;
+  uint32_t resolv_id;
+  uint8_t ip_version;
+  uint8_t proxy_type;
+  unsigned char version;
+  BIT(resolve_local);
+  BIT(start_resolving);
+  BIT(socks4a);
 };
 
 #if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
@@ -89,388 +116,273 @@ struct socks_state {
  *
  * This is STUPID BLOCKING behavior. Only used by the SOCKS GSSAPI functions.
  */
-int Curl_blockread_all(struct Curl_cfilter *cf,
-                       struct Curl_easy *data,   /* transfer */
-                       char *buf,                /* store read data here */
-                       ssize_t buffersize,       /* max amount to read */
-                       ssize_t *n)               /* amount bytes read */
+CURLcode Curl_blockread_all(struct Curl_cfilter *cf,
+                            struct Curl_easy *data,
+                            char *buf,             /* store read data here */
+                            size_t blen,           /* space in buf */
+                            size_t *pnread)        /* amount bytes read */
 {
-  ssize_t nread = 0;
-  ssize_t allread = 0;
-  int result;
-  CURLcode err = CURLE_OK;
+  size_t nread = 0;
+  CURLcode result;
 
-  *n = 0;
+  *pnread = 0;
   for(;;) {
-    timediff_t timeout_ms = Curl_timeleft(data, NULL, TRUE);
+    timediff_t timeout_ms = Curl_timeleft_ms(data);
+    curl_socket_t sock = Curl_conn_cf_get_socket(cf, data);
+
     if(timeout_ms < 0) {
       /* we already got the timeout */
-      result = CURLE_OPERATION_TIMEDOUT;
-      break;
+      return CURLE_OPERATION_TIMEDOUT;
     }
     if(!timeout_ms)
       timeout_ms = TIMEDIFF_T_MAX;
-    if(SOCKET_READABLE(cf->conn->sock[cf->sockindex], timeout_ms) <= 0) {
-      result = ~CURLE_OK;
-      break;
-    }
-    nread = Curl_conn_cf_recv(cf->next, data, buf, buffersize, &err);
-    if(nread <= 0) {
-      result = err;
-      if(CURLE_AGAIN == err)
-        continue;
-      if(err) {
-        break;
-      }
-    }
+    if(SOCKET_READABLE(sock, timeout_ms) <= 0)
+      return CURLE_OPERATION_TIMEDOUT;
+    result = Curl_conn_cf_recv(cf->next, data, buf, blen, &nread);
+    if(result == CURLE_AGAIN)
+      continue;
+    else if(result)
+      return result;
 
-    if(buffersize == nread) {
-      allread += nread;
-      *n = allread;
-      result = CURLE_OK;
-      break;
-    }
-    if(!nread) {
-      result = ~CURLE_OK;
-      break;
+    if(blen == nread) {
+      *pnread += nread;
+      return CURLE_OK;
     }
+    if(!nread) /* EOF */
+      return CURLE_RECV_ERROR;
 
-    buffersize -= nread;
     buf += nread;
-    allread += nread;
+    blen -= nread;
+    *pnread += nread;
   }
-  return result;
 }
 #endif
 
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
-#define DEBUG_AND_VERBOSE
-#define sxstate(x,d,y) socksstate(x,d,y, __LINE__)
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
+#define sxstate(x, c, d, y) socksstate(x, c, d, y, __LINE__)
 #else
-#define sxstate(x,d,y) socksstate(x,d,y)
+#define sxstate(x, c, d, y) socksstate(x, c, d, y)
 #endif
 
 /* always use this function to change state, to make debugging easier */
-static void socksstate(struct socks_state *sx, struct Curl_easy *data,
-                       enum connect_t state
-#ifdef DEBUG_AND_VERBOSE
+static void socksstate(struct socks_ctx *sx,
+                       struct Curl_cfilter *cf,
+                       struct Curl_easy *data,
+                       enum socks_state_t state
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
                        , int lineno
 #endif
 )
 {
-  enum connect_t oldstate = sx->state;
-#ifdef DEBUG_AND_VERBOSE
-  /* synced with the state list in urldata.h */
-  static const char * const socks_statename[] = {
-    "INIT",
-    "SOCKS_INIT",
-    "SOCKS_SEND",
-    "SOCKS_READ_INIT",
-    "SOCKS_READ",
-    "GSSAPI_INIT",
-    "AUTH_INIT",
-    "AUTH_SEND",
-    "AUTH_READ",
-    "REQ_INIT",
-    "RESOLVING",
-    "RESOLVED",
-    "RESOLVE_REMOTE",
-    "REQ_SEND",
-    "REQ_SENDING",
-    "REQ_READ",
-    "REQ_READ_MORE",
-    "DONE"
-  };
-#endif
+  enum socks_state_t oldstate = sx->state;
 
-  (void)data;
   if(oldstate == state)
-    /* don't bother when the new state is the same as the old state */
+    /* do not bother when the new state is the same as the old state */
     return;
 
   sx->state = state;
 
-#ifdef DEBUG_AND_VERBOSE
-  infof(data,
-        "SXSTATE: %s => %s; line %d",
-        socks_statename[oldstate], socks_statename[sx->state],
-        lineno);
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
+  CURL_TRC_CF(data, cf, "[%s] -> [%s] (line %d)",
+              cf_socks_statename[oldstate],
+              cf_socks_statename[sx->state], lineno);
+#else
+  (void)cf;
+  (void)data;
 #endif
 }
 
-static CURLproxycode socks_state_send(struct Curl_cfilter *cf,
-                                      struct socks_state *sx,
-                                      struct Curl_easy *data,
-                                      CURLproxycode failcode,
-                                      const char *description)
+static CURLproxycode socks_failed(struct socks_ctx *sx,
+                                  struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  CURLproxycode presult)
 {
-  ssize_t nwritten;
-  CURLcode result;
+  sxstate(sx, cf, data, SOCKS_ST_FAILED);
+  sx->presult = presult;
+  return presult;
+}
 
-  nwritten = Curl_conn_cf_send(cf->next, data, (char *)sx->outp,
-                               sx->outstanding, &result);
-  if(nwritten <= 0) {
-    if(CURLE_AGAIN == result) {
+static CURLproxycode socks_flush(struct socks_ctx *sx,
+                                 struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 bool *done)
+{
+  CURLcode result;
+  size_t nwritten;
+
+  *done = FALSE;
+  while(!Curl_bufq_is_empty(&sx->iobuf)) {
+    result = Curl_cf_send_bufq(cf->next, data, &sx->iobuf, NULL, 0,
+                               &nwritten);
+    if(result == CURLE_AGAIN)
       return CURLPX_OK;
+    else if(result) {
+      failf(data, "Failed to send SOCKS request: %s",
+            curl_easy_strerror(result));
+      return socks_failed(sx, cf, data, CURLPX_SEND_CONNECT);
     }
-    else if(CURLE_OK == result) {
-      /* connection closed */
-      failf(data, "connection to proxy closed");
-      return CURLPX_CLOSED;
-    }
-    failf(data, "Failed to send %s: %s", description,
-          curl_easy_strerror(result));
-    return failcode;
   }
-  DEBUGASSERT(sx->outstanding >= nwritten);
-  /* not done, remain in state */
-  sx->outstanding -= nwritten;
-  sx->outp += nwritten;
+  *done = TRUE;
   return CURLPX_OK;
 }
 
-static CURLproxycode socks_state_recv(struct Curl_cfilter *cf,
-                                      struct socks_state *sx,
-                                      struct Curl_easy *data,
-                                      CURLproxycode failcode,
-                                      const char *description)
+static CURLproxycode socks_recv(struct socks_ctx *sx,
+                                struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                size_t min_bytes,
+                                bool *done)
 {
-  ssize_t nread;
   CURLcode result;
+  size_t nread;
 
-  nread = Curl_conn_cf_recv(cf->next, data, (char *)sx->outp,
-                            sx->outstanding, &result);
-  if(nread <= 0) {
-    if(CURLE_AGAIN == result) {
+  *done = FALSE;
+  while(Curl_bufq_len(&sx->iobuf) < min_bytes) {
+    result = Curl_cf_recv_bufq(cf->next, data, &sx->iobuf,
+                               min_bytes - Curl_bufq_len(&sx->iobuf),
+                               &nread);
+    if(result == CURLE_AGAIN)
       return CURLPX_OK;
+    else if(result) {
+      failf(data, "Failed to receive SOCKS response: %s",
+            curl_easy_strerror(result));
+      return CURLPX_RECV_CONNECT;
     }
-    else if(CURLE_OK == result) {
-      /* connection closed */
-      failf(data, "connection to proxy closed");
-      return CURLPX_CLOSED;
+    else if(!nread) { /* EOF */
+      if(Curl_bufq_len(&sx->iobuf) < min_bytes) {
+        failf(data, "Failed to receive SOCKS response, "
+              "proxy closed connection");
+        return CURLPX_RECV_CONNECT;
+      }
+      break;
     }
-    failf(data, "SOCKS4: Failed receiving %s: %s", description,
-          curl_easy_strerror(result));
-    return failcode;
   }
-  /* remain in reading state */
-  DEBUGASSERT(sx->outstanding >= nread);
-  sx->outstanding -= nread;
-  sx->outp += nread;
+  *done = TRUE;
   return CURLPX_OK;
 }
 
-/*
-* This function logs in to a SOCKS4 proxy and sends the specifics to the final
-* destination server.
-*
-* Reference :
-*   https://www.openssh.com/txt/socks4.protocol
-*
-* Note :
-*   Set protocol4a=true for  "SOCKS 4A (Simple Extension to SOCKS 4 Protocol)"
-*   Nonsupport "Identification Protocol (RFC1413)"
-*/
-static CURLproxycode do_SOCKS4(struct Curl_cfilter *cf,
-                               struct socks_state *sx,
-                               struct Curl_easy *data)
+static CURLproxycode socks4_req_add_hd(struct socks_ctx *sx,
+                                       struct Curl_easy *data)
 {
-  struct connectdata *conn = cf->conn;
-  const bool protocol4a =
-    (conn->socks_proxy.proxytype == CURLPROXY_SOCKS4A) ? TRUE : FALSE;
-  unsigned char *socksreq = (unsigned char *)data->state.buffer;
+  unsigned char buf[4];
+  size_t nwritten;
   CURLcode result;
-  CURLproxycode presult;
-  struct Curl_dns_entry *dns = NULL;
 
-  /* make sure that the buffer is at least 600 bytes */
-  DEBUGASSERT(READBUFFER_MIN >= 600);
+  (void)data;
+  buf[0] = 4; /* version (SOCKS4) */
+  buf[1] = 1; /* connect */
+  buf[2] = (unsigned char)((sx->dest->port >> 8) & 0xffU); /* MSB */
+  buf[3] = (unsigned char)(sx->dest->port & 0xffU);        /* LSB */
 
-  switch(sx->state) {
-  case CONNECT_SOCKS_INIT:
-    /* SOCKS4 can only do IPv4, insist! */
-    conn->ip_version = CURL_IPRESOLVE_V4;
-    if(conn->bits.httpproxy)
-      infof(data, "SOCKS4%s: connecting to HTTP proxy %s port %d",
-            protocol4a ? "a" : "", sx->hostname, sx->remote_port);
+  result = Curl_bufq_write(&sx->iobuf, buf, 4, &nwritten);
+  if(result || (nwritten != 4))
+    return CURLPX_SEND_REQUEST;
+  return CURLPX_OK;
+}
 
-    infof(data, "SOCKS4 communication to %s:%d",
-          sx->hostname, sx->remote_port);
+static CURLproxycode socks4_req_add_user(struct socks_ctx *sx,
+                                         struct Curl_easy *data)
+{
+  CURLcode result;
+  size_t nwritten;
 
-    /*
-     * Compose socks4 request
-     *
-     * Request format
-     *
-     *     +----+----+----+----+----+----+----+----+----+----+....+----+
-     *     | VN | CD | DSTPORT |      DSTIP        | USERID       |NULL|
-     *     +----+----+----+----+----+----+----+----+----+----+....+----+
-     * # of bytes:  1    1      2              4           variable       1
-     */
-
-    socksreq[0] = 4; /* version (SOCKS4) */
-    socksreq[1] = 1; /* connect */
-    socksreq[2] = (unsigned char)((sx->remote_port >> 8) & 0xff); /* MSB */
-    socksreq[3] = (unsigned char)(sx->remote_port & 0xff);        /* LSB */
-
-    /* DNS resolve only for SOCKS4, not SOCKS4a */
-    if(!protocol4a) {
-      enum resolve_t rc =
-        Curl_resolv(data, sx->hostname, sx->remote_port, TRUE, &dns);
-
-      if(rc == CURLRESOLV_ERROR)
-        return CURLPX_RESOLVE_HOST;
-      else if(rc == CURLRESOLV_PENDING) {
-        sxstate(sx, data, CONNECT_RESOLVING);
-        infof(data, "SOCKS4 non-blocking resolve of %s", sx->hostname);
-        return CURLPX_OK;
-      }
-      sxstate(sx, data, CONNECT_RESOLVED);
-      goto CONNECT_RESOLVED;
+  if(sx->creds) {
+    size_t plen = strlen(sx->creds->user);
+    if(plen > 255) {
+      /* there is no real size limit to this field in the protocol, but
+         SOCKS5 limits the proxy user field to 255 bytes and it seems likely
+         that a longer field is either a mistake or malicious input */
+      failf(data, "Too long SOCKS proxy username");
+      return CURLPX_LONG_USER;
     }
-
-    /* socks4a doesn't resolve anything locally */
-    sxstate(sx, data, CONNECT_REQ_INIT);
-    goto CONNECT_REQ_INIT;
-
-  case CONNECT_RESOLVING:
-    /* check if we have the name resolved by now */
-    dns = Curl_fetch_addr(data, sx->hostname, (int)conn->port);
-
-    if(dns) {
-#ifdef CURLRES_ASYNCH
-      data->state.async.dns = dns;
-      data->state.async.done = TRUE;
-#endif
-      infof(data, "Hostname '%s' was found", sx->hostname);
-      sxstate(sx, data, CONNECT_RESOLVED);
-    }
-    else {
-      result = Curl_resolv_check(data, &dns);
-      if(!dns) {
-        if(result)
-          return CURLPX_RESOLVE_HOST;
-        return CURLPX_OK;
-      }
-    }
-    /* FALLTHROUGH */
-CONNECT_RESOLVED:
-  case CONNECT_RESOLVED: {
-    struct Curl_addrinfo *hp = NULL;
-    /*
-     * We cannot use 'hostent' as a struct that Curl_resolv() returns.  It
-     * returns a Curl_addrinfo pointer that may not always look the same.
-     */
-    if(dns) {
-      hp = dns->addr;
-
-      /* scan for the first IPv4 address */
-      while(hp && (hp->ai_family != AF_INET))
-        hp = hp->ai_next;
-
-      if(hp) {
-        struct sockaddr_in *saddr_in;
-        char buf[64];
-        Curl_printable_address(hp, buf, sizeof(buf));
-
-        saddr_in = (struct sockaddr_in *)(void *)hp->ai_addr;
-        socksreq[4] = ((unsigned char *)&saddr_in->sin_addr.s_addr)[0];
-        socksreq[5] = ((unsigned char *)&saddr_in->sin_addr.s_addr)[1];
-        socksreq[6] = ((unsigned char *)&saddr_in->sin_addr.s_addr)[2];
-        socksreq[7] = ((unsigned char *)&saddr_in->sin_addr.s_addr)[3];
-
-        infof(data, "SOCKS4 connect to IPv4 %s (locally resolved)", buf);
-
-        Curl_resolv_unlock(data, dns); /* not used anymore from now on */
-      }
-      else
-        failf(data, "SOCKS4 connection to %s not supported", sx->hostname);
-    }
-    else
-      failf(data, "Failed to resolve \"%s\" for SOCKS4 connect.",
-            sx->hostname);
-
-    if(!hp)
-      return CURLPX_RESOLVE_HOST;
+    /* add proxy name WITH trailing zero */
+    result = Curl_bufq_cwrite(&sx->iobuf, sx->creds->user, plen + 1,
+                              &nwritten);
+    if(result || (nwritten != (plen + 1)))
+      return CURLPX_SEND_REQUEST;
   }
-    /* FALLTHROUGH */
-CONNECT_REQ_INIT:
-  case CONNECT_REQ_INIT:
-    /*
-     * This is currently not supporting "Identification Protocol (RFC1413)".
-     */
-    socksreq[8] = 0; /* ensure empty userid is NUL-terminated */
-    if(sx->proxy_user) {
-      size_t plen = strlen(sx->proxy_user);
-      if(plen >= (size_t)data->set.buffer_size - 8) {
-        failf(data, "Too long SOCKS proxy user name, can't use");
-        return CURLPX_LONG_USER;
-      }
-      /* copy the proxy name WITH trailing zero */
-      memcpy(socksreq + 8, sx->proxy_user, plen + 1);
-    }
+  else {
+    /* empty username */
+    unsigned char b = 0;
+    result = Curl_bufq_write(&sx->iobuf, &b, 1, &nwritten);
+    if(result || (nwritten != 1))
+      return CURLPX_SEND_REQUEST;
+  }
+  return CURLPX_OK;
+}
 
-    /*
-     * Make connection
-     */
-    {
-      size_t packetsize = 9 +
-        strlen((char *)socksreq + 8); /* size including NUL */
+static CURLproxycode socks4_resolving(struct socks_ctx *sx,
+                                      struct Curl_cfilter *cf,
+                                      struct Curl_easy *data,
+                                      bool *done)
+{
+  const struct Curl_addrinfo *ai = NULL;
+  CURLcode result;
+  size_t nwritten;
+  bool dns_done;
 
-      /* If SOCKS4a, set special invalid IP address 0.0.0.x */
-      if(protocol4a) {
-        size_t hostnamelen = 0;
-        socksreq[4] = 0;
-        socksreq[5] = 0;
-        socksreq[6] = 0;
-        socksreq[7] = 1;
-        /* append hostname */
-        hostnamelen = strlen(sx->hostname) + 1; /* length including NUL */
-        if(hostnamelen <= 255)
-          strcpy((char *)socksreq + packetsize, sx->hostname);
-        else {
-          failf(data, "SOCKS4: too long host name");
-          return CURLPX_LONG_HOSTNAME;
-        }
-        packetsize += hostnamelen;
-      }
-      sx->outp = socksreq;
-      sx->outstanding = packetsize;
-      sxstate(sx, data, CONNECT_REQ_SENDING);
+  *done = FALSE;
+  if(sx->start_resolving) {
+    /* need to resolve hostname to add destination address */
+    sx->start_resolving = FALSE;
+    result = Curl_cf_dns_insert_after(
+      cf, data, Curl_resolv_dns_queries(data, sx->ip_version),
+      sx->dest, TRNSPRT_TCP, TRUE);
+    if(result) {
+      failf(data, "unable to create DNS filter for socks");
+      return CURLPX_UNKNOWN_FAIL;
     }
-    /* FALLTHROUGH */
-  case CONNECT_REQ_SENDING:
-    /* Send request */
-    presult = socks_state_send(cf, sx, data, CURLPX_SEND_CONNECT,
-                               "SOCKS4 connect request");
-    if(CURLPX_OK != presult)
-      return presult;
-    else if(sx->outstanding) {
-      /* remain in sending state */
-      return CURLPX_OK;
-    }
-    /* done sending! */
-    sx->outstanding = 8; /* receive data size */
-    sx->outp = socksreq;
-    sxstate(sx, data, CONNECT_SOCKS_READ);
-
-    /* FALLTHROUGH */
-  case CONNECT_SOCKS_READ:
-    /* Receive response */
-    presult = socks_state_recv(cf, sx, data, CURLPX_RECV_CONNECT,
-                               "connect request ack");
-    if(CURLPX_OK != presult)
-      return presult;
-    else if(sx->outstanding) {
-      /* remain in reading state */
-      return CURLPX_OK;
-    }
-    sxstate(sx, data, CONNECT_DONE);
-    break;
-  default: /* lots of unused states in SOCKS4 */
-    break;
   }
 
+  /* resolve the hostname by connecting the DNS filter */
+  result = Curl_conn_cf_connect(cf->next, data, &dns_done);
+  if(result) {
+    failf(data, "Failed to resolve \"%s\" for SOCKS4 connect.",
+          sx->dest->hostname);
+    return CURLPX_RESOLVE_HOST;
+  }
+  else if(!dns_done)
+    return CURLPX_OK;
+
+  ai = Curl_cf_dns_get_ai(cf->next, data, sx->dest, AF_INET, 0);
+  if(ai) {
+    struct sockaddr_in *saddr_in;
+    char ipbuf[64];
+
+    Curl_printable_address(ai, ipbuf, sizeof(ipbuf));
+    CURL_TRC_CF(data, cf, "SOCKS4 connect to IPv4 %s (locally resolved)",
+                ipbuf);
+
+    saddr_in = (struct sockaddr_in *)(void *)ai->ai_addr;
+    result = Curl_bufq_write(&sx->iobuf,
+                             (unsigned char *)&saddr_in->sin_addr.s_addr, 4,
+                             &nwritten);
+
+    if(result || (nwritten != 4))
+      return CURLPX_SEND_REQUEST;
+  }
+  else {
+    /* No ipv4 address resolved */
+    failf(data, "SOCKS4 connection to %s not supported", sx->dest->hostname);
+    return CURLPX_RESOLVE_HOST;
+  }
+
+  *done = TRUE;
+  return CURLPX_OK;
+}
+
+static CURLproxycode socks4_check_resp(struct socks_ctx *sx,
+                                       struct Curl_cfilter *cf,
+                                       struct Curl_easy *data)
+{
+  const unsigned char *resp;
+  size_t rlen;
+
+  if(!Curl_bufq_peek(&sx->iobuf, &resp, &rlen) || rlen < 8) {
+    failf(data, "SOCKS4 reply is incomplete.");
+    return CURLPX_RECV_CONNECT;
+  }
+
+  DEBUGASSERT(rlen == 8);
   /*
    * Response format
    *
@@ -491,610 +403,792 @@ CONNECT_REQ_INIT:
    */
 
   /* wrong version ? */
-  if(socksreq[0]) {
-    failf(data,
-          "SOCKS4 reply has wrong version, version should be 0.");
+  if(resp[0]) {
+    failf(data, "SOCKS4 reply has wrong version, version should be 0.");
     return CURLPX_BAD_VERSION;
   }
 
   /* Result */
-  switch(socksreq[1]) {
+  switch(resp[1]) {
   case 90:
-    infof(data, "SOCKS4%s request granted.", protocol4a?"a":"");
-    break;
+    CURL_TRC_CF(data, cf, "SOCKS4%s request granted.", sx->socks4a ? "a" : "");
+    Curl_bufq_skip(&sx->iobuf, 8);
+    return CURLPX_OK;
   case 91:
     failf(data,
-          "Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d)"
+          "[SOCKS] cannot complete SOCKS4 connection to %u.%u.%u.%u:%u. (%u)"
           ", request rejected or failed.",
-          socksreq[4], socksreq[5], socksreq[6], socksreq[7],
-          (((unsigned char)socksreq[2] << 8) | (unsigned char)socksreq[3]),
-          (unsigned char)socksreq[1]);
+          resp[4], resp[5], resp[6], resp[7],
+          (unsigned int)((resp[2] << 8) | resp[3]), resp[1]);
     return CURLPX_REQUEST_FAILED;
   case 92:
     failf(data,
-          "Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d)"
+          "[SOCKS] cannot complete SOCKS4 connection to %u.%u.%u.%u:%u. (%u)"
           ", request rejected because SOCKS server cannot connect to "
           "identd on the client.",
-          socksreq[4], socksreq[5], socksreq[6], socksreq[7],
-          (((unsigned char)socksreq[2] << 8) | (unsigned char)socksreq[3]),
-          (unsigned char)socksreq[1]);
+          resp[4], resp[5], resp[6], resp[7],
+          (unsigned int)((resp[2] << 8) | resp[3]), resp[1]);
     return CURLPX_IDENTD;
   case 93:
     failf(data,
-          "Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d)"
+          "[SOCKS] cannot complete SOCKS4 connection to %u.%u.%u.%u:%u. (%u)"
           ", request rejected because the client program and identd "
           "report different user-ids.",
-          socksreq[4], socksreq[5], socksreq[6], socksreq[7],
-          (((unsigned char)socksreq[2] << 8) | (unsigned char)socksreq[3]),
-          (unsigned char)socksreq[1]);
+          resp[4], resp[5], resp[6], resp[7],
+          (unsigned int)((resp[2] << 8) | resp[3]), resp[1]);
     return CURLPX_IDENTD_DIFFER;
   default:
     failf(data,
-          "Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d)"
+          "[SOCKS] cannot complete SOCKS4 connection to %u.%u.%u.%u:%u. (%u)"
           ", Unknown.",
-          socksreq[4], socksreq[5], socksreq[6], socksreq[7],
-          (((unsigned char)socksreq[2] << 8) | (unsigned char)socksreq[3]),
-          (unsigned char)socksreq[1]);
+          resp[4], resp[5], resp[6], resp[7],
+          (unsigned int)((resp[2] << 8) | resp[3]), resp[1]);
     return CURLPX_UNKNOWN_FAIL;
   }
+}
 
-  return CURLPX_OK; /* Proxy was successful! */
+/*
+ * This function logs in to a SOCKS4 proxy and sends the specifics to the final
+ * destination server.
+ *
+ * Reference :
+ *   https://www.openssh.com/txt/socks4.protocol
+ *
+ * Note :
+ *   Set protocol4a=true for  "SOCKS 4A (Simple Extension to SOCKS 4 Protocol)"
+ *   Nonsupport "Identification Protocol (RFC1413)"
+ */
+static CURLproxycode socks4_connect(struct Curl_cfilter *cf,
+                                    struct socks_ctx *sx,
+                                    struct Curl_easy *data)
+{
+  size_t nwritten;
+  CURLproxycode presult;
+  CURLcode result;
+  bool done;
+
+process_state:
+  switch(sx->state) {
+  case SOCKS_ST_INIT:
+    sx->version = 4;
+    sxstate(sx, cf, data, SOCKS4_ST_START);
+    FALLTHROUGH();
+
+  case SOCKS4_ST_START:
+    Curl_bufq_reset(&sx->iobuf);
+    sx->start_resolving = FALSE;
+    sx->socks4a = (sx->proxy_type == CURLPROXY_SOCKS4A);
+    sx->resolve_local = !sx->socks4a;
+    sx->presult = CURLPX_OK;
+
+    /* SOCKS4 can only do IPv4, insist! */
+    sx->ip_version = CURL_IPRESOLVE_V4;
+    CURL_TRC_CF(data, cf, "SOCKS4%s connecting to %s:%u",
+                sx->socks4a ? "a" : "",
+                sx->dest->hostname, sx->dest->port);
+
+    /*
+     * Compose socks4 request
+     *
+     * Request format
+     *
+     *     +----+----+----+----+----+----+----+----+----+----+....+----+
+     *     | VN | CD | DSTPORT |      DSTIP        | USERID       |NULL|
+     *     +----+----+----+----+----+----+----+----+----+----+....+----+
+     * # of bytes:  1    1      2              4           variable       1
+     */
+    presult = socks4_req_add_hd(sx, data);
+    if(presult)
+      return socks_failed(sx, cf, data, presult);
+
+    /* DNS resolve only for SOCKS4, not SOCKS4a */
+    if(!sx->resolve_local) {
+      /* socks4a, not resolving locally, sends the hostname.
+       * add an invalid address + user + hostname */
+      unsigned char buf[4] = { 0, 0, 0, 1 };
+      size_t hlen = strlen(sx->dest->hostname) + 1; /* including NUL */
+
+      if(hlen > 255) {
+        failf(data, "SOCKS4: too long hostname");
+        return socks_failed(sx, cf, data, CURLPX_LONG_HOSTNAME);
+      }
+      result = Curl_bufq_write(&sx->iobuf, buf, 4, &nwritten);
+      if(result || (nwritten != 4))
+        return socks_failed(sx, cf, data, CURLPX_SEND_REQUEST);
+      presult = socks4_req_add_user(sx, data);
+      if(presult)
+        return socks_failed(sx, cf, data, presult);
+      result = Curl_bufq_cwrite(&sx->iobuf, sx->dest->hostname, hlen,
+                                &nwritten);
+      if(result || (nwritten != hlen))
+        return socks_failed(sx, cf, data, CURLPX_SEND_REQUEST);
+      /* request complete */
+      sxstate(sx, cf, data, SOCKS4_ST_SEND);
+      goto process_state;
+    }
+    sx->start_resolving = TRUE;
+    sxstate(sx, cf, data, SOCKS4_ST_RESOLVING);
+    FALLTHROUGH();
+
+  case SOCKS4_ST_RESOLVING:
+    presult = socks4_resolving(sx, cf, data, &done);
+    if(presult)
+      return socks_failed(sx, cf, data, presult);
+    if(!done)
+      return CURLPX_OK;
+    /* append user */
+    presult = socks4_req_add_user(sx, data);
+    if(presult)
+      return socks_failed(sx, cf, data, presult);
+    sxstate(sx, cf, data, SOCKS4_ST_SEND);
+    FALLTHROUGH();
+
+  case SOCKS4_ST_SEND:
+    presult = socks_flush(sx, cf, data, &done);
+    if(presult)
+      return socks_failed(sx, cf, data, presult);
+    else if(!done)
+      return CURLPX_OK;
+    sxstate(sx, cf, data, SOCKS4_ST_RECV);
+    FALLTHROUGH();
+
+  case SOCKS4_ST_RECV:
+    /* Receive 8-byte response */
+    presult = socks_recv(sx, cf, data, 8, &done);
+    if(presult)
+      return socks_failed(sx, cf, data, presult);
+    else if(!done)
+      return CURLPX_OK;
+    presult = socks4_check_resp(sx, cf, data);
+    if(presult)
+      return socks_failed(sx, cf, data, presult);
+    sxstate(sx, cf, data, SOCKS_ST_SUCCESS);
+    FALLTHROUGH();
+
+  case SOCKS_ST_SUCCESS:
+    return CURLPX_OK;
+
+  case SOCKS_ST_FAILED:
+    DEBUGASSERT(sx->presult);
+    return sx->presult;
+
+  default:
+    DEBUGASSERT(0);
+    return socks_failed(sx, cf, data, CURLPX_SEND_REQUEST);
+  }
+}
+
+static CURLproxycode socks5_req0_init(struct Curl_cfilter *cf,
+                                      struct socks_ctx *sx,
+                                      struct Curl_easy *data)
+{
+  const unsigned char auth = data->set.socks5auth;
+  unsigned char req[5]; /* version + len + 3 possible auth methods */
+  unsigned char nauths;
+  size_t req_len, nwritten;
+  CURLcode result;
+
+  (void)cf;
+  /* RFC1928 chapter 5 specifies max 255 chars for domain name in packet */
+  if(!sx->resolve_local && strlen(sx->dest->hostname) > 255) {
+    failf(data, "SOCKS5: the destination hostname is too long to be "
+          "resolved remotely by the proxy.");
+    return CURLPX_LONG_HOSTNAME;
+  }
+
+  if(auth & ~(CURLAUTH_BASIC | CURLAUTH_GSSAPI))
+    infof(data, "warning: unsupported value passed to "
+          "CURLOPT_SOCKS5_AUTH: %u", auth);
+  if(!(auth & CURLAUTH_BASIC))
+    /* disable username/password auth */
+    Curl_creds_unlink(&sx->creds);
+
+  req[0] = 5;   /* version */
+  nauths = 1;
+  req[1 + nauths] = 0;   /* 1. no authentication */
+#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
+  if(auth & CURLAUTH_GSSAPI) {
+    ++nauths;
+    req[1 + nauths] = 1; /* GSS-API */
+  }
+#endif
+  if(sx->creds) {
+    ++nauths;
+    req[1 + nauths] = 2; /* username/password */
+  }
+  req[1] = nauths;
+  req_len = 2 + nauths;
+
+  result = Curl_bufq_write(&sx->iobuf, req, req_len, &nwritten);
+  if(result || (nwritten != req_len))
+    return CURLPX_SEND_REQUEST;
+  return CURLPX_OK;
+}
+
+static CURLproxycode socks5_check_resp0(struct socks_ctx *sx,
+                                        struct Curl_cfilter *cf,
+                                        struct Curl_easy *data)
+{
+  const unsigned char *resp;
+  unsigned char auth_mode;
+  size_t rlen;
+
+  if(!Curl_bufq_peek(&sx->iobuf, &resp, &rlen) || rlen < 2) {
+    failf(data, "SOCKS5 initial reply is incomplete.");
+    return CURLPX_RECV_CONNECT;
+  }
+
+  if(resp[0] != 5) {
+    failf(data, "Received invalid version in initial SOCKS5 response.");
+    return CURLPX_BAD_VERSION;
+  }
+
+  auth_mode = resp[1];
+  Curl_bufq_skip(&sx->iobuf, 2);
+
+  switch(auth_mode) {
+  case 0:
+    /* DONE! No authentication needed. Send request. */
+    sxstate(sx, cf, data, SOCKS5_ST_REQ1_INIT);
+    return CURLPX_OK;
+  case 1:
+    if(data->set.socks5auth & CURLAUTH_GSSAPI) {
+      sxstate(sx, cf, data, SOCKS5_ST_GSSAPI_INIT);
+      return CURLPX_OK;
+    }
+    failf(data, "SOCKS5 GSSAPI per-message authentication is not enabled.");
+    return CURLPX_GSSAPI_PERMSG;
+  case 2:
+    /* regular name + password authentication */
+    if(data->set.socks5auth & CURLAUTH_BASIC) {
+      sxstate(sx, cf, data, SOCKS5_ST_AUTH_INIT);
+      return CURLPX_OK;
+    }
+    failf(data, "BASIC authentication proposed but not enabled.");
+    return CURLPX_NO_AUTH;
+  case 255:
+    failf(data, "No authentication method was acceptable.");
+    return CURLPX_NO_AUTH;
+  default:
+    failf(data, "Unknown SOCKS5 mode attempted to be used by server.");
+    return CURLPX_UNKNOWN_MODE;
+  }
+}
+
+static CURLproxycode socks5_auth_init(struct Curl_cfilter *cf,
+                                      struct socks_ctx *sx,
+                                      struct Curl_easy *data)
+{
+  /* Needs username and password */
+  size_t ulen = 0, plen = 0, nwritten;
+  unsigned char buf[2];
+  CURLcode result;
+
+  if(sx->creds) {
+    ulen = strlen(sx->creds->user);
+    plen = strlen(sx->creds->passwd);
+    /* the lengths must fit in a single byte */
+    if(ulen > 255) {
+      failf(data, "Excessive username length for proxy auth");
+      return CURLPX_LONG_USER;
+    }
+    if(plen > 255) {
+      failf(data, "Excessive password length for proxy auth");
+      return CURLPX_LONG_PASSWD;
+    }
+  }
+
+  /*   username/password request looks like
+   * +----+------+----------+------+----------+
+   * |VER | ULEN |  UNAME   | PLEN |  PASSWD  |
+   * +----+------+----------+------+----------+
+   * | 1  |  1   | 1 to 255 |  1   | 1 to 255 |
+   * +----+------+----------+------+----------+
+   */
+  buf[0] = 1;    /* username/pw subnegotiation version */
+  buf[1] = (unsigned char)ulen;
+  result = Curl_bufq_write(&sx->iobuf, buf, 2, &nwritten);
+  if(result || (nwritten != 2))
+    return CURLPX_SEND_REQUEST;
+  if(ulen) {
+    result = Curl_bufq_cwrite(&sx->iobuf, sx->creds->user, ulen, &nwritten);
+    if(result || (nwritten != ulen))
+      return CURLPX_SEND_REQUEST;
+  }
+  buf[0] = (unsigned char)plen;
+  result = Curl_bufq_write(&sx->iobuf, buf, 1, &nwritten);
+  if(result || (nwritten != 1))
+    return CURLPX_SEND_REQUEST;
+  if(plen) {
+    result = Curl_bufq_cwrite(&sx->iobuf, sx->creds->passwd, plen, &nwritten);
+    if(result || (nwritten != plen))
+      return CURLPX_SEND_REQUEST;
+  }
+  sxstate(sx, cf, data, SOCKS5_ST_AUTH_SEND);
+  return CURLPX_OK;
+}
+
+static CURLproxycode socks5_check_auth_resp(struct socks_ctx *sx,
+                                            struct Curl_cfilter *cf,
+                                            struct Curl_easy *data)
+{
+  const unsigned char *resp;
+  unsigned char auth_status;
+  size_t rlen;
+
+  (void)cf;
+  if(!Curl_bufq_peek(&sx->iobuf, &resp, &rlen) || rlen < 2) {
+    failf(data, "SOCKS5 sub-negotiation response incomplete.");
+    return CURLPX_RECV_CONNECT;
+  }
+
+  /* ignore the first (VER) byte */
+  auth_status = resp[1];
+  if(auth_status) {
+    failf(data, "User was rejected by the SOCKS5 server (%d %d).",
+          resp[0], resp[1]);
+    return CURLPX_USER_REJECTED;
+  }
+  Curl_bufq_skip(&sx->iobuf, 2);
+  return CURLPX_OK;
+}
+
+static CURLproxycode socks5_req1_init(struct socks_ctx *sx,
+                                      struct Curl_cfilter *cf,
+                                      struct Curl_easy *data)
+{
+  unsigned char req[5];
+  unsigned char ipbuf[16];
+  const unsigned char *destination;
+  unsigned char desttype, destlen, hdlen;
+  size_t nwritten;
+  CURLcode result;
+
+  req[0] = 5; /* version (SOCKS5) */
+  req[1] = 1; /* connect */
+  req[2] = 0; /* must be zero */
+  if(sx->resolve_local) {
+    /* rest of request is added after resolving */
+    result = Curl_bufq_write(&sx->iobuf, req, 3, &nwritten);
+    if(result || (nwritten != 3))
+      return CURLPX_SEND_REQUEST;
+    return CURLPX_OK;
+  }
+
+  /* remote resolving, send what type+addr/string to resolve */
+#ifdef USE_IPV6
+  if(strchr(sx->dest->hostname, ':')) {
+    desttype = 4;
+    destination = ipbuf;
+    destlen = 16;
+    if(curlx_inet_pton(AF_INET6, sx->dest->hostname, ipbuf) != 1)
+      return CURLPX_BAD_ADDRESS_TYPE;
+  }
+  else
+#endif
+  if(curlx_inet_pton(AF_INET, sx->dest->hostname, ipbuf) == 1) {
+    desttype = 1;
+    destination = ipbuf;
+    destlen = 4;
+  }
+  else {
+    const size_t hostname_len = strlen(sx->dest->hostname);
+    /* socks5_req0_init() already rejects hostnames longer than 255 bytes, so
+       this cast to unsigned char is safe. Assert to guard against future
+       refactoring that might remove or reorder that earlier check. */
+    DEBUGASSERT(hostname_len <= 255);
+    desttype = 3;
+    destination = (const unsigned char *)sx->dest->hostname;
+    destlen = (unsigned char)hostname_len; /* 1-byte length */
+  }
+
+  req[3] = desttype;
+  req[4] = destlen;
+  hdlen = (desttype == 3) ? 5 : 4; /* no length byte for ip addresses */
+  result = Curl_bufq_write(&sx->iobuf, req, hdlen, &nwritten);
+  if(result || (nwritten != hdlen))
+    return CURLPX_SEND_REQUEST;
+  result = Curl_bufq_write(&sx->iobuf, destination, destlen, &nwritten);
+  if(result || (nwritten != destlen))
+    return CURLPX_SEND_REQUEST;
+  /* PORT MSB+LSB */
+  req[0] = (unsigned char)((sx->dest->port >> 8) & 0xff);
+  req[1] = (unsigned char)(sx->dest->port & 0xff);
+  result = Curl_bufq_write(&sx->iobuf, req, 2, &nwritten);
+  if(result || (nwritten != 2))
+    return CURLPX_SEND_REQUEST;
+  CURL_TRC_CF(data, cf, "SOCKS5 connect to %s:%u (remotely resolved)",
+              sx->dest->hostname, sx->dest->port);
+  return CURLPX_OK;
+}
+
+static CURLproxycode socks5_resolving(struct socks_ctx *sx,
+                                      struct Curl_cfilter *cf,
+                                      struct Curl_easy *data,
+                                      bool *done)
+{
+  const struct Curl_addrinfo *ai = NULL;
+  char dest[MAX_IPADR_LEN];  /* printable address */
+  const unsigned char *destination = NULL;
+  unsigned char desttype = 1, destlen = 4;
+  unsigned char req[2];
+  CURLcode result;
+  CURLproxycode presult = CURLPX_OK;
+  size_t nwritten;
+  bool dns_done;
+
+  *done = FALSE;
+  if(sx->start_resolving) {
+    /* need to resolve hostname to add destination address */
+    sx->start_resolving = FALSE;
+    result = Curl_cf_dns_insert_after(
+      cf, data, Curl_resolv_dns_queries(data, sx->ip_version),
+      sx->dest, TRNSPRT_TCP, TRUE);
+    if(result) {
+      failf(data, "unable to create DNS filter for socks");
+      return CURLPX_UNKNOWN_FAIL;
+    }
+  }
+
+  /* resolve the hostname by connecting the DNS filter */
+  result = Curl_conn_cf_connect(cf->next, data, &dns_done);
+  if(result) {
+    failf(data, "Failed to resolve \"%s\" for SOCKS5 connect.",
+          sx->dest->hostname);
+    return CURLPX_RESOLVE_HOST;
+  }
+  else if(!dns_done)
+    return CURLPX_OK;
+
+#ifdef USE_IPV6
+  if(data->set.ipver != CURL_IPRESOLVE_V4)
+    ai = Curl_cf_dns_get_ai(cf->next, data, sx->dest, AF_INET6, 0);
+#endif
+  if(!ai)
+    ai = Curl_cf_dns_get_ai(cf->next, data, sx->dest, AF_INET, 0);
+
+  if(!ai) {
+    failf(data, "Failed to resolve \"%s\" for SOCKS5 connect.",
+          sx->dest->hostname);
+    presult = CURLPX_RESOLVE_HOST;
+    goto out;
+  }
+
+  Curl_printable_address(ai, dest, sizeof(dest));
+
+  if(ai->ai_family == AF_INET) {
+    struct sockaddr_in *saddr_in;
+    desttype = 1; /* ATYP: IPv4 = 1 */
+    destlen = 4;
+    saddr_in = (struct sockaddr_in *)(void *)ai->ai_addr;
+    destination = (const unsigned char *)&saddr_in->sin_addr.s_addr;
+    CURL_TRC_CF(data, cf, "SOCKS5 connect to %s:%u (locally resolved)",
+                dest, sx->dest->port);
+  }
+#ifdef USE_IPV6
+  else if(ai->ai_family == AF_INET6) {
+    struct sockaddr_in6 *saddr_in6;
+    desttype = 4; /* ATYP: IPv6 = 4 */
+    destlen = 16;
+    saddr_in6 = (struct sockaddr_in6 *)(void *)ai->ai_addr;
+    destination = (const unsigned char *)&saddr_in6->sin6_addr.s6_addr;
+    CURL_TRC_CF(data, cf, "SOCKS5 connect to [%s]:%u (locally resolved)",
+                dest, sx->dest->port);
+  }
+#endif
+
+  if(!destination) {
+    failf(data, "SOCKS5 connection to %s not supported", dest);
+    presult = CURLPX_RESOLVE_HOST;
+    goto out;
+  }
+
+  req[0] = desttype;
+  result = Curl_bufq_write(&sx->iobuf, req, 1, &nwritten);
+  if(result || (nwritten != 1)) {
+    presult = CURLPX_SEND_REQUEST;
+    goto out;
+  }
+  result = Curl_bufq_write(&sx->iobuf, destination, destlen, &nwritten);
+  if(result || (nwritten != destlen)) {
+    presult = CURLPX_SEND_REQUEST;
+    goto out;
+  }
+  /* PORT MSB+LSB */
+  req[0] = (unsigned char)((sx->dest->port >> 8) & 0xffU);
+  req[1] = (unsigned char)(sx->dest->port & 0xffU);
+  result = Curl_bufq_write(&sx->iobuf, req, 2, &nwritten);
+  if(result || (nwritten != 2)) {
+    presult = CURLPX_SEND_REQUEST;
+    goto out;
+  }
+
+out:
+  *done = (presult == CURLPX_OK);
+  return presult;
+}
+
+static CURLproxycode socks5_recv_resp1(struct socks_ctx *sx,
+                                       struct Curl_cfilter *cf,
+                                       struct Curl_easy *data,
+                                       bool *done)
+{
+  const unsigned char *resp;
+  size_t rlen, resp_len = 8; /* minimum response length */
+  CURLproxycode presult;
+
+  presult = socks_recv(sx, cf, data, resp_len, done);
+  if(presult)
+    return presult;
+  else if(!*done)
+    return CURLPX_OK;
+
+  if(!Curl_bufq_peek(&sx->iobuf, &resp, &rlen) || rlen < resp_len) {
+    failf(data, "SOCKS5 response is incomplete.");
+    return CURLPX_RECV_CONNECT;
+  }
+
+  /* Response packet includes BND.ADDR is variable length parameter by RFC
+     1928, so the response packet MUST be read until the end to avoid errors
+     at subsequent protocol level.
+
+     +----+-----+-------+------+----------+----------+
+     |VER | REP |  RSV  | ATYP | BND.ADDR | BND.PORT |
+     +----+-----+-------+------+----------+----------+
+     | 1  |  1  | 0x00  |  1   | Variable |    2     |
+     +----+-----+-------+------+----------+----------+
+
+     ATYP:
+     o IPv4 address: 0x01, BND.ADDR = 4-byte
+     o domain name:  0x03, BND.ADDR = [ 1-byte length, string ]
+     o IPv6 address: 0x04, BND.ADDR = 16-byte
+  */
+  if(resp[0] != 5) { /* version */
+    failf(data, "SOCKS5 reply has wrong version, version should be 5.");
+    return CURLPX_BAD_VERSION;
+  }
+  else if(resp[1]) { /* Anything besides 0 is an error */
+    CURLproxycode rc = CURLPX_REPLY_UNASSIGNED;
+    int code = resp[1];
+    failf(data, "cannot complete SOCKS5 connection to %s. (%d)",
+          sx->dest->hostname, code);
+    if(code < 9) {
+      /* RFC 1928 section 6 lists: */
+      static const CURLproxycode lookup[] = {
+        CURLPX_OK,
+        CURLPX_REPLY_GENERAL_SERVER_FAILURE,
+        CURLPX_REPLY_NOT_ALLOWED,
+        CURLPX_REPLY_NETWORK_UNREACHABLE,
+        CURLPX_REPLY_HOST_UNREACHABLE,
+        CURLPX_REPLY_CONNECTION_REFUSED,
+        CURLPX_REPLY_TTL_EXPIRED,
+        CURLPX_REPLY_COMMAND_NOT_SUPPORTED,
+        CURLPX_REPLY_ADDRESS_TYPE_NOT_SUPPORTED,
+      };
+      rc = lookup[code];
+    }
+    return rc;
+  }
+
+  /* Calculate real packet size */
+  switch(resp[3]) {
+  case 1: /* IPv4 */
+    resp_len = 4 + 4 + 2;
+    break;
+  case 3: /* domain name */
+    resp_len = 4 + 1 + resp[4] + 2; /* header, var length, var bytes, port */
+    break;
+  case 4: /* IPv6 */
+    resp_len = 4 + 16 + 2;
+    break;
+  default:
+    failf(data, "SOCKS5 reply has wrong address type.");
+    return CURLPX_BAD_ADDRESS_TYPE;
+  }
+
+  /* receive the rest of the response */
+  presult = socks_recv(sx, cf, data, resp_len, done);
+  if(presult)
+    return presult;
+  else if(!*done)
+    return CURLPX_OK;
+
+  if(!Curl_bufq_peek(&sx->iobuf, &resp, &rlen) || rlen < resp_len) {
+    failf(data, "SOCKS5 response is incomplete.");
+    return CURLPX_RECV_CONNECT;
+  }
+  /* got it all */
+  *done = TRUE;
+  return CURLPX_OK;
 }
 
 /*
  * This function logs in to a SOCKS5 proxy and sends the specifics to the final
  * destination server.
  */
-static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
-                               struct socks_state *sx,
-                               struct Curl_easy *data)
+static CURLproxycode socks5_connect(struct Curl_cfilter *cf,
+                                    struct socks_ctx *sx,
+                                    struct Curl_easy *data)
 {
-  /*
-    According to the RFC1928, section "6.  Replies". This is what a SOCK5
-    replies:
-
-        +----+-----+-------+------+----------+----------+
-        |VER | REP |  RSV  | ATYP | BND.ADDR | BND.PORT |
-        +----+-----+-------+------+----------+----------+
-        | 1  |  1  | X'00' |  1   | Variable |    2     |
-        +----+-----+-------+------+----------+----------+
-
-    Where:
-
-    o  VER    protocol version: X'05'
-    o  REP    Reply field:
-    o  X'00' succeeded
-  */
-  struct connectdata *conn = cf->conn;
-  unsigned char *socksreq = (unsigned char *)data->state.buffer;
-  int idx;
-  CURLcode result;
   CURLproxycode presult;
-  bool socks5_resolve_local =
-    (conn->socks_proxy.proxytype == CURLPROXY_SOCKS5) ? TRUE : FALSE;
-  const size_t hostname_len = strlen(sx->hostname);
-  ssize_t len = 0;
-  const unsigned char auth = data->set.socks5auth;
-  bool allow_gssapi = FALSE;
-  struct Curl_dns_entry *dns = NULL;
+  bool done;
 
-  DEBUGASSERT(auth & (CURLAUTH_BASIC | CURLAUTH_GSSAPI));
+process_state:
   switch(sx->state) {
-  case CONNECT_SOCKS_INIT:
-    if(conn->bits.httpproxy)
-      infof(data, "SOCKS5: connecting to HTTP proxy %s port %d",
-            sx->hostname, sx->remote_port);
+  case SOCKS_ST_INIT:
+    sx->version = 5;
+    sx->resolve_local = (sx->proxy_type == CURLPROXY_SOCKS5);
+    sxstate(sx, cf, data, SOCKS5_ST_START);
+    FALLTHROUGH();
 
-    /* RFC1928 chapter 5 specifies max 255 chars for domain name in packet */
-    if(!socks5_resolve_local && hostname_len > 255) {
-      infof(data, "SOCKS5: server resolving disabled for hostnames of "
-            "length > 255 [actual len=%zu]", hostname_len);
-      socks5_resolve_local = TRUE;
-    }
+  case SOCKS5_ST_START:
+    CURL_TRC_CF(data, cf, "SOCKS5: connecting to %s:%u",
+                sx->dest->hostname, sx->dest->port);
+    presult = socks5_req0_init(cf, sx, data);
+    if(presult)
+      return socks_failed(sx, cf, data, presult);
+    sxstate(sx, cf, data, SOCKS5_ST_REQ0_SEND);
+    FALLTHROUGH();
 
-    if(auth & ~(CURLAUTH_BASIC | CURLAUTH_GSSAPI))
-      infof(data,
-            "warning: unsupported value passed to CURLOPT_SOCKS5_AUTH: %u",
-            auth);
-    if(!(auth & CURLAUTH_BASIC))
-      /* disable username/password auth */
-      sx->proxy_user = NULL;
-#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
-    if(auth & CURLAUTH_GSSAPI)
-      allow_gssapi = TRUE;
-#endif
-
-    idx = 0;
-    socksreq[idx++] = 5;   /* version */
-    idx++;                 /* number of authentication methods */
-    socksreq[idx++] = 0;   /* no authentication */
-    if(allow_gssapi)
-      socksreq[idx++] = 1; /* GSS-API */
-    if(sx->proxy_user)
-      socksreq[idx++] = 2; /* username/password */
-    /* write the number of authentication methods */
-    socksreq[1] = (unsigned char) (idx - 2);
-
-    sx->outp = socksreq;
-    sx->outstanding = idx;
-    presult = socks_state_send(cf, sx, data, CURLPX_SEND_CONNECT,
-                               "initial SOCKS5 request");
-    if(CURLPX_OK != presult)
-      return presult;
-    else if(sx->outstanding) {
-      /* remain in sending state */
+  case SOCKS5_ST_REQ0_SEND:
+    presult = socks_flush(sx, cf, data, &done);
+    if(presult)
+      return socks_failed(sx, cf, data, presult);
+    else if(!done)
       return CURLPX_OK;
-    }
-    sxstate(sx, data, CONNECT_SOCKS_READ);
-    goto CONNECT_SOCKS_READ_INIT;
-  case CONNECT_SOCKS_SEND:
-    presult = socks_state_send(cf, sx, data, CURLPX_SEND_CONNECT,
-                               "initial SOCKS5 request");
-    if(CURLPX_OK != presult)
-      return presult;
-    else if(sx->outstanding) {
-      /* remain in sending state */
+    /* done sending! */
+    sxstate(sx, cf, data, SOCKS5_ST_RESP0_RECV);
+    FALLTHROUGH();
+
+  case SOCKS5_ST_RESP0_RECV:
+    presult = socks_recv(sx, cf, data, 2, &done);
+    if(presult)
+      return socks_failed(sx, cf, data, presult);
+    else if(!done)
       return CURLPX_OK;
-    }
-    /* FALLTHROUGH */
-CONNECT_SOCKS_READ_INIT:
-  case CONNECT_SOCKS_READ_INIT:
-    sx->outstanding = 2; /* expect two bytes */
-    sx->outp = socksreq; /* store it here */
-    /* FALLTHROUGH */
-  case CONNECT_SOCKS_READ:
-    presult = socks_state_recv(cf, sx, data, CURLPX_RECV_CONNECT,
-                               "initial SOCKS5 response");
-    if(CURLPX_OK != presult)
-      return presult;
-    else if(sx->outstanding) {
-      /* remain in reading state */
-      return CURLPX_OK;
-    }
-    else if(socksreq[0] != 5) {
-      failf(data, "Received invalid version in initial SOCKS5 response.");
-      return CURLPX_BAD_VERSION;
-    }
-    else if(socksreq[1] == 0) {
-      /* DONE! No authentication needed. Send request. */
-      sxstate(sx, data, CONNECT_REQ_INIT);
-      goto CONNECT_REQ_INIT;
-    }
-    else if(socksreq[1] == 2) {
-      /* regular name + password authentication */
-      sxstate(sx, data, CONNECT_AUTH_INIT);
-      goto CONNECT_AUTH_INIT;
-    }
+    presult = socks5_check_resp0(sx, cf, data);
+    if(presult)
+      return socks_failed(sx, cf, data, presult);
+    /* socks5_check_resp0() sets next socks state */
+    goto process_state;
+
+  case SOCKS5_ST_GSSAPI_INIT: {
 #if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
-    else if(allow_gssapi && (socksreq[1] == 1)) {
-      sxstate(sx, data, CONNECT_GSSAPI_INIT);
-      result = Curl_SOCKS5_gssapi_negotiate(cf, data);
-      if(result) {
-        failf(data, "Unable to negotiate SOCKS5 GSS-API context.");
-        return CURLPX_GSSAPI;
-      }
-    }
-#endif
-    else {
-      /* error */
-      if(!allow_gssapi && (socksreq[1] == 1)) {
-        failf(data,
-              "SOCKS5 GSSAPI per-message authentication is not supported.");
-        return CURLPX_GSSAPI_PERMSG;
-      }
-      else if(socksreq[1] == 255) {
-        failf(data, "No authentication method was acceptable.");
-        return CURLPX_NO_AUTH;
-      }
-    }
-    failf(data,
-          "Undocumented SOCKS5 mode attempted to be used by server.");
-    return CURLPX_UNKNOWN_MODE;
-#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
-  case CONNECT_GSSAPI_INIT:
     /* GSSAPI stuff done non-blocking */
-    break;
+    CURLcode result = Curl_SOCKS5_gssapi_negotiate(cf, data, sx->creds);
+    if(result) {
+      failf(data, "Unable to negotiate SOCKS5 GSS-API context.");
+      return CURLPX_GSSAPI;
+    }
+    sxstate(sx, cf, data, SOCKS5_ST_REQ1_INIT);
+    goto process_state;
+#else
+    failf(data, "SOCKS5 GSSAPI per-message authentication is not supported.");
+    return socks_failed(sx, cf, data, CURLPX_GSSAPI_PERMSG);
 #endif
-
-  default: /* do nothing! */
-    break;
-
-CONNECT_AUTH_INIT:
-  case CONNECT_AUTH_INIT: {
-    /* Needs user name and password */
-    size_t proxy_user_len, proxy_password_len;
-    if(sx->proxy_user && sx->proxy_password) {
-      proxy_user_len = strlen(sx->proxy_user);
-      proxy_password_len = strlen(sx->proxy_password);
-    }
-    else {
-      proxy_user_len = 0;
-      proxy_password_len = 0;
-    }
-
-    /*   username/password request looks like
-     * +----+------+----------+------+----------+
-     * |VER | ULEN |  UNAME   | PLEN |  PASSWD  |
-     * +----+------+----------+------+----------+
-     * | 1  |  1   | 1 to 255 |  1   | 1 to 255 |
-     * +----+------+----------+------+----------+
-     */
-    len = 0;
-    socksreq[len++] = 1;    /* username/pw subnegotiation version */
-    socksreq[len++] = (unsigned char) proxy_user_len;
-    if(sx->proxy_user && proxy_user_len) {
-      /* the length must fit in a single byte */
-      if(proxy_user_len > 255) {
-        failf(data, "Excessive user name length for proxy auth");
-        return CURLPX_LONG_USER;
-      }
-      memcpy(socksreq + len, sx->proxy_user, proxy_user_len);
-    }
-    len += proxy_user_len;
-    socksreq[len++] = (unsigned char) proxy_password_len;
-    if(sx->proxy_password && proxy_password_len) {
-      /* the length must fit in a single byte */
-      if(proxy_password_len > 255) {
-        failf(data, "Excessive password length for proxy auth");
-        return CURLPX_LONG_PASSWD;
-      }
-      memcpy(socksreq + len, sx->proxy_password, proxy_password_len);
-    }
-    len += proxy_password_len;
-    sxstate(sx, data, CONNECT_AUTH_SEND);
-    sx->outstanding = len;
-    sx->outp = socksreq;
   }
-    /* FALLTHROUGH */
-  case CONNECT_AUTH_SEND:
-    presult = socks_state_send(cf, sx, data, CURLPX_SEND_AUTH,
-                               "SOCKS5 sub-negotiation request");
-    if(CURLPX_OK != presult)
-      return presult;
-    else if(sx->outstanding) {
-      /* remain in sending state */
-      return CURLPX_OK;
-    }
-    sx->outp = socksreq;
-    sx->outstanding = 2;
-    sxstate(sx, data, CONNECT_AUTH_READ);
-    /* FALLTHROUGH */
-  case CONNECT_AUTH_READ:
-    presult = socks_state_recv(cf, sx, data, CURLPX_RECV_AUTH,
-                               "SOCKS5 sub-negotiation response");
-    if(CURLPX_OK != presult)
-      return presult;
-    else if(sx->outstanding) {
-      /* remain in reading state */
-      return CURLPX_OK;
-    }
-    /* ignore the first (VER) byte */
-    else if(socksreq[1]) { /* status */
-      failf(data, "User was rejected by the SOCKS5 server (%d %d).",
-            socksreq[0], socksreq[1]);
-      return CURLPX_USER_REJECTED;
-    }
 
+  case SOCKS5_ST_AUTH_INIT:
+    presult = socks5_auth_init(cf, sx, data);
+    if(presult)
+      return socks_failed(sx, cf, data, presult);
+    sxstate(sx, cf, data, SOCKS5_ST_AUTH_SEND);
+    FALLTHROUGH();
+
+  case SOCKS5_ST_AUTH_SEND:
+    presult = socks_flush(sx, cf, data, &done);
+    if(presult)
+      return socks_failed(sx, cf, data, presult);
+    else if(!done)
+      return CURLPX_OK;
+    sxstate(sx, cf, data, SOCKS5_ST_AUTH_RECV);
+    FALLTHROUGH();
+
+  case SOCKS5_ST_AUTH_RECV:
+    presult = socks_recv(sx, cf, data, 2, &done);
+    if(presult)
+      return socks_failed(sx, cf, data, presult);
+    else if(!done)
+      return CURLPX_OK;
+    presult = socks5_check_auth_resp(sx, cf, data);
+    if(presult)
+      return socks_failed(sx, cf, data, presult);
     /* Everything is good so far, user was authenticated! */
-    sxstate(sx, data, CONNECT_REQ_INIT);
-    /* FALLTHROUGH */
-CONNECT_REQ_INIT:
-  case CONNECT_REQ_INIT:
-    if(socks5_resolve_local) {
-      enum resolve_t rc = Curl_resolv(data, sx->hostname, sx->remote_port,
-                                      TRUE, &dns);
+    sxstate(sx, cf, data, SOCKS5_ST_REQ1_INIT);
+    FALLTHROUGH();
 
-      if(rc == CURLRESOLV_ERROR)
-        return CURLPX_RESOLVE_HOST;
-
-      if(rc == CURLRESOLV_PENDING) {
-        sxstate(sx, data, CONNECT_RESOLVING);
-        return CURLPX_OK;
-      }
-      sxstate(sx, data, CONNECT_RESOLVED);
-      goto CONNECT_RESOLVED;
+  case SOCKS5_ST_REQ1_INIT:
+    presult = socks5_req1_init(sx, cf, data);
+    if(presult)
+      return socks_failed(sx, cf, data, presult);
+    if(!sx->resolve_local) {
+      /* we do not resolve, request is complete */
+      sxstate(sx, cf, data, SOCKS5_ST_REQ1_SEND);
+      goto process_state;
     }
-    goto CONNECT_RESOLVE_REMOTE;
+    sx->start_resolving = TRUE;
+    sxstate(sx, cf, data, SOCKS5_ST_RESOLVING);
+    FALLTHROUGH();
 
-  case CONNECT_RESOLVING:
-    /* check if we have the name resolved by now */
-    dns = Curl_fetch_addr(data, sx->hostname, sx->remote_port);
-
-    if(dns) {
-#ifdef CURLRES_ASYNCH
-      data->state.async.dns = dns;
-      data->state.async.done = TRUE;
-#endif
-      infof(data, "SOCKS5: hostname '%s' found", sx->hostname);
-    }
-
-    if(!dns) {
-      result = Curl_resolv_check(data, &dns);
-      if(!dns) {
-        if(result)
-          return CURLPX_RESOLVE_HOST;
-        return CURLPX_OK;
-      }
-    }
-    /* FALLTHROUGH */
-CONNECT_RESOLVED:
-  case CONNECT_RESOLVED: {
-    char dest[MAX_IPADR_LEN] = "unknown";  /* printable address */
-    struct Curl_addrinfo *hp = NULL;
-    if(dns)
-      hp = dns->addr;
-    if(!hp) {
-      failf(data, "Failed to resolve \"%s\" for SOCKS5 connect.",
-            sx->hostname);
-      return CURLPX_RESOLVE_HOST;
-    }
-
-    Curl_printable_address(hp, dest, sizeof(dest));
-
-    len = 0;
-    socksreq[len++] = 5; /* version (SOCKS5) */
-    socksreq[len++] = 1; /* connect */
-    socksreq[len++] = 0; /* must be zero */
-    if(hp->ai_family == AF_INET) {
-      int i;
-      struct sockaddr_in *saddr_in;
-      socksreq[len++] = 1; /* ATYP: IPv4 = 1 */
-
-      saddr_in = (struct sockaddr_in *)(void *)hp->ai_addr;
-      for(i = 0; i < 4; i++) {
-        socksreq[len++] = ((unsigned char *)&saddr_in->sin_addr.s_addr)[i];
-      }
-
-      infof(data, "SOCKS5 connect to %s:%d (locally resolved)", dest,
-            sx->remote_port);
-    }
-#ifdef ENABLE_IPV6
-    else if(hp->ai_family == AF_INET6) {
-      int i;
-      struct sockaddr_in6 *saddr_in6;
-      socksreq[len++] = 4; /* ATYP: IPv6 = 4 */
-
-      saddr_in6 = (struct sockaddr_in6 *)(void *)hp->ai_addr;
-      for(i = 0; i < 16; i++) {
-        socksreq[len++] =
-          ((unsigned char *)&saddr_in6->sin6_addr.s6_addr)[i];
-      }
-
-      infof(data, "SOCKS5 connect to [%s]:%d (locally resolved)", dest,
-            sx->remote_port);
-    }
-#endif
-    else {
-      hp = NULL; /* fail! */
-      failf(data, "SOCKS5 connection to %s not supported", dest);
-    }
-
-    Curl_resolv_unlock(data, dns); /* not used anymore from now on */
-    goto CONNECT_REQ_SEND;
-  }
-CONNECT_RESOLVE_REMOTE:
-  case CONNECT_RESOLVE_REMOTE:
-    /* Authentication is complete, now specify destination to the proxy */
-    len = 0;
-    socksreq[len++] = 5; /* version (SOCKS5) */
-    socksreq[len++] = 1; /* connect */
-    socksreq[len++] = 0; /* must be zero */
-
-    if(!socks5_resolve_local) {
-      /* ATYP: domain name = 3,
-         IPv6 == 4,
-         IPv4 == 1 */
-      unsigned char ip4[4];
-#ifdef ENABLE_IPV6
-      if(conn->bits.ipv6_ip) {
-        char ip6[16];
-        if(1 != Curl_inet_pton(AF_INET6, sx->hostname, ip6))
-          return CURLPX_BAD_ADDRESS_TYPE;
-        socksreq[len++] = 4;
-        memcpy(&socksreq[len], ip6, sizeof(ip6));
-        len += sizeof(ip6);
-      }
-      else
-#endif
-      if(1 == Curl_inet_pton(AF_INET, sx->hostname, ip4)) {
-        socksreq[len++] = 1;
-        memcpy(&socksreq[len], ip4, sizeof(ip4));
-        len += sizeof(ip4);
-      }
-      else {
-        socksreq[len++] = 3;
-        socksreq[len++] = (char) hostname_len; /* one byte address length */
-        memcpy(&socksreq[len], sx->hostname, hostname_len); /* w/o NULL */
-        len += hostname_len;
-      }
-      infof(data, "SOCKS5 connect to %s:%d (remotely resolved)",
-            sx->hostname, sx->remote_port);
-    }
-    /* FALLTHROUGH */
-
-CONNECT_REQ_SEND:
-  case CONNECT_REQ_SEND:
-    /* PORT MSB */
-    socksreq[len++] = (unsigned char)((sx->remote_port >> 8) & 0xff);
-    /* PORT LSB */
-    socksreq[len++] = (unsigned char)(sx->remote_port & 0xff);
+  case SOCKS5_ST_RESOLVING:
+    presult = socks5_resolving(sx, cf, data, &done);
+    if(presult)
+      return socks_failed(sx, cf, data, presult);
+    if(!done)
+      return CURLPX_OK;
+    sxstate(sx, cf, data, SOCKS5_ST_REQ1_SEND);
+    FALLTHROUGH();
 
+  case SOCKS5_ST_REQ1_SEND:
+    presult = socks_flush(sx, cf, data, &done);
+    if(presult)
+      return socks_failed(sx, cf, data, presult);
+    else if(!done)
+      return CURLPX_OK;
 #if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
-    if(conn->socks5_gssapi_enctype) {
+    if(cf->conn->socks5_gssapi_enctype) {
       failf(data, "SOCKS5 GSS-API protection not yet implemented.");
       return CURLPX_GSSAPI_PROTECTION;
     }
 #endif
-    sx->outp = socksreq;
-    sx->outstanding = len;
-    sxstate(sx, data, CONNECT_REQ_SENDING);
-    /* FALLTHROUGH */
-  case CONNECT_REQ_SENDING:
-    presult = socks_state_send(cf, sx, data, CURLPX_SEND_REQUEST,
-                               "SOCKS5 connect request");
-    if(CURLPX_OK != presult)
-      return presult;
-    else if(sx->outstanding) {
-      /* remain in send state */
+    sxstate(sx, cf, data, SOCKS5_ST_RESP1_RECV);
+    FALLTHROUGH();
+
+  case SOCKS5_ST_RESP1_RECV:
+    presult = socks5_recv_resp1(sx, cf, data, &done);
+    if(presult)
+      return socks_failed(sx, cf, data, presult);
+    if(!done)
       return CURLPX_OK;
-    }
-#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
-    if(conn->socks5_gssapi_enctype) {
-      failf(data, "SOCKS5 GSS-API protection not yet implemented.");
-      return CURLPX_GSSAPI_PROTECTION;
-    }
-#endif
-    sx->outstanding = 10; /* minimum packet size is 10 */
-    sx->outp = socksreq;
-    sxstate(sx, data, CONNECT_REQ_READ);
-    /* FALLTHROUGH */
-  case CONNECT_REQ_READ:
-    presult = socks_state_recv(cf, sx, data, CURLPX_RECV_REQACK,
-                               "SOCKS5 connect request ack");
-    if(CURLPX_OK != presult)
-      return presult;
-    else if(sx->outstanding) {
-      /* remain in reading state */
-      return CURLPX_OK;
-    }
-    else if(socksreq[0] != 5) { /* version */
-      failf(data,
-            "SOCKS5 reply has wrong version, version should be 5.");
-      return CURLPX_BAD_VERSION;
-    }
-    else if(socksreq[1]) { /* Anything besides 0 is an error */
-      CURLproxycode rc = CURLPX_REPLY_UNASSIGNED;
-      int code = socksreq[1];
-      failf(data, "Can't complete SOCKS5 connection to %s. (%d)",
-            sx->hostname, (unsigned char)socksreq[1]);
-      if(code < 9) {
-        /* RFC 1928 section 6 lists: */
-        static const CURLproxycode lookup[] = {
-          CURLPX_OK,
-          CURLPX_REPLY_GENERAL_SERVER_FAILURE,
-          CURLPX_REPLY_NOT_ALLOWED,
-          CURLPX_REPLY_NETWORK_UNREACHABLE,
-          CURLPX_REPLY_HOST_UNREACHABLE,
-          CURLPX_REPLY_CONNECTION_REFUSED,
-          CURLPX_REPLY_TTL_EXPIRED,
-          CURLPX_REPLY_COMMAND_NOT_SUPPORTED,
-          CURLPX_REPLY_ADDRESS_TYPE_NOT_SUPPORTED,
-        };
-        rc = lookup[code];
-      }
-      return rc;
-    }
+    CURL_TRC_CF(data, cf, "SOCKS5 request granted.");
+    sxstate(sx, cf, data, SOCKS_ST_SUCCESS);
+    FALLTHROUGH();
 
-    /* Fix: in general, returned BND.ADDR is variable length parameter by RFC
-       1928, so the reply packet should be read until the end to avoid errors
-       at subsequent protocol level.
+  case SOCKS_ST_SUCCESS:
+    return CURLPX_OK;
 
-       +----+-----+-------+------+----------+----------+
-       |VER | REP |  RSV  | ATYP | BND.ADDR | BND.PORT |
-       +----+-----+-------+------+----------+----------+
-       | 1  |  1  | X'00' |  1   | Variable |    2     |
-       +----+-----+-------+------+----------+----------+
-
-       ATYP:
-       o  IP v4 address: X'01', BND.ADDR = 4 byte
-       o  domain name:  X'03', BND.ADDR = [ 1 byte length, string ]
-       o  IP v6 address: X'04', BND.ADDR = 16 byte
-    */
-
-    /* Calculate real packet size */
-    if(socksreq[3] == 3) {
-      /* domain name */
-      int addrlen = (int) socksreq[4];
-      len = 5 + addrlen + 2;
-    }
-    else if(socksreq[3] == 4) {
-      /* IPv6 */
-      len = 4 + 16 + 2;
-    }
-    else if(socksreq[3] == 1) {
-      len = 4 + 4 + 2;
-    }
-    else {
-      failf(data, "SOCKS5 reply has wrong address type.");
-      return CURLPX_BAD_ADDRESS_TYPE;
-    }
-
-    /* At this point we already read first 10 bytes */
-#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
-    if(!conn->socks5_gssapi_enctype) {
-      /* decrypt_gssapi_blockread already read the whole packet */
-#endif
-      if(len > 10) {
-        sx->outstanding = len - 10; /* get the rest */
-        sx->outp = &socksreq[10];
-        sxstate(sx, data, CONNECT_REQ_READ_MORE);
-      }
-      else {
-        sxstate(sx, data, CONNECT_DONE);
-        break;
-      }
-#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
-    }
-#endif
-    /* FALLTHROUGH */
-  case CONNECT_REQ_READ_MORE:
-    presult = socks_state_recv(cf, sx, data, CURLPX_RECV_ADDRESS,
-                               "SOCKS5 connect request address");
-    if(CURLPX_OK != presult)
-      return presult;
-    else if(sx->outstanding) {
-      /* remain in reading state */
-      return CURLPX_OK;
-    }
-    sxstate(sx, data, CONNECT_DONE);
-  }
-  infof(data, "SOCKS5 request granted.");
-
-  return CURLPX_OK; /* Proxy was successful! */
-}
-
-static CURLcode connect_SOCKS(struct Curl_cfilter *cf,
-                              struct socks_state *sxstate,
-                              struct Curl_easy *data)
-{
-  CURLcode result = CURLE_OK;
-  CURLproxycode pxresult = CURLPX_OK;
-  struct connectdata *conn = cf->conn;
-
-  switch(conn->socks_proxy.proxytype) {
-  case CURLPROXY_SOCKS5:
-  case CURLPROXY_SOCKS5_HOSTNAME:
-    pxresult = do_SOCKS5(cf, sxstate, data);
-    break;
-
-  case CURLPROXY_SOCKS4:
-  case CURLPROXY_SOCKS4A:
-    pxresult = do_SOCKS4(cf, sxstate, data);
-    break;
+  case SOCKS_ST_FAILED:
+    DEBUGASSERT(sx->presult);
+    return sx->presult;
 
   default:
-    failf(data, "unknown proxytype option given");
-    result = CURLE_COULDNT_CONNECT;
-  } /* switch proxytype */
-  if(pxresult) {
-    result = CURLE_PROXY;
-    data->info.pxcode = pxresult;
+    DEBUGASSERT(0);
+    return socks_failed(sx, cf, data, CURLPX_SEND_REQUEST);
   }
-
-  return result;
 }
 
-static void socks_proxy_cf_free(struct Curl_cfilter *cf)
+static void socks_proxy_ctx_free(struct socks_ctx *ctx)
 {
-  struct socks_state *sxstate = cf->ctx;
-  if(sxstate) {
-    free(sxstate);
-    cf->ctx = NULL;
+  if(ctx) {
+    Curl_peer_unlink(&ctx->dest);
+    Curl_creds_unlink(&ctx->creds);
+    Curl_bufq_free(&ctx->iobuf);
+    curlx_free(ctx);
   }
 }
 
 /* After a TCP connection to the proxy has been verified, this function does
-   the next magic steps. If 'done' isn't set TRUE, it is not done yet and
+   the next magic steps. If 'done' is not set TRUE, it is not done yet and
    must be called again.
 
    Note: this function's sub-functions call failf()
@@ -1102,151 +1196,195 @@ static void socks_proxy_cf_free(struct Curl_cfilter *cf)
 */
 static CURLcode socks_proxy_cf_connect(struct Curl_cfilter *cf,
                                        struct Curl_easy *data,
-                                       bool blocking, bool *done)
+                                       bool *done)
 {
+  struct socks_ctx *ctx = cf->ctx;
+  CURLproxycode pxresult = CURLPX_OK;
   CURLcode result;
-  struct connectdata *conn = cf->conn;
-  int sockindex = cf->sockindex;
-  struct socks_state *sx = cf->ctx;
 
   if(cf->connected) {
     *done = TRUE;
     return CURLE_OK;
   }
 
-  result = cf->next->cft->do_connect(cf->next, data, blocking, done);
+  result = cf->next->cft->do_connect(cf->next, data, done);
   if(result || !*done)
     return result;
 
-  if(!sx) {
-    sx = calloc(sizeof(*sx), 1);
-    if(!sx)
-      return CURLE_OUT_OF_MEMORY;
-    cf->ctx = sx;
+  switch(ctx->proxy_type) {
+  case CURLPROXY_SOCKS5:
+  case CURLPROXY_SOCKS5_HOSTNAME:
+    pxresult = socks5_connect(cf, ctx, data);
+    break;
+
+  case CURLPROXY_SOCKS4:
+  case CURLPROXY_SOCKS4A:
+    pxresult = socks4_connect(cf, ctx, data);
+    break;
+
+  default:
+    DEBUGASSERT(0); /* should not come here, checked it at creation time */
+    result = CURLE_COULDNT_CONNECT;
+    goto out;
   }
 
-  if(sx->state == CONNECT_INIT) {
-    /* for the secondary socket (FTP), use the "connect to host"
-     * but ignore the "connect to port" (use the secondary port)
-     */
-    sxstate(sx, data, CONNECT_SOCKS_INIT);
-    sx->hostname =
-      conn->bits.httpproxy ?
-      conn->http_proxy.host.name :
-      conn->bits.conn_to_host ?
-      conn->conn_to_host.name :
-      sockindex == SECONDARYSOCKET ?
-      conn->secondaryhostname : conn->host.name;
-    sx->remote_port =
-      conn->bits.httpproxy ? (int)conn->http_proxy.port :
-      sockindex == SECONDARYSOCKET ? conn->secondary_port :
-      conn->bits.conn_to_port ? conn->conn_to_port :
-      conn->remote_port;
-    sx->proxy_user = conn->socks_proxy.user;
-    sx->proxy_password = conn->socks_proxy.passwd;
+  if(pxresult) {
+    result = CURLE_PROXY;
+    data->info.pxcode = pxresult;
+    goto out;
   }
+  else if(ctx->state != SOCKS_ST_SUCCESS)
+    goto out;
 
-  result = connect_SOCKS(cf, sx, data);
-  if(!result && sx->state == CONNECT_DONE) {
-    cf->connected = TRUE;
-    Curl_verboseconnect(data, conn);
-    socks_proxy_cf_free(cf);
+#ifdef CURLVERBOSE
+  if(Curl_trc_is_verbose(data)) {
+    struct ip_quadruple ipquad;
+    bool is_ipv6;
+    if(!Curl_conn_cf_get_ip_info(cf->next, data, &is_ipv6, &ipquad))
+      infof(data, "Opened %sSOCKS connection from %s port %d to %s port %d "
+            "(via %s port %u)",
+            (cf->sockindex == SECONDARYSOCKET) ? "2nd " : "",
+            ipquad.local_ip, ipquad.local_port,
+            ctx->dest->hostname, ctx->dest->port,
+            ipquad.remote_ip, ipquad.remote_port);
+    else
+      infof(data, "Opened %sSOCKS connection",
+            (cf->sockindex == SECONDARYSOCKET) ? "2nd " : "");
   }
+#endif
+  cf->connected = TRUE;
 
-  *done = cf->connected;
+out:
+  *done = (bool)cf->connected;
+  if(*done || result)
+    Curl_creds_unlink(&ctx->creds);
   return result;
 }
 
-static int socks_cf_get_select_socks(struct Curl_cfilter *cf,
-                                     struct Curl_easy *data,
-                                     curl_socket_t *socks)
+static CURLcode socks_cf_adjust_pollset(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data,
+                                        struct easy_pollset *ps)
 {
-  struct socks_state *sx = cf->ctx;
-  int fds;
+  struct socks_ctx *sx = cf->ctx;
+  CURLcode result = CURLE_OK;
 
-  fds = cf->next->cft->get_select_socks(cf->next, data, socks);
-  if(!fds && cf->next->connected && !cf->connected && sx) {
+  if(!cf->connected && sx) {
     /* If we are not connected, the filter below is and has nothing
      * to wait on, we determine what to wait for. */
-    socks[0] = Curl_conn_cf_get_socket(cf, data);
+    curl_socket_t sock = Curl_conn_cf_get_socket(cf, data);
     switch(sx->state) {
-    case CONNECT_RESOLVING:
-    case CONNECT_SOCKS_READ:
-    case CONNECT_AUTH_READ:
-    case CONNECT_REQ_READ:
-    case CONNECT_REQ_READ_MORE:
-      fds = GETSOCK_READSOCK(0);
+    case SOCKS4_ST_SEND:
+    case SOCKS5_ST_REQ0_SEND:
+    case SOCKS5_ST_AUTH_SEND:
+    case SOCKS5_ST_REQ1_SEND:
+      CURL_TRC_CF(data, cf, "adjust pollset out (%d)", (int)sx->state);
+      result = Curl_pollset_set_out_only(data, ps, sock);
       break;
     default:
-      fds = GETSOCK_WRITESOCK(0);
+      CURL_TRC_CF(data, cf, "adjust pollset in (%d)", (int)sx->state);
+      result = Curl_pollset_set_in_only(data, ps, sock);
       break;
     }
   }
-  return fds;
-}
-
-static void socks_proxy_cf_close(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data)
-{
-
-  DEBUGASSERT(cf->next);
-  cf->connected = FALSE;
-  socks_proxy_cf_free(cf);
-  cf->next->cft->do_close(cf->next, data);
+  return result;
 }
 
 static void socks_proxy_cf_destroy(struct Curl_cfilter *cf,
                                    struct Curl_easy *data)
 {
   (void)data;
-  socks_proxy_cf_free(cf);
+  socks_proxy_ctx_free(cf->ctx);
+  cf->ctx = NULL;
 }
 
-static void socks_cf_get_host(struct Curl_cfilter *cf,
-                              struct Curl_easy *data,
-                              const char **phost,
-                              const char **pdisplay_host,
-                              int *pport)
+static CURLcode socks_cf_query(struct Curl_cfilter *cf,
+                               struct Curl_easy *data,
+                               int query, int *pres1, void *pres2)
 {
-  (void)data;
-  if(!cf->connected) {
-    *phost = cf->conn->socks_proxy.host.name;
-    *pdisplay_host = cf->conn->http_proxy.host.dispname;
-    *pport = (int)cf->conn->socks_proxy.port;
+  struct socks_ctx *sx = cf->ctx;
+
+  switch(query) {
+  case CF_QUERY_HOST_PORT:
+    if(sx) {
+      *pres1 = sx->dest->port;
+      *((const char **)pres2) = sx->dest->hostname;
+      return CURLE_OK;
+    }
+    break;
+  case CF_QUERY_ALPN_NEGOTIATED: {
+    const char **palpn = pres2;
+    DEBUGASSERT(palpn);
+    *palpn = NULL;
+    return CURLE_OK;
   }
-  else {
-    cf->next->cft->get_host(cf->next, data, phost, pdisplay_host, pport);
+  default:
+    break;
   }
+  return cf->next ?
+    cf->next->cft->query(cf->next, data, query, pres1, pres2) :
+    CURLE_UNKNOWN_OPTION;
 }
 
 struct Curl_cftype Curl_cft_socks_proxy = {
-  "SOCKS-PROXYY",
-  CF_TYPE_IP_CONNECT,
+  "SOCKS",
+  CF_TYPE_IP_CONNECT | CF_TYPE_PROXY,
   0,
   socks_proxy_cf_destroy,
   socks_proxy_cf_connect,
-  socks_proxy_cf_close,
-  socks_cf_get_host,
-  socks_cf_get_select_socks,
+  Curl_cf_def_shutdown,
+  socks_cf_adjust_pollset,
   Curl_cf_def_data_pending,
   Curl_cf_def_send,
   Curl_cf_def_recv,
   Curl_cf_def_cntrl,
   Curl_cf_def_conn_is_alive,
   Curl_cf_def_conn_keep_alive,
-  Curl_cf_def_query,
+  socks_cf_query,
 };
 
 CURLcode Curl_cf_socks_proxy_insert_after(struct Curl_cfilter *cf_at,
-                                          struct Curl_easy *data)
+                                          struct Curl_easy *data,
+                                          struct Curl_peer *dest,
+                                          uint8_t ip_version,
+                                          uint8_t proxy_type,
+                                          struct Curl_creds *creds)
 {
   struct Curl_cfilter *cf;
+  struct socks_ctx *ctx;
   CURLcode result;
 
-  (void)data;
-  result = Curl_cf_create(&cf, &Curl_cft_socks_proxy, NULL);
+  if(!dest)
+    return CURLE_FAILED_INIT;
+
+  switch(proxy_type) {
+  case CURLPROXY_SOCKS5:
+  case CURLPROXY_SOCKS5_HOSTNAME:
+  case CURLPROXY_SOCKS4:
+  case CURLPROXY_SOCKS4A:
+    break; /* all supported */
+  default:
+    failf(data, "unknown proxytype %d option given", proxy_type);
+    return CURLE_COULDNT_CONNECT;
+  }
+
+  /* NUL byte already part of struct size */
+  ctx = curlx_calloc(1, sizeof(*ctx));
+  if(!ctx) {
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  Curl_peer_link(&ctx->dest, dest);
+  ctx->ip_version = ip_version;
+  ctx->proxy_type = proxy_type;
+  Curl_creds_link(&ctx->creds, creds);
+  Curl_bufq_init2(&ctx->iobuf, SOCKS_CHUNK_SIZE, SOCKS_CHUNKS,
+                  BUFQ_OPT_SOFT_LIMIT);
+
+  result = Curl_cf_create(&cf, &Curl_cft_socks_proxy, ctx);
   if(!result)
     Curl_conn_cf_insert_after(cf_at, cf);
+  else
+    socks_proxy_ctx_free(ctx);
   return result;
 }
 
diff --git a/third-party/curl/lib/socks.h b/third-party/curl/lib/socks.h
index a3adcc6e91..d8e77c7f13 100644
--- a/third-party/curl/lib/socks.h
+++ b/third-party/curl/lib/socks.h
@@ -23,39 +23,47 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#ifdef CURL_DISABLE_PROXY
-#define Curl_SOCKS4(a,b,c,d,e) CURLE_NOT_BUILT_IN
-#define Curl_SOCKS5(a,b,c,d,e,f) CURLE_NOT_BUILT_IN
-#define Curl_SOCKS_getsock(x,y,z) 0
-#else
+#ifndef CURL_DISABLE_PROXY
+
+struct Curl_peer;
+struct Curl_creds;
+
 /*
  * Helper read-from-socket functions. Does the same as Curl_read() but it
  * blocks until all bytes amount of buffersize will be read. No more, no less.
  *
  * This is STUPID BLOCKING behavior
  */
-int Curl_blockread_all(struct Curl_cfilter *cf,
-                       struct Curl_easy *data,
-                       char *buf,
-                       ssize_t buffersize,
-                       ssize_t *n);
+CURLcode Curl_blockread_all(struct Curl_cfilter *cf,
+                            struct Curl_easy *data,
+                            char *buf,
+                            size_t blen,
+                            size_t *pnread);
 
 #if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
 /*
  * This function handles the SOCKS5 GSS-API negotiation and initialization
  */
 CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
-                                      struct Curl_easy *data);
+                                      struct Curl_easy *data,
+                                      struct Curl_creds *creds);
 #endif
 
+/* Insert a SOCKS filter after `cf_at` for connecting to `dest`.
+ * Credentials are optional and NOT duplicated and are
+ * expected to exist during connect phase.
+ */
 CURLcode Curl_cf_socks_proxy_insert_after(struct Curl_cfilter *cf_at,
-                                          struct Curl_easy *data);
+                                          struct Curl_easy *data,
+                                          struct Curl_peer *dest,
+                                          uint8_t ip_version,
+                                          uint8_t proxy_type,
+                                          struct Curl_creds *creds);
 
 extern struct Curl_cftype Curl_cft_socks_proxy;
 
-#endif /* CURL_DISABLE_PROXY */
+#endif /* !CURL_DISABLE_PROXY */
 
-#endif  /* HEADER_CURL_SOCKS_H */
+#endif /* HEADER_CURL_SOCKS_H */
diff --git a/third-party/curl/lib/socks_gssapi.c b/third-party/curl/lib/socks_gssapi.c
index 2ede8c7c29..e10899c7e7 100644
--- a/third-party/curl/lib/socks_gssapi.c
+++ b/third-party/curl/lib/socks_gssapi.c
@@ -22,26 +22,25 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if defined(HAVE_GSSAPI) && !defined(CURL_DISABLE_PROXY)
 
 #include "curl_gssapi.h"
 #include "urldata.h"
-#include "sendf.h"
+#include "curl_trc.h"
 #include "cfilters.h"
 #include "connect.h"
-#include "timeval.h"
+#include "curlx/nonblock.h"
 #include "socks.h"
-#include "warnless.h"
+#include "curlx/strdup.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
 
-static gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;
+#define MAX_GSS_LEN 1024
 
 /*
  * Helper GSS-API error functions.
@@ -55,10 +54,9 @@ static int check_gss_err(struct Curl_easy *data,
     OM_uint32 maj_stat, min_stat;
     OM_uint32 msg_ctx = 0;
     gss_buffer_desc status_string = GSS_C_EMPTY_BUFFER;
-    char buf[1024];
-    size_t len;
+    struct dynbuf dbuf;
 
-    len = 0;
+    curlx_dyn_init(&dbuf, MAX_GSS_LEN);
     msg_ctx = 0;
     while(!msg_ctx) {
       /* convert major status code (GSS-API error) to text */
@@ -67,19 +65,15 @@ static int check_gss_err(struct Curl_easy *data,
                                     GSS_C_NULL_OID,
                                     &msg_ctx, &status_string);
       if(maj_stat == GSS_S_COMPLETE) {
-        if(sizeof(buf) > len + status_string.length + 1) {
-          strcpy(buf + len, (char *) status_string.value);
-          len += status_string.length;
-        }
+        if(curlx_dyn_addn(&dbuf, status_string.value, status_string.length))
+          return 1; /* error */
         gss_release_buffer(&min_stat, &status_string);
         break;
       }
       gss_release_buffer(&min_stat, &status_string);
     }
-    if(sizeof(buf) > len + 3) {
-      strcpy(buf + len, ".\n");
-      len += 2;
-    }
+    if(curlx_dyn_addn(&dbuf, ".\n", 2))
+      return 1; /* error */
     msg_ctx = 0;
     while(!msg_ctx) {
       /* convert minor status code (underlying routine error) to text */
@@ -88,45 +82,79 @@ static int check_gss_err(struct Curl_easy *data,
                                     GSS_C_NULL_OID,
                                     &msg_ctx, &status_string);
       if(maj_stat == GSS_S_COMPLETE) {
-        if(sizeof(buf) > len + status_string.length)
-          strcpy(buf + len, (char *) status_string.value);
+        if(curlx_dyn_addn(&dbuf, status_string.value, status_string.length))
+          return 1; /* error */
         gss_release_buffer(&min_stat, &status_string);
         break;
       }
       gss_release_buffer(&min_stat, &status_string);
     }
-    failf(data, "GSS-API error: %s failed: %s", function, buf);
+    failf(data, "GSS-API error: %s failed: %s", function,
+          curlx_dyn_ptr(&dbuf));
+    curlx_dyn_free(&dbuf);
     return 1;
   }
 
   return 0;
 }
 
-CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
-                                      struct Curl_easy *data)
+static CURLcode socks5_gss_create_service_name(struct Curl_easy *data,
+                                               struct connectdata *conn,
+                                               const char *serviceptr,
+                                               gss_name_t *server)
 {
-  struct connectdata *conn = cf->conn;
-  curl_socket_t sock = conn->sock[cf->sockindex];
-  CURLcode code;
-  ssize_t actualread;
-  ssize_t nwritten;
-  int result;
   OM_uint32 gss_major_status, gss_minor_status, gss_status;
-  OM_uint32 gss_ret_flags;
-  int gss_conf_state, gss_enc;
-  gss_buffer_desc  service = GSS_C_EMPTY_BUFFER;
-  gss_buffer_desc  gss_send_token = GSS_C_EMPTY_BUFFER;
-  gss_buffer_desc  gss_recv_token = GSS_C_EMPTY_BUFFER;
-  gss_buffer_desc  gss_w_token = GSS_C_EMPTY_BUFFER;
+  gss_buffer_desc service = GSS_C_EMPTY_BUFFER;
+
+  /* prepare service name */
+  if(strchr(serviceptr, '/')) {
+    service.length = strlen(serviceptr);
+    service.value = curlx_memdup(serviceptr, service.length);
+    if(!service.value)
+      return CURLE_OUT_OF_MEMORY;
+
+    gss_major_status = gss_import_name(&gss_minor_status, &service,
+                                       (gss_OID)GSS_C_NULL_OID, server);
+  }
+  else {
+    service.value = curl_maprintf("%s@%s", serviceptr,
+                                  conn->socks_proxy.peer->hostname);
+    if(!service.value)
+      return CURLE_OUT_OF_MEMORY;
+    service.length = strlen(service.value);
+
+    gss_major_status = gss_import_name(&gss_minor_status, &service,
+                                       GSS_C_NT_HOSTBASED_SERVICE, server);
+  }
+
+  curlx_safefree(service.value);
+  service.length = 0;
+
+  if(check_gss_err(data, gss_major_status,
+                   gss_minor_status, "gss_import_name()")) {
+    failf(data, "Failed to create service name.");
+    gss_release_name(&gss_status, server);
+    return CURLE_COULDNT_CONNECT;
+  }
+
+  return CURLE_OK;
+}
+
+static CURLcode socks5_gss_auth_loop(struct Curl_cfilter *cf,
+                                     struct Curl_easy *data,
+                                     gss_name_t *server_ptr,
+                                     gss_ctx_id_t *gss_context,
+                                     OM_uint32 *gss_ret_flags)
+{
+  OM_uint32 gss_major_status, gss_minor_status, gss_status;
+  gss_buffer_desc gss_send_token = GSS_C_EMPTY_BUFFER;
+  gss_buffer_desc gss_recv_token = GSS_C_EMPTY_BUFFER;
   gss_buffer_desc *gss_token = GSS_C_NO_BUFFER;
-  gss_name_t       server = GSS_C_NO_NAME;
-  gss_name_t       gss_client_name = GSS_C_NO_NAME;
-  unsigned short   us_length;
-  char             *user = NULL;
-  unsigned char socksreq[4]; /* room for GSS-API exchange header only */
-  const char *serviceptr = data->set.str[STRING_PROXY_SERVICE_NAME] ?
-                           data->set.str[STRING_PROXY_SERVICE_NAME] : "rcmd";
-  const size_t serviceptr_length = strlen(serviceptr);
+  unsigned short us_length;
+  unsigned char socksreq[4];
+  size_t actualread;
+  size_t nwritten;
+  CURLcode result;
 
   /*   GSS-API request looks like
    * +----+------+-----+----------------+
@@ -136,104 +164,68 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
    * +----+------+-----+----------------+
    */
 
-  /* prepare service name */
-  if(strchr(serviceptr, '/')) {
-    service.length = serviceptr_length;
-    service.value = malloc(service.length);
-    if(!service.value)
-      return CURLE_OUT_OF_MEMORY;
-    memcpy(service.value, serviceptr, service.length);
-
-    gss_major_status = gss_import_name(&gss_minor_status, &service,
-                                       (gss_OID) GSS_C_NULL_OID, &server);
-  }
-  else {
-    service.value = malloc(serviceptr_length +
-                           strlen(conn->socks_proxy.host.name) + 2);
-    if(!service.value)
-      return CURLE_OUT_OF_MEMORY;
-    service.length = serviceptr_length +
-      strlen(conn->socks_proxy.host.name) + 1;
-    msnprintf(service.value, service.length + 1, "%s@%s",
-              serviceptr, conn->socks_proxy.host.name);
-
-    gss_major_status = gss_import_name(&gss_minor_status, &service,
-                                       GSS_C_NT_HOSTBASED_SERVICE, &server);
-  }
-
-  gss_release_buffer(&gss_status, &service); /* clear allocated memory */
-
-  if(check_gss_err(data, gss_major_status,
-                   gss_minor_status, "gss_import_name()")) {
-    failf(data, "Failed to create service name.");
-    gss_release_name(&gss_status, &server);
-    return CURLE_COULDNT_CONNECT;
-  }
-
-  (void)curlx_nonblock(sock, FALSE);
-
-  /* As long as we need to keep sending some context info, and there's no  */
-  /* errors, keep sending it...                                            */
+  /* As long as we need to keep sending some context info, and there is no
+   * errors, keep sending it... */
   for(;;) {
     gss_major_status = Curl_gss_init_sec_context(data,
                                                  &gss_minor_status,
-                                                 &gss_context,
-                                                 server,
+                                                 gss_context,
+                                                 *server_ptr,
                                                  &Curl_krb5_mech_oid,
                                                  NULL,
                                                  gss_token,
                                                  &gss_send_token,
                                                  TRUE,
-                                                 &gss_ret_flags);
+                                                 gss_ret_flags);
 
-    if(gss_token != GSS_C_NO_BUFFER)
-      gss_release_buffer(&gss_status, &gss_recv_token);
+    if(gss_token != GSS_C_NO_BUFFER) {
+      curlx_safefree(gss_recv_token.value);
+      gss_recv_token.length = 0;
+    }
     if(check_gss_err(data, gss_major_status,
-                     gss_minor_status, "gss_init_sec_context")) {
-      gss_release_name(&gss_status, &server);
-      gss_release_buffer(&gss_status, &gss_recv_token);
+                     gss_minor_status, "gss_init_sec_context") ||
+       /* the size needs to fit in a 16-bit field */
+       (gss_send_token.length > 0xffff)) {
+      gss_release_name(&gss_status, server_ptr);
       gss_release_buffer(&gss_status, &gss_send_token);
-      gss_delete_sec_context(&gss_status, &gss_context, NULL);
-      failf(data, "Failed to initial GSS-API token.");
+      Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
+      failf(data, "Failed to initialize GSS-API token.");
       return CURLE_COULDNT_CONNECT;
     }
 
     if(gss_send_token.length) {
       socksreq[0] = 1;    /* GSS-API subnegotiation version */
       socksreq[1] = 1;    /* authentication message type */
-      us_length = htons((short)gss_send_token.length);
+      us_length = htons((unsigned short)gss_send_token.length);
       memcpy(socksreq + 2, &us_length, sizeof(short));
 
-      nwritten = Curl_conn_cf_send(cf->next, data, (char *)socksreq, 4, &code);
-      if(code || (4 != nwritten)) {
+      result = Curl_conn_cf_send(cf->next, data, socksreq, 4, FALSE,
+                                 &nwritten);
+      if(result || (nwritten != 4)) {
         failf(data, "Failed to send GSS-API authentication request.");
-        gss_release_name(&gss_status, &server);
-        gss_release_buffer(&gss_status, &gss_recv_token);
+        gss_release_name(&gss_status, server_ptr);
         gss_release_buffer(&gss_status, &gss_send_token);
-        gss_delete_sec_context(&gss_status, &gss_context, NULL);
+        Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
         return CURLE_COULDNT_CONNECT;
       }
 
-      nwritten = Curl_conn_cf_send(cf->next, data,
-                                   (char *)gss_send_token.value,
-                                   gss_send_token.length, &code);
-      if(code || ((ssize_t)gss_send_token.length != nwritten)) {
+      result = Curl_conn_cf_send(cf->next, data,
+                                 gss_send_token.value,
+                                 gss_send_token.length, FALSE, &nwritten);
+      if(result || (gss_send_token.length != nwritten)) {
         failf(data, "Failed to send GSS-API authentication token.");
-        gss_release_name(&gss_status, &server);
-        gss_release_buffer(&gss_status, &gss_recv_token);
+        gss_release_name(&gss_status, server_ptr);
         gss_release_buffer(&gss_status, &gss_send_token);
-        gss_delete_sec_context(&gss_status, &gss_context, NULL);
+        Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
         return CURLE_COULDNT_CONNECT;
       }
-
     }
 
     gss_release_buffer(&gss_status, &gss_send_token);
-    gss_release_buffer(&gss_status, &gss_recv_token);
     if(gss_major_status != GSS_S_CONTINUE_NEEDED)
       break;
 
-    /* analyse response */
+    /* analyze response */
 
     /*   GSS-API response looks like
      * +----+------+-----+----------------+
@@ -246,8 +238,8 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
     result = Curl_blockread_all(cf, data, (char *)socksreq, 4, &actualread);
     if(result || (actualread != 4)) {
       failf(data, "Failed to receive GSS-API authentication response.");
-      gss_release_name(&gss_status, &server);
-      gss_delete_sec_context(&gss_status, &gss_context, NULL);
+      gss_release_name(&gss_status, server_ptr);
+      Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
       return CURLE_COULDNT_CONNECT;
     }
 
@@ -255,30 +247,37 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
     if(socksreq[1] == 255) { /* status / message type */
       failf(data, "User was rejected by the SOCKS5 server (%d %d).",
             socksreq[0], socksreq[1]);
-      gss_release_name(&gss_status, &server);
-      gss_delete_sec_context(&gss_status, &gss_context, NULL);
+      gss_release_name(&gss_status, server_ptr);
+      Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
       return CURLE_COULDNT_CONNECT;
     }
 
     if(socksreq[1] != 1) { /* status / message type */
       failf(data, "Invalid GSS-API authentication response type (%d %d).",
             socksreq[0], socksreq[1]);
-      gss_release_name(&gss_status, &server);
-      gss_delete_sec_context(&gss_status, &gss_context, NULL);
+      gss_release_name(&gss_status, server_ptr);
+      Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
       return CURLE_COULDNT_CONNECT;
     }
 
     memcpy(&us_length, socksreq + 2, sizeof(short));
     us_length = ntohs(us_length);
 
+    if(!us_length) {
+      failf(data, "Invalid zero-length GSS-API authentication token.");
+      gss_release_name(&gss_status, server_ptr);
+      Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
+      return CURLE_COULDNT_CONNECT;
+    }
+
     gss_recv_token.length = us_length;
-    gss_recv_token.value = malloc(us_length);
+    gss_recv_token.value = curlx_malloc(gss_recv_token.length);
     if(!gss_recv_token.value) {
       failf(data,
             "Could not allocate memory for GSS-API authentication "
             "response token.");
-      gss_release_name(&gss_status, &server);
-      gss_delete_sec_context(&gss_status, &gss_context, NULL);
+      gss_release_name(&gss_status, server_ptr);
+      Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
       return CURLE_OUT_OF_MEMORY;
     }
 
@@ -287,53 +286,74 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
 
     if(result || (actualread != us_length)) {
       failf(data, "Failed to receive GSS-API authentication token.");
-      gss_release_name(&gss_status, &server);
-      gss_release_buffer(&gss_status, &gss_recv_token);
-      gss_delete_sec_context(&gss_status, &gss_context, NULL);
+      gss_release_name(&gss_status, server_ptr);
+      curlx_safefree(gss_recv_token.value);
+      gss_recv_token.length = 0;
+      Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
       return CURLE_COULDNT_CONNECT;
     }
 
     gss_token = &gss_recv_token;
   }
 
-  gss_release_name(&gss_status, &server);
+  gss_release_name(&gss_status, server_ptr);
+  return CURLE_OK;
+}
+
+static CURLcode socks5_gss_auth_verify(struct Curl_easy *data,
+                                       gss_ctx_id_t *gss_context)
+{
+  OM_uint32 gss_major_status, gss_minor_status, gss_status;
+  gss_name_t gss_client_name = GSS_C_NO_NAME;
+  gss_buffer_desc gss_send_token = GSS_C_EMPTY_BUFFER;
 
   /* Everything is good so far, user was authenticated! */
-  gss_major_status = gss_inquire_context(&gss_minor_status, gss_context,
+  gss_major_status = gss_inquire_context(&gss_minor_status, *gss_context,
                                          &gss_client_name, NULL, NULL, NULL,
                                          NULL, NULL, NULL);
   if(check_gss_err(data, gss_major_status,
                    gss_minor_status, "gss_inquire_context")) {
-    gss_delete_sec_context(&gss_status, &gss_context, NULL);
+    Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
     gss_release_name(&gss_status, &gss_client_name);
-    failf(data, "Failed to determine user name.");
+    failf(data, "Failed to determine username.");
     return CURLE_COULDNT_CONNECT;
   }
   gss_major_status = gss_display_name(&gss_minor_status, gss_client_name,
                                       &gss_send_token, NULL);
   if(check_gss_err(data, gss_major_status,
                    gss_minor_status, "gss_display_name")) {
-    gss_delete_sec_context(&gss_status, &gss_context, NULL);
+    Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
     gss_release_name(&gss_status, &gss_client_name);
     gss_release_buffer(&gss_status, &gss_send_token);
-    failf(data, "Failed to determine user name.");
+    failf(data, "Failed to determine username.");
     return CURLE_COULDNT_CONNECT;
   }
-  user = malloc(gss_send_token.length + 1);
-  if(!user) {
-    gss_delete_sec_context(&gss_status, &gss_context, NULL);
-    gss_release_name(&gss_status, &gss_client_name);
-    gss_release_buffer(&gss_status, &gss_send_token);
-    return CURLE_OUT_OF_MEMORY;
-  }
 
-  memcpy(user, gss_send_token.value, gss_send_token.length);
-  user[gss_send_token.length] = '\0';
+  infof(data, "SOCKS5 server authenticated user %.*s with GSS-API.",
+        (int)gss_send_token.length, (const char *)gss_send_token.value);
+
   gss_release_name(&gss_status, &gss_client_name);
   gss_release_buffer(&gss_status, &gss_send_token);
-  infof(data, "SOCKS5 server authenticated user %s with GSS-API.",user);
-  free(user);
-  user = NULL;
+
+  return CURLE_OK;
+}
+
+static CURLcode socks5_gss_negotiate_enc(struct Curl_cfilter *cf,
+                                         struct Curl_easy *data,
+                                         gss_ctx_id_t *gss_context,
+                                         OM_uint32 gss_ret_flags)
+{
+  struct connectdata *conn = cf->conn;
+  OM_uint32 gss_major_status, gss_minor_status, gss_status;
+  gss_buffer_desc gss_send_token = GSS_C_EMPTY_BUFFER;
+  gss_buffer_desc gss_recv_token = GSS_C_EMPTY_BUFFER;
+  gss_buffer_desc gss_w_token = GSS_C_EMPTY_BUFFER;
+  unsigned short us_length;
+  unsigned char socksreq[4];
+  size_t actualread;
+  size_t nwritten;
+  CURLcode result;
+  int gss_enc;
 
   /* Do encryption */
   socksreq[0] = 1;    /* GSS-API subnegotiation version */
@@ -348,9 +368,9 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
     gss_enc = 1;
 
   infof(data, "SOCKS5 server supports GSS-API %s data protection.",
-        (gss_enc == 0)?"no":((gss_enc==1)?"integrity":"confidentiality"));
-  /* force for the moment to no data protection */
-  gss_enc = 0;
+        (gss_enc == 0) ? "no" :
+        ((gss_enc == 1) ? "integrity" : "confidentiality"));
+
   /*
    * Sending the encryption type in clear seems wrong. It should be
    * protected with gss_seal()/gss_wrap(). See RFC1961 extract below
@@ -377,7 +397,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
    *
    * The token is produced by encapsulating an octet containing the
    * required protection level using gss_seal()/gss_wrap() with conf_req
-   * set to FALSE.  The token is verified using gss_unseal()/
+   * set to FALSE. The token is verified using gss_unseal()/
    * gss_unwrap().
    *
    */
@@ -387,55 +407,55 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
   }
   else {
     gss_send_token.length = 1;
-    gss_send_token.value = malloc(1);
+    gss_send_token.value = curlx_memdup(&gss_enc, gss_send_token.length);
     if(!gss_send_token.value) {
-      gss_delete_sec_context(&gss_status, &gss_context, NULL);
+      Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
       return CURLE_OUT_OF_MEMORY;
     }
-    memcpy(gss_send_token.value, &gss_enc, 1);
 
-    gss_major_status = gss_wrap(&gss_minor_status, gss_context, 0,
+    gss_major_status = gss_wrap(&gss_minor_status, *gss_context, 0,
                                 GSS_C_QOP_DEFAULT, &gss_send_token,
-                                &gss_conf_state, &gss_w_token);
+                                NULL, &gss_w_token);
 
     if(check_gss_err(data, gss_major_status, gss_minor_status, "gss_wrap")) {
-      gss_release_buffer(&gss_status, &gss_send_token);
+      curlx_safefree(gss_send_token.value);
+      gss_send_token.length = 0;
       gss_release_buffer(&gss_status, &gss_w_token);
-      gss_delete_sec_context(&gss_status, &gss_context, NULL);
+      Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
       failf(data, "Failed to wrap GSS-API encryption value into token.");
       return CURLE_COULDNT_CONNECT;
     }
-    gss_release_buffer(&gss_status, &gss_send_token);
+    curlx_safefree(gss_send_token.value);
+    gss_send_token.length = 0;
 
-    us_length = htons((short)gss_w_token.length);
+    us_length = htons((unsigned short)gss_w_token.length);
     memcpy(socksreq + 2, &us_length, sizeof(short));
   }
 
-  nwritten = Curl_conn_cf_send(cf->next, data, (char *)socksreq, 4, &code);
-  if(code  || (4 != nwritten)) {
+  result = Curl_conn_cf_send(cf->next, data, socksreq, 4, FALSE, &nwritten);
+  if(result || (nwritten != 4)) {
     failf(data, "Failed to send GSS-API encryption request.");
     gss_release_buffer(&gss_status, &gss_w_token);
-    gss_delete_sec_context(&gss_status, &gss_context, NULL);
+    Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
     return CURLE_COULDNT_CONNECT;
   }
 
   if(data->set.socks5_gssapi_nec) {
     memcpy(socksreq, &gss_enc, 1);
-    nwritten = Curl_conn_cf_send(cf->next, data, (char *)socksreq, 1, &code);
-    if(code || ( 1 != nwritten)) {
+    result = Curl_conn_cf_send(cf->next, data, socksreq, 1, FALSE, &nwritten);
+    if(result || (nwritten != 1)) {
       failf(data, "Failed to send GSS-API encryption type.");
-      gss_delete_sec_context(&gss_status, &gss_context, NULL);
+      Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
       return CURLE_COULDNT_CONNECT;
     }
   }
   else {
-    nwritten = Curl_conn_cf_send(cf->next, data,
-                                 (char *)gss_w_token.value,
-                                 gss_w_token.length, &code);
-    if(code || ((ssize_t)gss_w_token.length != nwritten)) {
+    result = Curl_conn_cf_send(cf->next, data, gss_w_token.value,
+                               gss_w_token.length, FALSE, &nwritten);
+    if(result || (gss_w_token.length != nwritten)) {
       failf(data, "Failed to send GSS-API encryption type.");
       gss_release_buffer(&gss_status, &gss_w_token);
-      gss_delete_sec_context(&gss_status, &gss_context, NULL);
+      Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
       return CURLE_COULDNT_CONNECT;
     }
     gss_release_buffer(&gss_status, &gss_w_token);
@@ -444,7 +464,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
   result = Curl_blockread_all(cf, data, (char *)socksreq, 4, &actualread);
   if(result || (actualread != 4)) {
     failf(data, "Failed to receive GSS-API encryption response.");
-    gss_delete_sec_context(&gss_status, &gss_context, NULL);
+    Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
     return CURLE_COULDNT_CONNECT;
   }
 
@@ -452,55 +472,64 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
   if(socksreq[1] == 255) { /* status / message type */
     failf(data, "User was rejected by the SOCKS5 server (%d %d).",
           socksreq[0], socksreq[1]);
-    gss_delete_sec_context(&gss_status, &gss_context, NULL);
+    Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
     return CURLE_COULDNT_CONNECT;
   }
 
   if(socksreq[1] != 2) { /* status / message type */
     failf(data, "Invalid GSS-API encryption response type (%d %d).",
           socksreq[0], socksreq[1]);
-    gss_delete_sec_context(&gss_status, &gss_context, NULL);
+    Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
     return CURLE_COULDNT_CONNECT;
   }
 
   memcpy(&us_length, socksreq + 2, sizeof(short));
   us_length = ntohs(us_length);
 
+  if(!us_length) {
+    failf(data, "Invalid zero-length GSS-API encryption token.");
+    Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
+    return CURLE_COULDNT_CONNECT;
+  }
+
   gss_recv_token.length = us_length;
-  gss_recv_token.value = malloc(gss_recv_token.length);
+  gss_recv_token.value = curlx_malloc(gss_recv_token.length);
   if(!gss_recv_token.value) {
-    gss_delete_sec_context(&gss_status, &gss_context, NULL);
+    Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
     return CURLE_OUT_OF_MEMORY;
   }
   result = Curl_blockread_all(cf, data, (char *)gss_recv_token.value,
                               gss_recv_token.length, &actualread);
 
   if(result || (actualread != us_length)) {
-    failf(data, "Failed to receive GSS-API encryptrion type.");
-    gss_release_buffer(&gss_status, &gss_recv_token);
-    gss_delete_sec_context(&gss_status, &gss_context, NULL);
+    failf(data, "Failed to receive GSS-API encryption type.");
+    curlx_safefree(gss_recv_token.value);
+    gss_recv_token.length = 0;
+    Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
     return CURLE_COULDNT_CONNECT;
   }
 
   if(!data->set.socks5_gssapi_nec) {
-    gss_major_status = gss_unwrap(&gss_minor_status, gss_context,
+    gss_major_status = gss_unwrap(&gss_minor_status, *gss_context,
                                   &gss_recv_token, &gss_w_token,
-                                  0, GSS_C_QOP_DEFAULT);
+                                  NULL, NULL);
 
     if(check_gss_err(data, gss_major_status, gss_minor_status, "gss_unwrap")) {
-      gss_release_buffer(&gss_status, &gss_recv_token);
+      curlx_safefree(gss_recv_token.value);
+      gss_recv_token.length = 0;
       gss_release_buffer(&gss_status, &gss_w_token);
-      gss_delete_sec_context(&gss_status, &gss_context, NULL);
+      Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
       failf(data, "Failed to unwrap GSS-API encryption value into token.");
       return CURLE_COULDNT_CONNECT;
     }
-    gss_release_buffer(&gss_status, &gss_recv_token);
+    curlx_safefree(gss_recv_token.value);
+    gss_recv_token.length = 0;
 
     if(gss_w_token.length != 1) {
       failf(data, "Invalid GSS-API encryption response length (%zu).",
             gss_w_token.length);
       gss_release_buffer(&gss_status, &gss_w_token);
-      gss_delete_sec_context(&gss_status, &gss_context, NULL);
+      Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
       return CURLE_COULDNT_CONNECT;
     }
 
@@ -511,26 +540,61 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
     if(gss_recv_token.length != 1) {
       failf(data, "Invalid GSS-API encryption response length (%zu).",
             gss_recv_token.length);
-      gss_release_buffer(&gss_status, &gss_recv_token);
-      gss_delete_sec_context(&gss_status, &gss_context, NULL);
+      curlx_safefree(gss_recv_token.value);
+      gss_recv_token.length = 0;
+      Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
       return CURLE_COULDNT_CONNECT;
     }
 
     memcpy(socksreq, gss_recv_token.value, gss_recv_token.length);
-    gss_release_buffer(&gss_status, &gss_recv_token);
+    curlx_safefree(gss_recv_token.value);
+    gss_recv_token.length = 0;
   }
 
-  (void)curlx_nonblock(sock, TRUE);
-
-  infof(data, "SOCKS5 access with%s protection granted.",
-        (socksreq[0] == 0)?"out GSS-API data":
-        ((socksreq[0] == 1)?" GSS-API integrity":" GSS-API confidentiality"));
+  infof(data, "SOCKS5 access %s protection granted.",
+        (socksreq[0] == 0) ? "without GSS-API data" :
+         ((socksreq[0] == 1) ? "with GSS-API integrity" :
+          "with GSS-API confidentiality"));
 
   conn->socks5_gssapi_enctype = socksreq[0];
   if(socksreq[0] == 0)
-    gss_delete_sec_context(&gss_status, &gss_context, NULL);
+    Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
 
   return CURLE_OK;
 }
 
+CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
+                                      struct Curl_easy *data,
+                                      struct Curl_creds *creds)
+{
+  struct connectdata *conn = cf->conn;
+  curl_socket_t sock = conn->sock[cf->sockindex];
+  CURLcode result;
+  OM_uint32 gss_ret_flags = 0;
+  gss_name_t server = GSS_C_NO_NAME;
+  const char *service = Curl_creds_has_sasl_service(creds) ?
+    Curl_creds_sasl_service(creds) : "rcmd";
+  gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;
+
+  result = socks5_gss_create_service_name(data, conn, service, &server);
+  if(!result) {
+    (void)curlx_nonblock(sock, FALSE);
+    result = socks5_gss_auth_loop(cf, data, &server, &gss_context,
+                                  &gss_ret_flags);
+  }
+  if(!result)
+    result = socks5_gss_auth_verify(data, &gss_context);
+  if(!result)
+    result = socks5_gss_negotiate_enc(cf, data, &gss_context, gss_ret_flags);
+
+  /* unconditionally put it back to non-blocking */
+  (void)curlx_nonblock(sock, TRUE);
+
+  return result;
+}
+
+#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
+#pragma GCC diagnostic pop
+#endif
+
 #endif /* HAVE_GSSAPI && !CURL_DISABLE_PROXY */
diff --git a/third-party/curl/lib/socks_sspi.c b/third-party/curl/lib/socks_sspi.c
index d1200ea037..10a8be1773 100644
--- a/third-party/curl/lib/socks_sspi.c
+++ b/third-party/curl/lib/socks_sspi.c
@@ -22,26 +22,19 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if defined(USE_WINDOWS_SSPI) && !defined(CURL_DISABLE_PROXY)
 
 #include "urldata.h"
-#include "sendf.h"
+#include "curl_trc.h"
 #include "cfilters.h"
 #include "connect.h"
 #include "strerror.h"
-#include "timeval.h"
+#include "curlx/nonblock.h"
 #include "socks.h"
 #include "curl_sspi.h"
-#include "curl_multibyte.h"
-#include "warnless.h"
-#include "strdup.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curlx/multibyte.h"
 
 /*
  * Helper sspi error functions.
@@ -63,58 +56,70 @@ static int check_sspi_err(struct Curl_easy *data,
 }
 
 /* This is the SSPI-using version of this function */
-CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
-                                      struct Curl_easy *data)
+static CURLcode socks5_sspi_setup(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  struct Curl_creds *creds,
+                                  CredHandle *cred_handle,
+                                  char **service_namep)
+{
+  struct connectdata *conn = cf->conn;
+  const char *service = Curl_creds_has_sasl_service(creds) ?
+    Curl_creds_sasl_service(creds) : "rcmd";
+  SECURITY_STATUS status;
+
+  /* prepare service name */
+  if(strchr(service, '/'))
+    *service_namep = curlx_strdup(service);
+  else
+    *service_namep = curl_maprintf("%s/%s",
+                                   service, conn->socks_proxy.peer->hostname);
+  if(!*service_namep)
+    return CURLE_OUT_OF_MEMORY;
+
+  status =
+    Curl_pSecFn->AcquireCredentialsHandle(NULL,
+                                       (TCHAR *)CURL_UNCONST(TEXT("Kerberos")),
+                                          SECPKG_CRED_OUTBOUND,
+                                          NULL, NULL, NULL, NULL,
+                                          cred_handle, NULL);
+
+  if(check_sspi_err(data, status, "AcquireCredentialsHandle")) {
+    failf(data, "Failed to acquire credentials.");
+    return CURLE_COULDNT_CONNECT;
+  }
+
+  return CURLE_OK;
+}
+
+static CURLcode socks5_free_token(SecBuffer *send_token,
+                                  CURLcode result)
+{
+  if(send_token->pvBuffer) {
+    Curl_pSecFn->FreeContextBuffer(send_token->pvBuffer);
+    send_token->pvBuffer = NULL;
+  }
+  return result;
+}
+
+static CURLcode socks5_sspi_loop(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 CredHandle *cred_handle,
+                                 CtxtHandle *sspi_context,
+                                 char *service_name,
+                                 unsigned long *sspi_ret_flagsp)
 {
   struct connectdata *conn = cf->conn;
   curl_socket_t sock = conn->sock[cf->sockindex];
+  CURLcode result = CURLE_OK;
   CURLcode code;
-  ssize_t actualread;
-  ssize_t written;
-  int result;
-  /* Needs GSS-API authentication */
   SECURITY_STATUS status;
-  unsigned long sspi_ret_flags = 0;
-  unsigned char gss_enc;
-  SecBuffer sspi_send_token, sspi_recv_token, sspi_w_token[3];
-  SecBufferDesc input_desc, output_desc, wrap_desc;
-  SecPkgContext_Sizes sspi_sizes;
-  CredHandle cred_handle;
-  CtxtHandle sspi_context;
+  SecBuffer sspi_send_token, sspi_recv_token;
+  SecBufferDesc input_desc, output_desc;
   PCtxtHandle context_handle = NULL;
-  SecPkgCredentials_Names names;
-  TimeStamp expiry;
-  char *service_name = NULL;
   unsigned short us_length;
-  unsigned long qop;
-  unsigned char socksreq[4]; /* room for GSS-API exchange header only */
-  const char *service = data->set.str[STRING_PROXY_SERVICE_NAME] ?
-    data->set.str[STRING_PROXY_SERVICE_NAME]  : "rcmd";
-  const size_t service_length = strlen(service);
-
-  /*   GSS-API request looks like
-   * +----+------+-----+----------------+
-   * |VER | MTYP | LEN |     TOKEN      |
-   * +----+------+----------------------+
-   * | 1  |  1   |  2  | up to 2^16 - 1 |
-   * +----+------+-----+----------------+
-   */
-
-  /* prepare service name */
-  if(strchr(service, '/')) {
-    service_name = strdup(service);
-    if(!service_name)
-      return CURLE_OUT_OF_MEMORY;
-  }
-  else {
-    service_name = malloc(service_length +
-                          strlen(conn->socks_proxy.host.name) + 2);
-    if(!service_name)
-      return CURLE_OUT_OF_MEMORY;
-    msnprintf(service_name, service_length +
-              strlen(conn->socks_proxy.host.name) + 2, "%s/%s",
-              service, conn->socks_proxy.host.name);
-  }
+  size_t actualread;
+  size_t written;
+  unsigned char socksreq[4];
 
   input_desc.cBuffers = 1;
   input_desc.pBuffers = &sspi_recv_token;
@@ -132,420 +137,293 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
   sspi_send_token.cbBuffer = 0;
   sspi_send_token.pvBuffer = NULL;
 
-  wrap_desc.cBuffers = 3;
-  wrap_desc.pBuffers = sspi_w_token;
-  wrap_desc.ulVersion = SECBUFFER_VERSION;
-
-  cred_handle.dwLower = 0;
-  cred_handle.dwUpper = 0;
-
-  status = s_pSecFn->AcquireCredentialsHandle(NULL,
-                                              (TCHAR *) TEXT("Kerberos"),
-                                              SECPKG_CRED_OUTBOUND,
-                                              NULL,
-                                              NULL,
-                                              NULL,
-                                              NULL,
-                                              &cred_handle,
-                                              &expiry);
-
-  if(check_sspi_err(data, status, "AcquireCredentialsHandle")) {
-    failf(data, "Failed to acquire credentials.");
-    free(service_name);
-    s_pSecFn->FreeCredentialsHandle(&cred_handle);
-    return CURLE_COULDNT_CONNECT;
-  }
-
   (void)curlx_nonblock(sock, FALSE);
 
-  /* As long as we need to keep sending some context info, and there's no  */
-  /* errors, keep sending it...                                            */
   for(;;) {
-    TCHAR *sname;
-
-    sname = curlx_convert_UTF8_to_tchar(service_name);
-    if(!sname)
-      return CURLE_OUT_OF_MEMORY;
-
-    status = s_pSecFn->InitializeSecurityContext(&cred_handle,
-                                                 context_handle,
-                                                 sname,
-                                                 ISC_REQ_MUTUAL_AUTH |
-                                                 ISC_REQ_ALLOCATE_MEMORY |
-                                                 ISC_REQ_CONFIDENTIALITY |
-                                                 ISC_REQ_REPLAY_DETECT,
-                                                 0,
-                                                 SECURITY_NATIVE_DREP,
-                                                 &input_desc,
-                                                 0,
-                                                 &sspi_context,
-                                                 &output_desc,
-                                                 &sspi_ret_flags,
-                                                 &expiry);
-
-    curlx_unicodefree(sname);
-
-    if(sspi_recv_token.pvBuffer) {
-      s_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer);
-      sspi_recv_token.pvBuffer = NULL;
-      sspi_recv_token.cbBuffer = 0;
+    TCHAR *sname = curlx_convert_UTF8_to_tchar(service_name);
+    if(!sname) {
+      curlx_free(sspi_recv_token.pvBuffer);
+      return socks5_free_token(&sspi_send_token, CURLE_OUT_OF_MEMORY);
     }
 
+    status =
+      Curl_pSecFn->InitializeSecurityContext(cred_handle, context_handle,
+                                             sname,
+                                             ISC_REQ_MUTUAL_AUTH |
+                                             ISC_REQ_ALLOCATE_MEMORY |
+                                             ISC_REQ_CONFIDENTIALITY |
+                                             ISC_REQ_REPLAY_DETECT,
+                                             0, SECURITY_NATIVE_DREP,
+                                             &input_desc, 0,
+                                             sspi_context,
+                                             &output_desc,
+                                             sspi_ret_flagsp, NULL);
+
+    curlx_free(sname);
+    curlx_safefree(sspi_recv_token.pvBuffer);
+    sspi_recv_token.cbBuffer = 0;
+
     if(check_sspi_err(data, status, "InitializeSecurityContext")) {
-      free(service_name);
-      s_pSecFn->FreeCredentialsHandle(&cred_handle);
-      s_pSecFn->DeleteSecurityContext(&sspi_context);
-      if(sspi_recv_token.pvBuffer)
-        s_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer);
-      failf(data, "Failed to initialise security context.");
-      return CURLE_COULDNT_CONNECT;
+      failf(data, "Failed to initialize security context.");
+      return socks5_free_token(&sspi_send_token, CURLE_COULDNT_CONNECT);
     }
 
     if(sspi_send_token.cbBuffer) {
-      socksreq[0] = 1;    /* GSS-API subnegotiation version */
-      socksreq[1] = 1;    /* authentication message type */
-      us_length = htons((short)sspi_send_token.cbBuffer);
+      socksreq[0] = 1; /* GSS-API subnegotiation version */
+      socksreq[1] = 1; /* authentication message type */
+      if(sspi_send_token.cbBuffer > 0xffff) {
+        /* needs to fit in an unsigned 16-bit field */
+        return socks5_free_token(&sspi_send_token, CURLE_COULDNT_CONNECT);
+      }
+      us_length = htons((unsigned short)sspi_send_token.cbBuffer);
       memcpy(socksreq + 2, &us_length, sizeof(short));
 
-      written = Curl_conn_cf_send(cf->next, data, (char *)socksreq, 4, &code);
-      if(code || (4 != written)) {
+      code = Curl_conn_cf_send(cf->next, data, socksreq, 4, FALSE, &written);
+      if(code || (written != 4)) {
         failf(data, "Failed to send SSPI authentication request.");
-        free(service_name);
-        if(sspi_send_token.pvBuffer)
-          s_pSecFn->FreeContextBuffer(sspi_send_token.pvBuffer);
-        if(sspi_recv_token.pvBuffer)
-          s_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer);
-        s_pSecFn->FreeCredentialsHandle(&cred_handle);
-        s_pSecFn->DeleteSecurityContext(&sspi_context);
-        return CURLE_COULDNT_CONNECT;
+        return socks5_free_token(&sspi_send_token, CURLE_COULDNT_CONNECT);
       }
 
-      written = Curl_conn_cf_send(cf->next, data,
-                                  (char *)sspi_send_token.pvBuffer,
-                                  sspi_send_token.cbBuffer, &code);
-      if(code || (sspi_send_token.cbBuffer != (size_t)written)) {
+      code = Curl_conn_cf_send(cf->next, data,
+                               sspi_send_token.pvBuffer,
+                               sspi_send_token.cbBuffer, FALSE, &written);
+      if(code || (sspi_send_token.cbBuffer != written)) {
         failf(data, "Failed to send SSPI authentication token.");
-        free(service_name);
-        if(sspi_send_token.pvBuffer)
-          s_pSecFn->FreeContextBuffer(sspi_send_token.pvBuffer);
-        if(sspi_recv_token.pvBuffer)
-          s_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer);
-        s_pSecFn->FreeCredentialsHandle(&cred_handle);
-        s_pSecFn->DeleteSecurityContext(&sspi_context);
-        return CURLE_COULDNT_CONNECT;
+        return socks5_free_token(&sspi_send_token, CURLE_COULDNT_CONNECT);
       }
-
     }
 
-    if(sspi_send_token.pvBuffer) {
-      s_pSecFn->FreeContextBuffer(sspi_send_token.pvBuffer);
-      sspi_send_token.pvBuffer = NULL;
-    }
+    if(sspi_send_token.pvBuffer)
+      socks5_free_token(&sspi_send_token, CURLE_OK);
     sspi_send_token.cbBuffer = 0;
 
-    if(sspi_recv_token.pvBuffer) {
-      s_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer);
-      sspi_recv_token.pvBuffer = NULL;
-    }
+    curlx_safefree(sspi_recv_token.pvBuffer);
     sspi_recv_token.cbBuffer = 0;
 
     if(status != SEC_I_CONTINUE_NEEDED)
       break;
 
-    /* analyse response */
-
-    /*   GSS-API response looks like
-     * +----+------+-----+----------------+
-     * |VER | MTYP | LEN |     TOKEN      |
-     * +----+------+----------------------+
-     * | 1  |  1   |  2  | up to 2^16 - 1 |
-     * +----+------+-----+----------------+
-     */
-
     result = Curl_blockread_all(cf, data, (char *)socksreq, 4, &actualread);
     if(result || (actualread != 4)) {
       failf(data, "Failed to receive SSPI authentication response.");
-      free(service_name);
-      s_pSecFn->FreeCredentialsHandle(&cred_handle);
-      s_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_COULDNT_CONNECT;
+      return result ? result : CURLE_COULDNT_CONNECT;
     }
 
-    /* ignore the first (VER) byte */
-    if(socksreq[1] == 255) { /* status / message type */
+    if(socksreq[1] == 255) {
       failf(data, "User was rejected by the SOCKS5 server (%u %u).",
             (unsigned int)socksreq[0], (unsigned int)socksreq[1]);
-      free(service_name);
-      s_pSecFn->FreeCredentialsHandle(&cred_handle);
-      s_pSecFn->DeleteSecurityContext(&sspi_context);
       return CURLE_COULDNT_CONNECT;
     }
 
-    if(socksreq[1] != 1) { /* status / message type */
+    if(socksreq[1] != 1) {
       failf(data, "Invalid SSPI authentication response type (%u %u).",
             (unsigned int)socksreq[0], (unsigned int)socksreq[1]);
-      free(service_name);
-      s_pSecFn->FreeCredentialsHandle(&cred_handle);
-      s_pSecFn->DeleteSecurityContext(&sspi_context);
       return CURLE_COULDNT_CONNECT;
     }
 
     memcpy(&us_length, socksreq + 2, sizeof(short));
     us_length = ntohs(us_length);
 
-    sspi_recv_token.cbBuffer = us_length;
-    sspi_recv_token.pvBuffer = malloc(us_length);
-
-    if(!sspi_recv_token.pvBuffer) {
-      free(service_name);
-      s_pSecFn->FreeCredentialsHandle(&cred_handle);
-      s_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_OUT_OF_MEMORY;
+    if(!us_length) {
+      failf(data, "Invalid zero-length SSPI authentication token.");
+      return CURLE_COULDNT_CONNECT;
     }
+
+    sspi_recv_token.cbBuffer = us_length;
+    sspi_recv_token.pvBuffer = curlx_malloc(us_length);
+
+    if(!sspi_recv_token.pvBuffer)
+      return CURLE_OUT_OF_MEMORY;
+
     result = Curl_blockread_all(cf, data, (char *)sspi_recv_token.pvBuffer,
                                 sspi_recv_token.cbBuffer, &actualread);
 
     if(result || (actualread != us_length)) {
       failf(data, "Failed to receive SSPI authentication token.");
-      free(service_name);
-      if(sspi_recv_token.pvBuffer)
-        s_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer);
-      s_pSecFn->FreeCredentialsHandle(&cred_handle);
-      s_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_COULDNT_CONNECT;
+      curlx_free(sspi_recv_token.pvBuffer);
+      return result ? result : CURLE_COULDNT_CONNECT;
     }
 
-    context_handle = &sspi_context;
+    context_handle = sspi_context;
   }
 
-  free(service_name);
+  return CURLE_OK;
+}
 
-  /* Everything is good so far, user was authenticated! */
-  status = s_pSecFn->QueryCredentialsAttributes(&cred_handle,
-                                                SECPKG_CRED_ATTR_NAMES,
-                                                &names);
-  s_pSecFn->FreeCredentialsHandle(&cred_handle);
-  if(check_sspi_err(data, status, "QueryCredentialAttributes")) {
-    s_pSecFn->DeleteSecurityContext(&sspi_context);
-    s_pSecFn->FreeContextBuffer(names.sUserName);
-    failf(data, "Failed to determine user name.");
-    return CURLE_COULDNT_CONNECT;
-  }
-  infof(data, "SOCKS5 server authenticated user %s with GSS-API.",
-        names.sUserName);
-  s_pSecFn->FreeContextBuffer(names.sUserName);
+static CURLcode socks5_free(SecBuffer *sspi_w_token,
+                            CURLcode result)
+{
+  curlx_safefree(sspi_w_token[0].pvBuffer);
+  curlx_safefree(sspi_w_token[1].pvBuffer);
+  curlx_safefree(sspi_w_token[2].pvBuffer);
+  return result;
+}
 
-  /* Do encryption */
-  socksreq[0] = 1;    /* GSS-API subnegotiation version */
-  socksreq[1] = 2;    /* encryption message type */
+static CURLcode socks5_sspi_encrypt(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    CtxtHandle *sspi_context,
+                                    unsigned long sspi_ret_flags)
+{
+  CURLcode result = CURLE_OK;
+  CURLcode code;
+  SECURITY_STATUS status;
+  unsigned char gss_enc;
+  SecBuffer sspi_w_token[3];
+  SecBufferDesc wrap_desc;
+  SecPkgContext_Sizes sspi_sizes;
+  unsigned short us_length;
+  unsigned long qop;
+  unsigned char socksreq[4];
+  uint8_t *etbuf = NULL;
+  size_t etbuf_size = 0;
+  size_t actualread;
+  size_t written;
 
-  gss_enc = 0; /* no data protection */
-  /* do confidentiality protection if supported */
+  gss_enc = 0;
   if(sspi_ret_flags & ISC_REQ_CONFIDENTIALITY)
     gss_enc = 2;
-  /* else do integrity protection */
   else if(sspi_ret_flags & ISC_REQ_INTEGRITY)
     gss_enc = 1;
 
   infof(data, "SOCKS5 server supports GSS-API %s data protection.",
-        (gss_enc == 0)?"no":((gss_enc == 1)?"integrity":"confidentiality") );
-  /* force to no data protection, avoid encryption/decryption for now */
-  gss_enc = 0;
-  /*
-   * Sending the encryption type in clear seems wrong. It should be
-   * protected with gss_seal()/gss_wrap(). See RFC1961 extract below
-   * The NEC reference implementations on which this is based is
-   * therefore at fault
-   *
-   *  +------+------+------+.......................+
-   *  + ver  | mtyp | len  |   token               |
-   *  +------+------+------+.......................+
-   *  + 0x01 | 0x02 | 0x02 | up to 2^16 - 1 octets |
-   *  +------+------+------+.......................+
-   *
-   *   Where:
-   *
-   *  - "ver" is the protocol version number, here 1 to represent the
-   *    first version of the SOCKS/GSS-API protocol
-   *
-   *  - "mtyp" is the message type, here 2 to represent a protection
-   *    -level negotiation message
-   *
-   *  - "len" is the length of the "token" field in octets
-   *
-   *  - "token" is the GSS-API encapsulated protection level
-   *
-   * The token is produced by encapsulating an octet containing the
-   * required protection level using gss_seal()/gss_wrap() with conf_req
-   * set to FALSE.  The token is verified using gss_unseal()/
-   * gss_unwrap().
-   *
-   */
+        (gss_enc == 0) ? "no" :
+        ((gss_enc == 1) ? "integrity" : "confidentiality"));
+
+  sspi_w_token[0].pvBuffer =
+    sspi_w_token[1].pvBuffer =
+    sspi_w_token[2].pvBuffer = NULL;
+
+  wrap_desc.cBuffers = 3;
+  wrap_desc.pBuffers = sspi_w_token;
+  wrap_desc.ulVersion = SECBUFFER_VERSION;
+
+  socksreq[0] = 1;
+  socksreq[1] = 2;
 
   if(data->set.socks5_gssapi_nec) {
-    us_length = htons((short)1);
+    us_length = htons((unsigned short)1);
     memcpy(socksreq + 2, &us_length, sizeof(short));
   }
   else {
-    status = s_pSecFn->QueryContextAttributes(&sspi_context,
-                                              SECPKG_ATTR_SIZES,
-                                              &sspi_sizes);
+    status = Curl_pSecFn->QueryContextAttributes(sspi_context,
+                                                 SECPKG_ATTR_SIZES,
+                                                 &sspi_sizes);
     if(check_sspi_err(data, status, "QueryContextAttributes")) {
-      s_pSecFn->DeleteSecurityContext(&sspi_context);
       failf(data, "Failed to query security context attributes.");
       return CURLE_COULDNT_CONNECT;
     }
 
     sspi_w_token[0].cbBuffer = sspi_sizes.cbSecurityTrailer;
     sspi_w_token[0].BufferType = SECBUFFER_TOKEN;
-    sspi_w_token[0].pvBuffer = malloc(sspi_sizes.cbSecurityTrailer);
+    sspi_w_token[0].pvBuffer = curlx_malloc(sspi_sizes.cbSecurityTrailer);
 
-    if(!sspi_w_token[0].pvBuffer) {
-      s_pSecFn->DeleteSecurityContext(&sspi_context);
+    if(!sspi_w_token[0].pvBuffer)
       return CURLE_OUT_OF_MEMORY;
-    }
 
     sspi_w_token[1].cbBuffer = 1;
-    sspi_w_token[1].pvBuffer = malloc(1);
-    if(!sspi_w_token[1].pvBuffer) {
-      s_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
-      s_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_OUT_OF_MEMORY;
-    }
+    sspi_w_token[1].BufferType = SECBUFFER_DATA;
+    sspi_w_token[1].pvBuffer = curlx_malloc(1);
+    if(!sspi_w_token[1].pvBuffer)
+      return socks5_free(sspi_w_token, CURLE_OUT_OF_MEMORY);
 
     memcpy(sspi_w_token[1].pvBuffer, &gss_enc, 1);
     sspi_w_token[2].BufferType = SECBUFFER_PADDING;
     sspi_w_token[2].cbBuffer = sspi_sizes.cbBlockSize;
-    sspi_w_token[2].pvBuffer = malloc(sspi_sizes.cbBlockSize);
-    if(!sspi_w_token[2].pvBuffer) {
-      s_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
-      s_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer);
-      s_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_OUT_OF_MEMORY;
-    }
-    status = s_pSecFn->EncryptMessage(&sspi_context,
-                                      KERB_WRAP_NO_ENCRYPT,
-                                      &wrap_desc,
-                                      0);
-    if(check_sspi_err(data, status, "EncryptMessage")) {
-      s_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
-      s_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer);
-      s_pSecFn->FreeContextBuffer(sspi_w_token[2].pvBuffer);
-      s_pSecFn->DeleteSecurityContext(&sspi_context);
-      failf(data, "Failed to query security context attributes.");
-      return CURLE_COULDNT_CONNECT;
-    }
-    sspi_send_token.cbBuffer = sspi_w_token[0].cbBuffer
-      + sspi_w_token[1].cbBuffer
-      + sspi_w_token[2].cbBuffer;
-    sspi_send_token.pvBuffer = malloc(sspi_send_token.cbBuffer);
-    if(!sspi_send_token.pvBuffer) {
-      s_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
-      s_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer);
-      s_pSecFn->FreeContextBuffer(sspi_w_token[2].pvBuffer);
-      s_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_OUT_OF_MEMORY;
-    }
+    sspi_w_token[2].pvBuffer = curlx_malloc(sspi_sizes.cbBlockSize);
+    if(!sspi_w_token[2].pvBuffer)
+      return socks5_free(sspi_w_token, CURLE_OUT_OF_MEMORY);
 
-    memcpy(sspi_send_token.pvBuffer, sspi_w_token[0].pvBuffer,
-           sspi_w_token[0].cbBuffer);
-    memcpy((PUCHAR) sspi_send_token.pvBuffer +(int)sspi_w_token[0].cbBuffer,
+    status = Curl_pSecFn->EncryptMessage(sspi_context,
+                                         KERB_WRAP_NO_ENCRYPT,
+                                         &wrap_desc, 0);
+    if(check_sspi_err(data, status, "EncryptMessage"))
+      return socks5_free(sspi_w_token, CURLE_COULDNT_CONNECT);
+
+    etbuf_size = sspi_w_token[0].cbBuffer + sspi_w_token[1].cbBuffer +
+      sspi_w_token[2].cbBuffer;
+    if(etbuf_size > 0xffff)
+      return socks5_free(sspi_w_token, CURLE_COULDNT_CONNECT);
+
+    etbuf = curlx_malloc(etbuf_size);
+    if(!etbuf)
+      return socks5_free(sspi_w_token, CURLE_OUT_OF_MEMORY);
+
+    memcpy(etbuf, sspi_w_token[0].pvBuffer, sspi_w_token[0].cbBuffer);
+    memcpy(etbuf + sspi_w_token[0].cbBuffer,
            sspi_w_token[1].pvBuffer, sspi_w_token[1].cbBuffer);
-    memcpy((PUCHAR) sspi_send_token.pvBuffer
-           + sspi_w_token[0].cbBuffer
-           + sspi_w_token[1].cbBuffer,
+    memcpy(etbuf + sspi_w_token[0].cbBuffer + sspi_w_token[1].cbBuffer,
            sspi_w_token[2].pvBuffer, sspi_w_token[2].cbBuffer);
 
-    s_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
-    sspi_w_token[0].pvBuffer = NULL;
-    sspi_w_token[0].cbBuffer = 0;
-    s_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer);
-    sspi_w_token[1].pvBuffer = NULL;
-    sspi_w_token[1].cbBuffer = 0;
-    s_pSecFn->FreeContextBuffer(sspi_w_token[2].pvBuffer);
-    sspi_w_token[2].pvBuffer = NULL;
-    sspi_w_token[2].cbBuffer = 0;
+    (void)socks5_free(sspi_w_token, CURLE_OK);
 
-    us_length = htons((short)sspi_send_token.cbBuffer);
+    us_length = htons((unsigned short)etbuf_size);
     memcpy(socksreq + 2, &us_length, sizeof(short));
   }
 
-  written = Curl_conn_cf_send(cf->next, data, (char *)socksreq, 4, &code);
-  if(code || (4 != written)) {
+  code = Curl_conn_cf_send(cf->next, data, socksreq, 4, FALSE, &written);
+  if(code || (written != 4)) {
     failf(data, "Failed to send SSPI encryption request.");
-    if(sspi_send_token.pvBuffer)
-      s_pSecFn->FreeContextBuffer(sspi_send_token.pvBuffer);
-    s_pSecFn->DeleteSecurityContext(&sspi_context);
+    curlx_free(etbuf);
     return CURLE_COULDNT_CONNECT;
   }
 
   if(data->set.socks5_gssapi_nec) {
     memcpy(socksreq, &gss_enc, 1);
-    written = Curl_conn_cf_send(cf->next, data, (char *)socksreq, 1, &code);
-    if(code || (1 != written)) {
+    code = Curl_conn_cf_send(cf->next, data, socksreq, 1, FALSE, &written);
+    if(code || (written != 1)) {
       failf(data, "Failed to send SSPI encryption type.");
-      s_pSecFn->DeleteSecurityContext(&sspi_context);
       return CURLE_COULDNT_CONNECT;
     }
   }
   else {
-    written = Curl_conn_cf_send(cf->next, data,
-                                (char *)sspi_send_token.pvBuffer,
-                                sspi_send_token.cbBuffer, &code);
-    if(code || (sspi_send_token.cbBuffer != (size_t)written)) {
+    code = Curl_conn_cf_send(cf->next, data, etbuf, etbuf_size, FALSE,
+                             &written);
+    curlx_free(etbuf);
+    if(code || (etbuf_size != written)) {
       failf(data, "Failed to send SSPI encryption type.");
-      if(sspi_send_token.pvBuffer)
-        s_pSecFn->FreeContextBuffer(sspi_send_token.pvBuffer);
-      s_pSecFn->DeleteSecurityContext(&sspi_context);
       return CURLE_COULDNT_CONNECT;
     }
-    if(sspi_send_token.pvBuffer)
-      s_pSecFn->FreeContextBuffer(sspi_send_token.pvBuffer);
   }
 
   result = Curl_blockread_all(cf, data, (char *)socksreq, 4, &actualread);
   if(result || (actualread != 4)) {
     failf(data, "Failed to receive SSPI encryption response.");
-    s_pSecFn->DeleteSecurityContext(&sspi_context);
-    return CURLE_COULDNT_CONNECT;
+    return result ? result : CURLE_COULDNT_CONNECT;
   }
 
-  /* ignore the first (VER) byte */
-  if(socksreq[1] == 255) { /* status / message type */
+  if(socksreq[1] == 255) {
     failf(data, "User was rejected by the SOCKS5 server (%u %u).",
           (unsigned int)socksreq[0], (unsigned int)socksreq[1]);
-    s_pSecFn->DeleteSecurityContext(&sspi_context);
     return CURLE_COULDNT_CONNECT;
   }
 
-  if(socksreq[1] != 2) { /* status / message type */
+  if(socksreq[1] != 2) {
     failf(data, "Invalid SSPI encryption response type (%u %u).",
           (unsigned int)socksreq[0], (unsigned int)socksreq[1]);
-    s_pSecFn->DeleteSecurityContext(&sspi_context);
     return CURLE_COULDNT_CONNECT;
   }
 
   memcpy(&us_length, socksreq + 2, sizeof(short));
   us_length = ntohs(us_length);
 
-  sspi_w_token[0].cbBuffer = us_length;
-  sspi_w_token[0].pvBuffer = malloc(us_length);
-  if(!sspi_w_token[0].pvBuffer) {
-    s_pSecFn->DeleteSecurityContext(&sspi_context);
-    return CURLE_OUT_OF_MEMORY;
+  if(!us_length) {
+    failf(data, "Invalid zero-length SSPI encryption token.");
+    return CURLE_COULDNT_CONNECT;
   }
 
+  sspi_w_token[0].cbBuffer = us_length;
+  sspi_w_token[0].pvBuffer = curlx_malloc(us_length);
+  if(!sspi_w_token[0].pvBuffer)
+    return CURLE_OUT_OF_MEMORY;
+
   result = Curl_blockread_all(cf, data, (char *)sspi_w_token[0].pvBuffer,
                               sspi_w_token[0].cbBuffer, &actualread);
 
   if(result || (actualread != us_length)) {
     failf(data, "Failed to receive SSPI encryption type.");
-    s_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
-    s_pSecFn->DeleteSecurityContext(&sspi_context);
-    return CURLE_COULDNT_CONNECT;
+    goto fail;
   }
 
-
   if(!data->set.socks5_gssapi_nec) {
     wrap_desc.cBuffers = 2;
     sspi_w_token[0].BufferType = SECBUFFER_STREAM;
@@ -553,62 +431,107 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
     sspi_w_token[1].cbBuffer = 0;
     sspi_w_token[1].pvBuffer = NULL;
 
-    status = s_pSecFn->DecryptMessage(&sspi_context,
-                                      &wrap_desc,
-                                      0,
-                                      &qop);
+    /* At least one of the descriptors must be of type SECBUFFER_DATA. The
+       message is decrypted in place so the SECBUFFER_DATA receives a pointer
+       to the message in SECBUFFER_STREAM. */
+    status = Curl_pSecFn->DecryptMessage(sspi_context, &wrap_desc, 0, &qop);
 
-    if(check_sspi_err(data, status, "DecryptMessage")) {
-      if(sspi_w_token[0].pvBuffer)
-        s_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
-      if(sspi_w_token[1].pvBuffer)
-        s_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer);
-      s_pSecFn->DeleteSecurityContext(&sspi_context);
-      failf(data, "Failed to query security context attributes.");
-      return CURLE_COULDNT_CONNECT;
-    }
+    if(check_sspi_err(data, status, "DecryptMessage"))
+      goto fail;
 
     if(sspi_w_token[1].cbBuffer != 1) {
       failf(data, "Invalid SSPI encryption response length (%lu).",
             (unsigned long)sspi_w_token[1].cbBuffer);
-      if(sspi_w_token[0].pvBuffer)
-        s_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
-      if(sspi_w_token[1].pvBuffer)
-        s_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer);
-      s_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_COULDNT_CONNECT;
+      goto fail;
     }
 
     memcpy(socksreq, sspi_w_token[1].pvBuffer, sspi_w_token[1].cbBuffer);
-    s_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
-    s_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer);
   }
   else {
     if(sspi_w_token[0].cbBuffer != 1) {
       failf(data, "Invalid SSPI encryption response length (%lu).",
             (unsigned long)sspi_w_token[0].cbBuffer);
-      s_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
-      s_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_COULDNT_CONNECT;
+      goto fail;
     }
     memcpy(socksreq, sspi_w_token[0].pvBuffer, sspi_w_token[0].cbBuffer);
-    s_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
   }
-  (void)curlx_nonblock(sock, TRUE);
+  curlx_free(sspi_w_token[0].pvBuffer);
 
-  infof(data, "SOCKS5 access with%s protection granted.",
-        (socksreq[0] == 0)?"out GSS-API data":
-        ((socksreq[0] == 1)?" GSS-API integrity":" GSS-API confidentiality"));
+  infof(data, "SOCKS5 access %s protection granted BUT NOT USED.",
+        (socksreq[0] == 0) ? "without GSS-API data" :
+         ((socksreq[0] == 1) ? "with GSS-API integrity" :
+          "with GSS-API confidentiality"));
 
-  /* For later use if encryption is required
-     conn->socks5_gssapi_enctype = socksreq[0];
-     if(socksreq[0] != 0)
-       conn->socks5_sspi_context = sspi_context;
-     else {
-       s_pSecFn->DeleteSecurityContext(&sspi_context);
-       conn->socks5_sspi_context = sspi_context;
-     }
-  */
+  cf->conn->socks5_gssapi_enctype = socksreq[0];
   return CURLE_OK;
+
+fail:
+  curlx_free(sspi_w_token[0].pvBuffer);
+  return CURLE_COULDNT_CONNECT;
+}
+
+CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
+                                      struct Curl_easy *data,
+                                      struct Curl_creds *creds)
+{
+  struct connectdata *conn = cf->conn;
+  curl_socket_t sock = conn->sock[cf->sockindex];
+  CURLcode result;
+  SECURITY_STATUS status;
+  CredHandle cred_handle;
+  CtxtHandle sspi_context;
+  SecPkgCredentials_Names names;
+  char *service_name = NULL;
+  unsigned long sspi_ret_flags = 0;
+
+  memset(&cred_handle, 0, sizeof(cred_handle));
+  memset(&sspi_context, 0, sizeof(sspi_context));
+  names.sUserName = NULL;
+
+  result = socks5_sspi_setup(cf, data, creds, &cred_handle, &service_name);
+  if(result)
+    goto error;
+
+  result = socks5_sspi_loop(cf, data, &cred_handle, &sspi_context,
+                            service_name, &sspi_ret_flags);
+  if(result)
+    goto error;
+
+  curlx_safefree(service_name);
+
+  status = Curl_pSecFn->QueryCredentialsAttributes(&cred_handle,
+                                                   SECPKG_CRED_ATTR_NAMES,
+                                                   &names);
+  if(check_sspi_err(data, status, "QueryCredentialAttributes")) {
+    failf(data, "Failed to determine username.");
+    result = CURLE_COULDNT_CONNECT;
+    goto error;
+  }
+  else {
+    VERBOSE(char *user_utf8 = curlx_convert_tchar_to_UTF8(names.sUserName));
+    infof(data, "SOCKS5 server authenticated user %s with GSS-API.",
+          (user_utf8 ? user_utf8 : "(unknown)"));
+    VERBOSE(curlx_free(user_utf8));
+    Curl_pSecFn->FreeContextBuffer(names.sUserName);
+    names.sUserName = NULL;
+  }
+
+  result = socks5_sspi_encrypt(cf, data, &sspi_context, sspi_ret_flags);
+  if(result)
+    goto error;
+
+  (void)curlx_nonblock(sock, TRUE);
+  Curl_pSecFn->DeleteSecurityContext(&sspi_context);
+  Curl_pSecFn->FreeCredentialsHandle(&cred_handle);
+  return CURLE_OK;
+
+error:
+  (void)curlx_nonblock(sock, TRUE);
+  curlx_free(service_name);
+  Curl_pSecFn->DeleteSecurityContext(&sspi_context);
+  Curl_pSecFn->FreeCredentialsHandle(&cred_handle);
+  if(names.sUserName)
+    Curl_pSecFn->FreeContextBuffer(names.sUserName);
+  return result;
 }
 #endif
diff --git a/third-party/curl/lib/speedcheck.c b/third-party/curl/lib/speedcheck.c
deleted file mode 100644
index 580efbde75..0000000000
--- a/third-party/curl/lib/speedcheck.c
+++ /dev/null
@@ -1,79 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#include <curl/curl.h>
-#include "urldata.h"
-#include "sendf.h"
-#include "multiif.h"
-#include "speedcheck.h"
-
-void Curl_speedinit(struct Curl_easy *data)
-{
-  memset(&data->state.keeps_speed, 0, sizeof(struct curltime));
-}
-
-/*
- * @unittest: 1606
- */
-CURLcode Curl_speedcheck(struct Curl_easy *data,
-                         struct curltime now)
-{
-  if(data->req.keepon & KEEP_RECV_PAUSE)
-    /* A paused transfer is not qualified for speed checks */
-    return CURLE_OK;
-
-  if((data->progress.current_speed >= 0) && data->set.low_speed_time) {
-    if(data->progress.current_speed < data->set.low_speed_limit) {
-      if(!data->state.keeps_speed.tv_sec)
-        /* under the limit at this very moment */
-        data->state.keeps_speed = now;
-      else {
-        /* how long has it been under the limit */
-        timediff_t howlong = Curl_timediff(now, data->state.keeps_speed);
-
-        if(howlong >= data->set.low_speed_time * 1000) {
-          /* too long */
-          failf(data,
-                "Operation too slow. "
-                "Less than %ld bytes/sec transferred the last %ld seconds",
-                data->set.low_speed_limit,
-                data->set.low_speed_time);
-          return CURLE_OPERATION_TIMEDOUT;
-        }
-      }
-    }
-    else
-      /* faster right now */
-      data->state.keeps_speed.tv_sec = 0;
-  }
-
-  if(data->set.low_speed_limit)
-    /* if low speed limit is enabled, set the expire timer to make this
-       connection's speed get checked again in a second */
-    Curl_expire(data, 1000, EXPIRE_SPEEDCHECK);
-
-  return CURLE_OK;
-}
diff --git a/third-party/curl/lib/speedcheck.h b/third-party/curl/lib/speedcheck.h
deleted file mode 100644
index bff2f32b77..0000000000
--- a/third-party/curl/lib/speedcheck.h
+++ /dev/null
@@ -1,35 +0,0 @@
-#ifndef HEADER_CURL_SPEEDCHECK_H
-#define HEADER_CURL_SPEEDCHECK_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#include "timeval.h"
-
-void Curl_speedinit(struct Curl_easy *data);
-CURLcode Curl_speedcheck(struct Curl_easy *data,
-                         struct curltime now);
-
-#endif /* HEADER_CURL_SPEEDCHECK_H */
diff --git a/third-party/curl/lib/splay.c b/third-party/curl/lib/splay.c
index 48e079b32a..ddab7a4d6e 100644
--- a/third-party/curl/lib/splay.c
+++ b/third-party/curl/lib/splay.c
@@ -21,7 +21,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #include "splay.h"
@@ -33,28 +32,28 @@
  *  zero          : when i is equal   to   j
  *  positive when : when i is larger  than j
  */
-#define compare(i,j) Curl_splaycomparekeys((i),(j))
+#define splay_compare(i, j) curlx_ptimediff_us(i, j)
 
 /*
  * Splay using the key i (which may or may not be in the tree.) The starting
  * root is t.
  */
-struct Curl_tree *Curl_splay(struct curltime i,
+struct Curl_tree *Curl_splay(const struct curltime *pkey,
                              struct Curl_tree *t)
 {
   struct Curl_tree N, *l, *r, *y;
 
   if(!t)
-    return t;
+    return NULL;
   N.smaller = N.larger = NULL;
   l = r = &N;
 
   for(;;) {
-    long comp = compare(i, t->key);
+    timediff_t comp = splay_compare(pkey, &t->key);
     if(comp < 0) {
       if(!t->smaller)
         break;
-      if(compare(i, t->smaller->key) < 0) {
+      if(splay_compare(pkey, &t->smaller->key) < 0) {
         y = t->smaller;                           /* rotate smaller */
         t->smaller = y->larger;
         y->larger = t;
@@ -69,7 +68,7 @@ struct Curl_tree *Curl_splay(struct curltime i,
     else if(comp > 0) {
       if(!t->larger)
         break;
-      if(compare(i, t->larger->key) > 0) {
+      if(splay_compare(pkey, &t->larger->key) > 0) {
         y = t->larger;                          /* rotate larger */
         t->larger = y->smaller;
         y->smaller = t;
@@ -93,31 +92,30 @@ struct Curl_tree *Curl_splay(struct curltime i,
   return t;
 }
 
-/* Insert key i into the tree t.  Return a pointer to the resulting tree or
+static const struct curltime SPLAY_SUBNODE = {
+  ~0, -1
+};
+
+/* Insert key i into the tree t. Return a pointer to the resulting tree or
  * NULL if something went wrong.
  *
  * @unittest: 1309
  */
-struct Curl_tree *Curl_splayinsert(struct curltime i,
+struct Curl_tree *Curl_splayinsert(const struct curltime *pkey,
                                    struct Curl_tree *t,
                                    struct Curl_tree *node)
 {
-  static const struct curltime KEY_NOTUSED = {
-    ~0, -1
-  }; /* will *NEVER* appear */
-
-  if(!node)
-    return t;
+  DEBUGASSERT(node);
 
   if(t) {
-    t = Curl_splay(i, t);
-    if(compare(i, t->key) == 0) {
-      /* There already exists a node in the tree with the very same key. Build
-         a doubly-linked circular list of nodes. We add the new 'node' struct
-         to the end of this list. */
+    t = Curl_splay(pkey, t);
+    DEBUGASSERT(t);
+    if(splay_compare(pkey, &t->key) == 0) {
+      /* There already exists a node in the tree with the same key. Build a
+         doubly-linked circular list of nodes. We add the new 'node' struct to
+         the end of this list. */
 
-      node->key = KEY_NOTUSED; /* we set the key in the sub node to NOTUSED
-                                  to quickly identify this node as a subnode */
+      node->key = SPLAY_SUBNODE; /* identify this node as a subnode */
       node->samen = t;
       node->samep = t->samep;
       t->samep->samen = node;
@@ -130,18 +128,17 @@ struct Curl_tree *Curl_splayinsert(struct curltime i,
   if(!t) {
     node->smaller = node->larger = NULL;
   }
-  else if(compare(i, t->key) < 0) {
+  else if(splay_compare(pkey, &t->key) < 0) {
     node->smaller = t->smaller;
     node->larger = t;
     t->smaller = NULL;
-
   }
   else {
     node->larger = t->larger;
     node->smaller = t;
     t->larger = NULL;
   }
-  node->key = i;
+  node->key = *pkey;
 
   /* no identical nodes (yet), we are the only one in the list of nodes */
   node->samen = node;
@@ -150,13 +147,13 @@ struct Curl_tree *Curl_splayinsert(struct curltime i,
 }
 
 /* Finds and deletes the best-fit node from the tree. Return a pointer to the
-   resulting tree.  best-fit means the smallest node if it is not larger than
+   resulting tree. best-fit means the smallest node if it is not larger than
    the key */
-struct Curl_tree *Curl_splaygetbest(struct curltime i,
+struct Curl_tree *Curl_splaygetbest(const struct curltime *pkey,
                                     struct Curl_tree *t,
                                     struct Curl_tree **removed)
 {
-  static const struct curltime tv_zero = {0, 0};
+  static const struct curltime tv_zero = { 0, 0 };
   struct Curl_tree *x;
 
   if(!t) {
@@ -165,8 +162,9 @@ struct Curl_tree *Curl_splaygetbest(struct curltime i,
   }
 
   /* find smallest */
-  t = Curl_splay(tv_zero, t);
-  if(compare(i, t->key) < 0) {
+  t = Curl_splay(&tv_zero, t);
+  DEBUGASSERT(t);
+  if(splay_compare(pkey, &t->key) < 0) {
     /* even the smallest is too big */
     *removed = NULL;
     return t;
@@ -196,14 +194,13 @@ struct Curl_tree *Curl_splaygetbest(struct curltime i,
   return x;
 }
 
-
-/* Deletes the very node we point out from the tree if it's there. Stores a
+/* Deletes the node we point out from the tree if it is there. Stores a
  * pointer to the new resulting tree in 'newroot'.
  *
  * Returns zero on success and non-zero on errors!
  * When returning error, it does not touch the 'newroot' pointer.
  *
- * NOTE: when the last node of the tree is removed, there's no tree left so
+ * NOTE: when the last node of the tree is removed, there is no tree left so
  * 'newroot' will be made to point to NULL.
  *
  * @unittest: 1309
@@ -212,19 +209,19 @@ int Curl_splayremove(struct Curl_tree *t,
                      struct Curl_tree *removenode,
                      struct Curl_tree **newroot)
 {
-  static const struct curltime KEY_NOTUSED = {
-    ~0, -1
-  }; /* will *NEVER* appear */
   struct Curl_tree *x;
 
-  if(!t || !removenode)
+  if(!t)
     return 1;
 
-  if(compare(KEY_NOTUSED, removenode->key) == 0) {
-    /* Key set to NOTUSED means it is a subnode within a 'same' linked list
-       and thus we can unlink it easily. */
+  DEBUGASSERT(removenode);
+
+  if(splay_compare(&SPLAY_SUBNODE, &removenode->key) == 0) {
+    /* It is a subnode within a 'same' linked list and thus we can unlink it
+       easily. */
+    DEBUGASSERT(removenode->samen != removenode);
     if(removenode->samen == removenode)
-      /* A non-subnode should never be set to KEY_NOTUSED */
+      /* A non-subnode should never be set to SPLAY_SUBNODE */
       return 3;
 
     removenode->samep->samen = removenode->samen;
@@ -237,23 +234,25 @@ int Curl_splayremove(struct Curl_tree *t,
     return 0;
   }
 
-  t = Curl_splay(removenode->key, t);
+  t = Curl_splay(&removenode->key, t);
+  DEBUGASSERT(t);
 
   /* First make sure that we got the same root node as the one we want
      to remove, as otherwise we might be trying to remove a node that
-     isn't actually in the tree.
+     is not actually in the tree.
 
-     We cannot just compare the keys here as a double remove in quick
-     succession of a node with key != KEY_NOTUSED && same != NULL
+     We cannot compare the keys here as a double remove in quick
+     succession of a node with key != SPLAY_SUBNODE && same != NULL
      could return the same key but a different node. */
+  DEBUGASSERT(t == removenode);
   if(t != removenode)
     return 2;
 
-  /* Check if there is a list with identical sizes, as then we're trying to
+  /* Check if there is a list with identical sizes, as then we are trying to
      remove the root node of a list of nodes with identical keys. */
   x = t->samen;
   if(x != t) {
-    /* 'x' is the new root node, we just make it use the root node's
+    /* 'x' is the new root node, we make it use the root node's
        smaller/larger links */
 
     x->key = t->key;
@@ -267,7 +266,8 @@ int Curl_splayremove(struct Curl_tree *t,
     if(!t->smaller)
       x = t->larger;
     else {
-      x = Curl_splay(removenode->key, t->smaller);
+      x = Curl_splay(&removenode->key, t->smaller);
+      DEBUGASSERT(x);
       x->larger = t->larger;
     }
   }
@@ -276,3 +276,16 @@ int Curl_splayremove(struct Curl_tree *t,
 
   return 0;
 }
+
+/* set and get the custom payload for this tree node */
+void Curl_splayset(struct Curl_tree *node, void *payload)
+{
+  DEBUGASSERT(node);
+  node->ptr = payload;
+}
+
+void *Curl_splayget(struct Curl_tree *node)
+{
+  DEBUGASSERT(node);
+  return node->ptr;
+}
diff --git a/third-party/curl/lib/splay.h b/third-party/curl/lib/splay.h
index dd1d07ac2e..c6623f2ef0 100644
--- a/third-party/curl/lib/splay.h
+++ b/third-party/curl/lib/splay.h
@@ -24,25 +24,27 @@
  *
  ***************************************************************************/
 #include "curl_setup.h"
-#include "timeval.h"
 
+#include "curlx/timeval.h"
+
+/* only use function calls to access this struct */
 struct Curl_tree {
   struct Curl_tree *smaller; /* smaller node */
   struct Curl_tree *larger;  /* larger node */
   struct Curl_tree *samen;   /* points to the next node with identical key */
   struct Curl_tree *samep;   /* points to the prev node with identical key */
-  struct curltime key;        /* this node's "sort" key */
-  void *payload;             /* data the splay code doesn't care about */
+  struct curltime key;       /* this node's "sort" key */
+  void *ptr;                 /* data the splay code does not care about */
 };
 
-struct Curl_tree *Curl_splay(struct curltime i,
+struct Curl_tree *Curl_splay(const struct curltime *pkey,
                              struct Curl_tree *t);
 
-struct Curl_tree *Curl_splayinsert(struct curltime key,
+struct Curl_tree *Curl_splayinsert(const struct curltime *pkey,
                                    struct Curl_tree *t,
-                                   struct Curl_tree *newnode);
+                                   struct Curl_tree *node);
 
-struct Curl_tree *Curl_splaygetbest(struct curltime key,
+struct Curl_tree *Curl_splaygetbest(const struct curltime *pkey,
                                     struct Curl_tree *t,
                                     struct Curl_tree **removed);
 
@@ -50,9 +52,8 @@ int Curl_splayremove(struct Curl_tree *t,
                      struct Curl_tree *removenode,
                      struct Curl_tree **newroot);
 
-#define Curl_splaycomparekeys(i,j) ( ((i.tv_sec)  < (j.tv_sec)) ? -1 : \
-                                   ( ((i.tv_sec)  > (j.tv_sec)) ?  1 : \
-                                   ( ((i.tv_usec) < (j.tv_usec)) ? -1 : \
-                                   ( ((i.tv_usec) > (j.tv_usec)) ?  1 : 0))))
+/* set and get the custom payload for this tree node */
+void Curl_splayset(struct Curl_tree *node, void *payload);
+void *Curl_splayget(struct Curl_tree *node);
 
 #endif /* HEADER_CURL_SPLAY_H */
diff --git a/third-party/curl/lib/strcase.c b/third-party/curl/lib/strcase.c
index 7c0b4ef909..9f70f41bd6 100644
--- a/third-party/curl/lib/strcase.c
+++ b/third-party/curl/lib/strcase.c
@@ -21,130 +21,72 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include <curl/curl.h>
-
 #include "strcase.h"
 
 /* Mapping table to go from lowercase to uppercase for plain ASCII.*/
 static const unsigned char touppermap[256] = {
-0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21,
-22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
-41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59,
-60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78,
-79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 65,
-66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84,
-85, 86, 87, 88, 89, 90, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133,
-134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149,
-150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165,
-166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181,
-182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197,
-198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213,
-214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229,
-230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243, 244, 245,
-246, 247, 248, 249, 250, 251, 252, 253, 254, 255
+  0,   1,   2,   3,   4,   5,   6,   7,   8,   9,   10,  11,  12,  13,  14,
+  15,  16,  17,  18,  19,  20,  21,  22,  23,  24,  25,  26,  27,  28,  29,
+  30,  31,  32,  33,  34,  35,  36,  37,  38,  39,  40,  41,  42,  43,  44,
+  45,  46,  47,  48,  49,  50,  51,  52,  53,  54,  55,  56,  57,  58,  59,
+  60,  61,  62,  63,  64,  65,  66,  67,  68,  69,  70,  71,  72,  73,  74,
+  75,  76,  77,  78,  79,  80,  81,  82,  83,  84,  85,  86,  87,  88,  89,
+  90,  91,  92,  93,  94,  95,  96,  65,  66,  67,  68,  69,  70,  71,  72,
+  73,  74,  75,  76,  77,  78,  79,  80,  81,  82,  83,  84,  85,  86,  87,
+  88,  89,  90,  123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134,
+  135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149,
+  150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164,
+  165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179,
+  180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194,
+  195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209,
+  210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224,
+  225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239,
+  240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254,
+  255
 };
 
 /* Mapping table to go from uppercase to lowercase for plain ASCII.*/
 static const unsigned char tolowermap[256] = {
-0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21,
-22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41,
-42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61,
-62, 63, 64, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110,
-111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 91, 92, 93, 94, 95,
-96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111,
-112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127,
-128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143,
-144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159,
-160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175,
-176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191,
-192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207,
-208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223,
-224, 225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239,
-240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255
+  0,   1,   2,   3,   4,   5,   6,   7,   8,   9,   10,  11,  12,  13,  14,
+  15,  16,  17,  18,  19,  20,  21,  22,  23,  24,  25,  26,  27,  28,  29,
+  30,  31,  32,  33,  34,  35,  36,  37,  38,  39,  40,  41,  42,  43,  44,
+  45,  46,  47,  48,  49,  50,  51,  52,  53,  54,  55,  56,  57,  58,  59,
+  60,  61,  62,  63,  64,  97,  98,  99,  100, 101, 102, 103, 104, 105, 106,
+  107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121,
+  122, 91,  92,  93,  94,  95,  96,  97,  98,  99,  100, 101, 102, 103, 104,
+  105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119,
+  120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134,
+  135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149,
+  150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164,
+  165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179,
+  180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194,
+  195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209,
+  210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224,
+  225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239,
+  240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254,
+  255
 };
 
-
 /* Portable, consistent toupper. Do not use toupper() because its behavior is
    altered by the current locale. */
 char Curl_raw_toupper(char in)
 {
-  return touppermap[(unsigned char) in];
+  return (char)touppermap[(unsigned char)in];
 }
 
-
 /* Portable, consistent tolower. Do not use tolower() because its behavior is
    altered by the current locale. */
 char Curl_raw_tolower(char in)
 {
-  return tolowermap[(unsigned char) in];
+  return (char)tolowermap[(unsigned char)in];
 }
 
-/*
- * curl_strequal() is for doing "raw" case insensitive strings. This is meant
- * to be locale independent and only compare strings we know are safe for
- * this. See https://daniel.haxx.se/blog/2008/10/15/strcasecmp-in-turkish/ for
- * further explanations as to why this function is necessary.
- */
-
-static int casecompare(const char *first, const char *second)
-{
-  while(*first && *second) {
-    if(Curl_raw_toupper(*first) != Curl_raw_toupper(*second))
-      /* get out of the loop as soon as they don't match */
-      return 0;
-    first++;
-    second++;
-  }
-  /* If we're here either the strings are the same or the length is different.
-     We can just test if the "current" character is non-zero for one and zero
-     for the other. Note that the characters may not be exactly the same even
-     if they match, we only want to compare zero-ness. */
-  return !*first == !*second;
-}
-
-/* --- public function --- */
-int curl_strequal(const char *first, const char *second)
-{
-  if(first && second)
-    /* both pointers point to something then compare them */
-    return casecompare(first, second);
-
-  /* if both pointers are NULL then treat them as equal */
-  return (NULL == first && NULL == second);
-}
-
-static int ncasecompare(const char *first, const char *second, size_t max)
-{
-  while(*first && *second && max) {
-    if(Curl_raw_toupper(*first) != Curl_raw_toupper(*second))
-      return 0;
-    max--;
-    first++;
-    second++;
-  }
-  if(0 == max)
-    return 1; /* they are equal this far */
-
-  return Curl_raw_toupper(*first) == Curl_raw_toupper(*second);
-}
-
-/* --- public function --- */
-int curl_strnequal(const char *first, const char *second, size_t max)
-{
-  if(first && second)
-    /* both pointers point to something then compare them */
-    return ncasecompare(first, second, max);
-
-  /* if both pointers are NULL then treat them as equal if max is non-zero */
-  return (NULL == first && NULL == second && max);
-}
-/* Copy an upper case version of the string from src to dest.  The
- * strings may overlap.  No more than n characters of the string are copied
+/* Copy an upper case version of the string from src to dest. The
+ * strings may overlap. No more than n characters of the string are copied
  * (including any NUL) and the destination string will NOT be
- * NUL-terminated if that limit is reached.
+ * null-terminated if that limit is reached.
  */
 void Curl_strntoupper(char *dest, const char *src, size_t n)
 {
@@ -156,10 +98,10 @@ void Curl_strntoupper(char *dest, const char *src, size_t n)
   } while(*src++ && --n);
 }
 
-/* Copy a lower case version of the string from src to dest.  The
- * strings may overlap.  No more than n characters of the string are copied
+/* Copy a lower case version of the string from src to dest. The
+ * strings may overlap. No more than n characters of the string are copied
  * (including any NUL) and the destination string will NOT be
- * NUL-terminated if that limit is reached.
+ * null-terminated if that limit is reached.
  */
 void Curl_strntolower(char *dest, const char *src, size_t n)
 {
@@ -171,10 +113,10 @@ void Curl_strntolower(char *dest, const char *src, size_t n)
   } while(*src++ && --n);
 }
 
-/* Compare case-sensitive NUL-terminated strings, taking care of possible
+/* Compare case-sensitive null-terminated strings, taking care of possible
  * null pointers. Return true if arguments match.
  */
-bool Curl_safecmp(char *a, char *b)
+bool Curl_safecmp(const char *a, const char *b)
 {
   if(a && b)
     return !strcmp(a, b);
@@ -192,7 +134,7 @@ int Curl_timestrcmp(const char *a, const char *b)
 
   if(a && b) {
     while(1) {
-      match |= a[i]^b[i];
+      match |= a[i] ^ b[i];
       if(!a[i] || !b[i])
         break;
       i++;
diff --git a/third-party/curl/lib/strcase.h b/third-party/curl/lib/strcase.h
index 8c50bbcba6..54299812be 100644
--- a/third-party/curl/lib/strcase.h
+++ b/third-party/curl/lib/strcase.h
@@ -23,32 +23,19 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
-#include <curl/curl.h>
-
-/*
- * Only "raw" case insensitive strings. This is meant to be locale independent
- * and only compare strings we know are safe for this.
- *
- * The function is capable of comparing a-z case insensitively.
- *
- * Result is 1 if text matches and 0 if not.
- */
-
-#define strcasecompare(a,b) curl_strequal(a,b)
-#define strncasecompare(a,b,c) curl_strnequal(a,b,c)
+#include "curl_setup.h"
 
 char Curl_raw_toupper(char in);
 char Curl_raw_tolower(char in);
 
 /* checkprefix() is a shorter version of the above, used when the first
    argument is the string literal */
-#define checkprefix(a,b)    curl_strnequal(b, STRCONST(a))
+#define checkprefix(a, b) curl_strnequal(b, STRCONST(a))
 
 void Curl_strntoupper(char *dest, const char *src, size_t n);
 void Curl_strntolower(char *dest, const char *src, size_t n);
 
-bool Curl_safecmp(char *a, char *b);
-int Curl_timestrcmp(const char *first, const char *second);
+bool Curl_safecmp(const char *a, const char *b);
+int Curl_timestrcmp(const char *a, const char *b);
 
 #endif /* HEADER_CURL_STRCASE_H */
diff --git a/third-party/curl/lib/strdup.c b/third-party/curl/lib/strdup.c
deleted file mode 100644
index 07a61391ae..0000000000
--- a/third-party/curl/lib/strdup.c
+++ /dev/null
@@ -1,123 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#include <curl/curl.h>
-
-#ifdef WIN32
-#include <wchar.h>
-#endif
-
-#include "strdup.h"
-#include "curl_memory.h"
-
-/* The last #include file should be: */
-#include "memdebug.h"
-
-#ifndef HAVE_STRDUP
-char *Curl_strdup(const char *str)
-{
-  size_t len;
-  char *newstr;
-
-  if(!str)
-    return (char *)NULL;
-
-  len = strlen(str) + 1;
-
-  newstr = malloc(len);
-  if(!newstr)
-    return (char *)NULL;
-
-  memcpy(newstr, str, len);
-  return newstr;
-}
-#endif
-
-#ifdef WIN32
-/***************************************************************************
- *
- * Curl_wcsdup(source)
- *
- * Copies the 'source' wchar string to a newly allocated buffer (that is
- * returned).
- *
- * Returns the new pointer or NULL on failure.
- *
- ***************************************************************************/
-wchar_t *Curl_wcsdup(const wchar_t *src)
-{
-  size_t length = wcslen(src);
-
-  if(length > (SIZE_T_MAX / sizeof(wchar_t)) - 1)
-    return (wchar_t *)NULL; /* integer overflow */
-
-  return (wchar_t *)Curl_memdup(src, (length + 1) * sizeof(wchar_t));
-}
-#endif
-
-/***************************************************************************
- *
- * Curl_memdup(source, length)
- *
- * Copies the 'source' data to a newly allocated buffer (that is
- * returned). Copies 'length' bytes.
- *
- * Returns the new pointer or NULL on failure.
- *
- ***************************************************************************/
-void *Curl_memdup(const void *src, size_t length)
-{
-  void *buffer = malloc(length);
-  if(!buffer)
-    return NULL; /* fail */
-
-  memcpy(buffer, src, length);
-
-  return buffer;
-}
-
-/***************************************************************************
- *
- * Curl_saferealloc(ptr, size)
- *
- * Does a normal realloc(), but will free the data pointer if the realloc
- * fails. If 'size' is non-zero, it will free the data and return a failure.
- *
- * This convenience function is provided and used to help us avoid a common
- * mistake pattern when we could pass in a zero, catch the NULL return and end
- * up free'ing the memory twice.
- *
- * Returns the new pointer or NULL on failure.
- *
- ***************************************************************************/
-void *Curl_saferealloc(void *ptr, size_t size)
-{
-  void *datap = realloc(ptr, size);
-  if(size && !datap)
-    /* only free 'ptr' if size was non-zero */
-    free(ptr);
-  return datap;
-}
diff --git a/third-party/curl/lib/strequal.c b/third-party/curl/lib/strequal.c
new file mode 100644
index 0000000000..a352fda70b
--- /dev/null
+++ b/third-party/curl/lib/strequal.c
@@ -0,0 +1,95 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "strcase.h"
+
+/*
+ * curl_strequal() is for doing "raw" case insensitive strings. This is meant
+ * to be locale independent and only compare strings we know are safe for
+ * this. See https://daniel.haxx.se/blog/2008/10/15/strcasecmp-in-turkish/ for
+ * further explanations as to why this function is necessary.
+ */
+
+static int casecompare(const char *first, const char *second)
+{
+  while(*first) {
+    if(Curl_raw_toupper(*first) != Curl_raw_toupper(*second))
+      /* get out of the loop as soon as they do not match */
+      return 0;
+    first++;
+    second++;
+  }
+  /* If we are here either the strings are the same or the length is different.
+     We can test if the "current" character is non-zero for one and zero
+     for the other. Note that the characters may not be exactly the same even
+     if they match, we only want to compare zero-ness. */
+  return !*first == !*second;
+}
+
+static int ncasecompare(const char *first, const char *second, size_t max)
+{
+  while(*first && max) {
+    if(Curl_raw_toupper(*first) != Curl_raw_toupper(*second))
+      return 0;
+    max--;
+    first++;
+    second++;
+  }
+  if(max == 0)
+    return 1; /* they are equal this far */
+
+  return Curl_raw_toupper(*first) == Curl_raw_toupper(*second);
+}
+
+/*
+ * Only "raw" case insensitive strings. This is meant to be locale independent
+ * and only compare strings we know are safe for this.
+ *
+ * The function is capable of comparing a-z case insensitively.
+ *
+ * Result is 1 if text matches and 0 if not.
+ */
+
+/* --- public function --- */
+int curl_strequal(const char *s1, const char *s2)
+{
+  if(s1 && s2)
+    /* both pointers point to something then compare them */
+    return casecompare(s1, s2);
+
+  /* if both pointers are NULL then treat them as equal */
+  return NULL == s1 && NULL == s2;
+}
+
+/* --- public function --- */
+int curl_strnequal(const char *s1, const char *s2, size_t n)
+{
+  if(s1 && s2)
+    /* both pointers point to something then compare them */
+    return ncasecompare(s1, s2, n);
+
+  /* if both pointers are NULL then treat them as equal if max is non-zero */
+  return NULL == s1 && NULL == s2 && n;
+}
diff --git a/third-party/curl/lib/strerror.c b/third-party/curl/lib/strerror.c
index be41914140..7b6dc02127 100644
--- a/third-party/curl/lib/strerror.c
+++ b/third-party/curl/lib/strerror.c
@@ -21,41 +21,19 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#ifdef HAVE_STRERROR_R
-#  if (!defined(HAVE_POSIX_STRERROR_R) && \
-       !defined(HAVE_GLIBC_STRERROR_R)) || \
-      (defined(HAVE_POSIX_STRERROR_R) && defined(HAVE_GLIBC_STRERROR_R))
-#    error "strerror_r MUST be either POSIX, glibc style"
-#  endif
-#endif
-
-#include <curl/curl.h>
-
-#ifdef USE_LIBIDN2
-#include <idn2.h>
-#endif
-
 #ifdef USE_WINDOWS_SSPI
 #include "curl_sspi.h"
 #endif
 
+#include "curlx/winapi.h"
 #include "strerror.h"
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curlx/strcopy.h"
 
-#if defined(WIN32) || defined(_WIN32_WCE)
-#define PRESERVE_WINDOWS_ERROR_CODE
-#endif
-
-const char *
-curl_easy_strerror(CURLcode error)
+const char *curl_easy_strerror(CURLcode error)
 {
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
+#ifdef CURLVERBOSE
   switch(error) {
   case CURLE_OK:
     return "No error";
@@ -71,16 +49,16 @@ curl_easy_strerror(CURLcode error)
 
   case CURLE_NOT_BUILT_IN:
     return "A requested feature, protocol or option was not found built-in in"
-      " this libcurl due to a build-time decision.";
+           " this libcurl due to a build-time decision.";
 
   case CURLE_COULDNT_RESOLVE_PROXY:
-    return "Couldn't resolve proxy name";
+    return "Could not resolve proxy name";
 
   case CURLE_COULDNT_RESOLVE_HOST:
-    return "Couldn't resolve host name";
+    return "Could not resolve hostname";
 
   case CURLE_COULDNT_CONNECT:
-    return "Couldn't connect to server";
+    return "Could not connect to server";
 
   case CURLE_WEIRD_SERVER_REPLY:
     return "Weird server reply";
@@ -107,19 +85,19 @@ curl_easy_strerror(CURLcode error)
     return "FTP: unknown 227 response format";
 
   case CURLE_FTP_CANT_GET_HOST:
-    return "FTP: can't figure out the host in the PASV response";
+    return "FTP: cannot figure out the host in the PASV response";
 
   case CURLE_HTTP2:
     return "Error in the HTTP2 framing layer";
 
   case CURLE_FTP_COULDNT_SET_TYPE:
-    return "FTP: couldn't set file type";
+    return "FTP: could not set file type";
 
   case CURLE_PARTIAL_FILE:
     return "Transferred a partial file";
 
   case CURLE_FTP_COULDNT_RETR_FILE:
-    return "FTP: couldn't retrieve (RETR failed) the specified file";
+    return "FTP: could not retrieve (RETR failed) the specified file";
 
   case CURLE_QUOTE_ERROR:
     return "Quote command returned error";
@@ -151,17 +129,14 @@ curl_easy_strerror(CURLcode error)
   case CURLE_RANGE_ERROR:
     return "Requested range was not delivered by the server";
 
-  case CURLE_HTTP_POST_ERROR:
-    return "Internal problem setting up the POST";
-
   case CURLE_SSL_CONNECT_ERROR:
     return "SSL connect error";
 
   case CURLE_BAD_DOWNLOAD_RESUME:
-    return "Couldn't resume download";
+    return "Could not resume download";
 
   case CURLE_FILE_COULDNT_READ_FILE:
-    return "Couldn't read a file:// file";
+    return "Could not read a file:// file";
 
   case CURLE_LDAP_CANNOT_BIND:
     return "LDAP: cannot bind";
@@ -169,9 +144,6 @@ curl_easy_strerror(CURLcode error)
   case CURLE_LDAP_SEARCH_FAILED:
     return "LDAP: search failed";
 
-  case CURLE_FUNCTION_NOT_FOUND:
-    return "A required function in the library was not found";
-
   case CURLE_ABORTED_BY_CALLBACK:
     return "Operation was aborted by an application callback";
 
@@ -200,7 +172,7 @@ curl_easy_strerror(CURLcode error)
     return "Can not set SSL crypto engine as default";
 
   case CURLE_SSL_ENGINE_INITFAILED:
-    return "Failed to initialise SSL crypto engine";
+    return "Failed to initialize SSL crypto engine";
 
   case CURLE_SEND_ERROR:
     return "Failed sending data to the peer";
@@ -212,7 +184,7 @@ curl_easy_strerror(CURLcode error)
     return "Problem with the local SSL certificate";
 
   case CURLE_SSL_CIPHER:
-    return "Couldn't use specified SSL cipher";
+    return "Could not use specified SSL cipher";
 
   case CURLE_PEER_FAILED_VERIFICATION:
     return "SSL peer certificate or SSH remote key was not OK";
@@ -319,36 +291,28 @@ curl_easy_strerror(CURLcode error)
   case CURLE_UNRECOVERABLE_POLL:
     return "Unrecoverable error in select/poll";
 
+  case CURLE_TOO_LARGE:
+    return "A value or data field grew larger than allowed";
+
+  case CURLE_ECH_REQUIRED:
+    return "ECH attempted but failed";
+
     /* error codes not used by current libcurl */
-  case CURLE_OBSOLETE20:
-  case CURLE_OBSOLETE24:
-  case CURLE_OBSOLETE29:
-  case CURLE_OBSOLETE32:
-  case CURLE_OBSOLETE40:
-  case CURLE_OBSOLETE44:
-  case CURLE_OBSOLETE46:
-  case CURLE_OBSOLETE50:
-  case CURLE_OBSOLETE51:
-  case CURLE_OBSOLETE57:
-  case CURLE_OBSOLETE62:
-  case CURLE_OBSOLETE75:
-  case CURLE_OBSOLETE76:
-  case CURL_LAST:
+  default:
     break;
   }
   /*
    * By using a switch, gcc -Wall will complain about enum values
    * which do not appear, helping keep this function up-to-date.
-   * By using gcc -Wall -Werror, you can't forget.
+   * By using gcc -Wall -Werror, you cannot forget.
    *
-   * A table would not have the same benefit.  Most compilers will
-   * generate code very similar to a table in any case, so there
-   * is little performance gain from a table.  And something is broken
-   * for the user's application, anyways, so does it matter how fast
-   * it _doesn't_ work?
+   * A table would not have the same benefit. Most compilers will generate
+   * code similar to a table in any case, so there is little performance gain
+   * from a table. Something is broken for the user's application, anyways, so
+   * does it matter how fast it _does not_ work?
    *
-   * The line number for the error will be near this comment, which
-   * is why it is here, and not at the start of the switch.
+   * The line number for the error will be near this comment, which is why it
+   * is here, and not at the start of the switch.
    */
   return "Unknown error";
 #else
@@ -359,10 +323,9 @@ curl_easy_strerror(CURLcode error)
 #endif
 }
 
-const char *
-curl_multi_strerror(CURLMcode error)
+const char *curl_multi_strerror(CURLMcode error)
 {
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
+#ifdef CURLVERBOSE
   switch(error) {
   case CURLM_CALL_MULTI_PERFORM:
     return "Please call curl_multi_perform() soon";
@@ -419,10 +382,9 @@ curl_multi_strerror(CURLMcode error)
 #endif
 }
 
-const char *
-curl_share_strerror(CURLSHcode error)
+const char *curl_share_strerror(CURLSHcode error)
 {
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
+#ifdef CURLVERBOSE
   switch(error) {
   case CURLSHE_OK:
     return "No error";
@@ -455,10 +417,9 @@ curl_share_strerror(CURLSHcode error)
 #endif
 }
 
-const char *
-curl_url_strerror(CURLUcode error)
+const char *curl_url_strerror(CURLUcode error)
 {
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
+#ifdef CURLVERBOSE
   switch(error) {
   case CURLUE_OK:
     return "No error";
@@ -553,6 +514,9 @@ curl_url_strerror(CURLUcode error)
   case CURLUE_LACKS_IDN:
     return "libcurl lacks IDN support";
 
+  case CURLUE_TOO_LARGE:
+    return "A value or data field is larger than allowed";
+
   case CURLUE_LAST:
     break;
   }
@@ -566,543 +530,144 @@ curl_url_strerror(CURLUcode error)
 #endif
 }
 
-#ifdef USE_WINSOCK
-/* This is a helper function for Curl_strerror that converts Winsock error
- * codes (WSAGetLastError) to error messages.
- * Returns NULL if no error message was found for error code.
- */
-static const char *
-get_winsock_error (int err, char *buf, size_t len)
-{
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-  const char *p;
-#endif
-
-  if(!len)
-    return NULL;
-
-  *buf = '\0';
-
-#ifdef CURL_DISABLE_VERBOSE_STRINGS
-  (void)err;
-  return NULL;
-#else
-  switch(err) {
-  case WSAEINTR:
-    p = "Call interrupted";
-    break;
-  case WSAEBADF:
-    p = "Bad file";
-    break;
-  case WSAEACCES:
-    p = "Bad access";
-    break;
-  case WSAEFAULT:
-    p = "Bad argument";
-    break;
-  case WSAEINVAL:
-    p = "Invalid arguments";
-    break;
-  case WSAEMFILE:
-    p = "Out of file descriptors";
-    break;
-  case WSAEWOULDBLOCK:
-    p = "Call would block";
-    break;
-  case WSAEINPROGRESS:
-  case WSAEALREADY:
-    p = "Blocking call in progress";
-    break;
-  case WSAENOTSOCK:
-    p = "Descriptor is not a socket";
-    break;
-  case WSAEDESTADDRREQ:
-    p = "Need destination address";
-    break;
-  case WSAEMSGSIZE:
-    p = "Bad message size";
-    break;
-  case WSAEPROTOTYPE:
-    p = "Bad protocol";
-    break;
-  case WSAENOPROTOOPT:
-    p = "Protocol option is unsupported";
-    break;
-  case WSAEPROTONOSUPPORT:
-    p = "Protocol is unsupported";
-    break;
-  case WSAESOCKTNOSUPPORT:
-    p = "Socket is unsupported";
-    break;
-  case WSAEOPNOTSUPP:
-    p = "Operation not supported";
-    break;
-  case WSAEAFNOSUPPORT:
-    p = "Address family not supported";
-    break;
-  case WSAEPFNOSUPPORT:
-    p = "Protocol family not supported";
-    break;
-  case WSAEADDRINUSE:
-    p = "Address already in use";
-    break;
-  case WSAEADDRNOTAVAIL:
-    p = "Address not available";
-    break;
-  case WSAENETDOWN:
-    p = "Network down";
-    break;
-  case WSAENETUNREACH:
-    p = "Network unreachable";
-    break;
-  case WSAENETRESET:
-    p = "Network has been reset";
-    break;
-  case WSAECONNABORTED:
-    p = "Connection was aborted";
-    break;
-  case WSAECONNRESET:
-    p = "Connection was reset";
-    break;
-  case WSAENOBUFS:
-    p = "No buffer space";
-    break;
-  case WSAEISCONN:
-    p = "Socket is already connected";
-    break;
-  case WSAENOTCONN:
-    p = "Socket is not connected";
-    break;
-  case WSAESHUTDOWN:
-    p = "Socket has been shut down";
-    break;
-  case WSAETOOMANYREFS:
-    p = "Too many references";
-    break;
-  case WSAETIMEDOUT:
-    p = "Timed out";
-    break;
-  case WSAECONNREFUSED:
-    p = "Connection refused";
-    break;
-  case WSAELOOP:
-    p = "Loop??";
-    break;
-  case WSAENAMETOOLONG:
-    p = "Name too long";
-    break;
-  case WSAEHOSTDOWN:
-    p = "Host down";
-    break;
-  case WSAEHOSTUNREACH:
-    p = "Host unreachable";
-    break;
-  case WSAENOTEMPTY:
-    p = "Not empty";
-    break;
-  case WSAEPROCLIM:
-    p = "Process limit reached";
-    break;
-  case WSAEUSERS:
-    p = "Too many users";
-    break;
-  case WSAEDQUOT:
-    p = "Bad quota";
-    break;
-  case WSAESTALE:
-    p = "Something is stale";
-    break;
-  case WSAEREMOTE:
-    p = "Remote error";
-    break;
-#ifdef WSAEDISCON  /* missing in SalfordC! */
-  case WSAEDISCON:
-    p = "Disconnected";
-    break;
-#endif
-    /* Extended Winsock errors */
-  case WSASYSNOTREADY:
-    p = "Winsock library is not ready";
-    break;
-  case WSANOTINITIALISED:
-    p = "Winsock library not initialised";
-    break;
-  case WSAVERNOTSUPPORTED:
-    p = "Winsock version not supported";
-    break;
-
-    /* getXbyY() errors (already handled in herrmsg):
-     * Authoritative Answer: Host not found */
-  case WSAHOST_NOT_FOUND:
-    p = "Host not found";
-    break;
-
-    /* Non-Authoritative: Host not found, or SERVERFAIL */
-  case WSATRY_AGAIN:
-    p = "Host not found, try again";
-    break;
-
-    /* Non recoverable errors, FORMERR, REFUSED, NOTIMP */
-  case WSANO_RECOVERY:
-    p = "Unrecoverable error in call to nameserver";
-    break;
-
-    /* Valid name, no data record of requested type */
-  case WSANO_DATA:
-    p = "No data record of requested type";
-    break;
-
-  default:
-    return NULL;
-  }
-  strncpy(buf, p, len);
-  buf [len-1] = '\0';
-  return buf;
-#endif
-}
-#endif   /* USE_WINSOCK */
-
-#if defined(WIN32) || defined(_WIN32_WCE)
-/* This is a helper function for Curl_strerror that converts Windows API error
- * codes (GetLastError) to error messages.
- * Returns NULL if no error message was found for error code.
- */
-static const char *
-get_winapi_error(int err, char *buf, size_t buflen)
-{
-  char *p;
-  wchar_t wbuf[256];
-
-  if(!buflen)
-    return NULL;
-
-  *buf = '\0';
-  *wbuf = L'\0';
-
-  /* We return the local codepage version of the error string because if it is
-     output to the user's terminal it will likely be with functions which
-     expect the local codepage (eg fprintf, failf, infof).
-     FormatMessageW -> wcstombs is used for Windows CE compatibility. */
-  if(FormatMessageW((FORMAT_MESSAGE_FROM_SYSTEM |
-                     FORMAT_MESSAGE_IGNORE_INSERTS), NULL, err,
-                    LANG_NEUTRAL, wbuf, sizeof(wbuf)/sizeof(wchar_t), NULL)) {
-    size_t written = wcstombs(buf, wbuf, buflen - 1);
-    if(written != (size_t)-1)
-      buf[written] = '\0';
-    else
-      *buf = '\0';
-  }
-
-  /* Truncate multiple lines */
-  p = strchr(buf, '\n');
-  if(p) {
-    if(p > buf && *(p-1) == '\r')
-      *(p-1) = '\0';
-    else
-      *p = '\0';
-  }
-
-  return (*buf ? buf : NULL);
-}
-#endif /* WIN32 || _WIN32_WCE */
-
-/*
- * Our thread-safe and smart strerror() replacement.
- *
- * The 'err' argument passed in to this function MUST be a true errno number
- * as reported on this system. We do no range checking on the number before
- * we pass it to the "number-to-message" conversion function and there might
- * be systems that don't do proper range checking in there themselves.
- *
- * We don't do range checking (on systems other than Windows) since there is
- * no good reliable and portable way to do it.
- *
- * On Windows different types of error codes overlap. This function has an
- * order of preference when trying to match error codes:
- * CRT (errno), Winsock (WSAGetLastError), Windows API (GetLastError).
- *
- * It may be more correct to call one of the variant functions instead:
- * Call Curl_sspi_strerror if the error code is definitely Windows SSPI.
- * Call Curl_winapi_strerror if the error code is definitely Windows API.
- */
-const char *Curl_strerror(int err, char *buf, size_t buflen)
-{
-#ifdef PRESERVE_WINDOWS_ERROR_CODE
-  DWORD old_win_err = GetLastError();
-#endif
-  int old_errno = errno;
-  char *p;
-  size_t max;
-
-  if(!buflen)
-    return NULL;
-
-#ifndef WIN32
-  DEBUGASSERT(err >= 0);
-#endif
-
-  max = buflen - 1;
-  *buf = '\0';
-
-#if defined(WIN32) || defined(_WIN32_WCE)
-#if defined(WIN32)
-  /* 'sys_nerr' is the maximum errno number, it is not widely portable */
-  if(err >= 0 && err < sys_nerr)
-    strncpy(buf, sys_errlist[err], max);
-  else
-#endif
-  {
-    if(
-#ifdef USE_WINSOCK
-       !get_winsock_error(err, buf, max) &&
-#endif
-       !get_winapi_error((DWORD)err, buf, max))
-      msnprintf(buf, max, "Unknown error %d (%#x)", err, err);
-  }
-#else /* not Windows coming up */
-
-#if defined(HAVE_STRERROR_R) && defined(HAVE_POSIX_STRERROR_R)
- /*
-  * The POSIX-style strerror_r() may set errno to ERANGE if insufficient
-  * storage is supplied via 'strerrbuf' and 'buflen' to hold the generated
-  * message string, or EINVAL if 'errnum' is not a valid error number.
-  */
-  if(0 != strerror_r(err, buf, max)) {
-    if('\0' == buf[0])
-      msnprintf(buf, max, "Unknown error %d", err);
-  }
-#elif defined(HAVE_STRERROR_R) && defined(HAVE_GLIBC_STRERROR_R)
- /*
-  * The glibc-style strerror_r() only *might* use the buffer we pass to
-  * the function, but it always returns the error message as a pointer,
-  * so we must copy that string unconditionally (if non-NULL).
-  */
-  {
-    char buffer[256];
-    char *msg = strerror_r(err, buffer, sizeof(buffer));
-    if(msg)
-      strncpy(buf, msg, max);
-    else
-      msnprintf(buf, max, "Unknown error %d", err);
-  }
-#else
-  {
-    /* !checksrc! disable STRERROR 1 */
-    const char *msg = strerror(err);
-    if(msg)
-      strncpy(buf, msg, max);
-    else
-      msnprintf(buf, max, "Unknown error %d", err);
-  }
-#endif
-
-#endif /* end of not Windows */
-
-  buf[max] = '\0'; /* make sure the string is null-terminated */
-
-  /* strip trailing '\r\n' or '\n'. */
-  p = strrchr(buf, '\n');
-  if(p && (p - buf) >= 2)
-    *p = '\0';
-  p = strrchr(buf, '\r');
-  if(p && (p - buf) >= 1)
-    *p = '\0';
-
-  if(errno != old_errno)
-    errno = old_errno;
-
-#ifdef PRESERVE_WINDOWS_ERROR_CODE
-  if(old_win_err != GetLastError())
-    SetLastError(old_win_err);
-#endif
-
-  return buf;
-}
-
-/*
- * Curl_winapi_strerror:
- * Variant of Curl_strerror if the error code is definitely Windows API.
- */
-#if defined(WIN32) || defined(_WIN32_WCE)
-const char *Curl_winapi_strerror(DWORD err, char *buf, size_t buflen)
-{
-#ifdef PRESERVE_WINDOWS_ERROR_CODE
-  DWORD old_win_err = GetLastError();
-#endif
-  int old_errno = errno;
-
-  if(!buflen)
-    return NULL;
-
-  *buf = '\0';
-
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-  if(!get_winapi_error(err, buf, buflen)) {
-    msnprintf(buf, buflen, "Unknown error %lu (0x%08lX)", err, err);
-  }
-#else
-  {
-    const char *txt = (err == ERROR_SUCCESS) ? "No error" : "Error";
-    strncpy(buf, txt, buflen);
-    buf[buflen - 1] = '\0';
-  }
-#endif
-
-  if(errno != old_errno)
-    errno = old_errno;
-
-#ifdef PRESERVE_WINDOWS_ERROR_CODE
-  if(old_win_err != GetLastError())
-    SetLastError(old_win_err);
-#endif
-
-  return buf;
-}
-#endif /* WIN32 || _WIN32_WCE */
-
 #ifdef USE_WINDOWS_SSPI
 /*
  * Curl_sspi_strerror:
- * Variant of Curl_strerror if the error code is definitely Windows SSPI.
+ * Variant of curlx_strerror if the error code is definitely Windows SSPI.
  */
-const char *Curl_sspi_strerror(int err, char *buf, size_t buflen)
+const char *Curl_sspi_strerror(SECURITY_STATUS err, char *buf, size_t buflen)
 {
-#ifdef PRESERVE_WINDOWS_ERROR_CODE
+#ifdef _WIN32
   DWORD old_win_err = GetLastError();
 #endif
   int old_errno = errno;
-  const char *txt;
+  VERBOSE(const char *txt);
 
   if(!buflen)
     return NULL;
 
   *buf = '\0';
 
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-
+#ifdef CURLVERBOSE
   switch(err) {
-    case SEC_E_OK:
-      txt = "No error";
-      break;
+  case SEC_E_OK:
+    txt = "No error";
+    break;
 #define SEC2TXT(sec) case sec: txt = #sec; break
-    SEC2TXT(CRYPT_E_REVOKED);
-    SEC2TXT(SEC_E_ALGORITHM_MISMATCH);
-    SEC2TXT(SEC_E_BAD_BINDINGS);
-    SEC2TXT(SEC_E_BAD_PKGID);
-    SEC2TXT(SEC_E_BUFFER_TOO_SMALL);
-    SEC2TXT(SEC_E_CANNOT_INSTALL);
-    SEC2TXT(SEC_E_CANNOT_PACK);
-    SEC2TXT(SEC_E_CERT_EXPIRED);
-    SEC2TXT(SEC_E_CERT_UNKNOWN);
-    SEC2TXT(SEC_E_CERT_WRONG_USAGE);
-    SEC2TXT(SEC_E_CONTEXT_EXPIRED);
-    SEC2TXT(SEC_E_CROSSREALM_DELEGATION_FAILURE);
-    SEC2TXT(SEC_E_CRYPTO_SYSTEM_INVALID);
-    SEC2TXT(SEC_E_DECRYPT_FAILURE);
-    SEC2TXT(SEC_E_DELEGATION_POLICY);
-    SEC2TXT(SEC_E_DELEGATION_REQUIRED);
-    SEC2TXT(SEC_E_DOWNGRADE_DETECTED);
-    SEC2TXT(SEC_E_ENCRYPT_FAILURE);
-    SEC2TXT(SEC_E_ILLEGAL_MESSAGE);
-    SEC2TXT(SEC_E_INCOMPLETE_CREDENTIALS);
-    SEC2TXT(SEC_E_INCOMPLETE_MESSAGE);
-    SEC2TXT(SEC_E_INSUFFICIENT_MEMORY);
-    SEC2TXT(SEC_E_INTERNAL_ERROR);
-    SEC2TXT(SEC_E_INVALID_HANDLE);
-    SEC2TXT(SEC_E_INVALID_PARAMETER);
-    SEC2TXT(SEC_E_INVALID_TOKEN);
-    SEC2TXT(SEC_E_ISSUING_CA_UNTRUSTED);
-    SEC2TXT(SEC_E_ISSUING_CA_UNTRUSTED_KDC);
-    SEC2TXT(SEC_E_KDC_CERT_EXPIRED);
-    SEC2TXT(SEC_E_KDC_CERT_REVOKED);
-    SEC2TXT(SEC_E_KDC_INVALID_REQUEST);
-    SEC2TXT(SEC_E_KDC_UNABLE_TO_REFER);
-    SEC2TXT(SEC_E_KDC_UNKNOWN_ETYPE);
-    SEC2TXT(SEC_E_LOGON_DENIED);
-    SEC2TXT(SEC_E_MAX_REFERRALS_EXCEEDED);
-    SEC2TXT(SEC_E_MESSAGE_ALTERED);
-    SEC2TXT(SEC_E_MULTIPLE_ACCOUNTS);
-    SEC2TXT(SEC_E_MUST_BE_KDC);
-    SEC2TXT(SEC_E_NOT_OWNER);
-    SEC2TXT(SEC_E_NO_AUTHENTICATING_AUTHORITY);
-    SEC2TXT(SEC_E_NO_CREDENTIALS);
-    SEC2TXT(SEC_E_NO_IMPERSONATION);
-    SEC2TXT(SEC_E_NO_IP_ADDRESSES);
-    SEC2TXT(SEC_E_NO_KERB_KEY);
-    SEC2TXT(SEC_E_NO_PA_DATA);
-    SEC2TXT(SEC_E_NO_S4U_PROT_SUPPORT);
-    SEC2TXT(SEC_E_NO_TGT_REPLY);
-    SEC2TXT(SEC_E_OUT_OF_SEQUENCE);
-    SEC2TXT(SEC_E_PKINIT_CLIENT_FAILURE);
-    SEC2TXT(SEC_E_PKINIT_NAME_MISMATCH);
-    SEC2TXT(SEC_E_POLICY_NLTM_ONLY);
-    SEC2TXT(SEC_E_QOP_NOT_SUPPORTED);
-    SEC2TXT(SEC_E_REVOCATION_OFFLINE_C);
-    SEC2TXT(SEC_E_REVOCATION_OFFLINE_KDC);
-    SEC2TXT(SEC_E_SECPKG_NOT_FOUND);
-    SEC2TXT(SEC_E_SECURITY_QOS_FAILED);
-    SEC2TXT(SEC_E_SHUTDOWN_IN_PROGRESS);
-    SEC2TXT(SEC_E_SMARTCARD_CERT_EXPIRED);
-    SEC2TXT(SEC_E_SMARTCARD_CERT_REVOKED);
-    SEC2TXT(SEC_E_SMARTCARD_LOGON_REQUIRED);
-    SEC2TXT(SEC_E_STRONG_CRYPTO_NOT_SUPPORTED);
-    SEC2TXT(SEC_E_TARGET_UNKNOWN);
-    SEC2TXT(SEC_E_TIME_SKEW);
-    SEC2TXT(SEC_E_TOO_MANY_PRINCIPALS);
-    SEC2TXT(SEC_E_UNFINISHED_CONTEXT_DELETED);
-    SEC2TXT(SEC_E_UNKNOWN_CREDENTIALS);
-    SEC2TXT(SEC_E_UNSUPPORTED_FUNCTION);
-    SEC2TXT(SEC_E_UNSUPPORTED_PREAUTH);
-    SEC2TXT(SEC_E_UNTRUSTED_ROOT);
-    SEC2TXT(SEC_E_WRONG_CREDENTIAL_HANDLE);
-    SEC2TXT(SEC_E_WRONG_PRINCIPAL);
-    SEC2TXT(SEC_I_COMPLETE_AND_CONTINUE);
-    SEC2TXT(SEC_I_COMPLETE_NEEDED);
-    SEC2TXT(SEC_I_CONTEXT_EXPIRED);
-    SEC2TXT(SEC_I_CONTINUE_NEEDED);
-    SEC2TXT(SEC_I_INCOMPLETE_CREDENTIALS);
-    SEC2TXT(SEC_I_LOCAL_LOGON);
-    SEC2TXT(SEC_I_NO_LSA_CONTEXT);
-    SEC2TXT(SEC_I_RENEGOTIATE);
-    SEC2TXT(SEC_I_SIGNATURE_NEEDED);
-    default:
-      txt = "Unknown error";
+  SEC2TXT(CRYPT_E_REVOKED);
+  SEC2TXT(CRYPT_E_NO_REVOCATION_DLL);
+  SEC2TXT(CRYPT_E_NO_REVOCATION_CHECK);
+  SEC2TXT(CRYPT_E_REVOCATION_OFFLINE);
+  SEC2TXT(CRYPT_E_NOT_IN_REVOCATION_DATABASE);
+  SEC2TXT(SEC_E_ALGORITHM_MISMATCH);
+  SEC2TXT(SEC_E_BAD_BINDINGS);
+  SEC2TXT(SEC_E_BAD_PKGID);
+  SEC2TXT(SEC_E_BUFFER_TOO_SMALL);
+  SEC2TXT(SEC_E_CANNOT_INSTALL);
+  SEC2TXT(SEC_E_CANNOT_PACK);
+  SEC2TXT(SEC_E_CERT_EXPIRED);
+  SEC2TXT(SEC_E_CERT_UNKNOWN);
+  SEC2TXT(SEC_E_CERT_WRONG_USAGE);
+  SEC2TXT(SEC_E_CONTEXT_EXPIRED);
+  SEC2TXT(SEC_E_CROSSREALM_DELEGATION_FAILURE);
+  SEC2TXT(SEC_E_CRYPTO_SYSTEM_INVALID);
+  SEC2TXT(SEC_E_DECRYPT_FAILURE);
+  SEC2TXT(SEC_E_DELEGATION_POLICY);
+  SEC2TXT(SEC_E_DELEGATION_REQUIRED);
+  SEC2TXT(SEC_E_DOWNGRADE_DETECTED);
+  SEC2TXT(SEC_E_ENCRYPT_FAILURE);
+  SEC2TXT(SEC_E_ILLEGAL_MESSAGE);
+  SEC2TXT(SEC_E_INCOMPLETE_CREDENTIALS);
+  SEC2TXT(SEC_E_INCOMPLETE_MESSAGE);
+  SEC2TXT(SEC_E_INSUFFICIENT_MEMORY);
+  SEC2TXT(SEC_E_INTERNAL_ERROR);
+  SEC2TXT(SEC_E_INVALID_HANDLE);
+  SEC2TXT(SEC_E_INVALID_PARAMETER);
+  SEC2TXT(SEC_E_INVALID_TOKEN);
+  SEC2TXT(SEC_E_ISSUING_CA_UNTRUSTED);
+  SEC2TXT(SEC_E_ISSUING_CA_UNTRUSTED_KDC);
+  SEC2TXT(SEC_E_KDC_CERT_EXPIRED);
+  SEC2TXT(SEC_E_KDC_CERT_REVOKED);
+  SEC2TXT(SEC_E_KDC_INVALID_REQUEST);
+  SEC2TXT(SEC_E_KDC_UNABLE_TO_REFER);
+  SEC2TXT(SEC_E_KDC_UNKNOWN_ETYPE);
+  SEC2TXT(SEC_E_LOGON_DENIED);
+  SEC2TXT(SEC_E_MAX_REFERRALS_EXCEEDED);
+  SEC2TXT(SEC_E_MESSAGE_ALTERED);
+  SEC2TXT(SEC_E_MULTIPLE_ACCOUNTS);
+  SEC2TXT(SEC_E_MUST_BE_KDC);
+  SEC2TXT(SEC_E_NOT_OWNER);
+  SEC2TXT(SEC_E_NO_AUTHENTICATING_AUTHORITY);
+  SEC2TXT(SEC_E_NO_CREDENTIALS);
+  SEC2TXT(SEC_E_NO_IMPERSONATION);
+  SEC2TXT(SEC_E_NO_IP_ADDRESSES);
+  SEC2TXT(SEC_E_NO_KERB_KEY);
+  SEC2TXT(SEC_E_NO_PA_DATA);
+  SEC2TXT(SEC_E_NO_S4U_PROT_SUPPORT);
+  SEC2TXT(SEC_E_NO_TGT_REPLY);
+  SEC2TXT(SEC_E_OUT_OF_SEQUENCE);
+  SEC2TXT(SEC_E_PKINIT_CLIENT_FAILURE);
+  SEC2TXT(SEC_E_PKINIT_NAME_MISMATCH);
+  SEC2TXT(SEC_E_POLICY_NLTM_ONLY);
+  SEC2TXT(SEC_E_QOP_NOT_SUPPORTED);
+  SEC2TXT(SEC_E_REVOCATION_OFFLINE_C);
+  SEC2TXT(SEC_E_REVOCATION_OFFLINE_KDC);
+  SEC2TXT(SEC_E_SECPKG_NOT_FOUND);
+  SEC2TXT(SEC_E_SECURITY_QOS_FAILED);
+  SEC2TXT(SEC_E_SHUTDOWN_IN_PROGRESS);
+  SEC2TXT(SEC_E_SMARTCARD_CERT_EXPIRED);
+  SEC2TXT(SEC_E_SMARTCARD_CERT_REVOKED);
+  SEC2TXT(SEC_E_SMARTCARD_LOGON_REQUIRED);
+  SEC2TXT(SEC_E_STRONG_CRYPTO_NOT_SUPPORTED);
+  SEC2TXT(SEC_E_TARGET_UNKNOWN);
+  SEC2TXT(SEC_E_TIME_SKEW);
+  SEC2TXT(SEC_E_TOO_MANY_PRINCIPALS);
+  SEC2TXT(SEC_E_UNFINISHED_CONTEXT_DELETED);
+  SEC2TXT(SEC_E_UNKNOWN_CREDENTIALS);
+  SEC2TXT(SEC_E_UNSUPPORTED_FUNCTION);
+  SEC2TXT(SEC_E_UNSUPPORTED_PREAUTH);
+  SEC2TXT(SEC_E_UNTRUSTED_ROOT);
+  SEC2TXT(SEC_E_WRONG_CREDENTIAL_HANDLE);
+  SEC2TXT(SEC_E_WRONG_PRINCIPAL);
+  SEC2TXT(SEC_I_COMPLETE_AND_CONTINUE);
+  SEC2TXT(SEC_I_COMPLETE_NEEDED);
+  SEC2TXT(SEC_I_CONTEXT_EXPIRED);
+  SEC2TXT(SEC_I_CONTINUE_NEEDED);
+  SEC2TXT(SEC_I_INCOMPLETE_CREDENTIALS);
+  SEC2TXT(SEC_I_LOCAL_LOGON);
+  SEC2TXT(SEC_I_NO_LSA_CONTEXT);
+  SEC2TXT(SEC_I_RENEGOTIATE);
+  SEC2TXT(SEC_I_SIGNATURE_NEEDED);
+  default:
+    txt = "Unknown error";
   }
 
   if(err == SEC_E_ILLEGAL_MESSAGE) {
-    msnprintf(buf, buflen,
-              "SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs "
-              "when a fatal SSL/TLS alert is received (e.g. handshake failed)."
-              " More detail may be available in the Windows System event log.",
-              err);
+    curl_msnprintf(buf, buflen,
+                   "SEC_E_ILLEGAL_MESSAGE (0x%08lx) - This error usually "
+                   "occurs when a fatal SSL/TLS alert is received (e.g. "
+                   "handshake failed). More detail may be available in "
+                   "the Windows System event log.", (unsigned long)err);
   }
   else {
-    char txtbuf[80];
     char msgbuf[256];
-
-    msnprintf(txtbuf, sizeof(txtbuf), "%s (0x%08X)", txt, err);
-
-    if(get_winapi_error(err, msgbuf, sizeof(msgbuf)))
-      msnprintf(buf, buflen, "%s - %s", txtbuf, msgbuf);
-    else {
-      strncpy(buf, txtbuf, buflen);
-      buf[buflen - 1] = '\0';
-    }
+    if(curlx_get_winapi_error((DWORD)err, msgbuf, sizeof(msgbuf)))
+      curl_msnprintf(buf, buflen, "%s (0x%08lx) - %s", txt, (unsigned long)err,
+                     msgbuf);
+    else
+      curl_msnprintf(buf, buflen, "%s (0x%08lx)", txt, (unsigned long)err);
   }
-
-#else
+#else /* CURLVERBOSE */
   if(err == SEC_E_OK)
-    txt = "No error";
+    curlx_strcopy(buf, buflen, STRCONST("No error"));
   else
-    txt = "Error";
-  strncpy(buf, txt, buflen);
-  buf[buflen - 1] = '\0';
+    curlx_strcopy(buf, buflen, STRCONST("Error"));
 #endif
 
   if(errno != old_errno)
     errno = old_errno;
 
-#ifdef PRESERVE_WINDOWS_ERROR_CODE
+#ifdef _WIN32
   if(old_win_err != GetLastError())
     SetLastError(old_win_err);
 #endif
diff --git a/third-party/curl/lib/strerror.h b/third-party/curl/lib/strerror.h
index 399712f8eb..4b9779ff2d 100644
--- a/third-party/curl/lib/strerror.h
+++ b/third-party/curl/lib/strerror.h
@@ -23,17 +23,10 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "curl_setup.h"
 
-#include "urldata.h"
-
-#define STRERROR_LEN 256 /* a suitable length */
-
-const char *Curl_strerror(int err, char *buf, size_t buflen);
-#if defined(WIN32) || defined(_WIN32_WCE)
-const char *Curl_winapi_strerror(DWORD err, char *buf, size_t buflen);
-#endif
 #ifdef USE_WINDOWS_SSPI
-const char *Curl_sspi_strerror(int err, char *buf, size_t buflen);
+const char *Curl_sspi_strerror(SECURITY_STATUS err, char *buf, size_t buflen);
 #endif
 
 #endif /* HEADER_CURL_STRERROR_H */
diff --git a/third-party/curl/lib/strtok.c b/third-party/curl/lib/strtok.c
deleted file mode 100644
index d8e1e8183f..0000000000
--- a/third-party/curl/lib/strtok.c
+++ /dev/null
@@ -1,68 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#ifndef HAVE_STRTOK_R
-#include <stddef.h>
-
-#include "strtok.h"
-
-char *
-Curl_strtok_r(char *ptr, const char *sep, char **end)
-{
-  if(!ptr)
-    /* we got NULL input so then we get our last position instead */
-    ptr = *end;
-
-  /* pass all letters that are including in the separator string */
-  while(*ptr && strchr(sep, *ptr))
-    ++ptr;
-
-  if(*ptr) {
-    /* so this is where the next piece of string starts */
-    char *start = ptr;
-
-    /* set the end pointer to the first byte after the start */
-    *end = start + 1;
-
-    /* scan through the string to find where it ends, it ends on a
-       null byte or a character that exists in the separator string */
-    while(**end && !strchr(sep, **end))
-      ++*end;
-
-    if(**end) {
-      /* the end is not a null byte */
-      **end = '\0';  /* null-terminate it! */
-      ++*end;        /* advance the last pointer to beyond the null byte */
-    }
-
-    return start; /* return the position where the string starts */
-  }
-
-  /* we ended up on a null byte, there are no more strings to find! */
-  return NULL;
-}
-
-#endif /* this was only compiled if strtok_r wasn't present */
diff --git a/third-party/curl/lib/strtok.h b/third-party/curl/lib/strtok.h
deleted file mode 100644
index 321cba2326..0000000000
--- a/third-party/curl/lib/strtok.h
+++ /dev/null
@@ -1,36 +0,0 @@
-#ifndef HEADER_CURL_STRTOK_H
-#define HEADER_CURL_STRTOK_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "curl_setup.h"
-#include <stddef.h>
-
-#ifndef HAVE_STRTOK_R
-char *Curl_strtok_r(char *s, const char *delim, char **last);
-#define strtok_r Curl_strtok_r
-#else
-#include <string.h>
-#endif
-
-#endif /* HEADER_CURL_STRTOK_H */
diff --git a/third-party/curl/lib/strtoofft.c b/third-party/curl/lib/strtoofft.c
deleted file mode 100644
index 077b25792e..0000000000
--- a/third-party/curl/lib/strtoofft.c
+++ /dev/null
@@ -1,245 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include <errno.h>
-#include "curl_setup.h"
-
-#include "strtoofft.h"
-
-/*
- * NOTE:
- *
- * In the ISO C standard (IEEE Std 1003.1), there is a strtoimax() function we
- * could use in case strtoll() doesn't exist...  See
- * https://www.opengroup.org/onlinepubs/009695399/functions/strtoimax.html
- */
-
-#if (SIZEOF_CURL_OFF_T > SIZEOF_LONG)
-#  ifdef HAVE_STRTOLL
-#    define strtooff strtoll
-#  else
-#    if defined(_MSC_VER) && (_MSC_VER >= 1300) && (_INTEGRAL_MAX_BITS >= 64)
-#      if defined(_SAL_VERSION)
-         _Check_return_ _CRTIMP __int64 __cdecl _strtoi64(
-             _In_z_ const char *_String,
-             _Out_opt_ _Deref_post_z_ char **_EndPtr, _In_ int _Radix);
-#      else
-         _CRTIMP __int64 __cdecl _strtoi64(const char *_String,
-                                           char **_EndPtr, int _Radix);
-#      endif
-#      define strtooff _strtoi64
-#    else
-#      define PRIVATE_STRTOOFF 1
-#    endif
-#  endif
-#else
-#  define strtooff strtol
-#endif
-
-#ifdef PRIVATE_STRTOOFF
-
-/* Range tests can be used for alphanum decoding if characters are consecutive,
-   like in ASCII. Else an array is scanned. Determine this condition now. */
-
-#if('9' - '0') != 9 || ('Z' - 'A') != 25 || ('z' - 'a') != 25
-
-#define NO_RANGE_TEST
-
-static const char valchars[] =
-            "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-#endif
-
-static int get_char(char c, int base);
-
-/**
- * Custom version of the strtooff function.  This extracts a curl_off_t
- * value from the given input string and returns it.
- */
-static curl_off_t strtooff(const char *nptr, char **endptr, int base)
-{
-  char *end;
-  int is_negative = 0;
-  int overflow;
-  int i;
-  curl_off_t value = 0;
-  curl_off_t newval;
-
-  /* Skip leading whitespace. */
-  end = (char *)nptr;
-  while(ISBLANK(end[0])) {
-    end++;
-  }
-
-  /* Handle the sign, if any. */
-  if(end[0] == '-') {
-    is_negative = 1;
-    end++;
-  }
-  else if(end[0] == '+') {
-    end++;
-  }
-  else if(end[0] == '\0') {
-    /* We had nothing but perhaps some whitespace -- there was no number. */
-    if(endptr) {
-      *endptr = end;
-    }
-    return 0;
-  }
-
-  /* Handle special beginnings, if present and allowed. */
-  if(end[0] == '0' && end[1] == 'x') {
-    if(base == 16 || base == 0) {
-      end += 2;
-      base = 16;
-    }
-  }
-  else if(end[0] == '0') {
-    if(base == 8 || base == 0) {
-      end++;
-      base = 8;
-    }
-  }
-
-  /* Matching strtol, if the base is 0 and it doesn't look like
-   * the number is octal or hex, we assume it's base 10.
-   */
-  if(base == 0) {
-    base = 10;
-  }
-
-  /* Loop handling digits. */
-  value = 0;
-  overflow = 0;
-  for(i = get_char(end[0], base);
-      i != -1;
-      end++, i = get_char(end[0], base)) {
-    newval = base * value + i;
-    if(newval < value) {
-      /* We've overflowed. */
-      overflow = 1;
-      break;
-    }
-    else
-      value = newval;
-  }
-
-  if(!overflow) {
-    if(is_negative) {
-      /* Fix the sign. */
-      value *= -1;
-    }
-  }
-  else {
-    if(is_negative)
-      value = CURL_OFF_T_MIN;
-    else
-      value = CURL_OFF_T_MAX;
-
-    errno = ERANGE;
-  }
-
-  if(endptr)
-    *endptr = end;
-
-  return value;
-}
-
-/**
- * Returns the value of c in the given base, or -1 if c cannot
- * be interpreted properly in that base (i.e., is out of range,
- * is a null, etc.).
- *
- * @param c     the character to interpret according to base
- * @param base  the base in which to interpret c
- *
- * @return  the value of c in base, or -1 if c isn't in range
- */
-static int get_char(char c, int base)
-{
-#ifndef NO_RANGE_TEST
-  int value = -1;
-  if(c <= '9' && c >= '0') {
-    value = c - '0';
-  }
-  else if(c <= 'Z' && c >= 'A') {
-    value = c - 'A' + 10;
-  }
-  else if(c <= 'z' && c >= 'a') {
-    value = c - 'a' + 10;
-  }
-#else
-  const char *cp;
-  int value;
-
-  cp = memchr(valchars, c, 10 + 26 + 26);
-
-  if(!cp)
-    return -1;
-
-  value = cp - valchars;
-
-  if(value >= 10 + 26)
-    value -= 26;                /* Lowercase. */
-#endif
-
-  if(value >= base) {
-    value = -1;
-  }
-
-  return value;
-}
-#endif  /* Only present if we need strtoll, but don't have it. */
-
-/*
- * Parse a *positive* up to 64 bit number written in ascii.
- */
-CURLofft curlx_strtoofft(const char *str, char **endp, int base,
-                         curl_off_t *num)
-{
-  char *end;
-  curl_off_t number;
-  errno = 0;
-  *num = 0; /* clear by default */
-  DEBUGASSERT(base); /* starting now, avoid base zero */
-
-  while(*str && ISBLANK(*str))
-    str++;
-  if(('-' == *str) || (ISSPACE(*str))) {
-    if(endp)
-      *endp = (char *)str; /* didn't actually move */
-    return CURL_OFFT_INVAL; /* nothing parsed */
-  }
-  number = strtooff(str, &end, base);
-  if(endp)
-    *endp = end;
-  if(errno == ERANGE)
-    /* overflow/underflow */
-    return CURL_OFFT_FLOW;
-  else if(str == end)
-    /* nothing parsed */
-    return CURL_OFFT_INVAL;
-
-  *num = number;
-  return CURL_OFFT_OK;
-}
diff --git a/third-party/curl/lib/strtoofft.h b/third-party/curl/lib/strtoofft.h
deleted file mode 100644
index 34d293ba38..0000000000
--- a/third-party/curl/lib/strtoofft.h
+++ /dev/null
@@ -1,54 +0,0 @@
-#ifndef HEADER_CURL_STRTOOFFT_H
-#define HEADER_CURL_STRTOOFFT_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-/*
- * Determine which string to integral data type conversion function we use
- * to implement string conversion to our curl_off_t integral data type.
- *
- * Notice that curl_off_t might be 64 or 32 bit wide, and that it might use
- * an underlying data type which might be 'long', 'int64_t', 'long long' or
- * '__int64' and more remotely other data types.
- *
- * On systems where the size of curl_off_t is greater than the size of 'long'
- * the conversion function to use is strtoll() if it is available, otherwise,
- * we emulate its functionality with our own clone.
- *
- * On systems where the size of curl_off_t is smaller or equal than the size
- * of 'long' the conversion function to use is strtol().
- */
-
-typedef enum {
-  CURL_OFFT_OK,    /* parsed fine */
-  CURL_OFFT_FLOW,  /* over or underflow */
-  CURL_OFFT_INVAL  /* nothing was parsed */
-} CURLofft;
-
-CURLofft curlx_strtoofft(const char *str, char **endp, int base,
-                         curl_off_t *num);
-
-#endif /* HEADER_CURL_STRTOOFFT_H */
diff --git a/third-party/curl/lib/system_win32.c b/third-party/curl/lib/system_win32.c
index 0cdaf3b2fe..1b052357b5 100644
--- a/third-party/curl/lib/system_win32.c
+++ b/third-party/curl/lib/system_win32.c
@@ -21,35 +21,20 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#if defined(WIN32)
+#ifdef _WIN32
 
-#include <curl/curl.h>
 #include "system_win32.h"
-#include "version_win32.h"
 #include "curl_sspi.h"
-#include "warnless.h"
+#include "curlx/timeval.h"
+#include "curlx/version_win32.h"  /* for curlx_verify_windows_init() */
 
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
-
-LARGE_INTEGER Curl_freq;
-bool Curl_isVistaOrGreater;
-
-/* Handle of iphlpapp.dll */
-static HMODULE s_hIpHlpApiDll = NULL;
-
-/* Pointer to the if_nametoindex function */
-IF_NAMETOINDEX_FN Curl_if_nametoindex = NULL;
-
-/* Curl_win32_init() performs win32 global initialization */
+/* Curl_win32_init() performs Win32 global initialization */
 CURLcode Curl_win32_init(long flags)
 {
   /* CURL_GLOBAL_WIN32 controls the *optional* part of the initialization which
-     is just for Winsock at the moment. Any required win32 initialization
+     is for Winsock at the moment. Any required Win32 initialization
      should take place after this block. */
   if(flags & CURL_GLOBAL_WIN32) {
 #ifdef USE_WINSOCK
@@ -61,8 +46,8 @@ CURLcode Curl_win32_init(long flags)
     res = WSAStartup(wVersionRequested, &wsaData);
 
     if(res)
-      /* Tell the user that we couldn't find a usable */
-      /* winsock.dll.     */
+      /* Tell the user that we could not find a usable */
+      /* winsock.dll. */
       return CURLE_FAILED_INIT;
 
     /* Confirm that the Windows Sockets DLL supports what we need.*/
@@ -72,8 +57,8 @@ CURLcode Curl_win32_init(long flags)
     /* highest supported version. */
 
     if(LOBYTE(wsaData.wVersion) != LOBYTE(wVersionRequested) ||
-       HIBYTE(wsaData.wVersion) != HIBYTE(wVersionRequested) ) {
-      /* Tell the user that we couldn't find a usable */
+       HIBYTE(wsaData.wVersion) != HIBYTE(wVersionRequested)) {
+      /* Tell the user that we could not find a usable */
 
       /* winsock.dll. */
       WSACleanup();
@@ -93,39 +78,14 @@ CURLcode Curl_win32_init(long flags)
   }
 #endif
 
-  s_hIpHlpApiDll = Curl_load_library(TEXT("iphlpapi.dll"));
-  if(s_hIpHlpApiDll) {
-    /* Get the address of the if_nametoindex function */
-    IF_NAMETOINDEX_FN pIfNameToIndex =
-      CURLX_FUNCTION_CAST(IF_NAMETOINDEX_FN,
-                          (GetProcAddress(s_hIpHlpApiDll, "if_nametoindex")));
-
-    if(pIfNameToIndex)
-      Curl_if_nametoindex = pIfNameToIndex;
-  }
-
-  /* curlx_verify_windows_version must be called during init at least once
-     because it has its own initialization routine. */
-  if(curlx_verify_windows_version(6, 0, 0, PLATFORM_WINNT,
-                                  VERSION_GREATER_THAN_EQUAL)) {
-    Curl_isVistaOrGreater = TRUE;
-  }
-  else
-    Curl_isVistaOrGreater = FALSE;
-
-  QueryPerformanceFrequency(&Curl_freq);
+  curlx_verify_windows_init();
+  curlx_now_init();
   return CURLE_OK;
 }
 
 /* Curl_win32_cleanup() is the opposite of Curl_win32_init() */
 void Curl_win32_cleanup(long init_flags)
 {
-  if(s_hIpHlpApiDll) {
-    FreeLibrary(s_hIpHlpApiDll);
-    s_hIpHlpApiDll = NULL;
-    Curl_if_nametoindex = NULL;
-  }
-
 #ifdef USE_WINDOWS_SSPI
   Curl_sspi_global_cleanup();
 #endif
@@ -137,105 +97,4 @@ void Curl_win32_cleanup(long init_flags)
   }
 }
 
-#if !defined(LOAD_WITH_ALTERED_SEARCH_PATH)
-#define LOAD_WITH_ALTERED_SEARCH_PATH  0x00000008
-#endif
-
-#if !defined(LOAD_LIBRARY_SEARCH_SYSTEM32)
-#define LOAD_LIBRARY_SEARCH_SYSTEM32   0x00000800
-#endif
-
-/* We use our own typedef here since some headers might lack these */
-typedef HMODULE (APIENTRY *LOADLIBRARYEX_FN)(LPCTSTR, HANDLE, DWORD);
-
-/* See function definitions in winbase.h */
-#ifdef UNICODE
-#  ifdef _WIN32_WCE
-#    define LOADLIBARYEX  L"LoadLibraryExW"
-#  else
-#    define LOADLIBARYEX  "LoadLibraryExW"
-#  endif
-#else
-#  define LOADLIBARYEX    "LoadLibraryExA"
-#endif
-
-/*
- * Curl_load_library()
- *
- * This is used to dynamically load DLLs using the most secure method available
- * for the version of Windows that we are running on.
- *
- * Parameters:
- *
- * filename  [in] - The filename or full path of the DLL to load. If only the
- *                  filename is passed then the DLL will be loaded from the
- *                  Windows system directory.
- *
- * Returns the handle of the module on success; otherwise NULL.
- */
-HMODULE Curl_load_library(LPCTSTR filename)
-{
-#ifndef CURL_WINDOWS_APP
-  HMODULE hModule = NULL;
-  LOADLIBRARYEX_FN pLoadLibraryEx = NULL;
-
-  /* Get a handle to kernel32 so we can access it's functions at runtime */
-  HMODULE hKernel32 = GetModuleHandle(TEXT("kernel32"));
-  if(!hKernel32)
-    return NULL;
-
-  /* Attempt to find LoadLibraryEx() which is only available on Windows 2000
-     and above */
-  pLoadLibraryEx =
-    CURLX_FUNCTION_CAST(LOADLIBRARYEX_FN,
-                        (GetProcAddress(hKernel32, LOADLIBARYEX)));
-
-  /* Detect if there's already a path in the filename and load the library if
-     there is. Note: Both back slashes and forward slashes have been supported
-     since the earlier days of DOS at an API level although they are not
-     supported by command prompt */
-  if(_tcspbrk(filename, TEXT("\\/"))) {
-    /** !checksrc! disable BANNEDFUNC 1 **/
-    hModule = pLoadLibraryEx ?
-      pLoadLibraryEx(filename, NULL, LOAD_WITH_ALTERED_SEARCH_PATH) :
-      LoadLibrary(filename);
-  }
-  /* Detect if KB2533623 is installed, as LOAD_LIBRARY_SEARCH_SYSTEM32 is only
-     supported on Windows Vista, Windows Server 2008, Windows 7 and Windows
-     Server 2008 R2 with this patch or natively on Windows 8 and above */
-  else if(pLoadLibraryEx && GetProcAddress(hKernel32, "AddDllDirectory")) {
-    /* Load the DLL from the Windows system directory */
-    hModule = pLoadLibraryEx(filename, NULL, LOAD_LIBRARY_SEARCH_SYSTEM32);
-  }
-  else {
-    /* Attempt to get the Windows system path */
-    UINT systemdirlen = GetSystemDirectory(NULL, 0);
-    if(systemdirlen) {
-      /* Allocate space for the full DLL path (Room for the null terminator
-         is included in systemdirlen) */
-      size_t filenamelen = _tcslen(filename);
-      TCHAR *path = malloc(sizeof(TCHAR) * (systemdirlen + 1 + filenamelen));
-      if(path && GetSystemDirectory(path, systemdirlen)) {
-        /* Calculate the full DLL path */
-        _tcscpy(path + _tcslen(path), TEXT("\\"));
-        _tcscpy(path + _tcslen(path), filename);
-
-        /* Load the DLL from the Windows system directory */
-        /** !checksrc! disable BANNEDFUNC 1 **/
-        hModule = pLoadLibraryEx ?
-          pLoadLibraryEx(path, NULL, LOAD_WITH_ALTERED_SEARCH_PATH) :
-          LoadLibrary(path);
-
-      }
-      free(path);
-    }
-  }
-  return hModule;
-#else
-  /* the Universal Windows Platform (UWP) can't do this */
-  (void)filename;
-  return NULL;
-#endif
-}
-
-#endif /* WIN32 */
+#endif /* _WIN32 */
diff --git a/third-party/curl/lib/system_win32.h b/third-party/curl/lib/system_win32.h
index 6482643fab..8a51f09670 100644
--- a/third-party/curl/lib/system_win32.h
+++ b/third-party/curl/lib/system_win32.h
@@ -23,27 +23,15 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#if defined(WIN32)
-
+#ifdef _WIN32
 extern LARGE_INTEGER Curl_freq;
-extern bool Curl_isVistaOrGreater;
 
 CURLcode Curl_win32_init(long flags);
 void Curl_win32_cleanup(long init_flags);
-
-/* We use our own typedef here since some headers might lack this */
-typedef unsigned int(WINAPI *IF_NAMETOINDEX_FN)(const char *);
-
-/* This is used instead of if_nametoindex if available on Windows */
-extern IF_NAMETOINDEX_FN Curl_if_nametoindex;
-
-/* This is used to dynamically load DLLs */
-HMODULE Curl_load_library(LPCTSTR filename);
-#else  /* WIN32 */
+#else
 #define Curl_win32_init(x) CURLE_OK
-#endif /* !WIN32 */
+#endif /* _WIN32 */
 
 #endif /* HEADER_CURL_SYSTEM_WIN32_H */
diff --git a/third-party/curl/lib/telnet.c b/third-party/curl/lib/telnet.c
index 850f88c1ec..2870d7e2c9 100644
--- a/third-party/curl/lib/telnet.c
+++ b/third-party/curl/lib/telnet.c
@@ -21,8 +21,9 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+#include "urldata.h"
+#include "telnet.h"
 
 #ifndef CURL_DISABLE_TELNET
 
@@ -46,78 +47,36 @@
 #include <sys/param.h>
 #endif
 
-#include "urldata.h"
-#include <curl/curl.h>
+#include "url.h"
 #include "transfer.h"
 #include "sendf.h"
-#include "telnet.h"
-#include "connect.h"
+#include "curl_trc.h"
 #include "progress.h"
-#include "system_win32.h"
 #include "arpa_telnet.h"
+#include "connect.h"
 #include "select.h"
-#include "strcase.h"
-#include "warnless.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curlx/strparse.h"
 
 #define SUBBUFSIZE 512
 
-#define CURL_SB_CLEAR(x)  x->subpointer = x->subbuffer
-#define CURL_SB_TERM(x)                                 \
-  do {                                                  \
-    x->subend = x->subpointer;                          \
-    CURL_SB_CLEAR(x);                                   \
+#define CURL_SB_CLEAR(x) x->subpointer = (x)->subbuffer
+#define CURL_SB_TERM(x)            \
+  do {                             \
+    (x)->subend = (x)->subpointer; \
+    CURL_SB_CLEAR(x);              \
   } while(0)
-#define CURL_SB_ACCUM(x,c)                                      \
-  do {                                                          \
-    if(x->subpointer < (x->subbuffer + sizeof(x->subbuffer)))   \
-      *x->subpointer++ = (c);                                   \
+#define CURL_SB_ACCUM(x, c)                                         \
+  do {                                                              \
+    if((x)->subpointer < ((x)->subbuffer + sizeof((x)->subbuffer))) \
+      *(x)->subpointer++ = (c);                                     \
   } while(0)
 
-#define  CURL_SB_GET(x) ((*x->subpointer++)&0xff)
-#define  CURL_SB_LEN(x) (x->subend - x->subpointer)
+#define CURL_SB_GET(x) ((*(x)->subpointer++) & 0xff)
+#define CURL_SB_LEN(x) ((x)->subend - (x)->subpointer)
 
 /* For posterity:
-#define  CURL_SB_PEEK(x) ((*x->subpointer)&0xff)
-#define  CURL_SB_EOF(x) (x->subpointer >= x->subend) */
-
-#ifdef CURL_DISABLE_VERBOSE_STRINGS
-#define printoption(a,b,c,d)  Curl_nop_stmt
-#endif
-
-static
-CURLcode telrcv(struct Curl_easy *data,
-                const unsigned char *inbuf, /* Data received from socket */
-                ssize_t count);             /* Number of bytes received */
-
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-static void printoption(struct Curl_easy *data,
-                        const char *direction,
-                        int cmd, int option);
-#endif
-
-static void negotiate(struct Curl_easy *data);
-static void send_negotiation(struct Curl_easy *data, int cmd, int option);
-static void set_local_option(struct Curl_easy *data,
-                             int option, int newstate);
-static void set_remote_option(struct Curl_easy *data,
-                              int option, int newstate);
-
-static void printsub(struct Curl_easy *data,
-                     int direction, unsigned char *pointer,
-                     size_t length);
-static void suboption(struct Curl_easy *data);
-static void sendsuboption(struct Curl_easy *data, int option);
-
-static CURLcode telnet_do(struct Curl_easy *data, bool *done);
-static CURLcode telnet_done(struct Curl_easy *data,
-                                 CURLcode, bool premature);
-static CURLcode send_telnet_data(struct Curl_easy *data,
-                                 char *buffer, ssize_t nread);
+#define CURL_SB_PEEK(x) (*(x)->subpointer & 0xff)
+#define CURL_SB_EOF(x)  ((x)->subpointer >= (x)->subend) */
 
 /* For negotiation compliant to RFC 1143 */
 #define CURL_NO          0
@@ -128,20 +87,22 @@ static CURLcode send_telnet_data(struct Curl_easy *data,
 #define CURL_EMPTY       0
 #define CURL_OPPOSITE    1
 
+/* meta key for storing protocol meta at easy handle */
+#define CURL_META_TELNET_EASY   "meta:proto:telnet:easy"
+
 /*
  * Telnet receiver states for fsm
  */
-typedef enum
-{
-   CURL_TS_DATA = 0,
-   CURL_TS_IAC,
-   CURL_TS_WILL,
-   CURL_TS_WONT,
-   CURL_TS_DO,
-   CURL_TS_DONT,
-   CURL_TS_CR,
-   CURL_TS_SB,   /* sub-option collection */
-   CURL_TS_SE   /* looking for sub-option end */
+typedef enum {
+  CURL_TS_DATA = 0,
+  CURL_TS_IAC,
+  CURL_TS_WILL,
+  CURL_TS_WONT,
+  CURL_TS_DO,
+  CURL_TS_DONT,
+  CURL_TS_CR,
+  CURL_TS_SB,   /* sub-option collection */
+  CURL_TS_SE    /* looking for sub-option end */
 } TelnetReceive;
 
 struct TELNET {
@@ -154,116 +115,22 @@ struct TELNET {
   int himq[256];
   int him_preferred[256];
   int subnegotiation[256];
-  char subopt_ttype[32];             /* Set with suboption TTYPE */
-  char subopt_xdisploc[128];         /* Set with suboption XDISPLOC */
+  const char *subopt_ttype;          /* Set with suboption TTYPE */
+  const char *subopt_xdisploc;       /* Set with suboption XDISPLOC */
   unsigned short subopt_wsx;         /* Set with suboption NAWS */
   unsigned short subopt_wsy;         /* Set with suboption NAWS */
   TelnetReceive telrcv_state;
   struct curl_slist *telnet_vars;    /* Environment variables */
+  struct dynbuf out;                 /* output buffer */
 
   /* suboptions */
   unsigned char subbuffer[SUBBUFSIZE];
   unsigned char *subpointer, *subend;      /* buffer for sub-options */
 };
 
-
-/*
- * TELNET protocol handler.
- */
-
-const struct Curl_handler Curl_handler_telnet = {
-  "TELNET",                             /* scheme */
-  ZERO_NULL,                            /* setup_connection */
-  telnet_do,                            /* do_it */
-  telnet_done,                          /* done */
-  ZERO_NULL,                            /* do_more */
-  ZERO_NULL,                            /* connect_it */
-  ZERO_NULL,                            /* connecting */
-  ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  ZERO_NULL,                            /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_TELNET,                          /* defport */
-  CURLPROTO_TELNET,                     /* protocol */
-  CURLPROTO_TELNET,                     /* family */
-  PROTOPT_NONE | PROTOPT_NOURLQUERY     /* flags */
-};
-
-
-static
-CURLcode init_telnet(struct Curl_easy *data)
-{
-  struct TELNET *tn;
-
-  tn = calloc(1, sizeof(struct TELNET));
-  if(!tn)
-    return CURLE_OUT_OF_MEMORY;
-
-  data->req.p.telnet = tn; /* make us known */
-
-  tn->telrcv_state = CURL_TS_DATA;
-
-  /* Init suboptions */
-  CURL_SB_CLEAR(tn);
-
-  /* Set the options we want by default */
-  tn->us_preferred[CURL_TELOPT_SGA] = CURL_YES;
-  tn->him_preferred[CURL_TELOPT_SGA] = CURL_YES;
-
-  /* To be compliant with previous releases of libcurl
-     we enable this option by default. This behavior
-         can be changed thanks to the "BINARY" option in
-         CURLOPT_TELNETOPTIONS
-  */
-  tn->us_preferred[CURL_TELOPT_BINARY] = CURL_YES;
-  tn->him_preferred[CURL_TELOPT_BINARY] = CURL_YES;
-
-  /* We must allow the server to echo what we sent
-         but it is not necessary to request the server
-         to do so (it might forces the server to close
-         the connection). Hence, we ignore ECHO in the
-         negotiate function
-  */
-  tn->him_preferred[CURL_TELOPT_ECHO] = CURL_YES;
-
-  /* Set the subnegotiation fields to send information
-    just after negotiation passed (do/will)
-
-     Default values are (0,0) initialized by calloc.
-     According to the RFC1013 it is valid:
-     A value equal to zero is acceptable for the width (or height),
-         and means that no character width (or height) is being sent.
-         In this case, the width (or height) that will be assumed by the
-         Telnet server is operating system specific (it will probably be
-         based upon the terminal type information that may have been sent
-         using the TERMINAL TYPE Telnet option). */
-  tn->subnegotiation[CURL_TELOPT_NAWS] = CURL_YES;
-  return CURLE_OK;
-}
-
-static void negotiate(struct Curl_easy *data)
-{
-  int i;
-  struct TELNET *tn = data->req.p.telnet;
-
-  for(i = 0; i < CURL_NTELOPTS; i++) {
-    if(i == CURL_TELOPT_ECHO)
-      continue;
-
-    if(tn->us_preferred[i] == CURL_YES)
-      set_local_option(data, i, CURL_YES);
-
-    if(tn->him_preferred[i] == CURL_YES)
-      set_remote_option(data, i, CURL_YES);
-  }
-}
-
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
+#ifndef CURLVERBOSE
+#define printoption(a, b, c, d) Curl_nop_stmt
+#else
 static void printoption(struct Curl_easy *data,
                         const char *direction, int cmd, int option)
 {
@@ -298,7 +165,62 @@ static void printoption(struct Curl_easy *data,
     }
   }
 }
-#endif
+#endif /* !CURLVERBOSE */
+
+static void telnet_easy_dtor(void *key, size_t klen, void *entry)
+{
+  struct TELNET *tn = entry;
+  (void)key;
+  (void)klen;
+  curl_slist_free_all(tn->telnet_vars);
+  curlx_dyn_free(&tn->out);
+  curlx_free(tn);
+}
+
+static CURLcode init_telnet(struct Curl_easy *data)
+{
+  struct TELNET *tn;
+
+  tn = curlx_calloc(1, sizeof(struct TELNET));
+  if(!tn)
+    return CURLE_OUT_OF_MEMORY;
+
+  curlx_dyn_init(&tn->out, 0xffff);
+
+  tn->telrcv_state = CURL_TS_DATA;
+
+  /* Init suboptions */
+  CURL_SB_CLEAR(tn);
+
+  /* Set the options we want by default */
+  tn->us_preferred[CURL_TELOPT_SGA] = CURL_YES;
+  tn->him_preferred[CURL_TELOPT_SGA] = CURL_YES;
+
+  /* To be compliant with previous releases of libcurl we enable this option
+     by default. This behavior can be changed with the "BINARY" option in
+     CURLOPT_TELNETOPTIONS */
+  tn->us_preferred[CURL_TELOPT_BINARY] = CURL_YES;
+  tn->him_preferred[CURL_TELOPT_BINARY] = CURL_YES;
+
+  /* We must allow the server to echo what we sent but it is not necessary
+     to request the server to do so (it might force the server to close
+     the connection). Hence, we ignore ECHO in the negotiate function */
+  tn->him_preferred[CURL_TELOPT_ECHO] = CURL_YES;
+
+  /* Set the subnegotiation fields to send information after negotiation
+     passed (do/will)
+
+     Default values are (0,0) initialized by calloc.
+     According to the RFC1013 it is valid:
+     A value equal to zero is acceptable for the width (or height), and means
+     that no character width (or height) is being sent. In this case, the width
+     (or height) that will be assumed by the Telnet server is operating system
+     specific (it will probably be based upon the terminal type information
+     that may have been sent using the TERMINAL TYPE Telnet option). */
+  tn->subnegotiation[CURL_TELOPT_NAWS] = CURL_YES;
+
+  return Curl_meta_set(data, CURL_META_TELNET_EASY, tn, telnet_easy_dtor);
+}
 
 static void send_negotiation(struct Curl_easy *data, int cmd, int option)
 {
@@ -311,18 +233,15 @@ static void send_negotiation(struct Curl_easy *data, int cmd, int option)
   buf[2] = (unsigned char)option;
 
   bytes_written = swrite(conn->sock[FIRSTSOCKET], buf, 3);
-  if(bytes_written < 0) {
-    int err = SOCKERRNO;
-    failf(data,"Sending data failed (%d)",err);
-  }
+  if(bytes_written < 0)
+    failf(data, "Sending data failed (%d)", SOCKERRNO);
 
   printoption(data, "SENT", cmd, option);
 }
 
-static
-void set_remote_option(struct Curl_easy *data, int option, int newstate)
+static void set_remote_option(struct Curl_easy *data, struct TELNET *tn,
+                              int option, int newstate)
 {
-  struct TELNET *tn = data->req.p.telnet;
   if(newstate == CURL_YES) {
     switch(tn->him[option]) {
     case CURL_NO:
@@ -393,10 +312,97 @@ void set_remote_option(struct Curl_easy *data, int option, int newstate)
   }
 }
 
-static
-void rec_will(struct Curl_easy *data, int option)
+static void set_local_option(struct Curl_easy *data, struct TELNET *tn,
+                             int option, int newstate)
+{
+  if(newstate == CURL_YES) {
+    switch(tn->us[option]) {
+    case CURL_NO:
+      tn->us[option] = CURL_WANTYES;
+      send_negotiation(data, CURL_WILL, option);
+      break;
+
+    case CURL_YES:
+      /* Already enabled */
+      break;
+
+    case CURL_WANTNO:
+      switch(tn->usq[option]) {
+      case CURL_EMPTY:
+        /* Already negotiating for CURL_YES, queue the request */
+        tn->usq[option] = CURL_OPPOSITE;
+        break;
+      case CURL_OPPOSITE:
+        /* Error: already queued an enable request */
+        break;
+      }
+      break;
+
+    case CURL_WANTYES:
+      switch(tn->usq[option]) {
+      case CURL_EMPTY:
+        /* Error: already negotiating for enable */
+        break;
+      case CURL_OPPOSITE:
+        tn->usq[option] = CURL_EMPTY;
+        break;
+      }
+      break;
+    }
+  }
+  else { /* NO */
+    switch(tn->us[option]) {
+    case CURL_NO:
+      /* Already disabled */
+      break;
+
+    case CURL_YES:
+      tn->us[option] = CURL_WANTNO;
+      send_negotiation(data, CURL_WONT, option);
+      break;
+
+    case CURL_WANTNO:
+      switch(tn->usq[option]) {
+      case CURL_EMPTY:
+        /* Already negotiating for NO */
+        break;
+      case CURL_OPPOSITE:
+        tn->usq[option] = CURL_EMPTY;
+        break;
+      }
+      break;
+
+    case CURL_WANTYES:
+      switch(tn->usq[option]) {
+      case CURL_EMPTY:
+        tn->usq[option] = CURL_OPPOSITE;
+        break;
+      case CURL_OPPOSITE:
+        break;
+      }
+      break;
+    }
+  }
+}
+
+static void telnet_negotiate(struct Curl_easy *data, struct TELNET *tn)
+{
+  int i;
+
+  for(i = 0; i < CURL_NTELOPTS; i++) {
+    if(i == CURL_TELOPT_ECHO)
+      continue;
+
+    if(tn->us_preferred[i] == CURL_YES)
+      set_local_option(data, tn, i, CURL_YES);
+
+    if(tn->him_preferred[i] == CURL_YES)
+      set_remote_option(data, tn, i, CURL_YES);
+  }
+}
+
+static void rec_will(struct Curl_easy *data, struct TELNET *tn, int option)
 {
-  struct TELNET *tn = data->req.p.telnet;
   switch(tn->him[option]) {
   case CURL_NO:
     if(tn->him_preferred[option] == CURL_YES) {
@@ -441,10 +447,8 @@ void rec_will(struct Curl_easy *data, int option)
   }
 }
 
-static
-void rec_wont(struct Curl_easy *data, int option)
+static void rec_wont(struct Curl_easy *data, struct TELNET *tn, int option)
 {
-  struct TELNET *tn = data->req.p.telnet;
   switch(tn->him[option]) {
   case CURL_NO:
     /* Already disabled */
@@ -483,84 +487,238 @@ void rec_wont(struct Curl_easy *data, int option)
   }
 }
 
-static void
-set_local_option(struct Curl_easy *data, int option, int newstate)
+static void printsub(struct Curl_easy *data,
+                     int direction,                /* '<' or '>' */
+                     const unsigned char *pointer, /* ptr to suboption data */
+                     size_t length)                /* suboption data length */
 {
-  struct TELNET *tn = data->req.p.telnet;
-  if(newstate == CURL_YES) {
-    switch(tn->us[option]) {
-    case CURL_NO:
-      tn->us[option] = CURL_WANTYES;
-      send_negotiation(data, CURL_WILL, option);
-      break;
+  if(data->set.verbose) {
+    unsigned int i = 0;
+    if(direction) {
+      infof(data, "%s IAC SB ", (direction == '<') ? "RCVD" : "SENT");
+      if(length >= 3) {
+        int j;
 
-    case CURL_YES:
-      /* Already enabled */
-      break;
+        i = pointer[length - 2];
+        j = pointer[length - 1];
 
-    case CURL_WANTNO:
-      switch(tn->usq[option]) {
-      case CURL_EMPTY:
-        /* Already negotiating for CURL_YES, queue the request */
-        tn->usq[option] = CURL_OPPOSITE;
-        break;
-      case CURL_OPPOSITE:
-        /* Error: already queued an enable request */
-        break;
+        if(i != CURL_IAC || j != CURL_SE) {
+          infof(data, "(terminated by ");
+          if(CURL_TELOPT_OK(i))
+            infof(data, "%s ", CURL_TELOPT(i));
+          else if(CURL_TELCMD_OK(i))
+            infof(data, "%s ", CURL_TELCMD(i));
+          else
+            infof(data, "%u ", i);
+          if(CURL_TELOPT_OK(j))
+            infof(data, "%s", CURL_TELOPT(j));
+          else if(CURL_TELCMD_OK(j))
+            infof(data, "%s", CURL_TELCMD(j));
+          else
+            infof(data, "%d", j);
+          infof(data, ", not IAC SE) ");
+        }
       }
-      break;
-
-    case CURL_WANTYES:
-      switch(tn->usq[option]) {
-      case CURL_EMPTY:
-        /* Error: already negotiating for enable */
-        break;
-      case CURL_OPPOSITE:
-        tn->usq[option] = CURL_EMPTY;
-        break;
-      }
-      break;
+      if(length >= 2)
+        length -= 2;
+      else /* bad input */
+        return;
+    }
+    if(length <= 1) {
+      infof(data, "(Empty suboption?)");
+      return;
     }
-  }
-  else { /* NO */
-    switch(tn->us[option]) {
-    case CURL_NO:
-      /* Already disabled */
-      break;
 
-    case CURL_YES:
-      tn->us[option] = CURL_WANTNO;
-      send_negotiation(data, CURL_WONT, option);
-      break;
-
-    case CURL_WANTNO:
-      switch(tn->usq[option]) {
-      case CURL_EMPTY:
-        /* Already negotiating for NO */
+    if(CURL_TELOPT_OK(pointer[0])) {
+      switch(pointer[0]) {
+      case CURL_TELOPT_TTYPE:
+      case CURL_TELOPT_XDISPLOC:
+      case CURL_TELOPT_NEW_ENVIRON:
+      case CURL_TELOPT_NAWS:
+        infof(data, "%s", CURL_TELOPT(pointer[0]));
         break;
-      case CURL_OPPOSITE:
-        tn->usq[option] = CURL_EMPTY;
+      default:
+        infof(data, "%s (unsupported)", CURL_TELOPT(pointer[0]));
         break;
       }
-      break;
+    }
+    else
+      infof(data, "%d (unknown)", pointer[0]);
 
-    case CURL_WANTYES:
-      switch(tn->usq[option]) {
-      case CURL_EMPTY:
-        tn->usq[option] = CURL_OPPOSITE;
+    switch(pointer[0]) {
+    case CURL_TELOPT_NAWS:
+      if(length > 4)
+        infof(data, "Width: %d ; Height: %d", (pointer[1] << 8) | pointer[2],
+              (pointer[3] << 8) | pointer[4]);
+      break;
+    default:
+      switch(pointer[1]) {
+      case CURL_TELQUAL_IS:
+        infof(data, " IS");
         break;
-      case CURL_OPPOSITE:
+      case CURL_TELQUAL_SEND:
+        infof(data, " SEND");
+        break;
+      case CURL_TELQUAL_INFO:
+        infof(data, " INFO/REPLY");
+        break;
+      case CURL_TELQUAL_NAME:
+        infof(data, " NAME");
+        break;
+      }
+
+      switch(pointer[0]) {
+      case CURL_TELOPT_TTYPE:
+      case CURL_TELOPT_XDISPLOC:
+        infof(data, " \"%.*s\"",
+              (int)((length > 2) ? (length - 2) : 0), &pointer[2]);
+        break;
+      case CURL_TELOPT_NEW_ENVIRON:
+        if(pointer[1] == CURL_TELQUAL_IS) {
+          infof(data, " ");
+          for(i = 3; i < length; i++) {
+            switch(pointer[i]) {
+            case CURL_NEW_ENV_VAR:
+              infof(data, ", ");
+              break;
+            case CURL_NEW_ENV_VALUE:
+              infof(data, " = ");
+              break;
+            default:
+              infof(data, "%c", pointer[i]);
+              break;
+            }
+          }
+        }
+        break;
+      default:
+        for(i = 2; i < length; i++)
+          infof(data, " %.2x", pointer[i]);
         break;
       }
-      break;
     }
   }
 }
 
-static
-void rec_do(struct Curl_easy *data, int option)
+/* Escape and send a telnet data block */
+static CURLcode send_telnet_data(struct Curl_easy *data,
+                                 struct TELNET *tn,
+                                 const char *buffer, ssize_t nread)
+{
+  size_t i, outlen;
+  const unsigned char *outbuf;
+  CURLcode result = CURLE_OK;
+  size_t bytes_written;
+  size_t total_written = 0;
+  struct connectdata *conn = data->conn;
+
+  DEBUGASSERT(tn);
+  DEBUGASSERT(nread > 0);
+  if(nread < 0)
+    return CURLE_TOO_LARGE;
+
+  if(memchr(buffer, CURL_IAC, nread)) {
+    /* only use the escape buffer when necessary */
+    curlx_dyn_reset(&tn->out);
+
+    for(i = 0; i < (size_t)nread && !result; i++) {
+      result = curlx_dyn_addn(&tn->out, &buffer[i], 1);
+      if(!result && ((unsigned char)buffer[i] == CURL_IAC))
+        /* IAC is FF in hex */
+        result = curlx_dyn_addn(&tn->out, "\xff", 1);
+    }
+
+    outlen = curlx_dyn_len(&tn->out);
+    outbuf = curlx_dyn_uptr(&tn->out);
+  }
+  else {
+    outlen = (size_t)nread;
+    outbuf = (const unsigned char *)buffer;
+  }
+  while(!result && total_written < outlen) {
+    /* Make sure socket is writable to avoid EWOULDBLOCK condition */
+    struct pollfd pfd[1];
+    timediff_t timeout_ms = Curl_timeleft_ms(data);
+    pfd[0].fd = conn->sock[FIRSTSOCKET];
+    pfd[0].events = POLLOUT;
+    if(timeout_ms < 0)
+      return CURLE_OPERATION_TIMEDOUT;
+    /* 0 means no timeout configured; pass -1 to poll for infinite wait */
+    switch(Curl_poll(pfd, 1, timeout_ms ? timeout_ms : -1)) {
+    case -1:                    /* error, abort writing */
+      result = CURLE_SEND_ERROR;
+      break;
+    case 0:                     /* timeout */
+      result = CURLE_OPERATION_TIMEDOUT;
+      break;
+    default:                    /* write! */
+      bytes_written = 0;
+      result = Curl_xfer_send(data, outbuf + total_written,
+                              outlen - total_written, FALSE, &bytes_written);
+      total_written += bytes_written;
+      break;
+    }
+  }
+
+  return result;
+}
+
+/*
+ * sendsuboption()
+ *
+ * Send suboption information to the server side.
+ */
+static void sendsuboption(struct Curl_easy *data,
+                          struct TELNET *tn, int option)
+{
+  ssize_t bytes_written;
+  unsigned short x, y;
+  const unsigned char *uc1, *uc2;
+  struct connectdata *conn = data->conn;
+
+  switch(option) {
+  case CURL_TELOPT_NAWS:
+    /* We prepare data to be sent */
+    CURL_SB_CLEAR(tn);
+    CURL_SB_ACCUM(tn, CURL_IAC);
+    CURL_SB_ACCUM(tn, CURL_SB);
+    CURL_SB_ACCUM(tn, CURL_TELOPT_NAWS);
+    /* We must deal either with little or big endian processors */
+    /* Window size must be sent according to the 'network order' */
+    x = htons(tn->subopt_wsx);
+    y = htons(tn->subopt_wsy);
+    uc1 = (const unsigned char *)&x;
+    uc2 = (const unsigned char *)&y;
+    CURL_SB_ACCUM(tn, uc1[0]);
+    CURL_SB_ACCUM(tn, uc1[1]);
+    CURL_SB_ACCUM(tn, uc2[0]);
+    CURL_SB_ACCUM(tn, uc2[1]);
+
+    CURL_SB_ACCUM(tn, CURL_IAC);
+    CURL_SB_ACCUM(tn, CURL_SE);
+    CURL_SB_TERM(tn);
+    /* data suboption is now ready */
+
+    printsub(data, '>', (const unsigned char *)tn->subbuffer + 2,
+             CURL_SB_LEN(tn) - 2);
+
+    /* we send the header of the suboption... */
+    bytes_written = swrite(conn->sock[FIRSTSOCKET], tn->subbuffer, 3);
+    if(bytes_written < 0)
+      failf(data, "Sending data failed (%d)", SOCKERRNO);
+    /* ... then the window size with the send_telnet_data() function
+       to deal with 0xFF cases ... */
+    send_telnet_data(data, tn, (const char *)tn->subbuffer + 3, 4);
+    /* ... and the footer */
+    bytes_written = swrite(conn->sock[FIRSTSOCKET], tn->subbuffer + 7, 2);
+    if(bytes_written < 0)
+      failf(data, "Sending data failed (%d)", SOCKERRNO);
+    break;
+  }
+}
+
+static void rec_do(struct Curl_easy *data, struct TELNET *tn, int option)
 {
-  struct TELNET *tn = data->req.p.telnet;
   switch(tn->us[option]) {
   case CURL_NO:
     if(tn->us_preferred[option] == CURL_YES) {
@@ -568,13 +726,13 @@ void rec_do(struct Curl_easy *data, int option)
       send_negotiation(data, CURL_WILL, option);
       if(tn->subnegotiation[option] == CURL_YES)
         /* transmission of data option */
-        sendsuboption(data, option);
+        sendsuboption(data, tn, option);
     }
     else if(tn->subnegotiation[option] == CURL_YES) {
       /* send information to achieve this option */
       tn->us[option] = CURL_YES;
       send_negotiation(data, CURL_WILL, option);
-      sendsuboption(data, option);
+      sendsuboption(data, tn, option);
     }
     else
       send_negotiation(data, CURL_WONT, option);
@@ -604,12 +762,12 @@ void rec_do(struct Curl_easy *data, int option)
       tn->us[option] = CURL_YES;
       if(tn->subnegotiation[option] == CURL_YES) {
         /* transmission of data option */
-        sendsuboption(data, option);
+        sendsuboption(data, tn, option);
       }
       break;
     case CURL_OPPOSITE:
       tn->us[option] = CURL_WANTNO;
-      tn->himq[option] = CURL_EMPTY;
+      tn->usq[option] = CURL_EMPTY;
       send_negotiation(data, CURL_WONT, option);
       break;
     }
@@ -617,10 +775,8 @@ void rec_do(struct Curl_easy *data, int option)
   }
 }
 
-static
-void rec_dont(struct Curl_easy *data, int option)
+static void rec_dont(struct Curl_easy *data, struct TELNET *tn, int option)
 {
-  struct TELNET *tn = data->req.p.telnet;
   switch(tn->us[option]) {
   case CURL_NO:
     /* Already disabled */
@@ -659,149 +815,33 @@ void rec_dont(struct Curl_easy *data, int option)
   }
 }
 
-
-static void printsub(struct Curl_easy *data,
-                     int direction,             /* '<' or '>' */
-                     unsigned char *pointer,    /* where suboption data is */
-                     size_t length)             /* length of suboption data */
-{
-  if(data->set.verbose) {
-    unsigned int i = 0;
-    if(direction) {
-      infof(data, "%s IAC SB ", (direction == '<')? "RCVD":"SENT");
-      if(length >= 3) {
-        int j;
-
-        i = pointer[length-2];
-        j = pointer[length-1];
-
-        if(i != CURL_IAC || j != CURL_SE) {
-          infof(data, "(terminated by ");
-          if(CURL_TELOPT_OK(i))
-            infof(data, "%s ", CURL_TELOPT(i));
-          else if(CURL_TELCMD_OK(i))
-            infof(data, "%s ", CURL_TELCMD(i));
-          else
-            infof(data, "%u ", i);
-          if(CURL_TELOPT_OK(j))
-            infof(data, "%s", CURL_TELOPT(j));
-          else if(CURL_TELCMD_OK(j))
-            infof(data, "%s", CURL_TELCMD(j));
-          else
-            infof(data, "%d", j);
-          infof(data, ", not IAC SE) ");
-        }
-      }
-      length -= 2;
-    }
-    if(length < 1) {
-      infof(data, "(Empty suboption?)");
-      return;
-    }
-
-    if(CURL_TELOPT_OK(pointer[0])) {
-      switch(pointer[0]) {
-      case CURL_TELOPT_TTYPE:
-      case CURL_TELOPT_XDISPLOC:
-      case CURL_TELOPT_NEW_ENVIRON:
-      case CURL_TELOPT_NAWS:
-        infof(data, "%s", CURL_TELOPT(pointer[0]));
-        break;
-      default:
-        infof(data, "%s (unsupported)", CURL_TELOPT(pointer[0]));
-        break;
-      }
-    }
-    else
-      infof(data, "%d (unknown)", pointer[i]);
-
-    switch(pointer[0]) {
-    case CURL_TELOPT_NAWS:
-      if(length > 4)
-        infof(data, "Width: %d ; Height: %d", (pointer[1]<<8) | pointer[2],
-              (pointer[3]<<8) | pointer[4]);
-      break;
-    default:
-      switch(pointer[1]) {
-      case CURL_TELQUAL_IS:
-        infof(data, " IS");
-        break;
-      case CURL_TELQUAL_SEND:
-        infof(data, " SEND");
-        break;
-      case CURL_TELQUAL_INFO:
-        infof(data, " INFO/REPLY");
-        break;
-      case CURL_TELQUAL_NAME:
-        infof(data, " NAME");
-        break;
-      }
-
-      switch(pointer[0]) {
-      case CURL_TELOPT_TTYPE:
-      case CURL_TELOPT_XDISPLOC:
-        pointer[length] = 0;
-        infof(data, " \"%s\"", &pointer[2]);
-        break;
-      case CURL_TELOPT_NEW_ENVIRON:
-        if(pointer[1] == CURL_TELQUAL_IS) {
-          infof(data, " ");
-          for(i = 3; i < length; i++) {
-            switch(pointer[i]) {
-            case CURL_NEW_ENV_VAR:
-              infof(data, ", ");
-              break;
-            case CURL_NEW_ENV_VALUE:
-              infof(data, " = ");
-              break;
-            default:
-              infof(data, "%c", pointer[i]);
-              break;
-            }
-          }
-        }
-        break;
-      default:
-        for(i = 2; i < length; i++)
-          infof(data, " %.2x", pointer[i]);
-        break;
-      }
-    }
-  }
-}
-
-#ifdef _MSC_VER
-#pragma warning(push)
-/* warning C4706: assignment within conditional expression */
-#pragma warning(disable:4706)
-#endif
 static bool str_is_nonascii(const char *str)
 {
   char c;
-  while((c = *str++))
+  while((c = *str++) != 0)
     if(c & 0x80)
       return TRUE;
 
   return FALSE;
 }
-#ifdef _MSC_VER
-#pragma warning(pop)
-#endif
 
-static CURLcode check_telnet_options(struct Curl_easy *data)
+static CURLcode check_telnet_options(struct Curl_easy *data,
+                                     struct TELNET *tn)
 {
   struct curl_slist *head;
   struct curl_slist *beg;
-  struct TELNET *tn = data->req.p.telnet;
   CURLcode result = CURLE_OK;
 
-  /* Add the user name as an environment variable if it
+  /* Add the username as an environment variable if it
      was given on the command line */
-  if(data->state.aptr.user) {
+  if(data->state.creds) {
     char buffer[256];
-    if(str_is_nonascii(data->conn->user))
+    if(str_is_nonascii(Curl_creds_user(data->conn->creds))) {
+      DEBUGF(infof(data, "set a non ASCII username in telnet"));
       return CURLE_BAD_FUNCTION_ARGUMENT;
-    msnprintf(buffer, sizeof(buffer), "USER,%s", data->conn->user);
+    }
+    curl_msnprintf(buffer, sizeof(buffer), "USER,%s",
+                   Curl_creds_user(data->conn->creds));
     beg = curl_slist_append(tn->telnet_vars, buffer);
     if(!beg) {
       curl_slist_free_all(tn->telnet_vars);
@@ -814,9 +854,9 @@ static CURLcode check_telnet_options(struct Curl_easy *data)
 
   for(head = data->set.telnet_options; head && !result; head = head->next) {
     size_t olen;
-    char *option = head->data;
-    char *arg;
-    char *sep = strchr(option, '=');
+    const char *option = head->data;
+    const char *arg;
+    const char *sep = strchr(option, '=');
     if(sep) {
       olen = sep - option;
       arg = ++sep;
@@ -825,29 +865,27 @@ static CURLcode check_telnet_options(struct Curl_easy *data)
       switch(olen) {
       case 5:
         /* Terminal type */
-        if(strncasecompare(option, "TTYPE", 5)) {
-          strncpy(tn->subopt_ttype, arg, 31);
-          tn->subopt_ttype[31] = 0; /* String termination */
+        if(curl_strnequal(option, "TTYPE", 5)) {
+          tn->subopt_ttype = arg;
           tn->us_preferred[CURL_TELOPT_TTYPE] = CURL_YES;
+          break;
         }
-        else
-          result = CURLE_UNKNOWN_OPTION;
+        result = CURLE_UNKNOWN_OPTION;
         break;
 
       case 8:
         /* Display variable */
-        if(strncasecompare(option, "XDISPLOC", 8)) {
-          strncpy(tn->subopt_xdisploc, arg, 127);
-          tn->subopt_xdisploc[127] = 0; /* String termination */
+        if(curl_strnequal(option, "XDISPLOC", 8)) {
+          tn->subopt_xdisploc = arg;
           tn->us_preferred[CURL_TELOPT_XDISPLOC] = CURL_YES;
+          break;
         }
-        else
-          result = CURLE_UNKNOWN_OPTION;
+        result = CURLE_UNKNOWN_OPTION;
         break;
 
       case 7:
         /* Environment variable */
-        if(strncasecompare(option, "NEW_ENV", 7)) {
+        if(curl_strnequal(option, "NEW_ENV", 7)) {
           beg = curl_slist_append(tn->telnet_vars, arg);
           if(!beg) {
             result = CURLE_OUT_OF_MEMORY;
@@ -862,23 +900,21 @@ static CURLcode check_telnet_options(struct Curl_easy *data)
 
       case 2:
         /* Window Size */
-        if(strncasecompare(option, "WS", 2)) {
-          char *p;
-          unsigned long x = strtoul(arg, &p, 10);
-          unsigned long y = 0;
-          if(x && (x <= 0xffff) && Curl_raw_tolower(*p) == 'x') {
-            p++;
-            y = strtoul(p, NULL, 10);
-            if(y && (y <= 0xffff)) {
-              tn->subopt_wsx = (unsigned short)x;
-              tn->subopt_wsy = (unsigned short)y;
-              tn->us_preferred[CURL_TELOPT_NAWS] = CURL_YES;
-            }
-          }
-          if(!y) {
+        if(curl_strnequal(option, "WS", 2)) {
+          const char *p = arg;
+          curl_off_t x = 0;
+          curl_off_t y = 0;
+          if(curlx_str_number(&p, &x, 0xffff) ||
+             curlx_str_single(&p, 'x') ||
+             curlx_str_number(&p, &y, 0xffff)) {
             failf(data, "Syntax error in telnet option: %s", head->data);
             result = CURLE_SETOPT_OPTION_SYNTAX;
           }
+          else {
+            tn->subopt_wsx = (unsigned short)x;
+            tn->subopt_wsy = (unsigned short)y;
+            tn->us_preferred[CURL_TELOPT_NAWS] = CURL_YES;
+          }
         }
         else
           result = CURLE_UNKNOWN_OPTION;
@@ -886,9 +922,11 @@ static CURLcode check_telnet_options(struct Curl_easy *data)
 
       case 6:
         /* To take care or not of the 8th bit in data exchange */
-        if(strncasecompare(option, "BINARY", 6)) {
-          int binary_option = atoi(arg);
-          if(binary_option != 1) {
+        if(curl_strnequal(option, "BINARY", 6)) {
+          const char *p = arg;
+          curl_off_t binary_option;
+          if(!curlx_str_number(&p, &binary_option, 1) &&
+             (binary_option != 1)) {
             tn->us_preferred[CURL_TELOPT_BINARY] = CURL_NO;
             tn->him_preferred[CURL_TELOPT_BINARY] = CURL_NO;
           }
@@ -916,172 +954,131 @@ static CURLcode check_telnet_options(struct Curl_easy *data)
   return result;
 }
 
+/* if the option contains an IAC code, it should be escaped in the output, but
+   as we cannot think of any legit way to send that as part of the content we
+   rather ban its use instead */
+static bool bad_option(const char *data)
+{
+  return !data || !!strchr(data, CURL_IAC);
+}
+
 /*
  * suboption()
  *
  * Look at the sub-option buffer, and try to be helpful to the other
  * side.
  */
-
-static void suboption(struct Curl_easy *data)
+static CURLcode suboption(struct Curl_easy *data, struct TELNET *tn)
 {
   struct curl_slist *v;
   unsigned char temp[2048];
   ssize_t bytes_written;
   size_t len;
-  int err;
-  struct TELNET *tn = data->req.p.telnet;
   struct connectdata *conn = data->conn;
 
-  printsub(data, '<', (unsigned char *)tn->subbuffer, CURL_SB_LEN(tn) + 2);
-  switch(CURL_SB_GET(tn)) {
-    case CURL_TELOPT_TTYPE:
-      len = strlen(tn->subopt_ttype) + 4 + 2;
-      msnprintf((char *)temp, sizeof(temp),
-                "%c%c%c%c%s%c%c", CURL_IAC, CURL_SB, CURL_TELOPT_TTYPE,
-                CURL_TELQUAL_IS, tn->subopt_ttype, CURL_IAC, CURL_SE);
-      bytes_written = swrite(conn->sock[FIRSTSOCKET], temp, len);
-      if(bytes_written < 0) {
-        err = SOCKERRNO;
-        failf(data,"Sending data failed (%d)",err);
-      }
-      printsub(data, '>', &temp[2], len-2);
-      break;
-    case CURL_TELOPT_XDISPLOC:
-      len = strlen(tn->subopt_xdisploc) + 4 + 2;
-      msnprintf((char *)temp, sizeof(temp),
-                "%c%c%c%c%s%c%c", CURL_IAC, CURL_SB, CURL_TELOPT_XDISPLOC,
-                CURL_TELQUAL_IS, tn->subopt_xdisploc, CURL_IAC, CURL_SE);
-      bytes_written = swrite(conn->sock[FIRSTSOCKET], temp, len);
-      if(bytes_written < 0) {
-        err = SOCKERRNO;
-        failf(data,"Sending data failed (%d)",err);
-      }
-      printsub(data, '>', &temp[2], len-2);
-      break;
-    case CURL_TELOPT_NEW_ENVIRON:
-      msnprintf((char *)temp, sizeof(temp),
-                "%c%c%c%c", CURL_IAC, CURL_SB, CURL_TELOPT_NEW_ENVIRON,
-                CURL_TELQUAL_IS);
-      len = 4;
+  if(!CURL_SB_LEN(tn)) /* ignore empty suboption */
+    return CURLE_OK;
 
-      for(v = tn->telnet_vars; v; v = v->next) {
-        size_t tmplen = (strlen(v->data) + 1);
-        /* Add the variable if it fits */
-        if(len + tmplen < (int)sizeof(temp)-6) {
-          char *s = strchr(v->data, ',');
-          if(!s)
-            len += msnprintf((char *)&temp[len], sizeof(temp) - len,
-                             "%c%s", CURL_NEW_ENV_VAR, v->data);
-          else {
-            size_t vlen = s - v->data;
-            len += msnprintf((char *)&temp[len], sizeof(temp) - len,
-                             "%c%.*s%c%s", CURL_NEW_ENV_VAR,
-                             (int)vlen, v->data, CURL_NEW_ENV_VALUE, ++s);
-          }
+  printsub(data, '<', (const unsigned char *)tn->subbuffer,
+           CURL_SB_LEN(tn) + 2);
+  switch(CURL_SB_GET(tn)) {
+  case CURL_TELOPT_TTYPE:
+    if(bad_option(tn->subopt_ttype))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    if(strlen(tn->subopt_ttype) > 1000) {
+      failf(data, "Too long telnet TTYPE");
+      return CURLE_SEND_ERROR;
+    }
+    len = curl_msnprintf((char *)temp, sizeof(temp), "%c%c%c%c%s%c%c",
+                         CURL_IAC, CURL_SB, CURL_TELOPT_TTYPE,
+                         CURL_TELQUAL_IS, tn->subopt_ttype, CURL_IAC,
+                         CURL_SE);
+    bytes_written = swrite(conn->sock[FIRSTSOCKET], temp, len);
+
+    if(bytes_written < 0) {
+      failf(data, "Sending data failed (%d)", SOCKERRNO);
+      return CURLE_SEND_ERROR;
+    }
+    printsub(data, '>', &temp[2], len-2);
+    break;
+  case CURL_TELOPT_XDISPLOC:
+    if(bad_option(tn->subopt_xdisploc))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    if(strlen(tn->subopt_xdisploc) > 1000) {
+      failf(data, "Too long telnet XDISPLOC");
+      return CURLE_SEND_ERROR;
+    }
+    len = curl_msnprintf((char *)temp, sizeof(temp), "%c%c%c%c%s%c%c",
+                         CURL_IAC, CURL_SB, CURL_TELOPT_XDISPLOC,
+                         CURL_TELQUAL_IS, tn->subopt_xdisploc, CURL_IAC,
+                         CURL_SE);
+    bytes_written = swrite(conn->sock[FIRSTSOCKET], temp, len);
+    if(bytes_written < 0) {
+      failf(data, "Sending data failed (%d)", SOCKERRNO);
+      return CURLE_SEND_ERROR;
+    }
+    printsub(data, '>', &temp[2], len - 2);
+    break;
+  case CURL_TELOPT_NEW_ENVIRON:
+    len = curl_msnprintf((char *)temp, sizeof(temp), "%c%c%c%c",
+                         CURL_IAC, CURL_SB, CURL_TELOPT_NEW_ENVIRON,
+                         CURL_TELQUAL_IS);
+    for(v = tn->telnet_vars; v; v = v->next) {
+      size_t tmplen = (strlen(v->data) + 1);
+      if(bad_option(v->data))
+        return CURLE_BAD_FUNCTION_ARGUMENT;
+      /* Add the variable if it fits */
+      if(len + tmplen < sizeof(temp) - 6) {
+        const char *s = strchr(v->data, ',');
+        if(!s)
+          len += curl_msnprintf((char *)&temp[len], sizeof(temp) - len,
+                                "%c%s", CURL_NEW_ENV_VAR, v->data);
+        else {
+          size_t vlen = s - v->data;
+          len += curl_msnprintf((char *)&temp[len], sizeof(temp) - len,
+                                "%c%.*s%c%s", CURL_NEW_ENV_VAR,
+                                (int)vlen, v->data, CURL_NEW_ENV_VALUE, ++s);
         }
       }
-      msnprintf((char *)&temp[len], sizeof(temp) - len,
-                "%c%c", CURL_IAC, CURL_SE);
-      len += 2;
-      bytes_written = swrite(conn->sock[FIRSTSOCKET], temp, len);
-      if(bytes_written < 0) {
-        err = SOCKERRNO;
-        failf(data,"Sending data failed (%d)",err);
-      }
-      printsub(data, '>', &temp[2], len-2);
-      break;
-  }
-  return;
-}
-
-
-/*
- * sendsuboption()
- *
- * Send suboption information to the server side.
- */
-
-static void sendsuboption(struct Curl_easy *data, int option)
-{
-  ssize_t bytes_written;
-  int err;
-  unsigned short x, y;
-  unsigned char *uc1, *uc2;
-  struct TELNET *tn = data->req.p.telnet;
-  struct connectdata *conn = data->conn;
-
-  switch(option) {
-  case CURL_TELOPT_NAWS:
-    /* We prepare data to be sent */
-    CURL_SB_CLEAR(tn);
-    CURL_SB_ACCUM(tn, CURL_IAC);
-    CURL_SB_ACCUM(tn, CURL_SB);
-    CURL_SB_ACCUM(tn, CURL_TELOPT_NAWS);
-    /* We must deal either with little or big endian processors */
-    /* Window size must be sent according to the 'network order' */
-    x = htons(tn->subopt_wsx);
-    y = htons(tn->subopt_wsy);
-    uc1 = (unsigned char *)&x;
-    uc2 = (unsigned char *)&y;
-    CURL_SB_ACCUM(tn, uc1[0]);
-    CURL_SB_ACCUM(tn, uc1[1]);
-    CURL_SB_ACCUM(tn, uc2[0]);
-    CURL_SB_ACCUM(tn, uc2[1]);
-
-    CURL_SB_ACCUM(tn, CURL_IAC);
-    CURL_SB_ACCUM(tn, CURL_SE);
-    CURL_SB_TERM(tn);
-    /* data suboption is now ready */
-
-    printsub(data, '>', (unsigned char *)tn->subbuffer + 2,
-             CURL_SB_LEN(tn)-2);
-
-    /* we send the header of the suboption... */
-    bytes_written = swrite(conn->sock[FIRSTSOCKET], tn->subbuffer, 3);
-    if(bytes_written < 0) {
-      err = SOCKERRNO;
-      failf(data, "Sending data failed (%d)", err);
-    }
-    /* ... then the window size with the send_telnet_data() function
-       to deal with 0xFF cases ... */
-    send_telnet_data(data, (char *)tn->subbuffer + 3, 4);
-    /* ... and the footer */
-    bytes_written = swrite(conn->sock[FIRSTSOCKET], tn->subbuffer + 7, 2);
-    if(bytes_written < 0) {
-      err = SOCKERRNO;
-      failf(data, "Sending data failed (%d)", err);
     }
+    curl_msnprintf((char *)&temp[len], sizeof(temp) - len,
+                   "%c%c", CURL_IAC, CURL_SE);
+    len += 2;
+    bytes_written = swrite(conn->sock[FIRSTSOCKET], temp, len);
+    if(bytes_written < 0)
+      failf(data, "Sending data failed (%d)", SOCKERRNO);
+    printsub(data, '>', &temp[2], len - 2);
     break;
   }
+  return CURLE_OK;
 }
 
-
-static
-CURLcode telrcv(struct Curl_easy *data,
-                const unsigned char *inbuf, /* Data received from socket */
-                ssize_t count)              /* Number of bytes received */
+static CURLcode telrcv(struct Curl_easy *data,
+                       struct TELNET *tn,
+                       const unsigned char *inbuf, /* Data received from
+                                                      socket */
+                       ssize_t count)              /* Number of bytes
+                                                      received */
 {
   unsigned char c;
   CURLcode result;
   int in = 0;
   int startwrite = -1;
-  struct TELNET *tn = data->req.p.telnet;
 
-#define startskipping()                                       \
-  if(startwrite >= 0) {                                       \
-    result = Curl_client_write(data,                          \
-                               CLIENTWRITE_BODY,              \
-                               (char *)&inbuf[startwrite],    \
-                               in-startwrite);                \
-    if(result)                                                \
-      return result;                                          \
-  }                                                           \
+#define startskipping()                                          \
+  if(startwrite >= 0) {                                          \
+    result = Curl_client_write(data,                             \
+                               CLIENTWRITE_BODY,                 \
+                               (const char *)&inbuf[startwrite], \
+                               in-startwrite);                   \
+    if(result)                                                   \
+      return result;                                             \
+  }                                                              \
   startwrite = -1
 
-#define writebyte() \
-    if(startwrite < 0) \
-      startwrite = in
+#define writebyte()  \
+  if(startwrite < 0) \
+    startwrite = in
 
 #define bufferflush() startskipping()
 
@@ -1110,7 +1107,6 @@ CURLcode telrcv(struct Curl_easy *data,
       break;
 
     case CURL_TS_IAC:
-process_iac:
       DEBUGASSERT(startwrite < 0);
       switch(c) {
       case CURL_WILL:
@@ -1143,75 +1139,67 @@ process_iac:
       }
       break;
 
-      case CURL_TS_WILL:
-        printoption(data, "RCVD", CURL_WILL, c);
-        tn->please_negotiate = 1;
-        rec_will(data, c);
-        tn->telrcv_state = CURL_TS_DATA;
-        break;
+    case CURL_TS_WILL:
+      printoption(data, "RCVD", CURL_WILL, c);
+      tn->please_negotiate = 1;
+      rec_will(data, tn, c);
+      tn->telrcv_state = CURL_TS_DATA;
+      break;
 
-      case CURL_TS_WONT:
-        printoption(data, "RCVD", CURL_WONT, c);
-        tn->please_negotiate = 1;
-        rec_wont(data, c);
-        tn->telrcv_state = CURL_TS_DATA;
-        break;
+    case CURL_TS_WONT:
+      printoption(data, "RCVD", CURL_WONT, c);
+      tn->please_negotiate = 1;
+      rec_wont(data, tn, c);
+      tn->telrcv_state = CURL_TS_DATA;
+      break;
 
-      case CURL_TS_DO:
-        printoption(data, "RCVD", CURL_DO, c);
-        tn->please_negotiate = 1;
-        rec_do(data, c);
-        tn->telrcv_state = CURL_TS_DATA;
-        break;
+    case CURL_TS_DO:
+      printoption(data, "RCVD", CURL_DO, c);
+      tn->please_negotiate = 1;
+      rec_do(data, tn, c);
+      tn->telrcv_state = CURL_TS_DATA;
+      break;
 
-      case CURL_TS_DONT:
-        printoption(data, "RCVD", CURL_DONT, c);
-        tn->please_negotiate = 1;
-        rec_dont(data, c);
-        tn->telrcv_state = CURL_TS_DATA;
-        break;
+    case CURL_TS_DONT:
+      printoption(data, "RCVD", CURL_DONT, c);
+      tn->please_negotiate = 1;
+      rec_dont(data, tn, c);
+      tn->telrcv_state = CURL_TS_DATA;
+      break;
 
-      case CURL_TS_SB:
-        if(c == CURL_IAC)
-          tn->telrcv_state = CURL_TS_SE;
-        else
-          CURL_SB_ACCUM(tn, c);
-        break;
+    case CURL_TS_SB:
+      if(c == CURL_IAC)
+        tn->telrcv_state = CURL_TS_SE;
+      else
+        CURL_SB_ACCUM(tn, c);
+      break;
 
-      case CURL_TS_SE:
-        if(c != CURL_SE) {
-          if(c != CURL_IAC) {
-            /*
-             * This is an error.  We only expect to get "IAC IAC" or "IAC SE".
-             * Several things may have happened.  An IAC was not doubled, the
-             * IAC SE was left off, or another option got inserted into the
-             * suboption are all possibilities.  If we assume that the IAC was
-             * not doubled, and really the IAC SE was left off, we could get
-             * into an infinite loop here.  So, instead, we terminate the
-             * suboption, and process the partial suboption if we can.
-             */
-            CURL_SB_ACCUM(tn, CURL_IAC);
-            CURL_SB_ACCUM(tn, c);
-            tn->subpointer -= 2;
-            CURL_SB_TERM(tn);
-
-            printoption(data, "In SUBOPTION processing, RCVD", CURL_IAC, c);
-            suboption(data);   /* handle sub-option */
-            tn->telrcv_state = CURL_TS_IAC;
-            goto process_iac;
-          }
-          CURL_SB_ACCUM(tn, c);
-          tn->telrcv_state = CURL_TS_SB;
+    case CURL_TS_SE:
+      if(c != CURL_SE) {
+        if(c != CURL_IAC) {
+          /*
+           * This is an error. We only expect to get "IAC IAC" or "IAC SE".
+           * Several things may have happened. An IAC was not doubled, the IAC
+           * SE was left off, or another option got inserted into the
+           * suboption are all possibilities.
+           */
+          failf(data, "telnet: suboption error");
+          return CURLE_RECV_ERROR;
         }
-        else {
-          CURL_SB_ACCUM(tn, CURL_IAC);
-          CURL_SB_ACCUM(tn, CURL_SE);
-          tn->subpointer -= 2;
-          CURL_SB_TERM(tn);
-          suboption(data);   /* handle sub-option */
-          tn->telrcv_state = CURL_TS_DATA;
-        }
-        break;
+        CURL_SB_ACCUM(tn, c);
+        tn->telrcv_state = CURL_TS_SB;
+      }
+      else {
+        CURL_SB_ACCUM(tn, CURL_IAC);
+        CURL_SB_ACCUM(tn, CURL_SE);
+        tn->subpointer -= 2;
+        CURL_SB_TERM(tn);
+        result = suboption(data, tn);   /* handle sub-option */
+        if(result)
+          return result;
+        tn->telrcv_state = CURL_TS_DATA;
+      }
+      break;
     }
     ++in;
   }
@@ -1219,81 +1207,12 @@ process_iac:
   return CURLE_OK;
 }
 
-/* Escape and send a telnet data block */
-static CURLcode send_telnet_data(struct Curl_easy *data,
-                                 char *buffer, ssize_t nread)
-{
-  ssize_t escapes, i, outlen;
-  unsigned char *outbuf = NULL;
-  CURLcode result = CURLE_OK;
-  ssize_t bytes_written, total_written;
-  struct connectdata *conn = data->conn;
-
-  /* Determine size of new buffer after escaping */
-  escapes = 0;
-  for(i = 0; i < nread; i++)
-    if((unsigned char)buffer[i] == CURL_IAC)
-      escapes++;
-  outlen = nread + escapes;
-
-  if(outlen == nread)
-    outbuf = (unsigned char *)buffer;
-  else {
-    ssize_t j;
-    outbuf = malloc(nread + escapes + 1);
-    if(!outbuf)
-      return CURLE_OUT_OF_MEMORY;
-
-    j = 0;
-    for(i = 0; i < nread; i++) {
-      outbuf[j++] = (unsigned char)buffer[i];
-      if((unsigned char)buffer[i] == CURL_IAC)
-        outbuf[j++] = CURL_IAC;
-    }
-    outbuf[j] = '\0';
-  }
-
-  total_written = 0;
-  while(!result && total_written < outlen) {
-    /* Make sure socket is writable to avoid EWOULDBLOCK condition */
-    struct pollfd pfd[1];
-    pfd[0].fd = conn->sock[FIRSTSOCKET];
-    pfd[0].events = POLLOUT;
-    switch(Curl_poll(pfd, 1, -1)) {
-      case -1:                    /* error, abort writing */
-      case 0:                     /* timeout (will never happen) */
-        result = CURLE_SEND_ERROR;
-        break;
-      default:                    /* write! */
-        bytes_written = 0;
-        result = Curl_nwrite(data, FIRSTSOCKET,
-                             outbuf + total_written,
-                             outlen - total_written,
-                             &bytes_written);
-        total_written += bytes_written;
-        break;
-    }
-  }
-
-  /* Free malloc copy if escaped */
-  if(outbuf != (unsigned char *)buffer)
-    free(outbuf);
-
-  return result;
-}
-
 static CURLcode telnet_done(struct Curl_easy *data,
                             CURLcode status, bool premature)
 {
-  struct TELNET *tn = data->req.p.telnet;
-  (void)status; /* unused */
-  (void)premature; /* not used */
-
-  if(!tn)
-    return CURLE_OK;
-
-  curl_slist_free_all(tn->telnet_vars);
-  tn->telnet_vars = NULL;
+  (void)status;
+  (void)premature;
+  Curl_meta_remove(data, CURL_META_TELNET_EASY);
   return CURLE_OK;
 }
 
@@ -1307,21 +1226,17 @@ static CURLcode telnet_do(struct Curl_easy *data, bool *done)
   WSANETWORKEVENTS events;
   HANDLE stdin_handle;
   HANDLE objs[2];
-  DWORD  obj_count;
-  DWORD  wait_timeout;
+  DWORD obj_count;
+  DWORD wait_timeout;
   DWORD readfile_read;
-  int err;
 #else
   timediff_t interval_ms;
   struct pollfd pfd[2];
   int poll_cnt;
-  curl_off_t total_dl = 0;
-  curl_off_t total_ul = 0;
+  ssize_t snread;
 #endif
-  ssize_t nread;
-  struct curltime now;
   bool keepon = TRUE;
-  char *buf = data->state.buffer;
+  char buffer[4 * 1024];
   struct TELNET *tn;
 
   *done = TRUE; /* unconditionally */
@@ -1330,17 +1245,19 @@ static CURLcode telnet_do(struct Curl_easy *data, bool *done)
   if(result)
     return result;
 
-  tn = data->req.p.telnet;
+  tn = Curl_meta_get(data, CURL_META_TELNET_EASY);
+  if(!tn)
+    return CURLE_FAILED_INIT;
 
-  result = check_telnet_options(data);
+  result = check_telnet_options(data, tn);
   if(result)
     return result;
 
 #ifdef USE_WINSOCK
   /* We want to wait for both stdin and the socket. Since
-  ** the select() function in winsock only works on sockets
-  ** we have to use the WaitForMultipleObjects() call.
-  */
+   * the select() function in Winsock only works on sockets
+   * we have to use the WaitForMultipleObjects() call.
+   */
 
   /* First, create a sockets event object */
   event_handle = WSACreateEvent();
@@ -1349,13 +1266,13 @@ static CURLcode telnet_do(struct Curl_easy *data, bool *done)
     return CURLE_FAILED_INIT;
   }
 
-  /* Tell winsock what events we want to listen to */
-  if(WSAEventSelect(sockfd, event_handle, FD_READ|FD_CLOSE) == SOCKET_ERROR) {
+  /* Tell Winsock what events we want to listen to */
+  if(WSAEventSelect(sockfd, event_handle, FD_READ | FD_CLOSE) != 0) {
     WSACloseEvent(event_handle);
-    return CURLE_OK;
+    return CURLE_RECV_ERROR;
   }
 
-  /* The get the Windows file handle for stdin */
+  /* Then get the Windows file handle for stdin */
   stdin_handle = GetStdHandle(STD_INPUT_HANDLE);
 
   /* Create the list of objects to wait for */
@@ -1364,9 +1281,8 @@ static CURLcode telnet_do(struct Curl_easy *data, bool *done)
 
   /* If stdin_handle is a pipe, use PeekNamedPipe() method to check it,
      else use the old WaitForMultipleObjects() way */
-  if(GetFileType(stdin_handle) == FILE_TYPE_PIPE ||
-     data->set.is_fread_set) {
-    /* Don't wait for stdin_handle, just wait for event_handle */
+  if(GetFileType(stdin_handle) == FILE_TYPE_PIPE || data->set.is_fread_set) {
+    /* Do not wait for stdin_handle, wait for event_handle */
     obj_count = 1;
     /* Check stdin_handle per 100 milliseconds */
     wait_timeout = 100;
@@ -1378,18 +1294,17 @@ static CURLcode telnet_do(struct Curl_easy *data, bool *done)
 
   /* Keep on listening and act on events */
   while(keepon) {
-    const DWORD buf_size = (DWORD)data->set.buffer_size;
+    const DWORD buf_size = (DWORD)sizeof(buffer);
     DWORD waitret = WaitForMultipleObjects(obj_count, objs,
                                            FALSE, wait_timeout);
     switch(waitret) {
 
-    case WAIT_TIMEOUT:
-    {
+    case WAIT_TIMEOUT: {
       for(;;) {
         if(data->set.is_fread_set) {
           size_t n;
           /* read from user-supplied method */
-          n = data->state.fread_func(buf, 1, buf_size, data->state.in);
+          n = data->state.fread_func(buffer, 1, buf_size, data->state.in);
           if(n == CURL_READFUNC_ABORT) {
             keepon = FALSE;
             result = CURLE_READ_ERROR;
@@ -1417,15 +1332,14 @@ static CURLcode telnet_do(struct Curl_easy *data, bool *done)
           if(!readfile_read)
             break;
 
-          if(!ReadFile(stdin_handle, buf, buf_size,
-                       &readfile_read, NULL)) {
+          if(!ReadFile(stdin_handle, buffer, buf_size, &readfile_read, NULL)) {
             keepon = FALSE;
             result = CURLE_READ_ERROR;
             break;
           }
         }
 
-        result = send_telnet_data(data, buf, readfile_read);
+        result = send_telnet_data(data, tn, buffer, readfile_read);
         if(result) {
           keepon = FALSE;
           break;
@@ -1434,16 +1348,14 @@ static CURLcode telnet_do(struct Curl_easy *data, bool *done)
     }
     break;
 
-    case WAIT_OBJECT_0 + 1:
-    {
-      if(!ReadFile(stdin_handle, buf, buf_size,
-                   &readfile_read, NULL)) {
+    case WAIT_OBJECT_0 + 1: {
+      if(!ReadFile(stdin_handle, buffer, buf_size, &readfile_read, NULL)) {
         keepon = FALSE;
         result = CURLE_READ_ERROR;
         break;
       }
 
-      result = send_telnet_data(data, buf, readfile_read);
+      result = send_telnet_data(data, tn, buffer, readfile_read);
       if(result) {
         keepon = FALSE;
         break;
@@ -1451,13 +1363,12 @@ static CURLcode telnet_do(struct Curl_easy *data, bool *done)
     }
     break;
 
-    case WAIT_OBJECT_0:
-    {
+    case WAIT_OBJECT_0: {
       events.lNetworkEvents = 0;
-      if(WSAEnumNetworkEvents(sockfd, event_handle, &events) == SOCKET_ERROR) {
-        err = SOCKERRNO;
-        if(err != EINPROGRESS) {
-          infof(data, "WSAEnumNetworkEvents failed (%d)", err);
+      if(WSAEnumNetworkEvents(sockfd, event_handle, &events) != 0) {
+        int sockerr = SOCKERRNO;
+        if(sockerr != SOCKEINPROGRESS) {
+          infof(data, "WSAEnumNetworkEvents failed (%d)", sockerr);
           keepon = FALSE;
           result = CURLE_READ_ERROR;
         }
@@ -1465,8 +1376,9 @@ static CURLcode telnet_do(struct Curl_easy *data, bool *done)
       }
       if(events.lNetworkEvents & FD_READ) {
         /* read data from network */
-        result = Curl_read(data, sockfd, buf, data->set.buffer_size, &nread);
-        /* read would've blocked. Loop again */
+        size_t nread;
+        result = Curl_xfer_recv(data, buffer, sizeof(buffer), &nread);
+        /* read would have blocked. Loop again */
         if(result == CURLE_AGAIN)
           break;
         /* returned not-zero, this an error */
@@ -1476,36 +1388,35 @@ static CURLcode telnet_do(struct Curl_easy *data, bool *done)
         }
         /* returned zero but actually received 0 or less here,
            the server closed the connection and we bail out */
-        else if(nread <= 0) {
+        else if(!nread) {
           keepon = FALSE;
           break;
         }
 
-        result = telrcv(data, (unsigned char *) buf, nread);
+        result = telrcv(data, tn, (unsigned char *)buffer, nread);
         if(result) {
           keepon = FALSE;
           break;
         }
 
         /* Negotiate if the peer has started negotiating,
-           otherwise don't. We don't want to speak telnet with
+           otherwise do not. We do not want to speak telnet with
            non-telnet servers, like POP or SMTP. */
         if(tn->please_negotiate && !tn->already_negotiated) {
-          negotiate(data);
+          telnet_negotiate(data, tn);
           tn->already_negotiated = 1;
         }
       }
       if(events.lNetworkEvents & FD_CLOSE) {
         keepon = FALSE;
       }
+      break;
     }
-    break;
-
-    }
+    } /* switch */
 
     if(data->set.timeout) {
-      now = Curl_now();
-      if(Curl_timediff(now, conn->created) >= data->set.timeout) {
+      if(curlx_ptimediff_ms(Curl_pgrs_now(data), &conn->created) >=
+         data->set.timeout) {
         failf(data, "Time-out");
         result = CURLE_OPERATION_TIMEDOUT;
         keepon = FALSE;
@@ -1531,112 +1442,140 @@ static CURLcode telnet_do(struct Curl_easy *data, bool *done)
     pfd[1].events = POLLIN;
     poll_cnt = 2;
     interval_ms = 1 * 1000;
+    if(pfd[1].fd < 0) {
+      failf(data, "cannot read input");
+      result = CURLE_RECV_ERROR;
+      keepon = FALSE;
+    }
   }
 
   while(keepon) {
     DEBUGF(infof(data, "telnet_do, poll %d fds", poll_cnt));
-    switch(Curl_poll(pfd, poll_cnt, interval_ms)) {
+    switch(Curl_poll(pfd, (unsigned int)poll_cnt, interval_ms)) {
     case -1:                    /* error, stop reading */
       keepon = FALSE;
       continue;
     case 0:                     /* timeout */
       pfd[0].revents = 0;
       pfd[1].revents = 0;
-      /* FALLTHROUGH */
+      FALLTHROUGH();
     default:                    /* read! */
       if(pfd[0].revents & POLLIN) {
         /* read data from network */
-        result = Curl_read(data, sockfd, buf, data->set.buffer_size, &nread);
-        /* read would've blocked. Loop again */
+        size_t nread;
+        result = Curl_xfer_recv(data, buffer, sizeof(buffer), &nread);
+        /* read would have blocked. Loop again */
         if(result == CURLE_AGAIN)
           break;
         /* returned not-zero, this an error */
         if(result) {
           keepon = FALSE;
-          /* TODO: in test 1452, macOS sees a ECONNRESET sometimes?
-           * Is this the telnet test server not shutting down the socket
-           * in a clean way? Seems to be timing related, happens more
-           * on slow debug build */
-          if(data->state.os_errno == ECONNRESET) {
+          /* In test 1452, macOS sees a ECONNRESET sometimes? Is this the
+           * telnet test server not shutting down the socket in a clean way?
+           * Seems to be timing related, happens more on slow debug build */
+          if(data->state.os_errno == SOCKECONNRESET) {
             DEBUGF(infof(data, "telnet_do, unexpected ECONNRESET on recv"));
           }
           break;
         }
         /* returned zero but actually received 0 or less here,
            the server closed the connection and we bail out */
-        else if(nread <= 0) {
+        else if(!nread) {
           keepon = FALSE;
           break;
         }
 
-        total_dl += nread;
-        Curl_pgrsSetDownloadCounter(data, total_dl);
-        result = telrcv(data, (unsigned char *)buf, nread);
+        Curl_pgrs_download_inc(data, nread);
+        result = telrcv(data, tn, (unsigned char *)buffer, nread);
         if(result) {
           keepon = FALSE;
           break;
         }
 
         /* Negotiate if the peer has started negotiating,
-           otherwise don't. We don't want to speak telnet with
+           otherwise do not. We do not want to speak telnet with
            non-telnet servers, like POP or SMTP. */
         if(tn->please_negotiate && !tn->already_negotiated) {
-          negotiate(data);
+          telnet_negotiate(data, tn);
           tn->already_negotiated = 1;
         }
       }
 
-      nread = 0;
+      snread = 0;
       if(poll_cnt == 2) {
         if(pfd[1].revents & POLLIN) { /* read from in file */
-          nread = read(pfd[1].fd, buf, data->set.buffer_size);
+          snread = read(pfd[1].fd, buffer, sizeof(buffer));
         }
       }
       else {
         /* read from user-supplied method */
-        nread = (int)data->state.fread_func(buf, 1, data->set.buffer_size,
-                                            data->state.in);
-        if(nread == CURL_READFUNC_ABORT) {
+        snread = (int)data->state.fread_func(buffer, 1, sizeof(buffer),
+                                             data->state.in);
+        if(snread == CURL_READFUNC_ABORT) {
           keepon = FALSE;
           break;
         }
-        if(nread == CURL_READFUNC_PAUSE)
+        if(snread == CURL_READFUNC_PAUSE)
           break;
       }
 
-      if(nread > 0) {
-        result = send_telnet_data(data, buf, nread);
+      if(snread > 0) {
+        result = send_telnet_data(data, tn, buffer, snread);
         if(result) {
           keepon = FALSE;
           break;
         }
-        total_ul += nread;
-        Curl_pgrsSetUploadCounter(data, total_ul);
+        Curl_pgrs_upload_inc(data, (size_t)snread);
       }
-      else if(nread < 0)
+      else if(snread < 0)
         keepon = FALSE;
 
       break;
     } /* poll switch statement */
 
     if(data->set.timeout) {
-      now = Curl_now();
-      if(Curl_timediff(now, conn->created) >= data->set.timeout) {
+      if(curlx_ptimediff_ms(Curl_pgrs_now(data), &conn->created) >=
+         data->set.timeout) {
         failf(data, "Time-out");
         result = CURLE_OPERATION_TIMEDOUT;
         keepon = FALSE;
       }
     }
 
-    if(Curl_pgrsUpdate(data)) {
-      result = CURLE_ABORTED_BY_CALLBACK;
-      break;
+    if(!result) {
+      result = Curl_pgrsUpdate(data);
+      if(result)
+        keepon = FALSE;
     }
   }
 #endif
   /* mark this as "no further transfer wanted" */
-  Curl_setup_transfer(data, -1, -1, FALSE, -1);
+  Curl_xfer_setup_nop(data);
 
   return result;
 }
-#endif
+
+/*
+ * TELNET protocol handler.
+ */
+const struct Curl_protocol Curl_protocol_telnet = {
+  ZERO_NULL,                            /* setup_connection */
+  telnet_do,                            /* do_it */
+  telnet_done,                          /* done */
+  ZERO_NULL,                            /* do_more */
+  ZERO_NULL,                            /* connect_it */
+  ZERO_NULL,                            /* connecting */
+  ZERO_NULL,                            /* doing */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
+  ZERO_NULL,                            /* disconnect */
+  ZERO_NULL,                            /* write_resp */
+  ZERO_NULL,                            /* write_resp_hd */
+  ZERO_NULL,                            /* connection_is_dead */
+  ZERO_NULL,                            /* attach connection */
+  ZERO_NULL,                            /* follow */
+};
+
+#endif /* !CURL_DISABLE_TELNET */
diff --git a/third-party/curl/lib/telnet.h b/third-party/curl/lib/telnet.h
index 30782d8375..3848fff3ba 100644
--- a/third-party/curl/lib/telnet.h
+++ b/third-party/curl/lib/telnet.h
@@ -24,7 +24,7 @@
  *
  ***************************************************************************/
 #ifndef CURL_DISABLE_TELNET
-extern const struct Curl_handler Curl_handler_telnet;
+extern const struct Curl_protocol Curl_protocol_telnet;
 #endif
 
 #endif /* HEADER_CURL_TELNET_H */
diff --git a/third-party/curl/lib/tftp.c b/third-party/curl/lib/tftp.c
index 8ed1b887b4..00e89752bd 100644
--- a/third-party/curl/lib/tftp.c
+++ b/third-party/curl/lib/tftp.c
@@ -21,8 +21,9 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+#include "urldata.h"
+#include "tftp.h"
 
 #ifndef CURL_DISABLE_TFTP
 
@@ -46,33 +47,25 @@
 #include <sys/param.h>
 #endif
 
-#include "urldata.h"
-#include <curl/curl.h>
+#include "cfilters.h"
 #include "cf-socket.h"
 #include "transfer.h"
 #include "sendf.h"
-#include "tftp.h"
+#include "curl_trc.h"
 #include "progress.h"
 #include "connect.h"
-#include "strerror.h"
 #include "sockaddr.h" /* required for Curl_sockaddr_storage */
-#include "multiif.h"
 #include "url.h"
 #include "strcase.h"
-#include "speedcheck.h"
 #include "select.h"
 #include "escape.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curlx/strerr.h"
+#include "curlx/strparse.h"
+#include "curlx/strcopy.h"
 
 /* RFC2348 allows the block size to be negotiated */
 #define TFTP_BLKSIZE_DEFAULT 512
-#define TFTP_BLKSIZE_MIN 8
-#define TFTP_BLKSIZE_MAX 65464
-#define TFTP_OPTION_BLKSIZE "blksize"
+#define TFTP_OPTION_BLKSIZE  "blksize"
 
 /* from RFC2349: */
 #define TFTP_OPTION_TSIZE    "tsize"
@@ -122,7 +115,14 @@ struct tftp_packet {
   unsigned char *data;
 };
 
-struct tftp_state_data {
+/* meta key for storing protocol meta at connection */
+#define CURL_META_TFTP_CONN   "meta:proto:tftp:conn"
+
+struct tftp_conn {
+  struct Curl_sockaddr_storage local_addr;
+  struct Curl_sockaddr_storage remote_addr;
+  struct tftp_packet rpacket;
+  struct tftp_packet spacket;
   tftp_state_t    state;
   tftp_mode_t     mode;
   tftp_error_t    error;
@@ -133,63 +133,13 @@ struct tftp_state_data {
   int             retry_time;
   int             retry_max;
   time_t          rx_time;
-  struct Curl_sockaddr_storage   local_addr;
-  struct Curl_sockaddr_storage   remote_addr;
   curl_socklen_t  remote_addrlen;
   int             rbytes;
-  int             sbytes;
-  int             blksize;
-  int             requested_blksize;
+  size_t          sbytes;
+  unsigned int    blksize;
+  unsigned int    requested_blksize;
   unsigned short  block;
-  struct tftp_packet rpacket;
-  struct tftp_packet spacket;
-};
-
-
-/* Forward declarations */
-static CURLcode tftp_rx(struct tftp_state_data *state, tftp_event_t event);
-static CURLcode tftp_tx(struct tftp_state_data *state, tftp_event_t event);
-static CURLcode tftp_connect(struct Curl_easy *data, bool *done);
-static CURLcode tftp_disconnect(struct Curl_easy *data,
-                                struct connectdata *conn,
-                                bool dead_connection);
-static CURLcode tftp_do(struct Curl_easy *data, bool *done);
-static CURLcode tftp_done(struct Curl_easy *data,
-                          CURLcode, bool premature);
-static CURLcode tftp_setup_connection(struct Curl_easy *data,
-                                      struct connectdata *conn);
-static CURLcode tftp_multi_statemach(struct Curl_easy *data, bool *done);
-static CURLcode tftp_doing(struct Curl_easy *data, bool *dophase_done);
-static int tftp_getsock(struct Curl_easy *data, struct connectdata *conn,
-                        curl_socket_t *socks);
-static CURLcode tftp_translate_code(tftp_error_t error);
-
-
-/*
- * TFTP protocol handler.
- */
-
-const struct Curl_handler Curl_handler_tftp = {
-  "TFTP",                               /* scheme */
-  tftp_setup_connection,                /* setup_connection */
-  tftp_do,                              /* do_it */
-  tftp_done,                            /* done */
-  ZERO_NULL,                            /* do_more */
-  tftp_connect,                         /* connect_it */
-  tftp_multi_statemach,                 /* connecting */
-  tftp_doing,                           /* doing */
-  tftp_getsock,                         /* proto_getsock */
-  tftp_getsock,                         /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
-  tftp_disconnect,                      /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_TFTP,                            /* defport */
-  CURLPROTO_TFTP,                       /* protocol */
-  CURLPROTO_TFTP,                       /* family */
-  PROTOPT_NOTCPPROXY | PROTOPT_NOURLQUERY /* flags */
+  BIT(remote_pinned);
 };
 
 /**********************************************************
@@ -202,14 +152,13 @@ const struct Curl_handler Curl_handler_tftp = {
  *
  *
  **********************************************************/
-static CURLcode tftp_set_timeouts(struct tftp_state_data *state)
+static CURLcode tftp_set_timeouts(struct tftp_conn *state)
 {
-  time_t maxtime, timeout;
+  time_t timeout;
   timediff_t timeout_ms;
-  bool start = (state->state == TFTP_STATE_START) ? TRUE : FALSE;
 
   /* Compute drop-dead time */
-  timeout_ms = Curl_timeleft(state->data, NULL, start);
+  timeout_ms = Curl_timeleft_ms(state->data);
 
   if(timeout_ms < 0) {
     /* time-out, bail out, go home */
@@ -217,36 +166,34 @@ static CURLcode tftp_set_timeouts(struct tftp_state_data *state)
     return CURLE_OPERATION_TIMEDOUT;
   }
 
-  if(timeout_ms > 0)
-    maxtime = (time_t)(timeout_ms + 500) / 1000;
-  else
-    maxtime = 3600; /* use for calculating block timeouts */
-
   /* Set per-block timeout to total */
-  timeout = maxtime;
+  if((timeout_ms > 0) && (timeout_ms < 3600000))
+    /* do the calculation only if the timeout is "reasonable" */
+    timeout = (time_t)(timeout_ms + 500) / 1000;
+  else
+    timeout = 15;
 
   /* Average reposting an ACK after 5 seconds */
-  state->retry_max = (int)timeout/5;
+  state->retry_max = (int)timeout / 5;
 
-  /* But bound the total number */
-  if(state->retry_max<3)
+  /* Bound the total number */
+  if(state->retry_max < 3)
     state->retry_max = 3;
 
-  if(state->retry_max>50)
+  if(state->retry_max > 50)
     state->retry_max = 50;
 
   /* Compute the re-ACK interval to suit the timeout */
-  state->retry_time = (int)(timeout/state->retry_max);
-  if(state->retry_time<1)
+  state->retry_time = (int)(timeout / state->retry_max);
+  if(state->retry_time < 1)
     state->retry_time = 1;
 
   infof(state->data,
-        "set timeouts for state %d; Total % " CURL_FORMAT_CURL_OFF_T
-        ", retry %d maxtry %d",
+        "set timeouts for state %d; Total %" FMT_OFF_T ", retry %d maxtry %d",
         (int)state->state, timeout_ms, state->retry_time, state->retry_max);
 
   /* init RX time */
-  time(&state->rx_time);
+  state->rx_time = time(NULL);
 
   return CURLE_OK;
 }
@@ -265,7 +212,6 @@ static void setpacketevent(struct tftp_packet *packet, unsigned short num)
   packet->data[1] = (unsigned char)(num & 0xff);
 }
 
-
 static void setpacketblock(struct tftp_packet *packet, unsigned short num)
 {
   packet->data[2] = (unsigned char)(num >> 8);
@@ -285,7 +231,7 @@ static unsigned short getrpacketblock(const struct tftp_packet *packet)
 static size_t tftp_strnlen(const char *string, size_t maxlen)
 {
   const char *end = memchr(string, '\0', maxlen);
-  return end ? (size_t) (end - string) : maxlen;
+  return end ? (size_t)(end - string) : maxlen;
 }
 
 static const char *tftp_option_get(const char *buf, size_t len,
@@ -300,7 +246,7 @@ static const char *tftp_option_get(const char *buf, size_t len,
     return NULL;
   *option = buf;
 
-  loc += tftp_strnlen(buf + loc, len-loc);
+  loc += tftp_strnlen(buf + loc, len - loc);
   loc++; /* NULL term */
 
   if(loc > len)
@@ -310,71 +256,71 @@ static const char *tftp_option_get(const char *buf, size_t len,
   return &buf[loc];
 }
 
-static CURLcode tftp_parse_option_ack(struct tftp_state_data *state,
+static CURLcode tftp_parse_option_ack(struct tftp_conn *state,
                                       const char *ptr, int len)
 {
   const char *tmp = ptr;
   struct Curl_easy *data = state->data;
 
-  /* if OACK doesn't contain blksize option, the default (512) must be used */
+  /* if OACK does not contain blksize option, the default (512) must be used */
   state->blksize = TFTP_BLKSIZE_DEFAULT;
 
   while(tmp < ptr + len) {
     const char *option, *value;
+    size_t olen;
 
     tmp = tftp_option_get(tmp, ptr + len - tmp, &option, &value);
     if(!tmp) {
       failf(data, "Malformed ACK packet, rejecting");
       return CURLE_TFTP_ILLEGAL;
     }
+    olen = strlen(option);
 
     infof(data, "got option=(%s) value=(%s)", option, value);
 
-    if(checkprefix(TFTP_OPTION_BLKSIZE, option)) {
-      long blksize;
-
-      blksize = strtol(value, NULL, 10);
-
-      if(!blksize) {
-        failf(data, "invalid blocksize value in OACK packet");
-        return CURLE_TFTP_ILLEGAL;
-      }
-      if(blksize > TFTP_BLKSIZE_MAX) {
+    if((strlen(TFTP_OPTION_BLKSIZE) == olen) &&
+       checkprefix(TFTP_OPTION_BLKSIZE, option)) {
+      curl_off_t blksize;
+      if(curlx_str_number(&value, &blksize, TFTP_BLKSIZE_MAX)) {
         failf(data, "%s (%d)", "blksize is larger than max supported",
               TFTP_BLKSIZE_MAX);
         return CURLE_TFTP_ILLEGAL;
       }
+      if(!blksize) {
+        failf(data, "invalid blocksize value in OACK packet");
+        return CURLE_TFTP_ILLEGAL;
+      }
       else if(blksize < TFTP_BLKSIZE_MIN) {
         failf(data, "%s (%d)", "blksize is smaller than min supported",
               TFTP_BLKSIZE_MIN);
         return CURLE_TFTP_ILLEGAL;
       }
       else if(blksize > state->requested_blksize) {
-        /* could realloc pkt buffers here, but the spec doesn't call out
+        /* could realloc pkt buffers here, but the spec does not call out
          * support for the server requesting a bigger blksize than the client
          * requests */
-        failf(data, "%s (%ld)",
-              "server requested blksize larger than allocated", blksize);
+        failf(data, "server requested blksize larger than allocated (%"
+              CURL_FORMAT_CURL_OFF_T ")", blksize);
         return CURLE_TFTP_ILLEGAL;
       }
 
-      state->blksize = (int)blksize;
-      infof(data, "%s (%d) %s (%d)", "blksize parsed from OACK",
-            state->blksize, "requested", state->requested_blksize);
+      state->blksize = (unsigned int)blksize;
+      infof(data, "blksize parsed from OACK (%u) requested (%u)",
+            state->blksize, state->requested_blksize);
     }
-    else if(checkprefix(TFTP_OPTION_TSIZE, option)) {
-      long tsize = 0;
-
-      tsize = strtol(value, NULL, 10);
-      infof(data, "%s (%ld)", "tsize parsed from OACK", tsize);
-
+    else if((strlen(TFTP_OPTION_TSIZE) == olen) &&
+            checkprefix(TFTP_OPTION_TSIZE, option)) {
+      curl_off_t tsize = 0;
       /* tsize should be ignored on upload: Who cares about the size of the
          remote file? */
-      if(!data->state.upload) {
+      if(!data->state.upload &&
+         !curlx_str_number(&value, &tsize, CURL_OFF_T_MAX)) {
         if(!tsize) {
           failf(data, "invalid tsize -:%s:- value in OACK packet", value);
           return CURLE_TFTP_ILLEGAL;
         }
+        infof(data, "tsize parsed from OACK (%" CURL_FORMAT_CURL_OFF_T ")",
+              tsize);
         Curl_pgrsSetDownloadSize(data, tsize);
       }
     }
@@ -383,25 +329,182 @@ static CURLcode tftp_parse_option_ack(struct tftp_state_data *state,
   return CURLE_OK;
 }
 
-static CURLcode tftp_option_add(struct tftp_state_data *state, size_t *csize,
-                                char *buf, const char *option)
+static CURLcode tftp_option_add(struct tftp_conn *state, size_t *csize,
+                                size_t index, const char *option)
 {
-  if(( strlen(option) + *csize + 1) > (size_t)state->blksize)
+  char *buf = (char *)&state->spacket.data[index];
+  size_t oplen = strlen(option);
+  size_t blen;
+  if((state->blksize <= index) ||
+     (oplen + 1) > (size_t)(state->blksize - index))
     return CURLE_TFTP_ILLEGAL;
-  strcpy(buf, option);
-  *csize += strlen(option) + 1;
+  blen = state->blksize - index;
+  curlx_strcopy(buf, blen, option, oplen);
+  *csize += oplen + 1;
   return CURLE_OK;
 }
 
-static CURLcode tftp_connect_for_tx(struct tftp_state_data *state,
+/* the next blocknum is x + 1 but it needs to wrap at an unsigned 16-bit
+   boundary */
+#define NEXT_BLOCKNUM(x) (((x) + 1) & 0xffff)
+
+/**********************************************************
+ *
+ * tftp_tx
+ *
+ * Event handler for the TX state
+ *
+ **********************************************************/
+static CURLcode tftp_tx(struct tftp_conn *state, tftp_event_t event)
+{
+  struct Curl_easy *data = state->data;
+  ssize_t sbytes;
+  CURLcode result = CURLE_OK;
+  struct SingleRequest *k = &data->req;
+  size_t cb; /* Bytes currently read */
+  char buffer[STRERROR_LEN];
+  char *bufptr;
+  bool eos;
+
+  switch(event) {
+
+  case TFTP_EVENT_ACK:
+  case TFTP_EVENT_OACK:
+    if(event == TFTP_EVENT_ACK) {
+      /* Ack the packet */
+      int rblock = getrpacketblock(&state->rpacket);
+
+      if(rblock != state->block &&
+         /* There is a bug in tftpd-hpa that causes it to send us an ACK for
+          * 65535 when the block number wraps to 0. To handle it, when we are
+          * expecting 0, also accept 65535. See
+          * https://www.syslinux.org/archives/2010-September/015612.html
+          * */
+         !(state->block == 0 && rblock == 65535)) {
+        /* This is not the expected block. Log it and up the retry counter */
+        infof(data, "Received ACK for block %d, expecting %d",
+              rblock, state->block);
+        state->retries++;
+        /* Bail out if over the maximum */
+        if(state->retries > state->retry_max) {
+          failf(data, "tftp_tx: giving up waiting for block %d ack",
+                state->block);
+          result = CURLE_SEND_ERROR;
+        }
+        else {
+          /* Re-send the data packet */
+          sbytes = sendto(state->sockfd, (void *)state->spacket.data,
+                          4 + (SEND_TYPE_ARG3)state->sbytes, SEND_4TH_ARG,
+                          (struct sockaddr *)&state->remote_addr,
+                          state->remote_addrlen);
+          /* Check all sbytes were sent */
+          if(sbytes < 0) {
+            failf(data, "%s",
+                  curlx_strerror(SOCKERRNO, buffer, sizeof(buffer)));
+            result = CURLE_SEND_ERROR;
+          }
+        }
+
+        return result;
+      }
+      /* This is the expected packet. Reset the counters and send the next
+         block */
+      state->rx_time = time(NULL);
+      state->block++;
+    }
+    else
+      state->block = 1; /* first data block is 1 when using OACK */
+
+    state->retries = 0;
+    setpacketevent(&state->spacket, TFTP_EVENT_DATA);
+    setpacketblock(&state->spacket, state->block);
+    if(state->block > 1 && state->sbytes < state->blksize) {
+      state->state = TFTP_STATE_FIN;
+      return CURLE_OK;
+    }
+
+    /* TFTP considers data block size < 512 bytes as an end of session, so
+     * in some cases we must wait for additional data to build full (512 bytes)
+     * data block.
+     * */
+    state->sbytes = 0;
+    bufptr = (char *)state->spacket.data + 4;
+    do {
+      result = Curl_client_read(data, bufptr, state->blksize - state->sbytes,
+                                &cb, &eos);
+      if(result)
+        return result;
+      state->sbytes += cb;
+      bufptr += cb;
+    } while(state->sbytes < state->blksize && cb);
+
+    sbytes = sendto(state->sockfd, (void *)state->spacket.data,
+                    4 + (SEND_TYPE_ARG3)state->sbytes, SEND_4TH_ARG,
+                    (struct sockaddr *)&state->remote_addr,
+                    state->remote_addrlen);
+    /* Check all sbytes were sent */
+    if(sbytes < 0) {
+      failf(data, "%s", curlx_strerror(SOCKERRNO, buffer, sizeof(buffer)));
+      return CURLE_SEND_ERROR;
+    }
+    /* Update the progress meter */
+    k->writebytecount += state->sbytes;
+    Curl_pgrs_upload_inc(data, state->sbytes);
+    break;
+
+  case TFTP_EVENT_TIMEOUT:
+    /* Increment the retry counter and log the timeout */
+    state->retries++;
+    infof(data, "Timeout waiting for block %d ACK. "
+          "Retries = %d", NEXT_BLOCKNUM(state->block), state->retries);
+    /* Decide if we have had enough */
+    if(state->retries > state->retry_max) {
+      state->error = TFTP_ERR_TIMEOUT;
+      state->state = TFTP_STATE_FIN;
+    }
+    else {
+      /* Re-send the data packet */
+      sbytes = sendto(state->sockfd, (void *)state->spacket.data,
+                      4 + (SEND_TYPE_ARG3)state->sbytes, SEND_4TH_ARG,
+                      (struct sockaddr *)&state->remote_addr,
+                      state->remote_addrlen);
+      /* Check all sbytes were sent */
+      if(sbytes < 0) {
+        failf(data, "%s", curlx_strerror(SOCKERRNO, buffer, sizeof(buffer)));
+        return CURLE_SEND_ERROR;
+      }
+      /* since this was a re-send, we remain at the still byte position */
+      Curl_pgrsSetUploadCounter(data, k->writebytecount);
+    }
+    break;
+
+  case TFTP_EVENT_ERROR:
+    state->state = TFTP_STATE_FIN;
+    setpacketevent(&state->spacket, TFTP_EVENT_ERROR);
+    setpacketblock(&state->spacket, state->block);
+    (void)sendto(state->sockfd, (void *)state->spacket.data, 4, SEND_4TH_ARG,
+                 (struct sockaddr *)&state->remote_addr,
+                 state->remote_addrlen);
+    /* do not bother with the return code, but if the socket is still up we
+     * should be a good TFTP client and let the server know we are done */
+    state->state = TFTP_STATE_FIN;
+    break;
+
+  default:
+    failf(data, "tftp_tx: internal error, event: %d", (int)event);
+    break;
+  }
+
+  return result;
+}
+
+static CURLcode tftp_connect_for_tx(struct tftp_conn *state,
                                     tftp_event_t event)
 {
   CURLcode result;
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-  struct Curl_easy *data = state->data;
 
-  infof(data, "%s", "Connected for transmit");
-#endif
+  infof(state->data, "%s", "Connected for transmit");
+
   state->state = TFTP_STATE_TX;
   result = tftp_set_timeouts(state);
   if(result)
@@ -409,15 +512,135 @@ static CURLcode tftp_connect_for_tx(struct tftp_state_data *state,
   return tftp_tx(state, event);
 }
 
-static CURLcode tftp_connect_for_rx(struct tftp_state_data *state,
+/**********************************************************
+ *
+ * tftp_rx
+ *
+ * Event handler for the RX state
+ *
+ **********************************************************/
+static CURLcode tftp_rx(struct tftp_conn *state, tftp_event_t event)
+{
+  ssize_t sbytes;
+  int rblock;
+  struct Curl_easy *data = state->data;
+  char buffer[STRERROR_LEN];
+
+  switch(event) {
+
+  case TFTP_EVENT_DATA:
+    /* Is this the block we expect? */
+    rblock = getrpacketblock(&state->rpacket);
+    if(NEXT_BLOCKNUM(state->block) == rblock) {
+      /* This is the expected block. Reset counters and ACK it. */
+      state->retries = 0;
+    }
+    else if(state->block == rblock) {
+      /* This is the last recently received block again. Log it and ACK it
+         again. */
+      infof(data, "Received last DATA packet block %d again.", rblock);
+    }
+    else {
+      /* totally unexpected, log it */
+      infof(data,
+            "Received unexpected DATA packet block %d, expecting block %d",
+            rblock, NEXT_BLOCKNUM(state->block));
+      break;
+    }
+
+    /* ACK this block. */
+    state->block = (unsigned short)rblock;
+    setpacketevent(&state->spacket, TFTP_EVENT_ACK);
+    setpacketblock(&state->spacket, state->block);
+    sbytes = sendto(state->sockfd, (void *)state->spacket.data,
+                    4, SEND_4TH_ARG,
+                    (struct sockaddr *)&state->remote_addr,
+                    state->remote_addrlen);
+    if(sbytes < 0) {
+      failf(data, "%s", curlx_strerror(SOCKERRNO, buffer, sizeof(buffer)));
+      return CURLE_SEND_ERROR;
+    }
+
+    /* Check if completed (That is, a less than full packet is received) */
+    if(state->rbytes < (ssize_t)state->blksize + 4) {
+      state->state = TFTP_STATE_FIN;
+    }
+    else {
+      state->state = TFTP_STATE_RX;
+    }
+    state->rx_time = time(NULL);
+    break;
+
+  case TFTP_EVENT_OACK:
+    /* ACK option acknowledgement so we can move on to data */
+    state->block = 0;
+    state->retries = 0;
+    setpacketevent(&state->spacket, TFTP_EVENT_ACK);
+    setpacketblock(&state->spacket, state->block);
+    sbytes = sendto(state->sockfd, (void *)state->spacket.data,
+                    4, SEND_4TH_ARG,
+                    (struct sockaddr *)&state->remote_addr,
+                    state->remote_addrlen);
+    if(sbytes < 0) {
+      failf(data, "%s", curlx_strerror(SOCKERRNO, buffer, sizeof(buffer)));
+      return CURLE_SEND_ERROR;
+    }
+
+    /* we are ready to RX data */
+    state->state = TFTP_STATE_RX;
+    state->rx_time = time(NULL);
+    break;
+
+  case TFTP_EVENT_TIMEOUT:
+    /* Increment the retry count and fail if over the limit */
+    state->retries++;
+    infof(data,
+          "Timeout waiting for block %d ACK. Retries = %d",
+          NEXT_BLOCKNUM(state->block), state->retries);
+    if(state->retries > state->retry_max) {
+      state->error = TFTP_ERR_TIMEOUT;
+      state->state = TFTP_STATE_FIN;
+    }
+    else {
+      /* Resend the previous ACK */
+      sbytes = sendto(state->sockfd, (void *)state->spacket.data,
+                      4, SEND_4TH_ARG,
+                      (struct sockaddr *)&state->remote_addr,
+                      state->remote_addrlen);
+      if(sbytes < 0) {
+        failf(data, "%s", curlx_strerror(SOCKERRNO, buffer, sizeof(buffer)));
+        return CURLE_SEND_ERROR;
+      }
+    }
+    break;
+
+  case TFTP_EVENT_ERROR:
+    setpacketevent(&state->spacket, TFTP_EVENT_ERROR);
+    setpacketblock(&state->spacket, state->block);
+    (void)sendto(state->sockfd, (void *)state->spacket.data,
+                 4, SEND_4TH_ARG,
+                 (struct sockaddr *)&state->remote_addr,
+                 state->remote_addrlen);
+    /* do not bother with the return code, but if the socket is still up we
+     * should be a good TFTP client and let the server know we are done */
+    state->state = TFTP_STATE_FIN;
+    break;
+
+  default:
+    failf(data, "%s", "tftp_rx: internal error");
+    return CURLE_TFTP_ILLEGAL; /* not really the perfect return code for
+                                  this */
+  }
+  return CURLE_OK;
+}
+
+static CURLcode tftp_connect_for_rx(struct tftp_conn *state,
                                     tftp_event_t event)
 {
   CURLcode result;
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-  struct Curl_easy *data = state->data;
 
-  infof(data, "%s", "Connected for receive");
-#endif
+  infof(state->data, "%s", "Connected for receive");
+
   state->state = TFTP_STATE_RX;
   result = tftp_set_timeouts(state);
   if(result)
@@ -425,7 +648,7 @@ static CURLcode tftp_connect_for_rx(struct tftp_state_data *state,
   return tftp_rx(state, event);
 }
 
-static CURLcode tftp_send_first(struct tftp_state_data *state,
+static CURLcode tftp_send_first(struct tftp_conn *state,
                                 tftp_event_t event)
 {
   size_t sbytes;
@@ -433,9 +656,10 @@ static CURLcode tftp_send_first(struct tftp_state_data *state,
   const char *mode = "octet";
   char *filename;
   struct Curl_easy *data = state->data;
+  const struct Curl_sockaddr_ex *remote_addr = NULL;
   CURLcode result = CURLE_OK;
 
-  /* Set ascii mode if -B flag was used */
+  /* Set ASCII mode if -B flag was used */
   if(data->state.prefer_ascii)
     mode = "netascii";
 
@@ -445,17 +669,15 @@ static CURLcode tftp_send_first(struct tftp_state_data *state,
   case TFTP_EVENT_TIMEOUT: /* Resend the first packet out */
     /* Increment the retry counter, quit if over the limit */
     state->retries++;
-    if(state->retries>state->retry_max) {
+    if(state->retries > state->retry_max) {
       state->error = TFTP_ERR_NORESPONSE;
       state->state = TFTP_STATE_FIN;
       return result;
     }
 
     if(data->state.upload) {
-      /* If we are uploading, send an WRQ */
+      /* If we are uploading, send a WRQ */
       setpacketevent(&state->spacket, TFTP_EVENT_WRQ);
-      state->data->req.upload_fromhere =
-        (char *)state->spacket.data + 4;
       if(data->state.infilesize != -1)
         Curl_pgrsSetUploadSize(data, data->state.infilesize);
     }
@@ -464,79 +686,81 @@ static CURLcode tftp_send_first(struct tftp_state_data *state,
       setpacketevent(&state->spacket, TFTP_EVENT_RRQ);
     }
     /* As RFC3617 describes the separator slash is not actually part of the
-       file name so we skip the always-present first letter of the path
+       filename so we skip the always-present first letter of the path
        string. */
+    if(!state->data->state.up.path[1]) {
+      failf(data, "Missing filename");
+      return CURLE_TFTP_ILLEGAL;
+    }
     result = Curl_urldecode(&state->data->state.up.path[1], 0,
                             &filename, NULL, REJECT_ZERO);
     if(result)
       return result;
 
-    if(strlen(filename) > (state->blksize - strlen(mode) - 4)) {
-      failf(data, "TFTP file name too long");
-      free(filename);
-      return CURLE_TFTP_ILLEGAL; /* too long file name field */
+    if(strlen(filename) + strlen(mode) + 4 > state->blksize) {
+      failf(data, "TFTP filename too long");
+      curlx_free(filename);
+      return CURLE_TFTP_ILLEGAL; /* too long filename field */
     }
 
-    msnprintf((char *)state->spacket.data + 2,
-              state->blksize,
-              "%s%c%s%c", filename, '\0',  mode, '\0');
-    sbytes = 4 + strlen(filename) + strlen(mode);
+    sbytes = 2 +
+      curl_msnprintf((char *)state->spacket.data + 2,
+                     state->blksize,
+                     "%s%c%s%c", filename, '\0', mode, '\0');
+    curlx_free(filename);
 
     /* optional addition of TFTP options */
     if(!data->set.tftp_no_options) {
       char buf[64];
       /* add tsize option */
-      if(data->state.upload && (data->state.infilesize != -1))
-        msnprintf(buf, sizeof(buf), "%" CURL_FORMAT_CURL_OFF_T,
-                  data->state.infilesize);
-      else
-        strcpy(buf, "0"); /* the destination is large enough */
+      curl_msnprintf(buf, sizeof(buf), "%" FMT_OFF_T,
+                     data->state.upload && (data->state.infilesize != -1) ?
+                     data->state.infilesize : 0);
 
-      result = tftp_option_add(state, &sbytes,
-                               (char *)state->spacket.data + sbytes,
-                               TFTP_OPTION_TSIZE);
+      result = tftp_option_add(state, &sbytes, sbytes, TFTP_OPTION_TSIZE);
       if(result == CURLE_OK)
-        result = tftp_option_add(state, &sbytes,
-                                 (char *)state->spacket.data + sbytes, buf);
+        result = tftp_option_add(state, &sbytes, sbytes, buf);
 
       /* add blksize option */
-      msnprintf(buf, sizeof(buf), "%d", state->requested_blksize);
+      curl_msnprintf(buf, sizeof(buf), "%u", state->requested_blksize);
       if(result == CURLE_OK)
-        result = tftp_option_add(state, &sbytes,
-                                 (char *)state->spacket.data + sbytes,
-                                 TFTP_OPTION_BLKSIZE);
+        result = tftp_option_add(state, &sbytes, sbytes, TFTP_OPTION_BLKSIZE);
       if(result == CURLE_OK)
-        result = tftp_option_add(state, &sbytes,
-                                 (char *)state->spacket.data + sbytes, buf);
+        result = tftp_option_add(state, &sbytes, sbytes, buf);
 
       /* add timeout option */
-      msnprintf(buf, sizeof(buf), "%d", state->retry_time);
+      curl_msnprintf(buf, sizeof(buf), "%d", state->retry_time);
       if(result == CURLE_OK)
-        result = tftp_option_add(state, &sbytes,
-                                 (char *)state->spacket.data + sbytes,
-                                 TFTP_OPTION_INTERVAL);
+        result = tftp_option_add(state, &sbytes, sbytes, TFTP_OPTION_INTERVAL);
       if(result == CURLE_OK)
-        result = tftp_option_add(state, &sbytes,
-                                 (char *)state->spacket.data + sbytes, buf);
+        result = tftp_option_add(state, &sbytes, sbytes, buf);
 
       if(result != CURLE_OK) {
         failf(data, "TFTP buffer too small for options");
-        free(filename);
         return CURLE_TFTP_ILLEGAL;
       }
     }
 
-    /* the typecase for the 3rd argument is mostly for systems that do
+    /* the typecast for the 3rd argument is mostly for systems that do
        not have a size_t argument, like older unixes that want an 'int' */
+#ifdef __AMIGA__
+#define CURL_SENDTO_ARG5(x) CURL_UNCONST(x)
+#else
+#define CURL_SENDTO_ARG5(x) (x)
+#endif
+    remote_addr = Curl_conn_get_remote_addr(data, FIRSTSOCKET);
+    if(!remote_addr)
+      return CURLE_FAILED_INIT;
+
     senddata = sendto(state->sockfd, (void *)state->spacket.data,
                       (SEND_TYPE_ARG3)sbytes, 0,
-                      &data->conn->remote_addr->sa_addr,
-                      data->conn->remote_addr->addrlen);
+                      CURL_SENDTO_ARG5(&remote_addr->curl_sa_addr),
+                      (curl_socklen_t)remote_addr->addrlen);
     if(senddata != (ssize_t)sbytes) {
       char buffer[STRERROR_LEN];
-      failf(data, "%s", Curl_strerror(SOCKERRNO, buffer, sizeof(buffer)));
+      failf(data, "%s", curlx_strerror(SOCKERRNO, buffer, sizeof(buffer)));
+      return CURLE_SEND_ERROR;
     }
-    free(filename);
     break;
 
   case TFTP_EVENT_OACK:
@@ -562,281 +786,7 @@ static CURLcode tftp_send_first(struct tftp_state_data *state,
 
   default:
     failf(state->data, "tftp_send_first: internal error");
-    break;
-  }
-
-  return result;
-}
-
-/* the next blocknum is x + 1 but it needs to wrap at an unsigned 16bit
-   boundary */
-#define NEXT_BLOCKNUM(x) (((x) + 1)&0xffff)
-
-/**********************************************************
- *
- * tftp_rx
- *
- * Event handler for the RX state
- *
- **********************************************************/
-static CURLcode tftp_rx(struct tftp_state_data *state,
-                        tftp_event_t event)
-{
-  ssize_t sbytes;
-  int rblock;
-  struct Curl_easy *data = state->data;
-  char buffer[STRERROR_LEN];
-
-  switch(event) {
-
-  case TFTP_EVENT_DATA:
-    /* Is this the block we expect? */
-    rblock = getrpacketblock(&state->rpacket);
-    if(NEXT_BLOCKNUM(state->block) == rblock) {
-      /* This is the expected block.  Reset counters and ACK it. */
-      state->retries = 0;
-    }
-    else if(state->block == rblock) {
-      /* This is the last recently received block again. Log it and ACK it
-         again. */
-      infof(data, "Received last DATA packet block %d again.", rblock);
-    }
-    else {
-      /* totally unexpected, just log it */
-      infof(data,
-            "Received unexpected DATA packet block %d, expecting block %d",
-            rblock, NEXT_BLOCKNUM(state->block));
-      break;
-    }
-
-    /* ACK this block. */
-    state->block = (unsigned short)rblock;
-    setpacketevent(&state->spacket, TFTP_EVENT_ACK);
-    setpacketblock(&state->spacket, state->block);
-    sbytes = sendto(state->sockfd, (void *)state->spacket.data,
-                    4, SEND_4TH_ARG,
-                    (struct sockaddr *)&state->remote_addr,
-                    state->remote_addrlen);
-    if(sbytes < 0) {
-      failf(data, "%s", Curl_strerror(SOCKERRNO, buffer, sizeof(buffer)));
-      return CURLE_SEND_ERROR;
-    }
-
-    /* Check if completed (That is, a less than full packet is received) */
-    if(state->rbytes < (ssize_t)state->blksize + 4) {
-      state->state = TFTP_STATE_FIN;
-    }
-    else {
-      state->state = TFTP_STATE_RX;
-    }
-    time(&state->rx_time);
-    break;
-
-  case TFTP_EVENT_OACK:
-    /* ACK option acknowledgement so we can move on to data */
-    state->block = 0;
-    state->retries = 0;
-    setpacketevent(&state->spacket, TFTP_EVENT_ACK);
-    setpacketblock(&state->spacket, state->block);
-    sbytes = sendto(state->sockfd, (void *)state->spacket.data,
-                    4, SEND_4TH_ARG,
-                    (struct sockaddr *)&state->remote_addr,
-                    state->remote_addrlen);
-    if(sbytes < 0) {
-      failf(data, "%s", Curl_strerror(SOCKERRNO, buffer, sizeof(buffer)));
-      return CURLE_SEND_ERROR;
-    }
-
-    /* we're ready to RX data */
-    state->state = TFTP_STATE_RX;
-    time(&state->rx_time);
-    break;
-
-  case TFTP_EVENT_TIMEOUT:
-    /* Increment the retry count and fail if over the limit */
-    state->retries++;
-    infof(data,
-          "Timeout waiting for block %d ACK.  Retries = %d",
-          NEXT_BLOCKNUM(state->block), state->retries);
-    if(state->retries > state->retry_max) {
-      state->error = TFTP_ERR_TIMEOUT;
-      state->state = TFTP_STATE_FIN;
-    }
-    else {
-      /* Resend the previous ACK */
-      sbytes = sendto(state->sockfd, (void *)state->spacket.data,
-                      4, SEND_4TH_ARG,
-                      (struct sockaddr *)&state->remote_addr,
-                      state->remote_addrlen);
-      if(sbytes<0) {
-        failf(data, "%s", Curl_strerror(SOCKERRNO, buffer, sizeof(buffer)));
-        return CURLE_SEND_ERROR;
-      }
-    }
-    break;
-
-  case TFTP_EVENT_ERROR:
-    setpacketevent(&state->spacket, TFTP_EVENT_ERROR);
-    setpacketblock(&state->spacket, state->block);
-    (void)sendto(state->sockfd, (void *)state->spacket.data,
-                 4, SEND_4TH_ARG,
-                 (struct sockaddr *)&state->remote_addr,
-                 state->remote_addrlen);
-    /* don't bother with the return code, but if the socket is still up we
-     * should be a good TFTP client and let the server know we're done */
-    state->state = TFTP_STATE_FIN;
-    break;
-
-  default:
-    failf(data, "%s", "tftp_rx: internal error");
-    return CURLE_TFTP_ILLEGAL; /* not really the perfect return code for
-                                  this */
-  }
-  return CURLE_OK;
-}
-
-/**********************************************************
- *
- * tftp_tx
- *
- * Event handler for the TX state
- *
- **********************************************************/
-static CURLcode tftp_tx(struct tftp_state_data *state, tftp_event_t event)
-{
-  struct Curl_easy *data = state->data;
-  ssize_t sbytes;
-  CURLcode result = CURLE_OK;
-  struct SingleRequest *k = &data->req;
-  size_t cb; /* Bytes currently read */
-  char buffer[STRERROR_LEN];
-
-  switch(event) {
-
-  case TFTP_EVENT_ACK:
-  case TFTP_EVENT_OACK:
-    if(event == TFTP_EVENT_ACK) {
-      /* Ack the packet */
-      int rblock = getrpacketblock(&state->rpacket);
-
-      if(rblock != state->block &&
-         /* There's a bug in tftpd-hpa that causes it to send us an ack for
-          * 65535 when the block number wraps to 0. So when we're expecting
-          * 0, also accept 65535. See
-          * https://www.syslinux.org/archives/2010-September/015612.html
-          * */
-         !(state->block == 0 && rblock == 65535)) {
-        /* This isn't the expected block.  Log it and up the retry counter */
-        infof(data, "Received ACK for block %d, expecting %d",
-              rblock, state->block);
-        state->retries++;
-        /* Bail out if over the maximum */
-        if(state->retries>state->retry_max) {
-          failf(data, "tftp_tx: giving up waiting for block %d ack",
-                state->block);
-          result = CURLE_SEND_ERROR;
-        }
-        else {
-          /* Re-send the data packet */
-          sbytes = sendto(state->sockfd, (void *)state->spacket.data,
-                          4 + state->sbytes, SEND_4TH_ARG,
-                          (struct sockaddr *)&state->remote_addr,
-                          state->remote_addrlen);
-          /* Check all sbytes were sent */
-          if(sbytes<0) {
-            failf(data, "%s", Curl_strerror(SOCKERRNO,
-                                            buffer, sizeof(buffer)));
-            result = CURLE_SEND_ERROR;
-          }
-        }
-
-        return result;
-      }
-      /* This is the expected packet.  Reset the counters and send the next
-         block */
-      time(&state->rx_time);
-      state->block++;
-    }
-    else
-      state->block = 1; /* first data block is 1 when using OACK */
-
-    state->retries = 0;
-    setpacketevent(&state->spacket, TFTP_EVENT_DATA);
-    setpacketblock(&state->spacket, state->block);
-    if(state->block > 1 && state->sbytes < state->blksize) {
-      state->state = TFTP_STATE_FIN;
-      return CURLE_OK;
-    }
-
-    /* TFTP considers data block size < 512 bytes as an end of session. So
-     * in some cases we must wait for additional data to build full (512 bytes)
-     * data block.
-     * */
-    state->sbytes = 0;
-    state->data->req.upload_fromhere = (char *)state->spacket.data + 4;
-    do {
-      result = Curl_fillreadbuffer(data, state->blksize - state->sbytes, &cb);
-      if(result)
-        return result;
-      state->sbytes += (int)cb;
-      state->data->req.upload_fromhere += cb;
-    } while(state->sbytes < state->blksize && cb);
-
-    sbytes = sendto(state->sockfd, (void *) state->spacket.data,
-                    4 + state->sbytes, SEND_4TH_ARG,
-                    (struct sockaddr *)&state->remote_addr,
-                    state->remote_addrlen);
-    /* Check all sbytes were sent */
-    if(sbytes<0) {
-      failf(data, "%s", Curl_strerror(SOCKERRNO, buffer, sizeof(buffer)));
-      return CURLE_SEND_ERROR;
-    }
-    /* Update the progress meter */
-    k->writebytecount += state->sbytes;
-    Curl_pgrsSetUploadCounter(data, k->writebytecount);
-    break;
-
-  case TFTP_EVENT_TIMEOUT:
-    /* Increment the retry counter and log the timeout */
-    state->retries++;
-    infof(data, "Timeout waiting for block %d ACK. "
-          " Retries = %d", NEXT_BLOCKNUM(state->block), state->retries);
-    /* Decide if we've had enough */
-    if(state->retries > state->retry_max) {
-      state->error = TFTP_ERR_TIMEOUT;
-      state->state = TFTP_STATE_FIN;
-    }
-    else {
-      /* Re-send the data packet */
-      sbytes = sendto(state->sockfd, (void *)state->spacket.data,
-                      4 + state->sbytes, SEND_4TH_ARG,
-                      (struct sockaddr *)&state->remote_addr,
-                      state->remote_addrlen);
-      /* Check all sbytes were sent */
-      if(sbytes<0) {
-        failf(data, "%s", Curl_strerror(SOCKERRNO, buffer, sizeof(buffer)));
-        return CURLE_SEND_ERROR;
-      }
-      /* since this was a re-send, we remain at the still byte position */
-      Curl_pgrsSetUploadCounter(data, k->writebytecount);
-    }
-    break;
-
-  case TFTP_EVENT_ERROR:
-    state->state = TFTP_STATE_FIN;
-    setpacketevent(&state->spacket, TFTP_EVENT_ERROR);
-    setpacketblock(&state->spacket, state->block);
-    (void)sendto(state->sockfd, (void *)state->spacket.data, 4, SEND_4TH_ARG,
-                 (struct sockaddr *)&state->remote_addr,
-                 state->remote_addrlen);
-    /* don't bother with the return code, but if the socket is still up we
-     * should be a good TFTP client and let the server know we're done */
-    state->state = TFTP_STATE_FIN;
-    break;
-
-  default:
-    failf(data, "tftp_tx: internal error, event: %i", (int)(event));
-    break;
+    return CURLE_TFTP_ILLEGAL;
   }
 
   return result;
@@ -901,7 +851,7 @@ static CURLcode tftp_translate_code(tftp_error_t error)
  * The tftp state machine event dispatcher
  *
  **********************************************************/
-static CURLcode tftp_state_machine(struct tftp_state_data *state,
+static CURLcode tftp_state_machine(struct tftp_conn *state,
                                    tftp_event_t event)
 {
   CURLcode result = CURLE_OK;
@@ -924,7 +874,7 @@ static CURLcode tftp_state_machine(struct tftp_state_data *state,
     infof(data, "%s", "TFTP finished");
     break;
   default:
-    DEBUGF(infof(data, "STATE: %d", state->state));
+    DEBUGF(infof(data, "STATE: %d", (int)state->state));
     failf(data, "%s", "Internal state machine error");
     result = CURLE_TFTP_ILLEGAL;
     break;
@@ -933,28 +883,14 @@ static CURLcode tftp_state_machine(struct tftp_state_data *state,
   return result;
 }
 
-/**********************************************************
- *
- * tftp_disconnect
- *
- * The disconnect callback
- *
- **********************************************************/
-static CURLcode tftp_disconnect(struct Curl_easy *data,
-                                struct connectdata *conn, bool dead_connection)
+static void tftp_conn_dtor(void *key, size_t klen, void *entry)
 {
-  struct tftp_state_data *state = conn->proto.tftpc;
-  (void) data;
-  (void) dead_connection;
-
-  /* done, free dynamically allocated pkt buffers */
-  if(state) {
-    Curl_safefree(state->rpacket.data);
-    Curl_safefree(state->spacket.data);
-    free(state);
-  }
-
-  return CURLE_OK;
+  struct tftp_conn *state = entry;
+  (void)key;
+  (void)klen;
+  curlx_safefree(state->rpacket.data);
+  curlx_safefree(state->spacket.data);
+  curlx_free(state);
 }
 
 /**********************************************************
@@ -966,23 +902,24 @@ static CURLcode tftp_disconnect(struct Curl_easy *data,
  **********************************************************/
 static CURLcode tftp_connect(struct Curl_easy *data, bool *done)
 {
-  struct tftp_state_data *state;
+  struct tftp_conn *state;
   int blksize;
   int need_blksize;
   struct connectdata *conn = data->conn;
+  const struct Curl_sockaddr_ex *remote_addr = NULL;
+  CURLcode result;
 
   blksize = TFTP_BLKSIZE_DEFAULT;
 
-  state = conn->proto.tftpc = calloc(1, sizeof(struct tftp_state_data));
-  if(!state)
+  state = curlx_calloc(1, sizeof(*state));
+  if(!state ||
+     Curl_conn_meta_set(conn, CURL_META_TFTP_CONN, state, tftp_conn_dtor))
     return CURLE_OUT_OF_MEMORY;
 
   /* alloc pkt buffers based on specified blksize */
-  if(data->set.tftp_blksize) {
+  if(data->set.tftp_blksize)
+    /* range checked when set */
     blksize = (int)data->set.tftp_blksize;
-    if(blksize > TFTP_BLKSIZE_MAX || blksize < TFTP_BLKSIZE_MIN)
-      return CURLE_TFTP_ILLEGAL;
-  }
 
   need_blksize = blksize;
   /* default size is the fallback when no OACK is received */
@@ -990,21 +927,21 @@ static CURLcode tftp_connect(struct Curl_easy *data, bool *done)
     need_blksize = TFTP_BLKSIZE_DEFAULT;
 
   if(!state->rpacket.data) {
-    state->rpacket.data = calloc(1, need_blksize + 2 + 2);
+    state->rpacket.data = curlx_calloc(1, need_blksize + 2 + 2);
 
     if(!state->rpacket.data)
       return CURLE_OUT_OF_MEMORY;
   }
 
   if(!state->spacket.data) {
-    state->spacket.data = calloc(1, need_blksize + 2 + 2);
+    state->spacket.data = curlx_calloc(1, need_blksize + 2 + 2);
 
     if(!state->spacket.data)
       return CURLE_OUT_OF_MEMORY;
   }
 
-  /* we don't keep TFTP connections up basically because there's none or very
-   * little gain for UDP */
+  /* we do not keep TFTP connections up because there is none or little gain
+   * for UDP */
   connclose(conn, "TFTP");
 
   state->data = data;
@@ -1014,10 +951,17 @@ static CURLcode tftp_connect(struct Curl_easy *data, bool *done)
   state->blksize = TFTP_BLKSIZE_DEFAULT; /* Unless updated by OACK response */
   state->requested_blksize = blksize;
 
-  ((struct sockaddr *)&state->local_addr)->sa_family =
-    (CURL_SA_FAMILY_T)(conn->remote_addr->family);
+  remote_addr = Curl_conn_get_remote_addr(data, FIRSTSOCKET);
+  DEBUGASSERT(remote_addr);
+  if(!remote_addr)
+    return CURLE_FAILED_INIT;
 
-  tftp_set_timeouts(state);
+  ((struct sockaddr *)&state->local_addr)->sa_family =
+    (CURL_SA_FAMILY_T)(remote_addr->family);
+
+  result = tftp_set_timeouts(state);
+  if(result)
+    return result;
 
   if(!conn->bits.bound) {
     /* If not already bound, bind to any interface, random UDP port. If it is
@@ -1034,11 +978,11 @@ static CURLcode tftp_connect(struct Curl_easy *data, bool *done)
      * IPv4 and IPv6...
      */
     int rc = bind(state->sockfd, (struct sockaddr *)&state->local_addr,
-                  conn->remote_addr->addrlen);
+                  (curl_socklen_t)remote_addr->addrlen);
     if(rc) {
       char buffer[STRERROR_LEN];
       failf(data, "bind() failed; %s",
-            Curl_strerror(SOCKERRNO, buffer, sizeof(buffer)));
+            curlx_strerror(SOCKERRNO, buffer, sizeof(buffer)));
       return CURLE_COULDNT_CONNECT;
     }
     conn->bits.bound = TRUE;
@@ -1063,10 +1007,10 @@ static CURLcode tftp_done(struct Curl_easy *data, CURLcode status,
 {
   CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
-  struct tftp_state_data *state = conn->proto.tftpc;
+  struct tftp_conn *state = Curl_conn_meta_get(conn, CURL_META_TFTP_CONN);
 
-  (void)status; /* unused */
-  (void)premature; /* not used */
+  (void)status;
+  (void)premature;
 
   if(Curl_pgrsDone(data))
     return CURLE_ABORTED_BY_CALLBACK;
@@ -1078,19 +1022,10 @@ static CURLcode tftp_done(struct Curl_easy *data, CURLcode status,
   return result;
 }
 
-/**********************************************************
- *
- * tftp_getsock
- *
- * The getsock callback
- *
- **********************************************************/
-static int tftp_getsock(struct Curl_easy *data,
-                        struct connectdata *conn, curl_socket_t *socks)
+static CURLcode tftp_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps)
 {
-  (void)data;
-  socks[0] = conn->sock[FIRSTSOCKET];
-  return GETSOCK_READSOCK(0);
+  return Curl_pollset_add_in(data, ps, data->conn->sock[FIRSTSOCKET]);
 }
 
 /**********************************************************
@@ -1100,26 +1035,35 @@ static int tftp_getsock(struct Curl_easy *data,
  * Called once select fires and data is ready on the socket
  *
  **********************************************************/
-static CURLcode tftp_receive_packet(struct Curl_easy *data)
+static CURLcode tftp_receive_packet(struct Curl_easy *data,
+                                    struct tftp_conn *state)
 {
-  struct Curl_sockaddr_storage fromaddr;
-  curl_socklen_t        fromlen;
-  CURLcode              result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct tftp_state_data *state = conn->proto.tftpc;
-  struct SingleRequest  *k = &data->req;
+  CURLcode result = CURLE_OK;
+  struct Curl_sockaddr_storage remote_addr;
+  curl_socklen_t fromlen = sizeof(remote_addr);
 
   /* Receive the packet */
-  fromlen = sizeof(fromaddr);
   state->rbytes = (int)recvfrom(state->sockfd,
                                 (void *)state->rpacket.data,
-                                state->blksize + 4,
+                                (RECV_TYPE_ARG3)state->blksize + 4,
                                 0,
-                                (struct sockaddr *)&fromaddr,
+                                (struct sockaddr *)&remote_addr,
                                 &fromlen);
-  if(state->remote_addrlen == 0) {
-    memcpy(&state->remote_addr, &fromaddr, fromlen);
-    state->remote_addrlen = fromlen;
+  if((state->rbytes >= 0) && fromlen) {
+    if(state->remote_pinned) {
+      /* pinned, verify that it comes from the same address */
+      if((state->remote_addrlen != fromlen) ||
+         memcmp(&remote_addr, &state->remote_addr, fromlen)) {
+        failf(data, "Data received from another address");
+        return CURLE_RECV_ERROR;
+      }
+    }
+    else {
+      /* pin address on first use */
+      state->remote_pinned = TRUE;
+      state->remote_addrlen = fromlen;
+      memcpy(&state->remote_addr, &remote_addr, fromlen);
+    }
   }
 
   /* Sanity check packet length */
@@ -1135,24 +1079,21 @@ static CURLcode tftp_receive_packet(struct Curl_easy *data)
 
     switch(state->event) {
     case TFTP_EVENT_DATA:
-      /* Don't pass to the client empty or retransmitted packets */
+      /* Do not pass to the client empty or retransmitted packets */
       if(state->rbytes > 4 &&
          (NEXT_BLOCKNUM(state->block) == getrpacketblock(&state->rpacket))) {
         result = Curl_client_write(data, CLIENTWRITE_BODY,
-                                   (char *)state->rpacket.data + 4,
-                                   state->rbytes-4);
+                                   (const char *)state->rpacket.data + 4,
+                                   state->rbytes - 4);
         if(result) {
           tftp_state_machine(state, TFTP_EVENT_ERROR);
           return result;
         }
-        k->bytecount += state->rbytes-4;
-        Curl_pgrsSetDownloadCounter(data, (curl_off_t) k->bytecount);
       }
       break;
-    case TFTP_EVENT_ERROR:
-    {
+    case TFTP_EVENT_ERROR: {
       unsigned short error = getrpacketblock(&state->rpacket);
-      char *str = (char *)state->rpacket.data + 4;
+      const char *str = (const char *)state->rpacket.data + 4;
       size_t strn = state->rbytes - 4;
       state->error = (tftp_error_t)error;
       if(tftp_strnlen(str, strn) < strn)
@@ -1176,9 +1117,10 @@ static CURLcode tftp_receive_packet(struct Curl_easy *data)
     }
 
     /* Update the progress meter */
-    if(Curl_pgrsUpdate(data)) {
+    result = Curl_pgrsUpdate(data);
+    if(result) {
       tftp_state_machine(state, TFTP_EVENT_ERROR);
-      return CURLE_ABORTED_BY_CALLBACK;
+      return result;
     }
   }
   return result;
@@ -1191,29 +1133,26 @@ static CURLcode tftp_receive_packet(struct Curl_easy *data)
  * Check if timeouts have been reached
  *
  **********************************************************/
-static timediff_t tftp_state_timeout(struct Curl_easy *data,
+static timediff_t tftp_state_timeout(struct tftp_conn *state,
                                      tftp_event_t *event)
 {
   time_t current;
-  struct connectdata *conn = data->conn;
-  struct tftp_state_data *state = conn->proto.tftpc;
   timediff_t timeout_ms;
 
   if(event)
     *event = TFTP_EVENT_NONE;
 
-  timeout_ms = Curl_timeleft(state->data, NULL,
-                             (state->state == TFTP_STATE_START));
+  timeout_ms = Curl_timeleft_ms(state->data);
   if(timeout_ms < 0) {
     state->error = TFTP_ERR_TIMEOUT;
     state->state = TFTP_STATE_FIN;
-    return 0;
+    return timeout_ms;
   }
-  time(&current);
+  current = time(NULL);
   if(current > state->rx_time + state->retry_time) {
     if(event)
       *event = TFTP_EVENT_TIMEOUT;
-    time(&state->rx_time); /* update even though we received nothing */
+    state->rx_time = time(NULL); /* update even though we received nothing */
   }
 
   return timeout_ms;
@@ -1231,11 +1170,14 @@ static CURLcode tftp_multi_statemach(struct Curl_easy *data, bool *done)
   tftp_event_t event;
   CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
-  struct tftp_state_data *state = conn->proto.tftpc;
-  timediff_t timeout_ms = tftp_state_timeout(data, &event);
+  struct tftp_conn *state = Curl_conn_meta_get(conn, CURL_META_TFTP_CONN);
+  timediff_t timeout_ms;
 
   *done = FALSE;
+  if(!state)
+    return CURLE_FAILED_INIT;
 
+  timeout_ms = tftp_state_timeout(state, &event);
   if(timeout_ms < 0) {
     failf(data, "TFTP response timeout");
     return CURLE_OPERATION_TIMEDOUT;
@@ -1244,10 +1186,10 @@ static CURLcode tftp_multi_statemach(struct Curl_easy *data, bool *done)
     result = tftp_state_machine(state, event);
     if(result)
       return result;
-    *done = (state->state == TFTP_STATE_FIN) ? TRUE : FALSE;
+    *done = (state->state == TFTP_STATE_FIN);
     if(*done)
-      /* Tell curl we're done */
-      Curl_setup_transfer(data, -1, -1, FALSE, -1);
+      /* Tell curl we are done */
+      Curl_xfer_setup_nop(data);
   }
   else {
     /* no timeouts to handle, check our socket */
@@ -1255,22 +1197,22 @@ static CURLcode tftp_multi_statemach(struct Curl_easy *data, bool *done)
 
     if(rc == -1) {
       /* bail out */
-      int error = SOCKERRNO;
+      int sockerr = SOCKERRNO;
       char buffer[STRERROR_LEN];
-      failf(data, "%s", Curl_strerror(error, buffer, sizeof(buffer)));
+      failf(data, "%s", curlx_strerror(sockerr, buffer, sizeof(buffer)));
       state->event = TFTP_EVENT_ERROR;
     }
     else if(rc) {
-      result = tftp_receive_packet(data);
+      result = tftp_receive_packet(data, state);
       if(result)
         return result;
       result = tftp_state_machine(state, state->event);
       if(result)
         return result;
-      *done = (state->state == TFTP_STATE_FIN) ? TRUE : FALSE;
+      *done = (state->state == TFTP_STATE_FIN);
       if(*done)
-        /* Tell curl we're done */
-        Curl_setup_transfer(data, -1, -1, FALSE, -1);
+        /* Tell curl we are done */
+        Curl_xfer_setup_nop(data);
     }
     /* if rc == 0, then select() timed out */
   }
@@ -1294,13 +1236,10 @@ static CURLcode tftp_doing(struct Curl_easy *data, bool *dophase_done)
     DEBUGF(infof(data, "DO phase is complete"));
   }
   else if(!result) {
-    /* The multi code doesn't have this logic for the DOING state so we
+    /* The multi code does not have this logic for the DOING state so we
        provide it for TFTP since it may do the entire transfer in this
        state. */
-    if(Curl_pgrsUpdate(data))
-      result = CURLE_ABORTED_BY_CALLBACK;
-    else
-      result = Curl_speedcheck(data, Curl_now());
+    result = Curl_pgrsCheck(data);
   }
   return result;
 }
@@ -1316,16 +1255,18 @@ static CURLcode tftp_perform(struct Curl_easy *data, bool *dophase_done)
 {
   CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
-  struct tftp_state_data *state = conn->proto.tftpc;
+  struct tftp_conn *state = Curl_conn_meta_get(conn, CURL_META_TFTP_CONN);
 
   *dophase_done = FALSE;
+  if(!state)
+    return CURLE_FAILED_INIT;
 
   result = tftp_state_machine(state, TFTP_EVENT_INIT);
 
   if((state->state == TFTP_STATE_FIN) || result)
     return result;
 
-  tftp_multi_statemach(data, dophase_done);
+  result = tftp_multi_statemach(data, dophase_done);
 
   if(*dophase_done)
     DEBUGF(infof(data, "DO phase is complete"));
@@ -1333,7 +1274,6 @@ static CURLcode tftp_perform(struct Curl_easy *data, bool *dophase_done)
   return result;
 }
 
-
 /**********************************************************
  *
  * tftp_do
@@ -1346,21 +1286,21 @@ static CURLcode tftp_perform(struct Curl_easy *data, bool *dophase_done)
 
 static CURLcode tftp_do(struct Curl_easy *data, bool *done)
 {
-  struct tftp_state_data *state;
-  CURLcode result;
   struct connectdata *conn = data->conn;
+  struct tftp_conn *state = Curl_conn_meta_get(conn, CURL_META_TFTP_CONN);
+  CURLcode result;
 
   *done = FALSE;
 
-  if(!conn->proto.tftpc) {
+  if(!state) {
     result = tftp_connect(data, done);
     if(result)
       return result;
-  }
 
-  state = conn->proto.tftpc;
-  if(!state)
-    return CURLE_TFTP_ILLEGAL;
+    state = Curl_conn_meta_get(conn, CURL_META_TFTP_CONN);
+    if(!state)
+      return CURLE_TFTP_ILLEGAL;
+  }
 
   result = tftp_perform(data, done);
 
@@ -1376,37 +1316,45 @@ static CURLcode tftp_do(struct Curl_easy *data, bool *done)
 static CURLcode tftp_setup_connection(struct Curl_easy *data,
                                       struct connectdata *conn)
 {
-  char *type;
+  char *path = data->state.up.path;
+  size_t len = strlen(path);
 
-  conn->transport = TRNSPRT_UDP;
+  conn->transport_wanted = TRNSPRT_UDP;
 
-  /* TFTP URLs support an extension like ";mode=<typecode>" that
-   * we'll try to get now! */
-  type = strstr(data->state.up.path, ";mode=");
-
-  if(!type)
-    type = strstr(conn->host.rawalloc, ";mode=");
-
-  if(type) {
-    char command;
-    *type = 0;                   /* it was in the middle of the hostname */
-    command = Curl_raw_toupper(type[6]);
-
-    switch(command) {
-    case 'A': /* ASCII mode */
-    case 'N': /* NETASCII mode */
-      data->state.prefer_ascii = TRUE;
-      break;
-
-    case 'O': /* octet mode */
-    case 'I': /* binary mode */
-    default:
-      /* switch off ASCII */
-      data->state.prefer_ascii = FALSE;
-      break;
-    }
+  /* TFTP URLs support a trailing ";mode=netascii" or ";mode=octet" */
+  if((len >= 14) && !memcmp(&path[len - 14], ";mode=netascii", 14)) {
+    data->state.prefer_ascii = TRUE;
+    path[len - 14] = 0; /* cut it there */
+  }
+  else if((len >= 11) && !memcmp(&path[len - 11], ";mode=octet", 11)) {
+    data->state.prefer_ascii = FALSE;
+    path[len - 11] = 0; /* cut it there */
   }
 
   return CURLE_OK;
 }
+
+/*
+ * TFTP protocol handler.
+ */
+const struct Curl_protocol Curl_protocol_tftp = {
+  tftp_setup_connection,                /* setup_connection */
+  tftp_do,                              /* do_it */
+  tftp_done,                            /* done */
+  ZERO_NULL,                            /* do_more */
+  tftp_connect,                         /* connect_it */
+  tftp_multi_statemach,                 /* connecting */
+  tftp_doing,                           /* doing */
+  tftp_pollset,                         /* proto_pollset */
+  tftp_pollset,                         /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
+  ZERO_NULL,                            /* disconnect */
+  ZERO_NULL,                            /* write_resp */
+  ZERO_NULL,                            /* write_resp_hd */
+  ZERO_NULL,                            /* connection_is_dead */
+  ZERO_NULL,                            /* attach connection */
+  ZERO_NULL,                            /* follow */
+};
+
 #endif
diff --git a/third-party/curl/lib/tftp.h b/third-party/curl/lib/tftp.h
index 5d2d5da615..32310103b0 100644
--- a/third-party/curl/lib/tftp.h
+++ b/third-party/curl/lib/tftp.h
@@ -24,7 +24,10 @@
  *
  ***************************************************************************/
 #ifndef CURL_DISABLE_TFTP
-extern const struct Curl_handler Curl_handler_tftp;
+extern const struct Curl_protocol Curl_protocol_tftp;
 #endif
 
+#define TFTP_BLKSIZE_MIN 8
+#define TFTP_BLKSIZE_MAX 65464
+
 #endif /* HEADER_CURL_TFTP_H */
diff --git a/third-party/curl/lib/thrdpool.c b/third-party/curl/lib/thrdpool.c
new file mode 100644
index 0000000000..e8c7d36435
--- /dev/null
+++ b/third-party/curl/lib/thrdpool.c
@@ -0,0 +1,481 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef USE_THREADS
+
+#include "llist.h"
+#include "curl_threads.h"
+#include "curlx/timeval.h"
+#include "thrdpool.h"
+#ifdef CURLVERBOSE
+#include "curl_trc.h"
+#include "urldata.h"
+#endif
+
+
+struct thrdslot {
+  struct Curl_llist_node node;
+  struct curl_thrdpool *tpool;
+  curl_thread_t thread;
+  curl_cond_t await;
+  struct curltime starttime;
+  const char *work_description;
+  timediff_t work_timeout_ms;
+  uint32_t id;
+  BIT(running);
+  BIT(idle);
+};
+
+struct curl_thrdpool {
+  char *name;
+  uint64_t refcount;
+  curl_mutex_t lock;
+  curl_cond_t await;
+  struct Curl_llist slots;
+  struct Curl_llist zombies;
+  Curl_thrdpool_take_item_cb *fn_take;
+  Curl_thrdpool_process_item_cb *fn_process;
+  Curl_thrdpool_return_item_cb *fn_return;
+  void *fn_user_data;
+  CURLcode fatal_err;
+  uint32_t min_threads;
+  uint32_t max_threads;
+  uint32_t idle_time_ms;
+  uint32_t next_id;
+  BIT(aborted);
+  BIT(detached);
+};
+
+static void thrdpool_join_zombies(struct curl_thrdpool *tpool);
+static bool thrdpool_unlink(struct curl_thrdpool *tpool, bool locked);
+
+static void thrdslot_destroy(struct thrdslot *tslot)
+{
+  DEBUGASSERT(tslot->thread == curl_thread_t_null);
+  DEBUGASSERT(!tslot->running);
+  Curl_cond_destroy(&tslot->await);
+  curlx_free(tslot);
+}
+
+static void thrdslot_done(struct thrdslot *tslot)
+{
+  struct curl_thrdpool *tpool = tslot->tpool;
+
+  DEBUGASSERT(Curl_node_llist(&tslot->node) == &tpool->slots);
+  Curl_node_remove(&tslot->node);
+  tslot->running = FALSE;
+  Curl_llist_append(&tpool->zombies, tslot, &tslot->node);
+  Curl_cond_signal(&tpool->await);
+}
+
+static CURL_THREAD_RETURN_T CURL_STDCALL thrdslot_run(void *arg)
+{
+  struct thrdslot *tslot = arg;
+  struct curl_thrdpool *tpool = tslot->tpool;
+  void *item;
+
+  Curl_mutex_acquire(&tpool->lock);
+  DEBUGASSERT(Curl_node_llist(&tslot->node) == &tpool->slots);
+  for(;;) {
+    while(!tpool->aborted) {
+      tslot->work_description = NULL;
+      tslot->work_timeout_ms = 0;
+      item = tpool->fn_take(tpool->fn_user_data, &tslot->work_description,
+                            &tslot->work_timeout_ms);
+      if(!item)
+        break;
+      tslot->starttime = curlx_now();
+      tslot->idle = FALSE;
+      Curl_mutex_release(&tpool->lock);
+
+      tpool->fn_process(item);
+
+      Curl_mutex_acquire(&tpool->lock);
+      tslot->work_description = NULL;
+      tpool->fn_return(item, tpool->aborted ? NULL : tpool->fn_user_data);
+    }
+
+    if(tpool->aborted ||
+       (Curl_llist_count(&tpool->slots) > tpool->max_threads))
+      goto out;
+
+    tslot->idle = TRUE;
+    tslot->starttime = curlx_now();
+    thrdpool_join_zombies(tpool);
+    Curl_cond_signal(&tpool->await);
+    /* Only wait with idle timeout when we are above the minimum
+     * number of threads. Otherwise short idle timeouts will keep
+     * on activating threads that have no means to shut down. */
+    if((tpool->idle_time_ms > 0) &&
+       (Curl_llist_count(&tpool->slots) > tpool->min_threads)) {
+      CURLcode result = Curl_cond_timedwait(&tslot->await, &tpool->lock,
+                                            tpool->idle_time_ms);
+      if((result == CURLE_OPERATION_TIMEDOUT) &&
+         (Curl_llist_count(&tpool->slots) > tpool->min_threads)) {
+        goto out;
+      }
+    }
+    else {
+      Curl_cond_wait(&tslot->await, &tpool->lock);
+    }
+  }
+
+out:
+  thrdslot_done(tslot);
+  if(!thrdpool_unlink(tslot->tpool, TRUE)) {
+    /* tpool not destroyed */
+    Curl_mutex_release(&tpool->lock);
+  }
+  return 0;
+}
+
+static CURLcode thrdslot_start(struct curl_thrdpool *tpool)
+{
+  struct thrdslot *tslot;
+  CURLcode result = CURLE_OUT_OF_MEMORY;
+
+  tslot = curlx_calloc(1, sizeof(*tslot));
+  if(!tslot)
+    goto out;
+  tslot->id = tpool->next_id++;
+  tslot->tpool = tpool;
+  tslot->thread = curl_thread_t_null;
+  Curl_cond_init(&tslot->await);
+
+  tpool->refcount++;
+  tslot->running = TRUE;
+  tslot->thread = Curl_thread_create(thrdslot_run, tslot);
+  if(tslot->thread == curl_thread_t_null) { /* never started */
+    tslot->running = FALSE;
+    thrdpool_unlink(tpool, TRUE);
+    result = CURLE_FAILED_INIT;
+    goto out;
+  }
+
+  Curl_llist_append(&tpool->slots, tslot, &tslot->node);
+  tslot = NULL;
+  result = CURLE_OK;
+
+out:
+  if(tslot)
+    thrdslot_destroy(tslot);
+  return result;
+}
+
+static void thrdpool_wake_all(struct curl_thrdpool *tpool)
+{
+  struct Curl_llist_node *e;
+  for(e = Curl_llist_head(&tpool->slots); e; e = Curl_node_next(e)) {
+    struct thrdslot *tslot = Curl_node_elem(e);
+    Curl_cond_signal(&tslot->await);
+  }
+}
+
+static void thrdpool_join_zombies(struct curl_thrdpool *tpool)
+{
+  struct Curl_llist_node *e;
+
+  for(e = Curl_llist_head(&tpool->zombies); e;
+      e = Curl_llist_head(&tpool->zombies)) {
+    struct thrdslot *tslot = Curl_node_elem(e);
+
+    Curl_node_remove(&tslot->node);
+    if(tslot->thread != curl_thread_t_null) {
+      Curl_mutex_release(&tpool->lock);
+      Curl_thread_join(&tslot->thread);
+      Curl_mutex_acquire(&tpool->lock);
+      tslot->thread = curl_thread_t_null;
+    }
+    thrdslot_destroy(tslot);
+  }
+}
+
+static bool thrdpool_unlink(struct curl_thrdpool *tpool, bool locked)
+{
+  DEBUGASSERT(tpool->refcount);
+  if(tpool->refcount)
+    tpool->refcount--;
+  if(tpool->refcount)
+    return FALSE;
+
+  /* no more references, free */
+  DEBUGASSERT(tpool->aborted);
+  thrdpool_join_zombies(tpool);
+  if(locked)
+    Curl_mutex_release(&tpool->lock);
+  curlx_free(tpool->name);
+  Curl_cond_destroy(&tpool->await);
+  Curl_mutex_destroy(&tpool->lock);
+  curlx_free(tpool);
+  return TRUE;
+}
+
+static CURLcode thrdpool_signal(struct curl_thrdpool *tpool,
+                                uint32_t nthreads)
+{
+  struct Curl_llist_node *e, *n;
+  CURLcode result = CURLE_OK;
+
+  DEBUGASSERT(!tpool->aborted);
+  thrdpool_join_zombies(tpool);
+
+  for(e = Curl_llist_head(&tpool->slots); e && nthreads; e = n) {
+    struct thrdslot *tslot = Curl_node_elem(e);
+    n = Curl_node_next(e);
+    if(tslot->idle) {
+      Curl_cond_signal(&tslot->await);
+      --nthreads;
+    }
+    else if(!tslot->starttime.tv_sec && !tslot->starttime.tv_usec) {
+      /* starting thread, queries for work soon. */
+      --nthreads;
+    }
+  }
+
+  while(nthreads && !result &&
+        Curl_llist_count(&tpool->slots) < tpool->max_threads) {
+    result = thrdslot_start(tpool);
+    if(result)
+      break;
+    --nthreads;
+  }
+
+  return result;
+}
+
+CURLcode Curl_thrdpool_set_props(struct curl_thrdpool *tpool,
+                                 uint32_t min_threads,
+                                 uint32_t max_threads,
+                                 uint32_t idle_time_ms)
+{
+  CURLcode result = CURLE_OK;
+  size_t running;
+
+  if(!max_threads || (min_threads > max_threads))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  Curl_mutex_acquire(&tpool->lock);
+  tpool->min_threads = min_threads;
+  tpool->max_threads = max_threads;
+  tpool->idle_time_ms = idle_time_ms;
+  running = Curl_llist_count(&tpool->slots);
+  if(tpool->min_threads > running) {
+    result = thrdpool_signal(tpool, tpool->min_threads - (uint32_t)running);
+  }
+  Curl_mutex_release(&tpool->lock);
+
+  return result;
+}
+
+CURLcode Curl_thrdpool_create(struct curl_thrdpool **ptpool,
+                              const char *name,
+                              uint32_t min_threads,
+                              uint32_t max_threads,
+                              uint32_t idle_time_ms,
+                              Curl_thrdpool_take_item_cb *fn_take,
+                              Curl_thrdpool_process_item_cb *fn_process,
+                              Curl_thrdpool_return_item_cb *fn_return,
+                              void *user_data)
+{
+  struct curl_thrdpool *tpool;
+  CURLcode result = CURLE_OUT_OF_MEMORY;
+
+  tpool = curlx_calloc(1, sizeof(*tpool));
+  if(!tpool)
+    goto out;
+  tpool->refcount = 1;
+
+  Curl_mutex_init(&tpool->lock);
+  Curl_cond_init(&tpool->await);
+  Curl_llist_init(&tpool->slots, NULL);
+  Curl_llist_init(&tpool->zombies, NULL);
+  tpool->fn_take = fn_take;
+  tpool->fn_process = fn_process;
+  tpool->fn_return = fn_return;
+  tpool->fn_user_data = user_data;
+
+  tpool->name = curlx_strdup(name);
+  if(!tpool->name)
+    goto out;
+
+  result = Curl_thrdpool_set_props(tpool, min_threads, max_threads,
+                                   idle_time_ms);
+
+out:
+  if(result && tpool) {
+    tpool->aborted = TRUE;
+    thrdpool_unlink(tpool, FALSE);
+    tpool = NULL;
+  }
+  *ptpool = tpool;
+  return result;
+}
+
+void Curl_thrdpool_destroy(struct curl_thrdpool *tpool, bool join)
+{
+  Curl_mutex_acquire(&tpool->lock);
+
+  tpool->aborted = TRUE;
+
+  while(join && Curl_llist_count(&tpool->slots)) {
+    thrdpool_wake_all(tpool);
+    Curl_cond_wait(&tpool->await, &tpool->lock);
+  }
+
+  thrdpool_join_zombies(tpool);
+
+  /* detach all still running threads */
+  if(Curl_llist_count(&tpool->slots)) {
+    struct Curl_llist_node *e;
+    for(e = Curl_llist_head(&tpool->slots); e; e = Curl_node_next(e)) {
+      struct thrdslot *tslot = Curl_node_elem(e);
+      if(tslot->thread != curl_thread_t_null)
+        Curl_thread_destroy(&tslot->thread);
+    }
+    tpool->detached = TRUE;
+  }
+
+  if(!thrdpool_unlink(tpool, TRUE)) {
+    /* tpool not destroyed */
+    Curl_mutex_release(&tpool->lock);
+  }
+}
+
+CURLcode Curl_thrdpool_signal(struct curl_thrdpool *tpool, uint32_t nthreads)
+{
+  CURLcode result;
+
+  Curl_mutex_acquire(&tpool->lock);
+  result = thrdpool_signal(tpool, nthreads);
+  Curl_mutex_release(&tpool->lock);
+  return result;
+}
+
+static bool thrdpool_all_idle(struct curl_thrdpool *tpool)
+{
+  struct Curl_llist_node *e;
+  for(e = Curl_llist_head(&tpool->slots); e; e = Curl_node_next(e)) {
+    struct thrdslot *tslot = Curl_node_elem(e);
+    if(!tslot->idle)
+      return FALSE;
+  }
+  return TRUE;
+}
+
+CURLcode Curl_thrdpool_await_idle(struct curl_thrdpool *tpool,
+                                  uint32_t timeout_ms)
+{
+  CURLcode result = CURLE_OK;
+  struct curltime end = { 0 };
+
+  Curl_mutex_acquire(&tpool->lock);
+  DEBUGASSERT(!tpool->aborted);
+  if(tpool->aborted) {
+    result = CURLE_FAILED_INIT;
+    goto out;
+  }
+
+  while(!thrdpool_all_idle(tpool)) {
+    if(timeout_ms) {
+      timediff_t remain_ms;
+      CURLcode r;
+
+      if(!end.tv_sec && !end.tv_usec) {
+        end = curlx_now();
+        end.tv_sec += (time_t)(timeout_ms / 1000);
+        end.tv_usec += (int)(timeout_ms % 1000) * 1000;
+        if(end.tv_usec >= 1000000) {
+          end.tv_sec++;
+          end.tv_usec -= 1000000;
+        }
+      }
+      remain_ms = curlx_timediff_ms(curlx_now(), end);
+      if(remain_ms <= 0)
+        r = CURLE_OPERATION_TIMEDOUT;
+      else
+        r = Curl_cond_timedwait(&tpool->await, &tpool->lock,
+                                (uint32_t)remain_ms);
+      if(r == CURLE_OPERATION_TIMEDOUT) {
+        result = r;
+        break;
+      }
+    }
+    else {
+      Curl_cond_wait(&tpool->await, &tpool->lock);
+    }
+  }
+
+out:
+  thrdpool_join_zombies(tpool);
+  Curl_mutex_release(&tpool->lock);
+  return result;
+}
+
+#ifdef CURLVERBOSE
+void Curl_thrdpool_trace(struct curl_thrdpool *tpool,
+                         struct Curl_easy *data)
+{
+  struct curl_trc_feat *feat = &Curl_trc_feat_threads;
+  if(Curl_trc_ft_is_verbose(data, feat)) {
+    struct Curl_llist_node *e;
+    struct curltime now = curlx_now();
+
+    Curl_mutex_acquire(&tpool->lock);
+    if(!Curl_llist_count(&tpool->slots)) {
+      Curl_trc_feat_infof(data, feat, "[TPOOL-%s] no threads running",
+                          tpool->name);
+    }
+    for(e = Curl_llist_head(&tpool->slots); e; e = Curl_node_next(e)) {
+      struct thrdslot *tslot = Curl_node_elem(e);
+      timediff_t elapsed_ms = curlx_ptimediff_ms(&now, &tslot->starttime);
+      if(!tslot->running) {
+        Curl_trc_feat_infof(data, feat, "[TPOOL-%s] [%u]: not running",
+                            tpool->name, tslot->id);
+      }
+      else if(!tslot->starttime.tv_sec && !tslot->starttime.tv_usec) {
+        Curl_trc_feat_infof(data, feat, "[TPOOL-%s] [%u]: starting...",
+                            tpool->name, tslot->id);
+      }
+      else if(tslot->idle) {
+        Curl_trc_feat_infof(data, feat, "[TPOOL-%s] [%u]: idle for %"
+                            FMT_TIMEDIFF_T "ms",
+                            tpool->name, tslot->id, elapsed_ms);
+      }
+      else {
+        timediff_t remain_ms = tslot->work_timeout_ms ?
+          (tslot->work_timeout_ms - elapsed_ms) : 0;
+        Curl_trc_feat_infof(data, feat, "[TPOOL-%s] [%u]: busy %"
+                            FMT_TIMEDIFF_T "ms, timeout in %" FMT_TIMEDIFF_T
+                            "ms: %s",
+                            tpool->name, tslot->id, elapsed_ms, remain_ms,
+                            tslot->work_description);
+      }
+    }
+    Curl_mutex_release(&tpool->lock);
+  }
+}
+#endif
+
+#endif /* USE_THREADS */
diff --git a/third-party/curl/lib/thrdpool.h b/third-party/curl/lib/thrdpool.h
new file mode 100644
index 0000000000..cc81fb6fcb
--- /dev/null
+++ b/third-party/curl/lib/thrdpool.h
@@ -0,0 +1,106 @@
+#ifndef HEADER_CURL_THRDPOOL_H
+#define HEADER_CURL_THRDPOOL_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+#include "curlx/timediff.h"
+
+#ifdef USE_THREADS
+
+struct curl_thrdpool;
+struct Curl_easy;
+
+/* Invoked under thread pool lock to get an "item" to work on. Must
+ * return NULL if there is nothing to do.
+ * Caller might return a descriptive string about the "item", where
+ * available. The string needs to have the same lifetime as the
+ * item itself. */
+typedef void *Curl_thrdpool_take_item_cb(void *user_data,
+                                         const char **pdescription,
+                                         timediff_t *ptimeout_ms);
+
+/* Invoked outside thread pool lock to process the item taken. */
+typedef void Curl_thrdpool_process_item_cb(void *item);
+
+/* Invoked under thread pool lock to return a processed item back
+ * to the producer.
+ * If the thread pool has been destroyed, `user_data` will be NULL
+ * and the callback is responsible to release all `item` resources. */
+typedef void Curl_thrdpool_return_item_cb(void *item, void *user_data);
+
+/* Create a new thread pool.
+ * @param name         name of pool for tracing purposes
+ * @param min_threads  minimum number of threads to have always running
+ * @param max_threads  maximum number of threads running, ever.
+ * @param idle_time_ms maximum time a thread should wait for tasks to
+ *                     process before shutting down (unless the pool is
+ *                     already at minimum thread count), use 0 for
+ *                     infinite wait.
+ * @param fn_take      take the next item to process
+ * @param fn_process   process the item taken
+ * @param fn_return    return the processed item
+ * @param user_data    parameter passed to take/return callbacks
+ */
+CURLcode Curl_thrdpool_create(struct curl_thrdpool **ptpool,
+                              const char *name,
+                              uint32_t min_threads,
+                              uint32_t max_threads,
+                              uint32_t idle_time_ms,
+                              Curl_thrdpool_take_item_cb *fn_take,
+                              Curl_thrdpool_process_item_cb *fn_process,
+                              Curl_thrdpool_return_item_cb *fn_return,
+                              void *user_data);
+
+/* Destroy the thread pool, release its resources.
+ * With `join` being TRUE, the call will wait for all threads to finish
+ * processing before returning. On FALSE, it will detach all threads
+ * running. Ongoing item processing will continue to run and
+ * `fn_return` will be invoked with NULL user_data before the thread exits.
+ */
+void Curl_thrdpool_destroy(struct curl_thrdpool *tpool, bool join);
+
+/* Signal the pool to wake up `nthreads` idle worker threads, possible
+ * creating new threads up to the max limit. The number should reflect
+ * the items that can actually be taken for processing right away, e.g.
+ * the producers "queue" length of outstanding items.
+ */
+CURLcode Curl_thrdpool_signal(struct curl_thrdpool *tpool, uint32_t nthreads);
+
+CURLcode Curl_thrdpool_await_idle(struct curl_thrdpool *tpool,
+                                  uint32_t timeout_ms);
+
+/* Change the properties of a threadpool. */
+CURLcode Curl_thrdpool_set_props(struct curl_thrdpool *tpool,
+                                 uint32_t min_threads,
+                                 uint32_t max_threads,
+                                 uint32_t idle_time_ms);
+
+#ifdef CURLVERBOSE
+void Curl_thrdpool_trace(struct curl_thrdpool *tpool,
+                         struct Curl_easy *data);
+#endif
+
+#endif /* USE_THREADS */
+
+#endif /* HEADER_CURL_THRDPOOL_H */
diff --git a/third-party/curl/lib/thrdqueue.c b/third-party/curl/lib/thrdqueue.c
new file mode 100644
index 0000000000..f68f8e1797
--- /dev/null
+++ b/third-party/curl/lib/thrdqueue.c
@@ -0,0 +1,416 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef USE_THREADS
+
+#include "llist.h"
+#include "curl_threads.h"
+#include "thrdpool.h"
+#include "thrdqueue.h"
+#include "curlx/timeval.h"
+#ifdef CURLVERBOSE
+#include "curl_trc.h"
+#include "urldata.h"
+#endif
+
+
+struct curl_thrdq {
+  char *name;
+  curl_mutex_t lock;
+  curl_cond_t await;
+  struct Curl_llist sendq;
+  struct Curl_llist recvq;
+  struct curl_thrdpool *tpool;
+  Curl_thrdq_item_free_cb *fn_free;
+  Curl_thrdq_item_process_cb *fn_process;
+  Curl_thrdq_ev_cb *fn_event;
+  void *fn_user_data;
+  uint32_t send_max_len;
+  BIT(aborted);
+};
+
+struct thrdq_item {
+  struct Curl_llist_node node;
+  Curl_thrdq_item_free_cb *fn_free;
+  Curl_thrdq_item_process_cb *fn_process;
+  void *item;
+  struct curltime start;
+  timediff_t timeout_ms;
+  const char *description;
+};
+
+static struct thrdq_item *thrdq_item_create(struct curl_thrdq *tqueue,
+                                            void *item,
+                                            const char *description,
+                                            timediff_t timeout_ms)
+{
+  struct thrdq_item *qitem;
+
+  qitem = curlx_calloc(1, sizeof(*qitem));
+  if(!qitem)
+    return NULL;
+  qitem->item = item;
+  qitem->description = description;
+  qitem->fn_free = tqueue->fn_free;
+  qitem->fn_process = tqueue->fn_process;
+  if(timeout_ms) {
+    qitem->start = curlx_now();
+    qitem->timeout_ms = timeout_ms;
+  }
+  return qitem;
+}
+
+static void thrdq_item_destroy(struct thrdq_item *qitem)
+{
+  if(qitem->item)
+    qitem->fn_free(qitem->item);
+  curlx_free(qitem);
+}
+
+static void thrdq_item_list_dtor(void *user_data, void *elem)
+{
+  (void)user_data;
+  thrdq_item_destroy(elem);
+}
+
+static void *thrdq_tpool_take(void *user_data, const char **pdescription,
+                              timediff_t *ptimeout_ms)
+{
+  struct curl_thrdq *tqueue = user_data;
+  struct thrdq_item *qitem = NULL;
+  struct Curl_llist_node *e;
+  Curl_thrdq_ev_cb *fn_event = NULL;
+  void *fn_user_data = NULL;
+
+  Curl_mutex_acquire(&tqueue->lock);
+  *pdescription = NULL;
+  *ptimeout_ms = 0;
+  if(!tqueue->aborted) {
+    e = Curl_llist_head(&tqueue->sendq);
+    if(e) {
+      struct curltime now = curlx_now();
+      timediff_t timeout_ms;
+      while(e) {
+        qitem = Curl_node_take_elem(e);
+        timeout_ms = (!qitem->timeout_ms) ? 0 :
+          (qitem->timeout_ms - curlx_ptimediff_ms(&now, &qitem->start));
+        if(timeout_ms < 0) {
+          /* timed out while queued, place on receive queue */
+          Curl_llist_append(&tqueue->recvq, qitem, &qitem->node);
+          fn_event = tqueue->fn_event;
+          fn_user_data = tqueue->fn_user_data;
+          qitem = NULL;
+          e = Curl_llist_head(&tqueue->sendq);
+          continue;
+        }
+        else {
+          *pdescription = qitem->description;
+          *ptimeout_ms = timeout_ms;
+          break;
+        }
+      }
+    }
+  }
+  Curl_mutex_release(&tqueue->lock);
+  /* avoiding deadlocks */
+  if(fn_event)
+    fn_event(tqueue, CURL_THRDQ_EV_ITEM_DONE, fn_user_data);
+  return qitem;
+}
+
+static void thrdq_tpool_return(void *item, void *user_data)
+{
+  struct curl_thrdq *tqueue = user_data;
+  struct thrdq_item *qitem = item;
+  Curl_thrdq_ev_cb *fn_event = NULL;
+  void *fn_user_data = NULL;
+
+  if(!tqueue) {
+    thrdq_item_destroy(item);
+    return;
+  }
+
+  Curl_mutex_acquire(&tqueue->lock);
+  if(tqueue->aborted) {
+    thrdq_item_destroy(qitem);
+  }
+  else {
+    DEBUGASSERT(!Curl_node_llist(&qitem->node));
+    Curl_llist_append(&tqueue->recvq, qitem, &qitem->node);
+    fn_event = tqueue->fn_event;
+    fn_user_data = tqueue->fn_user_data;
+  }
+  Curl_mutex_release(&tqueue->lock);
+  /* avoiding deadlocks */
+  if(fn_event)
+    fn_event(tqueue, CURL_THRDQ_EV_ITEM_DONE, fn_user_data);
+}
+
+static void thrdq_tpool_process(void *item)
+{
+  struct thrdq_item *qitem = item;
+  qitem->fn_process(qitem->item);
+}
+
+static void thrdq_unlink(struct curl_thrdq *tqueue, bool locked, bool join)
+{
+  DEBUGASSERT(tqueue->aborted);
+  if(tqueue->tpool) {
+    if(locked)
+      Curl_mutex_release(&tqueue->lock);
+    Curl_thrdpool_destroy(tqueue->tpool, join);
+    tqueue->tpool = NULL;
+    if(locked)
+      Curl_mutex_acquire(&tqueue->lock);
+  }
+
+  Curl_llist_destroy(&tqueue->sendq, NULL);
+  Curl_llist_destroy(&tqueue->recvq, NULL);
+  curlx_free(tqueue->name);
+  Curl_cond_destroy(&tqueue->await);
+  if(locked)
+    Curl_mutex_release(&tqueue->lock);
+  Curl_mutex_destroy(&tqueue->lock);
+  curlx_free(tqueue);
+}
+
+CURLcode Curl_thrdq_create(struct curl_thrdq **ptqueue,
+                           const char *name,
+                           uint32_t max_len,
+                           uint32_t min_threads,
+                           uint32_t max_threads,
+                           uint32_t idle_time_ms,
+                           Curl_thrdq_item_free_cb *fn_free,
+                           Curl_thrdq_item_process_cb *fn_process,
+                           Curl_thrdq_ev_cb *fn_event,
+                           void *user_data)
+{
+  struct curl_thrdq *tqueue;
+  CURLcode result = CURLE_OUT_OF_MEMORY;
+
+  tqueue = curlx_calloc(1, sizeof(*tqueue));
+  if(!tqueue)
+    goto out;
+
+  Curl_mutex_init(&tqueue->lock);
+  Curl_cond_init(&tqueue->await);
+  Curl_llist_init(&tqueue->sendq, thrdq_item_list_dtor);
+  Curl_llist_init(&tqueue->recvq, thrdq_item_list_dtor);
+  tqueue->fn_free = fn_free;
+  tqueue->fn_process = fn_process;
+  tqueue->fn_event = fn_event;
+  tqueue->fn_user_data = user_data;
+  tqueue->send_max_len = max_len;
+
+  tqueue->name = curlx_strdup(name);
+  if(!tqueue->name)
+    goto out;
+
+  result = Curl_thrdpool_create(&tqueue->tpool, name,
+                                min_threads, max_threads, idle_time_ms,
+                                thrdq_tpool_take,
+                                thrdq_tpool_process,
+                                thrdq_tpool_return,
+                                tqueue);
+
+out:
+  if(result && tqueue) {
+    tqueue->aborted = TRUE;
+    thrdq_unlink(tqueue, FALSE, TRUE);
+    tqueue = NULL;
+  }
+  *ptqueue = tqueue;
+  return result;
+}
+
+void Curl_thrdq_destroy(struct curl_thrdq *tqueue, bool join)
+{
+  Curl_mutex_acquire(&tqueue->lock);
+  DEBUGASSERT(!tqueue->aborted);
+  tqueue->aborted = TRUE;
+  thrdq_unlink(tqueue, TRUE, join);
+}
+
+CURLcode Curl_thrdq_send(struct curl_thrdq *tqueue, void *item,
+                         const char *description, timediff_t timeout_ms)
+{
+  CURLcode result = CURLE_AGAIN;
+  size_t signals = 0;
+
+  Curl_mutex_acquire(&tqueue->lock);
+  if(tqueue->aborted) {
+    DEBUGASSERT(0);
+    result = CURLE_SEND_ERROR;
+    goto out;
+  }
+  if(timeout_ms < 0) {
+    result = CURLE_OPERATION_TIMEDOUT;
+    goto out;
+  }
+
+  if(!tqueue->send_max_len ||
+     (Curl_llist_count(&tqueue->sendq) < tqueue->send_max_len)) {
+    struct thrdq_item *qitem = thrdq_item_create(tqueue, item, description,
+                                                 timeout_ms);
+    if(!qitem) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+    item = NULL;
+    Curl_llist_append(&tqueue->sendq, qitem, &qitem->node);
+    signals = Curl_llist_count(&tqueue->sendq);
+    result = CURLE_OK;
+  }
+
+out:
+  Curl_mutex_release(&tqueue->lock);
+  /* Signal thread pool unlocked to avoid deadlocks. Since we added
+   * item to the queue already, it might have been taken for processing
+   * already. Any error in signalling the pool cannot be reported to
+   * the caller since it needs to give up ownership of item. */
+  if(!result && signals)
+    (void)Curl_thrdpool_signal(tqueue->tpool, (uint32_t)signals);
+  return result;
+}
+
+CURLcode Curl_thrdq_recv(struct curl_thrdq *tqueue, void **pitem)
+{
+  CURLcode result = CURLE_AGAIN;
+  struct Curl_llist_node *e;
+
+  *pitem = NULL;
+  Curl_mutex_acquire(&tqueue->lock);
+  if(tqueue->aborted) {
+    DEBUGASSERT(0);
+    result = CURLE_RECV_ERROR;
+    goto out;
+  }
+
+  e = Curl_llist_head(&tqueue->recvq);
+  if(e) {
+    struct thrdq_item *qitem = Curl_node_take_elem(e);
+    *pitem = qitem->item;
+    qitem->item = NULL;
+    thrdq_item_destroy(qitem);
+    result = CURLE_OK;
+  }
+out:
+  Curl_mutex_release(&tqueue->lock);
+  return result;
+}
+
+static void thrdq_llist_clean_matches(struct Curl_llist *llist,
+                                      Curl_thrdq_item_match_cb *fn_match,
+                                      void *match_data)
+{
+  struct Curl_llist_node *e, *n;
+  struct thrdq_item *qitem;
+
+  for(e = Curl_llist_head(llist); e; e = n) {
+    n = Curl_node_next(e);
+    qitem = Curl_node_elem(e);
+    if(fn_match(qitem->item, match_data))
+      Curl_node_remove(e);
+  }
+}
+
+void Curl_thrdq_clear(struct curl_thrdq *tqueue,
+                      Curl_thrdq_item_match_cb *fn_match,
+                      void *match_data)
+{
+  Curl_mutex_acquire(&tqueue->lock);
+  if(tqueue->aborted) {
+    DEBUGASSERT(0);
+    goto out;
+  }
+  thrdq_llist_clean_matches(&tqueue->sendq, fn_match, match_data);
+  thrdq_llist_clean_matches(&tqueue->recvq, fn_match, match_data);
+out:
+  Curl_mutex_release(&tqueue->lock);
+}
+
+#ifdef UNITTESTS
+/* @unittest 3301 */
+UNITTEST CURLcode thrdq_await_done(struct curl_thrdq *tqueue,
+                                   uint32_t timeout_ms);
+UNITTEST CURLcode thrdq_await_done(struct curl_thrdq *tqueue,
+                                   uint32_t timeout_ms)
+{
+  return Curl_thrdpool_await_idle(tqueue->tpool, timeout_ms);
+}
+#endif
+
+CURLcode Curl_thrdq_set_props(struct curl_thrdq *tqueue,
+                              uint32_t max_len,
+                              uint32_t min_threads,
+                              uint32_t max_threads,
+                              uint32_t idle_time_ms)
+{
+  CURLcode result;
+  size_t signals;
+
+  Curl_mutex_acquire(&tqueue->lock);
+  tqueue->send_max_len = max_len;
+  signals = Curl_llist_count(&tqueue->sendq);
+  Curl_mutex_release(&tqueue->lock);
+
+  result = Curl_thrdpool_set_props(tqueue->tpool, min_threads,
+                                   max_threads, idle_time_ms);
+  if(!result && signals)
+    result = Curl_thrdpool_signal(tqueue->tpool, (uint32_t)signals);
+  return result;
+}
+
+#ifdef CURLVERBOSE
+void Curl_thrdq_trace(struct curl_thrdq *tqueue,
+                      struct Curl_easy *data)
+{
+  struct curl_trc_feat *feat = &Curl_trc_feat_threads;
+  if(Curl_trc_ft_is_verbose(data, feat)) {
+    struct Curl_llist_node *e;
+    struct thrdq_item *qitem;
+
+    Curl_thrdpool_trace(tqueue->tpool, data);
+    Curl_mutex_acquire(&tqueue->lock);
+    if(!Curl_llist_count(&tqueue->sendq) &&
+       !Curl_llist_count(&tqueue->recvq)) {
+      Curl_trc_feat_infof(data, feat, "[TQUEUE-%s] empty", tqueue->name);
+    }
+    for(e = Curl_llist_head(&tqueue->sendq); e; e = Curl_node_next(e)) {
+      qitem = Curl_node_elem(e);
+      Curl_trc_feat_infof(data, feat, "[TQUEUE-%s] in: %s",
+                          tqueue->name, qitem->description);
+    }
+    for(e = Curl_llist_head(&tqueue->recvq); e; e = Curl_node_next(e)) {
+      qitem = Curl_node_elem(e);
+      Curl_trc_feat_infof(data, feat, "[TQUEUE-%s] out: %s",
+                          tqueue->name, qitem->description);
+    }
+    Curl_mutex_release(&tqueue->lock);
+  }
+}
+#endif
+
+#endif /* USE_THREADS */
diff --git a/third-party/curl/lib/thrdqueue.h b/third-party/curl/lib/thrdqueue.h
new file mode 100644
index 0000000000..1144bb4185
--- /dev/null
+++ b/third-party/curl/lib/thrdqueue.h
@@ -0,0 +1,119 @@
+#ifndef HEADER_CURL_THRDQUEUE_H
+#define HEADER_CURL_THRDQUEUE_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+#include "curlx/timediff.h"
+
+struct curl_thrdq;
+
+#ifdef USE_THREADS
+
+struct Curl_easy;
+
+typedef enum {
+  CURL_THRDQ_EV_ITEM_DONE /* an item has been processed and is ready */
+} Curl_thrdq_event;
+
+/* Notification callback when "events" happen in the queue. May be called from
+ * any thread, queue is not locked. */
+typedef void Curl_thrdq_ev_cb(const struct curl_thrdq *tqueue,
+                              Curl_thrdq_event ev,
+                              void *user_data);
+
+/* Process a queued item. May be called from any thread. Queue is not
+ * locked. */
+typedef void Curl_thrdq_item_process_cb(void *item);
+
+/* Free an item. May be called from any thread at any time for an
+ * item that is in the queue (either before or after processing). */
+typedef void Curl_thrdq_item_free_cb(void *item);
+
+/* Create a new queue processing "items" by a thread pool.
+ */
+CURLcode Curl_thrdq_create(struct curl_thrdq **ptqueue,
+                           const char *name,
+                           uint32_t max_len, /* 0 for unlimited */
+                           uint32_t min_threads,
+                           uint32_t max_threads,
+                           uint32_t idle_time_ms,
+                           Curl_thrdq_item_free_cb *fn_free,
+                           Curl_thrdq_item_process_cb *fn_process,
+                           Curl_thrdq_ev_cb *fn_event, /* optional */
+                           void *user_data);
+
+/* Destroy the queue, free all queued items unprocessed and destroy
+ * the thread pool used.
+ * @param join TRUE when thread pool shall be joined. FALSE for
+ *             detaching any running threads.
+ */
+void Curl_thrdq_destroy(struct curl_thrdq *tqueue, bool join);
+
+/* Send "item" onto the queue. The caller needs to clear any reference
+ * to "item" on success, e.g. the queue takes ownership.
+ * `description` is an optional string describing the item for tracing
+ * purposes. It needs to have the same lifetime as `item`.
+ * Returns CURLE_AGAIN when the queue has already been full.
+ *
+ * With`timeout_ms` != 0, items that get stuck that long in the send
+ * queue are removed and added to the receive queue right away.
+ */
+CURLcode Curl_thrdq_send(struct curl_thrdq *tqueue, void *item,
+                         const char *description, timediff_t timeout_ms);
+
+/* Receive the oldest, processed item from the queue again, if there is one.
+ * The caller takes ownership of the item received, e.g. the queue
+ * relinquishes all references to item.
+ * Returns CURLE_AGAIN when there is no processed item, setting `pitem`
+ * to NULL.
+ */
+CURLcode Curl_thrdq_recv(struct curl_thrdq *tqueue, void **pitem);
+
+/* Return TRUE if the passed "item" matches. */
+typedef bool Curl_thrdq_item_match_cb(void *item, void *match_data);
+
+/* Clear all scheduled/processed items that match from the queue. This
+ * will *not* be able to clear items that are being processed.
+ */
+void Curl_thrdq_clear(struct curl_thrdq *tqueue,
+                      Curl_thrdq_item_match_cb *fn_match,
+                      void *match_data);
+
+CURLcode Curl_thrdq_await_done(struct curl_thrdq *tqueue,
+                               uint32_t timeout_ms);
+
+CURLcode Curl_thrdq_set_props(struct curl_thrdq *tqueue,
+                              uint32_t max_len, /* 0 for unlimited */
+                              uint32_t min_threads,
+                              uint32_t max_threads,
+                              uint32_t idle_time_ms);
+
+#ifdef CURLVERBOSE
+void Curl_thrdq_trace(struct curl_thrdq *tqueue,
+                      struct Curl_easy *data);
+#endif
+
+#endif /* USE_THREADS */
+
+#endif /* HEADER_CURL_THRDQUEUE_H */
diff --git a/third-party/curl/lib/timeval.c b/third-party/curl/lib/timeval.c
deleted file mode 100644
index 2de79be46d..0000000000
--- a/third-party/curl/lib/timeval.c
+++ /dev/null
@@ -1,224 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "timeval.h"
-
-#if defined(WIN32) && !defined(MSDOS)
-
-/* set in win32_init() */
-extern LARGE_INTEGER Curl_freq;
-extern bool Curl_isVistaOrGreater;
-
-/* In case of bug fix this function has a counterpart in tool_util.c */
-struct curltime Curl_now(void)
-{
-  struct curltime now;
-  if(Curl_isVistaOrGreater) { /* QPC timer might have issues pre-Vista */
-    LARGE_INTEGER count;
-    QueryPerformanceCounter(&count);
-    now.tv_sec = (time_t)(count.QuadPart / Curl_freq.QuadPart);
-    now.tv_usec = (int)((count.QuadPart % Curl_freq.QuadPart) * 1000000 /
-                        Curl_freq.QuadPart);
-  }
-  else {
-    /* Disable /analyze warning that GetTickCount64 is preferred  */
-#if defined(_MSC_VER)
-#pragma warning(push)
-#pragma warning(disable:28159)
-#endif
-    DWORD milliseconds = GetTickCount();
-#if defined(_MSC_VER)
-#pragma warning(pop)
-#endif
-
-    now.tv_sec = milliseconds / 1000;
-    now.tv_usec = (milliseconds % 1000) * 1000;
-  }
-  return now;
-}
-
-#elif defined(HAVE_CLOCK_GETTIME_MONOTONIC) ||  \
-  defined(HAVE_CLOCK_GETTIME_MONOTONIC_RAW)
-
-struct curltime Curl_now(void)
-{
-  /*
-  ** clock_gettime() is granted to be increased monotonically when the
-  ** monotonic clock is queried. Time starting point is unspecified, it
-  ** could be the system start-up time, the Epoch, or something else,
-  ** in any case the time starting point does not change once that the
-  ** system has started up.
-  */
-#ifdef HAVE_GETTIMEOFDAY
-  struct timeval now;
-#endif
-  struct curltime cnow;
-  struct timespec tsnow;
-
-  /*
-  ** clock_gettime() may be defined by Apple's SDK as weak symbol thus
-  ** code compiles but fails during run-time if clock_gettime() is
-  ** called on unsupported OS version.
-  */
-#if defined(__APPLE__) && defined(HAVE_BUILTIN_AVAILABLE) && \
-        (HAVE_BUILTIN_AVAILABLE == 1)
-  bool have_clock_gettime = FALSE;
-  if(__builtin_available(macOS 10.12, iOS 10, tvOS 10, watchOS 3, *))
-    have_clock_gettime = TRUE;
-#endif
-
-#ifdef HAVE_CLOCK_GETTIME_MONOTONIC_RAW
-  if(
-#if defined(__APPLE__) && defined(HAVE_BUILTIN_AVAILABLE) &&    \
-        (HAVE_BUILTIN_AVAILABLE == 1)
-    have_clock_gettime &&
-#endif
-    (0 == clock_gettime(CLOCK_MONOTONIC_RAW, &tsnow))) {
-    cnow.tv_sec = tsnow.tv_sec;
-    cnow.tv_usec = (unsigned int)(tsnow.tv_nsec / 1000);
-  }
-  else
-#endif
-
-  if(
-#if defined(__APPLE__) && defined(HAVE_BUILTIN_AVAILABLE) && \
-        (HAVE_BUILTIN_AVAILABLE == 1)
-    have_clock_gettime &&
-#endif
-    (0 == clock_gettime(CLOCK_MONOTONIC, &tsnow))) {
-    cnow.tv_sec = tsnow.tv_sec;
-    cnow.tv_usec = (unsigned int)(tsnow.tv_nsec / 1000);
-  }
-  /*
-  ** Even when the configure process has truly detected monotonic clock
-  ** availability, it might happen that it is not actually available at
-  ** run-time. When this occurs simply fallback to other time source.
-  */
-#ifdef HAVE_GETTIMEOFDAY
-  else {
-    (void)gettimeofday(&now, NULL);
-    cnow.tv_sec = now.tv_sec;
-    cnow.tv_usec = (unsigned int)now.tv_usec;
-  }
-#else
-  else {
-    cnow.tv_sec = time(NULL);
-    cnow.tv_usec = 0;
-  }
-#endif
-  return cnow;
-}
-
-#elif defined(HAVE_MACH_ABSOLUTE_TIME)
-
-#include <stdint.h>
-#include <mach/mach_time.h>
-
-struct curltime Curl_now(void)
-{
-  /*
-  ** Monotonic timer on Mac OS is provided by mach_absolute_time(), which
-  ** returns time in Mach "absolute time units," which are platform-dependent.
-  ** To convert to nanoseconds, one must use conversion factors specified by
-  ** mach_timebase_info().
-  */
-  static mach_timebase_info_data_t timebase;
-  struct curltime cnow;
-  uint64_t usecs;
-
-  if(0 == timebase.denom)
-    (void) mach_timebase_info(&timebase);
-
-  usecs = mach_absolute_time();
-  usecs *= timebase.numer;
-  usecs /= timebase.denom;
-  usecs /= 1000;
-
-  cnow.tv_sec = usecs / 1000000;
-  cnow.tv_usec = (int)(usecs % 1000000);
-
-  return cnow;
-}
-
-#elif defined(HAVE_GETTIMEOFDAY)
-
-struct curltime Curl_now(void)
-{
-  /*
-  ** gettimeofday() is not granted to be increased monotonically, due to
-  ** clock drifting and external source time synchronization it can jump
-  ** forward or backward in time.
-  */
-  struct timeval now;
-  struct curltime ret;
-  (void)gettimeofday(&now, NULL);
-  ret.tv_sec = now.tv_sec;
-  ret.tv_usec = (int)now.tv_usec;
-  return ret;
-}
-
-#else
-
-struct curltime Curl_now(void)
-{
-  /*
-  ** time() returns the value of time in seconds since the Epoch.
-  */
-  struct curltime now;
-  now.tv_sec = time(NULL);
-  now.tv_usec = 0;
-  return now;
-}
-
-#endif
-
-/*
- * Returns: time difference in number of milliseconds. For too large diffs it
- * returns max value.
- *
- * @unittest: 1323
- */
-timediff_t Curl_timediff(struct curltime newer, struct curltime older)
-{
-  timediff_t diff = (timediff_t)newer.tv_sec-older.tv_sec;
-  if(diff >= (TIMEDIFF_T_MAX/1000))
-    return TIMEDIFF_T_MAX;
-  else if(diff <= (TIMEDIFF_T_MIN/1000))
-    return TIMEDIFF_T_MIN;
-  return diff * 1000 + (newer.tv_usec-older.tv_usec)/1000;
-}
-
-/*
- * Returns: time difference in number of microseconds. For too large diffs it
- * returns max value.
- */
-timediff_t Curl_timediff_us(struct curltime newer, struct curltime older)
-{
-  timediff_t diff = (timediff_t)newer.tv_sec-older.tv_sec;
-  if(diff >= (TIMEDIFF_T_MAX/1000000))
-    return TIMEDIFF_T_MAX;
-  else if(diff <= (TIMEDIFF_T_MIN/1000000))
-    return TIMEDIFF_T_MIN;
-  return diff * 1000000 + newer.tv_usec-older.tv_usec;
-}
diff --git a/third-party/curl/lib/timeval.h b/third-party/curl/lib/timeval.h
deleted file mode 100644
index 92e484ad1d..0000000000
--- a/third-party/curl/lib/timeval.h
+++ /dev/null
@@ -1,54 +0,0 @@
-#ifndef HEADER_CURL_TIMEVAL_H
-#define HEADER_CURL_TIMEVAL_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#include "timediff.h"
-
-struct curltime {
-  time_t tv_sec; /* seconds */
-  int tv_usec;   /* microseconds */
-};
-
-struct curltime Curl_now(void);
-
-/*
- * Make sure that the first argument (t1) is the more recent time and t2 is
- * the older time, as otherwise you get a weird negative time-diff back...
- *
- * Returns: the time difference in number of milliseconds.
- */
-timediff_t Curl_timediff(struct curltime t1, struct curltime t2);
-
-/*
- * Make sure that the first argument (t1) is the more recent time and t2 is
- * the older time, as otherwise you get a weird negative time-diff back...
- *
- * Returns: the time difference in number of microseconds.
- */
-timediff_t Curl_timediff_us(struct curltime newer, struct curltime older);
-
-#endif /* HEADER_CURL_TIMEVAL_H */
diff --git a/third-party/curl/lib/transfer.c b/third-party/curl/lib/transfer.c
index d0602b8753..1a4138f6c1 100644
--- a/third-party/curl/lib/transfer.c
+++ b/third-party/curl/lib/transfer.c
@@ -21,9 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
-#include "strtoofft.h"
 
 #ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
@@ -40,9 +38,7 @@
 #ifdef HAVE_SYS_IOCTL_H
 #include <sys/ioctl.h>
 #endif
-#ifdef HAVE_SIGNAL_H
 #include <signal.h>
-#endif
 
 #ifdef HAVE_SYS_PARAM_H
 #include <sys/param.h>
@@ -55,43 +51,31 @@
 #endif
 
 #ifndef HAVE_SOCKET
-#error "We can't compile without socket() support!"
+#error "We cannot compile without socket() support!"
 #endif
 
 #include "urldata.h"
-#include <curl/curl.h>
-#include "netrc.h"
 
-#include "content_encoding.h"
 #include "hostip.h"
 #include "cfilters.h"
+#include "cw-out.h"
+#include "dnscache.h"
 #include "transfer.h"
 #include "sendf.h"
-#include "speedcheck.h"
+#include "curl_trc.h"
 #include "progress.h"
 #include "http.h"
 #include "url.h"
 #include "getinfo.h"
-#include "vtls/vtls.h"
-#include "vquic/vquic.h"
-#include "select.h"
 #include "multiif.h"
 #include "connect.h"
-#include "http2.h"
-#include "mime.h"
-#include "strcase.h"
-#include "urlapi-int.h"
 #include "hsts.h"
 #include "setopt.h"
 #include "headers.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "bufref.h"
 
 #if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_SMTP) || \
-    !defined(CURL_DISABLE_IMAP)
+  !defined(CURL_DISABLE_IMAP)
 /*
  * checkheaders() checks the linked list of custom headers for a
  * particular header (prefix). Provide the prefix without colon!
@@ -104,11 +88,11 @@ char *Curl_checkheaders(const struct Curl_easy *data,
 {
   struct curl_slist *head;
   DEBUGASSERT(thislen);
-  DEBUGASSERT(thisheader[thislen-1] != ':');
+  DEBUGASSERT(thisheader[thislen - 1] != ':');
 
   for(head = data->set.headers; head; head = head->next) {
-    if(strncasecompare(head->data, thisheader, thislen) &&
-       Curl_headersep(head->data[thislen]) )
+    if(curl_strnequal(head->data, thisheader, thislen) &&
+       Curl_headersep(head->data[thislen]))
       return head->data;
   }
 
@@ -116,265 +100,18 @@ char *Curl_checkheaders(const struct Curl_easy *data,
 }
 #endif
 
-CURLcode Curl_get_upload_buffer(struct Curl_easy *data)
-{
-  if(!data->state.ulbuf) {
-    data->state.ulbuf = malloc(data->set.upload_buffer_size);
-    if(!data->state.ulbuf)
-      return CURLE_OUT_OF_MEMORY;
-  }
-  return CURLE_OK;
-}
-
-#ifndef CURL_DISABLE_HTTP
-/*
- * This function will be called to loop through the trailers buffer
- * until no more data is available for sending.
- */
-static size_t trailers_read(char *buffer, size_t size, size_t nitems,
-                            void *raw)
-{
-  struct Curl_easy *data = (struct Curl_easy *)raw;
-  struct dynbuf *trailers_buf = &data->state.trailers_buf;
-  size_t bytes_left = Curl_dyn_len(trailers_buf) -
-    data->state.trailers_bytes_sent;
-  size_t to_copy = (size*nitems < bytes_left) ? size*nitems : bytes_left;
-  if(to_copy) {
-    memcpy(buffer,
-           Curl_dyn_ptr(trailers_buf) + data->state.trailers_bytes_sent,
-           to_copy);
-    data->state.trailers_bytes_sent += to_copy;
-  }
-  return to_copy;
-}
-
-static size_t trailers_left(void *raw)
-{
-  struct Curl_easy *data = (struct Curl_easy *)raw;
-  struct dynbuf *trailers_buf = &data->state.trailers_buf;
-  return Curl_dyn_len(trailers_buf) - data->state.trailers_bytes_sent;
-}
-#endif
-
-/*
- * This function will call the read callback to fill our buffer with data
- * to upload.
- */
-CURLcode Curl_fillreadbuffer(struct Curl_easy *data, size_t bytes,
-                             size_t *nreadp)
-{
-  size_t buffersize = bytes;
-  size_t nread;
-
-  curl_read_callback readfunc = NULL;
-  void *extra_data = NULL;
-
-#ifndef CURL_DISABLE_HTTP
-  if(data->state.trailers_state == TRAILERS_INITIALIZED) {
-    struct curl_slist *trailers = NULL;
-    CURLcode result;
-    int trailers_ret_code;
-
-    /* at this point we already verified that the callback exists
-       so we compile and store the trailers buffer, then proceed */
-    infof(data,
-          "Moving trailers state machine from initialized to sending.");
-    data->state.trailers_state = TRAILERS_SENDING;
-    Curl_dyn_init(&data->state.trailers_buf, DYN_TRAILERS);
-
-    data->state.trailers_bytes_sent = 0;
-    Curl_set_in_callback(data, true);
-    trailers_ret_code = data->set.trailer_callback(&trailers,
-                                                   data->set.trailer_data);
-    Curl_set_in_callback(data, false);
-    if(trailers_ret_code == CURL_TRAILERFUNC_OK) {
-      result = Curl_http_compile_trailers(trailers, &data->state.trailers_buf,
-                                          data);
-    }
-    else {
-      failf(data, "operation aborted by trailing headers callback");
-      *nreadp = 0;
-      result = CURLE_ABORTED_BY_CALLBACK;
-    }
-    if(result) {
-      Curl_dyn_free(&data->state.trailers_buf);
-      curl_slist_free_all(trailers);
-      return result;
-    }
-    infof(data, "Successfully compiled trailers.");
-    curl_slist_free_all(trailers);
-  }
-#endif
-
-#ifndef CURL_DISABLE_HTTP
-  /* if we are transmitting trailing data, we don't need to write
-     a chunk size so we skip this */
-  if(data->req.upload_chunky &&
-     data->state.trailers_state == TRAILERS_NONE) {
-    /* if chunked Transfer-Encoding */
-    buffersize -= (8 + 2 + 2);   /* 32bit hex + CRLF + CRLF */
-    data->req.upload_fromhere += (8 + 2); /* 32bit hex + CRLF */
-  }
-
-  if(data->state.trailers_state == TRAILERS_SENDING) {
-    /* if we're here then that means that we already sent the last empty chunk
-       but we didn't send a final CR LF, so we sent 0 CR LF. We then start
-       pulling trailing data until we have no more at which point we
-       simply return to the previous point in the state machine as if
-       nothing happened.
-       */
-    readfunc = trailers_read;
-    extra_data = (void *)data;
-  }
-  else
-#endif
-  {
-    readfunc = data->state.fread_func;
-    extra_data = data->state.in;
-  }
-
-  Curl_set_in_callback(data, true);
-  nread = readfunc(data->req.upload_fromhere, 1,
-                   buffersize, extra_data);
-  Curl_set_in_callback(data, false);
-
-  if(nread == CURL_READFUNC_ABORT) {
-    failf(data, "operation aborted by callback");
-    *nreadp = 0;
-    return CURLE_ABORTED_BY_CALLBACK;
-  }
-  if(nread == CURL_READFUNC_PAUSE) {
-    struct SingleRequest *k = &data->req;
-
-    if(data->conn->handler->flags & PROTOPT_NONETWORK) {
-      /* protocols that work without network cannot be paused. This is
-         actually only FILE:// just now, and it can't pause since the transfer
-         isn't done using the "normal" procedure. */
-      failf(data, "Read callback asked for PAUSE when not supported");
-      return CURLE_READ_ERROR;
-    }
-
-    /* CURL_READFUNC_PAUSE pauses read callbacks that feed socket writes */
-    k->keepon |= KEEP_SEND_PAUSE; /* mark socket send as paused */
-    if(data->req.upload_chunky) {
-        /* Back out the preallocation done above */
-      data->req.upload_fromhere -= (8 + 2);
-    }
-    *nreadp = 0;
-
-    return CURLE_OK; /* nothing was read */
-  }
-  else if(nread > buffersize) {
-    /* the read function returned a too large value */
-    *nreadp = 0;
-    failf(data, "read function returned funny value");
-    return CURLE_READ_ERROR;
-  }
-
-#ifndef CURL_DISABLE_HTTP
-  if(!data->req.forbidchunk && data->req.upload_chunky) {
-    /* if chunked Transfer-Encoding
-     *    build chunk:
-     *
-     *        <HEX SIZE> CRLF
-     *        <DATA> CRLF
-     */
-    /* On non-ASCII platforms the <DATA> may or may not be
-       translated based on state.prefer_ascii while the protocol
-       portion must always be translated to the network encoding.
-       To further complicate matters, line end conversion might be
-       done later on, so we need to prevent CRLFs from becoming
-       CRCRLFs if that's the case.  To do this we use bare LFs
-       here, knowing they'll become CRLFs later on.
-     */
-
-    bool added_crlf = FALSE;
-    int hexlen = 0;
-    const char *endofline_native;
-    const char *endofline_network;
-
-    if(
-#ifdef CURL_DO_LINEEND_CONV
-       (data->state.prefer_ascii) ||
-#endif
-       (data->set.crlf)) {
-      /* \n will become \r\n later on */
-      endofline_native  = "\n";
-      endofline_network = "\x0a";
-    }
-    else {
-      endofline_native  = "\r\n";
-      endofline_network = "\x0d\x0a";
-    }
-
-    /* if we're not handling trailing data, proceed as usual */
-    if(data->state.trailers_state != TRAILERS_SENDING) {
-      char hexbuffer[11] = "";
-      hexlen = msnprintf(hexbuffer, sizeof(hexbuffer),
-                         "%zx%s", nread, endofline_native);
-
-      /* move buffer pointer */
-      data->req.upload_fromhere -= hexlen;
-      nread += hexlen;
-
-      /* copy the prefix to the buffer, leaving out the NUL */
-      memcpy(data->req.upload_fromhere, hexbuffer, hexlen);
-
-      /* always append ASCII CRLF to the data unless
-         we have a valid trailer callback */
-      if((nread-hexlen) == 0 &&
-          data->set.trailer_callback != NULL &&
-          data->state.trailers_state == TRAILERS_NONE) {
-        data->state.trailers_state = TRAILERS_INITIALIZED;
-      }
-      else {
-        memcpy(data->req.upload_fromhere + nread,
-               endofline_network,
-               strlen(endofline_network));
-        added_crlf = TRUE;
-      }
-    }
-
-    if(data->state.trailers_state == TRAILERS_SENDING &&
-       !trailers_left(data)) {
-      Curl_dyn_free(&data->state.trailers_buf);
-      data->state.trailers_state = TRAILERS_DONE;
-      data->set.trailer_data = NULL;
-      data->set.trailer_callback = NULL;
-      /* mark the transfer as done */
-      data->req.upload_done = TRUE;
-      infof(data, "Signaling end of chunked upload after trailers.");
-    }
-    else
-      if((nread - hexlen) == 0 &&
-         data->state.trailers_state != TRAILERS_INITIALIZED) {
-        /* mark this as done once this chunk is transferred */
-        data->req.upload_done = TRUE;
-        infof(data,
-              "Signaling end of chunked upload via terminating chunk.");
-      }
-
-    if(added_crlf)
-      nread += strlen(endofline_network); /* for the added end of line */
-  }
-#endif
-
-  *nreadp = nread;
-
-  return CURLE_OK;
-}
-
-static int data_pending(struct Curl_easy *data)
+static int data_pending(struct Curl_easy *data, bool rcvd_eagain)
 {
   struct connectdata *conn = data->conn;
 
-  if(conn->handler->protocol&PROTO_FAMILY_FTP)
+  if(conn->scheme->protocol & PROTO_FAMILY_FTP)
     return Curl_conn_data_pending(data, SECONDARYSOCKET);
 
   /* in the case of libssh2, we can never be really sure that we have emptied
      its internal buffers so we MUST always try until we get EAGAIN back */
-  return conn->handler->protocol&(CURLPROTO_SCP|CURLPROTO_SFTP) ||
-    Curl_conn_data_pending(data, FIRSTSOCKET);
+  return (!rcvd_eagain &&
+          conn->scheme->protocol & (CURLPROTO_SCP | CURLPROTO_SFTP)) ||
+         Curl_conn_data_pending(data, FIRSTSOCKET);
 }
 
 /*
@@ -390,16 +127,14 @@ bool Curl_meets_timecondition(struct Curl_easy *data, time_t timeofdoc)
   case CURL_TIMECOND_IFMODSINCE:
   default:
     if(timeofdoc <= data->set.timevalue) {
-      infof(data,
-            "The requested document is not new enough");
+      infof(data, "The requested document is not new enough");
       data->info.timecond = TRUE;
       return FALSE;
     }
     break;
   case CURL_TIMECOND_IFUNMODSINCE:
     if(timeofdoc >= data->set.timevalue) {
-      infof(data,
-            "The requested document is not old enough");
+      infof(data, "The requested document is not old enough");
       data->info.timecond = TRUE;
       return FALSE;
     }
@@ -409,779 +144,259 @@ bool Curl_meets_timecondition(struct Curl_easy *data, time_t timeofdoc)
   return TRUE;
 }
 
+static CURLcode xfer_recv_shutdown(struct Curl_easy *data, bool *done)
+{
+  if(!data || !data->conn)
+    return CURLE_FAILED_INIT;
+  return Curl_conn_shutdown(data, data->conn->recv_idx, done);
+}
+
+static bool xfer_recv_shutdown_started(struct Curl_easy *data)
+{
+  if(!data || !data->conn)
+    return FALSE;
+  return Curl_shutdown_started(data, data->conn->recv_idx);
+}
+
+CURLcode Curl_xfer_send_shutdown(struct Curl_easy *data, bool *done)
+{
+  if(!data || !data->conn)
+    return CURLE_FAILED_INIT;
+  return Curl_conn_shutdown(data, data->conn->send_idx, done);
+}
+
+/**
+ * Receive raw response data for the transfer.
+ * @param data         the transfer
+ * @param buf          buffer to keep response data received
+ * @param blen         length of `buf`
+ * @param eos_reliable if EOS detection in underlying connection is reliable
+ * @return number of bytes read or -1 for error
+ */
+static CURLcode xfer_recv_resp(struct Curl_easy *data,
+                               char *buf, size_t blen,
+                               bool eos_reliable,
+                               size_t *pnread)
+{
+  CURLcode result;
+
+  DEBUGASSERT(blen > 0);
+  *pnread = 0;
+  /* If we are reading BODY data and the connection does NOT handle EOF
+   * and we know the size of the BODY data, limit the read amount */
+  if(!eos_reliable && !data->req.header && data->req.size != -1) {
+    blen = curlx_sotouz_range(data->req.size - data->req.bytecount, 0, blen);
+  }
+  else if(xfer_recv_shutdown_started(data)) {
+    /* we already received everything. Do not try more. */
+    blen = 0;
+  }
+
+  if(blen) {
+    result = Curl_xfer_recv(data, buf, blen, pnread);
+    if(result)
+      return result;
+  }
+
+  if(*pnread == 0) {
+    if(data->req.shutdown) {
+      bool done;
+      result = xfer_recv_shutdown(data, &done);
+      if(result)
+        return result;
+      if(!done) {
+        return CURLE_AGAIN;
+      }
+    }
+    DEBUGF(infof(data, "sendrecv_dl: we are done"));
+  }
+  return CURLE_OK;
+}
+
 /*
  * Go ahead and do a read if we have a readable socket or if
  * the stream was rewound (in which case we have data in a
  * buffer)
- *
- * return '*comeback' TRUE if we didn't properly drain the socket so this
- * function should get called again without select() or similar in between!
  */
-static CURLcode readwrite_data(struct Curl_easy *data,
-                               struct connectdata *conn,
-                               struct SingleRequest *k,
-                               int *didwhat, bool *done,
-                               bool *comeback)
+static CURLcode sendrecv_dl(struct Curl_easy *data,
+                            struct SingleRequest *k)
 {
+  struct connectdata *conn = data->conn;
   CURLcode result = CURLE_OK;
-  ssize_t nread; /* number of bytes read */
-  size_t excess = 0; /* excess bytes read */
-  bool readmore = FALSE; /* used by RTP to signal for more data */
-  int maxloops = 100;
-  curl_off_t max_recv = data->set.max_recv_speed?
-                        data->set.max_recv_speed : CURL_OFF_T_MAX;
-  char *buf = data->state.buffer;
-  bool data_eof_handled = FALSE;
-  DEBUGASSERT(buf);
+  char *buf, *xfer_buf;
+  size_t blen, xfer_blen;
+  int maxloops = 10;
+  bool is_multiplex = FALSE;
+  bool rcvd_eagain = FALSE;
+  bool is_eos = FALSE, rate_limited = FALSE;
 
-  *done = FALSE;
-  *comeback = FALSE;
+  result = Curl_multi_xfer_buf_borrow(data, &xfer_buf, &xfer_blen);
+  if(result)
+    goto out;
 
   /* This is where we loop until we have read everything there is to
      read or we get a CURLE_AGAIN */
   do {
-    bool is_empty_data = FALSE;
-    size_t buffersize = data->set.buffer_size;
-    size_t bytestoread = buffersize;
-    /* For HTTP/2 and HTTP/3, read data without caring about the content
-       length. This is safe because body in HTTP/2 is always segmented
-       thanks to its framing layer. Meanwhile, we have to call Curl_read
-       to ensure that http2_handle_stream_close is called when we read all
-       incoming bytes for a particular stream. */
-    bool is_http3 = Curl_conn_is_http3(data, conn, FIRSTSOCKET);
-    data_eof_handled = is_http3 || Curl_conn_is_http2(data, conn, FIRSTSOCKET);
+    size_t bytestoread;
 
-    if(!data_eof_handled && k->size != -1 && !k->header) {
-      /* make sure we don't read too much */
-      curl_off_t totalleft = k->size - k->bytecount;
-      if(totalleft < (curl_off_t)bytestoread)
-        bytestoread = (size_t)totalleft;
+    if(!is_multiplex) {
+      /* Multiplexed connection have inherent handling of EOF and we do not
+       * have to carefully restrict the amount we try to read.
+       * Multiplexed changes only in one direction. */
+      is_multiplex = Curl_conn_is_multiplex(conn, FIRSTSOCKET);
     }
 
-    if(bytestoread) {
-      /* receive data from the network! */
-      result = Curl_read(data, conn->sockfd, buf, bytestoread, &nread);
+    buf = xfer_buf;
+    bytestoread = xfer_blen;
 
-      /* read would've blocked */
-      if(CURLE_AGAIN == result) {
-        result = CURLE_OK;
-        break; /* get out of loop */
+    if(bytestoread && Curl_rlimit_active(&data->progress.dl.rlimit)) {
+      curl_off_t dl_avail = Curl_rlimit_avail(&data->progress.dl.rlimit,
+                                              Curl_pgrs_now(data));
+#if 0
+      DEBUGF(infof(data, "dl_rlimit, available=%" FMT_OFF_T, dl_avail));
+#endif
+      /* In case of rate limited downloads: if this loop already got data and
+       * less than 16k is left in the limit, break out. We want to stutter a
+       * bit to keep in the limit, but too small receives will cost cpu
+       * unnecessarily. */
+      if(dl_avail <= 0) {
+        rate_limited = TRUE;
+        break;
       }
-
-      if(result>0)
-        goto out;
-    }
-    else {
-      /* read nothing but since we wanted nothing we consider this an OK
-         situation to proceed from */
-      DEBUGF(infof(data, "readwrite_data: we're done"));
-      nread = 0;
+      if(dl_avail < (curl_off_t)bytestoread)
+        bytestoread = (size_t)dl_avail;
     }
 
-    if(!k->bytecount) {
-      Curl_pgrsTime(data, TIMER_STARTTRANSFER);
-      if(k->exp100 > EXP100_SEND_DATA)
-        /* set time stamp to compare with when waiting for the 100 */
-        k->start100 = Curl_now();
-    }
-
-    *didwhat |= KEEP_RECV;
-    /* indicates data of zero size, i.e. empty file */
-    is_empty_data = ((nread == 0) && (k->bodywrites == 0)) ? TRUE : FALSE;
-
-    if(0 < nread || is_empty_data) {
-      buf[nread] = 0;
-    }
-    if(!nread) {
-      /* if we receive 0 or less here, either the data transfer is done or the
-         server closed the connection and we bail out from this! */
-      if(data_eof_handled)
-        DEBUGF(infof(data, "nread == 0, stream closed, bailing"));
+    rcvd_eagain = FALSE;
+    result = xfer_recv_resp(data, buf, bytestoread, is_multiplex, &blen);
+    if(result) {
+      if(result != CURLE_AGAIN)
+        goto out; /* real error */
+      rcvd_eagain = TRUE;
+      result = CURLE_OK;
+      if(data->req.download_done && data->req.no_body &&
+         !data->req.resp_trailer) {
+        DEBUGF(infof(data, "EAGAIN, download done, no trailer announced, "
+                     "not waiting for EOS"));
+        blen = 0;
+        /* continue as if we received the EOS */
+      }
       else
-        DEBUGF(infof(data, "nread <= 0, server closed connection, bailing"));
-      k->keepon = 0; /* stop sending as well */
-      if(!is_empty_data)
+        break; /* get out of loop */
+    }
+
+    /* We only get a 0-length receive at the end of the response */
+    is_eos = (blen == 0);
+
+    if(!blen) {
+      result = Curl_req_stop_send_recv(data);
+      if(result)
+        goto out;
+      if(k->eos_written) /* already did write this to client, leave */
         break;
     }
 
-    /* Default buffer to use when we write the buffer, it may be changed
-       in the flow below before the actual storing is done. */
-    k->str = buf;
+    result = Curl_xfer_write_resp(data, buf, blen, is_eos);
+    if(result || data->req.done)
+      goto out;
 
-    if(conn->handler->readwrite) {
-      result = conn->handler->readwrite(data, conn, &nread, &readmore);
-      if(result)
-        goto out;
-      if(readmore)
-        break;
+    /* if we are done, we stop receiving. On multiplexed connections,
+     * we should read the EOS. Which may arrive as meta data after
+     * the bytes. Not taking it in might lead to RST of streams. */
+    if((!is_multiplex && data->req.download_done) || is_eos) {
+      CURL_REQ_CLEAR_RECV(data);
     }
-
-#ifndef CURL_DISABLE_HTTP
-    /* Since this is a two-state thing, we check if we are parsing
-       headers at the moment or not. */
-    if(k->header) {
-      /* we are in parse-the-header-mode */
-      bool stop_reading = FALSE;
-      result = Curl_http_readwrite_headers(data, conn, &nread, &stop_reading);
-      if(result)
-        goto out;
-
-      if(conn->handler->readwrite &&
-         (k->maxdownload <= 0 && nread > 0)) {
-        result = conn->handler->readwrite(data, conn, &nread, &readmore);
-        if(result)
-          goto out;
-        if(readmore)
-          break;
-      }
-
-      if(stop_reading) {
-        /* We've stopped dealing with input, get out of the do-while loop */
-
-        if(nread > 0) {
-          infof(data,
-                "Excess found:"
-                " excess = %zd"
-                " url = %s (zero-length body)",
-                nread, data->state.up.path);
-        }
-
-        break;
-      }
-    }
-#endif /* CURL_DISABLE_HTTP */
-
-
-    /* This is not an 'else if' since it may be a rest from the header
-       parsing, where the beginning of the buffer is headers and the end
-       is non-headers. */
-    if(!k->header && (nread > 0 || is_empty_data)) {
-
-      if(data->req.no_body) {
-        /* data arrives although we want none, bail out */
-        streamclose(conn, "ignoring body");
-        *done = TRUE;
-        result = CURLE_WEIRD_SERVER_REPLY;
-        goto out;
-      }
-
-#ifndef CURL_DISABLE_HTTP
-      if(0 == k->bodywrites && !is_empty_data) {
-        /* These checks are only made the first time we are about to
-           write a piece of the body */
-        if(conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_RTSP)) {
-          /* HTTP-only checks */
-          result = Curl_http_firstwrite(data, conn, done);
-          if(result || *done)
-            goto out;
-        }
-      } /* this is the first time we write a body part */
-#endif /* CURL_DISABLE_HTTP */
-
-      k->bodywrites++;
-
-      /* pass data to the debug function before it gets "dechunked" */
-      if(data->set.verbose) {
-        if(k->badheader) {
-          Curl_debug(data, CURLINFO_DATA_IN,
-                     Curl_dyn_ptr(&data->state.headerb),
-                     Curl_dyn_len(&data->state.headerb));
-          if(k->badheader == HEADER_PARTHEADER)
-            Curl_debug(data, CURLINFO_DATA_IN,
-                       k->str, (size_t)nread);
-        }
-        else
-          Curl_debug(data, CURLINFO_DATA_IN,
-                     k->str, (size_t)nread);
-      }
-
-#ifndef CURL_DISABLE_HTTP
-      if(k->chunk) {
-        /*
-         * Here comes a chunked transfer flying and we need to decode this
-         * properly.  While the name says read, this function both reads
-         * and writes away the data. The returned 'nread' holds the number
-         * of actual data it wrote to the client.
-         */
-        CURLcode extra;
-        CHUNKcode res =
-          Curl_httpchunk_read(data, k->str, nread, &nread, &extra);
-
-        if(CHUNKE_OK < res) {
-          if(CHUNKE_PASSTHRU_ERROR == res) {
-            failf(data, "Failed reading the chunked-encoded stream");
-            result = extra;
-            goto out;
-          }
-          failf(data, "%s in chunked-encoding", Curl_chunked_strerror(res));
-          result = CURLE_RECV_ERROR;
-          goto out;
-        }
-        if(CHUNKE_STOP == res) {
-          /* we're done reading chunks! */
-          k->keepon &= ~KEEP_RECV; /* read no more */
-
-          /* N number of bytes at the end of the str buffer that weren't
-             written to the client. */
-          if(conn->chunk.datasize) {
-            infof(data, "Leftovers after chunking: % "
-                  CURL_FORMAT_CURL_OFF_T "u bytes",
-                  conn->chunk.datasize);
-          }
-        }
-        /* If it returned OK, we just keep going */
-      }
-#endif   /* CURL_DISABLE_HTTP */
-
-      /* Account for body content stored in the header buffer */
-      if((k->badheader == HEADER_PARTHEADER) && !k->ignorebody) {
-        size_t headlen = Curl_dyn_len(&data->state.headerb);
-        DEBUGF(infof(data, "Increasing bytecount by %zu", headlen));
-        k->bytecount += headlen;
-      }
-
-      if((-1 != k->maxdownload) &&
-         (k->bytecount + nread >= k->maxdownload)) {
-
-        excess = (size_t)(k->bytecount + nread - k->maxdownload);
-        if(excess > 0 && !k->ignorebody) {
-          infof(data,
-                "Excess found in a read:"
-                " excess = %zu"
-                ", size = %" CURL_FORMAT_CURL_OFF_T
-                ", maxdownload = %" CURL_FORMAT_CURL_OFF_T
-                ", bytecount = %" CURL_FORMAT_CURL_OFF_T,
-                excess, k->size, k->maxdownload, k->bytecount);
-          connclose(conn, "excess found in a read");
-        }
-
-        nread = (ssize_t) (k->maxdownload - k->bytecount);
-        if(nread < 0) /* this should be unusual */
-          nread = 0;
-
-        /* HTTP/3 over QUIC should keep reading until QUIC connection
-           is closed.  In contrast to HTTP/2 which can stop reading
-           from TCP connection, HTTP/3 over QUIC needs ACK from server
-           to ensure stream closure.  It should keep reading. */
-        if(!is_http3) {
-          k->keepon &= ~KEEP_RECV; /* we're done reading */
-        }
-      }
-
-      k->bytecount += nread;
-      max_recv -= nread;
-
-      Curl_pgrsSetDownloadCounter(data, k->bytecount);
-
-      if(!k->chunk && (nread || k->badheader || is_empty_data)) {
-        /* If this is chunky transfer, it was already written */
-
-        if(k->badheader && !k->ignorebody) {
-          /* we parsed a piece of data wrongly assuming it was a header
-             and now we output it as body instead */
-          size_t headlen = Curl_dyn_len(&data->state.headerb);
-
-          /* Don't let excess data pollute body writes */
-          if(k->maxdownload == -1 || (curl_off_t)headlen <= k->maxdownload)
-            result = Curl_client_write(data, CLIENTWRITE_BODY,
-                                       Curl_dyn_ptr(&data->state.headerb),
-                                       headlen);
-          else
-            result = Curl_client_write(data, CLIENTWRITE_BODY,
-                                       Curl_dyn_ptr(&data->state.headerb),
-                                       (size_t)k->maxdownload);
-
-          if(result)
-            goto out;
-        }
-        if(k->badheader < HEADER_ALLBAD) {
-          /* This switch handles various content encodings. If there's an
-             error here, be sure to check over the almost identical code
-             in http_chunks.c.
-             Make sure that ALL_CONTENT_ENCODINGS contains all the
-             encodings handled here. */
-          if(data->set.http_ce_skip || !k->writer_stack) {
-            if(!k->ignorebody && nread) {
-#ifndef CURL_DISABLE_POP3
-              if(conn->handler->protocol & PROTO_FAMILY_POP3)
-                result = Curl_pop3_write(data, k->str, nread);
-              else
-#endif /* CURL_DISABLE_POP3 */
-                result = Curl_client_write(data, CLIENTWRITE_BODY, k->str,
-                                           nread);
-            }
-          }
-          else if(!k->ignorebody && nread)
-            result = Curl_unencode_write(data, k->writer_stack, k->str, nread);
-        }
-        k->badheader = HEADER_NORMAL; /* taken care of now */
-
-        if(result)
-          goto out;
-      }
-
-    } /* if(!header and data to read) */
-
-    if(conn->handler->readwrite && excess) {
-      /* Parse the excess data */
-      k->str += nread;
-
-      if(&k->str[excess] > &buf[data->set.buffer_size]) {
-        /* the excess amount was too excessive(!), make sure
-           it doesn't read out of buffer */
-        excess = &buf[data->set.buffer_size] - k->str;
-      }
-      nread = (ssize_t)excess;
-
-      result = conn->handler->readwrite(data, conn, &nread, &readmore);
-      if(result)
-        goto out;
-
-      if(readmore)
-        k->keepon |= KEEP_RECV; /* we're not done reading */
+    /* if we stopped receiving, leave the loop */
+    if(!CURL_REQ_WANT_RECV(data))
       break;
-    }
 
-    if(is_empty_data) {
-      /* if we received nothing, the server closed the connection and we
-         are done */
-      k->keepon &= ~KEEP_RECV;
-    }
+  } while(maxloops--);
 
-    if((k->keepon & KEEP_RECV_PAUSE) || !(k->keepon & KEEP_RECV)) {
-      /* this is a paused or stopped transfer */
-      break;
-    }
-
-  } while((max_recv > 0) && data_pending(data) && maxloops--);
-
-  if(maxloops <= 0 || max_recv <= 0) {
-    /* we mark it as read-again-please */
-    data->state.dselect_bits = CURL_CSELECT_IN;
-    *comeback = TRUE;
+  if(!is_eos && !rate_limited && CURL_REQ_WANT_RECV(data) &&
+     (!rcvd_eagain || data_pending(data, rcvd_eagain))) {
+    /* Did not read until EAGAIN/EOS or there is still data pending
+     * in buffers. Mark as read-again via simulated SELECT results. */
+    Curl_multi_mark_dirty(data);
+    CURL_TRC_M(data, "sendrecv_dl() no EAGAIN/pending data, mark as dirty");
   }
 
-  if(((k->keepon & (KEEP_RECV|KEEP_SEND)) == KEEP_SEND) &&
-     (conn->bits.close || data_eof_handled)) {
-    /* When we've read the entire thing and the close bit is set, the server
-       may now close the connection. If there's now any kind of sending going
+  if(!CURL_REQ_WANT_RECV(data) && CURL_REQ_WANT_SEND(data) &&
+     (conn->bits.close || is_multiplex)) {
+    /* When we have read the entire thing and the close bit is set, the server
+       may now close the connection. If there is now any kind of sending going
        on from our side, we need to stop that immediately. */
     infof(data, "we are done reading and this is set to close, stop send");
-    k->keepon &= ~KEEP_SEND; /* no writing anymore either */
+    Curl_req_abort_sending(data);
   }
 
 out:
+  Curl_multi_xfer_buf_release(data, xfer_buf);
   if(result)
-    DEBUGF(infof(data, "readwrite_data() -> %d", result));
+    DEBUGF(infof(data, "sendrecv_dl() -> %d", (int)result));
   return result;
 }
 
-CURLcode Curl_done_sending(struct Curl_easy *data,
-                           struct SingleRequest *k)
-{
-  k->keepon &= ~KEEP_SEND; /* we're done writing */
-
-  /* These functions should be moved into the handler struct! */
-  Curl_conn_ev_data_done_send(data);
-
-  return CURLE_OK;
-}
-
-#if defined(WIN32) && defined(USE_WINSOCK)
-#ifndef SIO_IDEAL_SEND_BACKLOG_QUERY
-#define SIO_IDEAL_SEND_BACKLOG_QUERY 0x4004747B
-#endif
-
-static void win_update_buffer_size(curl_socket_t sockfd)
-{
-  int result;
-  ULONG ideal;
-  DWORD ideallen;
-  result = WSAIoctl(sockfd, SIO_IDEAL_SEND_BACKLOG_QUERY, 0, 0,
-                    &ideal, sizeof(ideal), &ideallen, 0, 0);
-  if(result == 0) {
-    setsockopt(sockfd, SOL_SOCKET, SO_SNDBUF,
-               (const char *)&ideal, sizeof(ideal));
-  }
-}
-#else
-#define win_update_buffer_size(x)
-#endif
-
-#define curl_upload_refill_watermark(data) \
-        ((ssize_t)((data)->set.upload_buffer_size >> 5))
-
 /*
  * Send data to upload to the server, when the socket is writable.
  */
-static CURLcode readwrite_upload(struct Curl_easy *data,
-                                 struct connectdata *conn,
-                                 int *didwhat)
+static CURLcode sendrecv_ul(struct Curl_easy *data)
 {
-  ssize_t i, si;
-  ssize_t bytes_written;
-  CURLcode result;
-  ssize_t nread; /* number of bytes read */
-  bool sending_http_headers = FALSE;
-  struct SingleRequest *k = &data->req;
-
-  *didwhat |= KEEP_SEND;
-
-  do {
-    curl_off_t nbody;
-    ssize_t offset = 0;
-
-    if(0 != k->upload_present &&
-       k->upload_present < curl_upload_refill_watermark(data) &&
-       !k->upload_chunky &&/*(variable sized chunked header; append not safe)*/
-       !k->upload_done &&  /*!(k->upload_done once k->upload_present sent)*/
-       !(k->writebytecount + k->upload_present - k->pendingheader ==
-         data->state.infilesize)) {
-      offset = k->upload_present;
-    }
-
-    /* only read more data if there's no upload data already
-       present in the upload buffer, or if appending to upload buffer */
-    if(0 == k->upload_present || offset) {
-      result = Curl_get_upload_buffer(data);
-      if(result)
-        return result;
-      if(offset && k->upload_fromhere != data->state.ulbuf)
-        memmove(data->state.ulbuf, k->upload_fromhere, offset);
-      /* init the "upload from here" pointer */
-      k->upload_fromhere = data->state.ulbuf;
-
-      if(!k->upload_done) {
-        /* HTTP pollution, this should be written nicer to become more
-           protocol agnostic. */
-        size_t fillcount;
-        struct HTTP *http = k->p.http;
-
-        if((k->exp100 == EXP100_SENDING_REQUEST) &&
-           (http->sending == HTTPSEND_BODY)) {
-          /* If this call is to send body data, we must take some action:
-             We have sent off the full HTTP 1.1 request, and we shall now
-             go into the Expect: 100 state and await such a header */
-          k->exp100 = EXP100_AWAITING_CONTINUE; /* wait for the header */
-          k->keepon &= ~KEEP_SEND;         /* disable writing */
-          k->start100 = Curl_now();       /* timeout count starts now */
-          *didwhat &= ~KEEP_SEND;  /* we didn't write anything actually */
-          /* set a timeout for the multi interface */
-          Curl_expire(data, data->set.expect_100_timeout, EXPIRE_100_TIMEOUT);
-          break;
-        }
-
-        if(conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_RTSP)) {
-          if(http->sending == HTTPSEND_REQUEST)
-            /* We're sending the HTTP request headers, not the data.
-               Remember that so we don't change the line endings. */
-            sending_http_headers = TRUE;
-          else
-            sending_http_headers = FALSE;
-        }
-
-        k->upload_fromhere += offset;
-        result = Curl_fillreadbuffer(data, data->set.upload_buffer_size-offset,
-                                     &fillcount);
-        k->upload_fromhere -= offset;
-        if(result)
-          return result;
-
-        nread = offset + fillcount;
-      }
-      else
-        nread = 0; /* we're done uploading/reading */
-
-      if(!nread && (k->keepon & KEEP_SEND_PAUSE)) {
-        /* this is a paused transfer */
-        break;
-      }
-      if(nread <= 0) {
-        result = Curl_done_sending(data, k);
-        if(result)
-          return result;
-        break;
-      }
-
-      /* store number of bytes available for upload */
-      k->upload_present = nread;
-
-      /* convert LF to CRLF if so asked */
-      if((!sending_http_headers) && (
-#ifdef CURL_DO_LINEEND_CONV
-         /* always convert if we're FTPing in ASCII mode */
-         (data->state.prefer_ascii) ||
-#endif
-         (data->set.crlf))) {
-        /* Do we need to allocate a scratch buffer? */
-        if(!data->state.scratch) {
-          data->state.scratch = malloc(2 * data->set.upload_buffer_size);
-          if(!data->state.scratch) {
-            failf(data, "Failed to alloc scratch buffer");
-
-            return CURLE_OUT_OF_MEMORY;
-          }
-        }
-
-        /*
-         * ASCII/EBCDIC Note: This is presumably a text (not binary)
-         * transfer so the data should already be in ASCII.
-         * That means the hex values for ASCII CR (0x0d) & LF (0x0a)
-         * must be used instead of the escape sequences \r & \n.
-         */
-        if(offset)
-          memcpy(data->state.scratch, k->upload_fromhere, offset);
-        for(i = offset, si = offset; i < nread; i++, si++) {
-          if(k->upload_fromhere[i] == 0x0a) {
-            data->state.scratch[si++] = 0x0d;
-            data->state.scratch[si] = 0x0a;
-            if(!data->set.crlf) {
-              /* we're here only because FTP is in ASCII mode...
-                 bump infilesize for the LF we just added */
-              if(data->state.infilesize != -1)
-                data->state.infilesize++;
-            }
-          }
-          else
-            data->state.scratch[si] = k->upload_fromhere[i];
-        }
-
-        if(si != nread) {
-          /* only perform the special operation if we really did replace
-             anything */
-          nread = si;
-
-          /* upload from the new (replaced) buffer instead */
-          k->upload_fromhere = data->state.scratch;
-
-          /* set the new amount too */
-          k->upload_present = nread;
-        }
-      }
-
-#ifndef CURL_DISABLE_SMTP
-      if(conn->handler->protocol & PROTO_FAMILY_SMTP) {
-        result = Curl_smtp_escape_eob(data, nread, offset);
-        if(result)
-          return result;
-      }
-#endif /* CURL_DISABLE_SMTP */
-    } /* if 0 == k->upload_present or appended to upload buffer */
-    else {
-      /* We have a partial buffer left from a previous "round". Use
-         that instead of reading more data */
-    }
-
-    /* write to socket (send away data) */
-    result = Curl_write(data,
-                        conn->writesockfd,  /* socket to send to */
-                        k->upload_fromhere, /* buffer pointer */
-                        k->upload_present,  /* buffer size */
-                        &bytes_written);    /* actually sent */
-    if(result)
-      return result;
-
-#if defined(WIN32) && defined(USE_WINSOCK)
-    {
-      struct curltime n = Curl_now();
-      if(Curl_timediff(n, k->last_sndbuf_update) > 1000) {
-        win_update_buffer_size(conn->writesockfd);
-        k->last_sndbuf_update = n;
-      }
-    }
-#endif
-
-    if(k->pendingheader) {
-      /* parts of what was sent was header */
-      curl_off_t n = CURLMIN(k->pendingheader, bytes_written);
-      /* show the data before we change the pointer upload_fromhere */
-      Curl_debug(data, CURLINFO_HEADER_OUT, k->upload_fromhere, (size_t)n);
-      k->pendingheader -= n;
-      nbody = bytes_written - n; /* size of the written body part */
-    }
-    else
-      nbody = bytes_written;
-
-    if(nbody) {
-      /* show the data before we change the pointer upload_fromhere */
-      Curl_debug(data, CURLINFO_DATA_OUT,
-                 &k->upload_fromhere[bytes_written - nbody],
-                 (size_t)nbody);
-
-      k->writebytecount += nbody;
-      Curl_pgrsSetUploadCounter(data, k->writebytecount);
-    }
-
-    if((!k->upload_chunky || k->forbidchunk) &&
-       (k->writebytecount == data->state.infilesize)) {
-      /* we have sent all data we were supposed to */
-      k->upload_done = TRUE;
-      infof(data, "We are completely uploaded and fine");
-    }
-
-    if(k->upload_present != bytes_written) {
-      /* we only wrote a part of the buffer (if anything), deal with it! */
-
-      /* store the amount of bytes left in the buffer to write */
-      k->upload_present -= bytes_written;
-
-      /* advance the pointer where to find the buffer when the next send
-         is to happen */
-      k->upload_fromhere += bytes_written;
-    }
-    else {
-      /* we've uploaded that buffer now */
-      result = Curl_get_upload_buffer(data);
-      if(result)
-        return result;
-      k->upload_fromhere = data->state.ulbuf;
-      k->upload_present = 0; /* no more bytes left */
-
-      if(k->upload_done) {
-        result = Curl_done_sending(data, k);
-        if(result)
-          return result;
-      }
-    }
-
-
-  } while(0); /* just to break out from! */
+  /* We should not get here when the sending is already done. */
+  DEBUGASSERT(!Curl_req_done_sending(data));
 
+  if(!Curl_req_done_sending(data))
+    return Curl_req_send_more(data);
   return CURLE_OK;
 }
 
 /*
- * Curl_readwrite() is the low-level function to be called when data is to
+ * Curl_sendrecv() is the low-level function to be called when data is to
  * be read and written to/from the connection.
- *
- * return '*comeback' TRUE if we didn't properly drain the socket so this
- * function should get called again without select() or similar in between!
  */
-CURLcode Curl_readwrite(struct connectdata *conn,
-                        struct Curl_easy *data,
-                        bool *done,
-                        bool *comeback)
+CURLcode Curl_sendrecv(struct Curl_easy *data)
 {
   struct SingleRequest *k = &data->req;
-  CURLcode result;
-  struct curltime now;
-  int didwhat = 0;
-  int select_bits;
+  CURLcode result = CURLE_OK;
 
-
-  if(data->state.dselect_bits) {
-    select_bits = data->state.dselect_bits;
-    data->state.dselect_bits = 0;
-  }
-  else if(conn->cselect_bits) {
-    select_bits = conn->cselect_bits;
-    conn->cselect_bits = 0;
-  }
-  else {
-    curl_socket_t fd_read;
-    curl_socket_t fd_write;
-    /* only use the proper socket if the *_HOLD bit is not set simultaneously
-       as then we are in rate limiting state in that transfer direction */
-    if((k->keepon & KEEP_RECVBITS) == KEEP_RECV)
-      fd_read = conn->sockfd;
-    else
-      fd_read = CURL_SOCKET_BAD;
-
-    if((k->keepon & KEEP_SENDBITS) == KEEP_SEND)
-      fd_write = conn->writesockfd;
-    else
-      fd_write = CURL_SOCKET_BAD;
-
-    select_bits = Curl_socket_check(fd_read, CURL_SOCKET_BAD, fd_write, 0);
-  }
-
-  if(select_bits == CURL_CSELECT_ERR) {
-    failf(data, "select/poll returned error");
-    result = CURLE_SEND_ERROR;
+  if(Curl_xfer_is_blocked(data)) {
+    result = CURLE_OK;
     goto out;
   }
 
-#ifdef USE_HYPER
-  if(conn->datastream) {
-    result = conn->datastream(data, conn, &didwhat, done, select_bits);
-    if(result || *done)
-      goto out;
-  }
-  else {
-#endif
-  /* We go ahead and do a read if we have a readable socket or if
-     the stream was rewound (in which case we have data in a
-     buffer) */
-  if((k->keepon & KEEP_RECV) && (select_bits & CURL_CSELECT_IN)) {
-    result = readwrite_data(data, conn, k, &didwhat, done, comeback);
-    if(result || *done)
+  /* We go ahead and do a read if we have a readable socket or if the stream
+     was rewound (in which case we have data in a buffer) */
+  if(CURL_REQ_WANT_RECV(data)) {
+    result = sendrecv_dl(data, k);
+    if(result || data->req.done)
       goto out;
   }
 
   /* If we still have writing to do, we check if we have a writable socket. */
-  if((k->keepon & KEEP_SEND) && (select_bits & CURL_CSELECT_OUT)) {
-    /* write */
-
-    result = readwrite_upload(data, conn, &didwhat);
-    if(result)
-      goto out;
-  }
-#ifdef USE_HYPER
-  }
-#endif
-
-  now = Curl_now();
-  if(!didwhat) {
-    /* no read no write, this is a timeout? */
-    if(k->exp100 == EXP100_AWAITING_CONTINUE) {
-      /* This should allow some time for the header to arrive, but only a
-         very short time as otherwise it'll be too much wasted time too
-         often. */
-
-      /* Quoting RFC2616, section "8.2.3 Use of the 100 (Continue) Status":
-
-         Therefore, when a client sends this header field to an origin server
-         (possibly via a proxy) from which it has never seen a 100 (Continue)
-         status, the client SHOULD NOT wait for an indefinite period before
-         sending the request body.
-
-      */
-
-      timediff_t ms = Curl_timediff(now, k->start100);
-      if(ms >= data->set.expect_100_timeout) {
-        /* we've waited long enough, continue anyway */
-        k->exp100 = EXP100_SEND_DATA;
-        k->keepon |= KEEP_SEND;
-        Curl_expire_done(data, EXPIRE_100_TIMEOUT);
-        infof(data, "Done waiting for 100-continue");
-      }
-    }
-
-    result = Curl_conn_ev_data_idle(data);
+  if(Curl_req_want_send(data)) {
+    result = sendrecv_ul(data);
     if(result)
       goto out;
   }
 
-  if(Curl_pgrsUpdate(data))
-    result = CURLE_ABORTED_BY_CALLBACK;
-  else
-    result = Curl_speedcheck(data, now);
+  result = Curl_pgrsCheck(data);
   if(result)
     goto out;
 
-  if(k->keepon) {
-    if(0 > Curl_timeleft(data, &now, FALSE)) {
+  if(CURL_REQ_WANT_IO(data)) {
+    if(Curl_timeleft_ms(data) < 0) {
       if(k->size != -1) {
-        failf(data, "Operation timed out after %" CURL_FORMAT_TIMEDIFF_T
-              " milliseconds with %" CURL_FORMAT_CURL_OFF_T " out of %"
-              CURL_FORMAT_CURL_OFF_T " bytes received",
-              Curl_timediff(now, data->progress.t_startsingle),
+        failf(data, "Operation timed out after %" FMT_TIMEDIFF_T
+              " milliseconds with %" FMT_OFF_T " out of %"
+              FMT_OFF_T " bytes received",
+              curlx_ptimediff_ms(Curl_pgrs_now(data),
+                                 &data->progress.t_startsingle),
               k->bytecount, k->size);
       }
       else {
-        failf(data, "Operation timed out after %" CURL_FORMAT_TIMEDIFF_T
-              " milliseconds with %" CURL_FORMAT_CURL_OFF_T " bytes received",
-              Curl_timediff(now, data->progress.t_startsingle),
+        failf(data, "Operation timed out after %" FMT_TIMEDIFF_T
+              " milliseconds with %" FMT_OFF_T " bytes received",
+              curlx_ptimediff_ms(Curl_pgrs_now(data),
+                                 &data->progress.t_startsingle),
               k->bytecount);
       }
       result = CURLE_OPERATION_TIMEDOUT;
@@ -1190,100 +405,30 @@ CURLcode Curl_readwrite(struct connectdata *conn,
   }
   else {
     /*
-     * The transfer has been performed. Just make some general checks before
+     * The transfer has been performed. Make some general checks before
      * returning.
      */
-
     if(!(data->req.no_body) && (k->size != -1) &&
-       (k->bytecount != k->size) &&
-#ifdef CURL_DO_LINEEND_CONV
-       /* Most FTP servers don't adjust their file SIZE response for CRLFs,
-          so we'll check to see if the discrepancy can be explained
-          by the number of CRLFs we've changed to LFs.
-       */
-       (k->bytecount != (k->size + data->state.crlf_conversions)) &&
-#endif /* CURL_DO_LINEEND_CONV */
-       !k->newurl) {
-      failf(data, "transfer closed with %" CURL_FORMAT_CURL_OFF_T
+       (k->bytecount != k->size) && !k->newurl) {
+      failf(data, "transfer closed with %" FMT_OFF_T
             " bytes remaining to read", k->size - k->bytecount);
       result = CURLE_PARTIAL_FILE;
       goto out;
     }
-    if(!(data->req.no_body) && k->chunk &&
-       (conn->chunk.state != CHUNK_STOP)) {
-      /*
-       * In chunked mode, return an error if the connection is closed prior to
-       * the empty (terminating) chunk is read.
-       *
-       * The condition above used to check for
-       * conn->proto.http->chunk.datasize != 0 which is true after reading
-       * *any* chunk, not just the empty chunk.
-       *
-       */
-      failf(data, "transfer closed with outstanding read data remaining");
-      result = CURLE_PARTIAL_FILE;
-      goto out;
-    }
-    if(Curl_pgrsUpdate(data)) {
-      result = CURLE_ABORTED_BY_CALLBACK;
-      goto out;
-    }
   }
 
-  /* Now update the "done" boolean we return */
-  *done = (0 == (k->keepon&(KEEP_RECVBITS|KEEP_SENDBITS))) ? TRUE : FALSE;
+  /* If there is nothing more to send/recv, the request is done */
+  if(!CURL_REQ_WANT_IO(data))
+    data->req.done = TRUE;
+
+  result = Curl_pgrsUpdate(data);
+
 out:
   if(result)
-    DEBUGF(infof(data, "Curl_readwrite() -> %d", result));
+    DEBUGF(infof(data, "Curl_sendrecv() -> %d", (int)result));
   return result;
 }
 
-/*
- * Curl_single_getsock() gets called by the multi interface code when the app
- * has requested to get the sockets for the current connection. This function
- * will then be called once for every connection that the multi interface
- * keeps track of. This function will only be called for connections that are
- * in the proper state to have this information available.
- */
-int Curl_single_getsock(struct Curl_easy *data,
-                        struct connectdata *conn,
-                        curl_socket_t *sock)
-{
-  int bitmap = GETSOCK_BLANK;
-  unsigned sockindex = 0;
-
-  if(conn->handler->perform_getsock)
-    return conn->handler->perform_getsock(data, conn, sock);
-
-  /* don't include HOLD and PAUSE connections */
-  if((data->req.keepon & KEEP_RECVBITS) == KEEP_RECV) {
-
-    DEBUGASSERT(conn->sockfd != CURL_SOCKET_BAD);
-
-    bitmap |= GETSOCK_READSOCK(sockindex);
-    sock[sockindex] = conn->sockfd;
-  }
-
-  /* don't include HOLD and PAUSE connections */
-  if((data->req.keepon & KEEP_SENDBITS) == KEEP_SEND) {
-    if((conn->sockfd != conn->writesockfd) ||
-       bitmap == GETSOCK_BLANK) {
-      /* only if they are not the same socket and we have a readable
-         one, we increase index */
-      if(bitmap != GETSOCK_BLANK)
-        sockindex++; /* increase index if we need two entries */
-
-      DEBUGASSERT(conn->writesockfd != CURL_SOCKET_BAD);
-
-      sock[sockindex] = conn->writesockfd;
-    }
-
-    bitmap |= GETSOCK_WRITESOCK(sockindex);
-  }
-
-  return bitmap;
-}
-
 /* Curl_init_CONNECT() gets called each time the handle switches to CONNECT
    which means this gets called once for each subsequent redirect etc */
 void Curl_init_CONNECT(struct Curl_easy *data)
@@ -1300,34 +445,41 @@ void Curl_init_CONNECT(struct Curl_easy *data)
  */
 CURLcode Curl_pretransfer(struct Curl_easy *data)
 {
-  CURLcode result;
+  CURLcode result = CURLE_OK;
 
-  if(!data->state.url && !data->set.uh) {
-    /* we can't do anything without URL */
+  /* Reset the retry count at the start of each request.
+   * If the retry count is not reset, when the connection drops,
+   * it will not enter the retry mechanism on CONN_MAX_RETRIES + 1 attempts
+   * and will immediately throw
+   * "Connection died, tried CONN_MAX_RETRIES times before giving up".
+   * By resetting it here, we ensure each new request starts fresh. */
+  data->state.retrycount = 0;
+
+  if(!data->set.str[STRING_SET_URL] && !data->set.uh) {
+    /* we cannot do anything without URL */
     failf(data, "No URL set");
     return CURLE_URL_MALFORMAT;
   }
 
-  /* since the URL may have been redirected in a previous use of this handle */
-  if(data->state.url_alloc) {
-    /* the already set URL is allocated, free it first! */
-    Curl_safefree(data->state.url);
-    data->state.url_alloc = FALSE;
-  }
-
-  if(!data->state.url && data->set.uh) {
+  /* CURLOPT_CURLU overrides CURLOPT_URL and the contents of the CURLU handle
+     is allowed to be changed by the user between transfers */
+  if(data->set.uh) {
     CURLUcode uc;
-    free(data->set.str[STRING_SET_URL]);
+    curlx_free(data->set.str[STRING_SET_URL]);
     uc = curl_url_get(data->set.uh,
                       CURLUPART_URL, &data->set.str[STRING_SET_URL], 0);
     if(uc) {
+      /* clear the pointer to not point to freed memory anymore */
+      Curl_bufref_set(&data->state.url, NULL, 0, NULL);
       failf(data, "No URL set");
       return CURLE_URL_MALFORMAT;
     }
   }
 
+  Curl_bufref_set(&data->state.url, data->set.str[STRING_SET_URL], 0, NULL);
+
   if(data->set.postfields && data->set.set_resume_from) {
-    /* we can't */
+    /* we cannot */
     failf(data, "cannot mix POSTFIELDS with RESUME_FROM");
     return CURLE_BAD_FUNCTION_ARGUMENT;
   }
@@ -1337,26 +489,31 @@ CURLcode Curl_pretransfer(struct Curl_easy *data)
   data->state.list_only = data->set.list_only;
 #endif
   data->state.httpreq = data->set.method;
-  data->state.url = data->set.str[STRING_SET_URL];
-
-  /* Init the SSL session ID cache here. We do it here since we want to do it
-     after the *_setopt() calls (that could specify the size of the cache) but
-     before any transfer takes place. */
-  result = Curl_ssl_initsessions(data, data->set.general_ssl.max_ssl_sessions);
-  if(result)
-    return result;
 
+  /* initial transfer request coming up, forget the initial origin
+   * from a previous perform() on this handle. */
+  Curl_peer_unlink(&data->state.initial_origin);
+  Curl_peer_unlink(&data->state.origin);
   data->state.requests = 0;
   data->state.followlocation = 0; /* reset the location-follow counter */
   data->state.this_is_a_follow = FALSE; /* reset this */
+  data->state.http_ignorecustom = FALSE; /* use custom HTTP method */
   data->state.errorbuf = FALSE; /* no error has occurred */
-  data->state.httpwant = data->set.httpwant;
-  data->state.httpversion = 0;
+#ifndef CURL_DISABLE_HTTP
+  Curl_http_neg_init(data, &data->state.http_neg);
+#endif
   data->state.authproblem = FALSE;
   data->state.authhost.want = data->set.httpauth;
   data->state.authproxy.want = data->set.proxyauth;
-  Curl_safefree(data->info.wouldredirect);
+  curlx_safefree(data->info.wouldredirect);
   Curl_data_priority_clear_state(data);
+  if(data->set.http_auto_referer)
+    Curl_bufref_free(&data->state.referer);
+  if(data->set.str[STRING_SET_REFERER])
+    Curl_bufref_set(&data->state.referer, data->set.str[STRING_SET_REFERER],
+                    0, NULL);
+  else
+    Curl_bufref_free(&data->state.referer);
 
   if(data->state.httpreq == HTTPREQ_PUT)
     data->state.infilesize = data->set.filesize;
@@ -1370,14 +527,17 @@ CURLcode Curl_pretransfer(struct Curl_easy *data)
     data->state.infilesize = 0;
 
   /* If there is a list of cookie files to read, do it now! */
-  Curl_cookie_loadfiles(data);
+  result = Curl_cookie_loadfiles(data);
+  if(!result)
+    Curl_cookie_run(data); /* activate */
 
   /* If there is a list of host pairs to deal with */
-  if(data->state.resolve)
+  if(!result && data->state.resolve)
     result = Curl_loadhostpairs(data);
 
-  /* If there is a list of hsts files to read */
-  Curl_hsts_loadfiles(data);
+  if(!result)
+    /* If there is a list of hsts files to read */
+    result = Curl_hsts_loadfiles(data);
 
   if(!result) {
     /* Allow data->set.use_port to set which port to use. This needs to be
@@ -1385,7 +545,7 @@ CURLcode Curl_pretransfer(struct Curl_easy *data)
      * different ports! */
     data->state.allow_port = TRUE;
 
-#if defined(HAVE_SIGNAL) && defined(SIGPIPE) && !defined(HAVE_MSG_NOSIGNAL)
+#if defined(HAVE_SIGNAL) && defined(SIGPIPE) && !defined(MSG_NOSIGNAL)
     /*************************************************************
      * Tell signal handler to ignore SIGPIPE
      *************************************************************/
@@ -1408,20 +568,17 @@ CURLcode Curl_pretransfer(struct Curl_easy *data)
     if(data->state.wildcardmatch) {
       struct WildcardData *wc;
       if(!data->wildcard) {
-        data->wildcard = calloc(1, sizeof(struct WildcardData));
+        data->wildcard = curlx_calloc(1, sizeof(struct WildcardData));
         if(!data->wildcard)
           return CURLE_OUT_OF_MEMORY;
       }
       wc = data->wildcard;
-      if((wc->state < CURLWC_INIT) ||
-         (wc->state >= CURLWC_CLEAN)) {
+      if(wc->state < CURLWC_INIT) {
         if(wc->ftpwc)
           wc->dtor(wc->ftpwc);
-        Curl_safefree(wc->pattern);
-        Curl_safefree(wc->path);
-        result = Curl_wildcard_init(wc); /* init wildcard structures */
-        if(result)
-          return CURLE_OUT_OF_MEMORY;
+        curlx_safefree(wc->pattern);
+        curlx_safefree(wc->path);
+        Curl_wildcard_init(wc); /* init wildcard structures */
       }
     }
 #endif
@@ -1430,359 +587,41 @@ CURLcode Curl_pretransfer(struct Curl_easy *data)
 
   /*
    * Set user-agent. Used for HTTP, but since we can attempt to tunnel
-   * basically anything through an HTTP proxy we can't limit this based on
-   * protocol.
+   * anything through an HTTP proxy we cannot limit this based on protocol.
    */
-  if(data->set.str[STRING_USERAGENT]) {
-    Curl_safefree(data->state.aptr.uagent);
+  if(!result && data->set.str[STRING_USERAGENT]) {
+    curlx_free(data->state.aptr.uagent);
     data->state.aptr.uagent =
-      aprintf("User-Agent: %s\r\n", data->set.str[STRING_USERAGENT]);
+      curl_maprintf("User-Agent: %s\r\n", data->set.str[STRING_USERAGENT]);
     if(!data->state.aptr.uagent)
       return CURLE_OUT_OF_MEMORY;
   }
 
-  if(!result)
-    result = Curl_setstropt(&data->state.aptr.user,
-                            data->set.str[STRING_USERNAME]);
-  if(!result)
-    result = Curl_setstropt(&data->state.aptr.passwd,
-                            data->set.str[STRING_PASSWORD]);
-  if(!result)
-    result = Curl_setstropt(&data->state.aptr.proxyuser,
-                            data->set.str[STRING_PROXYUSERNAME]);
-  if(!result)
-    result = Curl_setstropt(&data->state.aptr.proxypasswd,
-                            data->set.str[STRING_PROXYPASSWORD]);
-
   data->req.headerbytecount = 0;
   Curl_headers_cleanup(data);
   return result;
 }
 
-/*
- * Curl_posttransfer() is called immediately after a transfer ends
- */
-CURLcode Curl_posttransfer(struct Curl_easy *data)
-{
-#if defined(HAVE_SIGNAL) && defined(SIGPIPE) && !defined(HAVE_MSG_NOSIGNAL)
-  /* restore the signal handler for SIGPIPE before we get back */
-  if(!data->set.no_signal)
-    signal(SIGPIPE, data->state.prev_signal);
-#else
-  (void)data; /* unused parameter */
-#endif
-
-  return CURLE_OK;
-}
-
-/*
- * Curl_follow() handles the URL redirect magic. Pass in the 'newurl' string
- * as given by the remote server and set up the new URL to request.
- *
- * This function DOES NOT FREE the given url.
- */
-CURLcode Curl_follow(struct Curl_easy *data,
-                     char *newurl,    /* the Location: string */
-                     followtype type) /* see transfer.h */
-{
-#ifdef CURL_DISABLE_HTTP
-  (void)data;
-  (void)newurl;
-  (void)type;
-  /* Location: following will not happen when HTTP is disabled */
-  return CURLE_TOO_MANY_REDIRECTS;
-#else
-
-  /* Location: redirect */
-  bool disallowport = FALSE;
-  bool reachedmax = FALSE;
-  CURLUcode uc;
-
-  DEBUGASSERT(type != FOLLOW_NONE);
-
-  if(type != FOLLOW_FAKE)
-    data->state.requests++; /* count all real follows */
-  if(type == FOLLOW_REDIR) {
-    if((data->set.maxredirs != -1) &&
-       (data->state.followlocation >= data->set.maxredirs)) {
-      reachedmax = TRUE;
-      type = FOLLOW_FAKE; /* switch to fake to store the would-be-redirected
-                             to URL */
-    }
-    else {
-      data->state.followlocation++; /* count redirect-followings, including
-                                       auth reloads */
-
-      if(data->set.http_auto_referer) {
-        CURLU *u;
-        char *referer = NULL;
-
-        /* We are asked to automatically set the previous URL as the referer
-           when we get the next URL. We pick the ->url field, which may or may
-           not be 100% correct */
-
-        if(data->state.referer_alloc) {
-          Curl_safefree(data->state.referer);
-          data->state.referer_alloc = FALSE;
-        }
-
-        /* Make a copy of the URL without credentials and fragment */
-        u = curl_url();
-        if(!u)
-          return CURLE_OUT_OF_MEMORY;
-
-        uc = curl_url_set(u, CURLUPART_URL, data->state.url, 0);
-        if(!uc)
-          uc = curl_url_set(u, CURLUPART_FRAGMENT, NULL, 0);
-        if(!uc)
-          uc = curl_url_set(u, CURLUPART_USER, NULL, 0);
-        if(!uc)
-          uc = curl_url_set(u, CURLUPART_PASSWORD, NULL, 0);
-        if(!uc)
-          uc = curl_url_get(u, CURLUPART_URL, &referer, 0);
-
-        curl_url_cleanup(u);
-
-        if(uc || !referer)
-          return CURLE_OUT_OF_MEMORY;
-
-        data->state.referer = referer;
-        data->state.referer_alloc = TRUE; /* yes, free this later */
-      }
-    }
-  }
-
-  if((type != FOLLOW_RETRY) &&
-     (data->req.httpcode != 401) && (data->req.httpcode != 407) &&
-     Curl_is_absolute_url(newurl, NULL, 0, FALSE)) {
-    /* If this is not redirect due to a 401 or 407 response and an absolute
-       URL: don't allow a custom port number */
-    disallowport = TRUE;
-  }
-
-  DEBUGASSERT(data->state.uh);
-  uc = curl_url_set(data->state.uh, CURLUPART_URL, newurl,
-                    (type == FOLLOW_FAKE) ? CURLU_NON_SUPPORT_SCHEME :
-                    ((type == FOLLOW_REDIR) ? CURLU_URLENCODE : 0) |
-                    CURLU_ALLOW_SPACE |
-                    (data->set.path_as_is ? CURLU_PATH_AS_IS : 0));
-  if(uc) {
-    if(type != FOLLOW_FAKE) {
-      failf(data, "The redirect target URL could not be parsed: %s",
-            curl_url_strerror(uc));
-      return Curl_uc_to_curlcode(uc);
-    }
-
-    /* the URL could not be parsed for some reason, but since this is FAKE
-       mode, just duplicate the field as-is */
-    newurl = strdup(newurl);
-    if(!newurl)
-      return CURLE_OUT_OF_MEMORY;
-  }
-  else {
-    uc = curl_url_get(data->state.uh, CURLUPART_URL, &newurl, 0);
-    if(uc)
-      return Curl_uc_to_curlcode(uc);
-
-    /* Clear auth if this redirects to a different port number or protocol,
-       unless permitted */
-    if(!data->set.allow_auth_to_other_hosts && (type != FOLLOW_FAKE)) {
-      char *portnum;
-      int port;
-      bool clear = FALSE;
-
-      if(data->set.use_port && data->state.allow_port)
-        /* a custom port is used */
-        port = (int)data->set.use_port;
-      else {
-        uc = curl_url_get(data->state.uh, CURLUPART_PORT, &portnum,
-                          CURLU_DEFAULT_PORT);
-        if(uc) {
-          free(newurl);
-          return Curl_uc_to_curlcode(uc);
-        }
-        port = atoi(portnum);
-        free(portnum);
-      }
-      if(port != data->info.conn_remote_port) {
-        infof(data, "Clear auth, redirects to port from %u to %u",
-              data->info.conn_remote_port, port);
-        clear = TRUE;
-      }
-      else {
-        char *scheme;
-        const struct Curl_handler *p;
-        uc = curl_url_get(data->state.uh, CURLUPART_SCHEME, &scheme, 0);
-        if(uc) {
-          free(newurl);
-          return Curl_uc_to_curlcode(uc);
-        }
-
-        p = Curl_builtin_scheme(scheme, CURL_ZERO_TERMINATED);
-        if(p && (p->protocol != data->info.conn_protocol)) {
-          infof(data, "Clear auth, redirects scheme from %s to %s",
-                data->info.conn_scheme, scheme);
-          clear = TRUE;
-        }
-        free(scheme);
-      }
-      if(clear) {
-        Curl_safefree(data->state.aptr.user);
-        Curl_safefree(data->state.aptr.passwd);
-      }
-    }
-  }
-
-  if(type == FOLLOW_FAKE) {
-    /* we're only figuring out the new url if we would've followed locations
-       but now we're done so we can get out! */
-    data->info.wouldredirect = newurl;
-
-    if(reachedmax) {
-      failf(data, "Maximum (%ld) redirects followed", data->set.maxredirs);
-      return CURLE_TOO_MANY_REDIRECTS;
-    }
-    return CURLE_OK;
-  }
-
-  if(disallowport)
-    data->state.allow_port = FALSE;
-
-  if(data->state.url_alloc)
-    Curl_safefree(data->state.url);
-
-  data->state.url = newurl;
-  data->state.url_alloc = TRUE;
-
-  infof(data, "Issue another request to this URL: '%s'", data->state.url);
-
-  /*
-   * We get here when the HTTP code is 300-399 (and 401). We need to perform
-   * differently based on exactly what return code there was.
-   *
-   * News from 7.10.6: we can also get here on a 401 or 407, in case we act on
-   * an HTTP (proxy-) authentication scheme other than Basic.
-   */
-  switch(data->info.httpcode) {
-    /* 401 - Act on a WWW-Authenticate, we keep on moving and do the
-       Authorization: XXXX header in the HTTP request code snippet */
-    /* 407 - Act on a Proxy-Authenticate, we keep on moving and do the
-       Proxy-Authorization: XXXX header in the HTTP request code snippet */
-    /* 300 - Multiple Choices */
-    /* 306 - Not used */
-    /* 307 - Temporary Redirect */
-  default:  /* for all above (and the unknown ones) */
-    /* Some codes are explicitly mentioned since I've checked RFC2616 and they
-     * seem to be OK to POST to.
-     */
-    break;
-  case 301: /* Moved Permanently */
-    /* (quote from RFC7231, section 6.4.2)
-     *
-     * Note: For historical reasons, a user agent MAY change the request
-     * method from POST to GET for the subsequent request.  If this
-     * behavior is undesired, the 307 (Temporary Redirect) status code
-     * can be used instead.
-     *
-     * ----
-     *
-     * Many webservers expect this, so these servers often answers to a POST
-     * request with an error page. To be sure that libcurl gets the page that
-     * most user agents would get, libcurl has to force GET.
-     *
-     * This behavior is forbidden by RFC1945 and the obsolete RFC2616, and
-     * can be overridden with CURLOPT_POSTREDIR.
-     */
-    if((data->state.httpreq == HTTPREQ_POST
-        || data->state.httpreq == HTTPREQ_POST_FORM
-        || data->state.httpreq == HTTPREQ_POST_MIME)
-       && !(data->set.keep_post & CURL_REDIR_POST_301)) {
-      infof(data, "Switch from POST to GET");
-      data->state.httpreq = HTTPREQ_GET;
-    }
-    break;
-  case 302: /* Found */
-    /* (quote from RFC7231, section 6.4.3)
-     *
-     * Note: For historical reasons, a user agent MAY change the request
-     * method from POST to GET for the subsequent request.  If this
-     * behavior is undesired, the 307 (Temporary Redirect) status code
-     * can be used instead.
-     *
-     * ----
-     *
-     * Many webservers expect this, so these servers often answers to a POST
-     * request with an error page. To be sure that libcurl gets the page that
-     * most user agents would get, libcurl has to force GET.
-     *
-     * This behavior is forbidden by RFC1945 and the obsolete RFC2616, and
-     * can be overridden with CURLOPT_POSTREDIR.
-     */
-    if((data->state.httpreq == HTTPREQ_POST
-        || data->state.httpreq == HTTPREQ_POST_FORM
-        || data->state.httpreq == HTTPREQ_POST_MIME)
-       && !(data->set.keep_post & CURL_REDIR_POST_302)) {
-      infof(data, "Switch from POST to GET");
-      data->state.httpreq = HTTPREQ_GET;
-    }
-    break;
-
-  case 303: /* See Other */
-    /* 'See Other' location is not the resource but a substitute for the
-     * resource. In this case we switch the method to GET/HEAD, unless the
-     * method is POST and the user specified to keep it as POST.
-     * https://github.com/curl/curl/issues/5237#issuecomment-614641049
-     */
-    if(data->state.httpreq != HTTPREQ_GET &&
-       ((data->state.httpreq != HTTPREQ_POST &&
-         data->state.httpreq != HTTPREQ_POST_FORM &&
-         data->state.httpreq != HTTPREQ_POST_MIME) ||
-        !(data->set.keep_post & CURL_REDIR_POST_303))) {
-      data->state.httpreq = HTTPREQ_GET;
-      infof(data, "Switch to %s",
-            data->req.no_body?"HEAD":"GET");
-    }
-    break;
-  case 304: /* Not Modified */
-    /* 304 means we did a conditional request and it was "Not modified".
-     * We shouldn't get any Location: header in this response!
-     */
-    break;
-  case 305: /* Use Proxy */
-    /* (quote from RFC2616, section 10.3.6):
-     * "The requested resource MUST be accessed through the proxy given
-     * by the Location field. The Location field gives the URI of the
-     * proxy.  The recipient is expected to repeat this single request
-     * via the proxy. 305 responses MUST only be generated by origin
-     * servers."
-     */
-    break;
-  }
-  Curl_pgrsTime(data, TIMER_REDIRECT);
-  Curl_pgrsResetTransferSizes(data);
-
-  return CURLE_OK;
-#endif /* CURL_DISABLE_HTTP */
-}
-
 /* Returns CURLE_OK *and* sets '*url' if a request retry is wanted.
 
-   NOTE: that the *url is malloc()ed. */
+   NOTE: that the *url is curlx_malloc()ed. */
 CURLcode Curl_retry_request(struct Curl_easy *data, char **url)
 {
   struct connectdata *conn = data->conn;
   bool retry = FALSE;
   *url = NULL;
 
-  /* if we're talking upload, we can't do the checks below, unless the protocol
-     is HTTP as when uploading over HTTP we will still get a response */
+  /* if we are talking upload, we cannot do the checks below, unless the
+     protocol is HTTP as when uploading over HTTP we will still get a
+     response */
   if(data->state.upload &&
-     !(conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_RTSP)))
+     !(conn->scheme->protocol & (PROTO_FAMILY_HTTP | CURLPROTO_RTSP)))
     return CURLE_OK;
 
-  if((data->req.bytecount + data->req.headerbytecount == 0) &&
-     conn->bits.reuse &&
-     (!data->req.no_body || (conn->handler->protocol & PROTO_FAMILY_HTTP))
+  if(conn->bits.reuse &&
+     (data->req.bytecount + data->req.headerbytecount == 0) &&
+     ((!data->req.no_body && !data->req.done) ||
+      (conn->scheme->protocol & PROTO_FAMILY_HTTP))
 #ifndef CURL_DISABLE_RTSP
      && (data->set.rtspreq != RTSPREQ_RECEIVE)
 #endif
@@ -1796,7 +635,7 @@ CURLcode Curl_retry_request(struct Curl_easy *data, char **url)
        it again. Bad luck. Retry the same request on a fresh connect! */
     retry = TRUE;
   else if(data->state.refused_stream &&
-          (data->req.bytecount + data->req.headerbytecount == 0) ) {
+          (data->req.bytecount + data->req.headerbytecount == 0)) {
     /* This was sent on a refused stream, safe to rerun. A refused stream
        error can typically only happen on HTTP/2 level if the stream is safe
        to issue again, but the nghttp2 API can deliver the message to other
@@ -1816,118 +655,262 @@ CURLcode Curl_retry_request(struct Curl_easy *data, char **url)
     }
     infof(data, "Connection died, retrying a fresh connect (retry count: %d)",
           data->state.retrycount);
-    *url = strdup(data->state.url);
+    *url = Curl_bufref_dup(&data->state.url);
     if(!*url)
       return CURLE_OUT_OF_MEMORY;
 
     connclose(conn, "retry"); /* close this connection */
-    conn->bits.retry = TRUE; /* mark this as a connection we're about
-                                to retry. Marking it this way should
-                                prevent i.e HTTP transfers to return
-                                error just because nothing has been
-                                transferred! */
-
-
-    if((conn->handler->protocol&PROTO_FAMILY_HTTP) &&
-       data->req.writebytecount) {
-      data->state.rewindbeforesend = TRUE;
-      infof(data, "state.rewindbeforesend = TRUE");
-    }
+    conn->bits.retry = TRUE; /* mark this as a connection we are about to
+                                retry. Marking it this way should prevent i.e
+                                HTTP transfers to return error because nothing
+                                has been transferred! */
+    Curl_creader_set_rewind(data, TRUE);
   }
   return CURLE_OK;
 }
 
-/*
- * Curl_setup_transfer() is called to setup some basic properties for the
- * upcoming transfer.
- */
-void
-Curl_setup_transfer(
+static void xfer_setup(
   struct Curl_easy *data,   /* transfer */
-  int sockindex,            /* socket index to read from or -1 */
-  curl_off_t size,          /* -1 if unknown at this point */
-  bool getheader,           /* TRUE if header parsing is wanted */
-  int writesockindex        /* socket index to write to, it may very well be
-                               the same we read from. -1 disables */
+  int send_idx,             /* sockindex to send on or -1 */
+  int recv_idx,             /* sockindex to receive on or -1 */
+  curl_off_t recv_size      /* how much to receive, -1 if unknown */
   )
 {
   struct SingleRequest *k = &data->req;
   struct connectdata *conn = data->conn;
-  struct HTTP *http = data->req.p.http;
-  bool httpsending;
 
-  DEBUGASSERT(conn != NULL);
-  DEBUGASSERT((sockindex <= 1) && (sockindex >= -1));
+  DEBUGASSERT(conn);
+  /* indexes are in range */
+  DEBUGASSERT((send_idx <= 1) && (send_idx >= -1));
+  DEBUGASSERT((recv_idx <= 1) && (recv_idx >= -1));
+  /* if request wants to send, switching off the send direction is wrong */
+  DEBUGASSERT((send_idx >= 0) || !Curl_req_want_send(data));
 
-  httpsending = ((conn->handler->protocol&PROTO_FAMILY_HTTP) &&
-                 (http->sending == HTTPSEND_REQUEST));
+  conn->send_idx = send_idx;
+  conn->recv_idx = recv_idx;
 
-  if(conn->bits.multiplex || conn->httpversion >= 20 || httpsending) {
-    /* when multiplexing, the read/write sockets need to be the same! */
-    conn->sockfd = sockindex == -1 ?
-      ((writesockindex == -1 ? CURL_SOCKET_BAD : conn->sock[writesockindex])) :
-      conn->sock[sockindex];
-    conn->writesockfd = conn->sockfd;
-    if(httpsending)
-      /* special and very HTTP-specific */
-      writesockindex = FIRSTSOCKET;
+  /* without receiving, there should be not recv_size */
+  DEBUGASSERT((conn->recv_idx >= 0) || (recv_size == -1));
+  k->size = recv_size;
+  k->header = !!conn->scheme->run->write_resp_hd;
+  /* by default, we do not shutdown at the end of the transfer */
+  k->shutdown = FALSE;
+  k->shutdown_err_ignore = FALSE;
+
+  /* The code sequence below is placed in this function because all necessary
+     input is not always known in do_complete() as this function may be called
+     after that */
+  if(!k->header && (recv_size > 0))
+    Curl_pgrsSetDownloadSize(data, recv_size);
+
+  /* we want header and/or body, if neither then do not do this! */
+  if(conn->scheme->run->write_resp_hd || !data->req.no_body) {
+    if(conn->recv_idx != -1)
+      CURL_REQ_SET_RECV(data);
+    if(conn->send_idx != -1)
+      CURL_REQ_SET_SEND(data);
+  }
+  CURL_TRC_M(data, "xfer_setup: recv_idx=%d, send_idx=%d",
+             conn->recv_idx, conn->send_idx);
+}
+
+void Curl_xfer_setup_nop(struct Curl_easy *data)
+{
+  xfer_setup(data, -1, -1, -1);
+}
+
+void Curl_xfer_setup_sendrecv(struct Curl_easy *data,
+                              int sockindex,
+                              curl_off_t recv_size)
+{
+  xfer_setup(data, sockindex, sockindex, recv_size);
+}
+
+void Curl_xfer_setup_send(struct Curl_easy *data,
+                          int sockindex)
+{
+  xfer_setup(data, sockindex, -1, -1);
+}
+
+void Curl_xfer_setup_recv(struct Curl_easy *data,
+                          int sockindex,
+                          curl_off_t recv_size)
+{
+  xfer_setup(data, -1, sockindex, recv_size);
+}
+
+void Curl_xfer_set_shutdown(struct Curl_easy *data,
+                            bool shutdown,
+                            bool ignore_errors)
+{
+  /* Shutdown should only be set when the transfer only sends or receives. */
+  DEBUGASSERT(!shutdown ||
+              (data->conn->send_idx < 0) || (data->conn->recv_idx < 0));
+  data->req.shutdown = shutdown;
+  data->req.shutdown_err_ignore = ignore_errors;
+}
+
+CURLcode Curl_xfer_write_resp(struct Curl_easy *data,
+                              const char *buf, size_t blen,
+                              bool is_eos)
+{
+  CURLcode result = CURLE_OK;
+
+  if(data->conn->scheme->run->write_resp) {
+    /* protocol handlers offering this function take full responsibility
+     * for writing all received download data to the client. */
+    result = data->conn->scheme->run->write_resp(data, buf, blen, is_eos);
   }
   else {
-    conn->sockfd = sockindex == -1 ?
-      CURL_SOCKET_BAD : conn->sock[sockindex];
-    conn->writesockfd = writesockindex == -1 ?
-      CURL_SOCKET_BAD:conn->sock[writesockindex];
+    /* No special handling by protocol handler, write all received data
+     * as BODY to the client. */
+    if(blen || is_eos) {
+      int cwtype = CLIENTWRITE_BODY;
+      if(is_eos)
+        cwtype |= CLIENTWRITE_EOS;
+      result = Curl_client_write(data, cwtype, buf, blen);
+    }
   }
-  k->getheader = getheader;
 
-  k->size = size;
-
-  /* The code sequence below is placed in this function just because all
-     necessary input is not always known in do_complete() as this function may
-     be called after that */
-
-  if(!k->getheader) {
-    k->header = FALSE;
-    if(size > 0)
-      Curl_pgrsSetDownloadSize(data, size);
+  if(!result && is_eos) {
+    /* If we wrote the EOS, we are definitely done */
+    data->req.eos_written = TRUE;
+    data->req.download_done = TRUE;
   }
-  /* we want header and/or body, if neither then don't do this! */
-  if(k->getheader || !data->req.no_body) {
-
-    if(sockindex != -1)
-      k->keepon |= KEEP_RECV;
-
-    if(writesockindex != -1) {
-      /* HTTP 1.1 magic:
-
-         Even if we require a 100-return code before uploading data, we might
-         need to write data before that since the REQUEST may not have been
-         finished sent off just yet.
-
-         Thus, we must check if the request has been sent before we set the
-         state info where we wait for the 100-return code
-      */
-      if((data->state.expect100header) &&
-         (conn->handler->protocol&PROTO_FAMILY_HTTP) &&
-         (http->sending == HTTPSEND_BODY)) {
-        /* wait with write until we either got 100-continue or a timeout */
-        k->exp100 = EXP100_AWAITING_CONTINUE;
-        k->start100 = Curl_now();
-
-        /* Set a timeout for the multi interface. Add the inaccuracy margin so
-           that we don't fire slightly too early and get denied to run. */
-        Curl_expire(data, data->set.expect_100_timeout, EXPIRE_100_TIMEOUT);
-      }
-      else {
-        if(data->state.expect100header)
-          /* when we've sent off the rest of the headers, we must await a
-             100-continue but first finish sending the request */
-          k->exp100 = EXP100_SENDING_REQUEST;
-
-        /* enable the write bit when we're not waiting for continue */
-        k->keepon |= KEEP_SEND;
-      }
-    } /* if(writesockindex != -1) */
-  } /* if(k->getheader || !data->req.no_body) */
-
+  CURL_TRC_WRITE(data, "xfer_write_resp(len=%zu, eos=%d) -> %d",
+                 blen, is_eos, (int)result);
+  return result;
+}
+
+bool Curl_xfer_write_is_paused(struct Curl_easy *data)
+{
+  return Curl_cwriter_is_paused(data);
+}
+
+CURLcode Curl_xfer_write_resp_hd(struct Curl_easy *data,
+                                 const char *hd0, size_t hdlen, bool is_eos)
+{
+  if(data->conn->scheme->run->write_resp_hd) {
+    DEBUGASSERT(!hd0[hdlen]); /* null-terminated */
+    /* protocol handlers offering this function take full responsibility
+     * for writing all received download data to the client. */
+    return data->conn->scheme->run->write_resp_hd(data, hd0, hdlen, is_eos);
+  }
+  /* No special handling by protocol handler, write as response bytes */
+  return Curl_xfer_write_resp(data, hd0, hdlen, is_eos);
+}
+
+CURLcode Curl_xfer_write_done(struct Curl_easy *data, bool premature)
+{
+  (void)premature;
+  return Curl_cw_out_done(data);
+}
+
+bool Curl_xfer_needs_flush(struct Curl_easy *data)
+{
+  return Curl_conn_needs_flush(data, data->conn->send_idx);
+}
+
+CURLcode Curl_xfer_flush(struct Curl_easy *data)
+{
+  return Curl_conn_flush(data, data->conn->send_idx);
+}
+
+CURLcode Curl_xfer_send(struct Curl_easy *data,
+                        const void *buf, size_t blen, bool eos,
+                        size_t *pnwritten)
+{
+  CURLcode result;
+
+  DEBUGASSERT(data);
+  DEBUGASSERT(data->conn);
+
+  result = Curl_conn_send(data, data->conn->send_idx,
+                          buf, blen, eos, pnwritten);
+  if(result == CURLE_AGAIN) {
+    result = CURLE_OK;
+    *pnwritten = 0;
+  }
+  else if(!result && *pnwritten)
+    data->info.request_size += *pnwritten;
+
+  DEBUGF(infof(data, "Curl_xfer_send(len=%zu, eos=%d) -> %d, %zu",
+               blen, eos, (int)result, *pnwritten));
+  return result;
+}
+
+CURLcode Curl_xfer_recv(struct Curl_easy *data,
+                        char *buf, size_t blen,
+                        size_t *pnrcvd)
+{
+  DEBUGASSERT(data);
+  DEBUGASSERT(data->conn);
+  DEBUGASSERT(data->set.buffer_size > 0);
+
+  if(curlx_uitouz(data->set.buffer_size) < blen)
+    blen = curlx_uitouz(data->set.buffer_size);
+  return Curl_conn_recv(data, data->conn->recv_idx, buf, blen, pnrcvd);
+}
+
+CURLcode Curl_xfer_send_close(struct Curl_easy *data)
+{
+  Curl_conn_ev_data_done_send(data);
+  return CURLE_OK;
+}
+
+bool Curl_xfer_is_blocked(struct Curl_easy *data)
+{
+  bool want_send = CURL_REQ_WANT_SEND(data);
+  bool want_recv = CURL_REQ_WANT_RECV(data);
+  if(!want_send)
+    return want_recv && Curl_xfer_recv_is_paused(data);
+  else if(!want_recv)
+    return want_send && Curl_xfer_send_is_paused(data);
+  else
+    return Curl_xfer_recv_is_paused(data) && Curl_xfer_send_is_paused(data);
+}
+
+bool Curl_xfer_send_is_paused(struct Curl_easy *data)
+{
+  return Curl_rlimit_is_blocked(&data->progress.ul.rlimit);
+}
+
+bool Curl_xfer_recv_is_paused(struct Curl_easy *data)
+{
+  return Curl_rlimit_is_blocked(&data->progress.dl.rlimit);
+}
+
+CURLcode Curl_xfer_pause_send(struct Curl_easy *data, bool enable)
+{
+  CURLcode result = CURLE_OK;
+  Curl_rlimit_block(&data->progress.ul.rlimit, enable, Curl_pgrs_now(data));
+  if(!enable && Curl_creader_is_paused(data))
+    result = Curl_creader_unpause(data);
+  Curl_pgrsSendPause(data, enable);
+  return result;
+}
+
+CURLcode Curl_xfer_pause_recv(struct Curl_easy *data, bool enable)
+{
+  CURLcode result = CURLE_OK;
+  Curl_rlimit_block(&data->progress.dl.rlimit, enable, Curl_pgrs_now(data));
+  if(!enable && Curl_cwriter_is_paused(data))
+    result = Curl_cwriter_unpause(data);
+  Curl_conn_ev_data_pause(data, enable);
+  Curl_pgrsRecvPause(data, enable);
+  return result;
+}
+
+bool Curl_xfer_is_secure(struct Curl_easy *data)
+{
+#ifndef CURL_DISABLE_PROXY
+  if(data->conn && data->conn->bits.origin_is_proxy) {
+    /* talking to a forward proxy, not secure. we do not use
+     * a forward proxy for https: and other 's' URLs. Let's just check that
+     * this did not fail somewhere. */
+    DEBUGASSERT(!(data->state.origin->scheme->flags & PROTOPT_SSL));
+    return FALSE;
+  }
+#endif
+  return (data->state.origin->scheme->flags & PROTOPT_SSL);
 }
diff --git a/third-party/curl/lib/transfer.h b/third-party/curl/lib/transfer.h
index 536ac249b7..7507ce27bd 100644
--- a/third-party/curl/lib/transfer.h
+++ b/third-party/curl/lib/transfer.h
@@ -23,8 +23,8 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#define Curl_headersep(x) ((((x) == ':') || ((x) == ';')))
 
-#define Curl_headersep(x) ((((x)==':') || ((x)==';')))
 char *Curl_checkheaders(const struct Curl_easy *data,
                         const char *thisheader,
                         const size_t thislen);
@@ -32,42 +32,119 @@ char *Curl_checkheaders(const struct Curl_easy *data,
 void Curl_init_CONNECT(struct Curl_easy *data);
 
 CURLcode Curl_pretransfer(struct Curl_easy *data);
-CURLcode Curl_posttransfer(struct Curl_easy *data);
 
-typedef enum {
-  FOLLOW_NONE,  /* not used within the function, just a placeholder to
-                   allow initing to this */
-  FOLLOW_FAKE,  /* only records stuff, not actually following */
-  FOLLOW_RETRY, /* set if this is a request retry as opposed to a real
-                   redirect following */
-  FOLLOW_REDIR /* a full true redirect */
-} followtype;
-
-CURLcode Curl_follow(struct Curl_easy *data, char *newurl,
-                     followtype type);
-CURLcode Curl_readwrite(struct connectdata *conn,
-                        struct Curl_easy *data, bool *done,
-                        bool *comeback);
-int Curl_single_getsock(struct Curl_easy *data,
-                        struct connectdata *conn, curl_socket_t *socks);
-CURLcode Curl_fillreadbuffer(struct Curl_easy *data, size_t bytes,
-                             size_t *nreadp);
+CURLcode Curl_sendrecv(struct Curl_easy *data);
 CURLcode Curl_retry_request(struct Curl_easy *data, char **url);
 bool Curl_meets_timecondition(struct Curl_easy *data, time_t timeofdoc);
-CURLcode Curl_get_upload_buffer(struct Curl_easy *data);
 
-CURLcode Curl_done_sending(struct Curl_easy *data,
-                           struct SingleRequest *k);
+/**
+ * Write the transfer raw response bytes, as received from the connection.
+ * Handle all passed bytes or return an error. By default, this writes
+ * the bytes as BODY to the client. Protocols may provide a
+ * "write_resp" callback in their handler to add specific treatment. E.g.
+ * HTTP parses response headers and passes them differently to the client.
+ * @param data     the transfer
+ * @param buf      the raw response bytes
+ * @param blen     the amount of bytes in `buf`
+ * @param is_eos   TRUE iff the connection indicates this to be the last
+ *                 bytes of the response
+ */
+CURLcode Curl_xfer_write_resp(struct Curl_easy *data,
+                              const char *buf, size_t blen,
+                              bool is_eos);
 
-/* This sets up a forthcoming transfer */
-void
-Curl_setup_transfer (struct Curl_easy *data,
-                     int sockindex,     /* socket index to read from or -1 */
-                     curl_off_t size,   /* -1 if unknown at this point */
-                     bool getheader,    /* TRUE if header parsing is wanted */
-                     int writesockindex /* socket index to write to. May be
-                                           the same we read from. -1
-                                           disables */
-  );
+bool Curl_xfer_write_is_paused(struct Curl_easy *data);
+
+/**
+ * Write a single "header" line from a server response.
+ * @param hd0      the null-terminated, single header line
+ * @param hdlen    the length of the header line
+ * @param is_eos   TRUE iff this is the end of the response
+ */
+CURLcode Curl_xfer_write_resp_hd(struct Curl_easy *data,
+                                 const char *hd0, size_t hdlen, bool is_eos);
+
+/* The transfer is neither receiving nor sending. */
+void Curl_xfer_setup_nop(struct Curl_easy *data);
+
+/* The transfer sends data on the given socket index */
+void Curl_xfer_setup_send(struct Curl_easy *data,
+                          int sockindex);
+
+/* The transfer receives data on the given socket index, the
+ * amount to receive (or -1 if unknown). */
+void Curl_xfer_setup_recv(struct Curl_easy *data,
+                          int sockindex,
+                          curl_off_t recv_size);
+
+/* *After* Curl_xfer_setup_xxx(), tell the transfer to shutdown the
+ * connection at the end. Let the transfer either fail or ignore any
+ * errors during shutdown. */
+void Curl_xfer_set_shutdown(struct Curl_easy *data,
+                            bool shutdown,
+                            bool ignore_errors);
+
+/**
+ * The transfer will use socket 1 to send/recv. `recv_size` is
+ * the amount to receive or -1 if unknown.
+ */
+void Curl_xfer_setup_sendrecv(struct Curl_easy *data,
+                              int sockindex,
+                              curl_off_t recv_size);
+
+/**
+ * Multi has set transfer to DONE. Last chance to trigger
+ * missing response things like writing an EOS to the client.
+ */
+CURLcode Curl_xfer_write_done(struct Curl_easy *data, bool premature);
+
+/**
+ * Return TRUE iff transfer has pending data to send. Checks involved
+ * connection filters.
+ */
+bool Curl_xfer_needs_flush(struct Curl_easy *data);
+
+/**
+ * Flush any pending send data on the transfer connection.
+ */
+CURLcode Curl_xfer_flush(struct Curl_easy *data);
+
+/**
+ * Send data on the socket/connection filter designated
+ * for transfer's outgoing data.
+ * Return CURLE_OK on blocking with (*pnwritten == 0).
+ */
+CURLcode Curl_xfer_send(struct Curl_easy *data,
+                        const void *buf, size_t blen, bool eos,
+                        size_t *pnwritten);
+
+/**
+ * Receive data on the socket/connection filter designated
+ * for transfer's incoming data.
+ * Return CURLE_AGAIN on blocking with (*pnrcvd == 0).
+ */
+CURLcode Curl_xfer_recv(struct Curl_easy *data,
+                        char *buf, size_t blen,
+                        size_t *pnrcvd);
+
+CURLcode Curl_xfer_send_close(struct Curl_easy *data);
+CURLcode Curl_xfer_send_shutdown(struct Curl_easy *data, bool *done);
+
+/* Return TRUE if the transfer is not done, but further progress
+ * is blocked. For example when it is only receiving and its writer
+ * is PAUSED. */
+bool Curl_xfer_is_blocked(struct Curl_easy *data);
+
+/* Query if send/recv for transfer is paused. */
+bool Curl_xfer_send_is_paused(struct Curl_easy *data);
+bool Curl_xfer_recv_is_paused(struct Curl_easy *data);
+
+/* Enable/Disable pausing of send/recv for the transfer. */
+CURLcode Curl_xfer_pause_send(struct Curl_easy *data, bool enable);
+CURLcode Curl_xfer_pause_recv(struct Curl_easy *data, bool enable);
+
+/* TRUE if the transfer is secure, e.g. uses TLS and does not
+ * use a forward proxy. */
+bool Curl_xfer_is_secure(struct Curl_easy *data);
 
 #endif /* HEADER_CURL_TRANSFER_H */
diff --git a/third-party/curl/lib/uint-bset.c b/third-party/curl/lib/uint-bset.c
new file mode 100644
index 0000000000..55aedb234b
--- /dev/null
+++ b/third-party/curl/lib/uint-bset.c
@@ -0,0 +1,233 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "uint-bset.h"
+
+#ifdef DEBUGBUILD
+#define CURL_UINT32_BSET_MAGIC  0x62757473
+#endif
+
+void Curl_uint32_bset_init(struct uint32_bset *bset)
+{
+  memset(bset, 0, sizeof(*bset));
+#ifdef DEBUGBUILD
+  bset->init = CURL_UINT32_BSET_MAGIC;
+#endif
+}
+
+CURLcode Curl_uint32_bset_resize(struct uint32_bset *bset, uint32_t nmax)
+{
+  uint32_t nslots = (nmax < (UINT32_MAX - 63)) ?
+                    ((nmax + 63) / 64) : (UINT32_MAX / 64);
+
+  DEBUGASSERT(bset->init == CURL_UINT32_BSET_MAGIC);
+  if(nslots != bset->nslots) {
+    uint64_t *slots = curlx_calloc(nslots, sizeof(uint64_t));
+    if(!slots)
+      return CURLE_OUT_OF_MEMORY;
+
+    if(bset->slots) {
+      memcpy(slots, bset->slots,
+             (CURLMIN(nslots, bset->nslots) * sizeof(uint64_t)));
+      curlx_free(bset->slots);
+    }
+    bset->slots = slots;
+    bset->nslots = nslots;
+    bset->first_slot_used = 0;
+  }
+  return CURLE_OK;
+}
+
+void Curl_uint32_bset_destroy(struct uint32_bset *bset)
+{
+  DEBUGASSERT(bset->init == CURL_UINT32_BSET_MAGIC);
+  curlx_free(bset->slots);
+  memset(bset, 0, sizeof(*bset));
+}
+
+#ifdef UNITTESTS
+/* @unittest 3211 */
+UNITTEST uint32_t uint32_bset_capacity(struct uint32_bset *bset);
+UNITTEST uint32_t uint32_bset_capacity(struct uint32_bset *bset)
+{
+  return bset->nslots * 64;
+}
+#endif
+
+uint32_t Curl_uint32_bset_count(struct uint32_bset *bset)
+{
+  uint32_t i;
+  uint32_t n = 0;
+  for(i = 0; i < bset->nslots; ++i) {
+    if(bset->slots[i])
+      n += CURL_POPCOUNT64(bset->slots[i]);
+  }
+  return n;
+}
+
+bool Curl_uint32_bset_empty(struct uint32_bset *bset)
+{
+  uint32_t i;
+  for(i = bset->first_slot_used; i < bset->nslots; ++i) {
+    if(bset->slots[i])
+      return FALSE;
+  }
+  return TRUE;
+}
+
+void Curl_uint32_bset_clear(struct uint32_bset *bset)
+{
+  if(bset->nslots) {
+    memset(bset->slots, 0, bset->nslots * sizeof(uint64_t));
+    bset->first_slot_used = UINT32_MAX;
+  }
+}
+
+bool Curl_uint32_bset_add(struct uint32_bset *bset, uint32_t i)
+{
+  uint32_t islot = i / 64;
+  if(islot >= bset->nslots)
+    return FALSE;
+  bset->slots[islot] |= ((uint64_t)1 << (i % 64));
+  if(islot < bset->first_slot_used)
+    bset->first_slot_used = islot;
+  return TRUE;
+}
+
+void Curl_uint32_bset_remove(struct uint32_bset *bset, uint32_t i)
+{
+  size_t islot = i / 64;
+  if(islot < bset->nslots)
+    bset->slots[islot] &= ~((uint64_t)1 << (i % 64));
+}
+
+bool Curl_uint32_bset_contains(struct uint32_bset *bset, uint32_t i)
+{
+  uint32_t islot = i / 64;
+  if(islot >= bset->nslots)
+    return FALSE;
+  return (bset->slots[islot] & ((uint64_t)1 << (i % 64))) != 0;
+}
+
+bool Curl_uint32_bset_first(struct uint32_bset *bset, uint32_t *pfirst)
+{
+  uint32_t i;
+  for(i = bset->first_slot_used; i < bset->nslots; ++i) {
+    if(bset->slots[i]) {
+      *pfirst = (i * 64) + CURL_CTZ64(bset->slots[i]);
+      bset->first_slot_used = i;
+      return TRUE;
+    }
+  }
+  bset->first_slot_used = *pfirst = UINT32_MAX;
+  return FALSE;
+}
+
+bool Curl_uint32_bset_next(struct uint32_bset *bset, uint32_t last,
+                           uint32_t *pnext)
+{
+  uint32_t islot;
+  uint64_t x;
+
+  ++last; /* look for number one higher than last */
+  islot = last / 64; /* the slot this would be in */
+  if(islot < bset->nslots) {
+    /* shift away the bits we already iterated in this slot */
+    x = (bset->slots[islot] >> (last % 64));
+    if(x) {
+      /* more bits set, next is `last` + trailing 0s of the shifted slot */
+      *pnext = last + CURL_CTZ64(x);
+      return TRUE;
+    }
+    /* no more bits set in the last slot, scan forward */
+    for(islot = islot + 1; islot < bset->nslots; ++islot) {
+      if(bset->slots[islot]) {
+        *pnext = (islot * 64) + CURL_CTZ64(bset->slots[islot]);
+        return TRUE;
+      }
+    }
+  }
+  *pnext = UINT32_MAX; /* a value we cannot store */
+  return FALSE;
+}
+
+#ifdef CURL_POPCOUNT64_IMPLEMENT
+uint32_t Curl_popcount64(uint64_t x)
+{
+  /* Compute the "Hamming Distance" between 'x' and 0,
+   * which is the number of set bits in 'x'.
+   * See: https://en.wikipedia.org/wiki/Hamming_weight */
+  const uint64_t m1 = 0x5555555555555555LL; /* 0101+ */
+  const uint64_t m2 = 0x3333333333333333LL; /* 00110011+ */
+  const uint64_t m4 = 0x0f0f0f0f0f0f0f0fLL; /* 00001111+ */
+  /* 1 + 256^1 + 256^2 + 256^3 + ... + 256^7 */
+  const uint64_t h01 = 0x0101010101010101LL;
+  x -= (x >> 1) & m1;             /* replace every 2 bits with bits present */
+  x = (x & m2) + ((x >> 2) & m2); /* replace every nibble with bits present */
+  x = (x + (x >> 4)) & m4;        /* replace every byte with bits present */
+  /* top 8 bits of x + (x << 8) + (x << 16) + (x << 24) + ... which makes the
+   * top byte the sum of all individual 8 bytes, throw away the rest */
+  return (uint32_t)((x * h01) >> 56);
+}
+#endif /* CURL_POPCOUNT64_IMPLEMENT */
+
+#ifdef CURL_CTZ64_IMPLEMENT
+uint32_t Curl_ctz64(uint64_t x)
+{
+  /* count trailing zeros in a uint64_t.
+   * divide and conquer to find the number of lower 0 bits */
+  const uint64_t ml32 = 0xFFFFFFFF; /* lower 32 bits */
+  const uint64_t ml16 = 0x0000FFFF; /* lower 16 bits */
+  const uint64_t ml8  = 0x000000FF; /* lower 8 bits */
+  const uint64_t ml4  = 0x0000000F; /* lower 4 bits */
+  const uint64_t ml2  = 0x00000003; /* lower 2 bits */
+  uint32_t n;
+
+  if(!x)
+    return 64;
+  n = 1;
+  if(!(x & ml32)) {
+    n = n + 32;
+    x = x >> 32;
+  }
+  if(!(x & ml16)) {
+    n = n + 16;
+    x = x >> 16;
+  }
+  if(!(x & ml8)) {
+    n = n + 8;
+    x = x >> 8;
+  }
+  if(!(x & ml4)) {
+    n = n + 4;
+    x = x >> 4;
+  }
+  if(!(x & ml2)) {
+    n = n + 2;
+    x = x >> 2;
+  }
+  return n - (uint32_t)(x & 1);
+}
+#endif /* CURL_CTZ64_IMPLEMENT */
diff --git a/third-party/curl/lib/uint-bset.h b/third-party/curl/lib/uint-bset.h
new file mode 100644
index 0000000000..ce0450c53c
--- /dev/null
+++ b/third-party/curl/lib/uint-bset.h
@@ -0,0 +1,109 @@
+#ifndef HEADER_CURL_UINT_BSET_H
+#define HEADER_CURL_UINT_BSET_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+/* A bitset for unsigned int values.
+ * It can hold the numbers from 0 - (nmax - 1),
+ * rounded to the next 64 multiple.
+ *
+ * Optimized for high efficiency in adding/removing numbers.
+ * Efficient storage when the set is (often) relatively full.
+ *
+ * If the set's cardinality is only expected to be a fraction of nmax,
+ * uint_spbset offers a "sparse" variant with more memory efficiency at
+ * the price of slightly slower operations.
+ */
+
+struct uint32_bset {
+  uint64_t *slots;
+  uint32_t nslots;
+  uint32_t first_slot_used;
+#ifdef DEBUGBUILD
+  int init;
+#endif
+};
+
+/* Initialize the bitset with capacity 0. */
+void Curl_uint32_bset_init(struct uint32_bset *bset);
+
+/* Resize the bitset capacity to hold numbers from 0 to `nmax`,
+ * which rounds up `nmax` to the next multiple of 64. */
+CURLcode Curl_uint32_bset_resize(struct uint32_bset *bset, uint32_t nmax);
+
+/* Destroy the bitset, freeing all resources. */
+void Curl_uint32_bset_destroy(struct uint32_bset *bset);
+
+/* Get the cardinality of the bitset, e.g. numbers present in the set. */
+uint32_t Curl_uint32_bset_count(struct uint32_bset *bset);
+
+/* TRUE of bitset is empty */
+bool Curl_uint32_bset_empty(struct uint32_bset *bset);
+
+/* Clear the bitset, making it empty. */
+void Curl_uint32_bset_clear(struct uint32_bset *bset);
+
+/* Add the number `i` to the bitset. Return FALSE if the number is
+ * outside the set's capacity.
+ * Numbers can be added more than once, without making a difference. */
+bool Curl_uint32_bset_add(struct uint32_bset *bset, uint32_t i);
+
+/* Remove the number `i` from the bitset. */
+void Curl_uint32_bset_remove(struct uint32_bset *bset, uint32_t i);
+
+/* Return TRUE if the bitset contains number `i`. */
+bool Curl_uint32_bset_contains(struct uint32_bset *bset, uint32_t i);
+
+/* Get the first number in the bitset, e.g. the smallest.
+ * Returns FALSE when the bitset is empty. */
+bool Curl_uint32_bset_first(struct uint32_bset *bset, uint32_t *pfirst);
+
+/* Get the next number in the bitset, following `last` in natural order.
+ * Put another way, this is the smallest number greater than `last` in
+ * the bitset. `last` does not have to be present in the set.
+ *
+ * Returns FALSE when no such number is in the set.
+ *
+ * This allows to iterate the set while being modified:
+ * - added numbers higher than 'last' will be picked up by the iteration.
+ * - added numbers lower than 'last' will not show up.
+ * - removed numbers lower or equal to 'last' will not show up.
+ * - removed numbers higher than 'last' will not be visited. */
+bool Curl_uint32_bset_next(struct uint32_bset *bset, uint32_t last,
+                           uint32_t *pnext);
+
+#ifndef CURL_POPCOUNT64
+#define CURL_POPCOUNT64(x)  Curl_popcount64(x)
+#define CURL_POPCOUNT64_IMPLEMENT
+uint32_t Curl_popcount64(uint64_t x);
+#endif /* !CURL_POPCOUNT64 */
+
+#ifndef CURL_CTZ64
+#define CURL_CTZ64(x)  Curl_ctz64(x)
+#define CURL_CTZ64_IMPLEMENT
+uint32_t Curl_ctz64(uint64_t x);
+#endif /* !CURL_CTZ64 */
+
+#endif /* HEADER_CURL_UINT_BSET_H */
diff --git a/third-party/curl/lib/uint-hash.c b/third-party/curl/lib/uint-hash.c
new file mode 100644
index 0000000000..c37448fd11
--- /dev/null
+++ b/third-party/curl/lib/uint-hash.c
@@ -0,0 +1,235 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "uint-hash.h"
+
+/* random patterns for API verification */
+#ifdef DEBUGBUILD
+#define CURL_UINT32_HASHINIT 0x7117e779
+#endif
+
+static uint32_t uint32_hash_hash(uint32_t id, uint32_t slots)
+{
+  return (id % slots);
+}
+
+struct uint_hash_entry {
+  struct uint_hash_entry *next;
+  void *value;
+  uint32_t id;
+};
+
+void Curl_uint32_hash_init(struct uint_hash *h,
+                           uint32_t slots,
+                           Curl_uint32_hash_dtor *dtor)
+{
+  DEBUGASSERT(h);
+  DEBUGASSERT(slots);
+
+  h->table = NULL;
+  h->dtor = dtor;
+  h->size = 0;
+  h->slots = slots;
+#ifdef DEBUGBUILD
+  h->init = CURL_UINT32_HASHINIT;
+#endif
+}
+
+static struct uint_hash_entry *uint32_hash_mk_entry(uint32_t id, void *value)
+{
+  struct uint_hash_entry *e;
+
+  /* allocate the struct for the hash entry */
+  e = curlx_malloc(sizeof(*e));
+  if(e) {
+    e->id = id;
+    e->next = NULL;
+    e->value = value;
+  }
+  return e;
+}
+
+static void uint32_hash_entry_clear(struct uint_hash *h,
+                                    struct uint_hash_entry *e)
+{
+  DEBUGASSERT(h);
+  DEBUGASSERT(e);
+  if(e->value) {
+    if(h->dtor)
+      h->dtor(e->id, e->value);
+    e->value = NULL;
+  }
+}
+
+static void uint32_hash_entry_destroy(struct uint_hash *h,
+                                      struct uint_hash_entry *e)
+{
+  uint32_hash_entry_clear(h, e);
+  curlx_free(e);
+}
+
+static void uint32_hash_entry_unlink(struct uint_hash *h,
+                                     struct uint_hash_entry **he_anchor,
+                                     struct uint_hash_entry *he)
+{
+  *he_anchor = he->next;
+  --h->size;
+}
+
+static void uint32_hash_elem_link(struct uint_hash *h,
+                                  struct uint_hash_entry **he_anchor,
+                                  struct uint_hash_entry *he)
+{
+  he->next = *he_anchor;
+  *he_anchor = he;
+  ++h->size;
+}
+
+#define CURL_UINT32_HASH_SLOT(h, id) h->table[uint32_hash_hash(id, (h)->slots)]
+#define CURL_UINT32_HASH_SLOT_ADDR(h, id) &CURL_UINT32_HASH_SLOT(h, id)
+
+bool Curl_uint32_hash_set(struct uint_hash *h, uint32_t id, void *value)
+{
+  struct uint_hash_entry *he, **slot;
+
+  DEBUGASSERT(h);
+  DEBUGASSERT(h->slots);
+  DEBUGASSERT(h->init == CURL_UINT32_HASHINIT);
+  if(!h->table) {
+    h->table = curlx_calloc(h->slots, sizeof(*he));
+    if(!h->table)
+      return FALSE; /* OOM */
+  }
+
+  slot = CURL_UINT32_HASH_SLOT_ADDR(h, id);
+  for(he = *slot; he; he = he->next) {
+    if(he->id == id) {
+      /* existing key entry, overwrite by clearing old pointer */
+      uint32_hash_entry_clear(h, he);
+      he->value = value;
+      return TRUE;
+    }
+  }
+
+  he = uint32_hash_mk_entry(id, value);
+  if(!he)
+    return FALSE; /* OOM */
+
+  uint32_hash_elem_link(h, slot, he);
+  return TRUE;
+}
+
+bool Curl_uint32_hash_remove(struct uint_hash *h, uint32_t id)
+{
+  DEBUGASSERT(h);
+  DEBUGASSERT(h->slots);
+  DEBUGASSERT(h->init == CURL_UINT32_HASHINIT);
+  if(h->table) {
+    struct uint_hash_entry *he, **he_anchor;
+
+    he_anchor = CURL_UINT32_HASH_SLOT_ADDR(h, id);
+    while(*he_anchor) {
+      he = *he_anchor;
+      if(id == he->id) {
+        uint32_hash_entry_unlink(h, he_anchor, he);
+        uint32_hash_entry_destroy(h, he);
+        return TRUE;
+      }
+      he_anchor = &he->next;
+    }
+  }
+  return FALSE;
+}
+
+void *Curl_uint32_hash_get(struct uint_hash *h, uint32_t id)
+{
+  DEBUGASSERT(h);
+  DEBUGASSERT(h->init == CURL_UINT32_HASHINIT);
+  if(h->table) {
+    struct uint_hash_entry *he;
+    DEBUGASSERT(h->slots);
+    he = CURL_UINT32_HASH_SLOT(h, id);
+    while(he) {
+      if(id == he->id) {
+        return he->value;
+      }
+      he = he->next;
+    }
+  }
+  return NULL;
+}
+
+/* @unittest 1616 */
+UNITTEST void uint_hash_clear(struct uint_hash *h);
+UNITTEST void uint_hash_clear(struct uint_hash *h)
+{
+  if(h && h->table) {
+    struct uint_hash_entry *he, **he_anchor;
+    size_t i;
+    DEBUGASSERT(h->init == CURL_UINT32_HASHINIT);
+    for(i = 0; i < h->slots; ++i) {
+      he_anchor = &h->table[i];
+      while(*he_anchor) {
+        he = *he_anchor;
+        uint32_hash_entry_unlink(h, he_anchor, he);
+        uint32_hash_entry_destroy(h, he);
+      }
+    }
+  }
+}
+
+void Curl_uint32_hash_destroy(struct uint_hash *h)
+{
+  DEBUGASSERT(h->init == CURL_UINT32_HASHINIT);
+  if(h->table) {
+    uint_hash_clear(h);
+    curlx_safefree(h->table);
+  }
+  DEBUGASSERT(h->size == 0);
+  h->slots = 0;
+}
+
+uint32_t Curl_uint32_hash_count(struct uint_hash *h)
+{
+  DEBUGASSERT(h->init == CURL_UINT32_HASHINIT);
+  return h->size;
+}
+
+void Curl_uint32_hash_visit(struct uint_hash *h,
+                            Curl_uint32_hash_visit_cb *cb,
+                            void *user_data)
+{
+  if(h && h->table && cb) {
+    struct uint_hash_entry *he;
+    size_t i;
+    DEBUGASSERT(h->init == CURL_UINT32_HASHINIT);
+    for(i = 0; i < h->slots; ++i) {
+      for(he = h->table[i]; he; he = he->next) {
+        if(!cb(he->id, he->value, user_data))
+          return;
+      }
+    }
+  }
+}
diff --git a/third-party/curl/lib/uint-hash.h b/third-party/curl/lib/uint-hash.h
new file mode 100644
index 0000000000..3cbcf8f8f1
--- /dev/null
+++ b/third-party/curl/lib/uint-hash.h
@@ -0,0 +1,59 @@
+#ifndef HEADER_CURL_UINT_HASH_H
+#define HEADER_CURL_UINT_HASH_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+/* A version with uint32_t as key */
+typedef void Curl_uint32_hash_dtor(uint32_t id, void *value);
+struct uint_hash_entry;
+
+/* Hash for `uint32_t` as key */
+struct uint_hash {
+  struct uint_hash_entry **table;
+  Curl_uint32_hash_dtor *dtor;
+  uint32_t slots;
+  uint32_t size;
+#ifdef DEBUGBUILD
+  int init;
+#endif
+};
+
+void Curl_uint32_hash_init(struct uint_hash *h,
+                           uint32_t slots,
+                           Curl_uint32_hash_dtor *dtor);
+void Curl_uint32_hash_destroy(struct uint_hash *h);
+bool Curl_uint32_hash_set(struct uint_hash *h, uint32_t id, void *value);
+bool Curl_uint32_hash_remove(struct uint_hash *h, uint32_t id);
+void *Curl_uint32_hash_get(struct uint_hash *h, uint32_t id);
+uint32_t Curl_uint32_hash_count(struct uint_hash *h);
+
+typedef bool Curl_uint32_hash_visit_cb(uint32_t id, void *value,
+                                       void *user_data);
+
+void Curl_uint32_hash_visit(struct uint_hash *h,
+                            Curl_uint32_hash_visit_cb *cb,
+                            void *user_data);
+
+#endif /* HEADER_CURL_UINT_HASH_H */
diff --git a/third-party/curl/lib/uint-spbset.c b/third-party/curl/lib/uint-spbset.c
new file mode 100644
index 0000000000..d4e6c8e70b
--- /dev/null
+++ b/third-party/curl/lib/uint-spbset.c
@@ -0,0 +1,253 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "uint-bset.h"
+#include "uint-spbset.h"
+
+#ifdef DEBUGBUILD
+#define CURL_UINT32_SPBSET_MAGIC  0x70737362
+#endif
+
+void Curl_uint32_spbset_init(struct uint32_spbset *bset)
+{
+  memset(bset, 0, sizeof(*bset));
+#ifdef DEBUGBUILD
+  bset->init = CURL_UINT32_SPBSET_MAGIC;
+#endif
+}
+
+/* Clear the bitset, making it empty.
+
+   @unittest 3213
+ */
+UNITTEST void uint32_spbset_clear(struct uint32_spbset *bset);
+UNITTEST void uint32_spbset_clear(struct uint32_spbset *bset)
+{
+  struct uint32_spbset_chunk *next, *chunk;
+
+  for(chunk = bset->head.next; chunk; chunk = next) {
+    next = chunk->next;
+    curlx_free(chunk);
+  }
+  memset(&bset->head, 0, sizeof(bset->head));
+}
+
+void Curl_uint32_spbset_destroy(struct uint32_spbset *bset)
+{
+  DEBUGASSERT(bset->init == CURL_UINT32_SPBSET_MAGIC);
+  uint32_spbset_clear(bset);
+}
+
+uint32_t Curl_uint32_spbset_count(struct uint32_spbset *bset)
+{
+  struct uint32_spbset_chunk *chunk;
+  uint32_t i, n = 0;
+
+  for(chunk = &bset->head; chunk; chunk = chunk->next) {
+    for(i = 0; i < CURL_UINT32_SPBSET_CH_SLOTS; ++i) {
+      if(chunk->slots[i])
+        n += CURL_POPCOUNT64(chunk->slots[i]);
+    }
+  }
+  return n;
+}
+
+static struct uint32_spbset_chunk *uint32_spbset_get_chunk(
+  struct uint32_spbset *bset, uint32_t i, bool grow)
+{
+  struct uint32_spbset_chunk *chunk, **panchor = NULL;
+  uint32_t i_offset = (i & ~CURL_UINT32_SPBSET_CH_MASK);
+
+  if(!bset)
+    return NULL;
+
+  for(chunk = &bset->head; chunk;
+      panchor = &chunk->next, chunk = chunk->next) {
+    if(chunk->offset == i_offset) {
+      return chunk;
+    }
+    else if(chunk->offset > i_offset) {
+      /* need new chunk here */
+      chunk = NULL;
+      break;
+    }
+  }
+
+  if(!grow)
+    return NULL;
+
+  /* need a new one */
+  chunk = curlx_calloc(1, sizeof(*chunk));
+  if(!chunk)
+    return NULL;
+
+  if(panchor) {  /* insert between panchor and *panchor */
+    chunk->next = *panchor;
+    *panchor = chunk;
+  }
+  else {  /* prepend to head, switching places */
+    memcpy(chunk, &bset->head, sizeof(*chunk));
+    memset(&bset->head, 0, sizeof(bset->head));
+    bset->head.next = chunk;
+  }
+  chunk->offset = i_offset;
+  return chunk;
+}
+
+bool Curl_uint32_spbset_add(struct uint32_spbset *bset, uint32_t i)
+{
+  struct uint32_spbset_chunk *chunk;
+  uint32_t i_chunk;
+
+  chunk = uint32_spbset_get_chunk(bset, i, TRUE);
+  if(!chunk)
+    return FALSE;
+
+  DEBUGASSERT(i >= chunk->offset);
+  i_chunk = (i - chunk->offset);
+  DEBUGASSERT((i_chunk / 64) < CURL_UINT32_SPBSET_CH_SLOTS);
+  chunk->slots[(i_chunk / 64)] |= ((uint64_t)1 << (i_chunk % 64));
+  return TRUE;
+}
+
+void Curl_uint32_spbset_remove(struct uint32_spbset *bset, uint32_t i)
+{
+  struct uint32_spbset_chunk *chunk;
+  uint32_t i_chunk;
+
+  chunk = uint32_spbset_get_chunk(bset, i, FALSE);
+  if(chunk) {
+    DEBUGASSERT(i >= chunk->offset);
+    i_chunk = (i - chunk->offset);
+    DEBUGASSERT((i_chunk / 64) < CURL_UINT32_SPBSET_CH_SLOTS);
+    chunk->slots[(i_chunk / 64)] &= ~((uint64_t)1 << (i_chunk % 64));
+  }
+}
+
+bool Curl_uint32_spbset_contains(struct uint32_spbset *bset, uint32_t i)
+{
+  struct uint32_spbset_chunk *chunk;
+  uint32_t i_chunk;
+
+  chunk = uint32_spbset_get_chunk(bset, i, FALSE);
+  if(chunk) {
+    DEBUGASSERT(i >= chunk->offset);
+    i_chunk = (i - chunk->offset);
+    DEBUGASSERT((i_chunk / 64) < CURL_UINT32_SPBSET_CH_SLOTS);
+    return (chunk->slots[i_chunk / 64] &
+            ((uint64_t)1 << (i_chunk % 64))) != 0;
+  }
+  return FALSE;
+}
+
+bool Curl_uint32_spbset_first(struct uint32_spbset *bset, uint32_t *pfirst)
+{
+  struct uint32_spbset_chunk *chunk;
+  uint32_t i;
+
+  for(chunk = &bset->head; chunk; chunk = chunk->next) {
+    for(i = 0; i < CURL_UINT32_SPBSET_CH_SLOTS; ++i) {
+      if(chunk->slots[i]) {
+        *pfirst = chunk->offset + ((i * 64) + CURL_CTZ64(chunk->slots[i]));
+        return TRUE;
+      }
+    }
+  }
+  *pfirst = 0; /* give it a defined value even if it should not be used */
+  return FALSE;
+}
+
+static bool uint32_spbset_chunk_first(struct uint32_spbset_chunk *chunk,
+                                      uint32_t *pfirst)
+{
+  uint32_t i;
+  for(i = 0; i < CURL_UINT32_SPBSET_CH_SLOTS; ++i) {
+    if(chunk->slots[i]) {
+      *pfirst = chunk->offset + ((i * 64) + CURL_CTZ64(chunk->slots[i]));
+      return TRUE;
+    }
+  }
+  *pfirst = UINT32_MAX; /* a value we cannot store */
+  return FALSE;
+}
+
+static bool uint32_spbset_chunk_next(struct uint32_spbset_chunk *chunk,
+                                     uint32_t last,
+                                     uint32_t *pnext)
+{
+  if(chunk->offset <= last) {
+    uint64_t x;
+    uint32_t i = ((last - chunk->offset) / 64);
+    if(i < CURL_UINT32_SPBSET_CH_SLOTS) {
+      x = (chunk->slots[i] >> (last % 64));
+      if(x) {
+        /* more bits set, next is `last` + trailing 0s of the shifted slot */
+        *pnext = last + CURL_CTZ64(x);
+        return TRUE;
+      }
+      /* no more bits set in the last slot, scan forward */
+      for(i = i + 1; i < CURL_UINT32_SPBSET_CH_SLOTS; ++i) {
+        if(chunk->slots[i]) {
+          *pnext = chunk->offset + ((i * 64) + CURL_CTZ64(chunk->slots[i]));
+          return TRUE;
+        }
+      }
+    }
+  }
+  *pnext = UINT32_MAX;
+  return FALSE;
+}
+
+bool Curl_uint32_spbset_next(struct uint32_spbset *bset, uint32_t last,
+                             uint32_t *pnext)
+{
+  struct uint32_spbset_chunk *chunk;
+  uint32_t last_offset;
+
+  ++last; /* look for the next higher number */
+  last_offset = (last & ~CURL_UINT32_SPBSET_CH_MASK);
+
+  for(chunk = &bset->head; chunk; chunk = chunk->next) {
+    if(chunk->offset >= last_offset) {
+      break;
+    }
+  }
+
+  if(chunk && (chunk->offset == last_offset)) {
+    /* is there a number higher than last in this chunk? */
+    if(uint32_spbset_chunk_next(chunk, last, pnext))
+      return TRUE;
+    /* not in this chunk */
+    chunk = chunk->next;
+  }
+  /* look for the first in the "higher" chunks, if there are any. */
+  while(chunk) {
+    if(uint32_spbset_chunk_first(chunk, pnext))
+      return TRUE;
+    chunk = chunk->next;
+  }
+  *pnext = UINT32_MAX;
+  return FALSE;
+}
diff --git a/third-party/curl/lib/uint-spbset.h b/third-party/curl/lib/uint-spbset.h
new file mode 100644
index 0000000000..4b105c02ed
--- /dev/null
+++ b/third-party/curl/lib/uint-spbset.h
@@ -0,0 +1,91 @@
+#ifndef HEADER_CURL_UINT_SPBSET_H
+#define HEADER_CURL_UINT_SPBSET_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+/* A "sparse" bitset for uint32_t values.
+ * It can hold any uint32_t value.
+ *
+ * Optimized for the case where only a small set of numbers need
+ * to be kept, especially when "close" together. Then storage space
+ * is most efficient, deteriorating when many number are far apart.
+ */
+
+/* 4 slots = 256 bits, keep this a 2^n value. */
+#define CURL_UINT32_SPBSET_CH_SLOTS  4
+#define CURL_UINT32_SPBSET_CH_MASK   ((CURL_UINT32_SPBSET_CH_SLOTS * 64) - 1)
+
+/* store the uint value from offset to
+ * (offset + (CURL_UINT32_SPBSET_CHUNK_SLOTS * 64) - 1 */
+struct uint32_spbset_chunk {
+  struct uint32_spbset_chunk *next;
+  uint64_t slots[CURL_UINT32_SPBSET_CH_SLOTS];
+  uint32_t offset;
+};
+
+struct uint32_spbset {
+  struct uint32_spbset_chunk head;
+#ifdef DEBUGBUILD
+  int init;
+#endif
+};
+
+void Curl_uint32_spbset_init(struct uint32_spbset *bset);
+
+void Curl_uint32_spbset_destroy(struct uint32_spbset *bset);
+
+/* Get the cardinality of the bitset, e.g. numbers present in the set. */
+uint32_t Curl_uint32_spbset_count(struct uint32_spbset *bset);
+
+/* Add the number `i` to the bitset.
+ * Numbers can be added more than once, without making a difference.
+ * Returns FALSE if allocations failed. */
+bool Curl_uint32_spbset_add(struct uint32_spbset *bset, uint32_t i);
+
+/* Remove the number `i` from the bitset. */
+void Curl_uint32_spbset_remove(struct uint32_spbset *bset, uint32_t i);
+
+/* Return TRUE if the bitset contains number `i`. */
+bool Curl_uint32_spbset_contains(struct uint32_spbset *bset, uint32_t i);
+
+/* Get the first number in the bitset, e.g. the smallest.
+ * Returns FALSE when the bitset is empty. */
+bool Curl_uint32_spbset_first(struct uint32_spbset *bset, uint32_t *pfirst);
+
+/* Get the next number in the bitset, following `last` in natural order.
+ * Put another way, this is the smallest number greater than `last` in
+ * the bitset. `last` does not have to be present in the set.
+ *
+ * Returns FALSE when no such number is in the set.
+ *
+ * This allows to iterate the set while being modified:
+ * - added numbers higher than 'last' will be picked up by the iteration.
+ * - added numbers lower than 'last' will not show up.
+ * - removed numbers lower or equal to 'last' will not show up.
+ * - removed numbers higher than 'last' will not be visited. */
+bool Curl_uint32_spbset_next(struct uint32_spbset *bset, uint32_t last,
+                             uint32_t *pnext);
+
+#endif /* HEADER_CURL_UINT_SPBSET_H */
diff --git a/third-party/curl/lib/uint-table.c b/third-party/curl/lib/uint-table.c
new file mode 100644
index 0000000000..addd2c9cb2
--- /dev/null
+++ b/third-party/curl/lib/uint-table.c
@@ -0,0 +1,202 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "uint-table.h"
+
+#ifdef DEBUGBUILD
+#define CURL_UINT32_TBL_MAGIC  0x62757473
+#endif
+
+void Curl_uint32_tbl_init(struct uint32_tbl *tbl,
+                          Curl_uint32_tbl_entry_dtor *entry_dtor)
+{
+  memset(tbl, 0, sizeof(*tbl));
+  tbl->entry_dtor = entry_dtor;
+  tbl->last_key_added = UINT32_MAX;
+#ifdef DEBUGBUILD
+  tbl->init = CURL_UINT32_TBL_MAGIC;
+#endif
+}
+
+static void uint32_tbl_clear_rows(struct uint32_tbl *tbl,
+                                  uint32_t from,
+                                  uint32_t upto_excluding)
+{
+  uint32_t i, end;
+
+  end = CURLMIN(upto_excluding, tbl->nrows);
+  for(i = from; i < end; ++i) {
+    if(tbl->rows[i]) {
+      if(tbl->entry_dtor)
+        tbl->entry_dtor(i, tbl->rows[i]);
+      tbl->rows[i] = NULL;
+      tbl->nentries--;
+    }
+  }
+}
+
+CURLcode Curl_uint32_tbl_resize(struct uint32_tbl *tbl, uint32_t nrows)
+{
+  /* we use `tbl->nrows + 1` during iteration, want that to work */
+  DEBUGASSERT(tbl->init == CURL_UINT32_TBL_MAGIC);
+  if(!nrows)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  if(nrows != tbl->nrows) {
+    void **rows = curlx_calloc(nrows, sizeof(void *));
+    if(!rows)
+      return CURLE_OUT_OF_MEMORY;
+    if(tbl->rows) {
+      memcpy(rows, tbl->rows, (CURLMIN(nrows, tbl->nrows) * sizeof(void *)));
+      if(nrows < tbl->nrows)
+        uint32_tbl_clear_rows(tbl, nrows, tbl->nrows);
+      curlx_free(tbl->rows);
+    }
+    tbl->rows = rows;
+    tbl->nrows = nrows;
+  }
+  return CURLE_OK;
+}
+
+/* Clear the table, making it empty.
+
+   @unittest 3212
+ */
+UNITTEST void uint32_tbl_clear(struct uint32_tbl *tbl);
+UNITTEST void uint32_tbl_clear(struct uint32_tbl *tbl)
+{
+  DEBUGASSERT(tbl->init == CURL_UINT32_TBL_MAGIC);
+  uint32_tbl_clear_rows(tbl, 0, tbl->nrows);
+  DEBUGASSERT(!tbl->nentries);
+  tbl->last_key_added = UINT32_MAX;
+}
+
+void Curl_uint32_tbl_destroy(struct uint32_tbl *tbl)
+{
+  DEBUGASSERT(tbl->init == CURL_UINT32_TBL_MAGIC);
+  uint32_tbl_clear(tbl);
+  curlx_free(tbl->rows);
+  memset(tbl, 0, sizeof(*tbl));
+}
+
+uint32_t Curl_uint32_tbl_capacity(struct uint32_tbl *tbl)
+{
+  return tbl->nrows;
+}
+
+uint32_t Curl_uint32_tbl_count(struct uint32_tbl *tbl)
+{
+  return tbl->nentries;
+}
+
+void *Curl_uint32_tbl_get(struct uint32_tbl *tbl, uint32_t key)
+{
+  return (key < tbl->nrows) ? tbl->rows[key] : NULL;
+}
+
+bool Curl_uint32_tbl_add(struct uint32_tbl *tbl, void *entry, uint32_t *pkey)
+{
+  uint32_t key, start_pos;
+
+  DEBUGASSERT(tbl->init == CURL_UINT32_TBL_MAGIC);
+  if(!entry || !pkey)
+    return FALSE;
+  *pkey = UINT32_MAX;
+  if(tbl->nentries == tbl->nrows)  /* full */
+    return FALSE;
+
+  start_pos = CURLMIN(tbl->last_key_added, tbl->nrows) + 1;
+  for(key = start_pos; key < tbl->nrows; ++key) {
+    if(!tbl->rows[key]) {
+      tbl->rows[key] = entry;
+      tbl->nentries++;
+      tbl->last_key_added = key;
+      *pkey = key;
+      return TRUE;
+    }
+  }
+  /* no free entry at or above tbl->maybe_next_key, wrap around */
+  for(key = 0; key < start_pos; ++key) {
+    if(!tbl->rows[key]) {
+      tbl->rows[key] = entry;
+      tbl->nentries++;
+      tbl->last_key_added = key;
+      *pkey = key;
+      return TRUE;
+    }
+  }
+  /* Did not find any free row? Should not happen */
+  DEBUGASSERT(0);
+  return FALSE;
+}
+
+void Curl_uint32_tbl_remove(struct uint32_tbl *tbl, uint32_t key)
+{
+  uint32_tbl_clear_rows(tbl, key, key + 1);
+}
+
+bool Curl_uint32_tbl_contains(struct uint32_tbl *tbl, uint32_t key)
+{
+  return (key < tbl->nrows) ? !!tbl->rows[key] : FALSE;
+}
+
+static bool uint32_tbl_next_at(struct uint32_tbl *tbl, uint32_t key,
+                               uint32_t *pkey, void **pentry)
+{
+  for(; key < tbl->nrows; ++key) {
+    if(tbl->rows[key]) {
+      *pkey = key;
+      *pentry = tbl->rows[key];
+      return TRUE;
+    }
+  }
+  *pkey = UINT32_MAX;  /* always invalid */
+  *pentry = NULL;
+  return FALSE;
+}
+
+bool Curl_uint32_tbl_first(struct uint32_tbl *tbl,
+                           uint32_t *pkey, void **pentry)
+{
+  if(!pkey || !pentry)
+    return FALSE;
+  if(tbl->nentries && uint32_tbl_next_at(tbl, 0, pkey, pentry))
+    return TRUE;
+  DEBUGASSERT(!tbl->nentries);
+  *pkey = UINT32_MAX;  /* always invalid */
+  *pentry = NULL;
+  return FALSE;
+}
+
+bool Curl_uint32_tbl_next(struct uint32_tbl *tbl, uint32_t last_key,
+                          uint32_t *pkey, void **pentry)
+{
+  if(!pkey || !pentry)
+    return FALSE;
+  if(uint32_tbl_next_at(tbl, last_key + 1, pkey, pentry))
+    return TRUE;
+  *pkey = UINT32_MAX;  /* always invalid */
+  *pentry = NULL;
+  return FALSE;
+}
diff --git a/third-party/curl/lib/uint-table.h b/third-party/curl/lib/uint-table.h
new file mode 100644
index 0000000000..398a26a648
--- /dev/null
+++ b/third-party/curl/lib/uint-table.h
@@ -0,0 +1,96 @@
+#ifndef HEADER_CURL_UINT_TABLE_H
+#define HEADER_CURL_UINT_TABLE_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+/* Destructor for a single table entry */
+typedef void Curl_uint32_tbl_entry_dtor(uint32_t key, void *entry);
+
+struct uint32_tbl {
+  void **rows;  /* array of void* holding entries */
+  Curl_uint32_tbl_entry_dtor *entry_dtor;
+  uint32_t nrows;  /* length of `rows` array */
+  uint32_t nentries; /* entries in table */
+  uint32_t last_key_added; /* UINT_MAX or last key added */
+#ifdef DEBUGBUILD
+  int init;
+#endif
+};
+
+/* Initialize the table with 0 capacity.
+ * The optional `entry_dtor` is called when a table entry is removed,
+ * Passing NULL means no action is taken on removal. */
+void Curl_uint32_tbl_init(struct uint32_tbl *tbl,
+                          Curl_uint32_tbl_entry_dtor *entry_dtor);
+
+/* Resize the table to change capacity `nmax`. When `nmax` is reduced,
+ * all present entries with key equal or larger to `nmax` are removed. */
+CURLcode Curl_uint32_tbl_resize(struct uint32_tbl *tbl, uint32_t nrows);
+
+/* Destroy the table, freeing all entries. */
+void Curl_uint32_tbl_destroy(struct uint32_tbl *tbl);
+
+/* Get the table capacity. */
+uint32_t Curl_uint32_tbl_capacity(struct uint32_tbl *tbl);
+
+/* Get the number of entries in the table. */
+uint32_t Curl_uint32_tbl_count(struct uint32_tbl *tbl);
+
+/* Get the entry for key or NULL if not present */
+void *Curl_uint32_tbl_get(struct uint32_tbl *tbl, uint32_t key);
+
+/* Add a new entry to the table and assign it a free key.
+ * Returns FALSE if the table is full.
+ *
+ * Keys are assigned in a round-robin manner.
+ * No matter the capacity, UINT_MAX is never assigned. */
+bool Curl_uint32_tbl_add(struct uint32_tbl *tbl, void *entry, uint32_t *pkey);
+
+/* Remove the entry with `key`. */
+void Curl_uint32_tbl_remove(struct uint32_tbl *tbl, uint32_t key);
+
+/* Return TRUE if the table contains an tryn with that keys. */
+bool Curl_uint32_tbl_contains(struct uint32_tbl *tbl, uint32_t key);
+
+/* Get the first entry in the table (with the smallest `key`).
+ * Returns FALSE if the table is empty. */
+bool Curl_uint32_tbl_first(struct uint32_tbl *tbl,
+                           uint32_t *pkey, void **pentry);
+
+/* Get the next key in the table, following `last_key` in natural order.
+ * Put another way, this is the smallest key greater than `last_key` in
+ * the table. `last_key` does not have to be present in the table.
+ *
+ * Returns FALSE when no such entry is in the table.
+ *
+ * This allows to iterate the table while being modified:
+ * - added keys higher than 'last_key' will be picked up by the iteration.
+ * - added keys lower than 'last_key' will not show up.
+ * - removed keys lower or equal to 'last_key' will not show up.
+ * - removed keys higher than 'last_key' will not be visited. */
+bool Curl_uint32_tbl_next(struct uint32_tbl *tbl, uint32_t last_key,
+                          uint32_t *pkey, void **pentry);
+
+#endif /* HEADER_CURL_UINT_TABLE_H */
diff --git a/third-party/curl/lib/url.c b/third-party/curl/lib/url.c
index 4f5673ed0d..505e08a7e1 100644
--- a/third-party/curl/lib/url.c
+++ b/third-party/curl/lib/url.c
@@ -21,7 +21,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef HAVE_NETINET_IN_H
@@ -56,241 +55,96 @@
 #endif
 
 #ifndef HAVE_SOCKET
-#error "We can't compile without socket() support!"
+#error "We cannot compile without socket() support!"
 #endif
 
-#include <limits.h>
+#if defined(HAVE_IF_NAMETOINDEX) && defined(USE_WINSOCK)
+#if defined(__MINGW32__) && (__MINGW64_VERSION_MAJOR <= 5)
+#include <wincrypt.h>  /* workaround for old mingw-w64 missing to include it */
+#endif
+#include <iphlpapi.h>
+#endif
 
-#include "doh.h"
 #include "urldata.h"
-#include "netrc.h"
-#include "formdata.h"
 #include "mime.h"
+#include "bufref.h"
 #include "vtls/vtls.h"
+#include "vssh/vssh.h"
 #include "hostip.h"
 #include "transfer.h"
-#include "sendf.h"
+#include "curl_addrinfo.h"
+#include "curl_trc.h"
 #include "progress.h"
 #include "cookie.h"
 #include "strcase.h"
-#include "strerror.h"
 #include "escape.h"
-#include "strtok.h"
-#include "share.h"
-#include "content_encoding.h"
+#include "curl_share.h"
 #include "http_digest.h"
-#include "http_negotiate.h"
-#include "select.h"
 #include "multiif.h"
-#include "easyif.h"
-#include "speedcheck.h"
-#include "warnless.h"
 #include "getinfo.h"
+#include "pop3.h"
 #include "urlapi-int.h"
 #include "system_win32.h"
 #include "hsts.h"
-#include "noproxy.h"
+#include "proxy.h"
 #include "cfilters.h"
 #include "idn.h"
+#include "http_proxy.h"
+#include "conncache.h"
+#include "multihandle.h"
+#include "curlx/strdup.h"
+#include "setopt.h"
+#include "altsvc.h"
+#include "curlx/dynbuf.h"
+#include "headers.h"
+#include "curlx/strerr.h"
+#include "curlx/strparse.h"
+#include "peer.h"
 
-/* And now for the protocols */
+/* Now for the protocols */
 #include "ftp.h"
 #include "dict.h"
 #include "telnet.h"
 #include "tftp.h"
 #include "http.h"
-#include "http2.h"
+#include "vauth/vauth.h"
 #include "file.h"
 #include "curl_ldap.h"
 #include "vssh/ssh.h"
 #include "imap.h"
 #include "url.h"
 #include "connect.h"
-#include "inet_ntop.h"
-#include "http_ntlm.h"
-#include "curl_rtmp.h"
 #include "gopher.h"
 #include "mqtt.h"
-#include "http_proxy.h"
-#include "conncache.h"
-#include "multihandle.h"
-#include "strdup.h"
-#include "setopt.h"
-#include "altsvc.h"
-#include "dynbuf.h"
-#include "headers.h"
+#include "rtsp.h"
+#include "smtp.h"
+#include "ws.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-#ifndef ARRAYSIZE
-#define ARRAYSIZE(A) (sizeof(A)/sizeof((A)[0]))
-#endif
-
-#ifdef USE_NGHTTP2
-static void data_priority_cleanup(struct Curl_easy *data);
-#else
-#define data_priority_cleanup(x)
-#endif
-
-/* Some parts of the code (e.g. chunked encoding) assume this buffer has at
- * more than just a few bytes to play with. Don't let it become too small or
- * bad things will happen.
+/* Some parts of the code (e.g. chunked encoding) assume this buffer has more
+ * than a few bytes to play with. Do not let it become too small or bad things
+ * will happen.
  */
 #if READBUFFER_SIZE < READBUFFER_MIN
 # error READBUFFER_SIZE is too small
 #endif
 
-#ifdef USE_UNIX_SOCKETS
-#define UNIX_SOCKET_PREFIX "localhost"
-#endif
-
-/* Reject URLs exceeding this length */
-#define MAX_URL_LEN 0xffff
-
 /*
-* get_protocol_family()
-*
-* This is used to return the protocol family for a given protocol.
-*
-* Parameters:
-*
-* 'h'  [in]  - struct Curl_handler pointer.
-*
-* Returns the family as a single bit protocol identifier.
-*/
-static curl_prot_t get_protocol_family(const struct Curl_handler *h)
-{
-  DEBUGASSERT(h);
-  DEBUGASSERT(h->family);
-  return h->family;
-}
-
-
-/*
- * Protocol table. Schemes (roughly) in 2019 popularity order:
+ * get_protocol_family()
  *
- * HTTPS, HTTP, FTP, FTPS, SFTP, FILE, SCP, SMTP, LDAP, IMAPS, TELNET, IMAP,
- * LDAPS, SMTPS, TFTP, SMB, POP3, GOPHER POP3S, RTSP, RTMP, SMBS, DICT
+ * This is used to return the protocol family for a given protocol.
+ *
+ * Parameters:
+ *
+ * 's'  [in]  - struct Curl_scheme pointer.
+ *
+ * Returns the family as a single bit protocol identifier.
  */
-static const struct Curl_handler * const protocols[] = {
-
-#if defined(USE_SSL) && !defined(CURL_DISABLE_HTTP)
-  &Curl_handler_https,
-#endif
-
-#ifndef CURL_DISABLE_HTTP
-  &Curl_handler_http,
-#endif
-
-#ifdef USE_WEBSOCKETS
-#if defined(USE_SSL) && !defined(CURL_DISABLE_HTTP)
-  &Curl_handler_wss,
-#endif
-
-#ifndef CURL_DISABLE_HTTP
-  &Curl_handler_ws,
-#endif
-#endif
-
-#ifndef CURL_DISABLE_FTP
-  &Curl_handler_ftp,
-#endif
-
-#if defined(USE_SSL) && !defined(CURL_DISABLE_FTP)
-  &Curl_handler_ftps,
-#endif
-
-#if defined(USE_SSH)
-  &Curl_handler_sftp,
-#endif
-
-#ifndef CURL_DISABLE_FILE
-  &Curl_handler_file,
-#endif
-
-#if defined(USE_SSH) && !defined(USE_WOLFSSH)
-  &Curl_handler_scp,
-#endif
-
-#ifndef CURL_DISABLE_SMTP
-  &Curl_handler_smtp,
-#ifdef USE_SSL
-  &Curl_handler_smtps,
-#endif
-#endif
-
-#ifndef CURL_DISABLE_LDAP
-  &Curl_handler_ldap,
-#if !defined(CURL_DISABLE_LDAPS) && \
-    ((defined(USE_OPENLDAP) && defined(USE_SSL)) || \
-     (!defined(USE_OPENLDAP) && defined(HAVE_LDAP_SSL)))
-  &Curl_handler_ldaps,
-#endif
-#endif
-
-#ifndef CURL_DISABLE_IMAP
-  &Curl_handler_imap,
-#ifdef USE_SSL
-  &Curl_handler_imaps,
-#endif
-#endif
-
-#ifndef CURL_DISABLE_TELNET
-  &Curl_handler_telnet,
-#endif
-
-#ifndef CURL_DISABLE_TFTP
-  &Curl_handler_tftp,
-#endif
-
-#ifndef CURL_DISABLE_POP3
-  &Curl_handler_pop3,
-#ifdef USE_SSL
-  &Curl_handler_pop3s,
-#endif
-#endif
-
-#if !defined(CURL_DISABLE_SMB) && defined(USE_CURL_NTLM_CORE) && \
-   (SIZEOF_CURL_OFF_T > 4)
-  &Curl_handler_smb,
-#ifdef USE_SSL
-  &Curl_handler_smbs,
-#endif
-#endif
-
-#ifndef CURL_DISABLE_RTSP
-  &Curl_handler_rtsp,
-#endif
-
-#ifndef CURL_DISABLE_MQTT
-  &Curl_handler_mqtt,
-#endif
-
-#ifndef CURL_DISABLE_GOPHER
-  &Curl_handler_gopher,
-#ifdef USE_SSL
-  &Curl_handler_gophers,
-#endif
-#endif
-
-#ifdef USE_LIBRTMP
-  &Curl_handler_rtmp,
-  &Curl_handler_rtmpt,
-  &Curl_handler_rtmpe,
-  &Curl_handler_rtmpte,
-  &Curl_handler_rtmps,
-  &Curl_handler_rtmpts,
-#endif
-
-#ifndef CURL_DISABLE_DICT
-  &Curl_handler_dict,
-#endif
-
-  (struct Curl_handler *) NULL
-};
+static curl_prot_t get_protocol_family(const struct Curl_scheme *s)
+{
+  DEBUGASSERT(s);
+  DEBUGASSERT(s->family);
+  return s->family;
+}
 
 void Curl_freeset(struct Curl_easy *data)
 {
@@ -299,29 +153,24 @@ void Curl_freeset(struct Curl_easy *data)
   enum dupblob j;
 
   for(i = (enum dupstring)0; i < STRING_LAST; i++) {
-    Curl_safefree(data->set.str[i]);
+    curlx_safefree(data->set.str[i]);
   }
 
   for(j = (enum dupblob)0; j < BLOB_LAST; j++) {
-    Curl_safefree(data->set.blobs[j]);
+    curlx_safefree(data->set.blobs[j]);
   }
 
-  if(data->state.referer_alloc) {
-    Curl_safefree(data->state.referer);
-    data->state.referer_alloc = FALSE;
-  }
-  data->state.referer = NULL;
-  if(data->state.url_alloc) {
-    Curl_safefree(data->state.url);
-    data->state.url_alloc = FALSE;
-  }
-  data->state.url = NULL;
+  Curl_bufref_free(&data->state.referer);
+  Curl_bufref_free(&data->state.url);
 
-  Curl_mime_cleanpart(&data->set.mimepost);
+#if !defined(CURL_DISABLE_MIME) || !defined(CURL_DISABLE_FORM_API)
+  Curl_mime_cleanpart(data->set.mimepostp);
+  curlx_safefree(data->set.mimepostp);
+#endif
 
 #ifndef CURL_DISABLE_COOKIES
-  curl_slist_free_all(data->set.cookielist);
-  data->set.cookielist = NULL;
+  curl_slist_free_all(data->state.cookielist);
+  data->state.cookielist = NULL;
 #endif
 }
 
@@ -329,14 +178,14 @@ void Curl_freeset(struct Curl_easy *data)
 static void up_free(struct Curl_easy *data)
 {
   struct urlpieces *up = &data->state.up;
-  Curl_safefree(up->scheme);
-  Curl_safefree(up->hostname);
-  Curl_safefree(up->port);
-  Curl_safefree(up->user);
-  Curl_safefree(up->password);
-  Curl_safefree(up->options);
-  Curl_safefree(up->path);
-  Curl_safefree(up->query);
+  curlx_safefree(up->scheme);
+  curlx_safefree(up->hostname);
+  curlx_safefree(up->port);
+  curlx_safefree(up->user);
+  curlx_safefree(up->password);
+  curlx_safefree(up->options);
+  curlx_safefree(up->path);
+  curlx_safefree(up->query);
   curl_url_cleanup(data->state.uh);
   data->state.uh = NULL;
 }
@@ -358,115 +207,106 @@ CURLcode Curl_close(struct Curl_easy **datap)
   data = *datap;
   *datap = NULL;
 
-  Curl_expire_clear(data); /* shut off timers */
-
-  /* Detach connection if any is left. This should not be normal, but can be
-     the case for example with CONNECT_ONLY + recv/send (test 556) */
-  Curl_detach_connection(data);
-  if(data->multi)
+  if(!data->state.internal && data->multi) {
     /* This handle is still part of a multi handle, take care of this first
-       and detach this handle from there. */
+       and detach this handle from there.
+       This detaches the connection. */
     curl_multi_remove_handle(data->multi, data);
-
-  if(data->multi_easy) {
-    /* when curl_easy_perform() is used, it creates its own multi handle to
-       use and this is the one */
-    curl_multi_cleanup(data->multi_easy);
-    data->multi_easy = NULL;
   }
+  else {
+    /* Detach connection if any is left. This should not be normal, but can be
+       the case for example with CONNECT_ONLY + recv/send (test 556) */
+    Curl_detach_connection(data);
+    if(!data->state.internal && data->multi_easy) {
+      /* when curl_easy_perform() is used, it creates its own multi handle to
+         use and this is the one */
+      curl_multi_cleanup(data->multi_easy);
+      data->multi_easy = NULL;
+    }
+  }
+  DEBUGASSERT(!data->conn || data->state.internal);
 
-  data->magic = 0; /* force a clear AFTER the possibly enforced removal from
-                      the multi handle, since that function uses the magic
-                      field! */
+  Curl_expire_clear(data); /* shut off any timers left */
 
   if(data->state.rangestringalloc)
-    free(data->state.range);
+    curlx_free(data->state.range);
 
-  /* freed here just in case DONE wasn't called */
-  Curl_free_request_state(data);
+  /* release any resolve information this transfer kept */
+  Curl_resolv_destroy_all(data);
+
+  data->set.verbose = FALSE; /* no more calls to DEBUGFUNCTION */
+  data->magic = 0; /* force a clear AFTER the possibly enforced removal from
+                    * the multi handle and async dns shutdown. The multi
+                    * handle might check the magic and so might any
+                    * DEBUGFUNCTION invoked for tracing */
+
+  /* freed here in case DONE was not called */
+  Curl_req_free(&data->req, data);
 
   /* Close down all open SSL info and sessions */
   Curl_ssl_close_all(data);
-  Curl_safefree(data->state.first_host);
-  Curl_safefree(data->state.scratch);
+  Curl_peer_unlink(&data->state.origin);
+  Curl_peer_unlink(&data->state.initial_origin);
   Curl_ssl_free_certinfo(data);
 
-  /* Cleanup possible redirect junk */
-  free(data->req.newurl);
-  data->req.newurl = NULL;
-
-  if(data->state.referer_alloc) {
-    Curl_safefree(data->state.referer);
-    data->state.referer_alloc = FALSE;
-  }
-  data->state.referer = NULL;
+  Curl_bufref_free(&data->state.referer);
 
   up_free(data);
-  Curl_safefree(data->state.buffer);
-  Curl_dyn_free(&data->state.headerb);
-  Curl_safefree(data->state.ulbuf);
+  curlx_dyn_free(&data->state.headerb);
   Curl_flush_cookies(data, TRUE);
+#ifndef CURL_DISABLE_ALTSVC
   Curl_altsvc_save(data, data->asi, data->set.str[STRING_ALTSVC]);
   Curl_altsvc_cleanup(&data->asi);
-  Curl_hsts_save(data, data->hsts, data->set.str[STRING_HSTS]);
+#endif
 #ifndef CURL_DISABLE_HSTS
+  Curl_hsts_save(data, data->hsts, data->set.str[STRING_HSTS]);
   if(!data->share || !data->share->hsts)
     Curl_hsts_cleanup(&data->hsts);
-  curl_slist_free_all(data->set.hstslist); /* clean up list */
+  curl_slist_free_all(data->state.hstslist); /* clean up list */
 #endif
 #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_DIGEST_AUTH)
   Curl_http_auth_cleanup_digest(data);
 #endif
-  Curl_safefree(data->info.contenttype);
-  Curl_safefree(data->info.wouldredirect);
-
-  /* this destroys the channel and we cannot use it anymore after this */
-  Curl_resolver_cancel(data);
-  Curl_resolver_cleanup(data->state.async.resolver);
-
-  data_priority_cleanup(data);
+  curlx_safefree(data->state.most_recent_ftp_entrypath);
+  curlx_safefree(data->info.contenttype);
+  curlx_safefree(data->info.wouldredirect);
 
   /* No longer a dirty share, if it exists */
-  if(data->share) {
-    Curl_share_lock(data, CURL_LOCK_DATA_SHARE, CURL_LOCK_ACCESS_SINGLE);
-    data->share->dirty--;
-    Curl_share_unlock(data, CURL_LOCK_DATA_SHARE);
-  }
+  if(Curl_share_easy_unlink(data))
+    DEBUGASSERT(0);
 
-  Curl_safefree(data->state.aptr.proxyuserpwd);
-  Curl_safefree(data->state.aptr.uagent);
-  Curl_safefree(data->state.aptr.userpwd);
-  Curl_safefree(data->state.aptr.accept_encoding);
-  Curl_safefree(data->state.aptr.te);
-  Curl_safefree(data->state.aptr.rangeline);
-  Curl_safefree(data->state.aptr.ref);
-  Curl_safefree(data->state.aptr.host);
-  Curl_safefree(data->state.aptr.cookiehost);
-  Curl_safefree(data->state.aptr.rtsp_transport);
-  Curl_safefree(data->state.aptr.user);
-  Curl_safefree(data->state.aptr.passwd);
-  Curl_safefree(data->state.aptr.proxyuser);
-  Curl_safefree(data->state.aptr.proxypasswd);
-
-#ifndef CURL_DISABLE_DOH
-  if(data->req.doh) {
-    Curl_dyn_free(&data->req.doh->probe[0].serverdoh);
-    Curl_dyn_free(&data->req.doh->probe[1].serverdoh);
-    curl_slist_free_all(data->req.doh->headers);
-    Curl_safefree(data->req.doh);
-  }
+  Curl_hash_destroy(&data->meta_hash);
+  Curl_creds_unlink(&data->state.creds);
+  curlx_safefree(data->state.aptr.uagent);
+  curlx_safefree(data->state.aptr.accept_encoding);
+  curlx_safefree(data->state.aptr.rangeline);
+  curlx_safefree(data->state.aptr.ref);
+  curlx_safefree(data->state.aptr.host);
+#ifndef CURL_DISABLE_COOKIES
+  curlx_safefree(data->req.cookiehost);
+#endif
+#ifndef CURL_DISABLE_RTSP
+  curlx_safefree(data->state.aptr.rtsp_transport);
 #endif
 
+#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_FORM_API)
   Curl_mime_cleanpart(data->state.formp);
-#ifndef CURL_DISABLE_HTTP
-  Curl_safefree(data->state.formp);
+  curlx_safefree(data->state.formp);
 #endif
 
   /* destruct wildcard structures if it is needed */
   Curl_wildcard_dtor(&data->wildcard);
   Curl_freeset(data);
   Curl_headers_cleanup(data);
-  free(data);
+  Curl_netrc_cleanup(&data->state.netrc);
+#ifndef CURL_DISABLE_DIGEST_AUTH
+  curlx_free(data->state.envproxy);
+#endif
+  Curl_ssl_config_cleanup(&data->set.ssl.primary);
+#ifndef CURL_DISABLE_PROXY
+  Curl_ssl_config_cleanup(&data->set.proxy_ssl.primary);
+#endif
+  curlx_free(data);
   return CURLE_OK;
 }
 
@@ -474,26 +314,31 @@ CURLcode Curl_close(struct Curl_easy **datap)
  * Initialize the UserDefined fields within a Curl_easy.
  * This may be safely called on a new or existing Curl_easy.
  */
-CURLcode Curl_init_userdefined(struct Curl_easy *data)
+void Curl_init_userdefined(struct Curl_easy *data)
 {
   struct UserDefined *set = &data->set;
-  CURLcode result = CURLE_OK;
 
-  set->out = stdout; /* default output to stdout */
+  set->out = stdout;  /* default output to stdout */
   set->in_set = stdin;  /* default input from stdin */
-  set->err  = stderr;  /* default stderr to stderr */
+  set->err = stderr;  /* default stderr to stderr */
 
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wcast-function-type-strict"
+#endif
   /* use fwrite as default function to store output */
   set->fwrite_func = (curl_write_callback)fwrite;
 
   /* use fread as default function to read input */
   set->fread_func_set = (curl_read_callback)fread;
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic pop
+#endif
   set->is_fread_set = 0;
 
-  set->seek_func = ZERO_NULL;
   set->seek_client = ZERO_NULL;
 
-  set->filesize = -1;        /* we don't know the size */
+  set->filesize = -1;        /* we do not know the size */
   set->postfieldsize = -1;   /* unknown size */
   set->maxredirs = 30;       /* sensible default */
 
@@ -508,16 +353,16 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data)
   set->ftp_filemethod = FTPFILE_MULTICWD;
   set->ftp_skip_ip = TRUE;    /* skip PASV IP by default */
 #endif
-  set->dns_cache_timeout = 60; /* Timeout every 60 seconds by default */
+  set->dns_cache_timeout_ms = 60000; /* Timeout every 60 seconds by default */
 
-  /* Set the default size of the SSL session ID cache */
-  set->general_ssl.max_ssl_sessions = 5;
   /* Timeout every 24 hours by default */
   set->general_ssl.ca_cache_timeout = 24 * 60 * 60;
 
   set->httpauth = CURLAUTH_BASIC;  /* defaults to basic */
 
+  Curl_ssl_config_init(&data->set.ssl.primary);
 #ifndef CURL_DISABLE_PROXY
+  Curl_ssl_config_init(&data->set.proxy_ssl.primary);
   set->proxyport = 0;
   set->proxytype = CURLPROXY_HTTP; /* defaults to HTTP proxy */
   set->proxyauth = CURLAUTH_BASIC; /* defaults to basic */
@@ -525,36 +370,19 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data)
   set->socks5auth = CURLAUTH_BASIC | CURLAUTH_GSSAPI;
 #endif
 
-  /* make libcurl quiet by default: */
-  set->hide_progress = TRUE;  /* CURLOPT_NOPROGRESS changes these */
-
-  Curl_mime_initpart(&set->mimepost);
-
-  /*
-   * libcurl 7.10 introduced SSL verification *by default*! This needs to be
-   * switched off unless wanted.
-   */
 #ifndef CURL_DISABLE_DOH
   set->doh_verifyhost = TRUE;
   set->doh_verifypeer = TRUE;
 #endif
-  set->ssl.primary.verifypeer = TRUE;
-  set->ssl.primary.verifyhost = TRUE;
 #ifdef USE_SSH
   /* defaults to any auth type */
   set->ssh_auth_types = CURLSSH_AUTH_DEFAULT;
   set->new_directory_perms = 0755; /* Default permissions */
 #endif
-  set->ssl.primary.sessionid = TRUE; /* session ID caching enabled by
-                                        default */
-#ifndef CURL_DISABLE_PROXY
-  set->proxy_ssl = set->ssl;
-#endif
 
   set->new_file_perms = 0644;    /* Default permissions */
-  set->allowed_protocols = (curl_prot_t) CURLPROTO_ALL;
-  set->redir_protocols = CURLPROTO_HTTP | CURLPROTO_HTTPS | CURLPROTO_FTP |
-                         CURLPROTO_FTPS;
+  set->allowed_protocols = (curl_prot_t)CURLPROTO_64ALL;
+  set->redir_protocols = CURLPROTO_REDIR;
 
 #if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
   /*
@@ -564,43 +392,24 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data)
   set->socks5_gssapi_nec = FALSE;
 #endif
 
-  /* Set the default CA cert bundle/path detected/specified at build time.
-   *
-   * If Schannel is the selected SSL backend then these locations are
-   * ignored. We allow setting CA location for schannel only when explicitly
-   * specified by the user via CURLOPT_CAINFO / --cacert.
-   */
-  if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
-#if defined(CURL_CA_BUNDLE)
-    result = Curl_setstropt(&set->str[STRING_SSL_CAFILE], CURL_CA_BUNDLE);
-    if(result)
-      return result;
-
-    result = Curl_setstropt(&set->str[STRING_SSL_CAFILE_PROXY],
-                            CURL_CA_BUNDLE);
-    if(result)
-      return result;
+  /* set default minimum TLS version */
+#ifdef USE_SSL
+  Curl_setopt_SSLVERSION(data, CURLOPT_SSLVERSION, CURL_SSLVERSION_DEFAULT);
+#ifndef CURL_DISABLE_PROXY
+  Curl_setopt_SSLVERSION(data, CURLOPT_PROXY_SSLVERSION,
+                         CURL_SSLVERSION_DEFAULT);
 #endif
-#if defined(CURL_CA_PATH)
-    result = Curl_setstropt(&set->str[STRING_SSL_CAPATH], CURL_CA_PATH);
-    if(result)
-      return result;
-
-    result = Curl_setstropt(&set->str[STRING_SSL_CAPATH_PROXY], CURL_CA_PATH);
-    if(result)
-      return result;
 #endif
-  }
-
 #ifndef CURL_DISABLE_FTP
   set->wildcard_enabled = FALSE;
-  set->chunk_bgn      = ZERO_NULL;
-  set->chunk_end      = ZERO_NULL;
+  set->chunk_bgn = ZERO_NULL;
+  set->chunk_end = ZERO_NULL;
   set->fnmatch = ZERO_NULL;
 #endif
   set->tcp_keepalive = FALSE;
   set->tcp_keepintvl = 60;
   set->tcp_keepidle = 60;
+  set->tcp_keepcnt = 9;
   set->tcp_fastopen = FALSE;
   set->tcp_nodelay = TRUE;
   set->ssl_enable_alpn = TRUE;
@@ -608,23 +417,33 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data)
   set->sep_headers = TRUE; /* separated header lists by default */
   set->buffer_size = READBUFFER_SIZE;
   set->upload_buffer_size = UPLOADBUFFER_DEFAULT;
+  set->upload_flags = CURLULFLAG_SEEN;
   set->happy_eyeballs_timeout = CURL_HET_DEFAULT;
   set->upkeep_interval_ms = CURL_UPKEEP_INTERVAL_DEFAULT;
   set->maxconnects = DEFAULT_CONNCACHE_SIZE; /* for easy handles */
-  set->maxage_conn = 118;
-  set->maxlifetime_conn = 0;
+  set->conn_max_idle_ms = 118 * 1000;
+  set->conn_max_age_ms = 24 * 3600 * 1000;
   set->http09_allowed = FALSE;
-#ifdef USE_HTTP2
-  set->httpwant = CURL_HTTP_VERSION_2TLS
-#else
-  set->httpwant = CURL_HTTP_VERSION_1_1
-#endif
-    ;
+  set->httpwant = CURL_HTTP_VERSION_NONE;
 #if defined(USE_HTTP2) || defined(USE_HTTP3)
   memset(&set->priority, 0, sizeof(set->priority));
 #endif
   set->quick_exit = 0L;
-  return result;
+#ifndef CURL_DISABLE_WEBSOCKETS
+  set->ws_raw_mode = FALSE;
+  set->ws_no_auto_pong = FALSE;
+#endif
+}
+
+/* easy->meta_hash destructor. Should never be called as elements
+ * MUST be added with their own destructor */
+static void easy_meta_freeentry(void *p)
+{
+  (void)p;
+  /* Always FALSE. Cannot use a 0 assert here since compilers
+   * are not in agreement if they then want a NORETURN attribute or
+   * not. *sigh* */
+  DEBUGASSERT(!p);
 }
 
 /**
@@ -637,319 +456,183 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data)
 
 CURLcode Curl_open(struct Curl_easy **curl)
 {
-  CURLcode result;
   struct Curl_easy *data;
 
-  /* Very simple start-up: alloc the struct, init it with zeroes and return */
-  data = calloc(1, sizeof(struct Curl_easy));
+  /* simple start-up: alloc the struct, init it with zeroes and return */
+  data = curlx_calloc(1, sizeof(struct Curl_easy));
   if(!data) {
-    /* this is a very serious error */
-    DEBUGF(fprintf(stderr, "Error: calloc of Curl_easy failed\n"));
+    /* this is a serious error */
+    DEBUGF(curl_mfprintf(stderr, "Error: calloc of Curl_easy failed\n"));
     return CURLE_OUT_OF_MEMORY;
   }
 
   data->magic = CURLEASY_MAGIC_NUMBER;
+  /* most recent connection is not yet defined */
+  data->state.lastconnect_id = -1;
+  data->state.recent_conn_id = -1;
+  /* and not assigned an id yet */
+  data->id = -1;
+  data->mid = UINT32_MAX;
+  data->master_mid = UINT32_MAX;
+  data->progress.hide = TRUE;
+  data->state.current_speed = -1; /* init to negative == impossible */
 
-  result = Curl_resolver_init(data, &data->state.async.resolver);
-  if(result) {
-    DEBUGF(fprintf(stderr, "Error: resolver_init failed\n"));
-    free(data);
-    return result;
-  }
+  Curl_hash_init(&data->meta_hash, 23,
+                 Curl_hash_str, curlx_str_key_compare, easy_meta_freeentry);
+  curlx_dyn_init(&data->state.headerb, CURL_MAX_HTTP_HEADER);
+  Curl_bufref_init(&data->state.url);
+  Curl_bufref_init(&data->state.referer);
+  Curl_req_init(&data->req);
+  Curl_initinfo(data);
+#ifndef CURL_DISABLE_HTTP
+  Curl_llist_init(&data->state.httphdrs, NULL);
+#endif
+  Curl_netrc_init(&data->state.netrc);
+  Curl_init_userdefined(data);
 
-  result = Curl_init_userdefined(data);
-  if(!result) {
-    Curl_dyn_init(&data->state.headerb, CURL_MAX_HTTP_HEADER);
-    Curl_initinfo(data);
-
-    /* most recent connection is not yet defined */
-    data->state.lastconnect_id = -1;
-    data->state.recent_conn_id = -1;
-    /* and not assigned an id yet */
-    data->id = -1;
-
-    data->progress.flags |= PGRS_HIDE;
-    data->state.current_speed = -1; /* init to negative == impossible */
-  }
-
-  if(result) {
-    Curl_resolver_cleanup(data->state.async.resolver);
-    Curl_dyn_free(&data->state.headerb);
-    Curl_freeset(data);
-    free(data);
-    data = NULL;
-  }
-  else
-    *curl = data;
-
-  return result;
+  *curl = data;
+  return CURLE_OK;
 }
 
-static void conn_shutdown(struct Curl_easy *data)
-{
-  DEBUGASSERT(data);
-  infof(data, "Closing connection");
-
-  /* possible left-overs from the async name resolvers */
-  Curl_resolver_cancel(data);
-
-  Curl_conn_close(data, SECONDARYSOCKET);
-  Curl_conn_close(data, FIRSTSOCKET);
-}
-
-static void conn_free(struct Curl_easy *data, struct connectdata *conn)
+void Curl_conn_free(struct Curl_easy *data, struct connectdata *conn)
 {
   size_t i;
 
   DEBUGASSERT(conn);
 
-  for(i = 0; i < ARRAYSIZE(conn->cfilter); ++i) {
+  if(conn->scheme && conn->scheme->run->disconnect &&
+     !conn->bits.shutdown_handler)
+    conn->scheme->run->disconnect(data, conn, TRUE);
+
+  for(i = 0; i < CURL_ARRAYSIZE(conn->cfilter); ++i) {
     Curl_conn_cf_discard_all(data, conn, (int)i);
   }
 
-  Curl_free_idnconverted_hostname(&conn->host);
-  Curl_free_idnconverted_hostname(&conn->conn_to_host);
 #ifndef CURL_DISABLE_PROXY
-  Curl_free_idnconverted_hostname(&conn->http_proxy.host);
-  Curl_free_idnconverted_hostname(&conn->socks_proxy.host);
-  Curl_safefree(conn->http_proxy.user);
-  Curl_safefree(conn->socks_proxy.user);
-  Curl_safefree(conn->http_proxy.passwd);
-  Curl_safefree(conn->socks_proxy.passwd);
-  Curl_safefree(conn->http_proxy.host.rawalloc); /* http proxy name buffer */
-  Curl_safefree(conn->socks_proxy.host.rawalloc); /* socks proxy name buffer */
-  Curl_free_primary_ssl_config(&conn->proxy_ssl_config);
+  Curl_peer_unlink(&conn->http_proxy.peer);
+  Curl_peer_unlink(&conn->socks_proxy.peer);
+  Curl_creds_unlink(&conn->http_proxy.creds);
+  Curl_creds_unlink(&conn->socks_proxy.creds);
 #endif
-  Curl_safefree(conn->user);
-  Curl_safefree(conn->passwd);
-  Curl_safefree(conn->sasl_authzid);
-  Curl_safefree(conn->options);
-  Curl_safefree(conn->oauth_bearer);
+  Curl_creds_unlink(&conn->creds);
+  Curl_peer_unlink(&conn->creds_origin);
+  curlx_safefree(conn->options);
+  curlx_safefree(conn->localdev);
+  Curl_ssl_conn_config_cleanup(conn);
+
+  curlx_safefree(conn->destination);
+  Curl_hash_destroy(&conn->meta_hash);
+  Curl_peer_unlink(&conn->origin);
+  Curl_peer_unlink(&conn->via_peer);
+  Curl_peer_unlink(&conn->origin2);
+  Curl_peer_unlink(&conn->via_peer2);
+
+  curlx_free(conn); /* free all the connection oriented data */
+}
+
+/*
+ * xfer_may_multiplex()
+ *
+ * Return a TRUE, iff the transfer can be done over an (appropriate)
+ * multiplexed connection.
+ */
+static bool xfer_may_multiplex(const struct Curl_easy *data,
+                               const struct connectdata *conn)
+{
 #ifndef CURL_DISABLE_HTTP
-  Curl_dyn_free(&conn->trailer);
-#endif
-  Curl_safefree(conn->host.rawalloc); /* host name buffer */
-  Curl_safefree(conn->conn_to_host.rawalloc); /* host name buffer */
-  Curl_safefree(conn->hostname_resolve);
-  Curl_safefree(conn->secondaryhostname);
-  Curl_safefree(conn->localdev);
-  Curl_free_primary_ssl_config(&conn->ssl_config);
-
-#ifdef USE_UNIX_SOCKETS
-  Curl_safefree(conn->unix_domain_socket);
-#endif
-
-  free(conn); /* free all the connection oriented data */
-}
-
-/*
- * Disconnects the given connection. Note the connection may not be the
- * primary connection, like when freeing room in the connection cache or
- * killing of a dead old connection.
- *
- * A connection needs an easy handle when closing down. We support this passed
- * in separately since the connection to get closed here is often already
- * disassociated from an easy handle.
- *
- * This function MUST NOT reset state in the Curl_easy struct if that
- * isn't strictly bound to the life-time of *this* particular connection.
- *
- */
-
-void Curl_disconnect(struct Curl_easy *data,
-                     struct connectdata *conn, bool dead_connection)
-{
-  /* there must be a connection to close */
-  DEBUGASSERT(conn);
-
-  /* it must be removed from the connection cache */
-  DEBUGASSERT(!conn->bundle);
-
-  /* there must be an associated transfer */
-  DEBUGASSERT(data);
-
-  /* the transfer must be detached from the connection */
-  DEBUGASSERT(!data->conn);
-
-  DEBUGF(infof(data, "Curl_disconnect(conn #%"
-         CURL_FORMAT_CURL_OFF_T ", dead=%d)",
-         conn->connection_id, dead_connection));
-  /*
-   * If this connection isn't marked to force-close, leave it open if there
-   * are other users of it
-   */
-  if(CONN_INUSE(conn) && !dead_connection) {
-    DEBUGF(infof(data, "Curl_disconnect when inuse: %zu", CONN_INUSE(conn)));
-    return;
-  }
-
-  if(conn->dns_entry) {
-    Curl_resolv_unlock(data, conn->dns_entry);
-    conn->dns_entry = NULL;
-  }
-
-  /* Cleanup NTLM connection-related data */
-  Curl_http_auth_cleanup_ntlm(conn);
-
-  /* Cleanup NEGOTIATE connection-related data */
-  Curl_http_auth_cleanup_negotiate(conn);
-
-  if(conn->connect_only)
-    /* treat the connection as dead in CONNECT_ONLY situations */
-    dead_connection = TRUE;
-
-  /* temporarily attach the connection to this transfer handle for the
-     disconnect and shutdown */
-  Curl_attach_connection(data, conn);
-
-  if(conn->handler && conn->handler->disconnect)
-    /* This is set if protocol-specific cleanups should be made */
-    conn->handler->disconnect(data, conn, dead_connection);
-
-  conn_shutdown(data);
-
-  /* detach it again */
-  Curl_detach_connection(data);
-
-  conn_free(data, conn);
-}
-
-/*
- * IsMultiplexingPossible()
- *
- * Return a bitmask with the available multiplexing options for the given
- * requested connection.
- */
-static int IsMultiplexingPossible(const struct Curl_easy *handle,
-                                  const struct connectdata *conn)
-{
-  int avail = 0;
-
   /* If an HTTP protocol and multiplexing is enabled */
-  if((conn->handler->protocol & PROTO_FAMILY_HTTP) &&
+  if((conn->scheme->protocol & PROTO_FAMILY_HTTP) &&
      (!conn->bits.protoconnstart || !conn->bits.close)) {
 
-    if(Curl_multiplex_wanted(handle->multi) &&
-       (handle->state.httpwant >= CURL_HTTP_VERSION_2))
-      /* allows HTTP/2 */
-      avail |= CURLPIPE_MULTIPLEX;
+    if(Curl_multiplex_wanted(data->multi) &&
+       (data->state.http_neg.allowed & (CURL_HTTP_V2x | CURL_HTTP_V3x)))
+      /* allows HTTP/2 or newer */
+      return TRUE;
   }
-  return avail;
-}
-
-#ifndef CURL_DISABLE_PROXY
-static bool
-proxy_info_matches(const struct proxy_info *data,
-                   const struct proxy_info *needle)
-{
-  if((data->proxytype == needle->proxytype) &&
-     (data->port == needle->port) &&
-     strcasecompare(data->host.name, needle->host.name))
-    return TRUE;
-
+#else
+  (void)data;
+  (void)conn;
+#endif
   return FALSE;
 }
 
-static bool
-socks_proxy_info_matches(const struct proxy_info *data,
-                         const struct proxy_info *needle)
+#ifndef CURL_DISABLE_PROXY
+static bool proxy_info_matches(const struct proxy_info *data,
+                               const struct proxy_info *needle)
 {
-  if(!proxy_info_matches(data, needle))
-    return FALSE;
-
-  /* the user information is case-sensitive
-     or at least it is not defined as case-insensitive
-     see https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.1 */
-
-  /* curl_strequal does a case insensitive comparison,
-     so do not use it here! */
-  if(Curl_timestrcmp(data->user, needle->user) ||
-     Curl_timestrcmp(data->passwd, needle->passwd))
-    return FALSE;
-  return TRUE;
+  if((data->proxytype == needle->proxytype) &&
+     Curl_peer_same_destination(data->peer, needle->peer) &&
+     Curl_creds_same(data->creds, needle->creds)) {
+    return TRUE;
+  }
+  return FALSE;
 }
-#else
-/* disabled, won't get called */
-#define proxy_info_matches(x,y) FALSE
-#define socks_proxy_info_matches(x,y) FALSE
 #endif
 
-/* A connection has to have been idle for a shorter time than 'maxage_conn'
-   (the success rate is just too low after this), or created less than
-   'maxlifetime_conn' ago, to be subject for reuse. */
-
+/* A connection has to have been idle for less than 'conn_max_idle_ms'
+   (the success rate is too low after this), or created less than
+   'conn_max_age_ms' ago, to be subject for reuse. */
 static bool conn_maxage(struct Curl_easy *data,
                         struct connectdata *conn,
                         struct curltime now)
 {
-  timediff_t idletime, lifetime;
+  timediff_t age_ms;
 
-  idletime = Curl_timediff(now, conn->lastused);
-  idletime /= 1000; /* integer seconds is fine */
-
-  if(idletime > data->set.maxage_conn) {
-    infof(data, "Too old connection (%ld seconds idle), disconnect it",
-          idletime);
-    return TRUE;
+  if(data->set.conn_max_idle_ms) {
+    age_ms = curlx_ptimediff_ms(&now, &conn->lastused);
+    if(age_ms > data->set.conn_max_idle_ms) {
+      infof(data, "Too old connection (%" FMT_TIMEDIFF_T
+            " ms idle, max idle is %" FMT_TIMEDIFF_T " ms), disconnect it",
+            age_ms, data->set.conn_max_idle_ms);
+      return TRUE;
+    }
   }
 
-  lifetime = Curl_timediff(now, conn->created);
-  lifetime /= 1000; /* integer seconds is fine */
-
-  if(data->set.maxlifetime_conn && lifetime > data->set.maxlifetime_conn) {
-    infof(data,
-          "Too old connection (%ld seconds since creation), disconnect it",
-          lifetime);
-    return TRUE;
+  if(data->set.conn_max_age_ms) {
+    age_ms = curlx_ptimediff_ms(&now, &conn->created);
+    if(age_ms > data->set.conn_max_age_ms) {
+      infof(data,
+            "Too old connection (created %" FMT_TIMEDIFF_T
+            " ms ago, max lifetime is %" FMT_TIMEDIFF_T " ms), disconnect it",
+            age_ms, data->set.conn_max_age_ms);
+      return TRUE;
+    }
   }
 
-
   return FALSE;
 }
 
 /*
- * This function checks if the given connection is dead and extracts it from
- * the connection cache if so.
- *
- * When this is called as a Curl_conncache_foreach() callback, the connection
- * cache lock is held!
- *
- * Returns TRUE if the connection was dead and extracted.
+ * Return TRUE iff the given connection is considered dead.
  */
-static bool extract_if_dead(struct connectdata *conn,
-                            struct Curl_easy *data)
+bool Curl_conn_seems_dead(struct connectdata *conn,
+                          struct Curl_easy *data)
 {
+  DEBUGASSERT(!data->conn);
   if(!CONN_INUSE(conn)) {
-    /* The check for a dead socket makes sense only if the connection isn't in
+    /* The check for a dead socket makes sense only if the connection is not in
        use */
     bool dead;
-    struct curltime now = Curl_now();
-    if(conn_maxage(data, conn, now)) {
+
+    if(conn_maxage(data, conn, *Curl_pgrs_now(data))) {
       /* avoid check if already too old */
       dead = TRUE;
     }
-    else if(conn->handler->connection_check) {
+    else if(conn->scheme->run->connection_is_dead) {
       /* The protocol has a special method for checking the state of the
          connection. Use it to check if the connection is dead. */
-      unsigned int state;
-
-      /* briefly attach the connection to this transfer for the purpose of
-         checking it */
+      /* briefly attach the connection for the check */
       Curl_attach_connection(data, conn);
-
-      state = conn->handler->connection_check(data, conn, CONNCHECK_ISDEAD);
-      dead = (state & CONNRESULT_DEAD);
-      /* detach the connection again */
+      dead = conn->scheme->run->connection_is_dead(data, conn);
       Curl_detach_connection(data);
-
     }
     else {
-      bool input_pending;
+      bool input_pending = FALSE;
 
       Curl_attach_connection(data, conn);
       dead = !Curl_conn_is_alive(data, conn, &input_pending);
       if(input_pending) {
-        /* For reuse, we want a "clean" connection state. The includes
+        /* For reuse, we want a "clean" connection state. This includes
          * that we expect - in general - no waiting input data. Input
          * waiting might be a TLS Notify Close, for example. We reject
          * that.
@@ -957,558 +640,638 @@ static bool extract_if_dead(struct connectdata *conn,
          * any time (HTTP/2 PING for example), the protocol handler needs
          * to install its own `connection_check` callback.
          */
+        DEBUGF(infof(data, "connection has input pending, not reusable"));
         dead = TRUE;
       }
       Curl_detach_connection(data);
     }
 
     if(dead) {
-      infof(data, "Connection %" CURL_FORMAT_CURL_OFF_T " seems to be dead",
+      /* remove connection from cpool */
+      infof(data, "Connection %" FMT_OFF_T " seems to be dead",
             conn->connection_id);
-      Curl_conncache_remove_conn(data, conn, FALSE);
       return TRUE;
     }
   }
   return FALSE;
 }
 
-struct prunedead {
-  struct Curl_easy *data;
-  struct connectdata *extracted;
-};
-
-/*
- * Wrapper to use extract_if_dead() function in Curl_conncache_foreach()
- *
- */
-static int call_extract_if_dead(struct Curl_easy *data,
-                                struct connectdata *conn, void *param)
+CURLcode Curl_conn_upkeep(struct Curl_easy *data,
+                          struct connectdata *conn)
 {
-  struct prunedead *p = (struct prunedead *)param;
-  if(extract_if_dead(conn, data)) {
-    /* stop the iteration here, pass back the connection that was extracted */
-    p->extracted = conn;
-    return 1;
-  }
-  return 0; /* continue iteration */
-}
+  CURLcode result = CURLE_OK;
+  if(curlx_ptimediff_ms(Curl_pgrs_now(data), &conn->keepalive) <=
+     data->set.upkeep_interval_ms)
+    return result;
 
-/*
- * This function scans the connection cache for half-open/dead connections,
- * closes and removes them. The cleanup is done at most once per second.
- *
- * When called, this transfer has no connection attached.
- */
-static void prune_dead_connections(struct Curl_easy *data)
-{
-  struct curltime now = Curl_now();
-  timediff_t elapsed;
+  /* briefly attach for action */
+  Curl_attach_connection(data, conn);
+  result = Curl_conn_keep_alive(data, conn, FIRSTSOCKET);
+  Curl_detach_connection(data);
 
-  DEBUGASSERT(!data->conn); /* no connection */
-  CONNCACHE_LOCK(data);
-  elapsed =
-    Curl_timediff(now, data->state.conn_cache->last_cleanup);
-  CONNCACHE_UNLOCK(data);
-
-  if(elapsed >= 1000L) {
-    struct prunedead prune;
-    prune.data = data;
-    prune.extracted = NULL;
-    while(Curl_conncache_foreach(data, data->state.conn_cache, &prune,
-                                 call_extract_if_dead)) {
-      /* unlocked */
-
-      /* remove connection from cache */
-      Curl_conncache_remove_conn(data, prune.extracted, TRUE);
-
-      /* disconnect it */
-      Curl_disconnect(data, prune.extracted, TRUE);
-    }
-    CONNCACHE_LOCK(data);
-    data->state.conn_cache->last_cleanup = now;
-    CONNCACHE_UNLOCK(data);
-  }
+  conn->keepalive = *Curl_pgrs_now(data);
+  return result;
 }
 
 #ifdef USE_SSH
 static bool ssh_config_matches(struct connectdata *one,
                                struct connectdata *two)
 {
-  return (Curl_safecmp(one->proto.sshc.rsa, two->proto.sshc.rsa) &&
-          Curl_safecmp(one->proto.sshc.rsa_pub, two->proto.sshc.rsa_pub));
+  struct ssh_conn *sshc1, *sshc2;
+
+  sshc1 = Curl_conn_meta_get(one, CURL_META_SSH_CONN);
+  sshc2 = Curl_conn_meta_get(two, CURL_META_SSH_CONN);
+  return sshc1 && sshc2 && Curl_safecmp(sshc1->rsa, sshc2->rsa) &&
+         Curl_safecmp(sshc1->rsa_pub, sshc2->rsa_pub);
+}
+#endif
+
+struct url_conn_match {
+  struct connectdata *found;
+  struct Curl_easy *data;
+  struct connectdata *needle;
+  BIT(may_multiplex);
+  BIT(want_ntlm_http);
+  BIT(want_proxy_ntlm_http);
+  BIT(want_nego_http);
+  BIT(want_proxy_nego_http);
+  BIT(may_tls); /* May upgrade clear-text connection to TLS, can only reuse
+                 * connections that have matching TLS configuration.
+                 * Always TRUE if `req_tls` is TRUE. */
+  BIT(require_tls); /* Requires TLS use from a clear-text start, can only
+                 * reuse connections that have TLS. */
+  BIT(wait_pipe);
+  BIT(force_reuse);
+  BIT(seen_pending_conn);
+  BIT(seen_single_use_conn);
+  BIT(seen_multiplex_conn);
+};
+
+static bool url_match_connect_config(struct connectdata *conn,
+                                     struct url_conn_match *m)
+{
+  /* connect-only or to-be-closed connections will not be reused */
+  if(conn->bits.connect_only || conn->bits.close || conn->bits.no_reuse)
+    return FALSE;
+
+  /* ip_version must match */
+  if(m->data->set.ipver != CURL_IPRESOLVE_WHATEVER &&
+     m->data->set.ipver != conn->ip_version)
+    return FALSE;
+
+  if(m->needle->localdev || m->needle->localport) {
+    /* If we are bound to a specific local end (IP+port), we must not reuse a
+       random other one, although if we did not ask for a particular one we
+       can reuse one that was bound.
+
+       This comparison is a bit rough and too strict. Since the input
+       parameters can be specified in numerous ways and still end up the same
+       it would take a lot of processing to make it really accurate. Instead,
+       this matching will assume that reuses of bound connections will most
+       likely also reuse the exact same binding parameters and missing out a
+       few edge cases should not hurt anyone much.
+    */
+    if((conn->localport != m->needle->localport) ||
+       (conn->localportrange != m->needle->localportrange) ||
+       (m->needle->localdev &&
+        (!conn->localdev || strcmp(conn->localdev, m->needle->localdev))))
+      return FALSE;
+  }
+
+  if(!m->needle->via_peer != !conn->via_peer)
+    /* do not mix connections that use the "connect to host" feature and
+     * connections that do not use this feature */
+    return FALSE;
+
+  return TRUE;
+}
+
+static bool url_match_fully_connected(struct connectdata *conn,
+                                      struct url_conn_match *m)
+{
+  if(!Curl_conn_is_connected(conn, FIRSTSOCKET) ||
+     conn->bits.upgrade_in_progress) {
+    /* Not yet connected, or a protocol upgrade is in progress. The later
+     * happens for HTTP/2 Upgrade: requests that need a response. */
+    if(m->may_multiplex) {
+      m->seen_pending_conn = TRUE;
+      /* Do not pick a connection that has not connected yet */
+      infof(m->data, "Connection #%" FMT_OFF_T
+            " is not open enough, cannot reuse", conn->connection_id);
+    }
+    /* Do not pick a connection that has not connected yet */
+    return FALSE;
+  }
+  return TRUE;
+}
+
+static bool url_match_multi(struct connectdata *conn,
+                            struct url_conn_match *m)
+{
+  if(CONN_INUSE(conn)) {
+    DEBUGASSERT(conn->attached_multi);
+    if(conn->attached_multi != m->data->multi)
+      return FALSE;
+  }
+  return TRUE;
+}
+
+static bool url_match_multiplex_needs(struct connectdata *conn,
+                                      struct url_conn_match *m)
+{
+  if(CONN_INUSE(conn)) {
+    if(!conn->bits.multiplex) {
+      /* conn busy and conn cannot take more transfers */
+      m->seen_single_use_conn = TRUE;
+      return FALSE;
+    }
+    m->seen_multiplex_conn = TRUE;
+    if(!m->may_multiplex || !url_match_multi(conn, m))
+      /* conn busy and transfer cannot be multiplexed */
+      return FALSE;
+  }
+  return TRUE;
+}
+
+static bool url_match_multiplex_limits(struct connectdata *conn,
+                                       struct url_conn_match *m)
+{
+  if(CONN_INUSE(conn) && m->may_multiplex) {
+    DEBUGASSERT(conn->bits.multiplex);
+    /* If multiplexed, make sure we do not go over concurrency limit */
+    if(conn->attached_xfers >=
+            Curl_multi_max_concurrent_streams(m->data->multi)) {
+      infof(m->data, "client side MAX_CONCURRENT_STREAMS reached"
+            ", skip (%u)", conn->attached_xfers);
+      return FALSE;
+    }
+    if(conn->attached_xfers >=
+       Curl_conn_get_max_concurrent(m->data, conn, FIRSTSOCKET)) {
+      infof(m->data, "MAX_CONCURRENT_STREAMS reached, skip (%u)",
+            conn->attached_xfers);
+      return FALSE;
+    }
+    /* When not multiplexed, we have a match here! */
+    infof(m->data, "Multiplexed connection found");
+  }
+  return TRUE;
+}
+
+static bool url_match_ssl_use(struct connectdata *conn,
+                              struct url_conn_match *m)
+{
+  if(m->needle->scheme->flags & PROTOPT_SSL) {
+    /* We are looking for SSL, if `conn` does not do it, not a match. */
+    if(!Curl_conn_is_ssl(conn, FIRSTSOCKET))
+      return FALSE;
+  }
+  else if(Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
+    /* If the protocol does not allow reuse of SSL connections OR
+       is of another protocol family, not a match. */
+    if(!(m->needle->scheme->flags & PROTOPT_SSL_REUSE) ||
+       (get_protocol_family(conn->scheme) != m->needle->scheme->protocol))
+      return FALSE;
+  }
+  else if(m->require_tls)
+    /* a clear-text STARTTLS protocol with required TLS */
+    return FALSE;
+  return TRUE;
+}
+
+#ifndef CURL_DISABLE_PROXY
+static bool url_match_proxy_use(struct connectdata *conn,
+                                struct url_conn_match *m)
+{
+  if(m->needle->bits.origin_is_proxy != conn->bits.origin_is_proxy)
+    return FALSE;
+
+  if(!proxy_info_matches(&m->needle->socks_proxy, &conn->socks_proxy))
+    return FALSE;
+
+  if(!proxy_info_matches(&m->needle->http_proxy, &conn->http_proxy))
+    return FALSE;
+
+  if(CURL_PROXY_IS_HTTPS(m->needle->http_proxy.proxytype)) {
+    /* https proxies come in different types, http/1.1, h2, ... */
+    /* match SSL config to proxy */
+    if(!Curl_ssl_conn_config_match(m->data, conn, TRUE)) {
+      DEBUGF(infof(m->data,
+                   "Connection #%" FMT_OFF_T
+                   " has different SSL proxy parameters, cannot reuse",
+                   conn->connection_id));
+      return FALSE;
+    }
+    /* the SSL config to the server, which may apply here is checked
+     * further below */
+  }
+  return TRUE;
 }
 #else
-#define ssh_config_matches(x,y) FALSE
+#define url_match_proxy_use(c, m) ((void)(c), (void)(m), TRUE)
 #endif
 
-/*
- * Given one filled in connection struct (named needle), this function should
- * detect if there already is one that has all the significant details
- * exactly the same and thus should be used instead.
- *
- * If there is a match, this function returns TRUE - and has marked the
- * connection as 'in-use'. It must later be called with ConnectionDone() to
- * return back to 'idle' (unused) state.
- *
- * The force_reuse flag is set if the connection must be used.
- */
-static bool
-ConnectionExists(struct Curl_easy *data,
-                 struct connectdata *needle,
-                 struct connectdata **usethis,
-                 bool *force_reuse,
-                 bool *waitpipe)
+#ifndef CURL_DISABLE_HTTP
+static bool url_match_http_multiplex(struct connectdata *conn,
+                                     struct url_conn_match *m)
 {
-  struct connectdata *check;
-  struct connectdata *chosen = 0;
-  bool foundPendingCandidate = FALSE;
-  bool canmultiplex = IsMultiplexingPossible(data, needle);
-  struct connectbundle *bundle;
-
-#ifdef USE_NTLM
-  bool wantNTLMhttp = ((data->state.authhost.want &
-                        (CURLAUTH_NTLM | CURLAUTH_NTLM_WB)) &&
-                       (needle->handler->protocol & PROTO_FAMILY_HTTP));
-#ifndef CURL_DISABLE_PROXY
-  bool wantProxyNTLMhttp = (needle->bits.proxy_user_passwd &&
-                            ((data->state.authproxy.want &
-                              (CURLAUTH_NTLM | CURLAUTH_NTLM_WB)) &&
-                             (needle->handler->protocol & PROTO_FAMILY_HTTP)));
-#else
-  bool wantProxyNTLMhttp = FALSE;
-#endif
-#endif
-  /* plain HTTP with upgrade */
-  bool h2upgrade = (data->state.httpwant == CURL_HTTP_VERSION_2_0) &&
-    (needle->handler->protocol & CURLPROTO_HTTP);
-
-  *force_reuse = FALSE;
-  *waitpipe = FALSE;
-
-  /* Look up the bundle with all the connections to this particular host.
-     Locks the connection cache, beware of early returns! */
-  bundle = Curl_conncache_find_bundle(data, needle, data->state.conn_cache);
-  if(bundle) {
-    /* Max pipe length is zero (unlimited) for multiplexed connections */
-    struct Curl_llist_element *curr;
-
-    infof(data, "Found bundle for host: %p [%s]",
-          (void *)bundle, (bundle->multiuse == BUNDLE_MULTIPLEX ?
-                           "can multiplex" : "serially"));
-
-    /* We can't multiplex if we don't know anything about the server */
-    if(canmultiplex) {
-      if(bundle->multiuse == BUNDLE_UNKNOWN) {
-        if(data->set.pipewait) {
-          infof(data, "Server doesn't support multiplex yet, wait");
-          *waitpipe = TRUE;
-          CONNCACHE_UNLOCK(data);
-          return FALSE; /* no reuse */
-        }
-
-        infof(data, "Server doesn't support multiplex (yet)");
-        canmultiplex = FALSE;
-      }
-      if((bundle->multiuse == BUNDLE_MULTIPLEX) &&
-         !Curl_multiplex_wanted(data->multi)) {
-        infof(data, "Could multiplex, but not asked to");
-        canmultiplex = FALSE;
-      }
-      if(bundle->multiuse == BUNDLE_NO_MULTIUSE) {
-        infof(data, "Can not multiplex, even if we wanted to");
-        canmultiplex = FALSE;
-      }
+  if(m->may_multiplex &&
+     (m->data->state.http_neg.allowed & (CURL_HTTP_V2x | CURL_HTTP_V3x)) &&
+     (m->needle->scheme->protocol & CURLPROTO_HTTP) &&
+     !conn->httpversion_seen) {
+    if(m->data->set.pipewait) {
+      infof(m->data, "Server upgrade does not support multiplex yet, wait");
+      m->found = NULL;
+      m->wait_pipe = TRUE;
+      return TRUE; /* stop searching, we want to wait */
     }
+    infof(m->data, "Server upgrade cannot be used");
+    return FALSE;
+  }
+  return TRUE;
+}
 
-    curr = bundle->conn_list.head;
-    while(curr) {
-      bool match = FALSE;
-      size_t multiplexed = 0;
-
-      /*
-       * Note that if we use an HTTP proxy in normal mode (no tunneling), we
-       * check connections to that proxy and not to the actual remote server.
-       */
-      check = curr->ptr;
-      curr = curr->next;
-
-      if(check->connect_only || check->bits.close)
-        /* connect-only or to-be-closed connections will not be reused */
-        continue;
-
-      if(extract_if_dead(check, data)) {
-        /* disconnect it */
-        Curl_disconnect(data, check, TRUE);
-        continue;
+static bool url_match_http_version(struct connectdata *conn,
+                                   struct url_conn_match *m)
+{
+  /* If looking for HTTP and the HTTP versions allowed do not include
+   * the HTTP version of conn, continue looking. */
+  if((m->needle->scheme->protocol & PROTO_FAMILY_HTTP)) {
+    switch(Curl_conn_http_version(m->data, conn)) {
+    case 30:
+      if(!(m->data->state.http_neg.allowed & CURL_HTTP_V3x)) {
+        DEBUGF(infof(m->data, "not reusing conn #%" CURL_FORMAT_CURL_OFF_T
+                     ", we do not want h3", conn->connection_id));
+        return FALSE;
       }
-
-      if(data->set.ipver != CURL_IPRESOLVE_WHATEVER
-         && data->set.ipver != check->ip_version) {
-        /* skip because the connection is not via the requested IP version */
-        continue;
+      break;
+    case 20:
+      if(!(m->data->state.http_neg.allowed & CURL_HTTP_V2x)) {
+        DEBUGF(infof(m->data, "not reusing conn #%" CURL_FORMAT_CURL_OFF_T
+                     ", we do not want h2", conn->connection_id));
+        return FALSE;
       }
-
-      if(bundle->multiuse == BUNDLE_MULTIPLEX)
-        multiplexed = CONN_INUSE(check);
-
-      if(!canmultiplex) {
-        if(multiplexed) {
-          /* can only happen within multi handles, and means that another easy
-             handle is using this connection */
-          continue;
-        }
-
-        if(Curl_resolver_asynch() &&
-           /* primary_ip[0] is NUL only if the resolving of the name hasn't
-              completed yet and until then we don't reuse this connection */
-           !check->primary_ip[0])
-          continue;
+      break;
+    default:
+      if(!(m->data->state.http_neg.allowed & CURL_HTTP_V1x)) {
+        DEBUGF(infof(m->data, "not reusing conn #%" CURL_FORMAT_CURL_OFF_T
+                     ", we do not want h1", conn->connection_id));
+        return FALSE;
       }
-
-      if(!Curl_conn_is_connected(check, FIRSTSOCKET)) {
-        foundPendingCandidate = TRUE;
-        /* Don't pick a connection that hasn't connected yet */
-        infof(data, "Connection #%" CURL_FORMAT_CURL_OFF_T
-              "isn't open enough, can't reuse", check->connection_id);
-        continue;
-      }
-
-#ifdef USE_UNIX_SOCKETS
-      if(needle->unix_domain_socket) {
-        if(!check->unix_domain_socket)
-          continue;
-        if(strcmp(needle->unix_domain_socket, check->unix_domain_socket))
-          continue;
-        if(needle->bits.abstract_unix_socket !=
-           check->bits.abstract_unix_socket)
-          continue;
-      }
-      else if(check->unix_domain_socket)
-        continue;
+      break;
+    }
+  }
+  return TRUE;
+}
+#else
+#define url_match_http_multiplex(c, m) ((void)(c), (void)(m), TRUE)
+#define url_match_http_version(c, m)   ((void)(c), (void)(m), TRUE)
 #endif
 
-      if((needle->handler->flags&PROTOPT_SSL) !=
-         (check->handler->flags&PROTOPT_SSL))
-        /* don't do mixed SSL and non-SSL connections */
-        if(get_protocol_family(check->handler) !=
-           needle->handler->protocol || !check->bits.tls_upgraded)
-          /* except protocols that have been upgraded via TLS */
-          continue;
+static bool url_match_proto_config(struct connectdata *conn,
+                                   struct url_conn_match *m)
+{
+  if(!url_match_http_version(conn, m))
+    return FALSE;
 
-#ifndef CURL_DISABLE_PROXY
-      if(needle->bits.httpproxy != check->bits.httpproxy ||
-         needle->bits.socksproxy != check->bits.socksproxy)
-        continue;
-
-      if(needle->bits.socksproxy &&
-        !socks_proxy_info_matches(&needle->socks_proxy,
-                                  &check->socks_proxy))
-        continue;
-#endif
-      if(needle->bits.conn_to_host != check->bits.conn_to_host)
-        /* don't mix connections that use the "connect to host" feature and
-         * connections that don't use this feature */
-        continue;
-
-      if(needle->bits.conn_to_port != check->bits.conn_to_port)
-        /* don't mix connections that use the "connect to port" feature and
-         * connections that don't use this feature */
-        continue;
-
-#ifndef CURL_DISABLE_PROXY
-      if(needle->bits.httpproxy) {
-        if(!proxy_info_matches(&needle->http_proxy, &check->http_proxy))
-          continue;
-
-        if(needle->bits.tunnel_proxy != check->bits.tunnel_proxy)
-          continue;
-
-        if(IS_HTTPS_PROXY(needle->http_proxy.proxytype)) {
-          /* use https proxy */
-          if(needle->http_proxy.proxytype !=
-             check->http_proxy.proxytype)
-            continue;
-          else if(needle->handler->flags&PROTOPT_SSL) {
-            /* use double layer ssl */
-            if(!Curl_ssl_config_matches(&needle->proxy_ssl_config,
-                                        &check->proxy_ssl_config))
-              continue;
-          }
-          else if(!Curl_ssl_config_matches(&needle->ssl_config,
-                                           &check->ssl_config))
-            continue;
-        }
-      }
-#endif
-
-      if(h2upgrade && !check->httpversion && canmultiplex) {
-        if(data->set.pipewait) {
-          infof(data, "Server upgrade doesn't support multiplex yet, wait");
-          *waitpipe = TRUE;
-          CONNCACHE_UNLOCK(data);
-          return FALSE; /* no reuse */
-        }
-        infof(data, "Server upgrade cannot be used");
-        continue; /* can't be used atm */
-      }
-
-      if(!canmultiplex && CONN_INUSE(check))
-        /* this request can't be multiplexed but the checked connection is
-           already in use so we skip it */
-        continue;
-
-      if(CONN_INUSE(check)) {
-        /* Subject for multiplex use if 'checks' belongs to the same multi
-           handle as 'data' is. */
-        struct Curl_llist_element *e = check->easyq.head;
-        struct Curl_easy *entry = e->ptr;
-        if(entry->multi != data->multi)
-          continue;
-      }
-
-      if(needle->localdev || needle->localport) {
-        /* If we are bound to a specific local end (IP+port), we must not
-           reuse a random other one, although if we didn't ask for a
-           particular one we can reuse one that was bound.
-
-           This comparison is a bit rough and too strict. Since the input
-           parameters can be specified in numerous ways and still end up the
-           same it would take a lot of processing to make it really accurate.
-           Instead, this matching will assume that reuses of bound connections
-           will most likely also reuse the exact same binding parameters and
-           missing out a few edge cases shouldn't hurt anyone very much.
-        */
-        if((check->localport != needle->localport) ||
-           (check->localportrange != needle->localportrange) ||
-           (needle->localdev &&
-            (!check->localdev || strcmp(check->localdev, needle->localdev))))
-          continue;
-      }
-
-      if(!(needle->handler->flags & PROTOPT_CREDSPERREQUEST)) {
-        /* This protocol requires credentials per connection,
-           so verify that we're using the same name and password as well */
-        if(Curl_timestrcmp(needle->user, check->user) ||
-           Curl_timestrcmp(needle->passwd, check->passwd) ||
-           Curl_timestrcmp(needle->sasl_authzid, check->sasl_authzid) ||
-           Curl_timestrcmp(needle->oauth_bearer, check->oauth_bearer)) {
-          /* one of them was different */
-          continue;
-        }
-      }
-
-      /* GSS delegation differences do not actually affect every connection
-         and auth method, but this check takes precaution before efficiency */
-      if(needle->gssapi_delegation != check->gssapi_delegation)
-        continue;
-
-      /* If multiplexing isn't enabled on the h2 connection and h1 is
-         explicitly requested, handle it: */
-      if((needle->handler->protocol & PROTO_FAMILY_HTTP) &&
-         (((check->httpversion >= 20) &&
-           (data->state.httpwant < CURL_HTTP_VERSION_2_0))
-          || ((check->httpversion >= 30) &&
-              (data->state.httpwant < CURL_HTTP_VERSION_3))))
-        continue;
 #ifdef USE_SSH
-      else if(get_protocol_family(needle->handler) & PROTO_FAMILY_SSH) {
-        if(!ssh_config_matches(needle, check))
-          continue;
-      }
+  if(get_protocol_family(m->needle->scheme) & PROTO_FAMILY_SSH) {
+    if(!ssh_config_matches(m->needle, conn))
+      return FALSE;
+  }
 #endif
 #ifndef CURL_DISABLE_FTP
-      else if(get_protocol_family(needle->handler) & PROTO_FAMILY_FTP) {
-        /* Also match ACCOUNT, ALTERNATIVE-TO-USER, USE_SSL and CCC options */
-        if(Curl_timestrcmp(needle->proto.ftpc.account,
-                           check->proto.ftpc.account) ||
-           Curl_timestrcmp(needle->proto.ftpc.alternative_to_user,
-                           check->proto.ftpc.alternative_to_user) ||
-           (needle->proto.ftpc.use_ssl != check->proto.ftpc.use_ssl) ||
-           (needle->proto.ftpc.ccc != check->proto.ftpc.ccc))
-          continue;
-      }
+  else if(get_protocol_family(m->needle->scheme) & PROTO_FAMILY_FTP) {
+    if(!ftp_conns_match(m->needle, conn))
+      return FALSE;
+  }
+#endif
+  return TRUE;
+}
+
+static bool url_match_auth(struct connectdata *conn,
+                           struct url_conn_match *m)
+{
+  if(!Curl_creds_same(m->needle->creds, conn->creds)) {
+    if(m->needle->creds)
+      return FALSE;
+    if(!Curl_creds_same(m->data->state.creds, conn->creds))
+      return FALSE;
+  }
+#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
+  /* GSS delegation differences do not actually affect every connection and
+     auth method, but this check takes precaution before efficiency */
+  if(m->needle->gssapi_delegation != conn->gssapi_delegation)
+    return FALSE;
 #endif
 
-      if((needle->handler->flags&PROTOPT_SSL)
-#ifndef CURL_DISABLE_PROXY
-         || !needle->bits.httpproxy || needle->bits.tunnel_proxy
-#endif
-        ) {
-        /* The requested connection does not use an HTTP proxy or it uses SSL
-           or it is a non-SSL protocol tunneled or it is a non-SSL protocol
-           which is allowed to be upgraded via TLS */
+  return TRUE;
+}
 
-        if((strcasecompare(needle->handler->scheme, check->handler->scheme) ||
-            (get_protocol_family(check->handler) ==
-             needle->handler->protocol && check->bits.tls_upgraded)) &&
-           (!needle->bits.conn_to_host || strcasecompare(
-            needle->conn_to_host.name, check->conn_to_host.name)) &&
-           (!needle->bits.conn_to_port ||
-             needle->conn_to_port == check->conn_to_port) &&
-           strcasecompare(needle->host.name, check->host.name) &&
-           needle->remote_port == check->remote_port) {
-          /* The schemes match or the protocol family is the same and the
-             previous connection was TLS upgraded, and the hostname and host
-             port match */
-          if(needle->handler->flags & PROTOPT_SSL) {
-            /* This is a SSL connection so verify that we're using the same
-               SSL options as well */
-            if(!Curl_ssl_config_matches(&needle->ssl_config,
-                                        &check->ssl_config)) {
-              DEBUGF(infof(data,
-                           "Connection #%" CURL_FORMAT_CURL_OFF_T
-                           " has different SSL parameters, can't reuse",
-                           check->connection_id));
-              continue;
-            }
-          }
-          match = TRUE;
-        }
-      }
-      else {
-        /* The requested connection is using the same HTTP proxy in normal
-           mode (no tunneling) */
-        match = TRUE;
-      }
+static bool url_match_destination(struct connectdata *conn,
+                                  struct url_conn_match *m)
+{
+  /* Different connect-to peers never match */
+  if(!Curl_peer_same_destination(m->needle->via_peer, conn->via_peer))
+    return FALSE;
 
-      if(match) {
-#if defined(USE_NTLM)
-        /* If we are looking for an HTTP+NTLM connection, check if this is
-           already authenticating with the right credentials. If not, keep
-           looking so that we can reuse NTLM connections if
-           possible. (Especially we must not reuse the same connection if
-           partway through a handshake!) */
-        if(wantNTLMhttp) {
-          if(Curl_timestrcmp(needle->user, check->user) ||
-             Curl_timestrcmp(needle->passwd, check->passwd)) {
-
-            /* we prefer a credential match, but this is at least a connection
-               that can be reused and "upgraded" to NTLM */
-            if(check->http_ntlm_state == NTLMSTATE_NONE)
-              chosen = check;
-            continue;
-          }
-        }
-        else if(check->http_ntlm_state != NTLMSTATE_NONE) {
-          /* Connection is using NTLM auth but we don't want NTLM */
-          continue;
-        }
-
-#ifndef CURL_DISABLE_PROXY
-        /* Same for Proxy NTLM authentication */
-        if(wantProxyNTLMhttp) {
-          /* Both check->http_proxy.user and check->http_proxy.passwd can be
-           * NULL */
-          if(!check->http_proxy.user || !check->http_proxy.passwd)
-            continue;
-
-          if(Curl_timestrcmp(needle->http_proxy.user,
-                             check->http_proxy.user) ||
-             Curl_timestrcmp(needle->http_proxy.passwd,
-                             check->http_proxy.passwd))
-            continue;
-        }
-        else if(check->proxy_ntlm_state != NTLMSTATE_NONE) {
-          /* Proxy connection is using NTLM auth but we don't want NTLM */
-          continue;
-        }
-#endif
-        if(wantNTLMhttp || wantProxyNTLMhttp) {
-          /* Credentials are already checked, we can use this connection */
-          chosen = check;
-
-          if((wantNTLMhttp &&
-             (check->http_ntlm_state != NTLMSTATE_NONE)) ||
-              (wantProxyNTLMhttp &&
-               (check->proxy_ntlm_state != NTLMSTATE_NONE))) {
-            /* We must use this connection, no other */
-            *force_reuse = TRUE;
-            break;
-          }
-
-          /* Continue look up for a better connection */
-          continue;
-        }
-#endif
-        if(canmultiplex) {
-          /* We can multiplex if we want to. Let's continue looking for
-             the optimal connection to use. */
-
-          if(!multiplexed) {
-            /* We have the optimal connection. Let's stop looking. */
-            chosen = check;
-            break;
-          }
-
-#ifdef USE_NGHTTP2
-          /* If multiplexed, make sure we don't go over concurrency limit */
-          if(check->bits.multiplex) {
-            if(multiplexed >= Curl_conn_get_max_concurrent(data, check,
-                                                           FIRSTSOCKET)) {
-              infof(data, "MAX_CONCURRENT_STREAMS reached, skip (%zu)",
-                    multiplexed);
-              continue;
-            }
-            else if(multiplexed >=
-                    Curl_multi_max_concurrent_streams(data->multi)) {
-              infof(data, "client side MAX_CONCURRENT_STREAMS reached"
-                    ", skip (%zu)",
-                    multiplexed);
-              continue;
-            }
-          }
-#endif
-          /* When not multiplexed, we have a match here! */
-          chosen = check;
-          infof(data, "Multiplexed connection found");
-          break;
-        }
-        else {
-          /* We have found a connection. Let's stop searching. */
-          chosen = check;
-          break;
-        }
-      }
+  if(m->needle->origin->scheme != conn->origin->scheme) {
+    /* `needle` and `conn` not having the same scheme.
+     * This is allowed for the same family *if* conn is using TLS.
+     * - IMAP+STARTTLS works for IMAPS.
+     * - IMAPS works for IMAP. */
+    if(get_protocol_family(conn->origin->scheme) !=
+       m->needle->scheme->protocol) {
+      return FALSE;
     }
   }
+  /* Scheme mismatch is acceptable, compare hostname/port */
+  return Curl_peer_same_destination(m->needle->origin, conn->origin);
+}
 
-  if(chosen) {
-    /* mark it as used before releasing the lock */
-    Curl_attach_connection(data, chosen);
-    CONNCACHE_UNLOCK(data);
-    *usethis = chosen;
-    return TRUE; /* yes, we found one to use! */
+static bool url_match_ssl_config(struct connectdata *conn,
+                                 struct url_conn_match *m)
+{
+  /* If talking/upgrading to TLS, conn needs to use the same SSL options. */
+  if(((m->needle->scheme->flags & PROTOPT_SSL) || m->may_tls) &&
+     !Curl_ssl_conn_config_match(m->data, conn, FALSE)) {
+    DEBUGF(infof(m->data, "Connection #%" FMT_OFF_T
+                 " has different SSL parameters, cannot reuse",
+                 conn->connection_id));
+    return FALSE;
   }
-  CONNCACHE_UNLOCK(data);
+  return TRUE;
+}
 
-  if(foundPendingCandidate && data->set.pipewait) {
-    infof(data,
+#ifdef USE_NTLM
+static bool url_match_auth_ntlm(struct connectdata *conn,
+                                struct url_conn_match *m)
+{
+  /* If we are looking for an HTTP+NTLM connection, check if this is
+     already authenticating with the right credentials. If not, keep
+     looking so that we can reuse NTLM connections if
+     possible. (Especially we must not reuse the same connection if
+     partway through a handshake!) */
+  if(m->want_ntlm_http) {
+    if(conn->creds &&
+       (!Curl_creds_same(conn->creds, m->data->state.creds) ||
+        !Curl_peer_equal(conn->creds_origin, m->data->state.origin))) {
+      /* connection credentials in play and not the same or not for the
+       * same origin. */
+      return FALSE;
+    }
+  }
+  else if(conn->http_ntlm_state != NTLMSTATE_NONE) {
+    /* Connection is using NTLM auth but we do not want NTLM */
+    return FALSE;
+  }
+
+#ifndef CURL_DISABLE_PROXY
+  /* Same for Proxy NTLM authentication */
+  if(m->want_proxy_ntlm_http) {
+    /* Both conn->http_proxy.user and conn->http_proxy.passwd can be
+     * NULL */
+    if(!conn->http_proxy.creds)
+      return FALSE;
+
+    if(!Curl_creds_same(m->needle->http_proxy.creds, conn->http_proxy.creds))
+      return FALSE;
+  }
+  else if(conn->proxy_ntlm_state != NTLMSTATE_NONE) {
+    /* Proxy connection is using NTLM auth but we do not want NTLM */
+    return FALSE;
+  }
+#endif
+  if(m->want_ntlm_http || m->want_proxy_ntlm_http) {
+    /* Credentials are already checked, we may use this connection.
+     * With NTLM being weird as it is, we MUST use a
+     * connection where it has already been fully negotiated.
+     * If it has not, we keep on looking for a better one. */
+    m->found = conn;
+
+    if((m->want_ntlm_http &&
+       (conn->http_ntlm_state != NTLMSTATE_NONE)) ||
+        (m->want_proxy_ntlm_http &&
+         (conn->proxy_ntlm_state != NTLMSTATE_NONE))) {
+      /* We must use this connection, no other */
+      m->force_reuse = TRUE;
+      return TRUE;
+    }
+    /* Continue look up for a better connection */
+    return FALSE;
+  }
+  return TRUE;
+}
+#else
+#define url_match_auth_ntlm(c, m) ((void)(c), (void)(m), TRUE)
+#endif
+
+#ifdef USE_SPNEGO
+static bool url_match_auth_nego(struct connectdata *conn,
+                                struct url_conn_match *m)
+{
+  /* If we are looking for an HTTP+Negotiate connection, check if this is
+     already authenticating with the right credentials. If not, keep looking
+     so that we can reuse Negotiate connections if possible. */
+  if(m->want_nego_http) {
+    if(conn->creds &&
+       (!Curl_creds_same(conn->creds, m->data->state.creds) ||
+        !Curl_peer_equal(conn->creds_origin, m->data->state.origin)))
+      return FALSE;
+  }
+  else if(conn->http_negotiate_state != GSS_AUTHNONE) {
+    /* Connection is using Negotiate auth but we do not want Negotiate */
+    return FALSE;
+  }
+
+#ifndef CURL_DISABLE_PROXY
+  /* Same for Proxy Negotiate authentication */
+  if(m->want_proxy_nego_http) {
+    /* Both conn->http_proxy.user and conn->http_proxy.passwd can be
+     * NULL */
+    if(!conn->http_proxy.creds)
+      return FALSE;
+
+    if(!Curl_creds_same(m->needle->http_proxy.creds, conn->http_proxy.creds))
+      return FALSE;
+  }
+  else if(conn->proxy_negotiate_state != GSS_AUTHNONE) {
+    /* Proxy connection is using Negotiate auth but we do not want Negotiate */
+    return FALSE;
+  }
+#endif
+  if(m->want_nego_http || m->want_proxy_nego_http) {
+    /* Credentials are already checked, we may use this connection. We MUST
+     * use a connection where it has already been fully negotiated. If it has
+     * not, we keep on looking for a better one. */
+    m->found = conn;
+    if((m->want_nego_http &&
+        (conn->http_negotiate_state != GSS_AUTHNONE)) ||
+       (m->want_proxy_nego_http &&
+        (conn->proxy_negotiate_state != GSS_AUTHNONE))) {
+      /* We must use this connection, no other */
+      m->force_reuse = TRUE;
+      return TRUE;
+    }
+    return FALSE; /* get another */
+  }
+  return TRUE;
+}
+#else
+#define url_match_auth_nego(c, m) ((void)(c), (void)(m), TRUE)
+#endif
+
+static bool url_match_conn(struct connectdata *conn, void *userdata)
+{
+  struct url_conn_match *m = userdata;
+  /* Check if `conn` can be used for transfer `m->data` */
+
+  /* general connect config setting match? */
+  if(!url_match_connect_config(conn, m))
+    return FALSE;
+
+  /* match for destination and protocol? */
+  if(!url_match_destination(conn, m))
+    return FALSE;
+
+  if(!url_match_fully_connected(conn, m))
+    return FALSE;
+
+  if(!url_match_multiplex_needs(conn, m))
+    return FALSE;
+
+  if(!url_match_ssl_use(conn, m))
+    return FALSE;
+
+  if(!url_match_proxy_use(conn, m))
+    return FALSE;
+  if(!url_match_ssl_config(conn, m))
+    return FALSE;
+
+  if(!url_match_http_multiplex(conn, m))
+    return FALSE;
+  else if(m->wait_pipe)
+    /* we decided to wait on PIPELINING */
+    return TRUE;
+
+  if(!url_match_auth(conn, m))
+    return FALSE;
+
+  if(!url_match_proto_config(conn, m))
+    return FALSE;
+
+  if(!url_match_auth_ntlm(conn, m))
+    return FALSE;
+  else if(m->force_reuse)
+    return TRUE;
+
+  if(!url_match_auth_nego(conn, m))
+    return FALSE;
+  else if(m->force_reuse)
+    return TRUE;
+
+  if(!url_match_multiplex_limits(conn, m))
+    return FALSE;
+
+  if(!CONN_INUSE(conn) && Curl_conn_seems_dead(conn, m->data)) {
+    /* remove and disconnect. */
+    Curl_conn_terminate(m->data, conn, FALSE);
+    return FALSE;
+  }
+
+  /* conn matches our needs. */
+  m->found = conn;
+  return TRUE;
+}
+
+static bool url_match_result(void *userdata)
+{
+  struct url_conn_match *match = userdata;
+  if(match->found) {
+    /* Attach it now while still under lock, so the connection does
+     * no longer appear idle and can be reaped. */
+    Curl_attach_connection(match->data, match->found);
+    return TRUE;
+  }
+  else if(match->seen_single_use_conn && !match->seen_multiplex_conn) {
+    /* We have seen a single-use, existing connection to the destination and
+     * no multiplexed one. It seems safe to assume that the server does
+     * not support multiplexing. */
+    match->wait_pipe = FALSE;
+  }
+  else if(match->seen_pending_conn && match->data->set.pipewait) {
+    infof(match->data,
           "Found pending candidate for reuse and CURLOPT_PIPEWAIT is set");
-    *waitpipe = TRUE;
+    match->wait_pipe = TRUE;
   }
-
-  return FALSE; /* no matching connecting exists */
+  match->force_reuse = FALSE;
+  return FALSE;
 }
 
 /*
- * verboseconnect() displays verbose information after a connect
+ * Given a transfer and a prototype connection (needle),
+ * find and attach an existing connection that matches.
+ *
+ * Return TRUE if an existing connection was attached.
+ * `waitpipe` is TRUE if no existing connection matched, but there
+ * might be suitable one in the near future (common cause: multiplexing
+ * capability has not been determined yet, e.g. ALPN handshake).
  */
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-void Curl_verboseconnect(struct Curl_easy *data,
-                         struct connectdata *conn)
+static bool url_attach_existing(struct Curl_easy *data,
+                                struct connectdata *needle,
+                                bool *waitpipe)
 {
-  if(data->set.verbose)
-    infof(data, "Connected to %s (%s) port %u",
-          CURL_CONN_HOST_DISPNAME(conn), conn->primary_ip, conn->port);
-}
+  struct url_conn_match match;
+  bool success;
+
+  DEBUGASSERT(!data->conn);
+  memset(&match, 0, sizeof(match));
+  match.data = data;
+  match.needle = needle;
+  match.may_multiplex = xfer_may_multiplex(data, needle);
+
+#ifdef USE_NTLM
+  match.want_ntlm_http =
+    (data->state.authhost.want & CURLAUTH_NTLM) &&
+    (needle->scheme->protocol & PROTO_FAMILY_HTTP);
+#ifndef CURL_DISABLE_PROXY
+  match.want_proxy_ntlm_http =
+    needle->http_proxy.creds &&
+    (data->state.authproxy.want & CURLAUTH_NTLM) &&
+    (needle->scheme->protocol & PROTO_FAMILY_HTTP);
 #endif
+#endif
+
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_SPNEGO)
+  match.want_nego_http =
+    (data->state.authhost.want & CURLAUTH_NEGOTIATE) &&
+    (needle->scheme->protocol & PROTO_FAMILY_HTTP);
+#ifndef CURL_DISABLE_PROXY
+  match.want_proxy_nego_http =
+    needle->http_proxy.creds &&
+    (data->state.authproxy.want & CURLAUTH_NEGOTIATE) &&
+    (needle->scheme->protocol & PROTO_FAMILY_HTTP);
+#endif
+#endif
+  match.require_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
+  match.may_tls = data->set.use_ssl > CURLUSESSL_NONE;
+
+  /* Find a connection in the pool that matches what "data + needle"
+   * requires. If a suitable candidate is found, it is attached to "data". */
+  success = Curl_cpool_find(data, needle->destination,
+                            url_match_conn, url_match_result, &match);
+
+  /* wait_pipe is TRUE if we encounter a bundle that is undecided. There
+   * is no matching connection then, yet. */
+  *waitpipe = (bool)match.wait_pipe;
+  return success;
+}
 
 /*
  * Allocate and initialize a new connectdata object.
  */
 static struct connectdata *allocate_conn(struct Curl_easy *data)
 {
-  struct connectdata *conn = calloc(1, sizeof(struct connectdata));
+  struct connectdata *conn = curlx_calloc(1, sizeof(struct connectdata));
   if(!conn)
     return NULL;
 
@@ -1516,82 +1279,28 @@ static struct connectdata *allocate_conn(struct Curl_easy *data)
 
   conn->sock[FIRSTSOCKET] = CURL_SOCKET_BAD;     /* no file descriptor */
   conn->sock[SECONDARYSOCKET] = CURL_SOCKET_BAD; /* no file descriptor */
+  conn->recv_idx = 0; /* default for receiving transfer data */
+  conn->send_idx = 0; /* default for sending transfer data */
   conn->connection_id = -1;    /* no ID */
-  conn->port = -1; /* unknown at this point */
-  conn->remote_port = -1; /* unknown at this point */
-
-  /* Default protocol-independent behavior doesn't support persistent
-     connections, so we set this to force-close. Protocols that support
-     this need to set this to FALSE in their "curl_do" functions. */
-  connclose(conn, "Default to force-close");
+  conn->attached_xfers = 0;
 
   /* Store creation time to help future close decision making */
-  conn->created = Curl_now();
+  conn->created = *Curl_pgrs_now(data);
 
   /* Store current time to give a baseline to keepalive connection times. */
   conn->keepalive = conn->created;
 
-#ifndef CURL_DISABLE_PROXY
-  conn->http_proxy.proxytype = data->set.proxytype;
-  conn->socks_proxy.proxytype = CURLPROXY_SOCKS4;
-
-  /* note that these two proxy bits are now just on what looks to be
-     requested, they may be altered down the road */
-  conn->bits.proxy = (data->set.str[STRING_PROXY] &&
-                      *data->set.str[STRING_PROXY]) ? TRUE : FALSE;
-  conn->bits.httpproxy = (conn->bits.proxy &&
-                          (conn->http_proxy.proxytype == CURLPROXY_HTTP ||
-                           conn->http_proxy.proxytype == CURLPROXY_HTTP_1_0 ||
-                           IS_HTTPS_PROXY(conn->http_proxy.proxytype))) ?
-    TRUE : FALSE;
-  conn->bits.socksproxy = (conn->bits.proxy &&
-                           !conn->bits.httpproxy) ? TRUE : FALSE;
-
-  if(data->set.str[STRING_PRE_PROXY] && *data->set.str[STRING_PRE_PROXY]) {
-    conn->bits.proxy = TRUE;
-    conn->bits.socksproxy = TRUE;
-  }
-
-  conn->bits.proxy_user_passwd =
-    (data->state.aptr.proxyuser) ? TRUE : FALSE;
-  conn->bits.tunnel_proxy = data->set.tunnel_thru_httpproxy;
-#endif /* CURL_DISABLE_PROXY */
-
 #ifndef CURL_DISABLE_FTP
   conn->bits.ftp_use_epsv = data->set.ftp_use_epsv;
   conn->bits.ftp_use_eprt = data->set.ftp_use_eprt;
-#endif
-  conn->ssl_config.verifystatus = data->set.ssl.primary.verifystatus;
-  conn->ssl_config.verifypeer = data->set.ssl.primary.verifypeer;
-  conn->ssl_config.verifyhost = data->set.ssl.primary.verifyhost;
-  conn->ssl_config.ssl_options = data->set.ssl.primary.ssl_options;
-#ifndef CURL_DISABLE_PROXY
-  conn->proxy_ssl_config.verifystatus =
-    data->set.proxy_ssl.primary.verifystatus;
-  conn->proxy_ssl_config.verifypeer = data->set.proxy_ssl.primary.verifypeer;
-  conn->proxy_ssl_config.verifyhost = data->set.proxy_ssl.primary.verifyhost;
-  conn->proxy_ssl_config.ssl_options = data->set.proxy_ssl.primary.ssl_options;
 #endif
   conn->ip_version = data->set.ipver;
-  conn->connect_only = data->set.connect_only;
-  conn->transport = TRNSPRT_TCP; /* most of them are TCP streams */
-
-#if !defined(CURL_DISABLE_HTTP) && defined(USE_NTLM) && \
-    defined(NTLM_WB_ENABLED)
-  conn->ntlm.ntlm_auth_hlpr_socket = CURL_SOCKET_BAD;
-  conn->proxyntlm.ntlm_auth_hlpr_socket = CURL_SOCKET_BAD;
-#endif
-
-  /* Initialize the easy handle list */
-  Curl_llist_init(&conn->easyq, NULL);
-
-#ifdef HAVE_GSSAPI
-  conn->data_prot = PROT_CLEAR;
-#endif
+  conn->bits.connect_only = (bool)data->set.connect_only;
+  conn->transport_wanted = TRNSPRT_TCP; /* most of them are TCP streams */
 
   /* Store the local bind parameters that will be used for this connection */
   if(data->set.str[STRING_DEVICE]) {
-    conn->localdev = strdup(data->set.str[STRING_DEVICE]);
+    conn->localdev = curlx_strdup(data->set.str[STRING_DEVICE]);
     if(!conn->localdev)
       goto error;
   }
@@ -1605,69 +1314,39 @@ static struct connectdata *allocate_conn(struct Curl_easy *data)
   conn->fclosesocket = data->set.fclosesocket;
   conn->closesocket_client = data->set.closesocket_client;
   conn->lastused = conn->created;
+#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
   conn->gssapi_delegation = data->set.gssapi_delegation;
-
+#endif
   return conn;
 error:
 
-  free(conn->localdev);
-  free(conn);
+  curlx_free(conn->localdev);
+  curlx_free(conn);
   return NULL;
 }
 
-/* returns the handler if the given scheme is built-in */
-const struct Curl_handler *Curl_builtin_scheme(const char *scheme,
-                                               size_t schemelen)
+static CURLcode url_set_conn_scheme(struct Curl_easy *data,
+                                    struct connectdata *conn,
+                                    const struct Curl_scheme *scheme)
 {
-  const struct Curl_handler * const *pp;
-  const struct Curl_handler *p;
-  /* Scan protocol handler table and match against 'scheme'. The handler may
-     be changed later when the protocol specific setup function is called. */
-  if(schemelen == CURL_ZERO_TERMINATED)
-    schemelen = strlen(scheme);
-  for(pp = protocols; (p = *pp) != NULL; pp++)
-    if(strncasecompare(p->scheme, scheme, schemelen) && !p->scheme[schemelen])
-      /* Protocol found in table. */
-      return p;
-  return NULL; /* not found */
-}
-
-
-static CURLcode findprotocol(struct Curl_easy *data,
-                             struct connectdata *conn,
-                             const char *protostr)
-{
-  const struct Curl_handler *p = Curl_builtin_scheme(protostr,
-                                                     CURL_ZERO_TERMINATED);
-
-  if(p && /* Protocol found in table. Check if allowed */
-     (data->set.allowed_protocols & p->protocol)) {
-
-    /* it is allowed for "normal" request, now do an extra check if this is
-       the result of a redirect */
-    if(data->state.this_is_a_follow &&
-       !(data->set.redir_protocols & p->protocol))
-      /* nope, get out */
-      ;
-    else {
-      /* Perform setup complement if some. */
-      conn->handler = conn->given = p;
-
-      /* 'port' and 'remote_port' are set in setup_connection_internals() */
-      return CURLE_OK;
-    }
+  /* URL scheme is usable for connection when it is
+   * - allowed
+   * - not from a redirect or an allowed redirect protocol */
+  if(scheme->run &&
+     (data->set.allowed_protocols & scheme->protocol) &&
+     (!data->state.this_is_a_follow ||
+       (data->set.redir_protocols & scheme->protocol))) {
+    conn->scheme = conn->given = scheme;
+    return CURLE_OK;
   }
-
-  /* The protocol was not found in the table, but we don't have to assign it
-     to anything since it is already assigned to a dummy-struct in the
-     create_conn() function when the connectdata struct is allocated. */
-  failf(data, "Protocol \"%s\" not supported or disabled in " LIBCURL_NAME,
-        protostr);
-
+  if(scheme->flags & PROTOPT_NO_TRANSFER)
+    failf(data, "Protocol \"%s\" is not for transfers", scheme->name);
+  else
+    failf(data, "Protocol \"%s\" is disabled%s", scheme->name,
+          data->state.this_is_a_follow ? " (in redirect)" : "");
   return CURLE_UNSUPPORTED_PROTOCOL;
 }
 
-
 CURLcode Curl_uc_to_curlcode(CURLUcode uc)
 {
   switch(uc) {
@@ -1682,283 +1361,277 @@ CURLcode Curl_uc_to_curlcode(CURLUcode uc)
   }
 }
 
-#ifdef ENABLE_IPV6
-/*
- * If the URL was set with an IPv6 numerical address with a zone id part, set
- * the scope_id based on that!
- */
-
-static void zonefrom_url(CURLU *uh, struct Curl_easy *data,
-                         struct connectdata *conn)
+#ifndef CURL_DISABLE_HSTS
+static CURLcode hsts_upgrade(struct Curl_easy *data,
+                             CURLU *uh,
+                             uint16_t port_override,
+                             uint32_t scope_id)
 {
-  char *zoneid;
-  CURLUcode uc = curl_url_get(uh, CURLUPART_ZONEID, &zoneid, 0);
-#ifdef CURL_DISABLE_VERBOSE_STRINGS
-  (void)data;
-#endif
+  /* HSTS upgrade */
+  if(data->hsts && (data->state.origin->scheme == &Curl_scheme_http) &&
+     Curl_hsts_applies(data->hsts, data->state.origin)) {
+    char *url;
+    CURLUcode uc;
+    CURLcode result;
 
-  if(!uc && zoneid) {
-    char *endp;
-    unsigned long scope = strtoul(zoneid, &endp, 10);
-    if(!*endp && (scope < UINT_MAX))
-      /* A plain number, use it directly as a scope id. */
-      conn->scope_id = (unsigned int)scope;
-#if defined(HAVE_IF_NAMETOINDEX)
-    else {
-#elif defined(WIN32)
-    else if(Curl_if_nametoindex) {
-#endif
-
-#if defined(HAVE_IF_NAMETOINDEX) || defined(WIN32)
-      /* Zone identifier is not numeric */
-      unsigned int scopeidx = 0;
-#if defined(WIN32)
-      scopeidx = Curl_if_nametoindex(zoneid);
-#else
-      scopeidx = if_nametoindex(zoneid);
-#endif
-      if(!scopeidx) {
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-        char buffer[STRERROR_LEN];
-        infof(data, "Invalid zoneid: %s; %s", zoneid,
-              Curl_strerror(errno, buffer, sizeof(buffer)));
-#endif
-      }
-      else
-        conn->scope_id = scopeidx;
-    }
-#endif /* HAVE_IF_NAMETOINDEX || WIN32 */
-
-    free(zoneid);
-  }
-}
-#else
-#define zonefrom_url(a,b,c) Curl_nop_stmt
-#endif
-
-/*
- * Parse URL and fill in the relevant members of the connection struct.
- */
-static CURLcode parseurlandfillconn(struct Curl_easy *data,
-                                    struct connectdata *conn)
-{
-  CURLcode result;
-  CURLU *uh;
-  CURLUcode uc;
-  char *hostname;
-  bool use_set_uh = (data->set.uh && !data->state.this_is_a_follow);
-
-  up_free(data); /* cleanup previous leftovers first */
-
-  /* parse the URL */
-  if(use_set_uh) {
-    uh = data->state.uh = curl_url_dup(data->set.uh);
-  }
-  else {
-    uh = data->state.uh = curl_url();
-  }
-
-  if(!uh)
-    return CURLE_OUT_OF_MEMORY;
-
-  if(data->set.str[STRING_DEFAULT_PROTOCOL] &&
-     !Curl_is_absolute_url(data->state.url, NULL, 0, TRUE)) {
-    char *url = aprintf("%s://%s", data->set.str[STRING_DEFAULT_PROTOCOL],
-                        data->state.url);
-    if(!url)
-      return CURLE_OUT_OF_MEMORY;
-    if(data->state.url_alloc)
-      free(data->state.url);
-    data->state.url = url;
-    data->state.url_alloc = TRUE;
-  }
-
-  if(!use_set_uh) {
-    char *newurl;
-    uc = curl_url_set(uh, CURLUPART_URL, data->state.url,
-                      CURLU_GUESS_SCHEME |
-                      CURLU_NON_SUPPORT_SCHEME |
-                      (data->set.disallow_username_in_url ?
-                       CURLU_DISALLOW_USER : 0) |
-                      (data->set.path_as_is ? CURLU_PATH_AS_IS : 0));
-    if(uc) {
-      failf(data, "URL rejected: %s", curl_url_strerror(uc));
-      return Curl_uc_to_curlcode(uc);
-    }
-
-    /* after it was parsed, get the generated normalized version */
-    uc = curl_url_get(uh, CURLUPART_URL, &newurl, 0);
+    curlx_safefree(data->state.up.scheme);
+    uc = curl_url_set(uh, CURLUPART_SCHEME, "https", 0);
     if(uc)
       return Curl_uc_to_curlcode(uc);
-    if(data->state.url_alloc)
-      free(data->state.url);
-    data->state.url = newurl;
-    data->state.url_alloc = TRUE;
-  }
-
-  uc = curl_url_get(uh, CURLUPART_SCHEME, &data->state.up.scheme, 0);
-  if(uc)
-    return Curl_uc_to_curlcode(uc);
-
-  uc = curl_url_get(uh, CURLUPART_HOST, &data->state.up.hostname, 0);
-  if(uc) {
-    if(!strcasecompare("file", data->state.up.scheme))
-      return CURLE_OUT_OF_MEMORY;
-  }
-  else if(strlen(data->state.up.hostname) > MAX_URL_LEN) {
-    failf(data, "Too long host name (maximum is %d)", MAX_URL_LEN);
-    return CURLE_URL_MALFORMAT;
-  }
-  hostname = data->state.up.hostname;
-
-  if(hostname && hostname[0] == '[') {
-    /* This looks like an IPv6 address literal. See if there is an address
-       scope. */
-    size_t hlen;
-    conn->bits.ipv6_ip = TRUE;
-    /* cut off the brackets! */
-    hostname++;
-    hlen = strlen(hostname);
-    hostname[hlen - 1] = 0;
-
-    zonefrom_url(uh, data, conn);
-  }
-
-  /* make sure the connect struct gets its own copy of the host name */
-  conn->host.rawalloc = strdup(hostname ? hostname : "");
-  if(!conn->host.rawalloc)
-    return CURLE_OUT_OF_MEMORY;
-  conn->host.name = conn->host.rawalloc;
-
-  /*************************************************************
-   * IDN-convert the hostnames
-   *************************************************************/
-  result = Curl_idnconvert_hostname(&conn->host);
-  if(result)
-    return result;
-
-#ifndef CURL_DISABLE_HSTS
-  /* HSTS upgrade */
-  if(data->hsts && strcasecompare("http", data->state.up.scheme)) {
-    /* This MUST use the IDN decoded name */
-    if(Curl_hsts(data->hsts, conn->host.name, TRUE)) {
-      char *url;
-      Curl_safefree(data->state.up.scheme);
-      uc = curl_url_set(uh, CURLUPART_SCHEME, "https", 0);
-      if(uc)
-        return Curl_uc_to_curlcode(uc);
-      if(data->state.url_alloc)
-        Curl_safefree(data->state.url);
-      /* after update, get the updated version */
-      uc = curl_url_get(uh, CURLUPART_URL, &url, 0);
-      if(uc)
-        return Curl_uc_to_curlcode(uc);
-      uc = curl_url_get(uh, CURLUPART_SCHEME, &data->state.up.scheme, 0);
-      if(uc) {
-        free(url);
-        return Curl_uc_to_curlcode(uc);
-      }
-      data->state.url = url;
-      data->state.url_alloc = TRUE;
-      infof(data, "Switched from HTTP to HTTPS due to HSTS => %s",
-            data->state.url);
-    }
-  }
-#endif
-
-  result = findprotocol(data, conn, data->state.up.scheme);
-  if(result)
-    return result;
-
-  /*
-   * User name and password set with their own options override the
-   * credentials possibly set in the URL.
-   */
-  if(!data->set.str[STRING_PASSWORD]) {
-    uc = curl_url_get(uh, CURLUPART_PASSWORD, &data->state.up.password, 0);
-    if(!uc) {
-      char *decoded;
-      result = Curl_urldecode(data->state.up.password, 0, &decoded, NULL,
-                              conn->handler->flags&PROTOPT_USERPWDCTRL ?
-                              REJECT_ZERO : REJECT_CTRL);
-      if(result)
-        return result;
-      conn->passwd = decoded;
-      result = Curl_setstropt(&data->state.aptr.passwd, decoded);
-      if(result)
-        return result;
-    }
-    else if(uc != CURLUE_NO_PASSWORD)
+    Curl_bufref_free(&data->state.url);
+    /* after update, get the updated version */
+    uc = curl_url_get(uh, CURLUPART_URL, &url, 0);
+    if(uc)
       return Curl_uc_to_curlcode(uc);
-  }
+    Curl_bufref_set(&data->state.url, url, 0, curl_free);
 
-  if(!data->set.str[STRING_USERNAME]) {
-    /* we don't use the URL API's URL decoder option here since it rejects
-       control codes and we want to allow them for some schemes in the user
-       and password fields */
-    uc = curl_url_get(uh, CURLUPART_USER, &data->state.up.user, 0);
-    if(!uc) {
-      char *decoded;
-      result = Curl_urldecode(data->state.up.user, 0, &decoded, NULL,
-                              conn->handler->flags&PROTOPT_USERPWDCTRL ?
-                              REJECT_ZERO : REJECT_CTRL);
-      if(result)
-        return result;
-      conn->user = decoded;
-      result = Curl_setstropt(&data->state.aptr.user, decoded);
-    }
-    else if(uc != CURLUE_NO_USER)
-      return Curl_uc_to_curlcode(uc);
-    else if(data->state.aptr.passwd) {
-      /* no user was set but a password, set a blank user */
-      result = Curl_setstropt(&data->state.aptr.user, "");
-    }
+    result = Curl_peer_from_url(uh, data, port_override, scope_id,
+                                &data->state.up, &data->state.origin);
     if(result)
       return result;
+    infof(data, "Switched from HTTP to HTTPS due to HSTS => %s", url);
   }
-
-  uc = curl_url_get(uh, CURLUPART_OPTIONS, &data->state.up.options,
-                    CURLU_URLDECODE);
-  if(!uc) {
-    conn->options = strdup(data->state.up.options);
-    if(!conn->options)
-      return CURLE_OUT_OF_MEMORY;
-  }
-  else if(uc != CURLUE_NO_OPTIONS)
-    return Curl_uc_to_curlcode(uc);
-
-  uc = curl_url_get(uh, CURLUPART_PATH, &data->state.up.path,
-                    CURLU_URLENCODE);
-  if(uc)
-    return Curl_uc_to_curlcode(uc);
-
-  uc = curl_url_get(uh, CURLUPART_PORT, &data->state.up.port,
-                    CURLU_DEFAULT_PORT);
-  if(uc) {
-    if(!strcasecompare("file", data->state.up.scheme))
-      return CURLE_OUT_OF_MEMORY;
-  }
-  else {
-    unsigned long port = strtoul(data->state.up.port, NULL, 10);
-    conn->port = conn->remote_port =
-      (data->set.use_port && data->state.allow_port) ?
-      data->set.use_port : curlx_ultous(port);
-  }
-
-  (void)curl_url_get(uh, CURLUPART_QUERY, &data->state.up.query, 0);
-
-#ifdef ENABLE_IPV6
-  if(data->set.scope_id)
-    /* Override any scope that was set above.  */
-    conn->scope_id = data->set.scope_id;
-#endif
-
   return CURLE_OK;
 }
+#else
+#define hsts_upgrade(x, y, z, a) CURLE_OK
+#endif
 
+#ifndef CURL_DISABLE_NETRC
+static bool str_has_ctrl(const char *input)
+{
+  if(input) {
+    const unsigned char *str = (const unsigned char *)input;
+    while(*str) {
+      if(*str < 0x20)
+        return TRUE;
+      str++;
+    }
+  }
+  return FALSE;
+}
 
 /*
- * If we're doing a resumed transfer, we need to setup our stuff
+ * Override the login details from the URL with that in the CURLOPT_USERPWD
+ * option or a .netrc file, if applicable.
+ */
+static CURLcode url_set_data_creds_netrc(struct Curl_easy *data,
+                                         struct Curl_creds **pcreds)
+{
+  struct Curl_creds *ncreds_out = NULL;
+  CURLcode result = CURLE_OK;
+
+  if(data->set.use_netrc) { /* not CURL_NETRC_IGNORED */
+    struct Curl_creds *ncreds_in = NULL;
+    bool scan_netrc = TRUE;
+    NETRCcode ret;
+    CURLUcode uc;
+
+    if(*pcreds) {
+      switch((*pcreds)->source) {
+      case CREDS_OPTION:
+        /* we never override credentials set via CURLOPT_*, leave. */
+        scan_netrc = FALSE;
+        break;
+      case CREDS_URL: /* only apply when netrc is not required */
+        if(data->set.use_netrc == CURL_NETRC_REQUIRED) {
+          /* We ignore password from URL */
+          ncreds_in = *pcreds;
+        }
+        else if(!Curl_creds_has_user(*pcreds) ||
+                !Curl_creds_has_passwd(*pcreds)) {
+          /* We use netrc to complete what is missing */
+          ncreds_in = *pcreds;
+        }
+        else
+          scan_netrc = FALSE;
+        break;
+      default: /* ignore credentials from other sources */
+        break;
+      }
+    }
+
+    if(!scan_netrc)
+      goto out;
+
+    ret = Curl_netrc_scan(data, &data->state.netrc,
+                          data->state.origin->hostname,
+                          Curl_creds_user(ncreds_in),
+                          data->set.str[STRING_NETRC_FILE],
+                          &ncreds_out);
+    DEBUGASSERT(!ret || !ncreds_out);
+    if(ret == NETRC_OUT_OF_MEMORY) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+    else if(ret && ((ret == NETRC_NO_MATCH) ||
+                    (data->set.use_netrc == CURL_NETRC_OPTIONAL))) {
+      infof(data, "Could not find host %s in the %s file; using defaults",
+            data->state.origin->hostname,
+            (data->set.str[STRING_NETRC_FILE] ?
+             data->set.str[STRING_NETRC_FILE] : ".netrc"));
+    }
+    else if(ret) {
+      const char *m = Curl_netrc_strerror(ret);
+      failf(data, ".netrc error: %s", m);
+      result = CURLE_READ_ERROR;
+      goto out;
+    }
+    else if(ncreds_out) {
+      if(!(data->state.origin->scheme->flags & PROTOPT_USERPWDCTRL)) {
+        /* if the protocol cannot handle control codes in credentials, make
+           sure there are none */
+        if(str_has_ctrl(ncreds_out->user) ||
+           str_has_ctrl(ncreds_out->passwd)) {
+          failf(data, "control code detected in .netrc credentials");
+          result = CURLE_READ_ERROR;
+          goto out;
+        }
+      }
+      CURL_TRC_M(data, "netrc: using credentials for %s as %s",
+                 data->state.origin->hostname, ncreds_out->user);
+      result = Curl_creds_merge(ncreds_out->user, ncreds_out->passwd,
+                                *pcreds, CREDS_NETRC, pcreds);
+      if(result)
+        goto out;
+      /* for updated strings, we update them in the URL */
+      uc = curl_url_set(data->state.uh, CURLUPART_USER,
+                        Curl_creds_user(*pcreds), CURLU_URLENCODE);
+      if(!uc)
+        uc = curl_url_set(data->state.uh, CURLUPART_PASSWORD,
+                          Curl_creds_passwd(*pcreds),
+                          CURLU_URLENCODE);
+      if(uc)
+        result = Curl_uc_to_curlcode(uc);
+    }
+    else
+      DEBUGASSERT(0);
+  }
+
+#ifdef CURLVERBOSE
+  Curl_creds_trace(data, data->state.creds, "transfer credentials");
+#endif
+
+out:
+  Curl_creds_unlink(&ncreds_out);
+  return result;
+}
+#endif /* CURL_DISABLE_NETRC */
+
+static CURLcode url_set_data_creds(struct Curl_easy *data, CURLU *uh)
+{
+  struct Curl_creds *newcreds = NULL;
+  CURLcode result = CURLE_OK;
+
+  if((data->set.str[STRING_USERNAME] ||
+      data->set.str[STRING_PASSWORD] ||
+      data->set.str[STRING_BEARER] ||
+      data->set.str[STRING_SASL_AUTHZID] ||
+      data->set.str[STRING_SERVICE_NAME]) &&
+     Curl_auth_allowed_to_origin(data, data->state.origin)) {
+    result = Curl_creds_create(data->set.str[STRING_USERNAME],
+                               data->set.str[STRING_PASSWORD],
+                               data->set.str[STRING_BEARER],
+                               data->set.str[STRING_SASL_AUTHZID],
+                               data->set.str[STRING_SERVICE_NAME],
+                               CREDS_OPTION, &newcreds);
+    if(result)
+      goto out;
+  }
+
+  /* Extract credentials from the URL only if there are none OR
+   * if no CURLOPT_USER was set. */
+  if(!newcreds || !Curl_creds_has_user(newcreds)) {
+    char *udecoded = NULL;
+    char *pdecoded = NULL;
+    CURLUcode uc;
+
+    uc = curl_url_get(uh, CURLUPART_USER, &data->state.up.user, 0);
+    if(uc && (uc != CURLUE_NO_USER))
+      result = Curl_uc_to_curlcode(uc);
+    if(!result) {
+      uc = curl_url_get(uh, CURLUPART_PASSWORD, &data->state.up.password, 0);
+      if(uc && (uc != CURLUE_NO_PASSWORD))
+        result = Curl_uc_to_curlcode(uc);
+    }
+    if(!result && data->state.up.user) {
+      result = Curl_urldecode(data->state.up.user, 0, &udecoded, NULL,
+                              (data->state.origin->scheme->flags &
+                               PROTOPT_USERPWDCTRL) ?
+                              REJECT_ZERO : REJECT_CTRL);
+    }
+    if(!result && data->state.up.password) {
+      result = Curl_urldecode(data->state.up.password, 0, &pdecoded, NULL,
+                              (data->state.origin->scheme->flags &
+                               PROTOPT_USERPWDCTRL) ?
+                              REJECT_ZERO : REJECT_CTRL);
+    }
+    if(!result)
+      result = Curl_creds_merge(udecoded, pdecoded, newcreds,
+                                CREDS_URL, &newcreds);
+
+    curlx_free(udecoded);
+    curlx_free(pdecoded);
+    if(result) {
+      failf(data, "error extracting credentials from URL");
+      goto out;
+    }
+  }
+
+#ifndef CURL_DISABLE_NETRC
+  /* Check for overridden login details and set them accordingly so that
+     they are known when protocol->setup_connection is called! */
+  result = url_set_data_creds_netrc(data, &newcreds);
+#endif /* CURL_DISABLE_NETRC */
+
+out:
+  if(!result && !Curl_creds_equal(data->state.creds, newcreds)) {
+    /* Do we have more things to trigger on credentials change? */
+    Curl_creds_link(&data->state.creds, newcreds);
+  }
+  Curl_creds_unlink(&newcreds);
+  return result;
+}
+
+static CURLcode url_set_conn_origin_etc(struct Curl_easy *data,
+                                        struct connectdata *conn)
+{
+  CURLcode result = CURLE_OK;
+
+  Curl_peer_link(&conn->origin, data->state.origin);
+
+  /* set the connection scheme */
+  result = url_set_conn_scheme(data, conn, conn->origin->scheme);
+  if(result)
+    goto out;
+
+  /* set the connection options */
+  if(data->set.str[STRING_OPTIONS]) {
+    conn->options = curlx_strdup(data->set.str[STRING_OPTIONS]);
+    if(!conn->options) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+  }
+  else if(data->state.up.options) {
+    conn->options = curlx_strdup(data->state.up.options);
+    if(!conn->options) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+  }
+
+#ifdef USE_IPV6
+  conn->scope_id = data->set.scope_id ?
+                   data->set.scope_id : data->state.origin->scopeid;
+#endif
+
+out:
+  return result;
+}
+
+/*
+ * If we are doing a resumed transfer, we need to setup our stuff
  * properly.
  */
 static CURLcode setup_range(struct Curl_easy *data)
@@ -1967,18 +1640,18 @@ static CURLcode setup_range(struct Curl_easy *data)
   s->resume_from = data->set.set_resume_from;
   if(s->resume_from || data->set.str[STRING_SET_RANGE]) {
     if(s->rangestringalloc)
-      free(s->range);
+      curlx_free(s->range);
 
     if(s->resume_from)
-      s->range = aprintf("%" CURL_FORMAT_CURL_OFF_T "-", s->resume_from);
+      s->range = curl_maprintf("%" FMT_OFF_T "-", s->resume_from);
     else
-      s->range = strdup(data->set.str[STRING_SET_RANGE]);
-
-    s->rangestringalloc = (s->range) ? TRUE : FALSE;
+      s->range = curlx_strdup(data->set.str[STRING_SET_RANGE]);
 
     if(!s->range)
       return CURLE_OUT_OF_MEMORY;
 
+    s->rangestringalloc = TRUE;
+
     /* tell ourselves to fetch this range */
     s->use_range = TRUE;        /* enable range download */
   }
@@ -1988,7 +1661,6 @@ static CURLcode setup_range(struct Curl_easy *data)
   return CURLE_OK;
 }
 
-
 /*
  * setup_connection_internals() -
  *
@@ -2001,545 +1673,44 @@ static CURLcode setup_range(struct Curl_easy *data)
 static CURLcode setup_connection_internals(struct Curl_easy *data,
                                            struct connectdata *conn)
 {
-  const struct Curl_handler *p;
+  struct Curl_peer *peer = NULL;
   CURLcode result;
 
-  /* Perform setup complement if some. */
-  p = conn->handler;
-
-  if(p->setup_connection) {
-    result = (*p->setup_connection)(data, conn);
-
+  if(conn->scheme->run->setup_connection) {
+    result = conn->scheme->run->setup_connection(data, conn);
     if(result)
       return result;
-
-    p = conn->handler;              /* May have changed. */
   }
 
-  if(conn->port < 0)
-    /* we check for -1 here since if proxy was detected already, this
-       was very likely already set to the proxy port */
-    conn->port = p->defport;
+  /* Now create the destination name */
+  peer = Curl_conn_get_destination(conn, FIRSTSOCKET);
+  if(!peer)
+    return CURLE_FAILED_INIT;
+
+  /* IPv6 addresses with a scope_id (0 is default == global) have a
+   * printable representation with a '%<scope_id>' suffix. */
+  if(peer->ipv6)
+    if(peer->scopeid)
+      conn->destination = curl_maprintf("[%s%%%u]:%u",
+        peer->hostname, peer->scopeid, peer->port);
+    else
+      conn->destination = curl_maprintf("[%s]:%u",
+        peer->hostname, peer->port);
+  else
+    conn->destination = curl_maprintf("%s:%u", peer->hostname, peer->port);
+  if(!conn->destination)
+    return CURLE_OUT_OF_MEMORY;
+
+  Curl_strntolower(conn->destination, conn->destination,
+                   strlen(conn->destination));
 
   return CURLE_OK;
 }
 
-/*
- * Curl_free_request_state() should free temp data that was allocated in the
- * Curl_easy for this single request.
- */
-
-void Curl_free_request_state(struct Curl_easy *data)
-{
-  Curl_safefree(data->req.p.http);
-  Curl_safefree(data->req.newurl);
-
-#ifndef CURL_DISABLE_DOH
-  if(data->req.doh) {
-    Curl_close(&data->req.doh->probe[0].easy);
-    Curl_close(&data->req.doh->probe[1].easy);
-  }
-#endif
-}
-
-
-#ifndef CURL_DISABLE_PROXY
-
-#ifndef CURL_DISABLE_HTTP
-/****************************************************************
-* Detect what (if any) proxy to use. Remember that this selects a host
-* name and is not limited to HTTP proxies only.
-* The returned pointer must be freed by the caller (unless NULL)
-****************************************************************/
-static char *detect_proxy(struct Curl_easy *data,
-                          struct connectdata *conn)
-{
-  char *proxy = NULL;
-
-  /* If proxy was not specified, we check for default proxy environment
-   * variables, to enable i.e Lynx compliance:
-   *
-   * http_proxy=http://some.server.dom:port/
-   * https_proxy=http://some.server.dom:port/
-   * ftp_proxy=http://some.server.dom:port/
-   * no_proxy=domain1.dom,host.domain2.dom
-   *   (a comma-separated list of hosts which should
-   *   not be proxied, or an asterisk to override
-   *   all proxy variables)
-   * all_proxy=http://some.server.dom:port/
-   *   (seems to exist for the CERN www lib. Probably
-   *   the first to check for.)
-   *
-   * For compatibility, the all-uppercase versions of these variables are
-   * checked if the lowercase versions don't exist.
-   */
-  char proxy_env[128];
-  const char *protop = conn->handler->scheme;
-  char *envp = proxy_env;
-  char *prox;
-#ifdef CURL_DISABLE_VERBOSE_STRINGS
-  (void)data;
-#endif
-
-  /* Now, build <protocol>_proxy and check for such a one to use */
-  while(*protop)
-    *envp++ = Curl_raw_tolower(*protop++);
-
-  /* append _proxy */
-  strcpy(envp, "_proxy");
-
-  /* read the protocol proxy: */
-  prox = curl_getenv(proxy_env);
-
-  /*
-   * We don't try the uppercase version of HTTP_PROXY because of
-   * security reasons:
-   *
-   * When curl is used in a webserver application
-   * environment (cgi or php), this environment variable can
-   * be controlled by the web server user by setting the
-   * http header 'Proxy:' to some value.
-   *
-   * This can cause 'internal' http/ftp requests to be
-   * arbitrarily redirected by any external attacker.
-   */
-  if(!prox && !strcasecompare("http_proxy", proxy_env)) {
-    /* There was no lowercase variable, try the uppercase version: */
-    Curl_strntoupper(proxy_env, proxy_env, sizeof(proxy_env));
-    prox = curl_getenv(proxy_env);
-  }
-
-  envp = proxy_env;
-  if(prox) {
-    proxy = prox; /* use this */
-  }
-  else {
-    envp = (char *)"all_proxy";
-    proxy = curl_getenv(envp); /* default proxy to use */
-    if(!proxy) {
-      envp = (char *)"ALL_PROXY";
-      proxy = curl_getenv(envp);
-    }
-  }
-  if(proxy)
-    infof(data, "Uses proxy env variable %s == '%s'", envp, proxy);
-
-  return proxy;
-}
-#endif /* CURL_DISABLE_HTTP */
-
-/*
- * If this is supposed to use a proxy, we need to figure out the proxy
- * host name, so that we can reuse an existing connection
- * that may exist registered to the same proxy host.
- */
-static CURLcode parse_proxy(struct Curl_easy *data,
-                            struct connectdata *conn, char *proxy,
-                            curl_proxytype proxytype)
-{
-  char *portptr = NULL;
-  int port = -1;
-  char *proxyuser = NULL;
-  char *proxypasswd = NULL;
-  char *host = NULL;
-  bool sockstype;
-  CURLUcode uc;
-  struct proxy_info *proxyinfo;
-  CURLU *uhp = curl_url();
-  CURLcode result = CURLE_OK;
-  char *scheme = NULL;
-#ifdef USE_UNIX_SOCKETS
-  char *path = NULL;
-  bool is_unix_proxy = FALSE;
-#endif
-
-
-  if(!uhp) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-
-  /* When parsing the proxy, allowing non-supported schemes since we have
-     these made up ones for proxies. Guess scheme for URLs without it. */
-  uc = curl_url_set(uhp, CURLUPART_URL, proxy,
-                    CURLU_NON_SUPPORT_SCHEME|CURLU_GUESS_SCHEME);
-  if(!uc) {
-    /* parsed okay as a URL */
-    uc = curl_url_get(uhp, CURLUPART_SCHEME, &scheme, 0);
-    if(uc) {
-      result = CURLE_OUT_OF_MEMORY;
-      goto error;
-    }
-
-    if(strcasecompare("https", scheme)) {
-      if(proxytype != CURLPROXY_HTTPS2)
-        proxytype = CURLPROXY_HTTPS;
-      else
-        proxytype = CURLPROXY_HTTPS2;
-    }
-    else if(strcasecompare("socks5h", scheme))
-      proxytype = CURLPROXY_SOCKS5_HOSTNAME;
-    else if(strcasecompare("socks5", scheme))
-      proxytype = CURLPROXY_SOCKS5;
-    else if(strcasecompare("socks4a", scheme))
-      proxytype = CURLPROXY_SOCKS4A;
-    else if(strcasecompare("socks4", scheme) ||
-            strcasecompare("socks", scheme))
-      proxytype = CURLPROXY_SOCKS4;
-    else if(strcasecompare("http", scheme))
-      ; /* leave it as HTTP or HTTP/1.0 */
-    else {
-      /* Any other xxx:// reject! */
-      failf(data, "Unsupported proxy scheme for \'%s\'", proxy);
-      result = CURLE_COULDNT_CONNECT;
-      goto error;
-    }
-  }
-  else {
-    failf(data, "Unsupported proxy syntax in \'%s\': %s", proxy,
-          curl_url_strerror(uc));
-    result = CURLE_COULDNT_RESOLVE_PROXY;
-    goto error;
-  }
-
-#ifdef USE_SSL
-  if(!Curl_ssl_supports(data, SSLSUPP_HTTPS_PROXY))
-#endif
-    if(IS_HTTPS_PROXY(proxytype)) {
-      failf(data, "Unsupported proxy \'%s\', libcurl is built without the "
-            "HTTPS-proxy support.", proxy);
-      result = CURLE_NOT_BUILT_IN;
-      goto error;
-    }
-
-  sockstype =
-    proxytype == CURLPROXY_SOCKS5_HOSTNAME ||
-    proxytype == CURLPROXY_SOCKS5 ||
-    proxytype == CURLPROXY_SOCKS4A ||
-    proxytype == CURLPROXY_SOCKS4;
-
-  proxyinfo = sockstype ? &conn->socks_proxy : &conn->http_proxy;
-  proxyinfo->proxytype = (unsigned char)proxytype;
-
-  /* Is there a username and password given in this proxy url? */
-  uc = curl_url_get(uhp, CURLUPART_USER, &proxyuser, CURLU_URLDECODE);
-  if(uc && (uc != CURLUE_NO_USER))
-    goto error;
-  uc = curl_url_get(uhp, CURLUPART_PASSWORD, &proxypasswd, CURLU_URLDECODE);
-  if(uc && (uc != CURLUE_NO_PASSWORD))
-    goto error;
-
-  if(proxyuser || proxypasswd) {
-    Curl_safefree(proxyinfo->user);
-    proxyinfo->user = proxyuser;
-    result = Curl_setstropt(&data->state.aptr.proxyuser, proxyuser);
-    proxyuser = NULL;
-    if(result)
-      goto error;
-    Curl_safefree(proxyinfo->passwd);
-    if(!proxypasswd) {
-      proxypasswd = strdup("");
-      if(!proxypasswd) {
-        result = CURLE_OUT_OF_MEMORY;
-        goto error;
-      }
-    }
-    proxyinfo->passwd = proxypasswd;
-    result = Curl_setstropt(&data->state.aptr.proxypasswd, proxypasswd);
-    proxypasswd = NULL;
-    if(result)
-      goto error;
-    conn->bits.proxy_user_passwd = TRUE; /* enable it */
-  }
-
-  (void)curl_url_get(uhp, CURLUPART_PORT, &portptr, 0);
-
-  if(portptr) {
-    port = (int)strtol(portptr, NULL, 10);
-    free(portptr);
-  }
-  else {
-    if(data->set.proxyport)
-      /* None given in the proxy string, then get the default one if it is
-         given */
-      port = (int)data->set.proxyport;
-    else {
-      if(IS_HTTPS_PROXY(proxytype))
-        port = CURL_DEFAULT_HTTPS_PROXY_PORT;
-      else
-        port = CURL_DEFAULT_PROXY_PORT;
-    }
-  }
-  if(port >= 0) {
-    proxyinfo->port = port;
-    if(conn->port < 0 || sockstype || !conn->socks_proxy.host.rawalloc)
-      conn->port = port;
-  }
-
-  /* now, clone the proxy host name */
-  uc = curl_url_get(uhp, CURLUPART_HOST, &host, CURLU_URLDECODE);
-  if(uc) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-#ifdef USE_UNIX_SOCKETS
-  if(sockstype && strcasecompare(UNIX_SOCKET_PREFIX, host)) {
-    uc = curl_url_get(uhp, CURLUPART_PATH, &path, CURLU_URLDECODE);
-    if(uc) {
-      result = CURLE_OUT_OF_MEMORY;
-      goto error;
-    }
-    /* path will be "/", if no path was found */
-    if(strcmp("/", path)) {
-      is_unix_proxy = TRUE;
-      free(host);
-      host = aprintf(UNIX_SOCKET_PREFIX"%s", path);
-      if(!host) {
-        result = CURLE_OUT_OF_MEMORY;
-        goto error;
-      }
-      Curl_safefree(proxyinfo->host.rawalloc);
-      proxyinfo->host.rawalloc = host;
-      proxyinfo->host.name = host;
-      host = NULL;
-    }
-  }
-
-  if(!is_unix_proxy) {
-#endif
-    Curl_safefree(proxyinfo->host.rawalloc);
-    proxyinfo->host.rawalloc = host;
-    if(host[0] == '[') {
-      /* this is a numerical IPv6, strip off the brackets */
-      size_t len = strlen(host);
-      host[len-1] = 0; /* clear the trailing bracket */
-      host++;
-      zonefrom_url(uhp, data, conn);
-    }
-    proxyinfo->host.name = host;
-    host = NULL;
-#ifdef USE_UNIX_SOCKETS
-  }
-#endif
-
-error:
-  free(proxyuser);
-  free(proxypasswd);
-  free(host);
-  free(scheme);
-#ifdef USE_UNIX_SOCKETS
-  free(path);
-#endif
-  curl_url_cleanup(uhp);
-  return result;
-}
-
-/*
- * Extract the user and password from the authentication string
- */
-static CURLcode parse_proxy_auth(struct Curl_easy *data,
-                                 struct connectdata *conn)
-{
-  const char *proxyuser = data->state.aptr.proxyuser ?
-    data->state.aptr.proxyuser : "";
-  const char *proxypasswd = data->state.aptr.proxypasswd ?
-    data->state.aptr.proxypasswd : "";
-  CURLcode result = Curl_urldecode(proxyuser, 0, &conn->http_proxy.user, NULL,
-                                   REJECT_ZERO);
-  if(!result)
-    result = Curl_setstropt(&data->state.aptr.proxyuser,
-                            conn->http_proxy.user);
-  if(!result)
-    result = Curl_urldecode(proxypasswd, 0, &conn->http_proxy.passwd,
-                            NULL, REJECT_ZERO);
-  if(!result)
-    result = Curl_setstropt(&data->state.aptr.proxypasswd,
-                            conn->http_proxy.passwd);
-  return result;
-}
-
-/* create_conn helper to parse and init proxy values. to be called after unix
-   socket init but before any proxy vars are evaluated. */
-static CURLcode create_conn_helper_init_proxy(struct Curl_easy *data,
-                                              struct connectdata *conn)
-{
-  char *proxy = NULL;
-  char *socksproxy = NULL;
-  char *no_proxy = NULL;
-  CURLcode result = CURLE_OK;
-  bool spacesep = FALSE;
-
-  /*************************************************************
-   * Extract the user and password from the authentication string
-   *************************************************************/
-  if(conn->bits.proxy_user_passwd) {
-    result = parse_proxy_auth(data, conn);
-    if(result)
-      goto out;
-  }
-
-  /*************************************************************
-   * Detect what (if any) proxy to use
-   *************************************************************/
-  if(data->set.str[STRING_PROXY]) {
-    proxy = strdup(data->set.str[STRING_PROXY]);
-    /* if global proxy is set, this is it */
-    if(!proxy) {
-      failf(data, "memory shortage");
-      result = CURLE_OUT_OF_MEMORY;
-      goto out;
-    }
-  }
-
-  if(data->set.str[STRING_PRE_PROXY]) {
-    socksproxy = strdup(data->set.str[STRING_PRE_PROXY]);
-    /* if global socks proxy is set, this is it */
-    if(!socksproxy) {
-      failf(data, "memory shortage");
-      result = CURLE_OUT_OF_MEMORY;
-      goto out;
-    }
-  }
-
-  if(!data->set.str[STRING_NOPROXY]) {
-    const char *p = "no_proxy";
-    no_proxy = curl_getenv(p);
-    if(!no_proxy) {
-      p = "NO_PROXY";
-      no_proxy = curl_getenv(p);
-    }
-    if(no_proxy) {
-      infof(data, "Uses proxy env variable %s == '%s'", p, no_proxy);
-    }
-  }
-
-  if(Curl_check_noproxy(conn->host.name, data->set.str[STRING_NOPROXY] ?
-                        data->set.str[STRING_NOPROXY] : no_proxy,
-                        &spacesep)) {
-    Curl_safefree(proxy);
-    Curl_safefree(socksproxy);
-  }
-#ifndef CURL_DISABLE_HTTP
-  else if(!proxy && !socksproxy)
-    /* if the host is not in the noproxy list, detect proxy. */
-    proxy = detect_proxy(data, conn);
-#endif /* CURL_DISABLE_HTTP */
-  if(spacesep)
-    infof(data, "space-separated NOPROXY patterns are deprecated");
-
-  Curl_safefree(no_proxy);
-
-#ifdef USE_UNIX_SOCKETS
-  /* For the time being do not mix proxy and unix domain sockets. See #1274 */
-  if(proxy && conn->unix_domain_socket) {
-    free(proxy);
-    proxy = NULL;
-  }
-#endif
-
-  if(proxy && (!*proxy || (conn->handler->flags & PROTOPT_NONETWORK))) {
-    free(proxy);  /* Don't bother with an empty proxy string or if the
-                     protocol doesn't work with network */
-    proxy = NULL;
-  }
-  if(socksproxy && (!*socksproxy ||
-                    (conn->handler->flags & PROTOPT_NONETWORK))) {
-    free(socksproxy);  /* Don't bother with an empty socks proxy string or if
-                          the protocol doesn't work with network */
-    socksproxy = NULL;
-  }
-
-  /***********************************************************************
-   * If this is supposed to use a proxy, we need to figure out the proxy host
-   * name, proxy type and port number, so that we can reuse an existing
-   * connection that may exist registered to the same proxy host.
-   ***********************************************************************/
-  if(proxy || socksproxy) {
-    curl_proxytype ptype = (curl_proxytype)conn->http_proxy.proxytype;
-    if(proxy) {
-      result = parse_proxy(data, conn, proxy, ptype);
-      Curl_safefree(proxy); /* parse_proxy copies the proxy string */
-      if(result)
-        goto out;
-    }
-
-    if(socksproxy) {
-      result = parse_proxy(data, conn, socksproxy, ptype);
-      /* parse_proxy copies the socks proxy string */
-      Curl_safefree(socksproxy);
-      if(result)
-        goto out;
-    }
-
-    if(conn->http_proxy.host.rawalloc) {
-#ifdef CURL_DISABLE_HTTP
-      /* asking for an HTTP proxy is a bit funny when HTTP is disabled... */
-      result = CURLE_UNSUPPORTED_PROTOCOL;
-      goto out;
-#else
-      /* force this connection's protocol to become HTTP if compatible */
-      if(!(conn->handler->protocol & PROTO_FAMILY_HTTP)) {
-        if((conn->handler->flags & PROTOPT_PROXY_AS_HTTP) &&
-           !conn->bits.tunnel_proxy)
-          conn->handler = &Curl_handler_http;
-        else
-          /* if not converting to HTTP over the proxy, enforce tunneling */
-          conn->bits.tunnel_proxy = TRUE;
-      }
-      conn->bits.httpproxy = TRUE;
-#endif
-    }
-    else {
-      conn->bits.httpproxy = FALSE; /* not an HTTP proxy */
-      conn->bits.tunnel_proxy = FALSE; /* no tunneling if not HTTP */
-    }
-
-    if(conn->socks_proxy.host.rawalloc) {
-      if(!conn->http_proxy.host.rawalloc) {
-        /* once a socks proxy */
-        if(!conn->socks_proxy.user) {
-          conn->socks_proxy.user = conn->http_proxy.user;
-          conn->http_proxy.user = NULL;
-          Curl_safefree(conn->socks_proxy.passwd);
-          conn->socks_proxy.passwd = conn->http_proxy.passwd;
-          conn->http_proxy.passwd = NULL;
-        }
-      }
-      conn->bits.socksproxy = TRUE;
-    }
-    else
-      conn->bits.socksproxy = FALSE; /* not a socks proxy */
-  }
-  else {
-    conn->bits.socksproxy = FALSE;
-    conn->bits.httpproxy = FALSE;
-  }
-  conn->bits.proxy = conn->bits.httpproxy || conn->bits.socksproxy;
-
-  if(!conn->bits.proxy) {
-    /* we aren't using the proxy after all... */
-    conn->bits.proxy = FALSE;
-    conn->bits.httpproxy = FALSE;
-    conn->bits.socksproxy = FALSE;
-    conn->bits.proxy_user_passwd = FALSE;
-    conn->bits.tunnel_proxy = FALSE;
-    /* CURLPROXY_HTTPS does not have its own flag in conn->bits, yet we need
-       to signal that CURLPROXY_HTTPS is not used for this connection */
-    conn->http_proxy.proxytype = CURLPROXY_HTTP;
-  }
-
-out:
-
-  free(socksproxy);
-  free(proxy);
-  return result;
-}
-#endif /* CURL_DISABLE_PROXY */
-
 /*
  * Curl_parse_login_details()
  *
- * This is used to parse a login string for user name, password and options in
+ * This is used to parse a login string for username, password and options in
  * the following formats:
  *
  *   user
@@ -2554,14 +1725,15 @@ out:
  *
  * Parameters:
  *
- * login    [in]     - The login string.
- * len      [in]     - The length of the login string.
- * userp    [in/out] - The address where a pointer to newly allocated memory
+ * login    [in]     - login string.
+ * len      [in]     - length of the login string.
+ * userp    [in/out] - address where a pointer to newly allocated memory
  *                     holding the user will be stored upon completion.
- * passwdp  [in/out] - The address where a pointer to newly allocated memory
+ * passwdp  [in/out] - address where a pointer to newly allocated memory
  *                     holding the password will be stored upon completion.
- * optionsp [in/out] - The address where a pointer to newly allocated memory
- *                     holding the options will be stored upon completion.
+ * optionsp [in/out] - OPTIONAL address where a pointer to newly allocated
+ *                     memory holding the options will be stored upon
+ *                     completion.
  *
  * Returns CURLE_OK on success.
  */
@@ -2569,19 +1741,19 @@ CURLcode Curl_parse_login_details(const char *login, const size_t len,
                                   char **userp, char **passwdp,
                                   char **optionsp)
 {
-  CURLcode result = CURLE_OK;
   char *ubuf = NULL;
   char *pbuf = NULL;
-  char *obuf = NULL;
   const char *psep = NULL;
   const char *osep = NULL;
   size_t ulen;
   size_t plen;
   size_t olen;
 
+  DEBUGASSERT(userp);
+  DEBUGASSERT(passwdp);
+
   /* Attempt to find the password separator */
-  if(passwdp)
-    psep = memchr(login, ':', len);
+  psep = memchr(login, ':', len);
 
   /* Attempt to find the options separator */
   if(optionsp)
@@ -2593,335 +1765,65 @@ CURLcode Curl_parse_login_details(const char *login, const size_t len,
           (osep ? (size_t)(osep - login) : len));
   plen = (psep ?
           (osep && osep > psep ? (size_t)(osep - psep) :
-                                 (size_t)(login + len - psep)) - 1 : 0);
+           (size_t)(login + len - psep)) - 1 : 0);
   olen = (osep ?
           (psep && psep > osep ? (size_t)(psep - osep) :
-                                 (size_t)(login + len - osep)) - 1 : 0);
+           (size_t)(login + len - osep)) - 1 : 0);
 
-  /* Allocate the user portion buffer, which can be zero length */
-  if(userp) {
-    ubuf = malloc(ulen + 1);
-    if(!ubuf)
-      result = CURLE_OUT_OF_MEMORY;
-  }
+  /* Clone the user portion buffer, which can be zero length */
+  ubuf = curlx_memdup0(login, ulen);
+  if(!ubuf)
+    goto error;
 
-  /* Allocate the password portion buffer */
-  if(!result && passwdp && psep) {
-    pbuf = malloc(plen + 1);
-    if(!pbuf) {
-      free(ubuf);
-      result = CURLE_OUT_OF_MEMORY;
-    }
+  /* Clone the password portion buffer */
+  if(psep) {
+    pbuf = curlx_memdup0(&psep[1], plen);
+    if(!pbuf)
+      goto error;
   }
 
   /* Allocate the options portion buffer */
-  if(!result && optionsp && olen) {
-    obuf = malloc(olen + 1);
-    if(!obuf) {
-      free(pbuf);
-      free(ubuf);
-      result = CURLE_OUT_OF_MEMORY;
-    }
-  }
-
-  if(!result) {
-    /* Store the user portion if necessary */
-    if(ubuf) {
-      memcpy(ubuf, login, ulen);
-      ubuf[ulen] = '\0';
-      Curl_safefree(*userp);
-      *userp = ubuf;
-    }
-
-    /* Store the password portion if necessary */
-    if(pbuf) {
-      memcpy(pbuf, psep + 1, plen);
-      pbuf[plen] = '\0';
-      Curl_safefree(*passwdp);
-      *passwdp = pbuf;
-    }
-
-    /* Store the options portion if necessary */
-    if(obuf) {
-      memcpy(obuf, osep + 1, olen);
-      obuf[olen] = '\0';
-      Curl_safefree(*optionsp);
-      *optionsp = obuf;
-    }
-  }
-
-  return result;
-}
-
-/*************************************************************
- * Figure out the remote port number and fix it in the URL
- *
- * No matter if we use a proxy or not, we have to figure out the remote
- * port number of various reasons.
- *
- * The port number embedded in the URL is replaced, if necessary.
- *************************************************************/
-static CURLcode parse_remote_port(struct Curl_easy *data,
-                                  struct connectdata *conn)
-{
-
-  if(data->set.use_port && data->state.allow_port) {
-    /* if set, we use this instead of the port possibly given in the URL */
-    char portbuf[16];
-    CURLUcode uc;
-    conn->remote_port = data->set.use_port;
-    msnprintf(portbuf, sizeof(portbuf), "%d", conn->remote_port);
-    uc = curl_url_set(data->state.uh, CURLUPART_PORT, portbuf, 0);
-    if(uc)
-      return CURLE_OUT_OF_MEMORY;
-  }
-
-  return CURLE_OK;
-}
-
-/*
- * Override the login details from the URL with that in the CURLOPT_USERPWD
- * option or a .netrc file, if applicable.
- */
-static CURLcode override_login(struct Curl_easy *data,
-                               struct connectdata *conn)
-{
-  CURLUcode uc;
-  char **userp = &conn->user;
-  char **passwdp = &conn->passwd;
-  char **optionsp = &conn->options;
-
-  if(data->set.str[STRING_OPTIONS]) {
-    free(*optionsp);
-    *optionsp = strdup(data->set.str[STRING_OPTIONS]);
-    if(!*optionsp)
-      return CURLE_OUT_OF_MEMORY;
-  }
-
-#ifndef CURL_DISABLE_NETRC
-  if(data->set.use_netrc == CURL_NETRC_REQUIRED) {
-    Curl_safefree(*userp);
-    Curl_safefree(*passwdp);
-  }
-  conn->bits.netrc = FALSE;
-  if(data->set.use_netrc && !data->set.str[STRING_USERNAME]) {
-    int ret;
-    bool url_provided = FALSE;
-
-    if(data->state.aptr.user) {
-      /* there was a user name in the URL. Use the URL decoded version */
-      userp = &data->state.aptr.user;
-      url_provided = TRUE;
-    }
-
-    ret = Curl_parsenetrc(conn->host.name,
-                          userp, passwdp,
-                          data->set.str[STRING_NETRC_FILE]);
-    if(ret > 0) {
-      infof(data, "Couldn't find host %s in the %s file; using defaults",
-            conn->host.name, data->set.str[STRING_NETRC_FILE]);
-    }
-    else if(ret < 0) {
-      failf(data, ".netrc parser error");
-      return CURLE_READ_ERROR;
-    }
-    else {
-      /* set bits.netrc TRUE to remember that we got the name from a .netrc
-         file, so that it is safe to use even if we followed a Location: to a
-         different host or similar. */
-      conn->bits.netrc = TRUE;
-    }
-    if(url_provided) {
-      Curl_safefree(conn->user);
-      conn->user = strdup(*userp);
-      if(!conn->user)
-        return CURLE_OUT_OF_MEMORY;
-    }
-    /* no user was set but a password, set a blank user */
-    if(!*userp && *passwdp) {
-      *userp = strdup("");
-      if(!*userp)
-        return CURLE_OUT_OF_MEMORY;
-    }
-  }
-#endif
-
-  /* for updated strings, we update them in the URL */
-  if(*userp) {
-    CURLcode result;
-    if(data->state.aptr.user != *userp) {
-      /* nothing to do then */
-      result = Curl_setstropt(&data->state.aptr.user, *userp);
-      if(result)
-        return result;
-    }
-  }
-  if(data->state.aptr.user) {
-    uc = curl_url_set(data->state.uh, CURLUPART_USER, data->state.aptr.user,
-                      CURLU_URLENCODE);
-    if(uc)
-      return Curl_uc_to_curlcode(uc);
-    if(!*userp) {
-      *userp = strdup(data->state.aptr.user);
-      if(!*userp)
-        return CURLE_OUT_OF_MEMORY;
-    }
-  }
-  if(*passwdp) {
-    CURLcode result = Curl_setstropt(&data->state.aptr.passwd, *passwdp);
-    if(result)
-      return result;
-  }
-  if(data->state.aptr.passwd) {
-    uc = curl_url_set(data->state.uh, CURLUPART_PASSWORD,
-                      data->state.aptr.passwd, CURLU_URLENCODE);
-    if(uc)
-      return Curl_uc_to_curlcode(uc);
-    if(!*passwdp) {
-      *passwdp = strdup(data->state.aptr.passwd);
-      if(!*passwdp)
-        return CURLE_OUT_OF_MEMORY;
-    }
-  }
-
-  return CURLE_OK;
-}
-
-/*
- * Set the login details so they're available in the connection
- */
-static CURLcode set_login(struct Curl_easy *data,
-                          struct connectdata *conn)
-{
-  CURLcode result = CURLE_OK;
-  const char *setuser = CURL_DEFAULT_USER;
-  const char *setpasswd = CURL_DEFAULT_PASSWORD;
-
-  /* If our protocol needs a password and we have none, use the defaults */
-  if((conn->handler->flags & PROTOPT_NEEDSPWD) && !data->state.aptr.user)
-    ;
-  else {
-    setuser = "";
-    setpasswd = "";
-  }
-  /* Store the default user */
-  if(!conn->user) {
-    conn->user = strdup(setuser);
-    if(!conn->user)
-      return CURLE_OUT_OF_MEMORY;
-  }
-
-  /* Store the default password */
-  if(!conn->passwd) {
-    conn->passwd = strdup(setpasswd);
-    if(!conn->passwd)
-      result = CURLE_OUT_OF_MEMORY;
-  }
-
-  return result;
-}
-
-/*
- * Parses a "host:port" string to connect to.
- * The hostname and the port may be empty; in this case, NULL is returned for
- * the hostname and -1 for the port.
- */
-static CURLcode parse_connect_to_host_port(struct Curl_easy *data,
-                                           const char *host,
-                                           char **hostname_result,
-                                           int *port_result)
-{
-  char *host_dup;
-  char *hostptr;
-  char *host_portno;
-  char *portptr;
-  int port = -1;
-  CURLcode result = CURLE_OK;
-
-#if defined(CURL_DISABLE_VERBOSE_STRINGS)
-  (void) data;
-#endif
-
-  *hostname_result = NULL;
-  *port_result = -1;
-
-  if(!host || !*host)
-    return CURLE_OK;
-
-  host_dup = strdup(host);
-  if(!host_dup)
-    return CURLE_OUT_OF_MEMORY;
-
-  hostptr = host_dup;
-
-  /* start scanning for port number at this point */
-  portptr = hostptr;
-
-  /* detect and extract RFC6874-style IPv6-addresses */
-  if(*hostptr == '[') {
-#ifdef ENABLE_IPV6
-    char *ptr = ++hostptr; /* advance beyond the initial bracket */
-    while(*ptr && (ISXDIGIT(*ptr) || (*ptr == ':') || (*ptr == '.')))
-      ptr++;
-    if(*ptr == '%') {
-      /* There might be a zone identifier */
-      if(strncmp("%25", ptr, 3))
-        infof(data, "Please URL encode %% as %%25, see RFC 6874.");
-      ptr++;
-      /* Allow unreserved characters as defined in RFC 3986 */
-      while(*ptr && (ISALPHA(*ptr) || ISXDIGIT(*ptr) || (*ptr == '-') ||
-                     (*ptr == '.') || (*ptr == '_') || (*ptr == '~')))
-        ptr++;
-    }
-    if(*ptr == ']')
-      /* yeps, it ended nicely with a bracket as well */
-      *ptr++ = '\0';
-    else
-      infof(data, "Invalid IPv6 address format");
-    portptr = ptr;
-    /* Note that if this didn't end with a bracket, we still advanced the
-     * hostptr first, but I can't see anything wrong with that as no host
-     * name nor a numeric can legally start with a bracket.
-     */
-#else
-    failf(data, "Use of IPv6 in *_CONNECT_TO without IPv6 support built-in");
-    result = CURLE_NOT_BUILT_IN;
-    goto error;
-#endif
-  }
-
-  /* Get port number off server.com:1080 */
-  host_portno = strchr(portptr, ':');
-  if(host_portno) {
-    char *endp = NULL;
-    *host_portno = '\0'; /* cut off number from host name */
-    host_portno++;
-    if(*host_portno) {
-      long portparse = strtol(host_portno, &endp, 10);
-      if((endp && *endp) || (portparse < 0) || (portparse > 65535)) {
-        failf(data, "No valid port number in connect to host string (%s)",
-              host_portno);
-        result = CURLE_SETOPT_OPTION_SYNTAX;
+  if(optionsp) {
+    char *obuf = NULL;
+    if(olen) {
+      obuf = curlx_memdup0(&osep[1], olen);
+      if(!obuf)
         goto error;
-      }
-      else
-        port = (int)portparse; /* we know it will fit */
     }
+    *optionsp = obuf;
   }
-
-  /* now, clone the cleaned host name */
-  DEBUGASSERT(hostptr);
-  *hostname_result = strdup(hostptr);
-  if(!*hostname_result) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto error;
-  }
-
-  *port_result = port;
-
+  *userp = ubuf;
+  *passwdp = pbuf;
+  return CURLE_OK;
 error:
-  free(host_dup);
-  return result;
+  curlx_free(ubuf);
+  curlx_free(pbuf);
+  return CURLE_OUT_OF_MEMORY;
+}
+
+/*
+ * Set the login details so they are available in the connection
+ */
+static CURLcode url_set_conn_login(struct Curl_easy *data,
+                                   struct connectdata *conn)
+{
+  /* If our protocol needs a password and we have none, use the defaults */
+  if((conn->scheme->flags & PROTOPT_NEEDSPWD) && !conn->creds) {
+    Curl_peer_link(&conn->creds_origin, data->state.origin);
+    if(data->state.creds)
+      Curl_creds_link(&conn->creds, data->state.creds);
+    else
+      return Curl_creds_create(CURL_DEFAULT_USER, CURL_DEFAULT_PASSWORD,
+                               NULL, NULL, NULL, CREDS_NONE, &conn->creds);
+  }
+  else if(!(conn->scheme->flags & PROTOPT_CREDSPERREQUEST)) {
+    /* for protocols that do not handle credentials per request,
+     * the connection credentials are set by the initial transfer. */
+    Curl_peer_link(&conn->creds_origin, data->state.origin);
+    Curl_creds_link(&conn->creds, data->state.creds);
+  }
+
+  return CURLE_OK;
 }
 
 /*
@@ -2929,18 +1831,16 @@ error:
  * "HOST:PORT:CONNECT-TO-HOST:CONNECT-TO-PORT".
  */
 static CURLcode parse_connect_to_string(struct Curl_easy *data,
-                                        struct connectdata *conn,
-                                        const char *conn_to_host,
-                                        char **host_result,
-                                        int *port_result)
+                                        const struct Curl_peer *dest,
+                                        const char *conn_to_line,
+                                        struct Curl_peer **pvia_dest)
 {
   CURLcode result = CURLE_OK;
-  const char *ptr = conn_to_host;
-  int host_match = FALSE;
-  int port_match = FALSE;
+  const char *ptr = conn_to_line;
+  bool host_match = FALSE;
+  bool port_match = FALSE;
 
-  *host_result = NULL;
-  *port_result = -1;
+  *pvia_dest = NULL;
 
   if(*ptr == ':') {
     /* an empty hostname always matches */
@@ -2948,19 +1848,14 @@ static CURLcode parse_connect_to_string(struct Curl_easy *data,
     ptr++;
   }
   else {
-    /* check whether the URL's hostname matches */
-    size_t hostname_to_match_len;
-    char *hostname_to_match = aprintf("%s%s%s",
-                                      conn->bits.ipv6_ip ? "[" : "",
-                                      conn->host.name,
-                                      conn->bits.ipv6_ip ? "]" : "");
-    if(!hostname_to_match)
-      return CURLE_OUT_OF_MEMORY;
-    hostname_to_match_len = strlen(hostname_to_match);
-    host_match = strncasecompare(ptr, hostname_to_match,
-                                 hostname_to_match_len);
-    free(hostname_to_match);
-    ptr += hostname_to_match_len;
+    /* check whether the URL's hostname matches. Use the URL hostname
+     * when it was an IPv6 address. Otherwise use the connection's hostname
+     * that has IDN conversion. */
+    const char *hostname_to_match = (dest->user_hostname[0] == '[') ?
+      dest->user_hostname : dest->hostname;
+    size_t hlen = strlen(hostname_to_match);
+    host_match = curl_strnequal(ptr, hostname_to_match, hlen);
+    ptr += hlen;
 
     host_match = host_match && *ptr == ':';
     ptr++;
@@ -2974,75 +1869,50 @@ static CURLcode parse_connect_to_string(struct Curl_easy *data,
     }
     else {
       /* check whether the URL's port matches */
-      char *ptr_next = strchr(ptr, ':');
+      const char *ptr_next = strchr(ptr, ':');
       if(ptr_next) {
-        char *endp = NULL;
-        long port_to_match = strtol(ptr, &endp, 10);
-        if((endp == ptr_next) && (port_to_match == conn->remote_port)) {
+        curl_off_t port_to_match;
+        if(!curlx_str_number(&ptr, &port_to_match, 0xffff) &&
+           ((uint16_t)port_to_match == dest->port)) {
           port_match = TRUE;
-          ptr = ptr_next + 1;
         }
+        ptr = ptr_next + 1;
       }
     }
   }
 
-  if(host_match && port_match) {
-    /* parse the hostname and port to connect to */
-    result = parse_connect_to_host_port(data, ptr, host_result, port_result);
-  }
+  if(host_match && port_match && ptr && *ptr)
+    result = Curl_peer_from_connect_to(data, dest, ptr, pvia_dest);
 
   return result;
 }
 
-/*
- * Processes all strings in the "connect to" slist, and uses the "connect
- * to host" and "connect to port" of the first string that matches.
- */
-static CURLcode parse_connect_to_slist(struct Curl_easy *data,
-                                       struct connectdata *conn,
-                                       struct curl_slist *conn_to_host)
+/* With `conn->origin` known, determine if we should talk to that
+ * directly or via another peer. This is the result of inspecting
+ * the "connect to" slist and "alt-svc" settings. */
+static CURLcode url_set_conn_peer(struct Curl_easy *data,
+                                  struct connectdata *conn)
 {
   CURLcode result = CURLE_OK;
-  char *host = NULL;
-  int port = -1;
+  const struct Curl_peer *origin = conn->origin;
+  struct Curl_peer *via_peer = NULL;
+  struct curl_slist *conn_to_entry = data->set.connect_to;
 
-  while(conn_to_host && !host && port == -1) {
-    result = parse_connect_to_string(data, conn, conn_to_host->data,
-                                     &host, &port);
+  DEBUGASSERT(!conn->via_peer);
+  Curl_peer_unlink(&conn->via_peer);
+
+  while(conn_to_entry && !via_peer) {
+    result = parse_connect_to_string(data, origin, conn_to_entry->data,
+                                     &via_peer);
     if(result)
       return result;
-
-    if(host && *host) {
-      conn->conn_to_host.rawalloc = host;
-      conn->conn_to_host.name = host;
-      conn->bits.conn_to_host = TRUE;
-
-      infof(data, "Connecting to hostname: %s", host);
-    }
-    else {
-      /* no "connect to host" */
-      conn->bits.conn_to_host = FALSE;
-      Curl_safefree(host);
-    }
-
-    if(port >= 0) {
-      conn->conn_to_port = port;
-      conn->bits.conn_to_port = TRUE;
-      infof(data, "Connecting to port: %d", port);
-    }
-    else {
-      /* no "connect to port" */
-      conn->bits.conn_to_port = FALSE;
-      port = -1;
-    }
-
-    conn_to_host = conn_to_host->next;
+    conn_to_entry = conn_to_entry->next;
   }
 
 #ifndef CURL_DISABLE_ALTSVC
-  if(data->asi && !host && (port == -1) &&
-     ((conn->handler->protocol == CURLPROTO_HTTPS) ||
-#ifdef CURLDEBUG
+  if(data->asi && !via_peer &&
+     ((conn->scheme->protocol == CURLPROTO_HTTPS) ||
+#ifdef DEBUGBUILD
       /* allow debug builds to circumvent the HTTPS restriction */
       getenv("CURL_ALTSVC_HTTP")
 #else
@@ -3050,62 +1920,104 @@ static CURLcode parse_connect_to_slist(struct Curl_easy *data,
 #endif
        )) {
     /* no connect_to match, try alt-svc! */
-    enum alpnid srcalpnid;
-    bool hit;
-    struct altsvc *as;
-    const int allowed_versions = ( ALPN_h1
-#ifdef USE_HTTP2
-                                   | ALPN_h2
-#endif
-#ifdef ENABLE_QUIC
-                                   | ALPN_h3
-#endif
-      ) & data->asi->flags;
+    enum alpnid srcalpnid = ALPN_none;
+    bool hit = FALSE;
+    struct altsvc *as = NULL;
+    int allowed_alpns = ALPN_none;
+    struct http_negotiation *neg = &data->state.http_neg;
+    bool same_dest = FALSE;
 
-    host = conn->host.rawalloc;
-#ifdef USE_HTTP2
-    /* with h2 support, check that first */
-    srcalpnid = ALPN_h2;
-    hit = Curl_altsvc_lookup(data->asi,
-                             srcalpnid, host, conn->remote_port, /* from */
-                             &as /* to */,
-                             allowed_versions);
-    if(!hit)
+    DEBUGF(infof(data, "Alt-svc check wanted=%x, allowed=%x",
+                 neg->wanted, neg->allowed));
+#ifdef USE_HTTP3
+    if(neg->allowed & CURL_HTTP_V3x)
+      allowed_alpns |= ALPN_h3;
 #endif
-    {
+#ifdef USE_HTTP2
+    if(neg->allowed & CURL_HTTP_V2x)
+      allowed_alpns |= ALPN_h2;
+#endif
+    if(neg->allowed & CURL_HTTP_V1x)
+      allowed_alpns |= ALPN_h1;
+    allowed_alpns &= (int)data->asi->flags;
+
+    DEBUGF(infof(data, "check Alt-Svc for host '%s'", origin->hostname));
+#ifdef USE_HTTP3
+    if(!hit && (neg->wanted & CURL_HTTP_V3x)) {
+      srcalpnid = ALPN_h3;
+      hit = Curl_altsvc_lookup(data->asi,
+                               ALPN_h3, origin->hostname,
+                               origin->port, /* from */
+                               &as /* to */,
+                               allowed_alpns, &same_dest);
+    }
+#endif
+#ifdef USE_HTTP2
+    if(!hit && (neg->wanted & CURL_HTTP_V2x) &&
+       !neg->h2_prior_knowledge) {
+      srcalpnid = ALPN_h2;
+      hit = Curl_altsvc_lookup(data->asi,
+                               ALPN_h2, origin->hostname,
+                               origin->port, /* from */
+                               &as /* to */,
+                               allowed_alpns, &same_dest);
+    }
+#endif
+    if(!hit && (neg->wanted & CURL_HTTP_V1x) &&
+       !neg->only_10) {
       srcalpnid = ALPN_h1;
       hit = Curl_altsvc_lookup(data->asi,
-                               srcalpnid, host, conn->remote_port, /* from */
+                               ALPN_h1, origin->hostname,
+                               origin->port, /* from */
                                &as /* to */,
-                               allowed_versions);
+                               allowed_alpns, &same_dest);
     }
-    if(hit) {
-      char *hostd = strdup((char *)as->dst.host);
-      if(!hostd)
-        return CURLE_OUT_OF_MEMORY;
-      conn->conn_to_host.rawalloc = hostd;
-      conn->conn_to_host.name = hostd;
-      conn->bits.conn_to_host = TRUE;
-      conn->conn_to_port = as->dst.port;
-      conn->bits.conn_to_port = TRUE;
+
+    if(hit && same_dest) {
+      /* same destination, but more HTTPS version options */
+      switch(as->dst.alpnid) {
+      case ALPN_h1:
+        neg->wanted |= CURL_HTTP_V1x;
+        neg->preferred = CURL_HTTP_V1x;
+        break;
+      case ALPN_h2:
+        neg->wanted |= CURL_HTTP_V2x;
+        neg->preferred = CURL_HTTP_V2x;
+        break;
+      case ALPN_h3:
+        neg->wanted |= CURL_HTTP_V3x;
+        neg->preferred = CURL_HTTP_V3x;
+        break;
+      default: /* should not be possible */
+        break;
+      }
+    }
+    else if(hit) {
+      result = Curl_peer_create(data, conn->origin->scheme,
+                                as->dst.host, as->dst.port,
+                                &via_peer);
+      if(result)
+        return result;
+      infof(data, "Alt-svc connecting from [%s]%s:%u to [%s]%s:%u",
+            Curl_alpnid2str(srcalpnid), origin->hostname, origin->port,
+            Curl_alpnid2str(as->dst.alpnid),
+            via_peer->hostname, via_peer->port);
       conn->bits.altused = TRUE;
-      infof(data, "Alt-svc connecting from [%s]%s:%d to [%s]%s:%d",
-            Curl_alpnid2str(srcalpnid), host, conn->remote_port,
-            Curl_alpnid2str(as->dst.alpnid), hostd, as->dst.port);
       if(srcalpnid != as->dst.alpnid) {
         /* protocol version switch */
         switch(as->dst.alpnid) {
         case ALPN_h1:
-          conn->httpversion = 11;
+          neg->wanted = neg->allowed = CURL_HTTP_V1x;
+          neg->only_10 = FALSE;
           break;
         case ALPN_h2:
-          conn->httpversion = 20;
+          neg->wanted = neg->allowed = CURL_HTTP_V2x;
           break;
         case ALPN_h3:
-          conn->transport = TRNSPRT_QUIC;
-          conn->httpversion = 30;
+          conn->transport_wanted = TRNSPRT_QUIC;
+          neg->wanted = neg->allowed = CURL_HTTP_V3x;
           break;
-        default: /* shouldn't be possible */
+        default: /* should not be possible */
           break;
         }
       }
@@ -3113,687 +2025,459 @@ static CURLcode parse_connect_to_slist(struct Curl_easy *data,
   }
 #endif
 
+  if(via_peer)
+    conn->via_peer = via_peer;
+
   return result;
 }
 
-#ifdef USE_UNIX_SOCKETS
-static CURLcode resolve_unix(struct Curl_easy *data,
-                             struct connectdata *conn,
-                             char *unix_path)
-{
-  struct Curl_dns_entry *hostaddr = NULL;
-  bool longpath = FALSE;
-
-  DEBUGASSERT(unix_path);
-  DEBUGASSERT(conn->dns_entry == NULL);
-
-  /* Unix domain sockets are local. The host gets ignored, just use the
-   * specified domain socket address. Do not cache "DNS entries". There is
-   * no DNS involved and we already have the filesystem path available. */
-  hostaddr = calloc(1, sizeof(struct Curl_dns_entry));
-  if(!hostaddr)
-    return CURLE_OUT_OF_MEMORY;
-
-  hostaddr->addr = Curl_unix2addr(unix_path, &longpath,
-                                  conn->bits.abstract_unix_socket);
-  if(!hostaddr->addr) {
-    if(longpath)
-      /* Long paths are not supported for now */
-      failf(data, "Unix socket path too long: '%s'", unix_path);
-    free(hostaddr);
-    return longpath ? CURLE_COULDNT_RESOLVE_HOST : CURLE_OUT_OF_MEMORY;
-  }
-
-  hostaddr->inuse++;
-  conn->dns_entry = hostaddr;
-  return CURLE_OK;
-}
-#endif
-
-#ifndef CURL_DISABLE_PROXY
-static CURLcode resolve_proxy(struct Curl_easy *data,
-                              struct connectdata *conn,
-                              bool *async)
-{
-  struct Curl_dns_entry *hostaddr = NULL;
-  struct hostname *host;
-  timediff_t timeout_ms = Curl_timeleft(data, NULL, TRUE);
-  int rc;
-
-  DEBUGASSERT(conn->dns_entry == NULL);
-
-  host = conn->bits.socksproxy ? &conn->socks_proxy.host :
-    &conn->http_proxy.host;
-
-  conn->hostname_resolve = strdup(host->name);
-  if(!conn->hostname_resolve)
-    return CURLE_OUT_OF_MEMORY;
-
-  rc = Curl_resolv_timeout(data, conn->hostname_resolve, (int)conn->port,
-                           &hostaddr, timeout_ms);
-  conn->dns_entry = hostaddr;
-  if(rc == CURLRESOLV_PENDING)
-    *async = TRUE;
-  else if(rc == CURLRESOLV_TIMEDOUT)
-    return CURLE_OPERATION_TIMEDOUT;
-  else if(!hostaddr) {
-    failf(data, "Couldn't resolve proxy '%s'", host->dispname);
-    return CURLE_COULDNT_RESOLVE_PROXY;
-  }
-
-  return CURLE_OK;
-}
-#endif
-
-static CURLcode resolve_host(struct Curl_easy *data,
-                             struct connectdata *conn,
-                             bool *async)
-{
-  struct Curl_dns_entry *hostaddr = NULL;
-  struct hostname *connhost;
-  timediff_t timeout_ms = Curl_timeleft(data, NULL, TRUE);
-  int rc;
-
-  DEBUGASSERT(conn->dns_entry == NULL);
-
-  connhost = conn->bits.conn_to_host ? &conn->conn_to_host : &conn->host;
-
-  /* If not connecting via a proxy, extract the port from the URL, if it is
-   * there, thus overriding any defaults that might have been set above. */
-  conn->port = conn->bits.conn_to_port ? conn->conn_to_port :
-    conn->remote_port;
-
-  /* Resolve target host right on */
-  conn->hostname_resolve = strdup(connhost->name);
-  if(!conn->hostname_resolve)
-    return CURLE_OUT_OF_MEMORY;
-
-  rc = Curl_resolv_timeout(data, conn->hostname_resolve, (int)conn->port,
-                           &hostaddr, timeout_ms);
-  conn->dns_entry = hostaddr;
-  if(rc == CURLRESOLV_PENDING)
-    *async = TRUE;
-  else if(rc == CURLRESOLV_TIMEDOUT) {
-    failf(data, "Failed to resolve host '%s' with timeout after %ld ms",
-          connhost->dispname,
-          Curl_timediff(Curl_now(), data->progress.t_startsingle));
-    return CURLE_OPERATION_TIMEDOUT;
-  }
-  else if(!hostaddr) {
-    failf(data, "Could not resolve host: %s", connhost->dispname);
-    return CURLE_COULDNT_RESOLVE_HOST;
-  }
-
-  return CURLE_OK;
-}
-
-/* Perform a fresh resolve */
-static CURLcode resolve_fresh(struct Curl_easy *data,
-                              struct connectdata *conn,
-                              bool *async)
-{
-#ifdef USE_UNIX_SOCKETS
-  char *unix_path = conn->unix_domain_socket;
-
-#ifndef CURL_DISABLE_PROXY
-  if(!unix_path && conn->socks_proxy.host.name &&
-     !strncmp(UNIX_SOCKET_PREFIX"/",
-              conn->socks_proxy.host.name, sizeof(UNIX_SOCKET_PREFIX)))
-    unix_path = conn->socks_proxy.host.name + sizeof(UNIX_SOCKET_PREFIX) - 1;
-#endif
-
-  if(unix_path) {
-    conn->transport = TRNSPRT_UNIX;
-    return resolve_unix(data, conn, unix_path);
-  }
-#endif
-
-#ifndef CURL_DISABLE_PROXY
-  if(CONN_IS_PROXIED(conn))
-    return resolve_proxy(data, conn, async);
-#endif
-
-  return resolve_host(data, conn, async);
-}
-
-/*************************************************************
- * Resolve the address of the server or proxy
- *************************************************************/
-static CURLcode resolve_server(struct Curl_easy *data,
-                               struct connectdata *conn,
-                               bool *async)
-{
-  DEBUGASSERT(conn);
-  DEBUGASSERT(data);
-
-  /* Resolve the name of the server or proxy */
-  if(conn->bits.reuse) {
-    /* We're reusing the connection - no need to resolve anything, and
-       idnconvert_hostname() was called already in create_conn() for the reuse
-       case. */
-    *async = FALSE;
-    return CURLE_OK;
-  }
-
-  return resolve_fresh(data, conn, async);
-}
-
 /*
- * Cleanup the connection `temp`, just allocated for `data`, before using the
- * previously `existing` one for `data`.  All relevant info is copied over
- * and `temp` is freed.
+ * Adjust reused connection settings to the transfer/needle.
  */
-static void reuse_conn(struct Curl_easy *data,
-                       struct connectdata *temp,
-                       struct connectdata *existing)
+static void url_conn_reuse_adjust(struct Curl_easy *data,
+                                  struct connectdata *needle)
 {
-  /* get the user+password information from the temp struct since it may
-   * be new for this request even when we reuse an existing connection */
-  if(temp->user) {
-    /* use the new user name and password though */
-    Curl_safefree(existing->user);
-    Curl_safefree(existing->passwd);
-    existing->user = temp->user;
-    existing->passwd = temp->passwd;
-    temp->user = NULL;
-    temp->passwd = NULL;
+  struct connectdata *conn = data->conn;
+
+  /* get the user+password information from the needle since it may
+   * be new for this request even when we reuse conn */
+  if(needle->creds) {
+    /* use the new username and password though */
+    Curl_creds_link(&conn->creds, needle->creds);
   }
 
 #ifndef CURL_DISABLE_PROXY
-  existing->bits.proxy_user_passwd = temp->bits.proxy_user_passwd;
-  if(existing->bits.proxy_user_passwd) {
-    /* use the new proxy user name and proxy password though */
-    Curl_safefree(existing->http_proxy.user);
-    Curl_safefree(existing->socks_proxy.user);
-    Curl_safefree(existing->http_proxy.passwd);
-    Curl_safefree(existing->socks_proxy.passwd);
-    existing->http_proxy.user = temp->http_proxy.user;
-    existing->socks_proxy.user = temp->socks_proxy.user;
-    existing->http_proxy.passwd = temp->http_proxy.passwd;
-    existing->socks_proxy.passwd = temp->socks_proxy.passwd;
-    temp->http_proxy.user = NULL;
-    temp->socks_proxy.user = NULL;
-    temp->http_proxy.passwd = NULL;
-    temp->socks_proxy.passwd = NULL;
-  }
+  /* use the new proxy username and proxy password though */
+  Curl_creds_link(&conn->http_proxy.creds, needle->http_proxy.creds);
+  Curl_creds_link(&conn->socks_proxy.creds, needle->socks_proxy.creds);
 #endif
 
-  /* Finding a connection for reuse in the cache matches, among other
+  /* Finding a connection for reuse in the cpool matches, among other
    * things on the "remote-relevant" hostname. This is not necessarily
-   * the authority of the URL, e.g. conn->host. For example:
+   * the authority of the URL, e.g. conn->origin. For example:
    * - we use a proxy (not tunneling). we want to send all requests
    *   that use the same proxy on this connection.
    * - we have a "connect-to" setting that may redirect the hostname of
    *   a new request to the same remote endpoint of an existing conn.
    *   We want to reuse an existing conn to the remote endpoint.
-   * Since connection reuse does not match on conn->host necessarily, we
-   * switch `existing` conn to `temp` conn's host settings.
-   * TODO: is this correct in the case of TLS connections that have
-   *       used the original hostname in SNI to negotiate? Do we send
-   *       requests for another host through the different SNI?
+   * Since connection reuse does not match on conn->origin necessarily, we
+   * switch conn to needle's host settings.
    */
-  Curl_free_idnconverted_hostname(&existing->host);
-  Curl_free_idnconverted_hostname(&existing->conn_to_host);
-  Curl_safefree(existing->host.rawalloc);
-  Curl_safefree(existing->conn_to_host.rawalloc);
-  existing->host = temp->host;
-  temp->host.rawalloc = NULL;
-  temp->host.encalloc = NULL;
-  existing->conn_to_host = temp->conn_to_host;
-  temp->conn_to_host.rawalloc = NULL;
-  existing->conn_to_port = temp->conn_to_port;
-  existing->remote_port = temp->remote_port;
-  Curl_safefree(existing->hostname_resolve);
-
-  existing->hostname_resolve = temp->hostname_resolve;
-  temp->hostname_resolve = NULL;
-
-  /* reuse init */
-  existing->bits.reuse = TRUE; /* yes, we're reusing here */
-
-  conn_free(data, temp);
+  Curl_peer_link(&conn->origin, needle->origin);
+  Curl_peer_link(&conn->via_peer, needle->via_peer);
+  Curl_peer_link(&conn->origin2, needle->origin2);
+  Curl_peer_link(&conn->via_peer2, needle->via_peer2);
 }
 
-/**
- * create_conn() sets up a new connectdata struct, or reuses an already
- * existing one, and resolves host name.
- *
- * if this function returns CURLE_OK and *async is set to TRUE, the resolve
- * response will be coming asynchronously. If *async is FALSE, the name is
- * already resolved.
- *
- * @param data The sessionhandle pointer
- * @param in_connect is set to the next connection data pointer
- * @param async is set TRUE when an async DNS resolution is pending
- * @see Curl_setup_conn()
- *
- */
-
-static CURLcode create_conn(struct Curl_easy *data,
-                            struct connectdata **in_connect,
-                            bool *async)
+static void conn_meta_freeentry(void *p)
 {
+  (void)p;
+  /* Always FALSE. Cannot use a 0 assert here since compilers
+   * are not in agreement if they then want a NORETURN attribute or
+   * not. *sigh* */
+  DEBUGASSERT(!p);
+}
+
+static CURLcode url_create_needle(struct Curl_easy *data,
+                                  struct connectdata **pneedle)
+{
+  struct connectdata *needle = NULL;
   CURLcode result = CURLE_OK;
-  struct connectdata *conn;
-  struct connectdata *existing = NULL;
-  bool reuse;
-  bool connections_available = TRUE;
-  bool force_reuse = FALSE;
-  bool waitpipe = FALSE;
-  size_t max_host_connections = Curl_multi_max_host_connections(data->multi);
-  size_t max_total_connections = Curl_multi_max_total_connections(data->multi);
-
-  *async = FALSE;
-  *in_connect = NULL;
-
-  /*************************************************************
-   * Check input data
-   *************************************************************/
-  if(!data->state.url) {
-    result = CURLE_URL_MALFORMAT;
-    goto out;
-  }
+  bool network_scheme = TRUE; /* almost all are */
 
   /* First, split up the current URL in parts so that we can use the
      parts for checking against the already present connections. In order
      to not have to modify everything at once, we allocate a temporary
      connection data struct and fill in for comparison purposes. */
-  conn = allocate_conn(data);
-
-  if(!conn) {
+  needle = allocate_conn(data);
+  if(!needle) {
     result = CURLE_OUT_OF_MEMORY;
     goto out;
   }
 
-  /* We must set the return variable as soon as possible, so that our
-     parent can cleanup any possible allocs we may have done before
-     any failure */
-  *in_connect = conn;
+  /* Do the unfailable inits first, before checks that may early return */
+  Curl_hash_init(&needle->meta_hash, 23,
+                 Curl_hash_str, curlx_str_key_compare, conn_meta_freeentry);
 
-  result = parseurlandfillconn(data, conn);
+  /*************************************************************
+   * Determine `conn->origin` and populate `data->state.up` and
+   * other URL related properties.
+   *************************************************************/
+  result = url_set_conn_origin_etc(data, needle);
   if(result)
     goto out;
 
-  if(data->set.str[STRING_SASL_AUTHZID]) {
-    conn->sasl_authzid = strdup(data->set.str[STRING_SASL_AUTHZID]);
-    if(!conn->sasl_authzid) {
-      result = CURLE_OUT_OF_MEMORY;
-      goto out;
-    }
-  }
-
-  if(data->set.str[STRING_BEARER]) {
-    conn->oauth_bearer = strdup(data->set.str[STRING_BEARER]);
-    if(!conn->oauth_bearer) {
-      result = CURLE_OUT_OF_MEMORY;
-      goto out;
-    }
-  }
+  DEBUGASSERT(needle->origin);
+  network_scheme = !(needle->origin->scheme->flags & PROTOPT_NONETWORK);
 
 #ifdef USE_UNIX_SOCKETS
-  if(data->set.str[STRING_UNIX_SOCKET_PATH]) {
-    conn->unix_domain_socket = strdup(data->set.str[STRING_UNIX_SOCKET_PATH]);
-    if(!conn->unix_domain_socket) {
-      result = CURLE_OUT_OF_MEMORY;
+  /*************************************************************
+   * Set UDS first. It overrides "via_peer" and proxy settings.
+   *************************************************************/
+  if(network_scheme && data->set.str[STRING_UNIX_SOCKET_PATH]) {
+    result = Curl_peer_uds_create(needle->origin->scheme,
+                                  data->set.str[STRING_UNIX_SOCKET_PATH],
+                                  (bool)data->set.abstract_unix_socket,
+                                  &needle->via_peer);
+    if(result)
       goto out;
-    }
-    conn->bits.abstract_unix_socket = data->set.abstract_unix_socket;
   }
-#endif
+#endif /* USE_UNIX_SOCKETS */
 
-  /* After the unix socket init but before the proxy vars are used, parse and
-     initialize the proxy vars */
-#ifndef CURL_DISABLE_PROXY
-  result = create_conn_helper_init_proxy(data, conn);
-  if(result)
-    goto out;
-
-  /*************************************************************
-   * If the protocol is using SSL and HTTP proxy is used, we set
-   * the tunnel_proxy bit.
-   *************************************************************/
-  if((conn->given->flags&PROTOPT_SSL) && conn->bits.httpproxy)
-    conn->bits.tunnel_proxy = TRUE;
-#endif
-
-  /*************************************************************
-   * Figure out the remote port number and fix it in the URL
-   *************************************************************/
-  result = parse_remote_port(data, conn);
-  if(result)
-    goto out;
-
-  /* Check for overridden login details and set them accordingly so that
-     they are known when protocol->setup_connection is called! */
-  result = override_login(data, conn);
-  if(result)
-    goto out;
-
-  result = set_login(data, conn); /* default credentials */
-  if(result)
-    goto out;
-
-  /*************************************************************
-   * Process the "connect to" linked list of hostname/port mappings.
-   * Do this after the remote port number has been fixed in the URL.
-   *************************************************************/
-  result = parse_connect_to_slist(data, conn, data->set.connect_to);
-  if(result)
-    goto out;
-
-  /*************************************************************
-   * IDN-convert the proxy hostnames
-   *************************************************************/
-#ifndef CURL_DISABLE_PROXY
-  if(conn->bits.httpproxy) {
-    result = Curl_idnconvert_hostname(&conn->http_proxy.host);
+  if(network_scheme && !needle->via_peer) {
+    /*************************************************************
+     * If the `via_peer` is not already set (via UDS above),
+     * determine if we talk to `conn->origin` directly or use
+     * `conn->via_peer` using "connect to" and "alt-svc" properties.
+     *************************************************************/
+    result = url_set_conn_peer(data, needle);
     if(result)
-      return result;
-  }
-  if(conn->bits.socksproxy) {
-    result = Curl_idnconvert_hostname(&conn->socks_proxy.host);
-    if(result)
-      return result;
-  }
-#endif
-  if(conn->bits.conn_to_host) {
-    result = Curl_idnconvert_hostname(&conn->conn_to_host);
-    if(result)
-      return result;
+      goto out;
   }
 
   /*************************************************************
    * Check whether the host and the "connect to host" are equal.
-   * Do this after the hostnames have been IDN-converted.
+   * Do this after the hostnames have been IDN-converted and
+   * before initializing the proxy.
    *************************************************************/
-  if(conn->bits.conn_to_host &&
-     strcasecompare(conn->conn_to_host.name, conn->host.name)) {
-    conn->bits.conn_to_host = FALSE;
-  }
-
-  /*************************************************************
-   * Check whether the port and the "connect to port" are equal.
-   * Do this after the remote port number has been fixed in the URL.
-   *************************************************************/
-  if(conn->bits.conn_to_port && conn->conn_to_port == conn->remote_port) {
-    conn->bits.conn_to_port = FALSE;
+  if(Curl_peer_equal(needle->origin, needle->via_peer)) {
+    Curl_peer_unlink(&needle->via_peer);
   }
 
 #ifndef CURL_DISABLE_PROXY
-  /*************************************************************
-   * If the "connect to" feature is used with an HTTP proxy,
-   * we set the tunnel_proxy bit.
-   *************************************************************/
-  if((conn->bits.conn_to_host || conn->bits.conn_to_port) &&
-      conn->bits.httpproxy)
-    conn->bits.tunnel_proxy = TRUE;
-#endif
+  /* Going via a unix socket ignores any proxy settings */
+  if(network_scheme &&
+     (!needle->via_peer || !needle->via_peer->unix_socket)) {
+    result = Curl_proxy_init_conn(data, needle);
+    if(result)
+      goto out;
+  }
+#endif /* CURL_DISABLE_PROXY */
+
+  result = url_set_conn_login(data, needle); /* default credentials */
+  if(result)
+    goto out;
 
   /*************************************************************
    * Setup internals depending on protocol. Needs to be done after
    * we figured out what/if proxy to use.
    *************************************************************/
-  result = setup_connection_internals(data, conn);
+  result = setup_connection_internals(data, needle);
   if(result)
     goto out;
 
+  if(needle->scheme->flags & PROTOPT_ALPN) {
+    /* The protocol wants it, so set the bits if enabled in the easy handle
+       (default) */
+    if(data->set.ssl_enable_alpn)
+      needle->bits.tls_enable_alpn = TRUE;
+  }
+
+  if(network_scheme) {
+    /* Setup callbacks for network connections */
+    needle->recv[FIRSTSOCKET] = Curl_cf_recv;
+    needle->send[FIRSTSOCKET] = Curl_cf_send;
+    needle->recv[SECONDARYSOCKET] = Curl_cf_recv;
+    needle->send[SECONDARYSOCKET] = Curl_cf_send;
+    needle->bits.tcp_fastopen = data->set.tcp_fastopen;
+#ifdef USE_UNIX_SOCKETS
+    if(Curl_conn_get_first_peer(needle, FIRSTSOCKET)->unix_socket)
+      needle->transport_wanted = TRNSPRT_UNIX;
+#endif
+  }
+
+out:
+  if(!result) {
+    DEBUGASSERT(needle);
+    DEBUGASSERT(needle->origin);
+    *pneedle = needle;
+  }
+  else {
+    *pneedle = NULL;
+    if(needle)
+      Curl_conn_free(data, needle);
+  }
+  return result;
+}
+
+static CURLcode url_set_data_origin_and_creds(struct Curl_easy *data)
+{
+  CURLcode result = CURLE_OK;
+  CURLU *uh;
+  CURLUcode uc;
+  bool use_set_uh = (data->set.uh && !data->state.this_is_a_follow);
+  uint16_t port_override = data->state.allow_port ? data->set.use_port : 0;
+  uint32_t scope_id = 0;
+
+  /*************************************************************
+   * Check input data
+   *************************************************************/
+  if(!Curl_bufref_ptr(&data->state.url)) {
+    result = CURLE_URL_MALFORMAT;
+    goto out;
+  }
+
+  up_free(data); /* cleanup previous leftovers first */
+
+  /* parse the URL */
+  if(use_set_uh)
+    uh = data->state.uh = curl_url_dup(data->set.uh);
+  else
+    uh = data->state.uh = curl_url();
+  if(!uh) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  /* Calculate the *real* URL this transfer uses, applying defaults
+   * where information is missing. */
+  if(data->set.str[STRING_DEFAULT_PROTOCOL] &&
+     !Curl_is_absolute_url(Curl_bufref_ptr(&data->state.url), NULL, 0, TRUE)) {
+    char *url = curl_maprintf("%s://%s",
+                              data->set.str[STRING_DEFAULT_PROTOCOL],
+                              Curl_bufref_ptr(&data->state.url));
+    if(!url) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+    Curl_bufref_set(&data->state.url, url, 0, curl_free);
+  }
+
+  if(!use_set_uh) {
+    char *newurl;
+    uc = curl_url_set(uh, CURLUPART_URL, Curl_bufref_ptr(&data->state.url),
+                      (unsigned int)(CURLU_GUESS_SCHEME |
+                       CURLU_NON_SUPPORT_SCHEME |
+                       (data->set.disallow_username_in_url ?
+                        CURLU_DISALLOW_USER : 0) |
+                       (data->set.path_as_is ? CURLU_PATH_AS_IS : 0)));
+    if(uc) {
+      failf(data, "URL rejected: %s", curl_url_strerror(uc));
+      result = Curl_uc_to_curlcode(uc);
+      goto out;
+    }
+
+    /* after it was parsed, get the generated normalized version */
+    uc = curl_url_get(uh, CURLUPART_URL, &newurl, CURLU_GET_EMPTY);
+    if(uc) {
+      result = Curl_uc_to_curlcode(uc);
+      goto out;
+    }
+    Curl_bufref_set(&data->state.url, newurl, 0, curl_free);
+  }
+
+#ifdef USE_IPV6
+  scope_id = data->set.scope_id;
+#endif
+
+  /* `uh` is now as the connection should use it, probably. */
+  result = Curl_peer_from_url(uh, data, port_override, scope_id,
+                              &data->state.up, &data->state.origin);
+  if(result)
+    goto out;
+  /* The origin might get changed when HSTS applies */
+  result = hsts_upgrade(data, uh, port_override, scope_id);
+  if(result)
+    goto out;
+
+  /* When the transfers initial_origin is not set, this is the initial
+   * request. Remember this starting point. */
+  if(!data->state.initial_origin)
+    Curl_peer_link(&data->state.initial_origin, data->state.origin);
+
+  uc = curl_url_get(uh, CURLUPART_PATH, &data->state.up.path, CURLU_URLENCODE);
+  if(uc) {
+    result = Curl_uc_to_curlcode(uc);
+    goto out;
+  }
+  uc = curl_url_get(uh, CURLUPART_QUERY, &data->state.up.query,
+                    CURLU_GET_EMPTY);
+  if(uc && (uc != CURLUE_NO_QUERY)) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  uc = curl_url_get(uh, CURLUPART_OPTIONS, &data->state.up.options,
+                    CURLU_URLDECODE);
+  if(uc && (uc != CURLUE_NO_OPTIONS)) {
+    result = Curl_uc_to_curlcode(uc);
+    goto out;
+  }
+
+  result = url_set_data_creds(data, uh);
+  if(result)
+    goto out;
+
+out:
+  return result;
+}
+
+/**
+ * Find an existing connection for the transfer or create a new one.
+ * Returns
+ * - CURLE_OK on success with a connection attached to data
+ * - CURLE_NO_CONNECTION_AVAILABLE when connection limits apply or when
+ *   a suitable connection has not determined its multiplex capability.
+ * - a fatal error
+ */
+static CURLcode url_find_or_create_conn(struct Curl_easy *data)
+{
+  struct connectdata *needle = NULL;
+  bool waitpipe = FALSE;
+  CURLcode result;
+
+  /* create the template connection for transfer data. Use this needle to
+   * find an existing connection or, if none exists, convert needle
+   * to a full connection and attach it to data. */
+  result = url_create_needle(data, &needle);
+  if(result)
+    goto out;
+  DEBUGASSERT(needle);
+
   /***********************************************************************
-   * file: is a special case in that it doesn't need a network connection
+   * file: is a special case in that it does not need a network connection
    ***********************************************************************/
 #ifndef CURL_DISABLE_FILE
-  if(conn->handler->flags & PROTOPT_NONETWORK) {
+  if(needle->scheme->flags & PROTOPT_NONETWORK) {
     bool done;
     /* this is supposed to be the connect function so we better at least check
        that the file is present here! */
-    DEBUGASSERT(conn->handler->connect_it);
-    Curl_persistconninfo(data, conn, NULL, -1);
-    result = conn->handler->connect_it(data, &done);
+    DEBUGASSERT(needle->scheme->run->connect_it);
+    data->info.conn_scheme = needle->scheme->name;
+    /* conn_protocol can only provide "old" protocols */
+    data->info.conn_protocol = (needle->scheme->protocol) & CURLPROTO_MASK;
+    result = needle->scheme->run->connect_it(data, &done);
+    if(result)
+      goto out;
 
-    /* Setup a "faked" transfer that'll do nothing */
+    /* Setup a "faked" transfer that will do nothing */
+    Curl_attach_connection(data, needle);
+    needle = NULL;
+    result = Curl_cpool_add(data, data->conn);
     if(!result) {
-      Curl_attach_connection(data, conn);
-      result = Curl_conncache_add_conn(data);
-      if(result)
-        goto out;
-
-      /*
-       * Setup whatever necessary for a resumed transfer
-       */
+      /* Setup whatever necessary for a resumed transfer */
       result = setup_range(data);
-      if(result) {
-        DEBUGASSERT(conn->handler->done);
-        /* we ignore the return code for the protocol-specific DONE */
-        (void)conn->handler->done(data, result, FALSE);
-        goto out;
+      if(!result) {
+        Curl_xfer_setup_nop(data);
+        result = Curl_init_do(data, data->conn);
       }
-      Curl_setup_transfer(data, -1, -1, FALSE, -1);
     }
 
-    /* since we skip do_init() */
-    Curl_init_do(data, conn);
-
+    if(result) {
+      DEBUGASSERT(data->conn->scheme->run->done);
+      /* we ignore the return code for the protocol-specific DONE */
+      (void)data->conn->scheme->run->done(data, result, FALSE);
+    }
     goto out;
   }
 #endif
 
-  /* Setup filter for network connections */
-  conn->recv[FIRSTSOCKET] = Curl_conn_recv;
-  conn->send[FIRSTSOCKET] = Curl_conn_send;
-  conn->recv[SECONDARYSOCKET] = Curl_conn_recv;
-  conn->send[SECONDARYSOCKET] = Curl_conn_send;
-  conn->bits.tcp_fastopen = data->set.tcp_fastopen;
-
-  /* Get a cloned copy of the SSL config situation stored in the
-     connection struct. But to get this going nicely, we must first make
-     sure that the strings in the master copy are pointing to the correct
-     strings in the session handle strings array!
-
-     Keep in mind that the pointers in the master copy are pointing to strings
-     that will be freed as part of the Curl_easy struct, but all cloned
-     copies will be separately allocated.
-  */
-  data->set.ssl.primary.CApath = data->set.str[STRING_SSL_CAPATH];
-  data->set.ssl.primary.CAfile = data->set.str[STRING_SSL_CAFILE];
-  data->set.ssl.primary.issuercert = data->set.str[STRING_SSL_ISSUERCERT];
-  data->set.ssl.primary.issuercert_blob = data->set.blobs[BLOB_SSL_ISSUERCERT];
-  data->set.ssl.primary.cipher_list =
-    data->set.str[STRING_SSL_CIPHER_LIST];
-  data->set.ssl.primary.cipher_list13 =
-    data->set.str[STRING_SSL_CIPHER13_LIST];
-  data->set.ssl.primary.pinned_key =
-    data->set.str[STRING_SSL_PINNEDPUBLICKEY];
-  data->set.ssl.primary.cert_blob = data->set.blobs[BLOB_CERT];
-  data->set.ssl.primary.ca_info_blob = data->set.blobs[BLOB_CAINFO];
-  data->set.ssl.primary.curves = data->set.str[STRING_SSL_EC_CURVES];
-
-#ifndef CURL_DISABLE_PROXY
-  data->set.proxy_ssl.primary.CApath = data->set.str[STRING_SSL_CAPATH_PROXY];
-  data->set.proxy_ssl.primary.CAfile = data->set.str[STRING_SSL_CAFILE_PROXY];
-  data->set.proxy_ssl.primary.cipher_list =
-    data->set.str[STRING_SSL_CIPHER_LIST_PROXY];
-  data->set.proxy_ssl.primary.cipher_list13 =
-    data->set.str[STRING_SSL_CIPHER13_LIST_PROXY];
-  data->set.proxy_ssl.primary.pinned_key =
-    data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY];
-  data->set.proxy_ssl.primary.cert_blob = data->set.blobs[BLOB_CERT_PROXY];
-  data->set.proxy_ssl.primary.ca_info_blob =
-    data->set.blobs[BLOB_CAINFO_PROXY];
-  data->set.proxy_ssl.primary.issuercert =
-    data->set.str[STRING_SSL_ISSUERCERT_PROXY];
-  data->set.proxy_ssl.primary.issuercert_blob =
-    data->set.blobs[BLOB_SSL_ISSUERCERT_PROXY];
-  data->set.proxy_ssl.primary.CRLfile =
-    data->set.str[STRING_SSL_CRLFILE_PROXY];
-  data->set.proxy_ssl.cert_type = data->set.str[STRING_CERT_TYPE_PROXY];
-  data->set.proxy_ssl.key = data->set.str[STRING_KEY_PROXY];
-  data->set.proxy_ssl.key_type = data->set.str[STRING_KEY_TYPE_PROXY];
-  data->set.proxy_ssl.key_passwd = data->set.str[STRING_KEY_PASSWD_PROXY];
-  data->set.proxy_ssl.primary.clientcert = data->set.str[STRING_CERT_PROXY];
-  data->set.proxy_ssl.key_blob = data->set.blobs[BLOB_KEY_PROXY];
-#endif
-  data->set.ssl.primary.CRLfile = data->set.str[STRING_SSL_CRLFILE];
-  data->set.ssl.cert_type = data->set.str[STRING_CERT_TYPE];
-  data->set.ssl.key = data->set.str[STRING_KEY];
-  data->set.ssl.key_type = data->set.str[STRING_KEY_TYPE];
-  data->set.ssl.key_passwd = data->set.str[STRING_KEY_PASSWD];
-  data->set.ssl.primary.clientcert = data->set.str[STRING_CERT];
-#ifdef USE_TLS_SRP
-  data->set.ssl.primary.username = data->set.str[STRING_TLSAUTH_USERNAME];
-  data->set.ssl.primary.password = data->set.str[STRING_TLSAUTH_PASSWORD];
-#ifndef CURL_DISABLE_PROXY
-  data->set.proxy_ssl.primary.username =
-    data->set.str[STRING_TLSAUTH_USERNAME_PROXY];
-  data->set.proxy_ssl.primary.password =
-    data->set.str[STRING_TLSAUTH_PASSWORD_PROXY];
-#endif
-#endif
-  data->set.ssl.key_blob = data->set.blobs[BLOB_KEY];
-
-  if(!Curl_clone_primary_ssl_config(&data->set.ssl.primary,
-                                    &conn->ssl_config)) {
-    result = CURLE_OUT_OF_MEMORY;
+  /* Complete the easy's SSL configuration for connection cache matching */
+  result = Curl_ssl_easy_config_complete(data, needle->origin);
+  if(result)
     goto out;
-  }
 
-#ifndef CURL_DISABLE_PROXY
-  if(!Curl_clone_primary_ssl_config(&data->set.proxy_ssl.primary,
-                                    &conn->proxy_ssl_config)) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto out;
-  }
-#endif
-
-  prune_dead_connections(data);
+  /* Get rid of any dead connections so limit are easier kept. */
+  Curl_cpool_prune_dead(data);
 
   /*************************************************************
-   * Check the current list of connections to see if we can
-   * reuse an already existing one or if we have to create a
-   * new one.
+   * Reuse of existing connection is not allowed when
+   * - connect_only is set or
+   * - reuse_fresh is set and this is not a follow-up request
+   *   (like with HTTP followlocation)
    *************************************************************/
+  if((!data->set.reuse_fresh || data->state.followlocation) &&
+     !data->set.connect_only) {
+    /* Ok, try to find and attach an existing one */
+    url_attach_existing(data, needle, &waitpipe);
+  }
 
-  DEBUGASSERT(conn->user);
-  DEBUGASSERT(conn->passwd);
+  if(data->conn) {
+    /* We attached an existing connection for this transfer. Copy
+     * over transfer specific properties over from needle. */
+    struct connectdata *conn = data->conn;
+    VERBOSE(bool tls_upgraded = (!(needle->given->flags & PROTOPT_SSL) &&
+                                 Curl_conn_is_ssl(conn, FIRSTSOCKET)));
 
-  /* reuse_fresh is TRUE if we are told to use a new connection by force, but
-     we only acknowledge this option if this is not a reused connection
-     already (which happens due to follow-location or during an HTTP
-     authentication phase). CONNECT_ONLY transfers also refuse reuse. */
-  if((data->set.reuse_fresh && !data->state.followlocation) ||
-     data->set.connect_only)
-    reuse = FALSE;
-  else
-    reuse = ConnectionExists(data, conn, &existing, &force_reuse, &waitpipe);
-
-  if(reuse) {
-    /*
-     * We already have a connection for this, we got the former connection in
-     * `existing` and thus we need to cleanup the one we just
-     * allocated before we can move along and use `existing`.
-     */
-    reuse_conn(data, conn, existing);
-    conn = existing;
-    *in_connect = conn;
+    conn->bits.reuse = TRUE;
+    url_conn_reuse_adjust(data, needle);
 
 #ifndef CURL_DISABLE_PROXY
-    infof(data, "Re-using existing connection with %s %s",
-          conn->bits.proxy?"proxy":"host",
-          conn->socks_proxy.host.name ? conn->socks_proxy.host.dispname :
-          conn->http_proxy.host.name ? conn->http_proxy.host.dispname :
-          conn->host.dispname);
+    infof(data, "Reusing existing %s: connection%s with %s %s",
+          conn->given->name,
+          tls_upgraded ? " (upgraded to SSL)" : "",
+          (conn->socks_proxy.peer || conn->http_proxy.peer) ? "proxy" : "host",
+          conn->socks_proxy.peer ? conn->socks_proxy.peer->user_hostname :
+          conn->http_proxy.peer ? conn->http_proxy.peer->user_hostname :
+          conn->origin->hostname);
 #else
-    infof(data, "Re-using existing connection with host %s",
-          conn->host.dispname);
+    infof(data, "Reusing existing %s: connection%s with host %s",
+          conn->given->name,
+          tls_upgraded ? " (upgraded to SSL)" : "",
+          conn->origin->hostname);
 #endif
   }
   else {
-    /* We have decided that we want a new connection. However, we may not
-       be able to do that if we have reached the limit of how many
-       connections we are allowed to open. */
+    /* We have decided that we want a new connection. We may not be able to do
+       that if we have reached the limit of how many connections we are
+       allowed to open. */
 
-    if(conn->handler->flags & PROTOPT_ALPN) {
-      /* The protocol wants it, so set the bits if enabled in the easy handle
-         (default) */
-      if(data->set.ssl_enable_alpn)
-        conn->bits.tls_enable_alpn = TRUE;
-    }
-
-    if(waitpipe)
+    if(waitpipe) {
       /* There is a connection that *might* become usable for multiplexing
          "soon", and we wait for that */
-      connections_available = FALSE;
-    else {
-      /* this gets a lock on the conncache */
-      struct connectbundle *bundle =
-        Curl_conncache_find_bundle(data, conn, data->state.conn_cache);
-
-      if(max_host_connections > 0 && bundle &&
-         (bundle->num_connections >= max_host_connections)) {
-        struct connectdata *conn_candidate;
-
-        /* The bundle is full. Extract the oldest connection. */
-        conn_candidate = Curl_conncache_extract_bundle(data, bundle);
-        CONNCACHE_UNLOCK(data);
-
-        if(conn_candidate)
-          Curl_disconnect(data, conn_candidate, FALSE);
-        else {
-          infof(data, "No more connections allowed to host: %zu",
-                max_host_connections);
-          connections_available = FALSE;
-        }
-      }
-      else
-        CONNCACHE_UNLOCK(data);
-
-    }
-
-    if(connections_available &&
-       (max_total_connections > 0) &&
-       (Curl_conncache_size(data) >= max_total_connections)) {
-      struct connectdata *conn_candidate;
-
-      /* The cache is full. Let's see if we can kill a connection. */
-      conn_candidate = Curl_conncache_extract_oldest(data);
-      if(conn_candidate)
-        Curl_disconnect(data, conn_candidate, FALSE);
-      else {
-        infof(data, "No connections available in cache");
-        connections_available = FALSE;
-      }
-    }
-
-    if(!connections_available) {
-      infof(data, "No connections available.");
-
-      conn_free(data, conn);
-      *in_connect = NULL;
-
+      infof(data, "Waiting on connection to negotiate possible multiplexing.");
       result = CURLE_NO_CONNECTION_AVAILABLE;
       goto out;
     }
     else {
-      /*
-       * This is a brand new connection, so let's store it in the connection
-       * cache of ours!
-       */
-      Curl_attach_connection(data, conn);
-      result = Curl_conncache_add_conn(data);
-      if(result)
+      switch(Curl_cpool_check_limits(data, needle)) {
+      case CPOOL_LIMIT_DEST:
+        infof(data, "No more connections allowed to host");
+        result = CURLE_NO_CONNECTION_AVAILABLE;
         goto out;
+      case CPOOL_LIMIT_TOTAL:
+        if(data->master_mid != UINT32_MAX)
+          CURL_TRC_M(data, "Allowing sub-requests (like DoH) to override "
+                     "max connection limit");
+        else {
+          infof(data, "No connections available, total of %zu reached.",
+                data->multi->max_total_connections);
+          result = CURLE_NO_CONNECTION_AVAILABLE;
+          goto out;
+        }
+        break;
+      default:
+        break;
+      }
     }
 
-#if defined(USE_NTLM)
-    /* If NTLM is requested in a part of this connection, make sure we don't
+    /* Convert needle into a full connection by filling in all the
+     * remaining parts like the cloned SSL configuration. */
+    result = Curl_ssl_conn_config_init(data, needle);
+    if(result) {
+      DEBUGF(curl_mfprintf(stderr, "Error: init connection SSL config\n"));
+      goto out;
+    }
+    /* attach it and no longer own it */
+    Curl_attach_connection(data, needle);
+    needle = NULL;
+
+    result = Curl_cpool_add(data, data->conn);
+    if(result)
+      goto out;
+
+#ifdef USE_NTLM
+    /* If NTLM is requested in a part of this connection, make sure we do not
        assume the state is fine as this is a fresh connection and NTLM is
        connection based. */
-    if((data->state.authhost.picked & (CURLAUTH_NTLM | CURLAUTH_NTLM_WB)) &&
+    if((data->state.authhost.picked & CURLAUTH_NTLM) &&
        data->state.authhost.done) {
       infof(data, "NTLM picked AND auth done set, clear picked");
       data->state.authhost.picked = CURLAUTH_NONE;
       data->state.authhost.done = FALSE;
     }
 
-    if((data->state.authproxy.picked & (CURLAUTH_NTLM | CURLAUTH_NTLM_WB)) &&
+    if((data->state.authproxy.picked & CURLAUTH_NTLM) &&
        data->state.authproxy.done) {
       infof(data, "NTLM-proxy picked AND auth done set, clear picked");
       data->state.authproxy.picked = CURLAUTH_NONE;
@@ -3803,121 +2487,93 @@ static CURLcode create_conn(struct Curl_easy *data,
   }
 
   /* Setup and init stuff before DO starts, in preparing for the transfer. */
-  Curl_init_do(data, conn);
+  result = Curl_init_do(data, data->conn);
+  if(result)
+    goto out;
 
-  /*
-   * Setup whatever necessary for a resumed transfer
-   */
+  /* Setup whatever necessary for a resumed transfer */
   result = setup_range(data);
   if(result)
     goto out;
 
-  /* Continue connectdata initialization here. */
+  /* persist the scheme and handler the transfer is using */
+  data->info.conn_scheme = data->conn->scheme->name;
+  /* conn_protocol can only provide "old" protocols */
+  data->info.conn_protocol = (data->conn->scheme->protocol) & CURLPROTO_MASK;
+  data->info.used_proxy =
+#ifdef CURL_DISABLE_PROXY
+    0
+#else
+    (data->conn->socks_proxy.peer || data->conn->http_proxy.peer)
+#endif
+    ;
 
-  /*
-   * Inherit the proper values from the urldata struct AFTER we have arranged
-   * the persistent connection stuff
-   */
-  conn->seek_func = data->set.seek_func;
-  conn->seek_client = data->set.seek_client;
-
-  /*************************************************************
-   * Resolve the address of the server or proxy
-   *************************************************************/
-  result = resolve_server(data, conn, async);
-  if(result)
-    goto out;
-
-  /* Everything general done, inform filters that they need
-   * to prepare for a data transfer.
-   */
+  /* Lastly, inform connection filters that a new transfer is attached */
   result = Curl_conn_ev_data_setup(data);
 
 out:
+  if(needle)
+    Curl_conn_free(data, needle);
+  DEBUGASSERT(result || data->conn);
   return result;
 }
 
-/* Curl_setup_conn() is called after the name resolve initiated in
- * create_conn() is all done.
- *
- * Curl_setup_conn() also handles reused connections
- */
-CURLcode Curl_setup_conn(struct Curl_easy *data,
-                         bool *protocol_done)
-{
-  CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-
-  Curl_pgrsTime(data, TIMER_NAMELOOKUP);
-
-  if(conn->handler->flags & PROTOPT_NONETWORK) {
-    /* nothing to setup when not using a network */
-    *protocol_done = TRUE;
-    return result;
-  }
-
-#ifndef CURL_DISABLE_PROXY
-  /* set proxy_connect_closed to false unconditionally already here since it
-     is used strictly to provide extra information to a parent function in the
-     case of proxy CONNECT failures and we must make sure we don't have it
-     lingering set from a previous invoke */
-  conn->bits.proxy_connect_closed = FALSE;
-#endif
-
-#ifdef CURL_DO_LINEEND_CONV
-  data->state.crlf_conversions = 0; /* reset CRLF conversion counter */
-#endif /* CURL_DO_LINEEND_CONV */
-
-  /* set start time here for timeout purposes in the connect procedure, it
-     is later set again for the progress meter purpose */
-  conn->now = Curl_now();
-  if(!conn->bits.reuse)
-    result = Curl_conn_setup(data, conn, FIRSTSOCKET, conn->dns_entry,
-                             CURL_CF_SSL_DEFAULT);
-  /* not sure we need this flag to be passed around any more */
-  *protocol_done = FALSE;
-  return result;
-}
-
-CURLcode Curl_connect(struct Curl_easy *data,
-                      bool *asyncp,
-                      bool *protocol_done)
+CURLcode Curl_connect(struct Curl_easy *data, bool *pconnected)
 {
   CURLcode result;
-  struct connectdata *conn;
+  struct connectdata *conn = NULL;
 
-  *asyncp = FALSE; /* assume synchronous resolves by default */
+  *pconnected = FALSE;
 
-  /* init the single-transfer specific data */
-  Curl_free_request_state(data);
-  memset(&data->req, 0, sizeof(struct SingleRequest));
-  data->req.size = data->req.maxdownload = -1;
-  data->req.no_body = data->set.opt_no_body;
+  /* Set the request to virgin state based on transfer settings */
+  Curl_req_hard_reset(&data->req, data);
+  /* Determine the origin of the transfer and what credentials to use */
+  result = url_set_data_origin_and_creds(data);
+  if(result)
+    goto out;
+  if(!data->state.origin) { /* just make really sure */
+    DEBUGASSERT(0);
+    result = CURLE_FAILED_INIT;
+    goto out;
+  }
 
-  /* call the stuff that needs to be called */
-  result = create_conn(data, &conn, asyncp);
+  /* Get or create a connection for the transfer. */
+  result = url_find_or_create_conn(data);
+  conn = data->conn;
+  if(result)
+    goto out;
+  if(!data->conn) { /* just make really sure */
+    DEBUGASSERT(0);
+    result = CURLE_FAILED_INIT;
+    goto out;
+  }
 
-  if(!result) {
-    if(CONN_INUSE(conn) > 1)
+  Curl_pgrsTime(data, TIMER_POSTQUEUE);
+  if(conn->bits.reuse) {
+    if(conn->attached_xfers > 1)
       /* multiplexed */
-      *protocol_done = TRUE;
-    else if(!*asyncp) {
-      /* DNS resolution is done: that's either because this is a reused
-         connection, in which case DNS was unnecessary, or because DNS
-         really did finish already (synch resolver/fast async resolve) */
-      result = Curl_setup_conn(data, protocol_done);
-    }
+      *pconnected = TRUE;
+  }
+  else if(conn->scheme->flags & PROTOPT_NONETWORK) {
+    Curl_pgrsTime(data, TIMER_NAMELOOKUP);
+    *pconnected = TRUE;
+  }
+  else {
+    result = Curl_conn_setup(data, conn, FIRSTSOCKET, CURL_CF_SSL_DEFAULT);
+    if(!result)
+      result = Curl_headers_init(data);
+    CURL_TRC_M(data, "Curl_conn_setup() -> %d", (int)result);
   }
 
-  if(result == CURLE_NO_CONNECTION_AVAILABLE) {
-    return result;
-  }
-  else if(result && conn) {
-    /* We're not allowed to return failure with memory left allocated in the
+out:
+  if(result == CURLE_NO_CONNECTION_AVAILABLE)
+    DEBUGASSERT(!conn);
+
+  if(result && conn) {
+    /* We are not allowed to return failure with memory left allocated in the
        connectdata struct, free those here */
     Curl_detach_connection(data);
-    Curl_conncache_remove_conn(data, conn, TRUE);
-    Curl_disconnect(data, conn, TRUE);
+    Curl_conn_terminate(data, conn, TRUE);
   }
 
   return result;
@@ -3935,136 +2591,66 @@ CURLcode Curl_connect(struct Curl_easy *data,
 
 CURLcode Curl_init_do(struct Curl_easy *data, struct connectdata *conn)
 {
-  struct SingleRequest *k = &data->req;
-
-  /* if this is a pushed stream, we need this: */
-  CURLcode result = Curl_preconnect(data);
-  if(result)
-    return result;
+  CURLcode result;
 
   if(conn) {
-    conn->bits.do_more = FALSE; /* by default there's no curl_do_more() to
+    conn->bits.do_more = FALSE; /* by default there is no curl_do_more() to
                                    use */
-    /* if the protocol used doesn't support wildcards, switch it off */
+    /* if the protocol used does not support wildcards, switch it off */
     if(data->state.wildcardmatch &&
-       !(conn->handler->flags & PROTOPT_WILDCARD))
+       !(conn->scheme->flags & PROTOPT_WILDCARD))
       data->state.wildcardmatch = FALSE;
   }
 
   data->state.done = FALSE; /* *_done() is not called yet */
-  data->state.expect100header = FALSE;
 
+  data->req.no_body = data->set.opt_no_body;
   if(data->req.no_body)
     /* in HTTP lingo, no body means using the HEAD request... */
     data->state.httpreq = HTTPREQ_HEAD;
 
-  k->start = Curl_now(); /* start time */
-  k->header = TRUE; /* assume header */
-  k->bytecount = 0;
-  k->ignorebody = FALSE;
-
-  Curl_speedinit(data);
-  Curl_pgrsSetUploadCounter(data, 0);
-  Curl_pgrsSetDownloadCounter(data, 0);
-
-  return CURLE_OK;
+  result = Curl_req_start(&data->req, data);
+  if(!result) {
+    Curl_pgrsReset(data);
+  }
+  return result;
 }
 
 #if defined(USE_HTTP2) || defined(USE_HTTP3)
 
-#ifdef USE_NGHTTP2
-
-static void priority_remove_child(struct Curl_easy *parent,
-                                  struct Curl_easy *child)
-{
-  struct Curl_data_prio_node **pnext = &parent->set.priority.children;
-  struct Curl_data_prio_node *pnode = parent->set.priority.children;
-
-  DEBUGASSERT(child->set.priority.parent == parent);
-  while(pnode && pnode->data != child) {
-    pnext = &pnode->next;
-    pnode = pnode->next;
-  }
-
-  DEBUGASSERT(pnode);
-  if(pnode) {
-    *pnext = pnode->next;
-    free(pnode);
-  }
-
-  child->set.priority.parent = 0;
-  child->set.priority.exclusive = FALSE;
-}
-
-CURLcode Curl_data_priority_add_child(struct Curl_easy *parent,
-                                      struct Curl_easy *child,
-                                      bool exclusive)
-{
-  if(child->set.priority.parent) {
-    priority_remove_child(child->set.priority.parent, child);
-  }
-
-  if(parent) {
-    struct Curl_data_prio_node **tail;
-    struct Curl_data_prio_node *pnode;
-
-    pnode = calloc(1, sizeof(*pnode));
-    if(!pnode)
-      return CURLE_OUT_OF_MEMORY;
-    pnode->data = child;
-
-    if(parent->set.priority.children && exclusive) {
-      /* exclusive: move all existing children underneath the new child */
-      struct Curl_data_prio_node *node = parent->set.priority.children;
-      while(node) {
-        node->data->set.priority.parent = child;
-        node = node->next;
-      }
-
-      tail = &child->set.priority.children;
-      while(*tail)
-        tail = &(*tail)->next;
-
-      DEBUGASSERT(!*tail);
-      *tail = parent->set.priority.children;
-      parent->set.priority.children = 0;
-    }
-
-    tail = &parent->set.priority.children;
-    while(*tail) {
-      (*tail)->data->set.priority.exclusive = FALSE;
-      tail = &(*tail)->next;
-    }
-
-    DEBUGASSERT(!*tail);
-    *tail = pnode;
-  }
-
-  child->set.priority.parent = parent;
-  child->set.priority.exclusive = exclusive;
-  return CURLE_OK;
-}
-
-#endif /* USE_NGHTTP2 */
-
-#ifdef USE_NGHTTP2
-static void data_priority_cleanup(struct Curl_easy *data)
-{
-  while(data->set.priority.children) {
-    struct Curl_easy *tmp = data->set.priority.children->data;
-    priority_remove_child(data, tmp);
-    if(data->set.priority.parent)
-      Curl_data_priority_add_child(data->set.priority.parent, tmp, FALSE);
-  }
-
-  if(data->set.priority.parent)
-    priority_remove_child(data->set.priority.parent, data);
-}
-#endif
-
 void Curl_data_priority_clear_state(struct Curl_easy *data)
 {
   memset(&data->state.priority, 0, sizeof(data->state.priority));
 }
 
-#endif /* defined(USE_HTTP2) || defined(USE_HTTP3) */
+#endif /* USE_HTTP2 || USE_HTTP3 */
+
+CURLcode Curl_conn_meta_set(struct connectdata *conn, const char *key,
+                            void *meta_data, Curl_meta_dtor *meta_dtor)
+{
+  if(!Curl_hash_add2(&conn->meta_hash, CURL_UNCONST(key), strlen(key) + 1,
+                     meta_data, meta_dtor)) {
+    meta_dtor(CURL_UNCONST(key), strlen(key) + 1, meta_data);
+    return CURLE_OUT_OF_MEMORY;
+  }
+  return CURLE_OK;
+}
+
+void Curl_conn_meta_remove(struct connectdata *conn, const char *key)
+{
+  Curl_hash_delete(&conn->meta_hash, CURL_UNCONST(key), strlen(key) + 1);
+}
+
+void *Curl_conn_meta_get(struct connectdata *conn, const char *key)
+{
+  return Curl_hash_pick(&conn->meta_hash, CURL_UNCONST(key), strlen(key) + 1);
+}
+
+CURLcode Curl_1st_fatal(CURLcode r1, CURLcode r2)
+{
+  if(r1 && (r1 != CURLE_AGAIN))
+    return r1;
+  if(r2 && (r2 != CURLE_AGAIN))
+    return r2;
+  return r1;
+}
diff --git a/third-party/curl/lib/url.h b/third-party/curl/lib/url.h
index f6a5b25737..ebbe9d53c4 100644
--- a/third-party/curl/lib/url.h
+++ b/third-party/curl/lib/url.h
@@ -25,45 +25,75 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
+/* Reject URLs exceeding this length */
+#define MAX_URL_LEN 0xffff
+
 /*
- * Prototypes for library-wide functions provided by url.c
+ * Prototypes for library-wide functions
  */
 
 CURLcode Curl_init_do(struct Curl_easy *data, struct connectdata *conn);
 CURLcode Curl_open(struct Curl_easy **curl);
-CURLcode Curl_init_userdefined(struct Curl_easy *data);
+void Curl_init_userdefined(struct Curl_easy *data);
 
 void Curl_freeset(struct Curl_easy *data);
 CURLcode Curl_uc_to_curlcode(CURLUcode uc);
-CURLcode Curl_close(struct Curl_easy **datap); /* opposite of curl_open() */
-CURLcode Curl_connect(struct Curl_easy *, bool *async, bool *protocol_connect);
-void Curl_disconnect(struct Curl_easy *data,
-                     struct connectdata *, bool dead_connection);
-CURLcode Curl_setup_conn(struct Curl_easy *data,
-                         bool *protocol_done);
-void Curl_free_request_state(struct Curl_easy *data);
+CURLcode Curl_close(struct Curl_easy **datap); /* opposite of Curl_open() */
+CURLcode Curl_connect(struct Curl_easy *data, bool *pconnected);
+void Curl_conn_free(struct Curl_easy *data, struct connectdata *conn);
 CURLcode Curl_parse_login_details(const char *login, const size_t len,
-                                  char **userptr, char **passwdptr,
-                                  char **optionsptr);
+                                  char **userp, char **passwdp,
+                                  char **optionsp);
 
-const struct Curl_handler *Curl_builtin_scheme(const char *scheme,
-                                               size_t schemelen);
+/* Attach/Clear/Get meta data for an easy handle. Needs to provide
+ * a destructor, will be automatically called when the easy handle
+ * is reset or closed. */
+typedef void Curl_meta_dtor(void *key, size_t key_len, void *meta_data);
+
+/* Set the transfer meta data for the key. Any existing entry for that
+ * key will be destroyed.
+ * Takes ownership of `meta_data` and destroys it when the call fails. */
+CURLcode Curl_meta_set(struct Curl_easy *data, const char *key,
+                       void *meta_data, Curl_meta_dtor *meta_dtor);
+void Curl_meta_remove(struct Curl_easy *data, const char *key);
+void *Curl_meta_get(struct Curl_easy *data, const char *key);
+void Curl_meta_reset(struct Curl_easy *data);
+
+/* Set connection meta data for the key. Any existing entry for that
+ * key will be destroyed.
+ * Takes ownership of `meta_data` and destroys it when the call fails. */
+CURLcode Curl_conn_meta_set(struct connectdata *conn, const char *key,
+                            void *meta_data, Curl_meta_dtor *meta_dtor);
+void Curl_conn_meta_remove(struct connectdata *conn, const char *key);
+void *Curl_conn_meta_get(struct connectdata *conn, const char *key);
 
 #define CURL_DEFAULT_PROXY_PORT 1080 /* default proxy port unless specified */
 #define CURL_DEFAULT_HTTPS_PROXY_PORT 443 /* default https proxy port unless
                                              specified */
 
-#ifdef CURL_DISABLE_VERBOSE_STRINGS
-#define Curl_verboseconnect(x,y)  Curl_nop_stmt
-#else
-void Curl_verboseconnect(struct Curl_easy *data, struct connectdata *conn);
-#endif
+/**
+ * Return TRUE iff the given connection is considered dead.
+ */
+bool Curl_conn_seems_dead(struct connectdata *conn,
+                          struct Curl_easy *data);
+
+/**
+ * Perform upkeep operations on the connection.
+ */
+CURLcode Curl_conn_upkeep(struct Curl_easy *data,
+                          struct connectdata *conn);
+
+/**
+ * Always eval all arguments, return the first
+ * result != (CURLE_OK | CURLE_AGAIN) or `r1`.
+ */
+CURLcode Curl_1st_fatal(CURLcode r1, CURLcode r2);
 
 #if defined(USE_HTTP2) || defined(USE_HTTP3)
 void Curl_data_priority_clear_state(struct Curl_easy *data);
 #else
 #define Curl_data_priority_clear_state(x)
-#endif /* !(defined(USE_HTTP2) || defined(USE_HTTP3)) */
+#endif /* USE_HTTP2 || USE_HTTP3 */
 
 #ifdef USE_NGHTTP2
 CURLcode Curl_data_priority_add_child(struct Curl_easy *parent,
diff --git a/third-party/curl/lib/urlapi-int.h b/third-party/curl/lib/urlapi-int.h
index d6e240aa36..4d8f2c1cb8 100644
--- a/third-party/curl/lib/urlapi-int.h
+++ b/third-party/curl/lib/urlapi-int.h
@@ -24,16 +24,45 @@
  *
  ***************************************************************************/
 #include "curl_setup.h"
+#include <curl/urlapi.h>
+
+/* Internal representation of CURLU. Point to URL-encoded strings. */
+struct Curl_URL {
+  char *scheme;
+  char *user;
+  char *password;
+  char *options; /* IMAP only? */
+  char *host;
+  char *zoneid; /* for numerical IPv6 addresses */
+  char *port;
+  char *path;
+  char *query;
+  char *fragment;
+  unsigned short portnum; /* the numerical version (if 'port' is set) */
+  BIT(query_present);    /* to support blank */
+  BIT(fragment_present); /* to support blank */
+  BIT(guessed_scheme);   /* when a URL without scheme is parsed */
+};
+
+#define HOST_ERROR   (-1) /* out of memory */
+#define HOST_NAME    1
+#define HOST_IPV4    2
+#define HOST_IPV6    3
+
+#define QUERY_NO      2
+#define QUERY_NOT_YET 3 /* allow to change to query */
+#define QUERY_YES     4
 
 size_t Curl_is_absolute_url(const char *url, char *buf, size_t buflen,
                             bool guess_scheme);
 
-CURLUcode Curl_url_set_authority(CURLU *u, const char *authority,
-                                 unsigned int flags);
+CURLUcode Curl_url_set_authority(CURLU *u, const char *authority);
 
-#ifdef DEBUGBUILD
-CURLUcode Curl_parse_port(struct Curl_URL *u, struct dynbuf *host,
-                          bool has_scheme);
-#endif
+CURLUcode Curl_junkscan(const char *url, size_t *urllen, bool allowspace);
+
+#define U_CURLU_URLDECODE  (unsigned int)CURLU_URLDECODE
+#define U_CURLU_PATH_AS_IS (unsigned int)CURLU_PATH_AS_IS
+
+bool Curl_url_same_origin(CURLU *base, CURLU *href);
 
 #endif /* HEADER_CURL_URLAPI_INT_H */
diff --git a/third-party/curl/lib/urlapi.c b/third-party/curl/lib/urlapi.c
index 80299e7c0e..05c79dfb0d 100644
--- a/third-party/curl/lib/urlapi.c
+++ b/third-party/curl/lib/urlapi.c
@@ -21,7 +21,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #include "urldata.h"
@@ -29,164 +28,155 @@
 #include "strcase.h"
 #include "url.h"
 #include "escape.h"
-#include "curl_ctype.h"
-#include "inet_pton.h"
-#include "inet_ntop.h"
-#include "strdup.h"
+#include "curlx/inet_pton.h"
+#include "curlx/inet_ntop.h"
+#include "curlx/strdup.h"
 #include "idn.h"
+#include "curlx/strparse.h"
 #include "curl_memrchr.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-  /* MSDOS/Windows style drive prefix, eg c: in c:foo */
-#define STARTS_WITH_DRIVE_PREFIX(str) \
-  ((('a' <= str[0] && str[0] <= 'z') || \
-    ('A' <= str[0] && str[0] <= 'Z')) && \
-   (str[1] == ':'))
-
-  /* MSDOS/Windows style drive prefix, optionally with
-   * a '|' instead of ':', followed by a slash or NUL */
-#define STARTS_WITH_URL_DRIVE_PREFIX(str) \
-  ((('a' <= (str)[0] && (str)[0] <= 'z') || \
+#ifdef _WIN32
+/* MS-DOS/Windows style drive prefix, eg c: in c:foo */
+#define STARTS_WITH_DRIVE_PREFIX(str)        \
+  ((('a' <= (str)[0] && (str)[0] <= 'z') ||  \
     ('A' <= (str)[0] && (str)[0] <= 'Z')) && \
-   ((str)[1] == ':' || (str)[1] == '|') && \
+   ((str)[1] == ':'))
+#endif
+
+/* MS-DOS/Windows style drive prefix, optionally with
+ * a '|' instead of ':', followed by a slash or NUL */
+#define STARTS_WITH_URL_DRIVE_PREFIX(str)                  \
+  ((('a' <= (str)[0] && (str)[0] <= 'z') ||                \
+    ('A' <= (str)[0] && (str)[0] <= 'Z')) &&               \
+   ((str)[1] == ':' || (str)[1] == '|') &&                 \
    ((str)[2] == '/' || (str)[2] == '\\' || (str)[2] == 0))
 
 /* scheme is not URL encoded, the longest libcurl supported ones are... */
 #define MAX_SCHEME_LEN 40
 
 /*
- * If ENABLE_IPV6 is disabled, we still want to parse IPv6 addresses, so make
+ * If USE_IPV6 is disabled, we still want to parse IPv6 addresses, so make
  * sure we have _some_ value for AF_INET6 without polluting our fake value
  * everywhere.
  */
-#if !defined(ENABLE_IPV6) && !defined(AF_INET6)
+#if !defined(USE_IPV6) && !defined(AF_INET6)
 #define AF_INET6 (AF_INET + 1)
 #endif
 
-/* Internal representation of CURLU. Point to URL-encoded strings. */
-struct Curl_URL {
-  char *scheme;
-  char *user;
-  char *password;
-  char *options; /* IMAP only? */
-  char *host;
-  char *zoneid; /* for numerical IPv6 addresses */
-  char *port;
-  char *path;
-  char *query;
-  char *fragment;
-  long portnum; /* the numerical version */
-};
-
 #define DEFAULT_SCHEME "https"
 
 static void free_urlhandle(struct Curl_URL *u)
 {
-  free(u->scheme);
-  free(u->user);
-  free(u->password);
-  free(u->options);
-  free(u->host);
-  free(u->zoneid);
-  free(u->port);
-  free(u->path);
-  free(u->query);
-  free(u->fragment);
+  curlx_free(u->scheme);
+  curlx_free(u->user);
+  curlx_free(u->password);
+  curlx_free(u->options);
+  curlx_free(u->host);
+  curlx_free(u->zoneid);
+  curlx_free(u->port);
+  curlx_free(u->path);
+  curlx_free(u->query);
+  curlx_free(u->fragment);
 }
 
 /*
- * Find the separator at the end of the host name, or the '?' in cases like
- * http://www.url.com?id=2380
+ * Find the separator at the end of the hostname, or the '?' in cases like
+ * http://www.example.com?id=2380
  */
 static const char *find_host_sep(const char *url)
 {
-  const char *sep;
-  const char *query;
-
   /* Find the start of the hostname */
-  sep = strstr(url, "//");
+  const char *sep = strstr(url, "//");
   if(!sep)
     sep = url;
   else
     sep += 2;
 
-  query = strchr(sep, '?');
-  sep = strchr(sep, '/');
+  /* Find first / or ? */
+  while(*sep && *sep != '/' && *sep != '?')
+    sep++;
 
-  if(!sep)
-    sep = url + strlen(url);
-
-  if(!query)
-    query = url + strlen(url);
-
-  return sep < query ? sep : query;
+  return sep;
 }
 
-/*
- * Decide whether a character in a URL must be escaped.
- */
-#define urlchar_needs_escaping(c) (!(ISCNTRL(c) || ISSPACE(c) || ISGRAPH(c)))
+/* convert CURLcode to CURLUcode */
+#define cc2cu(x) \
+  ((x) == CURLE_TOO_LARGE ? CURLUE_TOO_LARGE : CURLUE_OUT_OF_MEMORY)
 
-static const char hexdigits[] = "0123456789abcdef";
 /* urlencode_str() writes data into an output dynbuf and URL-encodes the
  * spaces in the source URL accordingly.
  *
- * URL encoding should be skipped for host names, otherwise IDN resolution
+ * This function re-encodes the string, meaning that it leaves already encoded
+ * bytes as-is and works by encoding only what *has* to be encoded - unless it
+ * has to uppercase the hex to normalize.
+ *
+ * Illegal percent-encoding sequences are left as-is.
+ *
+ * URL encoding should be skipped for hostnames, otherwise IDN resolution
  * will fail.
+ *
+ * 'query' tells if it is a query part or not, or if it is allowed to
+ * "transition" into a query part with a question mark.
+ *
+ * @unittest 1675
  */
-static CURLUcode urlencode_str(struct dynbuf *o, const char *url,
-                               size_t len, bool relative,
-                               bool query)
+UNITTEST CURLUcode urlencode_str(struct dynbuf *o, const char *url,
+                                 size_t len, bool relative,
+                                 unsigned int query);
+UNITTEST CURLUcode urlencode_str(struct dynbuf *o, const char *url,
+                                 size_t len, bool relative,
+                                 unsigned int query)
 {
   /* we must add this with whitespace-replacing */
-  bool left = !query;
   const unsigned char *iptr;
-  const unsigned char *host_sep = (const unsigned char *) url;
+  const unsigned char *host_sep = (const unsigned char *)url;
+  CURLcode result = CURLE_OK;
 
-  if(!relative)
-    host_sep = (const unsigned char *) find_host_sep(url);
+  DEBUGASSERT((query >= QUERY_NO) && (query <= QUERY_YES));
 
-  for(iptr = (unsigned char *)url;    /* read from here */
-      len; iptr++, len--) {
+  if(!relative) {
+    size_t n;
+    host_sep = (const unsigned char *)find_host_sep(url);
 
-    if(iptr < host_sep) {
-      if(Curl_dyn_addn(o, iptr, 1))
-        return CURLUE_OUT_OF_MEMORY;
-      continue;
-    }
+    /* output the first piece as-is */
+    n = (const char *)host_sep - url;
+    result = curlx_dyn_addn(o, url, n);
+    len -= n;
+  }
 
+  for(iptr = host_sep; len && !result; iptr++, len--) {
     if(*iptr == ' ') {
-      if(left) {
-        if(Curl_dyn_addn(o, "%20", 3))
-          return CURLUE_OUT_OF_MEMORY;
-      }
-      else {
-        if(Curl_dyn_addn(o, "+", 1))
-          return CURLUE_OUT_OF_MEMORY;
-      }
-      continue;
+      if(query != QUERY_YES)
+        result = curlx_dyn_addn(o, "%20", 3);
+      else
+        result = curlx_dyn_addn(o, "+", 1);
     }
-
-    if(*iptr == '?')
-      left = FALSE;
-
-    if(urlchar_needs_escaping(*iptr)) {
-      char out[3]={'%'};
-      out[1] = hexdigits[*iptr>>4];
-      out[2] = hexdigits[*iptr & 0xf];
-      if(Curl_dyn_addn(o, out, 3))
-        return CURLUE_OUT_OF_MEMORY;
+    else if((*iptr < ' ') || (*iptr >= 0x7f)) {
+      unsigned char out[3] = { '%' };
+      Curl_hexbyte(&out[1], *iptr);
+      result = curlx_dyn_addn(o, out, 3);
+    }
+    else if(*iptr == '%' && (len >= 3) &&
+            ISXDIGIT(iptr[1]) && ISXDIGIT(iptr[2]) &&
+            (ISLOWER(iptr[1]) || ISLOWER(iptr[2]))) {
+      /* uppercase it */
+      unsigned char hex = (unsigned char)((curlx_hexval(iptr[1]) << 4) |
+                                          curlx_hexval(iptr[2]));
+      unsigned char out[3] = { '%' };
+      Curl_hexbyte(&out[1], hex);
+      result = curlx_dyn_addn(o, out, 3);
+      iptr += 2;
+      len -= 2;
     }
     else {
-      if(Curl_dyn_addn(o, iptr, 1))
-        return CURLUE_OUT_OF_MEMORY;
+      result = curlx_dyn_addn(o, iptr, 1);
+      if(*iptr == '?' && (query == QUERY_NOT_YET))
+        query = QUERY_YES;
     }
   }
 
+  if(result)
+    return cc2cu(result);
   return CURLUE_OK;
 }
 
@@ -201,19 +191,19 @@ static CURLUcode urlencode_str(struct dynbuf *o, const char *url,
 size_t Curl_is_absolute_url(const char *url, char *buf, size_t buflen,
                             bool guess_scheme)
 {
-  int i = 0;
+  size_t i = 0;
   DEBUGASSERT(!buf || (buflen > MAX_SCHEME_LEN));
   (void)buflen; /* only used in debug-builds */
   if(buf)
     buf[0] = 0; /* always leave a defined value in buf */
-#ifdef WIN32
+#ifdef _WIN32
   if(guess_scheme && STARTS_WITH_DRIVE_PREFIX(url))
     return 0;
 #endif
   if(ISALPHA(url[0]))
     for(i = 1; i < MAX_SCHEME_LEN; ++i) {
       char s = url[i];
-      if(s && (ISALNUM(s) || (s == '+') || (s == '-') || (s == '.') )) {
+      if(s && (ISALNUM(s) || (s == '+') || (s == '-') || (s == '.'))) {
         /* RFC 3986 3.1 explains:
            scheme      = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )
         */
@@ -225,180 +215,34 @@ size_t Curl_is_absolute_url(const char *url, char *buf, size_t buflen,
   if(i && (url[i] == ':') && ((url[i + 1] == '/') || !guess_scheme)) {
     /* If this does not guess scheme, the scheme always ends with the colon so
        that this also detects data: URLs etc. In guessing mode, data: could
-       be the host name "data" with a specified port number. */
+       be the hostname "data" with a specified port number. */
 
     /* the length of the scheme is the name part only */
     size_t len = i;
     if(buf) {
+      Curl_strntolower(buf, url, i);
       buf[i] = 0;
-      while(i--) {
-        buf[i] = Curl_raw_tolower(url[i]);
-      }
     }
     return len;
   }
   return 0;
 }
 
-/*
- * Concatenate a relative URL to a base URL making it absolute.
- * URL-encodes any spaces.
- * The returned pointer must be freed by the caller unless NULL
- * (returns NULL on out of memory).
- *
- * Note that this function destroys the 'base' string.
- */
-static char *concat_url(char *base, const char *relurl)
-{
-  /***
-   TRY to append this new path to the old URL
-   to the right of the host part. Oh crap, this is doomed to cause
-   problems in the future...
-  */
-  struct dynbuf newest;
-  char *protsep;
-  char *pathsep;
-  bool host_changed = FALSE;
-  const char *useurl = relurl;
-
-  /* protsep points to the start of the host name */
-  protsep = strstr(base, "//");
-  if(!protsep)
-    protsep = base;
-  else
-    protsep += 2; /* pass the slashes */
-
-  if('/' != relurl[0]) {
-    int level = 0;
-
-    /* First we need to find out if there's a ?-letter in the URL,
-       and cut it and the right-side of that off */
-    pathsep = strchr(protsep, '?');
-    if(pathsep)
-      *pathsep = 0;
-
-    /* we have a relative path to append to the last slash if there's one
-       available, or if the new URL is just a query string (starts with a
-       '?')  we append the new one at the end of the entire currently worked
-       out URL */
-    if(useurl[0] != '?') {
-      pathsep = strrchr(protsep, '/');
-      if(pathsep)
-        *pathsep = 0;
-    }
-
-    /* Check if there's any slash after the host name, and if so, remember
-       that position instead */
-    pathsep = strchr(protsep, '/');
-    if(pathsep)
-      protsep = pathsep + 1;
-    else
-      protsep = NULL;
-
-    /* now deal with one "./" or any amount of "../" in the newurl
-       and act accordingly */
-
-    if((useurl[0] == '.') && (useurl[1] == '/'))
-      useurl += 2; /* just skip the "./" */
-
-    while((useurl[0] == '.') &&
-          (useurl[1] == '.') &&
-          (useurl[2] == '/')) {
-      level++;
-      useurl += 3; /* pass the "../" */
-    }
-
-    if(protsep) {
-      while(level--) {
-        /* cut off one more level from the right of the original URL */
-        pathsep = strrchr(protsep, '/');
-        if(pathsep)
-          *pathsep = 0;
-        else {
-          *protsep = 0;
-          break;
-        }
-      }
-    }
-  }
-  else {
-    /* We got a new absolute path for this server */
-
-    if(relurl[1] == '/') {
-      /* the new URL starts with //, just keep the protocol part from the
-         original one */
-      *protsep = 0;
-      useurl = &relurl[2]; /* we keep the slashes from the original, so we
-                              skip the new ones */
-      host_changed = TRUE;
-    }
-    else {
-      /* cut off the original URL from the first slash, or deal with URLs
-         without slash */
-      pathsep = strchr(protsep, '/');
-      if(pathsep) {
-        /* When people use badly formatted URLs, such as
-           "http://www.url.com?dir=/home/daniel" we must not use the first
-           slash, if there's a ?-letter before it! */
-        char *sep = strchr(protsep, '?');
-        if(sep && (sep < pathsep))
-          pathsep = sep;
-        *pathsep = 0;
-      }
-      else {
-        /* There was no slash. Now, since we might be operating on a badly
-           formatted URL, such as "http://www.url.com?id=2380" which doesn't
-           use a slash separator as it is supposed to, we need to check for a
-           ?-letter as well! */
-        pathsep = strchr(protsep, '?');
-        if(pathsep)
-          *pathsep = 0;
-      }
-    }
-  }
-
-  Curl_dyn_init(&newest, CURL_MAX_INPUT_LENGTH);
-
-  /* copy over the root url part */
-  if(Curl_dyn_add(&newest, base))
-    return NULL;
-
-  /* check if we need to append a slash */
-  if(('/' == useurl[0]) || (protsep && !*protsep) || ('?' == useurl[0]))
-    ;
-  else {
-    if(Curl_dyn_addn(&newest, "/", 1))
-      return NULL;
-  }
-
-  /* then append the new piece on the right side */
-  urlencode_str(&newest, useurl, strlen(useurl), !host_changed, FALSE);
-
-  return Curl_dyn_ptr(&newest);
-}
-
 /* scan for byte values <= 31, 127 and sometimes space */
-static CURLUcode junkscan(const char *url, size_t *urllen, unsigned int flags)
+CURLUcode Curl_junkscan(const char *url, size_t *urllen, bool allowspace)
 {
-  static const char badbytes[]={
-    /* */ 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
-    0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
-    0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
-    0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
-    0x7f, 0x00 /* null-terminate */
-  };
   size_t n = strlen(url);
-  size_t nfine;
-
+  size_t i;
+  unsigned char control;
+  const unsigned char *p = (const unsigned char *)url;
   if(n > CURL_MAX_INPUT_LENGTH)
-    /* excessive input length */
-    return CURLUE_MALFORMED_INPUT;
-
-  nfine = strcspn(url, badbytes);
-  if((nfine != n) ||
-     (!(flags & CURLU_ALLOW_SPACE) && strchr(url, ' ')))
     return CURLUE_MALFORMED_INPUT;
 
+  control = allowspace ? 0x1f : 0x20;
+  for(i = 0; i < n; i++) {
+    if(p[i] <= control || p[i] == 127)
+      return CURLUE_MALFORMED_INPUT;
+  }
   *urllen = n;
   return CURLUE_OK;
 }
@@ -406,22 +250,28 @@ static CURLUcode junkscan(const char *url, size_t *urllen, unsigned int flags)
 /*
  * parse_hostname_login()
  *
- * Parse the login details (user name, password and options) from the URL and
- * strip them out of the host name
+ * Parse the login details (username, password and options) from the URL and
+ * strip them out of the hostname
  *
+ * @unittest 1675
  */
-static CURLUcode parse_hostname_login(struct Curl_URL *u,
-                                      const char *login,
-                                      size_t len,
-                                      unsigned int flags,
-                                      size_t *offset) /* to the host name */
+UNITTEST CURLUcode parse_hostname_login(struct Curl_URL *u,
+                                        const char *login,
+                                        size_t len,
+                                        unsigned int flags,
+                                        size_t *hostname_offset);
+UNITTEST CURLUcode parse_hostname_login(struct Curl_URL *u,
+                                        const char *login,
+                                        size_t len,
+                                        unsigned int flags,
+                                        size_t *hostname_offset)
 {
-  CURLUcode result = CURLUE_OK;
-  CURLcode ccode;
+  CURLUcode ures = CURLUE_OK;
+  CURLcode result;
   char *userp = NULL;
   char *passwdp = NULL;
   char *optionsp = NULL;
-  const struct Curl_handler *h = NULL;
+  const struct Curl_scheme *h = NULL;
 
   /* At this point, we assume all the other special cases have been taken
    * care of, so the host is at most
@@ -430,76 +280,81 @@ static CURLUcode parse_hostname_login(struct Curl_URL *u,
    *
    * We need somewhere to put the embedded details, so do that first.
    */
-  char *ptr;
+  const char *ptr;
 
   DEBUGASSERT(login);
 
-  *offset = 0;
+  *hostname_offset = 0;
   ptr = memchr(login, '@', len);
   if(!ptr)
     goto out;
 
   /* We will now try to extract the
    * possible login information in a string like:
-   * ftp://user:password@ftp.my.site:8021/README */
+   * ftp://user:password@ftp.site.example:8021/README */
   ptr++;
 
   /* if this is a known scheme, get some details */
   if(u->scheme)
-    h = Curl_builtin_scheme(u->scheme, CURL_ZERO_TERMINATED);
+    h = Curl_get_scheme(u->scheme);
 
   /* We could use the login information in the URL so extract it. Only parse
      options if the handler says we should. Note that 'h' might be NULL! */
-  ccode = Curl_parse_login_details(login, ptr - login - 1,
-                                   &userp, &passwdp,
-                                   (h && (h->flags & PROTOPT_URLOPTIONS)) ?
-                                   &optionsp:NULL);
-  if(ccode) {
-    result = CURLUE_BAD_LOGIN;
+  result = Curl_parse_login_details(login, ptr - login - 1,
+                                    &userp, &passwdp,
+                                    (h && (h->flags & PROTOPT_URLOPTIONS)) ?
+                                    &optionsp : NULL);
+  if(result) {
+    /* the only possible error from Curl_parse_login_details is out of
+       memory: */
+    ures = CURLUE_OUT_OF_MEMORY;
     goto out;
   }
 
   if(userp) {
     if(flags & CURLU_DISALLOW_USER) {
-      /* Option DISALLOW_USER is set and url contains username. */
-      result = CURLUE_USER_NOT_ALLOWED;
+      /* Option DISALLOW_USER is set and URL contains username. */
+      ures = CURLUE_USER_NOT_ALLOWED;
       goto out;
     }
-    free(u->user);
+    curlx_free(u->user);
     u->user = userp;
   }
 
   if(passwdp) {
-    free(u->password);
+    curlx_free(u->password);
     u->password = passwdp;
   }
 
   if(optionsp) {
-    free(u->options);
+    curlx_free(u->options);
     u->options = optionsp;
   }
 
-  /* the host name starts at this offset */
-  *offset = ptr - login;
+  /* the hostname starts at this offset */
+  *hostname_offset = ptr - login;
   return CURLUE_OK;
 
 out:
 
-  free(userp);
-  free(passwdp);
-  free(optionsp);
-  u->user = NULL;
-  u->password = NULL;
-  u->options = NULL;
+  curlx_free(userp);
+  curlx_free(passwdp);
+  curlx_free(optionsp);
+  curlx_safefree(u->user);
+  curlx_safefree(u->password);
+  curlx_safefree(u->options);
 
-  return result;
+  return ures;
 }
 
-UNITTEST CURLUcode Curl_parse_port(struct Curl_URL *u, struct dynbuf *host,
-                                   bool has_scheme)
+/* @unittest 1653 */
+UNITTEST CURLUcode parse_port(struct Curl_URL *u, struct dynbuf *host,
+                              bool has_scheme);
+UNITTEST CURLUcode parse_port(struct Curl_URL *u, struct dynbuf *host,
+                              bool has_scheme)
 {
-  char *portptr;
-  char *hostname = Curl_dyn_ptr(host);
+  const char *portptr;
+  const char *hostname = curlx_dyn_ptr(host);
   /*
    * Find the end of an IPv6 address on the ']' ending bracket.
    */
@@ -520,37 +375,28 @@ UNITTEST CURLUcode Curl_parse_port(struct Curl_URL *u, struct dynbuf *host,
     portptr = strchr(hostname, ':');
 
   if(portptr) {
-    char *rest;
-    long port;
+    curl_off_t port;
     size_t keep = portptr - hostname;
 
-    /* Browser behavior adaptation. If there's a colon with no digits after,
-       just cut off the name there which makes us ignore the colon and just
-       use the default port. Firefox, Chrome and Safari all do that.
+    /* Browser behavior adaptation. If there is a colon with no digits after,
+       cut off the name there which makes us ignore the colon and use the
+       default port. Firefox, Chrome and Safari all do that.
 
-       Don't do it if the URL has no scheme, to make something that looks like
+       Do not do it if the URL has no scheme, to make something that looks like
        a scheme not work!
     */
-    Curl_dyn_setlen(host, keep);
+    curlx_dyn_setlen(host, keep);
     portptr++;
     if(!*portptr)
       return has_scheme ? CURLUE_OK : CURLUE_BAD_PORT_NUMBER;
 
-    if(!ISDIGIT(*portptr))
+    if(curlx_str_number(&portptr, &port, 0xffff) || *portptr)
       return CURLUE_BAD_PORT_NUMBER;
 
-    port = strtol(portptr, &rest, 10);  /* Port number must be decimal */
-
-    if(port > 0xffff)
-      return CURLUE_BAD_PORT_NUMBER;
-
-    if(rest[0])
-      return CURLUE_BAD_PORT_NUMBER;
-
-    u->portnum = port;
+    u->portnum = (unsigned short)port;
     /* generate a new port number string to get rid of leading zeroes etc */
-    free(u->port);
-    u->port = aprintf("%ld", port);
+    curlx_free(u->port);
+    u->port = curl_maprintf("%" CURL_FORMAT_CURL_OFF_T, port);
     if(!u->port)
       return CURLUE_OUT_OF_MEMORY;
   }
@@ -558,9 +404,15 @@ UNITTEST CURLUcode Curl_parse_port(struct Curl_URL *u, struct dynbuf *host,
   return CURLUE_OK;
 }
 
-/* this assumes 'hostname' now starts with [ */
-static CURLUcode ipv6_parse(struct Curl_URL *u, char *hostname,
-                            size_t hlen) /* length of hostname */
+/* This function assumes 'hostname' now starts with [. It trims 'hostname' in
+ * place and it sets u->zoneid if present.
+ *
+ * @unittest 1675
+ */
+UNITTEST CURLUcode ipv6_parse(struct Curl_URL *u, char *hostname,
+                              size_t hlen);
+UNITTEST CURLUcode ipv6_parse(struct Curl_URL *u, char *hostname,
+                              size_t hlen) /* length of hostname */
 {
   size_t len;
   DEBUGASSERT(*hostname == '[');
@@ -579,7 +431,7 @@ static CURLUcode ipv6_parse(struct Curl_URL *u, char *hostname,
       char zoneid[16];
       int i = 0;
       char *h = &hostname[len + 1];
-      /* pass '25' if present and is a url encoded percent sign */
+      /* pass '25' if present and is a URL encoded percent sign */
       if(!strncmp(h, "25", 2) && h[2] && (h[2] != ']'))
         h += 2;
       while(*h && (*h != ']') && (i < 15))
@@ -587,7 +439,7 @@ static CURLUcode ipv6_parse(struct Curl_URL *u, char *hostname,
       if(!i || (']' != *h))
         return CURLUE_BAD_IPV6;
       zoneid[i] = 0;
-      u->zoneid = strdup(zoneid);
+      u->zoneid = curlx_strdup(zoneid);
       if(!u->zoneid)
         return CURLUE_OUT_OF_MEMORY;
       hostname[len] = ']'; /* insert end bracket */
@@ -598,19 +450,14 @@ static CURLUcode ipv6_parse(struct Curl_URL *u, char *hostname,
     /* hostname is fine */
   }
 
-  /* Check the IPv6 address. */
+  /* Normalize the IPv6 address */
   {
     char dest[16]; /* fits a binary IPv6 address */
-    char norm[MAX_IPADR_LEN];
     hostname[hlen] = 0; /* end the address there */
-    if(1 != Curl_inet_pton(AF_INET6, hostname, dest))
+    if(curlx_inet_pton(AF_INET6, hostname, dest) != 1)
       return CURLUE_BAD_IPV6;
-
-    /* check if it can be done shorter */
-    if(Curl_inet_ntop(AF_INET6, dest, norm, sizeof(norm)) &&
-       (strlen(norm) < hlen)) {
-      strcpy(hostname, norm);
-      hlen = strlen(norm);
+    if(curlx_inet_ntop(AF_INET6, dest, hostname, hlen + 1)) {
+      hlen = strlen(hostname); /* might be shorter now */
       hostname[hlen + 1] = 0;
     }
     hostname[hlen] = ']'; /* restore ending bracket */
@@ -630,10 +477,17 @@ static CURLUcode hostname_check(struct Curl_URL *u, char *hostname,
     return ipv6_parse(u, hostname, hlen);
   else {
     /* letters from the second string are not ok */
-    len = strcspn(hostname, " \r\n\t/:#?!@{}[]\\$\'\"^`*<>=;,+&()%");
+    len = strcspn(hostname, " \r\n\t/:#?!@{}[]\\$\'\"^`*<>=;,+&()%|");
     if(hlen != len)
       /* hostname with bad content */
       return CURLUE_BAD_HOSTNAME;
+    else if((hlen >= 2) &&
+            (hostname[hlen - 1] == '.') && (hostname[hlen - 2] == '.'))
+      /* more than one trailing dot is not allowed */
+      return CURLUE_BAD_HOSTNAME;
+    else if((hlen == 1) && (hostname[0] == '.'))
+      /* a single dot alone is not allowed */
+      return CURLUE_BAD_HOSTNAME;
   }
   return CURLUE_OK;
 }
@@ -648,44 +502,61 @@ static CURLUcode hostname_check(struct Curl_URL *u, char *hostname,
  * Output the "normalized" version of that input string in plain quad decimal
  * integers.
  *
+ * A single dot following the numerical address is accepted and "swallowed" as
+ * if it was never there.
+ *
  * Returns the host type.
+ *
+ * @unittest 1675
  */
-
-#define HOST_ERROR   -1 /* out of memory */
-#define HOST_BAD     -2 /* bad IPv4 address */
-
-#define HOST_NAME    1
-#define HOST_IPV4    2
-#define HOST_IPV6    3
-
-static int ipv4_normalize(struct dynbuf *host)
+UNITTEST int ipv4_normalize(struct dynbuf *host);
+UNITTEST int ipv4_normalize(struct dynbuf *host)
 {
   bool done = FALSE;
   int n = 0;
-  const char *c = Curl_dyn_ptr(host);
-  unsigned long parts[4] = {0, 0, 0, 0};
+  const char *c = curlx_dyn_ptr(host);
+  unsigned int parts[4] = { 0, 0, 0, 0 };
   CURLcode result = CURLE_OK;
 
   if(*c == '[')
     return HOST_IPV6;
 
   while(!done) {
-    char *endp;
-    unsigned long l;
-    if(!ISDIGIT(*c))
-      /* most importantly this doesn't allow a leading plus or minus */
-      return HOST_NAME;
-    l = strtoul(c, &endp, 0);
+    int rc;
+    curl_off_t l;
+    if(*c == '0') {
+      if(Curl_raw_tolower(c[1]) == 'x') {
+        c += 2; /* skip the prefix */
+        rc = curlx_str_hex(&c, &l, UINT_MAX);
+        if(rc)
+          return HOST_NAME;
+      }
+      else
+        rc = curlx_str_octal(&c, &l, UINT_MAX);
+    }
+    else
+      rc = curlx_str_number(&c, &l, UINT_MAX);
 
-    parts[n] = l;
-    c = endp;
+    if(rc) {
+      if(!n || (rc != STRE_NO_NUM) || *c)
+        return HOST_NAME;
+      n--;
+    }
+    else
+      parts[n] = (unsigned int)l;
 
     switch(*c) {
     case '.':
-      if(n == 3)
-        return HOST_NAME;
-      n++;
-      c++;
+      if(n == 3) {
+        if(c[1])
+          /* something follows this dot */
+          return HOST_NAME;
+        done = TRUE;
+      }
+      else {
+        n++;
+        c++;
+      }
       break;
 
     case '\0':
@@ -695,49 +566,48 @@ static int ipv4_normalize(struct dynbuf *host)
     default:
       return HOST_NAME;
     }
-
-    /* overflow */
-    if((l == ULONG_MAX) && (errno == ERANGE))
-      return HOST_NAME;
-
-#if SIZEOF_LONG > 4
-    /* a value larger than 32 bits */
-    if(l > UINT_MAX)
-      return HOST_NAME;
-#endif
   }
 
   switch(n) {
   case 0: /* a -- 32 bits */
-    Curl_dyn_reset(host);
+    curlx_dyn_reset(host);
 
-    result = Curl_dyn_addf(host, "%u.%u.%u.%u",
-                           parts[0] >> 24, (parts[0] >> 16) & 0xff,
-                           (parts[0] >> 8) & 0xff, parts[0] & 0xff);
+    result = curlx_dyn_addf(host, "%u.%u.%u.%u",
+                            (parts[0] >> 24),
+                            ((parts[0] >> 16) & 0xff),
+                            ((parts[0] >> 8) & 0xff),
+                            (parts[0] & 0xff));
     break;
   case 1: /* a.b -- 8.24 bits */
     if((parts[0] > 0xff) || (parts[1] > 0xffffff))
       return HOST_NAME;
-    Curl_dyn_reset(host);
-    result = Curl_dyn_addf(host, "%u.%u.%u.%u",
-                           parts[0], (parts[1] >> 16) & 0xff,
-                           (parts[1] >> 8) & 0xff, parts[1] & 0xff);
+    curlx_dyn_reset(host);
+    result = curlx_dyn_addf(host, "%u.%u.%u.%u",
+                            (parts[0]),
+                            ((parts[1] >> 16) & 0xff),
+                            ((parts[1] >> 8) & 0xff),
+                            (parts[1] & 0xff));
     break;
   case 2: /* a.b.c -- 8.8.16 bits */
     if((parts[0] > 0xff) || (parts[1] > 0xff) || (parts[2] > 0xffff))
       return HOST_NAME;
-    Curl_dyn_reset(host);
-    result = Curl_dyn_addf(host, "%u.%u.%u.%u",
-                           parts[0], parts[1], (parts[2] >> 8) & 0xff,
-                           parts[2] & 0xff);
+    curlx_dyn_reset(host);
+    result = curlx_dyn_addf(host, "%u.%u.%u.%u",
+                            (parts[0]),
+                            (parts[1]),
+                            ((parts[2] >> 8) & 0xff),
+                            (parts[2] & 0xff));
     break;
   case 3: /* a.b.c.d -- 8.8.8.8 bits */
     if((parts[0] > 0xff) || (parts[1] > 0xff) || (parts[2] > 0xff) ||
        (parts[3] > 0xff))
       return HOST_NAME;
-    Curl_dyn_reset(host);
-    result = Curl_dyn_addf(host, "%u.%u.%u.%u",
-                           parts[0], parts[1], parts[2], parts[3]);
+    curlx_dyn_reset(host);
+    result = curlx_dyn_addf(host, "%u.%u.%u.%u",
+                            (parts[0]),
+                            (parts[1]),
+                            (parts[2]),
+                            (parts[3]));
     break;
   }
   if(result)
@@ -748,8 +618,8 @@ static int ipv4_normalize(struct dynbuf *host)
 /* if necessary, replace the host content with a URL decoded version */
 static CURLUcode urldecode_host(struct dynbuf *host)
 {
-  char *per = NULL;
-  const char *hostname = Curl_dyn_ptr(host);
+  const char *per;
+  const char *hostname = curlx_dyn_ptr(host);
   per = strchr(hostname, '%');
   if(!per)
     /* nothing to decode */
@@ -762,11 +632,11 @@ static CURLUcode urldecode_host(struct dynbuf *host)
                                      REJECT_CTRL);
     if(result)
       return CURLUE_BAD_HOSTNAME;
-    Curl_dyn_reset(host);
-    result = Curl_dyn_addn(host, decoded, dlen);
-    free(decoded);
+    curlx_dyn_reset(host);
+    result = curlx_dyn_addn(host, decoded, dlen);
+    curlx_free(decoded);
     if(result)
-      return CURLUE_OUT_OF_MEMORY;
+      return cc2cu(result);
   }
 
   return CURLUE_OK;
@@ -779,69 +649,71 @@ static CURLUcode parse_authority(struct Curl_URL *u,
                                  bool has_scheme)
 {
   size_t offset;
-  CURLUcode result;
+  CURLUcode uc;
+  CURLcode result;
 
   /*
-   * Parse the login details and strip them out of the host name.
+   * Parse the login details and strip them out of the hostname.
    */
-  result = parse_hostname_login(u, auth, authlen, flags, &offset);
-  if(result)
-    goto out;
+  uc = parse_hostname_login(u, auth, authlen, flags, &offset);
+  if(uc)
+    return uc;
 
-  if(Curl_dyn_addn(host, auth + offset, authlen - offset)) {
-    result = CURLUE_OUT_OF_MEMORY;
-    goto out;
+  result = curlx_dyn_addn(host, auth + offset, authlen - offset);
+  if(result) {
+    uc = cc2cu(result);
+    return uc;
   }
 
-  result = Curl_parse_port(u, host, has_scheme);
-  if(result)
-    goto out;
+  uc = parse_port(u, host, has_scheme);
+  if(uc)
+    return uc;
 
-  if(!Curl_dyn_len(host))
-    return CURLUE_NO_HOST;
+  if(!curlx_dyn_len(host))
+    uc = CURLUE_NO_HOST;
+  else
+    uc = urldecode_host(host);
+  if(uc)
+    return uc;
 
   switch(ipv4_normalize(host)) {
   case HOST_IPV4:
     break;
   case HOST_IPV6:
-    result = ipv6_parse(u, Curl_dyn_ptr(host), Curl_dyn_len(host));
+    uc = ipv6_parse(u, curlx_dyn_ptr(host), curlx_dyn_len(host));
     break;
   case HOST_NAME:
-    result = urldecode_host(host);
-    if(!result)
-      result = hostname_check(u, Curl_dyn_ptr(host), Curl_dyn_len(host));
+    uc = hostname_check(u, curlx_dyn_ptr(host), curlx_dyn_len(host));
     break;
   case HOST_ERROR:
-    result = CURLUE_OUT_OF_MEMORY;
+    uc = CURLUE_OUT_OF_MEMORY;
     break;
-  case HOST_BAD:
   default:
-    result = CURLUE_BAD_HOSTNAME; /* Bad IPv4 address even */
+    uc = CURLUE_BAD_HOSTNAME; /* Bad IPv4 address even */
     break;
   }
 
-out:
-  return result;
+  return uc;
 }
 
-CURLUcode Curl_url_set_authority(CURLU *u, const char *authority,
-                                 unsigned int flags)
+/* used for HTTP/2 server push */
+CURLUcode Curl_url_set_authority(CURLU *u, const char *authority)
 {
-  CURLUcode result;
+  CURLUcode ures;
   struct dynbuf host;
 
   DEBUGASSERT(authority);
-  Curl_dyn_init(&host, CURL_MAX_INPUT_LENGTH);
+  curlx_dyn_init(&host, CURL_MAX_INPUT_LENGTH);
 
-  result = parse_authority(u, authority, strlen(authority), flags,
-                           &host, !!u->scheme);
-  if(result)
-    Curl_dyn_free(&host);
+  ures = parse_authority(u, authority, strlen(authority),
+                         CURLU_DISALLOW_USER, &host, !!u->scheme);
+  if(ures)
+    curlx_dyn_free(&host);
   else {
-    free(u->host);
-    u->host = Curl_dyn_ptr(&host);
+    curlx_free(u->host);
+    u->host = curlx_dyn_ptr(&host);
   }
-  return result;
+  return ures;
 }
 
 /*
@@ -849,486 +721,498 @@ CURLUcode Curl_url_set_authority(CURLU *u, const char *authority,
  * https://datatracker.ietf.org/doc/html/rfc3986#section-5.2.4
  */
 
+static bool is_dot(const char **str, size_t *clen)
+{
+  const char *p = *str;
+  if(*p == '.') {
+    (*str)++;
+    (*clen)--;
+    return TRUE;
+  }
+  else if((*clen >= 3) &&
+          (p[0] == '%') && (p[1] == '2') && ((p[2] | 0x20) == 'e')) {
+    *str += 3;
+    *clen -= 3;
+    return TRUE;
+  }
+  return FALSE;
+}
+
+#define ISSLASH(x) ((x) == '/')
+
 /*
  * dedotdotify()
- * @unittest: 1395
  *
  * This function gets a null-terminated path with dot and dotdot sequences
  * passed in and strips them off according to the rules in RFC 3986 section
  * 5.2.4.
  *
- * The function handles a query part ('?' + stuff) appended but it expects
- * that fragments ('#' + stuff) have already been cut off.
+ * The function handles a path. It should not contain the query nor fragment.
  *
  * RETURNS
  *
  * Zero for success and 'out' set to an allocated dedotdotified string.
+ *
+ * @unittest 1395
  */
 UNITTEST int dedotdotify(const char *input, size_t clen, char **outp);
 UNITTEST int dedotdotify(const char *input, size_t clen, char **outp)
 {
-  char *outptr;
-  const char *endp = &input[clen];
-  char *out;
+  struct dynbuf out;
+  CURLcode result = CURLE_OK;
+
+  /* variables for leading dot checks */
+  const char *dinput = input;
+  size_t dlen = clen;
 
   *outp = NULL;
-  /* the path always starts with a slash, and a slash has not dot */
-  if((clen < 2) || !memchr(input, '.', clen))
+  /* a single byte path cannot be cleaned up */
+  if(clen < 2)
     return 0;
 
-  out = malloc(clen + 1);
-  if(!out)
-    return 1; /* out of memory */
+  curlx_dyn_init(&out, clen + 1);
 
-  *out = 0; /* null-terminates, for inputs like "./" */
-  outptr = out;
+  /* if the input buffer begins with a prefix of "../" or "./", then remove
+     that prefix from the input buffer; otherwise, */
+  if(is_dot(&dinput, &dlen)) {
+    if(ISSLASH(*dinput)) {
+      /* one dot followed by a slash */
+      input = dinput + 1;
+      clen = dlen - 1;
+    }
 
-  do {
-    bool dotdot = TRUE;
-    if(*input == '.') {
-      /*  A.  If the input buffer begins with a prefix of "../" or "./", then
-          remove that prefix from the input buffer; otherwise, */
-
-      if(!strncmp("./", input, 2)) {
-        input += 2;
-        clen -= 2;
+    /* if the input buffer consists only of "." or "..", then remove
+       that from the input buffer; otherwise, */
+    else if(is_dot(&dinput, &dlen)) {
+      if(!dlen)
+        /* .. [end] */
+        goto end;
+      else if(ISSLASH(*dinput)) {
+        /* ../ */
+        input = dinput + 1;
+        clen = dlen - 1;
       }
-      else if(!strncmp("../", input, 3)) {
-        input += 3;
-        clen -= 3;
-      }
-      /*  D.  if the input buffer consists only of "." or "..", then remove
-          that from the input buffer; otherwise, */
+    }
+  }
 
-      else if(!strcmp(".", input) || !strcmp("..", input) ||
-              !strncmp(".?", input, 2) || !strncmp("..?", input, 3)) {
-        *out = 0;
-        break;
+  while(clen && !result) { /* until end of path content */
+    if(ISSLASH(*input)) {
+      const char *p = &input[1];
+      size_t blen = clen - 1;
+      /* if the input buffer begins with a prefix of "/./" or "/.", where "."
+         is a complete path segment, then replace that prefix with "/" in the
+         input buffer; otherwise, */
+      if(is_dot(&p, &blen)) {
+        if(!blen) { /* /. */
+          result = curlx_dyn_addn(&out, "/", 1);
+          break;
+        }
+        else if(ISSLASH(*p)) { /* /./ */
+          input = p;
+          clen = blen;
+          continue;
+        }
+
+        /* if the input buffer begins with a prefix of "/../" or "/..", where
+           ".." is a complete path segment, then replace that prefix with "/"
+           in the input buffer and remove the last segment and its preceding
+           "/" (if any) from the output buffer; otherwise, */
+        else if(is_dot(&p, &blen) && (ISSLASH(*p) || !blen)) {
+          /* remove the last segment from the output buffer */
+          size_t len = curlx_dyn_len(&out);
+          if(len) {
+            const char *ptr = curlx_dyn_ptr(&out);
+            const char *last = memrchr(ptr, '/', len);
+            if(last)
+              /* trim the output at the slash */
+              curlx_dyn_setlen(&out, last - ptr);
+          }
+
+          if(blen) { /* /../ */
+            input = p;
+            clen = blen;
+            continue;
+          }
+          result = curlx_dyn_addn(&out, "/", 1);
+          break;
+        }
+      }
+    }
+
+    /* move the first path segment in the input buffer to the end of the
+       output buffer, including the initial "/" character (if any) and any
+       subsequent characters up to, but not including, the next "/" character
+       or the end of the input buffer. */
+
+    result = curlx_dyn_addn(&out, input, 1);
+    input++;
+    clen--;
+  }
+end:
+  if(!result) {
+    if(curlx_dyn_len(&out))
+      *outp = curlx_dyn_ptr(&out);
+    else {
+      *outp = curlx_strdup("");
+      if(!*outp)
+        return 1;
+    }
+  }
+  return result ? 1 : 0; /* success */
+}
+
+/*
+ * @unittest 1675
+ */
+UNITTEST CURLUcode parse_file(const char *url, size_t urllen, CURLU *u,
+                              const char **pathp, size_t *pathlenp);
+UNITTEST CURLUcode parse_file(const char *url, size_t urllen, CURLU *u,
+                              const char **pathp, size_t *pathlenp)
+{
+  const char *path;
+  size_t pathlen;
+
+  *pathp = NULL;
+  *pathlenp = 0;
+  if(urllen <= 6)
+    /* file:/ is not enough to actually be a complete file: URL */
+    return CURLUE_BAD_FILE_URL;
+
+  /* path has been allocated large enough to hold this */
+  path = &url[5];
+  pathlen = urllen - 5;
+
+  /* RFC 8089: file-hier-part = ( "//" auth-path ) / local-path, where
+     local-path also starts with a "/". So reject anything that does not
+     start with at least one "/" */
+  if(path[0] != '/')
+    return CURLUE_BAD_FILE_URL;
+
+  /* Extra handling URLs with an authority component (i.e. that start with
+   * "file://")
+   *
+   * We allow omitted hostname (e.g. file:/<path>) -- valid according to
+   * RFC 8089, but not the (current) WHAT-WG URL spec.
+   */
+  if(path[1] == '/') {
+    /* swallow the two slashes */
+    const char *ptr = &path[2];
+
+    /*
+     * According to RFC 8089, a file: URL can be reliably dereferenced if:
+     *
+     *  o it has no/blank hostname, or
+     *
+     *  o the hostname matches "localhost" (case-insensitively), or
+     *
+     *  o the hostname is a FQDN that resolves to this machine, or
+     *
+     * For brevity, we only consider URLs with empty, "localhost", or
+     * "127.0.0.1" hostnames as local, otherwise as an UNC String.
+     *
+     * Additionally, there is an exception for URLs with a Windows drive
+     * letter in the authority (which was accidentally omitted from RFC 8089
+     * Appendix E, but believe me, it was meant to be there. --MK)
+     */
+    if(ptr[0] != '/' && !STARTS_WITH_URL_DRIVE_PREFIX(ptr)) {
+      /* the URL includes a hostname, it must match "localhost" or
+         "127.0.0.1" to be valid */
+      if(checkprefix("localhost/", ptr) ||
+         checkprefix("127.0.0.1/", ptr)) {
+        ptr += 9; /* now points to the slash after the host */
       }
       else
-        dotdot = FALSE;
-    }
-    else if(*input == '/') {
-      /*  B.  if the input buffer begins with a prefix of "/./" or "/.", where
-          "."  is a complete path segment, then replace that prefix with "/" in
-          the input buffer; otherwise, */
-      if(!strncmp("/./", input, 3)) {
-        input += 2;
-        clen -= 2;
-      }
-      else if(!strcmp("/.", input) || !strncmp("/.?", input, 3)) {
-        *outptr++ = '/';
-        *outptr = 0;
-        break;
-      }
-
-      /*  C.  if the input buffer begins with a prefix of "/../" or "/..",
-          where ".." is a complete path segment, then replace that prefix with
-          "/" in the input buffer and remove the last segment and its
-          preceding "/" (if any) from the output buffer; otherwise, */
-
-      else if(!strncmp("/../", input, 4)) {
-        input += 3;
-        clen -= 3;
-        /* remove the last segment from the output buffer */
-        while(outptr > out) {
-          outptr--;
-          if(*outptr == '/')
-            break;
-        }
-        *outptr = 0; /* null-terminate where it stops */
-      }
-      else if(!strcmp("/..", input) || !strncmp("/..?", input, 4)) {
-        /* remove the last segment from the output buffer */
-        while(outptr > out) {
-          outptr--;
-          if(*outptr == '/')
-            break;
-        }
-        *outptr++ = '/';
-        *outptr = 0; /* null-terminate where it stops */
-        break;
-      }
-      else
-        dotdot = FALSE;
-    }
-    else
-      dotdot = FALSE;
-
-    if(!dotdot) {
-      /*  E.  move the first path segment in the input buffer to the end of
-          the output buffer, including the initial "/" character (if any) and
-          any subsequent characters up to, but not including, the next "/"
-          character or the end of the input buffer. */
-
-      do {
-        *outptr++ = *input++;
-        clen--;
-      } while(*input && (*input != '/') && (*input != '?'));
-      *outptr = 0;
+        /* Invalid file://hostname/, expected localhost or 127.0.0.1 or
+           none */
+        return CURLUE_BAD_FILE_URL;
     }
 
-    /* continue until end of path */
-  } while(input < endp);
+    path = ptr;
+    pathlen = urllen - (ptr - url);
+  }
 
-  *outp = out;
-  return 0; /* success */
+#if !defined(_WIN32) && !defined(MSDOS) && !defined(__CYGWIN__)
+  /* Do not allow Windows drive letters when not in Windows.
+   * This catches both "file:/c:" and "file:c:" */
+  if(('/' == path[0] && STARTS_WITH_URL_DRIVE_PREFIX(&path[1])) ||
+     STARTS_WITH_URL_DRIVE_PREFIX(path)) {
+    /* File drive letters are only accepted in MS-DOS/Windows */
+    return CURLUE_BAD_FILE_URL;
+  }
+#else
+  /* If the path starts with a slash and a drive letter, ditch the slash */
+  if('/' == path[0] && STARTS_WITH_URL_DRIVE_PREFIX(&path[1])) {
+    /* This cannot be done with strcpy, as the memory chunks overlap! */
+    path++;
+    pathlen--;
+  }
+#endif
+  u->scheme = curlx_strdup("file");
+  if(!u->scheme)
+    return CURLUE_OUT_OF_MEMORY;
+
+  *pathp = path;
+  *pathlenp = pathlen;
+  return CURLUE_OK;
+}
+
+static CURLUcode parse_scheme(const char *url, CURLU *u, char *schemebuf,
+                              size_t schemelen, unsigned int flags,
+                              const char **hostpp)
+{
+  /* clear path */
+  const char *schemep = NULL;
+
+  if(schemelen) {
+    int i = 0;
+    const char *p = &url[schemelen + 1];
+    while((*p == '/') && (i < 4)) {
+      p++;
+      i++;
+    }
+
+    schemep = schemebuf;
+    if(!Curl_get_scheme(schemep) &&
+       !(flags & CURLU_NON_SUPPORT_SCHEME))
+      return CURLUE_UNSUPPORTED_SCHEME;
+
+    if((i < 1) || (i > 3))
+      /* less than one or more than three slashes */
+      return CURLUE_BAD_SLASHES;
+
+    *hostpp = p; /* hostname starts here */
+  }
+  else {
+    /* no scheme! */
+
+    if(!(flags & (CURLU_DEFAULT_SCHEME | CURLU_GUESS_SCHEME)))
+      return CURLUE_BAD_SCHEME;
+
+    if(flags & CURLU_DEFAULT_SCHEME)
+      schemep = DEFAULT_SCHEME;
+
+    /*
+     * The URL was badly formatted, let's try without scheme specified.
+     */
+    *hostpp = url;
+  }
+
+  if(schemep) {
+    u->scheme = curlx_strdup(schemep);
+    if(!u->scheme)
+      return CURLUE_OUT_OF_MEMORY;
+  }
+  return CURLUE_OK;
+}
+
+static CURLUcode guess_scheme(CURLU *u, struct dynbuf *host)
+{
+  const char *hostname = curlx_dyn_ptr(host);
+  const char *schemep = NULL;
+  /* legacy curl-style guess based on hostname */
+  if(checkprefix("ftp.", hostname))
+    schemep = "ftp";
+  else if(checkprefix("dict.", hostname))
+    schemep = "dict";
+  else if(checkprefix("ldap.", hostname))
+    schemep = "ldap";
+  else if(checkprefix("imap.", hostname))
+    schemep = "imap";
+  else if(checkprefix("smtp.", hostname))
+    schemep = "smtp";
+  else if(checkprefix("pop3.", hostname))
+    schemep = "pop3";
+  else
+    schemep = "http";
+
+  u->scheme = curlx_strdup(schemep);
+  if(!u->scheme)
+    return CURLUE_OUT_OF_MEMORY;
+
+  u->guessed_scheme = TRUE;
+  return CURLUE_OK;
+}
+
+static CURLUcode handle_fragment(CURLU *u, const char *fragment,
+                                 size_t fraglen, unsigned int flags)
+{
+  CURLUcode ures;
+  u->fragment_present = TRUE;
+  if(fraglen > 1) {
+    /* skip the leading '#' in the copy but include the null-terminator */
+    if(flags & CURLU_URLENCODE) {
+      struct dynbuf enc;
+      curlx_dyn_init(&enc, CURL_MAX_INPUT_LENGTH);
+      ures = urlencode_str(&enc, fragment + 1, fraglen - 1, TRUE, QUERY_NO);
+      if(ures)
+        return ures;
+      u->fragment = curlx_dyn_ptr(&enc);
+    }
+    else {
+      u->fragment = curlx_memdup0(fragment + 1, fraglen - 1);
+      if(!u->fragment)
+        return CURLUE_OUT_OF_MEMORY;
+    }
+  }
+  return CURLUE_OK;
+}
+
+static CURLUcode handle_query(CURLU *u, const char *query,
+                              size_t qlen, unsigned int flags)
+{
+  u->query_present = TRUE;
+  if(qlen > 1) {
+    if(flags & CURLU_URLENCODE) {
+      struct dynbuf enc;
+      CURLUcode ures;
+      curlx_dyn_init(&enc, CURL_MAX_INPUT_LENGTH);
+      /* skip the leading question mark */
+      ures = urlencode_str(&enc, query + 1, qlen - 1, TRUE, QUERY_YES);
+      if(ures)
+        return ures;
+      u->query = curlx_dyn_ptr(&enc);
+    }
+    else {
+      u->query = curlx_memdup0(query + 1, qlen - 1);
+      if(!u->query)
+        return CURLUE_OUT_OF_MEMORY;
+    }
+  }
+  else {
+    /* single byte query */
+    u->query = curlx_strdup("");
+    if(!u->query)
+      return CURLUE_OUT_OF_MEMORY;
+  }
+  return CURLUE_OK;
+}
+
+static CURLUcode handle_path(CURLU *u, const char *path,
+                             size_t pathlen, unsigned int flags,
+                             bool is_file)
+{
+  CURLUcode ures;
+  if(pathlen && (flags & CURLU_URLENCODE)) {
+    struct dynbuf enc;
+    curlx_dyn_init(&enc, CURL_MAX_INPUT_LENGTH);
+    ures = urlencode_str(&enc, path, pathlen, TRUE, QUERY_NO);
+    if(ures)
+      return ures;
+    pathlen = curlx_dyn_len(&enc);
+    path = u->path = curlx_dyn_ptr(&enc);
+  }
+
+  if(pathlen >= (size_t)(1 + !is_file)) {
+    /* paths for file:// scheme can be one byte, others need to be two */
+    if(!u->path) {
+      u->path = curlx_memdup0(path, pathlen);
+      if(!u->path)
+        return CURLUE_OUT_OF_MEMORY;
+      path = u->path;
+    }
+    else if(flags & CURLU_URLENCODE)
+      /* it might have encoded more than the path so cut it */
+      u->path[pathlen] = 0;
+
+    if(!(flags & CURLU_PATH_AS_IS)) {
+      /* remove ../ and ./ sequences according to RFC3986 */
+      char *dedot;
+      int err = dedotdotify(path, pathlen, &dedot);
+      if(err)
+        return CURLUE_OUT_OF_MEMORY;
+      if(dedot) {
+        curlx_free(u->path);
+        u->path = dedot;
+      }
+    }
+  }
+  return CURLUE_OK;
 }
 
 static CURLUcode parseurl(const char *url, CURLU *u, unsigned int flags)
 {
   const char *path;
   size_t pathlen;
-  char *query = NULL;
-  char *fragment = NULL;
   char schemebuf[MAX_SCHEME_LEN + 1];
   size_t schemelen = 0;
   size_t urllen;
-  CURLUcode result = CURLUE_OK;
-  size_t fraglen = 0;
+  CURLUcode ures = CURLUE_OK;
   struct dynbuf host;
+  bool is_file = FALSE;
 
   DEBUGASSERT(url);
 
-  Curl_dyn_init(&host, CURL_MAX_INPUT_LENGTH);
+  curlx_dyn_init(&host, CURL_MAX_INPUT_LENGTH);
 
-  result = junkscan(url, &urllen, flags);
-  if(result)
+  ures = Curl_junkscan(url, &urllen, !!(flags & CURLU_ALLOW_SPACE));
+  if(ures)
     goto fail;
 
   schemelen = Curl_is_absolute_url(url, schemebuf, sizeof(schemebuf),
-                                   flags & (CURLU_GUESS_SCHEME|
+                                   flags & (CURLU_GUESS_SCHEME |
                                             CURLU_DEFAULT_SCHEME));
 
   /* handle the file: scheme */
   if(schemelen && !strcmp(schemebuf, "file")) {
-    bool uncpath = FALSE;
-    if(urllen <= 6) {
-      /* file:/ is not enough to actually be a complete file: URL */
-      result = CURLUE_BAD_FILE_URL;
-      goto fail;
-    }
-
-    /* path has been allocated large enough to hold this */
-    path = (char *)&url[5];
-    pathlen = urllen - 5;
-
-    u->scheme = strdup("file");
-    if(!u->scheme) {
-      result = CURLUE_OUT_OF_MEMORY;
-      goto fail;
-    }
-
-    /* Extra handling URLs with an authority component (i.e. that start with
-     * "file://")
-     *
-     * We allow omitted hostname (e.g. file:/<path>) -- valid according to
-     * RFC 8089, but not the (current) WHAT-WG URL spec.
-     */
-    if(path[0] == '/' && path[1] == '/') {
-      /* swallow the two slashes */
-      const char *ptr = &path[2];
-
-      /*
-       * According to RFC 8089, a file: URL can be reliably dereferenced if:
-       *
-       *  o it has no/blank hostname, or
-       *
-       *  o the hostname matches "localhost" (case-insensitively), or
-       *
-       *  o the hostname is a FQDN that resolves to this machine, or
-       *
-       *  o it is an UNC String transformed to an URI (Windows only, RFC 8089
-       *    Appendix E.3).
-       *
-       * For brevity, we only consider URLs with empty, "localhost", or
-       * "127.0.0.1" hostnames as local, otherwise as an UNC String.
-       *
-       * Additionally, there is an exception for URLs with a Windows drive
-       * letter in the authority (which was accidentally omitted from RFC 8089
-       * Appendix E, but believe me, it was meant to be there. --MK)
-       */
-      if(ptr[0] != '/' && !STARTS_WITH_URL_DRIVE_PREFIX(ptr)) {
-        /* the URL includes a host name, it must match "localhost" or
-           "127.0.0.1" to be valid */
-        if(checkprefix("localhost/", ptr) ||
-           checkprefix("127.0.0.1/", ptr)) {
-          ptr += 9; /* now points to the slash after the host */
-        }
-        else {
-#if defined(WIN32)
-          size_t len;
-
-          /* the host name, NetBIOS computer name, can not contain disallowed
-             chars, and the delimiting slash character must be appended to the
-             host name */
-          path = strpbrk(ptr, "/\\:*?\"<>|");
-          if(!path || *path != '/') {
-            result = CURLUE_BAD_FILE_URL;
-            goto fail;
-          }
-
-          len = path - ptr;
-          if(len) {
-            if(Curl_dyn_addn(&host, ptr, len)) {
-              result = CURLUE_OUT_OF_MEMORY;
-              goto fail;
-            }
-            uncpath = TRUE;
-          }
-
-          ptr -= 2; /* now points to the // before the host in UNC */
-#else
-          /* Invalid file://hostname/, expected localhost or 127.0.0.1 or
-             none */
-          result = CURLUE_BAD_FILE_URL;
-          goto fail;
-#endif
-        }
-      }
-
-      path = ptr;
-      pathlen = urllen - (ptr - url);
-    }
-
-    if(!uncpath)
-      /* no host for file: URLs by default */
-      Curl_dyn_reset(&host);
-
-#if !defined(MSDOS) && !defined(WIN32) && !defined(__CYGWIN__)
-    /* Don't allow Windows drive letters when not in Windows.
-     * This catches both "file:/c:" and "file:c:" */
-    if(('/' == path[0] && STARTS_WITH_URL_DRIVE_PREFIX(&path[1])) ||
-       STARTS_WITH_URL_DRIVE_PREFIX(path)) {
-      /* File drive letters are only accepted in MSDOS/Windows */
-      result = CURLUE_BAD_FILE_URL;
-      goto fail;
-    }
-#else
-    /* If the path starts with a slash and a drive letter, ditch the slash */
-    if('/' == path[0] && STARTS_WITH_URL_DRIVE_PREFIX(&path[1])) {
-      /* This cannot be done with strcpy, as the memory chunks overlap! */
-      path++;
-      pathlen--;
-    }
-#endif
-
+    is_file = TRUE;
+    ures = parse_file(url, urllen, u, &path, &pathlen);
   }
   else {
-    /* clear path */
-    const char *schemep = NULL;
-    const char *hostp;
+    const char *hostp = NULL;
     size_t hostlen;
+    ures = parse_scheme(url, u, schemebuf, schemelen, flags, &hostp);
+    if(ures)
+      goto fail;
 
-    if(schemelen) {
-      int i = 0;
-      const char *p = &url[schemelen + 1];
-      while((*p == '/') && (i < 4)) {
-        p++;
-        i++;
-      }
-
-      schemep = schemebuf;
-      if(!Curl_builtin_scheme(schemep, CURL_ZERO_TERMINATED) &&
-         !(flags & CURLU_NON_SUPPORT_SCHEME)) {
-        result = CURLUE_UNSUPPORTED_SCHEME;
-        goto fail;
-      }
-
-      if((i < 1) || (i > 3)) {
-        /* less than one or more than three slashes */
-        result = CURLUE_BAD_SLASHES;
-        goto fail;
-      }
-      hostp = p; /* host name starts here */
-    }
-    else {
-      /* no scheme! */
-
-      if(!(flags & (CURLU_DEFAULT_SCHEME|CURLU_GUESS_SCHEME))) {
-        result = CURLUE_BAD_SCHEME;
-        goto fail;
-      }
-      if(flags & CURLU_DEFAULT_SCHEME)
-        schemep = DEFAULT_SCHEME;
-
-      /*
-       * The URL was badly formatted, let's try without scheme specified.
-       */
-      hostp = url;
-    }
-
-    if(schemep) {
-      u->scheme = strdup(schemep);
-      if(!u->scheme) {
-        result = CURLUE_OUT_OF_MEMORY;
-        goto fail;
-      }
-    }
-
-    /* find the end of the host name + port number */
+    /* find the end of the hostname + port number */
     hostlen = strcspn(hostp, "/?#");
     path = &hostp[hostlen];
 
     /* this pathlen also contains the query and the fragment */
     pathlen = urllen - (path - url);
     if(hostlen) {
-
-      result = parse_authority(u, hostp, hostlen, flags, &host, schemelen);
-      if(result)
-        goto fail;
-
-      if((flags & CURLU_GUESS_SCHEME) && !schemep) {
-        const char *hostname = Curl_dyn_ptr(&host);
-        /* legacy curl-style guess based on host name */
-        if(checkprefix("ftp.", hostname))
-          schemep = "ftp";
-        else if(checkprefix("dict.", hostname))
-          schemep = "dict";
-        else if(checkprefix("ldap.", hostname))
-          schemep = "ldap";
-        else if(checkprefix("imap.", hostname))
-          schemep = "imap";
-        else if(checkprefix("smtp.", hostname))
-          schemep = "smtp";
-        else if(checkprefix("pop3.", hostname))
-          schemep = "pop3";
-        else
-          schemep = "http";
-
-        u->scheme = strdup(schemep);
-        if(!u->scheme) {
-          result = CURLUE_OUT_OF_MEMORY;
-          goto fail;
-        }
-      }
+      ures = parse_authority(u, hostp, hostlen, flags, &host, !!u->scheme);
+      if(!ures && (flags & CURLU_GUESS_SCHEME) && !u->scheme)
+        ures = guess_scheme(u, &host);
     }
     else if(flags & CURLU_NO_AUTHORITY) {
       /* allowed to be empty. */
-      if(Curl_dyn_add(&host, "")) {
-        result = CURLUE_OUT_OF_MEMORY;
-        goto fail;
-      }
+      if(curlx_dyn_add(&host, ""))
+        ures = CURLUE_OUT_OF_MEMORY;
     }
-    else {
-      result = CURLUE_NO_HOST;
-      goto fail;
+    else
+      ures = CURLUE_NO_HOST;
+  }
+  if(!ures) {
+    /* The path might at this point contain a fragment and/or a query to
+       handle */
+    const char *fragment = strchr(path, '#');
+    if(fragment) {
+      size_t fraglen = pathlen - (fragment - path);
+      ures = handle_fragment(u, fragment, fraglen, flags);
+      /* after this, pathlen still contains the query */
+      pathlen -= fraglen;
     }
   }
-
-  fragment = strchr(path, '#');
-  if(fragment) {
-    fraglen = pathlen - (fragment - path);
-    if(fraglen > 1) {
-      /* skip the leading '#' in the copy but include the terminating null */
-      if(flags & CURLU_URLENCODE) {
-        struct dynbuf enc;
-        Curl_dyn_init(&enc, CURL_MAX_INPUT_LENGTH);
-        if(urlencode_str(&enc, fragment + 1, fraglen, TRUE, FALSE)) {
-          result = CURLUE_OUT_OF_MEMORY;
-          goto fail;
-        }
-        u->fragment = Curl_dyn_ptr(&enc);
-      }
-      else {
-        u->fragment = Curl_memdup(fragment + 1, fraglen);
-        if(!u->fragment) {
-          result = CURLUE_OUT_OF_MEMORY;
-          goto fail;
-        }
-      }
-    }
-    /* after this, pathlen still contains the query */
-    pathlen -= fraglen;
-  }
-
-  DEBUGASSERT(pathlen < urllen);
-  query = memchr(path, '?', pathlen);
-  if(query) {
-    size_t qlen = fragment ? (size_t)(fragment - query) :
-      pathlen - (query - path);
-    pathlen -= qlen;
-    if(qlen > 1) {
-      if(flags & CURLU_URLENCODE) {
-        struct dynbuf enc;
-        Curl_dyn_init(&enc, CURL_MAX_INPUT_LENGTH);
-        /* skip the leading question mark */
-        if(urlencode_str(&enc, query + 1, qlen - 1, TRUE, TRUE)) {
-          result = CURLUE_OUT_OF_MEMORY;
-          goto fail;
-        }
-        u->query = Curl_dyn_ptr(&enc);
-      }
-      else {
-        u->query = Curl_memdup(query + 1, qlen);
-        if(!u->query) {
-          result = CURLUE_OUT_OF_MEMORY;
-          goto fail;
-        }
-        u->query[qlen - 1] = 0;
-      }
-    }
-    else {
-      /* single byte query */
-      u->query = strdup("");
-      if(!u->query) {
-        result = CURLUE_OUT_OF_MEMORY;
-        goto fail;
-      }
+  if(!ures) {
+    const char *query = memchr(path, '?', pathlen);
+    if(query) {
+      size_t qlen = pathlen - (query - path);
+      ures = handle_query(u, query, qlen, flags);
+      pathlen -= qlen;
     }
   }
-
-  if(pathlen && (flags & CURLU_URLENCODE)) {
-    struct dynbuf enc;
-    Curl_dyn_init(&enc, CURL_MAX_INPUT_LENGTH);
-    if(urlencode_str(&enc, path, pathlen, TRUE, FALSE)) {
-      result = CURLUE_OUT_OF_MEMORY;
-      goto fail;
-    }
-    pathlen = Curl_dyn_len(&enc);
-    path = u->path = Curl_dyn_ptr(&enc);
+  if(!ures)
+    /* the fragment and query parts are trimmed off from the path */
+    ures = handle_path(u, path, pathlen, flags, is_file);
+  if(!ures) {
+    u->host = curlx_dyn_ptr(&host);
+    return CURLUE_OK;
   }
-
-  if(pathlen <= 1) {
-    /* there is no path left or just the slash, unset */
-    path = NULL;
-  }
-  else {
-    if(!u->path) {
-      u->path = Curl_memdup(path, pathlen + 1);
-      if(!u->path) {
-        result = CURLUE_OUT_OF_MEMORY;
-        goto fail;
-      }
-      u->path[pathlen] = 0;
-      path = u->path;
-    }
-    else if(flags & CURLU_URLENCODE)
-      /* it might have encoded more than just the path so cut it */
-      u->path[pathlen] = 0;
-
-    if(!(flags & CURLU_PATH_AS_IS)) {
-      /* remove ../ and ./ sequences according to RFC3986 */
-      char *dedot;
-      int err = dedotdotify((char *)path, pathlen, &dedot);
-      if(err) {
-        result = CURLUE_OUT_OF_MEMORY;
-        goto fail;
-      }
-      if(dedot) {
-        free(u->path);
-        u->path = dedot;
-      }
-    }
-  }
-
-  u->host = Curl_dyn_ptr(&host);
-
-  return result;
 fail:
-  Curl_dyn_free(&host);
+  curlx_dyn_free(&host);
   free_urlhandle(u);
-  return result;
+  return ures;
 }
 
 /*
@@ -1337,44 +1221,123 @@ fail:
 static CURLUcode parseurl_and_replace(const char *url, CURLU *u,
                                       unsigned int flags)
 {
-  CURLUcode result;
+  CURLUcode ures;
   CURLU tmpurl;
   memset(&tmpurl, 0, sizeof(tmpurl));
-  result = parseurl(url, &tmpurl, flags);
-  if(!result) {
+  ures = parseurl(url, &tmpurl, flags);
+  if(!ures) {
     free_urlhandle(u);
     *u = tmpurl;
   }
-  return result;
+  return ures;
+}
+
+/*
+ * Concatenate a relative URL onto a base URL making it absolute.
+ */
+static CURLUcode redirect_url(const char *base, const char *relurl,
+                              CURLU *u, unsigned int flags)
+{
+  struct dynbuf urlbuf;
+  bool host_changed = FALSE;
+  const char *useurl = relurl;
+  const char *cutoff = NULL;
+  size_t prelen;
+  CURLUcode uc;
+  /* this can get here with a NULL u->scheme only if asked to use the default
+     scheme, so allow fallback to that */
+  const char *scheme = u->scheme ? u->scheme : DEFAULT_SCHEME;
+
+  /* protsep points to the start of the hostname, after [scheme]:// */
+  const char *protsep = base + strlen(scheme) + 3;
+  DEBUGASSERT(base && relurl && u); /* all set here */
+  if(!base)
+    return CURLUE_MALFORMED_INPUT; /* should never happen */
+
+  /* handle different relative URL types */
+  switch(relurl[0]) {
+  case '/':
+    if(relurl[1] == '/') {
+      /* protocol-relative URL: //example.com/path */
+      cutoff = protsep;
+      useurl = &relurl[2];
+      host_changed = TRUE;
+    }
+    else
+      /* absolute /path */
+      cutoff = strchr(protsep, '/');
+    break;
+
+  case '#':
+    /* fragment-only change */
+    if(u->fragment)
+      cutoff = strchr(protsep, '#');
+    break;
+
+  default:
+    /* path or query-only change */
+    if(u->query && u->query[0])
+      /* remove existing query */
+      cutoff = strchr(protsep, '?');
+    else if(u->fragment && u->fragment[0])
+      /* Remove existing fragment */
+      cutoff = strchr(protsep, '#');
+
+    if(relurl[0] != '?') {
+      /* append a relative path after the last slash */
+      cutoff = memrchr(protsep, '/',
+                       cutoff ? (size_t)(cutoff - protsep) : strlen(protsep));
+      if(cutoff)
+        cutoff++; /* truncate after last slash */
+    }
+    break;
+  }
+
+  prelen = cutoff ? (size_t)(cutoff - base) : strlen(base);
+
+  /* build new URL */
+  curlx_dyn_init(&urlbuf, CURL_MAX_INPUT_LENGTH);
+
+  if(!curlx_dyn_addn(&urlbuf, base, prelen) &&
+     !urlencode_str(&urlbuf, useurl, strlen(useurl), !host_changed,
+                    QUERY_NOT_YET)) {
+    uc = parseurl_and_replace(curlx_dyn_ptr(&urlbuf), u,
+                              flags & ~U_CURLU_PATH_AS_IS);
+  }
+  else
+    uc = CURLUE_OUT_OF_MEMORY;
+
+  curlx_dyn_free(&urlbuf);
+  return uc;
 }
 
 /*
  */
 CURLU *curl_url(void)
 {
-  return calloc(sizeof(struct Curl_URL), 1);
+  return curlx_calloc(1, sizeof(struct Curl_URL));
 }
 
 void curl_url_cleanup(CURLU *u)
 {
   if(u) {
     free_urlhandle(u);
-    free(u);
+    curlx_free(u);
   }
 }
 
 #define DUP(dest, src, name)                    \
   do {                                          \
-    if(src->name) {                             \
-      dest->name = strdup(src->name);           \
-      if(!dest->name)                           \
+    if((src)->name) {                           \
+      (dest)->name = curlx_strdup((src)->name); \
+      if(!(dest)->name)                         \
         goto fail;                              \
     }                                           \
   } while(0)
 
 CURLU *curl_url_dup(const CURLU *in)
 {
-  struct Curl_URL *u = calloc(sizeof(struct Curl_URL), 1);
+  struct Curl_URL *u = curlx_calloc(1, sizeof(struct Curl_URL));
   if(u) {
     DUP(u, in, scheme);
     DUP(u, in, user);
@@ -1387,6 +1350,8 @@ CURLU *curl_url_dup(const CURLU *in)
     DUP(u, in, fragment);
     DUP(u, in, zoneid);
     u->portnum = in->portnum;
+    u->fragment_present = in->fragment_present;
+    u->query_present = in->query_present;
   }
   return u;
 fail:
@@ -1394,18 +1359,226 @@ fail:
   return NULL;
 }
 
+#ifndef USE_IDN
+#define host_decode(x, y) CURLUE_LACKS_IDN
+#define host_encode(x, y) CURLUE_LACKS_IDN
+#else
+static CURLUcode host_decode(const char *host, char **allochost)
+{
+  CURLcode result = Curl_idn_decode(host, allochost);
+  if(result)
+    return (result == CURLE_OUT_OF_MEMORY) ?
+      CURLUE_OUT_OF_MEMORY : CURLUE_BAD_HOSTNAME;
+  return CURLUE_OK;
+}
+
+static CURLUcode host_encode(const char *host, char **allochost)
+{
+  CURLcode result = Curl_idn_encode(host, allochost);
+  if(result)
+    return (result == CURLE_OUT_OF_MEMORY) ?
+      CURLUE_OUT_OF_MEMORY : CURLUE_BAD_HOSTNAME;
+  return CURLUE_OK;
+}
+#endif
+
+static CURLUcode urlget_format(const CURLU *u, CURLUPart what,
+                               const char *ptr, char **partp,
+                               bool plusdecode, unsigned int flags)
+{
+  CURLUcode uc = CURLUE_OK;
+  size_t partlen = strlen(ptr);
+  bool urldecode = (flags & CURLU_URLDECODE) ? 1 : 0;
+  bool urlencode = (flags & CURLU_URLENCODE) ? 1 : 0;
+  bool punycode = (flags & CURLU_PUNYCODE) && (what == CURLUPART_HOST);
+  bool depunyfy = (flags & CURLU_PUNY2IDN) && (what == CURLUPART_HOST);
+  char *part = curlx_memdup0(ptr, partlen);
+  *partp = NULL;
+  if(!part)
+    return CURLUE_OUT_OF_MEMORY;
+  if(plusdecode) {
+    /* convert + to space */
+    char *plus = part;
+    size_t i = 0;
+    for(i = 0; i < partlen; ++plus, i++) {
+      if(*plus == '+')
+        *plus = ' ';
+    }
+  }
+  if(urldecode) {
+    char *decoded;
+    size_t dlen;
+    /* this unconditional rejection of control bytes is documented API
+       behavior */
+    CURLcode result = Curl_urldecode(part, partlen, &decoded, &dlen,
+                                     REJECT_CTRL);
+    curlx_free(part);
+    if(result)
+      return CURLUE_URLDECODE;
+    part = decoded;
+    partlen = dlen;
+  }
+  if(urlencode) {
+    struct dynbuf enc;
+    curlx_dyn_init(&enc, CURL_MAX_INPUT_LENGTH);
+    uc = urlencode_str(&enc, part, partlen, TRUE, what == CURLUPART_QUERY ?
+                       QUERY_YES : QUERY_NO);
+    curlx_free(part);
+    if(uc)
+      return uc;
+    part = curlx_dyn_ptr(&enc);
+  }
+  else if(punycode) {
+    if(!Curl_is_ASCII_name(u->host)) {
+      char *punyversion = NULL;
+      uc = host_decode(part, &punyversion);
+      curlx_free(part);
+      if(uc)
+        return uc;
+      part = punyversion;
+    }
+  }
+  else if(depunyfy) {
+    if(Curl_is_ASCII_name(u->host)) {
+      char *unpunified = NULL;
+      uc = host_encode(part, &unpunified);
+      curlx_free(part);
+      if(uc)
+        return uc;
+      part = unpunified;
+    }
+  }
+  *partp = part;
+  return CURLUE_OK;
+}
+
+static CURLUcode file_url(const CURLU *u, char **part,
+                          const char *fragmentsep,
+                          const char *querysep)
+{
+  char *url = curl_maprintf("file://%s%s%s%s%s",
+                            u->path, querysep, u->query ? u->query : "",
+                            fragmentsep, u->fragment ? u->fragment : "");
+  if(!url)
+    return CURLUE_OUT_OF_MEMORY;
+
+  *part = url;
+  return CURLUE_OK;
+}
+
+static CURLUcode urlget_url(const CURLU *u, char **part, unsigned int flags)
+{
+  char *url;
+  char *allochost = NULL;
+  const char *fragmentsep =
+    (u->fragment || (u->fragment_present && flags & CURLU_GET_EMPTY)) ?
+    "#" : "";
+  const char *querysep = ((u->query && u->query[0]) ||
+                          (u->query_present && flags & CURLU_GET_EMPTY)) ?
+    "?" : "";
+  char portbuf[7];
+  if(curl_strequal("file", u->scheme))
+    return file_url(u, part, fragmentsep, querysep);
+  else if(!u->host)
+    return CURLUE_NO_HOST;
+  else {
+    const char *scheme;
+    char *options = u->options;
+    char *port = u->port;
+    const struct Curl_scheme *h = NULL;
+    char schemebuf[MAX_SCHEME_LEN + 5];
+    if(u->scheme)
+      scheme = u->scheme;
+    else if(flags & CURLU_DEFAULT_SCHEME)
+      scheme = DEFAULT_SCHEME;
+    else
+      return CURLUE_NO_SCHEME;
+
+    h = Curl_get_scheme(scheme);
+    if(h) {
+      if(!port && (flags & CURLU_DEFAULT_PORT)) {
+        /* there is no stored port number, but asked to deliver a default one
+           for the scheme */
+        curl_msnprintf(portbuf, sizeof(portbuf), "%u", h->defport);
+        port = portbuf;
+      }
+      else if(port && (h->defport == u->portnum) &&
+              (flags & CURLU_NO_DEFAULT_PORT))
+        /* there is a stored port number, but asked to inhibit if it matches
+           the default port for the scheme */
+        port = NULL;
+      if(!(h->flags & PROTOPT_URLOPTIONS))
+        options = NULL;
+    }
+
+    if(u->host[0] == '[') {
+      if(u->zoneid) {
+        /* make it '[ host %25 zoneid ]' */
+        struct dynbuf enc;
+        size_t hostlen = strlen(u->host);
+        curlx_dyn_init(&enc, CURL_MAX_INPUT_LENGTH);
+        if(curlx_dyn_addf(&enc, "%.*s%%25%s]", (int)hostlen - 1, u->host,
+                          u->zoneid))
+          return CURLUE_OUT_OF_MEMORY;
+        allochost = curlx_dyn_ptr(&enc);
+      }
+    }
+    else if(flags & CURLU_URLENCODE) {
+      allochost = curl_easy_escape(NULL, u->host, 0);
+      if(!allochost)
+        return CURLUE_OUT_OF_MEMORY;
+    }
+    else if(flags & CURLU_PUNYCODE) {
+      if(!Curl_is_ASCII_name(u->host)) {
+        CURLUcode ret = host_decode(u->host, &allochost);
+        if(ret)
+          return ret;
+      }
+    }
+    else if(flags & CURLU_PUNY2IDN) {
+      if(Curl_is_ASCII_name(u->host)) {
+        CURLUcode ret = host_encode(u->host, &allochost);
+        if(ret)
+          return ret;
+      }
+    }
+
+    if(!(flags & CURLU_NO_GUESS_SCHEME) || !u->guessed_scheme)
+      curl_msnprintf(schemebuf, sizeof(schemebuf), "%s://", scheme);
+    else
+      schemebuf[0] = 0;
+
+    url = curl_maprintf("%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
+                        schemebuf,
+                        u->user ? u->user : "",
+                        u->password ? ":" : "",
+                        u->password ? u->password : "",
+                        options ? ";" : "",
+                        options ? options : "",
+                        (u->user || u->password || options) ? "@" : "",
+                        allochost ? allochost : u->host,
+                        port ? ":" : "",
+                        port ? port : "",
+                        u->path ? u->path : "/",
+                        querysep,
+                        u->query ? u->query : "",
+                        fragmentsep,
+                        u->fragment ? u->fragment : "");
+    curlx_free(allochost);
+  }
+  if(!url)
+    return CURLUE_OUT_OF_MEMORY;
+  *part = url;
+  return CURLUE_OK;
+}
+
 CURLUcode curl_url_get(const CURLU *u, CURLUPart what,
                        char **part, unsigned int flags)
 {
   const char *ptr;
   CURLUcode ifmissing = CURLUE_UNKNOWN_PART;
   char portbuf[7];
-  bool urldecode = (flags & CURLU_URLDECODE)?1:0;
-  bool urlencode = (flags & CURLU_URLENCODE)?1:0;
-  bool punycode = FALSE;
-  bool depunyfy = FALSE;
   bool plusdecode = FALSE;
-  (void)flags;
   if(!u)
     return CURLUE_BAD_HANDLE;
   if(!part)
@@ -1416,7 +1589,9 @@ CURLUcode curl_url_get(const CURLU *u, CURLUPart what,
   case CURLUPART_SCHEME:
     ptr = u->scheme;
     ifmissing = CURLUE_NO_SCHEME;
-    urldecode = FALSE; /* never for schemes */
+    flags &= ~U_CURLU_URLDECODE; /* never for schemes */
+    if((flags & CURLU_NO_GUESS_SCHEME) && u->guessed_scheme)
+      return CURLUE_NO_SCHEME;
     break;
   case CURLUPART_USER:
     ptr = u->user;
@@ -1433,8 +1608,6 @@ CURLUcode curl_url_get(const CURLU *u, CURLUPart what,
   case CURLUPART_HOST:
     ptr = u->host;
     ifmissing = CURLUE_NO_HOST;
-    punycode = (flags & CURLU_PUNYCODE)?1:0;
-    depunyfy = (flags & CURLU_PUNY2IDN)?1:0;
     break;
   case CURLUPART_ZONEID:
     ptr = u->zoneid;
@@ -1443,22 +1616,20 @@ CURLUcode curl_url_get(const CURLU *u, CURLUPart what,
   case CURLUPART_PORT:
     ptr = u->port;
     ifmissing = CURLUE_NO_PORT;
-    urldecode = FALSE; /* never for port */
+    flags &= ~U_CURLU_URLDECODE; /* never for port */
     if(!ptr && (flags & CURLU_DEFAULT_PORT) && u->scheme) {
-      /* there's no stored port number, but asked to deliver
+      /* there is no stored port number, but asked to deliver
          a default one for the scheme */
-      const struct Curl_handler *h =
-        Curl_builtin_scheme(u->scheme, CURL_ZERO_TERMINATED);
+      const struct Curl_scheme *h = Curl_get_scheme(u->scheme);
       if(h) {
-        msnprintf(portbuf, sizeof(portbuf), "%u", h->defport);
+        curl_msnprintf(portbuf, sizeof(portbuf), "%u", h->defport);
         ptr = portbuf;
       }
     }
     else if(ptr && u->scheme) {
       /* there is a stored port number, but ask to inhibit if
          it matches the default one for the scheme */
-      const struct Curl_handler *h =
-        Curl_builtin_scheme(u->scheme, CURL_ZERO_TERMINATED);
+      const struct Curl_scheme *h = Curl_get_scheme(u->scheme);
       if(h && (h->defport == u->portnum) &&
          (flags & CURLU_NO_DEFAULT_PORT))
         ptr = NULL;
@@ -1472,285 +1643,47 @@ CURLUcode curl_url_get(const CURLU *u, CURLUPart what,
   case CURLUPART_QUERY:
     ptr = u->query;
     ifmissing = CURLUE_NO_QUERY;
-    plusdecode = urldecode;
+    plusdecode = flags & CURLU_URLDECODE;
+    if(ptr && !ptr[0] && !(flags & CURLU_GET_EMPTY))
+      /* there was a blank query and the user do not ask for it */
+      ptr = NULL;
     break;
   case CURLUPART_FRAGMENT:
     ptr = u->fragment;
     ifmissing = CURLUE_NO_FRAGMENT;
+    if(!ptr && u->fragment_present && flags & CURLU_GET_EMPTY)
+      /* there was a blank fragment and the user asks for it */
+      ptr = "";
     break;
-  case CURLUPART_URL: {
-    char *url;
-    char *scheme;
-    char *options = u->options;
-    char *port = u->port;
-    char *allochost = NULL;
-    punycode = (flags & CURLU_PUNYCODE)?1:0;
-    depunyfy = (flags & CURLU_PUNY2IDN)?1:0;
-    if(u->scheme && strcasecompare("file", u->scheme)) {
-      url = aprintf("file://%s%s%s",
-                    u->path,
-                    u->fragment? "#": "",
-                    u->fragment? u->fragment : "");
-    }
-    else if(!u->host)
-      return CURLUE_NO_HOST;
-    else {
-      const struct Curl_handler *h = NULL;
-      if(u->scheme)
-        scheme = u->scheme;
-      else if(flags & CURLU_DEFAULT_SCHEME)
-        scheme = (char *) DEFAULT_SCHEME;
-      else
-        return CURLUE_NO_SCHEME;
-
-      h = Curl_builtin_scheme(scheme, CURL_ZERO_TERMINATED);
-      if(!port && (flags & CURLU_DEFAULT_PORT)) {
-        /* there's no stored port number, but asked to deliver
-           a default one for the scheme */
-        if(h) {
-          msnprintf(portbuf, sizeof(portbuf), "%u", h->defport);
-          port = portbuf;
-        }
-      }
-      else if(port) {
-        /* there is a stored port number, but asked to inhibit if it matches
-           the default one for the scheme */
-        if(h && (h->defport == u->portnum) &&
-           (flags & CURLU_NO_DEFAULT_PORT))
-          port = NULL;
-      }
-
-      if(h && !(h->flags & PROTOPT_URLOPTIONS))
-        options = NULL;
-
-      if(u->host[0] == '[') {
-        if(u->zoneid) {
-          /* make it '[ host %25 zoneid ]' */
-          struct dynbuf enc;
-          size_t hostlen = strlen(u->host);
-          Curl_dyn_init(&enc, CURL_MAX_INPUT_LENGTH);
-          if(Curl_dyn_addf(&enc, "%.*s%%25%s]", (int)hostlen - 1, u->host,
-                           u->zoneid))
-            return CURLUE_OUT_OF_MEMORY;
-          allochost = Curl_dyn_ptr(&enc);
-        }
-      }
-      else if(urlencode) {
-        allochost = curl_easy_escape(NULL, u->host, 0);
-        if(!allochost)
-          return CURLUE_OUT_OF_MEMORY;
-      }
-      else if(punycode) {
-        if(!Curl_is_ASCII_name(u->host)) {
-#ifndef USE_IDN
-          return CURLUE_LACKS_IDN;
-#else
-          CURLcode result = Curl_idn_decode(u->host, &allochost);
-          if(result)
-            return (result == CURLE_OUT_OF_MEMORY) ?
-              CURLUE_OUT_OF_MEMORY : CURLUE_BAD_HOSTNAME;
-#endif
-        }
-      }
-      else if(depunyfy) {
-        if(Curl_is_ASCII_name(u->host) && !strncmp("xn--", u->host, 4)) {
-#ifndef USE_IDN
-          return CURLUE_LACKS_IDN;
-#else
-          CURLcode result = Curl_idn_encode(u->host, &allochost);
-          if(result)
-            /* this is the most likely error */
-            return (result == CURLE_OUT_OF_MEMORY) ?
-              CURLUE_OUT_OF_MEMORY : CURLUE_BAD_HOSTNAME;
-#endif
-        }
-      }
-
-      url = aprintf("%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
-                    scheme,
-                    u->user ? u->user : "",
-                    u->password ? ":": "",
-                    u->password ? u->password : "",
-                    options ? ";" : "",
-                    options ? options : "",
-                    (u->user || u->password || options) ? "@": "",
-                    allochost ? allochost : u->host,
-                    port ? ":": "",
-                    port ? port : "",
-                    u->path ? u->path : "/",
-                    (u->query && u->query[0]) ? "?": "",
-                    (u->query && u->query[0]) ? u->query : "",
-                    u->fragment? "#": "",
-                    u->fragment? u->fragment : "");
-      free(allochost);
-    }
-    if(!url)
-      return CURLUE_OUT_OF_MEMORY;
-    *part = url;
-    return CURLUE_OK;
-  }
+  case CURLUPART_URL:
+    return urlget_url(u, part, flags);
   default:
     ptr = NULL;
     break;
   }
-  if(ptr) {
-    size_t partlen = strlen(ptr);
-    size_t i = 0;
-    *part = Curl_memdup(ptr, partlen + 1);
-    if(!*part)
-      return CURLUE_OUT_OF_MEMORY;
-    if(plusdecode) {
-      /* convert + to space */
-      char *plus = *part;
-      for(i = 0; i < partlen; ++plus, i++) {
-        if(*plus == '+')
-          *plus = ' ';
-      }
-    }
-    if(urldecode) {
-      char *decoded;
-      size_t dlen;
-      /* this unconditional rejection of control bytes is documented
-         API behavior */
-      CURLcode res = Curl_urldecode(*part, 0, &decoded, &dlen, REJECT_CTRL);
-      free(*part);
-      if(res) {
-        *part = NULL;
-        return CURLUE_URLDECODE;
-      }
-      *part = decoded;
-      partlen = dlen;
-    }
-    if(urlencode) {
-      struct dynbuf enc;
-      Curl_dyn_init(&enc, CURL_MAX_INPUT_LENGTH);
-      if(urlencode_str(&enc, *part, partlen, TRUE,
-                       what == CURLUPART_QUERY))
-        return CURLUE_OUT_OF_MEMORY;
-      free(*part);
-      *part = Curl_dyn_ptr(&enc);
-    }
-    else if(punycode) {
-      if(!Curl_is_ASCII_name(u->host)) {
-#ifndef USE_IDN
-        return CURLUE_LACKS_IDN;
-#else
-        char *allochost;
-        CURLcode result = Curl_idn_decode(*part, &allochost);
-        if(result)
-          return (result == CURLE_OUT_OF_MEMORY) ?
-            CURLUE_OUT_OF_MEMORY : CURLUE_BAD_HOSTNAME;
-        free(*part);
-        *part = allochost;
-#endif
-      }
-    }
-    else if(depunyfy) {
-      if(Curl_is_ASCII_name(u->host)  && !strncmp("xn--", u->host, 4)) {
-#ifndef USE_IDN
-        return CURLUE_LACKS_IDN;
-#else
-        char *allochost;
-        CURLcode result = Curl_idn_encode(*part, &allochost);
-        if(result)
-          return (result == CURLE_OUT_OF_MEMORY) ?
-            CURLUE_OUT_OF_MEMORY : CURLUE_BAD_HOSTNAME;
-        free(*part);
-        *part = allochost;
-#endif
-      }
-    }
+  if(ptr)
+    return urlget_format(u, what, ptr, part, plusdecode, flags);
 
-    return CURLUE_OK;
-  }
-  else
-    return ifmissing;
+  return ifmissing;
 }
 
-CURLUcode curl_url_set(CURLU *u, CURLUPart what,
-                       const char *part, unsigned int flags)
+static CURLUcode set_url_scheme(CURLU *u, const char *scheme,
+                                unsigned int flags)
 {
-  char **storep = NULL;
-  long port = 0;
-  bool urlencode = (flags & CURLU_URLENCODE)? 1 : 0;
-  bool plusencode = FALSE;
-  bool urlskipslash = FALSE;
-  bool leadingslash = FALSE;
-  bool appendquery = FALSE;
-  bool equalsencode = FALSE;
-  size_t nalloc;
-
-  if(!u)
-    return CURLUE_BAD_HANDLE;
-  if(!part) {
-    /* setting a part to NULL clears it */
-    switch(what) {
-    case CURLUPART_URL:
-      break;
-    case CURLUPART_SCHEME:
-      storep = &u->scheme;
-      break;
-    case CURLUPART_USER:
-      storep = &u->user;
-      break;
-    case CURLUPART_PASSWORD:
-      storep = &u->password;
-      break;
-    case CURLUPART_OPTIONS:
-      storep = &u->options;
-      break;
-    case CURLUPART_HOST:
-      storep = &u->host;
-      break;
-    case CURLUPART_ZONEID:
-      storep = &u->zoneid;
-      break;
-    case CURLUPART_PORT:
-      u->portnum = 0;
-      storep = &u->port;
-      break;
-    case CURLUPART_PATH:
-      storep = &u->path;
-      break;
-    case CURLUPART_QUERY:
-      storep = &u->query;
-      break;
-    case CURLUPART_FRAGMENT:
-      storep = &u->fragment;
-      break;
-    default:
-      return CURLUE_UNKNOWN_PART;
-    }
-    if(storep && *storep) {
-      Curl_safefree(*storep);
-    }
-    else if(!storep) {
-      free_urlhandle(u);
-      memset(u, 0, sizeof(struct Curl_URL));
-    }
-    return CURLUE_OK;
-  }
-
-  nalloc = strlen(part);
-  if(nalloc > CURL_MAX_INPUT_LENGTH)
-    /* excessive input length */
-    return CURLUE_MALFORMED_INPUT;
-
-  switch(what) {
-  case CURLUPART_SCHEME: {
-    size_t plen = strlen(part);
-    const char *s = part;
-    if((plen > MAX_SCHEME_LEN) || (plen < 1))
-      /* too long or too short */
-      return CURLUE_BAD_SCHEME;
-    if(!(flags & CURLU_NON_SUPPORT_SCHEME) &&
-       /* verify that it is a fine scheme */
-       !Curl_builtin_scheme(part, CURL_ZERO_TERMINATED))
-      return CURLUE_UNSUPPORTED_SCHEME;
-    storep = &u->scheme;
-    urlencode = FALSE; /* never */
+  size_t plen = strlen(scheme);
+  const struct Curl_scheme *h = NULL;
+  if((plen > MAX_SCHEME_LEN) || (plen < 1))
+    /* too long or too short */
+    return CURLUE_BAD_SCHEME;
+  /* verify that it is a fine scheme */
+  h = Curl_get_scheme(scheme);
+  if(!(flags & CURLU_NON_SUPPORT_SCHEME) && (!h || !h->run))
+    return CURLUE_UNSUPPORTED_SCHEME;
+  if(!h) {
+    const char *s = scheme;
     if(ISALPHA(*s)) {
       /* ALPHA *( ALPHA / DIGIT / "+" / "-" / "." ) */
+      s++;
       while(--plen) {
         if(ISALNUM(*s) || (*s == '+') || (*s == '-') || (*s == '.'))
           s++; /* fine */
@@ -1760,6 +1693,304 @@ CURLUcode curl_url_set(CURLU *u, CURLUPart what,
     }
     else
       return CURLUE_BAD_SCHEME;
+  }
+  u->guessed_scheme = FALSE;
+  return CURLUE_OK;
+}
+
+static CURLUcode set_url_port(CURLU *u, const char *provided_port)
+{
+  char *tmp;
+  curl_off_t port;
+  if(!ISDIGIT(provided_port[0]))
+    /* not a number */
+    return CURLUE_BAD_PORT_NUMBER;
+  if(curlx_str_number(&provided_port, &port, 0xffff) || *provided_port)
+    /* weirdly provided number, not good! */
+    return CURLUE_BAD_PORT_NUMBER;
+  tmp = curl_maprintf("%" CURL_FORMAT_CURL_OFF_T, port);
+  if(!tmp)
+    return CURLUE_OUT_OF_MEMORY;
+  curlx_free(u->port);
+  u->port = tmp;
+  u->portnum = (unsigned short)port;
+  return CURLUE_OK;
+}
+
+static CURLUcode set_url(CURLU *u, const char *url, size_t part_size,
+                         unsigned int flags)
+{
+  /*
+   * Allow a new URL to replace the existing (if any) contents.
+   *
+   * If the existing contents is enough for a URL, allow a relative URL to
+   * replace it.
+   */
+  CURLUcode uc;
+  char *oldurl = NULL;
+
+  if(!part_size) {
+    /* a blank URL is not a valid URL unless we already have a complete one
+       and this is a redirect */
+    uc = curl_url_get(u, CURLUPART_URL, &oldurl, flags);
+    if(!uc) {
+      /* success, meaning the "" is a fine relative URL, and the new URL
+         inherits scheme/authority/path/query, but not fragment, from the
+         existing URL (RFC 3986 section 5.2.2) */
+      curlx_safefree(u->fragment);
+      u->fragment_present = FALSE;
+      curlx_free(oldurl);
+      return CURLUE_OK;
+    }
+    if(uc == CURLUE_OUT_OF_MEMORY)
+      return uc;
+    return CURLUE_MALFORMED_INPUT;
+  }
+
+  /* if the new URL is absolute replace the existing with the new. */
+  if(Curl_is_absolute_url(url, NULL, 0,
+                          flags & (CURLU_GUESS_SCHEME | CURLU_DEFAULT_SCHEME)))
+    return parseurl_and_replace(url, u, flags);
+
+  /* if the old URL is incomplete (we cannot get an absolute URL in
+     'oldurl'), replace the existing with the new.
+     Always include "scheme://" to make the URL "complete" */
+  uc = curl_url_get(u, CURLUPART_URL, &oldurl, flags& ~CURLU_NO_GUESS_SCHEME);
+  if(uc == CURLUE_OUT_OF_MEMORY)
+    return uc;
+  else if(uc)
+    return parseurl_and_replace(url, u, flags);
+
+  DEBUGASSERT(oldurl); /* it is set here */
+  /* apply the relative part to create a new URL */
+  uc = redirect_url(oldurl, url, u, flags);
+  curlx_free(oldurl);
+  return uc;
+}
+
+static CURLUcode urlset_clear(CURLU *u, CURLUPart what)
+{
+  switch(what) {
+  case CURLUPART_URL:
+    free_urlhandle(u);
+    memset(u, 0, sizeof(struct Curl_URL));
+    break;
+  case CURLUPART_SCHEME:
+    curlx_safefree(u->scheme);
+    u->guessed_scheme = FALSE;
+    break;
+  case CURLUPART_USER:
+    curlx_safefree(u->user);
+    break;
+  case CURLUPART_PASSWORD:
+    curlx_safefree(u->password);
+    break;
+  case CURLUPART_OPTIONS:
+    curlx_safefree(u->options);
+    break;
+  case CURLUPART_HOST:
+    curlx_safefree(u->host);
+    break;
+  case CURLUPART_ZONEID:
+    curlx_safefree(u->zoneid);
+    break;
+  case CURLUPART_PORT:
+    u->portnum = 0;
+    curlx_safefree(u->port);
+    break;
+  case CURLUPART_PATH:
+    curlx_safefree(u->path);
+    break;
+  case CURLUPART_QUERY:
+    curlx_safefree(u->query);
+    u->query_present = FALSE;
+    break;
+  case CURLUPART_FRAGMENT:
+    curlx_safefree(u->fragment);
+    u->fragment_present = FALSE;
+    break;
+  default:
+    return CURLUE_UNKNOWN_PART;
+  }
+  return CURLUE_OK;
+}
+
+static bool allowed_in_path(unsigned char x)
+{
+  switch(x) {
+  case '!':
+  case '$':
+  case '&':
+  case '\'':
+  case '(':
+  case ')':
+  case '{':
+  case '}':
+  case '[':
+  case ']':
+  case '*':
+  case '+':
+  case ',':
+  case ';':
+  case '=':
+  case ':':
+  case '@':
+  case '/':
+    return TRUE;
+  }
+  return FALSE;
+}
+
+static CURLUcode url_encode_part(struct dynbuf *encp,
+                                 const char *part,
+                                 bool plusencode,
+                                 bool pathmode,
+                                 bool equalsencode)
+{
+  const unsigned char *i;
+
+  for(i = (const unsigned char *)part; *i; i++) {
+    CURLcode result;
+    if((*i == ' ') && plusencode)
+      result = curlx_dyn_addn(encp, "+", 1);
+    else if(ISUNRESERVED(*i) ||
+            (pathmode && allowed_in_path(*i)) ||
+            ((*i == '=') && equalsencode)) {
+      if((*i == '=') && equalsencode)
+        /* only skip the first equals sign */
+        equalsencode = FALSE;
+      result = curlx_dyn_addn(encp, i, 1);
+    }
+    else {
+      unsigned char out[3] = { '%' };
+      Curl_hexbyte(&out[1], *i);
+      result = curlx_dyn_addn(encp, out, 3);
+    }
+    if(result)
+      return cc2cu(result);
+  }
+  return CURLUE_OK;
+}
+
+static CURLUcode url_uppercasehex_part(struct dynbuf *encp,
+                                       const char *part)
+{
+  char *p;
+  CURLcode result = curlx_dyn_add(encp, part);
+  if(result)
+    return cc2cu(result);
+  p = curlx_dyn_ptr(encp);
+  while(*p) {
+    /* make sure percent encoded are upper case */
+    if((*p == '%') && ISXDIGIT(p[1]) && ISXDIGIT(p[2]) &&
+       (ISLOWER(p[1]) || ISLOWER(p[2]))) {
+      p[1] = Curl_raw_toupper(p[1]);
+      p[2] = Curl_raw_toupper(p[2]);
+      p += 3;
+    }
+    else
+      p++;
+  }
+  return CURLUE_OK;
+}
+
+static CURLUcode url_append_query(CURLU *u, struct dynbuf *encp)
+{
+  /* Append the 'encp' string onto the old query. Add a '&' separator if none
+     is already present at the end of the existing query */
+
+  size_t querylen = u->query ? strlen(u->query) : 0;
+  bool addamperand = querylen && (u->query[querylen - 1] != '&');
+  if(querylen) {
+    struct dynbuf qbuf;
+    CURLcode result;
+    const char *newp = curlx_dyn_ptr(encp);
+    curlx_dyn_init(&qbuf, CURL_MAX_INPUT_LENGTH);
+
+    /* add original query */
+    result = curlx_dyn_addn(&qbuf, u->query, querylen);
+    if(!result && addamperand)
+      /* add ampersand */
+      result = curlx_dyn_addn(&qbuf, "&", 1);
+    if(!result)
+      /* add new query part */
+      result = curlx_dyn_add(&qbuf, newp);
+    if(result)
+      goto nomem;
+    curlx_dyn_free(encp);
+    curlx_free(u->query);
+    u->query = curlx_dyn_ptr(&qbuf);
+    return CURLUE_OK;
+nomem:
+    curlx_dyn_free(encp);
+    return cc2cu(result);
+  }
+  else {
+    curlx_free(u->query);
+    u->query = curlx_dyn_ptr(encp);
+  }
+  return CURLUE_OK;
+}
+
+static CURLUcode url_sethost(CURLU *u, struct dynbuf *encp,
+                             bool urlencode,
+                             unsigned int flags)
+{
+  size_t n = curlx_dyn_len(encp);
+  bool bad = FALSE;
+  char *newp = curlx_dyn_ptr(encp);
+  if(!n)
+    /* an empty hostname is okay if told so */
+    bad = (flags & CURLU_NO_AUTHORITY) ? FALSE : TRUE;
+  else if(!urlencode) {
+    /* if the hostname part was not URL encoded here, it was set already URL
+       encoded so we need to decode it to check */
+    size_t dlen;
+    char *decoded = NULL;
+    CURLcode result = Curl_urldecode(newp, n, &decoded, &dlen, REJECT_CTRL);
+    if(result || hostname_check(u, decoded, dlen))
+      bad = TRUE;
+    curlx_free(decoded);
+  }
+  else if(hostname_check(u, (char *)CURL_UNCONST(newp), n))
+    bad = TRUE;
+  if(bad) {
+    curlx_dyn_free(encp);
+    return CURLUE_BAD_HOSTNAME;
+  }
+  return CURLUE_OK;
+}
+
+CURLUcode curl_url_set(CURLU *u, CURLUPart what,
+                       const char *part, unsigned int flags)
+{
+  char **storep = NULL;
+  bool urlencode = (flags & CURLU_URLENCODE) ? 1 : 0;
+  bool plusencode = FALSE;
+  bool pathmode = FALSE;
+  bool leadingslash = FALSE;
+  bool appendquery = FALSE;
+  bool equalsencode = FALSE;
+  size_t nalloc;
+
+  if(!u)
+    return CURLUE_BAD_HANDLE;
+  if(!part)
+    /* setting a part to NULL clears it */
+    return urlset_clear(u, what);
+
+  nalloc = strlen(part);
+  if(nalloc > CURL_MAX_INPUT_LENGTH)
+    /* excessive input length */
+    return CURLUE_MALFORMED_INPUT;
+
+  switch(what) {
+  case CURLUPART_SCHEME: {
+    CURLUcode status = set_url_scheme(u, part, flags);
+    if(status)
+      return status;
+    storep = &u->scheme;
+    urlencode = FALSE; /* never */
     break;
   }
   case CURLUPART_USER:
@@ -1773,186 +2004,99 @@ CURLUcode curl_url_set(CURLU *u, CURLUPart what,
     break;
   case CURLUPART_HOST:
     storep = &u->host;
-    Curl_safefree(u->zoneid);
+    curlx_safefree(u->zoneid);
     break;
   case CURLUPART_ZONEID:
     storep = &u->zoneid;
     break;
   case CURLUPART_PORT:
-  {
-    char *endp;
-    urlencode = FALSE; /* never */
-    port = strtol(part, &endp, 10);  /* Port number must be decimal */
-    if((port <= 0) || (port > 0xffff))
-      return CURLUE_BAD_PORT_NUMBER;
-    if(*endp)
-      /* weirdly provided number, not good! */
-      return CURLUE_BAD_PORT_NUMBER;
-    storep = &u->port;
-  }
-  break;
+    return set_url_port(u, part);
   case CURLUPART_PATH:
-    urlskipslash = TRUE;
+    pathmode = TRUE;
     leadingslash = TRUE; /* enforce */
     storep = &u->path;
     break;
   case CURLUPART_QUERY:
     plusencode = urlencode;
-    appendquery = (flags & CURLU_APPENDQUERY)?1:0;
+    appendquery = (flags & CURLU_APPENDQUERY) ? 1 : 0;
     equalsencode = appendquery;
     storep = &u->query;
+    u->query_present = TRUE;
     break;
   case CURLUPART_FRAGMENT:
     storep = &u->fragment;
+    u->fragment_present = TRUE;
     break;
-  case CURLUPART_URL: {
-    /*
-     * Allow a new URL to replace the existing (if any) contents.
-     *
-     * If the existing contents is enough for a URL, allow a relative URL to
-     * replace it.
-     */
-    CURLUcode result;
-    char *oldurl;
-    char *redired_url;
-
-    if(!nalloc)
-      /* a blank URL is not a valid URL */
-      return CURLUE_MALFORMED_INPUT;
-
-    /* if the new thing is absolute or the old one is not
-     * (we could not get an absolute url in 'oldurl'),
-     * then replace the existing with the new. */
-    if(Curl_is_absolute_url(part, NULL, 0,
-                            flags & (CURLU_GUESS_SCHEME|
-                                     CURLU_DEFAULT_SCHEME))
-       || curl_url_get(u, CURLUPART_URL, &oldurl, flags)) {
-      return parseurl_and_replace(part, u, flags);
-    }
-
-    /* apply the relative part to create a new URL
-     * and replace the existing one with it. */
-    redired_url = concat_url(oldurl, part);
-    free(oldurl);
-    if(!redired_url)
-      return CURLUE_OUT_OF_MEMORY;
-
-    result = parseurl_and_replace(redired_url, u, flags);
-    free(redired_url);
-    return result;
-  }
+  case CURLUPART_URL:
+    return set_url(u, part, nalloc, flags);
   default:
     return CURLUE_UNKNOWN_PART;
   }
   DEBUGASSERT(storep);
   {
-    const char *newp;
+    const char *newp = NULL;
     struct dynbuf enc;
-    Curl_dyn_init(&enc, nalloc * 3 + 1 + leadingslash);
+    CURLUcode status;
+    curlx_dyn_init(&enc, (nalloc * 3) + 1 + leadingslash);
 
     if(leadingslash && (part[0] != '/')) {
-      CURLcode result = Curl_dyn_addn(&enc, "/", 1);
+      CURLcode result = curlx_dyn_addn(&enc, "/", 1);
       if(result)
-        return CURLUE_OUT_OF_MEMORY;
+        return cc2cu(result);
     }
-    if(urlencode) {
-      const unsigned char *i;
+    if(urlencode)
+      status = url_encode_part(&enc, part, plusencode, pathmode, equalsencode);
+    else
+      status = url_uppercasehex_part(&enc, part);
+    if(!status) {
+      newp = curlx_dyn_ptr(&enc);
 
-      for(i = (const unsigned char *)part; *i; i++) {
-        CURLcode result;
-        if((*i == ' ') && plusencode) {
-          result = Curl_dyn_addn(&enc, "+", 1);
-          if(result)
-            return CURLUE_OUT_OF_MEMORY;
-        }
-        else if(Curl_isunreserved(*i) ||
-                ((*i == '/') && urlskipslash) ||
-                ((*i == '=') && equalsencode)) {
-          if((*i == '=') && equalsencode)
-            /* only skip the first equals sign */
-            equalsencode = FALSE;
-          result = Curl_dyn_addn(&enc, i, 1);
-          if(result)
-            return CURLUE_OUT_OF_MEMORY;
-        }
-        else {
-          char out[3]={'%'};
-          out[1] = hexdigits[*i>>4];
-          out[2] = hexdigits[*i & 0xf];
-          result = Curl_dyn_addn(&enc, out, 3);
-          if(result)
-            return CURLUE_OUT_OF_MEMORY;
-        }
-      }
+      if(appendquery && newp)
+        return url_append_query(u, &enc);
+      else if(what == CURLUPART_HOST)
+        status = url_sethost(u, &enc, urlencode, flags);
     }
-    else {
-      char *p;
-      CURLcode result = Curl_dyn_add(&enc, part);
-      if(result)
-        return CURLUE_OUT_OF_MEMORY;
-      p = Curl_dyn_ptr(&enc);
-      while(*p) {
-        /* make sure percent encoded are lower case */
-        if((*p == '%') && ISXDIGIT(p[1]) && ISXDIGIT(p[2]) &&
-           (ISUPPER(p[1]) || ISUPPER(p[2]))) {
-          p[1] = Curl_raw_tolower(p[1]);
-          p[2] = Curl_raw_tolower(p[2]);
-          p += 3;
-        }
-        else
-          p++;
-      }
-    }
-    newp = Curl_dyn_ptr(&enc);
+    if(status)
+      return status;
 
-    if(appendquery) {
-      /* Append the 'newp' string onto the old query. Add a '&' separator if
-         none is present at the end of the existing query already */
-
-      size_t querylen = u->query ? strlen(u->query) : 0;
-      bool addamperand = querylen && (u->query[querylen -1] != '&');
-      if(querylen) {
-        struct dynbuf qbuf;
-        Curl_dyn_init(&qbuf, CURL_MAX_INPUT_LENGTH);
-
-        if(Curl_dyn_addn(&qbuf, u->query, querylen)) /* add original query */
-          goto nomem;
-
-        if(addamperand) {
-          if(Curl_dyn_addn(&qbuf, "&", 1))
-            goto nomem;
-        }
-        if(Curl_dyn_add(&qbuf, newp))
-          goto nomem;
-        Curl_dyn_free(&enc);
-        free(*storep);
-        *storep = Curl_dyn_ptr(&qbuf);
-        return CURLUE_OK;
-nomem:
-        Curl_dyn_free(&enc);
-        return CURLUE_OUT_OF_MEMORY;
-      }
-    }
-
-    if(what == CURLUPART_HOST) {
-      size_t n = strlen(newp);
-      if(!n && (flags & CURLU_NO_AUTHORITY)) {
-        /* Skip hostname check, it's allowed to be empty. */
-      }
-      else {
-        if(!n || hostname_check(u, (char *)newp, n)) {
-          Curl_dyn_free(&enc);
-          return CURLUE_BAD_HOSTNAME;
-        }
-      }
-    }
-
-    free(*storep);
-    *storep = (char *)newp;
+    curlx_free(*storep);
+    *storep = (char *)CURL_UNCONST(newp);
   }
-  /* set after the string, to make it not assigned if the allocation above
-     fails */
-  if(port)
-    u->portnum = port;
   return CURLUE_OK;
 }
+
+bool Curl_url_same_origin(CURLU *base, CURLU *href)
+{
+  const struct Curl_scheme *s = NULL;
+
+  /* base must be an absolute URL */
+  if(!base->scheme || !base->host)
+    return FALSE;
+  if(href->scheme && !curl_strequal(base->scheme, href->scheme))
+    return FALSE;
+  if(href->host) {
+    if(!curl_strequal(base->host, href->host))
+      return FALSE;
+    if(!curl_strequal(base->zoneid ? base->zoneid : "",
+                      href->zoneid ? href->zoneid : ""))
+      return FALSE;
+    if(!curl_strequal(base->port, href->port)) {
+      /* This may still match if only one has an explicit port
+       * and it is the default for the scheme. */
+      if(base->port && href->port)
+        return FALSE;
+
+      s = Curl_get_scheme(base->scheme);
+      if(!s) /* Cannot match default port for unknown scheme */
+        return FALSE;
+
+      /* The port which is set must be the default one */
+      if((base->port && (base->portnum != s->defport)) ||
+         (href->port && (href->portnum != s->defport)))
+        return FALSE;
+    }
+  }
+  else if(href->port) /* no host in href, then there must be no port */
+    return FALSE;
+  return TRUE;
+}
diff --git a/third-party/curl/lib/urldata.h b/third-party/curl/lib/urldata.h
index 4bfb3b48d2..d4d336d8db 100644
--- a/third-party/curl/lib/urldata.h
+++ b/third-party/curl/lib/urldata.h
@@ -23,88 +23,16 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /* This file is for lib internal stuff */
-
 #include "curl_setup.h"
 
-#define PORT_FTP 21
-#define PORT_FTPS 990
-#define PORT_TELNET 23
-#define PORT_HTTP 80
-#define PORT_HTTPS 443
-#define PORT_DICT 2628
-#define PORT_LDAP 389
-#define PORT_LDAPS 636
-#define PORT_TFTP 69
-#define PORT_SSH 22
-#define PORT_IMAP 143
-#define PORT_IMAPS 993
-#define PORT_POP3 110
-#define PORT_POP3S 995
-#define PORT_SMB 445
-#define PORT_SMBS 445
-#define PORT_SMTP 25
-#define PORT_SMTPS 465 /* sometimes called SSMTP */
-#define PORT_RTSP 554
-#define PORT_RTMP 1935
-#define PORT_RTMPT PORT_HTTP
-#define PORT_RTMPS PORT_HTTPS
-#define PORT_GOPHER 70
-#define PORT_MQTT 1883
-
-#ifdef USE_WEBSOCKETS
-/* CURLPROTO_GOPHERS (29) is the highest publicly used protocol bit number,
- * the rest are internal information. If we use higher bits we only do this on
- * platforms that have a >= 64 bit type and then we use such a type for the
- * protocol fields in the protocol handler.
- */
-#define CURLPROTO_WS     (1<<30)
-#define CURLPROTO_WSS    ((curl_prot_t)1<<31)
-#else
-#define CURLPROTO_WS 0
-#define CURLPROTO_WSS 0
-#endif
-
-/* This should be undefined once we need bit 32 or higher */
-#define PROTO_TYPE_SMALL
-
-#ifndef PROTO_TYPE_SMALL
-typedef curl_off_t curl_prot_t;
-#else
-typedef unsigned int curl_prot_t;
-#endif
-
-/* This mask is for all the old protocols that are provided and defined in the
-   public header and shall exclude protocols added since which are not exposed
-   in the API */
-#define CURLPROTO_MASK   (0x3ffffff)
-
-#define DICT_MATCH "/MATCH:"
-#define DICT_MATCH2 "/M:"
-#define DICT_MATCH3 "/FIND:"
-#define DICT_DEFINE "/DEFINE:"
-#define DICT_DEFINE2 "/D:"
-#define DICT_DEFINE3 "/LOOKUP:"
-
-#define CURL_DEFAULT_USER "anonymous"
+#define CURL_DEFAULT_USER     "anonymous"
 #define CURL_DEFAULT_PASSWORD "ftp@example.com"
 
-/* Convenience defines for checking protocols or their SSL based version. Each
-   protocol handler should only ever have a single CURLPROTO_ in its protocol
-   field. */
-#define PROTO_FAMILY_HTTP (CURLPROTO_HTTP|CURLPROTO_HTTPS|CURLPROTO_WS| \
-                           CURLPROTO_WSS)
-#define PROTO_FAMILY_FTP  (CURLPROTO_FTP|CURLPROTO_FTPS)
-#define PROTO_FAMILY_POP3 (CURLPROTO_POP3|CURLPROTO_POP3S)
-#define PROTO_FAMILY_SMB  (CURLPROTO_SMB|CURLPROTO_SMBS)
-#define PROTO_FAMILY_SMTP (CURLPROTO_SMTP|CURLPROTO_SMTPS)
-#define PROTO_FAMILY_SSH  (CURLPROTO_SCP|CURLPROTO_SFTP)
-
-#if !defined(CURL_DISABLE_FTP) || defined(USE_SSH) ||   \
-  !defined(CURL_DISABLE_POP3)
-/* these protocols support CURLOPT_DIRLISTONLY */
-#define CURL_LIST_ONLY_PROTOCOL 1
+#if !defined(_WIN32) && !defined(MSDOS)
+/* do FTP line-end CRLF => LF conversions on platforms that prefer LF-only. It
+   also means: keep CRLF line endings on the CRLF platforms */
+#define CURL_PREFER_LF_LINEENDS
 #endif
 
 #define DEFAULT_CONNCACHE_SIZE 5
@@ -112,18 +40,10 @@ typedef unsigned int curl_prot_t;
 /* length of longest IPv6 address string including the trailing null */
 #define MAX_IPADR_LEN sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")
 
-/* Default FTP/IMAP etc response timeout in milliseconds */
-#define RESP_TIMEOUT (120*1000)
-
 /* Max string input length is a precaution against abuse and to detect junk
    input easier and better. */
 #define CURL_MAX_INPUT_LENGTH 8000000
 
-
-#include "cookie.h"
-#include "psl.h"
-#include "formdata.h"
-
 #ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
 #endif
@@ -131,66 +51,61 @@ typedef unsigned int curl_prot_t;
 #include <netinet/in6.h>
 #endif
 
-#include "timeval.h"
-
-#include <curl/curl.h>
+#include "curlx/timeval.h"
 
+#include "asyn.h"
+#include "cookie.h"
+#include "creds.h"
+#include "psl.h"
+#include "formdata.h"
 #include "http_chunks.h" /* for the structs and enum stuff */
 #include "hostip.h"
 #include "hash.h"
+#include "peer.h"
+#include "proxy.h"
 #include "splay.h"
-#include "dynbuf.h"
+#include "curlx/dynbuf.h"
+#include "bufref.h"
 #include "dynhds.h"
+#include "request.h"
+#include "ratelimit.h"
+#include "netrc.h"
+#include "vtls/vtls_config.h"
 
-/* return the count of bytes sent, or -1 on error */
-typedef ssize_t (Curl_send)(struct Curl_easy *data,   /* transfer */
-                            int sockindex,            /* socketindex */
-                            const void *buf,          /* data to write */
-                            size_t len,               /* max amount to write */
-                            CURLcode *err);           /* error to return */
+/* On error return, the value of `pnwritten` has no meaning */
+typedef CURLcode (Curl_send)(struct Curl_easy *data,   /* transfer */
+                             int sockindex,            /* socketindex */
+                             const uint8_t *buf,       /* data to write */
+                             size_t len,               /* amount to send */
+                             bool eos,                 /* last chunk */
+                             size_t *pnwritten);       /* how much sent */
 
-/* return the count of bytes read, or -1 on error */
-typedef ssize_t (Curl_recv)(struct Curl_easy *data,   /* transfer */
-                            int sockindex,            /* socketindex */
-                            char *buf,                /* store data here */
-                            size_t len,               /* max amount to read */
-                            CURLcode *err);           /* error to return */
-
-#ifdef USE_HYPER
-typedef CURLcode (*Curl_datastream)(struct Curl_easy *data,
-                                    struct connectdata *conn,
-                                    int *didwhat,
-                                    bool *done,
-                                    int select_res);
-#endif
+/* On error return, the value of `pnread` has no meaning */
+typedef CURLcode (Curl_recv)(struct Curl_easy *data,   /* transfer */
+                             int sockindex,            /* socketindex */
+                             char *buf,                /* store data here */
+                             size_t len,               /* max amount to read */
+                             size_t *pnread);          /* how much received */
 
 #include "mime.h"
-#include "imap.h"
-#include "pop3.h"
-#include "smtp.h"
+#include "protocol.h"
 #include "ftp.h"
-#include "file.h"
-#include "vssh/ssh.h"
 #include "http.h"
-#include "rtsp.h"
 #include "smb.h"
 #include "mqtt.h"
 #include "ftplistparser.h"
 #include "multihandle.h"
-#include "c-hyper.h"
 #include "cf-socket.h"
 
 #ifdef HAVE_GSSAPI
-# ifdef HAVE_GSSGNU
-#  include <gss.h>
-# elif defined HAVE_GSSAPI_GSSAPI_H
-#  include <gssapi/gssapi.h>
-# else
-#  include <gssapi.h>
-# endif
-# ifdef HAVE_GSSAPI_GSSAPI_GENERIC_H
-#  include <gssapi/gssapi_generic.h>
-# endif
+#  ifdef HAVE_GSSGNU
+#    include <gss.h>
+#  elif defined(HAVE_GSSAPI_H)
+#    include <gssapi.h>
+#  else /* MIT Kerberos */
+#    include <gssapi/gssapi.h>
+#    include <gssapi/gssapi_krb5.h> /* for GSS_C_CHANNEL_BOUND_FLAG in 1.19+ */
+#  endif
 #endif
 
 #ifdef USE_LIBSSH2
@@ -211,8 +126,8 @@ typedef CURLcode (*Curl_datastream)(struct Curl_easy *data,
    larger buffers can help further, but this is deemed a fair memory/speed
    compromise. */
 #define UPLOADBUFFER_DEFAULT 65536
-#define UPLOADBUFFER_MAX (2*1024*1024)
-#define UPLOADBUFFER_MIN CURL_MAX_WRITE_SIZE
+#define UPLOADBUFFER_MAX     (2 * 1024 * 1024)
+#define UPLOADBUFFER_MIN     CURL_MAX_WRITE_SIZE
 
 #define CURLEASY_MAGIC_NUMBER 0xc0dedbadU
 #ifdef DEBUGBUILD
@@ -220,118 +135,13 @@ typedef CURLcode (*Curl_datastream)(struct Curl_easy *data,
  * are not NULL, but no longer have the MAGIC touch. This gives
  * us early warning on things only discovered by valgrind otherwise. */
 #define GOOD_EASY_HANDLE(x) \
-  (((x) && ((x)->magic == CURLEASY_MAGIC_NUMBER))? TRUE: \
-  (DEBUGASSERT(!(x)), FALSE))
+  (((x) && ((x)->magic == CURLEASY_MAGIC_NUMBER)) ? TRUE : \
+   (DEBUGASSERT(!(x)), FALSE))
 #else
 #define GOOD_EASY_HANDLE(x) \
   ((x) && ((x)->magic == CURLEASY_MAGIC_NUMBER))
 #endif
 
-#ifdef HAVE_GSSAPI
-/* Types needed for krb5-ftp connections */
-struct krb5buffer {
-  void *data;
-  size_t size;
-  size_t index;
-  BIT(eof_flag);
-};
-
-enum protection_level {
-  PROT_NONE, /* first in list */
-  PROT_CLEAR,
-  PROT_SAFE,
-  PROT_CONFIDENTIAL,
-  PROT_PRIVATE,
-  PROT_CMD,
-  PROT_LAST /* last in list */
-};
-#endif
-
-/* enum for the nonblocking SSL connection state machine */
-typedef enum {
-  ssl_connect_1,
-  ssl_connect_2,
-  ssl_connect_2_reading,
-  ssl_connect_2_writing,
-  ssl_connect_3,
-  ssl_connect_done
-} ssl_connect_state;
-
-typedef enum {
-  ssl_connection_none,
-  ssl_connection_negotiating,
-  ssl_connection_complete
-} ssl_connection_state;
-
-/* SSL backend-specific data; declared differently by each SSL backend */
-struct ssl_backend_data;
-
-struct ssl_primary_config {
-  char *CApath;          /* certificate dir (doesn't work on windows) */
-  char *CAfile;          /* certificate to verify peer against */
-  char *issuercert;      /* optional issuer certificate filename */
-  char *clientcert;
-  char *cipher_list;     /* list of ciphers to use */
-  char *cipher_list13;   /* list of TLS 1.3 cipher suites to use */
-  char *pinned_key;
-  char *CRLfile;         /* CRL to check certificate revocation */
-  struct curl_blob *cert_blob;
-  struct curl_blob *ca_info_blob;
-  struct curl_blob *issuercert_blob;
-#ifdef USE_TLS_SRP
-  char *username; /* TLS username (for, e.g., SRP) */
-  char *password; /* TLS password (for, e.g., SRP) */
-#endif
-  char *curves;          /* list of curves to use */
-  unsigned char ssl_options;  /* the CURLOPT_SSL_OPTIONS bitmask */
-  unsigned int version_max; /* max supported version the client wants to use */
-  unsigned char version;    /* what version the client wants to use */
-  BIT(verifypeer);       /* set TRUE if this is desired */
-  BIT(verifyhost);       /* set TRUE if CN/SAN must match hostname */
-  BIT(verifystatus);     /* set TRUE if certificate status must be checked */
-  BIT(sessionid);        /* cache session IDs or not */
-};
-
-struct ssl_config_data {
-  struct ssl_primary_config primary;
-  long certverifyresult; /* result from the certificate verification */
-  curl_ssl_ctx_callback fsslctx; /* function to initialize ssl ctx */
-  void *fsslctxp;        /* parameter for call back */
-  char *cert_type; /* format for certificate (default: PEM)*/
-  char *key; /* private key file name */
-  struct curl_blob *key_blob;
-  char *key_type; /* format for private key (default: PEM) */
-  char *key_passwd; /* plain text private key password */
-  BIT(certinfo);     /* gather lots of certificate info */
-  BIT(falsestart);
-  BIT(enable_beast); /* allow this flaw for interoperability's sake */
-  BIT(no_revoke);    /* disable SSL certificate revocation checks */
-  BIT(no_partialchain); /* don't accept partial certificate chains */
-  BIT(revoke_best_effort); /* ignore SSL revocation offline/missing revocation
-                              list errors */
-  BIT(native_ca_store); /* use the native ca store of operating system */
-  BIT(auto_client_cert);   /* automatically locate and use a client
-                              certificate for authentication (Schannel) */
-};
-
-struct ssl_general_config {
-  size_t max_ssl_sessions; /* SSL session id cache size */
-  int ca_cache_timeout;  /* Certificate store cache timeout (seconds) */
-};
-
-/* information stored about one single SSL session */
-struct Curl_ssl_session {
-  char *name;       /* host name for which this ID was used */
-  char *conn_to_host; /* host name for the connection (may be NULL) */
-  const char *scheme; /* protocol scheme used */
-  void *sessionid;  /* as returned from the SSL layer */
-  size_t idsize;    /* if known, otherwise 0 */
-  long age;         /* just a number, the higher the more recent */
-  int remote_port;  /* remote port */
-  int conn_to_port; /* remote port for the connection (may be -1) */
-  struct ssl_primary_config ssl_config; /* setup for this session */
-};
-
 #ifdef USE_WINDOWS_SSPI
 #include "curl_sspi.h"
 #endif
@@ -339,14 +149,12 @@ struct Curl_ssl_session {
 #ifndef CURL_DISABLE_DIGEST_AUTH
 /* Struct used for Digest challenge-response authentication */
 struct digestdata {
-#if defined(USE_WINDOWS_SSPI)
+  struct Curl_creds *creds;
+  struct Curl_peer *origin;
+#ifdef USE_WINDOWS_SSPI
   BYTE *input_token;
   size_t input_token_len;
   CtxtHandle *http_context;
-  /* copy of user/passwd used to make the identity for http_context.
-     either may be NULL. */
-  char *user;
-  char *passwd;
 #else
   char *nonce;
   char *cnonce;
@@ -355,7 +163,7 @@ struct digestdata {
   char *qop;
   char *algorithm;
   int nc; /* nonce count */
-  unsigned char algo;
+  uint8_t algo;
   BIT(stale); /* set true for re-negotiation */
   BIT(userhash);
 #endif
@@ -378,133 +186,18 @@ typedef enum {
   GSS_AUTHSUCC
 } curlnegotiate;
 
-/* Struct used for GSSAPI (Kerberos V5) authentication */
-#if defined(USE_KERBEROS5)
-struct kerberos5data {
-#if defined(USE_WINDOWS_SSPI)
-  CredHandle *credentials;
-  CtxtHandle *context;
-  TCHAR *spn;
-  SEC_WINNT_AUTH_IDENTITY identity;
-  SEC_WINNT_AUTH_IDENTITY *p_identity;
-  size_t token_max;
-  BYTE *output_token;
-#else
-  gss_ctx_id_t context;
-  gss_name_t spn;
-#endif
-};
-#endif
-
-/* Struct used for SCRAM-SHA-1 authentication */
-#ifdef USE_GSASL
-#include <gsasl.h>
-struct gsasldata {
-  Gsasl *ctx;
-  Gsasl_session *client;
-};
-#endif
-
-/* Struct used for NTLM challenge-response authentication */
-#if defined(USE_NTLM)
-struct ntlmdata {
-#ifdef USE_WINDOWS_SSPI
-/* The sslContext is used for the Schannel bindings. The
- * api is available on the Windows 7 SDK and later.
- */
-#ifdef SECPKG_ATTR_ENDPOINT_BINDINGS
-  CtxtHandle *sslContext;
-#endif
-  CredHandle *credentials;
-  CtxtHandle *context;
-  SEC_WINNT_AUTH_IDENTITY identity;
-  SEC_WINNT_AUTH_IDENTITY *p_identity;
-  size_t token_max;
-  BYTE *output_token;
-  BYTE *input_token;
-  size_t input_token_len;
-  TCHAR *spn;
-#else
-  unsigned int flags;
-  unsigned char nonce[8];
-  unsigned int target_info_len;
-  void *target_info; /* TargetInfo received in the ntlm type-2 message */
-
-#if defined(NTLM_WB_ENABLED)
-  /* used for communication with Samba's winbind daemon helper ntlm_auth */
-  curl_socket_t ntlm_auth_hlpr_socket;
-  pid_t ntlm_auth_hlpr_pid;
-  char *challenge; /* The received base64 encoded ntlm type-2 message */
-  char *response;  /* The generated base64 ntlm type-1/type-3 message */
-#endif
-#endif
-};
-#endif
-
-/* Struct used for Negotiate (SPNEGO) authentication */
-#ifdef USE_SPNEGO
-struct negotiatedata {
-#ifdef HAVE_GSSAPI
-  OM_uint32 status;
-  gss_ctx_id_t context;
-  gss_name_t spn;
-  gss_buffer_desc output_token;
-#else
-#ifdef USE_WINDOWS_SSPI
-#ifdef SECPKG_ATTR_ENDPOINT_BINDINGS
-  CtxtHandle *sslContext;
-#endif
-  DWORD status;
-  CredHandle *credentials;
-  CtxtHandle *context;
-  SEC_WINNT_AUTH_IDENTITY identity;
-  SEC_WINNT_AUTH_IDENTITY *p_identity;
-  TCHAR *spn;
-  size_t token_max;
-  BYTE *output_token;
-  size_t output_token_length;
-#endif
-#endif
-  BIT(noauthpersist);
-  BIT(havenoauthpersist);
-  BIT(havenegdata);
-  BIT(havemultiplerequests);
-};
-#endif
-
-#ifdef CURL_DISABLE_PROXY
-#define CONN_IS_PROXIED(x) 0
-#else
-#define CONN_IS_PROXIED(x) x->bits.proxy
-#endif
-
 /*
  * Boolean values that concerns this connection.
  */
 struct ConnectBits {
+  BIT(connect_only);
 #ifndef CURL_DISABLE_PROXY
-  BIT(httpproxy);  /* if set, this transfer is done through an HTTP proxy */
-  BIT(socksproxy); /* if set, this transfer is done through a socks proxy */
-  BIT(proxy_user_passwd); /* user+password for the proxy? */
-  BIT(tunnel_proxy);  /* if CONNECT is used to "tunnel" through the proxy.
-                         This is implicit when SSL-protocols are used through
-                         proxies, but can also be enabled explicitly by
-                         apps */
-  BIT(proxy_connect_closed); /* TRUE if a proxy disconnected the connection
-                                in a CONNECT request with auth, so that
-                                libcurl should reconnect and continue. */
-  BIT(proxy); /* if set, this transfer is done through a proxy - any type */
+  BIT(origin_is_proxy);  /* if set, the connection's origin is a proxy */
 #endif
   /* always modify bits.close with the connclose() and connkeep() macros! */
   BIT(close); /* if set, we close the connection after this request */
   BIT(reuse); /* if set, this is a reused connection */
   BIT(altused); /* this is an alt-svc "redirect" */
-  BIT(conn_to_host); /* if set, this connection has a "connect to host"
-                        that overrides the host in the URL */
-  BIT(conn_to_port); /* if set, this connection has a "connect to port"
-                        that overrides the port in the URL (remote port) */
-  BIT(ipv6_ip); /* we communicate with a remote site specified with pure IPv6
-                   IP address */
   BIT(ipv6);    /* we communicate with a site using an IPv6 address */
   BIT(do_more); /* this is set TRUE if the ->curl_do_more() function is
                    supposed to be called, after ->curl_do() */
@@ -512,39 +205,31 @@ struct ConnectBits {
                          the TCP layer connect */
   BIT(retry);         /* this connection is about to get closed and then
                          re-attempted at another connection. */
-  BIT(authneg);       /* TRUE when the auth phase has started, which means
-                         that we are creating a request with an auth header,
-                         but it is not the final request in the auth
-                         negotiation. */
 #ifndef CURL_DISABLE_FTP
   BIT(ftp_use_epsv);  /* As set with CURLOPT_FTP_USE_EPSV, but if we find out
-                         EPSV doesn't work we disable it for the forthcoming
+                         EPSV does not work we disable it for the forthcoming
                          requests */
   BIT(ftp_use_eprt);  /* As set with CURLOPT_FTP_USE_EPRT, but if we find out
-                         EPRT doesn't work we disable it for the forthcoming
+                         EPRT does not work we disable it for the forthcoming
                          requests */
   BIT(ftp_use_data_ssl); /* Enabled SSL for the data connection */
-  BIT(ftp_use_control_ssl); /* Enabled SSL for the control connection */
-#endif
-#ifndef CURL_DISABLE_NETRC
-  BIT(netrc);         /* name+password provided by netrc */
 #endif
   BIT(bound); /* set true if bind() has already been done on this socket/
                  connection */
+  BIT(upgrade_in_progress); /* protocol upgrade is in progress */
   BIT(multiplex); /* connection is multiplexed */
   BIT(tcp_fastopen); /* use TCP Fast Open */
   BIT(tls_enable_alpn); /* TLS ALPN extension? */
-#ifndef CURL_DISABLE_DOH
-  BIT(doh);
-#endif
-#ifdef USE_UNIX_SOCKETS
-  BIT(abstract_unix_socket);
-#endif
-  BIT(tls_upgraded);
   BIT(sock_accepted); /* TRUE if the SECONDARYSOCKET was created with
                          accept() */
   BIT(parallel_connect); /* set TRUE when a parallel connect attempt has
                             started (happy eyeballs) */
+  BIT(aborted); /* connection was aborted, e.g. in unclean state */
+  BIT(no_reuse); /* connection should not be reused */
+  BIT(shutdown_handler); /* connection shutdown: handler shut down */
+  BIT(shutdown_filters); /* connection shutdown: filters shut down */
+  BIT(in_cpool);     /* connection is kept in a connection pool */
+  BIT(dns_resolved); /* DNS records for connection were resolved */
 };
 
 struct hostname {
@@ -554,386 +239,88 @@ struct hostname {
   const char *dispname; /* name to display, as 'name' might be encoded */
 };
 
-/*
- * Flags on the keepon member of the Curl_transfer_keeper
- */
-
-#define KEEP_NONE  0
-#define KEEP_RECV  (1<<0)     /* there is or may be data to read */
-#define KEEP_SEND (1<<1)     /* there is or may be data to write */
-#define KEEP_RECV_HOLD (1<<2) /* when set, no reading should be done but there
-                                 might still be data to read */
-#define KEEP_SEND_HOLD (1<<3) /* when set, no writing should be done but there
-                                  might still be data to write */
-#define KEEP_RECV_PAUSE (1<<4) /* reading is paused */
-#define KEEP_SEND_PAUSE (1<<5) /* writing is paused */
-
-#define KEEP_RECVBITS (KEEP_RECV | KEEP_RECV_HOLD | KEEP_RECV_PAUSE)
-#define KEEP_SENDBITS (KEEP_SEND | KEEP_SEND_HOLD | KEEP_SEND_PAUSE)
-
-#if defined(CURLRES_ASYNCH) || !defined(CURL_DISABLE_DOH)
-#define USE_CURL_ASYNC
-struct Curl_async {
-  char *hostname;
-  struct Curl_dns_entry *dns;
-  struct thread_data *tdata;
-  void *resolver; /* resolver state, if it is used in the URL state -
-                     ares_channel e.g. */
-  int port;
-  int status; /* if done is TRUE, this is the status from the callback */
-  BIT(done);  /* set TRUE when the lookup is complete */
-};
-
-#endif
-
 #define FIRSTSOCKET     0
 #define SECONDARYSOCKET 1
 
-enum expect100 {
-  EXP100_SEND_DATA,           /* enough waiting, just send the body now */
-  EXP100_AWAITING_CONTINUE,   /* waiting for the 100 Continue header */
-  EXP100_SENDING_REQUEST,     /* still sending the request but will wait for
-                                 the 100 header once done with the request */
-  EXP100_FAILED               /* used on 417 Expectation Failed */
-};
-
-enum upgrade101 {
-  UPGR101_INIT,               /* default state */
-  UPGR101_WS,                 /* upgrade to WebSockets requested */
-  UPGR101_H2,                 /* upgrade to HTTP/2 requested */
-  UPGR101_RECEIVED,           /* 101 response received */
-  UPGR101_WORKING             /* talking upgraded protocol */
-};
-
-enum doh_slots {
-  /* Explicit values for first two symbols so as to match hard-coded
-   * constants in existing code
-   */
-  DOH_PROBE_SLOT_IPADDR_V4 = 0, /* make 'V4' stand out for readability */
-  DOH_PROBE_SLOT_IPADDR_V6 = 1, /* 'V6' likewise */
-
-  /* Space here for (possibly build-specific) additional slot definitions */
-
-  /* for example */
-  /* #ifdef WANT_DOH_FOOBAR_TXT */
-  /*   DOH_PROBE_SLOT_FOOBAR_TXT, */
-  /* #endif */
-
-  /* AFTER all slot definitions, establish how many we have */
-  DOH_PROBE_SLOTS
-};
-
-/*
- * Request specific data in the easy handle (Curl_easy).  Previously,
- * these members were on the connectdata struct but since a conn struct may
- * now be shared between different Curl_easys, we store connection-specific
- * data here. This struct only keeps stuff that's interesting for *this*
- * request, as it will be cleared between multiple ones
- */
-struct SingleRequest {
-  curl_off_t size;        /* -1 if unknown at this point */
-  curl_off_t maxdownload; /* in bytes, the maximum amount of data to fetch,
-                             -1 means unlimited */
-  curl_off_t bytecount;         /* total number of bytes read */
-  curl_off_t writebytecount;    /* number of bytes written */
-
-  curl_off_t pendingheader;      /* this many bytes left to send is actually
-                                    header and not body */
-  struct curltime start;         /* transfer started at this time */
-  unsigned int headerbytecount;  /* only count received headers */
-  unsigned int deductheadercount; /* this amount of bytes doesn't count when
-                                     we check if anything has been transferred
-                                     at the end of a connection. We use this
-                                     counter to make only a 100 reply (without
-                                     a following second response code) result
-                                     in a CURLE_GOT_NOTHING error code */
-  enum {
-    HEADER_NORMAL,              /* no bad header at all */
-    HEADER_PARTHEADER,          /* part of the chunk is a bad header, the rest
-                                   is normal data */
-    HEADER_ALLBAD               /* all was believed to be header */
-  } badheader;                  /* the header was deemed bad and will be
-                                   written as body */
-  int headerline;               /* counts header lines to better track the
-                                   first one */
-  char *str;                    /* within buf */
-  curl_off_t offset;            /* possible resume offset read from the
-                                   Content-Range: header */
-  int httpcode;                 /* error code from the 'HTTP/1.? XXX' or
-                                   'RTSP/1.? XXX' line */
-  int keepon;
-  struct curltime start100;      /* time stamp to wait for the 100 code from */
-  enum expect100 exp100;        /* expect 100 continue state */
-  enum upgrade101 upgr101;      /* 101 upgrade state */
-
-  /* Content unencoding stack. See sec 3.5, RFC2616. */
-  struct contenc_writer *writer_stack;
-  time_t timeofdoc;
-  long bodywrites;
-  char *location;   /* This points to an allocated version of the Location:
-                       header data */
-  char *newurl;     /* Set to the new URL to use when a redirect or a retry is
-                       wanted */
-
-  /* 'upload_present' is used to keep a byte counter of how much data there is
-     still left in the buffer, aimed for upload. */
-  ssize_t upload_present;
-
-  /* 'upload_fromhere' is used as a read-pointer when we uploaded parts of a
-     buffer, so the next read should read from where this pointer points to,
-     and the 'upload_present' contains the number of bytes available at this
-     position */
-  char *upload_fromhere;
-
-  /* Allocated protocol-specific data. Each protocol handler makes sure this
-     points to data it needs. */
-  union {
-    struct FILEPROTO *file;
-    struct FTP *ftp;
-    struct HTTP *http;
-    struct IMAP *imap;
-    struct ldapreqinfo *ldap;
-    struct MQTT *mqtt;
-    struct POP3 *pop3;
-    struct RTSP *rtsp;
-    struct smb_request *smb;
-    struct SMTP *smtp;
-    struct SSHPROTO *ssh;
-    struct TELNET *telnet;
-  } p;
-#ifndef CURL_DISABLE_DOH
-  struct dohdata *doh; /* DoH specific data for this request */
-#endif
-#if defined(WIN32) && defined(USE_WINSOCK)
-  struct curltime last_sndbuf_update;  /* last time readwrite_upload called
-                                          win_update_buffer_size */
-#endif
-#ifndef CURL_DISABLE_COOKIES
-  unsigned char setcookies;
-#endif
-  unsigned char writer_stack_depth; /* Unencoding stack depth. */
-  BIT(header);        /* incoming data has HTTP header */
-  BIT(content_range); /* set TRUE if Content-Range: was found */
-  BIT(upload_done);   /* set to TRUE when doing chunked transfer-encoding
-                         upload and we're uploading the last chunk */
-  BIT(ignorebody);    /* we read a response-body but we ignore it! */
-  BIT(http_bodyless); /* HTTP response status code is between 100 and 199,
-                         204 or 304 */
-  BIT(chunk);         /* if set, this is a chunked transfer-encoding */
-  BIT(ignore_cl);     /* ignore content-length */
-  BIT(upload_chunky); /* set TRUE if we are doing chunked transfer-encoding
-                         on upload */
-  BIT(getheader);    /* TRUE if header parsing is wanted */
-  BIT(forbidchunk);  /* used only to explicitly forbid chunk-upload for
-                        specific upload buffers. See readmoredata() in http.c
-                        for details. */
-  BIT(no_body);      /* the response has no body */
-};
-
-/*
- * Specific protocol handler.
- */
-
-struct Curl_handler {
-  const char *scheme;        /* URL scheme name. */
-
-  /* Complement to setup_connection_internals(). This is done before the
-     transfer "owns" the connection. */
-  CURLcode (*setup_connection)(struct Curl_easy *data,
-                               struct connectdata *conn);
-
-  /* These two functions MUST be set to be protocol dependent */
-  CURLcode (*do_it)(struct Curl_easy *data, bool *done);
-  CURLcode (*done)(struct Curl_easy *, CURLcode, bool);
-
-  /* If the curl_do() function is better made in two halves, this
-   * curl_do_more() function will be called afterwards, if set. For example
-   * for doing the FTP stuff after the PASV/PORT command.
-   */
-  CURLcode (*do_more)(struct Curl_easy *, int *);
-
-  /* This function *MAY* be set to a protocol-dependent function that is run
-   * after the connect() and everything is done, as a step in the connection.
-   * The 'done' pointer points to a bool that should be set to TRUE if the
-   * function completes before return. If it doesn't complete, the caller
-   * should call the ->connecting() function until it is.
-   */
-  CURLcode (*connect_it)(struct Curl_easy *data, bool *done);
-
-  /* See above. */
-  CURLcode (*connecting)(struct Curl_easy *data, bool *done);
-  CURLcode (*doing)(struct Curl_easy *data, bool *done);
-
-  /* Called from the multi interface during the PROTOCONNECT phase, and it
-     should then return a proper fd set */
-  int (*proto_getsock)(struct Curl_easy *data,
-                       struct connectdata *conn, curl_socket_t *socks);
-
-  /* Called from the multi interface during the DOING phase, and it should
-     then return a proper fd set */
-  int (*doing_getsock)(struct Curl_easy *data,
-                       struct connectdata *conn, curl_socket_t *socks);
-
-  /* Called from the multi interface during the DO_MORE phase, and it should
-     then return a proper fd set */
-  int (*domore_getsock)(struct Curl_easy *data,
-                        struct connectdata *conn, curl_socket_t *socks);
-
-  /* Called from the multi interface during the DO_DONE, PERFORM and
-     WAITPERFORM phases, and it should then return a proper fd set. Not setting
-     this will make libcurl use the generic default one. */
-  int (*perform_getsock)(struct Curl_easy *data,
-                         struct connectdata *conn, curl_socket_t *socks);
-
-  /* This function *MAY* be set to a protocol-dependent function that is run
-   * by the curl_disconnect(), as a step in the disconnection.  If the handler
-   * is called because the connection has been considered dead,
-   * dead_connection is set to TRUE. The connection is (again) associated with
-   * the transfer here.
-   */
-  CURLcode (*disconnect)(struct Curl_easy *, struct connectdata *,
-                         bool dead_connection);
-
-  /* If used, this function gets called from transfer.c:readwrite_data() to
-     allow the protocol to do extra reads/writes */
-  CURLcode (*readwrite)(struct Curl_easy *data, struct connectdata *conn,
-                        ssize_t *nread, bool *readmore);
-
-  /* This function can perform various checks on the connection. See
-     CONNCHECK_* for more information about the checks that can be performed,
-     and CONNRESULT_* for the results that can be returned. */
-  unsigned int (*connection_check)(struct Curl_easy *data,
-                                   struct connectdata *conn,
-                                   unsigned int checks_to_perform);
-
-  /* attach() attaches this transfer to this connection */
-  void (*attach)(struct Curl_easy *data, struct connectdata *conn);
-
-  int defport;            /* Default port. */
-  curl_prot_t protocol;  /* See CURLPROTO_* - this needs to be the single
-                            specific protocol bit */
-  curl_prot_t family;    /* single bit for protocol family; basically the
-                            non-TLS name of the protocol this is */
-  unsigned int flags;     /* Extra particular characteristics, see PROTOPT_* */
-
-};
-
-#define PROTOPT_NONE 0             /* nothing extra */
-#define PROTOPT_SSL (1<<0)         /* uses SSL */
-#define PROTOPT_DUAL (1<<1)        /* this protocol uses two connections */
-#define PROTOPT_CLOSEACTION (1<<2) /* need action before socket close */
-/* some protocols will have to call the underlying functions without regard to
-   what exact state the socket signals. IE even if the socket says "readable",
-   the send function might need to be called while uploading, or vice versa.
-*/
-#define PROTOPT_DIRLOCK (1<<3)
-#define PROTOPT_NONETWORK (1<<4)   /* protocol doesn't use the network! */
-#define PROTOPT_NEEDSPWD (1<<5)    /* needs a password, and if none is set it
-                                      gets a default */
-#define PROTOPT_NOURLQUERY (1<<6)   /* protocol can't handle
-                                        url query strings (?foo=bar) ! */
-#define PROTOPT_CREDSPERREQUEST (1<<7) /* requires login credentials per
-                                          request instead of per connection */
-#define PROTOPT_ALPN (1<<8) /* set ALPN for this */
-/* (1<<9) was PROTOPT_STREAM, now free */
-#define PROTOPT_URLOPTIONS (1<<10) /* allow options part in the userinfo field
-                                      of the URL */
-#define PROTOPT_PROXY_AS_HTTP (1<<11) /* allow this non-HTTP scheme over a
-                                         HTTP proxy as HTTP proxies may know
-                                         this protocol and act as a gateway */
-#define PROTOPT_WILDCARD (1<<12) /* protocol supports wildcard matching */
-#define PROTOPT_USERPWDCTRL (1<<13) /* Allow "control bytes" (< 32 ascii) in
-                                       user name and password */
-#define PROTOPT_NOTCPPROXY (1<<14) /* this protocol can't proxy over TCP */
-
-#define CONNCHECK_NONE 0                 /* No checks */
-#define CONNCHECK_ISDEAD (1<<0)          /* Check if the connection is dead. */
-#define CONNCHECK_KEEPALIVE (1<<1)       /* Perform any keepalive function. */
-
-#define CONNRESULT_NONE 0                /* No extra information. */
-#define CONNRESULT_DEAD (1<<0)           /* The connection is dead. */
-
-struct proxy_info {
-  struct hostname host;
-  int port;
-  unsigned char proxytype; /* curl_proxytype: what kind of proxy that is in
-                              use */
-  char *user;    /* proxy user name string, allocated */
-  char *passwd;  /* proxy password string, allocated */
-};
-
-struct ldapconninfo;
-
-#define TRNSPRT_TCP 3
-#define TRNSPRT_UDP 4
+#define TRNSPRT_NONE 0
+#define TRNSPRT_TCP  3
+#define TRNSPRT_UDP  4
 #define TRNSPRT_QUIC 5
 #define TRNSPRT_UNIX 6
 
+#define TRNSPRT_IS_DGRAM(x)   (((x) == TRNSPRT_UDP) || ((x) == TRNSPRT_QUIC))
+
+struct ip_quadruple {
+  char remote_ip[MAX_IPADR_LEN];
+  char local_ip[MAX_IPADR_LEN];
+  uint16_t remote_port;
+  uint16_t local_port;
+  uint8_t transport;
+};
+
+#define CUR_IP_QUAD_HAS_PORTS(x)      \
+  (((x)->transport == TRNSPRT_TCP) || \
+   ((x)->transport == TRNSPRT_UDP) || \
+   ((x)->transport == TRNSPRT_QUIC))
+
 /*
  * The connectdata struct contains all fields and variables that should be
  * unique for an entire connection.
  */
 struct connectdata {
-  struct Curl_llist_element bundle_node; /* conncache */
-
-  /* chunk is for HTTP chunked encoding, but is in the general connectdata
-     struct only because we can do just about any protocol through an HTTP
-     proxy and an HTTP proxy may in fact respond using chunked encoding */
-  struct Curl_chunker chunk;
+  struct Curl_llist_node cpool_node; /* conncache lists */
+  struct Curl_llist_node cshutdn_node; /* cshutdn list */
 
   curl_closesocket_callback fclosesocket; /* function closing the socket(s) */
   void *closesocket_client;
 
-  /* This is used by the connection cache logic. If this returns TRUE, this
+  /* This is used by the connection pool logic. If this returns TRUE, this
      handle is still used by one or more easy handles and can only used by any
      other easy handle without careful consideration (== only for
      multiplexing) and it cannot be used by another multi handle! */
-#define CONN_INUSE(c) ((c)->easyq.size)
+#define CONN_INUSE(c) (!!(c)->attached_xfers)
 
   /**** Fields set when inited and not modified again */
   curl_off_t connection_id; /* Contains a unique number to make it easier to
                                track the connections in the log output */
+  char *destination; /* string carrying normalized hostname+port+scope */
 
-  /* 'dns_entry' is the particular host we use. This points to an entry in the
-     DNS cache and it will not get pruned while locked. It gets unlocked in
-     multi_done(). This entry will be NULL if the connection is reused as then
-     there is no name resolve done. */
-  struct Curl_dns_entry *dns_entry;
+  /* `meta_hash` is a general key-value store for implementations
+   * with the lifetime of the connection.
+   * Elements need to be added with their own destructor to be invoked when
+   * the connection is cleaned up (see Curl_hash_add2()).*/
+  struct Curl_hash meta_hash;
 
-  /* 'remote_addr' is the particular IP we connected to. it is owned, set
-   * and NULLed by the connected socket filter (if there is one). */
-  const struct Curl_sockaddr_ex *remote_addr;
-
-  struct hostname host;
-  char *hostname_resolve; /* host name to resolve to address, allocated */
-  char *secondaryhostname; /* secondary socket host name (ftp) */
-  struct hostname conn_to_host; /* the host to connect to. valid only if
-                                   bits.conn_to_host is set */
+  /* Who the connection is talking to, ultimately */
+  struct Curl_peer *origin; /* connection ultimately talks to this */
+  struct Curl_peer *via_peer; /* if set, connection really talks to this */
+  struct Curl_peer *origin2; /* origin of SECONDARYSOCKET */
+  struct Curl_peer *via_peer2; /* peer of SECONDARYSOCKET */
 #ifndef CURL_DISABLE_PROXY
   struct proxy_info socks_proxy;
   struct proxy_info http_proxy;
 #endif
-  /* 'primary_ip' and 'primary_port' get filled with peer's numerical
-     ip address and port number whenever an outgoing connection is
-     *attempted* from the primary socket to a remote address. When more
-     than one address is tried for a connection these will hold data
-     for the last attempt. When the connection is actually established
-     these are updated with data which comes directly from the socket. */
-
-  char primary_ip[MAX_IPADR_LEN];
-  char *user;    /* user name string, allocated */
-  char *passwd;  /* password string, allocated */
+  struct Curl_creds *creds; /* When connection itself is tied to credentials */
+  struct Curl_peer *creds_origin; /* origin tied credentials are for */
   char *options; /* options string, allocated */
-  char *sasl_authzid;     /* authorization identity string, allocated */
-  char *oauth_bearer; /* OAUTH2 bearer, allocated */
-  struct curltime now;     /* "current" time */
   struct curltime created; /* creation time */
-  struct curltime lastused; /* when returned to the connection cache */
-  curl_socket_t sock[2]; /* two sockets, the second is used for the data
-                            transfer when doing FTP */
+  struct curltime lastused; /* when returned to the connection pool as idle */
+
+  /* A connection can have one or two sockets and connection filters.
+   * The protocol using the 2nd one is FTP for CONTROL+DATA sockets */
+  curl_socket_t sock[2];
+  struct Curl_cfilter *cfilter[2]; /* connection filters */
   Curl_recv *recv[2];
   Curl_send *send[2];
-  struct Curl_cfilter *cfilter[2]; /* connection filters */
+  int recv_idx;  /* on which socket index to receive, default 0 */
+  int send_idx;  /* on which socket index to send, default 0 */
+
+#define CONN_SOCK_IDX_VALID(i)    (((i) >= 0) && ((i) < 2))
+
+  struct {
+    struct curltime start[2]; /* when filter shutdown started */
+    timediff_t timeout_ms; /* 0 means no timeout */
+  } shutdown;
 
   struct ssl_primary_config ssl_config;
 #ifndef CURL_DISABLE_PROXY
@@ -941,166 +328,73 @@ struct connectdata {
 #endif
   struct ConnectBits bits;    /* various state-flags for this connection */
 
-  const struct Curl_handler *handler; /* Connection's protocol handler */
-  const struct Curl_handler *given;   /* The protocol first given */
+  const struct Curl_scheme *scheme; /* Connection's protocol handler */
+  const struct Curl_scheme *given;   /* The protocol first given */
 
   /* Protocols can use a custom keepalive mechanism to keep connections alive.
      This allows those protocols to track the last time the keepalive mechanism
      was used on this connection. */
   struct curltime keepalive;
 
-  /**** curl_get() phase fields */
-
-  curl_socket_t sockfd;   /* socket to read from or CURL_SOCKET_BAD */
-  curl_socket_t writesockfd; /* socket to write to, it may very
-                                well be the same we read from.
-                                CURL_SOCKET_BAD disables */
-
-#ifdef HAVE_GSSAPI
-  BIT(sec_complete); /* if Kerberos is enabled for this connection */
-  unsigned char command_prot; /* enum protection_level */
-  unsigned char data_prot; /* enum protection_level */
-  unsigned char request_data_prot; /* enum protection_level */
-  size_t buffer_size;
-  struct krb5buffer in_buffer;
-  void *app_data;
-  const struct Curl_sec_client_mech *mech;
-  struct sockaddr_in local_addr;
-#endif
-
-#if defined(USE_KERBEROS5)    /* Consider moving some of the above GSS-API */
-  struct kerberos5data krb5;  /* variables into the structure definition, */
-#endif                        /* however, some of them are ftp specific. */
-
-  struct Curl_llist easyq;    /* List of easy handles using this connection */
-  curl_seek_callback seek_func; /* function that seeks the input */
-  void *seek_client;            /* pointer to pass to the seek() above */
+  /* A connection cache from a SHARE might be used in several multi handles.
+   * We MUST not reuse connections that are running in another multi,
+   * for concurrency reasons. That multi might run in another thread.
+   * `attached_multi` is set by the first transfer attached and cleared
+   * when the last one is detached.
+   * NEVER call anything on this multi, check for equality. */
+  struct Curl_multi *attached_multi;
 
   /*************** Request - specific items ************/
 #if defined(USE_WINDOWS_SSPI) && defined(SECPKG_ATTR_ENDPOINT_BINDINGS)
-  CtxtHandle *sslContext;
+  CtxtHandle *sslContext;  /* mingw-w64 v9+, MS SDK 7.0A/VS2010+ */
 #endif
 
-#ifdef USE_GSASL
-  struct gsasldata gsasl;
-#endif
-
-#if defined(USE_NTLM)
+#ifdef USE_NTLM
   curlntlm http_ntlm_state;
   curlntlm proxy_ntlm_state;
-
-  struct ntlmdata ntlm;     /* NTLM differs from other authentication schemes
-                               because it authenticates connections, not
-                               single requests! */
-  struct ntlmdata proxyntlm; /* NTLM data for proxy */
 #endif
 
 #ifdef USE_SPNEGO
   curlnegotiate http_negotiate_state;
   curlnegotiate proxy_negotiate_state;
-
-  struct negotiatedata negotiate; /* state data for host Negotiate auth */
-  struct negotiatedata proxyneg; /* state data for proxy Negotiate auth */
 #endif
 
-#ifndef CURL_DISABLE_HTTP
-  /* for chunked-encoded trailer */
-  struct dynbuf trailer;
-#endif
-
-  union {
-#ifndef CURL_DISABLE_FTP
-    struct ftp_conn ftpc;
-#endif
-#ifdef USE_SSH
-    struct ssh_conn sshc;
-#endif
-#ifndef CURL_DISABLE_TFTP
-    struct tftp_state_data *tftpc;
-#endif
-#ifndef CURL_DISABLE_IMAP
-    struct imap_conn imapc;
-#endif
-#ifndef CURL_DISABLE_POP3
-    struct pop3_conn pop3c;
-#endif
-#ifndef CURL_DISABLE_SMTP
-    struct smtp_conn smtpc;
-#endif
-#ifndef CURL_DISABLE_RTSP
-    struct rtsp_conn rtspc;
-#endif
-#ifndef CURL_DISABLE_SMB
-    struct smb_conn smbc;
-#endif
-#ifdef USE_LIBRTMP
-    void *rtmp;
-#endif
-#ifdef USE_OPENLDAP
-    struct ldapconninfo *ldapc;
-#endif
-#ifndef CURL_DISABLE_MQTT
-    struct mqtt_conn mqtt;
-#endif
-#ifdef USE_WEBSOCKETS
-    struct websocket *ws;
-#endif
-    unsigned int unused:1; /* avoids empty union */
-  } proto;
-
-  struct connectbundle *bundle; /* The bundle we are member of */
-#ifdef USE_UNIX_SOCKETS
-  char *unix_domain_socket;
-#endif
-#ifdef USE_HYPER
-  /* if set, an alternative data transfer function */
-  Curl_datastream datastream;
-#endif
   /* When this connection is created, store the conditions for the local end
      bind. This is stored before the actual bind and before any connection is
      made and will serve the purpose of being used for comparison reasons so
-     that subsequent bound-requested connections aren't accidentally reusing
+     that subsequent bound-requested connections are not accidentally reusing
      wrong connections. */
   char *localdev;
-  unsigned short localportrange;
-  int waitfor;      /* current READ/WRITE bits to wait for */
 #if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
   int socks5_gssapi_enctype;
 #endif
-  /* The field below gets set in connect.c:connecthost() */
-  int port;        /* which port to use locally - to connect to */
-  int remote_port; /* the remote port, not the proxy port! */
-  int conn_to_port; /* the remote port to connect to. valid only if
-                       bits.conn_to_port is set */
-#ifdef ENABLE_IPV6
-  unsigned int scope_id;  /* Scope id for IPv6 */
+  uint32_t attached_xfers; /* # of attached easy handles */
+
+#ifdef USE_IPV6
+  uint32_t scope_id;  /* Scope id for IPv6 */
 #endif
-  unsigned short localport;
-  unsigned short secondary_port; /* secondary socket remote port to connect to
-                                    (ftp) */
-  unsigned char cselect_bits; /* bitmask of socket events */
-  unsigned char alpn; /* APLN TLS negotiated protocol, a CURL_HTTP_VERSION*
-                         value */
-#ifndef CURL_DISABLE_PROXY
-  unsigned char proxy_alpn; /* APLN of proxy tunnel, CURL_HTTP_VERSION* */
-#endif
-  unsigned char transport; /* one of the TRNSPRT_* defines */
-  unsigned char ip_version; /* copied from the Curl_easy at creation time */
-  unsigned char httpversion; /* the HTTP version*10 reported by the server */
-  unsigned char connect_only;
-  unsigned char gssapi_delegation; /* inherited from set.gssapi_delegation */
+  uint16_t localportrange;
+  uint16_t localport;
+  uint8_t transport_wanted; /* one of the TRNSPRT_* defines. Not necessarily
+   the transport the connection ends using due to Alt-Svc and happy
+   eyeballing. Use Curl_conn_get_transport() for actual value once the
+   connection is set up. */
+  uint8_t ip_version; /* copied from the Curl_easy at creation time */
+  /* HTTP version last responded with by the server or negotiated via ALPN.
+   * 0 at start, then one of 09, 10, 11, etc. */
+  uint8_t httpversion_seen;
+  uint8_t gssapi_delegation; /* inherited from set.gssapi_delegation */
 };
 
 #ifndef CURL_DISABLE_PROXY
 #define CURL_CONN_HOST_DISPNAME(c) \
-          ((c)->bits.socksproxy ? (c)->socks_proxy.host.dispname : \
-            (c)->bits.httpproxy ? (c)->http_proxy.host.dispname : \
-              (c)->bits.conn_to_host ? (c)->conn_to_host.dispname : \
-                (c)->host.dispname)
+  ((c)->socks_proxy.peer ? (c)->socks_proxy.peer->user_hostname : \
+    (c)->http_proxy.peer ? (c)->http_proxy.peer->user_hostname : \
+      (c)->via_peer ? (c)->via_peer->user_hostname : \
+        (c)->origin->user_hostname)
 #else
 #define CURL_CONN_HOST_DISPNAME(c) \
-          (c)->bits.conn_to_host ? (c)->conn_to_host.dispname : \
-            (c)->host.dispname
+  ((c)->via_peer ? (c)->via_peer->user_hostname : (c)->origin->user_hostname)
 #endif
 
 /* The end of connectdata. */
@@ -1116,115 +410,107 @@ struct PureInfo {
   time_t filetime; /* If requested, this is might get set. Set to -1 if the
                       time was unretrievable. */
   curl_off_t request_size; /* the amount of bytes sent in the request(s) */
-  unsigned long proxyauthavail; /* what proxy auth types were announced */
-  unsigned long httpauthavail;  /* what host auth types were announced */
-  long numconnects; /* how many new connection did libcurl created */
+  curl_off_t numconnects; /* how many new connections libcurl created */
+  uint32_t proxyauthavail; /* what proxy auth types were announced */
+  uint32_t httpauthavail;  /* what host auth types were announced */
+  uint32_t proxyauthpicked; /* selected proxy auth type */
+  uint32_t httpauthpicked;  /* selected host auth type */
   char *contenttype; /* the content type of the object */
-  char *wouldredirect; /* URL this would've been redirected to if asked to */
+  char *wouldredirect; /* URL this would have been redirected to if asked to */
   curl_off_t retry_after; /* info from Retry-After: header */
-  unsigned int header_size;  /* size of read header(s) in bytes */
+  uint32_t header_size;  /* size of read header(s) in bytes */
 
-  /* PureInfo members 'conn_primary_ip', 'conn_primary_port', 'conn_local_ip'
-     and, 'conn_local_port' are copied over from the connectdata struct in
-     order to allow curl_easy_getinfo() to return this information even when
-     the session handle is no longer associated with a connection, and also
-     allow curl_easy_reset() to clear this information from the session handle
-     without disturbing information which is still alive, and that might be
-     reused, in the connection cache. */
-
-  char conn_primary_ip[MAX_IPADR_LEN];
-  int conn_primary_port; /* this is the destination port to the connection,
-                            which might have been a proxy */
-  int conn_remote_port;  /* this is the "remote port", which is the port
-                            number of the used URL, independent of proxy or
-                            not */
-  char conn_local_ip[MAX_IPADR_LEN];
-  int conn_local_port;
+  /* PureInfo primary ip_quadruple is copied over from the connectdata
+     struct in order to allow curl_easy_getinfo() to return this information
+     even when the session handle is no longer associated with a connection,
+     and also allow curl_easy_reset() to clear this information from the
+     session handle without disturbing information which is still alive, and
+     that might be reused, in the connection pool. */
+  struct ip_quadruple primary;
   const char *conn_scheme;
-  unsigned int conn_protocol;
+  uint32_t conn_protocol;
   struct curl_certinfo certs; /* info about the certs. Asked for with
                                  CURLOPT_CERTINFO / CURLINFO_CERTINFO */
   CURLproxycode pxcode;
-  BIT(timecond);  /* set to TRUE if the time condition didn't match, which
+  BIT(timecond);  /* set to TRUE if the time condition did not match, which
                      thus made the document NOT get fetched */
+  BIT(used_proxy); /* the transfer used a proxy */
 };
 
+struct pgrs_dir {
+  curl_off_t total_size; /* total expected bytes */
+  curl_off_t cur_size; /* transferred bytes so far */
+  curl_off_t speed; /* bytes per second transferred */
+  struct Curl_rlimit rlimit; /* speed limiting / pausing */
+};
 
 struct Progress {
+  struct curltime now; /* current time of processing */
   time_t lastshow; /* time() of the last displayed progress meter or NULL to
                       force redraw at next call */
-  curl_off_t size_dl; /* total expected size */
-  curl_off_t size_ul; /* total expected size */
-  curl_off_t downloaded; /* transferred so far */
-  curl_off_t uploaded; /* transferred so far */
+  struct pgrs_dir ul;
+  struct pgrs_dir dl;
+  curl_off_t deliver; /* amount of data delivered to application */
 
   curl_off_t current_speed; /* uses the currently fastest transfer */
-
-  int width; /* screen width at download start */
-  int flags; /* see progress.h */
+  curl_off_t earlydata_sent;
 
   timediff_t timespent;
 
-  curl_off_t dlspeed;
-  curl_off_t ulspeed;
-
+  timediff_t t_postqueue;
   timediff_t t_nslookup;
   timediff_t t_connect;
   timediff_t t_appconnect;
   timediff_t t_pretransfer;
+  timediff_t t_posttransfer;
   timediff_t t_starttransfer;
   timediff_t t_redirect;
 
   struct curltime start;
   struct curltime t_startsingle;
   struct curltime t_startop;
+  struct curltime t_startqueue;
   struct curltime t_acceptdata;
 
+#define CURL_SPEED_RECORDS (5 + 1) /* 6 entries for 5 seconds */
 
-  /* upload speed limit */
-  struct curltime ul_limit_start;
-  curl_off_t ul_limit_size;
-  /* download speed limit */
-  struct curltime dl_limit_start;
-  curl_off_t dl_limit_size;
-
-#define CURR_TIME (5 + 1) /* 6 entries for 5 seconds */
-
-  curl_off_t speeder[ CURR_TIME ];
-  struct curltime speeder_time[ CURR_TIME ];
-  int speeder_c;
+  curl_off_t speed_amount[CURL_SPEED_RECORDS];
+  struct curltime speed_time[CURL_SPEED_RECORDS];
+  uint32_t speeder_c;
+  BIT(hide);
+  BIT(ul_size_known);
+  BIT(dl_size_known);
+  BIT(headers_out); /* when the headers have been written */
   BIT(callback);  /* set when progress callback is used */
   BIT(is_t_startransfer_set);
 };
 
 typedef enum {
-    RTSPREQ_NONE, /* first in list */
-    RTSPREQ_OPTIONS,
-    RTSPREQ_DESCRIBE,
-    RTSPREQ_ANNOUNCE,
-    RTSPREQ_SETUP,
-    RTSPREQ_PLAY,
-    RTSPREQ_PAUSE,
-    RTSPREQ_TEARDOWN,
-    RTSPREQ_GET_PARAMETER,
-    RTSPREQ_SET_PARAMETER,
-    RTSPREQ_RECORD,
-    RTSPREQ_RECEIVE,
-    RTSPREQ_LAST /* last in list */
+  RTSPREQ_NONE, /* first in list */
+  RTSPREQ_OPTIONS,
+  RTSPREQ_DESCRIBE,
+  RTSPREQ_ANNOUNCE,
+  RTSPREQ_SETUP,
+  RTSPREQ_PLAY,
+  RTSPREQ_PAUSE,
+  RTSPREQ_TEARDOWN,
+  RTSPREQ_GET_PARAMETER,
+  RTSPREQ_SET_PARAMETER,
+  RTSPREQ_RECORD,
+  RTSPREQ_RECEIVE,
+  RTSPREQ_LAST /* last in list */
 } Curl_RtspReq;
 
 struct auth {
-  unsigned long want;  /* Bitmask set to the authentication methods wanted by
-                          app (with CURLOPT_HTTPAUTH or CURLOPT_PROXYAUTH). */
-  unsigned long picked;
-  unsigned long avail; /* Bitmask for what the server reports to support for
-                          this resource */
+  uint32_t want;  /* Bitmask set to the authentication methods wanted by app
+                     (with CURLOPT_HTTPAUTH or CURLOPT_PROXYAUTH). */
+  uint32_t picked;
+  uint32_t avail; /* Bitmask for what the server reports to support for this
+                     resource */
   BIT(done);  /* TRUE when the auth phase is done and ready to do the
                  actual request */
   BIT(multipass); /* TRUE if this is not yet authenticated but within the
                      auth multipass negotiation */
-  BIT(iestyle); /* TRUE if digest should be done IE-style or FALSE if it
-                   should be RFC compliant */
 };
 
 #ifdef USE_NGHTTP2
@@ -1237,29 +523,9 @@ struct Curl_data_prio_node {
 /**
  * Priority information for an easy handle in relation to others
  * on the same connection.
- * TODO: we need to adapt it to the new priority scheme as defined in RFC 9218
  */
 struct Curl_data_priority {
-#ifdef USE_NGHTTP2
-  /* tree like dependencies only implemented in nghttp2 */
-  struct Curl_easy *parent;
-  struct Curl_data_prio_node *children;
-#endif
   int weight;
-#ifdef USE_NGHTTP2
-  BIT(exclusive);
-#endif
-};
-
-/*
- * This struct is for holding data that was attempted to get sent to the user's
- * callback but is held due to pausing. One instance per type (BOTH, HEADER,
- * BODY).
- */
-struct tempbuf {
-  struct dynbuf b;
-  int type;   /* type of the 'tempwrite' buffer as a bitmask that is used with
-                 Curl_client_write() */
 };
 
 /* Timers */
@@ -1272,30 +538,21 @@ typedef enum {
   EXPIRE_HAPPY_EYEBALLS_DNS, /* See asyn-ares.c */
   EXPIRE_HAPPY_EYEBALLS,
   EXPIRE_MULTI_PENDING,
-  EXPIRE_RUN_NOW,
   EXPIRE_SPEEDCHECK,
   EXPIRE_TIMEOUT,
   EXPIRE_TOOFAST,
   EXPIRE_QUIC,
   EXPIRE_FTP_ACCEPT,
   EXPIRE_ALPN_EYEBALLS,
+  EXPIRE_SHUTDOWN,
   EXPIRE_LAST /* not an actual timer, used as a marker only */
 } expire_id;
 
-
-typedef enum {
-  TRAILERS_NONE,
-  TRAILERS_INITIALIZED,
-  TRAILERS_SENDING,
-  TRAILERS_DONE
-} trailers_state;
-
-
 /*
  * One instance for each timeout an easy handle can set.
  */
 struct time_node {
-  struct Curl_llist_element list;
+  struct Curl_llist_node list;
   struct curltime time;
   expire_id eid;
 };
@@ -1313,8 +570,6 @@ struct urlpieces {
 };
 
 struct UrlState {
-  /* Points to the connection cache */
-  struct conncache *conn_cache;
   /* buffers to store authentication data in, as parsed from input options */
   struct curltime keeps_speed; /* for the progress meter really */
 
@@ -1322,46 +577,49 @@ struct UrlState {
   curl_off_t recent_conn_id; /* The most recent connection used, might no
                               * longer exist */
   struct dynbuf headerb; /* buffer to store headers in */
-
-  char *buffer; /* download buffer */
-  char *ulbuf; /* allocated upload buffer or NULL */
+#ifndef CURL_DISABLE_HSTS
+  struct curl_slist *hstslist; /* list of HSTS files set by
+                                  curl_easy_setopt(HSTS) calls */
+#endif
   curl_off_t current_speed;  /* the ProgressShow() function sets this,
                                 bytes / second */
 
-  /* host name, port number and protocol of the first (not followed) request.
-     if set, this should be the host name that we will sent authorization to,
-     no else. Used to make Location: following not keep sending user+password.
-     This is strdup()ed data. */
-  char *first_host;
-  int first_remote_port;
-  curl_prot_t first_remote_protocol;
+  /* Origin of the initial (e.g. not followed) request of a transfer.
+     Credentials from CURLOPT_* are only valid for this origin.
+     Always set once a transfer starts searching for connections. */
+  struct Curl_peer *initial_origin;
+  /* Current origin of the transfer, changes to origin of follow
+   * requests. */
+  struct Curl_peer *origin;
 
-  int retrycount; /* number of retries on a new connection */
-  struct Curl_ssl_session *session; /* array of 'max_ssl_sessions' size */
-  long sessionage;                  /* number of the most recent session */
-  struct tempbuf tempwrite[3]; /* BOTH, HEADER, BODY */
-  unsigned int tempcount; /* number of entries in use in tempwrite, 0 - 3 */
   int os_errno;  /* filled in with errno whenever an error occurs */
-  char *scratch; /* huge buffer[set.buffer_size*2] for upload CRLF replacing */
-  long followlocation; /* redirect counter */
   int requests; /* request counter: redirects + authentication retakes */
 #ifdef HAVE_SIGNAL
   /* storage for the previous bag^H^H^HSIGPIPE signal handler :-) */
   void (*prev_signal)(int sig);
 #endif
 #ifndef CURL_DISABLE_DIGEST_AUTH
+  char *envproxy; /* last proxy string used for proxy-related state */
   struct digestdata digest;      /* state data for host Digest auth */
   struct digestdata proxydigest; /* state data for proxy Digest auth */
 #endif
   struct auth authhost;  /* auth details for host */
   struct auth authproxy; /* auth details for proxy */
+
 #ifdef USE_CURL_ASYNC
-  struct Curl_async async;  /* asynchronous name resolver data */
+  struct Curl_resolv_async *async;  /* asynchronous name resolver data */
 #endif
 
-#if defined(USE_OPENSSL)
+#ifdef USE_OPENSSL
   /* void instead of ENGINE to avoid bleeding OpenSSL into this header */
   void *engine;
+  /* void instead of OSSL_PROVIDER */
+  void *provider;
+  void *baseprov;
+  void *libctx;
+  char *propq; /* for a provider */
+
+  BIT(provider_loaded);
 #endif /* USE_OPENSSL */
   struct curltime expiretime; /* set this with Curl_expire() only */
   struct Curl_tree timenode; /* for the splay stuff */
@@ -1370,25 +628,16 @@ struct UrlState {
 
   /* a place to store the most recently set (S)FTP entrypath */
   char *most_recent_ftp_entrypath;
-#if !defined(WIN32) && !defined(MSDOS) && !defined(__EMX__)
-/* do FTP line-end conversions on most platforms */
-#define CURL_DO_LINEEND_CONV
-  /* for FTP downloads: track CRLF sequences that span blocks */
-  BIT(prev_block_had_trailing_cr);
-  /* for FTP downloads: how many CRLFs did we converted to LFs? */
-  curl_off_t crlf_conversions;
-#endif
   char *range; /* range, if used. See README for detailed specification on
                   this syntax. */
   curl_off_t resume_from; /* continue [ftp] transfer from here */
 
 #ifndef CURL_DISABLE_RTSP
   /* This RTSP state information survives requests and connections */
-  long rtsp_next_client_CSeq; /* the session's next client CSeq */
-  long rtsp_next_server_CSeq; /* the session's next server CSeq */
-  long rtsp_CSeq_recv; /* most recent CSeq received */
-
-  unsigned char rtp_channel_mask[32]; /* for the correctness checking of the
+  uint32_t rtsp_next_client_CSeq; /* the session's next client CSeq */
+  uint32_t rtsp_next_server_CSeq; /* the session's next server CSeq */
+  uint32_t rtsp_CSeq_recv; /* most recent CSeq received */
+  uint8_t rtp_channel_mask[32]; /* for the correctness checking of the
                                          interleaved data */
 #endif
 
@@ -1402,66 +651,60 @@ struct UrlState {
   void *in;                      /* CURLOPT_READDATA */
   CURLU *uh; /* URL handle for the current parsed URL */
   struct urlpieces up;
-  char *url;        /* work URL, copied from UserDefined */
-  char *referer;    /* referer string */
+  struct bufref url;        /* work URL, initially copied from UserDefined */
+  struct bufref referer;    /* referer string */
   struct curl_slist *resolve; /* set to point to the set.resolve list when
                                  this should be dealt with in pretransfer */
 #ifndef CURL_DISABLE_HTTP
   curl_mimepart *mimepost;
-  curl_mimepart *formp; /* storage for old API form-posting, alloced on
+#ifndef CURL_DISABLE_FORM_API
+  curl_mimepart *formp; /* storage for old API form-posting, allocated on
                            demand */
+#endif
   size_t trailers_bytes_sent;
   struct dynbuf trailers_buf; /* a buffer containing the compiled trailing
                                  headers */
   struct Curl_llist httphdrs; /* received headers */
   struct curl_header headerout[2]; /* for external purposes */
   struct Curl_header_store *prevhead; /* the latest added header */
-  trailers_state trailers_state; /* whether we are sending trailers
-                                    and what stage are we at */
 #endif
-#ifdef USE_HYPER
-  bool hconnect;  /* set if a CONNECT request */
-  CURLcode hresult; /* used to pass return codes back from hyper callbacks */
+#ifndef CURL_DISABLE_COOKIES
+  struct curl_slist *cookielist; /* list of cookie files set by
+                                    curl_easy_setopt(COOKIEFILE) calls */
 #endif
 
+#ifdef CURLVERBOSE
+  struct curl_trc_feat *feat; /* opt. trace feature transfer is part of */
+#endif
+
+#ifndef CURL_DISABLE_NETRC
+  struct store_netrc netrc;
+#endif
+
+  struct Curl_creds *creds; /* Credentials for the origin only */
+
   /* Dynamically allocated strings, MUST be freed before this struct is
      killed. */
   struct dynamically_allocated_data {
-    char *proxyuserpwd;
     char *uagent;
     char *accept_encoding;
-    char *userpwd;
     char *rangeline;
     char *ref;
     char *host;
-    char *cookiehost;
+#ifndef CURL_DISABLE_RTSP
     char *rtsp_transport;
-    char *te; /* TE: request header */
-
-    /* transfer credentials */
-    char *user;
-    char *passwd;
-    char *proxyuser;
-    char *proxypasswd;
-  } aptr;
-
-  unsigned char httpwant; /* when non-zero, a specific HTTP version requested
-                             to be used in the library's request(s) */
-  unsigned char httpversion; /* the lowest HTTP version*10 reported by any
-                                server involved in this request */
-  unsigned char httpreq; /* Curl_HttpReq; what kind of HTTP request (if any)
-                            is this */
-  unsigned char dselect_bits; /* != 0 -> bitmask of socket events for this
-                                 transfer overriding anything the socket may
-                                 report */
-#ifdef CURLDEBUG
-  BIT(conncache_lock);
 #endif
-  /* when curl_easy_perform() is called, the multi handle is "owned" by
-     the easy handle so curl_easy_cleanup() on such an easy handle will
-     also close the multi handle! */
-  BIT(multi_owned_by_easy);
+  } aptr;
+#ifndef CURL_DISABLE_HTTP
+  struct http_negotiation http_neg;
+#endif
+  uint16_t followlocation; /* redirect counter */
+  uint8_t retrycount; /* number of retries on a new connection, up to
+                               CONN_MAX_RETRIES */
+  uint8_t httpreq; /* Curl_HttpReq; what kind of HTTP request (if any)
+                            is this */
 
+  BIT(really_alive); /* transfer is really alive in multi, passed INIT */
   BIT(this_is_a_follow); /* this is a followed Location: request */
   BIT(refused_stream); /* this was refused, try again */
   BIT(errorbuf); /* Set to TRUE if the error buffer is already filled in.
@@ -1469,10 +712,9 @@ struct UrlState {
                     called. */
   BIT(allow_port); /* Is set.use_port allowed to take effect or not. This
                       is always set TRUE when curl_easy_perform() is called. */
-  BIT(authproblem); /* TRUE if there's some problem authenticating */
+  BIT(authproblem); /* TRUE if there is some problem authenticating */
   /* set after initial USER failure, to prevent an authentication loop */
   BIT(wildcardmatch); /* enable wildcard matching */
-  BIT(expect100header);  /* TRUE if we added Expect: 100-continue */
   BIT(disableexpect);    /* TRUE if Expect: is disabled due to a previous
                             417 response */
   BIT(use_range);
@@ -1480,7 +722,6 @@ struct UrlState {
   BIT(done); /* set to FALSE when Curl_init_do() is called and set to TRUE
                 when multi_done() is called, to prevent multi_done() to get
                 invoked twice when the multi interface is used. */
-  BIT(previouslypending); /* this transfer WAS in the multi->pending queue */
 #ifndef CURL_DISABLE_COOKIES
   BIT(cookie_engine);
 #endif
@@ -1488,13 +729,19 @@ struct UrlState {
 #ifdef CURL_LIST_ONLY_PROTOCOL
   BIT(list_only);      /* list directory contents */
 #endif
-  BIT(url_alloc);   /* URL string is malloc()'ed */
-  BIT(referer_alloc); /* referer string is malloc()ed */
   BIT(wildcard_resolve); /* Set to true if any resolve change is a wildcard */
-  BIT(rewindbeforesend);/* TRUE when the sending couldn't be stopped even
-                           though it will be discarded. We must call the data
-                           rewind callback before trying to send again. */
   BIT(upload);         /* upload request */
+  BIT(internal); /* internal: true if this easy handle was created for
+                    internal use and the user does not have ownership of the
+                    handle. */
+  BIT(http_ignorecustom); /* ignore custom method from now */
+#ifndef CURL_DISABLE_HTTP
+  BIT(http_hd_te); /* Added HTTP header TE: */
+  BIT(http_hd_upgrade); /* Added HTTP header Upgrade: */
+  BIT(http_hd_h2_settings); /* Added HTTP header H2Settings: */
+  BIT(maybe_folded);
+  BIT(leading_unfold); /* unfold started, this is the leading bytes */
+#endif
 };
 
 /*
@@ -1508,95 +755,127 @@ struct UrlState {
 
 struct Curl_multi;    /* declared in multihandle.c */
 
-/*
- * This enumeration MUST not use conditional directives (#ifdefs), new
- * null terminated strings MUST be added to the enumeration immediately
- * before STRING_LASTZEROTERMINATED, binary fields immediately before
- * STRING_LAST. When doing so, ensure that the packages/OS400/chkstring.c
- * test is updated and applicable changes for EBCDIC to ASCII conversion
- * are catered for in curl_easy_setopt_ccsid()
- */
 enum dupstring {
-  STRING_CERT,            /* client certificate file name */
-  STRING_CERT_PROXY,      /* client certificate file name */
+  STRING_CERT,            /* client certificate filename */
   STRING_CERT_TYPE,       /* format for certificate (default: PEM)*/
+  STRING_KEY,             /* private key filename */
+  STRING_KEY_PASSWD,      /* plain text private key password */
+  STRING_KEY_TYPE,        /* format for private key (default: PEM) */
+  STRING_SSL_CAPATH,      /* CA directory name (does not work on Windows) */
+  STRING_SSL_CAFILE,      /* certificate file to verify peer against */
+  STRING_SSL_PINNEDPUBLICKEY, /* public key file to verify peer against */
+  STRING_SSL_CIPHER_LIST, /* list of ciphers to use */
+  STRING_SSL_CIPHER13_LIST, /* list of TLS 1.3 ciphers to use */
+  STRING_SSL_CRLFILE,     /* CRL file to check certificate */
+  STRING_SSL_ISSUERCERT,  /* issuer cert file to check certificate */
+  STRING_SERVICE_NAME,    /* Service name */
+#ifndef CURL_DISABLE_PROXY
+  STRING_CERT_PROXY,      /* client certificate filename */
   STRING_CERT_TYPE_PROXY, /* format for certificate (default: PEM)*/
+  STRING_KEY_PROXY,       /* private key filename */
+  STRING_KEY_PASSWD_PROXY, /* plain text private key password */
+  STRING_KEY_TYPE_PROXY,  /* format for private key (default: PEM) */
+  STRING_SSL_CAPATH_PROXY, /* CA directory name (does not work on Windows) */
+  STRING_SSL_CAFILE_PROXY, /* certificate file to verify peer against */
+  STRING_SSL_PINNEDPUBLICKEY_PROXY, /* public key file to verify proxy */
+  STRING_SSL_CIPHER_LIST_PROXY, /* list of ciphers to use */
+  STRING_SSL_CIPHER13_LIST_PROXY, /* list of TLS 1.3 ciphers to use */
+  STRING_SSL_CRLFILE_PROXY, /* CRL file to check certificate */
+  STRING_SSL_ISSUERCERT_PROXY, /* issuer cert file to check certificate */
+  STRING_PROXY_SERVICE_NAME, /* Proxy service name */
+#endif
+#ifndef CURL_DISABLE_COOKIES
   STRING_COOKIE,          /* HTTP cookie string to send */
   STRING_COOKIEJAR,       /* dump all cookies to this file */
+#endif
   STRING_CUSTOMREQUEST,   /* HTTP/FTP/RTSP request/method to use */
-  STRING_DEFAULT_PROTOCOL, /* Protocol to use when the URL doesn't specify */
+  STRING_DEFAULT_PROTOCOL, /* Protocol to use when the URL does not specify */
   STRING_DEVICE,          /* local network interface/address to use */
+  STRING_INTERFACE,       /* local network interface to use */
+  STRING_BINDHOST,        /* local address to use */
   STRING_ENCODING,        /* Accept-Encoding string */
+#ifndef CURL_DISABLE_FTP
   STRING_FTP_ACCOUNT,     /* ftp account data */
   STRING_FTP_ALTERNATIVE_TO_USER, /* command to send if USER/PASS fails */
   STRING_FTPPORT,         /* port to send with the FTP PORT command */
-  STRING_KEY,             /* private key file name */
-  STRING_KEY_PROXY,       /* private key file name */
-  STRING_KEY_PASSWD,      /* plain text private key password */
-  STRING_KEY_PASSWD_PROXY, /* plain text private key password */
-  STRING_KEY_TYPE,        /* format for private key (default: PEM) */
-  STRING_KEY_TYPE_PROXY,  /* format for private key (default: PEM) */
-  STRING_KRB_LEVEL,       /* krb security level */
+#endif
+#ifndef CURL_DISABLE_NETRC
   STRING_NETRC_FILE,      /* if not NULL, use this instead of trying to find
                              $HOME/.netrc */
+#endif
+#ifndef CURL_DISABLE_PROXY
   STRING_PROXY,           /* proxy to use */
   STRING_PRE_PROXY,       /* pre socks proxy to use */
+#endif
   STRING_SET_RANGE,       /* range, if used */
   STRING_SET_REFERER,     /* custom string for the HTTP referer field */
   STRING_SET_URL,         /* what original URL to work on */
-  STRING_SSL_CAPATH,      /* CA directory name (doesn't work on windows) */
-  STRING_SSL_CAPATH_PROXY, /* CA directory name (doesn't work on windows) */
-  STRING_SSL_CAFILE,      /* certificate file to verify peer against */
-  STRING_SSL_CAFILE_PROXY, /* certificate file to verify peer against */
-  STRING_SSL_PINNEDPUBLICKEY, /* public key file to verify peer against */
-  STRING_SSL_PINNEDPUBLICKEY_PROXY, /* public key file to verify proxy */
-  STRING_SSL_CIPHER_LIST, /* list of ciphers to use */
-  STRING_SSL_CIPHER_LIST_PROXY, /* list of ciphers to use */
-  STRING_SSL_CIPHER13_LIST, /* list of TLS 1.3 ciphers to use */
-  STRING_SSL_CIPHER13_LIST_PROXY, /* list of TLS 1.3 ciphers to use */
   STRING_USERAGENT,       /* User-Agent string */
-  STRING_SSL_CRLFILE,     /* crl file to check certificate */
-  STRING_SSL_CRLFILE_PROXY, /* crl file to check certificate */
-  STRING_SSL_ISSUERCERT, /* issuer cert file to check certificate */
-  STRING_SSL_ISSUERCERT_PROXY, /* issuer cert file to check certificate */
-  STRING_SSL_ENGINE,      /* name of ssl engine */
+  STRING_SSL_ENGINE,      /* name of SSL engine */
   STRING_USERNAME,        /* <username>, if used */
   STRING_PASSWORD,        /* <password>, if used */
   STRING_OPTIONS,         /* <options>, if used */
+#ifndef CURL_DISABLE_PROXY
   STRING_PROXYUSERNAME,   /* Proxy <username>, if used */
   STRING_PROXYPASSWORD,   /* Proxy <password>, if used */
   STRING_NOPROXY,         /* List of hosts which should not use the proxy, if
                              used */
+#endif
+#ifndef CURL_DISABLE_RTSP
   STRING_RTSP_SESSION_ID, /* Session ID to use */
   STRING_RTSP_STREAM_URI, /* Stream URI for this request */
   STRING_RTSP_TRANSPORT,  /* Transport for this session */
+#endif
+#ifdef USE_SSH
   STRING_SSH_PRIVATE_KEY, /* path to the private key file for auth */
   STRING_SSH_PUBLIC_KEY,  /* path to the public key file for auth */
-  STRING_SSH_HOST_PUBLIC_KEY_MD5, /* md5 of host public key in ascii hex */
+  STRING_SSH_HOST_PUBLIC_KEY_MD5, /* md5 of host public key in ASCII hex */
   STRING_SSH_HOST_PUBLIC_KEY_SHA256, /* sha256 of host public key in base64 */
-  STRING_SSH_KNOWNHOSTS,  /* file name of knownhosts file */
-  STRING_PROXY_SERVICE_NAME, /* Proxy service name */
-  STRING_SERVICE_NAME,    /* Service name */
+  STRING_SSH_KNOWNHOSTS,  /* filename of knownhosts file */
+#endif
+#ifndef CURL_DISABLE_SMTP
   STRING_MAIL_FROM,
   STRING_MAIL_AUTH,
+#endif
+#ifdef USE_TLS_SRP
   STRING_TLSAUTH_USERNAME,  /* TLS auth <username> */
-  STRING_TLSAUTH_USERNAME_PROXY, /* TLS auth <username> */
   STRING_TLSAUTH_PASSWORD,  /* TLS auth <password> */
+#ifndef CURL_DISABLE_PROXY
+  STRING_TLSAUTH_USERNAME_PROXY, /* TLS auth <username> */
   STRING_TLSAUTH_PASSWORD_PROXY, /* TLS auth <password> */
+#endif
+#endif
   STRING_BEARER,                /* <bearer>, if used */
+#ifdef USE_UNIX_SOCKETS
   STRING_UNIX_SOCKET_PATH,      /* path to Unix socket, if used */
+#endif
   STRING_TARGET,                /* CURLOPT_REQUEST_TARGET */
+#ifndef CURL_DISABLE_DOH
   STRING_DOH,                   /* CURLOPT_DOH_URL */
+#endif
+#ifndef CURL_DISABLE_ALTSVC
   STRING_ALTSVC,                /* CURLOPT_ALTSVC */
+#endif
+#ifndef CURL_DISABLE_HSTS
   STRING_HSTS,                  /* CURLOPT_HSTS */
+#endif
   STRING_SASL_AUTHZID,          /* CURLOPT_SASL_AUTHZID */
+#ifdef USE_ARES
   STRING_DNS_SERVERS,
   STRING_DNS_INTERFACE,
   STRING_DNS_LOCAL_IP4,
   STRING_DNS_LOCAL_IP6,
+#endif
   STRING_SSL_EC_CURVES,
+#ifndef CURL_DISABLE_AWS
   STRING_AWS_SIGV4, /* Parameters for V4 signature */
+#endif
+#ifndef CURL_DISABLE_PROXY
   STRING_HAPROXY_CLIENT_IP,     /* CURLOPT_HAPROXY_CLIENT_IP */
+#endif
+  STRING_ECH_CONFIG,            /* CURLOPT_ECH_CONFIG */
+  STRING_ECH_PUBLIC,            /* CURLOPT_ECH_PUBLIC */
+  STRING_SSL_SIGNATURE_ALGORITHMS, /* CURLOPT_SSL_SIGNATURE_ALGORITHMS */
 
   /* -- end of null-terminated strings -- */
 
@@ -1606,26 +885,23 @@ enum dupstring {
 
   STRING_COPYPOSTFIELDS,  /* if POST, set the fields' values here */
 
-  STRING_LAST /* not used, just an end-of-list marker */
+  STRING_LAST /* not used, an end-of-list marker */
 };
 
 enum dupblob {
   BLOB_CERT,
-  BLOB_CERT_PROXY,
   BLOB_KEY,
-  BLOB_KEY_PROXY,
   BLOB_SSL_ISSUERCERT,
-  BLOB_SSL_ISSUERCERT_PROXY,
   BLOB_CAINFO,
+#ifndef CURL_DISABLE_PROXY
+  BLOB_CERT_PROXY,
+  BLOB_KEY_PROXY,
+  BLOB_SSL_ISSUERCERT_PROXY,
   BLOB_CAINFO_PROXY,
+#endif
   BLOB_LAST
 };
 
-/* callback that gets called when this easy handle is completed within a multi
-   handle.  Only used for internally created transfers, like for example
-   DoH. */
-typedef int (*multidone_func)(struct Curl_easy *easy, CURLcode result);
-
 struct UserDefined {
   FILE *err;         /* the stderr user data goes here */
   void *debugdata;   /* the data that will be passed to fdebug */
@@ -1633,28 +909,18 @@ struct UserDefined {
   void *out;         /* CURLOPT_WRITEDATA */
   void *in_set;      /* CURLOPT_READDATA */
   void *writeheader; /* write the header to this if non-NULL */
-  unsigned short use_port; /* which port to use (when not using default) */
-  unsigned long httpauth;  /* kind of HTTP authentication to use (bitmask) */
-  unsigned long proxyauth; /* kind of proxy authentication to use (bitmask) */
-  long maxredirs;    /* maximum no. of http(s) redirects to follow, set to -1
-                        for infinity */
-
+  uint32_t httpauth;  /* kind of HTTP authentication to use (bitmask) */
+  uint32_t proxyauth; /* kind of proxy authentication to use (bitmask) */
   void *postfields;  /* if POST, set the fields' values here */
   curl_seek_callback seek_func;      /* function that seeks the input */
   curl_off_t postfieldsize; /* if POST, this might have a size to use instead
                                of strlen(), and then the data *may* be binary
                                (contain zero bytes) */
-#ifndef CURL_DISABLE_BINDLOCAL
-  unsigned short localport; /* local port number to bind to */
-  unsigned short localportrange; /* number of additional port numbers to test
-                                    in case the 'localport' one can't be
-                                    bind()ed */
-#endif
   curl_write_callback fwrite_func;   /* function that stores the output */
   curl_write_callback fwrite_header; /* function that stores headers */
   curl_write_callback fwrite_rtp;    /* function that stores interleaved RTP */
   curl_read_callback fread_func_set; /* function that reads the input */
-  curl_progress_callback fprogress; /* OLD and deprecated progress callback  */
+  curl_progress_callback fprogress; /* OLD and deprecated progress callback */
   curl_xferinfo_callback fxferinfo; /* progress callback */
   curl_debug_callback fdebug;      /* function that write informational data */
   curl_ioctl_callback ioctl_func;  /* function for I/O control */
@@ -1671,13 +937,7 @@ struct UserDefined {
   void *prereq_userp; /* pre-initial request user data */
 
   void *seek_client;    /* pointer to pass to the seek callback */
-#ifndef CURL_DISABLE_COOKIES
-  struct curl_slist *cookielist; /* list of cookie files set by
-                                    curl_easy_setopt(COOKIEFILE) calls */
-#endif
 #ifndef CURL_DISABLE_HSTS
-  struct curl_slist *hstslist; /* list of HSTS files set by
-                                  curl_easy_setopt(HSTS) calls */
   curl_hstsread_callback hsts_read;
   void *hsts_read_userp;
   curl_hstswrite_callback hsts_write;
@@ -1685,27 +945,21 @@ struct UserDefined {
 #endif
   void *progress_client; /* pointer to pass to the progress callback */
   void *ioctl_client;   /* pointer to pass to the ioctl callback */
-  unsigned int timeout;        /* ms, 0 means no timeout */
-  unsigned int connecttimeout; /* ms, 0 means no timeout */
-  unsigned int happy_eyeballs_timeout; /* ms, 0 is a valid value */
-  unsigned int server_response_timeout; /* ms, 0 means no timeout */
-  long maxage_conn;     /* in seconds, max idle time to allow a connection that
-                           is to be reused */
-  long maxlifetime_conn; /* in seconds, max time since creation to allow a
-                            connection that is to be reused */
-#ifndef CURL_DISABLE_TFTP
-  long tftp_blksize;    /* in bytes, 0 means use default */
-#endif
+  timediff_t conn_max_idle_ms; /* max idle time to allow a connection that
+                                  is to be reused */
+  timediff_t conn_max_age_ms; /* max time since creation to allow a
+                                 connection that is to be reused */
   curl_off_t filesize;  /* size of file to upload, -1 means unknown */
-  long low_speed_limit; /* bytes/second */
-  long low_speed_time;  /* number of seconds */
+  curl_off_t low_speed_limit; /* bytes/second */
   curl_off_t max_send_speed; /* high speed limit in bytes/second for upload */
   curl_off_t max_recv_speed; /* high speed limit in bytes/second for
                                 download */
   curl_off_t set_resume_from;  /* continue [ftp] transfer from here */
   struct curl_slist *headers; /* linked list of extra headers */
   struct curl_httppost *httppost;  /* linked list of old POST data */
-  curl_mimepart mimepost;  /* MIME/POST data. */
+#if !defined(CURL_DISABLE_MIME) || !defined(CURL_DISABLE_FORM_API)
+  curl_mimepart *mimepostp;  /* MIME/POST data. */
+#endif
 #ifndef CURL_DISABLE_TELNET
   struct curl_slist *telnet_options; /* linked list of telnet options */
 #endif
@@ -1714,47 +968,36 @@ struct UserDefined {
   struct curl_slist *connect_to; /* list of host:port mappings to override
                                     the hostname and port to connect to */
   time_t timevalue;       /* what time to compare with */
-  unsigned char timecondition; /* kind of time comparison: curl_TimeCond */
-  unsigned char method;   /* what kind of HTTP request: Curl_HttpReq */
-  unsigned char httpwant; /* when non-zero, a specific HTTP version requested
-                             to be used in the library's request(s) */
   struct ssl_config_data ssl;  /* user defined SSL stuff */
 #ifndef CURL_DISABLE_PROXY
   struct ssl_config_data proxy_ssl;  /* user defined SSL stuff for proxy */
   struct curl_slist *proxyheaders; /* linked list of extra CONNECT headers */
-  unsigned short proxyport; /* If non-zero, use this port number by
+  uint16_t proxyport;       /* If non-zero, use this port number by
                                default. If the proxy string features a
                                ":[port]" that one will override this. */
-  unsigned char proxytype; /* what kind of proxy: curl_proxytype */
-  unsigned char socks5auth;/* kind of SOCKS5 authentication to use (bitmask) */
+  uint8_t proxytype; /* what kind of proxy */
+  uint8_t socks5auth;/* kind of SOCKS5 authentication to use (bitmask) */
 #endif
   struct ssl_general_config general_ssl; /* general user defined SSL stuff */
-  int dns_cache_timeout; /* DNS cache timeout (seconds) */
-  unsigned int buffer_size;      /* size of receive buffer to use */
-  unsigned int upload_buffer_size; /* size of upload buffer to use,
-                                      keep it >= CURL_MAX_WRITE_SIZE */
+  timediff_t dns_cache_timeout_ms; /* DNS cache timeout (milliseconds) */
+  uint32_t buffer_size;        /* size of receive buffer to use */
+  uint32_t upload_buffer_size; /* size of upload buffer to use, keep it >=
+                                  CURL_MAX_WRITE_SIZE */
   void *private_data; /* application-private data */
 #ifndef CURL_DISABLE_HTTP
   struct curl_slist *http200aliases; /* linked list of aliases for http200 */
 #endif
-  unsigned char ipver; /* the CURL_IPRESOLVE_* defines in the public header
-                          file 0 - whatever, 1 - v2, 2 - v6 */
   curl_off_t max_filesize; /* Maximum file size to download */
 #ifndef CURL_DISABLE_FTP
-  unsigned char ftp_filemethod; /* how to get to a file: curl_ftpfile  */
-  unsigned char ftpsslauth; /* what AUTH XXX to try: curl_ftpauth */
-  unsigned char ftp_ccc;   /* FTP CCC options: curl_ftpccc */
-  unsigned int accepttimeout;   /* in milliseconds, 0 means no timeout */
+  timediff_t accepttimeout;   /* in milliseconds, 0 means no timeout */
+  uint8_t ftp_filemethod; /* how to get to a file: curl_ftpfile */
+  uint8_t ftpsslauth; /* what AUTH XXX to try: curl_ftpauth */
+  uint8_t ftp_ccc;   /* FTP CCC options: curl_ftpccc */
 #endif
 #if !defined(CURL_DISABLE_FTP) || defined(USE_SSH)
   struct curl_slist *quote;     /* after connection is established */
   struct curl_slist *postquote; /* after the transfer */
   struct curl_slist *prequote; /* before the transfer, after type */
-  /* Despite the name, ftp_create_missing_dirs is for FTP(S) and SFTP
-     1 - create directories that don't exist
-     2 - the same but also allow MKD to fail once
-  */
-  unsigned char ftp_create_missing_dirs;
 #endif
 #ifdef USE_LIBSSH2
   curl_sshhostkeycallback ssh_hostkeyfunc; /* hostkey check callback */
@@ -1763,23 +1006,17 @@ struct UserDefined {
 #ifdef USE_SSH
   curl_sshkeycallback ssh_keyfunc; /* key matching callback */
   void *ssh_keyfunc_userp;         /* custom pointer to callback */
-  int ssh_auth_types;    /* allowed SSH auth types */
-  unsigned int new_directory_perms; /* when creating remote dirs */
+  uint32_t ssh_auth_types;   /* allowed SSH auth types */
+  uint32_t new_directory_perms; /* when creating remote dirs */
 #endif
-#ifndef CURL_DISABLE_NETRC
-  unsigned char use_netrc;        /* enum CURL_NETRC_OPTION values  */
-#endif
-  unsigned int new_file_perms;      /* when creating remote files */
+  uint32_t new_file_perms;      /* when creating remote files */
   char *str[STRING_LAST]; /* array of strings, pointing to allocated memory */
   struct curl_blob *blobs[BLOB_LAST];
-#ifdef ENABLE_IPV6
-  unsigned int scope_id;  /* Scope id for IPv6 */
+#ifdef USE_IPV6
+  uint32_t scope_id;  /* Scope id for IPv6 */
 #endif
   curl_prot_t allowed_protocols;
   curl_prot_t redir_protocols;
-#ifndef CURL_DISABLE_MIME
-  unsigned int mime_options;      /* Mime option flags. */
-#endif
 #ifndef CURL_DISABLE_RTSP
   void *rtp_out;     /* write RTP to this if non-NULL */
   /* Common RTSP header options */
@@ -1795,43 +1032,84 @@ struct UserDefined {
   void *fnmatch_data;
   void *wildcardptr;
 #endif
- /* GSS-API credential delegation, see the documentation of
-    CURLOPT_GSSAPI_DELEGATION */
-  unsigned char gssapi_delegation;
 
+  timediff_t timeout;   /* ms, 0 means no timeout */
+  timediff_t connecttimeout; /* ms, 0 means default timeout */
+  timediff_t happy_eyeballs_timeout; /* ms, 0 is a valid value */
+  timediff_t server_response_timeout; /* ms, 0 means no timeout */
+  timediff_t shutdowntimeout; /* ms, 0 means default timeout */
   int tcp_keepidle;     /* seconds in idle before sending keepalive probe */
   int tcp_keepintvl;    /* seconds between TCP keepalive probes */
+  int tcp_keepcnt;      /* maximum number of keepalive probes */
 
-  size_t maxconnects;    /* Max idle connections in the connection cache */
-
-  long expect_100_timeout; /* in milliseconds */
 #if defined(USE_HTTP2) || defined(USE_HTTP3)
   struct Curl_data_priority priority;
 #endif
   curl_resolver_start_callback resolver_start; /* optional callback called
                                                   before resolver start */
   void *resolver_start_client; /* pointer to pass to resolver start callback */
-  long upkeep_interval_ms;      /* Time between calls for connection upkeep. */
-  multidone_func fmultidone;
-#ifndef CURL_DISABLE_DOH
-  struct Curl_easy *dohfor; /* this is a DoH request for that transfer */
-#endif
+  timediff_t upkeep_interval_ms; /* Time between calls for connection
+                                    upkeep. */
   CURLU *uh; /* URL handle for the current parsed URL */
 #ifndef CURL_DISABLE_HTTP
   void *trailer_data; /* pointer to pass to trailer data callback */
   curl_trailer_callback trailer_callback; /* trailing data callback */
 #endif
-  char keep_post;     /* keep POSTs as POSTs after a 30x request; each
-                         bit represents a request, from 301 to 303 */
 #ifndef CURL_DISABLE_SMTP
   struct curl_slist *mail_rcpt; /* linked list of mail recipients */
+#endif
+  uint32_t maxconnects; /* Max idle connections in the connection cache */
+  short maxredirs;    /* maximum no. of http(s) redirects to follow,
+                         set to -1 for infinity */
+  uint16_t expect_100_timeout; /* in milliseconds */
+  uint16_t use_port; /* which port to use (when not using default) */
+  uint16_t low_speed_time;  /* number of seconds */
+#ifndef CURL_DISABLE_BINDLOCAL
+  uint16_t localport; /* local port number to bind to */
+  uint16_t localportrange; /* number of additional port numbers to test
+                                    in case the 'localport' one cannot be
+                                    bind()ed */
+#endif
+#ifndef CURL_DISABLE_TFTP
+  uint16_t tftp_blksize;    /* in bytes, 0 means use default */
+#endif
+#ifdef USE_ECH
+  uint8_t tls_ech;      /* TLS ECH configuration */
+#endif
+#ifndef CURL_DISABLE_NETRC
+  uint8_t use_netrc;        /* enum CURL_NETRC_OPTION values */
+#endif
+#if !defined(CURL_DISABLE_FTP) || defined(USE_SSH)
+  /* Despite the name, ftp_create_missing_dirs is for FTP(S) and SFTP
+     1 - create directories that do not exist
+     2 - the same but also allow MKD to fail once
+  */
+  uint8_t ftp_create_missing_dirs;
+#endif
+  uint8_t use_ssl;   /* if AUTH TLS is to be attempted etc, for FTP or IMAP or
+                        POP3 or others! (type: curl_usessl)*/
+  uint8_t timecondition; /* kind of time comparison: curl_TimeCond */
+  uint8_t method;   /* what kind of HTTP request: Curl_HttpReq */
+  uint8_t httpwant; /* when non-zero, a specific HTTP version requested
+                             to be used in the library's request(s) */
+  uint8_t ipver; /* the CURL_IPRESOLVE_* defines in the public header
+                          file 0 - whatever, 1 - v2, 2 - v6 */
+  uint8_t upload_flags; /* flags set by CURLOPT_UPLOAD_FLAGS */
+#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
+  /* GSS-API/SSPI credential delegation, see CURLOPT_GSSAPI_DELEGATION */
+  uint8_t gssapi_delegation;
+#endif
+  uint8_t http_follow_mode; /* follow HTTP redirects */
+  BIT(connect_only); /* make connection/request, then let application use the
+                        socket */
+  BIT(connect_only_ws); /* special websocket connect-only level */
+#ifndef CURL_DISABLE_SMTP
   BIT(mail_rcpt_allowfails); /* allow RCPT TO command to fail for some
                                 recipients */
 #endif
-  unsigned char use_ssl;   /* if AUTH TLS is to be attempted etc, for FTP or
-                              IMAP or POP3 or others! (type: curl_usessl)*/
-  unsigned char connect_only; /* make connection/request, then let
-                                 application use the socket */
+#ifndef CURL_DISABLE_MIME
+  BIT(mime_formescape);
+#endif
   BIT(is_fread_set); /* has read callback been set to non-NULL? */
 #ifndef CURL_DISABLE_TFTP
   BIT(tftp_no_options); /* do not send TFTP options requests */
@@ -1841,17 +1119,21 @@ struct UserDefined {
   BIT(cookiesession);   /* new cookie session? */
 #endif
   BIT(crlf);            /* convert crlf on ftp upload(?) */
+#ifdef USE_SSH
   BIT(ssh_compression);            /* enable SSH compression */
+#endif
 
 /* Here follows boolean settings that define how to behave during
    this session. They are STATIC, set by libcurl users or at least initially
-   and they don't change during operations. */
+   and they do not change during operations. */
   BIT(quick_exit);       /* set 1L when it is okay to leak things (like
-                            threads), as we're about to exit() anyway and
-                            don't want lengthy cleanups to delay termination,
+                            threads), as we are about to exit() anyway and
+                            do not want lengthy cleanups to delay termination,
                             e.g. after a DNS timeout */
   BIT(get_filetime);     /* get the time and get of the remote file */
+#ifndef CURL_DISABLE_PROXY
   BIT(tunnel_thru_httpproxy); /* use CONNECT through an HTTP proxy */
+#endif
   BIT(prefer_ascii);     /* ASCII rather than binary */
   BIT(remote_append);    /* append, not overwrite, on upload */
 #ifdef CURL_LIST_ONLY_PROTOCOL
@@ -1866,10 +1148,8 @@ struct UserDefined {
                             us */
   BIT(wildcard_enabled); /* enable wildcard matching */
 #endif
-  BIT(hide_progress);    /* don't use the progress meter */
   BIT(http_fail_on_error);  /* fail on HTTP error codes >= 400 */
   BIT(http_keep_sending_on_error); /* for HTTP status codes >= 300 */
-  BIT(http_follow_location); /* follow HTTP redirects */
   BIT(http_transfer_encoding); /* request compressed HTTP transfer-encoding */
   BIT(allow_auth_to_other_hosts);
   BIT(include_header); /* include received protocol headers in data output */
@@ -1878,9 +1158,8 @@ struct UserDefined {
                              location: */
   BIT(opt_no_body);    /* as set with CURLOPT_NOBODY */
   BIT(verbose);        /* output verbosity */
-  BIT(krb);            /* Kerberos connection requested */
   BIT(reuse_forbid);   /* forbidden to be reused, close after use */
-  BIT(reuse_fresh);    /* do not reuse an existing connection  */
+  BIT(reuse_fresh);    /* do not reuse an existing connection */
   BIT(no_signal);      /* do not use any signal/alarm handler */
   BIT(tcp_nodelay);    /* whether to enable TCP_NODELAY or not */
   BIT(ignorecl);       /* ignore content length */
@@ -1903,10 +1182,14 @@ struct UserDefined {
   BIT(suppress_connect_headers); /* suppress proxy CONNECT response headers
                                     from user callbacks */
   BIT(dns_shuffle_addresses); /* whether to shuffle addresses before use */
+#ifndef CURL_DISABLE_PROXY
   BIT(haproxyprotocol); /* whether to send HAProxy PROXY protocol v1
                            header */
+#endif
+#ifdef USE_UNIX_SOCKETS
   BIT(abstract_unix_socket);
-  BIT(disallow_username_in_url); /* disallow username in url */
+#endif
+  BIT(disallow_username_in_url); /* disallow username in URL */
 #ifndef CURL_DISABLE_DOH
   BIT(doh); /* DNS-over-HTTPS enabled */
   BIT(doh_verifypeer);     /* DoH certificate peer verification */
@@ -1914,19 +1197,27 @@ struct UserDefined {
   BIT(doh_verifystatus);   /* DoH certificate status verification */
 #endif
   BIT(http09_allowed); /* allow HTTP/0.9 responses */
-#ifdef USE_WEBSOCKETS
+#ifndef CURL_DISABLE_WEBSOCKETS
   BIT(ws_raw_mode);
+  BIT(ws_no_auto_pong);
 #endif
+  BIT(post301); /* keep POSTs as POSTs after a 301 request */
+  BIT(post302); /* keep POSTs as POSTs after a 302 request */
+  BIT(post303); /* keep POSTs as POSTs after a 303 request */
 };
 
-struct Names {
-  struct Curl_hash *hostcache;
-  enum {
-    HCACHE_NONE,    /* not pointing to anything */
-    HCACHE_MULTI,   /* points to a shared one in the multi handle */
-    HCACHE_SHARED   /* points to a shared one in a shared object */
-  } hostcachetype;
-};
+#ifndef CURL_DISABLE_MIME
+#define IS_MIME_POST(a)                                                 \
+  ((a)->set.mimepostp && ((a)->set.mimepostp->kind != MIMEKIND_NONE))
+#else
+#define IS_MIME_POST(a) FALSE
+#endif
+
+/* callback that gets called when a sub easy (data->master_mid set) is
+   DONE. Called on the master easy. */
+typedef void multi_sub_xfer_done_cb(struct Curl_easy *master_easy,
+                                    struct Curl_easy *sub_easy,
+                                    CURLcode result);
 
 /*
  * The 'connectdata' struct MUST have all the connection oriented stuff as we
@@ -1941,39 +1232,28 @@ struct Names {
 struct Curl_easy {
   /* First a simple identifier to easier detect if a user mix up this easy
      handle with a multi handle. Set this to CURLEASY_MAGIC_NUMBER */
-  unsigned int magic;
-  /* once an easy handle is tied to a connection cache
-     a non-negative number to distinguish this transfer from
-     other using the same cache. For easier tracking
-     in log output.
-     This may wrap around after LONG_MAX to 0 again, so it
-     has no uniqueness guarantuee for very large processings. */
+  uint32_t magic;
+  /* once an easy handle is tied to a connection pool a non-negative number to
+     distinguish this transfer from other using the same pool. For easier
+     tracking in log output. This may wrap around after LONG_MAX to 0 again,
+     so it has no uniqueness guarantee for large processings. Note: it has no
+     uniqueness either IFF more than one connection pool is used by the
+     libcurl application. */
   curl_off_t id;
-
-  /* first, two fields for the linked list of these */
-  struct Curl_easy *next;
-  struct Curl_easy *prev;
+  /* once an easy handle is added to a multi, either explicitly by the
+   * libcurl application or implicitly during `curl_easy_perform()`,
+   * a unique identifier inside this one multi instance. */
+  uint32_t mid;
+  uint32_t master_mid; /* if set, this transfer belongs to a master */
+  multi_sub_xfer_done_cb *sub_xfer_done;
 
   struct connectdata *conn;
-  struct Curl_llist_element connect_queue; /* for the pending and msgsent
-                                              lists */
-  struct Curl_llist_element conn_queue; /* list per connectdata */
 
   CURLMstate mstate;  /* the handle's state */
   CURLcode result;   /* previous result */
 
   struct Curl_message msg; /* A single posted message. */
 
-  /* Array with the plain socket numbers this handle takes care of, in no
-     particular order. Note that all sockets are added to the sockhash, where
-     the state etc are also kept. This array is mostly used to detect when a
-     socket is to be removed from the hash. See singlesocket(). */
-  curl_socket_t sockets[MAX_SOCKSPEREASYHANDLE];
-  unsigned char actions[MAX_SOCKSPEREASYHANDLE]; /* action for each socket in
-                                                    sockets[] */
-  int numsocks;
-
-  struct Names dns;
   struct Curl_multi *multi;    /* if non-NULL, points to the multi handle
                                   struct to which this "belongs" when used by
                                   the multi interface */
@@ -1981,6 +1261,13 @@ struct Curl_easy {
                                     struct to which this "belongs" when used
                                     by the easy interface */
   struct Curl_share *share;    /* Share, handles global variable mutexing */
+
+  /* `meta_hash` is a general key-value store for implementations
+   * with the lifetime of the easy handle.
+   * Elements need to be added with their own destructor to be invoked when
+   * the easy handle is cleaned up (see Curl_hash_add2()).*/
+  struct Curl_hash meta_hash;
+
 #ifdef USE_LIBPSL
   struct PslCache *psl;        /* The associated PSL cache. */
 #endif
@@ -2007,9 +1294,6 @@ struct Curl_easy {
   struct PureInfo info;        /* stats, reports and info data */
   struct curl_tlssessioninfo tsi; /* Information about the TLS session, only
                                      valid after a client has asked for it */
-#ifdef USE_HYPER
-  struct hyptransfer hyp;
-#endif
 };
 
 #define LIBCURL_NAME "libcurl"
diff --git a/third-party/curl/lib/vauth/cleartext.c b/third-party/curl/lib/vauth/cleartext.c
index c651fc5145..ca0c9967ff 100644
--- a/third-party/curl/lib/vauth/cleartext.c
+++ b/third-party/curl/lib/vauth/cleartext.c
@@ -24,26 +24,13 @@
  * Draft   LOGIN SASL Mechanism <draft-murchison-sasl-login-00.txt>
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#if !defined(CURL_DISABLE_IMAP) || !defined(CURL_DISABLE_SMTP) ||       \
-  !defined(CURL_DISABLE_POP3) || \
+#if !defined(CURL_DISABLE_IMAP) || !defined(CURL_DISABLE_SMTP) || \
+  !defined(CURL_DISABLE_POP3) ||                                  \
   (!defined(CURL_DISABLE_LDAP) && defined(USE_OPENLDAP))
 
-#include <curl/curl.h>
-#include "urldata.h"
-
 #include "vauth/vauth.h"
-#include "curl_md5.h"
-#include "warnless.h"
-#include "strtok.h"
-#include "sendf.h"
-#include "curl_printf.h"
-
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
 
 /*
  * Curl_auth_create_plain_message()
@@ -53,47 +40,35 @@
  *
  * Parameters:
  *
- * authzid [in]     - The authorization identity.
- * authcid [in]     - The authentication identity.
+ * creds   [in]     - The credentials.
  * passwd  [in]     - The password.
  * out     [out]    - The result storage.
  *
  * Returns CURLE_OK on success.
  */
-CURLcode Curl_auth_create_plain_message(const char *authzid,
-                                        const char *authcid,
-                                        const char *passwd,
+CURLcode Curl_auth_create_plain_message(struct Curl_creds *creds,
                                         struct bufref *out)
 {
-  char *plainauth;
-  size_t plainlen;
-  size_t zlen;
-  size_t clen;
-  size_t plen;
+  size_t len;
+  char *auth;
 
-  zlen = (authzid == NULL ? 0 : strlen(authzid));
-  clen = strlen(authcid);
-  plen = strlen(passwd);
+  size_t zlen = strlen(Curl_creds_sasl_authzid(creds));
+  size_t clen = strlen(Curl_creds_user(creds));
+  size_t plen = strlen(Curl_creds_passwd(creds));
 
-  /* Compute binary message length. Check for overflows. */
-  if((zlen > SIZE_T_MAX/4) || (clen > SIZE_T_MAX/4) ||
-     (plen > (SIZE_T_MAX/2 - 2)))
+  if((zlen > CURL_MAX_INPUT_LENGTH) || (clen > CURL_MAX_INPUT_LENGTH) ||
+     (plen > CURL_MAX_INPUT_LENGTH))
+    return CURLE_TOO_LARGE;
+
+  len = zlen + clen + plen + 2;
+
+  auth = curl_maprintf("%s%c%s%c%s",
+                       Curl_creds_sasl_authzid(creds), '\0',
+                       Curl_creds_user(creds), '\0',
+                       Curl_creds_passwd(creds));
+  if(!auth)
     return CURLE_OUT_OF_MEMORY;
-  plainlen = zlen + clen + plen + 2;
-
-  plainauth = malloc(plainlen + 1);
-  if(!plainauth)
-    return CURLE_OUT_OF_MEMORY;
-
-  /* Calculate the reply */
-  if(zlen)
-    memcpy(plainauth, authzid, zlen);
-  plainauth[zlen] = '\0';
-  memcpy(plainauth + zlen + 1, authcid, clen);
-  plainauth[zlen + clen + 1] = '\0';
-  memcpy(plainauth + zlen + clen + 2, passwd, plen);
-  plainauth[plainlen] = '\0';
-  Curl_bufref_set(out, plainauth, plainlen, curl_free);
+  Curl_bufref_set(out, auth, len, curl_free);
   return CURLE_OK;
 }
 
@@ -101,39 +76,37 @@ CURLcode Curl_auth_create_plain_message(const char *authzid,
  * Curl_auth_create_login_message()
  *
  * This is used to generate an already encoded LOGIN message containing the
- * user name or password ready for sending to the recipient.
+ * username or password ready for sending to the recipient.
  *
  * Parameters:
  *
- * valuep  [in]     - The user name or user's password.
+ * value   [in]     - The username or user's password.
  * out     [out]    - The result storage.
  *
- * Returns CURLE_OK on success.
+ * Returns void.
  */
-CURLcode Curl_auth_create_login_message(const char *valuep, struct bufref *out)
+void Curl_auth_create_login_message(const char *value, struct bufref *out)
 {
-  Curl_bufref_set(out, valuep, strlen(valuep), NULL);
-  return CURLE_OK;
+  Curl_bufref_set(out, value, strlen(value), NULL);
 }
 
 /*
  * Curl_auth_create_external_message()
  *
  * This is used to generate an already encoded EXTERNAL message containing
- * the user name ready for sending to the recipient.
+ * the username ready for sending to the recipient.
  *
  * Parameters:
  *
- * user    [in]     - The user name.
+ * user    [in]     - The username.
  * out     [out]    - The result storage.
  *
- * Returns CURLE_OK on success.
+ * Returns void.
  */
-CURLcode Curl_auth_create_external_message(const char *user,
-                                           struct bufref *out)
+void Curl_auth_create_external_message(const char *user, struct bufref *out)
 {
   /* This is the same formatting as the login message */
-  return Curl_auth_create_login_message(user, out);
+  Curl_auth_create_login_message(user, out);
 }
 
 #endif /* if no users */
diff --git a/third-party/curl/lib/vauth/cram.c b/third-party/curl/lib/vauth/cram.c
index 91fb261c57..023c31b58b 100644
--- a/third-party/curl/lib/vauth/cram.c
+++ b/third-party/curl/lib/vauth/cram.c
@@ -23,24 +23,13 @@
  * RFC2195 CRAM-MD5 authentication
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifndef CURL_DISABLE_DIGEST_AUTH
 
-#include <curl/curl.h>
-#include "urldata.h"
-
 #include "vauth/vauth.h"
 #include "curl_hmac.h"
 #include "curl_md5.h"
-#include "warnless.h"
-#include "curl_printf.h"
-
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
-
 
 /*
  * Curl_auth_create_cram_md5_message()
@@ -51,40 +40,41 @@
  * Parameters:
  *
  * chlg    [in]     - The challenge.
- * userp   [in]     - The user name.
+ * userp   [in]     - The username.
  * passwdp [in]     - The user's password.
  * out     [out]    - The result storage.
  *
  * Returns CURLE_OK on success.
  */
 CURLcode Curl_auth_create_cram_md5_message(const struct bufref *chlg,
-                                           const char *userp,
-                                           const char *passwdp,
+                                           struct Curl_creds *creds,
                                            struct bufref *out)
 {
   struct HMAC_context *ctxt;
   unsigned char digest[MD5_DIGEST_LEN];
   char *response;
+  const char *user = Curl_creds_user(creds);
+  const char *passwd = Curl_creds_passwd(creds);
 
   /* Compute the digest using the password as the key */
-  ctxt = Curl_HMAC_init(Curl_HMAC_MD5,
-                        (const unsigned char *) passwdp,
-                        curlx_uztoui(strlen(passwdp)));
+  ctxt = Curl_HMAC_init(&Curl_HMAC_MD5,
+                        (const unsigned char *)passwd,
+                        curlx_uztoui(strlen(passwd)));
   if(!ctxt)
     return CURLE_OUT_OF_MEMORY;
 
   /* Update the digest with the given challenge */
   if(Curl_bufref_len(chlg))
-    Curl_HMAC_update(ctxt, Curl_bufref_ptr(chlg),
+    Curl_HMAC_update(ctxt, Curl_bufref_uptr(chlg),
                      curlx_uztoui(Curl_bufref_len(chlg)));
 
   /* Finalise the digest */
   Curl_HMAC_final(ctxt, digest);
 
   /* Generate the response */
-  response = aprintf(
+  response = curl_maprintf(
     "%s %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
-    userp, digest[0], digest[1], digest[2], digest[3], digest[4],
+    user, digest[0], digest[1], digest[2], digest[3], digest[4],
     digest[5], digest[6], digest[7], digest[8], digest[9], digest[10],
     digest[11], digest[12], digest[13], digest[14], digest[15]);
   if(!response)
diff --git a/third-party/curl/lib/vauth/digest.c b/third-party/curl/lib/vauth/digest.c
index 12c6f7dd5b..1818fc96c7 100644
--- a/third-party/curl/lib/vauth/digest.c
+++ b/third-party/curl/lib/vauth/digest.c
@@ -24,31 +24,21 @@
  * RFC7616 DIGEST-SHA256, DIGEST-SHA512-256 authentication
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifndef CURL_DISABLE_DIGEST_AUTH
 
-#include <curl/curl.h>
-
 #include "vauth/vauth.h"
 #include "vauth/digest.h"
-#include "urldata.h"
-#include "curl_base64.h"
-#include "curl_hmac.h"
+#include "curlx/base64.h"
 #include "curl_md5.h"
 #include "curl_sha256.h"
-#include "vtls/vtls.h"
-#include "warnless.h"
-#include "strtok.h"
-#include "strcase.h"
-#include "curl_printf.h"
+#include "curl_sha512_256.h"
+#include "curlx/strparse.h"
 #include "rand.h"
+#include "escape.h"
 
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
-
+#ifndef USE_WINDOWS_SSPI
 #define SESSION_ALGO 1 /* for algos with this bit set */
 
 #define ALGO_MD5 0
@@ -58,7 +48,6 @@
 #define ALGO_SHA512_256 4
 #define ALGO_SHA512_256SESS (ALGO_SHA512_256 | SESSION_ALGO)
 
-#if !defined(USE_WINDOWS_SSPI)
 #define DIGEST_QOP_VALUE_AUTH             (1 << 0)
 #define DIGEST_QOP_VALUE_AUTH_INT         (1 << 1)
 #define DIGEST_QOP_VALUE_AUTH_CONF        (1 << 2)
@@ -102,7 +91,7 @@ bool Curl_auth_digest_get_pair(const char *str, char *value, char *content,
 
       case ',':
         if(!starts_with_quote) {
-          /* This signals the end of the content if we didn't get a starting
+          /* This signals the end of the content if we did not get a starting
              quote and then we do "sloppy" parsing */
           c = 0; /* the end */
           continue;
@@ -125,7 +114,6 @@ bool Curl_auth_digest_get_pair(const char *str, char *value, char *content,
         }
         else
           return FALSE;
-        break;
       }
     }
 
@@ -141,112 +129,127 @@ bool Curl_auth_digest_get_pair(const char *str, char *value, char *content,
   return TRUE;
 }
 
-#if !defined(USE_WINDOWS_SSPI)
-/* Convert md5 chunk to RFC2617 (section 3.1.3) -suitable ascii string */
-static void auth_digest_md5_to_ascii(unsigned char *source, /* 16 bytes */
-                                     unsigned char *dest) /* 33 bytes */
+#ifndef USE_WINDOWS_SSPI
+/* Convert MD5 chunk to RFC2617 (section 3.1.3) -suitable ASCII string */
+static void auth_digest_md5_to_ascii(
+  const unsigned char *source, /* 16 bytes */
+  unsigned char *dest)         /* 33 bytes */
 {
   int i;
   for(i = 0; i < 16; i++)
-    msnprintf((char *) &dest[i * 2], 3, "%02x", source[i]);
+    curl_msnprintf((char *)&dest[i * 2], 3, "%02x", source[i]);
 }
 
-/* Convert sha256 chunk to RFC7616 -suitable ascii string */
-static void auth_digest_sha256_to_ascii(unsigned char *source, /* 32 bytes */
-                                     unsigned char *dest) /* 65 bytes */
+/* Convert sha256 or SHA-512/256 chunk to RFC7616 -suitable ASCII string */
+static void auth_digest_sha256_to_ascii(
+  const unsigned char *source, /* 32 bytes */
+  unsigned char *dest)         /* 65 bytes */
 {
   int i;
   for(i = 0; i < 32; i++)
-    msnprintf((char *) &dest[i * 2], 3, "%02x", source[i]);
+    curl_msnprintf((char *)&dest[i * 2], 3, "%02x", source[i]);
 }
 
 /* Perform quoted-string escaping as described in RFC2616 and its errata */
-static char *auth_digest_string_quoted(const char *source)
+static char *auth_digest_string_quoted(const char *s)
 {
-  char *dest;
-  const char *s = source;
-  size_t n = 1; /* null terminator */
-
-  /* Calculate size needed */
+  struct dynbuf out;
+  curlx_dyn_init(&out, 2048);
+  if(!*s) /* for zero length input, make sure we return an empty string */
+    return curlx_strdup("");
   while(*s) {
-    ++n;
+    CURLcode result;
     if(*s == '"' || *s == '\\') {
-      ++n;
+      result = curlx_dyn_addn(&out, "\\", 1);
+      if(!result)
+        result = curlx_dyn_addn(&out, s, 1);
     }
-    ++s;
-  }
-
-  dest = malloc(n);
-  if(dest) {
-    char *d = dest;
-    s = source;
-    while(*s) {
-      if(*s == '"' || *s == '\\') {
-        *d++ = '\\';
-      }
-      *d++ = *s++;
+    else if((*s < ' ') || (*s > 0x7e)) {
+      unsigned char buf[3] = { '%' };
+      Curl_hexbyte(&buf[1], (unsigned char)*s);
+      result = curlx_dyn_addn(&out, buf, 3);
     }
-    *d = '\0';
+    else
+      result = curlx_dyn_addn(&out, s, 1);
+    if(result)
+      return NULL;
+    s++;
   }
-
-  return dest;
+  return curlx_dyn_ptr(&out);
 }
 
 /* Retrieves the value for a corresponding key from the challenge string
  * returns TRUE if the key could be found, FALSE if it does not exists
  */
-static bool auth_digest_get_key_value(const char *chlg,
-                                      const char *key,
-                                      char *value,
-                                      size_t max_val_len,
-                                      char end_char)
+static bool auth_digest_get_key_value(const char *chlg, const char *key,
+                                      char *buf, size_t buflen)
 {
-  char *find_pos;
-  size_t i;
+  /* keyword=[value],keyword2=[value]
+     The values may or may not be quoted.
+   */
 
-  find_pos = strstr(chlg, key);
-  if(!find_pos)
-    return FALSE;
+  do {
+    struct Curl_str data;
+    struct Curl_str name;
 
-  find_pos += strlen(key);
+    curlx_str_passblanks(&chlg);
 
-  for(i = 0; *find_pos && *find_pos != end_char && i < max_val_len - 1; ++i)
-    value[i] = *find_pos++;
-  value[i] = '\0';
+    if(!curlx_str_until(&chlg, &name, 64, '=') &&
+       !curlx_str_single(&chlg, '=')) {
+      /* this is the key, get the value, possibly quoted */
+      int rc = curlx_str_quotedword(&chlg, &data, 256);
+      if(rc == STRE_BEGQUOTE)
+        /* try unquoted until comma */
+        rc = curlx_str_until(&chlg, &data, 256, ',');
+      if(rc)
+        return FALSE; /* weird */
 
-  return TRUE;
+      if(curlx_str_cmp(&name, key)) {
+        /* if this is our key, return the value */
+        size_t len = curlx_strlen(&data);
+        const char *src = curlx_str(&data);
+        size_t i;
+        size_t outlen = 0;
+
+        if(len >= buflen)
+          /* does not fit */
+          return FALSE;
+
+        for(i = 0; i < len; i++) {
+          if(src[i] == '\\' && i + 1 < len) {
+            i++; /* skip backslash */
+          }
+          buf[outlen++] = src[i];
+        }
+        buf[outlen] = 0;
+        return TRUE;
+      }
+      if(curlx_str_single(&chlg, ','))
+        return FALSE;
+    }
+    else /* odd syntax */
+      break;
+  } while(1);
+
+  return FALSE;
 }
 
-static CURLcode auth_digest_get_qop_values(const char *options, int *value)
+static void auth_digest_get_qop_values(const char *options, int *value)
 {
-  char *tmp;
-  char *token;
-  char *tok_buf = NULL;
-
-  /* Initialise the output */
+  struct Curl_str out;
+  /* Initialize the output */
   *value = 0;
 
-  /* Tokenise the list of qop values. Use a temporary clone of the buffer since
-     strtok_r() ruins it. */
-  tmp = strdup(options);
-  if(!tmp)
-    return CURLE_OUT_OF_MEMORY;
-
-  token = strtok_r(tmp, ",", &tok_buf);
-  while(token) {
-    if(strcasecompare(token, DIGEST_QOP_VALUE_STRING_AUTH))
+  while(!curlx_str_until(&options, &out, 32, ',')) {
+    if(curlx_str_casecompare(&out, DIGEST_QOP_VALUE_STRING_AUTH))
       *value |= DIGEST_QOP_VALUE_AUTH;
-    else if(strcasecompare(token, DIGEST_QOP_VALUE_STRING_AUTH_INT))
+    else if(curlx_str_casecompare(&out, DIGEST_QOP_VALUE_STRING_AUTH_INT))
       *value |= DIGEST_QOP_VALUE_AUTH_INT;
-    else if(strcasecompare(token, DIGEST_QOP_VALUE_STRING_AUTH_CONF))
+    else if(curlx_str_casecompare(&out, DIGEST_QOP_VALUE_STRING_AUTH_CONF))
       *value |= DIGEST_QOP_VALUE_AUTH_CONF;
-
-    token = strtok_r(NULL, ",", &tok_buf);
+    if(curlx_str_single(&options, ','))
+      break;
   }
-
-  free(tmp);
-
-  return CURLE_OK;
 }
 
 /*
@@ -258,13 +261,13 @@ static CURLcode auth_digest_get_qop_values(const char *options, int *value)
  * Parameters:
  *
  * chlgref [in]     - The challenge message.
- * nonce   [in/out] - The buffer where the nonce will be stored.
+ * nonce   [in/out] - The buffer where the nonce is stored.
  * nlen    [in]     - The length of the nonce buffer.
- * realm   [in/out] - The buffer where the realm will be stored.
+ * realm   [in/out] - The buffer where the realm is stored.
  * rlen    [in]     - The length of the realm buffer.
- * alg     [in/out] - The buffer where the algorithm will be stored.
+ * alg     [in/out] - The buffer where the algorithm is stored.
  * alen    [in]     - The length of the algorithm buffer.
- * qop     [in/out] - The buffer where the qop-options will be stored.
+ * qop     [in/out] - The buffer where the qop-options is stored.
  * qlen    [in]     - The length of the qop buffer.
  *
  * Returns CURLE_OK on success.
@@ -275,28 +278,28 @@ static CURLcode auth_decode_digest_md5_message(const struct bufref *chlgref,
                                                char *alg, size_t alen,
                                                char *qop, size_t qlen)
 {
-  const char *chlg = (const char *) Curl_bufref_ptr(chlgref);
+  const char *chlg = Curl_bufref_ptr(chlgref);
 
   /* Ensure we have a valid challenge message */
   if(!Curl_bufref_len(chlgref))
     return CURLE_BAD_CONTENT_ENCODING;
 
   /* Retrieve nonce string from the challenge */
-  if(!auth_digest_get_key_value(chlg, "nonce=\"", nonce, nlen, '\"'))
+  if(!auth_digest_get_key_value(chlg, "nonce", nonce, nlen))
     return CURLE_BAD_CONTENT_ENCODING;
 
   /* Retrieve realm string from the challenge */
-  if(!auth_digest_get_key_value(chlg, "realm=\"", realm, rlen, '\"')) {
+  if(!auth_digest_get_key_value(chlg, "realm", realm, rlen)) {
     /* Challenge does not have a realm, set empty string [RFC2831] page 6 */
-    strcpy(realm, "");
+    *realm = '\0';
   }
 
   /* Retrieve algorithm string from the challenge */
-  if(!auth_digest_get_key_value(chlg, "algorithm=", alg, alen, ','))
+  if(!auth_digest_get_key_value(chlg, "algorithm", alg, alen))
     return CURLE_BAD_CONTENT_ENCODING;
 
   /* Retrieve qop-options string from the challenge */
-  if(!auth_digest_get_key_value(chlg, "qop=\"", qop, qlen, '\"'))
+  if(!auth_digest_get_key_value(chlg, "qop", qop, qlen))
     return CURLE_BAD_CONTENT_ENCODING;
 
   return CURLE_OK;
@@ -326,7 +329,7 @@ bool Curl_auth_is_digest_supported(void)
  *
  * data    [in]     - The session handle.
  * chlg    [in]     - The challenge message.
- * userp   [in]     - The user name.
+ * userp   [in]     - The username.
  * passwdp [in]     - The user's password.
  * service [in]     - The service type such as http, smtp, pop or imap.
  * out     [out]    - The result storage.
@@ -335,18 +338,21 @@ bool Curl_auth_is_digest_supported(void)
  */
 CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
                                              const struct bufref *chlg,
-                                             const char *userp,
-                                             const char *passwdp,
-                                             const char *service,
+                                             struct Curl_creds *creds,
+                                             const char *default_service,
                                              struct bufref *out)
 {
+  const char *service = Curl_creds_has_sasl_service(creds) ?
+    Curl_creds_sasl_service(creds) : default_service;
   size_t i;
   struct MD5_context *ctxt;
+  const char *userp = Curl_creds_user(creds);
+  const char *passwdp = Curl_creds_passwd(creds);
   char *response = NULL;
   unsigned char digest[MD5_DIGEST_LEN];
-  char HA1_hex[2 * MD5_DIGEST_LEN + 1];
-  char HA2_hex[2 * MD5_DIGEST_LEN + 1];
-  char resp_hash_hex[2 * MD5_DIGEST_LEN + 1];
+  char HA1_hex[(2 * MD5_DIGEST_LEN) + 1];
+  char HA2_hex[(2 * MD5_DIGEST_LEN) + 1];
+  char resp_hash_hex[(2 * MD5_DIGEST_LEN) + 1];
   char nonce[64];
   char realm[128];
   char algorithm[64];
@@ -357,6 +363,9 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
   char method[]     = "AUTHENTICATE";
   char qop[]        = DIGEST_QOP_VALUE_STRING_AUTH;
   char *spn         = NULL;
+  char *qrealm;
+  char *qnonce;
+  char *quserp;
 
   /* Decode the challenge message */
   CURLcode result = auth_decode_digest_md5_message(chlg,
@@ -370,13 +379,11 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
     return result;
 
   /* We only support md5 sessions */
-  if(strcmp(algorithm, "md5-sess") != 0)
+  if(strcmp(algorithm, "md5-sess"))
     return CURLE_BAD_CONTENT_ENCODING;
 
   /* Get the qop-values from the qop-options */
-  result = auth_digest_get_qop_values(qop_options, &qop_values);
-  if(result)
-    return result;
+  auth_digest_get_qop_values(qop_options, &qop_values);
 
   /* We only support auth quality-of-protection */
   if(!(qop_values & DIGEST_QOP_VALUE_AUTH))
@@ -387,98 +394,108 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
   if(result)
     return result;
 
-  /* So far so good, now calculate A1 and H(A1) according to RFC 2831 */
-  ctxt = Curl_MD5_init(Curl_DIGEST_MD5);
+  /* Good so far, now calculate A1 and H(A1) according to RFC 2831 */
+  ctxt = Curl_MD5_init(&Curl_DIGEST_MD5);
   if(!ctxt)
     return CURLE_OUT_OF_MEMORY;
 
-  Curl_MD5_update(ctxt, (const unsigned char *) userp,
+  Curl_MD5_update(ctxt, (const unsigned char *)userp,
                   curlx_uztoui(strlen(userp)));
-  Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
-  Curl_MD5_update(ctxt, (const unsigned char *) realm,
+  Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
+  Curl_MD5_update(ctxt, (const unsigned char *)realm,
                   curlx_uztoui(strlen(realm)));
-  Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
-  Curl_MD5_update(ctxt, (const unsigned char *) passwdp,
+  Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
+  Curl_MD5_update(ctxt, (const unsigned char *)passwdp,
                   curlx_uztoui(strlen(passwdp)));
   Curl_MD5_final(ctxt, digest);
 
-  ctxt = Curl_MD5_init(Curl_DIGEST_MD5);
+  ctxt = Curl_MD5_init(&Curl_DIGEST_MD5);
   if(!ctxt)
     return CURLE_OUT_OF_MEMORY;
 
-  Curl_MD5_update(ctxt, (const unsigned char *) digest, MD5_DIGEST_LEN);
-  Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
-  Curl_MD5_update(ctxt, (const unsigned char *) nonce,
+  Curl_MD5_update(ctxt, (const unsigned char *)digest, MD5_DIGEST_LEN);
+  Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
+  Curl_MD5_update(ctxt, (const unsigned char *)nonce,
                   curlx_uztoui(strlen(nonce)));
-  Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
-  Curl_MD5_update(ctxt, (const unsigned char *) cnonce,
+  Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
+  Curl_MD5_update(ctxt, (const unsigned char *)cnonce,
                   curlx_uztoui(strlen(cnonce)));
   Curl_MD5_final(ctxt, digest);
 
   /* Convert calculated 16 octet hex into 32 bytes string */
   for(i = 0; i < MD5_DIGEST_LEN; i++)
-    msnprintf(&HA1_hex[2 * i], 3, "%02x", digest[i]);
+    curl_msnprintf(&HA1_hex[2 * i], 3, "%02x", digest[i]);
 
   /* Generate our SPN */
-  spn = Curl_auth_build_spn(service, data->conn->host.name, NULL);
+  spn = Curl_auth_build_spn(service, data->state.origin->hostname, NULL);
   if(!spn)
     return CURLE_OUT_OF_MEMORY;
 
   /* Calculate H(A2) */
-  ctxt = Curl_MD5_init(Curl_DIGEST_MD5);
+  ctxt = Curl_MD5_init(&Curl_DIGEST_MD5);
   if(!ctxt) {
-    free(spn);
+    curlx_free(spn);
 
     return CURLE_OUT_OF_MEMORY;
   }
 
-  Curl_MD5_update(ctxt, (const unsigned char *) method,
+  Curl_MD5_update(ctxt, (const unsigned char *)method,
                   curlx_uztoui(strlen(method)));
-  Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
-  Curl_MD5_update(ctxt, (const unsigned char *) spn,
+  Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
+  Curl_MD5_update(ctxt, (const unsigned char *)spn,
                   curlx_uztoui(strlen(spn)));
   Curl_MD5_final(ctxt, digest);
 
   for(i = 0; i < MD5_DIGEST_LEN; i++)
-    msnprintf(&HA2_hex[2 * i], 3, "%02x", digest[i]);
+    curl_msnprintf(&HA2_hex[2 * i], 3, "%02x", digest[i]);
 
   /* Now calculate the response hash */
-  ctxt = Curl_MD5_init(Curl_DIGEST_MD5);
+  ctxt = Curl_MD5_init(&Curl_DIGEST_MD5);
   if(!ctxt) {
-    free(spn);
+    curlx_free(spn);
 
     return CURLE_OUT_OF_MEMORY;
   }
 
-  Curl_MD5_update(ctxt, (const unsigned char *) HA1_hex, 2 * MD5_DIGEST_LEN);
-  Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
-  Curl_MD5_update(ctxt, (const unsigned char *) nonce,
+  Curl_MD5_update(ctxt, (const unsigned char *)HA1_hex, 2 * MD5_DIGEST_LEN);
+  Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
+  Curl_MD5_update(ctxt, (const unsigned char *)nonce,
                   curlx_uztoui(strlen(nonce)));
-  Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
+  Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
 
-  Curl_MD5_update(ctxt, (const unsigned char *) nonceCount,
+  Curl_MD5_update(ctxt, (const unsigned char *)nonceCount,
                   curlx_uztoui(strlen(nonceCount)));
-  Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
-  Curl_MD5_update(ctxt, (const unsigned char *) cnonce,
+  Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
+  Curl_MD5_update(ctxt, (const unsigned char *)cnonce,
                   curlx_uztoui(strlen(cnonce)));
-  Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
-  Curl_MD5_update(ctxt, (const unsigned char *) qop,
+  Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
+  Curl_MD5_update(ctxt, (const unsigned char *)qop,
                   curlx_uztoui(strlen(qop)));
-  Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
+  Curl_MD5_update(ctxt, (const unsigned char *)":", 1);
 
-  Curl_MD5_update(ctxt, (const unsigned char *) HA2_hex, 2 * MD5_DIGEST_LEN);
+  Curl_MD5_update(ctxt, (const unsigned char *)HA2_hex, 2 * MD5_DIGEST_LEN);
   Curl_MD5_final(ctxt, digest);
 
   for(i = 0; i < MD5_DIGEST_LEN; i++)
-    msnprintf(&resp_hash_hex[2 * i], 3, "%02x", digest[i]);
+    curl_msnprintf(&resp_hash_hex[2 * i], 3, "%02x", digest[i]);
 
-  /* Generate the response */
-  response = aprintf("username=\"%s\",realm=\"%s\",nonce=\"%s\","
-                     "cnonce=\"%s\",nc=\"%s\",digest-uri=\"%s\",response=%s,"
-                     "qop=%s",
-                     userp, realm, nonce,
-                     cnonce, nonceCount, spn, resp_hash_hex, qop);
-  free(spn);
+  /* escape double quotes and backslashes in the username, realm and nonce as
+     necessary */
+  qrealm = auth_digest_string_quoted(realm);
+  qnonce = auth_digest_string_quoted(nonce);
+  quserp = auth_digest_string_quoted(userp);
+  if(qrealm && qnonce && quserp)
+    /* Generate the response */
+    response = curl_maprintf("username=\"%s\",realm=\"%s\",nonce=\"%s\","
+                             "cnonce=\"%s\",nc=\"%s\",digest-uri=\"%s\","
+                             "response=%s,qop=%s",
+                             quserp, qrealm, qnonce,
+                             cnonce, nonceCount, spn, resp_hash_hex, qop);
+
+  curlx_free(qrealm);
+  curlx_free(qnonce);
+  curlx_free(quserp);
+  curlx_free(spn);
   if(!response)
     return CURLE_OUT_OF_MEMORY;
 
@@ -504,16 +521,12 @@ CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
                                               struct digestdata *digest)
 {
   bool before = FALSE; /* got a nonce before */
-  bool foundAuth = FALSE;
-  bool foundAuthInt = FALSE;
-  char *token = NULL;
-  char *tmp = NULL;
 
   /* If we already have received a nonce, keep that in mind */
   if(digest->nonce)
     before = TRUE;
 
-  /* Clean up any former leftovers and initialise to defaults */
+  /* Clean up any former leftovers and initialize to defaults */
   Curl_auth_digest_cleanup(digest);
 
   for(;;) {
@@ -526,91 +539,97 @@ CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
 
     /* Extract a value=content pair */
     if(Curl_auth_digest_get_pair(chlg, value, content, &chlg)) {
-      if(strcasecompare(value, "nonce")) {
-        free(digest->nonce);
-        digest->nonce = strdup(content);
+      if(curl_strequal(value, "nonce")) {
+        curlx_free(digest->nonce);
+        digest->nonce = curlx_strdup(content);
         if(!digest->nonce)
           return CURLE_OUT_OF_MEMORY;
       }
-      else if(strcasecompare(value, "stale")) {
-        if(strcasecompare(content, "true")) {
+      else if(curl_strequal(value, "stale")) {
+        if(curl_strequal(content, "true")) {
           digest->stale = TRUE;
           digest->nc = 1; /* we make a new nonce now */
         }
       }
-      else if(strcasecompare(value, "realm")) {
-        free(digest->realm);
-        digest->realm = strdup(content);
+      else if(curl_strequal(value, "realm")) {
+        curlx_free(digest->realm);
+        digest->realm = curlx_strdup(content);
         if(!digest->realm)
           return CURLE_OUT_OF_MEMORY;
       }
-      else if(strcasecompare(value, "opaque")) {
-        free(digest->opaque);
-        digest->opaque = strdup(content);
+      else if(curl_strequal(value, "opaque")) {
+        curlx_free(digest->opaque);
+        digest->opaque = curlx_strdup(content);
         if(!digest->opaque)
           return CURLE_OUT_OF_MEMORY;
       }
-      else if(strcasecompare(value, "qop")) {
-        char *tok_buf = NULL;
-        /* Tokenize the list and choose auth if possible, use a temporary
-           clone of the buffer since strtok_r() ruins it */
-        tmp = strdup(content);
-        if(!tmp)
-          return CURLE_OUT_OF_MEMORY;
-
-        token = strtok_r(tmp, ",", &tok_buf);
-        while(token) {
-          /* Pass additional spaces here */
+      else if(curl_strequal(value, "qop")) {
+        const char *token = content;
+        struct Curl_str out;
+        bool foundAuth = FALSE;
+        bool foundAuthInt = FALSE;
+        /* Pass leading spaces */
+        while(*token && ISBLANK(*token))
+          token++;
+        while(!curlx_str_until(&token, &out, 32, ',')) {
+          if(curlx_str_casecompare(&out, DIGEST_QOP_VALUE_STRING_AUTH))
+            foundAuth = TRUE;
+          else if(curlx_str_casecompare(&out,
+                                        DIGEST_QOP_VALUE_STRING_AUTH_INT))
+            foundAuthInt = TRUE;
+          if(curlx_str_single(&token, ','))
+            break;
           while(*token && ISBLANK(*token))
             token++;
-          if(strcasecompare(token, DIGEST_QOP_VALUE_STRING_AUTH)) {
-            foundAuth = TRUE;
-          }
-          else if(strcasecompare(token, DIGEST_QOP_VALUE_STRING_AUTH_INT)) {
-            foundAuthInt = TRUE;
-          }
-          token = strtok_r(NULL, ",", &tok_buf);
         }
 
-        free(tmp);
-
         /* Select only auth or auth-int. Otherwise, ignore */
         if(foundAuth) {
-          free(digest->qop);
-          digest->qop = strdup(DIGEST_QOP_VALUE_STRING_AUTH);
+          curlx_free(digest->qop);
+          digest->qop = curlx_strdup(DIGEST_QOP_VALUE_STRING_AUTH);
           if(!digest->qop)
             return CURLE_OUT_OF_MEMORY;
         }
         else if(foundAuthInt) {
-          free(digest->qop);
-          digest->qop = strdup(DIGEST_QOP_VALUE_STRING_AUTH_INT);
+          curlx_free(digest->qop);
+          digest->qop = curlx_strdup(DIGEST_QOP_VALUE_STRING_AUTH_INT);
           if(!digest->qop)
             return CURLE_OUT_OF_MEMORY;
         }
       }
-      else if(strcasecompare(value, "algorithm")) {
-        free(digest->algorithm);
-        digest->algorithm = strdup(content);
+      else if(curl_strequal(value, "algorithm")) {
+        curlx_free(digest->algorithm);
+        digest->algorithm = curlx_strdup(content);
         if(!digest->algorithm)
           return CURLE_OUT_OF_MEMORY;
 
-        if(strcasecompare(content, "MD5-sess"))
+        if(curl_strequal(content, "MD5-sess"))
           digest->algo = ALGO_MD5SESS;
-        else if(strcasecompare(content, "MD5"))
+        else if(curl_strequal(content, "MD5"))
           digest->algo = ALGO_MD5;
-        else if(strcasecompare(content, "SHA-256"))
+        else if(curl_strequal(content, "SHA-256"))
           digest->algo = ALGO_SHA256;
-        else if(strcasecompare(content, "SHA-256-SESS"))
+        else if(curl_strequal(content, "SHA-256-SESS"))
           digest->algo = ALGO_SHA256SESS;
-        else if(strcasecompare(content, "SHA-512-256"))
+        else if(curl_strequal(content, "SHA-512-256")) {
+#ifdef CURL_HAVE_SHA512_256
           digest->algo = ALGO_SHA512_256;
-        else if(strcasecompare(content, "SHA-512-256-SESS"))
+#else /* !CURL_HAVE_SHA512_256 */
+          return CURLE_NOT_BUILT_IN;
+#endif /* CURL_HAVE_SHA512_256 */
+        }
+        else if(curl_strequal(content, "SHA-512-256-SESS")) {
+#ifdef CURL_HAVE_SHA512_256
           digest->algo = ALGO_SHA512_256SESS;
+#else /* !CURL_HAVE_SHA512_256 */
+          return CURLE_NOT_BUILT_IN;
+#endif /* CURL_HAVE_SHA512_256 */
+        }
         else
           return CURLE_BAD_CONTENT_ENCODING;
       }
-      else if(strcasecompare(value, "userhash")) {
-        if(strcasecompare(content, "true")) {
+      else if(curl_strequal(value, "userhash")) {
+        if(curl_strequal(content, "true")) {
           digest->userhash = TRUE;
         }
       }
@@ -619,7 +638,7 @@ CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
       }
     }
     else
-      break; /* We're done here */
+      break; /* We are done here */
 
     /* Pass all additional spaces here */
     while(*chlg && ISBLANK(*chlg))
@@ -636,7 +655,7 @@ CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
   if(before && !digest->stale)
     return CURLE_BAD_CONTENT_ENCODING;
 
-  /* We got this header without a nonce, that's a bad Digest line! */
+  /* We got this header without a nonce, that is a bad Digest line! */
   if(!digest->nonce)
     return CURLE_BAD_CONTENT_ENCODING;
 
@@ -656,30 +675,29 @@ CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
  * Parameters:
  *
  * data    [in]     - The session handle.
- * userp   [in]     - The user name.
- * passwdp [in]     - The user's password.
+ * creds   [in]     - The credentials
  * request [in]     - The HTTP request.
  * uripath [in]     - The path of the HTTP uri.
  * digest  [in/out] - The digest data struct being used and modified.
  * outptr  [in/out] - The address where a pointer to newly allocated memory
- *                    holding the result will be stored upon completion.
+ *                    holding the result is stored upon completion.
  * outlen  [out]    - The length of the output message.
  *
  * Returns CURLE_OK on success.
  */
 static CURLcode auth_create_digest_http_message(
-                  struct Curl_easy *data,
-                  const char *userp,
-                  const char *passwdp,
-                  const unsigned char *request,
-                  const unsigned char *uripath,
-                  struct digestdata *digest,
-                  char **outptr, size_t *outlen,
-                  void (*convert_to_ascii)(unsigned char *, unsigned char *),
-                  CURLcode (*hash)(unsigned char *, const unsigned char *,
-                                   const size_t))
+  struct Curl_easy *data,
+  struct Curl_creds *creds,
+  const unsigned char *request,
+  const unsigned char *uripath,
+  struct digestdata *digest,
+  char **outptr, size_t *outlen,
+  void (*convert_to_ascii)(const unsigned char *, unsigned char *),
+  CURLcode (*hash)(unsigned char *, const unsigned char *, const size_t))
 {
   CURLcode result;
+  const char *userp = Curl_creds_user(creds);
+  const char *passwdp = Curl_creds_passwd(creds);
   unsigned char hashbuf[32]; /* 32 bytes/256 bits */
   unsigned char request_digest[65];
   unsigned char ha1[65];    /* 64 digits and 1 zero byte */
@@ -687,39 +705,49 @@ static CURLcode auth_create_digest_http_message(
   char userh[65];
   char *cnonce = NULL;
   size_t cnonce_sz = 0;
-  char *userp_quoted;
-  char *realm_quoted;
-  char *nonce_quoted;
-  char *response = NULL;
+  char *userp_quoted = NULL;
+  char *realm_quoted = NULL;
+  char *nonce_quoted = NULL;
   char *hashthis = NULL;
-  char *tmp = NULL;
+  char *uri_quoted = NULL;
+  struct dynbuf response;
+  *outptr = NULL;
+
+  curlx_dyn_init(&response, 4096); /* arbitrary max */
 
   memset(hashbuf, 0, sizeof(hashbuf));
   if(!digest->nc)
     digest->nc = 1;
 
   if(!digest->cnonce) {
-    char cnoncebuf[33];
-    result = Curl_rand_hex(data, (unsigned char *)cnoncebuf,
-                           sizeof(cnoncebuf));
+    char cnoncebuf[12];
+    result = Curl_rand_bytes(data,
+#ifdef DEBUGBUILD
+                             TRUE,
+#endif
+                             (unsigned char *)cnoncebuf,
+                             sizeof(cnoncebuf));
+    if(!result)
+      result = curlx_base64_encode((uint8_t *)cnoncebuf, sizeof(cnoncebuf),
+                                   &cnonce, &cnonce_sz);
     if(result)
-      return result;
-
-    result = Curl_base64_encode(cnoncebuf, strlen(cnoncebuf),
-                                &cnonce, &cnonce_sz);
-    if(result)
-      return result;
+      goto oom;
 
     digest->cnonce = cnonce;
   }
 
   if(digest->userhash) {
-    hashthis = aprintf("%s:%s", userp, digest->realm ? digest->realm : "");
-    if(!hashthis)
-      return CURLE_OUT_OF_MEMORY;
+    char *hasht = curl_maprintf("%s:%s", userp,
+                                digest->realm ? digest->realm : "");
+    if(!hasht) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto oom;
+    }
 
-    hash(hashbuf, (unsigned char *) hashthis, strlen(hashthis));
-    free(hashthis);
+    result = hash(hashbuf, (unsigned char *)hasht, strlen(hasht));
+    curlx_free(hasht);
+    if(result)
+      goto oom;
     convert_to_ascii(hashbuf, (unsigned char *)userh);
   }
 
@@ -734,23 +762,31 @@ static CURLcode auth_create_digest_http_message(
            unq(nonce-value) ":" unq(cnonce-value)
   */
 
-  hashthis = aprintf("%s:%s:%s", userp, digest->realm ? digest->realm : "",
-                     passwdp);
-  if(!hashthis)
-    return CURLE_OUT_OF_MEMORY;
+  hashthis = curl_maprintf("%s:%s:%s", userp, digest->realm ?
+                           digest->realm : "", passwdp);
+  if(!hashthis) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto oom;
+  }
 
-  hash(hashbuf, (unsigned char *) hashthis, strlen(hashthis));
-  free(hashthis);
+  result = hash(hashbuf, (unsigned char *)hashthis, strlen(hashthis));
+  curlx_free(hashthis);
+  if(result)
+    goto oom;
   convert_to_ascii(hashbuf, ha1);
 
   if(digest->algo & SESSION_ALGO) {
     /* nonce and cnonce are OUTSIDE the hash */
-    tmp = aprintf("%s:%s:%s", ha1, digest->nonce, digest->cnonce);
-    if(!tmp)
-      return CURLE_OUT_OF_MEMORY;
+    char *tmp = curl_maprintf("%s:%s:%s", ha1, digest->nonce, digest->cnonce);
+    if(!tmp) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto oom;
+    }
 
-    hash(hashbuf, (unsigned char *) tmp, strlen(tmp));
-    free(tmp);
+    result = hash(hashbuf, (unsigned char *)tmp, strlen(tmp));
+    curlx_free(tmp);
+    if(result)
+      goto oom;
     convert_to_ascii(hashbuf, ha1);
   }
 
@@ -767,43 +803,61 @@ static CURLcode auth_create_digest_http_message(
     5.1.1 of RFC 2616)
   */
 
-  hashthis = aprintf("%s:%s", request, uripath);
-  if(!hashthis)
-    return CURLE_OUT_OF_MEMORY;
+  uri_quoted = auth_digest_string_quoted((const char *)uripath);
+  if(!uri_quoted) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto oom;
+  }
 
-  if(digest->qop && strcasecompare(digest->qop, "auth-int")) {
-    /* We don't support auth-int for PUT or POST */
+  hashthis = curl_maprintf("%s:%s", request, uripath);
+  if(!hashthis) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto oom;
+  }
+
+  if(digest->qop && curl_strequal(digest->qop, "auth-int")) {
+    /* We do not support auth-int for PUT or POST */
     char hashed[65];
     char *hashthis2;
 
-    hash(hashbuf, (const unsigned char *)"", 0);
+    result = hash(hashbuf, (const unsigned char *)"", 0);
+    if(result) {
+      curlx_free(hashthis);
+      goto oom;
+    }
     convert_to_ascii(hashbuf, (unsigned char *)hashed);
 
-    hashthis2 = aprintf("%s:%s", hashthis, hashed);
-    free(hashthis);
+    hashthis2 = curl_maprintf("%s:%s", hashthis, hashed);
+    curlx_free(hashthis);
     hashthis = hashthis2;
+    if(!hashthis) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto oom;
+    }
   }
 
-  if(!hashthis)
-    return CURLE_OUT_OF_MEMORY;
-
-  hash(hashbuf, (unsigned char *) hashthis, strlen(hashthis));
-  free(hashthis);
+  result = hash(hashbuf, (unsigned char *)hashthis, strlen(hashthis));
+  curlx_free(hashthis);
+  if(result)
+    goto oom;
   convert_to_ascii(hashbuf, ha2);
 
-  if(digest->qop) {
-    hashthis = aprintf("%s:%s:%08x:%s:%s:%s", ha1, digest->nonce, digest->nc,
-                       digest->cnonce, digest->qop, ha2);
-  }
-  else {
-    hashthis = aprintf("%s:%s:%s", ha1, digest->nonce, ha2);
+  if(digest->qop)
+    hashthis = curl_maprintf("%s:%s:%08x:%s:%s:%s", ha1, digest->nonce,
+                             (unsigned int)digest->nc, digest->cnonce,
+                             digest->qop, ha2);
+  else
+    hashthis = curl_maprintf("%s:%s:%s", ha1, digest->nonce, ha2);
+
+  if(!hashthis) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto oom;
   }
 
-  if(!hashthis)
-    return CURLE_OUT_OF_MEMORY;
-
-  hash(hashbuf, (unsigned char *) hashthis, strlen(hashthis));
-  free(hashthis);
+  result = hash(hashbuf, (unsigned char *)hashthis, strlen(hashthis));
+  curlx_free(hashthis);
+  if(result)
+    goto oom;
   convert_to_ascii(hashbuf, request_digest);
 
   /* For test case 64 (snooped from a Mozilla 1.3a request)
@@ -811,117 +865,114 @@ static CURLcode auth_create_digest_http_message(
      Authorization: Digest username="testuser", realm="testrealm", \
      nonce="1053604145", uri="/64", response="c55f7f30d83d774a3d2dcacf725abaca"
 
-     Digest parameters are all quoted strings.  Username which is provided by
-     the user will need double quotes and backslashes within it escaped.
-     realm, nonce, and opaque will need backslashes as well as they were
-     de-escaped when copied from request header.  cnonce is generated with
-     web-safe characters.  uri is already percent encoded.  nc is 8 hex
-     characters.  algorithm and qop with standard values only contain web-safe
+     Digest parameters are all quoted strings. Username which is provided by
+     the user needs double quotes and backslashes within it escaped.
+     realm, nonce, and opaque needs backslashes as well as they were
+     de-escaped when copied from request header. cnonce is generated with
+     web-safe characters. uri is already percent encoded. nc is 8 hex
+     characters. algorithm and qop with standard values only contain web-safe
      characters.
   */
   userp_quoted = auth_digest_string_quoted(digest->userhash ? userh : userp);
-  if(!userp_quoted)
-    return CURLE_OUT_OF_MEMORY;
+  if(!userp_quoted) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto oom;
+  }
   if(digest->realm)
     realm_quoted = auth_digest_string_quoted(digest->realm);
   else {
-    realm_quoted = malloc(1);
+    realm_quoted = curlx_malloc(1);
     if(realm_quoted)
       realm_quoted[0] = 0;
   }
   if(!realm_quoted) {
-    free(userp_quoted);
-    return CURLE_OUT_OF_MEMORY;
+    result = CURLE_OUT_OF_MEMORY;
+    goto oom;
   }
+
   nonce_quoted = auth_digest_string_quoted(digest->nonce);
   if(!nonce_quoted) {
-    free(realm_quoted);
-    free(userp_quoted);
-    return CURLE_OUT_OF_MEMORY;
+    result = CURLE_OUT_OF_MEMORY;
+    goto oom;
   }
 
   if(digest->qop) {
-    response = aprintf("username=\"%s\", "
-                       "realm=\"%s\", "
-                       "nonce=\"%s\", "
-                       "uri=\"%s\", "
-                       "cnonce=\"%s\", "
-                       "nc=%08x, "
-                       "qop=%s, "
-                       "response=\"%s\"",
-                       userp_quoted,
-                       realm_quoted,
-                       nonce_quoted,
-                       uripath,
-                       digest->cnonce,
-                       digest->nc,
-                       digest->qop,
-                       request_digest);
+    result = curlx_dyn_addf(&response, "username=\"%s\", "
+                            "realm=\"%s\", "
+                            "nonce=\"%s\", "
+                            "uri=\"%s\", "
+                            "cnonce=\"%s\", "
+                            "nc=%08x, "
+                            "qop=%s, "
+                            "response=\"%s\"",
+                            userp_quoted,
+                            realm_quoted,
+                            nonce_quoted,
+                            uri_quoted,
+                            digest->cnonce,
+                            (unsigned int)digest->nc,
+                            digest->qop,
+                            request_digest);
 
     /* Increment nonce-count to use another nc value for the next request */
     digest->nc++;
   }
   else {
-    response = aprintf("username=\"%s\", "
-                       "realm=\"%s\", "
-                       "nonce=\"%s\", "
-                       "uri=\"%s\", "
-                       "response=\"%s\"",
-                       userp_quoted,
-                       realm_quoted,
-                       nonce_quoted,
-                       uripath,
-                       request_digest);
+    result = curlx_dyn_addf(&response, "username=\"%s\", "
+                            "realm=\"%s\", "
+                            "nonce=\"%s\", "
+                            "uri=\"%s\", "
+                            "response=\"%s\"",
+                            userp_quoted,
+                            realm_quoted,
+                            nonce_quoted,
+                            uri_quoted,
+                            request_digest);
   }
-  free(nonce_quoted);
-  free(realm_quoted);
-  free(userp_quoted);
-  if(!response)
-    return CURLE_OUT_OF_MEMORY;
+  if(result)
+    goto oom;
 
   /* Add the optional fields */
   if(digest->opaque) {
-    char *opaque_quoted;
     /* Append the opaque */
-    opaque_quoted = auth_digest_string_quoted(digest->opaque);
+    char *opaque_quoted = auth_digest_string_quoted(digest->opaque);
     if(!opaque_quoted) {
-      free(response);
-      return CURLE_OUT_OF_MEMORY;
+      result = CURLE_OUT_OF_MEMORY;
+      goto oom;
     }
-    tmp = aprintf("%s, opaque=\"%s\"", response, opaque_quoted);
-    free(response);
-    free(opaque_quoted);
-    if(!tmp)
-      return CURLE_OUT_OF_MEMORY;
-
-    response = tmp;
+    result = curlx_dyn_addf(&response, ", opaque=\"%s\"", opaque_quoted);
+    curlx_free(opaque_quoted);
+    if(result)
+      goto oom;
   }
 
   if(digest->algorithm) {
     /* Append the algorithm */
-    tmp = aprintf("%s, algorithm=%s", response, digest->algorithm);
-    free(response);
-    if(!tmp)
-      return CURLE_OUT_OF_MEMORY;
-
-    response = tmp;
+    result = curlx_dyn_addf(&response, ", algorithm=%s", digest->algorithm);
+    if(result)
+      goto oom;
   }
 
   if(digest->userhash) {
     /* Append the userhash */
-    tmp = aprintf("%s, userhash=true", response);
-    free(response);
-    if(!tmp)
-      return CURLE_OUT_OF_MEMORY;
-
-    response = tmp;
+    result = curlx_dyn_add(&response, ", userhash=true");
+    if(result)
+      goto oom;
   }
 
   /* Return the output */
-  *outptr = response;
-  *outlen = strlen(response);
+  *outptr = curlx_dyn_ptr(&response);
+  *outlen = curlx_dyn_len(&response);
+  result = CURLE_OK;
 
-  return CURLE_OK;
+oom:
+  curlx_free(nonce_quoted);
+  curlx_free(realm_quoted);
+  curlx_free(uri_quoted);
+  curlx_free(userp_quoted);
+  if(result)
+    curlx_dyn_free(&response);
+  return result;
 }
 
 /*
@@ -933,37 +984,48 @@ static CURLcode auth_create_digest_http_message(
  * Parameters:
  *
  * data    [in]     - The session handle.
- * userp   [in]     - The user name.
+ * userp   [in]     - The username.
  * passwdp [in]     - The user's password.
  * request [in]     - The HTTP request.
  * uripath [in]     - The path of the HTTP uri.
  * digest  [in/out] - The digest data struct being used and modified.
  * outptr  [in/out] - The address where a pointer to newly allocated memory
- *                    holding the result will be stored upon completion.
+ *                    holding the result is stored upon completion.
  * outlen  [out]    - The length of the output message.
  *
  * Returns CURLE_OK on success.
  */
 CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
-                                              const char *userp,
-                                              const char *passwdp,
+                                              struct Curl_creds *creds,
                                               const unsigned char *request,
                                               const unsigned char *uripath,
                                               struct digestdata *digest,
                                               char **outptr, size_t *outlen)
 {
   if(digest->algo <= ALGO_MD5SESS)
-    return auth_create_digest_http_message(data, userp, passwdp,
+    return auth_create_digest_http_message(data, creds,
                                            request, uripath, digest,
                                            outptr, outlen,
                                            auth_digest_md5_to_ascii,
                                            Curl_md5it);
-  DEBUGASSERT(digest->algo <= ALGO_SHA512_256SESS);
-  return auth_create_digest_http_message(data, userp, passwdp,
-                                         request, uripath, digest,
-                                         outptr, outlen,
-                                         auth_digest_sha256_to_ascii,
-                                         Curl_sha256it);
+
+  if(digest->algo <= ALGO_SHA256SESS)
+    return auth_create_digest_http_message(data, creds,
+                                           request, uripath, digest,
+                                           outptr, outlen,
+                                           auth_digest_sha256_to_ascii,
+                                           Curl_sha256it);
+#ifdef CURL_HAVE_SHA512_256
+  if(digest->algo <= ALGO_SHA512_256SESS)
+    return auth_create_digest_http_message(data, creds,
+                                           request, uripath, digest,
+                                           outptr, outlen,
+                                           auth_digest_sha256_to_ascii,
+                                           Curl_sha512_256it);
+#endif /* CURL_HAVE_SHA512_256 */
+
+  /* Should be unreachable */
+  return CURLE_BAD_CONTENT_ENCODING;
 }
 
 /*
@@ -978,18 +1040,20 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
  */
 void Curl_auth_digest_cleanup(struct digestdata *digest)
 {
-  Curl_safefree(digest->nonce);
-  Curl_safefree(digest->cnonce);
-  Curl_safefree(digest->realm);
-  Curl_safefree(digest->opaque);
-  Curl_safefree(digest->qop);
-  Curl_safefree(digest->algorithm);
+  Curl_peer_unlink(&digest->origin);
+  Curl_creds_unlink(&digest->creds);
+  curlx_safefree(digest->nonce);
+  curlx_safefree(digest->cnonce);
+  curlx_safefree(digest->realm);
+  curlx_safefree(digest->opaque);
+  curlx_safefree(digest->qop);
+  curlx_safefree(digest->algorithm);
 
   digest->nc = 0;
   digest->algo = ALGO_MD5; /* default algorithm */
-  digest->stale = FALSE; /* default means normal, not stale */
+  digest->stale = FALSE;   /* default means normal, not stale */
   digest->userhash = FALSE;
 }
-#endif  /* !USE_WINDOWS_SSPI */
+#endif /* !USE_WINDOWS_SSPI */
 
-#endif  /* !CURL_DISABLE_DIGEST_AUTH */
+#endif /* !CURL_DISABLE_DIGEST_AUTH */
diff --git a/third-party/curl/lib/vauth/digest.h b/third-party/curl/lib/vauth/digest.h
index 99ce1f9138..5b8f3ae767 100644
--- a/third-party/curl/lib/vauth/digest.h
+++ b/third-party/curl/lib/vauth/digest.h
@@ -23,8 +23,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
-#include <curl/curl.h>
+#include "curl_setup.h"
 
 #ifndef CURL_DISABLE_DIGEST_AUTH
 
diff --git a/third-party/curl/lib/vauth/digest_sspi.c b/third-party/curl/lib/vauth/digest_sspi.c
index 02e36ea5ed..305e367e17 100644
--- a/third-party/curl/lib/vauth/digest_sspi.c
+++ b/third-party/curl/lib/vauth/digest_sspi.c
@@ -24,51 +24,45 @@
  * RFC2831 DIGEST-MD5 authentication
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if defined(USE_WINDOWS_SSPI) && !defined(CURL_DISABLE_DIGEST_AUTH)
 
-#include <curl/curl.h>
-
+#include "creds.h"
 #include "vauth/vauth.h"
 #include "vauth/digest.h"
-#include "urldata.h"
-#include "warnless.h"
-#include "curl_multibyte.h"
-#include "sendf.h"
-#include "strdup.h"
+#include "curlx/multibyte.h"
+#include "curl_trc.h"
+#include "curlx/strdup.h"
 #include "strcase.h"
 #include "strerror.h"
 
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
-
 /*
-* Curl_auth_is_digest_supported()
-*
-* This is used to evaluate if DIGEST is supported.
-*
-* Parameters: None
-*
-* Returns TRUE if DIGEST is supported by Windows SSPI.
-*/
+ * Curl_auth_is_digest_supported()
+ *
+ * This is used to evaluate if DIGEST is supported.
+ *
+ * Parameters: None
+ *
+ * Returns TRUE if DIGEST is supported by Windows SSPI.
+ */
 bool Curl_auth_is_digest_supported(void)
 {
   PSecPkgInfo SecurityPackage;
   SECURITY_STATUS status;
 
   /* Query the security package for Digest */
-  status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_DIGEST),
-                                              &SecurityPackage);
+  status =
+    Curl_pSecFn->QuerySecurityPackageInfo(
+                                   (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_DIGEST)),
+                                   &SecurityPackage);
 
   /* Release the package buffer as it is not required anymore */
   if(status == SEC_E_OK) {
-    s_pSecFn->FreeContextBuffer(SecurityPackage);
+    Curl_pSecFn->FreeContextBuffer(SecurityPackage);
   }
 
-  return (status == SEC_E_OK ? TRUE : FALSE);
+  return status == SEC_E_OK;
 }
 
 /*
@@ -81,7 +75,7 @@ bool Curl_auth_is_digest_supported(void)
  *
  * data    [in]     - The session handle.
  * chlg    [in]     - The challenge message.
- * userp   [in]     - The user name in the format User or Domain\User.
+ * userp   [in]     - The username in the format User or Domain\User.
  * passwdp [in]     - The user's password.
  * service [in]     - The service type such as http, smtp, pop or imap.
  * out     [out]    - The result storage.
@@ -90,9 +84,8 @@ bool Curl_auth_is_digest_supported(void)
  */
 CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
                                              const struct bufref *chlg,
-                                             const char *userp,
-                                             const char *passwdp,
-                                             const char *service,
+                                             struct Curl_creds *creds,
+                                             const char *default_service,
                                              struct bufref *out)
 {
   CURLcode result = CURLE_OK;
@@ -110,7 +103,8 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
   SecBufferDesc resp_desc;
   SECURITY_STATUS status;
   unsigned long attrs;
-  TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
+  const char *service = Curl_creds_has_sasl_service(creds) ?
+    Curl_creds_sasl_service(creds) : default_service;
 
   /* Ensure we have a valid challenge message */
   if(!Curl_bufref_len(chlg)) {
@@ -119,36 +113,39 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
   }
 
   /* Query the security package for DigestSSP */
-  status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_DIGEST),
-                                              &SecurityPackage);
+  status =
+    Curl_pSecFn->QuerySecurityPackageInfo(
+                                   (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_DIGEST)),
+                                   &SecurityPackage);
   if(status != SEC_E_OK) {
-    failf(data, "SSPI: couldn't get auth info");
+    failf(data, "SSPI: could not get auth info");
     return CURLE_AUTH_ERROR;
   }
 
   token_max = SecurityPackage->cbMaxToken;
 
   /* Release the package buffer as it is not required anymore */
-  s_pSecFn->FreeContextBuffer(SecurityPackage);
+  Curl_pSecFn->FreeContextBuffer(SecurityPackage);
 
   /* Allocate our response buffer */
-  output_token = malloc(token_max);
+  output_token = curlx_malloc(token_max);
   if(!output_token)
     return CURLE_OUT_OF_MEMORY;
 
   /* Generate our SPN */
-  spn = Curl_auth_build_spn(service, data->conn->host.name, NULL);
+  spn = Curl_auth_build_spn(service, data->state.origin->hostname, NULL);
   if(!spn) {
-    free(output_token);
+    curlx_free(output_token);
     return CURLE_OUT_OF_MEMORY;
   }
 
-  if(userp && *userp) {
+  if(Curl_creds_has_user(creds)) {
     /* Populate our identity structure */
-    result = Curl_create_sspi_identity(userp, passwdp, &identity);
+    result = Curl_create_sspi_identity(creds->user, creds->passwd,
+                                       &identity);
     if(result) {
-      free(spn);
-      free(output_token);
+      curlx_free(spn);
+      curlx_free(output_token);
       return result;
     }
 
@@ -160,16 +157,16 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
     p_identity = NULL;
 
   /* Acquire our credentials handle */
-  status = s_pSecFn->AcquireCredentialsHandle(NULL,
-                                              (TCHAR *) TEXT(SP_NAME_DIGEST),
-                                              SECPKG_CRED_OUTBOUND, NULL,
-                                              p_identity, NULL, NULL,
-                                              &credentials, &expiry);
+  status = Curl_pSecFn->AcquireCredentialsHandle(NULL,
+                                   (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_DIGEST)),
+                                   SECPKG_CRED_OUTBOUND, NULL,
+                                   p_identity, NULL, NULL,
+                                   &credentials, NULL);
 
   if(status != SEC_E_OK) {
     Curl_sspi_free_identity(p_identity);
-    free(spn);
-    free(output_token);
+    curlx_free(spn);
+    curlx_free(output_token);
     return CURLE_LOGIN_DENIED;
   }
 
@@ -178,7 +175,7 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
   chlg_desc.cBuffers  = 1;
   chlg_desc.pBuffers  = &chlg_buf;
   chlg_buf.BufferType = SECBUFFER_TOKEN;
-  chlg_buf.pvBuffer   = (void *) Curl_bufref_ptr(chlg);
+  chlg_buf.pvBuffer   = CURL_UNCONST(Curl_bufref_ptr(chlg));
   chlg_buf.cbBuffer   = curlx_uztoul(Curl_bufref_len(chlg));
 
   /* Setup the response "output" security buffer */
@@ -190,23 +187,21 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
   resp_buf.cbBuffer   = curlx_uztoul(token_max);
 
   /* Generate our response message */
-  status = s_pSecFn->InitializeSecurityContext(&credentials, NULL, spn,
-                                               0, 0, 0, &chlg_desc, 0,
-                                               &context, &resp_desc, &attrs,
-                                               &expiry);
+  status = Curl_pSecFn->InitializeSecurityContext(&credentials, NULL, spn,
+                                                  0, 0, 0, &chlg_desc, 0,
+                                                  &context, &resp_desc, &attrs,
+                                                  NULL);
 
   if(status == SEC_I_COMPLETE_NEEDED ||
      status == SEC_I_COMPLETE_AND_CONTINUE)
-    s_pSecFn->CompleteAuthToken(&credentials, &resp_desc);
+    Curl_pSecFn->CompleteAuthToken(&credentials, &resp_desc);
   else if(status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED) {
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
-    char buffer[STRERROR_LEN];
-#endif
+    VERBOSE(char buffer[STRERROR_LEN]);
 
-    s_pSecFn->FreeCredentialsHandle(&credentials);
+    Curl_pSecFn->FreeCredentialsHandle(&credentials);
     Curl_sspi_free_identity(p_identity);
-    free(spn);
-    free(output_token);
+    curlx_free(spn);
+    curlx_free(output_token);
 
     if(status == SEC_E_INSUFFICIENT_MEMORY)
       return CURLE_OUT_OF_MEMORY;
@@ -221,14 +216,14 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
   Curl_bufref_set(out, output_token, resp_buf.cbBuffer, curl_free);
 
   /* Free our handles */
-  s_pSecFn->DeleteSecurityContext(&context);
-  s_pSecFn->FreeCredentialsHandle(&credentials);
+  Curl_pSecFn->DeleteSecurityContext(&context);
+  Curl_pSecFn->FreeCredentialsHandle(&credentials);
 
   /* Free the identity structure */
   Curl_sspi_free_identity(p_identity);
 
   /* Free the SPN */
-  free(spn);
+  curlx_free(spn);
 
   return result;
 }
@@ -236,7 +231,7 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
 /*
  * Curl_override_sspi_http_realm()
  *
- * This is used to populate the domain in a SSPI identity structure
+ * This is used to populate the domain in an SSPI identity structure
  * The realm is extracted from the challenge message and used as the
  * domain if it is not already explicitly set.
  *
@@ -264,32 +259,32 @@ CURLcode Curl_override_sspi_http_realm(const char *chlg,
 
       /* Extract a value=content pair */
       if(Curl_auth_digest_get_pair(chlg, value, content, &chlg)) {
-        if(strcasecompare(value, "realm")) {
+        if(curl_strequal(value, "realm")) {
 
           /* Setup identity's domain and length */
-          domain.tchar_ptr = curlx_convert_UTF8_to_tchar((char *) content);
+          domain.tchar_ptr = curlx_convert_UTF8_to_tchar(content);
           if(!domain.tchar_ptr)
             return CURLE_OUT_OF_MEMORY;
 
-          dup_domain.tchar_ptr = _tcsdup(domain.tchar_ptr);
+          dup_domain.tchar_ptr = curlx_tcsdup(domain.tchar_ptr);
           if(!dup_domain.tchar_ptr) {
-            curlx_unicodefree(domain.tchar_ptr);
+            curlx_free(domain.tchar_ptr);
             return CURLE_OUT_OF_MEMORY;
           }
 
-          free(identity->Domain);
+          curlx_free(identity->Domain);
           identity->Domain = dup_domain.tbyte_ptr;
           identity->DomainLength = curlx_uztoul(_tcslen(dup_domain.tchar_ptr));
           dup_domain.tchar_ptr = NULL;
 
-          curlx_unicodefree(domain.tchar_ptr);
+          curlx_free(domain.tchar_ptr);
         }
         else {
           /* Unknown specifier, ignore it! */
         }
       }
       else
-        break; /* We're done here */
+        break; /* We are done here */
 
       /* Pass all additional spaces here */
       while(*chlg && ISBLANK(*chlg))
@@ -322,10 +317,10 @@ CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
 {
   size_t chlglen = strlen(chlg);
 
-  /* We had an input token before so if there's another one now that means we
-     provided bad credentials in the previous request or it's stale. */
+  /* We had an input token before so if there is another one now that means we
+     provided bad credentials in the previous request or it is stale. */
   if(digest->input_token) {
-    bool stale = false;
+    bool stale = FALSE;
     const char *p = chlg;
 
     /* Check for the 'stale' directive */
@@ -339,9 +334,9 @@ CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
       if(!Curl_auth_digest_get_pair(p, value, content, &p))
         break;
 
-      if(strcasecompare(value, "stale") &&
-         strcasecompare(content, "true")) {
-        stale = true;
+      if(curl_strequal(value, "stale") &&
+         curl_strequal(content, "true")) {
+        stale = TRUE;
         break;
       }
 
@@ -359,7 +354,7 @@ CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
   }
 
   /* Store the challenge for use later */
-  digest->input_token = (BYTE *) Curl_memdup(chlg, chlglen + 1);
+  digest->input_token = (BYTE *)curlx_memdup(chlg, chlglen + 1);
   if(!digest->input_token)
     return CURLE_OUT_OF_MEMORY;
 
@@ -377,20 +372,19 @@ CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
  * Parameters:
  *
  * data    [in]     - The session handle.
- * userp   [in]     - The user name in the format User or Domain\User.
+ * userp   [in]     - The username in the format User or Domain\User.
  * passwdp [in]     - The user's password.
  * request [in]     - The HTTP request.
  * uripath [in]     - The path of the HTTP uri.
  * digest  [in/out] - The digest data struct being used and modified.
  * outptr  [in/out] - The address where a pointer to newly allocated memory
- *                    holding the result will be stored upon completion.
+ *                    holding the result is stored upon completion.
  * outlen  [out]    - The length of the output message.
  *
  * Returns CURLE_OK on success.
  */
 CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
-                                              const char *userp,
-                                              const char *passwdp,
+                                              struct Curl_creds *creds,
                                               const unsigned char *request,
                                               const unsigned char *uripath,
                                               struct digestdata *digest,
@@ -405,40 +399,36 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
   SecBufferDesc chlg_desc;
   SECURITY_STATUS status;
 
-  (void) data;
-
   /* Query the security package for DigestSSP */
-  status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_DIGEST),
-                                              &SecurityPackage);
+  status =
+    Curl_pSecFn->QuerySecurityPackageInfo(
+                                   (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_DIGEST)),
+                                   &SecurityPackage);
   if(status != SEC_E_OK) {
-    failf(data, "SSPI: couldn't get auth info");
+    failf(data, "SSPI: could not get auth info");
     return CURLE_AUTH_ERROR;
   }
 
   token_max = SecurityPackage->cbMaxToken;
 
   /* Release the package buffer as it is not required anymore */
-  s_pSecFn->FreeContextBuffer(SecurityPackage);
+  Curl_pSecFn->FreeContextBuffer(SecurityPackage);
 
   /* Allocate the output buffer according to the max token size as indicated
      by the security package */
-  output_token = malloc(token_max);
+  output_token = curlx_malloc(token_max);
   if(!output_token) {
     return CURLE_OUT_OF_MEMORY;
   }
 
   /* If the user/passwd that was used to make the identity for http_context
      has changed then delete that context. */
-  if((userp && !digest->user) || (!userp && digest->user) ||
-     (passwdp && !digest->passwd) || (!passwdp && digest->passwd) ||
-     (userp && digest->user && Curl_timestrcmp(userp, digest->user)) ||
-     (passwdp && digest->passwd && Curl_timestrcmp(passwdp, digest->passwd))) {
+  if(!Curl_creds_same(creds, digest->creds)) {
     if(digest->http_context) {
-      s_pSecFn->DeleteSecurityContext(digest->http_context);
-      Curl_safefree(digest->http_context);
+      Curl_pSecFn->DeleteSecurityContext(digest->http_context);
+      curlx_safefree(digest->http_context);
     }
-    Curl_safefree(digest->user);
-    Curl_safefree(digest->passwd);
+    Curl_creds_unlink(&digest->creds);
   }
 
   if(digest->http_context) {
@@ -449,11 +439,11 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
     chlg_buf[0].pvBuffer   = NULL;
     chlg_buf[0].cbBuffer   = 0;
     chlg_buf[1].BufferType = SECBUFFER_PKG_PARAMS;
-    chlg_buf[1].pvBuffer   = (void *) request;
-    chlg_buf[1].cbBuffer   = curlx_uztoul(strlen((const char *) request));
+    chlg_buf[1].pvBuffer   = CURL_UNCONST(request);
+    chlg_buf[1].cbBuffer   = curlx_uztoul(strlen((const char *)request));
     chlg_buf[2].BufferType = SECBUFFER_PKG_PARAMS;
-    chlg_buf[2].pvBuffer   = (void *) uripath;
-    chlg_buf[2].cbBuffer   = curlx_uztoul(strlen((const char *) uripath));
+    chlg_buf[2].pvBuffer   = CURL_UNCONST(uripath);
+    chlg_buf[2].cbBuffer   = curlx_uztoul(strlen((const char *)uripath));
     chlg_buf[3].BufferType = SECBUFFER_PKG_PARAMS;
     chlg_buf[3].pvBuffer   = NULL;
     chlg_buf[3].cbBuffer   = 0;
@@ -461,14 +451,15 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
     chlg_buf[4].pvBuffer   = output_token;
     chlg_buf[4].cbBuffer   = curlx_uztoul(token_max);
 
-    status = s_pSecFn->MakeSignature(digest->http_context, 0, &chlg_desc, 0);
+    status = Curl_pSecFn->MakeSignature(digest->http_context, 0, &chlg_desc,
+                                        0);
     if(status == SEC_E_OK)
       output_token_len = chlg_buf[4].cbBuffer;
     else { /* delete the context so a new one can be made */
       infof(data, "digest_sspi: MakeSignature failed, error 0x%08lx",
-            (long)status);
-      s_pSecFn->DeleteSecurityContext(digest->http_context);
-      Curl_safefree(digest->http_context);
+            (unsigned long)status);
+      Curl_pSecFn->DeleteSecurityContext(digest->http_context);
+      curlx_safefree(digest->http_context);
     }
   }
 
@@ -479,24 +470,23 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
     SecBuffer resp_buf;
     SecBufferDesc resp_desc;
     unsigned long attrs;
-    TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
     TCHAR *spn;
 
-    /* free the copy of user/passwd used to make the previous identity */
-    Curl_safefree(digest->user);
-    Curl_safefree(digest->passwd);
+    /* free the credentials used to make the previous identity */
+    Curl_creds_unlink(&digest->creds);
 
-    if(userp && *userp) {
+    if(Curl_creds_has_user(creds)) {
       /* Populate our identity structure */
-      if(Curl_create_sspi_identity(userp, passwdp, &identity)) {
-        free(output_token);
+      if(Curl_create_sspi_identity(creds->user, creds->passwd, &identity)) {
+        curlx_free(output_token);
         return CURLE_OUT_OF_MEMORY;
       }
 
       /* Populate our identity domain */
-      if(Curl_override_sspi_http_realm((const char *) digest->input_token,
+      if(Curl_override_sspi_http_realm((const char *)digest->input_token,
                                        &identity)) {
-        free(output_token);
+        Curl_sspi_free_identity(&identity);
+        curlx_free(output_token);
         return CURLE_OUT_OF_MEMORY;
       }
 
@@ -507,34 +497,18 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
       /* Use the current Windows user */
       p_identity = NULL;
 
-    if(userp) {
-      digest->user = strdup(userp);
-
-      if(!digest->user) {
-        free(output_token);
-        return CURLE_OUT_OF_MEMORY;
-      }
-    }
-
-    if(passwdp) {
-      digest->passwd = strdup(passwdp);
-
-      if(!digest->passwd) {
-        free(output_token);
-        Curl_safefree(digest->user);
-        return CURLE_OUT_OF_MEMORY;
-      }
-    }
+    if(creds)
+      Curl_creds_link(&digest->creds, creds);
 
     /* Acquire our credentials handle */
-    status = s_pSecFn->AcquireCredentialsHandle(NULL,
-                                                (TCHAR *) TEXT(SP_NAME_DIGEST),
-                                                SECPKG_CRED_OUTBOUND, NULL,
-                                                p_identity, NULL, NULL,
-                                                &credentials, &expiry);
+    status = Curl_pSecFn->AcquireCredentialsHandle(NULL,
+                                   (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_DIGEST)),
+                                   SECPKG_CRED_OUTBOUND, NULL,
+                                   p_identity, NULL, NULL,
+                                   &credentials, NULL);
     if(status != SEC_E_OK) {
       Curl_sspi_free_identity(p_identity);
-      free(output_token);
+      curlx_free(output_token);
 
       return CURLE_LOGIN_DENIED;
     }
@@ -547,8 +521,8 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
     chlg_buf[0].pvBuffer   = digest->input_token;
     chlg_buf[0].cbBuffer   = curlx_uztoul(digest->input_token_len);
     chlg_buf[1].BufferType = SECBUFFER_PKG_PARAMS;
-    chlg_buf[1].pvBuffer   = (void *) request;
-    chlg_buf[1].cbBuffer   = curlx_uztoul(strlen((const char *) request));
+    chlg_buf[1].pvBuffer   = CURL_UNCONST(request);
+    chlg_buf[1].cbBuffer   = curlx_uztoul(strlen((const char *)request));
     chlg_buf[2].BufferType = SECBUFFER_PKG_PARAMS;
     chlg_buf[2].pvBuffer   = NULL;
     chlg_buf[2].cbBuffer   = 0;
@@ -561,44 +535,48 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
     resp_buf.pvBuffer   = output_token;
     resp_buf.cbBuffer   = curlx_uztoul(token_max);
 
-    spn = curlx_convert_UTF8_to_tchar((char *) uripath);
+    spn = curlx_convert_UTF8_to_tchar((const char *)uripath);
     if(!spn) {
-      s_pSecFn->FreeCredentialsHandle(&credentials);
+      Curl_pSecFn->FreeCredentialsHandle(&credentials);
 
       Curl_sspi_free_identity(p_identity);
-      free(output_token);
+      curlx_free(output_token);
 
       return CURLE_OUT_OF_MEMORY;
     }
 
     /* Allocate our new context handle */
-    digest->http_context = calloc(1, sizeof(CtxtHandle));
-    if(!digest->http_context)
+    digest->http_context = curlx_calloc(1, sizeof(CtxtHandle));
+    if(!digest->http_context) {
+      Curl_pSecFn->FreeCredentialsHandle(&credentials);
+      curlx_free(spn);
+      Curl_sspi_free_identity(p_identity);
+      curlx_free(output_token);
       return CURLE_OUT_OF_MEMORY;
+    }
 
     /* Generate our response message */
-    status = s_pSecFn->InitializeSecurityContext(&credentials, NULL,
-                                                 spn,
-                                                 ISC_REQ_USE_HTTP_STYLE, 0, 0,
-                                                 &chlg_desc, 0,
-                                                 digest->http_context,
-                                                 &resp_desc, &attrs, &expiry);
-    curlx_unicodefree(spn);
+    status = Curl_pSecFn->InitializeSecurityContext(&credentials, NULL,
+                                                    spn,
+                                                    ISC_REQ_USE_HTTP_STYLE,
+                                                    0, 0,
+                                                    &chlg_desc, 0,
+                                                    digest->http_context,
+                                                    &resp_desc, &attrs, NULL);
+    curlx_free(spn);
 
     if(status == SEC_I_COMPLETE_NEEDED ||
        status == SEC_I_COMPLETE_AND_CONTINUE)
-      s_pSecFn->CompleteAuthToken(&credentials, &resp_desc);
+      Curl_pSecFn->CompleteAuthToken(&credentials, &resp_desc);
     else if(status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED) {
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
-      char buffer[STRERROR_LEN];
-#endif
+      VERBOSE(char buffer[STRERROR_LEN]);
 
-      s_pSecFn->FreeCredentialsHandle(&credentials);
+      Curl_pSecFn->FreeCredentialsHandle(&credentials);
 
       Curl_sspi_free_identity(p_identity);
-      free(output_token);
+      curlx_free(output_token);
 
-      Curl_safefree(digest->http_context);
+      curlx_safefree(digest->http_context);
 
       if(status == SEC_E_INSUFFICIENT_MEMORY)
         return CURLE_OUT_OF_MEMORY;
@@ -611,28 +589,19 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
 
     output_token_len = resp_buf.cbBuffer;
 
-    s_pSecFn->FreeCredentialsHandle(&credentials);
+    Curl_pSecFn->FreeCredentialsHandle(&credentials);
     Curl_sspi_free_identity(p_identity);
   }
 
-  resp = malloc(output_token_len + 1);
+  resp = curlx_memdup0((const char *)output_token, output_token_len);
+  curlx_free(output_token);
   if(!resp) {
-    free(output_token);
-
     return CURLE_OUT_OF_MEMORY;
   }
 
-  /* Copy the generated response */
-  memcpy(resp, output_token, output_token_len);
-  resp[output_token_len] = 0;
-
   /* Return the response */
   *outptr = resp;
   *outlen = output_token_len;
-
-  /* Free the response buffer */
-  free(output_token);
-
   return CURLE_OK;
 }
 
@@ -649,20 +618,20 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
 void Curl_auth_digest_cleanup(struct digestdata *digest)
 {
   /* Free the input token */
-  Curl_safefree(digest->input_token);
+  curlx_safefree(digest->input_token);
 
   /* Reset any variables */
   digest->input_token_len = 0;
 
   /* Delete security context */
   if(digest->http_context) {
-    s_pSecFn->DeleteSecurityContext(digest->http_context);
-    Curl_safefree(digest->http_context);
+    Curl_pSecFn->DeleteSecurityContext(digest->http_context);
+    curlx_safefree(digest->http_context);
   }
 
   /* Free the copy of user/passwd used to make the identity for http_context */
-  Curl_safefree(digest->user);
-  Curl_safefree(digest->passwd);
+  Curl_creds_unlink(&digest->creds);
+  Curl_peer_unlink(&digest->origin);
 }
 
 #endif /* USE_WINDOWS_SSPI && !CURL_DISABLE_DIGEST_AUTH */
diff --git a/third-party/curl/lib/vauth/gsasl.c b/third-party/curl/lib/vauth/gsasl.c
index c7d0a8d3b2..10a83fdb09 100644
--- a/third-party/curl/lib/vauth/gsasl.c
+++ b/third-party/curl/lib/vauth/gsasl.c
@@ -23,23 +23,18 @@
  * RFC5802 SCRAM-SHA-1 authentication
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef USE_GSASL
 
-#include <curl/curl.h>
-
 #include "vauth/vauth.h"
-#include "urldata.h"
-#include "sendf.h"
+#include "curl_trc.h"
 
 #include <gsasl.h>
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#if GSASL_VERSION_NUMBER < 0x010600
+#error "requires libgsasl 1.6.0+"
+#endif
 
 bool Curl_auth_gsasl_is_supported(struct Curl_easy *data,
                                   const char *mech,
@@ -49,32 +44,32 @@ bool Curl_auth_gsasl_is_supported(struct Curl_easy *data,
 
   res = gsasl_init(&gsasl->ctx);
   if(res != GSASL_OK) {
-    failf(data, "gsasl init: %s\n", gsasl_strerror(res));
+    failf(data, "gsasl init: %s", gsasl_strerror(res));
     return FALSE;
   }
 
   res = gsasl_client_start(gsasl->ctx, mech, &gsasl->client);
   if(res != GSASL_OK) {
     gsasl_done(gsasl->ctx);
+    gsasl->ctx = NULL;
     return FALSE;
   }
 
-  return true;
+  return TRUE;
 }
 
 CURLcode Curl_auth_gsasl_start(struct Curl_easy *data,
-                               const char *userp,
-                               const char *passwdp,
+                               struct Curl_creds *creds,
                                struct gsasldata *gsasl)
 {
 #if GSASL_VERSION_NUMBER >= 0x010b00
   int res;
   res =
 #endif
-    gsasl_property_set(gsasl->client, GSASL_AUTHID, userp);
+    gsasl_property_set(gsasl->client, GSASL_AUTHID, creds->user);
 #if GSASL_VERSION_NUMBER >= 0x010b00
   if(res != GSASL_OK) {
-    failf(data, "setting AUTHID failed: %s\n", gsasl_strerror(res));
+    failf(data, "setting AUTHID failed: %s", gsasl_strerror(res));
     return CURLE_OUT_OF_MEMORY;
   }
 #endif
@@ -82,10 +77,10 @@ CURLcode Curl_auth_gsasl_start(struct Curl_easy *data,
 #if GSASL_VERSION_NUMBER >= 0x010b00
   res =
 #endif
-    gsasl_property_set(gsasl->client, GSASL_PASSWORD, passwdp);
+    gsasl_property_set(gsasl->client, GSASL_PASSWORD, creds->passwd);
 #if GSASL_VERSION_NUMBER >= 0x010b00
   if(res != GSASL_OK) {
-    failf(data, "setting PASSWORD failed: %s\n", gsasl_strerror(res));
+    failf(data, "setting PASSWORD failed: %s", gsasl_strerror(res));
     return CURLE_OUT_OF_MEMORY;
   }
 #endif
@@ -104,11 +99,10 @@ CURLcode Curl_auth_gsasl_token(struct Curl_easy *data,
   char *response;
   size_t outlen;
 
-  res = gsasl_step(gsasl->client,
-                   (const char *) Curl_bufref_ptr(chlg), Curl_bufref_len(chlg),
+  res = gsasl_step(gsasl->client, Curl_bufref_ptr(chlg), Curl_bufref_len(chlg),
                    &response, &outlen);
   if(res != GSASL_OK && res != GSASL_NEEDS_MORE) {
-    failf(data, "GSASL step: %s\n", gsasl_strerror(res));
+    failf(data, "GSASL step: %s", gsasl_strerror(res));
     return CURLE_BAD_CONTENT_ENCODING;
   }
 
diff --git a/third-party/curl/lib/vauth/krb5_gssapi.c b/third-party/curl/lib/vauth/krb5_gssapi.c
index 65eb3e1b50..738ce9a744 100644
--- a/third-party/curl/lib/vauth/krb5_gssapi.c
+++ b/third-party/curl/lib/vauth/krb5_gssapi.c
@@ -24,23 +24,19 @@
  * RFC4752 The Kerberos V5 ("GSSAPI") SASL Mechanism
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if defined(HAVE_GSSAPI) && defined(USE_KERBEROS5)
 
-#include <curl/curl.h>
-
 #include "vauth/vauth.h"
 #include "curl_sasl.h"
-#include "urldata.h"
 #include "curl_gssapi.h"
-#include "sendf.h"
-#include "curl_printf.h"
+#include "curl_trc.h"
 
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
+#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
 
 /*
  * Curl_auth_is_gssapi_supported()
@@ -65,10 +61,10 @@ bool Curl_auth_is_gssapi_supported(void)
  * Parameters:
  *
  * data        [in]     - The session handle.
- * userp       [in]     - The user name.
+ * userp       [in]     - The username.
  * passwdp     [in]     - The user's password.
  * service     [in]     - The service type such as http, smtp, pop or imap.
- * host        [in[     - The host name.
+ * host        [in[     - The hostname.
  * mutual_auth [in]     - Flag specifying whether or not mutual authentication
  *                        is enabled.
  * chlg        [in]     - Optional challenge message.
@@ -78,9 +74,8 @@ bool Curl_auth_is_gssapi_supported(void)
  * Returns CURLE_OK on success.
  */
 CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
-                                              const char *userp,
-                                              const char *passwdp,
-                                              const char *service,
+                                              struct Curl_creds *creds,
+                                              const char *default_service,
                                               const char *host,
                                               const bool mutual_auth,
                                               const struct bufref *chlg,
@@ -91,14 +86,14 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
   OM_uint32 major_status;
   OM_uint32 minor_status;
   OM_uint32 unused_status;
-  gss_buffer_desc spn_token = GSS_C_EMPTY_BUFFER;
   gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
   gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
-
-  (void) userp;
-  (void) passwdp;
+  const char *service = Curl_creds_has_sasl_service(creds) ?
+    Curl_creds_sasl_service(creds) : default_service;
 
   if(!krb5->spn) {
+    gss_buffer_desc spn_token = GSS_C_EMPTY_BUFFER;
+
     /* Generate our SPN */
     char *spn = Curl_auth_build_spn(service, NULL, host);
     if(!spn)
@@ -115,12 +110,12 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
       Curl_gss_log_error(data, "gss_import_name() failed: ",
                          major_status, minor_status);
 
-      free(spn);
+      curlx_free(spn);
 
       return CURLE_AUTH_ERROR;
     }
 
-    free(spn);
+    curlx_free(spn);
   }
 
   if(chlg) {
@@ -128,7 +123,7 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
       infof(data, "GSSAPI handshake failure (empty challenge message)");
       return CURLE_BAD_CONTENT_ENCODING;
     }
-    input_token.value = (void *) Curl_bufref_ptr(chlg);
+    input_token.value = CURL_UNCONST(Curl_bufref_ptr(chlg));
     input_token.length = Curl_bufref_len(chlg);
   }
 
@@ -154,11 +149,11 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
   }
 
   if(output_token.value && output_token.length) {
-    result = Curl_bufref_memdup(out, output_token.value, output_token.length);
+    result = Curl_bufref_memdup0(out, output_token.value, output_token.length);
     gss_release_buffer(&unused_status, &output_token);
   }
   else
-    Curl_bufref_set(out, mutual_auth? "": NULL, 0, NULL);
+    Curl_bufref_set(out, mutual_auth ? "" : NULL, 0, NULL);
 
   return result;
 }
@@ -205,7 +200,7 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
   }
 
   /* Setup the challenge "input" security buffer */
-  input_token.value = (void *) Curl_bufref_ptr(chlg);
+  input_token.value = CURL_UNCONST(Curl_bufref_ptr(chlg));
   input_token.length = Curl_bufref_len(chlg);
 
   /* Decrypt the inbound challenge and obtain the qop */
@@ -220,13 +215,15 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
   /* Not 4 octets long so fail as per RFC4752 Section 3.1 */
   if(output_token.length != 4) {
     infof(data, "GSSAPI handshake failure (invalid security data)");
+    gss_release_buffer(&unused_status, &output_token);
     return CURLE_BAD_CONTENT_ENCODING;
   }
 
   /* Extract the security layer and the maximum message size */
   indata = output_token.value;
   sec_layer = indata[0];
-  max_size = (indata[1] << 16) | (indata[2] << 8) | indata[3];
+  max_size = ((unsigned int)indata[1] << 16) |
+             ((unsigned int)indata[2] << 8) | indata[3];
 
   /* Free the challenge as it is not required anymore */
   gss_release_buffer(&unused_status, &output_token);
@@ -241,8 +238,8 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
 
   /* Process the maximum message size the server can receive */
   if(max_size > 0) {
-    /* The server has told us it supports a maximum receive buffer, however, as
-       we don't require one unless we are encrypting data, we tell the server
+    /* The server has told us it supports a maximum receive buffer, but as we
+       do not require one unless we are encrypting data, we tell the server
        our receive buffer is zero. */
     max_size = 0;
   }
@@ -251,7 +248,7 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
   messagelen = 4;
   if(authzid)
     messagelen += strlen(authzid);
-  message = malloc(messagelen);
+  message = curlx_malloc(messagelen);
   if(!message)
     return CURLE_OUT_OF_MEMORY;
 
@@ -278,17 +275,17 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
   if(GSS_ERROR(major_status)) {
     Curl_gss_log_error(data, "gss_wrap() failed: ",
                        major_status, minor_status);
-    free(message);
+    curlx_free(message);
     return CURLE_AUTH_ERROR;
   }
 
   /* Return the response. */
-  result = Curl_bufref_memdup(out, output_token.value, output_token.length);
+  result = Curl_bufref_memdup0(out, output_token.value, output_token.length);
   /* Free the output buffer */
   gss_release_buffer(&unused_status, &output_token);
 
   /* Free the message buffer */
-  free(message);
+  curlx_free(message);
 
   return result;
 }
@@ -309,7 +306,8 @@ void Curl_auth_cleanup_gssapi(struct kerberos5data *krb5)
 
   /* Free our security context */
   if(krb5->context != GSS_C_NO_CONTEXT) {
-    gss_delete_sec_context(&minor_status, &krb5->context, GSS_C_NO_BUFFER);
+    Curl_gss_delete_sec_context(&minor_status, &krb5->context,
+                                GSS_C_NO_BUFFER);
     krb5->context = GSS_C_NO_CONTEXT;
   }
 
@@ -320,4 +318,8 @@ void Curl_auth_cleanup_gssapi(struct kerberos5data *krb5)
   }
 }
 
+#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
+#pragma GCC diagnostic pop
+#endif
+
 #endif /* HAVE_GSSAPI && USE_KERBEROS5 */
diff --git a/third-party/curl/lib/vauth/krb5_sspi.c b/third-party/curl/lib/vauth/krb5_sspi.c
index c487149b9d..543a6fe284 100644
--- a/third-party/curl/lib/vauth/krb5_sspi.c
+++ b/third-party/curl/lib/vauth/krb5_sspi.c
@@ -23,22 +23,12 @@
  * RFC4752 The Kerberos V5 ("GSSAPI") SASL Mechanism
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if defined(USE_WINDOWS_SSPI) && defined(USE_KERBEROS5)
 
-#include <curl/curl.h>
-
 #include "vauth/vauth.h"
-#include "urldata.h"
-#include "warnless.h"
-#include "curl_multibyte.h"
-#include "sendf.h"
-
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curl_trc.h"
 
 /*
  * Curl_auth_is_gssapi_supported()
@@ -55,16 +45,16 @@ bool Curl_auth_is_gssapi_supported(void)
   SECURITY_STATUS status;
 
   /* Query the security package for Kerberos */
-  status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *)
-                                              TEXT(SP_NAME_KERBEROS),
-                                              &SecurityPackage);
+  status = Curl_pSecFn->QuerySecurityPackageInfo(
+                                 (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_KERBEROS)),
+                                 &SecurityPackage);
 
   /* Release the package buffer as it is not required anymore */
   if(status == SEC_E_OK) {
-    s_pSecFn->FreeContextBuffer(SecurityPackage);
+    Curl_pSecFn->FreeContextBuffer(SecurityPackage);
   }
 
-  return (status == SEC_E_OK ? TRUE : FALSE);
+  return status == SEC_E_OK;
 }
 
 /*
@@ -76,10 +66,10 @@ bool Curl_auth_is_gssapi_supported(void)
  * Parameters:
  *
  * data        [in]     - The session handle.
- * userp       [in]     - The user name in the format User or Domain\User.
+ * userp       [in]     - The username in the format User or Domain\User.
  * passwdp     [in]     - The user's password.
  * service     [in]     - The service type such as http, smtp, pop or imap.
- * host        [in]     - The host name.
+ * host        [in]     - The hostname.
  * mutual_auth [in]     - Flag specifying whether or not mutual authentication
  *                        is enabled.
  * chlg        [in]     - Optional challenge message.
@@ -89,9 +79,8 @@ bool Curl_auth_is_gssapi_supported(void)
  * Returns CURLE_OK on success.
  */
 CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
-                                              const char *userp,
-                                              const char *passwdp,
-                                              const char *service,
+                                              struct Curl_creds *creds,
+                                              const char *default_service,
                                               const char *host,
                                               const bool mutual_auth,
                                               const struct bufref *chlg,
@@ -107,7 +96,8 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
   SecBufferDesc resp_desc;
   SECURITY_STATUS status;
   unsigned long attrs;
-  TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
+  const char *service = Curl_creds_has_sasl_service(creds) ?
+    Curl_creds_sasl_service(creds) : default_service;
 
   if(!krb5->spn) {
     /* Generate our SPN */
@@ -118,30 +108,31 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
 
   if(!krb5->output_token) {
     /* Query the security package for Kerberos */
-    status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *)
-                                                TEXT(SP_NAME_KERBEROS),
-                                                &SecurityPackage);
+    status = Curl_pSecFn->QuerySecurityPackageInfo(
+                                 (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_KERBEROS)),
+                                 &SecurityPackage);
     if(status != SEC_E_OK) {
-      failf(data, "SSPI: couldn't get auth info");
+      failf(data, "SSPI: could not get auth info");
       return CURLE_AUTH_ERROR;
     }
 
     krb5->token_max = SecurityPackage->cbMaxToken;
 
     /* Release the package buffer as it is not required anymore */
-    s_pSecFn->FreeContextBuffer(SecurityPackage);
+    Curl_pSecFn->FreeContextBuffer(SecurityPackage);
 
     /* Allocate our response buffer */
-    krb5->output_token = malloc(krb5->token_max);
+    krb5->output_token = curlx_malloc(krb5->token_max);
     if(!krb5->output_token)
       return CURLE_OUT_OF_MEMORY;
   }
 
   if(!krb5->credentials) {
     /* Do we have credentials to use or are we using single sign-on? */
-    if(userp && *userp) {
+    if(Curl_creds_has_user(creds)) {
       /* Populate our identity structure */
-      result = Curl_create_sspi_identity(userp, passwdp, &krb5->identity);
+      result = Curl_create_sspi_identity(
+        creds->user, creds->passwd, &krb5->identity);
       if(result)
         return result;
 
@@ -153,22 +144,23 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
       krb5->p_identity = NULL;
 
     /* Allocate our credentials handle */
-    krb5->credentials = calloc(1, sizeof(CredHandle));
+    krb5->credentials = curlx_calloc(1, sizeof(CredHandle));
     if(!krb5->credentials)
       return CURLE_OUT_OF_MEMORY;
 
     /* Acquire our credentials handle */
-    status = s_pSecFn->AcquireCredentialsHandle(NULL,
-                                                (TCHAR *)
-                                                TEXT(SP_NAME_KERBEROS),
-                                                SECPKG_CRED_OUTBOUND, NULL,
-                                                krb5->p_identity, NULL, NULL,
-                                                krb5->credentials, &expiry);
-    if(status != SEC_E_OK)
+    status = Curl_pSecFn->AcquireCredentialsHandle(NULL,
+                                 (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_KERBEROS)),
+                                 SECPKG_CRED_OUTBOUND, NULL,
+                                 krb5->p_identity, NULL, NULL,
+                                 krb5->credentials, NULL);
+    if(status != SEC_E_OK) {
+      curlx_safefree(krb5->credentials);
       return CURLE_LOGIN_DENIED;
+    }
 
     /* Allocate our new context handle */
-    krb5->context = calloc(1, sizeof(CtxtHandle));
+    krb5->context = curlx_calloc(1, sizeof(CtxtHandle));
     if(!krb5->context)
       return CURLE_OUT_OF_MEMORY;
   }
@@ -184,7 +176,7 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
     chlg_desc.cBuffers  = 1;
     chlg_desc.pBuffers  = &chlg_buf;
     chlg_buf.BufferType = SECBUFFER_TOKEN;
-    chlg_buf.pvBuffer   = (void *) Curl_bufref_ptr(chlg);
+    chlg_buf.pvBuffer   = CURL_UNCONST(Curl_bufref_ptr(chlg));
     chlg_buf.cbBuffer   = curlx_uztoul(Curl_bufref_len(chlg));
   }
 
@@ -197,7 +189,7 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
   resp_buf.cbBuffer   = curlx_uztoul(krb5->token_max);
 
   /* Generate our challenge-response message */
-  status = s_pSecFn->InitializeSecurityContext(krb5->credentials,
+  status = Curl_pSecFn->InitializeSecurityContext(krb5->credentials,
                                                chlg ? krb5->context : NULL,
                                                krb5->spn,
                                                (mutual_auth ?
@@ -205,8 +197,7 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
                                                0, SECURITY_NATIVE_DREP,
                                                chlg ? &chlg_desc : NULL, 0,
                                                &context,
-                                               &resp_desc, &attrs,
-                                               &expiry);
+                                               &resp_desc, &attrs, NULL);
 
   if(status == SEC_E_INSUFFICIENT_MEMORY)
     return CURLE_OUT_OF_MEMORY;
@@ -215,13 +206,13 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
     return CURLE_AUTH_ERROR;
 
   if(memcmp(&context, krb5->context, sizeof(context))) {
-    s_pSecFn->DeleteSecurityContext(krb5->context);
+    Curl_pSecFn->DeleteSecurityContext(krb5->context);
 
     memcpy(krb5->context, &context, sizeof(context));
   }
 
   if(resp_buf.cbBuffer) {
-    result = Curl_bufref_memdup(out, resp_buf.pvBuffer, resp_buf.cbBuffer);
+    result = Curl_bufref_memdup0(out, resp_buf.pvBuffer, resp_buf.cbBuffer);
   }
   else if(mutual_auth)
     Curl_bufref_set(out, "", 0, NULL);
@@ -241,7 +232,7 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
  *
  * data    [in]     - The session handle.
  * authzid [in]     - The authorization identity if some.
- * chlg    [in]     - The optional challenge message.
+ * chlg    [in]     - The challenge message.
  * krb5    [in/out] - The Kerberos 5 data struct being used and modified.
  * out     [out]    - The result storage.
  *
@@ -253,6 +244,7 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
                                                   struct kerberos5data *krb5,
                                                   struct bufref *out)
 {
+  CURLcode result = CURLE_OK;
   size_t offset = 0;
   size_t messagelen = 0;
   size_t appdatalen = 0;
@@ -271,20 +263,16 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
   SecPkgContext_Sizes sizes;
   SECURITY_STATUS status;
 
-#if defined(CURL_DISABLE_VERBOSE_STRINGS)
-  (void) data;
-#endif
-
   /* Ensure we have a valid challenge message */
+  DEBUGASSERT(chlg);
   if(!Curl_bufref_len(chlg)) {
     infof(data, "GSSAPI handshake failure (empty security message)");
     return CURLE_BAD_CONTENT_ENCODING;
   }
 
   /* Get our response size information */
-  status = s_pSecFn->QueryContextAttributes(krb5->context,
-                                            SECPKG_ATTR_SIZES,
-                                            &sizes);
+  status = Curl_pSecFn->QueryContextAttributes(krb5->context,
+                                               SECPKG_ATTR_SIZES, &sizes);
 
   if(status == SEC_E_INSUFFICIENT_MEMORY)
     return CURLE_OUT_OF_MEMORY;
@@ -297,16 +285,19 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
   input_desc.cBuffers = 2;
   input_desc.pBuffers = input_buf;
   input_buf[0].BufferType = SECBUFFER_STREAM;
-  input_buf[0].pvBuffer = (void *) Curl_bufref_ptr(chlg);
+  input_buf[0].pvBuffer = CURL_UNCONST(Curl_bufref_ptr(chlg));
   input_buf[0].cbBuffer = curlx_uztoul(Curl_bufref_len(chlg));
   input_buf[1].BufferType = SECBUFFER_DATA;
   input_buf[1].pvBuffer = NULL;
   input_buf[1].cbBuffer = 0;
 
-  /* Decrypt the inbound challenge and obtain the qop */
-  status = s_pSecFn->DecryptMessage(krb5->context, &input_desc, 0, &qop);
+  /* Decrypt the inbound challenge and obtain the qop. The encrypted message
+     is decrypted in place, overwriting the original contents of its buffer.
+     The SECBUFFER_DATA receives a pointer to the message in
+     SECBUFFER_STREAM. */
+  status = Curl_pSecFn->DecryptMessage(krb5->context, &input_desc, 0, &qop);
   if(status != SEC_E_OK) {
-    infof(data, "GSSAPI handshake failure (empty security message)");
+    infof(data, "GSSAPI handshake failure (decryption failed)");
     return CURLE_BAD_CONTENT_ENCODING;
   }
 
@@ -319,10 +310,8 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
   /* Extract the security layer and the maximum message size */
   indata = input_buf[1].pvBuffer;
   sec_layer = indata[0];
-  max_size = (indata[1] << 16) | (indata[2] << 8) | indata[3];
-
-  /* Free the challenge as it is not required anymore */
-  s_pSecFn->FreeContextBuffer(input_buf[1].pvBuffer);
+  max_size = ((unsigned long)indata[1] << 16) |
+             ((unsigned long)indata[2] << 8) | indata[3];
 
   /* Process the security layer */
   if(!(sec_layer & KERB_WRAP_NO_ENCRYPT)) {
@@ -333,14 +322,14 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
 
   /* Process the maximum message size the server can receive */
   if(max_size > 0) {
-    /* The server has told us it supports a maximum receive buffer, however, as
-       we don't require one unless we are encrypting data, we tell the server
+    /* The server has told us it supports a maximum receive buffer, but as we
+       do not require one unless we are encrypting data, we tell the server
        our receive buffer is zero. */
     max_size = 0;
   }
 
   /* Allocate the trailer */
-  trailer = malloc(sizes.cbSecurityTrailer);
+  trailer = curlx_malloc(sizes.cbSecurityTrailer);
   if(!trailer)
     return CURLE_OUT_OF_MEMORY;
 
@@ -348,11 +337,10 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
   messagelen = 4;
   if(authzid)
     messagelen += strlen(authzid);
-  message = malloc(messagelen);
+  message = curlx_malloc(messagelen);
   if(!message) {
-    free(trailer);
-
-    return CURLE_OUT_OF_MEMORY;
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
   }
 
   /* Populate the message with the security layer and client supported receive
@@ -368,12 +356,10 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
     memcpy(message + 4, authzid, messagelen - 4);
 
   /* Allocate the padding */
-  padding = malloc(sizes.cbBlockSize);
+  padding = curlx_malloc(sizes.cbBlockSize);
   if(!padding) {
-    free(message);
-    free(trailer);
-
-    return CURLE_OUT_OF_MEMORY;
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
   }
 
   /* Setup the "authentication data" security buffer */
@@ -391,29 +377,23 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
   wrap_buf[2].cbBuffer   = sizes.cbBlockSize;
 
   /* Encrypt the data */
-  status = s_pSecFn->EncryptMessage(krb5->context, KERB_WRAP_NO_ENCRYPT,
-                                    &wrap_desc, 0);
+  status = Curl_pSecFn->EncryptMessage(krb5->context, KERB_WRAP_NO_ENCRYPT,
+                                       &wrap_desc, 0);
   if(status != SEC_E_OK) {
-    free(padding);
-    free(message);
-    free(trailer);
-
     if(status == SEC_E_INSUFFICIENT_MEMORY)
-      return CURLE_OUT_OF_MEMORY;
-
-    return CURLE_AUTH_ERROR;
+      result = CURLE_OUT_OF_MEMORY;
+    else
+      result = CURLE_AUTH_ERROR;
+    goto out;
   }
 
   /* Allocate the encryption (wrap) buffer */
   appdatalen = wrap_buf[0].cbBuffer + wrap_buf[1].cbBuffer +
                wrap_buf[2].cbBuffer;
-  appdata = malloc(appdatalen);
+  appdata = curlx_malloc(appdatalen);
   if(!appdata) {
-    free(padding);
-    free(message);
-    free(trailer);
-
-    return CURLE_OUT_OF_MEMORY;
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
   }
 
   /* Populate the encryption buffer */
@@ -423,10 +403,14 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
   offset += wrap_buf[1].cbBuffer;
   memcpy(appdata + offset, wrap_buf[2].pvBuffer, wrap_buf[2].cbBuffer);
 
+out:
   /* Free all of our local buffers */
-  free(padding);
-  free(message);
-  free(trailer);
+  curlx_free(padding);
+  curlx_free(message);
+  curlx_free(trailer);
+
+  if(result)
+    return result;
 
   /* Return the response. */
   Curl_bufref_set(out, appdata, appdatalen, curl_free);
@@ -447,16 +431,14 @@ void Curl_auth_cleanup_gssapi(struct kerberos5data *krb5)
 {
   /* Free our security context */
   if(krb5->context) {
-    s_pSecFn->DeleteSecurityContext(krb5->context);
-    free(krb5->context);
-    krb5->context = NULL;
+    Curl_pSecFn->DeleteSecurityContext(krb5->context);
+    curlx_safefree(krb5->context);
   }
 
   /* Free our credentials handle */
   if(krb5->credentials) {
-    s_pSecFn->FreeCredentialsHandle(krb5->credentials);
-    free(krb5->credentials);
-    krb5->credentials = NULL;
+    Curl_pSecFn->FreeCredentialsHandle(krb5->credentials);
+    curlx_safefree(krb5->credentials);
   }
 
   /* Free our identity */
@@ -464,8 +446,8 @@ void Curl_auth_cleanup_gssapi(struct kerberos5data *krb5)
   krb5->p_identity = NULL;
 
   /* Free the SPN and output token */
-  Curl_safefree(krb5->spn);
-  Curl_safefree(krb5->output_token);
+  curlx_safefree(krb5->spn);
+  curlx_safefree(krb5->output_token);
 
   /* Reset any variables */
   krb5->token_max = 0;
diff --git a/third-party/curl/lib/vauth/ntlm.c b/third-party/curl/lib/vauth/ntlm.c
index ed7cee8def..2803c05d9f 100644
--- a/third-party/curl/lib/vauth/ntlm.c
+++ b/third-party/curl/lib/vauth/ntlm.c
@@ -21,7 +21,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if defined(USE_NTLM) && !defined(USE_WINDOWS_SSPI)
@@ -35,113 +34,209 @@
 
 #define DEBUG_ME 0
 
-#include "urldata.h"
-#include "sendf.h"
-#include "curl_ntlm_core.h"
-#include "curl_gethostname.h"
-#include "curl_multibyte.h"
-#include "curl_md5.h"
-#include "warnless.h"
-#include "rand.h"
-#include "vtls/vtls.h"
-
-#define BUILDING_CURL_NTLM_MSGS_C
 #include "vauth/vauth.h"
-#include "vauth/ntlm.h"
+#include "curl_trc.h"
+#include "curl_ntlm_core.h"
+#include "rand.h"
+#include "curlx/strdup.h"
 #include "curl_endian.h"
-#include "curl_printf.h"
-
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
 
 /* "NTLMSSP" signature is always in ASCII regardless of the platform */
 #define NTLMSSP_SIGNATURE "\x4e\x54\x4c\x4d\x53\x53\x50"
 
-/* The fixed host name we provide, in order to not leak our real local host
-   name. Copy the name used by Firefox. */
-#define NTLM_HOSTNAME "WORKSTATION"
+/* NTLM buffer fixed size, large enough for long user + host + domain */
+#define NTLM_BUFSIZE 1024
+
+/* Flag bits definitions based on
+   https://davenport.sourceforge.net/ntlm.html */
+
+#define NTLMFLAG_NEGOTIATE_UNICODE               (1 << 0)
+/* Indicates that Unicode strings are supported for use in security buffer
+   data. */
+
+#define NTLMFLAG_NEGOTIATE_OEM                   (1 << 1)
+/* Indicates that OEM strings are supported for use in security buffer data. */
+
+#define NTLMFLAG_REQUEST_TARGET                  (1 << 2)
+/* Requests that the server's authentication realm be included in the Type 2
+   message. */
 
 #if DEBUG_ME
-# define DEBUG_OUT(x) x
+/* unknown (1 << 3) */
+#define NTLMFLAG_NEGOTIATE_SIGN                  (1 << 4)
+/* Specifies that authenticated communication between the client and server
+   should carry a digital signature (message integrity). */
+
+#define NTLMFLAG_NEGOTIATE_SEAL                  (1 << 5)
+/* Specifies that authenticated communication between the client and server
+   should be encrypted (message confidentiality). */
+
+#define NTLMFLAG_NEGOTIATE_DATAGRAM_STYLE        (1 << 6)
+/* Indicates that datagram authentication is being used. */
+
+#define NTLMFLAG_NEGOTIATE_LM_KEY                (1 << 7)
+/* Indicates that the LAN Manager session key should be used for signing and
+   sealing authenticated communications. */
+#endif
+
+#define NTLMFLAG_NEGOTIATE_NTLM_KEY              (1 << 9)
+/* Indicates that NTLM authentication is being used. */
+
+#if DEBUG_ME
+/* unknown (1 << 10) */
+
+#define NTLMFLAG_NEGOTIATE_ANONYMOUS             (1 << 11)
+/* Sent by the client in the Type 3 message to indicate that an anonymous
+   context has been established. This also affects the response fields. */
+
+#define NTLMFLAG_NEGOTIATE_DOMAIN_SUPPLIED       (1 << 12)
+/* Sent by the client in the Type 1 message to indicate that a desired
+   authentication realm is included in the message. */
+
+#define NTLMFLAG_NEGOTIATE_WORKSTATION_SUPPLIED  (1 << 13)
+/* Sent by the client in the Type 1 message to indicate that the client
+   workstation's name is included in the message. */
+
+#define NTLMFLAG_NEGOTIATE_LOCAL_CALL            (1 << 14)
+/* Sent by the server to indicate that the server and client are on the same
+   machine. Implies that the client may use a pre-established local security
+   context rather than responding to the challenge. */
+#endif
+
+#define NTLMFLAG_NEGOTIATE_ALWAYS_SIGN           (1 << 15)
+/* Indicates that authenticated communication between the client and server
+   should be signed with a "dummy" signature. */
+
+#if DEBUG_ME
+#define NTLMFLAG_TARGET_TYPE_DOMAIN              (1 << 16)
+/* Sent by the server in the Type 2 message to indicate that the target
+   authentication realm is a domain. */
+
+#define NTLMFLAG_TARGET_TYPE_SERVER              (1 << 17)
+/* Sent by the server in the Type 2 message to indicate that the target
+   authentication realm is a server. */
+
+#define NTLMFLAG_TARGET_TYPE_SHARE               (1 << 18)
+/* Sent by the server in the Type 2 message to indicate that the target
+   authentication realm is a share. Presumably, this is for share-level
+   authentication. Usage is unclear. */
+#endif
+
+#define NTLMFLAG_NEGOTIATE_NTLM2_KEY             (1 << 19)
+/* Indicates that the NTLM2 signing and sealing scheme should be used for
+   protecting authenticated communications. */
+
+#if DEBUG_ME
+#define NTLMFLAG_REQUEST_INIT_RESPONSE           (1 << 20)
+/* unknown purpose */
+
+#define NTLMFLAG_REQUEST_ACCEPT_RESPONSE         (1 << 21)
+/* unknown purpose */
+
+#define NTLMFLAG_REQUEST_NONNT_SESSION_KEY       (1 << 22)
+/* unknown purpose */
+#endif
+
+#define NTLMFLAG_NEGOTIATE_TARGET_INFO           (1 << 23)
+/* Sent by the server in the Type 2 message to indicate that it is including a
+   Target Information block in the message. */
+
+#if DEBUG_ME
+/* unknown (1<24) */
+/* unknown (1<25) */
+/* unknown (1<26) */
+/* unknown (1<27) */
+/* unknown (1<28) */
+
+#define NTLMFLAG_NEGOTIATE_128                   (1 << 29)
+/* Indicates that 128-bit encryption is supported. */
+
+#define NTLMFLAG_NEGOTIATE_KEY_EXCHANGE          (1 << 30)
+/* Indicates that the client provides an encrypted master key in
+   the "Session Key" field of the Type 3 message. */
+
+#define NTLMFLAG_NEGOTIATE_56                    (1 << 31)
+/* Indicates that 56-bit encryption is supported. */
+
+#define DEBUG_OUT(x) x
 static void ntlm_print_flags(FILE *handle, unsigned long flags)
 {
   if(flags & NTLMFLAG_NEGOTIATE_UNICODE)
-    fprintf(handle, "NTLMFLAG_NEGOTIATE_UNICODE ");
+    curl_mfprintf(handle, "NTLMFLAG_NEGOTIATE_UNICODE ");
   if(flags & NTLMFLAG_NEGOTIATE_OEM)
-    fprintf(handle, "NTLMFLAG_NEGOTIATE_OEM ");
+    curl_mfprintf(handle, "NTLMFLAG_NEGOTIATE_OEM ");
   if(flags & NTLMFLAG_REQUEST_TARGET)
-    fprintf(handle, "NTLMFLAG_REQUEST_TARGET ");
-  if(flags & (1<<3))
-    fprintf(handle, "NTLMFLAG_UNKNOWN_3 ");
+    curl_mfprintf(handle, "NTLMFLAG_REQUEST_TARGET ");
+  if(flags & (1 << 3))
+    curl_mfprintf(handle, "NTLMFLAG_UNKNOWN_3 ");
   if(flags & NTLMFLAG_NEGOTIATE_SIGN)
-    fprintf(handle, "NTLMFLAG_NEGOTIATE_SIGN ");
+    curl_mfprintf(handle, "NTLMFLAG_NEGOTIATE_SIGN ");
   if(flags & NTLMFLAG_NEGOTIATE_SEAL)
-    fprintf(handle, "NTLMFLAG_NEGOTIATE_SEAL ");
+    curl_mfprintf(handle, "NTLMFLAG_NEGOTIATE_SEAL ");
   if(flags & NTLMFLAG_NEGOTIATE_DATAGRAM_STYLE)
-    fprintf(handle, "NTLMFLAG_NEGOTIATE_DATAGRAM_STYLE ");
+    curl_mfprintf(handle, "NTLMFLAG_NEGOTIATE_DATAGRAM_STYLE ");
   if(flags & NTLMFLAG_NEGOTIATE_LM_KEY)
-    fprintf(handle, "NTLMFLAG_NEGOTIATE_LM_KEY ");
+    curl_mfprintf(handle, "NTLMFLAG_NEGOTIATE_LM_KEY ");
   if(flags & NTLMFLAG_NEGOTIATE_NTLM_KEY)
-    fprintf(handle, "NTLMFLAG_NEGOTIATE_NTLM_KEY ");
-  if(flags & (1<<10))
-    fprintf(handle, "NTLMFLAG_UNKNOWN_10 ");
+    curl_mfprintf(handle, "NTLMFLAG_NEGOTIATE_NTLM_KEY ");
+  if(flags & (1 << 10))
+    curl_mfprintf(handle, "NTLMFLAG_UNKNOWN_10 ");
   if(flags & NTLMFLAG_NEGOTIATE_ANONYMOUS)
-    fprintf(handle, "NTLMFLAG_NEGOTIATE_ANONYMOUS ");
+    curl_mfprintf(handle, "NTLMFLAG_NEGOTIATE_ANONYMOUS ");
   if(flags & NTLMFLAG_NEGOTIATE_DOMAIN_SUPPLIED)
-    fprintf(handle, "NTLMFLAG_NEGOTIATE_DOMAIN_SUPPLIED ");
+    curl_mfprintf(handle, "NTLMFLAG_NEGOTIATE_DOMAIN_SUPPLIED ");
   if(flags & NTLMFLAG_NEGOTIATE_WORKSTATION_SUPPLIED)
-    fprintf(handle, "NTLMFLAG_NEGOTIATE_WORKSTATION_SUPPLIED ");
+    curl_mfprintf(handle, "NTLMFLAG_NEGOTIATE_WORKSTATION_SUPPLIED ");
   if(flags & NTLMFLAG_NEGOTIATE_LOCAL_CALL)
-    fprintf(handle, "NTLMFLAG_NEGOTIATE_LOCAL_CALL ");
+    curl_mfprintf(handle, "NTLMFLAG_NEGOTIATE_LOCAL_CALL ");
   if(flags & NTLMFLAG_NEGOTIATE_ALWAYS_SIGN)
-    fprintf(handle, "NTLMFLAG_NEGOTIATE_ALWAYS_SIGN ");
+    curl_mfprintf(handle, "NTLMFLAG_NEGOTIATE_ALWAYS_SIGN ");
   if(flags & NTLMFLAG_TARGET_TYPE_DOMAIN)
-    fprintf(handle, "NTLMFLAG_TARGET_TYPE_DOMAIN ");
+    curl_mfprintf(handle, "NTLMFLAG_TARGET_TYPE_DOMAIN ");
   if(flags & NTLMFLAG_TARGET_TYPE_SERVER)
-    fprintf(handle, "NTLMFLAG_TARGET_TYPE_SERVER ");
+    curl_mfprintf(handle, "NTLMFLAG_TARGET_TYPE_SERVER ");
   if(flags & NTLMFLAG_TARGET_TYPE_SHARE)
-    fprintf(handle, "NTLMFLAG_TARGET_TYPE_SHARE ");
+    curl_mfprintf(handle, "NTLMFLAG_TARGET_TYPE_SHARE ");
   if(flags & NTLMFLAG_NEGOTIATE_NTLM2_KEY)
-    fprintf(handle, "NTLMFLAG_NEGOTIATE_NTLM2_KEY ");
+    curl_mfprintf(handle, "NTLMFLAG_NEGOTIATE_NTLM2_KEY ");
   if(flags & NTLMFLAG_REQUEST_INIT_RESPONSE)
-    fprintf(handle, "NTLMFLAG_REQUEST_INIT_RESPONSE ");
+    curl_mfprintf(handle, "NTLMFLAG_REQUEST_INIT_RESPONSE ");
   if(flags & NTLMFLAG_REQUEST_ACCEPT_RESPONSE)
-    fprintf(handle, "NTLMFLAG_REQUEST_ACCEPT_RESPONSE ");
+    curl_mfprintf(handle, "NTLMFLAG_REQUEST_ACCEPT_RESPONSE ");
   if(flags & NTLMFLAG_REQUEST_NONNT_SESSION_KEY)
-    fprintf(handle, "NTLMFLAG_REQUEST_NONNT_SESSION_KEY ");
+    curl_mfprintf(handle, "NTLMFLAG_REQUEST_NONNT_SESSION_KEY ");
   if(flags & NTLMFLAG_NEGOTIATE_TARGET_INFO)
-    fprintf(handle, "NTLMFLAG_NEGOTIATE_TARGET_INFO ");
-  if(flags & (1<<24))
-    fprintf(handle, "NTLMFLAG_UNKNOWN_24 ");
-  if(flags & (1<<25))
-    fprintf(handle, "NTLMFLAG_UNKNOWN_25 ");
-  if(flags & (1<<26))
-    fprintf(handle, "NTLMFLAG_UNKNOWN_26 ");
-  if(flags & (1<<27))
-    fprintf(handle, "NTLMFLAG_UNKNOWN_27 ");
-  if(flags & (1<<28))
-    fprintf(handle, "NTLMFLAG_UNKNOWN_28 ");
+    curl_mfprintf(handle, "NTLMFLAG_NEGOTIATE_TARGET_INFO ");
+  if(flags & (1 << 24))
+    curl_mfprintf(handle, "NTLMFLAG_UNKNOWN_24 ");
+  if(flags & (1 << 25))
+    curl_mfprintf(handle, "NTLMFLAG_UNKNOWN_25 ");
+  if(flags & (1 << 26))
+    curl_mfprintf(handle, "NTLMFLAG_UNKNOWN_26 ");
+  if(flags & (1 << 27))
+    curl_mfprintf(handle, "NTLMFLAG_UNKNOWN_27 ");
+  if(flags & (1 << 28))
+    curl_mfprintf(handle, "NTLMFLAG_UNKNOWN_28 ");
   if(flags & NTLMFLAG_NEGOTIATE_128)
-    fprintf(handle, "NTLMFLAG_NEGOTIATE_128 ");
+    curl_mfprintf(handle, "NTLMFLAG_NEGOTIATE_128 ");
   if(flags & NTLMFLAG_NEGOTIATE_KEY_EXCHANGE)
-    fprintf(handle, "NTLMFLAG_NEGOTIATE_KEY_EXCHANGE ");
+    curl_mfprintf(handle, "NTLMFLAG_NEGOTIATE_KEY_EXCHANGE ");
   if(flags & NTLMFLAG_NEGOTIATE_56)
-    fprintf(handle, "NTLMFLAG_NEGOTIATE_56 ");
+    curl_mfprintf(handle, "NTLMFLAG_NEGOTIATE_56 ");
 }
 
 static void ntlm_print_hex(FILE *handle, const char *buf, size_t len)
 {
   const char *p = buf;
 
-  (void) handle;
+  (void)handle;
 
-  fprintf(stderr, "0x");
+  curl_mfprintf(stderr, "0x");
   while(len-- > 0)
-    fprintf(stderr, "%02.2x", (unsigned int)*p++);
+    curl_mfprintf(stderr, "%02.2x", (unsigned int)*p++);
 }
 #else
-# define DEBUG_OUT(x) Curl_nop_stmt
+#define DEBUG_OUT(x) Curl_nop_stmt
 #endif
 
 /*
@@ -164,13 +259,9 @@ static CURLcode ntlm_decode_type2_target(struct Curl_easy *data,
 {
   unsigned short target_info_len = 0;
   unsigned int target_info_offset = 0;
-  const unsigned char *type2 = Curl_bufref_ptr(type2ref);
+  const unsigned char *type2 = Curl_bufref_uptr(type2ref);
   size_t type2len = Curl_bufref_len(type2ref);
 
-#if defined(CURL_DISABLE_VERBOSE_STRINGS)
-  (void) data;
-#endif
-
   if(type2len >= 48) {
     target_info_len = Curl_read16_le(&type2[40]);
     target_info_offset = Curl_read32_le(&type2[44]);
@@ -183,12 +274,11 @@ static CURLcode ntlm_decode_type2_target(struct Curl_easy *data,
         return CURLE_BAD_CONTENT_ENCODING;
       }
 
-      free(ntlm->target_info); /* replace any previous data */
-      ntlm->target_info = malloc(target_info_len);
+      curlx_free(ntlm->target_info); /* replace any previous data */
+      ntlm->target_info = curlx_memdup(&type2[target_info_offset],
+                                       target_info_len);
       if(!ntlm->target_info)
         return CURLE_OUT_OF_MEMORY;
-
-      memcpy(ntlm->target_info, &type2[target_info_offset], target_info_len);
     }
   }
 
@@ -265,18 +355,14 @@ CURLcode Curl_auth_decode_ntlm_type2_message(struct Curl_easy *data,
   */
 
   CURLcode result = CURLE_OK;
-  const unsigned char *type2 = Curl_bufref_ptr(type2ref);
+  const unsigned char *type2 = Curl_bufref_uptr(type2ref);
   size_t type2len = Curl_bufref_len(type2ref);
 
-#if defined(CURL_DISABLE_VERBOSE_STRINGS)
-  (void)data;
-#endif
-
   ntlm->flags = 0;
 
   if((type2len < 32) ||
-     (memcmp(type2, NTLMSSP_SIGNATURE, 8) != 0) ||
-     (memcmp(type2 + 8, type2_marker, sizeof(type2_marker)) != 0)) {
+     memcmp(type2, NTLMSSP_SIGNATURE, 8) ||
+     memcmp(type2 + 8, type2_marker, sizeof(type2_marker))) {
     /* This was not a good enough type-2 message */
     infof(data, "NTLM handshake failure (bad type-2 message)");
     return CURLE_BAD_CONTENT_ENCODING;
@@ -294,12 +380,12 @@ CURLcode Curl_auth_decode_ntlm_type2_message(struct Curl_easy *data,
   }
 
   DEBUG_OUT({
-    fprintf(stderr, "**** TYPE2 header flags=0x%08.8lx ", ntlm->flags);
+    curl_mfprintf(stderr, "**** TYPE2 header flags=0x%08.8lx ", ntlm->flags);
     ntlm_print_flags(stderr, ntlm->flags);
-    fprintf(stderr, "\n                  nonce=");
+    curl_mfprintf(stderr, "\n                  nonce=");
     ntlm_print_hex(stderr, (char *)ntlm->nonce, 8);
-    fprintf(stderr, "\n****\n");
-    fprintf(stderr, "**** Header %s\n ", header);
+    curl_mfprintf(stderr, "\n****\n");
+    curl_mfprintf(stderr, "**** Header %s\n ", header);
   });
 
   return result;
@@ -312,7 +398,7 @@ static void unicodecpy(unsigned char *dest, const char *src, size_t length)
   size_t i;
   for(i = 0; i < length; i++) {
     dest[2 * i] = (unsigned char)src[i];
-    dest[2 * i + 1] = '\0';
+    dest[(2 * i) + 1] = '\0';
   }
 }
 
@@ -325,20 +411,19 @@ static void unicodecpy(unsigned char *dest, const char *src, size_t length)
  * Parameters:
  *
  * data    [in]     - The session handle.
- * userp   [in]     - The user name in the format User or Domain\User.
+ * userp   [in]     - The username in the format User or Domain\User.
  * passwdp [in]     - The user's password.
  * service [in]     - The service type such as http, smtp, pop or imap.
- * host    [in]     - The host name.
+ * host    [in]     - The hostname.
  * ntlm    [in/out] - The NTLM data struct being used and modified.
  * out     [out]    - The result storage.
  *
  * Returns CURLE_OK on success.
  */
 CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
-                                             const char *userp,
-                                             const char *passwdp,
-                                             const char *service,
-                                             const char *hostname,
+                                             struct Curl_creds *creds,
+                                             const char *default_service,
+                                             const char *host,
                                              struct ntlmdata *ntlm,
                                              struct bufref *out)
 {
@@ -356,10 +441,12 @@ CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
                                      (*) -> Optional
   */
 
+  const char *service = Curl_creds_has_sasl_service(creds) ?
+    Curl_creds_sasl_service(creds) : default_service;
   size_t size;
 
   char *ntlmbuf;
-  const char *host = "";              /* empty */
+  const char *hostname = "";          /* empty */
   const char *domain = "";            /* empty */
   size_t hostlen = 0;
   size_t domlen = 0;
@@ -367,45 +454,44 @@ CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
   size_t domoff = hostoff + hostlen;  /* This is 0: remember that host and
                                          domain are empty */
   (void)data;
-  (void)userp;
-  (void)passwdp;
+  (void)creds;
   (void)service;
-  (void)hostname;
+  (void)host;
 
-  /* Clean up any former leftovers and initialise to defaults */
+  /* Clean up any former leftovers and initialize to defaults */
   Curl_auth_cleanup_ntlm(ntlm);
 
-  ntlmbuf = aprintf(NTLMSSP_SIGNATURE "%c"
-                    "\x01%c%c%c" /* 32-bit type = 1 */
-                    "%c%c%c%c"   /* 32-bit NTLM flag field */
-                    "%c%c"       /* domain length */
-                    "%c%c"       /* domain allocated space */
-                    "%c%c"       /* domain name offset */
-                    "%c%c"       /* 2 zeroes */
-                    "%c%c"       /* host length */
-                    "%c%c"       /* host allocated space */
-                    "%c%c"       /* host name offset */
-                    "%c%c"       /* 2 zeroes */
-                    "%s"         /* host name */
-                    "%s",        /* domain string */
-                    0,           /* trailing zero */
-                    0, 0, 0,     /* part of type-1 long */
+  ntlmbuf = curl_maprintf(NTLMSSP_SIGNATURE "%c"
+                          "\x01%c%c%c" /* 32-bit type = 1 */
+                          "%c%c%c%c"   /* 32-bit NTLM flag field */
+                          "%c%c"       /* domain length */
+                          "%c%c"       /* domain allocated space */
+                          "%c%c"       /* domain name offset */
+                          "%c%c"       /* 2 zeroes */
+                          "%c%c"       /* host length */
+                          "%c%c"       /* host allocated space */
+                          "%c%c"       /* hostname offset */
+                          "%c%c"       /* 2 zeroes */
+                          "%s"         /* hostname */
+                          "%s",        /* domain string */
+                          0,           /* trailing zero */
+                          0, 0, 0,     /* part of type-1 long */
 
-                    LONGQUARTET(NTLMFLAG_NEGOTIATE_OEM |
-                                NTLMFLAG_REQUEST_TARGET |
-                                NTLMFLAG_NEGOTIATE_NTLM_KEY |
-                                NTLMFLAG_NEGOTIATE_NTLM2_KEY |
-                                NTLMFLAG_NEGOTIATE_ALWAYS_SIGN),
-                    SHORTPAIR(domlen),
-                    SHORTPAIR(domlen),
-                    SHORTPAIR(domoff),
-                    0, 0,
-                    SHORTPAIR(hostlen),
-                    SHORTPAIR(hostlen),
-                    SHORTPAIR(hostoff),
-                    0, 0,
-                    host,  /* this is empty */
-                    domain /* this is empty */);
+                          LONGQUARTET(NTLMFLAG_NEGOTIATE_OEM |
+                                      NTLMFLAG_REQUEST_TARGET |
+                                      NTLMFLAG_NEGOTIATE_NTLM_KEY |
+                                      NTLMFLAG_NEGOTIATE_NTLM2_KEY |
+                                      NTLMFLAG_NEGOTIATE_ALWAYS_SIGN),
+                          SHORTPAIR(domlen),
+                          SHORTPAIR(domlen),
+                          SHORTPAIR(domoff),
+                          0, 0,
+                          SHORTPAIR(hostlen),
+                          SHORTPAIR(hostlen),
+                          SHORTPAIR(hostoff),
+                          0, 0,
+                          hostname, /* this is empty */
+                          domain /* this is empty */);
 
   if(!ntlmbuf)
     return CURLE_OUT_OF_MEMORY;
@@ -414,25 +500,25 @@ CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
   size = 32 + hostlen + domlen;
 
   DEBUG_OUT({
-    fprintf(stderr, "* TYPE1 header flags=0x%02.2x%02.2x%02.2x%02.2x "
-            "0x%08.8x ",
-            LONGQUARTET(NTLMFLAG_NEGOTIATE_OEM |
-                        NTLMFLAG_REQUEST_TARGET |
-                        NTLMFLAG_NEGOTIATE_NTLM_KEY |
-                        NTLMFLAG_NEGOTIATE_NTLM2_KEY |
-                        NTLMFLAG_NEGOTIATE_ALWAYS_SIGN),
-            NTLMFLAG_NEGOTIATE_OEM |
-            NTLMFLAG_REQUEST_TARGET |
-            NTLMFLAG_NEGOTIATE_NTLM_KEY |
-            NTLMFLAG_NEGOTIATE_NTLM2_KEY |
-            NTLMFLAG_NEGOTIATE_ALWAYS_SIGN);
+    curl_mfprintf(stderr, "* TYPE1 header flags=0x%02.2x%02.2x%02.2x%02.2x "
+                  "0x%08.8x ",
+                  LONGQUARTET(NTLMFLAG_NEGOTIATE_OEM |
+                              NTLMFLAG_REQUEST_TARGET |
+                              NTLMFLAG_NEGOTIATE_NTLM_KEY |
+                              NTLMFLAG_NEGOTIATE_NTLM2_KEY |
+                              NTLMFLAG_NEGOTIATE_ALWAYS_SIGN),
+                  NTLMFLAG_NEGOTIATE_OEM |
+                  NTLMFLAG_REQUEST_TARGET |
+                  NTLMFLAG_NEGOTIATE_NTLM_KEY |
+                  NTLMFLAG_NEGOTIATE_NTLM2_KEY |
+                  NTLMFLAG_NEGOTIATE_ALWAYS_SIGN);
     ntlm_print_flags(stderr,
                      NTLMFLAG_NEGOTIATE_OEM |
                      NTLMFLAG_REQUEST_TARGET |
                      NTLMFLAG_NEGOTIATE_NTLM_KEY |
                      NTLMFLAG_NEGOTIATE_NTLM2_KEY |
                      NTLMFLAG_NEGOTIATE_ALWAYS_SIGN);
-    fprintf(stderr, "\n****\n");
+    curl_mfprintf(stderr, "\n****\n");
   });
 
   Curl_bufref_set(out, ntlmbuf, size, curl_free);
@@ -448,7 +534,7 @@ CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
  * Parameters:
  *
  * data    [in]     - The session handle.
- * userp   [in]     - The user name in the format User or Domain\User.
+ * userp   [in]     - The username in the format User or Domain\User.
  * passwdp [in]     - The user's password.
  * ntlm    [in/out] - The NTLM data struct being used and modified.
  * out     [out]    - The result storage.
@@ -456,8 +542,7 @@ CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
  * Returns CURLE_OK on success.
  */
 CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
-                                             const char *userp,
-                                             const char *passwdp,
+                                             struct Curl_creds *creds,
                                              struct ntlmdata *ntlm,
                                              struct bufref *out)
 {
@@ -470,7 +555,7 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
            12    LM/LMv2 Response       security buffer
            20    NTLM/NTLMv2 Response   security buffer
            28    Target Name            security buffer
-           36    User Name              security buffer
+           36    username              security buffer
            44    Workstation Name       security buffer
           (52)   Session Key            security buffer (*)
           (60)   Flags                  long (*)
@@ -482,15 +567,19 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
   CURLcode result = CURLE_OK;
   size_t size;
   unsigned char ntlmbuf[NTLM_BUFSIZE];
-  int lmrespoff;
+  unsigned int lmrespoff;
   unsigned char lmresp[24]; /* fixed-size */
-  int ntrespoff;
+  unsigned int ntrespoff;
   unsigned int ntresplen = 24;
   unsigned char ntresp[24]; /* fixed-size */
-  unsigned char *ptr_ntresp = &ntresp[0];
+  const unsigned char *ptr_ntresp = &ntresp[0];
   unsigned char *ntlmv2resp = NULL;
-  bool unicode = (ntlm->flags & NTLMFLAG_NEGOTIATE_UNICODE) ? TRUE : FALSE;
-  char host[HOSTNAME_MAX + 1] = "";
+  bool unicode = (ntlm->flags & NTLMFLAG_NEGOTIATE_UNICODE);
+  /* The fixed hostname we provide, in order to not leak our real local host
+     name. Copy the name used by Firefox. */
+  static const char host[] = "WORKSTATION";
+  const char *userp = Curl_creds_user(creds);
+  const char *passwdp = Curl_creds_passwd(creds);
   const char *user;
   const char *domain = "";
   size_t hostoff = 0;
@@ -515,21 +604,7 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
     user = userp;
 
   userlen = strlen(user);
-
-#ifndef NTLM_HOSTNAME
-  /* Get the machine's un-qualified host name as NTLM doesn't like the fully
-     qualified domain name */
-  if(Curl_gethostname(host, sizeof(host))) {
-    infof(data, "gethostname() failed, continuing without");
-    hostlen = 0;
-  }
-  else {
-    hostlen = strlen(host);
-  }
-#else
-  (void)msnprintf(host, sizeof(host), "%s", NTLM_HOSTNAME);
-  hostlen = sizeof(NTLM_HOSTNAME)-1;
-#endif
+  hostlen = sizeof(host) - 1;
 
   if(ntlm->flags & NTLMFLAG_NEGOTIATE_NTLM2_KEY) {
     unsigned char ntbuffer[0x18];
@@ -585,7 +660,7 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
       return result;
 
     Curl_ntlm_core_lm_resp(lmbuffer, &ntlm->nonce[0], lmresp);
-    ntlm->flags &= ~NTLMFLAG_NEGOTIATE_NTLM2_KEY;
+    ntlm->flags &= ~(unsigned int)NTLMFLAG_NEGOTIATE_NTLM2_KEY;
 
     /* A safer but less compatible alternative is:
      *   Curl_ntlm_core_lm_resp(ntbuffer, &ntlm->nonce[0], lmresp);
@@ -605,82 +680,84 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
   hostoff = useroff + userlen;
 
   /* Create the big type-3 message binary blob */
-  size = msnprintf((char *)ntlmbuf, NTLM_BUFSIZE,
-                   NTLMSSP_SIGNATURE "%c"
-                   "\x03%c%c%c"  /* 32-bit type = 3 */
+  size = curl_msnprintf((char *)ntlmbuf, NTLM_BUFSIZE,
+                         NTLMSSP_SIGNATURE "%c"
+                         "\x03%c%c%c"  /* 32-bit type = 3 */
 
-                   "%c%c"  /* LanManager length */
-                   "%c%c"  /* LanManager allocated space */
-                   "%c%c"  /* LanManager offset */
-                   "%c%c"  /* 2 zeroes */
+                         "%c%c"  /* LanManager length */
+                         "%c%c"  /* LanManager allocated space */
+                         "%c%c"  /* LanManager offset */
+                         "%c%c"  /* 2 zeroes */
 
-                   "%c%c"  /* NT-response length */
-                   "%c%c"  /* NT-response allocated space */
-                   "%c%c"  /* NT-response offset */
-                   "%c%c"  /* 2 zeroes */
+                         "%c%c"  /* NT-response length */
+                         "%c%c"  /* NT-response allocated space */
+                         "%c%c"  /* NT-response offset */
+                         "%c%c"  /* 2 zeroes */
 
-                   "%c%c"  /* domain length */
-                   "%c%c"  /* domain allocated space */
-                   "%c%c"  /* domain name offset */
-                   "%c%c"  /* 2 zeroes */
+                         "%c%c"  /* domain length */
+                         "%c%c"  /* domain allocated space */
+                         "%c%c"  /* domain name offset */
+                         "%c%c"  /* 2 zeroes */
 
-                   "%c%c"  /* user length */
-                   "%c%c"  /* user allocated space */
-                   "%c%c"  /* user offset */
-                   "%c%c"  /* 2 zeroes */
+                         "%c%c"  /* user length */
+                         "%c%c"  /* user allocated space */
+                         "%c%c"  /* user offset */
+                         "%c%c"  /* 2 zeroes */
 
-                   "%c%c"  /* host length */
-                   "%c%c"  /* host allocated space */
-                   "%c%c"  /* host offset */
-                   "%c%c"  /* 2 zeroes */
+                         "%c%c"  /* host length */
+                         "%c%c"  /* host allocated space */
+                         "%c%c"  /* host offset */
+                         "%c%c"  /* 2 zeroes */
 
-                   "%c%c"  /* session key length (unknown purpose) */
-                   "%c%c"  /* session key allocated space (unknown purpose) */
-                   "%c%c"  /* session key offset (unknown purpose) */
-                   "%c%c"  /* 2 zeroes */
+                         "%c%c"  /* session key length (unknown purpose) */
+                         "%c%c"  /* session key allocated space
+                                    (unknown purpose) */
+                         "%c%c"  /* session key offset (unknown purpose) */
+                         "%c%c"  /* 2 zeroes */
 
-                   "%c%c%c%c",  /* flags */
+                         "%c%c%c%c",  /* flags */
 
-                   /* domain string */
-                   /* user string */
-                   /* host string */
-                   /* LanManager response */
-                   /* NT response */
+                         /* domain string */
+                         /* user string */
+                         /* host string */
+                         /* LanManager response */
+                         /* NT response */
 
-                   0,                /* null-termination */
-                   0, 0, 0,          /* type-3 long, the 24 upper bits */
+                         0,                /* null-termination */
+                         0, 0, 0,          /* type-3 long, the 24 upper bits */
 
-                   SHORTPAIR(0x18),  /* LanManager response length, twice */
-                   SHORTPAIR(0x18),
-                   SHORTPAIR(lmrespoff),
-                   0x0, 0x0,
+                         SHORTPAIR(0x18),  /* LanManager response length,
+                                              twice */
+                         SHORTPAIR(0x18),
+                         SHORTPAIR(lmrespoff),
+                         0x0, 0x0,
 
-                   SHORTPAIR(ntresplen),  /* NT-response length, twice */
-                   SHORTPAIR(ntresplen),
-                   SHORTPAIR(ntrespoff),
-                   0x0, 0x0,
+                         SHORTPAIR(ntresplen),  /* NT-response length, twice */
+                         SHORTPAIR(ntresplen),
+                         SHORTPAIR(ntrespoff),
+                         0x0, 0x0,
 
-                   SHORTPAIR(domlen),
-                   SHORTPAIR(domlen),
-                   SHORTPAIR(domoff),
-                   0x0, 0x0,
+                         SHORTPAIR(domlen),
+                         SHORTPAIR(domlen),
+                         SHORTPAIR(domoff),
+                         0x0, 0x0,
 
-                   SHORTPAIR(userlen),
-                   SHORTPAIR(userlen),
-                   SHORTPAIR(useroff),
-                   0x0, 0x0,
+                         SHORTPAIR(userlen),
+                         SHORTPAIR(userlen),
+                         SHORTPAIR(useroff),
+                         0x0, 0x0,
 
-                   SHORTPAIR(hostlen),
-                   SHORTPAIR(hostlen),
-                   SHORTPAIR(hostoff),
-                   0x0, 0x0,
+                         SHORTPAIR(hostlen),
+                         SHORTPAIR(hostlen),
+                         SHORTPAIR(hostoff),
+                         0x0, 0x0,
 
-                   0x0, 0x0,
-                   0x0, 0x0,
-                   0x0, 0x0,
-                   0x0, 0x0,
+                         0x0, 0x0,
+                         0x0, 0x0,
+                         0x0, 0x0,
+                         0x0, 0x0,
 
-                   LONGQUARTET(ntlm->flags));
+                         LONGQUARTET(ntlm->flags));
 
   DEBUGASSERT(size == 64);
   DEBUGASSERT(size == (size_t)lmrespoff);
@@ -692,38 +769,38 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
   }
 
   DEBUG_OUT({
-    fprintf(stderr, "**** TYPE3 header lmresp=");
+    curl_mfprintf(stderr, "**** TYPE3 header lmresp=");
     ntlm_print_hex(stderr, (char *)&ntlmbuf[lmrespoff], 0x18);
   });
 
   /* ntresplen + size should not be risking an integer overflow here */
   if(ntresplen + size > sizeof(ntlmbuf)) {
     failf(data, "incoming NTLM message too big");
-    return CURLE_OUT_OF_MEMORY;
+    result = CURLE_TOO_LARGE;
+    goto error;
   }
   DEBUGASSERT(size == (size_t)ntrespoff);
   memcpy(&ntlmbuf[size], ptr_ntresp, ntresplen);
   size += ntresplen;
 
   DEBUG_OUT({
-    fprintf(stderr, "\n   ntresp=");
+    curl_mfprintf(stderr, "\n   ntresp=");
     ntlm_print_hex(stderr, (char *)&ntlmbuf[ntrespoff], ntresplen);
   });
 
-  free(ntlmv2resp);/* Free the dynamic buffer allocated for NTLMv2 */
-
   DEBUG_OUT({
-    fprintf(stderr, "\n   flags=0x%02.2x%02.2x%02.2x%02.2x 0x%08.8x ",
-            LONGQUARTET(ntlm->flags), ntlm->flags);
+    curl_mfprintf(stderr, "\n   flags=0x%02.2x%02.2x%02.2x%02.2x 0x%08.8x ",
+                  LONGQUARTET(ntlm->flags), ntlm->flags);
     ntlm_print_flags(stderr, ntlm->flags);
-    fprintf(stderr, "\n****\n");
+    curl_mfprintf(stderr, "\n****\n");
   });
 
   /* Make sure that the domain, user and host strings fit in the
      buffer before we copy them there. */
   if(size + userlen + domlen + hostlen >= NTLM_BUFSIZE) {
-    failf(data, "user + domain + host name too big");
-    return CURLE_OUT_OF_MEMORY;
+    failf(data, "user + domain + hostname too big for NTLM");
+    result = CURLE_TOO_LARGE;
+    goto error;
   }
 
   DEBUGASSERT(size == domoff);
@@ -751,7 +828,10 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
   size += hostlen;
 
   /* Return the binary blob. */
-  result = Curl_bufref_memdup(out, ntlmbuf, size);
+  result = Curl_bufref_memdup0(out, ntlmbuf, size);
+
+error:
+  curlx_free(ntlmv2resp);  /* Free the dynamic buffer allocated for NTLMv2 */
 
   Curl_auth_cleanup_ntlm(ntlm);
 
@@ -771,7 +851,7 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
 void Curl_auth_cleanup_ntlm(struct ntlmdata *ntlm)
 {
   /* Free the target info */
-  Curl_safefree(ntlm->target_info);
+  curlx_safefree(ntlm->target_info);
 
   /* Reset any variables */
   ntlm->target_info_len = 0;
diff --git a/third-party/curl/lib/vauth/ntlm.h b/third-party/curl/lib/vauth/ntlm.h
deleted file mode 100644
index 31ce921cd1..0000000000
--- a/third-party/curl/lib/vauth/ntlm.h
+++ /dev/null
@@ -1,143 +0,0 @@
-#ifndef HEADER_VAUTH_NTLM_H
-#define HEADER_VAUTH_NTLM_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#ifdef USE_NTLM
-
-/* NTLM buffer fixed size, large enough for long user + host + domain */
-#define NTLM_BUFSIZE 1024
-
-/* Stuff only required for curl_ntlm_msgs.c */
-#ifdef BUILDING_CURL_NTLM_MSGS_C
-
-/* Flag bits definitions based on
-   https://davenport.sourceforge.net/ntlm.html */
-
-#define NTLMFLAG_NEGOTIATE_UNICODE               (1<<0)
-/* Indicates that Unicode strings are supported for use in security buffer
-   data. */
-
-#define NTLMFLAG_NEGOTIATE_OEM                   (1<<1)
-/* Indicates that OEM strings are supported for use in security buffer data. */
-
-#define NTLMFLAG_REQUEST_TARGET                  (1<<2)
-/* Requests that the server's authentication realm be included in the Type 2
-   message. */
-
-/* unknown (1<<3) */
-#define NTLMFLAG_NEGOTIATE_SIGN                  (1<<4)
-/* Specifies that authenticated communication between the client and server
-   should carry a digital signature (message integrity). */
-
-#define NTLMFLAG_NEGOTIATE_SEAL                  (1<<5)
-/* Specifies that authenticated communication between the client and server
-   should be encrypted (message confidentiality). */
-
-#define NTLMFLAG_NEGOTIATE_DATAGRAM_STYLE        (1<<6)
-/* Indicates that datagram authentication is being used. */
-
-#define NTLMFLAG_NEGOTIATE_LM_KEY                (1<<7)
-/* Indicates that the LAN Manager session key should be used for signing and
-   sealing authenticated communications. */
-
-#define NTLMFLAG_NEGOTIATE_NTLM_KEY              (1<<9)
-/* Indicates that NTLM authentication is being used. */
-
-/* unknown (1<<10) */
-
-#define NTLMFLAG_NEGOTIATE_ANONYMOUS             (1<<11)
-/* Sent by the client in the Type 3 message to indicate that an anonymous
-   context has been established. This also affects the response fields. */
-
-#define NTLMFLAG_NEGOTIATE_DOMAIN_SUPPLIED       (1<<12)
-/* Sent by the client in the Type 1 message to indicate that a desired
-   authentication realm is included in the message. */
-
-#define NTLMFLAG_NEGOTIATE_WORKSTATION_SUPPLIED  (1<<13)
-/* Sent by the client in the Type 1 message to indicate that the client
-   workstation's name is included in the message. */
-
-#define NTLMFLAG_NEGOTIATE_LOCAL_CALL            (1<<14)
-/* Sent by the server to indicate that the server and client are on the same
-   machine. Implies that the client may use a pre-established local security
-   context rather than responding to the challenge. */
-
-#define NTLMFLAG_NEGOTIATE_ALWAYS_SIGN           (1<<15)
-/* Indicates that authenticated communication between the client and server
-   should be signed with a "dummy" signature. */
-
-#define NTLMFLAG_TARGET_TYPE_DOMAIN              (1<<16)
-/* Sent by the server in the Type 2 message to indicate that the target
-   authentication realm is a domain. */
-
-#define NTLMFLAG_TARGET_TYPE_SERVER              (1<<17)
-/* Sent by the server in the Type 2 message to indicate that the target
-   authentication realm is a server. */
-
-#define NTLMFLAG_TARGET_TYPE_SHARE               (1<<18)
-/* Sent by the server in the Type 2 message to indicate that the target
-   authentication realm is a share. Presumably, this is for share-level
-   authentication. Usage is unclear. */
-
-#define NTLMFLAG_NEGOTIATE_NTLM2_KEY             (1<<19)
-/* Indicates that the NTLM2 signing and sealing scheme should be used for
-   protecting authenticated communications. */
-
-#define NTLMFLAG_REQUEST_INIT_RESPONSE           (1<<20)
-/* unknown purpose */
-
-#define NTLMFLAG_REQUEST_ACCEPT_RESPONSE         (1<<21)
-/* unknown purpose */
-
-#define NTLMFLAG_REQUEST_NONNT_SESSION_KEY       (1<<22)
-/* unknown purpose */
-
-#define NTLMFLAG_NEGOTIATE_TARGET_INFO           (1<<23)
-/* Sent by the server in the Type 2 message to indicate that it is including a
-   Target Information block in the message. */
-
-/* unknown (1<24) */
-/* unknown (1<25) */
-/* unknown (1<26) */
-/* unknown (1<27) */
-/* unknown (1<28) */
-
-#define NTLMFLAG_NEGOTIATE_128                   (1<<29)
-/* Indicates that 128-bit encryption is supported. */
-
-#define NTLMFLAG_NEGOTIATE_KEY_EXCHANGE          (1<<30)
-/* Indicates that the client will provide an encrypted master key in
-   the "Session Key" field of the Type 3 message. */
-
-#define NTLMFLAG_NEGOTIATE_56                    (1<<31)
-/* Indicates that 56-bit encryption is supported. */
-
-#endif /* BUILDING_CURL_NTLM_MSGS_C */
-
-#endif /* USE_NTLM */
-
-#endif /* HEADER_VAUTH_NTLM_H */
diff --git a/third-party/curl/lib/vauth/ntlm_sspi.c b/third-party/curl/lib/vauth/ntlm_sspi.c
index 5118963f4d..2e98e86e5f 100644
--- a/third-party/curl/lib/vauth/ntlm_sspi.c
+++ b/third-party/curl/lib/vauth/ntlm_sspi.c
@@ -21,23 +21,14 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if defined(USE_WINDOWS_SSPI) && defined(USE_NTLM)
 
-#include <curl/curl.h>
-
 #include "vauth/vauth.h"
-#include "urldata.h"
 #include "curl_ntlm_core.h"
-#include "warnless.h"
-#include "curl_multibyte.h"
-#include "sendf.h"
-
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curl_trc.h"
+#include "curlx/strdup.h"
 
 /*
  * Curl_auth_is_ntlm_supported()
@@ -54,15 +45,16 @@ bool Curl_auth_is_ntlm_supported(void)
   SECURITY_STATUS status;
 
   /* Query the security package for NTLM */
-  status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_NTLM),
-                                              &SecurityPackage);
+  status = Curl_pSecFn->QuerySecurityPackageInfo(
+                                     (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_NTLM)),
+                                     &SecurityPackage);
 
   /* Release the package buffer as it is not required anymore */
   if(status == SEC_E_OK) {
-    s_pSecFn->FreeContextBuffer(SecurityPackage);
+    Curl_pSecFn->FreeContextBuffer(SecurityPackage);
   }
 
-  return (status == SEC_E_OK ? TRUE : FALSE);
+  return status == SEC_E_OK;
 }
 
 /*
@@ -74,19 +66,18 @@ bool Curl_auth_is_ntlm_supported(void)
  * Parameters:
  *
  * data    [in]     - The session handle.
- * userp   [in]     - The user name in the format User or Domain\User.
+ * userp   [in]     - The username in the format User or Domain\User.
  * passwdp [in]     - The user's password.
  * service [in]     - The service type such as http, smtp, pop or imap.
- * host    [in]     - The host name.
+ * host    [in]     - The hostname.
  * ntlm    [in/out] - The NTLM data struct being used and modified.
  * out     [out]    - The result storage.
  *
  * Returns CURLE_OK on success.
  */
 CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
-                                             const char *userp,
-                                             const char *passwdp,
-                                             const char *service,
+                                             struct Curl_creds *creds,
+                                             const char *default_service,
                                              const char *host,
                                              struct ntlmdata *ntlm,
                                              struct bufref *out)
@@ -96,34 +87,37 @@ CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
   SecBufferDesc type_1_desc;
   SECURITY_STATUS status;
   unsigned long attrs;
-  TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
+  const char *service = Curl_creds_has_sasl_service(creds) ?
+    Curl_creds_sasl_service(creds) : default_service;
 
-  /* Clean up any former leftovers and initialise to defaults */
+  /* Clean up any former leftovers and initialize to defaults */
   Curl_auth_cleanup_ntlm(ntlm);
 
   /* Query the security package for NTLM */
-  status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_NTLM),
-                                              &SecurityPackage);
+  status = Curl_pSecFn->QuerySecurityPackageInfo(
+                                     (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_NTLM)),
+                                     &SecurityPackage);
   if(status != SEC_E_OK) {
-    failf(data, "SSPI: couldn't get auth info");
+    failf(data, "SSPI: could not get auth info");
     return CURLE_AUTH_ERROR;
   }
 
   ntlm->token_max = SecurityPackage->cbMaxToken;
 
   /* Release the package buffer as it is not required anymore */
-  s_pSecFn->FreeContextBuffer(SecurityPackage);
+  Curl_pSecFn->FreeContextBuffer(SecurityPackage);
 
   /* Allocate our output buffer */
-  ntlm->output_token = malloc(ntlm->token_max);
+  ntlm->output_token = curlx_malloc(ntlm->token_max);
   if(!ntlm->output_token)
     return CURLE_OUT_OF_MEMORY;
 
-  if(userp && *userp) {
+  if(Curl_creds_has_user(creds)) {
     CURLcode result;
 
     /* Populate our identity structure */
-    result = Curl_create_sspi_identity(userp, passwdp, &ntlm->identity);
+    result = Curl_create_sspi_identity(
+      creds->user, creds->passwd, &ntlm->identity);
     if(result)
       return result;
 
@@ -135,21 +129,23 @@ CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
     ntlm->p_identity = NULL;
 
   /* Allocate our credentials handle */
-  ntlm->credentials = calloc(1, sizeof(CredHandle));
+  ntlm->credentials = curlx_calloc(1, sizeof(CredHandle));
   if(!ntlm->credentials)
     return CURLE_OUT_OF_MEMORY;
 
   /* Acquire our credentials handle */
-  status = s_pSecFn->AcquireCredentialsHandle(NULL,
-                                              (TCHAR *) TEXT(SP_NAME_NTLM),
-                                              SECPKG_CRED_OUTBOUND, NULL,
-                                              ntlm->p_identity, NULL, NULL,
-                                              ntlm->credentials, &expiry);
-  if(status != SEC_E_OK)
+  status = Curl_pSecFn->AcquireCredentialsHandle(NULL,
+                                     (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_NTLM)),
+                                     SECPKG_CRED_OUTBOUND, NULL,
+                                     ntlm->p_identity, NULL, NULL,
+                                     ntlm->credentials, NULL);
+  if(status != SEC_E_OK) {
+    curlx_safefree(ntlm->credentials);
     return CURLE_LOGIN_DENIED;
+  }
 
   /* Allocate our new context handle */
-  ntlm->context = calloc(1, sizeof(CtxtHandle));
+  ntlm->context = curlx_calloc(1, sizeof(CtxtHandle));
   if(!ntlm->context)
     return CURLE_OUT_OF_MEMORY;
 
@@ -166,15 +162,15 @@ CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
   type_1_buf.cbBuffer   = curlx_uztoul(ntlm->token_max);
 
   /* Generate our type-1 message */
-  status = s_pSecFn->InitializeSecurityContext(ntlm->credentials, NULL,
-                                               ntlm->spn,
-                                               0, 0, SECURITY_NETWORK_DREP,
-                                               NULL, 0,
-                                               ntlm->context, &type_1_desc,
-                                               &attrs, &expiry);
+  status = Curl_pSecFn->InitializeSecurityContext(ntlm->credentials, NULL,
+                                                  ntlm->spn,
+                                                  0, 0, SECURITY_NETWORK_DREP,
+                                                  NULL, 0,
+                                                  ntlm->context, &type_1_desc,
+                                                  &attrs, NULL);
   if(status == SEC_I_COMPLETE_NEEDED ||
-    status == SEC_I_COMPLETE_AND_CONTINUE)
-    s_pSecFn->CompleteAuthToken(ntlm->context, &type_1_desc);
+     status == SEC_I_COMPLETE_AND_CONTINUE)
+    Curl_pSecFn->CompleteAuthToken(ntlm->context, &type_1_desc);
   else if(status == SEC_E_INSUFFICIENT_MEMORY)
     return CURLE_OUT_OF_MEMORY;
   else if(status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED)
@@ -199,32 +195,26 @@ CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
  * Returns CURLE_OK on success.
  */
 CURLcode Curl_auth_decode_ntlm_type2_message(struct Curl_easy *data,
-                                             const struct bufref *type2,
+                                             const struct bufref *type2ref,
                                              struct ntlmdata *ntlm)
 {
-#if defined(CURL_DISABLE_VERBOSE_STRINGS)
-  (void) data;
-#endif
-
   /* Ensure we have a valid type-2 message */
-  if(!Curl_bufref_len(type2)) {
+  if(!Curl_bufref_len(type2ref)) {
     infof(data, "NTLM handshake failure (empty type-2 message)");
     return CURLE_BAD_CONTENT_ENCODING;
   }
 
   /* Store the challenge for later use */
-  ntlm->input_token = malloc(Curl_bufref_len(type2) + 1);
+  ntlm->input_token = curlx_memdup0(Curl_bufref_ptr(type2ref),
+                                    Curl_bufref_len(type2ref));
   if(!ntlm->input_token)
     return CURLE_OUT_OF_MEMORY;
-  memcpy(ntlm->input_token, Curl_bufref_ptr(type2), Curl_bufref_len(type2));
-  ntlm->input_token[Curl_bufref_len(type2)] = '\0';
-  ntlm->input_token_len = Curl_bufref_len(type2);
+  ntlm->input_token_len = Curl_bufref_len(type2ref);
 
   return CURLE_OK;
 }
 
 /*
-* Curl_auth_create_ntlm_type3_message()
  * Curl_auth_create_ntlm_type3_message()
  *
  * This is used to generate an already encoded NTLM type-3 message ready for
@@ -233,7 +223,7 @@ CURLcode Curl_auth_decode_ntlm_type2_message(struct Curl_easy *data,
  * Parameters:
  *
  * data    [in]     - The session handle.
- * userp   [in]     - The user name in the format User or Domain\User.
+ * userp   [in]     - The username in the format User or Domain\User.
  * passwdp [in]     - The user's password.
  * ntlm    [in/out] - The NTLM data struct being used and modified.
  * out     [out]    - The result storage.
@@ -241,8 +231,7 @@ CURLcode Curl_auth_decode_ntlm_type2_message(struct Curl_easy *data,
  * Returns CURLE_OK on success.
  */
 CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
-                                             const char *userp,
-                                             const char *passwdp,
+                                             struct Curl_creds *creds,
                                              struct ntlmdata *ntlm,
                                              struct bufref *out)
 {
@@ -253,13 +242,8 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
   SecBufferDesc type_3_desc;
   SECURITY_STATUS status;
   unsigned long attrs;
-  TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
 
-#if defined(CURL_DISABLE_VERBOSE_STRINGS)
-  (void) data;
-#endif
-  (void) passwdp;
-  (void) userp;
+  (void)creds;
 
   /* Setup the type-2 "input" security buffer */
   type_2_desc.ulVersion     = SECBUFFER_VERSION;
@@ -270,19 +254,18 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
   type_2_bufs[0].cbBuffer   = curlx_uztoul(ntlm->input_token_len);
 
 #ifdef SECPKG_ATTR_ENDPOINT_BINDINGS
-  /* ssl context comes from schannel.
-  * When extended protection is used in IIS server,
-  * we have to pass a second SecBuffer to the SecBufferDesc
-  * otherwise IIS will not pass the authentication (401 response).
-  * Minimum supported version is Windows 7.
-  * https://docs.microsoft.com/en-us/security-updates
-  * /SecurityAdvisories/2009/973811
-  */
+  /* SSL context comes from schannel.
+   * When extended protection is used in IIS server,
+   * we have to pass a second SecBuffer to the SecBufferDesc
+   * otherwise IIS does not pass the authentication (401 response).
+   * Minimum supported version is Windows 7.
+   * https://learn.microsoft.com/security-updates/SecurityAdvisories/2009/973811
+   */
   if(ntlm->sslContext) {
     SEC_CHANNEL_BINDINGS channelBindings;
     SecPkgContext_Bindings pkgBindings;
     pkgBindings.Bindings = &channelBindings;
-    status = s_pSecFn->QueryContextAttributes(
+    status = Curl_pSecFn->QueryContextAttributes(
       ntlm->sslContext,
       SECPKG_ATTR_ENDPOINT_BINDINGS,
       &pkgBindings
@@ -305,17 +288,17 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
   type_3_buf.cbBuffer   = curlx_uztoul(ntlm->token_max);
 
   /* Generate our type-3 message */
-  status = s_pSecFn->InitializeSecurityContext(ntlm->credentials,
-                                               ntlm->context,
-                                               ntlm->spn,
-                                               0, 0, SECURITY_NETWORK_DREP,
-                                               &type_2_desc,
-                                               0, ntlm->context,
-                                               &type_3_desc,
-                                               &attrs, &expiry);
+  status = Curl_pSecFn->InitializeSecurityContext(ntlm->credentials,
+                                                  ntlm->context,
+                                                  ntlm->spn,
+                                                  0, 0, SECURITY_NETWORK_DREP,
+                                                  &type_2_desc,
+                                                  0, ntlm->context,
+                                                  &type_3_desc,
+                                                  &attrs, NULL);
   if(status != SEC_E_OK) {
-    infof(data, "NTLM handshake failure (type-3 message): Status=%x",
-          status);
+    infof(data, "NTLM handshake failure (type-3 message): Status=0x%08lx",
+          (unsigned long)status);
 
     if(status == SEC_E_INSUFFICIENT_MEMORY)
       return CURLE_OUT_OF_MEMORY;
@@ -324,7 +307,7 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
   }
 
   /* Return the response. */
-  result = Curl_bufref_memdup(out, ntlm->output_token, type_3_buf.cbBuffer);
+  result = Curl_bufref_memdup0(out, ntlm->output_token, type_3_buf.cbBuffer);
   Curl_auth_cleanup_ntlm(ntlm);
   return result;
 }
@@ -343,16 +326,14 @@ void Curl_auth_cleanup_ntlm(struct ntlmdata *ntlm)
 {
   /* Free our security context */
   if(ntlm->context) {
-    s_pSecFn->DeleteSecurityContext(ntlm->context);
-    free(ntlm->context);
-    ntlm->context = NULL;
+    Curl_pSecFn->DeleteSecurityContext(ntlm->context);
+    curlx_safefree(ntlm->context);
   }
 
   /* Free our credentials handle */
   if(ntlm->credentials) {
-    s_pSecFn->FreeCredentialsHandle(ntlm->credentials);
-    free(ntlm->credentials);
-    ntlm->credentials = NULL;
+    Curl_pSecFn->FreeCredentialsHandle(ntlm->credentials);
+    curlx_safefree(ntlm->credentials);
   }
 
   /* Free our identity */
@@ -360,13 +341,13 @@ void Curl_auth_cleanup_ntlm(struct ntlmdata *ntlm)
   ntlm->p_identity = NULL;
 
   /* Free the input and output tokens */
-  Curl_safefree(ntlm->input_token);
-  Curl_safefree(ntlm->output_token);
+  curlx_safefree(ntlm->input_token);
+  curlx_safefree(ntlm->output_token);
 
   /* Reset any variables */
   ntlm->token_max = 0;
 
-  Curl_safefree(ntlm->spn);
+  curlx_safefree(ntlm->spn);
 }
 
 #endif /* USE_WINDOWS_SSPI && USE_NTLM */
diff --git a/third-party/curl/lib/vauth/oauth2.c b/third-party/curl/lib/vauth/oauth2.c
index a4adbdcf15..f597114638 100644
--- a/third-party/curl/lib/vauth/oauth2.c
+++ b/third-party/curl/lib/vauth/oauth2.c
@@ -23,23 +23,13 @@
  * RFC6749 OAuth 2.0 Authorization Framework
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if !defined(CURL_DISABLE_IMAP) || !defined(CURL_DISABLE_SMTP) || \
-  !defined(CURL_DISABLE_POP3) || \
+  !defined(CURL_DISABLE_POP3) ||                                  \
   (!defined(CURL_DISABLE_LDAP) && defined(USE_OPENLDAP))
 
-#include <curl/curl.h>
-#include "urldata.h"
-
 #include "vauth/vauth.h"
-#include "warnless.h"
-#include "curl_printf.h"
-
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
 
 /*
  * Curl_auth_create_oauth_bearer_message()
@@ -49,29 +39,30 @@
  *
  * Parameters:
  *
- * user[in]         - The user name.
- * host[in]         - The host name.
+ * user[in]         - The username.
+ * host[in]         - The hostname.
  * port[in]         - The port(when not Port 80).
  * bearer[in]       - The bearer token.
  * out[out]         - The result storage.
  *
  * Returns CURLE_OK on success.
  */
-CURLcode Curl_auth_create_oauth_bearer_message(const char *user,
+CURLcode Curl_auth_create_oauth_bearer_message(struct Curl_creds *creds,
                                                const char *host,
                                                const long port,
-                                               const char *bearer,
                                                struct bufref *out)
 {
   char *oauth;
 
   /* Generate the message */
   if(port == 0 || port == 80)
-    oauth = aprintf("n,a=%s,\1host=%s\1auth=Bearer %s\1\1", user, host,
-                    bearer);
+    oauth = curl_maprintf("n,a=%s,\1host=%s\1auth=Bearer %s\1\1",
+                          Curl_creds_user(creds), host,
+                          Curl_creds_oauth_bearer(creds));
   else
-    oauth = aprintf("n,a=%s,\1host=%s\1port=%ld\1auth=Bearer %s\1\1", user,
-                    host, port, bearer);
+    oauth = curl_maprintf("n,a=%s,\1host=%s\1port=%ld\1auth=Bearer %s\1\1",
+                          Curl_creds_user(creds), host, port,
+                          Curl_creds_oauth_bearer(creds));
   if(!oauth)
     return CURLE_OUT_OF_MEMORY;
 
@@ -87,18 +78,19 @@ CURLcode Curl_auth_create_oauth_bearer_message(const char *user,
  *
  * Parameters:
  *
- * user[in]         - The user name.
+ * user[in]         - The username.
  * bearer[in]       - The bearer token.
  * out[out]         - The result storage.
  *
  * Returns CURLE_OK on success.
  */
-CURLcode Curl_auth_create_xoauth_bearer_message(const char *user,
-                                               const char *bearer,
-                                               struct bufref *out)
+CURLcode Curl_auth_create_xoauth_bearer_message(struct Curl_creds *creds,
+                                                struct bufref *out)
 {
   /* Generate the message */
-  char *xoauth = aprintf("user=%s\1auth=Bearer %s\1\1", user, bearer);
+  char *xoauth = curl_maprintf("user=%s\1auth=Bearer %s\1\1",
+                               Curl_creds_user(creds),
+                               Curl_creds_oauth_bearer(creds));
   if(!xoauth)
     return CURLE_OUT_OF_MEMORY;
 
diff --git a/third-party/curl/lib/vauth/spnego_gssapi.c b/third-party/curl/lib/vauth/spnego_gssapi.c
index e1d52b755c..869a27fdc9 100644
--- a/third-party/curl/lib/vauth/spnego_gssapi.c
+++ b/third-party/curl/lib/vauth/spnego_gssapi.c
@@ -23,24 +23,19 @@
  * RFC4178 Simple and Protected GSS-API Negotiation Mechanism
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if defined(HAVE_GSSAPI) && defined(USE_SPNEGO)
 
-#include <curl/curl.h>
-
 #include "vauth/vauth.h"
-#include "urldata.h"
-#include "curl_base64.h"
+#include "curlx/base64.h"
 #include "curl_gssapi.h"
-#include "warnless.h"
-#include "curl_multibyte.h"
-#include "sendf.h"
+#include "curl_trc.h"
 
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
+#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
 
 /*
  * Curl_auth_is_spnego_supported()
@@ -65,19 +60,18 @@ bool Curl_auth_is_spnego_supported(void)
  * Parameters:
  *
  * data        [in]     - The session handle.
- * userp       [in]     - The user name in the format User or Domain\User.
+ * userp       [in]     - The username in the format User or Domain\User.
  * passwdp     [in]     - The user's password.
  * service     [in]     - The service type such as http, smtp, pop or imap.
- * host        [in]     - The host name.
+ * host        [in]     - The hostname.
  * chlg64      [in]     - The optional base64 encoded challenge message.
  * nego        [in/out] - The Negotiate data struct being used and modified.
  *
  * Returns CURLE_OK on success.
  */
 CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
-                                         const char *user,
-                                         const char *password,
-                                         const char *service,
+                                         struct Curl_creds *creds,
+                                         const char *default_service,
                                          const char *host,
                                          const char *chlg64,
                                          struct negotiatedata *nego)
@@ -88,23 +82,29 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
   OM_uint32 major_status;
   OM_uint32 minor_status;
   OM_uint32 unused_status;
-  gss_buffer_desc spn_token = GSS_C_EMPTY_BUFFER;
   gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
   gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
+  gss_channel_bindings_t chan_bindings = GSS_C_NO_CHANNEL_BINDINGS;
+#ifdef GSS_C_CHANNEL_BOUND_FLAG
+  struct gss_channel_bindings_struct chan;
+#endif
 
-  (void) user;
-  (void) password;
+  (void)creds;
 
   if(nego->context && nego->status == GSS_S_COMPLETE) {
     /* We finished successfully our part of authentication, but server
-     * rejected it (since we're again here). Exit with an error since we
-     * can't invent anything better */
+     * rejected it (since we are again here). Exit with an error since we
+     * cannot invent anything better */
     Curl_auth_cleanup_spnego(nego);
     return CURLE_LOGIN_DENIED;
   }
 
   if(!nego->spn) {
+    gss_buffer_desc spn_token = GSS_C_EMPTY_BUFFER;
+
     /* Generate our SPN */
+    const char *service = Curl_creds_has_sasl_service(creds) ?
+      Curl_creds_sasl_service(creds) : default_service;
     char *spn = Curl_auth_build_spn(service, NULL, host);
     if(!spn)
       return CURLE_OUT_OF_MEMORY;
@@ -121,18 +121,18 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
       Curl_gss_log_error(data, "gss_import_name() failed: ",
                          major_status, minor_status);
 
-      free(spn);
+      curlx_free(spn);
 
       return CURLE_AUTH_ERROR;
     }
 
-    free(spn);
+    curlx_free(spn);
   }
 
   if(chlg64 && *chlg64) {
     /* Decode the base-64 encoded challenge message */
     if(*chlg64 != '=') {
-      result = Curl_base64_decode(chlg64, &chlg, &chlglen);
+      result = curlx_base64_decode(chlg64, &chlg, &chlglen);
       if(result)
         return result;
     }
@@ -148,20 +148,30 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
     input_token.length = chlglen;
   }
 
+  /* Set channel binding data if available */
+#ifdef GSS_C_CHANNEL_BOUND_FLAG
+  if(curlx_dyn_len(&nego->channel_binding_data)) {
+    memset(&chan, 0, sizeof(struct gss_channel_bindings_struct));
+    chan.application_data.length = curlx_dyn_len(&nego->channel_binding_data);
+    chan.application_data.value = curlx_dyn_ptr(&nego->channel_binding_data);
+    chan_bindings = &chan;
+  }
+#endif
+
   /* Generate our challenge-response message */
   major_status = Curl_gss_init_sec_context(data,
                                            &minor_status,
                                            &nego->context,
                                            nego->spn,
                                            &Curl_spnego_mech_oid,
-                                           GSS_C_NO_CHANNEL_BINDINGS,
+                                           chan_bindings,
                                            &input_token,
                                            &output_token,
                                            TRUE,
                                            NULL);
 
   /* Free the decoded challenge as it is not required anymore */
-  Curl_safefree(input_token.value);
+  curlx_safefree(input_token.value);
 
   nego->status = major_status;
   if(GSS_ERROR(major_status)) {
@@ -201,7 +211,7 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
  * data        [in]     - The session handle.
  * nego        [in/out] - The Negotiate data struct being used and modified.
  * outptr      [in/out] - The address where a pointer to newly allocated memory
- *                        holding the result will be stored upon completion.
+ *                        holding the result is stored upon completion.
  * outlen      [out]    - The length of the output message.
  *
  * Returns CURLE_OK on success.
@@ -213,9 +223,9 @@ CURLcode Curl_auth_create_spnego_message(struct negotiatedata *nego,
   OM_uint32 minor_status;
 
   /* Base64 encode the already generated response */
-  result = Curl_base64_encode(nego->output_token.value,
-                              nego->output_token.length,
-                              outptr, outlen);
+  result = curlx_base64_encode(nego->output_token.value,
+                               nego->output_token.length,
+                               outptr, outlen);
 
   if(result) {
     gss_release_buffer(&minor_status, &nego->output_token);
@@ -252,7 +262,8 @@ void Curl_auth_cleanup_spnego(struct negotiatedata *nego)
 
   /* Free our security context */
   if(nego->context != GSS_C_NO_CONTEXT) {
-    gss_delete_sec_context(&minor_status, &nego->context, GSS_C_NO_BUFFER);
+    Curl_gss_delete_sec_context(&minor_status, &nego->context,
+                                GSS_C_NO_BUFFER);
     nego->context = GSS_C_NO_CONTEXT;
   }
 
@@ -261,7 +272,6 @@ void Curl_auth_cleanup_spnego(struct negotiatedata *nego)
     gss_release_buffer(&minor_status, &nego->output_token);
     nego->output_token.value = NULL;
     nego->output_token.length = 0;
-
   }
 
   /* Free the SPN */
@@ -278,4 +288,8 @@ void Curl_auth_cleanup_spnego(struct negotiatedata *nego)
   nego->havemultiplerequests = FALSE;
 }
 
+#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
+#pragma GCC diagnostic pop
+#endif
+
 #endif /* HAVE_GSSAPI && USE_SPNEGO */
diff --git a/third-party/curl/lib/vauth/spnego_sspi.c b/third-party/curl/lib/vauth/spnego_sspi.c
index d3245d0b18..b7d82c04dd 100644
--- a/third-party/curl/lib/vauth/spnego_sspi.c
+++ b/third-party/curl/lib/vauth/spnego_sspi.c
@@ -23,25 +23,15 @@
  * RFC4178 Simple and Protected GSS-API Negotiation Mechanism
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #if defined(USE_WINDOWS_SSPI) && defined(USE_SPNEGO)
 
-#include <curl/curl.h>
-
 #include "vauth/vauth.h"
-#include "urldata.h"
-#include "curl_base64.h"
-#include "warnless.h"
-#include "curl_multibyte.h"
-#include "sendf.h"
+#include "curlx/base64.h"
+#include "curl_trc.h"
 #include "strerror.h"
 
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
-
 /*
  * Curl_auth_is_spnego_supported()
  *
@@ -57,17 +47,16 @@ bool Curl_auth_is_spnego_supported(void)
   SECURITY_STATUS status;
 
   /* Query the security package for Negotiate */
-  status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *)
-                                              TEXT(SP_NAME_NEGOTIATE),
-                                              &SecurityPackage);
+  status = Curl_pSecFn->QuerySecurityPackageInfo(
+                                (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_NEGOTIATE)),
+                                &SecurityPackage);
 
   /* Release the package buffer as it is not required anymore */
   if(status == SEC_E_OK) {
-    s_pSecFn->FreeContextBuffer(SecurityPackage);
+    Curl_pSecFn->FreeContextBuffer(SecurityPackage);
   }
 
-
-  return (status == SEC_E_OK ? TRUE : FALSE);
+  return status == SEC_E_OK;
 }
 
 /*
@@ -79,19 +68,18 @@ bool Curl_auth_is_spnego_supported(void)
  * Parameters:
  *
  * data        [in]     - The session handle.
- * user        [in]     - The user name in the format User or Domain\User.
+ * user        [in]     - The username in the format User or Domain\User.
  * password    [in]     - The user's password.
  * service     [in]     - The service type such as http, smtp, pop or imap.
- * host        [in]     - The host name.
+ * host        [in]     - The hostname.
  * chlg64      [in]     - The optional base64 encoded challenge message.
  * nego        [in/out] - The Negotiate data struct being used and modified.
  *
  * Returns CURLE_OK on success.
  */
 CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
-                                         const char *user,
-                                         const char *password,
-                                         const char *service,
+                                         struct Curl_creds *creds,
+                                         const char *default_service,
                                          const char *host,
                                          const char *chlg64,
                                          struct negotiatedata *nego)
@@ -105,22 +93,19 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
   SecBufferDesc chlg_desc;
   SecBufferDesc resp_desc;
   unsigned long attrs;
-  TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
-
-#if defined(CURL_DISABLE_VERBOSE_STRINGS)
-  (void) data;
-#endif
 
   if(nego->context && nego->status == SEC_E_OK) {
     /* We finished successfully our part of authentication, but server
-     * rejected it (since we're again here). Exit with an error since we
-     * can't invent anything better */
+     * rejected it (since we are again here). Exit with an error since we
+     * cannot invent anything better */
     Curl_auth_cleanup_spnego(nego);
     return CURLE_LOGIN_DENIED;
   }
 
   if(!nego->spn) {
     /* Generate our SPN */
+    const char *service = Curl_creds_has_sasl_service(creds) ?
+      Curl_creds_sasl_service(creds) : default_service;
     nego->spn = Curl_auth_build_spn(service, host, NULL);
     if(!nego->spn)
       return CURLE_OUT_OF_MEMORY;
@@ -128,30 +113,31 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
 
   if(!nego->output_token) {
     /* Query the security package for Negotiate */
-    nego->status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *)
-                                                      TEXT(SP_NAME_NEGOTIATE),
-                                                      &SecurityPackage);
+    nego->status = Curl_pSecFn->QuerySecurityPackageInfo(
+                                (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_NEGOTIATE)),
+                                &SecurityPackage);
     if(nego->status != SEC_E_OK) {
-      failf(data, "SSPI: couldn't get auth info");
+      failf(data, "SSPI: could not get auth info");
       return CURLE_AUTH_ERROR;
     }
 
     nego->token_max = SecurityPackage->cbMaxToken;
 
     /* Release the package buffer as it is not required anymore */
-    s_pSecFn->FreeContextBuffer(SecurityPackage);
+    Curl_pSecFn->FreeContextBuffer(SecurityPackage);
 
     /* Allocate our output buffer */
-    nego->output_token = malloc(nego->token_max);
+    nego->output_token = curlx_malloc(nego->token_max);
     if(!nego->output_token)
       return CURLE_OUT_OF_MEMORY;
- }
+  }
 
   if(!nego->credentials) {
     /* Do we have credentials to use or are we using single sign-on? */
-    if(user && *user) {
+    if(Curl_creds_has_user(creds)) {
       /* Populate our identity structure */
-      result = Curl_create_sspi_identity(user, password, &nego->identity);
+      result = Curl_create_sspi_identity(creds->user, creds->passwd,
+                                         &nego->identity);
       if(result)
         return result;
 
@@ -163,22 +149,23 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
       nego->p_identity = NULL;
 
     /* Allocate our credentials handle */
-    nego->credentials = calloc(1, sizeof(CredHandle));
+    nego->credentials = curlx_calloc(1, sizeof(CredHandle));
     if(!nego->credentials)
       return CURLE_OUT_OF_MEMORY;
 
     /* Acquire our credentials handle */
-    nego->status =
-      s_pSecFn->AcquireCredentialsHandle(NULL,
-                                         (TCHAR *)TEXT(SP_NAME_NEGOTIATE),
-                                         SECPKG_CRED_OUTBOUND, NULL,
-                                         nego->p_identity, NULL, NULL,
-                                         nego->credentials, &expiry);
-    if(nego->status != SEC_E_OK)
+    nego->status = Curl_pSecFn->AcquireCredentialsHandle(NULL,
+                                (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_NEGOTIATE)),
+                                SECPKG_CRED_OUTBOUND, NULL,
+                                nego->p_identity, NULL, NULL,
+                                nego->credentials, NULL);
+    if(nego->status != SEC_E_OK) {
+      curlx_safefree(nego->credentials);
       return CURLE_AUTH_ERROR;
+    }
 
     /* Allocate our new context handle */
-    nego->context = calloc(1, sizeof(CtxtHandle));
+    nego->context = curlx_calloc(1, sizeof(CtxtHandle));
     if(!nego->context)
       return CURLE_OUT_OF_MEMORY;
   }
@@ -186,7 +173,7 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
   if(chlg64 && *chlg64) {
     /* Decode the base-64 encoded challenge message */
     if(*chlg64 != '=') {
-      result = Curl_base64_decode(chlg64, &chlg, &chlglen);
+      result = curlx_base64_decode(chlg64, &chlg, &chlglen);
       if(result)
         return result;
     }
@@ -206,23 +193,21 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
     chlg_buf[0].cbBuffer   = curlx_uztoul(chlglen);
 
 #ifdef SECPKG_ATTR_ENDPOINT_BINDINGS
-    /* ssl context comes from Schannel.
-    * When extended protection is used in IIS server,
-    * we have to pass a second SecBuffer to the SecBufferDesc
-    * otherwise IIS will not pass the authentication (401 response).
-    * Minimum supported version is Windows 7.
-    * https://docs.microsoft.com/en-us/security-updates
-    * /SecurityAdvisories/2009/973811
-    */
+    /* SSL context comes from Schannel.
+     * When extended protection is used in IIS server,
+     * we have to pass a second SecBuffer to the SecBufferDesc
+     * otherwise IIS does not pass the authentication (401 response).
+     * Minimum supported version is Windows 7.
+     * https://learn.microsoft.com/security-updates/SecurityAdvisories/2009/973811
+     */
     if(nego->sslContext) {
       SEC_CHANNEL_BINDINGS channelBindings;
       SecPkgContext_Bindings pkgBindings;
       pkgBindings.Bindings = &channelBindings;
-      nego->status = s_pSecFn->QueryContextAttributes(
+      nego->status = Curl_pSecFn->QueryContextAttributes(
           nego->sslContext,
           SECPKG_ATTR_ENDPOINT_BINDINGS,
-          &pkgBindings
-      );
+          &pkgBindings);
       if(nego->status == SEC_E_OK) {
         chlg_desc.cBuffers++;
         chlg_buf[1].BufferType = SECBUFFER_CHANNEL_BINDINGS;
@@ -242,26 +227,30 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
   resp_buf.cbBuffer   = curlx_uztoul(nego->token_max);
 
   /* Generate our challenge-response message */
-  nego->status = s_pSecFn->InitializeSecurityContext(nego->credentials,
-                                                     chlg ? nego->context :
-                                                            NULL,
-                                                     nego->spn,
-                                                     ISC_REQ_CONFIDENTIALITY,
-                                                     0, SECURITY_NATIVE_DREP,
-                                                     chlg ? &chlg_desc : NULL,
-                                                     0, nego->context,
-                                                     &resp_desc, &attrs,
-                                                     &expiry);
+  {
+    DWORD sspi_flags = ISC_REQ_CONFIDENTIALITY;
+    if(data->set.gssapi_delegation & CURLGSSAPI_DELEGATION_FLAG)
+      sspi_flags |= ISC_REQ_DELEGATE | ISC_REQ_MUTUAL_AUTH;
+    nego->status =
+      Curl_pSecFn->InitializeSecurityContext(nego->credentials,
+                                             chlg ? nego->context : NULL,
+                                             nego->spn,
+                                             sspi_flags,
+                                             0, SECURITY_NATIVE_DREP,
+                                             chlg ? &chlg_desc : NULL,
+                                             0, nego->context,
+                                             &resp_desc, &attrs, NULL);
+  }
 
   /* Free the decoded challenge as it is not required anymore */
-  free(chlg);
+  curlx_free(chlg);
 
   if(GSS_ERROR(nego->status)) {
     char buffer[STRERROR_LEN];
     failf(data, "InitializeSecurityContext failed: %s",
           Curl_sspi_strerror(nego->status, buffer, sizeof(buffer)));
 
-    if(nego->status == (DWORD)SEC_E_INSUFFICIENT_MEMORY)
+    if(nego->status == SEC_E_INSUFFICIENT_MEMORY)
       return CURLE_OUT_OF_MEMORY;
 
     return CURLE_AUTH_ERROR;
@@ -269,13 +258,13 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
 
   if(nego->status == SEC_I_COMPLETE_NEEDED ||
      nego->status == SEC_I_COMPLETE_AND_CONTINUE) {
-    nego->status = s_pSecFn->CompleteAuthToken(nego->context, &resp_desc);
+    nego->status = Curl_pSecFn->CompleteAuthToken(nego->context, &resp_desc);
     if(GSS_ERROR(nego->status)) {
       char buffer[STRERROR_LEN];
       failf(data, "CompleteAuthToken failed: %s",
             Curl_sspi_strerror(nego->status, buffer, sizeof(buffer)));
 
-      if(nego->status == (DWORD)SEC_E_INSUFFICIENT_MEMORY)
+      if(nego->status == SEC_E_INSUFFICIENT_MEMORY)
         return CURLE_OUT_OF_MEMORY;
 
       return CURLE_AUTH_ERROR;
@@ -298,7 +287,7 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
  * data        [in]     - The session handle.
  * nego        [in/out] - The Negotiate data struct being used and modified.
  * outptr      [in/out] - The address where a pointer to newly allocated memory
- *                        holding the result will be stored upon completion.
+ *                        holding the result is stored upon completion.
  * outlen      [out]    - The length of the output message.
  *
  * Returns CURLE_OK on success.
@@ -307,11 +296,11 @@ CURLcode Curl_auth_create_spnego_message(struct negotiatedata *nego,
                                          char **outptr, size_t *outlen)
 {
   /* Base64 encode the already generated response */
-  CURLcode result = Curl_base64_encode((const char *) nego->output_token,
-                                       nego->output_token_length, outptr,
-                                       outlen);
+  CURLcode result = curlx_base64_encode(nego->output_token,
+                                        nego->output_token_length, outptr,
+                                        outlen);
   if(!result && (!*outptr || !*outlen)) {
-    free(*outptr);
+    curlx_free(*outptr);
     result = CURLE_REMOTE_ACCESS_DENIED;
   }
 
@@ -332,16 +321,14 @@ void Curl_auth_cleanup_spnego(struct negotiatedata *nego)
 {
   /* Free our security context */
   if(nego->context) {
-    s_pSecFn->DeleteSecurityContext(nego->context);
-    free(nego->context);
-    nego->context = NULL;
+    Curl_pSecFn->DeleteSecurityContext(nego->context);
+    curlx_safefree(nego->context);
   }
 
   /* Free our credentials handle */
   if(nego->credentials) {
-    s_pSecFn->FreeCredentialsHandle(nego->credentials);
-    free(nego->credentials);
-    nego->credentials = NULL;
+    Curl_pSecFn->FreeCredentialsHandle(nego->credentials);
+    curlx_safefree(nego->credentials);
   }
 
   /* Free our identity */
@@ -349,8 +336,8 @@ void Curl_auth_cleanup_spnego(struct negotiatedata *nego)
   nego->p_identity = NULL;
 
   /* Free the SPN and output token */
-  Curl_safefree(nego->spn);
-  Curl_safefree(nego->output_token);
+  curlx_safefree(nego->spn);
+  curlx_safefree(nego->output_token);
 
   /* Reset any variables */
   nego->status = 0;
diff --git a/third-party/curl/lib/vauth/vauth.c b/third-party/curl/lib/vauth/vauth.c
index 62fc7c40fe..3259556e5f 100644
--- a/third-party/curl/lib/vauth/vauth.c
+++ b/third-party/curl/lib/vauth/vauth.c
@@ -21,25 +21,17 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#include <curl/curl.h>
-
-#include "vauth.h"
-#include "urldata.h"
-#include "strcase.h"
-#include "curl_multibyte.h"
-#include "curl_printf.h"
-
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "vauth/vauth.h"
+#include "creds.h"
+#include "curlx/multibyte.h"
+#include "url.h"
 
 /*
  * Curl_auth_build_spn()
  *
- * This is used to build a SPN string in the following formats:
+ * This is used to build an SPN string in the following formats:
  *
  * service/host@realm (Not currently used)
  * service/host       (Not used by GSS-API)
@@ -48,12 +40,12 @@
  * Parameters:
  *
  * service  [in] - The service type such as http, smtp, pop or imap.
- * host     [in] - The host name.
+ * host     [in] - The hostname.
  * realm    [in] - The realm.
  *
  * Returns a pointer to the newly allocated SPN.
  */
-#if !defined(USE_WINDOWS_SSPI)
+#ifndef USE_WINDOWS_SSPI
 char *Curl_auth_build_spn(const char *service, const char *host,
                           const char *realm)
 {
@@ -61,11 +53,11 @@ char *Curl_auth_build_spn(const char *service, const char *host,
 
   /* Generate our SPN */
   if(host && realm)
-    spn = aprintf("%s/%s@%s", service, host, realm);
+    spn = curl_maprintf("%s/%s@%s", service, host, realm);
   else if(host)
-    spn = aprintf("%s/%s", service, host);
+    spn = curl_maprintf("%s/%s", service, host);
   else if(realm)
-    spn = aprintf("%s@%s", service, realm);
+    spn = curl_maprintf("%s@%s", service, realm);
 
   /* Return our newly allocated SPN */
   return spn;
@@ -76,9 +68,8 @@ TCHAR *Curl_auth_build_spn(const char *service, const char *host,
 {
   char *utf8_spn = NULL;
   TCHAR *tchar_spn = NULL;
-  TCHAR *dupe_tchar_spn = NULL;
 
-  (void) realm;
+  (void)realm;
 
   /* Note: We could use DsMakeSPN() or DsClientMakeSpnForTargetServer() rather
      than doing this ourselves but the first is only available in Windows XP
@@ -88,20 +79,15 @@ TCHAR *Curl_auth_build_spn(const char *service, const char *host,
      formulate the SPN instead. */
 
   /* Generate our UTF8 based SPN */
-  utf8_spn = aprintf("%s/%s", service, host);
+  utf8_spn = curl_maprintf("%s/%s", service, host);
   if(!utf8_spn)
     return NULL;
 
-  /* Allocate and return a TCHAR based SPN. Since curlx_convert_UTF8_to_tchar
-     must be freed by curlx_unicodefree we'll dupe the result so that the
-     pointer this function returns can be normally free'd. */
+  /* Allocate and return a TCHAR based SPN. */
   tchar_spn = curlx_convert_UTF8_to_tchar(utf8_spn);
-  free(utf8_spn);
-  if(!tchar_spn)
-    return NULL;
-  dupe_tchar_spn = _tcsdup(tchar_spn);
-  curlx_unicodefree(tchar_spn);
-  return dupe_tchar_spn;
+  curlx_free(utf8_spn);
+
+  return tchar_spn;
 }
 #endif /* USE_WINDOWS_SSPI */
 
@@ -115,27 +101,27 @@ TCHAR *Curl_auth_build_spn(const char *service, const char *host,
  * Domain/User (curl Down-level format - for compatibility with existing code)
  * User@Domain (User Principal Name)
  *
- * Note: The user name may be empty when using a GSS-API library or Windows
+ * Note: The username may be empty when using a GSS-API library or Windows
  * SSPI as the user and domain are either obtained from the credentials cache
  * when using GSS-API or via the currently logged in user's credentials when
  * using Windows SSPI.
  *
  * Parameters:
  *
- * user  [in] - The user name.
+ * user  [in] - The username.
  *
  * Returns TRUE on success; otherwise FALSE.
  */
-bool Curl_auth_user_contains_domain(const char *user)
+bool Curl_auth_user_contains_domain(struct Curl_creds *creds)
 {
   bool valid = FALSE;
 
-  if(user && *user) {
+  if(Curl_creds_has_user(creds)) {
     /* Check we have a domain name or UPN present */
-    char *p = strpbrk(user, "\\/@");
+    const char *p = strpbrk(creds->user, "\\/@");
 
-    valid = (p != NULL && p > user && p < user + strlen(user) - 1 ? TRUE :
-                                                                    FALSE);
+    valid = p && (p > creds->user) &&
+            (p < (creds->user + strlen(creds->user) - 1));
   }
 #if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
   else
@@ -148,16 +134,119 @@ bool Curl_auth_user_contains_domain(const char *user)
 }
 
 /*
- * Curl_auth_ollowed_to_host() tells if authentication, cookies or other
- * "sensitive data" can (still) be sent to this host.
+ * Curl_auth_allowed_to_host() tells if authentication, cookies or other
+ * "sensitive data" can be sent to the connection's origin.
  */
 bool Curl_auth_allowed_to_host(struct Curl_easy *data)
 {
-  struct connectdata *conn = data->conn;
-  return (!data->state.this_is_a_follow ||
-          data->set.allow_auth_to_other_hosts ||
-          (data->state.first_host &&
-           strcasecompare(data->state.first_host, conn->host.name) &&
-           (data->state.first_remote_port == conn->remote_port) &&
-           (data->state.first_remote_protocol == conn->handler->protocol)));
+  return Curl_auth_allowed_to_origin(data, data->state.origin);
 }
+
+bool Curl_auth_allowed_to_origin(struct Curl_easy *data,
+                                 struct Curl_peer *origin)
+{
+  return data->set.allow_auth_to_other_hosts ||
+         Curl_peer_equal(data->state.initial_origin, origin);
+}
+
+#ifdef USE_NTLM
+static void ntlm_conn_dtor(void *key, size_t klen, void *entry)
+{
+  struct ntlmdata *ntlm = entry;
+  (void)key;
+  (void)klen;
+  DEBUGASSERT(ntlm);
+  Curl_auth_cleanup_ntlm(ntlm);
+  curlx_free(ntlm);
+}
+
+struct ntlmdata *Curl_auth_ntlm_get(struct connectdata *conn, bool proxy)
+{
+  const char *key = proxy ? CURL_META_NTLM_PROXY_CONN : CURL_META_NTLM_CONN;
+  struct ntlmdata *ntlm = Curl_conn_meta_get(conn, key);
+  if(!ntlm) {
+    ntlm = curlx_calloc(1, sizeof(*ntlm));
+    if(!ntlm || Curl_conn_meta_set(conn, key, ntlm, ntlm_conn_dtor))
+      return NULL;
+  }
+  return ntlm;
+}
+
+void Curl_auth_ntlm_remove(struct connectdata *conn, bool proxy)
+{
+  Curl_conn_meta_remove(conn, proxy ? CURL_META_NTLM_PROXY_CONN
+                                    : CURL_META_NTLM_CONN);
+}
+#endif /* USE_NTLM */
+
+#ifdef USE_KERBEROS5
+static void krb5_conn_dtor(void *key, size_t klen, void *entry)
+{
+  struct kerberos5data *krb5 = entry;
+  (void)key;
+  (void)klen;
+  DEBUGASSERT(krb5);
+  Curl_auth_cleanup_gssapi(krb5);
+  curlx_free(krb5);
+}
+
+struct kerberos5data *Curl_auth_krb5_get(struct connectdata *conn)
+{
+  struct kerberos5data *krb5 = Curl_conn_meta_get(conn, CURL_META_KRB5_CONN);
+  if(!krb5) {
+    krb5 = curlx_calloc(1, sizeof(*krb5));
+    if(!krb5 ||
+       Curl_conn_meta_set(conn, CURL_META_KRB5_CONN, krb5, krb5_conn_dtor))
+      return NULL;
+  }
+  return krb5;
+}
+#endif /* USE_KERBEROS5 */
+
+#ifdef USE_GSASL
+static void gsasl_conn_dtor(void *key, size_t klen, void *entry)
+{
+  struct gsasldata *gsasl = entry;
+  (void)key;
+  (void)klen;
+  DEBUGASSERT(gsasl);
+  Curl_auth_gsasl_cleanup(gsasl);
+  curlx_free(gsasl);
+}
+
+struct gsasldata *Curl_auth_gsasl_get(struct connectdata *conn)
+{
+  struct gsasldata *gsasl = Curl_conn_meta_get(conn, CURL_META_GSASL_CONN);
+  if(!gsasl) {
+    gsasl = curlx_calloc(1, sizeof(*gsasl));
+    if(!gsasl ||
+       Curl_conn_meta_set(conn, CURL_META_GSASL_CONN, gsasl, gsasl_conn_dtor))
+      return NULL;
+  }
+  return gsasl;
+}
+#endif /* USE_GSASL */
+
+#ifdef USE_SPNEGO
+static void nego_conn_dtor(void *key, size_t klen, void *entry)
+{
+  struct negotiatedata *nego = entry;
+  (void)key;
+  (void)klen;
+  DEBUGASSERT(nego);
+  Curl_auth_cleanup_spnego(nego);
+  curlx_free(nego);
+}
+
+struct negotiatedata *Curl_auth_nego_get(struct connectdata *conn, bool proxy)
+{
+  const char *key = proxy ? CURL_META_NEGO_PROXY_CONN : CURL_META_NEGO_CONN;
+  struct negotiatedata *nego = Curl_conn_meta_get(conn, key);
+  if(!nego) {
+    nego = curlx_calloc(1, sizeof(*nego));
+    if(!nego || Curl_conn_meta_set(conn, key, nego, nego_conn_dtor))
+      return NULL;
+  }
+  return nego;
+}
+#endif /* USE_SPNEGO */
diff --git a/third-party/curl/lib/vauth/vauth.h b/third-party/curl/lib/vauth/vauth.h
index 9da0540892..0f82f92945 100644
--- a/third-party/curl/lib/vauth/vauth.h
+++ b/third-party/curl/lib/vauth/vauth.h
@@ -23,34 +23,35 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
-#include <curl/curl.h>
+#include "curl_setup.h"
 
 #include "bufref.h"
+#include "curlx/dynbuf.h"
+#include "urldata.h"
 
 struct Curl_easy;
+struct Curl_creds;
+struct connectdata;
+struct Curl_peer;
 
-#if !defined(CURL_DISABLE_DIGEST_AUTH)
+#ifndef CURL_DISABLE_DIGEST_AUTH
 struct digestdata;
 #endif
 
-#if defined(USE_NTLM)
+#ifdef USE_NTLM
 struct ntlmdata;
 #endif
 
-#if defined(USE_KERBEROS5)
-struct kerberos5data;
-#endif
-
 #if (defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)) && defined(USE_SPNEGO)
 struct negotiatedata;
 #endif
 
-#if defined(USE_GSASL)
+#ifdef USE_GSASL
 struct gsasldata;
 #endif
 
-#if defined(USE_WINDOWS_SSPI)
+#ifdef USE_WINDOWS_SSPI
+#include "curl_sspi.h"
 #define GSS_ERROR(status) ((status) & 0x80000000)
 #endif
 
@@ -59,9 +60,11 @@ struct gsasldata;
  * "sensitive data" can (still) be sent to this host.
  */
 bool Curl_auth_allowed_to_host(struct Curl_easy *data);
+bool Curl_auth_allowed_to_origin(struct Curl_easy *data,
+                                 struct Curl_peer *origin);
 
-/* This is used to build a SPN string */
-#if !defined(USE_WINDOWS_SSPI)
+/* This is used to build an SPN string */
+#ifndef USE_WINDOWS_SSPI
 char *Curl_auth_build_spn(const char *service, const char *host,
                           const char *realm);
 #else
@@ -70,27 +73,22 @@ TCHAR *Curl_auth_build_spn(const char *service, const char *host,
 #endif
 
 /* This is used to test if the user contains a Windows domain name */
-bool Curl_auth_user_contains_domain(const char *user);
+bool Curl_auth_user_contains_domain(struct Curl_creds *creds);
 
 /* This is used to generate a PLAIN cleartext message */
-CURLcode Curl_auth_create_plain_message(const char *authzid,
-                                        const char *authcid,
-                                        const char *passwd,
+CURLcode Curl_auth_create_plain_message(struct Curl_creds *creds,
                                         struct bufref *out);
 
 /* This is used to generate a LOGIN cleartext message */
-CURLcode Curl_auth_create_login_message(const char *value,
-                                        struct bufref *out);
+void Curl_auth_create_login_message(const char *value, struct bufref *out);
 
 /* This is used to generate an EXTERNAL cleartext message */
-CURLcode Curl_auth_create_external_message(const char *user,
-                                           struct bufref *out);
+void Curl_auth_create_external_message(const char *user, struct bufref *out);
 
 #ifndef CURL_DISABLE_DIGEST_AUTH
 /* This is used to generate a CRAM-MD5 response message */
 CURLcode Curl_auth_create_cram_md5_message(const struct bufref *chlg,
-                                           const char *userp,
-                                           const char *passwdp,
+                                           struct Curl_creds *creds,
                                            struct bufref *out);
 
 /* This is used to evaluate if DIGEST is supported */
@@ -99,9 +97,8 @@ bool Curl_auth_is_digest_supported(void);
 /* This is used to generate a base64 encoded DIGEST-MD5 response message */
 CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
                                              const struct bufref *chlg,
-                                             const char *userp,
-                                             const char *passwdp,
-                                             const char *service,
+                                             struct Curl_creds *creds,
+                                             const char *default_service,
                                              struct bufref *out);
 
 /* This is used to decode an HTTP DIGEST challenge message */
@@ -110,26 +107,39 @@ CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
 
 /* This is used to generate an HTTP DIGEST response message */
 CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
-                                              const char *userp,
-                                              const char *passwdp,
+                                              struct Curl_creds *creds,
                                               const unsigned char *request,
-                                              const unsigned char *uri,
+                                              const unsigned char *uripath,
                                               struct digestdata *digest,
                                               char **outptr, size_t *outlen);
 
 /* This is used to clean up the digest specific data */
 void Curl_auth_digest_cleanup(struct digestdata *digest);
+#else
+#define Curl_auth_digest_cleanup(x)
+#define Curl_auth_is_digest_supported()       FALSE
 #endif /* !CURL_DISABLE_DIGEST_AUTH */
 
 #ifdef USE_GSASL
+
+/* meta key for storing GSASL meta at connection */
+#define CURL_META_GSASL_CONN   "meta:auth:gsasl:conn"
+
+#include <gsasl.h>
+struct gsasldata {
+  Gsasl *ctx;
+  Gsasl_session *client;
+};
+
+struct gsasldata *Curl_auth_gsasl_get(struct connectdata *conn);
+
 /* This is used to evaluate if MECH is supported by gsasl */
 bool Curl_auth_gsasl_is_supported(struct Curl_easy *data,
                                   const char *mech,
                                   struct gsasldata *gsasl);
 /* This is used to start a gsasl method */
 CURLcode Curl_auth_gsasl_start(struct Curl_easy *data,
-                               const char *userp,
-                               const char *passwdp,
+                               struct Curl_creds *creds,
                                struct gsasldata *gsasl);
 
 /* This is used to process and generate a new SASL token */
@@ -139,62 +149,115 @@ CURLcode Curl_auth_gsasl_token(struct Curl_easy *data,
                                struct bufref *out);
 
 /* This is used to clean up the gsasl specific data */
-void Curl_auth_gsasl_cleanup(struct gsasldata *digest);
+void Curl_auth_gsasl_cleanup(struct gsasldata *gsasl);
 #endif
 
-#if defined(USE_NTLM)
+#ifdef USE_NTLM
+
+/* meta key for storing NTML meta at connection */
+#define CURL_META_NTLM_CONN   "meta:auth:ntml:conn"
+/* meta key for storing NTML-PROXY meta at connection */
+#define CURL_META_NTLM_PROXY_CONN   "meta:auth:ntml-proxy:conn"
+
+struct ntlmdata {
+#ifdef USE_WINDOWS_SSPI
+/* The sslContext is used for the Schannel bindings. The
+ * api is available on the Windows 7 SDK and later.
+ */
+#ifdef SECPKG_ATTR_ENDPOINT_BINDINGS
+  CtxtHandle *sslContext;
+#endif
+  CredHandle *credentials;
+  CtxtHandle *context;
+  SEC_WINNT_AUTH_IDENTITY identity;
+  SEC_WINNT_AUTH_IDENTITY *p_identity;
+  size_t token_max;
+  BYTE *output_token;
+  BYTE *input_token;
+  size_t input_token_len;
+  TCHAR *spn;
+#else
+  unsigned int flags;
+  unsigned char nonce[8];
+  unsigned int target_info_len;
+  void *target_info; /* TargetInfo received in the NTLM type-2 message */
+#endif
+};
+
 /* This is used to evaluate if NTLM is supported */
 bool Curl_auth_is_ntlm_supported(void);
 
+struct ntlmdata *Curl_auth_ntlm_get(struct connectdata *conn, bool proxy);
+void Curl_auth_ntlm_remove(struct connectdata *conn, bool proxy);
+
+/* This is used to clean up the NTLM specific data */
+void Curl_auth_cleanup_ntlm(struct ntlmdata *ntlm);
+
 /* This is used to generate a base64 encoded NTLM type-1 message */
 CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
-                                             const char *userp,
-                                             const char *passwdp,
-                                             const char *service,
+                                             struct Curl_creds *creds,
+                                             const char *default_service,
                                              const char *host,
                                              struct ntlmdata *ntlm,
                                              struct bufref *out);
 
 /* This is used to decode a base64 encoded NTLM type-2 message */
 CURLcode Curl_auth_decode_ntlm_type2_message(struct Curl_easy *data,
-                                             const struct bufref *type2,
+                                             const struct bufref *type2ref,
                                              struct ntlmdata *ntlm);
 
 /* This is used to generate a base64 encoded NTLM type-3 message */
 CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
-                                             const char *userp,
-                                             const char *passwdp,
+                                             struct Curl_creds *creds,
                                              struct ntlmdata *ntlm,
                                              struct bufref *out);
 
-/* This is used to clean up the NTLM specific data */
-void Curl_auth_cleanup_ntlm(struct ntlmdata *ntlm);
+#else
+#define Curl_auth_is_ntlm_supported()     FALSE
 #endif /* USE_NTLM */
 
 /* This is used to generate a base64 encoded OAuth 2.0 message */
-CURLcode Curl_auth_create_oauth_bearer_message(const char *user,
+CURLcode Curl_auth_create_oauth_bearer_message(struct Curl_creds *creds,
                                                const char *host,
                                                const long port,
-                                               const char *bearer,
                                                struct bufref *out);
 
 /* This is used to generate a base64 encoded XOAuth 2.0 message */
-CURLcode Curl_auth_create_xoauth_bearer_message(const char *user,
-                                                const char *bearer,
+CURLcode Curl_auth_create_xoauth_bearer_message(struct Curl_creds *creds,
                                                 struct bufref *out);
 
-#if defined(USE_KERBEROS5)
+#ifdef USE_KERBEROS5
+
+/* meta key for storing KRB5 meta at connection */
+#define CURL_META_KRB5_CONN   "meta:auth:krb5:conn"
+
+struct kerberos5data {
+#ifdef USE_WINDOWS_SSPI
+  CredHandle *credentials;
+  CtxtHandle *context;
+  TCHAR *spn;
+  SEC_WINNT_AUTH_IDENTITY identity;
+  SEC_WINNT_AUTH_IDENTITY *p_identity;
+  size_t token_max;
+  BYTE *output_token;
+#else
+  gss_ctx_id_t context;
+  gss_name_t spn;
+#endif
+};
+
+struct kerberos5data *Curl_auth_krb5_get(struct connectdata *conn);
+
 /* This is used to evaluate if GSSAPI (Kerberos V5) is supported */
 bool Curl_auth_is_gssapi_supported(void);
 
 /* This is used to generate a base64 encoded GSSAPI (Kerberos V5) user token
    message */
 CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
-                                              const char *userp,
-                                              const char *passwdp,
-                                              const char *service,
+                                              struct Curl_creds *creds,
+                                              const char *default_service,
                                               const char *host,
-                                              const bool mutual,
+                                              const bool mutual_auth,
                                               const struct bufref *chlg,
                                               struct kerberos5data *krb5,
                                               struct bufref *out);
@@ -209,18 +272,58 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
 
 /* This is used to clean up the GSSAPI specific data */
 void Curl_auth_cleanup_gssapi(struct kerberos5data *krb5);
+#else
+#define Curl_auth_is_gssapi_supported()       FALSE
 #endif /* USE_KERBEROS5 */
 
-#if defined(USE_SPNEGO)
-/* This is used to evaluate if SPNEGO (Negotiate) is supported */
+#ifdef USE_SPNEGO
+
 bool Curl_auth_is_spnego_supported(void);
 
+/* meta key for storing NEGO meta at connection */
+#define CURL_META_NEGO_CONN         "meta:auth:nego:conn"
+/* meta key for storing NEGO PROXY meta at connection */
+#define CURL_META_NEGO_PROXY_CONN   "meta:auth:nego-proxy:conn"
+
+/* Struct used for Negotiate (SPNEGO) authentication */
+struct negotiatedata {
+#ifdef HAVE_GSSAPI
+  OM_uint32 status;
+  gss_ctx_id_t context;
+  gss_name_t spn;
+  gss_buffer_desc output_token;
+#ifdef GSS_C_CHANNEL_BOUND_FLAG
+  struct dynbuf channel_binding_data;
+#endif
+#else
+#ifdef USE_WINDOWS_SSPI
+#ifdef SECPKG_ATTR_ENDPOINT_BINDINGS
+  CtxtHandle *sslContext;
+#endif
+  SECURITY_STATUS status;
+  CredHandle *credentials;
+  CtxtHandle *context;
+  SEC_WINNT_AUTH_IDENTITY identity;
+  SEC_WINNT_AUTH_IDENTITY *p_identity;
+  TCHAR *spn;
+  size_t token_max;
+  BYTE *output_token;
+  size_t output_token_length;
+#endif
+#endif
+  BIT(noauthpersist);
+  BIT(havenoauthpersist);
+  BIT(havenegdata);
+  BIT(havemultiplerequests);
+};
+
+struct negotiatedata *Curl_auth_nego_get(struct connectdata *conn, bool proxy);
+
 /* This is used to decode a base64 encoded SPNEGO (Negotiate) challenge
    message */
 CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
-                                         const char *user,
-                                         const char *password,
-                                         const char *service,
+                                         struct Curl_creds *creds,
+                                         const char *default_service,
                                          const char *host,
                                          const char *chlg64,
                                          struct negotiatedata *nego);
diff --git a/third-party/curl/lib/version.c b/third-party/curl/lib/version.c
index 47304259e0..299caee9fb 100644
--- a/third-party/curl/lib/version.c
+++ b/third-party/curl/lib/version.c
@@ -21,27 +21,20 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef USE_NGHTTP2
 #include <nghttp2/nghttp2.h>
 #endif
 
-#include <curl/curl.h>
 #include "urldata.h"
 #include "vtls/vtls.h"
 #include "http2.h"
 #include "vssh/ssh.h"
 #include "vquic/vquic.h"
-#include "curl_printf.h"
 #include "easy_lock.h"
 
 #ifdef USE_ARES
-#  if defined(CURL_STATICLIB) && !defined(CARES_STATICLIB) &&   \
-  defined(WIN32)
-#    define CARES_STATICLIB
-#  endif
 #  include <ares.h>
 #endif
 
@@ -53,22 +46,18 @@
 #include <libpsl.h>
 #endif
 
-#ifdef USE_LIBRTMP
-#include <librtmp/rtmp.h>
-#endif
-
 #ifdef HAVE_LIBZ
 #include <zlib.h>
 #endif
 
 #ifdef HAVE_BROTLI
-#if defined(__GNUC__)
+#ifdef CURL_HAVE_DIAG
 /* Ignore -Wvla warnings in brotli headers */
 #pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Wvla"
 #endif
 #include <brotli/decode.h>
-#if defined(__GNUC__)
+#ifdef CURL_HAVE_DIAG
 #pragma GCC diagnostic pop
 #endif
 #endif
@@ -81,8 +70,8 @@
 #include <gsasl.h>
 #endif
 
-#ifdef USE_OPENLDAP
-#include <ldap.h>
+#ifndef CURL_DISABLE_LDAP
+#include "curl_ldap.h"
 #endif
 
 #ifdef HAVE_BROTLI
@@ -92,20 +81,49 @@ static void brotli_version(char *buf, size_t bufsz)
   unsigned int major = brotli_version >> 24;
   unsigned int minor = (brotli_version & 0x00FFFFFF) >> 12;
   unsigned int patch = brotli_version & 0x00000FFF;
-  (void)msnprintf(buf, bufsz, "%u.%u.%u", major, minor, patch);
+  (void)curl_msnprintf(buf, bufsz, "brotli/%u.%u.%u", major, minor, patch);
 }
 #endif
 
 #ifdef HAVE_ZSTD
 static void zstd_version(char *buf, size_t bufsz)
 {
-  unsigned long zstd_version = (unsigned long)ZSTD_versionNumber();
-  unsigned int major = (unsigned int)(zstd_version / (100 * 100));
-  unsigned int minor = (unsigned int)((zstd_version -
-                                       (major * 100 * 100)) / 100);
-  unsigned int patch = (unsigned int)(zstd_version -
-                                      (major * 100 * 100) - (minor * 100));
-  (void)msnprintf(buf, bufsz, "%u.%u.%u", major, minor, patch);
+  unsigned int version = ZSTD_versionNumber();
+  unsigned int major = version / (100 * 100);
+  unsigned int minor = (version - (major * 100 * 100)) / 100;
+  unsigned int patch = version - (major * 100 * 100) - (minor * 100);
+  (void)curl_msnprintf(buf, bufsz, "zstd/%u.%u.%u", major, minor, patch);
+}
+#endif
+
+#ifdef USE_LIBPSL
+static void psl_version(char *buf, size_t bufsz)
+{
+#if defined(PSL_VERSION_MAJOR) && (PSL_VERSION_MAJOR > 0 ||     \
+                                   PSL_VERSION_MINOR >= 11)
+  int num = psl_check_version_number(0);
+  curl_msnprintf(buf, bufsz, "libpsl/%d.%d.%d",
+                 num >> 16, (num >> 8) & 0xff, num & 0xff);
+#else
+  curl_msnprintf(buf, bufsz, "libpsl/%s", psl_get_version());
+#endif
+}
+#endif
+
+#if defined(USE_LIBIDN2) || defined(USE_WIN32_IDN) || defined(USE_APPLE_IDN)
+#define USE_IDN
+#endif
+
+#ifdef USE_IDN
+static void idn_version(char *buf, size_t bufsz)
+{
+#ifdef USE_LIBIDN2
+  curl_msnprintf(buf, bufsz, "libidn2/%s", idn2_check_version(NULL));
+#elif defined(USE_WIN32_IDN)
+  curl_msnprintf(buf, bufsz, "WinIDN");
+#elif defined(USE_APPLE_IDN)
+  curl_msnprintf(buf, bufsz, "AppleIDN");
+#endif
 }
 #endif
 
@@ -129,42 +147,39 @@ char *curl_version(void)
   char ssl_version[200];
 #endif
 #ifdef HAVE_LIBZ
-  char z_version[40];
+  char z_version[30];
 #endif
 #ifdef HAVE_BROTLI
-  char br_version[40] = "brotli/";
+  char br_version[30];
 #endif
 #ifdef HAVE_ZSTD
-  char zst_version[40] = "zstd/";
+  char zstd_ver[30];
 #endif
 #ifdef USE_ARES
-  char cares_version[40];
+  char cares_version[30];
 #endif
-#if defined(USE_LIBIDN2)
-  char idn_version[40];
+#ifdef USE_IDN
+  char idn_ver[30];
 #endif
 #ifdef USE_LIBPSL
-  char psl_version[40];
+  char psl_ver[30];
 #endif
 #ifdef USE_SSH
-  char ssh_version[40];
+  char ssh_version[30];
 #endif
-#ifdef USE_NGHTTP2
-  char h2_version[40];
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_NGHTTP2)
+  char h2_version[30];
 #endif
-#ifdef ENABLE_QUIC
-  char h3_version[40];
-#endif
-#ifdef USE_LIBRTMP
-  char rtmp_version[40];
-#endif
-#ifdef USE_HYPER
-  char hyper_buf[30];
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_HTTP3)
+  char h3_version[30];
 #endif
 #ifdef USE_GSASL
   char gsasl_buf[30];
 #endif
-#ifdef USE_OPENLDAP
+#ifdef HAVE_GSSAPI
+  char gss_buf[40];
+#endif
+#ifndef CURL_DISABLE_LDAP
   char ldap_buf[30];
 #endif
   int i = 0;
@@ -174,8 +189,7 @@ char *curl_version(void)
   /* Override version string when environment variable CURL_VERSION is set */
   const char *debugversion = getenv("CURL_VERSION");
   if(debugversion) {
-    strncpy(out, debugversion, sizeof(out)-1);
-    out[sizeof(out)-1] = '\0';
+    curl_msnprintf(out, sizeof(out), "%s", debugversion);
     return out;
   }
 #endif
@@ -186,89 +200,60 @@ char *curl_version(void)
   src[i++] = ssl_version;
 #endif
 #ifdef HAVE_LIBZ
-  msnprintf(z_version, sizeof(z_version), "zlib/%s", zlibVersion());
+  curl_msnprintf(z_version, sizeof(z_version), "zlib/%s", zlibVersion());
   src[i++] = z_version;
 #endif
 #ifdef HAVE_BROTLI
-  brotli_version(&br_version[7], sizeof(br_version) - 7);
+  brotli_version(br_version, sizeof(br_version));
   src[i++] = br_version;
 #endif
 #ifdef HAVE_ZSTD
-  zstd_version(&zst_version[5], sizeof(zst_version) - 5);
-  src[i++] = zst_version;
+  zstd_version(zstd_ver, sizeof(zstd_ver));
+  src[i++] = zstd_ver;
 #endif
 #ifdef USE_ARES
-  msnprintf(cares_version, sizeof(cares_version),
-            "c-ares/%s", ares_version(NULL));
+  curl_msnprintf(cares_version, sizeof(cares_version),
+                 "c-ares/%s", ares_version(NULL));
   src[i++] = cares_version;
 #endif
-#ifdef USE_LIBIDN2
-  msnprintf(idn_version, sizeof(idn_version),
-            "libidn2/%s", idn2_check_version(NULL));
-  src[i++] = idn_version;
-#elif defined(USE_WIN32_IDN)
-  src[i++] = (char *)"WinIDN";
+#ifdef USE_IDN
+  idn_version(idn_ver, sizeof(idn_ver));
+  src[i++] = idn_ver;
 #endif
-
 #ifdef USE_LIBPSL
-  msnprintf(psl_version, sizeof(psl_version), "libpsl/%s", psl_get_version());
-  src[i++] = psl_version;
+  psl_version(psl_ver, sizeof(psl_ver));
+  src[i++] = psl_ver;
 #endif
-
 #ifdef USE_SSH
   Curl_ssh_version(ssh_version, sizeof(ssh_version));
   src[i++] = ssh_version;
 #endif
-#ifdef USE_NGHTTP2
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_NGHTTP2)
   Curl_http2_ver(h2_version, sizeof(h2_version));
   src[i++] = h2_version;
 #endif
-#ifdef ENABLE_QUIC
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_HTTP3)
   Curl_quic_ver(h3_version, sizeof(h3_version));
   src[i++] = h3_version;
 #endif
-#ifdef USE_LIBRTMP
-  {
-    char suff[2];
-    if(RTMP_LIB_VERSION & 0xff) {
-      suff[0] = (RTMP_LIB_VERSION & 0xff) + 'a' - 1;
-      suff[1] = '\0';
-    }
-    else
-      suff[0] = '\0';
-
-    msnprintf(rtmp_version, sizeof(rtmp_version), "librtmp/%d.%d%s",
-              RTMP_LIB_VERSION >> 16, (RTMP_LIB_VERSION >> 8) & 0xff,
-              suff);
-    src[i++] = rtmp_version;
-  }
-#endif
-#ifdef USE_HYPER
-  msnprintf(hyper_buf, sizeof(hyper_buf), "Hyper/%s", hyper_version());
-  src[i++] = hyper_buf;
-#endif
 #ifdef USE_GSASL
-  msnprintf(gsasl_buf, sizeof(gsasl_buf), "libgsasl/%s",
-            gsasl_check_version(NULL));
+  curl_msnprintf(gsasl_buf, sizeof(gsasl_buf), "libgsasl/%s",
+                 gsasl_check_version(NULL));
   src[i++] = gsasl_buf;
 #endif
-#ifdef USE_OPENLDAP
-  {
-    LDAPAPIInfo api;
-    api.ldapai_info_version = LDAP_API_INFO_VERSION;
-
-    if(ldap_get_option(NULL, LDAP_OPT_API_INFO, &api) == LDAP_OPT_SUCCESS) {
-      unsigned int patch = api.ldapai_vendor_version % 100;
-      unsigned int major = api.ldapai_vendor_version / 10000;
-      unsigned int minor =
-        ((api.ldapai_vendor_version - major * 10000) - patch) / 100;
-      msnprintf(ldap_buf, sizeof(ldap_buf), "%s/%u.%u.%u",
-                api.ldapai_vendor_name, major, minor, patch);
-      src[i++] = ldap_buf;
-      ldap_memfree(api.ldapai_vendor_name);
-      ber_memvfree((void **)api.ldapai_extensions);
-    }
-  }
+#ifdef HAVE_GSSAPI
+#ifdef HAVE_GSSGNU
+  curl_msnprintf(gss_buf, sizeof(gss_buf), "libgss/%s", GSS_VERSION);
+#elif defined(CURL_KRB5_VERSION)
+  curl_msnprintf(gss_buf, sizeof(gss_buf), "mit-krb5/%s", CURL_KRB5_VERSION);
+#else
+  curl_msnprintf(gss_buf, sizeof(gss_buf), "mit-krb5");
+#endif
+  src[i++] = gss_buf;
+#endif /* HAVE_GSSAPI */
+#ifndef CURL_DISABLE_LDAP
+  Curl_ldap_version(ldap_buf, sizeof(ldap_buf));
+  src[i++] = ldap_buf;
 #endif
 
   DEBUGASSERT(i <= VERSION_PARTS);
@@ -334,38 +319,31 @@ static const char * const supported_protocols[] = {
 #ifndef CURL_DISABLE_LDAP
   "ldap",
 #if !defined(CURL_DISABLE_LDAPS) && \
-    ((defined(USE_OPENLDAP) && defined(USE_SSL)) || \
-     (!defined(USE_OPENLDAP) && defined(HAVE_LDAP_SSL)))
+  ((defined(USE_OPENLDAP) && defined(USE_SSL)) || \
+   (!defined(USE_OPENLDAP) && defined(HAVE_LDAP_SSL)))
   "ldaps",
 #endif
 #endif
 #ifndef CURL_DISABLE_MQTT
   "mqtt",
 #endif
+#if defined(USE_SSL) && !defined(CURL_DISABLE_MQTT)
+  "mqtts",
+#endif
 #ifndef CURL_DISABLE_POP3
   "pop3",
 #endif
 #if defined(USE_SSL) && !defined(CURL_DISABLE_POP3)
   "pop3s",
 #endif
-#ifdef USE_LIBRTMP
-  "rtmp",
-  "rtmpe",
-  "rtmps",
-  "rtmpt",
-  "rtmpte",
-  "rtmpts",
-#endif
 #ifndef CURL_DISABLE_RTSP
   "rtsp",
 #endif
-#if defined(USE_SSH) && !defined(USE_WOLFSSH)
-  "scp",
-#endif
 #ifdef USE_SSH
+  "scp",
   "sftp",
 #endif
-#if !defined(CURL_DISABLE_SMB) && defined(USE_CURL_NTLM_CORE)
+#if defined(CURL_ENABLE_SMB) && defined(USE_CURL_NTLM_CORE)
   "smb",
 #  ifdef USE_SSL
   "smbs",
@@ -383,40 +361,55 @@ static const char * const supported_protocols[] = {
 #ifndef CURL_DISABLE_TFTP
   "tftp",
 #endif
-#ifdef USE_WEBSOCKETS
+#ifndef CURL_DISABLE_HTTP
+  /* WebSocket support relies on HTTP */
+#ifndef CURL_DISABLE_WEBSOCKETS
   "ws",
 #endif
-#if defined(USE_SSL) && defined(USE_WEBSOCKETS)
+#if defined(USE_SSL) && !defined(CURL_DISABLE_WEBSOCKETS)
   "wss",
+#endif
 #endif
 
   NULL
 };
 
 /*
- * Feature presence run-time check functions.
+ * Feature presence runtime check functions.
  *
  * Warning: the value returned by these should not change between
  * curl_global_init() and curl_global_cleanup() calls.
  */
 
-#if defined(USE_LIBIDN2)
+#if defined(USE_LIBIDN2) || defined(USE_WIN32_IDN) || defined(USE_APPLE_IDN)
 static int idn_present(curl_version_info_data *info)
 {
-  return info->libidn != NULL;
-}
+#if defined(USE_WIN32_IDN) || defined(USE_APPLE_IDN)
+  (void)info;
+  return TRUE;
 #else
-#define idn_present     NULL
+  return !!info->libidn;
+#endif
+}
 #endif
 
-#if defined(USE_SSL) && !defined(CURL_DISABLE_PROXY)
+#if defined(USE_SSL) && !defined(CURL_DISABLE_PROXY) && \
+  !defined(CURL_DISABLE_HTTP)
 static int https_proxy_present(curl_version_info_data *info)
 {
-  (void) info;
+  (void)info;
   return Curl_ssl_supports(NULL, SSLSUPP_HTTPS_PROXY);
 }
 #endif
 
+#if defined(USE_SSL) && defined(USE_ECH)
+static int ech_present(curl_version_info_data *info)
+{
+  (void)info;
+  return Curl_ssl_supports(NULL, SSLSUPP_ECH);
+}
+#endif
+
 /*
  * Features table.
  *
@@ -424,7 +417,7 @@ static int https_proxy_present(curl_version_info_data *info)
  * Use FEATURE() macro to define an entry: this allows documentation check.
  */
 
-#define FEATURE(name, present, bitmask) {(name), (present), (bitmask)}
+#define FEATURE(name, present, bitmask) { (name), (present), (bitmask) }
 
 struct feat {
   const char *name;
@@ -436,6 +429,9 @@ static const struct feat features_table[] = {
 #ifndef CURL_DISABLE_ALTSVC
   FEATURE("alt-svc",     NULL,                CURL_VERSION_ALTSVC),
 #endif
+#if defined(USE_ARES) && defined(USE_RESOLV_THREADED) && defined(USE_HTTPSRR)
+  FEATURE("asyn-rr",     NULL,                0),
+#endif
 #ifdef CURLRES_ASYNCH
   FEATURE("AsynchDNS",   NULL,                CURL_VERSION_ASYNCHDNS),
 #endif
@@ -445,6 +441,13 @@ static const struct feat features_table[] = {
 #ifdef DEBUGBUILD
   FEATURE("Debug",       NULL,                CURL_VERSION_DEBUG),
 #endif
+#if defined(USE_SSL) && defined(USE_ECH)
+  FEATURE("ECH",         ech_present,         0),
+
+#ifndef USE_HTTPSRR
+#error "ECH enabled but not HTTPSRR, must be a config error"
+#endif
+#endif
 #ifdef USE_GSASL
   FEATURE("gsasl",       NULL,                CURL_VERSION_GSASL),
 #endif
@@ -454,26 +457,29 @@ static const struct feat features_table[] = {
 #ifndef CURL_DISABLE_HSTS
   FEATURE("HSTS",        NULL,                CURL_VERSION_HSTS),
 #endif
-#if defined(USE_NGHTTP2) || defined(USE_HYPER)
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_NGHTTP2)
   FEATURE("HTTP2",       NULL,                CURL_VERSION_HTTP2),
 #endif
-#if defined(ENABLE_QUIC)
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_HTTP3)
   FEATURE("HTTP3",       NULL,                CURL_VERSION_HTTP3),
 #endif
-#if defined(USE_SSL) && !defined(CURL_DISABLE_PROXY)
+#if defined(USE_SSL) && !defined(CURL_DISABLE_PROXY) && \
+  !defined(CURL_DISABLE_HTTP)
   FEATURE("HTTPS-proxy", https_proxy_present, CURL_VERSION_HTTPS_PROXY),
 #endif
-#if defined(USE_LIBIDN2) || defined(USE_WIN32_IDN)
+#ifdef USE_HTTPSRR
+  FEATURE("HTTPSRR",     NULL,                0),
+#endif
+#if defined(USE_LIBIDN2) || defined(USE_WIN32_IDN) || defined(USE_APPLE_IDN)
   FEATURE("IDN",         idn_present,         CURL_VERSION_IDN),
 #endif
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
   FEATURE("IPv6",        NULL,                CURL_VERSION_IPV6),
 #endif
 #ifdef USE_KERBEROS5
   FEATURE("Kerberos",    NULL,                CURL_VERSION_KERBEROS5),
 #endif
-#if (SIZEOF_CURL_OFF_T > 4) && \
-    ( (SIZEOF_OFF_T > 4) || defined(USE_WIN32_LARGE_FILES) )
+#if (SIZEOF_CURL_OFF_T > 4) && ((SIZEOF_OFF_T > 4) || defined(_WIN32))
   FEATURE("Largefile",   NULL,                CURL_VERSION_LARGEFILE),
 #endif
 #ifdef HAVE_LIBZ
@@ -485,19 +491,28 @@ static const struct feat features_table[] = {
 #ifdef USE_NTLM
   FEATURE("NTLM",        NULL,                CURL_VERSION_NTLM),
 #endif
-#if !defined(CURL_DISABLE_HTTP) && defined(USE_NTLM) && \
-  defined(NTLM_WB_ENABLED)
-  FEATURE("NTLM_WB",     NULL,                CURL_VERSION_NTLM_WB),
+#ifdef USE_PROXY_HTTP3
+  FEATURE("proxy-HTTP3", NULL,                0),
 #endif
-#if defined(USE_LIBPSL)
+#ifdef USE_LIBPSL
   FEATURE("PSL",         NULL,                CURL_VERSION_PSL),
 #endif
+#ifdef USE_SSL
+#ifdef USE_APPLE_SECTRUST
+  FEATURE("AppleSecTrust", NULL,              0),
+#elif defined(CURL_CA_NATIVE)
+  FEATURE("NativeCA",    NULL,              0),
+#endif
+#endif /* USE_SSL */
 #ifdef USE_SPNEGO
   FEATURE("SPNEGO",      NULL,                CURL_VERSION_SPNEGO),
 #endif
 #ifdef USE_SSL
   FEATURE("SSL",         NULL,                CURL_VERSION_SSL),
 #endif
+#ifdef USE_SSLS_EXPORT
+  FEATURE("SSLS-EXPORT", NULL,                0),
+#endif
 #ifdef USE_WINDOWS_SSPI
   FEATURE("SSPI",        NULL,                CURL_VERSION_SSPI),
 #endif
@@ -507,10 +522,7 @@ static const struct feat features_table[] = {
 #ifdef USE_TLS_SRP
   FEATURE("TLS-SRP",     NULL,                CURL_VERSION_TLSAUTH_SRP),
 #endif
-#ifdef CURLDEBUG
-  FEATURE("TrackMemory", NULL,                CURL_VERSION_CURLDEBUG),
-#endif
-#if defined(WIN32) && defined(UNICODE) && defined(_UNICODE)
+#if defined(_WIN32) && defined(UNICODE) && defined(_UNICODE)
   FEATURE("Unicode",     NULL,                CURL_VERSION_UNICODE),
 #endif
 #ifdef USE_UNIX_SOCKETS
@@ -519,19 +531,17 @@ static const struct feat features_table[] = {
 #ifdef HAVE_ZSTD
   FEATURE("zstd",        NULL,                CURL_VERSION_ZSTD),
 #endif
-  {NULL,             NULL,                0}
+  {NULL,                 NULL,                0}
 };
 
-static const char *feature_names[sizeof(features_table) /
-                                 sizeof(features_table[0])] = {NULL};
-
+static const char *feature_names[CURL_ARRAYSIZE(features_table)] = { NULL };
 
 static curl_version_info_data version_info = {
   CURLVERSION_NOW,
   LIBCURL_VERSION,
   LIBCURL_VERSION_NUM,
-  OS,   /* as found by configure or set by hand at build-time */
-  0,    /* features bitmask is built at run-time */
+  CURL_OS, /* as found by configure or set by hand at build-time */
+  0,    /* features bitmask is built at runtime */
   NULL, /* ssl_version */
   0,    /* ssl_version_num, this is kept at zero */
   NULL, /* zlib_version */
@@ -560,7 +570,8 @@ static curl_version_info_data version_info = {
   NULL, /* zstd version */
   NULL, /* Hyper version */
   NULL, /* gsasl version */
-  feature_names
+  feature_names,
+  NULL  /* rtmp version */
 };
 
 curl_version_info_data *curl_version_info(CURLversion stamp)
@@ -569,8 +580,8 @@ curl_version_info_data *curl_version_info(CURLversion stamp)
   const struct feat *p;
   int features = 0;
 
-#if defined(USE_SSH)
-  static char ssh_buffer[80];
+#ifdef USE_SSH
+  static char ssh_buf[80];  /* 'ssh_buffer' clashes with libssh/libssh.h */
 #endif
 #ifdef USE_SSL
 #ifdef CURL_WITH_MULTI_SSL
@@ -586,7 +597,7 @@ curl_version_info_data *curl_version_info(CURLversion stamp)
   static char zstd_buffer[80];
 #endif
 
-  (void)stamp; /* avoid compiler warnings, we don't use this */
+  (void)stamp;
 
 #ifdef USE_SSL
   Curl_ssl_version(ssl_buffer, sizeof(ssl_buffer));
@@ -610,9 +621,9 @@ curl_version_info_data *curl_version_info(CURLversion stamp)
   version_info.libidn = idn2_check_version(IDN2_VERSION);
 #endif
 
-#if defined(USE_SSH)
-  Curl_ssh_version(ssh_buffer, sizeof(ssh_buffer));
-  version_info.libssh_version = ssh_buffer;
+#ifdef USE_SSH
+  Curl_ssh_version(ssh_buf, sizeof(ssh_buf));
+  version_info.libssh_version = ssh_buf;
 #endif
 
 #ifdef HAVE_BROTLI
@@ -622,7 +633,7 @@ curl_version_info_data *curl_version_info(CURLversion stamp)
 #endif
 
 #ifdef HAVE_ZSTD
-  version_info.zstd_ver_num = (unsigned int)ZSTD_versionNumber();
+  version_info.zstd_ver_num = ZSTD_versionNumber();
   zstd_version(zstd_buffer, sizeof(zstd_buffer));
   version_info.zstd_version = zstd_buffer;
 #endif
@@ -630,12 +641,12 @@ curl_version_info_data *curl_version_info(CURLversion stamp)
 #ifdef USE_NGHTTP2
   {
     nghttp2_info *h2 = nghttp2_version(0);
-    version_info.nghttp2_ver_num = h2->version_num;
+    version_info.nghttp2_ver_num = (unsigned int)h2->version_num;
     version_info.nghttp2_version = h2->version_str;
   }
 #endif
 
-#ifdef ENABLE_QUIC
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_HTTP3)
   {
     static char quicbuffer[80];
     Curl_quic_ver(quicbuffer, sizeof(quicbuffer));
@@ -643,14 +654,6 @@ curl_version_info_data *curl_version_info(CURLversion stamp)
   }
 #endif
 
-#ifdef USE_HYPER
-  {
-    static char hyper_buffer[30];
-    msnprintf(hyper_buffer, sizeof(hyper_buffer), "Hyper/%s", hyper_version());
-    version_info.hyper_version = hyper_buffer;
-  }
-#endif
-
 #ifdef USE_GSASL
   {
     version_info.gsasl_version = gsasl_check_version(NULL);
@@ -665,6 +668,10 @@ curl_version_info_data *curl_version_info(CURLversion stamp)
       feature_names[n++] = p->name;
     }
 
+#ifdef DEBUGBUILD
+  features |= CURL_VERSION_CURLDEBUG; /* for compatibility */
+#endif
+
   feature_names[n] = NULL;  /* Terminate array. */
   version_info.features = features;
 
diff --git a/third-party/curl/lib/version_win32.c b/third-party/curl/lib/version_win32.c
deleted file mode 100644
index 872d5b4f3c..0000000000
--- a/third-party/curl/lib/version_win32.c
+++ /dev/null
@@ -1,319 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Steve Holme, <steve_holme@hotmail.com>.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#if defined(WIN32)
-
-#include <curl/curl.h>
-#include "version_win32.h"
-#include "warnless.h"
-
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
-
-/* This Unicode version struct works for VerifyVersionInfoW (OSVERSIONINFOEXW)
-   and RtlVerifyVersionInfo (RTLOSVERSIONINFOEXW) */
-struct OUR_OSVERSIONINFOEXW {
-  ULONG  dwOSVersionInfoSize;
-  ULONG  dwMajorVersion;
-  ULONG  dwMinorVersion;
-  ULONG  dwBuildNumber;
-  ULONG  dwPlatformId;
-  WCHAR  szCSDVersion[128];
-  USHORT wServicePackMajor;
-  USHORT wServicePackMinor;
-  USHORT wSuiteMask;
-  UCHAR  wProductType;
-  UCHAR  wReserved;
-};
-
-/*
- * curlx_verify_windows_version()
- *
- * This is used to verify if we are running on a specific windows version.
- *
- * Parameters:
- *
- * majorVersion [in] - The major version number.
- * minorVersion [in] - The minor version number.
- * buildVersion [in] - The build version number. If 0, this parameter is
- *                     ignored.
- * platform     [in] - The optional platform identifier.
- * condition    [in] - The test condition used to specifier whether we are
- *                     checking a version less then, equal to or greater than
- *                     what is specified in the major and minor version
- *                     numbers.
- *
- * Returns TRUE if matched; otherwise FALSE.
- */
-bool curlx_verify_windows_version(const unsigned int majorVersion,
-                                  const unsigned int minorVersion,
-                                  const unsigned int buildVersion,
-                                  const PlatformIdentifier platform,
-                                  const VersionCondition condition)
-{
-  bool matched = FALSE;
-
-#if defined(CURL_WINDOWS_APP)
-  (void)buildVersion;
-
-  /* We have no way to determine the Windows version from Windows apps,
-     so let's assume we're running on the target Windows version. */
-  const WORD fullVersion = MAKEWORD(minorVersion, majorVersion);
-  const WORD targetVersion = (WORD)_WIN32_WINNT;
-
-  switch(condition) {
-  case VERSION_LESS_THAN:
-    matched = targetVersion < fullVersion;
-    break;
-
-  case VERSION_LESS_THAN_EQUAL:
-    matched = targetVersion <= fullVersion;
-    break;
-
-  case VERSION_EQUAL:
-    matched = targetVersion == fullVersion;
-    break;
-
-  case VERSION_GREATER_THAN_EQUAL:
-    matched = targetVersion >= fullVersion;
-    break;
-
-  case VERSION_GREATER_THAN:
-    matched = targetVersion > fullVersion;
-    break;
-  }
-
-  if(matched && (platform == PLATFORM_WINDOWS)) {
-    /* we're always running on PLATFORM_WINNT */
-    matched = FALSE;
-  }
-#elif !defined(_WIN32_WINNT) || !defined(_WIN32_WINNT_WIN2K) || \
-    (_WIN32_WINNT < _WIN32_WINNT_WIN2K)
-  OSVERSIONINFO osver;
-
-  memset(&osver, 0, sizeof(osver));
-  osver.dwOSVersionInfoSize = sizeof(osver);
-
-  /* Find out Windows version */
-  if(GetVersionEx(&osver)) {
-    /* Verify the Operating System version number */
-    switch(condition) {
-    case VERSION_LESS_THAN:
-      if(osver.dwMajorVersion < majorVersion ||
-        (osver.dwMajorVersion == majorVersion &&
-         osver.dwMinorVersion < minorVersion) ||
-        (buildVersion != 0 &&
-         (osver.dwMajorVersion == majorVersion &&
-          osver.dwMinorVersion == minorVersion &&
-          osver.dwBuildNumber < buildVersion)))
-        matched = TRUE;
-      break;
-
-    case VERSION_LESS_THAN_EQUAL:
-      if(osver.dwMajorVersion < majorVersion ||
-        (osver.dwMajorVersion == majorVersion &&
-         osver.dwMinorVersion < minorVersion) ||
-        (osver.dwMajorVersion == majorVersion &&
-         osver.dwMinorVersion == minorVersion &&
-         (buildVersion == 0 ||
-          osver.dwBuildNumber <= buildVersion)))
-        matched = TRUE;
-      break;
-
-    case VERSION_EQUAL:
-      if(osver.dwMajorVersion == majorVersion &&
-         osver.dwMinorVersion == minorVersion &&
-        (buildVersion == 0 ||
-         osver.dwBuildNumber == buildVersion))
-        matched = TRUE;
-      break;
-
-    case VERSION_GREATER_THAN_EQUAL:
-      if(osver.dwMajorVersion > majorVersion ||
-        (osver.dwMajorVersion == majorVersion &&
-         osver.dwMinorVersion > minorVersion) ||
-        (osver.dwMajorVersion == majorVersion &&
-         osver.dwMinorVersion == minorVersion &&
-         (buildVersion == 0 ||
-          osver.dwBuildNumber >= buildVersion)))
-        matched = TRUE;
-      break;
-
-    case VERSION_GREATER_THAN:
-      if(osver.dwMajorVersion > majorVersion ||
-        (osver.dwMajorVersion == majorVersion &&
-         osver.dwMinorVersion > minorVersion) ||
-        (buildVersion != 0 &&
-         (osver.dwMajorVersion == majorVersion &&
-          osver.dwMinorVersion == minorVersion &&
-          osver.dwBuildNumber > buildVersion)))
-        matched = TRUE;
-      break;
-    }
-
-    /* Verify the platform identifier (if necessary) */
-    if(matched) {
-      switch(platform) {
-      case PLATFORM_WINDOWS:
-        if(osver.dwPlatformId != VER_PLATFORM_WIN32_WINDOWS)
-          matched = FALSE;
-        break;
-
-      case PLATFORM_WINNT:
-        if(osver.dwPlatformId != VER_PLATFORM_WIN32_NT)
-          matched = FALSE;
-        break;
-
-      default: /* like platform == PLATFORM_DONT_CARE */
-        break;
-      }
-    }
-  }
-#else
-  ULONGLONG cm = 0;
-  struct OUR_OSVERSIONINFOEXW osver;
-  BYTE majorCondition;
-  BYTE minorCondition;
-  BYTE buildCondition;
-  BYTE spMajorCondition;
-  BYTE spMinorCondition;
-  DWORD dwTypeMask = VER_MAJORVERSION | VER_MINORVERSION |
-                     VER_SERVICEPACKMAJOR | VER_SERVICEPACKMINOR;
-
-  typedef LONG (APIENTRY *RTLVERIFYVERSIONINFO_FN)
-    (struct OUR_OSVERSIONINFOEXW *, ULONG, ULONGLONG);
-  static RTLVERIFYVERSIONINFO_FN pRtlVerifyVersionInfo;
-  static bool onetime = true; /* safe because first call is during init */
-
-  if(onetime) {
-    pRtlVerifyVersionInfo = CURLX_FUNCTION_CAST(RTLVERIFYVERSIONINFO_FN,
-      (GetProcAddress(GetModuleHandleA("ntdll"), "RtlVerifyVersionInfo")));
-    onetime = false;
-  }
-
-  switch(condition) {
-  case VERSION_LESS_THAN:
-    majorCondition = VER_LESS;
-    minorCondition = VER_LESS;
-    buildCondition = VER_LESS;
-    spMajorCondition = VER_LESS_EQUAL;
-    spMinorCondition = VER_LESS_EQUAL;
-    break;
-
-  case VERSION_LESS_THAN_EQUAL:
-    majorCondition = VER_LESS_EQUAL;
-    minorCondition = VER_LESS_EQUAL;
-    buildCondition = VER_LESS_EQUAL;
-    spMajorCondition = VER_LESS_EQUAL;
-    spMinorCondition = VER_LESS_EQUAL;
-    break;
-
-  case VERSION_EQUAL:
-    majorCondition = VER_EQUAL;
-    minorCondition = VER_EQUAL;
-    buildCondition = VER_EQUAL;
-    spMajorCondition = VER_GREATER_EQUAL;
-    spMinorCondition = VER_GREATER_EQUAL;
-    break;
-
-  case VERSION_GREATER_THAN_EQUAL:
-    majorCondition = VER_GREATER_EQUAL;
-    minorCondition = VER_GREATER_EQUAL;
-    buildCondition = VER_GREATER_EQUAL;
-    spMajorCondition = VER_GREATER_EQUAL;
-    spMinorCondition = VER_GREATER_EQUAL;
-    break;
-
-  case VERSION_GREATER_THAN:
-    majorCondition = VER_GREATER;
-    minorCondition = VER_GREATER;
-    buildCondition = VER_GREATER;
-    spMajorCondition = VER_GREATER_EQUAL;
-    spMinorCondition = VER_GREATER_EQUAL;
-    break;
-
-  default:
-    return FALSE;
-  }
-
-  memset(&osver, 0, sizeof(osver));
-  osver.dwOSVersionInfoSize = sizeof(osver);
-  osver.dwMajorVersion = majorVersion;
-  osver.dwMinorVersion = minorVersion;
-  osver.dwBuildNumber = buildVersion;
-  if(platform == PLATFORM_WINDOWS)
-    osver.dwPlatformId = VER_PLATFORM_WIN32_WINDOWS;
-  else if(platform == PLATFORM_WINNT)
-    osver.dwPlatformId = VER_PLATFORM_WIN32_NT;
-
-  cm = VerSetConditionMask(cm, VER_MAJORVERSION, majorCondition);
-  cm = VerSetConditionMask(cm, VER_MINORVERSION, minorCondition);
-  cm = VerSetConditionMask(cm, VER_SERVICEPACKMAJOR, spMajorCondition);
-  cm = VerSetConditionMask(cm, VER_SERVICEPACKMINOR, spMinorCondition);
-
-  if(platform != PLATFORM_DONT_CARE) {
-    cm = VerSetConditionMask(cm, VER_PLATFORMID, VER_EQUAL);
-    dwTypeMask |= VER_PLATFORMID;
-  }
-
-  /* Later versions of Windows have version functions that may not return the
-     real version of Windows unless the application is so manifested. We prefer
-     the real version always, so we use the Rtl variant of the function when
-     possible. Note though the function signatures have underlying fundamental
-     types that are the same, the return values are different. */
-  if(pRtlVerifyVersionInfo)
-    matched = !pRtlVerifyVersionInfo(&osver, dwTypeMask, cm);
-  else
-    matched = !!VerifyVersionInfoW((OSVERSIONINFOEXW *)&osver, dwTypeMask, cm);
-
-  /* Compare the build number separately. VerifyVersionInfo normally compares
-     major.minor in hierarchical order (eg 1.9 is less than 2.0) but does not
-     do the same for build (eg 1.9 build 222 is not less than 2.0 build 111).
-     Build comparison is only needed when build numbers are equal (eg 1.9 is
-     always less than 2.0 so build comparison is not needed). */
-  if(matched && buildVersion &&
-     (condition == VERSION_EQUAL ||
-      ((condition == VERSION_GREATER_THAN_EQUAL ||
-        condition == VERSION_LESS_THAN_EQUAL) &&
-        curlx_verify_windows_version(majorVersion, minorVersion, 0,
-                                     platform, VERSION_EQUAL)))) {
-
-    cm = VerSetConditionMask(0, VER_BUILDNUMBER, buildCondition);
-    dwTypeMask = VER_BUILDNUMBER;
-    if(pRtlVerifyVersionInfo)
-      matched = !pRtlVerifyVersionInfo(&osver, dwTypeMask, cm);
-    else
-      matched = !!VerifyVersionInfoW((OSVERSIONINFOEXW *)&osver,
-                                      dwTypeMask, cm);
-  }
-
-#endif
-
-  return matched;
-}
-
-#endif /* WIN32 */
diff --git a/third-party/curl/lib/vquic/capsule.c b/third-party/curl/lib/vquic/capsule.c
new file mode 100644
index 0000000000..4bbdae3ace
--- /dev/null
+++ b/third-party/curl/lib/vquic/capsule.c
@@ -0,0 +1,301 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+#include "curl_setup.h"
+
+#if !defined(CURL_DISABLE_PROXY) && !defined(CURL_DISABLE_HTTP)
+
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>  /* for htons() */
+#endif
+
+#include <curl/curl.h>
+#include "urldata.h"
+#include "curlx/dynbuf.h"
+#include "cfilters.h"
+#include "curl_trc.h"
+#include "bufq.h"
+#include "vquic/capsule.h"
+
+
+/**
+ * Convert 64-bit value from network byte order to host byte order
+ */
+static uint64_t capsule_ntohll(uint64_t value)
+{
+#if defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__)
+  return value;
+#elif (defined(__GNUC__) || defined(__clang__)) && \
+  defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)
+  return __builtin_bswap64(value);
+#else
+  union {
+    uint64_t u64;
+    uint32_t u32[2];
+  } src, dst;
+
+  src.u64 = value;
+  dst.u32[0] = ntohl(src.u32[1]);
+  dst.u32[1] = ntohl(src.u32[0]);
+  return dst.u64;
+#endif
+}
+
+/**
+ * Encode a variable-length integer into a plain buffer.
+ * @param buf   Output buffer (must have at least 8 bytes)
+ * @param value Value to encode (must be <= 0x3FFFFFFFFFFFFFFF)
+ * @return Number of bytes written
+ */
+static size_t capsule_encode_varint_buf(uint8_t *buf, uint64_t value)
+{
+  DEBUGASSERT(value <= 0x3FFFFFFFFFFFFFFF);
+
+  if(value <= 0x3F) {
+    buf[0] = (uint8_t)value;
+    return 1;
+  }
+  else if(value <= 0x3FFF) {
+    uint16_t encoded = (uint16_t)value & 0x3FFF;
+    encoded = ntohs(encoded | 0x4000);
+    memcpy(buf, &encoded, 2);
+    return 2;
+  }
+  else if(value <= 0x3FFFFFFF) {
+    uint32_t encoded = (uint32_t)value & 0x3FFFFFFF;
+    encoded = ntohl(encoded | 0x80000000);
+    memcpy(buf, &encoded, 4);
+    return 4;
+  }
+  else {
+    uint64_t encoded = (uint64_t)value & 0x3FFFFFFFFFFFFFFF;
+    encoded = capsule_ntohll(encoded | 0xC000000000000000);
+    memcpy(buf, &encoded, 8);
+    return 8;
+  }
+}
+
+static CURLcode capsule_peek_u8(struct bufq *recvbufq,
+                                size_t offset,
+                                uint8_t *pbyte)
+{
+  const unsigned char *peek = NULL;
+  size_t peeklen = 0;
+
+  if(!Curl_bufq_peek_at(recvbufq, offset, &peek, &peeklen) || !peeklen)
+    return CURLE_AGAIN;
+  *pbyte = peek[0];
+  return CURLE_OK;
+}
+
+static CURLcode capsule_decode_varint_at(struct bufq *recvbufq,
+                                         size_t offset,
+                                         uint64_t *pvalue,
+                                         size_t *pconsumed)
+{
+  uint8_t first_byte, byte;
+  uint64_t value;
+  size_t nbytes;
+  size_t i;
+  CURLcode result;
+
+  result = capsule_peek_u8(recvbufq, offset, &first_byte);
+  if(result)
+    return result;
+
+  nbytes = (size_t)1 << (first_byte >> 6); /* 1, 2, 4 or 8 bytes */
+  value = first_byte & 0x3F;
+
+  for(i = 1; i < nbytes; ++i) {
+    result = capsule_peek_u8(recvbufq, offset + i, &byte);
+    if(result)
+      return result;
+    value = (value << 8) | byte;
+  }
+
+  *pvalue = value;
+  *pconsumed = nbytes;
+  return CURLE_OK;
+}
+
+/**
+ * Write the capsule header (type + varint length + context ID) into `hdr`.
+ * @param hdr         Output buffer (must be >= HTTP_CAPSULE_HEADER_MAX_SIZE)
+ * @param hdrlen      Size of `hdr` in bytes
+ * @param payload_len Length of the UDP payload that follows
+ * @return Number of header bytes written, or 0 on error
+ *
+ * @unittest 3400
+ */
+UNITTEST size_t capsule_encap_udp_hdr(uint8_t *hdr, size_t hdrlen,
+                                      size_t payload_len);
+UNITTEST size_t capsule_encap_udp_hdr(uint8_t *hdr, size_t hdrlen,
+                                      size_t payload_len)
+{
+  size_t off = 0;
+  DEBUGASSERT(hdrlen >= HTTP_CAPSULE_HEADER_MAX_SIZE);
+  if(hdrlen < HTTP_CAPSULE_HEADER_MAX_SIZE)
+    return 0;
+  hdr[off++] = 0; /* capsule type: HTTP Datagram */
+  off += capsule_encode_varint_buf(hdr + off, (uint64_t)payload_len + 1);
+  hdr[off++] = 0; /* context ID */
+  return off;
+}
+
+CURLcode Curl_capsule_encap_udp_datagram(struct bufq *q,
+                                         const void *buf, size_t blen)
+{
+  CURLcode result;
+  uint8_t hdr[HTTP_CAPSULE_HEADER_MAX_SIZE];
+  size_t hdr_len, nwritten;
+
+  hdr_len = capsule_encap_udp_hdr(hdr, sizeof(hdr), blen);
+  DEBUGASSERT(hdr_len);
+  if(!hdr_len)
+    return CURLE_FAILED_INIT;
+
+  result = Curl_bufq_write(q, hdr, hdr_len, &nwritten);
+  if(!result && (nwritten != hdr_len))
+    return CURLE_WRITE_ERROR;
+  if(!result) {
+    result = Curl_bufq_write(q, buf, blen, &nwritten);
+    if(!result && (nwritten != blen))
+      return CURLE_WRITE_ERROR;
+  }
+  if(result == CURLE_AGAIN)
+    return CURLE_WRITE_ERROR;
+  return result;
+}
+
+size_t Curl_capsule_process_udp_raw(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    struct bufq *recvbufq,
+                                    unsigned char *buf, size_t len,
+                                    CURLcode *err)
+{
+  const unsigned char *context_id, *capsule_type;
+  size_t read_size, varint_len;
+  uint64_t capsule_length;
+  size_t offset, payload_len;
+  size_t bytes_read = 0;
+  CURLcode result = CURLE_OK;
+
+  if(!len) {
+    *err = CURLE_BAD_FUNCTION_ARGUMENT;
+    return 0;
+  }
+
+  if(Curl_bufq_is_empty(recvbufq)) {
+    *err = CURLE_AGAIN;
+    return 0;
+  }
+
+  if(!Curl_bufq_peek(recvbufq, &capsule_type, &read_size) || !read_size) {
+    *err = CURLE_AGAIN;
+    return 0;
+  }
+
+  if(capsule_type[0]) {
+    infof(data, "Error! Invalid capsule type: %d", capsule_type[0]);
+    Curl_bufq_skip(recvbufq, 1);
+    *err = CURLE_RECV_ERROR;
+    return 0;
+  }
+
+  offset = 1;
+  result = capsule_decode_varint_at(recvbufq, offset, &capsule_length,
+                                    &varint_len);
+  if(result == CURLE_AGAIN) {
+    *err = CURLE_AGAIN;
+    return 0;
+  }
+  else if(result) {
+    *err = CURLE_RECV_ERROR;
+    return 0;
+  }
+  offset += varint_len;
+
+  if(!Curl_bufq_peek_at(recvbufq, offset, &context_id, &read_size) ||
+     !read_size) {
+    *err = CURLE_AGAIN;
+    return 0;
+  }
+
+  if(*context_id) {
+    infof(data, "Error! Invalid context ID: %02x", *context_id);
+    Curl_bufq_skip(recvbufq, offset + 1);
+    *err = CURLE_RECV_ERROR;
+    return 0;
+  }
+  offset += 1;
+
+  if(!capsule_length) {
+    infof(data, "Error! Invalid capsule length: 0");
+    Curl_bufq_skip(recvbufq, offset);
+    *err = CURLE_RECV_ERROR;
+    return 0;
+  }
+  if(capsule_length - 1 >= (uint64_t)SIZE_MAX) {
+    infof(data, "Error! Capsule length too large: %" CURL_FORMAT_CURL_OFF_T,
+          (curl_off_t)capsule_length);
+    *err = CURLE_RECV_ERROR;
+    return 0;
+  }
+  payload_len = (size_t)(capsule_length - 1);
+
+  if(Curl_bufq_len(recvbufq) < offset + payload_len) {
+    *err = CURLE_AGAIN;
+    return 0;
+  }
+
+  if(payload_len > len) {
+    infof(data, "UDP payload does not fit destination buffer: %zu > %zu",
+          payload_len, len);
+    Curl_bufq_skip(recvbufq, offset + payload_len);
+    *err = CURLE_RECV_ERROR;
+    return 0;
+  }
+
+  Curl_bufq_skip(recvbufq, offset);
+  if(!payload_len) {
+    *err = CURLE_OK;
+    return 0;
+  }
+  result = Curl_bufq_read(recvbufq, buf, payload_len, &bytes_read);
+  if(result || (bytes_read != payload_len)) {
+    infof(data, "Error! Read less than expected %zu %zu",
+          payload_len, bytes_read);
+    *err = CURLE_RECV_ERROR;
+    return 0;
+  }
+
+  if(cf && data) {
+    CURL_TRC_CF(data, cf, "Processed UDP capsule raw: size=%zu "
+                "length_left %zu", payload_len, Curl_bufq_len(recvbufq));
+  }
+  *err = CURLE_OK;
+  return bytes_read;
+}
+
+#endif /* !CURL_DISABLE_PROXY && !CURL_DISABLE_HTTP */
diff --git a/third-party/curl/lib/vquic/capsule.h b/third-party/curl/lib/vquic/capsule.h
new file mode 100644
index 0000000000..7861e6fd73
--- /dev/null
+++ b/third-party/curl/lib/vquic/capsule.h
@@ -0,0 +1,70 @@
+#ifndef HEADER_CURL_CAPSULE_H
+#define HEADER_CURL_CAPSULE_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+#include "curl_setup.h"
+
+#if !defined(CURL_DISABLE_PROXY) && !defined(CURL_DISABLE_HTTP)
+
+#include "curlx/dynbuf.h"
+#include "bufq.h"
+
+/* HTTP Capsule constants */
+#define HTTP_CAPSULE_HEADER_MAX_SIZE    10
+
+/* HTTP Capsule function prototypes */
+
+/**
+ * Encapsulate UDP payload into HTTP Datagram capsule format
+ * @param q     the bufq to write the capsule to
+ * @param buf   Payload buffer
+ * @param blen  Payload buffer length
+ * @return CURLE_OK on success, error code on failure
+ */
+CURLcode Curl_capsule_encap_udp_datagram(struct bufq *q,
+                                         const void *buf, size_t blen);
+
+struct Curl_easy;
+struct Curl_cfilter;
+
+/**
+ * Process one UDP capsule from buffer into raw datagram payload bytes.
+ * @param cf        Connection filter
+ * @param data      Easy handle
+ * @param recvbufq  Buffer queue containing capsule data
+ * @param buf       Output buffer for one datagram payload
+ * @param len       Size of output buffer in bytes
+ * @param err       Error code output
+ * @return Number of payload bytes written. Check `err` for status.
+ */
+size_t Curl_capsule_process_udp_raw(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    struct bufq *recvbufq,
+                                    unsigned char *buf, size_t len,
+                                    CURLcode *err);
+
+#endif /* !CURL_DISABLE_PROXY && !CURL_DISABLE_HTTP */
+
+#endif /* HEADER_CURL_CAPSULE_H */
diff --git a/third-party/curl/lib/vquic/cf-capsule.c b/third-party/curl/lib/vquic/cf-capsule.c
new file mode 100644
index 0000000000..3ff7827bba
--- /dev/null
+++ b/third-party/curl/lib/vquic/cf-capsule.c
@@ -0,0 +1,306 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#if !defined(CURL_DISABLE_PROXY) && !defined(CURL_DISABLE_HTTP)
+
+#include "urldata.h"
+#include "cfilters.h"
+#include "curl_trc.h"
+#include "bufq.h"
+#include "select.h"
+#include "vquic/capsule.h"
+#include "vquic/cf-capsule.h"
+
+/* send/recv buffer: 4 chunks of 16KB = 64KB, enough for large datagrams */
+#define CAPSULE_RECV_CHUNKS    4
+#define CAPSULE_SEND_CHUNKS    4
+#define CAPSULE_CHUNK_SIZE     (16 * 1024)
+
+struct cf_capsule_ctx {
+  struct bufq recvbuf;
+  struct bufq sendbuf;
+};
+
+static void cf_capsule_destroy(struct Curl_cfilter *cf,
+                               struct Curl_easy *data)
+{
+  struct cf_capsule_ctx *ctx = cf->ctx;
+  (void)data;
+  if(ctx) {
+    Curl_bufq_free(&ctx->recvbuf);
+    Curl_bufq_free(&ctx->sendbuf);
+    curlx_safefree(ctx);
+  }
+}
+
+static CURLcode cf_capsule_connect(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data,
+                                   bool *done)
+{
+  if(cf->connected) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+  if(cf->next) {
+    CURLcode result = cf->next->cft->do_connect(cf->next, data, done);
+    if(!result && *done)
+      cf->connected = TRUE;
+    return result;
+  }
+  *done = FALSE;
+  return CURLE_OK;
+}
+
+static CURLcode cf_capsule_flush(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data)
+{
+  struct cf_capsule_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+  size_t nwritten;
+
+  if(Curl_bufq_is_empty(&ctx->sendbuf))
+    return CURLE_OK;
+
+  result = Curl_cf_send_bufq(cf->next, data, &ctx->sendbuf, NULL, 0,
+                             &nwritten);
+  if(result) {
+    if(result == CURLE_AGAIN) {
+      CURL_TRC_CF(data, cf, "flush send buffer(%zu) -> EAGAIN",
+                  Curl_bufq_len(&ctx->sendbuf));
+    }
+    return result;
+  }
+  return Curl_bufq_is_empty(&ctx->sendbuf) ? CURLE_OK : CURLE_AGAIN;
+}
+
+static CURLcode cf_capsule_send(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                const uint8_t *buf, size_t len,
+                                bool eos, size_t *pnwritten)
+{
+  struct cf_capsule_ctx *ctx = cf->ctx;
+  CURLcode result;
+
+  (void)eos;
+  *pnwritten = 0;
+
+  if(Curl_bufq_is_full(&ctx->sendbuf)) {
+    result = cf_capsule_flush(cf, data);
+    if(result)
+      return result;
+  }
+
+  /* encapsulate new payload into a capsule */
+  result = Curl_capsule_encap_udp_datagram(&ctx->sendbuf, buf, len);
+  if(result)
+    return result;
+
+  result = cf_capsule_flush(cf, data);
+  if(result == CURLE_AGAIN) {
+    /* Could not send it (or all), report success nevertheless as we
+     * have the payload buffered now and will flush it later. */
+    result = CURLE_OK;
+  }
+
+  if(!result)
+    *pnwritten = len;
+  return result;
+}
+
+static CURLcode cf_capsule_recv(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                char *buf, size_t len,
+                                size_t *pnread)
+{
+  struct cf_capsule_ctx *ctx = cf->ctx;
+  CURLcode result;
+  size_t nread;
+
+  *pnread = 0;
+
+  /* fill our receive buffer from the filter below */
+  while(!Curl_bufq_is_full(&ctx->recvbuf)) {
+    result = Curl_cf_recv_bufq(cf->next, data, &ctx->recvbuf, 0, &nread);
+    if(result == CURLE_AGAIN)
+      break;
+    if(result)
+      return result;
+    if(!nread)
+      break;
+  }
+
+  /* try to extract a complete capsule datagram */
+  *pnread = Curl_capsule_process_udp_raw(cf, data, &ctx->recvbuf,
+                                         (unsigned char *)buf, len,
+                                         &result);
+  return result;
+}
+
+static bool cf_capsule_data_pending(struct Curl_cfilter *cf,
+                                    const struct Curl_easy *data)
+{
+  struct cf_capsule_ctx *ctx = cf->ctx;
+
+  if(ctx && !Curl_bufq_is_empty(&ctx->recvbuf))
+    return TRUE;
+  return cf->next ? cf->next->cft->has_data_pending(cf->next, data) : FALSE;
+}
+
+static CURLcode cf_capsule_cntrl(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 int event, int arg1, void *arg2)
+{
+  CURLcode result = CURLE_OK;
+
+  (void)arg1;
+  (void)arg2;
+  switch(event) {
+  case CF_CTRL_FLUSH:
+    result = cf_capsule_flush(cf, data);
+    break;
+  default:
+    break;
+  }
+  return result;
+}
+
+static CURLcode cf_capsule_query(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 int query, int *pres1, void *pres2)
+{
+  struct cf_capsule_ctx *ctx = cf->ctx;
+
+  (void)pres2;
+  switch(query) {
+  case CF_QUERY_NEED_FLUSH: {
+    if(!Curl_bufq_is_empty(&ctx->sendbuf)) {
+      *pres1 = TRUE;
+      return CURLE_OK;
+    }
+    break;
+  }
+  default:
+    break;
+  }
+  return cf->next ?
+    cf->next->cft->query(cf->next, data, query, pres1, pres2) :
+    CURLE_UNKNOWN_OPTION;
+}
+
+static CURLcode cf_capsule_adjust_pollset(struct Curl_cfilter *cf,
+                                          struct Curl_easy *data,
+                                          struct easy_pollset *ps)
+{
+  struct cf_capsule_ctx *ctx = cf->ctx;
+
+  if(!Curl_bufq_is_empty(&ctx->sendbuf)) {
+    curl_socket_t sock = Curl_conn_cf_get_socket(cf, data);
+    if(sock != CURL_SOCKET_BAD)
+      return Curl_pollset_add_out(data, ps, sock);
+  }
+  return CURLE_OK;
+}
+
+static CURLcode cf_capsule_shutdown(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data, bool *done)
+{
+  CURLcode result = CURLE_OK;
+
+  if(!cf->connected || cf->shutdown) {
+    *done = TRUE;
+  }
+  else {
+    result = cf_capsule_flush(cf, data);
+    *done = !result;
+    if(result == CURLE_AGAIN)
+      result = CURLE_OK;
+  }
+  return result;
+}
+
+struct Curl_cftype Curl_cft_capsule = {
+  "CAPSULE",
+  0,
+  0,
+  cf_capsule_destroy,
+  cf_capsule_connect,
+  cf_capsule_shutdown,
+  cf_capsule_adjust_pollset,
+  cf_capsule_data_pending,
+  cf_capsule_send,
+  cf_capsule_recv,
+  cf_capsule_cntrl,
+  Curl_cf_def_conn_is_alive,
+  Curl_cf_def_conn_keep_alive,
+  cf_capsule_query,
+};
+
+static CURLcode cf_capsule_create(struct Curl_cfilter **pcf,
+                                  struct Curl_easy *data,
+                                  struct connectdata *conn)
+{
+  struct Curl_cfilter *cf = NULL;
+  struct cf_capsule_ctx *ctx;
+  CURLcode result;
+
+  (void)data;
+  (void)conn;
+  *pcf = NULL;
+  ctx = curlx_calloc(1, sizeof(*ctx));
+  if(!ctx) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  Curl_bufq_init2(&ctx->recvbuf, CAPSULE_CHUNK_SIZE, CAPSULE_RECV_CHUNKS,
+                  BUFQ_OPT_SOFT_LIMIT);
+  Curl_bufq_init2(&ctx->sendbuf, CAPSULE_CHUNK_SIZE, CAPSULE_SEND_CHUNKS,
+                  BUFQ_OPT_SOFT_LIMIT);
+
+  result = Curl_cf_create(&cf, &Curl_cft_capsule, ctx);
+
+out:
+  *pcf = (!result) ? cf : NULL;
+  if(result && ctx) {
+    Curl_bufq_free(&ctx->recvbuf);
+    Curl_bufq_free(&ctx->sendbuf);
+    curlx_free(ctx);
+  }
+  return result;
+}
+
+CURLcode Curl_cf_capsule_insert_after(struct Curl_cfilter *cf_at,
+                                      struct Curl_easy *data)
+{
+  struct Curl_cfilter *cf;
+  CURLcode result;
+
+  result = cf_capsule_create(&cf, data, cf_at->conn);
+  if(!result)
+    Curl_conn_cf_insert_after(cf_at, cf);
+  return result;
+}
+
+#endif /* !CURL_DISABLE_PROXY && !CURL_DISABLE_HTTP */
diff --git a/third-party/curl/lib/vquic/cf-capsule.h b/third-party/curl/lib/vquic/cf-capsule.h
new file mode 100644
index 0000000000..437c9681b6
--- /dev/null
+++ b/third-party/curl/lib/vquic/cf-capsule.h
@@ -0,0 +1,40 @@
+#ifndef HEADER_CURL_CF_CAPSULE_H
+#define HEADER_CURL_CF_CAPSULE_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#if !defined(CURL_DISABLE_PROXY) && !defined(CURL_DISABLE_HTTP)
+
+/* Insert a capsule protocol filter after `cf_at` in the filter chain.
+ * The capsule filter encapsulates/decapsulates UDP datagrams using
+ * the HTTP Datagram capsule format (RFC 9297). */
+CURLcode Curl_cf_capsule_insert_after(struct Curl_cfilter *cf_at,
+                                      struct Curl_easy *data);
+
+extern struct Curl_cftype Curl_cft_capsule;
+
+#endif /* !CURL_DISABLE_PROXY && !CURL_DISABLE_HTTP */
+
+#endif /* HEADER_CURL_CF_CAPSULE_H */
diff --git a/third-party/curl/lib/vquic/cf-ngtcp2-cmn.c b/third-party/curl/lib/vquic/cf-ngtcp2-cmn.c
new file mode 100644
index 0000000000..e1ca18cf69
--- /dev/null
+++ b/third-party/curl/lib/vquic/cf-ngtcp2-cmn.c
@@ -0,0 +1,1969 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_NGTCP2) && defined(USE_NGHTTP3)
+
+#include <ngtcp2/ngtcp2.h>
+
+#ifdef USE_OPENSSL
+#include <openssl/err.h>
+#if defined(OPENSSL_IS_AWSLC) || defined(OPENSSL_IS_BORINGSSL)
+#include <ngtcp2/ngtcp2_crypto_boringssl.h>
+#elif defined(OPENSSL_QUIC_API2)
+#include <ngtcp2/ngtcp2_crypto_ossl.h>
+#else
+#include <ngtcp2/ngtcp2_crypto_quictls.h>
+#endif
+#include "vtls/openssl.h"
+#elif defined(USE_GNUTLS)
+#include <ngtcp2/ngtcp2_crypto_gnutls.h>
+#include "vtls/gtls.h"
+#elif defined(USE_WOLFSSL)
+#include <ngtcp2/ngtcp2_crypto_wolfssl.h>
+#include "vtls/wolfssl.h"
+#endif
+
+#include <nghttp3/nghttp3.h>
+
+#include "urldata.h"
+#include "url.h"
+#include "uint-hash.h"
+#include "curl_trc.h"
+#include "rand.h"
+#include "multiif.h"
+#include "cfilters.h"
+#include "cf-dns.h"
+#include "cf-socket.h"
+#include "connect.h"
+#include "progress.h"
+#include "curlx/fopen.h"
+#include "curlx/dynbuf.h"
+#include "http1.h"
+#include "select.h"
+#include "sockaddr.h"
+#include "transfer.h"
+#include "bufref.h"
+#include "vquic/vquic.h"
+#include "vquic/vquic_int.h"
+#include "vquic/vquic-tls.h"
+#include "vtls/vtls.h"
+#include "vtls/vtls_scache.h"
+#include "vquic/cf-ngtcp2-cmn.h"
+
+/*
+ * Store ngtcp2 version info in this buffer.
+ */
+void Curl_ngtcp2_ver(char *p, size_t len)
+{
+  const ngtcp2_info *ng2 = ngtcp2_version(0);
+  const nghttp3_info *ht3 = nghttp3_version(0);
+  (void)curl_msnprintf(p, len, "ngtcp2/%s nghttp3/%s",
+                       ng2->version_str, ht3->version_str);
+}
+
+void Curl_cf_ngtcp2_h3_stream_ctx_free(struct h3_stream_ctx *stream)
+{
+  Curl_bufq_free(&stream->sendbuf);
+  Curl_h1_req_parse_free(&stream->h1);
+  curlx_free(stream);
+}
+
+static void h3_stream_hash_free(unsigned int id, void *stream)
+{
+  (void)id;
+  DEBUGASSERT(stream);
+  Curl_cf_ngtcp2_h3_stream_ctx_free((struct h3_stream_ctx *)stream);
+}
+
+static bool cf_ngtcp2_h3_err_is_fatal(int code)
+{
+  return (NGHTTP3_ERR_FATAL >= code) ||
+         (NGHTTP3_ERR_H3_CLOSED_CRITICAL_STREAM == code);
+}
+
+void Curl_cf_ngtcp2_h3_err_set(struct Curl_cfilter *cf,
+                               struct Curl_easy *data, int code)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  if(!ctx->last_error.error_code) {
+    ngtcp2_ccerr_set_application_error(&ctx->last_error,
+      nghttp3_err_infer_quic_app_error_code(code), NULL, 0);
+  }
+  if(cf_ngtcp2_h3_err_is_fatal(code))
+    Curl_cf_ngtcp2_cmn_conn_close(cf, data);
+}
+
+CURLcode Curl_cf_ngtcp2_ctx_init(struct cf_ngtcp2_ctx *ctx,
+                                 struct Curl_peer *origin,
+                                 struct Curl_peer *peer,
+                                 struct ssl_primary_config *sslc,
+                                 cf_ngtcp2_init_h3_conn *init_h3_conn_cb)
+{
+  DEBUGASSERT(!ctx->initialized);
+  ctx->qlogfd = -1;
+  ctx->tunnel_inbuf = NULL;
+  ctx->tunnel_inbuf_len = 0;
+  ctx->version = NGTCP2_PROTO_VER_MAX;
+  Curl_bufcp_init(&ctx->stream_bufcp, H3_STREAM_CHUNK_SIZE,
+                  H3_STREAM_POOL_SPARES);
+  curlx_dyn_init(&ctx->scratch, CURL_MAX_HTTP_HEADER);
+  Curl_uint32_hash_init(&ctx->streams, 63, h3_stream_hash_free);
+  ctx->init_h3_conn_cb = init_h3_conn_cb;
+  ctx->initialized = TRUE;
+  return Curl_vquic_tls_peer_init(origin, peer, sslc, &ctx->ssl_peer);
+}
+
+void Curl_cf_ngtcp2_ctx_cleanup(struct cf_ngtcp2_ctx *ctx)
+{
+  if(ctx && ctx->initialized) {
+    Curl_vquic_tls_cleanup(&ctx->tls);
+    vquic_ctx_free(&ctx->q);
+    Curl_bufcp_free(&ctx->stream_bufcp);
+    curlx_dyn_free(&ctx->scratch);
+    Curl_uint32_hash_destroy(&ctx->streams);
+    Curl_ssl_peer_cleanup(&ctx->ssl_peer);
+    curlx_safefree(ctx->tunnel_inbuf);
+    ctx->tunnel_inbuf_len = 0;
+    if(ctx->qlogfd != -1) {
+      curlx_close(ctx->qlogfd);
+      ctx->qlogfd = -1;
+    }
+  }
+}
+
+static ngtcp2_conn *get_conn(ngtcp2_crypto_conn_ref *conn_ref)
+{
+  struct Curl_cfilter *cf = conn_ref->user_data;
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  return ctx->qconn;
+}
+
+#ifdef DEBUG_NGTCP2
+static void quic_printf(void *user_data, const char *fmt, ...)
+{
+  va_list ap;
+  (void)user_data;
+  va_start(ap, fmt);
+  curl_mvfprintf(stderr, fmt, ap);
+  va_end(ap);
+  curl_mfprintf(stderr, "\n");
+}
+#endif
+
+static void qlog_callback(void *user_data, uint32_t flags,
+                          const void *data, size_t datalen)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  (void)flags;
+  if(ctx->qlogfd != -1) {
+    ssize_t rc = write(ctx->qlogfd, data, datalen);
+    if(rc == -1) {
+      /* on write error, stop further write attempts */
+      curlx_close(ctx->qlogfd);
+      ctx->qlogfd = -1;
+    }
+  }
+}
+
+static void quic_settings(struct cf_ngtcp2_ctx *ctx,
+                          struct Curl_easy *data,
+                          struct cf_ngtcp2_io_ctx *pktx)
+{
+  ngtcp2_settings *s = &ctx->settings;
+  ngtcp2_transport_params *t = &ctx->transport_params;
+
+  ngtcp2_settings_default(s);
+  ngtcp2_transport_params_default(t);
+#ifdef DEBUG_NGTCP2
+  s->log_printf = quic_printf;
+#else
+  s->log_printf = NULL;
+#endif
+
+  s->initial_ts = pktx->ts;
+  s->handshake_timeout = (data->set.connecttimeout > 0) ?
+    data->set.connecttimeout * NGTCP2_MILLISECONDS : QUIC_HANDSHAKE_TIMEOUT;
+  s->max_window = H3_CONN_WINDOW_SIZE_MAX;
+  s->max_stream_window = 0; /* disable ngtcp2 auto-tuning of window */
+  s->no_pmtud = FALSE;
+#ifdef NGTCP2_SETTINGS_V3
+  /* try ten times the ngtcp2 defaults here for problems with Caddy */
+  s->glitch_ratelim_burst = 1000 * 10;
+  s->glitch_ratelim_rate = 33 * 10;
+#endif
+  t->initial_max_data = s->max_window;
+  t->initial_max_stream_data_bidi_local = H3_STREAM_WINDOW_SIZE_INITIAL;
+  t->initial_max_stream_data_bidi_remote = H3_STREAM_WINDOW_SIZE_INITIAL;
+  t->initial_max_stream_data_uni = t->initial_max_data;
+  t->initial_max_streams_bidi = QUIC_MAX_STREAMS;
+  t->initial_max_streams_uni = QUIC_MAX_STREAMS;
+  t->max_idle_timeout = 0; /* no idle timeout from our side */
+  if(ctx->qlogfd != -1) {
+    s->qlog_write = qlog_callback;
+  }
+}
+
+#if defined(_MSC_VER) && defined(_DLL)
+#pragma warning(push)
+#pragma warning(disable:4232) /* MSVC extension, dllimport identity */
+#endif
+
+static int cb_ngtcp2_handshake_completed(ngtcp2_conn *tconn, void *user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_ngtcp2_ctx *ctx = cf ? cf->ctx : NULL;
+  struct Curl_easy *data;
+
+  (void)tconn;
+  DEBUGASSERT(ctx);
+  data = CF_DATA_CURRENT(cf);
+  DEBUGASSERT(data);
+  if(!ctx || !data)
+    return NGTCP2_ERR_CALLBACK_FAILURE;
+
+  ctx->handshake_at = *Curl_pgrs_now(data);
+  ctx->tls_handshake_complete = TRUE;
+  Curl_vquic_report_handshake(&ctx->tls, cf, data);
+
+  ctx->tls_vrfy_result = Curl_vquic_tls_verify_peer(&ctx->tls, cf,
+                                                    data, &ctx->ssl_peer);
+  if(ctx->tls_vrfy_result)
+    return NGTCP2_ERR_CALLBACK_FAILURE;
+
+#ifdef CURLVERBOSE
+  if(Curl_trc_is_verbose(data)) {
+    const ngtcp2_transport_params *rp;
+    rp = ngtcp2_conn_get_remote_transport_params(ctx->qconn);
+    CURL_TRC_CF(data, cf, "handshake complete after %" FMT_TIMEDIFF_T
+                "ms, remote transport[max_udp_payload=%" PRIu64
+                ", initial_max_data=%" PRIu64 "]",
+                curlx_ptimediff_ms(&ctx->handshake_at, &ctx->started_at),
+                rp->max_udp_payload_size, rp->initial_max_data);
+  }
+#endif
+
+  /* In case of earlydata, where we simulate being connected, update
+   * the handshake time when we really did connect */
+  if(ctx->use_earlydata)
+    Curl_pgrsTimeWas(data, TIMER_APPCONNECT, ctx->handshake_at);
+  if(ctx->use_earlydata) {
+#if defined(USE_OPENSSL) && defined(HAVE_OPENSSL_EARLYDATA)
+    ctx->earlydata_accepted =
+      (SSL_get_early_data_status(ctx->tls.ossl.ssl) !=
+       SSL_EARLY_DATA_REJECTED);
+#endif
+#ifdef USE_GNUTLS
+    int flags = gnutls_session_get_flags(ctx->tls.gtls.session);
+    ctx->earlydata_accepted = !!(flags & GNUTLS_SFLAGS_EARLY_DATA);
+#endif
+#ifdef USE_WOLFSSL
+#ifdef WOLFSSL_EARLY_DATA
+    ctx->earlydata_accepted =
+      (wolfSSL_get_early_data_status(ctx->tls.wssl.ssl) !=
+       WOLFSSL_EARLY_DATA_REJECTED);
+#else
+    DEBUGASSERT(0); /* should not come here if ED is disabled. */
+    ctx->earlydata_accepted = FALSE;
+#endif /* WOLFSSL_EARLY_DATA */
+#endif
+    CURL_TRC_CF(data, cf, "server did%s accept %zu bytes of early data",
+                ctx->earlydata_accepted ? "" : " not", ctx->earlydata_skip);
+    Curl_pgrsEarlyData(data, ctx->earlydata_accepted ?
+                              (curl_off_t)ctx->earlydata_skip :
+                             -(curl_off_t)ctx->earlydata_skip);
+  }
+  return 0;
+}
+
+static int cb_recv_stream_data(ngtcp2_conn *tconn, uint32_t flags,
+                               int64_t stream_id, uint64_t offset,
+                               const uint8_t *buf, size_t buflen,
+                               void *user_data, void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  nghttp3_ssize rc;
+  uint64_t nconsumed;
+  int fin = (flags & NGTCP2_STREAM_DATA_FLAG_FIN) ? 1 : 0;
+  struct Curl_easy *data = stream_user_data;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+  (void)offset;
+
+  rc = nghttp3_conn_read_stream(ctx->h3conn, stream_id, buf, buflen, fin);
+  if(rc < 0) {
+    if(data && stream) {
+      CURL_TRC_CF(data, cf, "[%" PRId64 "] error on known stream, "
+                  "reset=%d, closed=%d",
+                  stream_id, stream->reset, stream->closed);
+    }
+    return NGTCP2_ERR_CALLBACK_FAILURE;
+  }
+  nconsumed = (uint64_t)rc;
+  if(nconsumed) {
+    /* number of bytes inside buflen which consists of framing overhead
+     * including QPACK HEADERS. In other words, it does not consume payload of
+     * DATA frame. */
+    ngtcp2_conn_extend_max_stream_offset(tconn, stream_id, nconsumed);
+    ngtcp2_conn_extend_max_offset(tconn, nconsumed);
+    if(stream) {
+      stream->rx_offset += nconsumed;
+      stream->rx_offset_max += nconsumed;
+    }
+  }
+  return 0;
+}
+
+static int cb_acked_stream_data_offset(ngtcp2_conn *tconn, int64_t stream_id,
+                                       uint64_t offset, uint64_t datalen,
+                                       void *user_data, void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  int rv;
+  (void)stream_id;
+  (void)tconn;
+  (void)offset;
+  (void)datalen;
+  (void)stream_user_data;
+
+  rv = nghttp3_conn_add_ack_offset(ctx->h3conn, stream_id, datalen);
+  if(rv && rv != NGHTTP3_ERR_STREAM_NOT_FOUND) {
+    return NGTCP2_ERR_CALLBACK_FAILURE;
+  }
+
+  return 0;
+}
+
+static int cb_stream_close(ngtcp2_conn *tconn, uint32_t flags,
+                           int64_t stream_id, uint64_t app_error_code,
+                           void *user_data, void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct Curl_easy *data = stream_user_data;
+  int rv;
+
+  (void)tconn;
+  /* stream is closed... */
+  if(!data)
+    data = CF_DATA_CURRENT(cf);
+  if(!data)
+    return NGTCP2_ERR_CALLBACK_FAILURE;
+
+  if(!(flags & NGTCP2_STREAM_CLOSE_FLAG_APP_ERROR_CODE_SET)) {
+    app_error_code = NGHTTP3_H3_NO_ERROR;
+  }
+
+  rv = nghttp3_conn_close_stream(ctx->h3conn, stream_id, app_error_code);
+  CURL_TRC_CF(data, cf, "[%" PRId64 "] quic close(app_error=%"
+              PRIu64 ") -> %d", stream_id, app_error_code, rv);
+  if(rv && rv != NGHTTP3_ERR_STREAM_NOT_FOUND) {
+    Curl_cf_ngtcp2_h3_err_set(cf, data, rv);
+    return NGTCP2_ERR_CALLBACK_FAILURE;
+  }
+
+  return 0;
+}
+
+static int cb_stream_reset(ngtcp2_conn *tconn, int64_t stream_id,
+                           uint64_t final_size, uint64_t app_error_code,
+                           void *user_data, void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct Curl_easy *data = stream_user_data;
+  int rv;
+  (void)tconn;
+  (void)final_size;
+  (void)app_error_code;
+
+  rv = nghttp3_conn_shutdown_stream_read(ctx->h3conn, stream_id);
+  CURL_TRC_CF(data, cf, "[%" PRId64 "] reset -> %d", stream_id, rv);
+  if(rv && rv != NGHTTP3_ERR_STREAM_NOT_FOUND) {
+    return NGTCP2_ERR_CALLBACK_FAILURE;
+  }
+
+  return 0;
+}
+
+static int cb_stream_stop_sending(ngtcp2_conn *tconn, int64_t stream_id,
+                                  uint64_t app_error_code, void *user_data,
+                                  void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  int rv;
+  (void)tconn;
+  (void)app_error_code;
+  (void)stream_user_data;
+
+  rv = nghttp3_conn_shutdown_stream_read(ctx->h3conn, stream_id);
+  if(rv && rv != NGHTTP3_ERR_STREAM_NOT_FOUND) {
+    return NGTCP2_ERR_CALLBACK_FAILURE;
+  }
+
+  return 0;
+}
+
+static int cb_extend_max_local_streams_bidi(ngtcp2_conn *tconn,
+                                            uint64_t max_streams,
+                                            void *user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct Curl_easy *data = CF_DATA_CURRENT(cf);
+
+  (void)tconn;
+  ctx->max_bidi_streams = max_streams;
+  if(data)
+    CURL_TRC_CF(data, cf, "max bidi streams now %" PRIu64 ", used %" PRIu64,
+                ctx->max_bidi_streams, ctx->used_bidi_streams);
+  return 0;
+}
+
+static int cb_extend_max_stream_data(ngtcp2_conn *tconn, int64_t stream_id,
+                                     uint64_t max_data, void *user_data,
+                                     void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct Curl_easy *s_data = stream_user_data;
+  struct h3_stream_ctx *stream;
+  int rv;
+  (void)tconn;
+  (void)max_data;
+
+  rv = nghttp3_conn_unblock_stream(ctx->h3conn, stream_id);
+  if(rv && rv != NGHTTP3_ERR_STREAM_NOT_FOUND) {
+    return NGTCP2_ERR_CALLBACK_FAILURE;
+  }
+  stream = H3_STREAM_CTX(ctx, s_data);
+  if(stream && stream->quic_flow_blocked) {
+    CURL_TRC_CF(s_data, cf, "[%" PRId64 "] unblock quic flow", stream_id);
+    stream->quic_flow_blocked = FALSE;
+    Curl_multi_mark_dirty(s_data);
+  }
+  return 0;
+}
+
+static void cb_rand(uint8_t *dest, size_t destlen,
+                    const ngtcp2_rand_ctx *rand_ctx)
+{
+  CURLcode result;
+  (void)rand_ctx;
+
+  result = Curl_rand(NULL, dest, destlen);
+  if(result) {
+    /* cb_rand is only used for non-cryptographic context. If Curl_rand
+       failed, fill 0 and call it *random*. */
+    memset(dest, 0, destlen);
+  }
+}
+
+/* for ngtcp2 <v1.22.0 */
+static int cb_get_new_connection_id(ngtcp2_conn *tconn, ngtcp2_cid *cid,
+                                    uint8_t *token, size_t cidlen,
+                                    void *user_data)
+{
+  CURLcode result;
+  (void)tconn;
+  (void)user_data;
+
+  result = Curl_rand(NULL, cid->data, cidlen);
+  if(result)
+    return NGTCP2_ERR_CALLBACK_FAILURE;
+  cid->datalen = cidlen;
+
+  result = Curl_rand(NULL, token, NGTCP2_STATELESS_RESET_TOKENLEN);
+  if(result)
+    return NGTCP2_ERR_CALLBACK_FAILURE;
+
+  return 0;
+}
+
+#ifdef NGTCP2_CALLBACKS_V3  /* ngtcp2 v1.22.0+ */
+static int cb_get_new_connection_id2(
+  ngtcp2_conn *tconn, ngtcp2_cid *cid,
+  struct ngtcp2_stateless_reset_token *token, size_t cidlen, void *user_data)
+{
+  CURLcode result;
+  (void)tconn;
+  (void)user_data;
+
+  result = Curl_rand(NULL, cid->data, cidlen);
+  if(result)
+    return NGTCP2_ERR_CALLBACK_FAILURE;
+  cid->datalen = cidlen;
+
+  result = Curl_rand(NULL, token->data, sizeof(token->data));
+  if(result)
+    return NGTCP2_ERR_CALLBACK_FAILURE;
+
+  return 0;
+}
+#endif
+
+static int cb_recv_rx_key(ngtcp2_conn *tconn, ngtcp2_encryption_level level,
+                          void *user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_ngtcp2_ctx *ctx = cf ? cf->ctx : NULL;
+  struct Curl_easy *data = CF_DATA_CURRENT(cf);
+  (void)tconn;
+
+  if(level != NGTCP2_ENCRYPTION_LEVEL_1RTT)
+    return 0;
+
+  DEBUGASSERT(ctx);
+  DEBUGASSERT(data);
+  if(ctx && data && !ctx->h3conn && ctx->init_h3_conn_cb) {
+    if(ctx->init_h3_conn_cb(cf, data, ctx))
+      return NGTCP2_ERR_CALLBACK_FAILURE;
+  }
+  return 0;
+}
+
+static ngtcp2_callbacks ng_callbacks = {
+  ngtcp2_crypto_client_initial_cb,
+  NULL, /* recv_client_initial */
+  ngtcp2_crypto_recv_crypto_data_cb,
+  cb_ngtcp2_handshake_completed,
+  NULL, /* recv_version_negotiation */
+  ngtcp2_crypto_encrypt_cb,
+  ngtcp2_crypto_decrypt_cb,
+  ngtcp2_crypto_hp_mask_cb,
+  cb_recv_stream_data,
+  cb_acked_stream_data_offset,
+  NULL, /* stream_open */
+  cb_stream_close,
+  NULL, /* recv_stateless_reset */
+  ngtcp2_crypto_recv_retry_cb,
+  cb_extend_max_local_streams_bidi,
+  NULL, /* extend_max_local_streams_uni */
+  cb_rand,
+  cb_get_new_connection_id, /* for ngtcp2 <v1.22.0 */
+  NULL, /* remove_connection_id */
+  ngtcp2_crypto_update_key_cb, /* update_key */
+  NULL, /* path_validation */
+  NULL, /* select_preferred_addr */
+  cb_stream_reset,
+  NULL, /* extend_max_remote_streams_bidi */
+  NULL, /* extend_max_remote_streams_uni */
+  cb_extend_max_stream_data,
+  NULL, /* dcid_status */
+  NULL, /* handshake_confirmed */
+  NULL, /* recv_new_token */
+  ngtcp2_crypto_delete_crypto_aead_ctx_cb,
+  ngtcp2_crypto_delete_crypto_cipher_ctx_cb,
+  NULL, /* recv_datagram */
+  NULL, /* ack_datagram */
+  NULL, /* lost_datagram */
+  ngtcp2_crypto_get_path_challenge_data_cb,
+  cb_stream_stop_sending,
+  NULL, /* version_negotiation */
+  cb_recv_rx_key,
+  NULL, /* recv_tx_key */
+  NULL, /* early_data_rejected */
+#ifdef NGTCP2_CALLBACKS_V2  /* ngtcp2 v1.14.0+ */
+  NULL, /* begin_path_validation */
+#endif
+#ifdef NGTCP2_CALLBACKS_V3  /* ngtcp2 v1.22.0+ */
+  NULL, /* recv_stateless_reset2 */
+  cb_get_new_connection_id2, /* get_new_connection_id2 */
+  NULL, /* dcid_status2 */
+  ngtcp2_crypto_get_path_challenge_data2_cb, /* get_path_challenge_data2 */
+#endif
+};
+
+#if defined(_MSC_VER) && defined(_DLL)
+#pragma warning(pop)
+#endif
+
+static bool cf_ngtcp2_need_httpsrr(struct Curl_easy *data)
+{
+#ifdef USE_OPENSSL
+  return Curl_ossl_need_httpsrr(data);
+#elif defined(USE_WOLFSSL)
+  return Curl_wssl_need_httpsrr(data);
+#else
+  (void)data;
+  return FALSE;
+#endif
+}
+
+#ifdef USE_OPENSSL
+/* The "new session" callback must return zero if the session can be removed
+ * or non-zero if the session has been put into the session cache.
+ */
+static int quic_ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid)
+{
+  struct Curl_cfilter *cf;
+  struct cf_ngtcp2_ctx *ctx;
+  struct Curl_easy *data;
+  ngtcp2_crypto_conn_ref *cref;
+
+  cref = (ngtcp2_crypto_conn_ref *)SSL_get_app_data(ssl);
+  cf = cref ? cref->user_data : NULL;
+  ctx = cf ? cf->ctx : NULL;
+  data = cf ? CF_DATA_CURRENT(cf) : NULL;
+  if(cf && data && ctx) {
+    unsigned char *quic_tp = NULL;
+    size_t quic_tp_len = 0;
+#ifdef HAVE_OPENSSL_EARLYDATA
+    ngtcp2_ssize tplen;
+    uint8_t tpbuf[256];
+
+    tplen = ngtcp2_conn_encode_0rtt_transport_params(ctx->qconn, tpbuf,
+                                                     sizeof(tpbuf));
+    if(tplen < 0)
+      CURL_TRC_CF(data, cf, "error encoding 0RTT transport data: %s",
+                  ngtcp2_strerror((int)tplen));
+    else {
+      quic_tp = (unsigned char *)tpbuf;
+      quic_tp_len = (size_t)tplen;
+    }
+#endif
+    Curl_ossl_add_session(cf, data, ctx->ssl_peer.scache_key, ssl_sessionid,
+                          SSL_version(ssl), "h3", quic_tp, quic_tp_len);
+  }
+  return 0;
+}
+#endif /* USE_OPENSSL */
+
+#ifdef USE_GNUTLS
+
+#ifdef CURLVERBOSE
+static const char *gtls_hs_msg_name(int mtype)
+{
+  switch(mtype) {
+  case 1:
+    return "ClientHello";
+  case 2:
+    return "ServerHello";
+  case 4:
+    return "SessionTicket";
+  case 8:
+    return "EncryptedExtensions";
+  case 11:
+    return "Certificate";
+  case 13:
+    return "CertificateRequest";
+  case 15:
+    return "CertificateVerify";
+  case 20:
+    return "Finished";
+  case 24:
+    return "KeyUpdate";
+  case 254:
+    return "MessageHash";
+  }
+  return "Unknown";
+}
+#endif
+
+static int quic_gtls_handshake_cb(gnutls_session_t session, unsigned int htype,
+                                  unsigned when, unsigned int incoming,
+                                  const gnutls_datum_t *msg)
+{
+  ngtcp2_crypto_conn_ref *conn_ref = gnutls_session_get_ptr(session);
+  struct Curl_cfilter *cf = conn_ref ? conn_ref->user_data : NULL;
+  struct cf_ngtcp2_ctx *ctx = cf ? cf->ctx : NULL;
+
+  (void)msg;
+  (void)incoming;
+  if(when && cf && ctx) { /* after message has been processed */
+    struct Curl_easy *data = CF_DATA_CURRENT(cf);
+    DEBUGASSERT(data);
+    if(!data)
+      return 0;
+    CURL_TRC_CF(data, cf, "SSL message: %s %s [%u]",
+                incoming ? "<-" : "->", gtls_hs_msg_name(htype), htype);
+    switch(htype) {
+    case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET: {
+      ngtcp2_ssize tplen;
+      uint8_t tpbuf[256];
+      unsigned char *quic_tp = NULL;
+      size_t quic_tp_len = 0;
+
+      tplen = ngtcp2_conn_encode_0rtt_transport_params(ctx->qconn, tpbuf,
+                                                       sizeof(tpbuf));
+      if(tplen < 0)
+        CURL_TRC_CF(data, cf, "error encoding 0RTT transport data: %s",
+                    ngtcp2_strerror((int)tplen));
+      else {
+        quic_tp = (unsigned char *)tpbuf;
+        quic_tp_len = (size_t)tplen;
+      }
+      (void)Curl_gtls_cache_session(cf, data, ctx->ssl_peer.scache_key,
+                                    session, 0, "h3", quic_tp, quic_tp_len);
+      break;
+    }
+    default:
+      break;
+    }
+  }
+  return 0;
+}
+#endif /* USE_GNUTLS */
+
+#ifdef USE_WOLFSSL
+static int wssl_quic_new_session_cb(WOLFSSL *ssl, WOLFSSL_SESSION *session)
+{
+  ngtcp2_crypto_conn_ref *conn_ref = wolfSSL_get_app_data(ssl);
+  struct Curl_cfilter *cf = conn_ref ? conn_ref->user_data : NULL;
+
+  DEBUGASSERT(cf);
+  if(cf && session) {
+    struct cf_ngtcp2_ctx *ctx = cf->ctx;
+    struct Curl_easy *data = CF_DATA_CURRENT(cf);
+    DEBUGASSERT(data);
+    if(data && ctx) {
+      ngtcp2_ssize tplen;
+      uint8_t tpbuf[256];
+      unsigned char *quic_tp = NULL;
+      size_t quic_tp_len = 0;
+
+      tplen = ngtcp2_conn_encode_0rtt_transport_params(ctx->qconn, tpbuf,
+                                                       sizeof(tpbuf));
+      if(tplen < 0)
+        CURL_TRC_CF(data, cf, "error encoding 0RTT transport data: %s",
+                    ngtcp2_strerror((int)tplen));
+      else {
+        quic_tp = (unsigned char *)tpbuf;
+        quic_tp_len = (size_t)tplen;
+      }
+      (void)Curl_wssl_cache_session(cf, data, ctx->ssl_peer.scache_key,
+                                    session, wolfSSL_version(ssl),
+                                    "h3", quic_tp, quic_tp_len);
+    }
+  }
+  return 0;
+}
+#endif /* USE_WOLFSSL */
+
+static CURLcode cf_ngtcp2_tls_ctx_setup(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data,
+                                        void *user_data)
+{
+  struct curl_tls_ctx *ctx = user_data;
+
+#ifdef USE_OPENSSL
+#if defined(OPENSSL_IS_AWSLC) || defined(OPENSSL_IS_BORINGSSL)
+  if(ngtcp2_crypto_boringssl_configure_client_context(ctx->ossl.ssl_ctx)
+     != 0) {
+    failf(data, "ngtcp2_crypto_boringssl_configure_client_context failed");
+    return CURLE_FAILED_INIT;
+  }
+#elif defined(OPENSSL_QUIC_API2)
+  /* nothing to do */
+#else
+  if(ngtcp2_crypto_quictls_configure_client_context(ctx->ossl.ssl_ctx) != 0) {
+    failf(data, "ngtcp2_crypto_quictls_configure_client_context failed");
+    return CURLE_FAILED_INIT;
+  }
+#endif /* !OPENSSL_IS_AWSLC && !OPENSSL_IS_BORINGSSL */
+  if(Curl_ssl_scache_use(cf, data)) {
+    /* Enable the session cache because it is a prerequisite for the
+     * "new session" callback. Use the "external storage" mode to prevent
+     * OpenSSL from creating an internal session cache.
+     */
+    SSL_CTX_set_session_cache_mode(ctx->ossl.ssl_ctx,
+                                   SSL_SESS_CACHE_CLIENT |
+                                   SSL_SESS_CACHE_NO_INTERNAL);
+    SSL_CTX_sess_set_new_cb(ctx->ossl.ssl_ctx, quic_ossl_new_session_cb);
+  }
+
+#elif defined(USE_GNUTLS)
+  if(ngtcp2_crypto_gnutls_configure_client_session(ctx->gtls.session) != 0) {
+    failf(data, "ngtcp2_crypto_gnutls_configure_client_session failed");
+    return CURLE_FAILED_INIT;
+  }
+  if(Curl_ssl_scache_use(cf, data)) {
+    gnutls_handshake_set_hook_function(ctx->gtls.session,
+                                       GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST,
+                                       quic_gtls_handshake_cb);
+  }
+
+#elif defined(USE_WOLFSSL)
+  if(ngtcp2_crypto_wolfssl_configure_client_context(ctx->wssl.ssl_ctx) != 0) {
+    failf(data, "ngtcp2_crypto_wolfssl_configure_client_context failed");
+    return CURLE_FAILED_INIT;
+  }
+  if(Curl_ssl_scache_use(cf, data)) {
+    /* Register to get notified when a new session is received */
+    wolfSSL_CTX_sess_set_new_cb(ctx->wssl.ssl_ctx, wssl_quic_new_session_cb);
+  }
+#endif
+  return CURLE_OK;
+}
+
+static CURLcode cf_ngtcp2_on_session_reuse(struct Curl_cfilter *cf,
+                                           struct Curl_easy *data,
+                                           struct alpn_spec *alpns,
+                                           struct Curl_ssl_session *scs,
+                                           bool *do_early_data)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  *do_early_data = FALSE;
+#if defined(USE_OPENSSL) && defined(HAVE_OPENSSL_EARLYDATA)
+  ctx->earlydata_max = scs->earlydata_max;
+#endif
+#ifdef USE_GNUTLS
+  ctx->earlydata_max =
+    gnutls_record_get_max_early_data_size(ctx->tls.gtls.session);
+#endif
+#ifdef USE_WOLFSSL
+#ifdef WOLFSSL_EARLY_DATA
+  ctx->earlydata_max = scs->earlydata_max;
+#else
+  ctx->earlydata_max = 0;
+#endif /* WOLFSSL_EARLY_DATA */
+#endif
+#if defined(USE_GNUTLS) || defined(USE_WOLFSSL) || \
+  (defined(USE_OPENSSL) && defined(HAVE_OPENSSL_EARLYDATA))
+  if(!ctx->earlydata_max) {
+    CURL_TRC_CF(data, cf, "SSL session does not allow earlydata");
+  }
+  else if(!Curl_alpn_contains_proto(alpns, scs->alpn)) {
+    CURL_TRC_CF(data, cf, "SSL session from different ALPN, no early data");
+  }
+  else if(!scs->quic_tp || !scs->quic_tp_len) {
+    CURL_TRC_CF(data, cf, "no 0RTT transport parameters, no early data");
+  }
+  else {
+    int rv;
+    rv = ngtcp2_conn_decode_and_set_0rtt_transport_params(
+      ctx->qconn, (const uint8_t *)scs->quic_tp, scs->quic_tp_len);
+    if(rv)
+      CURL_TRC_CF(data, cf, "no early data, failed to set 0RTT transport "
+                  "parameters: %s", ngtcp2_strerror(rv));
+    else if(ctx->init_h3_conn_cb) {
+      infof(data, "SSL session allows %zu bytes of early data, "
+            "reusing ALPN '%s'", ctx->earlydata_max, scs->alpn);
+      result = ctx->init_h3_conn_cb(cf, data, ctx);
+      if(!result) {
+        ctx->use_earlydata = TRUE;
+        cf->connected = TRUE;
+        *do_early_data = TRUE;
+      }
+    }
+    else { /* h3_conn_init set, assume done */
+        ctx->use_earlydata = TRUE;
+        cf->connected = TRUE;
+        *do_early_data = TRUE;
+    }
+  }
+#else /* not supported in the TLS backend */
+  (void)data;
+  (void)ctx;
+  (void)scs;
+  (void)alpns;
+#endif
+  return result;
+}
+
+/*
+ * Might be called twice for happy eyeballs.
+ */
+static CURLcode cf_connect_start(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 struct cf_ngtcp2_io_ctx *pktx)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  int rc;
+  int rv;
+  CURLcode result;
+  const struct Curl_sockaddr_ex *sockaddr = NULL;
+  int qfd;
+  static const struct alpn_spec ALPN_SPEC_H3 = { { "h3", "h3-29" }, 2 };
+
+  DEBUGASSERT(ctx->initialized);
+  ctx->dcid.datalen = NGTCP2_MAX_CIDLEN;
+  result = Curl_rand(data, ctx->dcid.data, NGTCP2_MAX_CIDLEN);
+  if(result)
+    return result;
+
+  ctx->scid.datalen = NGTCP2_MAX_CIDLEN;
+  result = Curl_rand(data, ctx->scid.data, NGTCP2_MAX_CIDLEN);
+  if(result)
+    return result;
+
+  (void)Curl_qlogdir(data, ctx->scid.data, NGTCP2_MAX_CIDLEN, &qfd);
+  ctx->qlogfd = qfd; /* -1 if failure above */
+  quic_settings(ctx, data, pktx);
+
+  result = vquic_ctx_init(data, &ctx->q);
+  if(result)
+    return result;
+
+  /* Query socket and remote address from sub-chain */
+  if(Curl_cf_socket_peek(cf->next, data, &ctx->q.sockfd, &sockaddr, NULL)) {
+    /* No direct socket - must be tunneled QUIC (CONNECT-UDP through proxy) */
+    ctx->q.sockfd = CURL_SOCKET_BAD;
+  }
+
+  if(ctx->q.sockfd != CURL_SOCKET_BAD) {
+    /* Direct UDP socket - get local address for ngtcp2 */
+    ctx->q.local_addrlen = sizeof(ctx->q.local_addr);
+    rv = getsockname(ctx->q.sockfd, (struct sockaddr *)&ctx->q.local_addr,
+                     &ctx->q.local_addrlen);
+    if(rv == -1)
+      return CURLE_QUIC_CONNECT_ERROR;
+
+    ngtcp2_addr_init(&ctx->connected_path.local,
+                     (struct sockaddr *)&ctx->q.local_addr,
+                     ctx->q.local_addrlen);
+    ngtcp2_addr_init(&ctx->connected_path.remote,
+                     &sockaddr->curl_sa_addr, (socklen_t)sockaddr->addrlen);
+
+    rc = ngtcp2_conn_client_new(&ctx->qconn, &ctx->dcid, &ctx->scid,
+                                &ctx->connected_path,
+                                NGTCP2_PROTO_VER_V1, &ng_callbacks,
+                                &ctx->settings, &ctx->transport_params,
+                                Curl_ngtcp2_mem(), cf);
+    if(rc)
+      return CURLE_QUIC_CONNECT_ERROR;
+
+    ctx->conn_ref.get_conn = get_conn;
+    ctx->conn_ref.user_data = cf;
+  }
+  else {
+    /* Tunneled QUIC (e.g. CONNECT-UDP): get remote address
+       from the connected filter below */
+    const struct Curl_sockaddr_ex *remote = NULL;
+    if(cf->next->cft->query(cf->next, data, CF_QUERY_REMOTE_ADDR, NULL,
+                            CURL_UNCONST(&remote)))
+      return CURLE_QUIC_CONNECT_ERROR;
+    if(!remote)
+      return CURLE_QUIC_CONNECT_ERROR;
+
+    memset(&ctx->q.local_addr, 0, sizeof(ctx->q.local_addr));
+    switch(remote->family) {
+    case AF_INET:
+      ((struct sockaddr_in *)&ctx->q.local_addr)->sin_family = AF_INET;
+      ctx->q.local_addrlen = sizeof(struct sockaddr_in);
+      break;
+#ifdef USE_IPV6
+    case AF_INET6:
+      ((struct sockaddr_in6 *)&ctx->q.local_addr)->sin6_family = AF_INET6;
+      ctx->q.local_addrlen = sizeof(struct sockaddr_in6);
+      break;
+#endif
+    default:
+      return CURLE_QUIC_CONNECT_ERROR;
+    }
+
+    ngtcp2_addr_init(&ctx->connected_path.local,
+                     (struct sockaddr *)&ctx->q.local_addr,
+                     ctx->q.local_addrlen);
+    ngtcp2_addr_init(&ctx->connected_path.remote,
+                     &remote->curl_sa_addr,
+                     (socklen_t)remote->addrlen);
+
+    rc = ngtcp2_conn_client_new(&ctx->qconn, &ctx->dcid, &ctx->scid,
+                                &ctx->connected_path,
+                                NGTCP2_PROTO_VER_V1, &ng_callbacks,
+                                &ctx->settings, &ctx->transport_params,
+                                Curl_ngtcp2_mem(), cf);
+    if(rc)
+      return CURLE_QUIC_CONNECT_ERROR;
+
+    ctx->conn_ref.get_conn = get_conn;
+    ctx->conn_ref.user_data = cf;
+  }
+
+  result = Curl_vquic_tls_init(&ctx->tls, cf, data,
+                               &ctx->ssl_peer, &ALPN_SPEC_H3,
+                               cf_ngtcp2_tls_ctx_setup, &ctx->tls,
+                               &ctx->conn_ref,
+                               cf_ngtcp2_on_session_reuse);
+  if(result)
+    return result;
+
+#if defined(USE_OPENSSL) && defined(OPENSSL_QUIC_API2)
+  if(ngtcp2_crypto_ossl_ctx_new(&ctx->ossl_ctx, ctx->tls.ossl.ssl) != 0) {
+    failf(data, "ngtcp2_crypto_ossl_ctx_new failed");
+    return CURLE_FAILED_INIT;
+  }
+  ngtcp2_conn_set_tls_native_handle(ctx->qconn, ctx->ossl_ctx);
+  if(ngtcp2_crypto_ossl_configure_client_session(ctx->tls.ossl.ssl) != 0) {
+    failf(data, "ngtcp2_crypto_ossl_configure_client_session failed");
+    return CURLE_FAILED_INIT;
+  }
+#elif defined(USE_OPENSSL)
+  SSL_set_quic_use_legacy_codepoint(ctx->tls.ossl.ssl, 0);
+  ngtcp2_conn_set_tls_native_handle(ctx->qconn, ctx->tls.ossl.ssl);
+#elif defined(USE_GNUTLS)
+  ngtcp2_conn_set_tls_native_handle(ctx->qconn, ctx->tls.gtls.session);
+#elif defined(USE_WOLFSSL)
+  ngtcp2_conn_set_tls_native_handle(ctx->qconn, ctx->tls.wssl.ssl);
+#else
+#error "ngtcp2 TLS backend not defined"
+#endif
+
+  ngtcp2_ccerr_default(&ctx->last_error);
+
+  return CURLE_OK;
+}
+
+CURLcode Curl_cf_ngtcp2_cmn_connect(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    bool *done)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+  struct cf_call_data save;
+  struct cf_ngtcp2_io_ctx pktx;
+
+  if(cf->connected) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  /* Connect the sub-chain */
+  if(cf->next && !cf->next->connected) {
+    result = Curl_conn_cf_connect(cf->next, data, done);
+    if(result || !*done)
+      return result;
+  }
+
+  *done = FALSE;
+
+  if(cf_ngtcp2_need_httpsrr(data) &&
+     !Curl_conn_dns_resolved_https(data, cf->sockindex, ctx->ssl_peer.peer)) {
+    CURL_TRC_CF(data, cf, "need HTTPS-RR, delaying connect");
+    return CURLE_OK;
+  }
+
+  Curl_cf_ngtcp2_io_ctx_init(&pktx, cf, data);
+  CF_DATA_SAVE(save, cf, data);
+
+  if(!ctx->qconn) {
+    ctx->started_at = *Curl_pgrs_now(data);
+    result = cf_connect_start(cf, data, &pktx);
+    if(result)
+      goto out;
+    if(cf->connected) {
+      *done = TRUE;
+      goto out;
+    }
+    result = Curl_cf_ngtcp2_progress_egress(cf, data, &pktx);
+    /* we do not expect to be able to recv anything yet */
+    goto out;
+  }
+
+  result = Curl_cf_ngtcp2_progress_ingress(cf, data, &pktx);
+  if(result)
+    goto out;
+
+  result = Curl_cf_ngtcp2_progress_egress(cf, data, &pktx);
+  if(result)
+    goto out;
+
+  if(ngtcp2_conn_get_handshake_completed(ctx->qconn)) {
+    result = ctx->tls_vrfy_result;
+    if(!result) {
+      CURL_TRC_CF(data, cf, "peer verified");
+      cf->connected = TRUE;
+      *done = TRUE;
+    }
+  }
+
+out:
+  if(ctx->tls_vrfy_result)
+    result = ctx->tls_vrfy_result;
+  if(ctx->qconn &&
+     ((result == CURLE_RECV_ERROR) || (result == CURLE_SEND_ERROR)) &&
+     ngtcp2_conn_in_draining_period(ctx->qconn)) {
+    const ngtcp2_ccerr *cerr = ngtcp2_conn_get_ccerr(ctx->qconn);
+
+    result = CURLE_COULDNT_CONNECT;
+    if(cerr) {
+      CURL_TRC_CF(data, cf, "connect error, type=%d, code=%" PRIu64,
+                  (int)cerr->type, cerr->error_code);
+      switch(cerr->type) {
+      case NGTCP2_CCERR_TYPE_VERSION_NEGOTIATION:
+        CURL_TRC_CF(data, cf, "error in version negotiation");
+        break;
+      default:
+        if(cerr->error_code >= NGTCP2_CRYPTO_ERROR) {
+          CURL_TRC_CF(data, cf, "crypto error, tls alert=%u",
+                      (unsigned int)(cerr->error_code & 0xffU));
+        }
+        else if(cerr->error_code == NGTCP2_CONNECTION_REFUSED) {
+          CURL_TRC_CF(data, cf, "connection refused by server");
+          /* When a QUIC server instance is shutting down, it may send us a
+           * CONNECTION_CLOSE with this code right away. We want
+           * to keep on trying in this case. */
+          result = CURLE_WEIRD_SERVER_REPLY;
+        }
+      }
+    }
+  }
+
+#ifdef CURLVERBOSE
+  if(result) {
+    if(ctx->q.sockfd != CURL_SOCKET_BAD) {
+      /* Direct UDP socket - get IP info for error reporting */
+      struct ip_quadruple ip;
+
+      if(!Curl_cf_socket_peek(cf->next, data, NULL, NULL, &ip))
+        infof(data, "QUIC connect to %s port %u failed: %s",
+              ip.remote_ip, ip.remote_port, curl_easy_strerror(result));
+    }
+  }
+#endif
+  if(!result && ctx->qconn) {
+    result = Curl_cf_ngtcp2_cmn_set_expiry(cf, data, &pktx);
+  }
+  if(result || *done)
+    CURL_TRC_CF(data, cf, "connect -> %d, done=%d", (int)result, *done);
+  CF_DATA_RESTORE(cf, save);
+  return result;
+}
+
+CURLcode Curl_cf_ngtcp2_cmn_shutdown(struct Curl_cfilter *cf,
+                                     struct Curl_easy *data, bool *done)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct cf_call_data save;
+  struct cf_ngtcp2_io_ctx pktx;
+  CURLcode result = CURLE_OK;
+
+  if(cf->shutdown || !ctx->qconn) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  if(!cf->next) {
+    Curl_bufq_reset(&ctx->q.sendbuf);
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  CF_DATA_SAVE(save, cf, data);
+  *done = FALSE;
+  Curl_cf_ngtcp2_io_ctx_init(&pktx, cf, data);
+
+  if(!ctx->shutdown_started) {
+    char buffer[NGTCP2_MAX_UDP_PAYLOAD_SIZE];
+    ngtcp2_ssize nwritten;
+
+    if(!Curl_bufq_is_empty(&ctx->q.sendbuf)) {
+      CURL_TRC_CF(data, cf, "shutdown, flushing sendbuf");
+      result = Curl_cf_ngtcp2_progress_egress(cf, data, &pktx);
+      if(!Curl_bufq_is_empty(&ctx->q.sendbuf)) {
+        CURL_TRC_CF(data, cf, "sending shutdown packets blocked");
+        result = CURLE_OK;
+        goto out;
+      }
+      else if(result) {
+        CURL_TRC_CF(data, cf, "shutdown, error %d flushing sendbuf",
+                    (int)result);
+        *done = TRUE;
+        goto out;
+      }
+    }
+
+    DEBUGASSERT(Curl_bufq_is_empty(&ctx->q.sendbuf));
+    ctx->shutdown_started = TRUE;
+    nwritten = ngtcp2_conn_write_connection_close(
+      ctx->qconn, NULL, /* path */
+      NULL, /* pkt_info */
+      (uint8_t *)buffer, sizeof(buffer),
+      &ctx->last_error, pktx.ts);
+    CURL_TRC_CF(data, cf, "start shutdown(err_type=%d, err_code=%"
+                PRIu64 ") -> %zd", (int)ctx->last_error.type,
+                ctx->last_error.error_code, (ssize_t)nwritten);
+    /* there are cases listed in ngtcp2 documentation where this call
+     * may fail. Since we are doing a connection shutdown as graceful
+     * as we can, such an error is ignored here. */
+    if(nwritten > 0) {
+      /* Ignore amount written. sendbuf was empty and has always room for
+       * NGTCP2_MAX_UDP_PAYLOAD_SIZE. It can only completely fail, in which
+       * case `result` is set non zero. */
+      size_t n;
+      result = Curl_bufq_write(&ctx->q.sendbuf, (const unsigned char *)buffer,
+                               (size_t)nwritten, &n);
+      if(result) {
+        CURL_TRC_CF(data, cf, "error %d adding shutdown packets to sendbuf, "
+                    "aborting shutdown", (int)result);
+        goto out;
+      }
+
+      ctx->q.no_gso = TRUE;
+      ctx->q.gsolen = (size_t)nwritten;
+      ctx->q.split_len = 0;
+    }
+  }
+
+  if(!Curl_bufq_is_empty(&ctx->q.sendbuf)) {
+    CURL_TRC_CF(data, cf, "shutdown, flushing egress");
+    result = vquic_flush(cf, data, &ctx->q);
+    if(result == CURLE_AGAIN) {
+      CURL_TRC_CF(data, cf, "sending shutdown packets blocked");
+      result = CURLE_OK;
+      goto out;
+    }
+    else if(result) {
+      CURL_TRC_CF(data, cf, "shutdown, error %d flushing sendbuf",
+                  (int)result);
+      *done = TRUE;
+      goto out;
+    }
+  }
+
+  if(Curl_bufq_is_empty(&ctx->q.sendbuf)) {
+    /* Sent everything off. ngtcp2 seems to have no support for graceful
+     * shutdowns. We are done. */
+    CURL_TRC_CF(data, cf, "shutdown completely sent off, done");
+    *done = TRUE;
+    result = CURLE_OK;
+  }
+out:
+  CF_DATA_RESTORE(cf, save);
+  return result;
+}
+
+void Curl_cf_ngtcp2_cmn_conn_close(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data)
+{
+  bool done;
+  Curl_cf_ngtcp2_cmn_shutdown(cf, data, &done);
+}
+
+static bool cf_ngtcp2_err_is_fatal(int code)
+{
+  return (NGTCP2_ERR_FATAL >= code) ||
+         (NGTCP2_ERR_DROP_CONN == code) ||
+         (NGTCP2_ERR_IDLE_CLOSE == code);
+}
+
+void Curl_cf_ngtcp2_cmn_err_set(struct Curl_cfilter *cf,
+                                struct Curl_easy *data, int code)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  if(!ctx->last_error.error_code) {
+    if(NGTCP2_ERR_CRYPTO == code) {
+      ngtcp2_ccerr_set_tls_alert(&ctx->last_error,
+                                 ngtcp2_conn_get_tls_alert(ctx->qconn),
+                                 NULL, 0);
+    }
+    else {
+      ngtcp2_ccerr_set_liberr(&ctx->last_error, code, NULL, 0);
+    }
+  }
+  if(cf_ngtcp2_err_is_fatal(code))
+    Curl_cf_ngtcp2_cmn_conn_close(cf, data);
+}
+
+void Curl_cf_ngtcp2_io_ctx_init(struct cf_ngtcp2_io_ctx *io_ctx,
+                                struct Curl_cfilter *cf,
+                                struct Curl_easy *data)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  const struct curltime *pnow = Curl_pgrs_now(data);
+
+  io_ctx->cf = cf;
+  io_ctx->data = data;
+  ngtcp2_path_storage_zero(&io_ctx->ps);
+  vquic_ctx_set_time(&ctx->q, pnow);
+  io_ctx->ts = ((ngtcp2_tstamp)pnow->tv_sec * NGTCP2_SECONDS) +
+               ((ngtcp2_tstamp)pnow->tv_usec * NGTCP2_MICROSECONDS);
+}
+
+void Curl_cf_ngtcp2_io_ctx_update_time(struct Curl_easy *data,
+                                       struct cf_ngtcp2_io_ctx *pktx,
+                                       struct Curl_cfilter *cf)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  const struct curltime *pnow = Curl_pgrs_now(data);
+
+  vquic_ctx_update_time(&ctx->q, pnow);
+  pktx->ts = ((ngtcp2_tstamp)pnow->tv_sec * NGTCP2_SECONDS) +
+             ((ngtcp2_tstamp)pnow->tv_usec * NGTCP2_MICROSECONDS);
+}
+
+#if NGTCP2_VERSION_NUM < 0x011100
+struct cf_ngtcp2_sfind_ctx {
+  int64_t stream_id;
+  struct h3_stream_ctx *stream;
+  uint32_t mid;
+};
+
+static bool cf_ngtcp2_sfind(uint32_t mid, void *value, void *user_data)
+{
+  struct cf_ngtcp2_sfind_ctx *fctx = user_data;
+  struct h3_stream_ctx *stream = value;
+
+  if(fctx->stream_id == stream->id) {
+    fctx->mid = mid;
+    fctx->stream = stream;
+    return FALSE;
+  }
+  return TRUE; /* continue */
+}
+
+static struct h3_stream_ctx *cf_ngtcp2_get_stream(struct cf_ngtcp2_ctx *ctx,
+                                                  int64_t stream_id)
+{
+  struct cf_ngtcp2_sfind_ctx fctx;
+  fctx.stream_id = stream_id;
+  fctx.stream = NULL;
+  Curl_uint32_hash_visit(&ctx->streams, cf_ngtcp2_sfind, &fctx);
+  return fctx.stream;
+}
+#else
+static struct h3_stream_ctx *cf_ngtcp2_get_stream(struct cf_ngtcp2_ctx *ctx,
+                                                  int64_t stream_id)
+{
+  struct Curl_easy *data =
+    ngtcp2_conn_get_stream_user_data(ctx->qconn, stream_id);
+
+  if(!data) {
+    return NULL;
+  }
+
+  return H3_STREAM_CTX(ctx, data);
+}
+#endif
+
+/**
+ * Read a network packet to send from ngtcp2 into `buf`.
+ * Return number of bytes written or -1 with *err set.
+ */
+static CURLcode read_pkt_to_send(void *userp,
+                                 unsigned char *buf, size_t buflen,
+                                 size_t *pnread)
+{
+  struct cf_ngtcp2_io_ctx *x = userp;
+  struct cf_ngtcp2_ctx *ctx = x->cf->ctx;
+  nghttp3_vec vec[16];
+  nghttp3_ssize veccnt;
+  ngtcp2_ssize ndatalen;
+  uint32_t flags;
+  int64_t stream_id;
+  int fin;
+  ssize_t n;
+
+  *pnread = 0;
+  veccnt = 0;
+  stream_id = -1;
+  fin = 0;
+
+  /* ngtcp2 may want to put several frames from different streams into
+   * this packet. `NGTCP2_WRITE_STREAM_FLAG_MORE` tells it to do so.
+   * When `NGTCP2_ERR_WRITE_MORE` is returned, we *need* to make
+   * another iteration.
+   * When ngtcp2 is happy (because it has no other frame that would fit
+   * or it has nothing more to send), it returns the total length
+   * of the assembled packet. This may be 0 if there was nothing to send. */
+  for(;;) {
+
+    if(ctx->h3conn && ngtcp2_conn_get_max_data_left(ctx->qconn)) {
+      veccnt = nghttp3_conn_writev_stream(ctx->h3conn, &stream_id, &fin, vec,
+                                          CURL_ARRAYSIZE(vec));
+      if(veccnt < 0) {
+        failf(x->data, "nghttp3_conn_writev_stream returned error: %s",
+              nghttp3_strerror((int)veccnt));
+        Curl_cf_ngtcp2_h3_err_set(x->cf, x->data, (int)veccnt);
+        return CURLE_SEND_ERROR;
+      }
+    }
+
+    flags = NGTCP2_WRITE_STREAM_FLAG_MORE |
+            (fin ? NGTCP2_WRITE_STREAM_FLAG_FIN : 0);
+    n = ngtcp2_conn_writev_stream(ctx->qconn, &x->ps.path,
+                                  NULL, buf, buflen,
+                                  &ndatalen, flags, stream_id,
+                                  (const ngtcp2_vec *)vec, veccnt, x->ts);
+    if(n == 0) {
+      /* nothing to send */
+      return CURLE_AGAIN;
+    }
+    else if(n < 0) {
+      switch(n) {
+      case NGTCP2_ERR_STREAM_DATA_BLOCKED: {
+        struct h3_stream_ctx *stream;
+        DEBUGASSERT(ndatalen == -1);
+        nghttp3_conn_block_stream(ctx->h3conn, stream_id);
+        CURL_TRC_CF(x->data, x->cf, "[%" PRId64 "] block quic flow",
+                    stream_id);
+        stream = cf_ngtcp2_get_stream(ctx, stream_id);
+        if(stream) /* it might be not one of our h3 streams? */
+          stream->quic_flow_blocked = TRUE;
+        n = 0;
+        break;
+      }
+      case NGTCP2_ERR_STREAM_SHUT_WR:
+        DEBUGASSERT(ndatalen == -1);
+        nghttp3_conn_shutdown_stream_write(ctx->h3conn, stream_id);
+        n = 0;
+        break;
+      case NGTCP2_ERR_WRITE_MORE:
+        /* ngtcp2 wants to send more. update the flow of the stream whose data
+         * is in the buffer and continue */
+        DEBUGASSERT(ndatalen >= 0);
+        n = 0;
+        break;
+      default:
+        DEBUGASSERT(ndatalen == -1);
+        failf(x->data, "ngtcp2_conn_writev_stream returned error: %s",
+              ngtcp2_strerror((int)n));
+        Curl_cf_ngtcp2_cmn_err_set(x->cf, x->data, (int)n);
+        return CURLE_SEND_ERROR;
+      }
+    }
+
+    if(ndatalen >= 0) {
+      /* we add the amount of data bytes to the flow windows */
+      int rv = nghttp3_conn_add_write_offset(ctx->h3conn, stream_id, ndatalen);
+      if(rv) {
+        failf(x->data, "nghttp3_conn_add_write_offset returned error: %s",
+              nghttp3_strerror(rv));
+        return CURLE_SEND_ERROR;
+      }
+    }
+
+    if(n > 0) {
+      /* packet assembled, leave */
+      *pnread = (size_t)n;
+      return CURLE_OK;
+    }
+  }
+}
+
+CURLcode Curl_cf_ngtcp2_progress_egress(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data,
+                                        struct cf_ngtcp2_io_ctx *pktx)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  size_t nread;
+  size_t max_payload_size, path_max_payload_size;
+  size_t pktcnt = 0;
+  size_t gsolen = 0;  /* this disables gso until we have a clue */
+  size_t send_quantum;
+  CURLcode result;
+  struct cf_ngtcp2_io_ctx local_pktx;
+
+  if(!pktx) {
+    Curl_cf_ngtcp2_io_ctx_init(&local_pktx, cf, data);
+    pktx = &local_pktx;
+  }
+  else {
+    Curl_cf_ngtcp2_io_ctx_update_time(data, pktx, cf);
+    ngtcp2_path_storage_zero(&pktx->ps);
+  }
+
+  result = vquic_flush(cf, data, &ctx->q);
+  if(result) {
+    if(result == CURLE_AGAIN) {
+      Curl_expire(data, 1, EXPIRE_QUIC);
+      return CURLE_OK;
+    }
+    return result;
+  }
+
+  /* In UDP, there is a maximum theoretical packet payload length and
+   * a minimum payload length that is "guaranteed" to work.
+   * To detect if this minimum payload can be increased, ngtcp2 sends
+   * now and then a packet payload larger than the minimum. It that
+   * is ACKed by the peer, both parties know that it works and
+   * the subsequent packets can use a larger one.
+   * This is called PMTUD (Path Maximum Transmission Unit Discovery).
+   * Since a PMTUD might be rejected right on send, we do not want it
+   * be followed by other packets of lesser size. Because those would
+   * also fail then. If we detect a PMTUD while buffering, we flush.
+   */
+  max_payload_size = ngtcp2_conn_get_max_tx_udp_payload_size(ctx->qconn);
+  path_max_payload_size =
+    ngtcp2_conn_get_path_max_tx_udp_payload_size(ctx->qconn);
+  send_quantum = ngtcp2_conn_get_send_quantum(ctx->qconn);
+  CURL_TRC_CF(data, cf, "egress, collect and send packets, quantum=%zu",
+              send_quantum);
+  for(;;) {
+    /* add the next packet to send, if any, to our buffer */
+    result = Curl_bufq_sipn(&ctx->q.sendbuf, max_payload_size,
+                            read_pkt_to_send, pktx, &nread);
+    if(result == CURLE_AGAIN)
+      break;
+    else if(result)
+      return result;
+    else {
+      size_t buflen = Curl_bufq_len(&ctx->q.sendbuf);
+      if((buflen >= send_quantum) ||
+         ((buflen + gsolen) >= ctx->q.sendbuf.chunk_size))
+        break;
+      DEBUGASSERT(nread > 0);
+      ++pktcnt;
+      if(pktcnt == 1) {
+        /* first packet in buffer. This is either of a known, "good"
+         * payload size or it is a PMTUD. We shall see. */
+        gsolen = nread;
+      }
+      else if(nread > gsolen ||
+              (gsolen > path_max_payload_size && nread != gsolen)) {
+        /* The added packet is a PMTUD *or* the one(s) before the
+         * added were PMTUD and the last one is smaller.
+         * Flush the buffer before the last add. */
+        result = vquic_send_tail_split(cf, data, &ctx->q,
+                                       gsolen, nread, nread);
+        if(result) {
+          if(result == CURLE_AGAIN) {
+            Curl_expire(data, 1, EXPIRE_QUIC);
+            return CURLE_OK;
+          }
+          return result;
+        }
+        pktcnt = 0;
+      }
+      else if(nread < gsolen) {
+        /* Reached capacity of our buffer *or*
+         * last add was shorter than the previous ones, flush */
+        break;
+      }
+    }
+  }
+
+  if(!Curl_bufq_is_empty(&ctx->q.sendbuf)) {
+    /* time to send */
+    CURL_TRC_CF(data, cf, "egress, send collected %zu packets in %zu bytes",
+                pktcnt, Curl_bufq_len(&ctx->q.sendbuf));
+    result = vquic_send(cf, data, &ctx->q, gsolen);
+    if(result) {
+      if(result == CURLE_AGAIN) {
+        Curl_expire(data, 1, EXPIRE_QUIC);
+        return CURLE_OK;
+      }
+      return result;
+    }
+    Curl_cf_ngtcp2_io_ctx_update_time(data, pktx, cf);
+    ngtcp2_conn_update_pkt_tx_time(ctx->qconn, pktx->ts);
+  }
+  return CURLE_OK;
+}
+
+struct cf_ngtcp2_recv_ctx {
+  struct cf_ngtcp2_io_ctx *pktx;
+  size_t pkt_count;
+};
+
+static CURLcode cf_ngtcp2_recv_pkts(const unsigned char *buf, size_t buflen,
+                                    size_t gso_size,
+                                    struct sockaddr_storage *remote_addr,
+                                    socklen_t remote_addrlen, int ecn,
+                                    void *userp)
+{
+  struct cf_ngtcp2_recv_ctx *rctx = userp;
+  struct cf_ngtcp2_io_ctx *pktx = rctx->pktx;
+  struct cf_ngtcp2_ctx *ctx = pktx->cf->ctx;
+  ngtcp2_pkt_info pi;
+  ngtcp2_path path;
+  size_t offset, pktlen;
+  int rv;
+
+  if(!rctx->pkt_count) {
+    Curl_cf_ngtcp2_io_ctx_update_time(pktx->data, pktx, pktx->cf);
+    ngtcp2_path_storage_zero(&pktx->ps);
+  }
+
+  if(ecn)
+    CURL_TRC_CF(pktx->data, pktx->cf, "vquic_recv(len=%zu, gso=%zu, ecn=%x)",
+                buflen, gso_size, (unsigned int)ecn);
+  ngtcp2_addr_init(&path.local, (struct sockaddr *)&ctx->q.local_addr,
+                   ctx->q.local_addrlen);
+  ngtcp2_addr_init(&path.remote, (struct sockaddr *)remote_addr,
+                   remote_addrlen);
+  pi.ecn = (uint8_t)ecn;
+
+  for(offset = 0; offset < buflen; offset += gso_size) {
+    rctx->pkt_count++;
+    pktlen = ((offset + gso_size) <= buflen) ? gso_size : (buflen - offset);
+    rv = ngtcp2_conn_read_pkt(ctx->qconn, &path, &pi,
+                              buf + offset, pktlen, pktx->ts);
+    if(rv) {
+      CURL_TRC_CF(pktx->data, pktx->cf, "ingress, read_pkt -> %s (%d)",
+                  ngtcp2_strerror(rv), rv);
+      Curl_cf_ngtcp2_cmn_err_set(pktx->cf, pktx->data, rv);
+
+      if(rv == NGTCP2_ERR_CRYPTO)
+        /* this is a "TLS problem", but a failed certificate verification
+           is a common reason for this */
+        return CURLE_PEER_FAILED_VERIFICATION;
+      return CURLE_RECV_ERROR;
+    }
+  }
+  return CURLE_OK;
+}
+
+CURLcode Curl_cf_ngtcp2_progress_ingress(struct Curl_cfilter *cf,
+                                         struct Curl_easy *data,
+                                         struct cf_ngtcp2_io_ctx *pktx)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct cf_ngtcp2_io_ctx local_pktx;
+  struct cf_ngtcp2_recv_ctx rctx;
+  CURLcode result = CURLE_OK;
+
+  if(!pktx) {
+    Curl_cf_ngtcp2_io_ctx_init(&local_pktx, cf, data);
+    pktx = &local_pktx;
+  }
+
+  result = Curl_vquic_tls_before_recv(&ctx->tls, cf, data);
+  if(result)
+    return result;
+
+  rctx.pktx = pktx;
+  rctx.pkt_count = 0;
+
+  if(ctx->q.sockfd != CURL_SOCKET_BAD) {
+    /* Direct UDP socket (via happy eyeballs) */
+    CURL_TRC_CF(data, cf, "progress_ingress(socket)");
+    return vquic_recv_packets(cf, data, &ctx->q, 1000,
+                              cf_ngtcp2_recv_pkts, &rctx);
+  }
+  else {
+    /* Tunneled QUIC (CONNECT-UDP through proxy) */
+    unsigned char *buf;
+    size_t max_udp_payload = QUIC_TUNNEL_INBUF_SIZE;
+    size_t pkt_limit = QUIC_TUNNEL_INGRESS_PKT_LIMIT;
+    size_t nread;
+    struct sockaddr_storage remote_addr;
+    socklen_t remote_addrlen;
+
+    CURL_TRC_CF(data, cf, "progress_ingress(sub-filters)");
+    if(ctx->qconn) {
+      size_t max_path_payload;
+      max_path_payload =
+        ngtcp2_conn_get_path_max_tx_udp_payload_size(ctx->qconn);
+      if(max_path_payload > max_udp_payload)
+        max_udp_payload = max_path_payload;
+    }
+
+    if(ctx->tunnel_inbuf_len < max_udp_payload) {
+      unsigned char *newbuf = curlx_realloc(ctx->tunnel_inbuf,
+                                            max_udp_payload);
+      if(!newbuf)
+        return CURLE_OUT_OF_MEMORY;
+      ctx->tunnel_inbuf = newbuf;
+      ctx->tunnel_inbuf_len = max_udp_payload;
+    }
+    buf = ctx->tunnel_inbuf;
+
+    while(pkt_limit--) {
+      result = Curl_conn_cf_recv(cf->next, data, (char *)buf,
+                                 ctx->tunnel_inbuf_len, &nread);
+      if(result == CURLE_AGAIN) {
+        /* no more data available at the moment */
+        return CURLE_OK;
+      }
+      if(result) {
+        CURL_TRC_CF(data, cf, "ingress, recv from tunnel failed: %d",
+                    (int)result);
+        return result;
+      }
+      if(nread == 0) {
+        /* tunnel closed */
+        return CURLE_OK;
+      }
+
+      memcpy(&remote_addr, ctx->connected_path.remote.addr,
+             ctx->connected_path.remote.addrlen);
+      remote_addrlen = (socklen_t)ctx->connected_path.remote.addrlen;
+      result = cf_ngtcp2_recv_pkts(buf, nread, nread, &remote_addr,
+                                   remote_addrlen, 0, &rctx);
+      if(result)
+        return result;
+
+      if(!ctx->q.got_first_byte) {
+        ctx->q.got_first_byte = TRUE;
+        ctx->q.first_byte_at = ctx->q.last_op;
+      }
+      ctx->q.last_io = ctx->q.last_op;
+    }
+    return CURLE_OK;
+  }
+}
+
+/**
+ * Connection maintenance like timeouts on packet ACKs etc. are done by us, not
+ * the OS like for TCP. POLL events on the socket therefore are not
+ * sufficient.
+ * ngtcp2 tells us when it wants to be invoked again. We handle that via
+ * the `Curl_expire()` mechanisms.
+ */
+CURLcode Curl_cf_ngtcp2_cmn_set_expiry(struct Curl_cfilter *cf,
+                                       struct Curl_easy *data,
+                                       struct cf_ngtcp2_io_ctx *pktx)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct cf_ngtcp2_io_ctx local_pktx;
+  ngtcp2_tstamp expiry;
+
+  if(!pktx) {
+    Curl_cf_ngtcp2_io_ctx_init(&local_pktx, cf, data);
+    pktx = &local_pktx;
+  }
+  else {
+    Curl_cf_ngtcp2_io_ctx_update_time(data, pktx, cf);
+  }
+
+  expiry = ngtcp2_conn_get_expiry(ctx->qconn);
+  if(expiry != UINT64_MAX) {
+    if(expiry <= pktx->ts) {
+      CURLcode result;
+      int rv = ngtcp2_conn_handle_expiry(ctx->qconn, pktx->ts);
+      if(rv) {
+        failf(data, "ngtcp2_conn_handle_expiry returned error: %s",
+              ngtcp2_strerror(rv));
+        Curl_cf_ngtcp2_cmn_err_set(cf, data, rv);
+        return CURLE_SEND_ERROR;
+      }
+      result = Curl_cf_ngtcp2_progress_ingress(cf, data, pktx);
+      if(result)
+        return result;
+      result = Curl_cf_ngtcp2_progress_egress(cf, data, pktx);
+      if(result)
+        return result;
+      /* ask again, things might have changed */
+      expiry = ngtcp2_conn_get_expiry(ctx->qconn);
+    }
+
+    if(expiry > pktx->ts) {
+      ngtcp2_duration timeout = expiry - pktx->ts;
+      if(timeout % NGTCP2_MILLISECONDS) {
+        timeout += NGTCP2_MILLISECONDS;
+      }
+      Curl_expire(data, (timediff_t)(timeout / NGTCP2_MILLISECONDS),
+                  EXPIRE_QUIC);
+    }
+  }
+  return CURLE_OK;
+}
+
+static void cf_ngtcp2_setup_keep_alive(struct Curl_cfilter *cf,
+                                       struct Curl_easy *data)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  const ngtcp2_transport_params *rp;
+  /* Peer should have sent us its transport parameters. If it
+   * announces a positive `max_idle_timeout` it closes the
+   * connection when it does not hear from us for that time.
+   *
+   * Some servers use this as a keep-alive timer at a rather low
+   * value. We are doing HTTP/3 here and waiting for the response
+   * to a request may take a considerable amount of time. We need
+   * to prevent the peer's QUIC stack from closing in this case.
+   */
+  if(!ctx->qconn)
+    return;
+
+  rp = ngtcp2_conn_get_remote_transport_params(ctx->qconn);
+  if(!rp || !rp->max_idle_timeout) {
+    ngtcp2_conn_set_keep_alive_timeout(ctx->qconn, UINT64_MAX);
+    CURL_TRC_CF(data, cf, "no peer idle timeout, unset keep-alive");
+  }
+  else if(!Curl_uint32_hash_count(&ctx->streams)) {
+    ngtcp2_conn_set_keep_alive_timeout(ctx->qconn, UINT64_MAX);
+    CURL_TRC_CF(data, cf, "no active streams, unset keep-alive");
+  }
+  else {
+    ngtcp2_duration keep_ns;
+    keep_ns = (rp->max_idle_timeout > 1) ? (rp->max_idle_timeout / 2) : 1;
+    ngtcp2_conn_set_keep_alive_timeout(ctx->qconn, keep_ns);
+    CURL_TRC_CF(data, cf, "peer idle timeout is %" PRIu64 "ms, "
+                "set keep-alive to %" PRIu64 " ms.",
+                (rp->max_idle_timeout / NGTCP2_MILLISECONDS),
+                (keep_ns / NGTCP2_MILLISECONDS));
+  }
+}
+
+CURLcode Curl_cf_ngtcp2_h3_stream_setup(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+
+  if(!data)
+    return CURLE_FAILED_INIT;
+
+  if(stream)
+    return CURLE_OK;
+
+  stream = curlx_calloc(1, sizeof(*stream));
+  if(!stream)
+    return CURLE_OUT_OF_MEMORY;
+
+  stream->id = -1;
+  stream->rx_offset = 0;
+  stream->rx_offset_max = H3_STREAM_WINDOW_SIZE_INITIAL;
+
+  /* on send, we control how much we put into the buffer */
+  Curl_bufq_initp(&stream->sendbuf, &ctx->stream_bufcp,
+                  H3_STREAM_SEND_CHUNKS, BUFQ_OPT_NONE);
+  stream->sendbuf_len_in_flight = 0;
+  stream->window_size_max = H3_STREAM_WINDOW_SIZE_INITIAL;
+  Curl_h1_req_parse_init(&stream->h1, H1_PARSE_DEFAULT_MAX_LINE_LEN);
+
+  if(!Curl_uint32_hash_set(&ctx->streams, data->mid, stream)) {
+    Curl_cf_ngtcp2_h3_stream_ctx_free(stream);
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  if(Curl_uint32_hash_count(&ctx->streams) == 1)
+    cf_ngtcp2_setup_keep_alive(cf, data);
+
+  return CURLE_OK;
+}
+
+void Curl_cf_ngtcp2_h3_stream_close(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    struct h3_stream_ctx *stream)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  DEBUGASSERT(data);
+  DEBUGASSERT(stream);
+  if(!stream->closed && ctx->qconn && ctx->h3conn) {
+    CURLcode result;
+
+    nghttp3_conn_set_stream_user_data(ctx->h3conn, stream->id, NULL);
+    ngtcp2_conn_set_stream_user_data(ctx->qconn, stream->id, NULL);
+    stream->closed = TRUE;
+    (void)ngtcp2_conn_shutdown_stream(ctx->qconn, 0, stream->id,
+                                      NGHTTP3_H3_REQUEST_CANCELLED);
+    result = Curl_cf_ngtcp2_progress_egress(cf, data, NULL);
+    if(result)
+      CURL_TRC_CF(data, cf, "[%" PRId64 "] cancel stream -> %d",
+                  stream->id, (int)result);
+  }
+}
+
+void Curl_cf_ngtcp2_h3_stream_done(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+  (void)cf;
+  if(stream) {
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] easy handle is done", stream->id);
+    Curl_cf_ngtcp2_h3_stream_close(cf, data, stream);
+    Curl_uint32_hash_remove(&ctx->streams, data->mid);
+    if(!Curl_uint32_hash_count(&ctx->streams))
+      cf_ngtcp2_setup_keep_alive(cf, data);
+  }
+}
+
+bool Curl_cf_ngtcp2_cmn_conn_is_alive(struct Curl_cfilter *cf,
+                                      struct Curl_easy *data,
+                                      bool *input_pending)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  bool alive = FALSE;
+  const ngtcp2_transport_params *rp;
+  struct cf_call_data save;
+
+  CF_DATA_SAVE(save, cf, data);
+  *input_pending = FALSE;
+  if(!ctx->qconn || ctx->shutdown_started)
+    goto out;
+
+  /* We do not announce a max idle timeout, but when the peer does
+   * it closes the connection when it expires. */
+  rp = ngtcp2_conn_get_remote_transport_params(ctx->qconn);
+  if(rp && rp->max_idle_timeout) {
+    timediff_t idletime_ms =
+      curlx_ptimediff_ms(Curl_pgrs_now(data), &ctx->q.last_io);
+    if(idletime_ms > 0) {
+      uint64_t max_idle_ms =
+        (uint64_t)(rp->max_idle_timeout / NGTCP2_MILLISECONDS);
+      if((uint64_t)idletime_ms > max_idle_ms)
+        goto out;
+    }
+  }
+
+  if(!cf->next || !cf->next->cft->is_alive(cf->next, data, input_pending))
+    goto out;
+
+  alive = TRUE;
+  if(*input_pending) {
+    CURLcode result;
+    /* This happens before we have sent off a request and the connection is
+       not in use by any other transfer, there should not be any data here,
+       only "protocol frames" */
+    *input_pending = FALSE;
+    result = Curl_cf_ngtcp2_progress_ingress(cf, data, NULL);
+    CURL_TRC_CF(data, cf, "is_alive, progress ingress -> %d", (int)result);
+    alive = result ? FALSE : TRUE;
+  }
+
+out:
+  CF_DATA_RESTORE(cf, save);
+  return alive;
+}
+
+CURLcode Curl_cf_ngtcp2_h3_init_ctrls(struct cf_ngtcp2_ctx *ctx,
+                                      struct Curl_easy *data)
+{
+  int64_t ctrl_stream_id, qpack_enc_stream_id, qpack_dec_stream_id;
+  int rc;
+
+  rc = ngtcp2_conn_open_uni_stream(ctx->qconn, &ctrl_stream_id, NULL);
+  if(rc) {
+    failf(data, "error creating HTTP/3 control stream: %s",
+          ngtcp2_strerror(rc));
+    return CURLE_QUIC_CONNECT_ERROR;
+  }
+  rc = nghttp3_conn_bind_control_stream(ctx->h3conn, ctrl_stream_id);
+  if(rc) {
+    failf(data, "error binding HTTP/3 control stream: %s",
+          ngtcp2_strerror(rc));
+    return CURLE_QUIC_CONNECT_ERROR;
+  }
+  rc = ngtcp2_conn_open_uni_stream(ctx->qconn, &qpack_enc_stream_id, NULL);
+  if(rc) {
+    failf(data, "error creating HTTP/3 qpack encoding stream: %s",
+          ngtcp2_strerror(rc));
+    return CURLE_QUIC_CONNECT_ERROR;
+  }
+  rc = ngtcp2_conn_open_uni_stream(ctx->qconn, &qpack_dec_stream_id, NULL);
+  if(rc) {
+    failf(data, "error creating HTTP/3 qpack decoding stream: %s",
+          ngtcp2_strerror(rc));
+    return CURLE_QUIC_CONNECT_ERROR;
+  }
+  rc = nghttp3_conn_bind_qpack_streams(ctx->h3conn, qpack_enc_stream_id,
+                                       qpack_dec_stream_id);
+  if(rc) {
+    failf(data, "error binding HTTP/3 qpack streams: %s", ngtcp2_strerror(rc));
+    return CURLE_QUIC_CONNECT_ERROR;
+  }
+  return CURLE_OK;
+}
+
+#endif /* !CURL_DISABLE_HTTP && USE_NGTCP2 && USE_NGHTTP3 */
diff --git a/third-party/curl/lib/vquic/cf-ngtcp2-cmn.h b/third-party/curl/lib/vquic/cf-ngtcp2-cmn.h
new file mode 100644
index 0000000000..88554edfb6
--- /dev/null
+++ b/third-party/curl/lib/vquic/cf-ngtcp2-cmn.h
@@ -0,0 +1,239 @@
+#ifndef HEADER_CURL_VQUIC_CF_NGTCP2_CMN_H
+#define HEADER_CURL_VQUIC_CF_NGTCP2_CMN_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_NGTCP2) && defined(USE_NGHTTP3)
+
+#include <ngtcp2/ngtcp2.h>
+#include <ngtcp2/ngtcp2_crypto.h>
+
+#ifdef USE_OPENSSL
+#include <openssl/err.h>
+#if defined(OPENSSL_IS_AWSLC) || defined(OPENSSL_IS_BORINGSSL)
+#include <ngtcp2/ngtcp2_crypto_boringssl.h>
+#elif defined(OPENSSL_QUIC_API2)
+#include <ngtcp2/ngtcp2_crypto_ossl.h>
+#else
+#include <ngtcp2/ngtcp2_crypto_quictls.h>
+#endif
+#include "vtls/openssl.h"
+#elif defined(USE_GNUTLS)
+#include <ngtcp2/ngtcp2_crypto_gnutls.h>
+#include "vtls/gtls.h"
+#elif defined(USE_WOLFSSL)
+#include <wolfssl/options.h>
+#include <wolfssl/ssl.h>
+#include <wolfssl/quic.h>
+#include <ngtcp2/ngtcp2_crypto_wolfssl.h>
+#include "vtls/wolfssl.h"
+#endif
+
+#ifdef HAVE_NETINET_UDP_H
+#include <netinet/udp.h>
+#endif
+
+#include <nghttp3/nghttp3.h>
+
+#include "http1.h"
+#include "uint-hash.h"
+#include "vtls/vtls.h"
+#include "vquic/vquic_int.h"
+#include "vquic/vquic-tls.h"
+
+struct Curl_cfilter;
+struct Curl_easy;
+struct cf_ngtcp2_ctx;
+struct cf_quic_ctx;
+
+#define QUIC_MAX_STREAMS       (256 * 1024)
+#define QUIC_HANDSHAKE_TIMEOUT (10 * NGTCP2_SECONDS)
+#define QUIC_TUNNEL_INBUF_SIZE (64 * 1024)
+
+/* We announce a small window size in transport param to the server,
+ * and grow that immediately to max when no rate limit is in place.
+ * We need to start small as we are not able to decrease it. */
+#define H3_STREAM_WINDOW_SIZE_INITIAL (32 * 1024)
+#define H3_STREAM_WINDOW_SIZE_MAX     (10 * 1024 * 1024)
+#define H3_CONN_WINDOW_SIZE_MAX       (100 * H3_STREAM_WINDOW_SIZE_MAX)
+
+#define H3_STREAM_CHUNK_SIZE  (64 * 1024)
+#if H3_STREAM_CHUNK_SIZE < NGTCP2_MAX_UDP_PAYLOAD_SIZE
+#error H3_STREAM_CHUNK_SIZE smaller than NGTCP2_MAX_UDP_PAYLOAD_SIZE
+#endif
+/* The pool keeps spares around and half of a full stream window
+ * seems good. More does not seem to improve performance.
+ * The benefit of the pool is that stream buffers do not keep
+ * spares. Memory consumption goes down when streams run empty,
+ * have a large upload done, etc. */
+#define H3_STREAM_POOL_SPARES      2
+/* The max amount of un-acked upload data we keep around per stream */
+#define H3_STREAM_SEND_BUFFER_MAX      (10 * 1024 * 1024)
+#define H3_STREAM_SEND_CHUNKS \
+  (H3_STREAM_SEND_BUFFER_MAX / H3_STREAM_CHUNK_SIZE)
+#define QUIC_TUNNEL_INGRESS_PKT_LIMIT 1000
+
+
+void Curl_ngtcp2_ver(char *p, size_t len);
+
+typedef CURLcode cf_ngtcp2_init_h3_conn(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data,
+                                        struct cf_ngtcp2_ctx *ctx);
+
+struct cf_ngtcp2_ctx {
+  struct cf_quic_ctx q;
+  struct ssl_peer ssl_peer;
+  struct curl_tls_ctx tls;
+#ifdef OPENSSL_QUIC_API2
+  ngtcp2_crypto_ossl_ctx *ossl_ctx;
+#endif
+  ngtcp2_path connected_path;
+  ngtcp2_conn *qconn;
+  ngtcp2_cid dcid;
+  ngtcp2_cid scid;
+  uint32_t version;
+  ngtcp2_settings settings;
+  ngtcp2_transport_params transport_params;
+  ngtcp2_ccerr last_error;
+  ngtcp2_crypto_conn_ref conn_ref;
+  struct cf_call_data call_data;
+  cf_ngtcp2_init_h3_conn *init_h3_conn_cb;
+  nghttp3_conn *h3conn;
+  nghttp3_settings h3settings;
+  struct curltime started_at;       /* time the current attempt started */
+  struct curltime handshake_at;     /* time connect handshake finished */
+  struct bufc_pool stream_bufcp;    /* chunk pool for streams */
+  struct dynbuf scratch;            /* temp buffer for header construction */
+  struct uint_hash streams;         /* hash data->mid to h3_stream_ctx */
+  uint64_t used_bidi_streams;       /* bidi streams we have opened */
+  uint64_t max_bidi_streams;        /* max bidi streams we can open */
+  size_t earlydata_max;             /* max amount of early data supported by
+                                       server on session reuse */
+  size_t earlydata_skip;            /* sending bytes to skip when earlydata
+                                       is accepted by peer */
+  CURLcode tls_vrfy_result;         /* result of TLS peer verification */
+  int qlogfd;
+  unsigned char *tunnel_inbuf;      /* ingress buffer for tunneled packets */
+  size_t tunnel_inbuf_len;
+  BIT(initialized);
+  BIT(tls_handshake_complete);      /* TLS handshake is done */
+  BIT(use_earlydata);               /* Using 0RTT data */
+  BIT(earlydata_accepted);          /* 0RTT was accepted by server */
+  BIT(shutdown_started);            /* queued shutdown packets */
+};
+
+/* How to access `call_data` from a cf_ngtcp2 filter */
+#undef CF_CTX_CALL_DATA
+#define CF_CTX_CALL_DATA(cf) ((struct cf_ngtcp2_ctx *)(cf)->ctx)->call_data
+
+CURLcode Curl_cf_ngtcp2_ctx_init(struct cf_ngtcp2_ctx *ctx,
+                                 struct Curl_peer *origin,
+                                 struct Curl_peer *peer,
+                                 struct ssl_primary_config *sslc,
+                                 cf_ngtcp2_init_h3_conn *init_h3_conn_cb);
+void Curl_cf_ngtcp2_ctx_cleanup(struct cf_ngtcp2_ctx *ctx);
+void Curl_cf_ngtcp2_cmn_err_set(struct Curl_cfilter *cf,
+                                struct Curl_easy *data, int code);
+
+/**
+ * All about the H3 internals of a stream
+ */
+struct h3_stream_ctx {
+  int64_t id;                   /* HTTP/3 stream identifier */
+  struct bufq sendbuf;          /* h3 request body */
+  struct h1_req_parser h1;      /* h1 request parsing */
+  size_t sendbuf_len_in_flight; /* sendbuf amount "in flight" */
+  uint64_t error3;              /* HTTP/3 stream error code */
+  curl_off_t upload_left;       /* number of request bytes left to upload */
+  curl_off_t rx_total;          /* total number of bytes received */
+  uint64_t rx_offset;           /* current receive offset */
+  uint64_t rx_offset_max;       /* allowed receive offset */
+  uint64_t window_size_max;     /* max flow control window set for stream */
+  int status_code;              /* HTTP status code */
+  CURLcode xfer_result;         /* result from xfer_resp_write(_hd) */
+  BIT(resp_hds_complete);       /* we have a complete, final response */
+  BIT(closed);                  /* TRUE on stream close */
+  BIT(reset);                   /* TRUE on stream reset */
+  BIT(send_closed);             /* stream is local closed */
+  BIT(quic_flow_blocked);       /* stream is blocked by QUIC flow control */
+};
+
+void Curl_cf_ngtcp2_h3_stream_ctx_free(struct h3_stream_ctx *stream);
+void Curl_cf_ngtcp2_h3_err_set(struct Curl_cfilter *cf,
+                               struct Curl_easy *data, int code);
+
+CURLcode Curl_cf_ngtcp2_h3_init_ctrls(struct cf_ngtcp2_ctx *ctx,
+                                      struct Curl_easy *data);
+
+CURLcode Curl_cf_ngtcp2_cmn_connect(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    bool *done);
+
+CURLcode Curl_cf_ngtcp2_cmn_shutdown(struct Curl_cfilter *cf,
+                                     struct Curl_easy *data, bool *done);
+void Curl_cf_ngtcp2_cmn_conn_close(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data);
+
+struct cf_ngtcp2_io_ctx {
+  struct Curl_cfilter *cf;
+  struct Curl_easy *data;
+  ngtcp2_tstamp ts;
+  ngtcp2_path_storage ps;
+};
+
+void Curl_cf_ngtcp2_io_ctx_init(struct cf_ngtcp2_io_ctx *io_ctx,
+                                struct Curl_cfilter *cf,
+                                struct Curl_easy *data);
+void Curl_cf_ngtcp2_io_ctx_update_time(struct Curl_easy *data,
+                                       struct cf_ngtcp2_io_ctx *pktx,
+                                       struct Curl_cfilter *cf);
+
+CURLcode Curl_cf_ngtcp2_progress_egress(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data,
+                                        struct cf_ngtcp2_io_ctx *pktx);
+
+CURLcode Curl_cf_ngtcp2_progress_ingress(struct Curl_cfilter *cf,
+                                         struct Curl_easy *data,
+                                         struct cf_ngtcp2_io_ctx *pktx);
+
+CURLcode Curl_cf_ngtcp2_cmn_set_expiry(struct Curl_cfilter *cf,
+                                       struct Curl_easy *data,
+                                       struct cf_ngtcp2_io_ctx *pktx);
+
+CURLcode Curl_cf_ngtcp2_h3_stream_setup(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data);
+void Curl_cf_ngtcp2_h3_stream_close(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    struct h3_stream_ctx *stream);
+void Curl_cf_ngtcp2_h3_stream_done(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data);
+
+bool Curl_cf_ngtcp2_cmn_conn_is_alive(struct Curl_cfilter *cf,
+                                      struct Curl_easy *data,
+                                      bool *input_pending);
+
+#endif /* !CURL_DISABLE_HTTP && USE_NGTCP2 && USE_NGHTTP3 */
+
+#endif /* HEADER_CURL_VQUIC_CF_NGTCP2_CMN_H */
diff --git a/third-party/curl/lib/vquic/cf-ngtcp2-proxy.c b/third-party/curl/lib/vquic/cf-ngtcp2-proxy.c
new file mode 100644
index 0000000000..fd2840890f
--- /dev/null
+++ b/third-party/curl/lib/vquic/cf-ngtcp2-proxy.c
@@ -0,0 +1,1316 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_PROXY) && \
+  defined(USE_PROXY_HTTP3) && defined(USE_NGHTTP3) &&              \
+  defined(USE_NGTCP2) && defined(USE_OPENSSL)
+
+#include "urldata.h"
+#include "url.h"
+#include "curl_trc.h"
+#include "sendf.h"
+#include "multiif.h"
+#include "cfilters.h"
+#include "connect.h"
+#include "progress.h"
+#include "curlx/dynbuf.h"
+#include "http_proxy.h"
+#include "vquic/vquic.h"
+#include "vquic/cf-ngtcp2-cmn.h"
+#include "vquic/cf-ngtcp2-proxy.h"
+#include "capsule.h"
+
+/* A stream window is the maximum amount we need to buffer for
+ * each active transfer. We use HTTP/3 flow control and only ACK
+ * when we take things out of the buffer.
+ * Chunk size is large enough to take a full DATA frame */
+#define PROXY_H3_STREAM_RECV_CHUNKS ((512 * 1024) / H3_STREAM_CHUNK_SIZE)
+
+typedef enum {
+  H3_TUNNEL_INIT,     /* init/default/no tunnel state */
+  H3_TUNNEL_CONNECT,  /* CONNECT request is being sent */
+  H3_TUNNEL_RESPONSE, /* CONNECT response received completely */
+  H3_TUNNEL_ESTABLISHED,
+  H3_TUNNEL_FAILED
+} h3_tunnel_state;
+
+struct h3_tunnel_stream {
+  struct Curl_peer *peer;  /* where the tunnel goes to */
+  struct http_resp *resp;
+  struct bufq recvbuf;
+  char *authority;
+  struct h3_stream_ctx *stream;
+  h3_tunnel_state state;
+  BIT(udp);
+  BIT(has_final_response);
+  BIT(closed);
+};
+
+static CURLcode h3_tunnel_stream_init(struct h3_tunnel_stream *ts,
+                                      struct Curl_peer *peer,
+                                      bool udp)
+{
+  ts->state = H3_TUNNEL_INIT;
+  Curl_peer_link(&ts->peer, peer);
+  Curl_bufq_init2(&ts->recvbuf, H3_STREAM_CHUNK_SIZE,
+                  PROXY_H3_STREAM_RECV_CHUNKS, BUFQ_OPT_SOFT_LIMIT);
+  ts->udp = udp;
+  /* host:port with IPv6 support */
+  ts->authority = curl_maprintf("%s%s%s:%u", peer->ipv6 ? "[" : "",
+                                peer->hostname,
+                                peer->ipv6 ? "]" : "",
+                                peer->port);
+  if(!ts->authority)
+    return CURLE_OUT_OF_MEMORY;
+
+  return CURLE_OK;
+}
+
+static void h3_tunnel_stream_reset(struct h3_tunnel_stream *ts)
+{
+  Curl_bufq_reset(&ts->recvbuf);
+  Curl_http_resp_free(ts->resp);
+  ts->resp = NULL;
+  ts->stream = NULL;
+  ts->has_final_response = FALSE;
+  ts->closed = FALSE;
+  ts->state = H3_TUNNEL_INIT;
+}
+
+static void h3_tunnel_stream_cleanup(struct h3_tunnel_stream *ts)
+{
+  Curl_peer_unlink(&ts->peer);
+  Curl_bufq_free(&ts->recvbuf);
+  Curl_http_resp_free(ts->resp);
+  curlx_safefree(ts->authority);
+  ts->state = H3_TUNNEL_INIT;
+}
+
+static void h3_tunnel_go_state(struct Curl_cfilter *cf,
+                               struct h3_tunnel_stream *ts,
+                               h3_tunnel_state new_state,
+                               struct Curl_easy *data)
+{
+  VERBOSE(int64_t stream_id = ts->stream ? ts->stream->id : -1);
+  (void)cf;
+
+  if(ts->state == new_state)
+    return;
+
+  /* leaving this one */
+  switch(ts->state) {
+  case H3_TUNNEL_CONNECT:
+    data->req.ignorebody = FALSE;
+    break;
+  default:
+    break;
+  }
+
+  /* entering this one */
+  switch(new_state) {
+  case H3_TUNNEL_INIT:
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] -> [init]", stream_id);
+    h3_tunnel_stream_reset(ts);
+    break;
+  case H3_TUNNEL_CONNECT:
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] -> [connect]", stream_id);
+    ts->state = H3_TUNNEL_CONNECT;
+    break;
+  case H3_TUNNEL_RESPONSE:
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] -> [response]", stream_id);
+    ts->state = H3_TUNNEL_RESPONSE;
+    break;
+  case H3_TUNNEL_ESTABLISHED:
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] -> [established]", stream_id);
+    infof(data, "CONNECT%s phase completed for HTTP/3 proxy",
+          ts->udp ? "-UDP" : "");
+    data->state.authproxy.done = TRUE;
+    data->state.authproxy.multipass = FALSE;
+    ts->state = new_state;
+    curlx_safefree(data->req.hd_proxy_auth);
+    break;
+  case H3_TUNNEL_FAILED:
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] -> [failed]", stream_id);
+    ts->state = new_state;
+    /* If a proxy-authorization header was used for the proxy, then we should
+       make sure that it is not accidentally used for the document request
+       after we have connected. So let's free and clear it here. */
+    curlx_safefree(data->req.hd_proxy_auth);
+    break;
+  }
+}
+
+struct cf_h3_proxy_ctx {
+  struct cf_ngtcp2_ctx ngtcp2_ctx;
+  struct h3_tunnel_stream tunnel; /* our tunnel CONNECT stream */
+  BIT(connected);
+};
+
+static CURLcode cf_ngtcp2_proxy_h3_init(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data,
+                                        struct cf_ngtcp2_ctx *ctx);
+
+static CURLcode cf_h3_proxy_ctx_init(struct cf_h3_proxy_ctx *ctx,
+                                     struct Curl_peer *origin,
+                                     struct Curl_peer *peer,
+                                     struct ssl_primary_config *sslc,
+                                     struct Curl_peer *tunnel_peer,
+                                     uint8_t tunnel_transport)
+{
+  CURLcode result;
+  result = Curl_cf_ngtcp2_ctx_init(&ctx->ngtcp2_ctx, origin, peer,
+                                   sslc, cf_ngtcp2_proxy_h3_init);
+  if(!result)
+    result = h3_tunnel_stream_init(&ctx->tunnel, tunnel_peer,
+                                   TRNSPRT_IS_DGRAM(tunnel_transport));
+  return result;
+}
+
+static void cf_h3_proxy_ctx_free(struct cf_h3_proxy_ctx *ctx)
+{
+  if(ctx) {
+    Curl_cf_ngtcp2_ctx_cleanup(&ctx->ngtcp2_ctx);
+    h3_tunnel_stream_cleanup(&ctx->tunnel);
+    curlx_free(ctx);
+  }
+}
+
+static int cb_h3_proxy_acked_req_body(nghttp3_conn *conn, int64_t stream_id,
+                                      uint64_t datalen, void *user_data,
+                                      void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_h3_proxy_ctx *pctx = cf->ctx;
+  struct h3_stream_ctx *stream;
+  size_t skiplen;
+  (void)stream_user_data;
+
+  stream = pctx->tunnel.stream;
+  if(!stream || (stream->id != stream_id))
+    return 0;
+
+  /* The server acknowledged `datalen` of bytes from our request body.
+   * This is a delta. We have kept this data in `sendbuf` for
+   * re-transmissions and can free it now. */
+  if(datalen >= (uint64_t)stream->sendbuf_len_in_flight)
+    skiplen = stream->sendbuf_len_in_flight;
+  else
+    skiplen = (size_t)datalen;
+  Curl_bufq_skip(&stream->sendbuf, skiplen);
+  stream->sendbuf_len_in_flight -= skiplen;
+
+  /* Resume upload processing if we have more data to send */
+  if(stream->sendbuf_len_in_flight < Curl_bufq_len(&stream->sendbuf)) {
+    int rv = nghttp3_conn_resume_stream(conn, stream_id);
+    if(rv && rv != NGHTTP3_ERR_STREAM_NOT_FOUND) {
+      return NGHTTP3_ERR_CALLBACK_FAILURE;
+    }
+  }
+  return 0;
+}
+
+static int cb_h3_proxy_stream_close(nghttp3_conn *conn, int64_t stream_id,
+                                    uint64_t app_error_code, void *user_data,
+                                    void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_h3_proxy_ctx *pctx = cf->ctx;
+  struct Curl_easy *data = CF_DATA_CURRENT(cf);
+  struct h3_stream_ctx *stream;
+
+  (void)conn;
+  (void)stream_user_data;
+  if(!data)
+    return NGHTTP3_ERR_CALLBACK_FAILURE;
+
+  stream = pctx->tunnel.stream;
+  if(!stream || (stream->id != stream_id))
+    return 0;
+
+  stream->closed = TRUE;
+  stream->error3 = app_error_code;
+  if(stream->error3 != NGHTTP3_H3_NO_ERROR) {
+    stream->reset = TRUE;
+    stream->send_closed = TRUE;
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] RESET: error %" PRIu64,
+                stream->id, stream->error3);
+  }
+  else
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] CLOSED", stream->id);
+  pctx->tunnel.stream = NULL;
+  pctx->tunnel.closed = TRUE;
+  Curl_multi_mark_dirty(data);
+  return 0;
+}
+
+static void cf_h3_proxy_upd_rx_win(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data,
+                                   struct h3_stream_ctx *stream)
+{
+  struct cf_h3_proxy_ctx *pctx = cf->ctx;
+  struct cf_ngtcp2_ctx *ctx = &pctx->ngtcp2_ctx;
+  uint64_t cur_win, wanted_win = H3_STREAM_WINDOW_SIZE_MAX;
+
+  /* how much does rate limiting allow us to acknowledge? */
+  if(Curl_rlimit_active(&data->progress.dl.rlimit)) {
+    int64_t avail;
+
+    /* start rate limit updates only after first bytes arrived */
+    if(!stream->rx_offset)
+      return;
+
+    avail = Curl_rlimit_avail(&data->progress.dl.rlimit, Curl_pgrs_now(data));
+    if(avail <= 0) {
+      /* nothing available, do not extend the rx offset */
+      CURL_TRC_CF(data, cf, "[%" PRId64 "] dl rate limit exhausted (%" PRId64
+                  " tokens)", stream->id, avail);
+      return;
+    }
+    wanted_win = CURLMIN((uint64_t)avail, H3_STREAM_WINDOW_SIZE_MAX);
+  }
+
+  if(stream->rx_offset_max < stream->rx_offset) {
+    DEBUGASSERT(0);
+    return;
+  }
+  cur_win = stream->rx_offset_max - stream->rx_offset;
+  if(cur_win < wanted_win) {
+    /* We have exhausted the credit we gave the QUIC peer for DATA.
+     * We extend it with the amount we can give (rate limit) */
+    uint64_t ext = wanted_win - cur_win;
+
+    ngtcp2_conn_extend_max_stream_offset(ctx->qconn, stream->id, ext);
+    ngtcp2_conn_extend_max_offset(ctx->qconn, ext);
+    stream->rx_offset_max += ext;
+    if(stream->rx_offset_max > stream->window_size_max) {
+      stream->window_size_max = stream->rx_offset_max;
+      CURL_TRC_CF(data, cf, "[%" PRId64 "] max window now -> %" PRIu64,
+                  stream->id, stream->window_size_max);
+    }
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] rx_offset_max -> %" PRIu64
+                " (ext %" PRIu64 ", win %" PRIu64 ")",
+                stream->id, stream->rx_offset_max, ext, wanted_win);
+  }
+}
+
+static int cb_h3_proxy_recv_data(nghttp3_conn *conn, int64_t stream3_id,
+                                 const uint8_t *buf, size_t buflen,
+                                 void *user_data, void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_h3_proxy_ctx *pctx = cf->ctx;
+  struct Curl_easy *data = CF_DATA_CURRENT(cf);
+  struct h3_stream_ctx *stream;
+  size_t nwritten;
+  CURLcode result = CURLE_OK;
+  (void)conn;
+  (void)stream3_id;
+  (void)stream_user_data;
+
+  stream = pctx->tunnel.stream;
+  if(!data || !stream || (stream->id != stream3_id)) {
+    return NGHTTP3_ERR_CALLBACK_FAILURE;
+  }
+
+  stream->rx_total += (curl_off_t)buflen;
+  CURL_TRC_CF(data, cf, "[cb_h3_proxy_recv_data] "
+              "[%" PRId64 "] DATA len=%zu, total=%" FMT_OFF_T,
+              stream->id, buflen, stream->rx_total);
+
+  result = Curl_bufq_write(&pctx->tunnel.recvbuf, buf, buflen, &nwritten);
+  if(result || (nwritten < buflen)) {
+    return NGHTTP3_ERR_CALLBACK_FAILURE;
+  }
+
+  /* DATA has been moved into our local recv buffer. Update stream offsets
+   * and give QUIC read credit back so long transfers over proxy tunnels
+   * do not stall on stream/connection flow-control limits. */
+  stream->rx_offset += buflen;
+  if(stream->rx_offset_max < stream->rx_offset)
+    stream->rx_offset_max = stream->rx_offset;
+
+  CURL_TRC_CF(data, cf, "[%" PRId64 "] DATA len=%zu, rx win=%" PRIu64,
+              stream->id, buflen, stream->rx_offset_max - stream->rx_offset);
+  cf_h3_proxy_upd_rx_win(cf, data, stream);
+
+  Curl_multi_mark_dirty(data);
+  return 0;
+}
+
+static int cb_h3_proxy_deferred_consume(nghttp3_conn *conn, int64_t stream_id,
+                                        size_t consumed, void *user_data,
+                                        void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_h3_proxy_ctx *pctx = cf->ctx;
+  struct cf_ngtcp2_ctx *ctx = &pctx->ngtcp2_ctx;
+  (void)conn;
+  (void)stream_user_data;
+
+  if(!ctx)
+    return 0;
+
+  /* nghttp3 has consumed bytes on the QUIC stream and we need to
+   * tell the QUIC connection to increase its flow control */
+  ngtcp2_conn_extend_max_stream_offset(ctx->qconn, stream_id, consumed);
+  ngtcp2_conn_extend_max_offset(ctx->qconn, consumed);
+
+  return 0;
+}
+
+static int cb_h3_proxy_recv_header(nghttp3_conn *conn, int64_t stream_id,
+                                   int32_t token, nghttp3_rcbuf *name,
+                                   nghttp3_rcbuf *value, uint8_t flags,
+                                   void *user_data, void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_h3_proxy_ctx *pctx = cf->ctx;
+  nghttp3_vec h3name = nghttp3_rcbuf_get_buf(name);
+  nghttp3_vec h3val = nghttp3_rcbuf_get_buf(value);
+  struct Curl_easy *data = CF_DATA_CURRENT(cf);
+  struct h3_stream_ctx *stream;
+  CURLcode result = CURLE_OK;
+  int http_status;
+  struct http_resp *resp;
+  (void)conn;
+  (void)stream_id;
+  (void)token;
+  (void)flags;
+  (void)stream_user_data;
+
+  /* stream_user_data might be NULL for control streams */
+  if(!data)
+    return NGHTTP3_ERR_CALLBACK_FAILURE;
+
+  stream = pctx->tunnel.stream;
+  if(!stream || (stream->id != stream_id)) {
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] recv_header: stream lookup "
+                "failed for data=%p mid=%u",
+                stream_id, (void *)data, data ? data->mid : 0);
+    return 0;
+  }
+
+  if(pctx->tunnel.has_final_response) {
+    /* we do not do anything with trailers for tunnel streams */
+    return 0;
+  }
+
+  if(token == NGHTTP3_QPACK_TOKEN__STATUS) {
+    result = Curl_http_decode_status(&stream->status_code,
+                                     (const char *)h3val.base, h3val.len);
+    if(result)
+      return NGHTTP3_ERR_CALLBACK_FAILURE;
+    http_status = stream->status_code;
+    result = Curl_http_resp_make(&resp, http_status, NULL);
+    if(result)
+      return NGHTTP3_ERR_CALLBACK_FAILURE;
+    if(pctx->tunnel.resp)
+      Curl_http_resp_free(pctx->tunnel.resp);
+    pctx->tunnel.resp = resp;
+  }
+  else {
+    /* store as an HTTP1-style header */
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] header: %.*s: %.*s", stream_id,
+                (int)h3name.len, h3name.base, (int)h3val.len, h3val.base);
+    result = Curl_dynhds_add(&pctx->tunnel.resp->headers,
+                             (const char *)h3name.base, h3name.len,
+                             (const char *)h3val.base, h3val.len);
+    if(result) {
+      return NGHTTP3_ERR_CALLBACK_FAILURE;
+    }
+  }
+  return 0;
+}
+
+static int cb_h3_proxy_end_headers(nghttp3_conn *conn, int64_t stream_id,
+                                   int fin, void *user_data,
+                                   void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_h3_proxy_ctx *pctx = cf->ctx;
+  struct Curl_easy *data = CF_DATA_CURRENT(cf);
+  struct h3_stream_ctx *stream;
+  (void)conn;
+  (void)stream_id;
+  (void)fin;
+  (void)stream_user_data;
+
+  if(!data)
+    return NGHTTP3_ERR_CALLBACK_FAILURE;
+
+  stream = pctx->tunnel.stream;
+  if(!stream || (stream->id != stream_id)) {
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] end_headers: stream lookup "
+                "failed for data=%p mid=%u",
+                stream_id, (void *)data, data ? data->mid : 0);
+    return 0;
+  }
+
+  CURL_TRC_CF(data, cf, "[%" PRId64 "] end_headers, status=%d", stream_id,
+              stream->status_code);
+
+  if(!pctx->tunnel.has_final_response) {
+    if(stream->status_code / 100 != 1) {
+      pctx->tunnel.has_final_response = TRUE;
+    }
+  }
+
+  if(stream->status_code / 100 != 1) {
+    stream->resp_hds_complete = TRUE;
+  }
+
+  Curl_multi_mark_dirty(data);
+  return 0;
+}
+
+static int cb_h3_proxy_stop_sending(nghttp3_conn *conn, int64_t stream_id,
+                                    uint64_t app_error_code, void *user_data,
+                                    void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_h3_proxy_ctx *pctx = cf->ctx;
+  struct cf_ngtcp2_ctx *ctx = &pctx->ngtcp2_ctx;
+  (void)conn;
+  (void)stream_user_data;
+
+  if(ctx) {
+    int rv = ngtcp2_conn_shutdown_stream_read(ctx->qconn, 0, stream_id,
+                                              app_error_code);
+
+    if(rv && rv != NGTCP2_ERR_STREAM_NOT_FOUND) {
+      return NGHTTP3_ERR_CALLBACK_FAILURE;
+    }
+  }
+
+  return 0;
+}
+
+static int cb_h3_proxy_reset_stream(nghttp3_conn *conn, int64_t stream_id,
+                                    uint64_t app_error_code, void *user_data,
+                                    void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_h3_proxy_ctx *pctx = cf->ctx;
+  struct cf_ngtcp2_ctx *ctx = &pctx->ngtcp2_ctx;
+  struct Curl_easy *data = CF_DATA_CURRENT(cf);
+  int rv;
+
+  (void)conn;
+  (void)stream_user_data;
+  if(!data)
+    return NGHTTP3_ERR_CALLBACK_FAILURE;
+
+  if(!pctx->tunnel.stream ||
+     (stream_id != pctx->tunnel.stream->id))
+    return 0;
+
+  rv = ngtcp2_conn_shutdown_stream_write(ctx->qconn, 0, stream_id,
+                                         app_error_code);
+  CURL_TRC_CF(data, cf, "[%" PRId64 "] reset -> %d", stream_id, rv);
+  pctx->tunnel.stream = NULL;
+  pctx->tunnel.closed = TRUE;
+  if(rv && rv != NGTCP2_ERR_STREAM_NOT_FOUND) {
+    return NGHTTP3_ERR_CALLBACK_FAILURE;
+  }
+  return 0;
+}
+
+static nghttp3_ssize cb_h3_tunnel_read_data(nghttp3_conn *conn,
+                                            int64_t stream_id,
+                                            nghttp3_vec *vec,
+                                            size_t veccnt,
+                                            uint32_t *pflags,
+                                            void *user_data,
+                                            void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_h3_proxy_ctx *pctx = cf->ctx;
+  struct Curl_easy *data = CF_DATA_CURRENT(cf);
+  struct h3_stream_ctx *stream;
+  size_t nwritten = 0;
+  size_t nvecs = 0;
+  const unsigned char *buf_base;
+
+  (void)conn;
+  (void)stream_id;
+  (void)veccnt;
+  (void)stream_user_data;
+  (void)pflags;
+
+  stream = pctx->tunnel.stream;
+  if(!data || !stream || (stream->id != stream_id))
+    return NGHTTP3_ERR_CALLBACK_FAILURE;
+
+  /* nghttp3 keeps references to the sendbuf data until it is ACKed
+   * by the server (see `cb_h3_proxy_acked_req_body()` for updates).
+   * `sendbuf_len_in_flight` is the amount of bytes in `sendbuf`
+   * that we have already passed to nghttp3, but which have not been
+   * ACKed yet.
+   * Any amount beyond `sendbuf_len_in_flight` we need still to pass
+   * to nghttp3. Do that now, if we can. */
+  if(stream->sendbuf_len_in_flight < Curl_bufq_len(&stream->sendbuf)) {
+    nvecs = 0;
+    while(nvecs < veccnt) {
+      if(!Curl_bufq_peek_at(&stream->sendbuf,
+                           stream->sendbuf_len_in_flight,
+                           &buf_base,
+                           &vec[nvecs].len))
+        break;
+      vec[nvecs].base = (uint8_t *)(uintptr_t)buf_base;
+      stream->sendbuf_len_in_flight += vec[nvecs].len;
+      nwritten += vec[nvecs].len;
+      ++nvecs;
+    }
+    DEBUGASSERT(nvecs > 0); /* we SHOULD have been able to peek */
+  }
+
+  if(!nwritten) {
+    /* Not EOF, and nothing to give, we signal WOULDBLOCK. */
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] read req body -> AGAIN",
+                stream->id);
+    return NGHTTP3_ERR_WOULDBLOCK;
+  }
+
+  CURL_TRC_CF(data, cf, "[%" PRId64 "] read req body -> "
+              "%zu vecs%s with %zu (buffered=%zu)",
+              stream->id, nvecs,
+              *pflags == NGHTTP3_DATA_FLAG_EOF ? " EOF" : "",
+              nwritten, Curl_bufq_len(&stream->sendbuf));
+  return (nghttp3_ssize)nvecs;
+}
+
+static nghttp3_callbacks ngh3_proxy_callbacks = {
+  cb_h3_proxy_acked_req_body, /* acked_stream_data */
+  cb_h3_proxy_stream_close,
+  cb_h3_proxy_recv_data,
+  cb_h3_proxy_deferred_consume,
+  NULL, /* begin_headers */
+  cb_h3_proxy_recv_header,
+  cb_h3_proxy_end_headers,
+  NULL, /* begin_trailers */
+  cb_h3_proxy_recv_header,
+  NULL, /* end_trailers */
+  cb_h3_proxy_stop_sending,
+  NULL, /* end_stream */
+  cb_h3_proxy_reset_stream,
+  NULL, /* shutdown */
+  NULL, /* recv_settings (deprecated) */
+#ifdef NGHTTP3_CALLBACKS_V2  /* nghttp3 v1.11.0+ */
+  NULL, /* recv_origin */
+  NULL, /* end_origin */
+  NULL, /* rand */
+#endif
+#ifdef NGHTTP3_CALLBACKS_V3  /* nghttp3 v1.14.0+ */
+  NULL, /* recv_settings2 */
+#endif
+};
+
+static CURLcode cf_ngtcp2_proxy_h3_init(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data,
+                                        struct cf_ngtcp2_ctx *ctx)
+{
+  int rc;
+
+  if(ngtcp2_conn_get_streams_uni_left(ctx->qconn) < 3) {
+    failf(data, "QUIC connection lacks 3 uni streams to run HTTP/3");
+    return CURLE_QUIC_CONNECT_ERROR;
+  }
+
+  nghttp3_settings_default(&ctx->h3settings);
+
+  rc = nghttp3_conn_client_new(&ctx->h3conn,
+                               &ngh3_proxy_callbacks,
+                               &ctx->h3settings,
+                               Curl_nghttp3_mem(),
+                               cf);
+  if(rc) {
+    failf(data, "error creating nghttp3 connection instance");
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  return Curl_cf_ngtcp2_h3_init_ctrls(ctx, data);
+}
+
+static ssize_t cf_h3_proxy_recv_closed_stream(struct Curl_cfilter *cf,
+                                              struct Curl_easy *data,
+                                              struct h3_stream_ctx *stream,
+                                              CURLcode *err)
+{
+  ssize_t nread = -1;
+  *err = CURLE_OK;
+
+  if(stream->reset) {
+    if(stream->error3 == CURL_H3_ERR_REQUEST_REJECTED) {
+      infof(data, "HTTP/3 stream %" PRId64 " refused by server, try again "
+            "on a new connection", stream->id);
+      connclose(cf->conn, "REFUSED_STREAM");
+      data->state.refused_stream = TRUE;
+      *err = CURLE_RECV_ERROR;
+      goto out;
+    }
+    else if(stream->resp_hds_complete && data->req.no_body) {
+      CURL_TRC_CF(data, cf, "[%" PRId64 "] error after response headers, "
+                  "but we did not want a body anyway, ignore error 0x%"
+                  PRIx64 " %s", stream->id, stream->error3,
+                  vquic_h3_err_str(stream->error3));
+      nread = 0;
+      goto out;
+    }
+    failf(data, "HTTP/3 stream %" PRId64 " reset by server (error 0x%" PRIx64
+          " %s)", stream->id, stream->error3,
+          vquic_h3_err_str(stream->error3));
+    *err = data->req.bytecount ? CURLE_PARTIAL_FILE : CURLE_HTTP3;
+    goto out;
+  }
+  else if(!stream->resp_hds_complete) {
+    failf(data,
+          "HTTP/3 stream %" PRId64 " was closed cleanly, but before "
+          "getting all response header fields, treated as error",
+          stream->id);
+    *err = CURLE_HTTP3;
+    goto out;
+  }
+  nread = 0;
+
+out:
+  return nread;
+}
+
+static CURLcode cf_h3_proxy_sendbuf_add(struct Curl_easy *data,
+                                        struct h3_stream_ctx *stream,
+                                        const uint8_t *buf, size_t len,
+                                        size_t *pnwritten)
+{
+  CURLcode result;
+  *pnwritten = 0;
+  (void)data;
+
+  result = Curl_bufq_write(&stream->sendbuf, buf, len, pnwritten);
+  return result;
+}
+
+static CURLcode cf_h3_proxy_send(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 const uint8_t *buf, size_t len,
+                                 bool eos, size_t *pnwritten)
+{
+  struct cf_h3_proxy_ctx *pctx = cf->ctx;
+  struct cf_ngtcp2_ctx *ctx = &pctx->ngtcp2_ctx;
+  struct h3_stream_ctx *stream = NULL;
+  struct cf_call_data save;
+  struct cf_ngtcp2_io_ctx pktx;
+  CURLcode result = CURLE_OK;
+
+  CF_DATA_SAVE(save, cf, data);
+  DEBUGASSERT(cf->connected);
+  DEBUGASSERT(ctx->qconn);
+  DEBUGASSERT(ctx->h3conn);
+  Curl_cf_ngtcp2_io_ctx_init(&pktx, cf, data);
+  *pnwritten = 0;
+
+  /* handshake verification failed in callback, do not send anything */
+  if(ctx->tls_vrfy_result) {
+    result = ctx->tls_vrfy_result;
+    goto denied;
+  }
+
+  (void)eos; /* use for stream EOF and block handling */
+  result = Curl_cf_ngtcp2_progress_ingress(cf, data, &pktx);
+  if(result)
+    goto out;
+
+  if(pctx->tunnel.closed) {
+    result = CURLE_SEND_ERROR;
+    goto denied;
+  }
+
+  stream = pctx->tunnel.stream;
+  if(!stream) {
+    result = CURLE_SEND_ERROR;
+    goto denied;
+  }
+
+  if(stream->closed) {
+    if(stream->resp_hds_complete) {
+      /* Server decided to close the stream after having sent us a final
+       * response. This is valid if it is not interested in the request
+       * body. This happens on 30x or 40x responses.
+       * We silently discard the data sent, since this is not a transport
+       * error situation. */
+      CURL_TRC_CF(data, cf, "[%" PRId64 "] discarding data"
+                  "on closed stream with response", stream->id);
+      result = CURLE_OK;
+      *pnwritten = len;
+      goto out;
+    }
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] send_body(len=%zu) "
+                "-> stream closed", stream->id, len);
+    result = CURLE_HTTP3;
+    goto out;
+  }
+  else {
+    result = cf_h3_proxy_sendbuf_add(data, stream, buf, len, pnwritten);
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] cf_send, add to "
+                "sendbuf(len=%zu) -> %d, %zu",
+                stream->id, len, (int)result, *pnwritten);
+    if(result)
+      goto out;
+    (void)nghttp3_conn_resume_stream(ctx->h3conn, stream->id);
+  }
+
+  if(*pnwritten > 0 && !ctx->tls_handshake_complete && ctx->use_earlydata)
+    ctx->earlydata_skip += *pnwritten;
+
+  DEBUGASSERT(!result);
+  result = Curl_cf_ngtcp2_progress_egress(cf, data, &pktx);
+
+out:
+  result = Curl_1st_fatal(result,
+                          Curl_cf_ngtcp2_cmn_set_expiry(cf, data, &pktx));
+denied:
+  CURL_TRC_CF(data, cf, "[%" PRId64 "] cf_send(len=%zu) -> %d, %zu",
+              stream ? stream->id : -1, len, (int)result, *pnwritten);
+  CF_DATA_RESTORE(cf, save);
+  return result;
+}
+
+/* incoming data frames on the h3 stream */
+static CURLcode cf_h3_proxy_recv(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 char *buf, size_t len, size_t *pnread)
+{
+  struct cf_h3_proxy_ctx *pctx = cf->ctx;
+  struct cf_ngtcp2_ctx *ctx = &pctx->ngtcp2_ctx;
+  struct h3_stream_ctx *stream = pctx->tunnel.stream;
+  struct cf_call_data save;
+  struct cf_ngtcp2_io_ctx pktx;
+  CURLcode result = CURLE_OK;
+
+  CF_DATA_SAVE(save, cf, data);
+  DEBUGASSERT(cf->connected);
+  DEBUGASSERT(ctx);
+  DEBUGASSERT(ctx->qconn);
+  DEBUGASSERT(ctx->h3conn);
+  *pnread = 0;
+
+  /* handshake verification failed in callback, do not recv anything */
+  if(ctx->tls_vrfy_result) {
+    result = ctx->tls_vrfy_result;
+    goto denied;
+  }
+
+  Curl_cf_ngtcp2_io_ctx_init(&pktx, cf, data);
+
+  if(!stream || ctx->shutdown_started) {
+    result = CURLE_RECV_ERROR;
+    goto out;
+  }
+
+  if(!Curl_bufq_is_empty(&pctx->tunnel.recvbuf)) {
+    result = Curl_bufq_cread(&pctx->tunnel.recvbuf, buf, len, pnread);
+    if(result)
+      goto out;
+  }
+
+  result = Curl_cf_ngtcp2_progress_ingress(cf, data, &pktx);
+  if(result)
+    goto out;
+
+  /* inbufq had nothing before, maybe after progressing ingress? */
+  if(!*pnread && !Curl_bufq_is_empty(&pctx->tunnel.recvbuf)) {
+    result = Curl_bufq_cread(&pctx->tunnel.recvbuf, buf, len, pnread);
+    if(result) {
+      CURL_TRC_CF(data, cf, "[%" PRId64 "] read inbufq(len=%zu) -> %zu, %d",
+                  stream->id, len, *pnread, (int)result);
+      goto out;
+    }
+  }
+
+  if(*pnread) {
+    Curl_multi_mark_dirty(data);
+  }
+  else {
+    if(stream->xfer_result) {
+      CURL_TRC_CF(data, cf, "[%" PRId64 "] xfer write failed", stream->id);
+      Curl_cf_ngtcp2_h3_stream_close(cf, data, stream);
+      result = stream->xfer_result;
+      goto out;
+    }
+    else if(stream->closed) {
+      ssize_t nread =
+        cf_h3_proxy_recv_closed_stream(cf, data, stream, &result);
+      if(nread > 0)
+        *pnread = (size_t)nread;
+      goto out;
+    }
+    result = CURLE_AGAIN;
+  }
+
+out:
+  result = Curl_1st_fatal(result,
+                          Curl_cf_ngtcp2_progress_egress(cf, data, &pktx));
+  result = Curl_1st_fatal(result,
+                          Curl_cf_ngtcp2_cmn_set_expiry(cf, data, &pktx));
+denied:
+  CURL_TRC_CF(data, cf, "[%" PRId64 "] cf_recv(len=%zu) -> %d, %zu",
+              stream ? stream->id : -1, len, (int)result, *pnread);
+  CF_DATA_RESTORE(cf, save);
+  return result;
+}
+
+static CURLcode cf_h3_proxy_submit(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data,
+                                   struct h3_tunnel_stream *ts,
+                                   struct httpreq *req)
+{
+  struct cf_h3_proxy_ctx *pctx = cf->ctx;
+  struct cf_ngtcp2_ctx *ctx = &pctx->ngtcp2_ctx;
+  struct h3_stream_ctx *stream = NULL;
+  struct dynhds h2_headers;
+  nghttp3_nv *nva = NULL;
+  size_t nheader;
+  int rc = 0;
+  unsigned int i;
+  nghttp3_data_reader reader;
+  nghttp3_data_reader *preader = NULL;
+  CURLcode result;
+
+  Curl_dynhds_init(&h2_headers, 0, DYN_HTTP_REQUEST);
+  result = Curl_http_req_to_h2(&h2_headers, req, data);
+  if(result)
+    goto out;
+
+  result = Curl_cf_ngtcp2_h3_stream_setup(cf, data);
+  if(result)
+    goto out;
+  stream = H3_STREAM_CTX(ctx, data);
+  DEBUGASSERT(stream);
+  if(!stream) {
+    result = CURLE_FAILED_INIT;
+    goto out;
+  }
+
+  nheader = Curl_dynhds_count(&h2_headers);
+  nva = curlx_malloc(sizeof(nghttp3_nv) * nheader);
+  if(!nva) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  for(i = 0; i < nheader; ++i) {
+    struct dynhds_entry *e = Curl_dynhds_getn(&h2_headers, i);
+    nva[i].name = (unsigned char *)e->name;
+    nva[i].namelen = e->namelen;
+    nva[i].value = (unsigned char *)e->value;
+    nva[i].valuelen = e->valuelen;
+    nva[i].flags = NGHTTP3_NV_FLAG_NONE;
+  }
+
+  /* Open a bidirectional stream */
+  {
+    int64_t sid;
+    int rv;
+
+    DEBUGASSERT(stream->id == -1);
+    /* Do NOT set `data` as stream user data. The transfer `data` may
+     * get cleaned up long before the tunnel goes down. */
+    rv = ngtcp2_conn_open_bidi_stream(ctx->qconn, &sid, NULL);
+    if(rv) {
+      failf(data, "cannot get bidi streams: %s", ngtcp2_strerror(rv));
+      result = CURLE_SEND_ERROR;
+      goto out;
+    }
+    stream->id = sid;
+    ts->stream = stream;
+    ++ctx->used_bidi_streams;
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] opened bidi stream", sid);
+  }
+
+  /* CONNECT-UDP request stream remains open for capsules, no fixed EOF. */
+  stream->send_closed = 0;
+  reader.read_data = cb_h3_tunnel_read_data;
+  preader = &reader;
+
+  rc = nghttp3_conn_submit_request(ctx->h3conn, stream->id,
+                                   nva, nheader, preader, data);
+
+  if(rc) {
+    switch(rc) {
+    case NGHTTP3_ERR_CONN_CLOSING:
+      CURL_TRC_CF(data, cf, "h3sid[%" PRId64 "] failed to send, "
+                  "connection is closing", stream->id);
+      break;
+    default:
+      CURL_TRC_CF(data, cf, "h3sid[%" PRId64 "] failed to send -> %d (%s)",
+                  stream->id, rc, nghttp3_strerror(rc));
+      break;
+    }
+    result = CURLE_SEND_ERROR;
+    goto out;
+  }
+
+  if(Curl_trc_is_verbose(data)) {
+    CURL_TRC_CF(data, cf, "[H3-PROXY] [%" PRId64 "] OPENED stream "
+                "for %s", stream->id,
+                Curl_bufref_ptr(&data->state.url));
+  }
+
+out:
+  curlx_free(nva);
+  Curl_dynhds_free(&h2_headers);
+  return result;
+}
+
+static CURLcode cf_h3_proxy_adjust_pollset(struct Curl_cfilter *cf,
+                                           struct Curl_easy *data,
+                                           struct easy_pollset *ps)
+{
+  struct cf_h3_proxy_ctx *pctx = cf->ctx;
+  struct cf_ngtcp2_ctx *ctx = &pctx->ngtcp2_ctx;
+  bool want_recv, want_send;
+  CURLcode result = CURLE_OK;
+  curl_socket_t sock = (ctx->q.sockfd != CURL_SOCKET_BAD) ?
+   ctx->q.sockfd : Curl_conn_cf_get_socket(cf, data);
+
+  if(!ctx->qconn || !pctx->tunnel.stream || (sock == CURL_SOCKET_BAD))
+    return CURLE_OK;
+
+  Curl_pollset_check(data, ps, sock, &want_recv, &want_send);
+
+  if(want_recv || want_send || !Curl_bufq_is_empty(&ctx->q.sendbuf)) {
+    struct h3_stream_ctx *stream = pctx->tunnel.stream;
+    bool c_exhaust, s_exhaust;
+
+    c_exhaust = want_send &&
+                (!ngtcp2_conn_get_cwnd_left(ctx->qconn) ||
+                 !ngtcp2_conn_get_max_data_left(ctx->qconn));
+    s_exhaust = want_send && stream && stream->id >= 0 &&
+                stream->quic_flow_blocked;
+    want_recv = (want_recv || c_exhaust || s_exhaust);
+    want_send = (!s_exhaust && want_send) ||
+                 !Curl_bufq_is_empty(&ctx->q.sendbuf);
+
+    result = Curl_pollset_set(data, ps, sock, want_recv, want_send);
+  }
+  return result;
+}
+
+static bool cf_h3_proxy_data_pending(struct Curl_cfilter *cf,
+                                     const struct Curl_easy *data)
+{
+  struct cf_h3_proxy_ctx *pctx = cf->ctx;
+  if(!Curl_bufq_is_empty(&pctx->tunnel.recvbuf))
+    return TRUE;
+  return cf->next ?
+    cf->next->cft->has_data_pending(cf->next, data) : FALSE;
+}
+
+static CURLcode cf_h3_proxy_submit_CONNECT(struct Curl_cfilter *cf,
+                                           struct Curl_easy *data,
+                                           struct h3_tunnel_stream *ts)
+{
+  CURLcode result;
+  struct httpreq *req = NULL;
+
+  result = Curl_http_proxy_create_tunnel_request(&req, cf, data,
+                                                  ts->peer,
+                                                  PROXY_HTTP_V3,
+                                                  (bool)ts->udp);
+  if(!result)
+    result = Curl_creader_set_null(data);
+  if(!result)
+    result = cf_h3_proxy_submit(cf, data, ts, req);
+
+  if(req)
+    Curl_http_req_free(req);
+  if(result)
+    failf(data, "Failed sending CONNECT to proxy");
+  return result;
+}
+
+static CURLcode cf_h3_proxy_inspect_response(struct Curl_cfilter *cf,
+                                             struct Curl_easy *data,
+                                             struct h3_tunnel_stream *ts)
+{
+  struct cf_h3_proxy_ctx *pctx = cf->ctx;
+  proxy_inspect_result res;
+  CURLcode result;
+
+  result = Curl_http_proxy_inspect_tunnel_response(
+      cf, data, ts->resp, (bool)pctx->tunnel.udp, &res);
+  if(result)
+    return result;
+  switch(res) {
+  case PROXY_INSPECT_OK:
+    h3_tunnel_go_state(cf, ts, H3_TUNNEL_ESTABLISHED, data);
+    break;
+  case PROXY_INSPECT_FAILED:
+    h3_tunnel_go_state(cf, ts, H3_TUNNEL_FAILED, data);
+    result = CURLE_COULDNT_CONNECT;
+    break;
+  case PROXY_INSPECT_AUTH_RETRY:
+    h3_tunnel_go_state(cf, ts, H3_TUNNEL_INIT, data);
+    break;
+  }
+  return result;
+}
+
+static CURLcode cf_h3_proxy_tunnel(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data,
+                                   struct h3_tunnel_stream *ts,
+                                   bool *pdone)
+{
+  struct cf_h3_proxy_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  DEBUGASSERT(ts);
+  DEBUGASSERT(ts->authority);
+  *pdone = FALSE;
+  do {
+    switch(ts->state) {
+    case H3_TUNNEL_INIT:
+      CURL_TRC_CF(data, cf, "[0] CONNECT start for %s", ts->authority);
+      result = cf_h3_proxy_submit_CONNECT(cf, data, ts);
+      if(result)
+        goto out;
+      h3_tunnel_go_state(cf, ts, H3_TUNNEL_CONNECT, data);
+
+      result = Curl_cf_ngtcp2_progress_egress(cf, data, NULL);
+      if(result)
+        goto out;
+      FALLTHROUGH();
+
+    case H3_TUNNEL_CONNECT:
+      /* Non-blocking: call ingress/egress once and return.
+       * The multi interface will call us again when ready. */
+      result = Curl_cf_ngtcp2_progress_ingress(cf, data, NULL);
+      if(result)
+        goto out;
+      result = Curl_cf_ngtcp2_progress_egress(cf, data, NULL);
+      if(result && result != CURLE_AGAIN) {
+        h3_tunnel_go_state(cf, ts, H3_TUNNEL_FAILED, data);
+        goto out;
+      }
+
+      if(ts->has_final_response) {
+        h3_tunnel_go_state(cf, ts, H3_TUNNEL_RESPONSE, data);
+      }
+      else {
+        /* Not done yet, return and let multi interface call us again */
+        result = CURLE_OK;
+        goto out;
+      }
+      FALLTHROUGH();
+
+    case H3_TUNNEL_RESPONSE:
+      DEBUGASSERT(ts->has_final_response);
+      result = cf_h3_proxy_inspect_response(cf, data, ts);
+      if(result)
+        goto out;
+      ctx->connected = TRUE;
+      break;
+
+    case H3_TUNNEL_ESTABLISHED:
+      *pdone = TRUE;
+      return CURLE_OK;
+
+    case H3_TUNNEL_FAILED:
+      return CURLE_RECV_ERROR;
+
+    default:
+      break;
+    }
+
+  } while(ts->state == H3_TUNNEL_INIT);
+
+out:
+  if((result && (result != CURLE_AGAIN)) || ctx->tunnel.closed)
+    h3_tunnel_go_state(cf, ts, H3_TUNNEL_FAILED, data);
+  return result;
+}
+
+static CURLcode cf_h3_proxy_connect(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data, bool *done)
+{
+  struct cf_h3_proxy_ctx *pctx = cf->ctx;
+  struct cf_call_data save = { 0 };
+  CURLcode result = CURLE_OK;
+  struct h3_tunnel_stream *ts = &pctx->tunnel;
+  bool data_saved = FALSE;
+
+  result = Curl_cf_ngtcp2_cmn_connect(cf, data, done);
+  if(result || !*done)
+    goto out;
+
+  CF_DATA_SAVE(save, cf, data);
+  data_saved = TRUE;
+
+  /* At this point the QUIC is connected, but the proxy is not connected */
+  result = cf_h3_proxy_tunnel(cf, data, ts, done);
+
+out:
+  if(*done) {
+    cf->connected = TRUE;
+    /* The real request will follow the CONNECT, reset request partially */
+    Curl_req_soft_reset(&data->req, data);
+    Curl_client_reset(data);
+  }
+
+  if(data_saved)
+    CF_DATA_RESTORE(cf, save);
+  return result;
+}
+
+static void cf_h3_proxy_destroy(struct Curl_cfilter *cf,
+                                struct Curl_easy *data)
+{
+  struct cf_h3_proxy_ctx *ctx = cf->ctx;
+
+  (void)data;
+  if(ctx) {
+    CURL_TRC_CF(data, cf, "cf_h3_proxy_destroy()");
+    cf_h3_proxy_ctx_free(ctx);
+    cf->ctx = NULL;
+  }
+}
+
+static CURLcode cf_h3_proxy_shutdown(struct Curl_cfilter *cf,
+                                     struct Curl_easy *data, bool *done)
+{
+  return Curl_cf_ngtcp2_cmn_shutdown(cf, data, done);
+}
+
+struct Curl_cftype Curl_cft_h3_proxy = {
+  "H3-PROXY",
+  CF_TYPE_IP_CONNECT | CF_TYPE_PROXY | CF_TYPE_SSL,
+  CURL_LOG_LVL_NONE,
+  cf_h3_proxy_destroy,
+  cf_h3_proxy_connect,
+  cf_h3_proxy_shutdown,
+  cf_h3_proxy_adjust_pollset,
+  cf_h3_proxy_data_pending,
+  cf_h3_proxy_send,
+  cf_h3_proxy_recv,
+  Curl_cf_def_cntrl,
+  Curl_cf_ngtcp2_cmn_conn_is_alive,
+  Curl_cf_def_conn_keep_alive,
+  Curl_cf_def_query,
+};
+
+CURLcode Curl_cf_ngtcp2_proxy_create(struct Curl_cfilter **pcf,
+                                     struct Curl_easy *data,
+                                     struct Curl_peer *origin,
+                                     struct Curl_peer *peer,
+                                     uint8_t transport_peer,
+                                     struct connectdata *conn,
+                                     struct Curl_sockaddr_ex *addr,
+                                     struct Curl_peer *tunnel_peer,
+                                     uint8_t tunnel_transport)
+{
+  struct Curl_cfilter *cf = NULL;
+  struct cf_h3_proxy_ctx *ctx;
+  CURLcode result = CURLE_OUT_OF_MEMORY;
+
+  if(!tunnel_peer)
+    return CURLE_FAILED_INIT;
+  if((transport_peer != TRNSPRT_QUIC) || (!conn->http_proxy.peer))
+    return CURLE_FAILED_INIT;
+
+  ctx = curlx_calloc(1, sizeof(*ctx));
+  if(!ctx) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+  result = cf_h3_proxy_ctx_init(ctx, origin, peer, &conn->proxy_ssl_config,
+                                tunnel_peer, tunnel_transport);
+  if(result)
+    goto out;
+
+  result = Curl_cf_create(&cf, &Curl_cft_h3_proxy, ctx);
+  if(result)
+    goto out;
+  cf->conn = conn;
+
+  result = Curl_cf_udp_create(&cf->next, data, origin, peer, TRNSPRT_QUIC,
+                              conn, addr, NULL, TRNSPRT_QUIC);
+  if(result)
+    goto out;
+  cf->next->conn = cf->conn;
+  cf->next->sockindex = cf->sockindex;
+
+out:
+  *pcf = (!result) ? cf : NULL;
+  if(result) {
+    if(cf)
+      Curl_conn_cf_discard_chain(&cf, data);
+    else if(ctx)
+      cf_h3_proxy_ctx_free(ctx);
+  }
+  else
+    CURL_TRC_CF(data, cf, "created, udp_tunnel=%d", ctx->tunnel.udp);
+  return result;
+}
+
+CURLcode Curl_cf_ngtcp2_proxy_insert_after(struct Curl_cfilter *cf_at,
+                                           struct Curl_easy *data,
+                                           struct Curl_peer *origin,
+                                           struct Curl_peer *peer,
+                                           struct Curl_peer *tunnel_peer,
+                                           uint8_t tunnel_transport)
+{
+  struct Curl_cfilter *cf = NULL;
+  struct cf_h3_proxy_ctx *ctx;
+  CURLcode result = CURLE_OUT_OF_MEMORY;
+  (void)data;
+
+  ctx = curlx_calloc(1, sizeof(*ctx));
+  if(!ctx)
+    goto out;
+  result = cf_h3_proxy_ctx_init(ctx, origin, peer,
+                                &cf_at->conn->proxy_ssl_config,
+                                tunnel_peer, tunnel_transport);
+  if(result)
+    goto out;
+
+  result = Curl_cf_create(&cf, &Curl_cft_h3_proxy, ctx);
+  if(result)
+    goto out;
+
+  /* H3-PROXY uses the UDP socket created by happy eyeballs below it.
+     Curl_conn_cf_insert_after chains the existing sub-filters, i.e.
+     "HAPPY-EYEBALLS -> UDP" as cf->next of H3-PROXY. */
+  Curl_conn_cf_insert_after(cf_at, cf);
+
+out:
+  if(result) {
+    if(cf)
+      Curl_conn_cf_discard_chain(&cf, data);
+    else if(ctx)
+      cf_h3_proxy_ctx_free(ctx);
+  }
+  return result;
+}
+
+#endif
diff --git a/third-party/curl/lib/vquic/cf-ngtcp2-proxy.h b/third-party/curl/lib/vquic/cf-ngtcp2-proxy.h
new file mode 100644
index 0000000000..acdee0e463
--- /dev/null
+++ b/third-party/curl/lib/vquic/cf-ngtcp2-proxy.h
@@ -0,0 +1,52 @@
+#ifndef HEADER_CURL_VQUIC_CF_NGTCP2_PROXY_H
+#define HEADER_CURL_VQUIC_CF_NGTCP2_PROXY_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+#include "curl_setup.h"
+
+#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_PROXY) && \
+  defined(USE_PROXY_HTTP3) && defined(USE_NGHTTP3) &&              \
+  defined(USE_NGTCP2) && defined(USE_OPENSSL)
+
+CURLcode Curl_cf_ngtcp2_proxy_insert_after(struct Curl_cfilter *cf_at,
+                                           struct Curl_easy *data,
+                                           struct Curl_peer *origin,
+                                           struct Curl_peer *peer,
+                                           struct Curl_peer *tunnel_peer,
+                                           uint8_t tunnel_transport);
+
+CURLcode Curl_cf_ngtcp2_proxy_create(struct Curl_cfilter **pcf,
+                                     struct Curl_easy *data,
+                                     struct Curl_peer *origin,
+                                     struct Curl_peer *peer,
+                                     uint8_t transport_peer,
+                                     struct connectdata *conn,
+                                     struct Curl_sockaddr_ex *addr,
+                                     struct Curl_peer *tunnel_peer,
+                                     uint8_t tunnel_transport);
+
+#endif
+
+#endif /* HEADER_CURL_VQUIC_CF_NGTCP2_PROXY_H */
diff --git a/third-party/curl/lib/vquic/cf-ngtcp2.c b/third-party/curl/lib/vquic/cf-ngtcp2.c
new file mode 100644
index 0000000000..be1a3257c3
--- /dev/null
+++ b/third-party/curl/lib/vquic/cf-ngtcp2.c
@@ -0,0 +1,1166 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_NGTCP2) && defined(USE_NGHTTP3)
+
+#include "urldata.h"
+#include "url.h"
+#include "uint-hash.h"
+#include "curl_trc.h"
+#include "rand.h"
+#include "multiif.h"
+#include "cfilters.h"
+#include "cf-dns.h"
+#include "cf-socket.h"
+#include "connect.h"
+#include "progress.h"
+#include "curlx/fopen.h"
+#include "curlx/dynbuf.h"
+#include "http1.h"
+#include "select.h"
+#include "transfer.h"
+#include "bufref.h"
+#include "vquic/vquic.h"
+#include "vquic/vquic_int.h"
+#include "vquic/cf-ngtcp2-cmn.h"
+#include "vquic/cf-ngtcp2.h"
+
+
+static int cb_h3_acked_req_body(nghttp3_conn *conn, int64_t stream_id,
+                                uint64_t datalen, void *user_data,
+                                void *stream_user_data);
+
+static CURLcode cf_ngtcp2_adjust_pollset(struct Curl_cfilter *cf,
+                                         struct Curl_easy *data,
+                                         struct easy_pollset *ps)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  bool want_recv, want_send;
+  CURLcode result = CURLE_OK;
+  curl_socket_t sock = (ctx->q.sockfd != CURL_SOCKET_BAD) ?
+   ctx->q.sockfd : Curl_conn_cf_get_socket(cf, data);
+
+  if(!ctx->qconn || (sock == CURL_SOCKET_BAD))
+    return CURLE_OK;
+
+  Curl_pollset_check(data, ps, sock, &want_recv, &want_send);
+  if(!want_send && !Curl_bufq_is_empty(&ctx->q.sendbuf))
+    want_send = TRUE;
+
+  if(want_recv || want_send) {
+    struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+    struct cf_call_data save;
+    bool c_exhaust, s_exhaust;
+
+    CF_DATA_SAVE(save, cf, data);
+    c_exhaust = want_send && (!ngtcp2_conn_get_cwnd_left(ctx->qconn) ||
+                              !ngtcp2_conn_get_max_data_left(ctx->qconn));
+    s_exhaust = want_send && stream && stream->id >= 0 &&
+                stream->quic_flow_blocked;
+    want_recv = (want_recv || c_exhaust || s_exhaust);
+    want_send = (!s_exhaust && want_send) ||
+                 !Curl_bufq_is_empty(&ctx->q.sendbuf);
+
+    result = Curl_pollset_set(data, ps, sock, want_recv, want_send);
+    CF_DATA_RESTORE(cf, save);
+  }
+  return result;
+}
+
+static int cb_h3_stream_close(nghttp3_conn *conn, int64_t stream_id,
+                              uint64_t app_error_code, void *user_data,
+                              void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct Curl_easy *data = stream_user_data;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+  (void)conn;
+  (void)stream_id;
+
+  /* we might be called by nghttp3 after we already cleaned up */
+  if(!stream)
+    return 0;
+
+  stream->closed = TRUE;
+  stream->error3 = app_error_code;
+  if(stream->error3 != NGHTTP3_H3_NO_ERROR) {
+    stream->reset = TRUE;
+    stream->send_closed = TRUE;
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] RESET: error %" PRIu64,
+                stream->id, stream->error3);
+  }
+  else {
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] CLOSED", stream->id);
+  }
+  Curl_multi_mark_dirty(data);
+  return 0;
+}
+
+static void h3_xfer_write_resp_hd(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  struct h3_stream_ctx *stream,
+                                  const char *buf, size_t buflen, bool eos)
+{
+  /* This function returns no error intentionally, but records
+   * the result at the stream, skipping further writes once the
+   * `result` of the transfer is known.
+   * The stream is subsequently cancelled "higher up" in the filter's
+   * send/recv callbacks. Closing the stream here leads to SEND/RECV
+   * errors in other places that then overwrite the transfer's result. */
+  if(!stream->xfer_result) {
+    stream->xfer_result = Curl_xfer_write_resp_hd(data, buf, buflen, eos);
+    if(stream->xfer_result)
+      CURL_TRC_CF(data, cf, "[%" PRId64 "] error %d writing %zu "
+                  "bytes of headers", stream->id, (int)stream->xfer_result,
+                  buflen);
+  }
+}
+
+static void h3_xfer_write_resp(struct Curl_cfilter *cf,
+                               struct Curl_easy *data,
+                               struct h3_stream_ctx *stream,
+                               const char *buf, size_t buflen, bool eos)
+{
+  /* This function returns no error intentionally, but records
+   * the result at the stream, skipping further writes once the
+   * `result` of the transfer is known.
+   * The stream is subsequently cancelled "higher up" in the filter's
+   * send/recv callbacks. Closing the stream here leads to SEND/RECV
+   * errors in other places that then overwrite the transfer's result. */
+  if(!stream->xfer_result) {
+    stream->xfer_result = Curl_xfer_write_resp(data, buf, buflen, eos);
+    /* If the transfer write is errored, we do not want any more data */
+    if(stream->xfer_result) {
+      CURL_TRC_CF(data, cf, "[%" PRId64 "] error %d writing %zu bytes of data",
+                  stream->id, (int)stream->xfer_result, buflen);
+    }
+  }
+}
+
+static void cf_ngtcp2_upd_rx_win(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 struct h3_stream_ctx *stream)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  uint64_t cur_win, wanted_win = H3_STREAM_WINDOW_SIZE_MAX;
+
+  /* how much does rate limiting allow us to acknowledge? */
+  if(Curl_rlimit_active(&data->progress.dl.rlimit)) {
+    int64_t avail;
+
+    /* start rate limit updates only after first bytes arrived */
+    if(!stream->rx_offset)
+      return;
+
+    avail = Curl_rlimit_avail(&data->progress.dl.rlimit, Curl_pgrs_now(data));
+    if(avail <= 0) {
+      /* nothing available, do not extend the rx offset */
+      CURL_TRC_CF(data, cf, "[%" PRId64 "] dl rate limit exhausted (%" PRId64
+                  " tokens)", stream->id, avail);
+      return;
+    }
+    wanted_win = CURLMIN((uint64_t)avail, H3_STREAM_WINDOW_SIZE_MAX);
+  }
+
+  if(stream->rx_offset_max < stream->rx_offset) {
+    DEBUGASSERT(0);
+    return;
+  }
+  cur_win = stream->rx_offset_max - stream->rx_offset;
+
+  if(wanted_win > cur_win) {
+    uint64_t delta = wanted_win - cur_win;
+
+    if(UINT64_MAX - delta < stream->rx_offset_max)
+      delta = UINT64_MAX - stream->rx_offset_max;
+    if(delta) {
+      CURL_TRC_CF(data, cf, "[%" PRId64 "] rx window, extend by %" PRIu64
+                  " bytes", stream->id, delta);
+      stream->rx_offset_max += delta;
+      ngtcp2_conn_extend_max_stream_offset(ctx->qconn, stream->id, delta);
+    }
+  }
+}
+
+static int cb_h3_recv_data(nghttp3_conn *conn, int64_t stream3_id,
+                           const uint8_t *buf, size_t buflen,
+                           void *user_data, void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct Curl_easy *data = stream_user_data;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+
+  (void)conn;
+  (void)stream3_id;
+
+  if(!stream)
+    return NGHTTP3_ERR_CALLBACK_FAILURE;
+
+  h3_xfer_write_resp(cf, data, stream, (const char *)buf, buflen, FALSE);
+
+  ngtcp2_conn_extend_max_offset(ctx->qconn, buflen);
+  stream->rx_offset += buflen;
+  if(stream->rx_offset_max < stream->rx_offset)
+    stream->rx_offset_max = stream->rx_offset;
+
+  CURL_TRC_CF(data, cf, "[%" PRId64 "] DATA len=%zu, rx win=%" PRIu64,
+              stream->id, buflen, stream->rx_offset_max - stream->rx_offset);
+  cf_ngtcp2_upd_rx_win(cf, data, stream);
+  return 0;
+}
+
+static int cb_h3_deferred_consume(nghttp3_conn *conn, int64_t stream3_id,
+                                  size_t consumed, void *user_data,
+                                  void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct Curl_easy *data = stream_user_data;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+  (void)conn;
+
+  /* nghttp3 has consumed bytes on the QUIC stream and we need to
+   * tell the QUIC connection to increase its flow control */
+  ngtcp2_conn_extend_max_stream_offset(ctx->qconn, stream3_id, consumed);
+  ngtcp2_conn_extend_max_offset(ctx->qconn, consumed);
+  if(stream) {
+    stream->rx_offset += consumed;
+    stream->rx_offset_max += consumed;
+  }
+  return 0;
+}
+
+static int cb_h3_end_headers(nghttp3_conn *conn, int64_t stream_id,
+                             int fin, void *user_data, void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct Curl_easy *data = stream_user_data;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+  (void)conn;
+  (void)stream_id;
+  (void)fin;
+  (void)cf;
+
+  if(!stream)
+    return 0;
+  /* add a CRLF only if we have received some headers */
+  h3_xfer_write_resp_hd(cf, data, stream, STRCONST("\r\n"),
+                        (bool)stream->closed);
+
+  CURL_TRC_CF(data, cf, "[%" PRId64 "] end_headers, status=%d",
+              stream_id, stream->status_code);
+  if(stream->status_code / 100 != 1) {
+    stream->resp_hds_complete = TRUE;
+  }
+  Curl_multi_mark_dirty(data);
+  return 0;
+}
+
+static int cb_h3_recv_header(nghttp3_conn *conn, int64_t stream_id,
+                             int32_t token, nghttp3_rcbuf *name,
+                             nghttp3_rcbuf *value, uint8_t flags,
+                             void *user_data, void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  nghttp3_vec h3name = nghttp3_rcbuf_get_buf(name);
+  nghttp3_vec h3val = nghttp3_rcbuf_get_buf(value);
+  struct Curl_easy *data = stream_user_data;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+  CURLcode result = CURLE_OK;
+  (void)conn;
+  (void)stream_id;
+  (void)token;
+  (void)flags;
+  (void)cf;
+
+  /* we might have cleaned up this transfer already */
+  if(!stream)
+    return 0;
+
+  if(token == NGHTTP3_QPACK_TOKEN__STATUS) {
+
+    result = Curl_http_decode_status(&stream->status_code,
+                                     (const char *)h3val.base, h3val.len);
+    if(result)
+      return NGHTTP3_ERR_CALLBACK_FAILURE;
+    curlx_dyn_reset(&ctx->scratch);
+    result = curlx_dyn_addn(&ctx->scratch, STRCONST("HTTP/3 "));
+    if(!result)
+      result = curlx_dyn_addn(&ctx->scratch,
+                              (const char *)h3val.base, h3val.len);
+    if(!result)
+      result = curlx_dyn_addn(&ctx->scratch, STRCONST(" \r\n"));
+    if(!result)
+      h3_xfer_write_resp_hd(cf, data, stream, curlx_dyn_ptr(&ctx->scratch),
+                            curlx_dyn_len(&ctx->scratch), FALSE);
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] status: %s",
+                stream_id, curlx_dyn_ptr(&ctx->scratch));
+    if(result) {
+      return NGHTTP3_ERR_CALLBACK_FAILURE;
+    }
+  }
+  else {
+    /* store as an HTTP1-style header */
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] header: %.*s: %.*s",
+                stream_id, (int)h3name.len, h3name.base,
+                (int)h3val.len, h3val.base);
+    curlx_dyn_reset(&ctx->scratch);
+    result = curlx_dyn_addn(&ctx->scratch,
+                            (const char *)h3name.base, h3name.len);
+    if(!result)
+      result = curlx_dyn_addn(&ctx->scratch, STRCONST(": "));
+    if(!result)
+      result = curlx_dyn_addn(&ctx->scratch,
+                              (const char *)h3val.base, h3val.len);
+    if(!result)
+      result = curlx_dyn_addn(&ctx->scratch, STRCONST("\r\n"));
+    if(!result)
+      h3_xfer_write_resp_hd(cf, data, stream, curlx_dyn_ptr(&ctx->scratch),
+                            curlx_dyn_len(&ctx->scratch), FALSE);
+  }
+  return 0;
+}
+
+static int cb_h3_stop_sending(nghttp3_conn *conn, int64_t stream_id,
+                              uint64_t app_error_code, void *user_data,
+                              void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  int rv;
+  (void)conn;
+  (void)stream_user_data;
+
+  rv = ngtcp2_conn_shutdown_stream_read(ctx->qconn, 0, stream_id,
+                                        app_error_code);
+  if(rv && rv != NGTCP2_ERR_STREAM_NOT_FOUND) {
+    return NGHTTP3_ERR_CALLBACK_FAILURE;
+  }
+
+  return 0;
+}
+
+static int cb_h3_reset_stream(nghttp3_conn *conn, int64_t stream_id,
+                              uint64_t app_error_code, void *user_data,
+                              void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct Curl_easy *data = stream_user_data;
+  int rv;
+  (void)conn;
+
+  rv = ngtcp2_conn_shutdown_stream_write(ctx->qconn, 0, stream_id,
+                                         app_error_code);
+  CURL_TRC_CF(data, cf, "[%" PRId64 "] reset -> %d", stream_id, rv);
+  if(rv && rv != NGTCP2_ERR_STREAM_NOT_FOUND) {
+    return NGHTTP3_ERR_CALLBACK_FAILURE;
+  }
+
+  return 0;
+}
+
+static nghttp3_callbacks ngh3_callbacks = {
+  cb_h3_acked_req_body, /* acked_stream_data */
+  cb_h3_stream_close,
+  cb_h3_recv_data,
+  cb_h3_deferred_consume,
+  NULL, /* begin_headers */
+  cb_h3_recv_header,
+  cb_h3_end_headers,
+  NULL, /* begin_trailers */
+  cb_h3_recv_header,
+  NULL, /* end_trailers */
+  cb_h3_stop_sending,
+  NULL, /* end_stream */
+  cb_h3_reset_stream,
+  NULL, /* shutdown */
+  NULL, /* recv_settings (deprecated) */
+#ifdef NGHTTP3_CALLBACKS_V2  /* nghttp3 v1.11.0+ */
+  NULL, /* recv_origin */
+  NULL, /* end_origin */
+  NULL, /* rand */
+#endif
+#ifdef NGHTTP3_CALLBACKS_V3  /* nghttp3 v1.14.0+ */
+  NULL, /* recv_settings2 */
+#endif
+};
+
+static CURLcode init_ngh3_conn(struct Curl_cfilter *cf,
+                               struct Curl_easy *data,
+                               struct cf_ngtcp2_ctx *ctx)
+{
+  int rc;
+
+  if(ngtcp2_conn_get_streams_uni_left(ctx->qconn) < 3) {
+    failf(data, "QUIC connection lacks 3 uni streams to run HTTP/3");
+    return CURLE_QUIC_CONNECT_ERROR;
+  }
+
+  nghttp3_settings_default(&ctx->h3settings);
+
+  rc = nghttp3_conn_client_new(&ctx->h3conn,
+                               &ngh3_callbacks,
+                               &ctx->h3settings,
+                               Curl_nghttp3_mem(),
+                               cf);
+  if(rc) {
+    failf(data, "error creating nghttp3 connection instance");
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  return Curl_cf_ngtcp2_h3_init_ctrls(ctx, data);
+}
+
+static CURLcode recv_closed_stream(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data,
+                                   struct h3_stream_ctx *stream,
+                                   size_t *pnread)
+{
+  (void)cf;
+  *pnread = 0;
+  if(stream->reset) {
+    if(stream->error3 == CURL_H3_ERR_REQUEST_REJECTED) {
+      infof(data, "HTTP/3 stream %" PRId64 " refused by server, try again "
+            "on a new connection", stream->id);
+      connclose(cf->conn, "REFUSED_STREAM"); /* do not use this anymore */
+      data->state.refused_stream = TRUE;
+      return CURLE_RECV_ERROR; /* trigger Curl_retry_request() later */
+    }
+    else if(stream->resp_hds_complete && data->req.no_body) {
+        CURL_TRC_CF(data, cf, "[%" PRId64 "] error after response headers, "
+                    "but we did not want a body anyway, ignore error 0x%"
+                    PRIx64 " %s", stream->id, stream->error3,
+                    vquic_h3_err_str(stream->error3));
+        return CURLE_OK;
+    }
+    failf(data, "HTTP/3 stream %" PRId64 " reset by server (error 0x%" PRIx64
+          " %s)", stream->id, stream->error3,
+          vquic_h3_err_str(stream->error3));
+    return data->req.bytecount ? CURLE_PARTIAL_FILE : CURLE_HTTP3;
+  }
+  else if(!stream->resp_hds_complete) {
+    failf(data,
+          "HTTP/3 stream %" PRId64 " was closed cleanly, but before "
+          "getting all response header fields, treated as error",
+          stream->id);
+    return CURLE_HTTP3;
+  }
+  return CURLE_OK;
+}
+
+/* incoming data frames on the h3 stream */
+static CURLcode cf_ngtcp2_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
+                               char *buf, size_t buflen, size_t *pnread)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+  struct cf_call_data save;
+  struct cf_ngtcp2_io_ctx pktx;
+  CURLcode result = CURLE_OK;
+  int i;
+
+  (void)ctx;
+  (void)buf;
+  NOVERBOSE((void)buflen);
+
+  CF_DATA_SAVE(save, cf, data);
+  DEBUGASSERT(cf->connected);
+  DEBUGASSERT(ctx);
+  DEBUGASSERT(ctx->qconn);
+  DEBUGASSERT(ctx->h3conn);
+  *pnread = 0;
+
+  /* handshake verification failed in callback, do not recv anything */
+  if(ctx->tls_vrfy_result) {
+    result = ctx->tls_vrfy_result;
+    goto denied;
+  }
+
+  Curl_cf_ngtcp2_io_ctx_init(&pktx, cf, data);
+
+  if(!stream || ctx->shutdown_started) {
+    result = CURLE_RECV_ERROR;
+    goto out;
+  }
+
+  cf_ngtcp2_upd_rx_win(cf, data, stream);
+
+  /* first check for results/closed already known without touching
+   * the connection. For an already failed/closed stream, errors on
+   * the connection do not count.
+   * Then handle incoming data and check for failed/closed again.
+   */
+  for(i = 0; i < 2; ++i) {
+    if(stream->xfer_result) {
+      CURL_TRC_CF(data, cf, "[%" PRId64 "] xfer write failed", stream->id);
+      Curl_cf_ngtcp2_h3_stream_close(cf, data, stream);
+      result = stream->xfer_result;
+      goto out;
+    }
+    else if(stream->closed) {
+      result = recv_closed_stream(cf, data, stream, pnread);
+      goto out;
+    }
+
+    if(!i && Curl_cf_ngtcp2_progress_ingress(cf, data, &pktx)) {
+      result = CURLE_RECV_ERROR;
+      goto out;
+    }
+  }
+
+  result = CURLE_AGAIN;
+
+out:
+  result = Curl_1st_fatal(result,
+                          Curl_cf_ngtcp2_progress_egress(cf, data, &pktx));
+  result = Curl_1st_fatal(result,
+                          Curl_cf_ngtcp2_cmn_set_expiry(cf, data, &pktx));
+  if(ctx->tls_vrfy_result)
+    result = ctx->tls_vrfy_result;
+denied:
+  CURL_TRC_CF(data, cf, "[%" PRId64 "] cf_recv(buflen=%zu) -> %d, %zu",
+              stream ? stream->id : -1, buflen, (int)result, *pnread);
+  CF_DATA_RESTORE(cf, save);
+  return result;
+}
+
+static int cb_h3_acked_req_body(nghttp3_conn *conn, int64_t stream_id,
+                                uint64_t datalen, void *user_data,
+                                void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct Curl_easy *data = stream_user_data;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+  size_t skiplen;
+
+  (void)cf;
+  if(!stream)
+    return 0;
+  /* The server acknowledged `datalen` of bytes from our request body.
+   * This is a delta. We have kept this data in `sendbuf` for
+   * re-transmissions and can free it now. */
+  if(datalen >= (uint64_t)stream->sendbuf_len_in_flight)
+    skiplen = stream->sendbuf_len_in_flight;
+  else
+    skiplen = (size_t)datalen;
+  Curl_bufq_skip(&stream->sendbuf, skiplen);
+  stream->sendbuf_len_in_flight -= skiplen;
+
+  /* Resume upload processing if we have more data to send */
+  if(stream->sendbuf_len_in_flight < Curl_bufq_len(&stream->sendbuf)) {
+    int rv = nghttp3_conn_resume_stream(conn, stream_id);
+    if(rv && rv != NGHTTP3_ERR_STREAM_NOT_FOUND) {
+      return NGHTTP3_ERR_CALLBACK_FAILURE;
+    }
+  }
+  return 0;
+}
+
+static nghttp3_ssize cb_h3_read_req_body(nghttp3_conn *conn, int64_t stream_id,
+                                         nghttp3_vec *vec, size_t veccnt,
+                                         uint32_t *pflags, void *user_data,
+                                         void *stream_user_data)
+{
+  struct Curl_cfilter *cf = user_data;
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct Curl_easy *data = stream_user_data;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+  size_t nwritten = 0;
+  size_t nvecs = 0;
+  (void)cf;
+  (void)conn;
+  (void)stream_id;
+  (void)user_data;
+  (void)veccnt;
+
+  if(!stream)
+    return NGHTTP3_ERR_CALLBACK_FAILURE;
+  /* nghttp3 keeps references to the sendbuf data until it is ACKed
+   * by the server (see `cb_h3_acked_req_body()` for updates).
+   * `sendbuf_len_in_flight` is the amount of bytes in `sendbuf`
+   * that we have already passed to nghttp3, but which have not been
+   * ACKed yet.
+   * Any amount beyond `sendbuf_len_in_flight` we need still to pass
+   * to nghttp3. Do that now, if we can. */
+  if(stream->sendbuf_len_in_flight < Curl_bufq_len(&stream->sendbuf)) {
+    nvecs = 0;
+    while(nvecs < veccnt &&
+          Curl_bufq_peek_at(&stream->sendbuf,
+                            stream->sendbuf_len_in_flight,
+                            CURL_UNCONST(&vec[nvecs].base),
+                            &vec[nvecs].len)) {
+      stream->sendbuf_len_in_flight += vec[nvecs].len;
+      nwritten += vec[nvecs].len;
+      ++nvecs;
+    }
+    DEBUGASSERT(nvecs > 0); /* we SHOULD have been be able to peek */
+  }
+
+  if(nwritten > 0 && stream->upload_left != -1)
+    stream->upload_left -= nwritten;
+
+  /* When we stopped sending and everything in `sendbuf` is "in flight",
+   * we are at the end of the request body. */
+  if(stream->upload_left == 0) {
+    *pflags = NGHTTP3_DATA_FLAG_EOF;
+    stream->send_closed = TRUE;
+  }
+  else if(!nwritten) {
+    /* Not EOF, and nothing to give, we signal WOULDBLOCK. */
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] read req body -> AGAIN", stream->id);
+    return NGHTTP3_ERR_WOULDBLOCK;
+  }
+
+  CURL_TRC_CF(data, cf, "[%" PRId64 "] read req body -> "
+              "%zu vecs%s with %zu (buffered=%zu, left=%" FMT_OFF_T ")",
+              stream->id, nvecs,
+              *pflags == NGHTTP3_DATA_FLAG_EOF ? " EOF" : "",
+              nwritten, Curl_bufq_len(&stream->sendbuf),
+              stream->upload_left);
+  return (nghttp3_ssize)nvecs;
+}
+
+static CURLcode h3_stream_open(struct Curl_cfilter *cf,
+                               struct Curl_easy *data,
+                               const uint8_t *buf, size_t len,
+                               size_t *pnwritten)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct h3_stream_ctx *stream = NULL;
+  int64_t sid;
+  struct dynhds h2_headers;
+  size_t nheader;
+  nghttp3_nv *nva = NULL;
+  int rc = 0;
+  unsigned int i;
+  nghttp3_data_reader reader;
+  nghttp3_data_reader *preader = NULL;
+  CURLcode result;
+
+  *pnwritten = 0;
+  Curl_dynhds_init(&h2_headers, 0, DYN_HTTP_REQUEST);
+
+  result = Curl_cf_ngtcp2_h3_stream_setup(cf, data);
+  if(result)
+    goto out;
+  stream = H3_STREAM_CTX(ctx, data);
+  DEBUGASSERT(stream);
+  if(!stream) {
+    result = CURLE_FAILED_INIT;
+    goto out;
+  }
+
+  result = Curl_h1_req_parse_read(&stream->h1, buf, len, NULL,
+                                  !data->state.http_ignorecustom ?
+                                  data->set.str[STRING_CUSTOMREQUEST] : NULL,
+                                  0, pnwritten);
+  if(result)
+    goto out;
+  if(!stream->h1.done) {
+    /* need more data */
+    goto out;
+  }
+  DEBUGASSERT(stream->h1.req);
+
+  result = Curl_http_req_to_h2(&h2_headers, stream->h1.req, data);
+  if(result)
+    goto out;
+
+  /* no longer needed */
+  Curl_h1_req_parse_free(&stream->h1);
+
+  nheader = Curl_dynhds_count(&h2_headers);
+  nva = curlx_malloc(sizeof(nghttp3_nv) * nheader);
+  if(!nva) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  for(i = 0; i < nheader; ++i) {
+    struct dynhds_entry *e = Curl_dynhds_getn(&h2_headers, i);
+    nva[i].name = (unsigned char *)e->name;
+    nva[i].namelen = e->namelen;
+    nva[i].value = (unsigned char *)e->value;
+    nva[i].valuelen = e->valuelen;
+    nva[i].flags = NGHTTP3_NV_FLAG_NONE;
+  }
+
+  rc = ngtcp2_conn_open_bidi_stream(ctx->qconn, &sid, data);
+  if(rc) {
+    failf(data, "cannot open bidi streams");
+    result = CURLE_SEND_ERROR;
+    goto out;
+  }
+  stream->id = sid;
+  ++ctx->used_bidi_streams;
+
+  switch(data->state.httpreq) {
+  case HTTPREQ_POST:
+  case HTTPREQ_POST_FORM:
+  case HTTPREQ_POST_MIME:
+  case HTTPREQ_PUT:
+    /* known request body size or -1 */
+    if(data->state.infilesize != -1)
+      stream->upload_left = data->state.infilesize;
+    else
+      /* data sending without specifying the data amount up front */
+      stream->upload_left = -1; /* unknown */
+    break;
+  default:
+    /* there is no request body */
+    stream->upload_left = 0; /* no request body */
+    break;
+  }
+
+  stream->send_closed = (stream->upload_left == 0);
+  if(!stream->send_closed) {
+    reader.read_data = cb_h3_read_req_body;
+    preader = &reader;
+  }
+
+  rc = nghttp3_conn_submit_request(ctx->h3conn, stream->id,
+                                   nva, nheader, preader, data);
+  if(rc) {
+    switch(rc) {
+    case NGHTTP3_ERR_CONN_CLOSING:
+      CURL_TRC_CF(data, cf, "h3sid[%" PRId64 "] failed to send, "
+                  "connection is closing", stream->id);
+      break;
+    default:
+      CURL_TRC_CF(data, cf, "h3sid[%" PRId64 "] failed to send -> "
+                  "%d (%s)", stream->id, rc, nghttp3_strerror(rc));
+      break;
+    }
+    Curl_cf_ngtcp2_h3_stream_close(cf, data, stream);
+    result = CURLE_SEND_ERROR;
+    goto out;
+  }
+
+  cf_ngtcp2_upd_rx_win(cf, data, stream);
+
+  if(Curl_trc_is_verbose(data)) {
+    infof(data, "[HTTP/3] [%" PRId64 "] OPENED stream for %s",
+          stream->id, Curl_bufref_ptr(&data->state.url));
+    for(i = 0; i < nheader; ++i) {
+      infof(data, "[HTTP/3] [%" PRId64 "] [%.*s: %.*s]", stream->id,
+            (int)nva[i].namelen, nva[i].name,
+            (int)nva[i].valuelen, nva[i].value);
+    }
+  }
+
+out:
+  curlx_free(nva);
+  Curl_dynhds_free(&h2_headers);
+  return result;
+}
+
+static CURLcode cf_ngtcp2_send(struct Curl_cfilter *cf, struct Curl_easy *data,
+                               const uint8_t *buf, size_t len, bool eos,
+                               size_t *pnwritten)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+  struct cf_call_data save;
+  struct cf_ngtcp2_io_ctx pktx;
+  CURLcode result = CURLE_OK;
+
+  CF_DATA_SAVE(save, cf, data);
+  DEBUGASSERT(cf->connected);
+  DEBUGASSERT(ctx->qconn);
+  DEBUGASSERT(ctx->h3conn);
+  Curl_cf_ngtcp2_io_ctx_init(&pktx, cf, data);
+  *pnwritten = 0;
+
+  /* handshake verification failed in callback, do not send anything */
+  if(ctx->tls_vrfy_result) {
+    result = ctx->tls_vrfy_result;
+    goto denied;
+  }
+
+  (void)eos; /* use for stream EOF and block handling */
+  result = Curl_cf_ngtcp2_progress_ingress(cf, data, &pktx);
+  if(result)
+    goto out;
+
+  if(!stream || stream->id < 0) {
+    if(ctx->shutdown_started) {
+      CURL_TRC_CF(data, cf, "cannot open stream on closed connection");
+      result = CURLE_SEND_ERROR;
+      goto out;
+    }
+    result = h3_stream_open(cf, data, buf, len, pnwritten);
+    if(result) {
+      CURL_TRC_CF(data, cf, "failed to open stream -> %d", (int)result);
+      goto out;
+    }
+    VERBOSE(stream = H3_STREAM_CTX(ctx, data));
+  }
+  else if(stream->xfer_result) {
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] xfer write failed", stream->id);
+    Curl_cf_ngtcp2_h3_stream_close(cf, data, stream);
+    result = stream->xfer_result;
+    goto out;
+  }
+  else if(stream->closed) {
+    if(stream->resp_hds_complete) {
+      /* Server decided to close the stream after having sent us a final
+       * response. This is valid if it is not interested in the request
+       * body. This happens on 30x or 40x responses.
+       * We silently discard the data sent, since this is not a transport
+       * error situation. */
+      CURL_TRC_CF(data, cf, "[%" PRId64 "] discarding data"
+                  "on closed stream with response", stream->id);
+      result = CURLE_OK;
+      *pnwritten = len;
+      goto out;
+    }
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] send_body(len=%zu) "
+                "-> stream closed", stream->id, len);
+    result = CURLE_HTTP3;
+    goto out;
+  }
+  else if(ctx->shutdown_started) {
+    CURL_TRC_CF(data, cf, "cannot send on closed connection");
+    result = CURLE_SEND_ERROR;
+    goto out;
+  }
+  else {
+    result = Curl_bufq_write(&stream->sendbuf, buf, len, pnwritten);
+    CURL_TRC_CF(data, cf, "[%" PRId64 "] cf_send, add to "
+                "sendbuf(len=%zu) -> %d, %zu",
+                stream->id, len, (int)result, *pnwritten);
+    if(result)
+      goto out;
+    (void)nghttp3_conn_resume_stream(ctx->h3conn, stream->id);
+  }
+
+  if(*pnwritten > 0 && !ctx->tls_handshake_complete && ctx->use_earlydata)
+    ctx->earlydata_skip += *pnwritten;
+
+  DEBUGASSERT(!result);
+  result = Curl_cf_ngtcp2_progress_egress(cf, data, &pktx);
+
+out:
+  result = Curl_1st_fatal(result,
+                          Curl_cf_ngtcp2_cmn_set_expiry(cf, data, &pktx));
+  if(ctx->tls_vrfy_result)
+    result = ctx->tls_vrfy_result;
+denied:
+  CURL_TRC_CF(data, cf, "[%" PRId64 "] cf_send(len=%zu) -> %d, %zu",
+              stream ? stream->id : -1, len, (int)result, *pnwritten);
+  CF_DATA_RESTORE(cf, save);
+  return result;
+}
+
+static CURLcode h3_data_pause(struct Curl_cfilter *cf,
+                              struct Curl_easy *data,
+                              bool pause)
+{
+  /* There seems to exist no API in ngtcp2 to shrink/enlarge the streams
+   * windows. As we do in HTTP/2. */
+  (void)cf;
+  if(!pause)
+    Curl_multi_mark_dirty(data);
+  return CURLE_OK;
+}
+
+static CURLcode cf_ngtcp2_cntrl(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                int event, int arg1, void *arg2)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+  struct cf_call_data save;
+
+  CF_DATA_SAVE(save, cf, data);
+  (void)arg1;
+  (void)arg2;
+  switch(event) {
+  case CF_CTRL_DATA_SETUP:
+    break;
+  case CF_CTRL_DATA_PAUSE:
+    result = h3_data_pause(cf, data, (arg1 != 0));
+    break;
+  case CF_CTRL_DATA_DONE:
+    Curl_cf_ngtcp2_h3_stream_done(cf, data);
+    break;
+  case CF_CTRL_DATA_DONE_SEND: {
+    struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+    if(stream && !stream->send_closed) {
+      stream->send_closed = TRUE;
+      stream->upload_left = Curl_bufq_len(&stream->sendbuf) -
+        stream->sendbuf_len_in_flight;
+      (void)nghttp3_conn_resume_stream(ctx->h3conn, stream->id);
+    }
+    break;
+  }
+  case CF_CTRL_CONN_INFO_UPDATE:
+    if(!cf->sockindex && cf->connected) {
+      cf->conn->httpversion_seen = 30;
+      Curl_conn_set_multiplex(cf->conn);
+    }
+    break;
+  default:
+    break;
+  }
+  CF_DATA_RESTORE(cf, save);
+  return result;
+}
+
+static void cf_ngtcp2_ctx_close(struct cf_ngtcp2_ctx *ctx)
+{
+  struct cf_call_data save = ctx->call_data;
+
+  if(!ctx->initialized)
+    return;
+  if(ctx->qlogfd != -1) {
+    curlx_close(ctx->qlogfd);
+  }
+  ctx->qlogfd = -1;
+  Curl_vquic_tls_cleanup(&ctx->tls);
+  Curl_ssl_peer_cleanup(&ctx->ssl_peer);
+  vquic_ctx_free(&ctx->q);
+  if(ctx->h3conn) {
+    nghttp3_conn_del(ctx->h3conn);
+    ctx->h3conn = NULL;
+  }
+  if(ctx->qconn) {
+    ngtcp2_conn_del(ctx->qconn);
+    ctx->qconn = NULL;
+  }
+#ifdef OPENSSL_QUIC_API2
+  if(ctx->ossl_ctx) {
+    ngtcp2_crypto_ossl_ctx_del(ctx->ossl_ctx);
+    ctx->ossl_ctx = NULL;
+  }
+#endif
+  ctx->call_data = save;
+}
+
+static void cf_ngtcp2_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+
+  CURL_TRC_CF(data, cf, "destroy");
+  if(ctx) {
+    if(ctx->qconn) {
+      struct cf_call_data save;
+      CF_DATA_SAVE(save, cf, data);
+      Curl_cf_ngtcp2_cmn_conn_close(cf, data);
+      cf_ngtcp2_ctx_close(ctx);
+      CF_DATA_RESTORE(cf, save);
+    }
+    Curl_cf_ngtcp2_ctx_cleanup(ctx);
+    curlx_free(ctx);
+    cf->ctx = NULL;
+  }
+}
+
+static CURLcode cf_ngtcp2_connect(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  bool *done)
+{
+  return Curl_cf_ngtcp2_cmn_connect(cf, data, done);
+}
+
+static CURLcode cf_ngtcp2_query(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                int query, int *pres1, void *pres2)
+{
+  struct cf_ngtcp2_ctx *ctx = cf->ctx;
+  struct cf_call_data save;
+
+  switch(query) {
+  case CF_QUERY_MAX_CONCURRENT: {
+    DEBUGASSERT(pres1);
+    CF_DATA_SAVE(save, cf, data);
+    /* Set after transport params arrived and continually updated
+     * by callback. QUIC counts the number over the lifetime of the
+     * connection, ever increasing.
+     * We count the *open* transfers plus the budget for new ones. */
+    if(!ctx->qconn || ctx->shutdown_started) {
+      *pres1 = 0;
+    }
+    else if(ctx->max_bidi_streams) {
+      uint64_t avail_bidi_streams = 0;
+      uint64_t max_streams = cf->conn->attached_xfers;
+      if(ctx->max_bidi_streams > ctx->used_bidi_streams)
+        avail_bidi_streams = ctx->max_bidi_streams - ctx->used_bidi_streams;
+      max_streams += avail_bidi_streams;
+      *pres1 = (max_streams > INT_MAX) ? INT_MAX : (int)max_streams;
+    }
+    else  /* transport params not arrived yet? take our default. */
+      *pres1 = (int)Curl_multi_max_concurrent_streams(data->multi);
+    CURL_TRC_CF(data, cf, "query conn[%" FMT_OFF_T "]: "
+                "MAX_CONCURRENT -> %d (%u in use)",
+                cf->conn->connection_id, *pres1, cf->conn->attached_xfers);
+    CF_DATA_RESTORE(cf, save);
+    return CURLE_OK;
+  }
+  case CF_QUERY_CONNECT_REPLY_MS:
+    if(ctx->q.got_first_byte) {
+      timediff_t ms = curlx_ptimediff_ms(&ctx->q.first_byte_at,
+                                         &ctx->started_at);
+      *pres1 = (ms < INT_MAX) ? (int)ms : INT_MAX;
+    }
+    else
+      *pres1 = -1;
+    return CURLE_OK;
+  case CF_QUERY_TIMER_CONNECT: {
+    struct curltime *when = pres2;
+    if(ctx->q.got_first_byte)
+      *when = ctx->q.first_byte_at;
+    return CURLE_OK;
+  }
+  case CF_QUERY_TIMER_APPCONNECT: {
+    struct curltime *when = pres2;
+    if(cf->connected)
+      *when = ctx->handshake_at;
+    return CURLE_OK;
+  }
+  case CF_QUERY_HTTP_VERSION:
+    *pres1 = 30;
+    return CURLE_OK;
+  case CF_QUERY_SSL_INFO:
+  case CF_QUERY_SSL_CTX_INFO: {
+    struct curl_tlssessioninfo *info = pres2;
+    if(Curl_vquic_tls_get_ssl_info(&ctx->tls,
+                                   (query == CF_QUERY_SSL_CTX_INFO), info))
+      return CURLE_OK;
+    break;
+  }
+  case CF_QUERY_ALPN_NEGOTIATED: {
+    const char **palpn = pres2;
+    DEBUGASSERT(palpn);
+    *palpn = cf->connected ? "h3" : NULL;
+    return CURLE_OK;
+  }
+  default:
+    break;
+  }
+  return cf->next ?
+    cf->next->cft->query(cf->next, data, query, pres1, pres2) :
+    CURLE_UNKNOWN_OPTION;
+}
+
+struct Curl_cftype Curl_cft_http3 = {
+  "HTTP/3",
+  CF_TYPE_IP_CONNECT | CF_TYPE_SSL | CF_TYPE_MULTIPLEX | CF_TYPE_HTTP,
+  0,
+  cf_ngtcp2_destroy,
+  cf_ngtcp2_connect,
+  Curl_cf_ngtcp2_cmn_shutdown,
+  cf_ngtcp2_adjust_pollset,
+  Curl_cf_def_data_pending,
+  cf_ngtcp2_send,
+  cf_ngtcp2_recv,
+  cf_ngtcp2_cntrl,
+  Curl_cf_ngtcp2_cmn_conn_is_alive,
+  Curl_cf_def_conn_keep_alive,
+  cf_ngtcp2_query,
+};
+
+CURLcode Curl_cf_ngtcp2_create(struct Curl_cfilter **pcf,
+                               struct Curl_easy *data,
+                               struct Curl_peer *origin,
+                               struct Curl_peer *peer,
+                               struct connectdata *conn,
+                               struct Curl_sockaddr_ex *addr)
+{
+  struct cf_ngtcp2_ctx *ctx = NULL;
+  struct Curl_cfilter *cf = NULL;
+  CURLcode result;
+
+  ctx = curlx_calloc(1, sizeof(*ctx));
+  if(!ctx) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+  result = Curl_cf_ngtcp2_ctx_init(ctx, origin, peer,
+                                   &conn->ssl_config, init_ngh3_conn);
+  if(!result)
+    result = Curl_cf_create(&cf, &Curl_cft_http3, ctx);
+  if(result)
+    goto out;
+  cf->conn = conn;
+
+  result = Curl_cf_udp_create(&cf->next, data, origin, peer, TRNSPRT_QUIC,
+                              conn, addr, NULL, TRNSPRT_QUIC);
+  if(result)
+    goto out;
+  cf->next->conn = cf->conn;
+  cf->next->sockindex = cf->sockindex;
+
+out:
+  *pcf = (!result) ? cf : NULL;
+  if(result) {
+    if(cf)
+      Curl_conn_cf_discard_chain(&cf, data);
+    else if(ctx) {
+      Curl_cf_ngtcp2_ctx_cleanup(ctx);
+      curlx_free(ctx);
+    }
+  }
+  return result;
+}
+
+CURLcode Curl_cf_ngtcp2_insert_after(struct Curl_cfilter *cf_at,
+                                     struct Curl_peer *origin,
+                                     struct Curl_peer *peer)
+{
+  struct cf_ngtcp2_ctx *ctx = NULL;
+  struct Curl_cfilter *cf = NULL;
+  CURLcode result;
+
+  ctx = curlx_calloc(1, sizeof(*ctx));
+  if(!ctx) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+  result = Curl_cf_ngtcp2_ctx_init(ctx, origin, peer,
+                                   &cf_at->conn->ssl_config, init_ngh3_conn);
+  if(!result)
+    result = Curl_cf_create(&cf, &Curl_cft_http3, ctx);
+  if(result)
+    goto out;
+  Curl_conn_cf_insert_after(cf_at, cf);
+out:
+  if(result) {
+    curlx_safefree(cf);
+    if(ctx) {
+      Curl_cf_ngtcp2_ctx_cleanup(ctx);
+      curlx_free(ctx);
+    }
+  }
+  return result;
+}
+
+#endif
diff --git a/third-party/curl/lib/vquic/cf-ngtcp2.h b/third-party/curl/lib/vquic/cf-ngtcp2.h
new file mode 100644
index 0000000000..601efc8224
--- /dev/null
+++ b/third-party/curl/lib/vquic/cf-ngtcp2.h
@@ -0,0 +1,63 @@
+#ifndef HEADER_CURL_VQUIC_CF_NGTCP2_H
+#define HEADER_CURL_VQUIC_CF_NGTCP2_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_NGTCP2) && defined(USE_NGHTTP3)
+
+#ifdef HAVE_NETINET_UDP_H
+#include <netinet/udp.h>
+#endif
+
+#include <ngtcp2/ngtcp2_crypto.h>
+#ifdef OPENSSL_QUIC_API2
+#include <ngtcp2/ngtcp2_crypto_ossl.h>
+#endif
+#include <nghttp3/nghttp3.h>
+#ifdef USE_OPENSSL
+#include <openssl/ssl.h>
+#elif defined(USE_WOLFSSL)
+#include <wolfssl/options.h>
+#include <wolfssl/ssl.h>
+#include <wolfssl/quic.h>
+#endif
+
+struct Curl_cfilter;
+
+#include "urldata.h"
+
+CURLcode Curl_cf_ngtcp2_create(struct Curl_cfilter **pcf,
+                               struct Curl_easy *data,
+                               struct Curl_peer *origin,
+                               struct Curl_peer *peer,
+                               struct connectdata *conn,
+                               struct Curl_sockaddr_ex *addr);
+
+CURLcode Curl_cf_ngtcp2_insert_after(struct Curl_cfilter *cf_at,
+                               struct Curl_peer *origin,
+                               struct Curl_peer *peer);
+#endif
+
+#endif /* HEADER_CURL_VQUIC_CF_NGTCP2_H */
diff --git a/third-party/curl/lib/vquic/cf-quiche.c b/third-party/curl/lib/vquic/cf-quiche.c
new file mode 100644
index 0000000000..31a3957ec3
--- /dev/null
+++ b/third-party/curl/lib/vquic/cf-quiche.c
@@ -0,0 +1,1713 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_QUICHE)
+#include <quiche.h>
+#include <openssl/err.h>
+#include <openssl/ssl.h>
+
+#include "bufq.h"
+#include "uint-hash.h"
+#include "urldata.h"
+#include "cfilters.h"
+#include "cf-dns.h"
+#include "cf-socket.h"
+#include "curl_trc.h"
+#include "rand.h"
+#include "multiif.h"
+#include "connect.h"
+#include "progress.h"
+#include "select.h"
+#include "http1.h"
+#include "sockaddr.h"
+#include "vquic/vquic.h"
+#include "vquic/vquic_int.h"
+#include "vquic/vquic-tls.h"
+#include "vquic/cf-quiche.h"
+#include "transfer.h"
+#include "url.h"
+#include "bufref.h"
+#include "vtls/openssl.h"
+#include "vtls/vtls.h"
+
+/* HTTP/3 error values defined in RFC 9114, ch. 8.1 */
+#define CURL_H3_NO_ERROR  0x0100
+
+#define MAX_PKT_BURST          10
+
+#define QUIC_MAX_STREAMS       100
+
+#define H3_STREAM_WINDOW_SIZE  (1024 * 128)
+#define H3_STREAM_CHUNK_SIZE   (1024 * 16)
+/* Receive and Send max number of chunks follows from the
+ * chunk size and window size */
+#define H3_STREAM_RECV_CHUNKS \
+  (H3_STREAM_WINDOW_SIZE / H3_STREAM_CHUNK_SIZE)
+
+/*
+ * Store quiche version info in this buffer.
+ */
+void Curl_quiche_ver(char *p, size_t len)
+{
+  (void)curl_msnprintf(p, len, "quiche/%s", quiche_version());
+}
+
+struct cf_quiche_ctx {
+  struct cf_quic_ctx q;
+  struct ssl_peer ssl_peer;
+  struct curl_tls_ctx tls;
+  quiche_conn *qconn;
+  quiche_config *cfg;
+  quiche_h3_conn *h3c;
+  quiche_h3_config *h3config;
+  uint8_t scid[QUICHE_MAX_CONN_ID_LEN];
+  struct curltime started_at;        /* time the current attempt started */
+  struct curltime handshake_at;      /* time connect handshake finished */
+  struct uint_hash streams;          /* hash `data->mid` to `stream_ctx` */
+  struct dynbuf h1hdr;               /* temp buffer for header construction */
+  struct bufq writebuf;              /* temp buffer for writing bodies */
+  curl_off_t data_recvd;
+  BIT(initialized);
+  BIT(goaway);                       /* got GOAWAY from server */
+  BIT(x509_store_setup);             /* if x509 store has been set up */
+  BIT(shutdown_started);             /* queued shutdown packets */
+};
+
+#ifdef DEBUG_QUICHE
+/* initialize debug log callback only once */
+static int debug_log_init = 0;
+static void quiche_debug_log(const char *line, void *argp)
+{
+  (void)argp;
+  curl_mfprintf(stderr, "%s\n", line);
+}
+#endif
+
+static void h3_stream_hash_free(unsigned int id, void *stream);
+
+static CURLcode cf_quiche_ctx_init(struct cf_quiche_ctx *ctx,
+                                   struct Curl_peer *origin,
+                                   struct Curl_peer *peer,
+                                   struct ssl_primary_config *sslc)
+{
+  DEBUGASSERT(!ctx->initialized);
+#ifdef DEBUG_QUICHE
+  if(!debug_log_init) {
+    quiche_enable_debug_logging(quiche_debug_log, NULL);
+    debug_log_init = 1;
+  }
+#endif
+  curlx_dyn_init(&ctx->h1hdr, CURL_MAX_HTTP_HEADER);
+  Curl_uint32_hash_init(&ctx->streams, 63, h3_stream_hash_free);
+  Curl_bufq_init2(&ctx->writebuf, H3_STREAM_CHUNK_SIZE, H3_STREAM_RECV_CHUNKS,
+                  BUFQ_OPT_SOFT_LIMIT);
+  ctx->data_recvd = 0;
+  ctx->initialized = TRUE;
+  return Curl_vquic_tls_peer_init(origin, peer, sslc, &ctx->ssl_peer);
+}
+
+static void cf_quiche_ctx_free(struct cf_quiche_ctx *ctx)
+{
+  if(ctx && ctx->initialized) {
+    /* quiche freed it */
+    ctx->tls.ossl.ssl = NULL;
+    Curl_vquic_tls_cleanup(&ctx->tls);
+    Curl_ssl_peer_cleanup(&ctx->ssl_peer);
+    vquic_ctx_free(&ctx->q);
+    Curl_uint32_hash_destroy(&ctx->streams);
+    curlx_dyn_free(&ctx->h1hdr);
+    Curl_bufq_free(&ctx->writebuf);
+  }
+  curlx_free(ctx);
+}
+
+static void cf_quiche_ctx_close(struct cf_quiche_ctx *ctx)
+{
+  if(ctx->h3c) {
+    quiche_h3_conn_free(ctx->h3c);
+    ctx->h3c = NULL;
+  }
+  if(ctx->h3config) {
+    quiche_h3_config_free(ctx->h3config);
+    ctx->h3config = NULL;
+  }
+  if(ctx->qconn) {
+    quiche_conn_free(ctx->qconn);
+    ctx->qconn = NULL;
+  }
+  if(ctx->cfg) {
+    quiche_config_free(ctx->cfg);
+    ctx->cfg = NULL;
+  }
+  Curl_ssl_peer_cleanup(&ctx->ssl_peer);
+}
+
+static CURLcode cf_flush_egress(struct Curl_cfilter *cf,
+                                struct Curl_easy *data);
+
+/**
+ * All about the H3 internals of a stream
+ */
+struct h3_stream_ctx {
+  uint64_t id;             /* HTTP/3 protocol stream identifier */
+  struct h1_req_parser h1; /* h1 request parsing */
+  uint64_t error3;         /* HTTP/3 stream error code */
+  int status_code;         /* HTTP status code */
+  CURLcode xfer_result;    /* result from cf_quiche_write_(hd/body) */
+  BIT(opened);             /* TRUE after stream has been opened */
+  BIT(closed);             /* TRUE on stream close */
+  BIT(reset);              /* TRUE on stream reset */
+  BIT(send_closed);        /* stream is locally closed */
+  BIT(resp_hds_complete);  /* final response has been received */
+  BIT(resp_got_header);    /* TRUE when h3 stream has recvd some HEADER */
+  BIT(quic_flow_blocked);  /* stream is blocked by QUIC flow control */
+};
+
+static void h3_stream_ctx_free(struct h3_stream_ctx *stream)
+{
+  Curl_h1_req_parse_free(&stream->h1);
+  curlx_free(stream);
+}
+
+static void h3_stream_hash_free(unsigned int id, void *stream)
+{
+  (void)id;
+  DEBUGASSERT(stream);
+  h3_stream_ctx_free((struct h3_stream_ctx *)stream);
+}
+
+typedef bool cf_quiche_svisit(struct Curl_cfilter *cf,
+                              struct Curl_easy *sdata,
+                              struct h3_stream_ctx *stream,
+                              void *user_data);
+
+struct cf_quiche_visit_ctx {
+  struct Curl_cfilter *cf;
+  struct Curl_multi *multi;
+  cf_quiche_svisit *cb;
+  void *user_data;
+};
+
+static bool cf_quiche_stream_do(uint32_t mid, void *val, void *user_data)
+{
+  struct cf_quiche_visit_ctx *vctx = user_data;
+  struct h3_stream_ctx *stream = val;
+  struct Curl_easy *sdata = Curl_multi_get_easy(vctx->multi, mid);
+  if(sdata)
+    return vctx->cb(vctx->cf, sdata, stream, vctx->user_data);
+  return TRUE;
+}
+
+static void cf_quiche_for_all_streams(struct Curl_cfilter *cf,
+                                      struct Curl_multi *multi,
+                                      cf_quiche_svisit *do_cb,
+                                      void *user_data)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  struct cf_quiche_visit_ctx vctx;
+  vctx.cf = cf;
+  vctx.multi = multi;
+  vctx.cb = do_cb;
+  vctx.user_data = user_data;
+  Curl_uint32_hash_visit(&ctx->streams, cf_quiche_stream_do, &vctx);
+}
+
+static bool cf_quiche_do_resume(struct Curl_cfilter *cf,
+                                struct Curl_easy *sdata,
+                                struct h3_stream_ctx *stream,
+                                void *user_data)
+{
+  (void)user_data;
+  if(stream->quic_flow_blocked) {
+    stream->quic_flow_blocked = FALSE;
+    Curl_multi_mark_dirty(sdata);
+    CURL_TRC_CF(sdata, cf, "[%" PRIu64 "] unblock", stream->id);
+  }
+  return TRUE;
+}
+
+static bool cf_quiche_do_expire(struct Curl_cfilter *cf,
+                                struct Curl_easy *sdata,
+                                struct h3_stream_ctx *stream,
+                                void *user_data)
+{
+  (void)stream;
+  (void)user_data;
+  CURL_TRC_CF(sdata, cf, "conn closed, mark as dirty");
+  stream->xfer_result = CURLE_SEND_ERROR;
+  Curl_multi_mark_dirty(sdata);
+  return TRUE;
+}
+
+static CURLcode h3_data_setup(struct Curl_cfilter *cf,
+                              struct Curl_easy *data)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+
+  if(stream)
+    return CURLE_OK;
+
+  stream = curlx_calloc(1, sizeof(*stream));
+  if(!stream)
+    return CURLE_OUT_OF_MEMORY;
+
+  stream->id = -1;
+  Curl_h1_req_parse_init(&stream->h1, H1_PARSE_DEFAULT_MAX_LINE_LEN);
+
+  if(!Curl_uint32_hash_set(&ctx->streams, data->mid, stream)) {
+    h3_stream_ctx_free(stream);
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  return CURLE_OK;
+}
+
+static void cf_quiche_stream_close(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data,
+                                   struct h3_stream_ctx *stream)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  CURLcode result;
+
+  if(ctx->qconn && !stream->closed) {
+    quiche_conn_stream_shutdown(ctx->qconn, stream->id,
+                                QUICHE_SHUTDOWN_READ, CURL_H3_NO_ERROR);
+    if(!stream->send_closed) {
+      quiche_conn_stream_shutdown(ctx->qconn, stream->id,
+                                  QUICHE_SHUTDOWN_WRITE, CURL_H3_NO_ERROR);
+      stream->send_closed = TRUE;
+    }
+    stream->closed = TRUE;
+    result = cf_flush_egress(cf, data);
+    if(result)
+      CURL_TRC_CF(data, cf, "[%" PRIu64 "] stream close, flush egress -> %d",
+                  stream->id, (int)result);
+  }
+}
+
+static void h3_data_done(struct Curl_cfilter *cf, struct Curl_easy *data)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+
+  (void)cf;
+  if(stream) {
+    CURL_TRC_CF(data, cf, "[%" PRIu64 "] easy handle is done", stream->id);
+    cf_quiche_stream_close(cf, data, stream);
+    Curl_uint32_hash_remove(&ctx->streams, data->mid);
+  }
+}
+
+static void cf_quiche_expire_conn_closed(struct Curl_cfilter *cf,
+                                         struct Curl_easy *data)
+{
+  DEBUGASSERT(data->multi);
+  CURL_TRC_CF(data, cf, "conn closed, expire all transfers");
+  cf_quiche_for_all_streams(cf, data->multi, cf_quiche_do_expire, NULL);
+}
+
+static void cf_quiche_write_hd(struct Curl_cfilter *cf,
+                               struct Curl_easy *data,
+                               struct h3_stream_ctx *stream,
+                               const char *buf, size_t blen, bool eos)
+{
+  /* This function returns no error intentionally, but records
+   * the result at the stream, skipping further writes once the
+   * `result` of the transfer is known.
+   * The stream is subsequently cancelled "higher up" in the filter's
+   * send/recv callbacks. Closing the stream here leads to SEND/RECV
+   * errors in other places that then overwrite the transfer's result. */
+  if(!stream->xfer_result) {
+    stream->xfer_result = Curl_xfer_write_resp_hd(data, buf, blen, eos);
+    if(stream->xfer_result)
+      CURL_TRC_CF(data, cf, "[%" PRIu64 "] error %d writing %zu "
+                  "bytes of headers", stream->id, (int)stream->xfer_result,
+                  blen);
+  }
+}
+
+struct cb_ctx {
+  struct Curl_cfilter *cf;
+  struct Curl_easy *data;
+  struct h3_stream_ctx *stream;
+};
+
+static bool is_valid_h3_header(const uint8_t *hdr, size_t hlen)
+{
+  while(hlen--) {
+    switch(*hdr++) {
+    case '\n':
+    case '\r':
+    case '\0':
+      return FALSE;
+    }
+  }
+  return TRUE;
+}
+
+static int cb_each_header(uint8_t *name, size_t name_len,
+                          uint8_t *value, size_t value_len,
+                          void *argp)
+{
+  struct cb_ctx *x = argp;
+  struct Curl_cfilter *cf = x->cf;
+  struct Curl_easy *data = x->data;
+  struct h3_stream_ctx *stream = x->stream;
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  if(!stream || stream->xfer_result)
+    return 1; /* abort iteration */
+
+  if((name_len == 7) && !strncmp(HTTP_PSEUDO_STATUS, (char *)name, 7) &&
+     is_valid_h3_header(value, value_len)) {
+    curlx_dyn_reset(&ctx->h1hdr);
+    result = Curl_http_decode_status(&stream->status_code,
+                                     (const char *)value, value_len);
+    if(!result)
+      result = curlx_dyn_addn(&ctx->h1hdr, STRCONST("HTTP/3 "));
+    if(!result)
+      result = curlx_dyn_addn(&ctx->h1hdr, (const char *)value, value_len);
+    if(!result)
+      result = curlx_dyn_addn(&ctx->h1hdr, STRCONST(" \r\n"));
+    if(!result)
+      cf_quiche_write_hd(cf, data, stream, curlx_dyn_ptr(&ctx->h1hdr),
+                         curlx_dyn_len(&ctx->h1hdr), FALSE);
+    CURL_TRC_CF(data, cf, "[%" PRIu64 "] status: %s",
+                stream->id, curlx_dyn_ptr(&ctx->h1hdr));
+  }
+  else {
+    if(is_valid_h3_header(value, value_len) &&
+       is_valid_h3_header(name, name_len)) {
+      /* store as an HTTP1-style header */
+      CURL_TRC_CF(data, cf, "[%" PRIu64 "] header: %.*s: %.*s",
+                  stream->id, (int)name_len, name,
+                  (int)value_len, value);
+      curlx_dyn_reset(&ctx->h1hdr);
+      result = curlx_dyn_addn(&ctx->h1hdr, (const char *)name, name_len);
+      if(!result)
+        result = curlx_dyn_addn(&ctx->h1hdr, STRCONST(": "));
+      if(!result)
+        result = curlx_dyn_addn(&ctx->h1hdr, (const char *)value, value_len);
+      if(!result)
+        result = curlx_dyn_addn(&ctx->h1hdr, STRCONST("\r\n"));
+      if(!result)
+        cf_quiche_write_hd(cf, data, stream, curlx_dyn_ptr(&ctx->h1hdr),
+                           curlx_dyn_len(&ctx->h1hdr), FALSE);
+    }
+    else
+      CURL_TRC_CF(x->data, x->cf, "[%" PRIu64 "] ignore %zu bytes bad header",
+                  stream->id, value_len + name_len);
+  }
+
+  if(result) {
+    CURL_TRC_CF(x->data, x->cf, "[%" PRIu64 "] on header error %d",
+                stream->id, (int)result);
+    if(!stream->xfer_result)
+      stream->xfer_result = result;
+  }
+  return stream->xfer_result ? 1 : 0;
+}
+
+static CURLcode stream_resp_read(void *reader_ctx,
+                                 unsigned char *buf, size_t len,
+                                 size_t *pnread)
+{
+  struct cb_ctx *x = reader_ctx;
+  struct cf_quiche_ctx *ctx = x->cf->ctx;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, x->data);
+  ssize_t nread;
+
+  *pnread = 0;
+  if(!stream)
+    return CURLE_RECV_ERROR;
+
+  nread = quiche_h3_recv_body(ctx->h3c, ctx->qconn, stream->id, buf, len);
+  if(!curlx_sztouz(nread, pnread))
+    return CURLE_AGAIN;
+  return CURLE_OK;
+}
+
+static void cf_quiche_flush_body(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 struct h3_stream_ctx *stream)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  const uint8_t *buf;
+  size_t blen;
+
+  while(stream && !stream->xfer_result) {
+    if(Curl_bufq_peek(&ctx->writebuf, &buf, &blen)) {
+      stream->xfer_result = Curl_xfer_write_resp(
+        data, (const char *)buf, blen, FALSE);
+      Curl_bufq_skip(&ctx->writebuf, blen);
+      if(stream->xfer_result) {
+        CURL_TRC_CF(data, cf, "[%" PRIu64 "] error %d writing %zu bytes"
+                    " of data", stream->id, (int)stream->xfer_result, blen);
+      }
+    }
+    else
+      break;
+  }
+  Curl_bufq_reset(&ctx->writebuf);
+}
+
+static void cf_quiche_recv_body(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                struct h3_stream_ctx *stream)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  size_t nread;
+  struct cb_ctx cb_ctx;
+  CURLcode result = CURLE_OK;
+
+  if(!stream)
+    return;
+
+  /* Even when the transfer has already errored, we need to receive
+   * the data from quiche, as quiche otherwise gets stuck and
+   * raise events to receive over and over again. */
+  cb_ctx.cf = cf;
+  cb_ctx.data = data;
+  cb_ctx.stream = stream;
+  Curl_bufq_reset(&ctx->writebuf);
+  while(!result) {
+    result = Curl_bufq_slurp(&ctx->writebuf,
+                             stream_resp_read, &cb_ctx, &nread);
+    if(!result)
+      cf_quiche_flush_body(cf, data, stream);
+    else if(result == CURLE_AGAIN)
+      break;
+    else if(result) {
+      CURL_TRC_CF(data, cf, "[%" PRIu64 "] recv_body error %d",
+                  stream->id, (int)result);
+      failf(data, "[%" PRIu64 "] Error %d in HTTP/3 response body for stream",
+            stream->id, (int)result);
+      stream->closed = TRUE;
+      stream->reset = TRUE;
+      stream->send_closed = TRUE;
+      if(!stream->xfer_result)
+        stream->xfer_result = result;
+    }
+  }
+  cf_quiche_flush_body(cf, data, stream);
+}
+
+static void cf_quiche_process_ev(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 struct h3_stream_ctx *stream,
+                                 quiche_h3_event *ev)
+{
+  enum quiche_h3_event_type type;
+
+  if(!stream)
+    return;
+
+  type = quiche_h3_event_type(ev);
+
+  switch(type) {
+  case QUICHE_H3_EVENT_HEADERS: {
+    struct cb_ctx cb_ctx;
+    stream->resp_got_header = TRUE;
+    cb_ctx.cf = cf;
+    cb_ctx.data = data;
+    cb_ctx.stream = stream;
+    quiche_h3_event_for_each_header(ev, cb_each_header, &cb_ctx);
+    CURL_TRC_CF(data, cf, "[%" PRIu64 "] <- [HEADERS]", stream->id);
+    Curl_multi_mark_dirty(data);
+    break;
+  }
+  case QUICHE_H3_EVENT_DATA:
+    if(!stream->resp_hds_complete) {
+      stream->resp_hds_complete = TRUE;
+      cf_quiche_write_hd(cf, data, stream, "\r\n", 2, FALSE);
+    }
+    cf_quiche_recv_body(cf, data, stream);
+    CURL_TRC_CF(data, cf, "[%" PRIu64 "] <- [DATA]", stream->id);
+    Curl_multi_mark_dirty(data);
+    break;
+
+  case QUICHE_H3_EVENT_RESET:
+    CURL_TRC_CF(data, cf, "[%" PRIu64 "] RESET", stream->id);
+    stream->closed = TRUE;
+    stream->reset = TRUE;
+    stream->send_closed = TRUE;
+    Curl_multi_mark_dirty(data);
+    break;
+
+  case QUICHE_H3_EVENT_FINISHED:
+    CURL_TRC_CF(data, cf, "[%" PRIu64 "] CLOSED", stream->id);
+    if(!stream->resp_hds_complete) {
+      stream->resp_hds_complete = TRUE;
+      cf_quiche_write_hd(cf, data, stream, "\r\n", 2, TRUE);
+    }
+    stream->closed = TRUE;
+    Curl_multi_mark_dirty(data);
+    break;
+
+  case QUICHE_H3_EVENT_GOAWAY:
+    CURL_TRC_CF(data, cf, "[%" PRIu64 "] <- [GOAWAY]", stream->id);
+    break;
+
+  default:
+    CURL_TRC_CF(data, cf, "[%" PRIu64 "] recv, unhandled event %d",
+                stream->id, (int)type);
+    break;
+  }
+}
+
+struct cf_quich_disp_ctx {
+  uint64_t stream_id;
+  struct Curl_cfilter *cf;
+  struct Curl_multi *multi;
+  quiche_h3_event *ev;
+};
+
+static bool cf_quiche_disp_event(uint32_t mid, void *val, void *user_data)
+{
+  struct cf_quich_disp_ctx *dctx = user_data;
+  struct h3_stream_ctx *stream = val;
+
+  if(stream->id == dctx->stream_id) {
+    struct Curl_easy *sdata = Curl_multi_get_easy(dctx->multi, mid);
+    if(sdata)
+      cf_quiche_process_ev(dctx->cf, sdata, stream, dctx->ev);
+    return FALSE; /* stop iterating */
+  }
+  return TRUE;
+}
+
+static CURLcode cf_poll_events(struct Curl_cfilter *cf,
+                               struct Curl_easy *data)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  struct h3_stream_ctx *stream = NULL;
+  quiche_h3_event *ev;
+
+  /* Take in the events and distribute them to the transfers. */
+  while(ctx->h3c) {
+    int64_t rv = quiche_h3_conn_poll(ctx->h3c, ctx->qconn, &ev);
+    if(rv == QUICHE_H3_ERR_DONE) {
+      break;
+    }
+    else if(rv < 0) {
+      CURL_TRC_CF(data, cf, "error poll: %" PRId64, rv);
+      return CURLE_HTTP3;
+    }
+    else {
+      stream = H3_STREAM_CTX(ctx, data);
+      if(stream && stream->id == (uint64_t)rv) {
+        /* event for calling transfer */
+        cf_quiche_process_ev(cf, data, stream, ev);
+        quiche_h3_event_free(ev);
+        if(stream->xfer_result)
+          return stream->xfer_result;
+      }
+      else {
+        /* another transfer, do not return errors, as they are not for
+         * the calling transfer */
+        struct cf_quich_disp_ctx dctx;
+        dctx.stream_id = (uint64_t)rv;
+        dctx.cf = cf;
+        dctx.multi = data->multi;
+        dctx.ev = ev;
+        Curl_uint32_hash_visit(&ctx->streams, cf_quiche_disp_event, &dctx);
+        quiche_h3_event_free(ev);
+      }
+    }
+  }
+  return CURLE_OK;
+}
+
+struct recv_ctx {
+  struct Curl_cfilter *cf;
+  struct Curl_easy *data;
+  int pkts;
+};
+
+static CURLcode cf_quiche_recv_pkts(const unsigned char *buf, size_t buflen,
+                                    size_t gso_size,
+                                    struct sockaddr_storage *remote_addr,
+                                    socklen_t remote_addrlen, int ecn,
+                                    void *userp)
+{
+  struct recv_ctx *r = userp;
+  struct cf_quiche_ctx *ctx = r->cf->ctx;
+  quiche_recv_info recv_info;
+  size_t pktlen, offset, nread;
+  ssize_t rv;
+
+  (void)ecn;
+
+  recv_info.to = (struct sockaddr *)&ctx->q.local_addr;
+  recv_info.to_len = ctx->q.local_addrlen;
+  recv_info.from = (struct sockaddr *)remote_addr;
+  recv_info.from_len = remote_addrlen;
+
+  for(offset = 0; offset < buflen; offset += gso_size) {
+    pktlen = ((offset + gso_size) <= buflen) ? gso_size : (buflen - offset);
+    rv = quiche_conn_recv(ctx->qconn,
+                          (unsigned char *)CURL_UNCONST(buf + offset),
+                          pktlen, &recv_info);
+    if(!curlx_sztouz(rv, &nread)) {
+      if(QUICHE_ERR_DONE == rv) {
+        if(quiche_conn_is_draining(ctx->qconn)) {
+          CURL_TRC_CF(r->data, r->cf, "ingress, connection is draining");
+          return CURLE_RECV_ERROR;
+        }
+        if(quiche_conn_is_closed(ctx->qconn)) {
+          CURL_TRC_CF(r->data, r->cf, "ingress, connection is closed");
+          return CURLE_RECV_ERROR;
+        }
+        CURL_TRC_CF(r->data, r->cf, "ingress, quiche is DONE");
+        return CURLE_OK;
+      }
+      else if(QUICHE_ERR_TLS_FAIL == rv) {
+        long verify_ok = SSL_get_verify_result(ctx->tls.ossl.ssl);
+        if(verify_ok != X509_V_OK) {
+          failf(r->data, "SSL certificate problem: %s",
+                X509_verify_cert_error_string(verify_ok));
+          return CURLE_PEER_FAILED_VERIFICATION;
+        }
+        failf(r->data, "ingress, quiche reports TLS fail");
+        return CURLE_RECV_ERROR;
+      }
+      else {
+        failf(r->data, "quiche reports error %zd on receive", rv);
+        return CURLE_RECV_ERROR;
+      }
+    }
+    else if(nread < pktlen) {
+      CURL_TRC_CF(r->data, r->cf, "ingress, quiche only read %zu/%zu bytes",
+                  nread, pktlen);
+    }
+    ++r->pkts;
+  }
+
+  return CURLE_OK;
+}
+
+static CURLcode cf_process_ingress(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  struct recv_ctx rctx;
+  CURLcode result;
+
+  DEBUGASSERT(ctx->qconn);
+  result = Curl_vquic_tls_before_recv(&ctx->tls, cf, data);
+  if(result)
+    return result;
+
+  rctx.cf = cf;
+  rctx.data = data;
+  rctx.pkts = 0;
+
+  result = vquic_recv_packets(cf, data, &ctx->q, 1000,
+                              cf_quiche_recv_pkts, &rctx);
+  if(result)
+    return result;
+
+  if(rctx.pkts > 0) {
+    /* quiche digested ingress packets. It might have opened flow control
+     * windows again. */
+    DEBUGASSERT(data->multi);
+    cf_quiche_for_all_streams(cf, data->multi, cf_quiche_do_resume, NULL);
+  }
+  return cf_poll_events(cf, data);
+}
+
+struct read_ctx {
+  struct Curl_cfilter *cf;
+  struct Curl_easy *data;
+  quiche_send_info send_info;
+};
+
+static CURLcode read_pkt_to_send(void *userp,
+                                 unsigned char *buf, size_t buflen,
+                                 size_t *pnread)
+{
+  struct read_ctx *x = userp;
+  struct cf_quiche_ctx *ctx = x->cf->ctx;
+  ssize_t rv;
+
+  *pnread = 0;
+  rv = quiche_conn_send(ctx->qconn, buf, buflen, &x->send_info);
+  if(rv == QUICHE_ERR_DONE)
+    return CURLE_AGAIN;
+
+  if(!curlx_sztouz(rv, pnread)) {
+    failf(x->data, "quiche_conn_send returned %zd", rv);
+    return CURLE_SEND_ERROR;
+  }
+  return CURLE_OK;
+}
+
+/*
+ * flush_egress drains the buffers and sends off data.
+ * Calls failf() on errors.
+ */
+static CURLcode cf_flush_egress(struct Curl_cfilter *cf,
+                                struct Curl_easy *data)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  size_t nread;
+  CURLcode result;
+  int64_t expiry_ns;
+  int64_t timeout_ns;
+  struct read_ctx readx;
+  size_t pkt_count, gsolen;
+
+  expiry_ns = quiche_conn_timeout_as_nanos(ctx->qconn);
+  if(!expiry_ns) {
+    quiche_conn_on_timeout(ctx->qconn);
+    if(quiche_conn_is_closed(ctx->qconn)) {
+      if(quiche_conn_is_timed_out(ctx->qconn))
+        failf(data, "connection closed by idle timeout");
+      else
+        failf(data, "connection closed by server");
+      /* Connection timed out, expire all transfers belonging to it
+       * as it does not get any more POLL events here. */
+      cf_quiche_expire_conn_closed(cf, data);
+      return CURLE_SEND_ERROR;
+    }
+  }
+
+  result = vquic_flush(cf, data, &ctx->q);
+  if(result) {
+    if(result == CURLE_AGAIN) {
+      Curl_expire(data, 1, EXPIRE_QUIC);
+      return CURLE_OK;
+    }
+    return result;
+  }
+
+  readx.cf = cf;
+  readx.data = data;
+  memset(&readx.send_info, 0, sizeof(readx.send_info));
+  pkt_count = 0;
+  gsolen = quiche_conn_max_send_udp_payload_size(ctx->qconn);
+  for(;;) {
+    /* add the next packet to send, if any, to our buffer */
+    result = Curl_bufq_sipn(&ctx->q.sendbuf, 0,
+                            read_pkt_to_send, &readx, &nread);
+    if(result) {
+      if(result != CURLE_AGAIN)
+        return result;
+      /* Nothing more to add, flush and leave */
+      result = vquic_send(cf, data, &ctx->q, gsolen);
+      if(result) {
+        if(result == CURLE_AGAIN) {
+          Curl_expire(data, 1, EXPIRE_QUIC);
+          return CURLE_OK;
+        }
+        return result;
+      }
+      goto out;
+    }
+
+    ++pkt_count;
+    if(nread < gsolen || pkt_count >= MAX_PKT_BURST) {
+      result = vquic_send(cf, data, &ctx->q, gsolen);
+      if(result) {
+        if(result == CURLE_AGAIN) {
+          Curl_expire(data, 1, EXPIRE_QUIC);
+          return CURLE_OK;
+        }
+        goto out;
+      }
+      pkt_count = 0;
+    }
+  }
+
+out:
+  timeout_ns = quiche_conn_timeout_as_nanos(ctx->qconn);
+  if(timeout_ns % 1000000)
+    timeout_ns += 1000000;
+  /* expire resolution is milliseconds */
+  Curl_expire(data, (timeout_ns / 1000000), EXPIRE_QUIC);
+  return result;
+}
+
+static CURLcode recv_closed_stream(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data,
+                                   size_t *pnread)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+  CURLcode result = CURLE_OK;
+
+  DEBUGASSERT(stream);
+  *pnread = 0;
+  if(stream->reset) {
+    if(stream->error3 == CURL_H3_ERR_REQUEST_REJECTED) {
+      infof(data, "HTTP/3 stream %" PRIu64 " refused by server, try again "
+            "on a new connection", stream->id);
+      connclose(cf->conn, "REFUSED_STREAM"); /* do not use this anymore */
+      data->state.refused_stream = TRUE;
+      return CURLE_RECV_ERROR; /* trigger Curl_retry_request() later */
+    }
+    else if(stream->resp_hds_complete && data->req.no_body) {
+        CURL_TRC_CF(data, cf, "[%" PRIu64 "] error after response headers, "
+                    "but we did not want a body anyway, ignore error 0x%"
+                    PRIx64 " %s", stream->id, stream->error3,
+                    vquic_h3_err_str(stream->error3));
+        return CURLE_OK;
+    }
+    failf(data, "HTTP/3 stream %" PRIu64 " reset by server (error 0x%" PRIx64
+          " %s)", stream->id, stream->error3,
+          vquic_h3_err_str(stream->error3));
+    result = data->req.bytecount ? CURLE_PARTIAL_FILE : CURLE_HTTP3;
+    CURL_TRC_CF(data, cf, "[%" PRIu64 "] cf_recv, was reset -> %d",
+                stream->id, (int)result);
+  }
+  else if(!stream->resp_got_header) {
+    failf(data, "HTTP/3 stream %" PRIu64 " was closed cleanly, but before "
+          "getting all response header fields, treated as error",
+          stream->id);
+    result = CURLE_HTTP3;
+  }
+  return result;
+}
+
+static CURLcode cf_quiche_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
+                               char *buf, size_t blen, size_t *pnread)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+  CURLcode result = CURLE_OK;
+
+  *pnread = 0;
+  (void)buf;
+  (void)blen;
+  vquic_ctx_update_time(&ctx->q, Curl_pgrs_now(data));
+
+  if(!stream)
+    return CURLE_RECV_ERROR;
+
+  result = cf_process_ingress(cf, data);
+  if(result) {
+    CURL_TRC_CF(data, cf, "cf_recv, error on ingress");
+    goto out;
+  }
+
+  if(stream->xfer_result) {
+    cf_quiche_stream_close(cf, data, stream);
+    result = stream->xfer_result;
+    goto out;
+  }
+  else if(stream->closed)
+    result = recv_closed_stream(cf, data, pnread);
+  else if(quiche_conn_is_draining(ctx->qconn)) {
+    failf(data, "QUIC connection is draining");
+    result = CURLE_HTTP3;
+  }
+  else
+    result = CURLE_AGAIN;
+
+out:
+  result = Curl_1st_fatal(result, cf_flush_egress(cf, data));
+  if(*pnread > 0)
+    ctx->data_recvd += *pnread;
+  CURL_TRC_CF(data, cf, "[%" PRIu64 "] cf_recv(len=%zu) -> %d, %zu, total=%"
+              FMT_OFF_T, stream->id, blen, (int)result, *pnread,
+              ctx->data_recvd);
+  return result;
+}
+
+static CURLcode cf_quiche_send_body(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    struct h3_stream_ctx *stream,
+                                    const uint8_t *buf, size_t len, bool eos,
+                                    size_t *pnwritten)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  ssize_t rv;
+
+  *pnwritten = 0;
+  rv = quiche_h3_send_body(ctx->h3c, ctx->qconn, stream->id,
+                           (uint8_t *)CURL_UNCONST(buf), len, eos);
+  if(rv == QUICHE_H3_ERR_DONE || (rv == 0 && len > 0)) {
+    /* Blocked on flow control and should HOLD sending.
+       When do we open again? */
+    if(!quiche_conn_stream_writable(ctx->qconn, stream->id, len)) {
+      CURL_TRC_CF(data, cf, "[%" PRIu64 "] send_body(len=%zu) "
+                  "-> window exhausted", stream->id, len);
+      stream->quic_flow_blocked = TRUE;
+    }
+    return CURLE_AGAIN;
+  }
+  else if(rv == QUICHE_H3_TRANSPORT_ERR_INVALID_STREAM_STATE) {
+    CURL_TRC_CF(data, cf, "[%" PRIu64 "] send_body(len=%zu) "
+                "-> invalid stream state", stream->id, len);
+    return CURLE_HTTP3;
+  }
+  else if(rv == QUICHE_H3_TRANSPORT_ERR_FINAL_SIZE) {
+    CURL_TRC_CF(data, cf, "[%" PRIu64 "] send_body(len=%zu) -> exceeds size",
+                stream->id, len);
+    return CURLE_SEND_ERROR;
+  }
+  else if(!curlx_sztouz(rv, pnwritten)) {
+    CURL_TRC_CF(data, cf, "[%" PRIu64 "] send_body(len=%zu) -> quiche err %zd",
+                stream->id, len, rv);
+    return CURLE_SEND_ERROR;
+  }
+  else {
+    if(eos && (len == *pnwritten))
+      stream->send_closed = TRUE;
+    CURL_TRC_CF(data, cf, "[%" PRIu64 "] send body(len=%zu, eos=%d) -> %zu",
+                stream->id, len, stream->send_closed, *pnwritten);
+    return CURLE_OK;
+  }
+}
+
+static CURLcode h3_open_stream(struct Curl_cfilter *cf,
+                               struct Curl_easy *data,
+                               const uint8_t *buf, size_t blen, bool eos,
+                               size_t *pnwritten)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+  size_t nheader, i;
+  int64_t rv;
+  struct dynhds h2_headers;
+  quiche_h3_header *nva = NULL;
+  CURLcode result = CURLE_OK;
+
+  *pnwritten = 0;
+  if(!stream) {
+    result = h3_data_setup(cf, data);
+    if(result)
+      return result;
+    stream = H3_STREAM_CTX(ctx, data);
+    DEBUGASSERT(stream);
+  }
+
+  Curl_dynhds_init(&h2_headers, 0, DYN_HTTP_REQUEST);
+
+  DEBUGASSERT(stream);
+
+  result = Curl_h1_req_parse_read(&stream->h1, buf, blen, NULL,
+                                  !data->state.http_ignorecustom ?
+                                  data->set.str[STRING_CUSTOMREQUEST] : NULL,
+                                  0, pnwritten);
+  if(result)
+    goto out;
+  if(!stream->h1.done) {
+    /* need more data */
+    goto out;
+  }
+  DEBUGASSERT(stream->h1.req);
+
+  result = Curl_http_req_to_h2(&h2_headers, stream->h1.req, data);
+  if(result)
+    goto out;
+
+  /* no longer needed */
+  Curl_h1_req_parse_free(&stream->h1);
+
+  nheader = Curl_dynhds_count(&h2_headers);
+  nva = curlx_malloc(sizeof(quiche_h3_header) * nheader);
+  if(!nva) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  for(i = 0; i < nheader; ++i) {
+    struct dynhds_entry *e = Curl_dynhds_getn(&h2_headers, i);
+    nva[i].name = (unsigned char *)e->name;
+    nva[i].name_len = e->namelen;
+    nva[i].value = (unsigned char *)e->value;
+    nva[i].value_len = e->valuelen;
+  }
+
+  buf += *pnwritten;
+  blen -= *pnwritten;
+
+  if(eos && !blen)
+    stream->send_closed = TRUE;
+
+  rv = quiche_h3_send_request(ctx->h3c, ctx->qconn, nva, nheader,
+                              stream->send_closed);
+  CURL_TRC_CF(data, cf, "quiche_send_request() -> %" PRId64, rv);
+  if(rv < 0) {
+    if(QUICHE_H3_ERR_STREAM_BLOCKED == rv) {
+      /* quiche seems to report this error if the connection window is
+       * exhausted. Which happens frequently and intermittent. */
+      CURL_TRC_CF(data, cf, "[%" PRIu64 "] blocked", stream->id);
+      stream->quic_flow_blocked = TRUE;
+      result = CURLE_AGAIN;
+      goto out;
+    }
+    else {
+      CURL_TRC_CF(data, cf, "send_request(%s) -> %" PRId64,
+                  Curl_bufref_ptr(&data->state.url), rv);
+    }
+    result = CURLE_SEND_ERROR;
+    goto out;
+  }
+
+  DEBUGASSERT(!stream->opened);
+  stream->id = (uint64_t)rv;
+  stream->opened = TRUE;
+  stream->closed = FALSE;
+  stream->reset = FALSE;
+
+  if(Curl_trc_is_verbose(data)) {
+    infof(data, "[HTTP/3] [%" PRIu64 "] OPENED stream for %s",
+          stream->id, Curl_bufref_ptr(&data->state.url));
+    for(i = 0; i < nheader; ++i) {
+      infof(data, "[HTTP/3] [%" PRIu64 "] [%.*s: %.*s]", stream->id,
+            (int)nva[i].name_len, nva[i].name,
+            (int)nva[i].value_len, nva[i].value);
+    }
+  }
+
+  if(blen) {  /* after the headers, there was request BODY data */
+    size_t nwritten;
+    CURLcode r2 = CURLE_OK;
+
+    r2 = cf_quiche_send_body(cf, data, stream, buf, blen, eos, &nwritten);
+    if(r2 && (r2 != CURLE_AGAIN)) {  /* real error, fail */
+      result = r2;
+    }
+    else if(nwritten > 0) {
+      *pnwritten += nwritten;
+    }
+  }
+
+out:
+  curlx_free(nva);
+  Curl_dynhds_free(&h2_headers);
+  return result;
+}
+
+static CURLcode cf_quiche_send(struct Curl_cfilter *cf, struct Curl_easy *data,
+                               const uint8_t *buf, size_t len, bool eos,
+                               size_t *pnwritten)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+  CURLcode result;
+
+  *pnwritten = 0;
+  vquic_ctx_update_time(&ctx->q, Curl_pgrs_now(data));
+
+  result = cf_process_ingress(cf, data);
+  if(result)
+    goto out;
+
+  if(!stream || !stream->opened) {
+    result = h3_open_stream(cf, data, buf, len, eos, pnwritten);
+    if(result)
+      goto out;
+    stream = H3_STREAM_CTX(ctx, data);
+  }
+  else if(stream->xfer_result) {
+    cf_quiche_stream_close(cf, data, stream);
+    result = stream->xfer_result;
+  }
+  else if(stream->closed) {
+    if(stream->resp_hds_complete) {
+      /* sending request body on a stream that has been closed by the
+       * server. If the server has send us a final response, we should
+       * silently discard the send data.
+       * This happens for example on redirects where the server, instead
+       * of reading the full request body closed the stream after
+       * sending the 30x response.
+       * This is sort of a race: had the transfer loop called recv first,
+       * it would see the response and stop/discard sending on its own- */
+      CURL_TRC_CF(data, cf, "[%" PRIu64 "] discarding data"
+                  "on closed stream with response", stream->id);
+      result = CURLE_OK;
+      *pnwritten = len;
+      goto out;
+    }
+    CURL_TRC_CF(data, cf, "[%" PRIu64 "] send_body(len=%zu) "
+                "-> stream closed", stream->id, len);
+    result = CURLE_HTTP3;
+    goto out;
+  }
+  else {
+    result = cf_quiche_send_body(cf, data, stream, buf, len, eos, pnwritten);
+  }
+
+out:
+  result = Curl_1st_fatal(result, cf_flush_egress(cf, data));
+
+  CURL_TRC_CF(data, cf, "[%" PRIu64 "] cf_send(len=%zu) -> %d, %zu",
+              stream ? stream->id : (uint64_t)~0, len,
+              (int)result, *pnwritten);
+  return result;
+}
+
+static bool stream_is_writable(struct Curl_cfilter *cf,
+                               struct Curl_easy *data)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+
+  return stream && (quiche_conn_stream_writable(
+    ctx->qconn, stream->id, 1) > 0);
+}
+
+static CURLcode cf_quiche_adjust_pollset(struct Curl_cfilter *cf,
+                                         struct Curl_easy *data,
+                                         struct easy_pollset *ps)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  bool want_recv, want_send;
+  CURLcode result = CURLE_OK;
+
+  if(!ctx->qconn)
+    return CURLE_OK;
+
+  Curl_pollset_check(data, ps, ctx->q.sockfd, &want_recv, &want_send);
+  if(want_recv || want_send) {
+    struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+    bool c_exhaust, s_exhaust;
+
+    c_exhaust = FALSE; /* Have not found any call in quiche that tells
+                          us if the connection itself is blocked */
+    s_exhaust = want_send && stream && stream->opened &&
+                (stream->quic_flow_blocked || !stream_is_writable(cf, data));
+    want_recv = (want_recv || c_exhaust || s_exhaust);
+    want_send = (!s_exhaust && want_send) ||
+                 !Curl_bufq_is_empty(&ctx->q.sendbuf);
+
+    result = Curl_pollset_set(data, ps, ctx->q.sockfd, want_recv, want_send);
+  }
+  return result;
+}
+
+static CURLcode h3_data_pause(struct Curl_cfilter *cf,
+                              struct Curl_easy *data,
+                              bool pause)
+{
+  /* There seems to exist no API in quiche to shrink/enlarge the streams
+   * windows. As we do in HTTP/2. */
+  (void)cf;
+  if(!pause) {
+    Curl_multi_mark_dirty(data);
+  }
+  return CURLE_OK;
+}
+
+static CURLcode cf_quiche_cntrl(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                int event, int arg1, void *arg2)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  (void)arg1;
+  (void)arg2;
+  switch(event) {
+  case CF_CTRL_DATA_SETUP:
+    break;
+  case CF_CTRL_DATA_PAUSE:
+    result = h3_data_pause(cf, data, (arg1 != 0));
+    break;
+  case CF_CTRL_DATA_DONE:
+    h3_data_done(cf, data);
+    break;
+  case CF_CTRL_DATA_DONE_SEND: {
+    struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
+    if(stream && !stream->send_closed) {
+      unsigned char body[1];
+      size_t sent;
+
+      stream->send_closed = TRUE;
+      body[0] = 'X';
+      result = cf_quiche_send(cf, data, body, 0, TRUE, &sent);
+      CURL_TRC_CF(data, cf, "[%" PRIu64 "] DONE_SEND -> %d, %zu",
+                  stream->id, (int)result, sent);
+    }
+    break;
+  }
+  case CF_CTRL_CONN_INFO_UPDATE:
+    if(!cf->sockindex && cf->connected) {
+      cf->conn->httpversion_seen = 30;
+      Curl_conn_set_multiplex(cf->conn);
+    }
+    break;
+  default:
+    break;
+  }
+  return result;
+}
+
+static CURLcode cf_quiche_ctx_open(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  int rv;
+  CURLcode result;
+  const struct Curl_sockaddr_ex *sockaddr;
+  static const struct alpn_spec ALPN_SPEC_H3 = { { "h3" }, 1 };
+
+  DEBUGASSERT(ctx->q.sockfd != CURL_SOCKET_BAD);
+  DEBUGASSERT(ctx->initialized);
+
+  result = vquic_ctx_init(data, &ctx->q);
+  if(result)
+    return result;
+
+  ctx->cfg = quiche_config_new(QUICHE_PROTOCOL_VERSION);
+  if(!ctx->cfg) {
+    failf(data, "cannot create quiche config");
+    return CURLE_FAILED_INIT;
+  }
+  quiche_config_enable_pacing(ctx->cfg, FALSE);
+  quiche_config_set_initial_max_data(ctx->cfg, (1 * 1024 * 1024)
+    /* (QUIC_MAX_STREAMS/2) * H3_STREAM_WINDOW_SIZE */);
+  quiche_config_set_initial_max_streams_bidi(ctx->cfg, QUIC_MAX_STREAMS);
+  quiche_config_set_initial_max_streams_uni(ctx->cfg, QUIC_MAX_STREAMS);
+  quiche_config_set_initial_max_stream_data_bidi_local(ctx->cfg,
+    H3_STREAM_WINDOW_SIZE);
+  quiche_config_set_initial_max_stream_data_bidi_remote(ctx->cfg,
+    H3_STREAM_WINDOW_SIZE);
+  quiche_config_set_initial_max_stream_data_uni(ctx->cfg,
+    H3_STREAM_WINDOW_SIZE);
+  quiche_config_set_disable_active_migration(ctx->cfg, TRUE);
+
+  quiche_config_set_max_connection_window(ctx->cfg,
+    10 * QUIC_MAX_STREAMS * H3_STREAM_WINDOW_SIZE);
+  quiche_config_set_max_stream_window(ctx->cfg, 10 * H3_STREAM_WINDOW_SIZE);
+  quiche_config_set_application_protos(ctx->cfg,
+                       (uint8_t *)CURL_UNCONST(QUICHE_H3_APPLICATION_PROTOCOL),
+                                       sizeof(QUICHE_H3_APPLICATION_PROTOCOL)
+                                       - 1);
+
+  result = Curl_vquic_tls_init(&ctx->tls, cf, data, &ctx->ssl_peer,
+                               &ALPN_SPEC_H3, NULL, NULL, cf, NULL);
+  if(result)
+    return result;
+
+  result = Curl_rand(data, ctx->scid, sizeof(ctx->scid));
+  if(result)
+    return result;
+
+  if(Curl_cf_socket_peek(cf->next, data, &ctx->q.sockfd, &sockaddr, NULL))
+    return CURLE_QUIC_CONNECT_ERROR;
+
+  ctx->q.local_addrlen = sizeof(ctx->q.local_addr);
+  rv = getsockname(ctx->q.sockfd, (struct sockaddr *)&ctx->q.local_addr,
+                   &ctx->q.local_addrlen);
+  if(rv == -1)
+    return CURLE_QUIC_CONNECT_ERROR;
+
+  ctx->qconn = quiche_conn_new_with_tls((const uint8_t *)ctx->scid,
+                                        sizeof(ctx->scid), NULL, 0,
+                                        (struct sockaddr *)&ctx->q.local_addr,
+                                        ctx->q.local_addrlen,
+                                        &sockaddr->curl_sa_addr,
+                                        sockaddr->addrlen,
+                                        ctx->cfg, ctx->tls.ossl.ssl, FALSE);
+  if(!ctx->qconn) {
+    failf(data, "cannot create quiche connection");
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  /* Known to not work on Windows */
+#if !defined(_WIN32) && defined(HAVE_QUICHE_CONN_SET_QLOG_FD)
+  {
+    int qfd;
+    (void)Curl_qlogdir(data, ctx->scid, sizeof(ctx->scid), &qfd);
+    if(qfd != -1)
+      quiche_conn_set_qlog_fd(ctx->qconn, qfd, "qlog title", "curl qlog");
+  }
+#endif
+
+  result = cf_flush_egress(cf, data);
+  if(result)
+    return result;
+
+  {
+    unsigned char alpn_protocols[] = QUICHE_H3_APPLICATION_PROTOCOL;
+    unsigned alpn_len, offset = 0;
+
+    /* Replace each ALPN length prefix by a comma. */
+    while(offset < sizeof(alpn_protocols) - 1) {
+      alpn_len = alpn_protocols[offset];
+      alpn_protocols[offset] = ',';
+      offset += 1 + alpn_len;
+    }
+
+    CURL_TRC_CF(data, cf, "Sent QUIC client Initial, ALPN: %s",
+                alpn_protocols + 1);
+  }
+
+  return CURLE_OK;
+}
+
+static CURLcode cf_quiche_verify_peer(struct Curl_cfilter *cf,
+                                      struct Curl_easy *data)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  return Curl_vquic_tls_verify_peer(&ctx->tls, cf, data, &ctx->ssl_peer);
+}
+
+static CURLcode cf_quiche_connect(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  bool *done)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  if(cf->connected) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  /* Connect the UDP filter first */
+  if(!cf->next->connected) {
+    result = Curl_conn_cf_connect(cf->next, data, done);
+    if(result || !*done)
+      return result;
+  }
+
+  *done = FALSE;
+  if(Curl_ossl_need_httpsrr(data) &&
+     !Curl_conn_dns_resolved_https(data, cf->sockindex, ctx->ssl_peer.peer)) {
+    CURL_TRC_CF(data, cf, "need HTTPS-RR, delaying connect");
+    return CURLE_OK;
+  }
+
+  vquic_ctx_update_time(&ctx->q, Curl_pgrs_now(data));
+
+  if(!ctx->qconn) {
+    result = cf_quiche_ctx_open(cf, data);
+    if(result)
+      goto out;
+    ctx->started_at = ctx->q.last_op;
+    result = cf_flush_egress(cf, data);
+    /* we do not expect to be able to recv anything yet */
+    goto out;
+  }
+
+  result = cf_process_ingress(cf, data);
+  if(result)
+    goto out;
+
+  result = cf_flush_egress(cf, data);
+  if(result)
+    goto out;
+
+  if(quiche_conn_is_established(ctx->qconn)) {
+    ctx->handshake_at = ctx->q.last_op;
+    CURL_TRC_CF(data, cf, "handshake complete after %" FMT_TIMEDIFF_T "ms",
+                curlx_ptimediff_ms(&ctx->handshake_at, &ctx->started_at));
+    result = cf_quiche_verify_peer(cf, data);
+    if(!result) {
+      CURL_TRC_CF(data, cf, "peer verified");
+      ctx->h3config = quiche_h3_config_new();
+      if(!ctx->h3config) {
+        result = CURLE_OUT_OF_MEMORY;
+        goto out;
+      }
+
+      /* Create a new HTTP/3 connection on the QUIC connection. */
+      ctx->h3c = quiche_h3_conn_new_with_transport(ctx->qconn, ctx->h3config);
+      if(!ctx->h3c) {
+        result = CURLE_OUT_OF_MEMORY;
+        goto out;
+      }
+      cf->connected = TRUE;
+      *done = TRUE;
+    }
+  }
+  else if(quiche_conn_is_draining(ctx->qconn)) {
+    /* When a QUIC server instance is shutting down, it may send us a
+     * CONNECTION_CLOSE right away. Our connection then enters the DRAINING
+     * state. The CONNECT may work in the near future again. Indicate
+     * that as a "weird" reply. */
+    result = CURLE_WEIRD_SERVER_REPLY;
+  }
+
+out:
+#ifdef CURLVERBOSE
+  if(result && result != CURLE_AGAIN) {
+    struct ip_quadruple ip;
+
+    if(!Curl_cf_socket_peek(cf->next, data, NULL, NULL, &ip))
+      infof(data, "connect to %s port %u failed: %s",
+            ip.remote_ip, ip.remote_port, curl_easy_strerror(result));
+    else
+      infof(data, "connect failed: %s", curl_easy_strerror(result));
+  }
+#endif
+  return result;
+}
+
+static CURLcode cf_quiche_shutdown(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data, bool *done)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  if(cf->shutdown || !ctx || !ctx->qconn) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  *done = FALSE;
+  if(!ctx->shutdown_started) {
+    int err;
+
+    ctx->shutdown_started = TRUE;
+    vquic_ctx_update_time(&ctx->q, Curl_pgrs_now(data));
+    err = quiche_conn_close(ctx->qconn, TRUE, 0, NULL, 0);
+    if(err) {
+      CURL_TRC_CF(data, cf, "error %d adding shutdown packet, "
+                  "aborting shutdown", err);
+      result = CURLE_SEND_ERROR;
+      goto out;
+    }
+  }
+
+  if(!Curl_bufq_is_empty(&ctx->q.sendbuf)) {
+    CURL_TRC_CF(data, cf, "shutdown, flushing sendbuf");
+    result = cf_flush_egress(cf, data);
+    if(result)
+      goto out;
+  }
+
+  if(Curl_bufq_is_empty(&ctx->q.sendbuf)) {
+    /* sent everything, quiche does not seem to support a graceful
+     * shutdown waiting for a reply, so ware done. */
+    CURL_TRC_CF(data, cf, "shutdown completely sent off, done");
+    *done = TRUE;
+  }
+  else {
+    CURL_TRC_CF(data, cf, "shutdown sending blocked");
+  }
+
+out:
+  return result;
+}
+
+static void cf_quiche_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
+{
+  (void)data;
+  if(cf->ctx) {
+    cf_quiche_ctx_close(cf->ctx);
+    cf_quiche_ctx_free(cf->ctx);
+    cf->ctx = NULL;
+  }
+}
+
+static CURLcode cf_quiche_query(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                int query, int *pres1, void *pres2)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+
+  switch(query) {
+  case CF_QUERY_MAX_CONCURRENT: {
+    uint64_t max_streams = cf->conn->attached_xfers;
+    if(!ctx->goaway && ctx->qconn) {
+      max_streams += quiche_conn_peer_streams_left_bidi(ctx->qconn);
+    }
+    *pres1 = (max_streams > INT_MAX) ? INT_MAX : (int)max_streams;
+    CURL_TRC_CF(data, cf, "query conn[%" FMT_OFF_T "]: "
+                "MAX_CONCURRENT -> %d (%u in use)",
+                cf->conn->connection_id, *pres1, cf->conn->attached_xfers);
+    return CURLE_OK;
+  }
+  case CF_QUERY_CONNECT_REPLY_MS:
+    if(ctx->q.got_first_byte) {
+      timediff_t ms = curlx_ptimediff_ms(&ctx->q.first_byte_at,
+                                         &ctx->started_at);
+      *pres1 = (ms < INT_MAX) ? (int)ms : INT_MAX;
+    }
+    else
+      *pres1 = -1;
+    return CURLE_OK;
+  case CF_QUERY_TIMER_CONNECT: {
+    struct curltime *when = pres2;
+    if(ctx->q.got_first_byte)
+      *when = ctx->q.first_byte_at;
+    return CURLE_OK;
+  }
+  case CF_QUERY_TIMER_APPCONNECT: {
+    struct curltime *when = pres2;
+    if(cf->connected)
+      *when = ctx->handshake_at;
+    return CURLE_OK;
+  }
+  case CF_QUERY_HTTP_VERSION:
+    *pres1 = 30;
+    return CURLE_OK;
+  case CF_QUERY_SSL_INFO:
+  case CF_QUERY_SSL_CTX_INFO: {
+    struct curl_tlssessioninfo *info = pres2;
+    if(Curl_vquic_tls_get_ssl_info(&ctx->tls,
+                                   (query == CF_QUERY_SSL_CTX_INFO), info))
+      return CURLE_OK;
+    break;
+  }
+  case CF_QUERY_ALPN_NEGOTIATED: {
+    const char **palpn = pres2;
+    DEBUGASSERT(palpn);
+    *palpn = cf->connected ? "h3" : NULL;
+    return CURLE_OK;
+  }
+  default:
+    break;
+  }
+  return cf->next ?
+    cf->next->cft->query(cf->next, data, query, pres1, pres2) :
+    CURLE_UNKNOWN_OPTION;
+}
+
+static bool cf_quiche_conn_is_alive(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    bool *input_pending)
+{
+  struct cf_quiche_ctx *ctx = cf->ctx;
+  bool alive = TRUE;
+
+  *input_pending = FALSE;
+  if(!ctx->qconn)
+    return FALSE;
+
+  if(quiche_conn_is_closed(ctx->qconn)) {
+    if(quiche_conn_is_timed_out(ctx->qconn))
+      CURL_TRC_CF(data, cf, "connection was closed due to idle timeout");
+    else
+      CURL_TRC_CF(data, cf, "connection is closed");
+    return FALSE;
+  }
+
+  if(!cf->next || !cf->next->cft->is_alive(cf->next, data, input_pending))
+    return FALSE;
+
+  if(*input_pending) {
+    /* This happens before we have sent off a request and the connection is
+       not in use by any other transfer, there should not be any data here,
+       only "protocol frames" */
+    *input_pending = FALSE;
+    if(cf_process_ingress(cf, data))
+      alive = FALSE;
+    else {
+      alive = TRUE;
+    }
+  }
+
+  return alive;
+}
+
+struct Curl_cftype Curl_cft_http3 = {
+  "HTTP/3",
+  CF_TYPE_IP_CONNECT | CF_TYPE_SSL | CF_TYPE_MULTIPLEX | CF_TYPE_HTTP,
+  0,
+  cf_quiche_destroy,
+  cf_quiche_connect,
+  cf_quiche_shutdown,
+  cf_quiche_adjust_pollset,
+  Curl_cf_def_data_pending,
+  cf_quiche_send,
+  cf_quiche_recv,
+  cf_quiche_cntrl,
+  cf_quiche_conn_is_alive,
+  Curl_cf_def_conn_keep_alive,
+  cf_quiche_query,
+};
+
+CURLcode Curl_cf_quiche_create(struct Curl_cfilter **pcf,
+                               struct Curl_easy *data,
+                               struct Curl_peer *origin,
+                               struct Curl_peer *peer,
+                               struct connectdata *conn,
+                               struct Curl_sockaddr_ex *addr)
+{
+  struct cf_quiche_ctx *ctx = NULL;
+  struct Curl_cfilter *cf = NULL;
+  CURLcode result;
+
+  ctx = curlx_calloc(1, sizeof(*ctx));
+  if(!ctx) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+  result = cf_quiche_ctx_init(ctx, origin, peer, &conn->ssl_config);
+  if(!result)
+    result = Curl_cf_create(&cf, &Curl_cft_http3, ctx);
+  if(result)
+    goto out;
+  cf->conn = conn;
+
+  result = Curl_cf_udp_create(&cf->next, data, origin, peer, TRNSPRT_QUIC,
+                              conn, addr, NULL, TRNSPRT_QUIC);
+  if(result)
+    goto out;
+  cf->next->conn = cf->conn;
+  cf->next->sockindex = cf->sockindex;
+
+out:
+  *pcf = (!result) ? cf : NULL;
+  if(result) {
+    if(cf)
+      Curl_conn_cf_discard_chain(&cf, data);
+    else if(ctx)
+      cf_quiche_ctx_free(ctx);
+  }
+
+  return result;
+}
+
+CURLcode Curl_cf_quiche_insert_after(struct Curl_cfilter *cf_at,
+                                     struct Curl_peer *origin,
+                                     struct Curl_peer *peer)
+{
+  struct cf_quiche_ctx *ctx = NULL;
+  struct Curl_cfilter *cf = NULL;
+  CURLcode result;
+
+  ctx = curlx_calloc(1, sizeof(*ctx));
+  if(!ctx) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+  result = cf_quiche_ctx_init(ctx, origin, peer, &cf_at->conn->ssl_config);
+  if(!result)
+    result = Curl_cf_create(&cf, &Curl_cft_http3, ctx);
+  if(result)
+    goto out;
+  Curl_conn_cf_insert_after(cf_at, cf);
+
+out:
+  if(result) {
+    curlx_safefree(cf);
+    if(ctx)
+      cf_quiche_ctx_free(ctx);
+  }
+
+  return result;
+}
+
+#endif
diff --git a/third-party/curl/lib/vquic/cf-quiche.h b/third-party/curl/lib/vquic/cf-quiche.h
new file mode 100644
index 0000000000..88d9161dd7
--- /dev/null
+++ b/third-party/curl/lib/vquic/cf-quiche.h
@@ -0,0 +1,50 @@
+#ifndef HEADER_CURL_VQUIC_CF_QUICHE_H
+#define HEADER_CURL_VQUIC_CF_QUICHE_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_QUICHE)
+
+#include <quiche.h>
+#include <openssl/ssl.h>
+
+struct Curl_cfilter;
+struct Curl_easy;
+
+void Curl_quiche_ver(char *p, size_t len);
+
+CURLcode Curl_cf_quiche_create(struct Curl_cfilter **pcf,
+                               struct Curl_easy *data,
+                               struct Curl_peer *origin,
+                               struct Curl_peer *peer,
+                               struct connectdata *conn,
+                               struct Curl_sockaddr_ex *addr);
+CURLcode Curl_cf_quiche_insert_after(struct Curl_cfilter *cf_at,
+                                     struct Curl_peer *origin,
+                                     struct Curl_peer *peer);
+
+#endif
+
+#endif /* HEADER_CURL_VQUIC_CF_QUICHE_H */
diff --git a/third-party/curl/lib/vquic/curl_msh3.c b/third-party/curl/lib/vquic/curl_msh3.c
deleted file mode 100644
index 6bd0d23316..0000000000
--- a/third-party/curl/lib/vquic/curl_msh3.c
+++ /dev/null
@@ -1,1087 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#ifdef USE_MSH3
-
-#include "urldata.h"
-#include "timeval.h"
-#include "multiif.h"
-#include "sendf.h"
-#include "curl_trc.h"
-#include "cfilters.h"
-#include "cf-socket.h"
-#include "connect.h"
-#include "progress.h"
-#include "http1.h"
-#include "curl_msh3.h"
-#include "socketpair.h"
-#include "vquic/vquic.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-#define H3_STREAM_WINDOW_SIZE (128 * 1024)
-#define H3_STREAM_CHUNK_SIZE   (16 * 1024)
-#define H3_STREAM_RECV_CHUNKS \
-          (H3_STREAM_WINDOW_SIZE / H3_STREAM_CHUNK_SIZE)
-
-#ifdef _WIN32
-#define msh3_lock CRITICAL_SECTION
-#define msh3_lock_initialize(lock) InitializeCriticalSection(lock)
-#define msh3_lock_uninitialize(lock) DeleteCriticalSection(lock)
-#define msh3_lock_acquire(lock) EnterCriticalSection(lock)
-#define msh3_lock_release(lock) LeaveCriticalSection(lock)
-#else /* !_WIN32 */
-#include <pthread.h>
-#define msh3_lock pthread_mutex_t
-#define msh3_lock_initialize(lock) do { \
-  pthread_mutexattr_t attr; \
-  pthread_mutexattr_init(&attr); \
-  pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_RECURSIVE); \
-  pthread_mutex_init(lock, &attr); \
-  pthread_mutexattr_destroy(&attr); \
-}while(0)
-#define msh3_lock_uninitialize(lock) pthread_mutex_destroy(lock)
-#define msh3_lock_acquire(lock) pthread_mutex_lock(lock)
-#define msh3_lock_release(lock) pthread_mutex_unlock(lock)
-#endif /* _WIN32 */
-
-
-static void MSH3_CALL msh3_conn_connected(MSH3_CONNECTION *Connection,
-                                          void *IfContext);
-static void MSH3_CALL msh3_conn_shutdown_complete(MSH3_CONNECTION *Connection,
-                                          void *IfContext);
-static void MSH3_CALL msh3_conn_new_request(MSH3_CONNECTION *Connection,
-                                          void *IfContext,
-                                          MSH3_REQUEST *Request);
-static void MSH3_CALL msh3_header_received(MSH3_REQUEST *Request,
-                                           void *IfContext,
-                                           const MSH3_HEADER *Header);
-static bool MSH3_CALL msh3_data_received(MSH3_REQUEST *Request,
-                                        void *IfContext, uint32_t *Length,
-                                        const uint8_t *Data);
-static void MSH3_CALL msh3_complete(MSH3_REQUEST *Request, void *IfContext,
-                                    bool Aborted, uint64_t AbortError);
-static void MSH3_CALL msh3_shutdown_complete(MSH3_REQUEST *Request,
-                                             void *IfContext);
-static void MSH3_CALL msh3_data_sent(MSH3_REQUEST *Request,
-                                     void *IfContext, void *SendContext);
-
-
-void Curl_msh3_ver(char *p, size_t len)
-{
-  uint32_t v[4];
-  MsH3Version(v);
-  (void)msnprintf(p, len, "msh3/%d.%d.%d.%d", v[0], v[1], v[2], v[3]);
-}
-
-#define SP_LOCAL   0
-#define SP_REMOTE  1
-
-struct cf_msh3_ctx {
-  MSH3_API *api;
-  MSH3_CONNECTION *qconn;
-  struct Curl_sockaddr_ex addr;
-  curl_socket_t sock[2]; /* fake socket pair until we get support in msh3 */
-  char l_ip[MAX_IPADR_LEN];          /* local IP as string */
-  int l_port;                        /* local port number */
-  struct cf_call_data call_data;
-  struct curltime connect_started;   /* time the current attempt started */
-  struct curltime handshake_at;      /* time connect handshake finished */
-  /* Flags written by msh3/msquic thread */
-  bool handshake_complete;
-  bool handshake_succeeded;
-  bool connected;
-  /* Flags written by curl thread */
-  BIT(verbose);
-  BIT(active);
-};
-
-/* How to access `call_data` from a cf_msh3 filter */
-#undef CF_CTX_CALL_DATA
-#define CF_CTX_CALL_DATA(cf)  \
-  ((struct cf_msh3_ctx *)(cf)->ctx)->call_data
-
-/**
- * All about the H3 internals of a stream
- */
-struct stream_ctx {
-  struct MSH3_REQUEST *req;
-  struct bufq recvbuf;   /* h3 response */
-#ifdef _WIN32
-  CRITICAL_SECTION recv_lock;
-#else /* !_WIN32 */
-  pthread_mutex_t recv_lock;
-#endif /* _WIN32 */
-  uint64_t error3; /* HTTP/3 stream error code */
-  int status_code; /* HTTP status code */
-  CURLcode recv_error;
-  bool closed;
-  bool reset;
-  bool upload_done;
-  bool firstheader;  /* FALSE until headers arrive */
-  bool recv_header_complete;
-};
-
-#define H3_STREAM_CTX(d)    ((struct stream_ctx *)(((d) && (d)->req.p.http)? \
-                             ((struct HTTP *)(d)->req.p.http)->h3_ctx \
-                               : NULL))
-#define H3_STREAM_LCTX(d)   ((struct HTTP *)(d)->req.p.http)->h3_ctx
-#define H3_STREAM_ID(d)     (H3_STREAM_CTX(d)? \
-                             H3_STREAM_CTX(d)->id : -2)
-
-
-static CURLcode h3_data_setup(struct Curl_cfilter *cf,
-                              struct Curl_easy *data)
-{
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-
-  if(stream)
-    return CURLE_OK;
-
-  stream = calloc(1, sizeof(*stream));
-  if(!stream)
-    return CURLE_OUT_OF_MEMORY;
-
-  H3_STREAM_LCTX(data) = stream;
-  stream->req = ZERO_NULL;
-  msh3_lock_initialize(&stream->recv_lock);
-  Curl_bufq_init2(&stream->recvbuf, H3_STREAM_CHUNK_SIZE,
-                  H3_STREAM_RECV_CHUNKS, BUFQ_OPT_SOFT_LIMIT);
-  CURL_TRC_CF(data, cf, "data setup");
-  return CURLE_OK;
-}
-
-static void h3_data_done(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-
-  (void)cf;
-  if(stream) {
-    CURL_TRC_CF(data, cf, "easy handle is done");
-    Curl_bufq_free(&stream->recvbuf);
-    free(stream);
-    H3_STREAM_LCTX(data) = NULL;
-  }
-}
-
-static void drain_stream_from_other_thread(struct Curl_easy *data,
-                                           struct stream_ctx *stream)
-{
-  unsigned char bits;
-
-  /* risky */
-  bits = CURL_CSELECT_IN;
-  if(stream && !stream->upload_done)
-    bits |= CURL_CSELECT_OUT;
-  if(data->state.dselect_bits != bits) {
-    data->state.dselect_bits = bits;
-    /* cannot expire from other thread */
-  }
-}
-
-static void drain_stream(struct Curl_cfilter *cf,
-                         struct Curl_easy *data)
-{
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  unsigned char bits;
-
-  (void)cf;
-  bits = CURL_CSELECT_IN;
-  if(stream && !stream->upload_done)
-    bits |= CURL_CSELECT_OUT;
-  if(data->state.dselect_bits != bits) {
-    data->state.dselect_bits = bits;
-    Curl_expire(data, 0, EXPIRE_RUN_NOW);
-  }
-}
-
-static const MSH3_CONNECTION_IF msh3_conn_if = {
-  msh3_conn_connected,
-  msh3_conn_shutdown_complete,
-  msh3_conn_new_request
-};
-
-static void MSH3_CALL msh3_conn_connected(MSH3_CONNECTION *Connection,
-                                          void *IfContext)
-{
-  struct Curl_cfilter *cf = IfContext;
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct Curl_easy *data = CF_DATA_CURRENT(cf);
-  (void)Connection;
-
-  CURL_TRC_CF(data, cf, "[MSH3] connected");
-  ctx->handshake_succeeded = true;
-  ctx->connected = true;
-  ctx->handshake_complete = true;
-}
-
-static void MSH3_CALL msh3_conn_shutdown_complete(MSH3_CONNECTION *Connection,
-                                          void *IfContext)
-{
-  struct Curl_cfilter *cf = IfContext;
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct Curl_easy *data = CF_DATA_CURRENT(cf);
-
-  (void)Connection;
-  CURL_TRC_CF(data, cf, "[MSH3] shutdown complete");
-  ctx->connected = false;
-  ctx->handshake_complete = true;
-}
-
-static void MSH3_CALL msh3_conn_new_request(MSH3_CONNECTION *Connection,
-                                          void *IfContext,
-                                          MSH3_REQUEST *Request)
-{
-  (void)Connection;
-  (void)IfContext;
-  (void)Request;
-}
-
-static const MSH3_REQUEST_IF msh3_request_if = {
-  msh3_header_received,
-  msh3_data_received,
-  msh3_complete,
-  msh3_shutdown_complete,
-  msh3_data_sent
-};
-
-/* Decode HTTP status code.  Returns -1 if no valid status code was
-   decoded. (duplicate from http2.c) */
-static int decode_status_code(const char *value, size_t len)
-{
-  int i;
-  int res;
-
-  if(len != 3) {
-    return -1;
-  }
-
-  res = 0;
-
-  for(i = 0; i < 3; ++i) {
-    char c = value[i];
-
-    if(c < '0' || c > '9') {
-      return -1;
-    }
-
-    res *= 10;
-    res += c - '0';
-  }
-
-  return res;
-}
-
-/*
- * write_resp_raw() copies response data in raw format to the `data`'s
-  * receive buffer. If not enough space is available, it appends to the
- * `data`'s overflow buffer.
- */
-static CURLcode write_resp_raw(struct Curl_easy *data,
-                               const void *mem, size_t memlen)
-{
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  CURLcode result = CURLE_OK;
-  ssize_t nwritten;
-
-  if(!stream)
-    return CURLE_RECV_ERROR;
-
-  nwritten = Curl_bufq_write(&stream->recvbuf, mem, memlen, &result);
-  if(nwritten < 0) {
-    return result;
-  }
-
-  if((size_t)nwritten < memlen) {
-    /* This MUST not happen. Our recbuf is dimensioned to hold the
-     * full max_stream_window and then some for this very reason. */
-    DEBUGASSERT(0);
-    return CURLE_RECV_ERROR;
-  }
-  return result;
-}
-
-static void MSH3_CALL msh3_header_received(MSH3_REQUEST *Request,
-                                           void *userp,
-                                           const MSH3_HEADER *hd)
-{
-  struct Curl_easy *data = userp;
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  CURLcode result;
-  (void)Request;
-
-  if(!stream || stream->recv_header_complete) {
-    return;
-  }
-
-  msh3_lock_acquire(&stream->recv_lock);
-
-  if((hd->NameLength == 7) &&
-     !strncmp(HTTP_PSEUDO_STATUS, (char *)hd->Name, 7)) {
-    char line[14]; /* status line is always 13 characters long */
-    size_t ncopy;
-
-    DEBUGASSERT(!stream->firstheader);
-    stream->status_code = decode_status_code(hd->Value, hd->ValueLength);
-    DEBUGASSERT(stream->status_code != -1);
-    ncopy = msnprintf(line, sizeof(line), "HTTP/3 %03d \r\n",
-                      stream->status_code);
-    result = write_resp_raw(data, line, ncopy);
-    if(result)
-      stream->recv_error = result;
-    stream->firstheader = TRUE;
-  }
-  else {
-    /* store as an HTTP1-style header */
-    DEBUGASSERT(stream->firstheader);
-    result = write_resp_raw(data, hd->Name, hd->NameLength);
-    if(!result)
-      result = write_resp_raw(data, ": ", 2);
-    if(!result)
-      result = write_resp_raw(data, hd->Value, hd->ValueLength);
-    if(!result)
-      result = write_resp_raw(data, "\r\n", 2);
-    if(result) {
-      stream->recv_error = result;
-    }
-  }
-
-  drain_stream_from_other_thread(data, stream);
-  msh3_lock_release(&stream->recv_lock);
-}
-
-static bool MSH3_CALL msh3_data_received(MSH3_REQUEST *Request,
-                                         void *IfContext, uint32_t *buflen,
-                                         const uint8_t *buf)
-{
-  struct Curl_easy *data = IfContext;
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  CURLcode result;
-  bool rv = FALSE;
-
-  /* TODO: we would like to limit the amount of data we are buffer here.
-   * There seems to be no mechanism in msh3 to adjust flow control and
-   * it is undocumented what happens if we return FALSE here or less
-   * length (buflen is an inout parameter).
-   */
-  (void)Request;
-  if(!stream)
-    return FALSE;
-
-  msh3_lock_acquire(&stream->recv_lock);
-
-  if(!stream->recv_header_complete) {
-    result = write_resp_raw(data, "\r\n", 2);
-    if(result) {
-      stream->recv_error = result;
-      goto out;
-    }
-    stream->recv_header_complete = true;
-  }
-
-  result = write_resp_raw(data, buf, *buflen);
-  if(result) {
-    stream->recv_error = result;
-  }
-  rv = TRUE;
-
-out:
-  msh3_lock_release(&stream->recv_lock);
-  return rv;
-}
-
-static void MSH3_CALL msh3_complete(MSH3_REQUEST *Request, void *IfContext,
-                                    bool aborted, uint64_t error)
-{
-  struct Curl_easy *data = IfContext;
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-
-  (void)Request;
-  if(!stream)
-    return;
-  msh3_lock_acquire(&stream->recv_lock);
-  stream->closed = TRUE;
-  stream->recv_header_complete = true;
-  if(error)
-    stream->error3 = error;
-  if(aborted)
-    stream->reset = TRUE;
-  msh3_lock_release(&stream->recv_lock);
-}
-
-static void MSH3_CALL msh3_shutdown_complete(MSH3_REQUEST *Request,
-                                             void *IfContext)
-{
-  struct Curl_easy *data = IfContext;
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-
-  if(!stream)
-    return;
-  (void)Request;
-  (void)stream;
-}
-
-static void MSH3_CALL msh3_data_sent(MSH3_REQUEST *Request,
-                                     void *IfContext, void *SendContext)
-{
-  struct Curl_easy *data = IfContext;
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  if(!stream)
-    return;
-  (void)Request;
-  (void)stream;
-  (void)SendContext;
-}
-
-static ssize_t recv_closed_stream(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  CURLcode *err)
-{
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  ssize_t nread = -1;
-
-  if(!stream) {
-    *err = CURLE_RECV_ERROR;
-    return -1;
-  }
-  (void)cf;
-  if(stream->reset) {
-    failf(data, "HTTP/3 stream reset by server");
-    *err = CURLE_PARTIAL_FILE;
-    CURL_TRC_CF(data, cf, "cf_recv, was reset -> %d", *err);
-    goto out;
-  }
-  else if(stream->error3) {
-    failf(data, "HTTP/3 stream was not closed cleanly: (error %zd)",
-          (ssize_t)stream->error3);
-    *err = CURLE_HTTP3;
-    CURL_TRC_CF(data, cf, "cf_recv, closed uncleanly -> %d", *err);
-    goto out;
-  }
-  else {
-    CURL_TRC_CF(data, cf, "cf_recv, closed ok -> %d", *err);
-  }
-  *err = CURLE_OK;
-  nread = 0;
-
-out:
-  return nread;
-}
-
-static void set_quic_expire(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-
-  /* we have no indication from msh3 when it would be a good time
-   * to juggle the connection again. So, we compromise by calling
-   * us again every some milliseconds. */
-  (void)cf;
-  if(stream && stream->req && !stream->closed) {
-    Curl_expire(data, 10, EXPIRE_QUIC);
-  }
-  else {
-    Curl_expire(data, 50, EXPIRE_QUIC);
-  }
-}
-
-static ssize_t cf_msh3_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
-                            char *buf, size_t len, CURLcode *err)
-{
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  ssize_t nread = -1;
-  struct cf_call_data save;
-
-  (void)cf;
-  if(!stream) {
-    *err = CURLE_RECV_ERROR;
-    return -1;
-  }
-  CF_DATA_SAVE(save, cf, data);
-  CURL_TRC_CF(data, cf, "req: recv with %zu byte buffer", len);
-
-  msh3_lock_acquire(&stream->recv_lock);
-
-  if(stream->recv_error) {
-    failf(data, "request aborted");
-    *err = stream->recv_error;
-    goto out;
-  }
-
-  *err = CURLE_OK;
-
-  if(!Curl_bufq_is_empty(&stream->recvbuf)) {
-    nread = Curl_bufq_read(&stream->recvbuf,
-                           (unsigned char *)buf, len, err);
-    CURL_TRC_CF(data, cf, "read recvbuf(len=%zu) -> %zd, %d",
-                len, nread, *err);
-    if(nread < 0)
-      goto out;
-    if(stream->closed)
-      drain_stream(cf, data);
-  }
-  else if(stream->closed) {
-    nread = recv_closed_stream(cf, data, err);
-    goto out;
-  }
-  else {
-    CURL_TRC_CF(data, cf, "req: nothing here, call again");
-    *err = CURLE_AGAIN;
-  }
-
-out:
-  msh3_lock_release(&stream->recv_lock);
-  set_quic_expire(cf, data);
-  CF_DATA_RESTORE(cf, save);
-  return nread;
-}
-
-static ssize_t cf_msh3_send(struct Curl_cfilter *cf, struct Curl_easy *data,
-                            const void *buf, size_t len, CURLcode *err)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  struct h1_req_parser h1;
-  struct dynhds h2_headers;
-  MSH3_HEADER *nva = NULL;
-  size_t nheader, i;
-  ssize_t nwritten = -1;
-  struct cf_call_data save;
-  bool eos;
-
-  CF_DATA_SAVE(save, cf, data);
-
-  Curl_h1_req_parse_init(&h1, H1_PARSE_DEFAULT_MAX_LINE_LEN);
-  Curl_dynhds_init(&h2_headers, 0, DYN_HTTP_REQUEST);
-
-  /* Sizes must match for cast below to work" */
-  DEBUGASSERT(stream);
-  CURL_TRC_CF(data, cf, "req: send %zu bytes", len);
-
-  if(!stream->req) {
-    /* The first send on the request contains the headers and possibly some
-       data. Parse out the headers and create the request, then if there is
-       any data left over go ahead and send it too. */
-    nwritten = Curl_h1_req_parse_read(&h1, buf, len, NULL, 0, err);
-    if(nwritten < 0)
-      goto out;
-    DEBUGASSERT(h1.done);
-    DEBUGASSERT(h1.req);
-
-    *err = Curl_http_req_to_h2(&h2_headers, h1.req, data);
-    if(*err) {
-      nwritten = -1;
-      goto out;
-    }
-
-    nheader = Curl_dynhds_count(&h2_headers);
-    nva = malloc(sizeof(MSH3_HEADER) * nheader);
-    if(!nva) {
-      *err = CURLE_OUT_OF_MEMORY;
-      nwritten = -1;
-      goto out;
-    }
-
-    for(i = 0; i < nheader; ++i) {
-      struct dynhds_entry *e = Curl_dynhds_getn(&h2_headers, i);
-      nva[i].Name = e->name;
-      nva[i].NameLength = e->namelen;
-      nva[i].Value = e->value;
-      nva[i].ValueLength = e->valuelen;
-    }
-
-    switch(data->state.httpreq) {
-    case HTTPREQ_POST:
-    case HTTPREQ_POST_FORM:
-    case HTTPREQ_POST_MIME:
-    case HTTPREQ_PUT:
-      /* known request body size or -1 */
-      eos = FALSE;
-      break;
-    default:
-      /* there is not request body */
-      eos = TRUE;
-      stream->upload_done = TRUE;
-      break;
-    }
-
-    CURL_TRC_CF(data, cf, "req: send %zu headers", nheader);
-    stream->req = MsH3RequestOpen(ctx->qconn, &msh3_request_if, data,
-                                  nva, nheader,
-                                  eos ? MSH3_REQUEST_FLAG_FIN :
-                                  MSH3_REQUEST_FLAG_NONE);
-    if(!stream->req) {
-      failf(data, "request open failed");
-      *err = CURLE_SEND_ERROR;
-      goto out;
-    }
-    *err = CURLE_OK;
-    nwritten = len;
-    goto out;
-  }
-  else {
-    /* request is open */
-    CURL_TRC_CF(data, cf, "req: send %zu body bytes", len);
-    if(len > 0xFFFFFFFF) {
-      len = 0xFFFFFFFF;
-    }
-
-    if(!MsH3RequestSend(stream->req, MSH3_REQUEST_FLAG_NONE, buf,
-                        (uint32_t)len, stream)) {
-      *err = CURLE_SEND_ERROR;
-      goto out;
-    }
-
-    /* TODO - msh3/msquic will hold onto this memory until the send complete
-       event. How do we make sure curl doesn't free it until then? */
-    *err = CURLE_OK;
-    nwritten = len;
-  }
-
-out:
-  set_quic_expire(cf, data);
-  free(nva);
-  Curl_h1_req_parse_free(&h1);
-  Curl_dynhds_free(&h2_headers);
-  CF_DATA_RESTORE(cf, save);
-  return nwritten;
-}
-
-static int cf_msh3_get_select_socks(struct Curl_cfilter *cf,
-                                    struct Curl_easy *data,
-                                    curl_socket_t *socks)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  int bitmap = GETSOCK_BLANK;
-  struct cf_call_data save;
-
-  CF_DATA_SAVE(save, cf, data);
-  if(stream && ctx->sock[SP_LOCAL] != CURL_SOCKET_BAD) {
-    socks[0] = ctx->sock[SP_LOCAL];
-
-    if(stream->recv_error) {
-      bitmap |= GETSOCK_READSOCK(0);
-      drain_stream(cf, data);
-    }
-    else if(stream->req) {
-      bitmap |= GETSOCK_READSOCK(0);
-      drain_stream(cf, data);
-    }
-  }
-  CURL_TRC_CF(data, cf, "select_sock -> %d", bitmap);
-  CF_DATA_RESTORE(cf, save);
-  return bitmap;
-}
-
-static bool cf_msh3_data_pending(struct Curl_cfilter *cf,
-                                 const struct Curl_easy *data)
-{
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  struct cf_call_data save;
-  bool pending = FALSE;
-
-  CF_DATA_SAVE(save, cf, data);
-
-  (void)cf;
-  if(stream && stream->req) {
-    msh3_lock_acquire(&stream->recv_lock);
-    CURL_TRC_CF((struct Curl_easy *)data, cf, "data pending = %zu",
-                Curl_bufq_len(&stream->recvbuf));
-    pending = !Curl_bufq_is_empty(&stream->recvbuf);
-    msh3_lock_release(&stream->recv_lock);
-    if(pending)
-      drain_stream(cf, (struct Curl_easy *)data);
-  }
-
-  CF_DATA_RESTORE(cf, save);
-  return pending;
-}
-
-static void cf_msh3_active(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-
-  /* use this socket from now on */
-  cf->conn->sock[cf->sockindex] = ctx->sock[SP_LOCAL];
-  /* the first socket info gets set at conn and data */
-  if(cf->sockindex == FIRSTSOCKET) {
-    cf->conn->remote_addr = &ctx->addr;
-  #ifdef ENABLE_IPV6
-    cf->conn->bits.ipv6 = (ctx->addr.family == AF_INET6)? TRUE : FALSE;
-  #endif
-    Curl_persistconninfo(data, cf->conn, ctx->l_ip, ctx->l_port);
-  }
-  ctx->active = TRUE;
-}
-
-static CURLcode h3_data_pause(struct Curl_cfilter *cf,
-                              struct Curl_easy *data,
-                              bool pause)
-{
-  if(!pause) {
-    drain_stream(cf, data);
-    Curl_expire(data, 0, EXPIRE_RUN_NOW);
-  }
-  return CURLE_OK;
-}
-
-static CURLcode cf_msh3_data_event(struct Curl_cfilter *cf,
-                                   struct Curl_easy *data,
-                                   int event, int arg1, void *arg2)
-{
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  struct cf_call_data save;
-  CURLcode result = CURLE_OK;
-
-  CF_DATA_SAVE(save, cf, data);
-
-  (void)arg1;
-  (void)arg2;
-  switch(event) {
-  case CF_CTRL_DATA_SETUP:
-    result = h3_data_setup(cf, data);
-    break;
-  case CF_CTRL_DATA_PAUSE:
-    result = h3_data_pause(cf, data, (arg1 != 0));
-    break;
-  case CF_CTRL_DATA_DONE:
-    h3_data_done(cf, data);
-    break;
-  case CF_CTRL_DATA_DONE_SEND:
-    CURL_TRC_CF(data, cf, "req: send done");
-    if(stream) {
-      stream->upload_done = TRUE;
-      if(stream->req) {
-        char buf[1];
-        if(!MsH3RequestSend(stream->req, MSH3_REQUEST_FLAG_FIN,
-                            buf, 0, data)) {
-          result = CURLE_SEND_ERROR;
-        }
-      }
-    }
-    break;
-  case CF_CTRL_CONN_INFO_UPDATE:
-    CURL_TRC_CF(data, cf, "req: update info");
-    cf_msh3_active(cf, data);
-    break;
-  default:
-    break;
-  }
-
-  CF_DATA_RESTORE(cf, save);
-  return result;
-}
-
-static CURLcode cf_connect_start(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  bool verify = !!cf->conn->ssl_config.verifypeer;
-  MSH3_ADDR addr = {0};
-  CURLcode result;
-
-  memcpy(&addr, &ctx->addr.sa_addr, ctx->addr.addrlen);
-  MSH3_SET_PORT(&addr, (uint16_t)cf->conn->remote_port);
-
-  if(verify && (cf->conn->ssl_config.CAfile || cf->conn->ssl_config.CApath)) {
-    /* TODO: need a way to provide trust anchors to MSH3 */
-#ifdef DEBUGBUILD
-    /* we need this for our test cases to run */
-    CURL_TRC_CF(data, cf, "non-standard CA not supported, "
-                "switching off verifypeer in DEBUG mode");
-    verify = 0;
-#else
-    CURL_TRC_CF(data, cf, "non-standard CA not supported, "
-                "attempting with built-in verification");
-#endif
-  }
-
-  CURL_TRC_CF(data, cf, "connecting to %s:%d (verify=%d)",
-              cf->conn->host.name, (int)cf->conn->remote_port, verify);
-
-  ctx->api = MsH3ApiOpen();
-  if(!ctx->api) {
-    failf(data, "can't create msh3 api");
-    return CURLE_FAILED_INIT;
-  }
-
-  ctx->qconn = MsH3ConnectionOpen(ctx->api,
-                                  &msh3_conn_if,
-                                  cf,
-                                  cf->conn->host.name,
-                                  &addr,
-                                  !verify);
-  if(!ctx->qconn) {
-    failf(data, "can't create msh3 connection");
-    if(ctx->api) {
-      MsH3ApiClose(ctx->api);
-      ctx->api = NULL;
-    }
-    return CURLE_FAILED_INIT;
-  }
-
-  result = h3_data_setup(cf, data);
-  if(result)
-    return result;
-
-  return CURLE_OK;
-}
-
-static CURLcode cf_msh3_connect(struct Curl_cfilter *cf,
-                                struct Curl_easy *data,
-                                bool blocking, bool *done)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct cf_call_data save;
-  CURLcode result = CURLE_OK;
-
-  (void)blocking;
-  if(cf->connected) {
-    *done = TRUE;
-    return CURLE_OK;
-  }
-
-  CF_DATA_SAVE(save, cf, data);
-
-  if(ctx->sock[SP_LOCAL] == CURL_SOCKET_BAD) {
-    if(Curl_socketpair(AF_UNIX, SOCK_STREAM, 0, &ctx->sock[0]) < 0) {
-      ctx->sock[SP_LOCAL] = CURL_SOCKET_BAD;
-      ctx->sock[SP_REMOTE] = CURL_SOCKET_BAD;
-      return CURLE_COULDNT_CONNECT;
-    }
-  }
-
-  *done = FALSE;
-  if(!ctx->qconn) {
-    ctx->connect_started = Curl_now();
-    result = cf_connect_start(cf, data);
-    if(result)
-      goto out;
-  }
-
-  if(ctx->handshake_complete) {
-    ctx->handshake_at = Curl_now();
-    if(ctx->handshake_succeeded) {
-      CURL_TRC_CF(data, cf, "handshake succeeded");
-      cf->conn->bits.multiplex = TRUE; /* at least potentially multiplexed */
-      cf->conn->httpversion = 30;
-      cf->conn->bundle->multiuse = BUNDLE_MULTIPLEX;
-      cf->connected = TRUE;
-      cf->conn->alpn = CURL_HTTP_VERSION_3;
-      *done = TRUE;
-      connkeep(cf->conn, "HTTP/3 default");
-      Curl_pgrsTime(data, TIMER_APPCONNECT);
-    }
-    else {
-      failf(data, "failed to connect, handshake failed");
-      result = CURLE_COULDNT_CONNECT;
-    }
-  }
-
-out:
-  CF_DATA_RESTORE(cf, save);
-  return result;
-}
-
-static void cf_msh3_close(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct cf_call_data save;
-
-  (void)data;
-  CF_DATA_SAVE(save, cf, data);
-
-  if(ctx) {
-    CURL_TRC_CF(data, cf, "destroying");
-    if(ctx->qconn) {
-      MsH3ConnectionClose(ctx->qconn);
-      ctx->qconn = NULL;
-    }
-    if(ctx->api) {
-      MsH3ApiClose(ctx->api);
-      ctx->api = NULL;
-    }
-
-    if(ctx->active) {
-      /* We share our socket at cf->conn->sock[cf->sockindex] when active.
-       * If it is no longer there, someone has stolen (and hopefully
-       * closed it) and we just forget about it.
-       */
-      ctx->active = FALSE;
-      if(ctx->sock[SP_LOCAL] == cf->conn->sock[cf->sockindex]) {
-        CURL_TRC_CF(data, cf, "cf_msh3_close(%d) active",
-                    (int)ctx->sock[SP_LOCAL]);
-        cf->conn->sock[cf->sockindex] = CURL_SOCKET_BAD;
-      }
-      else {
-        CURL_TRC_CF(data, cf, "cf_socket_close(%d) no longer at "
-                    "conn->sock[], discarding", (int)ctx->sock[SP_LOCAL]);
-        ctx->sock[SP_LOCAL] = CURL_SOCKET_BAD;
-      }
-      if(cf->sockindex == FIRSTSOCKET)
-        cf->conn->remote_addr = NULL;
-    }
-    if(ctx->sock[SP_LOCAL] != CURL_SOCKET_BAD) {
-      sclose(ctx->sock[SP_LOCAL]);
-    }
-    if(ctx->sock[SP_REMOTE] != CURL_SOCKET_BAD) {
-      sclose(ctx->sock[SP_REMOTE]);
-    }
-    ctx->sock[SP_LOCAL] = CURL_SOCKET_BAD;
-    ctx->sock[SP_REMOTE] = CURL_SOCKET_BAD;
-  }
-  CF_DATA_RESTORE(cf, save);
-}
-
-static void cf_msh3_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_call_data save;
-
-  CF_DATA_SAVE(save, cf, data);
-  cf_msh3_close(cf, data);
-  free(cf->ctx);
-  cf->ctx = NULL;
-  /* no CF_DATA_RESTORE(cf, save); its gone */
-
-}
-
-static CURLcode cf_msh3_query(struct Curl_cfilter *cf,
-                              struct Curl_easy *data,
-                              int query, int *pres1, void *pres2)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-
-  switch(query) {
-  case CF_QUERY_MAX_CONCURRENT: {
-    /* TODO: we do not have access to this so far, fake it */
-    (void)ctx;
-    *pres1 = 100;
-    return CURLE_OK;
-  }
-  case CF_QUERY_TIMER_CONNECT: {
-    struct curltime *when = pres2;
-    /* we do not know when the first byte arrived */
-    if(cf->connected)
-      *when = ctx->handshake_at;
-    return CURLE_OK;
-  }
-  case CF_QUERY_TIMER_APPCONNECT: {
-    struct curltime *when = pres2;
-    if(cf->connected)
-      *when = ctx->handshake_at;
-    return CURLE_OK;
-  }
-  default:
-    break;
-  }
-  return cf->next?
-    cf->next->cft->query(cf->next, data, query, pres1, pres2) :
-    CURLE_UNKNOWN_OPTION;
-}
-
-static bool cf_msh3_conn_is_alive(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  bool *input_pending)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-
-  (void)data;
-  *input_pending = FALSE;
-  return ctx && ctx->sock[SP_LOCAL] != CURL_SOCKET_BAD && ctx->qconn &&
-         ctx->connected;
-}
-
-struct Curl_cftype Curl_cft_http3 = {
-  "HTTP/3",
-  CF_TYPE_IP_CONNECT | CF_TYPE_SSL | CF_TYPE_MULTIPLEX,
-  0,
-  cf_msh3_destroy,
-  cf_msh3_connect,
-  cf_msh3_close,
-  Curl_cf_def_get_host,
-  cf_msh3_get_select_socks,
-  cf_msh3_data_pending,
-  cf_msh3_send,
-  cf_msh3_recv,
-  cf_msh3_data_event,
-  cf_msh3_conn_is_alive,
-  Curl_cf_def_conn_keep_alive,
-  cf_msh3_query,
-};
-
-CURLcode Curl_cf_msh3_create(struct Curl_cfilter **pcf,
-                             struct Curl_easy *data,
-                             struct connectdata *conn,
-                             const struct Curl_addrinfo *ai)
-{
-  struct cf_msh3_ctx *ctx = NULL;
-  struct Curl_cfilter *cf = NULL;
-  CURLcode result;
-
-  (void)data;
-  (void)conn;
-  (void)ai; /* TODO: msh3 resolves itself? */
-  ctx = calloc(sizeof(*ctx), 1);
-  if(!ctx) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto out;
-  }
-  Curl_sock_assign_addr(&ctx->addr, ai, TRNSPRT_QUIC);
-  ctx->sock[SP_LOCAL] = CURL_SOCKET_BAD;
-  ctx->sock[SP_REMOTE] = CURL_SOCKET_BAD;
-
-  result = Curl_cf_create(&cf, &Curl_cft_http3, ctx);
-
-out:
-  *pcf = (!result)? cf : NULL;
-  if(result) {
-    Curl_safefree(cf);
-    Curl_safefree(ctx);
-  }
-
-  return result;
-}
-
-bool Curl_conn_is_msh3(const struct Curl_easy *data,
-                       const struct connectdata *conn,
-                       int sockindex)
-{
-  struct Curl_cfilter *cf = conn? conn->cfilter[sockindex] : NULL;
-
-  (void)data;
-  for(; cf; cf = cf->next) {
-    if(cf->cft == &Curl_cft_http3)
-      return TRUE;
-    if(cf->cft->flags & CF_TYPE_IP_CONNECT)
-      return FALSE;
-  }
-  return FALSE;
-}
-
-#endif /* USE_MSH3 */
diff --git a/third-party/curl/lib/vquic/curl_msh3.h b/third-party/curl/lib/vquic/curl_msh3.h
deleted file mode 100644
index 33931f59bb..0000000000
--- a/third-party/curl/lib/vquic/curl_msh3.h
+++ /dev/null
@@ -1,46 +0,0 @@
-#ifndef HEADER_CURL_VQUIC_CURL_MSH3_H
-#define HEADER_CURL_VQUIC_CURL_MSH3_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#ifdef USE_MSH3
-
-#include <msh3.h>
-
-void Curl_msh3_ver(char *p, size_t len);
-
-CURLcode Curl_cf_msh3_create(struct Curl_cfilter **pcf,
-                             struct Curl_easy *data,
-                             struct connectdata *conn,
-                             const struct Curl_addrinfo *ai);
-
-bool Curl_conn_is_msh3(const struct Curl_easy *data,
-                       const struct connectdata *conn,
-                       int sockindex);
-
-#endif /* USE_MSQUIC */
-
-#endif /* HEADER_CURL_VQUIC_CURL_MSH3_H */
diff --git a/third-party/curl/lib/vquic/curl_ngtcp2.c b/third-party/curl/lib/vquic/curl_ngtcp2.c
deleted file mode 100644
index 03e911d184..0000000000
--- a/third-party/curl/lib/vquic/curl_ngtcp2.c
+++ /dev/null
@@ -1,2748 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#if defined(USE_NGTCP2) && defined(USE_NGHTTP3)
-#include <ngtcp2/ngtcp2.h>
-#include <nghttp3/nghttp3.h>
-
-#ifdef USE_OPENSSL
-#include <openssl/err.h>
-#ifdef OPENSSL_IS_BORINGSSL
-#include <ngtcp2/ngtcp2_crypto_boringssl.h>
-#else
-#include <ngtcp2/ngtcp2_crypto_quictls.h>
-#endif
-#include "vtls/openssl.h"
-#elif defined(USE_GNUTLS)
-#include <ngtcp2/ngtcp2_crypto_gnutls.h>
-#include "vtls/gtls.h"
-#elif defined(USE_WOLFSSL)
-#include <ngtcp2/ngtcp2_crypto_wolfssl.h>
-#include "vtls/wolfssl.h"
-#endif
-
-#include "urldata.h"
-#include "sendf.h"
-#include "strdup.h"
-#include "rand.h"
-#include "multiif.h"
-#include "strcase.h"
-#include "cfilters.h"
-#include "cf-socket.h"
-#include "connect.h"
-#include "progress.h"
-#include "strerror.h"
-#include "dynbuf.h"
-#include "http1.h"
-#include "select.h"
-#include "inet_pton.h"
-#include "vquic.h"
-#include "vquic_int.h"
-#include "vtls/keylog.h"
-#include "vtls/vtls.h"
-#include "curl_ngtcp2.h"
-
-#include "warnless.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-
-#define H3_ALPN_H3_29 "\x5h3-29"
-#define H3_ALPN_H3 "\x2h3"
-
-#define QUIC_MAX_STREAMS (256*1024)
-#define QUIC_MAX_DATA (1*1024*1024)
-#define QUIC_IDLE_TIMEOUT (60*NGTCP2_SECONDS)
-#define QUIC_HANDSHAKE_TIMEOUT (10*NGTCP2_SECONDS)
-
-/* A stream window is the maximum amount we need to buffer for
- * each active transfer. We use HTTP/3 flow control and only ACK
- * when we take things out of the buffer.
- * Chunk size is large enough to take a full DATA frame */
-#define H3_STREAM_WINDOW_SIZE (128 * 1024)
-#define H3_STREAM_CHUNK_SIZE   (16 * 1024)
-/* The pool keeps spares around and half of a full stream windows
- * seems good. More does not seem to improve performance.
- * The benefit of the pool is that stream buffer to not keep
- * spares. So memory consumption goes down when streams run empty,
- * have a large upload done, etc. */
-#define H3_STREAM_POOL_SPARES \
-          (H3_STREAM_WINDOW_SIZE / H3_STREAM_CHUNK_SIZE ) / 2
-/* Receive and Send max number of chunks just follows from the
- * chunk size and window size */
-#define H3_STREAM_RECV_CHUNKS \
-          (H3_STREAM_WINDOW_SIZE / H3_STREAM_CHUNK_SIZE)
-#define H3_STREAM_SEND_CHUNKS \
-          (H3_STREAM_WINDOW_SIZE / H3_STREAM_CHUNK_SIZE)
-
-
-#ifdef USE_OPENSSL
-#define QUIC_CIPHERS                                                          \
-  "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_"               \
-  "POLY1305_SHA256:TLS_AES_128_CCM_SHA256"
-#define QUIC_GROUPS "P-256:X25519:P-384:P-521"
-#elif defined(USE_GNUTLS)
-#define QUIC_PRIORITY \
-  "NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM:+AES-256-GCM:" \
-  "+CHACHA20-POLY1305:+AES-128-CCM:-GROUP-ALL:+GROUP-SECP256R1:" \
-  "+GROUP-X25519:+GROUP-SECP384R1:+GROUP-SECP521R1:" \
-  "%DISABLE_TLS13_COMPAT_MODE"
-#elif defined(USE_WOLFSSL)
-#define QUIC_CIPHERS                                                          \
-  "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_"               \
-  "POLY1305_SHA256:TLS_AES_128_CCM_SHA256"
-#define QUIC_GROUPS "P-256:P-384:P-521"
-#endif
-
-
-/*
- * Store ngtcp2 version info in this buffer.
- */
-void Curl_ngtcp2_ver(char *p, size_t len)
-{
-  const ngtcp2_info *ng2 = ngtcp2_version(0);
-  const nghttp3_info *ht3 = nghttp3_version(0);
-  (void)msnprintf(p, len, "ngtcp2/%s nghttp3/%s",
-                  ng2->version_str, ht3->version_str);
-}
-
-struct cf_ngtcp2_ctx {
-  struct cf_quic_ctx q;
-  ngtcp2_path connected_path;
-  ngtcp2_conn *qconn;
-  ngtcp2_cid dcid;
-  ngtcp2_cid scid;
-  uint32_t version;
-  ngtcp2_settings settings;
-  ngtcp2_transport_params transport_params;
-  ngtcp2_ccerr last_error;
-  ngtcp2_crypto_conn_ref conn_ref;
-#ifdef USE_OPENSSL
-  SSL_CTX *sslctx;
-  SSL *ssl;
-#elif defined(USE_GNUTLS)
-  struct gtls_instance *gtls;
-#elif defined(USE_WOLFSSL)
-  WOLFSSL_CTX *sslctx;
-  WOLFSSL *ssl;
-#endif
-  struct cf_call_data call_data;
-  nghttp3_conn *h3conn;
-  nghttp3_settings h3settings;
-  struct curltime started_at;        /* time the current attempt started */
-  struct curltime handshake_at;      /* time connect handshake finished */
-  struct curltime first_byte_at;     /* when first byte was recvd */
-  struct curltime reconnect_at;      /* time the next attempt should start */
-  struct bufc_pool stream_bufcp;     /* chunk pool for streams */
-  size_t max_stream_window;          /* max flow window for one stream */
-  int qlogfd;
-  BIT(got_first_byte);               /* if first byte was received */
-#ifdef USE_OPENSSL
-  BIT(x509_store_setup);             /* if x509 store has been set up */
-#endif
-};
-
-/* How to access `call_data` from a cf_ngtcp2 filter */
-#undef CF_CTX_CALL_DATA
-#define CF_CTX_CALL_DATA(cf)  \
-  ((struct cf_ngtcp2_ctx *)(cf)->ctx)->call_data
-
-/**
- * All about the H3 internals of a stream
- */
-struct h3_stream_ctx {
-  int64_t id; /* HTTP/3 protocol identifier */
-  struct bufq sendbuf;   /* h3 request body */
-  struct bufq recvbuf;   /* h3 response body */
-  struct h1_req_parser h1; /* h1 request parsing */
-  size_t sendbuf_len_in_flight; /* sendbuf amount "in flight" */
-  size_t upload_blocked_len; /* the amount written last and EGAINed */
-  size_t recv_buf_nonflow; /* buffered bytes, not counting for flow control */
-  uint64_t error3; /* HTTP/3 stream error code */
-  curl_off_t upload_left; /* number of request bytes left to upload */
-  int status_code; /* HTTP status code */
-  bool resp_hds_complete; /* we have a complete, final response */
-  bool closed; /* TRUE on stream close */
-  bool reset;  /* TRUE on stream reset */
-  bool send_closed; /* stream is local closed */
-};
-
-#define H3_STREAM_CTX(d)  ((struct h3_stream_ctx *)(((d) && (d)->req.p.http)? \
-                           ((struct HTTP *)(d)->req.p.http)->h3_ctx \
-                             : NULL))
-#define H3_STREAM_LCTX(d) ((struct HTTP *)(d)->req.p.http)->h3_ctx
-#define H3_STREAM_ID(d)   (H3_STREAM_CTX(d)? \
-                           H3_STREAM_CTX(d)->id : -2)
-
-static CURLcode h3_data_setup(struct Curl_cfilter *cf,
-                              struct Curl_easy *data)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(data);
-
-  if(!data || !data->req.p.http) {
-    failf(data, "initialization failure, transfer not http initialized");
-    return CURLE_FAILED_INIT;
-  }
-
-  if(stream)
-    return CURLE_OK;
-
-  stream = calloc(1, sizeof(*stream));
-  if(!stream)
-    return CURLE_OUT_OF_MEMORY;
-
-  stream->id = -1;
-  /* on send, we control how much we put into the buffer */
-  Curl_bufq_initp(&stream->sendbuf, &ctx->stream_bufcp,
-                  H3_STREAM_SEND_CHUNKS, BUFQ_OPT_NONE);
-  stream->sendbuf_len_in_flight = 0;
-  /* on recv, we need a flexible buffer limit since we also write
-   * headers to it that are not counted against the nghttp3 flow limits. */
-  Curl_bufq_initp(&stream->recvbuf, &ctx->stream_bufcp,
-                  H3_STREAM_RECV_CHUNKS, BUFQ_OPT_SOFT_LIMIT);
-  stream->recv_buf_nonflow = 0;
-  Curl_h1_req_parse_init(&stream->h1, H1_PARSE_DEFAULT_MAX_LINE_LEN);
-
-  H3_STREAM_LCTX(data) = stream;
-  return CURLE_OK;
-}
-
-static void h3_data_done(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(data);
-
-  (void)cf;
-  if(stream) {
-    CURL_TRC_CF(data, cf, "[%"PRId64"] easy handle is done", stream->id);
-    Curl_bufq_free(&stream->sendbuf);
-    Curl_bufq_free(&stream->recvbuf);
-    Curl_h1_req_parse_free(&stream->h1);
-    free(stream);
-    H3_STREAM_LCTX(data) = NULL;
-  }
-}
-
-/* ngtcp2 default congestion controller does not perform pacing. Limit
-   the maximum packet burst to MAX_PKT_BURST packets. */
-#define MAX_PKT_BURST 10
-
-struct pkt_io_ctx {
-  struct Curl_cfilter *cf;
-  struct Curl_easy *data;
-  ngtcp2_tstamp ts;
-  size_t pkt_count;
-  ngtcp2_path_storage ps;
-};
-
-static ngtcp2_tstamp timestamp(void)
-{
-  struct curltime ct = Curl_now();
-  return ct.tv_sec * NGTCP2_SECONDS + ct.tv_usec * NGTCP2_MICROSECONDS;
-}
-
-static void pktx_init(struct pkt_io_ctx *pktx,
-                      struct Curl_cfilter *cf,
-                      struct Curl_easy *data)
-{
-  pktx->cf = cf;
-  pktx->data = data;
-  pktx->ts = timestamp();
-  pktx->pkt_count = 0;
-  ngtcp2_path_storage_zero(&pktx->ps);
-}
-
-static CURLcode cf_progress_ingress(struct Curl_cfilter *cf,
-                                    struct Curl_easy *data,
-                                    struct pkt_io_ctx *pktx);
-static CURLcode cf_progress_egress(struct Curl_cfilter *cf,
-                                   struct Curl_easy *data,
-                                   struct pkt_io_ctx *pktx);
-static int cb_h3_acked_req_body(nghttp3_conn *conn, int64_t stream_id,
-                                   uint64_t datalen, void *user_data,
-                                   void *stream_user_data);
-
-static ngtcp2_conn *get_conn(ngtcp2_crypto_conn_ref *conn_ref)
-{
-  struct Curl_cfilter *cf = conn_ref->user_data;
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  return ctx->qconn;
-}
-
-#ifdef DEBUG_NGTCP2
-static void quic_printf(void *user_data, const char *fmt, ...)
-{
-  struct Curl_cfilter *cf = user_data;
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-
-  (void)ctx;  /* TODO: need an easy handle to infof() message */
-  va_list ap;
-  va_start(ap, fmt);
-  vfprintf(stderr, fmt, ap);
-  va_end(ap);
-  fprintf(stderr, "\n");
-}
-#endif
-
-static void qlog_callback(void *user_data, uint32_t flags,
-                          const void *data, size_t datalen)
-{
-  struct Curl_cfilter *cf = user_data;
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  (void)flags;
-  if(ctx->qlogfd != -1) {
-    ssize_t rc = write(ctx->qlogfd, data, datalen);
-    if(rc == -1) {
-      /* on write error, stop further write attempts */
-      close(ctx->qlogfd);
-      ctx->qlogfd = -1;
-    }
-  }
-
-}
-
-static void quic_settings(struct cf_ngtcp2_ctx *ctx,
-                          struct Curl_easy *data,
-                          struct pkt_io_ctx *pktx)
-{
-  ngtcp2_settings *s = &ctx->settings;
-  ngtcp2_transport_params *t = &ctx->transport_params;
-
-  ngtcp2_settings_default(s);
-  ngtcp2_transport_params_default(t);
-#ifdef DEBUG_NGTCP2
-  s->log_printf = quic_printf;
-#else
-  s->log_printf = NULL;
-#endif
-
-  (void)data;
-  s->initial_ts = pktx->ts;
-  s->handshake_timeout = QUIC_HANDSHAKE_TIMEOUT;
-  s->max_window = 100 * ctx->max_stream_window;
-  s->max_stream_window = ctx->max_stream_window;
-
-  t->initial_max_data = 10 * ctx->max_stream_window;
-  t->initial_max_stream_data_bidi_local = ctx->max_stream_window;
-  t->initial_max_stream_data_bidi_remote = ctx->max_stream_window;
-  t->initial_max_stream_data_uni = ctx->max_stream_window;
-  t->initial_max_streams_bidi = QUIC_MAX_STREAMS;
-  t->initial_max_streams_uni = QUIC_MAX_STREAMS;
-  t->max_idle_timeout = QUIC_IDLE_TIMEOUT;
-  if(ctx->qlogfd != -1) {
-    s->qlog_write = qlog_callback;
-  }
-}
-
-#ifdef USE_OPENSSL
-static void keylog_callback(const SSL *ssl, const char *line)
-{
-  (void)ssl;
-  Curl_tls_keylog_write_line(line);
-}
-#elif defined(USE_GNUTLS)
-static int keylog_callback(gnutls_session_t session, const char *label,
-                    const gnutls_datum_t *secret)
-{
-  gnutls_datum_t crandom;
-  gnutls_datum_t srandom;
-
-  gnutls_session_get_random(session, &crandom, &srandom);
-  if(crandom.size != 32) {
-    return -1;
-  }
-
-  Curl_tls_keylog_write(label, crandom.data, secret->data, secret->size);
-  return 0;
-}
-#elif defined(USE_WOLFSSL)
-#if defined(HAVE_SECRET_CALLBACK)
-static void keylog_callback(const WOLFSSL *ssl, const char *line)
-{
-  (void)ssl;
-  Curl_tls_keylog_write_line(line);
-}
-#endif
-#endif
-
-static int init_ngh3_conn(struct Curl_cfilter *cf);
-
-#ifdef USE_OPENSSL
-static CURLcode quic_ssl_ctx(SSL_CTX **pssl_ctx,
-                             struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  struct connectdata *conn = cf->conn;
-  CURLcode result = CURLE_FAILED_INIT;
-  SSL_CTX *ssl_ctx = SSL_CTX_new(TLS_method());
-
-  if(!ssl_ctx) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto out;
-  }
-
-#ifdef OPENSSL_IS_BORINGSSL
-  if(ngtcp2_crypto_boringssl_configure_client_context(ssl_ctx) != 0) {
-    failf(data, "ngtcp2_crypto_boringssl_configure_client_context failed");
-    goto out;
-  }
-#else
-  if(ngtcp2_crypto_quictls_configure_client_context(ssl_ctx) != 0) {
-    failf(data, "ngtcp2_crypto_quictls_configure_client_context failed");
-    goto out;
-  }
-#endif
-
-  SSL_CTX_set_default_verify_paths(ssl_ctx);
-
-#ifdef OPENSSL_IS_BORINGSSL
-  if(SSL_CTX_set1_curves_list(ssl_ctx, QUIC_GROUPS) != 1) {
-    failf(data, "SSL_CTX_set1_curves_list failed");
-    goto out;
-  }
-#else
-  if(SSL_CTX_set_ciphersuites(ssl_ctx, QUIC_CIPHERS) != 1) {
-    char error_buffer[256];
-    ERR_error_string_n(ERR_get_error(), error_buffer, sizeof(error_buffer));
-    failf(data, "SSL_CTX_set_ciphersuites: %s", error_buffer);
-    goto out;
-  }
-
-  if(SSL_CTX_set1_groups_list(ssl_ctx, QUIC_GROUPS) != 1) {
-    failf(data, "SSL_CTX_set1_groups_list failed");
-    goto out;
-  }
-#endif
-
-  /* Open the file if a TLS or QUIC backend has not done this before. */
-  Curl_tls_keylog_open();
-  if(Curl_tls_keylog_enabled()) {
-    SSL_CTX_set_keylog_callback(ssl_ctx, keylog_callback);
-  }
-
-  /* OpenSSL always tries to verify the peer, this only says whether it should
-   * fail to connect if the verification fails, or if it should continue
-   * anyway. In the latter case the result of the verification is checked with
-   * SSL_get_verify_result() below. */
-  SSL_CTX_set_verify(ssl_ctx, conn->ssl_config.verifypeer ?
-                     SSL_VERIFY_PEER : SSL_VERIFY_NONE, NULL);
-
-  /* give application a chance to interfere with SSL set up. */
-  if(data->set.ssl.fsslctx) {
-    /* When a user callback is installed to modify the SSL_CTX,
-     * we need to do the full initialization before calling it.
-     * See: #11800 */
-    if(!ctx->x509_store_setup) {
-      result = Curl_ssl_setup_x509_store(cf, data, ssl_ctx);
-      if(result)
-        goto out;
-      ctx->x509_store_setup = TRUE;
-    }
-    Curl_set_in_callback(data, true);
-    result = (*data->set.ssl.fsslctx)(data, ssl_ctx,
-                                      data->set.ssl.fsslctxp);
-    Curl_set_in_callback(data, false);
-    if(result) {
-      failf(data, "error signaled by ssl ctx callback");
-      goto out;
-    }
-  }
-  result = CURLE_OK;
-
-out:
-  *pssl_ctx = result? NULL : ssl_ctx;
-  if(result && ssl_ctx)
-    SSL_CTX_free(ssl_ctx);
-  return result;
-}
-
-static CURLcode quic_set_client_cert(struct Curl_cfilter *cf,
-                                     struct Curl_easy *data)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  SSL_CTX *ssl_ctx = ctx->sslctx;
-  const struct ssl_config_data *ssl_config;
-
-  ssl_config = Curl_ssl_get_config(data, FIRSTSOCKET);
-  DEBUGASSERT(ssl_config);
-
-  if(ssl_config->primary.clientcert || ssl_config->primary.cert_blob
-     || ssl_config->cert_type) {
-    return Curl_ossl_set_client_cert(
-        data, ssl_ctx, ssl_config->primary.clientcert,
-        ssl_config->primary.cert_blob, ssl_config->cert_type,
-        ssl_config->key, ssl_config->key_blob,
-        ssl_config->key_type, ssl_config->key_passwd);
-  }
-
-  return CURLE_OK;
-}
-
-/** SSL callbacks ***/
-
-static CURLcode quic_init_ssl(struct Curl_cfilter *cf,
-                              struct Curl_easy *data)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  const uint8_t *alpn = NULL;
-  size_t alpnlen = 0;
-  unsigned char checkip[16];
-
-  DEBUGASSERT(!ctx->ssl);
-  ctx->ssl = SSL_new(ctx->sslctx);
-
-  SSL_set_app_data(ctx->ssl, &ctx->conn_ref);
-  SSL_set_connect_state(ctx->ssl);
-  SSL_set_quic_use_legacy_codepoint(ctx->ssl, 0);
-
-  alpn = (const uint8_t *)H3_ALPN_H3_29 H3_ALPN_H3;
-  alpnlen = sizeof(H3_ALPN_H3_29) - 1 + sizeof(H3_ALPN_H3) - 1;
-  if(alpn)
-    SSL_set_alpn_protos(ctx->ssl, alpn, (int)alpnlen);
-
-  /* set SNI */
-  if((0 == Curl_inet_pton(AF_INET, cf->conn->host.name, checkip))
-#ifdef ENABLE_IPV6
-     && (0 == Curl_inet_pton(AF_INET6, cf->conn->host.name, checkip))
-#endif
-     ) {
-    char *snihost = Curl_ssl_snihost(data, cf->conn->host.name, NULL);
-    if(!snihost || !SSL_set_tlsext_host_name(ctx->ssl, snihost)) {
-      failf(data, "Failed set SNI");
-      SSL_free(ctx->ssl);
-      ctx->ssl = NULL;
-      return CURLE_QUIC_CONNECT_ERROR;
-    }
-  }
-  return CURLE_OK;
-}
-#elif defined(USE_GNUTLS)
-static CURLcode quic_init_ssl(struct Curl_cfilter *cf,
-                              struct Curl_easy *data)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  CURLcode result;
-  gnutls_datum_t alpn[2];
-  /* this will need some attention when HTTPS proxy over QUIC get fixed */
-  const char * const hostname = cf->conn->host.name;
-  long * const pverifyresult = &data->set.ssl.certverifyresult;
-  int rc;
-
-  DEBUGASSERT(ctx->gtls == NULL);
-  ctx->gtls = calloc(1, sizeof(*(ctx->gtls)));
-  if(!ctx->gtls)
-    return CURLE_OUT_OF_MEMORY;
-
-  result = gtls_client_init(data, &cf->conn->ssl_config, &data->set.ssl,
-                            hostname, ctx->gtls, pverifyresult);
-  if(result)
-    return result;
-
-  gnutls_session_set_ptr(ctx->gtls->session, &ctx->conn_ref);
-
-  if(ngtcp2_crypto_gnutls_configure_client_session(ctx->gtls->session) != 0) {
-    CURL_TRC_CF(data, cf,
-                "ngtcp2_crypto_gnutls_configure_client_session failed\n");
-    return CURLE_QUIC_CONNECT_ERROR;
-  }
-
-  rc = gnutls_priority_set_direct(ctx->gtls->session, QUIC_PRIORITY, NULL);
-  if(rc < 0) {
-    CURL_TRC_CF(data, cf, "gnutls_priority_set_direct failed: %s\n",
-                gnutls_strerror(rc));
-    return CURLE_QUIC_CONNECT_ERROR;
-  }
-
-  /* Open the file if a TLS or QUIC backend has not done this before. */
-  Curl_tls_keylog_open();
-  if(Curl_tls_keylog_enabled()) {
-    gnutls_session_set_keylog_function(ctx->gtls->session, keylog_callback);
-  }
-
-  /* strip the first byte (the length) from NGHTTP3_ALPN_H3 */
-  alpn[0].data = (unsigned char *)H3_ALPN_H3_29 + 1;
-  alpn[0].size = sizeof(H3_ALPN_H3_29) - 2;
-  alpn[1].data = (unsigned char *)H3_ALPN_H3 + 1;
-  alpn[1].size = sizeof(H3_ALPN_H3) - 2;
-
-  gnutls_alpn_set_protocols(ctx->gtls->session,
-                            alpn, 2, GNUTLS_ALPN_MANDATORY);
-  return CURLE_OK;
-}
-#elif defined(USE_WOLFSSL)
-
-static CURLcode quic_ssl_ctx(WOLFSSL_CTX **pssl_ctx,
-                             struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct connectdata *conn = cf->conn;
-  CURLcode result = CURLE_FAILED_INIT;
-  WOLFSSL_CTX *ssl_ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method());
-
-  if(!ssl_ctx) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto out;
-  }
-
-  if(ngtcp2_crypto_wolfssl_configure_client_context(ssl_ctx) != 0) {
-    failf(data, "ngtcp2_crypto_wolfssl_configure_client_context failed");
-    goto out;
-  }
-
-  wolfSSL_CTX_set_default_verify_paths(ssl_ctx);
-
-  if(wolfSSL_CTX_set_cipher_list(ssl_ctx, QUIC_CIPHERS) != 1) {
-    char error_buffer[256];
-    ERR_error_string_n(ERR_get_error(), error_buffer, sizeof(error_buffer));
-    failf(data, "wolfSSL_CTX_set_cipher_list: %s", error_buffer);
-    goto out;
-  }
-
-  if(wolfSSL_CTX_set1_groups_list(ssl_ctx, (char *)QUIC_GROUPS) != 1) {
-    failf(data, "SSL_CTX_set1_groups_list failed");
-    goto out;
-  }
-
-  /* Open the file if a TLS or QUIC backend has not done this before. */
-  Curl_tls_keylog_open();
-  if(Curl_tls_keylog_enabled()) {
-#if defined(HAVE_SECRET_CALLBACK)
-    wolfSSL_CTX_set_keylog_callback(ssl_ctx, keylog_callback);
-#else
-    failf(data, "wolfSSL was built without keylog callback");
-    goto out;
-#endif
-  }
-
-  if(conn->ssl_config.verifypeer) {
-    const char * const ssl_cafile = conn->ssl_config.CAfile;
-    const char * const ssl_capath = conn->ssl_config.CApath;
-
-    wolfSSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, NULL);
-    if(conn->ssl_config.CAfile || conn->ssl_config.CApath) {
-      /* tell wolfSSL where to find CA certificates that are used to verify
-         the server's certificate. */
-      if(!wolfSSL_CTX_load_verify_locations(ssl_ctx, ssl_cafile, ssl_capath)) {
-        /* Fail if we insist on successfully verifying the server. */
-        failf(data, "error setting certificate verify locations:"
-              "  CAfile: %s CApath: %s",
-              ssl_cafile ? ssl_cafile : "none",
-              ssl_capath ? ssl_capath : "none");
-        goto out;
-      }
-      infof(data, " CAfile: %s", ssl_cafile ? ssl_cafile : "none");
-      infof(data, " CApath: %s", ssl_capath ? ssl_capath : "none");
-    }
-#ifdef CURL_CA_FALLBACK
-    else {
-      /* verifying the peer without any CA certificates won't work so
-         use wolfssl's built-in default as fallback */
-      wolfSSL_CTX_set_default_verify_paths(ssl_ctx);
-    }
-#endif
-  }
-  else {
-    wolfSSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_NONE, NULL);
-  }
-
-  /* give application a chance to interfere with SSL set up. */
-  if(data->set.ssl.fsslctx) {
-    Curl_set_in_callback(data, true);
-    result = (*data->set.ssl.fsslctx)(data, ssl_ctx,
-                                      data->set.ssl.fsslctxp);
-    Curl_set_in_callback(data, false);
-    if(result) {
-      failf(data, "error signaled by ssl ctx callback");
-      goto out;
-    }
-  }
-  result = CURLE_OK;
-
-out:
-  *pssl_ctx = result? NULL : ssl_ctx;
-  if(result && ssl_ctx)
-    SSL_CTX_free(ssl_ctx);
-  return result;
-}
-
-/** SSL callbacks ***/
-
-static CURLcode quic_init_ssl(struct Curl_cfilter *cf,
-                              struct Curl_easy *data)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  const uint8_t *alpn = NULL;
-  size_t alpnlen = 0;
-  /* this will need some attention when HTTPS proxy over QUIC get fixed */
-  const char * const hostname = cf->conn->host.name;
-
-  (void)data;
-  DEBUGASSERT(!ctx->ssl);
-  ctx->ssl = wolfSSL_new(ctx->sslctx);
-
-  wolfSSL_set_app_data(ctx->ssl, &ctx->conn_ref);
-  wolfSSL_set_connect_state(ctx->ssl);
-  wolfSSL_set_quic_use_legacy_codepoint(ctx->ssl, 0);
-
-  alpn = (const uint8_t *)H3_ALPN_H3_29 H3_ALPN_H3;
-  alpnlen = sizeof(H3_ALPN_H3_29) - 1 + sizeof(H3_ALPN_H3) - 1;
-  if(alpn)
-    wolfSSL_set_alpn_protos(ctx->ssl, alpn, (int)alpnlen);
-
-  /* set SNI */
-  wolfSSL_UseSNI(ctx->ssl, WOLFSSL_SNI_HOST_NAME,
-                 hostname, (unsigned short)strlen(hostname));
-
-  return CURLE_OK;
-}
-#endif /* defined(USE_WOLFSSL) */
-
-static int cb_handshake_completed(ngtcp2_conn *tconn, void *user_data)
-{
-  (void)user_data;
-  (void)tconn;
-  return 0;
-}
-
-static void report_consumed_data(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data,
-                                 size_t consumed)
-{
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(data);
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-
-  if(!stream)
-    return;
-  /* the HTTP/1.1 response headers are written to the buffer, but
-   * consuming those does not count against flow control. */
-  if(stream->recv_buf_nonflow) {
-    if(consumed >= stream->recv_buf_nonflow) {
-      consumed -= stream->recv_buf_nonflow;
-      stream->recv_buf_nonflow = 0;
-    }
-    else {
-      stream->recv_buf_nonflow -= consumed;
-      consumed = 0;
-    }
-  }
-  if(consumed > 0) {
-    CURL_TRC_CF(data, cf, "[%" PRId64 "] ACK %zu bytes of DATA",
-                stream->id, consumed);
-    ngtcp2_conn_extend_max_stream_offset(ctx->qconn, stream->id,
-                                         consumed);
-    ngtcp2_conn_extend_max_offset(ctx->qconn, consumed);
-  }
-}
-
-static int cb_recv_stream_data(ngtcp2_conn *tconn, uint32_t flags,
-                               int64_t stream_id, uint64_t offset,
-                               const uint8_t *buf, size_t buflen,
-                               void *user_data, void *stream_user_data)
-{
-  struct Curl_cfilter *cf = user_data;
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  nghttp3_ssize nconsumed;
-  int fin = (flags & NGTCP2_STREAM_DATA_FLAG_FIN) ? 1 : 0;
-  struct Curl_easy *data = stream_user_data;
-  (void)offset;
-  (void)data;
-
-  nconsumed =
-    nghttp3_conn_read_stream(ctx->h3conn, stream_id, buf, buflen, fin);
-  CURL_TRC_CF(data, cf, "[%" PRId64 "] read_stream(len=%zu) -> %zd",
-              stream_id, buflen, nconsumed);
-  if(nconsumed < 0) {
-    ngtcp2_ccerr_set_application_error(
-      &ctx->last_error,
-      nghttp3_err_infer_quic_app_error_code((int)nconsumed), NULL, 0);
-    return NGTCP2_ERR_CALLBACK_FAILURE;
-  }
-
-  /* number of bytes inside buflen which consists of framing overhead
-   * including QPACK HEADERS. In other words, it does not consume payload of
-   * DATA frame. */
-  ngtcp2_conn_extend_max_stream_offset(tconn, stream_id, nconsumed);
-  ngtcp2_conn_extend_max_offset(tconn, nconsumed);
-
-  return 0;
-}
-
-static int
-cb_acked_stream_data_offset(ngtcp2_conn *tconn, int64_t stream_id,
-                            uint64_t offset, uint64_t datalen, void *user_data,
-                            void *stream_user_data)
-{
-  struct Curl_cfilter *cf = user_data;
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  int rv;
-  (void)stream_id;
-  (void)tconn;
-  (void)offset;
-  (void)datalen;
-  (void)stream_user_data;
-
-  rv = nghttp3_conn_add_ack_offset(ctx->h3conn, stream_id, datalen);
-  if(rv) {
-    return NGTCP2_ERR_CALLBACK_FAILURE;
-  }
-
-  return 0;
-}
-
-static int cb_stream_close(ngtcp2_conn *tconn, uint32_t flags,
-                           int64_t stream3_id, uint64_t app_error_code,
-                           void *user_data, void *stream_user_data)
-{
-  struct Curl_cfilter *cf = user_data;
-  struct Curl_easy *data = stream_user_data;
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  int rv;
-
-  (void)tconn;
-  (void)data;
-  /* stream is closed... */
-
-  if(!(flags & NGTCP2_STREAM_CLOSE_FLAG_APP_ERROR_CODE_SET)) {
-    app_error_code = NGHTTP3_H3_NO_ERROR;
-  }
-
-  rv = nghttp3_conn_close_stream(ctx->h3conn, stream3_id,
-                                 app_error_code);
-  CURL_TRC_CF(data, cf, "[%" PRId64 "] quic close(err=%"
-              PRIu64 ") -> %d", stream3_id, app_error_code, rv);
-  if(rv) {
-    ngtcp2_ccerr_set_application_error(
-      &ctx->last_error, nghttp3_err_infer_quic_app_error_code(rv), NULL, 0);
-    return NGTCP2_ERR_CALLBACK_FAILURE;
-  }
-
-  return 0;
-}
-
-static int cb_stream_reset(ngtcp2_conn *tconn, int64_t stream_id,
-                           uint64_t final_size, uint64_t app_error_code,
-                           void *user_data, void *stream_user_data)
-{
-  struct Curl_cfilter *cf = user_data;
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  struct Curl_easy *data = stream_user_data;
-  int rv;
-  (void)tconn;
-  (void)final_size;
-  (void)app_error_code;
-  (void)data;
-
-  rv = nghttp3_conn_shutdown_stream_read(ctx->h3conn, stream_id);
-  CURL_TRC_CF(data, cf, "[%" PRId64 "] reset -> %d", stream_id, rv);
-  if(rv) {
-    return NGTCP2_ERR_CALLBACK_FAILURE;
-  }
-
-  return 0;
-}
-
-static int cb_stream_stop_sending(ngtcp2_conn *tconn, int64_t stream_id,
-                                  uint64_t app_error_code, void *user_data,
-                                  void *stream_user_data)
-{
-  struct Curl_cfilter *cf = user_data;
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  int rv;
-  (void)tconn;
-  (void)app_error_code;
-  (void)stream_user_data;
-
-  rv = nghttp3_conn_shutdown_stream_read(ctx->h3conn, stream_id);
-  if(rv) {
-    return NGTCP2_ERR_CALLBACK_FAILURE;
-  }
-
-  return 0;
-}
-
-static int cb_extend_max_local_streams_bidi(ngtcp2_conn *tconn,
-                                            uint64_t max_streams,
-                                            void *user_data)
-{
-  (void)tconn;
-  (void)max_streams;
-  (void)user_data;
-
-  return 0;
-}
-
-static int cb_extend_max_stream_data(ngtcp2_conn *tconn, int64_t stream_id,
-                                     uint64_t max_data, void *user_data,
-                                     void *stream_user_data)
-{
-  struct Curl_cfilter *cf = user_data;
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  int rv;
-  (void)tconn;
-  (void)max_data;
-  (void)stream_user_data;
-
-  rv = nghttp3_conn_unblock_stream(ctx->h3conn, stream_id);
-  if(rv) {
-    return NGTCP2_ERR_CALLBACK_FAILURE;
-  }
-
-  return 0;
-}
-
-static void cb_rand(uint8_t *dest, size_t destlen,
-                    const ngtcp2_rand_ctx *rand_ctx)
-{
-  CURLcode result;
-  (void)rand_ctx;
-
-  result = Curl_rand(NULL, dest, destlen);
-  if(result) {
-    /* cb_rand is only used for non-cryptographic context.  If Curl_rand
-       failed, just fill 0 and call it *random*. */
-    memset(dest, 0, destlen);
-  }
-}
-
-static int cb_get_new_connection_id(ngtcp2_conn *tconn, ngtcp2_cid *cid,
-                                    uint8_t *token, size_t cidlen,
-                                    void *user_data)
-{
-  CURLcode result;
-  (void)tconn;
-  (void)user_data;
-
-  result = Curl_rand(NULL, cid->data, cidlen);
-  if(result)
-    return NGTCP2_ERR_CALLBACK_FAILURE;
-  cid->datalen = cidlen;
-
-  result = Curl_rand(NULL, token, NGTCP2_STATELESS_RESET_TOKENLEN);
-  if(result)
-    return NGTCP2_ERR_CALLBACK_FAILURE;
-
-  return 0;
-}
-
-static int cb_recv_rx_key(ngtcp2_conn *tconn, ngtcp2_encryption_level level,
-                          void *user_data)
-{
-  struct Curl_cfilter *cf = user_data;
-  (void)tconn;
-
-  if(level != NGTCP2_ENCRYPTION_LEVEL_1RTT) {
-    return 0;
-  }
-
-  if(init_ngh3_conn(cf) != CURLE_OK) {
-    return NGTCP2_ERR_CALLBACK_FAILURE;
-  }
-
-  return 0;
-}
-
-static ngtcp2_callbacks ng_callbacks = {
-  ngtcp2_crypto_client_initial_cb,
-  NULL, /* recv_client_initial */
-  ngtcp2_crypto_recv_crypto_data_cb,
-  cb_handshake_completed,
-  NULL, /* recv_version_negotiation */
-  ngtcp2_crypto_encrypt_cb,
-  ngtcp2_crypto_decrypt_cb,
-  ngtcp2_crypto_hp_mask_cb,
-  cb_recv_stream_data,
-  cb_acked_stream_data_offset,
-  NULL, /* stream_open */
-  cb_stream_close,
-  NULL, /* recv_stateless_reset */
-  ngtcp2_crypto_recv_retry_cb,
-  cb_extend_max_local_streams_bidi,
-  NULL, /* extend_max_local_streams_uni */
-  cb_rand,
-  cb_get_new_connection_id,
-  NULL, /* remove_connection_id */
-  ngtcp2_crypto_update_key_cb, /* update_key */
-  NULL, /* path_validation */
-  NULL, /* select_preferred_addr */
-  cb_stream_reset,
-  NULL, /* extend_max_remote_streams_bidi */
-  NULL, /* extend_max_remote_streams_uni */
-  cb_extend_max_stream_data,
-  NULL, /* dcid_status */
-  NULL, /* handshake_confirmed */
-  NULL, /* recv_new_token */
-  ngtcp2_crypto_delete_crypto_aead_ctx_cb,
-  ngtcp2_crypto_delete_crypto_cipher_ctx_cb,
-  NULL, /* recv_datagram */
-  NULL, /* ack_datagram */
-  NULL, /* lost_datagram */
-  ngtcp2_crypto_get_path_challenge_data_cb,
-  cb_stream_stop_sending,
-  NULL, /* version_negotiation */
-  cb_recv_rx_key,
-  NULL, /* recv_tx_key */
-  NULL, /* early_data_rejected */
-};
-
-/**
- * Connection maintenance like timeouts on packet ACKs etc. are done by us, not
- * the OS like for TCP. POLL events on the socket therefore are not
- * sufficient.
- * ngtcp2 tells us when it wants to be invoked again. We handle that via
- * the `Curl_expire()` mechanisms.
- */
-static CURLcode check_and_set_expiry(struct Curl_cfilter *cf,
-                                     struct Curl_easy *data,
-                                     struct pkt_io_ctx *pktx)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  struct pkt_io_ctx local_pktx;
-  ngtcp2_tstamp expiry;
-
-  if(!pktx) {
-    pktx_init(&local_pktx, cf, data);
-    pktx = &local_pktx;
-  }
-  else {
-    pktx->ts = timestamp();
-  }
-
-  expiry = ngtcp2_conn_get_expiry(ctx->qconn);
-  if(expiry != UINT64_MAX) {
-    if(expiry <= pktx->ts) {
-      CURLcode result;
-      int rv = ngtcp2_conn_handle_expiry(ctx->qconn, pktx->ts);
-      if(rv) {
-        failf(data, "ngtcp2_conn_handle_expiry returned error: %s",
-              ngtcp2_strerror(rv));
-        ngtcp2_ccerr_set_liberr(&ctx->last_error, rv, NULL, 0);
-        return CURLE_SEND_ERROR;
-      }
-      result = cf_progress_ingress(cf, data, pktx);
-      if(result)
-        return result;
-      result = cf_progress_egress(cf, data, pktx);
-      if(result)
-        return result;
-      /* ask again, things might have changed */
-      expiry = ngtcp2_conn_get_expiry(ctx->qconn);
-    }
-
-    if(expiry > pktx->ts) {
-      ngtcp2_duration timeout = expiry - pktx->ts;
-      if(timeout % NGTCP2_MILLISECONDS) {
-        timeout += NGTCP2_MILLISECONDS;
-      }
-      Curl_expire(data, timeout / NGTCP2_MILLISECONDS, EXPIRE_QUIC);
-    }
-  }
-  return CURLE_OK;
-}
-
-static int cf_ngtcp2_get_select_socks(struct Curl_cfilter *cf,
-                                      struct Curl_easy *data,
-                                      curl_socket_t *socks)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  struct SingleRequest *k = &data->req;
-  int rv = GETSOCK_BLANK;
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(data);
-  struct cf_call_data save;
-
-  CF_DATA_SAVE(save, cf, data);
-  socks[0] = ctx->q.sockfd;
-
-  /* in HTTP/3 we can always get a frame, so check read */
-  rv |= GETSOCK_READSOCK(0);
-
-  /* we're still uploading or the HTTP/2 layer wants to send data */
-  if((k->keepon & KEEP_SENDBITS) == KEEP_SEND &&
-     ngtcp2_conn_get_cwnd_left(ctx->qconn) &&
-     ngtcp2_conn_get_max_data_left(ctx->qconn) &&
-     stream && nghttp3_conn_is_stream_writable(ctx->h3conn, stream->id))
-    rv |= GETSOCK_WRITESOCK(0);
-
-  CF_DATA_RESTORE(cf, save);
-  return rv;
-}
-
-static void h3_drain_stream(struct Curl_cfilter *cf,
-                            struct Curl_easy *data)
-{
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(data);
-  unsigned char bits;
-
-  (void)cf;
-  bits = CURL_CSELECT_IN;
-  if(stream && stream->upload_left && !stream->send_closed)
-    bits |= CURL_CSELECT_OUT;
-  if(data->state.dselect_bits != bits) {
-    data->state.dselect_bits = bits;
-    Curl_expire(data, 0, EXPIRE_RUN_NOW);
-  }
-}
-
-static int cb_h3_stream_close(nghttp3_conn *conn, int64_t stream_id,
-                              uint64_t app_error_code, void *user_data,
-                              void *stream_user_data)
-{
-  struct Curl_cfilter *cf = user_data;
-  struct Curl_easy *data = stream_user_data;
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(data);
-  (void)conn;
-  (void)stream_id;
-
-  /* we might be called by nghttp3 after we already cleaned up */
-  if(!stream)
-    return 0;
-
-  stream->closed = TRUE;
-  stream->error3 = app_error_code;
-  if(stream->error3 != NGHTTP3_H3_NO_ERROR) {
-    stream->reset = TRUE;
-    stream->send_closed = TRUE;
-    CURL_TRC_CF(data, cf, "[%" PRId64 "] RESET: error %" PRId64,
-                stream->id, stream->error3);
-  }
-  else {
-    CURL_TRC_CF(data, cf, "[%" PRId64 "] CLOSED", stream->id);
-  }
-  data->req.keepon &= ~KEEP_SEND_HOLD;
-  h3_drain_stream(cf, data);
-  return 0;
-}
-
-/*
- * write_resp_raw() copies response data in raw format to the `data`'s
-  * receive buffer. If not enough space is available, it appends to the
- * `data`'s overflow buffer.
- */
-static CURLcode write_resp_raw(struct Curl_cfilter *cf,
-                               struct Curl_easy *data,
-                               const void *mem, size_t memlen,
-                               bool flow)
-{
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(data);
-  CURLcode result = CURLE_OK;
-  ssize_t nwritten;
-
-  (void)cf;
-  if(!stream) {
-    return CURLE_RECV_ERROR;
-  }
-  nwritten = Curl_bufq_write(&stream->recvbuf, mem, memlen, &result);
-  if(nwritten < 0) {
-    return result;
-  }
-
-  if(!flow)
-    stream->recv_buf_nonflow += (size_t)nwritten;
-
-  if((size_t)nwritten < memlen) {
-    /* This MUST not happen. Our recbuf is dimensioned to hold the
-     * full max_stream_window and then some for this very reason. */
-    DEBUGASSERT(0);
-    return CURLE_RECV_ERROR;
-  }
-  return result;
-}
-
-static int cb_h3_recv_data(nghttp3_conn *conn, int64_t stream3_id,
-                           const uint8_t *buf, size_t buflen,
-                           void *user_data, void *stream_user_data)
-{
-  struct Curl_cfilter *cf = user_data;
-  struct Curl_easy *data = stream_user_data;
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(data);
-  CURLcode result;
-
-  (void)conn;
-  (void)stream3_id;
-
-  if(!stream)
-    return NGHTTP3_ERR_CALLBACK_FAILURE;
-
-  result = write_resp_raw(cf, data, buf, buflen, TRUE);
-  if(result) {
-    CURL_TRC_CF(data, cf, "[%" PRId64 "] DATA len=%zu, ERROR receiving %d",
-                stream->id, buflen, result);
-    return NGHTTP3_ERR_CALLBACK_FAILURE;
-  }
-  CURL_TRC_CF(data, cf, "[%" PRId64 "] DATA len=%zu", stream->id, buflen);
-  h3_drain_stream(cf, data);
-  return 0;
-}
-
-static int cb_h3_deferred_consume(nghttp3_conn *conn, int64_t stream3_id,
-                                  size_t consumed, void *user_data,
-                                  void *stream_user_data)
-{
-  struct Curl_cfilter *cf = user_data;
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  (void)conn;
-  (void)stream_user_data;
-
-  /* nghttp3 has consumed bytes on the QUIC stream and we need to
-   * tell the QUIC connection to increase its flow control */
-  ngtcp2_conn_extend_max_stream_offset(ctx->qconn, stream3_id, consumed);
-  ngtcp2_conn_extend_max_offset(ctx->qconn, consumed);
-  return 0;
-}
-
-static int cb_h3_end_headers(nghttp3_conn *conn, int64_t stream_id,
-                             int fin, void *user_data, void *stream_user_data)
-{
-  struct Curl_cfilter *cf = user_data;
-  struct Curl_easy *data = stream_user_data;
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(data);
-  CURLcode result = CURLE_OK;
-  (void)conn;
-  (void)stream_id;
-  (void)fin;
-  (void)cf;
-
-  if(!stream)
-    return 0;
-  /* add a CRLF only if we've received some headers */
-  result = write_resp_raw(cf, data, "\r\n", 2, FALSE);
-  if(result) {
-    return -1;
-  }
-
-  CURL_TRC_CF(data, cf, "[%" PRId64 "] end_headers, status=%d",
-              stream_id, stream->status_code);
-  if(stream->status_code / 100 != 1) {
-    stream->resp_hds_complete = TRUE;
-  }
-  h3_drain_stream(cf, data);
-  return 0;
-}
-
-static int cb_h3_recv_header(nghttp3_conn *conn, int64_t stream_id,
-                             int32_t token, nghttp3_rcbuf *name,
-                             nghttp3_rcbuf *value, uint8_t flags,
-                             void *user_data, void *stream_user_data)
-{
-  struct Curl_cfilter *cf = user_data;
-  nghttp3_vec h3name = nghttp3_rcbuf_get_buf(name);
-  nghttp3_vec h3val = nghttp3_rcbuf_get_buf(value);
-  struct Curl_easy *data = stream_user_data;
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(data);
-  CURLcode result = CURLE_OK;
-  (void)conn;
-  (void)stream_id;
-  (void)token;
-  (void)flags;
-  (void)cf;
-
-  /* we might have cleaned up this transfer already */
-  if(!stream)
-    return 0;
-
-  if(token == NGHTTP3_QPACK_TOKEN__STATUS) {
-    char line[14]; /* status line is always 13 characters long */
-    size_t ncopy;
-
-    result = Curl_http_decode_status(&stream->status_code,
-                                     (const char *)h3val.base, h3val.len);
-    if(result)
-      return -1;
-    ncopy = msnprintf(line, sizeof(line), "HTTP/3 %03d \r\n",
-                      stream->status_code);
-    CURL_TRC_CF(data, cf, "[%" PRId64 "] status: %s", stream_id, line);
-    result = write_resp_raw(cf, data, line, ncopy, FALSE);
-    if(result) {
-      return -1;
-    }
-  }
-  else {
-    /* store as an HTTP1-style header */
-    CURL_TRC_CF(data, cf, "[%" PRId64 "] header: %.*s: %.*s",
-                stream_id, (int)h3name.len, h3name.base,
-                (int)h3val.len, h3val.base);
-    result = write_resp_raw(cf, data, h3name.base, h3name.len, FALSE);
-    if(result) {
-      return -1;
-    }
-    result = write_resp_raw(cf, data, ": ", 2, FALSE);
-    if(result) {
-      return -1;
-    }
-    result = write_resp_raw(cf, data, h3val.base, h3val.len, FALSE);
-    if(result) {
-      return -1;
-    }
-    result = write_resp_raw(cf, data, "\r\n", 2, FALSE);
-    if(result) {
-      return -1;
-    }
-  }
-  return 0;
-}
-
-static int cb_h3_stop_sending(nghttp3_conn *conn, int64_t stream_id,
-                              uint64_t app_error_code, void *user_data,
-                              void *stream_user_data)
-{
-  struct Curl_cfilter *cf = user_data;
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  int rv;
-  (void)conn;
-  (void)stream_user_data;
-
-  rv = ngtcp2_conn_shutdown_stream_read(ctx->qconn, 0, stream_id,
-                                        app_error_code);
-  if(rv && rv != NGTCP2_ERR_STREAM_NOT_FOUND) {
-    return NGTCP2_ERR_CALLBACK_FAILURE;
-  }
-
-  return 0;
-}
-
-static int cb_h3_reset_stream(nghttp3_conn *conn, int64_t stream_id,
-                              uint64_t app_error_code, void *user_data,
-                              void *stream_user_data) {
-  struct Curl_cfilter *cf = user_data;
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  struct Curl_easy *data = stream_user_data;
-  int rv;
-  (void)conn;
-  (void)data;
-
-  rv = ngtcp2_conn_shutdown_stream_write(ctx->qconn, 0, stream_id,
-                                         app_error_code);
-  CURL_TRC_CF(data, cf, "[%" PRId64 "] reset -> %d", stream_id, rv);
-  if(rv && rv != NGTCP2_ERR_STREAM_NOT_FOUND) {
-    return NGTCP2_ERR_CALLBACK_FAILURE;
-  }
-
-  return 0;
-}
-
-static nghttp3_callbacks ngh3_callbacks = {
-  cb_h3_acked_req_body, /* acked_stream_data */
-  cb_h3_stream_close,
-  cb_h3_recv_data,
-  cb_h3_deferred_consume,
-  NULL, /* begin_headers */
-  cb_h3_recv_header,
-  cb_h3_end_headers,
-  NULL, /* begin_trailers */
-  cb_h3_recv_header,
-  NULL, /* end_trailers */
-  cb_h3_stop_sending,
-  NULL, /* end_stream */
-  cb_h3_reset_stream,
-  NULL, /* shutdown */
-  NULL /* recv_settings */
-};
-
-static int init_ngh3_conn(struct Curl_cfilter *cf)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  CURLcode result;
-  int rc;
-  int64_t ctrl_stream_id, qpack_enc_stream_id, qpack_dec_stream_id;
-
-  if(ngtcp2_conn_get_streams_uni_left(ctx->qconn) < 3) {
-    return CURLE_QUIC_CONNECT_ERROR;
-  }
-
-  nghttp3_settings_default(&ctx->h3settings);
-
-  rc = nghttp3_conn_client_new(&ctx->h3conn,
-                               &ngh3_callbacks,
-                               &ctx->h3settings,
-                               nghttp3_mem_default(),
-                               cf);
-  if(rc) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto fail;
-  }
-
-  rc = ngtcp2_conn_open_uni_stream(ctx->qconn, &ctrl_stream_id, NULL);
-  if(rc) {
-    result = CURLE_QUIC_CONNECT_ERROR;
-    goto fail;
-  }
-
-  rc = nghttp3_conn_bind_control_stream(ctx->h3conn, ctrl_stream_id);
-  if(rc) {
-    result = CURLE_QUIC_CONNECT_ERROR;
-    goto fail;
-  }
-
-  rc = ngtcp2_conn_open_uni_stream(ctx->qconn, &qpack_enc_stream_id, NULL);
-  if(rc) {
-    result = CURLE_QUIC_CONNECT_ERROR;
-    goto fail;
-  }
-
-  rc = ngtcp2_conn_open_uni_stream(ctx->qconn, &qpack_dec_stream_id, NULL);
-  if(rc) {
-    result = CURLE_QUIC_CONNECT_ERROR;
-    goto fail;
-  }
-
-  rc = nghttp3_conn_bind_qpack_streams(ctx->h3conn, qpack_enc_stream_id,
-                                       qpack_dec_stream_id);
-  if(rc) {
-    result = CURLE_QUIC_CONNECT_ERROR;
-    goto fail;
-  }
-
-  return CURLE_OK;
-fail:
-
-  return result;
-}
-
-static ssize_t recv_closed_stream(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  struct h3_stream_ctx *stream,
-                                  CURLcode *err)
-{
-  ssize_t nread = -1;
-
-  (void)cf;
-  if(stream->reset) {
-    failf(data,
-          "HTTP/3 stream %" PRId64 " reset by server", stream->id);
-    *err = stream->resp_hds_complete? CURLE_PARTIAL_FILE : CURLE_HTTP3;
-    goto out;
-  }
-  else if(!stream->resp_hds_complete) {
-    failf(data,
-          "HTTP/3 stream %" PRId64 " was closed cleanly, but before getting"
-          " all response header fields, treated as error",
-          stream->id);
-    *err = CURLE_HTTP3;
-    goto out;
-  }
-  *err = CURLE_OK;
-  nread = 0;
-
-out:
-  return nread;
-}
-
-/* incoming data frames on the h3 stream */
-static ssize_t cf_ngtcp2_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
-                              char *buf, size_t len, CURLcode *err)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(data);
-  ssize_t nread = -1;
-  struct cf_call_data save;
-  struct pkt_io_ctx pktx;
-
-  (void)ctx;
-
-  CF_DATA_SAVE(save, cf, data);
-  DEBUGASSERT(cf->connected);
-  DEBUGASSERT(ctx);
-  DEBUGASSERT(ctx->qconn);
-  DEBUGASSERT(ctx->h3conn);
-  *err = CURLE_OK;
-
-  pktx_init(&pktx, cf, data);
-
-  if(!stream) {
-    *err = CURLE_RECV_ERROR;
-    goto out;
-  }
-
-  if(!Curl_bufq_is_empty(&stream->recvbuf)) {
-    nread = Curl_bufq_read(&stream->recvbuf,
-                           (unsigned char *)buf, len, err);
-    if(nread < 0) {
-      CURL_TRC_CF(data, cf, "[%" PRId64 "] read recvbuf(len=%zu) "
-                  "-> %zd, %d", stream->id, len, nread, *err);
-      goto out;
-    }
-    report_consumed_data(cf, data, nread);
-  }
-
-  if(cf_progress_ingress(cf, data, &pktx)) {
-    *err = CURLE_RECV_ERROR;
-    nread = -1;
-    goto out;
-  }
-
-  /* recvbuf had nothing before, maybe after progressing ingress? */
-  if(nread < 0 && !Curl_bufq_is_empty(&stream->recvbuf)) {
-    nread = Curl_bufq_read(&stream->recvbuf,
-                           (unsigned char *)buf, len, err);
-    if(nread < 0) {
-      CURL_TRC_CF(data, cf, "[%" PRId64 "] read recvbuf(len=%zu) "
-                  "-> %zd, %d", stream->id, len, nread, *err);
-      goto out;
-    }
-    report_consumed_data(cf, data, nread);
-  }
-
-  if(nread > 0) {
-    h3_drain_stream(cf, data);
-  }
-  else {
-    if(stream->closed) {
-      nread = recv_closed_stream(cf, data, stream, err);
-      goto out;
-    }
-    *err = CURLE_AGAIN;
-    nread = -1;
-  }
-
-out:
-  if(cf_progress_egress(cf, data, &pktx)) {
-    *err = CURLE_SEND_ERROR;
-    nread = -1;
-  }
-  else {
-    CURLcode result2 = check_and_set_expiry(cf, data, &pktx);
-    if(result2) {
-      *err = result2;
-      nread = -1;
-    }
-  }
-  CURL_TRC_CF(data, cf, "[%" PRId64 "] cf_recv(len=%zu) -> %zd, %d",
-              stream? stream->id : -1, len, nread, *err);
-  CF_DATA_RESTORE(cf, save);
-  return nread;
-}
-
-static int cb_h3_acked_req_body(nghttp3_conn *conn, int64_t stream_id,
-                                uint64_t datalen, void *user_data,
-                                void *stream_user_data)
-{
-  struct Curl_cfilter *cf = user_data;
-  struct Curl_easy *data = stream_user_data;
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(data);
-  size_t skiplen;
-
-  (void)cf;
-  if(!stream)
-    return 0;
-  /* The server acknowledged `datalen` of bytes from our request body.
-   * This is a delta. We have kept this data in `sendbuf` for
-   * re-transmissions and can free it now. */
-  if(datalen >= (uint64_t)stream->sendbuf_len_in_flight)
-    skiplen = stream->sendbuf_len_in_flight;
-  else
-    skiplen = (size_t)datalen;
-  Curl_bufq_skip(&stream->sendbuf, skiplen);
-  stream->sendbuf_len_in_flight -= skiplen;
-
-  /* Everything ACKed, we resume upload processing */
-  if(!stream->sendbuf_len_in_flight) {
-    int rv = nghttp3_conn_resume_stream(conn, stream_id);
-    if(rv) {
-      return NGTCP2_ERR_CALLBACK_FAILURE;
-    }
-    if((data->req.keepon & KEEP_SEND_HOLD) &&
-       (data->req.keepon & KEEP_SEND)) {
-      data->req.keepon &= ~KEEP_SEND_HOLD;
-      h3_drain_stream(cf, data);
-      CURL_TRC_CF(data, cf, "[%" PRId64 "] unpausing acks", stream_id);
-    }
-  }
-  return 0;
-}
-
-static nghttp3_ssize
-cb_h3_read_req_body(nghttp3_conn *conn, int64_t stream_id,
-                    nghttp3_vec *vec, size_t veccnt,
-                    uint32_t *pflags, void *user_data,
-                    void *stream_user_data)
-{
-  struct Curl_cfilter *cf = user_data;
-  struct Curl_easy *data = stream_user_data;
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(data);
-  ssize_t nwritten = 0;
-  size_t nvecs = 0;
-  (void)cf;
-  (void)conn;
-  (void)stream_id;
-  (void)user_data;
-  (void)veccnt;
-
-  if(!stream)
-    return NGHTTP3_ERR_CALLBACK_FAILURE;
-  /* nghttp3 keeps references to the sendbuf data until it is ACKed
-   * by the server (see `cb_h3_acked_req_body()` for updates).
-   * `sendbuf_len_in_flight` is the amount of bytes in `sendbuf`
-   * that we have already passed to nghttp3, but which have not been
-   * ACKed yet.
-   * Any amount beyond `sendbuf_len_in_flight` we need still to pass
-   * to nghttp3. Do that now, if we can. */
-  if(stream->sendbuf_len_in_flight < Curl_bufq_len(&stream->sendbuf)) {
-    nvecs = 0;
-    while(nvecs < veccnt &&
-          Curl_bufq_peek_at(&stream->sendbuf,
-                            stream->sendbuf_len_in_flight,
-                            (const unsigned char **)&vec[nvecs].base,
-                            &vec[nvecs].len)) {
-      stream->sendbuf_len_in_flight += vec[nvecs].len;
-      nwritten += vec[nvecs].len;
-      ++nvecs;
-    }
-    DEBUGASSERT(nvecs > 0); /* we SHOULD have been be able to peek */
-  }
-
-  if(nwritten > 0 && stream->upload_left != -1)
-    stream->upload_left -= nwritten;
-
-  /* When we stopped sending and everything in `sendbuf` is "in flight",
-   * we are at the end of the request body. */
-  if(stream->upload_left == 0) {
-    *pflags = NGHTTP3_DATA_FLAG_EOF;
-    stream->send_closed = TRUE;
-  }
-  else if(!nwritten) {
-    /* Not EOF, and nothing to give, we signal WOULDBLOCK. */
-    CURL_TRC_CF(data, cf, "[%" PRId64 "] read req body -> AGAIN",
-                stream->id);
-    return NGHTTP3_ERR_WOULDBLOCK;
-  }
-
-  CURL_TRC_CF(data, cf, "[%" PRId64 "] read req body -> "
-              "%d vecs%s with %zu (buffered=%zu, left=%"
-              CURL_FORMAT_CURL_OFF_T ")",
-              stream->id, (int)nvecs,
-              *pflags == NGHTTP3_DATA_FLAG_EOF?" EOF":"",
-              nwritten, Curl_bufq_len(&stream->sendbuf),
-              stream->upload_left);
-  return (nghttp3_ssize)nvecs;
-}
-
-/* Index where :authority header field will appear in request header
-   field list. */
-#define AUTHORITY_DST_IDX 3
-
-static ssize_t h3_stream_open(struct Curl_cfilter *cf,
-                              struct Curl_easy *data,
-                              const void *buf, size_t len,
-                              CURLcode *err)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  struct h3_stream_ctx *stream = NULL;
-  struct dynhds h2_headers;
-  size_t nheader;
-  nghttp3_nv *nva = NULL;
-  int rc = 0;
-  unsigned int i;
-  ssize_t nwritten = -1;
-  nghttp3_data_reader reader;
-  nghttp3_data_reader *preader = NULL;
-
-  Curl_dynhds_init(&h2_headers, 0, DYN_HTTP_REQUEST);
-
-  *err = h3_data_setup(cf, data);
-  if(*err)
-    goto out;
-  stream = H3_STREAM_CTX(data);
-  DEBUGASSERT(stream);
-
-  nwritten = Curl_h1_req_parse_read(&stream->h1, buf, len, NULL, 0, err);
-  if(nwritten < 0)
-    goto out;
-  if(!stream->h1.done) {
-    /* need more data */
-    goto out;
-  }
-  DEBUGASSERT(stream->h1.req);
-
-  *err = Curl_http_req_to_h2(&h2_headers, stream->h1.req, data);
-  if(*err) {
-    nwritten = -1;
-    goto out;
-  }
-  /* no longer needed */
-  Curl_h1_req_parse_free(&stream->h1);
-
-  nheader = Curl_dynhds_count(&h2_headers);
-  nva = malloc(sizeof(nghttp3_nv) * nheader);
-  if(!nva) {
-    *err = CURLE_OUT_OF_MEMORY;
-    nwritten = -1;
-    goto out;
-  }
-
-  for(i = 0; i < nheader; ++i) {
-    struct dynhds_entry *e = Curl_dynhds_getn(&h2_headers, i);
-    nva[i].name = (unsigned char *)e->name;
-    nva[i].namelen = e->namelen;
-    nva[i].value = (unsigned char *)e->value;
-    nva[i].valuelen = e->valuelen;
-    nva[i].flags = NGHTTP3_NV_FLAG_NONE;
-  }
-
-  rc = ngtcp2_conn_open_bidi_stream(ctx->qconn, &stream->id, NULL);
-  if(rc) {
-    failf(data, "can get bidi streams");
-    *err = CURLE_SEND_ERROR;
-    goto out;
-  }
-
-  switch(data->state.httpreq) {
-  case HTTPREQ_POST:
-  case HTTPREQ_POST_FORM:
-  case HTTPREQ_POST_MIME:
-  case HTTPREQ_PUT:
-    /* known request body size or -1 */
-    if(data->state.infilesize != -1)
-      stream->upload_left = data->state.infilesize;
-    else
-      /* data sending without specifying the data amount up front */
-      stream->upload_left = -1; /* unknown */
-    break;
-  default:
-    /* there is not request body */
-    stream->upload_left = 0; /* no request body */
-    break;
-  }
-
-  stream->send_closed = (stream->upload_left == 0);
-  if(!stream->send_closed) {
-    reader.read_data = cb_h3_read_req_body;
-    preader = &reader;
-  }
-
-  rc = nghttp3_conn_submit_request(ctx->h3conn, stream->id,
-                                   nva, nheader, preader, data);
-  if(rc) {
-    switch(rc) {
-    case NGHTTP3_ERR_CONN_CLOSING:
-      CURL_TRC_CF(data, cf, "h3sid[%"PRId64"] failed to send, "
-                  "connection is closing", stream->id);
-      break;
-    default:
-      CURL_TRC_CF(data, cf, "h3sid[%"PRId64"] failed to send -> %d (%s)",
-                  stream->id, rc, ngtcp2_strerror(rc));
-      break;
-    }
-    *err = CURLE_SEND_ERROR;
-    nwritten = -1;
-    goto out;
-  }
-
-  if(Curl_trc_is_verbose(data)) {
-    infof(data, "[HTTP/3] [%" PRId64 "] OPENED stream for %s",
-          stream->id, data->state.url);
-    for(i = 0; i < nheader; ++i) {
-      infof(data, "[HTTP/3] [%" PRId64 "] [%.*s: %.*s]", stream->id,
-            (int)nva[i].namelen, nva[i].name,
-            (int)nva[i].valuelen, nva[i].value);
-    }
-  }
-
-out:
-  free(nva);
-  Curl_dynhds_free(&h2_headers);
-  return nwritten;
-}
-
-static ssize_t cf_ngtcp2_send(struct Curl_cfilter *cf, struct Curl_easy *data,
-                              const void *buf, size_t len, CURLcode *err)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(data);
-  ssize_t sent = 0;
-  struct cf_call_data save;
-  struct pkt_io_ctx pktx;
-  CURLcode result;
-
-  CF_DATA_SAVE(save, cf, data);
-  DEBUGASSERT(cf->connected);
-  DEBUGASSERT(ctx->qconn);
-  DEBUGASSERT(ctx->h3conn);
-  pktx_init(&pktx, cf, data);
-  *err = CURLE_OK;
-
-  result = cf_progress_ingress(cf, data, &pktx);
-  if(result) {
-    *err = result;
-    sent = -1;
-  }
-
-  if(!stream || stream->id < 0) {
-    sent = h3_stream_open(cf, data, buf, len, err);
-    if(sent < 0) {
-      CURL_TRC_CF(data, cf, "failed to open stream -> %d", *err);
-      goto out;
-    }
-    stream = H3_STREAM_CTX(data);
-  }
-  else if(stream->upload_blocked_len) {
-    /* the data in `buf` has already been submitted or added to the
-     * buffers, but have been EAGAINed on the last invocation. */
-    DEBUGASSERT(len >= stream->upload_blocked_len);
-    if(len < stream->upload_blocked_len) {
-      /* Did we get called again with a smaller `len`? This should not
-       * happen. We are not prepared to handle that. */
-      failf(data, "HTTP/3 send again with decreased length");
-      *err = CURLE_HTTP3;
-      sent = -1;
-      goto out;
-    }
-    sent = (ssize_t)stream->upload_blocked_len;
-    stream->upload_blocked_len = 0;
-  }
-  else if(stream->closed) {
-    if(stream->resp_hds_complete) {
-      /* Server decided to close the stream after having sent us a final
-       * response. This is valid if it is not interested in the request
-       * body. This happens on 30x or 40x responses.
-       * We silently discard the data sent, since this is not a transport
-       * error situation. */
-      CURL_TRC_CF(data, cf, "[%" PRId64 "] discarding data"
-                  "on closed stream with response", stream->id);
-      *err = CURLE_OK;
-      sent = (ssize_t)len;
-      goto out;
-    }
-    *err = CURLE_HTTP3;
-    sent = -1;
-    goto out;
-  }
-  else {
-    sent = Curl_bufq_write(&stream->sendbuf, buf, len, err);
-    CURL_TRC_CF(data, cf, "[%" PRId64 "] cf_send, add to "
-                "sendbuf(len=%zu) -> %zd, %d",
-                stream->id, len, sent, *err);
-    if(sent < 0) {
-      goto out;
-    }
-
-    (void)nghttp3_conn_resume_stream(ctx->h3conn, stream->id);
-  }
-
-  result = cf_progress_egress(cf, data, &pktx);
-  if(result) {
-    *err = result;
-    sent = -1;
-  }
-
-  if(stream && sent > 0 && stream->sendbuf_len_in_flight) {
-    /* We have unacknowledged DATA and cannot report success to our
-     * caller. Instead we EAGAIN and remember how much we have already
-     * "written" into our various internal connection buffers.
-     * We put the stream upload on HOLD, until this gets ACKed. */
-    stream->upload_blocked_len = sent;
-    CURL_TRC_CF(data, cf, "[%" PRId64 "] cf_send(len=%zu), "
-                "%zu bytes in flight -> EGAIN", stream->id, len,
-                stream->sendbuf_len_in_flight);
-    *err = CURLE_AGAIN;
-    sent = -1;
-    data->req.keepon |= KEEP_SEND_HOLD;
-  }
-
-out:
-  result = check_and_set_expiry(cf, data, &pktx);
-  if(result) {
-    *err = result;
-    sent = -1;
-  }
-  CURL_TRC_CF(data, cf, "[%" PRId64 "] cf_send(len=%zu) -> %zd, %d",
-              stream? stream->id : -1, len, sent, *err);
-  CF_DATA_RESTORE(cf, save);
-  return sent;
-}
-
-static CURLcode qng_verify_peer(struct Curl_cfilter *cf,
-                                struct Curl_easy *data)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  CURLcode result = CURLE_OK;
-  const char *hostname, *disp_hostname;
-  int port;
-  char *snihost;
-
-  Curl_conn_get_host(data, cf->sockindex, &hostname, &disp_hostname, &port);
-  snihost = Curl_ssl_snihost(data, hostname, NULL);
-  if(!snihost)
-    return CURLE_PEER_FAILED_VERIFICATION;
-
-  cf->conn->bits.multiplex = TRUE; /* at least potentially multiplexed */
-  cf->conn->httpversion = 30;
-  cf->conn->bundle->multiuse = BUNDLE_MULTIPLEX;
-
-  if(cf->conn->ssl_config.verifyhost) {
-#ifdef USE_OPENSSL
-    X509 *server_cert;
-    server_cert = SSL_get_peer_certificate(ctx->ssl);
-    if(!server_cert) {
-      return CURLE_PEER_FAILED_VERIFICATION;
-    }
-    result = Curl_ossl_verifyhost(data, cf->conn, server_cert);
-    X509_free(server_cert);
-    if(result)
-      return result;
-#elif defined(USE_GNUTLS)
-    result = Curl_gtls_verifyserver(data, ctx->gtls->session,
-                                    &cf->conn->ssl_config, &data->set.ssl,
-                                    hostname, disp_hostname,
-                                    data->set.str[STRING_SSL_PINNEDPUBLICKEY]);
-    if(result)
-      return result;
-#elif defined(USE_WOLFSSL)
-    if(wolfSSL_check_domain_name(ctx->ssl, snihost) == SSL_FAILURE)
-      return CURLE_PEER_FAILED_VERIFICATION;
-#endif
-    infof(data, "Verified certificate just fine");
-  }
-  else
-    infof(data, "Skipped certificate verification");
-#ifdef USE_OPENSSL
-  if(data->set.ssl.certinfo)
-    /* asked to gather certificate info */
-    (void)Curl_ossl_certchain(data, ctx->ssl);
-#endif
-  return result;
-}
-
-static CURLcode recv_pkt(const unsigned char *pkt, size_t pktlen,
-                         struct sockaddr_storage *remote_addr,
-                         socklen_t remote_addrlen, int ecn,
-                         void *userp)
-{
-  struct pkt_io_ctx *pktx = userp;
-  struct cf_ngtcp2_ctx *ctx = pktx->cf->ctx;
-  ngtcp2_pkt_info pi;
-  ngtcp2_path path;
-  int rv;
-
-  ++pktx->pkt_count;
-  ngtcp2_addr_init(&path.local, (struct sockaddr *)&ctx->q.local_addr,
-                   ctx->q.local_addrlen);
-  ngtcp2_addr_init(&path.remote, (struct sockaddr *)remote_addr,
-                   remote_addrlen);
-  pi.ecn = (uint8_t)ecn;
-
-  rv = ngtcp2_conn_read_pkt(ctx->qconn, &path, &pi, pkt, pktlen, pktx->ts);
-  if(rv) {
-    CURL_TRC_CF(pktx->data, pktx->cf, "ingress, read_pkt -> %s",
-                ngtcp2_strerror(rv));
-    if(!ctx->last_error.error_code) {
-      if(rv == NGTCP2_ERR_CRYPTO) {
-        ngtcp2_ccerr_set_tls_alert(&ctx->last_error,
-                                   ngtcp2_conn_get_tls_alert(ctx->qconn),
-                                   NULL, 0);
-      }
-      else {
-        ngtcp2_ccerr_set_liberr(&ctx->last_error, rv, NULL, 0);
-      }
-    }
-
-    if(rv == NGTCP2_ERR_CRYPTO)
-      /* this is a "TLS problem", but a failed certificate verification
-         is a common reason for this */
-      return CURLE_PEER_FAILED_VERIFICATION;
-    return CURLE_RECV_ERROR;
-  }
-
-  return CURLE_OK;
-}
-
-static CURLcode cf_progress_ingress(struct Curl_cfilter *cf,
-                                    struct Curl_easy *data,
-                                    struct pkt_io_ctx *pktx)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  struct pkt_io_ctx local_pktx;
-  size_t pkts_chunk = 128, i;
-  size_t pkts_max = 10 * pkts_chunk;
-  CURLcode result = CURLE_OK;
-
-  if(!pktx) {
-    pktx_init(&local_pktx, cf, data);
-    pktx = &local_pktx;
-  }
-  else {
-    pktx->ts = timestamp();
-  }
-
-#ifdef USE_OPENSSL
-  if(!ctx->x509_store_setup) {
-    result = Curl_ssl_setup_x509_store(cf, data, ctx->sslctx);
-    if(result)
-      return result;
-    ctx->x509_store_setup = TRUE;
-  }
-#endif
-
-  for(i = 0; i < pkts_max; i += pkts_chunk) {
-    pktx->pkt_count = 0;
-    result = vquic_recv_packets(cf, data, &ctx->q, pkts_chunk,
-                                recv_pkt, pktx);
-    if(result) /* error */
-      break;
-    if(pktx->pkt_count < pkts_chunk) /* got less than we could */
-      break;
-    /* give egress a chance before we receive more */
-    result = cf_progress_egress(cf, data, pktx);
-    if(result) /* error */
-      break;
-  }
-  return result;
-}
-
-/**
- * Read a network packet to send from ngtcp2 into `buf`.
- * Return number of bytes written or -1 with *err set.
- */
-static ssize_t read_pkt_to_send(void *userp,
-                                unsigned char *buf, size_t buflen,
-                                CURLcode *err)
-{
-  struct pkt_io_ctx *x = userp;
-  struct cf_ngtcp2_ctx *ctx = x->cf->ctx;
-  nghttp3_vec vec[16];
-  nghttp3_ssize veccnt;
-  ngtcp2_ssize ndatalen;
-  uint32_t flags;
-  int64_t stream_id;
-  int fin;
-  ssize_t nwritten, n;
-  veccnt = 0;
-  stream_id = -1;
-  fin = 0;
-
-  /* ngtcp2 may want to put several frames from different streams into
-   * this packet. `NGTCP2_WRITE_STREAM_FLAG_MORE` tells it to do so.
-   * When `NGTCP2_ERR_WRITE_MORE` is returned, we *need* to make
-   * another iteration.
-   * When ngtcp2 is happy (because it has no other frame that would fit
-   * or it has nothing more to send), it returns the total length
-   * of the assembled packet. This may be 0 if there was nothing to send. */
-  nwritten = 0;
-  *err = CURLE_OK;
-  for(;;) {
-
-    if(ctx->h3conn && ngtcp2_conn_get_max_data_left(ctx->qconn)) {
-      veccnt = nghttp3_conn_writev_stream(ctx->h3conn, &stream_id, &fin, vec,
-                                          sizeof(vec) / sizeof(vec[0]));
-      if(veccnt < 0) {
-        failf(x->data, "nghttp3_conn_writev_stream returned error: %s",
-              nghttp3_strerror((int)veccnt));
-        ngtcp2_ccerr_set_application_error(
-          &ctx->last_error,
-          nghttp3_err_infer_quic_app_error_code((int)veccnt), NULL, 0);
-        *err = CURLE_SEND_ERROR;
-        return -1;
-      }
-    }
-
-    flags = NGTCP2_WRITE_STREAM_FLAG_MORE |
-            (fin ? NGTCP2_WRITE_STREAM_FLAG_FIN : 0);
-    n = ngtcp2_conn_writev_stream(ctx->qconn, &x->ps.path,
-                                  NULL, buf, buflen,
-                                  &ndatalen, flags, stream_id,
-                                  (const ngtcp2_vec *)vec, veccnt, x->ts);
-    if(n == 0) {
-      /* nothing to send */
-      *err = CURLE_AGAIN;
-      nwritten = -1;
-      goto out;
-    }
-    else if(n < 0) {
-      switch(n) {
-      case NGTCP2_ERR_STREAM_DATA_BLOCKED:
-        DEBUGASSERT(ndatalen == -1);
-        nghttp3_conn_block_stream(ctx->h3conn, stream_id);
-        n = 0;
-        break;
-      case NGTCP2_ERR_STREAM_SHUT_WR:
-        DEBUGASSERT(ndatalen == -1);
-        nghttp3_conn_shutdown_stream_write(ctx->h3conn, stream_id);
-        n = 0;
-        break;
-      case NGTCP2_ERR_WRITE_MORE:
-        /* ngtcp2 wants to send more. update the flow of the stream whose data
-         * is in the buffer and continue */
-        DEBUGASSERT(ndatalen >= 0);
-        n = 0;
-        break;
-      default:
-        DEBUGASSERT(ndatalen == -1);
-        failf(x->data, "ngtcp2_conn_writev_stream returned error: %s",
-              ngtcp2_strerror((int)n));
-        ngtcp2_ccerr_set_liberr(&ctx->last_error, (int)n, NULL, 0);
-        *err = CURLE_SEND_ERROR;
-        nwritten = -1;
-        goto out;
-      }
-    }
-
-    if(ndatalen >= 0) {
-      /* we add the amount of data bytes to the flow windows */
-      int rv = nghttp3_conn_add_write_offset(ctx->h3conn, stream_id, ndatalen);
-      if(rv) {
-        failf(x->data, "nghttp3_conn_add_write_offset returned error: %s\n",
-              nghttp3_strerror(rv));
-        return CURLE_SEND_ERROR;
-      }
-    }
-
-    if(n > 0) {
-      /* packet assembled, leave */
-      nwritten = n;
-      goto out;
-    }
-  }
-out:
-  return nwritten;
-}
-
-static CURLcode cf_progress_egress(struct Curl_cfilter *cf,
-                                   struct Curl_easy *data,
-                                   struct pkt_io_ctx *pktx)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  ssize_t nread;
-  size_t max_payload_size, path_max_payload_size, max_pktcnt;
-  size_t pktcnt = 0;
-  size_t gsolen = 0;  /* this disables gso until we have a clue */
-  CURLcode curlcode;
-  struct pkt_io_ctx local_pktx;
-
-  if(!pktx) {
-    pktx_init(&local_pktx, cf, data);
-    pktx = &local_pktx;
-  }
-  else {
-    pktx->ts = timestamp();
-    ngtcp2_path_storage_zero(&pktx->ps);
-  }
-
-  curlcode = vquic_flush(cf, data, &ctx->q);
-  if(curlcode) {
-    if(curlcode == CURLE_AGAIN) {
-      Curl_expire(data, 1, EXPIRE_QUIC);
-      return CURLE_OK;
-    }
-    return curlcode;
-  }
-
-  /* In UDP, there is a maximum theoretical packet paload length and
-   * a minimum payload length that is "guarantueed" to work.
-   * To detect if this minimum payload can be increased, ngtcp2 sends
-   * now and then a packet payload larger than the minimum. It that
-   * is ACKed by the peer, both parties know that it works and
-   * the subsequent packets can use a larger one.
-   * This is called PMTUD (Path Maximum Transmission Unit Discovery).
-   * Since a PMTUD might be rejected right on send, we do not want it
-   * be followed by other packets of lesser size. Because those would
-   * also fail then. So, if we detect a PMTUD while buffering, we flush.
-   */
-  max_payload_size = ngtcp2_conn_get_max_tx_udp_payload_size(ctx->qconn);
-  path_max_payload_size =
-      ngtcp2_conn_get_path_max_tx_udp_payload_size(ctx->qconn);
-  /* maximum number of packets buffered before we flush to the socket */
-  max_pktcnt = CURLMIN(MAX_PKT_BURST,
-                       ctx->q.sendbuf.chunk_size / max_payload_size);
-
-  for(;;) {
-    /* add the next packet to send, if any, to our buffer */
-    nread = Curl_bufq_sipn(&ctx->q.sendbuf, max_payload_size,
-                           read_pkt_to_send, pktx, &curlcode);
-    if(nread < 0) {
-      if(curlcode != CURLE_AGAIN)
-        return curlcode;
-      /* Nothing more to add, flush and leave */
-      curlcode = vquic_send(cf, data, &ctx->q, gsolen);
-      if(curlcode) {
-        if(curlcode == CURLE_AGAIN) {
-          Curl_expire(data, 1, EXPIRE_QUIC);
-          return CURLE_OK;
-        }
-        return curlcode;
-      }
-      goto out;
-    }
-
-    DEBUGASSERT(nread > 0);
-    if(pktcnt == 0) {
-      /* first packet in buffer. This is either of a known, "good"
-       * payload size or it is a PMTUD. We'll see. */
-      gsolen = (size_t)nread;
-    }
-    else if((size_t)nread > gsolen ||
-            (gsolen > path_max_payload_size && (size_t)nread != gsolen)) {
-      /* The just added packet is a PMTUD *or* the one(s) before the
-       * just added were PMTUD and the last one is smaller.
-       * Flush the buffer before the last add. */
-      curlcode = vquic_send_tail_split(cf, data, &ctx->q,
-                                       gsolen, nread, nread);
-      if(curlcode) {
-        if(curlcode == CURLE_AGAIN) {
-          Curl_expire(data, 1, EXPIRE_QUIC);
-          return CURLE_OK;
-        }
-        return curlcode;
-      }
-      pktcnt = 0;
-      continue;
-    }
-
-    if(++pktcnt >= max_pktcnt || (size_t)nread < gsolen) {
-      /* Reached MAX_PKT_BURST *or*
-       * the capacity of our buffer *or*
-       * last add was shorter than the previous ones, flush */
-      curlcode = vquic_send(cf, data, &ctx->q, gsolen);
-      if(curlcode) {
-        if(curlcode == CURLE_AGAIN) {
-          Curl_expire(data, 1, EXPIRE_QUIC);
-          return CURLE_OK;
-        }
-        return curlcode;
-      }
-      /* pktbuf has been completely sent */
-      pktcnt = 0;
-    }
-  }
-
-out:
-  return CURLE_OK;
-}
-
-/*
- * Called from transfer.c:data_pending to know if we should keep looping
- * to receive more data from the connection.
- */
-static bool cf_ngtcp2_data_pending(struct Curl_cfilter *cf,
-                                   const struct Curl_easy *data)
-{
-  const struct h3_stream_ctx *stream = H3_STREAM_CTX(data);
-  (void)cf;
-  return stream && !Curl_bufq_is_empty(&stream->recvbuf);
-}
-
-static CURLcode h3_data_pause(struct Curl_cfilter *cf,
-                              struct Curl_easy *data,
-                              bool pause)
-{
-  /* TODO: there seems right now no API in ngtcp2 to shrink/enlarge
-   * the streams windows. As we do in HTTP/2. */
-  if(!pause) {
-    h3_drain_stream(cf, data);
-    Curl_expire(data, 0, EXPIRE_RUN_NOW);
-  }
-  return CURLE_OK;
-}
-
-static CURLcode cf_ngtcp2_data_event(struct Curl_cfilter *cf,
-                                     struct Curl_easy *data,
-                                     int event, int arg1, void *arg2)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  CURLcode result = CURLE_OK;
-  struct cf_call_data save;
-
-  CF_DATA_SAVE(save, cf, data);
-  (void)arg1;
-  (void)arg2;
-  switch(event) {
-  case CF_CTRL_DATA_SETUP:
-    break;
-  case CF_CTRL_DATA_PAUSE:
-    result = h3_data_pause(cf, data, (arg1 != 0));
-    break;
-  case CF_CTRL_DATA_DONE: {
-    h3_data_done(cf, data);
-    break;
-  }
-  case CF_CTRL_DATA_DONE_SEND: {
-    struct h3_stream_ctx *stream = H3_STREAM_CTX(data);
-    if(stream && !stream->send_closed) {
-      stream->send_closed = TRUE;
-      stream->upload_left = Curl_bufq_len(&stream->sendbuf);
-      (void)nghttp3_conn_resume_stream(ctx->h3conn, stream->id);
-    }
-    break;
-  }
-  case CF_CTRL_DATA_IDLE: {
-    struct h3_stream_ctx *stream = H3_STREAM_CTX(data);
-    CURL_TRC_CF(data, cf, "data idle");
-    if(stream && !stream->closed) {
-      result = check_and_set_expiry(cf, data, NULL);
-      if(result)
-        CURL_TRC_CF(data, cf, "data idle, check_and_set_expiry -> %d", result);
-    }
-    break;
-  }
-  default:
-    break;
-  }
-  CF_DATA_RESTORE(cf, save);
-  return result;
-}
-
-static void cf_ngtcp2_ctx_clear(struct cf_ngtcp2_ctx *ctx)
-{
-  struct cf_call_data save = ctx->call_data;
-
-  if(ctx->qlogfd != -1) {
-    close(ctx->qlogfd);
-  }
-#ifdef USE_OPENSSL
-  if(ctx->ssl)
-    SSL_free(ctx->ssl);
-  if(ctx->sslctx)
-    SSL_CTX_free(ctx->sslctx);
-#elif defined(USE_GNUTLS)
-  if(ctx->gtls) {
-    if(ctx->gtls->cred)
-      gnutls_certificate_free_credentials(ctx->gtls->cred);
-    if(ctx->gtls->session)
-      gnutls_deinit(ctx->gtls->session);
-    free(ctx->gtls);
-  }
-#elif defined(USE_WOLFSSL)
-  if(ctx->ssl)
-    wolfSSL_free(ctx->ssl);
-  if(ctx->sslctx)
-    wolfSSL_CTX_free(ctx->sslctx);
-#endif
-  vquic_ctx_free(&ctx->q);
-  if(ctx->h3conn)
-    nghttp3_conn_del(ctx->h3conn);
-  if(ctx->qconn)
-    ngtcp2_conn_del(ctx->qconn);
-  Curl_bufcp_free(&ctx->stream_bufcp);
-
-  memset(ctx, 0, sizeof(*ctx));
-  ctx->qlogfd = -1;
-  ctx->call_data = save;
-}
-
-static void cf_ngtcp2_close(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  struct cf_call_data save;
-
-  CF_DATA_SAVE(save, cf, data);
-  if(ctx && ctx->qconn) {
-    char buffer[NGTCP2_MAX_UDP_PAYLOAD_SIZE];
-    ngtcp2_tstamp ts;
-    ngtcp2_ssize rc;
-
-    CURL_TRC_CF(data, cf, "close");
-    ts = timestamp();
-    rc = ngtcp2_conn_write_connection_close(ctx->qconn, NULL, /* path */
-                                            NULL, /* pkt_info */
-                                            (uint8_t *)buffer, sizeof(buffer),
-                                            &ctx->last_error, ts);
-    if(rc > 0) {
-      while((send(ctx->q.sockfd, buffer, (SEND_TYPE_ARG3)rc, 0) == -1) &&
-            SOCKERRNO == EINTR);
-    }
-
-    cf_ngtcp2_ctx_clear(ctx);
-  }
-
-  cf->connected = FALSE;
-  CF_DATA_RESTORE(cf, save);
-}
-
-static void cf_ngtcp2_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  struct cf_call_data save;
-
-  CF_DATA_SAVE(save, cf, data);
-  CURL_TRC_CF(data, cf, "destroy");
-  if(ctx) {
-    cf_ngtcp2_ctx_clear(ctx);
-    free(ctx);
-  }
-  cf->ctx = NULL;
-  /* No CF_DATA_RESTORE(cf, save) possible */
-  (void)save;
-}
-
-/*
- * Might be called twice for happy eyeballs.
- */
-static CURLcode cf_connect_start(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data,
-                                 struct pkt_io_ctx *pktx)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  int rc;
-  int rv;
-  CURLcode result;
-  const struct Curl_sockaddr_ex *sockaddr = NULL;
-  int qfd;
-
-  ctx->version = NGTCP2_PROTO_VER_MAX;
-  ctx->max_stream_window = H3_STREAM_WINDOW_SIZE;
-  Curl_bufcp_init(&ctx->stream_bufcp, H3_STREAM_CHUNK_SIZE,
-                  H3_STREAM_POOL_SPARES);
-
-#ifdef USE_OPENSSL
-  result = quic_ssl_ctx(&ctx->sslctx, cf, data);
-  if(result)
-    return result;
-
-  result = quic_set_client_cert(cf, data);
-  if(result)
-    return result;
-#elif defined(USE_WOLFSSL)
-  result = quic_ssl_ctx(&ctx->sslctx, cf, data);
-  if(result)
-    return result;
-#endif
-
-  result = quic_init_ssl(cf, data);
-  if(result)
-    return result;
-
-  ctx->dcid.datalen = NGTCP2_MAX_CIDLEN;
-  result = Curl_rand(data, ctx->dcid.data, NGTCP2_MAX_CIDLEN);
-  if(result)
-    return result;
-
-  ctx->scid.datalen = NGTCP2_MAX_CIDLEN;
-  result = Curl_rand(data, ctx->scid.data, NGTCP2_MAX_CIDLEN);
-  if(result)
-    return result;
-
-  (void)Curl_qlogdir(data, ctx->scid.data, NGTCP2_MAX_CIDLEN, &qfd);
-  ctx->qlogfd = qfd; /* -1 if failure above */
-  quic_settings(ctx, data, pktx);
-
-  result = vquic_ctx_init(&ctx->q);
-  if(result)
-    return result;
-
-  Curl_cf_socket_peek(cf->next, data, &ctx->q.sockfd,
-                      &sockaddr, NULL, NULL, NULL, NULL);
-  if(!sockaddr)
-    return CURLE_QUIC_CONNECT_ERROR;
-  ctx->q.local_addrlen = sizeof(ctx->q.local_addr);
-  rv = getsockname(ctx->q.sockfd, (struct sockaddr *)&ctx->q.local_addr,
-                   &ctx->q.local_addrlen);
-  if(rv == -1)
-    return CURLE_QUIC_CONNECT_ERROR;
-
-  ngtcp2_addr_init(&ctx->connected_path.local,
-                   (struct sockaddr *)&ctx->q.local_addr,
-                   ctx->q.local_addrlen);
-  ngtcp2_addr_init(&ctx->connected_path.remote,
-                   &sockaddr->sa_addr, sockaddr->addrlen);
-
-  rc = ngtcp2_conn_client_new(&ctx->qconn, &ctx->dcid, &ctx->scid,
-                              &ctx->connected_path,
-                              NGTCP2_PROTO_VER_V1, &ng_callbacks,
-                              &ctx->settings, &ctx->transport_params,
-                              NULL, cf);
-  if(rc)
-    return CURLE_QUIC_CONNECT_ERROR;
-
-#ifdef USE_GNUTLS
-  ngtcp2_conn_set_tls_native_handle(ctx->qconn, ctx->gtls->session);
-#else
-  ngtcp2_conn_set_tls_native_handle(ctx->qconn, ctx->ssl);
-#endif
-
-  ngtcp2_ccerr_default(&ctx->last_error);
-
-  ctx->conn_ref.get_conn = get_conn;
-  ctx->conn_ref.user_data = cf;
-
-  return CURLE_OK;
-}
-
-static CURLcode cf_ngtcp2_connect(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  bool blocking, bool *done)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  CURLcode result = CURLE_OK;
-  struct cf_call_data save;
-  struct curltime now;
-  struct pkt_io_ctx pktx;
-
-  if(cf->connected) {
-    *done = TRUE;
-    return CURLE_OK;
-  }
-
-  /* Connect the UDP filter first */
-  if(!cf->next->connected) {
-    result = Curl_conn_cf_connect(cf->next, data, blocking, done);
-    if(result || !*done)
-      return result;
-  }
-
-  *done = FALSE;
-  now = Curl_now();
-  pktx_init(&pktx, cf, data);
-
-  CF_DATA_SAVE(save, cf, data);
-
-  if(ctx->reconnect_at.tv_sec && Curl_timediff(now, ctx->reconnect_at) < 0) {
-    /* Not time yet to attempt the next connect */
-    CURL_TRC_CF(data, cf, "waiting for reconnect time");
-    goto out;
-  }
-
-  if(!ctx->qconn) {
-    ctx->started_at = now;
-    result = cf_connect_start(cf, data, &pktx);
-    if(result)
-      goto out;
-    result = cf_progress_egress(cf, data, &pktx);
-    /* we do not expect to be able to recv anything yet */
-    goto out;
-  }
-
-  result = cf_progress_ingress(cf, data, &pktx);
-  if(result)
-    goto out;
-
-  result = cf_progress_egress(cf, data, &pktx);
-  if(result)
-    goto out;
-
-  if(ngtcp2_conn_get_handshake_completed(ctx->qconn)) {
-    ctx->handshake_at = now;
-    CURL_TRC_CF(data, cf, "handshake complete after %dms",
-               (int)Curl_timediff(now, ctx->started_at));
-    result = qng_verify_peer(cf, data);
-    if(!result) {
-      CURL_TRC_CF(data, cf, "peer verified");
-      cf->connected = TRUE;
-      cf->conn->alpn = CURL_HTTP_VERSION_3;
-      *done = TRUE;
-      connkeep(cf->conn, "HTTP/3 default");
-    }
-  }
-
-out:
-  if(result == CURLE_RECV_ERROR && ctx->qconn &&
-     ngtcp2_conn_in_draining_period(ctx->qconn)) {
-    /* When a QUIC server instance is shutting down, it may send us a
-     * CONNECTION_CLOSE right away. Our connection then enters the DRAINING
-     * state.
-     * This may be a stopping of the service or it may be that the server
-     * is reloading and a new instance will start serving soon.
-     * In any case, we tear down our socket and start over with a new one.
-     * We re-open the underlying UDP cf right now, but do not start
-     * connecting until called again.
-     */
-    int reconn_delay_ms = 200;
-
-    CURL_TRC_CF(data, cf, "connect, remote closed, reconnect after %dms",
-                reconn_delay_ms);
-    Curl_conn_cf_close(cf->next, data);
-    cf_ngtcp2_ctx_clear(ctx);
-    result = Curl_conn_cf_connect(cf->next, data, FALSE, done);
-    if(!result && *done) {
-      *done = FALSE;
-      ctx->reconnect_at = now;
-      ctx->reconnect_at.tv_usec += reconn_delay_ms * 1000;
-      Curl_expire(data, reconn_delay_ms, EXPIRE_QUIC);
-      result = CURLE_OK;
-    }
-  }
-
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-  if(result) {
-    const char *r_ip = NULL;
-    int r_port = 0;
-
-    Curl_cf_socket_peek(cf->next, data, NULL, NULL,
-                        &r_ip, &r_port, NULL, NULL);
-    infof(data, "QUIC connect to %s port %u failed: %s",
-          r_ip, r_port, curl_easy_strerror(result));
-  }
-#endif
-  if(!result && ctx->qconn) {
-    result = check_and_set_expiry(cf, data, &pktx);
-  }
-  if(result || *done)
-    CURL_TRC_CF(data, cf, "connect -> %d, done=%d", result, *done);
-  CF_DATA_RESTORE(cf, save);
-  return result;
-}
-
-static CURLcode cf_ngtcp2_query(struct Curl_cfilter *cf,
-                                struct Curl_easy *data,
-                                int query, int *pres1, void *pres2)
-{
-  struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  struct cf_call_data save;
-
-  switch(query) {
-  case CF_QUERY_MAX_CONCURRENT: {
-    const ngtcp2_transport_params *rp;
-    DEBUGASSERT(pres1);
-
-    CF_DATA_SAVE(save, cf, data);
-    rp = ngtcp2_conn_get_remote_transport_params(ctx->qconn);
-    if(rp)
-      *pres1 = (rp->initial_max_streams_bidi > INT_MAX)?
-                 INT_MAX : (int)rp->initial_max_streams_bidi;
-    else  /* not arrived yet? */
-      *pres1 = Curl_multi_max_concurrent_streams(data->multi);
-    CURL_TRC_CF(data, cf, "query max_conncurrent -> %d", *pres1);
-    CF_DATA_RESTORE(cf, save);
-    return CURLE_OK;
-  }
-  case CF_QUERY_CONNECT_REPLY_MS:
-    if(ctx->got_first_byte) {
-      timediff_t ms = Curl_timediff(ctx->first_byte_at, ctx->started_at);
-      *pres1 = (ms < INT_MAX)? (int)ms : INT_MAX;
-    }
-    else
-      *pres1 = -1;
-    return CURLE_OK;
-  case CF_QUERY_TIMER_CONNECT: {
-    struct curltime *when = pres2;
-    if(ctx->got_first_byte)
-      *when = ctx->first_byte_at;
-    return CURLE_OK;
-  }
-  case CF_QUERY_TIMER_APPCONNECT: {
-    struct curltime *when = pres2;
-    if(cf->connected)
-      *when = ctx->handshake_at;
-    return CURLE_OK;
-  }
-  default:
-    break;
-  }
-  return cf->next?
-    cf->next->cft->query(cf->next, data, query, pres1, pres2) :
-    CURLE_UNKNOWN_OPTION;
-}
-
-static bool cf_ngtcp2_conn_is_alive(struct Curl_cfilter *cf,
-                                    struct Curl_easy *data,
-                                    bool *input_pending)
-{
-  bool alive = TRUE;
-
-  *input_pending = FALSE;
-  if(!cf->next || !cf->next->cft->is_alive(cf->next, data, input_pending))
-    return FALSE;
-
-  if(*input_pending) {
-    /* This happens before we've sent off a request and the connection is
-       not in use by any other transfer, there shouldn't be any data here,
-       only "protocol frames" */
-    *input_pending = FALSE;
-    if(cf_progress_ingress(cf, data, NULL))
-      alive = FALSE;
-    else {
-      alive = TRUE;
-    }
-  }
-
-  return alive;
-}
-
-struct Curl_cftype Curl_cft_http3 = {
-  "HTTP/3",
-  CF_TYPE_IP_CONNECT | CF_TYPE_SSL | CF_TYPE_MULTIPLEX,
-  0,
-  cf_ngtcp2_destroy,
-  cf_ngtcp2_connect,
-  cf_ngtcp2_close,
-  Curl_cf_def_get_host,
-  cf_ngtcp2_get_select_socks,
-  cf_ngtcp2_data_pending,
-  cf_ngtcp2_send,
-  cf_ngtcp2_recv,
-  cf_ngtcp2_data_event,
-  cf_ngtcp2_conn_is_alive,
-  Curl_cf_def_conn_keep_alive,
-  cf_ngtcp2_query,
-};
-
-CURLcode Curl_cf_ngtcp2_create(struct Curl_cfilter **pcf,
-                               struct Curl_easy *data,
-                               struct connectdata *conn,
-                               const struct Curl_addrinfo *ai)
-{
-  struct cf_ngtcp2_ctx *ctx = NULL;
-  struct Curl_cfilter *cf = NULL, *udp_cf = NULL;
-  CURLcode result;
-
-  (void)data;
-  ctx = calloc(sizeof(*ctx), 1);
-  if(!ctx) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto out;
-  }
-  ctx->qlogfd = -1;
-  cf_ngtcp2_ctx_clear(ctx);
-
-  result = Curl_cf_create(&cf, &Curl_cft_http3, ctx);
-  if(result)
-    goto out;
-
-  result = Curl_cf_udp_create(&udp_cf, data, conn, ai, TRNSPRT_QUIC);
-  if(result)
-    goto out;
-
-  cf->conn = conn;
-  udp_cf->conn = cf->conn;
-  udp_cf->sockindex = cf->sockindex;
-  cf->next = udp_cf;
-
-out:
-  *pcf = (!result)? cf : NULL;
-  if(result) {
-    if(udp_cf)
-      Curl_conn_cf_discard_sub(cf, udp_cf, data, TRUE);
-    Curl_safefree(cf);
-    Curl_safefree(ctx);
-  }
-  return result;
-}
-
-bool Curl_conn_is_ngtcp2(const struct Curl_easy *data,
-                         const struct connectdata *conn,
-                         int sockindex)
-{
-  struct Curl_cfilter *cf = conn? conn->cfilter[sockindex] : NULL;
-
-  (void)data;
-  for(; cf; cf = cf->next) {
-    if(cf->cft == &Curl_cft_http3)
-      return TRUE;
-    if(cf->cft->flags & CF_TYPE_IP_CONNECT)
-      return FALSE;
-  }
-  return FALSE;
-}
-
-#endif
diff --git a/third-party/curl/lib/vquic/curl_ngtcp2.h b/third-party/curl/lib/vquic/curl_ngtcp2.h
deleted file mode 100644
index db3e611bd0..0000000000
--- a/third-party/curl/lib/vquic/curl_ngtcp2.h
+++ /dev/null
@@ -1,61 +0,0 @@
-#ifndef HEADER_CURL_VQUIC_CURL_NGTCP2_H
-#define HEADER_CURL_VQUIC_CURL_NGTCP2_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#if defined(USE_NGTCP2) && defined(USE_NGHTTP3)
-
-#ifdef HAVE_NETINET_UDP_H
-#include <netinet/udp.h>
-#endif
-
-#include <ngtcp2/ngtcp2_crypto.h>
-#include <nghttp3/nghttp3.h>
-#ifdef USE_OPENSSL
-#include <openssl/ssl.h>
-#elif defined(USE_WOLFSSL)
-#include <wolfssl/options.h>
-#include <wolfssl/ssl.h>
-#include <wolfssl/quic.h>
-#endif
-
-struct Curl_cfilter;
-
-#include "urldata.h"
-
-void Curl_ngtcp2_ver(char *p, size_t len);
-
-CURLcode Curl_cf_ngtcp2_create(struct Curl_cfilter **pcf,
-                             struct Curl_easy *data,
-                             struct connectdata *conn,
-                             const struct Curl_addrinfo *ai);
-
-bool Curl_conn_is_ngtcp2(const struct Curl_easy *data,
-                         const struct connectdata *conn,
-                         int sockindex);
-#endif
-
-#endif /* HEADER_CURL_VQUIC_CURL_NGTCP2_H */
diff --git a/third-party/curl/lib/vquic/curl_quiche.c b/third-party/curl/lib/vquic/curl_quiche.c
deleted file mode 100644
index 3598de1c7a..0000000000
--- a/third-party/curl/lib/vquic/curl_quiche.c
+++ /dev/null
@@ -1,1709 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#ifdef USE_QUICHE
-#include <quiche.h>
-#include <openssl/err.h>
-#include <openssl/ssl.h>
-#include "bufq.h"
-#include "urldata.h"
-#include "cfilters.h"
-#include "cf-socket.h"
-#include "sendf.h"
-#include "strdup.h"
-#include "rand.h"
-#include "strcase.h"
-#include "multiif.h"
-#include "connect.h"
-#include "progress.h"
-#include "strerror.h"
-#include "http1.h"
-#include "vquic.h"
-#include "vquic_int.h"
-#include "curl_quiche.h"
-#include "transfer.h"
-#include "inet_pton.h"
-#include "vtls/openssl.h"
-#include "vtls/keylog.h"
-#include "vtls/vtls.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-/* #define DEBUG_QUICHE */
-
-#define QUIC_MAX_STREAMS              (100)
-#define QUIC_IDLE_TIMEOUT        (60 * 1000) /* milliseconds */
-
-#define H3_STREAM_WINDOW_SIZE  (128 * 1024)
-#define H3_STREAM_CHUNK_SIZE    (16 * 1024)
-/* The pool keeps spares around and half of a full stream windows
- * seems good. More does not seem to improve performance.
- * The benefit of the pool is that stream buffer to not keep
- * spares. So memory consumption goes down when streams run empty,
- * have a large upload done, etc. */
-#define H3_STREAM_POOL_SPARES \
-          (H3_STREAM_WINDOW_SIZE / H3_STREAM_CHUNK_SIZE ) / 2
-/* Receive and Send max number of chunks just follows from the
- * chunk size and window size */
-#define H3_STREAM_RECV_CHUNKS \
-          (H3_STREAM_WINDOW_SIZE / H3_STREAM_CHUNK_SIZE)
-#define H3_STREAM_SEND_CHUNKS \
-          (H3_STREAM_WINDOW_SIZE / H3_STREAM_CHUNK_SIZE)
-
-/*
- * Store quiche version info in this buffer.
- */
-void Curl_quiche_ver(char *p, size_t len)
-{
-  (void)msnprintf(p, len, "quiche/%s", quiche_version());
-}
-
-static void keylog_callback(const SSL *ssl, const char *line)
-{
-  (void)ssl;
-  Curl_tls_keylog_write_line(line);
-}
-
-struct cf_quiche_ctx {
-  struct cf_quic_ctx q;
-  quiche_conn *qconn;
-  quiche_config *cfg;
-  quiche_h3_conn *h3c;
-  quiche_h3_config *h3config;
-  uint8_t scid[QUICHE_MAX_CONN_ID_LEN];
-  SSL_CTX *sslctx;
-  SSL *ssl;
-  struct curltime started_at;        /* time the current attempt started */
-  struct curltime handshake_at;      /* time connect handshake finished */
-  struct curltime first_byte_at;     /* when first byte was recvd */
-  struct curltime reconnect_at;      /* time the next attempt should start */
-  struct bufc_pool stream_bufcp;     /* chunk pool for streams */
-  curl_off_t data_recvd;
-  size_t sends_on_hold;              /* # of streams with SEND_HOLD set */
-  BIT(goaway);                       /* got GOAWAY from server */
-  BIT(got_first_byte);               /* if first byte was received */
-  BIT(x509_store_setup);             /* if x509 store has been set up */
-};
-
-#ifdef DEBUG_QUICHE
-static void quiche_debug_log(const char *line, void *argp)
-{
-  (void)argp;
-  fprintf(stderr, "%s\n", line);
-}
-#endif
-
-static void cf_quiche_ctx_clear(struct cf_quiche_ctx *ctx)
-{
-  if(ctx) {
-    vquic_ctx_free(&ctx->q);
-    if(ctx->qconn)
-      quiche_conn_free(ctx->qconn);
-    if(ctx->h3config)
-      quiche_h3_config_free(ctx->h3config);
-    if(ctx->h3c)
-      quiche_h3_conn_free(ctx->h3c);
-    if(ctx->cfg)
-      quiche_config_free(ctx->cfg);
-    Curl_bufcp_free(&ctx->stream_bufcp);
-    memset(ctx, 0, sizeof(*ctx));
-  }
-}
-
-static CURLcode quic_x509_store_setup(struct Curl_cfilter *cf,
-                                      struct Curl_easy *data)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-
-  if(!ctx->x509_store_setup) {
-    if(cf->conn->ssl_config.verifypeer) {
-      const char * const ssl_cafile = cf->conn->ssl_config.CAfile;
-      const char * const ssl_capath = cf->conn->ssl_config.CApath;
-      if(ssl_cafile || ssl_capath) {
-        SSL_CTX_set_verify(ctx->sslctx, SSL_VERIFY_PEER, NULL);
-        /* tell OpenSSL where to find CA certificates that are used to verify
-           the server's certificate. */
-        if(!SSL_CTX_load_verify_locations(
-              ctx->sslctx, ssl_cafile, ssl_capath)) {
-          /* Fail if we insist on successfully verifying the server. */
-          failf(data, "error setting certificate verify locations:"
-                "  CAfile: %s CApath: %s",
-                ssl_cafile ? ssl_cafile : "none",
-                ssl_capath ? ssl_capath : "none");
-          return CURLE_SSL_CACERT_BADFILE;
-        }
-        infof(data, " CAfile: %s", ssl_cafile ? ssl_cafile : "none");
-        infof(data, " CApath: %s", ssl_capath ? ssl_capath : "none");
-      }
-#ifdef CURL_CA_FALLBACK
-      else {
-        /* verifying the peer without any CA certificates won't work so
-           use openssl's built-in default as fallback */
-        SSL_CTX_set_default_verify_paths(ssl_ctx);
-      }
-#endif
-    }
-    ctx->x509_store_setup = TRUE;
-  }
-  return CURLE_OK;
-}
-
-static CURLcode quic_ssl_setup(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-  unsigned char checkip[16];
-
-  DEBUGASSERT(!ctx->sslctx);
-  ctx->sslctx = SSL_CTX_new(TLS_method());
-  if(!ctx->sslctx)
-    return CURLE_OUT_OF_MEMORY;
-
-  SSL_CTX_set_alpn_protos(ctx->sslctx,
-                          (const uint8_t *)QUICHE_H3_APPLICATION_PROTOCOL,
-                          sizeof(QUICHE_H3_APPLICATION_PROTOCOL) - 1);
-
-  SSL_CTX_set_default_verify_paths(ctx->sslctx);
-
-  /* Open the file if a TLS or QUIC backend has not done this before. */
-  Curl_tls_keylog_open();
-  if(Curl_tls_keylog_enabled()) {
-    SSL_CTX_set_keylog_callback(ctx->sslctx, keylog_callback);
-  }
-
-  ctx->ssl = SSL_new(ctx->sslctx);
-  if(!ctx->ssl)
-    return CURLE_QUIC_CONNECT_ERROR;
-
-  SSL_set_app_data(ctx->ssl, cf);
-
-  if((0 == Curl_inet_pton(AF_INET, cf->conn->host.name, checkip))
-#ifdef ENABLE_IPV6
-     && (0 == Curl_inet_pton(AF_INET6, cf->conn->host.name, checkip))
-#endif
-     ) {
-    char *snihost = Curl_ssl_snihost(data, cf->conn->host.name, NULL);
-    if(!snihost || !SSL_set_tlsext_host_name(ctx->ssl, snihost)) {
-      failf(data, "Failed set SNI");
-      SSL_free(ctx->ssl);
-      ctx->ssl = NULL;
-      return CURLE_QUIC_CONNECT_ERROR;
-    }
-  }
-
-  return CURLE_OK;
-}
-
-/**
- * All about the H3 internals of a stream
- */
-struct stream_ctx {
-  int64_t id; /* HTTP/3 protocol stream identifier */
-  struct bufq recvbuf; /* h3 response */
-  struct h1_req_parser h1; /* h1 request parsing */
-  uint64_t error3; /* HTTP/3 stream error code */
-  curl_off_t upload_left; /* number of request bytes left to upload */
-  bool closed; /* TRUE on stream close */
-  bool reset;  /* TRUE on stream reset */
-  bool send_closed; /* stream is locally closed */
-  bool resp_hds_complete;  /* complete, final response has been received */
-  bool resp_got_header; /* TRUE when h3 stream has recvd some HEADER */
-};
-
-#define H3_STREAM_CTX(d)    ((struct stream_ctx *)(((d) && (d)->req.p.http)? \
-                             ((struct HTTP *)(d)->req.p.http)->h3_ctx \
-                               : NULL))
-#define H3_STREAM_LCTX(d)   ((struct HTTP *)(d)->req.p.http)->h3_ctx
-#define H3_STREAM_ID(d)     (H3_STREAM_CTX(d)? \
-                             H3_STREAM_CTX(d)->id : -2)
-
-static bool stream_send_is_suspended(struct Curl_easy *data)
-{
-  return (data->req.keepon & KEEP_SEND_HOLD);
-}
-
-static void stream_send_suspend(struct Curl_cfilter *cf,
-                                struct Curl_easy *data)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-
-  if((data->req.keepon & KEEP_SENDBITS) == KEEP_SEND) {
-    data->req.keepon |= KEEP_SEND_HOLD;
-    ++ctx->sends_on_hold;
-    if(H3_STREAM_ID(data) >= 0)
-      CURL_TRC_CF(data, cf, "[%"PRId64"] suspend sending",
-                  H3_STREAM_ID(data));
-    else
-      CURL_TRC_CF(data, cf, "[%s] suspend sending", data->state.url);
-  }
-}
-
-static void stream_send_resume(struct Curl_cfilter *cf,
-                               struct Curl_easy *data)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-
-  if(stream_send_is_suspended(data)) {
-    data->req.keepon &= ~KEEP_SEND_HOLD;
-    --ctx->sends_on_hold;
-    if(H3_STREAM_ID(data) >= 0)
-      CURL_TRC_CF(data, cf, "[%"PRId64"] resume sending",
-                  H3_STREAM_ID(data));
-    else
-      CURL_TRC_CF(data, cf, "[%s] resume sending", data->state.url);
-    Curl_expire(data, 0, EXPIRE_RUN_NOW);
-  }
-}
-
-static void check_resumes(struct Curl_cfilter *cf,
-                          struct Curl_easy *data)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-  struct Curl_easy *sdata;
-
-  if(ctx->sends_on_hold) {
-    DEBUGASSERT(data->multi);
-    for(sdata = data->multi->easyp;
-        sdata && ctx->sends_on_hold; sdata = sdata->next) {
-      if(stream_send_is_suspended(sdata)) {
-        stream_send_resume(cf, sdata);
-      }
-    }
-  }
-}
-
-static CURLcode h3_data_setup(struct Curl_cfilter *cf,
-                              struct Curl_easy *data)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-
-  if(stream)
-    return CURLE_OK;
-
-  stream = calloc(1, sizeof(*stream));
-  if(!stream)
-    return CURLE_OUT_OF_MEMORY;
-
-  H3_STREAM_LCTX(data) = stream;
-  stream->id = -1;
-  Curl_bufq_initp(&stream->recvbuf, &ctx->stream_bufcp,
-                  H3_STREAM_RECV_CHUNKS, BUFQ_OPT_SOFT_LIMIT);
-  Curl_h1_req_parse_init(&stream->h1, H1_PARSE_DEFAULT_MAX_LINE_LEN);
-  return CURLE_OK;
-}
-
-static void h3_data_done(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-
-  (void)cf;
-  if(stream) {
-    CURL_TRC_CF(data, cf, "[%"PRId64"] easy handle is done", stream->id);
-    if(stream_send_is_suspended(data)) {
-      data->req.keepon &= ~KEEP_SEND_HOLD;
-      --ctx->sends_on_hold;
-    }
-    Curl_bufq_free(&stream->recvbuf);
-    Curl_h1_req_parse_free(&stream->h1);
-    free(stream);
-    H3_STREAM_LCTX(data) = NULL;
-  }
-}
-
-static void drain_stream(struct Curl_cfilter *cf,
-                         struct Curl_easy *data)
-{
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  unsigned char bits;
-
-  (void)cf;
-  bits = CURL_CSELECT_IN;
-  if(stream && !stream->send_closed && stream->upload_left)
-    bits |= CURL_CSELECT_OUT;
-  if(data->state.dselect_bits != bits) {
-    data->state.dselect_bits = bits;
-    Curl_expire(data, 0, EXPIRE_RUN_NOW);
-  }
-}
-
-static struct Curl_easy *get_stream_easy(struct Curl_cfilter *cf,
-                                         struct Curl_easy *data,
-                                         int64_t stream3_id)
-{
-  struct Curl_easy *sdata;
-
-  (void)cf;
-  if(H3_STREAM_ID(data) == stream3_id) {
-    return data;
-  }
-  else {
-    DEBUGASSERT(data->multi);
-    for(sdata = data->multi->easyp; sdata; sdata = sdata->next) {
-      if((sdata->conn == data->conn) && H3_STREAM_ID(sdata) == stream3_id) {
-        return sdata;
-      }
-    }
-  }
-  return NULL;
-}
-
-/*
- * write_resp_raw() copies response data in raw format to the `data`'s
-  * receive buffer. If not enough space is available, it appends to the
- * `data`'s overflow buffer.
- */
-static CURLcode write_resp_raw(struct Curl_cfilter *cf,
-                               struct Curl_easy *data,
-                               const void *mem, size_t memlen)
-{
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  CURLcode result = CURLE_OK;
-  ssize_t nwritten;
-
-  (void)cf;
-  if(!stream)
-    return CURLE_RECV_ERROR;
-  nwritten = Curl_bufq_write(&stream->recvbuf, mem, memlen, &result);
-  if(nwritten < 0)
-    return result;
-
-  if((size_t)nwritten < memlen) {
-    /* This MUST not happen. Our recbuf is dimensioned to hold the
-     * full max_stream_window and then some for this very reason. */
-    DEBUGASSERT(0);
-    return CURLE_RECV_ERROR;
-  }
-  return result;
-}
-
-struct cb_ctx {
-  struct Curl_cfilter *cf;
-  struct Curl_easy *data;
-};
-
-static int cb_each_header(uint8_t *name, size_t name_len,
-                          uint8_t *value, size_t value_len,
-                          void *argp)
-{
-  struct cb_ctx *x = argp;
-  struct stream_ctx *stream = H3_STREAM_CTX(x->data);
-  CURLcode result;
-
-  if(!stream)
-    return CURLE_OK;
-
-  if((name_len == 7) && !strncmp(HTTP_PSEUDO_STATUS, (char *)name, 7)) {
-    CURL_TRC_CF(x->data, x->cf, "[%" PRId64 "] status: %.*s",
-                stream->id, (int)value_len, value);
-    result = write_resp_raw(x->cf, x->data, "HTTP/3 ", sizeof("HTTP/3 ") - 1);
-    if(!result)
-      result = write_resp_raw(x->cf, x->data, value, value_len);
-    if(!result)
-      result = write_resp_raw(x->cf, x->data, " \r\n", 3);
-  }
-  else {
-    CURL_TRC_CF(x->data, x->cf, "[%" PRId64 "] header: %.*s: %.*s",
-                stream->id, (int)name_len, name,
-                (int)value_len, value);
-    result = write_resp_raw(x->cf, x->data, name, name_len);
-    if(!result)
-      result = write_resp_raw(x->cf, x->data, ": ", 2);
-    if(!result)
-      result = write_resp_raw(x->cf, x->data, value, value_len);
-    if(!result)
-      result = write_resp_raw(x->cf, x->data, "\r\n", 2);
-  }
-  if(result) {
-    CURL_TRC_CF(x->data, x->cf, "[%"PRId64"] on header error %d",
-                stream->id, result);
-  }
-  return result;
-}
-
-static ssize_t stream_resp_read(void *reader_ctx,
-                                unsigned char *buf, size_t len,
-                                CURLcode *err)
-{
-  struct cb_ctx *x = reader_ctx;
-  struct cf_quiche_ctx *ctx = x->cf->ctx;
-  struct stream_ctx *stream = H3_STREAM_CTX(x->data);
-  ssize_t nread;
-
-  if(!stream) {
-    *err = CURLE_RECV_ERROR;
-    return -1;
-  }
-
-  nread = quiche_h3_recv_body(ctx->h3c, ctx->qconn, stream->id,
-                              buf, len);
-  if(nread >= 0) {
-    *err = CURLE_OK;
-    return nread;
-  }
-  else {
-    *err = CURLE_AGAIN;
-    return -1;
-  }
-}
-
-static CURLcode cf_recv_body(struct Curl_cfilter *cf,
-                             struct Curl_easy *data)
-{
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  ssize_t nwritten;
-  struct cb_ctx cb_ctx;
-  CURLcode result = CURLE_OK;
-
-  if(!stream)
-    return CURLE_RECV_ERROR;
-
-  if(!stream->resp_hds_complete) {
-    result = write_resp_raw(cf, data, "\r\n", 2);
-    if(result)
-      return result;
-    stream->resp_hds_complete = TRUE;
-  }
-
-  cb_ctx.cf = cf;
-  cb_ctx.data = data;
-  nwritten = Curl_bufq_slurp(&stream->recvbuf,
-                             stream_resp_read, &cb_ctx, &result);
-
-  if(nwritten < 0 && result != CURLE_AGAIN) {
-    CURL_TRC_CF(data, cf, "[%"PRId64"] recv_body error %zd",
-                stream->id, nwritten);
-    failf(data, "Error %d in HTTP/3 response body for stream[%"PRId64"]",
-          result, stream->id);
-    stream->closed = TRUE;
-    stream->reset = TRUE;
-    stream->send_closed = TRUE;
-    streamclose(cf->conn, "Reset of stream");
-    return result;
-  }
-  return CURLE_OK;
-}
-
-#ifdef DEBUGBUILD
-static const char *cf_ev_name(quiche_h3_event *ev)
-{
-  switch(quiche_h3_event_type(ev)) {
-  case QUICHE_H3_EVENT_HEADERS:
-    return "HEADERS";
-  case QUICHE_H3_EVENT_DATA:
-    return "DATA";
-  case QUICHE_H3_EVENT_RESET:
-    return "RESET";
-  case QUICHE_H3_EVENT_FINISHED:
-    return "FINISHED";
-  case QUICHE_H3_EVENT_GOAWAY:
-    return "GOAWAY";
-  default:
-    return "Unknown";
-  }
-}
-#else
-#define cf_ev_name(x)   ""
-#endif
-
-static CURLcode h3_process_event(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data,
-                                 int64_t stream3_id,
-                                 quiche_h3_event *ev)
-{
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  struct cb_ctx cb_ctx;
-  CURLcode result = CURLE_OK;
-  int rc;
-
-  if(!stream)
-    return CURLE_OK;
-  DEBUGASSERT(stream3_id == stream->id);
-  switch(quiche_h3_event_type(ev)) {
-  case QUICHE_H3_EVENT_HEADERS:
-    stream->resp_got_header = TRUE;
-    cb_ctx.cf = cf;
-    cb_ctx.data = data;
-    rc = quiche_h3_event_for_each_header(ev, cb_each_header, &cb_ctx);
-    if(rc) {
-      failf(data, "Error %d in HTTP/3 response header for stream[%"PRId64"]",
-            rc, stream3_id);
-      return CURLE_RECV_ERROR;
-    }
-    CURL_TRC_CF(data, cf, "[%"PRId64"] <- [HEADERS]", stream3_id);
-    break;
-
-  case QUICHE_H3_EVENT_DATA:
-    if(!stream->closed) {
-      result = cf_recv_body(cf, data);
-    }
-    break;
-
-  case QUICHE_H3_EVENT_RESET:
-    CURL_TRC_CF(data, cf, "[%"PRId64"] RESET", stream3_id);
-    stream->closed = TRUE;
-    stream->reset = TRUE;
-    stream->send_closed = TRUE;
-    streamclose(cf->conn, "Reset of stream");
-    break;
-
-  case QUICHE_H3_EVENT_FINISHED:
-    CURL_TRC_CF(data, cf, "[%"PRId64"] CLOSED", stream3_id);
-    if(!stream->resp_hds_complete) {
-      result = write_resp_raw(cf, data, "\r\n", 2);
-      if(result)
-        return result;
-      stream->resp_hds_complete = TRUE;
-    }
-    stream->closed = TRUE;
-    streamclose(cf->conn, "End of stream");
-    data->req.keepon &= ~KEEP_SEND_HOLD;
-    break;
-
-  case QUICHE_H3_EVENT_GOAWAY:
-    CURL_TRC_CF(data, cf, "[%"PRId64"] <- [GOAWAY]", stream3_id);
-    break;
-
-  default:
-    CURL_TRC_CF(data, cf, "[%"PRId64"] recv, unhandled event %d",
-                stream3_id, quiche_h3_event_type(ev));
-    break;
-  }
-  return result;
-}
-
-static CURLcode cf_poll_events(struct Curl_cfilter *cf,
-                               struct Curl_easy *data)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  struct Curl_easy *sdata;
-  quiche_h3_event *ev;
-  CURLcode result;
-
-  /* Take in the events and distribute them to the transfers. */
-  while(ctx->h3c) {
-    int64_t stream3_id = quiche_h3_conn_poll(ctx->h3c, ctx->qconn, &ev);
-    if(stream3_id == QUICHE_H3_ERR_DONE) {
-      break;
-    }
-    else if(stream3_id < 0) {
-      CURL_TRC_CF(data, cf, "[%"PRId64"] error poll: %"PRId64,
-                  stream? stream->id : -1, stream3_id);
-      return CURLE_HTTP3;
-    }
-
-    sdata = get_stream_easy(cf, data, stream3_id);
-    if(!sdata) {
-      CURL_TRC_CF(data, cf, "[%"PRId64"] discard event %s for "
-                  "unknown [%"PRId64"]",
-                  stream? stream->id : -1, cf_ev_name(ev), stream3_id);
-    }
-    else {
-      result = h3_process_event(cf, sdata, stream3_id, ev);
-      drain_stream(cf, sdata);
-      if(result) {
-        CURL_TRC_CF(data, cf, "[%"PRId64"] error processing event %s "
-                    "for [%"PRId64"] -> %d",
-                    stream? stream->id : -1, cf_ev_name(ev),
-                    stream3_id, result);
-        if(data == sdata) {
-          /* Only report this error to the caller if it is about the
-           * transfer we were called with. Otherwise we fail a transfer
-           * due to a problem in another one. */
-          quiche_h3_event_free(ev);
-          return result;
-        }
-      }
-      quiche_h3_event_free(ev);
-    }
-  }
-  return CURLE_OK;
-}
-
-struct recv_ctx {
-  struct Curl_cfilter *cf;
-  struct Curl_easy *data;
-  int pkts;
-};
-
-static CURLcode recv_pkt(const unsigned char *pkt, size_t pktlen,
-                         struct sockaddr_storage *remote_addr,
-                         socklen_t remote_addrlen, int ecn,
-                         void *userp)
-{
-  struct recv_ctx *r = userp;
-  struct cf_quiche_ctx *ctx = r->cf->ctx;
-  quiche_recv_info recv_info;
-  ssize_t nread;
-
-  (void)ecn;
-  ++r->pkts;
-
-  recv_info.to = (struct sockaddr *)&ctx->q.local_addr;
-  recv_info.to_len = ctx->q.local_addrlen;
-  recv_info.from = (struct sockaddr *)remote_addr;
-  recv_info.from_len = remote_addrlen;
-
-  nread = quiche_conn_recv(ctx->qconn, (unsigned char *)pkt, pktlen,
-                           &recv_info);
-  if(nread < 0) {
-    if(QUICHE_ERR_DONE == nread) {
-      CURL_TRC_CF(r->data, r->cf, "ingress, quiche is DONE");
-      return CURLE_OK;
-    }
-    else if(QUICHE_ERR_TLS_FAIL == nread) {
-      long verify_ok = SSL_get_verify_result(ctx->ssl);
-      if(verify_ok != X509_V_OK) {
-        failf(r->data, "SSL certificate problem: %s",
-              X509_verify_cert_error_string(verify_ok));
-        return CURLE_PEER_FAILED_VERIFICATION;
-      }
-    }
-    else {
-      failf(r->data, "quiche_conn_recv() == %zd", nread);
-      return CURLE_RECV_ERROR;
-    }
-  }
-  else if((size_t)nread < pktlen) {
-    CURL_TRC_CF(r->data, r->cf, "ingress, quiche only read %zd/%zu bytes",
-                nread, pktlen);
-  }
-
-  return CURLE_OK;
-}
-
-static CURLcode cf_process_ingress(struct Curl_cfilter *cf,
-                                   struct Curl_easy *data)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-  struct recv_ctx rctx;
-  CURLcode result;
-
-  DEBUGASSERT(ctx->qconn);
-  result = quic_x509_store_setup(cf, data);
-  if(result)
-    return result;
-
-  rctx.cf = cf;
-  rctx.data = data;
-  rctx.pkts = 0;
-
-  result = vquic_recv_packets(cf, data, &ctx->q, 1000, recv_pkt, &rctx);
-  if(result)
-    return result;
-
-  if(rctx.pkts > 0) {
-    /* quiche digested ingress packets. It might have opened flow control
-     * windows again. */
-    check_resumes(cf, data);
-  }
-  return cf_poll_events(cf, data);
-}
-
-struct read_ctx {
-  struct Curl_cfilter *cf;
-  struct Curl_easy *data;
-  quiche_send_info send_info;
-};
-
-static ssize_t read_pkt_to_send(void *userp,
-                                unsigned char *buf, size_t buflen,
-                                CURLcode *err)
-{
-  struct read_ctx *x = userp;
-  struct cf_quiche_ctx *ctx = x->cf->ctx;
-  ssize_t nwritten;
-
-  nwritten = quiche_conn_send(ctx->qconn, buf, buflen, &x->send_info);
-  if(nwritten == QUICHE_ERR_DONE) {
-    *err = CURLE_AGAIN;
-    return -1;
-  }
-
-  if(nwritten < 0) {
-    failf(x->data, "quiche_conn_send returned %zd", nwritten);
-    *err = CURLE_SEND_ERROR;
-    return -1;
-  }
-  *err = CURLE_OK;
-  return nwritten;
-}
-
-/*
- * flush_egress drains the buffers and sends off data.
- * Calls failf() on errors.
- */
-static CURLcode cf_flush_egress(struct Curl_cfilter *cf,
-                                struct Curl_easy *data)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-  ssize_t nread;
-  CURLcode result;
-  int64_t expiry_ns;
-  int64_t timeout_ns;
-  struct read_ctx readx;
-  size_t pkt_count, gsolen;
-
-  expiry_ns = quiche_conn_timeout_as_nanos(ctx->qconn);
-  if(!expiry_ns) {
-    quiche_conn_on_timeout(ctx->qconn);
-    if(quiche_conn_is_closed(ctx->qconn)) {
-      failf(data, "quiche_conn_on_timeout closed the connection");
-      return CURLE_SEND_ERROR;
-    }
-  }
-
-  result = vquic_flush(cf, data, &ctx->q);
-  if(result) {
-    if(result == CURLE_AGAIN) {
-      Curl_expire(data, 1, EXPIRE_QUIC);
-      return CURLE_OK;
-    }
-    return result;
-  }
-
-  readx.cf = cf;
-  readx.data = data;
-  memset(&readx.send_info, 0, sizeof(readx.send_info));
-  pkt_count = 0;
-  gsolen = quiche_conn_max_send_udp_payload_size(ctx->qconn);
-  for(;;) {
-    /* add the next packet to send, if any, to our buffer */
-    nread = Curl_bufq_sipn(&ctx->q.sendbuf, 0,
-                           read_pkt_to_send, &readx, &result);
-    if(nread < 0) {
-      if(result != CURLE_AGAIN)
-        return result;
-      /* Nothing more to add, flush and leave */
-      result = vquic_send(cf, data, &ctx->q, gsolen);
-      if(result) {
-        if(result == CURLE_AGAIN) {
-          Curl_expire(data, 1, EXPIRE_QUIC);
-          return CURLE_OK;
-        }
-        return result;
-      }
-      goto out;
-    }
-
-    ++pkt_count;
-    if((size_t)nread < gsolen || pkt_count >= MAX_PKT_BURST) {
-      result = vquic_send(cf, data, &ctx->q, gsolen);
-      if(result) {
-        if(result == CURLE_AGAIN) {
-          Curl_expire(data, 1, EXPIRE_QUIC);
-          return CURLE_OK;
-        }
-        goto out;
-      }
-      pkt_count = 0;
-    }
-  }
-
-out:
-  timeout_ns = quiche_conn_timeout_as_nanos(ctx->qconn);
-  if(timeout_ns % 1000000)
-    timeout_ns += 1000000;
-    /* expire resolution is milliseconds */
-  Curl_expire(data, (timeout_ns / 1000000), EXPIRE_QUIC);
-  return result;
-}
-
-static ssize_t recv_closed_stream(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  CURLcode *err)
-{
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  ssize_t nread = -1;
-
-  DEBUGASSERT(stream);
-  if(stream->reset) {
-    failf(data,
-          "HTTP/3 stream %" PRId64 " reset by server", stream->id);
-    *err = stream->resp_got_header? CURLE_PARTIAL_FILE : CURLE_RECV_ERROR;
-    CURL_TRC_CF(data, cf, "[%" PRId64 "] cf_recv, was reset -> %d",
-                stream->id, *err);
-  }
-  else if(!stream->resp_got_header) {
-    failf(data,
-          "HTTP/3 stream %" PRId64 " was closed cleanly, but before getting"
-          " all response header fields, treated as error",
-          stream->id);
-    /* *err = CURLE_PARTIAL_FILE; */
-    *err = CURLE_RECV_ERROR;
-    CURL_TRC_CF(data, cf, "[%" PRId64 "] cf_recv, closed incomplete"
-                " -> %d", stream->id, *err);
-  }
-  else {
-    *err = CURLE_OK;
-    nread = 0;
-  }
-  return nread;
-}
-
-static ssize_t cf_quiche_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
-                              char *buf, size_t len, CURLcode *err)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  ssize_t nread = -1;
-  CURLcode result;
-
-  if(!stream) {
-    *err = CURLE_RECV_ERROR;
-    return -1;
-  }
-
-  if(!Curl_bufq_is_empty(&stream->recvbuf)) {
-    nread = Curl_bufq_read(&stream->recvbuf,
-                           (unsigned char *)buf, len, err);
-    CURL_TRC_CF(data, cf, "[%" PRId64 "] read recvbuf(len=%zu) "
-                "-> %zd, %d", stream->id, len, nread, *err);
-    if(nread < 0)
-      goto out;
-  }
-
-  if(cf_process_ingress(cf, data)) {
-    CURL_TRC_CF(data, cf, "cf_recv, error on ingress");
-    *err = CURLE_RECV_ERROR;
-    nread = -1;
-    goto out;
-  }
-
-  /* recvbuf had nothing before, maybe after progressing ingress? */
-  if(nread < 0 && !Curl_bufq_is_empty(&stream->recvbuf)) {
-    nread = Curl_bufq_read(&stream->recvbuf,
-                           (unsigned char *)buf, len, err);
-    CURL_TRC_CF(data, cf, "[%" PRId64 "] read recvbuf(len=%zu) "
-                "-> %zd, %d", stream->id, len, nread, *err);
-    if(nread < 0)
-      goto out;
-  }
-
-  if(nread > 0) {
-    if(stream->closed)
-      drain_stream(cf, data);
-  }
-  else {
-    if(stream->closed) {
-      nread = recv_closed_stream(cf, data, err);
-      goto out;
-    }
-    else if(quiche_conn_is_draining(ctx->qconn)) {
-      failf(data, "QUIC connection is draining");
-      *err = CURLE_HTTP3;
-      nread = -1;
-      goto out;
-    }
-    *err = CURLE_AGAIN;
-    nread = -1;
-  }
-
-out:
-  result = cf_flush_egress(cf, data);
-  if(result) {
-    CURL_TRC_CF(data, cf, "cf_recv, flush egress failed");
-    *err = result;
-    nread = -1;
-  }
-  if(nread > 0)
-    ctx->data_recvd += nread;
-  CURL_TRC_CF(data, cf, "[%"PRId64"] cf_recv(total=%"
-              CURL_FORMAT_CURL_OFF_T ") -> %zd, %d",
-              stream->id, ctx->data_recvd, nread, *err);
-  return nread;
-}
-
-/* Index where :authority header field will appear in request header
-   field list. */
-#define AUTHORITY_DST_IDX 3
-
-static ssize_t h3_open_stream(struct Curl_cfilter *cf,
-                              struct Curl_easy *data,
-                              const void *buf, size_t len,
-                              CURLcode *err)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  size_t nheader, i;
-  int64_t stream3_id;
-  struct dynhds h2_headers;
-  quiche_h3_header *nva = NULL;
-  ssize_t nwritten;
-
-  if(!stream) {
-    *err = h3_data_setup(cf, data);
-    if(*err) {
-      return -1;
-    }
-    stream = H3_STREAM_CTX(data);
-    DEBUGASSERT(stream);
-  }
-
-  Curl_dynhds_init(&h2_headers, 0, DYN_HTTP_REQUEST);
-
-  DEBUGASSERT(stream);
-  nwritten = Curl_h1_req_parse_read(&stream->h1, buf, len, NULL, 0, err);
-  if(nwritten < 0)
-    goto out;
-  if(!stream->h1.done) {
-    /* need more data */
-    goto out;
-  }
-  DEBUGASSERT(stream->h1.req);
-
-  *err = Curl_http_req_to_h2(&h2_headers, stream->h1.req, data);
-  if(*err) {
-    nwritten = -1;
-    goto out;
-  }
-  /* no longer needed */
-  Curl_h1_req_parse_free(&stream->h1);
-
-  nheader = Curl_dynhds_count(&h2_headers);
-  nva = malloc(sizeof(quiche_h3_header) * nheader);
-  if(!nva) {
-    *err = CURLE_OUT_OF_MEMORY;
-    nwritten = -1;
-    goto out;
-  }
-
-  for(i = 0; i < nheader; ++i) {
-    struct dynhds_entry *e = Curl_dynhds_getn(&h2_headers, i);
-    nva[i].name = (unsigned char *)e->name;
-    nva[i].name_len = e->namelen;
-    nva[i].value = (unsigned char *)e->value;
-    nva[i].value_len = e->valuelen;
-  }
-
-  switch(data->state.httpreq) {
-  case HTTPREQ_POST:
-  case HTTPREQ_POST_FORM:
-  case HTTPREQ_POST_MIME:
-  case HTTPREQ_PUT:
-    if(data->state.infilesize != -1)
-      stream->upload_left = data->state.infilesize;
-    else
-      /* data sending without specifying the data amount up front */
-      stream->upload_left = -1; /* unknown */
-    break;
-  default:
-    stream->upload_left = 0; /* no request body */
-    break;
-  }
-
-  if(stream->upload_left == 0)
-    stream->send_closed = TRUE;
-
-  stream3_id = quiche_h3_send_request(ctx->h3c, ctx->qconn, nva, nheader,
-                                      stream->send_closed);
-  if(stream3_id < 0) {
-    if(QUICHE_H3_ERR_STREAM_BLOCKED == stream3_id) {
-      /* quiche seems to report this error if the connection window is
-       * exhausted. Which happens frequently and intermittent. */
-      CURL_TRC_CF(data, cf, "send_request(%s) rejected with BLOCKED",
-                  data->state.url);
-      stream_send_suspend(cf, data);
-      *err = CURLE_AGAIN;
-      nwritten = -1;
-      goto out;
-    }
-    else {
-      CURL_TRC_CF(data, cf, "send_request(%s) -> %" PRId64,
-                  data->state.url, stream3_id);
-    }
-    *err = CURLE_SEND_ERROR;
-    nwritten = -1;
-    goto out;
-  }
-
-  DEBUGASSERT(stream->id == -1);
-  *err = CURLE_OK;
-  stream->id = stream3_id;
-  stream->closed = FALSE;
-  stream->reset = FALSE;
-
-  if(Curl_trc_is_verbose(data)) {
-    infof(data, "[HTTP/3] [%" PRId64 "] OPENED stream for %s",
-          stream->id, data->state.url);
-    for(i = 0; i < nheader; ++i) {
-      infof(data, "[HTTP/3] [%" PRId64 "] [%.*s: %.*s]", stream->id,
-            (int)nva[i].name_len, nva[i].name,
-            (int)nva[i].value_len, nva[i].value);
-    }
-  }
-
-out:
-  free(nva);
-  Curl_dynhds_free(&h2_headers);
-  return nwritten;
-}
-
-static ssize_t cf_quiche_send(struct Curl_cfilter *cf, struct Curl_easy *data,
-                              const void *buf, size_t len, CURLcode *err)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-  CURLcode result;
-  ssize_t nwritten;
-
-  *err = cf_process_ingress(cf, data);
-  if(*err) {
-    nwritten = -1;
-    goto out;
-  }
-
-  if(!stream || stream->id < 0) {
-    nwritten = h3_open_stream(cf, data, buf, len, err);
-    if(nwritten < 0)
-      goto out;
-    stream = H3_STREAM_CTX(data);
-  }
-  else {
-    bool eof = (stream->upload_left >= 0 &&
-                (curl_off_t)len >= stream->upload_left);
-    nwritten = quiche_h3_send_body(ctx->h3c, ctx->qconn, stream->id,
-                                   (uint8_t *)buf, len, eof);
-    if(nwritten == QUICHE_H3_ERR_DONE || (nwritten == 0 && len > 0)) {
-      /* TODO: we seem to be blocked on flow control and should HOLD
-       * sending. But when do we open again? */
-      if(!quiche_conn_stream_writable(ctx->qconn, stream->id, len)) {
-        CURL_TRC_CF(data, cf, "[%" PRId64 "] send_body(len=%zu) "
-                    "-> window exhausted", stream->id, len);
-        stream_send_suspend(cf, data);
-      }
-      *err = CURLE_AGAIN;
-      nwritten = -1;
-      goto out;
-    }
-    else if(nwritten == QUICHE_H3_TRANSPORT_ERR_INVALID_STREAM_STATE &&
-            stream->closed && stream->resp_hds_complete) {
-      /* sending request body on a stream that has been closed by the
-       * server. If the server has send us a final response, we should
-       * silently discard the send data.
-       * This happens for example on redirects where the server, instead
-       * of reading the full request body just closed the stream after
-       * sending the 30x response.
-       * This is sort of a race: had the transfer loop called recv first,
-       * it would see the response and stop/discard sending on its own- */
-      CURL_TRC_CF(data, cf, "[%" PRId64 "] discarding data"
-                  "on closed stream with response", stream->id);
-      *err = CURLE_OK;
-      nwritten = (ssize_t)len;
-      goto out;
-    }
-    else if(nwritten == QUICHE_H3_TRANSPORT_ERR_FINAL_SIZE) {
-      CURL_TRC_CF(data, cf, "[%" PRId64 "] send_body(len=%zu) "
-                  "-> exceeds size", stream->id, len);
-      *err = CURLE_SEND_ERROR;
-      nwritten = -1;
-      goto out;
-    }
-    else if(nwritten < 0) {
-      CURL_TRC_CF(data, cf, "[%" PRId64 "] send_body(len=%zu) "
-                  "-> quiche err %zd", stream->id, len, nwritten);
-      *err = CURLE_SEND_ERROR;
-      nwritten = -1;
-      goto out;
-    }
-    else {
-      /* quiche accepted all or at least a part of the buf */
-      if(stream->upload_left > 0) {
-        stream->upload_left = (nwritten < stream->upload_left)?
-                              (stream->upload_left - nwritten) : 0;
-      }
-      if(stream->upload_left == 0)
-        stream->send_closed = TRUE;
-
-      CURL_TRC_CF(data, cf, "[%" PRId64 "] send body(len=%zu, "
-                  "left=%" CURL_FORMAT_CURL_OFF_T ") -> %zd",
-                  stream->id, len, stream->upload_left, nwritten);
-      *err = CURLE_OK;
-    }
-  }
-
-out:
-  result = cf_flush_egress(cf, data);
-  if(result) {
-    *err = result;
-    nwritten = -1;
-  }
-  CURL_TRC_CF(data, cf, "[%" PRId64 "] cf_send(len=%zu) -> %zd, %d",
-              stream? stream->id : -1, len, nwritten, *err);
-  return nwritten;
-}
-
-static bool stream_is_writeable(struct Curl_cfilter *cf,
-                                struct Curl_easy *data)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-  struct stream_ctx *stream = H3_STREAM_CTX(data);
-
-  return stream &&
-         quiche_conn_stream_writable(ctx->qconn, (uint64_t)stream->id, 1);
-}
-
-static int cf_quiche_get_select_socks(struct Curl_cfilter *cf,
-                                      struct Curl_easy *data,
-                                      curl_socket_t *socks)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-  struct SingleRequest *k = &data->req;
-  int rv = GETSOCK_BLANK;
-
-  socks[0] = ctx->q.sockfd;
-
-  /* in an HTTP/3 connection we can basically always get a frame so we should
-     always be ready for one */
-  rv |= GETSOCK_READSOCK(0);
-
-  /* we're still uploading or the HTTP/3 layer wants to send data */
-  if(((k->keepon & KEEP_SENDBITS) == KEEP_SEND)
-     && stream_is_writeable(cf, data))
-    rv |= GETSOCK_WRITESOCK(0);
-
-  return rv;
-}
-
-/*
- * Called from transfer.c:data_pending to know if we should keep looping
- * to receive more data from the connection.
- */
-static bool cf_quiche_data_pending(struct Curl_cfilter *cf,
-                                   const struct Curl_easy *data)
-{
-  const struct stream_ctx *stream = H3_STREAM_CTX(data);
-  (void)cf;
-  return stream && !Curl_bufq_is_empty(&stream->recvbuf);
-}
-
-static CURLcode h3_data_pause(struct Curl_cfilter *cf,
-                              struct Curl_easy *data,
-                              bool pause)
-{
-  /* TODO: there seems right now no API in quiche to shrink/enlarge
-   * the streams windows. As we do in HTTP/2. */
-  if(!pause) {
-    drain_stream(cf, data);
-    Curl_expire(data, 0, EXPIRE_RUN_NOW);
-  }
-  return CURLE_OK;
-}
-
-static CURLcode cf_quiche_data_event(struct Curl_cfilter *cf,
-                                     struct Curl_easy *data,
-                                     int event, int arg1, void *arg2)
-{
-  CURLcode result = CURLE_OK;
-
-  (void)arg1;
-  (void)arg2;
-  switch(event) {
-  case CF_CTRL_DATA_SETUP:
-    break;
-  case CF_CTRL_DATA_PAUSE:
-    result = h3_data_pause(cf, data, (arg1 != 0));
-    break;
-  case CF_CTRL_DATA_DONE: {
-    h3_data_done(cf, data);
-    break;
-  }
-  case CF_CTRL_DATA_DONE_SEND: {
-    struct stream_ctx *stream = H3_STREAM_CTX(data);
-    if(stream && !stream->send_closed) {
-      unsigned char body[1];
-      ssize_t sent;
-
-      stream->send_closed = TRUE;
-      stream->upload_left = 0;
-      body[0] = 'X';
-      sent = cf_quiche_send(cf, data, body, 0, &result);
-      CURL_TRC_CF(data, cf, "[%"PRId64"] DONE_SEND -> %zd, %d",
-                  stream->id, sent, result);
-    }
-    break;
-  }
-  case CF_CTRL_DATA_IDLE: {
-    struct stream_ctx *stream = H3_STREAM_CTX(data);
-    if(stream && !stream->closed) {
-      result = cf_flush_egress(cf, data);
-      if(result)
-        CURL_TRC_CF(data, cf, "data idle, flush egress -> %d", result);
-    }
-    break;
-  }
-  default:
-    break;
-  }
-  return result;
-}
-
-static CURLcode cf_verify_peer(struct Curl_cfilter *cf,
-                               struct Curl_easy *data)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-  CURLcode result = CURLE_OK;
-
-  cf->conn->bits.multiplex = TRUE; /* at least potentially multiplexed */
-  cf->conn->httpversion = 30;
-  cf->conn->bundle->multiuse = BUNDLE_MULTIPLEX;
-
-  if(cf->conn->ssl_config.verifyhost) {
-    X509 *server_cert;
-    server_cert = SSL_get_peer_certificate(ctx->ssl);
-    if(!server_cert) {
-      result = CURLE_PEER_FAILED_VERIFICATION;
-      goto out;
-    }
-    result = Curl_ossl_verifyhost(data, cf->conn, server_cert);
-    X509_free(server_cert);
-    if(result)
-      goto out;
-  }
-  else
-    CURL_TRC_CF(data, cf, "Skipped certificate verification");
-
-  ctx->h3config = quiche_h3_config_new();
-  if(!ctx->h3config) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto out;
-  }
-
-  /* Create a new HTTP/3 connection on the QUIC connection. */
-  ctx->h3c = quiche_h3_conn_new_with_transport(ctx->qconn, ctx->h3config);
-  if(!ctx->h3c) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto out;
-  }
-  if(data->set.ssl.certinfo)
-    /* asked to gather certificate info */
-    (void)Curl_ossl_certchain(data, ctx->ssl);
-
-out:
-  if(result) {
-    if(ctx->h3config) {
-      quiche_h3_config_free(ctx->h3config);
-      ctx->h3config = NULL;
-    }
-    if(ctx->h3c) {
-      quiche_h3_conn_free(ctx->h3c);
-      ctx->h3c = NULL;
-    }
-  }
-  return result;
-}
-
-static CURLcode cf_connect_start(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-  int rv;
-  CURLcode result;
-  const struct Curl_sockaddr_ex *sockaddr;
-
-  DEBUGASSERT(ctx->q.sockfd != CURL_SOCKET_BAD);
-
-#ifdef DEBUG_QUICHE
-  /* initialize debug log callback only once */
-  static int debug_log_init = 0;
-  if(!debug_log_init) {
-    quiche_enable_debug_logging(quiche_debug_log, NULL);
-    debug_log_init = 1;
-  }
-#endif
-  Curl_bufcp_init(&ctx->stream_bufcp, H3_STREAM_CHUNK_SIZE,
-                  H3_STREAM_POOL_SPARES);
-  ctx->data_recvd = 0;
-
-  result = vquic_ctx_init(&ctx->q);
-  if(result)
-    return result;
-
-  ctx->cfg = quiche_config_new(QUICHE_PROTOCOL_VERSION);
-  if(!ctx->cfg) {
-    failf(data, "can't create quiche config");
-    return CURLE_FAILED_INIT;
-  }
-  quiche_config_enable_pacing(ctx->cfg, false);
-  quiche_config_set_max_idle_timeout(ctx->cfg, QUIC_IDLE_TIMEOUT);
-  quiche_config_set_initial_max_data(ctx->cfg, (1 * 1024 * 1024)
-    /* (QUIC_MAX_STREAMS/2) * H3_STREAM_WINDOW_SIZE */);
-  quiche_config_set_initial_max_streams_bidi(ctx->cfg, QUIC_MAX_STREAMS);
-  quiche_config_set_initial_max_streams_uni(ctx->cfg, QUIC_MAX_STREAMS);
-  quiche_config_set_initial_max_stream_data_bidi_local(ctx->cfg,
-    H3_STREAM_WINDOW_SIZE);
-  quiche_config_set_initial_max_stream_data_bidi_remote(ctx->cfg,
-    H3_STREAM_WINDOW_SIZE);
-  quiche_config_set_initial_max_stream_data_uni(ctx->cfg,
-    H3_STREAM_WINDOW_SIZE);
-  quiche_config_set_disable_active_migration(ctx->cfg, TRUE);
-
-  quiche_config_set_max_connection_window(ctx->cfg,
-    10 * QUIC_MAX_STREAMS * H3_STREAM_WINDOW_SIZE);
-  quiche_config_set_max_stream_window(ctx->cfg, 10 * H3_STREAM_WINDOW_SIZE);
-  quiche_config_set_application_protos(ctx->cfg,
-                                       (uint8_t *)
-                                       QUICHE_H3_APPLICATION_PROTOCOL,
-                                       sizeof(QUICHE_H3_APPLICATION_PROTOCOL)
-                                       - 1);
-
-  DEBUGASSERT(!ctx->ssl);
-  DEBUGASSERT(!ctx->sslctx);
-  result = quic_ssl_setup(cf, data);
-  if(result)
-    return result;
-
-  result = Curl_rand(data, ctx->scid, sizeof(ctx->scid));
-  if(result)
-    return result;
-
-  Curl_cf_socket_peek(cf->next, data, &ctx->q.sockfd,
-                      &sockaddr, NULL, NULL, NULL, NULL);
-  ctx->q.local_addrlen = sizeof(ctx->q.local_addr);
-  rv = getsockname(ctx->q.sockfd, (struct sockaddr *)&ctx->q.local_addr,
-                   &ctx->q.local_addrlen);
-  if(rv == -1)
-    return CURLE_QUIC_CONNECT_ERROR;
-
-  ctx->qconn = quiche_conn_new_with_tls((const uint8_t *)ctx->scid,
-                                      sizeof(ctx->scid), NULL, 0,
-                                      (struct sockaddr *)&ctx->q.local_addr,
-                                      ctx->q.local_addrlen,
-                                      &sockaddr->sa_addr, sockaddr->addrlen,
-                                      ctx->cfg, ctx->ssl, false);
-  if(!ctx->qconn) {
-    failf(data, "can't create quiche connection");
-    return CURLE_OUT_OF_MEMORY;
-  }
-
-  /* Known to not work on Windows */
-#if !defined(WIN32) && defined(HAVE_QUICHE_CONN_SET_QLOG_FD)
-  {
-    int qfd;
-    (void)Curl_qlogdir(data, ctx->scid, sizeof(ctx->scid), &qfd);
-    if(qfd != -1)
-      quiche_conn_set_qlog_fd(ctx->qconn, qfd,
-                              "qlog title", "curl qlog");
-  }
-#endif
-
-  result = cf_flush_egress(cf, data);
-  if(result)
-    return result;
-
-  {
-    unsigned char alpn_protocols[] = QUICHE_H3_APPLICATION_PROTOCOL;
-    unsigned alpn_len, offset = 0;
-
-    /* Replace each ALPN length prefix by a comma. */
-    while(offset < sizeof(alpn_protocols) - 1) {
-      alpn_len = alpn_protocols[offset];
-      alpn_protocols[offset] = ',';
-      offset += 1 + alpn_len;
-    }
-
-    CURL_TRC_CF(data, cf, "Sent QUIC client Initial, ALPN: %s",
-                alpn_protocols + 1);
-  }
-
-  return CURLE_OK;
-}
-
-static CURLcode cf_quiche_connect(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  bool blocking, bool *done)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-  CURLcode result = CURLE_OK;
-  struct curltime now;
-
-  if(cf->connected) {
-    *done = TRUE;
-    return CURLE_OK;
-  }
-
-  /* Connect the UDP filter first */
-  if(!cf->next->connected) {
-    result = Curl_conn_cf_connect(cf->next, data, blocking, done);
-    if(result || !*done)
-      return result;
-  }
-
-  *done = FALSE;
-  now = Curl_now();
-
-  if(ctx->reconnect_at.tv_sec && Curl_timediff(now, ctx->reconnect_at) < 0) {
-    /* Not time yet to attempt the next connect */
-    CURL_TRC_CF(data, cf, "waiting for reconnect time");
-    goto out;
-  }
-
-  if(!ctx->qconn) {
-    result = cf_connect_start(cf, data);
-    if(result)
-      goto out;
-    ctx->started_at = now;
-    result = cf_flush_egress(cf, data);
-    /* we do not expect to be able to recv anything yet */
-    goto out;
-  }
-
-  result = cf_process_ingress(cf, data);
-  if(result)
-    goto out;
-
-  result = cf_flush_egress(cf, data);
-  if(result)
-    goto out;
-
-  if(quiche_conn_is_established(ctx->qconn)) {
-    CURL_TRC_CF(data, cf, "handshake complete after %dms",
-                (int)Curl_timediff(now, ctx->started_at));
-    ctx->handshake_at = now;
-    result = cf_verify_peer(cf, data);
-    if(!result) {
-      CURL_TRC_CF(data, cf, "peer verified");
-      cf->connected = TRUE;
-      cf->conn->alpn = CURL_HTTP_VERSION_3;
-      *done = TRUE;
-      connkeep(cf->conn, "HTTP/3 default");
-    }
-  }
-  else if(quiche_conn_is_draining(ctx->qconn)) {
-    /* When a QUIC server instance is shutting down, it may send us a
-     * CONNECTION_CLOSE right away. Our connection then enters the DRAINING
-     * state.
-     * This may be a stopping of the service or it may be that the server
-     * is reloading and a new instance will start serving soon.
-     * In any case, we tear down our socket and start over with a new one.
-     * We re-open the underlying UDP cf right now, but do not start
-     * connecting until called again.
-     */
-    int reconn_delay_ms = 200;
-
-    CURL_TRC_CF(data, cf, "connect, remote closed, reconnect after %dms",
-                reconn_delay_ms);
-    Curl_conn_cf_close(cf->next, data);
-    cf_quiche_ctx_clear(ctx);
-    result = Curl_conn_cf_connect(cf->next, data, FALSE, done);
-    if(!result && *done) {
-      *done = FALSE;
-      ctx->reconnect_at = Curl_now();
-      ctx->reconnect_at.tv_usec += reconn_delay_ms * 1000;
-      Curl_expire(data, reconn_delay_ms, EXPIRE_QUIC);
-      result = CURLE_OK;
-    }
-  }
-
-out:
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-  if(result && result != CURLE_AGAIN) {
-    const char *r_ip;
-    int r_port;
-
-    Curl_cf_socket_peek(cf->next, data, NULL, NULL,
-                        &r_ip, &r_port, NULL, NULL);
-    infof(data, "connect to %s port %u failed: %s",
-          r_ip, r_port, curl_easy_strerror(result));
-  }
-#endif
-  return result;
-}
-
-static void cf_quiche_close(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-
-  if(ctx) {
-    if(ctx->qconn) {
-      (void)quiche_conn_close(ctx->qconn, TRUE, 0, NULL, 0);
-      /* flushing the egress is not a failsafe way to deliver all the
-         outstanding packets, but we also don't want to get stuck here... */
-      (void)cf_flush_egress(cf, data);
-    }
-    cf_quiche_ctx_clear(ctx);
-  }
-}
-
-static void cf_quiche_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-
-  (void)data;
-  cf_quiche_ctx_clear(ctx);
-  free(ctx);
-  cf->ctx = NULL;
-}
-
-static CURLcode cf_quiche_query(struct Curl_cfilter *cf,
-                                struct Curl_easy *data,
-                                int query, int *pres1, void *pres2)
-{
-  struct cf_quiche_ctx *ctx = cf->ctx;
-
-  switch(query) {
-  case CF_QUERY_MAX_CONCURRENT: {
-    uint64_t max_streams = CONN_INUSE(cf->conn);
-    if(!ctx->goaway) {
-      max_streams += quiche_conn_peer_streams_left_bidi(ctx->qconn);
-    }
-    *pres1 = (max_streams > INT_MAX)? INT_MAX : (int)max_streams;
-    CURL_TRC_CF(data, cf, "query: MAX_CONCURRENT -> %d", *pres1);
-    return CURLE_OK;
-  }
-  case CF_QUERY_CONNECT_REPLY_MS:
-    if(ctx->got_first_byte) {
-      timediff_t ms = Curl_timediff(ctx->first_byte_at, ctx->started_at);
-      *pres1 = (ms < INT_MAX)? (int)ms : INT_MAX;
-    }
-    else
-      *pres1 = -1;
-    return CURLE_OK;
-  case CF_QUERY_TIMER_CONNECT: {
-    struct curltime *when = pres2;
-    if(ctx->got_first_byte)
-      *when = ctx->first_byte_at;
-    return CURLE_OK;
-  }
-  case CF_QUERY_TIMER_APPCONNECT: {
-    struct curltime *when = pres2;
-    if(cf->connected)
-      *when = ctx->handshake_at;
-    return CURLE_OK;
-  }
-  default:
-    break;
-  }
-  return cf->next?
-    cf->next->cft->query(cf->next, data, query, pres1, pres2) :
-    CURLE_UNKNOWN_OPTION;
-}
-
-static bool cf_quiche_conn_is_alive(struct Curl_cfilter *cf,
-                                    struct Curl_easy *data,
-                                    bool *input_pending)
-{
-  bool alive = TRUE;
-
-  *input_pending = FALSE;
-  if(!cf->next || !cf->next->cft->is_alive(cf->next, data, input_pending))
-    return FALSE;
-
-  if(*input_pending) {
-    /* This happens before we've sent off a request and the connection is
-       not in use by any other transfer, there shouldn't be any data here,
-       only "protocol frames" */
-    *input_pending = FALSE;
-    if(cf_process_ingress(cf, data))
-      alive = FALSE;
-    else {
-      alive = TRUE;
-    }
-  }
-
-  return alive;
-}
-
-struct Curl_cftype Curl_cft_http3 = {
-  "HTTP/3",
-  CF_TYPE_IP_CONNECT | CF_TYPE_SSL | CF_TYPE_MULTIPLEX,
-  0,
-  cf_quiche_destroy,
-  cf_quiche_connect,
-  cf_quiche_close,
-  Curl_cf_def_get_host,
-  cf_quiche_get_select_socks,
-  cf_quiche_data_pending,
-  cf_quiche_send,
-  cf_quiche_recv,
-  cf_quiche_data_event,
-  cf_quiche_conn_is_alive,
-  Curl_cf_def_conn_keep_alive,
-  cf_quiche_query,
-};
-
-CURLcode Curl_cf_quiche_create(struct Curl_cfilter **pcf,
-                               struct Curl_easy *data,
-                               struct connectdata *conn,
-                               const struct Curl_addrinfo *ai)
-{
-  struct cf_quiche_ctx *ctx = NULL;
-  struct Curl_cfilter *cf = NULL, *udp_cf = NULL;
-  CURLcode result;
-
-  (void)data;
-  (void)conn;
-  ctx = calloc(sizeof(*ctx), 1);
-  if(!ctx) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto out;
-  }
-
-  result = Curl_cf_create(&cf, &Curl_cft_http3, ctx);
-  if(result)
-    goto out;
-
-  result = Curl_cf_udp_create(&udp_cf, data, conn, ai, TRNSPRT_QUIC);
-  if(result)
-    goto out;
-
-  udp_cf->conn = cf->conn;
-  udp_cf->sockindex = cf->sockindex;
-  cf->next = udp_cf;
-
-out:
-  *pcf = (!result)? cf : NULL;
-  if(result) {
-    if(udp_cf)
-      Curl_conn_cf_discard_sub(cf, udp_cf, data, TRUE);
-    Curl_safefree(cf);
-    Curl_safefree(ctx);
-  }
-
-  return result;
-}
-
-bool Curl_conn_is_quiche(const struct Curl_easy *data,
-                         const struct connectdata *conn,
-                         int sockindex)
-{
-  struct Curl_cfilter *cf = conn? conn->cfilter[sockindex] : NULL;
-
-  (void)data;
-  for(; cf; cf = cf->next) {
-    if(cf->cft == &Curl_cft_http3)
-      return TRUE;
-    if(cf->cft->flags & CF_TYPE_IP_CONNECT)
-      return FALSE;
-  }
-  return FALSE;
-}
-
-#endif
diff --git a/third-party/curl/lib/vquic/curl_quiche.h b/third-party/curl/lib/vquic/curl_quiche.h
deleted file mode 100644
index bce781c1bc..0000000000
--- a/third-party/curl/lib/vquic/curl_quiche.h
+++ /dev/null
@@ -1,50 +0,0 @@
-#ifndef HEADER_CURL_VQUIC_CURL_QUICHE_H
-#define HEADER_CURL_VQUIC_CURL_QUICHE_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#ifdef USE_QUICHE
-
-#include <quiche.h>
-#include <openssl/ssl.h>
-
-struct Curl_cfilter;
-struct Curl_easy;
-
-void Curl_quiche_ver(char *p, size_t len);
-
-CURLcode Curl_cf_quiche_create(struct Curl_cfilter **pcf,
-                               struct Curl_easy *data,
-                               struct connectdata *conn,
-                               const struct Curl_addrinfo *ai);
-
-bool Curl_conn_is_quiche(const struct Curl_easy *data,
-                         const struct connectdata *conn,
-                         int sockindex);
-
-#endif
-
-#endif /* HEADER_CURL_VQUIC_CURL_QUICHE_H */
diff --git a/third-party/curl/lib/vquic/vquic-tls.c b/third-party/curl/lib/vquic/vquic-tls.c
new file mode 100644
index 0000000000..58f139306a
--- /dev/null
+++ b/third-party/curl/lib/vquic/vquic-tls.c
@@ -0,0 +1,241 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#if defined(USE_HTTP3) && \
+  (defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_WOLFSSL))
+
+#ifdef USE_OPENSSL
+#include <openssl/err.h>
+#include "vtls/openssl.h"
+#elif defined(USE_GNUTLS)
+#include <gnutls/abstract.h>
+#include <gnutls/gnutls.h>
+#include <gnutls/x509.h>
+#include <gnutls/crypto.h>
+#include <nettle/sha2.h>
+#include "vtls/gtls.h"
+#elif defined(USE_WOLFSSL)
+#include <wolfssl/options.h>
+#include <wolfssl/ssl.h>
+#include <wolfssl/quic.h>
+#include "vtls/wolfssl.h"
+#endif
+
+#include "urldata.h"
+#include "cfilters.h"
+#include "vtls/vtls.h"
+#include "vtls/vtls_scache.h"
+#include "vquic/vquic-tls.h"
+
+CURLcode Curl_vquic_tls_peer_init(struct Curl_peer *origin,
+                                  struct Curl_peer *peer,
+                                  struct ssl_primary_config *sslc,
+                                  struct ssl_peer *ssl_peer)
+{
+  char tls_id[80];
+
+#ifdef USE_OPENSSL
+  Curl_ossl_version(tls_id, sizeof(tls_id));
+#elif defined(USE_GNUTLS)
+  Curl_gtls_version(tls_id, sizeof(tls_id));
+#elif defined(USE_WOLFSSL)
+  Curl_wssl_version(tls_id, sizeof(tls_id));
+#else
+#error "no TLS lib in used, should not happen"
+  return CURLE_FAILED_INIT;
+#endif
+  if(ssl_peer->origin || ssl_peer->peer)
+    Curl_ssl_peer_cleanup(ssl_peer);
+  return Curl_ssl_peer_init(ssl_peer, origin, peer, sslc,
+                            tls_id, TRNSPRT_QUIC);
+}
+
+CURLcode Curl_vquic_tls_init(struct curl_tls_ctx *ctx,
+                             struct Curl_cfilter *cf,
+                             struct Curl_easy *data,
+                             struct ssl_peer *ssl_peer,
+                             const struct alpn_spec *alpns,
+                             Curl_vquic_tls_ctx_setup *cb_setup,
+                             void *cb_user_data, void *ssl_user_data,
+                             Curl_vquic_session_reuse_cb *session_reuse_cb)
+{
+#ifdef USE_OPENSSL
+  return Curl_ossl_ctx_init(&ctx->ossl, cf, data, ssl_peer, alpns,
+                            cb_setup, cb_user_data, NULL, ssl_user_data,
+                            session_reuse_cb);
+#elif defined(USE_GNUTLS)
+  return Curl_gtls_ctx_init(&ctx->gtls, cf, data, ssl_peer, alpns,
+                            cb_setup, cb_user_data, ssl_user_data,
+                            session_reuse_cb);
+#elif defined(USE_WOLFSSL)
+  return Curl_wssl_ctx_init(&ctx->wssl, cf, data, ssl_peer, alpns,
+                            cb_setup, cb_user_data,
+                            ssl_user_data, session_reuse_cb);
+#else
+#error "no TLS lib in used, should not happen"
+  return CURLE_FAILED_INIT;
+#endif
+}
+
+void Curl_vquic_tls_cleanup(struct curl_tls_ctx *ctx)
+{
+#ifdef USE_OPENSSL
+  if(ctx->ossl.ssl)
+    SSL_free(ctx->ossl.ssl);
+  if(ctx->ossl.ssl_ctx)
+    SSL_CTX_free(ctx->ossl.ssl_ctx);
+#elif defined(USE_GNUTLS)
+  if(ctx->gtls.session)
+    gnutls_deinit(ctx->gtls.session);
+  Curl_gtls_shared_creds_free(&ctx->gtls.shared_creds);
+#elif defined(USE_WOLFSSL)
+  if(ctx->wssl.ssl)
+    wolfSSL_free(ctx->wssl.ssl);
+  if(ctx->wssl.ssl_ctx)
+    wolfSSL_CTX_free(ctx->wssl.ssl_ctx);
+#endif
+  memset(ctx, 0, sizeof(*ctx));
+}
+
+CURLcode Curl_vquic_tls_before_recv(struct curl_tls_ctx *ctx,
+                                    struct Curl_cfilter *cf,
+                                    struct Curl_easy *data)
+{
+#ifdef USE_OPENSSL
+  if(!ctx->ossl.x509_store_setup) {
+    CURLcode result = Curl_ssl_setup_x509_store(cf, data, &ctx->ossl);
+    if(result)
+      return result;
+    ctx->ossl.x509_store_setup = TRUE;
+  }
+#elif defined(USE_WOLFSSL)
+  if(!ctx->wssl.x509_store_setup) {
+    CURLcode result = Curl_wssl_setup_x509_store(cf, data, &ctx->wssl);
+    if(result)
+      return result;
+  }
+#elif defined(USE_GNUTLS)
+  if(!ctx->gtls.shared_creds->trust_setup) {
+    CURLcode result = Curl_gtls_client_trust_setup(cf, data, &ctx->gtls);
+    if(result)
+      return result;
+  }
+#else
+  (void)ctx;
+  (void)cf;
+  (void)data;
+#endif
+  return CURLE_OK;
+}
+
+CURLcode Curl_vquic_tls_verify_peer(struct curl_tls_ctx *ctx,
+                                    struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    struct ssl_peer *peer)
+{
+  struct ssl_primary_config *conn_config;
+  CURLcode result = CURLE_OK;
+
+  conn_config = Curl_ssl_cf_get_primary_config(cf);
+  if(!conn_config)
+    return CURLE_FAILED_INIT;
+
+#ifdef USE_OPENSSL
+  (void)conn_config;
+  result = Curl_ossl_check_peer_cert(cf, data, &ctx->ossl, peer);
+#elif defined(USE_GNUTLS)
+  result = Curl_gtls_verifyserver(cf, data, ctx->gtls.session,
+                                  conn_config, &data->set.ssl, peer,
+                                  data->set.str[STRING_SSL_PINNEDPUBLICKEY]);
+  if(result)
+    return result;
+#elif defined(USE_WOLFSSL)
+  (void)data;
+  if(conn_config->verifyhost) {
+    WOLFSSL_X509 *cert = wolfSSL_get_peer_certificate(ctx->wssl.ssl);
+    if(!cert)
+      result = CURLE_OUT_OF_MEMORY;
+    else if(peer->sni &&
+            (wolfSSL_X509_check_host(cert, peer->sni, strlen(peer->sni), 0,
+                                     NULL) == WOLFSSL_FAILURE))
+      result = CURLE_PEER_FAILED_VERIFICATION;
+    else if(!peer->sni &&
+            (wolfSSL_X509_check_ip_asc(cert, peer->origin->hostname,
+                                       0) == WOLFSSL_FAILURE))
+      result = CURLE_PEER_FAILED_VERIFICATION;
+    wolfSSL_X509_free(cert);
+  }
+  if(!result)
+    result = Curl_wssl_verify_pinned(cf, data, &ctx->wssl);
+#endif
+  /* on error, remove any session we might have in the pool */
+  if(result)
+    Curl_ssl_scache_remove_all(cf, data, peer->scache_key);
+  return result;
+}
+
+bool Curl_vquic_tls_get_ssl_info(struct curl_tls_ctx *ctx,
+                                 bool give_ssl_ctx,
+                                 struct curl_tlssessioninfo *info)
+{
+#ifdef USE_OPENSSL
+  info->backend = CURLSSLBACKEND_OPENSSL;
+  info->internals = give_ssl_ctx ?
+                    (void *)ctx->ossl.ssl_ctx : (void *)ctx->ossl.ssl;
+  return TRUE;
+#elif defined(USE_GNUTLS)
+  (void)give_ssl_ctx; /* gnutls always returns its session */
+  info->backend = CURLSSLBACKEND_GNUTLS;
+  info->internals = ctx->gtls.session;
+  return TRUE;
+#elif defined(USE_WOLFSSL)
+  info->backend = CURLSSLBACKEND_WOLFSSL;
+  info->internals = give_ssl_ctx ?
+                    (void *)ctx->wssl.ssl_ctx : (void *)ctx->wssl.ssl;
+  return TRUE;
+#else
+  return FALSE;
+#endif
+}
+
+void Curl_vquic_report_handshake(struct curl_tls_ctx *ctx,
+                                 struct Curl_cfilter *cf,
+                                 struct Curl_easy *data)
+{
+  (void)cf;
+#ifdef USE_OPENSSL
+  (void)cf;
+  Curl_ossl_report_handshake(data, &ctx->ossl);
+#elif defined(USE_GNUTLS)
+  Curl_gtls_report_handshake(data, &ctx->gtls);
+#elif defined(USE_WOLFSSL)
+  Curl_wssl_report_handshake(data, &ctx->wssl);
+#else
+  (void)data;
+  (void)ctx;
+#endif
+}
+
+#endif /* !USE_HTTP3 && (USE_OPENSSL || USE_GNUTLS || USE_WOLFSSL) */
diff --git a/third-party/curl/lib/vquic/vquic-tls.h b/third-party/curl/lib/vquic/vquic-tls.h
new file mode 100644
index 0000000000..e8d2418b06
--- /dev/null
+++ b/third-party/curl/lib/vquic/vquic-tls.h
@@ -0,0 +1,125 @@
+#ifndef HEADER_CURL_VQUIC_TLS_H
+#define HEADER_CURL_VQUIC_TLS_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#if defined(USE_HTTP3) && \
+  (defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_WOLFSSL))
+
+#include "bufq.h"
+#include "vtls/vtls.h"
+#include "vtls/vtls_int.h"
+
+#include "vtls/openssl.h"
+#include "vtls/wolfssl.h"
+
+struct ssl_peer;
+struct Curl_ssl_session;
+struct curl_tlssessioninfo;
+
+struct curl_tls_ctx {
+#ifdef USE_OPENSSL
+  struct ossl_ctx ossl;
+#elif defined(USE_GNUTLS)
+  struct gtls_ctx gtls;
+#elif defined(USE_WOLFSSL)
+  struct wssl_ctx wssl;
+#endif
+};
+
+/**
+ * Callback passed to `Curl_vquic_tls_init()` that can
+ * do early initializations on the not otherwise configured TLS
+ * instances created. This varies by TLS backend:
+ * - openssl/wolfssl: SSL_CTX* has been created
+ * - gnutls: gtls_client_init() has run
+ */
+typedef CURLcode Curl_vquic_tls_ctx_setup(struct Curl_cfilter *cf,
+                                          struct Curl_easy *data,
+                                          void *cb_user_data);
+
+typedef CURLcode Curl_vquic_session_reuse_cb(struct Curl_cfilter *cf,
+                                             struct Curl_easy *data,
+                                             struct alpn_spec *alpns,
+                                             struct Curl_ssl_session *scs,
+                                             bool *do_early_data);
+
+CURLcode Curl_vquic_tls_peer_init(struct Curl_peer *origin,
+                                  struct Curl_peer *peer,
+                                  struct ssl_primary_config *sslc,
+                                  struct ssl_peer *ssl_peer);
+
+/**
+ * Initialize the QUIC TLS instances based of the SSL configurations
+ * for the connection filter, transfer and peer.
+ * @param ctx              the TLS context to initialize
+ * @param cf               the connection filter involved
+ * @param data             the transfer involved
+ * @param ssl_peer         the SSL peer to be connected to
+ * @param alpns            the ALPN specifications to negotiate, may be NULL
+ * @param cb_setup         optional callback for early TLS config
+ * @param cb_user_data     user_data param for callback
+ * @param ssl_user_data    optional pointer to set in TLS application context
+ * @param session_reuse_cb callback to handle session reuse, signal early data
+ */
+CURLcode Curl_vquic_tls_init(struct curl_tls_ctx *ctx,
+                             struct Curl_cfilter *cf,
+                             struct Curl_easy *data,
+                             struct ssl_peer *ssl_peer,
+                             const struct alpn_spec *alpns,
+                             Curl_vquic_tls_ctx_setup *cb_setup,
+                             void *cb_user_data,
+                             void *ssl_user_data,
+                             Curl_vquic_session_reuse_cb *session_reuse_cb);
+
+/**
+ * Cleanup all data that has been initialized.
+ */
+void Curl_vquic_tls_cleanup(struct curl_tls_ctx *ctx);
+
+CURLcode Curl_vquic_tls_before_recv(struct curl_tls_ctx *ctx,
+                                    struct Curl_cfilter *cf,
+                                    struct Curl_easy *data);
+
+/**
+ * After the QUIC basic handshake has been, verify that the peer
+ * (and its certificate) fulfill our requirements.
+ */
+CURLcode Curl_vquic_tls_verify_peer(struct curl_tls_ctx *ctx,
+                                    struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    struct ssl_peer *peer);
+
+bool Curl_vquic_tls_get_ssl_info(struct curl_tls_ctx *ctx,
+                                 bool give_ssl_ctx,
+                                 struct curl_tlssessioninfo *info);
+
+void Curl_vquic_report_handshake(struct curl_tls_ctx *ctx,
+                                 struct Curl_cfilter *cf,
+                                 struct Curl_easy *data);
+
+#endif /* !USE_HTTP3 && (USE_OPENSSL || USE_GNUTLS || USE_WOLFSSL) */
+
+#endif /* HEADER_CURL_VQUIC_TLS_H */
diff --git a/third-party/curl/lib/vquic/vquic.c b/third-party/curl/lib/vquic/vquic.c
index 9a1a1bbb3c..dfb8346c1a 100644
--- a/third-party/curl/lib/vquic/vquic.c
+++ b/third-party/curl/lib/vquic/vquic.c
@@ -21,54 +21,50 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
-/* WIP, experimental: use recvmmsg() on linux
- * we have no configure check, yet
- * and also it is only available for _GNU_SOURCE, which
- * we do not use otherwise.
-#define HAVE_SENDMMSG
- */
-#if defined(HAVE_SENDMMSG)
-#define _GNU_SOURCE
-#include <sys/socket.h>
-#undef _GNU_SOURCE
-#endif
-
 #include "curl_setup.h"
-
-#ifdef HAVE_FCNTL_H
-#include <fcntl.h>
-#endif
 #include "urldata.h"
-#include "bufq.h"
-#include "dynbuf.h"
-#include "cfilters.h"
+#include "vquic/vquic.h"
+
 #include "curl_trc.h"
-#include "curl_msh3.h"
-#include "curl_ngtcp2.h"
-#include "curl_quiche.h"
-#include "rand.h"
-#include "vquic.h"
-#include "vquic_int.h"
-#include "strerror.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_HTTP3)
 
-
-#ifdef ENABLE_QUIC
-
-#ifdef O_BINARY
-#define QLOGMODE O_WRONLY|O_CREAT|O_BINARY
-#else
-#define QLOGMODE O_WRONLY|O_CREAT
+#ifdef HAVE_NETINET_UDP_H
+#include <netinet/udp.h>
 #endif
 
+#ifdef USE_NGHTTP3
+#include <nghttp3/nghttp3.h>
+#endif
+
+#include "bufq.h"
+#include "curlx/dynbuf.h"
+#include "curlx/fopen.h"
+#include "cfilters.h"
+#include "vquic/cf-ngtcp2.h"
+#include "vquic/cf-ngtcp2-cmn.h"
+#include "vquic/cf-ngtcp2-proxy.h"
+#include "vquic/cf-quiche.h"
+#include "multiif.h"
+#include "progress.h"
+#include "rand.h"
+#include "vquic/vquic_int.h"
+#include "curlx/strerr.h"
+#include "curlx/strparse.h"
+
+
 #define NW_CHUNK_SIZE     (64 * 1024)
-#define NW_SEND_CHUNKS    2
+#define NW_SEND_CHUNKS    1
 
+int Curl_vquic_init(void)
+{
+#if defined(USE_NGTCP2) && defined(OPENSSL_QUIC_API2)
+  if(ngtcp2_crypto_ossl_init())
+    return 0;
+#endif
+
+  return 1;
+}
 
 void Curl_quic_ver(char *p, size_t len)
 {
@@ -76,12 +72,11 @@ void Curl_quic_ver(char *p, size_t len)
   Curl_ngtcp2_ver(p, len);
 #elif defined(USE_QUICHE)
   Curl_quiche_ver(p, len);
-#elif defined(USE_MSH3)
-  Curl_msh3_ver(p, len);
 #endif
 }
 
-CURLcode vquic_ctx_init(struct cf_quic_ctx *qctx)
+CURLcode vquic_ctx_init(struct Curl_easy *data,
+                        struct cf_quic_ctx *qctx)
 {
   Curl_bufq_init2(&qctx->sendbuf, NW_CHUNK_SIZE, NW_SEND_CHUNKS,
                   BUFQ_OPT_SOFT_LIMIT);
@@ -92,14 +87,15 @@ CURLcode vquic_ctx_init(struct cf_quic_ctx *qctx)
 #endif
 #ifdef DEBUGBUILD
   {
-    char *p = getenv("CURL_DBG_QUIC_WBLOCK");
+    const char *p = getenv("CURL_DBG_QUIC_WBLOCK");
     if(p) {
-      long l = strtol(p, NULL, 10);
-      if(l >= 0 && l <= 100)
+      curl_off_t l;
+      if(!curlx_str_number(&p, &l, 100))
         qctx->wblock_percent = (int)l;
     }
   }
 #endif
+  vquic_ctx_set_time(qctx, Curl_pgrs_now(data));
 
   return CURLE_OK;
 }
@@ -109,6 +105,18 @@ void vquic_ctx_free(struct cf_quic_ctx *qctx)
   Curl_bufq_free(&qctx->sendbuf);
 }
 
+void vquic_ctx_set_time(struct cf_quic_ctx *qctx,
+                        const struct curltime *pnow)
+{
+  qctx->last_op = *pnow;
+}
+
+void vquic_ctx_update_time(struct cf_quic_ctx *qctx,
+                           const struct curltime *pnow)
+{
+  qctx->last_op = *pnow;
+}
+
 static CURLcode send_packet_no_gso(struct Curl_cfilter *cf,
                                    struct Curl_easy *data,
                                    struct cf_quic_ctx *qctx,
@@ -121,17 +129,18 @@ static CURLcode do_sendmsg(struct Curl_cfilter *cf,
                            const uint8_t *pkt, size_t pktlen, size_t gsolen,
                            size_t *psent)
 {
+  CURLcode result = CURLE_OK;
 #ifdef HAVE_SENDMSG
   struct iovec msg_iov;
-  struct msghdr msg = {0};
-  ssize_t sent;
+  struct msghdr msg = { 0 };
+  ssize_t rv;
 #if defined(__linux__) && defined(UDP_SEGMENT)
   uint8_t msg_ctrl[32];
   struct cmsghdr *cm;
 #endif
 
   *psent = 0;
-  msg_iov.iov_base = (uint8_t *)pkt;
+  msg_iov.iov_base = (uint8_t *)CURL_UNCONST(pkt);
   msg_iov.iov_len = pktlen;
   msg.msg_iov = &msg_iov;
   msg.msg_iovlen = 1;
@@ -140,9 +149,10 @@ static CURLcode do_sendmsg(struct Curl_cfilter *cf,
   if(pktlen > gsolen) {
     /* Only set this, when we need it. macOS, for example,
      * does not seem to like a msg_control of length 0. */
+    memset(msg_ctrl, 0, sizeof(msg_ctrl));
     msg.msg_control = msg_ctrl;
-    assert(sizeof(msg_ctrl) >= CMSG_SPACE(sizeof(uint16_t)));
-    msg.msg_controllen = CMSG_SPACE(sizeof(uint16_t));
+    assert(sizeof(msg_ctrl) >= CMSG_SPACE(sizeof(int)));
+    msg.msg_controllen = CMSG_SPACE(sizeof(int));
     cm = CMSG_FIRSTHDR(&msg);
     cm->cmsg_level = SOL_UDP;
     cm->cmsg_type = UDP_SEGMENT;
@@ -151,68 +161,78 @@ static CURLcode do_sendmsg(struct Curl_cfilter *cf,
   }
 #endif
 
-
-  while((sent = sendmsg(qctx->sockfd, &msg, 0)) == -1 && SOCKERRNO == EINTR)
+  while((rv = sendmsg(qctx->sockfd, &msg, 0)) == -1 && SOCKERRNO == SOCKEINTR)
     ;
 
-  if(sent == -1) {
-    switch(SOCKERRNO) {
-    case EAGAIN:
-#if EAGAIN != EWOULDBLOCK
-    case EWOULDBLOCK:
-#endif
+  if(!curlx_sztouz(rv, psent)) {
+    int sockerr = SOCKERRNO;
+    if(SOCK_EAGAIN(sockerr))
       return CURLE_AGAIN;
-    case EMSGSIZE:
-      /* UDP datagram is too large; caused by PMTUD. Just let it be lost. */
+    switch(sockerr) {
+    case SOCKEMSGSIZE:
+      /* UDP datagram is too large; caused by PMTUD. Let it be lost. */
+      *psent = pktlen;
       break;
     case EIO:
       if(pktlen > gsolen) {
         /* GSO failure */
-        failf(data, "sendmsg() returned %zd (errno %d); disable GSO", sent,
-              SOCKERRNO);
+        infof(data, "sendmsg() returned %zd (errno %d); disable GSO", rv,
+              sockerr);
         qctx->no_gso = TRUE;
         return send_packet_no_gso(cf, data, qctx, pkt, pktlen, gsolen, psent);
       }
-      /* FALLTHROUGH */
+      FALLTHROUGH();
     default:
-      failf(data, "sendmsg() returned %zd (errno %d)", sent, SOCKERRNO);
-      return CURLE_SEND_ERROR;
+      failf(data, "sendmsg() returned %zd (errno %d)", rv, sockerr);
+      result = CURLE_SEND_ERROR;
+      goto out;
     }
   }
-  else {
-    assert(pktlen == (size_t)sent);
+  else if(pktlen != *psent) {
+    failf(data, "sendmsg() sent only %zu/%zu bytes", *psent, pktlen);
+    result = CURLE_SEND_ERROR;
+    goto out;
   }
 #else
-  ssize_t sent;
+  ssize_t rv;
   (void)gsolen;
 
   *psent = 0;
 
-  while((sent = send(qctx->sockfd,
-                     (const char *)pkt, (SEND_TYPE_ARG3)pktlen, 0)) == -1 &&
-        SOCKERRNO == EINTR)
+  while((rv = swrite(qctx->sockfd, pkt, pktlen)) == -1 &&
+        SOCKERRNO == SOCKEINTR)
     ;
 
-  if(sent == -1) {
-    if(SOCKERRNO == EAGAIN || SOCKERRNO == EWOULDBLOCK) {
-      return CURLE_AGAIN;
+  if(!curlx_sztouz(rv, psent)) {
+    if(SOCK_EAGAIN(SOCKERRNO)) {
+      result = CURLE_AGAIN;
+      goto out;
     }
     else {
-      failf(data, "send() returned %zd (errno %d)", sent, SOCKERRNO);
-      if(SOCKERRNO != EMSGSIZE) {
-        return CURLE_SEND_ERROR;
+      if(SOCKERRNO != SOCKEMSGSIZE) {
+        failf(data, "send() returned %zd (errno %d)", rv, SOCKERRNO);
+        result = CURLE_SEND_ERROR;
+        goto out;
       }
-      /* UDP datagram is too large; caused by PMTUD. Just let it be
-         lost. */
+      /* UDP datagram is too large; caused by PMTUD. Let it be lost. */
+      *psent = pktlen;
     }
   }
 #endif
   (void)cf;
-  *psent = pktlen;
 
-  return CURLE_OK;
+out:
+  return result;
 }
 
+#ifdef CURLVERBOSE
+#ifdef HAVE_SENDMSG
+#define VQUIC_SEND_METHOD   "sendmsg"
+#else
+#define VQUIC_SEND_METHOD   "send"
+#endif
+#endif
+
 static CURLcode send_packet_no_gso(struct Curl_cfilter *cf,
                                    struct Curl_easy *data,
                                    struct cf_quic_ctx *qctx,
@@ -220,20 +240,64 @@ static CURLcode send_packet_no_gso(struct Curl_cfilter *cf,
                                    size_t gsolen, size_t *psent)
 {
   const uint8_t *p, *end = pkt + pktlen;
-  size_t sent;
+  size_t sent, len;
+  CURLcode result = CURLE_OK;
+  VERBOSE(size_t calls = 0);
 
   *psent = 0;
 
   for(p = pkt; p < end; p += gsolen) {
-    size_t len = CURLMIN(gsolen, (size_t)(end - p));
-    CURLcode curlcode = do_sendmsg(cf, data, qctx, p, len, len, &sent);
-    if(curlcode != CURLE_OK) {
-      return curlcode;
+    len = CURLMIN(gsolen, (size_t)(end - p));
+    result = do_sendmsg(cf, data, qctx, p, len, len, &sent);
+    if(result)
+      goto out;
+    *psent += sent;
+    VERBOSE(++calls);
+  }
+out:
+  CURL_TRC_CF(data, cf,
+              "vquic_%s(len=%zu, gso=%zu, calls=%zu) -> %d, sent=%zu",
+              VQUIC_SEND_METHOD, pktlen, gsolen, calls, (int)result, *psent);
+  return result;
+}
+
+/* Split QUIC payload by datagram (gso) boundaries when sending over a
+ * non-UDP lower filter (for example CONNECT-UDP proxy tunnel). */
+static CURLcode send_packet_no_gso_cf(struct Curl_cfilter *cf,
+                                      struct Curl_easy *data,
+                                      const uint8_t *pkt, size_t pktlen,
+                                      size_t gsolen, size_t *psent)
+{
+  const uint8_t *p, *end = pkt + pktlen;
+  size_t sent, len;
+  CURLcode result = CURLE_OK;
+  VERBOSE(size_t calls = 0);
+
+  *psent = 0;
+
+  /* Send one datagram-sized chunk per call into the lower filter. */
+  for(p = pkt; p < end; p += len) {
+    len = CURLMIN(gsolen, (size_t)(end - p));
+    result = Curl_conn_cf_send(cf->next, data, p, len, FALSE, &sent);
+    /* Report forward progress even if we return CURLE_AGAIN later. */
+    VERBOSE(++calls);
+    /* Preserve lower-filter errors (including CURLE_AGAIN). */
+    if(result)
+      goto out;
+
+    if(sent != len) {
+      /* We can only send the complete datagram, not parts. */
+      result = CURLE_SEND_ERROR;
+      goto out;
     }
     *psent += sent;
   }
 
-  return CURLE_OK;
+out:
+  CURL_TRC_CF(data, cf,
+              "vquic_cf_send(len=%zu, gso=%zu, calls=%zu) -> %d, sent=%zu",
+              pktlen, gsolen, calls, (int)result, *psent);
+  return result;
 }
 
 static CURLcode vquic_send_packets(struct Curl_cfilter *cf,
@@ -242,22 +306,31 @@ static CURLcode vquic_send_packets(struct Curl_cfilter *cf,
                                    const uint8_t *pkt, size_t pktlen,
                                    size_t gsolen, size_t *psent)
 {
+  CURLcode result;
 #ifdef DEBUGBUILD
   /* simulate network blocking/partial writes */
   if(qctx->wblock_percent > 0) {
     unsigned char c;
+    *psent = 0;
     Curl_rand(data, &c, 1);
-    if(c >= ((100-qctx->wblock_percent)*256/100)) {
+    if(c >= ((100 - qctx->wblock_percent) * 256 / 100)) {
       CURL_TRC_CF(data, cf, "vquic_flush() simulate EWOULDBLOCK");
       return CURLE_AGAIN;
     }
   }
 #endif
   if(qctx->no_gso && pktlen > gsolen) {
-    return send_packet_no_gso(cf, data, qctx, pkt, pktlen, gsolen, psent);
+    result = send_packet_no_gso(cf, data, qctx, pkt, pktlen, gsolen, psent);
   }
-
-  return do_sendmsg(cf, data, qctx, pkt, pktlen, gsolen, psent);
+  else {
+    result = do_sendmsg(cf, data, qctx, pkt, pktlen, gsolen, psent);
+    CURL_TRC_CF(data, cf,
+                "vquic_%s(len=%zu, gso=%zu, calls=1) -> %d, sent=%zu",
+                VQUIC_SEND_METHOD, pktlen, gsolen, (int)result, *psent);
+  }
+  if(!result)
+    qctx->last_io = qctx->last_op;
+  return result;
 }
 
 CURLcode vquic_flush(struct Curl_cfilter *cf, struct Curl_easy *data,
@@ -276,9 +349,22 @@ CURLcode vquic_flush(struct Curl_cfilter *cf, struct Curl_easy *data,
         blen = qctx->split_len;
     }
 
-    result = vquic_send_packets(cf, data, qctx, buf, blen, gsolen, &sent);
-    CURL_TRC_CF(data, cf, "vquic_send(len=%zu, gso=%zu) -> %d, sent=%zu",
-                blen, gsolen, result, sent);
+    if(qctx->sockfd != CURL_SOCKET_BAD) {
+      /* Direct UDP socket (via happy eyeballs) */
+      result = vquic_send_packets(cf, data, qctx, buf, blen, gsolen, &sent);
+    }
+    else {
+      /* Tunneled QUIC (CONNECT-UDP through proxy) */
+      if(gsolen && (blen > gsolen)) {
+        /* Send one datagram at a time to preserve packet boundaries. */
+        result = send_packet_no_gso_cf(cf, data, buf, blen, gsolen, &sent);
+      }
+      else {
+        /* No GSO aggregate to split, regular lower-filter send is enough. */
+        result = Curl_conn_cf_send(cf->next, data, buf, blen, FALSE, &sent);
+      }
+    }
+
     if(result) {
       if(result == CURLE_AGAIN) {
         Curl_bufq_skip(&qctx->sendbuf, sent);
@@ -295,7 +381,7 @@ CURLcode vquic_flush(struct Curl_cfilter *cf, struct Curl_easy *data,
 }
 
 CURLcode vquic_send(struct Curl_cfilter *cf, struct Curl_easy *data,
-                        struct cf_quic_ctx *qctx, size_t gsolen)
+                    struct cf_quic_ctx *qctx, size_t gsolen)
 {
   qctx->gsolen = gsolen;
   return vquic_flush(cf, data, qctx);
@@ -310,84 +396,143 @@ CURLcode vquic_send_tail_split(struct Curl_cfilter *cf, struct Curl_easy *data,
   qctx->split_gsolen = gsolen;
   qctx->gsolen = tail_gsolen;
   CURL_TRC_CF(data, cf, "vquic_send_tail_split: [%zu gso=%zu][%zu gso=%zu]",
-              qctx->split_len, qctx->split_gsolen,
-              tail_len, qctx->gsolen);
+              qctx->split_len, qctx->split_gsolen, tail_len, qctx->gsolen);
   return vquic_flush(cf, data, qctx);
 }
 
+#if defined(HAVE_SENDMMSG) || defined(HAVE_SENDMSG)
+static size_t vquic_msghdr_get_udp_gro(struct msghdr *msg)
+{
+  int gso_size = 0;
+#if defined(__linux__) && defined(UDP_GRO)
+  struct cmsghdr *cmsg;
+
+  /* Workaround musl CMSG_NXTHDR issue */
+#if defined(__clang__) && !defined(__GLIBC__)
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wsign-compare"
+#pragma clang diagnostic ignored "-Wcast-align"
+#endif
+  for(cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) {
+#if defined(__clang__) && !defined(__GLIBC__)
+#pragma clang diagnostic pop
+#endif
+    if(cmsg->cmsg_level == SOL_UDP && cmsg->cmsg_type == UDP_GRO) {
+      memcpy(&gso_size, CMSG_DATA(cmsg), sizeof(gso_size));
+
+      break;
+    }
+  }
+#endif
+  (void)msg;
+
+  return (size_t)gso_size;
+}
+#endif
+
 #ifdef HAVE_SENDMMSG
 static CURLcode recvmmsg_packets(struct Curl_cfilter *cf,
                                  struct Curl_easy *data,
                                  struct cf_quic_ctx *qctx,
                                  size_t max_pkts,
-                                 vquic_recv_pkt_cb *recv_cb, void *userp)
+                                 vquic_recv_pkts_cb *recv_cb, void *userp)
 {
+#if defined(__linux__) && defined(UDP_GRO)
+#define MMSG_NUM  16
+#define UDP_GRO_CNT_MAX  64
+#else
 #define MMSG_NUM  64
+#define UDP_GRO_CNT_MAX  1
+#endif
+#define MSG_BUF_SIZE  (UDP_GRO_CNT_MAX * 1500)
   struct iovec msg_iov[MMSG_NUM];
   struct mmsghdr mmsg[MMSG_NUM];
-  uint8_t bufs[MMSG_NUM][2*1024];
+  uint8_t msg_ctrl[MMSG_NUM * CMSG_SPACE(sizeof(int))];
   struct sockaddr_storage remote_addr[MMSG_NUM];
-  size_t total_nread, pkts;
+  size_t total_nread = 0, pkts = 0;
+#ifdef CURLVERBOSE
+  size_t calls = 0;
+#endif
   int mcount, i, n;
   char errstr[STRERROR_LEN];
   CURLcode result = CURLE_OK;
+  size_t gso_size;
+  char *sockbuf = NULL;
+  uint8_t (*bufs)[MSG_BUF_SIZE] = NULL;
 
   DEBUGASSERT(max_pkts > 0);
-  pkts = 0;
+  result = Curl_multi_xfer_sockbuf_borrow(data, MMSG_NUM * MSG_BUF_SIZE,
+                                          &sockbuf);
+  if(result)
+    goto out;
+  bufs = (uint8_t (*)[MSG_BUF_SIZE])sockbuf;
+
   total_nread = 0;
   while(pkts < max_pkts) {
-    n = (int)CURLMIN(MMSG_NUM, max_pkts);
+    n = (int)CURLMIN(CURLMIN(MMSG_NUM, IOV_MAX), max_pkts);
     memset(&mmsg, 0, sizeof(mmsg));
     for(i = 0; i < n; ++i) {
       msg_iov[i].iov_base = bufs[i];
-      msg_iov[i].iov_len = (int)sizeof(bufs[i]);
+      msg_iov[i].iov_len = sizeof(bufs[i]);
       mmsg[i].msg_hdr.msg_iov = &msg_iov[i];
       mmsg[i].msg_hdr.msg_iovlen = 1;
       mmsg[i].msg_hdr.msg_name = &remote_addr[i];
       mmsg[i].msg_hdr.msg_namelen = sizeof(remote_addr[i]);
+      mmsg[i].msg_hdr.msg_control = &msg_ctrl[i * CMSG_SPACE(sizeof(int))];
+      mmsg[i].msg_hdr.msg_controllen = CMSG_SPACE(sizeof(int));
     }
 
     while((mcount = recvmmsg(qctx->sockfd, mmsg, n, 0, NULL)) == -1 &&
-          SOCKERRNO == EINTR)
+          (SOCKERRNO == SOCKEINTR || SOCKERRNO == SOCKEMSGSIZE))
       ;
     if(mcount == -1) {
-      if(SOCKERRNO == EAGAIN || SOCKERRNO == EWOULDBLOCK) {
+      if(SOCK_EAGAIN(SOCKERRNO)) {
         CURL_TRC_CF(data, cf, "ingress, recvmmsg -> EAGAIN");
         goto out;
       }
-      if(!cf->connected && SOCKERRNO == ECONNREFUSED) {
-        const char *r_ip = NULL;
-        int r_port = 0;
-        Curl_cf_socket_peek(cf->next, data, NULL, NULL,
-                            &r_ip, &r_port, NULL, NULL);
-        failf(data, "QUIC: connection to %s port %u refused",
-              r_ip, r_port);
+      if(!cf->connected && SOCKERRNO == SOCKECONNREFUSED) {
+        struct ip_quadruple ip;
+        if(!Curl_cf_socket_peek(cf->next, data, NULL, NULL, &ip))
+          failf(data, "QUIC: connection to %s port %u refused",
+                ip.remote_ip, ip.remote_port);
         result = CURLE_COULDNT_CONNECT;
         goto out;
       }
-      Curl_strerror(SOCKERRNO, errstr, sizeof(errstr));
-      failf(data, "QUIC: recvmsg() unexpectedly returned %d (errno=%d; %s)",
-                  mcount, SOCKERRNO, errstr);
+      curlx_strerror(SOCKERRNO, errstr, sizeof(errstr));
+      failf(data, "QUIC: recvmmsg() unexpectedly returned %d (errno=%d; %s)",
+            mcount, SOCKERRNO, errstr);
       result = CURLE_RECV_ERROR;
       goto out;
     }
 
-    CURL_TRC_CF(data, cf, "recvmmsg() -> %d packets", mcount);
-    pkts += mcount;
+    VERBOSE(++calls);
     for(i = 0; i < mcount; ++i) {
+      /* A zero-length UDP packet is no QUIC packet. Ignore. */
+      if(!mmsg[i].msg_len) {
+        ++pkts;
+        continue;
+      }
       total_nread += mmsg[i].msg_len;
-      result = recv_cb(bufs[i], mmsg[i].msg_len,
-                       mmsg[i].msg_hdr.msg_name, mmsg[i].msg_hdr.msg_namelen,
-                       0, userp);
+
+      gso_size = vquic_msghdr_get_udp_gro(&mmsg[i].msg_hdr);
+      if(gso_size == 0)
+        gso_size = mmsg[i].msg_len;
+
+      result = recv_cb(bufs[i], mmsg[i].msg_len, gso_size,
+                       mmsg[i].msg_hdr.msg_name,
+                       mmsg[i].msg_hdr.msg_namelen, 0, userp);
       if(result)
         goto out;
+      pkts += (mmsg[i].msg_len + gso_size - 1) / gso_size;
     }
   }
 
 out:
   if(total_nread || result)
-    CURL_TRC_CF(data, cf, "recvd %zu packets with %zu bytes -> %d",
-                pkts, total_nread, result);
+    CURL_TRC_CF(data, cf,
+                "vquic_recvmmsg(len=%zu, packets=%zu, calls=%zu) -> %d",
+                total_nread, pkts, calls, (int)result);
+  Curl_multi_xfer_sockbuf_release(data, sockbuf);
   return result;
 }
 
@@ -396,64 +541,81 @@ static CURLcode recvmsg_packets(struct Curl_cfilter *cf,
                                 struct Curl_easy *data,
                                 struct cf_quic_ctx *qctx,
                                 size_t max_pkts,
-                                vquic_recv_pkt_cb *recv_cb, void *userp)
+                                vquic_recv_pkts_cb *recv_cb, void *userp)
 {
   struct iovec msg_iov;
   struct msghdr msg;
-  uint8_t buf[64*1024];
+  uint8_t buf[64 * 1024];
   struct sockaddr_storage remote_addr;
-  size_t total_nread, pkts;
-  ssize_t nread;
+  size_t total_nread, pkts, calls;
+  ssize_t rc;
+  size_t nread;
   char errstr[STRERROR_LEN];
   CURLcode result = CURLE_OK;
-
-  msg_iov.iov_base = buf;
-  msg_iov.iov_len = (int)sizeof(buf);
-
-  memset(&msg, 0, sizeof(msg));
-  msg.msg_iov = &msg_iov;
-  msg.msg_iovlen = 1;
+  uint8_t msg_ctrl[CMSG_SPACE(sizeof(int))];
+  size_t gso_size;
 
   DEBUGASSERT(max_pkts > 0);
-  for(pkts = 0, total_nread = 0; pkts < max_pkts;) {
+  for(pkts = 0, total_nread = 0, calls = 0; pkts < max_pkts;) {
+    /* fully initialize this on each call to `recvmsg()`. There seem to
+     * operating systems out there that mess with `msg_iov.iov_len`. */
+    memset(&msg, 0, sizeof(msg));
+    msg_iov.iov_base = buf;
+    msg_iov.iov_len = sizeof(buf);
+    msg.msg_iov = &msg_iov;
+    msg.msg_iovlen = 1;
+    msg.msg_control = msg_ctrl;
     msg.msg_name = &remote_addr;
     msg.msg_namelen = sizeof(remote_addr);
-    while((nread = recvmsg(qctx->sockfd, &msg, 0)) == -1 &&
-          SOCKERRNO == EINTR)
+    msg.msg_controllen = sizeof(msg_ctrl);
+
+    while((rc = recvmsg(qctx->sockfd, &msg, 0)) == -1 &&
+          (SOCKERRNO == SOCKEINTR || SOCKERRNO == SOCKEMSGSIZE))
       ;
-    if(nread == -1) {
-      if(SOCKERRNO == EAGAIN || SOCKERRNO == EWOULDBLOCK) {
+    if(!curlx_sztouz(rc, &nread)) {
+      if(SOCK_EAGAIN(SOCKERRNO)) {
         goto out;
       }
-      if(!cf->connected && SOCKERRNO == ECONNREFUSED) {
-        const char *r_ip = NULL;
-        int r_port = 0;
-        Curl_cf_socket_peek(cf->next, data, NULL, NULL,
-                            &r_ip, &r_port, NULL, NULL);
-        failf(data, "QUIC: connection to %s port %u refused",
-              r_ip, r_port);
+      if(!cf->connected && SOCKERRNO == SOCKECONNREFUSED) {
+        struct ip_quadruple ip;
+        if(!Curl_cf_socket_peek(cf->next, data, NULL, NULL, &ip))
+          failf(data, "QUIC: connection to %s port %u refused",
+                ip.remote_ip, ip.remote_port);
         result = CURLE_COULDNT_CONNECT;
         goto out;
       }
-      Curl_strerror(SOCKERRNO, errstr, sizeof(errstr));
+      curlx_strerror(SOCKERRNO, errstr, sizeof(errstr));
       failf(data, "QUIC: recvmsg() unexpectedly returned %zd (errno=%d; %s)",
-                  nread, SOCKERRNO, errstr);
+            rc, SOCKERRNO, errstr);
       result = CURLE_RECV_ERROR;
       goto out;
     }
 
-    ++pkts;
-    total_nread += (size_t)nread;
-    result = recv_cb(buf, (size_t)nread, msg.msg_name, msg.msg_namelen,
-                     0, userp);
+    total_nread += nread;
+    ++calls;
+
+    /* A 0-length UDP packet is no QUIC packet */
+    if(!nread) {
+      ++pkts;
+      continue;
+    }
+
+    gso_size = vquic_msghdr_get_udp_gro(&msg);
+    if(gso_size == 0)
+      gso_size = nread;
+
+    result = recv_cb(buf, nread, gso_size,
+                     msg.msg_name, msg.msg_namelen, 0, userp);
     if(result)
       goto out;
+    pkts += (nread + gso_size - 1) / gso_size;
   }
 
 out:
   if(total_nread || result)
-    CURL_TRC_CF(data, cf, "recvd %zu packets with %zu bytes -> %d",
-                pkts, total_nread, result);
+    CURL_TRC_CF(data, cf,
+                "vquic_recvmsg(len=%zu, packets=%zu, calls=%zu) -> %d",
+                total_nread, pkts, calls, (int)result);
   return result;
 }
 
@@ -462,49 +624,53 @@ static CURLcode recvfrom_packets(struct Curl_cfilter *cf,
                                  struct Curl_easy *data,
                                  struct cf_quic_ctx *qctx,
                                  size_t max_pkts,
-                                 vquic_recv_pkt_cb *recv_cb, void *userp)
+                                 vquic_recv_pkts_cb *recv_cb, void *userp)
 {
-  uint8_t buf[64*1024];
+  uint8_t buf[64 * 1024];
   int bufsize = (int)sizeof(buf);
   struct sockaddr_storage remote_addr;
   socklen_t remote_addrlen = sizeof(remote_addr);
-  size_t total_nread, pkts;
-  ssize_t nread;
+  size_t total_nread, pkts, calls = 0, nread;
+  ssize_t rv;
   char errstr[STRERROR_LEN];
   CURLcode result = CURLE_OK;
 
   DEBUGASSERT(max_pkts > 0);
   for(pkts = 0, total_nread = 0; pkts < max_pkts;) {
-    while((nread = recvfrom(qctx->sockfd, (char *)buf, bufsize, 0,
-                            (struct sockaddr *)&remote_addr,
-                            &remote_addrlen)) == -1 &&
-          SOCKERRNO == EINTR)
+    while((rv = recvfrom(qctx->sockfd, (char *)buf, bufsize, 0,
+                         (struct sockaddr *)&remote_addr,
+                         &remote_addrlen)) == -1 &&
+          (SOCKERRNO == SOCKEINTR || SOCKERRNO == SOCKEMSGSIZE))
       ;
-    if(nread == -1) {
-      if(SOCKERRNO == EAGAIN || SOCKERRNO == EWOULDBLOCK) {
+    if(!curlx_sztouz(rv, &nread)) {
+      if(SOCK_EAGAIN(SOCKERRNO)) {
         CURL_TRC_CF(data, cf, "ingress, recvfrom -> EAGAIN");
         goto out;
       }
-      if(!cf->connected && SOCKERRNO == ECONNREFUSED) {
-        const char *r_ip = NULL;
-        int r_port = 0;
-        Curl_cf_socket_peek(cf->next, data, NULL, NULL,
-                            &r_ip, &r_port, NULL, NULL);
-        failf(data, "QUIC: connection to %s port %u refused",
-              r_ip, r_port);
+      if(!cf->connected && SOCKERRNO == SOCKECONNREFUSED) {
+        struct ip_quadruple ip;
+        if(!Curl_cf_socket_peek(cf->next, data, NULL, NULL, &ip))
+          failf(data, "QUIC: connection to %s port %u refused",
+                ip.remote_ip, ip.remote_port);
         result = CURLE_COULDNT_CONNECT;
         goto out;
       }
-      Curl_strerror(SOCKERRNO, errstr, sizeof(errstr));
+      curlx_strerror(SOCKERRNO, errstr, sizeof(errstr));
       failf(data, "QUIC: recvfrom() unexpectedly returned %zd (errno=%d; %s)",
-                  nread, SOCKERRNO, errstr);
+            rv, SOCKERRNO, errstr);
       result = CURLE_RECV_ERROR;
       goto out;
     }
 
     ++pkts;
-    total_nread += (size_t)nread;
-    result = recv_cb(buf, (size_t)nread, &remote_addr, remote_addrlen,
+    ++calls;
+
+    /* A 0-length UDP packet is no QUIC packet */
+    if(!nread)
+      continue;
+
+    total_nread += nread;
+    result = recv_cb(buf, nread, nread, &remote_addr, remote_addrlen,
                      0, userp);
     if(result)
       goto out;
@@ -512,8 +678,9 @@ static CURLcode recvfrom_packets(struct Curl_cfilter *cf,
 
 out:
   if(total_nread || result)
-    CURL_TRC_CF(data, cf, "recvd %zu packets with %zu bytes -> %d",
-                pkts, total_nread, result);
+    CURL_TRC_CF(data, cf,
+                "vquic_recvfrom(len=%zu, packets=%zu, calls=%zu) -> %d",
+                total_nread, pkts, calls, (int)result);
   return result;
 }
 #endif /* !HAVE_SENDMMSG && !HAVE_SENDMSG */
@@ -522,15 +689,24 @@ CURLcode vquic_recv_packets(struct Curl_cfilter *cf,
                             struct Curl_easy *data,
                             struct cf_quic_ctx *qctx,
                             size_t max_pkts,
-                            vquic_recv_pkt_cb *recv_cb, void *userp)
+                            vquic_recv_pkts_cb *recv_cb, void *userp)
 {
-#if defined(HAVE_SENDMMSG)
-  return recvmmsg_packets(cf, data, qctx, max_pkts, recv_cb, userp);
+  CURLcode result;
+#ifdef HAVE_SENDMMSG
+  result = recvmmsg_packets(cf, data, qctx, max_pkts, recv_cb, userp);
 #elif defined(HAVE_SENDMSG)
-  return recvmsg_packets(cf, data, qctx, max_pkts, recv_cb, userp);
+  result = recvmsg_packets(cf, data, qctx, max_pkts, recv_cb, userp);
 #else
-  return recvfrom_packets(cf, data, qctx, max_pkts, recv_cb, userp);
+  result = recvfrom_packets(cf, data, qctx, max_pkts, recv_cb, userp);
 #endif
+  if(!result) {
+    if(!qctx->got_first_byte) {
+      qctx->got_first_byte = TRUE;
+      qctx->first_byte_at = qctx->last_op;
+    }
+    qctx->last_io = qctx->last_op;
+  }
+  return result;
 }
 
 /*
@@ -546,31 +722,37 @@ CURLcode Curl_qlogdir(struct Curl_easy *data,
                       size_t scidlen,
                       int *qlogfdp)
 {
-  const char *qlog_dir = getenv("QLOGDIR");
+  char *qlog_dir = curl_getenv("QLOGDIR");
   *qlogfdp = -1;
   if(qlog_dir) {
     struct dynbuf fname;
     CURLcode result;
     unsigned int i;
-    Curl_dyn_init(&fname, DYN_QLOG_NAME);
-    result = Curl_dyn_add(&fname, qlog_dir);
+    curlx_dyn_init(&fname, DYN_QLOG_NAME);
+    result = curlx_dyn_add(&fname, qlog_dir);
     if(!result)
-      result = Curl_dyn_add(&fname, "/");
+      result = curlx_dyn_add(&fname, "/");
     for(i = 0; (i < scidlen) && !result; i++) {
       char hex[3];
-      msnprintf(hex, 3, "%02x", scid[i]);
-      result = Curl_dyn_add(&fname, hex);
+      curl_msnprintf(hex, 3, "%02x", scid[i]);
+      result = curlx_dyn_add(&fname, hex);
     }
     if(!result)
-      result = Curl_dyn_add(&fname, ".sqlog");
+      result = curlx_dyn_add(&fname, ".sqlog");
 
     if(!result) {
-      int qlogfd = open(Curl_dyn_ptr(&fname), QLOGMODE,
-                        data->set.new_file_perms);
+      int qlogfd = curlx_open(curlx_dyn_ptr(&fname),
+                              O_WRONLY | O_CREAT | CURL_O_BINARY,
+                              data->set.new_file_perms
+#ifdef _WIN32
+                              & (_S_IREAD | _S_IWRITE)
+#endif
+                              );
       if(qlogfd != -1)
         *qlogfdp = qlogfd;
     }
-    Curl_dyn_free(&fname);
+    curlx_dyn_free(&fname);
+    curlx_free(qlog_dir);
     if(result)
       return result;
   }
@@ -578,79 +760,247 @@ CURLcode Curl_qlogdir(struct Curl_easy *data,
   return CURLE_OK;
 }
 
-CURLcode Curl_cf_quic_create(struct Curl_cfilter **pcf,
-                             struct Curl_easy *data,
-                             struct connectdata *conn,
-                             const struct Curl_addrinfo *ai,
-                             int transport)
+CURLcode Curl_cf_quic_insert_after(struct Curl_cfilter *cf_at,
+                                   struct Curl_peer *origin,
+                                   struct Curl_peer *peer)
 {
-  (void)transport;
-  DEBUGASSERT(transport == TRNSPRT_QUIC);
 #if defined(USE_NGTCP2) && defined(USE_NGHTTP3)
-  return Curl_cf_ngtcp2_create(pcf, data, conn, ai);
+  return Curl_cf_ngtcp2_insert_after(cf_at, origin, peer);
 #elif defined(USE_QUICHE)
-  return Curl_cf_quiche_create(pcf, data, conn, ai);
-#elif defined(USE_MSH3)
-  return Curl_cf_msh3_create(pcf, data, conn, ai);
+  return Curl_cf_quiche_insert_after(cf_at, origin, peer);
 #else
-  *pcf = NULL;
-  (void)data;
-  (void)conn;
-  (void)ai;
+  (void)cf_at;
+  (void)origin;
+  (void)peer;
   return CURLE_NOT_BUILT_IN;
 #endif
 }
 
-bool Curl_conn_is_http3(const struct Curl_easy *data,
-                        const struct connectdata *conn,
-                        int sockindex)
+CURLcode Curl_cf_quic_create(struct Curl_cfilter **pcf,
+                             struct Curl_easy *data,
+                             struct Curl_peer *origin,
+                             struct Curl_peer *peer,
+                             uint8_t transport_peer,
+                             struct connectdata *conn,
+                             struct Curl_sockaddr_ex *addr,
+                             struct Curl_peer *tunnel_peer,
+                             uint8_t tunnel_transport)
 {
+  (void)transport_peer;
+  (void)tunnel_transport;
+  (void)tunnel_peer;
+  DEBUGASSERT(transport_peer == TRNSPRT_QUIC);
 #if defined(USE_NGTCP2) && defined(USE_NGHTTP3)
-  return Curl_conn_is_ngtcp2(data, conn, sockindex);
+  return Curl_cf_ngtcp2_create(pcf, data, origin, peer, conn, addr);
 #elif defined(USE_QUICHE)
-  return Curl_conn_is_quiche(data, conn, sockindex);
-#elif defined(USE_MSH3)
-  return Curl_conn_is_msh3(data, conn, sockindex);
+  return Curl_cf_quiche_create(pcf, data, origin, peer, conn, addr);
 #else
-  return ((conn->handler->protocol & PROTO_FAMILY_HTTP) &&
-          (conn->httpversion == 30));
+  *pcf = NULL;
+  (void)data;
+  (void)origin;
+  (void)peer;
+  (void)conn;
+  (void)addr;
+  (void)tunnel_peer;
+  (void)tunnel_transport;
+  return CURLE_NOT_BUILT_IN;
 #endif
 }
 
-CURLcode Curl_conn_may_http3(struct Curl_easy *data,
-                             const struct connectdata *conn)
+#if !defined(CURL_DISABLE_PROXY) && defined(USE_PROXY_HTTP3)
+
+CURLcode Curl_cf_h3_proxy_insert_after(struct Curl_cfilter *cf_at,
+                                       struct Curl_easy *data,
+                                       struct Curl_peer *origin,
+                                       struct Curl_peer *peer,
+                                       struct Curl_peer *tunnel_peer,
+                                       uint8_t tunnel_transport)
 {
-  if(conn->transport == TRNSPRT_UNIX) {
-    /* cannot do QUIC over a unix domain socket */
+#if defined(USE_NGTCP2) && defined(USE_NGHTTP3)
+  return Curl_cf_ngtcp2_proxy_insert_after(cf_at, data, origin, peer,
+                                           tunnel_peer, tunnel_transport);
+#else
+  (void)cf_at;
+  (void)data;
+  (void)origin;
+  (void)peer;
+  (void)tunnel_peer;
+  (void)tunnel_transport;
+  return CURLE_NOT_BUILT_IN;
+#endif
+}
+
+CURLcode Curl_cf_h3_proxy_create(struct Curl_cfilter **pcf,
+                                 struct Curl_easy *data,
+                                 struct Curl_peer *origin,
+                                 struct Curl_peer *peer,
+                                 uint8_t transport_peer,
+                                 struct connectdata *conn,
+                                 struct Curl_sockaddr_ex *addr,
+                                 struct Curl_peer *tunnel_peer,
+                                 uint8_t tunnel_transport)
+{
+  DEBUGASSERT(transport_peer == TRNSPRT_QUIC);
+#if defined(USE_NGTCP2) && defined(USE_NGHTTP3)
+  return Curl_cf_ngtcp2_proxy_create(pcf, data, origin, peer, transport_peer,
+                                     conn, addr,
+                                     tunnel_peer, tunnel_transport);
+#else
+  *pcf = NULL;
+  (void)data;
+  (void)conn;
+  (void)addr;
+  (void)peer;
+  (void)transport_peer;
+  (void)tunnel_peer;
+  (void)tunnel_transport;
+  return CURLE_NOT_BUILT_IN;
+#endif
+}
+
+#endif /* !CURL_DISABLE_PROXY && USE_PROXY_HTTP3 */
+
+CURLcode Curl_conn_may_http3(struct Curl_easy *data,
+                             const struct connectdata *conn,
+                             unsigned char transport)
+{
+  if(transport == TRNSPRT_UNIX) {
+    failf(data, "HTTP/3 cannot be used over UNIX domain sockets");
     return CURLE_QUIC_CONNECT_ERROR;
   }
-  if(!(conn->handler->flags & PROTOPT_SSL)) {
+  if(!(data->state.origin->scheme->flags & PROTOPT_SSL)) {
     failf(data, "HTTP/3 requested for non-HTTPS URL");
     return CURLE_URL_MALFORMAT;
   }
 #ifndef CURL_DISABLE_PROXY
-  if(conn->bits.socksproxy) {
+  if(conn->socks_proxy.peer) {
     failf(data, "HTTP/3 is not supported over a SOCKS proxy");
     return CURLE_URL_MALFORMAT;
   }
-  if(conn->bits.httpproxy && conn->bits.tunnel_proxy) {
-    failf(data, "HTTP/3 is not supported over a HTTP proxy");
-    return CURLE_URL_MALFORMAT;
-  }
+#else
+  (void)conn;
 #endif
 
   return CURLE_OK;
 }
 
-#else /* ENABLE_QUIC */
+#ifdef CURLVERBOSE
+const char *vquic_h3_err_str(uint64_t error_code)
+{
+  if(error_code <= UINT_MAX) {
+    switch((unsigned int)error_code) {
+    case CURL_H3_ERR_NO_ERROR:
+      return "NO_ERROR";
+    case CURL_H3_ERR_GENERAL_PROTOCOL_ERROR:
+      return "GENERAL_PROTOCOL_ERROR";
+    case CURL_H3_ERR_INTERNAL_ERROR:
+      return "INTERNAL_ERROR";
+    case CURL_H3_ERR_STREAM_CREATION_ERROR:
+      return "STREAM_CREATION_ERROR";
+    case CURL_H3_ERR_CLOSED_CRITICAL_STREAM:
+      return "CLOSED_CRITICAL_STREAM";
+    case CURL_H3_ERR_FRAME_UNEXPECTED:
+      return "FRAME_UNEXPECTED";
+    case CURL_H3_ERR_FRAME_ERROR:
+      return "FRAME_ERROR";
+    case CURL_H3_ERR_EXCESSIVE_LOAD:
+      return "EXCESSIVE_LOAD";
+    case CURL_H3_ERR_ID_ERROR:
+      return "ID_ERROR";
+    case CURL_H3_ERR_SETTINGS_ERROR:
+      return "SETTINGS_ERROR";
+    case CURL_H3_ERR_MISSING_SETTINGS:
+      return "MISSING_SETTINGS";
+    case CURL_H3_ERR_REQUEST_REJECTED:
+      return "REQUEST_REJECTED";
+    case CURL_H3_ERR_REQUEST_CANCELLED:
+      return "REQUEST_CANCELLED";
+    case CURL_H3_ERR_REQUEST_INCOMPLETE:
+      return "REQUEST_INCOMPLETE";
+    case CURL_H3_ERR_MESSAGE_ERROR:
+      return "MESSAGE_ERROR";
+    case CURL_H3_ERR_CONNECT_ERROR:
+      return "CONNECT_ERROR";
+    case CURL_H3_ERR_VERSION_FALLBACK:
+      return "VERSION_FALLBACK";
+    default:
+      break;
+    }
+  }
+  /* RFC 9114 ch. 8.1 + 9, reserved future error codes that are NO_ERROR */
+  if((error_code >= 0x21) && !((error_code - 0x21) % 0x1f))
+    return "NO_ERROR";
+  return "unknown";
+}
+#endif /* CURLVERBOSE */
+
+#if defined(USE_NGTCP2) || defined(USE_NGHTTP3)
+
+static void *vquic_ngtcp2_malloc(size_t size, void *user_data)
+{
+  (void)user_data;
+  return Curl_cmalloc(size);
+}
+
+static void vquic_ngtcp2_free(void *ptr, void *user_data)
+{
+  (void)user_data;
+  Curl_cfree(ptr);
+}
+
+static void *vquic_ngtcp2_calloc(size_t nmemb, size_t size, void *user_data)
+{
+  (void)user_data;
+  return Curl_ccalloc(nmemb, size);
+}
+
+static void *vquic_ngtcp2_realloc(void *ptr, size_t size, void *user_data)
+{
+  (void)user_data;
+  return Curl_crealloc(ptr, size);
+}
+
+#ifdef USE_NGTCP2
+static struct ngtcp2_mem vquic_ngtcp2_mem = {
+  NULL,
+  vquic_ngtcp2_malloc,
+  vquic_ngtcp2_free,
+  vquic_ngtcp2_calloc,
+  vquic_ngtcp2_realloc
+};
+struct ngtcp2_mem *Curl_ngtcp2_mem(void)
+{
+  return &vquic_ngtcp2_mem;
+}
+#endif
+
+#ifdef USE_NGHTTP3
+static struct nghttp3_mem vquic_nghttp3_mem = {
+  NULL,
+  vquic_ngtcp2_malloc,
+  vquic_ngtcp2_free,
+  vquic_ngtcp2_calloc,
+  vquic_ngtcp2_realloc
+};
+struct nghttp3_mem *Curl_nghttp3_mem(void)
+{
+  return &vquic_nghttp3_mem;
+}
+#endif
+
+#endif /* USE_NGTCP2 || USE_NGHTTP3 */
+
+#else /* CURL_DISABLE_HTTP || !USE_HTTP3 */
 
 CURLcode Curl_conn_may_http3(struct Curl_easy *data,
-                             const struct connectdata *conn)
+                             const struct connectdata *conn,
+                             unsigned char transport)
 {
-  (void)conn;
   (void)data;
+  (void)conn;
+  (void)transport;
   DEBUGF(infof(data, "QUIC is not supported in this build"));
   return CURLE_NOT_BUILT_IN;
 }
 
-#endif /* !ENABLE_QUIC */
+#endif /* !CURL_DISABLE_HTTP && USE_HTTP3 */
diff --git a/third-party/curl/lib/vquic/vquic.h b/third-party/curl/lib/vquic/vquic.h
index dc73957aaf..5211a9b33a 100644
--- a/third-party/curl/lib/vquic/vquic.h
+++ b/third-party/curl/lib/vquic/vquic.h
@@ -23,42 +23,67 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#ifdef ENABLE_QUIC
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_HTTP3)
 struct Curl_cfilter;
 struct Curl_easy;
 struct connectdata;
 struct Curl_addrinfo;
 
 void Curl_quic_ver(char *p, size_t len);
+int Curl_vquic_init(void);
 
 CURLcode Curl_qlogdir(struct Curl_easy *data,
                       unsigned char *scid,
                       size_t scidlen,
                       int *qlogfdp);
 
+CURLcode Curl_cf_quic_insert_after(struct Curl_cfilter *cf_at,
+                                   struct Curl_peer *origin,
+                                   struct Curl_peer *peer);
 
 CURLcode Curl_cf_quic_create(struct Curl_cfilter **pcf,
                              struct Curl_easy *data,
+                             struct Curl_peer *origin,
+                             struct Curl_peer *peer,
+                             uint8_t transport_peer,
                              struct connectdata *conn,
-                             const struct Curl_addrinfo *ai,
-                             int transport);
-
-bool Curl_conn_is_http3(const struct Curl_easy *data,
-                        const struct connectdata *conn,
-                        int sockindex);
+                             struct Curl_sockaddr_ex *addr,
+                             struct Curl_peer *tunnel_peer,
+                             uint8_t tunnel_transport);
 
 extern struct Curl_cftype Curl_cft_http3;
 
-#else /* ENABLE_QUIC */
+#if !defined(CURL_DISABLE_PROXY) && defined(USE_PROXY_HTTP3)
 
-#define Curl_conn_is_http3(a,b,c)   FALSE
+CURLcode Curl_cf_h3_proxy_insert_after(struct Curl_cfilter *cf_at,
+                                       struct Curl_easy *data,
+                                       struct Curl_peer *origin,
+                                       struct Curl_peer *peer,
+                                       struct Curl_peer *tunnel_peer,
+                                       uint8_t tunnel_transport);
 
-#endif /* !ENABLE_QUIC */
+CURLcode Curl_cf_h3_proxy_create(struct Curl_cfilter **pcf,
+                                 struct Curl_easy *data,
+                                 struct Curl_peer *origin,
+                                 struct Curl_peer *peer,
+                                 uint8_t transport_peer,
+                                 struct connectdata *conn,
+                                 struct Curl_sockaddr_ex *addr,
+                                 struct Curl_peer *tunnel_peer,
+                                 uint8_t tunnel_transport);
+
+extern struct Curl_cftype Curl_cft_h3_proxy;
+
+#endif /* !CURL_DISABLE_PROXY && USE_PROXY_HTTP3 */
+
+#else
+#define Curl_vquic_init() 1
+#endif /* !CURL_DISABLE_HTTP && USE_HTTP3 */
 
 CURLcode Curl_conn_may_http3(struct Curl_easy *data,
-                             const struct connectdata *conn);
+                             const struct connectdata *conn,
+                             unsigned char transport);
 
 #endif /* HEADER_CURL_VQUIC_QUIC_H */
diff --git a/third-party/curl/lib/vquic/vquic_int.h b/third-party/curl/lib/vquic/vquic_int.h
index dbcd009d72..db5183d431 100644
--- a/third-party/curl/lib/vquic/vquic_int.h
+++ b/third-party/curl/lib/vquic/vquic_int.h
@@ -23,43 +23,75 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+
+#ifdef USE_HTTP3
+
 #include "bufq.h"
 
-#ifdef ENABLE_QUIC
-
-#define MAX_PKT_BURST 10
 #define MAX_UDP_PAYLOAD_SIZE  1452
 
-struct cf_quic_ctx {
-  curl_socket_t sockfd; /* connected UDP socket */
-  struct sockaddr_storage local_addr; /* address socket is bound to */
-  socklen_t local_addrlen; /* length of local address */
+/* definitions from RFC 9114, ch 8.1 */
+typedef enum {
+  CURL_H3_ERR_NO_ERROR = 0x0100,
+  CURL_H3_ERR_GENERAL_PROTOCOL_ERROR = 0x0101,
+  CURL_H3_ERR_INTERNAL_ERROR = 0x0102,
+  CURL_H3_ERR_STREAM_CREATION_ERROR = 0x0103,
+  CURL_H3_ERR_CLOSED_CRITICAL_STREAM = 0x0104,
+  CURL_H3_ERR_FRAME_UNEXPECTED = 0x0105,
+  CURL_H3_ERR_FRAME_ERROR = 0x0106,
+  CURL_H3_ERR_EXCESSIVE_LOAD = 0x0107,
+  CURL_H3_ERR_ID_ERROR = 0x0108,
+  CURL_H3_ERR_SETTINGS_ERROR = 0x0109,
+  CURL_H3_ERR_MISSING_SETTINGS = 0x010a,
+  CURL_H3_ERR_REQUEST_REJECTED = 0x010b,
+  CURL_H3_ERR_REQUEST_CANCELLED = 0x010c,
+  CURL_H3_ERR_REQUEST_INCOMPLETE = 0x010d,
+  CURL_H3_ERR_MESSAGE_ERROR = 0x010e,
+  CURL_H3_ERR_CONNECT_ERROR = 0x010f,
+  CURL_H3_ERR_VERSION_FALLBACK = 0x0110,
+} vquic_h3_error;
 
-  struct bufq sendbuf; /* buffer for sending one or more packets */
-  size_t gsolen; /* length of individual packets in send buf */
-  size_t split_len; /* if != 0, buffer length after which GSO differs */
+#ifdef CURLVERBOSE
+const char *vquic_h3_err_str(uint64_t error_code);
+#else
+#define vquic_h3_err_str(x)   ""
+#endif /* CURLVERBOSE */
+
+struct cf_quic_ctx {
+  curl_socket_t sockfd;               /* connected UDP socket */
+  struct sockaddr_storage local_addr; /* address socket is bound to */
+  socklen_t local_addrlen;            /* length of local address */
+
+  struct bufq sendbuf;           /* buffer for sending one or more packets */
+  struct curltime first_byte_at; /* when first byte was recvd */
+  struct curltime last_op;       /* last (attempted) send/recv operation */
+  struct curltime last_io;       /* last successful socket IO */
+  size_t gsolen;                 /* length of individual packets in send buf */
+  size_t split_len;    /* if != 0, buffer length after which GSO differs */
   size_t split_gsolen; /* length of individual packets after split_len */
 #ifdef DEBUGBUILD
-  int wblock_percent; /* percent of writes doing EAGAIN */
+  int wblock_percent;  /* percent of writes doing EAGAIN */
 #endif
-  bool no_gso; /* do not use gso on sending */
+  BIT(got_first_byte); /* if first byte was received */
+  BIT(no_gso);         /* do not use gso on sending */
 };
 
-CURLcode vquic_ctx_init(struct cf_quic_ctx *qctx);
+#define H3_STREAM_CTX(ctx, data)                                        \
+  ((data) ? Curl_uint32_hash_get(&(ctx)->streams, (data)->mid) : NULL)
+
+CURLcode vquic_ctx_init(struct Curl_easy *data,
+                        struct cf_quic_ctx *qctx);
 void vquic_ctx_free(struct cf_quic_ctx *qctx);
 
-void vquic_push_blocked_pkt(struct Curl_cfilter *cf,
-                            struct cf_quic_ctx *qctx,
-                            const uint8_t *pkt, size_t pktlen, size_t gsolen);
+void vquic_ctx_set_time(struct cf_quic_ctx *qctx,
+                        const struct curltime *pnow);
 
-CURLcode vquic_send_blocked_pkts(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data,
-                                 struct cf_quic_ctx *qctx);
+void vquic_ctx_update_time(struct cf_quic_ctx *qctx,
+                           const struct curltime *pnow);
 
 CURLcode vquic_send(struct Curl_cfilter *cf, struct Curl_easy *data,
-                        struct cf_quic_ctx *qctx, size_t gsolen);
+                    struct cf_quic_ctx *qctx, size_t gsolen);
 
 CURLcode vquic_send_tail_split(struct Curl_cfilter *cf, struct Curl_easy *data,
                                struct cf_quic_ctx *qctx, size_t gsolen,
@@ -68,18 +100,27 @@ CURLcode vquic_send_tail_split(struct Curl_cfilter *cf, struct Curl_easy *data,
 CURLcode vquic_flush(struct Curl_cfilter *cf, struct Curl_easy *data,
                      struct cf_quic_ctx *qctx);
 
-
-typedef CURLcode vquic_recv_pkt_cb(const unsigned char *pkt, size_t pktlen,
-                                   struct sockaddr_storage *remote_addr,
-                                   socklen_t remote_addrlen, int ecn,
-                                   void *userp);
+typedef CURLcode vquic_recv_pkts_cb(const unsigned char *buf, size_t buflen,
+                                    size_t gso_size,
+                                    struct sockaddr_storage *remote_addr,
+                                    socklen_t remote_addrlen, int ecn,
+                                    void *userp);
 
 CURLcode vquic_recv_packets(struct Curl_cfilter *cf,
                             struct Curl_easy *data,
                             struct cf_quic_ctx *qctx,
                             size_t max_pkts,
-                            vquic_recv_pkt_cb *recv_cb, void *userp);
+                            vquic_recv_pkts_cb *recv_cb, void *userp);
 
-#endif /* !ENABLE_QUIC */
+#ifdef USE_NGTCP2
+struct ngtcp2_mem;
+struct ngtcp2_mem *Curl_ngtcp2_mem(void);
+#endif
+#ifdef USE_NGHTTP3
+struct nghttp3_mem;
+struct nghttp3_mem *Curl_nghttp3_mem(void);
+#endif
+
+#endif /* !USE_HTTP3 */
 
 #endif /* HEADER_CURL_VQUIC_QUIC_INT_H */
diff --git a/third-party/curl/lib/vssh/libssh.c b/third-party/curl/lib/vssh/libssh.c
index dea0084575..e4071caa46 100644
--- a/third-party/curl/lib/vssh/libssh.c
+++ b/third-party/curl/lib/vssh/libssh.c
@@ -24,16 +24,10 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef USE_LIBSSH
 
-#include <limits.h>
-
-#include <libssh/libssh.h>
-#include <libssh/sftp.h>
-
 #ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
 #endif
@@ -48,35 +42,23 @@
 #include <inet.h>
 #endif
 
-#include <curl/curl.h>
 #include "urldata.h"
 #include "sendf.h"
+#include "curl_trc.h"
 #include "hostip.h"
 #include "progress.h"
 #include "transfer.h"
-#include "escape.h"
-#include "http.h"               /* for HTTP proxy tunnel stuff */
-#include "ssh.h"
+#include "vssh/ssh.h"
 #include "url.h"
-#include "speedcheck.h"
-#include "getinfo.h"
-#include "strdup.h"
-#include "strcase.h"
-#include "vtls/vtls.h"
 #include "cfilters.h"
 #include "connect.h"
-#include "inet_ntop.h"
 #include "parsedate.h"          /* for the week day and month names */
-#include "sockaddr.h"           /* required for Curl_sockaddr_storage */
-#include "strtoofft.h"
+#include "curlx/strparse.h"
 #include "multiif.h"
 #include "select.h"
-#include "warnless.h"
-#include "curl_path.h"
+#include "vssh/vssh.h"
+#include "curlx/base64.h" /* for curlx_base64_encode() */
 
-#ifdef HAVE_SYS_STAT_H
-#include <sys/stat.h>
-#endif
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 #endif
@@ -84,26 +66,14 @@
 #include <fcntl.h>
 #endif
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-/* in 0.10.0 or later, ignore deprecated warnings */
-#if defined(__GNUC__) &&                        \
-  (LIBSSH_VERSION_MINOR >= 10) ||               \
-  (LIBSSH_VERSION_MAJOR > 0)
-#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
-#endif
-
 /* A recent macro provided by libssh. Or make our own. */
 #ifndef SSH_STRING_FREE_CHAR
-#define SSH_STRING_FREE_CHAR(x)                 \
-  do {                                          \
-    if(x) {                                     \
-      ssh_string_free_char(x);                  \
-      x = NULL;                                 \
-    }                                           \
+#define SSH_STRING_FREE_CHAR(x) \
+  do {                          \
+    if(x) {                     \
+      ssh_string_free_char(x);  \
+      x = NULL;                 \
+    }                           \
   } while(0)
 #endif
 
@@ -115,273 +85,140 @@
 #define SSH_S_IFLNK  0120000
 #endif
 
-/* Local functions: */
-static CURLcode myssh_connect(struct Curl_easy *data, bool *done);
-static CURLcode myssh_multi_statemach(struct Curl_easy *data,
-                                      bool *done);
-static CURLcode myssh_do_it(struct Curl_easy *data, bool *done);
-
-static CURLcode scp_done(struct Curl_easy *data,
-                         CURLcode, bool premature);
-static CURLcode scp_doing(struct Curl_easy *data, bool *dophase_done);
-static CURLcode scp_disconnect(struct Curl_easy *data,
-                               struct connectdata *conn,
-                               bool dead_connection);
-
-static CURLcode sftp_done(struct Curl_easy *data,
-                          CURLcode, bool premature);
-static CURLcode sftp_doing(struct Curl_easy *data,
-                           bool *dophase_done);
-static CURLcode sftp_disconnect(struct Curl_easy *data,
-                                struct connectdata *conn,
-                                bool dead);
-static
-CURLcode sftp_perform(struct Curl_easy *data,
-                      bool *connected,
-                      bool *dophase_done);
-
-static void sftp_quote(struct Curl_easy *data);
-static void sftp_quote_stat(struct Curl_easy *data);
-static int myssh_getsock(struct Curl_easy *data,
-                         struct connectdata *conn, curl_socket_t *sock);
-
-static CURLcode myssh_setup_connection(struct Curl_easy *data,
-                                       struct connectdata *conn);
-
-/*
- * SCP protocol handler.
- */
-
-const struct Curl_handler Curl_handler_scp = {
-  "SCP",                        /* scheme */
-  myssh_setup_connection,       /* setup_connection */
-  myssh_do_it,                  /* do_it */
-  scp_done,                     /* done */
-  ZERO_NULL,                    /* do_more */
-  myssh_connect,                /* connect_it */
-  myssh_multi_statemach,        /* connecting */
-  scp_doing,                    /* doing */
-  myssh_getsock,                /* proto_getsock */
-  myssh_getsock,                /* doing_getsock */
-  ZERO_NULL,                    /* domore_getsock */
-  myssh_getsock,                /* perform_getsock */
-  scp_disconnect,               /* disconnect */
-  ZERO_NULL,                    /* readwrite */
-  ZERO_NULL,                    /* connection_check */
-  ZERO_NULL,                    /* attach connection */
-  PORT_SSH,                     /* defport */
-  CURLPROTO_SCP,                /* protocol */
-  CURLPROTO_SCP,                /* family */
-  PROTOPT_DIRLOCK | PROTOPT_CLOSEACTION | PROTOPT_NOURLQUERY    /* flags */
-};
-
-/*
- * SFTP protocol handler.
- */
-
-const struct Curl_handler Curl_handler_sftp = {
-  "SFTP",                               /* scheme */
-  myssh_setup_connection,               /* setup_connection */
-  myssh_do_it,                          /* do_it */
-  sftp_done,                            /* done */
-  ZERO_NULL,                            /* do_more */
-  myssh_connect,                        /* connect_it */
-  myssh_multi_statemach,                /* connecting */
-  sftp_doing,                           /* doing */
-  myssh_getsock,                        /* proto_getsock */
-  myssh_getsock,                        /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  myssh_getsock,                        /* perform_getsock */
-  sftp_disconnect,                      /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_SSH,                             /* defport */
-  CURLPROTO_SFTP,                       /* protocol */
-  CURLPROTO_SFTP,                       /* family */
-  PROTOPT_DIRLOCK | PROTOPT_CLOSEACTION
-  | PROTOPT_NOURLQUERY                  /* flags */
-};
-
 static CURLcode sftp_error_to_CURLE(int err)
 {
   switch(err) {
-    case SSH_FX_OK:
-      return CURLE_OK;
+  case SSH_FX_OK:
+    return CURLE_OK;
 
-    case SSH_FX_NO_SUCH_FILE:
-    case SSH_FX_NO_SUCH_PATH:
-      return CURLE_REMOTE_FILE_NOT_FOUND;
+  case SSH_FX_NO_SUCH_FILE:
+  case SSH_FX_NO_SUCH_PATH:
+    return CURLE_REMOTE_FILE_NOT_FOUND;
 
-    case SSH_FX_PERMISSION_DENIED:
-    case SSH_FX_WRITE_PROTECT:
-      return CURLE_REMOTE_ACCESS_DENIED;
+  case SSH_FX_PERMISSION_DENIED:
+  case SSH_FX_WRITE_PROTECT:
+    return CURLE_REMOTE_ACCESS_DENIED;
 
-    case SSH_FX_FILE_ALREADY_EXISTS:
-      return CURLE_REMOTE_FILE_EXISTS;
+  case SSH_FX_FILE_ALREADY_EXISTS:
+    return CURLE_REMOTE_FILE_EXISTS;
 
-    default:
-      break;
+  default:
+    break;
   }
 
   return CURLE_SSH;
 }
 
-#ifndef DEBUGBUILD
-#define state(x,y) mystate(x,y)
-#else
-#define state(x,y) mystate(x,y, __LINE__)
-#endif
-
-/*
- * SSH State machine related code
- */
-/* This is the ONLY way to change SSH state! */
-static void mystate(struct Curl_easy *data, sshstate nowstate
-#ifdef DEBUGBUILD
-                    , int lineno
-#endif
-  )
-{
-  struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
-  /* for debug purposes */
-  static const char *const names[] = {
-    "SSH_STOP",
-    "SSH_INIT",
-    "SSH_S_STARTUP",
-    "SSH_HOSTKEY",
-    "SSH_AUTHLIST",
-    "SSH_AUTH_PKEY_INIT",
-    "SSH_AUTH_PKEY",
-    "SSH_AUTH_PASS_INIT",
-    "SSH_AUTH_PASS",
-    "SSH_AUTH_AGENT_INIT",
-    "SSH_AUTH_AGENT_LIST",
-    "SSH_AUTH_AGENT",
-    "SSH_AUTH_HOST_INIT",
-    "SSH_AUTH_HOST",
-    "SSH_AUTH_KEY_INIT",
-    "SSH_AUTH_KEY",
-    "SSH_AUTH_GSSAPI",
-    "SSH_AUTH_DONE",
-    "SSH_SFTP_INIT",
-    "SSH_SFTP_REALPATH",
-    "SSH_SFTP_QUOTE_INIT",
-    "SSH_SFTP_POSTQUOTE_INIT",
-    "SSH_SFTP_QUOTE",
-    "SSH_SFTP_NEXT_QUOTE",
-    "SSH_SFTP_QUOTE_STAT",
-    "SSH_SFTP_QUOTE_SETSTAT",
-    "SSH_SFTP_QUOTE_SYMLINK",
-    "SSH_SFTP_QUOTE_MKDIR",
-    "SSH_SFTP_QUOTE_RENAME",
-    "SSH_SFTP_QUOTE_RMDIR",
-    "SSH_SFTP_QUOTE_UNLINK",
-    "SSH_SFTP_QUOTE_STATVFS",
-    "SSH_SFTP_GETINFO",
-    "SSH_SFTP_FILETIME",
-    "SSH_SFTP_TRANS_INIT",
-    "SSH_SFTP_UPLOAD_INIT",
-    "SSH_SFTP_CREATE_DIRS_INIT",
-    "SSH_SFTP_CREATE_DIRS",
-    "SSH_SFTP_CREATE_DIRS_MKDIR",
-    "SSH_SFTP_READDIR_INIT",
-    "SSH_SFTP_READDIR",
-    "SSH_SFTP_READDIR_LINK",
-    "SSH_SFTP_READDIR_BOTTOM",
-    "SSH_SFTP_READDIR_DONE",
-    "SSH_SFTP_DOWNLOAD_INIT",
-    "SSH_SFTP_DOWNLOAD_STAT",
-    "SSH_SFTP_CLOSE",
-    "SSH_SFTP_SHUTDOWN",
-    "SSH_SCP_TRANS_INIT",
-    "SSH_SCP_UPLOAD_INIT",
-    "SSH_SCP_DOWNLOAD_INIT",
-    "SSH_SCP_DOWNLOAD",
-    "SSH_SCP_DONE",
-    "SSH_SCP_SEND_EOF",
-    "SSH_SCP_WAIT_EOF",
-    "SSH_SCP_WAIT_CLOSE",
-    "SSH_SCP_CHANNEL_FREE",
-    "SSH_SESSION_DISCONNECT",
-    "SSH_SESSION_FREE",
-    "QUIT"
-  };
-
-
-  if(sshc->state != nowstate) {
-    infof(data, "SSH %p state change from %s to %s (line %d)",
-          (void *) sshc, names[sshc->state], names[nowstate],
-          lineno);
-  }
-#endif
-
-  sshc->state = nowstate;
-}
-
 /* Multiple options:
- * 1. data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5] is set with an MD5
+ * 1. data->set.str[STRING_SSH_HOST_PUBLIC_KEY_SHA256] is set with a SHA256
+ *    hash.
+ * 2. data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5] is set with an MD5
  *    hash (90s style auth, not sure we should have it here)
- * 2. data->set.ssh_keyfunc callback is set. Then we do trust on first
+ * 3. data->set.ssh_keyfunc callback is set. Then we do trust on first
  *    use. We even save on knownhosts if CURLKHSTAT_FINE_ADD_TO_FILE
  *    is returned by it.
- * 3. none of the above. We only accept if it is present on known hosts.
+ * 4. none of the above. We only accept if it is present on known hosts.
  *
  * Returns SSH_OK or SSH_ERROR.
  */
-static int myssh_is_known(struct Curl_easy *data)
+static int myssh_is_known(struct Curl_easy *data, struct ssh_conn *sshc)
 {
   int rc;
-  struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
   ssh_key pubkey;
-  size_t hlen;
-  unsigned char *hash = NULL;
+  unsigned char *hash_sha256 = NULL;
+  size_t hlen_sha256;
+  unsigned char *hash_md5 = NULL;
+  size_t hlen_md5;
   char *found_base64 = NULL;
   char *known_base64 = NULL;
   int vstate;
   enum curl_khmatch keymatch;
   struct curl_khkey foundkey;
   struct curl_khkey *knownkeyp = NULL;
-  curl_sshkeycallback func =
-    data->set.ssh_keyfunc;
-
-#if LIBSSH_VERSION_INT >= SSH_VERSION_INT(0,9,0)
+  curl_sshkeycallback func = data->set.ssh_keyfunc;
   struct ssh_knownhosts_entry *knownhostsentry = NULL;
   struct curl_khkey knownkey;
-#endif
 
-#if LIBSSH_VERSION_INT >= SSH_VERSION_INT(0,8,0)
   rc = ssh_get_server_publickey(sshc->ssh_session, &pubkey);
-#else
-  rc = ssh_get_publickey(sshc->ssh_session, &pubkey);
-#endif
+
   if(rc != SSH_OK)
     return rc;
 
+  if(data->set.str[STRING_SSH_HOST_PUBLIC_KEY_SHA256]) {
+    const char *pubkey_sha256 =
+      data->set.str[STRING_SSH_HOST_PUBLIC_KEY_SHA256];
+    char *fingerprint_b64 = NULL;
+    size_t fingerprint_b64_len;
+    size_t pub_pos = 0;
+    size_t b64_pos = 0;
+
+    rc = ssh_get_publickey_hash(pubkey, SSH_PUBLICKEY_HASH_SHA256,
+                                &hash_sha256, &hlen_sha256);
+    if(rc != SSH_OK || hlen_sha256 != 32) {
+      failf(data, "Denied establishing ssh session: "
+            "SHA256 fingerprint not available");
+      goto cleanup;
+    }
+
+    if(curlx_base64_encode((const uint8_t *)hash_sha256, 32, &fingerprint_b64,
+                           &fingerprint_b64_len) != CURLE_OK) {
+      rc = SSH_ERROR;
+      goto cleanup;
+    }
+
+    infof(data, "SSH SHA256 fingerprint: %s", fingerprint_b64);
+
+    /* Find the position of any = padding characters in the public key */
+    while((pubkey_sha256[pub_pos] != '=') && pubkey_sha256[pub_pos]) {
+      pub_pos++;
+    }
+
+    /* Find the position of any = padding characters in the base64 coded
+     * hostkey fingerprint */
+    while((fingerprint_b64[b64_pos] != '=') && fingerprint_b64[b64_pos]) {
+      b64_pos++;
+    }
+
+    /* Before we authenticate we check the hostkey's SHA256 fingerprint
+     * against a known fingerprint, if available.
+     */
+    if((pub_pos != b64_pos) ||
+       strncmp(fingerprint_b64, pubkey_sha256, pub_pos)) {
+      failf(data,
+            "Denied establishing ssh session: mismatch SHA256 fingerprint. "
+            "Remote %s is not equal to %s", fingerprint_b64, pubkey_sha256);
+      curlx_free(fingerprint_b64);
+      rc = SSH_ERROR;
+      goto cleanup;
+    }
+
+    curlx_free(fingerprint_b64);
+
+    rc = SSH_OK;
+    goto cleanup;
+  }
+
   if(data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5]) {
-    int i;
-    char md5buffer[33];
     const char *pubkey_md5 = data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5];
+    char md5buffer[33];
+    int i;
 
     rc = ssh_get_publickey_hash(pubkey, SSH_PUBLICKEY_HASH_MD5,
-                                &hash, &hlen);
-    if(rc != SSH_OK || hlen != 16) {
+                                &hash_md5, &hlen_md5);
+    if(rc != SSH_OK || hlen_md5 != 16) {
       failf(data,
-            "Denied establishing ssh session: md5 fingerprint not available");
+            "Denied establishing ssh session: MD5 fingerprint not available");
       goto cleanup;
     }
 
     for(i = 0; i < 16; i++)
-      msnprintf(&md5buffer[i*2], 3, "%02x", (unsigned char)hash[i]);
+      curl_msnprintf(&md5buffer[i * 2], 3, "%02x", hash_md5[i]);
 
     infof(data, "SSH MD5 fingerprint: %s", md5buffer);
 
-    if(!strcasecompare(md5buffer, pubkey_md5)) {
+    if(!curl_strequal(md5buffer, pubkey_md5)) {
       failf(data,
-            "Denied establishing ssh session: mismatch md5 fingerprint. "
+            "Denied establishing ssh session: mismatch MD5 fingerprint. "
             "Remote %s is not equal to %s", md5buffer, pubkey_md5);
       rc = SSH_ERROR;
       goto cleanup;
@@ -391,28 +228,24 @@ static int myssh_is_known(struct Curl_easy *data)
     goto cleanup;
   }
 
-  if(data->set.ssl.primary.verifyhost != TRUE) {
-    rc = SSH_OK;
-    goto cleanup;
-  }
+  if(data->set.str[STRING_SSH_KNOWNHOSTS]) {
 
-#if LIBSSH_VERSION_INT >= SSH_VERSION_INT(0,9,0)
-  /* Get the known_key from the known hosts file */
-  vstate = ssh_session_get_known_hosts_entry(sshc->ssh_session,
-                                             &knownhostsentry);
+    /* Get the known_key from the known hosts file */
+    vstate = ssh_session_get_known_hosts_entry(sshc->ssh_session,
+                                               &knownhostsentry);
 
-  /* Case an entry was found in a known hosts file */
-  if(knownhostsentry) {
-    if(knownhostsentry->publickey) {
-      rc = ssh_pki_export_pubkey_base64(knownhostsentry->publickey,
-                                        &known_base64);
-      if(rc != SSH_OK) {
-        goto cleanup;
-      }
-      knownkey.key = known_base64;
-      knownkey.len = strlen(known_base64);
+    /* Case an entry was found in a known hosts file */
+    if(knownhostsentry) {
+      if(knownhostsentry->publickey) {
+        rc = ssh_pki_export_pubkey_base64(knownhostsentry->publickey,
+                                          &known_base64);
+        if(rc != SSH_OK) {
+          goto cleanup;
+        }
+        knownkey.key = known_base64;
+        knownkey.len = strlen(known_base64);
 
-      switch(ssh_key_type(knownhostsentry->publickey)) {
+        switch(ssh_key_type(knownhostsentry->publickey)) {
         case SSH_KEYTYPE_RSA:
           knownkey.keytype = CURLKHTYPE_RSA;
           break;
@@ -434,55 +267,37 @@ static int myssh_is_known(struct Curl_easy *data)
         default:
           rc = SSH_ERROR;
           goto cleanup;
+        }
+        knownkeyp = &knownkey;
       }
-      knownkeyp = &knownkey;
     }
-  }
 
-  switch(vstate) {
+    switch(vstate) {
     case SSH_KNOWN_HOSTS_OK:
       keymatch = CURLKHMATCH_OK;
       break;
     case SSH_KNOWN_HOSTS_OTHER:
-      /* fallthrough */
+      keymatch = CURLKHMATCH_MISMATCH;
+      break;
     case SSH_KNOWN_HOSTS_NOT_FOUND:
-      /* fallthrough */
     case SSH_KNOWN_HOSTS_UNKNOWN:
-      /* fallthrough */
     case SSH_KNOWN_HOSTS_ERROR:
       keymatch = CURLKHMATCH_MISSING;
       break;
-  default:
+    default:
       keymatch = CURLKHMATCH_MISMATCH;
       break;
-  }
+    }
 
-#else
-  vstate = ssh_is_server_known(sshc->ssh_session);
-  switch(vstate) {
-    case SSH_SERVER_KNOWN_OK:
-      keymatch = CURLKHMATCH_OK;
-      break;
-    case SSH_SERVER_FILE_NOT_FOUND:
-      /* fallthrough */
-    case SSH_SERVER_NOT_KNOWN:
-      keymatch = CURLKHMATCH_MISSING;
-      break;
-  default:
-      keymatch = CURLKHMATCH_MISMATCH;
-      break;
-  }
-#endif
+    if(func) { /* use callback to determine action */
+      rc = ssh_pki_export_pubkey_base64(pubkey, &found_base64);
+      if(rc != SSH_OK)
+        goto cleanup;
 
-  if(func) { /* use callback to determine action */
-    rc = ssh_pki_export_pubkey_base64(pubkey, &found_base64);
-    if(rc != SSH_OK)
-      goto cleanup;
+      foundkey.key = found_base64;
+      foundkey.len = strlen(found_base64);
 
-    foundkey.key = found_base64;
-    foundkey.len = strlen(found_base64);
-
-    switch(ssh_key_type(pubkey)) {
+      switch(ssh_key_type(pubkey)) {
       case SSH_KEYTYPE_RSA:
         foundkey.keytype = CURLKHTYPE_RSA;
         break;
@@ -490,39 +305,31 @@ static int myssh_is_known(struct Curl_easy *data)
         foundkey.keytype = CURLKHTYPE_RSA1;
         break;
       case SSH_KEYTYPE_ECDSA:
-#if LIBSSH_VERSION_INT >= SSH_VERSION_INT(0,9,0)
       case SSH_KEYTYPE_ECDSA_P256:
       case SSH_KEYTYPE_ECDSA_P384:
       case SSH_KEYTYPE_ECDSA_P521:
-#endif
         foundkey.keytype = CURLKHTYPE_ECDSA;
         break;
-#if LIBSSH_VERSION_INT >= SSH_VERSION_INT(0,7,0)
       case SSH_KEYTYPE_ED25519:
         foundkey.keytype = CURLKHTYPE_ED25519;
         break;
-#endif
       case SSH_KEYTYPE_DSS:
         foundkey.keytype = CURLKHTYPE_DSS;
         break;
       default:
         rc = SSH_ERROR;
         goto cleanup;
-    }
+      }
 
-    Curl_set_in_callback(data, true);
-    rc = func(data, knownkeyp, /* from the knownhosts file */
-              &foundkey, /* from the remote host */
-              keymatch, data->set.ssh_keyfunc_userp);
-    Curl_set_in_callback(data, false);
+      Curl_set_in_callback(data, TRUE);
+      rc = func(data, knownkeyp, /* from the knownhosts file */
+                &foundkey,       /* from the remote host */
+                keymatch, data->set.ssh_keyfunc_userp);
+      Curl_set_in_callback(data, FALSE);
 
-    switch(rc) {
+      switch(rc) {
       case CURLKHSTAT_FINE_ADD_TO_FILE:
-#if LIBSSH_VERSION_INT >= SSH_VERSION_INT(0,8,0)
         rc = ssh_session_update_known_hosts(sshc->ssh_session);
-#else
-        rc = ssh_write_knownhost(sshc->ssh_session);
-#endif
         if(rc != SSH_OK) {
           goto cleanup;
         }
@@ -532,2161 +339,1163 @@ static int myssh_is_known(struct Curl_easy *data)
       default: /* REJECT/DEFER */
         rc = SSH_ERROR;
         goto cleanup;
+      }
     }
-  }
-  else {
-    if(keymatch != CURLKHMATCH_OK) {
-      rc = SSH_ERROR;
-      goto cleanup;
+    else {
+      if(keymatch != CURLKHMATCH_OK) {
+        rc = SSH_ERROR;
+        goto cleanup;
+      }
     }
   }
   rc = SSH_OK;
 
 cleanup:
   if(found_base64) {
-    (free)(found_base64);
+    /* !checksrc! disable BANNEDFUNC 1 */
+    free(found_base64); /* allocated by libssh, deallocate with system free */
   }
   if(known_base64) {
-    (free)(known_base64);
+    /* !checksrc! disable BANNEDFUNC 1 */
+    free(known_base64); /* allocated by libssh, deallocate with system free */
   }
-  if(hash)
-    ssh_clean_pubkey_hash(&hash);
+  if(hash_sha256)
+    ssh_clean_pubkey_hash(&hash_sha256);
+  if(hash_md5)
+    ssh_clean_pubkey_hash(&hash_md5);
   ssh_key_free(pubkey);
-#if LIBSSH_VERSION_INT >= SSH_VERSION_INT(0,9,0)
   if(knownhostsentry) {
     ssh_knownhosts_entry_free(knownhostsentry);
   }
-#endif
   return rc;
 }
 
-#define MOVE_TO_ERROR_STATE(_r) do {            \
-    state(data, SSH_SESSION_DISCONNECT);        \
-    sshc->actualcode = _r;                      \
-    rc = SSH_ERROR;                             \
-  } while(0)
+static int myssh_to_ERROR(struct Curl_easy *data,
+                          struct ssh_conn *sshc,
+                          CURLcode result)
+{
+  myssh_to(data, sshc, SSH_SESSION_DISCONNECT);
+  sshc->actualcode = result;
+  return SSH_ERROR;
+}
 
-#define MOVE_TO_SFTP_CLOSE_STATE() do {                         \
-    state(data, SSH_SFTP_CLOSE);                                \
-    sshc->actualcode =                                          \
-      sftp_error_to_CURLE(sftp_get_error(sshc->sftp_session));  \
-    rc = SSH_ERROR;                                             \
-  } while(0)
+static int myssh_to_SFTP_CLOSE(struct Curl_easy *data,
+                               struct ssh_conn *sshc)
+{
+  myssh_to(data, sshc, SSH_SFTP_CLOSE);
+  sshc->actualcode = sftp_error_to_CURLE(sftp_get_error(sshc->sftp_session));
+  return SSH_ERROR;
+}
 
-#define MOVE_TO_PASSWD_AUTH do {                        \
-    if(sshc->auth_methods & SSH_AUTH_METHOD_PASSWORD) { \
-      rc = SSH_OK;                                      \
-      state(data, SSH_AUTH_PASS_INIT);                  \
-    }                                                   \
-    else {                                              \
-      MOVE_TO_ERROR_STATE(CURLE_LOGIN_DENIED);          \
-    }                                                   \
-  } while(0)
+static int myssh_to_PASSWD_AUTH(struct Curl_easy *data,
+                                struct ssh_conn *sshc)
+{
+  if(sshc->auth_methods & SSH_AUTH_METHOD_PASSWORD) {
+    myssh_to(data, sshc, SSH_AUTH_PASS_INIT);
+    return SSH_OK;
+  }
+  return myssh_to_ERROR(data, sshc, CURLE_LOGIN_DENIED);
+}
 
-#define MOVE_TO_KEY_AUTH do {                                   \
-    if(sshc->auth_methods & SSH_AUTH_METHOD_INTERACTIVE) {      \
-      rc = SSH_OK;                                              \
-      state(data, SSH_AUTH_KEY_INIT);                           \
-    }                                                           \
-    else {                                                      \
-      MOVE_TO_PASSWD_AUTH;                                      \
-    }                                                           \
-  } while(0)
+static int myssh_to_KEY_AUTH(struct Curl_easy *data,
+                             struct ssh_conn *sshc)
+{
+  if(sshc->auth_methods & SSH_AUTH_METHOD_INTERACTIVE) {
+    myssh_to(data, sshc, SSH_AUTH_KEY_INIT);
+    return SSH_OK;
+  }
+  return myssh_to_PASSWD_AUTH(data, sshc);
+}
 
-#define MOVE_TO_GSSAPI_AUTH do {                                \
-    if(sshc->auth_methods & SSH_AUTH_METHOD_GSSAPI_MIC) {       \
-      rc = SSH_OK;                                              \
-      state(data, SSH_AUTH_GSSAPI);                             \
-    }                                                           \
-    else {                                                      \
-      MOVE_TO_KEY_AUTH;                                         \
-    }                                                           \
-  } while(0)
+static int myssh_to_GSSAPI_AUTH(struct Curl_easy *data,
+                                struct ssh_conn *sshc)
+{
+  if(sshc->auth_methods & SSH_AUTH_METHOD_GSSAPI_MIC) {
+    myssh_to(data, sshc, SSH_AUTH_GSSAPI);
+    return SSH_OK;
+  }
+  return myssh_to_KEY_AUTH(data, sshc);
+}
 
-static
-int myssh_auth_interactive(struct connectdata *conn)
+static int myssh_in_SFTP_READDIR_INIT(struct Curl_easy *data,
+                                      struct ssh_conn *sshc,
+                                      struct SSHPROTO *sshp)
+{
+  if(!sshp)
+    return myssh_to_ERROR(data, sshc, CURLE_FAILED_INIT);
+  Curl_pgrsSetDownloadSize(data, -1);
+  if(data->req.no_body) {
+    myssh_to(data, sshc, SSH_STOP);
+    return SSH_NO_ERROR;
+  }
+
+  /*
+   * This is a directory that we are trying to get, so produce a directory
+   * listing
+   */
+  sshc->sftp_dir = sftp_opendir(sshc->sftp_session,
+                                sshp->path);
+  if(!sshc->sftp_dir) {
+    failf(data, "Could not open directory for reading: %s",
+          ssh_get_error(sshc->ssh_session));
+    return myssh_to_SFTP_CLOSE(data, sshc);
+  }
+  myssh_to(data, sshc, SSH_SFTP_READDIR);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_READDIR(struct Curl_easy *data,
+                                 struct ssh_conn *sshc,
+                                 struct SSHPROTO *sshp)
+{
+  CURLcode result = CURLE_OK;
+
+  if(!sshp)
+    return myssh_to_ERROR(data, sshc, CURLE_FAILED_INIT);
+  curlx_dyn_reset(&sshc->readdir_buf);
+  if(sshc->readdir_attrs)
+    sftp_attributes_free(sshc->readdir_attrs);
+
+  sshc->readdir_attrs = sftp_readdir(sshc->sftp_session, sshc->sftp_dir);
+  if(sshc->readdir_attrs) {
+    sshc->readdir_filename = sshc->readdir_attrs->name;
+    sshc->readdir_longentry = sshc->readdir_attrs->longname;
+    sshc->readdir_len = strlen(sshc->readdir_filename);
+
+    if(data->set.list_only) {
+      char *tmpLine;
+
+      tmpLine = curl_maprintf("%s\n", sshc->readdir_filename);
+      if(!tmpLine) {
+        myssh_to(data, sshc, SSH_SFTP_CLOSE);
+        sshc->actualcode = CURLE_OUT_OF_MEMORY;
+        return SSH_ERROR;
+      }
+      result = Curl_client_write(data, CLIENTWRITE_BODY,
+                                 tmpLine, sshc->readdir_len + 1);
+      curlx_free(tmpLine);
+
+      if(result) {
+        myssh_to(data, sshc, SSH_STOP);
+        sshc->actualcode = result;
+        return SSH_NO_ERROR;
+      }
+    }
+    else {
+      if(curlx_dyn_add(&sshc->readdir_buf, sshc->readdir_longentry)) {
+        sshc->actualcode = CURLE_OUT_OF_MEMORY;
+        myssh_to(data, sshc, SSH_STOP);
+        return SSH_ERROR;
+      }
+
+      if((sshc->readdir_attrs->flags & SSH_FILEXFER_ATTR_PERMISSIONS) &&
+         ((sshc->readdir_attrs->permissions & SSH_S_IFMT) ==
+          SSH_S_IFLNK)) {
+        sshc->readdir_linkPath = curl_maprintf("%s%s", sshp->path,
+                                               sshc->readdir_filename);
+
+        if(!sshc->readdir_linkPath) {
+          myssh_to(data, sshc, SSH_SFTP_CLOSE);
+          sshc->actualcode = CURLE_OUT_OF_MEMORY;
+          return SSH_ERROR;
+        }
+
+        myssh_to(data, sshc, SSH_SFTP_READDIR_LINK);
+        return SSH_NO_ERROR;
+      }
+      myssh_to(data, sshc, SSH_SFTP_READDIR_BOTTOM);
+      return SSH_NO_ERROR;
+    }
+  }
+  else if(sftp_dir_eof(sshc->sftp_dir)) {
+    myssh_to(data, sshc, SSH_SFTP_READDIR_DONE);
+  }
+  else {
+    failf(data, "Could not open remote directory for reading: %s",
+          ssh_get_error(sshc->ssh_session));
+    return myssh_to_SFTP_CLOSE(data, sshc);
+  }
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_READDIR_LINK(struct Curl_easy *data,
+                                      struct ssh_conn *sshc)
+{
+  if(sshc->readdir_link_attrs)
+    sftp_attributes_free(sshc->readdir_link_attrs);
+
+  sshc->readdir_link_attrs = sftp_lstat(sshc->sftp_session,
+                                        sshc->readdir_linkPath);
+  if(!sshc->readdir_link_attrs) {
+    failf(data, "Could not read symlink for reading: %s",
+          ssh_get_error(sshc->ssh_session));
+    return myssh_to_SFTP_CLOSE(data, sshc);
+  }
+
+  if(!sshc->readdir_link_attrs->name) {
+    sshc->readdir_tmp = sftp_readlink(sshc->sftp_session,
+                                      sshc->readdir_linkPath);
+    if(!sshc->readdir_tmp)
+      sshc->readdir_len = 0;
+    else
+      sshc->readdir_len = strlen(sshc->readdir_tmp);
+    sshc->readdir_longentry = NULL;
+    sshc->readdir_filename = sshc->readdir_tmp;
+  }
+  else {
+    sshc->readdir_len = strlen(sshc->readdir_link_attrs->name);
+    sshc->readdir_filename = sshc->readdir_link_attrs->name;
+    sshc->readdir_longentry = sshc->readdir_link_attrs->longname;
+  }
+
+  curlx_safefree(sshc->readdir_linkPath);
+
+  if(curlx_dyn_addf(&sshc->readdir_buf, " -> %s", sshc->readdir_filename)) {
+    /* Not using:
+     * return myssh_to_SFTP_CLOSE(data, sshc);
+     *
+     * as that assumes an sftp related error while
+     * assigning sshc->actualcode whereas the current
+     * error is curlx_dyn_addf() related.
+     */
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
+    sshc->actualcode = CURLE_OUT_OF_MEMORY;
+    return SSH_ERROR;
+  }
+
+  sftp_attributes_free(sshc->readdir_link_attrs);
+  sshc->readdir_link_attrs = NULL;
+  sshc->readdir_filename = NULL;
+  sshc->readdir_longentry = NULL;
+
+  myssh_to(data, sshc, SSH_SFTP_READDIR_BOTTOM);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_READDIR_BOTTOM(struct Curl_easy *data,
+                                        struct ssh_conn *sshc)
+{
+  CURLcode result;
+
+  if(curlx_dyn_addn(&sshc->readdir_buf, "\n", 1))
+    result = CURLE_OUT_OF_MEMORY;
+  else
+    result = Curl_client_write(data, CLIENTWRITE_BODY,
+                               curlx_dyn_ptr(&sshc->readdir_buf),
+                               curlx_dyn_len(&sshc->readdir_buf));
+
+  ssh_string_free_char(sshc->readdir_tmp);
+  sshc->readdir_tmp = NULL;
+
+  if(result) {
+    myssh_to(data, sshc, SSH_STOP);
+    sshc->actualcode = result;
+  }
+  else
+    myssh_to(data, sshc, SSH_SFTP_READDIR);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_READDIR_DONE(struct Curl_easy *data,
+                                      struct ssh_conn *sshc)
+{
+  sftp_closedir(sshc->sftp_dir);
+  sshc->sftp_dir = NULL;
+
+  /* no data to transfer */
+  Curl_xfer_setup_nop(data);
+  myssh_to(data, sshc, SSH_STOP);
+  return SSH_NO_ERROR;
+}
+
+static void myssh_quote_error(struct Curl_easy *data, struct ssh_conn *sshc,
+                              const char *cmd)
+{
+  if(cmd)
+    failf(data, "%s command failed: %s", cmd,
+          ssh_get_error(sshc->ssh_session));
+  curlx_safefree(sshc->quote_path1);
+  curlx_safefree(sshc->quote_path2);
+  myssh_to(data, sshc, SSH_SFTP_CLOSE);
+  sshc->nextstate = SSH_NO_STATE;
+  sshc->actualcode = CURLE_QUOTE_ERROR;
+}
+
+static int myssh_in_SFTP_QUOTE_STATVFS(struct Curl_easy *data,
+                                       struct ssh_conn *sshc)
+{
+  sftp_statvfs_t statvfs;
+
+  statvfs = sftp_statvfs(sshc->sftp_session, sshc->quote_path1);
+  if(!statvfs && !sshc->acceptfail) {
+    myssh_quote_error(data, sshc, "statvfs");
+    return SSH_OK;
+  }
+  else if(statvfs) {
+#ifdef _MSC_VER
+#define CURL_LIBSSH_VFS_SIZE_MASK "I64u"
+#elif defined(__MINGW32__) && (__MINGW64_VERSION_MAJOR <= 6)
+#define CURL_LIBSSH_VFS_SIZE_MASK "llu"
+#else
+#define CURL_LIBSSH_VFS_SIZE_MASK PRIu64
+#endif
+    CURLcode result = CURLE_OK;
+    char *tmp = curl_maprintf("statvfs:\n"
+                              "f_bsize: %" CURL_LIBSSH_VFS_SIZE_MASK "\n"
+                              "f_frsize: %" CURL_LIBSSH_VFS_SIZE_MASK "\n"
+                              "f_blocks: %" CURL_LIBSSH_VFS_SIZE_MASK "\n"
+                              "f_bfree: %" CURL_LIBSSH_VFS_SIZE_MASK "\n"
+                              "f_bavail: %" CURL_LIBSSH_VFS_SIZE_MASK "\n"
+                              "f_files: %" CURL_LIBSSH_VFS_SIZE_MASK "\n"
+                              "f_ffree: %" CURL_LIBSSH_VFS_SIZE_MASK "\n"
+                              "f_favail: %" CURL_LIBSSH_VFS_SIZE_MASK "\n"
+                              "f_fsid: %" CURL_LIBSSH_VFS_SIZE_MASK "\n"
+                              "f_flag: %" CURL_LIBSSH_VFS_SIZE_MASK "\n"
+                              "f_namemax: %" CURL_LIBSSH_VFS_SIZE_MASK "\n",
+                              statvfs->f_bsize, statvfs->f_frsize,
+                              statvfs->f_blocks, statvfs->f_bfree,
+                              statvfs->f_bavail, statvfs->f_files,
+                              statvfs->f_ffree, statvfs->f_favail,
+                              statvfs->f_fsid, statvfs->f_flag,
+                              statvfs->f_namemax);
+    sftp_statvfs_free(statvfs);
+
+    if(!tmp)
+      result = CURLE_OUT_OF_MEMORY;
+
+    if(!result) {
+      result = Curl_client_write(data, CLIENTWRITE_HEADER, tmp, strlen(tmp));
+      curlx_free(tmp);
+    }
+    if(result) {
+      myssh_to(data, sshc, SSH_SFTP_CLOSE);
+      sshc->nextstate = SSH_NO_STATE;
+      sshc->actualcode = result;
+    }
+  }
+  myssh_to(data, sshc, SSH_SFTP_NEXT_QUOTE);
+  return SSH_OK;
+}
+
+static int myssh_auth_interactive(struct connectdata *conn,
+                                  struct ssh_conn *sshc)
 {
   int rc;
-  struct ssh_conn *sshc = &conn->proto.sshc;
   int nprompts;
 
 restart:
   switch(sshc->kbd_state) {
-    case 0:
-      rc = ssh_userauth_kbdint(sshc->ssh_session, NULL, NULL);
-      if(rc == SSH_AUTH_AGAIN)
-        return SSH_AGAIN;
+  case 0:
+    rc = ssh_userauth_kbdint(sshc->ssh_session, NULL, NULL);
+    if(rc == SSH_AUTH_AGAIN)
+      return SSH_AGAIN;
 
-      if(rc != SSH_AUTH_INFO)
-        return SSH_ERROR;
-
-      nprompts = ssh_userauth_kbdint_getnprompts(sshc->ssh_session);
-      if(nprompts != 1)
-        return SSH_ERROR;
-
-      rc = ssh_userauth_kbdint_setanswer(sshc->ssh_session, 0, conn->passwd);
-      if(rc < 0)
-        return SSH_ERROR;
-
-    /* FALLTHROUGH */
-    case 1:
-      sshc->kbd_state = 1;
-
-      rc = ssh_userauth_kbdint(sshc->ssh_session, NULL, NULL);
-      if(rc == SSH_AUTH_AGAIN)
-        return SSH_AGAIN;
-      else if(rc == SSH_AUTH_SUCCESS)
-        rc = SSH_OK;
-      else if(rc == SSH_AUTH_INFO) {
-        nprompts = ssh_userauth_kbdint_getnprompts(sshc->ssh_session);
-        if(nprompts)
-          return SSH_ERROR;
-
-        sshc->kbd_state = 2;
-        goto restart;
-      }
-      else
-        rc = SSH_ERROR;
-      break;
-    case 2:
-      sshc->kbd_state = 2;
-
-      rc = ssh_userauth_kbdint(sshc->ssh_session, NULL, NULL);
-      if(rc == SSH_AUTH_AGAIN)
-        return SSH_AGAIN;
-      else if(rc == SSH_AUTH_SUCCESS)
-        rc = SSH_OK;
-      else
-        rc = SSH_ERROR;
-
-      break;
-    default:
+    if(rc != SSH_AUTH_INFO)
       return SSH_ERROR;
+
+    nprompts = ssh_userauth_kbdint_getnprompts(sshc->ssh_session);
+    if(nprompts != 1)
+      return SSH_ERROR;
+
+    rc = ssh_userauth_kbdint_setanswer(sshc->ssh_session, 0,
+                                       Curl_creds_passwd(conn->creds));
+    if(rc < 0)
+      return SSH_ERROR;
+
+    FALLTHROUGH();
+  case 1:
+    sshc->kbd_state = 1;
+
+    rc = ssh_userauth_kbdint(sshc->ssh_session, NULL, NULL);
+    if(rc == SSH_AUTH_AGAIN)
+      return SSH_AGAIN;
+    else if(rc == SSH_AUTH_SUCCESS)
+      rc = SSH_OK;
+    else if(rc == SSH_AUTH_INFO) {
+      nprompts = ssh_userauth_kbdint_getnprompts(sshc->ssh_session);
+      if(nprompts)
+        return SSH_ERROR;
+
+      sshc->kbd_state = 2;
+      goto restart;
+    }
+    else
+      rc = SSH_ERROR;
+    break;
+  case 2:
+    sshc->kbd_state = 2;
+
+    rc = ssh_userauth_kbdint(sshc->ssh_session, NULL, NULL);
+    if(rc == SSH_AUTH_AGAIN)
+      return SSH_AGAIN;
+    else if(rc == SSH_AUTH_SUCCESS)
+      rc = SSH_OK;
+    else
+      rc = SSH_ERROR;
+
+    break;
+  default:
+    return SSH_ERROR;
   }
 
   sshc->kbd_state = 0;
   return rc;
 }
 
-/*
- * ssh_statemach_act() runs the SSH state machine as far as it can without
- * blocking and without reaching the end.  The data the pointer 'block' points
- * to will be set to TRUE if the libssh function returns SSH_AGAIN
- * meaning it wants to be called again when the socket is ready
- */
-static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
+static void myssh_state_init(struct Curl_easy *data,
+                             struct ssh_conn *sshc)
 {
-  CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct SSHPROTO *protop = data->req.p.ssh;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-  curl_socket_t sock = conn->sock[FIRSTSOCKET];
-  int rc = SSH_NO_ERROR, err;
-  int seekerr = CURL_SEEKFUNC_OK;
-  const char *err_msg;
-  *block = 0;                   /* we're not blocking by default */
-
-  do {
-
-    switch(sshc->state) {
-    case SSH_INIT:
-      sshc->secondCreateDirs = 0;
-      sshc->nextstate = SSH_NO_STATE;
-      sshc->actualcode = CURLE_OK;
+  sshc->secondCreateDirs = 0;
+  sshc->nextstate = SSH_NO_STATE;
+  sshc->actualcode = CURLE_OK;
 
 #if 0
-      ssh_set_log_level(SSH_LOG_PROTOCOL);
+  ssh_set_log_level(SSH_LOG_PROTOCOL);
 #endif
 
-      /* Set libssh to non-blocking, since everything internally is
-         non-blocking */
-      ssh_set_blocking(sshc->ssh_session, 0);
+  /* Set libssh to non-blocking, since everything internally is
+     non-blocking */
+  ssh_set_blocking(sshc->ssh_session, 0);
 
-      state(data, SSH_S_STARTUP);
-      /* FALLTHROUGH */
-
-    case SSH_S_STARTUP:
-      rc = ssh_connect(sshc->ssh_session);
-      if(rc == SSH_AGAIN)
-        break;
-
-      if(rc != SSH_OK) {
-        failf(data, "Failure establishing ssh session");
-        MOVE_TO_ERROR_STATE(CURLE_FAILED_INIT);
-        break;
-      }
-
-      state(data, SSH_HOSTKEY);
-
-      /* FALLTHROUGH */
-    case SSH_HOSTKEY:
-
-      rc = myssh_is_known(data);
-      if(rc != SSH_OK) {
-        MOVE_TO_ERROR_STATE(CURLE_PEER_FAILED_VERIFICATION);
-        break;
-      }
-
-      state(data, SSH_AUTHLIST);
-      /* FALLTHROUGH */
-    case SSH_AUTHLIST:{
-        sshc->authed = FALSE;
-
-        rc = ssh_userauth_none(sshc->ssh_session, NULL);
-        if(rc == SSH_AUTH_AGAIN) {
-          rc = SSH_AGAIN;
-          break;
-        }
-
-        if(rc == SSH_AUTH_SUCCESS) {
-          sshc->authed = TRUE;
-          infof(data, "Authenticated with none");
-          state(data, SSH_AUTH_DONE);
-          break;
-        }
-        else if(rc == SSH_AUTH_ERROR) {
-          MOVE_TO_ERROR_STATE(CURLE_LOGIN_DENIED);
-          break;
-        }
-
-        sshc->auth_methods = ssh_userauth_list(sshc->ssh_session, NULL);
-        if(sshc->auth_methods)
-          infof(data, "SSH authentication methods available: %s%s%s%s",
-                sshc->auth_methods & SSH_AUTH_METHOD_PUBLICKEY ?
-                "public key, ": "",
-                sshc->auth_methods & SSH_AUTH_METHOD_GSSAPI_MIC ?
-                "GSSAPI, " : "",
-                sshc->auth_methods & SSH_AUTH_METHOD_INTERACTIVE ?
-                "keyboard-interactive, " : "",
-                sshc->auth_methods & SSH_AUTH_METHOD_PASSWORD ?
-                "password": "");
-        if(sshc->auth_methods & SSH_AUTH_METHOD_PUBLICKEY) {
-          state(data, SSH_AUTH_PKEY_INIT);
-          infof(data, "Authentication using SSH public key file");
-        }
-        else if(sshc->auth_methods & SSH_AUTH_METHOD_GSSAPI_MIC) {
-          state(data, SSH_AUTH_GSSAPI);
-        }
-        else if(sshc->auth_methods & SSH_AUTH_METHOD_INTERACTIVE) {
-          state(data, SSH_AUTH_KEY_INIT);
-        }
-        else if(sshc->auth_methods & SSH_AUTH_METHOD_PASSWORD) {
-          state(data, SSH_AUTH_PASS_INIT);
-        }
-        else {                  /* unsupported authentication method */
-          MOVE_TO_ERROR_STATE(CURLE_LOGIN_DENIED);
-          break;
-        }
-
-        break;
-      }
-    case SSH_AUTH_PKEY_INIT:
-      if(!(data->set.ssh_auth_types & CURLSSH_AUTH_PUBLICKEY)) {
-        MOVE_TO_GSSAPI_AUTH;
-        break;
-      }
-
-      /* Two choices, (1) private key was given on CMD,
-       * (2) use the "default" keys. */
-      if(data->set.str[STRING_SSH_PRIVATE_KEY]) {
-        if(sshc->pubkey && !data->set.ssl.key_passwd) {
-          rc = ssh_userauth_try_publickey(sshc->ssh_session, NULL,
-                                          sshc->pubkey);
-          if(rc == SSH_AUTH_AGAIN) {
-            rc = SSH_AGAIN;
-            break;
-          }
-
-          if(rc != SSH_OK) {
-            MOVE_TO_GSSAPI_AUTH;
-            break;
-          }
-        }
-
-        rc = ssh_pki_import_privkey_file(data->
-                                         set.str[STRING_SSH_PRIVATE_KEY],
-                                         data->set.ssl.key_passwd, NULL,
-                                         NULL, &sshc->privkey);
-        if(rc != SSH_OK) {
-          failf(data, "Could not load private key file %s",
-                data->set.str[STRING_SSH_PRIVATE_KEY]);
-          MOVE_TO_ERROR_STATE(CURLE_LOGIN_DENIED);
-          break;
-        }
-
-        state(data, SSH_AUTH_PKEY);
-        break;
-
-      }
-      else {
-        rc = ssh_userauth_publickey_auto(sshc->ssh_session, NULL,
-                                         data->set.ssl.key_passwd);
-        if(rc == SSH_AUTH_AGAIN) {
-          rc = SSH_AGAIN;
-          break;
-        }
-        if(rc == SSH_AUTH_SUCCESS) {
-          rc = SSH_OK;
-          sshc->authed = TRUE;
-          infof(data, "Completed public key authentication");
-          state(data, SSH_AUTH_DONE);
-          break;
-        }
-
-        MOVE_TO_GSSAPI_AUTH;
-      }
-      break;
-    case SSH_AUTH_PKEY:
-      rc = ssh_userauth_publickey(sshc->ssh_session, NULL, sshc->privkey);
-      if(rc == SSH_AUTH_AGAIN) {
-        rc = SSH_AGAIN;
-        break;
-      }
-
-      if(rc == SSH_AUTH_SUCCESS) {
-        sshc->authed = TRUE;
-        infof(data, "Completed public key authentication");
-        state(data, SSH_AUTH_DONE);
-        break;
-      }
-      else {
-        infof(data, "Failed public key authentication (rc: %d)", rc);
-        MOVE_TO_GSSAPI_AUTH;
-      }
-      break;
-
-    case SSH_AUTH_GSSAPI:
-      if(!(data->set.ssh_auth_types & CURLSSH_AUTH_GSSAPI)) {
-        MOVE_TO_KEY_AUTH;
-        break;
-      }
-
-      rc = ssh_userauth_gssapi(sshc->ssh_session);
-      if(rc == SSH_AUTH_AGAIN) {
-        rc = SSH_AGAIN;
-        break;
-      }
-
-      if(rc == SSH_AUTH_SUCCESS) {
-        rc = SSH_OK;
-        sshc->authed = TRUE;
-        infof(data, "Completed gssapi authentication");
-        state(data, SSH_AUTH_DONE);
-        break;
-      }
-
-      MOVE_TO_KEY_AUTH;
-      break;
-
-    case SSH_AUTH_KEY_INIT:
-      if(data->set.ssh_auth_types & CURLSSH_AUTH_KEYBOARD) {
-        state(data, SSH_AUTH_KEY);
-      }
-      else {
-        MOVE_TO_PASSWD_AUTH;
-      }
-      break;
-
-    case SSH_AUTH_KEY:
-      /* keyboard-interactive authentication */
-      rc = myssh_auth_interactive(conn);
-      if(rc == SSH_AGAIN) {
-        break;
-      }
-      if(rc == SSH_OK) {
-        sshc->authed = TRUE;
-        infof(data, "completed keyboard interactive authentication");
-        state(data, SSH_AUTH_DONE);
-      }
-      else {
-        MOVE_TO_PASSWD_AUTH;
-      }
-      break;
-
-    case SSH_AUTH_PASS_INIT:
-      if(!(data->set.ssh_auth_types & CURLSSH_AUTH_PASSWORD)) {
-        MOVE_TO_ERROR_STATE(CURLE_LOGIN_DENIED);
-        break;
-      }
-      state(data, SSH_AUTH_PASS);
-      /* FALLTHROUGH */
-
-    case SSH_AUTH_PASS:
-      rc = ssh_userauth_password(sshc->ssh_session, NULL, conn->passwd);
-      if(rc == SSH_AUTH_AGAIN) {
-        rc = SSH_AGAIN;
-        break;
-      }
-
-      if(rc == SSH_AUTH_SUCCESS) {
-        sshc->authed = TRUE;
-        infof(data, "Completed password authentication");
-        state(data, SSH_AUTH_DONE);
-      }
-      else {
-        MOVE_TO_ERROR_STATE(CURLE_LOGIN_DENIED);
-      }
-      break;
-
-    case SSH_AUTH_DONE:
-      if(!sshc->authed) {
-        failf(data, "Authentication failure");
-        MOVE_TO_ERROR_STATE(CURLE_LOGIN_DENIED);
-        break;
-      }
-
-      /*
-       * At this point we have an authenticated ssh session.
-       */
-      infof(data, "Authentication complete");
-
-      Curl_pgrsTime(data, TIMER_APPCONNECT);      /* SSH is connected */
-
-      conn->sockfd = sock;
-      conn->writesockfd = CURL_SOCKET_BAD;
-
-      if(conn->handler->protocol == CURLPROTO_SFTP) {
-        state(data, SSH_SFTP_INIT);
-        break;
-      }
-      infof(data, "SSH CONNECT phase done");
-      state(data, SSH_STOP);
-      break;
-
-    case SSH_SFTP_INIT:
-      ssh_set_blocking(sshc->ssh_session, 1);
-
-      sshc->sftp_session = sftp_new(sshc->ssh_session);
-      if(!sshc->sftp_session) {
-        failf(data, "Failure initializing sftp session: %s",
-              ssh_get_error(sshc->ssh_session));
-        MOVE_TO_ERROR_STATE(CURLE_COULDNT_CONNECT);
-        break;
-      }
-
-      rc = sftp_init(sshc->sftp_session);
-      if(rc != SSH_OK) {
-        failf(data, "Failure initializing sftp session: %s",
-              ssh_get_error(sshc->ssh_session));
-        MOVE_TO_ERROR_STATE(sftp_error_to_CURLE(SSH_FX_FAILURE));
-        break;
-      }
-      state(data, SSH_SFTP_REALPATH);
-      /* FALLTHROUGH */
-    case SSH_SFTP_REALPATH:
-      /*
-       * Get the "home" directory
-       */
-      sshc->homedir = sftp_canonicalize_path(sshc->sftp_session, ".");
-      if(!sshc->homedir) {
-        MOVE_TO_ERROR_STATE(CURLE_COULDNT_CONNECT);
-        break;
-      }
-      data->state.most_recent_ftp_entrypath = sshc->homedir;
-
-      /* This is the last step in the SFTP connect phase. Do note that while
-         we get the homedir here, we get the "workingpath" in the DO action
-         since the homedir will remain the same between request but the
-         working path will not. */
-      DEBUGF(infof(data, "SSH CONNECT phase done"));
-      state(data, SSH_STOP);
-      break;
-
-    case SSH_SFTP_QUOTE_INIT:
-      result = Curl_getworkingpath(data, sshc->homedir, &protop->path);
-      if(result) {
-        sshc->actualcode = result;
-        state(data, SSH_STOP);
-        break;
-      }
-
-      if(data->set.quote) {
-        infof(data, "Sending quote commands");
-        sshc->quote_item = data->set.quote;
-        state(data, SSH_SFTP_QUOTE);
-      }
-      else {
-        state(data, SSH_SFTP_GETINFO);
-      }
-      break;
-
-    case SSH_SFTP_POSTQUOTE_INIT:
-      if(data->set.postquote) {
-        infof(data, "Sending quote commands");
-        sshc->quote_item = data->set.postquote;
-        state(data, SSH_SFTP_QUOTE);
-      }
-      else {
-        state(data, SSH_STOP);
-      }
-      break;
-
-    case SSH_SFTP_QUOTE:
-      /* Send any quote commands */
-      sftp_quote(data);
-      break;
-
-    case SSH_SFTP_NEXT_QUOTE:
-      Curl_safefree(sshc->quote_path1);
-      Curl_safefree(sshc->quote_path2);
-
-      sshc->quote_item = sshc->quote_item->next;
-
-      if(sshc->quote_item) {
-        state(data, SSH_SFTP_QUOTE);
-      }
-      else {
-        if(sshc->nextstate != SSH_NO_STATE) {
-          state(data, sshc->nextstate);
-          sshc->nextstate = SSH_NO_STATE;
-        }
-        else {
-          state(data, SSH_SFTP_GETINFO);
-        }
-      }
-      break;
-
-    case SSH_SFTP_QUOTE_STAT:
-      sftp_quote_stat(data);
-      break;
-
-    case SSH_SFTP_QUOTE_SETSTAT:
-      rc = sftp_setstat(sshc->sftp_session, sshc->quote_path2,
-                        sshc->quote_attrs);
-      if(rc && !sshc->acceptfail) {
-        Curl_safefree(sshc->quote_path1);
-        Curl_safefree(sshc->quote_path2);
-        failf(data, "Attempt to set SFTP stats failed: %s",
-              ssh_get_error(sshc->ssh_session));
-        state(data, SSH_SFTP_CLOSE);
-        sshc->nextstate = SSH_NO_STATE;
-        sshc->actualcode = CURLE_QUOTE_ERROR;
-        /* sshc->actualcode = sftp_error_to_CURLE(err);
-         * we do not send the actual error; we return
-         * the error the libssh2 backend is returning */
-        break;
-      }
-      state(data, SSH_SFTP_NEXT_QUOTE);
-      break;
-
-    case SSH_SFTP_QUOTE_SYMLINK:
-      rc = sftp_symlink(sshc->sftp_session, sshc->quote_path2,
-                        sshc->quote_path1);
-      if(rc && !sshc->acceptfail) {
-        Curl_safefree(sshc->quote_path1);
-        Curl_safefree(sshc->quote_path2);
-        failf(data, "symlink command failed: %s",
-              ssh_get_error(sshc->ssh_session));
-        state(data, SSH_SFTP_CLOSE);
-        sshc->nextstate = SSH_NO_STATE;
-        sshc->actualcode = CURLE_QUOTE_ERROR;
-        break;
-      }
-      state(data, SSH_SFTP_NEXT_QUOTE);
-      break;
-
-    case SSH_SFTP_QUOTE_MKDIR:
-      rc = sftp_mkdir(sshc->sftp_session, sshc->quote_path1,
-                      (mode_t)data->set.new_directory_perms);
-      if(rc && !sshc->acceptfail) {
-        Curl_safefree(sshc->quote_path1);
-        failf(data, "mkdir command failed: %s",
-              ssh_get_error(sshc->ssh_session));
-        state(data, SSH_SFTP_CLOSE);
-        sshc->nextstate = SSH_NO_STATE;
-        sshc->actualcode = CURLE_QUOTE_ERROR;
-        break;
-      }
-      state(data, SSH_SFTP_NEXT_QUOTE);
-      break;
-
-    case SSH_SFTP_QUOTE_RENAME:
-      rc = sftp_rename(sshc->sftp_session, sshc->quote_path1,
-                       sshc->quote_path2);
-      if(rc && !sshc->acceptfail) {
-        Curl_safefree(sshc->quote_path1);
-        Curl_safefree(sshc->quote_path2);
-        failf(data, "rename command failed: %s",
-              ssh_get_error(sshc->ssh_session));
-        state(data, SSH_SFTP_CLOSE);
-        sshc->nextstate = SSH_NO_STATE;
-        sshc->actualcode = CURLE_QUOTE_ERROR;
-        break;
-      }
-      state(data, SSH_SFTP_NEXT_QUOTE);
-      break;
-
-    case SSH_SFTP_QUOTE_RMDIR:
-      rc = sftp_rmdir(sshc->sftp_session, sshc->quote_path1);
-      if(rc && !sshc->acceptfail) {
-        Curl_safefree(sshc->quote_path1);
-        failf(data, "rmdir command failed: %s",
-              ssh_get_error(sshc->ssh_session));
-        state(data, SSH_SFTP_CLOSE);
-        sshc->nextstate = SSH_NO_STATE;
-        sshc->actualcode = CURLE_QUOTE_ERROR;
-        break;
-      }
-      state(data, SSH_SFTP_NEXT_QUOTE);
-      break;
-
-    case SSH_SFTP_QUOTE_UNLINK:
-      rc = sftp_unlink(sshc->sftp_session, sshc->quote_path1);
-      if(rc && !sshc->acceptfail) {
-        Curl_safefree(sshc->quote_path1);
-        failf(data, "rm command failed: %s",
-              ssh_get_error(sshc->ssh_session));
-        state(data, SSH_SFTP_CLOSE);
-        sshc->nextstate = SSH_NO_STATE;
-        sshc->actualcode = CURLE_QUOTE_ERROR;
-        break;
-      }
-      state(data, SSH_SFTP_NEXT_QUOTE);
-      break;
-
-    case SSH_SFTP_QUOTE_STATVFS:
-    {
-      sftp_statvfs_t statvfs;
-
-      statvfs = sftp_statvfs(sshc->sftp_session, sshc->quote_path1);
-      if(!statvfs && !sshc->acceptfail) {
-        Curl_safefree(sshc->quote_path1);
-        failf(data, "statvfs command failed: %s",
-              ssh_get_error(sshc->ssh_session));
-        state(data, SSH_SFTP_CLOSE);
-        sshc->nextstate = SSH_NO_STATE;
-        sshc->actualcode = CURLE_QUOTE_ERROR;
-        break;
-      }
-      else if(statvfs) {
-        char *tmp = aprintf("statvfs:\n"
-                            "f_bsize: %llu\n" "f_frsize: %llu\n"
-                            "f_blocks: %llu\n" "f_bfree: %llu\n"
-                            "f_bavail: %llu\n" "f_files: %llu\n"
-                            "f_ffree: %llu\n" "f_favail: %llu\n"
-                            "f_fsid: %llu\n" "f_flag: %llu\n"
-                            "f_namemax: %llu\n",
-                            statvfs->f_bsize, statvfs->f_frsize,
-                            statvfs->f_blocks, statvfs->f_bfree,
-                            statvfs->f_bavail, statvfs->f_files,
-                            statvfs->f_ffree, statvfs->f_favail,
-                            statvfs->f_fsid, statvfs->f_flag,
-                            statvfs->f_namemax);
-        sftp_statvfs_free(statvfs);
-
-        if(!tmp) {
-          result = CURLE_OUT_OF_MEMORY;
-          state(data, SSH_SFTP_CLOSE);
-          sshc->nextstate = SSH_NO_STATE;
-          break;
-        }
-
-        result = Curl_client_write(data, CLIENTWRITE_HEADER, tmp, strlen(tmp));
-        free(tmp);
-        if(result) {
-          state(data, SSH_SFTP_CLOSE);
-          sshc->nextstate = SSH_NO_STATE;
-          sshc->actualcode = result;
-        }
-      }
-      state(data, SSH_SFTP_NEXT_QUOTE);
-      break;
-    }
-
-    case SSH_SFTP_GETINFO:
-      if(data->set.get_filetime) {
-        state(data, SSH_SFTP_FILETIME);
-      }
-      else {
-        state(data, SSH_SFTP_TRANS_INIT);
-      }
-      break;
-
-    case SSH_SFTP_FILETIME:
-    {
-      sftp_attributes attrs;
-
-      attrs = sftp_stat(sshc->sftp_session, protop->path);
-      if(attrs) {
-        data->info.filetime = attrs->mtime;
-        sftp_attributes_free(attrs);
-      }
-
-      state(data, SSH_SFTP_TRANS_INIT);
-      break;
-    }
-
-    case SSH_SFTP_TRANS_INIT:
-      if(data->state.upload)
-        state(data, SSH_SFTP_UPLOAD_INIT);
-      else {
-        if(protop->path[strlen(protop->path)-1] == '/')
-          state(data, SSH_SFTP_READDIR_INIT);
-        else
-          state(data, SSH_SFTP_DOWNLOAD_INIT);
-      }
-      break;
-
-    case SSH_SFTP_UPLOAD_INIT:
-    {
-      int flags;
-
-      if(data->state.resume_from) {
-        sftp_attributes attrs;
-
-        if(data->state.resume_from < 0) {
-          attrs = sftp_stat(sshc->sftp_session, protop->path);
-          if(attrs) {
-            curl_off_t size = attrs->size;
-            if(size < 0) {
-              failf(data, "Bad file size (%" CURL_FORMAT_CURL_OFF_T ")", size);
-              MOVE_TO_ERROR_STATE(CURLE_BAD_DOWNLOAD_RESUME);
-              break;
-            }
-            data->state.resume_from = attrs->size;
-
-            sftp_attributes_free(attrs);
-          }
-          else {
-            data->state.resume_from = 0;
-          }
-        }
-      }
-
-      if(data->set.remote_append)
-        /* Try to open for append, but create if nonexisting */
-        flags = O_WRONLY|O_CREAT|O_APPEND;
-      else if(data->state.resume_from > 0)
-        /* If we have restart position then open for append */
-        flags = O_WRONLY|O_APPEND;
-      else
-        /* Clear file before writing (normal behavior) */
-        flags = O_WRONLY|O_CREAT|O_TRUNC;
-
-      if(sshc->sftp_file)
-        sftp_close(sshc->sftp_file);
-      sshc->sftp_file =
-        sftp_open(sshc->sftp_session, protop->path,
-                  flags, (mode_t)data->set.new_file_perms);
-      if(!sshc->sftp_file) {
-        err = sftp_get_error(sshc->sftp_session);
-
-        if(((err == SSH_FX_NO_SUCH_FILE || err == SSH_FX_FAILURE ||
-             err == SSH_FX_NO_SUCH_PATH)) &&
-             (data->set.ftp_create_missing_dirs &&
-             (strlen(protop->path) > 1))) {
-               /* try to create the path remotely */
-               rc = 0;
-               sshc->secondCreateDirs = 1;
-               state(data, SSH_SFTP_CREATE_DIRS_INIT);
-               break;
-        }
-        else {
-          MOVE_TO_SFTP_CLOSE_STATE();
-          break;
-        }
-      }
-
-      /* If we have a restart point then we need to seek to the correct
-         position. */
-      if(data->state.resume_from > 0) {
-        /* Let's read off the proper amount of bytes from the input. */
-        if(conn->seek_func) {
-          Curl_set_in_callback(data, true);
-          seekerr = conn->seek_func(conn->seek_client, data->state.resume_from,
-                                    SEEK_SET);
-          Curl_set_in_callback(data, false);
-        }
-
-        if(seekerr != CURL_SEEKFUNC_OK) {
-          curl_off_t passed = 0;
-
-          if(seekerr != CURL_SEEKFUNC_CANTSEEK) {
-            failf(data, "Could not seek stream");
-            return CURLE_FTP_COULDNT_USE_REST;
-          }
-          /* seekerr == CURL_SEEKFUNC_CANTSEEK (can't seek to offset) */
-          do {
-            size_t readthisamountnow =
-              (data->state.resume_from - passed > data->set.buffer_size) ?
-              (size_t)data->set.buffer_size :
-              curlx_sotouz(data->state.resume_from - passed);
-
-            size_t actuallyread =
-              data->state.fread_func(data->state.buffer, 1,
-                                     readthisamountnow, data->state.in);
-
-            passed += actuallyread;
-            if((actuallyread == 0) || (actuallyread > readthisamountnow)) {
-              /* this checks for greater-than only to make sure that the
-                 CURL_READFUNC_ABORT return code still aborts */
-              failf(data, "Failed to read data");
-              MOVE_TO_ERROR_STATE(CURLE_FTP_COULDNT_USE_REST);
-              break;
-            }
-          } while(passed < data->state.resume_from);
-          if(rc)
-            break;
-        }
-
-        /* now, decrease the size of the read */
-        if(data->state.infilesize > 0) {
-          data->state.infilesize -= data->state.resume_from;
-          data->req.size = data->state.infilesize;
-          Curl_pgrsSetUploadSize(data, data->state.infilesize);
-        }
-
-        rc = sftp_seek64(sshc->sftp_file, data->state.resume_from);
-        if(rc) {
-          MOVE_TO_SFTP_CLOSE_STATE();
-          break;
-        }
-      }
-      if(data->state.infilesize > 0) {
-        data->req.size = data->state.infilesize;
-        Curl_pgrsSetUploadSize(data, data->state.infilesize);
-      }
-      /* upload data */
-      Curl_setup_transfer(data, -1, -1, FALSE, FIRSTSOCKET);
-
-      /* not set by Curl_setup_transfer to preserve keepon bits */
-      conn->sockfd = conn->writesockfd;
-
-      /* store this original bitmask setup to use later on if we can't
-         figure out a "real" bitmask */
-      sshc->orig_waitfor = data->req.keepon;
-
-      /* we want to use the _sending_ function even when the socket turns
-         out readable as the underlying libssh sftp send function will deal
-         with both accordingly */
-      conn->cselect_bits = CURL_CSELECT_OUT;
-
-      /* since we don't really wait for anything at this point, we want the
-         state machine to move on as soon as possible so we set a very short
-         timeout here */
-      Curl_expire(data, 0, EXPIRE_RUN_NOW);
-
-      state(data, SSH_STOP);
-      break;
-    }
-
-    case SSH_SFTP_CREATE_DIRS_INIT:
-      if(strlen(protop->path) > 1) {
-        sshc->slash_pos = protop->path + 1; /* ignore the leading '/' */
-        state(data, SSH_SFTP_CREATE_DIRS);
-      }
-      else {
-        state(data, SSH_SFTP_UPLOAD_INIT);
-      }
-      break;
-
-    case SSH_SFTP_CREATE_DIRS:
-      sshc->slash_pos = strchr(sshc->slash_pos, '/');
-      if(sshc->slash_pos) {
-        *sshc->slash_pos = 0;
-
-        infof(data, "Creating directory '%s'", protop->path);
-        state(data, SSH_SFTP_CREATE_DIRS_MKDIR);
-        break;
-      }
-      state(data, SSH_SFTP_UPLOAD_INIT);
-      break;
-
-    case SSH_SFTP_CREATE_DIRS_MKDIR:
-      /* 'mode' - parameter is preliminary - default to 0644 */
-      rc = sftp_mkdir(sshc->sftp_session, protop->path,
-                      (mode_t)data->set.new_directory_perms);
-      *sshc->slash_pos = '/';
-      ++sshc->slash_pos;
-      if(rc < 0) {
-        /*
-         * Abort if failure wasn't that the dir already exists or the
-         * permission was denied (creation might succeed further down the
-         * path) - retry on unspecific FAILURE also
-         */
-        err = sftp_get_error(sshc->sftp_session);
-        if((err != SSH_FX_FILE_ALREADY_EXISTS) &&
-           (err != SSH_FX_FAILURE) &&
-           (err != SSH_FX_PERMISSION_DENIED)) {
-          MOVE_TO_SFTP_CLOSE_STATE();
-          break;
-        }
-        rc = 0; /* clear rc and continue */
-      }
-      state(data, SSH_SFTP_CREATE_DIRS);
-      break;
-
-    case SSH_SFTP_READDIR_INIT:
-      Curl_pgrsSetDownloadSize(data, -1);
-      if(data->req.no_body) {
-        state(data, SSH_STOP);
-        break;
-      }
-
-      /*
-       * This is a directory that we are trying to get, so produce a directory
-       * listing
-       */
-      sshc->sftp_dir = sftp_opendir(sshc->sftp_session,
-                                    protop->path);
-      if(!sshc->sftp_dir) {
-        failf(data, "Could not open directory for reading: %s",
-              ssh_get_error(sshc->ssh_session));
-        MOVE_TO_SFTP_CLOSE_STATE();
-        break;
-      }
-      state(data, SSH_SFTP_READDIR);
-      break;
-
-    case SSH_SFTP_READDIR:
-      Curl_dyn_reset(&sshc->readdir_buf);
-      if(sshc->readdir_attrs)
-        sftp_attributes_free(sshc->readdir_attrs);
-
-      sshc->readdir_attrs = sftp_readdir(sshc->sftp_session, sshc->sftp_dir);
-      if(sshc->readdir_attrs) {
-        sshc->readdir_filename = sshc->readdir_attrs->name;
-        sshc->readdir_longentry = sshc->readdir_attrs->longname;
-        sshc->readdir_len = strlen(sshc->readdir_filename);
-
-        if(data->set.list_only) {
-          char *tmpLine;
-
-          tmpLine = aprintf("%s\n", sshc->readdir_filename);
-          if(!tmpLine) {
-            state(data, SSH_SFTP_CLOSE);
-            sshc->actualcode = CURLE_OUT_OF_MEMORY;
-            break;
-          }
-          result = Curl_client_write(data, CLIENTWRITE_BODY,
-                                     tmpLine, sshc->readdir_len + 1);
-          free(tmpLine);
-
-          if(result) {
-            state(data, SSH_STOP);
-            break;
-          }
-          /* since this counts what we send to the client, we include the
-             newline in this counter */
-          data->req.bytecount += sshc->readdir_len + 1;
-
-          /* output debug output if that is requested */
-          Curl_debug(data, CURLINFO_DATA_OUT, (char *)sshc->readdir_filename,
-                     sshc->readdir_len);
-        }
-        else {
-          if(Curl_dyn_add(&sshc->readdir_buf, sshc->readdir_longentry)) {
-            sshc->actualcode = CURLE_OUT_OF_MEMORY;
-            state(data, SSH_STOP);
-            break;
-          }
-
-          if((sshc->readdir_attrs->flags & SSH_FILEXFER_ATTR_PERMISSIONS) &&
-             ((sshc->readdir_attrs->permissions & SSH_S_IFMT) ==
-              SSH_S_IFLNK)) {
-            sshc->readdir_linkPath = aprintf("%s%s", protop->path,
-                                             sshc->readdir_filename);
-
-            if(!sshc->readdir_linkPath) {
-              state(data, SSH_SFTP_CLOSE);
-              sshc->actualcode = CURLE_OUT_OF_MEMORY;
-              break;
-            }
-
-            state(data, SSH_SFTP_READDIR_LINK);
-            break;
-          }
-          state(data, SSH_SFTP_READDIR_BOTTOM);
-          break;
-        }
-      }
-      else if(sftp_dir_eof(sshc->sftp_dir)) {
-        state(data, SSH_SFTP_READDIR_DONE);
-        break;
-      }
-      else {
-        failf(data, "Could not open remote file for reading: %s",
-              ssh_get_error(sshc->ssh_session));
-        MOVE_TO_SFTP_CLOSE_STATE();
-        break;
-      }
-      break;
-
-    case SSH_SFTP_READDIR_LINK:
-      if(sshc->readdir_link_attrs)
-        sftp_attributes_free(sshc->readdir_link_attrs);
-
-      sshc->readdir_link_attrs = sftp_lstat(sshc->sftp_session,
-                                            sshc->readdir_linkPath);
-      if(sshc->readdir_link_attrs == 0) {
-        failf(data, "Could not read symlink for reading: %s",
-              ssh_get_error(sshc->ssh_session));
-        MOVE_TO_SFTP_CLOSE_STATE();
-        break;
-      }
-
-      if(!sshc->readdir_link_attrs->name) {
-        sshc->readdir_tmp = sftp_readlink(sshc->sftp_session,
-                                          sshc->readdir_linkPath);
-        if(!sshc->readdir_filename)
-          sshc->readdir_len = 0;
-        else
-          sshc->readdir_len = strlen(sshc->readdir_tmp);
-        sshc->readdir_longentry = NULL;
-        sshc->readdir_filename = sshc->readdir_tmp;
-      }
-      else {
-        sshc->readdir_len = strlen(sshc->readdir_link_attrs->name);
-        sshc->readdir_filename = sshc->readdir_link_attrs->name;
-        sshc->readdir_longentry = sshc->readdir_link_attrs->longname;
-      }
-
-      Curl_safefree(sshc->readdir_linkPath);
-
-      if(Curl_dyn_addf(&sshc->readdir_buf, " -> %s",
-                       sshc->readdir_filename)) {
-        sshc->actualcode = CURLE_OUT_OF_MEMORY;
-        break;
-      }
-
-      sftp_attributes_free(sshc->readdir_link_attrs);
-      sshc->readdir_link_attrs = NULL;
-      sshc->readdir_filename = NULL;
-      sshc->readdir_longentry = NULL;
-
-      state(data, SSH_SFTP_READDIR_BOTTOM);
-      /* FALLTHROUGH */
-    case SSH_SFTP_READDIR_BOTTOM:
-      if(Curl_dyn_addn(&sshc->readdir_buf, "\n", 1))
-        result = CURLE_OUT_OF_MEMORY;
-      else
-        result = Curl_client_write(data, CLIENTWRITE_BODY,
-                                   Curl_dyn_ptr(&sshc->readdir_buf),
-                                   Curl_dyn_len(&sshc->readdir_buf));
-
-      if(!result) {
-        /* output debug output if that is requested */
-        Curl_debug(data, CURLINFO_DATA_OUT, Curl_dyn_ptr(&sshc->readdir_buf),
-                   Curl_dyn_len(&sshc->readdir_buf));
-        data->req.bytecount += Curl_dyn_len(&sshc->readdir_buf);
-      }
-      ssh_string_free_char(sshc->readdir_tmp);
-      sshc->readdir_tmp = NULL;
-
-      if(result) {
-        state(data, SSH_STOP);
-      }
-      else
-        state(data, SSH_SFTP_READDIR);
-      break;
-
-    case SSH_SFTP_READDIR_DONE:
-      sftp_closedir(sshc->sftp_dir);
-      sshc->sftp_dir = NULL;
-
-      /* no data to transfer */
-      Curl_setup_transfer(data, -1, -1, FALSE, -1);
-      state(data, SSH_STOP);
-      break;
-
-    case SSH_SFTP_DOWNLOAD_INIT:
-      /*
-       * Work on getting the specified file
-       */
-      if(sshc->sftp_file)
-        sftp_close(sshc->sftp_file);
-
-      sshc->sftp_file = sftp_open(sshc->sftp_session, protop->path,
-                                  O_RDONLY, (mode_t)data->set.new_file_perms);
-      if(!sshc->sftp_file) {
-        failf(data, "Could not open remote file for reading: %s",
-              ssh_get_error(sshc->ssh_session));
-
-        MOVE_TO_SFTP_CLOSE_STATE();
-        break;
-      }
-      sftp_file_set_nonblocking(sshc->sftp_file);
-      state(data, SSH_SFTP_DOWNLOAD_STAT);
-      break;
-
-    case SSH_SFTP_DOWNLOAD_STAT:
-    {
-      sftp_attributes attrs;
-      curl_off_t size;
-
-      attrs = sftp_fstat(sshc->sftp_file);
-      if(!attrs ||
-              !(attrs->flags & SSH_FILEXFER_ATTR_SIZE) ||
-              (attrs->size == 0)) {
-        /*
-         * sftp_fstat didn't return an error, so maybe the server
-         * just doesn't support stat()
-         * OR the server doesn't return a file size with a stat()
-         * OR file size is 0
-         */
-        data->req.size = -1;
-        data->req.maxdownload = -1;
-        Curl_pgrsSetDownloadSize(data, -1);
-        size = 0;
-      }
-      else {
-        size = attrs->size;
-
-        sftp_attributes_free(attrs);
-
-        if(size < 0) {
-          failf(data, "Bad file size (%" CURL_FORMAT_CURL_OFF_T ")", size);
-          return CURLE_BAD_DOWNLOAD_RESUME;
-        }
-        if(data->state.use_range) {
-          curl_off_t from, to;
-          char *ptr;
-          char *ptr2;
-          CURLofft to_t;
-          CURLofft from_t;
-
-          from_t = curlx_strtoofft(data->state.range, &ptr, 10, &from);
-          if(from_t == CURL_OFFT_FLOW) {
-            return CURLE_RANGE_ERROR;
-          }
-          while(*ptr && (ISBLANK(*ptr) || (*ptr == '-')))
-            ptr++;
-          to_t = curlx_strtoofft(ptr, &ptr2, 10, &to);
-          if(to_t == CURL_OFFT_FLOW) {
-            return CURLE_RANGE_ERROR;
-          }
-          if((to_t == CURL_OFFT_INVAL) /* no "to" value given */
-             || (to >= size)) {
-            to = size - 1;
-          }
-          if(from_t) {
-            /* from is relative to end of file */
-            from = size - to;
-            to = size - 1;
-          }
-          if(from > size) {
-            failf(data, "Offset (%"
-                  CURL_FORMAT_CURL_OFF_T ") was beyond file size (%"
-                  CURL_FORMAT_CURL_OFF_T ")", from, size);
-            return CURLE_BAD_DOWNLOAD_RESUME;
-          }
-          if(from > to) {
-            from = to;
-            size = 0;
-          }
-          else {
-            size = to - from + 1;
-          }
-
-          rc = sftp_seek64(sshc->sftp_file, from);
-          if(rc) {
-            MOVE_TO_SFTP_CLOSE_STATE();
-            break;
-          }
-        }
-        data->req.size = size;
-        data->req.maxdownload = size;
-        Curl_pgrsSetDownloadSize(data, size);
-      }
-
-      /* We can resume if we can seek to the resume position */
-      if(data->state.resume_from) {
-        if(data->state.resume_from < 0) {
-          /* We're supposed to download the last abs(from) bytes */
-          if((curl_off_t)size < -data->state.resume_from) {
-            failf(data, "Offset (%"
-                  CURL_FORMAT_CURL_OFF_T ") was beyond file size (%"
-                  CURL_FORMAT_CURL_OFF_T ")",
-                  data->state.resume_from, size);
-            return CURLE_BAD_DOWNLOAD_RESUME;
-          }
-          /* download from where? */
-          data->state.resume_from += size;
-        }
-        else {
-          if((curl_off_t)size < data->state.resume_from) {
-            failf(data, "Offset (%" CURL_FORMAT_CURL_OFF_T
-                  ") was beyond file size (%" CURL_FORMAT_CURL_OFF_T ")",
-                  data->state.resume_from, size);
-            return CURLE_BAD_DOWNLOAD_RESUME;
-          }
-        }
-        /* Now store the number of bytes we are expected to download */
-        data->req.size = size - data->state.resume_from;
-        data->req.maxdownload = size - data->state.resume_from;
-        Curl_pgrsSetDownloadSize(data,
-                                 size - data->state.resume_from);
-
-        rc = sftp_seek64(sshc->sftp_file, data->state.resume_from);
-        if(rc) {
-          MOVE_TO_SFTP_CLOSE_STATE();
-          break;
-        }
-      }
-    }
-
-    /* Setup the actual download */
-    if(data->req.size == 0) {
-      /* no data to transfer */
-      Curl_setup_transfer(data, -1, -1, FALSE, -1);
-      infof(data, "File already completely downloaded");
-      state(data, SSH_STOP);
-      break;
-    }
-    Curl_setup_transfer(data, FIRSTSOCKET, data->req.size, FALSE, -1);
-
-    /* not set by Curl_setup_transfer to preserve keepon bits */
-    conn->writesockfd = conn->sockfd;
-
-    /* we want to use the _receiving_ function even when the socket turns
-       out writableable as the underlying libssh recv function will deal
-       with both accordingly */
-    conn->cselect_bits = CURL_CSELECT_IN;
-
-    if(result) {
-      /* this should never occur; the close state should be entered
-         at the time the error occurs */
-      state(data, SSH_SFTP_CLOSE);
-      sshc->actualcode = result;
-    }
-    else {
-      sshc->sftp_recv_state = 0;
-      state(data, SSH_STOP);
-    }
-    break;
-
-    case SSH_SFTP_CLOSE:
-      if(sshc->sftp_file) {
-        sftp_close(sshc->sftp_file);
-        sshc->sftp_file = NULL;
-      }
-      Curl_safefree(protop->path);
-
-      DEBUGF(infof(data, "SFTP DONE done"));
-
-      /* Check if nextstate is set and move .nextstate could be POSTQUOTE_INIT
-         After nextstate is executed, the control should come back to
-         SSH_SFTP_CLOSE to pass the correct result back  */
-      if(sshc->nextstate != SSH_NO_STATE &&
-         sshc->nextstate != SSH_SFTP_CLOSE) {
-        state(data, sshc->nextstate);
-        sshc->nextstate = SSH_SFTP_CLOSE;
-      }
-      else {
-        state(data, SSH_STOP);
-        result = sshc->actualcode;
-      }
-      break;
-
-    case SSH_SFTP_SHUTDOWN:
-      /* during times we get here due to a broken transfer and then the
-         sftp_handle might not have been taken down so make sure that is done
-         before we proceed */
-
-      if(sshc->sftp_file) {
-        sftp_close(sshc->sftp_file);
-        sshc->sftp_file = NULL;
-      }
-
-      if(sshc->sftp_session) {
-        sftp_free(sshc->sftp_session);
-        sshc->sftp_session = NULL;
-      }
-
-      SSH_STRING_FREE_CHAR(sshc->homedir);
-      data->state.most_recent_ftp_entrypath = NULL;
-
-      state(data, SSH_SESSION_DISCONNECT);
-      break;
-
-    case SSH_SCP_TRANS_INIT:
-      result = Curl_getworkingpath(data, sshc->homedir, &protop->path);
-      if(result) {
-        sshc->actualcode = result;
-        state(data, SSH_STOP);
-        break;
-      }
-
-      /* Functions from the SCP subsystem cannot handle/return SSH_AGAIN */
-      ssh_set_blocking(sshc->ssh_session, 1);
-
-      if(data->state.upload) {
-        if(data->state.infilesize < 0) {
-          failf(data, "SCP requires a known file size for upload");
-          sshc->actualcode = CURLE_UPLOAD_FAILED;
-          MOVE_TO_ERROR_STATE(CURLE_UPLOAD_FAILED);
-          break;
-        }
-
-        sshc->scp_session =
-          ssh_scp_new(sshc->ssh_session, SSH_SCP_WRITE, protop->path);
-        state(data, SSH_SCP_UPLOAD_INIT);
-      }
-      else {
-        sshc->scp_session =
-          ssh_scp_new(sshc->ssh_session, SSH_SCP_READ, protop->path);
-        state(data, SSH_SCP_DOWNLOAD_INIT);
-      }
-
-      if(!sshc->scp_session) {
-        err_msg = ssh_get_error(sshc->ssh_session);
-        failf(data, "%s", err_msg);
-        MOVE_TO_ERROR_STATE(CURLE_UPLOAD_FAILED);
-      }
-
-      break;
-
-    case SSH_SCP_UPLOAD_INIT:
-
-      rc = ssh_scp_init(sshc->scp_session);
-      if(rc != SSH_OK) {
-        err_msg = ssh_get_error(sshc->ssh_session);
-        failf(data, "%s", err_msg);
-        MOVE_TO_ERROR_STATE(CURLE_UPLOAD_FAILED);
-        break;
-      }
-
-      rc = ssh_scp_push_file(sshc->scp_session, protop->path,
-                             data->state.infilesize,
-                             (int)data->set.new_file_perms);
-      if(rc != SSH_OK) {
-        err_msg = ssh_get_error(sshc->ssh_session);
-        failf(data, "%s", err_msg);
-        MOVE_TO_ERROR_STATE(CURLE_UPLOAD_FAILED);
-        break;
-      }
-
-      /* upload data */
-      Curl_setup_transfer(data, -1, data->req.size, FALSE, FIRSTSOCKET);
-
-      /* not set by Curl_setup_transfer to preserve keepon bits */
-      conn->sockfd = conn->writesockfd;
-
-      /* store this original bitmask setup to use later on if we can't
-         figure out a "real" bitmask */
-      sshc->orig_waitfor = data->req.keepon;
-
-      /* we want to use the _sending_ function even when the socket turns
-         out readable as the underlying libssh scp send function will deal
-         with both accordingly */
-      conn->cselect_bits = CURL_CSELECT_OUT;
-
-      state(data, SSH_STOP);
-
-      break;
-
-    case SSH_SCP_DOWNLOAD_INIT:
-
-      rc = ssh_scp_init(sshc->scp_session);
-      if(rc != SSH_OK) {
-        err_msg = ssh_get_error(sshc->ssh_session);
-        failf(data, "%s", err_msg);
-        MOVE_TO_ERROR_STATE(CURLE_COULDNT_CONNECT);
-        break;
-      }
-      state(data, SSH_SCP_DOWNLOAD);
-      /* FALLTHROUGH */
-
-    case SSH_SCP_DOWNLOAD:{
-        curl_off_t bytecount;
-
-        rc = ssh_scp_pull_request(sshc->scp_session);
-        if(rc != SSH_SCP_REQUEST_NEWFILE) {
-          err_msg = ssh_get_error(sshc->ssh_session);
-          failf(data, "%s", err_msg);
-          MOVE_TO_ERROR_STATE(CURLE_REMOTE_FILE_NOT_FOUND);
-          break;
-        }
-
-        /* download data */
-        bytecount = ssh_scp_request_get_size(sshc->scp_session);
-        data->req.maxdownload = (curl_off_t) bytecount;
-        Curl_setup_transfer(data, FIRSTSOCKET, bytecount, FALSE, -1);
-
-        /* not set by Curl_setup_transfer to preserve keepon bits */
-        conn->writesockfd = conn->sockfd;
-
-        /* we want to use the _receiving_ function even when the socket turns
-           out writableable as the underlying libssh recv function will deal
-           with both accordingly */
-        conn->cselect_bits = CURL_CSELECT_IN;
-
-        state(data, SSH_STOP);
-        break;
-      }
-    case SSH_SCP_DONE:
-      if(data->state.upload)
-        state(data, SSH_SCP_SEND_EOF);
-      else
-        state(data, SSH_SCP_CHANNEL_FREE);
-      break;
-
-    case SSH_SCP_SEND_EOF:
-      if(sshc->scp_session) {
-        rc = ssh_scp_close(sshc->scp_session);
-        if(rc == SSH_AGAIN) {
-          /* Currently the ssh_scp_close handles waiting for EOF in
-           * blocking way.
-           */
-          break;
-        }
-        if(rc != SSH_OK) {
-          infof(data, "Failed to close libssh scp channel: %s",
-                ssh_get_error(sshc->ssh_session));
-        }
-      }
-
-      state(data, SSH_SCP_CHANNEL_FREE);
-      break;
-
-    case SSH_SCP_CHANNEL_FREE:
-      if(sshc->scp_session) {
-        ssh_scp_free(sshc->scp_session);
-        sshc->scp_session = NULL;
-      }
-      DEBUGF(infof(data, "SCP DONE phase complete"));
-
-      ssh_set_blocking(sshc->ssh_session, 0);
-
-      state(data, SSH_SESSION_DISCONNECT);
-      /* FALLTHROUGH */
-
-    case SSH_SESSION_DISCONNECT:
-      /* during weird times when we've been prematurely aborted, the channel
-         is still alive when we reach this state and we MUST kill the channel
-         properly first */
-      if(sshc->scp_session) {
-        ssh_scp_free(sshc->scp_session);
-        sshc->scp_session = NULL;
-      }
-
-      ssh_disconnect(sshc->ssh_session);
-      if(!ssh_version(SSH_VERSION_INT(0, 10, 0))) {
-        /* conn->sock[FIRSTSOCKET] is closed by ssh_disconnect behind our back,
-           explicitly mark it as closed with the memdebug macro. This libssh
-           bug is fixed in 0.10.0. */
-        fake_sclose(conn->sock[FIRSTSOCKET]);
-        conn->sock[FIRSTSOCKET] = CURL_SOCKET_BAD;
-      }
-
-      SSH_STRING_FREE_CHAR(sshc->homedir);
-      data->state.most_recent_ftp_entrypath = NULL;
-
-      state(data, SSH_SESSION_FREE);
-      /* FALLTHROUGH */
-    case SSH_SESSION_FREE:
-      if(sshc->ssh_session) {
-        ssh_free(sshc->ssh_session);
-        sshc->ssh_session = NULL;
-      }
-
-      /* worst-case scenario cleanup */
-
-      DEBUGASSERT(sshc->ssh_session == NULL);
-      DEBUGASSERT(sshc->scp_session == NULL);
-
-      if(sshc->readdir_tmp) {
-        ssh_string_free_char(sshc->readdir_tmp);
-        sshc->readdir_tmp = NULL;
-      }
-
-      if(sshc->quote_attrs)
-        sftp_attributes_free(sshc->quote_attrs);
-
-      if(sshc->readdir_attrs)
-        sftp_attributes_free(sshc->readdir_attrs);
-
-      if(sshc->readdir_link_attrs)
-        sftp_attributes_free(sshc->readdir_link_attrs);
-
-      if(sshc->privkey)
-        ssh_key_free(sshc->privkey);
-      if(sshc->pubkey)
-        ssh_key_free(sshc->pubkey);
-
-      Curl_safefree(sshc->rsa_pub);
-      Curl_safefree(sshc->rsa);
-      Curl_safefree(sshc->quote_path1);
-      Curl_safefree(sshc->quote_path2);
-      Curl_dyn_free(&sshc->readdir_buf);
-      Curl_safefree(sshc->readdir_linkPath);
-      SSH_STRING_FREE_CHAR(sshc->homedir);
-
-      /* the code we are about to return */
-      result = sshc->actualcode;
-
-      memset(sshc, 0, sizeof(struct ssh_conn));
-
-      connclose(conn, "SSH session free");
-      sshc->state = SSH_SESSION_FREE;   /* current */
-      sshc->nextstate = SSH_NO_STATE;
-      state(data, SSH_STOP);
-      break;
-
-    case SSH_QUIT:
-      /* fallthrough, just stop! */
-    default:
-      /* internal error */
-      sshc->nextstate = SSH_NO_STATE;
-      state(data, SSH_STOP);
-      break;
-
-    }
-  } while(!rc && (sshc->state != SSH_STOP));
-
-
-  if(rc == SSH_AGAIN) {
-    /* we would block, we need to wait for the socket to be ready (in the
-       right direction too)! */
-    *block = TRUE;
-  }
-
-  return result;
+  myssh_to(data, sshc, SSH_S_STARTUP);
 }
 
-
-/* called by the multi interface to figure out what socket(s) to wait for and
-   for what actions in the DO_DONE, PERFORM and WAITPERFORM states */
-static int myssh_getsock(struct Curl_easy *data,
-                         struct connectdata *conn,
-                         curl_socket_t *sock)
+static void myssh_block2waitfor(struct connectdata *conn,
+                                struct ssh_conn *sshc,
+                                bool block)
 {
-  int bitmap = GETSOCK_BLANK;
-  (void)data;
-  sock[0] = conn->sock[FIRSTSOCKET];
-
-  if(conn->waitfor & KEEP_RECV)
-    bitmap |= GETSOCK_READSOCK(FIRSTSOCKET);
-
-  if(conn->waitfor & KEEP_SEND)
-    bitmap |= GETSOCK_WRITESOCK(FIRSTSOCKET);
-
-  if(!conn->waitfor)
-    bitmap |= GETSOCK_WRITESOCK(FIRSTSOCKET);
-
-  return bitmap;
-}
-
-static void myssh_block2waitfor(struct connectdata *conn, bool block)
-{
-  struct ssh_conn *sshc = &conn->proto.sshc;
-
-  /* If it didn't block, or nothing was returned by ssh_get_poll_flags
-   * have the original set */
-  conn->waitfor = sshc->orig_waitfor;
-
+  (void)conn;
   if(block) {
     int dir = ssh_get_poll_flags(sshc->ssh_session);
-    if(dir & SSH_READ_PENDING) {
-      /* translate the libssh define bits into our own bit defines */
-      conn->waitfor = KEEP_RECV;
-    }
-    else if(dir & SSH_WRITE_PENDING) {
-      conn->waitfor = KEEP_SEND;
-    }
+    /* translate the libssh define bits into our own bit defines */
+    sshc->waitfor =
+      ((dir & SSH_READ_PENDING) ? REQ_IO_RECV : 0) |
+      ((dir & SSH_WRITE_PENDING) ? REQ_IO_SEND : 0);
   }
+  else
+    sshc->waitfor = 0;
 }
 
-/* called repeatedly until done from multi.c */
-static CURLcode myssh_multi_statemach(struct Curl_easy *data,
-                                      bool *done)
+static int myssh_in_S_STARTUP(struct Curl_easy *data,
+                              struct ssh_conn *sshc)
 {
   struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-  bool block;    /* we store the status and use that to provide a ssh_getsock()
-                    implementation */
-  CURLcode result = myssh_statemach_act(data, &block);
+  int rc = ssh_connect(sshc->ssh_session);
 
-  *done = (sshc->state == SSH_STOP) ? TRUE : FALSE;
-  myssh_block2waitfor(conn, block);
+  myssh_block2waitfor(conn, sshc, (rc == SSH_AGAIN));
+  if(rc == SSH_AGAIN) {
+    CURL_TRC_SSH(data, "connect -> EAGAIN");
+  }
+  else if(rc != SSH_OK) {
+    failf(data, "Failure establishing ssh session");
+    rc = myssh_to_ERROR(data, sshc, CURLE_FAILED_INIT);
+  }
+  else
+    myssh_to(data, sshc, SSH_HOSTKEY);
 
-  return result;
+  return rc;
 }
 
-static CURLcode myssh_block_statemach(struct Curl_easy *data,
-                                      bool disconnect)
+static int myssh_in_AUTHLIST(struct Curl_easy *data,
+                             struct ssh_conn *sshc)
 {
-  struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-  CURLcode result = CURLE_OK;
+  int rc;
+  sshc->authed = FALSE;
 
-  while((sshc->state != SSH_STOP) && !result) {
-    bool block;
-    timediff_t left = 1000;
-    struct curltime now = Curl_now();
+  rc = ssh_userauth_none(sshc->ssh_session, NULL);
+  if(rc == SSH_AUTH_AGAIN)
+    return SSH_AGAIN;
 
-    result = myssh_statemach_act(data, &block);
-    if(result)
-      break;
+  if(rc == SSH_AUTH_SUCCESS) {
+    sshc->authed = TRUE;
+    infof(data, "Authenticated with none");
+    myssh_to(data, sshc, SSH_AUTH_DONE);
+    return rc;
+  }
+  else if(rc == SSH_AUTH_ERROR) {
+    rc = myssh_to_ERROR(data, sshc, CURLE_LOGIN_DENIED);
+    return rc;
+  }
 
-    if(!disconnect) {
-      if(Curl_pgrsUpdate(data))
-        return CURLE_ABORTED_BY_CALLBACK;
+  sshc->auth_methods =
+    (unsigned int)ssh_userauth_list(sshc->ssh_session, NULL);
+  if(sshc->auth_methods)
+    infof(data, "SSH authentication methods available: %s%s%s%s",
+          sshc->auth_methods & SSH_AUTH_METHOD_PUBLICKEY ?
+          "public key, " : "",
+          sshc->auth_methods & SSH_AUTH_METHOD_GSSAPI_MIC ?
+          "GSSAPI, " : "",
+          sshc->auth_methods & SSH_AUTH_METHOD_INTERACTIVE ?
+          "keyboard-interactive, " : "",
+          sshc->auth_methods & SSH_AUTH_METHOD_PASSWORD ?
+          "password" : "");
+  /* For public key auth we need either the private key or
+     CURLSSH_AUTH_AGENT. */
+  if((sshc->auth_methods & SSH_AUTH_METHOD_PUBLICKEY) &&
+     (data->set.str[STRING_SSH_PRIVATE_KEY] ||
+      (data->set.ssh_auth_types & CURLSSH_AUTH_AGENT))) {
+    myssh_to(data, sshc, SSH_AUTH_PKEY_INIT);
+    infof(data, "Authentication using SSH public key file");
+  }
+  else if(sshc->auth_methods & SSH_AUTH_METHOD_GSSAPI_MIC) {
+    myssh_to(data, sshc, SSH_AUTH_GSSAPI);
+  }
+  else if(sshc->auth_methods & SSH_AUTH_METHOD_INTERACTIVE) {
+    myssh_to(data, sshc, SSH_AUTH_KEY_INIT);
+  }
+  else if(sshc->auth_methods & SSH_AUTH_METHOD_PASSWORD) {
+    myssh_to(data, sshc, SSH_AUTH_PASS_INIT);
+  }
+  else {                  /* unsupported authentication method */
+    rc = myssh_to_ERROR(data, sshc, CURLE_LOGIN_DENIED);
+  }
+  return rc;
+}
 
-      result = Curl_speedcheck(data, now);
-      if(result)
-        break;
+static int myssh_in_AUTH_PKEY_INIT(struct Curl_easy *data,
+                                   struct ssh_conn *sshc)
+{
+  int rc;
+  if(!(data->set.ssh_auth_types & CURLSSH_AUTH_PUBLICKEY)) {
+    rc = myssh_to_GSSAPI_AUTH(data, sshc);
+    return rc;
+  }
 
-      left = Curl_timeleft(data, NULL, FALSE);
-      if(left < 0) {
-        failf(data, "Operation timed out");
-        return CURLE_OPERATION_TIMEDOUT;
+  /* Two choices, (1) private key was given on CMD,
+   * (2) use the "default" keys. */
+  if(data->set.str[STRING_SSH_PRIVATE_KEY]) {
+    if(sshc->pubkey && !data->set.ssl.primary.key_passwd) {
+      rc = ssh_userauth_try_publickey(sshc->ssh_session, NULL, sshc->pubkey);
+      if(rc == SSH_AUTH_AGAIN)
+        return SSH_AGAIN;
+
+      if(rc != SSH_OK) {
+        rc = myssh_to_GSSAPI_AUTH(data, sshc);
+        return rc;
       }
     }
 
-    if(block) {
-      curl_socket_t fd_read = conn->sock[FIRSTSOCKET];
-      /* wait for the socket to become ready */
-      (void) Curl_socket_check(fd_read, CURL_SOCKET_BAD,
-                               CURL_SOCKET_BAD, left > 1000 ? 1000 : left);
+    rc = ssh_pki_import_privkey_file(data->
+                                     set.str[STRING_SSH_PRIVATE_KEY],
+                                     data->set.ssl.primary.key_passwd, NULL,
+                                     NULL, &sshc->privkey);
+    if(rc != SSH_OK) {
+      failf(data, "Could not load private key file %s",
+            data->set.str[STRING_SSH_PRIVATE_KEY]);
+      rc = myssh_to_ERROR(data, sshc, CURLE_LOGIN_DENIED);
+      return rc;
     }
 
-  }
-
-  return result;
-}
-
-/*
- * SSH setup connection
- */
-static CURLcode myssh_setup_connection(struct Curl_easy *data,
-                                       struct connectdata *conn)
-{
-  struct SSHPROTO *ssh;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-
-  data->req.p.ssh = ssh = calloc(1, sizeof(struct SSHPROTO));
-  if(!ssh)
-    return CURLE_OUT_OF_MEMORY;
-  Curl_dyn_init(&sshc->readdir_buf, PATH_MAX * 2);
-
-  return CURLE_OK;
-}
-
-static Curl_recv scp_recv, sftp_recv;
-static Curl_send scp_send, sftp_send;
-
-/*
- * Curl_ssh_connect() gets called from Curl_protocol_connect() to allow us to
- * do protocol-specific actions at connect-time.
- */
-static CURLcode myssh_connect(struct Curl_easy *data, bool *done)
-{
-  struct ssh_conn *ssh;
-  CURLcode result;
-  struct connectdata *conn = data->conn;
-  curl_socket_t sock = conn->sock[FIRSTSOCKET];
-  int rc;
-
-  /* initialize per-handle data if not already */
-  if(!data->req.p.ssh)
-    myssh_setup_connection(data, conn);
-
-  /* We default to persistent connections. We set this already in this connect
-     function to make the reuse checks properly be able to check this bit. */
-  connkeep(conn, "SSH default");
-
-  if(conn->handler->protocol & CURLPROTO_SCP) {
-    conn->recv[FIRSTSOCKET] = scp_recv;
-    conn->send[FIRSTSOCKET] = scp_send;
+    myssh_to(data, sshc, SSH_AUTH_PKEY);
   }
   else {
-    conn->recv[FIRSTSOCKET] = sftp_recv;
-    conn->send[FIRSTSOCKET] = sftp_send;
-  }
+    rc = ssh_userauth_publickey_auto(sshc->ssh_session, NULL,
+                                     data->set.ssl.primary.key_passwd);
+    if(rc == SSH_AUTH_AGAIN)
+      return SSH_AGAIN;
 
-  ssh = &conn->proto.sshc;
-
-  ssh->ssh_session = ssh_new();
-  if(!ssh->ssh_session) {
-    failf(data, "Failure initialising ssh session");
-    return CURLE_FAILED_INIT;
-  }
-
-  rc = ssh_options_set(ssh->ssh_session, SSH_OPTIONS_HOST, conn->host.name);
-  if(rc != SSH_OK) {
-    failf(data, "Could not set remote host");
-    return CURLE_FAILED_INIT;
-  }
-
-  rc = ssh_options_parse_config(ssh->ssh_session, NULL);
-  if(rc != SSH_OK) {
-    infof(data, "Could not parse SSH configuration files");
-    /* ignore */
-  }
-
-  rc = ssh_options_set(ssh->ssh_session, SSH_OPTIONS_FD, &sock);
-  if(rc != SSH_OK) {
-    failf(data, "Could not set socket");
-    return CURLE_FAILED_INIT;
-  }
-
-  if(conn->user && conn->user[0] != '\0') {
-    infof(data, "User: %s", conn->user);
-    rc = ssh_options_set(ssh->ssh_session, SSH_OPTIONS_USER, conn->user);
-    if(rc != SSH_OK) {
-      failf(data, "Could not set user");
-      return CURLE_FAILED_INIT;
+    if(rc == SSH_AUTH_SUCCESS) {
+      rc = SSH_OK;
+      sshc->authed = TRUE;
+      infof(data, "Completed public key authentication");
+      myssh_to(data, sshc, SSH_AUTH_DONE);
+      return rc;
     }
+
+    rc = myssh_to_GSSAPI_AUTH(data, sshc);
   }
-
-  if(data->set.str[STRING_SSH_KNOWNHOSTS]) {
-    infof(data, "Known hosts: %s", data->set.str[STRING_SSH_KNOWNHOSTS]);
-    rc = ssh_options_set(ssh->ssh_session, SSH_OPTIONS_KNOWNHOSTS,
-                         data->set.str[STRING_SSH_KNOWNHOSTS]);
-    if(rc != SSH_OK) {
-      failf(data, "Could not set known hosts file path");
-      return CURLE_FAILED_INIT;
-    }
-  }
-
-  if(conn->remote_port) {
-    rc = ssh_options_set(ssh->ssh_session, SSH_OPTIONS_PORT,
-                         &conn->remote_port);
-    if(rc != SSH_OK) {
-      failf(data, "Could not set remote port");
-      return CURLE_FAILED_INIT;
-    }
-  }
-
-  if(data->set.ssh_compression) {
-    rc = ssh_options_set(ssh->ssh_session, SSH_OPTIONS_COMPRESSION,
-                         "zlib,zlib@openssh.com,none");
-    if(rc != SSH_OK) {
-      failf(data, "Could not set compression");
-      return CURLE_FAILED_INIT;
-    }
-  }
-
-  ssh->privkey = NULL;
-  ssh->pubkey = NULL;
-
-  if(data->set.str[STRING_SSH_PUBLIC_KEY]) {
-    rc = ssh_pki_import_pubkey_file(data->set.str[STRING_SSH_PUBLIC_KEY],
-                                    &ssh->pubkey);
-    if(rc != SSH_OK) {
-      failf(data, "Could not load public key file");
-      return CURLE_FAILED_INIT;
-    }
-  }
-
-  /* we do not verify here, we do it at the state machine,
-   * after connection */
-
-  state(data, SSH_INIT);
-
-  result = myssh_multi_statemach(data, done);
-
-  return result;
+  return rc;
 }
 
-/* called from multi.c while DOing */
-static CURLcode scp_doing(struct Curl_easy *data, bool *dophase_done)
+static int myssh_in_AUTH_PKEY(struct Curl_easy *data,
+                              struct ssh_conn *sshc)
 {
-  CURLcode result;
-
-  result = myssh_multi_statemach(data, dophase_done);
-
-  if(*dophase_done) {
-    DEBUGF(infof(data, "DO phase is complete"));
+  int rc = ssh_userauth_publickey(sshc->ssh_session, NULL, sshc->privkey);
+  if(rc == SSH_AUTH_AGAIN)
+    return SSH_AGAIN;
+  else if(rc == SSH_AUTH_SUCCESS) {
+    sshc->authed = TRUE;
+    infof(data, "Completed public key authentication");
+    myssh_to(data, sshc, SSH_AUTH_DONE);
+    return SSH_OK;
   }
-  return result;
-}
-
-/*
- ***********************************************************************
- *
- * scp_perform()
- *
- * This is the actual DO function for SCP. Get a file according to
- * the options previously setup.
- */
-
-static
-CURLcode scp_perform(struct Curl_easy *data,
-                     bool *connected, bool *dophase_done)
-{
-  CURLcode result = CURLE_OK;
-
-  DEBUGF(infof(data, "DO phase starts"));
-
-  *dophase_done = FALSE;        /* not done yet */
-
-  /* start the first command in the DO phase */
-  state(data, SSH_SCP_TRANS_INIT);
-
-  result = myssh_multi_statemach(data, dophase_done);
-
-  *connected = Curl_conn_is_connected(data->conn, FIRSTSOCKET);
-
-  if(*dophase_done) {
-    DEBUGF(infof(data, "DO phase is complete"));
+  else {
+    infof(data, "Failed public key authentication (rc: %d)", rc);
+    return myssh_to_GSSAPI_AUTH(data, sshc);
   }
-
-  return result;
 }
 
-static CURLcode myssh_do_it(struct Curl_easy *data, bool *done)
-{
-  CURLcode result;
-  bool connected = 0;
-  struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-
-  *done = FALSE;                /* default to false */
-
-  data->req.size = -1;          /* make sure this is unknown at this point */
-
-  sshc->actualcode = CURLE_OK;  /* reset error code */
-  sshc->secondCreateDirs = 0;   /* reset the create dir attempt state
-                                   variable */
-
-  Curl_pgrsSetUploadCounter(data, 0);
-  Curl_pgrsSetDownloadCounter(data, 0);
-  Curl_pgrsSetUploadSize(data, -1);
-  Curl_pgrsSetDownloadSize(data, -1);
-
-  if(conn->handler->protocol & CURLPROTO_SCP)
-    result = scp_perform(data, &connected, done);
-  else
-    result = sftp_perform(data, &connected, done);
-
-  return result;
-}
-
-/* BLOCKING, but the function is using the state machine so the only reason
-   this is still blocking is that the multi interface code has no support for
-   disconnecting operations that takes a while */
-static CURLcode scp_disconnect(struct Curl_easy *data,
-                               struct connectdata *conn,
-                               bool dead_connection)
-{
-  CURLcode result = CURLE_OK;
-  struct ssh_conn *ssh = &conn->proto.sshc;
-  (void) dead_connection;
-
-  if(ssh->ssh_session) {
-    /* only if there's a session still around to use! */
-
-    state(data, SSH_SESSION_DISCONNECT);
-
-    result = myssh_block_statemach(data, TRUE);
-  }
-
-  return result;
-}
-
-/* generic done function for both SCP and SFTP called from their specific
-   done functions */
-static CURLcode myssh_done(struct Curl_easy *data, CURLcode status)
-{
-  CURLcode result = CURLE_OK;
-  struct SSHPROTO *protop = data->req.p.ssh;
-
-  if(!status) {
-    /* run the state-machine */
-    result = myssh_block_statemach(data, FALSE);
-  }
-  else
-    result = status;
-
-  if(protop)
-    Curl_safefree(protop->path);
-  if(Curl_pgrsDone(data))
-    return CURLE_ABORTED_BY_CALLBACK;
-
-  data->req.keepon = 0;   /* clear all bits */
-  return result;
-}
-
-
-static CURLcode scp_done(struct Curl_easy *data, CURLcode status,
-                         bool premature)
-{
-  (void) premature;             /* not used */
-
-  if(!status)
-    state(data, SSH_SCP_DONE);
-
-  return myssh_done(data, status);
-
-}
-
-static ssize_t scp_send(struct Curl_easy *data, int sockindex,
-                        const void *mem, size_t len, CURLcode *err)
+static int myssh_in_AUTH_GSSAPI(struct Curl_easy *data,
+                                struct ssh_conn *sshc)
 {
   int rc;
-  struct connectdata *conn = data->conn;
-  (void) sockindex; /* we only support SCP on the fixed known primary socket */
-  (void) err;
+  if(!(data->set.ssh_auth_types & CURLSSH_AUTH_GSSAPI))
+    return myssh_to_KEY_AUTH(data, sshc);
 
-  rc = ssh_scp_write(conn->proto.sshc.scp_session, mem, len);
+  rc = ssh_userauth_gssapi(sshc->ssh_session);
+  if(rc == SSH_AUTH_AGAIN)
+    return SSH_AGAIN;
 
-#if 0
-  /* The following code is misleading, mostly added as wishful thinking
-   * that libssh at some point will implement non-blocking ssh_scp_write/read.
-   * Currently rc can only be number of bytes read or SSH_ERROR. */
-  myssh_block2waitfor(conn, (rc == SSH_AGAIN) ? TRUE : FALSE);
+  if(rc == SSH_AUTH_SUCCESS) {
+    sshc->authed = TRUE;
+    infof(data, "Completed gssapi authentication");
+    myssh_to(data, sshc, SSH_AUTH_DONE);
+    return SSH_OK;
+  }
 
-  if(rc == SSH_AGAIN) {
-    *err = CURLE_AGAIN;
-    return 0;
+  return myssh_to_KEY_AUTH(data, sshc);
+}
+
+static int myssh_in_AUTH_KEY_INIT(struct Curl_easy *data,
+                                  struct ssh_conn *sshc)
+{
+  if(data->set.ssh_auth_types & CURLSSH_AUTH_KEYBOARD) {
+    myssh_to(data, sshc, SSH_AUTH_KEY);
+    return SSH_NO_ERROR;
+  }
+  return myssh_to_PASSWD_AUTH(data, sshc);
+}
+
+static int myssh_in_AUTH_KEY(struct Curl_easy *data,
+                             struct ssh_conn *sshc)
+{
+  /* keyboard-interactive authentication */
+  int rc = myssh_auth_interactive(data->conn, sshc);
+  if(rc == SSH_AGAIN)
+    return rc;
+  else if(rc == SSH_OK) {
+    sshc->authed = TRUE;
+    infof(data, "completed keyboard interactive authentication");
+    myssh_to(data, sshc, SSH_AUTH_DONE);
+    return SSH_NO_ERROR;
   }
   else
+    return myssh_to_PASSWD_AUTH(data, sshc);
+}
+
+static int myssh_in_AUTH_PASS_INIT(struct Curl_easy *data,
+                                   struct ssh_conn *sshc)
+{
+  if(!(data->set.ssh_auth_types & CURLSSH_AUTH_PASSWORD))
+    return myssh_to_ERROR(data, sshc, CURLE_LOGIN_DENIED);
+  myssh_to(data, sshc, SSH_AUTH_PASS);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_AUTH_PASS(struct Curl_easy *data,
+                              struct ssh_conn *sshc)
+{
+  int rc = ssh_userauth_password(sshc->ssh_session, NULL,
+                                 Curl_creds_passwd(data->conn->creds));
+  if(rc == SSH_AUTH_AGAIN)
+    return SSH_AGAIN;
+  else if(rc == SSH_AUTH_SUCCESS) {
+    sshc->authed = TRUE;
+    infof(data, "Completed password authentication");
+    myssh_to(data, sshc, SSH_AUTH_DONE);
+    return SSH_NO_ERROR;
+  }
+  return myssh_to_ERROR(data, sshc, CURLE_LOGIN_DENIED);
+}
+
+static int myssh_in_AUTH_DONE(struct Curl_easy *data,
+                              struct ssh_conn *sshc)
+{
+  struct connectdata *conn = data->conn;
+  if(!sshc->authed) {
+    failf(data, "Authentication failure");
+    return myssh_to_ERROR(data, sshc, CURLE_LOGIN_DENIED);
+  }
+
+  /* At this point we have an authenticated ssh session. */
+  infof(data, "Authentication complete");
+  Curl_pgrsTime(data, TIMER_APPCONNECT);      /* SSH is connected */
+  conn->recv_idx = FIRSTSOCKET;
+  conn->send_idx = -1;
+
+  if(conn->scheme->protocol == CURLPROTO_SFTP) {
+    myssh_to(data, sshc, SSH_SFTP_INIT);
+    return SSH_NO_ERROR;
+  }
+  infof(data, "SSH CONNECT phase done");
+  myssh_to(data, sshc, SSH_STOP);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_UPLOAD_INIT(struct Curl_easy *data,
+                                struct ssh_conn *sshc,
+                                struct SSHPROTO *sshp)
+{
+  int flags;
+  int rc = 0;
+
+  if(!sshp)
+    return myssh_to_ERROR(data, sshc, CURLE_FAILED_INIT);
+
+  if(data->state.resume_from) {
+    sftp_attributes attrs;
+
+    if(data->state.resume_from < 0) {
+      attrs = sftp_stat(sshc->sftp_session, sshp->path);
+      if(attrs) {
+        curl_off_t size = attrs->size;
+        sftp_attributes_free(attrs);
+        if(size < 0) {
+          failf(data, "Bad file size (%" FMT_OFF_T ")", size);
+          rc = myssh_to_ERROR(data, sshc, CURLE_BAD_DOWNLOAD_RESUME);
+          return rc;
+        }
+        data->state.resume_from = size;
+      }
+      else {
+        data->state.resume_from = 0;
+      }
+    }
+  }
+
+  if(data->set.remote_append) {
+    /* True append mode: create if nonexisting */
+    flags = O_WRONLY | O_CREAT | O_APPEND;
+  }
+  else if(data->state.resume_from > 0) {
+    /*
+     * Resume MUST NOT use O_APPEND. Many SFTP servers/impls force all
+     * writes to EOF when O_APPEND is set, ignoring a prior seek().
+     * Open write-only and seek to the resume offset instead.
+     */
+    flags = O_WRONLY;
+  }
+  else
+    /* Clear file before writing (normal behavior) */
+    flags = O_WRONLY | O_CREAT | O_TRUNC;
+
+  if(sshc->sftp_file)
+    sftp_close(sshc->sftp_file);
+  sshc->sftp_file =
+    sftp_open(sshc->sftp_session, sshp->path,
+              flags, (mode_t)data->set.new_file_perms);
+  if(!sshc->sftp_file) {
+    int err = sftp_get_error(sshc->sftp_session);
+
+    if((err == SSH_FX_NO_SUCH_FILE ||
+        err == SSH_FX_FAILURE ||
+        err == SSH_FX_NO_SUCH_PATH) &&
+       data->set.ftp_create_missing_dirs &&
+       (strlen(sshp->path) > 1)) {
+      /* try to create the path remotely */
+      rc = 0;
+      sshc->secondCreateDirs = 1;
+      myssh_to(data, sshc, SSH_SFTP_CREATE_DIRS_INIT);
+      return rc;
+    }
+    else {
+      rc = myssh_to_SFTP_CLOSE(data, sshc);
+      return rc;
+    }
+  }
+
+  /* If we have a restart point then we need to seek to the correct
+     position. Skip if in explicit remote append mode. */
+  if(data->state.resume_from > 0 && !data->set.remote_append) {
+    int seekerr = CURL_SEEKFUNC_OK;
+    /* Let's read off the proper amount of bytes from the input. */
+    if(data->set.seek_func) {
+      Curl_set_in_callback(data, TRUE);
+      seekerr = data->set.seek_func(data->set.seek_client,
+                                    data->state.resume_from, SEEK_SET);
+      Curl_set_in_callback(data, FALSE);
+    }
+
+    if(seekerr != CURL_SEEKFUNC_OK) {
+      curl_off_t passed = 0;
+
+      if(seekerr != CURL_SEEKFUNC_CANTSEEK) {
+        failf(data, "Could not seek stream");
+        rc = myssh_to_ERROR(data, sshc, CURLE_FTP_COULDNT_USE_REST);
+        return rc;
+      }
+      /* seekerr == CURL_SEEKFUNC_CANTSEEK (cannot seek to offset) */
+      do {
+        char scratch[4 * 1024];
+        size_t readthisamountnow =
+          (data->state.resume_from - passed >
+           (curl_off_t)sizeof(scratch)) ?
+          sizeof(scratch) : curlx_sotouz(data->state.resume_from - passed);
+
+        size_t actuallyread =
+          data->state.fread_func(scratch, 1,
+                                 readthisamountnow, data->state.in);
+
+        passed += actuallyread;
+        if((actuallyread == 0) || (actuallyread > readthisamountnow)) {
+          /* this checks for greater-than only to make sure that the
+             CURL_READFUNC_ABORT return code still aborts */
+          failf(data, "Failed to read data");
+          rc = myssh_to_ERROR(data, sshc, CURLE_FTP_COULDNT_USE_REST);
+          return rc;
+        }
+      } while(passed < data->state.resume_from);
+    }
+
+    /* now, decrease the size of the read */
+    if(data->state.infilesize > 0) {
+      if(data->state.resume_from > data->state.infilesize) {
+        failf(data, "Resume point beyond size");
+        return myssh_to_ERROR(data, sshc, CURLE_BAD_FUNCTION_ARGUMENT);
+      }
+      data->state.infilesize -= data->state.resume_from;
+      data->req.size = data->state.infilesize;
+      Curl_pgrsSetUploadSize(data, data->state.infilesize);
+    }
+
+    rc = sftp_seek64(sshc->sftp_file, data->state.resume_from);
+    if(rc) {
+      rc = myssh_to_SFTP_CLOSE(data, sshc);
+      return rc;
+    }
+  }
+  if(data->state.infilesize > 0) {
+    data->req.size = data->state.infilesize;
+    Curl_pgrsSetUploadSize(data, data->state.infilesize);
+  }
+  /* upload data */
+  Curl_xfer_setup_send(data, FIRSTSOCKET);
+
+  /* not set by Curl_xfer_setup to preserve io_flags */
+  data->conn->recv_idx = FIRSTSOCKET;
+
+  /* since we do not really wait for anything at this point, we want the
+     state machine to move on as soon as possible so we mark this as dirty */
+  Curl_multi_mark_dirty(data);
+#if LIBSSH_VERSION_INT > SSH_VERSION_INT(0, 11, 0)
+  sshc->sftp_send_state = 0;
 #endif
+  myssh_to(data, sshc, SSH_STOP);
+  return rc;
+}
+
+static int myssh_in_SFTP_DOWNLOAD_INIT(struct Curl_easy *data,
+                                       struct ssh_conn *sshc,
+                                       struct SSHPROTO *sshp)
+{
+  if(!sshp)
+    return myssh_to_ERROR(data, sshc, CURLE_FAILED_INIT);
+  /* Work on getting the specified file */
+  if(sshc->sftp_file)
+    sftp_close(sshc->sftp_file);
+
+  sshc->sftp_file = sftp_open(sshc->sftp_session, sshp->path,
+                              O_RDONLY, (mode_t)data->set.new_file_perms);
+  if(!sshc->sftp_file) {
+    failf(data, "Could not open remote file for reading: %s",
+          ssh_get_error(sshc->ssh_session));
+
+    return myssh_to_SFTP_CLOSE(data, sshc);
+  }
+  sftp_file_set_nonblocking(sshc->sftp_file);
+  myssh_to(data, sshc, SSH_SFTP_DOWNLOAD_STAT);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_DOWNLOAD_STAT(struct Curl_easy *data,
+                                       struct ssh_conn *sshc)
+{
+  curl_off_t size;
+  int rc = 0;
+  sftp_attributes attrs = sftp_fstat(sshc->sftp_file);
+  if(!attrs ||
+     !(attrs->flags & SSH_FILEXFER_ATTR_SIZE) ||
+     (attrs->size == 0)) {
+    /*
+     * sftp_fstat did not return an error, so maybe the server
+     * does not support stat()
+     * OR the server does not return a file size with a stat()
+     * OR file size is 0
+     */
+    data->req.size = -1;
+    data->req.maxdownload = -1;
+    Curl_pgrsSetDownloadSize(data, -1);
+    size = 0;
+    if(attrs)
+      sftp_attributes_free(attrs);
+  }
+  else {
+    size = attrs->size;
+
+    sftp_attributes_free(attrs);
+
+    if(size < 0) {
+      failf(data, "Bad file size (%" FMT_OFF_T ")", size);
+      return myssh_to_ERROR(data, sshc, CURLE_BAD_DOWNLOAD_RESUME);
+    }
+    if(data->state.use_range) {
+      curl_off_t from;
+      CURLcode result = Curl_ssh_range(data, data->state.range, size,
+                                       &from, &size);
+      if(result)
+        return myssh_to_ERROR(data, sshc, result);
+
+      rc = sftp_seek64(sshc->sftp_file, from);
+      if(rc)
+        return myssh_to_SFTP_CLOSE(data, sshc);
+    }
+    data->req.size = size;
+    data->req.maxdownload = size;
+    Curl_pgrsSetDownloadSize(data, size);
+  }
+
+  /* We can resume if we can seek to the resume position */
+  if(data->state.resume_from) {
+    if(data->state.resume_from < 0) {
+      /* We are supposed to download the last abs(from) bytes */
+      if(size < -data->state.resume_from) {
+        failf(data, "Offset (%" FMT_OFF_T ") was beyond file size (%"
+              FMT_OFF_T ")", data->state.resume_from, size);
+        return myssh_to_ERROR(data, sshc, CURLE_BAD_DOWNLOAD_RESUME);
+      }
+      /* download from where? */
+      data->state.resume_from += size;
+    }
+    else {
+      if(size < data->state.resume_from) {
+        failf(data, "Offset (%" FMT_OFF_T
+              ") was beyond file size (%" FMT_OFF_T ")",
+              data->state.resume_from, size);
+        return myssh_to_ERROR(data, sshc, CURLE_BAD_DOWNLOAD_RESUME);
+      }
+    }
+    /* Now store the number of bytes we are expected to download */
+    data->req.size = size - data->state.resume_from;
+    data->req.maxdownload = size - data->state.resume_from;
+    Curl_pgrsSetDownloadSize(data, size - data->state.resume_from);
+
+    rc = sftp_seek64(sshc->sftp_file, data->state.resume_from);
+    if(rc)
+      return myssh_to_SFTP_CLOSE(data, sshc);
+  }
+
+  /* Setup the actual download */
+  if(data->req.size == 0) {
+    /* no data to transfer */
+    Curl_xfer_setup_nop(data);
+    infof(data, "File already completely downloaded");
+    myssh_to(data, sshc, SSH_STOP);
+    return rc;
+  }
+  Curl_xfer_setup_recv(data, FIRSTSOCKET, data->req.size);
+
+  /* not set by Curl_xfer_setup to preserve io_flags */
+  data->conn->send_idx = 0;
+
+  sshc->sftp_recv_state = 0;
+  myssh_to(data, sshc, SSH_STOP);
+
+  return rc;
+}
+
+static int myssh_in_SFTP_CLOSE(struct Curl_easy *data,
+                               struct ssh_conn *sshc,
+                               struct SSHPROTO *sshp)
+{
+  if(!sshp)
+    return myssh_to_ERROR(data, sshc, CURLE_FAILED_INIT);
+  if(sshc->sftp_file) {
+    sftp_close(sshc->sftp_file);
+    sshc->sftp_file = NULL;
+  }
+  curlx_safefree(sshp->path);
+
+  CURL_TRC_SSH(data, "SFTP DONE done");
+
+  /* Check if nextstate is set and move .nextstate could be POSTQUOTE_INIT
+     After nextstate is executed, the control should come back to
+     SSH_SFTP_CLOSE to pass the correct result back */
+  if(sshc->nextstate != SSH_NO_STATE &&
+     sshc->nextstate != SSH_SFTP_CLOSE) {
+    myssh_to(data, sshc, sshc->nextstate);
+    sshc->nextstate = SSH_SFTP_CLOSE;
+  }
+  else {
+    myssh_to(data, sshc, SSH_STOP);
+  }
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_SHUTDOWN(struct Curl_easy *data,
+                                  struct ssh_conn *sshc)
+{
+  /* during times we get here due to a broken transfer and then the
+     sftp_handle might not have been taken down so make sure that is done
+     before we proceed */
+  ssh_set_blocking(sshc->ssh_session, 0);
+#if LIBSSH_VERSION_INT > SSH_VERSION_INT(0, 11, 0)
+  SFTP_AIO_FREE(sshc->sftp_send_aio);
+  SFTP_AIO_FREE(sshc->sftp_recv_aio);
+#endif
+
+  if(sshc->sftp_file) {
+    sftp_close(sshc->sftp_file);
+    sshc->sftp_file = NULL;
+  }
+
+  if(sshc->sftp_session) {
+    sftp_free(sshc->sftp_session);
+    sshc->sftp_session = NULL;
+  }
+
+  SSH_STRING_FREE_CHAR(sshc->homedir);
+
+  myssh_to(data, sshc, SSH_SESSION_DISCONNECT);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_INIT(struct Curl_easy *data,
+                              struct ssh_conn *sshc)
+{
+  int rc;
+  ssh_set_blocking(sshc->ssh_session, 1);
+
+  sshc->sftp_session = sftp_new(sshc->ssh_session);
+  if(!sshc->sftp_session) {
+    failf(data, "Failure initializing sftp session: %s",
+          ssh_get_error(sshc->ssh_session));
+    return myssh_to_ERROR(data, sshc, CURLE_COULDNT_CONNECT);
+  }
+
+  rc = sftp_init(sshc->sftp_session);
   if(rc != SSH_OK) {
-    *err = CURLE_SSH;
-    return -1;
+    failf(data, "Failure initializing sftp session: %s",
+          ssh_get_error(sshc->ssh_session));
+    return myssh_to_ERROR(data, sshc, sftp_error_to_CURLE(SSH_FX_FAILURE));
   }
-
-  return len;
+  myssh_to(data, sshc, SSH_SFTP_REALPATH);
+  return SSH_NO_ERROR;
 }
 
-static ssize_t scp_recv(struct Curl_easy *data, int sockindex,
-                        char *mem, size_t len, CURLcode *err)
+static int myssh_in_SFTP_REALPATH(struct Curl_easy *data,
+                                  struct ssh_conn *sshc)
 {
-  ssize_t nread;
-  struct connectdata *conn = data->conn;
-  (void) err;
-  (void) sockindex; /* we only support SCP on the fixed known primary socket */
+  /* Get the "home" directory */
+  sshc->homedir = sftp_canonicalize_path(sshc->sftp_session, ".");
+  if(!sshc->homedir)
+    return myssh_to_ERROR(data, sshc, CURLE_COULDNT_CONNECT);
 
-  /* libssh returns int */
-  nread = ssh_scp_read(conn->proto.sshc.scp_session, mem, len);
+  curlx_free(data->state.most_recent_ftp_entrypath);
+  data->state.most_recent_ftp_entrypath = curlx_strdup(sshc->homedir);
+  if(!data->state.most_recent_ftp_entrypath)
+    return myssh_to_ERROR(data, sshc, CURLE_OUT_OF_MEMORY);
 
-#if 0
-  /* The following code is misleading, mostly added as wishful thinking
-   * that libssh at some point will implement non-blocking ssh_scp_write/read.
-   * Currently rc can only be SSH_OK or SSH_ERROR. */
-
-  myssh_block2waitfor(conn, (nread == SSH_AGAIN) ? TRUE : FALSE);
-  if(nread == SSH_AGAIN) {
-    *err = CURLE_AGAIN;
-    nread = -1;
-  }
-#endif
-
-  return nread;
+  /* This is the last step in the SFTP connect phase. Do note that while
+     we get the homedir here, we get the "workingpath" in the DO action
+     since the homedir remains the same between request but the
+     working path does not. */
+  CURL_TRC_SSH(data, "CONNECT phase done");
+  myssh_to(data, sshc, SSH_STOP);
+  return SSH_NO_ERROR;
 }
 
-/*
- * =============== SFTP ===============
- */
-
-/*
- ***********************************************************************
- *
- * sftp_perform()
- *
- * This is the actual DO function for SFTP. Get a file/directory according to
- * the options previously setup.
- */
-
-static
-CURLcode sftp_perform(struct Curl_easy *data,
-                      bool *connected,
-                      bool *dophase_done)
+static int myssh_in_SFTP_QUOTE_INIT(struct Curl_easy *data,
+                                    struct ssh_conn *sshc,
+                                    struct SSHPROTO *sshp)
 {
-  CURLcode result = CURLE_OK;
+  CURLcode result;
 
-  DEBUGF(infof(data, "DO phase starts"));
+  if(!sshp)
+    return myssh_to_ERROR(data, sshc, CURLE_FAILED_INIT);
 
-  *dophase_done = FALSE; /* not done yet */
-
-  /* start the first command in the DO phase */
-  state(data, SSH_SFTP_QUOTE_INIT);
-
-  /* run the state-machine */
-  result = myssh_multi_statemach(data, dophase_done);
-
-  *connected = Curl_conn_is_connected(data->conn, FIRSTSOCKET);
-
-  if(*dophase_done) {
-    DEBUGF(infof(data, "DO phase is complete"));
+  result = Curl_getworkingpath(data, sshc->homedir, &sshp->path);
+  if(result) {
+    sshc->actualcode = result;
+    myssh_to(data, sshc, SSH_STOP);
   }
-
-  return result;
-}
-
-/* called from multi.c while DOing */
-static CURLcode sftp_doing(struct Curl_easy *data,
-                           bool *dophase_done)
-{
-  CURLcode result = myssh_multi_statemach(data, dophase_done);
-  if(*dophase_done) {
-    DEBUGF(infof(data, "DO phase is complete"));
-  }
-  return result;
-}
-
-/* BLOCKING, but the function is using the state machine so the only reason
-   this is still blocking is that the multi interface code has no support for
-   disconnecting operations that takes a while */
-static CURLcode sftp_disconnect(struct Curl_easy *data,
-                                struct connectdata *conn,
-                                bool dead_connection)
-{
-  CURLcode result = CURLE_OK;
-  (void) dead_connection;
-
-  DEBUGF(infof(data, "SSH DISCONNECT starts now"));
-
-  if(conn->proto.sshc.ssh_session) {
-    /* only if there's a session still around to use! */
-    state(data, SSH_SFTP_SHUTDOWN);
-    result = myssh_block_statemach(data, TRUE);
-  }
-
-  DEBUGF(infof(data, "SSH DISCONNECT is done"));
-
-  return result;
-
-}
-
-static CURLcode sftp_done(struct Curl_easy *data, CURLcode status,
-                          bool premature)
-{
-  struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-
-  if(!status) {
-    /* Post quote commands are executed after the SFTP_CLOSE state to avoid
-       errors that could happen due to open file handles during POSTQUOTE
-       operation */
-    if(!premature && data->set.postquote && !conn->bits.retry)
-      sshc->nextstate = SSH_SFTP_POSTQUOTE_INIT;
-    state(data, SSH_SFTP_CLOSE);
-  }
-  return myssh_done(data, status);
-}
-
-/* return number of sent bytes */
-static ssize_t sftp_send(struct Curl_easy *data, int sockindex,
-                         const void *mem, size_t len, CURLcode *err)
-{
-  ssize_t nwrite;
-  struct connectdata *conn = data->conn;
-  (void)sockindex;
-
-  nwrite = sftp_write(conn->proto.sshc.sftp_file, mem, len);
-
-  myssh_block2waitfor(conn, FALSE);
-
-#if 0 /* not returned by libssh on write */
-  if(nwrite == SSH_AGAIN) {
-    *err = CURLE_AGAIN;
-    nwrite = 0;
+  else if(data->set.quote) {
+    infof(data, "Sending quote commands");
+    sshc->quote_item = data->set.quote;
+    myssh_to(data, sshc, SSH_SFTP_QUOTE);
   }
   else
-#endif
-  if(nwrite < 0) {
-    *err = CURLE_SSH;
-    nwrite = -1;
-  }
-
-  return nwrite;
+    myssh_to(data, sshc, SSH_SFTP_GETINFO);
+  return SSH_NO_ERROR;
 }
 
-/*
- * Return number of received (decrypted) bytes
- * or <0 on error
- */
-static ssize_t sftp_recv(struct Curl_easy *data, int sockindex,
-                         char *mem, size_t len, CURLcode *err)
+static int myssh_in_SFTP_POSTQUOTE_INIT(struct Curl_easy *data,
+                                        struct ssh_conn *sshc)
 {
-  ssize_t nread;
-  struct connectdata *conn = data->conn;
-  (void)sockindex;
-
-  DEBUGASSERT(len < CURL_MAX_READ_SIZE);
-
-  switch(conn->proto.sshc.sftp_recv_state) {
-    case 0:
-      conn->proto.sshc.sftp_file_index =
-        sftp_async_read_begin(conn->proto.sshc.sftp_file,
-                              (uint32_t)len);
-      if(conn->proto.sshc.sftp_file_index < 0) {
-        *err = CURLE_RECV_ERROR;
-        return -1;
-      }
-
-      /* FALLTHROUGH */
-    case 1:
-      conn->proto.sshc.sftp_recv_state = 1;
-
-      nread = sftp_async_read(conn->proto.sshc.sftp_file,
-                              mem, (uint32_t)len,
-                              conn->proto.sshc.sftp_file_index);
-
-      myssh_block2waitfor(conn, (nread == SSH_AGAIN)?TRUE:FALSE);
-
-      if(nread == SSH_AGAIN) {
-        *err = CURLE_AGAIN;
-        return -1;
-      }
-      else if(nread < 0) {
-        *err = CURLE_RECV_ERROR;
-        return -1;
-      }
-
-      conn->proto.sshc.sftp_recv_state = 0;
-      return nread;
-
-    default:
-      /* we never reach here */
-      return -1;
+  if(data->set.postquote) {
+    infof(data, "Sending quote commands");
+    sshc->quote_item = data->set.postquote;
+    myssh_to(data, sshc, SSH_SFTP_QUOTE);
   }
+  else {
+    myssh_to(data, sshc, SSH_STOP);
+  }
+  return SSH_NO_ERROR;
 }
 
-static void sftp_quote(struct Curl_easy *data)
+static int quote_error(struct Curl_easy *data,
+                       struct ssh_conn *sshc)
+{
+  failf(data, "Suspicious data after the command line");
+  curlx_safefree(sshc->quote_path1);
+  curlx_safefree(sshc->quote_path2);
+  myssh_to(data, sshc, SSH_SFTP_CLOSE);
+  sshc->nextstate = SSH_NO_STATE;
+  sshc->actualcode = CURLE_QUOTE_ERROR;
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_QUOTE(struct Curl_easy *data,
+                               struct ssh_conn *sshc,
+                               struct SSHPROTO *sshp)
 {
   const char *cp;
-  struct connectdata *conn = data->conn;
-  struct SSHPROTO *protop = data->req.p.ssh;
-  struct ssh_conn *sshc = &conn->proto.sshc;
   CURLcode result;
 
   /*
    * Support some of the "FTP" commands
    */
-  char *cmd = sshc->quote_item->data;
+  const char *cmd = sshc->quote_item->data;
   sshc->acceptfail = FALSE;
 
+  if(!sshp)
+    return myssh_to_ERROR(data, sshc, CURLE_FAILED_INIT);
+
   /* if a command starts with an asterisk, which a legal SFTP command never
-     can, the command will be allowed to fail without it causing any
-     aborts or cancels etc. It will cause libcurl to act as if the command
-     is successful, whatever the server reponds. */
+     can, the command is allowed to fail without it causing any
+     aborts or cancels etc. It causes libcurl to act as if the command
+     is successful, whatever the server responds. */
 
   if(cmd[0] == '*') {
     cmd++;
     sshc->acceptfail = TRUE;
   }
 
-  if(strcasecompare("pwd", cmd)) {
+  if(curl_strequal("pwd", cmd)) {
     /* output debug output if that is requested */
-    char *tmp = aprintf("257 \"%s\" is current directory.\n",
-                        protop->path);
+    char *tmp = curl_maprintf("257 \"%s\" is current directory.\n",
+                              sshp->path);
     if(!tmp) {
       sshc->actualcode = CURLE_OUT_OF_MEMORY;
-      state(data, SSH_SFTP_CLOSE);
+      myssh_to(data, sshc, SSH_SFTP_CLOSE);
       sshc->nextstate = SSH_NO_STATE;
-      return;
+      return SSH_NO_ERROR;
     }
-    Curl_debug(data, CURLINFO_HEADER_OUT, (char *) "PWD\n", 4);
+    Curl_debug(data, CURLINFO_HEADER_OUT, "PWD\n", 4);
     Curl_debug(data, CURLINFO_HEADER_IN, tmp, strlen(tmp));
 
-    /* this sends an FTP-like "header" to the header callback so that the
-       current directory can be read very similar to how it is read when
+    /* this sends an FTP-like "header" to the header callback so that
+       the current directory can be read similar to how it is read when
        using ordinary FTP. */
     result = Curl_client_write(data, CLIENTWRITE_HEADER, tmp, strlen(tmp));
-    free(tmp);
+    curlx_free(tmp);
     if(result) {
-      state(data, SSH_SFTP_CLOSE);
+      myssh_to(data, sshc, SSH_SFTP_CLOSE);
       sshc->nextstate = SSH_NO_STATE;
       sshc->actualcode = result;
     }
     else
-      state(data, SSH_SFTP_NEXT_QUOTE);
-    return;
+      myssh_to(data, sshc, SSH_SFTP_NEXT_QUOTE);
+    return SSH_NO_ERROR;
   }
 
   /*
@@ -2696,10 +1505,10 @@ static void sftp_quote(struct Curl_easy *data)
   cp = strchr(cmd, ' ');
   if(!cp) {
     failf(data, "Syntax error in SFTP command. Supply parameter(s)");
-    state(data, SSH_SFTP_CLOSE);
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
     sshc->nextstate = SSH_NO_STATE;
     sshc->actualcode = CURLE_QUOTE_ERROR;
-    return;
+    return SSH_NO_ERROR;
   }
 
   /*
@@ -2712,23 +1521,23 @@ static void sftp_quote(struct Curl_easy *data)
       failf(data, "Out of memory");
     else
       failf(data, "Syntax error: Bad first parameter");
-    state(data, SSH_SFTP_CLOSE);
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
     sshc->nextstate = SSH_NO_STATE;
     sshc->actualcode = result;
-    return;
+    return SSH_NO_ERROR;
   }
 
   /*
-   * SFTP is a binary protocol, so we don't send text commands
+   * SFTP is a binary protocol, so we do not send text commands
    * to the server. Instead, we scan for commands used by
    * OpenSSH's sftp program and call the appropriate libssh
    * functions.
    */
-  if(strncasecompare(cmd, "chgrp ", 6) ||
-     strncasecompare(cmd, "chmod ", 6) ||
-     strncasecompare(cmd, "chown ", 6) ||
-     strncasecompare(cmd, "atime ", 6) ||
-     strncasecompare(cmd, "mtime ", 6)) {
+  if(!strncmp(cmd, "chgrp ", 6) ||
+     !strncmp(cmd, "chmod ", 6) ||
+     !strncmp(cmd, "chown ", 6) ||
+     !strncmp(cmd, "atime ", 6) ||
+     !strncmp(cmd, "mtime ", 6)) {
     /* attribute change */
 
     /* sshc->quote_path1 contains the mode to set */
@@ -2740,18 +1549,20 @@ static void sftp_quote(struct Curl_easy *data)
       else
         failf(data, "Syntax error in chgrp/chmod/chown/atime/mtime: "
               "Bad second parameter");
-      Curl_safefree(sshc->quote_path1);
-      state(data, SSH_SFTP_CLOSE);
+      curlx_safefree(sshc->quote_path1);
+      myssh_to(data, sshc, SSH_SFTP_CLOSE);
       sshc->nextstate = SSH_NO_STATE;
       sshc->actualcode = result;
-      return;
+      return SSH_NO_ERROR;
     }
+    if(*cp)
+      return quote_error(data, sshc);
     sshc->quote_attrs = NULL;
-    state(data, SSH_SFTP_QUOTE_STAT);
-    return;
+    myssh_to(data, sshc, SSH_SFTP_QUOTE_STAT);
+    return SSH_NO_ERROR;
   }
-  if(strncasecompare(cmd, "ln ", 3) ||
-     strncasecompare(cmd, "symlink ", 8)) {
+  if(!strncmp(cmd, "ln ", 3) ||
+     !strncmp(cmd, "symlink ", 8)) {
     /* symbolic linking */
     /* sshc->quote_path1 is the source */
     /* get the destination */
@@ -2761,21 +1572,25 @@ static void sftp_quote(struct Curl_easy *data)
         failf(data, "Out of memory");
       else
         failf(data, "Syntax error in ln/symlink: Bad second parameter");
-      Curl_safefree(sshc->quote_path1);
-      state(data, SSH_SFTP_CLOSE);
+      curlx_safefree(sshc->quote_path1);
+      myssh_to(data, sshc, SSH_SFTP_CLOSE);
       sshc->nextstate = SSH_NO_STATE;
       sshc->actualcode = result;
-      return;
+      return SSH_NO_ERROR;
     }
-    state(data, SSH_SFTP_QUOTE_SYMLINK);
-    return;
+    if(*cp)
+      return quote_error(data, sshc);
+    myssh_to(data, sshc, SSH_SFTP_QUOTE_SYMLINK);
+    return SSH_NO_ERROR;
   }
-  else if(strncasecompare(cmd, "mkdir ", 6)) {
-    /* create dir */
-    state(data, SSH_SFTP_QUOTE_MKDIR);
-    return;
+  else if(!strncmp(cmd, "mkdir ", 6)) {
+    if(*cp)
+      return quote_error(data, sshc);
+    /* create directory */
+    myssh_to(data, sshc, SSH_SFTP_QUOTE_MKDIR);
+    return SSH_NO_ERROR;
   }
-  else if(strncasecompare(cmd, "rename ", 7)) {
+  else if(!strncmp(cmd, "rename ", 7)) {
     /* rename file */
     /* first param is the source path */
     /* second param is the dest. path */
@@ -2785,50 +1600,81 @@ static void sftp_quote(struct Curl_easy *data)
         failf(data, "Out of memory");
       else
         failf(data, "Syntax error in rename: Bad second parameter");
-      Curl_safefree(sshc->quote_path1);
-      state(data, SSH_SFTP_CLOSE);
+      curlx_safefree(sshc->quote_path1);
+      myssh_to(data, sshc, SSH_SFTP_CLOSE);
       sshc->nextstate = SSH_NO_STATE;
       sshc->actualcode = result;
-      return;
+      return SSH_NO_ERROR;
     }
-    state(data, SSH_SFTP_QUOTE_RENAME);
-    return;
+    if(*cp)
+      return quote_error(data, sshc);
+    myssh_to(data, sshc, SSH_SFTP_QUOTE_RENAME);
+    return SSH_NO_ERROR;
   }
-  else if(strncasecompare(cmd, "rmdir ", 6)) {
-    /* delete dir */
-    state(data, SSH_SFTP_QUOTE_RMDIR);
-    return;
+  else if(!strncmp(cmd, "rmdir ", 6)) {
+    /* delete directory */
+    if(*cp)
+      return quote_error(data, sshc);
+    myssh_to(data, sshc, SSH_SFTP_QUOTE_RMDIR);
+    return SSH_NO_ERROR;
   }
-  else if(strncasecompare(cmd, "rm ", 3)) {
-    state(data, SSH_SFTP_QUOTE_UNLINK);
-    return;
+  else if(!strncmp(cmd, "rm ", 3)) {
+    if(*cp)
+      return quote_error(data, sshc);
+    myssh_to(data, sshc, SSH_SFTP_QUOTE_UNLINK);
+    return SSH_NO_ERROR;
   }
 #ifdef HAS_STATVFS_SUPPORT
-  else if(strncasecompare(cmd, "statvfs ", 8)) {
-    state(data, SSH_SFTP_QUOTE_STATVFS);
-    return;
+  else if(!strncmp(cmd, "statvfs ", 8)) {
+    if(*cp)
+      return quote_error(data, sshc);
+    myssh_to(data, sshc, SSH_SFTP_QUOTE_STATVFS);
+    return SSH_NO_ERROR;
   }
 #endif
 
   failf(data, "Unknown SFTP command");
-  Curl_safefree(sshc->quote_path1);
-  Curl_safefree(sshc->quote_path2);
-  state(data, SSH_SFTP_CLOSE);
+  curlx_safefree(sshc->quote_path1);
+  curlx_safefree(sshc->quote_path2);
+  myssh_to(data, sshc, SSH_SFTP_CLOSE);
   sshc->nextstate = SSH_NO_STATE;
   sshc->actualcode = CURLE_QUOTE_ERROR;
+  return SSH_NO_ERROR;
 }
 
-static void sftp_quote_stat(struct Curl_easy *data)
+static int myssh_in_SFTP_NEXT_QUOTE(struct Curl_easy *data,
+                                    struct ssh_conn *sshc)
 {
-  struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-  char *cmd = sshc->quote_item->data;
+  curlx_safefree(sshc->quote_path1);
+  curlx_safefree(sshc->quote_path2);
+
+  sshc->quote_item = sshc->quote_item->next;
+
+  if(sshc->quote_item) {
+    myssh_to(data, sshc, SSH_SFTP_QUOTE);
+  }
+  else {
+    if(sshc->nextstate != SSH_NO_STATE) {
+      myssh_to(data, sshc, sshc->nextstate);
+      sshc->nextstate = SSH_NO_STATE;
+    }
+    else {
+      myssh_to(data, sshc, SSH_SFTP_GETINFO);
+    }
+  }
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_QUOTE_STAT(struct Curl_easy *data,
+                                    struct ssh_conn *sshc)
+{
+  const char *cmd = sshc->quote_item->data;
   sshc->acceptfail = FALSE;
 
   /* if a command starts with an asterisk, which a legal SFTP command never
-     can, the command will be allowed to fail without it causing any
-     aborts or cancels etc. It will cause libcurl to act as if the command
-     is successful, whatever the server reponds. */
+     can, the command is allowed to fail without it causing any
+     aborts or cancels etc. It causes libcurl to act as if the command
+     is successful, whatever the server responds. */
 
   if(cmd[0] == '*') {
     cmd++;
@@ -2844,66 +1690,51 @@ static void sftp_quote_stat(struct Curl_easy *data)
     sftp_attributes_free(sshc->quote_attrs);
   sshc->quote_attrs = sftp_stat(sshc->sftp_session, sshc->quote_path2);
   if(!sshc->quote_attrs) {
-    Curl_safefree(sshc->quote_path1);
-    Curl_safefree(sshc->quote_path2);
     failf(data, "Attempt to get SFTP stats failed: %d",
           sftp_get_error(sshc->sftp_session));
-    state(data, SSH_SFTP_CLOSE);
-    sshc->nextstate = SSH_NO_STATE;
-    sshc->actualcode = CURLE_QUOTE_ERROR;
-    return;
+    myssh_quote_error(data, sshc, NULL);
+    return SSH_NO_ERROR;
   }
 
   /* Now set the new attributes... */
-  if(strncasecompare(cmd, "chgrp", 5)) {
-    sshc->quote_attrs->gid = (uint32_t)strtoul(sshc->quote_path1, NULL, 10);
-    if(sshc->quote_attrs->gid == 0 && !ISDIGIT(sshc->quote_path1[0]) &&
-        !sshc->acceptfail) {
-      Curl_safefree(sshc->quote_path1);
-      Curl_safefree(sshc->quote_path2);
+  if(!strncmp(cmd, "chgrp", 5)) {
+    const char *p = sshc->quote_path1;
+    curl_off_t gid;
+    if(curlx_str_number(&p, &gid, UINT_MAX)) {
       failf(data, "Syntax error: chgrp gid not a number");
-      state(data, SSH_SFTP_CLOSE);
-      sshc->nextstate = SSH_NO_STATE;
-      sshc->actualcode = CURLE_QUOTE_ERROR;
-      return;
+      myssh_quote_error(data, sshc, NULL);
+      return SSH_NO_ERROR;
     }
+    sshc->quote_attrs->gid = (uint32_t)gid;
     sshc->quote_attrs->flags |= SSH_FILEXFER_ATTR_UIDGID;
   }
-  else if(strncasecompare(cmd, "chmod", 5)) {
-    mode_t perms;
-    perms = (mode_t)strtoul(sshc->quote_path1, NULL, 8);
-    /* permissions are octal */
-    if(perms == 0 && !ISDIGIT(sshc->quote_path1[0])) {
-      Curl_safefree(sshc->quote_path1);
-      Curl_safefree(sshc->quote_path2);
+  else if(!strncmp(cmd, "chmod", 5)) {
+    curl_off_t perms;
+    const char *p = sshc->quote_path1;
+    if(curlx_str_octal(&p, &perms, 07777)) {
       failf(data, "Syntax error: chmod permissions not a number");
-      state(data, SSH_SFTP_CLOSE);
-      sshc->nextstate = SSH_NO_STATE;
-      sshc->actualcode = CURLE_QUOTE_ERROR;
-      return;
+      myssh_quote_error(data, sshc, NULL);
+      return SSH_NO_ERROR;
     }
-    sshc->quote_attrs->permissions = perms;
+    sshc->quote_attrs->permissions = (mode_t)perms;
     sshc->quote_attrs->flags |= SSH_FILEXFER_ATTR_PERMISSIONS;
   }
-  else if(strncasecompare(cmd, "chown", 5)) {
-    sshc->quote_attrs->uid = (uint32_t)strtoul(sshc->quote_path1, NULL, 10);
-    if(sshc->quote_attrs->uid == 0 && !ISDIGIT(sshc->quote_path1[0]) &&
-        !sshc->acceptfail) {
-      Curl_safefree(sshc->quote_path1);
-      Curl_safefree(sshc->quote_path2);
+  else if(!strncmp(cmd, "chown", 5)) {
+    const char *p = sshc->quote_path1;
+    curl_off_t uid;
+    if(curlx_str_number(&p, &uid, UINT_MAX)) {
       failf(data, "Syntax error: chown uid not a number");
-      state(data, SSH_SFTP_CLOSE);
-      sshc->nextstate = SSH_NO_STATE;
-      sshc->actualcode = CURLE_QUOTE_ERROR;
-      return;
+      myssh_quote_error(data, sshc, NULL);
+      return SSH_NO_ERROR;
     }
+    sshc->quote_attrs->uid = (uint32_t)uid;
     sshc->quote_attrs->flags |= SSH_FILEXFER_ATTR_UIDGID;
   }
-  else if(strncasecompare(cmd, "atime", 5) ||
-          strncasecompare(cmd, "mtime", 5)) {
-    time_t date = Curl_getdate_capped(sshc->quote_path1);
+  else if(!strncmp(cmd, "atime", 5) ||
+          !strncmp(cmd, "mtime", 5)) {
+    time_t date;
     bool fail = FALSE;
-    if(date == -1) {
+    if(Curl_getdate_capped(sshc->quote_path1, &date)) {
       failf(data, "incorrect date format for %.*s", 5, cmd);
       fail = TRUE;
     }
@@ -2914,14 +1745,10 @@ static void sftp_quote_stat(struct Curl_easy *data)
     }
 #endif
     if(fail) {
-      Curl_safefree(sshc->quote_path1);
-      Curl_safefree(sshc->quote_path2);
-      state(data, SSH_SFTP_CLOSE);
-      sshc->nextstate = SSH_NO_STATE;
-      sshc->actualcode = CURLE_QUOTE_ERROR;
-      return;
+      myssh_quote_error(data, sshc, NULL);
+      return SSH_NO_ERROR;
     }
-    if(strncasecompare(cmd, "atime", 5))
+    if(!strncmp(cmd, "atime", 5))
       sshc->quote_attrs->atime = (uint32_t)date;
     else /* mtime */
       sshc->quote_attrs->mtime = (uint32_t)date;
@@ -2930,14 +1757,1391 @@ static void sftp_quote_stat(struct Curl_easy *data)
   }
 
   /* Now send the completed structure... */
-  state(data, SSH_SFTP_QUOTE_SETSTAT);
-  return;
+  myssh_to(data, sshc, SSH_SFTP_QUOTE_SETSTAT);
+  return SSH_NO_ERROR;
+}
+
+static void conn_forget_socket(struct Curl_easy *data, int sockindex)
+{
+  struct connectdata *conn = data->conn;
+  if(conn && CONN_SOCK_IDX_VALID(sockindex)) {
+    struct Curl_cfilter *cf = conn->cfilter[sockindex];
+    if(cf)
+      (void)Curl_conn_cf_cntrl(cf, data, TRUE, CF_CTRL_FORGET_SOCKET, 0, NULL);
+    fake_sclose(conn->sock[sockindex]);
+    conn->sock[sockindex] = CURL_SOCKET_BAD;
+  }
+}
+
+static void myssh_SESSION_DISCONNECT(struct Curl_easy *data,
+                                     struct ssh_conn *sshc)
+{
+  /* during weird times when we have been prematurely aborted, the channel
+     is still alive when we reach this state and we MUST kill the channel
+     properly first */
+  if(sshc->scp_session) {
+    ssh_scp_free(sshc->scp_session);
+    sshc->scp_session = NULL;
+  }
+
+  if(sshc->sftp_file) {
+    sftp_close(sshc->sftp_file);
+    sshc->sftp_file = NULL;
+  }
+  if(sshc->sftp_session) {
+    sftp_free(sshc->sftp_session);
+    sshc->sftp_session = NULL;
+  }
+
+  ssh_disconnect(sshc->ssh_session);
+  if(!ssh_version(SSH_VERSION_INT(0, 10, 0))) {
+    /* conn->sock[FIRSTSOCKET] is closed by ssh_disconnect behind our back,
+       tell the connection to forget about it. This libssh
+       bug is fixed in 0.10.0. */
+    conn_forget_socket(data, FIRSTSOCKET);
+  }
+
+  SSH_STRING_FREE_CHAR(sshc->homedir);
+
+  myssh_to(data, sshc, SSH_SESSION_FREE);
+}
+
+static int myssh_SSH_SCP_DOWNLOAD(struct Curl_easy *data,
+                                  struct ssh_conn *sshc)
+{
+  curl_off_t bytecount;
+  int rc = ssh_scp_pull_request(sshc->scp_session);
+  if(rc != SSH_SCP_REQUEST_NEWFILE) {
+    const char *err_msg = ssh_get_error(sshc->ssh_session);
+    failf(data, "%s", err_msg);
+    return myssh_to_ERROR(data, sshc, CURLE_REMOTE_FILE_NOT_FOUND);
+  }
+
+  /* download data */
+  bytecount = ssh_scp_request_get_size(sshc->scp_session);
+  data->req.maxdownload = bytecount;
+  Curl_xfer_setup_recv(data, FIRSTSOCKET, bytecount);
+
+  /* not set by Curl_xfer_setup to preserve io_flags */
+  data->conn->send_idx = 0;
+
+  myssh_to(data, sshc, SSH_STOP);
+  return 0;
+}
+
+static int myssh_in_TRANS_INIT(struct Curl_easy *data, struct ssh_conn *sshc,
+                               struct SSHPROTO *sshp)
+{
+  CURLcode result;
+  int rc = 0;
+  if(!sshp)
+    return myssh_to_ERROR(data, sshc, CURLE_FAILED_INIT);
+
+  result = Curl_getworkingpath(data, sshc->homedir, &sshp->path);
+  if(result) {
+    sshc->actualcode = result;
+    myssh_to(data, sshc, SSH_STOP);
+    return 0;
+  }
+
+  /* Functions from the SCP subsystem cannot handle/return SSH_AGAIN */
+  ssh_set_blocking(sshc->ssh_session, 1);
+
+  if(data->state.upload) {
+    if(data->state.infilesize < 0) {
+      failf(data, "SCP requires a known file size for upload");
+      return myssh_to_ERROR(data, sshc, CURLE_UPLOAD_FAILED);
+    }
+
+    sshc->scp_session =
+      ssh_scp_new(sshc->ssh_session, SSH_SCP_WRITE, sshp->path);
+    myssh_to(data, sshc, SSH_SCP_UPLOAD_INIT);
+  }
+  else {
+    sshc->scp_session =
+      ssh_scp_new(sshc->ssh_session, SSH_SCP_READ, sshp->path);
+    myssh_to(data, sshc, SSH_SCP_DOWNLOAD_INIT);
+  }
+
+  if(!sshc->scp_session) {
+    const char *err_msg = ssh_get_error(sshc->ssh_session);
+    failf(data, "%s", err_msg);
+    rc = myssh_to_ERROR(data, sshc, CURLE_UPLOAD_FAILED);
+  }
+  return rc;
+}
+
+static void sshc_cleanup(struct ssh_conn *sshc)
+{
+  if(sshc->initialized) {
+    if(sshc->sftp_file) {
+      sftp_close(sshc->sftp_file);
+      sshc->sftp_file = NULL;
+    }
+    if(sshc->sftp_session) {
+      sftp_free(sshc->sftp_session);
+      sshc->sftp_session = NULL;
+    }
+    if(sshc->ssh_session) {
+      ssh_free(sshc->ssh_session);
+      sshc->ssh_session = NULL;
+    }
+
+    /* worst-case scenario cleanup */
+    DEBUGASSERT(!sshc->ssh_session);
+    DEBUGASSERT(!sshc->scp_session);
+
+    if(sshc->readdir_tmp) {
+      ssh_string_free_char(sshc->readdir_tmp);
+      sshc->readdir_tmp = NULL;
+    }
+    if(sshc->quote_attrs) {
+      sftp_attributes_free(sshc->quote_attrs);
+      sshc->quote_attrs = NULL;
+    }
+    if(sshc->readdir_attrs) {
+      sftp_attributes_free(sshc->readdir_attrs);
+      sshc->readdir_attrs = NULL;
+    }
+    if(sshc->readdir_link_attrs) {
+      sftp_attributes_free(sshc->readdir_link_attrs);
+      sshc->readdir_link_attrs = NULL;
+    }
+    if(sshc->privkey) {
+      ssh_key_free(sshc->privkey);
+      sshc->privkey = NULL;
+    }
+    if(sshc->pubkey) {
+      ssh_key_free(sshc->pubkey);
+      sshc->pubkey = NULL;
+    }
+
+    curlx_safefree(sshc->rsa_pub);
+    curlx_safefree(sshc->rsa);
+    curlx_safefree(sshc->quote_path1);
+    curlx_safefree(sshc->quote_path2);
+    curlx_dyn_free(&sshc->readdir_buf);
+    curlx_safefree(sshc->readdir_linkPath);
+    SSH_STRING_FREE_CHAR(sshc->homedir);
+    sshc->initialized = FALSE;
+  }
+}
+
+static int myssh_in_SFTP_QUOTE_SETSTAT(struct Curl_easy *data,
+                                       struct ssh_conn *sshc)
+{
+  int rc = sftp_setstat(sshc->sftp_session, sshc->quote_path2,
+                        sshc->quote_attrs);
+  if(rc == SSH_AGAIN)
+    return rc;
+  if(rc && !sshc->acceptfail) {
+    myssh_quote_error(data, sshc, "setstat");
+    return rc;
+  }
+  myssh_to(data, sshc, SSH_SFTP_NEXT_QUOTE);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_QUOTE_SYMLINK(struct Curl_easy *data,
+                                       struct ssh_conn *sshc)
+{
+  int rc = sftp_symlink(sshc->sftp_session, sshc->quote_path2,
+                        sshc->quote_path1);
+  if(rc == SSH_AGAIN)
+    return rc;
+  if(rc && !sshc->acceptfail) {
+    myssh_quote_error(data, sshc, "symlink");
+    return rc;
+  }
+  myssh_to(data, sshc, SSH_SFTP_NEXT_QUOTE);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_QUOTE_MKDIR(struct Curl_easy *data,
+                                     struct ssh_conn *sshc)
+{
+  int rc = sftp_mkdir(sshc->sftp_session, sshc->quote_path1,
+                      (mode_t)data->set.new_directory_perms);
+  if(rc == SSH_AGAIN)
+    return rc;
+  if(rc && !sshc->acceptfail) {
+    myssh_quote_error(data, sshc, "mkdir");
+    return rc;
+  }
+  myssh_to(data, sshc, SSH_SFTP_NEXT_QUOTE);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_QUOTE_RENAME(struct Curl_easy *data,
+                                      struct ssh_conn *sshc)
+{
+  int rc = sftp_rename(sshc->sftp_session, sshc->quote_path1,
+                       sshc->quote_path2);
+  if(rc == SSH_AGAIN)
+    return rc;
+  if(rc && !sshc->acceptfail) {
+    myssh_quote_error(data, sshc, "rename");
+    return rc;
+  }
+  myssh_to(data, sshc, SSH_SFTP_NEXT_QUOTE);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_QUOTE_RMDIR(struct Curl_easy *data,
+                                     struct ssh_conn *sshc)
+{
+  int rc = sftp_rmdir(sshc->sftp_session, sshc->quote_path1);
+  if(rc == SSH_AGAIN)
+    return rc;
+  if(rc && !sshc->acceptfail) {
+    myssh_quote_error(data, sshc, "rmdir");
+    return rc;
+  }
+  myssh_to(data, sshc, SSH_SFTP_NEXT_QUOTE);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_QUOTE_UNLINK(struct Curl_easy *data,
+                                      struct ssh_conn *sshc)
+{
+  int rc = sftp_unlink(sshc->sftp_session, sshc->quote_path1);
+  if(rc == SSH_AGAIN)
+    return rc;
+  if(rc && !sshc->acceptfail) {
+    myssh_quote_error(data, sshc, "rm");
+    return rc;
+  }
+  myssh_to(data, sshc, SSH_SFTP_NEXT_QUOTE);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_GETINFO(struct Curl_easy *data,
+                                 struct ssh_conn *sshc)
+{
+  if(data->set.get_filetime)
+    myssh_to(data, sshc, SSH_SFTP_FILETIME);
+  else
+    myssh_to(data, sshc, SSH_SFTP_TRANS_INIT);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_FILETIME(struct Curl_easy *data,
+                                  struct ssh_conn *sshc,
+                                  struct SSHPROTO *sshp)
+{
+  sftp_attributes attrs;
+  if(!sshp)
+    return myssh_to_ERROR(data, sshc, CURLE_FAILED_INIT);
+
+  attrs = sftp_stat(sshc->sftp_session, sshp->path);
+  if(attrs) {
+    data->info.filetime = attrs->mtime;
+    sftp_attributes_free(attrs);
+  }
+
+  myssh_to(data, sshc, SSH_SFTP_TRANS_INIT);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_TRANS_INIT(struct Curl_easy *data,
+                                    struct ssh_conn *sshc,
+                                    struct SSHPROTO *sshp)
+{
+  if(!sshp)
+    return myssh_to_ERROR(data, sshc, CURLE_FAILED_INIT);
+  if(data->state.upload)
+    myssh_to(data, sshc, SSH_SFTP_UPLOAD_INIT);
+  else {
+    size_t path_len = strlen(sshp->path);
+
+    if(path_len && sshp->path[path_len - 1] == '/')
+      myssh_to(data, sshc, SSH_SFTP_READDIR_INIT);
+    else
+      myssh_to(data, sshc, SSH_SFTP_DOWNLOAD_INIT);
+  }
+
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_CREATE_DIRS_INIT(struct Curl_easy *data,
+                                          struct ssh_conn *sshc,
+                                          struct SSHPROTO *sshp)
+{
+  if(!sshp)
+    return myssh_to_ERROR(data, sshc, CURLE_FAILED_INIT);
+
+  if(strlen(sshp->path) > 1) {
+    sshc->slash_pos = sshp->path + 1; /* ignore the leading '/' */
+    myssh_to(data, sshc, SSH_SFTP_CREATE_DIRS);
+  }
+  else {
+    myssh_to(data, sshc, SSH_SFTP_UPLOAD_INIT);
+  }
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_CREATE_DIRS(struct Curl_easy *data,
+                                     struct ssh_conn *sshc,
+                                     struct SSHPROTO *sshp)
+{
+  if(!sshp)
+    return myssh_to_ERROR(data, sshc, CURLE_FAILED_INIT);
+
+  sshc->slash_pos = strchr(sshc->slash_pos, '/');
+  if(sshc->slash_pos) {
+    *sshc->slash_pos = 0;
+
+    infof(data, "Creating directory '%s'", sshp->path);
+    myssh_to(data, sshc, SSH_SFTP_CREATE_DIRS_MKDIR);
+    return SSH_NO_ERROR;
+  }
+  myssh_to(data, sshc, SSH_SFTP_UPLOAD_INIT);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SFTP_CREATE_DIRS_MKDIR(struct Curl_easy *data,
+                                           struct ssh_conn *sshc,
+                                           struct SSHPROTO *sshp)
+{
+  int rc;
+  int err;
+  /* 'mode' - parameter is preliminary - default to 0644 */
+  if(!sshp)
+    return myssh_to_ERROR(data, sshc, CURLE_FAILED_INIT);
+
+  rc = sftp_mkdir(sshc->sftp_session, sshp->path,
+                  (mode_t)data->set.new_directory_perms);
+  if(rc == SSH_AGAIN)
+    return rc;
+  *sshc->slash_pos = '/';
+  ++sshc->slash_pos;
+  if(rc < 0) {
+    /*
+     * Abort if failure was not that the directory already
+     * exists or the permission was denied (creation might
+     * succeed further down the path) - retry on unspecific
+     * FAILURE also
+     */
+    err = sftp_get_error(sshc->sftp_session);
+    if((err != SSH_FX_FILE_ALREADY_EXISTS) &&
+       (err != SSH_FX_FAILURE) &&
+       (err != SSH_FX_PERMISSION_DENIED)) {
+      return myssh_to_SFTP_CLOSE(data, sshc);
+    }
+    rc = 0; /* clear rc and continue */
+  }
+  myssh_to(data, sshc, SSH_SFTP_CREATE_DIRS);
+  return rc;
+}
+
+static int myssh_in_SCP_UPLOAD_INIT(struct Curl_easy *data,
+                                    struct ssh_conn *sshc,
+                                    struct SSHPROTO *sshp)
+{
+  int rc;
+  if(!sshp)
+    return myssh_to_ERROR(data, sshc, CURLE_FAILED_INIT);
+
+  rc = ssh_scp_init(sshc->scp_session);
+  if(rc != SSH_OK) {
+    const char *err_msg = ssh_get_error(sshc->ssh_session);
+    failf(data, "%s", err_msg);
+    return myssh_to_ERROR(data, sshc, CURLE_UPLOAD_FAILED);
+  }
+
+  rc = ssh_scp_push_file64(sshc->scp_session, sshp->path,
+                           (uint64_t)data->state.infilesize,
+                           (int)data->set.new_file_perms);
+
+  if(rc != SSH_OK) {
+    const char *err_msg = ssh_get_error(sshc->ssh_session);
+    failf(data, "%s", err_msg);
+    return myssh_to_ERROR(data, sshc, CURLE_UPLOAD_FAILED);
+  }
+
+  /* upload data */
+  Curl_xfer_setup_send(data, FIRSTSOCKET);
+
+  /* not set by Curl_xfer_setup to preserve io_flags */
+  data->conn->recv_idx = FIRSTSOCKET;
+
+  myssh_to(data, sshc, SSH_STOP);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SCP_DOWNLOAD_INIT(struct Curl_easy *data,
+                                      struct ssh_conn *sshc)
+{
+  int rc = ssh_scp_init(sshc->scp_session);
+  if(rc != SSH_OK) {
+    const char *err_msg = ssh_get_error(sshc->ssh_session);
+    failf(data, "%s", err_msg);
+    return myssh_to_ERROR(data, sshc,
+                          CURLE_COULDNT_CONNECT);
+  }
+  myssh_to(data, sshc, SSH_SCP_DOWNLOAD);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SCP_DONE(struct Curl_easy *data,
+                             struct ssh_conn *sshc)
+{
+  if(data->state.upload)
+    myssh_to(data, sshc, SSH_SCP_SEND_EOF);
+  else
+    myssh_to(data, sshc, SSH_SCP_CHANNEL_FREE);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SCP_SEND_EOF(struct Curl_easy *data,
+                                 struct ssh_conn *sshc)
+{
+  if(sshc->scp_session) {
+    int rc = ssh_scp_close(sshc->scp_session);
+    if(rc == SSH_AGAIN) {
+      /* Currently the ssh_scp_close handles waiting for
+       * EOF in blocking way.
+       */
+      return SSH_AGAIN;
+    }
+    if(rc != SSH_OK) {
+      infof(data,
+            "Failed to close libssh scp channel: %s",
+            ssh_get_error(sshc->ssh_session));
+    }
+  }
+
+  myssh_to(data, sshc, SSH_SCP_CHANNEL_FREE);
+  return SSH_NO_ERROR;
+}
+
+static int myssh_in_SCP_CHANNEL_FREE(struct Curl_easy *data,
+                                     struct ssh_conn *sshc)
+{
+  if(sshc->scp_session) {
+    ssh_scp_free(sshc->scp_session);
+    sshc->scp_session = NULL;
+  }
+  CURL_TRC_SSH(data, "SCP DONE phase complete");
+
+  ssh_set_blocking(sshc->ssh_session, 0);
+
+  myssh_to(data, sshc, SSH_SESSION_DISCONNECT);
+  return SSH_NO_ERROR;
+}
+
+static CURLcode myssh_in_SESSION_FREE(struct Curl_easy *data,
+                                      struct ssh_conn *sshc)
+{
+  CURLcode result;
+  sshc_cleanup(sshc);
+  /* the code we are about to return */
+  result = sshc->actualcode;
+  memset(sshc, 0, sizeof(struct ssh_conn));
+  connclose(data->conn, "SSH session free");
+  sshc->state = SSH_SESSION_FREE;   /* current */
+  sshc->nextstate = SSH_NO_STATE;
+  myssh_to(data, sshc, SSH_STOP);
+  return result;
+}
+
+/*
+ * myssh_statemachine() runs the SSH state machine as far as it can without
+ * blocking and without reaching the end. The data the pointer 'block' points
+ * to is set to TRUE if the libssh function returns SSH_AGAIN
+ * meaning it wants to be called again when the socket is ready
+ */
+static CURLcode myssh_statemachine(struct Curl_easy *data,
+                                   struct ssh_conn *sshc,
+                                   struct SSHPROTO *sshp,
+                                   bool *block)
+{
+  CURLcode result = CURLE_OK;
+  int rc = SSH_NO_ERROR;
+
+  *block = FALSE;                   /* we are not blocking by default */
+  do {
+
+    switch(sshc->state) {
+    case SSH_INIT:
+      myssh_state_init(data, sshc);
+      FALLTHROUGH();
+    case SSH_S_STARTUP:
+      rc = myssh_in_S_STARTUP(data, sshc);
+      if(rc)
+        break;
+      FALLTHROUGH();
+    case SSH_HOSTKEY:
+      rc = myssh_is_known(data, sshc);
+      if(rc != SSH_OK) {
+        rc = myssh_to_ERROR(data, sshc, CURLE_PEER_FAILED_VERIFICATION);
+        break;
+      }
+      myssh_to(data, sshc, SSH_AUTHLIST);
+      FALLTHROUGH();
+    case SSH_AUTHLIST:
+      rc = myssh_in_AUTHLIST(data, sshc);
+      break;
+    case SSH_AUTH_PKEY_INIT:
+      rc = myssh_in_AUTH_PKEY_INIT(data, sshc);
+      break;
+    case SSH_AUTH_PKEY:
+      rc = myssh_in_AUTH_PKEY(data, sshc);
+      break;
+    case SSH_AUTH_GSSAPI:
+      rc = myssh_in_AUTH_GSSAPI(data, sshc);
+      break;
+    case SSH_AUTH_KEY_INIT:
+      rc = myssh_in_AUTH_KEY_INIT(data, sshc);
+      break;
+    case SSH_AUTH_KEY:
+      rc = myssh_in_AUTH_KEY(data, sshc);
+      break;
+    case SSH_AUTH_PASS_INIT:
+      rc = myssh_in_AUTH_PASS_INIT(data, sshc);
+      break;
+    case SSH_AUTH_PASS:
+      rc = myssh_in_AUTH_PASS(data, sshc);
+      break;
+    case SSH_AUTH_DONE:
+      rc = myssh_in_AUTH_DONE(data, sshc);
+      break;
+    case SSH_SFTP_INIT:
+      rc = myssh_in_SFTP_INIT(data, sshc);
+      break;
+    case SSH_SFTP_REALPATH:
+      rc = myssh_in_SFTP_REALPATH(data, sshc);
+      break;
+    case SSH_SFTP_QUOTE_INIT:
+      rc = myssh_in_SFTP_QUOTE_INIT(data, sshc, sshp);
+      break;
+    case SSH_SFTP_POSTQUOTE_INIT:
+      rc = myssh_in_SFTP_POSTQUOTE_INIT(data, sshc);
+      break;
+    case SSH_SFTP_QUOTE:
+      rc = myssh_in_SFTP_QUOTE(data, sshc, sshp);
+      break;
+    case SSH_SFTP_NEXT_QUOTE:
+      rc = myssh_in_SFTP_NEXT_QUOTE(data, sshc);
+      break;
+    case SSH_SFTP_QUOTE_STAT:
+      rc = myssh_in_SFTP_QUOTE_STAT(data, sshc);
+      break;
+    case SSH_SFTP_QUOTE_SETSTAT:
+      rc = myssh_in_SFTP_QUOTE_SETSTAT(data, sshc);
+      break;
+    case SSH_SFTP_QUOTE_SYMLINK:
+      rc = myssh_in_SFTP_QUOTE_SYMLINK(data, sshc);
+      break;
+    case SSH_SFTP_QUOTE_MKDIR:
+      rc = myssh_in_SFTP_QUOTE_MKDIR(data, sshc);
+      break;
+    case SSH_SFTP_QUOTE_RENAME:
+      rc = myssh_in_SFTP_QUOTE_RENAME(data, sshc);
+      break;
+    case SSH_SFTP_QUOTE_RMDIR:
+      rc = myssh_in_SFTP_QUOTE_RMDIR(data, sshc);
+      break;
+    case SSH_SFTP_QUOTE_UNLINK:
+      rc = myssh_in_SFTP_QUOTE_UNLINK(data, sshc);
+      break;
+    case SSH_SFTP_QUOTE_STATVFS:
+      rc = myssh_in_SFTP_QUOTE_STATVFS(data, sshc);
+      break;
+    case SSH_SFTP_GETINFO:
+      rc = myssh_in_SFTP_GETINFO(data, sshc);
+      break;
+    case SSH_SFTP_FILETIME:
+      rc = myssh_in_SFTP_FILETIME(data, sshc, sshp);
+      break;
+    case SSH_SFTP_TRANS_INIT:
+      rc = myssh_in_SFTP_TRANS_INIT(data, sshc, sshp);
+      break;
+    case SSH_SFTP_UPLOAD_INIT:
+      rc = myssh_in_UPLOAD_INIT(data, sshc, sshp);
+      break;
+    case SSH_SFTP_CREATE_DIRS_INIT:
+      rc = myssh_in_SFTP_CREATE_DIRS_INIT(data, sshc, sshp);
+      break;
+    case SSH_SFTP_CREATE_DIRS:
+      rc = myssh_in_SFTP_CREATE_DIRS(data, sshc, sshp);
+      break;
+    case SSH_SFTP_CREATE_DIRS_MKDIR:
+      rc = myssh_in_SFTP_CREATE_DIRS_MKDIR(data, sshc, sshp);
+      break;
+    case SSH_SFTP_READDIR_INIT:
+      rc = myssh_in_SFTP_READDIR_INIT(data, sshc, sshp);
+      break;
+    case SSH_SFTP_READDIR:
+      rc = myssh_in_SFTP_READDIR(data, sshc, sshp);
+      break;
+    case SSH_SFTP_READDIR_LINK:
+      rc = myssh_in_SFTP_READDIR_LINK(data, sshc);
+      break;
+    case SSH_SFTP_READDIR_BOTTOM:
+      rc = myssh_in_SFTP_READDIR_BOTTOM(data, sshc);
+      break;
+    case SSH_SFTP_READDIR_DONE:
+      rc = myssh_in_SFTP_READDIR_DONE(data, sshc);
+      break;
+    case SSH_SFTP_DOWNLOAD_INIT:
+      rc = myssh_in_SFTP_DOWNLOAD_INIT(data, sshc, sshp);
+      break;
+    case SSH_SFTP_DOWNLOAD_STAT:
+      rc = myssh_in_SFTP_DOWNLOAD_STAT(data, sshc);
+      break;
+    case SSH_SFTP_CLOSE:
+      rc = myssh_in_SFTP_CLOSE(data, sshc, sshp);
+      break;
+    case SSH_SFTP_SHUTDOWN:
+      rc = myssh_in_SFTP_SHUTDOWN(data, sshc);
+      break;
+    case SSH_SCP_TRANS_INIT:
+      rc = myssh_in_TRANS_INIT(data, sshc, sshp);
+      break;
+    case SSH_SCP_UPLOAD_INIT:
+      rc = myssh_in_SCP_UPLOAD_INIT(data, sshc, sshp);
+      break;
+    case SSH_SCP_DOWNLOAD_INIT:
+      rc = myssh_in_SCP_DOWNLOAD_INIT(data, sshc);
+      if(rc)
+        break;
+      FALLTHROUGH();
+    case SSH_SCP_DOWNLOAD:
+      rc = myssh_SSH_SCP_DOWNLOAD(data, sshc);
+      break;
+    case SSH_SCP_DONE:
+      rc = myssh_in_SCP_DONE(data, sshc);
+      break;
+    case SSH_SCP_SEND_EOF:
+      rc = myssh_in_SCP_SEND_EOF(data, sshc);
+      break;
+    case SSH_SCP_CHANNEL_FREE:
+      myssh_in_SCP_CHANNEL_FREE(data, sshc);
+      FALLTHROUGH();
+    case SSH_SESSION_DISCONNECT:
+      myssh_SESSION_DISCONNECT(data, sshc);
+      FALLTHROUGH();
+    case SSH_SESSION_FREE:
+      result = myssh_in_SESSION_FREE(data, sshc);
+      break;
+    case SSH_QUIT:
+    default:
+      /* internal error */
+      sshc->nextstate = SSH_NO_STATE;
+      myssh_to(data, sshc, SSH_STOP);
+      break;
+    }
+    /* break the loop only on STOP or SSH_AGAIN. If `rc` is some
+     * other error code, we will have progressed the state accordingly. */
+  } while((rc != SSH_AGAIN) && (sshc->state != SSH_STOP));
+
+  if(rc == SSH_AGAIN) {
+    /* we would block, we need to wait for the socket to be ready (in the
+       right direction too)! */
+    *block = TRUE;
+  }
+  if(!result && (sshc->state == SSH_STOP))
+    result = sshc->actualcode;
+  CURL_TRC_SSH(data, "[%s] statemachine() -> %d, block=%d",
+               Curl_ssh_statename(sshc->state), (int)result, *block);
+  return result;
+}
+
+/* called by the multi interface to figure out what socket(s) to wait for and
+   for what actions in the DO_DONE, PERFORM and WAITPERFORM states */
+static CURLcode myssh_pollset(struct Curl_easy *data,
+                              struct easy_pollset *ps)
+{
+  struct connectdata *conn = data->conn;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+  curl_socket_t sock = conn->sock[FIRSTSOCKET];
+  int waitfor;
+
+  if(!sshc || (sock == CURL_SOCKET_BAD))
+    return CURLE_FAILED_INIT;
+
+  waitfor = sshc->waitfor ? sshc->waitfor : data->req.io_flags;
+  if(waitfor) {
+    int flags = 0;
+    if(waitfor & REQ_IO_RECV)
+      flags |= CURL_POLL_IN;
+    if(waitfor & REQ_IO_SEND)
+      flags |= CURL_POLL_OUT;
+    DEBUGASSERT(flags);
+    CURL_TRC_SSH(data, "pollset, flags=%x", (unsigned int)flags);
+    return Curl_pollset_change(data, ps, sock, flags, 0);
+  }
+  /* While we still have a session, we listen incoming data. */
+  if(sshc->ssh_session)
+    return Curl_pollset_change(data, ps, sock, CURL_POLL_IN, 0);
+  return CURLE_OK;
+}
+
+/* called repeatedly until done from multi.c */
+static CURLcode myssh_multi_statemach(struct Curl_easy *data,
+                                      bool *done)
+{
+  struct connectdata *conn = data->conn;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+  struct SSHPROTO *sshp = Curl_meta_get(data, CURL_META_SSH_EASY);
+  bool block;    /* we store the status and use that to provide a ssh_pollset()
+                    implementation */
+  CURLcode result;
+
+  if(!sshc || !sshp)
+    return CURLE_FAILED_INIT;
+  result = myssh_statemachine(data, sshc, sshp, &block);
+  *done = (sshc->state == SSH_STOP);
+  myssh_block2waitfor(conn, sshc, block);
+
+  return result;
+}
+
+static CURLcode myssh_block_statemach(struct Curl_easy *data,
+                                      struct ssh_conn *sshc,
+                                      struct SSHPROTO *sshp,
+                                      bool disconnect)
+{
+  struct connectdata *conn = data->conn;
+  CURLcode result = CURLE_OK;
+
+  while((sshc->state != SSH_STOP) && !result) {
+    bool block;
+    timediff_t left_ms = 1000;
+
+    result = myssh_statemachine(data, sshc, sshp, &block);
+    if(result)
+      break;
+
+    if(!disconnect) {
+      result = Curl_pgrsCheck(data);
+      if(result)
+        break;
+
+      left_ms = Curl_timeleft_ms(data);
+      if(left_ms < 0) {
+        failf(data, "Operation timed out");
+        return CURLE_OPERATION_TIMEDOUT;
+      }
+    }
+
+    if(block) {
+      curl_socket_t fd_read = conn->sock[FIRSTSOCKET];
+      /* wait for the socket to become ready */
+      (void)SOCKET_READABLE(fd_read, left_ms > 1000 ? 1000 : left_ms);
+    }
+  }
+
+  return result;
+}
+
+static void myssh_easy_dtor(void *key, size_t klen, void *entry)
+{
+  struct SSHPROTO *sshp = entry;
+  (void)key;
+  (void)klen;
+  curlx_safefree(sshp->path);
+  curlx_free(sshp);
+}
+
+static void myssh_conn_dtor(void *key, size_t klen, void *entry)
+{
+  struct ssh_conn *sshc = entry;
+  (void)key;
+  (void)klen;
+  sshc_cleanup(sshc);
+  curlx_free(sshc);
+}
+
+/*
+ * SSH setup connection
+ */
+static CURLcode myssh_setup_connection(struct Curl_easy *data,
+                                       struct connectdata *conn)
+{
+  struct SSHPROTO *sshp;
+  struct ssh_conn *sshc;
+
+  sshc = curlx_calloc(1, sizeof(*sshc));
+  if(!sshc)
+    return CURLE_OUT_OF_MEMORY;
+
+  curlx_dyn_init(&sshc->readdir_buf, CURL_PATH_MAX * 2);
+  sshc->initialized = TRUE;
+  if(Curl_conn_meta_set(conn, CURL_META_SSH_CONN, sshc, myssh_conn_dtor))
+    return CURLE_OUT_OF_MEMORY;
+
+  sshp = curlx_calloc(1, sizeof(*sshp));
+  if(!sshp ||
+     Curl_meta_set(data, CURL_META_SSH_EASY, sshp, myssh_easy_dtor))
+    return CURLE_OUT_OF_MEMORY;
+
+  return CURLE_OK;
+}
+
+static Curl_recv scp_recv, sftp_recv;
+static Curl_send scp_send, sftp_send;
+
+/*
+ * Curl_ssh_connect() gets called from Curl_protocol_connect() to allow us to
+ * do protocol-specific actions at connect-time.
+ */
+static CURLcode myssh_connect(struct Curl_easy *data, bool *done)
+{
+  CURLcode result;
+  struct connectdata *conn = data->conn;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+  struct SSHPROTO *ssh = Curl_meta_get(data, CURL_META_SSH_EASY);
+  curl_socket_t sock = conn->sock[FIRSTSOCKET];
+  int rc;
+
+  if(!sshc || !ssh)
+    return CURLE_FAILED_INIT;
+
+  CURL_TRC_SSH(data, "myssh_connect");
+  if(conn->scheme->protocol & CURLPROTO_SCP) {
+    conn->recv[FIRSTSOCKET] = scp_recv;
+    conn->send[FIRSTSOCKET] = scp_send;
+  }
+  else {
+    conn->recv[FIRSTSOCKET] = sftp_recv;
+    conn->send[FIRSTSOCKET] = sftp_send;
+  }
+
+  sshc->ssh_session = ssh_new();
+  if(!sshc->ssh_session) {
+    failf(data, "Failure initializing ssh session");
+    return CURLE_FAILED_INIT;
+  }
+
+  rc = ssh_options_set(sshc->ssh_session, SSH_OPTIONS_HOST,
+                       (data->state.up.hostname[0] == '[') ?
+                       data->state.up.hostname : conn->origin->hostname);
+
+  if(rc != SSH_OK) {
+    failf(data, "Could not set remote host");
+    return CURLE_FAILED_INIT;
+  }
+
+  rc = ssh_options_parse_config(sshc->ssh_session, NULL);
+  if(rc != SSH_OK) {
+    infof(data, "Could not parse SSH configuration files");
+    /* ignore */
+  }
+
+  CURL_TRC_SSH(data, "myssh_connect, set socket=%" FMT_SOCKET_T, sock);
+  rc = ssh_options_set(sshc->ssh_session, SSH_OPTIONS_FD, &sock);
+  if(rc != SSH_OK) {
+    failf(data, "Could not set socket");
+    return CURLE_FAILED_INIT;
+  }
+
+  if(Curl_creds_has_user(conn->creds)) {
+    infof(data, "User: %s", conn->creds->user);
+    rc = ssh_options_set(sshc->ssh_session, SSH_OPTIONS_USER,
+                         conn->creds->user);
+    if(rc != SSH_OK) {
+      failf(data, "Could not set user");
+      return CURLE_FAILED_INIT;
+    }
+  }
+
+  if(data->set.str[STRING_SSH_KNOWNHOSTS]) {
+    infof(data, "Known hosts: %s", data->set.str[STRING_SSH_KNOWNHOSTS]);
+    rc = ssh_options_set(sshc->ssh_session, SSH_OPTIONS_KNOWNHOSTS,
+                         data->set.str[STRING_SSH_KNOWNHOSTS]);
+    if(rc == SSH_OK)
+      /* libssh has two separate options for this. Set both to the same file
+         to avoid surprises */
+      rc = ssh_options_set(sshc->ssh_session, SSH_OPTIONS_GLOBAL_KNOWNHOSTS,
+                           data->set.str[STRING_SSH_KNOWNHOSTS]);
+    if(rc != SSH_OK) {
+      failf(data, "Could not set known hosts file path");
+      return CURLE_FAILED_INIT;
+    }
+  }
+
+  if(conn->origin->port) {
+    rc = ssh_options_set(sshc->ssh_session, SSH_OPTIONS_PORT,
+                         &conn->origin->port);
+    if(rc != SSH_OK) {
+      failf(data, "Could not set remote port");
+      return CURLE_FAILED_INIT;
+    }
+  }
+
+  if(data->set.ssh_compression) {
+    rc = ssh_options_set(sshc->ssh_session, SSH_OPTIONS_COMPRESSION,
+                         "zlib,zlib@openssh.com,none");
+    if(rc != SSH_OK) {
+      failf(data, "Could not set compression");
+      return CURLE_FAILED_INIT;
+    }
+  }
+
+  sshc->privkey = NULL;
+  sshc->pubkey = NULL;
+
+  if(data->set.str[STRING_SSH_PUBLIC_KEY]) {
+    rc = ssh_pki_import_pubkey_file(data->set.str[STRING_SSH_PUBLIC_KEY],
+                                    &sshc->pubkey);
+    if(rc != SSH_OK) {
+      failf(data, "Could not load public key file");
+      return CURLE_FAILED_INIT;
+    }
+  }
+
+  /* we do not verify here, we do it at the state machine,
+   * after connection */
+
+  myssh_to(data, sshc, SSH_INIT);
+
+  result = myssh_multi_statemach(data, done);
+
+  return result;
+}
+
+/* called from multi.c while DOing */
+static CURLcode scp_doing(struct Curl_easy *data, bool *dophase_done)
+{
+  CURLcode result;
+
+  result = myssh_multi_statemach(data, dophase_done);
+
+  if(*dophase_done) {
+    CURL_TRC_SSH(data, "DO phase is complete");
+  }
+  return result;
+}
+
+/*
+ ***********************************************************************
+ *
+ * scp_perform()
+ *
+ * This is the actual DO function for SCP. Get a file according to
+ * the options previously setup.
+ */
+
+static CURLcode scp_perform(struct Curl_easy *data,
+                            bool *connected, bool *dophase_done)
+{
+  CURLcode result = CURLE_OK;
+  struct ssh_conn *sshc = Curl_conn_meta_get(data->conn, CURL_META_SSH_CONN);
+
+  CURL_TRC_SSH(data, "DO phase starts");
+
+  *dophase_done = FALSE;        /* not done yet */
+  if(!sshc)
+    return CURLE_FAILED_INIT;
+
+  /* start the first command in the DO phase */
+  myssh_to(data, sshc, SSH_SCP_TRANS_INIT);
+
+  result = myssh_multi_statemach(data, dophase_done);
+
+  *connected = Curl_conn_is_connected(data->conn, FIRSTSOCKET);
+
+  if(*dophase_done) {
+    CURL_TRC_SSH(data, "DO phase is complete");
+  }
+
+  return result;
+}
+
+/* BLOCKING, but the function is using the state machine so the only reason
+   this is still blocking is that the multi interface code has no support for
+   disconnecting operations that takes a while */
+static CURLcode scp_disconnect(struct Curl_easy *data,
+                               struct connectdata *conn,
+                               bool dead_connection)
+{
+  CURLcode result = CURLE_OK;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+  struct SSHPROTO *sshp = Curl_meta_get(data, CURL_META_SSH_EASY);
+  (void)dead_connection;
+
+  if(sshc && sshc->ssh_session) {
+    /* only if there is a session still around to use! */
+    myssh_to(data, sshc, SSH_SESSION_DISCONNECT);
+    result = myssh_block_statemach(data, sshc, sshp, TRUE);
+  }
+
+  return result;
+}
+
+/* generic done function for both SCP and SFTP called from their specific
+   done functions */
+static CURLcode myssh_done(struct Curl_easy *data,
+                           struct ssh_conn *sshc,
+                           CURLcode status)
+{
+  CURLcode result = CURLE_OK;
+  struct SSHPROTO *sshp = Curl_meta_get(data, CURL_META_SSH_EASY);
+
+  if(!status && sshp) {
+    /* run the state-machine */
+    result = myssh_block_statemach(data, sshc, sshp, FALSE);
+  }
+  else
+    result = status;
+
+  if(Curl_pgrsDone(data))
+    return CURLE_ABORTED_BY_CALLBACK;
+
+  CURL_REQ_CLEAR_IO(data);
+  return result;
+}
+
+static CURLcode scp_done(struct Curl_easy *data, CURLcode status,
+                         bool premature)
+{
+  struct ssh_conn *sshc = Curl_conn_meta_get(data->conn, CURL_META_SSH_CONN);
+  (void)premature;
+
+  if(!sshc)
+    return CURLE_FAILED_INIT;
+  if(!status)
+    myssh_to(data, sshc, SSH_SCP_DONE);
+
+  return myssh_done(data, sshc, status);
+}
+
+static CURLcode scp_send(struct Curl_easy *data, int sockindex,
+                         const uint8_t *mem, size_t len, bool eos,
+                         size_t *pnwritten)
+{
+  int rc;
+  struct connectdata *conn = data->conn;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+
+  (void)sockindex; /* we only support SCP on the fixed known primary socket */
+  (void)eos;
+  *pnwritten = 0;
+
+  if(!sshc)
+    return CURLE_FAILED_INIT;
+
+  rc = ssh_scp_write(sshc->scp_session, mem, len);
+
+#if 0
+  /* The following code is misleading, mostly added as wishful thinking
+   * that libssh at some point would implement non-blocking ssh_scp_write/read.
+   * Currently rc can only be number of bytes read or SSH_ERROR. */
+  myssh_block2waitfor(conn, sshc, (rc == SSH_AGAIN));
+
+  if(rc == SSH_AGAIN)
+    return CURLE_AGAIN;
+  else
+#endif
+  if(rc != SSH_OK)
+    return CURLE_SSH;
+
+  *pnwritten = len;
+  return CURLE_OK;
+}
+
+static CURLcode scp_recv(struct Curl_easy *data, int sockindex,
+                         char *mem, size_t len, size_t *pnread)
+{
+  struct connectdata *conn = data->conn;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+  int nread;
+
+  (void)sockindex; /* we only support SCP on the fixed known primary socket */
+  *pnread = 0;
+
+  if(!sshc)
+    return CURLE_FAILED_INIT;
+
+  /* libssh returns int */
+  nread = ssh_scp_read(sshc->scp_session, mem, len);
+  if(nread == SSH_ERROR)
+    return CURLE_SSH;
+#if 0
+  /* The following code is misleading, mostly added as wishful thinking
+   * that libssh at some point would implement non-blocking ssh_scp_write/read.
+   * Currently rc can only be SSH_OK or SSH_ERROR. */
+
+  myssh_block2waitfor(conn, sshc, (nread == SSH_AGAIN));
+  if(nread == SSH_AGAIN)
+    return CURLE_AGAIN;
+#endif
+  *pnread = (size_t)nread;
+  return CURLE_OK;
+}
+
+/*
+ * =============== SFTP ===============
+ */
+
+/*
+ ***********************************************************************
+ *
+ * sftp_perform()
+ *
+ * This is the actual DO function for SFTP. Get a file/directory according to
+ * the options previously setup.
+ */
+
+static CURLcode sftp_perform(struct Curl_easy *data,
+                             bool *connected,
+                             bool *dophase_done)
+{
+  struct ssh_conn *sshc = Curl_conn_meta_get(data->conn, CURL_META_SSH_CONN);
+  CURLcode result = CURLE_OK;
+
+  CURL_TRC_SSH(data, "DO phase starts");
+
+  *dophase_done = FALSE; /* not done yet */
+  if(!sshc)
+    return CURLE_FAILED_INIT;
+
+  /* start the first command in the DO phase */
+  myssh_to(data, sshc, SSH_SFTP_QUOTE_INIT);
+
+  /* run the state-machine */
+  result = myssh_multi_statemach(data, dophase_done);
+
+  *connected = Curl_conn_is_connected(data->conn, FIRSTSOCKET);
+
+  if(*dophase_done) {
+    CURL_TRC_SSH(data, "DO phase is complete");
+  }
+
+  return result;
+}
+
+/* called from multi.c while DOing */
+static CURLcode sftp_doing(struct Curl_easy *data,
+                           bool *dophase_done)
+{
+  CURLcode result = myssh_multi_statemach(data, dophase_done);
+  if(*dophase_done) {
+    CURL_TRC_SSH(data, "DO phase is complete");
+  }
+  return result;
+}
+
+/* BLOCKING, but the function is using the state machine so the only reason
+   this is still blocking is that the multi interface code has no support for
+   disconnecting operations that takes a while */
+static CURLcode sftp_disconnect(struct Curl_easy *data,
+                                struct connectdata *conn,
+                                bool dead_connection)
+{
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+  struct SSHPROTO *sshp = Curl_meta_get(data, CURL_META_SSH_EASY);
+  CURLcode result = CURLE_OK;
+  (void)dead_connection;
+
+  CURL_TRC_SSH(data, "DISCONNECT starts now");
+
+  if(sshc && sshc->ssh_session) {
+    /* only if there is a session still around to use! */
+    myssh_to(data, sshc, SSH_SFTP_SHUTDOWN);
+    result = myssh_block_statemach(data, sshc, sshp, TRUE);
+  }
+
+  CURL_TRC_SSH(data, "DISCONNECT is done");
+  return result;
+}
+
+static CURLcode sftp_done(struct Curl_easy *data, CURLcode status,
+                          bool premature)
+{
+  struct connectdata *conn = data->conn;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+
+  if(!sshc)
+    return CURLE_FAILED_INIT;
+  if(!status) {
+    /* Post quote commands are executed after the SFTP_CLOSE state to avoid
+       errors that could happen due to open file handles during POSTQUOTE
+       operation */
+    if(!premature && data->set.postquote && !conn->bits.retry)
+      sshc->nextstate = SSH_SFTP_POSTQUOTE_INIT;
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
+  }
+  return myssh_done(data, sshc, status);
+}
+
+/* return number of sent bytes */
+static CURLcode sftp_send(struct Curl_easy *data, int sockindex,
+                          const uint8_t *mem, size_t len, bool eos,
+                          size_t *pnwritten)
+{
+  struct connectdata *conn = data->conn;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+  ssize_t nwrite;
+
+  (void)sockindex;
+  (void)eos;
+  *pnwritten = 0;
+
+  if(!sshc)
+    return CURLE_FAILED_INIT;
+
+#if LIBSSH_VERSION_INT > SSH_VERSION_INT(0, 11, 0)
+  switch(sshc->sftp_send_state) {
+  case 0:
+    sftp_file_set_nonblocking(sshc->sftp_file);
+    if(sftp_aio_begin_write(sshc->sftp_file, mem, len,
+                            &sshc->sftp_send_aio) == SSH_ERROR) {
+      return CURLE_SEND_ERROR;
+    }
+    sshc->sftp_send_state = 1;
+    FALLTHROUGH();
+  case 1:
+    nwrite = sftp_aio_wait_write(&sshc->sftp_send_aio);
+    myssh_block2waitfor(conn, sshc, (nwrite == SSH_AGAIN) ? TRUE : FALSE);
+    if(nwrite == SSH_AGAIN)
+      return CURLE_AGAIN;
+    else if(nwrite < 0)
+      return CURLE_SEND_ERROR;
+
+    /*
+     * sftp_aio_wait_write() would free sftp_send_aio and
+     * assign it NULL in all cases except when it returns
+     * SSH_AGAIN.
+     */
+
+    sshc->sftp_send_state = 0;
+    *pnwritten = (size_t)nwrite;
+    return CURLE_OK;
+  default:
+    /* we never reach here */
+    return CURLE_SEND_ERROR;
+  }
+#else
+  /*
+   * limit the writes to the maximum specified in Section 3 of
+   * https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-02
+   *
+   * libssh started applying appropriate read/write length limits
+   * internally since version 0.11.0, hence such an operation is
+   * not needed for versions after (and including) 0.11.0.
+   */
+  if(len > 32768)
+    len = 32768;
+
+  nwrite = sftp_write(sshc->sftp_file, mem, len);
+
+  myssh_block2waitfor(conn, sshc, FALSE);
+
+#if 0 /* not returned by libssh on write */
+  if(nwrite == SSH_AGAIN) {
+    *err = CURLE_AGAIN;
+    nwrite = 0;
+  }
+  else
+#endif
+  if(nwrite < 0)
+    return CURLE_SSH;
+
+  *pnwritten = (size_t)nwrite;
+  return CURLE_OK;
+#endif
+}
+
+/*
+ * Return number of received (decrypted) bytes
+ * or <0 on error
+ */
+static CURLcode sftp_recv(struct Curl_easy *data, int sockindex,
+                          char *mem, size_t len, size_t *pnread)
+{
+  struct connectdata *conn = data->conn;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+  ssize_t nread;
+
+  (void)sockindex;
+  *pnread = 0;
+
+  DEBUGASSERT(len < CURL_MAX_READ_SIZE);
+  if(!sshc)
+    return CURLE_FAILED_INIT;
+
+  switch(sshc->sftp_recv_state) {
+  case 0:
+#if LIBSSH_VERSION_INT > SSH_VERSION_INT(0, 11, 0)
+    if(sftp_aio_begin_read(sshc->sftp_file, len,
+                           &sshc->sftp_recv_aio) == SSH_ERROR) {
+      return CURLE_RECV_ERROR;
+    }
+#else
+    sshc->sftp_file_index =
+      sftp_async_read_begin(sshc->sftp_file, (uint32_t)len);
+    if(sshc->sftp_file_index < 0)
+      return CURLE_RECV_ERROR;
+#endif
+
+    FALLTHROUGH();
+  case 1:
+    sshc->sftp_recv_state = 1;
+
+#if LIBSSH_VERSION_INT > SSH_VERSION_INT(0, 11, 0)
+    nread = sftp_aio_wait_read(&sshc->sftp_recv_aio, mem, len);
+#else
+    nread = sftp_async_read(sshc->sftp_file, mem, (uint32_t)len,
+                            (uint32_t)sshc->sftp_file_index);
+#endif
+
+    myssh_block2waitfor(conn, sshc, (nread == SSH_AGAIN));
+
+    if(nread == SSH_AGAIN)
+      return CURLE_AGAIN;
+    else if(nread < 0)
+      return CURLE_RECV_ERROR;
+
+    /*
+     * sftp_aio_wait_read() would free sftp_recv_aio and
+     * assign it NULL in all cases except when it returns
+     * SSH_AGAIN.
+     */
+
+    sshc->sftp_recv_state = 0;
+    *pnread = (size_t)nread;
+    return CURLE_OK;
+
+  default:
+    /* we never reach here */
+    return CURLE_RECV_ERROR;
+  }
+}
+
+static CURLcode myssh_do_it(struct Curl_easy *data, bool *done)
+{
+  CURLcode result;
+  bool connected = FALSE;
+  struct connectdata *conn = data->conn;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+
+  *done = FALSE;                /* default to false */
+  if(!sshc)
+    return CURLE_FAILED_INIT;
+
+  data->req.size = -1;          /* make sure this is unknown at this point */
+
+  sshc->actualcode = CURLE_OK;  /* reset error code */
+  sshc->secondCreateDirs = 0;   /* reset the create directory attempt state
+                                   variable */
+
+  Curl_pgrsReset(data);
+
+  if(conn->scheme->protocol & CURLPROTO_SCP)
+    result = scp_perform(data, &connected, done);
+  else
+    result = sftp_perform(data, &connected, done);
+
+  return result;
 }
 
 CURLcode Curl_ssh_init(void)
 {
   if(ssh_init()) {
-    DEBUGF(fprintf(stderr, "Error: libssh_init failed\n"));
+    DEBUGF(curl_mfprintf(stderr, "Error: libssh_init failed\n"));
     return CURLE_FAILED_INIT;
   }
   return CURLE_OK;
@@ -2950,7 +3154,53 @@ void Curl_ssh_cleanup(void)
 
 void Curl_ssh_version(char *buffer, size_t buflen)
 {
-  (void)msnprintf(buffer, buflen, "libssh/%s", ssh_version(0));
+  (void)curl_msnprintf(buffer, buflen, "libssh/%s", ssh_version(0));
 }
 
-#endif                          /* USE_LIBSSH */
+/*
+ * SCP.
+ */
+const struct Curl_protocol Curl_protocol_scp = {
+  myssh_setup_connection,               /* setup_connection */
+  myssh_do_it,                          /* do_it */
+  scp_done,                             /* done */
+  ZERO_NULL,                            /* do_more */
+  myssh_connect,                        /* connect_it */
+  myssh_multi_statemach,                /* connecting */
+  scp_doing,                            /* doing */
+  myssh_pollset,                        /* proto_pollset */
+  myssh_pollset,                        /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  myssh_pollset,                        /* perform_pollset */
+  scp_disconnect,                       /* disconnect */
+  ZERO_NULL,                            /* write_resp */
+  ZERO_NULL,                            /* write_resp_hd */
+  ZERO_NULL,                            /* connection_is_dead */
+  ZERO_NULL,                            /* attach connection */
+  ZERO_NULL,                            /* follow */
+};
+
+/*
+ * SFTP.
+ */
+const struct Curl_protocol Curl_protocol_sftp = {
+  myssh_setup_connection,               /* setup_connection */
+  myssh_do_it,                          /* do_it */
+  sftp_done,                            /* done */
+  ZERO_NULL,                            /* do_more */
+  myssh_connect,                        /* connect_it */
+  myssh_multi_statemach,                /* connecting */
+  sftp_doing,                           /* doing */
+  myssh_pollset,                        /* proto_pollset */
+  myssh_pollset,                        /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  myssh_pollset,                        /* perform_pollset */
+  sftp_disconnect,                      /* disconnect */
+  ZERO_NULL,                            /* write_resp */
+  ZERO_NULL,                            /* write_resp_hd */
+  ZERO_NULL,                            /* connection_is_dead */
+  ZERO_NULL,                            /* attach connection */
+  ZERO_NULL,                            /* follow */
+};
+
+#endif /* USE_LIBSSH */
diff --git a/third-party/curl/lib/vssh/libssh2.c b/third-party/curl/lib/vssh/libssh2.c
index 37040b4b77..b12d69f317 100644
--- a/third-party/curl/lib/vssh/libssh2.c
+++ b/third-party/curl/lib/vssh/libssh2.c
@@ -21,21 +21,11 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
-/* #define CURL_LIBSSH2_DEBUG */
-
 #include "curl_setup.h"
 
 #ifdef USE_LIBSSH2
 
-#include <limits.h>
-
-#include <libssh2.h>
-#include <libssh2_sftp.h>
-
-#ifdef HAVE_FCNTL_H
-#include <fcntl.h>
-#endif
+/* #define CURL_LIBSSH2_DEBUG */
 
 #ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
@@ -51,157 +41,118 @@
 #include <inet.h>
 #endif
 
-#include <curl/curl.h>
 #include "urldata.h"
 #include "sendf.h"
+#include "curl_trc.h"
 #include "hostip.h"
 #include "progress.h"
 #include "transfer.h"
-#include "escape.h"
-#include "http.h" /* for HTTP proxy tunnel stuff */
-#include "ssh.h"
+#include "vssh/ssh.h"
 #include "url.h"
-#include "speedcheck.h"
-#include "getinfo.h"
-#include "strdup.h"
-#include "strcase.h"
-#include "vtls/vtls.h"
 #include "cfilters.h"
 #include "connect.h"
-#include "inet_ntop.h"
 #include "parsedate.h" /* for the week day and month names */
-#include "sockaddr.h" /* required for Curl_sockaddr_storage */
-#include "strtoofft.h"
 #include "multiif.h"
 #include "select.h"
-#include "warnless.h"
-#include "curl_path.h"
+#include "curlx/fopen.h"
+#include "vssh/vssh.h"
+#include "curlx/strparse.h"
+#include "curlx/base64.h" /* for curlx_base64_encode() */
 
-#include <curl_base64.h> /* for base64 encoding/decoding */
-#include <curl_sha256.h>
+static const char *sftp_libssh2_strerror(unsigned long err)
+{
+  switch(err) {
+  case LIBSSH2_FX_NO_SUCH_FILE:
+    return "No such file or directory";
 
+  case LIBSSH2_FX_PERMISSION_DENIED:
+    return "Permission denied";
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+  case LIBSSH2_FX_FAILURE:
+    return "Operation failed";
 
-#if LIBSSH2_VERSION_NUM >= 0x010206
-/* libssh2_sftp_statvfs and friends were added in 1.2.6 */
-#define HAS_STATVFS_SUPPORT 1
-#endif
+  case LIBSSH2_FX_BAD_MESSAGE:
+    return "Bad message from SFTP server";
 
-#define sftp_libssh2_realpath(s,p,t,m)                          \
-  libssh2_sftp_symlink_ex((s), (p), curlx_uztoui(strlen(p)),    \
-                          (t), (m), LIBSSH2_SFTP_REALPATH)
+  case LIBSSH2_FX_NO_CONNECTION:
+    return "Not connected to SFTP server";
 
-/* Local functions: */
-static const char *sftp_libssh2_strerror(unsigned long err);
-static LIBSSH2_ALLOC_FUNC(my_libssh2_malloc);
-static LIBSSH2_REALLOC_FUNC(my_libssh2_realloc);
-static LIBSSH2_FREE_FUNC(my_libssh2_free);
-static CURLcode ssh_force_knownhost_key_type(struct Curl_easy *data);
-static CURLcode ssh_connect(struct Curl_easy *data, bool *done);
-static CURLcode ssh_multi_statemach(struct Curl_easy *data, bool *done);
-static CURLcode ssh_do(struct Curl_easy *data, bool *done);
-static CURLcode scp_done(struct Curl_easy *data, CURLcode c, bool premature);
-static CURLcode scp_doing(struct Curl_easy *data, bool *dophase_done);
-static CURLcode scp_disconnect(struct Curl_easy *data,
-                               struct connectdata *conn, bool dead_connection);
-static CURLcode sftp_done(struct Curl_easy *data, CURLcode, bool premature);
-static CURLcode sftp_doing(struct Curl_easy *data, bool *dophase_done);
-static CURLcode sftp_disconnect(struct Curl_easy *data,
-                                struct connectdata *conn, bool dead);
-static CURLcode sftp_perform(struct Curl_easy *data, bool *connected,
-                             bool *dophase_done);
-static int ssh_getsock(struct Curl_easy *data, struct connectdata *conn,
-                       curl_socket_t *sock);
-static CURLcode ssh_setup_connection(struct Curl_easy *data,
-                                     struct connectdata *conn);
-static void ssh_attach(struct Curl_easy *data, struct connectdata *conn);
+  case LIBSSH2_FX_CONNECTION_LOST:
+    return "Connection to SFTP server lost";
 
-/*
- * SCP protocol handler.
- */
+  case LIBSSH2_FX_OP_UNSUPPORTED:
+    return "Operation not supported by SFTP server";
 
-const struct Curl_handler Curl_handler_scp = {
-  "SCP",                                /* scheme */
-  ssh_setup_connection,                 /* setup_connection */
-  ssh_do,                               /* do_it */
-  scp_done,                             /* done */
-  ZERO_NULL,                            /* do_more */
-  ssh_connect,                          /* connect_it */
-  ssh_multi_statemach,                  /* connecting */
-  scp_doing,                            /* doing */
-  ssh_getsock,                          /* proto_getsock */
-  ssh_getsock,                          /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ssh_getsock,                          /* perform_getsock */
-  scp_disconnect,                       /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ssh_attach,                           /* attach */
-  PORT_SSH,                             /* defport */
-  CURLPROTO_SCP,                        /* protocol */
-  CURLPROTO_SCP,                        /* family */
-  PROTOPT_DIRLOCK | PROTOPT_CLOSEACTION
-  | PROTOPT_NOURLQUERY                  /* flags */
-};
+  case LIBSSH2_FX_INVALID_HANDLE:
+    return "Invalid handle";
 
+  case LIBSSH2_FX_NO_SUCH_PATH:
+    return "No such file or directory";
 
-/*
- * SFTP protocol handler.
- */
+  case LIBSSH2_FX_FILE_ALREADY_EXISTS:
+    return "File already exists";
 
-const struct Curl_handler Curl_handler_sftp = {
-  "SFTP",                               /* scheme */
-  ssh_setup_connection,                 /* setup_connection */
-  ssh_do,                               /* do_it */
-  sftp_done,                            /* done */
-  ZERO_NULL,                            /* do_more */
-  ssh_connect,                          /* connect_it */
-  ssh_multi_statemach,                  /* connecting */
-  sftp_doing,                           /* doing */
-  ssh_getsock,                          /* proto_getsock */
-  ssh_getsock,                          /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ssh_getsock,                          /* perform_getsock */
-  sftp_disconnect,                      /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ssh_attach,                           /* attach */
-  PORT_SSH,                             /* defport */
-  CURLPROTO_SFTP,                       /* protocol */
-  CURLPROTO_SFTP,                       /* family */
-  PROTOPT_DIRLOCK | PROTOPT_CLOSEACTION
-  | PROTOPT_NOURLQUERY                  /* flags */
-};
+  case LIBSSH2_FX_WRITE_PROTECT:
+    return "File is write protected";
 
-static void
-kbd_callback(const char *name, int name_len, const char *instruction,
-             int instruction_len, int num_prompts,
-             const LIBSSH2_USERAUTH_KBDINT_PROMPT *prompts,
-             LIBSSH2_USERAUTH_KBDINT_RESPONSE *responses,
-             void **abstract)
+  case LIBSSH2_FX_NO_MEDIA:
+    return "No media";
+
+  case LIBSSH2_FX_NO_SPACE_ON_FILESYSTEM:
+    return "Disk full";
+
+  case LIBSSH2_FX_QUOTA_EXCEEDED:
+    return "User quota exceeded";
+
+  case LIBSSH2_FX_UNKNOWN_PRINCIPAL:
+    return "Unknown principal";
+
+  case LIBSSH2_FX_LOCK_CONFLICT:
+    return "File lock conflict";
+
+  case LIBSSH2_FX_DIR_NOT_EMPTY:
+    return "Directory not empty";
+
+  case LIBSSH2_FX_NOT_A_DIRECTORY:
+    return "Not a directory";
+
+  case LIBSSH2_FX_INVALID_FILENAME:
+    return "Invalid filename";
+
+  case LIBSSH2_FX_LINK_LOOP:
+    return "Link points to itself";
+  }
+  return "Unknown error in libssh2";
+}
+
+static void kbd_callback(const char *name, int name_len,
+                         const char *instruction, int instruction_len,
+                         int num_prompts,
+                         const LIBSSH2_USERAUTH_KBDINT_PROMPT *prompts,
+                         LIBSSH2_USERAUTH_KBDINT_RESPONSE *responses,
+                         void **abstract)
 {
   struct Curl_easy *data = (struct Curl_easy *)*abstract;
 
 #ifdef CURL_LIBSSH2_DEBUG
-  fprintf(stderr, "name=%s\n", name);
-  fprintf(stderr, "name_len=%d\n", name_len);
-  fprintf(stderr, "instruction=%s\n", instruction);
-  fprintf(stderr, "instruction_len=%d\n", instruction_len);
-  fprintf(stderr, "num_prompts=%d\n", num_prompts);
+  curl_mfprintf(stderr, "name=%s\n", name);
+  curl_mfprintf(stderr, "name_len=%d\n", name_len);
+  curl_mfprintf(stderr, "instruction=%s\n", instruction);
+  curl_mfprintf(stderr, "instruction_len=%d\n", instruction_len);
+  curl_mfprintf(stderr, "num_prompts=%d\n", num_prompts);
 #else
   (void)name;
   (void)name_len;
   (void)instruction;
   (void)instruction_len;
-#endif  /* CURL_LIBSSH2_DEBUG */
+#endif /* CURL_LIBSSH2_DEBUG */
   if(num_prompts == 1) {
     struct connectdata *conn = data->conn;
-    responses[0].text = strdup(conn->passwd);
-    responses[0].length = curlx_uztoui(strlen(conn->passwd));
+    const char *passwd = Curl_creds_passwd(conn->creds);
+    /* this function must allocate memory that can be freed by libssh2, which
+       uses the LIBSSH2_FREE_FUNC callback */
+    responses[0].text = Curl_cstrdup(passwd);
+    responses[0].length = responses[0].text ? curlx_uztoui(strlen(passwd)) : 0;
   }
   (void)prompts;
 } /* kbd_callback */
@@ -209,30 +160,30 @@ kbd_callback(const char *name, int name_len, const char *instruction,
 static CURLcode sftp_libssh2_error_to_CURLE(unsigned long err)
 {
   switch(err) {
-    case LIBSSH2_FX_OK:
-      return CURLE_OK;
+  case LIBSSH2_FX_OK:
+    return CURLE_OK;
 
-    case LIBSSH2_FX_NO_SUCH_FILE:
-    case LIBSSH2_FX_NO_SUCH_PATH:
-      return CURLE_REMOTE_FILE_NOT_FOUND;
+  case LIBSSH2_FX_NO_SUCH_FILE:
+  case LIBSSH2_FX_NO_SUCH_PATH:
+    return CURLE_REMOTE_FILE_NOT_FOUND;
 
-    case LIBSSH2_FX_PERMISSION_DENIED:
-    case LIBSSH2_FX_WRITE_PROTECT:
-    case LIBSSH2_FX_LOCK_CONFlICT:
-      return CURLE_REMOTE_ACCESS_DENIED;
+  case LIBSSH2_FX_PERMISSION_DENIED:
+  case LIBSSH2_FX_WRITE_PROTECT:
+  case LIBSSH2_FX_LOCK_CONFLICT:
+    return CURLE_REMOTE_ACCESS_DENIED;
 
-    case LIBSSH2_FX_NO_SPACE_ON_FILESYSTEM:
-    case LIBSSH2_FX_QUOTA_EXCEEDED:
-      return CURLE_REMOTE_DISK_FULL;
+  case LIBSSH2_FX_NO_SPACE_ON_FILESYSTEM:
+  case LIBSSH2_FX_QUOTA_EXCEEDED:
+    return CURLE_REMOTE_DISK_FULL;
 
-    case LIBSSH2_FX_FILE_ALREADY_EXISTS:
-      return CURLE_REMOTE_FILE_EXISTS;
+  case LIBSSH2_FX_FILE_ALREADY_EXISTS:
+    return CURLE_REMOTE_FILE_EXISTS;
 
-    case LIBSSH2_FX_DIR_NOT_EMPTY:
-      return CURLE_QUOTE_ERROR;
+  case LIBSSH2_FX_DIR_NOT_EMPTY:
+    return CURLE_QUOTE_ERROR;
 
-    default:
-      break;
+  default:
+    break;
   }
 
   return CURLE_SSH;
@@ -241,151 +192,68 @@ static CURLcode sftp_libssh2_error_to_CURLE(unsigned long err)
 static CURLcode libssh2_session_error_to_CURLE(int err)
 {
   switch(err) {
-    /* Ordered by order of appearance in libssh2.h */
-    case LIBSSH2_ERROR_NONE:
-      return CURLE_OK;
+  /* Ordered by order of appearance in libssh2.h */
+  case LIBSSH2_ERROR_NONE:
+    return CURLE_OK;
 
-    /* This is the error returned by libssh2_scp_recv2
-     * on unknown file */
-    case LIBSSH2_ERROR_SCP_PROTOCOL:
-      return CURLE_REMOTE_FILE_NOT_FOUND;
+  /* This is the error returned by libssh2_scp_recv2
+   * on unknown file */
+  case LIBSSH2_ERROR_SCP_PROTOCOL:
+    return CURLE_REMOTE_FILE_NOT_FOUND;
 
-    case LIBSSH2_ERROR_SOCKET_NONE:
-      return CURLE_COULDNT_CONNECT;
+  case LIBSSH2_ERROR_SOCKET_NONE:
+    return CURLE_COULDNT_CONNECT;
 
-    case LIBSSH2_ERROR_ALLOC:
-      return CURLE_OUT_OF_MEMORY;
+  case LIBSSH2_ERROR_ALLOC:
+    return CURLE_OUT_OF_MEMORY;
 
-    case LIBSSH2_ERROR_SOCKET_SEND:
-      return CURLE_SEND_ERROR;
+  case LIBSSH2_ERROR_SOCKET_SEND:
+    return CURLE_SEND_ERROR;
 
-    case LIBSSH2_ERROR_HOSTKEY_INIT:
-    case LIBSSH2_ERROR_HOSTKEY_SIGN:
-    case LIBSSH2_ERROR_PUBLICKEY_UNRECOGNIZED:
-    case LIBSSH2_ERROR_PUBLICKEY_UNVERIFIED:
-      return CURLE_PEER_FAILED_VERIFICATION;
+  case LIBSSH2_ERROR_HOSTKEY_INIT:
+  case LIBSSH2_ERROR_HOSTKEY_SIGN:
+  case LIBSSH2_ERROR_PUBLICKEY_UNRECOGNIZED:
+  case LIBSSH2_ERROR_PUBLICKEY_UNVERIFIED:
+    return CURLE_PEER_FAILED_VERIFICATION;
 
-    case LIBSSH2_ERROR_PASSWORD_EXPIRED:
-      return CURLE_LOGIN_DENIED;
+  case LIBSSH2_ERROR_PASSWORD_EXPIRED:
+    return CURLE_LOGIN_DENIED;
 
-    case LIBSSH2_ERROR_SOCKET_TIMEOUT:
-    case LIBSSH2_ERROR_TIMEOUT:
-      return CURLE_OPERATION_TIMEDOUT;
+  case LIBSSH2_ERROR_SOCKET_TIMEOUT:
+  case LIBSSH2_ERROR_TIMEOUT:
+    return CURLE_OPERATION_TIMEDOUT;
 
-    case LIBSSH2_ERROR_EAGAIN:
-      return CURLE_AGAIN;
+  case LIBSSH2_ERROR_EAGAIN:
+    return CURLE_AGAIN;
   }
 
   return CURLE_SSH;
 }
 
+/* These functions are made to use the libcurl memory functions - NOT the
+   debugmem functions, as that leads us to trigger on libssh2 memory leaks
+   that are not ours to care for */
+
 static LIBSSH2_ALLOC_FUNC(my_libssh2_malloc)
 {
-  (void)abstract; /* arg not used */
-  return malloc(count);
+  (void)abstract;
+  return Curl_cmalloc(count);
 }
 
 static LIBSSH2_REALLOC_FUNC(my_libssh2_realloc)
 {
-  (void)abstract; /* arg not used */
-  return realloc(ptr, count);
+  (void)abstract;
+  return Curl_crealloc(ptr, count);
 }
 
 static LIBSSH2_FREE_FUNC(my_libssh2_free)
 {
-  (void)abstract; /* arg not used */
+  (void)abstract;
   if(ptr) /* ssh2 agent sometimes call free with null ptr */
-    free(ptr);
+    Curl_cfree(ptr);
 }
 
-/*
- * SSH State machine related code
- */
-/* This is the ONLY way to change SSH state! */
-static void state(struct Curl_easy *data, sshstate nowstate)
-{
-  struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
-  /* for debug purposes */
-  static const char * const names[] = {
-    "SSH_STOP",
-    "SSH_INIT",
-    "SSH_S_STARTUP",
-    "SSH_HOSTKEY",
-    "SSH_AUTHLIST",
-    "SSH_AUTH_PKEY_INIT",
-    "SSH_AUTH_PKEY",
-    "SSH_AUTH_PASS_INIT",
-    "SSH_AUTH_PASS",
-    "SSH_AUTH_AGENT_INIT",
-    "SSH_AUTH_AGENT_LIST",
-    "SSH_AUTH_AGENT",
-    "SSH_AUTH_HOST_INIT",
-    "SSH_AUTH_HOST",
-    "SSH_AUTH_KEY_INIT",
-    "SSH_AUTH_KEY",
-    "SSH_AUTH_GSSAPI",
-    "SSH_AUTH_DONE",
-    "SSH_SFTP_INIT",
-    "SSH_SFTP_REALPATH",
-    "SSH_SFTP_QUOTE_INIT",
-    "SSH_SFTP_POSTQUOTE_INIT",
-    "SSH_SFTP_QUOTE",
-    "SSH_SFTP_NEXT_QUOTE",
-    "SSH_SFTP_QUOTE_STAT",
-    "SSH_SFTP_QUOTE_SETSTAT",
-    "SSH_SFTP_QUOTE_SYMLINK",
-    "SSH_SFTP_QUOTE_MKDIR",
-    "SSH_SFTP_QUOTE_RENAME",
-    "SSH_SFTP_QUOTE_RMDIR",
-    "SSH_SFTP_QUOTE_UNLINK",
-    "SSH_SFTP_QUOTE_STATVFS",
-    "SSH_SFTP_GETINFO",
-    "SSH_SFTP_FILETIME",
-    "SSH_SFTP_TRANS_INIT",
-    "SSH_SFTP_UPLOAD_INIT",
-    "SSH_SFTP_CREATE_DIRS_INIT",
-    "SSH_SFTP_CREATE_DIRS",
-    "SSH_SFTP_CREATE_DIRS_MKDIR",
-    "SSH_SFTP_READDIR_INIT",
-    "SSH_SFTP_READDIR",
-    "SSH_SFTP_READDIR_LINK",
-    "SSH_SFTP_READDIR_BOTTOM",
-    "SSH_SFTP_READDIR_DONE",
-    "SSH_SFTP_DOWNLOAD_INIT",
-    "SSH_SFTP_DOWNLOAD_STAT",
-    "SSH_SFTP_CLOSE",
-    "SSH_SFTP_SHUTDOWN",
-    "SSH_SCP_TRANS_INIT",
-    "SSH_SCP_UPLOAD_INIT",
-    "SSH_SCP_DOWNLOAD_INIT",
-    "SSH_SCP_DOWNLOAD",
-    "SSH_SCP_DONE",
-    "SSH_SCP_SEND_EOF",
-    "SSH_SCP_WAIT_EOF",
-    "SSH_SCP_WAIT_CLOSE",
-    "SSH_SCP_CHANNEL_FREE",
-    "SSH_SESSION_DISCONNECT",
-    "SSH_SESSION_FREE",
-    "QUIT"
-  };
-
-  /* a precaution to make sure the lists are in sync */
-  DEBUGASSERT(sizeof(names)/sizeof(names[0]) == SSH_LAST);
-
-  if(sshc->state != nowstate) {
-    infof(data, "SFTP %p state change from %s to %s",
-          (void *)sshc, names[sshc->state], names[nowstate]);
-  }
-#endif
-
-  sshc->state = nowstate;
-}
-
-
-#ifdef HAVE_LIBSSH2_KNOWNHOST_API
-static int sshkeycallback(struct Curl_easy *easy,
+static int sshkeycallback(CURL *easy,
                           const struct curl_khkey *knownkey, /* known */
                           const struct curl_khkey *foundkey, /* found */
                           enum curl_khmatch match,
@@ -397,49 +265,21 @@ static int sshkeycallback(struct Curl_easy *easy,
   (void)clientp;
 
   /* we only allow perfect matches, and we reject everything else */
-  return (match != CURLKHMATCH_OK)?CURLKHSTAT_REJECT:CURLKHSTAT_FINE;
+  return (match != CURLKHMATCH_OK) ? CURLKHSTAT_REJECT : CURLKHSTAT_FINE;
 }
-#endif
 
-/*
- * Earlier libssh2 versions didn't have the ability to seek to 64bit positions
- * with 32bit size_t.
- */
-#ifdef HAVE_LIBSSH2_SFTP_SEEK64
-#define SFTP_SEEK(x,y) libssh2_sftp_seek64(x, (libssh2_uint64_t)y)
-#else
-#define SFTP_SEEK(x,y) libssh2_sftp_seek(x, (size_t)y)
-#endif
-
-/*
- * Earlier libssh2 versions didn't do SCP properly beyond 32bit sizes on 32bit
- * architectures so we check of the necessary function is present.
- */
-#ifndef HAVE_LIBSSH2_SCP_SEND64
-#define SCP_SEND(a,b,c,d) libssh2_scp_send_ex(a, b, (int)(c), (size_t)d, 0, 0)
-#else
-#define SCP_SEND(a,b,c,d) libssh2_scp_send64(a, b, (int)(c),            \
-                                             (libssh2_uint64_t)d, 0, 0)
-#endif
-
-/*
- * libssh2 1.2.8 fixed the problem with 32bit ints used for sockets on win64.
- */
-#ifdef HAVE_LIBSSH2_SESSION_HANDSHAKE
-#define session_startup(x,y) libssh2_session_handshake(x, y)
-#else
-#define session_startup(x,y) libssh2_session_startup(x, (int)y)
-#endif
-static int convert_ssh2_keytype(int sshkeytype)
+static enum curl_khtype convert_ssh2_keytype(int sshkeytype)
 {
-  int keytype = CURLKHTYPE_UNKNOWN;
+  enum curl_khtype keytype = CURLKHTYPE_UNKNOWN;
   switch(sshkeytype) {
   case LIBSSH2_HOSTKEY_TYPE_RSA:
     keytype = CURLKHTYPE_RSA;
     break;
-  case LIBSSH2_HOSTKEY_TYPE_DSS:
+#ifdef LIBSSH2_HOSTKEY_TYPE_DSS
+  case LIBSSH2_HOSTKEY_TYPE_DSS:  /* deprecated upstream */
     keytype = CURLKHTYPE_DSS;
     break;
+#endif
 #ifdef LIBSSH2_HOSTKEY_TYPE_ECDSA_256
   case LIBSSH2_HOSTKEY_TYPE_ECDSA_256:
     keytype = CURLKHTYPE_ECDSA;
@@ -464,160 +304,157 @@ static int convert_ssh2_keytype(int sshkeytype)
   return keytype;
 }
 
-static CURLcode ssh_knownhost(struct Curl_easy *data)
+static CURLcode ssh_knownhost(struct Curl_easy *data,
+                              struct ssh_conn *sshc)
 {
+  struct connectdata *conn = data->conn;
+  struct libssh2_knownhost *host = NULL;
+  const char *remotekey = NULL;
+  int keycheck = LIBSSH2_KNOWNHOST_CHECK_FAILURE;
+  int keybit = 0;
   int sshkeytype = 0;
   size_t keylen = 0;
   int rc = 0;
   CURLcode result = CURLE_OK;
 
-#ifdef HAVE_LIBSSH2_KNOWNHOST_API
-  if(data->set.str[STRING_SSH_KNOWNHOSTS]) {
-    /* we're asked to verify the host against a file */
-    struct connectdata *conn = data->conn;
-    struct ssh_conn *sshc = &conn->proto.sshc;
-    struct libssh2_knownhost *host = NULL;
-    const char *remotekey = libssh2_session_hostkey(sshc->ssh_session,
-                                                    &keylen, &sshkeytype);
-    int keycheck = LIBSSH2_KNOWNHOST_CHECK_FAILURE;
-    int keybit = 0;
+  if(!data->set.str[STRING_SSH_KNOWNHOSTS]) {
+    infof(data, "SSH: no knownhosts file configured");
+    return CURLE_OK;
+  }
 
-    if(remotekey) {
-      /*
-       * A subject to figure out is what host name we need to pass in here.
-       * What host name does OpenSSH store in its file if an IDN name is
-       * used?
-       */
-      enum curl_khmatch keymatch;
-      curl_sshkeycallback func =
-        data->set.ssh_keyfunc ? data->set.ssh_keyfunc : sshkeycallback;
-      struct curl_khkey knownkey;
-      struct curl_khkey *knownkeyp = NULL;
-      struct curl_khkey foundkey;
+  remotekey = libssh2_session_hostkey(sshc->ssh_session,
+                                      &keylen, &sshkeytype);
+  if(remotekey) {
+    /*
+     * A subject to figure out is what hostname we need to pass in here.
+     * What hostname does OpenSSH store in its file if an IDN name is
+     * used?
+     */
+    enum curl_khmatch keymatch;
+    curl_sshkeycallback func =
+      data->set.ssh_keyfunc ? data->set.ssh_keyfunc : sshkeycallback;
+    struct curl_khkey knownkey;
+    struct curl_khkey *knownkeyp = NULL;
+    struct curl_khkey foundkey;
 
-      switch(sshkeytype) {
-      case LIBSSH2_HOSTKEY_TYPE_RSA:
-        keybit = LIBSSH2_KNOWNHOST_KEY_SSHRSA;
-        break;
-      case LIBSSH2_HOSTKEY_TYPE_DSS:
-        keybit = LIBSSH2_KNOWNHOST_KEY_SSHDSS;
-        break;
-#ifdef LIBSSH2_HOSTKEY_TYPE_ECDSA_256
-      case LIBSSH2_HOSTKEY_TYPE_ECDSA_256:
-        keybit = LIBSSH2_KNOWNHOST_KEY_ECDSA_256;
-        break;
-#endif
-#ifdef LIBSSH2_HOSTKEY_TYPE_ECDSA_384
-      case LIBSSH2_HOSTKEY_TYPE_ECDSA_384:
-        keybit = LIBSSH2_KNOWNHOST_KEY_ECDSA_384;
-        break;
-#endif
-#ifdef LIBSSH2_HOSTKEY_TYPE_ECDSA_521
-      case LIBSSH2_HOSTKEY_TYPE_ECDSA_521:
-        keybit = LIBSSH2_KNOWNHOST_KEY_ECDSA_521;
-        break;
-#endif
-#ifdef LIBSSH2_HOSTKEY_TYPE_ED25519
-      case LIBSSH2_HOSTKEY_TYPE_ED25519:
-        keybit = LIBSSH2_KNOWNHOST_KEY_ED25519;
-        break;
-#endif
-      default:
-        infof(data, "unsupported key type, can't check knownhosts");
-        keybit = 0;
-        break;
-      }
-      if(!keybit)
-        /* no check means failure! */
-        rc = CURLKHSTAT_REJECT;
-      else {
-#ifdef HAVE_LIBSSH2_KNOWNHOST_CHECKP
-        keycheck = libssh2_knownhost_checkp(sshc->kh,
-                                            conn->host.name,
-                                            (conn->remote_port != PORT_SSH)?
-                                            conn->remote_port:-1,
-                                            remotekey, keylen,
-                                            LIBSSH2_KNOWNHOST_TYPE_PLAIN|
-                                            LIBSSH2_KNOWNHOST_KEYENC_RAW|
-                                            keybit,
-                                            &host);
-#else
-        keycheck = libssh2_knownhost_check(sshc->kh,
-                                           conn->host.name,
-                                           remotekey, keylen,
-                                           LIBSSH2_KNOWNHOST_TYPE_PLAIN|
-                                           LIBSSH2_KNOWNHOST_KEYENC_RAW|
-                                           keybit,
-                                           &host);
-#endif
-
-        infof(data, "SSH host check: %d, key: %s", keycheck,
-              (keycheck <= LIBSSH2_KNOWNHOST_CHECK_MISMATCH)?
-              host->key:"<none>");
-
-        /* setup 'knownkey' */
-        if(keycheck <= LIBSSH2_KNOWNHOST_CHECK_MISMATCH) {
-          knownkey.key = host->key;
-          knownkey.len = 0;
-          knownkey.keytype = convert_ssh2_keytype(sshkeytype);
-          knownkeyp = &knownkey;
-        }
-
-        /* setup 'foundkey' */
-        foundkey.key = remotekey;
-        foundkey.len = keylen;
-        foundkey.keytype = convert_ssh2_keytype(sshkeytype);
-
-        /*
-         * if any of the LIBSSH2_KNOWNHOST_CHECK_* defines and the
-         * curl_khmatch enum are ever modified, we need to introduce a
-         * translation table here!
-         */
-        keymatch = (enum curl_khmatch)keycheck;
-
-        /* Ask the callback how to behave */
-        Curl_set_in_callback(data, true);
-        rc = func(data, knownkeyp, /* from the knownhosts file */
-                  &foundkey, /* from the remote host */
-                  keymatch, data->set.ssh_keyfunc_userp);
-        Curl_set_in_callback(data, false);
-      }
-    }
-    else
-      /* no remotekey means failure! */
-      rc = CURLKHSTAT_REJECT;
-
-    switch(rc) {
-    default: /* unknown return codes will equal reject */
-      /* FALLTHROUGH */
-    case CURLKHSTAT_REJECT:
-      state(data, SSH_SESSION_FREE);
-      /* FALLTHROUGH */
-    case CURLKHSTAT_DEFER:
-      /* DEFER means bail out but keep the SSH_HOSTKEY state */
-      result = sshc->actualcode = CURLE_PEER_FAILED_VERIFICATION;
+    switch(sshkeytype) {
+    case LIBSSH2_HOSTKEY_TYPE_RSA:
+      keybit = LIBSSH2_KNOWNHOST_KEY_SSHRSA;
       break;
-    case CURLKHSTAT_FINE_REPLACE:
-      /* remove old host+key that doesn't match */
-      if(host)
-        libssh2_knownhost_del(sshc->kh, host);
-        /* FALLTHROUGH */
-    case CURLKHSTAT_FINE:
-        /* FALLTHROUGH */
-    case CURLKHSTAT_FINE_ADD_TO_FILE:
-      /* proceed */
-      if(keycheck != LIBSSH2_KNOWNHOST_CHECK_MATCH) {
-        /* the found host+key didn't match but has been told to be fine
-           anyway so we add it in memory */
-        int addrc = libssh2_knownhost_add(sshc->kh,
-                                          conn->host.name, NULL,
+#ifdef LIBSSH2_HOSTKEY_TYPE_DSS
+    case LIBSSH2_HOSTKEY_TYPE_DSS:  /* deprecated upstream */
+      keybit = LIBSSH2_KNOWNHOST_KEY_SSHDSS;
+      break;
+#endif
+    case LIBSSH2_HOSTKEY_TYPE_ECDSA_256:
+      keybit = LIBSSH2_KNOWNHOST_KEY_ECDSA_256;
+      break;
+    case LIBSSH2_HOSTKEY_TYPE_ECDSA_384:
+      keybit = LIBSSH2_KNOWNHOST_KEY_ECDSA_384;
+      break;
+    case LIBSSH2_HOSTKEY_TYPE_ECDSA_521:
+      keybit = LIBSSH2_KNOWNHOST_KEY_ECDSA_521;
+      break;
+    case LIBSSH2_HOSTKEY_TYPE_ED25519:
+      keybit = LIBSSH2_KNOWNHOST_KEY_ED25519;
+      break;
+    default:
+      infof(data, "SSH: unsupported host key type for knownhosts check");
+      keybit = 0;
+      break;
+    }
+    if(!keybit)
+      /* no check means failure! */
+      rc = CURLKHSTAT_REJECT;
+    else {
+      keycheck = libssh2_knownhost_checkp(sshc->kh,
+                                          conn->origin->hostname,
+                                          (conn->origin->port != PORT_SSH) ?
+                                          conn->origin->port : -1,
                                           remotekey, keylen,
                                           LIBSSH2_KNOWNHOST_TYPE_PLAIN|
                                           LIBSSH2_KNOWNHOST_KEYENC_RAW|
-                                          keybit, NULL);
+                                          keybit,
+                                          &host);
+
+      infof(data, "SSH: host check %d, key: %s", keycheck,
+            (keycheck <= LIBSSH2_KNOWNHOST_CHECK_MISMATCH) ?
+            host->key : "<none>");
+
+      /* setup 'knownkey' */
+      if(keycheck <= LIBSSH2_KNOWNHOST_CHECK_MISMATCH) {
+        knownkey.key = host->key;
+        knownkey.len = 0;
+        knownkey.keytype = convert_ssh2_keytype(sshkeytype);
+        knownkeyp = &knownkey;
+      }
+
+      /* setup 'foundkey' */
+      foundkey.key = remotekey;
+      foundkey.len = keylen;
+      foundkey.keytype = convert_ssh2_keytype(sshkeytype);
+
+      /*
+       * if any of the LIBSSH2_KNOWNHOST_CHECK_* defines and the
+       * curl_khmatch enum are ever modified, we need to introduce a
+       * translation table here!
+       */
+      keymatch = (enum curl_khmatch)keycheck;
+
+      /* Ask the callback how to behave */
+      Curl_set_in_callback(data, TRUE);
+      rc = func(data, knownkeyp, /* from the knownhosts file */
+                &foundkey, /* from the remote host */
+                keymatch, data->set.ssh_keyfunc_userp);
+      Curl_set_in_callback(data, FALSE);
+    }
+  }
+  else {
+    /* no remotekey means failure! */
+    infof(data, "SSH: host offers no public key");
+    rc = CURLKHSTAT_REJECT;
+  }
+
+  switch(rc) {
+  default: /* unknown return codes is the same as reject */
+  case CURLKHSTAT_REJECT:
+    infof(data, "SSH: knownhost check failed");
+    myssh_to(data, sshc, SSH_SESSION_FREE);
+    FALLTHROUGH();
+  case CURLKHSTAT_DEFER:
+    /* DEFER means bail out but keep the SSH_HOSTKEY state */
+    result = CURLE_PEER_FAILED_VERIFICATION;
+    break;
+  case CURLKHSTAT_FINE_REPLACE:
+    /* remove old host+key that does not match */
+    if(host)
+      libssh2_knownhost_del(sshc->kh, host);
+    FALLTHROUGH();
+  case CURLKHSTAT_FINE:
+  case CURLKHSTAT_FINE_ADD_TO_FILE:
+    /* proceed */
+    if(keycheck != LIBSSH2_KNOWNHOST_CHECK_MATCH) {
+      int addrc;
+      const char *hostbuf;
+      char *hostport = NULL;
+      if(conn->origin->port != PORT_SSH) {
+        hostbuf = hostport = curl_maprintf("[%s]:%u", conn->origin->hostname,
+                                           conn->origin->port);
+        if(!hostbuf)
+          infof(data, "WARNING: failed allocating buffer for [host]:port");
+      }
+      else
+        hostbuf = conn->origin->hostname;
+      if(hostbuf) {
+        /* the found host+key did not match but has been told to be fine
+           anyway so we add it in memory */
+        addrc = libssh2_knownhost_addc(sshc->kh, hostbuf, NULL,
+                                       remotekey, keylen, NULL, 0,
+                                       LIBSSH2_KNOWNHOST_TYPE_PLAIN |
+                                       LIBSSH2_KNOWNHOST_KEYENC_RAW |
+                                       keybit, NULL);
         if(addrc)
-          infof(data, "WARNING: adding the known host %s failed",
-                conn->host.name);
+          infof(data, "WARNING: adding the known host %s failed", hostbuf);
         else if(rc == CURLKHSTAT_FINE_ADD_TO_FILE ||
                 rc == CURLKHSTAT_FINE_REPLACE) {
           /* now we write the entire in-memory list of known hosts to the
@@ -632,27 +469,21 @@ static CURLcode ssh_knownhost(struct Curl_easy *data)
           }
         }
       }
-      break;
+      curlx_free(hostport);
     }
+    else
+      infof(data, "SSH: knownhost entry matches host key");
+    break;
   }
-#else /* HAVE_LIBSSH2_KNOWNHOST_API */
-  (void)data;
-#endif
   return result;
 }
 
-static CURLcode ssh_check_fingerprint(struct Curl_easy *data)
+static CURLcode ssh_check_fingerprint(struct Curl_easy *data,
+                                      struct ssh_conn *sshc)
 {
-  struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
   const char *pubkey_md5 = data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5];
   const char *pubkey_sha256 = data->set.str[STRING_SSH_HOST_PUBLIC_KEY_SHA256];
 
-  infof(data, "SSH MD5 public key: %s",
-    pubkey_md5 != NULL ? pubkey_md5 : "NULL");
-  infof(data, "SSH SHA256 public key: %s",
-      pubkey_sha256 != NULL ? pubkey_sha256 : "NULL");
-
   if(pubkey_sha256) {
     const char *fingerprint = NULL;
     char *fingerprint_b64 = NULL;
@@ -660,48 +491,33 @@ static CURLcode ssh_check_fingerprint(struct Curl_easy *data)
     size_t pub_pos = 0;
     size_t b64_pos = 0;
 
-#ifdef LIBSSH2_HOSTKEY_HASH_SHA256
-    /* The fingerprint points to static storage (!), don't free() it. */
+    infof(data, "SSH: SHA256 public key '%s'", pubkey_sha256);
+    /* The fingerprint points to static storage (!), do not free() it. */
     fingerprint = libssh2_hostkey_hash(sshc->ssh_session,
                                        LIBSSH2_HOSTKEY_HASH_SHA256);
-#else
-    const char *hostkey;
-    size_t len = 0;
-    unsigned char hash[32];
-
-    hostkey = libssh2_session_hostkey(sshc->ssh_session, &len, NULL);
-    if(hostkey) {
-      if(!Curl_sha256it(hash, (const unsigned char *) hostkey, len))
-        fingerprint = (char *) hash;
-    }
-#endif
-
     if(!fingerprint) {
       failf(data,
-            "Denied establishing ssh session: sha256 fingerprint "
+            "Denied establishing ssh session: SHA256 fingerprint "
             "not available");
-      state(data, SSH_SESSION_FREE);
-      sshc->actualcode = CURLE_PEER_FAILED_VERIFICATION;
-      return sshc->actualcode;
+      myssh_to(data, sshc, SSH_SESSION_FREE);
+      return CURLE_PEER_FAILED_VERIFICATION;
     }
 
     /* The length of fingerprint is 32 bytes for SHA256.
      * See libssh2_hostkey_hash documentation. */
-    if(Curl_base64_encode(fingerprint, 32, &fingerprint_b64,
-                          &fingerprint_b64_len) != CURLE_OK) {
-      state(data, SSH_SESSION_FREE);
-      sshc->actualcode = CURLE_PEER_FAILED_VERIFICATION;
-      return sshc->actualcode;
+    if(curlx_base64_encode((const uint8_t *)fingerprint, 32, &fingerprint_b64,
+                           &fingerprint_b64_len) != CURLE_OK) {
+      myssh_to(data, sshc, SSH_SESSION_FREE);
+      return CURLE_PEER_FAILED_VERIFICATION;
     }
 
     if(!fingerprint_b64) {
-      failf(data, "sha256 fingerprint could not be encoded");
-      state(data, SSH_SESSION_FREE);
-      sshc->actualcode = CURLE_PEER_FAILED_VERIFICATION;
-      return sshc->actualcode;
+      failf(data, "SHA256 fingerprint could not be encoded");
+      myssh_to(data, sshc, SSH_SESSION_FREE);
+      return CURLE_PEER_FAILED_VERIFICATION;
     }
 
-    infof(data, "SSH SHA256 fingerprint: %s", fingerprint_b64);
+    infof(data, "SSH: SHA256 fingerprint '%s'", fingerprint_b64);
 
     /* Find the position of any = padding characters in the public key */
     while((pubkey_sha256[pub_pos] != '=') && pubkey_sha256[pub_pos]) {
@@ -714,60 +530,60 @@ static CURLcode ssh_check_fingerprint(struct Curl_easy *data)
       b64_pos++;
     }
 
-    /* Before we authenticate we check the hostkey's sha256 fingerprint
+    /* Before we authenticate we check the hostkey's SHA256 fingerprint
      * against a known fingerprint, if available.
      */
     if((pub_pos != b64_pos) ||
        strncmp(fingerprint_b64, pubkey_sha256, pub_pos)) {
       failf(data,
-            "Denied establishing ssh session: mismatch sha256 fingerprint. "
+            "Denied establishing ssh session: mismatch SHA256 fingerprint. "
             "Remote %s is not equal to %s", fingerprint_b64, pubkey_sha256);
-      free(fingerprint_b64);
-      state(data, SSH_SESSION_FREE);
-      sshc->actualcode = CURLE_PEER_FAILED_VERIFICATION;
-      return sshc->actualcode;
+      curlx_free(fingerprint_b64);
+      myssh_to(data, sshc, SSH_SESSION_FREE);
+      return CURLE_PEER_FAILED_VERIFICATION;
     }
 
-    free(fingerprint_b64);
+    curlx_free(fingerprint_b64);
 
-    infof(data, "SHA256 checksum match");
+    infof(data, "SSH: SHA256 checksum match");
   }
 
   if(pubkey_md5) {
     char md5buffer[33];
-    const char *fingerprint = NULL;
+    const char *fingerprint;
 
+    infof(data, "SSH: MD5 public key '%s'", pubkey_md5);
     fingerprint = libssh2_hostkey_hash(sshc->ssh_session,
                                        LIBSSH2_HOSTKEY_HASH_MD5);
 
     if(fingerprint) {
-      /* The fingerprint points to static storage (!), don't free() it. */
+      /* The fingerprint points to static storage (!), do not free() it. */
       int i;
       for(i = 0; i < 16; i++) {
-        msnprintf(&md5buffer[i*2], 3, "%02x", (unsigned char) fingerprint[i]);
+        curl_msnprintf(&md5buffer[i * 2], 3, "%02x",
+                       (unsigned char)fingerprint[i]);
       }
 
-      infof(data, "SSH MD5 fingerprint: %s", md5buffer);
+      infof(data, "SSH: MD5 fingerprint '%s'", md5buffer);
     }
 
-    /* This does NOT verify the length of 'pubkey_md5' separately, which will
-       make the comparison below fail unless it is exactly 32 characters */
-    if(!fingerprint || !strcasecompare(md5buffer, pubkey_md5)) {
+    /* This does NOT verify the length of 'pubkey_md5' separately, which
+       makes the comparison below fail unless it is exactly 32 characters */
+    if(!fingerprint || !curl_strequal(md5buffer, pubkey_md5)) {
       if(fingerprint) {
         failf(data,
-              "Denied establishing ssh session: mismatch md5 fingerprint. "
+              "Denied establishing ssh session: mismatch MD5 fingerprint. "
               "Remote %s is not equal to %s", md5buffer, pubkey_md5);
       }
       else {
         failf(data,
-              "Denied establishing ssh session: md5 fingerprint "
+              "Denied establishing ssh session: MD5 fingerprint "
               "not available");
       }
-      state(data, SSH_SESSION_FREE);
-      sshc->actualcode = CURLE_PEER_FAILED_VERIFICATION;
-      return sshc->actualcode;
+      myssh_to(data, sshc, SSH_SESSION_FREE);
+      return CURLE_PEER_FAILED_VERIFICATION;
     }
-    infof(data, "MD5 checksum match");
+    infof(data, "SSH: MD5 checksum match");
   }
 
   if(!pubkey_md5 && !pubkey_sha256) {
@@ -779,26 +595,27 @@ static CURLcode ssh_check_fingerprint(struct Curl_easy *data)
       const char *remotekey = libssh2_session_hostkey(sshc->ssh_session,
                                                       &keylen, &sshkeytype);
       if(remotekey) {
-        int keytype = convert_ssh2_keytype(sshkeytype);
-        Curl_set_in_callback(data, true);
+        enum curl_khtype keytype = convert_ssh2_keytype(sshkeytype);
+        Curl_set_in_callback(data, TRUE);
         rc = data->set.ssh_hostkeyfunc(data->set.ssh_hostkeyfunc_userp,
-                                       keytype, remotekey, keylen);
-        Curl_set_in_callback(data, false);
-        if(rc!= CURLKHMATCH_OK) {
-          state(data, SSH_SESSION_FREE);
-          sshc->actualcode = CURLE_PEER_FAILED_VERIFICATION;
-          return sshc->actualcode;
+                                       (int)keytype, remotekey, keylen);
+        Curl_set_in_callback(data, FALSE);
+        if(rc != CURLKHMATCH_OK) {
+          myssh_to(data, sshc, SSH_SESSION_FREE);
+          failf(data, "SSH: callback failed host public key verification");
+          return CURLE_PEER_FAILED_VERIFICATION;
         }
+        infof(data, "SSH: verified public key via callback");
       }
       else {
-        state(data, SSH_SESSION_FREE);
-        sshc->actualcode = CURLE_PEER_FAILED_VERIFICATION;
-        return sshc->actualcode;
+        myssh_to(data, sshc, SSH_SESSION_FREE);
+        return CURLE_PEER_FAILED_VERIFICATION;
       }
       return CURLE_OK;
     }
     else {
-      return ssh_knownhost(data);
+      CURL_TRC_SSH(data, "no host key checksum given, checking knownhosts");
+      return ssh_knownhost(data, sshc);
     }
   }
   else {
@@ -808,78 +625,64 @@ static CURLcode ssh_check_fingerprint(struct Curl_easy *data)
 }
 
 /*
- * ssh_force_knownhost_key_type() will check the known hosts file and try to
+ * ssh_force_knownhost_key_type() checks the known hosts file and try to
  * force a specific public key type from the server if an entry is found.
  */
-static CURLcode ssh_force_knownhost_key_type(struct Curl_easy *data)
+static CURLcode ssh_force_knownhost_key_type(struct Curl_easy *data,
+                                             struct ssh_conn *sshc)
 {
   CURLcode result = CURLE_OK;
 
-#ifdef HAVE_LIBSSH2_KNOWNHOST_API
+  static const char hostkey_method_ssh_ed25519[] = "ssh-ed25519";
+  static const char hostkey_method_ssh_ecdsa_521[] = "ecdsa-sha2-nistp521";
+  static const char hostkey_method_ssh_ecdsa_384[] = "ecdsa-sha2-nistp384";
+  static const char hostkey_method_ssh_ecdsa_256[] = "ecdsa-sha2-nistp256";
+  static const char hostkey_method_ssh_rsa_all[] =
+    "rsa-sha2-256,rsa-sha2-512,ssh-rsa";
+#ifdef LIBSSH2_KNOWNHOST_KEY_SSHDSS
+  static const char hostkey_method_ssh_dss[] = "ssh-dss";
+#endif
+  bool found = FALSE;
 
-#ifdef LIBSSH2_KNOWNHOST_KEY_ED25519
-  static const char * const hostkey_method_ssh_ed25519
-    = "ssh-ed25519";
-#endif
-#ifdef LIBSSH2_KNOWNHOST_KEY_ECDSA_521
-  static const char * const hostkey_method_ssh_ecdsa_521
-    = "ecdsa-sha2-nistp521";
-#endif
-#ifdef LIBSSH2_KNOWNHOST_KEY_ECDSA_384
-  static const char * const hostkey_method_ssh_ecdsa_384
-    = "ecdsa-sha2-nistp384";
-#endif
-#ifdef LIBSSH2_KNOWNHOST_KEY_ECDSA_256
-  static const char * const hostkey_method_ssh_ecdsa_256
-    = "ecdsa-sha2-nistp256";
-#endif
-  static const char * const hostkey_method_ssh_rsa
-    = "ssh-rsa";
-  static const char * const hostkey_method_ssh_rsa_all
-    = "rsa-sha2-256,rsa-sha2-512,ssh-rsa";
-  static const char * const hostkey_method_ssh_dss
-    = "ssh-dss";
-
-  const char *hostkey_method = NULL;
-  struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-  struct libssh2_knownhost* store = NULL;
-  const char *kh_name_end = NULL;
-  size_t kh_name_size = 0;
-  int port = 0;
-  bool found = false;
-
-  if(sshc->kh && !data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5]) {
+  if(sshc->kh &&
+     !data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5] &&
+     !data->set.str[STRING_SSH_HOST_PUBLIC_KEY_SHA256]) {
+    struct libssh2_knownhost *store = NULL;
+    struct connectdata *conn = data->conn;
     /* lets try to find our host in the known hosts file */
     while(!libssh2_knownhost_get(sshc->kh, &store, store)) {
-      /* For non-standard ports, the name will be enclosed in */
+      /* For non-standard ports, the name is enclosed in */
       /* square brackets, followed by a colon and the port */
       if(store) {
         if(store->name) {
           if(store->name[0] == '[') {
-            kh_name_end = strstr(store->name, "]:");
+            curl_off_t port;
+            size_t kh_name_size = 0;
+            const char *p;
+            const char *kh_name_end = strstr(store->name, "]:");
             if(!kh_name_end) {
-              infof(data, "Invalid host pattern %s in %s",
+              infof(data, "SSH: invalid host pattern %s in %s",
                     store->name, data->set.str[STRING_SSH_KNOWNHOSTS]);
               continue;
             }
-            port = atoi(kh_name_end + 2);
-            if(kh_name_end && (port == conn->remote_port)) {
+            p = kh_name_end + 2; /* start of port number */
+            if(!curlx_str_number(&p, &port, 0xffff) &&
+               (kh_name_end && (port == conn->origin->port))) {
               kh_name_size = strlen(store->name) - 1 - strlen(kh_name_end);
-              if(strncmp(store->name + 1,
-                 conn->host.name, kh_name_size) == 0) {
-                found = true;
+              if(!strncmp(store->name + 1, conn->origin->hostname,
+                          kh_name_size)) {
+                found = TRUE;
                 break;
               }
             }
           }
-          else if(strcmp(store->name, conn->host.name) == 0) {
-            found = true;
+          else if(!strcmp(store->name, conn->origin->hostname)) {
+            found = TRUE;
             break;
           }
         }
         else {
-          found = true;
+          found = TRUE;
           break;
         }
       }
@@ -887,2257 +690,2619 @@ static CURLcode ssh_force_knownhost_key_type(struct Curl_easy *data)
 
     if(found) {
       int rc;
-      infof(data, "Found host %s in %s",
-            conn->host.name, data->set.str[STRING_SSH_KNOWNHOSTS]);
+      const char *hostkey_method = NULL;
+      infof(data, "SSH: found host '%s' in '%s'",
+            conn->origin->hostname, data->set.str[STRING_SSH_KNOWNHOSTS]);
 
       switch(store->typemask & LIBSSH2_KNOWNHOST_KEY_MASK) {
-#ifdef LIBSSH2_KNOWNHOST_KEY_ED25519
       case LIBSSH2_KNOWNHOST_KEY_ED25519:
         hostkey_method = hostkey_method_ssh_ed25519;
         break;
-#endif
-#ifdef LIBSSH2_KNOWNHOST_KEY_ECDSA_521
       case LIBSSH2_KNOWNHOST_KEY_ECDSA_521:
         hostkey_method = hostkey_method_ssh_ecdsa_521;
         break;
-#endif
-#ifdef LIBSSH2_KNOWNHOST_KEY_ECDSA_384
       case LIBSSH2_KNOWNHOST_KEY_ECDSA_384:
         hostkey_method = hostkey_method_ssh_ecdsa_384;
         break;
-#endif
-#ifdef LIBSSH2_KNOWNHOST_KEY_ECDSA_256
       case LIBSSH2_KNOWNHOST_KEY_ECDSA_256:
         hostkey_method = hostkey_method_ssh_ecdsa_256;
         break;
-#endif
       case LIBSSH2_KNOWNHOST_KEY_SSHRSA:
-#ifdef HAVE_LIBSSH2_VERSION
-        if(libssh2_version(0x010900))
-          /* since 1.9.0 libssh2_session_method_pref() works as expected */
-          hostkey_method = hostkey_method_ssh_rsa_all;
-        else
-#endif
-          /* old libssh2 which cannot correctly remove unsupported methods due
-           * to bug in src/kex.c or does not support the new methods anyways.
-           */
-          hostkey_method = hostkey_method_ssh_rsa;
+        hostkey_method = hostkey_method_ssh_rsa_all;
         break;
-      case LIBSSH2_KNOWNHOST_KEY_SSHDSS:
+#ifdef LIBSSH2_KNOWNHOST_KEY_SSHDSS
+      case LIBSSH2_KNOWNHOST_KEY_SSHDSS:  /* deprecated upstream */
         hostkey_method = hostkey_method_ssh_dss;
         break;
+#endif
       case LIBSSH2_KNOWNHOST_KEY_RSA1:
         failf(data, "Found host key type RSA1 which is not supported");
         return CURLE_SSH;
       default:
-        failf(data, "Unknown host key type: %i",
+        failf(data, "Unknown host key type: %d",
               (store->typemask & LIBSSH2_KNOWNHOST_KEY_MASK));
         return CURLE_SSH;
       }
 
-      infof(data, "Set \"%s\" as SSH hostkey type", hostkey_method);
+      infof(data, "SSH: set '%s' as hostkey type", hostkey_method);
       rc = libssh2_session_method_pref(sshc->ssh_session,
                                        LIBSSH2_METHOD_HOSTKEY, hostkey_method);
       if(rc) {
-        char *errmsg = NULL;
+        char *err_msg = NULL;
         int errlen;
-        libssh2_session_last_error(sshc->ssh_session, &errmsg, &errlen, 0);
-        failf(data, "libssh2: %s", errmsg);
+        libssh2_session_last_error(sshc->ssh_session, &err_msg, &errlen, 0);
+        failf(data, "libssh2 method '%s' failed: %s", hostkey_method, err_msg);
         result = libssh2_session_error_to_CURLE(rc);
       }
     }
     else {
-      infof(data, "Did not find host %s in %s",
-            conn->host.name, data->set.str[STRING_SSH_KNOWNHOSTS]);
+      infof(data, "SSH: did not find host '%s' in '%s'",
+            conn->origin->hostname, data->set.str[STRING_SSH_KNOWNHOSTS]);
     }
   }
 
-#endif /* HAVE_LIBSSH2_KNOWNHOST_API */
-
   return result;
 }
 
-/*
- * ssh_statemach_act() runs the SSH state machine as far as it can without
- * blocking and without reaching the end.  The data the pointer 'block' points
- * to will be set to TRUE if the libssh2 function returns LIBSSH2_ERROR_EAGAIN
- * meaning it wants to be called again when the socket is ready
- */
+static CURLcode quote_error(struct Curl_easy *data,
+                            struct ssh_conn *sshc)
+{
+  failf(data, "Suspicious data after the command line");
+  curlx_safefree(sshc->quote_path1);
+  curlx_safefree(sshc->quote_path2);
+  return CURLE_QUOTE_ERROR;
+}
 
-static CURLcode ssh_statemach_act(struct Curl_easy *data, bool *block)
+static CURLcode sftp_quote(struct Curl_easy *data,
+                           struct ssh_conn *sshc,
+                           struct SSHPROTO *sshp)
+{
+  const char *cp;
+  CURLcode result = CURLE_OK;
+
+  /*
+   * Support some of the "FTP" commands
+   *
+   * 'sshc->quote_item' is already verified to be non-NULL before it
+   * switched to this state.
+   */
+  const char *cmd = sshc->quote_item->data;
+  sshc->acceptfail = FALSE;
+
+  /* if a command starts with an asterisk, which a legal SFTP command never
+     can, the command is allowed to fail without it causing any
+     aborts or cancels etc. It causes libcurl to act as if the command
+     is successful, whatever the server responds. */
+
+  if(cmd[0] == '*') {
+    cmd++;
+    sshc->acceptfail = TRUE;
+  }
+
+  if(curl_strequal("pwd", cmd)) {
+    /* output debug output if that is requested */
+    char *tmp = curl_maprintf("257 \"%s\" is current directory.\n",
+                              sshp->path);
+    if(!tmp)
+      return CURLE_OUT_OF_MEMORY;
+    Curl_debug(data, CURLINFO_HEADER_OUT, "PWD\n", 4);
+    Curl_debug(data, CURLINFO_HEADER_IN, tmp, strlen(tmp));
+
+    /* this sends an FTP-like "header" to the header callback so that
+       the current directory can be read similar to how it is read when
+       using ordinary FTP. */
+    result = Curl_client_write(data, CLIENTWRITE_HEADER, tmp, strlen(tmp));
+    curlx_free(tmp);
+    if(!result)
+      myssh_to(data, sshc, SSH_SFTP_NEXT_QUOTE);
+    return result;
+  }
+
+  /*
+   * the arguments following the command must be separated from the
+   * command with a space so we can check for it unconditionally
+   */
+  cp = strchr(cmd, ' ');
+  if(!cp) {
+    failf(data, "Syntax error command '%s', missing parameter", cmd);
+    return CURLE_QUOTE_ERROR;
+  }
+
+  /*
+   * also, every command takes at least one argument so we get that
+   * first argument right now
+   */
+  result = Curl_get_pathname(&cp, &sshc->quote_path1, sshc->homedir);
+  if(result) {
+    if(result != CURLE_OUT_OF_MEMORY)
+      failf(data, "Syntax error: Bad first parameter to '%s'", cmd);
+    return result;
+  }
+
+  /*
+   * SFTP is a binary protocol, so we do not send text commands to the server.
+   * Instead, we scan for commands used by OpenSSH's sftp program and call the
+   * appropriate libssh2 functions.
+   */
+  if(!strncmp(cmd, "chgrp ", 6) ||
+     !strncmp(cmd, "chmod ", 6) ||
+     !strncmp(cmd, "chown ", 6) ||
+     !strncmp(cmd, "atime ", 6) ||
+     !strncmp(cmd, "mtime ", 6)) {
+    /* attribute change */
+
+    /* sshc->quote_path1 contains the mode to set */
+    /* get the destination */
+    result = Curl_get_pathname(&cp, &sshc->quote_path2, sshc->homedir);
+    if(result) {
+      if(result != CURLE_OUT_OF_MEMORY)
+        failf(data, "Syntax error in %s: Bad second parameter", cmd);
+      curlx_safefree(sshc->quote_path1);
+      return result;
+    }
+    if(*cp)
+      return quote_error(data, sshc);
+
+    memset(&sshp->quote_attrs, 0, sizeof(LIBSSH2_SFTP_ATTRIBUTES));
+    myssh_to(data, sshc, SSH_SFTP_QUOTE_STAT);
+    return result;
+  }
+  if(!strncmp(cmd, "ln ", 3) ||
+     !strncmp(cmd, "symlink ", 8)) {
+    /* symbolic linking */
+    /* sshc->quote_path1 is the source */
+    /* get the destination */
+    result = Curl_get_pathname(&cp, &sshc->quote_path2, sshc->homedir);
+    if(result) {
+      if(result != CURLE_OUT_OF_MEMORY)
+        failf(data, "Syntax error in ln/symlink: Bad second parameter");
+      curlx_safefree(sshc->quote_path1);
+      return result;
+    }
+    if(*cp)
+      return quote_error(data, sshc);
+    myssh_to(data, sshc, SSH_SFTP_QUOTE_SYMLINK);
+    return result;
+  }
+  else if(!strncmp(cmd, "mkdir ", 6)) {
+    if(*cp)
+      return quote_error(data, sshc);
+    /* create directory */
+    myssh_to(data, sshc, SSH_SFTP_QUOTE_MKDIR);
+    return result;
+  }
+  else if(!strncmp(cmd, "rename ", 7)) {
+    /* rename file */
+    /* first param is the source path */
+    /* second param is the dest. path */
+    result = Curl_get_pathname(&cp, &sshc->quote_path2, sshc->homedir);
+    if(result) {
+      if(result != CURLE_OUT_OF_MEMORY)
+        failf(data, "Syntax error in rename: Bad second parameter");
+      curlx_safefree(sshc->quote_path1);
+      return result;
+    }
+    if(*cp)
+      return quote_error(data, sshc);
+    myssh_to(data, sshc, SSH_SFTP_QUOTE_RENAME);
+    return result;
+  }
+  else if(!strncmp(cmd, "rmdir ", 6)) {
+    if(*cp)
+      return quote_error(data, sshc);
+    /* delete directory */
+    myssh_to(data, sshc, SSH_SFTP_QUOTE_RMDIR);
+    return result;
+  }
+  else if(!strncmp(cmd, "rm ", 3)) {
+    if(*cp)
+      return quote_error(data, sshc);
+    myssh_to(data, sshc, SSH_SFTP_QUOTE_UNLINK);
+    return result;
+  }
+  else if(!strncmp(cmd, "statvfs ", 8)) {
+    if(*cp)
+      return quote_error(data, sshc);
+    myssh_to(data, sshc, SSH_SFTP_QUOTE_STATVFS);
+    return result;
+  }
+
+  failf(data, "Unknown SFTP command");
+  curlx_safefree(sshc->quote_path1);
+  curlx_safefree(sshc->quote_path2);
+  return CURLE_QUOTE_ERROR;
+}
+
+static CURLcode sftp_upload_init(struct Curl_easy *data,
+                                 struct ssh_conn *sshc,
+                                 struct SSHPROTO *sshp,
+                                 bool *blockp)
+{
+  unsigned long flags;
+
+  /*
+   * NOTE!!!  libssh2 requires that the destination path is a full path
+   *          that includes the destination file and name OR ends in a "/"
+   *          If this is not done the destination file is named the
+   *          same name as the last directory in the path.
+   */
+
+  if(data->state.resume_from) {
+    LIBSSH2_SFTP_ATTRIBUTES attrs;
+    if(data->state.resume_from < 0) {
+      int rc = libssh2_sftp_stat_ex(sshc->sftp_session, sshp->path,
+                                    curlx_uztoui(strlen(sshp->path)),
+                                    LIBSSH2_SFTP_STAT, &attrs);
+      if(rc == LIBSSH2_ERROR_EAGAIN) {
+        *blockp = TRUE;
+        return CURLE_OK;
+      }
+      if(rc) {
+        data->state.resume_from = 0;
+      }
+      else {
+        curl_off_t size = attrs.filesize;
+        if(size < 0) {
+          failf(data, "Bad file size (%" FMT_OFF_T ")", size);
+          return CURLE_BAD_DOWNLOAD_RESUME;
+        }
+        data->state.resume_from = attrs.filesize;
+      }
+    }
+  }
+
+  if(data->set.remote_append) {
+    /* True append mode: create if nonexisting */
+    flags = LIBSSH2_FXF_WRITE | LIBSSH2_FXF_CREAT | LIBSSH2_FXF_APPEND;
+  }
+  else if(data->state.resume_from > 0) {
+    /*
+     * Resume MUST NOT use APPEND; some servers force writes to EOF when
+     * APPEND is set, ignoring a prior seek().
+     */
+    flags = LIBSSH2_FXF_WRITE;
+  }
+  else {
+    /* Clear file before writing (normal behavior) */
+    flags = LIBSSH2_FXF_WRITE | LIBSSH2_FXF_CREAT | LIBSSH2_FXF_TRUNC;
+  }
+
+  sshc->sftp_handle =
+    libssh2_sftp_open_ex(sshc->sftp_session, sshp->path,
+                         curlx_uztoui(strlen(sshp->path)),
+                         flags, (long)data->set.new_file_perms,
+                         LIBSSH2_SFTP_OPENFILE);
+
+  if(!sshc->sftp_handle) {
+    CURLcode result;
+    unsigned long sftperr;
+    int rc = libssh2_session_last_errno(sshc->ssh_session);
+
+    if(LIBSSH2_ERROR_EAGAIN == rc) {
+      *blockp = TRUE;
+      return CURLE_OK;
+    }
+
+    if(LIBSSH2_ERROR_SFTP_PROTOCOL == rc)
+      /* only when there was an SFTP protocol error can we extract
+         the sftp error! */
+      sftperr = libssh2_sftp_last_error(sshc->sftp_session);
+    else
+      sftperr = LIBSSH2_FX_OK; /* not an sftp error at all */
+
+    if(sshc->secondCreateDirs) {
+      myssh_to(data, sshc, SSH_SFTP_CLOSE);
+      failf(data, "Creating the dir/file failed: %s",
+            sftp_libssh2_strerror(sftperr));
+      return sftp_libssh2_error_to_CURLE(sftperr);
+    }
+    if((sftperr == LIBSSH2_FX_NO_SUCH_FILE ||
+        sftperr == LIBSSH2_FX_FAILURE ||
+        sftperr == LIBSSH2_FX_NO_SUCH_PATH) &&
+       data->set.ftp_create_missing_dirs &&
+       (strlen(sshp->path) > 1)) {
+      /* try to create the path remotely */
+      sshc->secondCreateDirs = 1;
+      myssh_to(data, sshc, SSH_SFTP_CREATE_DIRS_INIT);
+      return CURLE_OK;
+    }
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
+    result = sftp_libssh2_error_to_CURLE(sftperr);
+    if(!result) {
+      /* Sometimes, for some reason libssh2_sftp_last_error() returns zero
+         even though libssh2_sftp_open() failed previously! We need to
+         work around that! */
+      result = CURLE_SSH;
+      sftperr = LIBSSH2_FX_OK;
+    }
+    failf(data, "Upload failed: %s (%lu/%d)",
+          sftperr != LIBSSH2_FX_OK ?
+          sftp_libssh2_strerror(sftperr) : "ssh error",
+          sftperr, rc);
+    return result;
+  }
+
+  /* If we have a restart point then we need to seek to the correct
+     Skip if in explicit remote append mode. */
+  if(data->state.resume_from > 0 && !data->set.remote_append) {
+    int seekerr = CURL_SEEKFUNC_OK;
+    /* Let's read off the proper amount of bytes from the input. */
+    if(data->set.seek_func) {
+      Curl_set_in_callback(data, TRUE);
+      seekerr = data->set.seek_func(data->set.seek_client,
+                                    data->state.resume_from, SEEK_SET);
+      Curl_set_in_callback(data, FALSE);
+    }
+
+    if(seekerr != CURL_SEEKFUNC_OK) {
+      curl_off_t passed = 0;
+
+      if(seekerr != CURL_SEEKFUNC_CANTSEEK) {
+        failf(data, "Could not seek stream");
+        return CURLE_FTP_COULDNT_USE_REST;
+      }
+      /* seekerr == CURL_SEEKFUNC_CANTSEEK (cannot seek to offset) */
+      do {
+        char scratch[4 * 1024];
+        size_t readthisamountnow =
+          (data->state.resume_from - passed >
+           (curl_off_t)sizeof(scratch)) ?
+          sizeof(scratch) : curlx_sotouz(data->state.resume_from - passed);
+
+        size_t actuallyread;
+        Curl_set_in_callback(data, TRUE);
+        actuallyread = data->state.fread_func(scratch, 1,
+                                              readthisamountnow,
+                                              data->state.in);
+        Curl_set_in_callback(data, FALSE);
+
+        passed += actuallyread;
+        if((actuallyread == 0) || (actuallyread > readthisamountnow)) {
+          /* this checks for greater-than only to make sure that the
+             CURL_READFUNC_ABORT return code still aborts */
+          failf(data, "Failed to read data");
+          return CURLE_FTP_COULDNT_USE_REST;
+        }
+      } while(passed < data->state.resume_from);
+    }
+
+    /* now, decrease the size of the read */
+    if(data->state.infilesize > 0) {
+      data->state.infilesize -= data->state.resume_from;
+      data->req.size = data->state.infilesize;
+      Curl_pgrsSetUploadSize(data, data->state.infilesize);
+    }
+
+    libssh2_sftp_seek64(sshc->sftp_handle,
+                        (libssh2_uint64_t)data->state.resume_from);
+  }
+  if(data->state.infilesize > 0) {
+    data->req.size = data->state.infilesize;
+    Curl_pgrsSetUploadSize(data, data->state.infilesize);
+  }
+  /* upload data */
+  Curl_xfer_setup_send(data, FIRSTSOCKET);
+
+  /* not set by Curl_xfer_setup to preserve io_flags */
+  data->conn->recv_idx = FIRSTSOCKET;
+
+  /* since we do not really wait for anything at this point, we want the
+     state machine to move on as soon as possible so mark this as dirty */
+  Curl_multi_mark_dirty(data);
+
+  myssh_to(data, sshc, SSH_STOP);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_pkey_init(struct Curl_easy *data,
+                                    struct ssh_conn *sshc)
+{
+  /*
+   * Check the supported auth types in the order I feel is most secure
+   * with the requested type of authentication
+   */
+  sshc->authed = FALSE;
+
+  if((data->set.ssh_auth_types & CURLSSH_AUTH_PUBLICKEY) &&
+     strstr(sshc->authlist, "publickey")) {
+    bool out_of_memory = FALSE;
+
+    sshc->rsa_pub = sshc->rsa = NULL;
+
+    if(data->set.str[STRING_SSH_PRIVATE_KEY]) {
+      sshc->rsa = curlx_strdup(data->set.str[STRING_SSH_PRIVATE_KEY]);
+      if(!sshc->rsa)
+        out_of_memory = TRUE;
+    }
+    else {
+      /* To ponder about: should really the lib be messing about with the
+         HOME environment variable etc? */
+      char *home = curl_getenv("HOME");
+      curlx_struct_stat sbuf;
+
+      /* If no private key file is specified, try some common paths. */
+      if(home) {
+        /* Try ~/.ssh first. */
+        sshc->rsa = curl_maprintf("%s/.ssh/id_rsa", home);
+        if(!sshc->rsa)
+          out_of_memory = TRUE;
+        else if(curlx_stat(sshc->rsa, &sbuf)) {
+          curlx_free(sshc->rsa);
+          sshc->rsa = curl_maprintf("%s/.ssh/id_dsa", home);
+          if(!sshc->rsa)
+            out_of_memory = TRUE;
+          else if(curlx_stat(sshc->rsa, &sbuf)) {
+            curlx_safefree(sshc->rsa);
+          }
+        }
+        curlx_free(home);
+      }
+      if(!out_of_memory && !sshc->rsa) {
+        /* Nothing found; try the current dir. */
+        sshc->rsa = curlx_strdup("id_rsa");
+        if(sshc->rsa && curlx_stat(sshc->rsa, &sbuf)) {
+          curlx_free(sshc->rsa);
+          sshc->rsa = curlx_strdup("id_dsa");
+          if(sshc->rsa && curlx_stat(sshc->rsa, &sbuf)) {
+            curlx_free(sshc->rsa);
+            /* Out of guesses. Set to the empty string to avoid
+             * surprising info messages. */
+            sshc->rsa = curlx_strdup("");
+          }
+        }
+      }
+    }
+
+    /*
+     * Unless the user explicitly specifies a public key file, let
+     * libssh2 extract the public key from the private key file.
+     * This is done by passing sshc->rsa_pub = NULL.
+     */
+    if(!out_of_memory && data->set.str[STRING_SSH_PUBLIC_KEY] &&
+       /* treat empty string the same way as NULL */
+       data->set.str[STRING_SSH_PUBLIC_KEY][0]) {
+      sshc->rsa_pub = curlx_strdup(data->set.str[STRING_SSH_PUBLIC_KEY]);
+      if(!sshc->rsa_pub)
+        out_of_memory = TRUE;
+    }
+
+    if(out_of_memory || !sshc->rsa) {
+      curlx_safefree(sshc->rsa);
+      curlx_safefree(sshc->rsa_pub);
+      myssh_to(data, sshc, SSH_SESSION_FREE);
+      return CURLE_OUT_OF_MEMORY;
+    }
+
+    sshc->passphrase = data->set.ssl.primary.key_passwd;
+    if(!sshc->passphrase)
+      sshc->passphrase = "";
+
+    if(sshc->rsa_pub)
+      infof(data, "SSH: trying public key file '%s'", sshc->rsa_pub);
+    infof(data, "SSH: trying private key file '%s'", sshc->rsa);
+
+    myssh_to(data, sshc, SSH_AUTH_PKEY);
+  }
+  else {
+    myssh_to(data, sshc, SSH_AUTH_PASS_INIT);
+  }
+  return CURLE_OK;
+}
+
+static CURLcode sftp_quote_stat(struct Curl_easy *data,
+                                struct ssh_conn *sshc,
+                                struct SSHPROTO *sshp,
+                                bool *blockp)
+{
+  const char *cmd = sshc->quote_item->data;
+  sshc->acceptfail = FALSE;
+
+  /* if a command starts with an asterisk, which a legal SFTP command never
+     can, the command is allowed to fail without it causing any aborts or
+     cancels etc. It causes libcurl to act as if the command is
+     successful, whatever the server responds. */
+
+  if(cmd[0] == '*') {
+    cmd++;
+    sshc->acceptfail = TRUE;
+  }
+
+  if(strncmp(cmd, "chmod", 5)) {
+    /* Since chown and chgrp only set owner OR group but libssh2 wants to set
+     * them both at once, we need to obtain the current ownership first. This
+     * takes an extra protocol round trip.
+     */
+    int rc = libssh2_sftp_stat_ex(sshc->sftp_session, sshc->quote_path2,
+                                  curlx_uztoui(strlen(sshc->quote_path2)),
+                                  LIBSSH2_SFTP_STAT,
+                                  &sshp->quote_attrs);
+    if(rc == LIBSSH2_ERROR_EAGAIN) {
+      *blockp = TRUE;
+      return CURLE_OK;
+    }
+    if(rc && !sshc->acceptfail) { /* get those attributes */
+      unsigned long sftperr = libssh2_sftp_last_error(sshc->sftp_session);
+      failf(data, "Attempt to get SFTP stats failed: %s",
+            sftp_libssh2_strerror(sftperr));
+      goto fail;
+    }
+  }
+
+  /* Now set the new attributes... */
+  if(!strncmp(cmd, "chgrp", 5)) {
+    const char *p = sshc->quote_path1;
+    curl_off_t gid;
+    if(!curlx_str_number(&p, &gid, ULONG_MAX)) {
+      sshp->quote_attrs.gid = (unsigned long)gid;
+      sshp->quote_attrs.flags = LIBSSH2_SFTP_ATTR_UIDGID;
+    }
+    else if(!sshc->acceptfail) {
+      failf(data, "Syntax error: chgrp gid not a number");
+      goto fail;
+    }
+  }
+  else if(!strncmp(cmd, "chmod", 5)) {
+    curl_off_t perms;
+    const char *p = sshc->quote_path1;
+    /* permissions are octal */
+    if(curlx_str_octal(&p, &perms, 07777)) {
+      failf(data, "Syntax error: chmod permissions not a number");
+      goto fail;
+    }
+
+    sshp->quote_attrs.permissions = (unsigned long)perms;
+    sshp->quote_attrs.flags = LIBSSH2_SFTP_ATTR_PERMISSIONS;
+  }
+  else if(!strncmp(cmd, "chown", 5)) {
+    const char *p = sshc->quote_path1;
+    curl_off_t uid;
+    if(!curlx_str_number(&p, &uid, ULONG_MAX)) {
+      sshp->quote_attrs.uid = (unsigned long)uid;
+      sshp->quote_attrs.flags = LIBSSH2_SFTP_ATTR_UIDGID;
+    }
+    else if(!sshc->acceptfail) {
+      failf(data, "Syntax error: chown uid not a number");
+      goto fail;
+    }
+  }
+  else if(!strncmp(cmd, "atime", 5) ||
+          !strncmp(cmd, "mtime", 5)) {
+    time_t date;
+    bool fail = FALSE;
+
+    if(Curl_getdate_capped(sshc->quote_path1, &date)) {
+      failf(data, "incorrect date format for %.*s", 5, cmd);
+      fail = TRUE;
+    }
+#if SIZEOF_TIME_T > SIZEOF_LONG
+    if(date > 0xffffffff) {
+      /* if 'long' cannot hold >32-bit, this date cannot be sent */
+      failf(data, "date overflow");
+      fail = TRUE;
+    }
+#endif
+    if(fail)
+      goto fail;
+    if(!strncmp(cmd, "atime", 5))
+      sshp->quote_attrs.atime = (unsigned long)date;
+    else /* mtime */
+      sshp->quote_attrs.mtime = (unsigned long)date;
+
+    sshp->quote_attrs.flags = LIBSSH2_SFTP_ATTR_ACMODTIME;
+  }
+
+  /* Now send the completed structure... */
+  myssh_to(data, sshc, SSH_SFTP_QUOTE_SETSTAT);
+  return CURLE_OK;
+fail:
+  curlx_safefree(sshc->quote_path1);
+  curlx_safefree(sshc->quote_path2);
+  return CURLE_QUOTE_ERROR;
+}
+
+static CURLcode sftp_download_stat(struct Curl_easy *data,
+                                   struct ssh_conn *sshc,
+                                   struct SSHPROTO *sshp,
+                                   bool *blockp)
+{
+  LIBSSH2_SFTP_ATTRIBUTES attrs;
+  int rc = libssh2_sftp_stat_ex(sshc->sftp_session, sshp->path,
+                                curlx_uztoui(strlen(sshp->path)),
+                                LIBSSH2_SFTP_STAT, &attrs);
+  if(rc == LIBSSH2_ERROR_EAGAIN) {
+    *blockp = TRUE;
+    return CURLE_OK;
+  }
+  if(rc ||
+     !(attrs.flags & LIBSSH2_SFTP_ATTR_SIZE) ||
+     (attrs.filesize == 0)) {
+    /*
+     * libssh2_sftp_open() did not return an error, so maybe the server
+     * does not support stat()
+     * OR the server does not return a file size with a stat()
+     * OR file size is 0
+     */
+    data->req.size = -1;
+    data->req.maxdownload = -1;
+    Curl_pgrsSetDownloadSize(data, -1);
+    attrs.filesize = 0; /* might be uninitialized but is read below */
+  }
+  else {
+    curl_off_t size = attrs.filesize;
+
+    if(size < 0) {
+      failf(data, "Bad file size (%" FMT_OFF_T ")", size);
+      return CURLE_BAD_DOWNLOAD_RESUME;
+    }
+    if(data->state.use_range) {
+      curl_off_t from;
+      CURLcode result = Curl_ssh_range(data, data->state.range, size,
+                                       &from, &size);
+      if(result)
+        return result;
+
+      libssh2_sftp_seek64(sshc->sftp_handle, (libssh2_uint64_t)from);
+    }
+    data->req.size = size;
+    data->req.maxdownload = size;
+    Curl_pgrsSetDownloadSize(data, size);
+  }
+
+  /* We can resume if we can seek to the resume position */
+  if(data->state.resume_from) {
+    if(data->state.resume_from < 0) {
+      /* We are supposed to download the last abs(from) bytes */
+      if((curl_off_t)attrs.filesize < -data->state.resume_from) {
+        failf(data, "Offset (%" FMT_OFF_T ") was beyond file size (%"
+              FMT_OFF_T ")",
+              data->state.resume_from, (curl_off_t)attrs.filesize);
+        return CURLE_BAD_DOWNLOAD_RESUME;
+      }
+      /* download from where? */
+      data->state.resume_from += attrs.filesize;
+    }
+    else {
+      if((curl_off_t)attrs.filesize < data->state.resume_from) {
+        failf(data, "Offset (%" FMT_OFF_T
+              ") was beyond file size (%" FMT_OFF_T ")",
+              data->state.resume_from, (curl_off_t)attrs.filesize);
+        return CURLE_BAD_DOWNLOAD_RESUME;
+      }
+    }
+    /* Now store the number of bytes we are expected to download */
+    data->req.size = attrs.filesize - data->state.resume_from;
+    data->req.maxdownload = attrs.filesize - data->state.resume_from;
+    Curl_pgrsSetDownloadSize(data, attrs.filesize - data->state.resume_from);
+    libssh2_sftp_seek64(sshc->sftp_handle,
+                        (libssh2_uint64_t)data->state.resume_from);
+  }
+
+  /* Setup the actual download */
+  if(data->req.size == 0) {
+    /* no data to transfer */
+    Curl_xfer_setup_nop(data);
+    infof(data, "SSH: file already completely downloaded");
+    myssh_to(data, sshc, SSH_STOP);
+    return CURLE_OK;
+  }
+  Curl_xfer_setup_recv(data, FIRSTSOCKET, data->req.size);
+
+  /* not set by Curl_xfer_setup to preserve io_flags */
+  data->conn->send_idx = 0;
+
+  myssh_to(data, sshc, SSH_STOP);
+
+  return CURLE_OK;
+}
+
+static CURLcode sftp_readdir(struct Curl_easy *data,
+                             struct ssh_conn *sshc,
+                             struct SSHPROTO *sshp,
+                             bool *blockp)
 {
   CURLcode result = CURLE_OK;
+  int rc = libssh2_sftp_readdir_ex(sshc->sftp_handle,
+                                   sshp->readdir_filename, CURL_PATH_MAX,
+                                   sshp->readdir_longentry, CURL_PATH_MAX,
+                                   &sshp->readdir_attrs);
+  if(rc == LIBSSH2_ERROR_EAGAIN) {
+    *blockp = TRUE;
+    return result;
+  }
+  if(rc > 0) {
+    size_t readdir_len = (size_t)rc;
+    sshp->readdir_filename[readdir_len] = '\0';
+
+    if(data->set.list_only) {
+      result = Curl_client_write(data, CLIENTWRITE_BODY,
+                                 sshp->readdir_filename,
+                                 readdir_len);
+      if(!result)
+        result = Curl_client_write(data, CLIENTWRITE_BODY, "\n", 1);
+      if(result)
+        return result;
+    }
+    else {
+      result = curlx_dyn_add(&sshp->readdir, sshp->readdir_longentry);
+
+      if(!result) {
+        if((sshp->readdir_attrs.flags & LIBSSH2_SFTP_ATTR_PERMISSIONS) &&
+           ((sshp->readdir_attrs.permissions & LIBSSH2_SFTP_S_IFMT) ==
+            LIBSSH2_SFTP_S_IFLNK)) {
+          result = curlx_dyn_addf(&sshp->readdir_link, "%s%s", sshp->path,
+                                  sshp->readdir_filename);
+          myssh_to(data, sshc, SSH_SFTP_READDIR_LINK);
+        }
+        else {
+          myssh_to(data, sshc, SSH_SFTP_READDIR_BOTTOM);
+        }
+      }
+      return result;
+    }
+  }
+  else if(!rc) {
+    myssh_to(data, sshc, SSH_SFTP_READDIR_DONE);
+  }
+  else {
+    unsigned long sftperr = libssh2_sftp_last_error(sshc->sftp_session);
+    result = sftperr ? sftp_libssh2_error_to_CURLE(sftperr) : CURLE_SSH;
+    failf(data, "Could not open remote file for reading: %s :: %d",
+          sftp_libssh2_strerror(sftperr),
+          libssh2_session_last_errno(sshc->ssh_session));
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
+  }
+  return result;
+}
+
+static CURLcode ssh_state_init(struct Curl_easy *data,
+                               struct ssh_conn *sshc)
+{
+  CURLcode result;
+  sshc->secondCreateDirs = 0;
+  sshc->nextstate = SSH_NO_STATE;
+
+  /* Set libssh2 to non-blocking, since everything internally is
+     non-blocking */
+  libssh2_session_set_blocking(sshc->ssh_session, 0);
+
+  result = ssh_force_knownhost_key_type(data, sshc);
+  if(result)
+    myssh_to(data, sshc, SSH_SESSION_FREE);
+  else
+    myssh_to(data, sshc, SSH_S_STARTUP);
+  return result;
+}
+
+static CURLcode ssh_state_startup(struct Curl_easy *data,
+                                  struct ssh_conn *sshc)
+{
   struct connectdata *conn = data->conn;
-  struct SSHPROTO *sshp = data->req.p.ssh;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-  curl_socket_t sock = conn->sock[FIRSTSOCKET];
-  int rc = LIBSSH2_ERROR_NONE;
-  int ssherr;
-  unsigned long sftperr;
-  int seekerr = CURL_SEEKFUNC_OK;
-  size_t readdir_len;
-  *block = 0; /* we're not blocking by default */
+  int rc = libssh2_session_handshake(sshc->ssh_session,
+                                     conn->sock[FIRSTSOCKET]);
+  if(rc == LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+
+  if(rc) {
+    char *err_msg = NULL;
+    (void)libssh2_session_last_error(sshc->ssh_session, &err_msg, NULL, 0);
+    failf(data, "Failure establishing ssh session: %d, %s", rc, err_msg);
+
+    myssh_to(data, sshc, SSH_SESSION_FREE);
+    return CURLE_FAILED_INIT;
+  }
+
+  myssh_to(data, sshc, SSH_HOSTKEY);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_hostkey(struct Curl_easy *data,
+                                  struct ssh_conn *sshc)
+{
+  /*
+   * Before we authenticate we should check the hostkey's fingerprint
+   * against our known hosts. How that is handled (reading from file,
+   * whatever) is up to us.
+   */
+  CURLcode result = ssh_check_fingerprint(data, sshc);
+  if(!result)
+    myssh_to(data, sshc, SSH_AUTHLIST);
+  return result;
+}
+
+static CURLcode ssh_state_authlist(struct Curl_easy *data,
+                                   struct ssh_conn *sshc)
+{
+  /*
+   * Figure out authentication methods
+   * NB: As soon as we have provided a username to an openssh server we
+   * must never change it later. Thus, always specify the correct username
+   * here, even though the libssh2 docs kind of indicate that it should be
+   * possible to get a 'generic' list (not user-specific) of authentication
+   * methods, presumably with a blank username. That does not work in my
+   * experience.
+   * Therefore always specify it here.
+   */
+  struct connectdata *conn = data->conn;
+  const char *user = Curl_creds_user(conn->creds);
+  sshc->authlist = libssh2_userauth_list(sshc->ssh_session,
+                                         user, curlx_uztoui(strlen(user)));
+
+  if(!sshc->authlist) {
+    int rc;
+    if(libssh2_userauth_authenticated(sshc->ssh_session)) {
+      sshc->authed = TRUE;
+      infof(data, "SSH: user accepted with no authentication");
+      myssh_to(data, sshc, SSH_AUTH_DONE);
+      return CURLE_OK;
+    }
+    rc = libssh2_session_last_errno(sshc->ssh_session);
+    if(rc == LIBSSH2_ERROR_EAGAIN)
+      return CURLE_AGAIN;
+
+    myssh_to(data, sshc, SSH_SESSION_FREE);
+    return libssh2_session_error_to_CURLE(rc);
+  }
+  infof(data, "SSH: host offers authentication via: %s", sshc->authlist);
+
+  myssh_to(data, sshc, SSH_AUTH_PKEY_INIT);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_auth_pkey(struct Curl_easy *data,
+                                    struct ssh_conn *sshc)
+{
+  /* The function below checks if the files exists, no need to stat() here.
+   */
+  struct connectdata *conn = data->conn;
+  const char *user = Curl_creds_user(conn->creds);
+  int rc =
+    libssh2_userauth_publickey_fromfile_ex(sshc->ssh_session,
+                                           user,
+                                           curlx_uztoui(strlen(user)),
+                                           sshc->rsa_pub,
+                                           sshc->rsa, sshc->passphrase);
+  if(rc == LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+
+  curlx_safefree(sshc->rsa_pub);
+  curlx_safefree(sshc->rsa);
+
+  if(rc == 0) {
+    sshc->authed = TRUE;
+    infof(data, "SSH: authenticated via publickey");
+    myssh_to(data, sshc, SSH_AUTH_DONE);
+  }
+  else {
+    char *err_msg = NULL;
+    char unknown[] = "Reason unknown (-1)";
+    if(rc == -1) {
+      /* No error message has been set and the last set error message, if
+         any, is from a previous error so ignore it. #11837 */
+      err_msg = unknown;
+    }
+    else {
+      (void)libssh2_session_last_error(sshc->ssh_session, &err_msg, NULL, 0);
+    }
+    infof(data, "SSH: publickey authentication denied: %s", err_msg);
+    myssh_to(data, sshc, SSH_AUTH_PASS_INIT);
+  }
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_auth_pass_init(struct Curl_easy *data,
+                                         struct ssh_conn *sshc)
+{
+  if((data->set.ssh_auth_types & CURLSSH_AUTH_PASSWORD) &&
+     strstr(sshc->authlist, "password")) {
+    myssh_to(data, sshc, SSH_AUTH_PASS);
+  }
+  else {
+    myssh_to(data, sshc, SSH_AUTH_HOST_INIT);
+  }
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_auth_pass(struct Curl_easy *data,
+                                    struct ssh_conn *sshc)
+{
+  struct connectdata *conn = data->conn;
+  const char *user = Curl_creds_user(conn->creds);
+  const char *passwd = Curl_creds_passwd(conn->creds);
+  int rc =
+    libssh2_userauth_password_ex(sshc->ssh_session, user,
+                                 curlx_uztoui(strlen(user)),
+                                 passwd,
+                                 curlx_uztoui(strlen(passwd)),
+                                 NULL);
+  if(rc == LIBSSH2_ERROR_EAGAIN) {
+    return CURLE_AGAIN;
+  }
+  if(rc == 0) {
+    sshc->authed = TRUE;
+    infof(data, "SSH: initialized password authentication");
+    myssh_to(data, sshc, SSH_AUTH_DONE);
+  }
+  else {
+    myssh_to(data, sshc, SSH_AUTH_HOST_INIT);
+  }
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_auth_host_init(struct Curl_easy *data,
+                                         struct ssh_conn *sshc)
+{
+  if((data->set.ssh_auth_types & CURLSSH_AUTH_HOST) &&
+     strstr(sshc->authlist, "hostbased")) {
+    myssh_to(data, sshc, SSH_AUTH_HOST);
+  }
+  else {
+    myssh_to(data, sshc, SSH_AUTH_AGENT_INIT);
+  }
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_auth_agent_init(struct Curl_easy *data,
+                                          struct ssh_conn *sshc)
+{
+  int rc = 0;
+  if((data->set.ssh_auth_types & CURLSSH_AUTH_AGENT) &&
+     strstr(sshc->authlist, "publickey")) {
+
+    infof(data, "SSH: trying publickey authentication via agent");
+    /* Connect to the ssh-agent */
+    /* The agent could be shared by a curl thread i believe
+       but nothing obvious as keys can be added/removed at any time */
+    if(!sshc->ssh_agent) {
+      sshc->ssh_agent = libssh2_agent_init(sshc->ssh_session);
+      if(!sshc->ssh_agent) {
+        infof(data, "SSH: could not create agent object");
+
+        myssh_to(data, sshc, SSH_AUTH_KEY_INIT);
+        return CURLE_OK;
+      }
+    }
+
+    rc = libssh2_agent_connect(sshc->ssh_agent);
+    if(rc == LIBSSH2_ERROR_EAGAIN)
+      return CURLE_AGAIN;
+    if(rc < 0) {
+      infof(data, "SSH: failure connecting to agent");
+      myssh_to(data, sshc, SSH_AUTH_KEY_INIT);
+    }
+    else {
+      myssh_to(data, sshc, SSH_AUTH_AGENT_LIST);
+    }
+  }
+  else
+    myssh_to(data, sshc, SSH_AUTH_KEY_INIT);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_auth_agent_list(struct Curl_easy *data,
+                                          struct ssh_conn *sshc)
+{
+  int rc = libssh2_agent_list_identities(sshc->ssh_agent);
+
+  if(rc == LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+  if(rc < 0) {
+    infof(data, "SSH: failure requesting identities to agent");
+    myssh_to(data, sshc, SSH_AUTH_KEY_INIT);
+  }
+  else {
+    myssh_to(data, sshc, SSH_AUTH_AGENT);
+    sshc->sshagent_prev_identity = NULL;
+  }
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_auth_agent(struct Curl_easy *data,
+                                     struct ssh_conn *sshc)
+{
+  /* as prev_identity evolves only after an identity user auth finished we
+     can safely request it again as long as EAGAIN is returned here or by
+     libssh2_agent_userauth */
+  int rc = libssh2_agent_get_identity(sshc->ssh_agent,
+                                      &sshc->sshagent_identity,
+                                      sshc->sshagent_prev_identity);
+  if(rc == LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+
+  if(rc == 0) {
+    CURL_TRC_SSH(data, "[SSH_AUTH_AGENT_LIST] auth user '%s' for key '%s'",
+                 Curl_creds_user(data->conn->creds),
+                 sshc->sshagent_identity->comment);
+    rc = libssh2_agent_userauth(sshc->ssh_agent,
+                                Curl_creds_user(data->conn->creds),
+                                sshc->sshagent_identity);
+
+    if(rc < 0) {
+      if(rc != LIBSSH2_ERROR_EAGAIN) {
+        /* tried and failed? go to next identity */
+        sshc->sshagent_prev_identity = sshc->sshagent_identity;
+        return CURLE_OK;
+      }
+      return CURLE_AGAIN;
+    }
+  }
+
+  if(rc < 0)
+    infof(data, "SSH: failure requesting identities to agent");
+  else if(rc == 1)
+    infof(data, "SSH: no agent identity would match");
+
+  if(rc == LIBSSH2_ERROR_NONE) {
+    sshc->authed = TRUE;
+    infof(data, "SSH: agent authenticated user '%s' with key '%s'",
+          Curl_creds_user(data->conn->creds),
+          sshc->sshagent_identity->comment);
+    myssh_to(data, sshc, SSH_AUTH_DONE);
+  }
+  else {
+    myssh_to(data, sshc, SSH_AUTH_KEY_INIT);
+  }
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_auth_key_init(struct Curl_easy *data,
+                                        struct ssh_conn *sshc)
+{
+  if((data->set.ssh_auth_types & CURLSSH_AUTH_KEYBOARD) &&
+     strstr(sshc->authlist, "keyboard-interactive")) {
+    myssh_to(data, sshc, SSH_AUTH_KEY);
+  }
+  else {
+    myssh_to(data, sshc, SSH_AUTH_DONE);
+  }
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_auth_key(struct Curl_easy *data,
+                                   struct ssh_conn *sshc)
+{
+  /* Authentication failed. Continue with keyboard-interactive now. */
+  struct connectdata *conn = data->conn;
+  const char *user = Curl_creds_user(conn->creds);
+  int rc =
+    libssh2_userauth_keyboard_interactive_ex(sshc->ssh_session,
+                                             user, curlx_uztoui(strlen(user)),
+                                             &kbd_callback);
+  if(rc == LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+
+  if(rc == 0) {
+    sshc->authed = TRUE;
+    infof(data, "SSH: initialized keyboard interactive authentication");
+    myssh_to(data, sshc, SSH_AUTH_DONE);
+    return CURLE_OK;
+  }
+  return CURLE_LOGIN_DENIED;
+}
+
+static CURLcode ssh_state_auth_done(struct Curl_easy *data,
+                                    struct ssh_conn *sshc)
+{
+  struct connectdata *conn = data->conn;
+  if(!sshc->authed) {
+    failf(data, "Authentication failure");
+    myssh_to(data, sshc, SSH_SESSION_FREE);
+    return CURLE_LOGIN_DENIED;
+  }
+
+  /*
+   * At this point we have an authenticated ssh session.
+   */
+  infof(data, "SSH: authentication complete");
+
+  Curl_pgrsTime(data, TIMER_APPCONNECT); /* SSH is connected */
+
+  data->conn->recv_idx = FIRSTSOCKET;
+  conn->send_idx = -1;
+
+  if(conn->scheme->protocol == CURLPROTO_SFTP) {
+    myssh_to(data, sshc, SSH_SFTP_INIT);
+    return CURLE_OK;
+  }
+  infof(data, "SSH: connection established");
+  myssh_to(data, sshc, SSH_STOP);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_init(struct Curl_easy *data,
+                                    struct ssh_conn *sshc)
+{
+  /*
+   * Start the libssh2 sftp session
+   */
+  sshc->sftp_session = libssh2_sftp_init(sshc->ssh_session);
+  if(!sshc->sftp_session) {
+    char *err_msg = NULL;
+    if(libssh2_session_last_errno(sshc->ssh_session) ==
+       LIBSSH2_ERROR_EAGAIN)
+      return CURLE_AGAIN;
+
+    (void)libssh2_session_last_error(sshc->ssh_session, &err_msg, NULL, 0);
+    failf(data, "Failure initializing sftp session: %s", err_msg);
+    myssh_to(data, sshc, SSH_SESSION_FREE);
+    return CURLE_FAILED_INIT;
+  }
+  myssh_to(data, sshc, SSH_SFTP_REALPATH);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_realpath(struct Curl_easy *data,
+                                        struct ssh_conn *sshc,
+                                        struct SSHPROTO *sshp)
+{
+  /*
+   * Get the "home" directory
+   */
+  int rc;
+
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+
+  rc = libssh2_sftp_symlink_ex(sshc->sftp_session, ".",
+                               curlx_uztoui(strlen(".")),
+                               sshp->readdir_filename, CURL_PATH_MAX,
+                               LIBSSH2_SFTP_REALPATH);
+  if(rc == LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+
+  myssh_to(data, sshc, SSH_STOP);
+  if(rc > 0) {
+    curlx_free(sshc->homedir);
+    sshc->homedir = curlx_strdup(sshp->readdir_filename);
+    if(!sshc->homedir)
+      return CURLE_OUT_OF_MEMORY;
+    curlx_free(data->state.most_recent_ftp_entrypath);
+    data->state.most_recent_ftp_entrypath = curlx_strdup(sshc->homedir);
+    if(!data->state.most_recent_ftp_entrypath)
+      return CURLE_OUT_OF_MEMORY;
+  }
+  else {
+    /* Return the error type */
+    unsigned long sftperr = libssh2_sftp_last_error(sshc->sftp_session);
+    CURLcode result;
+    if(sftperr)
+      result = sftp_libssh2_error_to_CURLE(sftperr);
+    else
+      /* in this case, the error was not in the SFTP level but for example a
+         time-out or similar */
+      result = CURLE_SSH;
+    CURL_TRC_SSH(data, "error = %lu makes libcurl = %d", sftperr, (int)result);
+    return result;
+  }
+
+  /* This is the last step in the SFTP connect phase. Do note that while we
+     get the homedir here, we get the "workingpath" in the DO action since the
+     homedir remains the same between request but the working path does not. */
+  CURL_TRC_SSH(data, "CONNECT phase done");
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_quote_init(struct Curl_easy *data,
+                                          struct ssh_conn *sshc,
+                                          struct SSHPROTO *sshp)
+{
+  CURLcode result;
+
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+
+  result = Curl_getworkingpath(data, sshc->homedir, &sshp->path);
+  if(result) {
+    myssh_to(data, sshc, SSH_STOP);
+    return result;
+  }
+
+  if(data->set.quote) {
+    infof(data, "SSH: sending quote commands");
+    sshc->quote_item = data->set.quote;
+    myssh_to(data, sshc, SSH_SFTP_QUOTE);
+  }
+  else {
+    myssh_to(data, sshc, SSH_SFTP_GETINFO);
+  }
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_postquote_init(struct Curl_easy *data,
+                                              struct ssh_conn *sshc)
+{
+  if(data->set.postquote) {
+    infof(data, "SSH: sending quote commands");
+    sshc->quote_item = data->set.postquote;
+    myssh_to(data, sshc, SSH_SFTP_QUOTE);
+  }
+  else {
+    myssh_to(data, sshc, SSH_STOP);
+  }
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_quote(struct Curl_easy *data,
+                                     struct ssh_conn *sshc,
+                                     struct SSHPROTO *sshp)
+{
+  /* Send quote commands */
+  CURLcode result;
+
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+
+  result = sftp_quote(data, sshc, sshp);
+  if(result) {
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
+    sshc->nextstate = SSH_NO_STATE;
+  }
+  return result;
+}
+
+static CURLcode ssh_state_sftp_next_quote(struct Curl_easy *data,
+                                          struct ssh_conn *sshc)
+{
+  curlx_safefree(sshc->quote_path1);
+  curlx_safefree(sshc->quote_path2);
+
+  sshc->quote_item = sshc->quote_item->next;
+
+  if(sshc->quote_item) {
+    myssh_to(data, sshc, SSH_SFTP_QUOTE);
+  }
+  else {
+    if(sshc->nextstate != SSH_NO_STATE) {
+      myssh_to(data, sshc, sshc->nextstate);
+      sshc->nextstate = SSH_NO_STATE;
+    }
+    else {
+      myssh_to(data, sshc, SSH_SFTP_GETINFO);
+    }
+  }
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_quote_stat(struct Curl_easy *data,
+                                          struct ssh_conn *sshc,
+                                          struct SSHPROTO *sshp,
+                                          bool *blockp)
+{
+  CURLcode result;
+
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+
+  result = sftp_quote_stat(data, sshc, sshp, blockp);
+  if(result) {
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
+    sshc->nextstate = SSH_NO_STATE;
+  }
+  return result;
+}
+
+static CURLcode ssh_state_sftp_quote_setstat(struct Curl_easy *data,
+                                             struct ssh_conn *sshc,
+                                             struct SSHPROTO *sshp)
+{
+  int rc;
+
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+
+  rc = libssh2_sftp_stat_ex(sshc->sftp_session, sshc->quote_path2,
+                            curlx_uztoui(strlen(sshc->quote_path2)),
+                            LIBSSH2_SFTP_SETSTAT,
+                            &sshp->quote_attrs);
+  if(rc == LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+
+  if(rc && !sshc->acceptfail) {
+    unsigned long sftperr = libssh2_sftp_last_error(sshc->sftp_session);
+    failf(data, "Attempt to set SFTP stats for \"%s\" failed: %s",
+          sshc->quote_path2, sftp_libssh2_strerror(sftperr));
+    curlx_safefree(sshc->quote_path1);
+    curlx_safefree(sshc->quote_path2);
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
+    sshc->nextstate = SSH_NO_STATE;
+    return CURLE_QUOTE_ERROR;
+  }
+  myssh_to(data, sshc, SSH_SFTP_NEXT_QUOTE);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_quote_symlink(struct Curl_easy *data,
+                                             struct ssh_conn *sshc)
+{
+  int rc =
+    libssh2_sftp_symlink_ex(sshc->sftp_session, sshc->quote_path1,
+                            curlx_uztoui(strlen(sshc->quote_path1)),
+                            sshc->quote_path2,
+                            curlx_uztoui(strlen(sshc->quote_path2)),
+                            LIBSSH2_SFTP_SYMLINK);
+  if(rc == LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+
+  if(rc && !sshc->acceptfail) {
+    unsigned long sftperr = libssh2_sftp_last_error(sshc->sftp_session);
+    failf(data, "symlink \"%s\" to \"%s\" failed: %s",
+          sshc->quote_path1, sshc->quote_path2,
+          sftp_libssh2_strerror(sftperr));
+    curlx_safefree(sshc->quote_path1);
+    curlx_safefree(sshc->quote_path2);
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
+    sshc->nextstate = SSH_NO_STATE;
+    return CURLE_QUOTE_ERROR;
+  }
+  myssh_to(data, sshc, SSH_SFTP_NEXT_QUOTE);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_quote_mkdir(struct Curl_easy *data,
+                                           struct ssh_conn *sshc)
+{
+  int rc = libssh2_sftp_mkdir_ex(sshc->sftp_session, sshc->quote_path1,
+                                 curlx_uztoui(strlen(sshc->quote_path1)),
+                                 (long)data->set.new_directory_perms);
+  if(rc == LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+
+  if(rc && !sshc->acceptfail) {
+    unsigned long sftperr = libssh2_sftp_last_error(sshc->sftp_session);
+    failf(data, "mkdir \"%s\" failed: %s",
+          sshc->quote_path1, sftp_libssh2_strerror(sftperr));
+    curlx_safefree(sshc->quote_path1);
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
+    sshc->nextstate = SSH_NO_STATE;
+    return CURLE_QUOTE_ERROR;
+  }
+  myssh_to(data, sshc, SSH_SFTP_NEXT_QUOTE);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_quote_rename(struct Curl_easy *data,
+                                            struct ssh_conn *sshc)
+{
+  int rc =
+    libssh2_sftp_rename_ex(sshc->sftp_session, sshc->quote_path1,
+                           curlx_uztoui(strlen(sshc->quote_path1)),
+                           sshc->quote_path2,
+                           curlx_uztoui(strlen(sshc->quote_path2)),
+                           LIBSSH2_SFTP_RENAME_OVERWRITE |
+                           LIBSSH2_SFTP_RENAME_ATOMIC |
+                           LIBSSH2_SFTP_RENAME_NATIVE);
+
+  if(rc == LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+
+  if(rc && !sshc->acceptfail) {
+    unsigned long sftperr = libssh2_sftp_last_error(sshc->sftp_session);
+    failf(data, "rename \"%s\" to \"%s\" failed: %s",
+          sshc->quote_path1, sshc->quote_path2,
+          sftp_libssh2_strerror(sftperr));
+    curlx_safefree(sshc->quote_path1);
+    curlx_safefree(sshc->quote_path2);
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
+    sshc->nextstate = SSH_NO_STATE;
+    return CURLE_QUOTE_ERROR;
+  }
+  myssh_to(data, sshc, SSH_SFTP_NEXT_QUOTE);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_quote_rmdir(struct Curl_easy *data,
+                                           struct ssh_conn *sshc)
+{
+  int rc = libssh2_sftp_rmdir_ex(sshc->sftp_session, sshc->quote_path1,
+                                 curlx_uztoui(strlen(sshc->quote_path1)));
+  if(rc == LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+
+  if(rc && !sshc->acceptfail) {
+    unsigned long sftperr = libssh2_sftp_last_error(sshc->sftp_session);
+    failf(data, "rmdir \"%s\" failed: %s",
+          sshc->quote_path1, sftp_libssh2_strerror(sftperr));
+    curlx_safefree(sshc->quote_path1);
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
+    sshc->nextstate = SSH_NO_STATE;
+    return CURLE_QUOTE_ERROR;
+  }
+  myssh_to(data, sshc, SSH_SFTP_NEXT_QUOTE);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_quote_unlink(struct Curl_easy *data,
+                                            struct ssh_conn *sshc)
+{
+  int rc = libssh2_sftp_unlink_ex(sshc->sftp_session, sshc->quote_path1,
+                                  curlx_uztoui(strlen(sshc->quote_path1)));
+  if(rc == LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+
+  if(rc && !sshc->acceptfail) {
+    unsigned long sftperr = libssh2_sftp_last_error(sshc->sftp_session);
+    failf(data, "rm \"%s\" failed: %s",
+          sshc->quote_path1, sftp_libssh2_strerror(sftperr));
+    curlx_safefree(sshc->quote_path1);
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
+    sshc->nextstate = SSH_NO_STATE;
+    return CURLE_QUOTE_ERROR;
+  }
+  myssh_to(data, sshc, SSH_SFTP_NEXT_QUOTE);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_quote_statvfs(struct Curl_easy *data,
+                                             struct ssh_conn *sshc)
+{
+  LIBSSH2_SFTP_STATVFS statvfs;
+  int rc = libssh2_sftp_statvfs(sshc->sftp_session, sshc->quote_path1,
+                                curlx_uztoui(strlen(sshc->quote_path1)),
+                                &statvfs);
+
+  if(rc == LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+
+  if(rc && !sshc->acceptfail) {
+    unsigned long sftperr = libssh2_sftp_last_error(sshc->sftp_session);
+    failf(data, "statvfs \"%s\" failed: %s",
+          sshc->quote_path1, sftp_libssh2_strerror(sftperr));
+    curlx_safefree(sshc->quote_path1);
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
+    sshc->nextstate = SSH_NO_STATE;
+    return CURLE_QUOTE_ERROR;
+  }
+  else if(rc == 0) {
+#ifdef _MSC_VER
+#define CURL_LIBSSH2_VFS_SIZE_MASK "I64u"
+#else
+#define CURL_LIBSSH2_VFS_SIZE_MASK "llu"
+#endif
+    CURLcode result;
+    char *tmp = curl_maprintf("statvfs:\n"
+                              "f_bsize: %" CURL_LIBSSH2_VFS_SIZE_MASK "\n"
+                              "f_frsize: %" CURL_LIBSSH2_VFS_SIZE_MASK "\n"
+                              "f_blocks: %" CURL_LIBSSH2_VFS_SIZE_MASK "\n"
+                              "f_bfree: %" CURL_LIBSSH2_VFS_SIZE_MASK "\n"
+                              "f_bavail: %" CURL_LIBSSH2_VFS_SIZE_MASK "\n"
+                              "f_files: %" CURL_LIBSSH2_VFS_SIZE_MASK "\n"
+                              "f_ffree: %" CURL_LIBSSH2_VFS_SIZE_MASK "\n"
+                              "f_favail: %" CURL_LIBSSH2_VFS_SIZE_MASK "\n"
+                              "f_fsid: %" CURL_LIBSSH2_VFS_SIZE_MASK "\n"
+                              "f_flag: %" CURL_LIBSSH2_VFS_SIZE_MASK "\n"
+                              "f_namemax: %" CURL_LIBSSH2_VFS_SIZE_MASK "\n",
+                              statvfs.f_bsize, statvfs.f_frsize,
+                              statvfs.f_blocks, statvfs.f_bfree,
+                              statvfs.f_bavail, statvfs.f_files,
+                              statvfs.f_ffree, statvfs.f_favail,
+                              statvfs.f_fsid, statvfs.f_flag,
+                              statvfs.f_namemax);
+    if(!tmp) {
+      myssh_to(data, sshc, SSH_SFTP_CLOSE);
+      sshc->nextstate = SSH_NO_STATE;
+      return CURLE_OUT_OF_MEMORY;
+    }
+
+    result = Curl_client_write(data, CLIENTWRITE_HEADER, tmp, strlen(tmp));
+    curlx_free(tmp);
+    if(result) {
+      myssh_to(data, sshc, SSH_SFTP_CLOSE);
+      sshc->nextstate = SSH_NO_STATE;
+      return result;
+    }
+  }
+  myssh_to(data, sshc, SSH_SFTP_NEXT_QUOTE);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_create_dirs_mkdir(struct Curl_easy *data,
+                                                 struct ssh_conn *sshc,
+                                                 struct SSHPROTO *sshp)
+{
+  /* 'mode' - parameter is preliminary - default to 0644 */
+  int rc;
+
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+
+  rc = libssh2_sftp_mkdir_ex(sshc->sftp_session, sshp->path,
+                             curlx_uztoui(strlen(sshp->path)),
+                             (long)data->set.new_directory_perms);
+  if(rc == LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+
+  *sshc->slash_pos = '/';
+  ++sshc->slash_pos;
+  if(rc < 0) {
+    /*
+     * Abort if failure was not that the directory already exists or
+     * the permission was denied (creation might succeed further down
+     * the path) - retry on unspecific FAILURE also
+     */
+    unsigned long sftperr = libssh2_sftp_last_error(sshc->sftp_session);
+    if((sftperr != LIBSSH2_FX_FILE_ALREADY_EXISTS) &&
+       (sftperr != LIBSSH2_FX_FAILURE) &&
+       (sftperr != LIBSSH2_FX_PERMISSION_DENIED)) {
+      myssh_to(data, sshc, SSH_SFTP_CLOSE);
+      return sftp_libssh2_error_to_CURLE(sftperr);
+    }
+  }
+  myssh_to(data, sshc, SSH_SFTP_CREATE_DIRS);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_readdir_init(struct Curl_easy *data,
+                                            struct ssh_conn *sshc,
+                                            struct SSHPROTO *sshp)
+{
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+
+  Curl_pgrsSetDownloadSize(data, -1);
+  if(data->req.no_body) {
+    myssh_to(data, sshc, SSH_STOP);
+    return CURLE_OK;
+  }
+
+  /*
+   * This is a directory that we are trying to get, so produce a directory
+   * listing
+   */
+  sshc->sftp_handle =
+    libssh2_sftp_open_ex(sshc->sftp_session, sshp->path,
+                         curlx_uztoui(strlen(sshp->path)),
+                         0, 0, LIBSSH2_SFTP_OPENDIR);
+  if(!sshc->sftp_handle) {
+    unsigned long sftperr;
+    if(libssh2_session_last_errno(sshc->ssh_session) == LIBSSH2_ERROR_EAGAIN)
+      return CURLE_AGAIN;
+
+    sftperr = libssh2_sftp_last_error(sshc->sftp_session);
+    failf(data, "Could not open directory for reading: %s",
+          sftp_libssh2_strerror(sftperr));
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
+    return sftp_libssh2_error_to_CURLE(sftperr);
+  }
+  myssh_to(data, sshc, SSH_SFTP_READDIR);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_readdir_link(struct Curl_easy *data,
+                                            struct ssh_conn *sshc,
+                                            struct SSHPROTO *sshp)
+{
+  CURLcode result;
+  int rc;
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+
+  rc = libssh2_sftp_symlink_ex(sshc->sftp_session,
+                               curlx_dyn_ptr(&sshp->readdir_link),
+                               (unsigned int)
+                               curlx_dyn_len(&sshp->readdir_link),
+                               sshp->readdir_filename,
+                               CURL_PATH_MAX, LIBSSH2_SFTP_READLINK);
+  if(rc == LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+
+  curlx_dyn_free(&sshp->readdir_link);
+
+  if(rc < 0)
+    return CURLE_OUT_OF_MEMORY;
+
+  /* append filename and extra output */
+  result = curlx_dyn_addf(&sshp->readdir, " -> %s", sshp->readdir_filename);
+  if(result)
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
+  else
+    myssh_to(data, sshc, SSH_SFTP_READDIR_BOTTOM);
+  return result;
+}
+
+static CURLcode ssh_state_scp_download_init(struct Curl_easy *data,
+                                            struct ssh_conn *sshc,
+                                            struct SSHPROTO *sshp)
+{
+  curl_off_t bytecount;
+  libssh2_struct_stat sb;
+
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+  /*
+   * We must check the remote file; if it is a directory no values are
+   * be set in sb
+   */
+
+  /*
+   * If support for >2GB files exists, use it.
+   */
+
+  /* get a fresh new channel from the ssh layer */
+  memset(&sb, 0, sizeof(libssh2_struct_stat));
+  sshc->ssh_channel = libssh2_scp_recv2(sshc->ssh_session, sshp->path, &sb);
+  if(!sshc->ssh_channel) {
+    int ssh_err;
+    char *err_msg = NULL;
+
+    if(libssh2_session_last_errno(sshc->ssh_session) ==
+       LIBSSH2_ERROR_EAGAIN)
+      return CURLE_AGAIN;
+
+    ssh_err = libssh2_session_last_error(sshc->ssh_session, &err_msg, NULL, 0);
+    failf(data, "%s", err_msg);
+    myssh_to(data, sshc, SSH_SCP_CHANNEL_FREE);
+    return libssh2_session_error_to_CURLE(ssh_err);
+  }
+
+  /* download data */
+  bytecount = (curl_off_t)sb.st_size;
+  data->req.maxdownload = (curl_off_t)sb.st_size;
+  Curl_xfer_setup_recv(data, FIRSTSOCKET, bytecount);
+
+  /* not set by Curl_xfer_setup to preserve io_flags */
+  data->conn->send_idx = 0;
+
+  myssh_to(data, sshc, SSH_STOP);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_close(struct Curl_easy *data,
+                                     struct ssh_conn *sshc,
+                                     struct SSHPROTO *sshp)
+{
+  int rc = 0;
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+  if(sshc->sftp_handle) {
+    rc = libssh2_sftp_close(sshc->sftp_handle);
+    if(rc == LIBSSH2_ERROR_EAGAIN)
+      return CURLE_AGAIN;
+
+    if(rc < 0) {
+      char *err_msg = NULL;
+      (void)libssh2_session_last_error(sshc->ssh_session, &err_msg, NULL, 0);
+      infof(data, "Failed to close libssh2 file: %d %s", rc, err_msg);
+    }
+    sshc->sftp_handle = NULL;
+  }
+
+  curlx_safefree(sshp->path);
+
+  CURL_TRC_SSH(data, "SFTP DONE done");
+
+  /* Check if nextstate is set and move .nextstate could be POSTQUOTE_INIT
+     After nextstate is executed, the control should come back to
+     SSH_SFTP_CLOSE to pass the correct result back */
+  if(sshc->nextstate != SSH_NO_STATE &&
+     sshc->nextstate != SSH_SFTP_CLOSE) {
+    myssh_to(data, sshc, sshc->nextstate);
+    sshc->nextstate = SSH_SFTP_CLOSE;
+  }
+  else
+    myssh_to(data, sshc, SSH_STOP);
+
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_shutdown(struct Curl_easy *data,
+                                        struct ssh_conn *sshc)
+{
+  /* during times we get here due to a broken transfer and then the
+     sftp_handle might not have been taken down so make sure that is done
+     before we proceed */
+  int rc = 0;
+  if(sshc->sftp_handle) {
+    rc = libssh2_sftp_close(sshc->sftp_handle);
+    if(rc == LIBSSH2_ERROR_EAGAIN)
+      return CURLE_AGAIN;
+
+    if(rc < 0) {
+      char *err_msg = NULL;
+      (void)libssh2_session_last_error(sshc->ssh_session, &err_msg, NULL, 0);
+      infof(data, "Failed to close libssh2 file: %d %s", rc, err_msg);
+    }
+    sshc->sftp_handle = NULL;
+  }
+  if(sshc->sftp_session) {
+    rc = libssh2_sftp_shutdown(sshc->sftp_session);
+    if(rc == LIBSSH2_ERROR_EAGAIN)
+      return CURLE_AGAIN;
+
+    if(rc < 0) {
+      infof(data, "Failed to stop libssh2 sftp subsystem");
+    }
+    sshc->sftp_session = NULL;
+  }
+
+  curlx_safefree(sshc->homedir);
+
+  myssh_to(data, sshc, SSH_SESSION_DISCONNECT);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_download_init(struct Curl_easy *data,
+                                             struct ssh_conn *sshc,
+                                             struct SSHPROTO *sshp)
+{
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+  /*
+   * Work on getting the specified file
+   */
+  sshc->sftp_handle =
+    libssh2_sftp_open_ex(sshc->sftp_session, sshp->path,
+                         curlx_uztoui(strlen(sshp->path)),
+                         LIBSSH2_FXF_READ, (long)data->set.new_file_perms,
+                         LIBSSH2_SFTP_OPENFILE);
+  if(!sshc->sftp_handle) {
+    unsigned long sftperr;
+    if(libssh2_session_last_errno(sshc->ssh_session) ==
+       LIBSSH2_ERROR_EAGAIN) {
+      return CURLE_AGAIN;
+    }
+    sftperr = libssh2_sftp_last_error(sshc->sftp_session);
+    failf(data, "Could not open remote file for reading: %s",
+          sftp_libssh2_strerror(sftperr));
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
+    return sftp_libssh2_error_to_CURLE(sftperr);
+  }
+  myssh_to(data, sshc, SSH_SFTP_DOWNLOAD_STAT);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_scp_upload_init(struct Curl_easy *data,
+                                          struct ssh_conn *sshc,
+                                          struct SSHPROTO *sshp)
+{
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+  /*
+   * libssh2 requires that the destination path is a full path that
+   * includes the destination file and name OR ends in a "/" . If this is
+   * not done the destination file is named the same name as the last
+   * directory in the path.
+   */
+  sshc->ssh_channel =
+    libssh2_scp_send64(sshc->ssh_session, sshp->path,
+                       (int)data->set.new_file_perms,
+                       (libssh2_int64_t)data->state.infilesize, 0, 0);
+  if(!sshc->ssh_channel) {
+    int ssh_err;
+    char *err_msg = NULL;
+    CURLcode result;
+    if(libssh2_session_last_errno(sshc->ssh_session) ==
+       LIBSSH2_ERROR_EAGAIN)
+      return CURLE_AGAIN;
+
+    ssh_err = libssh2_session_last_error(sshc->ssh_session, &err_msg, NULL, 0);
+    failf(data, "%s", err_msg);
+    myssh_to(data, sshc, SSH_SCP_CHANNEL_FREE);
+    result = libssh2_session_error_to_CURLE(ssh_err);
+
+    /* Map generic errors to upload failed */
+    if(result == CURLE_SSH ||
+       result == CURLE_REMOTE_FILE_NOT_FOUND)
+      result = CURLE_UPLOAD_FAILED;
+    return result;
+  }
+
+  /* upload data */
+  data->req.size = data->state.infilesize;
+  Curl_pgrsSetUploadSize(data, data->state.infilesize);
+  Curl_xfer_setup_send(data, FIRSTSOCKET);
+
+  /* not set by Curl_xfer_setup to preserve io_flags */
+  data->conn->recv_idx = FIRSTSOCKET;
+
+  myssh_to(data, sshc, SSH_STOP);
+
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_session_disconnect(struct Curl_easy *data,
+                                             struct ssh_conn *sshc)
+{
+  /* during weird times when we have been prematurely aborted, the channel
+     is still alive when we reach this state and we MUST kill the channel
+     properly first */
+  int rc = 0;
+  if(sshc->ssh_channel) {
+    rc = libssh2_channel_free(sshc->ssh_channel);
+    if(rc == LIBSSH2_ERROR_EAGAIN)
+      return CURLE_AGAIN;
+
+    if(rc < 0) {
+      char *err_msg = NULL;
+      (void)libssh2_session_last_error(sshc->ssh_session, &err_msg, NULL, 0);
+      infof(data, "Failed to free libssh2 scp subsystem: %d %s", rc, err_msg);
+    }
+    sshc->ssh_channel = NULL;
+  }
+
+  if(sshc->ssh_session) {
+    rc = libssh2_session_disconnect(sshc->ssh_session, "Shutdown");
+    if(rc == LIBSSH2_ERROR_EAGAIN)
+      return CURLE_AGAIN;
+
+    if(rc < 0) {
+      char *err_msg = NULL;
+      (void)libssh2_session_last_error(sshc->ssh_session, &err_msg, NULL, 0);
+      infof(data, "Failed to disconnect libssh2 session: %d %s", rc, err_msg);
+    }
+  }
+
+  curlx_safefree(sshc->homedir);
+
+  myssh_to(data, sshc, SSH_SESSION_FREE);
+  return CURLE_OK;
+}
+
+static CURLcode sshc_cleanup(struct ssh_conn *sshc, struct Curl_easy *data,
+                             bool block)
+{
+  int rc;
+
+  if(sshc->kh) {
+    libssh2_knownhost_free(sshc->kh);
+    sshc->kh = NULL;
+  }
+
+  if(sshc->ssh_agent) {
+    rc = libssh2_agent_disconnect(sshc->ssh_agent);
+    if((rc < 0) && data) {
+      char *err_msg = NULL;
+      (void)libssh2_session_last_error(sshc->ssh_session, &err_msg, NULL, 0);
+      infof(data, "Failed to disconnect from libssh2 agent: %d %s",
+            rc, err_msg);
+    }
+    if(!block && (rc == LIBSSH2_ERROR_EAGAIN))
+      return CURLE_AGAIN;
+
+    libssh2_agent_free(sshc->ssh_agent);
+    sshc->ssh_agent = NULL;
+
+    /* NB: there is no need to free identities, they are part of internal
+       agent stuff */
+    sshc->sshagent_identity = NULL;
+    sshc->sshagent_prev_identity = NULL;
+  }
+
+  if(sshc->sftp_handle) {
+    rc = libssh2_sftp_close(sshc->sftp_handle);
+    if((rc < 0) && data) {
+      char *err_msg = NULL;
+      (void)libssh2_session_last_error(sshc->ssh_session, &err_msg, NULL, 0);
+      infof(data, "Failed to close libssh2 file: %d %s", rc, err_msg);
+    }
+    if(!block && (rc == LIBSSH2_ERROR_EAGAIN))
+      return CURLE_AGAIN;
+
+    sshc->sftp_handle = NULL;
+  }
+
+  if(sshc->ssh_channel) {
+    rc = libssh2_channel_free(sshc->ssh_channel);
+    if((rc < 0) && data) {
+      char *err_msg = NULL;
+      (void)libssh2_session_last_error(sshc->ssh_session, &err_msg, NULL, 0);
+      infof(data, "Failed to free libssh2 scp subsystem: %d %s", rc, err_msg);
+    }
+    if(!block && (rc == LIBSSH2_ERROR_EAGAIN))
+      return CURLE_AGAIN;
+
+    sshc->ssh_channel = NULL;
+  }
+
+  if(sshc->sftp_session) {
+    rc = libssh2_sftp_shutdown(sshc->sftp_session);
+    if((rc < 0) && data) {
+      char *err_msg = NULL;
+      (void)libssh2_session_last_error(sshc->ssh_session, &err_msg, NULL, 0);
+      infof(data, "Failed to stop libssh2 sftp subsystem: %d %s", rc, err_msg);
+    }
+    if(!block && (rc == LIBSSH2_ERROR_EAGAIN))
+      return CURLE_AGAIN;
+
+    sshc->sftp_session = NULL;
+  }
+
+  if(sshc->ssh_session) {
+    rc = libssh2_session_free(sshc->ssh_session);
+    if((rc < 0) && data) {
+      char *err_msg = NULL;
+      (void)libssh2_session_last_error(sshc->ssh_session, &err_msg, NULL, 0);
+      infof(data, "Failed to free libssh2 session: %d %s", rc, err_msg);
+    }
+    if(!block && (rc == LIBSSH2_ERROR_EAGAIN))
+      return CURLE_AGAIN;
+
+    sshc->ssh_session = NULL;
+  }
+
+  /* worst-case scenario cleanup */
+  DEBUGASSERT(!sshc->ssh_session);
+  DEBUGASSERT(!sshc->ssh_channel);
+  DEBUGASSERT(!sshc->sftp_session);
+  DEBUGASSERT(!sshc->sftp_handle);
+  DEBUGASSERT(!sshc->kh);
+  DEBUGASSERT(!sshc->ssh_agent);
+
+  curlx_safefree(sshc->rsa_pub);
+  curlx_safefree(sshc->rsa);
+  curlx_safefree(sshc->quote_path1);
+  curlx_safefree(sshc->quote_path2);
+  curlx_safefree(sshc->homedir);
+
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_getinfo(struct Curl_easy *data,
+                                       struct ssh_conn *sshc)
+{
+  if(data->set.get_filetime)
+    myssh_to(data, sshc, SSH_SFTP_FILETIME);
+  else
+    myssh_to(data, sshc, SSH_SFTP_TRANS_INIT);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_filetime(struct Curl_easy *data,
+                                        struct ssh_conn *sshc,
+                                        struct SSHPROTO *sshp)
+{
+  LIBSSH2_SFTP_ATTRIBUTES attrs;
+  int rc;
+
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+
+  rc = libssh2_sftp_stat_ex(sshc->sftp_session, sshp->path,
+                            curlx_uztoui(strlen(sshp->path)),
+                            LIBSSH2_SFTP_STAT, &attrs);
+  if(rc == LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+
+  if(rc == 0)
+    data->info.filetime = (time_t)attrs.mtime;
+
+  myssh_to(data, sshc, SSH_SFTP_TRANS_INIT);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_trans_init(struct Curl_easy *data,
+                                          struct ssh_conn *sshc,
+                                          struct SSHPROTO *sshp)
+{
+  if(data->state.upload)
+    myssh_to(data, sshc, SSH_SFTP_UPLOAD_INIT);
+  else if(sshp) {
+    size_t plen = strlen(sshp->path);
+    if(plen && (sshp->path[plen - 1] == '/'))
+      myssh_to(data, sshc, SSH_SFTP_READDIR_INIT);
+    else
+      myssh_to(data, sshc, SSH_SFTP_DOWNLOAD_INIT);
+  }
+  else
+    return CURLE_FAILED_INIT;
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_upload_init(struct Curl_easy *data,
+                                           struct ssh_conn *sshc,
+                                           struct SSHPROTO *sshp,
+                                           bool *block)
+{
+  CURLcode result;
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+  result = sftp_upload_init(data, sshc, sshp, block);
+  if(result) {
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
+    sshc->nextstate = SSH_NO_STATE;
+  }
+  return result;
+}
+
+static CURLcode ssh_state_sftp_create_dirs_init(struct Curl_easy *data,
+                                                struct ssh_conn *sshc,
+                                                struct SSHPROTO *sshp)
+{
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+  if(strlen(sshp->path) > 1) {
+    sshc->slash_pos = sshp->path + 1; /* ignore the leading '/' */
+    myssh_to(data, sshc, SSH_SFTP_CREATE_DIRS);
+  }
+  else
+    myssh_to(data, sshc, SSH_SFTP_UPLOAD_INIT);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_create_dirs(struct Curl_easy *data,
+                                           struct ssh_conn *sshc,
+                                           struct SSHPROTO *sshp)
+{
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+  sshc->slash_pos = strchr(sshc->slash_pos, '/');
+  if(sshc->slash_pos) {
+    *sshc->slash_pos = 0;
+    infof(data, "SFTP: creating directory '%s'", sshp->path);
+    myssh_to(data, sshc, SSH_SFTP_CREATE_DIRS_MKDIR);
+    return CURLE_OK;
+  }
+  myssh_to(data, sshc, SSH_SFTP_UPLOAD_INIT);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_readdir(struct Curl_easy *data,
+                                       struct ssh_conn *sshc,
+                                       struct SSHPROTO *sshp,
+                                       bool *block)
+{
+  CURLcode result;
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+  result = sftp_readdir(data, sshc, sshp, block);
+  if(result)
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
+  return result;
+}
+
+static CURLcode ssh_state_sftp_readdir_bottom(struct Curl_easy *data,
+                                              struct ssh_conn *sshc,
+                                              struct SSHPROTO *sshp)
+{
+  CURLcode result;
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+
+  result = curlx_dyn_addn(&sshp->readdir, "\n", 1);
+  if(!result)
+    result = Curl_client_write(data, CLIENTWRITE_BODY,
+                               curlx_dyn_ptr(&sshp->readdir),
+                               curlx_dyn_len(&sshp->readdir));
+  if(result) {
+    curlx_dyn_free(&sshp->readdir);
+    myssh_to(data, sshc, SSH_STOP);
+  }
+  else {
+    curlx_dyn_reset(&sshp->readdir);
+    myssh_to(data, sshc, SSH_SFTP_READDIR);
+  }
+  return result;
+}
+
+static CURLcode ssh_state_sftp_readdir_done(struct Curl_easy *data,
+                                            struct ssh_conn *sshc)
+{
+  if(libssh2_sftp_closedir(sshc->sftp_handle) ==
+     LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+
+  sshc->sftp_handle = NULL;
+
+  /* no data to transfer */
+  Curl_xfer_setup_nop(data);
+  myssh_to(data, sshc, SSH_STOP);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_sftp_download_stat(struct Curl_easy *data,
+                                             struct ssh_conn *sshc,
+                                             struct SSHPROTO *sshp,
+                                             bool *block)
+{
+  CURLcode result;
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+  result = sftp_download_stat(data, sshc, sshp, block);
+  if(result) {
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
+    sshc->nextstate = SSH_NO_STATE;
+  }
+  return result;
+}
+
+static CURLcode ssh_state_scp_trans_init(struct Curl_easy *data,
+                                         struct ssh_conn *sshc,
+                                         struct SSHPROTO *sshp)
+{
+  CURLcode result;
+  if(!sshp)
+    return CURLE_FAILED_INIT;
+  result = Curl_getworkingpath(data, sshc->homedir,
+                               &sshp->path);
+  if(result) {
+    myssh_to(data, sshc, SSH_STOP);
+    return result;
+  }
+
+  if(data->state.upload) {
+    if(data->state.infilesize < 0) {
+      failf(data, "SCP requires a known file size for upload");
+      myssh_to(data, sshc, SSH_SCP_CHANNEL_FREE);
+      return CURLE_UPLOAD_FAILED;
+    }
+    myssh_to(data, sshc, SSH_SCP_UPLOAD_INIT);
+  }
+  else
+    myssh_to(data, sshc, SSH_SCP_DOWNLOAD_INIT);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_scp_done(struct Curl_easy *data,
+                                   struct ssh_conn *sshc)
+{
+  if(data->state.upload)
+    myssh_to(data, sshc, SSH_SCP_SEND_EOF);
+  else
+    myssh_to(data, sshc, SSH_SCP_CHANNEL_FREE);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_scp_send_eof(struct Curl_easy *data,
+                                       struct ssh_conn *sshc)
+{
+  if(sshc->ssh_channel) {
+    int rc = libssh2_channel_send_eof(sshc->ssh_channel);
+    if(rc == LIBSSH2_ERROR_EAGAIN)
+      return CURLE_AGAIN;
+    if(rc) {
+      char *err_msg = NULL;
+      (void)libssh2_session_last_error(sshc->ssh_session,
+                                       &err_msg, NULL, 0);
+      infof(data, "Failed to send libssh2 channel EOF: %d %s",
+            rc, err_msg);
+    }
+  }
+  myssh_to(data, sshc, SSH_SCP_WAIT_EOF);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_scp_wait_eof(struct Curl_easy *data,
+                                       struct ssh_conn *sshc)
+{
+  if(sshc->ssh_channel) {
+    int rc = libssh2_channel_wait_eof(sshc->ssh_channel);
+    if(rc == LIBSSH2_ERROR_EAGAIN)
+      return CURLE_AGAIN;
+    if(rc) {
+      char *err_msg = NULL;
+      (void)libssh2_session_last_error(sshc->ssh_session,
+                                       &err_msg, NULL, 0);
+      infof(data, "Failed to get channel EOF: %d %s", rc, err_msg);
+    }
+  }
+  myssh_to(data, sshc, SSH_SCP_WAIT_CLOSE);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_scp_wait_close(struct Curl_easy *data,
+                                         struct ssh_conn *sshc)
+{
+  if(sshc->ssh_channel) {
+    int rc =
+      libssh2_channel_wait_closed(sshc->ssh_channel);
+    if(rc == LIBSSH2_ERROR_EAGAIN)
+      return CURLE_AGAIN;
+    if(rc) {
+      char *err_msg = NULL;
+      (void)libssh2_session_last_error(sshc->ssh_session,
+                                       &err_msg, NULL, 0);
+      infof(data, "Channel failed to close: %d %s", rc, err_msg);
+    }
+  }
+  myssh_to(data, sshc, SSH_SCP_CHANNEL_FREE);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_scp_channel_free(
+  struct Curl_easy *data,
+  struct ssh_conn *sshc)
+{
+  if(sshc->ssh_channel) {
+    int rc = libssh2_channel_free(sshc->ssh_channel);
+    if(rc == LIBSSH2_ERROR_EAGAIN)
+      return CURLE_AGAIN;
+    if(rc < 0) {
+      char *err_msg = NULL;
+      (void)libssh2_session_last_error(sshc->ssh_session,
+                                       &err_msg, NULL, 0);
+      infof(data, "Failed to free libssh2 scp subsystem: %d %s", rc, err_msg);
+    }
+    sshc->ssh_channel = NULL;
+  }
+  CURL_TRC_SSH(data, "SCP DONE phase complete");
+  myssh_to(data, sshc, SSH_STOP);
+  return CURLE_OK;
+}
+
+static CURLcode ssh_state_session_free(struct Curl_easy *data,
+                                       struct ssh_conn *sshc)
+{
+  CURLcode result = sshc_cleanup(sshc, data, FALSE);
+  struct connectdata *conn = data->conn;
+  if(result)
+    return result;
+  memset(sshc, 0, sizeof(struct ssh_conn));
+  connclose(conn, "SSH session free");
+  sshc->state = SSH_SESSION_FREE; /* current */
+  myssh_to(data, sshc, SSH_STOP);
+  return CURLE_OK;
+}
+
+/*
+ * ssh_statemachine() runs the SSH state machine as far as it can without
+ * blocking and without reaching the end. The data the pointer 'block' points
+ * to is set to TRUE if the libssh2 function returns LIBSSH2_ERROR_EAGAIN
+ * meaning it wants to be called again when the socket is ready
+ */
+static CURLcode ssh_statemachine(struct Curl_easy *data,
+                                 struct ssh_conn *sshc,
+                                 struct SSHPROTO *sshp,
+                                 bool *block)
+{
+  CURLcode result = CURLE_OK;
+  *block = 0; /* we are not blocking by default */
 
   do {
     switch(sshc->state) {
     case SSH_INIT:
-      sshc->secondCreateDirs = 0;
-      sshc->nextstate = SSH_NO_STATE;
-      sshc->actualcode = CURLE_OK;
-
-      /* Set libssh2 to non-blocking, since everything internally is
-         non-blocking */
-      libssh2_session_set_blocking(sshc->ssh_session, 0);
-
-      result = ssh_force_knownhost_key_type(data);
-      if(result) {
-        state(data, SSH_SESSION_FREE);
-        sshc->actualcode = result;
+      result = ssh_state_init(data, sshc);
+      if(result)
         break;
-      }
-
-      state(data, SSH_S_STARTUP);
-      /* FALLTHROUGH */
+      FALLTHROUGH();
 
     case SSH_S_STARTUP:
-      rc = session_startup(sshc->ssh_session, sock);
-      if(rc == LIBSSH2_ERROR_EAGAIN) {
+      result = ssh_state_startup(data, sshc);
+      if(result)
         break;
-      }
-      if(rc) {
-        char *err_msg = NULL;
-        (void)libssh2_session_last_error(sshc->ssh_session, &err_msg, NULL, 0);
-        failf(data, "Failure establishing ssh session: %d, %s", rc, err_msg);
+      FALLTHROUGH();
 
-        state(data, SSH_SESSION_FREE);
-        sshc->actualcode = CURLE_FAILED_INIT;
-        break;
-      }
-
-      state(data, SSH_HOSTKEY);
-
-      /* FALLTHROUGH */
     case SSH_HOSTKEY:
-      /*
-       * Before we authenticate we should check the hostkey's fingerprint
-       * against our known hosts. How that is handled (reading from file,
-       * whatever) is up to us.
-       */
-      result = ssh_check_fingerprint(data);
-      if(!result)
-        state(data, SSH_AUTHLIST);
-      /* ssh_check_fingerprint sets state appropriately on error */
+      result = ssh_state_hostkey(data, sshc);
       break;
 
     case SSH_AUTHLIST:
-      /*
-       * Figure out authentication methods
-       * NB: As soon as we have provided a username to an openssh server we
-       * must never change it later. Thus, always specify the correct username
-       * here, even though the libssh2 docs kind of indicate that it should be
-       * possible to get a 'generic' list (not user-specific) of authentication
-       * methods, presumably with a blank username. That won't work in my
-       * experience.
-       * So always specify it here.
-       */
-      sshc->authlist = libssh2_userauth_list(sshc->ssh_session,
-                                             conn->user,
-                                             curlx_uztoui(strlen(conn->user)));
-
-      if(!sshc->authlist) {
-        if(libssh2_userauth_authenticated(sshc->ssh_session)) {
-          sshc->authed = TRUE;
-          infof(data, "SSH user accepted with no authentication");
-          state(data, SSH_AUTH_DONE);
-          break;
-        }
-        ssherr = libssh2_session_last_errno(sshc->ssh_session);
-        if(ssherr == LIBSSH2_ERROR_EAGAIN)
-          rc = LIBSSH2_ERROR_EAGAIN;
-        else {
-          state(data, SSH_SESSION_FREE);
-          sshc->actualcode = libssh2_session_error_to_CURLE(ssherr);
-        }
-        break;
-      }
-      infof(data, "SSH authentication methods available: %s",
-            sshc->authlist);
-
-      state(data, SSH_AUTH_PKEY_INIT);
+      result = ssh_state_authlist(data, sshc);
       break;
 
     case SSH_AUTH_PKEY_INIT:
-      /*
-       * Check the supported auth types in the order I feel is most secure
-       * with the requested type of authentication
-       */
-      sshc->authed = FALSE;
-
-      if((data->set.ssh_auth_types & CURLSSH_AUTH_PUBLICKEY) &&
-         (strstr(sshc->authlist, "publickey") != NULL)) {
-        bool out_of_memory = FALSE;
-
-        sshc->rsa_pub = sshc->rsa = NULL;
-
-        if(data->set.str[STRING_SSH_PRIVATE_KEY])
-          sshc->rsa = strdup(data->set.str[STRING_SSH_PRIVATE_KEY]);
-        else {
-          /* To ponder about: should really the lib be messing about with the
-             HOME environment variable etc? */
-          char *home = curl_getenv("HOME");
-
-          /* If no private key file is specified, try some common paths. */
-          if(home) {
-            /* Try ~/.ssh first. */
-            sshc->rsa = aprintf("%s/.ssh/id_rsa", home);
-            if(!sshc->rsa)
-              out_of_memory = TRUE;
-            else if(access(sshc->rsa, R_OK) != 0) {
-              Curl_safefree(sshc->rsa);
-              sshc->rsa = aprintf("%s/.ssh/id_dsa", home);
-              if(!sshc->rsa)
-                out_of_memory = TRUE;
-              else if(access(sshc->rsa, R_OK) != 0) {
-                Curl_safefree(sshc->rsa);
-              }
-            }
-            free(home);
-          }
-          if(!out_of_memory && !sshc->rsa) {
-            /* Nothing found; try the current dir. */
-            sshc->rsa = strdup("id_rsa");
-            if(sshc->rsa && access(sshc->rsa, R_OK) != 0) {
-              Curl_safefree(sshc->rsa);
-              sshc->rsa = strdup("id_dsa");
-              if(sshc->rsa && access(sshc->rsa, R_OK) != 0) {
-                Curl_safefree(sshc->rsa);
-                /* Out of guesses. Set to the empty string to avoid
-                 * surprising info messages. */
-                sshc->rsa = strdup("");
-              }
-            }
-          }
-        }
-
-        /*
-         * Unless the user explicitly specifies a public key file, let
-         * libssh2 extract the public key from the private key file.
-         * This is done by simply passing sshc->rsa_pub = NULL.
-         */
-        if(data->set.str[STRING_SSH_PUBLIC_KEY]
-           /* treat empty string the same way as NULL */
-           && data->set.str[STRING_SSH_PUBLIC_KEY][0]) {
-          sshc->rsa_pub = strdup(data->set.str[STRING_SSH_PUBLIC_KEY]);
-          if(!sshc->rsa_pub)
-            out_of_memory = TRUE;
-        }
-
-        if(out_of_memory || !sshc->rsa) {
-          Curl_safefree(sshc->rsa);
-          Curl_safefree(sshc->rsa_pub);
-          state(data, SSH_SESSION_FREE);
-          sshc->actualcode = CURLE_OUT_OF_MEMORY;
-          break;
-        }
-
-        sshc->passphrase = data->set.ssl.key_passwd;
-        if(!sshc->passphrase)
-          sshc->passphrase = "";
-
-        if(sshc->rsa_pub)
-          infof(data, "Using SSH public key file '%s'", sshc->rsa_pub);
-        infof(data, "Using SSH private key file '%s'", sshc->rsa);
-
-        state(data, SSH_AUTH_PKEY);
-      }
-      else {
-        state(data, SSH_AUTH_PASS_INIT);
-      }
+      result = ssh_state_pkey_init(data, sshc);
       break;
 
     case SSH_AUTH_PKEY:
-      /* The function below checks if the files exists, no need to stat() here.
-       */
-      rc = libssh2_userauth_publickey_fromfile_ex(sshc->ssh_session,
-                                                  conn->user,
-                                                  curlx_uztoui(
-                                                    strlen(conn->user)),
-                                                  sshc->rsa_pub,
-                                                  sshc->rsa, sshc->passphrase);
-      if(rc == LIBSSH2_ERROR_EAGAIN) {
-        break;
-      }
-
-      Curl_safefree(sshc->rsa_pub);
-      Curl_safefree(sshc->rsa);
-
-      if(rc == 0) {
-        sshc->authed = TRUE;
-        infof(data, "Initialized SSH public key authentication");
-        state(data, SSH_AUTH_DONE);
-      }
-      else {
-        char *err_msg = NULL;
-        (void)libssh2_session_last_error(sshc->ssh_session,
-                                         &err_msg, NULL, 0);
-        infof(data, "SSH public key authentication failed: %s", err_msg);
-        state(data, SSH_AUTH_PASS_INIT);
-        rc = 0; /* clear rc and continue */
-      }
+      result = ssh_state_auth_pkey(data, sshc);
       break;
 
     case SSH_AUTH_PASS_INIT:
-      if((data->set.ssh_auth_types & CURLSSH_AUTH_PASSWORD) &&
-         (strstr(sshc->authlist, "password") != NULL)) {
-        state(data, SSH_AUTH_PASS);
-      }
-      else {
-        state(data, SSH_AUTH_HOST_INIT);
-        rc = 0; /* clear rc and continue */
-      }
+      result = ssh_state_auth_pass_init(data, sshc);
       break;
 
     case SSH_AUTH_PASS:
-      rc = libssh2_userauth_password_ex(sshc->ssh_session, conn->user,
-                                        curlx_uztoui(strlen(conn->user)),
-                                        conn->passwd,
-                                        curlx_uztoui(strlen(conn->passwd)),
-                                        NULL);
-      if(rc == LIBSSH2_ERROR_EAGAIN) {
-        break;
-      }
-      if(rc == 0) {
-        sshc->authed = TRUE;
-        infof(data, "Initialized password authentication");
-        state(data, SSH_AUTH_DONE);
-      }
-      else {
-        state(data, SSH_AUTH_HOST_INIT);
-        rc = 0; /* clear rc and continue */
-      }
+      result = ssh_state_auth_pass(data, sshc);
       break;
 
     case SSH_AUTH_HOST_INIT:
-      if((data->set.ssh_auth_types & CURLSSH_AUTH_HOST) &&
-         (strstr(sshc->authlist, "hostbased") != NULL)) {
-        state(data, SSH_AUTH_HOST);
-      }
-      else {
-        state(data, SSH_AUTH_AGENT_INIT);
-      }
+      result = ssh_state_auth_host_init(data, sshc);
       break;
 
     case SSH_AUTH_HOST:
-      state(data, SSH_AUTH_AGENT_INIT);
+      myssh_to(data, sshc, SSH_AUTH_AGENT_INIT);
       break;
 
     case SSH_AUTH_AGENT_INIT:
-#ifdef HAVE_LIBSSH2_AGENT_API
-      if((data->set.ssh_auth_types & CURLSSH_AUTH_AGENT)
-         && (strstr(sshc->authlist, "publickey") != NULL)) {
-
-        /* Connect to the ssh-agent */
-        /* The agent could be shared by a curl thread i believe
-           but nothing obvious as keys can be added/removed at any time */
-        if(!sshc->ssh_agent) {
-          sshc->ssh_agent = libssh2_agent_init(sshc->ssh_session);
-          if(!sshc->ssh_agent) {
-            infof(data, "Could not create agent object");
-
-            state(data, SSH_AUTH_KEY_INIT);
-            break;
-          }
-        }
-
-        rc = libssh2_agent_connect(sshc->ssh_agent);
-        if(rc == LIBSSH2_ERROR_EAGAIN)
-          break;
-        if(rc < 0) {
-          infof(data, "Failure connecting to agent");
-          state(data, SSH_AUTH_KEY_INIT);
-          rc = 0; /* clear rc and continue */
-        }
-        else {
-          state(data, SSH_AUTH_AGENT_LIST);
-        }
-      }
-      else
-#endif /* HAVE_LIBSSH2_AGENT_API */
-        state(data, SSH_AUTH_KEY_INIT);
+      result = ssh_state_auth_agent_init(data, sshc);
       break;
 
     case SSH_AUTH_AGENT_LIST:
-#ifdef HAVE_LIBSSH2_AGENT_API
-      rc = libssh2_agent_list_identities(sshc->ssh_agent);
-
-      if(rc == LIBSSH2_ERROR_EAGAIN)
-        break;
-      if(rc < 0) {
-        infof(data, "Failure requesting identities to agent");
-        state(data, SSH_AUTH_KEY_INIT);
-        rc = 0; /* clear rc and continue */
-      }
-      else {
-        state(data, SSH_AUTH_AGENT);
-        sshc->sshagent_prev_identity = NULL;
-      }
-#endif
+      result = ssh_state_auth_agent_list(data, sshc);
       break;
 
     case SSH_AUTH_AGENT:
-#ifdef HAVE_LIBSSH2_AGENT_API
-      /* as prev_identity evolves only after an identity user auth finished we
-         can safely request it again as long as EAGAIN is returned here or by
-         libssh2_agent_userauth */
-      rc = libssh2_agent_get_identity(sshc->ssh_agent,
-                                      &sshc->sshagent_identity,
-                                      sshc->sshagent_prev_identity);
-      if(rc == LIBSSH2_ERROR_EAGAIN)
-        break;
-
-      if(rc == 0) {
-        rc = libssh2_agent_userauth(sshc->ssh_agent, conn->user,
-                                    sshc->sshagent_identity);
-
-        if(rc < 0) {
-          if(rc != LIBSSH2_ERROR_EAGAIN) {
-            /* tried and failed? go to next identity */
-            sshc->sshagent_prev_identity = sshc->sshagent_identity;
-          }
-          break;
-        }
-      }
-
-      if(rc < 0)
-        infof(data, "Failure requesting identities to agent");
-      else if(rc == 1)
-        infof(data, "No identity would match");
-
-      if(rc == LIBSSH2_ERROR_NONE) {
-        sshc->authed = TRUE;
-        infof(data, "Agent based authentication successful");
-        state(data, SSH_AUTH_DONE);
-      }
-      else {
-        state(data, SSH_AUTH_KEY_INIT);
-        rc = 0; /* clear rc and continue */
-      }
-#endif
+      result = ssh_state_auth_agent(data, sshc);
       break;
 
     case SSH_AUTH_KEY_INIT:
-      if((data->set.ssh_auth_types & CURLSSH_AUTH_KEYBOARD)
-         && (strstr(sshc->authlist, "keyboard-interactive") != NULL)) {
-        state(data, SSH_AUTH_KEY);
-      }
-      else {
-        state(data, SSH_AUTH_DONE);
-      }
+      result = ssh_state_auth_key_init(data, sshc);
       break;
 
     case SSH_AUTH_KEY:
-      /* Authentication failed. Continue with keyboard-interactive now. */
-      rc = libssh2_userauth_keyboard_interactive_ex(sshc->ssh_session,
-                                                    conn->user,
-                                                    curlx_uztoui(
-                                                      strlen(conn->user)),
-                                                    &kbd_callback);
-      if(rc == LIBSSH2_ERROR_EAGAIN) {
-        break;
-      }
-      if(rc == 0) {
-        sshc->authed = TRUE;
-        infof(data, "Initialized keyboard interactive authentication");
-      }
-      state(data, SSH_AUTH_DONE);
+      result = ssh_state_auth_key(data, sshc);
       break;
 
     case SSH_AUTH_DONE:
-      if(!sshc->authed) {
-        failf(data, "Authentication failure");
-        state(data, SSH_SESSION_FREE);
-        sshc->actualcode = CURLE_LOGIN_DENIED;
-        break;
-      }
-
-      /*
-       * At this point we have an authenticated ssh session.
-       */
-      infof(data, "Authentication complete");
-
-      Curl_pgrsTime(data, TIMER_APPCONNECT); /* SSH is connected */
-
-      conn->sockfd = sock;
-      conn->writesockfd = CURL_SOCKET_BAD;
-
-      if(conn->handler->protocol == CURLPROTO_SFTP) {
-        state(data, SSH_SFTP_INIT);
-        break;
-      }
-      infof(data, "SSH CONNECT phase done");
-      state(data, SSH_STOP);
+      result = ssh_state_auth_done(data, sshc);
       break;
 
     case SSH_SFTP_INIT:
-      /*
-       * Start the libssh2 sftp session
-       */
-      sshc->sftp_session = libssh2_sftp_init(sshc->ssh_session);
-      if(!sshc->sftp_session) {
-        char *err_msg = NULL;
-        if(libssh2_session_last_errno(sshc->ssh_session) ==
-           LIBSSH2_ERROR_EAGAIN) {
-          rc = LIBSSH2_ERROR_EAGAIN;
-          break;
-        }
-
-        (void)libssh2_session_last_error(sshc->ssh_session,
-                                         &err_msg, NULL, 0);
-        failf(data, "Failure initializing sftp session: %s", err_msg);
-        state(data, SSH_SESSION_FREE);
-        sshc->actualcode = CURLE_FAILED_INIT;
-        break;
-      }
-      state(data, SSH_SFTP_REALPATH);
+      result = ssh_state_sftp_init(data, sshc);
       break;
 
     case SSH_SFTP_REALPATH:
-    {
-      char tempHome[PATH_MAX];
-
-      /*
-       * Get the "home" directory
-       */
-      rc = sftp_libssh2_realpath(sshc->sftp_session, ".",
-                                 tempHome, PATH_MAX-1);
-      if(rc == LIBSSH2_ERROR_EAGAIN) {
-        break;
-      }
-      if(rc > 0) {
-        /* It seems that this string is not always NULL terminated */
-        tempHome[rc] = '\0';
-        sshc->homedir = strdup(tempHome);
-        if(!sshc->homedir) {
-          state(data, SSH_SFTP_CLOSE);
-          sshc->actualcode = CURLE_OUT_OF_MEMORY;
-          break;
-        }
-        data->state.most_recent_ftp_entrypath = sshc->homedir;
-      }
-      else {
-        /* Return the error type */
-        sftperr = libssh2_sftp_last_error(sshc->sftp_session);
-        if(sftperr)
-          result = sftp_libssh2_error_to_CURLE(sftperr);
-        else
-          /* in this case, the error wasn't in the SFTP level but for example
-             a time-out or similar */
-          result = CURLE_SSH;
-        sshc->actualcode = result;
-        DEBUGF(infof(data, "error = %lu makes libcurl = %d",
-                     sftperr, (int)result));
-        state(data, SSH_STOP);
-        break;
-      }
-    }
-    /* This is the last step in the SFTP connect phase. Do note that while
-       we get the homedir here, we get the "workingpath" in the DO action
-       since the homedir will remain the same between request but the
-       working path will not. */
-    DEBUGF(infof(data, "SSH CONNECT phase done"));
-    state(data, SSH_STOP);
-    break;
+      result = ssh_state_sftp_realpath(data, sshc, sshp);
+      break;
 
     case SSH_SFTP_QUOTE_INIT:
-
-      result = Curl_getworkingpath(data, sshc->homedir, &sshp->path);
-      if(result) {
-        sshc->actualcode = result;
-        state(data, SSH_STOP);
-        break;
-      }
-
-      if(data->set.quote) {
-        infof(data, "Sending quote commands");
-        sshc->quote_item = data->set.quote;
-        state(data, SSH_SFTP_QUOTE);
-      }
-      else {
-        state(data, SSH_SFTP_GETINFO);
-      }
+      result = ssh_state_sftp_quote_init(data, sshc, sshp);
       break;
 
     case SSH_SFTP_POSTQUOTE_INIT:
-      if(data->set.postquote) {
-        infof(data, "Sending quote commands");
-        sshc->quote_item = data->set.postquote;
-        state(data, SSH_SFTP_QUOTE);
-      }
-      else {
-        state(data, SSH_STOP);
-      }
+      result = ssh_state_sftp_postquote_init(data, sshc);
       break;
 
     case SSH_SFTP_QUOTE:
-      /* Send any quote commands */
-    {
-      const char *cp;
-
-      /*
-       * Support some of the "FTP" commands
-       *
-       * 'sshc->quote_item' is already verified to be non-NULL before it
-       * switched to this state.
-       */
-      char *cmd = sshc->quote_item->data;
-      sshc->acceptfail = FALSE;
-
-      /* if a command starts with an asterisk, which a legal SFTP command never
-         can, the command will be allowed to fail without it causing any
-         aborts or cancels etc. It will cause libcurl to act as if the command
-         is successful, whatever the server reponds. */
-
-      if(cmd[0] == '*') {
-        cmd++;
-        sshc->acceptfail = TRUE;
-      }
-
-      if(strcasecompare("pwd", cmd)) {
-        /* output debug output if that is requested */
-        char *tmp = aprintf("257 \"%s\" is current directory.\n",
-                            sshp->path);
-        if(!tmp) {
-          result = CURLE_OUT_OF_MEMORY;
-          state(data, SSH_SFTP_CLOSE);
-          sshc->nextstate = SSH_NO_STATE;
-          break;
-        }
-        Curl_debug(data, CURLINFO_HEADER_OUT, (char *)"PWD\n", 4);
-        Curl_debug(data, CURLINFO_HEADER_IN, tmp, strlen(tmp));
-
-        /* this sends an FTP-like "header" to the header callback so that the
-           current directory can be read very similar to how it is read when
-           using ordinary FTP. */
-        result = Curl_client_write(data, CLIENTWRITE_HEADER, tmp, strlen(tmp));
-        free(tmp);
-        if(result) {
-          state(data, SSH_SFTP_CLOSE);
-          sshc->nextstate = SSH_NO_STATE;
-          sshc->actualcode = result;
-        }
-        else
-          state(data, SSH_SFTP_NEXT_QUOTE);
-        break;
-      }
-      {
-        /*
-         * the arguments following the command must be separated from the
-         * command with a space so we can check for it unconditionally
-         */
-        cp = strchr(cmd, ' ');
-        if(!cp) {
-          failf(data, "Syntax error command '%s', missing parameter",
-                cmd);
-          state(data, SSH_SFTP_CLOSE);
-          sshc->nextstate = SSH_NO_STATE;
-          sshc->actualcode = CURLE_QUOTE_ERROR;
-          break;
-        }
-
-        /*
-         * also, every command takes at least one argument so we get that
-         * first argument right now
-         */
-        result = Curl_get_pathname(&cp, &sshc->quote_path1, sshc->homedir);
-        if(result) {
-          if(result == CURLE_OUT_OF_MEMORY)
-            failf(data, "Out of memory");
-          else
-            failf(data, "Syntax error: Bad first parameter to '%s'", cmd);
-          state(data, SSH_SFTP_CLOSE);
-          sshc->nextstate = SSH_NO_STATE;
-          sshc->actualcode = result;
-          break;
-        }
-
-        /*
-         * SFTP is a binary protocol, so we don't send text commands
-         * to the server. Instead, we scan for commands used by
-         * OpenSSH's sftp program and call the appropriate libssh2
-         * functions.
-         */
-        if(strncasecompare(cmd, "chgrp ", 6) ||
-           strncasecompare(cmd, "chmod ", 6) ||
-           strncasecompare(cmd, "chown ", 6) ||
-           strncasecompare(cmd, "atime ", 6) ||
-           strncasecompare(cmd, "mtime ", 6)) {
-          /* attribute change */
-
-          /* sshc->quote_path1 contains the mode to set */
-          /* get the destination */
-          result = Curl_get_pathname(&cp, &sshc->quote_path2, sshc->homedir);
-          if(result) {
-            if(result == CURLE_OUT_OF_MEMORY)
-              failf(data, "Out of memory");
-            else
-              failf(data, "Syntax error in %s: Bad second parameter", cmd);
-            Curl_safefree(sshc->quote_path1);
-            state(data, SSH_SFTP_CLOSE);
-            sshc->nextstate = SSH_NO_STATE;
-            sshc->actualcode = result;
-            break;
-          }
-          memset(&sshp->quote_attrs, 0, sizeof(LIBSSH2_SFTP_ATTRIBUTES));
-          state(data, SSH_SFTP_QUOTE_STAT);
-          break;
-        }
-        if(strncasecompare(cmd, "ln ", 3) ||
-           strncasecompare(cmd, "symlink ", 8)) {
-          /* symbolic linking */
-          /* sshc->quote_path1 is the source */
-          /* get the destination */
-          result = Curl_get_pathname(&cp, &sshc->quote_path2, sshc->homedir);
-          if(result) {
-            if(result == CURLE_OUT_OF_MEMORY)
-              failf(data, "Out of memory");
-            else
-              failf(data,
-                    "Syntax error in ln/symlink: Bad second parameter");
-            Curl_safefree(sshc->quote_path1);
-            state(data, SSH_SFTP_CLOSE);
-            sshc->nextstate = SSH_NO_STATE;
-            sshc->actualcode = result;
-            break;
-          }
-          state(data, SSH_SFTP_QUOTE_SYMLINK);
-          break;
-        }
-        else if(strncasecompare(cmd, "mkdir ", 6)) {
-          /* create dir */
-          state(data, SSH_SFTP_QUOTE_MKDIR);
-          break;
-        }
-        else if(strncasecompare(cmd, "rename ", 7)) {
-          /* rename file */
-          /* first param is the source path */
-          /* second param is the dest. path */
-          result = Curl_get_pathname(&cp, &sshc->quote_path2, sshc->homedir);
-          if(result) {
-            if(result == CURLE_OUT_OF_MEMORY)
-              failf(data, "Out of memory");
-            else
-              failf(data, "Syntax error in rename: Bad second parameter");
-            Curl_safefree(sshc->quote_path1);
-            state(data, SSH_SFTP_CLOSE);
-            sshc->nextstate = SSH_NO_STATE;
-            sshc->actualcode = result;
-            break;
-          }
-          state(data, SSH_SFTP_QUOTE_RENAME);
-          break;
-        }
-        else if(strncasecompare(cmd, "rmdir ", 6)) {
-          /* delete dir */
-          state(data, SSH_SFTP_QUOTE_RMDIR);
-          break;
-        }
-        else if(strncasecompare(cmd, "rm ", 3)) {
-          state(data, SSH_SFTP_QUOTE_UNLINK);
-          break;
-        }
-#ifdef HAS_STATVFS_SUPPORT
-        else if(strncasecompare(cmd, "statvfs ", 8)) {
-          state(data, SSH_SFTP_QUOTE_STATVFS);
-          break;
-        }
-#endif
-
-        failf(data, "Unknown SFTP command");
-        Curl_safefree(sshc->quote_path1);
-        Curl_safefree(sshc->quote_path2);
-        state(data, SSH_SFTP_CLOSE);
-        sshc->nextstate = SSH_NO_STATE;
-        sshc->actualcode = CURLE_QUOTE_ERROR;
-        break;
-      }
-    }
-    break;
+      result = ssh_state_sftp_quote(data, sshc, sshp);
+      break;
 
     case SSH_SFTP_NEXT_QUOTE:
-      Curl_safefree(sshc->quote_path1);
-      Curl_safefree(sshc->quote_path2);
-
-      sshc->quote_item = sshc->quote_item->next;
-
-      if(sshc->quote_item) {
-        state(data, SSH_SFTP_QUOTE);
-      }
-      else {
-        if(sshc->nextstate != SSH_NO_STATE) {
-          state(data, sshc->nextstate);
-          sshc->nextstate = SSH_NO_STATE;
-        }
-        else {
-          state(data, SSH_SFTP_GETINFO);
-        }
-      }
+      result = ssh_state_sftp_next_quote(data, sshc);
       break;
 
     case SSH_SFTP_QUOTE_STAT:
-    {
-      char *cmd = sshc->quote_item->data;
-      sshc->acceptfail = FALSE;
-
-      /* if a command starts with an asterisk, which a legal SFTP command never
-         can, the command will be allowed to fail without it causing any
-         aborts or cancels etc. It will cause libcurl to act as if the command
-         is successful, whatever the server reponds. */
-
-      if(cmd[0] == '*') {
-        cmd++;
-        sshc->acceptfail = TRUE;
-      }
-
-      if(!strncasecompare(cmd, "chmod", 5)) {
-        /* Since chown and chgrp only set owner OR group but libssh2 wants to
-         * set them both at once, we need to obtain the current ownership
-         * first.  This takes an extra protocol round trip.
-         */
-        rc = libssh2_sftp_stat_ex(sshc->sftp_session, sshc->quote_path2,
-                                  curlx_uztoui(strlen(sshc->quote_path2)),
-                                  LIBSSH2_SFTP_STAT,
-                                  &sshp->quote_attrs);
-        if(rc == LIBSSH2_ERROR_EAGAIN) {
-          break;
-        }
-        if(rc && !sshc->acceptfail) { /* get those attributes */
-          sftperr = libssh2_sftp_last_error(sshc->sftp_session);
-          Curl_safefree(sshc->quote_path1);
-          Curl_safefree(sshc->quote_path2);
-          failf(data, "Attempt to get SFTP stats failed: %s",
-                sftp_libssh2_strerror(sftperr));
-          state(data, SSH_SFTP_CLOSE);
-          sshc->nextstate = SSH_NO_STATE;
-          sshc->actualcode = CURLE_QUOTE_ERROR;
-          break;
-        }
-      }
-
-      /* Now set the new attributes... */
-      if(strncasecompare(cmd, "chgrp", 5)) {
-        sshp->quote_attrs.gid = strtoul(sshc->quote_path1, NULL, 10);
-        sshp->quote_attrs.flags = LIBSSH2_SFTP_ATTR_UIDGID;
-        if(sshp->quote_attrs.gid == 0 && !ISDIGIT(sshc->quote_path1[0]) &&
-           !sshc->acceptfail) {
-          Curl_safefree(sshc->quote_path1);
-          Curl_safefree(sshc->quote_path2);
-          failf(data, "Syntax error: chgrp gid not a number");
-          state(data, SSH_SFTP_CLOSE);
-          sshc->nextstate = SSH_NO_STATE;
-          sshc->actualcode = CURLE_QUOTE_ERROR;
-          break;
-        }
-      }
-      else if(strncasecompare(cmd, "chmod", 5)) {
-        sshp->quote_attrs.permissions = strtoul(sshc->quote_path1, NULL, 8);
-        sshp->quote_attrs.flags = LIBSSH2_SFTP_ATTR_PERMISSIONS;
-        /* permissions are octal */
-        if(sshp->quote_attrs.permissions == 0 &&
-           !ISDIGIT(sshc->quote_path1[0])) {
-          Curl_safefree(sshc->quote_path1);
-          Curl_safefree(sshc->quote_path2);
-          failf(data, "Syntax error: chmod permissions not a number");
-          state(data, SSH_SFTP_CLOSE);
-          sshc->nextstate = SSH_NO_STATE;
-          sshc->actualcode = CURLE_QUOTE_ERROR;
-          break;
-        }
-      }
-      else if(strncasecompare(cmd, "chown", 5)) {
-        sshp->quote_attrs.uid = strtoul(sshc->quote_path1, NULL, 10);
-        sshp->quote_attrs.flags = LIBSSH2_SFTP_ATTR_UIDGID;
-        if(sshp->quote_attrs.uid == 0 && !ISDIGIT(sshc->quote_path1[0]) &&
-           !sshc->acceptfail) {
-          Curl_safefree(sshc->quote_path1);
-          Curl_safefree(sshc->quote_path2);
-          failf(data, "Syntax error: chown uid not a number");
-          state(data, SSH_SFTP_CLOSE);
-          sshc->nextstate = SSH_NO_STATE;
-          sshc->actualcode = CURLE_QUOTE_ERROR;
-          break;
-        }
-      }
-      else if(strncasecompare(cmd, "atime", 5) ||
-              strncasecompare(cmd, "mtime", 5)) {
-        time_t date = Curl_getdate_capped(sshc->quote_path1);
-        bool fail = FALSE;
-
-        if(date == -1) {
-          failf(data, "incorrect date format for %.*s", 5, cmd);
-          fail = TRUE;
-        }
-#if SIZEOF_TIME_T > SIZEOF_LONG
-        if(date > 0xffffffff) {
-          /* if 'long' can't old >32bit, this date cannot be sent */
-          failf(data, "date overflow");
-          fail = TRUE;
-        }
-#endif
-        if(fail) {
-          Curl_safefree(sshc->quote_path1);
-          Curl_safefree(sshc->quote_path2);
-          state(data, SSH_SFTP_CLOSE);
-          sshc->nextstate = SSH_NO_STATE;
-          sshc->actualcode = CURLE_QUOTE_ERROR;
-          break;
-        }
-        if(strncasecompare(cmd, "atime", 5))
-          sshp->quote_attrs.atime = (unsigned long)date;
-        else /* mtime */
-          sshp->quote_attrs.mtime = (unsigned long)date;
-
-        sshp->quote_attrs.flags = LIBSSH2_SFTP_ATTR_ACMODTIME;
-      }
-
-      /* Now send the completed structure... */
-      state(data, SSH_SFTP_QUOTE_SETSTAT);
+      result = ssh_state_sftp_quote_stat(data, sshc, sshp, block);
       break;
-    }
 
     case SSH_SFTP_QUOTE_SETSTAT:
-      rc = libssh2_sftp_stat_ex(sshc->sftp_session, sshc->quote_path2,
-                                curlx_uztoui(strlen(sshc->quote_path2)),
-                                LIBSSH2_SFTP_SETSTAT,
-                                &sshp->quote_attrs);
-      if(rc == LIBSSH2_ERROR_EAGAIN) {
-        break;
-      }
-      if(rc && !sshc->acceptfail) {
-        sftperr = libssh2_sftp_last_error(sshc->sftp_session);
-        Curl_safefree(sshc->quote_path1);
-        Curl_safefree(sshc->quote_path2);
-        failf(data, "Attempt to set SFTP stats failed: %s",
-              sftp_libssh2_strerror(sftperr));
-        state(data, SSH_SFTP_CLOSE);
-        sshc->nextstate = SSH_NO_STATE;
-        sshc->actualcode = CURLE_QUOTE_ERROR;
-        break;
-      }
-      state(data, SSH_SFTP_NEXT_QUOTE);
+      result = ssh_state_sftp_quote_setstat(data, sshc, sshp);
       break;
 
     case SSH_SFTP_QUOTE_SYMLINK:
-      rc = libssh2_sftp_symlink_ex(sshc->sftp_session, sshc->quote_path1,
-                                   curlx_uztoui(strlen(sshc->quote_path1)),
-                                   sshc->quote_path2,
-                                   curlx_uztoui(strlen(sshc->quote_path2)),
-                                   LIBSSH2_SFTP_SYMLINK);
-      if(rc == LIBSSH2_ERROR_EAGAIN) {
-        break;
-      }
-      if(rc && !sshc->acceptfail) {
-        sftperr = libssh2_sftp_last_error(sshc->sftp_session);
-        Curl_safefree(sshc->quote_path1);
-        Curl_safefree(sshc->quote_path2);
-        failf(data, "symlink command failed: %s",
-              sftp_libssh2_strerror(sftperr));
-        state(data, SSH_SFTP_CLOSE);
-        sshc->nextstate = SSH_NO_STATE;
-        sshc->actualcode = CURLE_QUOTE_ERROR;
-        break;
-      }
-      state(data, SSH_SFTP_NEXT_QUOTE);
+      result = ssh_state_sftp_quote_symlink(data, sshc);
       break;
 
     case SSH_SFTP_QUOTE_MKDIR:
-      rc = libssh2_sftp_mkdir_ex(sshc->sftp_session, sshc->quote_path1,
-                                 curlx_uztoui(strlen(sshc->quote_path1)),
-                                 data->set.new_directory_perms);
-      if(rc == LIBSSH2_ERROR_EAGAIN) {
-        break;
-      }
-      if(rc && !sshc->acceptfail) {
-        sftperr = libssh2_sftp_last_error(sshc->sftp_session);
-        Curl_safefree(sshc->quote_path1);
-        failf(data, "mkdir command failed: %s",
-              sftp_libssh2_strerror(sftperr));
-        state(data, SSH_SFTP_CLOSE);
-        sshc->nextstate = SSH_NO_STATE;
-        sshc->actualcode = CURLE_QUOTE_ERROR;
-        break;
-      }
-      state(data, SSH_SFTP_NEXT_QUOTE);
+      result = ssh_state_sftp_quote_mkdir(data, sshc);
       break;
 
     case SSH_SFTP_QUOTE_RENAME:
-      rc = libssh2_sftp_rename_ex(sshc->sftp_session, sshc->quote_path1,
-                                  curlx_uztoui(strlen(sshc->quote_path1)),
-                                  sshc->quote_path2,
-                                  curlx_uztoui(strlen(sshc->quote_path2)),
-                                  LIBSSH2_SFTP_RENAME_OVERWRITE |
-                                  LIBSSH2_SFTP_RENAME_ATOMIC |
-                                  LIBSSH2_SFTP_RENAME_NATIVE);
-
-      if(rc == LIBSSH2_ERROR_EAGAIN) {
-        break;
-      }
-      if(rc && !sshc->acceptfail) {
-        sftperr = libssh2_sftp_last_error(sshc->sftp_session);
-        Curl_safefree(sshc->quote_path1);
-        Curl_safefree(sshc->quote_path2);
-        failf(data, "rename command failed: %s",
-              sftp_libssh2_strerror(sftperr));
-        state(data, SSH_SFTP_CLOSE);
-        sshc->nextstate = SSH_NO_STATE;
-        sshc->actualcode = CURLE_QUOTE_ERROR;
-        break;
-      }
-      state(data, SSH_SFTP_NEXT_QUOTE);
+      result = ssh_state_sftp_quote_rename(data, sshc);
       break;
 
     case SSH_SFTP_QUOTE_RMDIR:
-      rc = libssh2_sftp_rmdir_ex(sshc->sftp_session, sshc->quote_path1,
-                                 curlx_uztoui(strlen(sshc->quote_path1)));
-      if(rc == LIBSSH2_ERROR_EAGAIN) {
-        break;
-      }
-      if(rc && !sshc->acceptfail) {
-        sftperr = libssh2_sftp_last_error(sshc->sftp_session);
-        Curl_safefree(sshc->quote_path1);
-        failf(data, "rmdir command failed: %s",
-              sftp_libssh2_strerror(sftperr));
-        state(data, SSH_SFTP_CLOSE);
-        sshc->nextstate = SSH_NO_STATE;
-        sshc->actualcode = CURLE_QUOTE_ERROR;
-        break;
-      }
-      state(data, SSH_SFTP_NEXT_QUOTE);
+      result = ssh_state_sftp_quote_rmdir(data, sshc);
       break;
 
     case SSH_SFTP_QUOTE_UNLINK:
-      rc = libssh2_sftp_unlink_ex(sshc->sftp_session, sshc->quote_path1,
-                                  curlx_uztoui(strlen(sshc->quote_path1)));
-      if(rc == LIBSSH2_ERROR_EAGAIN) {
-        break;
-      }
-      if(rc && !sshc->acceptfail) {
-        sftperr = libssh2_sftp_last_error(sshc->sftp_session);
-        Curl_safefree(sshc->quote_path1);
-        failf(data, "rm command failed: %s", sftp_libssh2_strerror(sftperr));
-        state(data, SSH_SFTP_CLOSE);
-        sshc->nextstate = SSH_NO_STATE;
-        sshc->actualcode = CURLE_QUOTE_ERROR;
-        break;
-      }
-      state(data, SSH_SFTP_NEXT_QUOTE);
+      result = ssh_state_sftp_quote_unlink(data, sshc);
       break;
 
-#ifdef HAS_STATVFS_SUPPORT
     case SSH_SFTP_QUOTE_STATVFS:
-    {
-      LIBSSH2_SFTP_STATVFS statvfs;
-      rc = libssh2_sftp_statvfs(sshc->sftp_session, sshc->quote_path1,
-                                curlx_uztoui(strlen(sshc->quote_path1)),
-                                &statvfs);
-
-      if(rc == LIBSSH2_ERROR_EAGAIN) {
-        break;
-      }
-      if(rc && !sshc->acceptfail) {
-        sftperr = libssh2_sftp_last_error(sshc->sftp_session);
-        Curl_safefree(sshc->quote_path1);
-        failf(data, "statvfs command failed: %s",
-              sftp_libssh2_strerror(sftperr));
-        state(data, SSH_SFTP_CLOSE);
-        sshc->nextstate = SSH_NO_STATE;
-        sshc->actualcode = CURLE_QUOTE_ERROR;
-        break;
-      }
-      else if(rc == 0) {
-        char *tmp = aprintf("statvfs:\n"
-                            "f_bsize: %llu\n" "f_frsize: %llu\n"
-                            "f_blocks: %llu\n" "f_bfree: %llu\n"
-                            "f_bavail: %llu\n" "f_files: %llu\n"
-                            "f_ffree: %llu\n" "f_favail: %llu\n"
-                            "f_fsid: %llu\n" "f_flag: %llu\n"
-                            "f_namemax: %llu\n",
-                            statvfs.f_bsize, statvfs.f_frsize,
-                            statvfs.f_blocks, statvfs.f_bfree,
-                            statvfs.f_bavail, statvfs.f_files,
-                            statvfs.f_ffree, statvfs.f_favail,
-                            statvfs.f_fsid, statvfs.f_flag,
-                            statvfs.f_namemax);
-        if(!tmp) {
-          result = CURLE_OUT_OF_MEMORY;
-          state(data, SSH_SFTP_CLOSE);
-          sshc->nextstate = SSH_NO_STATE;
-          break;
-        }
-
-        result = Curl_client_write(data, CLIENTWRITE_HEADER, tmp, strlen(tmp));
-        free(tmp);
-        if(result) {
-          state(data, SSH_SFTP_CLOSE);
-          sshc->nextstate = SSH_NO_STATE;
-          sshc->actualcode = result;
-        }
-      }
-      state(data, SSH_SFTP_NEXT_QUOTE);
+      result = ssh_state_sftp_quote_statvfs(data, sshc);
       break;
-    }
-#endif
+
     case SSH_SFTP_GETINFO:
-    {
-      if(data->set.get_filetime) {
-        state(data, SSH_SFTP_FILETIME);
-      }
-      else {
-        state(data, SSH_SFTP_TRANS_INIT);
-      }
+      result = ssh_state_sftp_getinfo(data, sshc);
       break;
-    }
 
     case SSH_SFTP_FILETIME:
-    {
-      LIBSSH2_SFTP_ATTRIBUTES attrs;
-
-      rc = libssh2_sftp_stat_ex(sshc->sftp_session, sshp->path,
-                                curlx_uztoui(strlen(sshp->path)),
-                                LIBSSH2_SFTP_STAT, &attrs);
-      if(rc == LIBSSH2_ERROR_EAGAIN) {
-        break;
-      }
-      if(rc == 0) {
-        data->info.filetime = attrs.mtime;
-      }
-
-      state(data, SSH_SFTP_TRANS_INIT);
+      result = ssh_state_sftp_filetime(data, sshc, sshp);
       break;
-    }
 
     case SSH_SFTP_TRANS_INIT:
-      if(data->state.upload)
-        state(data, SSH_SFTP_UPLOAD_INIT);
-      else {
-        if(sshp->path[strlen(sshp->path)-1] == '/')
-          state(data, SSH_SFTP_READDIR_INIT);
-        else
-          state(data, SSH_SFTP_DOWNLOAD_INIT);
-      }
+      result = ssh_state_sftp_trans_init(data, sshc, sshp);
       break;
 
     case SSH_SFTP_UPLOAD_INIT:
-    {
-      unsigned long flags;
-      /*
-       * NOTE!!!  libssh2 requires that the destination path is a full path
-       *          that includes the destination file and name OR ends in a "/"
-       *          If this is not done the destination file will be named the
-       *          same name as the last directory in the path.
-       */
-
-      if(data->state.resume_from) {
-        LIBSSH2_SFTP_ATTRIBUTES attrs;
-        if(data->state.resume_from < 0) {
-          rc = libssh2_sftp_stat_ex(sshc->sftp_session, sshp->path,
-                                    curlx_uztoui(strlen(sshp->path)),
-                                    LIBSSH2_SFTP_STAT, &attrs);
-          if(rc == LIBSSH2_ERROR_EAGAIN) {
-            break;
-          }
-          if(rc) {
-            data->state.resume_from = 0;
-          }
-          else {
-            curl_off_t size = attrs.filesize;
-            if(size < 0) {
-              failf(data, "Bad file size (%" CURL_FORMAT_CURL_OFF_T ")", size);
-              return CURLE_BAD_DOWNLOAD_RESUME;
-            }
-            data->state.resume_from = attrs.filesize;
-          }
-        }
-      }
-
-      if(data->set.remote_append)
-        /* Try to open for append, but create if nonexisting */
-        flags = LIBSSH2_FXF_WRITE|LIBSSH2_FXF_CREAT|LIBSSH2_FXF_APPEND;
-      else if(data->state.resume_from > 0)
-        /* If we have restart position then open for append */
-        flags = LIBSSH2_FXF_WRITE|LIBSSH2_FXF_APPEND;
-      else
-        /* Clear file before writing (normal behavior) */
-        flags = LIBSSH2_FXF_WRITE|LIBSSH2_FXF_CREAT|LIBSSH2_FXF_TRUNC;
-
-      sshc->sftp_handle =
-        libssh2_sftp_open_ex(sshc->sftp_session, sshp->path,
-                             curlx_uztoui(strlen(sshp->path)),
-                             flags, data->set.new_file_perms,
-                             LIBSSH2_SFTP_OPENFILE);
-
-      if(!sshc->sftp_handle) {
-        rc = libssh2_session_last_errno(sshc->ssh_session);
-
-        if(LIBSSH2_ERROR_EAGAIN == rc)
-          break;
-
-        if(LIBSSH2_ERROR_SFTP_PROTOCOL == rc)
-          /* only when there was an SFTP protocol error can we extract
-             the sftp error! */
-          sftperr = libssh2_sftp_last_error(sshc->sftp_session);
-        else
-          sftperr = LIBSSH2_FX_OK; /* not an sftp error at all */
-
-        if(sshc->secondCreateDirs) {
-          state(data, SSH_SFTP_CLOSE);
-          sshc->actualcode = sftperr != LIBSSH2_FX_OK ?
-            sftp_libssh2_error_to_CURLE(sftperr):CURLE_SSH;
-          failf(data, "Creating the dir/file failed: %s",
-                sftp_libssh2_strerror(sftperr));
-          break;
-        }
-        if(((sftperr == LIBSSH2_FX_NO_SUCH_FILE) ||
-            (sftperr == LIBSSH2_FX_FAILURE) ||
-            (sftperr == LIBSSH2_FX_NO_SUCH_PATH)) &&
-           (data->set.ftp_create_missing_dirs &&
-            (strlen(sshp->path) > 1))) {
-          /* try to create the path remotely */
-          rc = 0; /* clear rc and continue */
-          sshc->secondCreateDirs = 1;
-          state(data, SSH_SFTP_CREATE_DIRS_INIT);
-          break;
-        }
-        state(data, SSH_SFTP_CLOSE);
-        sshc->actualcode = sftperr != LIBSSH2_FX_OK ?
-          sftp_libssh2_error_to_CURLE(sftperr):CURLE_SSH;
-        if(!sshc->actualcode) {
-          /* Sometimes, for some reason libssh2_sftp_last_error() returns zero
-             even though libssh2_sftp_open() failed previously! We need to
-             work around that! */
-          sshc->actualcode = CURLE_SSH;
-          sftperr = LIBSSH2_FX_OK;
-        }
-        failf(data, "Upload failed: %s (%lu/%d)",
-              sftperr != LIBSSH2_FX_OK ?
-              sftp_libssh2_strerror(sftperr):"ssh error",
-              sftperr, rc);
-        break;
-      }
-
-      /* If we have a restart point then we need to seek to the correct
-         position. */
-      if(data->state.resume_from > 0) {
-        /* Let's read off the proper amount of bytes from the input. */
-        if(conn->seek_func) {
-          Curl_set_in_callback(data, true);
-          seekerr = conn->seek_func(conn->seek_client, data->state.resume_from,
-                                    SEEK_SET);
-          Curl_set_in_callback(data, false);
-        }
-
-        if(seekerr != CURL_SEEKFUNC_OK) {
-          curl_off_t passed = 0;
-
-          if(seekerr != CURL_SEEKFUNC_CANTSEEK) {
-            failf(data, "Could not seek stream");
-            return CURLE_FTP_COULDNT_USE_REST;
-          }
-          /* seekerr == CURL_SEEKFUNC_CANTSEEK (can't seek to offset) */
-          do {
-            size_t readthisamountnow =
-              (data->state.resume_from - passed > data->set.buffer_size) ?
-              (size_t)data->set.buffer_size :
-              curlx_sotouz(data->state.resume_from - passed);
-
-            size_t actuallyread;
-            Curl_set_in_callback(data, true);
-            actuallyread = data->state.fread_func(data->state.buffer, 1,
-                                                  readthisamountnow,
-                                                  data->state.in);
-            Curl_set_in_callback(data, false);
-
-            passed += actuallyread;
-            if((actuallyread == 0) || (actuallyread > readthisamountnow)) {
-              /* this checks for greater-than only to make sure that the
-                 CURL_READFUNC_ABORT return code still aborts */
-              failf(data, "Failed to read data");
-              return CURLE_FTP_COULDNT_USE_REST;
-            }
-          } while(passed < data->state.resume_from);
-        }
-
-        /* now, decrease the size of the read */
-        if(data->state.infilesize > 0) {
-          data->state.infilesize -= data->state.resume_from;
-          data->req.size = data->state.infilesize;
-          Curl_pgrsSetUploadSize(data, data->state.infilesize);
-        }
-
-        SFTP_SEEK(sshc->sftp_handle, data->state.resume_from);
-      }
-      if(data->state.infilesize > 0) {
-        data->req.size = data->state.infilesize;
-        Curl_pgrsSetUploadSize(data, data->state.infilesize);
-      }
-      /* upload data */
-      Curl_setup_transfer(data, -1, -1, FALSE, FIRSTSOCKET);
-
-      /* not set by Curl_setup_transfer to preserve keepon bits */
-      conn->sockfd = conn->writesockfd;
-
-      if(result) {
-        state(data, SSH_SFTP_CLOSE);
-        sshc->actualcode = result;
-      }
-      else {
-        /* store this original bitmask setup to use later on if we can't
-           figure out a "real" bitmask */
-        sshc->orig_waitfor = data->req.keepon;
-
-        /* we want to use the _sending_ function even when the socket turns
-           out readable as the underlying libssh2 sftp send function will deal
-           with both accordingly */
-        conn->cselect_bits = CURL_CSELECT_OUT;
-
-        /* since we don't really wait for anything at this point, we want the
-           state machine to move on as soon as possible so we set a very short
-           timeout here */
-        Curl_expire(data, 0, EXPIRE_RUN_NOW);
-
-        state(data, SSH_STOP);
-      }
+      result = ssh_state_sftp_upload_init(data, sshc, sshp, block);
       break;
-    }
 
     case SSH_SFTP_CREATE_DIRS_INIT:
-      if(strlen(sshp->path) > 1) {
-        sshc->slash_pos = sshp->path + 1; /* ignore the leading '/' */
-        state(data, SSH_SFTP_CREATE_DIRS);
-      }
-      else {
-        state(data, SSH_SFTP_UPLOAD_INIT);
-      }
+      result = ssh_state_sftp_create_dirs_init(data, sshc, sshp);
       break;
 
     case SSH_SFTP_CREATE_DIRS:
-      sshc->slash_pos = strchr(sshc->slash_pos, '/');
-      if(sshc->slash_pos) {
-        *sshc->slash_pos = 0;
-
-        infof(data, "Creating directory '%s'", sshp->path);
-        state(data, SSH_SFTP_CREATE_DIRS_MKDIR);
-        break;
-      }
-      state(data, SSH_SFTP_UPLOAD_INIT);
+      result = ssh_state_sftp_create_dirs(data, sshc, sshp);
       break;
 
     case SSH_SFTP_CREATE_DIRS_MKDIR:
-      /* 'mode' - parameter is preliminary - default to 0644 */
-      rc = libssh2_sftp_mkdir_ex(sshc->sftp_session, sshp->path,
-                                 curlx_uztoui(strlen(sshp->path)),
-                                 data->set.new_directory_perms);
-      if(rc == LIBSSH2_ERROR_EAGAIN) {
-        break;
-      }
-      *sshc->slash_pos = '/';
-      ++sshc->slash_pos;
-      if(rc < 0) {
-        /*
-         * Abort if failure wasn't that the dir already exists or the
-         * permission was denied (creation might succeed further down the
-         * path) - retry on unspecific FAILURE also
-         */
-        sftperr = libssh2_sftp_last_error(sshc->sftp_session);
-        if((sftperr != LIBSSH2_FX_FILE_ALREADY_EXISTS) &&
-           (sftperr != LIBSSH2_FX_FAILURE) &&
-           (sftperr != LIBSSH2_FX_PERMISSION_DENIED)) {
-          result = sftp_libssh2_error_to_CURLE(sftperr);
-          state(data, SSH_SFTP_CLOSE);
-          sshc->actualcode = result?result:CURLE_SSH;
-          break;
-        }
-        rc = 0; /* clear rc and continue */
-      }
-      state(data, SSH_SFTP_CREATE_DIRS);
+      result = ssh_state_sftp_create_dirs_mkdir(data, sshc, sshp);
       break;
 
     case SSH_SFTP_READDIR_INIT:
-      Curl_pgrsSetDownloadSize(data, -1);
-      if(data->req.no_body) {
-        state(data, SSH_STOP);
-        break;
-      }
-
-      /*
-       * This is a directory that we are trying to get, so produce a directory
-       * listing
-       */
-      sshc->sftp_handle = libssh2_sftp_open_ex(sshc->sftp_session,
-                                               sshp->path,
-                                               curlx_uztoui(
-                                                 strlen(sshp->path)),
-                                               0, 0, LIBSSH2_SFTP_OPENDIR);
-      if(!sshc->sftp_handle) {
-        if(libssh2_session_last_errno(sshc->ssh_session) ==
-           LIBSSH2_ERROR_EAGAIN) {
-          rc = LIBSSH2_ERROR_EAGAIN;
-          break;
-        }
-        sftperr = libssh2_sftp_last_error(sshc->sftp_session);
-        failf(data, "Could not open directory for reading: %s",
-              sftp_libssh2_strerror(sftperr));
-        state(data, SSH_SFTP_CLOSE);
-        result = sftp_libssh2_error_to_CURLE(sftperr);
-        sshc->actualcode = result?result:CURLE_SSH;
-        break;
-      }
-      sshp->readdir_filename = malloc(PATH_MAX + 1);
-      if(!sshp->readdir_filename) {
-        state(data, SSH_SFTP_CLOSE);
-        sshc->actualcode = CURLE_OUT_OF_MEMORY;
-        break;
-      }
-      sshp->readdir_longentry = malloc(PATH_MAX + 1);
-      if(!sshp->readdir_longentry) {
-        Curl_safefree(sshp->readdir_filename);
-        state(data, SSH_SFTP_CLOSE);
-        sshc->actualcode = CURLE_OUT_OF_MEMORY;
-        break;
-      }
-      Curl_dyn_init(&sshp->readdir, PATH_MAX * 2);
-      state(data, SSH_SFTP_READDIR);
+      result = ssh_state_sftp_readdir_init(data, sshc, sshp);
       break;
 
     case SSH_SFTP_READDIR:
-      rc = libssh2_sftp_readdir_ex(sshc->sftp_handle,
-                                   sshp->readdir_filename,
-                                   PATH_MAX,
-                                   sshp->readdir_longentry,
-                                   PATH_MAX,
-                                   &sshp->readdir_attrs);
-      if(rc == LIBSSH2_ERROR_EAGAIN) {
-        break;
-      }
-      if(rc > 0) {
-        readdir_len = (size_t) rc;
-        sshp->readdir_filename[readdir_len] = '\0';
-
-        if(data->set.list_only) {
-          result = Curl_client_write(data, CLIENTWRITE_BODY,
-                                     sshp->readdir_filename,
-                                     readdir_len);
-          if(!result)
-            result = Curl_client_write(data, CLIENTWRITE_BODY,
-                                       (char *)"\n", 1);
-          if(result) {
-            state(data, SSH_STOP);
-            break;
-          }
-          /* since this counts what we send to the client, we include the
-             newline in this counter */
-          data->req.bytecount += readdir_len + 1;
-
-          /* output debug output if that is requested */
-          Curl_debug(data, CURLINFO_DATA_IN, sshp->readdir_filename,
-                     readdir_len);
-          Curl_debug(data, CURLINFO_DATA_IN, (char *)"\n", 1);
-        }
-        else {
-          result = Curl_dyn_add(&sshp->readdir, sshp->readdir_longentry);
-
-          if(!result) {
-            if((sshp->readdir_attrs.flags & LIBSSH2_SFTP_ATTR_PERMISSIONS) &&
-               ((sshp->readdir_attrs.permissions & LIBSSH2_SFTP_S_IFMT) ==
-                LIBSSH2_SFTP_S_IFLNK)) {
-              Curl_dyn_init(&sshp->readdir_link, PATH_MAX);
-              result = Curl_dyn_addf(&sshp->readdir_link, "%s%s", sshp->path,
-                                     sshp->readdir_filename);
-              state(data, SSH_SFTP_READDIR_LINK);
-              if(!result)
-                break;
-            }
-            else {
-              state(data, SSH_SFTP_READDIR_BOTTOM);
-              break;
-            }
-          }
-          sshc->actualcode = result;
-          state(data, SSH_SFTP_CLOSE);
-          break;
-        }
-      }
-      else if(rc == 0) {
-        Curl_safefree(sshp->readdir_filename);
-        Curl_safefree(sshp->readdir_longentry);
-        state(data, SSH_SFTP_READDIR_DONE);
-        break;
-      }
-      else if(rc < 0) {
-        sftperr = libssh2_sftp_last_error(sshc->sftp_session);
-        result = sftp_libssh2_error_to_CURLE(sftperr);
-        sshc->actualcode = result?result:CURLE_SSH;
-        failf(data, "Could not open remote file for reading: %s :: %d",
-              sftp_libssh2_strerror(sftperr),
-              libssh2_session_last_errno(sshc->ssh_session));
-        Curl_safefree(sshp->readdir_filename);
-        Curl_safefree(sshp->readdir_longentry);
-        state(data, SSH_SFTP_CLOSE);
-        break;
-      }
+      result = ssh_state_sftp_readdir(data, sshc, sshp, block);
       break;
 
     case SSH_SFTP_READDIR_LINK:
-      rc =
-        libssh2_sftp_symlink_ex(sshc->sftp_session,
-                                Curl_dyn_ptr(&sshp->readdir_link),
-                                (int)Curl_dyn_len(&sshp->readdir_link),
-                                sshp->readdir_filename,
-                                PATH_MAX, LIBSSH2_SFTP_READLINK);
-      if(rc == LIBSSH2_ERROR_EAGAIN) {
-        break;
-      }
-      Curl_dyn_free(&sshp->readdir_link);
-
-      /* append filename and extra output */
-      result = Curl_dyn_addf(&sshp->readdir, " -> %s", sshp->readdir_filename);
-
-      if(result) {
-        Curl_safefree(sshp->readdir_filename);
-        Curl_safefree(sshp->readdir_longentry);
-        state(data, SSH_SFTP_CLOSE);
-        sshc->actualcode = result;
-        break;
-      }
-
-      state(data, SSH_SFTP_READDIR_BOTTOM);
+      result = ssh_state_sftp_readdir_link(data, sshc, sshp);
       break;
 
     case SSH_SFTP_READDIR_BOTTOM:
-      result = Curl_dyn_addn(&sshp->readdir, "\n", 1);
-      if(!result)
-        result = Curl_client_write(data, CLIENTWRITE_BODY,
-                                   Curl_dyn_ptr(&sshp->readdir),
-                                   Curl_dyn_len(&sshp->readdir));
-
-      if(!result) {
-        /* output debug output if that is requested */
-        Curl_debug(data, CURLINFO_DATA_IN,
-                   Curl_dyn_ptr(&sshp->readdir),
-                   Curl_dyn_len(&sshp->readdir));
-        data->req.bytecount += Curl_dyn_len(&sshp->readdir);
-      }
-      if(result) {
-        Curl_dyn_free(&sshp->readdir);
-        state(data, SSH_STOP);
-      }
-      else {
-        Curl_dyn_reset(&sshp->readdir);
-        state(data, SSH_SFTP_READDIR);
-      }
+      result = ssh_state_sftp_readdir_bottom(data, sshc, sshp);
       break;
 
     case SSH_SFTP_READDIR_DONE:
-      if(libssh2_sftp_closedir(sshc->sftp_handle) ==
-         LIBSSH2_ERROR_EAGAIN) {
-        rc = LIBSSH2_ERROR_EAGAIN;
-        break;
-      }
-      sshc->sftp_handle = NULL;
-      Curl_safefree(sshp->readdir_filename);
-      Curl_safefree(sshp->readdir_longentry);
-
-      /* no data to transfer */
-      Curl_setup_transfer(data, -1, -1, FALSE, -1);
-      state(data, SSH_STOP);
+      result = ssh_state_sftp_readdir_done(data, sshc);
       break;
 
     case SSH_SFTP_DOWNLOAD_INIT:
-      /*
-       * Work on getting the specified file
-       */
-      sshc->sftp_handle =
-        libssh2_sftp_open_ex(sshc->sftp_session, sshp->path,
-                             curlx_uztoui(strlen(sshp->path)),
-                             LIBSSH2_FXF_READ, data->set.new_file_perms,
-                             LIBSSH2_SFTP_OPENFILE);
-      if(!sshc->sftp_handle) {
-        if(libssh2_session_last_errno(sshc->ssh_session) ==
-           LIBSSH2_ERROR_EAGAIN) {
-          rc = LIBSSH2_ERROR_EAGAIN;
-          break;
-        }
-        sftperr = libssh2_sftp_last_error(sshc->sftp_session);
-        failf(data, "Could not open remote file for reading: %s",
-              sftp_libssh2_strerror(sftperr));
-        state(data, SSH_SFTP_CLOSE);
-        result = sftp_libssh2_error_to_CURLE(sftperr);
-        sshc->actualcode = result?result:CURLE_SSH;
-        break;
-      }
-      state(data, SSH_SFTP_DOWNLOAD_STAT);
+      result = ssh_state_sftp_download_init(data, sshc, sshp);
       break;
 
     case SSH_SFTP_DOWNLOAD_STAT:
-    {
-      LIBSSH2_SFTP_ATTRIBUTES attrs;
-
-      rc = libssh2_sftp_stat_ex(sshc->sftp_session, sshp->path,
-                                curlx_uztoui(strlen(sshp->path)),
-                                LIBSSH2_SFTP_STAT, &attrs);
-      if(rc == LIBSSH2_ERROR_EAGAIN) {
-        break;
-      }
-      if(rc ||
-         !(attrs.flags & LIBSSH2_SFTP_ATTR_SIZE) ||
-         (attrs.filesize == 0)) {
-        /*
-         * libssh2_sftp_open() didn't return an error, so maybe the server
-         * just doesn't support stat()
-         * OR the server doesn't return a file size with a stat()
-         * OR file size is 0
-         */
-        data->req.size = -1;
-        data->req.maxdownload = -1;
-        Curl_pgrsSetDownloadSize(data, -1);
-      }
-      else {
-        curl_off_t size = attrs.filesize;
-
-        if(size < 0) {
-          failf(data, "Bad file size (%" CURL_FORMAT_CURL_OFF_T ")", size);
-          return CURLE_BAD_DOWNLOAD_RESUME;
-        }
-        if(data->state.use_range) {
-          curl_off_t from, to;
-          char *ptr;
-          char *ptr2;
-          CURLofft to_t;
-          CURLofft from_t;
-
-          from_t = curlx_strtoofft(data->state.range, &ptr, 10, &from);
-          if(from_t == CURL_OFFT_FLOW)
-            return CURLE_RANGE_ERROR;
-          while(*ptr && (ISBLANK(*ptr) || (*ptr == '-')))
-            ptr++;
-          to_t = curlx_strtoofft(ptr, &ptr2, 10, &to);
-          if(to_t == CURL_OFFT_FLOW)
-            return CURLE_RANGE_ERROR;
-          if((to_t == CURL_OFFT_INVAL) /* no "to" value given */
-             || (to >= size)) {
-            to = size - 1;
-          }
-          if(from_t) {
-            /* from is relative to end of file */
-            from = size - to;
-            to = size - 1;
-          }
-          if(from > size) {
-            failf(data, "Offset (%"
-                  CURL_FORMAT_CURL_OFF_T ") was beyond file size (%"
-                  CURL_FORMAT_CURL_OFF_T ")", from,
-                  (curl_off_t)attrs.filesize);
-            return CURLE_BAD_DOWNLOAD_RESUME;
-          }
-          if(from > to) {
-            from = to;
-            size = 0;
-          }
-          else {
-            size = to - from + 1;
-          }
-
-          SFTP_SEEK(sshc->sftp_handle, from);
-        }
-        data->req.size = size;
-        data->req.maxdownload = size;
-        Curl_pgrsSetDownloadSize(data, size);
-      }
-
-      /* We can resume if we can seek to the resume position */
-      if(data->state.resume_from) {
-        if(data->state.resume_from < 0) {
-          /* We're supposed to download the last abs(from) bytes */
-          if((curl_off_t)attrs.filesize < -data->state.resume_from) {
-            failf(data, "Offset (%"
-                  CURL_FORMAT_CURL_OFF_T ") was beyond file size (%"
-                  CURL_FORMAT_CURL_OFF_T ")",
-                  data->state.resume_from, (curl_off_t)attrs.filesize);
-            return CURLE_BAD_DOWNLOAD_RESUME;
-          }
-          /* download from where? */
-          data->state.resume_from += attrs.filesize;
-        }
-        else {
-          if((curl_off_t)attrs.filesize < data->state.resume_from) {
-            failf(data, "Offset (%" CURL_FORMAT_CURL_OFF_T
-                  ") was beyond file size (%" CURL_FORMAT_CURL_OFF_T ")",
-                  data->state.resume_from, (curl_off_t)attrs.filesize);
-            return CURLE_BAD_DOWNLOAD_RESUME;
-          }
-        }
-        /* Now store the number of bytes we are expected to download */
-        data->req.size = attrs.filesize - data->state.resume_from;
-        data->req.maxdownload = attrs.filesize - data->state.resume_from;
-        Curl_pgrsSetDownloadSize(data,
-                                 attrs.filesize - data->state.resume_from);
-        SFTP_SEEK(sshc->sftp_handle, data->state.resume_from);
-      }
-    }
-
-    /* Setup the actual download */
-    if(data->req.size == 0) {
-      /* no data to transfer */
-      Curl_setup_transfer(data, -1, -1, FALSE, -1);
-      infof(data, "File already completely downloaded");
-      state(data, SSH_STOP);
+      result = ssh_state_sftp_download_stat(data, sshc, sshp, block);
       break;
-    }
-    Curl_setup_transfer(data, FIRSTSOCKET, data->req.size, FALSE, -1);
-
-    /* not set by Curl_setup_transfer to preserve keepon bits */
-    conn->writesockfd = conn->sockfd;
-
-    /* we want to use the _receiving_ function even when the socket turns
-       out writableable as the underlying libssh2 recv function will deal
-       with both accordingly */
-    conn->cselect_bits = CURL_CSELECT_IN;
-
-    if(result) {
-      /* this should never occur; the close state should be entered
-         at the time the error occurs */
-      state(data, SSH_SFTP_CLOSE);
-      sshc->actualcode = result;
-    }
-    else {
-      state(data, SSH_STOP);
-    }
-    break;
 
     case SSH_SFTP_CLOSE:
-      if(sshc->sftp_handle) {
-        rc = libssh2_sftp_close(sshc->sftp_handle);
-        if(rc == LIBSSH2_ERROR_EAGAIN) {
-          break;
-        }
-        if(rc < 0) {
-          char *err_msg = NULL;
-          (void)libssh2_session_last_error(sshc->ssh_session,
-                                           &err_msg, NULL, 0);
-          infof(data, "Failed to close libssh2 file: %d %s", rc, err_msg);
-        }
-        sshc->sftp_handle = NULL;
-      }
-
-      Curl_safefree(sshp->path);
-
-      DEBUGF(infof(data, "SFTP DONE done"));
-
-      /* Check if nextstate is set and move .nextstate could be POSTQUOTE_INIT
-         After nextstate is executed, the control should come back to
-         SSH_SFTP_CLOSE to pass the correct result back  */
-      if(sshc->nextstate != SSH_NO_STATE &&
-         sshc->nextstate != SSH_SFTP_CLOSE) {
-        state(data, sshc->nextstate);
-        sshc->nextstate = SSH_SFTP_CLOSE;
-      }
-      else {
-        state(data, SSH_STOP);
-        result = sshc->actualcode;
-      }
+      result = ssh_state_sftp_close(data, sshc, sshp);
       break;
 
     case SSH_SFTP_SHUTDOWN:
-      /* during times we get here due to a broken transfer and then the
-         sftp_handle might not have been taken down so make sure that is done
-         before we proceed */
-
-      if(sshc->sftp_handle) {
-        rc = libssh2_sftp_close(sshc->sftp_handle);
-        if(rc == LIBSSH2_ERROR_EAGAIN) {
-          break;
-        }
-        if(rc < 0) {
-          char *err_msg = NULL;
-          (void)libssh2_session_last_error(sshc->ssh_session, &err_msg,
-                                           NULL, 0);
-          infof(data, "Failed to close libssh2 file: %d %s", rc, err_msg);
-        }
-        sshc->sftp_handle = NULL;
-      }
-      if(sshc->sftp_session) {
-        rc = libssh2_sftp_shutdown(sshc->sftp_session);
-        if(rc == LIBSSH2_ERROR_EAGAIN) {
-          break;
-        }
-        if(rc < 0) {
-          infof(data, "Failed to stop libssh2 sftp subsystem");
-        }
-        sshc->sftp_session = NULL;
-      }
-
-      Curl_safefree(sshc->homedir);
-      data->state.most_recent_ftp_entrypath = NULL;
-
-      state(data, SSH_SESSION_DISCONNECT);
+      result = ssh_state_sftp_shutdown(data, sshc);
       break;
 
     case SSH_SCP_TRANS_INIT:
-      result = Curl_getworkingpath(data, sshc->homedir, &sshp->path);
-      if(result) {
-        sshc->actualcode = result;
-        state(data, SSH_STOP);
-        break;
-      }
-
-      if(data->state.upload) {
-        if(data->state.infilesize < 0) {
-          failf(data, "SCP requires a known file size for upload");
-          sshc->actualcode = CURLE_UPLOAD_FAILED;
-          state(data, SSH_SCP_CHANNEL_FREE);
-          break;
-        }
-        state(data, SSH_SCP_UPLOAD_INIT);
-      }
-      else {
-        state(data, SSH_SCP_DOWNLOAD_INIT);
-      }
+      result = ssh_state_scp_trans_init(data, sshc, sshp);
       break;
 
     case SSH_SCP_UPLOAD_INIT:
-      /*
-       * libssh2 requires that the destination path is a full path that
-       * includes the destination file and name OR ends in a "/" .  If this is
-       * not done the destination file will be named the same name as the last
-       * directory in the path.
-       */
-      sshc->ssh_channel =
-        SCP_SEND(sshc->ssh_session, sshp->path, data->set.new_file_perms,
-                 data->state.infilesize);
-      if(!sshc->ssh_channel) {
-        int ssh_err;
-        char *err_msg = NULL;
-
-        if(libssh2_session_last_errno(sshc->ssh_session) ==
-           LIBSSH2_ERROR_EAGAIN) {
-          rc = LIBSSH2_ERROR_EAGAIN;
-          break;
-        }
-
-        ssh_err = (int)(libssh2_session_last_error(sshc->ssh_session,
-                                                   &err_msg, NULL, 0));
-        failf(data, "%s", err_msg);
-        state(data, SSH_SCP_CHANNEL_FREE);
-        sshc->actualcode = libssh2_session_error_to_CURLE(ssh_err);
-        /* Map generic errors to upload failed */
-        if(sshc->actualcode == CURLE_SSH ||
-           sshc->actualcode == CURLE_REMOTE_FILE_NOT_FOUND)
-          sshc->actualcode = CURLE_UPLOAD_FAILED;
-        break;
-      }
-
-      /* upload data */
-      data->req.size = data->state.infilesize;
-      Curl_pgrsSetUploadSize(data, data->state.infilesize);
-      Curl_setup_transfer(data, -1, -1, FALSE, FIRSTSOCKET);
-
-      /* not set by Curl_setup_transfer to preserve keepon bits */
-      conn->sockfd = conn->writesockfd;
-
-      if(result) {
-        state(data, SSH_SCP_CHANNEL_FREE);
-        sshc->actualcode = result;
-      }
-      else {
-        /* store this original bitmask setup to use later on if we can't
-           figure out a "real" bitmask */
-        sshc->orig_waitfor = data->req.keepon;
-
-        /* we want to use the _sending_ function even when the socket turns
-           out readable as the underlying libssh2 scp send function will deal
-           with both accordingly */
-        conn->cselect_bits = CURL_CSELECT_OUT;
-
-        state(data, SSH_STOP);
-      }
+      result = ssh_state_scp_upload_init(data, sshc, sshp);
       break;
 
     case SSH_SCP_DOWNLOAD_INIT:
-    {
-      curl_off_t bytecount;
-
-      /*
-       * We must check the remote file; if it is a directory no values will
-       * be set in sb
-       */
-
-      /*
-       * If support for >2GB files exists, use it.
-       */
-
-      /* get a fresh new channel from the ssh layer */
-#if LIBSSH2_VERSION_NUM < 0x010700
-      struct stat sb;
-      memset(&sb, 0, sizeof(struct stat));
-      sshc->ssh_channel = libssh2_scp_recv(sshc->ssh_session,
-                                           sshp->path, &sb);
-#else
-      libssh2_struct_stat sb;
-      memset(&sb, 0, sizeof(libssh2_struct_stat));
-      sshc->ssh_channel = libssh2_scp_recv2(sshc->ssh_session,
-                                            sshp->path, &sb);
-#endif
-
-      if(!sshc->ssh_channel) {
-        int ssh_err;
-        char *err_msg = NULL;
-
-        if(libssh2_session_last_errno(sshc->ssh_session) ==
-           LIBSSH2_ERROR_EAGAIN) {
-          rc = LIBSSH2_ERROR_EAGAIN;
-          break;
-        }
-
-
-        ssh_err = (int)(libssh2_session_last_error(sshc->ssh_session,
-                                                   &err_msg, NULL, 0));
-        failf(data, "%s", err_msg);
-        state(data, SSH_SCP_CHANNEL_FREE);
-        sshc->actualcode = libssh2_session_error_to_CURLE(ssh_err);
-        break;
-      }
-
-      /* download data */
-      bytecount = (curl_off_t)sb.st_size;
-      data->req.maxdownload = (curl_off_t)sb.st_size;
-      Curl_setup_transfer(data, FIRSTSOCKET, bytecount, FALSE, -1);
-
-      /* not set by Curl_setup_transfer to preserve keepon bits */
-      conn->writesockfd = conn->sockfd;
-
-      /* we want to use the _receiving_ function even when the socket turns
-         out writableable as the underlying libssh2 recv function will deal
-         with both accordingly */
-      conn->cselect_bits = CURL_CSELECT_IN;
-
-      if(result) {
-        state(data, SSH_SCP_CHANNEL_FREE);
-        sshc->actualcode = result;
-      }
-      else
-        state(data, SSH_STOP);
-    }
-    break;
+      result = ssh_state_scp_download_init(data, sshc, sshp);
+      break;
 
     case SSH_SCP_DONE:
-      if(data->state.upload)
-        state(data, SSH_SCP_SEND_EOF);
-      else
-        state(data, SSH_SCP_CHANNEL_FREE);
+      result = ssh_state_scp_done(data, sshc);
       break;
 
     case SSH_SCP_SEND_EOF:
-      if(sshc->ssh_channel) {
-        rc = libssh2_channel_send_eof(sshc->ssh_channel);
-        if(rc == LIBSSH2_ERROR_EAGAIN) {
-          break;
-        }
-        if(rc) {
-          char *err_msg = NULL;
-          (void)libssh2_session_last_error(sshc->ssh_session,
-                                           &err_msg, NULL, 0);
-          infof(data, "Failed to send libssh2 channel EOF: %d %s",
-                rc, err_msg);
-        }
-      }
-      state(data, SSH_SCP_WAIT_EOF);
+      result = ssh_state_scp_send_eof(data, sshc);
       break;
 
     case SSH_SCP_WAIT_EOF:
-      if(sshc->ssh_channel) {
-        rc = libssh2_channel_wait_eof(sshc->ssh_channel);
-        if(rc == LIBSSH2_ERROR_EAGAIN) {
-          break;
-        }
-        if(rc) {
-          char *err_msg = NULL;
-          (void)libssh2_session_last_error(sshc->ssh_session,
-                                           &err_msg, NULL, 0);
-          infof(data, "Failed to get channel EOF: %d %s", rc, err_msg);
-        }
-      }
-      state(data, SSH_SCP_WAIT_CLOSE);
+      result = ssh_state_scp_wait_eof(data, sshc);
       break;
 
     case SSH_SCP_WAIT_CLOSE:
-      if(sshc->ssh_channel) {
-        rc = libssh2_channel_wait_closed(sshc->ssh_channel);
-        if(rc == LIBSSH2_ERROR_EAGAIN) {
-          break;
-        }
-        if(rc) {
-          char *err_msg = NULL;
-          (void)libssh2_session_last_error(sshc->ssh_session,
-                                           &err_msg, NULL, 0);
-          infof(data, "Channel failed to close: %d %s", rc, err_msg);
-        }
-      }
-      state(data, SSH_SCP_CHANNEL_FREE);
+      result = ssh_state_scp_wait_close(data, sshc);
       break;
 
     case SSH_SCP_CHANNEL_FREE:
-      if(sshc->ssh_channel) {
-        rc = libssh2_channel_free(sshc->ssh_channel);
-        if(rc == LIBSSH2_ERROR_EAGAIN) {
-          break;
-        }
-        if(rc < 0) {
-          char *err_msg = NULL;
-          (void)libssh2_session_last_error(sshc->ssh_session,
-                                           &err_msg, NULL, 0);
-          infof(data, "Failed to free libssh2 scp subsystem: %d %s",
-                rc, err_msg);
-        }
-        sshc->ssh_channel = NULL;
-      }
-      DEBUGF(infof(data, "SCP DONE phase complete"));
-#if 0 /* PREV */
-      state(data, SSH_SESSION_DISCONNECT);
-#endif
-      state(data, SSH_STOP);
-      result = sshc->actualcode;
+      result = ssh_state_scp_channel_free(data, sshc);
       break;
 
     case SSH_SESSION_DISCONNECT:
-      /* during weird times when we've been prematurely aborted, the channel
-         is still alive when we reach this state and we MUST kill the channel
-         properly first */
-      if(sshc->ssh_channel) {
-        rc = libssh2_channel_free(sshc->ssh_channel);
-        if(rc == LIBSSH2_ERROR_EAGAIN) {
-          break;
-        }
-        if(rc < 0) {
-          char *err_msg = NULL;
-          (void)libssh2_session_last_error(sshc->ssh_session,
-                                           &err_msg, NULL, 0);
-          infof(data, "Failed to free libssh2 scp subsystem: %d %s",
-                rc, err_msg);
-        }
-        sshc->ssh_channel = NULL;
-      }
-
-      if(sshc->ssh_session) {
-        rc = libssh2_session_disconnect(sshc->ssh_session, "Shutdown");
-        if(rc == LIBSSH2_ERROR_EAGAIN) {
-          break;
-        }
-        if(rc < 0) {
-          char *err_msg = NULL;
-          (void)libssh2_session_last_error(sshc->ssh_session,
-                                           &err_msg, NULL, 0);
-          infof(data, "Failed to disconnect libssh2 session: %d %s",
-                rc, err_msg);
-        }
-      }
-
-      Curl_safefree(sshc->homedir);
-      data->state.most_recent_ftp_entrypath = NULL;
-
-      state(data, SSH_SESSION_FREE);
+      result = ssh_state_session_disconnect(data, sshc);
       break;
 
     case SSH_SESSION_FREE:
-#ifdef HAVE_LIBSSH2_KNOWNHOST_API
-      if(sshc->kh) {
-        libssh2_knownhost_free(sshc->kh);
-        sshc->kh = NULL;
-      }
-#endif
-
-#ifdef HAVE_LIBSSH2_AGENT_API
-      if(sshc->ssh_agent) {
-        rc = libssh2_agent_disconnect(sshc->ssh_agent);
-        if(rc == LIBSSH2_ERROR_EAGAIN) {
-          break;
-        }
-        if(rc < 0) {
-          char *err_msg = NULL;
-          (void)libssh2_session_last_error(sshc->ssh_session,
-                                           &err_msg, NULL, 0);
-          infof(data, "Failed to disconnect from libssh2 agent: %d %s",
-                rc, err_msg);
-        }
-        libssh2_agent_free(sshc->ssh_agent);
-        sshc->ssh_agent = NULL;
-
-        /* NB: there is no need to free identities, they are part of internal
-           agent stuff */
-        sshc->sshagent_identity = NULL;
-        sshc->sshagent_prev_identity = NULL;
-      }
-#endif
-
-      if(sshc->ssh_session) {
-        rc = libssh2_session_free(sshc->ssh_session);
-        if(rc == LIBSSH2_ERROR_EAGAIN) {
-          break;
-        }
-        if(rc < 0) {
-          char *err_msg = NULL;
-          (void)libssh2_session_last_error(sshc->ssh_session,
-                                           &err_msg, NULL, 0);
-          infof(data, "Failed to free libssh2 session: %d %s", rc, err_msg);
-        }
-        sshc->ssh_session = NULL;
-      }
-
-      /* worst-case scenario cleanup */
-
-      DEBUGASSERT(sshc->ssh_session == NULL);
-      DEBUGASSERT(sshc->ssh_channel == NULL);
-      DEBUGASSERT(sshc->sftp_session == NULL);
-      DEBUGASSERT(sshc->sftp_handle == NULL);
-#ifdef HAVE_LIBSSH2_KNOWNHOST_API
-      DEBUGASSERT(sshc->kh == NULL);
-#endif
-#ifdef HAVE_LIBSSH2_AGENT_API
-      DEBUGASSERT(sshc->ssh_agent == NULL);
-#endif
-
-      Curl_safefree(sshc->rsa_pub);
-      Curl_safefree(sshc->rsa);
-      Curl_safefree(sshc->quote_path1);
-      Curl_safefree(sshc->quote_path2);
-      Curl_safefree(sshc->homedir);
-
-      /* the code we are about to return */
-      result = sshc->actualcode;
-
-      memset(sshc, 0, sizeof(struct ssh_conn));
-
-      connclose(conn, "SSH session free");
-      sshc->state = SSH_SESSION_FREE; /* current */
-      sshc->nextstate = SSH_NO_STATE;
-      state(data, SSH_STOP);
+      result = ssh_state_session_free(data, sshc);
       break;
 
     case SSH_QUIT:
-      /* fallthrough, just stop! */
     default:
       /* internal error */
-      sshc->nextstate = SSH_NO_STATE;
-      state(data, SSH_STOP);
+      myssh_to(data, sshc, SSH_STOP);
       break;
     }
 
-  } while(!rc && (sshc->state != SSH_STOP));
+  } while(!result && (sshc->state != SSH_STOP) && !*block);
 
-  if(rc == LIBSSH2_ERROR_EAGAIN) {
+  if(result == CURLE_AGAIN) {
     /* we would block, we need to wait for the socket to be ready (in the
        right direction too)! */
     *block = TRUE;
+    result = CURLE_OK;
   }
+  CURL_TRC_SSH(data, "[%s] statemachine() -> %d, block=%d",
+               Curl_ssh_statename(sshc->state), (int)result, *block);
 
   return result;
 }
 
 /* called by the multi interface to figure out what socket(s) to wait for and
    for what actions in the DO_DONE, PERFORM and WAITPERFORM states */
-static int ssh_getsock(struct Curl_easy *data,
-                       struct connectdata *conn,
-                       curl_socket_t *sock)
+static CURLcode ssh_pollset(struct Curl_easy *data,
+                            struct easy_pollset *ps)
 {
-  int bitmap = GETSOCK_BLANK;
-  (void)data;
+  struct connectdata *conn = data->conn;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+  curl_socket_t sock = conn->sock[FIRSTSOCKET];
+  int waitfor;
 
-  sock[0] = conn->sock[FIRSTSOCKET];
+  if(!sshc || (sock == CURL_SOCKET_BAD))
+    return CURLE_FAILED_INIT;
 
-  if(conn->waitfor & KEEP_RECV)
-    bitmap |= GETSOCK_READSOCK(FIRSTSOCKET);
-
-  if(conn->waitfor & KEEP_SEND)
-    bitmap |= GETSOCK_WRITESOCK(FIRSTSOCKET);
-
-  return bitmap;
+  waitfor = sshc->waitfor ? sshc->waitfor : data->req.io_flags;
+  if(waitfor) {
+    int flags = 0;
+    if(waitfor & REQ_IO_RECV)
+      flags |= CURL_POLL_IN;
+    if(waitfor & REQ_IO_SEND)
+      flags |= CURL_POLL_OUT;
+    DEBUGASSERT(flags);
+    CURL_TRC_SSH(data, "pollset, flags=%x", (unsigned int)flags);
+    return Curl_pollset_change(data, ps, sock, flags, 0);
+  }
+  /* While we still have a session, we listen incoming data. */
+  if(sshc->ssh_session)
+    return Curl_pollset_change(data, ps, sock, CURL_POLL_IN, 0);
+  return CURLE_OK;
 }
 
 /*
  * When one of the libssh2 functions has returned LIBSSH2_ERROR_EAGAIN this
  * function is used to figure out in what direction and stores this info so
  * that the multi interface can take advantage of it. Make sure to call this
- * function in all cases so that when it _doesn't_ return EAGAIN we can
+ * function in all cases so that when it _does not_ return EAGAIN we can
  * restore the default wait bits.
  */
-static void ssh_block2waitfor(struct Curl_easy *data, bool block)
+static void ssh_block2waitfor(struct Curl_easy *data,
+                              struct ssh_conn *sshc,
+                              bool block)
 {
-  struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
   int dir = 0;
+  (void)data;
   if(block) {
     dir = libssh2_session_block_directions(sshc->ssh_session);
     if(dir) {
       /* translate the libssh2 define bits into our own bit defines */
-      conn->waitfor = ((dir&LIBSSH2_SESSION_BLOCK_INBOUND)?KEEP_RECV:0) |
-        ((dir&LIBSSH2_SESSION_BLOCK_OUTBOUND)?KEEP_SEND:0);
+      sshc->waitfor =
+        ((dir & LIBSSH2_SESSION_BLOCK_INBOUND) ? REQ_IO_RECV : 0) |
+        ((dir & LIBSSH2_SESSION_BLOCK_OUTBOUND) ? REQ_IO_SEND : 0);
     }
   }
   if(!dir)
-    /* It didn't block or libssh2 didn't reveal in which direction, put back
-       the original set */
-    conn->waitfor = sshc->orig_waitfor;
+    sshc->waitfor = 0;
 }
 
 /* called repeatedly until done from multi.c */
 static CURLcode ssh_multi_statemach(struct Curl_easy *data, bool *done)
 {
   struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+  struct SSHPROTO *sshp = Curl_meta_get(data, CURL_META_SSH_EASY);
   CURLcode result = CURLE_OK;
-  bool block; /* we store the status and use that to provide a ssh_getsock()
+  bool block; /* we store the status and use that to provide a ssh_pollset()
                  implementation */
+  if(!sshc || !sshp)
+    return CURLE_FAILED_INIT;
+
   do {
-    result = ssh_statemach_act(data, &block);
-    *done = (sshc->state == SSH_STOP) ? TRUE : FALSE;
-    /* if there's no error, it isn't done and it didn't EWOULDBLOCK, then
+    result = ssh_statemachine(data, sshc, sshp, &block);
+    *done = (sshc->state == SSH_STOP);
+    /* if there is no error, it is not done and it did not EWOULDBLOCK, then
        try again */
   } while(!result && !*done && !block);
-  ssh_block2waitfor(data, block);
+  ssh_block2waitfor(data, sshc, block);
 
   return result;
 }
 
 static CURLcode ssh_block_statemach(struct Curl_easy *data,
-                                    struct connectdata *conn,
+                                    struct ssh_conn *sshc,
+                                    struct SSHPROTO *sshp,
                                     bool disconnect)
 {
-  struct ssh_conn *sshc = &conn->proto.sshc;
   CURLcode result = CURLE_OK;
-  struct curltime dis = Curl_now();
+  struct curltime start = *Curl_pgrs_now(data);
 
   while((sshc->state != SSH_STOP) && !result) {
     bool block;
-    timediff_t left = 1000;
-    struct curltime now = Curl_now();
+    timediff_t left_ms = 1000;
 
-    result = ssh_statemach_act(data, &block);
+    result = ssh_statemachine(data, sshc, sshp, &block);
     if(result)
       break;
 
     if(!disconnect) {
-      if(Curl_pgrsUpdate(data))
-        return CURLE_ABORTED_BY_CALLBACK;
-
-      result = Curl_speedcheck(data, now);
+      result = Curl_pgrsCheck(data);
       if(result)
         break;
 
-      left = Curl_timeleft(data, NULL, FALSE);
-      if(left < 0) {
+      left_ms = Curl_timeleft_ms(data);
+      if(left_ms < 0) {
         failf(data, "Operation timed out");
         return CURLE_OPERATION_TIMEDOUT;
       }
     }
-    else if(Curl_timediff(now, dis) > 1000) {
+    else if(curlx_ptimediff_ms(Curl_pgrs_now(data), &start) > 1000) {
       /* disconnect timeout */
       failf(data, "Disconnect timed out");
       result = CURLE_OK;
@@ -3146,7 +3311,7 @@ static CURLcode ssh_block_statemach(struct Curl_easy *data,
 
     if(block) {
       int dir = libssh2_session_block_directions(sshc->ssh_session);
-      curl_socket_t sock = conn->sock[FIRSTSOCKET];
+      curl_socket_t sock = data->conn->sock[FIRSTSOCKET];
       curl_socket_t fd_read = CURL_SOCKET_BAD;
       curl_socket_t fd_write = CURL_SOCKET_BAD;
       if(LIBSSH2_SESSION_BLOCK_INBOUND & dir)
@@ -3155,24 +3320,57 @@ static CURLcode ssh_block_statemach(struct Curl_easy *data,
         fd_write = sock;
       /* wait for the socket to become ready */
       (void)Curl_socket_check(fd_read, CURL_SOCKET_BAD, fd_write,
-                              left>1000?1000:left);
+                              left_ms > 1000 ? 1000 : left_ms);
     }
   }
 
   return result;
 }
 
+static void myssh_easy_dtor(void *key, size_t klen, void *entry)
+{
+  struct SSHPROTO *sshp = entry;
+  (void)key;
+  (void)klen;
+  curlx_safefree(sshp->path);
+  curlx_dyn_free(&sshp->readdir);
+  curlx_dyn_free(&sshp->readdir_link);
+  curlx_free(sshp);
+}
+
+static void myssh_conn_dtor(void *key, size_t klen, void *entry)
+{
+  struct ssh_conn *sshc = entry;
+  (void)key;
+  (void)klen;
+  sshc_cleanup(sshc, NULL, TRUE);
+  curlx_free(sshc);
+}
+
 /*
  * SSH setup and connection
  */
 static CURLcode ssh_setup_connection(struct Curl_easy *data,
                                      struct connectdata *conn)
 {
-  struct SSHPROTO *ssh;
+  struct ssh_conn *sshc;
+  struct SSHPROTO *sshp;
   (void)conn;
 
-  data->req.p.ssh = ssh = calloc(1, sizeof(struct SSHPROTO));
-  if(!ssh)
+  sshc = curlx_calloc(1, sizeof(*sshc));
+  if(!sshc)
+    return CURLE_OUT_OF_MEMORY;
+
+  if(Curl_conn_meta_set(conn, CURL_META_SSH_CONN, sshc, myssh_conn_dtor))
+    return CURLE_OUT_OF_MEMORY;
+
+  sshp = curlx_calloc(1, sizeof(*sshp));
+  if(!sshp)
+    return CURLE_OUT_OF_MEMORY;
+
+  curlx_dyn_init(&sshp->readdir, CURL_PATH_MAX * 2);
+  curlx_dyn_init(&sshp->readdir_link, CURL_PATH_MAX);
+  if(Curl_meta_set(data, CURL_META_SSH_EASY, sshp, myssh_easy_dtor))
     return CURLE_OUT_OF_MEMORY;
 
   return CURLE_OK;
@@ -3186,48 +3384,56 @@ static ssize_t ssh_tls_recv(libssh2_socket_t sock, void *buffer,
                             size_t length, int flags, void **abstract)
 {
   struct Curl_easy *data = (struct Curl_easy *)*abstract;
-  ssize_t nread;
+  int sockindex = Curl_conn_sockindex(data, sock);
+  size_t nread;
   CURLcode result;
   struct connectdata *conn = data->conn;
-  Curl_recv *backup = conn->recv[0];
-  struct ssh_conn *ssh = &conn->proto.sshc;
+  Curl_recv *backup = conn->recv[sockindex];
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
   (void)flags;
 
+  if(!sshc)
+    return -1;
+
   /* swap in the TLS reader function for this call only, and then swap back
      the SSH one again */
-  conn->recv[0] = ssh->tls_recv;
-  result = Curl_read(data, sock, buffer, length, &nread);
-  conn->recv[0] = backup;
+  conn->recv[sockindex] = sshc->tls_recv;
+  result = Curl_conn_recv(data, sockindex, buffer, length, &nread);
+  conn->recv[sockindex] = backup;
   if(result == CURLE_AGAIN)
     return -EAGAIN; /* magic return code for libssh2 */
   else if(result)
     return -1; /* generic error */
-  Curl_debug(data, CURLINFO_DATA_IN, (char *)buffer, (size_t)nread);
-  return nread;
+  Curl_debug(data, CURLINFO_DATA_IN, (const char *)buffer, nread);
+  return (ssize_t)nread;
 }
 
 static ssize_t ssh_tls_send(libssh2_socket_t sock, const void *buffer,
                             size_t length, int flags, void **abstract)
 {
   struct Curl_easy *data = (struct Curl_easy *)*abstract;
-  ssize_t nwrite;
+  int sockindex = Curl_conn_sockindex(data, sock);
+  size_t nwrite;
   CURLcode result;
   struct connectdata *conn = data->conn;
-  Curl_send *backup = conn->send[0];
-  struct ssh_conn *ssh = &conn->proto.sshc;
+  Curl_send *backup = conn->send[sockindex];
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
   (void)flags;
 
+  if(!sshc)
+    return -1;
+
   /* swap in the TLS writer function for this call only, and then swap back
      the SSH one again */
-  conn->send[0] = ssh->tls_send;
-  result = Curl_write(data, sock, buffer, length, &nwrite);
-  conn->send[0] = backup;
+  conn->send[sockindex] = sshc->tls_send;
+  result = Curl_conn_send(data, sockindex, buffer, length, FALSE, &nwrite);
+  conn->send[sockindex] = backup;
   if(result == CURLE_AGAIN)
     return -EAGAIN; /* magic return code for libssh2 */
   else if(result)
     return -1; /* error */
-  Curl_debug(data, CURLINFO_DATA_OUT, (char *)buffer, (size_t)nwrite);
-  return nwrite;
+  Curl_debug(data, CURLINFO_DATA_OUT, (const char *)buffer, nwrite);
+  return (ssize_t)nwrite;
 }
 #endif
 
@@ -3240,56 +3446,96 @@ static CURLcode ssh_connect(struct Curl_easy *data, bool *done)
 #ifdef CURL_LIBSSH2_DEBUG
   curl_socket_t sock;
 #endif
-  struct ssh_conn *sshc;
-  CURLcode result;
   struct connectdata *conn = data->conn;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+  CURLcode result;
 
-  /* initialize per-handle data if not already */
-  if(!data->req.p.ssh) {
-    result = ssh_setup_connection(data, conn);
-    if(result)
-      return result;
+#if LIBSSH2_VERSION_NUM >= 0x010b00
+  {
+    const char *crypto_str;
+    switch(libssh2_crypto_engine()) {
+    case libssh2_gcrypt:
+      crypto_str = "libgcrypt";
+      break;
+    case libssh2_mbedtls:
+      crypto_str = "mbedTLS";
+      break;
+    case libssh2_openssl:
+      crypto_str = "openssl compatible";
+      break;
+    case libssh2_os400qc3:
+      crypto_str = "OS400QC3";
+      break;
+    case libssh2_wincng:
+      crypto_str = "WinCNG";
+      break;
+    default:
+      crypto_str = NULL;
+      break;
+    }
+    if(crypto_str)
+      infof(data, "SSH: libssh2 cryptography backend: %s", crypto_str);
   }
+#endif
 
-  /* We default to persistent connections. We set this already in this connect
-     function to make the reuse checks properly be able to check this bit. */
-  connkeep(conn, "SSH default");
-
-  sshc = &conn->proto.sshc;
+  if(!sshc)
+    return CURLE_FAILED_INIT;
 
+  infof(data, "SSH: user '%s'", Curl_creds_user(conn->creds));
 #ifdef CURL_LIBSSH2_DEBUG
-  if(conn->user) {
-    infof(data, "User: %s", conn->user);
-  }
-  if(conn->passwd) {
-    infof(data, "Password: %s", conn->passwd);
-  }
+  infof(data, "SSH: password %s", Curl_creds_passwd(conn->creds));
   sock = conn->sock[FIRSTSOCKET];
 #endif /* CURL_LIBSSH2_DEBUG */
 
   /* libcurl MUST to set custom memory functions so that the kbd_callback
-     funciton's memory allocations can be properled freed */
+     function's memory allocations can be properly freed */
   sshc->ssh_session = libssh2_session_init_ex(my_libssh2_malloc,
                                               my_libssh2_free,
                                               my_libssh2_realloc, data);
 
   if(!sshc->ssh_session) {
-    failf(data, "Failure initialising ssh session");
+    failf(data, "Failure initializing ssh session");
     return CURLE_FAILED_INIT;
   }
 
-#ifdef HAVE_LIBSSH2_VERSION
   /* Set the packet read timeout if the libssh2 version supports it */
 #if LIBSSH2_VERSION_NUM >= 0x010B00
   if(data->set.server_response_timeout > 0) {
     libssh2_session_set_read_timeout(sshc->ssh_session,
-                                     data->set.server_response_timeout / 1000);
+                             (long)(data->set.server_response_timeout / 1000));
   }
 #endif
-#endif
 
 #ifndef CURL_DISABLE_PROXY
   if(conn->http_proxy.proxytype == CURLPROXY_HTTPS) {
+    /*
+      Setup libssh2 callbacks to make it read/write TLS from the socket.
+
+      ssize_t
+      recvcb(libssh2_socket_t sock, void *buffer, size_t length,
+      int flags, void **abstract);
+
+      ssize_t
+      sendcb(libssh2_socket_t sock, const void *buffer, size_t length,
+      int flags, void **abstract);
+
+    */
+#if LIBSSH2_VERSION_NUM >= 0x010b01
+    infof(data, "SSH: using HTTPS proxy");
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wcast-function-type-strict"
+#endif
+    libssh2_session_callback_set2(sshc->ssh_session,
+                                  LIBSSH2_CALLBACK_RECV,
+                                  (libssh2_cb_generic *)ssh_tls_recv);
+    libssh2_session_callback_set2(sshc->ssh_session,
+                                  LIBSSH2_CALLBACK_SEND,
+                                  (libssh2_cb_generic *)ssh_tls_send);
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic pop
+#endif
+#else
     /*
      * This crazy union dance is here to avoid assigning a void pointer a
      * function pointer as it is invalid C. The problem is of course that
@@ -3309,23 +3555,12 @@ static CURLcode ssh_connect(struct Curl_easy *data, bool *done)
     sshrecv.recvptr = ssh_tls_recv;
     sshsend.sendptr = ssh_tls_send;
 
-    infof(data, "Uses HTTPS proxy");
-    /*
-      Setup libssh2 callbacks to make it read/write TLS from the socket.
-
-      ssize_t
-      recvcb(libssh2_socket_t sock, void *buffer, size_t length,
-      int flags, void **abstract);
-
-      ssize_t
-      sendcb(libssh2_socket_t sock, const void *buffer, size_t length,
-      int flags, void **abstract);
-
-    */
+    infof(data, "SSH: using HTTPS proxy");
     libssh2_session_callback_set(sshc->ssh_session,
                                  LIBSSH2_CALLBACK_RECV, sshrecv.recvp);
     libssh2_session_callback_set(sshc->ssh_session,
                                  LIBSSH2_CALLBACK_SEND, sshsend.sendp);
+#endif
 
     /* Store the underlying TLS recv/send function pointers to be used when
        reading from the proxy */
@@ -3334,7 +3569,7 @@ static CURLcode ssh_connect(struct Curl_easy *data, bool *done)
   }
 
 #endif /* CURL_DISABLE_PROXY */
-  if(conn->handler->protocol & CURLPROTO_SCP) {
+  if(conn->scheme->protocol & CURLPROTO_SCP) {
     conn->recv[FIRSTSOCKET] = scp_recv;
     conn->send[FIRSTSOCKET] = scp_send;
   }
@@ -3343,14 +3578,11 @@ static CURLcode ssh_connect(struct Curl_easy *data, bool *done)
     conn->send[FIRSTSOCKET] = sftp_send;
   }
 
-  if(data->set.ssh_compression) {
-#if LIBSSH2_VERSION_NUM >= 0x010208
-    if(libssh2_session_flag(sshc->ssh_session, LIBSSH2_FLAG_COMPRESS, 1) < 0)
-#endif
-      infof(data, "Failed to enable compression for ssh session");
+  if(data->set.ssh_compression &&
+     libssh2_session_flag(sshc->ssh_session, LIBSSH2_FLAG_COMPRESS, 1) < 0) {
+    infof(data, "SSH: failed to enable compression for session");
   }
 
-#ifdef HAVE_LIBSSH2_KNOWNHOST_API
   if(data->set.str[STRING_SSH_KNOWNHOSTS]) {
     int rc;
     sshc->kh = libssh2_knownhost_init(sshc->ssh_session);
@@ -3365,17 +3597,16 @@ static CURLcode ssh_connect(struct Curl_easy *data, bool *done)
                                     data->set.str[STRING_SSH_KNOWNHOSTS],
                                     LIBSSH2_KNOWNHOST_FILE_OPENSSH);
     if(rc < 0)
-      infof(data, "Failed to read known hosts from %s",
+      infof(data, "SSH: failed to read known hosts from %s",
             data->set.str[STRING_SSH_KNOWNHOSTS]);
   }
-#endif /* HAVE_LIBSSH2_KNOWNHOST_API */
 
 #ifdef CURL_LIBSSH2_DEBUG
   libssh2_trace(sshc->ssh_session, ~0);
-  infof(data, "SSH socket: %d", (int)sock);
-#endif /* CURL_LIBSSH2_DEBUG */
+  infof(data, "SSH: socket %d", (int)sock);
+#endif
 
-  state(data, SSH_INIT);
+  myssh_to(data, sshc, SSH_INIT);
 
   result = ssh_multi_statemach(data, done);
 
@@ -3391,19 +3622,21 @@ static CURLcode ssh_connect(struct Curl_easy *data, bool *done)
  * the options previously setup.
  */
 
-static
-CURLcode scp_perform(struct Curl_easy *data,
-                     bool *connected,
-                     bool *dophase_done)
+static CURLcode scp_perform(struct Curl_easy *data,
+                            bool *connected,
+                            bool *dophase_done)
 {
+  struct ssh_conn *sshc = Curl_conn_meta_get(data->conn, CURL_META_SSH_CONN);
   CURLcode result = CURLE_OK;
 
-  DEBUGF(infof(data, "DO phase starts"));
+  CURL_TRC_SSH(data, "DO phase starts");
 
   *dophase_done = FALSE; /* not done yet */
+  if(!sshc)
+    return CURLE_FAILED_INIT;
 
   /* start the first command in the DO phase */
-  state(data, SSH_SCP_TRANS_INIT);
+  myssh_to(data, sshc, SSH_SCP_TRANS_INIT);
 
   /* run the state-machine */
   result = ssh_multi_statemach(data, dophase_done);
@@ -3411,7 +3644,7 @@ CURLcode scp_perform(struct Curl_easy *data,
   *connected = Curl_conn_is_connected(data->conn, FIRSTSOCKET);
 
   if(*dophase_done) {
-    DEBUGF(infof(data, "DO phase is complete"));
+    CURL_TRC_SSH(data, "DO phase is complete");
   }
 
   return result;
@@ -3425,44 +3658,11 @@ static CURLcode scp_doing(struct Curl_easy *data,
   result = ssh_multi_statemach(data, dophase_done);
 
   if(*dophase_done) {
-    DEBUGF(infof(data, "DO phase is complete"));
+    CURL_TRC_SSH(data, "DO phase is complete");
   }
   return result;
 }
 
-/*
- * The DO function is generic for both protocols. There was previously two
- * separate ones but this way means less duplicated code.
- */
-
-static CURLcode ssh_do(struct Curl_easy *data, bool *done)
-{
-  CURLcode result;
-  bool connected = 0;
-  struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-
-  *done = FALSE; /* default to false */
-
-  data->req.size = -1; /* make sure this is unknown at this point */
-
-  sshc->actualcode = CURLE_OK; /* reset error code */
-  sshc->secondCreateDirs = 0;   /* reset the create dir attempt state
-                                   variable */
-
-  Curl_pgrsSetUploadCounter(data, 0);
-  Curl_pgrsSetDownloadCounter(data, 0);
-  Curl_pgrsSetUploadSize(data, -1);
-  Curl_pgrsSetDownloadSize(data, -1);
-
-  if(conn->handler->protocol & CURLPROTO_SCP)
-    result = scp_perform(data, &connected,  done);
-  else
-    result = sftp_perform(data, &connected,  done);
-
-  return result;
-}
-
 /* BLOCKING, but the function is using the state machine so the only reason
    this is still blocking is that the multi interface code has no support for
    disconnecting operations that takes a while */
@@ -3471,15 +3671,18 @@ static CURLcode scp_disconnect(struct Curl_easy *data,
                                bool dead_connection)
 {
   CURLcode result = CURLE_OK;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-  (void) dead_connection;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+  struct SSHPROTO *sshp = Curl_meta_get(data, CURL_META_SSH_EASY);
+  (void)dead_connection;
 
-  if(sshc->ssh_session) {
-    /* only if there's a session still around to use! */
-    state(data, SSH_SESSION_DISCONNECT);
-    result = ssh_block_statemach(data, conn, TRUE);
+  if(sshc && sshc->ssh_session) {
+    /* only if there is a session still around to use! */
+    myssh_to(data, sshc, SSH_SESSION_DISCONNECT);
+    result = ssh_block_statemach(data, sshc, sshp, TRUE);
   }
 
+  if(sshc)
+    return sshc_cleanup(sshc, data, TRUE);
   return result;
 }
 
@@ -3487,84 +3690,96 @@ static CURLcode scp_disconnect(struct Curl_easy *data,
    done functions */
 static CURLcode ssh_done(struct Curl_easy *data, CURLcode status)
 {
+  struct ssh_conn *sshc = Curl_conn_meta_get(data->conn, CURL_META_SSH_CONN);
+  struct SSHPROTO *sshp = Curl_meta_get(data, CURL_META_SSH_EASY);
   CURLcode result = CURLE_OK;
-  struct SSHPROTO *sshp = data->req.p.ssh;
-  struct connectdata *conn = data->conn;
+
+  if(!sshc || !sshp)
+    return CURLE_FAILED_INIT;
 
   if(!status)
     /* run the state-machine */
-    result = ssh_block_statemach(data, conn, FALSE);
+    result = ssh_block_statemach(data, sshc, sshp, FALSE);
   else
     result = status;
 
-  Curl_safefree(sshp->path);
-  Curl_safefree(sshp->readdir_filename);
-  Curl_safefree(sshp->readdir_longentry);
-  Curl_dyn_free(&sshp->readdir);
-
   if(Curl_pgrsDone(data))
     return CURLE_ABORTED_BY_CALLBACK;
 
-  data->req.keepon = 0; /* clear all bits */
+  CURL_REQ_CLEAR_IO(data);
   return result;
 }
 
-
 static CURLcode scp_done(struct Curl_easy *data, CURLcode status,
                          bool premature)
 {
-  (void)premature; /* not used */
+  struct ssh_conn *sshc = Curl_conn_meta_get(data->conn, CURL_META_SSH_CONN);
+  (void)premature;
 
-  if(!status)
-    state(data, SSH_SCP_DONE);
+  if(sshc && !status)
+    myssh_to(data, sshc, SSH_SCP_DONE);
 
   return ssh_done(data, status);
-
 }
 
-static ssize_t scp_send(struct Curl_easy *data, int sockindex,
-                        const void *mem, size_t len, CURLcode *err)
+static CURLcode scp_send(struct Curl_easy *data, int sockindex,
+                         const uint8_t *mem, size_t len, bool eos,
+                         size_t *pnwritten)
 {
-  ssize_t nwrite;
   struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+  CURLcode result = CURLE_OK;
+  ssize_t nwritten;
+
   (void)sockindex; /* we only support SCP on the fixed known primary socket */
+  (void)eos;
+  *pnwritten = 0;
+
+  if(!sshc)
+    return CURLE_FAILED_INIT;
 
   /* libssh2_channel_write() returns int! */
-  nwrite = (ssize_t) libssh2_channel_write(sshc->ssh_channel, mem, len);
+  nwritten = (ssize_t)libssh2_channel_write(sshc->ssh_channel,
+                                            (const char *)mem, len);
 
-  ssh_block2waitfor(data, (nwrite == LIBSSH2_ERROR_EAGAIN)?TRUE:FALSE);
+  ssh_block2waitfor(data, sshc, (nwritten == LIBSSH2_ERROR_EAGAIN));
 
-  if(nwrite == LIBSSH2_ERROR_EAGAIN) {
-    *err = CURLE_AGAIN;
-    nwrite = 0;
-  }
-  else if(nwrite < LIBSSH2_ERROR_NONE) {
-    *err = libssh2_session_error_to_CURLE((int)nwrite);
-    nwrite = -1;
-  }
+  if(nwritten == LIBSSH2_ERROR_EAGAIN)
+    result = CURLE_AGAIN;
+  else if(nwritten < LIBSSH2_ERROR_NONE)
+    result = libssh2_session_error_to_CURLE((int)nwritten);
+  else
+    *pnwritten = (size_t)nwritten;
 
-  return nwrite;
+  return result;
 }
 
-static ssize_t scp_recv(struct Curl_easy *data, int sockindex,
-                        char *mem, size_t len, CURLcode *err)
+static CURLcode scp_recv(struct Curl_easy *data, int sockindex,
+                         char *mem, size_t len, size_t *pnread)
 {
-  ssize_t nread;
   struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+  CURLcode result = CURLE_OK;
+  ssize_t nread;
+
   (void)sockindex; /* we only support SCP on the fixed known primary socket */
+  *pnread = 0;
+
+  if(!sshc)
+    return CURLE_FAILED_INIT;
 
   /* libssh2_channel_read() returns int */
-  nread = (ssize_t) libssh2_channel_read(sshc->ssh_channel, mem, len);
+  nread = (ssize_t)libssh2_channel_read(sshc->ssh_channel, mem, len);
 
-  ssh_block2waitfor(data, (nread == LIBSSH2_ERROR_EAGAIN)?TRUE:FALSE);
-  if(nread == LIBSSH2_ERROR_EAGAIN) {
-    *err = CURLE_AGAIN;
-    nread = -1;
-  }
+  ssh_block2waitfor(data, sshc, (nread == LIBSSH2_ERROR_EAGAIN));
+  if(nread == LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+  else if(nread < LIBSSH2_ERROR_NONE)
+    result = libssh2_session_error_to_CURLE((int)nread);
+  else
+    *pnread = (size_t)nread;
 
-  return nread;
+  return result;
 }
 
 /*
@@ -3580,19 +3795,21 @@ static ssize_t scp_recv(struct Curl_easy *data, int sockindex,
  * the options previously setup.
  */
 
-static
-CURLcode sftp_perform(struct Curl_easy *data,
-                      bool *connected,
-                      bool *dophase_done)
+static CURLcode sftp_perform(struct Curl_easy *data,
+                             bool *connected,
+                             bool *dophase_done)
 {
+  struct ssh_conn *sshc = Curl_conn_meta_get(data->conn, CURL_META_SSH_CONN);
   CURLcode result = CURLE_OK;
 
-  DEBUGF(infof(data, "DO phase starts"));
+  CURL_TRC_SSH(data, "DO phase starts");
 
   *dophase_done = FALSE; /* not done yet */
+  if(!sshc)
+    return CURLE_FAILED_INIT;
 
   /* start the first command in the DO phase */
-  state(data, SSH_SFTP_QUOTE_INIT);
+  myssh_to(data, sshc, SSH_SFTP_QUOTE_INIT);
 
   /* run the state-machine */
   result = ssh_multi_statemach(data, dophase_done);
@@ -3600,7 +3817,7 @@ CURLcode sftp_perform(struct Curl_easy *data,
   *connected = Curl_conn_is_connected(data->conn, FIRSTSOCKET);
 
   if(*dophase_done) {
-    DEBUGF(infof(data, "DO phase is complete"));
+    CURL_TRC_SSH(data, "DO phase is complete");
   }
 
   return result;
@@ -3613,7 +3830,7 @@ static CURLcode sftp_doing(struct Curl_easy *data,
   CURLcode result = ssh_multi_statemach(data, dophase_done);
 
   if(*dophase_done) {
-    DEBUGF(infof(data, "DO phase is complete"));
+    CURL_TRC_SSH(data, "DO phase is complete");
   }
   return result;
 }
@@ -3625,28 +3842,31 @@ static CURLcode sftp_disconnect(struct Curl_easy *data,
                                 struct connectdata *conn, bool dead_connection)
 {
   CURLcode result = CURLE_OK;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-  (void) dead_connection;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+  struct SSHPROTO *sshp = Curl_meta_get(data, CURL_META_SSH_EASY);
+  (void)dead_connection;
 
-  DEBUGF(infof(data, "SSH DISCONNECT starts now"));
-
-  if(sshc->ssh_session) {
-    /* only if there's a session still around to use! */
-    state(data, SSH_SFTP_SHUTDOWN);
-    result = ssh_block_statemach(data, conn, TRUE);
+  if(sshc) {
+    if(sshc->ssh_session) {
+      /* only if there is a session still around to use! */
+      CURL_TRC_SSH(data, "DISCONNECT starts now");
+      myssh_to(data, sshc, SSH_SFTP_SHUTDOWN);
+      result = ssh_block_statemach(data, sshc, sshp, TRUE);
+      CURL_TRC_SSH(data, "DISCONNECT is done -> %d", (int)result);
+    }
+    sshc_cleanup(sshc, data, TRUE);
   }
-
-  DEBUGF(infof(data, "SSH DISCONNECT is done"));
-
   return result;
-
 }
 
 static CURLcode sftp_done(struct Curl_easy *data, CURLcode status,
-                               bool premature)
+                          bool premature)
 {
   struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+
+  if(!sshc)
+    return CURLE_FAILED_INIT;
 
   if(!status) {
     /* Post quote commands are executed after the SFTP_CLOSE state to avoid
@@ -3654,150 +3874,115 @@ static CURLcode sftp_done(struct Curl_easy *data, CURLcode status,
        operation */
     if(!premature && data->set.postquote && !conn->bits.retry)
       sshc->nextstate = SSH_SFTP_POSTQUOTE_INIT;
-    state(data, SSH_SFTP_CLOSE);
+    myssh_to(data, sshc, SSH_SFTP_CLOSE);
   }
   return ssh_done(data, status);
 }
 
 /* return number of sent bytes */
-static ssize_t sftp_send(struct Curl_easy *data, int sockindex,
-                         const void *mem, size_t len, CURLcode *err)
+static CURLcode sftp_send(struct Curl_easy *data, int sockindex,
+                          const uint8_t *mem, size_t len, bool eos,
+                          size_t *pnwritten)
 {
-  ssize_t nwrite;
   struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+  ssize_t nwrite;
+
   (void)sockindex;
+  (void)eos;
+  *pnwritten = 0;
 
-  nwrite = libssh2_sftp_write(sshc->sftp_handle, mem, len);
+  if(!sshc)
+    return CURLE_FAILED_INIT;
 
-  ssh_block2waitfor(data, (nwrite == LIBSSH2_ERROR_EAGAIN)?TRUE:FALSE);
+  nwrite = libssh2_sftp_write(sshc->sftp_handle, (const char *)mem, len);
 
-  if(nwrite == LIBSSH2_ERROR_EAGAIN) {
-    *err = CURLE_AGAIN;
-    nwrite = 0;
-  }
-  else if(nwrite < LIBSSH2_ERROR_NONE) {
-    *err = libssh2_session_error_to_CURLE((int)nwrite);
-    nwrite = -1;
-  }
+  ssh_block2waitfor(data, sshc, (nwrite == LIBSSH2_ERROR_EAGAIN));
 
-  return nwrite;
+  if(nwrite == LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+  else if(nwrite < LIBSSH2_ERROR_NONE)
+    return libssh2_session_error_to_CURLE((int)nwrite);
+  *pnwritten = (size_t)nwrite;
+  return CURLE_OK;
 }
 
 /*
  * Return number of received (decrypted) bytes
  * or <0 on error
  */
-static ssize_t sftp_recv(struct Curl_easy *data, int sockindex,
-                         char *mem, size_t len, CURLcode *err)
+static CURLcode sftp_recv(struct Curl_easy *data, int sockindex,
+                          char *mem, size_t len, size_t *pnread)
 {
-  ssize_t nread;
   struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+  ssize_t nread;
+
   (void)sockindex;
+  *pnread = 0;
+
+  if(!sshc)
+    return CURLE_FAILED_INIT;
 
   nread = libssh2_sftp_read(sshc->sftp_handle, mem, len);
 
-  ssh_block2waitfor(data, (nread == LIBSSH2_ERROR_EAGAIN)?TRUE:FALSE);
+  ssh_block2waitfor(data, sshc, (nread == LIBSSH2_ERROR_EAGAIN));
 
-  if(nread == LIBSSH2_ERROR_EAGAIN) {
-    *err = CURLE_AGAIN;
-    nread = -1;
+  if(nread == LIBSSH2_ERROR_EAGAIN)
+    return CURLE_AGAIN;
+  else if(nread < 0)
+    return libssh2_session_error_to_CURLE((int)nread);
 
-  }
-  else if(nread < 0) {
-    *err = libssh2_session_error_to_CURLE((int)nread);
-  }
-  return nread;
+  *pnread = (size_t)nread;
+  return CURLE_OK;
 }
 
-static const char *sftp_libssh2_strerror(unsigned long err)
+/*
+ * The DO function is generic for both protocols. There was previously two
+ * separate ones but this way means less duplicated code.
+ */
+static CURLcode ssh_do(struct Curl_easy *data, bool *done)
 {
-  switch(err) {
-    case LIBSSH2_FX_NO_SUCH_FILE:
-      return "No such file or directory";
+  CURLcode result;
+  bool connected = FALSE;
+  struct connectdata *conn = data->conn;
+  struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
 
-    case LIBSSH2_FX_PERMISSION_DENIED:
-      return "Permission denied";
+  *done = FALSE; /* default to false */
+  if(!sshc)
+    return CURLE_FAILED_INIT;
 
-    case LIBSSH2_FX_FAILURE:
-      return "Operation failed";
+  data->req.size = -1; /* make sure this is unknown at this point */
+  sshc->secondCreateDirs = 0;   /* reset the create directory attempt state
+                                   variable */
 
-    case LIBSSH2_FX_BAD_MESSAGE:
-      return "Bad message from SFTP server";
+  Curl_pgrsReset(data);
 
-    case LIBSSH2_FX_NO_CONNECTION:
-      return "Not connected to SFTP server";
+  if(conn->scheme->protocol & CURLPROTO_SCP)
+    result = scp_perform(data, &connected, done);
+  else
+    result = sftp_perform(data, &connected, done);
 
-    case LIBSSH2_FX_CONNECTION_LOST:
-      return "Connection to SFTP server lost";
-
-    case LIBSSH2_FX_OP_UNSUPPORTED:
-      return "Operation not supported by SFTP server";
-
-    case LIBSSH2_FX_INVALID_HANDLE:
-      return "Invalid handle";
-
-    case LIBSSH2_FX_NO_SUCH_PATH:
-      return "No such file or directory";
-
-    case LIBSSH2_FX_FILE_ALREADY_EXISTS:
-      return "File already exists";
-
-    case LIBSSH2_FX_WRITE_PROTECT:
-      return "File is write protected";
-
-    case LIBSSH2_FX_NO_MEDIA:
-      return "No media";
-
-    case LIBSSH2_FX_NO_SPACE_ON_FILESYSTEM:
-      return "Disk full";
-
-    case LIBSSH2_FX_QUOTA_EXCEEDED:
-      return "User quota exceeded";
-
-    case LIBSSH2_FX_UNKNOWN_PRINCIPLE:
-      return "Unknown principle";
-
-    case LIBSSH2_FX_LOCK_CONFlICT:
-      return "File lock conflict";
-
-    case LIBSSH2_FX_DIR_NOT_EMPTY:
-      return "Directory not empty";
-
-    case LIBSSH2_FX_NOT_A_DIRECTORY:
-      return "Not a directory";
-
-    case LIBSSH2_FX_INVALID_FILENAME:
-      return "Invalid filename";
-
-    case LIBSSH2_FX_LINK_LOOP:
-      return "Link points to itself";
-  }
-  return "Unknown error in libssh2";
+  return result;
 }
 
 CURLcode Curl_ssh_init(void)
 {
-#ifdef HAVE_LIBSSH2_INIT
   if(libssh2_init(0)) {
-    DEBUGF(fprintf(stderr, "Error: libssh2_init failed\n"));
+    DEBUGF(curl_mfprintf(stderr, "Error: libssh2_init failed\n"));
     return CURLE_FAILED_INIT;
   }
-#endif
   return CURLE_OK;
 }
 
 void Curl_ssh_cleanup(void)
 {
-#ifdef HAVE_LIBSSH2_EXIT
-  (void)libssh2_exit();
-#endif
+  libssh2_exit();
 }
 
 void Curl_ssh_version(char *buffer, size_t buflen)
 {
-  (void)msnprintf(buffer, buflen, "libssh2/%s", CURL_LIBSSH2_VERSION);
+  (void)curl_msnprintf(buffer, buflen, "libssh2/%s", libssh2_version(0));
 }
 
 /* The SSH session is associated with the *CONNECTION* but the callback user
@@ -3808,13 +3993,60 @@ static void ssh_attach(struct Curl_easy *data, struct connectdata *conn)
 {
   DEBUGASSERT(data);
   DEBUGASSERT(conn);
-  if(conn->handler->protocol & PROTO_FAMILY_SSH) {
-    struct ssh_conn *sshc = &conn->proto.sshc;
-    if(sshc->ssh_session) {
+  if(conn->scheme->protocol & PROTO_FAMILY_SSH) {
+    struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
+    if(sshc && sshc->ssh_session) {
       /* only re-attach if the session already exists */
       void **abstract = libssh2_session_abstract(sshc->ssh_session);
       *abstract = data;
     }
   }
 }
+
+/*
+ * SCP protocol handler.
+ */
+const struct Curl_protocol Curl_protocol_scp = {
+  ssh_setup_connection,                 /* setup_connection */
+  ssh_do,                               /* do_it */
+  scp_done,                             /* done */
+  ZERO_NULL,                            /* do_more */
+  ssh_connect,                          /* connect_it */
+  ssh_multi_statemach,                  /* connecting */
+  scp_doing,                            /* doing */
+  ssh_pollset,                          /* proto_pollset */
+  ssh_pollset,                          /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ssh_pollset,                          /* perform_pollset */
+  scp_disconnect,                       /* disconnect */
+  ZERO_NULL,                            /* write_resp */
+  ZERO_NULL,                            /* write_resp_hd */
+  ZERO_NULL,                            /* connection_is_dead */
+  ssh_attach,                           /* attach */
+  ZERO_NULL,                            /* follow */
+};
+
+/*
+ * SFTP protocol handler.
+ */
+const struct Curl_protocol Curl_protocol_sftp = {
+  ssh_setup_connection,                 /* setup_connection */
+  ssh_do,                               /* do_it */
+  sftp_done,                            /* done */
+  ZERO_NULL,                            /* do_more */
+  ssh_connect,                          /* connect_it */
+  ssh_multi_statemach,                  /* connecting */
+  sftp_doing,                           /* doing */
+  ssh_pollset,                          /* proto_pollset */
+  ssh_pollset,                          /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ssh_pollset,                          /* perform_pollset */
+  sftp_disconnect,                      /* disconnect */
+  ZERO_NULL,                            /* write_resp */
+  ZERO_NULL,                            /* write_resp_hd */
+  ZERO_NULL,                            /* connection_is_dead */
+  ssh_attach,                           /* attach */
+  ZERO_NULL,                            /* follow */
+};
+
 #endif /* USE_LIBSSH2 */
diff --git a/third-party/curl/lib/vssh/ssh.h b/third-party/curl/lib/vssh/ssh.h
index 1e1b1379c2..de76c8a253 100644
--- a/third-party/curl/lib/vssh/ssh.h
+++ b/third-party/curl/lib/vssh/ssh.h
@@ -1,5 +1,5 @@
-#ifndef HEADER_CURL_SSH_H
-#define HEADER_CURL_SSH_H
+#ifndef HEADER_CURL_VSSH_SSH_H
+#define HEADER_CURL_VSSH_SSH_H
 /***************************************************************************
  *                                  _   _ ____  _
  *  Project                     ___| | | |  _ \| |
@@ -23,20 +23,29 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
+#include "urldata.h"
 
-#if defined(USE_LIBSSH2)
+extern const struct Curl_protocol Curl_protocol_sftp;
+extern const struct Curl_protocol Curl_protocol_scp;
+
+#ifdef USE_SSH
+
+#ifdef USE_LIBSSH2
 #include <libssh2.h>
 #include <libssh2_sftp.h>
 #elif defined(USE_LIBSSH)
+/* in 0.10.0 or later, ignore deprecated warnings */
+#define SSH_SUPPRESS_DEPRECATED
 #include <libssh/libssh.h>
 #include <libssh/sftp.h>
-#elif defined(USE_WOLFSSH)
-#include <wolfssh/ssh.h>
-#include <wolfssh/wolfsftp.h>
 #endif
 
+/* meta key for storing protocol meta at easy handle */
+#define CURL_META_SSH_EASY   "meta:proto:ssh:easy"
+/* meta key for storing protocol meta at connection */
+#define CURL_META_SSH_CONN   "meta:proto:ssh:conn"
+
 /****************************************************************************
  * SSH unique setup
  ***************************************************************************/
@@ -107,17 +116,19 @@ typedef enum {
   SSH_LAST  /* never used */
 } sshstate;
 
+#define CURL_PATH_MAX 1024
+
 /* this struct is used in the HandleData struct which is part of the
    Curl_easy, which means this is used on a per-easy handle basis.
    Everything that is strictly related to a connection is banned from this
    struct. */
 struct SSHPROTO {
-  char *path;                  /* the path we operate on */
+  char *path;        /* the path we operate on, at least one byte long */
 #ifdef USE_LIBSSH2
   struct dynbuf readdir_link;
   struct dynbuf readdir;
-  char *readdir_filename;
-  char *readdir_longentry;
+  char readdir_filename[CURL_PATH_MAX + 1];
+  char readdir_longentry[CURL_PATH_MAX + 1];
 
   LIBSSH2_SFTP_ATTRIBUTES quote_attrs; /* used by the SFTP_QUOTE state */
 
@@ -135,27 +146,25 @@ struct ssh_conn {
   const char *passphrase;     /* pass-phrase to use */
   char *rsa_pub;              /* strdup'ed public key file */
   char *rsa;                  /* strdup'ed private key file */
-  bool authed;                /* the connection has been authenticated fine */
-  bool acceptfail;            /* used by the SFTP_QUOTE (continue if
-                                 quote command fails) */
   sshstate state;             /* always use ssh.c:state() to change state! */
   sshstate nextstate;         /* the state to goto after stopping */
-  CURLcode actualcode;        /* the actual error code */
   struct curl_slist *quote_item; /* for the quote option */
   char *quote_path1;          /* two generic pointers for the QUOTE stuff */
   char *quote_path2;
 
-  char *homedir;              /* when doing SFTP we figure out home dir in the
-                                 connect phase */
+  char *homedir;              /* when doing SFTP we figure out home directory
+                                 in the connect phase */
   /* end of READDIR stuff */
 
   int secondCreateDirs;         /* counter use by the code to see if the
                                    second attempt has been made to change
                                    to/create a directory */
-  int orig_waitfor;             /* default READ/WRITE bits wait for */
+  int waitfor;                  /* REQ_IO_RECV/REQ_IO_SEND bits overriding
+                                   pollset given flags */
   char *slash_pos;              /* used by the SFTP_CREATE_DIRS state */
 
-#if defined(USE_LIBSSH)
+#ifdef USE_LIBSSH
+  CURLcode actualcode;        /* the actual error code */
   char *readdir_linkPath;
   size_t readdir_len;
   struct dynbuf readdir_buf;
@@ -163,7 +172,7 @@ struct ssh_conn {
   unsigned kbd_state; /* 0 or 1 */
   ssh_key privkey;
   ssh_key pubkey;
-  int auth_methods;
+  unsigned int auth_methods;
   ssh_session ssh_session;
   ssh_scp scp_session;
   sftp_session sftp_session;
@@ -171,7 +180,14 @@ struct ssh_conn {
   sftp_dir sftp_dir;
 
   unsigned sftp_recv_state; /* 0 or 1 */
+#if LIBSSH_VERSION_INT > SSH_VERSION_INT(0, 11, 0)
+  sftp_aio sftp_recv_aio;
+
+  sftp_aio sftp_send_aio;
+  unsigned sftp_send_state; /* 0 or 1 */
+#else
   int sftp_file_index; /* for async read */
+#endif
   sftp_attributes readdir_attrs; /* used by the SFTP readdir actions */
   sftp_attributes readdir_link_attrs; /* used by the SFTP readdir actions */
   sftp_attributes quote_attrs; /* used by the SFTP_QUOTE state */
@@ -179,6 +195,7 @@ struct ssh_conn {
   const char *readdir_filename; /* points within readdir_attrs */
   const char *readdir_longentry;
   char *readdir_tmp;
+  BIT(initialized);
 #elif defined(USE_LIBSSH2)
   LIBSSH2_SESSION *ssh_session; /* Secure Shell session */
   LIBSSH2_CHANNEL *ssh_channel; /* Secure Shell channel handle */
@@ -191,71 +208,44 @@ struct ssh_conn {
   Curl_send *tls_send;
 #endif
 
-#ifdef HAVE_LIBSSH2_AGENT_API
   LIBSSH2_AGENT *ssh_agent;     /* proxy to ssh-agent/pageant */
-  struct libssh2_agent_publickey *sshagent_identity,
-                                 *sshagent_prev_identity;
-#endif
-
-  /* note that HAVE_LIBSSH2_KNOWNHOST_API is a define set in the libssh2.h
-     header */
-#ifdef HAVE_LIBSSH2_KNOWNHOST_API
+  struct libssh2_agent_publickey *sshagent_identity;
+  struct libssh2_agent_publickey *sshagent_prev_identity;
   LIBSSH2_KNOWNHOSTS *kh;
-#endif
-#elif defined(USE_WOLFSSH)
-  WOLFSSH *ssh_session;
-  WOLFSSH_CTX *ctx;
-  word32 handleSz;
-  byte handle[WOLFSSH_MAX_HANDLE];
-  curl_off_t offset;
 #endif /* USE_LIBSSH */
+  BIT(authed);                /* the connection has been authenticated fine */
+  BIT(acceptfail);            /* used by the SFTP_QUOTE (continue if
+                                 quote command fails) */
 };
 
-#if defined(USE_LIBSSH2)
+#ifdef USE_LIBSSH
+#if LIBSSH_VERSION_INT < SSH_VERSION_INT(0, 9, 0)
+#error "SCP/SFTP protocols require libssh 0.9.0 or later"
+#endif
+#endif
+
+#ifdef USE_LIBSSH2
 
 /* Feature detection based on version numbers to better work with
    non-configure platforms */
 
-#if !defined(LIBSSH2_VERSION_NUM) || (LIBSSH2_VERSION_NUM < 0x001000)
-#  error "SCP/SFTP protocols require libssh2 0.16 or later"
-#endif
-
-#if LIBSSH2_VERSION_NUM >= 0x010000
-#define HAVE_LIBSSH2_SFTP_SEEK64 1
-#endif
-
-#if LIBSSH2_VERSION_NUM >= 0x010100
-#define HAVE_LIBSSH2_VERSION 1
-#endif
-
-#if LIBSSH2_VERSION_NUM >= 0x010205
-#define HAVE_LIBSSH2_INIT 1
-#define HAVE_LIBSSH2_EXIT 1
-#endif
-
-#if LIBSSH2_VERSION_NUM >= 0x010206
-#define HAVE_LIBSSH2_KNOWNHOST_CHECKP 1
-#define HAVE_LIBSSH2_SCP_SEND64 1
-#endif
-
-#if LIBSSH2_VERSION_NUM >= 0x010208
-#define HAVE_LIBSSH2_SESSION_HANDSHAKE 1
-#endif
-
-#ifdef HAVE_LIBSSH2_VERSION
-/* get it run-time if possible */
-#define CURL_LIBSSH2_VERSION libssh2_version(0)
-#else
-/* use build-time if run-time not possible */
-#define CURL_LIBSSH2_VERSION LIBSSH2_VERSION
+#if !defined(LIBSSH2_VERSION_NUM) || (LIBSSH2_VERSION_NUM < 0x010900)
+#error "SCP/SFTP protocols require libssh2 1.9.0 or greater"
+/* 1.9.0 was released on June 20 2019 */
 #endif
 
 #endif /* USE_LIBSSH2 */
 
-#ifdef USE_SSH
+#ifdef CURLVERBOSE
+const char *Curl_ssh_statename(sshstate state);
+#else
+#define Curl_ssh_statename(x) ""
+#endif
+void Curl_ssh_set_state(struct Curl_easy *data,
+                        struct ssh_conn *sshc,
+                        sshstate nowstate);
 
-extern const struct Curl_handler Curl_handler_scp;
-extern const struct Curl_handler Curl_handler_sftp;
+#define myssh_to(x, y, z) Curl_ssh_set_state(x, y, z)
 
 /* generic SSH backend functions */
 CURLcode Curl_ssh_init(void);
@@ -263,10 +253,10 @@ void Curl_ssh_cleanup(void);
 void Curl_ssh_version(char *buffer, size_t buflen);
 void Curl_ssh_attach(struct Curl_easy *data,
                      struct connectdata *conn);
-#else
-/* for non-SSH builds */
+#else /* !USE_SSH */
 #define Curl_ssh_cleanup()
-#define Curl_ssh_attach(x,y)
-#endif
+#define Curl_ssh_attach(x, y)
+#define Curl_ssh_init() 0
+#endif /* USE_SSH */
 
 #endif /* HEADER_CURL_SSH_H */
diff --git a/third-party/curl/lib/vssh/vssh.c b/third-party/curl/lib/vssh/vssh.c
new file mode 100644
index 0000000000..0ba4a9e690
--- /dev/null
+++ b/third-party/curl/lib/vssh/vssh.c
@@ -0,0 +1,333 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl AND ISC
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+#include "vssh/ssh.h"
+
+#ifdef USE_SSH
+
+#include "vssh/vssh.h"
+#include "curlx/strparse.h"
+#include "curl_trc.h"
+#include "escape.h"
+
+#ifdef CURLVERBOSE
+const char *Curl_ssh_statename(sshstate state)
+{
+  static const char * const names[] = {
+    "SSH_STOP",
+    "SSH_INIT",
+    "SSH_S_STARTUP",
+    "SSH_HOSTKEY",
+    "SSH_AUTHLIST",
+    "SSH_AUTH_PKEY_INIT",
+    "SSH_AUTH_PKEY",
+    "SSH_AUTH_PASS_INIT",
+    "SSH_AUTH_PASS",
+    "SSH_AUTH_AGENT_INIT",
+    "SSH_AUTH_AGENT_LIST",
+    "SSH_AUTH_AGENT",
+    "SSH_AUTH_HOST_INIT",
+    "SSH_AUTH_HOST",
+    "SSH_AUTH_KEY_INIT",
+    "SSH_AUTH_KEY",
+    "SSH_AUTH_GSSAPI",
+    "SSH_AUTH_DONE",
+    "SSH_SFTP_INIT",
+    "SSH_SFTP_REALPATH",
+    "SSH_SFTP_QUOTE_INIT",
+    "SSH_SFTP_POSTQUOTE_INIT",
+    "SSH_SFTP_QUOTE",
+    "SSH_SFTP_NEXT_QUOTE",
+    "SSH_SFTP_QUOTE_STAT",
+    "SSH_SFTP_QUOTE_SETSTAT",
+    "SSH_SFTP_QUOTE_SYMLINK",
+    "SSH_SFTP_QUOTE_MKDIR",
+    "SSH_SFTP_QUOTE_RENAME",
+    "SSH_SFTP_QUOTE_RMDIR",
+    "SSH_SFTP_QUOTE_UNLINK",
+    "SSH_SFTP_QUOTE_STATVFS",
+    "SSH_SFTP_GETINFO",
+    "SSH_SFTP_FILETIME",
+    "SSH_SFTP_TRANS_INIT",
+    "SSH_SFTP_UPLOAD_INIT",
+    "SSH_SFTP_CREATE_DIRS_INIT",
+    "SSH_SFTP_CREATE_DIRS",
+    "SSH_SFTP_CREATE_DIRS_MKDIR",
+    "SSH_SFTP_READDIR_INIT",
+    "SSH_SFTP_READDIR",
+    "SSH_SFTP_READDIR_LINK",
+    "SSH_SFTP_READDIR_BOTTOM",
+    "SSH_SFTP_READDIR_DONE",
+    "SSH_SFTP_DOWNLOAD_INIT",
+    "SSH_SFTP_DOWNLOAD_STAT",
+    "SSH_SFTP_CLOSE",
+    "SSH_SFTP_SHUTDOWN",
+    "SSH_SCP_TRANS_INIT",
+    "SSH_SCP_UPLOAD_INIT",
+    "SSH_SCP_DOWNLOAD_INIT",
+    "SSH_SCP_DOWNLOAD",
+    "SSH_SCP_DONE",
+    "SSH_SCP_SEND_EOF",
+    "SSH_SCP_WAIT_EOF",
+    "SSH_SCP_WAIT_CLOSE",
+    "SSH_SCP_CHANNEL_FREE",
+    "SSH_SESSION_DISCONNECT",
+    "SSH_SESSION_FREE",
+    "QUIT"
+  };
+  /* a precaution to make sure the lists are in sync */
+  DEBUGASSERT(CURL_ARRAYSIZE(names) == SSH_LAST);
+  return ((size_t)state < CURL_ARRAYSIZE(names)) ? names[state] : "";
+}
+#endif /* CURLVERBOSE */
+
+/*
+ * SSH State machine related code
+ */
+/* This is the ONLY way to change SSH state! */
+void Curl_ssh_set_state(struct Curl_easy *data,
+                        struct ssh_conn *sshc,
+                        sshstate nowstate)
+{
+#ifdef CURLVERBOSE
+  if(sshc->state != nowstate) {
+    CURL_TRC_SSH(data, "[%s] -> [%s]",
+                 Curl_ssh_statename(sshc->state),
+                 Curl_ssh_statename(nowstate));
+  }
+#else
+  (void)data;
+#endif
+  sshc->state = nowstate;
+}
+
+#define MAX_SSHPATH_LEN 100000 /* arbitrary */
+
+/* figure out the path to work with in this particular request */
+CURLcode Curl_getworkingpath(struct Curl_easy *data,
+                             const char *homedir, /* when SFTP is used */
+                             char **path) /* returns the  allocated
+                                             real path to work with */
+{
+  char *working_path;
+  size_t working_path_len;
+  struct dynbuf npath;
+  CURLcode result =
+    Curl_urldecode(data->state.up.path, 0, &working_path,
+                   &working_path_len, REJECT_ZERO);
+  if(result)
+    return result;
+
+  /* new path to switch to in case we need to */
+  curlx_dyn_init(&npath, MAX_SSHPATH_LEN);
+
+  /* Check for /~/, indicating relative to the user's home directory */
+  if((data->conn->scheme->protocol & CURLPROTO_SCP) &&
+     (working_path_len > 3) && (!memcmp(working_path, "/~/", 3))) {
+    /* It is referenced to the home directory, so strip the leading '/~/' */
+    if(curlx_dyn_addn(&npath, &working_path[3], working_path_len - 3)) {
+      curlx_free(working_path);
+      return CURLE_OUT_OF_MEMORY;
+    }
+  }
+  else if((data->conn->scheme->protocol & CURLPROTO_SFTP) &&
+          (!strcmp("/~", working_path) ||
+           ((working_path_len > 2) && !memcmp(working_path, "/~/", 3)))) {
+    if(curlx_dyn_add(&npath, homedir)) {
+      curlx_free(working_path);
+      return CURLE_OUT_OF_MEMORY;
+    }
+    if(working_path_len > 2) {
+      size_t len;
+      const char *p;
+      int copyfrom = 3;
+      /* Copy a separating '/' if homedir does not end with one */
+      len = curlx_dyn_len(&npath);
+      p = curlx_dyn_ptr(&npath);
+      if(len && (p[len - 1] != '/'))
+        copyfrom = 2;
+
+      if(curlx_dyn_addn(&npath, &working_path[copyfrom],
+                        working_path_len - copyfrom)) {
+        curlx_free(working_path);
+        return CURLE_OUT_OF_MEMORY;
+      }
+    }
+    else {
+      if(curlx_dyn_add(&npath, "/")) {
+        curlx_free(working_path);
+        return CURLE_OUT_OF_MEMORY;
+      }
+    }
+  }
+
+  if(curlx_dyn_len(&npath)) {
+    curlx_free(working_path);
+
+    /* store the pointer for the caller to receive */
+    *path = curlx_dyn_ptr(&npath);
+  }
+  else
+    *path = working_path;
+  DEBUGASSERT(*path && (*path)[0]);
+
+  return CURLE_OK;
+}
+
+#define MAX_PATHLENGTH 65535 /* arbitrary long */
+
+CURLcode Curl_get_pathname(const char **cpp, char **path, const char *homedir)
+{
+  const char *cp = *cpp;
+  struct dynbuf out;
+  CURLcode result;
+
+  DEBUGASSERT(homedir);
+  *path = NULL;
+  *cpp = NULL;
+  if(!*cp || !homedir)
+    return CURLE_QUOTE_ERROR;
+
+  curlx_dyn_init(&out, MAX_PATHLENGTH);
+
+  /* Ignore leading whitespace */
+  curlx_str_passblanks(&cp);
+
+  /* Check for quoted filenames */
+  if(*cp == '\"' || *cp == '\'') {
+    char quot = *cp++;
+
+    /* Search for terminating quote, unescape some chars */
+    while(*cp != quot) {
+      if(!*cp) /* End of string */
+        goto fail;
+
+      if(*cp == '\\') { /* Escaped characters */
+        cp++;
+        if(*cp != '\'' && *cp != '\"' && *cp != '\\')
+          goto fail;
+      }
+      result = curlx_dyn_addn(&out, cp, 1);
+      if(result)
+        return result;
+      cp++;
+    }
+    cp++; /* pass the end quote */
+
+    if(!curlx_dyn_len(&out))
+      goto fail;
+  }
+  else {
+    struct Curl_str word;
+    bool content = FALSE;
+    int rc;
+    /* Handling for relative path - prepend home directory */
+    if(cp[0] == '/' && cp[1] == '~' && cp[2] == '/') {
+      result = curlx_dyn_add(&out, homedir);
+      if(!result)
+        result = curlx_dyn_addn(&out, "/", 1);
+      if(result)
+        return result;
+      cp += 3;
+      content = TRUE;
+    }
+    /* Read to end of filename - either to whitespace or terminator */
+    rc = curlx_str_word(&cp, &word, MAX_PATHLENGTH);
+    if(rc) {
+      if(rc == STRE_BIG) {
+        curlx_dyn_free(&out);
+        return CURLE_TOO_LARGE;
+      }
+      else if(!content)
+        /* no path, no word, this is incorrect */
+        goto fail;
+    }
+    else {
+      /* append the word */
+      result = curlx_dyn_addn(&out, curlx_str(&word), curlx_strlen(&word));
+      if(result)
+        return result;
+    }
+  }
+  /* skip whitespace */
+  curlx_str_passblanks(&cp);
+
+  /* return pointer to second parameter if it exists */
+  *cpp = cp;
+
+  *path = curlx_dyn_ptr(&out);
+  return CURLE_OK;
+
+fail:
+  curlx_dyn_free(&out);
+  return CURLE_QUOTE_ERROR;
+}
+
+CURLcode Curl_ssh_range(struct Curl_easy *data,
+                        const char *range, curl_off_t filesize,
+                        curl_off_t *startp, curl_off_t *sizep)
+{
+  curl_off_t from, to;
+  int to_t;
+  int from_t = curlx_str_number(&range, &from, CURL_OFF_T_MAX);
+  if(from_t == STRE_OVERFLOW)
+    return CURLE_RANGE_ERROR;
+  curlx_str_passblanks(&range);
+  (void)curlx_str_single(&range, '-');
+
+  to_t = curlx_str_numblanks(&range, &to);
+  if((to_t == STRE_OVERFLOW) || (to_t && from_t) || *range)
+    return CURLE_RANGE_ERROR;
+
+  if(from_t) {
+    /* no start point given, set from relative to end of file */
+    if(!to)
+      /* "-0" is not a fine range */
+      return CURLE_RANGE_ERROR;
+    else if(to > filesize)
+      to = filesize;
+    from = filesize - to;
+    to = filesize - 1;
+  }
+  else if(from > filesize) {
+    failf(data, "Offset (%" FMT_OFF_T ") was beyond file size (%"
+          FMT_OFF_T ")", from, filesize);
+    return CURLE_RANGE_ERROR;
+  }
+  else if((to_t == STRE_NO_NUM) || (to >= filesize))
+    to = filesize - 1;
+
+  if(from > to) {
+    failf(data, "Bad range: start offset larger than end offset");
+    return CURLE_RANGE_ERROR;
+  }
+  if((to - from) == CURL_OFF_T_MAX)
+    return CURLE_RANGE_ERROR;
+
+  *startp = from;
+  *sizep = to - from + 1;
+  return CURLE_OK;
+}
+
+#endif /* USE_SSH */
diff --git a/third-party/curl/lib/vssh/vssh.h b/third-party/curl/lib/vssh/vssh.h
new file mode 100644
index 0000000000..492108fbd7
--- /dev/null
+++ b/third-party/curl/lib/vssh/vssh.h
@@ -0,0 +1,42 @@
+#ifndef HEADER_CURL_VSSH_VSSH_H
+#define HEADER_CURL_VSSH_VSSH_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef USE_SSH
+
+#include "urldata.h"
+
+CURLcode Curl_getworkingpath(struct Curl_easy *data,
+                             const char *homedir,
+                             char **path);
+
+CURLcode Curl_get_pathname(const char **cpp, char **path, const char *homedir);
+
+CURLcode Curl_ssh_range(struct Curl_easy *data,
+                        const char *range, curl_off_t filesize,
+                        curl_off_t *startp, curl_off_t *sizep);
+#endif /* USE_SSH */
+#endif /* HEADER_CURL_VSSH_VSSH_H */
diff --git a/third-party/curl/lib/vssh/wolfssh.c b/third-party/curl/lib/vssh/wolfssh.c
deleted file mode 100644
index 306d299bcf..0000000000
--- a/third-party/curl/lib/vssh/wolfssh.c
+++ /dev/null
@@ -1,1173 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#ifdef USE_WOLFSSH
-
-#include <limits.h>
-
-#include <wolfssh/ssh.h>
-#include <wolfssh/wolfsftp.h>
-#include "urldata.h"
-#include "cfilters.h"
-#include "connect.h"
-#include "sendf.h"
-#include "progress.h"
-#include "curl_path.h"
-#include "strtoofft.h"
-#include "transfer.h"
-#include "speedcheck.h"
-#include "select.h"
-#include "multiif.h"
-#include "warnless.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
-
-static CURLcode wssh_connect(struct Curl_easy *data, bool *done);
-static CURLcode wssh_multi_statemach(struct Curl_easy *data, bool *done);
-static CURLcode wssh_do(struct Curl_easy *data, bool *done);
-#if 0
-static CURLcode wscp_done(struct Curl_easy *data,
-                          CURLcode, bool premature);
-static CURLcode wscp_doing(struct Curl_easy *data,
-                           bool *dophase_done);
-static CURLcode wscp_disconnect(struct Curl_easy *data,
-                                struct connectdata *conn,
-                                bool dead_connection);
-#endif
-static CURLcode wsftp_done(struct Curl_easy *data,
-                           CURLcode, bool premature);
-static CURLcode wsftp_doing(struct Curl_easy *data,
-                            bool *dophase_done);
-static CURLcode wsftp_disconnect(struct Curl_easy *data,
-                                 struct connectdata *conn,
-                                 bool dead);
-static int wssh_getsock(struct Curl_easy *data,
-                        struct connectdata *conn,
-                        curl_socket_t *sock);
-static CURLcode wssh_setup_connection(struct Curl_easy *data,
-                                      struct connectdata *conn);
-
-#if 0
-/*
- * SCP protocol handler.
- */
-
-const struct Curl_handler Curl_handler_scp = {
-  "SCP",                                /* scheme */
-  wssh_setup_connection,                /* setup_connection */
-  wssh_do,                              /* do_it */
-  wscp_done,                            /* done */
-  ZERO_NULL,                            /* do_more */
-  wssh_connect,                         /* connect_it */
-  wssh_multi_statemach,                 /* connecting */
-  wscp_doing,                           /* doing */
-  wssh_getsock,                         /* proto_getsock */
-  wssh_getsock,                         /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  wssh_getsock,                         /* perform_getsock */
-  wscp_disconnect,                      /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_SSH,                             /* defport */
-  CURLPROTO_SCP,                        /* protocol */
-  PROTOPT_DIRLOCK | PROTOPT_CLOSEACTION
-  | PROTOPT_NOURLQUERY                  /* flags */
-};
-
-#endif
-
-/*
- * SFTP protocol handler.
- */
-
-const struct Curl_handler Curl_handler_sftp = {
-  "SFTP",                               /* scheme */
-  wssh_setup_connection,                /* setup_connection */
-  wssh_do,                              /* do_it */
-  wsftp_done,                           /* done */
-  ZERO_NULL,                            /* do_more */
-  wssh_connect,                         /* connect_it */
-  wssh_multi_statemach,                 /* connecting */
-  wsftp_doing,                          /* doing */
-  wssh_getsock,                         /* proto_getsock */
-  wssh_getsock,                         /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  wssh_getsock,                         /* perform_getsock */
-  wsftp_disconnect,                     /* disconnect */
-  ZERO_NULL,                            /* readwrite */
-  ZERO_NULL,                            /* connection_check */
-  ZERO_NULL,                            /* attach connection */
-  PORT_SSH,                             /* defport */
-  CURLPROTO_SFTP,                       /* protocol */
-  CURLPROTO_SFTP,                       /* family */
-  PROTOPT_DIRLOCK | PROTOPT_CLOSEACTION
-  | PROTOPT_NOURLQUERY                  /* flags */
-};
-
-/*
- * SSH State machine related code
- */
-/* This is the ONLY way to change SSH state! */
-static void state(struct Curl_easy *data, sshstate nowstate)
-{
-  struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
-  /* for debug purposes */
-  static const char * const names[] = {
-    "SSH_STOP",
-    "SSH_INIT",
-    "SSH_S_STARTUP",
-    "SSH_HOSTKEY",
-    "SSH_AUTHLIST",
-    "SSH_AUTH_PKEY_INIT",
-    "SSH_AUTH_PKEY",
-    "SSH_AUTH_PASS_INIT",
-    "SSH_AUTH_PASS",
-    "SSH_AUTH_AGENT_INIT",
-    "SSH_AUTH_AGENT_LIST",
-    "SSH_AUTH_AGENT",
-    "SSH_AUTH_HOST_INIT",
-    "SSH_AUTH_HOST",
-    "SSH_AUTH_KEY_INIT",
-    "SSH_AUTH_KEY",
-    "SSH_AUTH_GSSAPI",
-    "SSH_AUTH_DONE",
-    "SSH_SFTP_INIT",
-    "SSH_SFTP_REALPATH",
-    "SSH_SFTP_QUOTE_INIT",
-    "SSH_SFTP_POSTQUOTE_INIT",
-    "SSH_SFTP_QUOTE",
-    "SSH_SFTP_NEXT_QUOTE",
-    "SSH_SFTP_QUOTE_STAT",
-    "SSH_SFTP_QUOTE_SETSTAT",
-    "SSH_SFTP_QUOTE_SYMLINK",
-    "SSH_SFTP_QUOTE_MKDIR",
-    "SSH_SFTP_QUOTE_RENAME",
-    "SSH_SFTP_QUOTE_RMDIR",
-    "SSH_SFTP_QUOTE_UNLINK",
-    "SSH_SFTP_QUOTE_STATVFS",
-    "SSH_SFTP_GETINFO",
-    "SSH_SFTP_FILETIME",
-    "SSH_SFTP_TRANS_INIT",
-    "SSH_SFTP_UPLOAD_INIT",
-    "SSH_SFTP_CREATE_DIRS_INIT",
-    "SSH_SFTP_CREATE_DIRS",
-    "SSH_SFTP_CREATE_DIRS_MKDIR",
-    "SSH_SFTP_READDIR_INIT",
-    "SSH_SFTP_READDIR",
-    "SSH_SFTP_READDIR_LINK",
-    "SSH_SFTP_READDIR_BOTTOM",
-    "SSH_SFTP_READDIR_DONE",
-    "SSH_SFTP_DOWNLOAD_INIT",
-    "SSH_SFTP_DOWNLOAD_STAT",
-    "SSH_SFTP_CLOSE",
-    "SSH_SFTP_SHUTDOWN",
-    "SSH_SCP_TRANS_INIT",
-    "SSH_SCP_UPLOAD_INIT",
-    "SSH_SCP_DOWNLOAD_INIT",
-    "SSH_SCP_DOWNLOAD",
-    "SSH_SCP_DONE",
-    "SSH_SCP_SEND_EOF",
-    "SSH_SCP_WAIT_EOF",
-    "SSH_SCP_WAIT_CLOSE",
-    "SSH_SCP_CHANNEL_FREE",
-    "SSH_SESSION_DISCONNECT",
-    "SSH_SESSION_FREE",
-    "QUIT"
-  };
-
-  /* a precaution to make sure the lists are in sync */
-  DEBUGASSERT(sizeof(names)/sizeof(names[0]) == SSH_LAST);
-
-  if(sshc->state != nowstate) {
-    infof(data, "wolfssh %p state change from %s to %s",
-          (void *)sshc, names[sshc->state], names[nowstate]);
-  }
-#endif
-
-  sshc->state = nowstate;
-}
-
-static ssize_t wscp_send(struct Curl_easy *data, int sockindex,
-                         const void *mem, size_t len, CURLcode *err)
-{
-  ssize_t nwrite = 0;
-  (void)data;
-  (void)sockindex; /* we only support SCP on the fixed known primary socket */
-  (void)mem;
-  (void)len;
-  (void)err;
-
-  return nwrite;
-}
-
-static ssize_t wscp_recv(struct Curl_easy *data, int sockindex,
-                         char *mem, size_t len, CURLcode *err)
-{
-  ssize_t nread = 0;
-  (void)data;
-  (void)sockindex; /* we only support SCP on the fixed known primary socket */
-  (void)mem;
-  (void)len;
-  (void)err;
-
-  return nread;
-}
-
-/* return number of sent bytes */
-static ssize_t wsftp_send(struct Curl_easy *data, int sockindex,
-                          const void *mem, size_t len, CURLcode *err)
-{
-  struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-  word32 offset[2];
-  int rc;
-  (void)sockindex;
-
-  offset[0] = (word32)sshc->offset&0xFFFFFFFF;
-  offset[1] = (word32)(sshc->offset>>32)&0xFFFFFFFF;
-
-  rc = wolfSSH_SFTP_SendWritePacket(sshc->ssh_session, sshc->handle,
-                                    sshc->handleSz,
-                                    &offset[0],
-                                    (byte *)mem, (word32)len);
-
-  if(rc == WS_FATAL_ERROR)
-    rc = wolfSSH_get_error(sshc->ssh_session);
-  if(rc == WS_WANT_READ) {
-    conn->waitfor = KEEP_RECV;
-    *err = CURLE_AGAIN;
-    return -1;
-  }
-  else if(rc == WS_WANT_WRITE) {
-    conn->waitfor = KEEP_SEND;
-    *err = CURLE_AGAIN;
-    return -1;
-  }
-  if(rc < 0) {
-    failf(data, "wolfSSH_SFTP_SendWritePacket returned %d", rc);
-    return -1;
-  }
-  DEBUGASSERT(rc == (int)len);
-  infof(data, "sent %zu bytes SFTP from offset %" CURL_FORMAT_CURL_OFF_T,
-        len, sshc->offset);
-  sshc->offset += len;
-  return (ssize_t)rc;
-}
-
-/*
- * Return number of received (decrypted) bytes
- * or <0 on error
- */
-static ssize_t wsftp_recv(struct Curl_easy *data, int sockindex,
-                          char *mem, size_t len, CURLcode *err)
-{
-  int rc;
-  struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-  word32 offset[2];
-  (void)sockindex;
-
-  offset[0] = (word32)sshc->offset&0xFFFFFFFF;
-  offset[1] = (word32)(sshc->offset>>32)&0xFFFFFFFF;
-
-  rc = wolfSSH_SFTP_SendReadPacket(sshc->ssh_session, sshc->handle,
-                                   sshc->handleSz,
-                                   &offset[0],
-                                   (byte *)mem, (word32)len);
-  if(rc == WS_FATAL_ERROR)
-    rc = wolfSSH_get_error(sshc->ssh_session);
-  if(rc == WS_WANT_READ) {
-    conn->waitfor = KEEP_RECV;
-    *err = CURLE_AGAIN;
-    return -1;
-  }
-  else if(rc == WS_WANT_WRITE) {
-    conn->waitfor = KEEP_SEND;
-    *err = CURLE_AGAIN;
-    return -1;
-  }
-
-  DEBUGASSERT(rc <= (int)len);
-
-  if(rc < 0) {
-    failf(data, "wolfSSH_SFTP_SendReadPacket returned %d", rc);
-    return -1;
-  }
-  sshc->offset += len;
-
-  return (ssize_t)rc;
-}
-
-/*
- * SSH setup and connection
- */
-static CURLcode wssh_setup_connection(struct Curl_easy *data,
-                                      struct connectdata *conn)
-{
-  struct SSHPROTO *ssh;
-  (void)conn;
-
-  data->req.p.ssh = ssh = calloc(1, sizeof(struct SSHPROTO));
-  if(!ssh)
-    return CURLE_OUT_OF_MEMORY;
-
-  return CURLE_OK;
-}
-
-static Curl_recv wscp_recv, wsftp_recv;
-static Curl_send wscp_send, wsftp_send;
-
-static int userauth(byte authtype,
-                    WS_UserAuthData* authdata,
-                    void *ctx)
-{
-  struct Curl_easy *data = ctx;
-  DEBUGF(infof(data, "wolfssh callback: type %s",
-               authtype == WOLFSSH_USERAUTH_PASSWORD ? "PASSWORD" :
-               "PUBLICCKEY"));
-  if(authtype == WOLFSSH_USERAUTH_PASSWORD) {
-    authdata->sf.password.password = (byte *)data->conn->passwd;
-    authdata->sf.password.passwordSz = (word32) strlen(data->conn->passwd);
-  }
-
-  return 0;
-}
-
-static CURLcode wssh_connect(struct Curl_easy *data, bool *done)
-{
-  struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc;
-  curl_socket_t sock = conn->sock[FIRSTSOCKET];
-  int rc;
-
-  /* initialize per-handle data if not already */
-  if(!data->req.p.ssh)
-    wssh_setup_connection(data, conn);
-
-  /* We default to persistent connections. We set this already in this connect
-     function to make the reuse checks properly be able to check this bit. */
-  connkeep(conn, "SSH default");
-
-  if(conn->handler->protocol & CURLPROTO_SCP) {
-    conn->recv[FIRSTSOCKET] = wscp_recv;
-    conn->send[FIRSTSOCKET] = wscp_send;
-  }
-  else {
-    conn->recv[FIRSTSOCKET] = wsftp_recv;
-    conn->send[FIRSTSOCKET] = wsftp_send;
-  }
-  sshc = &conn->proto.sshc;
-  sshc->ctx = wolfSSH_CTX_new(WOLFSSH_ENDPOINT_CLIENT, NULL);
-  if(!sshc->ctx) {
-    failf(data, "No wolfSSH context");
-    goto error;
-  }
-
-  sshc->ssh_session = wolfSSH_new(sshc->ctx);
-  if(!sshc->ssh_session) {
-    failf(data, "No wolfSSH session");
-    goto error;
-  }
-
-  rc = wolfSSH_SetUsername(sshc->ssh_session, conn->user);
-  if(rc != WS_SUCCESS) {
-    failf(data, "wolfSSH failed to set user name");
-    goto error;
-  }
-
-  /* set callback for authentication */
-  wolfSSH_SetUserAuth(sshc->ctx, userauth);
-  wolfSSH_SetUserAuthCtx(sshc->ssh_session, data);
-
-  rc = wolfSSH_set_fd(sshc->ssh_session, (int)sock);
-  if(rc) {
-    failf(data, "wolfSSH failed to set socket");
-    goto error;
-  }
-
-#if 0
-  wolfSSH_Debugging_ON();
-#endif
-
-  *done = TRUE;
-  if(conn->handler->protocol & CURLPROTO_SCP)
-    state(data, SSH_INIT);
-  else
-    state(data, SSH_SFTP_INIT);
-
-  return wssh_multi_statemach(data, done);
-error:
-  wolfSSH_free(sshc->ssh_session);
-  wolfSSH_CTX_free(sshc->ctx);
-  return CURLE_FAILED_INIT;
-}
-
-/*
- * wssh_statemach_act() runs the SSH state machine as far as it can without
- * blocking and without reaching the end.  The data the pointer 'block' points
- * to will be set to TRUE if the wolfssh function returns EAGAIN meaning it
- * wants to be called again when the socket is ready
- */
-
-static CURLcode wssh_statemach_act(struct Curl_easy *data, bool *block)
-{
-  CURLcode result = CURLE_OK;
-  struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-  struct SSHPROTO *sftp_scp = data->req.p.ssh;
-  WS_SFTPNAME *name;
-  int rc = 0;
-  *block = FALSE; /* we're not blocking by default */
-
-  do {
-    switch(sshc->state) {
-    case SSH_INIT:
-      state(data, SSH_S_STARTUP);
-      break;
-
-    case SSH_S_STARTUP:
-      rc = wolfSSH_connect(sshc->ssh_session);
-      if(rc != WS_SUCCESS)
-        rc = wolfSSH_get_error(sshc->ssh_session);
-      if(rc == WS_WANT_READ) {
-        *block = TRUE;
-        conn->waitfor = KEEP_RECV;
-        return CURLE_OK;
-      }
-      else if(rc == WS_WANT_WRITE) {
-        *block = TRUE;
-        conn->waitfor = KEEP_SEND;
-        return CURLE_OK;
-      }
-      else if(rc != WS_SUCCESS) {
-        state(data, SSH_STOP);
-        return CURLE_SSH;
-      }
-      infof(data, "wolfssh connected");
-      state(data, SSH_STOP);
-      break;
-    case SSH_STOP:
-      break;
-
-    case SSH_SFTP_INIT:
-      rc = wolfSSH_SFTP_connect(sshc->ssh_session);
-      if(rc != WS_SUCCESS)
-        rc = wolfSSH_get_error(sshc->ssh_session);
-      if(rc == WS_WANT_READ) {
-        *block = TRUE;
-        conn->waitfor = KEEP_RECV;
-        return CURLE_OK;
-      }
-      else if(rc == WS_WANT_WRITE) {
-        *block = TRUE;
-        conn->waitfor = KEEP_SEND;
-        return CURLE_OK;
-      }
-      else if(rc == WS_SUCCESS) {
-        infof(data, "wolfssh SFTP connected");
-        state(data, SSH_SFTP_REALPATH);
-      }
-      else {
-        failf(data, "wolfssh SFTP connect error %d", rc);
-        return CURLE_SSH;
-      }
-      break;
-    case SSH_SFTP_REALPATH:
-      name = wolfSSH_SFTP_RealPath(sshc->ssh_session, (char *)".");
-      rc = wolfSSH_get_error(sshc->ssh_session);
-      if(rc == WS_WANT_READ) {
-        *block = TRUE;
-        conn->waitfor = KEEP_RECV;
-        return CURLE_OK;
-      }
-      else if(rc == WS_WANT_WRITE) {
-        *block = TRUE;
-        conn->waitfor = KEEP_SEND;
-        return CURLE_OK;
-      }
-      else if(name && (rc == WS_SUCCESS)) {
-        sshc->homedir = malloc(name->fSz + 1);
-        if(!sshc->homedir) {
-          sshc->actualcode = CURLE_OUT_OF_MEMORY;
-        }
-        else {
-          memcpy(sshc->homedir, name->fName, name->fSz);
-          sshc->homedir[name->fSz] = 0;
-          infof(data, "wolfssh SFTP realpath succeeded");
-        }
-        wolfSSH_SFTPNAME_list_free(name);
-        state(data, SSH_STOP);
-        return CURLE_OK;
-      }
-      failf(data, "wolfssh SFTP realpath %d", rc);
-      return CURLE_SSH;
-
-    case SSH_SFTP_QUOTE_INIT:
-      result = Curl_getworkingpath(data, sshc->homedir, &sftp_scp->path);
-      if(result) {
-        sshc->actualcode = result;
-        state(data, SSH_STOP);
-        break;
-      }
-
-      if(data->set.quote) {
-        infof(data, "Sending quote commands");
-        sshc->quote_item = data->set.quote;
-        state(data, SSH_SFTP_QUOTE);
-      }
-      else {
-        state(data, SSH_SFTP_GETINFO);
-      }
-      break;
-    case SSH_SFTP_GETINFO:
-      if(data->set.get_filetime) {
-        state(data, SSH_SFTP_FILETIME);
-      }
-      else {
-        state(data, SSH_SFTP_TRANS_INIT);
-      }
-      break;
-    case SSH_SFTP_TRANS_INIT:
-      if(data->state.upload)
-        state(data, SSH_SFTP_UPLOAD_INIT);
-      else {
-        if(sftp_scp->path[strlen(sftp_scp->path)-1] == '/')
-          state(data, SSH_SFTP_READDIR_INIT);
-        else
-          state(data, SSH_SFTP_DOWNLOAD_INIT);
-      }
-      break;
-    case SSH_SFTP_UPLOAD_INIT: {
-      word32 flags;
-      WS_SFTP_FILEATRB createattrs;
-      if(data->state.resume_from) {
-        WS_SFTP_FILEATRB attrs;
-        if(data->state.resume_from < 0) {
-          rc = wolfSSH_SFTP_STAT(sshc->ssh_session, sftp_scp->path,
-                                 &attrs);
-          if(rc != WS_SUCCESS)
-            break;
-
-          if(rc) {
-            data->state.resume_from = 0;
-          }
-          else {
-            curl_off_t size = ((curl_off_t)attrs.sz[1] << 32) | attrs.sz[0];
-            if(size < 0) {
-              failf(data, "Bad file size (%" CURL_FORMAT_CURL_OFF_T ")", size);
-              return CURLE_BAD_DOWNLOAD_RESUME;
-            }
-            data->state.resume_from = size;
-          }
-        }
-      }
-
-      if(data->set.remote_append)
-        /* Try to open for append, but create if nonexisting */
-        flags = WOLFSSH_FXF_WRITE|WOLFSSH_FXF_CREAT|WOLFSSH_FXF_APPEND;
-      else if(data->state.resume_from > 0)
-        /* If we have restart position then open for append */
-        flags = WOLFSSH_FXF_WRITE|WOLFSSH_FXF_APPEND;
-      else
-        /* Clear file before writing (normal behavior) */
-        flags = WOLFSSH_FXF_WRITE|WOLFSSH_FXF_CREAT|WOLFSSH_FXF_TRUNC;
-
-      memset(&createattrs, 0, sizeof(createattrs));
-      createattrs.per = (word32)data->set.new_file_perms;
-      sshc->handleSz = sizeof(sshc->handle);
-      rc = wolfSSH_SFTP_Open(sshc->ssh_session, sftp_scp->path,
-                             flags, &createattrs,
-                             sshc->handle, &sshc->handleSz);
-      if(rc == WS_FATAL_ERROR)
-        rc = wolfSSH_get_error(sshc->ssh_session);
-      if(rc == WS_WANT_READ) {
-        *block = TRUE;
-        conn->waitfor = KEEP_RECV;
-        return CURLE_OK;
-      }
-      else if(rc == WS_WANT_WRITE) {
-        *block = TRUE;
-        conn->waitfor = KEEP_SEND;
-        return CURLE_OK;
-      }
-      else if(rc == WS_SUCCESS) {
-        infof(data, "wolfssh SFTP open succeeded");
-      }
-      else {
-        failf(data, "wolfssh SFTP upload open failed: %d", rc);
-        return CURLE_SSH;
-      }
-      state(data, SSH_SFTP_DOWNLOAD_STAT);
-
-      /* If we have a restart point then we need to seek to the correct
-         position. */
-      if(data->state.resume_from > 0) {
-        /* Let's read off the proper amount of bytes from the input. */
-        int seekerr = CURL_SEEKFUNC_OK;
-        if(conn->seek_func) {
-          Curl_set_in_callback(data, true);
-          seekerr = conn->seek_func(conn->seek_client, data->state.resume_from,
-                                    SEEK_SET);
-          Curl_set_in_callback(data, false);
-        }
-
-        if(seekerr != CURL_SEEKFUNC_OK) {
-          curl_off_t passed = 0;
-
-          if(seekerr != CURL_SEEKFUNC_CANTSEEK) {
-            failf(data, "Could not seek stream");
-            return CURLE_FTP_COULDNT_USE_REST;
-          }
-          /* seekerr == CURL_SEEKFUNC_CANTSEEK (can't seek to offset) */
-          do {
-            size_t readthisamountnow =
-              (data->state.resume_from - passed > data->set.buffer_size) ?
-              (size_t)data->set.buffer_size :
-              curlx_sotouz(data->state.resume_from - passed);
-
-            size_t actuallyread;
-            Curl_set_in_callback(data, true);
-            actuallyread = data->state.fread_func(data->state.buffer, 1,
-                                                  readthisamountnow,
-                                                  data->state.in);
-            Curl_set_in_callback(data, false);
-
-            passed += actuallyread;
-            if((actuallyread == 0) || (actuallyread > readthisamountnow)) {
-              /* this checks for greater-than only to make sure that the
-                 CURL_READFUNC_ABORT return code still aborts */
-              failf(data, "Failed to read data");
-              return CURLE_FTP_COULDNT_USE_REST;
-            }
-          } while(passed < data->state.resume_from);
-        }
-
-        /* now, decrease the size of the read */
-        if(data->state.infilesize > 0) {
-          data->state.infilesize -= data->state.resume_from;
-          data->req.size = data->state.infilesize;
-          Curl_pgrsSetUploadSize(data, data->state.infilesize);
-        }
-
-        sshc->offset += data->state.resume_from;
-      }
-      if(data->state.infilesize > 0) {
-        data->req.size = data->state.infilesize;
-        Curl_pgrsSetUploadSize(data, data->state.infilesize);
-      }
-      /* upload data */
-      Curl_setup_transfer(data, -1, -1, FALSE, FIRSTSOCKET);
-
-      /* not set by Curl_setup_transfer to preserve keepon bits */
-      conn->sockfd = conn->writesockfd;
-
-      if(result) {
-        state(data, SSH_SFTP_CLOSE);
-        sshc->actualcode = result;
-      }
-      else {
-        /* store this original bitmask setup to use later on if we can't
-           figure out a "real" bitmask */
-        sshc->orig_waitfor = data->req.keepon;
-
-        /* we want to use the _sending_ function even when the socket turns
-           out readable as the underlying libssh2 sftp send function will deal
-           with both accordingly */
-        conn->cselect_bits = CURL_CSELECT_OUT;
-
-        /* since we don't really wait for anything at this point, we want the
-           state machine to move on as soon as possible so we set a very short
-           timeout here */
-        Curl_expire(data, 0, EXPIRE_RUN_NOW);
-
-        state(data, SSH_STOP);
-      }
-      break;
-    }
-    case SSH_SFTP_DOWNLOAD_INIT:
-      sshc->handleSz = sizeof(sshc->handle);
-      rc = wolfSSH_SFTP_Open(sshc->ssh_session, sftp_scp->path,
-                             WOLFSSH_FXF_READ, NULL,
-                             sshc->handle, &sshc->handleSz);
-      if(rc == WS_FATAL_ERROR)
-        rc = wolfSSH_get_error(sshc->ssh_session);
-      if(rc == WS_WANT_READ) {
-        *block = TRUE;
-        conn->waitfor = KEEP_RECV;
-        return CURLE_OK;
-      }
-      else if(rc == WS_WANT_WRITE) {
-        *block = TRUE;
-        conn->waitfor = KEEP_SEND;
-        return CURLE_OK;
-      }
-      else if(rc == WS_SUCCESS) {
-        infof(data, "wolfssh SFTP open succeeded");
-        state(data, SSH_SFTP_DOWNLOAD_STAT);
-        return CURLE_OK;
-      }
-
-      failf(data, "wolfssh SFTP open failed: %d", rc);
-      return CURLE_SSH;
-
-    case SSH_SFTP_DOWNLOAD_STAT: {
-      WS_SFTP_FILEATRB attrs;
-      curl_off_t size;
-
-      rc = wolfSSH_SFTP_STAT(sshc->ssh_session, sftp_scp->path, &attrs);
-      if(rc == WS_FATAL_ERROR)
-        rc = wolfSSH_get_error(sshc->ssh_session);
-      if(rc == WS_WANT_READ) {
-        *block = TRUE;
-        conn->waitfor = KEEP_RECV;
-        return CURLE_OK;
-      }
-      else if(rc == WS_WANT_WRITE) {
-        *block = TRUE;
-        conn->waitfor = KEEP_SEND;
-        return CURLE_OK;
-      }
-      else if(rc == WS_SUCCESS) {
-        infof(data, "wolfssh STAT succeeded");
-      }
-      else {
-        failf(data, "wolfssh SFTP open failed: %d", rc);
-        data->req.size = -1;
-        data->req.maxdownload = -1;
-        Curl_pgrsSetDownloadSize(data, -1);
-        return CURLE_SSH;
-      }
-
-      size = ((curl_off_t)attrs.sz[1] <<32) | attrs.sz[0];
-
-      data->req.size = size;
-      data->req.maxdownload = size;
-      Curl_pgrsSetDownloadSize(data, size);
-
-      infof(data, "SFTP download %" CURL_FORMAT_CURL_OFF_T " bytes", size);
-
-      /* We cannot seek with wolfSSH so resuming and range requests are not
-         possible */
-      if(data->state.use_range || data->state.resume_from) {
-        infof(data, "wolfSSH cannot do range/seek on SFTP");
-        return CURLE_BAD_DOWNLOAD_RESUME;
-      }
-
-      /* Setup the actual download */
-      if(data->req.size == 0) {
-        /* no data to transfer */
-        Curl_setup_transfer(data, -1, -1, FALSE, -1);
-        infof(data, "File already completely downloaded");
-        state(data, SSH_STOP);
-        break;
-      }
-      Curl_setup_transfer(data, FIRSTSOCKET, data->req.size, FALSE, -1);
-
-      /* not set by Curl_setup_transfer to preserve keepon bits */
-      conn->writesockfd = conn->sockfd;
-
-      /* we want to use the _receiving_ function even when the socket turns
-         out writableable as the underlying libssh2 recv function will deal
-         with both accordingly */
-      conn->cselect_bits = CURL_CSELECT_IN;
-
-      if(result) {
-        /* this should never occur; the close state should be entered
-           at the time the error occurs */
-        state(data, SSH_SFTP_CLOSE);
-        sshc->actualcode = result;
-      }
-      else {
-        state(data, SSH_STOP);
-      }
-      break;
-    }
-    case SSH_SFTP_CLOSE:
-      if(sshc->handleSz)
-        rc = wolfSSH_SFTP_Close(sshc->ssh_session, sshc->handle,
-                                sshc->handleSz);
-      else
-        rc = WS_SUCCESS; /* directory listing */
-      if(rc == WS_WANT_READ) {
-        *block = TRUE;
-        conn->waitfor = KEEP_RECV;
-        return CURLE_OK;
-      }
-      else if(rc == WS_WANT_WRITE) {
-        *block = TRUE;
-        conn->waitfor = KEEP_SEND;
-        return CURLE_OK;
-      }
-      else if(rc == WS_SUCCESS) {
-        state(data, SSH_STOP);
-        return CURLE_OK;
-      }
-
-      failf(data, "wolfssh SFTP CLOSE failed: %d", rc);
-      return CURLE_SSH;
-
-    case SSH_SFTP_READDIR_INIT:
-      Curl_pgrsSetDownloadSize(data, -1);
-      if(data->req.no_body) {
-        state(data, SSH_STOP);
-        break;
-      }
-      state(data, SSH_SFTP_READDIR);
-      break;
-
-    case SSH_SFTP_READDIR:
-      name = wolfSSH_SFTP_LS(sshc->ssh_session, sftp_scp->path);
-      if(!name)
-        rc = wolfSSH_get_error(sshc->ssh_session);
-      else
-        rc = WS_SUCCESS;
-
-      if(rc == WS_WANT_READ) {
-        *block = TRUE;
-        conn->waitfor = KEEP_RECV;
-        return CURLE_OK;
-      }
-      else if(rc == WS_WANT_WRITE) {
-        *block = TRUE;
-        conn->waitfor = KEEP_SEND;
-        return CURLE_OK;
-      }
-      else if(name && (rc == WS_SUCCESS)) {
-        WS_SFTPNAME *origname = name;
-        result = CURLE_OK;
-        while(name) {
-          char *line = aprintf("%s\n",
-                               data->set.list_only ?
-                               name->fName : name->lName);
-          if(!line) {
-            state(data, SSH_SFTP_CLOSE);
-            sshc->actualcode = CURLE_OUT_OF_MEMORY;
-            break;
-          }
-          result = Curl_client_write(data, CLIENTWRITE_BODY,
-                                     line, strlen(line));
-          free(line);
-          if(result) {
-            sshc->actualcode = result;
-            break;
-          }
-          name = name->next;
-        }
-        wolfSSH_SFTPNAME_list_free(origname);
-        state(data, SSH_STOP);
-        return result;
-      }
-      failf(data, "wolfssh SFTP ls failed: %d", rc);
-      return CURLE_SSH;
-
-    case SSH_SFTP_SHUTDOWN:
-      Curl_safefree(sshc->homedir);
-      wolfSSH_free(sshc->ssh_session);
-      wolfSSH_CTX_free(sshc->ctx);
-      state(data, SSH_STOP);
-      return CURLE_OK;
-    default:
-      break;
-    }
-  } while(!rc && (sshc->state != SSH_STOP));
-  return result;
-}
-
-/* called repeatedly until done from multi.c */
-static CURLcode wssh_multi_statemach(struct Curl_easy *data, bool *done)
-{
-  struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-  CURLcode result = CURLE_OK;
-  bool block; /* we store the status and use that to provide a ssh_getsock()
-                 implementation */
-  do {
-    result = wssh_statemach_act(data, &block);
-    *done = (sshc->state == SSH_STOP) ? TRUE : FALSE;
-    /* if there's no error, it isn't done and it didn't EWOULDBLOCK, then
-       try again */
-    if(*done) {
-      DEBUGF(infof(data, "wssh_statemach_act says DONE"));
-    }
-  } while(!result && !*done && !block);
-
-  return result;
-}
-
-static
-CURLcode wscp_perform(struct Curl_easy *data,
-                      bool *connected,
-                      bool *dophase_done)
-{
-  (void)data;
-  (void)connected;
-  (void)dophase_done;
-  return CURLE_OK;
-}
-
-static
-CURLcode wsftp_perform(struct Curl_easy *data,
-                       bool *connected,
-                       bool *dophase_done)
-{
-  CURLcode result = CURLE_OK;
-
-  DEBUGF(infof(data, "DO phase starts"));
-
-  *dophase_done = FALSE; /* not done yet */
-
-  /* start the first command in the DO phase */
-  state(data, SSH_SFTP_QUOTE_INIT);
-
-  /* run the state-machine */
-  result = wssh_multi_statemach(data, dophase_done);
-
-  *connected = Curl_conn_is_connected(data->conn, FIRSTSOCKET);
-
-  if(*dophase_done) {
-    DEBUGF(infof(data, "DO phase is complete"));
-  }
-
-  return result;
-}
-
-/*
- * The DO function is generic for both protocols.
- */
-static CURLcode wssh_do(struct Curl_easy *data, bool *done)
-{
-  CURLcode result;
-  bool connected = 0;
-  struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-
-  *done = FALSE; /* default to false */
-  data->req.size = -1; /* make sure this is unknown at this point */
-  sshc->actualcode = CURLE_OK; /* reset error code */
-  sshc->secondCreateDirs = 0;   /* reset the create dir attempt state
-                                   variable */
-
-  Curl_pgrsSetUploadCounter(data, 0);
-  Curl_pgrsSetDownloadCounter(data, 0);
-  Curl_pgrsSetUploadSize(data, -1);
-  Curl_pgrsSetDownloadSize(data, -1);
-
-  if(conn->handler->protocol & CURLPROTO_SCP)
-    result = wscp_perform(data, &connected,  done);
-  else
-    result = wsftp_perform(data, &connected,  done);
-
-  return result;
-}
-
-static CURLcode wssh_block_statemach(struct Curl_easy *data,
-                                    bool disconnect)
-{
-  struct connectdata *conn = data->conn;
-  struct ssh_conn *sshc = &conn->proto.sshc;
-  CURLcode result = CURLE_OK;
-
-  while((sshc->state != SSH_STOP) && !result) {
-    bool block;
-    timediff_t left = 1000;
-    struct curltime now = Curl_now();
-
-    result = wssh_statemach_act(data, &block);
-    if(result)
-      break;
-
-    if(!disconnect) {
-      if(Curl_pgrsUpdate(data))
-        return CURLE_ABORTED_BY_CALLBACK;
-
-      result = Curl_speedcheck(data, now);
-      if(result)
-        break;
-
-      left = Curl_timeleft(data, NULL, FALSE);
-      if(left < 0) {
-        failf(data, "Operation timed out");
-        return CURLE_OPERATION_TIMEDOUT;
-      }
-    }
-
-    if(!result) {
-      int dir = conn->waitfor;
-      curl_socket_t sock = conn->sock[FIRSTSOCKET];
-      curl_socket_t fd_read = CURL_SOCKET_BAD;
-      curl_socket_t fd_write = CURL_SOCKET_BAD;
-      if(dir == KEEP_RECV)
-        fd_read = sock;
-      else if(dir == KEEP_SEND)
-        fd_write = sock;
-
-      /* wait for the socket to become ready */
-      (void)Curl_socket_check(fd_read, CURL_SOCKET_BAD, fd_write,
-                              left>1000?1000:left); /* ignore result */
-    }
-  }
-
-  return result;
-}
-
-/* generic done function for both SCP and SFTP called from their specific
-   done functions */
-static CURLcode wssh_done(struct Curl_easy *data, CURLcode status)
-{
-  CURLcode result = CURLE_OK;
-  struct SSHPROTO *sftp_scp = data->req.p.ssh;
-
-  if(!status) {
-    /* run the state-machine */
-    result = wssh_block_statemach(data, FALSE);
-  }
-  else
-    result = status;
-
-  if(sftp_scp)
-    Curl_safefree(sftp_scp->path);
-  if(Curl_pgrsDone(data))
-    return CURLE_ABORTED_BY_CALLBACK;
-
-  data->req.keepon = 0; /* clear all bits */
-  return result;
-}
-
-#if 0
-static CURLcode wscp_done(struct Curl_easy *data,
-                         CURLcode code, bool premature)
-{
-  CURLcode result = CURLE_OK;
-  (void)conn;
-  (void)code;
-  (void)premature;
-
-  return result;
-}
-
-static CURLcode wscp_doing(struct Curl_easy *data,
-                          bool *dophase_done)
-{
-  CURLcode result = CURLE_OK;
-  (void)conn;
-  (void)dophase_done;
-
-  return result;
-}
-
-static CURLcode wscp_disconnect(struct Curl_easy *data,
-                                struct connectdata *conn, bool dead_connection)
-{
-  CURLcode result = CURLE_OK;
-  (void)data;
-  (void)conn;
-  (void)dead_connection;
-
-  return result;
-}
-#endif
-
-static CURLcode wsftp_done(struct Curl_easy *data,
-                          CURLcode code, bool premature)
-{
-  (void)premature;
-  state(data, SSH_SFTP_CLOSE);
-
-  return wssh_done(data, code);
-}
-
-static CURLcode wsftp_doing(struct Curl_easy *data,
-                           bool *dophase_done)
-{
-  CURLcode result = wssh_multi_statemach(data, dophase_done);
-
-  if(*dophase_done) {
-    DEBUGF(infof(data, "DO phase is complete"));
-  }
-  return result;
-}
-
-static CURLcode wsftp_disconnect(struct Curl_easy *data,
-                                 struct connectdata *conn,
-                                 bool dead)
-{
-  CURLcode result = CURLE_OK;
-  (void)dead;
-
-  DEBUGF(infof(data, "SSH DISCONNECT starts now"));
-
-  if(conn->proto.sshc.ssh_session) {
-    /* only if there's a session still around to use! */
-    state(data, SSH_SFTP_SHUTDOWN);
-    result = wssh_block_statemach(data, TRUE);
-  }
-
-  DEBUGF(infof(data, "SSH DISCONNECT is done"));
-  return result;
-}
-
-static int wssh_getsock(struct Curl_easy *data,
-                        struct connectdata *conn,
-                        curl_socket_t *sock)
-{
-  int bitmap = GETSOCK_BLANK;
-  int dir = conn->waitfor;
-  (void)data;
-  sock[0] = conn->sock[FIRSTSOCKET];
-
-  if(dir == KEEP_RECV)
-    bitmap |= GETSOCK_READSOCK(FIRSTSOCKET);
-  else if(dir == KEEP_SEND)
-    bitmap |= GETSOCK_WRITESOCK(FIRSTSOCKET);
-
-  return bitmap;
-}
-
-void Curl_ssh_version(char *buffer, size_t buflen)
-{
-  (void)msnprintf(buffer, buflen, "wolfssh/%s", LIBWOLFSSH_VERSION_STRING);
-}
-
-CURLcode Curl_ssh_init(void)
-{
-  if(WS_SUCCESS != wolfSSH_Init()) {
-    DEBUGF(fprintf(stderr, "Error: wolfSSH_Init failed\n"));
-    return CURLE_FAILED_INIT;
-  }
-
-  return CURLE_OK;
-}
-void Curl_ssh_cleanup(void)
-{
-}
-
-#endif /* USE_WOLFSSH */
diff --git a/third-party/curl/lib/vtls/apple.c b/third-party/curl/lib/vtls/apple.c
new file mode 100644
index 0000000000..2e132f2977
--- /dev/null
+++ b/third-party/curl/lib/vtls/apple.c
@@ -0,0 +1,291 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+/* This file is for implementing all "generic" SSL functions that all libcurl
+   internals should use. It is then responsible for calling the proper
+   "backend" function.
+
+   SSL-functions in libcurl should call functions in this source file, and not
+   to any specific SSL-layer.
+
+   Curl_ssl_ - prefix for generic ones
+
+   Note that this source code uses the functions of the configured SSL
+   backend via the global Curl_ssl instance.
+
+   "SSL/TLS Strong Encryption: An Introduction"
+   https://httpd.apache.org/docs/2.0/ssl/ssl_intro.html
+*/
+
+#include "curl_setup.h"
+
+#ifdef USE_APPLE_SECTRUST
+
+#include "urldata.h"
+#include "cfilters.h"
+#include "curl_trc.h"
+#include "vtls/vtls.h"
+#include "vtls/apple.h"
+
+#include <Security/Security.h>
+
+#if (defined(MAC_OS_X_VERSION_MAX_ALLOWED) &&   \
+     MAC_OS_X_VERSION_MAX_ALLOWED >= 101400) || \
+  (defined(__IPHONE_OS_VERSION_MAX_ALLOWED) &&  \
+   __IPHONE_OS_VERSION_MAX_ALLOWED >= 120000)
+#define SUPPORTS_SecTrustEvaluateWithError 1
+#endif
+
+#if defined(SUPPORTS_SecTrustEvaluateWithError) && \
+  ((defined(MAC_OS_X_VERSION_MIN_REQUIRED) &&      \
+    MAC_OS_X_VERSION_MIN_REQUIRED >= 101400) ||    \
+   (defined(__IPHONE_OS_VERSION_MIN_REQUIRED) &&   \
+    __IPHONE_OS_VERSION_MIN_REQUIRED >= 120000))
+#define REQUIRES_SecTrustEvaluateWithError 1
+#endif
+
+#if defined(SUPPORTS_SecTrustEvaluateWithError) && \
+  !defined(HAVE_BUILTIN_AVAILABLE) &&              \
+  !defined(REQUIRES_SecTrustEvaluateWithError)
+#undef SUPPORTS_SecTrustEvaluateWithError
+#endif
+
+#if (defined(MAC_OS_X_VERSION_MAX_ALLOWED) &&   \
+     MAC_OS_X_VERSION_MAX_ALLOWED >= 100900) || \
+  (defined(__IPHONE_OS_VERSION_MAX_ALLOWED) &&  \
+   __IPHONE_OS_VERSION_MAX_ALLOWED >= 70000)
+#define SUPPORTS_SecOCSP 1
+#endif
+
+CURLcode Curl_vtls_apple_verify(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                struct ssl_peer *peer,
+                                size_t num_certs,
+                                Curl_vtls_get_cert_der *der_cb,
+                                void *cb_user_data,
+                                const unsigned char *ocsp_buf,
+                                size_t ocsp_len)
+{
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  CURLcode result = CURLE_OK;
+  SecTrustRef trust = NULL;
+  SecPolicyRef policy = NULL;
+  CFMutableArrayRef policies = NULL;
+  CFMutableArrayRef cert_array = NULL;
+  CFStringRef host_str = NULL;
+  CFErrorRef error = NULL;
+  OSStatus status = noErr;
+  CFStringRef error_ref = NULL;
+  char *err_desc = NULL;
+  size_t i;
+
+  if(conn_config->verifyhost) {
+    host_str = CFStringCreateWithCString(NULL,
+      peer->sni ? peer->sni : peer->origin->hostname, kCFStringEncodingUTF8);
+    if(!host_str) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+  }
+
+  policies = CFArrayCreateMutable(NULL, 2, &kCFTypeArrayCallBacks);
+  if(!policies) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  policy = SecPolicyCreateSSL(true, host_str);
+  if(!policy) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  CFArrayAppendValue(policies, policy);
+  CFRelease(policy);
+  policy = NULL;
+
+#if defined(HAVE_BUILTIN_AVAILABLE) && defined(SUPPORTS_SecOCSP)
+  {
+    struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+    if(!ssl_config->no_revoke) {
+      if(__builtin_available(macOS 10.9, iOS 7, tvOS 9, watchOS 2, *)) {
+        /* Even without this set, validation seemingly-unavoidably fails
+         * for certificates that trustd already knows to be revoked.
+         * This policy further allows trustd to consult CRLs and OCSP data
+         * to determine revocation status (which it may then cache). */
+        CFOptionFlags revocation_flags = kSecRevocationUseAnyAvailableMethod;
+#if 0
+        /* `revoke_best_effort` is off by default in libcurl. When we
+         * add `kSecRevocationRequirePositiveResponse` to the Apple
+         * Trust policies, it interprets this as it NEEDs a confirmation
+         * of a cert being NOT REVOKED. Which not in general available for
+         * certificates on the Internet.
+         * It seems that applications using this policy are expected to PIN
+         * their certificate public keys or verification fails.
+         * This does not seem to be what we want here. */
+        if(!ssl_config->revoke_best_effort) {
+          revocation_flags |= kSecRevocationRequirePositiveResponse;
+        }
+#endif
+        policy = SecPolicyCreateRevocation(revocation_flags);
+        if(!policy) {
+          result = CURLE_OUT_OF_MEMORY;
+          goto out;
+        }
+
+        CFArrayAppendValue(policies, policy);
+      }
+    }
+  }
+#endif
+
+  cert_array = CFArrayCreateMutable(NULL, num_certs, &kCFTypeArrayCallBacks);
+  if(!cert_array) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  for(i = 0; i < num_certs; i++) {
+    SecCertificateRef cert;
+    CFDataRef certdata;
+    unsigned char *der;
+    size_t der_len;
+
+    result = der_cb(cf, data, cb_user_data, i, &der, &der_len);
+    if(result)
+      goto out;
+
+    certdata = CFDataCreate(NULL, der, (CFIndex)der_len);
+    if(!certdata) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+
+    cert = SecCertificateCreateWithData(NULL, certdata);
+    CFRelease(certdata);
+    if(!cert) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+
+    CFArrayAppendValue(cert_array, cert);
+    CFRelease(cert);
+  }
+
+  status = SecTrustCreateWithCertificates(cert_array, policies, &trust);
+  if(status != noErr || !trust) {
+    failf(data, "Apple SecTrust: failed to create validation trust");
+    result = CURLE_PEER_FAILED_VERIFICATION;
+    goto out;
+  }
+
+#if defined(HAVE_BUILTIN_AVAILABLE) && defined(SUPPORTS_SecOCSP)
+  if(ocsp_len > 0) {
+    if(__builtin_available(macOS 10.9, iOS 7, tvOS 9, watchOS 2, *)) {
+      CFDataRef ocspdata = CFDataCreate(NULL, ocsp_buf, (CFIndex)ocsp_len);
+
+      status = SecTrustSetOCSPResponse(trust, ocspdata);
+      CFRelease(ocspdata);
+      if(status != noErr) {
+        failf(data, "Apple SecTrust: failed to set OCSP response: %d",
+              (int)status);
+        result = CURLE_PEER_FAILED_VERIFICATION;
+        goto out;
+      }
+    }
+  }
+#else
+  (void)ocsp_buf;
+  (void)ocsp_len;
+#endif
+
+#ifdef SUPPORTS_SecTrustEvaluateWithError
+#ifdef HAVE_BUILTIN_AVAILABLE
+  if(__builtin_available(macOS 10.14, iOS 12, tvOS 12, watchOS 5, *)) {
+#else
+  if(1) {
+#endif
+    result = SecTrustEvaluateWithError(trust, &error) ?
+             CURLE_OK : CURLE_PEER_FAILED_VERIFICATION;
+    if(error) {
+      VERBOSE(CFIndex code = CFErrorGetCode(error));
+      error_ref = CFErrorCopyDescription(error);
+
+      if(error_ref) {
+        CFIndex size = CFStringGetMaximumSizeForEncoding(
+          CFStringGetLength(error_ref), kCFStringEncodingUTF8);
+        err_desc = curlx_malloc(size + 1);
+        if(err_desc) {
+          if(!CFStringGetCString(error_ref, err_desc, size,
+                                 kCFStringEncodingUTF8))
+            curlx_safefree(err_desc);
+        }
+      }
+      infof(data, "Apple SecTrust failure %ld%s%s", code,
+            err_desc ? ": " : "", err_desc ? err_desc : "");
+    }
+  }
+  else
+#endif /* SUPPORTS_SecTrustEvaluateWithError */
+  {
+#ifndef REQUIRES_SecTrustEvaluateWithError
+    SecTrustResultType sec_result;
+    status = SecTrustEvaluate(trust, &sec_result);
+
+    if(status != noErr) {
+      failf(data, "Apple SecTrust verification failed: error %d", (int)status);
+      result = CURLE_PEER_FAILED_VERIFICATION;
+    }
+    else if((sec_result == kSecTrustResultUnspecified) ||
+            (sec_result == kSecTrustResultProceed)) {
+      /* "unspecified" means system-trusted with no explicit user setting */
+      result = CURLE_OK;
+    }
+    else {
+      /* Any other trust result is a verification failure in this context */
+      result = CURLE_PEER_FAILED_VERIFICATION;
+    }
+#endif /* REQUIRES_SecTrustEvaluateWithError */
+  }
+
+out:
+  curlx_free(err_desc);
+  if(error_ref)
+    CFRelease(error_ref);
+  if(error)
+    CFRelease(error);
+  if(host_str)
+    CFRelease(host_str);
+  if(policies)
+    CFRelease(policies);
+  if(policy)
+    CFRelease(policy);
+  if(cert_array)
+    CFRelease(cert_array);
+  if(trust)
+    CFRelease(trust);
+  return result;
+}
+
+#endif /* USE_APPLE_SECTRUST */
diff --git a/third-party/curl/lib/vtls/apple.h b/third-party/curl/lib/vtls/apple.h
new file mode 100644
index 0000000000..d86a56b1f9
--- /dev/null
+++ b/third-party/curl/lib/vtls/apple.h
@@ -0,0 +1,54 @@
+#ifndef HEADER_CURL_VTLS_APPLE_H
+#define HEADER_CURL_VTLS_APPLE_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Jan Venekamp, <jan@venekamp.net>
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef USE_APPLE_SECTRUST
+struct Curl_cfilter;
+struct Curl_easy;
+struct ssl_peer;
+
+/* Get the DER encoded i-th certificate in the server handshake */
+typedef CURLcode Curl_vtls_get_cert_der(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data,
+                                        void *user_data,
+                                        size_t i,
+                                        unsigned char **pder,
+                                        size_t *pder_len);
+
+/* Ask Apple's Security framework to verify the certificate chain
+ * send by the peer. On CURLE_OK it has been verified.
+ */
+CURLcode Curl_vtls_apple_verify(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                struct ssl_peer *peer,
+                                size_t num_certs,
+                                Curl_vtls_get_cert_der *der_cb,
+                                void *cb_user_data,
+                                const unsigned char *ocsp_buf,
+                                size_t ocsp_len);
+#endif /* USE_APPLE_SECTRUST */
+
+#endif /* HEADER_CURL_VTLS_APPLE_H */
diff --git a/third-party/curl/lib/vtls/bearssl.c b/third-party/curl/lib/vtls/bearssl.c
deleted file mode 100644
index 934149c1b0..0000000000
--- a/third-party/curl/lib/vtls/bearssl.c
+++ /dev/null
@@ -1,1230 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Michael Forney, <mforney@mforney.org>
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "curl_setup.h"
-
-#ifdef USE_BEARSSL
-
-#include <bearssl.h>
-
-#include "bearssl.h"
-#include "urldata.h"
-#include "sendf.h"
-#include "inet_pton.h"
-#include "vtls.h"
-#include "vtls_int.h"
-#include "connect.h"
-#include "select.h"
-#include "multiif.h"
-#include "curl_printf.h"
-#include "strcase.h"
-
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
-
-struct x509_context {
-  const br_x509_class *vtable;
-  br_x509_minimal_context minimal;
-  br_x509_decoder_context decoder;
-  bool verifyhost;
-  bool verifypeer;
-  int cert_num;
-};
-
-struct bearssl_ssl_backend_data {
-  br_ssl_client_context ctx;
-  struct x509_context x509;
-  unsigned char buf[BR_SSL_BUFSIZE_BIDI];
-  br_x509_trust_anchor *anchors;
-  size_t anchors_len;
-  const char *protocols[ALPN_ENTRIES_MAX];
-  /* SSL client context is active */
-  bool active;
-  /* size of pending write, yet to be flushed */
-  size_t pending_write;
-};
-
-struct cafile_parser {
-  CURLcode err;
-  bool in_cert;
-  br_x509_decoder_context xc;
-  /* array of trust anchors loaded from CAfile */
-  br_x509_trust_anchor *anchors;
-  size_t anchors_len;
-  /* buffer for DN data */
-  unsigned char dn[1024];
-  size_t dn_len;
-};
-
-#define CAFILE_SOURCE_PATH 1
-#define CAFILE_SOURCE_BLOB 2
-struct cafile_source {
-  int type;
-  const char *data;
-  size_t len;
-};
-
-static void append_dn(void *ctx, const void *buf, size_t len)
-{
-  struct cafile_parser *ca = ctx;
-
-  if(ca->err != CURLE_OK || !ca->in_cert)
-    return;
-  if(sizeof(ca->dn) - ca->dn_len < len) {
-    ca->err = CURLE_FAILED_INIT;
-    return;
-  }
-  memcpy(ca->dn + ca->dn_len, buf, len);
-  ca->dn_len += len;
-}
-
-static void x509_push(void *ctx, const void *buf, size_t len)
-{
-  struct cafile_parser *ca = ctx;
-
-  if(ca->in_cert)
-    br_x509_decoder_push(&ca->xc, buf, len);
-}
-
-static CURLcode load_cafile(struct cafile_source *source,
-                            br_x509_trust_anchor **anchors,
-                            size_t *anchors_len)
-{
-  struct cafile_parser ca;
-  br_pem_decoder_context pc;
-  br_x509_trust_anchor *ta;
-  size_t ta_size;
-  br_x509_trust_anchor *new_anchors;
-  size_t new_anchors_len;
-  br_x509_pkey *pkey;
-  FILE *fp = 0;
-  unsigned char buf[BUFSIZ];
-  const unsigned char *p;
-  const char *name;
-  size_t n, i, pushed;
-
-  DEBUGASSERT(source->type == CAFILE_SOURCE_PATH
-              || source->type == CAFILE_SOURCE_BLOB);
-
-  if(source->type == CAFILE_SOURCE_PATH) {
-    fp = fopen(source->data, "rb");
-    if(!fp)
-      return CURLE_SSL_CACERT_BADFILE;
-  }
-
-  if(source->type == CAFILE_SOURCE_BLOB && source->len > (size_t)INT_MAX)
-    return CURLE_SSL_CACERT_BADFILE;
-
-  ca.err = CURLE_OK;
-  ca.in_cert = FALSE;
-  ca.anchors = NULL;
-  ca.anchors_len = 0;
-  br_pem_decoder_init(&pc);
-  br_pem_decoder_setdest(&pc, x509_push, &ca);
-  do {
-    if(source->type == CAFILE_SOURCE_PATH) {
-      n = fread(buf, 1, sizeof(buf), fp);
-      if(n == 0)
-        break;
-      p = buf;
-    }
-    else if(source->type == CAFILE_SOURCE_BLOB) {
-      n = source->len;
-      p = (unsigned char *) source->data;
-    }
-    while(n) {
-      pushed = br_pem_decoder_push(&pc, p, n);
-      if(ca.err)
-        goto fail;
-      p += pushed;
-      n -= pushed;
-
-      switch(br_pem_decoder_event(&pc)) {
-      case 0:
-        break;
-      case BR_PEM_BEGIN_OBJ:
-        name = br_pem_decoder_name(&pc);
-        if(strcmp(name, "CERTIFICATE") && strcmp(name, "X509 CERTIFICATE"))
-          break;
-        br_x509_decoder_init(&ca.xc, append_dn, &ca);
-        ca.in_cert = TRUE;
-        ca.dn_len = 0;
-        break;
-      case BR_PEM_END_OBJ:
-        if(!ca.in_cert)
-          break;
-        ca.in_cert = FALSE;
-        if(br_x509_decoder_last_error(&ca.xc)) {
-          ca.err = CURLE_SSL_CACERT_BADFILE;
-          goto fail;
-        }
-        /* add trust anchor */
-        if(ca.anchors_len == SIZE_MAX / sizeof(ca.anchors[0])) {
-          ca.err = CURLE_OUT_OF_MEMORY;
-          goto fail;
-        }
-        new_anchors_len = ca.anchors_len + 1;
-        new_anchors = realloc(ca.anchors,
-                              new_anchors_len * sizeof(ca.anchors[0]));
-        if(!new_anchors) {
-          ca.err = CURLE_OUT_OF_MEMORY;
-          goto fail;
-        }
-        ca.anchors = new_anchors;
-        ca.anchors_len = new_anchors_len;
-        ta = &ca.anchors[ca.anchors_len - 1];
-        ta->dn.data = NULL;
-        ta->flags = 0;
-        if(br_x509_decoder_isCA(&ca.xc))
-          ta->flags |= BR_X509_TA_CA;
-        pkey = br_x509_decoder_get_pkey(&ca.xc);
-        if(!pkey) {
-          ca.err = CURLE_SSL_CACERT_BADFILE;
-          goto fail;
-        }
-        ta->pkey = *pkey;
-
-        /* calculate space needed for trust anchor data */
-        ta_size = ca.dn_len;
-        switch(pkey->key_type) {
-        case BR_KEYTYPE_RSA:
-          ta_size += pkey->key.rsa.nlen + pkey->key.rsa.elen;
-          break;
-        case BR_KEYTYPE_EC:
-          ta_size += pkey->key.ec.qlen;
-          break;
-        default:
-          ca.err = CURLE_FAILED_INIT;
-          goto fail;
-        }
-
-        /* fill in trust anchor DN and public key data */
-        ta->dn.data = malloc(ta_size);
-        if(!ta->dn.data) {
-          ca.err = CURLE_OUT_OF_MEMORY;
-          goto fail;
-        }
-        memcpy(ta->dn.data, ca.dn, ca.dn_len);
-        ta->dn.len = ca.dn_len;
-        switch(pkey->key_type) {
-        case BR_KEYTYPE_RSA:
-          ta->pkey.key.rsa.n = ta->dn.data + ta->dn.len;
-          memcpy(ta->pkey.key.rsa.n, pkey->key.rsa.n, pkey->key.rsa.nlen);
-          ta->pkey.key.rsa.e = ta->pkey.key.rsa.n + ta->pkey.key.rsa.nlen;
-          memcpy(ta->pkey.key.rsa.e, pkey->key.rsa.e, pkey->key.rsa.elen);
-          break;
-        case BR_KEYTYPE_EC:
-          ta->pkey.key.ec.q = ta->dn.data + ta->dn.len;
-          memcpy(ta->pkey.key.ec.q, pkey->key.ec.q, pkey->key.ec.qlen);
-          break;
-        }
-        break;
-      default:
-        ca.err = CURLE_SSL_CACERT_BADFILE;
-        goto fail;
-      }
-    }
-  } while(source->type != CAFILE_SOURCE_BLOB);
-  if(fp && ferror(fp))
-    ca.err = CURLE_READ_ERROR;
-  else if(ca.in_cert)
-    ca.err = CURLE_SSL_CACERT_BADFILE;
-
-fail:
-  if(fp)
-    fclose(fp);
-  if(ca.err == CURLE_OK) {
-    *anchors = ca.anchors;
-    *anchors_len = ca.anchors_len;
-  }
-  else {
-    for(i = 0; i < ca.anchors_len; ++i)
-      free(ca.anchors[i].dn.data);
-    free(ca.anchors);
-  }
-
-  return ca.err;
-}
-
-static void x509_start_chain(const br_x509_class **ctx,
-                             const char *server_name)
-{
-  struct x509_context *x509 = (struct x509_context *)ctx;
-
-  if(!x509->verifypeer) {
-    x509->cert_num = 0;
-    return;
-  }
-
-  if(!x509->verifyhost)
-    server_name = NULL;
-  x509->minimal.vtable->start_chain(&x509->minimal.vtable, server_name);
-}
-
-static void x509_start_cert(const br_x509_class **ctx, uint32_t length)
-{
-  struct x509_context *x509 = (struct x509_context *)ctx;
-
-  if(!x509->verifypeer) {
-    /* Only decode the first cert in the chain to obtain the public key */
-    if(x509->cert_num == 0)
-      br_x509_decoder_init(&x509->decoder, NULL, NULL);
-    return;
-  }
-
-  x509->minimal.vtable->start_cert(&x509->minimal.vtable, length);
-}
-
-static void x509_append(const br_x509_class **ctx, const unsigned char *buf,
-                        size_t len)
-{
-  struct x509_context *x509 = (struct x509_context *)ctx;
-
-  if(!x509->verifypeer) {
-    if(x509->cert_num == 0)
-      br_x509_decoder_push(&x509->decoder, buf, len);
-    return;
-  }
-
-  x509->minimal.vtable->append(&x509->minimal.vtable, buf, len);
-}
-
-static void x509_end_cert(const br_x509_class **ctx)
-{
-  struct x509_context *x509 = (struct x509_context *)ctx;
-
-  if(!x509->verifypeer) {
-    x509->cert_num++;
-    return;
-  }
-
-  x509->minimal.vtable->end_cert(&x509->minimal.vtable);
-}
-
-static unsigned x509_end_chain(const br_x509_class **ctx)
-{
-  struct x509_context *x509 = (struct x509_context *)ctx;
-
-  if(!x509->verifypeer) {
-    return br_x509_decoder_last_error(&x509->decoder);
-  }
-
-  return x509->minimal.vtable->end_chain(&x509->minimal.vtable);
-}
-
-static const br_x509_pkey *x509_get_pkey(const br_x509_class *const *ctx,
-                                         unsigned *usages)
-{
-  struct x509_context *x509 = (struct x509_context *)ctx;
-
-  if(!x509->verifypeer) {
-    /* Nothing in the chain is verified, just return the public key of the
-       first certificate and allow its usage for both TLS_RSA_* and
-       TLS_ECDHE_* */
-    if(usages)
-      *usages = BR_KEYTYPE_KEYX | BR_KEYTYPE_SIGN;
-    return br_x509_decoder_get_pkey(&x509->decoder);
-  }
-
-  return x509->minimal.vtable->get_pkey(&x509->minimal.vtable, usages);
-}
-
-static const br_x509_class x509_vtable = {
-  sizeof(struct x509_context),
-  x509_start_chain,
-  x509_start_cert,
-  x509_append,
-  x509_end_cert,
-  x509_end_chain,
-  x509_get_pkey
-};
-
-struct st_cipher {
-  const char *name; /* Cipher suite IANA name. It starts with "TLS_" prefix */
-  const char *alias_name; /* Alias name is the same as OpenSSL cipher name */
-  uint16_t num; /* BearSSL cipher suite */
-};
-
-/* Macro to initialize st_cipher data structure */
-#define CIPHER_DEF(num, alias) { #num, alias, BR_##num }
-
-static const struct st_cipher ciphertable[] = {
-  /* RFC 2246 TLS 1.0 */
-  CIPHER_DEF(TLS_RSA_WITH_3DES_EDE_CBC_SHA,                        /* 0x000A */
-             "DES-CBC3-SHA"),
-
-  /* RFC 3268 TLS 1.0 AES */
-  CIPHER_DEF(TLS_RSA_WITH_AES_128_CBC_SHA,                         /* 0x002F */
-             "AES128-SHA"),
-  CIPHER_DEF(TLS_RSA_WITH_AES_256_CBC_SHA,                         /* 0x0035 */
-             "AES256-SHA"),
-
-  /* RFC 5246 TLS 1.2 */
-  CIPHER_DEF(TLS_RSA_WITH_AES_128_CBC_SHA256,                      /* 0x003C */
-             "AES128-SHA256"),
-  CIPHER_DEF(TLS_RSA_WITH_AES_256_CBC_SHA256,                      /* 0x003D */
-             "AES256-SHA256"),
-
-  /* RFC 5288 TLS 1.2 AES GCM */
-  CIPHER_DEF(TLS_RSA_WITH_AES_128_GCM_SHA256,                      /* 0x009C */
-             "AES128-GCM-SHA256"),
-  CIPHER_DEF(TLS_RSA_WITH_AES_256_GCM_SHA384,                      /* 0x009D */
-             "AES256-GCM-SHA384"),
-
-  /* RFC 4492 TLS 1.0 ECC */
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,                 /* 0xC003 */
-             "ECDH-ECDSA-DES-CBC3-SHA"),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,                  /* 0xC004 */
-             "ECDH-ECDSA-AES128-SHA"),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,                  /* 0xC005 */
-             "ECDH-ECDSA-AES256-SHA"),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,                /* 0xC008 */
-             "ECDHE-ECDSA-DES-CBC3-SHA"),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,                 /* 0xC009 */
-             "ECDHE-ECDSA-AES128-SHA"),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,                 /* 0xC00A */
-             "ECDHE-ECDSA-AES256-SHA"),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,                   /* 0xC00D */
-             "ECDH-RSA-DES-CBC3-SHA"),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,                    /* 0xC00E */
-             "ECDH-RSA-AES128-SHA"),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,                    /* 0xC00F */
-             "ECDH-RSA-AES256-SHA"),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,                  /* 0xC012 */
-             "ECDHE-RSA-DES-CBC3-SHA"),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,                   /* 0xC013 */
-             "ECDHE-RSA-AES128-SHA"),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,                   /* 0xC014 */
-             "ECDHE-RSA-AES256-SHA"),
-
-  /* RFC 5289 TLS 1.2 ECC HMAC SHA256/384 */
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,              /* 0xC023 */
-             "ECDHE-ECDSA-AES128-SHA256"),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,              /* 0xC024 */
-             "ECDHE-ECDSA-AES256-SHA384"),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,               /* 0xC025 */
-             "ECDH-ECDSA-AES128-SHA256"),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,               /* 0xC026 */
-             "ECDH-ECDSA-AES256-SHA384"),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,                /* 0xC027 */
-             "ECDHE-RSA-AES128-SHA256"),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,                /* 0xC028 */
-             "ECDHE-RSA-AES256-SHA384"),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,                 /* 0xC029 */
-             "ECDH-RSA-AES128-SHA256"),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,                 /* 0xC02A */
-             "ECDH-RSA-AES256-SHA384"),
-
-  /* RFC 5289 TLS 1.2 GCM */
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,              /* 0xC02B */
-             "ECDHE-ECDSA-AES128-GCM-SHA256"),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,              /* 0xC02C */
-             "ECDHE-ECDSA-AES256-GCM-SHA384"),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,               /* 0xC02D */
-             "ECDH-ECDSA-AES128-GCM-SHA256"),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,               /* 0xC02E */
-             "ECDH-ECDSA-AES256-GCM-SHA384"),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,                /* 0xC02F */
-             "ECDHE-RSA-AES128-GCM-SHA256"),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,                /* 0xC030 */
-             "ECDHE-RSA-AES256-GCM-SHA384"),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,                 /* 0xC031 */
-             "ECDH-RSA-AES128-GCM-SHA256"),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,                 /* 0xC032 */
-             "ECDH-RSA-AES256-GCM-SHA384"),
-#ifdef BR_TLS_RSA_WITH_AES_128_CCM
-
-  /* RFC 6655 TLS 1.2 CCM
-     Supported since BearSSL 0.6 */
-  CIPHER_DEF(TLS_RSA_WITH_AES_128_CCM,                             /* 0xC09C */
-             "AES128-CCM"),
-  CIPHER_DEF(TLS_RSA_WITH_AES_256_CCM,                             /* 0xC09D */
-             "AES256-CCM"),
-  CIPHER_DEF(TLS_RSA_WITH_AES_128_CCM_8,                           /* 0xC0A0 */
-             "AES128-CCM8"),
-  CIPHER_DEF(TLS_RSA_WITH_AES_256_CCM_8,                           /* 0xC0A1 */
-             "AES256-CCM8"),
-
-  /* RFC 7251 TLS 1.2 ECC CCM
-     Supported since BearSSL 0.6 */
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CCM,                     /* 0xC0AC */
-             "ECDHE-ECDSA-AES128-CCM"),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CCM,                     /* 0xC0AD */
-             "ECDHE-ECDSA-AES256-CCM"),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8,                   /* 0xC0AE */
-             "ECDHE-ECDSA-AES128-CCM8"),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8,                   /* 0xC0AF */
-             "ECDHE-ECDSA-AES256-CCM8"),
-#endif
-
-  /* RFC 7905 TLS 1.2 ChaCha20-Poly1305
-     Supported since BearSSL 0.2 */
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,          /* 0xCCA8 */
-             "ECDHE-RSA-CHACHA20-POLY1305"),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,        /* 0xCCA9 */
-             "ECDHE-ECDSA-CHACHA20-POLY1305"),
-};
-
-#define NUM_OF_CIPHERS (sizeof(ciphertable) / sizeof(ciphertable[0]))
-#define CIPHER_NAME_BUF_LEN 64
-
-static bool is_separator(char c)
-{
-  /* Return whether character is a cipher list separator. */
-  switch(c) {
-    case ' ':
-    case '\t':
-    case ':':
-    case ',':
-    case ';':
-      return true;
-  }
-  return false;
-}
-
-static CURLcode bearssl_set_selected_ciphers(struct Curl_easy *data,
-                                             br_ssl_engine_context *ssl_eng,
-                                             const char *ciphers)
-{
-  uint16_t selected_ciphers[NUM_OF_CIPHERS];
-  size_t selected_count = 0;
-  char cipher_name[CIPHER_NAME_BUF_LEN];
-  const char *cipher_start = ciphers;
-  const char *cipher_end;
-  size_t i, j;
-
-  if(!cipher_start)
-    return CURLE_SSL_CIPHER;
-
-  while(true) {
-    /* Extract the next cipher name from the ciphers string */
-    while(is_separator(*cipher_start))
-      ++cipher_start;
-    if(*cipher_start == '\0')
-      break;
-    cipher_end = cipher_start;
-    while(*cipher_end != '\0' && !is_separator(*cipher_end))
-      ++cipher_end;
-    j = cipher_end - cipher_start < CIPHER_NAME_BUF_LEN - 1 ?
-        cipher_end - cipher_start : CIPHER_NAME_BUF_LEN - 1;
-    strncpy(cipher_name, cipher_start, j);
-    cipher_name[j] = '\0';
-    cipher_start = cipher_end;
-
-    /* Lookup the cipher name in the table of available ciphers. If the cipher
-       name starts with "TLS_" we do the lookup by IANA name. Otherwise, we try
-       to match cipher name by an (OpenSSL) alias. */
-    if(strncasecompare(cipher_name, "TLS_", 4)) {
-      for(i = 0; i < NUM_OF_CIPHERS &&
-                 !strcasecompare(cipher_name, ciphertable[i].name); ++i);
-    }
-    else {
-      for(i = 0; i < NUM_OF_CIPHERS &&
-                 !strcasecompare(cipher_name, ciphertable[i].alias_name); ++i);
-    }
-    if(i == NUM_OF_CIPHERS) {
-      infof(data, "BearSSL: unknown cipher in list: %s", cipher_name);
-      continue;
-    }
-
-    /* No duplicates allowed */
-    for(j = 0; j < selected_count &&
-               selected_ciphers[j] != ciphertable[i].num; j++);
-    if(j < selected_count) {
-      infof(data, "BearSSL: duplicate cipher in list: %s", cipher_name);
-      continue;
-    }
-
-    DEBUGASSERT(selected_count < NUM_OF_CIPHERS);
-    selected_ciphers[selected_count] = ciphertable[i].num;
-    ++selected_count;
-  }
-
-  if(selected_count == 0) {
-    failf(data, "BearSSL: no supported cipher in list");
-    return CURLE_SSL_CIPHER;
-  }
-
-  br_ssl_engine_set_suites(ssl_eng, selected_ciphers, selected_count);
-  return CURLE_OK;
-}
-
-static CURLcode bearssl_connect_step1(struct Curl_cfilter *cf,
-                                      struct Curl_easy *data)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct bearssl_ssl_backend_data *backend =
-    (struct bearssl_ssl_backend_data *)connssl->backend;
-  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
-  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
-  const struct curl_blob *ca_info_blob = conn_config->ca_info_blob;
-  const char * const ssl_cafile =
-    /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
-    (ca_info_blob ? NULL : conn_config->CAfile);
-  const char *hostname = connssl->hostname;
-  const bool verifypeer = conn_config->verifypeer;
-  const bool verifyhost = conn_config->verifyhost;
-  CURLcode ret;
-  unsigned version_min, version_max;
-  int session_set = 0;
-#ifdef ENABLE_IPV6
-  struct in6_addr addr;
-#else
-  struct in_addr addr;
-#endif
-
-  DEBUGASSERT(backend);
-  CURL_TRC_CF(data, cf, "connect_step1");
-
-  switch(conn_config->version) {
-  case CURL_SSLVERSION_SSLv2:
-    failf(data, "BearSSL does not support SSLv2");
-    return CURLE_SSL_CONNECT_ERROR;
-  case CURL_SSLVERSION_SSLv3:
-    failf(data, "BearSSL does not support SSLv3");
-    return CURLE_SSL_CONNECT_ERROR;
-  case CURL_SSLVERSION_TLSv1_0:
-    version_min = BR_TLS10;
-    version_max = BR_TLS10;
-    break;
-  case CURL_SSLVERSION_TLSv1_1:
-    version_min = BR_TLS11;
-    version_max = BR_TLS11;
-    break;
-  case CURL_SSLVERSION_TLSv1_2:
-    version_min = BR_TLS12;
-    version_max = BR_TLS12;
-    break;
-  case CURL_SSLVERSION_DEFAULT:
-  case CURL_SSLVERSION_TLSv1:
-    version_min = BR_TLS10;
-    version_max = BR_TLS12;
-    break;
-  default:
-    failf(data, "BearSSL: unknown CURLOPT_SSLVERSION");
-    return CURLE_SSL_CONNECT_ERROR;
-  }
-
-  if(verifypeer) {
-    if(ca_info_blob) {
-      struct cafile_source source;
-      source.type = CAFILE_SOURCE_BLOB;
-      source.data = ca_info_blob->data;
-      source.len = ca_info_blob->len;
-
-      CURL_TRC_CF(data, cf, "connect_step1, load ca_info_blob");
-      ret = load_cafile(&source, &backend->anchors, &backend->anchors_len);
-      if(ret != CURLE_OK) {
-        failf(data, "error importing CA certificate blob");
-        return ret;
-      }
-    }
-
-    if(ssl_cafile) {
-      struct cafile_source source;
-      source.type = CAFILE_SOURCE_PATH;
-      source.data = ssl_cafile;
-      source.len = 0;
-
-      CURL_TRC_CF(data, cf, "connect_step1, load cafile");
-      ret = load_cafile(&source, &backend->anchors, &backend->anchors_len);
-      if(ret != CURLE_OK) {
-        failf(data, "error setting certificate verify locations."
-              " CAfile: %s", ssl_cafile);
-        return ret;
-      }
-    }
-  }
-
-  /* initialize SSL context */
-  br_ssl_client_init_full(&backend->ctx, &backend->x509.minimal,
-                          backend->anchors, backend->anchors_len);
-  br_ssl_engine_set_versions(&backend->ctx.eng, version_min, version_max);
-  br_ssl_engine_set_buffer(&backend->ctx.eng, backend->buf,
-                           sizeof(backend->buf), 1);
-
-  if(conn_config->cipher_list) {
-    /* Override the ciphers as specified. For the default cipher list see the
-       BearSSL source code of br_ssl_client_init_full() */
-    CURL_TRC_CF(data, cf, "connect_step1, set ciphers");
-    ret = bearssl_set_selected_ciphers(data, &backend->ctx.eng,
-                                       conn_config->cipher_list);
-    if(ret)
-      return ret;
-  }
-
-  /* initialize X.509 context */
-  backend->x509.vtable = &x509_vtable;
-  backend->x509.verifypeer = verifypeer;
-  backend->x509.verifyhost = verifyhost;
-  br_ssl_engine_set_x509(&backend->ctx.eng, &backend->x509.vtable);
-
-  if(ssl_config->primary.sessionid) {
-    void *session;
-
-    CURL_TRC_CF(data, cf, "connect_step1, check session cache");
-    Curl_ssl_sessionid_lock(data);
-    if(!Curl_ssl_getsessionid(cf, data, &session, NULL)) {
-      br_ssl_engine_set_session_parameters(&backend->ctx.eng, session);
-      session_set = 1;
-      infof(data, "BearSSL: reusing session ID");
-    }
-    Curl_ssl_sessionid_unlock(data);
-  }
-
-  if(connssl->alpn) {
-    struct alpn_proto_buf proto;
-    size_t i;
-
-    for(i = 0; i < connssl->alpn->count; ++i) {
-      backend->protocols[i] = connssl->alpn->entries[i];
-    }
-    br_ssl_engine_set_protocol_names(&backend->ctx.eng, backend->protocols,
-                                     connssl->alpn->count);
-    Curl_alpn_to_proto_str(&proto, connssl->alpn);
-    infof(data, VTLS_INFOF_ALPN_OFFER_1STR, proto.data);
-  }
-
-  if((1 == Curl_inet_pton(AF_INET, hostname, &addr))
-#ifdef ENABLE_IPV6
-      || (1 == Curl_inet_pton(AF_INET6, hostname, &addr))
-#endif
-     ) {
-    if(verifyhost) {
-      failf(data, "BearSSL: "
-            "host verification of IP address is not supported");
-      return CURLE_PEER_FAILED_VERIFICATION;
-    }
-    hostname = NULL;
-  }
-  else {
-    char *snihost = Curl_ssl_snihost(data, hostname, NULL);
-    if(!snihost) {
-      failf(data, "Failed to set SNI");
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-    hostname = snihost;
-    CURL_TRC_CF(data, cf, "connect_step1, SNI set");
-  }
-
-  /* give application a chance to interfere with SSL set up. */
-  if(data->set.ssl.fsslctx) {
-    Curl_set_in_callback(data, true);
-    ret = (*data->set.ssl.fsslctx)(data, &backend->ctx,
-                                   data->set.ssl.fsslctxp);
-    Curl_set_in_callback(data, false);
-    if(ret) {
-      failf(data, "BearSSL: error signaled by ssl ctx callback");
-      return ret;
-    }
-  }
-
-  if(!br_ssl_client_reset(&backend->ctx, hostname, session_set))
-    return CURLE_FAILED_INIT;
-  backend->active = TRUE;
-
-  connssl->connecting_state = ssl_connect_2;
-
-  return CURLE_OK;
-}
-
-static int bearssl_get_select_socks(struct Curl_cfilter *cf,
-                                    struct Curl_easy *data,
-                                    curl_socket_t *socks)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  curl_socket_t sock = Curl_conn_cf_get_socket(cf->next, data);
-
-  if(sock == CURL_SOCKET_BAD)
-    return GETSOCK_BLANK;
-  else {
-    struct bearssl_ssl_backend_data *backend =
-      (struct bearssl_ssl_backend_data *)connssl->backend;
-    unsigned state = br_ssl_engine_current_state(&backend->ctx.eng);
-    if(state & BR_SSL_SENDREC) {
-      socks[0] = sock;
-      return GETSOCK_WRITESOCK(0);
-    }
-  }
-  socks[0] = sock;
-  return GETSOCK_READSOCK(0);
-}
-
-static CURLcode bearssl_run_until(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  unsigned target)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct bearssl_ssl_backend_data *backend =
-    (struct bearssl_ssl_backend_data *)connssl->backend;
-  unsigned state;
-  unsigned char *buf;
-  size_t len;
-  ssize_t ret;
-  CURLcode result;
-  int err;
-
-  DEBUGASSERT(backend);
-
-  for(;;) {
-    state = br_ssl_engine_current_state(&backend->ctx.eng);
-    if(state & BR_SSL_CLOSED) {
-      err = br_ssl_engine_last_error(&backend->ctx.eng);
-      switch(err) {
-      case BR_ERR_OK:
-        /* TLS close notify */
-        if(connssl->state != ssl_connection_complete) {
-          failf(data, "SSL: connection closed during handshake");
-          return CURLE_SSL_CONNECT_ERROR;
-        }
-        return CURLE_OK;
-      case BR_ERR_X509_EXPIRED:
-        failf(data, "SSL: X.509 verification: "
-              "certificate is expired or not yet valid");
-        return CURLE_PEER_FAILED_VERIFICATION;
-      case BR_ERR_X509_BAD_SERVER_NAME:
-        failf(data, "SSL: X.509 verification: "
-              "expected server name was not found in the chain");
-        return CURLE_PEER_FAILED_VERIFICATION;
-      case BR_ERR_X509_NOT_TRUSTED:
-        failf(data, "SSL: X.509 verification: "
-              "chain could not be linked to a trust anchor");
-        return CURLE_PEER_FAILED_VERIFICATION;
-      }
-      /* X.509 errors are documented to have the range 32..63 */
-      if(err >= 32 && err < 64)
-        return CURLE_PEER_FAILED_VERIFICATION;
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-    if(state & target)
-      return CURLE_OK;
-    if(state & BR_SSL_SENDREC) {
-      buf = br_ssl_engine_sendrec_buf(&backend->ctx.eng, &len);
-      ret = Curl_conn_cf_send(cf->next, data, (char *)buf, len, &result);
-      CURL_TRC_CF(data, cf, "ssl_send(len=%zu) -> %zd, %d", len, ret, result);
-      if(ret <= 0) {
-        return result;
-      }
-      br_ssl_engine_sendrec_ack(&backend->ctx.eng, ret);
-    }
-    else if(state & BR_SSL_RECVREC) {
-      buf = br_ssl_engine_recvrec_buf(&backend->ctx.eng, &len);
-      ret = Curl_conn_cf_recv(cf->next, data, (char *)buf, len, &result);
-      CURL_TRC_CF(data, cf, "ssl_recv(len=%zu) -> %zd, %d", len, ret, result);
-      if(ret == 0) {
-        failf(data, "SSL: EOF without close notify");
-        return CURLE_READ_ERROR;
-      }
-      if(ret <= 0) {
-        return result;
-      }
-      br_ssl_engine_recvrec_ack(&backend->ctx.eng, ret);
-    }
-  }
-}
-
-static CURLcode bearssl_connect_step2(struct Curl_cfilter *cf,
-                                      struct Curl_easy *data)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct bearssl_ssl_backend_data *backend =
-    (struct bearssl_ssl_backend_data *)connssl->backend;
-  CURLcode ret;
-
-  DEBUGASSERT(backend);
-  CURL_TRC_CF(data, cf, "connect_step2");
-
-  ret = bearssl_run_until(cf, data, BR_SSL_SENDAPP | BR_SSL_RECVAPP);
-  if(ret == CURLE_AGAIN)
-    return CURLE_OK;
-  if(ret == CURLE_OK) {
-    unsigned int tver;
-    if(br_ssl_engine_current_state(&backend->ctx.eng) == BR_SSL_CLOSED) {
-      failf(data, "SSL: connection closed during handshake");
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-    connssl->connecting_state = ssl_connect_3;
-    /* Informational message */
-    tver = br_ssl_engine_get_version(&backend->ctx.eng);
-    if(tver == 0x0303)
-      infof(data, "SSL connection using TLSv1.2");
-    else if(tver == 0x0304)
-      infof(data, "SSL connection using TLSv1.3");
-    else
-      infof(data, "SSL connection using TLS 0x%x", tver);
-  }
-  return ret;
-}
-
-static CURLcode bearssl_connect_step3(struct Curl_cfilter *cf,
-                                      struct Curl_easy *data)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct bearssl_ssl_backend_data *backend =
-    (struct bearssl_ssl_backend_data *)connssl->backend;
-  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
-  CURLcode ret;
-
-  DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);
-  DEBUGASSERT(backend);
-  CURL_TRC_CF(data, cf, "connect_step3");
-
-  if(connssl->alpn) {
-    const char *proto;
-
-    proto = br_ssl_engine_get_selected_protocol(&backend->ctx.eng);
-    Curl_alpn_set_negotiated(cf, data, (const unsigned char *)proto,
-                             proto? strlen(proto) : 0);
-  }
-
-  if(ssl_config->primary.sessionid) {
-    bool incache;
-    bool added = FALSE;
-    void *oldsession;
-    br_ssl_session_parameters *session;
-
-    session = malloc(sizeof(*session));
-    if(!session)
-      return CURLE_OUT_OF_MEMORY;
-    br_ssl_engine_get_session_parameters(&backend->ctx.eng, session);
-    Curl_ssl_sessionid_lock(data);
-    incache = !(Curl_ssl_getsessionid(cf, data, &oldsession, NULL));
-    if(incache)
-      Curl_ssl_delsessionid(data, oldsession);
-    ret = Curl_ssl_addsessionid(cf, data, session, 0, &added);
-    Curl_ssl_sessionid_unlock(data);
-    if(!added)
-      free(session);
-    if(ret) {
-      return CURLE_OUT_OF_MEMORY;
-    }
-  }
-
-  connssl->connecting_state = ssl_connect_done;
-
-  return CURLE_OK;
-}
-
-static ssize_t bearssl_send(struct Curl_cfilter *cf, struct Curl_easy *data,
-                            const void *buf, size_t len, CURLcode *err)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct bearssl_ssl_backend_data *backend =
-    (struct bearssl_ssl_backend_data *)connssl->backend;
-  unsigned char *app;
-  size_t applen;
-
-  DEBUGASSERT(backend);
-
-  for(;;) {
-    *err = bearssl_run_until(cf, data, BR_SSL_SENDAPP);
-    if(*err)
-      return -1;
-    app = br_ssl_engine_sendapp_buf(&backend->ctx.eng, &applen);
-    if(!app) {
-      failf(data, "SSL: connection closed during write");
-      *err = CURLE_SEND_ERROR;
-      return -1;
-    }
-    if(backend->pending_write) {
-      applen = backend->pending_write;
-      backend->pending_write = 0;
-      return applen;
-    }
-    if(applen > len)
-      applen = len;
-    memcpy(app, buf, applen);
-    br_ssl_engine_sendapp_ack(&backend->ctx.eng, applen);
-    br_ssl_engine_flush(&backend->ctx.eng, 0);
-    backend->pending_write = applen;
-  }
-}
-
-static ssize_t bearssl_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
-                            char *buf, size_t len, CURLcode *err)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct bearssl_ssl_backend_data *backend =
-    (struct bearssl_ssl_backend_data *)connssl->backend;
-  unsigned char *app;
-  size_t applen;
-
-  DEBUGASSERT(backend);
-
-  *err = bearssl_run_until(cf, data, BR_SSL_RECVAPP);
-  if(*err != CURLE_OK)
-    return -1;
-  app = br_ssl_engine_recvapp_buf(&backend->ctx.eng, &applen);
-  if(!app)
-    return 0;
-  if(applen > len)
-    applen = len;
-  memcpy(buf, app, applen);
-  br_ssl_engine_recvapp_ack(&backend->ctx.eng, applen);
-
-  return applen;
-}
-
-static CURLcode bearssl_connect_common(struct Curl_cfilter *cf,
-                                       struct Curl_easy *data,
-                                       bool nonblocking,
-                                       bool *done)
-{
-  CURLcode ret;
-  struct ssl_connect_data *connssl = cf->ctx;
-  curl_socket_t sockfd = Curl_conn_cf_get_socket(cf, data);
-  timediff_t timeout_ms;
-  int what;
-
-  CURL_TRC_CF(data, cf, "connect_common(blocking=%d)", !nonblocking);
-  /* check if the connection has already been established */
-  if(ssl_connection_complete == connssl->state) {
-    CURL_TRC_CF(data, cf, "connect_common, connected");
-    *done = TRUE;
-    return CURLE_OK;
-  }
-
-  if(ssl_connect_1 == connssl->connecting_state) {
-    ret = bearssl_connect_step1(cf, data);
-    if(ret)
-      return ret;
-  }
-
-  while(ssl_connect_2 == connssl->connecting_state ||
-        ssl_connect_2_reading == connssl->connecting_state ||
-        ssl_connect_2_writing == connssl->connecting_state) {
-    /* check allowed time left */
-    timeout_ms = Curl_timeleft(data, NULL, TRUE);
-
-    if(timeout_ms < 0) {
-      /* no need to continue if time already is up */
-      failf(data, "SSL connection timeout");
-      return CURLE_OPERATION_TIMEDOUT;
-    }
-
-    /* if ssl is expecting something, check if it's available. */
-    if(ssl_connect_2_reading == connssl->connecting_state ||
-       ssl_connect_2_writing == connssl->connecting_state) {
-
-      curl_socket_t writefd = ssl_connect_2_writing ==
-        connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
-      curl_socket_t readfd = ssl_connect_2_reading ==
-        connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
-
-      CURL_TRC_CF(data, cf, "connect_common, check socket");
-      what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd,
-                               nonblocking?0:timeout_ms);
-      CURL_TRC_CF(data, cf, "connect_common, check socket -> %d", what);
-      if(what < 0) {
-        /* fatal error */
-        failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
-        return CURLE_SSL_CONNECT_ERROR;
-      }
-      else if(0 == what) {
-        if(nonblocking) {
-          *done = FALSE;
-          return CURLE_OK;
-        }
-        else {
-          /* timeout */
-          failf(data, "SSL connection timeout");
-          return CURLE_OPERATION_TIMEDOUT;
-        }
-      }
-      /* socket is readable or writable */
-    }
-
-    /* Run transaction, and return to the caller if it failed or if this
-     * connection is done nonblocking and this loop would execute again. This
-     * permits the owner of a multi handle to abort a connection attempt
-     * before step2 has completed while ensuring that a client using select()
-     * or epoll() will always have a valid fdset to wait on.
-     */
-    ret = bearssl_connect_step2(cf, data);
-    if(ret || (nonblocking &&
-               (ssl_connect_2 == connssl->connecting_state ||
-                ssl_connect_2_reading == connssl->connecting_state ||
-                ssl_connect_2_writing == connssl->connecting_state)))
-      return ret;
-  }
-
-  if(ssl_connect_3 == connssl->connecting_state) {
-    ret = bearssl_connect_step3(cf, data);
-    if(ret)
-      return ret;
-  }
-
-  if(ssl_connect_done == connssl->connecting_state) {
-    connssl->state = ssl_connection_complete;
-    *done = TRUE;
-  }
-  else
-    *done = FALSE;
-
-  /* Reset our connect state machine */
-  connssl->connecting_state = ssl_connect_1;
-
-  return CURLE_OK;
-}
-
-static size_t bearssl_version(char *buffer, size_t size)
-{
-  return msnprintf(buffer, size, "BearSSL");
-}
-
-static bool bearssl_data_pending(struct Curl_cfilter *cf,
-                                 const struct Curl_easy *data)
-{
-  struct ssl_connect_data *ctx = cf->ctx;
-  struct bearssl_ssl_backend_data *backend;
-
-  (void)data;
-  DEBUGASSERT(ctx && ctx->backend);
-  backend = (struct bearssl_ssl_backend_data *)ctx->backend;
-  return br_ssl_engine_current_state(&backend->ctx.eng) & BR_SSL_RECVAPP;
-}
-
-static CURLcode bearssl_random(struct Curl_easy *data UNUSED_PARAM,
-                               unsigned char *entropy, size_t length)
-{
-  static br_hmac_drbg_context ctx;
-  static bool seeded = FALSE;
-
-  if(!seeded) {
-    br_prng_seeder seeder;
-
-    br_hmac_drbg_init(&ctx, &br_sha256_vtable, NULL, 0);
-    seeder = br_prng_seeder_system(NULL);
-    if(!seeder || !seeder(&ctx.vtable))
-      return CURLE_FAILED_INIT;
-    seeded = TRUE;
-  }
-  br_hmac_drbg_generate(&ctx, entropy, length);
-
-  return CURLE_OK;
-}
-
-static CURLcode bearssl_connect(struct Curl_cfilter *cf,
-                                struct Curl_easy *data)
-{
-  CURLcode ret;
-  bool done = FALSE;
-
-  ret = bearssl_connect_common(cf, data, FALSE, &done);
-  if(ret)
-    return ret;
-
-  DEBUGASSERT(done);
-
-  return CURLE_OK;
-}
-
-static CURLcode bearssl_connect_nonblocking(struct Curl_cfilter *cf,
-                                            struct Curl_easy *data,
-                                            bool *done)
-{
-  return bearssl_connect_common(cf, data, TRUE, done);
-}
-
-static void *bearssl_get_internals(struct ssl_connect_data *connssl,
-                                   CURLINFO info UNUSED_PARAM)
-{
-  struct bearssl_ssl_backend_data *backend =
-    (struct bearssl_ssl_backend_data *)connssl->backend;
-  DEBUGASSERT(backend);
-  return &backend->ctx;
-}
-
-static void bearssl_close(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct bearssl_ssl_backend_data *backend =
-    (struct bearssl_ssl_backend_data *)connssl->backend;
-  size_t i;
-
-  DEBUGASSERT(backend);
-
-  if(backend->active) {
-    backend->active = FALSE;
-    br_ssl_engine_close(&backend->ctx.eng);
-    (void)bearssl_run_until(cf, data, BR_SSL_CLOSED);
-  }
-  if(backend->anchors) {
-    for(i = 0; i < backend->anchors_len; ++i)
-      free(backend->anchors[i].dn.data);
-    Curl_safefree(backend->anchors);
-  }
-}
-
-static void bearssl_session_free(void *ptr)
-{
-  free(ptr);
-}
-
-static CURLcode bearssl_sha256sum(const unsigned char *input,
-                                  size_t inputlen,
-                                  unsigned char *sha256sum,
-                                  size_t sha256len UNUSED_PARAM)
-{
-  br_sha256_context ctx;
-
-  br_sha256_init(&ctx);
-  br_sha256_update(&ctx, input, inputlen);
-  br_sha256_out(&ctx, sha256sum);
-  return CURLE_OK;
-}
-
-const struct Curl_ssl Curl_ssl_bearssl = {
-  { CURLSSLBACKEND_BEARSSL, "bearssl" }, /* info */
-  SSLSUPP_CAINFO_BLOB | SSLSUPP_SSL_CTX | SSLSUPP_HTTPS_PROXY,
-  sizeof(struct bearssl_ssl_backend_data),
-
-  Curl_none_init,                  /* init */
-  Curl_none_cleanup,               /* cleanup */
-  bearssl_version,                 /* version */
-  Curl_none_check_cxn,             /* check_cxn */
-  Curl_none_shutdown,              /* shutdown */
-  bearssl_data_pending,            /* data_pending */
-  bearssl_random,                  /* random */
-  Curl_none_cert_status_request,   /* cert_status_request */
-  bearssl_connect,                 /* connect */
-  bearssl_connect_nonblocking,     /* connect_nonblocking */
-  bearssl_get_select_socks,        /* getsock */
-  bearssl_get_internals,           /* get_internals */
-  bearssl_close,                   /* close_one */
-  Curl_none_close_all,             /* close_all */
-  bearssl_session_free,            /* session_free */
-  Curl_none_set_engine,            /* set_engine */
-  Curl_none_set_engine_default,    /* set_engine_default */
-  Curl_none_engines_list,          /* engines_list */
-  Curl_none_false_start,           /* false_start */
-  bearssl_sha256sum,               /* sha256sum */
-  NULL,                            /* associate_connection */
-  NULL,                            /* disassociate_connection */
-  NULL,                            /* free_multi_ssl_backend_data */
-  bearssl_recv,                    /* recv decrypted data */
-  bearssl_send,                    /* send data to encrypt */
-};
-
-#endif /* USE_BEARSSL */
diff --git a/third-party/curl/lib/vtls/bearssl.h b/third-party/curl/lib/vtls/bearssl.h
deleted file mode 100644
index b3651b092c..0000000000
--- a/third-party/curl/lib/vtls/bearssl.h
+++ /dev/null
@@ -1,34 +0,0 @@
-#ifndef HEADER_CURL_BEARSSL_H
-#define HEADER_CURL_BEARSSL_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Michael Forney, <mforney@mforney.org>
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#ifdef USE_BEARSSL
-
-extern const struct Curl_ssl Curl_ssl_bearssl;
-
-#endif /* USE_BEARSSL */
-#endif /* HEADER_CURL_BEARSSL_H */
diff --git a/third-party/curl/lib/vtls/cipher_suite.c b/third-party/curl/lib/vtls/cipher_suite.c
new file mode 100644
index 0000000000..197055fc0d
--- /dev/null
+++ b/third-party/curl/lib/vtls/cipher_suite.c
@@ -0,0 +1,702 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Jan Venekamp, <jan@venekamp.net>
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#if defined(USE_MBEDTLS) || defined(USE_RUSTLS)
+
+#include "vtls/cipher_suite.h"
+
+/*
+ * To support the CURLOPT_SSL_CIPHER_LIST option on SSL backends
+ * that do not support it natively, but do support setting a list of
+ * IANA ids, we need a list of all supported cipher suite names
+ * (OpenSSL and IANA) to be able to look up the IANA ids.
+ *
+ * To keep the binary size of this list down we compress each entry
+ * down to 2 + 6 bytes using the C preprocessor.
+ */
+
+/*
+ * mbedTLS NOTE: mbedTLS has mbedtls_ssl_get_ciphersuite_id() to
+ * convert a string representation to an IANA id, we do not use that
+ * because it does not support "standard" OpenSSL cipher suite
+ * names, nor IANA names.
+ */
+
+/* NOTE: also see tests/unit/unit3205.c */
+
+/* Text for cipher suite parts (max 64 entries),
+   keep indexes below in sync with this! */
+static const char *cs_txt =
+  "\0"
+  "TLS" "\0"
+  "WITH" "\0"
+  "128" "\0"
+  "256" "\0"
+  "3DES" "\0"
+  "8" "\0"
+  "AES" "\0"
+  "AES128" "\0"
+  "AES256" "\0"
+  "CBC" "\0"
+  "CBC3" "\0"
+  "CCM" "\0"
+  "CCM8" "\0"
+  "CHACHA20" "\0"
+  "DES" "\0"
+  "DHE" "\0"
+  "ECDH" "\0"
+  "ECDHE" "\0"
+  "ECDSA" "\0"
+  "EDE" "\0" /* spellchecker:disable-line */
+  "GCM" "\0"
+  "MD5" "\0"
+  "NULL" "\0"
+  "POLY1305" "\0"
+  "PSK" "\0"
+  "RSA" "\0"
+  "SHA" "\0"
+  "SHA256" "\0"
+  "SHA384" "\0"
+#ifdef USE_MBEDTLS
+  "ARIA" "\0"
+  "ARIA128" "\0"
+  "ARIA256" "\0"
+  "CAMELLIA" "\0"
+  "CAMELLIA128" "\0"
+  "CAMELLIA256" "\0"
+#endif
+;
+/* Indexes of above cs_txt */
+enum {
+  CS_TXT_IDX_,
+  CS_TXT_IDX_TLS,
+  CS_TXT_IDX_WITH,
+  CS_TXT_IDX_128,
+  CS_TXT_IDX_256,
+  CS_TXT_IDX_3DES,
+  CS_TXT_IDX_8,
+  CS_TXT_IDX_AES,
+  CS_TXT_IDX_AES128,
+  CS_TXT_IDX_AES256,
+  CS_TXT_IDX_CBC,
+  CS_TXT_IDX_CBC3,
+  CS_TXT_IDX_CCM,
+  CS_TXT_IDX_CCM8,
+  CS_TXT_IDX_CHACHA20,
+  CS_TXT_IDX_DES,
+  CS_TXT_IDX_DHE,
+  CS_TXT_IDX_ECDH,
+  CS_TXT_IDX_ECDHE,
+  CS_TXT_IDX_ECDSA,
+  CS_TXT_IDX_EDE, /* spellchecker:disable-line */
+  CS_TXT_IDX_GCM,
+  CS_TXT_IDX_MD5,
+  CS_TXT_IDX_NULL,
+  CS_TXT_IDX_POLY1305,
+  CS_TXT_IDX_PSK,
+  CS_TXT_IDX_RSA,
+  CS_TXT_IDX_SHA,
+  CS_TXT_IDX_SHA256,
+  CS_TXT_IDX_SHA384,
+#ifdef USE_MBEDTLS
+  CS_TXT_IDX_ARIA,
+  CS_TXT_IDX_ARIA128,
+  CS_TXT_IDX_ARIA256,
+  CS_TXT_IDX_CAMELLIA,
+  CS_TXT_IDX_CAMELLIA128,
+  CS_TXT_IDX_CAMELLIA256,
+#endif
+  CS_TXT_LEN,
+};
+
+#define CS_ZIP_IDX(a, b, c, d, e, f, g, h)            \
+{                                                     \
+  (uint8_t)((((a) << 2) & 0xFF) | ((b) & 0x3F) >> 4), \
+  (uint8_t)((((b) << 4) & 0xFF) | ((c) & 0x3F) >> 2), \
+  (uint8_t)((((c) << 6) & 0xFF) | ((d) & 0x3F)),      \
+  (uint8_t)((((e) << 2) & 0xFF) | ((f) & 0x3F) >> 4), \
+  (uint8_t)((((f) << 4) & 0xFF) | ((g) & 0x3F) >> 2), \
+  (uint8_t)((((g) << 6) & 0xFF) | ((h) & 0x3F))       \
+}
+#define CS_ENTRY(id, a, b, c, d, e, f, g, h) \
+{                                            \
+  id,                                        \
+  CS_ZIP_IDX(                                \
+    CS_TXT_IDX_ ## a, CS_TXT_IDX_ ## b,      \
+    CS_TXT_IDX_ ## c, CS_TXT_IDX_ ## d,      \
+    CS_TXT_IDX_ ## e, CS_TXT_IDX_ ## f,      \
+    CS_TXT_IDX_ ## g, CS_TXT_IDX_ ## h       \
+  )                                          \
+}
+
+struct cs_entry {
+  uint16_t id;
+  uint8_t zip[6];
+};
+
+/* !checksrc! disable COMMANOSPACE all */
+static const struct cs_entry cs_list[] = {
+  /* TLS 1.3 ciphers */
+  CS_ENTRY(0x1301, TLS,AES,128,GCM,SHA256,,,),
+  CS_ENTRY(0x1302, TLS,AES,256,GCM,SHA384,,,),
+  CS_ENTRY(0x1303, TLS,CHACHA20,POLY1305,SHA256,,,,),
+  CS_ENTRY(0x1304, TLS,AES,128,CCM,SHA256,,,),
+  CS_ENTRY(0x1305, TLS,AES,128,CCM,8,SHA256,,),
+  /* TLS 1.2 ciphers */
+  CS_ENTRY(0xC02B, TLS,ECDHE,ECDSA,WITH,AES,128,GCM,SHA256),
+  CS_ENTRY(0xC02B, ECDHE,ECDSA,AES128,GCM,SHA256,,,),
+  CS_ENTRY(0xC02C, TLS,ECDHE,ECDSA,WITH,AES,256,GCM,SHA384),
+  CS_ENTRY(0xC02C, ECDHE,ECDSA,AES256,GCM,SHA384,,,),
+  CS_ENTRY(0xC02F, TLS,ECDHE,RSA,WITH,AES,128,GCM,SHA256),
+  CS_ENTRY(0xC02F, ECDHE,RSA,AES128,GCM,SHA256,,,),
+  CS_ENTRY(0xC030, TLS,ECDHE,RSA,WITH,AES,256,GCM,SHA384),
+  CS_ENTRY(0xC030, ECDHE,RSA,AES256,GCM,SHA384,,,),
+  CS_ENTRY(0xCCA8, TLS,ECDHE,RSA,WITH,CHACHA20,POLY1305,SHA256,),
+  CS_ENTRY(0xCCA8, ECDHE,RSA,CHACHA20,POLY1305,,,,),
+  CS_ENTRY(0xCCA9, TLS,ECDHE,ECDSA,WITH,CHACHA20,POLY1305,SHA256,),
+  CS_ENTRY(0xCCA9, ECDHE,ECDSA,CHACHA20,POLY1305,,,,),
+#ifdef USE_MBEDTLS
+  CS_ENTRY(0x002F, TLS,RSA,WITH,AES,128,CBC,SHA,),
+  CS_ENTRY(0x002F, AES128,SHA,,,,,,),
+  CS_ENTRY(0x0035, TLS,RSA,WITH,AES,256,CBC,SHA,),
+  CS_ENTRY(0x0035, AES256,SHA,,,,,,),
+  CS_ENTRY(0x003C, TLS,RSA,WITH,AES,128,CBC,SHA256,),
+  CS_ENTRY(0x003C, AES128,SHA256,,,,,,),
+  CS_ENTRY(0x003D, TLS,RSA,WITH,AES,256,CBC,SHA256,),
+  CS_ENTRY(0x003D, AES256,SHA256,,,,,,),
+  CS_ENTRY(0x009C, TLS,RSA,WITH,AES,128,GCM,SHA256,),
+  CS_ENTRY(0x009C, AES128,GCM,SHA256,,,,,),
+  CS_ENTRY(0x009D, TLS,RSA,WITH,AES,256,GCM,SHA384,),
+  CS_ENTRY(0x009D, AES256,GCM,SHA384,,,,,),
+  CS_ENTRY(0xC004, TLS,ECDH,ECDSA,WITH,AES,128,CBC,SHA),
+  CS_ENTRY(0xC004, ECDH,ECDSA,AES128,SHA,,,,),
+  CS_ENTRY(0xC005, TLS,ECDH,ECDSA,WITH,AES,256,CBC,SHA),
+  CS_ENTRY(0xC005, ECDH,ECDSA,AES256,SHA,,,,),
+  CS_ENTRY(0xC009, TLS,ECDHE,ECDSA,WITH,AES,128,CBC,SHA),
+  CS_ENTRY(0xC009, ECDHE,ECDSA,AES128,SHA,,,,),
+  CS_ENTRY(0xC00A, TLS,ECDHE,ECDSA,WITH,AES,256,CBC,SHA),
+  CS_ENTRY(0xC00A, ECDHE,ECDSA,AES256,SHA,,,,),
+  CS_ENTRY(0xC00E, TLS,ECDH,RSA,WITH,AES,128,CBC,SHA),
+  CS_ENTRY(0xC00E, ECDH,RSA,AES128,SHA,,,,),
+  CS_ENTRY(0xC00F, TLS,ECDH,RSA,WITH,AES,256,CBC,SHA),
+  CS_ENTRY(0xC00F, ECDH,RSA,AES256,SHA,,,,),
+  CS_ENTRY(0xC013, TLS,ECDHE,RSA,WITH,AES,128,CBC,SHA),
+  CS_ENTRY(0xC013, ECDHE,RSA,AES128,SHA,,,,),
+  CS_ENTRY(0xC014, TLS,ECDHE,RSA,WITH,AES,256,CBC,SHA),
+  CS_ENTRY(0xC014, ECDHE,RSA,AES256,SHA,,,,),
+  CS_ENTRY(0xC023, TLS,ECDHE,ECDSA,WITH,AES,128,CBC,SHA256),
+  CS_ENTRY(0xC023, ECDHE,ECDSA,AES128,SHA256,,,,),
+  CS_ENTRY(0xC024, TLS,ECDHE,ECDSA,WITH,AES,256,CBC,SHA384),
+  CS_ENTRY(0xC024, ECDHE,ECDSA,AES256,SHA384,,,,),
+  CS_ENTRY(0xC025, TLS,ECDH,ECDSA,WITH,AES,128,CBC,SHA256),
+  CS_ENTRY(0xC025, ECDH,ECDSA,AES128,SHA256,,,,),
+  CS_ENTRY(0xC026, TLS,ECDH,ECDSA,WITH,AES,256,CBC,SHA384),
+  CS_ENTRY(0xC026, ECDH,ECDSA,AES256,SHA384,,,,),
+  CS_ENTRY(0xC027, TLS,ECDHE,RSA,WITH,AES,128,CBC,SHA256),
+  CS_ENTRY(0xC027, ECDHE,RSA,AES128,SHA256,,,,),
+  CS_ENTRY(0xC028, TLS,ECDHE,RSA,WITH,AES,256,CBC,SHA384),
+  CS_ENTRY(0xC028, ECDHE,RSA,AES256,SHA384,,,,),
+  CS_ENTRY(0xC029, TLS,ECDH,RSA,WITH,AES,128,CBC,SHA256),
+  CS_ENTRY(0xC029, ECDH,RSA,AES128,SHA256,,,,),
+  CS_ENTRY(0xC02A, TLS,ECDH,RSA,WITH,AES,256,CBC,SHA384),
+  CS_ENTRY(0xC02A, ECDH,RSA,AES256,SHA384,,,,),
+  CS_ENTRY(0xC02D, TLS,ECDH,ECDSA,WITH,AES,128,GCM,SHA256),
+  CS_ENTRY(0xC02D, ECDH,ECDSA,AES128,GCM,SHA256,,,),
+  CS_ENTRY(0xC02E, TLS,ECDH,ECDSA,WITH,AES,256,GCM,SHA384),
+  CS_ENTRY(0xC02E, ECDH,ECDSA,AES256,GCM,SHA384,,,),
+  CS_ENTRY(0xC031, TLS,ECDH,RSA,WITH,AES,128,GCM,SHA256),
+  CS_ENTRY(0xC031, ECDH,RSA,AES128,GCM,SHA256,,,),
+  CS_ENTRY(0xC032, TLS,ECDH,RSA,WITH,AES,256,GCM,SHA384),
+  CS_ENTRY(0xC032, ECDH,RSA,AES256,GCM,SHA384,,,),
+  CS_ENTRY(0x0001, TLS,RSA,WITH,NULL,MD5,,,),
+  CS_ENTRY(0x0001, NULL,MD5,,,,,,),
+  CS_ENTRY(0x0002, TLS,RSA,WITH,NULL,SHA,,,),
+  CS_ENTRY(0x0002, NULL,SHA,,,,,,),
+  CS_ENTRY(0x002C, TLS,PSK,WITH,NULL,SHA,,,),
+  CS_ENTRY(0x002C, PSK,NULL,SHA,,,,,),
+  CS_ENTRY(0x002D, TLS,DHE,PSK,WITH,NULL,SHA,,),
+  CS_ENTRY(0x002D, DHE,PSK,NULL,SHA,,,,),
+  CS_ENTRY(0x002E, TLS,RSA,PSK,WITH,NULL,SHA,,),
+  CS_ENTRY(0x002E, RSA,PSK,NULL,SHA,,,,),
+  CS_ENTRY(0x0033, TLS,DHE,RSA,WITH,AES,128,CBC,SHA),
+  CS_ENTRY(0x0033, DHE,RSA,AES128,SHA,,,,),
+  CS_ENTRY(0x0039, TLS,DHE,RSA,WITH,AES,256,CBC,SHA),
+  CS_ENTRY(0x0039, DHE,RSA,AES256,SHA,,,,),
+  CS_ENTRY(0x003B, TLS,RSA,WITH,NULL,SHA256,,,),
+  CS_ENTRY(0x003B, NULL,SHA256,,,,,,),
+  CS_ENTRY(0x0067, TLS,DHE,RSA,WITH,AES,128,CBC,SHA256),
+  CS_ENTRY(0x0067, DHE,RSA,AES128,SHA256,,,,),
+  CS_ENTRY(0x006B, TLS,DHE,RSA,WITH,AES,256,CBC,SHA256),
+  CS_ENTRY(0x006B, DHE,RSA,AES256,SHA256,,,,),
+  CS_ENTRY(0x008C, TLS,PSK,WITH,AES,128,CBC,SHA,),
+  CS_ENTRY(0x008C, PSK,AES128,CBC,SHA,,,,),
+  CS_ENTRY(0x008D, TLS,PSK,WITH,AES,256,CBC,SHA,),
+  CS_ENTRY(0x008D, PSK,AES256,CBC,SHA,,,,),
+  CS_ENTRY(0x0090, TLS,DHE,PSK,WITH,AES,128,CBC,SHA),
+  CS_ENTRY(0x0090, DHE,PSK,AES128,CBC,SHA,,,),
+  CS_ENTRY(0x0091, TLS,DHE,PSK,WITH,AES,256,CBC,SHA),
+  CS_ENTRY(0x0091, DHE,PSK,AES256,CBC,SHA,,,),
+  CS_ENTRY(0x0094, TLS,RSA,PSK,WITH,AES,128,CBC,SHA),
+  CS_ENTRY(0x0094, RSA,PSK,AES128,CBC,SHA,,,),
+  CS_ENTRY(0x0095, TLS,RSA,PSK,WITH,AES,256,CBC,SHA),
+  CS_ENTRY(0x0095, RSA,PSK,AES256,CBC,SHA,,,),
+  CS_ENTRY(0x009E, TLS,DHE,RSA,WITH,AES,128,GCM,SHA256),
+  CS_ENTRY(0x009E, DHE,RSA,AES128,GCM,SHA256,,,),
+  CS_ENTRY(0x009F, TLS,DHE,RSA,WITH,AES,256,GCM,SHA384),
+  CS_ENTRY(0x009F, DHE,RSA,AES256,GCM,SHA384,,,),
+  CS_ENTRY(0x00A8, TLS,PSK,WITH,AES,128,GCM,SHA256,),
+  CS_ENTRY(0x00A8, PSK,AES128,GCM,SHA256,,,,),
+  CS_ENTRY(0x00A9, TLS,PSK,WITH,AES,256,GCM,SHA384,),
+  CS_ENTRY(0x00A9, PSK,AES256,GCM,SHA384,,,,),
+  CS_ENTRY(0x00AA, TLS,DHE,PSK,WITH,AES,128,GCM,SHA256),
+  CS_ENTRY(0x00AA, DHE,PSK,AES128,GCM,SHA256,,,),
+  CS_ENTRY(0x00AB, TLS,DHE,PSK,WITH,AES,256,GCM,SHA384),
+  CS_ENTRY(0x00AB, DHE,PSK,AES256,GCM,SHA384,,,),
+  CS_ENTRY(0x00AC, TLS,RSA,PSK,WITH,AES,128,GCM,SHA256),
+  CS_ENTRY(0x00AC, RSA,PSK,AES128,GCM,SHA256,,,),
+  CS_ENTRY(0x00AD, TLS,RSA,PSK,WITH,AES,256,GCM,SHA384),
+  CS_ENTRY(0x00AD, RSA,PSK,AES256,GCM,SHA384,,,),
+  CS_ENTRY(0x00AE, TLS,PSK,WITH,AES,128,CBC,SHA256,),
+  CS_ENTRY(0x00AE, PSK,AES128,CBC,SHA256,,,,),
+  CS_ENTRY(0x00AF, TLS,PSK,WITH,AES,256,CBC,SHA384,),
+  CS_ENTRY(0x00AF, PSK,AES256,CBC,SHA384,,,,),
+  CS_ENTRY(0x00B0, TLS,PSK,WITH,NULL,SHA256,,,),
+  CS_ENTRY(0x00B0, PSK,NULL,SHA256,,,,,),
+  CS_ENTRY(0x00B1, TLS,PSK,WITH,NULL,SHA384,,,),
+  CS_ENTRY(0x00B1, PSK,NULL,SHA384,,,,,),
+  CS_ENTRY(0x00B2, TLS,DHE,PSK,WITH,AES,128,CBC,SHA256),
+  CS_ENTRY(0x00B2, DHE,PSK,AES128,CBC,SHA256,,,),
+  CS_ENTRY(0x00B3, TLS,DHE,PSK,WITH,AES,256,CBC,SHA384),
+  CS_ENTRY(0x00B3, DHE,PSK,AES256,CBC,SHA384,,,),
+  CS_ENTRY(0x00B4, TLS,DHE,PSK,WITH,NULL,SHA256,,),
+  CS_ENTRY(0x00B4, DHE,PSK,NULL,SHA256,,,,),
+  CS_ENTRY(0x00B5, TLS,DHE,PSK,WITH,NULL,SHA384,,),
+  CS_ENTRY(0x00B5, DHE,PSK,NULL,SHA384,,,,),
+  CS_ENTRY(0x00B6, TLS,RSA,PSK,WITH,AES,128,CBC,SHA256),
+  CS_ENTRY(0x00B6, RSA,PSK,AES128,CBC,SHA256,,,),
+  CS_ENTRY(0x00B7, TLS,RSA,PSK,WITH,AES,256,CBC,SHA384),
+  CS_ENTRY(0x00B7, RSA,PSK,AES256,CBC,SHA384,,,),
+  CS_ENTRY(0x00B8, TLS,RSA,PSK,WITH,NULL,SHA256,,),
+  CS_ENTRY(0x00B8, RSA,PSK,NULL,SHA256,,,,),
+  CS_ENTRY(0x00B9, TLS,RSA,PSK,WITH,NULL,SHA384,,),
+  CS_ENTRY(0x00B9, RSA,PSK,NULL,SHA384,,,,),
+  CS_ENTRY(0xC001, TLS,ECDH,ECDSA,WITH,NULL,SHA,,),
+  CS_ENTRY(0xC001, ECDH,ECDSA,NULL,SHA,,,,),
+  CS_ENTRY(0xC006, TLS,ECDHE,ECDSA,WITH,NULL,SHA,,),
+  CS_ENTRY(0xC006, ECDHE,ECDSA,NULL,SHA,,,,),
+  CS_ENTRY(0xC00B, TLS,ECDH,RSA,WITH,NULL,SHA,,),
+  CS_ENTRY(0xC00B, ECDH,RSA,NULL,SHA,,,,),
+  CS_ENTRY(0xC010, TLS,ECDHE,RSA,WITH,NULL,SHA,,),
+  CS_ENTRY(0xC010, ECDHE,RSA,NULL,SHA,,,,),
+  CS_ENTRY(0xC035, TLS,ECDHE,PSK,WITH,AES,128,CBC,SHA),
+  CS_ENTRY(0xC035, ECDHE,PSK,AES128,CBC,SHA,,,),
+  CS_ENTRY(0xC036, TLS,ECDHE,PSK,WITH,AES,256,CBC,SHA),
+  CS_ENTRY(0xC036, ECDHE,PSK,AES256,CBC,SHA,,,),
+  CS_ENTRY(0xCCAB, TLS,PSK,WITH,CHACHA20,POLY1305,SHA256,,),
+  CS_ENTRY(0xCCAB, PSK,CHACHA20,POLY1305,,,,,),
+  CS_ENTRY(0xC09C, TLS,RSA,WITH,AES,128,CCM,,),
+  CS_ENTRY(0xC09C, AES128,CCM,,,,,,),
+  CS_ENTRY(0xC09D, TLS,RSA,WITH,AES,256,CCM,,),
+  CS_ENTRY(0xC09D, AES256,CCM,,,,,,),
+  CS_ENTRY(0xC0A0, TLS,RSA,WITH,AES,128,CCM,8,),
+  CS_ENTRY(0xC0A0, AES128,CCM8,,,,,,),
+  CS_ENTRY(0xC0A1, TLS,RSA,WITH,AES,256,CCM,8,),
+  CS_ENTRY(0xC0A1, AES256,CCM8,,,,,,),
+  CS_ENTRY(0xC0AC, TLS,ECDHE,ECDSA,WITH,AES,128,CCM,),
+  CS_ENTRY(0xC0AC, ECDHE,ECDSA,AES128,CCM,,,,),
+  CS_ENTRY(0xC0AD, TLS,ECDHE,ECDSA,WITH,AES,256,CCM,),
+  CS_ENTRY(0xC0AD, ECDHE,ECDSA,AES256,CCM,,,,),
+  CS_ENTRY(0xC0AE, TLS,ECDHE,ECDSA,WITH,AES,128,CCM,8),
+  CS_ENTRY(0xC0AE, ECDHE,ECDSA,AES128,CCM8,,,,),
+  CS_ENTRY(0xC0AF, TLS,ECDHE,ECDSA,WITH,AES,256,CCM,8),
+  CS_ENTRY(0xC0AF, ECDHE,ECDSA,AES256,CCM8,,,,),
+  /* entries marked ns are "non-standard", they are not in OpenSSL */
+  CS_ENTRY(0x0041, TLS,RSA,WITH,CAMELLIA,128,CBC,SHA,),
+  CS_ENTRY(0x0041, CAMELLIA128,SHA,,,,,,),
+  CS_ENTRY(0x0045, TLS,DHE,RSA,WITH,CAMELLIA,128,CBC,SHA),
+  CS_ENTRY(0x0045, DHE,RSA,CAMELLIA128,SHA,,,,),
+  CS_ENTRY(0x0084, TLS,RSA,WITH,CAMELLIA,256,CBC,SHA,),
+  CS_ENTRY(0x0084, CAMELLIA256,SHA,,,,,,),
+  CS_ENTRY(0x0088, TLS,DHE,RSA,WITH,CAMELLIA,256,CBC,SHA),
+  CS_ENTRY(0x0088, DHE,RSA,CAMELLIA256,SHA,,,,),
+  CS_ENTRY(0x00BA, TLS,RSA,WITH,CAMELLIA,128,CBC,SHA256,),
+  CS_ENTRY(0x00BA, CAMELLIA128,SHA256,,,,,,),
+  CS_ENTRY(0x00BE, TLS,DHE,RSA,WITH,CAMELLIA,128,CBC,SHA256),
+  CS_ENTRY(0x00BE, DHE,RSA,CAMELLIA128,SHA256,,,,),
+  CS_ENTRY(0x00C0, TLS,RSA,WITH,CAMELLIA,256,CBC,SHA256,),
+  CS_ENTRY(0x00C0, CAMELLIA256,SHA256,,,,,,),
+  CS_ENTRY(0x00C4, TLS,DHE,RSA,WITH,CAMELLIA,256,CBC,SHA256),
+  CS_ENTRY(0x00C4, DHE,RSA,CAMELLIA256,SHA256,,,,),
+  CS_ENTRY(0xC037, TLS,ECDHE,PSK,WITH,AES,128,CBC,SHA256),
+  CS_ENTRY(0xC037, ECDHE,PSK,AES128,CBC,SHA256,,,),
+  CS_ENTRY(0xC038, TLS,ECDHE,PSK,WITH,AES,256,CBC,SHA384),
+  CS_ENTRY(0xC038, ECDHE,PSK,AES256,CBC,SHA384,,,),
+  CS_ENTRY(0xC039, TLS,ECDHE,PSK,WITH,NULL,SHA,,),
+  CS_ENTRY(0xC039, ECDHE,PSK,NULL,SHA,,,,),
+  CS_ENTRY(0xC03A, TLS,ECDHE,PSK,WITH,NULL,SHA256,,),
+  CS_ENTRY(0xC03A, ECDHE,PSK,NULL,SHA256,,,,),
+  CS_ENTRY(0xC03B, TLS,ECDHE,PSK,WITH,NULL,SHA384,,),
+  CS_ENTRY(0xC03B, ECDHE,PSK,NULL,SHA384,,,,),
+  CS_ENTRY(0xC03C, TLS,RSA,WITH,ARIA,128,CBC,SHA256,),
+  CS_ENTRY(0xC03C, ARIA128,SHA256,,,,,,), /* ns */
+  CS_ENTRY(0xC03D, TLS,RSA,WITH,ARIA,256,CBC,SHA384,),
+  CS_ENTRY(0xC03D, ARIA256,SHA384,,,,,,), /* ns */
+  CS_ENTRY(0xC044, TLS,DHE,RSA,WITH,ARIA,128,CBC,SHA256),
+  CS_ENTRY(0xC044, DHE,RSA,ARIA128,SHA256,,,,), /* ns */
+  CS_ENTRY(0xC045, TLS,DHE,RSA,WITH,ARIA,256,CBC,SHA384),
+  CS_ENTRY(0xC045, DHE,RSA,ARIA256,SHA384,,,,), /* ns */
+  CS_ENTRY(0xC048, TLS,ECDHE,ECDSA,WITH,ARIA,128,CBC,SHA256),
+  CS_ENTRY(0xC048, ECDHE,ECDSA,ARIA128,SHA256,,,,), /* ns */
+  CS_ENTRY(0xC049, TLS,ECDHE,ECDSA,WITH,ARIA,256,CBC,SHA384),
+  CS_ENTRY(0xC049, ECDHE,ECDSA,ARIA256,SHA384,,,,), /* ns */
+  CS_ENTRY(0xC04A, TLS,ECDH,ECDSA,WITH,ARIA,128,CBC,SHA256),
+  CS_ENTRY(0xC04A, ECDH,ECDSA,ARIA128,SHA256,,,,), /* ns */
+  CS_ENTRY(0xC04B, TLS,ECDH,ECDSA,WITH,ARIA,256,CBC,SHA384),
+  CS_ENTRY(0xC04B, ECDH,ECDSA,ARIA256,SHA384,,,,), /* ns */
+  CS_ENTRY(0xC04C, TLS,ECDHE,RSA,WITH,ARIA,128,CBC,SHA256),
+  CS_ENTRY(0xC04C, ECDHE,ARIA128,SHA256,,,,,), /* ns */
+  CS_ENTRY(0xC04D, TLS,ECDHE,RSA,WITH,ARIA,256,CBC,SHA384),
+  CS_ENTRY(0xC04D, ECDHE,ARIA256,SHA384,,,,,), /* ns */
+  CS_ENTRY(0xC04E, TLS,ECDH,RSA,WITH,ARIA,128,CBC,SHA256),
+  CS_ENTRY(0xC04E, ECDH,ARIA128,SHA256,,,,,), /* ns */
+  CS_ENTRY(0xC04F, TLS,ECDH,RSA,WITH,ARIA,256,CBC,SHA384),
+  CS_ENTRY(0xC04F, ECDH,ARIA256,SHA384,,,,,), /* ns */
+  CS_ENTRY(0xC050, TLS,RSA,WITH,ARIA,128,GCM,SHA256,),
+  CS_ENTRY(0xC050, ARIA128,GCM,SHA256,,,,,),
+  CS_ENTRY(0xC051, TLS,RSA,WITH,ARIA,256,GCM,SHA384,),
+  CS_ENTRY(0xC051, ARIA256,GCM,SHA384,,,,,),
+  CS_ENTRY(0xC052, TLS,DHE,RSA,WITH,ARIA,128,GCM,SHA256),
+  CS_ENTRY(0xC052, DHE,RSA,ARIA128,GCM,SHA256,,,),
+  CS_ENTRY(0xC053, TLS,DHE,RSA,WITH,ARIA,256,GCM,SHA384),
+  CS_ENTRY(0xC053, DHE,RSA,ARIA256,GCM,SHA384,,,),
+  CS_ENTRY(0xC05C, TLS,ECDHE,ECDSA,WITH,ARIA,128,GCM,SHA256),
+  CS_ENTRY(0xC05C, ECDHE,ECDSA,ARIA128,GCM,SHA256,,,),
+  CS_ENTRY(0xC05D, TLS,ECDHE,ECDSA,WITH,ARIA,256,GCM,SHA384),
+  CS_ENTRY(0xC05D, ECDHE,ECDSA,ARIA256,GCM,SHA384,,,),
+  CS_ENTRY(0xC05E, TLS,ECDH,ECDSA,WITH,ARIA,128,GCM,SHA256),
+  CS_ENTRY(0xC05E, ECDH,ECDSA,ARIA128,GCM,SHA256,,,), /* ns */
+  CS_ENTRY(0xC05F, TLS,ECDH,ECDSA,WITH,ARIA,256,GCM,SHA384),
+  CS_ENTRY(0xC05F, ECDH,ECDSA,ARIA256,GCM,SHA384,,,), /* ns */
+  CS_ENTRY(0xC060, TLS,ECDHE,RSA,WITH,ARIA,128,GCM,SHA256),
+  CS_ENTRY(0xC060, ECDHE,ARIA128,GCM,SHA256,,,,),
+  CS_ENTRY(0xC061, TLS,ECDHE,RSA,WITH,ARIA,256,GCM,SHA384),
+  CS_ENTRY(0xC061, ECDHE,ARIA256,GCM,SHA384,,,,),
+  CS_ENTRY(0xC062, TLS,ECDH,RSA,WITH,ARIA,128,GCM,SHA256),
+  CS_ENTRY(0xC062, ECDH,ARIA128,GCM,SHA256,,,,), /* ns */
+  CS_ENTRY(0xC063, TLS,ECDH,RSA,WITH,ARIA,256,GCM,SHA384),
+  CS_ENTRY(0xC063, ECDH,ARIA256,GCM,SHA384,,,,), /* ns */
+  CS_ENTRY(0xC064, TLS,PSK,WITH,ARIA,128,CBC,SHA256,),
+  CS_ENTRY(0xC064, PSK,ARIA128,SHA256,,,,,), /* ns */
+  CS_ENTRY(0xC065, TLS,PSK,WITH,ARIA,256,CBC,SHA384,),
+  CS_ENTRY(0xC065, PSK,ARIA256,SHA384,,,,,), /* ns */
+  CS_ENTRY(0xC066, TLS,DHE,PSK,WITH,ARIA,128,CBC,SHA256),
+  CS_ENTRY(0xC066, DHE,PSK,ARIA128,SHA256,,,,), /* ns */
+  CS_ENTRY(0xC067, TLS,DHE,PSK,WITH,ARIA,256,CBC,SHA384),
+  CS_ENTRY(0xC067, DHE,PSK,ARIA256,SHA384,,,,), /* ns */
+  CS_ENTRY(0xC068, TLS,RSA,PSK,WITH,ARIA,128,CBC,SHA256),
+  CS_ENTRY(0xC068, RSA,PSK,ARIA128,SHA256,,,,), /* ns */
+  CS_ENTRY(0xC069, TLS,RSA,PSK,WITH,ARIA,256,CBC,SHA384),
+  CS_ENTRY(0xC069, RSA,PSK,ARIA256,SHA384,,,,), /* ns */
+  CS_ENTRY(0xC06A, TLS,PSK,WITH,ARIA,128,GCM,SHA256,),
+  CS_ENTRY(0xC06A, PSK,ARIA128,GCM,SHA256,,,,),
+  CS_ENTRY(0xC06B, TLS,PSK,WITH,ARIA,256,GCM,SHA384,),
+  CS_ENTRY(0xC06B, PSK,ARIA256,GCM,SHA384,,,,),
+  CS_ENTRY(0xC06C, TLS,DHE,PSK,WITH,ARIA,128,GCM,SHA256),
+  CS_ENTRY(0xC06C, DHE,PSK,ARIA128,GCM,SHA256,,,),
+  CS_ENTRY(0xC06D, TLS,DHE,PSK,WITH,ARIA,256,GCM,SHA384),
+  CS_ENTRY(0xC06D, DHE,PSK,ARIA256,GCM,SHA384,,,),
+  CS_ENTRY(0xC06E, TLS,RSA,PSK,WITH,ARIA,128,GCM,SHA256),
+  CS_ENTRY(0xC06E, RSA,PSK,ARIA128,GCM,SHA256,,,),
+  CS_ENTRY(0xC06F, TLS,RSA,PSK,WITH,ARIA,256,GCM,SHA384),
+  CS_ENTRY(0xC06F, RSA,PSK,ARIA256,GCM,SHA384,,,),
+  CS_ENTRY(0xC070, TLS,ECDHE,PSK,WITH,ARIA,128,CBC,SHA256),
+  CS_ENTRY(0xC070, ECDHE,PSK,ARIA128,SHA256,,,,), /* ns */
+  CS_ENTRY(0xC071, TLS,ECDHE,PSK,WITH,ARIA,256,CBC,SHA384),
+  CS_ENTRY(0xC071, ECDHE,PSK,ARIA256,SHA384,,,,), /* ns */
+  CS_ENTRY(0xC072, TLS,ECDHE,ECDSA,WITH,CAMELLIA,128,CBC,SHA256),
+  CS_ENTRY(0xC072, ECDHE,ECDSA,CAMELLIA128,SHA256,,,,),
+  CS_ENTRY(0xC073, TLS,ECDHE,ECDSA,WITH,CAMELLIA,256,CBC,SHA384),
+  CS_ENTRY(0xC073, ECDHE,ECDSA,CAMELLIA256,SHA384,,,,),
+  CS_ENTRY(0xC074, TLS,ECDH,ECDSA,WITH,CAMELLIA,128,CBC,SHA256),
+  CS_ENTRY(0xC074, ECDH,ECDSA,CAMELLIA128,SHA256,,,,), /* ns */
+  CS_ENTRY(0xC075, TLS,ECDH,ECDSA,WITH,CAMELLIA,256,CBC,SHA384),
+  CS_ENTRY(0xC075, ECDH,ECDSA,CAMELLIA256,SHA384,,,,), /* ns */
+  CS_ENTRY(0xC076, TLS,ECDHE,RSA,WITH,CAMELLIA,128,CBC,SHA256),
+  CS_ENTRY(0xC076, ECDHE,RSA,CAMELLIA128,SHA256,,,,),
+  CS_ENTRY(0xC077, TLS,ECDHE,RSA,WITH,CAMELLIA,256,CBC,SHA384),
+  CS_ENTRY(0xC077, ECDHE,RSA,CAMELLIA256,SHA384,,,,),
+  CS_ENTRY(0xC078, TLS,ECDH,RSA,WITH,CAMELLIA,128,CBC,SHA256),
+  CS_ENTRY(0xC078, ECDH,CAMELLIA128,SHA256,,,,,), /* ns */
+  CS_ENTRY(0xC079, TLS,ECDH,RSA,WITH,CAMELLIA,256,CBC,SHA384),
+  CS_ENTRY(0xC079, ECDH,CAMELLIA256,SHA384,,,,,), /* ns */
+  CS_ENTRY(0xC07A, TLS,RSA,WITH,CAMELLIA,128,GCM,SHA256,),
+  CS_ENTRY(0xC07A, CAMELLIA128,GCM,SHA256,,,,,), /* ns */
+  CS_ENTRY(0xC07B, TLS,RSA,WITH,CAMELLIA,256,GCM,SHA384,),
+  CS_ENTRY(0xC07B, CAMELLIA256,GCM,SHA384,,,,,), /* ns */
+  CS_ENTRY(0xC07C, TLS,DHE,RSA,WITH,CAMELLIA,128,GCM,SHA256),
+  CS_ENTRY(0xC07C, DHE,RSA,CAMELLIA128,GCM,SHA256,,,), /* ns */
+  CS_ENTRY(0xC07D, TLS,DHE,RSA,WITH,CAMELLIA,256,GCM,SHA384),
+  CS_ENTRY(0xC07D, DHE,RSA,CAMELLIA256,GCM,SHA384,,,), /* ns */
+  CS_ENTRY(0xC086, TLS,ECDHE,ECDSA,WITH,CAMELLIA,128,GCM,SHA256),
+  CS_ENTRY(0xC086, ECDHE,ECDSA,CAMELLIA128,GCM,SHA256,,,), /* ns */
+  CS_ENTRY(0xC087, TLS,ECDHE,ECDSA,WITH,CAMELLIA,256,GCM,SHA384),
+  CS_ENTRY(0xC087, ECDHE,ECDSA,CAMELLIA256,GCM,SHA384,,,), /* ns */
+  CS_ENTRY(0xC088, TLS,ECDH,ECDSA,WITH,CAMELLIA,128,GCM,SHA256),
+  CS_ENTRY(0xC088, ECDH,ECDSA,CAMELLIA128,GCM,SHA256,,,), /* ns */
+  CS_ENTRY(0xC089, TLS,ECDH,ECDSA,WITH,CAMELLIA,256,GCM,SHA384),
+  CS_ENTRY(0xC089, ECDH,ECDSA,CAMELLIA256,GCM,SHA384,,,), /* ns */
+  CS_ENTRY(0xC08A, TLS,ECDHE,RSA,WITH,CAMELLIA,128,GCM,SHA256),
+  CS_ENTRY(0xC08A, ECDHE,CAMELLIA128,GCM,SHA256,,,,), /* ns */
+  CS_ENTRY(0xC08B, TLS,ECDHE,RSA,WITH,CAMELLIA,256,GCM,SHA384),
+  CS_ENTRY(0xC08B, ECDHE,CAMELLIA256,GCM,SHA384,,,,), /* ns */
+  CS_ENTRY(0xC08C, TLS,ECDH,RSA,WITH,CAMELLIA,128,GCM,SHA256),
+  CS_ENTRY(0xC08C, ECDH,CAMELLIA128,GCM,SHA256,,,,), /* ns */
+  CS_ENTRY(0xC08D, TLS,ECDH,RSA,WITH,CAMELLIA,256,GCM,SHA384),
+  CS_ENTRY(0xC08D, ECDH,CAMELLIA256,GCM,SHA384,,,,), /* ns */
+  CS_ENTRY(0xC08E, TLS,PSK,WITH,CAMELLIA,128,GCM,SHA256,),
+  CS_ENTRY(0xC08E, PSK,CAMELLIA128,GCM,SHA256,,,,), /* ns */
+  CS_ENTRY(0xC08F, TLS,PSK,WITH,CAMELLIA,256,GCM,SHA384,),
+  CS_ENTRY(0xC08F, PSK,CAMELLIA256,GCM,SHA384,,,,), /* ns */
+  CS_ENTRY(0xC090, TLS,DHE,PSK,WITH,CAMELLIA,128,GCM,SHA256),
+  CS_ENTRY(0xC090, DHE,PSK,CAMELLIA128,GCM,SHA256,,,), /* ns */
+  CS_ENTRY(0xC091, TLS,DHE,PSK,WITH,CAMELLIA,256,GCM,SHA384),
+  CS_ENTRY(0xC091, DHE,PSK,CAMELLIA256,GCM,SHA384,,,), /* ns */
+  CS_ENTRY(0xC092, TLS,RSA,PSK,WITH,CAMELLIA,128,GCM,SHA256),
+  CS_ENTRY(0xC092, RSA,PSK,CAMELLIA128,GCM,SHA256,,,), /* ns */
+  CS_ENTRY(0xC093, TLS,RSA,PSK,WITH,CAMELLIA,256,GCM,SHA384),
+  CS_ENTRY(0xC093, RSA,PSK,CAMELLIA256,GCM,SHA384,,,), /* ns */
+  CS_ENTRY(0xC094, TLS,PSK,WITH,CAMELLIA,128,CBC,SHA256,),
+  CS_ENTRY(0xC094, PSK,CAMELLIA128,SHA256,,,,,),
+  CS_ENTRY(0xC095, TLS,PSK,WITH,CAMELLIA,256,CBC,SHA384,),
+  CS_ENTRY(0xC095, PSK,CAMELLIA256,SHA384,,,,,),
+  CS_ENTRY(0xC096, TLS,DHE,PSK,WITH,CAMELLIA,128,CBC,SHA256),
+  CS_ENTRY(0xC096, DHE,PSK,CAMELLIA128,SHA256,,,,),
+  CS_ENTRY(0xC097, TLS,DHE,PSK,WITH,CAMELLIA,256,CBC,SHA384),
+  CS_ENTRY(0xC097, DHE,PSK,CAMELLIA256,SHA384,,,,),
+  CS_ENTRY(0xC098, TLS,RSA,PSK,WITH,CAMELLIA,128,CBC,SHA256),
+  CS_ENTRY(0xC098, RSA,PSK,CAMELLIA128,SHA256,,,,),
+  CS_ENTRY(0xC099, TLS,RSA,PSK,WITH,CAMELLIA,256,CBC,SHA384),
+  CS_ENTRY(0xC099, RSA,PSK,CAMELLIA256,SHA384,,,,),
+  CS_ENTRY(0xC09A, TLS,ECDHE,PSK,WITH,CAMELLIA,128,CBC,SHA256),
+  CS_ENTRY(0xC09A, ECDHE,PSK,CAMELLIA128,SHA256,,,,),
+  CS_ENTRY(0xC09B, TLS,ECDHE,PSK,WITH,CAMELLIA,256,CBC,SHA384),
+  CS_ENTRY(0xC09B, ECDHE,PSK,CAMELLIA256,SHA384,,,,),
+  CS_ENTRY(0xC09E, TLS,DHE,RSA,WITH,AES,128,CCM,),
+  CS_ENTRY(0xC09E, DHE,RSA,AES128,CCM,,,,),
+  CS_ENTRY(0xC09F, TLS,DHE,RSA,WITH,AES,256,CCM,),
+  CS_ENTRY(0xC09F, DHE,RSA,AES256,CCM,,,,),
+  CS_ENTRY(0xC0A2, TLS,DHE,RSA,WITH,AES,128,CCM,8),
+  CS_ENTRY(0xC0A2, DHE,RSA,AES128,CCM8,,,,),
+  CS_ENTRY(0xC0A3, TLS,DHE,RSA,WITH,AES,256,CCM,8),
+  CS_ENTRY(0xC0A3, DHE,RSA,AES256,CCM8,,,,),
+  CS_ENTRY(0xC0A4, TLS,PSK,WITH,AES,128,CCM,,),
+  CS_ENTRY(0xC0A4, PSK,AES128,CCM,,,,,),
+  CS_ENTRY(0xC0A5, TLS,PSK,WITH,AES,256,CCM,,),
+  CS_ENTRY(0xC0A5, PSK,AES256,CCM,,,,,),
+  CS_ENTRY(0xC0A6, TLS,DHE,PSK,WITH,AES,128,CCM,),
+  CS_ENTRY(0xC0A6, DHE,PSK,AES128,CCM,,,,),
+  CS_ENTRY(0xC0A7, TLS,DHE,PSK,WITH,AES,256,CCM,),
+  CS_ENTRY(0xC0A7, DHE,PSK,AES256,CCM,,,,),
+  CS_ENTRY(0xC0A8, TLS,PSK,WITH,AES,128,CCM,8,),
+  CS_ENTRY(0xC0A8, PSK,AES128,CCM8,,,,,),
+  CS_ENTRY(0xC0A9, TLS,PSK,WITH,AES,256,CCM,8,),
+  CS_ENTRY(0xC0A9, PSK,AES256,CCM8,,,,,),
+  CS_ENTRY(0xC0AA, TLS,PSK,DHE,WITH,AES,128,CCM,8),
+  CS_ENTRY(0xC0AA, DHE,PSK,AES128,CCM8,,,,),
+  CS_ENTRY(0xC0AB, TLS,PSK,DHE,WITH,AES,256,CCM,8),
+  CS_ENTRY(0xC0AB, DHE,PSK,AES256,CCM8,,,,),
+  CS_ENTRY(0xCCAA, TLS,DHE,RSA,WITH,CHACHA20,POLY1305,SHA256,),
+  CS_ENTRY(0xCCAA, DHE,RSA,CHACHA20,POLY1305,,,,),
+  CS_ENTRY(0xCCAC, TLS,ECDHE,PSK,WITH,CHACHA20,POLY1305,SHA256,),
+  CS_ENTRY(0xCCAC, ECDHE,PSK,CHACHA20,POLY1305,,,,),
+  CS_ENTRY(0xCCAD, TLS,DHE,PSK,WITH,CHACHA20,POLY1305,SHA256,),
+  CS_ENTRY(0xCCAD, DHE,PSK,CHACHA20,POLY1305,,,,),
+  CS_ENTRY(0xCCAE, TLS,RSA,PSK,WITH,CHACHA20,POLY1305,SHA256,),
+  CS_ENTRY(0xCCAE, RSA,PSK,CHACHA20,POLY1305,,,,),
+#endif
+};
+#define CS_LIST_LEN CURL_ARRAYSIZE(cs_list)
+
+static int cs_str_to_zip(const char *cs_str, size_t cs_len, uint8_t zip[6])
+{
+  uint8_t indexes[8] = { 0 };
+  const char *entry, *cur;
+  const char *nxt = cs_str;
+  const char *end = cs_str + cs_len;
+  char separator = '-';
+  int idx, i = 0;
+  size_t len;
+
+  /* split the cipher string by '-' or '_' */
+  if(curl_strnequal(cs_str, "TLS", 3))
+    separator = '_';
+
+  do {
+    if(i == 8)
+      return -1;
+
+    /* determine the length of the part */
+    cur = nxt;
+    for(; nxt < end && *nxt != '\0' && *nxt != separator; nxt++)
+      ;
+    len = nxt - cur;
+
+    /* lookup index for the part (skip empty string at 0) */
+    for(idx = 1, entry = cs_txt + 1; idx < CS_TXT_LEN; idx++) {
+      size_t elen = strlen(entry);
+      if(elen == len && curl_strnequal(entry, cur, len))
+        break;
+      entry += elen + 1;
+    }
+    if(idx == CS_TXT_LEN)
+      return -1;
+
+    indexes[i++] = (uint8_t)idx;
+  } while(nxt < end && *(nxt++) != '\0');
+
+  /* zip the 8 indexes into 48 bits */
+  zip[0] = (uint8_t)(indexes[0] << 2 | (indexes[1] & 0x3F) >> 4);
+  zip[1] = (uint8_t)(indexes[1] << 4 | (indexes[2] & 0x3F) >> 2);
+  zip[2] = (uint8_t)(indexes[2] << 6 | (indexes[3] & 0x3F));
+  zip[3] = (uint8_t)(indexes[4] << 2 | (indexes[5] & 0x3F) >> 4);
+  zip[4] = (uint8_t)(indexes[5] << 4 | (indexes[6] & 0x3F) >> 2);
+  zip[5] = (uint8_t)(indexes[6] << 6 | (indexes[7] & 0x3F));
+
+  return 0;
+}
+
+static int cs_zip_to_str(const uint8_t zip[6], char *buf, size_t buf_size)
+{
+  uint8_t indexes[8] = { 0 };
+  const char *entry;
+  char separator = '-';
+  int idx, i, r;
+  size_t len = 0;
+
+  /* unzip the 8 indexes */
+  indexes[0] = zip[0] >> 2;
+  indexes[1] = (uint8_t)(((zip[0] << 4) & 0x3F) | zip[1] >> 4);
+  indexes[2] = (uint8_t)(((zip[1] << 2) & 0x3F) | zip[2] >> 6);
+  indexes[3] = ((zip[2] << 0) & 0x3F);
+  indexes[4] = zip[3] >> 2;
+  indexes[5] = (uint8_t)(((zip[3] << 4) & 0x3F) | zip[4] >> 4);
+  indexes[6] = (uint8_t)(((zip[4] << 2) & 0x3F) | zip[5] >> 6);
+  indexes[7] = ((zip[5] << 0) & 0x3F);
+
+  if(indexes[0] == CS_TXT_IDX_TLS)
+    separator = '_';
+
+  for(i = 0; i < 8 && indexes[i] != 0 && len < buf_size; i++) {
+    if(indexes[i] >= CS_TXT_LEN)
+      return -1;
+
+    /* lookup the part string for the index (skip empty string at 0) */
+    for(idx = 1, entry = cs_txt + 1; idx < indexes[i]; idx++) {
+      size_t elen = strlen(entry);
+      entry += elen + 1;
+    }
+
+    /* append the part string to the buffer */
+    if(i > 0)
+      r = curl_msnprintf(&buf[len], buf_size - len, "%c%s", separator, entry);
+    else
+      r = curl_msnprintf(&buf[len], buf_size - len, "%s", entry);
+
+    if(r < 0)
+      return -1;
+    len += r;
+  }
+
+  return 0;
+}
+
+uint16_t Curl_cipher_suite_lookup_id(const char *cs_str, size_t cs_len)
+{
+  size_t i;
+  uint8_t zip[6];
+
+  if(cs_len > 0 && cs_str_to_zip(cs_str, cs_len, zip) == 0) {
+    for(i = 0; i < CS_LIST_LEN; i++) {
+      if(!memcmp(cs_list[i].zip, zip, sizeof(zip)))
+        return cs_list[i].id;
+    }
+  }
+
+  return 0;
+}
+
+static bool cs_is_separator(char c)
+{
+  switch(c) {
+  case ' ':
+  case '\t':
+  case ':':
+  case ',':
+  case ';':
+    return TRUE;
+  }
+  return FALSE;
+}
+
+uint16_t Curl_cipher_suite_walk_str(const char **str, const char **end)
+{
+  /* move string pointer to first non-separator or end of string */
+  for(; cs_is_separator(*str[0]); (*str)++)
+    ;
+
+  /* move end pointer to next separator or end of string */
+  for(*end = *str; *end[0] != '\0' && !cs_is_separator(*end[0]); (*end)++)
+    ;
+
+  return Curl_cipher_suite_lookup_id(*str, *end - *str);
+}
+
+int Curl_cipher_suite_get_str(uint16_t id, char *buf, size_t buf_size,
+                              bool prefer_rfc)
+{
+  size_t i, j = CS_LIST_LEN;
+  int r = -1;
+
+  for(i = 0; i < CS_LIST_LEN; i++) {
+    if(cs_list[i].id != id)
+      continue;
+    if((cs_list[i].zip[0] >> 2 != CS_TXT_IDX_TLS) == !prefer_rfc) {
+      j = i;
+      break;
+    }
+    if(j == CS_LIST_LEN)
+      j = i;
+  }
+
+  if(j < CS_LIST_LEN)
+    r = cs_zip_to_str(cs_list[j].zip, buf, buf_size);
+
+  if(r < 0)
+    curl_msnprintf(buf, buf_size, "TLS_UNKNOWN_0x%04x", id);
+
+  return r;
+}
+
+#endif /* defined(USE_MBEDTLS) || defined(USE_RUSTLS) */
diff --git a/third-party/curl/lib/vtls/cipher_suite.h b/third-party/curl/lib/vtls/cipher_suite.h
new file mode 100644
index 0000000000..0e185e351e
--- /dev/null
+++ b/third-party/curl/lib/vtls/cipher_suite.h
@@ -0,0 +1,44 @@
+#ifndef HEADER_CURL_CIPHER_SUITE_H
+#define HEADER_CURL_CIPHER_SUITE_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Jan Venekamp, <jan@venekamp.net>
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#if defined(USE_MBEDTLS) || defined(USE_RUSTLS)
+
+/* Lookup IANA id for cipher suite string, returns 0 if not recognized */
+uint16_t Curl_cipher_suite_lookup_id(const char *cs_str, size_t cs_len);
+
+/* Walk over cipher suite string, update str and end pointers to next
+   cipher suite in string, returns IANA id of that suite if recognized */
+uint16_t Curl_cipher_suite_walk_str(const char **str, const char **end);
+
+/* Copy openssl or RFC name for cipher suite in supplied buffer.
+   Caller is responsible to supply sufficiently large buffer (size
+   of 64 should suffice), excess bytes are silently truncated. */
+int Curl_cipher_suite_get_str(uint16_t id, char *buf, size_t buf_size,
+                              bool prefer_rfc);
+
+#endif /* defined(USE_MBEDTLS) || defined(USE_RUSTLS) */
+#endif /* HEADER_CURL_CIPHER_SUITE_H */
diff --git a/third-party/curl/lib/vtls/gtls.c b/third-party/curl/lib/vtls/gtls.c
index e48346903c..1a7a4a1e5b 100644
--- a/third-party/curl/lib/vtls/gtls.c
+++ b/third-party/curl/lib/vtls/gtls.c
@@ -21,15 +21,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /*
  * Source file for all GnuTLS-specific code for the TLS/SSL layer. No code
  * but vtls.c should ever call or use these functions.
  *
- * Note: don't use the GnuTLS' *_t variable type names in this source code,
- * since they were not present in 1.0.X.
+ * Note: do not use the GnuTLS' *_t variable type names in this source code,
+ * since they were not present in 1.0.x.
  */
-
 #include "curl_setup.h"
 
 #ifdef USE_GNUTLS
@@ -39,139 +37,160 @@
 #include <gnutls/x509.h>
 #include <gnutls/crypto.h>
 #include <nettle/sha2.h>
+#include <nettle/version.h>
 
 #include "urldata.h"
-#include "sendf.h"
-#include "inet_pton.h"
-#include "gtls.h"
-#include "vtls.h"
-#include "vtls_int.h"
+#include "curl_trc.h"
+#include "vtls/keylog.h"
+#include "vtls/gtls.h"
+#include "vtls/vtls.h"
+#include "vtls/vtls_int.h"
+#include "vtls/vtls_scache.h"
+#include "vtls/apple.h"
 #include "vauth/vauth.h"
 #include "parsedate.h"
 #include "connect.h" /* for the connect timeout */
-#include "select.h"
-#include "strcase.h"
-#include "warnless.h"
-#include "x509asn1.h"
-#include "multiif.h"
-#include "curl_printf.h"
-#include "curl_memory.h"
-/* The last #include file should be: */
-#include "memdebug.h"
+#include "progress.h"
+#include "curlx/strdup.h"
+#include "curlx/fopen.h"
+#include "vtls/x509asn1.h"
 
 /* Enable GnuTLS debugging by defining GTLSDEBUG */
-/*#define GTLSDEBUG */
+#if 0
+#define GTLSDEBUG
+#endif
 
 #ifdef GTLSDEBUG
 static void tls_log_func(int level, const char *str)
 {
-    fprintf(stderr, "|<%d>| %s", level, str);
+  curl_mfprintf(stderr, "|<%d>| %s", level, str);
 }
 #endif
-static bool gtls_inited = FALSE;
 
-#if !defined(GNUTLS_VERSION_NUMBER) || (GNUTLS_VERSION_NUMBER < 0x03010a)
+#if !defined(GNUTLS_VERSION_NUMBER) || (GNUTLS_VERSION_NUMBER < 0x030605)
 #error "too old GnuTLS version"
 #endif
 
-# include <gnutls/ocsp.h>
+#undef CURL_GNUTLS_EARLY_DATA
+#if GNUTLS_VERSION_NUMBER >= 0x030702
+#define CURL_GNUTLS_EARLY_DATA
+#endif
+
+#include <gnutls/ocsp.h>
 
 struct gtls_ssl_backend_data {
-  struct gtls_instance gtls;
+  struct gtls_ctx gtls;
 };
 
 static ssize_t gtls_push(void *s, const void *buf, size_t blen)
 {
   struct Curl_cfilter *cf = s;
   struct ssl_connect_data *connssl = cf->ctx;
+  struct gtls_ssl_backend_data *backend =
+    (struct gtls_ssl_backend_data *)connssl->backend;
   struct Curl_easy *data = CF_DATA_CURRENT(cf);
-  ssize_t nwritten;
+  size_t nwritten;
   CURLcode result;
 
   DEBUGASSERT(data);
-  nwritten = Curl_conn_cf_send(cf->next, data, buf, blen, &result);
-  if(nwritten < 0) {
-    struct gtls_ssl_backend_data *backend =
-      (struct gtls_ssl_backend_data *)connssl->backend;
+  result = Curl_conn_cf_send(cf->next, data, buf, blen, FALSE, &nwritten);
+  CURL_TRC_CF(data, cf, "gtls_push(len=%zu) -> %d, %zu",
+              blen, (int)result, nwritten);
+  backend->gtls.io_result = result;
+  if(result) {
+    /* !checksrc! disable ERRNOVAR 1 */
     gnutls_transport_set_errno(backend->gtls.session,
-                               (CURLE_AGAIN == result)? EAGAIN : EINVAL);
-    nwritten = -1;
+                               (result == CURLE_AGAIN) ? EAGAIN : EINVAL);
+    return -1;
   }
-  return nwritten;
+  return (ssize_t)nwritten;
 }
 
 static ssize_t gtls_pull(void *s, void *buf, size_t blen)
 {
   struct Curl_cfilter *cf = s;
   struct ssl_connect_data *connssl = cf->ctx;
+  struct gtls_ssl_backend_data *backend =
+    (struct gtls_ssl_backend_data *)connssl->backend;
   struct Curl_easy *data = CF_DATA_CURRENT(cf);
-  ssize_t nread;
+  size_t nread;
   CURLcode result;
 
   DEBUGASSERT(data);
-  nread = Curl_conn_cf_recv(cf->next, data, buf, blen, &result);
-  if(nread < 0) {
-    struct gtls_ssl_backend_data *backend =
-      (struct gtls_ssl_backend_data *)connssl->backend;
-    gnutls_transport_set_errno(backend->gtls.session,
-                               (CURLE_AGAIN == result)? EAGAIN : EINVAL);
-    nread = -1;
+  if(!backend->gtls.shared_creds->trust_setup) {
+    result = Curl_gtls_client_trust_setup(cf, data, &backend->gtls);
+    if(result) {
+      /* !checksrc! disable ERRNOVAR 1 */
+      gnutls_transport_set_errno(backend->gtls.session, EINVAL);
+      backend->gtls.io_result = result;
+      return -1;
+    }
   }
-  return nread;
+
+  result = Curl_conn_cf_recv(cf->next, data, buf, blen, &nread);
+  CURL_TRC_CF(data, cf, "gtls_pull(len=%zu) -> %d, %zu", blen, (int)result,
+              nread);
+  backend->gtls.io_result = result;
+  if(result) {
+    /* !checksrc! disable ERRNOVAR 1 */
+    gnutls_transport_set_errno(backend->gtls.session,
+                               (result == CURLE_AGAIN) ? EAGAIN : EINVAL);
+    return -1;
+  }
+  else if(nread == 0)
+    connssl->peer_closed = TRUE;
+  return (ssize_t)nread;
 }
 
-/* gtls_init()
+/**
+ * gtls_init()
  *
  * Global GnuTLS init, called from Curl_ssl_init(). This calls functions that
- * are not thread-safe and thus this function itself is not thread-safe and
- * must only be called from within curl_global_init() to keep the thread
- * situation under control!
+ * are not thread-safe (It is thread-safe since GnuTLS 3.3.0) and thus this
+ * function itself is not thread-safe and must only be called from within
+ * curl_global_init() to keep the thread situation under control!
+ *
+ * @retval 0 error initializing SSL
+ * @retval 1 SSL initialized successfully
  */
 static int gtls_init(void)
 {
   int ret = 1;
-  if(!gtls_inited) {
-    ret = gnutls_global_init()?0:1;
+  ret = gnutls_global_init() ? 0 : 1;
 #ifdef GTLSDEBUG
-    gnutls_global_set_log_function(tls_log_func);
-    gnutls_global_set_log_level(2);
+  gnutls_global_set_log_function(tls_log_func);
+  gnutls_global_set_log_level(2);
 #endif
-    gtls_inited = TRUE;
-  }
   return ret;
 }
 
 static void gtls_cleanup(void)
 {
-  if(gtls_inited) {
-    gnutls_global_deinit();
-    gtls_inited = FALSE;
-  }
+  gnutls_global_deinit();
+  Curl_tls_keylog_close();
 }
 
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-static void showtime(struct Curl_easy *data,
-                     const char *text,
-                     time_t stamp)
+#ifdef CURLVERBOSE
+static void showtime(struct Curl_easy *data, const char *text, time_t stamp)
 {
   struct tm buffer;
   const struct tm *tm = &buffer;
   char str[96];
-  CURLcode result = Curl_gmtime(stamp, &buffer);
+  CURLcode result = curlx_gmtime(stamp, &buffer);
   if(result)
     return;
 
-  msnprintf(str,
-            sizeof(str),
-            "  %s: %s, %02d %s %4d %02d:%02d:%02d GMT",
-            text,
-            Curl_wkday[tm->tm_wday?tm->tm_wday-1:6],
-            tm->tm_mday,
-            Curl_month[tm->tm_mon],
-            tm->tm_year + 1900,
-            tm->tm_hour,
-            tm->tm_min,
-            tm->tm_sec);
+  curl_msnprintf(str,
+                 sizeof(str),
+                 "  %s: %s, %02d %s %4d %02d:%02d:%02d GMT",
+                 text,
+                 Curl_wkday[tm->tm_wday ? tm->tm_wday-1 : 6],
+                 tm->tm_mday,
+                 Curl_month[tm->tm_mon],
+                 tm->tm_year + 1900,
+                 tm->tm_hour,
+                 tm->tm_min,
+                 tm->tm_sec);
   infof(data, "%s", str);
 }
 #endif
@@ -183,174 +202,153 @@ static gnutls_datum_t load_file(const char *file)
   long filelen;
   void *ptr;
 
-  f = fopen(file, "rb");
+  f = curlx_fopen(file, "rb");
   if(!f)
     return loaded_file;
-  if(fseek(f, 0, SEEK_END) != 0
-     || (filelen = ftell(f)) < 0
-     || fseek(f, 0, SEEK_SET) != 0
-     || !(ptr = malloc((size_t)filelen)))
+  if(fseek(f, 0, SEEK_END))
+    goto out;
+  filelen = ftell(f);
+  if(filelen < 0 || filelen > CURL_MAX_INPUT_LENGTH)
+    goto out;
+  if(fseek(f, 0, SEEK_SET))
+    goto out;
+  ptr = curlx_malloc((size_t)filelen);
+  if(!ptr)
     goto out;
   if(fread(ptr, 1, (size_t)filelen, f) < (size_t)filelen) {
-    free(ptr);
+    curlx_free(ptr);
     goto out;
   }
 
   loaded_file.data = ptr;
   loaded_file.size = (unsigned int)filelen;
 out:
-  fclose(f);
+  curlx_fclose(f);
   return loaded_file;
 }
 
 static void unload_file(gnutls_datum_t data)
 {
-  free(data.data);
+  curlx_free(data.data);
 }
 
-
-/* this function does a SSL/TLS (re-)handshake */
-static CURLcode handshake(struct Curl_cfilter *cf,
-                          struct Curl_easy *data,
-                          bool duringconnect,
-                          bool nonblocking)
+/* this function does an SSL/TLS (re-)handshake */
+static CURLcode cf_gtls_handshake(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data)
 {
   struct ssl_connect_data *connssl = cf->ctx;
   struct gtls_ssl_backend_data *backend =
     (struct gtls_ssl_backend_data *)connssl->backend;
   gnutls_session_t session;
-  curl_socket_t sockfd = Curl_conn_cf_get_socket(cf, data);
+  int rc;
 
   DEBUGASSERT(backend);
   session = backend->gtls.session;
 
-  for(;;) {
-    timediff_t timeout_ms;
-    int rc;
+  connssl->io_need = CURL_SSL_IO_NEED_NONE;
+  backend->gtls.io_result = CURLE_OK;
+  rc = gnutls_handshake(session);
 
-    /* check allowed time left */
-    timeout_ms = Curl_timeleft(data, NULL, duringconnect);
-
-    if(timeout_ms < 0) {
-      /* no need to continue if time already is up */
-      failf(data, "SSL connection timeout");
-      return CURLE_OPERATION_TIMEDOUT;
-    }
-
-    /* if ssl is expecting something, check if it's available. */
-    if(connssl->connecting_state == ssl_connect_2_reading
-       || connssl->connecting_state == ssl_connect_2_writing) {
-      int what;
-      curl_socket_t writefd = ssl_connect_2_writing ==
-        connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
-      curl_socket_t readfd = ssl_connect_2_reading ==
-        connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
-
-      what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd,
-                               nonblocking?0:
-                               timeout_ms?timeout_ms:1000);
-      if(what < 0) {
-        /* fatal error */
-        failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
-        return CURLE_SSL_CONNECT_ERROR;
-      }
-      else if(0 == what) {
-        if(nonblocking)
-          return CURLE_OK;
-        else if(timeout_ms) {
-          /* timeout */
-          failf(data, "SSL connection timeout at %ld", (long)timeout_ms);
-          return CURLE_OPERATION_TIMEDOUT;
-        }
-      }
-      /* socket is readable or writable */
-    }
-
-    rc = gnutls_handshake(session);
-
-    if((rc == GNUTLS_E_AGAIN) || (rc == GNUTLS_E_INTERRUPTED)) {
-      connssl->connecting_state =
-        gnutls_record_get_direction(session)?
-        ssl_connect_2_writing:ssl_connect_2_reading;
-      continue;
-    }
-    else if((rc < 0) && !gnutls_error_is_fatal(rc)) {
-      const char *strerr = NULL;
-
-      if(rc == GNUTLS_E_WARNING_ALERT_RECEIVED) {
-        int alert = gnutls_alert_get(session);
-        strerr = gnutls_alert_get_name(alert);
-      }
-
-      if(!strerr)
-        strerr = gnutls_strerror(rc);
-
-      infof(data, "gnutls_handshake() warning: %s", strerr);
-      continue;
-    }
-    else if(rc < 0) {
-      const char *strerr = NULL;
-
-      if(rc == GNUTLS_E_FATAL_ALERT_RECEIVED) {
-        int alert = gnutls_alert_get(session);
-        strerr = gnutls_alert_get_name(alert);
-      }
-
-      if(!strerr)
-        strerr = gnutls_strerror(rc);
-
-      failf(data, "gnutls_handshake() failed: %s", strerr);
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-
-    /* Reset our connect state machine */
-    connssl->connecting_state = ssl_connect_1;
-    return CURLE_OK;
+  if(!backend->gtls.shared_creds->trust_setup) {
+    /* After having send off the ClientHello, we prepare the trust
+     * store to verify the coming certificate from the server */
+    CURLcode result = Curl_gtls_client_trust_setup(cf, data, &backend->gtls);
+    if(result)
+      return result;
   }
+
+  if((rc == GNUTLS_E_AGAIN) || (rc == GNUTLS_E_INTERRUPTED)) {
+    connssl->io_need =
+      gnutls_record_get_direction(session) ?
+      CURL_SSL_IO_NEED_SEND : CURL_SSL_IO_NEED_RECV;
+    return CURLE_AGAIN;
+  }
+  else if((rc < 0) && !gnutls_error_is_fatal(rc)) {
+#ifdef CURLVERBOSE
+    const char *strerr = NULL;
+
+    if(rc == GNUTLS_E_WARNING_ALERT_RECEIVED) {
+      gnutls_alert_description_t alert = gnutls_alert_get(session);
+      strerr = gnutls_alert_get_name(alert);
+    }
+
+    if(!strerr)
+      strerr = gnutls_strerror(rc);
+
+    infof(data, "gnutls_handshake() warning: %s", strerr);
+#endif
+    return CURLE_AGAIN;
+  }
+  else if((rc < 0) && backend->gtls.io_result) {
+    return backend->gtls.io_result;
+  }
+  else if(rc < 0) {
+    const char *strerr = NULL;
+
+    if(rc == GNUTLS_E_FATAL_ALERT_RECEIVED) {
+      gnutls_alert_description_t alert = gnutls_alert_get(session);
+      strerr = gnutls_alert_get_name(alert);
+    }
+
+    if(!strerr)
+      strerr = gnutls_strerror(rc);
+
+    failf(data, "GnuTLS, handshake failed: %s", strerr);
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  return CURLE_OK;
 }
 
-static gnutls_x509_crt_fmt_t do_file_type(const char *type)
+static gnutls_x509_crt_fmt_t gnutls_do_file_type(const char *type)
 {
   if(!type || !type[0])
     return GNUTLS_X509_FMT_PEM;
-  if(strcasecompare(type, "PEM"))
+  if(curl_strequal(type, "PEM"))
     return GNUTLS_X509_FMT_PEM;
-  if(strcasecompare(type, "DER"))
+  if(curl_strequal(type, "DER"))
     return GNUTLS_X509_FMT_DER;
   return GNUTLS_X509_FMT_PEM; /* default to PEM */
 }
 
-#define GNUTLS_CIPHERS "NORMAL:-ARCFOUR-128:-CTYPE-ALL:+CTYPE-X509"
-/* If GnuTLS was compiled without support for SRP it will error out if SRP is
+#define GNUTLS_CIPHERS "NORMAL:%PROFILE_MEDIUM:-ARCFOUR-128:" \
+  "-CTYPE-ALL:+CTYPE-X509"
+/* If GnuTLS was compiled without support for SRP it errors out if SRP is
    requested in the priority string, so treat it specially
  */
 #define GNUTLS_SRP "+SRP"
 
-static CURLcode
-set_ssl_version_min_max(struct Curl_easy *data,
-                        struct ssl_primary_config *conn_config,
-                        const char **prioritylist,
-                        const char *tls13support)
+#define QUIC_PRIORITY \
+  "NORMAL:%PROFILE_MEDIUM:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM:" \
+  "+AES-256-GCM:+CHACHA20-POLY1305:+AES-128-CCM:-GROUP-ALL:" \
+  "+GROUP-SECP256R1:+GROUP-X25519:+GROUP-SECP384R1:+GROUP-SECP521R1:" \
+  "%DISABLE_TLS13_COMPAT_MODE"
+
+static CURLcode gnutls_set_ssl_version_min_max(
+  struct Curl_easy *data,
+  struct ssl_peer *peer,
+  struct ssl_primary_config *conn_config,
+  const char **prioritylist,
+  bool tls13support)
 {
   long ssl_version = conn_config->version;
   long ssl_version_max = conn_config->version_max;
 
-  if((ssl_version == CURL_SSLVERSION_DEFAULT) ||
-     (ssl_version == CURL_SSLVERSION_TLSv1))
+  DEBUGASSERT(ssl_version != CURL_SSLVERSION_DEFAULT);
+  if(ssl_version <= CURL_SSLVERSION_TLSv1)
     ssl_version = CURL_SSLVERSION_TLSv1_0;
-  if(ssl_version_max == CURL_SSLVERSION_MAX_NONE)
-    ssl_version_max = CURL_SSLVERSION_MAX_DEFAULT;
-  if(!tls13support) {
-    /* If the running GnuTLS doesn't support TLS 1.3, we must not specify a
-       prioritylist involving that since it will make GnuTLS return an en
-       error back at us */
-    if((ssl_version_max == CURL_SSLVERSION_MAX_TLSv1_3) ||
-       (ssl_version_max == CURL_SSLVERSION_MAX_DEFAULT)) {
-      ssl_version_max = CURL_SSLVERSION_MAX_TLSv1_2;
+  if((ssl_version_max == CURL_SSLVERSION_MAX_NONE) ||
+     (ssl_version_max == CURL_SSLVERSION_MAX_DEFAULT))
+    ssl_version_max = tls13support ?
+      CURL_SSLVERSION_MAX_TLSv1_3 : CURL_SSLVERSION_MAX_TLSv1_2;
+
+  if(peer->transport == TRNSPRT_QUIC) {
+    if(ssl_version_max < CURL_SSLVERSION_MAX_TLSv1_3) {
+      failf(data, "QUIC needs at least TLS version 1.3");
+      return CURLE_SSL_CONNECT_ERROR;
     }
-  }
-  else if(ssl_version_max == CURL_SSLVERSION_MAX_DEFAULT) {
-    ssl_version_max = CURL_SSLVERSION_MAX_TLSv1_3;
+    *prioritylist = QUIC_PRIORITY;
+    return CURLE_OK;
   }
 
   switch(ssl_version | ssl_version_max) {
@@ -395,55 +393,518 @@ set_ssl_version_min_max(struct Curl_easy *data,
     return CURLE_OK;
   }
 
-  failf(data, "GnuTLS: cannot set ssl protocol");
+  failf(data, "GnuTLS: cannot set TLS protocol");
   return CURLE_SSL_CONNECT_ERROR;
 }
 
-CURLcode gtls_client_init(struct Curl_easy *data,
-                          struct ssl_primary_config *config,
-                          struct ssl_config_data *ssl_config,
-                          const char *hostname,
-                          struct gtls_instance *gtls,
-                          long *pverifyresult)
+CURLcode Curl_gtls_shared_creds_create(struct Curl_easy *data,
+                                       struct gtls_shared_creds **pcreds)
 {
+  struct gtls_shared_creds *shared;
+  int rc;
+
+  *pcreds = NULL;
+  shared = curlx_calloc(1, sizeof(*shared));
+  if(!shared)
+    return CURLE_OUT_OF_MEMORY;
+
+  rc = gnutls_certificate_allocate_credentials(&shared->creds);
+  if(rc != GNUTLS_E_SUCCESS) {
+    failf(data, "gnutls_certificate_allocate_credentials() failed: %s",
+          gnutls_strerror(rc));
+    curlx_free(shared);
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  shared->refcount = 1;
+  shared->time = *Curl_pgrs_now(data);
+  *pcreds = shared;
+  return CURLE_OK;
+}
+
+CURLcode Curl_gtls_shared_creds_up_ref(struct gtls_shared_creds *creds)
+{
+  DEBUGASSERT(creds);
+  if(creds->refcount < SIZE_MAX) {
+    ++creds->refcount;
+    return CURLE_OK;
+  }
+  return CURLE_BAD_FUNCTION_ARGUMENT;
+}
+
+void Curl_gtls_shared_creds_free(struct gtls_shared_creds **pcreds)
+{
+  struct gtls_shared_creds *shared = *pcreds;
+  *pcreds = NULL;
+  if(shared) {
+    --shared->refcount;
+    if(!shared->refcount) {
+      gnutls_certificate_free_credentials(shared->creds);
+      curlx_free(shared->CAfile);
+      curlx_free(shared);
+    }
+  }
+}
+
+static CURLcode gtls_populate_creds(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    gnutls_certificate_credentials_t creds)
+{
+  struct ssl_primary_config *config = Curl_ssl_cf_get_primary_config(cf);
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+  bool creds_are_empty = TRUE;
+  int rc;
+
+  if(!config->verifypeer) {
+    infof(data, "SSL Trust: peer verification disabled");
+    return CURLE_OK;
+  }
+
+  infof(data, "SSL Trust Anchors:");
+  if(ssl_config->native_ca_store) {
+#ifdef USE_APPLE_SECTRUST
+    infof(data, "  Native: Apple SecTrust");
+    creds_are_empty = FALSE;
+#else
+    rc = gnutls_certificate_set_x509_system_trust(creds);
+    if(rc < 0)
+      infof(data, "error reading native CA store (%s), continuing anyway",
+            gnutls_strerror(rc));
+    else {
+      infof(data, "  Native: %d certificates from system trust", rc);
+      if(rc > 0)
+        creds_are_empty = FALSE;
+    }
+#endif
+  }
+
+  if(config->ca_info_blob) {
+    gnutls_datum_t ca_info_datum;
+    if(config->ca_info_blob->len > (size_t)UINT_MAX) {
+      failf(data, "certificate blob too long: %zu bytes",
+            config->ca_info_blob->len);
+      return CURLE_SSL_CACERT_BADFILE;
+    }
+    ca_info_datum.data = config->ca_info_blob->data;
+    ca_info_datum.size = (unsigned int)config->ca_info_blob->len;
+    rc = gnutls_certificate_set_x509_trust_mem(creds, &ca_info_datum,
+                                               GNUTLS_X509_FMT_PEM);
+    creds_are_empty = creds_are_empty && (rc <= 0);
+    if(rc < 0) {
+      infof(data, "error reading CA cert blob (%s)%s", gnutls_strerror(rc),
+            (creds_are_empty ? "" : ", continuing anyway"));
+      if(creds_are_empty) {
+        ssl_config->certverifyresult = rc;
+        return CURLE_SSL_CACERT_BADFILE;
+      }
+    }
+    else
+      infof(data, "  CA Blob: %d certificates", rc);
+  }
+  /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
+  else if(config->CAfile) {
+    /* set the trusted CA cert bundle file */
+    gnutls_certificate_set_verify_flags(creds,
+                                        GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT);
+
+    rc = gnutls_certificate_set_x509_trust_file(creds,
+                                                config->CAfile,
+                                                GNUTLS_X509_FMT_PEM);
+    creds_are_empty = creds_are_empty && (rc <= 0);
+    if(rc < 0) {
+      infof(data, "error reading CA cert file %s (%s)%s",
+            config->CAfile, gnutls_strerror(rc),
+            (creds_are_empty ? "" : ", continuing anyway"));
+      if(creds_are_empty) {
+        ssl_config->certverifyresult = rc;
+        return CURLE_SSL_CACERT_BADFILE;
+      }
+    }
+    else
+      infof(data, "  CAfile: %d certificates in %s", rc, config->CAfile);
+  }
+
+  if(config->CApath) {
+    /* set the trusted CA cert directory */
+    rc = gnutls_certificate_set_x509_trust_dir(creds, config->CApath,
+                                               GNUTLS_X509_FMT_PEM);
+    creds_are_empty = creds_are_empty && (rc <= 0);
+    if(rc < 0) {
+      infof(data, "error reading CA cert file %s (%s)%s",
+            config->CApath, gnutls_strerror(rc),
+            (creds_are_empty ? "" : ", continuing anyway"));
+      if(creds_are_empty) {
+        ssl_config->certverifyresult = rc;
+        return CURLE_SSL_CACERT_BADFILE;
+      }
+    }
+    else
+      infof(data, "  CApath: %d certificates in %s", rc, config->CApath);
+  }
+
+  if(creds_are_empty)
+    infof(data, "  no trust anchors configured");
+
+  if(config->CRLfile) {
+    /* set the CRL list file */
+    rc = gnutls_certificate_set_x509_crl_file(creds, config->CRLfile,
+                                              GNUTLS_X509_FMT_PEM);
+    if(rc < 0) {
+      failf(data, "error reading CRL file %s (%s)",
+            config->CRLfile, gnutls_strerror(rc));
+      return CURLE_SSL_CRL_BADFILE;
+    }
+    else
+      infof(data, "  CRLfile: %d CRL in %s", rc, config->CRLfile);
+  }
+
+  return CURLE_OK;
+}
+
+/* key to use at `multi->proto_hash` */
+#define MPROTO_GTLS_X509_KEY   "tls:gtls:x509:share"
+
+static bool gtls_shared_creds_expired(struct Curl_easy *data,
+                                      const struct gtls_shared_creds *sc)
+{
+  const struct ssl_general_config *cfg = &data->set.general_ssl;
+  timediff_t elapsed_ms = curlx_ptimediff_ms(Curl_pgrs_now(data), &sc->time);
+  timediff_t timeout_ms = cfg->ca_cache_timeout * (timediff_t)1000;
+
+  if(timeout_ms < 0)
+    return FALSE;
+
+  return elapsed_ms >= timeout_ms;
+}
+
+static bool gtls_shared_creds_different(struct Curl_cfilter *cf,
+                                        const struct gtls_shared_creds *sc)
+{
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  if(!sc->CAfile || !conn_config->CAfile)
+    return sc->CAfile != conn_config->CAfile;
+
+  return strcmp(sc->CAfile, conn_config->CAfile);
+}
+
+static struct gtls_shared_creds *gtls_get_cached_creds(struct Curl_cfilter *cf,
+                                                       struct Curl_easy *data)
+{
+  struct gtls_shared_creds *shared_creds;
+
+  if(data->multi) {
+    shared_creds = Curl_hash_pick(&data->multi->proto_hash,
+                                  CURL_UNCONST(MPROTO_GTLS_X509_KEY),
+                                  sizeof(MPROTO_GTLS_X509_KEY) - 1);
+    if(shared_creds && shared_creds->creds &&
+       !gtls_shared_creds_expired(data, shared_creds) &&
+       !gtls_shared_creds_different(cf, shared_creds)) {
+      return shared_creds;
+    }
+  }
+  return NULL;
+}
+
+static void gtls_shared_creds_hash_free(void *key, size_t key_len, void *p)
+{
+  struct gtls_shared_creds *sc = p;
+  DEBUGASSERT(key_len == (sizeof(MPROTO_GTLS_X509_KEY) - 1));
+  DEBUGASSERT(!memcmp(MPROTO_GTLS_X509_KEY, key, key_len));
+  (void)key;
+  (void)key_len;
+  Curl_gtls_shared_creds_free(&sc); /* down reference */
+}
+
+static void gtls_set_cached_creds(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  struct gtls_shared_creds *sc)
+{
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+
+  DEBUGASSERT(sc);
+  DEBUGASSERT(sc->creds);
+  DEBUGASSERT(!sc->CAfile);
+  DEBUGASSERT(sc->refcount == 1);
+  if(!data->multi)
+    return;
+
+  if(conn_config->CAfile) {
+    sc->CAfile = curlx_strdup(conn_config->CAfile);
+    if(!sc->CAfile)
+      return;
+  }
+
+  if(Curl_gtls_shared_creds_up_ref(sc))
+    return;
+
+  if(!Curl_hash_add2(&data->multi->proto_hash,
+                     CURL_UNCONST(MPROTO_GTLS_X509_KEY),
+                     sizeof(MPROTO_GTLS_X509_KEY) - 1,
+                     sc, gtls_shared_creds_hash_free)) {
+    Curl_gtls_shared_creds_free(&sc); /* down reference again */
+    return;
+  }
+}
+
+CURLcode Curl_gtls_client_trust_setup(struct Curl_cfilter *cf,
+                                      struct Curl_easy *data,
+                                      struct gtls_ctx *gtls)
+{
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+  struct gtls_shared_creds *cached_creds = NULL;
+  bool cache_criteria_met;
+  CURLcode result;
+  int rc;
+
+  /* Consider the X509 store cacheable if it comes exclusively from a CAfile,
+     or no source is provided and we are falling back to OpenSSL's built-in
+     default. */
+  cache_criteria_met = (data->set.general_ssl.ca_cache_timeout != 0) &&
+    conn_config->verifypeer &&
+    !conn_config->CApath &&
+    !conn_config->ca_info_blob &&
+    !ssl_config->primary.CRLfile &&
+    !ssl_config->native_ca_store &&
+    !conn_config->clientcert; /* GnuTLS adds client cert to its credentials! */
+
+  if(cache_criteria_met)
+    cached_creds = gtls_get_cached_creds(cf, data);
+
+  if(cached_creds && !Curl_gtls_shared_creds_up_ref(cached_creds)) {
+    CURL_TRC_CF(data, cf, "using shared trust anchors and CRLs");
+    Curl_gtls_shared_creds_free(&gtls->shared_creds);
+    gtls->shared_creds = cached_creds;
+    rc = gnutls_credentials_set(gtls->session, GNUTLS_CRD_CERTIFICATE,
+                                gtls->shared_creds->creds);
+    if(rc != GNUTLS_E_SUCCESS) {
+      failf(data, "gnutls_credentials_set() failed: %s", gnutls_strerror(rc));
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+  }
+  else {
+    CURL_TRC_CF(data, cf, "loading trust anchors and CRLs");
+    result = gtls_populate_creds(cf, data, gtls->shared_creds->creds);
+    if(result)
+      return result;
+    gtls->shared_creds->trust_setup = TRUE;
+    if(cache_criteria_met)
+      gtls_set_cached_creds(cf, data, gtls->shared_creds);
+  }
+  return CURLE_OK;
+}
+
+#ifdef CURL_GNUTLS_EARLY_DATA
+static int gtls_get_ietf_proto(gnutls_session_t session)
+{
+  switch(gnutls_protocol_get_version(session)) {
+  case GNUTLS_SSL3:
+    return CURL_IETF_PROTO_SSL3;
+  case GNUTLS_TLS1_0:
+    return CURL_IETF_PROTO_TLS1;
+  case GNUTLS_TLS1_1:
+    return CURL_IETF_PROTO_TLS1_1;
+  case GNUTLS_TLS1_2:
+    return CURL_IETF_PROTO_TLS1_2;
+  case GNUTLS_TLS1_3:
+    return CURL_IETF_PROTO_TLS1_3;
+  default:
+    return CURL_IETF_PROTO_UNKNOWN;
+  }
+}
+
+CURLcode Curl_gtls_cache_session(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 const char *ssl_peer_key,
+                                 gnutls_session_t session,
+                                 curl_off_t valid_until,
+                                 const char *alpn,
+                                 unsigned char *quic_tp,
+                                 size_t quic_tp_len)
+{
+  struct Curl_ssl_session *sc_session;
+  unsigned char *sdata, *qtp_clone = NULL;
+  size_t sdata_len = 0;
+  size_t earlydata_max = 0;
+  CURLcode result = CURLE_OK;
+
+  if(!Curl_ssl_scache_use(cf, data))
+    return CURLE_OK;
+
+  /* we always unconditionally get the session id here, as even if we
+     already got it from the cache and asked to use it in the connection, it
+     might have been rejected and then a new one is in use now and we need to
+     detect that. */
+
+  /* get the session ID data size */
+  gnutls_session_get_data(session, NULL, &sdata_len);
+  if(!sdata_len) /* GnuTLS does this for some version combinations */
+    return CURLE_OK;
+
+  sdata = curlx_malloc(sdata_len); /* get a buffer for it */
+  if(!sdata)
+    return CURLE_OUT_OF_MEMORY;
+
+  /* extract session ID to the allocated buffer */
+  gnutls_session_get_data(session, sdata, &sdata_len);
+  earlydata_max = gnutls_record_get_max_early_data_size(session);
+
+  CURL_TRC_CF(data, cf, "get session id (len=%zu, alpn=%s, earlymax=%zu) "
+              "and store in cache", sdata_len, alpn ? alpn : "-",
+              earlydata_max);
+  if(quic_tp && quic_tp_len) {
+    qtp_clone = curlx_memdup0((const char *)quic_tp, quic_tp_len);
+    if(!qtp_clone) {
+      curlx_free(sdata);
+      return CURLE_OUT_OF_MEMORY;
+    }
+  }
+
+  result = Curl_ssl_session_create2(sdata, sdata_len,
+                                    gtls_get_ietf_proto(session),
+                                    alpn, valid_until, earlydata_max,
+                                    qtp_clone, quic_tp_len,
+                                    &sc_session);
+  /* call took ownership of `sdata` and `qtp_clone` */
+  if(!result) {
+    result = Curl_ssl_scache_put(cf, data, ssl_peer_key, sc_session);
+    /* took ownership of `sc_session` */
+  }
+  return result;
+}
+#endif
+
+#ifdef CURL_GNUTLS_EARLY_DATA
+static CURLcode cf_gtls_update_session_id(struct Curl_cfilter *cf,
+                                          struct Curl_easy *data,
+                                          gnutls_session_t session)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  return Curl_gtls_cache_session(cf, data, connssl->peer.scache_key,
+                                 session, 0, connssl->negotiated.alpn,
+                                 NULL, 0);
+}
+
+static int gtls_handshake_cb(gnutls_session_t session, unsigned int htype,
+                             unsigned when, unsigned int incoming,
+                             const gnutls_datum_t *msg)
+{
+  struct Curl_cfilter *cf = gnutls_session_get_ptr(session);
+
+  (void)msg;
+  (void)incoming;
+  if(when) { /* after message has been processed */
+    struct Curl_easy *data = CF_DATA_CURRENT(cf);
+    if(data) {
+      CURL_TRC_CF(data, cf, "handshake: %s message type %u",
+                  incoming ? "incoming" : "outgoing", htype);
+      switch(htype) {
+      case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET: {
+        cf_gtls_update_session_id(cf, data, session);
+        break;
+      }
+      default:
+        break;
+      }
+    }
+  }
+  return 0;
+}
+#endif
+
+static CURLcode gtls_set_priority(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  struct gtls_ctx *gtls,
+                                  const char *priority)
+{
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  struct dynbuf buf;
+  const char *err = NULL;
+  CURLcode result = CURLE_OK;
+  int rc;
+
+  curlx_dyn_init(&buf, 4096);
+
+#ifdef USE_GNUTLS_SRP
+  if(conn_config->username) {
+    /* Only add SRP to the cipher list if SRP is requested. Otherwise
+     * GnuTLS disables TLS 1.3 support. */
+    result = curlx_dyn_add(&buf, priority);
+    if(!result)
+      result = curlx_dyn_add(&buf, ":" GNUTLS_SRP);
+    if(result)
+      goto out;
+    priority = curlx_dyn_ptr(&buf);
+  }
+#endif
+
+  if(conn_config->cipher_list) {
+    if((conn_config->cipher_list[0] == '+') ||
+       (conn_config->cipher_list[0] == '-') ||
+       (conn_config->cipher_list[0] == '!')) {
+      /* add it to our own */
+      if(!curlx_dyn_len(&buf)) {  /* not added yet */
+        result = curlx_dyn_add(&buf, priority);
+        if(result)
+          goto out;
+      }
+      result = curlx_dyn_addf(&buf, ":%s", conn_config->cipher_list);
+      if(result)
+        goto out;
+      priority = curlx_dyn_ptr(&buf);
+    }
+    else /* replace our own completely */
+      priority = conn_config->cipher_list;
+  }
+
+  infof(data, "GnuTLS priority: %s", priority);
+  rc = gnutls_priority_set_direct(gtls->session, priority, &err);
+  if(rc != GNUTLS_E_SUCCESS) {
+    failf(data, "Error %d setting GnuTLS priority: %s", rc, err);
+    result = CURLE_SSL_CONNECT_ERROR;
+  }
+
+out:
+  curlx_dyn_free(&buf);
+  return result;
+}
+
+static CURLcode gtls_client_init(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 struct ssl_peer *peer,
+                                 size_t earlydata_max,
+                                 struct gtls_ctx *gtls)
+{
+  struct ssl_primary_config *config = Curl_ssl_cf_get_primary_config(cf);
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
   unsigned int init_flags;
   int rc;
-  bool sni = TRUE; /* default is SNI enabled */
-#ifdef ENABLE_IPV6
-  struct in6_addr addr;
-#else
-  struct in_addr addr;
-#endif
   const char *prioritylist;
-  const char *err = NULL;
-  const char *tls13support;
+  bool tls13support;
   CURLcode result;
 
-  if(!gtls_inited)
-    gtls_init();
-
-  *pverifyresult = 0;
-
-  if(config->version == CURL_SSLVERSION_SSLv2) {
-    failf(data, "GnuTLS does not support SSLv2");
+  if(config->version == CURL_SSLVERSION_SSLv2 ||
+     config->version == CURL_SSLVERSION_SSLv3) {
+    failf(data, "GnuTLS does not support SSLv2 or SSLv3");
     return CURLE_SSL_CONNECT_ERROR;
   }
-  else if(config->version == CURL_SSLVERSION_SSLv3)
-    sni = FALSE; /* SSLv3 has no SNI */
 
-  /* allocate a cred struct */
-  rc = gnutls_certificate_allocate_credentials(&gtls->cred);
-  if(rc != GNUTLS_E_SUCCESS) {
-    failf(data, "gnutls_cert_all_cred() failed: %s", gnutls_strerror(rc));
-    return CURLE_SSL_CONNECT_ERROR;
-  }
+  /* allocate a shared creds struct */
+  result = Curl_gtls_shared_creds_create(data, &gtls->shared_creds);
+  if(result)
+    return result;
 
 #ifdef USE_GNUTLS_SRP
   if(config->username && Curl_auth_allowed_to_host(data)) {
     infof(data, "Using TLS-SRP username: %s", config->username);
 
     rc = gnutls_srp_allocate_client_credentials(&gtls->srp_client_cred);
-    if(rc != GNUTLS_E_SUCCESS) {
+    if(rc == GNUTLS_E_UNIMPLEMENTED_FEATURE) {
+      failf(data, "GnuTLS: TLS-SRP support not built in: %s",
+            gnutls_strerror(rc));
+      return CURLE_NOT_BUILT_IN;
+    }
+    else if(rc != GNUTLS_E_SUCCESS) {
       failf(data, "gnutls_srp_allocate_client_cred() failed: %s",
             gnutls_strerror(rc));
       return CURLE_OUT_OF_MEMORY;
@@ -460,92 +921,47 @@ CURLcode gtls_client_init(struct Curl_easy *data,
   }
 #endif
 
-  if(config->CAfile) {
-    /* set the trusted CA cert bundle file */
-    gnutls_certificate_set_verify_flags(gtls->cred,
-                                        GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT);
-
-    rc = gnutls_certificate_set_x509_trust_file(gtls->cred,
-                                                config->CAfile,
-                                                GNUTLS_X509_FMT_PEM);
-    if(rc < 0) {
-      infof(data, "error reading ca cert file %s (%s)",
-            config->CAfile, gnutls_strerror(rc));
-      if(config->verifypeer) {
-        *pverifyresult = rc;
-        return CURLE_SSL_CACERT_BADFILE;
-      }
-    }
-    else
-      infof(data, "found %d certificates in %s", rc, config->CAfile);
-  }
-
-  if(config->CApath) {
-    /* set the trusted CA cert directory */
-    rc = gnutls_certificate_set_x509_trust_dir(gtls->cred,
-                                               config->CApath,
-                                               GNUTLS_X509_FMT_PEM);
-    if(rc < 0) {
-      infof(data, "error reading ca cert file %s (%s)",
-            config->CApath, gnutls_strerror(rc));
-      if(config->verifypeer) {
-        *pverifyresult = rc;
-        return CURLE_SSL_CACERT_BADFILE;
-      }
-    }
-    else
-      infof(data, "found %d certificates in %s", rc, config->CApath);
-  }
-
-#ifdef CURL_CA_FALLBACK
-  /* use system ca certificate store as fallback */
-  if(config->verifypeer && !(config->CAfile || config->CApath)) {
-    /* this ignores errors on purpose */
-    gnutls_certificate_set_x509_system_trust(gtls->cred);
-  }
-#endif
-
-  if(config->CRLfile) {
-    /* set the CRL list file */
-    rc = gnutls_certificate_set_x509_crl_file(gtls->cred,
-                                              config->CRLfile,
-                                              GNUTLS_X509_FMT_PEM);
-    if(rc < 0) {
-      failf(data, "error reading crl file %s (%s)",
-            config->CRLfile, gnutls_strerror(rc));
-      return CURLE_SSL_CRL_BADFILE;
-    }
-    else
-      infof(data, "found %d CRL in %s", rc, config->CRLfile);
-  }
+  ssl_config->certverifyresult = 0;
 
   /* Initialize TLS session as a client */
   init_flags = GNUTLS_CLIENT;
+#ifdef CURL_GNUTLS_EARLY_DATA
+  if(peer->transport == TRNSPRT_QUIC && earlydata_max > 0)
+    init_flags |= GNUTLS_ENABLE_EARLY_DATA | GNUTLS_NO_END_OF_EARLY_DATA;
+  else if(earlydata_max > 0 && earlydata_max != 0xFFFFFFFFUL)
+    /* See https://gitlab.com/gnutls/gnutls/-/issues/1619
+     * We cannot differentiate between a session announcing no earldata
+     * and one announcing 0xFFFFFFFFUL. On TCP+TLS, this is unlikely, but
+     * on QUIC this is common. */
+    init_flags |= GNUTLS_ENABLE_EARLY_DATA;
+#endif
 
-#if defined(GNUTLS_FORCE_CLIENT_CERT)
+#ifdef GNUTLS_FORCE_CLIENT_CERT
   init_flags |= GNUTLS_FORCE_CLIENT_CERT;
 #endif
 
-#if defined(GNUTLS_NO_TICKETS)
-  /* Disable TLS session tickets */
-  init_flags |= GNUTLS_NO_TICKETS;
+#ifdef GNUTLS_NO_TICKETS_TLS12
+  init_flags |= GNUTLS_NO_TICKETS_TLS12;
 #endif
 
+#ifdef GNUTLS_NO_STATUS_REQUEST
+  if(!config->verifystatus)
+    /* Disable the "status_request" TLS extension, enabled by default since
+       GnuTLS 3.8.0. */
+    init_flags |= GNUTLS_NO_STATUS_REQUEST;
+#endif
+
+  CURL_TRC_CF(data, cf, "gnutls_init(flags=%x), earlydata=%zu",
+              init_flags, earlydata_max);
   rc = gnutls_init(&gtls->session, init_flags);
   if(rc != GNUTLS_E_SUCCESS) {
     failf(data, "gnutls_init() failed: %d", rc);
     return CURLE_SSL_CONNECT_ERROR;
   }
 
-  if((0 == Curl_inet_pton(AF_INET, hostname, &addr)) &&
-#ifdef ENABLE_IPV6
-     (0 == Curl_inet_pton(AF_INET6, hostname, &addr)) &&
-#endif
-     sni) {
-    size_t snilen;
-    char *snihost = Curl_ssl_snihost(data, hostname, &snilen);
-    if(!snihost || gnutls_server_name_set(gtls->session, GNUTLS_NAME_DNS,
-                                          snihost, snilen) < 0) {
+  if(peer->sni) {
+    if(gnutls_server_name_set(gtls->session, GNUTLS_NAME_DNS,
+                              peer->sni, strlen(peer->sni)) < 0) {
       failf(data, "Failed to set SNI");
       return CURLE_SSL_CONNECT_ERROR;
     }
@@ -557,17 +973,7 @@ CURLcode gtls_client_init(struct Curl_easy *data,
     return CURLE_SSL_CONNECT_ERROR;
 
   /* "In GnuTLS 3.6.5, TLS 1.3 is enabled by default" */
-  tls13support = gnutls_check_version("3.6.5");
-
-  /* Ensure +SRP comes at the *end* of all relevant strings so that it can be
-   * removed if a run-time error indicates that SRP is not supported by this
-   * GnuTLS version */
-
-  if(config->version == CURL_SSLVERSION_SSLv2 ||
-     config->version == CURL_SSLVERSION_SSLv3) {
-    failf(data, "GnuTLS does not support SSLv2 or SSLv3");
-    return CURLE_SSL_CONNECT_ERROR;
-  }
+  tls13support = !!gnutls_check_version("3.6.5");
 
   if(config->version == CURL_SSLVERSION_TLSv1_3) {
     if(!tls13support) {
@@ -577,74 +983,56 @@ CURLcode gtls_client_init(struct Curl_easy *data,
   }
 
   /* At this point we know we have a supported TLS version, so set it */
-  result = set_ssl_version_min_max(data, config, &prioritylist, tls13support);
+  result = gnutls_set_ssl_version_min_max(data, peer,
+                                          config, &prioritylist, tls13support);
   if(result)
     return result;
 
-#ifdef USE_GNUTLS_SRP
-  /* Only add SRP to the cipher list if SRP is requested. Otherwise
-   * GnuTLS will disable TLS 1.3 support. */
-  if(config->username) {
-    size_t len = strlen(prioritylist);
-
-    char *prioritysrp = malloc(len + sizeof(GNUTLS_SRP) + 1);
-    if(!prioritysrp)
-      return CURLE_OUT_OF_MEMORY;
-    strcpy(prioritysrp, prioritylist);
-    strcpy(prioritysrp + len, ":" GNUTLS_SRP);
-    rc = gnutls_priority_set_direct(gtls->session, prioritysrp, &err);
-    free(prioritysrp);
-
-    if((rc == GNUTLS_E_INVALID_REQUEST) && err) {
-      infof(data, "This GnuTLS does not support SRP");
-    }
-  }
-  else {
-#endif
-    infof(data, "GnuTLS ciphers: %s", prioritylist);
-    rc = gnutls_priority_set_direct(gtls->session, prioritylist, &err);
-#ifdef USE_GNUTLS_SRP
-  }
-#endif
-
-  if(rc != GNUTLS_E_SUCCESS) {
-    failf(data, "Error %d setting GnuTLS cipher list starting with %s",
-          rc, err);
-    return CURLE_SSL_CONNECT_ERROR;
-  }
+  result = gtls_set_priority(cf, data, gtls, prioritylist);
+  if(result)
+    return result;
 
   if(config->clientcert) {
-    if(ssl_config->key_passwd) {
+    if(!gtls->shared_creds->trust_setup) {
+      result = Curl_gtls_client_trust_setup(cf, data, gtls);
+      if(result)
+        return result;
+    }
+    if(ssl_config->primary.cert_type &&
+       curl_strequal(ssl_config->primary.cert_type, "P12")) {
+      rc = gnutls_certificate_set_x509_simple_pkcs12_file(
+        gtls->shared_creds->creds, config->clientcert, GNUTLS_X509_FMT_DER,
+        ssl_config->primary.key_passwd ? ssl_config->primary.key_passwd : "");
+      if(rc != GNUTLS_E_SUCCESS) {
+        failf(data,
+              "error reading X.509 potentially-encrypted key or certificate "
+              "file: %s",
+              gnutls_strerror(rc));
+        return CURLE_SSL_CONNECT_ERROR;
+      }
+    }
+    else {
       const unsigned int supported_key_encryption_algorithms =
         GNUTLS_PKCS_USE_PKCS12_3DES | GNUTLS_PKCS_USE_PKCS12_ARCFOUR |
         GNUTLS_PKCS_USE_PKCS12_RC2_40 | GNUTLS_PKCS_USE_PBES2_3DES |
         GNUTLS_PKCS_USE_PBES2_AES_128 | GNUTLS_PKCS_USE_PBES2_AES_192 |
         GNUTLS_PKCS_USE_PBES2_AES_256;
       rc = gnutls_certificate_set_x509_key_file2(
-           gtls->cred,
+           gtls->shared_creds->creds,
            config->clientcert,
-           ssl_config->key ? ssl_config->key : config->clientcert,
-           do_file_type(ssl_config->cert_type),
-           ssl_config->key_passwd,
+           ssl_config->primary.key ? ssl_config->primary.key :
+                                     config->clientcert,
+           gnutls_do_file_type(ssl_config->primary.cert_type),
+           ssl_config->primary.key_passwd,
            supported_key_encryption_algorithms);
       if(rc != GNUTLS_E_SUCCESS) {
         failf(data,
-              "error reading X.509 potentially-encrypted key file: %s",
+              "error reading X.509 %skey file: %s",
+              ssl_config->primary.key_passwd ? "potentially-encrypted " : "",
               gnutls_strerror(rc));
         return CURLE_SSL_CONNECT_ERROR;
       }
     }
-    else {
-      if(gnutls_certificate_set_x509_key_file(
-           gtls->cred,
-           config->clientcert,
-           ssl_config->key ? ssl_config->key : config->clientcert,
-           do_file_type(ssl_config->cert_type) ) !=
-         GNUTLS_E_SUCCESS) {
-        failf(data, "error reading X.509 key or certificate file");
-        return CURLE_SSL_CONNECT_ERROR;
-      }
-    }
   }
 
 #ifdef USE_GNUTLS_SRP
@@ -661,7 +1049,7 @@ CURLcode gtls_client_init(struct Curl_easy *data,
 #endif
   {
     rc = gnutls_credentials_set(gtls->session, GNUTLS_CRD_CERTIFICATE,
-                                gtls->cred);
+                                gtls->shared_creds->creds);
     if(rc != GNUTLS_E_SUCCESS) {
       failf(data, "gnutls_credentials_set() failed: %s", gnutls_strerror(rc));
       return CURLE_SSL_CONNECT_ERROR;
@@ -680,15 +1068,160 @@ CURLcode gtls_client_init(struct Curl_easy *data,
   return CURLE_OK;
 }
 
-static CURLcode
-gtls_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
+#ifdef CURL_GNUTLS_EARLY_DATA
+static int keylog_callback(gnutls_session_t session, const char *label,
+                           const gnutls_datum_t *secret)
+{
+  gnutls_datum_t crandom;
+  gnutls_datum_t srandom;
+
+  gnutls_session_get_random(session, &crandom, &srandom);
+  if(crandom.size != 32) {
+    return -1;
+  }
+
+  Curl_tls_keylog_write(label, crandom.data, secret->data, secret->size);
+  return 0;
+}
+
+static CURLcode gtls_on_session_reuse(struct Curl_cfilter *cf,
+                                      struct Curl_easy *data,
+                                      struct alpn_spec *alpns,
+                                      struct Curl_ssl_session *scs,
+                                      bool *do_early_data)
 {
   struct ssl_connect_data *connssl = cf->ctx;
   struct gtls_ssl_backend_data *backend =
     (struct gtls_ssl_backend_data *)connssl->backend;
+
+  connssl->earlydata_max =
+    gnutls_record_get_max_early_data_size(backend->gtls.session);
+
+  /* Seems to be no GnuTLS way to signal no EarlyData in session */
+  return Curl_on_session_reuse(cf, data, alpns, scs, do_early_data,
+                               connssl->earlydata_max &&
+                               connssl->earlydata_max != 0xFFFFFFFFUL);
+}
+#endif
+
+CURLcode Curl_gtls_ctx_init(struct gtls_ctx *gctx,
+                            struct Curl_cfilter *cf,
+                            struct Curl_easy *data,
+                            struct ssl_peer *peer,
+                            const struct alpn_spec *alpns_requested,
+                            Curl_gtls_ctx_setup_cb *cb_setup,
+                            void *cb_user_data,
+                            void *ssl_user_data,
+                            Curl_gtls_init_session_reuse_cb *sess_reuse_cb)
+{
   struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
   struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
-  long * const pverifyresult = &ssl_config->certverifyresult;
+  struct Curl_ssl_session *scs = NULL;
+  gnutls_datum_t gtls_alpns[ALPN_ENTRIES_MAX];
+  size_t gtls_alpns_count = 0;
+  bool gtls_session_setup = FALSE;
+  struct alpn_spec alpns;
+  CURLcode result = CURLE_OK;
+  int rc;
+
+  DEBUGASSERT(gctx);
+  Curl_alpn_copy(&alpns, alpns_requested);
+
+  /* This might be a reconnect, so we check for a session ID in the cache
+     to speed up things. We need to do this before constructing the GnuTLS
+     session since we need to set flags depending on the kind of reuse. */
+  if(conn_config->cache_session && !conn_config->verifystatus) {
+    result = Curl_ssl_scache_take(cf, data, peer->scache_key, &scs);
+    if(result)
+      goto out;
+
+    if(scs && scs->sdata && scs->sdata_len &&
+       (!scs->alpn || Curl_alpn_contains_proto(&alpns, scs->alpn))) {
+      /* we got a cached session, use it! */
+
+      result = gtls_client_init(cf, data, peer, scs->earlydata_max, gctx);
+      if(result)
+        goto out;
+      gtls_session_setup = TRUE;
+
+      rc = gnutls_session_set_data(gctx->session, scs->sdata, scs->sdata_len);
+      if(rc < 0)
+        infof(data, "SSL session not accepted by GnuTLS, continuing without");
+      else {
+        infof(data, "SSL reusing session with ALPN '%s'",
+              scs->alpn ? scs->alpn : "-");
+        if(ssl_config->earlydata && scs->alpn &&
+           !cf->conn->bits.connect_only) {
+          bool do_early_data = FALSE;
+          if(sess_reuse_cb) {
+            result = sess_reuse_cb(cf, data, &alpns, scs, &do_early_data);
+            if(result)
+              goto out;
+          }
+          if(do_early_data) {
+            /* We only try the ALPN protocol the session used before,
+             * otherwise we might send early data for the wrong protocol */
+            Curl_alpn_restrict_to(&alpns, scs->alpn);
+          }
+        }
+      }
+    }
+  }
+
+  if(!gtls_session_setup) {
+    result = gtls_client_init(cf, data, peer, 0, gctx);
+    if(result)
+      goto out;
+  }
+
+  gnutls_session_set_ptr(gctx->session, ssl_user_data);
+
+  if(cb_setup) {
+    result = cb_setup(cf, data, cb_user_data);
+    if(result)
+      goto out;
+  }
+
+#ifdef CURL_GNUTLS_EARLY_DATA
+  /* Open the file if a TLS or QUIC backend has not done this before. */
+  Curl_tls_keylog_open();
+  if(Curl_tls_keylog_enabled()) {
+    gnutls_session_set_keylog_function(gctx->session, keylog_callback);
+  }
+#endif
+
+  /* convert the ALPN string from our arguments to a list of strings that
+   * GnuTLS wants and does convert internally back to this string for sending
+   * to the server. nice. */
+  if(!gtls_alpns_count && alpns.count) {
+    size_t i;
+    DEBUGASSERT(CURL_ARRAYSIZE(gtls_alpns) >= alpns.count);
+    for(i = 0; i < alpns.count; ++i) {
+      gtls_alpns[i].data = (unsigned char *)alpns.entries[i];
+      gtls_alpns[i].size = (unsigned int)strlen(alpns.entries[i]);
+    }
+    gtls_alpns_count = alpns.count;
+  }
+
+  if(gtls_alpns_count &&
+     gnutls_alpn_set_protocols(gctx->session,
+                               gtls_alpns, (unsigned int)gtls_alpns_count,
+                               GNUTLS_ALPN_MANDATORY)) {
+    failf(data, "failed setting ALPN");
+    result = CURLE_SSL_CONNECT_ERROR;
+  }
+
+out:
+  Curl_ssl_scache_return(cf, data, peer->scache_key, scs);
+  return result;
+}
+
+static CURLcode gtls_connect_step1(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct gtls_ssl_backend_data *backend =
+    (struct gtls_ssl_backend_data *)connssl->backend;
   CURLcode result;
 
   DEBUGASSERT(backend);
@@ -698,47 +1231,30 @@ gtls_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
        same connection */
     return CURLE_OK;
 
-  result = gtls_client_init(data, conn_config, ssl_config,
-                            connssl->hostname,
-                            &backend->gtls, pverifyresult);
+  result = Curl_gtls_ctx_init(&backend->gtls, cf, data, &connssl->peer,
+                              connssl->alpn, NULL, NULL, cf,
+#ifdef CURL_GNUTLS_EARLY_DATA
+                              gtls_on_session_reuse
+#else
+                              NULL
+#endif
+                              );
+
   if(result)
     return result;
 
-  if(connssl->alpn) {
+  if(connssl->alpn && (connssl->state != ssl_connection_deferred)) {
     struct alpn_proto_buf proto;
-    gnutls_datum_t alpn[ALPN_ENTRIES_MAX];
-    size_t i;
-
-    for(i = 0; i < connssl->alpn->count; ++i) {
-      alpn[i].data = (unsigned char *)connssl->alpn->entries[i];
-      alpn[i].size = (unsigned)strlen(connssl->alpn->entries[i]);
-    }
-    if(gnutls_alpn_set_protocols(backend->gtls.session, alpn,
-                                 (unsigned)connssl->alpn->count, 0)) {
-      failf(data, "failed setting ALPN");
-      return CURLE_SSL_CONNECT_ERROR;
-    }
+    memset(&proto, 0, sizeof(proto));
     Curl_alpn_to_proto_str(&proto, connssl->alpn);
     infof(data, VTLS_INFOF_ALPN_OFFER_1STR, proto.data);
   }
 
-  /* This might be a reconnect, so we check for a session ID in the cache
-     to speed up things */
-  if(conn_config->sessionid) {
-    void *ssl_sessionid;
-    size_t ssl_idsize;
-
-    Curl_ssl_sessionid_lock(data);
-    if(!Curl_ssl_getsessionid(cf, data, &ssl_sessionid, &ssl_idsize)) {
-      /* we got a session id, use it! */
-      gnutls_session_set_data(backend->gtls.session,
-                              ssl_sessionid, ssl_idsize);
-
-      /* Informational message */
-      infof(data, "SSL reusing session ID");
-    }
-    Curl_ssl_sessionid_unlock(data);
-  }
+#ifdef CURL_GNUTLS_EARLY_DATA
+  gnutls_handshake_set_hook_function(backend->gtls.session,
+                                     GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST,
+                                     gtls_handshake_cb);
+#endif
 
   /* register callback functions and handle to send and receive data. */
   gnutls_transport_set_ptr(backend->gtls.session, cf);
@@ -761,7 +1277,7 @@ static CURLcode pkp_pin_peer_pubkey(struct Curl_easy *data,
   /* Result is returned to caller */
   CURLcode result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
 
-  /* if a path wasn't specified, don't pin */
+  /* if a path was not specified, do not pin */
   if(!pinnedpubkey)
     return CURLE_OK;
 
@@ -771,8 +1287,10 @@ static CURLcode pkp_pin_peer_pubkey(struct Curl_easy *data,
   do {
     int ret;
 
-    /* Begin Gyrations to get the public key     */
-    gnutls_pubkey_init(&key);
+    /* Begin Gyrations to get the public key */
+    ret = gnutls_pubkey_init(&key);
+    if(ret < 0)
+      break; /* failed */
 
     ret = gnutls_pubkey_import_x509(key, cert, 0);
     if(ret < 0)
@@ -782,7 +1300,7 @@ static CURLcode pkp_pin_peer_pubkey(struct Curl_easy *data,
     if(ret != GNUTLS_E_SHORT_MEMORY_BUFFER || len1 == 0)
       break; /* failed */
 
-    buff1 = malloc(len1);
+    buff1 = curlx_malloc(len1);
     if(!buff1)
       break; /* failed */
 
@@ -801,55 +1319,359 @@ static CURLcode pkp_pin_peer_pubkey(struct Curl_easy *data,
   if(key)
     gnutls_pubkey_deinit(key);
 
-  Curl_safefree(buff1);
+  curlx_safefree(buff1);
 
   return result;
 }
 
-CURLcode
-Curl_gtls_verifyserver(struct Curl_easy *data,
-                       gnutls_session_t session,
-                       struct ssl_primary_config *config,
-                       struct ssl_config_data *ssl_config,
-                       const char *hostname,
-                       const char *dispname,
-                       const char *pinned_key)
+void Curl_gtls_report_handshake(struct Curl_easy *data, struct gtls_ctx *gctx)
+{
+#ifdef CURLVERBOSE
+  if(Curl_trc_is_verbose(data)) {
+    const char *ptr;
+    gnutls_protocol_t version = gnutls_protocol_get_version(gctx->session);
+
+    /* the name of the cipher suite used, e.g. ECDHE_RSA_AES_256_GCM_SHA384. */
+    ptr = gnutls_cipher_suite_get_name(gnutls_kx_get(gctx->session),
+                                       gnutls_cipher_get(gctx->session),
+                                       gnutls_mac_get(gctx->session));
+
+    infof(data, "SSL connection using %s / %s",
+          gnutls_protocol_get_name(version), ptr);
+  }
+#else
+  (void)data;
+  (void)gctx;
+#endif
+}
+
+static void gtls_msg_verify_result(struct Curl_easy *data,
+                                   struct ssl_peer *peer,
+                                   gnutls_x509_crt_t x509_cert,
+                                   bool was_verified,
+                                   bool needs_verified)
 {
-  unsigned int cert_list_size;
-  const gnutls_datum_t *chainp;
-  unsigned int verify_status = 0;
-  gnutls_x509_crt_t x509_cert, x509_issuer;
-  gnutls_datum_t issuerp;
-  gnutls_datum_t certfields;
   char certname[65] = ""; /* limited to 64 chars by ASN.1 */
-  size_t size;
+  size_t size = sizeof(certname);
+  int rc;
+
+  rc = gnutls_x509_crt_get_dn_by_oid(x509_cert, GNUTLS_OID_X520_COMMON_NAME,
+                                     0, /* the first and only one */
+                                     FALSE, certname, &size);
+  if(rc) {
+    infof(data, "error fetching CN from cert:%s", gnutls_strerror(rc));
+    certname[0] = 0;
+  }
+
+  if(!was_verified) {
+    if(needs_verified) {
+      failf(data, "SSL: certificate subject name (%s) does not match "
+            "target hostname '%s'", certname,
+            peer->origin->user_hostname);
+    }
+    else
+      infof(data, "  common name: %s (does not match '%s')",
+            certname, peer->origin->user_hostname);
+  }
+  else
+    infof(data, "  common name: %s (matched)", certname);
+}
+
+static void gtls_infof_cert(struct Curl_easy *data,
+                            gnutls_x509_crt_t x509_cert)
+{
+#ifdef CURLVERBOSE
+  if(Curl_trc_is_verbose(data)) {
+    gnutls_datum_t certfields;
+    int rc, algo;
+    time_t tstamp;
+    unsigned int bits;
+
+    /* public key algorithm's parameters */
+    algo = gnutls_x509_crt_get_pk_algorithm(x509_cert, &bits);
+    infof(data, "  certificate public key: %s",
+          gnutls_pk_algorithm_get_name((gnutls_pk_algorithm_t)algo));
+
+    /* version of the X.509 certificate. */
+    infof(data, "  certificate version: #%d",
+          gnutls_x509_crt_get_version(x509_cert));
+
+    rc = gnutls_x509_crt_get_dn2(x509_cert, &certfields);
+    if(rc)
+      infof(data, "Failed to get certificate name");
+    else {
+      infof(data, "  subject: %s", certfields.data);
+
+      tstamp = gnutls_x509_crt_get_activation_time(x509_cert);
+      showtime(data, "start date", tstamp);
+
+      tstamp = gnutls_x509_crt_get_expiration_time(x509_cert);
+      showtime(data, "expire date", tstamp);
+
+      gnutls_free(certfields.data);
+    }
+
+    rc = gnutls_x509_crt_get_issuer_dn2(x509_cert, &certfields);
+    if(rc)
+      infof(data, "Failed to get certificate issuer");
+    else {
+      infof(data, "  issuer: %s", certfields.data);
+
+      gnutls_free(certfields.data);
+    }
+  }
+#else
+  (void)data;
+  (void)x509_cert;
+#endif
+}
+
+static CURLcode gtls_verify_ocsp_status(struct Curl_easy *data,
+                                        gnutls_session_t session)
+{
+  gnutls_ocsp_resp_t ocsp_resp = NULL;
+  gnutls_datum_t status_request;
+  gnutls_certificate_credentials_t creds = NULL;
+  gnutls_x509_trust_list_t tlist = NULL;
+  unsigned int verify_status = 0;
+  gnutls_ocsp_cert_status_t status = GNUTLS_OCSP_CERT_UNKNOWN;
+  gnutls_x509_crl_reason_t reason;
+  CURLcode result = CURLE_OK;
+  int rc;
+
+  rc = gnutls_ocsp_status_request_get(session, &status_request);
+
+  if(rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
+    failf(data, "No OCSP response received");
+    result = CURLE_SSL_INVALIDCERTSTATUS;
+    goto out;
+  }
+  else if(rc < 0) {
+    failf(data, "Invalid OCSP response received");
+    result = CURLE_SSL_INVALIDCERTSTATUS;
+    goto out;
+  }
+
+  rc = gnutls_ocsp_resp_init(&ocsp_resp);
+  if(rc < 0) {
+    failf(data, "Failed to initialize OCSP response object");
+    result = CURLE_SSL_INVALIDCERTSTATUS;
+    goto out;
+  }
+
+  rc = gnutls_ocsp_resp_import(ocsp_resp, &status_request);
+  if(rc < 0) {
+    failf(data, "Invalid OCSP response received");
+    result = CURLE_SSL_INVALIDCERTSTATUS;
+    goto out;
+  }
+
+  if(!gnutls_credentials_get(session, GNUTLS_CRD_CERTIFICATE, (void **)&creds))
+    gnutls_certificate_get_trust_list(creds, &tlist);
+  if(!tlist) {
+    failf(data, "OCSP response signature verification failed");
+    result = CURLE_SSL_INVALIDCERTSTATUS;
+    goto out;
+  }
+  rc = gnutls_ocsp_resp_verify(ocsp_resp, tlist, &verify_status, 0);
+  if(rc < 0 || verify_status) {
+    failf(data, "OCSP response signature verification failed");
+    result = CURLE_SSL_INVALIDCERTSTATUS;
+    goto out;
+  }
+
+  (void)gnutls_ocsp_resp_get_single(ocsp_resp, 0, NULL, NULL, NULL, NULL,
+                                    &status, NULL, NULL, NULL, &reason);
+
+  switch(status) {
+  case GNUTLS_OCSP_CERT_GOOD:
+    break;
+
+  case GNUTLS_OCSP_CERT_REVOKED: {
+    const char *crl_reason;
+
+    switch(reason) {
+    default:
+    case GNUTLS_X509_CRLREASON_UNSPECIFIED:
+      crl_reason = "unspecified reason";
+      break;
+
+    case GNUTLS_X509_CRLREASON_KEYCOMPROMISE:
+      crl_reason = "private key compromised";
+      break;
+
+    case GNUTLS_X509_CRLREASON_CACOMPROMISE:
+      crl_reason = "CA compromised";
+      break;
+
+    case GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED:
+      crl_reason = "affiliation has changed";
+      break;
+
+    case GNUTLS_X509_CRLREASON_SUPERSEDED:
+      crl_reason = "certificate superseded";
+      break;
+
+    case GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION:
+      crl_reason = "operation has ceased";
+      break;
+
+    case GNUTLS_X509_CRLREASON_CERTIFICATEHOLD:
+      crl_reason = "certificate is on hold";
+      break;
+
+    case GNUTLS_X509_CRLREASON_REMOVEFROMCRL:
+      crl_reason = "will be removed from delta CRL";
+      break;
+
+    case GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN:
+      crl_reason = "privilege withdrawn";
+      break;
+
+    case GNUTLS_X509_CRLREASON_AACOMPROMISE:
+      crl_reason = "AA compromised";
+      break;
+    }
+
+    failf(data, "Server certificate was revoked: %s", crl_reason);
+    break;
+  }
+
+  default:
+  case GNUTLS_OCSP_CERT_UNKNOWN:
+    failf(data, "Server certificate status is unknown");
+    break;
+  }
+
+  result = (status != GNUTLS_OCSP_CERT_GOOD) ?
+           CURLE_SSL_INVALIDCERTSTATUS : CURLE_OK;
+
+out:
+  if(ocsp_resp)
+    gnutls_ocsp_resp_deinit(ocsp_resp);
+  return result;
+}
+
+struct gtls_cert_chain {
+  const gnutls_datum_t *certs;
+  unsigned int num_certs;
+};
+
+#ifdef USE_APPLE_SECTRUST
+static CURLcode gtls_chain_get_der(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data,
+                                   void *user_data,
+                                   size_t i,
+                                   unsigned char **pder,
+                                   size_t *pder_len)
+{
+  struct gtls_cert_chain *chain = user_data;
+
+  (void)cf;
+  (void)data;
+  *pder_len = 0;
+  *pder = NULL;
+
+  if(i >= chain->num_certs)
+    return CURLE_TOO_LARGE;
+  *pder = chain->certs[i].data;
+  *pder_len = (size_t)chain->certs[i].size;
+  return CURLE_OK;
+}
+#endif /* USE_APPLE_SECTRUST */
+
+/* This function verifies the peer's certificate and returns CURLE_OK on
+   success or an appropriate CURLcode on error. The certificate verification
+   status bitmask (trusted, invalid etc.) is stored in
+   ssl_config->certverifyresult as one or more gnutls_certificate_status_t
+   enumerated elements bitwise or'd. */
+static CURLcode gtls_verify_cert(struct Curl_easy *data,
+                                 struct ssl_primary_config *config,
+                                 struct ssl_config_data *ssl_config,
+                                 gnutls_session_t session,
+                                 struct Curl_cfilter *cf,
+                                 struct ssl_peer *peer,
+                                 struct gtls_cert_chain *chain)
+{
+  bool verified = FALSE;
+  unsigned int verify_status = 0;
+  long * const certverifyresult = &ssl_config->certverifyresult;
+  int rc = gnutls_certificate_verify_peers2(session, &verify_status);
+  if(rc < 0) {
+    failf(data, "server cert verify failed: %d", rc);
+    *certverifyresult = rc;
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+  *certverifyresult = verify_status;
+  verified = !(verify_status & GNUTLS_CERT_INVALID);
+  if(verified)
+    infof(data, "  SSL certificate verified by GnuTLS");
+
+#ifdef USE_APPLE_SECTRUST
+  if(!verified && ssl_config->native_ca_store) {
+    CURLcode result =
+      Curl_vtls_apple_verify(cf, data, peer, chain->num_certs,
+                             gtls_chain_get_der, chain, NULL, 0);
+    if(result && (result != CURLE_PEER_FAILED_VERIFICATION))
+      return result; /* unexpected error */
+    verified = !result;
+    if(verified) {
+      infof(data, "SSL certificate verified via Apple SecTrust.");
+      *certverifyresult = 0;
+    }
+  }
+#else
+  (void)cf;
+  (void)peer;
+  (void)chain;
+#endif
+
+  if(!verified) {
+    /* verify_status is a bitmask of gnutls_certificate_status bits */
+    const char *cause = "certificate error, no details available";
+    if(verify_status & GNUTLS_CERT_EXPIRED)
+      cause = "certificate has expired";
+    else if(verify_status & GNUTLS_CERT_SIGNER_NOT_FOUND)
+      cause = "certificate signer not trusted";
+    else if(verify_status & GNUTLS_CERT_INSECURE_ALGORITHM)
+      cause = "certificate uses insecure algorithm";
+    else if(verify_status & GNUTLS_CERT_INVALID_OCSP_STATUS)
+      cause = "attached OCSP status response is invalid";
+    failf(data, "SSL certificate verification failed: %s. (CAfile: %s "
+          "CRLfile: %s)", cause,
+          config->CAfile ? config->CAfile : "none",
+          ssl_config->primary.CRLfile ?
+          ssl_config->primary.CRLfile : "none");
+
+    return CURLE_PEER_FAILED_VERIFICATION;
+  }
+  return CURLE_OK;
+}
+
+CURLcode Curl_gtls_verifyserver(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                gnutls_session_t session,
+                                struct ssl_primary_config *config,
+                                struct ssl_config_data *ssl_config,
+                                struct ssl_peer *peer,
+                                const char *pinned_key)
+{
+  struct gtls_cert_chain chain;
+  gnutls_x509_crt_t x509_cert = NULL, x509_issuer = NULL;
   time_t certclock;
-  const char *ptr;
   int rc;
   CURLcode result = CURLE_OK;
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-  unsigned int algo;
-  unsigned int bits;
-  gnutls_protocol_t version = gnutls_protocol_get_version(session);
-#endif
   long * const certverifyresult = &ssl_config->certverifyresult;
 
-  /* the name of the cipher suite used, e.g. ECDHE_RSA_AES_256_GCM_SHA384. */
-  ptr = gnutls_cipher_suite_get_name(gnutls_kx_get(session),
-                                     gnutls_cipher_get(session),
-                                     gnutls_mac_get(session));
-
-  infof(data, "SSL connection using %s / %s",
-        gnutls_protocol_get_name(version), ptr);
-
-  /* This function will return the peer's raw certificate (chain) as sent by
+  (void)cf;
+  /* This function returns the peer's raw certificate (chain) as sent by
      the peer. These certificates are in raw format (DER encoded for
      X.509). In case of a X.509 then a certificate list may be present. The
      first certificate in the list is the peer's certificate, following the
      issuer's certificate, then the issuer's issuer etc. */
 
-  chainp = gnutls_certificate_get_peers(session, &cert_list_size);
-  if(!chainp) {
+  chain.certs = gnutls_certificate_get_peers(session, &chain.num_certs);
+  if(!chain.certs) {
     if(config->verifypeer ||
        config->verifyhost ||
        config->issuercert) {
@@ -863,267 +1685,68 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
 #endif
         failf(data, "failed to get server cert");
         *certverifyresult = GNUTLS_E_NO_CERTIFICATE_FOUND;
-        return CURLE_PEER_FAILED_VERIFICATION;
+        result = CURLE_PEER_FAILED_VERIFICATION;
+        goto out;
 #ifdef USE_GNUTLS_SRP
       }
 #endif
     }
-    infof(data, " common name: WARNING couldn't obtain");
+    infof(data, " common name: WARNING could not obtain");
   }
 
-  if(data->set.ssl.certinfo && chainp) {
-    unsigned int i;
+  if(data->set.ssl.certinfo && chain.certs) {
+    if(chain.num_certs > MAX_ALLOWED_CERT_AMOUNT) {
+      failf(data, "%u certificates is more than allowed (%d)",
+            chain.num_certs, MAX_ALLOWED_CERT_AMOUNT);
+      result = CURLE_SSL_CONNECT_ERROR;
+      goto out;
+    }
+    else {
+      unsigned int i;
 
-    result = Curl_ssl_init_certinfo(data, cert_list_size);
-    if(result)
-      return result;
-
-    for(i = 0; i < cert_list_size; i++) {
-      const char *beg = (const char *) chainp[i].data;
-      const char *end = beg + chainp[i].size;
-
-      result = Curl_extract_certinfo(data, i, beg, end);
+      result = Curl_ssl_init_certinfo(data, (int)chain.num_certs);
       if(result)
-        return result;
+        goto out;
+
+      for(i = 0; i < chain.num_certs; i++) {
+        const char *beg = (const char *)chain.certs[i].data;
+        const char *end = beg + chain.certs[i].size;
+
+        result = Curl_extract_certinfo(data, (int)i, beg, end);
+        if(result)
+          goto out;
+      }
     }
   }
 
   if(config->verifypeer) {
-    /* This function will try to verify the peer's certificate and return its
-       status (trusted, invalid etc.). The value of status should be one or
-       more of the gnutls_certificate_status_t enumerated elements bitwise
-       or'd. To avoid denial of service attacks some default upper limits
-       regarding the certificate key size and chain size are set. To override
-       them use gnutls_certificate_set_verify_limits(). */
-
-    rc = gnutls_certificate_verify_peers2(session, &verify_status);
-    if(rc < 0) {
-      failf(data, "server cert verify failed: %d", rc);
-      *certverifyresult = rc;
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-
-    *certverifyresult = verify_status;
-
-    /* verify_status is a bitmask of gnutls_certificate_status bits */
-    if(verify_status & GNUTLS_CERT_INVALID) {
-      if(config->verifypeer) {
-        failf(data, "server certificate verification failed. CAfile: %s "
-              "CRLfile: %s", config->CAfile ? config->CAfile:
-              "none",
-              ssl_config->primary.CRLfile ?
-              ssl_config->primary.CRLfile : "none");
-        return CURLE_PEER_FAILED_VERIFICATION;
-      }
-      else
-        infof(data, "  server certificate verification FAILED");
-    }
-    else
-      infof(data, "  server certificate verification OK");
+    result = gtls_verify_cert(data, config, ssl_config, session,
+                              cf, peer, &chain);
+    if(result)
+      goto out;
   }
   else
-    infof(data, "  server certificate verification SKIPPED");
-
-  if(config->verifystatus) {
-    if(gnutls_ocsp_status_request_is_checked(session, 0) == 0) {
-      gnutls_datum_t status_request;
-      gnutls_ocsp_resp_t ocsp_resp;
-
-      gnutls_ocsp_cert_status_t status;
-      gnutls_x509_crl_reason_t reason;
-
-      rc = gnutls_ocsp_status_request_get(session, &status_request);
-
-      infof(data, " server certificate status verification FAILED");
-
-      if(rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
-        failf(data, "No OCSP response received");
-        return CURLE_SSL_INVALIDCERTSTATUS;
-      }
-
-      if(rc < 0) {
-        failf(data, "Invalid OCSP response received");
-        return CURLE_SSL_INVALIDCERTSTATUS;
-      }
-
-      gnutls_ocsp_resp_init(&ocsp_resp);
-
-      rc = gnutls_ocsp_resp_import(ocsp_resp, &status_request);
-      if(rc < 0) {
-        failf(data, "Invalid OCSP response received");
-        return CURLE_SSL_INVALIDCERTSTATUS;
-      }
-
-      (void)gnutls_ocsp_resp_get_single(ocsp_resp, 0, NULL, NULL, NULL, NULL,
-                                        &status, NULL, NULL, NULL, &reason);
-
-      switch(status) {
-      case GNUTLS_OCSP_CERT_GOOD:
-        break;
-
-      case GNUTLS_OCSP_CERT_REVOKED: {
-        const char *crl_reason;
-
-        switch(reason) {
-          default:
-          case GNUTLS_X509_CRLREASON_UNSPECIFIED:
-            crl_reason = "unspecified reason";
-            break;
-
-          case GNUTLS_X509_CRLREASON_KEYCOMPROMISE:
-            crl_reason = "private key compromised";
-            break;
-
-          case GNUTLS_X509_CRLREASON_CACOMPROMISE:
-            crl_reason = "CA compromised";
-            break;
-
-          case GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED:
-            crl_reason = "affiliation has changed";
-            break;
-
-          case GNUTLS_X509_CRLREASON_SUPERSEDED:
-            crl_reason = "certificate superseded";
-            break;
-
-          case GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION:
-            crl_reason = "operation has ceased";
-            break;
-
-          case GNUTLS_X509_CRLREASON_CERTIFICATEHOLD:
-            crl_reason = "certificate is on hold";
-            break;
-
-          case GNUTLS_X509_CRLREASON_REMOVEFROMCRL:
-            crl_reason = "will be removed from delta CRL";
-            break;
-
-          case GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN:
-            crl_reason = "privilege withdrawn";
-            break;
-
-          case GNUTLS_X509_CRLREASON_AACOMPROMISE:
-            crl_reason = "AA compromised";
-            break;
-        }
-
-        failf(data, "Server certificate was revoked: %s", crl_reason);
-        break;
-      }
-
-      default:
-      case GNUTLS_OCSP_CERT_UNKNOWN:
-        failf(data, "Server certificate status is unknown");
-        break;
-      }
-
-      gnutls_ocsp_resp_deinit(ocsp_resp);
-
-      return CURLE_SSL_INVALIDCERTSTATUS;
-    }
-    else
-      infof(data, "  server certificate status verification OK");
-  }
-  else
-    infof(data, "  server certificate status verification SKIPPED");
+    infof(data, "  SSL certificate verification SKIPPED");
 
   /* initialize an X.509 certificate structure. */
-  gnutls_x509_crt_init(&x509_cert);
+  if(gnutls_x509_crt_init(&x509_cert)) {
+    failf(data, "failed to init GnuTLS x509_crt");
+    *certverifyresult = GNUTLS_E_NO_CERTIFICATE_FOUND;
+    result = CURLE_SSL_CONNECT_ERROR;
+    goto out;
+  }
 
-  if(chainp)
+  if(chain.certs) {
     /* convert the given DER or PEM encoded Certificate to the native
        gnutls_x509_crt_t format */
-    gnutls_x509_crt_import(x509_cert, chainp, GNUTLS_X509_FMT_DER);
-
-  if(config->issuercert) {
-    gnutls_x509_crt_init(&x509_issuer);
-    issuerp = load_file(config->issuercert);
-    gnutls_x509_crt_import(x509_issuer, &issuerp, GNUTLS_X509_FMT_PEM);
-    rc = gnutls_x509_crt_check_issuer(x509_cert, x509_issuer);
-    gnutls_x509_crt_deinit(x509_issuer);
-    unload_file(issuerp);
-    if(rc <= 0) {
-      failf(data, "server certificate issuer check failed (IssuerCert: %s)",
-            config->issuercert?config->issuercert:"none");
-      gnutls_x509_crt_deinit(x509_cert);
-      return CURLE_SSL_ISSUER_ERROR;
-    }
-    infof(data, "  server certificate issuer check OK (Issuer Cert: %s)",
-          config->issuercert?config->issuercert:"none");
-  }
-
-  size = sizeof(certname);
-  rc = gnutls_x509_crt_get_dn_by_oid(x509_cert, GNUTLS_OID_X520_COMMON_NAME,
-                                     0, /* the first and only one */
-                                     FALSE,
-                                     certname,
-                                     &size);
-  if(rc) {
-    infof(data, "error fetching CN from cert:%s",
-          gnutls_strerror(rc));
-  }
-
-  /* This function will check if the given certificate's subject matches the
-     given hostname. This is a basic implementation of the matching described
-     in RFC2818 (HTTPS), which takes into account wildcards, and the subject
-     alternative name PKIX extension. Returns non zero on success, and zero on
-     failure. */
-  rc = gnutls_x509_crt_check_hostname(x509_cert, hostname);
-#if GNUTLS_VERSION_NUMBER < 0x030306
-  /* Before 3.3.6, gnutls_x509_crt_check_hostname() didn't check IP
-     addresses. */
-  if(!rc) {
-#ifdef ENABLE_IPV6
-    #define use_addr in6_addr
-#else
-    #define use_addr in_addr
-#endif
-    unsigned char addrbuf[sizeof(struct use_addr)];
-    size_t addrlen = 0;
-
-    if(Curl_inet_pton(AF_INET, hostname, addrbuf) > 0)
-      addrlen = 4;
-#ifdef ENABLE_IPV6
-    else if(Curl_inet_pton(AF_INET6, hostname, addrbuf) > 0)
-      addrlen = 16;
-#endif
-
-    if(addrlen) {
-      unsigned char certaddr[sizeof(struct use_addr)];
-      int i;
-
-      for(i = 0; ; i++) {
-        size_t certaddrlen = sizeof(certaddr);
-        int ret = gnutls_x509_crt_get_subject_alt_name(x509_cert, i, certaddr,
-                                                       &certaddrlen, NULL);
-        /* If this happens, it wasn't an IP address. */
-        if(ret == GNUTLS_E_SHORT_MEMORY_BUFFER)
-          continue;
-        if(ret < 0)
-          break;
-        if(ret != GNUTLS_SAN_IPADDRESS)
-          continue;
-        if(certaddrlen == addrlen && !memcmp(addrbuf, certaddr, addrlen)) {
-          rc = 1;
-          break;
-        }
-      }
+    rc = gnutls_x509_crt_import(x509_cert, chain.certs, GNUTLS_X509_FMT_DER);
+    if(rc) {
+      failf(data, "error parsing server's certificate chain");
+      *certverifyresult = GNUTLS_E_NO_CERTIFICATE_FOUND;
+      result = CURLE_SSL_CONNECT_ERROR;
+      goto out;
     }
   }
-#endif
-  if(!rc) {
-    if(config->verifyhost) {
-      failf(data, "SSL: certificate subject name (%s) does not match "
-            "target host name '%s'", certname, dispname);
-      gnutls_x509_crt_deinit(x509_cert);
-      return CURLE_PEER_FAILED_VERIFICATION;
-    }
-    else
-      infof(data, "  common name: %s (does not match '%s')",
-            certname, dispname);
-  }
-  else
-    infof(data, "  common name: %s (matched)", certname);
 
   /* Check for time-based validity */
   certclock = gnutls_x509_crt_get_expiration_time(x509_cert);
@@ -1132,25 +1755,25 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
     if(config->verifypeer) {
       failf(data, "server cert expiration date verify failed");
       *certverifyresult = GNUTLS_CERT_EXPIRED;
-      gnutls_x509_crt_deinit(x509_cert);
-      return CURLE_SSL_CONNECT_ERROR;
+      result = CURLE_SSL_CONNECT_ERROR;
+      goto out;
     }
     else
-      infof(data, "  server certificate expiration date verify FAILED");
+      infof(data, "  SSL certificate expiration date verify FAILED");
   }
   else {
     if(certclock < time(NULL)) {
       if(config->verifypeer) {
         failf(data, "server certificate expiration date has passed.");
         *certverifyresult = GNUTLS_CERT_EXPIRED;
-        gnutls_x509_crt_deinit(x509_cert);
-        return CURLE_PEER_FAILED_VERIFICATION;
+        result = CURLE_PEER_FAILED_VERIFICATION;
+        goto out;
       }
       else
-        infof(data, "  server certificate expiration date FAILED");
+        infof(data, "  SSL certificate expiration date FAILED");
     }
     else
-      infof(data, "  server certificate expiration date OK");
+      infof(data, "  SSL certificate expiration date OK");
   }
 
   certclock = gnutls_x509_crt_get_activation_time(x509_cert);
@@ -1159,84 +1782,95 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
     if(config->verifypeer) {
       failf(data, "server cert activation date verify failed");
       *certverifyresult = GNUTLS_CERT_NOT_ACTIVATED;
-      gnutls_x509_crt_deinit(x509_cert);
-      return CURLE_SSL_CONNECT_ERROR;
+      result = CURLE_SSL_CONNECT_ERROR;
+      goto out;
     }
     else
-      infof(data, "  server certificate activation date verify FAILED");
+      infof(data, "  SSL certificate activation date verify FAILED");
   }
   else {
     if(certclock > time(NULL)) {
       if(config->verifypeer) {
         failf(data, "server certificate not activated yet.");
         *certverifyresult = GNUTLS_CERT_NOT_ACTIVATED;
-        gnutls_x509_crt_deinit(x509_cert);
-        return CURLE_PEER_FAILED_VERIFICATION;
+        result = CURLE_PEER_FAILED_VERIFICATION;
+        goto out;
       }
       else
-        infof(data, "  server certificate activation date FAILED");
+        infof(data, "  SSL certificate activation date FAILED");
     }
     else
-      infof(data, "  server certificate activation date OK");
+      infof(data, "  SSL certificate activation date OK");
   }
 
+  if(config->verifystatus) {
+    result = gtls_verify_ocsp_status(data, session);
+    if(result)
+      goto out;
+  }
+  else
+    infof(data, "  SSL certificate status verification SKIPPED");
+
+  if(config->issuercert) {
+    gnutls_datum_t issuerp;
+    if(gnutls_x509_crt_init(&x509_issuer)) {
+      failf(data, "failed to init GnuTLS x509_crt for issuer");
+      result = CURLE_SSL_ISSUER_ERROR;
+      goto out;
+    }
+    issuerp = load_file(config->issuercert);
+    rc = gnutls_x509_crt_import(x509_issuer, &issuerp, GNUTLS_X509_FMT_PEM);
+    unload_file(issuerp);
+    if(rc) {
+      failf(data, "failed to import issuer certificate (%s) (Issuer Cert: %s)",
+            gnutls_strerror(rc), config->issuercert);
+      result = CURLE_SSL_ISSUER_ERROR;
+      goto out;
+    }
+    rc = (int)gnutls_x509_crt_check_issuer(x509_cert, x509_issuer);
+    if(rc <= 0) {
+      failf(data, "server certificate issuer check failed (Issuer Cert: %s)",
+            config->issuercert);
+      result = CURLE_SSL_ISSUER_ERROR;
+      goto out;
+    }
+    infof(data, "  SSL certificate issuer check OK (Issuer Cert: %s)",
+          config->issuercert);
+  }
+
+  /* This function checks if the given certificate's subject matches the
+     given hostname. This is a basic implementation of the matching described
+     in RFC2818 (HTTPS), which takes into account wildcards, and the subject
+     alternative name PKIX extension. Returns non zero on success, and zero on
+     failure. */
+
+  /* This function does not handle trailing dots, so if we have an SNI name
+     use that and fallback to the hostname only if there is no SNI (like for
+     IP addresses) */
+  rc = (int)gnutls_x509_crt_check_hostname(x509_cert,
+                                           peer->sni ? peer->sni :
+                                           peer->origin->hostname);
+  result = (!rc && config->verifyhost) ?
+    CURLE_PEER_FAILED_VERIFICATION : CURLE_OK;
+  gtls_msg_verify_result(data, peer, x509_cert, rc, config->verifyhost);
+  if(result)
+    goto out;
+
   if(pinned_key) {
     result = pkp_pin_peer_pubkey(data, x509_cert, pinned_key);
     if(result != CURLE_OK) {
       failf(data, "SSL: public key does not match pinned public key");
-      gnutls_x509_crt_deinit(x509_cert);
-      return result;
+      goto out;
     }
   }
 
-  /* Show:
-
-  - subject
-  - start date
-  - expire date
-  - common name
-  - issuer
-
-  */
-
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-  /* public key algorithm's parameters */
-  algo = gnutls_x509_crt_get_pk_algorithm(x509_cert, &bits);
-  infof(data, "  certificate public key: %s",
-        gnutls_pk_algorithm_get_name(algo));
-
-  /* version of the X.509 certificate. */
-  infof(data, "  certificate version: #%d",
-        gnutls_x509_crt_get_version(x509_cert));
-
-
-  rc = gnutls_x509_crt_get_dn2(x509_cert, &certfields);
-  if(rc)
-    infof(data, "Failed to get certificate name");
-  else {
-    infof(data, "  subject: %s", certfields.data);
-
-    certclock = gnutls_x509_crt_get_activation_time(x509_cert);
-    showtime(data, "start date", certclock);
-
-    certclock = gnutls_x509_crt_get_expiration_time(x509_cert);
-    showtime(data, "expire date", certclock);
-
-    gnutls_free(certfields.data);
-  }
-
-  rc = gnutls_x509_crt_get_issuer_dn2(x509_cert, &certfields);
-  if(rc)
-    infof(data, "Failed to get certificate issuer");
-  else {
-    infof(data, "  issuer: %s", certfields.data);
-
-    gnutls_free(certfields.data);
-  }
-#endif
-
-  gnutls_x509_crt_deinit(x509_cert);
+  gtls_infof_cert(data, x509_cert);
 
+out:
+  if(x509_issuer)
+    gnutls_x509_crt_deinit(x509_issuer);
+  if(x509_cert)
+    gnutls_x509_crt_deinit(x509_cert);
   return result;
 }
 
@@ -1247,150 +1881,192 @@ static CURLcode gtls_verifyserver(struct Curl_cfilter *cf,
   struct ssl_connect_data *connssl = cf->ctx;
   struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
   struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
-  const char *pinned_key = Curl_ssl_cf_is_proxy(cf)?
-    data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY]:
+#ifndef CURL_DISABLE_PROXY
+  const char *pinned_key = Curl_ssl_cf_is_proxy(cf) ?
+    data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
     data->set.str[STRING_SSL_PINNEDPUBLICKEY];
+#else
+  const char *pinned_key = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
+#endif
   CURLcode result;
 
-  result = Curl_gtls_verifyserver(data, session, conn_config, ssl_config,
-                                  connssl->hostname, connssl->dispname,
-                                  pinned_key);
+  result = Curl_gtls_verifyserver(cf, data, session, conn_config, ssl_config,
+                                  &connssl->peer, pinned_key);
   if(result)
     goto out;
 
-  if(connssl->alpn) {
-    gnutls_datum_t proto;
-    int rc;
-
-    rc = gnutls_alpn_get_selected_protocol(session, &proto);
-    if(rc == 0)
-      Curl_alpn_set_negotiated(cf, data, proto.data, proto.size);
-    else
-      Curl_alpn_set_negotiated(cf, data, NULL, 0);
-  }
-
-  if(ssl_config->primary.sessionid) {
-    /* we always unconditionally get the session id here, as even if we
-       already got it from the cache and asked to use it in the connection, it
-       might've been rejected and then a new one is in use now and we need to
-       detect that. */
-    void *connect_sessionid;
-    size_t connect_idsize = 0;
-
-    /* get the session ID data size */
-    gnutls_session_get_data(session, NULL, &connect_idsize);
-    connect_sessionid = malloc(connect_idsize); /* get a buffer for it */
-
-    if(connect_sessionid) {
-      bool incache;
-      bool added = FALSE;
-      void *ssl_sessionid;
-
-      /* extract session ID to the allocated buffer */
-      gnutls_session_get_data(session, connect_sessionid, &connect_idsize);
-
-      Curl_ssl_sessionid_lock(data);
-      incache = !(Curl_ssl_getsessionid(cf, data, &ssl_sessionid, NULL));
-      if(incache) {
-        /* there was one before in the cache, so instead of risking that the
-           previous one was rejected, we just kill that and store the new */
-        Curl_ssl_delsessionid(data, ssl_sessionid);
-      }
-
-      /* store this session id */
-      result = Curl_ssl_addsessionid(cf, data, connect_sessionid,
-                                     connect_idsize, &added);
-      Curl_ssl_sessionid_unlock(data);
-      if(!added)
-        free(connect_sessionid);
-      if(result) {
-        result = CURLE_OUT_OF_MEMORY;
-      }
-    }
-    else
-      result = CURLE_OUT_OF_MEMORY;
-  }
+#ifdef CURL_GNUTLS_EARLY_DATA
+  /* Only on TLSv1.2 or lower do we have the session id now. For
+   * TLSv1.3 we get it via a SESSION_TICKET message that arrives later. */
+  if(gnutls_protocol_get_version(session) < GNUTLS_TLS1_3)
+    result = cf_gtls_update_session_id(cf, data, session);
+#endif
 
 out:
   return result;
 }
 
+#ifdef CURL_GNUTLS_EARLY_DATA
+static CURLcode gtls_send_earlydata(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct gtls_ssl_backend_data *backend =
+    (struct gtls_ssl_backend_data *)connssl->backend;
+  CURLcode result = CURLE_OK;
+  const unsigned char *buf;
+  size_t blen;
+  ssize_t n;
+
+  DEBUGASSERT(connssl->earlydata_state == ssl_earlydata_sending);
+  backend->gtls.io_result = CURLE_OK;
+  while(Curl_bufq_peek(&connssl->earlydata, &buf, &blen)) {
+    n = gnutls_record_send_early_data(backend->gtls.session, buf, blen);
+    CURL_TRC_CF(data, cf, "gtls_send_earlydata(len=%zu) -> %zd", blen, n);
+    if(n < 0) {
+      if(n == GNUTLS_E_AGAIN)
+        result = CURLE_AGAIN;
+      else
+        result = backend->gtls.io_result ?
+                 backend->gtls.io_result : CURLE_SEND_ERROR;
+      goto out;
+    }
+    else if(!n) {
+      /* GnuTLS is buggy, it *SHOULD* return the amount of bytes it took in.
+       * Instead it returns 0 if everything was written. */
+      n = (ssize_t)blen;
+    }
+
+    Curl_bufq_skip(&connssl->earlydata, (size_t)n);
+  }
+  /* sent everything there was */
+  infof(data, "SSL sending %zu bytes of early data", connssl->earlydata_skip);
+out:
+  return result;
+}
+#endif
+
 /*
  * This function is called after the TCP connect has completed. Setup the TLS
  * layer and do all necessary magic.
  */
 /* We use connssl->connecting_state to keep track of the connection status;
    there are three states: 'ssl_connect_1' (not started yet or complete),
-   'ssl_connect_2_reading' (waiting for data from server), and
-   'ssl_connect_2_writing' (waiting to be able to write).
+   'ssl_connect_2' (doing handshake with the server), and
+   'ssl_connect_3' (verifying and getting stats).
  */
-static CURLcode
-gtls_connect_common(struct Curl_cfilter *cf,
-                    struct Curl_easy *data,
-                    bool nonblocking,
-                    bool *done)
+static CURLcode gtls_connect_common(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    bool *done)
 {
   struct ssl_connect_data *connssl = cf->ctx;
-  int rc;
+  struct gtls_ssl_backend_data *backend =
+    (struct gtls_ssl_backend_data *)connssl->backend;
   CURLcode result = CURLE_OK;
 
-  /* Initiate the connection, if not already done */
-  if(ssl_connect_1 == connssl->connecting_state) {
-    rc = gtls_connect_step1(cf, data);
-    if(rc) {
-      result = rc;
-      goto out;
-    }
+  DEBUGASSERT(backend);
+  /* check if the connection has already been established */
+  if(ssl_connection_complete == connssl->state) {
+    *done = TRUE;
+    return CURLE_OK;
   }
 
-  rc = handshake(cf, data, TRUE, nonblocking);
-  if(rc) {
-    /* handshake() sets its own error message with failf() */
-    result = rc;
-    goto out;
+  *done = FALSE;
+
+  /* Initiate the connection, if not already done */
+  if(connssl->connecting_state == ssl_connect_1) {
+    result = gtls_connect_step1(cf, data);
+    if(result)
+      goto out;
+    connssl->connecting_state = ssl_connect_2;
+  }
+
+  if(connssl->connecting_state == ssl_connect_2) {
+#ifdef CURL_GNUTLS_EARLY_DATA
+    if(connssl->earlydata_state == ssl_earlydata_await) {
+      goto out;
+    }
+    else if(connssl->earlydata_state == ssl_earlydata_sending) {
+      result = gtls_send_earlydata(cf, data);
+      if(result)
+        goto out;
+      connssl->earlydata_state = ssl_earlydata_sent;
+    }
+    DEBUGASSERT((connssl->earlydata_state == ssl_earlydata_none) ||
+                (connssl->earlydata_state == ssl_earlydata_sent));
+#endif
+    result = cf_gtls_handshake(cf, data);
+    if(result)
+      goto out;
+    connssl->connecting_state = ssl_connect_3;
   }
 
   /* Finish connecting once the handshake is done */
-  if(ssl_connect_1 == connssl->connecting_state) {
-    struct gtls_ssl_backend_data *backend =
-      (struct gtls_ssl_backend_data *)connssl->backend;
-    gnutls_session_t session;
-    DEBUGASSERT(backend);
-    session = backend->gtls.session;
-    rc = gtls_verifyserver(cf, data, session);
-    if(rc) {
-      result = rc;
+  if(connssl->connecting_state == ssl_connect_3) {
+    gnutls_datum_t proto;
+    int rc;
+
+    Curl_gtls_report_handshake(data, &backend->gtls);
+
+    result = gtls_verifyserver(cf, data, backend->gtls.session);
+    if(result)
       goto out;
-    }
+
     connssl->state = ssl_connection_complete;
+
+    rc = gnutls_alpn_get_selected_protocol(backend->gtls.session, &proto);
+    if(rc) {  /* No ALPN from server */
+      proto.data = NULL;
+      proto.size = 0;
+    }
+
+    result = Curl_alpn_set_negotiated(cf, data, connssl,
+                                      proto.data, proto.size);
+    if(result)
+      goto out;
+
+#ifdef CURL_GNUTLS_EARLY_DATA
+    if(connssl->earlydata_state > ssl_earlydata_none) {
+      /* We should be in this state by now */
+      DEBUGASSERT(connssl->earlydata_state == ssl_earlydata_sent);
+      connssl->earlydata_state =
+        (gnutls_session_get_flags(backend->gtls.session) &
+         GNUTLS_SFLAGS_EARLY_DATA) ?
+        ssl_earlydata_accepted : ssl_earlydata_rejected;
+    }
+#endif
+    connssl->connecting_state = ssl_connect_done;
   }
 
-out:
-  *done = ssl_connect_1 == connssl->connecting_state;
+  if(connssl->connecting_state == ssl_connect_done)
+    DEBUGASSERT(connssl->state == ssl_connection_complete);
 
+out:
+  if(result == CURLE_AGAIN) {
+    *done = FALSE;
+    return CURLE_OK;
+  }
+  *done = ((connssl->state == ssl_connection_complete) ||
+           (connssl->state == ssl_connection_deferred));
+  CURL_TRC_CF(data, cf, "gtls_connect_common() -> %d, done=%d", (int)result,
+              *done);
   return result;
 }
 
-static CURLcode gtls_connect_nonblocking(struct Curl_cfilter *cf,
-                                         struct Curl_easy *data,
-                                         bool *done)
-{
-  return gtls_connect_common(cf, data, TRUE, done);
-}
-
 static CURLcode gtls_connect(struct Curl_cfilter *cf,
-                             struct Curl_easy *data)
+                             struct Curl_easy *data,
+                             bool *done)
 {
-  CURLcode result;
-  bool done = FALSE;
-
-  result = gtls_connect_common(cf, data, FALSE, &done);
-  if(result)
-    return result;
-
-  DEBUGASSERT(done);
-
-  return CURLE_OK;
+#ifdef CURL_GNUTLS_EARLY_DATA
+  struct ssl_connect_data *connssl = cf->ctx;
+  if((connssl->state == ssl_connection_deferred) &&
+     (connssl->earlydata_state == ssl_earlydata_await)) {
+    /* We refuse to be pushed, we are waiting for someone to send/recv. */
+    *done = TRUE;
+    return CURLE_OK;
+  }
+#endif
+  return gtls_connect_common(cf, data, done);
 }
 
 static bool gtls_data_pending(struct Curl_cfilter *cf,
@@ -1403,35 +2079,131 @@ static bool gtls_data_pending(struct Curl_cfilter *cf,
   DEBUGASSERT(ctx && ctx->backend);
   backend = (struct gtls_ssl_backend_data *)ctx->backend;
   if(backend->gtls.session &&
-     0 != gnutls_record_check_pending(backend->gtls.session))
+     gnutls_record_check_pending(backend->gtls.session) != 0)
     return TRUE;
   return FALSE;
 }
 
-static ssize_t gtls_send(struct Curl_cfilter *cf,
-                         struct Curl_easy *data,
-                         const void *mem,
-                         size_t len,
-                         CURLcode *curlcode)
+static CURLcode gtls_send(struct Curl_cfilter *cf,
+                          struct Curl_easy *data,
+                          const void *buf,
+                          size_t blen,
+                          size_t *pnwritten)
 {
   struct ssl_connect_data *connssl = cf->ctx;
   struct gtls_ssl_backend_data *backend =
     (struct gtls_ssl_backend_data *)connssl->backend;
-  ssize_t rc;
+  CURLcode result = CURLE_OK;
+  ssize_t nwritten;
+  size_t remain = blen;
 
-  (void)data;
   DEBUGASSERT(backend);
-  rc = gnutls_record_send(backend->gtls.session, mem, len);
+  *pnwritten = 0;
 
-  if(rc < 0) {
-    *curlcode = (rc == GNUTLS_E_AGAIN)
-      ? CURLE_AGAIN
-      : CURLE_SEND_ERROR;
+  while(remain) {
+    backend->gtls.io_result = CURLE_OK;
+    nwritten = gnutls_record_send(backend->gtls.session, buf, remain);
 
-    rc = -1;
+    if(nwritten >= 0) {
+      *pnwritten += (size_t)nwritten;
+      DEBUGASSERT((size_t)nwritten <= remain);
+      buf = (char *)CURL_UNCONST(buf) + (size_t)nwritten;
+      remain -= (size_t)nwritten;
+    }
+    else {
+      if(*pnwritten && (nwritten == GNUTLS_E_AGAIN)) {
+        result = CURLE_OK;
+        goto out;
+      }
+      result = (nwritten == GNUTLS_E_AGAIN) ?
+        CURLE_AGAIN :
+        (backend->gtls.io_result ? backend->gtls.io_result : CURLE_SEND_ERROR);
+      goto out;
+    }
   }
 
-  return rc;
+out:
+  CURL_TRC_CF(data, cf, "gtls_send(len=%zu) -> %d, %zu",
+              blen, (int)result, *pnwritten);
+  return result;
+}
+
+/*
+ * This function is called to shut down the SSL layer but keep the
+ * socket open (CCC - Clear Command Channel)
+ */
+static CURLcode gtls_shutdown(struct Curl_cfilter *cf,
+                              struct Curl_easy *data,
+                              bool send_shutdown, bool *done)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct gtls_ssl_backend_data *backend =
+    (struct gtls_ssl_backend_data *)connssl->backend;
+  char buf[1024];
+  CURLcode result = CURLE_OK;
+  ssize_t nread = 0;
+  size_t i;
+
+  DEBUGASSERT(backend);
+  /* If we have no handshaked connection or already shut down */
+  if(!backend->gtls.session || cf->shutdown ||
+     connssl->state != ssl_connection_complete) {
+    *done = TRUE;
+    goto out;
+  }
+
+  connssl->io_need = CURL_SSL_IO_NEED_NONE;
+  *done = FALSE;
+
+  if(!backend->gtls.sent_shutdown) {
+    /* do this only once */
+    backend->gtls.sent_shutdown = TRUE;
+    if(send_shutdown) {
+      int ret = gnutls_bye(backend->gtls.session, GNUTLS_SHUT_RDWR);
+      if((ret == GNUTLS_E_AGAIN) || (ret == GNUTLS_E_INTERRUPTED)) {
+        CURL_TRC_CF(data, cf, "SSL shutdown, gnutls_bye EAGAIN");
+        connssl->io_need = gnutls_record_get_direction(backend->gtls.session) ?
+          CURL_SSL_IO_NEED_SEND : CURL_SSL_IO_NEED_RECV;
+        backend->gtls.sent_shutdown = FALSE;
+        result = CURLE_OK;
+        goto out;
+      }
+      if(ret != GNUTLS_E_SUCCESS) {
+        CURL_TRC_CF(data, cf, "SSL shutdown, gnutls_bye error: '%s'(%d)",
+                    gnutls_strerror((int)ret), (int)ret);
+        result = CURLE_RECV_ERROR;
+        goto out;
+      }
+    }
+  }
+
+  /* SSL should now have started the shutdown from our side. Since it
+   * was not complete, we are lacking the close notify from the server. */
+  for(i = 0; i < 10; ++i) {
+    nread = gnutls_record_recv(backend->gtls.session, buf, sizeof(buf));
+    if(nread <= 0)
+      break;
+  }
+  if(nread > 0) {
+    /* still data coming in? */
+  }
+  else if(nread == 0) {
+    /* We got the close notify alert and are done. */
+    *done = TRUE;
+  }
+  else if((nread == GNUTLS_E_AGAIN) || (nread == GNUTLS_E_INTERRUPTED)) {
+    connssl->io_need = gnutls_record_get_direction(backend->gtls.session) ?
+      CURL_SSL_IO_NEED_SEND : CURL_SSL_IO_NEED_RECV;
+  }
+  else {
+    CURL_TRC_CF(data, cf, "SSL shutdown, error: '%s'(%d)",
+                gnutls_strerror((int)nread), (int)nread);
+    result = CURLE_RECV_ERROR;
+  }
+
+out:
+  cf->shutdown = (result || *done);
+  return result;
 }
 
 static void gtls_close(struct Curl_cfilter *cf,
@@ -1441,21 +2213,14 @@ static void gtls_close(struct Curl_cfilter *cf,
   struct gtls_ssl_backend_data *backend =
     (struct gtls_ssl_backend_data *)connssl->backend;
 
-  (void) data;
   DEBUGASSERT(backend);
-
+  CURL_TRC_CF(data, cf, "close");
   if(backend->gtls.session) {
-    char buf[32];
-    /* Maybe the server has already sent a close notify alert.
-       Read it to avoid an RST on the TCP connection. */
-    (void)gnutls_record_recv(backend->gtls.session, buf, sizeof(buf));
-    gnutls_bye(backend->gtls.session, GNUTLS_SHUT_WR);
     gnutls_deinit(backend->gtls.session);
     backend->gtls.session = NULL;
   }
-  if(backend->gtls.cred) {
-    gnutls_certificate_free_credentials(backend->gtls.cred);
-    backend->gtls.cred = NULL;
+  if(backend->gtls.shared_creds) {
+    Curl_gtls_shared_creds_free(&backend->gtls.shared_creds);
   }
 #ifdef USE_GNUTLS_SRP
   if(backend->gtls.srp_client_cred) {
@@ -1465,142 +2230,53 @@ static void gtls_close(struct Curl_cfilter *cf,
 #endif
 }
 
-/*
- * This function is called to shut down the SSL layer but keep the
- * socket open (CCC - Clear Command Channel)
- */
-static int gtls_shutdown(struct Curl_cfilter *cf,
-                         struct Curl_easy *data)
+static CURLcode gtls_recv(struct Curl_cfilter *cf,
+                          struct Curl_easy *data,
+                          char *buf, size_t blen,
+                          size_t *pnread)
 {
   struct ssl_connect_data *connssl = cf->ctx;
-  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
   struct gtls_ssl_backend_data *backend =
     (struct gtls_ssl_backend_data *)connssl->backend;
-  int retval = 0;
+  CURLcode result = CURLE_OK;
+  ssize_t nread;
 
   DEBUGASSERT(backend);
 
-#ifndef CURL_DISABLE_FTP
-  /* This has only been tested on the proftpd server, and the mod_tls code
-     sends a close notify alert without waiting for a close notify alert in
-     response. Thus we wait for a close notify alert from the server, but
-     we do not send one. Let's hope other servers do the same... */
+  nread = gnutls_record_recv(backend->gtls.session, buf, blen);
 
-  if(data->set.ftp_ccc == CURLFTPSSL_CCC_ACTIVE)
-    gnutls_bye(backend->gtls.session, GNUTLS_SHUT_WR);
-#endif
-
-  if(backend->gtls.session) {
-    ssize_t result;
-    bool done = FALSE;
-    char buf[120];
-
-    while(!done) {
-      int what = SOCKET_READABLE(Curl_conn_cf_get_socket(cf, data),
-                                 SSL_SHUTDOWN_TIMEOUT);
-      if(what > 0) {
-        /* Something to read, let's do it and hope that it is the close
-           notify alert from the server */
-        result = gnutls_record_recv(backend->gtls.session,
-                                    buf, sizeof(buf));
-        switch(result) {
-        case 0:
-          /* This is the expected response. There was no data but only
-             the close notify alert */
-          done = TRUE;
-          break;
-        case GNUTLS_E_AGAIN:
-        case GNUTLS_E_INTERRUPTED:
-          infof(data, "GNUTLS_E_AGAIN || GNUTLS_E_INTERRUPTED");
-          break;
-        default:
-          retval = -1;
-          done = TRUE;
-          break;
-        }
-      }
-      else if(0 == what) {
-        /* timeout */
-        failf(data, "SSL shutdown timeout");
-        done = TRUE;
-      }
-      else {
-        /* anything that gets here is fatally bad */
-        failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
-        retval = -1;
-        done = TRUE;
-      }
+  if(nread >= 0)
+    *pnread = (size_t)nread;
+  else {
+    if((nread == GNUTLS_E_AGAIN) || (nread == GNUTLS_E_INTERRUPTED)) {
+      result = CURLE_AGAIN;
+      goto out;
+    }
+    else if(nread == GNUTLS_E_REHANDSHAKE) {
+      /* Either TLSv1.2 renegotiate or a TLSv1.3 session key update. */
+      result = cf_gtls_handshake(cf, data);
+      if(!result)
+        result = CURLE_AGAIN; /* make us get called again. */
+      goto out;
+    }
+    else {
+      failf(data, "GnuTLS recv error (%d): %s",
+            (int)nread, gnutls_strerror((int)nread));
+      result = backend->gtls.io_result ?
+        backend->gtls.io_result : CURLE_RECV_ERROR;
+      goto out;
     }
-    gnutls_deinit(backend->gtls.session);
-  }
-  gnutls_certificate_free_credentials(backend->gtls.cred);
-
-#ifdef USE_GNUTLS_SRP
-  if(ssl_config->primary.username)
-    gnutls_srp_free_client_credentials(backend->gtls.srp_client_cred);
-#endif
-
-  backend->gtls.cred = NULL;
-  backend->gtls.session = NULL;
-
-  return retval;
-}
-
-static ssize_t gtls_recv(struct Curl_cfilter *cf,
-                         struct Curl_easy *data,
-                         char *buf,
-                         size_t buffersize,
-                         CURLcode *curlcode)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct gtls_ssl_backend_data *backend =
-    (struct gtls_ssl_backend_data *)connssl->backend;
-  ssize_t ret;
-
-  (void)data;
-  DEBUGASSERT(backend);
-
-  ret = gnutls_record_recv(backend->gtls.session, buf, buffersize);
-  if((ret == GNUTLS_E_AGAIN) || (ret == GNUTLS_E_INTERRUPTED)) {
-    *curlcode = CURLE_AGAIN;
-    ret = -1;
-    goto out;
-  }
-
-  if(ret == GNUTLS_E_REHANDSHAKE) {
-    /* BLOCKING call, this is bad but a work-around for now. Fixing this "the
-       proper way" takes a whole lot of work. */
-    CURLcode result = handshake(cf, data, FALSE, FALSE);
-    if(result)
-      /* handshake() writes error message on its own */
-      *curlcode = result;
-    else
-      *curlcode = CURLE_AGAIN; /* then return as if this was a wouldblock */
-    ret = -1;
-    goto out;
-  }
-
-  if(ret < 0) {
-    failf(data, "GnuTLS recv error (%d): %s",
-
-          (int)ret, gnutls_strerror((int)ret));
-    *curlcode = CURLE_RECV_ERROR;
-    ret = -1;
-    goto out;
   }
 
 out:
-  return ret;
+  CURL_TRC_CF(data, cf, "gtls_recv(len=%zu) -> %d, %zd", blen,
+              (int)result, nread);
+  return result;
 }
 
-static void gtls_session_free(void *ptr)
+size_t Curl_gtls_version(char *buffer, size_t size)
 {
-  free(ptr);
-}
-
-static size_t gtls_version(char *buffer, size_t size)
-{
-  return msnprintf(buffer, size, "GnuTLS/%s", gnutls_check_version(NULL));
+  return curl_msnprintf(buffer, size, "GnuTLS/%s", gnutls_check_version(NULL));
 }
 
 /* data might be NULL! */
@@ -1610,18 +2286,28 @@ static CURLcode gtls_random(struct Curl_easy *data,
   int rc;
   (void)data;
   rc = gnutls_rnd(GNUTLS_RND_RANDOM, entropy, length);
-  return rc?CURLE_FAILED_INIT:CURLE_OK;
+  return rc ? CURLE_FAILED_INIT : CURLE_OK;
 }
 
-static CURLcode gtls_sha256sum(const unsigned char *tmp, /* input */
-                               size_t tmplen,
+static CURLcode gtls_sha256sum(const unsigned char *input,
+                               size_t len,
                                unsigned char *sha256sum, /* output */
                                size_t sha256len)
 {
   struct sha256_ctx SHA256pw;
   sha256_init(&SHA256pw);
-  sha256_update(&SHA256pw, (unsigned int)tmplen, tmp);
+  do {
+    unsigned int ilen = (unsigned int)CURLMIN(len, UINT_MAX);
+    sha256_update(&SHA256pw, ilen, input);
+    len -= ilen;
+    input += ilen;
+  } while(len);
+#if NETTLE_VERSION_MAJOR >= 4
+  (void)sha256len;
+  sha256_digest(&SHA256pw, sha256sum);
+#else
   sha256_digest(&SHA256pw, (unsigned int)sha256len, sha256sum);
+#endif
   return CURLE_OK;
 }
 
@@ -1631,7 +2317,7 @@ static bool gtls_cert_status_request(void)
 }
 
 static void *gtls_get_internals(struct ssl_connect_data *connssl,
-                                CURLINFO info UNUSED_PARAM)
+                                CURLINFO info)
 {
   struct gtls_ssl_backend_data *backend =
     (struct gtls_ssl_backend_data *)connssl->backend;
@@ -1646,35 +2332,34 @@ const struct Curl_ssl Curl_ssl_gnutls = {
   SSLSUPP_CA_PATH  |
   SSLSUPP_CERTINFO |
   SSLSUPP_PINNEDPUBKEY |
-  SSLSUPP_HTTPS_PROXY,
+  SSLSUPP_HTTPS_PROXY |
+  SSLSUPP_CAINFO_BLOB |
+  SSLSUPP_CIPHER_LIST |
+  SSLSUPP_CA_CACHE |
+  SSLSUPP_ISSUERCERT |
+  SSLSUPP_CRLFILE,
 
   sizeof(struct gtls_ssl_backend_data),
 
   gtls_init,                     /* init */
   gtls_cleanup,                  /* cleanup */
-  gtls_version,                  /* version */
-  Curl_none_check_cxn,           /* check_cxn */
+  Curl_gtls_version,             /* version */
   gtls_shutdown,                 /* shutdown */
   gtls_data_pending,             /* data_pending */
   gtls_random,                   /* random */
   gtls_cert_status_request,      /* cert_status_request */
   gtls_connect,                  /* connect */
-  gtls_connect_nonblocking,      /* connect_nonblocking */
-  Curl_ssl_get_select_socks,              /* getsock */
+  Curl_ssl_adjust_pollset,       /* adjust_pollset */
   gtls_get_internals,            /* get_internals */
   gtls_close,                    /* close_one */
-  Curl_none_close_all,           /* close_all */
-  gtls_session_free,             /* session_free */
-  Curl_none_set_engine,          /* set_engine */
-  Curl_none_set_engine_default,  /* set_engine_default */
-  Curl_none_engines_list,        /* engines_list */
-  Curl_none_false_start,         /* false_start */
+  NULL,                          /* close_all */
+  NULL,                          /* set_engine */
+  NULL,                          /* set_engine_default */
+  NULL,                          /* engines_list */
   gtls_sha256sum,                /* sha256sum */
-  NULL,                          /* associate_connection */
-  NULL,                          /* disassociate_connection */
-  NULL,                          /* free_multi_ssl_backend_data */
   gtls_recv,                     /* recv decrypted data */
   gtls_send,                     /* send data to encrypt */
+  NULL,                          /* get_channel_binding */
 };
 
 #endif /* USE_GNUTLS */
diff --git a/third-party/curl/lib/vtls/gtls.h b/third-party/curl/lib/vtls/gtls.h
index ac141e1c61..4c662003eb 100644
--- a/third-party/curl/lib/vtls/gtls.h
+++ b/third-party/curl/lib/vtls/gtls.h
@@ -23,14 +23,14 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
-#include <curl/curl.h>
 
 #ifdef USE_GNUTLS
 
 #include <gnutls/gnutls.h>
 
+#include "curlx/timeval.h"
+
 #ifdef HAVE_GNUTLS_SRP
 /* the function exists */
 #ifdef USE_TLS_SRP
@@ -41,33 +41,82 @@
 
 struct Curl_easy;
 struct Curl_cfilter;
+struct alpn_spec;
 struct ssl_primary_config;
 struct ssl_config_data;
+struct ssl_peer;
+struct ssl_connect_data;
+struct Curl_ssl_session;
 
-struct gtls_instance {
+struct gtls_shared_creds {
+  gnutls_certificate_credentials_t creds;
+  char *CAfile; /* CAfile path used to generate X509 store */
+  struct curltime time; /* when the shared creds was created */
+  size_t refcount;
+  BIT(trust_setup); /* x509 anchors + CRLs have been set up */
+};
+
+CURLcode Curl_gtls_shared_creds_create(struct Curl_easy *data,
+                                       struct gtls_shared_creds **pcreds);
+CURLcode Curl_gtls_shared_creds_up_ref(struct gtls_shared_creds *creds);
+void Curl_gtls_shared_creds_free(struct gtls_shared_creds **pcreds);
+
+struct gtls_ctx {
   gnutls_session_t session;
-  gnutls_certificate_credentials_t cred;
+  struct gtls_shared_creds *shared_creds;
 #ifdef USE_GNUTLS_SRP
   gnutls_srp_client_credentials_t srp_client_cred;
 #endif
+  CURLcode io_result; /* result of last IO cfilter operation */
+  BIT(sent_shutdown);
 };
 
-CURLcode
-gtls_client_init(struct Curl_easy *data,
-                 struct ssl_primary_config *config,
-                 struct ssl_config_data *ssl_config,
-                 const char *hostname,
-                 struct gtls_instance *gtls,
-                 long *pverifyresult);
+size_t Curl_gtls_version(char *buffer, size_t size);
 
-CURLcode
-Curl_gtls_verifyserver(struct Curl_easy *data,
-                       gnutls_session_t session,
-                       struct ssl_primary_config *config,
-                       struct ssl_config_data *ssl_config,
-                       const char *hostname,
-                       const char *dispname,
-                       const char *pinned_key);
+typedef CURLcode Curl_gtls_ctx_setup_cb(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data,
+                                        void *user_data);
+
+typedef CURLcode Curl_gtls_init_session_reuse_cb(struct Curl_cfilter *cf,
+                                                 struct Curl_easy *data,
+                                                 struct alpn_spec *alpns,
+                                                 struct Curl_ssl_session *scs,
+                                                 bool *do_early_data);
+
+CURLcode Curl_gtls_ctx_init(struct gtls_ctx *gctx,
+                            struct Curl_cfilter *cf,
+                            struct Curl_easy *data,
+                            struct ssl_peer *peer,
+                            const struct alpn_spec *alpns_requested,
+                            Curl_gtls_ctx_setup_cb *cb_setup,
+                            void *cb_user_data,
+                            void *ssl_user_data,
+                            Curl_gtls_init_session_reuse_cb *sess_reuse_cb);
+
+CURLcode Curl_gtls_client_trust_setup(struct Curl_cfilter *cf,
+                                      struct Curl_easy *data,
+                                      struct gtls_ctx *gtls);
+
+CURLcode Curl_gtls_verifyserver(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                gnutls_session_t session,
+                                struct ssl_primary_config *config,
+                                struct ssl_config_data *ssl_config,
+                                struct ssl_peer *peer,
+                                const char *pinned_key);
+
+/* Extract TLS session and place in cache, if configured. */
+CURLcode Curl_gtls_cache_session(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 const char *ssl_peer_key,
+                                 gnutls_session_t session,
+                                 curl_off_t valid_until,
+                                 const char *alpn,
+                                 unsigned char *quic_tp,
+                                 size_t quic_tp_len);
+
+/* Report properties of a successful handshake */
+void Curl_gtls_report_handshake(struct Curl_easy *data, struct gtls_ctx *gctx);
 
 extern const struct Curl_ssl Curl_ssl_gnutls;
 
diff --git a/third-party/curl/lib/vtls/hostcheck.c b/third-party/curl/lib/vtls/hostcheck.c
index 2726dca7f2..ad09b83194 100644
--- a/third-party/curl/lib/vtls/hostcheck.c
+++ b/third-party/curl/lib/vtls/hostcheck.c
@@ -21,11 +21,9 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#if defined(USE_OPENSSL)                        \
-  || defined(USE_SCHANNEL)
+#if defined(USE_OPENSSL) || defined(USE_SCHANNEL)
 /* these backends use functions from this file */
 
 #ifdef HAVE_NETINET_IN_H
@@ -34,16 +32,11 @@
 #ifdef HAVE_NETINET_IN6_H
 #include <netinet/in6.h>
 #endif
+
 #include "curl_memrchr.h"
-
-#include "hostcheck.h"
-#include "strcase.h"
+#include "vtls/hostcheck.h"
 #include "hostip.h"
 
-#include "curl_memory.h"
-/* The last #include file should be: */
-#include "memdebug.h"
-
 /* check the two input strings with given length, but do not
    assume they end in nul-bytes */
 static bool pmatch(const char *hostname, size_t hostlen,
@@ -51,7 +44,7 @@ static bool pmatch(const char *hostname, size_t hostlen,
 {
   if(hostlen != patternlen)
     return FALSE;
-  return strncasecompare(hostname, pattern, hostlen);
+  return curl_strnequal(hostname, pattern, hostlen);
 }
 
 /*
@@ -62,7 +55,7 @@ static bool pmatch(const char *hostname, size_t hostlen,
  * We use the matching rule described in RFC6125, section 6.4.3.
  * https://datatracker.ietf.org/doc/html/rfc6125#section-6.4.3
  *
- * In addition: ignore trailing dots in the host names and wildcards, so that
+ * In addition: ignore trailing dots in the hostnames and wildcards, so that
  * the names are used normalized. This is what the browsers do.
  *
  * Do not allow wildcard matching on IP numbers. There are apparently
@@ -91,16 +84,16 @@ static bool hostmatch(const char *hostname,
   DEBUGASSERT(hostlen);
 
   /* normalize pattern and hostname by stripping off trailing dots */
-  if(hostname[hostlen-1]=='.')
+  if(hostname[hostlen - 1] == '.')
     hostlen--;
-  if(pattern[patternlen-1]=='.')
+  if(pattern[patternlen - 1] == '.')
     patternlen--;
 
   if(strncmp(pattern, "*.", 2))
     return pmatch(hostname, hostlen, pattern, patternlen);
 
-  /* detect IP address as hostname and fail the match if so */
-  else if(Curl_host_is_ipnum(hostname))
+  /* detect host as IP address or starting with a dot and fail if so */
+  else if(Curl_host_is_ipnum(hostname) || (hostname[0] == '.'))
     return FALSE;
 
   /* We require at least 2 dots in the pattern to avoid too wide wildcard
@@ -132,4 +125,4 @@ bool Curl_cert_hostcheck(const char *match, size_t matchlen,
   return FALSE;
 }
 
-#endif /* OPENSSL or SCHANNEL */
+#endif /* USE_OPENSSL || USE_SCHANNEL */
diff --git a/third-party/curl/lib/vtls/hostcheck.h b/third-party/curl/lib/vtls/hostcheck.h
index 22a1ac2e56..d8e1a52377 100644
--- a/third-party/curl/lib/vtls/hostcheck.h
+++ b/third-party/curl/lib/vtls/hostcheck.h
@@ -23,11 +23,14 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "curl_setup.h"
 
-#include <curl/curl.h>
+#if defined(USE_OPENSSL) || defined(USE_SCHANNEL)
 
-/* returns TRUE if there's a match */
-bool Curl_cert_hostcheck(const char *match_pattern, size_t matchlen,
+/* returns TRUE if there is a match */
+bool Curl_cert_hostcheck(const char *match, size_t matchlen,
                          const char *hostname, size_t hostlen);
 
+#endif
+
 #endif /* HEADER_CURL_HOSTCHECK_H */
diff --git a/third-party/curl/lib/vtls/keylog.c b/third-party/curl/lib/vtls/keylog.c
index d37bb183e7..094bf69db7 100644
--- a/third-party/curl/lib/vtls/keylog.c
+++ b/third-party/curl/lib/vtls/keylog.c
@@ -22,84 +22,72 @@
  *
  ***************************************************************************/
 #include "curl_setup.h"
+#include "vtls/keylog.h"
 
-#include "keylog.h"
-#include <curl/curl.h>
-
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
-
-#define KEYLOG_LABEL_MAXLEN (sizeof("CLIENT_HANDSHAKE_TRAFFIC_SECRET") - 1)
-
-#define CLIENT_RANDOM_SIZE  32
-
-/*
- * The master secret in TLS 1.2 and before is always 48 bytes. In TLS 1.3, the
- * secret size depends on the cipher suite's hash function which is 32 bytes
- * for SHA-256 and 48 bytes for SHA-384.
- */
-#define SECRET_MAXLEN       48
+#if defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_WOLFSSL) || \
+  defined(USE_RUSTLS)
 
+#include "escape.h"
+#include "curlx/fopen.h"
 
 /* The fp for the open SSLKEYLOGFILE, or NULL if not open */
 static FILE *keylog_file_fp;
+/* Used for verbose logging */
+static char *keylog_file_name;
 
-void
-Curl_tls_keylog_open(void)
+void Curl_tls_keylog_open(void)
 {
-  char *keylog_file_name;
-
   if(!keylog_file_fp) {
-    keylog_file_name = curl_getenv("SSLKEYLOGFILE");
+    keylog_file_name = getenv("SSLKEYLOGFILE");
     if(keylog_file_name) {
-      keylog_file_fp = fopen(keylog_file_name, FOPEN_APPENDTEXT);
+      keylog_file_fp = curlx_fopen(keylog_file_name, FOPEN_APPENDTEXT);
       if(keylog_file_fp) {
-#ifdef WIN32
+#ifdef _WIN32
         if(setvbuf(keylog_file_fp, NULL, _IONBF, 0))
 #else
         if(setvbuf(keylog_file_fp, NULL, _IOLBF, 4096))
 #endif
         {
-          fclose(keylog_file_fp);
+          curlx_fclose(keylog_file_fp);
           keylog_file_fp = NULL;
         }
       }
-      Curl_safefree(keylog_file_name);
     }
   }
 }
 
-void
-Curl_tls_keylog_close(void)
+void Curl_tls_keylog_close(void)
 {
   if(keylog_file_fp) {
-    fclose(keylog_file_fp);
+    curlx_fclose(keylog_file_fp);
     keylog_file_fp = NULL;
   }
 }
 
-bool
-Curl_tls_keylog_enabled(void)
+bool Curl_tls_keylog_enabled(void)
 {
-  return keylog_file_fp != NULL;
+  return !!keylog_file_fp;
 }
 
-bool
-Curl_tls_keylog_write_line(const char *line)
+const char *Curl_tls_keylog_file_name(void)
+{
+  return keylog_file_name;
+}
+
+bool Curl_tls_keylog_write_line(const char *line)
 {
   /* The current maximum valid keylog line length LF and NUL is 195. */
   size_t linelen;
   char buf[256];
 
   if(!keylog_file_fp || !line) {
-    return false;
+    return FALSE;
   }
 
   linelen = strlen(line);
   if(linelen == 0 || linelen > sizeof(buf) - 2) {
-    /* Empty line or too big to fit in a LF and NUL. */
-    return false;
+    /* Empty line or too big to fit in an LF and NUL. */
+    return FALSE;
   }
 
   memcpy(buf, line, linelen);
@@ -111,27 +99,27 @@ Curl_tls_keylog_write_line(const char *line)
   /* Using fputs here instead of fprintf since libcurl's fprintf replacement
      may not be thread-safe. */
   fputs(buf, keylog_file_fp);
-  return true;
+  return TRUE;
 }
 
-bool
-Curl_tls_keylog_write(const char *label,
-                      const unsigned char client_random[CLIENT_RANDOM_SIZE],
-                      const unsigned char *secret, size_t secretlen)
+bool Curl_tls_keylog_write(
+  const char *label,
+  const unsigned char client_random[CLIENT_RANDOM_SIZE],
+  const unsigned char *secret, size_t secretlen)
 {
-  const char *hex = "0123456789ABCDEF";
   size_t pos, i;
-  char line[KEYLOG_LABEL_MAXLEN + 1 + 2 * CLIENT_RANDOM_SIZE + 1 +
-            2 * SECRET_MAXLEN + 1 + 1];
+  unsigned char line[KEYLOG_LABEL_MAXLEN + 1 +
+                     (2 * CLIENT_RANDOM_SIZE) + 1 +
+                     (2 * SECRET_MAXLEN) + 1 + 1];
 
   if(!keylog_file_fp) {
-    return false;
+    return FALSE;
   }
 
   pos = strlen(label);
   if(pos > KEYLOG_LABEL_MAXLEN || !secretlen || secretlen > SECRET_MAXLEN) {
     /* Should never happen - sanity check anyway. */
-    return false;
+    return FALSE;
   }
 
   memcpy(line, label, pos);
@@ -139,21 +127,35 @@ Curl_tls_keylog_write(const char *label,
 
   /* Client Random */
   for(i = 0; i < CLIENT_RANDOM_SIZE; i++) {
-    line[pos++] = hex[client_random[i] >> 4];
-    line[pos++] = hex[client_random[i] & 0xF];
+    Curl_hexbyte(&line[pos], client_random[i]);
+    pos += 2;
   }
   line[pos++] = ' ';
 
   /* Secret */
   for(i = 0; i < secretlen; i++) {
-    line[pos++] = hex[secret[i] >> 4];
-    line[pos++] = hex[secret[i] & 0xF];
+    Curl_hexbyte(&line[pos], secret[i]);
+    pos += 2;
   }
   line[pos++] = '\n';
   line[pos] = '\0';
 
   /* Using fputs here instead of fprintf since libcurl's fprintf replacement
      may not be thread-safe. */
-  fputs(line, keylog_file_fp);
-  return true;
+  fputs((char *)line, keylog_file_fp);
+  return TRUE;
 }
+
+#else /* TLS backend */
+
+bool Curl_tls_keylog_enabled(void)
+{
+  return FALSE;
+}
+
+const char *Curl_tls_keylog_file_name(void)
+{
+  return NULL;
+}
+
+#endif  /* TLS backend */
diff --git a/third-party/curl/lib/vtls/keylog.h b/third-party/curl/lib/vtls/keylog.h
index eff5bf38f3..b09fcc6f4d 100644
--- a/third-party/curl/lib/vtls/keylog.h
+++ b/third-party/curl/lib/vtls/keylog.h
@@ -25,6 +25,17 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
+#define KEYLOG_LABEL_MAXLEN (sizeof("CLIENT_HANDSHAKE_TRAFFIC_SECRET") - 1)
+
+#define CLIENT_RANDOM_SIZE  32
+
+/*
+ * The master secret in TLS 1.2 and before is always 48 bytes. In TLS 1.3, the
+ * secret size depends on the cipher suite's hash function which is 32 bytes
+ * for SHA-256 and 48 bytes for SHA-384.
+ */
+#define SECRET_MAXLEN       48
+
 /*
  * Opens the TLS key log file if requested by the user. The SSLKEYLOGFILE
  * environment variable specifies the output file.
@@ -41,16 +52,22 @@ void Curl_tls_keylog_close(void);
  */
 bool Curl_tls_keylog_enabled(void);
 
+/*
+ * Returns a pointer to the filename keys are being written to, if enabled.
+ */
+const char *Curl_tls_keylog_file_name(void);
+
 /*
  * Appends a key log file entry.
  * Returns true iff the key log file is open and a valid entry was provided.
  */
-bool Curl_tls_keylog_write(const char *label,
-                           const unsigned char client_random[32],
-                           const unsigned char *secret, size_t secretlen);
+bool Curl_tls_keylog_write(
+  const char *label,
+  const unsigned char client_random[CLIENT_RANDOM_SIZE],
+  const unsigned char *secret, size_t secretlen);
 
 /*
- * Appends a line to the key log file, ensure it is terminated by a LF.
+ * Appends a line to the key log file, ensure it is terminated by an LF.
  * Returns true iff the key log file is open and a valid line was provided.
  */
 bool Curl_tls_keylog_write_line(const char *line);
diff --git a/third-party/curl/lib/vtls/mbedtls.c b/third-party/curl/lib/vtls/mbedtls.c
index f45636e57e..57727613ae 100644
--- a/third-party/curl/lib/vtls/mbedtls.c
+++ b/third-party/curl/lib/vtls/mbedtls.c
@@ -22,13 +22,11 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /*
  * Source file for all mbedTLS-specific code for the TLS/SSL layer. No code
  * but vtls.c should ever call or use these functions.
  *
  */
-
 #include "curl_setup.h"
 
 #ifdef USE_MBEDTLS
@@ -37,53 +35,46 @@
 /* #define MBEDTLS_DEBUG */
 
 #include <mbedtls/version.h>
-#if MBEDTLS_VERSION_NUMBER >= 0x02040000
-#include <mbedtls/net_sockets.h>
-#else
-#include <mbedtls/net.h>
+#if MBEDTLS_VERSION_NUMBER < 0x03020000
+#error "mbedTLS 3.2.0 or later required"
 #endif
+#include <psa/crypto_config.h>
+#include <mbedtls/net_sockets.h>
 #include <mbedtls/ssl.h>
 #include <mbedtls/x509.h>
+#include <mbedtls/psa_util.h>
 
-#include <mbedtls/error.h>
-#include <mbedtls/entropy.h>
-#include <mbedtls/ctr_drbg.h>
-#include <mbedtls/sha256.h>
-
-#if MBEDTLS_VERSION_MAJOR >= 2
-#  ifdef MBEDTLS_DEBUG
-#    include <mbedtls/debug.h>
-#  endif
+#if MBEDTLS_VERSION_NUMBER < 0x04000000 && !defined(MBEDTLS_CTR_DRBG_C)
+#error "MBEDTLS_CTR_DRBG_C is required for mbedTLS 3.x."
 #endif
 
-#include "urldata.h"
-#include "sendf.h"
-#include "inet_pton.h"
-#include "mbedtls.h"
-#include "vtls.h"
-#include "vtls_int.h"
-#include "parsedate.h"
-#include "connect.h" /* for the connect timeout */
-#include "select.h"
-#include "multiif.h"
-#include "mbedtls_threadlock.h"
+#include <mbedtls/error.h>
+#if MBEDTLS_VERSION_NUMBER < 0x04000000
+#include <mbedtls/entropy.h>
+#include <mbedtls/ctr_drbg.h>
+#endif
+#ifdef MBEDTLS_DEBUG
+#include <mbedtls/debug.h>
+#endif
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "vtls/cipher_suite.h"
+#include "urldata.h"
+#include "curl_trc.h"
+#include "vtls/mbedtls.h"
+#include "vtls/vtls.h"
+#include "vtls/vtls_int.h"
+#include "vtls/vtls_scache.h"
+#include "vtls/x509asn1.h"
+#include "connect.h" /* for the connect timeout */
+#include "curlx/strdup.h"
+#include "curl_sha256.h"
 
 /* ALPN for http2 */
-#ifdef USE_HTTP2
-#  undef HAS_ALPN
-#  ifdef MBEDTLS_SSL_ALPN
-#    define HAS_ALPN
-#  endif
+#if defined(USE_HTTP2) && defined(MBEDTLS_SSL_ALPN)
+#define HAS_ALPN_MBEDTLS
 #endif
 
 struct mbed_ssl_backend_data {
-  mbedtls_ctr_drbg_context ctr_drbg;
-  mbedtls_entropy_context entropy;
   mbedtls_ssl_context ssl;
   mbedtls_x509_crt cacert;
   mbedtls_x509_crt clicert;
@@ -92,292 +83,454 @@ struct mbed_ssl_backend_data {
 #endif
   mbedtls_pk_context pk;
   mbedtls_ssl_config config;
-#ifdef HAS_ALPN
+#ifdef HAS_ALPN_MBEDTLS
   const char *protocols[3];
 #endif
+  int *ciphersuites;
+  size_t send_blocked_len;
+  BIT(initialized); /* mbedtls_ssl_context is initialized */
+  BIT(sent_shutdown);
+  BIT(send_blocked);
 };
 
-/* apply threading? */
-#if defined(USE_THREADS_POSIX) || defined(USE_THREADS_WIN32)
-#define THREADING_SUPPORT
+/** A context for random number generation (RNG).
+ */
+#if MBEDTLS_VERSION_NUMBER < 0x04000000
+struct rng_context_t {
+  mbedtls_entropy_context entropy;
+  mbedtls_ctr_drbg_context drbg;
+};
+
+static struct rng_context_t rng;
 #endif
 
 #ifndef MBEDTLS_ERROR_C
-#define mbedtls_strerror(a,b,c) b[0] = 0
+#define mbedtls_strerror(a, b, c) b[0] = 0
 #endif
 
-#if defined(THREADING_SUPPORT)
-static mbedtls_entropy_context ts_entropy;
-
-static int entropy_init_initialized = 0;
-
-/* start of entropy_init_mutex() */
-static void entropy_init_mutex(mbedtls_entropy_context *ctx)
-{
-  /* lock 0 = entropy_init_mutex() */
-  Curl_mbedtlsthreadlock_lock_function(0);
-  if(entropy_init_initialized == 0) {
-    mbedtls_entropy_init(ctx);
-    entropy_init_initialized = 1;
-  }
-  Curl_mbedtlsthreadlock_unlock_function(0);
-}
-/* end of entropy_init_mutex() */
-
-/* start of entropy_func_mutex() */
-static int entropy_func_mutex(void *data, unsigned char *output, size_t len)
-{
-  int ret;
-  /* lock 1 = entropy_func_mutex() */
-  Curl_mbedtlsthreadlock_lock_function(1);
-  ret = mbedtls_entropy_func(data, output, len);
-  Curl_mbedtlsthreadlock_unlock_function(1);
-
-  return ret;
-}
-/* end of entropy_func_mutex() */
-
-#endif /* THREADING_SUPPORT */
-
 #ifdef MBEDTLS_DEBUG
 static void mbed_debug(void *context, int level, const char *f_name,
                        int line_nb, const char *line)
 {
-  struct Curl_easy *data = NULL;
+  struct Curl_easy *data = (struct Curl_easy *)context;
+  (void)level;
+  (void)line_nb;
+  (void)f_name;
 
-  if(!context)
-    return;
-
-  data = (struct Curl_easy *)context;
-
-  infof(data, "%s", line);
-  (void) level;
+  if(data) {
+    size_t len = strlen(line);
+    if(len && (line[len - 1] == '\n'))
+      /* discount any trailing newline */
+      len--;
+    infof(data, "%.*s", (int)len, line);
+  }
 }
-#else
 #endif
 
-static int bio_cf_write(void *bio, const unsigned char *buf, size_t blen)
+static int mbedtls_bio_cf_write(void *bio,
+                                const unsigned char *buf, size_t blen)
 {
   struct Curl_cfilter *cf = bio;
   struct Curl_easy *data = CF_DATA_CURRENT(cf);
-  ssize_t nwritten;
+  size_t nwritten;
   CURLcode result;
 
   DEBUGASSERT(data);
-  nwritten = Curl_conn_cf_send(cf->next, data, (char *)buf, blen, &result);
-  CURL_TRC_CF(data, cf, "bio_cf_out_write(len=%zu) -> %zd, err=%d",
-              blen, nwritten, result);
-  if(nwritten < 0 && CURLE_AGAIN == result) {
-    nwritten = MBEDTLS_ERR_SSL_WANT_WRITE;
-  }
-  return (int)nwritten;
+  if(!data)
+    return 0;
+
+  result = Curl_conn_cf_send(cf->next, data, buf, blen, FALSE, &nwritten);
+  CURL_TRC_CF(data, cf, "mbedtls_bio_cf_out_write(len=%zu) -> %d, %zu",
+              blen, (int)result, nwritten);
+  if(result == CURLE_AGAIN)
+    return MBEDTLS_ERR_SSL_WANT_WRITE;
+  return result ? -1 : (int)nwritten;
 }
 
-static int bio_cf_read(void *bio, unsigned char *buf, size_t blen)
+static int mbedtls_bio_cf_read(void *bio, unsigned char *buf, size_t blen)
 {
   struct Curl_cfilter *cf = bio;
   struct Curl_easy *data = CF_DATA_CURRENT(cf);
-  ssize_t nread;
+  size_t nread = 0;
   CURLcode result;
 
   DEBUGASSERT(data);
+  if(!data)
+    return 0;
   /* OpenSSL catches this case, so should we. */
   if(!buf)
     return 0;
 
-  nread = Curl_conn_cf_recv(cf->next, data, (char *)buf, blen, &result);
-  CURL_TRC_CF(data, cf, "bio_cf_in_read(len=%zu) -> %zd, err=%d",
-              blen, nread, result);
-  if(nread < 0 && CURLE_AGAIN == result) {
-    nread = MBEDTLS_ERR_SSL_WANT_READ;
-  }
-  return (int)nread;
+  result = Curl_conn_cf_recv(cf->next, data, (char *)buf, blen, &nread);
+  CURL_TRC_CF(data, cf, "mbedtls_bio_cf_in_read(len=%zu) -> %d, %zu",
+              blen, (int)result, nread);
+  if(result == CURLE_AGAIN)
+    return MBEDTLS_ERR_SSL_WANT_READ;
+  /* nread is never larger than int here */
+  return result ? -1 : (int)nread;
 }
 
-/*
- *  profile
+/* See:
+ * https://web.archive.org/web/20200921194007/tls.mbed.org/discussions/generic/howto-determine-exact-buffer-len-for-mbedtls_pk_write_pubkey_der
  */
-static const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_fr =
-{
-  /* Hashes from SHA-1 and above */
-  MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA1) |
-  MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_RIPEMD160) |
-  MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA224) |
-  MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA256) |
-  MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA384) |
-  MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA512),
-  0xFFFFFFF, /* Any PK alg    */
-  0xFFFFFFF, /* Any curve     */
-  1024,      /* RSA min key len */
-};
-
-/* See https://tls.mbed.org/discussions/generic/
-   howto-determine-exact-buffer-len-for-mbedtls_pk_write_pubkey_der
-*/
-#define RSA_PUB_DER_MAX_BYTES   (38 + 2 * MBEDTLS_MPI_MAX_SIZE)
-#define ECP_PUB_DER_MAX_BYTES   (30 + 2 * MBEDTLS_ECP_MAX_BYTES)
+#define RSA_PUB_DER_MAX_BYTES   (38 + (2 * MBEDTLS_MPI_MAX_SIZE))
+#define ECP_PUB_DER_MAX_BYTES   (30 + (2 * MBEDTLS_ECP_MAX_BYTES))
 
 #define PUB_DER_MAX_BYTES   (RSA_PUB_DER_MAX_BYTES > ECP_PUB_DER_MAX_BYTES ? \
                              RSA_PUB_DER_MAX_BYTES : ECP_PUB_DER_MAX_BYTES)
 
-static CURLcode mbedtls_version_from_curl(int *mbedver, long version)
+static CURLcode mbed_set_ssl_version_min_max(
+  struct Curl_easy *data,
+  struct mbed_ssl_backend_data *backend,
+  struct ssl_primary_config *conn_config)
 {
-#if MBEDTLS_VERSION_NUMBER >= 0x03000000
-  switch(version) {
-    case CURL_SSLVERSION_TLSv1_0:
-    case CURL_SSLVERSION_TLSv1_1:
-    case CURL_SSLVERSION_TLSv1_2:
-      *mbedver = MBEDTLS_SSL_MINOR_VERSION_3;
-      return CURLE_OK;
-    case CURL_SSLVERSION_TLSv1_3:
-      break;
-  }
+  mbedtls_ssl_protocol_version ver_min =
+#ifdef MBEDTLS_SSL_PROTO_TLS1_2
+    MBEDTLS_SSL_VERSION_TLS1_2
 #else
-  switch(version) {
-    case CURL_SSLVERSION_TLSv1_0:
-      *mbedver = MBEDTLS_SSL_MINOR_VERSION_1;
-      return CURLE_OK;
-    case CURL_SSLVERSION_TLSv1_1:
-      *mbedver = MBEDTLS_SSL_MINOR_VERSION_2;
-      return CURLE_OK;
-    case CURL_SSLVERSION_TLSv1_2:
-      *mbedver = MBEDTLS_SSL_MINOR_VERSION_3;
-      return CURLE_OK;
-    case CURL_SSLVERSION_TLSv1_3:
-      break;
+    MBEDTLS_SSL_VERSION_TLS1_3
+#endif
+    ;
+  mbedtls_ssl_protocol_version ver_max =
+#ifdef MBEDTLS_SSL_PROTO_TLS1_3
+    MBEDTLS_SSL_VERSION_TLS1_3
+#else
+    MBEDTLS_SSL_VERSION_TLS1_2
+#endif
+    ;
+
+  DEBUGASSERT(conn_config->version != CURL_SSLVERSION_DEFAULT);
+  switch(conn_config->version) {
+  case CURL_SSLVERSION_TLSv1:
+  case CURL_SSLVERSION_TLSv1_0:
+  case CURL_SSLVERSION_TLSv1_1:
+  case CURL_SSLVERSION_TLSv1_2:
+#ifdef MBEDTLS_SSL_PROTO_TLS1_2
+    ver_min = MBEDTLS_SSL_VERSION_TLS1_2;
+    break;
+#endif
+  case CURL_SSLVERSION_TLSv1_3:
+#ifdef MBEDTLS_SSL_PROTO_TLS1_3
+    ver_min = MBEDTLS_SSL_VERSION_TLS1_3;
+    break;
+#endif
+  default:
+    failf(data, "mbedTLS: unsupported minimum TLS version value: %x",
+          conn_config->version);
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  switch(conn_config->version_max) {
+  case CURL_SSLVERSION_MAX_DEFAULT:
+  case CURL_SSLVERSION_MAX_NONE:
+  case CURL_SSLVERSION_MAX_TLSv1_3:
+#ifdef MBEDTLS_SSL_PROTO_TLS1_3
+    ver_max = MBEDTLS_SSL_VERSION_TLS1_3;
+    break;
+#endif
+#ifdef MBEDTLS_SSL_PROTO_TLS1_2
+  case CURL_SSLVERSION_MAX_TLSv1_2:
+    ver_max = MBEDTLS_SSL_VERSION_TLS1_2;
+    break;
+#endif
+  case CURL_SSLVERSION_MAX_TLSv1_1:
+  case CURL_SSLVERSION_MAX_TLSv1_0:
+  default:
+    failf(data, "mbedTLS: unsupported maximum TLS version value");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  mbedtls_ssl_conf_min_tls_version(&backend->config, ver_min);
+  mbedtls_ssl_conf_max_tls_version(&backend->config, ver_max);
+
+  return CURLE_OK;
+}
+
+/* TLS_ECJPAKE_WITH_AES_128_CCM_8 (0xC0FF) is marked experimental in mbedTLS.
+   The number is not reserved by IANA nor is the cipher suite present in other
+   SSL implementations. Provide provisional support for specifying the cipher
+   suite here. */
+#ifdef MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8
+static int mbed_cipher_suite_get_str(uint16_t id, char *buf, size_t buf_size,
+                                     bool prefer_rfc)
+{
+  if(id == MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8)
+    curl_msnprintf(buf, buf_size, "%s", "TLS_ECJPAKE_WITH_AES_128_CCM_8");
+  else
+    return Curl_cipher_suite_get_str(id, buf, buf_size, prefer_rfc);
+  return 0;
+}
+
+static uint16_t mbed_cipher_suite_walk_str(const char **str, const char **end)
+{
+  uint16_t id = Curl_cipher_suite_walk_str(str, end);
+  size_t len = *end - *str;
+  static const char ecjpake_suite[] = "TLS_ECJPAKE_WITH_AES_128_CCM_8";
+
+  if(!id) {
+    if((len == sizeof(ecjpake_suite) - 1) &&
+       curl_strnequal(ecjpake_suite, *str, len))
+      id = MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8;
+  }
+  return id;
+}
+#else
+#define mbed_cipher_suite_get_str  Curl_cipher_suite_get_str
+#define mbed_cipher_suite_walk_str Curl_cipher_suite_walk_str
+#endif
+
+static CURLcode mbed_set_selected_ciphers(
+  struct Curl_easy *data,
+  struct mbed_ssl_backend_data *backend,
+  const char *ciphers12,
+  const char *ciphers13)
+{
+  const char *ciphers = ciphers12;
+  const int *supported;
+  int *selected;
+  size_t supported_len, count = 0, default13_count = 0, i, j;
+  const char *ptr, *end;
+
+  supported = mbedtls_ssl_list_ciphersuites();
+  for(i = 0; supported[i] != 0; i++)
+    ;
+  supported_len = i;
+
+  selected = curlx_malloc(sizeof(int) * (supported_len + 1));
+  if(!selected)
+    return CURLE_OUT_OF_MEMORY;
+
+#ifndef MBEDTLS_SSL_PROTO_TLS1_3
+  (void)ciphers13, (void)j;
+#else
+  if(!ciphers13) {
+    /* Add default TLSv1.3 ciphers to selection */
+    for(j = 0; j < supported_len; j++) {
+      uint16_t id = (uint16_t)supported[j];
+      if(strncmp(mbedtls_ssl_get_ciphersuite_name(id), "TLS1-3", 6))
+        continue;
+
+      selected[count++] = id;
+    }
+
+    default13_count = count;
+  }
+  else
+    ciphers = ciphers13;
+
+add_ciphers:
+#endif
+  for(ptr = ciphers; ptr[0] != '\0' && count < supported_len; ptr = end) {
+    uint16_t id = mbed_cipher_suite_walk_str(&ptr, &end);
+
+    /* Check if cipher is supported */
+    if(id) {
+      for(i = 0; i < supported_len && supported[i] != id; i++)
+        ;
+      if(i == supported_len)
+        id = 0;
+    }
+    if(!id) {
+      if(ptr[0] != '\0')
+        infof(data, "mbedTLS: unknown cipher in list: \"%.*s\"",
+              (int)(end - ptr), ptr);
+      continue;
+    }
+
+    /* No duplicates allowed (so selected cannot overflow) */
+    for(i = 0; i < count && selected[i] != id; i++)
+      ;
+    if(i < count) {
+      if(i >= default13_count)
+        infof(data, "mbedTLS: duplicate cipher in list: \"%.*s\"",
+              (int)(end - ptr), ptr);
+      continue;
+    }
+
+    selected[count++] = id;
+  }
+
+#ifdef MBEDTLS_SSL_PROTO_TLS1_3
+  if(ciphers == ciphers13 && ciphers12) {
+    ciphers = ciphers12;
+    goto add_ciphers;
+  }
+
+  if(!ciphers12) {
+    /* Add default TLSv1.2 ciphers to selection */
+    for(j = 0; j < supported_len; j++) {
+      uint16_t id = (uint16_t)supported[j];
+      if(!strncmp(mbedtls_ssl_get_ciphersuite_name(id), "TLS1-3", 6))
+        continue;
+
+      /* No duplicates allowed (so selected cannot overflow) */
+      for(i = 0; i < count && selected[i] != id; i++)
+        ;
+      if(i < count)
+        continue;
+
+      selected[count++] = id;
+    }
   }
 #endif
 
-  return CURLE_SSL_CONNECT_ERROR;
+  selected[count] = 0;
+
+  if(count == 0) {
+    curlx_free(selected);
+    failf(data, "mbedTLS: no supported cipher in list");
+    return CURLE_SSL_CIPHER;
+  }
+
+  /* mbedtls_ssl_conf_ciphersuites(): The ciphersuites array is not copied.
+     It must remain valid for the lifetime of the SSL configuration */
+  backend->ciphersuites = selected;
+  mbedtls_ssl_conf_ciphersuites(&backend->config, backend->ciphersuites);
+  return CURLE_OK;
 }
 
-static CURLcode
-set_ssl_version_min_max(struct Curl_cfilter *cf, struct Curl_easy *data)
+static void mbed_dump_cert_info(struct Curl_easy *data,
+                                const mbedtls_x509_crt *crt)
 {
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct mbed_ssl_backend_data *backend =
-    (struct mbed_ssl_backend_data *)connssl->backend;
+#if !defined(CURLVERBOSE) || defined(MBEDTLS_X509_REMOVE_INFO)
+  (void)data, (void)crt;
+#else
+  const size_t bufsize = 16384;
+  char *p, *buffer = curlx_malloc(bufsize);
+
+  if(buffer && mbedtls_x509_crt_info(buffer, bufsize, " ", crt) > 0) {
+    infof(data, "Server certificate:");
+    for(p = buffer; *p; p += *p != '\0') {
+      size_t s = strcspn(p, "\n");
+      infof(data, "%.*s", (int)s, p);
+      p += s;
+    }
+  }
+  else
+    infof(data, "Unable to dump certificate information");
+
+  curlx_free(buffer);
+#endif
+}
+
+static void mbed_extract_certinfo(struct Curl_easy *data,
+                                  const mbedtls_x509_crt *crt)
+{
+  CURLcode result;
+  const mbedtls_x509_crt *cur;
+  int cert_count = 0;
+  int i;
+
+  for(cur = crt; cur && cert_count <= MAX_ALLOWED_CERT_AMOUNT; cur = cur->next)
+    cert_count++;
+
+  if(cert_count > MAX_ALLOWED_CERT_AMOUNT) {
+    infof(data, "More certificates than allowed (%d), skipping certinfo",
+          MAX_ALLOWED_CERT_AMOUNT);
+    return;
+  }
+
+  result = Curl_ssl_init_certinfo(data, cert_count);
+
+  for(i = 0, cur = crt; result == CURLE_OK && cur; ++i, cur = cur->next) {
+    const char *beg = (const char *)cur->raw.p;
+    const char *end = beg + cur->raw.len;
+    result = Curl_extract_certinfo(data, i, beg, end);
+  }
+}
+
+static int mbed_verify_cb(void *ptr, mbedtls_x509_crt *crt,
+                          int depth, uint32_t *flags)
+{
+  struct Curl_cfilter *cf = (struct Curl_cfilter *)ptr;
   struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
-#if MBEDTLS_VERSION_NUMBER >= 0x03000000
-  int mbedtls_ver_min = MBEDTLS_SSL_MINOR_VERSION_3;
-  int mbedtls_ver_max = MBEDTLS_SSL_MINOR_VERSION_3;
+  struct Curl_easy *data = CF_DATA_CURRENT(cf);
+
+  if(depth == 0) {
+    if(data->set.verbose)
+      mbed_dump_cert_info(data, crt);
+    if(data->set.ssl.certinfo)
+      mbed_extract_certinfo(data, crt);
+  }
+
+  if(!conn_config->verifypeer)
+    *flags = 0;
+  else if(!conn_config->verifyhost)
+    *flags &= ~MBEDTLS_X509_BADCERT_CN_MISMATCH;
+
+  if(*flags) {
+#ifndef MBEDTLS_X509_REMOVE_INFO
+    char buf[128];
+    mbedtls_x509_crt_verify_info(buf, sizeof(buf), "", *flags);
+    failf(data, "mbedTLS: %s", buf);
 #else
-  int mbedtls_ver_min = MBEDTLS_SSL_MINOR_VERSION_1;
-  int mbedtls_ver_max = MBEDTLS_SSL_MINOR_VERSION_1;
+    failf(data, "mbedTLS: certificate verification error 0x%08x",
+          (unsigned int)*flags);
 #endif
-  long ssl_version = conn_config->version;
-  long ssl_version_max = conn_config->version_max;
-  CURLcode result = CURLE_OK;
-
-  DEBUGASSERT(backend);
-
-  switch(ssl_version) {
-    case CURL_SSLVERSION_DEFAULT:
-    case CURL_SSLVERSION_TLSv1:
-      ssl_version = CURL_SSLVERSION_TLSv1_0;
-      break;
   }
 
-  switch(ssl_version_max) {
-    case CURL_SSLVERSION_MAX_NONE:
-    case CURL_SSLVERSION_MAX_DEFAULT:
-      ssl_version_max = CURL_SSLVERSION_MAX_TLSv1_2;
-      break;
-  }
-
-  result = mbedtls_version_from_curl(&mbedtls_ver_min, ssl_version);
-  if(result) {
-    failf(data, "unsupported min version passed via CURLOPT_SSLVERSION");
-    return result;
-  }
-  result = mbedtls_version_from_curl(&mbedtls_ver_max, ssl_version_max >> 16);
-  if(result) {
-    failf(data, "unsupported max version passed via CURLOPT_SSLVERSION");
-    return result;
-  }
-
-  mbedtls_ssl_conf_min_version(&backend->config, MBEDTLS_SSL_MAJOR_VERSION_3,
-                               mbedtls_ver_min);
-  mbedtls_ssl_conf_max_version(&backend->config, MBEDTLS_SSL_MAJOR_VERSION_3,
-                               mbedtls_ver_max);
-
-  return result;
+  return 0;
 }
 
-static CURLcode
-mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
+static CURLcode mbed_load_cacert(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data)
 {
   struct ssl_connect_data *connssl = cf->ctx;
   struct mbed_ssl_backend_data *backend =
     (struct mbed_ssl_backend_data *)connssl->backend;
   struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
   const struct curl_blob *ca_info_blob = conn_config->ca_info_blob;
-  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
   const char * const ssl_cafile =
     /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
     (ca_info_blob ? NULL : conn_config->CAfile);
   const bool verifypeer = conn_config->verifypeer;
   const char * const ssl_capath = conn_config->CApath;
-  char * const ssl_cert = ssl_config->primary.clientcert;
-  const struct curl_blob *ssl_cert_blob = ssl_config->primary.cert_blob;
-  const char * const ssl_crlfile = ssl_config->primary.CRLfile;
-  const char *hostname = connssl->hostname;
+#ifdef MBEDTLS_PEM_PARSE_C
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+  const char * const ssl_cert_type = ssl_config->primary.cert_type;
+#endif
   int ret = -1;
   char errorbuf[128];
 
-  DEBUGASSERT(backend);
-
-  if((conn_config->version == CURL_SSLVERSION_SSLv2) ||
-     (conn_config->version == CURL_SSLVERSION_SSLv3)) {
-    failf(data, "Not supported SSL version");
-    return CURLE_NOT_BUILT_IN;
-  }
-
-#ifdef THREADING_SUPPORT
-  entropy_init_mutex(&ts_entropy);
-  mbedtls_ctr_drbg_init(&backend->ctr_drbg);
-
-  ret = mbedtls_ctr_drbg_seed(&backend->ctr_drbg, entropy_func_mutex,
-                              &ts_entropy, NULL, 0);
-  if(ret) {
-    mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
-    failf(data, "mbedtls_ctr_drbg_seed returned (-0x%04X) %s",
-          -ret, errorbuf);
-    return CURLE_FAILED_INIT;
-  }
-#else
-  mbedtls_entropy_init(&backend->entropy);
-  mbedtls_ctr_drbg_init(&backend->ctr_drbg);
-
-  ret = mbedtls_ctr_drbg_seed(&backend->ctr_drbg, mbedtls_entropy_func,
-                              &backend->entropy, NULL, 0);
-  if(ret) {
-    mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
-    failf(data, "mbedtls_ctr_drbg_seed returned (-0x%04X) %s",
-          -ret, errorbuf);
-    return CURLE_FAILED_INIT;
-  }
-#endif /* THREADING_SUPPORT */
-
-  /* Load the trusted CA */
   mbedtls_x509_crt_init(&backend->cacert);
 
   if(ca_info_blob && verifypeer) {
-    /* Unfortunately, mbedtls_x509_crt_parse() requires the data to be null
-       terminated even when provided the exact length, forcing us to waste
-       extra memory here. */
-    unsigned char *newblob = malloc(ca_info_blob->len + 1);
-    if(!newblob)
-      return CURLE_OUT_OF_MEMORY;
-    memcpy(newblob, ca_info_blob->data, ca_info_blob->len);
-    newblob[ca_info_blob->len] = 0; /* null terminate */
-    ret = mbedtls_x509_crt_parse(&backend->cacert, newblob,
-                                 ca_info_blob->len + 1);
-    free(newblob);
-    if(ret<0) {
+#ifdef MBEDTLS_PEM_PARSE_C
+    /* if DER or a null-terminated PEM process using
+       mbedtls_x509_crt_parse(). */
+    if((ssl_cert_type && curl_strequal(ssl_cert_type, "DER")) ||
+       ((char *)(ca_info_blob->data))[ca_info_blob->len - 1] == '\0') {
+      ret = mbedtls_x509_crt_parse(&backend->cacert, ca_info_blob->data,
+                                   ca_info_blob->len);
+    }
+    else { /* they say it is PEM and it is not null-terminated */
+
+      /* Unfortunately, mbedtls_x509_crt_parse() requires the data to be
+         null-terminated if the data is PEM encoded (even when provided the
+         exact length). The function accepts PEM or DER formats, but we cannot
+         assume if the user passed in a PEM format cert that it is
+         null-terminated. */
+      unsigned char *newblob = curlx_memdup0(ca_info_blob->data,
+                                             ca_info_blob->len);
+      if(!newblob)
+        return CURLE_OUT_OF_MEMORY;
+
+      ret = mbedtls_x509_crt_parse(&backend->cacert, newblob,
+                                   ca_info_blob->len + 1);
+      curlx_free(newblob);
+    }
+#else
+    /* DER encoded certs do not need to be null-terminated because it is a
+       binary format. Thus, if we are not compiling with PEM_PARSE we can avoid
+       the extra memory copies altogether. */
+    ret = mbedtls_x509_crt_parse_der(&backend->cacert, ca_info_blob->data,
+                                     ca_info_blob->len);
+#endif
+
+    if(ret < 0) {
       mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
-      failf(data, "Error importing ca cert blob - mbedTLS: (-0x%04X) %s",
-            -ret, errorbuf);
+      failf(data, "mbedTLS: error importing CA cert blob: (-0x%04X) %s",
+            (unsigned int)-ret, errorbuf);
       return CURLE_SSL_CERTPROBLEM;
     }
   }
@@ -386,14 +539,14 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
 #ifdef MBEDTLS_FS_IO
     ret = mbedtls_x509_crt_parse_file(&backend->cacert, ssl_cafile);
 
-    if(ret<0) {
+    if(ret < 0) {
       mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
-      failf(data, "Error reading ca cert file %s - mbedTLS: (-0x%04X) %s",
-            ssl_cafile, -ret, errorbuf);
+      failf(data, "mbedTLS: error reading CA cert file %s: (-0x%04X) %s",
+            ssl_cafile, (unsigned int)-ret, errorbuf);
       return CURLE_SSL_CACERT_BADFILE;
     }
 #else
-    failf(data, "mbedtls: functions that use the filesystem not built in");
+    failf(data, "mbedTLS: functions that use the file system not built in");
     return CURLE_NOT_BUILT_IN;
 #endif
   }
@@ -402,21 +555,38 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
 #ifdef MBEDTLS_FS_IO
     ret = mbedtls_x509_crt_parse_path(&backend->cacert, ssl_capath);
 
-    if(ret<0) {
+    if(ret < 0) {
       mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
-      failf(data, "Error reading ca cert path %s - mbedTLS: (-0x%04X) %s",
-            ssl_capath, -ret, errorbuf);
+      failf(data, "mbedTLS: error reading CA cert path %s: (-0x%04X) %s",
+            ssl_capath, (unsigned int)-ret, errorbuf);
 
       if(verifypeer)
         return CURLE_SSL_CACERT_BADFILE;
     }
 #else
-    failf(data, "mbedtls: functions that use the filesystem not built in");
+    failf(data, "mbedTLS: functions that use the file system not built in");
     return CURLE_NOT_BUILT_IN;
 #endif
   }
 
-  /* Load the client certificate */
+  return CURLE_OK;
+}
+
+static CURLcode mbed_load_clicert(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct mbed_ssl_backend_data *backend =
+    (struct mbed_ssl_backend_data *)connssl->backend;
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+  char * const ssl_cert = ssl_config->primary.clientcert;
+  const struct curl_blob *ssl_cert_blob = ssl_config->primary.cert_blob;
+#ifdef MBEDTLS_PEM_PARSE_C
+  const char * const ssl_cert_type = ssl_config->primary.cert_type;
+#endif
+  int ret = -1;
+  char errorbuf[128];
+
   mbedtls_x509_crt_init(&backend->clicert);
 
   if(ssl_cert) {
@@ -425,123 +595,211 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
 
     if(ret) {
       mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
-      failf(data, "Error reading client cert file %s - mbedTLS: (-0x%04X) %s",
-            ssl_cert, -ret, errorbuf);
+      failf(data, "mbedTLS: error reading client cert file %s: (-0x%04X) %s",
+            ssl_cert, (unsigned int)-ret, errorbuf);
 
       return CURLE_SSL_CERTPROBLEM;
     }
 #else
-    failf(data, "mbedtls: functions that use the filesystem not built in");
+    failf(data, "mbedTLS: functions that use the file system not built in");
     return CURLE_NOT_BUILT_IN;
 #endif
   }
 
   if(ssl_cert_blob) {
-    /* Unfortunately, mbedtls_x509_crt_parse() requires the data to be null
-       terminated even when provided the exact length, forcing us to waste
-       extra memory here. */
-    unsigned char *newblob = malloc(ssl_cert_blob->len + 1);
-    if(!newblob)
-      return CURLE_OUT_OF_MEMORY;
-    memcpy(newblob, ssl_cert_blob->data, ssl_cert_blob->len);
-    newblob[ssl_cert_blob->len] = 0; /* null terminate */
-    ret = mbedtls_x509_crt_parse(&backend->clicert, newblob,
-                                 ssl_cert_blob->len + 1);
-    free(newblob);
+#ifdef MBEDTLS_PEM_PARSE_C
+    /* if DER or a null-terminated PEM process using
+       mbedtls_x509_crt_parse(). */
+    if((ssl_cert_type && curl_strequal(ssl_cert_type, "DER")) ||
+       ((char *)(ssl_cert_blob->data))[ssl_cert_blob->len - 1] == '\0') {
+
+      ret = mbedtls_x509_crt_parse(&backend->clicert,
+                                   ssl_cert_blob->data,
+                                   ssl_cert_blob->len);
+    }
+    else { /* they say it is PEM and it is not null-terminated */
+
+      /* Unfortunately, mbedtls_x509_crt_parse() requires the data to be
+         null-terminated if the data is PEM encoded (even when provided the
+         exact length). The function accepts PEM or DER formats, but we cannot
+         assume if the user passed in a PEM format cert that it is
+         null-terminated. */
+      unsigned char *newblob = curlx_memdup0(ssl_cert_blob->data,
+                                             ssl_cert_blob->len);
+      if(!newblob)
+        return CURLE_OUT_OF_MEMORY;
+      ret = mbedtls_x509_crt_parse(&backend->clicert, newblob,
+                                   ssl_cert_blob->len + 1);
+      curlx_free(newblob);
+    }
+#else
+    /* DER encoded certs do not need to be null-terminated because it is a
+       binary format. Thus, if we are not compiling with PEM_PARSE we can avoid
+       the extra memory copies altogether. */
+    ret = mbedtls_x509_crt_parse_der(&backend->clicert, ssl_cert_blob->data,
+                                     ssl_cert_blob->len);
+#endif
 
     if(ret) {
       mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
-      failf(data, "Error reading private key %s - mbedTLS: (-0x%04X) %s",
-            ssl_config->key, -ret, errorbuf);
+      failf(data, "mbedTLS: error reading client cert blob: (-0x%04X) %s",
+            (unsigned int)-ret, errorbuf);
       return CURLE_SSL_CERTPROBLEM;
     }
   }
 
-  /* Load the client private key */
+  return CURLE_OK;
+}
+
+static CURLcode mbed_load_privkey(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct mbed_ssl_backend_data *backend =
+    (struct mbed_ssl_backend_data *)connssl->backend;
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+  int ret = -1;
+  char errorbuf[128];
+
   mbedtls_pk_init(&backend->pk);
 
-  if(ssl_config->key || ssl_config->key_blob) {
-    if(ssl_config->key) {
+  if(ssl_config->primary.key || ssl_config->primary.key_blob) {
+    if(ssl_config->primary.key) {
 #ifdef MBEDTLS_FS_IO
-#if MBEDTLS_VERSION_NUMBER >= 0x03000000
-      ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->key,
-                                     ssl_config->key_passwd,
-                                     mbedtls_ctr_drbg_random,
-                                     &backend->ctr_drbg);
+#if MBEDTLS_VERSION_NUMBER >= 0x04000000
+      ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->primary.key,
+                                     ssl_config->primary.key_passwd);
+      if(ret == 0 &&
+         !(mbedtls_pk_can_do_psa(&backend->pk,
+                                 PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_ANY_HASH),
+                                 PSA_KEY_USAGE_SIGN_HASH) ||
+           mbedtls_pk_can_do_psa(&backend->pk,
+                                 MBEDTLS_PK_ALG_ECDSA(PSA_ALG_ANY_HASH),
+                                 PSA_KEY_USAGE_SIGN_HASH)))
+        ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
 #else
-      ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->key,
-                                     ssl_config->key_passwd);
+      ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->primary.key,
+                                     ssl_config->primary.key_passwd,
+                                     mbedtls_ctr_drbg_random,
+                                     &rng.drbg);
+      if(ret == 0 && !(mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_RSA) ||
+                       mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_ECKEY)))
+        ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
 #endif
 
       if(ret) {
         mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
-        failf(data, "Error reading private key %s - mbedTLS: (-0x%04X) %s",
-              ssl_config->key, -ret, errorbuf);
+        failf(data, "mbedTLS: error reading private key %s: (-0x%04X) %s",
+              ssl_config->primary.key, (unsigned int)-ret, errorbuf);
         return CURLE_SSL_CERTPROBLEM;
       }
 #else
-      failf(data, "mbedtls: functions that use the filesystem not built in");
+      failf(data, "mbedTLS: functions that use the file system not built in");
       return CURLE_NOT_BUILT_IN;
 #endif
     }
     else {
-      const struct curl_blob *ssl_key_blob = ssl_config->key_blob;
-      const unsigned char *key_data =
-        (const unsigned char *)ssl_key_blob->data;
-      const char *passwd = ssl_config->key_passwd;
-#if MBEDTLS_VERSION_NUMBER >= 0x03000000
-      ret = mbedtls_pk_parse_key(&backend->pk, key_data, ssl_key_blob->len,
+      const struct curl_blob *ssl_key_blob = ssl_config->primary.key_blob;
+      const char *passwd = ssl_config->primary.key_passwd;
+      /* Unfortunately, mbedtls_pk_parse_key() requires the data to be
+         null-terminated if the data is PEM encoded (even when provided the
+         exact length). */
+      unsigned char *newblob = curlx_memdup0(ssl_key_blob->data,
+                                             ssl_key_blob->len);
+      if(!newblob)
+        return CURLE_OUT_OF_MEMORY;
+
+#if MBEDTLS_VERSION_NUMBER >= 0x04000000
+      ret = mbedtls_pk_parse_key(&backend->pk, newblob, ssl_key_blob->len,
+                                 (const unsigned char *)passwd,
+                                 passwd ? strlen(passwd) : 0);
+      if(ret == 0 &&
+         !(mbedtls_pk_can_do_psa(&backend->pk,
+                                 PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_ANY_HASH),
+                                 PSA_KEY_USAGE_SIGN_HASH) ||
+           mbedtls_pk_can_do_psa(&backend->pk,
+                                 MBEDTLS_PK_ALG_ECDSA(PSA_ALG_ANY_HASH),
+                                 PSA_KEY_USAGE_SIGN_HASH)))
+        ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
+#else
+      ret = mbedtls_pk_parse_key(&backend->pk, newblob, ssl_key_blob->len,
                                  (const unsigned char *)passwd,
                                  passwd ? strlen(passwd) : 0,
                                  mbedtls_ctr_drbg_random,
-                                 &backend->ctr_drbg);
-#else
-      ret = mbedtls_pk_parse_key(&backend->pk, key_data, ssl_key_blob->len,
-                                 (const unsigned char *)passwd,
-                                 passwd ? strlen(passwd) : 0);
+                                 &rng.drbg);
+      if(ret == 0 && !(mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_RSA) ||
+                       mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_ECKEY)))
+        ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
 #endif
+      curlx_free(newblob);
 
       if(ret) {
         mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
-        failf(data, "Error parsing private key - mbedTLS: (-0x%04X) %s",
-              -ret, errorbuf);
+        failf(data, "mbedTLS: error parsing private key: (-0x%04X) %s",
+              (unsigned int)-ret, errorbuf);
         return CURLE_SSL_CERTPROBLEM;
       }
     }
-
-    if(ret == 0 && !(mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_RSA) ||
-                     mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_ECKEY)))
-      ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
   }
 
-  /* Load the CRL */
+  return CURLE_OK;
+}
+
+static CURLcode mbed_load_crl(struct Curl_cfilter *cf,
+                              struct Curl_easy *data)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct mbed_ssl_backend_data *backend =
+    (struct mbed_ssl_backend_data *)connssl->backend;
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+  const char * const ssl_crlfile = ssl_config->primary.CRLfile;
+
 #ifdef MBEDTLS_X509_CRL_PARSE_C
   mbedtls_x509_crl_init(&backend->crl);
 
   if(ssl_crlfile) {
+    char errorbuf[128];
 #ifdef MBEDTLS_FS_IO
-    ret = mbedtls_x509_crl_parse_file(&backend->crl, ssl_crlfile);
+    int ret = mbedtls_x509_crl_parse_file(&backend->crl, ssl_crlfile);
 
     if(ret) {
       mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
-      failf(data, "Error reading CRL file %s - mbedTLS: (-0x%04X) %s",
-            ssl_crlfile, -ret, errorbuf);
+      failf(data, "mbedTLS: error reading CRL file %s: (-0x%04X) %s",
+            ssl_crlfile, (unsigned int)-ret, errorbuf);
 
       return CURLE_SSL_CRL_BADFILE;
     }
 #else
-    failf(data, "mbedtls: functions that use the filesystem not built in");
+    (void)errorbuf;
+    failf(data, "mbedTLS: functions that use the file system not built in");
     return CURLE_NOT_BUILT_IN;
 #endif
   }
 #else
+  (void)backend;
   if(ssl_crlfile) {
-    failf(data, "mbedtls: crl support not built in");
+    failf(data, "mbedTLS: CRL support not built in");
     return CURLE_NOT_BUILT_IN;
   }
 #endif
 
-  infof(data, "mbedTLS: Connecting to %s:%d", hostname, connssl->port);
+  return CURLE_OK;
+}
+
+static CURLcode mbed_configure_ssl(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct mbed_ssl_backend_data *backend =
+    (struct mbed_ssl_backend_data *)connssl->backend;
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+  int ret;
+  CURLcode result;
+  char errorbuf[128];
+
+  infof(data, "mbedTLS: Connecting to %s:%d",
+        connssl->peer.origin->hostname, connssl->peer.origin->port);
 
   mbedtls_ssl_config_init(&backend->config);
   ret = mbedtls_ssl_config_defaults(&backend->config,
@@ -553,120 +811,6 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
     return CURLE_SSL_CONNECT_ERROR;
   }
 
-  mbedtls_ssl_init(&backend->ssl);
-  if(mbedtls_ssl_setup(&backend->ssl, &backend->config)) {
-    failf(data, "mbedTLS: ssl_init failed");
-    return CURLE_SSL_CONNECT_ERROR;
-  }
-
-  /* new profile with RSA min key len = 1024 ... */
-  mbedtls_ssl_conf_cert_profile(&backend->config,
-                                &mbedtls_x509_crt_profile_fr);
-
-  switch(conn_config->version) {
-  case CURL_SSLVERSION_DEFAULT:
-  case CURL_SSLVERSION_TLSv1:
-#if MBEDTLS_VERSION_NUMBER < 0x03000000
-    mbedtls_ssl_conf_min_version(&backend->config, MBEDTLS_SSL_MAJOR_VERSION_3,
-                                 MBEDTLS_SSL_MINOR_VERSION_1);
-    infof(data, "mbedTLS: Set min SSL version to TLS 1.0");
-    break;
-#endif
-  case CURL_SSLVERSION_TLSv1_0:
-  case CURL_SSLVERSION_TLSv1_1:
-  case CURL_SSLVERSION_TLSv1_2:
-  case CURL_SSLVERSION_TLSv1_3:
-    {
-      CURLcode result = set_ssl_version_min_max(cf, data);
-      if(result != CURLE_OK)
-        return result;
-      break;
-    }
-  default:
-    failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
-    return CURLE_SSL_CONNECT_ERROR;
-  }
-
-  mbedtls_ssl_conf_authmode(&backend->config, MBEDTLS_SSL_VERIFY_OPTIONAL);
-
-  mbedtls_ssl_conf_rng(&backend->config, mbedtls_ctr_drbg_random,
-                       &backend->ctr_drbg);
-  mbedtls_ssl_set_bio(&backend->ssl, cf, bio_cf_write, bio_cf_read,
-                      NULL /*  rev_timeout() */);
-
-  mbedtls_ssl_conf_ciphersuites(&backend->config,
-                                mbedtls_ssl_list_ciphersuites());
-
-#if defined(MBEDTLS_SSL_RENEGOTIATION)
-  mbedtls_ssl_conf_renegotiation(&backend->config,
-                                 MBEDTLS_SSL_RENEGOTIATION_ENABLED);
-#endif
-
-#if defined(MBEDTLS_SSL_SESSION_TICKETS)
-  mbedtls_ssl_conf_session_tickets(&backend->config,
-                                   MBEDTLS_SSL_SESSION_TICKETS_DISABLED);
-#endif
-
-  /* Check if there's a cached ID we can/should use here! */
-  if(ssl_config->primary.sessionid) {
-    void *old_session = NULL;
-
-    Curl_ssl_sessionid_lock(data);
-    if(!Curl_ssl_getsessionid(cf, data, &old_session, NULL)) {
-      ret = mbedtls_ssl_set_session(&backend->ssl, old_session);
-      if(ret) {
-        Curl_ssl_sessionid_unlock(data);
-        failf(data, "mbedtls_ssl_set_session returned -0x%x", -ret);
-        return CURLE_SSL_CONNECT_ERROR;
-      }
-      infof(data, "mbedTLS reusing session");
-    }
-    Curl_ssl_sessionid_unlock(data);
-  }
-
-  mbedtls_ssl_conf_ca_chain(&backend->config,
-                            &backend->cacert,
-#ifdef MBEDTLS_X509_CRL_PARSE_C
-                            &backend->crl);
-#else
-                            NULL);
-#endif
-
-  if(ssl_config->key || ssl_config->key_blob) {
-    mbedtls_ssl_conf_own_cert(&backend->config,
-                              &backend->clicert, &backend->pk);
-  }
-  {
-    char *snihost = Curl_ssl_snihost(data, hostname, NULL);
-    if(!snihost || mbedtls_ssl_set_hostname(&backend->ssl, snihost)) {
-      /* mbedtls_ssl_set_hostname() sets the name to use in CN/SAN checks and
-         the name to set in the SNI extension. So even if curl connects to a
-         host specified as an IP address, this function must be used. */
-      failf(data, "Failed to set SNI");
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-  }
-
-#ifdef HAS_ALPN
-  if(connssl->alpn) {
-    struct alpn_proto_buf proto;
-    size_t i;
-
-    for(i = 0; i < connssl->alpn->count; ++i) {
-      backend->protocols[i] = connssl->alpn->entries[i];
-    }
-    /* this function doesn't clone the protocols array, which is why we need
-       to keep it around */
-    if(mbedtls_ssl_conf_alpn_protocols(&backend->config,
-                                       &backend->protocols[0])) {
-      failf(data, "Failed setting ALPN protocols");
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-    Curl_alpn_to_proto_str(&proto, connssl->alpn);
-    infof(data, VTLS_INFOF_ALPN_OFFER_1STR, proto.data);
-  }
-#endif
-
 #ifdef MBEDTLS_DEBUG
   /* In order to make that work in mbedtls MBEDTLS_DEBUG_C must be defined. */
   mbedtls_ssl_conf_dbg(&backend->config, mbed_debug, data);
@@ -679,121 +823,271 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
   mbedtls_debug_set_threshold(4);
 #endif
 
-  /* give application a chance to interfere with mbedTLS set up. */
-  if(data->set.ssl.fsslctx) {
-    ret = (*data->set.ssl.fsslctx)(data, &backend->config,
-                                   data->set.ssl.fsslctxp);
-    if(ret) {
-      failf(data, "error signaled by ssl ctx callback");
-      return ret;
-    }
+#if defined(MBEDTLS_SSL_SESSION_TICKETS) && \
+  defined(MBEDTLS_SSL_PROTO_TLS1_3) &&      \
+  MBEDTLS_VERSION_NUMBER >= 0x03060100 &&   \
+  MBEDTLS_VERSION_NUMBER < 0x04000000
+  /* New in mbedTLS 3.6.1, need to enable, default is now disabled. 4.0.0
+     enabled it by default for TLSv1.3. */
+  mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets(
+    &backend->config, MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED);
+#endif
+
+  /* Always let mbedTLS verify certificates, if verifypeer or verifyhost are
+   * disabled we clear the corresponding error flags in the verify callback
+   * function. That is also where we log verification errors. */
+  mbedtls_ssl_conf_verify(&backend->config, mbed_verify_cb, cf);
+  mbedtls_ssl_conf_authmode(&backend->config, MBEDTLS_SSL_VERIFY_REQUIRED);
+
+  mbedtls_ssl_init(&backend->ssl);
+  backend->initialized = TRUE;
+
+  /* use the default secure profile baked into mbedTLS */
+  mbedtls_ssl_conf_cert_profile(&backend->config,
+                                &mbedtls_x509_crt_profile_next);
+
+  result = mbed_set_ssl_version_min_max(data, backend, conn_config);
+  if(result)
+    return result;
+
+#if MBEDTLS_VERSION_NUMBER < 0x04000000
+  mbedtls_ssl_conf_rng(&backend->config, mbedtls_ctr_drbg_random,
+                       &rng.drbg);
+#endif
+
+  ret = mbedtls_ssl_setup(&backend->ssl,
+                          &backend->config);
+  if(ret) {
+    mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
+    failf(data, "mbedTLS: ssl_setup failed: "
+          "(-0x%04X) %s", (unsigned int)-ret, errorbuf);
+    return CURLE_SSL_CONNECT_ERROR;
   }
 
-  connssl->connecting_state = ssl_connect_2;
+  mbedtls_ssl_set_bio(&backend->ssl, cf,
+                      mbedtls_bio_cf_write,
+                      mbedtls_bio_cf_read,
+                      NULL /*  rev_timeout() */);
 
+#ifndef MBEDTLS_SSL_PROTO_TLS1_3
+  if(conn_config->cipher_list) {
+    result = mbed_set_selected_ciphers(data, backend,
+                                       conn_config->cipher_list, NULL);
+#else
+  if(conn_config->cipher_list || conn_config->cipher_list13) {
+    result = mbed_set_selected_ciphers(data, backend,
+                                       conn_config->cipher_list,
+                                       conn_config->cipher_list13);
+#endif
+    if(result) {
+      failf(data, "mbedTLS: failed to set cipher suites");
+      return result;
+    }
+  }
+  else {
+    mbedtls_ssl_conf_ciphersuites(&backend->config,
+                                  mbedtls_ssl_list_ciphersuites());
+  }
+
+#ifdef MBEDTLS_SSL_RENEGOTIATION
+  mbedtls_ssl_conf_renegotiation(&backend->config,
+                                 MBEDTLS_SSL_RENEGOTIATION_ENABLED);
+#endif
+
+#ifdef MBEDTLS_SSL_SESSION_TICKETS
+  mbedtls_ssl_conf_session_tickets(&backend->config,
+                                   MBEDTLS_SSL_SESSION_TICKETS_DISABLED);
+#endif
+
+  /* Check if there is a cached ID we can/should use here! */
+  if(Curl_ssl_scache_use(cf, data)) {
+    struct Curl_ssl_session *sc_session = NULL;
+    CURLcode sresult = Curl_ssl_scache_take(cf, data, connssl->peer.scache_key,
+                                            &sc_session);
+    if(!sresult && sc_session && sc_session->sdata && sc_session->sdata_len) {
+      mbedtls_ssl_session session;
+
+      mbedtls_ssl_session_init(&session);
+      ret = mbedtls_ssl_session_load(&session, sc_session->sdata,
+                                     sc_session->sdata_len);
+      if(ret) {
+        failf(data, "SSL session error loading: -0x%x", (unsigned int)-ret);
+      }
+      else {
+        ret = mbedtls_ssl_set_session(&backend->ssl, &session);
+        if(ret)
+          failf(data, "SSL session error setting: -0x%x", (unsigned int)-ret);
+        else
+          infof(data, "SSL reusing session ID");
+      }
+      mbedtls_ssl_session_free(&session);
+    }
+    Curl_ssl_scache_return(cf, data, connssl->peer.scache_key,
+                           sc_session);
+  }
+
+  mbedtls_ssl_conf_ca_chain(&backend->config, &backend->cacert,
+#ifdef MBEDTLS_X509_CRL_PARSE_C
+                            &backend->crl
+#else
+                            NULL
+#endif
+    );
+
+  if(ssl_config->primary.key || ssl_config->primary.key_blob) {
+    mbedtls_ssl_conf_own_cert(&backend->config, &backend->clicert,
+                              &backend->pk);
+  }
+
+  if(mbedtls_ssl_set_hostname(&backend->ssl, connssl->peer.sni ?
+                              connssl->peer.sni :
+                              connssl->peer.origin->hostname)) {
+    /* mbedtls_ssl_set_hostname() sets the name to use in CN/SAN checks and
+       the name to set in the SNI extension. Thus even if curl connects to
+       a host specified as an IP address, this function must be used. */
+    failf(data, "Failed to set SNI");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+#ifdef HAS_ALPN_MBEDTLS
+  if(connssl->alpn) {
+    struct alpn_proto_buf proto;
+    size_t i;
+
+    for(i = 0; i < connssl->alpn->count; ++i) {
+      backend->protocols[i] = connssl->alpn->entries[i];
+    }
+    /* this function does not clone the protocols array, which is why we need
+       to keep it around */
+    if(mbedtls_ssl_conf_alpn_protocols(&backend->config,
+                                       &backend->protocols[0])) {
+      failf(data, "Failed setting ALPN protocols");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+    Curl_alpn_to_proto_str(&proto, connssl->alpn);
+    infof(data, VTLS_INFOF_ALPN_OFFER_1STR, proto.data);
+  }
+#endif
+
+  /* give application a chance to interfere with mbedTLS set up. */
+  if(data->set.ssl.fsslctx) {
+    result = (*data->set.ssl.fsslctx)(data, &backend->config,
+                                      data->set.ssl.fsslctxp);
+    if(result)
+      failf(data, "error signaled by SSL ctx callback");
+  }
+
+  return result;
+}
+
+static CURLcode mbed_connect_step1(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  CURLcode result;
+
+  if((conn_config->version == CURL_SSLVERSION_SSLv2) ||
+     (conn_config->version == CURL_SSLVERSION_SSLv3)) {
+    failf(data, "Not supported SSL version");
+    return CURLE_NOT_BUILT_IN;
+  }
+
+  result = mbed_load_cacert(cf, data);
+  if(!result)
+    result = mbed_load_clicert(cf, data);
+  if(!result)
+    result = mbed_load_privkey(cf, data);
+  if(!result)
+    result = mbed_load_crl(cf, data);
+  if(!result)
+    result = mbed_configure_ssl(cf, data);
+  if(result)
+    return result;
+
+  connssl->connecting_state = ssl_connect_2;
   return CURLE_OK;
 }
 
-static CURLcode
-mbed_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
+#if defined(MBEDTLS_PK_WRITE_C) && defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
+#define HAVE_PINNED_PUBKEY
+#endif
+
+static CURLcode mbed_connect_step2(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data)
 {
+#if defined(HAVE_PINNED_PUBKEY) || defined(HAS_ALPN_MBEDTLS)
+  CURLcode result;
+#endif
   int ret;
   struct ssl_connect_data *connssl = cf->ctx;
   struct mbed_ssl_backend_data *backend =
     (struct mbed_ssl_backend_data *)connssl->backend;
-  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
-  const mbedtls_x509_crt *peercert;
-  const char * const pinnedpubkey = Curl_ssl_cf_is_proxy(cf)?
-    data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY]:
+#ifdef HAVE_PINNED_PUBKEY
+#ifndef CURL_DISABLE_PROXY
+  const char * const pinnedpubkey = Curl_ssl_cf_is_proxy(cf) ?
+    data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
     data->set.str[STRING_SSL_PINNEDPUBLICKEY];
+#else
+  const char * const pinnedpubkey = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
+#endif
+#endif
 
   DEBUGASSERT(backend);
 
   ret = mbedtls_ssl_handshake(&backend->ssl);
 
   if(ret == MBEDTLS_ERR_SSL_WANT_READ) {
-    connssl->connecting_state = ssl_connect_2_reading;
+    connssl->io_need = CURL_SSL_IO_NEED_RECV;
     return CURLE_OK;
   }
   else if(ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
-    connssl->connecting_state = ssl_connect_2_writing;
+    connssl->io_need = CURL_SSL_IO_NEED_SEND;
     return CURLE_OK;
   }
+  else if(ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED) {
+    failf(data, "peer certificate could not be verified");
+    return CURLE_PEER_FAILED_VERIFICATION;
+  }
   else if(ret) {
     char errorbuf[128];
+    CURL_TRC_CF(data, cf, "TLS version %04X",
+                mbedtls_ssl_get_version_number(&backend->ssl));
     mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
-    failf(data, "ssl_handshake returned - mbedTLS: (-0x%04X) %s",
-          -ret, errorbuf);
+    failf(data, "ssl_handshake returned: (-0x%04X) %s",
+          (unsigned int)-ret, errorbuf);
     return CURLE_SSL_CONNECT_ERROR;
   }
 
-  infof(data, "mbedTLS: Handshake complete, cipher is %s",
-        mbedtls_ssl_get_ciphersuite(&backend->ssl));
-
-  ret = mbedtls_ssl_get_verify_result(&backend->ssl);
-
-  if(!conn_config->verifyhost)
-    /* Ignore hostname errors if verifyhost is disabled */
-    ret &= ~MBEDTLS_X509_BADCERT_CN_MISMATCH;
-
-  if(ret && conn_config->verifypeer) {
-    if(ret & MBEDTLS_X509_BADCERT_EXPIRED)
-      failf(data, "Cert verify failed: BADCERT_EXPIRED");
-
-    else if(ret & MBEDTLS_X509_BADCERT_REVOKED)
-      failf(data, "Cert verify failed: BADCERT_REVOKED");
-
-    else if(ret & MBEDTLS_X509_BADCERT_CN_MISMATCH)
-      failf(data, "Cert verify failed: BADCERT_CN_MISMATCH");
-
-    else if(ret & MBEDTLS_X509_BADCERT_NOT_TRUSTED)
-      failf(data, "Cert verify failed: BADCERT_NOT_TRUSTED");
-
-    else if(ret & MBEDTLS_X509_BADCERT_FUTURE)
-      failf(data, "Cert verify failed: BADCERT_FUTURE");
-
-    return CURLE_PEER_FAILED_VERIFICATION;
-  }
-
-  peercert = mbedtls_ssl_get_peer_cert(&backend->ssl);
-
-  if(peercert && data->set.verbose) {
-    const size_t bufsize = 16384;
-    char *buffer = malloc(bufsize);
-
-    if(!buffer)
-      return CURLE_OUT_OF_MEMORY;
-
-    if(mbedtls_x509_crt_info(buffer, bufsize, "* ", peercert) > 0)
-      infof(data, "Dumping cert info: %s", buffer);
-    else
-      infof(data, "Unable to dump certificate information");
-
-    free(buffer);
+  {
+    char cipher_str[64];
+    uint16_t cipher_id;
+    cipher_id =
+      (uint16_t)mbedtls_ssl_get_ciphersuite_id_from_ssl(&backend->ssl);
+    mbed_cipher_suite_get_str(cipher_id, cipher_str, sizeof(cipher_str), TRUE);
+    infof(data, "mbedTLS: %s Handshake complete, cipher is %s",
+          mbedtls_ssl_get_version(&backend->ssl), cipher_str);
   }
 
+#ifdef HAVE_PINNED_PUBKEY
   if(pinnedpubkey) {
     int size;
-    CURLcode result;
+    const mbedtls_x509_crt *peercert;
     mbedtls_x509_crt *p = NULL;
     unsigned char *pubkey = NULL;
 
-#if MBEDTLS_VERSION_NUMBER == 0x03000000
-    if(!peercert || !peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(p) ||
-       !peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(len)) {
-#else
+    peercert = mbedtls_ssl_get_peer_cert(&backend->ssl);
     if(!peercert || !peercert->raw.p || !peercert->raw.len) {
-#endif
       failf(data, "Failed due to missing peer certificate");
       return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
     }
 
-    p = calloc(1, sizeof(*p));
+    p = curlx_calloc(1, sizeof(*p));
 
     if(!p)
       return CURLE_OUT_OF_MEMORY;
 
-    pubkey = malloc(PUB_DER_MAX_BYTES);
+    pubkey = curlx_malloc(PUB_DER_MAX_BYTES);
 
     if(!pubkey) {
       result = CURLE_OUT_OF_MEMORY;
@@ -804,25 +1098,14 @@ mbed_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
 
     /* Make a copy of our const peercert because mbedtls_pk_write_pubkey_der
        needs a non-const key, for now.
-       https://github.com/ARMmbed/mbedtls/issues/396 */
-#if MBEDTLS_VERSION_NUMBER == 0x03000000
-    if(mbedtls_x509_crt_parse_der(p,
-                        peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(p),
-                        peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(len))) {
-#else
+       https://github.com/Mbed-TLS/mbedtls/issues/396 */
     if(mbedtls_x509_crt_parse_der(p, peercert->raw.p, peercert->raw.len)) {
-#endif
       failf(data, "Failed copying peer certificate");
       result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
       goto pinnedpubkey_error;
     }
 
-#if MBEDTLS_VERSION_NUMBER == 0x03000000
-    size = mbedtls_pk_write_pubkey_der(&p->MBEDTLS_PRIVATE(pk), pubkey,
-                                       PUB_DER_MAX_BYTES);
-#else
     size = mbedtls_pk_write_pubkey_der(&p->pk, pubkey, PUB_DER_MAX_BYTES);
-#endif
 
     if(size <= 0) {
       failf(data, "Failed copying public key from peer certificate");
@@ -836,19 +1119,22 @@ mbed_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
                                   &pubkey[PUB_DER_MAX_BYTES - size], size);
 pinnedpubkey_error:
     mbedtls_x509_crt_free(p);
-    free(p);
-    free(pubkey);
-    if(result) {
+    curlx_free(p);
+    curlx_free(pubkey);
+    if(result)
       return result;
-    }
   }
+#endif
 
-#ifdef HAS_ALPN
+#ifdef HAS_ALPN_MBEDTLS
   if(connssl->alpn) {
     const char *proto = mbedtls_ssl_get_alpn_protocol(&backend->ssl);
 
-    Curl_alpn_set_negotiated(cf, data, (const unsigned char *)proto,
-                             proto? strlen(proto) : 0);
+    result = Curl_alpn_set_negotiated(cf, data, connssl,
+                                      (const unsigned char *)proto,
+                                      proto ? strlen(proto) : 0);
+    if(result)
+      return result;
   }
 #endif
 
@@ -858,87 +1144,218 @@ pinnedpubkey_error:
   return CURLE_OK;
 }
 
-static CURLcode
-mbed_connect_step3(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  CURLcode retcode = CURLE_OK;
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct mbed_ssl_backend_data *backend =
-    (struct mbed_ssl_backend_data *)connssl->backend;
-  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
-
-  DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);
-  DEBUGASSERT(backend);
-
-  if(ssl_config->primary.sessionid) {
-    int ret;
-    mbedtls_ssl_session *our_ssl_sessionid;
-    void *old_ssl_sessionid = NULL;
-    bool added = FALSE;
-
-    our_ssl_sessionid = malloc(sizeof(mbedtls_ssl_session));
-    if(!our_ssl_sessionid)
-      return CURLE_OUT_OF_MEMORY;
-
-    mbedtls_ssl_session_init(our_ssl_sessionid);
-
-    ret = mbedtls_ssl_get_session(&backend->ssl, our_ssl_sessionid);
-    if(ret) {
-      if(ret != MBEDTLS_ERR_SSL_ALLOC_FAILED)
-        mbedtls_ssl_session_free(our_ssl_sessionid);
-      free(our_ssl_sessionid);
-      failf(data, "mbedtls_ssl_get_session returned -0x%x", -ret);
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-
-    /* If there's already a matching session in the cache, delete it */
-    Curl_ssl_sessionid_lock(data);
-    if(!Curl_ssl_getsessionid(cf, data, &old_ssl_sessionid, NULL))
-      Curl_ssl_delsessionid(data, old_ssl_sessionid);
-
-    retcode = Curl_ssl_addsessionid(cf, data, our_ssl_sessionid,
-                                    0, &added);
-    Curl_ssl_sessionid_unlock(data);
-    if(!added) {
-      mbedtls_ssl_session_free(our_ssl_sessionid);
-      free(our_ssl_sessionid);
-    }
-    if(retcode) {
-      failf(data, "failed to store ssl session");
-      return retcode;
-    }
-  }
-
-  connssl->connecting_state = ssl_connect_done;
-
-  return CURLE_OK;
-}
-
-static ssize_t mbed_send(struct Curl_cfilter *cf, struct Curl_easy *data,
-                         const void *mem, size_t len,
-                         CURLcode *curlcode)
+static CURLcode mbed_new_session(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data)
 {
   struct ssl_connect_data *connssl = cf->ctx;
   struct mbed_ssl_backend_data *backend =
     (struct mbed_ssl_backend_data *)connssl->backend;
-  int ret = -1;
+  mbedtls_ssl_session session;
+  bool msession_alloced = FALSE;
+  struct Curl_ssl_session *sc_session = NULL;
+  unsigned char *sdata = NULL;
+  size_t slen = 0;
+  int ietf_tls_id;
+  CURLcode result = CURLE_OK;
+  int ret;
 
-  (void)data;
   DEBUGASSERT(backend);
-  ret = mbedtls_ssl_write(&backend->ssl, (unsigned char *)mem, len);
+  if(!Curl_ssl_scache_use(cf, data))
+    return CURLE_OK;
 
-  if(ret < 0) {
-    *curlcode = (ret == MBEDTLS_ERR_SSL_WANT_WRITE) ?
-      CURLE_AGAIN : CURLE_SEND_ERROR;
-    ret = -1;
+  mbedtls_ssl_session_init(&session);
+  ret = mbedtls_ssl_get_session(&backend->ssl, &session);
+  msession_alloced = (ret != MBEDTLS_ERR_SSL_ALLOC_FAILED);
+  if(ret) {
+    failf(data, "mbedtls_ssl_get_session returned -0x%x", (unsigned int)-ret);
+    result = CURLE_SSL_CONNECT_ERROR;
+    goto out;
   }
 
-  return ret;
+  mbedtls_ssl_session_save(&session, NULL, 0, &slen);
+  if(!slen) {
+    failf(data, "failed to serialize session: length is 0");
+    goto out;
+  }
+
+  sdata = curlx_malloc(slen);
+  if(!sdata) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  ret = mbedtls_ssl_session_save(&session, sdata, slen, &slen);
+  if(ret) {
+    failf(data, "failed to serialize session: -0x%x", (unsigned int)-ret);
+    goto out;
+  }
+
+  ietf_tls_id = mbedtls_ssl_get_version_number(&backend->ssl);
+  result = Curl_ssl_session_create(sdata, slen,
+                                   ietf_tls_id,
+                                   connssl->negotiated.alpn, 0, 0,
+                                   &sc_session);
+  sdata = NULL;  /* call took ownership */
+  if(!result)
+    result = Curl_ssl_scache_put(cf, data, connssl->peer.scache_key,
+                                 sc_session);
+
+out:
+  if(msession_alloced)
+    mbedtls_ssl_session_free(&session);
+  curlx_free(sdata);
+  return result;
 }
 
-static void mbedtls_close_all(struct Curl_easy *data)
+static CURLcode mbed_send(struct Curl_cfilter *cf, struct Curl_easy *data,
+                          const void *mem, size_t len, size_t *pnwritten)
 {
-  (void)data;
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct mbed_ssl_backend_data *backend =
+    (struct mbed_ssl_backend_data *)connssl->backend;
+  CURLcode result = CURLE_OK;
+  int nwritten;
+
+  DEBUGASSERT(backend);
+  *pnwritten = 0;
+  connssl->io_need = CURL_SSL_IO_NEED_NONE;
+  /* mbedTLS is picky when a mbedtls_ssl_write() was previously blocked.
+   * It requires to be called with the same amount of bytes again, or it
+   * loses bytes, e.g. reporting all was sent but they were not.
+   * Remember the blocked length and use that when set. */
+  if(backend->send_blocked) {
+    DEBUGASSERT(backend->send_blocked_len <= len);
+    CURL_TRC_CF(data, cf, "mbedtls_ssl_write(len=%zu) -> previously blocked "
+                "on %zu bytes", len, backend->send_blocked_len);
+    len = backend->send_blocked_len;
+  }
+
+  nwritten = mbedtls_ssl_write(&backend->ssl, (const unsigned char *)mem, len);
+
+  if(nwritten >= 0) {
+    *pnwritten = (size_t)nwritten;
+    backend->send_blocked = FALSE;
+  }
+  else {
+    CURL_TRC_CF(data, cf, "mbedtls_ssl_write(len=%zu) -> -0x%04X",
+                len, (unsigned int)-nwritten);
+    switch(nwritten) {
+#ifdef MBEDTLS_SSL_PROTO_TLS1_3
+    case MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET:
+#endif
+    case MBEDTLS_ERR_SSL_WANT_READ:
+      connssl->io_need = CURL_SSL_IO_NEED_RECV;
+      result = CURLE_AGAIN;
+      break;
+    case MBEDTLS_ERR_SSL_WANT_WRITE:
+      connssl->io_need = CURL_SSL_IO_NEED_SEND;
+      result = CURLE_AGAIN;
+      break;
+    default:
+      result = CURLE_SEND_ERROR;
+      break;
+    }
+    if((result == CURLE_AGAIN) && !backend->send_blocked) {
+      backend->send_blocked = TRUE;
+      backend->send_blocked_len = len;
+    }
+  }
+
+  CURL_TRC_CF(data, cf, "mbedtls_ssl_write(len=%zu) -> %d, %zu",
+              len, (int)result, *pnwritten);
+  return result;
+}
+
+static CURLcode mbedtls_shutdown(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 bool send_shutdown, bool *done)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct mbed_ssl_backend_data *backend =
+    (struct mbed_ssl_backend_data *)connssl->backend;
+  unsigned char buf[1024];
+  CURLcode result = CURLE_OK;
+  int ret = 0;
+  size_t i;
+
+  DEBUGASSERT(backend);
+
+  if(!backend->initialized || cf->shutdown) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  connssl->io_need = CURL_SSL_IO_NEED_NONE;
+  *done = FALSE;
+
+  if(!backend->sent_shutdown) {
+    /* do this only once */
+    backend->sent_shutdown = TRUE;
+    if(send_shutdown) {
+      ret = mbedtls_ssl_close_notify(&backend->ssl);
+      switch(ret) {
+      case 0: /* we sent it, receive from the server */
+        break;
+      case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY: /* server also closed */
+        *done = TRUE;
+        goto out;
+      case MBEDTLS_ERR_SSL_WANT_READ:
+        connssl->io_need = CURL_SSL_IO_NEED_RECV;
+        goto out;
+      case MBEDTLS_ERR_SSL_WANT_WRITE:
+        connssl->io_need = CURL_SSL_IO_NEED_SEND;
+        goto out;
+      default:
+        CURL_TRC_CF(data, cf, "mbedtls_shutdown error -0x%04X",
+                    (unsigned int)-ret);
+        result = CURLE_RECV_ERROR;
+        goto out;
+      }
+    }
+  }
+
+  /* SSL should now have started the shutdown from our side. Since it
+   * was not complete, we are lacking the close notify from the server. */
+  for(i = 0; i < 10; ++i) {
+    ret = mbedtls_ssl_read(&backend->ssl, buf, sizeof(buf));
+    /* This seems to be a bug in mbedTLS TLSv1.3 where it reports
+     * WANT_READ, but has not encountered an EAGAIN. */
+    if(ret == MBEDTLS_ERR_SSL_WANT_READ)
+      ret = mbedtls_ssl_read(&backend->ssl, buf, sizeof(buf));
+#ifdef MBEDTLS_SSL_PROTO_TLS1_3
+    if(ret == MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET)
+      continue;
+#endif
+    if(ret <= 0)
+      break;
+  }
+
+  if(ret > 0) {
+    /* still data coming in? */
+    CURL_TRC_CF(data, cf, "mbedtls_shutdown, still getting data");
+  }
+  else if(ret == 0 || (ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY)) {
+    /* We got the close notify alert and are done. */
+    CURL_TRC_CF(data, cf, "mbedtls_shutdown done");
+    *done = TRUE;
+  }
+  else if(ret == MBEDTLS_ERR_SSL_WANT_READ) {
+    CURL_TRC_CF(data, cf, "mbedtls_shutdown, need RECV");
+    connssl->io_need = CURL_SSL_IO_NEED_RECV;
+  }
+  else if(ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
+    CURL_TRC_CF(data, cf, "mbedtls_shutdown, need SEND");
+    connssl->io_need = CURL_SSL_IO_NEED_SEND;
+  }
+  else {
+    CURL_TRC_CF(data, cf, "mbedtls_shutdown error -0x%04X",
+                (unsigned int)-ret);
+    result = CURLE_RECV_ERROR;
+  }
+
+out:
+  cf->shutdown = (result || *done);
+  return result;
 }
 
 static void mbedtls_close(struct Curl_cfilter *cf, struct Curl_easy *data)
@@ -946,63 +1363,69 @@ static void mbedtls_close(struct Curl_cfilter *cf, struct Curl_easy *data)
   struct ssl_connect_data *connssl = cf->ctx;
   struct mbed_ssl_backend_data *backend =
     (struct mbed_ssl_backend_data *)connssl->backend;
-  char buf[32];
 
   (void)data;
   DEBUGASSERT(backend);
-
-  /* Maybe the server has already sent a close notify alert.
-     Read it to avoid an RST on the TCP connection. */
-  (void)mbedtls_ssl_read(&backend->ssl, (unsigned char *)buf, sizeof(buf));
-
   mbedtls_pk_free(&backend->pk);
   mbedtls_x509_crt_free(&backend->clicert);
   mbedtls_x509_crt_free(&backend->cacert);
 #ifdef MBEDTLS_X509_CRL_PARSE_C
   mbedtls_x509_crl_free(&backend->crl);
 #endif
+  curlx_safefree(backend->ciphersuites);
   mbedtls_ssl_config_free(&backend->config);
-  mbedtls_ssl_free(&backend->ssl);
-  mbedtls_ctr_drbg_free(&backend->ctr_drbg);
-#ifndef THREADING_SUPPORT
-  mbedtls_entropy_free(&backend->entropy);
-#endif /* THREADING_SUPPORT */
+  if(backend->initialized) {
+    mbedtls_ssl_free(&backend->ssl);
+    backend->initialized = FALSE;
+  }
 }
 
-static ssize_t mbed_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
-                         char *buf, size_t buffersize,
-                         CURLcode *curlcode)
+static CURLcode mbed_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
+                          char *buf, size_t buffersize, size_t *pnread)
 {
   struct ssl_connect_data *connssl = cf->ctx;
   struct mbed_ssl_backend_data *backend =
     (struct mbed_ssl_backend_data *)connssl->backend;
-  int ret = -1;
-  ssize_t len = -1;
+  CURLcode result = CURLE_OK;
+  int nread;
 
-  (void)data;
   DEBUGASSERT(backend);
+  *pnread = 0;
+  connssl->io_need = CURL_SSL_IO_NEED_NONE;
 
-  ret = mbedtls_ssl_read(&backend->ssl, (unsigned char *)buf,
-                         buffersize);
-
-  if(ret <= 0) {
-    if(ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY)
-      return 0;
-
-    *curlcode = (ret == MBEDTLS_ERR_SSL_WANT_READ) ?
-      CURLE_AGAIN : CURLE_RECV_ERROR;
-    return -1;
+  nread = mbedtls_ssl_read(&backend->ssl, (unsigned char *)buf, buffersize);
+  if(nread > 0)
+    *pnread = (size_t)nread;
+  else {
+    char errorbuf[128];
+    CURL_TRC_CF(data, cf, "mbedtls_ssl_read(len=%zu) -> -0x%04X",
+                buffersize, (unsigned int)-nread);
+    switch(nread) {
+#ifdef MBEDTLS_SSL_SESSION_TICKETS
+    case MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET:
+      mbed_new_session(cf, data);
+      FALLTHROUGH();
+#endif
+    case MBEDTLS_ERR_SSL_WANT_READ:
+      connssl->io_need = CURL_SSL_IO_NEED_RECV;
+      result = CURLE_AGAIN;
+      break;
+    case MBEDTLS_ERR_SSL_WANT_WRITE:
+      connssl->io_need = CURL_SSL_IO_NEED_SEND;
+      result = CURLE_AGAIN;
+      break;
+    case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY:
+      result = CURLE_OK;
+      break;
+    default:
+      mbedtls_strerror(nread, errorbuf, sizeof(errorbuf));
+      failf(data, "ssl_read returned: (-0x%04X) %s", (unsigned int)-nread,
+            errorbuf);
+      result = CURLE_RECV_ERROR;
+      break;
+    }
   }
-
-  len = ret;
-
-  return len;
-}
-
-static void mbedtls_session_free(void *ptr)
-{
-  mbedtls_ssl_session_free(ptr);
-  free(ptr);
+  return result;
 }
 
 static size_t mbedtls_version(char *buffer, size_t size)
@@ -1010,67 +1433,31 @@ static size_t mbedtls_version(char *buffer, size_t size)
 #ifdef MBEDTLS_VERSION_C
   /* if mbedtls_version_get_number() is available it is better */
   unsigned int version = mbedtls_version_get_number();
-  return msnprintf(buffer, size, "mbedTLS/%u.%u.%u", version>>24,
-                   (version>>16)&0xff, (version>>8)&0xff);
+  return curl_msnprintf(buffer, size, "mbedTLS/%u.%u.%u", version >> 24,
+                        (version >> 16) & 0xff, (version >> 8) & 0xff);
 #else
-  return msnprintf(buffer, size, "mbedTLS/%s", MBEDTLS_VERSION_STRING);
+  return curl_msnprintf(buffer, size, "mbedTLS/%s", MBEDTLS_VERSION_STRING);
 #endif
 }
 
+/* 'data' might be NULL */
 static CURLcode mbedtls_random(struct Curl_easy *data,
                                unsigned char *entropy, size_t length)
 {
-#if defined(MBEDTLS_CTR_DRBG_C)
-  int ret = -1;
-  char errorbuf[128];
-  mbedtls_entropy_context ctr_entropy;
-  mbedtls_ctr_drbg_context ctr_drbg;
-  mbedtls_entropy_init(&ctr_entropy);
-  mbedtls_ctr_drbg_init(&ctr_drbg);
+  psa_status_t status;
+  (void)data;
 
-  ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func,
-                              &ctr_entropy, NULL, 0);
+  status = psa_generate_random(entropy, length);
 
-  if(ret) {
-    mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
-    failf(data, "mbedtls_ctr_drbg_seed returned (-0x%04X) %s",
-          -ret, errorbuf);
-  }
-  else {
-    ret = mbedtls_ctr_drbg_random(&ctr_drbg, entropy, length);
-
-    if(ret) {
-      mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
-      failf(data, "mbedtls_ctr_drbg_random returned (-0x%04X) %s",
-            -ret, errorbuf);
-    }
-  }
-
-  mbedtls_ctr_drbg_free(&ctr_drbg);
-  mbedtls_entropy_free(&ctr_entropy);
-
-  return ret == 0 ? CURLE_OK : CURLE_FAILED_INIT;
-#elif defined(MBEDTLS_HAVEGE_C)
-  mbedtls_havege_state hs;
-  mbedtls_havege_init(&hs);
-  mbedtls_havege_random(&hs, entropy, length);
-  mbedtls_havege_free(&hs);
-  return CURLE_OK;
-#else
-  return CURLE_NOT_BUILT_IN;
-#endif
+  return status == PSA_SUCCESS ? CURLE_OK : CURLE_FAILED_INIT;
 }
 
-static CURLcode
-mbed_connect_common(struct Curl_cfilter *cf, struct Curl_easy *data,
-                    bool nonblocking,
-                    bool *done)
+static CURLcode mbedtls_connect(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                bool *done)
 {
-  CURLcode retcode;
+  CURLcode result;
   struct ssl_connect_data *connssl = cf->ctx;
-  curl_socket_t sockfd = Curl_conn_cf_get_socket(cf, data);
-  timediff_t timeout_ms;
-  int what;
 
   /* check if the connection has already been established */
   if(ssl_connection_complete == connssl->state) {
@@ -1078,117 +1465,40 @@ mbed_connect_common(struct Curl_cfilter *cf, struct Curl_easy *data,
     return CURLE_OK;
   }
 
-  if(ssl_connect_1 == connssl->connecting_state) {
-    /* Find out how much more time we're allowed */
-    timeout_ms = Curl_timeleft(data, NULL, TRUE);
+  *done = FALSE;
+  connssl->io_need = CURL_SSL_IO_NEED_NONE;
 
-    if(timeout_ms < 0) {
-      /* no need to continue if time already is up */
-      failf(data, "SSL connection timeout");
-      return CURLE_OPERATION_TIMEDOUT;
-    }
-    retcode = mbed_connect_step1(cf, data);
-    if(retcode)
-      return retcode;
+  if(ssl_connect_1 == connssl->connecting_state) {
+    result = mbed_connect_step1(cf, data);
+    if(result)
+      return result;
   }
 
-  while(ssl_connect_2 == connssl->connecting_state ||
-        ssl_connect_2_reading == connssl->connecting_state ||
-        ssl_connect_2_writing == connssl->connecting_state) {
-
-    /* check allowed time left */
-    timeout_ms = Curl_timeleft(data, NULL, TRUE);
-
-    if(timeout_ms < 0) {
-      /* no need to continue if time already is up */
-      failf(data, "SSL connection timeout");
-      return CURLE_OPERATION_TIMEDOUT;
-    }
-
-    /* if ssl is expecting something, check if it's available. */
-    if(connssl->connecting_state == ssl_connect_2_reading
-       || connssl->connecting_state == ssl_connect_2_writing) {
-
-      curl_socket_t writefd = ssl_connect_2_writing ==
-        connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
-      curl_socket_t readfd = ssl_connect_2_reading ==
-        connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
-
-      what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd,
-                               nonblocking ? 0 : timeout_ms);
-      if(what < 0) {
-        /* fatal error */
-        failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
-        return CURLE_SSL_CONNECT_ERROR;
-      }
-      else if(0 == what) {
-        if(nonblocking) {
-          *done = FALSE;
-          return CURLE_OK;
-        }
-        else {
-          /* timeout */
-          failf(data, "SSL connection timeout");
-          return CURLE_OPERATION_TIMEDOUT;
-        }
-      }
-      /* socket is readable or writable */
-    }
-
-    /* Run transaction, and return to the caller if it failed or if
-     * this connection is part of a multi handle and this loop would
-     * execute again. This permits the owner of a multi handle to
-     * abort a connection attempt before step2 has completed while
-     * ensuring that a client using select() or epoll() will always
-     * have a valid fdset to wait on.
-     */
-    retcode = mbed_connect_step2(cf, data);
-    if(retcode || (nonblocking &&
-                   (ssl_connect_2 == connssl->connecting_state ||
-                    ssl_connect_2_reading == connssl->connecting_state ||
-                    ssl_connect_2_writing == connssl->connecting_state)))
-      return retcode;
-
-  } /* repeat step2 until all transactions are done. */
+  if(ssl_connect_2 == connssl->connecting_state) {
+    result = mbed_connect_step2(cf, data);
+    if(result)
+      return result;
+  }
 
   if(ssl_connect_3 == connssl->connecting_state) {
-    retcode = mbed_connect_step3(cf, data);
-    if(retcode)
-      return retcode;
+    /* For tls1.3 we get notified about new sessions */
+    struct ssl_connect_data *ctx = cf->ctx;
+    struct mbed_ssl_backend_data *backend =
+      (struct mbed_ssl_backend_data *)ctx->backend;
+
+    if(mbedtls_ssl_get_version_number(&backend->ssl) <=
+       MBEDTLS_SSL_VERSION_TLS1_2) {
+      result = mbed_new_session(cf, data);
+      if(result)
+        return result;
+    }
+    connssl->connecting_state = ssl_connect_done;
   }
 
   if(ssl_connect_done == connssl->connecting_state) {
     connssl->state = ssl_connection_complete;
     *done = TRUE;
   }
-  else
-    *done = FALSE;
-
-  /* Reset our connect state machine */
-  connssl->connecting_state = ssl_connect_1;
-
-  return CURLE_OK;
-}
-
-static CURLcode mbedtls_connect_nonblocking(struct Curl_cfilter *cf,
-                                            struct Curl_easy *data,
-                                            bool *done)
-{
-  return mbed_connect_common(cf, data, TRUE, done);
-}
-
-
-static CURLcode mbedtls_connect(struct Curl_cfilter *cf,
-                                struct Curl_easy *data)
-{
-  CURLcode retcode;
-  bool done = FALSE;
-
-  retcode = mbed_connect_common(cf, data, FALSE, &done);
-  if(retcode)
-    return retcode;
-
-  DEBUGASSERT(done);
 
   return CURLE_OK;
 }
@@ -1199,12 +1509,45 @@ static CURLcode mbedtls_connect(struct Curl_cfilter *cf,
  */
 static int mbedtls_init(void)
 {
-  return Curl_mbedtlsthreadlock_thread_setup();
+#if MBEDTLS_VERSION_NUMBER < 0x04000000
+  int ret = 0;
+#endif
+  psa_status_t status;
+  status = psa_crypto_init();
+
+  if(status != PSA_SUCCESS)
+    return 0;
+
+#if MBEDTLS_VERSION_NUMBER < 0x04000000
+  mbedtls_ctr_drbg_init(&rng.drbg);
+  mbedtls_entropy_init(&rng.entropy);
+
+  ret = mbedtls_ctr_drbg_seed(&rng.drbg, mbedtls_entropy_func, &rng.entropy,
+                              NULL, 0);
+
+  if(ret)
+    /* mbedtls_ctr_drbg_seed returned error */
+    return 0;
+
+  /* To prevent an adversary from reading your random data,
+     you can enable prediction resistance.
+
+     Entropy is gathered before each mbedtls_ctr_drbg_random() call.
+     Only use this if you have ample supply of good entropy.*/
+  mbedtls_ctr_drbg_set_prediction_resistance(&rng.drbg,
+                                             MBEDTLS_CTR_DRBG_PR_ON);
+#endif
+  return 1;
 }
 
 static void mbedtls_cleanup(void)
 {
-  (void)Curl_mbedtlsthreadlock_thread_cleanup();
+  mbedtls_psa_crypto_free();
+
+#if MBEDTLS_VERSION_NUMBER < 0x04000000
+  mbedtls_ctr_drbg_free(&rng.drbg);
+  mbedtls_entropy_free(&rng.entropy);
+#endif
 }
 
 static bool mbedtls_data_pending(struct Curl_cfilter *cf,
@@ -1222,26 +1565,25 @@ static bool mbedtls_data_pending(struct Curl_cfilter *cf,
 static CURLcode mbedtls_sha256sum(const unsigned char *input,
                                   size_t inputlen,
                                   unsigned char *sha256sum,
-                                  size_t sha256len UNUSED_PARAM)
+                                  size_t sha256len)
 {
-  /* TODO: explain this for different mbedtls 2.x vs 3 version */
-  (void)sha256len;
-#if MBEDTLS_VERSION_NUMBER < 0x02070000
-  mbedtls_sha256(input, inputlen, sha256sum, 0);
-#else
-  /* returns 0 on success, otherwise failure */
-#if MBEDTLS_VERSION_NUMBER >= 0x03000000
-  if(mbedtls_sha256(input, inputlen, sha256sum, 0) != 0)
-#else
-  if(mbedtls_sha256_ret(input, inputlen, sha256sum, 0) != 0)
-#endif
+#if defined(PSA_WANT_ALG_SHA_256) && PSA_WANT_ALG_SHA_256
+  psa_status_t status;
+  size_t sha256len_actual;
+  status = psa_hash_compute(PSA_ALG_SHA_256, input, inputlen,
+                            sha256sum, sha256len,
+                            &sha256len_actual);
+  if(status != PSA_SUCCESS)
     return CURLE_BAD_FUNCTION_ARGUMENT;
-#endif
   return CURLE_OK;
+#else
+  (void)sha256len;
+  return Curl_sha256it(sha256sum, input, inputlen);
+#endif
 }
 
 static void *mbedtls_get_internals(struct ssl_connect_data *connssl,
-                                   CURLINFO info UNUSED_PARAM)
+                                   CURLINFO info)
 {
   struct mbed_ssl_backend_data *backend =
     (struct mbed_ssl_backend_data *)connssl->backend;
@@ -1255,37 +1597,42 @@ const struct Curl_ssl Curl_ssl_mbedtls = {
 
   SSLSUPP_CA_PATH |
   SSLSUPP_CAINFO_BLOB |
+  SSLSUPP_CERTINFO |
+#ifdef HAVE_PINNED_PUBKEY
   SSLSUPP_PINNEDPUBKEY |
+#endif
   SSLSUPP_SSL_CTX |
-  SSLSUPP_HTTPS_PROXY,
+#ifdef MBEDTLS_SSL_PROTO_TLS1_3  /* requires mbedTLS 3.6.0+ */
+  SSLSUPP_TLS13_CIPHERSUITES |
+#endif
+  SSLSUPP_HTTPS_PROXY |
+  SSLSUPP_CIPHER_LIST |
+#ifdef MBEDTLS_X509_CRL_PARSE_C
+  SSLSUPP_CRLFILE |
+#endif
+  0,
 
   sizeof(struct mbed_ssl_backend_data),
 
   mbedtls_init,                     /* init */
   mbedtls_cleanup,                  /* cleanup */
   mbedtls_version,                  /* version */
-  Curl_none_check_cxn,              /* check_cxn */
-  Curl_none_shutdown,               /* shutdown */
+  mbedtls_shutdown,                 /* shutdown */
   mbedtls_data_pending,             /* data_pending */
   mbedtls_random,                   /* random */
-  Curl_none_cert_status_request,    /* cert_status_request */
+  NULL,                             /* cert_status_request */
   mbedtls_connect,                  /* connect */
-  mbedtls_connect_nonblocking,      /* connect_nonblocking */
-  Curl_ssl_get_select_socks,                 /* getsock */
+  Curl_ssl_adjust_pollset,          /* adjust_pollset */
   mbedtls_get_internals,            /* get_internals */
   mbedtls_close,                    /* close_one */
-  mbedtls_close_all,                /* close_all */
-  mbedtls_session_free,             /* session_free */
-  Curl_none_set_engine,             /* set_engine */
-  Curl_none_set_engine_default,     /* set_engine_default */
-  Curl_none_engines_list,           /* engines_list */
-  Curl_none_false_start,            /* false_start */
+  NULL,                             /* close_all */
+  NULL,                             /* set_engine */
+  NULL,                             /* set_engine_default */
+  NULL,                             /* engines_list */
   mbedtls_sha256sum,                /* sha256sum */
-  NULL,                             /* associate_connection */
-  NULL,                             /* disassociate_connection */
-  NULL,                             /* free_multi_ssl_backend_data */
   mbed_recv,                        /* recv decrypted data */
   mbed_send,                        /* send data to encrypt */
+  NULL,                             /* get_channel_binding */
 };
 
 #endif /* USE_MBEDTLS */
diff --git a/third-party/curl/lib/vtls/mbedtls_threadlock.c b/third-party/curl/lib/vtls/mbedtls_threadlock.c
deleted file mode 100644
index bcb7106a63..0000000000
--- a/third-party/curl/lib/vtls/mbedtls_threadlock.c
+++ /dev/null
@@ -1,134 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- * Copyright (C) Hoi-Ho Chan, <hoiho.chan@gmail.com>
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "curl_setup.h"
-
-#if defined(USE_MBEDTLS) &&                                     \
-  ((defined(USE_THREADS_POSIX) && defined(HAVE_PTHREAD_H)) ||   \
-    defined(USE_THREADS_WIN32))
-
-#if defined(USE_THREADS_POSIX) && defined(HAVE_PTHREAD_H)
-#  include <pthread.h>
-#  define MBEDTLS_MUTEX_T pthread_mutex_t
-#elif defined(USE_THREADS_WIN32)
-#  define MBEDTLS_MUTEX_T HANDLE
-#endif
-
-#include "mbedtls_threadlock.h"
-#include "curl_printf.h"
-#include "curl_memory.h"
-/* The last #include file should be: */
-#include "memdebug.h"
-
-/* number of thread locks */
-#define NUMT                    2
-
-/* This array will store all of the mutexes available to Mbedtls. */
-static MBEDTLS_MUTEX_T *mutex_buf = NULL;
-
-int Curl_mbedtlsthreadlock_thread_setup(void)
-{
-  int i;
-
-  mutex_buf = calloc(NUMT * sizeof(MBEDTLS_MUTEX_T), 1);
-  if(!mutex_buf)
-    return 0;     /* error, no number of threads defined */
-
-  for(i = 0;  i < NUMT;  i++) {
-#if defined(USE_THREADS_POSIX) && defined(HAVE_PTHREAD_H)
-    if(pthread_mutex_init(&mutex_buf[i], NULL))
-      return 0; /* pthread_mutex_init failed */
-#elif defined(USE_THREADS_WIN32)
-    mutex_buf[i] = CreateMutex(0, FALSE, 0);
-    if(mutex_buf[i] == 0)
-      return 0;  /* CreateMutex failed */
-#endif /* USE_THREADS_POSIX && HAVE_PTHREAD_H */
-  }
-
-  return 1; /* OK */
-}
-
-int Curl_mbedtlsthreadlock_thread_cleanup(void)
-{
-  int i;
-
-  if(!mutex_buf)
-    return 0; /* error, no threads locks defined */
-
-  for(i = 0; i < NUMT; i++) {
-#if defined(USE_THREADS_POSIX) && defined(HAVE_PTHREAD_H)
-    if(pthread_mutex_destroy(&mutex_buf[i]))
-      return 0; /* pthread_mutex_destroy failed */
-#elif defined(USE_THREADS_WIN32)
-    if(!CloseHandle(mutex_buf[i]))
-      return 0; /* CloseHandle failed */
-#endif /* USE_THREADS_POSIX && HAVE_PTHREAD_H */
-  }
-  free(mutex_buf);
-  mutex_buf = NULL;
-
-  return 1; /* OK */
-}
-
-int Curl_mbedtlsthreadlock_lock_function(int n)
-{
-  if(n < NUMT) {
-#if defined(USE_THREADS_POSIX) && defined(HAVE_PTHREAD_H)
-    if(pthread_mutex_lock(&mutex_buf[n])) {
-      DEBUGF(fprintf(stderr,
-                     "Error: mbedtlsthreadlock_lock_function failed\n"));
-      return 0; /* pthread_mutex_lock failed */
-    }
-#elif defined(USE_THREADS_WIN32)
-    if(WaitForSingleObject(mutex_buf[n], INFINITE) == WAIT_FAILED) {
-      DEBUGF(fprintf(stderr,
-                     "Error: mbedtlsthreadlock_lock_function failed\n"));
-      return 0; /* pthread_mutex_lock failed */
-    }
-#endif /* USE_THREADS_POSIX && HAVE_PTHREAD_H */
-  }
-  return 1; /* OK */
-}
-
-int Curl_mbedtlsthreadlock_unlock_function(int n)
-{
-  if(n < NUMT) {
-#if defined(USE_THREADS_POSIX) && defined(HAVE_PTHREAD_H)
-    if(pthread_mutex_unlock(&mutex_buf[n])) {
-      DEBUGF(fprintf(stderr,
-                     "Error: mbedtlsthreadlock_unlock_function failed\n"));
-      return 0; /* pthread_mutex_unlock failed */
-    }
-#elif defined(USE_THREADS_WIN32)
-    if(!ReleaseMutex(mutex_buf[n])) {
-      DEBUGF(fprintf(stderr,
-                     "Error: mbedtlsthreadlock_unlock_function failed\n"));
-      return 0; /* pthread_mutex_lock failed */
-    }
-#endif /* USE_THREADS_POSIX && HAVE_PTHREAD_H */
-  }
-  return 1; /* OK */
-}
-
-#endif /* USE_MBEDTLS */
diff --git a/third-party/curl/lib/vtls/mbedtls_threadlock.h b/third-party/curl/lib/vtls/mbedtls_threadlock.h
deleted file mode 100644
index 2b0bd41c8b..0000000000
--- a/third-party/curl/lib/vtls/mbedtls_threadlock.h
+++ /dev/null
@@ -1,50 +0,0 @@
-#ifndef HEADER_CURL_MBEDTLS_THREADLOCK_H
-#define HEADER_CURL_MBEDTLS_THREADLOCK_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- * Copyright (C) Hoi-Ho Chan, <hoiho.chan@gmail.com>
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "curl_setup.h"
-
-#ifdef USE_MBEDTLS
-
-#if (defined(USE_THREADS_POSIX) && defined(HAVE_PTHREAD_H)) || \
-     defined(USE_THREADS_WIN32)
-
-int Curl_mbedtlsthreadlock_thread_setup(void);
-int Curl_mbedtlsthreadlock_thread_cleanup(void);
-int Curl_mbedtlsthreadlock_lock_function(int n);
-int Curl_mbedtlsthreadlock_unlock_function(int n);
-
-#else
-
-#define Curl_mbedtlsthreadlock_thread_setup() 1
-#define Curl_mbedtlsthreadlock_thread_cleanup() 1
-#define Curl_mbedtlsthreadlock_lock_function(x) 1
-#define Curl_mbedtlsthreadlock_unlock_function(x) 1
-
-#endif /* USE_THREADS_POSIX || USE_THREADS_WIN32 */
-
-#endif /* USE_MBEDTLS */
-
-#endif /* HEADER_CURL_MBEDTLS_THREADLOCK_H */
diff --git a/third-party/curl/lib/vtls/openssl.c b/third-party/curl/lib/vtls/openssl.c
index a12e712b16..010bbb9825 100644
--- a/third-party/curl/lib/vtls/openssl.c
+++ b/third-party/curl/lib/vtls/openssl.c
@@ -21,50 +21,41 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /*
  * Source file for all OpenSSL-specific code for the TLS/SSL layer. No code
  * but vtls.c should ever call or use these functions.
  */
-
 #include "curl_setup.h"
 
-#if defined(USE_QUICHE) || defined(USE_OPENSSL)
-
-#include <limits.h>
-
-/* Wincrypt must be included before anything that could include OpenSSL. */
-#if defined(USE_WIN32_CRYPTO)
-#include <wincrypt.h>
-/* Undefine wincrypt conflicting symbols for BoringSSL. */
-#undef X509_NAME
-#undef X509_EXTENSIONS
-#undef PKCS7_ISSUER_AND_SERIAL
-#undef PKCS7_SIGNER_INFO
-#undef OCSP_REQUEST
-#undef OCSP_RESPONSE
-#endif
+#ifdef USE_OPENSSL
 
 #include "urldata.h"
-#include "sendf.h"
+#include "curl_trc.h"
+#include "httpsrr.h"
 #include "formdata.h" /* for the boundary function */
-#include "url.h" /* for the ssl config check function */
-#include "inet_pton.h"
-#include "openssl.h"
+#include "url.h" /* for the SSL config check function */
+#include "curlx/inet_pton.h"
+#include "vtls/openssl.h"
 #include "connect.h"
-#include "slist.h"
-#include "select.h"
-#include "vtls.h"
-#include "vtls_int.h"
+#include "cf-dns.h"
+#include "progress.h"
+#include "vtls/vtls.h"
+#include "vtls/vtls_int.h"
+#include "vtls/vtls_scache.h"
 #include "vauth/vauth.h"
-#include "keylog.h"
-#include "strcase.h"
-#include "hostcheck.h"
+#include "vtls/keylog.h"
+#include "vtls/hostcheck.h"
+#include "transfer.h"
 #include "multiif.h"
-#include "strerror.h"
-#include "curl_printf.h"
+#include "curlx/strerr.h"
+#include "curlx/strparse.h"
+#include "curlx/strcopy.h"
+#include "curlx/strdup.h"
+#include "vtls/apple.h"
+#ifdef USE_ECH
+#include "curlx/base64.h"
+#endif
 
-#include <openssl/ssl.h>
 #include <openssl/rand.h>
 #include <openssl/x509v3.h>
 #ifndef OPENSSL_NO_DSA
@@ -72,109 +63,58 @@
 #endif
 #include <openssl/dh.h>
 #include <openssl/err.h>
-#include <openssl/md5.h>
 #include <openssl/conf.h>
 #include <openssl/bn.h>
 #include <openssl/rsa.h>
 #include <openssl/bio.h>
-#include <openssl/buffer.h>
 #include <openssl/pkcs12.h>
+#include <openssl/tls1.h>
+#include <openssl/evp.h>
 
-#if (OPENSSL_VERSION_NUMBER >= 0x0090808fL) && !defined(OPENSSL_NO_OCSP)
+#if defined(HAVE_SSL_SET1_ECH_CONFIG_LIST) && !defined(HAVE_BORINGSSL_LIKE)
+#include <openssl/ech.h>
+#endif
+
+#ifndef OPENSSL_NO_OCSP
 #include <openssl/ocsp.h>
 #endif
 
-#if (OPENSSL_VERSION_NUMBER >= 0x0090700fL) && /* 0.9.7 or later */     \
-  !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_UI_CONSOLE)
+#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_UI_CONSOLE)
 #define USE_OPENSSL_ENGINE
 #include <openssl/engine.h>
 #endif
 
-#include "warnless.h"
-
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
-
-
-/* Uncomment the ALLOW_RENEG line to a real #define if you want to allow TLS
-   renegotiations when built with BoringSSL. Renegotiating is non-compliant
-   with HTTP/2 and "an extremely dangerous protocol feature". Beware.
-
-#define ALLOW_RENEG 1
- */
-
-#ifndef OPENSSL_VERSION_NUMBER
-#error "OPENSSL_VERSION_NUMBER not defined"
+#ifdef LIBRESSL_VERSION_NUMBER
+/* As of LibreSSL 2.0.0-4.0.0: OPENSSL_VERSION_NUMBER == 0x20000000L */
+#  if LIBRESSL_VERSION_NUMBER < 0x2090100fL /* 2019-04-13 */
+#    error "LibreSSL 2.9.1 or later required"
+#  endif
+#elif !defined(HAVE_BORINGSSL_LIKE)
+#  ifndef HAVE_OPENSSL3 /* 2021-09-07 */
+#    error "OpenSSL 3.0.0 or later required"
+#  endif
 #endif
 
-#ifdef USE_OPENSSL_ENGINE
+#if defined(HAVE_OPENSSL3) && !defined(OPENSSL_NO_UI_CONSOLE)
+#include <openssl/provider.h>
+#include <openssl/store.h>
+/* this is used in the following conditions to make them easier to read */
+#define OPENSSL_HAS_PROVIDERS
+#endif
+
+/* AWS-LC fixed a bug with large buffers in v1.61.0 which also introduced
+ * X509_V_ERR_EC_KEY_EXPLICIT_PARAMS. */
+#if !defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_IS_BORINGSSL) && \
+  (!defined(OPENSSL_IS_AWSLC) || defined(X509_V_ERR_EC_KEY_EXPLICIT_PARAMS))
+#define HAVE_SSL_CTX_SET_DEFAULT_READ_BUFFER_LEN 1
+#endif
+
+#if defined(USE_OPENSSL_ENGINE) || defined(OPENSSL_HAS_PROVIDERS)
 #include <openssl/ui.h>
 #endif
 
-#if OPENSSL_VERSION_NUMBER >= 0x00909000L
-#define SSL_METHOD_QUAL const
-#else
-#define SSL_METHOD_QUAL
-#endif
-
-#if (OPENSSL_VERSION_NUMBER >= 0x10000000L)
-#define HAVE_ERR_REMOVE_THREAD_STATE 1
-#endif
-
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && /* OpenSSL 1.1.0+ */ \
-    !(defined(LIBRESSL_VERSION_NUMBER) && \
-      LIBRESSL_VERSION_NUMBER < 0x20700000L)
-#define SSLEAY_VERSION_NUMBER OPENSSL_VERSION_NUMBER
-#define HAVE_X509_GET0_EXTENSIONS 1 /* added in 1.1.0 -pre1 */
-#define HAVE_OPAQUE_EVP_PKEY 1 /* since 1.1.0 -pre3 */
-#define HAVE_OPAQUE_RSA_DSA_DH 1 /* since 1.1.0 -pre5 */
-#define CONST_EXTS const
-#define HAVE_ERR_REMOVE_THREAD_STATE_DEPRECATED 1
-
-/* funny typecast define due to difference in API */
-#ifdef LIBRESSL_VERSION_NUMBER
-#define ARG2_X509_signature_print (X509_ALGOR *)
-#else
-#define ARG2_X509_signature_print
-#endif
-
-#else
-/* For OpenSSL before 1.1.0 */
-#define ASN1_STRING_get0_data(x) ASN1_STRING_data(x)
-#define X509_get0_notBefore(x) X509_get_notBefore(x)
-#define X509_get0_notAfter(x) X509_get_notAfter(x)
-#define CONST_EXTS /* nope */
-#ifndef LIBRESSL_VERSION_NUMBER
-#define OpenSSL_version_num() SSLeay()
-#endif
-#endif
-
-#if (OPENSSL_VERSION_NUMBER >= 0x1000200fL) && /* 1.0.2 or later */ \
-    !(defined(LIBRESSL_VERSION_NUMBER) && \
-      LIBRESSL_VERSION_NUMBER < 0x20700000L)
-#define HAVE_X509_GET0_SIGNATURE 1
-#endif
-
-#if (OPENSSL_VERSION_NUMBER >= 0x1000200fL) /* 1.0.2 or later */
-#define HAVE_SSL_GET_SHUTDOWN 1
-#endif
-
-#if OPENSSL_VERSION_NUMBER >= 0x10002003L && \
-  OPENSSL_VERSION_NUMBER <= 0x10002FFFL && \
-  !defined(OPENSSL_NO_COMP)
-#define HAVE_SSL_COMP_FREE_COMPRESSION_METHODS 1
-#endif
-
-#if (OPENSSL_VERSION_NUMBER < 0x0090808fL)
-/* not present in older OpenSSL */
-#define OPENSSL_load_builtin_modules(x)
-#endif
-
-#if (OPENSSL_VERSION_NUMBER >= 0x30000000L)
+#ifdef HAVE_OPENSSL3
 #define HAVE_EVP_PKEY_GET_PARAMS 1
-#else
-#define SSL_get1_peer_certificate SSL_get_peer_certificate
 #endif
 
 #ifdef HAVE_EVP_PKEY_GET_PARAMS
@@ -186,228 +126,249 @@
 #define FREE_PKEY_PARAM_BIGNUM(name)
 #endif
 
-/*
- * Whether SSL_CTX_set_keylog_callback is available.
- * OpenSSL: supported since 1.1.1 https://github.com/openssl/openssl/pull/2287
- * BoringSSL: supported since d28f59c27bac (committed 2015-11-19)
- * LibreSSL: supported since 3.5.0 (released 2022-02-24)
- */
-#if (OPENSSL_VERSION_NUMBER >= 0x10101000L && \
-     !defined(LIBRESSL_VERSION_NUMBER)) || \
-    (defined(LIBRESSL_VERSION_NUMBER) && \
-     LIBRESSL_VERSION_NUMBER >= 0x3050000fL) || \
-    defined(OPENSSL_IS_BORINGSSL)
-#define HAVE_KEYLOG_CALLBACK
-#endif
-
 /* Whether SSL_CTX_set_ciphersuites is available.
- * OpenSSL: supported since 1.1.1 (commit a53b5be6a05)
  * BoringSSL: no
  * LibreSSL: supported since 3.4.1 (released 2021-10-14)
+ * OpenSSL: supported since 1.1.1 (commit a53b5be6a05)
  */
-#if ((OPENSSL_VERSION_NUMBER >= 0x10101000L && \
-      !defined(LIBRESSL_VERSION_NUMBER)) || \
+#if (!defined(LIBRESSL_VERSION_NUMBER) || \
      (defined(LIBRESSL_VERSION_NUMBER) && \
       LIBRESSL_VERSION_NUMBER >= 0x3040100fL)) && \
     !defined(OPENSSL_IS_BORINGSSL)
-  #define HAVE_SSL_CTX_SET_CIPHERSUITES
-  #if !defined(OPENSSL_IS_AWSLC)
-    #define HAVE_SSL_CTX_SET_POST_HANDSHAKE_AUTH
-  #endif
+#  define HAVE_SSL_CTX_SET_CIPHERSUITES
+#  ifndef OPENSSL_IS_AWSLC
+#    define HAVE_SSL_CTX_SET_POST_HANDSHAKE_AUTH
+#  endif
 #endif
 
-/*
- * Whether SSL_CTX_set1_curves_list is available.
- * OpenSSL: supported since 1.0.2, see
- *   https://www.openssl.org/docs/manmaster/man3/SSL_CTX_set1_groups.html
- * BoringSSL: supported since 5fd1807d95f7 (committed 2016-09-30)
- * LibreSSL: since 2.5.3 (April 12, 2017)
+/* Whether SSL_CTX_set1_sigalgs_list is available
+ * BoringSSL: supported since 0.20240913.0 (commit 826ce15)
+ * LibreSSL: no
+ * OpenSSL: supported since 1.0.2 (commit 0b362de5f575)
  */
-#if (OPENSSL_VERSION_NUMBER >= 0x10002000L) ||  \
-  defined(OPENSSL_IS_BORINGSSL)
-#define HAVE_SSL_CTX_SET_EC_CURVES
+#ifndef LIBRESSL_VERSION_NUMBER
+#define HAVE_SSL_CTX_SET1_SIGALGS
 #endif
 
-#if defined(LIBRESSL_VERSION_NUMBER)
+#ifdef LIBRESSL_VERSION_NUMBER
 #define OSSL_PACKAGE "LibreSSL"
-#elif defined(OPENSSL_IS_BORINGSSL)
-#define OSSL_PACKAGE "BoringSSL"
 #elif defined(OPENSSL_IS_AWSLC)
 #define OSSL_PACKAGE "AWS-LC"
+#elif defined(OPENSSL_IS_BORINGSSL)
+#define OSSL_PACKAGE "BoringSSL"
+#elif defined(USE_NGTCP2) && defined(USE_NGHTTP3) && \
+  !defined(OPENSSL_QUIC_API2)
+#define OSSL_PACKAGE "quictls"
 #else
 #define OSSL_PACKAGE "OpenSSL"
 #endif
 
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
-/* up2date versions of OpenSSL maintain reasonably secure defaults without
- * breaking compatibility, so it is better not to override the defaults in curl
- */
-#define DEFAULT_CIPHER_SELECTION NULL
-#else
-/* ... but it is not the case with old versions of OpenSSL */
-#define DEFAULT_CIPHER_SELECTION \
-  "ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH"
-#endif
-
-#ifdef HAVE_OPENSSL_SRP
-/* the function exists */
-#ifdef USE_TLS_SRP
-/* the functionality is not disabled */
-#define USE_OPENSSL_SRP
-#endif
-#endif
-
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
-#define HAVE_RANDOM_INIT_BY_DEFAULT 1
-#endif
-
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && \
-    !(defined(LIBRESSL_VERSION_NUMBER) && \
-      LIBRESSL_VERSION_NUMBER < 0x2070100fL) && \
-    !defined(OPENSSL_IS_BORINGSSL) && \
-    !defined(OPENSSL_IS_AWSLC)
-#define HAVE_OPENSSL_VERSION
-#endif
-
-#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
+#ifdef HAVE_BORINGSSL_LIKE
+typedef size_t numcert_t;
 typedef uint32_t sslerr_t;
 #else
+typedef int numcert_t;
 typedef unsigned long sslerr_t;
 #endif
+#define ossl_valsize_t numcert_t
 
-/*
- * Whether the OpenSSL version has the API needed to support sharing an
- * X509_STORE between connections. The API is:
- * * `X509_STORE_up_ref`       -- Introduced: OpenSSL 1.1.0.
- */
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) /* OpenSSL >= 1.1.0 */
-#define HAVE_SSL_X509_STORE_SHARE
-#endif
+static CURLcode push_certinfo(struct Curl_easy *data,
+                              BIO *mem, const char *label, int num)
+  WARN_UNUSED_RESULT;
 
-/* What API version do we use? */
-#if defined(LIBRESSL_VERSION_NUMBER)
-#define USE_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f)
-#else /* !LIBRESSL_VERSION_NUMBER */
-#define USE_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L)
-#endif /* !LIBRESSL_VERSION_NUMBER */
-
-struct ossl_ssl_backend_data {
-  /* these ones requires specific SSL-types */
-  SSL_CTX* ctx;
-  SSL*     handle;
-  X509*    server_cert;
-  BIO_METHOD *bio_method;
-  CURLcode io_result;       /* result of last BIO cfilter operation */
-#ifndef HAVE_KEYLOG_CALLBACK
-  /* Set to true once a valid keylog entry has been created to avoid dupes. */
-  bool     keylog_done;
-#endif
-  bool x509_store_setup;            /* x509 store has been set up */
-};
-
-#if defined(HAVE_SSL_X509_STORE_SHARE)
-struct multi_ssl_backend_data {
-  char *CAfile;         /* CAfile path used to generate X509 store */
-  X509_STORE *store;    /* cached X509 store or NULL if none */
-  struct curltime time; /* when the cached store was created */
-};
-#endif /* HAVE_SSL_X509_STORE_SHARE */
-
-#define push_certinfo(_label, _num)             \
-do {                              \
-  long info_len = BIO_get_mem_data(mem, &ptr); \
-  Curl_ssl_push_certinfo_len(data, _num, _label, ptr, info_len); \
-  if(1 != BIO_reset(mem))                                        \
-    break;                                                       \
-} while(0)
-
-static void pubkey_show(struct Curl_easy *data,
-                        BIO *mem,
-                        int num,
-                        const char *type,
-                        const char *name,
-                        const BIGNUM *bn)
+static CURLcode push_certinfo(struct Curl_easy *data,
+                              BIO *mem, const char *label, int num)
 {
   char *ptr;
+  long len = BIO_get_mem_data(mem, &ptr);
+  CURLcode result = Curl_ssl_push_certinfo_len(data, num, label, ptr, len);
+  (void)BIO_reset(mem);
+  return result;
+}
+
+static CURLcode pubkey_show(struct Curl_easy *data,
+                            BIO *mem,
+                            int num,
+                            const char *type,
+                            const char *name,
+                            const BIGNUM *bn) WARN_UNUSED_RESULT;
+
+static CURLcode pubkey_show(struct Curl_easy *data,
+                            BIO *mem,
+                            int num,
+                            const char *type,
+                            const char *name,
+                            const BIGNUM *bn)
+{
   char namebuf[32];
 
-  msnprintf(namebuf, sizeof(namebuf), "%s(%s)", type, name);
+  curl_msnprintf(namebuf, sizeof(namebuf), "%s(%s)", type, name);
 
   if(bn)
     BN_print(mem, bn);
-  push_certinfo(namebuf, num);
+  return push_certinfo(data, mem, namebuf, num);
 }
 
-#ifdef HAVE_OPAQUE_RSA_DSA_DH
-#define print_pubkey_BN(_type, _name, _num)              \
+#define print_pubkey_BN(_type, _name, _num)           \
   pubkey_show(data, mem, _num, #_type, #_name, _name)
 
-#else
-#define print_pubkey_BN(_type, _name, _num)    \
-do {                              \
-  if(_type->_name) { \
-    pubkey_show(data, mem, _num, #_type, #_name, _type->_name); \
-  } \
-} while(0)
-#endif
-
-static int asn1_object_dump(ASN1_OBJECT *a, char *buf, size_t len)
+static int asn1_object_dump(const ASN1_OBJECT *a, char *buf, size_t len)
 {
-  int i, ilen;
-
-  ilen = (int)len;
-  if(ilen < 0)
-    return 1; /* buffer too big */
-
-  i = i2t_ASN1_OBJECT(buf, ilen, a);
-
-  if(i >= ilen)
-    return 1; /* buffer too small */
-
-  return 0;
+  int i = i2t_ASN1_OBJECT(buf, (int)len, a);
+  return (i >= (int)len);  /* buffer too small */
 }
 
-static void X509V3_ext(struct Curl_easy *data,
-                       int certnum,
-                       CONST_EXTS STACK_OF(X509_EXTENSION) *exts)
+static CURLcode X509V3_ext(struct Curl_easy *data,
+                           int certnum,
+                           const STACK_OF(X509_EXTENSION) *extsarg)
 {
   int i;
+  CURLcode result = CURLE_OK;
+#ifdef LIBRESSL_VERSION_NUMBER
+  STACK_OF(X509_EXTENSION) *exts = CURL_UNCONST(extsarg);
+#else
+  const STACK_OF(X509_EXTENSION) *exts = extsarg;
+#endif
 
   if((int)sk_X509_EXTENSION_num(exts) <= 0)
     /* no extensions, bail out */
-    return;
+    return result;
 
   for(i = 0; i < (int)sk_X509_EXTENSION_num(exts); i++) {
-    ASN1_OBJECT *obj;
-    X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i);
+    const ASN1_OBJECT *obj;
+    X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, (ossl_valsize_t)i);
     BUF_MEM *biomem;
     char namebuf[128];
     BIO *bio_out = BIO_new(BIO_s_mem());
 
     if(!bio_out)
-      return;
+      return result;
 
     obj = X509_EXTENSION_get_object(ext);
 
-    asn1_object_dump(obj, namebuf, sizeof(namebuf));
+    if(asn1_object_dump(obj, namebuf, sizeof(namebuf)))
+      /* make sure the name is null-terminated */
+      namebuf[sizeof(namebuf) - 1] = 0;
 
     if(!X509V3_EXT_print(bio_out, ext, 0, 0))
-      ASN1_STRING_print(bio_out, (ASN1_STRING *)X509_EXTENSION_get_data(ext));
+      ASN1_STRING_print(bio_out,
+                        (const ASN1_STRING *)X509_EXTENSION_get_data(ext));
 
     BIO_get_mem_ptr(bio_out, &biomem);
-    Curl_ssl_push_certinfo_len(data, certnum, namebuf, biomem->data,
-                               biomem->length);
+    result = Curl_ssl_push_certinfo_len(data, certnum, namebuf, biomem->data,
+                                        biomem->length);
     BIO_free(bio_out);
+    if(result)
+      break;
   }
+  return result;
 }
 
-#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
-typedef size_t numcert_t;
+static CURLcode get_pkey_rsa(struct Curl_easy *data,
+                             EVP_PKEY *pubkey, BIO *mem, int i)
+{
+  CURLcode result = CURLE_OK;
+#ifndef HAVE_EVP_PKEY_GET_PARAMS
+  RSA *rsa = EVP_PKEY_get0_RSA(pubkey);
+#endif /* !HAVE_EVP_PKEY_GET_PARAMS */
+  DECLARE_PKEY_PARAM_BIGNUM(n);
+  DECLARE_PKEY_PARAM_BIGNUM(e);
+#ifdef HAVE_EVP_PKEY_GET_PARAMS
+  EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_RSA_N, &n);
+  EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_RSA_E, &e);
 #else
-typedef int numcert_t;
+  RSA_get0_key(rsa, &n, &e, NULL);
+#endif /* HAVE_EVP_PKEY_GET_PARAMS */
+  BIO_printf(mem, "%d", (int)(n ? BN_num_bits(n) : 0));
+  result = push_certinfo(data, mem, "RSA Public Key", i);
+  if(!result) {
+    result = print_pubkey_BN(rsa, n, i);
+    if(!result)
+      result = print_pubkey_BN(rsa, e, i);
+  }
+  FREE_PKEY_PARAM_BIGNUM(n);
+  FREE_PKEY_PARAM_BIGNUM(e);
+  return result;
+}
+
+#ifndef OPENSSL_NO_DSA
+static CURLcode get_pkey_dsa(struct Curl_easy *data,
+                             EVP_PKEY *pubkey, BIO *mem, int i)
+{
+  CURLcode result = CURLE_OK;
+#ifndef HAVE_EVP_PKEY_GET_PARAMS
+  DSA *dsa = EVP_PKEY_get0_DSA(pubkey);
+#endif /* !HAVE_EVP_PKEY_GET_PARAMS */
+  DECLARE_PKEY_PARAM_BIGNUM(p);
+  DECLARE_PKEY_PARAM_BIGNUM(q);
+  DECLARE_PKEY_PARAM_BIGNUM(g);
+  DECLARE_PKEY_PARAM_BIGNUM(pub_key);
+#ifdef HAVE_EVP_PKEY_GET_PARAMS
+  EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_FFC_P, &p);
+  EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_FFC_Q, &q);
+  EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_FFC_G, &g);
+  EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_PUB_KEY, &pub_key);
+#else
+  DSA_get0_pqg(dsa, &p, &q, &g);
+  DSA_get0_key(dsa, &pub_key, NULL);
+#endif /* HAVE_EVP_PKEY_GET_PARAMS */
+  result = print_pubkey_BN(dsa, p, i);
+  if(!result)
+    result = print_pubkey_BN(dsa, q, i);
+  if(!result)
+    result = print_pubkey_BN(dsa, g, i);
+  if(!result)
+    result = print_pubkey_BN(dsa, pub_key, i);
+  FREE_PKEY_PARAM_BIGNUM(p);
+  FREE_PKEY_PARAM_BIGNUM(q);
+  FREE_PKEY_PARAM_BIGNUM(g);
+  FREE_PKEY_PARAM_BIGNUM(pub_key);
+  return result;
+}
+#endif /* !OPENSSL_NO_DSA */
+
+static CURLcode get_pkey_dh(struct Curl_easy *data,
+                            EVP_PKEY *pubkey, BIO *mem, int i)
+{
+  CURLcode result;
+#ifndef HAVE_EVP_PKEY_GET_PARAMS
+  DH *dh = EVP_PKEY_get0_DH(pubkey);
+#endif /* !HAVE_EVP_PKEY_GET_PARAMS */
+  DECLARE_PKEY_PARAM_BIGNUM(p);
+  DECLARE_PKEY_PARAM_BIGNUM(q);
+  DECLARE_PKEY_PARAM_BIGNUM(g);
+  DECLARE_PKEY_PARAM_BIGNUM(pub_key);
+#ifdef HAVE_EVP_PKEY_GET_PARAMS
+  EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_FFC_P, &p);
+  EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_FFC_Q, &q);
+  EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_FFC_G, &g);
+  EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_PUB_KEY, &pub_key);
+#else
+  DH_get0_pqg(dh, &p, &q, &g);
+  DH_get0_key(dh, &pub_key, NULL);
+#endif /* HAVE_EVP_PKEY_GET_PARAMS */
+  result = print_pubkey_BN(dh, p, i);
+  if(!result)
+    result = print_pubkey_BN(dh, q, i);
+  if(!result)
+    result = print_pubkey_BN(dh, g, i);
+  if(!result)
+    result = print_pubkey_BN(dh, pub_key, i);
+  FREE_PKEY_PARAM_BIGNUM(p);
+  FREE_PKEY_PARAM_BIGNUM(q);
+  FREE_PKEY_PARAM_BIGNUM(g);
+  FREE_PKEY_PARAM_BIGNUM(pub_key);
+  return result;
+}
+
+#ifdef HAVE_OPENSSL3
+/* from OpenSSL commit fc756e594ed5a27af378 */
+typedef const X509_PUBKEY pubkeytype_t;
+#else
+typedef X509_PUBKEY pubkeytype_t;
 #endif
 
-CURLcode Curl_ossl_certchain(struct Curl_easy *data, SSL *ssl)
+static CURLcode ossl_certchain(struct Curl_easy *data, SSL *ssl)
 {
   CURLcode result;
   STACK_OF(X509) *sk;
@@ -418,56 +379,70 @@ CURLcode Curl_ossl_certchain(struct Curl_easy *data, SSL *ssl)
   DEBUGASSERT(ssl);
 
   sk = SSL_get_peer_cert_chain(ssl);
-  if(!sk) {
-    return CURLE_OUT_OF_MEMORY;
-  }
+  if(!sk)
+    return CURLE_SSL_CONNECT_ERROR;
 
   numcerts = sk_X509_num(sk);
+  if(numcerts > MAX_ALLOWED_CERT_AMOUNT) {
+    failf(data, "%d certificates is more than allowed (%d)", (int)numcerts,
+          MAX_ALLOWED_CERT_AMOUNT);
+    return CURLE_SSL_CONNECT_ERROR;
+  }
 
   result = Curl_ssl_init_certinfo(data, (int)numcerts);
-  if(result) {
+  if(result)
     return result;
-  }
 
   mem = BIO_new(BIO_s_mem());
-  if(!mem) {
-    return CURLE_OUT_OF_MEMORY;
-  }
+  if(!mem)
+    result = CURLE_OUT_OF_MEMORY;
 
-  for(i = 0; i < (int)numcerts; i++) {
+  for(i = 0; !result && (i < (int)numcerts); i++) {
     ASN1_INTEGER *num;
-    X509 *x = sk_X509_value(sk, i);
+    const unsigned char *numdata;
+    X509 *x = sk_X509_value(sk, (ossl_valsize_t)i);
     EVP_PKEY *pubkey = NULL;
     int j;
-    char *ptr;
     const ASN1_BIT_STRING *psig = NULL;
 
     X509_NAME_print_ex(mem, X509_get_subject_name(x), 0, XN_FLAG_ONELINE);
-    push_certinfo("Subject", i);
+    result = push_certinfo(data, mem, "Subject", i);
+    if(result)
+      break;
 
     X509_NAME_print_ex(mem, X509_get_issuer_name(x), 0, XN_FLAG_ONELINE);
-    push_certinfo("Issuer", i);
+    result = push_certinfo(data, mem, "Issuer", i);
+    if(result)
+      break;
 
-    BIO_printf(mem, "%lx", X509_get_version(x));
-    push_certinfo("Version", i);
+    BIO_printf(mem, "%lx", (unsigned long)X509_get_version(x));
+    result = push_certinfo(data, mem, "Version", i);
+    if(result)
+      break;
 
     num = X509_get_serialNumber(x);
-    if(num->type == V_ASN1_NEG_INTEGER)
+    if(ASN1_STRING_type(num) == V_ASN1_NEG_INTEGER)
       BIO_puts(mem, "-");
-    for(j = 0; j < num->length; j++)
-      BIO_printf(mem, "%02x", num->data[j]);
-    push_certinfo("Serial Number", i);
+    numdata = ASN1_STRING_get0_data(num);
+    for(j = 0; j < ASN1_STRING_length(num); j++)
+      BIO_printf(mem, "%02x", numdata[j]);
+    result = push_certinfo(data, mem, "Serial Number", i);
+    if(result)
+      break;
 
-#if defined(HAVE_X509_GET0_SIGNATURE) && defined(HAVE_X509_GET0_EXTENSIONS)
     {
       const X509_ALGOR *sigalg = NULL;
-      X509_PUBKEY *xpubkey = NULL;
+      pubkeytype_t *xpubkey = NULL;
       ASN1_OBJECT *pubkeyoid = NULL;
 
       X509_get0_signature(&psig, &sigalg, x);
       if(sigalg) {
-        i2a_ASN1_OBJECT(mem, sigalg->algorithm);
-        push_certinfo("Signature Algorithm", i);
+        const ASN1_OBJECT *sigalgoid = NULL;
+        X509_ALGOR_get0(&sigalgoid, NULL, NULL, sigalg);
+        i2a_ASN1_OBJECT(mem, sigalgoid);
+        result = push_certinfo(data, mem, "Signature Algorithm", i);
+        if(result)
+          break;
       }
 
       xpubkey = X509_get_X509_PUBKEY(x);
@@ -475,211 +450,87 @@ CURLcode Curl_ossl_certchain(struct Curl_easy *data, SSL *ssl)
         X509_PUBKEY_get0_param(&pubkeyoid, NULL, NULL, NULL, xpubkey);
         if(pubkeyoid) {
           i2a_ASN1_OBJECT(mem, pubkeyoid);
-          push_certinfo("Public Key Algorithm", i);
+          result = push_certinfo(data, mem, "Public Key Algorithm", i);
+          if(result)
+            break;
         }
       }
 
-      X509V3_ext(data, i, X509_get0_extensions(x));
+      result = X509V3_ext(data, i, X509_get0_extensions(x));
+      if(result)
+        break;
     }
-#else
-    {
-      /* before OpenSSL 1.0.2 */
-      X509_CINF *cinf = x->cert_info;
-
-      i2a_ASN1_OBJECT(mem, cinf->signature->algorithm);
-      push_certinfo("Signature Algorithm", i);
-
-      i2a_ASN1_OBJECT(mem, cinf->key->algor->algorithm);
-      push_certinfo("Public Key Algorithm", i);
-
-      X509V3_ext(data, i, cinf->extensions);
-
-      psig = x->signature;
-    }
-#endif
 
     ASN1_TIME_print(mem, X509_get0_notBefore(x));
-    push_certinfo("Start date", i);
+    result = push_certinfo(data, mem, "Start date", i);
+    if(result)
+      break;
 
     ASN1_TIME_print(mem, X509_get0_notAfter(x));
-    push_certinfo("Expire date", i);
+    result = push_certinfo(data, mem, "Expire date", i);
+    if(result)
+      break;
 
     pubkey = X509_get_pubkey(x);
     if(!pubkey)
       infof(data, "   Unable to load public key");
     else {
-      int pktype;
-#ifdef HAVE_OPAQUE_EVP_PKEY
-      pktype = EVP_PKEY_id(pubkey);
-#else
-      pktype = pubkey->type;
-#endif
-      switch(pktype) {
+      switch(EVP_PKEY_id(pubkey)) {
       case EVP_PKEY_RSA:
-      {
-#ifndef HAVE_EVP_PKEY_GET_PARAMS
-        RSA *rsa;
-#ifdef HAVE_OPAQUE_EVP_PKEY
-        rsa = EVP_PKEY_get0_RSA(pubkey);
-#else
-        rsa = pubkey->pkey.rsa;
-#endif /* HAVE_OPAQUE_EVP_PKEY */
-#endif /* !HAVE_EVP_PKEY_GET_PARAMS */
-
-        {
-#ifdef HAVE_OPAQUE_RSA_DSA_DH
-          DECLARE_PKEY_PARAM_BIGNUM(n);
-          DECLARE_PKEY_PARAM_BIGNUM(e);
-#ifdef HAVE_EVP_PKEY_GET_PARAMS
-          EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_RSA_N, &n);
-          EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_RSA_E, &e);
-#else
-          RSA_get0_key(rsa, &n, &e, NULL);
-#endif /* HAVE_EVP_PKEY_GET_PARAMS */
-          BIO_printf(mem, "%d", BN_num_bits(n));
-#else
-          BIO_printf(mem, "%d", BN_num_bits(rsa->n));
-#endif /* HAVE_OPAQUE_RSA_DSA_DH */
-          push_certinfo("RSA Public Key", i);
-          print_pubkey_BN(rsa, n, i);
-          print_pubkey_BN(rsa, e, i);
-          FREE_PKEY_PARAM_BIGNUM(n);
-          FREE_PKEY_PARAM_BIGNUM(e);
-        }
-
+        result = get_pkey_rsa(data, pubkey, mem, i);
         break;
-      }
-      case EVP_PKEY_DSA:
-      {
+
 #ifndef OPENSSL_NO_DSA
-#ifndef HAVE_EVP_PKEY_GET_PARAMS
-        DSA *dsa;
-#ifdef HAVE_OPAQUE_EVP_PKEY
-        dsa = EVP_PKEY_get0_DSA(pubkey);
-#else
-        dsa = pubkey->pkey.dsa;
-#endif /* HAVE_OPAQUE_EVP_PKEY */
-#endif /* !HAVE_EVP_PKEY_GET_PARAMS */
-        {
-#ifdef HAVE_OPAQUE_RSA_DSA_DH
-          DECLARE_PKEY_PARAM_BIGNUM(p);
-          DECLARE_PKEY_PARAM_BIGNUM(q);
-          DECLARE_PKEY_PARAM_BIGNUM(g);
-          DECLARE_PKEY_PARAM_BIGNUM(pub_key);
-#ifdef HAVE_EVP_PKEY_GET_PARAMS
-          EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_FFC_P, &p);
-          EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_FFC_Q, &q);
-          EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_FFC_G, &g);
-          EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_PUB_KEY, &pub_key);
-#else
-          DSA_get0_pqg(dsa, &p, &q, &g);
-          DSA_get0_key(dsa, &pub_key, NULL);
-#endif /* HAVE_EVP_PKEY_GET_PARAMS */
-#endif /* HAVE_OPAQUE_RSA_DSA_DH */
-          print_pubkey_BN(dsa, p, i);
-          print_pubkey_BN(dsa, q, i);
-          print_pubkey_BN(dsa, g, i);
-          print_pubkey_BN(dsa, pub_key, i);
-          FREE_PKEY_PARAM_BIGNUM(p);
-          FREE_PKEY_PARAM_BIGNUM(q);
-          FREE_PKEY_PARAM_BIGNUM(g);
-          FREE_PKEY_PARAM_BIGNUM(pub_key);
-        }
-#endif /* !OPENSSL_NO_DSA */
+      case EVP_PKEY_DSA:
+        result = get_pkey_dsa(data, pubkey, mem, i);
         break;
-      }
+#endif
+
       case EVP_PKEY_DH:
-      {
-#ifndef HAVE_EVP_PKEY_GET_PARAMS
-        DH *dh;
-#ifdef HAVE_OPAQUE_EVP_PKEY
-        dh = EVP_PKEY_get0_DH(pubkey);
-#else
-        dh = pubkey->pkey.dh;
-#endif /* HAVE_OPAQUE_EVP_PKEY */
-#endif /* !HAVE_EVP_PKEY_GET_PARAMS */
-        {
-#ifdef HAVE_OPAQUE_RSA_DSA_DH
-          DECLARE_PKEY_PARAM_BIGNUM(p);
-          DECLARE_PKEY_PARAM_BIGNUM(q);
-          DECLARE_PKEY_PARAM_BIGNUM(g);
-          DECLARE_PKEY_PARAM_BIGNUM(pub_key);
-#ifdef HAVE_EVP_PKEY_GET_PARAMS
-          EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_FFC_P, &p);
-          EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_FFC_Q, &q);
-          EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_FFC_G, &g);
-          EVP_PKEY_get_bn_param(pubkey, OSSL_PKEY_PARAM_PUB_KEY, &pub_key);
-#else
-          DH_get0_pqg(dh, &p, &q, &g);
-          DH_get0_key(dh, &pub_key, NULL);
-#endif /* HAVE_EVP_PKEY_GET_PARAMS */
-          print_pubkey_BN(dh, p, i);
-          print_pubkey_BN(dh, q, i);
-          print_pubkey_BN(dh, g, i);
-#else
-          print_pubkey_BN(dh, p, i);
-          print_pubkey_BN(dh, g, i);
-#endif /* HAVE_OPAQUE_RSA_DSA_DH */
-          print_pubkey_BN(dh, pub_key, i);
-          FREE_PKEY_PARAM_BIGNUM(p);
-          FREE_PKEY_PARAM_BIGNUM(q);
-          FREE_PKEY_PARAM_BIGNUM(g);
-          FREE_PKEY_PARAM_BIGNUM(pub_key);
-        }
+        result = get_pkey_dh(data, pubkey, mem, i);
         break;
       }
-      }
       EVP_PKEY_free(pubkey);
     }
 
-    if(psig) {
-      for(j = 0; j < psig->length; j++)
-        BIO_printf(mem, "%02x:", psig->data[j]);
-      push_certinfo("Signature", i);
+    if(!result && psig) {
+      const unsigned char *psigdata = ASN1_STRING_get0_data(psig);
+      for(j = 0; j < ASN1_STRING_length(psig); j++)
+        BIO_printf(mem, "%02x:", psigdata[j]);
+      result = push_certinfo(data, mem, "Signature", i);
     }
 
-    PEM_write_bio_X509(mem, x);
-    push_certinfo("Cert", i);
+    if(!result) {
+      PEM_write_bio_X509(mem, x);
+      result = push_certinfo(data, mem, "Cert", i);
+    }
   }
 
   BIO_free(mem);
 
-  return CURLE_OK;
+  if(result)
+    /* cleanup all leftovers */
+    Curl_ssl_free_certinfo(data);
+
+  return result;
 }
 
-#endif /* quiche or OpenSSL */
-
-#ifdef USE_OPENSSL
-
-#if USE_PRE_1_1_API
-#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER < 0x2070000fL
-#define BIO_set_init(x,v)          ((x)->init=(v))
-#define BIO_get_data(x)            ((x)->ptr)
-#define BIO_set_data(x,v)          ((x)->ptr=(v))
-#endif
-#define BIO_get_shutdown(x)        ((x)->shutdown)
-#define BIO_set_shutdown(x,v)      ((x)->shutdown=(v))
-#endif /* USE_PRE_1_1_API */
-
-static int bio_cf_create(BIO *bio)
+static int ossl_bio_cf_create(BIO *bio)
 {
   BIO_set_shutdown(bio, 1);
   BIO_set_init(bio, 1);
-#if USE_PRE_1_1_API
-  bio->num = -1;
-#endif
   BIO_set_data(bio, NULL);
   return 1;
 }
 
-static int bio_cf_destroy(BIO *bio)
+static int ossl_bio_cf_destroy(BIO *bio)
 {
   if(!bio)
     return 0;
   return 1;
 }
 
-static long bio_cf_ctrl(BIO *bio, int cmd, long num, void *ptr)
+static long ossl_bio_cf_ctrl(BIO *bio, int cmd, long num, void *ptr)
 {
   struct Curl_cfilter *cf = BIO_get_data(bio);
   long ret = 1;
@@ -701,11 +552,11 @@ static long bio_cf_ctrl(BIO *bio, int cmd, long num, void *ptr)
   case BIO_CTRL_DUP:
     ret = 1;
     break;
-#ifdef BIO_CTRL_EOF
-  case BIO_CTRL_EOF:
+  case BIO_CTRL_EOF: {
     /* EOF has been reached on input? */
-    return (!cf->next || !cf->next->connected);
-#endif
+    struct ssl_connect_data *connssl = cf->ctx;
+    return connssl->peer_closed;
+  }
   default:
     ret = 0;
     break;
@@ -713,122 +564,100 @@ static long bio_cf_ctrl(BIO *bio, int cmd, long num, void *ptr)
   return ret;
 }
 
-static int bio_cf_out_write(BIO *bio, const char *buf, int blen)
+static int ossl_bio_cf_out_write(BIO *bio, const char *buf, int blen)
 {
   struct Curl_cfilter *cf = BIO_get_data(bio);
   struct ssl_connect_data *connssl = cf->ctx;
-  struct ossl_ssl_backend_data *backend =
-    (struct ossl_ssl_backend_data *)connssl->backend;
+  struct ossl_ctx *octx = (struct ossl_ctx *)connssl->backend;
   struct Curl_easy *data = CF_DATA_CURRENT(cf);
-  ssize_t nwritten;
-  CURLcode result = CURLE_SEND_ERROR;
+  size_t nwritten;
+  CURLcode result;
 
   DEBUGASSERT(data);
-  nwritten = Curl_conn_cf_send(cf->next, data, buf, blen, &result);
-  CURL_TRC_CF(data, cf, "bio_cf_out_write(len=%d) -> %d, err=%d",
-              blen, (int)nwritten, result);
+  if(blen < 0)
+    return 0;
+
+  result = Curl_conn_cf_send(cf->next, data,
+                             (const uint8_t *)buf, (size_t)blen, FALSE,
+                             &nwritten);
+  CURL_TRC_CF(data, cf, "ossl_bio_cf_out_write(len=%d) -> %d, %zu",
+              blen, (int)result, nwritten);
   BIO_clear_retry_flags(bio);
-  backend->io_result = result;
-  if(nwritten < 0) {
-    if(CURLE_AGAIN == result)
+  octx->io_result = result;
+  if(result) {
+    if(result == CURLE_AGAIN)
       BIO_set_retry_write(bio);
+    return -1;
   }
   return (int)nwritten;
 }
 
-static int bio_cf_in_read(BIO *bio, char *buf, int blen)
+static int ossl_bio_cf_in_read(BIO *bio, char *buf, int blen)
 {
   struct Curl_cfilter *cf = BIO_get_data(bio);
   struct ssl_connect_data *connssl = cf->ctx;
-  struct ossl_ssl_backend_data *backend =
-    (struct ossl_ssl_backend_data *)connssl->backend;
+  struct ossl_ctx *octx = (struct ossl_ctx *)connssl->backend;
   struct Curl_easy *data = CF_DATA_CURRENT(cf);
-  ssize_t nread;
-  CURLcode result = CURLE_RECV_ERROR;
+  size_t nread;
+  CURLcode result, r2;
 
   DEBUGASSERT(data);
   /* OpenSSL catches this case, so should we. */
   if(!buf)
     return 0;
+  if(blen < 0)
+    return 0;
 
-  nread = Curl_conn_cf_recv(cf->next, data, buf, blen, &result);
-  CURL_TRC_CF(data, cf, "bio_cf_in_read(len=%d) -> %d, err=%d",
-              blen, (int)nread, result);
+  result = Curl_conn_cf_recv(cf->next, data, buf, (size_t)blen, &nread);
+  CURL_TRC_CF(data, cf, "ossl_bio_cf_in_read(len=%d) -> %d, %zu",
+              blen, (int)result, nread);
   BIO_clear_retry_flags(bio);
-  backend->io_result = result;
-  if(nread < 0) {
-    if(CURLE_AGAIN == result)
+  octx->io_result = result;
+  if(result) {
+    if(result == CURLE_AGAIN)
       BIO_set_retry_read(bio);
   }
+  else {
+    /* feeding data to OpenSSL means SSL_read() might succeed */
+    connssl->input_pending = TRUE;
+    if(nread == 0)
+      connssl->peer_closed = TRUE;
+  }
 
   /* Before returning server replies to the SSL instance, we need
-   * to have setup the x509 store or verification will fail. */
-  if(!backend->x509_store_setup) {
-    result = Curl_ssl_setup_x509_store(cf, data, backend->ctx);
-    if(result) {
-      backend->io_result = result;
+   * to have setup the x509 store or verification fails. */
+  if(!octx->x509_store_setup) {
+    r2 = Curl_ssl_setup_x509_store(cf, data, octx);
+    if(r2) {
+      BIO_clear_retry_flags(bio);
+      octx->io_result = r2;
       return -1;
     }
-    backend->x509_store_setup = TRUE;
+    octx->x509_store_setup = TRUE;
   }
-
-  return (int)nread;
+  return result ? -1 : (int)nread;
 }
 
-#if USE_PRE_1_1_API
-
-static BIO_METHOD bio_cf_meth_1_0 = {
-  BIO_TYPE_MEM,
-  "OpenSSL CF BIO",
-  bio_cf_out_write,
-  bio_cf_in_read,
-  NULL,                    /* puts is never called */
-  NULL,                    /* gets is never called */
-  bio_cf_ctrl,
-  bio_cf_create,
-  bio_cf_destroy,
-  NULL
-};
-
-static BIO_METHOD *bio_cf_method_create(void)
-{
-  return &bio_cf_meth_1_0;
-}
-
-#define bio_cf_method_free(m) Curl_nop_stmt
-
-#else
-
-static BIO_METHOD *bio_cf_method_create(void)
+static BIO_METHOD *ossl_bio_cf_method_create(void)
 {
   BIO_METHOD *m = BIO_meth_new(BIO_TYPE_MEM, "OpenSSL CF BIO");
   if(m) {
-    BIO_meth_set_write(m, &bio_cf_out_write);
-    BIO_meth_set_read(m, &bio_cf_in_read);
-    BIO_meth_set_ctrl(m, &bio_cf_ctrl);
-    BIO_meth_set_create(m, &bio_cf_create);
-    BIO_meth_set_destroy(m, &bio_cf_destroy);
+    BIO_meth_set_write(m, &ossl_bio_cf_out_write);
+    BIO_meth_set_read(m, &ossl_bio_cf_in_read);
+    BIO_meth_set_ctrl(m, &ossl_bio_cf_ctrl);
+    BIO_meth_set_create(m, &ossl_bio_cf_create);
+    BIO_meth_set_destroy(m, &ossl_bio_cf_destroy);
   }
   return m;
 }
 
-static void bio_cf_method_free(BIO_METHOD *m)
+static void ossl_bio_cf_method_free(BIO_METHOD *m)
 {
   if(m)
     BIO_meth_free(m);
 }
 
-#endif
-
-
-/*
- * Number of bytes to read from the random number seed file. This must be
- * a finite value (because some entropy "files" like /dev/urandom have
- * an infinite length), but must be large enough to provide enough
- * entropy to properly seed OpenSSL's PRNG.
- */
-#define RAND_LOAD_LENGTH 1024
-
+#ifndef HAVE_KEYLOG_UPSTREAM
 #ifdef HAVE_KEYLOG_CALLBACK
 static void ossl_keylog_callback(const SSL *ssl, const char *line)
 {
@@ -839,34 +668,29 @@ static void ossl_keylog_callback(const SSL *ssl, const char *line)
 #else
 /*
  * ossl_log_tls12_secret is called by libcurl to make the CLIENT_RANDOMs if the
- * OpenSSL being used doesn't have native support for doing that.
+ * OpenSSL being used does not have native support for doing that.
  */
-static void
-ossl_log_tls12_secret(const SSL *ssl, bool *keylog_done)
+static void ossl_log_tls12_secret(const SSL *ssl, bool *keylog_done)
 {
-  const SSL_SESSION *session = SSL_get_session(ssl);
+  const SSL_SESSION *session;
   unsigned char client_random[SSL3_RANDOM_SIZE];
   unsigned char master_key[SSL_MAX_MASTER_KEY_LENGTH];
   int master_key_length = 0;
 
-  if(!session || *keylog_done)
-    return;
+  ERR_set_mark();
+
+  session = SSL_get_session(ssl);
+
+  if(!session || *keylog_done) {
+    ERR_pop_to_mark();
+    return;
+  }
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L &&    \
-  !(defined(LIBRESSL_VERSION_NUMBER) &&         \
-    LIBRESSL_VERSION_NUMBER < 0x20700000L)
-  /* ssl->s3 is not checked in openssl 1.1.0-pre6, but let's assume that
-   * we have a valid SSL context if we have a non-NULL session. */
   SSL_get_client_random(ssl, client_random, SSL3_RANDOM_SIZE);
   master_key_length = (int)
     SSL_SESSION_get_master_key(session, master_key, SSL_MAX_MASTER_KEY_LENGTH);
-#else
-  if(ssl->s3 && session->master_key_length > 0) {
-    master_key_length = session->master_key_length;
-    memcpy(master_key, session->master_key, session->master_key_length);
-    memcpy(client_random, ssl->s3->client_random, SSL3_RANDOM_SIZE);
-  }
-#endif
+
+  ERR_pop_to_mark();
 
   /* The handshake has not progressed sufficiently yet, or this is a TLS 1.3
    * session (when curl was built with older OpenSSL headers and running with
@@ -874,11 +698,12 @@ ossl_log_tls12_secret(const SSL *ssl, bool *keylog_done)
   if(master_key_length <= 0)
     return;
 
-  *keylog_done = true;
+  *keylog_done = TRUE;
   Curl_tls_keylog_write("CLIENT_RANDOM", client_random,
                         master_key, master_key_length);
 }
 #endif /* !HAVE_KEYLOG_CALLBACK */
+#endif /* HAVE_KEYLOG_UPSTREAM */
 
 static const char *SSL_ERROR_to_str(int err)
 {
@@ -901,25 +726,23 @@ static const char *SSL_ERROR_to_str(int err)
     return "SSL_ERROR_WANT_CONNECT";
   case SSL_ERROR_WANT_ACCEPT:
     return "SSL_ERROR_WANT_ACCEPT";
-#if defined(SSL_ERROR_WANT_ASYNC)
+#ifdef SSL_ERROR_WANT_ASYNC  /* OpenSSL 1.1.0+, LibreSSL 3.6.0+ */
   case SSL_ERROR_WANT_ASYNC:
     return "SSL_ERROR_WANT_ASYNC";
 #endif
-#if defined(SSL_ERROR_WANT_ASYNC_JOB)
+#ifdef SSL_ERROR_WANT_ASYNC_JOB  /* OpenSSL 1.1.0+, LibreSSL 3.6.0+ */
   case SSL_ERROR_WANT_ASYNC_JOB:
     return "SSL_ERROR_WANT_ASYNC_JOB";
 #endif
-#if defined(SSL_ERROR_WANT_EARLY)
-  case SSL_ERROR_WANT_EARLY:
-    return "SSL_ERROR_WANT_EARLY";
+#ifdef SSL_ERROR_WANT_CLIENT_HELLO_CB  /* OpenSSL 1.1.1, LibreSSL 3.6.0+ */
+  case SSL_ERROR_WANT_CLIENT_HELLO_CB:
+    return "SSL_ERROR_WANT_CLIENT_HELLO_CB";
 #endif
   default:
     return "SSL_ERROR unknown";
   }
 }
 
-static size_t ossl_version(char *buffer, size_t size);
-
 /* Return error string for last OpenSSL error
  */
 static char *ossl_strerror(unsigned long error, char *buf, size_t size)
@@ -928,7 +751,7 @@ static char *ossl_strerror(unsigned long error, char *buf, size_t size)
   DEBUGASSERT(size);
   *buf = '\0';
 
-  len = ossl_version(buf, size);
+  len = Curl_ossl_version(buf, size);
   DEBUGASSERT(len < (size - 2));
   if(len < (size - 2)) {
     buf += len;
@@ -938,29 +761,28 @@ static char *ossl_strerror(unsigned long error, char *buf, size_t size)
     *buf = '\0';
   }
 
-#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
+#ifdef HAVE_BORINGSSL_LIKE
   ERR_error_string_n((uint32_t)error, buf, size);
 #else
   ERR_error_string_n(error, buf, size);
 #endif
 
   if(!*buf) {
-    strncpy(buf, (error ? "Unknown error" : "No error"), size);
-    buf[size - 1] = '\0';
+    const char *msg = error ? "Unknown error" : "No error";
+    curlx_strcopy(buf, size, msg, strlen(msg));
   }
 
   return buf;
 }
 
-static int passwd_callback(char *buf, int num, int encrypting,
-                           void *global_passwd)
+static int passwd_callback(char *buf, int num, int encrypting, void *password)
 {
-  DEBUGASSERT(0 == encrypting);
+  DEBUGASSERT(encrypting == 0);
 
-  if(!encrypting) {
-    int klen = curlx_uztosi(strlen((char *)global_passwd));
+  if(!encrypting && num >= 0 && password) {
+    int klen = curlx_uztosi(strlen((char *)password));
     if(num > klen) {
-      memcpy(buf, global_passwd, klen + 1);
+      memcpy(buf, password, klen + 1);
       return klen;
     }
   }
@@ -972,7 +794,7 @@ static int passwd_callback(char *buf, int num, int encrypting,
  */
 static bool rand_enough(void)
 {
-  return (0 != RAND_status()) ? TRUE : FALSE;
+  return RAND_status() != 0;
 }
 
 static CURLcode ossl_seed(struct Curl_easy *data)
@@ -987,57 +809,8 @@ static CURLcode ossl_seed(struct Curl_easy *data)
       data->multi->ssl_seeded = TRUE;
     return CURLE_OK;
   }
-#ifdef HAVE_RANDOM_INIT_BY_DEFAULT
-  /* with OpenSSL 1.1.0+, a failed RAND_status is a showstopper */
   failf(data, "Insufficient randomness");
   return CURLE_SSL_CONNECT_ERROR;
-#else
-
-#ifdef RANDOM_FILE
-  RAND_load_file(RANDOM_FILE, RAND_LOAD_LENGTH);
-  if(rand_enough())
-    return CURLE_OK;
-#endif
-
-  /* fallback to a custom seeding of the PRNG using a hash based on a current
-     time */
-  do {
-    unsigned char randb[64];
-    size_t len = sizeof(randb);
-    size_t i, i_max;
-    for(i = 0, i_max = len / sizeof(struct curltime); i < i_max; ++i) {
-      struct curltime tv = Curl_now();
-      Curl_wait_ms(1);
-      tv.tv_sec *= i + 1;
-      tv.tv_usec *= (unsigned int)i + 2;
-      tv.tv_sec ^= ((Curl_now().tv_sec + Curl_now().tv_usec) *
-                    (i + 3)) << 8;
-      tv.tv_usec ^= (unsigned int) ((Curl_now().tv_sec +
-                                     Curl_now().tv_usec) *
-                                    (i + 4)) << 16;
-      memcpy(&randb[i * sizeof(struct curltime)], &tv,
-             sizeof(struct curltime));
-    }
-    RAND_add(randb, (int)len, (double)len/2);
-  } while(!rand_enough());
-
-  {
-    /* generates a default path for the random seed file */
-    char fname[256];
-    fname[0] = 0; /* blank it first */
-    RAND_file_name(fname, sizeof(fname));
-    if(fname[0]) {
-      /* we got a file name to try */
-      RAND_load_file(fname, RAND_LOAD_LENGTH);
-      if(rand_enough())
-        return CURLE_OK;
-    }
-  }
-
-  infof(data, "libcurl is now using a weak random seed");
-  return (rand_enough() ? CURLE_OK :
-          CURLE_SSL_CONNECT_ERROR /* confusing error code */);
-#endif
 }
 
 #ifndef SSL_FILETYPE_ENGINE
@@ -1046,22 +819,27 @@ static CURLcode ossl_seed(struct Curl_easy *data)
 #ifndef SSL_FILETYPE_PKCS12
 #define SSL_FILETYPE_PKCS12 43
 #endif
-static int do_file_type(const char *type)
+#ifndef SSL_FILETYPE_PROVIDER
+#define SSL_FILETYPE_PROVIDER 44
+#endif
+static int ossl_do_file_type(const char *type)
 {
   if(!type || !type[0])
     return SSL_FILETYPE_PEM;
-  if(strcasecompare(type, "PEM"))
+  if(curl_strequal(type, "PEM"))
     return SSL_FILETYPE_PEM;
-  if(strcasecompare(type, "DER"))
+  if(curl_strequal(type, "DER"))
     return SSL_FILETYPE_ASN1;
-  if(strcasecompare(type, "ENG"))
+  if(curl_strequal(type, "PROV"))
+    return SSL_FILETYPE_PROVIDER;
+  if(curl_strequal(type, "ENG"))
     return SSL_FILETYPE_ENGINE;
-  if(strcasecompare(type, "P12"))
+  if(curl_strequal(type, "P12"))
     return SSL_FILETYPE_PKCS12;
   return -1;
 }
 
-#ifdef USE_OPENSSL_ENGINE
+#if defined(USE_OPENSSL_ENGINE) || defined(OPENSSL_HAS_PROVIDERS)
 /*
  * Supply default password to the engine user interface conversation.
  * The password is passed by OpenSSL engine from ENGINE_load_private_key()
@@ -1078,6 +856,7 @@ static int ssl_ui_reader(UI *ui, UI_STRING *uis)
       UI_set_result(ui, uis, password);
       return 1;
     }
+    FALLTHROUGH();
   default:
     break;
   }
@@ -1096,6 +875,7 @@ static int ssl_ui_writer(UI *ui, UI_STRING *uis)
        (UI_get_input_flags(uis) & UI_INPUT_FLAG_DEFAULT_PWD)) {
       return 1;
     }
+    FALLTHROUGH();
   default:
     break;
   }
@@ -1107,16 +887,18 @@ static int ssl_ui_writer(UI *ui, UI_STRING *uis)
  */
 static bool is_pkcs11_uri(const char *string)
 {
-  return (string && strncasecompare(string, "pkcs11:", 7));
+  return string && curl_strnequal(string, "pkcs11:", 7);
 }
 
 #endif
 
-static CURLcode ossl_set_engine(struct Curl_easy *data, const char *engine);
+static CURLcode ossl_set_engine(struct Curl_easy *data, const char *name);
+#ifdef OPENSSL_HAS_PROVIDERS
+static CURLcode ossl_set_provider(struct Curl_easy *data, const char *iname);
+#endif
 
-static int
-SSL_CTX_use_certificate_blob(SSL_CTX *ctx, const struct curl_blob *blob,
-                             int type, const char *key_passwd)
+static int use_certificate_blob(SSL_CTX *ctx, const struct curl_blob *blob,
+                                int type, const char *key_passwd)
 {
   int ret = 0;
   X509 *x = NULL;
@@ -1132,8 +914,7 @@ SSL_CTX_use_certificate_blob(SSL_CTX *ctx, const struct curl_blob *blob,
   }
   else if(type == SSL_FILETYPE_PEM) {
     /* ERR_R_PEM_LIB; */
-    x = PEM_read_bio_X509(in, NULL,
-                          passwd_callback, (void *)key_passwd);
+    x = PEM_read_bio_X509(in, NULL, passwd_callback, CURL_UNCONST(key_passwd));
   }
   else {
     ret = 0;
@@ -1152,9 +933,8 @@ end:
   return ret;
 }
 
-static int
-SSL_CTX_use_PrivateKey_blob(SSL_CTX *ctx, const struct curl_blob *blob,
-                            int type, const char *key_passwd)
+static int use_privatekey_blob(SSL_CTX *ctx, const struct curl_blob *blob,
+                               int type, const char *key_passwd)
 {
   int ret = 0;
   EVP_PKEY *pkey = NULL;
@@ -1164,17 +944,15 @@ SSL_CTX_use_PrivateKey_blob(SSL_CTX *ctx, const struct curl_blob *blob,
 
   if(type == SSL_FILETYPE_PEM)
     pkey = PEM_read_bio_PrivateKey(in, NULL, passwd_callback,
-                                   (void *)key_passwd);
+                                   CURL_UNCONST(key_passwd));
   else if(type == SSL_FILETYPE_ASN1)
     pkey = d2i_PrivateKey_bio(in, NULL);
-  else {
-    ret = 0;
+  else
     goto end;
-  }
-  if(!pkey) {
-    ret = 0;
+
+  if(!pkey)
     goto end;
-  }
+
   ret = SSL_CTX_use_PrivateKey(ctx, pkey);
   EVP_PKEY_free(pkey);
 end:
@@ -1182,17 +960,12 @@ end:
   return ret;
 }
 
-static int
-SSL_CTX_use_certificate_chain_blob(SSL_CTX *ctx, const struct curl_blob *blob,
-                                   const char *key_passwd)
+static int use_certificate_chain_blob(SSL_CTX *ctx,
+                                      const struct curl_blob *blob,
+                                      const char *key_passwd)
 {
-/* SSL_CTX_add1_chain_cert introduced in OpenSSL 1.0.2 */
-#if (OPENSSL_VERSION_NUMBER >= 0x1000200fL) && /* OpenSSL 1.0.2 or later */ \
-  !(defined(LIBRESSL_VERSION_NUMBER) &&                                     \
-    (LIBRESSL_VERSION_NUMBER < 0x2090100fL)) /* LibreSSL 2.9.1 or later */
   int ret = 0;
   X509 *x = NULL;
-  void *passwd_callback_userdata = (void *)key_passwd;
   BIO *in = BIO_new_mem_buf(blob->data, (int)(blob->len));
   if(!in)
     return CURLE_OUT_OF_MEMORY;
@@ -1200,12 +973,9 @@ SSL_CTX_use_certificate_chain_blob(SSL_CTX *ctx, const struct curl_blob *blob,
   ERR_clear_error();
 
   x = PEM_read_bio_X509_AUX(in, NULL,
-                            passwd_callback, (void *)key_passwd);
-
-  if(!x) {
-    ret = 0;
+                            passwd_callback, CURL_UNCONST(key_passwd));
+  if(!x)
     goto end;
-  }
 
   ret = SSL_CTX_use_certificate(ctx, x);
 
@@ -1222,8 +992,7 @@ SSL_CTX_use_certificate_chain_blob(SSL_CTX *ctx, const struct curl_blob *blob,
     }
 
     while((ca = PEM_read_bio_X509(in, NULL, passwd_callback,
-                                  passwd_callback_userdata))
-          != NULL) {
+                                  CURL_UNCONST(key_passwd))) != NULL) {
 
       if(!SSL_CTX_add0_chain_cert(ctx, ca)) {
         X509_free(ca);
@@ -1244,34 +1013,431 @@ end:
   X509_free(x);
   BIO_free(in);
   return ret;
+}
+
+static int enginecheck(struct Curl_easy *data,
+                       SSL_CTX* ctx,
+                       const char *key_file,
+                       const char *key_passwd)
+{
+#ifdef USE_OPENSSL_ENGINE
+  EVP_PKEY *priv_key = NULL;
+
+  /* Implicitly use pkcs11 engine if none was provided and the
+   * key_file is a PKCS#11 URI */
+  if(!data->state.engine) {
+    if(is_pkcs11_uri(key_file)) {
+      if(ossl_set_engine(data, "pkcs11") != CURLE_OK) {
+        return 0;
+      }
+    }
+  }
+
+  if(data->state.engine) {
+    UI_METHOD *ui_method = UI_create_method("curl user interface");
+    if(!ui_method) {
+      failf(data, "unable to create " OSSL_PACKAGE " user-interface method");
+      return 0;
+    }
+    UI_method_set_opener(ui_method, UI_method_get_opener(UI_OpenSSL()));
+    UI_method_set_closer(ui_method, UI_method_get_closer(UI_OpenSSL()));
+    UI_method_set_reader(ui_method, ssl_ui_reader);
+    UI_method_set_writer(ui_method, ssl_ui_writer);
+    priv_key = ENGINE_load_private_key(data->state.engine, key_file,
+                                       ui_method,
+                                       CURL_UNCONST(key_passwd));
+    UI_destroy_method(ui_method);
+    if(!priv_key) {
+      failf(data, "failed to load private key from crypto engine");
+      return 0;
+    }
+    if(SSL_CTX_use_PrivateKey(ctx, priv_key) != 1) {
+      failf(data, "unable to set private key");
+      EVP_PKEY_free(priv_key);
+      return 0;
+    }
+    EVP_PKEY_free(priv_key);  /* we do not need the handle any more... */
+  }
+  else {
+    failf(data, "crypto engine not set, cannot load private key");
+    return 0;
+  }
+  return 1;
 #else
-  (void)ctx; /* unused */
-  (void)blob; /* unused */
-  (void)key_passwd; /* unused */
+  (void)ctx;
+  (void)key_file;
+  (void)key_passwd;
+  failf(data, "SSL_FILETYPE_ENGINE not supported for private key");
   return 0;
 #endif
 }
 
-static
-int cert_stuff(struct Curl_easy *data,
-               SSL_CTX* ctx,
-               char *cert_file,
-               const struct curl_blob *cert_blob,
-               const char *cert_type,
-               char *key_file,
-               const struct curl_blob *key_blob,
-               const char *key_type,
-               char *key_passwd)
+static int providercheck(struct Curl_easy *data,
+                         SSL_CTX* ctx,
+                         const char *key_file)
+{
+#ifdef OPENSSL_HAS_PROVIDERS
+  char error_buffer[256];
+  /* Implicitly use pkcs11 provider if none was provided and the
+   * key_file is a PKCS#11 URI */
+  if(!data->state.provider_loaded) {
+    if(is_pkcs11_uri(key_file)) {
+      if(ossl_set_provider(data, "pkcs11") != CURLE_OK) {
+        return 0;
+      }
+    }
+  }
+
+  if(data->state.provider_loaded) {
+    /* Load the private key from the provider */
+    EVP_PKEY *priv_key = NULL;
+    OSSL_STORE_CTX *store = NULL;
+    OSSL_STORE_INFO *info = NULL;
+    UI_METHOD *ui_method = UI_create_method("curl user interface");
+    if(!ui_method) {
+      failf(data, "unable to create " OSSL_PACKAGE " user-interface method");
+      return 0;
+    }
+    UI_method_set_opener(ui_method, UI_method_get_opener(UI_OpenSSL()));
+    UI_method_set_closer(ui_method, UI_method_get_closer(UI_OpenSSL()));
+    UI_method_set_reader(ui_method, ssl_ui_reader);
+    UI_method_set_writer(ui_method, ssl_ui_writer);
+
+    store = OSSL_STORE_open_ex(key_file, data->state.libctx,
+                               data->state.propq, ui_method, NULL, NULL,
+                               NULL, NULL);
+    if(!store) {
+      failf(data, "Failed to open OpenSSL store: %s",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+      UI_destroy_method(ui_method);
+      return 0;
+    }
+    if(OSSL_STORE_expect(store, OSSL_STORE_INFO_PKEY) != 1) {
+      failf(data, "Failed to set store preference. Ignoring the error: %s",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+    }
+
+    info = OSSL_STORE_load(store);
+    if(info) {
+      int ossl_type = OSSL_STORE_INFO_get_type(info);
+
+      if(ossl_type == OSSL_STORE_INFO_PKEY)
+        priv_key = OSSL_STORE_INFO_get1_PKEY(info);
+      OSSL_STORE_INFO_free(info);
+    }
+    OSSL_STORE_close(store);
+    UI_destroy_method(ui_method);
+    if(!priv_key) {
+      failf(data, "No private key found in the openssl store: %s",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+      return 0;
+    }
+
+    if(SSL_CTX_use_PrivateKey(ctx, priv_key) != 1) {
+      failf(data, "unable to set private key [%s]",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+      EVP_PKEY_free(priv_key);
+      return 0;
+    }
+    EVP_PKEY_free(priv_key); /* we do not need the handle any more... */
+  }
+  else {
+    failf(data, "crypto provider not set, cannot load private key");
+    return 0;
+  }
+  return 1;
+#else
+  (void)ctx;
+  (void)key_file;
+  failf(data, "SSL_FILETYPE_PROVIDER not supported for private key");
+  return 0;
+#endif
+}
+
+static int engineload(struct Curl_easy *data,
+                      SSL_CTX* ctx,
+                      const char *cert_file)
+{
+/* ENGINE_CTRL_GET_CMD_FROM_NAME supported by OpenSSL, LibreSSL <=3.8.3 */
+#if defined(USE_OPENSSL_ENGINE) && defined(ENGINE_CTRL_GET_CMD_FROM_NAME)
+  char error_buffer[256];
+  /* Implicitly use pkcs11 engine if none was provided and the
+   * cert_file is a PKCS#11 URI */
+  if(!data->state.engine) {
+    if(is_pkcs11_uri(cert_file)) {
+      if(ossl_set_engine(data, "pkcs11") != CURLE_OK) {
+        return 0;
+      }
+    }
+  }
+
+  if(data->state.engine) {
+    const char *cmd_name = "LOAD_CERT_CTRL";
+    struct {
+      const char *cert_id;
+      X509 *cert;
+    } params;
+
+    params.cert_id = cert_file;
+    params.cert = NULL;
+
+    /* Does the engine supports LOAD_CERT_CTRL ? */
+    if(!ENGINE_ctrl(data->state.engine, ENGINE_CTRL_GET_CMD_FROM_NAME,
+                    0, CURL_UNCONST(cmd_name), NULL)) {
+      failf(data, "SSL engine does not support loading certificates");
+      return 0;
+    }
+
+    /* Load the certificate from the engine */
+    if(!ENGINE_ctrl_cmd(data->state.engine, cmd_name, 0, &params, NULL, 1)) {
+      failf(data, "SSL engine cannot load client cert with id '%s' [%s]",
+            cert_file,
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+      return 0;
+    }
+
+    if(!params.cert) {
+      failf(data, "SSL engine did not initialized the certificate properly.");
+      return 0;
+    }
+
+    if(SSL_CTX_use_certificate(ctx, params.cert) != 1) {
+      failf(data, "unable to set client certificate [%s]",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+      X509_free(params.cert);
+      return 0;
+    }
+    X509_free(params.cert); /* we do not need the handle any more... */
+  }
+  else {
+    failf(data, "crypto engine not set, cannot load certificate");
+    return 0;
+  }
+  return 1;
+#else
+  (void)ctx;
+  (void)cert_file;
+  failf(data, "SSL_FILETYPE_ENGINE not supported for certificate");
+  return 0;
+#endif
+}
+
+static int providerload(struct Curl_easy *data,
+                        SSL_CTX* ctx,
+                        const char *cert_file)
+{
+#ifdef OPENSSL_HAS_PROVIDERS
+  char error_buffer[256];
+  /* Implicitly use pkcs11 provider if none was provided and the
+   * cert_file is a PKCS#11 URI */
+  if(!data->state.provider_loaded) {
+    if(is_pkcs11_uri(cert_file)) {
+      if(ossl_set_provider(data, "pkcs11") != CURLE_OK) {
+        return 0;
+      }
+    }
+  }
+
+  if(data->state.provider_loaded) {
+    /* Load the certificate from the provider */
+    OSSL_STORE_INFO *info = NULL;
+    X509 *cert = NULL;
+    OSSL_STORE_CTX *store =
+      OSSL_STORE_open_ex(cert_file, data->state.libctx,
+                         NULL, NULL, NULL, NULL, NULL, NULL);
+    int rc;
+
+    if(!store) {
+      failf(data, "Failed to open OpenSSL store: %s",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+      return 0;
+    }
+    if(OSSL_STORE_expect(store, OSSL_STORE_INFO_CERT) != 1) {
+      failf(data, "Failed to set store preference. Ignoring the error: %s",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+    }
+
+    info = OSSL_STORE_load(store);
+    if(info) {
+      int ossl_type = OSSL_STORE_INFO_get_type(info);
+
+      if(ossl_type == OSSL_STORE_INFO_CERT)
+        cert = OSSL_STORE_INFO_get1_CERT(info);
+      OSSL_STORE_INFO_free(info);
+    }
+    OSSL_STORE_close(store);
+    if(!cert) {
+      failf(data, "No cert found in the openssl store: %s",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+      return 0;
+    }
+
+    rc = SSL_CTX_use_certificate(ctx, cert);
+    X509_free(cert); /* we do not need the handle any more... */
+
+    if(rc != 1) {
+      failf(data, "unable to set client certificate [%s]",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+      return 0;
+    }
+  }
+  else {
+    failf(data, "crypto provider not set, cannot load certificate");
+    return 0;
+  }
+  return 1;
+#else
+  (void)ctx;
+  (void)cert_file;
+  failf(data, "SSL_FILETYPE_PROVIDER not supported for certificate");
+  return 0;
+#endif
+}
+
+static int pkcs12load(struct Curl_easy *data,
+                      SSL_CTX* ctx,
+                      const struct curl_blob *cert_blob,
+                      const char *cert_file,
+                      const char *key_passwd)
+{
+  char error_buffer[256];
+  BIO *cert_bio = NULL;
+  PKCS12 *p12 = NULL;
+  EVP_PKEY *pri;
+  X509 *x509;
+  int cert_done = 0;
+  STACK_OF(X509) *ca = NULL;
+  if(cert_blob) {
+    cert_bio = BIO_new_mem_buf(cert_blob->data, (int)(cert_blob->len));
+    if(!cert_bio) {
+      failf(data, "BIO_new_mem_buf NULL, " OSSL_PACKAGE " error %s",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+      return 0;
+    }
+  }
+  else {
+    cert_bio = BIO_new(BIO_s_file());
+    if(!cert_bio) {
+      failf(data, "BIO_new return NULL, " OSSL_PACKAGE " error %s",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+      return 0;
+    }
+
+    if(BIO_read_filename(cert_bio, CURL_UNCONST(cert_file)) <= 0) {
+      failf(data, "could not open PKCS12 file '%s'", cert_file);
+      BIO_free(cert_bio);
+      return 0;
+    }
+  }
+
+  p12 = d2i_PKCS12_bio(cert_bio, NULL);
+  BIO_free(cert_bio);
+
+  if(!p12) {
+    failf(data, "error reading PKCS12 file '%s'",
+          cert_blob ? "(memory blob)" : cert_file);
+    return 0;
+  }
+
+  if(!PKCS12_parse(p12, key_passwd, &pri, &x509, &ca)) {
+    failf(data, "could not parse PKCS12 file, check password, " OSSL_PACKAGE
+          " error %s",
+          ossl_strerror(ERR_get_error(), error_buffer, sizeof(error_buffer)));
+    PKCS12_free(p12);
+    return 0;
+  }
+
+  PKCS12_free(p12);
+
+  if(SSL_CTX_use_certificate(ctx, x509) != 1) {
+    failf(data, "could not load PKCS12 client certificate, " OSSL_PACKAGE
+          " error %s",
+          ossl_strerror(ERR_get_error(), error_buffer, sizeof(error_buffer)));
+    goto fail;
+  }
+
+  if(SSL_CTX_use_PrivateKey(ctx, pri) != 1) {
+    failf(data, "unable to use private key from PKCS12 file '%s'", cert_file);
+    goto fail;
+  }
+
+  if(!SSL_CTX_check_private_key(ctx)) {
+    failf(data, "private key from PKCS12 file '%s' "
+          "does not match certificate in same file", cert_file);
+    goto fail;
+  }
+  /* Set Certificate Verification chain */
+  if(ca) {
+    while(sk_X509_num(ca)) {
+      /*
+       * Note that sk_X509_pop() is used below to make sure the cert is
+       * removed from the stack properly before getting passed to
+       * SSL_CTX_add_extra_chain_cert(), which takes ownership. Previously
+       * we used sk_X509_value() instead, but then we would clean it in the
+       * subsequent sk_X509_pop_free() call.
+       */
+      X509 *x = sk_X509_pop(ca);
+      if(!SSL_CTX_add_client_CA(ctx, x)) {
+        X509_free(x);
+        failf(data, "cannot add certificate to client CA list");
+        goto fail;
+      }
+      if(!SSL_CTX_add_extra_chain_cert(ctx, x)) {
+        X509_free(x);
+        failf(data, "cannot add certificate to certificate chain");
+        goto fail;
+      }
+    }
+  }
+
+  cert_done = 1;
+fail:
+  EVP_PKEY_free(pri);
+  X509_free(x509);
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wcast-function-type-strict"
+#endif
+  sk_X509_pop_free(ca, X509_free);
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic pop
+#endif
+  if(!cert_done)
+    return 0; /* failure! */
+  return 1;
+}
+
+static CURLcode client_cert(struct Curl_easy *data,
+                            SSL_CTX* ctx,
+                            char *cert_file,
+                            const struct curl_blob *cert_blob,
+                            const char *cert_type,
+                            char *key_file,
+                            const struct curl_blob *key_blob,
+                            const char *key_type,
+                            char *key_passwd)
 {
   char error_buffer[256];
   bool check_privkey = TRUE;
+  int file_type = ossl_do_file_type(cert_type);
 
-  int file_type = do_file_type(cert_type);
-
-  if(cert_file || cert_blob || (file_type == SSL_FILETYPE_ENGINE)) {
+  if(cert_file || cert_blob || (file_type == SSL_FILETYPE_ENGINE) ||
+     (file_type == SSL_FILETYPE_PROVIDER)) {
     SSL *ssl;
     X509 *x509;
-    int cert_done = 0;
+    bool pcks12_done = FALSE;
     int cert_use_result;
 
     if(key_passwd) {
@@ -1281,22 +1447,21 @@ int cert_stuff(struct Curl_easy *data,
       SSL_CTX_set_default_passwd_cb(ctx, passwd_callback);
     }
 
-
     switch(file_type) {
     case SSL_FILETYPE_PEM:
       /* SSL_CTX_use_certificate_chain_file() only works on PEM files */
       cert_use_result = cert_blob ?
-        SSL_CTX_use_certificate_chain_blob(ctx, cert_blob, key_passwd) :
+        use_certificate_chain_blob(ctx, cert_blob, key_passwd) :
         SSL_CTX_use_certificate_chain_file(ctx, cert_file);
       if(cert_use_result != 1) {
         failf(data,
               "could not load PEM client certificate from %s, " OSSL_PACKAGE
               " error %s, "
-              "(no key found, wrong pass phrase, or wrong file format?)",
+              "(no key found, wrong passphrase, or wrong file format?)",
               (cert_blob ? "CURLOPT_SSLCERT_BLOB" : cert_file),
               ossl_strerror(ERR_get_error(), error_buffer,
-                            sizeof(error_buffer)) );
-        return 0;
+                            sizeof(error_buffer)));
+        return CURLE_SSL_CERTPROBLEM;
       }
       break;
 
@@ -1306,318 +1471,102 @@ int cert_stuff(struct Curl_easy *data,
          ASN1 files. */
 
       cert_use_result = cert_blob ?
-        SSL_CTX_use_certificate_blob(ctx, cert_blob,
-                                     file_type, key_passwd) :
+        use_certificate_blob(ctx, cert_blob, file_type, key_passwd) :
       SSL_CTX_use_certificate_file(ctx, cert_file, file_type);
       if(cert_use_result != 1) {
         failf(data,
               "could not load ASN1 client certificate from %s, " OSSL_PACKAGE
               " error %s, "
-              "(no key found, wrong pass phrase, or wrong file format?)",
+              "(no key found, wrong passphrase, or wrong file format?)",
               (cert_blob ? "CURLOPT_SSLCERT_BLOB" : cert_file),
               ossl_strerror(ERR_get_error(), error_buffer,
-                            sizeof(error_buffer)) );
-        return 0;
+                            sizeof(error_buffer)));
+        return CURLE_SSL_CERTPROBLEM;
       }
       break;
+
     case SSL_FILETYPE_ENGINE:
-#if defined(USE_OPENSSL_ENGINE) && defined(ENGINE_CTRL_GET_CMD_FROM_NAME)
-    {
-      /* Implicitly use pkcs11 engine if none was provided and the
-       * cert_file is a PKCS#11 URI */
-      if(!data->state.engine) {
-        if(is_pkcs11_uri(cert_file)) {
-          if(ossl_set_engine(data, "pkcs11") != CURLE_OK) {
-            return 0;
-          }
-        }
-      }
+      if(!cert_file || !engineload(data, ctx, cert_file))
+        return CURLE_SSL_CERTPROBLEM;
+      break;
 
-      if(data->state.engine) {
-        const char *cmd_name = "LOAD_CERT_CTRL";
-        struct {
-          const char *cert_id;
-          X509 *cert;
-        } params;
-
-        params.cert_id = cert_file;
-        params.cert = NULL;
-
-        /* Does the engine supports LOAD_CERT_CTRL ? */
-        if(!ENGINE_ctrl(data->state.engine, ENGINE_CTRL_GET_CMD_FROM_NAME,
-                        0, (void *)cmd_name, NULL)) {
-          failf(data, "ssl engine does not support loading certificates");
-          return 0;
-        }
-
-        /* Load the certificate from the engine */
-        if(!ENGINE_ctrl_cmd(data->state.engine, cmd_name,
-                            0, &params, NULL, 1)) {
-          failf(data, "ssl engine cannot load client cert with id"
-                " '%s' [%s]", cert_file,
-                ossl_strerror(ERR_get_error(), error_buffer,
-                              sizeof(error_buffer)));
-          return 0;
-        }
-
-        if(!params.cert) {
-          failf(data, "ssl engine didn't initialized the certificate "
-                "properly.");
-          return 0;
-        }
-
-        if(SSL_CTX_use_certificate(ctx, params.cert) != 1) {
-          failf(data, "unable to set client certificate [%s]",
-                ossl_strerror(ERR_get_error(), error_buffer,
-                              sizeof(error_buffer)));
-          return 0;
-        }
-        X509_free(params.cert); /* we don't need the handle any more... */
-      }
-      else {
-        failf(data, "crypto engine not set, can't load certificate");
-        return 0;
-      }
-    }
-    break;
-#else
-    failf(data, "file type ENG for certificate not implemented");
-    return 0;
-#endif
+    case SSL_FILETYPE_PROVIDER:
+      if(!cert_file || !providerload(data, ctx, cert_file))
+        return CURLE_SSL_CERTPROBLEM;
+      break;
 
     case SSL_FILETYPE_PKCS12:
-    {
-      BIO *cert_bio = NULL;
-      PKCS12 *p12 = NULL;
-      EVP_PKEY *pri;
-      STACK_OF(X509) *ca = NULL;
-      if(cert_blob) {
-        cert_bio = BIO_new_mem_buf(cert_blob->data, (int)(cert_blob->len));
-        if(!cert_bio) {
-          failf(data,
-                "BIO_new_mem_buf NULL, " OSSL_PACKAGE
-                " error %s",
-                ossl_strerror(ERR_get_error(), error_buffer,
-                              sizeof(error_buffer)) );
-          return 0;
-        }
-      }
-      else {
-        cert_bio = BIO_new(BIO_s_file());
-        if(!cert_bio) {
-          failf(data,
-                "BIO_new return NULL, " OSSL_PACKAGE
-                " error %s",
-                ossl_strerror(ERR_get_error(), error_buffer,
-                              sizeof(error_buffer)) );
-          return 0;
-        }
-
-        if(BIO_read_filename(cert_bio, cert_file) <= 0) {
-          failf(data, "could not open PKCS12 file '%s'", cert_file);
-          BIO_free(cert_bio);
-          return 0;
-        }
-      }
-
-      p12 = d2i_PKCS12_bio(cert_bio, NULL);
-      BIO_free(cert_bio);
-
-      if(!p12) {
-        failf(data, "error reading PKCS12 file '%s'",
-              cert_blob ? "(memory blob)" : cert_file);
-        return 0;
-      }
-
-      PKCS12_PBE_add();
-
-      if(!PKCS12_parse(p12, key_passwd, &pri, &x509,
-                       &ca)) {
-        failf(data,
-              "could not parse PKCS12 file, check password, " OSSL_PACKAGE
-              " error %s",
-              ossl_strerror(ERR_get_error(), error_buffer,
-                            sizeof(error_buffer)) );
-        PKCS12_free(p12);
-        return 0;
-      }
-
-      PKCS12_free(p12);
-
-      if(SSL_CTX_use_certificate(ctx, x509) != 1) {
-        failf(data,
-              "could not load PKCS12 client certificate, " OSSL_PACKAGE
-              " error %s",
-              ossl_strerror(ERR_get_error(), error_buffer,
-                            sizeof(error_buffer)) );
-        goto fail;
-      }
-
-      if(SSL_CTX_use_PrivateKey(ctx, pri) != 1) {
-        failf(data, "unable to use private key from PKCS12 file '%s'",
-              cert_file);
-        goto fail;
-      }
-
-      if(!SSL_CTX_check_private_key (ctx)) {
-        failf(data, "private key from PKCS12 file '%s' "
-              "does not match certificate in same file", cert_file);
-        goto fail;
-      }
-      /* Set Certificate Verification chain */
-      if(ca) {
-        while(sk_X509_num(ca)) {
-          /*
-           * Note that sk_X509_pop() is used below to make sure the cert is
-           * removed from the stack properly before getting passed to
-           * SSL_CTX_add_extra_chain_cert(), which takes ownership. Previously
-           * we used sk_X509_value() instead, but then we'd clean it in the
-           * subsequent sk_X509_pop_free() call.
-           */
-          X509 *x = sk_X509_pop(ca);
-          if(!SSL_CTX_add_client_CA(ctx, x)) {
-            X509_free(x);
-            failf(data, "cannot add certificate to client CA list");
-            goto fail;
-          }
-          if(!SSL_CTX_add_extra_chain_cert(ctx, x)) {
-            X509_free(x);
-            failf(data, "cannot add certificate to certificate chain");
-            goto fail;
-          }
-        }
-      }
-
-      cert_done = 1;
-fail:
-      EVP_PKEY_free(pri);
-      X509_free(x509);
-      sk_X509_pop_free(ca, X509_free);
-      if(!cert_done)
-        return 0; /* failure! */
+      if(!pkcs12load(data, ctx, cert_blob, cert_file, key_passwd))
+        return CURLE_SSL_CERTPROBLEM;
+      pcks12_done = TRUE;
       break;
-    }
+
     default:
       failf(data, "not supported file type '%s' for certificate", cert_type);
-      return 0;
+      return CURLE_BAD_FUNCTION_ARGUMENT;
     }
 
-    if((!key_file) && (!key_blob)) {
+    if(!key_file && !key_blob) {
       key_file = cert_file;
       key_blob = cert_blob;
     }
     else
-      file_type = do_file_type(key_type);
+      file_type = ossl_do_file_type(key_type);
 
     switch(file_type) {
     case SSL_FILETYPE_PEM:
-      if(cert_done)
-        break;
-      /* FALLTHROUGH */
     case SSL_FILETYPE_ASN1:
       cert_use_result = key_blob ?
-        SSL_CTX_use_PrivateKey_blob(ctx, key_blob, file_type, key_passwd) :
+        use_privatekey_blob(ctx, key_blob, file_type, key_passwd) :
       SSL_CTX_use_PrivateKey_file(ctx, key_file, file_type);
       if(cert_use_result != 1) {
         failf(data, "unable to set private key file: '%s' type %s",
-              key_file?key_file:"(memory blob)", key_type?key_type:"PEM");
-        return 0;
+              key_file ? key_file : "(memory blob)",
+              key_type ? key_type : "PEM");
+        return CURLE_BAD_FUNCTION_ARGUMENT;
       }
       break;
     case SSL_FILETYPE_ENGINE:
-#ifdef USE_OPENSSL_ENGINE
-    {
-      EVP_PKEY *priv_key = NULL;
+      if(!enginecheck(data, ctx, key_file, key_passwd))
+        return CURLE_SSL_CERTPROBLEM;
+      break;
 
-      /* Implicitly use pkcs11 engine if none was provided and the
-       * key_file is a PKCS#11 URI */
-      if(!data->state.engine) {
-        if(is_pkcs11_uri(key_file)) {
-          if(ossl_set_engine(data, "pkcs11") != CURLE_OK) {
-            return 0;
-          }
-        }
-      }
+    case SSL_FILETYPE_PROVIDER:
+      if(!providercheck(data, ctx, key_file))
+        return CURLE_SSL_CERTPROBLEM;
+      break;
 
-      if(data->state.engine) {
-        UI_METHOD *ui_method =
-          UI_create_method((char *)"curl user interface");
-        if(!ui_method) {
-          failf(data, "unable do create " OSSL_PACKAGE
-                " user-interface method");
-          return 0;
-        }
-        UI_method_set_opener(ui_method, UI_method_get_opener(UI_OpenSSL()));
-        UI_method_set_closer(ui_method, UI_method_get_closer(UI_OpenSSL()));
-        UI_method_set_reader(ui_method, ssl_ui_reader);
-        UI_method_set_writer(ui_method, ssl_ui_writer);
-        /* the typecast below was added to please mingw32 */
-        priv_key = (EVP_PKEY *)
-          ENGINE_load_private_key(data->state.engine, key_file,
-                                  ui_method,
-                                  key_passwd);
-        UI_destroy_method(ui_method);
-        if(!priv_key) {
-          failf(data, "failed to load private key from crypto engine");
-          return 0;
-        }
-        if(SSL_CTX_use_PrivateKey(ctx, priv_key) != 1) {
-          failf(data, "unable to set private key");
-          EVP_PKEY_free(priv_key);
-          return 0;
-        }
-        EVP_PKEY_free(priv_key);  /* we don't need the handle any more... */
-      }
-      else {
-        failf(data, "crypto engine not set, can't load private key");
-        return 0;
-      }
-    }
-    break;
-#else
-    failf(data, "file type ENG for private key not supported");
-    return 0;
-#endif
     case SSL_FILETYPE_PKCS12:
-      if(!cert_done) {
+      if(!pcks12_done) {
         failf(data, "file type P12 for private key not supported");
-        return 0;
+        return CURLE_SSL_CERTPROBLEM;
       }
       break;
     default:
       failf(data, "not supported file type for private key");
-      return 0;
+      return CURLE_BAD_FUNCTION_ARGUMENT;
     }
 
     ssl = SSL_new(ctx);
     if(!ssl) {
       failf(data, "unable to create an SSL structure");
-      return 0;
+      return CURLE_OUT_OF_MEMORY;
     }
 
     x509 = SSL_get_certificate(ssl);
 
-    /* This version was provided by Evan Jordan and is supposed to not
-       leak memory as the previous version: */
     if(x509) {
       EVP_PKEY *pktmp = X509_get_pubkey(x509);
       EVP_PKEY_copy_parameters(pktmp, SSL_get_privatekey(ssl));
       EVP_PKEY_free(pktmp);
     }
 
-#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_IS_BORINGSSL) &&       \
-  !defined(OPENSSL_NO_DEPRECATED_3_0)
+#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
     {
-      /* If RSA is used, don't check the private key if its flags indicate
-       * it doesn't support it. */
+      /* If RSA is used, do not check the private key if its flags indicate
+       * it does not support it. */
       EVP_PKEY *priv_key = SSL_get_privatekey(ssl);
-      int pktype;
-#ifdef HAVE_OPAQUE_EVP_PKEY
-      pktype = EVP_PKEY_id(priv_key);
-#else
-      pktype = priv_key->type;
-#endif
-      if(pktype == EVP_PKEY_RSA) {
+      if(EVP_PKEY_id(priv_key) == EVP_PKEY_RSA) {
         RSA *rsa = EVP_PKEY_get1_RSA(priv_key);
         if(RSA_flags(rsa) & RSA_METHOD_FLAG_NO_CHECK)
           check_privkey = FALSE;
@@ -1636,54 +1585,36 @@ fail:
        * the SSL context */
       if(!SSL_CTX_check_private_key(ctx)) {
         failf(data, "Private key does not match the certificate public key");
-        return 0;
+        return CURLE_SSL_CERTPROBLEM;
       }
     }
   }
-  return 1;
-}
-
-CURLcode Curl_ossl_set_client_cert(struct Curl_easy *data, SSL_CTX *ctx,
-                                   char *cert_file,
-                                   const struct curl_blob *cert_blob,
-                                   const char *cert_type, char *key_file,
-                                   const struct curl_blob *key_blob,
-                                   const char *key_type, char *key_passwd)
-{
-  int rv = cert_stuff(data, ctx, cert_file, cert_blob, cert_type, key_file,
-                      key_blob, key_type, key_passwd);
-  if(rv != 1) {
-    return CURLE_SSL_CERTPROBLEM;
-  }
-
   return CURLE_OK;
 }
 
+#ifdef CURLVERBOSE
 /* returns non-zero on failure */
-static int x509_name_oneline(X509_NAME *a, char *buf, size_t size)
+static CURLcode x509_name_oneline(const X509_NAME *a, struct dynbuf *d)
 {
   BIO *bio_out = BIO_new(BIO_s_mem());
   BUF_MEM *biomem;
   int rc;
+  CURLcode result = CURLE_OUT_OF_MEMORY;
 
-  if(!bio_out)
-    return 1; /* alloc failed! */
-
-  rc = X509_NAME_print_ex(bio_out, a, 0, XN_FLAG_SEP_SPLUS_SPC);
-  BIO_get_mem_ptr(bio_out, &biomem);
-
-  if((size_t)biomem->length < size)
-    size = biomem->length;
-  else
-    size--; /* don't overwrite the buffer end */
-
-  memcpy(buf, biomem->data, size);
-  buf[size] = 0;
-
-  BIO_free(bio_out);
-
-  return !rc;
+  if(bio_out) {
+    unsigned long flags = XN_FLAG_SEP_SPLUS_SPC |
+      (XN_FLAG_ONELINE & ~ASN1_STRFLGS_ESC_MSB & ~XN_FLAG_SPC_EQ);
+    curlx_dyn_reset(d);
+    rc = X509_NAME_print_ex(bio_out, a, 0, flags);
+    if(rc != -1) {
+      BIO_get_mem_ptr(bio_out, &biomem);
+      result = curlx_dyn_addn(d, biomem->data, biomem->length);
+    }
+    BIO_free(bio_out);
+  }
+  return result;
 }
+#endif
 
 /**
  * Global SSL init
@@ -1693,8 +1624,6 @@ static int x509_name_oneline(X509_NAME *a, char *buf, size_t size)
  */
 static int ossl_init(void)
 {
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) &&  \
-  (!defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER >= 0x2070000fL)
   const uint64_t flags =
 #ifdef OPENSSL_INIT_ENGINE_ALL_BUILTIN
     /* not present in BoringSSL */
@@ -1707,36 +1636,10 @@ static int ossl_init(void)
 #endif
     0;
   OPENSSL_init_ssl(flags, NULL);
-#else
-  OPENSSL_load_builtin_modules();
-
-#ifdef USE_OPENSSL_ENGINE
-  ENGINE_load_builtin_engines();
-#endif
-
-/* CONF_MFLAGS_DEFAULT_SECTION was introduced some time between 0.9.8b and
-   0.9.8e */
-#ifndef CONF_MFLAGS_DEFAULT_SECTION
-#define CONF_MFLAGS_DEFAULT_SECTION 0x0
-#endif
-
-#ifndef CURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG
-  CONF_modules_load_file(NULL, NULL,
-                         CONF_MFLAGS_DEFAULT_SECTION|
-                         CONF_MFLAGS_IGNORE_MISSING_FILE);
-#endif
-
-  /* Let's get nice error messages */
-  SSL_load_error_strings();
-
-  /* Init the global ciphers and digests */
-  if(!SSLeay_add_ssl_algorithms())
-    return 0;
-
-  OpenSSL_add_all_algorithms();
-#endif
 
+#ifndef HAVE_KEYLOG_UPSTREAM
   Curl_tls_keylog_open();
+#endif
 
   return 1;
 }
@@ -1744,81 +1647,47 @@ static int ossl_init(void)
 /* Global cleanup */
 static void ossl_cleanup(void)
 {
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) &&  \
-  !defined(LIBRESSL_VERSION_NUMBER)
-  /* OpenSSL 1.1 deprecates all these cleanup functions and
-     turns them into no-ops in OpenSSL 1.0 compatibility mode */
-#else
-  /* Free ciphers and digests lists */
-  EVP_cleanup();
-
-#ifdef USE_OPENSSL_ENGINE
-  /* Free engine list */
-  ENGINE_cleanup();
-#endif
-
-  /* Free OpenSSL error strings */
-  ERR_free_strings();
-
-  /* Free thread local error state, destroying hash upon zero refcount */
-#ifdef HAVE_ERR_REMOVE_THREAD_STATE
-  ERR_remove_thread_state(NULL);
-#else
-  ERR_remove_state(0);
-#endif
-
-  /* Free all memory allocated by all configuration modules */
-  CONF_modules_free();
-
-#ifdef HAVE_SSL_COMP_FREE_COMPRESSION_METHODS
-  SSL_COMP_free_compression_methods();
-#endif
-#endif
-
+#ifndef HAVE_KEYLOG_UPSTREAM
   Curl_tls_keylog_close();
+#endif
 }
 
-/* Selects an OpenSSL crypto engine
+/* Selects an OpenSSL crypto engine or provider.
  */
-static CURLcode ossl_set_engine(struct Curl_easy *data, const char *engine)
+static CURLcode ossl_set_engine(struct Curl_easy *data, const char *name)
 {
 #ifdef USE_OPENSSL_ENGINE
-  ENGINE *e;
+  CURLcode result = CURLE_SSL_ENGINE_NOTFOUND;
+  ENGINE *e = ENGINE_by_id(name);
 
-#if OPENSSL_VERSION_NUMBER >= 0x00909000L
-  e = ENGINE_by_id(engine);
-#else
-  /* avoid memory leak */
-  for(e = ENGINE_get_first(); e; e = ENGINE_get_next(e)) {
-    const char *e_id = ENGINE_get_id(e);
-    if(!strcmp(engine, e_id))
-      break;
+  if(e) {
+
+    if(data->state.engine) {
+      ENGINE_finish(data->state.engine);
+      ENGINE_free(data->state.engine);
+      data->state.engine = NULL;
+    }
+    if(!ENGINE_init(e)) {
+      char buf[256];
+
+      ENGINE_free(e);
+      failf(data, "Failed to initialize SSL Engine '%s': %s",
+            name, ossl_strerror(ERR_get_error(), buf, sizeof(buf)));
+      result = CURLE_SSL_ENGINE_INITFAILED;
+      e = NULL;
+    }
+    else {
+      result = CURLE_OK;
+    }
+    data->state.engine = e;
+    return result;
   }
 #endif
-
-  if(!e) {
-    failf(data, "SSL Engine '%s' not found", engine);
-    return CURLE_SSL_ENGINE_NOTFOUND;
-  }
-
-  if(data->state.engine) {
-    ENGINE_finish(data->state.engine);
-    ENGINE_free(data->state.engine);
-    data->state.engine = NULL;
-  }
-  if(!ENGINE_init(e)) {
-    char buf[256];
-
-    ENGINE_free(e);
-    failf(data, "Failed to initialise SSL Engine '%s': %s",
-          engine, ossl_strerror(ERR_get_error(), buf, sizeof(buf)));
-    return CURLE_SSL_ENGINE_INITFAILED;
-  }
-  data->state.engine = e;
-  return CURLE_OK;
+#ifdef OPENSSL_HAS_PROVIDERS
+  return ossl_set_provider(data, name);
 #else
-  (void)engine;
-  failf(data, "SSL Engine not supported");
+  (void)name;
+  failf(data, "OpenSSL engine not found");
   return CURLE_SSL_ENGINE_NOTFOUND;
 #endif
 }
@@ -1840,7 +1709,7 @@ static CURLcode ossl_set_engine_default(struct Curl_easy *data)
     }
   }
 #else
-  (void) data;
+  (void)data;
 #endif
   return CURLE_OK;
 }
@@ -1863,162 +1732,255 @@ static struct curl_slist *ossl_engines_list(struct Curl_easy *data)
     list = beg;
   }
 #endif
-  (void) data;
+  (void)data;
   return list;
 }
 
+#ifdef OPENSSL_HAS_PROVIDERS
+
+static void ossl_provider_cleanup(struct Curl_easy *data)
+{
+  if(data->state.baseprov) {
+    OSSL_PROVIDER_unload(data->state.baseprov);
+    data->state.baseprov = NULL;
+  }
+  if(data->state.provider) {
+    OSSL_PROVIDER_unload(data->state.provider);
+    data->state.provider = NULL;
+  }
+  OSSL_LIB_CTX_free(data->state.libctx);
+  data->state.libctx = NULL;
+  curlx_safefree(data->state.propq);
+  data->state.provider_loaded = FALSE;
+}
+
+#define MAX_PROVIDER_LEN 128 /* reasonable */
+
+/* Selects an OpenSSL crypto provider.
+ *
+ * A provider might need an associated property, a string passed on to
+ * OpenSSL. Specify this as [PROVIDER][:PROPERTY]: separate the name and the
+ * property with a colon. No colon means no property is set.
+ *
+ * An example provider + property looks like "tpm2:?provider=tpm2".
+ */
+static CURLcode ossl_set_provider(struct Curl_easy *data, const char *iname)
+{
+  char name[MAX_PROVIDER_LEN + 1];
+  struct Curl_str prov;
+  const char *propq = NULL;
+
+  if(!iname) {
+    /* clear and cleanup provider use */
+    ossl_provider_cleanup(data);
+    return CURLE_OK;
+  }
+  if(curlx_str_until(&iname, &prov, MAX_PROVIDER_LEN, ':'))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  if(!curlx_str_single(&iname, ':'))
+    /* there was a colon, get the propq until the end of string */
+    propq = iname;
+
+  /* we need the name in a buffer, null-terminated */
+  memcpy(name, curlx_str(&prov), curlx_strlen(&prov));
+  name[curlx_strlen(&prov)] = 0;
+
+  if(!data->state.libctx) {
+    OSSL_LIB_CTX *libctx = OSSL_LIB_CTX_new();
+    if(!libctx)
+      return CURLE_OUT_OF_MEMORY;
+    if(propq) {
+      data->state.propq = curlx_strdup(propq);
+      if(!data->state.propq) {
+        OSSL_LIB_CTX_free(libctx);
+        return CURLE_OUT_OF_MEMORY;
+      }
+    }
+    data->state.libctx = libctx;
+  }
+
+#ifndef CURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG
+  /* load the configuration file into the library context before checking the
+   * provider availability */
+  if(!OSSL_LIB_CTX_load_config(data->state.libctx, NULL)) {
+    infof(data, "Failed to load default openssl config. Proceeding.");
+  }
+#endif
+
+  if(OSSL_PROVIDER_available(data->state.libctx, name)) {
+    /* already loaded through the configuration - no action needed */
+    data->state.provider_loaded = TRUE;
+    return CURLE_OK;
+  }
+
+  data->state.provider = OSSL_PROVIDER_try_load(data->state.libctx, name, 1);
+  if(!data->state.provider) {
+    char error_buffer[256];
+    failf(data, "Failed to initialize provider: %s",
+          ossl_strerror(ERR_get_error(), error_buffer, sizeof(error_buffer)));
+    ossl_provider_cleanup(data);
+    return CURLE_SSL_ENGINE_NOTFOUND;
+  }
+
+  /* load the base provider as well */
+  data->state.baseprov = OSSL_PROVIDER_try_load(data->state.libctx, "base", 1);
+  if(!data->state.baseprov) {
+    ossl_provider_cleanup(data);
+    failf(data, "Failed to load base");
+    return CURLE_SSL_ENGINE_NOTFOUND;
+  }
+  else
+    data->state.provider_loaded = TRUE;
+  return CURLE_OK;
+}
+#endif
+
+static CURLcode ossl_shutdown(struct Curl_cfilter *cf,
+                              struct Curl_easy *data,
+                              bool send_shutdown, bool *done)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct ossl_ctx *octx = (struct ossl_ctx *)connssl->backend;
+  CURLcode result = CURLE_OK;
+  char buf[1024];
+  int nread = -1, err;
+  size_t i;
+
+  DEBUGASSERT(octx);
+  if(!octx->ssl || cf->shutdown) {
+    *done = TRUE;
+    goto out;
+  }
+
+  connssl->io_need = CURL_SSL_IO_NEED_NONE;
+  *done = FALSE;
+  if(!(SSL_get_shutdown(octx->ssl) & SSL_SENT_SHUTDOWN)) {
+    /* We have not started the shutdown from our side yet. Check
+     * if the server already sent us one. */
+    ERR_clear_error();
+    for(i = 0; i < 10; ++i) {
+      nread = SSL_read(octx->ssl, buf, (int)sizeof(buf));
+      CURL_TRC_CF(data, cf, "SSL shutdown not sent, read -> %d", nread);
+      if(nread <= 0)
+        break;
+    }
+    err = SSL_get_error(octx->ssl, nread);
+    if(!nread && err == SSL_ERROR_ZERO_RETURN) {
+      bool input_pending;
+      /* Yes, it did. */
+      if(!send_shutdown) {
+        CURL_TRC_CF(data, cf, "SSL shutdown received, not sending");
+        *done = TRUE;
+        goto out;
+      }
+      else if(!cf->next->cft->is_alive(cf->next, data, &input_pending)) {
+        /* Server closed the connection after its closy notify. It
+         * seems not interested to see our close notify, so do not
+         * send it. We are done. */
+        connssl->peer_closed = TRUE;
+        CURL_TRC_CF(data, cf, "peer closed connection");
+        *done = TRUE;
+        goto out;
+      }
+    }
+  }
+
+  /* SSL should now have started the shutdown from our side. Since it
+   * was not complete, we are lacking the close notify from the server. */
+  if(send_shutdown && !(SSL_get_shutdown(octx->ssl) & SSL_SENT_SHUTDOWN)) {
+    int rc;
+    ERR_clear_error();
+    CURL_TRC_CF(data, cf, "send SSL close notify");
+    rc = SSL_shutdown(octx->ssl);
+    if(rc == 1) {
+      CURL_TRC_CF(data, cf, "SSL shutdown finished");
+      *done = TRUE;
+      goto out;
+    }
+    if(SSL_ERROR_WANT_WRITE == SSL_get_error(octx->ssl, rc)) {
+      CURL_TRC_CF(data, cf, "SSL shutdown still wants to send");
+      connssl->io_need = CURL_SSL_IO_NEED_SEND;
+      goto out;
+    }
+    /* Having sent the close notify, we use SSL_read() to get the
+     * missing close notify from the server. */
+  }
+
+  for(i = 0; i < 10; ++i) {
+    ERR_clear_error();
+    nread = SSL_read(octx->ssl, buf, (int)sizeof(buf));
+    CURL_TRC_CF(data, cf, "SSL shutdown read -> %d", nread);
+    if(nread <= 0)
+      break;
+  }
+  err = SSL_get_error(octx->ssl, nread);
+  switch(err) {
+  case SSL_ERROR_ZERO_RETURN: /* no more data */
+    if(SSL_shutdown(octx->ssl) == 1)
+      CURL_TRC_CF(data, cf, "SSL shutdown finished");
+    else
+      CURL_TRC_CF(data, cf, "SSL shutdown not received, but closed");
+    *done = TRUE;
+    break;
+  case SSL_ERROR_NONE: /* did not get anything */
+  case SSL_ERROR_WANT_READ:
+    /* SSL has send its notify and now wants to read the reply
+     * from the server. We are not really interested in that. */
+    CURL_TRC_CF(data, cf, "SSL shutdown sent, want receive");
+    connssl->io_need = CURL_SSL_IO_NEED_RECV;
+    break;
+  case SSL_ERROR_WANT_WRITE:
+    CURL_TRC_CF(data, cf, "SSL shutdown send blocked");
+    connssl->io_need = CURL_SSL_IO_NEED_SEND;
+    break;
+  default:
+    /* Server seems to have closed the connection without sending us
+     * a close notify. */
+    {
+      VERBOSE(unsigned long sslerr = ERR_get_error());
+      CURL_TRC_CF(data, cf, "SSL shutdown, ignore recv error: '%s', errno %d",
+                  (sslerr ?
+                   ossl_strerror(sslerr, buf, sizeof(buf)) :
+                   SSL_ERROR_to_str(err)),
+                  SOCKERRNO);
+    }
+    *done = TRUE;
+    result = CURLE_OK;
+    break;
+  }
+
+out:
+  cf->shutdown = (result || *done);
+  if(cf->shutdown || (connssl->io_need != CURL_SSL_IO_NEED_NONE))
+    connssl->input_pending = FALSE;
+  return result;
+}
+
 static void ossl_close(struct Curl_cfilter *cf, struct Curl_easy *data)
 {
   struct ssl_connect_data *connssl = cf->ctx;
-  struct ossl_ssl_backend_data *backend =
-    (struct ossl_ssl_backend_data *)connssl->backend;
+  struct ossl_ctx *octx = (struct ossl_ctx *)connssl->backend;
 
   (void)data;
-  DEBUGASSERT(backend);
+  DEBUGASSERT(octx);
 
-  if(backend->handle) {
-    if(cf->next && cf->next->connected) {
-      char buf[32];
-      /* Maybe the server has already sent a close notify alert.
-         Read it to avoid an RST on the TCP connection. */
-      (void)SSL_read(backend->handle, buf, (int)sizeof(buf));
-
-      (void)SSL_shutdown(backend->handle);
-
-      ERR_clear_error();
-
-      SSL_set_connect_state(backend->handle);
-    }
-
-    SSL_free(backend->handle);
-    backend->handle = NULL;
+  connssl->input_pending = FALSE;
+  if(octx->ssl) {
+    SSL_free(octx->ssl);
+    octx->ssl = NULL;
   }
-  if(backend->ctx) {
-    SSL_CTX_free(backend->ctx);
-    backend->ctx = NULL;
-    backend->x509_store_setup = FALSE;
+  if(octx->ssl_ctx) {
+    SSL_CTX_free(octx->ssl_ctx);
+    octx->ssl_ctx = NULL;
+    octx->x509_store_setup = FALSE;
   }
-  if(backend->bio_method) {
-    bio_cf_method_free(backend->bio_method);
-    backend->bio_method = NULL;
+  if(octx->bio_method) {
+    ossl_bio_cf_method_free(octx->bio_method);
+    octx->bio_method = NULL;
   }
 }
 
-/*
- * This function is called to shut down the SSL layer but keep the
- * socket open (CCC - Clear Command Channel)
- */
-static int ossl_shutdown(struct Curl_cfilter *cf,
-                         struct Curl_easy *data)
-{
-  int retval = 0;
-  struct ssl_connect_data *connssl = cf->ctx;
-  char buf[256]; /* We will use this for the OpenSSL error buffer, so it has
-                    to be at least 256 bytes long. */
-  unsigned long sslerror;
-  int nread;
-  int buffsize;
-  int err;
-  bool done = FALSE;
-  struct ossl_ssl_backend_data *backend =
-    (struct ossl_ssl_backend_data *)connssl->backend;
-  int loop = 10;
-
-  DEBUGASSERT(backend);
-
-#ifndef CURL_DISABLE_FTP
-  /* This has only been tested on the proftpd server, and the mod_tls code
-     sends a close notify alert without waiting for a close notify alert in
-     response. Thus we wait for a close notify alert from the server, but
-     we do not send one. Let's hope other servers do the same... */
-
-  if(data->set.ftp_ccc == CURLFTPSSL_CCC_ACTIVE)
-    (void)SSL_shutdown(backend->handle);
-#endif
-
-  if(backend->handle) {
-    buffsize = (int)sizeof(buf);
-    while(!done && loop--) {
-      int what = SOCKET_READABLE(Curl_conn_cf_get_socket(cf, data),
-                                 SSL_SHUTDOWN_TIMEOUT);
-      if(what > 0) {
-        ERR_clear_error();
-
-        /* Something to read, let's do it and hope that it is the close
-           notify alert from the server */
-        nread = SSL_read(backend->handle, buf, buffsize);
-        err = SSL_get_error(backend->handle, nread);
-
-        switch(err) {
-        case SSL_ERROR_NONE: /* this is not an error */
-        case SSL_ERROR_ZERO_RETURN: /* no more data */
-          /* This is the expected response. There was no data but only
-             the close notify alert */
-          done = TRUE;
-          break;
-        case SSL_ERROR_WANT_READ:
-          /* there's data pending, re-invoke SSL_read() */
-          infof(data, "SSL_ERROR_WANT_READ");
-          break;
-        case SSL_ERROR_WANT_WRITE:
-          /* SSL wants a write. Really odd. Let's bail out. */
-          infof(data, "SSL_ERROR_WANT_WRITE");
-          done = TRUE;
-          break;
-        default:
-          /* openssl/ssl.h says "look at error stack/return value/errno" */
-          sslerror = ERR_get_error();
-          failf(data, OSSL_PACKAGE " SSL_read on shutdown: %s, errno %d",
-                (sslerror ?
-                 ossl_strerror(sslerror, buf, sizeof(buf)) :
-                 SSL_ERROR_to_str(err)),
-                SOCKERRNO);
-          done = TRUE;
-          break;
-        }
-      }
-      else if(0 == what) {
-        /* timeout */
-        failf(data, "SSL shutdown timeout");
-        done = TRUE;
-      }
-      else {
-        /* anything that gets here is fatally bad */
-        failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
-        retval = -1;
-        done = TRUE;
-      }
-    } /* while()-loop for the select() */
-
-    if(data->set.verbose) {
-#ifdef HAVE_SSL_GET_SHUTDOWN
-      switch(SSL_get_shutdown(backend->handle)) {
-      case SSL_SENT_SHUTDOWN:
-        infof(data, "SSL_get_shutdown() returned SSL_SENT_SHUTDOWN");
-        break;
-      case SSL_RECEIVED_SHUTDOWN:
-        infof(data, "SSL_get_shutdown() returned SSL_RECEIVED_SHUTDOWN");
-        break;
-      case SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN:
-        infof(data, "SSL_get_shutdown() returned SSL_SENT_SHUTDOWN|"
-              "SSL_RECEIVED__SHUTDOWN");
-        break;
-      }
-#endif
-    }
-
-    SSL_free(backend->handle);
-    backend->handle = NULL;
-  }
-  return retval;
-}
-
-static void ossl_session_free(void *ptr)
-{
-  /* free the ID */
-  SSL_SESSION_free(ptr);
-}
-
 /*
  * This function is called when the 'data' struct is going away. Close
  * down everything and free all resources!
@@ -2034,56 +1996,13 @@ static void ossl_close_all(struct Curl_easy *data)
 #else
   (void)data;
 #endif
-#if !defined(HAVE_ERR_REMOVE_THREAD_STATE_DEPRECATED) &&        \
-  defined(HAVE_ERR_REMOVE_THREAD_STATE)
-  /* OpenSSL 1.0.1 and 1.0.2 build an error queue that is stored per-thread
-     so we need to clean it here in case the thread will be killed. All OpenSSL
-     code should extract the error in association with the error so clearing
-     this queue here should be harmless at worst. */
-  ERR_remove_thread_state(NULL);
+#ifdef OPENSSL_HAS_PROVIDERS
+  ossl_provider_cleanup(data);
 #endif
 }
 
 /* ====================================================== */
 
-/*
- * Match subjectAltName against the host name.
- */
-static bool subj_alt_hostcheck(struct Curl_easy *data,
-                               const char *match_pattern,
-                               size_t matchlen,
-                               const char *hostname,
-                               size_t hostlen,
-                               const char *dispname)
-{
-#ifdef CURL_DISABLE_VERBOSE_STRINGS
-  (void)dispname;
-  (void)data;
-#endif
-  if(Curl_cert_hostcheck(match_pattern, matchlen, hostname, hostlen)) {
-    infof(data, " subjectAltName: host \"%s\" matched cert's \"%s\"",
-          dispname, match_pattern);
-    return TRUE;
-  }
-  return FALSE;
-}
-
-static CURLcode
-ossl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
-                X509 *server_cert, const char *hostname,
-                const char *dispname);
-
-CURLcode Curl_ossl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
-                              X509 *server_cert)
-{
-  const char *hostname, *dispname;
-  int port;
-
-  (void)conn;
-  Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &dispname, &port);
-  return ossl_verifyhost(data, conn, server_cert, hostname, dispname);
-}
-
 /* Quote from RFC2818 section 3.1 "Server Identity"
 
    If a subjectAltName extension of type dNSName is present, that MUST
@@ -2093,7 +2012,7 @@ CURLcode Curl_ossl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
    Certification Authorities are encouraged to use the dNSName instead.
 
    Matching is performed using the matching rules specified by
-   [RFC2459].  If more than one identity of a given type is present in
+   [RFC2459]. If more than one identity of a given type is present in
    the certificate (e.g., more than one dNSName name, a match in any one
    of the set is considered acceptable.) Names may contain the wildcard
    character * which is considered to match any single domain name
@@ -2106,66 +2025,68 @@ CURLcode Curl_ossl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
 
    This function is now used from ngtcp2 (QUIC) as well.
 */
-static CURLcode
-ossl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
-                X509 *server_cert, const char *hostname,
-                const char *dispname)
+static CURLcode ossl_verifyhost(struct Curl_easy *data,
+                                struct connectdata *conn,
+                                struct ssl_peer *peer,
+                                X509 *server_cert)
 {
   bool matched = FALSE;
-  int target = GEN_DNS; /* target type, GEN_DNS or GEN_IPADD */
+  int target; /* target type, GEN_DNS or GEN_IPADD */
   size_t addrlen = 0;
   STACK_OF(GENERAL_NAME) *altnames;
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
   struct in6_addr addr;
 #else
   struct in_addr addr;
 #endif
   CURLcode result = CURLE_OK;
   bool dNSName = FALSE; /* if a dNSName field exists in the cert */
-  bool iPAddress = FALSE; /* if a iPAddress field exists in the cert */
-  size_t hostlen;
+  bool iPAddress = FALSE; /* if an iPAddress field exists in the cert */
+  size_t hostlen = strlen(peer->origin->hostname);
 
   (void)conn;
-  hostlen = strlen(hostname);
-
-#ifndef ENABLE_IPV6
-  /* Silence compiler warnings for unused params */
-  (void) conn;
-#endif
-
-#ifdef ENABLE_IPV6
-  if(conn->bits.ipv6_ip &&
-     Curl_inet_pton(AF_INET6, hostname, &addr)) {
+  switch(peer->type) {
+  case CURL_SSL_PEER_IPV4:
+    if(!curlx_inet_pton(AF_INET, peer->origin->hostname, &addr))
+      return CURLE_PEER_FAILED_VERIFICATION;
+    target = GEN_IPADD;
+    addrlen = sizeof(struct in_addr);
+    break;
+#ifdef USE_IPV6
+  case CURL_SSL_PEER_IPV6:
+    if(!curlx_inet_pton(AF_INET6, peer->origin->hostname, &addr))
+      return CURLE_PEER_FAILED_VERIFICATION;
     target = GEN_IPADD;
     addrlen = sizeof(struct in6_addr);
-  }
-  else
+    break;
 #endif
-    if(Curl_inet_pton(AF_INET, hostname, &addr)) {
-      target = GEN_IPADD;
-      addrlen = sizeof(struct in_addr);
-    }
+  case CURL_SSL_PEER_DNS:
+    target = GEN_DNS;
+    break;
+  default:
+    DEBUGASSERT(0);
+    failf(data, "unexpected SSL peer type: %d", (int)peer->type);
+    return CURLE_PEER_FAILED_VERIFICATION;
+  }
 
   /* get a "list" of alternative names */
   altnames = X509_get_ext_d2i(server_cert, NID_subject_alt_name, NULL, NULL);
 
   if(altnames) {
-#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
+#ifdef HAVE_BORINGSSL_LIKE
     size_t numalts;
     size_t i;
 #else
     int numalts;
     int i;
 #endif
-    bool dnsmatched = FALSE;
-    bool ipmatched = FALSE;
 
     /* get amount of alternatives, RFC2459 claims there MUST be at least
-       one, but we don't depend on it... */
+       one, but we do not depend on it... */
     numalts = sk_GENERAL_NAME_num(altnames);
 
     /* loop through all alternatives - until a dnsmatch */
-    for(i = 0; (i < numalts) && !dnsmatched; i++) {
+    for(i = 0; (i < numalts) && !matched; i++) {
       /* get a handle to alternative name number i */
       const GENERAL_NAME *check = sk_GENERAL_NAME_value(altnames, i);
 
@@ -2177,27 +2098,28 @@ ossl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
       /* only check alternatives of the same type the target is */
       if(check->type == target) {
         /* get data and length */
-        const char *altptr = (char *)ASN1_STRING_get0_data(check->d.ia5);
-        size_t altlen = (size_t) ASN1_STRING_length(check->d.ia5);
+        const char *altptr = (const char *)ASN1_STRING_get0_data(check->d.ia5);
+        size_t altlen = (size_t)ASN1_STRING_length(check->d.ia5);
 
         switch(target) {
         case GEN_DNS: /* name/pattern comparison */
           /* The OpenSSL man page explicitly says: "In general it cannot be
              assumed that the data returned by ASN1_STRING_data() is null
-             terminated or does not contain embedded nulls." But also that
-             "The actual format of the data will depend on the actual string
-             type itself: for example for an IA5String the data will be ASCII"
+             terminated or does not contain embedded nulls.", but also that
+             "The actual format of the data depends on the actual string
+             type itself: for example for an IA5String the data is ASCII"
 
              It has been however verified that in 0.9.6 and 0.9.7, IA5String
              is always null-terminated.
           */
           if((altlen == strlen(altptr)) &&
-             /* if this isn't true, there was an embedded zero in the name
+             /* if this is not true, there was an embedded zero in the name
                 string and we cannot match it. */
-             subj_alt_hostcheck(data,
-                                altptr,
-                                altlen, hostname, hostlen, dispname)) {
-            dnsmatched = TRUE;
+             Curl_cert_hostcheck(altptr, altlen,
+                                 peer->origin->hostname, hostlen)) {
+            matched = TRUE;
+            infof(data, "  subjectAltName: \"%s\" matches cert's \"%.*s\"",
+                  peer->origin->user_hostname, (int)altlen, altptr);
           }
           break;
 
@@ -2205,51 +2127,52 @@ ossl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
           /* compare alternative IP address if the data chunk is the same size
              our server IP address is */
           if((altlen == addrlen) && !memcmp(altptr, &addr, altlen)) {
-            ipmatched = TRUE;
-            infof(data,
-                  " subjectAltName: host \"%s\" matched cert's IP address!",
-                  dispname);
+            matched = TRUE;
+            infof(data, "  subjectAltName: \"%s\" matches cert's IP address!",
+                  peer->origin->user_hostname);
           }
           break;
         }
       }
     }
     GENERAL_NAMES_free(altnames);
-
-    if(dnsmatched || ipmatched)
-      matched = TRUE;
   }
 
   if(matched)
     /* an alternative name matched */
     ;
   else if(dNSName || iPAddress) {
-    infof(data, " subjectAltName does not match %s", dispname);
+    const char *tname = (peer->type == CURL_SSL_PEER_DNS) ? "hostname" :
+                        (peer->type == CURL_SSL_PEER_IPV4) ?
+                        "ipv4 address" : "ipv6 address";
+    infof(data, " subjectAltName does not match %s %s", tname,
+          peer->origin->user_hostname);
     failf(data, "SSL: no alternative certificate subject name matches "
-          "target host name '%s'", dispname);
+          "target %s '%s'", tname, peer->origin->user_hostname);
     result = CURLE_PEER_FAILED_VERIFICATION;
   }
   else {
     /* we have to look to the last occurrence of a commonName in the
        distinguished one to get the most significant one. */
     int i = -1;
-    unsigned char *peer_CN = NULL;
-    int peerlen = 0;
+    unsigned char *cn = NULL;
+    int cnlen = 0;
+    bool free_cn = FALSE;
 
     /* The following is done because of a bug in 0.9.6b */
-    X509_NAME *name = X509_get_subject_name(server_cert);
+    const X509_NAME *name = X509_get_subject_name(server_cert);
     if(name) {
       int j;
       while((j = X509_NAME_get_index_by_NID(name, NID_commonName, i)) >= 0)
         i = j;
     }
 
-    /* we have the name entry and we will now convert this to a string
+    /* we have the name entry and we now convert this to a string
        that we can use for comparison. Doing this we support BMPstring,
        UTF8, etc. */
 
     if(i >= 0) {
-      ASN1_STRING *tmp =
+      const ASN1_STRING *tmp =
         X509_NAME_ENTRY_get_data(X509_NAME_get_entry(name, i));
 
       /* In OpenSSL 0.9.7d and earlier, ASN1_STRING_to_UTF8 fails if the input
@@ -2258,22 +2181,18 @@ ossl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
          conditional in the future when OpenSSL has been fixed. */
       if(tmp) {
         if(ASN1_STRING_type(tmp) == V_ASN1_UTF8STRING) {
-          peerlen = ASN1_STRING_length(tmp);
-          if(peerlen >= 0) {
-            peer_CN = OPENSSL_malloc(peerlen + 1);
-            if(peer_CN) {
-              memcpy(peer_CN, ASN1_STRING_get0_data(tmp), peerlen);
-              peer_CN[peerlen] = '\0';
-            }
-            else
-              result = CURLE_OUT_OF_MEMORY;
-          }
+          cnlen = ASN1_STRING_length(tmp);
+          cn = (unsigned char *)CURL_UNCONST(ASN1_STRING_get0_data(tmp));
+        }
+        else { /* not a UTF8 name */
+          cnlen = ASN1_STRING_to_UTF8(&cn, tmp);
+          free_cn = TRUE;
         }
-        else /* not a UTF8 name */
-          peerlen = ASN1_STRING_to_UTF8(&peer_CN, tmp);
 
-        if(peer_CN && (curlx_uztosi(strlen((char *)peer_CN)) != peerlen)) {
-          /* there was a terminating zero before the end of string, this
+        if((cnlen <= 0) || !cn)
+          result = CURLE_OUT_OF_MEMORY;
+        else if((size_t)cnlen != strlen((char *)cn)) {
+          /* there was a null-terminator before the end of string, this
              cannot match and we return failure! */
           failf(data, "SSL: illegal cert name field");
           result = CURLE_PEER_FAILED_VERIFICATION;
@@ -2284,35 +2203,33 @@ ossl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
     if(result)
       /* error already detected, pass through */
       ;
-    else if(!peer_CN) {
-      failf(data,
-            "SSL: unable to obtain common name from peer certificate");
+    else if(!cn) {
+      failf(data, "SSL: unable to obtain common name from peer certificate");
       result = CURLE_PEER_FAILED_VERIFICATION;
     }
-    else if(!Curl_cert_hostcheck((const char *)peer_CN,
-                                 peerlen, hostname, hostlen)) {
+    else if(!Curl_cert_hostcheck((const char *)cn, cnlen,
+                                 peer->origin->hostname, hostlen)) {
       failf(data, "SSL: certificate subject name '%s' does not match "
-            "target host name '%s'", peer_CN, dispname);
+            "target hostname '%s'", cn, peer->origin->user_hostname);
       result = CURLE_PEER_FAILED_VERIFICATION;
     }
     else {
-      infof(data, " common name: %s (matched)", peer_CN);
+      infof(data, " common name: %s (matched)", cn);
     }
-    if(peer_CN)
-      OPENSSL_free(peer_CN);
+    if(free_cn)
+      OPENSSL_free(cn);
   }
 
   return result;
 }
 
-#if (OPENSSL_VERSION_NUMBER >= 0x0090808fL) && !defined(OPENSSL_NO_TLSEXT) && \
-  !defined(OPENSSL_NO_OCSP)
+#ifndef OPENSSL_NO_OCSP
 static CURLcode verifystatus(struct Curl_cfilter *cf,
-                             struct Curl_easy *data)
+                             struct Curl_easy *data,
+                             struct ossl_ctx *octx)
 {
-  struct ssl_connect_data *connssl = cf->ctx;
   int i, ocsp_status;
-#if defined(OPENSSL_IS_AWSLC)
+#ifdef HAVE_BORINGSSL_LIKE
   const uint8_t *status;
 #else
   unsigned char *status;
@@ -2323,8 +2240,6 @@ static CURLcode verifystatus(struct Curl_cfilter *cf,
   OCSP_BASICRESP *br = NULL;
   X509_STORE     *st = NULL;
   STACK_OF(X509) *ch = NULL;
-  struct ossl_ssl_backend_data *backend =
-    (struct ossl_ssl_backend_data *)connssl->backend;
   X509 *cert;
   OCSP_CERTID *id = NULL;
   int cert_status, crl_reason;
@@ -2332,9 +2247,10 @@ static CURLcode verifystatus(struct Curl_cfilter *cf,
   int ret;
   long len;
 
-  DEBUGASSERT(backend);
+  (void)cf;
+  DEBUGASSERT(octx);
 
-  len = SSL_get_tlsext_status_ocsp_resp(backend->handle, &status);
+  len = (long)SSL_get_tlsext_status_ocsp_resp(octx->ssl, &status);
 
   if(!status) {
     failf(data, "No OCSP response received");
@@ -2364,41 +2280,13 @@ static CURLcode verifystatus(struct Curl_cfilter *cf,
     goto end;
   }
 
-  ch = SSL_get_peer_cert_chain(backend->handle);
+  ch = SSL_get_peer_cert_chain(octx->ssl);
   if(!ch) {
     failf(data, "Could not get peer certificate chain");
     result = CURLE_SSL_INVALIDCERTSTATUS;
     goto end;
   }
-  st = SSL_CTX_get_cert_store(backend->ctx);
-
-#if ((OPENSSL_VERSION_NUMBER <= 0x1000201fL) /* Fixed after 1.0.2a */ || \
-     (defined(LIBRESSL_VERSION_NUMBER) &&                               \
-      LIBRESSL_VERSION_NUMBER <= 0x2040200fL))
-  /* The authorized responder cert in the OCSP response MUST be signed by the
-     peer cert's issuer (see RFC6960 section 4.2.2.2). If that's a root cert,
-     no problem, but if it's an intermediate cert OpenSSL has a bug where it
-     expects this issuer to be present in the chain embedded in the OCSP
-     response. So we add it if necessary. */
-
-  /* First make sure the peer cert chain includes both a peer and an issuer,
-     and the OCSP response contains a responder cert. */
-  if(sk_X509_num(ch) >= 2 && sk_X509_num(br->certs) >= 1) {
-    X509 *responder = sk_X509_value(br->certs, sk_X509_num(br->certs) - 1);
-
-    /* Find issuer of responder cert and add it to the OCSP response chain */
-    for(i = 0; i < sk_X509_num(ch); i++) {
-      X509 *issuer = sk_X509_value(ch, i);
-      if(X509_check_issued(issuer, responder) == X509_V_OK) {
-        if(!OCSP_basic_add1_cert(br, issuer)) {
-          failf(data, "Could not add issuer cert to OCSP response");
-          result = CURLE_SSL_INVALIDCERTSTATUS;
-          goto end;
-        }
-      }
-    }
-  }
-#endif
+  st = SSL_CTX_get_cert_store(octx->ssl_ctx);
 
   if(OCSP_basic_verify(br, ch, st, 0) <= 0) {
     failf(data, "OCSP response verification failed");
@@ -2407,7 +2295,7 @@ static CURLcode verifystatus(struct Curl_cfilter *cf,
   }
 
   /* Compute the certificate's ID */
-  cert = SSL_get1_peer_certificate(backend->handle);
+  cert = SSL_get1_peer_certificate(octx->ssl);
   if(!cert) {
     failf(data, "Error getting peer certificate");
     result = CURLE_SSL_INVALIDCERTSTATUS;
@@ -2415,8 +2303,11 @@ static CURLcode verifystatus(struct Curl_cfilter *cf,
   }
 
   for(i = 0; i < (int)sk_X509_num(ch); i++) {
-    X509 *issuer = sk_X509_value(ch, i);
+    X509 *issuer = sk_X509_value(ch, (ossl_valsize_t)i);
     if(X509_check_issued(issuer, cert) == X509_V_OK) {
+      /* Note to analysis tools: using SHA1 here is fine. The `id`
+       * generated is used as a hash lookup key, not as a verifier
+       * of the OCSP data itself. This all according to RFC 5019. */
       id = OCSP_cert_to_id(EVP_sha1(), cert, issuer);
       break;
     }
@@ -2439,7 +2330,14 @@ static CURLcode verifystatus(struct Curl_cfilter *cf,
     goto end;
   }
 
-  /* Validate the corresponding single OCSP response */
+  /* Validate the OCSP response issuing and update times.
+   * - `thisupd` is the time the OCSP response was issued
+   * - `nextupd` is the time the OCSP response should be updated
+   *    (valid life time assigned by the OCSP responder)
+   * - 3rd param: how many seconds of clock skew we allow between
+   *   our clock and the instance that issued the OCSP response
+   * - 4th param: how many seconds in the past `thisupd` may be, with
+   *   -1 meaning there is no limit. */
   if(!OCSP_check_validity(thisupd, nextupd, 300L, -1L)) {
     failf(data, "OCSP response has expired");
     result = CURLE_SSL_INVALIDCERTSTATUS;
@@ -2474,39 +2372,8 @@ end:
 }
 #endif
 
-#endif /* USE_OPENSSL */
-
-/* The SSL_CTRL_SET_MSG_CALLBACK doesn't exist in ancient OpenSSL versions
-   and thus this cannot be done there. */
-#ifdef SSL_CTRL_SET_MSG_CALLBACK
-
 static const char *ssl_msg_type(int ssl_ver, int msg)
 {
-#ifdef SSL2_VERSION_MAJOR
-  if(ssl_ver == SSL2_VERSION_MAJOR) {
-    switch(msg) {
-    case SSL2_MT_ERROR:
-      return "Error";
-    case SSL2_MT_CLIENT_HELLO:
-      return "Client hello";
-    case SSL2_MT_CLIENT_MASTER_KEY:
-      return "Client key";
-    case SSL2_MT_CLIENT_FINISHED:
-      return "Client finished";
-    case SSL2_MT_SERVER_HELLO:
-      return "Server hello";
-    case SSL2_MT_SERVER_VERIFY:
-      return "Server verify";
-    case SSL2_MT_SERVER_FINISHED:
-      return "Server finished";
-    case SSL2_MT_REQUEST_CERTIFICATE:
-      return "Request CERT";
-    case SSL2_MT_CLIENT_CERTIFICATE:
-      return "Client CERT";
-    }
-  }
-  else
-#endif
   if(ssl_ver == SSL3_VERSION_MAJOR) {
     switch(msg) {
     case SSL3_MT_HELLO_REQUEST:
@@ -2593,7 +2460,7 @@ static void ossl_trace(int direction, int ssl_ver, int content_type,
                        const void *buf, size_t len, SSL *ssl,
                        void *userp)
 {
-  const char *verstr = "???";
+  const char *verstr;
   struct Curl_cfilter *cf = userp;
   struct Curl_easy *data = NULL;
   char unknown[32];
@@ -2605,11 +2472,6 @@ static void ossl_trace(int direction, int ssl_ver, int content_type,
     return;
 
   switch(ssl_ver) {
-#ifdef SSL2_VERSION /* removed in recent versions */
-  case SSL2_VERSION:
-    verstr = "SSLv2";
-    break;
-#endif
 #ifdef SSL3_VERSION
   case SSL3_VERSION:
     verstr = "SSLv3";
@@ -2628,15 +2490,11 @@ static void ossl_trace(int direction, int ssl_ver, int content_type,
     verstr = "TLSv1.2";
     break;
 #endif
-#ifdef TLS1_3_VERSION
   case TLS1_3_VERSION:
     verstr = "TLSv1.3";
     break;
-#endif
-  case 0:
-    break;
   default:
-    msnprintf(unknown, sizeof(unknown), "(%x)", ssl_ver);
+    curl_msnprintf(unknown, sizeof(unknown), "(%x)", (unsigned int)ssl_ver);
     verstr = unknown;
     break;
   }
@@ -2653,16 +2511,18 @@ static void ossl_trace(int direction, int ssl_ver, int content_type,
      && content_type != SSL3_RT_INNER_CONTENT_TYPE
 #endif
     ) {
-    const char *msg_name, *tls_rt_name;
+    const char *msg_name = "Truncated message";
+    const char *tls_rt_name;
     char ssl_buf[1024];
-    int msg_type, txt_len;
+    int msg_type = 0;
+    int txt_len;
 
     /* the info given when the version is zero is not that useful for us */
 
     ssl_ver >>= 8; /* check the upper 8 bits only below */
 
-    /* SSLv2 doesn't seem to have TLS record-type headers, so OpenSSL
-     * always pass-up content-type as 0. But the interesting message-type
+    /* SSLv2 does not seem to have TLS record-type headers, so OpenSSL
+     * always pass-up content-type as 0, but the interesting message-type
      * is at 'buf[0]'.
      */
     if(ssl_ver == SSL3_VERSION_MAJOR && content_type)
@@ -2671,68 +2531,55 @@ static void ossl_trace(int direction, int ssl_ver, int content_type,
       tls_rt_name = "";
 
     if(content_type == SSL3_RT_CHANGE_CIPHER_SPEC) {
-      msg_type = *(char *)buf;
-      msg_name = "Change cipher spec";
+      if(len) {
+        msg_type = *(const unsigned char *)buf;
+        msg_name = "Change cipher spec";
+      }
     }
     else if(content_type == SSL3_RT_ALERT) {
-      msg_type = (((char *)buf)[0] << 8) + ((char *)buf)[1];
-      msg_name = SSL_alert_desc_string_long(msg_type);
+      if(len >= 2) {
+        msg_type =
+          (((const unsigned char *)buf)[0] << 8) +
+           ((const unsigned char *)buf)[1];
+        msg_name = SSL_alert_desc_string_long(msg_type);
+      }
     }
-    else {
-      msg_type = *(char *)buf;
+    else if(len) {
+      msg_type = *(const unsigned char *)buf;
       msg_name = ssl_msg_type(ssl_ver, msg_type);
     }
 
-    txt_len = msnprintf(ssl_buf, sizeof(ssl_buf),
-                        "%s (%s), %s, %s (%d):\n",
-                        verstr, direction?"OUT":"IN",
-                        tls_rt_name, msg_name, msg_type);
-    if(0 <= txt_len && (unsigned)txt_len < sizeof(ssl_buf)) {
-      Curl_debug(data, CURLINFO_TEXT, ssl_buf, (size_t)txt_len);
-    }
+    txt_len = curl_msnprintf(ssl_buf, sizeof(ssl_buf),
+                             "%s (%s), %s, %s (%d):\n",
+                             verstr, direction ? "OUT" : "IN",
+                             tls_rt_name, msg_name, msg_type);
+    Curl_debug(data, CURLINFO_TEXT, ssl_buf, (size_t)txt_len);
   }
 
   Curl_debug(data, (direction == 1) ? CURLINFO_SSL_DATA_OUT :
-             CURLINFO_SSL_DATA_IN, (char *)buf, len);
-  (void) ssl;
+             CURLINFO_SSL_DATA_IN, (const char *)buf, len);
+  (void)ssl;
 }
-#endif
 
-#ifdef USE_OPENSSL
-/* ====================================================== */
-
-#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
-#  define use_sni(x)  sni = (x)
-#else
-#  define use_sni(x)  Curl_nop_stmt
-#endif
-
-/* Check for OpenSSL 1.0.2 which has ALPN support. */
-#undef HAS_ALPN
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L       \
-  && !defined(OPENSSL_NO_TLSEXT)
-#  define HAS_ALPN 1
-#endif
-
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) /* 1.1.0 */
-static CURLcode
-ossl_set_ssl_version_min_max(struct Curl_cfilter *cf, SSL_CTX *ctx)
+static CURLcode ossl_set_ssl_version_min_max(struct Curl_cfilter *cf,
+                                             SSL_CTX *ctx,
+                                             unsigned int ssl_version_min)
 {
   struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
   /* first, TLS min version... */
-  long curl_ssl_version_min = conn_config->version;
+  long curl_ssl_version_min = (long)ssl_version_min;
   long curl_ssl_version_max;
 
   /* convert curl min SSL version option to OpenSSL constant */
-#if (defined(OPENSSL_IS_BORINGSSL)  || \
-     defined(OPENSSL_IS_AWSLC)      || \
-     defined(LIBRESSL_VERSION_NUMBER))
+#if defined(HAVE_BORINGSSL_LIKE) || defined(LIBRESSL_VERSION_NUMBER)
   uint16_t ossl_ssl_version_min = 0;
   uint16_t ossl_ssl_version_max = 0;
 #else
   long ossl_ssl_version_min = 0;
   long ossl_ssl_version_max = 0;
 #endif
+  /* it cannot be default here */
+  DEBUGASSERT(curl_ssl_version_min != CURL_SSLVERSION_DEFAULT);
   switch(curl_ssl_version_min) {
   case CURL_SSLVERSION_TLSv1: /* TLS 1.x */
   case CURL_SSLVERSION_TLSv1_0:
@@ -2745,28 +2592,12 @@ ossl_set_ssl_version_min_max(struct Curl_cfilter *cf, SSL_CTX *ctx)
     ossl_ssl_version_min = TLS1_2_VERSION;
     break;
   case CURL_SSLVERSION_TLSv1_3:
-#ifdef TLS1_3_VERSION
     ossl_ssl_version_min = TLS1_3_VERSION;
     break;
-#else
-    return CURLE_NOT_BUILT_IN;
-#endif
-  }
-
-  /* CURL_SSLVERSION_DEFAULT means that no option was selected.
-     We don't want to pass 0 to SSL_CTX_set_min_proto_version as
-     it would enable all versions down to the lowest supported by
-     the library.
-     So we skip this, and stay with the library default
-  */
-  if(curl_ssl_version_min != CURL_SSLVERSION_DEFAULT) {
-    if(!SSL_CTX_set_min_proto_version(ctx, ossl_ssl_version_min)) {
-      return CURLE_SSL_CONNECT_ERROR;
-    }
   }
 
   /* ... then, TLS max version */
-  curl_ssl_version_max = conn_config->version_max;
+  curl_ssl_version_max = (long)conn_config->version_max;
 
   /* convert curl max SSL version option to OpenSSL constant */
   switch(curl_ssl_version_max) {
@@ -2779,171 +2610,118 @@ ossl_set_ssl_version_min_max(struct Curl_cfilter *cf, SSL_CTX *ctx)
   case CURL_SSLVERSION_MAX_TLSv1_2:
     ossl_ssl_version_max = TLS1_2_VERSION;
     break;
-#ifdef TLS1_3_VERSION
   case CURL_SSLVERSION_MAX_TLSv1_3:
     ossl_ssl_version_max = TLS1_3_VERSION;
     break;
-#endif
   case CURL_SSLVERSION_MAX_NONE:  /* none selected */
   case CURL_SSLVERSION_MAX_DEFAULT:  /* max selected */
   default:
-    /* SSL_CTX_set_max_proto_version states that:
-       setting the maximum to 0 will enable
-       protocol versions up to the highest version
-       supported by the library */
+    /* SSL_CTX_set_max_proto_version states that: setting the maximum to 0
+       enables protocol versions up to the highest version supported by
+       the library */
     ossl_ssl_version_max = 0;
     break;
   }
 
-  if(!SSL_CTX_set_max_proto_version(ctx, ossl_ssl_version_max)) {
+  if(!SSL_CTX_set_min_proto_version(ctx, ossl_ssl_version_min) ||
+     !SSL_CTX_set_max_proto_version(ctx, ossl_ssl_version_max))
     return CURLE_SSL_CONNECT_ERROR;
-  }
 
   return CURLE_OK;
 }
-#endif
 
-#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
+#ifdef HAVE_BORINGSSL_LIKE
 typedef uint32_t ctx_option_t;
-#elif OPENSSL_VERSION_NUMBER >= 0x30000000L
+#elif defined(HAVE_OPENSSL3)
 typedef uint64_t ctx_option_t;
-#else
+#elif defined(LIBRESSL_VERSION_NUMBER)
 typedef long ctx_option_t;
+#else
+typedef unsigned long ctx_option_t;
 #endif
 
-#if (OPENSSL_VERSION_NUMBER < 0x10100000L) /* 1.1.0 */
-static CURLcode
-ossl_set_ssl_version_min_max_legacy(ctx_option_t *ctx_options,
-                                       struct Curl_cfilter *cf,
-                                       struct Curl_easy *data)
+CURLcode Curl_ossl_add_session(struct Curl_cfilter *cf,
+                               struct Curl_easy *data,
+                               const char *ssl_peer_key,
+                               SSL_SESSION *session,
+                               int ietf_tls_id,
+                               const char *alpn,
+                               unsigned char *quic_tp,
+                               size_t quic_tp_len)
 {
-  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
-  long ssl_version = conn_config->version;
-  long ssl_version_max = conn_config->version_max;
+  unsigned char *der_session_buf = NULL;
+  unsigned char *qtp_clone = NULL;
+  CURLcode result = CURLE_OK;
 
-  (void) data; /* In case it's unused. */
+  if(!cf || !data)
+    goto out;
 
-  switch(ssl_version) {
-  case CURL_SSLVERSION_TLSv1_3:
-#ifdef TLS1_3_VERSION
-  {
-    struct ssl_connect_data *connssl = cf->ctx;
-    struct ossl_ssl_backend_data *backend =
-      (struct ossl_ssl_backend_data *)connssl->backend;
-    DEBUGASSERT(backend);
-    SSL_CTX_set_max_proto_version(backend->ctx, TLS1_3_VERSION);
-    *ctx_options |= SSL_OP_NO_TLSv1_2;
-  }
-#else
-  (void)ctx_options;
-  failf(data, OSSL_PACKAGE " was built without TLS 1.3 support");
-  return CURLE_NOT_BUILT_IN;
+  if(Curl_ssl_scache_use(cf, data)) {
+    struct Curl_ssl_session *sc_session = NULL;
+    size_t der_session_size;
+    unsigned char *der_session_ptr;
+    size_t earlydata_max = 0;
+
+    der_session_size = i2d_SSL_SESSION(session, NULL);
+    if(der_session_size == 0) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+
+    der_session_buf = der_session_ptr = curlx_malloc(der_session_size);
+    if(!der_session_buf) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+
+    der_session_size = i2d_SSL_SESSION(session, &der_session_ptr);
+    if(der_session_size == 0) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+
+#ifdef HAVE_OPENSSL_EARLYDATA
+    earlydata_max = SSL_SESSION_get_max_early_data(session);
 #endif
-  /* FALLTHROUGH */
-  case CURL_SSLVERSION_TLSv1_2:
-#if OPENSSL_VERSION_NUMBER >= 0x1000100FL
-    *ctx_options |= SSL_OP_NO_TLSv1_1;
-#else
-    failf(data, OSSL_PACKAGE " was built without TLS 1.2 support");
-    return CURLE_NOT_BUILT_IN;
-#endif
-    /* FALLTHROUGH */
-  case CURL_SSLVERSION_TLSv1_1:
-#if OPENSSL_VERSION_NUMBER >= 0x1000100FL
-    *ctx_options |= SSL_OP_NO_TLSv1;
-#else
-    failf(data, OSSL_PACKAGE " was built without TLS 1.1 support");
-    return CURLE_NOT_BUILT_IN;
-#endif
-    /* FALLTHROUGH */
-  case CURL_SSLVERSION_TLSv1_0:
-  case CURL_SSLVERSION_TLSv1:
-    break;
+    if(quic_tp && quic_tp_len) {
+      qtp_clone = curlx_memdup0((const char *)quic_tp, quic_tp_len);
+      if(!qtp_clone) {
+        result = CURLE_OUT_OF_MEMORY;
+        goto out;
+      }
+    }
+
+    result = Curl_ssl_session_create2(der_session_buf, der_session_size,
+                                      ietf_tls_id, alpn,
+                                      (curl_off_t)time(NULL) +
+                                        SSL_SESSION_get_timeout(session),
+                                      earlydata_max, qtp_clone, quic_tp_len,
+                                      &sc_session);
+    der_session_buf = NULL;  /* took ownership of sdata */
+    if(!result) {
+      result = Curl_ssl_scache_put(cf, data, ssl_peer_key, sc_session);
+      /* took ownership of `sc_session` */
+    }
   }
 
-  switch(ssl_version_max) {
-  case CURL_SSLVERSION_MAX_TLSv1_0:
-#if OPENSSL_VERSION_NUMBER >= 0x1000100FL
-    *ctx_options |= SSL_OP_NO_TLSv1_1;
-#endif
-    /* FALLTHROUGH */
-  case CURL_SSLVERSION_MAX_TLSv1_1:
-#if OPENSSL_VERSION_NUMBER >= 0x1000100FL
-    *ctx_options |= SSL_OP_NO_TLSv1_2;
-#endif
-    /* FALLTHROUGH */
-  case CURL_SSLVERSION_MAX_TLSv1_2:
-#ifdef TLS1_3_VERSION
-    *ctx_options |= SSL_OP_NO_TLSv1_3;
-#endif
-    break;
-  case CURL_SSLVERSION_MAX_TLSv1_3:
-#ifdef TLS1_3_VERSION
-    break;
-#else
-    failf(data, OSSL_PACKAGE " was built without TLS 1.3 support");
-    return CURLE_NOT_BUILT_IN;
-#endif
-  }
-  return CURLE_OK;
+out:
+  curlx_free(der_session_buf);
+  return result;
 }
-#endif
 
 /* The "new session" callback must return zero if the session can be removed
  * or non-zero if the session has been put into the session cache.
  */
 static int ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid)
 {
-  int res = 0;
-  struct Curl_easy *data;
-  struct Curl_cfilter *cf;
-  const struct ssl_config_data *config;
-  struct ssl_connect_data *connssl;
-  bool isproxy;
-
-  cf = (struct Curl_cfilter*) SSL_get_app_data(ssl);
-  connssl = cf? cf->ctx : NULL;
-  data = connssl? CF_DATA_CURRENT(cf) : NULL;
-  /* The sockindex has been stored as a pointer to an array element */
-  if(!cf || !data)
-    return 0;
-
-  isproxy = Curl_ssl_cf_is_proxy(cf);
-
-  config = Curl_ssl_cf_get_config(cf, data);
-  if(config->primary.sessionid) {
-    bool incache;
-    bool added = FALSE;
-    void *old_ssl_sessionid = NULL;
-
-    Curl_ssl_sessionid_lock(data);
-    if(isproxy)
-      incache = FALSE;
-    else
-      incache = !(Curl_ssl_getsessionid(cf, data, &old_ssl_sessionid, NULL));
-    if(incache) {
-      if(old_ssl_sessionid != ssl_sessionid) {
-        infof(data, "old SSL session ID is stale, removing");
-        Curl_ssl_delsessionid(data, old_ssl_sessionid);
-        incache = FALSE;
-      }
-    }
-
-    if(!incache) {
-      if(!Curl_ssl_addsessionid(cf, data, ssl_sessionid,
-                                0 /* unknown size */, &added)) {
-        if(added) {
-          /* the session has been put into the session cache */
-          res = 1;
-        }
-      }
-      else
-        failf(data, "failed to store ssl session");
-    }
-    Curl_ssl_sessionid_unlock(data);
+  struct Curl_cfilter *cf = (struct Curl_cfilter *)SSL_get_app_data(ssl);
+  if(cf) {
+    struct Curl_easy *data = CF_DATA_CURRENT(cf);
+    struct ssl_connect_data *connssl = cf->ctx;
+    Curl_ossl_add_session(cf, data, connssl->peer.scache_key, ssl_sessionid,
+                          SSL_version(ssl), connssl->negotiated.alpn, NULL, 0);
   }
-
-  return res;
+  return 0;
 }
 
 static CURLcode load_cacert_from_memory(X509_STORE *store,
@@ -2953,7 +2731,7 @@ static CURLcode load_cacert_from_memory(X509_STORE *store,
   BIO *cbio = NULL;
   STACK_OF(X509_INFO) *inf = NULL;
 
-  /* everything else is just a reference */
+  /* everything else is a reference */
   int i, count = 0;
   X509_INFO *itmp = NULL;
 
@@ -2972,7 +2750,7 @@ static CURLcode load_cacert_from_memory(X509_STORE *store,
 
   /* add each entry from PEM file to x509_store */
   for(i = 0; i < (int)sk_X509_INFO_num(inf); ++i) {
-    itmp = sk_X509_INFO_value(inf, i);
+    itmp = sk_X509_INFO_value(inf, (ossl_valsize_t)i);
     if(itmp->x509) {
       if(X509_STORE_add_cert(store, itmp->x509)) {
         ++count;
@@ -2995,384 +2773,528 @@ static CURLcode load_cacert_from_memory(X509_STORE *store,
     }
   }
 
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wcast-function-type-strict"
+#endif
   sk_X509_INFO_pop_free(inf, X509_INFO_free);
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic pop
+#endif
   BIO_free(cbio);
 
-  /* if we didn't end up importing anything, treat that as an error */
+  /* if we did not end up importing anything, treat that as an error */
   return (count > 0) ? CURLE_OK : CURLE_SSL_CACERT_BADFILE;
 }
 
-static CURLcode populate_x509_store(struct Curl_cfilter *cf,
-                                    struct Curl_easy *data,
-                                    X509_STORE *store)
+#ifdef USE_WIN32_CRYPTO
+static CURLcode ossl_win_load_store(struct Curl_easy *data,
+                                    struct Curl_cfilter *cf,
+                                    const char *win_store,
+                                    X509_STORE *store,
+                                    bool *padded)
 {
-  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
-  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
   CURLcode result = CURLE_OK;
-  X509_LOOKUP *lookup = NULL;
-  const struct curl_blob *ca_info_blob = conn_config->ca_info_blob;
-  const char * const ssl_cafile =
-    /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
-    (ca_info_blob ? NULL : conn_config->CAfile);
-  const char * const ssl_capath = conn_config->CApath;
-  const char * const ssl_crlfile = ssl_config->primary.CRLfile;
-  const bool verifypeer = conn_config->verifypeer;
-  bool imported_native_ca = false;
-  bool imported_ca_info_blob = false;
+  HCERTSTORE hStore;
 
-  if(!store)
-    return CURLE_OUT_OF_MEMORY;
+  *padded = FALSE;
 
-  if(verifypeer) {
-#if defined(USE_WIN32_CRYPTO)
-    /* Import certificates from the Windows root certificate store if
-       requested.
-       https://stackoverflow.com/questions/9507184/
-       https://github.com/d3x0r/SACK/blob/master/src/netlib/ssl_layer.c#L1037
-       https://datatracker.ietf.org/doc/html/rfc5280 */
-    if(ssl_config->native_ca_store) {
-      HCERTSTORE hStore = CertOpenSystemStore(0, TEXT("ROOT"));
+  hStore = CertOpenSystemStoreA(0, win_store);
+  if(hStore) {
+    PCCERT_CONTEXT pContext = NULL;
+    /* The array of enhanced key usage OIDs varies per certificate and
+       is declared outside of the loop so that rather than malloc/free each
+       iteration we can grow it with realloc, when necessary. */
+    CERT_ENHKEY_USAGE *enhkey_usage = NULL;
+    DWORD enhkey_usage_size = 0;
+    VERBOSE(size_t total = 0);
+    VERBOSE(size_t imported = 0);
 
-      if(hStore) {
-        PCCERT_CONTEXT pContext = NULL;
-        /* The array of enhanced key usage OIDs will vary per certificate and
-           is declared outside of the loop so that rather than malloc/free each
-           iteration we can grow it with realloc, when necessary. */
-        CERT_ENHKEY_USAGE *enhkey_usage = NULL;
-        DWORD enhkey_usage_size = 0;
+    /* This loop makes a best effort to import all valid certificates from
+       the MS root store. If a certificate cannot be imported it is
+       skipped. 'result' is used to store only hard-fail conditions (such
+       as out of memory) that cause an early break. */
+    result = CURLE_OK;
+    for(;;) {
+      X509 *x509;
+      FILETIME now;
+      BYTE key_usage[2];
+      DWORD req_size;
+      const unsigned char *encoded_cert;
+      pContext = CertEnumCertificatesInStore(hStore, pContext);
+      if(!pContext)
+        break;
 
-        /* This loop makes a best effort to import all valid certificates from
-           the MS root store. If a certificate cannot be imported it is
-           skipped. 'result' is used to store only hard-fail conditions (such
-           as out of memory) that cause an early break. */
-        result = CURLE_OK;
-        for(;;) {
-          X509 *x509;
-          FILETIME now;
-          BYTE key_usage[2];
-          DWORD req_size;
-          const unsigned char *encoded_cert;
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
-          char cert_name[256];
-#endif
+      VERBOSE(++total);
 
-          pContext = CertEnumCertificatesInStore(hStore, pContext);
-          if(!pContext)
-            break;
-
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
-          if(!CertGetNameStringA(pContext, CERT_NAME_SIMPLE_DISPLAY_TYPE, 0,
-                                 NULL, cert_name, sizeof(cert_name))) {
-            strcpy(cert_name, "Unknown");
-          }
+#if defined(DEBUGBUILD) && defined(CURLVERBOSE)
+      {
+        char cert_name[256];
+        if(!CertGetNameStringA(pContext, CERT_NAME_SIMPLE_DISPLAY_TYPE, 0,
+                               NULL, cert_name, sizeof(cert_name)))
+          infof(data, "SSL: unknown cert name");
+        else
           infof(data, "SSL: Checking cert \"%s\"", cert_name);
+      }
 #endif
-          encoded_cert = (const unsigned char *)pContext->pbCertEncoded;
-          if(!encoded_cert)
-            continue;
+      encoded_cert = (const unsigned char *)pContext->pbCertEncoded;
+      if(!encoded_cert)
+        continue;
 
-          GetSystemTimeAsFileTime(&now);
-          if(CompareFileTime(&pContext->pCertInfo->NotBefore, &now) > 0 ||
-             CompareFileTime(&now, &pContext->pCertInfo->NotAfter) > 0)
-            continue;
+      GetSystemTimeAsFileTime(&now);
+      if(CompareFileTime(&pContext->pCertInfo->NotBefore, &now) > 0 ||
+         CompareFileTime(&now, &pContext->pCertInfo->NotAfter) > 0)
+        continue;
 
-          /* If key usage exists check for signing attribute */
-          if(CertGetIntendedKeyUsage(pContext->dwCertEncodingType,
-                                     pContext->pCertInfo,
-                                     key_usage, sizeof(key_usage))) {
-            if(!(key_usage[0] & CERT_KEY_CERT_SIGN_KEY_USAGE))
+      /* If key usage exists check for signing attribute */
+      if(CertGetIntendedKeyUsage(pContext->dwCertEncodingType,
+                                 pContext->pCertInfo,
+                                 key_usage, sizeof(key_usage))) {
+        if(!(key_usage[0] & CERT_KEY_CERT_SIGN_KEY_USAGE))
+          continue;
+      }
+      else if(GetLastError())
+        continue;
+
+      /* If enhanced key usage exists check for server auth attribute.
+       *
+       * Note "In a Microsoft environment, a certificate might also have
+       * EKU extended properties that specify valid uses for the
+       * certificate."  The call below checks both, and behavior varies
+       * depending on what is found. For more details see
+       * CertGetEnhancedKeyUsage doc.
+       */
+      if(CertGetEnhancedKeyUsage(pContext, 0, NULL, &req_size) && req_size) {
+        if(req_size > enhkey_usage_size) {
+          void *tmp = curlx_realloc(enhkey_usage, req_size);
+
+          if(!tmp) {
+            failf(data, "SSL: Out of memory allocating for OID list");
+            result = CURLE_OUT_OF_MEMORY;
+            break;
+          }
+
+          enhkey_usage = (CERT_ENHKEY_USAGE *)tmp;
+          enhkey_usage_size = req_size;
+        }
+
+        if(CertGetEnhancedKeyUsage(pContext, 0, enhkey_usage, &req_size)) {
+          if(!enhkey_usage->cUsageIdentifier) {
+            /* "If GetLastError returns CRYPT_E_NOT_FOUND, the certificate
+               is good for all uses. If it returns zero, the certificate
+               has no valid uses." */
+            if((HRESULT)GetLastError() != CRYPT_E_NOT_FOUND)
               continue;
           }
-          else if(GetLastError())
-            continue;
+          else {
+            DWORD i;
+            bool found = FALSE;
 
-          /* If enhanced key usage exists check for server auth attribute.
-           *
-           * Note "In a Microsoft environment, a certificate might also have
-           * EKU extended properties that specify valid uses for the
-           * certificate."  The call below checks both, and behavior varies
-           * depending on what is found. For more details see
-           * CertGetEnhancedKeyUsage doc.
-           */
-          if(CertGetEnhancedKeyUsage(pContext, 0, NULL, &req_size)) {
-            if(req_size && req_size > enhkey_usage_size) {
-              void *tmp = realloc(enhkey_usage, req_size);
-
-              if(!tmp) {
-                failf(data, "SSL: Out of memory allocating for OID list");
-                result = CURLE_OUT_OF_MEMORY;
+            for(i = 0; i < enhkey_usage->cUsageIdentifier; ++i) {
+              if(!strcmp("1.3.6.1.5.5.7.3.1" /* OID server auth */,
+                         enhkey_usage->rgpszUsageIdentifier[i])) {
+                found = TRUE;
                 break;
               }
-
-              enhkey_usage = (CERT_ENHKEY_USAGE *)tmp;
-              enhkey_usage_size = req_size;
             }
 
-            if(CertGetEnhancedKeyUsage(pContext, 0, enhkey_usage, &req_size)) {
-              if(!enhkey_usage->cUsageIdentifier) {
-                /* "If GetLastError returns CRYPT_E_NOT_FOUND, the certificate
-                   is good for all uses. If it returns zero, the certificate
-                   has no valid uses." */
-                if((HRESULT)GetLastError() != CRYPT_E_NOT_FOUND)
-                  continue;
-              }
-              else {
-                DWORD i;
-                bool found = false;
-
-                for(i = 0; i < enhkey_usage->cUsageIdentifier; ++i) {
-                  if(!strcmp("1.3.6.1.5.5.7.3.1" /* OID server auth */,
-                             enhkey_usage->rgpszUsageIdentifier[i])) {
-                    found = true;
-                    break;
-                  }
-                }
-
-                if(!found)
-                  continue;
-              }
-            }
-            else
+            if(!found)
               continue;
           }
-          else
-            continue;
-
-          x509 = d2i_X509(NULL, &encoded_cert, pContext->cbCertEncoded);
-          if(!x509)
-            continue;
-
-          /* Try to import the certificate. This may fail for legitimate
-             reasons such as duplicate certificate, which is allowed by MS but
-             not OpenSSL. */
-          if(X509_STORE_add_cert(store, x509) == 1) {
-#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
-            infof(data, "SSL: Imported cert \"%s\"", cert_name);
-#endif
-            imported_native_ca = true;
-          }
-          X509_free(x509);
         }
-
-        free(enhkey_usage);
-        CertFreeCertificateContext(pContext);
-        CertCloseStore(hStore, 0);
-
-        if(result)
-          return result;
+        else
+          continue;
       }
-      if(imported_native_ca)
-        infof(data, "successfully imported Windows CA store");
       else
-        infof(data, "error importing Windows CA store, continuing anyway");
-    }
+        continue;
+
+      x509 = d2i_X509(NULL, &encoded_cert, (long)pContext->cbCertEncoded);
+      if(!x509)
+        continue;
+
+      /* Try to import the certificate. This may fail for legitimate reasons
+         such as duplicate certificate, which is allowed by MS but not
+         OpenSSL. */
+      if(X509_STORE_add_cert(store, x509) == 1) {
+        VERBOSE(++imported);
+#ifdef DEBUGBUILD
+        infof(data, "SSL: Imported cert");
 #endif
-    if(ca_info_blob) {
-      result = load_cacert_from_memory(store, ca_info_blob);
-      if(result) {
-        failf(data, "error importing CA certificate blob");
-        return result;
-      }
-      else {
-        imported_ca_info_blob = true;
-        infof(data, "successfully imported CA certificate blob");
+        *padded = TRUE;
       }
+      X509_free(x509);
     }
 
-    if(ssl_cafile || ssl_capath) {
-#if defined(OPENSSL_VERSION_MAJOR) && (OPENSSL_VERSION_MAJOR >= 3)
-      /* OpenSSL 3.0.0 has deprecated SSL_CTX_load_verify_locations */
-      if(ssl_cafile && !X509_STORE_load_file(store, ssl_cafile)) {
-        if(!imported_native_ca && !imported_ca_info_blob) {
-          /* Fail if we insist on successfully verifying the server. */
-          failf(data, "error setting certificate file: %s", ssl_cafile);
-          return CURLE_SSL_CACERT_BADFILE;
-        }
-        else
-          infof(data, "error setting certificate file, continuing anyway");
-      }
-      if(ssl_capath && !X509_STORE_load_path(store, ssl_capath)) {
-        if(!imported_native_ca && !imported_ca_info_blob) {
-          /* Fail if we insist on successfully verifying the server. */
-          failf(data, "error setting certificate path: %s", ssl_capath);
-          return CURLE_SSL_CACERT_BADFILE;
-        }
-        else
-          infof(data, "error setting certificate path, continuing anyway");
-      }
-#else
-      /* tell OpenSSL where to find CA certificates that are used to verify the
-         server's certificate. */
-      if(!X509_STORE_load_locations(store, ssl_cafile, ssl_capath)) {
-        if(!imported_native_ca && !imported_ca_info_blob) {
-          /* Fail if we insist on successfully verifying the server. */
-          failf(data, "error setting certificate verify locations:"
-                "  CAfile: %s CApath: %s",
-                ssl_cafile ? ssl_cafile : "none",
-                ssl_capath ? ssl_capath : "none");
-          return CURLE_SSL_CACERT_BADFILE;
-        }
-        else {
-          infof(data, "error setting certificate verify locations,"
-                " continuing anyway");
-        }
-      }
-#endif
-      infof(data, " CAfile: %s", ssl_cafile ? ssl_cafile : "none");
-      infof(data, " CApath: %s", ssl_capath ? ssl_capath : "none");
-    }
+    curlx_free(enhkey_usage);
+    CertFreeCertificateContext(pContext);
+    CertCloseStore(hStore, 0);
 
-#ifdef CURL_CA_FALLBACK
-    if(!ssl_cafile && !ssl_capath &&
-       !imported_native_ca && !imported_ca_info_blob) {
-      /* verifying the peer without any CA certificates won't
-         work so use openssl's built-in default as fallback */
-      X509_STORE_set_default_paths(store);
-    }
-#endif
-  }
+    CURL_TRC_CF(data, cf,
+                "ossl_win_load_store() found: %zu imported: %zu certs in %s.",
+                total, imported, win_store);
 
-  if(ssl_crlfile) {
-    /* tell OpenSSL where to find CRL file that is used to check certificate
-     * revocation */
-    lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
-    if(!lookup ||
-       (!X509_load_crl_file(lookup, ssl_crlfile, X509_FILETYPE_PEM)) ) {
-      failf(data, "error loading CRL file: %s", ssl_crlfile);
-      return CURLE_SSL_CRL_BADFILE;
-    }
-    /* Everything is fine. */
-    infof(data, "successfully loaded CRL file:");
-    X509_STORE_set_flags(store,
-                         X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
-
-    infof(data, "  CRLfile: %s", ssl_crlfile);
-  }
-
-  if(verifypeer) {
-    /* Try building a chain using issuers in the trusted store first to avoid
-       problems with server-sent legacy intermediates.  Newer versions of
-       OpenSSL do alternate chain checking by default but we do not know how to
-       determine that in a reliable manner.
-       https://rt.openssl.org/Ticket/Display.html?id=3621&user=guest&pass=guest
-    */
-#if defined(X509_V_FLAG_TRUSTED_FIRST)
-    X509_STORE_set_flags(store, X509_V_FLAG_TRUSTED_FIRST);
-#endif
-#ifdef X509_V_FLAG_PARTIAL_CHAIN
-    if(!ssl_config->no_partialchain && !ssl_crlfile) {
-      /* Have intermediate certificates in the trust store be treated as
-         trust-anchors, in the same way as self-signed root CA certificates
-         are. This allows users to verify servers using the intermediate cert
-         only, instead of needing the whole chain.
-
-         Due to OpenSSL bug https://github.com/openssl/openssl/issues/5081 we
-         cannot do partial chains with a CRL check.
-      */
-      X509_STORE_set_flags(store, X509_V_FLAG_PARTIAL_CHAIN);
-    }
-#endif
+    if(result)
+      return result;
   }
 
   return result;
 }
 
-#if defined(HAVE_SSL_X509_STORE_SHARE)
-static bool cached_x509_store_expired(const struct Curl_easy *data,
-                                      const struct multi_ssl_backend_data *mb)
+static CURLcode ossl_windows_load_anchors(struct Curl_cfilter *cf,
+                                          struct Curl_easy *data,
+                                          X509_STORE *store,
+                                          bool *padded)
 {
-  const struct ssl_general_config *cfg = &data->set.general_ssl;
-  struct curltime now = Curl_now();
-  timediff_t elapsed_ms = Curl_timediff(now, mb->time);
-  timediff_t timeout_ms = cfg->ca_cache_timeout * (timediff_t)1000;
+  /* Import certificates from the Windows root certificate store if
+     requested.
+     https://stackoverflow.com/questions/9507184/
+     https://github.com/d3x0r/SACK/blob/ff15424d3c581b86d40f818532e5a400c516d39d/src/netlib/ssl_layer.c#L1410
+     https://datatracker.ietf.org/doc/html/rfc5280 */
+  const char *win_stores[] = {
+    "ROOT",   /* Trusted Root Certification Authorities */
+    "CA"      /* Intermediate Certification Authorities */
+  };
+  size_t i;
+  CURLcode result = CURLE_OK;
 
-  if(timeout_ms < 0)
-    return false;
-
-  return elapsed_ms >= timeout_ms;
+  *padded = FALSE;
+  for(i = 0; i < CURL_ARRAYSIZE(win_stores); ++i) {
+    bool store_added = FALSE;
+    result = ossl_win_load_store(data, cf, win_stores[i], store, &store_added);
+    if(result)
+      return result;
+    if(store_added) {
+      CURL_TRC_CF(data, cf, "added trust anchors from Windows %s store",
+                  win_stores[i]);
+      *padded = TRUE;
+    }
+    else
+      infof(data, "error importing Windows %s store, continuing anyway",
+            win_stores[i]);
+  }
+  return result;
 }
 
-static bool cached_x509_store_different(
-  struct Curl_cfilter *cf,
-  const struct multi_ssl_backend_data *mb)
+#endif /* USE_WIN32_CRYPTO */
+
+static CURLcode ossl_load_trust_anchors(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data,
+                                        struct ossl_ctx *octx,
+                                        X509_STORE *store)
 {
   struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+  CURLcode result = CURLE_OK;
+  const char * const ssl_cafile =
+    /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
+    (conn_config->ca_info_blob ? NULL : conn_config->CAfile);
+  const char * const ssl_capath = conn_config->CApath;
+  bool have_native_check = FALSE;
+
+  octx->store_is_empty = TRUE;
+  if(ssl_config->native_ca_store) {
+#ifdef USE_WIN32_CRYPTO
+    bool added = FALSE;
+    result = ossl_windows_load_anchors(cf, data, store, &added);
+    if(result)
+      return result;
+    if(added) {
+      infof(data, "  Native: Windows System Stores ROOT+CA");
+      octx->store_is_empty = FALSE;
+    }
+#elif defined(USE_APPLE_SECTRUST)
+    infof(data, "  Native: Apple SecTrust");
+    have_native_check = TRUE;
+#endif
+  }
+
+  if(conn_config->ca_info_blob) {
+    result = load_cacert_from_memory(store, conn_config->ca_info_blob);
+    if(result) {
+      failf(data, "error adding trust anchors from certificate blob: %d",
+            (int)result);
+      return result;
+    }
+    infof(data, "  CA Blob from configuration");
+    octx->store_is_empty = FALSE;
+  }
+
+  if(ssl_cafile || ssl_capath) {
+#ifdef HAVE_OPENSSL3
+    /* OpenSSL 3.0.0 has deprecated SSL_CTX_load_verify_locations */
+    if(ssl_cafile) {
+      if(!X509_STORE_load_file(store, ssl_cafile)) {
+        if(octx->store_is_empty && !have_native_check) {
+          /* Fail if we insist on successfully verifying the server. */
+          failf(data, "error adding trust anchors from file: %s", ssl_cafile);
+          return CURLE_SSL_CACERT_BADFILE;
+        }
+        else
+          infof(data, "error setting certificate file, continuing anyway");
+      }
+      infof(data, "  CAfile: %s", ssl_cafile);
+      octx->store_is_empty = FALSE;
+    }
+    if(ssl_capath) {
+      if(!X509_STORE_load_path(store, ssl_capath)) {
+        if(octx->store_is_empty && !have_native_check) {
+          /* Fail if we insist on successfully verifying the server. */
+          failf(data, "error adding trust anchors from path: %s", ssl_capath);
+          return CURLE_SSL_CACERT_BADFILE;
+        }
+        else
+          infof(data, "error setting certificate path, continuing anyway");
+      }
+      infof(data, "  CApath: %s", ssl_capath);
+      octx->store_is_empty = FALSE;
+    }
+#else
+    /* tell OpenSSL where to find CA certificates that are used to verify the
+       server's certificate. */
+    if(!X509_STORE_load_locations(store, ssl_cafile, ssl_capath)) {
+      if(octx->store_is_empty && !have_native_check) {
+        /* Fail if we insist on successfully verifying the server. */
+        failf(data, "error adding trust anchors from locations:"
+              "  CAfile: %s CApath: %s",
+              ssl_cafile ? ssl_cafile : "none",
+              ssl_capath ? ssl_capath : "none");
+        return CURLE_SSL_CACERT_BADFILE;
+      }
+      else {
+        infof(data, "error setting certificate verify locations,"
+              " continuing anyway");
+      }
+    }
+    if(ssl_cafile)
+      infof(data, "  CAfile: %s", ssl_cafile);
+    if(ssl_capath)
+      infof(data, "  CApath: %s", ssl_capath);
+    octx->store_is_empty = FALSE;
+#endif
+  }
+
+#ifdef CURL_CA_FALLBACK
+  if(octx->store_is_empty) {
+    /* verifying the peer without any CA certificates does not
+       work so use OpenSSL's built-in default as fallback */
+    X509_STORE_set_default_paths(store);
+    infof(data, "  OpenSSL default paths (fallback)");
+    octx->store_is_empty = FALSE;
+  }
+#endif
+  if(octx->store_is_empty && !have_native_check)
+    infof(data, "  no trust anchors configured");
+
+  return result;
+}
+
+static CURLcode ossl_populate_x509_store(struct Curl_cfilter *cf,
+                                         struct Curl_easy *data,
+                                         struct ossl_ctx *octx,
+                                         X509_STORE *store)
+{
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+  CURLcode result = CURLE_OK;
+  X509_LOOKUP *lookup = NULL;
+  const char * const ssl_crlfile = ssl_config->primary.CRLfile;
+  unsigned long x509flags = 0;
+
+  CURL_TRC_CF(data, cf, "configuring OpenSSL's x509 trust store");
+  if(!store)
+    return CURLE_OUT_OF_MEMORY;
+
+  if(!conn_config->verifypeer) {
+    infof(data, "SSL Trust: peer verification disabled");
+    return CURLE_OK;
+  }
+
+  infof(data, "SSL Trust Anchors:");
+  result = ossl_load_trust_anchors(cf, data, octx, store);
+  if(result)
+    return result;
+
+  /* Does not make sense to load a CRL file without peer verification */
+  if(ssl_crlfile) {
+    /* tell OpenSSL where to find CRL file that is used to check certificate
+     * revocation */
+    lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
+    if(!lookup ||
+       (!X509_load_crl_file(lookup, ssl_crlfile, X509_FILETYPE_PEM))) {
+      failf(data, "error loading CRL file: %s", ssl_crlfile);
+      return CURLE_SSL_CRL_BADFILE;
+    }
+    x509flags = X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL;
+    infof(data, " CRLfile: %s", ssl_crlfile);
+  }
+
+  /* Try building a chain using issuers in the trusted store first to avoid
+     problems with server-sent legacy intermediates. Newer versions of
+     OpenSSL do alternate chain checking by default but we do not know how to
+     determine that in a reliable manner.
+     https://web.archive.org/web/20190422050538/rt.openssl.org/Ticket/Display.html?id=3621
+  */
+  x509flags |= X509_V_FLAG_TRUSTED_FIRST;
+
+  if(!ssl_config->no_partialchain && !ssl_crlfile) {
+    /* Have intermediate certificates in the trust store be treated as
+       trust-anchors, in the same way as self-signed root CA certificates are.
+       This allows users to verify servers using the intermediate cert only,
+       instead of needing the whole chain.
+
+       Due to OpenSSL bug https://github.com/openssl/openssl/issues/5081 we
+       cannot do partial chains with a CRL check.
+    */
+    x509flags |= X509_V_FLAG_PARTIAL_CHAIN;
+  }
+  (void)X509_STORE_set_flags(store, x509flags);
+
+  return result;
+}
+
+/* key to use at `multi->proto_hash` */
+#define MPROTO_OSSL_X509_KEY  "tls:ossl:x509:share"
+
+struct ossl_x509_share {
+  char *CAfile;         /* CAfile path used to generate X509 store */
+  X509_STORE *store;    /* cached X509 store or NULL if none */
+  struct curltime time; /* when the cached store was created */
+  BIT(store_is_empty);  /* no certs/paths/blobs are in the store */
+  BIT(no_partialchain); /* keep partial chain state */
+};
+
+static void oss_x509_share_free(void *key, size_t key_len, void *p)
+{
+  struct ossl_x509_share *share = p;
+  DEBUGASSERT(key_len == (sizeof(MPROTO_OSSL_X509_KEY) - 1));
+  DEBUGASSERT(!memcmp(MPROTO_OSSL_X509_KEY, key, key_len));
+  (void)key;
+  (void)key_len;
+  if(share->store) {
+    X509_STORE_free(share->store);
+  }
+  curlx_free(share->CAfile);
+  curlx_free(share);
+}
+
+static bool ossl_cached_x509_store_expired(struct Curl_easy *data,
+                                           const struct ossl_x509_share *mb)
+{
+  const struct ssl_general_config *cfg = &data->set.general_ssl;
+  if(cfg->ca_cache_timeout < 0)
+    return FALSE;
+  else {
+    timediff_t elapsed_ms = curlx_ptimediff_ms(Curl_pgrs_now(data), &mb->time);
+    timediff_t timeout_ms = cfg->ca_cache_timeout * (timediff_t)1000;
+
+    return elapsed_ms >= timeout_ms;
+  }
+}
+
+static bool ossl_cached_x509_store_different(struct Curl_cfilter *cf,
+                                             const struct Curl_easy *data,
+                                             const struct ossl_x509_share *mb)
+{
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  struct ssl_config_data *ssl_config =
+    Curl_ssl_cf_get_config(cf, CURL_UNCONST(data));
+  if(mb->no_partialchain != ssl_config->no_partialchain)
+    return TRUE;
   if(!mb->CAfile || !conn_config->CAfile)
     return mb->CAfile != conn_config->CAfile;
-
   return strcmp(mb->CAfile, conn_config->CAfile);
 }
 
-static X509_STORE *get_cached_x509_store(struct Curl_cfilter *cf,
-                                         const struct Curl_easy *data)
+static X509_STORE *ossl_get_cached_x509_store(struct Curl_cfilter *cf,
+                                              struct Curl_easy *data,
+                                              bool *pempty)
 {
-  struct Curl_multi *multi = data->multi_easy ? data->multi_easy : data->multi;
+  struct Curl_multi *multi = data->multi;
+  struct ossl_x509_share *share;
   X509_STORE *store = NULL;
 
-  if(multi &&
-     multi->ssl_backend_data &&
-     multi->ssl_backend_data->store &&
-     !cached_x509_store_expired(data, multi->ssl_backend_data) &&
-     !cached_x509_store_different(cf, multi->ssl_backend_data)) {
-    store = multi->ssl_backend_data->store;
+  DEBUGASSERT(multi);
+  *pempty = TRUE;
+  share = multi ? Curl_hash_pick(&multi->proto_hash,
+                                 CURL_UNCONST(MPROTO_OSSL_X509_KEY),
+                                 sizeof(MPROTO_OSSL_X509_KEY) - 1) : NULL;
+  if(share && share->store &&
+     !ossl_cached_x509_store_expired(data, share) &&
+     !ossl_cached_x509_store_different(cf, data, share)) {
+    store = share->store;
+    *pempty = (bool)share->store_is_empty;
   }
 
   return store;
 }
 
-static void set_cached_x509_store(struct Curl_cfilter *cf,
-                                  const struct Curl_easy *data,
-                                  X509_STORE *store)
+static void ossl_set_cached_x509_store(struct Curl_cfilter *cf,
+                                       struct Curl_easy *data,
+                                       X509_STORE *store,
+                                       bool is_empty)
 {
   struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
-  struct Curl_multi *multi = data->multi_easy ? data->multi_easy : data->multi;
-  struct multi_ssl_backend_data *mbackend;
+  struct Curl_multi *multi = data->multi;
+  struct ossl_x509_share *share;
 
+  DEBUGASSERT(multi);
   if(!multi)
     return;
+  share = Curl_hash_pick(&multi->proto_hash,
+                         CURL_UNCONST(MPROTO_OSSL_X509_KEY),
+                         sizeof(MPROTO_OSSL_X509_KEY) - 1);
 
-  if(!multi->ssl_backend_data) {
-    multi->ssl_backend_data = calloc(1, sizeof(struct multi_ssl_backend_data));
-    if(!multi->ssl_backend_data)
+  if(!share) {
+    share = curlx_calloc(1, sizeof(*share));
+    if(!share)
       return;
+    if(!Curl_hash_add2(&multi->proto_hash,
+                       CURL_UNCONST(MPROTO_OSSL_X509_KEY),
+                       sizeof(MPROTO_OSSL_X509_KEY) - 1,
+                       share, oss_x509_share_free)) {
+      curlx_free(share);
+      return;
+    }
   }
 
-  mbackend = multi->ssl_backend_data;
-
   if(X509_STORE_up_ref(store)) {
     char *CAfile = NULL;
+    struct ssl_config_data *ssl_config =
+      Curl_ssl_cf_get_config(cf, CURL_UNCONST(data));
 
     if(conn_config->CAfile) {
-      CAfile = strdup(conn_config->CAfile);
+      CAfile = curlx_strdup(conn_config->CAfile);
       if(!CAfile) {
         X509_STORE_free(store);
         return;
       }
     }
 
-    if(mbackend->store) {
-      X509_STORE_free(mbackend->store);
-      free(mbackend->CAfile);
+    if(share->store) {
+      X509_STORE_free(share->store);
+      curlx_free(share->CAfile);
     }
 
-    mbackend->time = Curl_now();
-    mbackend->store = store;
-    mbackend->CAfile = CAfile;
+    share->time = *Curl_pgrs_now(data);
+    share->store = store;
+    share->store_is_empty = is_empty;
+    share->CAfile = CAfile;
+    share->no_partialchain = ssl_config->no_partialchain;
   }
 }
 
 CURLcode Curl_ssl_setup_x509_store(struct Curl_cfilter *cf,
                                    struct Curl_easy *data,
-                                   SSL_CTX *ssl_ctx)
+                                   struct ossl_ctx *octx)
 {
   struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
   struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
   CURLcode result = CURLE_OK;
   X509_STORE *cached_store;
-  bool cache_criteria_met;
+  bool cache_criteria_met, is_empty;
 
   /* Consider the X509 store cacheable if it comes exclusively from a CAfile,
-     or no source is provided and we are falling back to openssl's built-in
+     or no source is provided and we are falling back to OpenSSL's built-in
      default. */
   cache_criteria_met = (data->set.general_ssl.ca_cache_timeout != 0) &&
     conn_config->verifypeer &&
@@ -3381,66 +3303,384 @@ CURLcode Curl_ssl_setup_x509_store(struct Curl_cfilter *cf,
     !ssl_config->primary.CRLfile &&
     !ssl_config->native_ca_store;
 
-  cached_store = get_cached_x509_store(cf, data);
+  ERR_set_mark();
+
+  cached_store = ossl_get_cached_x509_store(cf, data, &is_empty);
   if(cached_store && cache_criteria_met && X509_STORE_up_ref(cached_store)) {
-    SSL_CTX_set_cert_store(ssl_ctx, cached_store);
+    SSL_CTX_set_cert_store(octx->ssl_ctx, cached_store);
+    octx->store_is_empty = is_empty;
   }
   else {
-    X509_STORE *store = SSL_CTX_get_cert_store(ssl_ctx);
+    X509_STORE *store = SSL_CTX_get_cert_store(octx->ssl_ctx);
 
-    result = populate_x509_store(cf, data, store);
+    result = ossl_populate_x509_store(cf, data, octx, store);
     if(result == CURLE_OK && cache_criteria_met) {
-      set_cached_x509_store(cf, data, store);
+      ossl_set_cached_x509_store(cf, data, store, (bool)octx->store_is_empty);
     }
   }
 
+  ERR_pop_to_mark();
+
   return result;
 }
-#else /* HAVE_SSL_X509_STORE_SHARE */
-CURLcode Curl_ssl_setup_x509_store(struct Curl_cfilter *cf,
-                                   struct Curl_easy *data,
-                                   SSL_CTX *ssl_ctx)
+
+static CURLcode ossl_init_session_and_alpns(
+  struct ossl_ctx *octx,
+  struct Curl_cfilter *cf,
+  struct Curl_easy *data,
+  struct ssl_peer *peer,
+  const struct alpn_spec *alpns_requested,
+  Curl_ossl_init_session_reuse_cb *sess_reuse_cb)
 {
-  X509_STORE *store = SSL_CTX_get_cert_store(ssl_ctx);
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+  struct ssl_primary_config *conn_cfg = Curl_ssl_cf_get_primary_config(cf);
+  struct alpn_spec alpns;
+  CURLcode result;
 
-  return populate_x509_store(cf, data, store);
+  Curl_alpn_copy(&alpns, alpns_requested);
+
+  octx->reused_session = FALSE;
+  if(Curl_ssl_scache_use(cf, data) && !conn_cfg->verifystatus) {
+    struct Curl_ssl_session *scs = NULL;
+
+    result = Curl_ssl_scache_take(cf, data, peer->scache_key, &scs);
+    if(!result && scs && scs->sdata && scs->sdata_len) {
+      const unsigned char *der_sessionid = scs->sdata;
+      size_t der_sessionid_size = scs->sdata_len;
+      SSL_SESSION *ssl_session = NULL;
+
+      /* If OpenSSL does not accept the session from the cache, this
+       * is not an error. We continue without it. */
+      ssl_session = d2i_SSL_SESSION(NULL, &der_sessionid,
+                                    (long)der_sessionid_size);
+      if(ssl_session) {
+        if(!SSL_set_session(octx->ssl, ssl_session)) {
+          VERBOSE(char error_buffer[256]);
+          infof(data, "SSL: SSL_set_session not accepted, "
+                "continuing without: %s",
+                ossl_strerror(ERR_get_error(), error_buffer,
+                              sizeof(error_buffer)));
+        }
+        else {
+          if(conn_cfg->verifypeer &&
+             (SSL_get_verify_result(octx->ssl) != X509_V_OK)) {
+            /* Session was from unverified connection, cannot reuse here */
+            SSL_set_session(octx->ssl, NULL);
+            infof(data, "SSL session not peer verified, not reusing");
+          }
+          else {
+            infof(data, "SSL reusing session with ALPN '%s'",
+                  scs->alpn ? scs->alpn : "-");
+            octx->reused_session = TRUE;
+            infof(data, "SSL verify result: %lx",
+                  (unsigned long)SSL_get_verify_result(octx->ssl));
+#ifdef HAVE_OPENSSL_EARLYDATA
+            if(ssl_config->earlydata && scs->alpn &&
+               SSL_SESSION_get_max_early_data(ssl_session) &&
+               !cf->conn->bits.connect_only &&
+               (SSL_version(octx->ssl) == TLS1_3_VERSION)) {
+              bool do_early_data = FALSE;
+              if(sess_reuse_cb) {
+                result = sess_reuse_cb(cf, data, &alpns, scs, &do_early_data);
+                if(result) {
+                  SSL_SESSION_free(ssl_session);
+                  return result;
+                }
+              }
+              if(do_early_data) {
+                /* We only try the ALPN protocol the session used before,
+                 * otherwise we might send early data for the wrong protocol */
+                Curl_alpn_restrict_to(&alpns, scs->alpn);
+              }
+            }
+#else
+            (void)ssl_config;
+            (void)sess_reuse_cb;
+#endif
+          }
+        }
+        SSL_SESSION_free(ssl_session);
+      }
+      else {
+        infof(data, "SSL session not accepted by OpenSSL, continuing without");
+      }
+    }
+    Curl_ssl_scache_return(cf, data, peer->scache_key, scs);
+  }
+
+  if(alpns.count) {
+    struct alpn_proto_buf proto;
+    memset(&proto, 0, sizeof(proto));
+    result = Curl_alpn_to_proto_buf(&proto, &alpns);
+    if(result) {
+      failf(data, "Error determining ALPN");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+    if(SSL_set_alpn_protos(octx->ssl, proto.data, proto.len)) {
+      failf(data, "Error setting ALPN");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+  }
+
+  return CURLE_OK;
 }
-#endif /* HAVE_SSL_X509_STORE_SHARE */
 
-static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
-                                   struct Curl_easy *data)
+#ifdef HAVE_SSL_SET1_ECH_CONFIG_LIST
+bool Curl_ossl_need_httpsrr(struct Curl_easy *data)
+{
+  if(!CURLECH_ENABLED(data))
+    return FALSE;
+  if((data->set.tls_ech == CURLECH_GREASE) ||
+     data->set.str[STRING_ECH_CONFIG])
+    return FALSE;
+  return TRUE;
+}
+
+static CURLcode ossl_init_ech(struct ossl_ctx *octx,
+                              struct Curl_cfilter *cf,
+                              struct Curl_easy *data,
+                              struct ssl_peer *peer)
+{
+  unsigned char *ech_config = NULL;
+  size_t ech_config_len = 0;
+  char *outername = data->set.str[STRING_ECH_PUBLIC];
+  int trying_ech_now = 0;
+
+  if(!CURLECH_ENABLED(data))
+    return CURLE_OK;
+
+  if(data->set.tls_ech == CURLECH_GREASE) {
+    infof(data, "ECH: will GREASE ClientHello");
+#ifdef HAVE_BORINGSSL_LIKE
+    SSL_set_enable_ech_grease(octx->ssl, 1);
+#else
+    SSL_set_options(octx->ssl, SSL_OP_ECH_GREASE);
+#endif
+  }
+  else if(data->set.tls_ech && data->set.str[STRING_ECH_CONFIG]) {
+#ifdef HAVE_BORINGSSL_LIKE
+    /* have to do base64 decode here for BoringSSL */
+    const char *b64 = data->set.str[STRING_ECH_CONFIG];
+    CURLcode result;
+
+    if(!b64) {
+      infof(data, "ECH: ECHConfig from command line empty");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+    ech_config_len = 2 * strlen(b64);
+    result = curlx_base64_decode(b64, &ech_config, &ech_config_len);
+    if(result || !ech_config) {
+      infof(data, "ECH: cannot base64 decode ECHConfig from command line");
+      if(data->set.tls_ech == CURLECH_HARD)
+        return result;
+    }
+    if(SSL_set1_ech_config_list(octx->ssl, ech_config, ech_config_len) != 1) {
+      infof(data, "ECH: SSL_ECH_set1_ech_config_list failed");
+      if(data->set.tls_ech == CURLECH_HARD) {
+        curlx_free(ech_config);
+        return CURLE_SSL_CONNECT_ERROR;
+      }
+    }
+    curlx_free(ech_config);
+    trying_ech_now = 1;
+#else
+    ech_config = (unsigned char *)data->set.str[STRING_ECH_CONFIG];
+    if(!ech_config) {
+      infof(data, "ECH: ECHConfig from command line empty");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+    ech_config_len = strlen(data->set.str[STRING_ECH_CONFIG]);
+    if(SSL_set1_ech_config_list(octx->ssl, ech_config, ech_config_len) != 1) {
+      infof(data, "ECH: SSL_ECH_set1_ech_config_list failed");
+      if(data->set.tls_ech == CURLECH_HARD)
+        return CURLE_SSL_CONNECT_ERROR;
+    }
+    else
+      trying_ech_now = 1;
+#endif /* HAVE_BORINGSSL_LIKE */
+    infof(data, "ECH: ECHConfig from command line");
+  }
+  else {
+    const struct Curl_https_rrinfo *rinfo =
+      Curl_conn_dns_get_https(data, cf->sockindex, peer->origin);
+
+    if(rinfo && rinfo->echconfiglist) {
+      const unsigned char *ecl = rinfo->echconfiglist;
+      size_t elen = rinfo->echconfiglist_len;
+
+      infof(data, "ECH: ECHConfig from HTTPS RR");
+      if(SSL_set1_ech_config_list(octx->ssl, ecl, elen) != 1) {
+        infof(data, "ECH: SSL_set1_ech_config_list failed");
+        if(data->set.tls_ech == CURLECH_HARD)
+          return CURLE_SSL_CONNECT_ERROR;
+      }
+      else {
+        trying_ech_now = 1;
+        infof(data, "ECH: imported ECHConfigList of length %zu", elen);
+      }
+    }
+    else {
+      infof(data, "ECH: requested but no ECHConfig available");
+      if(data->set.tls_ech == CURLECH_HARD)
+        return CURLE_SSL_CONNECT_ERROR;
+    }
+  }
+#ifdef HAVE_BORINGSSL_LIKE
+  (void)peer;
+  if(trying_ech_now && outername) {
+    infof(data, "ECH: setting public_name not supported with BoringSSL");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+#else
+  if(trying_ech_now && outername) {
+    int ret;
+    infof(data, "ECH: inner: '%s', outer: '%s'",
+          peer->origin->hostname ? peer->origin->hostname : "NULL", outername);
+    ret = SSL_ech_set1_server_names(octx->ssl,
+                                    peer->origin->hostname, outername,
+                                    0 /* do send outer */);
+    if(ret != 1) {
+      infof(data, "ECH: rv failed to set server name(s) %d [ERROR]", ret);
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+  }
+#endif /* HAVE_BORINGSSL_LIKE */
+  if(trying_ech_now &&
+     SSL_set_min_proto_version(octx->ssl, TLS1_3_VERSION) != 1) {
+    infof(data, "ECH: cannot force TLSv1.3 [ERROR]");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  return CURLE_OK;
+}
+#else /* HAVE_SSL_SET1_ECH_CONFIG_LIST */
+bool Curl_ossl_need_httpsrr(struct Curl_easy *data)
+{
+  (void)data;
+  return FALSE;
+}
+#endif /* else HAVE_SSL_SET1_ECH_CONFIG_LIST */
+
+static CURLcode ossl_init_ssl(struct ossl_ctx *octx,
+                              struct Curl_cfilter *cf,
+                              struct Curl_easy *data,
+                              struct ssl_peer *peer,
+                              const struct alpn_spec *alpns_requested,
+                              void *ssl_user_data,
+                              Curl_ossl_init_session_reuse_cb *sess_reuse_cb)
+{
+  /* Let's make an SSL structure */
+  if(octx->ssl)
+    SSL_free(octx->ssl);
+  octx->ssl = SSL_new(octx->ssl_ctx);
+  if(!octx->ssl) {
+    failf(data, "SSL: could not create a context (handle)");
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  SSL_set_app_data(octx->ssl, ssl_user_data);
+
+#ifndef OPENSSL_NO_OCSP
+  if(Curl_ssl_cf_get_primary_config(cf)->verifystatus)
+    SSL_set_tlsext_status_type(octx->ssl, TLSEXT_STATUSTYPE_ocsp);
+#endif
+
+  SSL_set_connect_state(octx->ssl);
+
+  if(peer->sni) {
+    if(!SSL_set_tlsext_host_name(octx->ssl, peer->sni)) {
+      failf(data, "Failed set SNI");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+  }
+
+#ifdef HAVE_SSL_SET1_ECH_CONFIG_LIST
+  {
+    CURLcode result = ossl_init_ech(octx, cf, data, peer);
+    if(result)
+      return result;
+  }
+#endif /* HAVE_SSL_SET1_ECH_CONFIG_LIST */
+
+  return ossl_init_session_and_alpns(octx, cf, data, peer,
+                                     alpns_requested, sess_reuse_cb);
+}
+
+static CURLcode ossl_init_method(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 struct ssl_peer *peer,
+                                 const SSL_METHOD **pmethod,
+                                 unsigned int *pssl_version_min)
+{
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+
+  *pmethod = NULL;
+  *pssl_version_min = conn_config->version;
+  DEBUGASSERT(conn_config->version != CURL_SSLVERSION_DEFAULT);
+  switch(peer->transport) {
+  case TRNSPRT_TCP:
+    /* check to see if we have been told to use an explicit SSL/TLS version */
+    switch(*pssl_version_min) {
+    case CURL_SSLVERSION_TLSv1:
+    case CURL_SSLVERSION_TLSv1_0:
+    case CURL_SSLVERSION_TLSv1_1:
+    case CURL_SSLVERSION_TLSv1_2:
+    case CURL_SSLVERSION_TLSv1_3:
+      /* it is handled later with the context options */
+      *pmethod = TLS_client_method();
+      break;
+    case CURL_SSLVERSION_SSLv2:
+      failf(data, "No SSLv2 support");
+      return CURLE_NOT_BUILT_IN;
+    case CURL_SSLVERSION_SSLv3:
+      failf(data, "No SSLv3 support");
+      return CURLE_NOT_BUILT_IN;
+    default:
+      failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+    break;
+  case TRNSPRT_QUIC:
+    *pssl_version_min = CURL_SSLVERSION_TLSv1_3;
+    if(conn_config->version_max &&
+       (conn_config->version_max != CURL_SSLVERSION_MAX_DEFAULT) &&
+       (conn_config->version_max != CURL_SSLVERSION_MAX_TLSv1_3)) {
+      failf(data, "QUIC needs at least TLS version 1.3");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+
+    *pmethod = TLS_method();
+    break;
+  default:
+    failf(data, "unsupported transport %d in SSL init", peer->transport);
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  return *pmethod ? CURLE_OK : CURLE_SSL_CONNECT_ERROR;
+}
+
+CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
+                            struct Curl_cfilter *cf,
+                            struct Curl_easy *data,
+                            struct ssl_peer *peer,
+                            const struct alpn_spec *alpns_requested,
+                            Curl_ossl_ctx_setup_cb *cb_setup,
+                            void *cb_user_data,
+                            Curl_ossl_new_session_cb *cb_new_session,
+                            void *ssl_user_data,
+                            Curl_ossl_init_session_reuse_cb *sess_reuse_cb)
 {
   CURLcode result = CURLE_OK;
-  char *ciphers;
-  SSL_METHOD_QUAL SSL_METHOD *req_method = NULL;
-  struct ssl_connect_data *connssl = cf->ctx;
+  const char *ciphers;
+  const SSL_METHOD *req_method = NULL;
   ctx_option_t ctx_options = 0;
-  void *ssl_sessionid = NULL;
   struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
   struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
-  BIO *bio;
-
-#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
-  bool sni;
-  const char *hostname = connssl->hostname;
-
-#ifdef ENABLE_IPV6
-  struct in6_addr addr;
-#else
-  struct in_addr addr;
-#endif
-#endif
-  const long int ssl_version = conn_config->version;
   char * const ssl_cert = ssl_config->primary.clientcert;
   const struct curl_blob *ssl_cert_blob = ssl_config->primary.cert_blob;
-  const char * const ssl_cert_type = ssl_config->cert_type;
-  const bool verifypeer = conn_config->verifypeer;
+  const char * const ssl_cert_type = ssl_config->primary.cert_type;
+  unsigned int ssl_version_min;
   char error_buffer[256];
-  struct ossl_ssl_backend_data *backend =
-    (struct ossl_ssl_backend_data *)connssl->backend;
-
-  DEBUGASSERT(ssl_connect_1 == connssl->connecting_state);
-  DEBUGASSERT(backend);
 
   /* Make funny stuff to get random input */
   result = ossl_seed(data);
@@ -3449,75 +3689,55 @@ static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
 
   ssl_config->certverifyresult = !X509_V_OK;
 
-  /* check to see if we've been told to use an explicit SSL/TLS version */
+  result = ossl_init_method(cf, data, peer, &req_method, &ssl_version_min);
+  if(result)
+    return result;
+  DEBUGASSERT(req_method);
 
-  switch(ssl_version) {
-  case CURL_SSLVERSION_DEFAULT:
-  case CURL_SSLVERSION_TLSv1:
-  case CURL_SSLVERSION_TLSv1_0:
-  case CURL_SSLVERSION_TLSv1_1:
-  case CURL_SSLVERSION_TLSv1_2:
-  case CURL_SSLVERSION_TLSv1_3:
-    /* it will be handled later with the context options */
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
-    req_method = TLS_client_method();
-#else
-    req_method = SSLv23_client_method();
+  DEBUGASSERT(!octx->ssl_ctx);
+  octx->ssl_ctx =
+#ifdef OPENSSL_HAS_PROVIDERS
+    data->state.libctx ?
+    SSL_CTX_new_ex(data->state.libctx, data->state.propq, req_method):
 #endif
-    use_sni(TRUE);
-    break;
-  case CURL_SSLVERSION_SSLv2:
-    failf(data, "No SSLv2 support");
-    return CURLE_NOT_BUILT_IN;
-  case CURL_SSLVERSION_SSLv3:
-    failf(data, "No SSLv3 support");
-    return CURLE_NOT_BUILT_IN;
-  default:
-    failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
-    return CURLE_SSL_CONNECT_ERROR;
-  }
+    SSL_CTX_new(req_method);
 
-  if(backend->ctx) {
-    /* This happens when an error was encountered before in this
-     * step and we are called to do it again. Get rid of any leftover
-     * from the previous call. */
-    ossl_close(cf, data);
-  }
-  backend->ctx = SSL_CTX_new(req_method);
-
-  if(!backend->ctx) {
-    failf(data, "SSL: couldn't create a context: %s",
+  if(!octx->ssl_ctx) {
+    failf(data, "SSL: could not create a context: %s",
           ossl_strerror(ERR_peek_error(), error_buffer, sizeof(error_buffer)));
     return CURLE_OUT_OF_MEMORY;
   }
 
-#ifdef SSL_MODE_RELEASE_BUFFERS
-  SSL_CTX_set_mode(backend->ctx, SSL_MODE_RELEASE_BUFFERS);
-#endif
-
-#ifdef SSL_CTRL_SET_MSG_CALLBACK
-  if(data->set.fdebug && data->set.verbose) {
-    /* the SSL trace callback is only used for verbose logging */
-    SSL_CTX_set_msg_callback(backend->ctx, ossl_trace);
-    SSL_CTX_set_msg_callback_arg(backend->ctx, cf);
+  if(cb_setup) {
+    result = cb_setup(cf, data, cb_user_data);
+    if(result)
+      return result;
+  }
+
+  if(data->set.fdebug && data->set.verbose &&
+     (peer->transport != TRNSPRT_QUIC)) {
+    /* the SSL trace callback is only used for verbose logging;
+     * QUIC connections use a different TLS record format that
+     * ossl_trace cannot handle */
+    SSL_CTX_set_msg_callback(octx->ssl_ctx, ossl_trace);
+    SSL_CTX_set_msg_callback_arg(octx->ssl_ctx, cf);
   }
-#endif
 
   /* OpenSSL contains code to work around lots of bugs and flaws in various
      SSL-implementations. SSL_CTX_set_options() is used to enabled those
-     work-arounds. The man page for this option states that SSL_OP_ALL enables
-     all the work-arounds and that "It is usually safe to use SSL_OP_ALL to
+     workarounds. The man page for this option states that SSL_OP_ALL enables
+     all the workarounds and that "It is usually safe to use SSL_OP_ALL to
      enable the bug workaround options if compatibility with somewhat broken
      implementations is desired."
 
-     The "-no_ticket" option was introduced in OpenSSL 0.9.8j. It's a flag to
+     The "-no_ticket" option was introduced in OpenSSL 0.9.8j. it is a flag to
      disable "rfc4507bis session ticket support". rfc4507bis was later turned
      into the proper RFC5077: https://datatracker.ietf.org/doc/html/rfc5077
 
      The enabled extension concerns the session management. I wonder how often
      libcurl stops a connection and then resumes a TLS session. Also, sending
-     the session data is some overhead. I suggest that you just use your
-     proposed patch (which explicitly disables TICKET).
+     the session data is some overhead. I suggest that you use your proposed
+     patch (which explicitly disables TICKET).
 
      If someone writes an application with libcurl and OpenSSL who wants to
      enable the feature, one can do this in the SSL callback.
@@ -3531,44 +3751,32 @@ static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
      CVE-2010-4180 when using previous OpenSSL versions we no longer enable
      this option regardless of OpenSSL version and SSL_OP_ALL definition.
 
-     OpenSSL added a work-around for a SSL 3.0/TLS 1.0 CBC vulnerability
-     (https://www.openssl.org/~bodo/tls-cbc.txt). In 0.9.6e they added a bit to
-     SSL_OP_ALL that _disables_ that work-around despite the fact that
-     SSL_OP_ALL is documented to do "rather harmless" workarounds. In order to
-     keep the secure work-around, the SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS bit
-     must not be set.
+     OpenSSL added a workaround for an SSL 3.0/TLS 1.0 CBC vulnerability:
+     https://web.archive.org/web/20240114184648/openssl.org/~bodo/tls-cbc.txt.
+     In 0.9.6e they added a bit to SSL_OP_ALL that _disables_ that workaround
+     despite the fact that SSL_OP_ALL is documented to do "rather harmless"
+     workarounds. In order to keep the secure workaround, the
+     SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS bit must not be set.
   */
 
-  ctx_options = SSL_OP_ALL;
+  ctx_options = SSL_OP_ALL | SSL_OP_NO_TICKET | SSL_OP_NO_COMPRESSION;
 
-#ifdef SSL_OP_NO_TICKET
-  ctx_options |= SSL_OP_NO_TICKET;
-#endif
-
-#ifdef SSL_OP_NO_COMPRESSION
-  ctx_options |= SSL_OP_NO_COMPRESSION;
-#endif
-
-#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
   /* mitigate CVE-2010-4180 */
-  ctx_options &= ~SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG;
-#endif
+  ctx_options &= ~(ctx_option_t)SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG;
 
-#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
   /* unless the user explicitly asks to allow the protocol vulnerability we
-     use the work-around */
+     use the workaround */
   if(!ssl_config->enable_beast)
-    ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
-#endif
+    ctx_options &= ~(ctx_option_t)SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
 
-  switch(ssl_version) {
+  DEBUGASSERT(ssl_version_min != CURL_SSLVERSION_DEFAULT);
+  switch(ssl_version_min) {
   case CURL_SSLVERSION_SSLv2:
   case CURL_SSLVERSION_SSLv3:
     return CURLE_NOT_BUILT_IN;
 
     /* "--tlsv<x.y>" options mean TLS >= version <x.y> */
-  case CURL_SSLVERSION_DEFAULT:
-  case CURL_SSLVERSION_TLSv1: /* TLS >= version 1.0 */
+  case CURL_SSLVERSION_TLSv1:   /* TLS >= version 1.0 */
   case CURL_SSLVERSION_TLSv1_0: /* TLS >= version 1.0 */
   case CURL_SSLVERSION_TLSv1_1: /* TLS >= version 1.1 */
   case CURL_SSLVERSION_TLSv1_2: /* TLS >= version 1.2 */
@@ -3578,12 +3786,8 @@ static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
     ctx_options |= SSL_OP_NO_SSLv2;
     ctx_options |= SSL_OP_NO_SSLv3;
 
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) /* 1.1.0 */
-    result = ossl_set_ssl_version_min_max(cf, backend->ctx);
-#else
-    result = ossl_set_ssl_version_min_max_legacy(&ctx_options, cf, data);
-#endif
-    if(result != CURLE_OK)
+    result = ossl_set_ssl_version_min_max(cf, octx->ssl_ctx, ssl_version_min);
+    if(result)
       return result;
     break;
 
@@ -3592,40 +3796,30 @@ static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
     return CURLE_SSL_CONNECT_ERROR;
   }
 
-  SSL_CTX_set_options(backend->ctx, ctx_options);
+  SSL_CTX_set_options(octx->ssl_ctx, ctx_options);
+  SSL_CTX_set_read_ahead(octx->ssl_ctx, 1);
 
-#ifdef HAS_ALPN
-  if(connssl->alpn) {
-    struct alpn_proto_buf proto;
+  /* Max TLS1.2 record size 0x4000 + 0x800.
+     OpenSSL supports processing "jumbo TLS record" (8 TLS records) in one go
+     for some algorithms, so match that here.
+     Experimentation shows that a slightly larger buffer is needed
+     to avoid short reads.
 
-    result = Curl_alpn_to_proto_buf(&proto, connssl->alpn);
-    if(result ||
-       SSL_CTX_set_alpn_protos(backend->ctx, proto.data, proto.len)) {
-      failf(data, "Error setting ALPN");
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-    Curl_alpn_to_proto_str(&proto, connssl->alpn);
-    infof(data, VTLS_INFOF_ALPN_OFFER_1STR, proto.data);
-  }
+     However using a large buffer (8 packets) actually decreases performance.
+     4 packets is better.
+   */
+#ifdef HAVE_SSL_CTX_SET_DEFAULT_READ_BUFFER_LEN
+  SSL_CTX_set_default_read_buffer_len(octx->ssl_ctx, 0x401e * 4);
 #endif
 
-  if(ssl_cert || ssl_cert_blob || ssl_cert_type) {
-    if(!result &&
-       !cert_stuff(data, backend->ctx,
-                   ssl_cert, ssl_cert_blob, ssl_cert_type,
-                   ssl_config->key, ssl_config->key_blob,
-                   ssl_config->key_type, ssl_config->key_passwd))
-      result = CURLE_SSL_CERTPROBLEM;
-    if(result)
-      /* failf() is already done in cert_stuff() */
-      return result;
-  }
+  /* We do retry writes sometimes from another buffer address */
+  SSL_CTX_set_mode(octx->ssl_ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
 
   ciphers = conn_config->cipher_list;
-  if(!ciphers)
-    ciphers = (char *)DEFAULT_CIPHER_SELECTION;
-  if(ciphers) {
-    if(!SSL_CTX_set_cipher_list(backend->ctx, ciphers)) {
+  if(!ciphers && (peer->transport != TRNSPRT_QUIC))
+    ciphers = NULL;
+  if(ciphers && (ssl_version_min < CURL_SSLVERSION_TLSv1_3)) {
+    if(!SSL_CTX_set_cipher_list(octx->ssl_ctx, ciphers)) {
       failf(data, "failed setting cipher list: %s", ciphers);
       return CURLE_SSL_CIPHER;
     }
@@ -3634,9 +3828,12 @@ static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
 
 #ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
   {
-    char *ciphers13 = conn_config->cipher_list13;
-    if(ciphers13) {
-      if(!SSL_CTX_set_ciphersuites(backend->ctx, ciphers13)) {
+    const char *ciphers13 = conn_config->cipher_list13;
+    if(ciphers13 &&
+       (!conn_config->version_max ||
+        (conn_config->version_max == CURL_SSLVERSION_MAX_DEFAULT) ||
+        (conn_config->version_max >= CURL_SSLVERSION_MAX_TLSv1_3))) {
+      if(!SSL_CTX_set_ciphersuites(octx->ssl_ctx, ciphers13)) {
         failf(data, "failed setting TLS 1.3 cipher suite: %s", ciphers13);
         return CURLE_SSL_CIPHER;
       }
@@ -3645,154 +3842,193 @@ static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
   }
 #endif
 
+  if(ssl_cert || ssl_cert_blob || ssl_cert_type) {
+    result = client_cert(data, octx->ssl_ctx,
+                         ssl_cert, ssl_cert_blob, ssl_cert_type,
+                         ssl_config->primary.key, ssl_config->primary.key_blob,
+                         ssl_config->primary.key_type,
+                         ssl_config->primary.key_passwd);
+    if(result)
+      /* failf() is already done in client_cert() */
+      return result;
+  }
+
 #ifdef HAVE_SSL_CTX_SET_POST_HANDSHAKE_AUTH
   /* OpenSSL 1.1.1 requires clients to opt-in for PHA */
-  SSL_CTX_set_post_handshake_auth(backend->ctx, 1);
+  SSL_CTX_set_post_handshake_auth(octx->ssl_ctx, 1);
 #endif
 
-#ifdef HAVE_SSL_CTX_SET_EC_CURVES
   {
-    char *curves = conn_config->curves;
+    const char *curves = conn_config->curves;
     if(curves) {
-      if(!SSL_CTX_set1_curves_list(backend->ctx, curves)) {
+#ifdef HAVE_BORINGSSL_LIKE
+#define OSSL_CURVE_CAST(x) (x)
+#else
+#define OSSL_CURVE_CAST(x) (char *)CURL_UNCONST(x)
+#endif
+      if(!SSL_CTX_set1_curves_list(octx->ssl_ctx, OSSL_CURVE_CAST(curves))) {
         failf(data, "failed setting curves list: '%s'", curves);
         return CURLE_SSL_CIPHER;
       }
     }
   }
+
+#ifdef HAVE_SSL_CTX_SET1_SIGALGS
+#define OSSL_SIGALG_CAST(x) OSSL_CURVE_CAST(x)
+  {
+    const char *signature_algorithms = conn_config->signature_algorithms;
+    if(signature_algorithms) {
+      if(!SSL_CTX_set1_sigalgs_list(octx->ssl_ctx,
+                                    OSSL_SIGALG_CAST(signature_algorithms))) {
+        failf(data, "failed setting signature algorithms: '%s'",
+              signature_algorithms);
+        return CURLE_SSL_CIPHER;
+      }
+    }
+  }
 #endif
 
-#ifdef USE_OPENSSL_SRP
+#if defined(HAVE_OPENSSL_SRP) && defined(USE_TLS_SRP)
   if(ssl_config->primary.username && Curl_auth_allowed_to_host(data)) {
     char * const ssl_username = ssl_config->primary.username;
     char * const ssl_password = ssl_config->primary.password;
     infof(data, "Using TLS-SRP username: %s", ssl_username);
 
-    if(!SSL_CTX_set_srp_username(backend->ctx, ssl_username)) {
-      failf(data, "Unable to set SRP user name");
+    if(!SSL_CTX_set_srp_username(octx->ssl_ctx, ssl_username)) {
+      failf(data, "Unable to set SRP username");
       return CURLE_BAD_FUNCTION_ARGUMENT;
     }
-    if(!SSL_CTX_set_srp_password(backend->ctx, ssl_password)) {
+    if(!SSL_CTX_set_srp_password(octx->ssl_ctx, ssl_password)) {
       failf(data, "failed setting SRP password");
       return CURLE_BAD_FUNCTION_ARGUMENT;
     }
     if(!conn_config->cipher_list) {
       infof(data, "Setting cipher list SRP");
 
-      if(!SSL_CTX_set_cipher_list(backend->ctx, "SRP")) {
+      if(!SSL_CTX_set_cipher_list(octx->ssl_ctx, "SRP")) {
         failf(data, "failed setting SRP cipher list");
         return CURLE_SSL_CIPHER;
       }
     }
   }
-#endif
+#endif /* HAVE_OPENSSL_SRP && USE_TLS_SRP */
 
-  /* OpenSSL always tries to verify the peer, this only says whether it should
-   * fail to connect if the verification fails, or if it should continue
-   * anyway. In the latter case the result of the verification is checked with
-   * SSL_get_verify_result() below. */
-  SSL_CTX_set_verify(backend->ctx,
-                     verifypeer ? SSL_VERIFY_PEER : SSL_VERIFY_NONE, NULL);
+  /* OpenSSL always tries to verify the peer. By setting the failure mode
+   * to NONE, we allow the connect to complete, regardless of the outcome.
+   * We then explicitly check the result and may try alternatives like
+   * Apple's SecTrust for verification. */
+  SSL_CTX_set_verify(octx->ssl_ctx, SSL_VERIFY_NONE, NULL);
 
   /* Enable logging of secrets to the file specified in env SSLKEYLOGFILE. */
-#ifdef HAVE_KEYLOG_CALLBACK
+#if !defined(HAVE_KEYLOG_UPSTREAM) && defined(HAVE_KEYLOG_CALLBACK)
   if(Curl_tls_keylog_enabled()) {
-    SSL_CTX_set_keylog_callback(backend->ctx, ossl_keylog_callback);
+    SSL_CTX_set_keylog_callback(octx->ssl_ctx, ossl_keylog_callback);
   }
 #endif
 
-  /* Enable the session cache because it's a prerequisite for the "new session"
-   * callback. Use the "external storage" mode to prevent OpenSSL from creating
-   * an internal session cache.
-   */
-  SSL_CTX_set_session_cache_mode(backend->ctx,
-                                 SSL_SESS_CACHE_CLIENT |
-                                 SSL_SESS_CACHE_NO_INTERNAL);
-  SSL_CTX_sess_set_new_cb(backend->ctx, ossl_new_session_cb);
+  if(cb_new_session) {
+    /* Enable the session cache because it is a prerequisite for the
+     * "new session" callback. Use the "external storage" mode to prevent
+     * OpenSSL from creating an internal session cache.
+     */
+    SSL_CTX_set_session_cache_mode(octx->ssl_ctx,
+                                   SSL_SESS_CACHE_CLIENT |
+                                   SSL_SESS_CACHE_NO_INTERNAL);
+    SSL_CTX_sess_set_new_cb(octx->ssl_ctx, cb_new_session);
+  }
 
   /* give application a chance to interfere with SSL set up. */
   if(data->set.ssl.fsslctx) {
     /* When a user callback is installed to modify the SSL_CTX,
      * we need to do the full initialization before calling it.
      * See: #11800 */
-    if(!backend->x509_store_setup) {
-      result = Curl_ssl_setup_x509_store(cf, data, backend->ctx);
+    if(!octx->x509_store_setup) {
+      result = Curl_ssl_setup_x509_store(cf, data, octx);
       if(result)
         return result;
-      backend->x509_store_setup = TRUE;
+      octx->x509_store_setup = TRUE;
     }
-    Curl_set_in_callback(data, true);
-    result = (*data->set.ssl.fsslctx)(data, backend->ctx,
+    Curl_set_in_callback(data, TRUE);
+    result = (*data->set.ssl.fsslctx)(data, octx->ssl_ctx,
                                       data->set.ssl.fsslctxp);
-    Curl_set_in_callback(data, false);
+    Curl_set_in_callback(data, FALSE);
     if(result) {
-      failf(data, "error signaled by ssl ctx callback");
+      failf(data, "error signaled by SSL ctx callback");
       return result;
     }
   }
 
-  /* Let's make an SSL structure */
-  if(backend->handle)
-    SSL_free(backend->handle);
-  backend->handle = SSL_new(backend->ctx);
-  if(!backend->handle) {
-    failf(data, "SSL: couldn't create a context (handle)");
+  return ossl_init_ssl(octx, cf, data, peer, alpns_requested,
+                       ssl_user_data, sess_reuse_cb);
+}
+
+static CURLcode ossl_on_session_reuse(struct Curl_cfilter *cf,
+                                      struct Curl_easy *data,
+                                      struct alpn_spec *alpns,
+                                      struct Curl_ssl_session *scs,
+                                      bool *do_early_data)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+
+  connssl->earlydata_max = scs->earlydata_max;
+
+  return Curl_on_session_reuse(cf, data, alpns, scs, do_early_data,
+                               connssl->earlydata_max);
+}
+
+void Curl_ossl_report_handshake(struct Curl_easy *data, struct ossl_ctx *octx)
+{
+#ifdef CURLVERBOSE
+  if(Curl_trc_is_verbose(data)) {
+    int psigtype_nid = NID_undef;
+    const char *negotiated_group_name = NULL;
+
+#ifdef HAVE_OPENSSL3
+    SSL_get_peer_signature_type_nid(octx->ssl, &psigtype_nid);
+#if OPENSSL_VERSION_NUMBER >= 0x30200000L
+    negotiated_group_name = SSL_get0_group_name(octx->ssl);
+#else
+    negotiated_group_name =
+      OBJ_nid2sn(SSL_get_negotiated_group(octx->ssl) & 0x0000FFFF);
+#endif
+#endif
+
+    /* Informational message */
+    infof(data, "SSL connection using %s / %s / %s / %s",
+          SSL_get_version(octx->ssl),
+          SSL_get_cipher(octx->ssl),
+          negotiated_group_name ? negotiated_group_name : "[blank]",
+          OBJ_nid2sn(psigtype_nid));
+  }
+#else
+  (void)data;
+  (void)octx;
+#endif /* CURLVERBOSE */
+}
+
+static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct ossl_ctx *octx = (struct ossl_ctx *)connssl->backend;
+  BIO *bio;
+  CURLcode result;
+
+  DEBUGASSERT(ssl_connect_1 == connssl->connecting_state);
+  DEBUGASSERT(octx);
+  DEBUGASSERT(connssl->peer.origin);
+
+  result = Curl_ossl_ctx_init(octx, cf, data, &connssl->peer,
+                              connssl->alpn, NULL, NULL,
+                              ossl_new_session_cb, cf,
+                              ossl_on_session_reuse);
+  if(result)
+    return result;
+
+  octx->bio_method = ossl_bio_cf_method_create();
+  if(!octx->bio_method)
     return CURLE_OUT_OF_MEMORY;
-  }
-
-  SSL_set_app_data(backend->handle, cf);
-
-#if (OPENSSL_VERSION_NUMBER >= 0x0090808fL) && !defined(OPENSSL_NO_TLSEXT) && \
-  !defined(OPENSSL_NO_OCSP)
-  if(conn_config->verifystatus)
-    SSL_set_tlsext_status_type(backend->handle, TLSEXT_STATUSTYPE_ocsp);
-#endif
-
-#if (defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)) && \
-    defined(ALLOW_RENEG)
-  SSL_set_renegotiate_mode(backend->handle, ssl_renegotiate_freely);
-#endif
-
-  SSL_set_connect_state(backend->handle);
-
-  backend->server_cert = 0x0;
-#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
-  if((0 == Curl_inet_pton(AF_INET, hostname, &addr)) &&
-#ifdef ENABLE_IPV6
-     (0 == Curl_inet_pton(AF_INET6, hostname, &addr)) &&
-#endif
-     sni) {
-    char *snihost = Curl_ssl_snihost(data, hostname, NULL);
-    if(!snihost || !SSL_set_tlsext_host_name(backend->handle, snihost)) {
-      failf(data, "Failed set SNI");
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-  }
-#endif
-
-  SSL_set_app_data(backend->handle, cf);
-
-  if(ssl_config->primary.sessionid) {
-    Curl_ssl_sessionid_lock(data);
-    if(!Curl_ssl_getsessionid(cf, data, &ssl_sessionid, NULL)) {
-      /* we got a session id, use it! */
-      if(!SSL_set_session(backend->handle, ssl_sessionid)) {
-        Curl_ssl_sessionid_unlock(data);
-        failf(data, "SSL: SSL_set_session failed: %s",
-              ossl_strerror(ERR_get_error(), error_buffer,
-                            sizeof(error_buffer)));
-        return CURLE_SSL_CONNECT_ERROR;
-      }
-      /* Informational message */
-      infof(data, "SSL reusing session ID");
-    }
-    Curl_ssl_sessionid_unlock(data);
-  }
-
-  backend->bio_method = bio_cf_method_create();
-  if(!backend->bio_method)
-    return CURLE_OUT_OF_MEMORY;
-  bio = BIO_new(backend->bio_method);
+  bio = BIO_new(octx->bio_method);
   if(!bio)
     return CURLE_OUT_OF_MEMORY;
 
@@ -3800,94 +4036,165 @@ static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
 #ifdef HAVE_SSL_SET0_WBIO
   /* with OpenSSL v1.1.1 we get an alternative to SSL_set_bio() that works
    * without backward compat quirks. Every call takes one reference, so we
-   * up it and pass. SSL* then owns it and will free.
-   * We check on the function in configure, since libressl and friends
+   * up it and pass. SSL* then owns and frees it.
+   * We check on the function in configure, since LibreSSL and friends
    * each have their own versions to add support for this. */
   BIO_up_ref(bio);
-  SSL_set0_rbio(backend->handle, bio);
-  SSL_set0_wbio(backend->handle, bio);
+  SSL_set0_rbio(octx->ssl, bio);
+  SSL_set0_wbio(octx->ssl, bio);
 #else
-  SSL_set_bio(backend->handle, bio, bio);
+  SSL_set_bio(octx->ssl, bio, bio);
 #endif
-  connssl->connecting_state = ssl_connect_2;
 
+  if(connssl->alpn && (connssl->state != ssl_connection_deferred)) {
+    struct alpn_proto_buf proto;
+    memset(&proto, 0, sizeof(proto));
+    Curl_alpn_to_proto_str(&proto, connssl->alpn);
+    infof(data, VTLS_INFOF_ALPN_OFFER_1STR, proto.data);
+  }
+
+  connssl->connecting_state = ssl_connect_2;
   return CURLE_OK;
 }
 
+#ifdef HAVE_SSL_SET1_ECH_CONFIG_LIST
+/* If we have retry configs, then trace those out */
+static int ossl_trace_ech_retry_configs(struct Curl_easy *data, SSL *ssl,
+                                        int reason)
+{
+  CURLcode result = CURLE_OK;
+  size_t rcl = 0;
+  int rv = 1;
+#ifndef HAVE_BORINGSSL_LIKE
+  char *inner = NULL;
+  uint8_t *rcs = NULL;
+  char *outer = NULL;
+#else
+  const char *inner = NULL;
+  const uint8_t *rcs = NULL;
+  const char *outer = NULL;
+  size_t out_name_len = 0;
+  int servername_type = 0;
+#endif
+  NOVERBOSE((void)reason);
+
+  /* nothing to trace if not doing ECH */
+  if(!CURLECH_ENABLED(data))
+    return rv;
+#ifndef HAVE_BORINGSSL_LIKE
+  rv = SSL_ech_get1_retry_config(ssl, &rcs, &rcl);
+#else
+  SSL_get0_ech_retry_configs(ssl, &rcs, &rcl);
+  rv = (int)rcl;
+#endif
+
+  if(rv && rcs) {
+    char *b64str = NULL;
+    size_t blen = 0;
+
+    result = curlx_base64_encode(rcs, rcl, &b64str, &blen);
+    if(!result && b64str) {
+      infof(data, "ECH: retry_configs %s", b64str);
+      curlx_free(b64str);
+#ifndef HAVE_BORINGSSL_LIKE
+      rv = SSL_ech_get1_status(ssl, &inner, &outer);
+      infof(data, "ECH: retry_configs for %s from %s, %d %d",
+            inner ? inner : "NULL", outer ? outer : "NULL", reason, rv);
+#else
+      rv = SSL_ech_accepted(ssl);
+      servername_type = SSL_get_servername_type(ssl);
+      inner = SSL_get_servername(ssl, servername_type);
+      SSL_get0_ech_name_override(ssl, &outer, &out_name_len);
+      infof(data, "ECH: retry_configs for %s from %s, %d %d",
+            inner ? inner : "NULL", outer ? outer : "NULL", reason, rv);
+#endif
+    }
+  }
+  else
+    infof(data, "ECH: no retry_configs (rv = %d)", rv);
+#ifndef HAVE_BORINGSSL_LIKE
+  OPENSSL_free(inner);
+  OPENSSL_free(rcs);
+  OPENSSL_free(outer);
+#endif
+  return rv;
+}
+
+#endif
+
 static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
                                    struct Curl_easy *data)
 {
   int err;
   struct ssl_connect_data *connssl = cf->ctx;
-  struct ossl_ssl_backend_data *backend =
-    (struct ossl_ssl_backend_data *)connssl->backend;
+  struct ossl_ctx *octx = (struct ossl_ctx *)connssl->backend;
   struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
-  DEBUGASSERT(ssl_connect_2 == connssl->connecting_state
-              || ssl_connect_2_reading == connssl->connecting_state
-              || ssl_connect_2_writing == connssl->connecting_state);
-  DEBUGASSERT(backend);
+  DEBUGASSERT(ssl_connect_2 == connssl->connecting_state);
+  DEBUGASSERT(octx);
 
+  connssl->io_need = CURL_SSL_IO_NEED_NONE;
   ERR_clear_error();
 
-  err = SSL_connect(backend->handle);
+  err = SSL_connect(octx->ssl);
 
-  if(!backend->x509_store_setup) {
+  if(!octx->x509_store_setup) {
     /* After having send off the ClientHello, we prepare the x509
      * store to verify the coming certificate from the server */
-    CURLcode result = Curl_ssl_setup_x509_store(cf, data, backend->ctx);
+    CURLcode result = Curl_ssl_setup_x509_store(cf, data, octx);
     if(result)
       return result;
-    backend->x509_store_setup = TRUE;
+    octx->x509_store_setup = TRUE;
   }
 
-#ifndef HAVE_KEYLOG_CALLBACK
-  if(Curl_tls_keylog_enabled()) {
-    /* If key logging is enabled, wait for the handshake to complete and then
-     * proceed with logging secrets (for TLS 1.2 or older).
-     */
-    ossl_log_tls12_secret(backend->handle, &backend->keylog_done);
-  }
+#if !defined(HAVE_KEYLOG_UPSTREAM) && !defined(HAVE_KEYLOG_CALLBACK)
+  /* If key logging is enabled, wait for the handshake to complete and then
+   * proceed with logging secrets (for TLS 1.2 or older).
+   */
+  if(Curl_tls_keylog_enabled() && !octx->keylog_done)
+    ossl_log_tls12_secret(octx->ssl, &octx->keylog_done);
 #endif
 
   /* 1  is fine
      0  is "not successful but was shut down controlled"
      <0 is "handshake was not successful, because a fatal error occurred" */
-  if(1 != err) {
-    int detail = SSL_get_error(backend->handle, err);
+  if(err != 1) {
+    int detail = SSL_get_error(octx->ssl, err);
+    CURL_TRC_CF(data, cf, "SSL_connect() -> err=%d, detail=%d", err, detail);
 
     if(SSL_ERROR_WANT_READ == detail) {
-      connssl->connecting_state = ssl_connect_2_reading;
-      return CURLE_OK;
+      CURL_TRC_CF(data, cf, "SSL_connect() -> want recv");
+      connssl->io_need = CURL_SSL_IO_NEED_RECV;
+      return CURLE_AGAIN;
     }
     if(SSL_ERROR_WANT_WRITE == detail) {
-      connssl->connecting_state = ssl_connect_2_writing;
-      return CURLE_OK;
+      CURL_TRC_CF(data, cf, "SSL_connect() -> want send");
+      connssl->io_need = CURL_SSL_IO_NEED_SEND;
+      return CURLE_AGAIN;
     }
 #ifdef SSL_ERROR_WANT_ASYNC
     if(SSL_ERROR_WANT_ASYNC == detail) {
-      connssl->connecting_state = ssl_connect_2;
-      return CURLE_OK;
+      CURL_TRC_CF(data, cf, "SSL_connect() -> want async");
+      connssl->io_need = CURL_SSL_IO_NEED_RECV;
+      return CURLE_AGAIN;
     }
 #endif
 #ifdef SSL_ERROR_WANT_RETRY_VERIFY
     if(SSL_ERROR_WANT_RETRY_VERIFY == detail) {
-      connssl->connecting_state = ssl_connect_2;
-      return CURLE_OK;
+      CURL_TRC_CF(data, cf, "SSL_connect() -> want retry_verify");
+      Curl_xfer_pause_recv(data, TRUE);
+      return CURLE_AGAIN;
     }
 #endif
-    if(backend->io_result == CURLE_AGAIN) {
-      return CURLE_OK;
-    }
     else {
       /* untreated error */
       sslerr_t errdetail;
-      char error_buffer[256]="";
+      char error_buffer[256] = "";
       CURLcode result;
       long lerr;
       int lib;
       int reason;
 
-      /* the connection failed, we're not waiting for anything else. */
+      /* the connection failed, we are not waiting for anything else. */
       connssl->connecting_state = ssl_connect_2;
 
       /* Get the earliest error code from the thread's error queue and remove
@@ -3899,83 +4206,161 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
       reason = ERR_GET_REASON(errdetail);
 
       if((lib == ERR_LIB_SSL) &&
-         ((reason == SSL_R_CERTIFICATE_VERIFY_FAILED) ||
-          (reason == SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED))) {
+         ((reason == SSL_R_CERTIFICATE_VERIFY_FAILED)
+/* Missing from OpenSSL 4+ OPENSSL_NO_DEPRECATED_3_0 builds */
+#ifdef SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED
+          || (reason == SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED)
+#endif
+         )) {
         result = CURLE_PEER_FAILED_VERIFICATION;
 
-        lerr = SSL_get_verify_result(backend->handle);
+        lerr = SSL_get_verify_result(octx->ssl);
         if(lerr != X509_V_OK) {
           ssl_config->certverifyresult = lerr;
-          msnprintf(error_buffer, sizeof(error_buffer),
-                    "SSL certificate problem: %s",
-                    X509_verify_cert_error_string(lerr));
+          failf(data, "SSL certificate problem: %s",
+                X509_verify_cert_error_string(lerr));
         }
         else
-          /* strcpy() is fine here as long as the string fits within
-             error_buffer */
-          strcpy(error_buffer, "SSL certificate verification failed");
+          failf(data, "%s", "SSL certificate verification failed");
       }
-#if defined(SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED)
+#ifdef SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED
       /* SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED is only available on
-         OpenSSL version above v1.1.1, not LibreSSL, BoringSSL, or AWS-LC */
+         OpenSSL version above v1.1.1, not AWS-LC, BoringSSL, or LibreSSL */
       else if((lib == ERR_LIB_SSL) &&
               (reason == SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED)) {
         /* If client certificate is required, communicate the
            error to client */
         result = CURLE_SSL_CLIENTCERT;
-        ossl_strerror(errdetail, error_buffer, sizeof(error_buffer));
+        failf(data, "TLS cert problem: %s",
+              ossl_strerror(errdetail, error_buffer, sizeof(error_buffer)));
+      }
+#endif
+#ifdef HAVE_SSL_SET1_ECH_CONFIG_LIST
+      else if((lib == ERR_LIB_SSL) &&
+#ifndef HAVE_BORINGSSL_LIKE
+              (reason == SSL_R_ECH_REQUIRED)) {
+#else
+              (reason == SSL_R_ECH_REJECTED)) {
+#endif /* HAVE_BORINGSSL_LIKE */
+
+        /* trace retry_configs if we got some */
+        ossl_trace_ech_retry_configs(data, octx->ssl, reason);
+
+        result = CURLE_ECH_REQUIRED;
+        failf(data, "ECH required: %s",
+              ossl_strerror(errdetail, error_buffer, sizeof(error_buffer)));
       }
 #endif
       else {
         result = CURLE_SSL_CONNECT_ERROR;
-        ossl_strerror(errdetail, error_buffer, sizeof(error_buffer));
+        failf(data, "TLS connect error: %s",
+              ossl_strerror(errdetail, error_buffer, sizeof(error_buffer)));
       }
 
       /* detail is already set to the SSL error above */
 
-      /* If we e.g. use SSLv2 request-method and the server doesn't like us
+      /* If we e.g. use SSLv2 request-method and the server does not like us
        * (RST connection, etc.), OpenSSL gives no explanation whatsoever and
        * the SO_ERROR is also lost.
        */
-      if(CURLE_SSL_CONNECT_ERROR == result && errdetail == 0) {
-        char extramsg[80]="";
+      if(result == CURLE_SSL_CONNECT_ERROR && errdetail == 0) {
+        char extramsg[80] = "";
         int sockerr = SOCKERRNO;
 
         if(sockerr && detail == SSL_ERROR_SYSCALL)
-          Curl_strerror(sockerr, extramsg, sizeof(extramsg));
+          curlx_strerror(sockerr, extramsg, sizeof(extramsg));
         failf(data, OSSL_PACKAGE " SSL_connect: %s in connection to %s:%d ",
               extramsg[0] ? extramsg : SSL_ERROR_to_str(detail),
-              connssl->hostname, connssl->port);
-        return result;
+              connssl->peer.origin->hostname, connssl->peer.origin->port);
       }
 
-      /* Could be a CERT problem */
-      failf(data, "%s", error_buffer);
-
       return result;
     }
   }
   else {
-    /* we connected fine, we're not waiting for anything else. */
+    /* we connected fine, we are not waiting for anything else. */
     connssl->connecting_state = ssl_connect_3;
+    Curl_ossl_report_handshake(data, octx);
 
-    /* Informational message */
-    infof(data, "SSL connection using %s / %s",
-          SSL_get_version(backend->handle),
-          SSL_get_cipher(backend->handle));
+#if defined(HAVE_SSL_SET1_ECH_CONFIG_LIST) && !defined(HAVE_BORINGSSL_LIKE)
+    if(CURLECH_ENABLED(data)) {
+      char *inner = NULL, *outer = NULL;
+      int rv;
+      VERBOSE(const char *status);
+
+      rv = SSL_ech_get1_status(octx->ssl, &inner, &outer);
+      switch(rv) {
+      case SSL_ECH_STATUS_SUCCESS:
+        VERBOSE(status = "succeeded");
+        break;
+      case SSL_ECH_STATUS_GREASE_ECH:
+        VERBOSE(status = "sent GREASE, got retry-configs");
+        break;
+      case SSL_ECH_STATUS_GREASE:
+        VERBOSE(status = "sent GREASE");
+        break;
+      case SSL_ECH_STATUS_NOT_TRIED:
+        VERBOSE(status = "not attempted");
+        break;
+      case SSL_ECH_STATUS_NOT_CONFIGURED:
+        VERBOSE(status = "not configured");
+        break;
+      case SSL_ECH_STATUS_BACKEND:
+        VERBOSE(status = "backend (unexpected)");
+        break;
+      case SSL_ECH_STATUS_FAILED:
+        VERBOSE(status = "failed");
+        break;
+      case SSL_ECH_STATUS_BAD_CALL:
+        VERBOSE(status = "bad call (unexpected)");
+        break;
+      case SSL_ECH_STATUS_BAD_NAME: {
+        struct ssl_primary_config *conn_config =
+          Curl_ssl_cf_get_primary_config(cf);
+        if(!conn_config->verifypeer && !conn_config->verifyhost &&
+           inner && !strcmp(inner, connssl->peer.origin->hostname)) {
+          VERBOSE(status = "bad name (tolerated without peer verification)");
+          rv = SSL_ECH_STATUS_SUCCESS;
+        }
+        else {
+          VERBOSE(status = "bad name (unexpected)");
+        }
+        break;
+      }
+      default:
+        VERBOSE(status = "unexpected status");
+        infof(data, "ECH: unexpected status %d", rv);
+      }
+      infof(data, "ECH: result: status is %s, inner is %s, outer is %s",
+            (status ? status : "NULL"),
+            (inner ? inner : "NULL"),
+            (outer ? outer : "NULL"));
+      OPENSSL_free(inner);
+      OPENSSL_free(outer);
+      if(rv == SSL_ECH_STATUS_GREASE_ECH) {
+        /* trace retry_configs if we got some */
+        ossl_trace_ech_retry_configs(data, octx->ssl, 0);
+      }
+      if(rv != SSL_ECH_STATUS_SUCCESS && (data->set.tls_ech == CURLECH_HARD)) {
+        infof(data, "ECH: ech-hard failed");
+        return CURLE_SSL_CONNECT_ERROR;
+      }
+    }
+    else {
+      infof(data, "ECH: result: status is not attempted");
+    }
+#endif /* HAVE_SSL_SET1_ECH_CONFIG_LIST && !HAVE_BORINGSSL_LIKE */
 
-#ifdef HAS_ALPN
     /* Sets data and len to negotiated protocol, len is 0 if no protocol was
      * negotiated
      */
     if(connssl->alpn) {
       const unsigned char *neg_protocol;
       unsigned int len;
-      SSL_get0_alpn_selected(backend->handle, &neg_protocol, &len);
+      SSL_get0_alpn_selected(octx->ssl, &neg_protocol, &len);
 
-      return Curl_alpn_set_negotiated(cf, data, neg_protocol, len);
+      return Curl_alpn_set_negotiated(cf, data, connssl, neg_protocol, len);
     }
-#endif
 
     return CURLE_OK;
   }
@@ -3985,7 +4370,7 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
  * Heavily modified from:
  * https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning#OpenSSL
  */
-static CURLcode ossl_pkp_pin_peer_pubkey(struct Curl_easy *data, X509* cert,
+static CURLcode ossl_pkp_pin_peer_pubkey(struct Curl_easy *data, X509 *cert,
                                          const char *pinnedpubkey)
 {
   /* Scratch */
@@ -3995,7 +4380,7 @@ static CURLcode ossl_pkp_pin_peer_pubkey(struct Curl_easy *data, X509* cert,
   /* Result is returned to caller */
   CURLcode result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
 
-  /* if a path wasn't specified, don't pin */
+  /* if a path was not specified, do not pin */
   if(!pinnedpubkey)
     return CURLE_OK;
 
@@ -4003,26 +4388,23 @@ static CURLcode ossl_pkp_pin_peer_pubkey(struct Curl_easy *data, X509* cert,
     return result;
 
   do {
-    /* Begin Gyrations to get the subjectPublicKeyInfo     */
-    /* Thanks to Viktor Dukhovni on the OpenSSL mailing list */
-
-    /* https://groups.google.com/group/mailing.openssl.users/browse_thread
-       /thread/d61858dae102c6c7 */
+    /* Get the subjectPublicKeyInfo */
+    /* https://groups.google.com/group/mailing.openssl.users/browse_thread/thread/d61858dae102c6c7 */
     len1 = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), NULL);
     if(len1 < 1)
       break; /* failed */
 
-    buff1 = temp = malloc(len1);
+    buff1 = temp = curlx_malloc(len1);
     if(!buff1)
       break; /* failed */
 
-    /* https://www.openssl.org/docs/crypto/d2i_X509.html */
+    /* https://docs.openssl.org/master/man3/d2i_X509/ */
     len2 = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), &temp);
 
     /*
      * These checks are verifying we got back the same values as when we
-     * sized the buffer. It's pretty weak since they should always be the
-     * same. But it gives us something to test.
+     * sized the buffer. it is pretty weak since they should always be the
+     * same, but it gives us something to test.
      */
     if((len1 != len2) || !temp || ((temp - buff1) != len1))
       break; /* failed */
@@ -4034,229 +4416,436 @@ static CURLcode ossl_pkp_pin_peer_pubkey(struct Curl_easy *data, X509* cert,
   } while(0);
 
   if(buff1)
-    free(buff1);
+    curlx_free(buff1);
 
   return result;
 }
 
-/*
- * Get the server cert, verify it and show it, etc., only call failf() if the
- * 'strict' argument is TRUE as otherwise all this is for informational
- * purposes only!
- *
- * We check certificates to authenticate the server; otherwise we risk
- * man-in-the-middle attack.
- */
-static CURLcode servercert(struct Curl_cfilter *cf,
-                           struct Curl_easy *data,
-                           bool strict)
+#ifdef CURLVERBOSE
+#if !defined(HAVE_BORINGSSL_LIKE) && \
+  !(defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x3060000fL)
+static void infof_certstack(struct Curl_easy *data, const SSL *ssl)
+{
+  STACK_OF(X509) *certstack;
+  long verify_result;
+  int num_cert_levels;
+  int cert_level;
+
+  if(!Curl_trc_is_verbose(data))
+    return;
+
+  verify_result = SSL_get_verify_result(ssl);
+  if(verify_result != X509_V_OK)
+    certstack = SSL_get_peer_cert_chain(ssl);
+  else
+    certstack = SSL_get0_verified_chain(ssl);
+  if(!certstack)
+    return;
+  num_cert_levels = sk_X509_num(certstack);
+
+  for(cert_level = 0; cert_level < num_cert_levels; cert_level++) {
+    char cert_algorithm[80] = "";
+    char group_name_final[80] = "";
+    const X509_ALGOR *palg_cert = NULL;
+    const ASN1_OBJECT *paobj_cert = NULL;
+    X509 *current_cert;
+    EVP_PKEY *current_pkey;
+    int key_bits;
+    int key_sec_bits;
+    int get_group_name;
+    const char *type_name;
+
+    current_cert = sk_X509_value(certstack, cert_level);
+    if(!current_cert)
+      continue;
+
+    current_pkey = X509_get0_pubkey(current_cert);
+    if(!current_pkey)
+      continue;
+
+    X509_get0_signature(NULL, &palg_cert, current_cert);
+    X509_ALGOR_get0(&paobj_cert, NULL, NULL, palg_cert);
+    OBJ_obj2txt(cert_algorithm, sizeof(cert_algorithm), paobj_cert, 0);
+
+    key_bits = EVP_PKEY_bits(current_pkey);
+#ifndef HAVE_OPENSSL3
+#define EVP_PKEY_get_security_bits EVP_PKEY_security_bits
+#endif
+    key_sec_bits = EVP_PKEY_get_security_bits(current_pkey);
+#ifdef HAVE_OPENSSL3
+    {
+      char group_name[80] = "";
+      get_group_name = EVP_PKEY_get_group_name(current_pkey, group_name,
+                                               sizeof(group_name), NULL);
+      curl_msnprintf(group_name_final, sizeof(group_name_final), "/%s",
+                     group_name);
+    }
+    type_name = EVP_PKEY_get0_type_name(current_pkey);
+#else
+    get_group_name = 0;
+    type_name = NULL;
+#endif
+
+    infof(data, "  Certificate level %d: "
+          "Public key type %s%s (%d/%d Bits/secBits), signed using %s",
+          cert_level, type_name ? type_name : "?",
+          get_group_name == 0 ? "" : group_name_final,
+          key_bits, key_sec_bits, cert_algorithm);
+  }
+}
+#else
+#define infof_certstack(data, ssl)
+#endif
+#endif /* CURLVERBOSE */
+
+static CURLcode ossl_check_issuer(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  X509 *server_cert)
 {
-  struct connectdata *conn = cf->conn;
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
   struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
-  CURLcode result = CURLE_OK;
-  int rc;
-  long lerr;
-  X509 *issuer;
+  X509 *issuer = NULL;
   BIO *fp = NULL;
-  char error_buffer[256]="";
-  char buffer[2048];
+  char err_buf[256] = "";
+  bool verify_enabled = (conn_config->verifypeer || conn_config->verifyhost);
+  CURLcode result = CURLE_OK;
+
+  /* e.g. match issuer name with provided issuer certificate */
+  if(conn_config->issuercert_blob) {
+    fp = BIO_new_mem_buf(conn_config->issuercert_blob->data,
+                         (int)conn_config->issuercert_blob->len);
+    if(!fp) {
+      failf(data, "BIO_new_mem_buf NULL, " OSSL_PACKAGE " error %s",
+            ossl_strerror(ERR_get_error(), err_buf, sizeof(err_buf)));
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+  }
+  else if(conn_config->issuercert) {
+    fp = BIO_new(BIO_s_file());
+    if(!fp) {
+      failf(data, "BIO_new return NULL, " OSSL_PACKAGE " error %s",
+            ossl_strerror(ERR_get_error(), err_buf, sizeof(err_buf)));
+      result = CURLE_OUT_OF_MEMORY;
+      goto out;
+    }
+
+    if(BIO_read_filename(fp, conn_config->issuercert) <= 0) {
+      if(verify_enabled)
+        failf(data, "SSL: Unable to open issuer cert (%s)",
+              conn_config->issuercert);
+      result = CURLE_SSL_ISSUER_ERROR;
+      goto out;
+    }
+  }
+
+  if(fp) {
+    issuer = PEM_read_bio_X509(fp, NULL, ZERO_NULL, NULL);
+    if(!issuer) {
+      if(verify_enabled)
+        failf(data, "SSL: Unable to read issuer cert (%s)",
+              conn_config->issuercert);
+      result = CURLE_SSL_ISSUER_ERROR;
+      goto out;
+    }
+
+    if(X509_check_issued(issuer, server_cert) != X509_V_OK) {
+      if(verify_enabled)
+        failf(data, "SSL: Certificate issuer check failed (%s)",
+              conn_config->issuercert);
+      result = CURLE_SSL_ISSUER_ERROR;
+      goto out;
+    }
+
+    infof(data, " SSL certificate issuer check ok (%s)",
+          conn_config->issuercert);
+  }
+
+out:
+  if(fp)
+    BIO_free(fp);
+  if(issuer)
+    X509_free(issuer);
+  return result;
+}
+
+static CURLcode ossl_check_pinned_key(struct Curl_cfilter *cf,
+                                      struct Curl_easy *data,
+                                      X509 *server_cert)
+{
   const char *ptr;
-  BIO *mem = BIO_new(BIO_s_mem());
-  struct ossl_ssl_backend_data *backend =
-    (struct ossl_ssl_backend_data *)connssl->backend;
+  CURLcode result = CURLE_OK;
 
-  DEBUGASSERT(backend);
-
-  if(!mem) {
-    failf(data,
-          "BIO_new return NULL, " OSSL_PACKAGE
-          " error %s",
-          ossl_strerror(ERR_get_error(), error_buffer,
-                        sizeof(error_buffer)) );
-    return CURLE_OUT_OF_MEMORY;
-  }
-
-  if(data->set.ssl.certinfo)
-    /* asked to gather certificate info */
-    (void)Curl_ossl_certchain(data, backend->handle);
-
-  backend->server_cert = SSL_get1_peer_certificate(backend->handle);
-  if(!backend->server_cert) {
-    BIO_free(mem);
-    if(!strict)
-      return CURLE_OK;
-
-    failf(data, "SSL: couldn't get peer certificate");
-    return CURLE_PEER_FAILED_VERIFICATION;
-  }
-
-  infof(data, "%s certificate:",
-        Curl_ssl_cf_is_proxy(cf)? "Proxy" : "Server");
-
-  rc = x509_name_oneline(X509_get_subject_name(backend->server_cert),
-                         buffer, sizeof(buffer));
-  infof(data, " subject: %s", rc?"[NONE]":buffer);
-
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-  {
-    long len;
-    ASN1_TIME_print(mem, X509_get0_notBefore(backend->server_cert));
-    len = BIO_get_mem_data(mem, (char **) &ptr);
-    infof(data, " start date: %.*s", (int)len, ptr);
-    (void)BIO_reset(mem);
-
-    ASN1_TIME_print(mem, X509_get0_notAfter(backend->server_cert));
-    len = BIO_get_mem_data(mem, (char **) &ptr);
-    infof(data, " expire date: %.*s", (int)len, ptr);
-    (void)BIO_reset(mem);
-  }
-#endif
-
-  BIO_free(mem);
-
-  if(conn_config->verifyhost) {
-    result = ossl_verifyhost(data, conn, backend->server_cert,
-                             connssl->hostname, connssl->dispname);
-    if(result) {
-      X509_free(backend->server_cert);
-      backend->server_cert = NULL;
-      return result;
-    }
-  }
-
-  rc = x509_name_oneline(X509_get_issuer_name(backend->server_cert),
-                         buffer, sizeof(buffer));
-  if(rc) {
-    if(strict)
-      failf(data, "SSL: couldn't get X509-issuer name");
-    result = CURLE_PEER_FAILED_VERIFICATION;
-  }
-  else {
-    infof(data, " issuer: %s", buffer);
-
-    /* We could do all sorts of certificate verification stuff here before
-       deallocating the certificate. */
-
-    /* e.g. match issuer name with provided issuer certificate */
-    if(conn_config->issuercert || conn_config->issuercert_blob) {
-      if(conn_config->issuercert_blob) {
-        fp = BIO_new_mem_buf(conn_config->issuercert_blob->data,
-                             (int)conn_config->issuercert_blob->len);
-        if(!fp) {
-          failf(data,
-                "BIO_new_mem_buf NULL, " OSSL_PACKAGE
-                " error %s",
-                ossl_strerror(ERR_get_error(), error_buffer,
-                              sizeof(error_buffer)) );
-          X509_free(backend->server_cert);
-          backend->server_cert = NULL;
-          return CURLE_OUT_OF_MEMORY;
-        }
-      }
-      else {
-        fp = BIO_new(BIO_s_file());
-        if(!fp) {
-          failf(data,
-                "BIO_new return NULL, " OSSL_PACKAGE
-                " error %s",
-                ossl_strerror(ERR_get_error(), error_buffer,
-                              sizeof(error_buffer)) );
-          X509_free(backend->server_cert);
-          backend->server_cert = NULL;
-          return CURLE_OUT_OF_MEMORY;
-        }
-
-        if(BIO_read_filename(fp, conn_config->issuercert) <= 0) {
-          if(strict)
-            failf(data, "SSL: Unable to open issuer cert (%s)",
-                  conn_config->issuercert);
-          BIO_free(fp);
-          X509_free(backend->server_cert);
-          backend->server_cert = NULL;
-          return CURLE_SSL_ISSUER_ERROR;
-        }
-      }
-
-      issuer = PEM_read_bio_X509(fp, NULL, ZERO_NULL, NULL);
-      if(!issuer) {
-        if(strict)
-          failf(data, "SSL: Unable to read issuer cert (%s)",
-                conn_config->issuercert);
-        BIO_free(fp);
-        X509_free(issuer);
-        X509_free(backend->server_cert);
-        backend->server_cert = NULL;
-        return CURLE_SSL_ISSUER_ERROR;
-      }
-
-      if(X509_check_issued(issuer, backend->server_cert) != X509_V_OK) {
-        if(strict)
-          failf(data, "SSL: Certificate issuer check failed (%s)",
-                conn_config->issuercert);
-        BIO_free(fp);
-        X509_free(issuer);
-        X509_free(backend->server_cert);
-        backend->server_cert = NULL;
-        return CURLE_SSL_ISSUER_ERROR;
-      }
-
-      infof(data, " SSL certificate issuer check ok (%s)",
-            conn_config->issuercert);
-      BIO_free(fp);
-      X509_free(issuer);
-    }
-
-    lerr = SSL_get_verify_result(backend->handle);
-    ssl_config->certverifyresult = lerr;
-    if(lerr != X509_V_OK) {
-      if(conn_config->verifypeer) {
-        /* We probably never reach this, because SSL_connect() will fail
-           and we return earlier if verifypeer is set? */
-        if(strict)
-          failf(data, "SSL certificate verify result: %s (%ld)",
-                X509_verify_cert_error_string(lerr), lerr);
-        result = CURLE_PEER_FAILED_VERIFICATION;
-      }
-      else
-        infof(data, " SSL certificate verify result: %s (%ld),"
-              " continuing anyway.",
-              X509_verify_cert_error_string(lerr), lerr);
-    }
-    else
-      infof(data, " SSL certificate verify ok.");
-  }
-
-#if (OPENSSL_VERSION_NUMBER >= 0x0090808fL) && !defined(OPENSSL_NO_TLSEXT) && \
-  !defined(OPENSSL_NO_OCSP)
-  if(conn_config->verifystatus) {
-    result = verifystatus(cf, data);
-    if(result) {
-      X509_free(backend->server_cert);
-      backend->server_cert = NULL;
-      return result;
-    }
-  }
-#endif
-
-  if(!strict)
-    /* when not strict, we don't bother about the verify cert problems */
-    result = CURLE_OK;
-
-  ptr = Curl_ssl_cf_is_proxy(cf)?
-    data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY]:
+  (void)cf;
+#ifndef CURL_DISABLE_PROXY
+  ptr = Curl_ssl_cf_is_proxy(cf) ?
+    data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
     data->set.str[STRING_SSL_PINNEDPUBLICKEY];
-  if(!result && ptr) {
-    result = ossl_pkp_pin_peer_pubkey(data, backend->server_cert, ptr);
+#else
+  ptr = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
+#endif
+  if(ptr) {
+    result = ossl_pkp_pin_peer_pubkey(data, server_cert, ptr);
     if(result)
       failf(data, "SSL: public key does not match pinned public key");
   }
+  return result;
+}
 
-  X509_free(backend->server_cert);
-  backend->server_cert = NULL;
-  connssl->connecting_state = ssl_connect_done;
+#ifdef CURLVERBOSE
+#define MAX_CERT_NAME_LENGTH 2048
+static CURLcode ossl_infof_cert(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                X509 *server_cert)
+{
+  BIO *mem = NULL;
+  struct dynbuf dname;
+  char err_buf[256] = "";
+  char *buf;
+  long len;
+  CURLcode result = CURLE_OK;
 
+  if(!Curl_trc_is_verbose(data))
+    return CURLE_OK;
+
+  curlx_dyn_init(&dname, MAX_CERT_NAME_LENGTH);
+  mem = BIO_new(BIO_s_mem());
+  if(!mem) {
+    failf(data, "BIO_new return NULL, " OSSL_PACKAGE " error %s",
+          ossl_strerror(ERR_get_error(), err_buf, sizeof(err_buf)));
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  infof(data, "%s certificate:", Curl_ssl_cf_is_proxy(cf) ?
+        "Proxy" : "Server");
+
+  result = x509_name_oneline(X509_get_subject_name(server_cert), &dname);
+  infof(data, "  subject: %s", result ? "[NONE]" : curlx_dyn_ptr(&dname));
+
+  ASN1_TIME_print(mem, X509_get0_notBefore(server_cert));
+  len = BIO_get_mem_data(mem, (char **)&buf);
+  infof(data, "  start date: %.*s", (int)len, buf);
+  (void)BIO_reset(mem);
+
+  ASN1_TIME_print(mem, X509_get0_notAfter(server_cert));
+  len = BIO_get_mem_data(mem, (char **)&buf);
+  infof(data, "  expire date: %.*s", (int)len, buf);
+  (void)BIO_reset(mem);
+
+  result = x509_name_oneline(X509_get_issuer_name(server_cert), &dname);
+  if(result) /* should be only fatal stuff like OOM */
+    goto out;
+  infof(data, "  issuer: %s", curlx_dyn_ptr(&dname));
+
+out:
+  BIO_free(mem);
+  curlx_dyn_free(&dname);
+  return result;
+}
+#endif /* CURLVERBOSE */
+
+#ifdef USE_APPLE_SECTRUST
+struct ossl_certs_ctx {
+  STACK_OF(X509) *sk;
+  size_t num_certs;
+};
+
+static CURLcode ossl_chain_get_der(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data,
+                                   void *user_data,
+                                   size_t i,
+                                   unsigned char **pder,
+                                   size_t *pder_len)
+{
+  struct ossl_certs_ctx *chain = user_data;
+  X509 *cert;
+  int der_len;
+
+  (void)cf;
+  (void)data;
+  *pder_len = 0;
+  *pder = NULL;
+
+  if(i >= chain->num_certs)
+    return CURLE_TOO_LARGE;
+  cert = sk_X509_value(chain->sk, (int)i);
+  if(!cert)
+    return CURLE_FAILED_INIT;
+  der_len = i2d_X509(cert, pder);
+  if(der_len < 0)
+    return CURLE_FAILED_INIT;
+  *pder_len = (size_t)der_len;
+  return CURLE_OK;
+}
+
+static CURLcode ossl_apple_verify(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  struct ossl_ctx *octx,
+                                  struct ssl_peer *peer,
+                                  bool *pverified)
+{
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  struct ossl_certs_ctx chain;
+  CURLcode result;
+
+  memset(&chain, 0, sizeof(chain));
+  chain.sk = SSL_get_peer_cert_chain(octx->ssl);
+  chain.num_certs = chain.sk ? sk_X509_num(chain.sk) : 0;
+
+  if(!chain.num_certs &&
+     (conn_config->verifypeer || conn_config->verifyhost)) {
+    if(!octx->reused_session) {
+      failf(data, "SSL: could not get peer certificate chain");
+      result = CURLE_PEER_FAILED_VERIFICATION;
+    }
+    else {
+      /* when session was reused, there is no peer cert chain */
+      *pverified = FALSE;
+      return CURLE_OK;
+    }
+  }
+  else {
+#ifdef HAVE_BORINGSSL_LIKE
+    const uint8_t *ocsp_data = NULL;
+#else
+    unsigned char *ocsp_data = NULL;
+#endif
+    long ocsp_len = 0;
+    bool ocsp_missing = FALSE;
+    if(conn_config->verifystatus && !octx->reused_session)
+      ocsp_len = (long)SSL_get_tlsext_status_ocsp_resp(octx->ssl, &ocsp_data);
+
+    /* SSL_get_tlsext_status_ocsp_resp() returns the length of the OCSP
+       response data or -1 if there is no OCSP response data. */
+    if(ocsp_len < 0) {
+      ocsp_len = 0; /* no data available */
+      ocsp_missing = TRUE;
+    }
+    result = Curl_vtls_apple_verify(cf, data, peer, chain.num_certs,
+                                    ossl_chain_get_der, &chain,
+                                    ocsp_data, ocsp_len);
+    if(!result && ocsp_missing && conn_config->verifystatus &&
+       !octx->reused_session) {
+      /* verified, but OCSP stapling is required and server sent none */
+      *pverified = TRUE;
+      failf(data, "No OCSP response received");
+      return CURLE_SSL_INVALIDCERTSTATUS;
+    }
+  }
+  *pverified = !result;
+  return result;
+}
+#endif /* USE_APPLE_SECTRUST */
+
+CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data,
+                                   struct ossl_ctx *octx,
+                                   struct ssl_peer *peer)
+{
+  struct connectdata *conn = cf->conn;
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  CURLcode result = CURLE_OK;
+  long ossl_verify;
+  X509 *server_cert;
+  bool verified = FALSE;
+#if !defined(OPENSSL_NO_OCSP) && defined(USE_APPLE_SECTRUST)
+  bool sectrust_verified = FALSE;
+#endif
+
+  if(data->set.ssl.certinfo && !octx->reused_session) {
+    /* asked to gather certificate info. Reused sessions do not have cert
+       chains */
+    result = ossl_certchain(data, octx->ssl);
+    if(result)
+      return result;
+  }
+
+  server_cert = SSL_get1_peer_certificate(octx->ssl);
+  if(!server_cert) {
+    /* no verification at all, this maybe acceptable */
+    if(!(conn_config->verifypeer || conn_config->verifyhost))
+      goto out;
+
+    failf(data, "SSL: could not get peer certificate");
+    result = CURLE_PEER_FAILED_VERIFICATION;
+    goto out;
+  }
+
+#ifdef CURLVERBOSE
+  result = ossl_infof_cert(cf, data, server_cert);
+  if(result)
+    goto out;
+  infof_certstack(data, octx->ssl);
+#endif
+
+  if(conn_config->verifyhost) {
+    result = ossl_verifyhost(data, conn, peer, server_cert);
+    if(result)
+      goto out;
+  }
+  /* `verifyhost` is either OK or not requested from here on */
+
+  ossl_verify = SSL_get_verify_result(octx->ssl);
+  ssl_config->certverifyresult = ossl_verify;
+  infof(data, "OpenSSL verify result: %lx", (unsigned long)ossl_verify);
+
+  verified = (ossl_verify == X509_V_OK);
+  if(verified)
+    infof(data, "SSL certificate verified via OpenSSL.");
+
+#ifdef USE_APPLE_SECTRUST
+  if(!verified && conn_config->verifypeer && ssl_config->native_ca_store) {
+    /* we verify using Apple SecTrust *unless* OpenSSL already verified.
+     * This may happen if the application intercepted the OpenSSL callback
+     * and installed its own. */
+    result = ossl_apple_verify(cf, data, octx, peer, &verified);
+    if(result && (result != CURLE_PEER_FAILED_VERIFICATION))
+      goto out; /* unexpected error */
+    if(verified) {
+      infof(data, "SSL certificate verified via Apple SecTrust.");
+      ssl_config->certverifyresult = X509_V_OK;
+#ifndef OPENSSL_NO_OCSP
+      sectrust_verified = TRUE;
+#endif
+    }
+  }
+#endif
+
+  if(!verified) {
+    /* no trust established, report the OpenSSL status */
+    if(conn_config->verifypeer) {
+      failf(data, "SSL certificate OpenSSL verify result: %s (%ld)",
+            X509_verify_cert_error_string(ossl_verify), ossl_verify);
+      result = CURLE_PEER_FAILED_VERIFICATION;
+      goto out;
+    }
+    infof(data, " SSL certificate verification failed, continuing anyway!");
+  }
+
+#ifndef OPENSSL_NO_OCSP
+  if(conn_config->verifystatus &&
+#ifdef USE_APPLE_SECTRUST
+     !sectrust_verified && /* already verified via apple sectrust, cannot
+                            * verifystate via OpenSSL in that case as it
+                            * does not have the trust anchors */
+#endif
+     !octx->reused_session) {
+    /* do not do this after Session ID reuse */
+    result = verifystatus(cf, data, octx);
+    if(result)
+      goto out;
+  }
+#endif
+
+  result = ossl_check_issuer(cf, data, server_cert);
+  if(result)
+    goto out;
+
+  result = ossl_check_pinned_key(cf, data, server_cert);
+
+out:
+  X509_free(server_cert);
   return result;
 }
 
@@ -4265,35 +4854,110 @@ static CURLcode ossl_connect_step3(struct Curl_cfilter *cf,
 {
   CURLcode result = CURLE_OK;
   struct ssl_connect_data *connssl = cf->ctx;
-  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  struct ossl_ctx *octx = (struct ossl_ctx *)connssl->backend;
 
   DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);
 
   /*
    * We check certificates to authenticate the server; otherwise we risk
-   * man-in-the-middle attack; NEVERTHELESS, if we're told explicitly not to
+   * man-in-the-middle attack; NEVERTHELESS, if we are told explicitly not to
    * verify the peer, ignore faults and failures from the server cert
    * operations.
    */
 
-  result = servercert(cf, data, conn_config->verifypeer ||
-                      conn_config->verifyhost);
-
-  if(!result)
-    connssl->connecting_state = ssl_connect_done;
+  result = Curl_ossl_check_peer_cert(cf, data, octx, &connssl->peer);
+  if(result)
+    /* on error, remove sessions we might have in the pool */
+    Curl_ssl_scache_remove_all(cf, data, connssl->peer.scache_key);
 
   return result;
 }
 
-static CURLcode ossl_connect_common(struct Curl_cfilter *cf,
-                                    struct Curl_easy *data,
-                                    bool nonblocking,
-                                    bool *done)
+#ifdef HAVE_OPENSSL_EARLYDATA
+static CURLcode ossl_send_earlydata(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct ossl_ctx *octx = (struct ossl_ctx *)connssl->backend;
+  CURLcode result = CURLE_OK;
+  const unsigned char *buf;
+  size_t blen, nwritten;
+  int rc;
+
+  DEBUGASSERT(connssl->earlydata_state == ssl_earlydata_sending);
+  octx->io_result = CURLE_OK;
+  while(Curl_bufq_peek(&connssl->earlydata, &buf, &blen)) {
+    nwritten = 0;
+    rc = SSL_write_early_data(octx->ssl, buf, blen, &nwritten);
+    CURL_TRC_CF(data, cf, "SSL_write_early_data(len=%zu) -> %d, %zu",
+                blen, rc, nwritten);
+    if(rc <= 0) {
+      long sslerror;
+      char error_buffer[256];
+      int err = SSL_get_error(octx->ssl, rc);
+
+      switch(err) {
+      case SSL_ERROR_WANT_READ:
+        connssl->io_need = CURL_SSL_IO_NEED_RECV;
+        result = CURLE_AGAIN;
+        goto out;
+      case SSL_ERROR_WANT_WRITE:
+        connssl->io_need = CURL_SSL_IO_NEED_SEND;
+        result = CURLE_AGAIN;
+        goto out;
+      case SSL_ERROR_SYSCALL: {
+        int sockerr = SOCKERRNO;
+
+        if(octx->io_result == CURLE_AGAIN) {
+          result = CURLE_AGAIN;
+          goto out;
+        }
+        sslerror = ERR_get_error();
+        if(sslerror)
+          ossl_strerror(sslerror, error_buffer, sizeof(error_buffer));
+        else if(sockerr)
+          curlx_strerror(sockerr, error_buffer, sizeof(error_buffer));
+        else
+          curl_msnprintf(error_buffer, sizeof(error_buffer), "%s",
+                         SSL_ERROR_to_str(err));
+
+        failf(data, OSSL_PACKAGE " SSL_write:early_data: %s, errno %d",
+              error_buffer, sockerr);
+        result = CURLE_SEND_ERROR;
+        goto out;
+      }
+      case SSL_ERROR_SSL: {
+        /*  A failure in the SSL library occurred, usually a protocol error.
+            The OpenSSL error queue contains more information on the error. */
+        sslerror = ERR_get_error();
+        failf(data, "SSL_write_early_data() error: %s",
+              ossl_strerror(sslerror, error_buffer, sizeof(error_buffer)));
+        result = CURLE_SEND_ERROR;
+        goto out;
+      }
+      default:
+        /* a true error */
+        failf(data, OSSL_PACKAGE " SSL_write_early_data: %s, errno %d",
+              SSL_ERROR_to_str(err), SOCKERRNO);
+        result = CURLE_SEND_ERROR;
+        goto out;
+      }
+    }
+    Curl_bufq_skip(&connssl->earlydata, nwritten);
+  }
+  /* sent everything there was */
+  infof(data, "SSL sending %zu bytes of early data", connssl->earlydata_skip);
+out:
+  return result;
+}
+#endif /* HAVE_OPENSSL_EARLYDATA */
+
+static CURLcode ossl_connect(struct Curl_cfilter *cf,
+                             struct Curl_easy *data,
+                             bool *done)
 {
   CURLcode result = CURLE_OK;
   struct ssl_connect_data *connssl = cf->ctx;
-  curl_socket_t sockfd = Curl_conn_cf_get_socket(cf, data);
-  int what;
 
   /* check if the connection has already been established */
   if(ssl_connection_complete == connssl->state) {
@@ -4301,138 +4965,89 @@ static CURLcode ossl_connect_common(struct Curl_cfilter *cf,
     return CURLE_OK;
   }
 
+  *done = FALSE;
+  connssl->io_need = CURL_SSL_IO_NEED_NONE;
+
   if(ssl_connect_1 == connssl->connecting_state) {
-    /* Find out how much more time we're allowed */
-    const timediff_t timeout_ms = Curl_timeleft(data, NULL, TRUE);
-
-    if(timeout_ms < 0) {
-      /* no need to continue if time is already up */
-      failf(data, "SSL connection timeout");
-      return CURLE_OPERATION_TIMEDOUT;
+    if(Curl_ossl_need_httpsrr(data) &&
+       !Curl_conn_dns_resolved_https(data, cf->sockindex,
+                                     connssl->peer.peer)) {
+      CURL_TRC_CF(data, cf, "need HTTPS-RR, delaying connect");
+      return CURLE_OK;
     }
-
+    CURL_TRC_CF(data, cf, "ossl_connect, step1");
     result = ossl_connect_step1(cf, data);
     if(result)
       goto out;
   }
 
-  while(ssl_connect_2 == connssl->connecting_state ||
-        ssl_connect_2_reading == connssl->connecting_state ||
-        ssl_connect_2_writing == connssl->connecting_state) {
-
-    /* check allowed time left */
-    const timediff_t timeout_ms = Curl_timeleft(data, NULL, TRUE);
-
-    if(timeout_ms < 0) {
-      /* no need to continue if time already is up */
-      failf(data, "SSL connection timeout");
-      result = CURLE_OPERATION_TIMEDOUT;
+  if(ssl_connect_2 == connssl->connecting_state) {
+    CURL_TRC_CF(data, cf, "ossl_connect, step2");
+#ifdef HAVE_OPENSSL_EARLYDATA
+    if(connssl->earlydata_state == ssl_earlydata_await) {
       goto out;
     }
-
-    /* if ssl is expecting something, check if it's available. */
-    if(!nonblocking &&
-       (connssl->connecting_state == ssl_connect_2_reading ||
-        connssl->connecting_state == ssl_connect_2_writing)) {
-
-      curl_socket_t writefd = ssl_connect_2_writing ==
-        connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
-      curl_socket_t readfd = ssl_connect_2_reading ==
-        connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
-
-      what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd,
-                               timeout_ms);
-      if(what < 0) {
-        /* fatal error */
-        failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
-        result = CURLE_SSL_CONNECT_ERROR;
+    else if(connssl->earlydata_state == ssl_earlydata_sending) {
+      result = ossl_send_earlydata(cf, data);
+      if(result)
         goto out;
-      }
-      if(0 == what) {
-        /* timeout */
-        failf(data, "SSL connection timeout");
-        result = CURLE_OPERATION_TIMEDOUT;
-        goto out;
-      }
-      /* socket is readable or writable */
+      connssl->earlydata_state = ssl_earlydata_sent;
     }
+#endif
+    DEBUGASSERT((connssl->earlydata_state == ssl_earlydata_none) ||
+                (connssl->earlydata_state == ssl_earlydata_sent));
 
-    /* Run transaction, and return to the caller if it failed or if this
-     * connection is done nonblocking and this loop would execute again. This
-     * permits the owner of a multi handle to abort a connection attempt
-     * before step2 has completed while ensuring that a client using select()
-     * or epoll() will always have a valid fdset to wait on.
-     */
     result = ossl_connect_step2(cf, data);
-    if(result || (nonblocking &&
-                  (ssl_connect_2 == connssl->connecting_state ||
-                   ssl_connect_2_reading == connssl->connecting_state ||
-                   ssl_connect_2_writing == connssl->connecting_state)))
-      goto out;
-
-  } /* repeat step2 until all transactions are done. */
-
-  if(ssl_connect_3 == connssl->connecting_state) {
-    result = ossl_connect_step3(cf, data);
     if(result)
       goto out;
   }
 
-  if(ssl_connect_done == connssl->connecting_state) {
-    connssl->state = ssl_connection_complete;
-    *done = TRUE;
+  if(ssl_connect_3 == connssl->connecting_state) {
+    CURL_TRC_CF(data, cf, "ossl_connect, step3");
+    result = ossl_connect_step3(cf, data);
+    if(result)
+      goto out;
+    connssl->connecting_state = ssl_connect_done;
+#ifdef HAVE_OPENSSL_EARLYDATA
+    if(connssl->earlydata_state > ssl_earlydata_none) {
+      struct ossl_ctx *octx = (struct ossl_ctx *)connssl->backend;
+      /* We should be in this state by now */
+      DEBUGASSERT(connssl->earlydata_state == ssl_earlydata_sent);
+      connssl->earlydata_state =
+        (SSL_get_early_data_status(octx->ssl) == SSL_EARLY_DATA_ACCEPTED) ?
+        ssl_earlydata_accepted : ssl_earlydata_rejected;
+    }
+#endif
   }
-  else
-    *done = FALSE;
 
-  /* Reset our connect state machine */
-  connssl->connecting_state = ssl_connect_1;
+  if(ssl_connect_done == connssl->connecting_state) {
+    CURL_TRC_CF(data, cf, "ossl_connect, done");
+    connssl->state = ssl_connection_complete;
+  }
 
 out:
+  if(result == CURLE_AGAIN) {
+    *done = FALSE;
+    return CURLE_OK;
+  }
+  *done = ((connssl->state == ssl_connection_complete) ||
+           (connssl->state == ssl_connection_deferred));
   return result;
 }
 
-static CURLcode ossl_connect_nonblocking(struct Curl_cfilter *cf,
-                                         struct Curl_easy *data,
-                                         bool *done)
-{
-  return ossl_connect_common(cf, data, TRUE, done);
-}
-
-static CURLcode ossl_connect(struct Curl_cfilter *cf,
-                             struct Curl_easy *data)
-{
-  CURLcode result;
-  bool done = FALSE;
-
-  result = ossl_connect_common(cf, data, FALSE, &done);
-  if(result)
-    return result;
-
-  DEBUGASSERT(done);
-
-  return CURLE_OK;
-}
-
 static bool ossl_data_pending(struct Curl_cfilter *cf,
                               const struct Curl_easy *data)
 {
   struct ssl_connect_data *connssl = cf->ctx;
-  struct ossl_ssl_backend_data *backend =
-    (struct ossl_ssl_backend_data *)connssl->backend;
-
   (void)data;
-  DEBUGASSERT(connssl && backend);
-  if(backend->handle && SSL_pending(backend->handle))
-    return TRUE;
-  return FALSE;
+  return (bool)connssl->input_pending;
 }
 
-static ssize_t ossl_send(struct Curl_cfilter *cf,
-                         struct Curl_easy *data,
-                         const void *mem,
-                         size_t len,
-                         CURLcode *curlcode)
+static CURLcode ossl_send(struct Curl_cfilter *cf,
+                          struct Curl_easy *data,
+                          const void *mem,
+                          size_t len,
+                          size_t *pnwritten)
 {
   /* SSL_write() is said to return 'int' while write() and send() returns
      'size_t' */
@@ -4440,119 +5055,117 @@ static ssize_t ossl_send(struct Curl_cfilter *cf,
   char error_buffer[256];
   sslerr_t sslerror;
   int memlen;
-  int rc;
   struct ssl_connect_data *connssl = cf->ctx;
-  struct ossl_ssl_backend_data *backend =
-    (struct ossl_ssl_backend_data *)connssl->backend;
-
-  (void)data;
-  DEBUGASSERT(backend);
+  struct ossl_ctx *octx = (struct ossl_ctx *)connssl->backend;
+  CURLcode result = CURLE_OK;
+  int nwritten;
 
+  DEBUGASSERT(octx);
+  *pnwritten = 0;
   ERR_clear_error();
 
+  connssl->io_need = CURL_SSL_IO_NEED_NONE;
   memlen = (len > (size_t)INT_MAX) ? INT_MAX : (int)len;
-  rc = SSL_write(backend->handle, mem, memlen);
+  if(octx->blocked_ssl_write_len && (octx->blocked_ssl_write_len != memlen)) {
+    /* The previous SSL_write() call was blocked, using that length.
+     * We need to use that again or OpenSSL freaks out. A shorter
+     * length should not happen and is a bug in libcurl. */
+    if(octx->blocked_ssl_write_len > memlen) {
+      DEBUGASSERT(0);
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    }
+    memlen = octx->blocked_ssl_write_len;
+  }
+  octx->blocked_ssl_write_len = 0;
+  nwritten = SSL_write(octx->ssl, mem, memlen);
 
-  if(rc <= 0) {
-    err = SSL_get_error(backend->handle, rc);
+  if(nwritten > 0)
+    *pnwritten = (size_t)nwritten;
+  else {
+    err = SSL_get_error(octx->ssl, nwritten);
 
     switch(err) {
     case SSL_ERROR_WANT_READ:
-    case SSL_ERROR_WANT_WRITE:
-      /* The operation did not complete; the same TLS/SSL I/O function
-         should be called again later. This is basically an EWOULDBLOCK
-         equivalent. */
-      *curlcode = CURLE_AGAIN;
-      rc = -1;
+      connssl->io_need = CURL_SSL_IO_NEED_RECV;
+      octx->blocked_ssl_write_len = memlen;
+      result = CURLE_AGAIN;
       goto out;
-    case SSL_ERROR_SYSCALL:
-    {
+    case SSL_ERROR_WANT_WRITE:
+      result = CURLE_AGAIN;
+      octx->blocked_ssl_write_len = memlen;
+      goto out;
+    case SSL_ERROR_SYSCALL: {
       int sockerr = SOCKERRNO;
 
-      if(backend->io_result == CURLE_AGAIN) {
-        *curlcode = CURLE_AGAIN;
-        rc = -1;
+      if(octx->io_result == CURLE_AGAIN) {
+        octx->blocked_ssl_write_len = memlen;
+        result = CURLE_AGAIN;
         goto out;
       }
       sslerror = ERR_get_error();
       if(sslerror)
         ossl_strerror(sslerror, error_buffer, sizeof(error_buffer));
       else if(sockerr)
-        Curl_strerror(sockerr, error_buffer, sizeof(error_buffer));
-      else {
-        strncpy(error_buffer, SSL_ERROR_to_str(err), sizeof(error_buffer));
-        error_buffer[sizeof(error_buffer) - 1] = '\0';
-      }
+        curlx_strerror(sockerr, error_buffer, sizeof(error_buffer));
+      else
+        curl_msnprintf(error_buffer, sizeof(error_buffer), "%s",
+                       SSL_ERROR_to_str(err));
+
       failf(data, OSSL_PACKAGE " SSL_write: %s, errno %d",
             error_buffer, sockerr);
-      *curlcode = CURLE_SEND_ERROR;
-      rc = -1;
+      result = CURLE_SEND_ERROR;
       goto out;
     }
     case SSL_ERROR_SSL: {
       /*  A failure in the SSL library occurred, usually a protocol error.
           The OpenSSL error queue contains more information on the error. */
-      struct Curl_cfilter *cf_ssl_next = Curl_ssl_cf_get_ssl(cf->next);
-      struct ssl_connect_data *connssl_next = cf_ssl_next?
-        cf_ssl_next->ctx : NULL;
       sslerror = ERR_get_error();
-      if(ERR_GET_LIB(sslerror) == ERR_LIB_SSL &&
-         ERR_GET_REASON(sslerror) == SSL_R_BIO_NOT_SET &&
-         connssl->state == ssl_connection_complete &&
-         (connssl_next && connssl_next->state == ssl_connection_complete)
-        ) {
-        char ver[120];
-        (void)ossl_version(ver, sizeof(ver));
-        failf(data, "Error: %s does not support double SSL tunneling.", ver);
-      }
-      else
-        failf(data, "SSL_write() error: %s",
-              ossl_strerror(sslerror, error_buffer, sizeof(error_buffer)));
-      *curlcode = CURLE_SEND_ERROR;
-      rc = -1;
+      failf(data, "SSL_write() error: %s",
+            ossl_strerror(sslerror, error_buffer, sizeof(error_buffer)));
+      result = CURLE_SEND_ERROR;
       goto out;
     }
     default:
       /* a true error */
       failf(data, OSSL_PACKAGE " SSL_write: %s, errno %d",
             SSL_ERROR_to_str(err), SOCKERRNO);
-      *curlcode = CURLE_SEND_ERROR;
-      rc = -1;
+      result = CURLE_SEND_ERROR;
       goto out;
     }
   }
-  *curlcode = CURLE_OK;
 
 out:
-  return (ssize_t)rc; /* number of bytes */
+  return result;
 }
 
-static ssize_t ossl_recv(struct Curl_cfilter *cf,
-                         struct Curl_easy *data,   /* transfer */
-                         char *buf,                /* store read data here */
-                         size_t buffersize,        /* max amount to read */
-                         CURLcode *curlcode)
+static CURLcode ossl_recv(struct Curl_cfilter *cf,
+                          struct Curl_easy *data,   /* transfer */
+                          char *buf,                /* store read data here */
+                          size_t buffersize,        /* max amount to read */
+                          size_t *pnread)
 {
   char error_buffer[256];
   unsigned long sslerror;
-  ssize_t nread;
   int buffsize;
-  struct connectdata *conn = cf->conn;
   struct ssl_connect_data *connssl = cf->ctx;
-  struct ossl_ssl_backend_data *backend =
-    (struct ossl_ssl_backend_data *)connssl->backend;
+  struct ossl_ctx *octx = (struct ossl_ctx *)connssl->backend;
+  CURLcode result = CURLE_OK;
+  int nread;
 
-  (void)data;
-  DEBUGASSERT(backend);
+  DEBUGASSERT(octx);
 
+  *pnread = 0;
   ERR_clear_error();
 
+  connssl->io_need = CURL_SSL_IO_NEED_NONE;
   buffsize = (buffersize > (size_t)INT_MAX) ? INT_MAX : (int)buffersize;
-  nread = (ssize_t)SSL_read(backend->handle, buf, buffsize);
+  nread = SSL_read(octx->ssl, buf, buffsize);
 
-  if(nread <= 0) {
+  if(nread > 0)
+    *pnread = (size_t)nread;
+  else {
     /* failed SSL_read */
-    int err = SSL_get_error(backend->handle, (int)nread);
+    int err = SSL_get_error(octx->ssl, nread);
 
     switch(err) {
     case SSL_ERROR_NONE: /* this is not an error */
@@ -4562,21 +5175,22 @@ static ssize_t ossl_recv(struct Curl_cfilter *cf,
       if(cf->sockindex == FIRSTSOCKET)
         /* mark the connection for close if it is indeed the control
            connection */
-        connclose(conn, "TLS close_notify");
+        CURL_TRC_CF(data, cf, "TLS close_notify");
       break;
     case SSL_ERROR_WANT_READ:
+      connssl->io_need = CURL_SSL_IO_NEED_RECV;
+      result = CURLE_AGAIN;
+      goto out;
     case SSL_ERROR_WANT_WRITE:
-      /* there's data pending, re-invoke SSL_read() */
-      *curlcode = CURLE_AGAIN;
-      nread = -1;
+      connssl->io_need = CURL_SSL_IO_NEED_SEND;
+      result = CURLE_AGAIN;
       goto out;
     default:
       /* openssl/ssl.h for SSL_ERROR_SYSCALL says "look at error stack/return
          value/errno" */
-      /* https://www.openssl.org/docs/crypto/ERR_get_error.html */
-      if(backend->io_result == CURLE_AGAIN) {
-        *curlcode = CURLE_AGAIN;
-        nread = -1;
+      /* https://docs.openssl.org/master/man3/ERR_get_error/ */
+      if(octx->io_result == CURLE_AGAIN) {
+        result = CURLE_AGAIN;
         goto out;
       }
       sslerror = ERR_get_error();
@@ -4587,127 +5201,234 @@ static ssize_t ossl_recv(struct Curl_cfilter *cf,
         if(sslerror)
           ossl_strerror(sslerror, error_buffer, sizeof(error_buffer));
         else if(sockerr && err == SSL_ERROR_SYSCALL)
-          Curl_strerror(sockerr, error_buffer, sizeof(error_buffer));
-        else {
-          strncpy(error_buffer, SSL_ERROR_to_str(err), sizeof(error_buffer));
-          error_buffer[sizeof(error_buffer) - 1] = '\0';
-        }
+          curlx_strerror(sockerr, error_buffer, sizeof(error_buffer));
+        else
+          curl_msnprintf(error_buffer, sizeof(error_buffer), "%s",
+                         SSL_ERROR_to_str(err));
         failf(data, OSSL_PACKAGE " SSL_read: %s, errno %d",
               error_buffer, sockerr);
-        *curlcode = CURLE_RECV_ERROR;
-        nread = -1;
+        result = CURLE_RECV_ERROR;
         goto out;
       }
-      /* For debug builds be a little stricter and error on any
-         SSL_ERROR_SYSCALL. For example a server may have closed the connection
-         abruptly without a close_notify alert. For compatibility with older
-         peers we don't do this by default. #4624
-
-         We can use this to gauge how many users may be affected, and
-         if it goes ok eventually transition to allow in dev and release with
-         the newest OpenSSL: #if (OPENSSL_VERSION_NUMBER >= 0x10101000L) */
-#ifdef DEBUGBUILD
-      if(err == SSL_ERROR_SYSCALL) {
-        int sockerr = SOCKERRNO;
-        if(sockerr)
-          Curl_strerror(sockerr, error_buffer, sizeof(error_buffer));
-        else {
-          msnprintf(error_buffer, sizeof(error_buffer),
-                    "Connection closed abruptly");
+      else if(err == SSL_ERROR_SYSCALL) {
+        if(octx->io_result) {
+          /* logging handling in underlying filter already */
+          result = octx->io_result;
+        }
+        else if(connssl->peer_closed) {
+          failf(data, "Connection closed abruptly");
+          result = CURLE_RECV_ERROR;
+        }
+        else {
+          /* We should no longer get here nowadays, but handle
+           * the error in case of some weirdness in the OSSL stack */
+          int sockerr = SOCKERRNO;
+          if(sockerr)
+            curlx_strerror(sockerr, error_buffer, sizeof(error_buffer));
+          else {
+            curl_msnprintf(error_buffer, sizeof(error_buffer),
+                           "Connection closed abruptly");
+          }
+          failf(data, OSSL_PACKAGE " SSL_read: %s, errno %d",
+                error_buffer, sockerr);
+          result = CURLE_RECV_ERROR;
         }
-        failf(data, OSSL_PACKAGE " SSL_read: %s, errno %d"
-              " (Fatal because this is a curl debug build)",
-              error_buffer, sockerr);
-        *curlcode = CURLE_RECV_ERROR;
-        nread = -1;
         goto out;
       }
-#endif
     }
   }
 
 out:
-  return nread;
+  if((!result && !*pnread) || (result == CURLE_AGAIN)) {
+    /* This happens when:
+     * - we read an EOF
+     * - OpenSSLs buffers are empty, there is no more data
+     * - OpenSSL read is blocked on writing something first
+     * - an incomplete TLS packet is buffered that cannot be read
+     *   until more data arrives */
+    connssl->input_pending = FALSE;
+  }
+  CURL_TRC_CF(data, cf, "ossl_recv(len=%zu) -> %d, %zu (in_pending=%d)",
+              buffersize, (int)result, *pnread, connssl->input_pending);
+  return result;
 }
 
-static size_t ossl_version(char *buffer, size_t size)
+static CURLcode ossl_get_channel_binding(struct Curl_easy *data,
+                                         int sockindex,
+                                         struct dynbuf *binding)
+{
+  X509 *cert;
+  int mdnid;
+  bool no_digest_acceptable = FALSE;
+  const EVP_MD *algo_type = NULL;
+  const char *algo_name = NULL;
+  unsigned int length;
+  unsigned char buf[EVP_MAX_MD_SIZE];
+
+  const char prefix[] = "tls-server-end-point:";
+  struct connectdata *conn = data->conn;
+  struct Curl_cfilter *cf = conn->cfilter[sockindex];
+  struct ossl_ctx *octx = NULL;
+  CURLcode result = CURLE_OK;
+
+  do {
+    const struct Curl_cftype *cft = cf->cft;
+    struct ssl_connect_data *connssl = cf->ctx;
+
+    if(cft->name && !strcmp(cft->name, "SSL")) {
+      octx = (struct ossl_ctx *)connssl->backend;
+      break;
+    }
+
+    cf = cf->next;
+  } while(cf);
+
+  if(!octx) {
+    failf(data, "Failed to find the SSL filter");
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
+
+  cert = SSL_get1_peer_certificate(octx->ssl);
+  if(!cert)
+    /* No server certificate, do not do channel binding */
+    return CURLE_OK;
+
+#ifdef HAVE_OPENSSL3
+  {
+    int pknid, secbits;
+    uint32_t flags;
+    EVP_PKEY *pkey = X509_get0_pubkey(cert);
+
+    if(!X509_get_signature_info(cert, &mdnid, &pknid, &secbits, &flags)) {
+      failf(data, "certificate signature algorithm not recognized");
+      result = CURLE_SSL_INVALIDCERTSTATUS;
+      goto out;
+    }
+
+    if(mdnid != NID_undef) {
+      if(mdnid == NID_md5 || mdnid == NID_sha1) {
+        algo_type = EVP_sha256();
+      }
+      else
+        algo_type = EVP_get_digestbynid(mdnid);
+    }
+    else if(pkey && !EVP_PKEY_is_a(pkey, OBJ_nid2sn(pknid))) {
+      /* The cert's pkey is different from the algorithm used to sign
+       * the certificate. Since the reported `mdnid` is undefined, there
+       * is no digest algorithm available here. This happens in PQC
+       * and is accepted, resulting in no addition to the binding. */
+      no_digest_acceptable = TRUE;
+    }
+    else if(pkey) {
+      /* cert's pkey type is the same as the cert signer (or same family).
+       * Ask for the mandatory/advisory digest algorithm for the pkey.
+       */
+      char mdname[128] = "";
+      int rc = EVP_PKEY_get_default_digest_name(pkey, mdname, sizeof(mdname));
+      bool md_is_undef = !strcmp(mdname, "UNDEF");
+
+      if(rc == 2 && md_is_undef) {
+        /* OpenSSL declares "undef" the *mandatory* digest for this key.
+         * This is some PQC shit, accept it, no addition to binding. */
+        no_digest_acceptable = TRUE;
+      }
+      else if(rc > 0 && mdname[0] != '\0' && !md_is_undef) {
+        infof(data, "Digest algorithm : %s%s (derived from public key)"
+              ", but unavailable",
+              mdname, rc == 2 ? " [mandatory]" : " [advisory]");
+      }
+    }
+  }
+#else /* HAVE_OPENSSL3 */
+
+  if(!OBJ_find_sigid_algs(X509_get_signature_nid(cert), &mdnid, NULL)) {
+    failf(data,
+          "Unable to find digest NID for certificate signature algorithm");
+    result = CURLE_SSL_INVALIDCERTSTATUS;
+    goto out;
+  }
+
+  /* https://datatracker.ietf.org/doc/html/rfc5929#section-4.1 */
+  if(mdnid == NID_md5 || mdnid == NID_sha1) {
+    algo_type = EVP_sha256();
+  }
+  else {
+    algo_type = EVP_get_digestbynid(mdnid);
+    if(!algo_type) {
+      algo_name = OBJ_nid2sn(mdnid);
+      failf(data, "Could not find digest algorithm %s (NID %d)",
+            algo_name ? algo_name : "(null)", mdnid);
+      result = CURLE_SSL_INVALIDCERTSTATUS;
+      goto out;
+    }
+  }
+
+#endif /* HAVE_OPENSSL3, else */
+
+  if(!algo_type) {
+    if(no_digest_acceptable) {
+      infof(data, "certificate exposes no signing digest algorithm, "
+            "nothing to add to channel binding");
+      result = CURLE_OK;
+      goto out;
+    }
+    /* unacceptable, something is wrong, fail */
+    algo_name = OBJ_nid2sn(mdnid);
+    failf(data, "Unable to find digest algorithm %s (NID %d) "
+          "for channel binding", algo_name ? algo_name : "(null)", mdnid);
+    result = CURLE_SSL_INVALIDCERTSTATUS;
+    goto out;
+  }
+
+  if(!X509_digest(cert, algo_type, buf, &length)) {
+    failf(data, "X509_digest() failed for channel binding");
+    result = CURLE_SSL_INVALIDCERTSTATUS;
+    goto out;
+  }
+
+  /* Append "tls-server-end-point:" */
+  result = curlx_dyn_addn(binding, prefix, sizeof(prefix) - 1);
+  if(result)
+    goto out;
+
+  /* Append digest */
+  result = curlx_dyn_addn(binding, buf, length);
+
+out:
+  X509_free(cert);
+  return result;
+}
+
+size_t Curl_ossl_version(char *buffer, size_t size)
 {
 #ifdef LIBRESSL_VERSION_NUMBER
-#ifdef HAVE_OPENSSL_VERSION
   char *p;
-  int count;
+  size_t count;
   const char *ver = OpenSSL_version(OPENSSL_VERSION);
   const char expected[] = OSSL_PACKAGE " "; /* ie "LibreSSL " */
-  if(strncasecompare(ver, expected, sizeof(expected) - 1)) {
+  if(curl_strnequal(ver, expected, sizeof(expected) - 1)) {
     ver += sizeof(expected) - 1;
   }
-  count = msnprintf(buffer, size, "%s/%s", OSSL_PACKAGE, ver);
+  count = curl_msnprintf(buffer, size, "%s/%s", OSSL_PACKAGE, ver);
   for(p = buffer; *p; ++p) {
     if(ISBLANK(*p))
       *p = '_';
   }
   return count;
-#else
-  return msnprintf(buffer, size, "%s/%lx.%lx.%lx",
-                   OSSL_PACKAGE,
-                   (LIBRESSL_VERSION_NUMBER>>28)&0xf,
-                   (LIBRESSL_VERSION_NUMBER>>20)&0xff,
-                   (LIBRESSL_VERSION_NUMBER>>12)&0xff);
-#endif
+#elif defined(OPENSSL_IS_AWSLC)
+  return curl_msnprintf(buffer, size, "%s/%s",
+                        OSSL_PACKAGE, AWSLC_VERSION_NUMBER_STRING);
 #elif defined(OPENSSL_IS_BORINGSSL)
 #ifdef CURL_BORINGSSL_VERSION
-  return msnprintf(buffer, size, "%s/%s",
-                   OSSL_PACKAGE,
-                   CURL_BORINGSSL_VERSION);
+  return curl_msnprintf(buffer, size, "%s/%s",
+                        OSSL_PACKAGE, CURL_BORINGSSL_VERSION);
 #else
-  return msnprintf(buffer, size, OSSL_PACKAGE);
+  return curl_msnprintf(buffer, size, OSSL_PACKAGE);
 #endif
-#elif defined(OPENSSL_IS_AWSLC)
-  return msnprintf(buffer, size, "%s/%s",
-                   OSSL_PACKAGE,
-                   AWSLC_VERSION_NUMBER_STRING);
-#elif defined(HAVE_OPENSSL_VERSION) && defined(OPENSSL_VERSION_STRING)
-  return msnprintf(buffer, size, "%s/%s",
-                   OSSL_PACKAGE, OpenSSL_version(OPENSSL_VERSION_STRING));
-#else
-  /* not LibreSSL, BoringSSL and not using OpenSSL_version */
-
-  char sub[3];
-  unsigned long ssleay_value;
-  sub[2]='\0';
-  sub[1]='\0';
-  ssleay_value = OpenSSL_version_num();
-  if(ssleay_value < 0x906000) {
-    ssleay_value = SSLEAY_VERSION_NUMBER;
-    sub[0]='\0';
-  }
-  else {
-    if(ssleay_value&0xff0) {
-      int minor_ver = (ssleay_value >> 4) & 0xff;
-      if(minor_ver > 26) {
-        /* handle extended version introduced for 0.9.8za */
-        sub[1] = (char) ((minor_ver - 1) % 26 + 'a' + 1);
-        sub[0] = 'z';
-      }
-      else {
-        sub[0] = (char) (minor_ver + 'a' - 1);
-      }
-    }
-    else
-      sub[0]='\0';
-  }
-
-  return msnprintf(buffer, size, "%s/%lx.%lx.%lx%s"
-#ifdef OPENSSL_FIPS
-                   "-fips"
+#else /* OpenSSL 3+ */
+  return curl_msnprintf(buffer, size, "%s/%s",
+                        OSSL_PACKAGE, OpenSSL_version(OPENSSL_VERSION_STRING));
 #endif
-                   ,
-                   OSSL_PACKAGE,
-                   (ssleay_value>>28)&0xf,
-                   (ssleay_value>>20)&0xff,
-                   (ssleay_value>>12)&0xff,
-                   sub);
-#endif /* OPENSSL_IS_BORINGSSL */
 }
 
 /* can be called with data == NULL */
@@ -4717,45 +5438,44 @@ static CURLcode ossl_random(struct Curl_easy *data,
   int rc;
   if(data) {
     if(ossl_seed(data)) /* Initiate the seed if not already done */
-      return CURLE_FAILED_INIT; /* couldn't seed for some reason */
+      return CURLE_FAILED_INIT; /* could not seed for some reason */
   }
   else {
     if(!rand_enough())
       return CURLE_FAILED_INIT;
   }
-  /* RAND_bytes() returns 1 on success, 0 otherwise.  */
-  rc = RAND_bytes(entropy, curlx_uztosi(length));
-  return (rc == 1 ? CURLE_OK : CURLE_FAILED_INIT);
+  /* RAND_bytes() returns 1 on success, 0 otherwise. */
+  rc = RAND_bytes(entropy, (ossl_valsize_t)curlx_uztosi(length));
+  return rc == 1 ? CURLE_OK : CURLE_FAILED_INIT;
 }
 
-#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
-static CURLcode ossl_sha256sum(const unsigned char *tmp, /* input */
-                               size_t tmplen,
+static CURLcode ossl_sha256sum(const unsigned char *input,
+                               size_t len,
                                unsigned char *sha256sum /* output */,
                                size_t unused)
 {
+  CURLcode result = CURLE_OK;
   EVP_MD_CTX *mdctx;
-  unsigned int len = 0;
-  (void) unused;
+  (void)unused;
 
   mdctx = EVP_MD_CTX_create();
   if(!mdctx)
     return CURLE_OUT_OF_MEMORY;
   if(!EVP_DigestInit(mdctx, EVP_sha256())) {
-    EVP_MD_CTX_destroy(mdctx);
-    return CURLE_FAILED_INIT;
+    result = CURLE_FAILED_INIT;
+    goto out;
   }
-  EVP_DigestUpdate(mdctx, tmp, tmplen);
-  EVP_DigestFinal_ex(mdctx, sha256sum, &len);
+  if(!EVP_DigestUpdate(mdctx, input, len) ||
+     !EVP_DigestFinal_ex(mdctx, sha256sum, NULL))
+    result = CURLE_BAD_FUNCTION_ARGUMENT;
+out:
   EVP_MD_CTX_destroy(mdctx);
-  return CURLE_OK;
+  return result;
 }
-#endif
 
 static bool ossl_cert_status_request(void)
 {
-#if (OPENSSL_VERSION_NUMBER >= 0x0090808fL) && !defined(OPENSSL_NO_TLSEXT) && \
-  !defined(OPENSSL_NO_OCSP)
+#ifndef OPENSSL_NO_OCSP
   return TRUE;
 #else
   return FALSE;
@@ -4766,25 +5486,10 @@ static void *ossl_get_internals(struct ssl_connect_data *connssl,
                                 CURLINFO info)
 {
   /* Legacy: CURLINFO_TLS_SESSION must return an SSL_CTX pointer. */
-  struct ossl_ssl_backend_data *backend =
-    (struct ossl_ssl_backend_data *)connssl->backend;
-  DEBUGASSERT(backend);
+  struct ossl_ctx *octx = (struct ossl_ctx *)connssl->backend;
+  DEBUGASSERT(octx);
   return info == CURLINFO_TLS_SESSION ?
-    (void *)backend->ctx : (void *)backend->handle;
-}
-
-static void ossl_free_multi_ssl_backend_data(
-  struct multi_ssl_backend_data *mbackend)
-{
-#if defined(HAVE_SSL_X509_STORE_SHARE)
-  if(mbackend->store) {
-    X509_STORE_free(mbackend->store);
-  }
-  free(mbackend->CAfile);
-  free(mbackend);
-#else /* HAVE_SSL_X509_STORE_SHARE */
-  (void)mbackend;
-#endif /* HAVE_SSL_X509_STORE_SHARE */
+    (void *)octx->ssl_ctx : (void *)octx->ssl;
 }
 
 const struct Curl_ssl Curl_ssl_openssl = {
@@ -4798,39 +5503,41 @@ const struct Curl_ssl Curl_ssl_openssl = {
 #ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
   SSLSUPP_TLS13_CIPHERSUITES |
 #endif
-  SSLSUPP_HTTPS_PROXY,
+#ifdef HAVE_SSL_CTX_SET1_SIGALGS
+  SSLSUPP_SIGNATURE_ALGORITHMS |
+#endif
+#ifdef HAVE_SSL_SET1_ECH_CONFIG_LIST
+  SSLSUPP_ECH |
+#endif
+  SSLSUPP_CA_CACHE |
+  SSLSUPP_HTTPS_PROXY |
+  SSLSUPP_CIPHER_LIST |
+  SSLSUPP_ISSUERCERT |
+  SSLSUPP_ISSUERCERT_BLOB |
+  SSLSUPP_SSL_EC_CURVES |
+  SSLSUPP_CRLFILE,
 
-  sizeof(struct ossl_ssl_backend_data),
+  sizeof(struct ossl_ctx),
 
   ossl_init,                /* init */
   ossl_cleanup,             /* cleanup */
-  ossl_version,             /* version */
-  Curl_none_check_cxn,      /* check_cxn */
+  Curl_ossl_version,        /* version */
   ossl_shutdown,            /* shutdown */
   ossl_data_pending,        /* data_pending */
   ossl_random,              /* random */
   ossl_cert_status_request, /* cert_status_request */
   ossl_connect,             /* connect */
-  ossl_connect_nonblocking, /* connect_nonblocking */
-  Curl_ssl_get_select_socks,/* getsock */
+  Curl_ssl_adjust_pollset,  /* adjust_pollset */
   ossl_get_internals,       /* get_internals */
   ossl_close,               /* close_one */
   ossl_close_all,           /* close_all */
-  ossl_session_free,        /* session_free */
-  ossl_set_engine,          /* set_engine */
+  ossl_set_engine,          /* set_engine or provider */
   ossl_set_engine_default,  /* set_engine_default */
   ossl_engines_list,        /* engines_list */
-  Curl_none_false_start,    /* false_start */
-#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
   ossl_sha256sum,           /* sha256sum */
-#else
-  NULL,                     /* sha256sum */
-#endif
-  NULL,                     /* use of data in this connection */
-  NULL,                     /* remote of data from this connection */
-  ossl_free_multi_ssl_backend_data, /* free_multi_ssl_backend_data */
   ossl_recv,                /* recv decrypted data */
   ossl_send,                /* send data to encrypt */
+  ossl_get_channel_binding  /* get_channel_binding */
 };
 
 #endif /* USE_OPENSSL */
diff --git a/third-party/curl/lib/vtls/openssl.h b/third-party/curl/lib/vtls/openssl.h
index 950faab889..4fa466b367 100644
--- a/third-party/curl/lib/vtls/openssl.h
+++ b/third-party/curl/lib/vtls/openssl.h
@@ -23,47 +23,176 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
 #ifdef USE_OPENSSL
+
+#ifdef USE_WIN32_CRYPTO
+#include <wincrypt.h>
+/* If <wincrypt.h> is included directly, or indirectly via <schannel.h>,
+ * <winldap.h>, <iphlpapi.h>, or something else, <wincrypt.h> does this:
+ *   #define X509_NAME  ((LPCSTR)7)
+ *
+ * In AWC-LC/BoringSSL's <openssl/base.h> there is:
+ *  typedef struct X509_name_st X509_NAME;
+ *  etc.
+ *
+ * The redefined symbols break these OpenSSL headers when included after
+ * <wincrypt.h>.
+ * The workaround is to undefine those defines here (and only here).
+ *
+ * For unity builds it may need to be repeated elsewhere too, e.g. in ldap.c,
+ * to apply to other sources using OpenSSL includes. Each compilation unit
+ * needs undefine them between the first <wincrypt.h> include and the first
+ * OpenSSL include.
+ *
+ * OpenSSL does this in <openssl/ssl.h> and <openssl/x509v3.h>, but it
+ * also does the #undef by including <openssl/ossl_typ.h>. <3.1.0 only does
+ * it on the first include.
+ *
+ * LibreSSL automatically undefines these symbols before using them.
+ */
+#undef X509_NAME
+#undef X509_EXTENSIONS
+#undef PKCS7_ISSUER_AND_SERIAL
+#undef PKCS7_SIGNER_INFO
+#undef OCSP_REQUEST
+#undef OCSP_RESPONSE
+#endif /* USE_WIN32_CRYPTO */
+
 /*
  * This header should only be needed to get included by vtls.c, openssl.c
  * and ngtcp2.c
  */
+#include <openssl/opensslv.h>
+#include <openssl/ossl_typ.h>
 #include <openssl/ssl.h>
 
 #include "urldata.h"
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#define HAVE_OPENSSL3  /* non-fork OpenSSL 3.x or later */
+#endif
+
+#if defined(OPENSSL_IS_AWSLC) || defined(OPENSSL_IS_BORINGSSL)
+#define HAVE_BORINGSSL_LIKE
+#endif
+
+/* OpenSSL 3.5.0+ has built-in 'SSLKEYLOGFILE' support if built with
+   'enable-sslkeylog' */
+#if OPENSSL_VERSION_NUMBER >= 0x30500000L && !defined(OPENSSL_NO_SSLKEYLOG)
+#define HAVE_KEYLOG_UPSTREAM
+#endif
+
 /*
- * In an effort to avoid using 'X509 *' here, we instead use the struct
- * x509_st version of the type so that we can forward-declare it here without
- * having to include <openssl/x509v3.h>. Including that header causes name
- * conflicts when libcurl is built with both Schannel and OpenSSL support.
+ * Whether SSL_CTX_set_keylog_callback is available.
+ * BoringSSL: supported since d28f59c27bac (committed 2015-11-19)
+ * LibreSSL: not supported. 3.5.0+ has a stub function that does nothing.
+ * OpenSSL: supported since 1.1.1 https://github.com/openssl/openssl/pull/2287
  */
-struct x509_st;
-CURLcode Curl_ossl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
-                              struct x509_st *server_cert);
+#ifndef LIBRESSL_VERSION_NUMBER
+#define HAVE_KEYLOG_CALLBACK
+#endif
+
+/* Check for OpenSSL 1.1.1 which has early data support. */
+#undef HAVE_OPENSSL_EARLYDATA
+#if defined(TLS1_3_VERSION) && !defined(HAVE_BORINGSSL_LIKE)
+#define HAVE_OPENSSL_EARLYDATA
+#endif
+
+struct alpn_spec;
+struct ssl_peer;
+struct Curl_ssl_session;
+
+/* Struct to hold a curl OpenSSL instance */
+struct ossl_ctx {
+  /* these ones requires specific SSL-types */
+  SSL_CTX *ssl_ctx;
+  SSL *ssl;
+  BIO_METHOD *bio_method;
+  CURLcode io_result;       /* result of last BIO cfilter operation */
+  /* blocked writes need to retry with same length, remember it */
+  int blocked_ssl_write_len;
+#if !defined(HAVE_KEYLOG_UPSTREAM) && !defined(HAVE_KEYLOG_CALLBACK)
+  /* Set to true once a valid keylog entry has been created to avoid dupes.
+     This is a bool and not a bitfield because it is passed by address. */
+  bool keylog_done;
+#endif
+  BIT(x509_store_setup);            /* x509 store has been set up */
+  BIT(store_is_empty);              /* no certs/paths/blobs in x509 store */
+  BIT(reused_session);              /* session-ID was reused for this */
+};
+
+size_t Curl_ossl_version(char *buffer, size_t size);
+
+typedef CURLcode Curl_ossl_ctx_setup_cb(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data,
+                                        void *user_data);
+
+typedef int Curl_ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid);
+typedef CURLcode Curl_ossl_init_session_reuse_cb(struct Curl_cfilter *cf,
+                                                 struct Curl_easy *data,
+                                                 struct alpn_spec *alpns,
+                                                 struct Curl_ssl_session *scs,
+                                                 bool *do_early_data);
+
+CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
+                            struct Curl_cfilter *cf,
+                            struct Curl_easy *data,
+                            struct ssl_peer *peer,
+                            const struct alpn_spec *alpns_requested,
+                            Curl_ossl_ctx_setup_cb *cb_setup,
+                            void *cb_user_data,
+                            Curl_ossl_new_session_cb *cb_new_session,
+                            void *ssl_user_data,
+                            Curl_ossl_init_session_reuse_cb *sess_reuse_cb);
+
+/* Is a resolved HTTPS-RR needed for initializing OpenSSL? */
+bool Curl_ossl_need_httpsrr(struct Curl_easy *data);
+
+#ifndef HAVE_OPENSSL3
+#define SSL_get1_peer_certificate SSL_get_peer_certificate
+#endif
+
 extern const struct Curl_ssl Curl_ssl_openssl;
 
-struct ssl_ctx_st;
-CURLcode Curl_ossl_set_client_cert(struct Curl_easy *data,
-                                   struct ssl_ctx_st *ctx, char *cert_file,
-                                   const struct curl_blob *cert_blob,
-                                   const char *cert_type, char *key_file,
-                                   const struct curl_blob *key_blob,
-                                   const char *key_type, char *key_passwd);
-
-CURLcode Curl_ossl_certchain(struct Curl_easy *data, SSL *ssl);
-
 /**
  * Setup the OpenSSL X509_STORE in `ssl_ctx` for the cfilter `cf` and
- * easy handle `data`. Will allow reuse of a shared cache if suitable
+ * easy handle `data`. Allows reuse of a shared cache if suitable
  * and configured.
  */
 CURLcode Curl_ssl_setup_x509_store(struct Curl_cfilter *cf,
                                    struct Curl_easy *data,
-                                   SSL_CTX *ssl_ctx);
+                                   struct ossl_ctx *octx);
+
+CURLcode Curl_ossl_ctx_configure(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 SSL_CTX *ssl_ctx);
+
+/*
+ * Add a new session to the cache. Takes ownership of the session.
+ */
+CURLcode Curl_ossl_add_session(struct Curl_cfilter *cf,
+                               struct Curl_easy *data,
+                               const char *ssl_peer_key,
+                               SSL_SESSION *session,
+                               int ietf_tls_id,
+                               const char *alpn,
+                               unsigned char *quic_tp,
+                               size_t quic_tp_len);
+
+/*
+ * Get the server cert, verify it and show it, etc., only call failf() if
+ * SSL config verifypeer or -host is set. Otherwise all this is for
+ * informational purposes only!
+ */
+CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data,
+                                   struct ossl_ctx *octx,
+                                   struct ssl_peer *peer);
+
+/* Report properties of a successful handshake */
+void Curl_ossl_report_handshake(struct Curl_easy *data, struct ossl_ctx *octx);
 
 #endif /* USE_OPENSSL */
 #endif /* HEADER_CURL_SSLUSE_H */
diff --git a/third-party/curl/lib/vtls/rustls.c b/third-party/curl/lib/vtls/rustls.c
index a3e9d964c9..950f170212 100644
--- a/third-party/curl/lib/vtls/rustls.c
+++ b/third-party/curl/lib/vtls/rustls.c
@@ -5,8 +5,9 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) Jacob Hoffman-Andrews,
- * <github@hoffman-andrews.com>
+ * Copyright (C) Jacob Hoffman-Andrews, <github@hoffman-andrews.com>
+ * Copyright (C) kpcyrd, <kpcyrd@archlinux.org>
+ * Copyright (C) Daniel McCarney, <daniel@binaryparadox.net>
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -26,61 +27,73 @@
 
 #ifdef USE_RUSTLS
 
-#include "curl_printf.h"
-
-#include <errno.h>
 #include <rustls.h>
 
-#include "inet_pton.h"
+#include "curlx/fopen.h"
+#include "curlx/strerr.h"
 #include "urldata.h"
-#include "sendf.h"
-#include "vtls.h"
-#include "vtls_int.h"
-#include "select.h"
-#include "strerror.h"
-#include "multiif.h"
+#include "cf-dns.h"
+#include "curl_trc.h"
+#include "httpsrr.h"
+#include "vtls/vtls.h"
+#include "vtls/vtls_int.h"
+#include "vtls/rustls.h"
+#include "vtls/keylog.h"
+#include "vtls/cipher_suite.h"
+#include "vtls/x509asn1.h"
+#ifdef USE_ECH
+#include "curlx/base64.h"
+#endif
 
-struct rustls_ssl_backend_data
-{
+#if EAGAIN != EWOULDBLOCK
+#define RAW_EAGAIN(e) ((e) == EWOULDBLOCK || (e) == EAGAIN)
+#else
+#define RAW_EAGAIN(e) ((e) == EWOULDBLOCK)
+#endif
+
+struct rustls_ssl_backend_data {
   const struct rustls_client_config *config;
   struct rustls_connection *conn;
-  bool data_pending;
+  size_t plain_out_buffered;
+  BIT(data_in_pending);
+  BIT(sent_shutdown);
 };
 
 /* For a given rustls_result error code, return the best-matching CURLcode. */
-static CURLcode map_error(rustls_result r)
+static CURLcode map_error(const rustls_result r)
 {
   if(rustls_result_is_cert_error(r)) {
     return CURLE_PEER_FAILED_VERIFICATION;
   }
   switch(r) {
-    case RUSTLS_RESULT_OK:
-      return CURLE_OK;
-    case RUSTLS_RESULT_NULL_PARAMETER:
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    default:
-      return CURLE_READ_ERROR;
+  case RUSTLS_RESULT_OK:
+    return CURLE_OK;
+  case RUSTLS_RESULT_NULL_PARAMETER:
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  default:
+    return CURLE_RECV_ERROR;
   }
 }
 
-static bool
-cr_data_pending(struct Curl_cfilter *cf, const struct Curl_easy *data)
+static void rustls_failf(struct Curl_easy *data, const rustls_result rr,
+                         const char *msg)
 {
-  struct ssl_connect_data *ctx = cf->ctx;
+  char errorbuf[STRERROR_LEN];
+  size_t errorlen;
+  rustls_error(rr, errorbuf, sizeof(errorbuf), &errorlen);
+  failf(data, "%s: %.*s", msg, (int)errorlen, errorbuf);
+}
+
+static bool cr_data_pending(struct Curl_cfilter *cf,
+                            const struct Curl_easy *data)
+{
+  const struct ssl_connect_data *ctx = cf->ctx;
   struct rustls_ssl_backend_data *backend;
 
   (void)data;
   DEBUGASSERT(ctx && ctx->backend);
   backend = (struct rustls_ssl_backend_data *)ctx->backend;
-  return backend->data_pending;
-}
-
-static CURLcode
-cr_connect(struct Curl_cfilter *cf UNUSED_PARAM,
-           struct Curl_easy *data UNUSED_PARAM)
-{
-  infof(data, "rustls_connect: unimplemented");
-  return CURLE_SSL_CONNECT_ERROR;
+  return (bool)backend->data_in_pending;
 }
 
 struct io_ctx {
@@ -88,53 +101,61 @@ struct io_ctx {
   struct Curl_easy *data;
 };
 
-static int
-read_cb(void *userdata, uint8_t *buf, uintptr_t len, uintptr_t *out_n)
+static int read_cb(void *userdata, uint8_t *buf, uintptr_t len,
+                   uintptr_t *out_n)
 {
-  struct io_ctx *io_ctx = userdata;
+  const struct io_ctx *io_ctx = userdata;
+  struct ssl_connect_data * const connssl = io_ctx->cf->ctx;
   CURLcode result;
   int ret = 0;
-  ssize_t nread = Curl_conn_cf_recv(io_ctx->cf->next, io_ctx->data,
-                                    (char *)buf, len, &result);
-  if(nread < 0) {
+  size_t nread;
+
+  result = Curl_conn_cf_recv(io_ctx->cf->next, io_ctx->data,
+                             (char *)buf, len, &nread);
+  if(result) {
     nread = 0;
-    if(CURLE_AGAIN == result)
+    /* !checksrc! disable ERRNOVAR 4 */
+    if(result == CURLE_AGAIN)
       ret = EAGAIN;
     else
       ret = EINVAL;
   }
-  *out_n = (int)nread;
+  else if(nread == 0)
+    connssl->peer_closed = TRUE;
+  *out_n = (uintptr_t)nread;
+  CURL_TRC_CF(io_ctx->data, io_ctx->cf, "cf->next recv(len=%zu) -> %d, %zu",
+              (size_t)len, (int)result, nread);
   return ret;
 }
 
-static int
-write_cb(void *userdata, const uint8_t *buf, uintptr_t len, uintptr_t *out_n)
+static int write_cb(void *userdata, const uint8_t *buf, uintptr_t len,
+                    uintptr_t *out_n)
 {
-  struct io_ctx *io_ctx = userdata;
+  const struct io_ctx *io_ctx = userdata;
   CURLcode result;
   int ret = 0;
-  ssize_t nwritten = Curl_conn_cf_send(io_ctx->cf->next, io_ctx->data,
-                                       (const char *)buf, len, &result);
-  if(nwritten < 0) {
+  size_t nwritten;
+
+  result = Curl_conn_cf_send(io_ctx->cf->next, io_ctx->data,
+                             buf, len, FALSE, &nwritten);
+  if(result) {
     nwritten = 0;
-    if(CURLE_AGAIN == result)
+    if(result == CURLE_AGAIN)
       ret = EAGAIN;
     else
       ret = EINVAL;
   }
-  *out_n = (int)nwritten;
-  /*
-  CURL_TRC_CFX(io_ctx->data, io_ctx->cf, "cf->next send(len=%zu) -> %zd, %d",
-                len, nwritten, result));
-  */
+  *out_n = (uintptr_t)nwritten;
+  CURL_TRC_CF(io_ctx->data, io_ctx->cf, "cf->next send(len=%zu) -> %d, %zu",
+              len, (int)result, nwritten);
   return ret;
 }
 
 static ssize_t tls_recv_more(struct Curl_cfilter *cf,
                              struct Curl_easy *data, CURLcode *err)
 {
-  struct ssl_connect_data *const connssl = cf->ctx;
-  struct rustls_ssl_backend_data *const backend =
+  const struct ssl_connect_data * const connssl = cf->ctx;
+  struct rustls_ssl_backend_data * const backend =
     (struct rustls_ssl_backend_data *)connssl->backend;
   struct io_ctx io_ctx;
   size_t tls_bytes_read = 0;
@@ -145,96 +166,78 @@ static ssize_t tls_recv_more(struct Curl_cfilter *cf,
   io_ctx.data = data;
   io_error = rustls_connection_read_tls(backend->conn, read_cb, &io_ctx,
                                         &tls_bytes_read);
-  if(io_error == EAGAIN || io_error == EWOULDBLOCK) {
+  if(RAW_EAGAIN(io_error)) {
     *err = CURLE_AGAIN;
     return -1;
   }
   else if(io_error) {
     char buffer[STRERROR_LEN];
     failf(data, "reading from socket: %s",
-          Curl_strerror(io_error, buffer, sizeof(buffer)));
-    *err = CURLE_READ_ERROR;
+          curlx_strerror(io_error, buffer, sizeof(buffer)));
+    *err = CURLE_RECV_ERROR;
     return -1;
   }
 
   rresult = rustls_connection_process_new_packets(backend->conn);
   if(rresult != RUSTLS_RESULT_OK) {
-    char errorbuf[255];
-    size_t errorlen;
-    rustls_error(rresult, errorbuf, sizeof(errorbuf), &errorlen);
-    failf(data, "rustls_connection_process_new_packets: %.*s",
-      errorlen, errorbuf);
+    rustls_failf(data, rresult, "rustls_connection_process_new_packets");
     *err = map_error(rresult);
     return -1;
   }
 
-  backend->data_pending = TRUE;
+  backend->data_in_pending = TRUE;
   *err = CURLE_OK;
   return (ssize_t)tls_bytes_read;
 }
 
 /*
- * On each run:
- *  - Read a chunk of bytes from the socket into rustls' TLS input buffer.
- *  - Tell rustls to process any new packets.
- *  - Read out as many plaintext bytes from rustls as possible, until hitting
- *    error, EOF, or EAGAIN/EWOULDBLOCK, or plainbuf/plainlen is filled up.
- *
- * It's okay to call this function with plainbuf == NULL and plainlen == 0.
- * In that case, it will copy bytes from the socket into rustls' TLS input
- * buffer, and process packets, but won't consume bytes from rustls' plaintext
- * output buffer.
+ * Filter receive method implementation. `plainbuf` and `plainlen`
+ * are always not NULL/0.
  */
-static ssize_t
-cr_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
-            char *plainbuf, size_t plainlen, CURLcode *err)
+static CURLcode cr_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
+                        char *plainbuf, size_t plainlen, size_t *pnread)
 {
-  struct ssl_connect_data *const connssl = cf->ctx;
-  struct rustls_ssl_backend_data *const backend =
+  const struct ssl_connect_data * const connssl = cf->ctx;
+  struct rustls_ssl_backend_data * const backend =
     (struct rustls_ssl_backend_data *)connssl->backend;
   struct rustls_connection *rconn = NULL;
+  CURLcode result = CURLE_OK;
   size_t n = 0;
-  size_t plain_bytes_copied = 0;
   rustls_result rresult = 0;
-  ssize_t nread;
   bool eof = FALSE;
 
   DEBUGASSERT(backend);
+  *pnread = 0;
   rconn = backend->conn;
 
-  while(plain_bytes_copied < plainlen) {
-    if(!backend->data_pending) {
-      if(tls_recv_more(cf, data, err) < 0) {
-        if(*err != CURLE_AGAIN) {
-          nread = -1;
+  while(*pnread < plainlen) {
+    if(!backend->data_in_pending) {
+      if(tls_recv_more(cf, data, &result) < 0) {
+        if(result != CURLE_AGAIN) {
           goto out;
         }
+        result = CURLE_OK;
         break;
       }
     }
 
     rresult = rustls_connection_read(rconn,
-      (uint8_t *)plainbuf + plain_bytes_copied,
-      plainlen - plain_bytes_copied,
-      &n);
+                                     (uint8_t *)plainbuf + *pnread,
+                                     plainlen - *pnread,
+                                     &n);
     if(rresult == RUSTLS_RESULT_PLAINTEXT_EMPTY) {
-      backend->data_pending = FALSE;
+      backend->data_in_pending = FALSE;
     }
     else if(rresult == RUSTLS_RESULT_UNEXPECTED_EOF) {
       failf(data, "rustls: peer closed TCP connection "
-        "without first closing TLS connection");
-      *err = CURLE_READ_ERROR;
-      nread = -1;
+            "without first closing TLS connection");
+      result = CURLE_RECV_ERROR;
       goto out;
     }
     else if(rresult != RUSTLS_RESULT_OK) {
-      /* n always equals 0 in this case, don't need to check it */
-      char errorbuf[255];
-      size_t errorlen;
-      rustls_error(rresult, errorbuf, sizeof(errorbuf), &errorlen);
-      failf(data, "rustls_connection_read: %.*s", errorlen, errorbuf);
-      *err = CURLE_READ_ERROR;
-      nread = -1;
+      /* n always equals 0 in this case, do not need to check it */
+      rustls_failf(data, rresult, "rustls_connection_read");
+      result = CURLE_RECV_ERROR;
       goto out;
     }
     else if(n == 0) {
@@ -245,321 +248,1046 @@ cr_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
       break;
     }
     else {
-      plain_bytes_copied += n;
+      *pnread += n;
     }
   }
 
-  if(plain_bytes_copied) {
-    *err = CURLE_OK;
-    nread = (ssize_t)plain_bytes_copied;
-  }
-  else if(eof) {
-    *err = CURLE_OK;
-    nread = 0;
-  }
-  else {
-    *err = CURLE_AGAIN;
-    nread = -1;
+  if(!eof && !*pnread) {
+    result = CURLE_AGAIN;
   }
 
 out:
-  CURL_TRC_CF(data, cf, "cf_recv(len=%zu) -> %zd, %d",
-              plainlen, nread, *err);
-  return nread;
+  CURL_TRC_CF(data, cf, "rustls_recv(len=%zu) -> %d, %zu",
+              plainlen, (int)result, *pnread);
+  return result;
 }
 
-/*
- * On each call:
- *  - Copy `plainlen` bytes into rustls' plaintext input buffer (if > 0).
- *  - Fully drain rustls' plaintext output buffer into the socket until
- *    we get either an error or EAGAIN/EWOULDBLOCK.
- *
- * It's okay to call this function with plainbuf == NULL and plainlen == 0.
- * In that case, it won't read anything into rustls' plaintext input buffer.
- * It will only drain rustls' plaintext output buffer into the socket.
- */
-static ssize_t
-cr_send(struct Curl_cfilter *cf, struct Curl_easy *data,
-        const void *plainbuf, size_t plainlen, CURLcode *err)
+static CURLcode cr_flush_out(struct Curl_cfilter *cf, struct Curl_easy *data,
+                             struct rustls_connection *rconn)
 {
-  struct ssl_connect_data *const connssl = cf->ctx;
-  struct rustls_ssl_backend_data *const backend =
-    (struct rustls_ssl_backend_data *)connssl->backend;
-  struct rustls_connection *rconn = NULL;
   struct io_ctx io_ctx;
-  size_t plainwritten = 0;
+  rustls_io_result io_error;
   size_t tlswritten = 0;
   size_t tlswritten_total = 0;
-  rustls_result rresult;
-  rustls_io_result io_error;
-  char errorbuf[256];
-  size_t errorlen;
-
-  DEBUGASSERT(backend);
-  rconn = backend->conn;
-
-  CURL_TRC_CF(data, cf, "cf_send: %ld plain bytes", plainlen);
 
   io_ctx.cf = cf;
   io_ctx.data = data;
 
-  if(plainlen > 0) {
-    rresult = rustls_connection_write(rconn, plainbuf, plainlen,
-                                      &plainwritten);
-    if(rresult != RUSTLS_RESULT_OK) {
-      rustls_error(rresult, errorbuf, sizeof(errorbuf), &errorlen);
-      failf(data, "rustls_connection_write: %.*s", errorlen, errorbuf);
-      *err = CURLE_WRITE_ERROR;
-      return -1;
-    }
-    else if(plainwritten == 0) {
-      failf(data, "rustls_connection_write: EOF");
-      *err = CURLE_WRITE_ERROR;
-      return -1;
-    }
-  }
-
   while(rustls_connection_wants_write(rconn)) {
     io_error = rustls_connection_write_tls(rconn, write_cb, &io_ctx,
                                            &tlswritten);
-    if(io_error == EAGAIN || io_error == EWOULDBLOCK) {
+    if(RAW_EAGAIN(io_error)) {
       CURL_TRC_CF(data, cf, "cf_send: EAGAIN after %zu bytes",
                   tlswritten_total);
-      *err = CURLE_AGAIN;
-      return -1;
+      return CURLE_AGAIN;
     }
     else if(io_error) {
       char buffer[STRERROR_LEN];
       failf(data, "writing to socket: %s",
-            Curl_strerror(io_error, buffer, sizeof(buffer)));
-      *err = CURLE_WRITE_ERROR;
-      return -1;
+            curlx_strerror(io_error, buffer, sizeof(buffer)));
+      return CURLE_SEND_ERROR;
     }
     if(tlswritten == 0) {
       failf(data, "EOF in swrite");
-      *err = CURLE_WRITE_ERROR;
-      return -1;
+      return CURLE_SEND_ERROR;
     }
     CURL_TRC_CF(data, cf, "cf_send: wrote %zu TLS bytes", tlswritten);
     tlswritten_total += tlswritten;
   }
-
-  return plainwritten;
+  return CURLE_OK;
 }
 
-/* A server certificate verify callback for rustls that always returns
-   RUSTLS_RESULT_OK, or in other words disable certificate verification. */
-static enum rustls_result
-cr_verify_none(void *userdata UNUSED_PARAM,
-               const rustls_verify_server_cert_params *params UNUSED_PARAM)
+/*
+ * On each call:
+ *  - Copy `plainlen` bytes into Rustls' plaintext input buffer (if > 0).
+ *  - Fully drain Rustls' plaintext output buffer into the socket until
+ *    we get either an error or EAGAIN/EWOULDBLOCK.
+ *
+ * it is okay to call this function with plainbuf == NULL and plainlen == 0.
+ * In that case, it does not read anything into Rustls' plaintext input buffer.
+ * It only drains Rustls' plaintext output buffer into the socket.
+ */
+static CURLcode cr_send(struct Curl_cfilter *cf, struct Curl_easy *data,
+                        const void *plainbuf, size_t plainlen,
+                        size_t *pnwritten)
 {
+  const struct ssl_connect_data * const connssl = cf->ctx;
+  struct rustls_ssl_backend_data * const backend =
+    (struct rustls_ssl_backend_data *)connssl->backend;
+  struct rustls_connection *rconn = NULL;
+  size_t plainwritten = 0;
+  const unsigned char *buf = plainbuf;
+  CURLcode result = CURLE_OK;
+  size_t blen = plainlen;
+
+  DEBUGASSERT(backend);
+  *pnwritten = 0;
+  rconn = backend->conn;
+  DEBUGASSERT(rconn);
+
+  CURL_TRC_CF(data, cf, "cf_send(len=%zu)", plainlen);
+
+  /* If a previous send blocked, we already added its plain bytes
+   * to rustsls and must not do that again. Flush the TLS bytes and,
+   * if successful, deduct the previous plain bytes from the current
+   * send. */
+  if(backend->plain_out_buffered) {
+    result = cr_flush_out(cf, data, rconn);
+    CURL_TRC_CF(data, cf, "cf_send: flushing %zu previously added bytes -> %d",
+                backend->plain_out_buffered, (int)result);
+    if(result)
+      return result;
+    if(blen > backend->plain_out_buffered) {
+      blen -= backend->plain_out_buffered;
+      buf += backend->plain_out_buffered;
+    }
+    else
+      blen = 0;
+    *pnwritten += backend->plain_out_buffered;
+    backend->plain_out_buffered = 0;
+  }
+
+  if(blen > 0) {
+    rustls_result rresult;
+    CURL_TRC_CF(data, cf, "cf_send: adding %zu plain bytes to Rustls", blen);
+    rresult = rustls_connection_write(rconn, buf, blen, &plainwritten);
+    if(rresult != RUSTLS_RESULT_OK) {
+      rustls_failf(data, rresult, "rustls_connection_write");
+      result = CURLE_WRITE_ERROR;
+      goto out;
+    }
+    else if(plainwritten == 0) {
+      failf(data, "rustls_connection_write: EOF");
+      result = CURLE_WRITE_ERROR;
+      goto out;
+    }
+  }
+
+  result = cr_flush_out(cf, data, rconn);
+  if(result) {
+    if(result == CURLE_AGAIN) {
+      /* The TLS bytes may have been partially written, but we fail the
+       * complete send() and remember how much we already added to Rustls. */
+      backend->plain_out_buffered = plainwritten;
+      if(*pnwritten) {
+        result = CURLE_OK;
+      }
+    }
+    goto out;
+  }
+  else
+    *pnwritten += plainwritten;
+
+out:
+  CURL_TRC_CF(data, cf, "rustls_send(len=%zu) -> %d, %zu",
+              plainlen, (int)result, *pnwritten);
+  return result;
+}
+
+/* A server certificate verify callback for Rustls that always returns
+   RUSTLS_RESULT_OK, or in other words disable certificate verification. */
+static uint32_t cr_verify_none(void *userdata,
+                               const rustls_verify_server_cert_params *params)
+{
+  (void)userdata;
+  (void)params;
   return RUSTLS_RESULT_OK;
 }
 
-static bool
-cr_hostname_is_ip(const char *hostname)
+static int read_file_into(const char *filename, struct dynbuf *out)
 {
-  struct in_addr in;
-#ifdef ENABLE_IPV6
-  struct in6_addr in6;
-  if(Curl_inet_pton(AF_INET6, hostname, &in6) > 0) {
-    return true;
+  FILE *f = curlx_fopen(filename, FOPEN_READTEXT);
+  if(!f) {
+    return 0;
   }
-#endif /* ENABLE_IPV6 */
-  if(Curl_inet_pton(AF_INET, hostname, &in) > 0) {
-    return true;
+
+  for(;;) {
+    uint8_t buf[256];
+    const size_t rr = fread(buf, 1, sizeof(buf), f);
+    if((!rr && !feof(f)) ||
+       curlx_dyn_addn(out, buf, rr)) {
+      curlx_fclose(f);
+      return 0;
+    }
+    if(rr < sizeof(buf))
+      break;
   }
-  return false;
+
+  return curlx_fclose(f) == 0;
+}
+
+static void
+cr_get_selected_ciphers(struct Curl_easy *data,
+                        const char *ciphers12,
+                        const char *ciphers13,
+                        const struct rustls_supported_ciphersuite **selected,
+                        size_t *selected_size)
+{
+  const size_t supported_len = *selected_size;
+  const size_t default_len = rustls_default_crypto_provider_ciphersuites_len();
+  const struct rustls_supported_ciphersuite *entry = NULL;
+  const char *ciphers = ciphers12;
+  size_t count = 0, default13_count = 0, i, j;
+  const char *ptr, *end;
+
+  DEBUGASSERT(default_len <= supported_len);
+
+  if(!ciphers13) {
+    /* Add default TLSv1.3 ciphers to selection */
+    for(j = 0; j < default_len; j++) {
+      entry = rustls_default_crypto_provider_ciphersuites_get(j);
+      if(rustls_supported_ciphersuite_protocol_version(entry) !=
+         RUSTLS_TLS_VERSION_TLSV1_3)
+        continue;
+
+      selected[count++] = entry;
+    }
+
+    default13_count = count;
+
+    if(!ciphers)
+      ciphers = "";
+  }
+  else
+    ciphers = ciphers13;
+
+add_ciphers:
+  for(ptr = ciphers; ptr[0] != '\0' && count < supported_len; ptr = end) {
+    uint16_t id = Curl_cipher_suite_walk_str(&ptr, &end);
+
+    /* Check if cipher is supported */
+    if(id) {
+      for(i = 0; i < supported_len; i++) {
+        entry = rustls_default_crypto_provider_ciphersuites_get(i);
+        if(rustls_supported_ciphersuite_get_suite(entry) == id)
+          break;
+      }
+      if(i == supported_len)
+        id = 0;
+    }
+    if(!id) {
+      if(ptr[0] != '\0')
+        infof(data, "rustls: unknown cipher in list: \"%.*s\"",
+              (int)(end - ptr), ptr);
+      continue;
+    }
+
+    /* No duplicates allowed (so selected cannot overflow) */
+    for(i = 0; i < count && selected[i] != entry; i++)
+      ;
+    if(i < count) {
+      if(i >= default13_count)
+        infof(data, "rustls: duplicate cipher in list: \"%.*s\"",
+              (int)(end - ptr), ptr);
+      continue;
+    }
+
+    selected[count++] = entry;
+  }
+
+  if(ciphers == ciphers13 && ciphers12) {
+    ciphers = ciphers12;
+    goto add_ciphers;
+  }
+
+  if(!ciphers12) {
+    /* Add default TLSv1.2 ciphers to selection */
+    for(j = 0; j < default_len; j++) {
+      entry = rustls_default_crypto_provider_ciphersuites_get(j);
+      if(rustls_supported_ciphersuite_protocol_version(entry) ==
+         RUSTLS_TLS_VERSION_TLSV1_3)
+        continue;
+
+      /* No duplicates allowed (so selected cannot overflow) */
+      for(i = 0; i < count && selected[i] != entry; i++)
+        ;
+      if(i < count)
+        continue;
+
+      selected[count++] = entry;
+    }
+  }
+
+  *selected_size = count;
+}
+
+static void cr_keylog_log_cb(struct rustls_str label,
+                             const uint8_t *client_random,
+                             size_t client_random_len, const uint8_t *secret,
+                             size_t secret_len)
+{
+  char clabel[KEYLOG_LABEL_MAXLEN];
+  (void)client_random_len;
+  DEBUGASSERT(client_random_len == CLIENT_RANDOM_SIZE);
+  /* Turning a "rustls_str" into a null delimited "c" string */
+  curl_msnprintf(clabel, sizeof(clabel), "%.*s", (int)label.len, label.data);
+  Curl_tls_keylog_write(clabel, client_random, secret, secret_len);
 }
 
 static CURLcode
-cr_init_backend(struct Curl_cfilter *cf, struct Curl_easy *data,
-                struct rustls_ssl_backend_data *const backend)
+init_config_builder(struct Curl_easy *data,
+                    const struct ssl_primary_config *conn_config,
+                    struct rustls_client_config_builder **config_builder)
 {
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  const struct rustls_supported_ciphersuite **cipher_suites = NULL;
+  struct rustls_crypto_provider_builder *custom_provider_builder = NULL;
+  const struct rustls_crypto_provider *custom_provider = NULL;
+
+  uint16_t tls_versions[2] = {
+    RUSTLS_TLS_VERSION_TLSV1_2,
+    RUSTLS_TLS_VERSION_TLSV1_3,
+  };
+  size_t tls_versions_len = 2;
+  size_t cipher_suites_len = rustls_default_crypto_provider_ciphersuites_len();
+
+  CURLcode result = CURLE_OK;
+  rustls_result rr;
+
+  DEBUGASSERT(conn_config->version != CURL_SSLVERSION_DEFAULT);
+  switch(conn_config->version) {
+  case CURL_SSLVERSION_TLSv1:
+  case CURL_SSLVERSION_TLSv1_0:
+  case CURL_SSLVERSION_TLSv1_1:
+  case CURL_SSLVERSION_TLSv1_2:
+    break;
+  case CURL_SSLVERSION_TLSv1_3:
+    tls_versions[0] = RUSTLS_TLS_VERSION_TLSV1_3;
+    tls_versions_len = 1;
+    break;
+  default:
+    failf(data, "rustls: unsupported minimum TLS version value");
+    result = CURLE_BAD_FUNCTION_ARGUMENT;
+    goto cleanup;
+  }
+
+  switch(conn_config->version_max) {
+  case CURL_SSLVERSION_MAX_DEFAULT:
+  case CURL_SSLVERSION_MAX_NONE:
+  case CURL_SSLVERSION_MAX_TLSv1_3:
+    break;
+  case CURL_SSLVERSION_MAX_TLSv1_2:
+    if(tls_versions[0] == RUSTLS_TLS_VERSION_TLSV1_2) {
+      tls_versions_len = 1;
+      break;
+    }
+    FALLTHROUGH();
+  case CURL_SSLVERSION_MAX_TLSv1_1:
+  case CURL_SSLVERSION_MAX_TLSv1_0:
+  default:
+    failf(data, "rustls: unsupported maximum TLS version value");
+    result = CURLE_BAD_FUNCTION_ARGUMENT;
+    goto cleanup;
+  }
+
+#ifdef USE_ECH
+  if(CURLECH_ENABLED(data)) {
+    tls_versions[0] = RUSTLS_TLS_VERSION_TLSV1_3;
+    tls_versions_len = 1;
+    infof(data, "rustls: ECH enabled, forcing TLSv1.3");
+  }
+#endif /* USE_ECH */
+
+  cipher_suites = curlx_malloc(sizeof(*cipher_suites) * cipher_suites_len);
+  if(!cipher_suites) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto cleanup;
+  }
+
+  cr_get_selected_ciphers(data,
+                          conn_config->cipher_list,
+                          conn_config->cipher_list13,
+                          cipher_suites, &cipher_suites_len);
+  if(cipher_suites_len == 0) {
+    failf(data, "rustls: no supported cipher in list");
+    result = CURLE_SSL_CIPHER;
+    goto cleanup;
+  }
+
+  rr = rustls_crypto_provider_builder_new_from_default(
+    &custom_provider_builder);
+  if(rr != RUSTLS_RESULT_OK) {
+    rustls_failf(data, rr,
+                 "failed to create crypto provider builder from default");
+    result = CURLE_SSL_CIPHER;
+    goto cleanup;
+  }
+
+  rr =
+    rustls_crypto_provider_builder_set_cipher_suites(
+      custom_provider_builder,
+      cipher_suites,
+      cipher_suites_len);
+  if(rr != RUSTLS_RESULT_OK) {
+    rustls_failf(data, rr,
+                 "failed to set ciphersuites for crypto provider builder");
+    result = CURLE_SSL_CIPHER;
+    goto cleanup;
+  }
+
+  rr = rustls_crypto_provider_builder_build(custom_provider_builder,
+                                            &custom_provider);
+  if(rr != RUSTLS_RESULT_OK) {
+    rustls_failf(data, rr, "failed to build custom crypto provider");
+    result = CURLE_SSL_CIPHER;
+    goto cleanup;
+  }
+
+  rr = rustls_client_config_builder_new_custom(custom_provider,
+                                               tls_versions,
+                                               tls_versions_len,
+                                               config_builder);
+  if(rr != RUSTLS_RESULT_OK) {
+    rustls_failf(data, rr, "failed to create client config builder");
+    result = CURLE_SSL_CIPHER;
+    goto cleanup;
+  }
+
+cleanup:
+  if(cipher_suites) {
+    curlx_free(cipher_suites);
+  }
+  if(custom_provider_builder) {
+    rustls_crypto_provider_builder_free(custom_provider_builder);
+  }
+  if(custom_provider) {
+    rustls_crypto_provider_free(custom_provider);
+  }
+  return result;
+}
+
+static void
+init_config_builder_alpn(struct Curl_easy *data,
+                         const struct ssl_connect_data *connssl,
+                         struct rustls_client_config_builder *config_builder)
+{
+  struct alpn_proto_buf proto;
+  rustls_slice_bytes alpn[ALPN_ENTRIES_MAX];
+  size_t i;
+
+  for(i = 0; i < connssl->alpn->count; ++i) {
+    alpn[i].data = (const uint8_t *)connssl->alpn->entries[i];
+    alpn[i].len = strlen(connssl->alpn->entries[i]);
+  }
+  rustls_client_config_builder_set_alpn_protocols(config_builder, alpn,
+                                                  connssl->alpn->count);
+  Curl_alpn_to_proto_str(&proto, connssl->alpn);
+  infof(data, VTLS_INFOF_ALPN_OFFER_1STR, proto.data);
+}
+
+static CURLcode init_config_builder_verifier_crl(
+  struct Curl_easy *data,
+  const struct ssl_primary_config *conn_config,
+  struct rustls_web_pki_server_cert_verifier_builder *builder)
+{
+  CURLcode result = CURLE_OK;
+  struct dynbuf crl_contents;
+  rustls_result rr;
+
+  curlx_dyn_init(&crl_contents, DYN_CRLFILE_SIZE);
+  if(!read_file_into(conn_config->CRLfile, &crl_contents)) {
+    failf(data, "rustls: failed to read revocation list file");
+    result = CURLE_SSL_CRL_BADFILE;
+    goto cleanup;
+  }
+
+  rr = rustls_web_pki_server_cert_verifier_builder_add_crl(
+    builder,
+    curlx_dyn_uptr(&crl_contents),
+    curlx_dyn_len(&crl_contents));
+  if(rr != RUSTLS_RESULT_OK) {
+    rustls_failf(data, rr, "failed to parse revocation list");
+    result = CURLE_SSL_CRL_BADFILE;
+    goto cleanup;
+  }
+
+cleanup:
+  curlx_dyn_free(&crl_contents);
+  return result;
+}
+
+static CURLcode
+init_config_builder_verifier(struct Curl_easy *data,
+                             struct rustls_client_config_builder *builder,
+                             const struct ssl_primary_config *conn_config,
+                             const struct curl_blob *ca_info_blob,
+                             const char * const ssl_cafile)
+{
+  const struct rustls_root_cert_store *roots = NULL;
+  struct rustls_root_cert_store_builder *roots_builder = NULL;
+  struct rustls_web_pki_server_cert_verifier_builder *verifier_builder = NULL;
+  struct rustls_server_cert_verifier *server_cert_verifier = NULL;
+  rustls_result rr = RUSTLS_RESULT_OK;
+  CURLcode result = CURLE_OK;
+
+  roots_builder = rustls_root_cert_store_builder_new();
+  if(ca_info_blob) {
+    rr = rustls_root_cert_store_builder_add_pem(roots_builder,
+                                                ca_info_blob->data,
+                                                ca_info_blob->len,
+                                                1);
+    if(rr != RUSTLS_RESULT_OK) {
+      rustls_failf(data, rr, "failed to parse trusted certificates from blob");
+      result = CURLE_SSL_CACERT_BADFILE;
+      goto cleanup;
+    }
+  }
+  else if(ssl_cafile) {
+    rr = rustls_root_cert_store_builder_load_roots_from_file(roots_builder,
+                                                             ssl_cafile,
+                                                             1);
+    if(rr != RUSTLS_RESULT_OK) {
+      rustls_failf(data, rr, "failed to load trusted certificates");
+      result = CURLE_SSL_CACERT_BADFILE;
+      goto cleanup;
+    }
+  }
+
+  rr = rustls_root_cert_store_builder_build(roots_builder, &roots);
+  if(rr != RUSTLS_RESULT_OK) {
+    rustls_failf(data, rr, "failed to build trusted root certificate store");
+    result = CURLE_SSL_CACERT_BADFILE;
+    goto cleanup;
+  }
+
+  verifier_builder = rustls_web_pki_server_cert_verifier_builder_new(roots);
+  if(!verifier_builder) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto cleanup;
+  }
+
+  if(conn_config->CRLfile) {
+    result = init_config_builder_verifier_crl(data,
+                                              conn_config,
+                                              verifier_builder);
+    if(result) {
+      goto cleanup;
+    }
+  }
+
+  rr = rustls_web_pki_server_cert_verifier_builder_build(
+    verifier_builder, &server_cert_verifier);
+  if(rr != RUSTLS_RESULT_OK) {
+    rustls_failf(data, rr, "failed to build certificate verifier");
+    result = CURLE_SSL_CACERT_BADFILE;
+    goto cleanup;
+  }
+
+  rustls_client_config_builder_set_server_verifier(builder,
+                                                   server_cert_verifier);
+cleanup:
+  if(roots_builder) {
+    rustls_root_cert_store_builder_free(roots_builder);
+  }
+  if(roots) {
+    rustls_root_cert_store_free(roots);
+  }
+  if(verifier_builder) {
+    rustls_web_pki_server_cert_verifier_builder_free(verifier_builder);
+  }
+  if(server_cert_verifier) {
+    rustls_server_cert_verifier_free(server_cert_verifier);
+  }
+
+  return result;
+}
+
+static CURLcode init_config_builder_platform_verifier(
+  struct Curl_easy *data,
+  struct rustls_client_config_builder *builder)
+{
+  struct rustls_server_cert_verifier *server_cert_verifier = NULL;
+  CURLcode result = CURLE_OK;
+  rustls_result rr;
+
+  rr = rustls_platform_server_cert_verifier(&server_cert_verifier);
+  if(rr != RUSTLS_RESULT_OK) {
+    rustls_failf(data, rr, "failed to create platform certificate verifier");
+    result = CURLE_SSL_CACERT_BADFILE;
+    goto cleanup;
+  }
+
+  rustls_client_config_builder_set_server_verifier(builder,
+                                                   server_cert_verifier);
+
+cleanup:
+  if(server_cert_verifier) {
+    rustls_server_cert_verifier_free(server_cert_verifier);
+  }
+  return result;
+}
+
+static CURLcode
+init_config_builder_keylog(struct Curl_easy *data,
+                           struct rustls_client_config_builder *builder)
+{
+  rustls_result rr;
+
+  Curl_tls_keylog_open();
+  if(!Curl_tls_keylog_enabled()) {
+    return CURLE_OK;
+  }
+
+  rr = rustls_client_config_builder_set_key_log(builder,
+                                                cr_keylog_log_cb,
+                                                NULL);
+  if(rr != RUSTLS_RESULT_OK) {
+    rustls_failf(data, rr, "rustls_client_config_builder_set_key_log");
+    Curl_tls_keylog_close();
+    return map_error(rr);
+  }
+
+  return CURLE_OK;
+}
+
+static CURLcode
+init_config_builder_client_auth(struct Curl_easy *data,
+                                const struct ssl_primary_config *conn_config,
+                                const struct ssl_config_data *ssl_config,
+                                struct rustls_client_config_builder *builder)
+{
+  struct dynbuf cert_contents;
+  struct dynbuf key_contents;
+  rustls_result rr;
+  const struct rustls_certified_key *certified_key = NULL;
+  CURLcode result = CURLE_OK;
+
+  if(conn_config->clientcert && !ssl_config->primary.key) {
+    failf(data, "rustls: must provide key with certificate '%s'",
+          conn_config->clientcert);
+    return CURLE_SSL_CERTPROBLEM;
+  }
+  else if(!conn_config->clientcert && ssl_config->primary.key) {
+    failf(data, "rustls: must provide certificate with key '%s'",
+          ssl_config->primary.key);
+    return CURLE_SSL_CERTPROBLEM;
+  }
+
+  curlx_dyn_init(&cert_contents, DYN_CERTFILE_SIZE);
+  curlx_dyn_init(&key_contents, DYN_KEYFILE_SIZE);
+
+  if(!read_file_into(conn_config->clientcert, &cert_contents)) {
+    failf(data, "rustls: failed to read client certificate file: '%s'",
+          conn_config->clientcert);
+    result = CURLE_SSL_CERTPROBLEM;
+    goto cleanup;
+  }
+
+  if(!read_file_into(ssl_config->primary.key, &key_contents)) {
+    failf(data, "rustls: failed to read key file: '%s'",
+          ssl_config->primary.key);
+    result = CURLE_SSL_CERTPROBLEM;
+    goto cleanup;
+  }
+
+  rr = rustls_certified_key_build(curlx_dyn_uptr(&cert_contents),
+                                  curlx_dyn_len(&cert_contents),
+                                  curlx_dyn_uptr(&key_contents),
+                                  curlx_dyn_len(&key_contents),
+                                  &certified_key);
+  if(rr != RUSTLS_RESULT_OK) {
+    rustls_failf(data, rr, "rustls: failed to build certified key");
+    result = CURLE_SSL_CERTPROBLEM;
+    goto cleanup;
+  }
+
+  rr = rustls_certified_key_keys_match(certified_key);
+  if(rr != RUSTLS_RESULT_OK) {
+    rustls_failf(data, rr,
+                 "rustls: client certificate and keypair files do not match:");
+    result = CURLE_SSL_CERTPROBLEM;
+    goto cleanup;
+  }
+
+  rr = rustls_client_config_builder_set_certified_key(builder,
+                                                      &certified_key,
+                                                      1);
+  if(rr != RUSTLS_RESULT_OK) {
+    rustls_failf(data, rr, "rustls: failed to set certified key");
+    result = CURLE_SSL_CERTPROBLEM;
+    goto cleanup;
+  }
+
+cleanup:
+  curlx_dyn_free(&cert_contents);
+  curlx_dyn_free(&key_contents);
+  if(certified_key) {
+    rustls_certified_key_free(certified_key);
+  }
+  return result;
+}
+
+#ifdef USE_ECH
+
+static bool cr_ech_need_httpsrr(struct Curl_easy *data)
+{
+  if(!CURLECH_ENABLED(data))
+    return FALSE;
+  if((data->set.tls_ech == CURLECH_GREASE) ||
+     data->set.str[STRING_ECH_CONFIG])
+    return FALSE;
+  return TRUE;
+}
+
+static CURLcode
+init_config_builder_ech(struct Curl_easy *data,
+                        struct Curl_cfilter *cf,
+                        struct rustls_client_config_builder *builder)
+{
+  const rustls_hpke *hpke = rustls_supported_hpke();
+  unsigned char *ech_config = NULL;
+  size_t ech_config_len = 0;
+  struct Curl_dns_entry *dns = NULL;
+  CURLcode result = CURLE_OK;
+  rustls_result rr;
+
+  if(!hpke) {
+    failf(data,
+          "rustls: ECH unavailable, rustls-ffi built without "
+          "HPKE compatible crypto provider");
+    result = CURLE_SSL_CONNECT_ERROR;
+    goto cleanup;
+  }
+
+  if(data->set.str[STRING_ECH_PUBLIC]) {
+    failf(data, "rustls: ECH outername not supported");
+    result = CURLE_SSL_CONNECT_ERROR;
+    goto cleanup;
+  }
+
+  if(data->set.tls_ech == CURLECH_GREASE) {
+    rr = rustls_client_config_builder_enable_ech_grease(builder, hpke);
+    if(rr != RUSTLS_RESULT_OK) {
+      rustls_failf(data, rr, "rustls: failed to configure ECH GREASE");
+      result = CURLE_SSL_CONNECT_ERROR;
+      goto cleanup;
+    }
+    return CURLE_OK;
+  }
+
+  if(data->set.tls_ech && data->set.str[STRING_ECH_CONFIG]) {
+    const char *b64 = data->set.str[STRING_ECH_CONFIG];
+    size_t decode_result;
+    if(!b64) {
+      infof(data, "rustls: ECHConfig from command line empty");
+      result = CURLE_SSL_CONNECT_ERROR;
+      goto cleanup;
+    }
+    /* rustls-ffi expects the raw TLS encoded ECHConfigList bytes */
+    decode_result = curlx_base64_decode(b64, &ech_config, &ech_config_len);
+    if(decode_result || !ech_config) {
+      infof(data, "rustls: cannot base64 decode ECHConfig from command line");
+      result = CURLE_SSL_CONNECT_ERROR;
+      goto cleanup;
+    }
+  }
+  else {
+    const struct ssl_connect_data *connssl = cf->ctx;
+    const struct Curl_https_rrinfo *rinfo =
+      Curl_conn_dns_get_https(data, cf->sockindex, connssl->peer.origin);
+
+    if(!rinfo || !rinfo->echconfiglist) {
+      failf(data, "rustls: ECH requested but no ECHConfig available");
+      result = CURLE_SSL_CONNECT_ERROR;
+      goto cleanup;
+    }
+    ech_config = rinfo->echconfiglist;
+    ech_config_len = rinfo->echconfiglist_len;
+  }
+
+  rr = rustls_client_config_builder_enable_ech(builder,
+                                               ech_config,
+                                               ech_config_len,
+                                               hpke);
+  if(rr != RUSTLS_RESULT_OK) {
+    rustls_failf(data, rr, "rustls: failed to configure ECH");
+    result = CURLE_SSL_CONNECT_ERROR;
+    goto cleanup;
+  }
+cleanup:
+  /* if we base64 decoded, we can free now */
+  if(data->set.tls_ech && data->set.str[STRING_ECH_CONFIG]) {
+    curlx_free(ech_config);
+  }
+  if(dns) {
+    Curl_dns_entry_unlink(data, &dns);
+  }
+  return result;
+}
+#endif /* USE_ECH */
+
+static CURLcode cr_init_backend(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                struct rustls_ssl_backend_data * const backend)
+{
+  const struct ssl_connect_data *connssl = cf->ctx;
+  const struct ssl_primary_config *conn_config =
+    Curl_ssl_cf_get_primary_config(cf);
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
   struct rustls_connection *rconn = NULL;
   struct rustls_client_config_builder *config_builder = NULL;
-  struct rustls_root_cert_store *roots = NULL;
+
   const struct curl_blob *ca_info_blob = conn_config->ca_info_blob;
   const char * const ssl_cafile =
     /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
     (ca_info_blob ? NULL : conn_config->CAfile);
-  const bool verifypeer = conn_config->verifypeer;
-  const char *hostname = connssl->hostname;
-  char errorbuf[256];
-  size_t errorlen;
-  int result;
+  CURLcode result = CURLE_OK;
+  rustls_result rr;
 
   DEBUGASSERT(backend);
   rconn = backend->conn;
 
-  config_builder = rustls_client_config_builder_new();
-  if(connssl->alpn) {
-    struct alpn_proto_buf proto;
-    rustls_slice_bytes alpn[ALPN_ENTRIES_MAX];
-    size_t i;
-
-    for(i = 0; i < connssl->alpn->count; ++i) {
-      alpn[i].data = (const uint8_t *)connssl->alpn->entries[i];
-      alpn[i].len = strlen(connssl->alpn->entries[i]);
-    }
-    rustls_client_config_builder_set_alpn_protocols(config_builder, alpn,
-                                                    connssl->alpn->count);
-    Curl_alpn_to_proto_str(&proto, connssl->alpn);
-    infof(data, VTLS_INFOF_ALPN_OFFER_1STR, proto.data);
+  result = init_config_builder(data, conn_config, &config_builder);
+  if(result != CURLE_OK) {
+    return result;
   }
-  if(!verifypeer) {
+
+  if(connssl->alpn) {
+    init_config_builder_alpn(data, connssl, config_builder);
+  }
+
+  if(!conn_config->verifypeer) {
     rustls_client_config_builder_dangerous_set_certificate_verifier(
       config_builder, cr_verify_none);
-    /* rustls doesn't support IP addresses (as of 0.19.0), and will reject
-     * connections created with an IP address, even when certificate
-     * verification is turned off. Set a placeholder hostname and disable
-     * SNI. */
-    if(cr_hostname_is_ip(hostname)) {
-      rustls_client_config_builder_set_enable_sni(config_builder, false);
-      hostname = "example.invalid";
+  }
+  else if(ssl_config->native_ca_store) {
+    if(conn_config->CRLfile) {
+      failf(data, "rustls: CRL file not supported with native CA store; "
+            "the platform verifier has no CRL attachment API");
+      rustls_client_config_builder_free(config_builder);
+      return CURLE_NOT_BUILT_IN;
+    }
+    result = init_config_builder_platform_verifier(data, config_builder);
+    if(result != CURLE_OK) {
+      rustls_client_config_builder_free(config_builder);
+      return result;
     }
   }
-  else if(ca_info_blob) {
-    roots = rustls_root_cert_store_new();
-
-    /* Enable strict parsing only if verification isn't disabled. */
-    result = rustls_root_cert_store_add_pem(roots, ca_info_blob->data,
-                                            ca_info_blob->len, verifypeer);
-    if(result != RUSTLS_RESULT_OK) {
-      failf(data, "rustls: failed to parse trusted certificates from blob");
-      rustls_root_cert_store_free(roots);
-      rustls_client_config_free(
-        rustls_client_config_builder_build(config_builder));
-      return CURLE_SSL_CACERT_BADFILE;
-    }
-
-    result = rustls_client_config_builder_use_roots(config_builder, roots);
-    rustls_root_cert_store_free(roots);
-    if(result != RUSTLS_RESULT_OK) {
-      failf(data, "rustls: failed to load trusted certificates");
-      rustls_client_config_free(
-        rustls_client_config_builder_build(config_builder));
-      return CURLE_SSL_CACERT_BADFILE;
-    }
-  }
-  else if(ssl_cafile) {
-    result = rustls_client_config_builder_load_roots_from_file(
-      config_builder, ssl_cafile);
-    if(result != RUSTLS_RESULT_OK) {
-      failf(data, "rustls: failed to load trusted certificates");
-      rustls_client_config_free(
-        rustls_client_config_builder_build(config_builder));
-      return CURLE_SSL_CACERT_BADFILE;
+  else if(ca_info_blob || ssl_cafile) {
+    result = init_config_builder_verifier(data,
+                                          config_builder,
+                                          conn_config,
+                                          ca_info_blob,
+                                          ssl_cafile);
+    if(result != CURLE_OK) {
+      rustls_client_config_builder_free(config_builder);
+      return result;
     }
   }
 
-  backend->config = rustls_client_config_builder_build(config_builder);
-  DEBUGASSERT(rconn == NULL);
-  {
-    char *snihost = Curl_ssl_snihost(data, hostname, NULL);
-    if(!snihost) {
-      failf(data, "rustls: failed to get SNI");
-      return CURLE_SSL_CONNECT_ERROR;
+  if(conn_config->clientcert || ssl_config->primary.key) {
+    result = init_config_builder_client_auth(data,
+                                             conn_config,
+                                             ssl_config,
+                                             config_builder);
+    if(result != CURLE_OK) {
+      rustls_client_config_builder_free(config_builder);
+      return result;
     }
-    result = rustls_client_connection_new(backend->config, snihost, &rconn);
   }
-  if(result != RUSTLS_RESULT_OK) {
-    rustls_error(result, errorbuf, sizeof(errorbuf), &errorlen);
-    failf(data, "rustls_client_connection_new: %.*s", errorlen, errorbuf);
+
+#ifdef USE_ECH
+  if(CURLECH_ENABLED(data)) {
+    result = init_config_builder_ech(data, cf, config_builder);
+    if((result != CURLE_OK) && (data->set.tls_ech == CURLECH_HARD)) {
+      rustls_client_config_builder_free(config_builder);
+      return result;
+    }
+  }
+#endif /* USE_ECH */
+
+  result = init_config_builder_keylog(data, config_builder);
+  if(result != CURLE_OK) {
+    rustls_client_config_builder_free(config_builder);
+    return result;
+  }
+
+  rr = rustls_client_config_builder_build(config_builder, &backend->config);
+  if(rr != RUSTLS_RESULT_OK) {
+    rustls_failf(data, rr, "failed to build client config");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  DEBUGASSERT(!rconn);
+  rr = rustls_client_connection_new(backend->config,
+                                    connssl->peer.origin->hostname,
+                                    &rconn);
+  if(rr != RUSTLS_RESULT_OK) {
+    rustls_failf(data, rr, "rustls_client_connection_new");
+    rustls_client_config_free(backend->config);
+    backend->config = NULL;
     return CURLE_COULDNT_CONNECT;
   }
+  DEBUGASSERT(rconn);
   rustls_connection_set_userdata(rconn, backend);
   backend->conn = rconn;
-  return CURLE_OK;
+
+  return result;
 }
 
-static void
-cr_set_negotiated_alpn(struct Curl_cfilter *cf, struct Curl_easy *data,
-  const struct rustls_connection *rconn)
+static void cr_set_negotiated_alpn(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data,
+                                   const struct rustls_connection *rconn)
 {
+  struct ssl_connect_data * const connssl = cf->ctx;
   const uint8_t *protocol = NULL;
   size_t len = 0;
 
   rustls_connection_get_alpn_protocol(rconn, &protocol, &len);
-  Curl_alpn_set_negotiated(cf, data, protocol, len);
+  Curl_alpn_set_negotiated(cf, data, connssl, protocol, len);
 }
 
-static CURLcode
-cr_connect_nonblocking(struct Curl_cfilter *cf,
-                       struct Curl_easy *data, bool *done)
+/* Given an established network connection, do a TLS handshake.
+ *
+ * This function sets `*done` to true once the handshake is complete.
+ * This function never reads the value of `*done*`.
+ */
+static CURLcode cr_connect(struct Curl_cfilter *cf, struct Curl_easy *data,
+                           bool *done)
 {
-  struct ssl_connect_data *const connssl = cf->ctx;
-  curl_socket_t sockfd = Curl_conn_cf_get_socket(cf, data);
-  struct rustls_ssl_backend_data *const backend =
+  struct ssl_connect_data * const connssl = cf->ctx;
+  const struct rustls_ssl_backend_data * const backend =
     (struct rustls_ssl_backend_data *)connssl->backend;
-  struct rustls_connection *rconn = NULL;
+  const struct rustls_connection *rconn = NULL;
   CURLcode tmperr = CURLE_OK;
-  int result;
-  int what;
+  CURLcode result;
   bool wants_read;
   bool wants_write;
-  curl_socket_t writefd;
-  curl_socket_t readfd;
+  ssize_t nread;
 
   DEBUGASSERT(backend);
 
-  if(ssl_connection_none == connssl->state) {
-    result = cr_init_backend(cf, data,
-               (struct rustls_ssl_backend_data *)connssl->backend);
-    if(result != CURLE_OK) {
-      return result;
+  CURL_TRC_CF(data, cf, "cr_connect, state=%d", (int)connssl->state);
+  *done = FALSE;
+
+#ifdef USE_ECH
+    /* if we do ECH and need the HTTPS-RR information for it,
+     * we delay the connect until it arrives or DNS resolve fails. */
+    if(cr_ech_need_httpsrr(data) &&
+       !Curl_conn_dns_resolved_https(data, cf->sockindex,
+                                     connssl->peer.peer)) {
+      CURL_TRC_CF(data, cf, "need HTTPS-RR for ECH, delaying connect");
+      return CURLE_OK;
     }
+#endif /* USE_ECH */
+
+  if(!backend->conn) {
+    result =
+      cr_init_backend(cf, data,
+                      (struct rustls_ssl_backend_data *)connssl->backend);
+    CURL_TRC_CF(data, cf, "cr_connect, init backend -> %d", (int)result);
+    if(result)
+      return result;
     connssl->state = ssl_connection_negotiating;
   }
-
   rconn = backend->conn;
 
   /* Read/write data until the handshake is done or the socket would block. */
   for(;;) {
     /*
-    * Connection has been established according to rustls. Set send/recv
-    * handlers, and update the state machine.
-    */
+     * Connection has been established according to Rustls. Set send/recv
+     * handlers, and update the state machine.
+     */
+    connssl->io_need = CURL_SSL_IO_NEED_NONE;
     if(!rustls_connection_is_handshaking(rconn)) {
-      infof(data, "Done handshaking");
-      /* Done with the handshake. Set up callbacks to send/receive data. */
-      connssl->state = ssl_connection_complete;
-
+      /* Rustls claims it is no longer handshaking *before* it has
+       * send its FINISHED message off. We attempt to let it write
+       * one more time. Oh my.
+       */
+      size_t nwritten;
       cr_set_negotiated_alpn(cf, data, rconn);
+      tmperr = cr_send(cf, data, NULL, 0, &nwritten);
+      if(tmperr == CURLE_AGAIN) {
+        connssl->io_need = CURL_SSL_IO_NEED_SEND;
+        return CURLE_OK;
+      }
+      else if(tmperr != CURLE_OK) {
+        return tmperr;
+      }
+      /* REALLY Done with the handshake. */
+      {
+#ifdef CURLVERBOSE
+        const uint16_t proto = rustls_connection_get_protocol_version(rconn);
+        const rustls_str ciphersuite_name =
+          rustls_connection_get_negotiated_ciphersuite_name(rconn);
+        const rustls_str kex_group_name =
+          rustls_connection_get_negotiated_key_exchange_group_name(rconn);
+        const char *ver = "TLS version unknown";
+        if(proto == RUSTLS_TLS_VERSION_TLSV1_3)
+          ver = "TLSv1.3";
+        if(proto == RUSTLS_TLS_VERSION_TLSV1_2)
+          ver = "TLSv1.2";
+#endif
+        infof(data,
+              "rustls: handshake complete, %s, ciphersuite: %.*s, "
+              "key exchange group: %.*s",
+              ver,
+              (int) ciphersuite_name.len,
+              ciphersuite_name.data,
+              (int) kex_group_name.len,
+              kex_group_name.data);
+      }
+      if(data->set.ssl.certinfo) {
+        size_t num_certs = 0;
+        size_t i;
+        while(rustls_connection_get_peer_certificate(rconn, num_certs)) {
+          num_certs++;
+          if(num_certs > MAX_ALLOWED_CERT_AMOUNT) {
+            failf(data, "%zu certificates is more than allowed (%d)",
+                  num_certs, MAX_ALLOWED_CERT_AMOUNT);
+            return CURLE_SSL_CONNECT_ERROR;
+          }
+        }
+        result = Curl_ssl_init_certinfo(data, (int)num_certs);
+        if(result)
+          return result;
+        for(i = 0; i < num_certs; i++) {
+          const rustls_certificate *cert;
+          const unsigned char *der_data;
+          size_t der_len;
+          rustls_result rresult = RUSTLS_RESULT_OK;
+          cert = rustls_connection_get_peer_certificate(rconn, i);
+          DEBUGASSERT(cert); /* Should exist since we counted already */
+          rresult = rustls_certificate_get_der(cert, &der_data, &der_len);
+          if(rresult != RUSTLS_RESULT_OK) {
+            char errorbuf[255];
+            size_t errorlen;
+            rustls_error(rresult, errorbuf, sizeof(errorbuf), &errorlen);
+            failf(data,
+                  "Failed getting DER of server certificate #%zu: %.*s", i,
+                  (int)errorlen, errorbuf);
+            return map_error(rresult);
+          }
+          {
+            const char *beg;
+            const char *end;
+            beg = (const char *)der_data;
+            end = (const char *)(der_data + der_len);
+            result = Curl_extract_certinfo(data, (int)i, beg, end);
+            if(result)
+              return result;
+          }
+        }
+      }
 
+      connssl->state = ssl_connection_complete;
       *done = TRUE;
       return CURLE_OK;
     }
 
+    connssl->connecting_state = ssl_connect_2;
     wants_read = rustls_connection_wants_read(rconn);
-    wants_write = rustls_connection_wants_write(rconn);
+    wants_write = rustls_connection_wants_write(rconn) ||
+                  backend->plain_out_buffered;
     DEBUGASSERT(wants_read || wants_write);
-    writefd = wants_write?sockfd:CURL_SOCKET_BAD;
-    readfd = wants_read?sockfd:CURL_SOCKET_BAD;
-
-    what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd, 0);
-    if(what < 0) {
-      /* fatal error */
-      failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-    if(0 == what) {
-      infof(data, "Curl_socket_check: %s would block",
-            wants_read&&wants_write ? "writing and reading" :
-            wants_write ? "writing" : "reading");
-      *done = FALSE;
-      return CURLE_OK;
-    }
-    /* socket is readable or writable */
 
     if(wants_write) {
-      infof(data, "rustls_connection wants us to write_tls.");
-      cr_send(cf, data, NULL, 0, &tmperr);
+      size_t nwritten;
+      CURL_TRC_CF(data, cf, "rustls_connection wants us to write_tls.");
+      tmperr = cr_send(cf, data, NULL, 0, &nwritten);
       if(tmperr == CURLE_AGAIN) {
-        infof(data, "writing would block");
-        /* fall through */
+        CURL_TRC_CF(data, cf, "writing would block");
+        connssl->io_need = CURL_SSL_IO_NEED_SEND;
+        return CURLE_OK;
       }
       else if(tmperr != CURLE_OK) {
         return tmperr;
@@ -567,14 +1295,20 @@ cr_connect_nonblocking(struct Curl_cfilter *cf,
     }
 
     if(wants_read) {
-      infof(data, "rustls_connection wants us to read_tls.");
-
-      if(tls_recv_more(cf, data, &tmperr) < 0) {
+      CURL_TRC_CF(data, cf, "rustls_connection wants us to read_tls.");
+      nread = tls_recv_more(cf, data, &tmperr);
+      if(nread == 0) {
+        connssl->peer_closed = TRUE;
+        failf(data, "TLS connect error: Connection closed abruptly");
+        return CURLE_SSL_CONNECT_ERROR;
+      }
+      if(nread < 0) {
         if(tmperr == CURLE_AGAIN) {
-          infof(data, "reading would block");
-          /* fall through */
+          CURL_TRC_CF(data, cf, "reading would block");
+          connssl->io_need = CURL_SSL_IO_NEED_RECV;
+          return CURLE_OK;
         }
-        else if(tmperr == CURLE_READ_ERROR) {
+        else if(tmperr == CURLE_RECV_ERROR) {
           return CURLE_SSL_CONNECT_ERROR;
         }
         else {
@@ -585,66 +1319,91 @@ cr_connect_nonblocking(struct Curl_cfilter *cf,
   }
 
   /* We should never fall through the loop. We should return either because
-     the handshake is done or because we can't read/write without blocking. */
-  DEBUGASSERT(false);
+     the handshake is done or because we cannot read/write without blocking. */
+  DEBUGASSERT(FALSE);
 }
 
-/* returns a bitmap of flags for this connection's first socket indicating
-   whether we want to read or write */
-static int
-cr_get_select_socks(struct Curl_cfilter *cf, struct Curl_easy *data,
-                    curl_socket_t *socks)
-{
-  struct ssl_connect_data *const connssl = cf->ctx;
-  curl_socket_t sockfd = Curl_conn_cf_get_socket(cf, data);
-  struct rustls_ssl_backend_data *const backend =
-    (struct rustls_ssl_backend_data *)connssl->backend;
-  struct rustls_connection *rconn = NULL;
-
-  (void)data;
-  DEBUGASSERT(backend);
-  rconn = backend->conn;
-
-  if(rustls_connection_wants_write(rconn)) {
-    socks[0] = sockfd;
-    return GETSOCK_WRITESOCK(0);
-  }
-  if(rustls_connection_wants_read(rconn)) {
-    socks[0] = sockfd;
-    return GETSOCK_READSOCK(0);
-  }
-
-  return GETSOCK_BLANK;
-}
-
-static void *
-cr_get_internals(struct ssl_connect_data *connssl,
-                 CURLINFO info UNUSED_PARAM)
+static void *cr_get_internals(struct ssl_connect_data *connssl, CURLINFO info)
 {
   struct rustls_ssl_backend_data *backend =
     (struct rustls_ssl_backend_data *)connssl->backend;
+  (void)info;
   DEBUGASSERT(backend);
-  return &backend->conn;
+  return backend->conn;
 }
 
-static void
-cr_close(struct Curl_cfilter *cf, struct Curl_easy *data)
+static CURLcode cr_shutdown(struct Curl_cfilter *cf, struct Curl_easy *data,
+                            const bool send_shutdown, bool *done)
 {
   struct ssl_connect_data *connssl = cf->ctx;
   struct rustls_ssl_backend_data *backend =
     (struct rustls_ssl_backend_data *)connssl->backend;
-  CURLcode tmperr = CURLE_OK;
-  ssize_t n = 0;
+  CURLcode result = CURLE_OK;
+  size_t i, nread = 0, nwritten;
 
   DEBUGASSERT(backend);
+  if(!backend->conn || cf->shutdown) {
+    *done = TRUE;
+    goto out;
+  }
 
-  if(backend->conn) {
-    rustls_connection_send_close_notify(backend->conn);
-    n = cr_send(cf, data, NULL, 0, &tmperr);
-    if(n < 0) {
-      failf(data, "rustls: error sending close_notify: %d", tmperr);
+  connssl->io_need = CURL_SSL_IO_NEED_NONE;
+  *done = FALSE;
+
+  if(!backend->sent_shutdown) {
+    /* do this only once */
+    backend->sent_shutdown = TRUE;
+    if(send_shutdown) {
+      rustls_connection_send_close_notify(backend->conn);
     }
+  }
 
+  result = cr_send(cf, data, NULL, 0, &nwritten);
+  if(result) {
+    if(result == CURLE_AGAIN) {
+      connssl->io_need = CURL_SSL_IO_NEED_SEND;
+      result = CURLE_OK;
+      goto out;
+    }
+    DEBUGASSERT(result);
+    CURL_TRC_CF(data, cf, "shutdown send failed: %d", (int)result);
+    goto out;
+  }
+
+  for(i = 0; i < 10; ++i) {
+    char buf[1024];
+    result = cr_recv(cf, data, buf, (int)sizeof(buf), &nread);
+    if(result)
+      break;
+  }
+
+  if(result == CURLE_AGAIN) {
+    connssl->io_need = CURL_SSL_IO_NEED_RECV;
+    result = CURLE_OK;
+  }
+  else if(result) {
+    DEBUGASSERT(result);
+    CURL_TRC_CF(data, cf, "shutdown, error: %d", (int)result);
+  }
+  else if(nread == 0) {
+    /* We got the close notify alert and are done. */
+    *done = TRUE;
+  }
+
+out:
+  cf->shutdown = (result || *done);
+  return result;
+}
+
+static void cr_close(struct Curl_cfilter *cf, struct Curl_easy *data)
+{
+  const struct ssl_connect_data *connssl = cf->ctx;
+  struct rustls_ssl_backend_data *backend =
+    (struct rustls_ssl_backend_data *)connssl->backend;
+
+  (void)data;
+  DEBUGASSERT(backend);
+  if(backend->conn) {
     rustls_connection_free(backend->conn);
     backend->conn = NULL;
   }
@@ -656,42 +1415,54 @@ cr_close(struct Curl_cfilter *cf, struct Curl_easy *data)
 
 static size_t cr_version(char *buffer, size_t size)
 {
-  struct rustls_str ver = rustls_version();
-  return msnprintf(buffer, size, "%.*s", (int)ver.len, ver.data);
+  const struct rustls_str ver = rustls_version();
+  return curl_msnprintf(buffer, size, "%.*s", (int)ver.len, ver.data);
+}
+
+static CURLcode cr_random(struct Curl_easy *data, unsigned char *entropy,
+                          size_t length)
+{
+  rustls_result rresult = 0;
+  (void)data;
+  rresult = rustls_default_crypto_provider_random(entropy, length);
+  return map_error(rresult);
+}
+
+static void cr_cleanup(void)
+{
+  Curl_tls_keylog_close();
 }
 
 const struct Curl_ssl Curl_ssl_rustls = {
   { CURLSSLBACKEND_RUSTLS, "rustls" },
   SSLSUPP_CAINFO_BLOB |            /* supports */
+  SSLSUPP_HTTPS_PROXY |
+  SSLSUPP_CIPHER_LIST |
   SSLSUPP_TLS13_CIPHERSUITES |
-  SSLSUPP_HTTPS_PROXY,
+  SSLSUPP_CERTINFO |
+  SSLSUPP_ECH |
+  SSLSUPP_CRLFILE,
   sizeof(struct rustls_ssl_backend_data),
 
-  Curl_none_init,                  /* init */
-  Curl_none_cleanup,               /* cleanup */
+  NULL,                            /* init */
+  cr_cleanup,                      /* cleanup */
   cr_version,                      /* version */
-  Curl_none_check_cxn,             /* check_cxn */
-  Curl_none_shutdown,              /* shutdown */
+  cr_shutdown,                     /* shutdown */
   cr_data_pending,                 /* data_pending */
-  Curl_none_random,                /* random */
-  Curl_none_cert_status_request,   /* cert_status_request */
+  cr_random,                       /* random */
+  NULL,                            /* cert_status_request */
   cr_connect,                      /* connect */
-  cr_connect_nonblocking,          /* connect_nonblocking */
-  cr_get_select_socks,             /* get_select_socks */
+  Curl_ssl_adjust_pollset,         /* adjust_pollset */
   cr_get_internals,                /* get_internals */
   cr_close,                        /* close_one */
-  Curl_none_close_all,             /* close_all */
-  Curl_none_session_free,          /* session_free */
-  Curl_none_set_engine,            /* set_engine */
-  Curl_none_set_engine_default,    /* set_engine_default */
-  Curl_none_engines_list,          /* engines_list */
-  Curl_none_false_start,           /* false_start */
+  NULL,                            /* close_all */
+  NULL,                            /* set_engine */
+  NULL,                            /* set_engine_default */
+  NULL,                            /* engines_list */
   NULL,                            /* sha256sum */
-  NULL,                            /* associate_connection */
-  NULL,                            /* disassociate_connection */
-  NULL,                            /* free_multi_ssl_backend_data */
   cr_recv,                         /* recv decrypted data */
   cr_send,                         /* send data to encrypt */
+  NULL,                            /* get_channel_binding */
 };
 
 #endif /* USE_RUSTLS */
diff --git a/third-party/curl/lib/vtls/rustls.h b/third-party/curl/lib/vtls/rustls.h
index bfbe23de3e..b6ddbd1b7e 100644
--- a/third-party/curl/lib/vtls/rustls.h
+++ b/third-party/curl/lib/vtls/rustls.h
@@ -1,3 +1,5 @@
+#ifndef HEADER_CURL_RUSTLS_H
+#define HEADER_CURL_RUSTLS_H
 /***************************************************************************
  *                                  _   _ ____  _
  *  Project                     ___| | | |  _ \| |
@@ -5,8 +7,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) Jacob Hoffman-Andrews,
- * <github@hoffman-andrews.com>
+ * Copyright (C) Jacob Hoffman-Andrews, <github@hoffman-andrews.com>
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -22,9 +23,6 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#ifndef HEADER_CURL_RUSTLS_H
-#define HEADER_CURL_RUSTLS_H
-
 #include "curl_setup.h"
 
 #ifdef USE_RUSTLS
diff --git a/third-party/curl/lib/vtls/schannel.c b/third-party/curl/lib/vtls/schannel.c
index f6a5d441a9..3e871227aa 100644
--- a/third-party/curl/lib/vtls/schannel.c
+++ b/third-party/curl/lib/vtls/schannel.c
@@ -23,138 +23,73 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /*
  * Source file for all Schannel-specific code for the TLS/SSL layer. No code
  * but vtls.c should ever call or use these functions.
  */
-
 #include "curl_setup.h"
 
 #ifdef USE_SCHANNEL
 
 #ifndef USE_WINDOWS_SSPI
-#  error "Can't compile SCHANNEL support without SSPI."
+#error "cannot compile Schannel support without SSPI."
 #endif
 
-#include "schannel.h"
-#include "schannel_int.h"
-#include "vtls.h"
-#include "vtls_int.h"
-#include "strcase.h"
-#include "sendf.h"
+#include "vtls/schannel.h"
+#include "vtls/schannel_int.h"
+#include "vtls/vtls.h"
+#include "vtls/vtls_int.h"
+#include "vtls/vtls_scache.h"
+#include "curl_trc.h"
 #include "connect.h" /* for the connect timeout */
+#include "curlx/strdup.h"
 #include "strerror.h"
 #include "select.h" /* for the socket readiness */
-#include "inet_pton.h" /* for IP addr SNI check */
-#include "curl_multibyte.h"
-#include "warnless.h"
-#include "x509asn1.h"
-#include "curl_printf.h"
-#include "multiif.h"
-#include "version_win32.h"
+#include "curlx/fopen.h"
+#include "curlx/multibyte.h"
+#include "vtls/x509asn1.h"
+#include "system_win32.h"
+#include "curlx/version_win32.h"
 #include "rand.h"
+#include "curlx/strparse.h"
+#include "progress.h"
+#include "curl_sha256.h"
 
-/* The last #include file should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
-
-/* ALPN requires version 8.1 of the Windows SDK, which was
-   shipped with Visual Studio 2013, aka _MSC_VER 1800:
-
-   https://technet.microsoft.com/en-us/library/hh831771%28v=ws.11%29.aspx
-*/
-#if defined(_MSC_VER) && (_MSC_VER >= 1800) && !defined(_USING_V110_SDK71_)
-#  define HAS_ALPN 1
-#endif
-
-#ifndef UNISP_NAME_A
-#define UNISP_NAME_A "Microsoft Unified Security Protocol Provider"
-#endif
-
-#ifndef UNISP_NAME_W
-#define UNISP_NAME_W L"Microsoft Unified Security Protocol Provider"
-#endif
-
-#ifndef UNISP_NAME
-#ifdef UNICODE
-#define UNISP_NAME  UNISP_NAME_W
+/* Some verbose debug messages are wrapped by SCH_DEV() instead of DEBUGF()
+ * and only shown if CURL_SCHANNEL_DEV_DEBUG was defined at build time. These
+ * messages are extra verbose and intended for curl developers debugging
+ * Schannel recv decryption and renegotiation.
+ */
+#ifdef CURL_SCHANNEL_DEV_DEBUG
+#define SCH_DEV(x) x
+#define SCH_DEV_SHOWBOOL(x)                                   \
+  infof(data, "schannel: " #x " %s", (x) ? "TRUE" : "FALSE");
 #else
-#define UNISP_NAME  UNISP_NAME_A
-#endif
-#endif
-
-#ifndef BCRYPT_CHACHA20_POLY1305_ALGORITHM
-#define BCRYPT_CHACHA20_POLY1305_ALGORITHM L"CHACHA20_POLY1305"
-#endif
-
-#ifndef BCRYPT_CHAIN_MODE_CCM
-#define BCRYPT_CHAIN_MODE_CCM L"ChainingModeCCM"
-#endif
-
-#ifndef BCRYPT_CHAIN_MODE_GCM
-#define BCRYPT_CHAIN_MODE_GCM L"ChainingModeGCM"
-#endif
-
-#ifndef BCRYPT_AES_ALGORITHM
-#define BCRYPT_AES_ALGORITHM L"AES"
-#endif
-
-#ifndef BCRYPT_SHA256_ALGORITHM
-#define BCRYPT_SHA256_ALGORITHM L"SHA256"
-#endif
-
-#ifndef BCRYPT_SHA384_ALGORITHM
-#define BCRYPT_SHA384_ALGORITHM L"SHA384"
-#endif
-
-/* Workaround broken compilers like MinGW.
-   Return the number of elements in a statically sized array.
-*/
-#ifndef ARRAYSIZE
-#define ARRAYSIZE(A) (sizeof(A)/sizeof((A)[0]))
-#endif
-
-#ifdef HAS_CLIENT_CERT_PATH
-#ifdef UNICODE
-#define CURL_CERT_STORE_PROV_SYSTEM CERT_STORE_PROV_SYSTEM_W
-#else
-#define CURL_CERT_STORE_PROV_SYSTEM CERT_STORE_PROV_SYSTEM_A
-#endif
-#endif
-
-#ifndef SP_PROT_SSL2_CLIENT
-#define SP_PROT_SSL2_CLIENT             0x00000008
-#endif
-
-#ifndef SP_PROT_SSL3_CLIENT
-#define SP_PROT_SSL3_CLIENT             0x00000008
-#endif
-
-#ifndef SP_PROT_TLS1_CLIENT
-#define SP_PROT_TLS1_CLIENT             0x00000080
+#define SCH_DEV(x) do {} while(0)
+#define SCH_DEV_SHOWBOOL(x) do {} while(0)
 #endif
 
+/* Offered by mingw-w64 v8+, MS SDK 7.0A/VS2010+ */
 #ifndef SP_PROT_TLS1_0_CLIENT
 #define SP_PROT_TLS1_0_CLIENT           SP_PROT_TLS1_CLIENT
 #endif
-
 #ifndef SP_PROT_TLS1_1_CLIENT
 #define SP_PROT_TLS1_1_CLIENT           0x00000200
 #endif
-
 #ifndef SP_PROT_TLS1_2_CLIENT
 #define SP_PROT_TLS1_2_CLIENT           0x00000800
 #endif
 
+/* Offered by mingw-w64 v8+, MS SDK 10.0.15063.0/VS2017 15.1+ */
 #ifndef SP_PROT_TLS1_3_CLIENT
 #define SP_PROT_TLS1_3_CLIENT           0x00002000
 #endif
-
+/* Offered by mingw-w64 v8+, MS SDK 8.1/~VS2013+ */
 #ifndef SCH_USE_STRONG_CRYPTO
 #define SCH_USE_STRONG_CRYPTO           0x00400000
 #endif
 
+/* Offered by mingw-w64 v10+, MS SDK 7.0A/VS2010+ */
 #ifndef SECBUFFER_ALERT
 #define SECBUFFER_ALERT                 17
 #endif
@@ -167,27 +102,33 @@
 #define CERT_THUMBPRINT_DATA_LEN 20
 
 /* Uncomment to force verbose output
- * #define infof(x, y, ...) printf(y, __VA_ARGS__)
- * #define failf(x, y, ...) printf(y, __VA_ARGS__)
+ * #define infof(x, y, ...) curl_mprintf(y, __VA_ARGS__)
+ * #define failf(x, y, ...) curl_mprintf(y, __VA_ARGS__)
  */
 
-#ifndef CALG_SHA_256
-#  define CALG_SHA_256 0x0000800c
-#endif
-
-/* Work around typo in classic MinGW's w32api up to version 5.0,
-   see https://osdn.net/projects/mingw/ticket/38391 */
-#if !defined(ALG_CLASS_DHASH) && defined(ALG_CLASS_HASH)
-#define ALG_CLASS_DHASH ALG_CLASS_HASH
-#endif
-
+/* Offered by mingw-w64 v4+, MS SDK 6.0A/VS2008+ */
 #ifndef PKCS12_NO_PERSIST_KEY
 #define PKCS12_NO_PERSIST_KEY 0x00008000
 #endif
 
-static CURLcode schannel_pkp_pin_peer_pubkey(struct Curl_cfilter *cf,
-                                             struct Curl_easy *data,
-                                             const char *pinnedpubkey);
+/* Offered by mingw-w64 v4+, MS SDK 8.0/~VS2012+ */
+#ifndef CERT_FIND_HAS_PRIVATE_KEY
+#define CERT_FIND_HAS_PRIVATE_KEY (21 << CERT_COMPARE_SHIFT)
+#endif
+
+/* key to use at `multi->proto_hash` */
+#define MPROTO_SCHANNEL_CERT_SHARE_KEY   "tls:schannel:cert:share"
+
+/* ALPN requires version 8.1 of the Windows SDK, which was
+   shipped with Visual Studio 2013, aka _MSC_VER 1800:
+     https://learn.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831771
+   Or mingw-w64 9.0 or upper.
+*/
+#if (defined(__MINGW64_VERSION_MAJOR) && __MINGW64_VERSION_MAJOR >= 9) || \
+  (defined(_MSC_VER) && (_MSC_VER >= 1800) && !defined(_USING_V110_SDK71_))
+#define HAS_ALPN_SCHANNEL
+static bool s_win_has_alpn;
+#endif
 
 static void InitSecBuffer(SecBuffer *buffer, unsigned long BufType,
                           void *BufDataPtr, unsigned long BufByteSize)
@@ -205,14 +146,13 @@ static void InitSecBufferDesc(SecBufferDesc *desc, SecBuffer *BufArr,
   desc->cBuffers = NumArrElem;
 }
 
-static CURLcode
-schannel_set_ssl_version_min_max(DWORD *enabled_protocols,
-                                 struct Curl_cfilter *cf,
-                                 struct Curl_easy *data)
+static CURLcode schannel_set_ssl_version_min_max(DWORD *enabled_protocols,
+                                                 struct Curl_cfilter *cf,
+                                                 struct Curl_easy *data)
 {
   struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
   long ssl_version = conn_config->version;
-  long ssl_version_max = conn_config->version_max;
+  long ssl_version_max = (long)conn_config->version_max;
   long i = ssl_version;
 
   switch(ssl_version_max) {
@@ -227,7 +167,7 @@ schannel_set_ssl_version_min_max(DWORD *enabled_protocols,
                                     VERSION_GREATER_THAN_EQUAL)) {
       ssl_version_max = CURL_SSLVERSION_MAX_TLSv1_3;
     }
-    else /* Windows 10 and older */
+    else /* Windows 10 or older */
       ssl_version_max = CURL_SSLVERSION_MAX_TLSv1_2;
 
     break;
@@ -236,24 +176,24 @@ schannel_set_ssl_version_min_max(DWORD *enabled_protocols,
   for(; i <= (ssl_version_max >> 16); ++i) {
     switch(i) {
     case CURL_SSLVERSION_TLSv1_0:
-      (*enabled_protocols) |= SP_PROT_TLS1_0_CLIENT;
+      *enabled_protocols |= SP_PROT_TLS1_0_CLIENT;
       break;
     case CURL_SSLVERSION_TLSv1_1:
-      (*enabled_protocols) |= SP_PROT_TLS1_1_CLIENT;
+      *enabled_protocols |= SP_PROT_TLS1_1_CLIENT;
       break;
     case CURL_SSLVERSION_TLSv1_2:
-      (*enabled_protocols) |= SP_PROT_TLS1_2_CLIENT;
+      *enabled_protocols |= SP_PROT_TLS1_2_CLIENT;
       break;
     case CURL_SSLVERSION_TLSv1_3:
 
       /* Windows Server 2022 and newer */
       if(curlx_verify_windows_version(10, 0, 20348, PLATFORM_WINNT,
                                       VERSION_GREATER_THAN_EQUAL)) {
-        (*enabled_protocols) |= SP_PROT_TLS1_3_CLIENT;
+        *enabled_protocols |= SP_PROT_TLS1_3_CLIENT;
         break;
       }
-      else { /* Windows 10 and older */
-        failf(data, "schannel: TLS 1.3 not supported on Windows prior to 11");
+      else { /* Windows 10 or older */
+        failf(data, "schannel: TLS 1.3 not supported on Windows 10 or older");
         return CURLE_SSL_CONNECT_ERROR;
       }
     }
@@ -261,16 +201,14 @@ schannel_set_ssl_version_min_max(DWORD *enabled_protocols,
   return CURLE_OK;
 }
 
-/* longest is 26, buffer is slightly bigger */
-#define LONGEST_ALG_ID 32
-#define CIPHEROPTION(x) {#x, x}
+#define CIPHEROPTION(x) { #x, x }
 
 struct algo {
   const char *name;
   int id;
 };
 
-static const struct algo algs[]= {
+static const struct algo algs[] = {
   CIPHEROPTION(CALG_MD2),
   CIPHEROPTION(CALG_MD4),
   CIPHEROPTION(CALG_MD5),
@@ -279,109 +217,57 @@ static const struct algo algs[]= {
   CIPHEROPTION(CALG_MAC),
   CIPHEROPTION(CALG_RSA_SIGN),
   CIPHEROPTION(CALG_DSS_SIGN),
-/* ifdefs for the options that are defined conditionally in wincrypt.h */
-#ifdef CALG_NO_SIGN
   CIPHEROPTION(CALG_NO_SIGN),
-#endif
   CIPHEROPTION(CALG_RSA_KEYX),
   CIPHEROPTION(CALG_DES),
-#ifdef CALG_3DES_112
   CIPHEROPTION(CALG_3DES_112),
-#endif
   CIPHEROPTION(CALG_3DES),
   CIPHEROPTION(CALG_DESX),
   CIPHEROPTION(CALG_RC2),
   CIPHEROPTION(CALG_RC4),
   CIPHEROPTION(CALG_SEAL),
-#ifdef CALG_DH_SF
   CIPHEROPTION(CALG_DH_SF),
-#endif
   CIPHEROPTION(CALG_DH_EPHEM),
-#ifdef CALG_AGREEDKEY_ANY
   CIPHEROPTION(CALG_AGREEDKEY_ANY),
-#endif
-#ifdef CALG_HUGHES_MD5
   CIPHEROPTION(CALG_HUGHES_MD5),
-#endif
   CIPHEROPTION(CALG_SKIPJACK),
-#ifdef CALG_TEK
   CIPHEROPTION(CALG_TEK),
-#endif
-  CIPHEROPTION(CALG_CYLINK_MEK),
+  CIPHEROPTION(CALG_CYLINK_MEK), /* spellchecker:disable-line */
   CIPHEROPTION(CALG_SSL3_SHAMD5),
-#ifdef CALG_SSL3_MASTER
   CIPHEROPTION(CALG_SSL3_MASTER),
-#endif
-#ifdef CALG_SCHANNEL_MASTER_HASH
   CIPHEROPTION(CALG_SCHANNEL_MASTER_HASH),
-#endif
-#ifdef CALG_SCHANNEL_MAC_KEY
   CIPHEROPTION(CALG_SCHANNEL_MAC_KEY),
-#endif
-#ifdef CALG_SCHANNEL_ENC_KEY
   CIPHEROPTION(CALG_SCHANNEL_ENC_KEY),
-#endif
-#ifdef CALG_PCT1_MASTER
   CIPHEROPTION(CALG_PCT1_MASTER),
-#endif
-#ifdef CALG_SSL2_MASTER
   CIPHEROPTION(CALG_SSL2_MASTER),
-#endif
-#ifdef CALG_TLS1_MASTER
   CIPHEROPTION(CALG_TLS1_MASTER),
-#endif
-#ifdef CALG_RC5
   CIPHEROPTION(CALG_RC5),
-#endif
-#ifdef CALG_HMAC
   CIPHEROPTION(CALG_HMAC),
-#endif
-#ifdef CALG_TLS1PRF
   CIPHEROPTION(CALG_TLS1PRF),
-#endif
-#ifdef CALG_HASH_REPLACE_OWF
   CIPHEROPTION(CALG_HASH_REPLACE_OWF),
-#endif
-#ifdef CALG_AES_128
   CIPHEROPTION(CALG_AES_128),
-#endif
-#ifdef CALG_AES_192
   CIPHEROPTION(CALG_AES_192),
-#endif
-#ifdef CALG_AES_256
   CIPHEROPTION(CALG_AES_256),
-#endif
-#ifdef CALG_AES
   CIPHEROPTION(CALG_AES),
-#endif
-#ifdef CALG_SHA_256
   CIPHEROPTION(CALG_SHA_256),
-#endif
-#ifdef CALG_SHA_384
   CIPHEROPTION(CALG_SHA_384),
-#endif
-#ifdef CALG_SHA_512
   CIPHEROPTION(CALG_SHA_512),
-#endif
-#ifdef CALG_ECDH
   CIPHEROPTION(CALG_ECDH),
-#endif
+/* Offered by mingw-w64 v4+, MS SDK 6.0A/VS2008+ */
 #ifdef CALG_ECMQV
   CIPHEROPTION(CALG_ECMQV),
 #endif
-#ifdef CALG_ECDSA
   CIPHEROPTION(CALG_ECDSA),
-#endif
+/* Offered by mingw-w64 v7+, MS SDK 7.0A/VS2010+ */
 #ifdef CALG_ECDH_EPHEM
   CIPHEROPTION(CALG_ECDH_EPHEM),
 #endif
-  {NULL, 0},
+  { NULL, 0 },
 };
 
-static int
-get_alg_id_by_name(char *name)
+static int get_alg_id_by_name(const char *name)
 {
-  char *nameEnd = strchr(name, ':');
+  const char *nameEnd = strchr(name, ':');
   size_t n = nameEnd ? (size_t)(nameEnd - name) : strlen(name);
   int i;
 
@@ -392,20 +278,20 @@ get_alg_id_by_name(char *name)
   return 0; /* not found */
 }
 
-#define NUM_CIPHERS 47 /* There are 47 options listed above */
+#define NUM_CIPHERS 47 /* There are a maximum of 47 options listed above */
 
-static CURLcode
-set_ssl_ciphers(SCHANNEL_CRED *schannel_cred, char *ciphers,
-                ALG_ID *algIds)
+static CURLcode set_ssl_ciphers(SCHANNEL_CRED *schannel_cred, char *ciphers,
+                                ALG_ID *algIds)
 {
-  char *startCur = ciphers;
+  const char *startCur = ciphers;
   int algCount = 0;
-  while(startCur && (0 != *startCur) && (algCount < NUM_CIPHERS)) {
-    long alg = strtol(startCur, 0, 0);
-    if(!alg)
+  while(startCur && *startCur && (algCount < NUM_CIPHERS)) {
+    curl_off_t alg;
+    if(curlx_str_number(&startCur, &alg, INT_MAX) || !alg)
       alg = get_alg_id_by_name(startCur);
+
     if(alg)
-      algIds[algCount++] = alg;
+      algIds[algCount++] = (ALG_ID)alg;
     else if(!strncmp(startCur, "USE_STRONG_CRYPTO",
                      sizeof("USE_STRONG_CRYPTO") - 1) ||
             !strncmp(startCur, "SCH_USE_STRONG_CRYPTO",
@@ -418,16 +304,13 @@ set_ssl_ciphers(SCHANNEL_CRED *schannel_cred, char *ciphers,
       startCur++;
   }
   schannel_cred->palgSupportedAlgs = algIds;
-  schannel_cred->cSupportedAlgs = algCount;
+  schannel_cred->cSupportedAlgs = (DWORD)algCount;
   return CURLE_OK;
 }
 
-#ifdef HAS_CLIENT_CERT_PATH
-
 /* Function allocates memory for store_path only if CURLE_OK is returned */
-static CURLcode
-get_cert_location(TCHAR *path, DWORD *store_name, TCHAR **store_path,
-                  TCHAR **thumbprint)
+static CURLcode get_cert_location(TCHAR *path, DWORD *store_name,
+                                  TCHAR **store_path, TCHAR **thumbprint)
 {
   TCHAR *sep;
   TCHAR *store_path_start;
@@ -449,14 +332,11 @@ get_cert_location(TCHAR *path, DWORD *store_name, TCHAR **store_path,
     *store_name = CERT_SYSTEM_STORE_SERVICES;
   else if(_tcsncmp(path, TEXT("Users"), store_name_len) == 0)
     *store_name = CERT_SYSTEM_STORE_USERS;
-  else if(_tcsncmp(path, TEXT("CurrentUserGroupPolicy"),
-                   store_name_len) == 0)
+  else if(_tcsncmp(path, TEXT("CurrentUserGroupPolicy"), store_name_len) == 0)
     *store_name = CERT_SYSTEM_STORE_CURRENT_USER_GROUP_POLICY;
-  else if(_tcsncmp(path, TEXT("LocalMachineGroupPolicy"),
-                   store_name_len) == 0)
+  else if(_tcsncmp(path, TEXT("LocalMachineGroupPolicy"), store_name_len) == 0)
     *store_name = CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY;
-  else if(_tcsncmp(path, TEXT("LocalMachineEnterprise"),
-                   store_name_len) == 0)
+  else if(_tcsncmp(path, TEXT("LocalMachineEnterprise"), store_name_len) == 0)
     *store_name = CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE;
   else
     return CURLE_SSL_CERTPROBLEM;
@@ -472,171 +352,93 @@ get_cert_location(TCHAR *path, DWORD *store_name, TCHAR **store_path,
     return CURLE_SSL_CERTPROBLEM;
 
   *sep = TEXT('\0');
-  *store_path = _tcsdup(store_path_start);
+  *store_path = curlx_tcsdup(store_path_start);
   *sep = TEXT('\\');
   if(!*store_path)
     return CURLE_OUT_OF_MEMORY;
 
   return CURLE_OK;
 }
-#endif
-static CURLcode
-schannel_acquire_credential_handle(struct Curl_cfilter *cf,
-                                   struct Curl_easy *data)
+
+static CURLcode get_client_cert(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                HCERTSTORE *out_cert_store,
+                                PCCERT_CONTEXT *out_cert_context)
 {
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
-  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
-
-#ifdef HAS_CLIENT_CERT_PATH
-  PCCERT_CONTEXT client_certs[1] = { NULL };
+  struct ssl_primary_config *sslc = Curl_ssl_cf_get_primary_config(cf);
+  PCCERT_CONTEXT client_cert = NULL;
   HCERTSTORE client_cert_store = NULL;
-#endif
-  SECURITY_STATUS sspi_status = SEC_E_OK;
-  CURLcode result;
+  CURLcode result = CURLE_OK;
 
-  /* setup Schannel API options */
-  DWORD flags = 0;
-  DWORD enabled_protocols = 0;
-
-  struct schannel_ssl_backend_data *backend =
-    (struct schannel_ssl_backend_data *)(connssl->backend);
-
-  DEBUGASSERT(backend);
-
-  if(conn_config->verifypeer) {
-#ifdef HAS_MANUAL_VERIFY_API
-    if(backend->use_manual_cred_validation)
-      flags = SCH_CRED_MANUAL_CRED_VALIDATION;
-    else
-#endif
-      flags = SCH_CRED_AUTO_CRED_VALIDATION;
-
-    if(ssl_config->no_revoke) {
-      flags |= SCH_CRED_IGNORE_NO_REVOCATION_CHECK |
-        SCH_CRED_IGNORE_REVOCATION_OFFLINE;
-
-      DEBUGF(infof(data, "schannel: disabled server certificate revocation "
-                   "checks"));
-    }
-    else if(ssl_config->revoke_best_effort) {
-      flags |= SCH_CRED_IGNORE_NO_REVOCATION_CHECK |
-        SCH_CRED_IGNORE_REVOCATION_OFFLINE | SCH_CRED_REVOCATION_CHECK_CHAIN;
-
-      DEBUGF(infof(data, "schannel: ignore revocation offline errors"));
-    }
-    else {
-      flags |= SCH_CRED_REVOCATION_CHECK_CHAIN;
-
-      DEBUGF(infof(data,
-                   "schannel: checking server certificate revocation"));
-    }
-  }
-  else {
-    flags = SCH_CRED_MANUAL_CRED_VALIDATION |
-      SCH_CRED_IGNORE_NO_REVOCATION_CHECK |
-      SCH_CRED_IGNORE_REVOCATION_OFFLINE;
-    DEBUGF(infof(data,
-                 "schannel: disabled server cert revocation checks"));
-  }
-
-  if(!conn_config->verifyhost) {
-    flags |= SCH_CRED_NO_SERVERNAME_CHECK;
-    DEBUGF(infof(data, "schannel: verifyhost setting prevents Schannel from "
-                 "comparing the supplied target name with the subject "
-                 "names in server certificates."));
-  }
-
-  if(!ssl_config->auto_client_cert) {
-    flags &= ~SCH_CRED_USE_DEFAULT_CREDS;
-    flags |= SCH_CRED_NO_DEFAULT_CREDS;
-    infof(data, "schannel: disabled automatic use of client certificate");
-  }
-  else
-    infof(data, "schannel: enabled automatic use of client certificate");
-
-  switch(conn_config->version) {
-  case CURL_SSLVERSION_DEFAULT:
-  case CURL_SSLVERSION_TLSv1:
-  case CURL_SSLVERSION_TLSv1_0:
-  case CURL_SSLVERSION_TLSv1_1:
-  case CURL_SSLVERSION_TLSv1_2:
-  case CURL_SSLVERSION_TLSv1_3:
-  {
-    result = schannel_set_ssl_version_min_max(&enabled_protocols, cf, data);
-    if(result != CURLE_OK)
-      return result;
-    break;
-  }
-  case CURL_SSLVERSION_SSLv3:
-  case CURL_SSLVERSION_SSLv2:
-    failf(data, "SSL versions not supported");
-    return CURLE_NOT_BUILT_IN;
-  default:
-    failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
-    return CURLE_SSL_CONNECT_ERROR;
-  }
-
-#ifdef HAS_CLIENT_CERT_PATH
-  /* client certificate */
-  if(data->set.ssl.primary.clientcert || data->set.ssl.primary.cert_blob) {
+  if(sslc->clientcert || sslc->cert_blob) {
     DWORD cert_store_name = 0;
     TCHAR *cert_store_path = NULL;
     TCHAR *cert_thumbprint_str = NULL;
+    TCHAR cert_thumbprint_buf[CERT_THUMBPRINT_STR_LEN + 1];
     CRYPT_HASH_BLOB cert_thumbprint;
     BYTE cert_thumbprint_data[CERT_THUMBPRINT_DATA_LEN];
     HCERTSTORE cert_store = NULL;
     FILE *fInCert = NULL;
     void *certdata = NULL;
     size_t certsize = 0;
-    bool blob = data->set.ssl.primary.cert_blob != NULL;
-    TCHAR *cert_path = NULL;
+    bool blob = !!sslc->cert_blob;
+
     if(blob) {
-      certdata = data->set.ssl.primary.cert_blob->data;
-      certsize = data->set.ssl.primary.cert_blob->len;
+      certdata = sslc->cert_blob->data;
+      certsize = sslc->cert_blob->len;
     }
     else {
-      cert_path = curlx_convert_UTF8_to_tchar(
-        data->set.ssl.primary.clientcert);
+      TCHAR *cert_path =
+        curlx_convert_UTF8_to_tchar(sslc->clientcert);
       if(!cert_path)
         return CURLE_OUT_OF_MEMORY;
 
       result = get_cert_location(cert_path, &cert_store_name,
                                  &cert_store_path, &cert_thumbprint_str);
 
-      if(result && (data->set.ssl.primary.clientcert[0]!='\0'))
-        fInCert = fopen(data->set.ssl.primary.clientcert, "rb");
+      /* 'cert_thumbprint_str' points in to the allocated 'cert_path', copy
+         the data. The string is verified to be CERT_THUMBPRINT_STR_LEN bytes
+         long within the get_cert_location() function. */
+      if(!result && cert_thumbprint_str) {
+        memcpy(cert_thumbprint_buf, cert_thumbprint_str,
+               sizeof(cert_thumbprint_buf));
+        cert_thumbprint_str = cert_thumbprint_buf;
+      }
+
+      curlx_free(cert_path);
+      if(result && (sslc->clientcert[0] != '\0'))
+        fInCert = curlx_fopen(sslc->clientcert, "rb");
 
       if(result && !fInCert) {
         failf(data, "schannel: Failed to get certificate location"
               " or file for %s",
-              data->set.ssl.primary.clientcert);
-        curlx_unicodefree(cert_path);
+              sslc->clientcert);
         return result;
       }
     }
 
-    if((fInCert || blob) && (data->set.ssl.cert_type) &&
-       (!strcasecompare(data->set.ssl.cert_type, "P12"))) {
+    if((fInCert || blob) && sslc->cert_type &&
+       !curl_strequal(sslc->cert_type, "P12")) {
       failf(data, "schannel: certificate format compatibility error "
-            " for %s",
-            blob ? "(memory blob)" : data->set.ssl.primary.clientcert);
-      curlx_unicodefree(cert_path);
+            "for %s",
+            blob ? "(memory blob)" : sslc->clientcert);
+      curlx_free(cert_store_path);
+      if(fInCert)
+        curlx_fclose(fInCert);
       return CURLE_SSL_CERTPROBLEM;
     }
 
     if(fInCert || blob) {
-      /* Reading a .P12 or .pfx file, like the example at bottom of
-         https://social.msdn.microsoft.com/Forums/windowsdesktop/
-         en-US/3e7bc95f-b21a-4bcd-bd2c-7f996718cae5
+      /* Reading a .p12 or .pfx file, like the example at bottom of
+         https://learn.microsoft.com/archive/msdn-technet-forums/3e7bc95f-b21a-4bcd-bd2c-7f996718cae5
       */
       CRYPT_DATA_BLOB datablob;
-      WCHAR* pszPassword;
+      WCHAR *pszPassword;
       size_t pwd_len = 0;
-      int str_w_len = 0;
+      int cert_find_flags;
       const char *cert_showfilename_error = blob ?
-        "(memory blob)" : data->set.ssl.primary.clientcert;
-      curlx_unicodefree(cert_path);
+        "(memory blob)" : sslc->clientcert;
+      curlx_free(cert_store_path);
       if(fInCert) {
         long cert_tell = 0;
         bool continue_reading = fseek(fInCert, 0, SEEK_END) == 0;
@@ -648,32 +450,33 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
           certsize = (size_t)cert_tell;
         if(continue_reading)
           continue_reading = fseek(fInCert, 0, SEEK_SET) == 0;
-        if(continue_reading)
-          certdata = malloc(certsize + 1);
+        if(continue_reading && (certsize < CURL_MAX_INPUT_LENGTH))
+          certdata = curlx_malloc(certsize + 1);
         if((!certdata) ||
            ((int) fread(certdata, certsize, 1, fInCert) != 1))
           continue_reading = FALSE;
-        fclose(fInCert);
+        curlx_fclose(fInCert);
         if(!continue_reading) {
           failf(data, "schannel: Failed to read cert file %s",
-                data->set.ssl.primary.clientcert);
-          free(certdata);
+                sslc->clientcert);
+          curlx_free(certdata);
           return CURLE_SSL_CERTPROBLEM;
         }
       }
 
       /* Convert key-pair data to the in-memory certificate store */
-      datablob.pbData = (BYTE*)certdata;
+      datablob.pbData = (BYTE *)certdata;
       datablob.cbData = (DWORD)certsize;
 
-      if(data->set.ssl.key_passwd)
-        pwd_len = strlen(data->set.ssl.key_passwd);
-      pszPassword = (WCHAR*)malloc(sizeof(WCHAR)*(pwd_len + 1));
+      if(sslc->key_passwd)
+        pwd_len = strlen(sslc->key_passwd);
+      pszPassword = curlx_malloc(sizeof(WCHAR) * (pwd_len + 1));
       if(pszPassword) {
+        int str_w_len = 0;
         if(pwd_len > 0)
           str_w_len = MultiByteToWideChar(CP_UTF8,
                                           MB_ERR_INVALID_CHARS,
-                                          data->set.ssl.key_passwd,
+                                          sslc->key_passwd,
                                           (int)pwd_len,
                                           pszPassword, (int)(pwd_len + 1));
 
@@ -682,17 +485,12 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
         else
           pszPassword[0] = 0;
 
-        if(curlx_verify_windows_version(6, 0, 0, PLATFORM_WINNT,
-                                        VERSION_GREATER_THAN_EQUAL))
-          cert_store = PFXImportCertStore(&datablob, pszPassword,
-                                          PKCS12_NO_PERSIST_KEY);
-        else
-          cert_store = PFXImportCertStore(&datablob, pszPassword, 0);
-
-        free(pszPassword);
+        cert_store = PFXImportCertStore(&datablob, pszPassword,
+                                        PKCS12_NO_PERSIST_KEY);
+        curlx_free(pszPassword);
       }
       if(!blob)
-        free(certdata);
+        curlx_free(certdata);
       if(!cert_store) {
         DWORD errorcode = GetLastError();
         if(errorcode == ERROR_INVALID_PASSWORD)
@@ -701,18 +499,27 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
                 cert_showfilename_error);
         else
           failf(data, "schannel: Failed to import cert file %s, "
-                "last error is 0x%x",
+                "last error is 0x%08lx",
                 cert_showfilename_error, errorcode);
         return CURLE_SSL_CERTPROBLEM;
       }
 
-      client_certs[0] = CertFindCertificateInStore(
-        cert_store, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0,
-        CERT_FIND_ANY, NULL, NULL);
+      /* CERT_FIND_HAS_PRIVATE_KEY is only available in Windows 8 / Server
+         2012, (NT v6.2). For earlier versions we use CURL_FIND_ANY. */
+      if(curlx_verify_windows_version(6, 2, 0, PLATFORM_WINNT,
+                                      VERSION_GREATER_THAN_EQUAL))
+        cert_find_flags = CERT_FIND_HAS_PRIVATE_KEY;
+      else
+        cert_find_flags = CERT_FIND_ANY;
 
-      if(!client_certs[0]) {
+      client_cert =
+        CertFindCertificateInStore(cert_store,
+                                   X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0,
+                                   cert_find_flags, NULL, NULL);
+
+      if(!client_cert) {
         failf(data, "schannel: Failed to get certificate from file %s"
-              ", last error is 0x%x",
+              ", last error is 0x%08lx",
               cert_showfilename_error, GetLastError());
         CertCloseStore(cert_store, 0);
         return CURLE_SSL_CERTPROBLEM;
@@ -720,19 +527,28 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
     }
     else {
       cert_store =
-        CertOpenStore(CURL_CERT_STORE_PROV_SYSTEM, 0,
+        CertOpenStore(
+#ifdef UNICODE
+                      CERT_STORE_PROV_SYSTEM_W,
+#else
+                      CERT_STORE_PROV_SYSTEM_A,
+#endif
+                      0,
                       (HCRYPTPROV)NULL,
                       CERT_STORE_OPEN_EXISTING_FLAG | cert_store_name,
                       cert_store_path);
       if(!cert_store) {
-        failf(data, "schannel: Failed to open cert store %x %s, "
-              "last error is 0x%x",
-              cert_store_name, cert_store_path, GetLastError());
-        free(cert_store_path);
-        curlx_unicodefree(cert_path);
+        char *path_utf8 =
+          curlx_convert_tchar_to_UTF8(cert_store_path);
+        failf(data, "schannel: Failed to open cert store %lx %s, "
+              "last error is 0x%08lx",
+              cert_store_name, (path_utf8 ? path_utf8 : "(unknown)"),
+              GetLastError());
+        curlx_free(cert_store_path);
+        curlx_free(path_utf8);
         return CURLE_SSL_CERTPROBLEM;
       }
-      free(cert_store_path);
+      curlx_free(cert_store_path);
 
       cert_thumbprint.pbData = cert_thumbprint_data;
       cert_thumbprint.cbData = CERT_THUMBPRINT_DATA_LEN;
@@ -743,55 +559,40 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
                               cert_thumbprint_data,
                               &cert_thumbprint.cbData,
                               NULL, NULL)) {
-        curlx_unicodefree(cert_path);
         CertCloseStore(cert_store, 0);
         return CURLE_SSL_CERTPROBLEM;
       }
 
-      client_certs[0] = CertFindCertificateInStore(
-        cert_store, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0,
-        CERT_FIND_HASH, &cert_thumbprint, NULL);
-
-      curlx_unicodefree(cert_path);
-
-      if(!client_certs[0]) {
+      client_cert =
+        CertFindCertificateInStore(cert_store,
+                                   X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0,
+                                   CERT_FIND_HASH, &cert_thumbprint, NULL);
+      if(!client_cert) {
         /* CRYPT_E_NOT_FOUND / E_INVALIDARG */
         CertCloseStore(cert_store, 0);
+        failf(data, "schannel: client cert not found in cert store");
         return CURLE_SSL_CERTPROBLEM;
       }
     }
     client_cert_store = cert_store;
   }
-#else
-  if(data->set.ssl.primary.clientcert || data->set.ssl.primary.cert_blob) {
-    failf(data, "schannel: client cert support not built in");
-    return CURLE_NOT_BUILT_IN;
-  }
-#endif
 
-  /* allocate memory for the re-usable credential handle */
-  backend->cred = (struct Curl_schannel_cred *)
-    calloc(1, sizeof(struct Curl_schannel_cred));
-  if(!backend->cred) {
-    failf(data, "schannel: unable to allocate memory");
+  *out_cert_store = client_cert_store;
+  *out_cert_context = client_cert;
 
-#ifdef HAS_CLIENT_CERT_PATH
-    if(client_certs[0])
-      CertFreeCertificateContext(client_certs[0]);
-    if(client_cert_store)
-      CertCloseStore(client_cert_store, 0);
-#endif
+  return CURLE_OK;
+}
 
-    return CURLE_OUT_OF_MEMORY;
-  }
-  backend->cred->refcount = 1;
-
-#ifdef HAS_CLIENT_CERT_PATH
-  /* Since we did not persist the key, we need to extend the store's
-   * lifetime until the end of the connection
-   */
-  backend->cred->client_cert_store = client_cert_store;
-#endif
+static CURLcode acquire_sspi_handle(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    struct schannel_ssl_backend_data *backend,
+                                    PCCERT_CONTEXT client_cert,
+                                    DWORD flags,
+                                    DWORD enabled_protocols)
+{
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  SECURITY_STATUS sspi_status = SEC_E_OK;
+  CURLcode result;
 
   /* We support TLS 1.3 starting in Windows 10 version 1809 (OS build 17763) as
      long as the user did not set a legacy algorithm list
@@ -800,243 +601,72 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
      curlx_verify_windows_version(10, 0, 17763, PLATFORM_WINNT,
                                   VERSION_GREATER_THAN_EQUAL)) {
 
-    char *ciphers13 = 0;
-
-    bool disable_aes_gcm_sha384 = FALSE;
-    bool disable_aes_gcm_sha256 = FALSE;
-    bool disable_chacha_poly = FALSE;
-    bool disable_aes_ccm_8_sha256 = FALSE;
-    bool disable_aes_ccm_sha256 = FALSE;
-
     SCH_CREDENTIALS credentials = { 0 };
     TLS_PARAMETERS tls_parameters = { 0 };
-    CRYPTO_SETTINGS crypto_settings[4] = { { 0 } };
-    UNICODE_STRING blocked_ccm_modes[1] = { { 0 } };
-    UNICODE_STRING blocked_gcm_modes[1] = { { 0 } };
+    CRYPTO_SETTINGS crypto_settings[1];
+    PCCERT_CONTEXT client_certs[1];
 
-    int crypto_settings_idx = 0;
+    if(client_cert)
+      client_certs[0] = client_cert;
+    else
+      client_certs[0] = NULL;
 
-
-    /* If TLS 1.3 ciphers are explicitly listed, then
-     * disable all the ciphers and re-enable which
-     * ciphers the user has provided.
-     */
-    ciphers13 = conn_config->cipher_list13;
-    if(ciphers13) {
-      const int remaining_ciphers = 5;
-
-      /* detect which remaining ciphers to enable
-         and then disable everything else.
-      */
-
-      char *startCur = ciphers13;
-      int algCount = 0;
-      char tmp[LONGEST_ALG_ID] = { 0 };
-      char *nameEnd;
-      size_t n;
-
-      disable_aes_gcm_sha384 = TRUE;
-      disable_aes_gcm_sha256 = TRUE;
-      disable_chacha_poly = TRUE;
-      disable_aes_ccm_8_sha256 = TRUE;
-      disable_aes_ccm_sha256 = TRUE;
-
-      while(startCur && (0 != *startCur) && (algCount < remaining_ciphers)) {
-        nameEnd = strchr(startCur, ':');
-        n = nameEnd ? (size_t)(nameEnd - startCur) : strlen(startCur);
-
-        /* reject too-long cipher names */
-        if(n > (LONGEST_ALG_ID - 1)) {
-          failf(data, "schannel: Cipher name too long, not checked");
-          return CURLE_SSL_CIPHER;
-        }
-
-        strncpy(tmp, startCur, n);
-        tmp[n] = 0;
-
-        if(disable_aes_gcm_sha384
-           && !strcmp("TLS_AES_256_GCM_SHA384", tmp)) {
-          disable_aes_gcm_sha384 = FALSE;
-        }
-        else if(disable_aes_gcm_sha256
-                && !strcmp("TLS_AES_128_GCM_SHA256", tmp)) {
-          disable_aes_gcm_sha256 = FALSE;
-        }
-        else if(disable_chacha_poly
-                && !strcmp("TLS_CHACHA20_POLY1305_SHA256", tmp)) {
-          disable_chacha_poly = FALSE;
-        }
-        else if(disable_aes_ccm_8_sha256
-                && !strcmp("TLS_AES_128_CCM_8_SHA256", tmp)) {
-          disable_aes_ccm_8_sha256 = FALSE;
-        }
-        else if(disable_aes_ccm_sha256
-                && !strcmp("TLS_AES_128_CCM_SHA256", tmp)) {
-          disable_aes_ccm_sha256 = FALSE;
-        }
-        else {
-          failf(data, "schannel: Unknown TLS 1.3 cipher: %s", tmp);
-          return CURLE_SSL_CIPHER;
-        }
-
-        startCur = nameEnd;
-        if(startCur)
-          startCur++;
-
-        algCount++;
-      }
-    }
-
-    if(disable_aes_gcm_sha384 && disable_aes_gcm_sha256
-       && disable_chacha_poly && disable_aes_ccm_8_sha256
-       && disable_aes_ccm_sha256) {
-      failf(data, "schannel: All available TLS 1.3 ciphers were disabled");
-      return CURLE_SSL_CIPHER;
-    }
-
-    /* Disable TLS_AES_128_CCM_8_SHA256 and/or TLS_AES_128_CCM_SHA256 */
-    if(disable_aes_ccm_8_sha256 || disable_aes_ccm_sha256) {
-      /*
-        Disallow AES_CCM algorithm.
-      */
-      blocked_ccm_modes[0].Length = sizeof(BCRYPT_CHAIN_MODE_CCM);
-      blocked_ccm_modes[0].MaximumLength = sizeof(BCRYPT_CHAIN_MODE_CCM);
-      blocked_ccm_modes[0].Buffer = (PWSTR)BCRYPT_CHAIN_MODE_CCM;
-
-      crypto_settings[crypto_settings_idx].eAlgorithmUsage =
-        TlsParametersCngAlgUsageCipher;
-      crypto_settings[crypto_settings_idx].rgstrChainingModes =
-        blocked_ccm_modes;
-      crypto_settings[crypto_settings_idx].cChainingModes =
-        ARRAYSIZE(blocked_ccm_modes);
-      crypto_settings[crypto_settings_idx].strCngAlgId.Length =
-        sizeof(BCRYPT_AES_ALGORITHM);
-      crypto_settings[crypto_settings_idx].strCngAlgId.MaximumLength =
-        sizeof(BCRYPT_AES_ALGORITHM);
-      crypto_settings[crypto_settings_idx].strCngAlgId.Buffer =
-        (PWSTR)BCRYPT_AES_ALGORITHM;
-
-      /* only disabling one of the CCM modes */
-      if(disable_aes_ccm_8_sha256 != disable_aes_ccm_sha256) {
-        if(disable_aes_ccm_8_sha256)
-          crypto_settings[crypto_settings_idx].dwMinBitLength = 128;
-        else /* disable_aes_ccm_sha256 */
-          crypto_settings[crypto_settings_idx].dwMaxBitLength = 64;
-      }
-
-      crypto_settings_idx++;
-    }
-
-    /* Disable TLS_AES_256_GCM_SHA384 and/or TLS_AES_128_GCM_SHA256 */
-    if(disable_aes_gcm_sha384 || disable_aes_gcm_sha256) {
-
-      /*
-        Disallow AES_GCM algorithm
-      */
-      blocked_gcm_modes[0].Length = sizeof(BCRYPT_CHAIN_MODE_GCM);
-      blocked_gcm_modes[0].MaximumLength = sizeof(BCRYPT_CHAIN_MODE_GCM);
-      blocked_gcm_modes[0].Buffer = (PWSTR)BCRYPT_CHAIN_MODE_GCM;
-
-      /* if only one is disabled, then explicitly disable the
-         digest cipher suite (sha384 or sha256) */
-      if(disable_aes_gcm_sha384 != disable_aes_gcm_sha256) {
-        crypto_settings[crypto_settings_idx].eAlgorithmUsage =
-          TlsParametersCngAlgUsageDigest;
-        crypto_settings[crypto_settings_idx].strCngAlgId.Length =
-          sizeof(disable_aes_gcm_sha384 ?
-                 BCRYPT_SHA384_ALGORITHM : BCRYPT_SHA256_ALGORITHM);
-        crypto_settings[crypto_settings_idx].strCngAlgId.MaximumLength =
-          sizeof(disable_aes_gcm_sha384 ?
-                 BCRYPT_SHA384_ALGORITHM : BCRYPT_SHA256_ALGORITHM);
-        crypto_settings[crypto_settings_idx].strCngAlgId.Buffer =
-          (PWSTR)(disable_aes_gcm_sha384 ?
-                  BCRYPT_SHA384_ALGORITHM : BCRYPT_SHA256_ALGORITHM);
-      }
-      else { /* Disable both AES_GCM ciphers */
-        crypto_settings[crypto_settings_idx].eAlgorithmUsage =
-          TlsParametersCngAlgUsageCipher;
-        crypto_settings[crypto_settings_idx].strCngAlgId.Length =
-          sizeof(BCRYPT_AES_ALGORITHM);
-        crypto_settings[crypto_settings_idx].strCngAlgId.MaximumLength =
-          sizeof(BCRYPT_AES_ALGORITHM);
-        crypto_settings[crypto_settings_idx].strCngAlgId.Buffer =
-          (PWSTR)BCRYPT_AES_ALGORITHM;
-      }
-
-      crypto_settings[crypto_settings_idx].rgstrChainingModes =
-        blocked_gcm_modes;
-      crypto_settings[crypto_settings_idx].cChainingModes = 1;
-
-      crypto_settings_idx++;
-    }
-
-    /*
-      Disable ChaCha20-Poly1305.
-    */
-    if(disable_chacha_poly) {
-      crypto_settings[crypto_settings_idx].eAlgorithmUsage =
-        TlsParametersCngAlgUsageCipher;
-      crypto_settings[crypto_settings_idx].strCngAlgId.Length =
-        sizeof(BCRYPT_CHACHA20_POLY1305_ALGORITHM);
-      crypto_settings[crypto_settings_idx].strCngAlgId.MaximumLength =
-        sizeof(BCRYPT_CHACHA20_POLY1305_ALGORITHM);
-      crypto_settings[crypto_settings_idx].strCngAlgId.Buffer =
-        (PWSTR)BCRYPT_CHACHA20_POLY1305_ALGORITHM;
-      crypto_settings_idx++;
-    }
+    memset(crypto_settings, 0, sizeof(crypto_settings));
 
     tls_parameters.pDisabledCrypto = crypto_settings;
 
     /* The number of blocked suites */
-    tls_parameters.cDisabledCrypto = crypto_settings_idx;
+    tls_parameters.cDisabledCrypto = (DWORD)0;
     credentials.pTlsParameters = &tls_parameters;
     credentials.cTlsParameters = 1;
 
     credentials.dwVersion = SCH_CREDENTIALS_VERSION;
     credentials.dwFlags = flags | SCH_USE_STRONG_CRYPTO;
 
-    credentials.pTlsParameters->grbitDisabledProtocols =
-      (DWORD)~enabled_protocols;
+    credentials.pTlsParameters->grbitDisabledProtocols = ~enabled_protocols;
 
-#ifdef HAS_CLIENT_CERT_PATH
     if(client_certs[0]) {
       credentials.cCreds = 1;
       credentials.paCred = client_certs;
     }
-#endif
 
     sspi_status =
-      s_pSecFn->AcquireCredentialsHandle(NULL, (TCHAR*)UNISP_NAME,
-                                         SECPKG_CRED_OUTBOUND, NULL,
-                                         &credentials, NULL, NULL,
-                                         &backend->cred->cred_handle,
-                                         &backend->cred->time_stamp);
+      Curl_pSecFn->AcquireCredentialsHandle(NULL,
+                                            (TCHAR *)CURL_UNCONST(UNISP_NAME),
+                                            SECPKG_CRED_OUTBOUND, NULL,
+                                            &credentials, NULL, NULL,
+                                            &backend->cred->cred_handle, NULL);
   }
   else {
-    /* Pre-Windows 10 1809 or the user set a legacy algorithm list. Although MS
-       doesn't document it, currently Schannel will not negotiate TLS 1.3 when
-       SCHANNEL_CRED is used. */
+    /* Pre-Windows 10 1809 or the user set a legacy algorithm list.
+       Schannel does not negotiate TLS 1.3 when SCHANNEL_CRED is used. */
     ALG_ID algIds[NUM_CIPHERS];
     char *ciphers = conn_config->cipher_list;
     SCHANNEL_CRED schannel_cred = { 0 };
+    PCCERT_CONTEXT client_certs[1];
+
+    if(client_cert)
+      client_certs[0] = client_cert;
+    else
+      client_certs[0] = NULL;
+
     schannel_cred.dwVersion = SCHANNEL_CRED_VERSION;
     schannel_cred.dwFlags = flags;
     schannel_cred.grbitEnabledProtocols = enabled_protocols;
 
     if(ciphers) {
       if((enabled_protocols & SP_PROT_TLS1_3_CLIENT)) {
-        infof(data, "schannel: WARNING: This version of Schannel may "
-              "negotiate a less-secure TLS version than TLS 1.3 because the "
+        if(!(enabled_protocols & ~SP_PROT_TLS1_3_CLIENT)) {
+          failf(data, "schannel: TLS 1.3 is not supported with a cipher list; "
+                "remove the cipher list or allow a lower TLS version");
+          return CURLE_SSL_CONNECT_ERROR;
+        }
+        infof(data, "schannel: WARNING: This version of Schannel "
+              "negotiates a less-secure TLS version than TLS 1.3 because the "
               "user set an algorithm cipher list.");
       }
-      if(conn_config->cipher_list13) {
-        failf(data, "schannel: This version of Schannel does not support "
-              "setting an algorithm cipher list and TLS 1.3 cipher list at "
-              "the same time");
-        return CURLE_SSL_CIPHER;
-      }
       result = set_ssl_ciphers(&schannel_cred, ciphers, algIds);
-      if(CURLE_OK != result) {
+      if(result) {
         failf(data, "schannel: Failed setting algorithm cipher list");
         return result;
       }
@@ -1045,31 +675,23 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
       schannel_cred.dwFlags = flags | SCH_USE_STRONG_CRYPTO;
     }
 
-#ifdef HAS_CLIENT_CERT_PATH
     if(client_certs[0]) {
       schannel_cred.cCreds = 1;
       schannel_cred.paCred = client_certs;
     }
-#endif
 
     sspi_status =
-      s_pSecFn->AcquireCredentialsHandle(NULL, (TCHAR*)UNISP_NAME,
-                                         SECPKG_CRED_OUTBOUND, NULL,
-                                         &schannel_cred, NULL, NULL,
-                                         &backend->cred->cred_handle,
-                                         &backend->cred->time_stamp);
+      Curl_pSecFn->AcquireCredentialsHandle(NULL,
+                                            (TCHAR *)CURL_UNCONST(UNISP_NAME),
+                                            SECPKG_CRED_OUTBOUND, NULL,
+                                            &schannel_cred, NULL, NULL,
+                                            &backend->cred->cred_handle, NULL);
   }
 
-#ifdef HAS_CLIENT_CERT_PATH
-  if(client_certs[0])
-    CertFreeCertificateContext(client_certs[0]);
-#endif
-
   if(sspi_status != SEC_E_OK) {
     char buffer[STRERROR_LEN];
     failf(data, "schannel: AcquireCredentialsHandle failed: %s",
           Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
-    Curl_safefree(backend->cred);
     switch(sspi_status) {
     case SEC_E_INSUFFICIENT_MEMORY:
       return CURLE_OUT_OF_MEMORY;
@@ -1086,10 +708,132 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
   return CURLE_OK;
 }
 
-static CURLcode
-schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
+static CURLcode schannel_acquire_credential_handle(struct Curl_cfilter *cf,
+                                                   struct Curl_easy *data)
 {
-  ssize_t written = -1;
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+
+  PCCERT_CONTEXT client_cert = NULL;
+  HCERTSTORE client_cert_store = NULL;
+  CURLcode result;
+
+  /* setup Schannel API options */
+  DWORD flags = 0;
+  DWORD enabled_protocols = 0;
+
+  struct schannel_ssl_backend_data *backend =
+    (struct schannel_ssl_backend_data *)(connssl->backend);
+
+  DEBUGASSERT(backend);
+
+  if(conn_config->verifypeer) {
+    if(backend->use_manual_cred_validation)
+      flags = SCH_CRED_MANUAL_CRED_VALIDATION;
+    else
+      flags = SCH_CRED_AUTO_CRED_VALIDATION;
+
+    if(ssl_config->no_revoke) {
+      flags |= SCH_CRED_IGNORE_NO_REVOCATION_CHECK |
+               SCH_CRED_IGNORE_REVOCATION_OFFLINE;
+
+      DEBUGF(infof(data, "schannel: disabled server certificate revocation "
+                         "checks"));
+    }
+    else if(ssl_config->revoke_best_effort) {
+      flags |= SCH_CRED_IGNORE_NO_REVOCATION_CHECK |
+               SCH_CRED_IGNORE_REVOCATION_OFFLINE |
+               SCH_CRED_REVOCATION_CHECK_CHAIN;
+
+      DEBUGF(infof(data, "schannel: ignore revocation offline errors"));
+    }
+    else {
+      flags |= SCH_CRED_REVOCATION_CHECK_CHAIN;
+
+      DEBUGF(infof(data, "schannel: checking server certificate revocation"));
+    }
+  }
+  else {
+    flags = SCH_CRED_MANUAL_CRED_VALIDATION |
+            SCH_CRED_IGNORE_NO_REVOCATION_CHECK |
+            SCH_CRED_IGNORE_REVOCATION_OFFLINE;
+    DEBUGF(infof(data, "schannel: disabled server cert revocation checks"));
+  }
+
+  if(!conn_config->verifyhost) {
+    flags |= SCH_CRED_NO_SERVERNAME_CHECK;
+    DEBUGF(infof(data, "schannel: verifyhost setting prevents Schannel from "
+                       "comparing the supplied target name with the subject "
+                       "names in server certificates."));
+  }
+
+  if(!ssl_config->auto_client_cert) {
+    flags &= ~(DWORD)SCH_CRED_USE_DEFAULT_CREDS;
+    flags |= SCH_CRED_NO_DEFAULT_CREDS;
+    infof(data, "schannel: disabled automatic use of client certificate");
+  }
+  else
+    infof(data, "schannel: enabled automatic use of client certificate");
+
+  DEBUGASSERT(conn_config->version != CURL_SSLVERSION_DEFAULT);
+  switch(conn_config->version) {
+  case CURL_SSLVERSION_TLSv1:
+  case CURL_SSLVERSION_TLSv1_0:
+  case CURL_SSLVERSION_TLSv1_1:
+  case CURL_SSLVERSION_TLSv1_2:
+  case CURL_SSLVERSION_TLSv1_3: {
+    result = schannel_set_ssl_version_min_max(&enabled_protocols, cf, data);
+    if(result)
+      return result;
+    break;
+  }
+  case CURL_SSLVERSION_SSLv3:
+  case CURL_SSLVERSION_SSLv2:
+    failf(data, "SSL versions not supported");
+    return CURLE_NOT_BUILT_IN;
+  default:
+    failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  result = get_client_cert(cf, data, &client_cert_store, &client_cert);
+  if(result)
+    return result;
+
+  /* allocate memory for the reusable credential handle */
+  backend->cred = (struct Curl_schannel_cred *)
+    curlx_calloc(1, sizeof(struct Curl_schannel_cred));
+  if(!backend->cred) {
+    failf(data, "schannel: unable to allocate memory");
+
+    if(client_cert)
+      CertFreeCertificateContext(client_cert);
+    if(client_cert_store)
+      CertCloseStore(client_cert_store, 0);
+
+    return CURLE_OUT_OF_MEMORY;
+  }
+  backend->cred->refcount = 1;
+
+  /* Since we did not persist the key, we need to extend the store's
+   * lifetime until the end of the connection
+   */
+  backend->cred->client_cert_store = client_cert_store;
+
+  result = acquire_sspi_handle(cf, data, backend, client_cert,
+                               flags, enabled_protocols);
+
+  if(client_cert)
+    CertFreeCertificateContext(client_cert);
+
+  return result;
+}
+
+static CURLcode schannel_connect_step1(struct Curl_cfilter *cf,
+                                       struct Curl_easy *data)
+{
+  size_t written = 0;
   struct ssl_connect_data *connssl = cf->ctx;
   struct schannel_ssl_backend_data *backend =
     (struct schannel_ssl_backend_data *)connssl->backend;
@@ -1099,80 +843,44 @@ schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
   SecBufferDesc outbuf_desc;
   SecBuffer inbuf;
   SecBufferDesc inbuf_desc;
-#ifdef HAS_ALPN
+#ifdef HAS_ALPN_SCHANNEL
   unsigned char alpn_buffer[128];
 #endif
   SECURITY_STATUS sspi_status = SEC_E_OK;
-  struct Curl_schannel_cred *old_cred = NULL;
-  struct in_addr addr;
-#ifdef ENABLE_IPV6
-  struct in6_addr addr6;
-#endif
   CURLcode result;
-  const char *hostname = connssl->hostname;
 
   DEBUGASSERT(backend);
-  DEBUGF(infof(data,
-               "schannel: SSL/TLS connection with %s port %d (step 1/3)",
-               hostname, connssl->port));
+  DEBUGF(infof(data, "schannel: SSL/TLS connection with %s port %d (step 1/3)",
+               connssl->peer.origin->hostname, connssl->peer.origin->port));
 
-  if(curlx_verify_windows_version(5, 1, 0, PLATFORM_WINNT,
-                                  VERSION_LESS_THAN_EQUAL)) {
-    /* Schannel in Windows XP (OS version 5.1) uses legacy handshakes and
-       algorithms that may not be supported by all servers. */
-    infof(data, "schannel: Windows version is old and may not be able to "
-          "connect to some servers due to lack of SNI, algorithms, etc.");
-  }
-
-#ifdef HAS_ALPN
-  /* ALPN is only supported on Windows 8.1 / Server 2012 R2 and above.
-     Also it doesn't seem to be supported for Wine, see curl bug #983. */
-  backend->use_alpn = connssl->alpn &&
-    !GetProcAddress(GetModuleHandle(TEXT("ntdll")),
-                    "wine_get_version") &&
-    curlx_verify_windows_version(6, 3, 0, PLATFORM_WINNT,
-                                 VERSION_GREATER_THAN_EQUAL);
+#ifdef HAS_ALPN_SCHANNEL
+  backend->use_alpn = connssl->alpn && s_win_has_alpn;
 #else
-  backend->use_alpn = false;
+  backend->use_alpn = FALSE;
 #endif
 
-#ifdef _WIN32_WCE
-#ifdef HAS_MANUAL_VERIFY_API
-  /* certificate validation on CE doesn't seem to work right; we'll
-   * do it following a more manual process. */
-  backend->use_manual_cred_validation = true;
-#else
-#error "compiler too old to support requisite manual cert verify for Win CE"
-#endif
-#else
-#ifdef HAS_MANUAL_VERIFY_API
   if(conn_config->CAfile || conn_config->ca_info_blob) {
     if(curlx_verify_windows_version(6, 1, 0, PLATFORM_WINNT,
                                     VERSION_GREATER_THAN_EQUAL)) {
-      backend->use_manual_cred_validation = true;
+      backend->use_manual_cred_validation = TRUE;
     }
     else {
       failf(data, "schannel: this version of Windows is too old to support "
-            "certificate verification via CA bundle file.");
+                  "certificate verification via CA bundle file.");
       return CURLE_SSL_CACERT_BADFILE;
     }
   }
   else
-    backend->use_manual_cred_validation = false;
-#else
-  if(conn_config->CAfile || conn_config->ca_info_blob) {
-    failf(data, "schannel: CA cert support not built in");
-    return CURLE_NOT_BUILT_IN;
-  }
-#endif
-#endif
+    backend->use_manual_cred_validation = FALSE;
 
   backend->cred = NULL;
 
-  /* check for an existing re-usable credential handle */
-  if(ssl_config->primary.sessionid) {
-    Curl_ssl_sessionid_lock(data);
-    if(!Curl_ssl_getsessionid(cf, data, (void **)&old_cred, NULL)) {
+  /* check for an existing reusable credential handle */
+  if(Curl_ssl_scache_use(cf, data)) {
+    struct Curl_schannel_cred *old_cred;
+    Curl_ssl_scache_lock(data);
+    old_cred = Curl_ssl_scache_get_obj(cf, data, connssl->peer.scache_key);
+    if(old_cred) {
       backend->cred = old_cred;
       DEBUGF(infof(data, "schannel: reusing existing credential handle"));
 
@@ -1182,60 +890,53 @@ schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
                    "schannel: incremented credential handle refcount = %d",
                    backend->cred->refcount));
     }
-    Curl_ssl_sessionid_unlock(data);
+    Curl_ssl_scache_unlock(data);
   }
 
   if(!backend->cred) {
     char *snihost;
     result = schannel_acquire_credential_handle(cf, data);
-    if(result)
+    if(result || !backend->cred)
       return result;
     /* schannel_acquire_credential_handle() sets backend->cred accordingly or
        it returns error otherwise. */
 
     /* A hostname associated with the credential is needed by
        InitializeSecurityContext for SNI and other reasons. */
-    snihost = Curl_ssl_snihost(data, hostname, NULL);
-    if(!snihost) {
-      failf(data, "Failed to set SNI");
-      return CURLE_SSL_CONNECT_ERROR;
-    }
+    snihost = connssl->peer.sni ?
+      connssl->peer.sni : connssl->peer.origin->hostname;
     backend->cred->sni_hostname = curlx_convert_UTF8_to_tchar(snihost);
     if(!backend->cred->sni_hostname)
       return CURLE_OUT_OF_MEMORY;
   }
 
   /* Warn if SNI is disabled due to use of an IP address */
-  if(Curl_inet_pton(AF_INET, hostname, &addr)
-#ifdef ENABLE_IPV6
-     || Curl_inet_pton(AF_INET6, hostname, &addr6)
-#endif
-    ) {
+  if(connssl->peer.type != CURL_SSL_PEER_DNS) {
     infof(data, "schannel: using IP address, SNI is not supported by OS.");
   }
 
-#ifdef HAS_ALPN
+#ifdef HAS_ALPN_SCHANNEL
   if(backend->use_alpn) {
     int cur = 0;
     int list_start_index = 0;
     unsigned int *extension_len = NULL;
-    unsigned short* list_len = NULL;
+    unsigned short *list_len = NULL;
     struct alpn_proto_buf proto;
 
-    /* The first four bytes will be an unsigned int indicating number
+    /* The first four bytes is an unsigned int indicating number
        of bytes of data in the rest of the buffer. */
     extension_len = (unsigned int *)(void *)(&alpn_buffer[cur]);
     cur += (int)sizeof(unsigned int);
 
-    /* The next four bytes are an indicator that this buffer will contain
+    /* The next four bytes are an indicator that this buffer contains
        ALPN data, as opposed to NPN, for example. */
     *(unsigned int *)(void *)&alpn_buffer[cur] =
       SecApplicationProtocolNegotiationExt_ALPN;
     cur += (int)sizeof(unsigned int);
 
-    /* The next two bytes will be an unsigned short indicating the number
+    /* The next two bytes is an unsigned short indicating the number
        of bytes used to list the preferred protocols. */
-    list_len = (unsigned short*)(void *)(&alpn_buffer[cur]);
+    list_len = (unsigned short *)(void *)(&alpn_buffer[cur]);
     cur += (int)sizeof(unsigned short);
 
     list_start_index = cur;
@@ -1249,9 +950,8 @@ schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
     cur += proto.len;
 
     *list_len = curlx_uitous(cur - list_start_index);
-    *extension_len = *list_len +
-      (unsigned short)sizeof(unsigned int) +
-      (unsigned short)sizeof(unsigned short);
+    *extension_len = (unsigned int)(*list_len +
+      sizeof(unsigned int) + sizeof(unsigned short));
 
     InitSecBuffer(&inbuf, SECBUFFER_APPLICATION_PROTOCOLS, alpn_buffer, cur);
     InitSecBufferDesc(&inbuf_desc, &inbuf, 1);
@@ -1263,7 +963,7 @@ schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
     InitSecBuffer(&inbuf, SECBUFFER_EMPTY, NULL, 0);
     InitSecBufferDesc(&inbuf_desc, &inbuf, 1);
   }
-#else /* HAS_ALPN */
+#else /* HAS_ALPN_SCHANNEL */
   InitSecBuffer(&inbuf, SECBUFFER_EMPTY, NULL, 0);
   InitSecBufferDesc(&inbuf_desc, &inbuf, 1);
 #endif
@@ -1273,39 +973,37 @@ schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
   InitSecBufferDesc(&outbuf_desc, &outbuf, 1);
 
   /* security request flags */
-  backend->req_flags = ISC_REQ_SEQUENCE_DETECT | ISC_REQ_REPLAY_DETECT |
+  backend->req_flags =
+    ISC_REQ_SEQUENCE_DETECT | ISC_REQ_REPLAY_DETECT |
     ISC_REQ_CONFIDENTIALITY | ISC_REQ_ALLOCATE_MEMORY |
-    ISC_REQ_STREAM;
-
-  if(!ssl_config->auto_client_cert) {
-    backend->req_flags |= ISC_REQ_USE_SUPPLIED_CREDS;
-  }
+    ISC_REQ_STREAM |
+    (!ssl_config->auto_client_cert ? ISC_REQ_USE_SUPPLIED_CREDS : 0);
 
   /* allocate memory for the security context handle */
   backend->ctxt = (struct Curl_schannel_ctxt *)
-    calloc(1, sizeof(struct Curl_schannel_ctxt));
+    curlx_calloc(1, sizeof(struct Curl_schannel_ctxt));
   if(!backend->ctxt) {
     failf(data, "schannel: unable to allocate memory");
     return CURLE_OUT_OF_MEMORY;
   }
 
   /* Schannel InitializeSecurityContext:
-     https://msdn.microsoft.com/en-us/library/windows/desktop/aa375924.aspx
+     https://learn.microsoft.com/windows/win32/api/sspi/nf-sspi-initializesecuritycontextw
 
-     At the moment we don't pass inbuf unless we're using ALPN since we only
-     use it for that, and Wine (for which we currently disable ALPN) is giving
+     At the moment we do not pass inbuf unless we are using ALPN since we only
+     use it for that, and WINE (for which we currently disable ALPN) is giving
      us problems with inbuf regardless. https://github.com/curl/curl/issues/983
   */
-  sspi_status = s_pSecFn->InitializeSecurityContext(
+  sspi_status = Curl_pSecFn->InitializeSecurityContext(
     &backend->cred->cred_handle, NULL, backend->cred->sni_hostname,
     backend->req_flags, 0, 0,
     (backend->use_alpn ? &inbuf_desc : NULL),
     0, &backend->ctxt->ctxt_handle,
-    &outbuf_desc, &backend->ret_flags, &backend->ctxt->time_stamp);
+    &outbuf_desc, &backend->ret_flags, NULL);
 
   if(sspi_status != SEC_I_CONTINUE_NEEDED) {
     char buffer[STRERROR_LEN];
-    Curl_safefree(backend->ctxt);
+    curlx_safefree(backend->ctxt);
     switch(sspi_status) {
     case SEC_E_INSUFFICIENT_MEMORY:
       failf(data, "schannel: initial InitializeSecurityContext failed: %s",
@@ -1315,17 +1013,17 @@ schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
       failf(data, "schannel: SNI or certificate check failed: %s",
             Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
       return CURLE_PEER_FAILED_VERIFICATION;
-      /*
-        case SEC_E_INVALID_HANDLE:
-        case SEC_E_INVALID_TOKEN:
-        case SEC_E_LOGON_DENIED:
-        case SEC_E_TARGET_UNKNOWN:
-        case SEC_E_NO_AUTHENTICATING_AUTHORITY:
-        case SEC_E_INTERNAL_ERROR:
-        case SEC_E_NO_CREDENTIALS:
-        case SEC_E_UNSUPPORTED_FUNCTION:
-        case SEC_E_APPLICATION_PROTOCOL_MISMATCH:
-      */
+#if 0
+    case SEC_E_INVALID_HANDLE:
+    case SEC_E_INVALID_TOKEN:
+    case SEC_E_LOGON_DENIED:
+    case SEC_E_TARGET_UNKNOWN:
+    case SEC_E_NO_AUTHENTICATING_AUTHORITY:
+    case SEC_E_INTERNAL_ERROR:
+    case SEC_E_NO_CREDENTIALS:
+    case SEC_E_UNSUPPORTED_FUNCTION:
+    case SEC_E_APPLICATION_PROTOCOL_MISMATCH:
+#endif
     default:
       failf(data, "schannel: initial InitializeSecurityContext failed: %s",
             Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
@@ -1337,24 +1035,26 @@ schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
                "sending %lu bytes.", outbuf.cbBuffer));
 
   /* send initial handshake data which is now stored in output buffer */
-  written = Curl_conn_cf_send(cf->next, data,
-                              outbuf.pvBuffer, outbuf.cbBuffer,
-                              &result);
-  s_pSecFn->FreeContextBuffer(outbuf.pvBuffer);
-  if((result != CURLE_OK) || (outbuf.cbBuffer != (size_t) written)) {
+  result = Curl_conn_cf_send(cf->next, data,
+                             (const uint8_t *)outbuf.pvBuffer,
+                             outbuf.cbBuffer, FALSE,
+                             &written);
+  Curl_pSecFn->FreeContextBuffer(outbuf.pvBuffer);
+  if(result || (outbuf.cbBuffer != written)) {
     failf(data, "schannel: failed to send initial handshake data: "
-          "sent %zd of %lu bytes", written, outbuf.cbBuffer);
+          "sent %zu of %lu bytes", written, outbuf.cbBuffer);
     return CURLE_SSL_CONNECT_ERROR;
   }
 
   DEBUGF(infof(data, "schannel: sent initial handshake data: "
-               "sent %zd bytes", written));
+               "sent %zu bytes", written));
 
   backend->recv_unrecoverable_err = CURLE_OK;
-  backend->recv_sspi_close_notify = false;
-  backend->recv_connection_closed = false;
-  backend->recv_renegotiating = false;
-  backend->encdata_is_incomplete = false;
+  backend->recv_sspi_close_notify = FALSE;
+  backend->recv_connection_closed = FALSE;
+  backend->recv_renegotiating = FALSE;
+  backend->renegotiate_state.started = FALSE;
+  backend->encdata_is_incomplete = FALSE;
 
   /* continue to second handshake step */
   connssl->connecting_state = ssl_connect_2;
@@ -1362,1299 +1062,39 @@ schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
   return CURLE_OK;
 }
 
-static CURLcode
-schannel_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
+static CURLcode schannel_error(struct Curl_easy *data,
+                               SECURITY_STATUS sspi_status)
 {
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct schannel_ssl_backend_data *backend =
-    (struct schannel_ssl_backend_data *)connssl->backend;
-  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
-  int i;
-  ssize_t nread = -1, written = -1;
-  unsigned char *reallocated_buffer;
-  SecBuffer outbuf[3];
-  SecBufferDesc outbuf_desc;
-  SecBuffer inbuf[2];
-  SecBufferDesc inbuf_desc;
-  SECURITY_STATUS sspi_status = SEC_E_OK;
-  CURLcode result;
-  bool doread;
-  const char *pubkey_ptr;
-
-  DEBUGASSERT(backend);
-
-  doread = (connssl->connecting_state != ssl_connect_2_writing) ? TRUE : FALSE;
-
-  DEBUGF(infof(data,
-               "schannel: SSL/TLS connection with %s port %d (step 2/3)",
-               connssl->hostname, connssl->port));
-
-  if(!backend->cred || !backend->ctxt)
-    return CURLE_SSL_CONNECT_ERROR;
-
-  /* buffer to store previously received and decrypted data */
-  if(!backend->decdata_buffer) {
-    backend->decdata_offset = 0;
-    backend->decdata_length = CURL_SCHANNEL_BUFFER_INIT_SIZE;
-    backend->decdata_buffer = malloc(backend->decdata_length);
-    if(!backend->decdata_buffer) {
-      failf(data, "schannel: unable to allocate memory");
-      return CURLE_OUT_OF_MEMORY;
-    }
-  }
-
-  /* buffer to store previously received and encrypted data */
-  if(!backend->encdata_buffer) {
-    backend->encdata_is_incomplete = false;
-    backend->encdata_offset = 0;
-    backend->encdata_length = CURL_SCHANNEL_BUFFER_INIT_SIZE;
-    backend->encdata_buffer = malloc(backend->encdata_length);
-    if(!backend->encdata_buffer) {
-      failf(data, "schannel: unable to allocate memory");
-      return CURLE_OUT_OF_MEMORY;
-    }
-  }
-
-  /* if we need a bigger buffer to read a full message, increase buffer now */
-  if(backend->encdata_length - backend->encdata_offset <
-     CURL_SCHANNEL_BUFFER_FREE_SIZE) {
-    /* increase internal encrypted data buffer */
-    size_t reallocated_length = backend->encdata_offset +
-      CURL_SCHANNEL_BUFFER_FREE_SIZE;
-    reallocated_buffer = realloc(backend->encdata_buffer,
-                                 reallocated_length);
-
-    if(!reallocated_buffer) {
-      failf(data, "schannel: unable to re-allocate memory");
-      return CURLE_OUT_OF_MEMORY;
-    }
-    else {
-      backend->encdata_buffer = reallocated_buffer;
-      backend->encdata_length = reallocated_length;
-    }
-  }
-
-  for(;;) {
-    if(doread) {
-      /* read encrypted handshake data from socket */
-      nread = Curl_conn_cf_recv(cf->next, data,
-                               (char *) (backend->encdata_buffer +
-                                         backend->encdata_offset),
-                               backend->encdata_length -
-                               backend->encdata_offset,
-                               &result);
-      if(result == CURLE_AGAIN) {
-        if(connssl->connecting_state != ssl_connect_2_writing)
-          connssl->connecting_state = ssl_connect_2_reading;
-        DEBUGF(infof(data, "schannel: failed to receive handshake, "
-                     "need more data"));
-        return CURLE_OK;
-      }
-      else if((result != CURLE_OK) || (nread == 0)) {
-        failf(data, "schannel: failed to receive handshake, "
-              "SSL/TLS connection failed");
-        return CURLE_SSL_CONNECT_ERROR;
-      }
-
-      /* increase encrypted data buffer offset */
-      backend->encdata_offset += nread;
-      backend->encdata_is_incomplete = false;
-      DEBUGF(infof(data, "schannel: encrypted data got %zd", nread));
-    }
-
-    DEBUGF(infof(data,
-                 "schannel: encrypted data buffer: offset %zu length %zu",
-                 backend->encdata_offset, backend->encdata_length));
-
-    /* setup input buffers */
-    InitSecBuffer(&inbuf[0], SECBUFFER_TOKEN, malloc(backend->encdata_offset),
-                  curlx_uztoul(backend->encdata_offset));
-    InitSecBuffer(&inbuf[1], SECBUFFER_EMPTY, NULL, 0);
-    InitSecBufferDesc(&inbuf_desc, inbuf, 2);
-
-    /* setup output buffers */
-    InitSecBuffer(&outbuf[0], SECBUFFER_TOKEN, NULL, 0);
-    InitSecBuffer(&outbuf[1], SECBUFFER_ALERT, NULL, 0);
-    InitSecBuffer(&outbuf[2], SECBUFFER_EMPTY, NULL, 0);
-    InitSecBufferDesc(&outbuf_desc, outbuf, 3);
-
-    if(!inbuf[0].pvBuffer) {
-      failf(data, "schannel: unable to allocate memory");
-      return CURLE_OUT_OF_MEMORY;
-    }
-
-    /* copy received handshake data into input buffer */
-    memcpy(inbuf[0].pvBuffer, backend->encdata_buffer,
-           backend->encdata_offset);
-
-    sspi_status = s_pSecFn->InitializeSecurityContext(
-      &backend->cred->cred_handle, &backend->ctxt->ctxt_handle,
-      backend->cred->sni_hostname, backend->req_flags,
-      0, 0, &inbuf_desc, 0, NULL,
-      &outbuf_desc, &backend->ret_flags, &backend->ctxt->time_stamp);
-
-    /* free buffer for received handshake data */
-    Curl_safefree(inbuf[0].pvBuffer);
-
-    /* check if the handshake was incomplete */
-    if(sspi_status == SEC_E_INCOMPLETE_MESSAGE) {
-      backend->encdata_is_incomplete = true;
-      connssl->connecting_state = ssl_connect_2_reading;
-      DEBUGF(infof(data,
-                   "schannel: received incomplete message, need more data"));
-      return CURLE_OK;
-    }
-
-    /* If the server has requested a client certificate, attempt to continue
-       the handshake without one. This will allow connections to servers which
-       request a client certificate but do not require it. */
-    if(sspi_status == SEC_I_INCOMPLETE_CREDENTIALS &&
-       !(backend->req_flags & ISC_REQ_USE_SUPPLIED_CREDS)) {
-      backend->req_flags |= ISC_REQ_USE_SUPPLIED_CREDS;
-      connssl->connecting_state = ssl_connect_2_writing;
-      DEBUGF(infof(data,
-                   "schannel: a client certificate has been requested"));
-      return CURLE_OK;
-    }
-
-    /* check if the handshake needs to be continued */
-    if(sspi_status == SEC_I_CONTINUE_NEEDED || sspi_status == SEC_E_OK) {
-      for(i = 0; i < 3; i++) {
-        /* search for handshake tokens that need to be send */
-        if(outbuf[i].BufferType == SECBUFFER_TOKEN && outbuf[i].cbBuffer > 0) {
-          DEBUGF(infof(data, "schannel: sending next handshake data: "
-                       "sending %lu bytes.", outbuf[i].cbBuffer));
-
-          /* send handshake token to server */
-          written = Curl_conn_cf_send(cf->next, data,
-                                      outbuf[i].pvBuffer, outbuf[i].cbBuffer,
-                                      &result);
-          if((result != CURLE_OK) ||
-             (outbuf[i].cbBuffer != (size_t) written)) {
-            failf(data, "schannel: failed to send next handshake data: "
-                  "sent %zd of %lu bytes", written, outbuf[i].cbBuffer);
-            return CURLE_SSL_CONNECT_ERROR;
-          }
-        }
-
-        /* free obsolete buffer */
-        if(outbuf[i].pvBuffer) {
-          s_pSecFn->FreeContextBuffer(outbuf[i].pvBuffer);
-        }
-      }
-    }
-    else {
-      char buffer[STRERROR_LEN];
-      switch(sspi_status) {
-      case SEC_E_INSUFFICIENT_MEMORY:
-        failf(data, "schannel: next InitializeSecurityContext failed: %s",
-              Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
-        return CURLE_OUT_OF_MEMORY;
-      case SEC_E_WRONG_PRINCIPAL:
-        failf(data, "schannel: SNI or certificate check failed: %s",
-              Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
-        return CURLE_PEER_FAILED_VERIFICATION;
-      case SEC_E_UNTRUSTED_ROOT:
-        failf(data, "schannel: %s",
-              Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
-        return CURLE_PEER_FAILED_VERIFICATION;
-        /*
-          case SEC_E_INVALID_HANDLE:
-          case SEC_E_INVALID_TOKEN:
-          case SEC_E_LOGON_DENIED:
-          case SEC_E_TARGET_UNKNOWN:
-          case SEC_E_NO_AUTHENTICATING_AUTHORITY:
-          case SEC_E_INTERNAL_ERROR:
-          case SEC_E_NO_CREDENTIALS:
-          case SEC_E_UNSUPPORTED_FUNCTION:
-          case SEC_E_APPLICATION_PROTOCOL_MISMATCH:
-        */
-      default:
-        failf(data, "schannel: next InitializeSecurityContext failed: %s",
-              Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
-        return CURLE_SSL_CONNECT_ERROR;
-      }
-    }
-
-    /* check if there was additional remaining encrypted data */
-    if(inbuf[1].BufferType == SECBUFFER_EXTRA && inbuf[1].cbBuffer > 0) {
-      DEBUGF(infof(data, "schannel: encrypted data length: %lu",
-                   inbuf[1].cbBuffer));
-      /*
-        There are two cases where we could be getting extra data here:
-        1) If we're renegotiating a connection and the handshake is already
-        complete (from the server perspective), it can encrypted app data
-        (not handshake data) in an extra buffer at this point.
-        2) (sspi_status == SEC_I_CONTINUE_NEEDED) We are negotiating a
-        connection and this extra data is part of the handshake.
-        We should process the data immediately; waiting for the socket to
-        be ready may fail since the server is done sending handshake data.
-      */
-      /* check if the remaining data is less than the total amount
-         and therefore begins after the already processed data */
-      if(backend->encdata_offset > inbuf[1].cbBuffer) {
-        memmove(backend->encdata_buffer,
-                (backend->encdata_buffer + backend->encdata_offset) -
-                inbuf[1].cbBuffer, inbuf[1].cbBuffer);
-        backend->encdata_offset = inbuf[1].cbBuffer;
-        if(sspi_status == SEC_I_CONTINUE_NEEDED) {
-          doread = FALSE;
-          continue;
-        }
-      }
-    }
-    else {
-      backend->encdata_offset = 0;
-    }
-    break;
-  }
-
-  /* check if the handshake needs to be continued */
-  if(sspi_status == SEC_I_CONTINUE_NEEDED) {
-    connssl->connecting_state = ssl_connect_2_reading;
-    return CURLE_OK;
-  }
-
-  /* check if the handshake is complete */
-  if(sspi_status == SEC_E_OK) {
-    connssl->connecting_state = ssl_connect_3;
-    DEBUGF(infof(data, "schannel: SSL/TLS handshake complete"));
-  }
-
-  pubkey_ptr = Curl_ssl_cf_is_proxy(cf)?
-    data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY]:
-    data->set.str[STRING_SSL_PINNEDPUBLICKEY];
-  if(pubkey_ptr) {
-    result = schannel_pkp_pin_peer_pubkey(cf, data, pubkey_ptr);
-    if(result) {
-      failf(data, "SSL: public key does not match pinned public key");
-      return result;
-    }
-  }
-
-#ifdef HAS_MANUAL_VERIFY_API
-  if(conn_config->verifypeer && backend->use_manual_cred_validation) {
-    /* Certificate verification also verifies the hostname if verifyhost */
-    return Curl_verify_certificate(cf, data);
-  }
+  char buffer[STRERROR_LEN];
+  switch(sspi_status) {
+  case SEC_E_INSUFFICIENT_MEMORY:
+    failf(data, "schannel: next InitializeSecurityContext failed: %s",
+          Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
+    return CURLE_OUT_OF_MEMORY;
+  case SEC_E_WRONG_PRINCIPAL:
+    failf(data, "schannel: SNI or certificate check failed: %s",
+          Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
+    return CURLE_PEER_FAILED_VERIFICATION;
+  case SEC_E_UNTRUSTED_ROOT:
+    failf(data, "schannel: %s",
+          Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
+    return CURLE_PEER_FAILED_VERIFICATION;
+#if 0
+  case SEC_E_INVALID_HANDLE:
+  case SEC_E_INVALID_TOKEN:
+  case SEC_E_LOGON_DENIED:
+  case SEC_E_TARGET_UNKNOWN:
+  case SEC_E_NO_AUTHENTICATING_AUTHORITY:
+  case SEC_E_INTERNAL_ERROR:
+  case SEC_E_NO_CREDENTIALS:
+  case SEC_E_UNSUPPORTED_FUNCTION:
+  case SEC_E_APPLICATION_PROTOCOL_MISMATCH:
 #endif
-
-  /* Verify the hostname manually when certificate verification is disabled,
-     because in that case Schannel won't verify it. */
-  if(!conn_config->verifypeer && conn_config->verifyhost)
-    return Curl_verify_host(cf, data);
-
-  return CURLE_OK;
-}
-
-static bool
-valid_cert_encoding(const CERT_CONTEXT *cert_context)
-{
-  return (cert_context != NULL) &&
-    ((cert_context->dwCertEncodingType & X509_ASN_ENCODING) != 0) &&
-    (cert_context->pbCertEncoded != NULL) &&
-    (cert_context->cbCertEncoded > 0);
-}
-
-typedef bool(*Read_crt_func)(const CERT_CONTEXT *ccert_context,
-                             bool reverse_order, void *arg);
-
-static void
-traverse_cert_store(const CERT_CONTEXT *context, Read_crt_func func,
-                    void *arg)
-{
-  const CERT_CONTEXT *current_context = NULL;
-  bool should_continue = true;
-  bool first = true;
-  bool reverse_order = false;
-  while(should_continue &&
-        (current_context = CertEnumCertificatesInStore(
-          context->hCertStore,
-          current_context)) != NULL) {
-    /* Windows 11 22H2 OS Build 22621.674 or higher enumerates certificates in
-       leaf-to-root order while all previous versions of Windows enumerate
-       certificates in root-to-leaf order. Determine the order of enumeration
-       by comparing SECPKG_ATTR_REMOTE_CERT_CONTEXT's pbCertContext with the
-       first certificate's pbCertContext. */
-    if(first && context->pbCertEncoded != current_context->pbCertEncoded)
-      reverse_order = true;
-    should_continue = func(current_context, reverse_order, arg);
-    first = false;
-  }
-
-  if(current_context)
-    CertFreeCertificateContext(current_context);
-}
-
-static bool
-cert_counter_callback(const CERT_CONTEXT *ccert_context, bool reverse_order,
-                      void *certs_count)
-{
-  (void)reverse_order; /* unused */
-  if(valid_cert_encoding(ccert_context))
-    (*(int *)certs_count)++;
-  return true;
-}
-
-struct Adder_args
-{
-  struct Curl_easy *data;
-  CURLcode result;
-  int idx;
-  int certs_count;
-};
-
-static bool
-add_cert_to_certinfo(const CERT_CONTEXT *ccert_context, bool reverse_order,
-                     void *raw_arg)
-{
-  struct Adder_args *args = (struct Adder_args*)raw_arg;
-  args->result = CURLE_OK;
-  if(valid_cert_encoding(ccert_context)) {
-    const char *beg = (const char *) ccert_context->pbCertEncoded;
-    const char *end = beg + ccert_context->cbCertEncoded;
-    int insert_index = reverse_order ? (args->certs_count - 1) - args->idx :
-                       args->idx;
-    args->result = Curl_extract_certinfo(args->data, insert_index,
-                                         beg, end);
-    args->idx++;
-  }
-  return args->result == CURLE_OK;
-}
-
-static CURLcode
-schannel_connect_step3(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct schannel_ssl_backend_data *backend =
-    (struct schannel_ssl_backend_data *)connssl->backend;
-  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
-  CURLcode result = CURLE_OK;
-  SECURITY_STATUS sspi_status = SEC_E_OK;
-  CERT_CONTEXT *ccert_context = NULL;
-#ifdef HAS_ALPN
-  SecPkgContext_ApplicationProtocol alpn_result;
-#endif
-
-  DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);
-  DEBUGASSERT(backend);
-
-  DEBUGF(infof(data,
-               "schannel: SSL/TLS connection with %s port %d (step 3/3)",
-               connssl->hostname, connssl->port));
-
-  if(!backend->cred)
-    return CURLE_SSL_CONNECT_ERROR;
-
-  /* check if the required context attributes are met */
-  if(backend->ret_flags != backend->req_flags) {
-    if(!(backend->ret_flags & ISC_RET_SEQUENCE_DETECT))
-      failf(data, "schannel: failed to setup sequence detection");
-    if(!(backend->ret_flags & ISC_RET_REPLAY_DETECT))
-      failf(data, "schannel: failed to setup replay detection");
-    if(!(backend->ret_flags & ISC_RET_CONFIDENTIALITY))
-      failf(data, "schannel: failed to setup confidentiality");
-    if(!(backend->ret_flags & ISC_RET_ALLOCATED_MEMORY))
-      failf(data, "schannel: failed to setup memory allocation");
-    if(!(backend->ret_flags & ISC_RET_STREAM))
-      failf(data, "schannel: failed to setup stream orientation");
+  default:
+    failf(data, "schannel: next InitializeSecurityContext failed: %s",
+          Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
     return CURLE_SSL_CONNECT_ERROR;
   }
-
-#ifdef HAS_ALPN
-  if(backend->use_alpn) {
-    sspi_status =
-      s_pSecFn->QueryContextAttributes(&backend->ctxt->ctxt_handle,
-                                       SECPKG_ATTR_APPLICATION_PROTOCOL,
-                                       &alpn_result);
-
-    if(sspi_status != SEC_E_OK) {
-      failf(data, "schannel: failed to retrieve ALPN result");
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-
-    if(alpn_result.ProtoNegoStatus ==
-       SecApplicationProtocolNegotiationStatus_Success) {
-      unsigned char prev_alpn = cf->conn->alpn;
-
-      Curl_alpn_set_negotiated(cf, data, alpn_result.ProtocolId,
-                               alpn_result.ProtocolIdSize);
-      if(backend->recv_renegotiating) {
-        if(prev_alpn != cf->conn->alpn &&
-           prev_alpn != CURL_HTTP_VERSION_NONE) {
-          /* Renegotiation selected a different protocol now, we cannot
-           * deal with this */
-          failf(data, "schannel: server selected an ALPN protocol too late");
-          return CURLE_SSL_CONNECT_ERROR;
-        }
-      }
-    }
-    else {
-      if(!backend->recv_renegotiating)
-        Curl_alpn_set_negotiated(cf, data, NULL, 0);
-    }
-  }
-#endif
-
-  /* save the current session data for possible reuse */
-  if(ssl_config->primary.sessionid) {
-    bool incache;
-    bool added = FALSE;
-    struct Curl_schannel_cred *old_cred = NULL;
-
-    Curl_ssl_sessionid_lock(data);
-    incache = !(Curl_ssl_getsessionid(cf, data, (void **)&old_cred, NULL));
-    if(incache) {
-      if(old_cred != backend->cred) {
-        DEBUGF(infof(data,
-                     "schannel: old credential handle is stale, removing"));
-        /* we're not taking old_cred ownership here, no refcount++ is needed */
-        Curl_ssl_delsessionid(data, (void *)old_cred);
-        incache = FALSE;
-      }
-    }
-    if(!incache) {
-      result = Curl_ssl_addsessionid(cf, data, backend->cred,
-                                     sizeof(struct Curl_schannel_cred),
-                                     &added);
-      if(result) {
-        Curl_ssl_sessionid_unlock(data);
-        failf(data, "schannel: failed to store credential handle");
-        return result;
-      }
-      else if(added) {
-        /* this cred session is now also referenced by sessionid cache */
-        backend->cred->refcount++;
-        DEBUGF(infof(data,
-                     "schannel: stored credential handle in session cache"));
-      }
-    }
-    Curl_ssl_sessionid_unlock(data);
-  }
-
-  if(data->set.ssl.certinfo) {
-    int certs_count = 0;
-    sspi_status =
-      s_pSecFn->QueryContextAttributes(&backend->ctxt->ctxt_handle,
-                                       SECPKG_ATTR_REMOTE_CERT_CONTEXT,
-                                       &ccert_context);
-
-    if((sspi_status != SEC_E_OK) || !ccert_context) {
-      failf(data, "schannel: failed to retrieve remote cert context");
-      return CURLE_PEER_FAILED_VERIFICATION;
-    }
-
-    traverse_cert_store(ccert_context, cert_counter_callback, &certs_count);
-
-    result = Curl_ssl_init_certinfo(data, certs_count);
-    if(!result) {
-      struct Adder_args args;
-      args.data = data;
-      args.idx = 0;
-      args.certs_count = certs_count;
-      traverse_cert_store(ccert_context, add_cert_to_certinfo, &args);
-      result = args.result;
-    }
-    CertFreeCertificateContext(ccert_context);
-    if(result)
-      return result;
-  }
-
-  connssl->connecting_state = ssl_connect_done;
-
-  return CURLE_OK;
-}
-
-static CURLcode
-schannel_connect_common(struct Curl_cfilter *cf,
-                        struct Curl_easy *data,
-                        bool nonblocking, bool *done)
-{
-  CURLcode result;
-  struct ssl_connect_data *connssl = cf->ctx;
-  curl_socket_t sockfd = Curl_conn_cf_get_socket(cf, data);
-  timediff_t timeout_ms;
-  int what;
-
-  /* check if the connection has already been established */
-  if(ssl_connection_complete == connssl->state) {
-    *done = TRUE;
-    return CURLE_OK;
-  }
-
-  if(ssl_connect_1 == connssl->connecting_state) {
-    /* check out how much more time we're allowed */
-    timeout_ms = Curl_timeleft(data, NULL, TRUE);
-
-    if(timeout_ms < 0) {
-      /* no need to continue if time already is up */
-      failf(data, "SSL/TLS connection timeout");
-      return CURLE_OPERATION_TIMEDOUT;
-    }
-
-    result = schannel_connect_step1(cf, data);
-    if(result)
-      return result;
-  }
-
-  while(ssl_connect_2 == connssl->connecting_state ||
-        ssl_connect_2_reading == connssl->connecting_state ||
-        ssl_connect_2_writing == connssl->connecting_state) {
-
-    /* check out how much more time we're allowed */
-    timeout_ms = Curl_timeleft(data, NULL, TRUE);
-
-    if(timeout_ms < 0) {
-      /* no need to continue if time already is up */
-      failf(data, "SSL/TLS connection timeout");
-      return CURLE_OPERATION_TIMEDOUT;
-    }
-
-    /* if ssl is expecting something, check if it's available. */
-    if(connssl->connecting_state == ssl_connect_2_reading
-       || connssl->connecting_state == ssl_connect_2_writing) {
-
-      curl_socket_t writefd = ssl_connect_2_writing ==
-        connssl->connecting_state ? sockfd : CURL_SOCKET_BAD;
-      curl_socket_t readfd = ssl_connect_2_reading ==
-        connssl->connecting_state ? sockfd : CURL_SOCKET_BAD;
-
-      what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd,
-                               nonblocking ? 0 : timeout_ms);
-      if(what < 0) {
-        /* fatal error */
-        failf(data, "select/poll on SSL/TLS socket, errno: %d", SOCKERRNO);
-        return CURLE_SSL_CONNECT_ERROR;
-      }
-      else if(0 == what) {
-        if(nonblocking) {
-          *done = FALSE;
-          return CURLE_OK;
-        }
-        else {
-          /* timeout */
-          failf(data, "SSL/TLS connection timeout");
-          return CURLE_OPERATION_TIMEDOUT;
-        }
-      }
-      /* socket is readable or writable */
-    }
-
-    /* Run transaction, and return to the caller if it failed or if
-     * this connection is part of a multi handle and this loop would
-     * execute again. This permits the owner of a multi handle to
-     * abort a connection attempt before step2 has completed while
-     * ensuring that a client using select() or epoll() will always
-     * have a valid fdset to wait on.
-     */
-    result = schannel_connect_step2(cf, data);
-    if(result || (nonblocking &&
-                  (ssl_connect_2 == connssl->connecting_state ||
-                   ssl_connect_2_reading == connssl->connecting_state ||
-                   ssl_connect_2_writing == connssl->connecting_state)))
-      return result;
-
-  } /* repeat step2 until all transactions are done. */
-
-  if(ssl_connect_3 == connssl->connecting_state) {
-    result = schannel_connect_step3(cf, data);
-    if(result)
-      return result;
-  }
-
-  if(ssl_connect_done == connssl->connecting_state) {
-    connssl->state = ssl_connection_complete;
-
-#ifdef SECPKG_ATTR_ENDPOINT_BINDINGS
-    /* When SSPI is used in combination with Schannel
-     * we need the Schannel context to create the Schannel
-     * binding to pass the IIS extended protection checks.
-     * Available on Windows 7 or later.
-     */
-    {
-      struct schannel_ssl_backend_data *backend =
-        (struct schannel_ssl_backend_data *)connssl->backend;
-      DEBUGASSERT(backend);
-      cf->conn->sslContext = &backend->ctxt->ctxt_handle;
-    }
-#endif
-
-    *done = TRUE;
-  }
-  else
-    *done = FALSE;
-
-  /* reset our connection state machine */
-  connssl->connecting_state = ssl_connect_1;
-
-  return CURLE_OK;
-}
-
-static ssize_t
-schannel_send(struct Curl_cfilter *cf, struct Curl_easy *data,
-              const void *buf, size_t len, CURLcode *err)
-{
-  ssize_t written = -1;
-  size_t data_len = 0;
-  unsigned char *ptr = NULL;
-  struct ssl_connect_data *connssl = cf->ctx;
-  SecBuffer outbuf[4];
-  SecBufferDesc outbuf_desc;
-  SECURITY_STATUS sspi_status = SEC_E_OK;
-  CURLcode result;
-  struct schannel_ssl_backend_data *backend =
-    (struct schannel_ssl_backend_data *)connssl->backend;
-
-  DEBUGASSERT(backend);
-
-  /* check if the maximum stream sizes were queried */
-  if(backend->stream_sizes.cbMaximumMessage == 0) {
-    sspi_status = s_pSecFn->QueryContextAttributes(
-      &backend->ctxt->ctxt_handle,
-      SECPKG_ATTR_STREAM_SIZES,
-      &backend->stream_sizes);
-    if(sspi_status != SEC_E_OK) {
-      *err = CURLE_SEND_ERROR;
-      return -1;
-    }
-  }
-
-  /* check if the buffer is longer than the maximum message length */
-  if(len > backend->stream_sizes.cbMaximumMessage) {
-    len = backend->stream_sizes.cbMaximumMessage;
-  }
-
-  /* calculate the complete message length and allocate a buffer for it */
-  data_len = backend->stream_sizes.cbHeader + len +
-    backend->stream_sizes.cbTrailer;
-  ptr = (unsigned char *) malloc(data_len);
-  if(!ptr) {
-    *err = CURLE_OUT_OF_MEMORY;
-    return -1;
-  }
-
-  /* setup output buffers (header, data, trailer, empty) */
-  InitSecBuffer(&outbuf[0], SECBUFFER_STREAM_HEADER,
-                ptr, backend->stream_sizes.cbHeader);
-  InitSecBuffer(&outbuf[1], SECBUFFER_DATA,
-                ptr + backend->stream_sizes.cbHeader, curlx_uztoul(len));
-  InitSecBuffer(&outbuf[2], SECBUFFER_STREAM_TRAILER,
-                ptr + backend->stream_sizes.cbHeader + len,
-                backend->stream_sizes.cbTrailer);
-  InitSecBuffer(&outbuf[3], SECBUFFER_EMPTY, NULL, 0);
-  InitSecBufferDesc(&outbuf_desc, outbuf, 4);
-
-  /* copy data into output buffer */
-  memcpy(outbuf[1].pvBuffer, buf, len);
-
-  /* https://msdn.microsoft.com/en-us/library/windows/desktop/aa375390.aspx */
-  sspi_status = s_pSecFn->EncryptMessage(&backend->ctxt->ctxt_handle, 0,
-                                         &outbuf_desc, 0);
-
-  /* check if the message was encrypted */
-  if(sspi_status == SEC_E_OK) {
-    written = 0;
-
-    /* send the encrypted message including header, data and trailer */
-    len = outbuf[0].cbBuffer + outbuf[1].cbBuffer + outbuf[2].cbBuffer;
-
-    /*
-      It's important to send the full message which includes the header,
-      encrypted payload, and trailer.  Until the client receives all the
-      data a coherent message has not been delivered and the client
-      can't read any of it.
-
-      If we wanted to buffer the unwritten encrypted bytes, we would
-      tell the client that all data it has requested to be sent has been
-      sent. The unwritten encrypted bytes would be the first bytes to
-      send on the next invocation.
-      Here's the catch with this - if we tell the client that all the
-      bytes have been sent, will the client call this method again to
-      send the buffered data?  Looking at who calls this function, it
-      seems the answer is NO.
-    */
-
-    /* send entire message or fail */
-    while(len > (size_t)written) {
-      ssize_t this_write = 0;
-      int what;
-      timediff_t timeout_ms = Curl_timeleft(data, NULL, FALSE);
-      if(timeout_ms < 0) {
-        /* we already got the timeout */
-        failf(data, "schannel: timed out sending data "
-              "(bytes sent: %zd)", written);
-        *err = CURLE_OPERATION_TIMEDOUT;
-        written = -1;
-        break;
-      }
-      else if(!timeout_ms)
-        timeout_ms = TIMEDIFF_T_MAX;
-      what = SOCKET_WRITABLE(Curl_conn_cf_get_socket(cf, data), timeout_ms);
-      if(what < 0) {
-        /* fatal error */
-        failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
-        *err = CURLE_SEND_ERROR;
-        written = -1;
-        break;
-      }
-      else if(0 == what) {
-        failf(data, "schannel: timed out sending data "
-              "(bytes sent: %zd)", written);
-        *err = CURLE_OPERATION_TIMEDOUT;
-        written = -1;
-        break;
-      }
-      /* socket is writable */
-
-       this_write = Curl_conn_cf_send(cf->next, data,
-                                      ptr + written, len - written,
-                                      &result);
-      if(result == CURLE_AGAIN)
-        continue;
-      else if(result != CURLE_OK) {
-        *err = result;
-        written = -1;
-        break;
-      }
-
-      written += this_write;
-    }
-  }
-  else if(sspi_status == SEC_E_INSUFFICIENT_MEMORY) {
-    *err = CURLE_OUT_OF_MEMORY;
-  }
-  else{
-    *err = CURLE_SEND_ERROR;
-  }
-
-  Curl_safefree(ptr);
-
-  if(len == (size_t)written)
-    /* Encrypted message including header, data and trailer entirely sent.
-       The return value is the number of unencrypted bytes that were sent. */
-    written = outbuf[1].cbBuffer;
-
-  return written;
-}
-
-static ssize_t
-schannel_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
-              char *buf, size_t len, CURLcode *err)
-{
-  size_t size = 0;
-  ssize_t nread = -1;
-  struct ssl_connect_data *connssl = cf->ctx;
-  unsigned char *reallocated_buffer;
-  size_t reallocated_length;
-  bool done = FALSE;
-  SecBuffer inbuf[4];
-  SecBufferDesc inbuf_desc;
-  SECURITY_STATUS sspi_status = SEC_E_OK;
-  /* we want the length of the encrypted buffer to be at least large enough
-     that it can hold all the bytes requested and some TLS record overhead. */
-  size_t min_encdata_length = len + CURL_SCHANNEL_BUFFER_FREE_SIZE;
-  struct schannel_ssl_backend_data *backend =
-    (struct schannel_ssl_backend_data *)connssl->backend;
-
-  DEBUGASSERT(backend);
-
-  /****************************************************************************
-   * Don't return or set backend->recv_unrecoverable_err unless in the cleanup.
-   * The pattern for return error is set *err, optional infof, goto cleanup.
-   *
-   * Our priority is to always return as much decrypted data to the caller as
-   * possible, even if an error occurs. The state of the decrypted buffer must
-   * always be valid. Transfer of decrypted data to the caller's buffer is
-   * handled in the cleanup.
-   */
-
-  DEBUGF(infof(data, "schannel: client wants to read %zu bytes", len));
-  *err = CURLE_OK;
-
-  if(len && len <= backend->decdata_offset) {
-    infof(data, "schannel: enough decrypted data is already available");
-    goto cleanup;
-  }
-  else if(backend->recv_unrecoverable_err) {
-    *err = backend->recv_unrecoverable_err;
-    infof(data, "schannel: an unrecoverable error occurred in a prior call");
-    goto cleanup;
-  }
-  else if(backend->recv_sspi_close_notify) {
-    /* once a server has indicated shutdown there is no more encrypted data */
-    infof(data, "schannel: server indicated shutdown in a prior call");
-    goto cleanup;
-  }
-
-  /* It's debatable what to return when !len. Regardless we can't return
-     immediately because there may be data to decrypt (in the case we want to
-     decrypt all encrypted cached data) so handle !len later in cleanup.
-  */
-  else if(len && !backend->recv_connection_closed) {
-    /* increase enc buffer in order to fit the requested amount of data */
-    size = backend->encdata_length - backend->encdata_offset;
-    if(size < CURL_SCHANNEL_BUFFER_FREE_SIZE ||
-       backend->encdata_length < min_encdata_length) {
-      reallocated_length = backend->encdata_offset +
-        CURL_SCHANNEL_BUFFER_FREE_SIZE;
-      if(reallocated_length < min_encdata_length) {
-        reallocated_length = min_encdata_length;
-      }
-      reallocated_buffer = realloc(backend->encdata_buffer,
-                                   reallocated_length);
-      if(!reallocated_buffer) {
-        *err = CURLE_OUT_OF_MEMORY;
-        failf(data, "schannel: unable to re-allocate memory");
-        goto cleanup;
-      }
-
-      backend->encdata_buffer = reallocated_buffer;
-      backend->encdata_length = reallocated_length;
-      size = backend->encdata_length - backend->encdata_offset;
-      DEBUGF(infof(data, "schannel: encdata_buffer resized %zu",
-                   backend->encdata_length));
-    }
-
-    DEBUGF(infof(data,
-                 "schannel: encrypted data buffer: offset %zu length %zu",
-                 backend->encdata_offset, backend->encdata_length));
-
-    /* read encrypted data from socket */
-    nread = Curl_conn_cf_recv(cf->next, data,
-                              (char *)(backend->encdata_buffer +
-                                    backend->encdata_offset),
-                              size, err);
-    if(*err) {
-      nread = -1;
-      if(*err == CURLE_AGAIN)
-        DEBUGF(infof(data,
-                     "schannel: recv returned CURLE_AGAIN"));
-      else if(*err == CURLE_RECV_ERROR)
-        infof(data, "schannel: recv returned CURLE_RECV_ERROR");
-      else
-        infof(data, "schannel: recv returned error %d", *err);
-    }
-    else if(nread == 0) {
-      backend->recv_connection_closed = true;
-      DEBUGF(infof(data, "schannel: server closed the connection"));
-    }
-    else if(nread > 0) {
-      backend->encdata_offset += (size_t)nread;
-      backend->encdata_is_incomplete = false;
-      DEBUGF(infof(data, "schannel: encrypted data got %zd", nread));
-    }
-  }
-
-  DEBUGF(infof(data,
-               "schannel: encrypted data buffer: offset %zu length %zu",
-               backend->encdata_offset, backend->encdata_length));
-
-  /* decrypt loop */
-  while(backend->encdata_offset > 0 && sspi_status == SEC_E_OK &&
-        (!len || backend->decdata_offset < len ||
-         backend->recv_connection_closed)) {
-    /* prepare data buffer for DecryptMessage call */
-    InitSecBuffer(&inbuf[0], SECBUFFER_DATA, backend->encdata_buffer,
-                  curlx_uztoul(backend->encdata_offset));
-
-    /* we need 3 more empty input buffers for possible output */
-    InitSecBuffer(&inbuf[1], SECBUFFER_EMPTY, NULL, 0);
-    InitSecBuffer(&inbuf[2], SECBUFFER_EMPTY, NULL, 0);
-    InitSecBuffer(&inbuf[3], SECBUFFER_EMPTY, NULL, 0);
-    InitSecBufferDesc(&inbuf_desc, inbuf, 4);
-
-    /* https://msdn.microsoft.com/en-us/library/windows/desktop/aa375348.aspx
-     */
-    sspi_status = s_pSecFn->DecryptMessage(&backend->ctxt->ctxt_handle,
-                                           &inbuf_desc, 0, NULL);
-
-    /* check if everything went fine (server may want to renegotiate
-       or shutdown the connection context) */
-    if(sspi_status == SEC_E_OK || sspi_status == SEC_I_RENEGOTIATE ||
-       sspi_status == SEC_I_CONTEXT_EXPIRED) {
-      /* check for successfully decrypted data, even before actual
-         renegotiation or shutdown of the connection context */
-      if(inbuf[1].BufferType == SECBUFFER_DATA) {
-        DEBUGF(infof(data, "schannel: decrypted data length: %lu",
-                     inbuf[1].cbBuffer));
-
-        /* increase buffer in order to fit the received amount of data */
-        size = inbuf[1].cbBuffer > CURL_SCHANNEL_BUFFER_FREE_SIZE ?
-          inbuf[1].cbBuffer : CURL_SCHANNEL_BUFFER_FREE_SIZE;
-        if(backend->decdata_length - backend->decdata_offset < size ||
-           backend->decdata_length < len) {
-          /* increase internal decrypted data buffer */
-          reallocated_length = backend->decdata_offset + size;
-          /* make sure that the requested amount of data fits */
-          if(reallocated_length < len) {
-            reallocated_length = len;
-          }
-          reallocated_buffer = realloc(backend->decdata_buffer,
-                                       reallocated_length);
-          if(!reallocated_buffer) {
-            *err = CURLE_OUT_OF_MEMORY;
-            failf(data, "schannel: unable to re-allocate memory");
-            goto cleanup;
-          }
-          backend->decdata_buffer = reallocated_buffer;
-          backend->decdata_length = reallocated_length;
-        }
-
-        /* copy decrypted data to internal buffer */
-        size = inbuf[1].cbBuffer;
-        if(size) {
-          memcpy(backend->decdata_buffer + backend->decdata_offset,
-                 inbuf[1].pvBuffer, size);
-          backend->decdata_offset += size;
-        }
-
-        DEBUGF(infof(data, "schannel: decrypted data added: %zu", size));
-        DEBUGF(infof(data,
-                     "schannel: decrypted cached: offset %zu length %zu",
-                     backend->decdata_offset, backend->decdata_length));
-      }
-
-      /* check for remaining encrypted data */
-      if(inbuf[3].BufferType == SECBUFFER_EXTRA && inbuf[3].cbBuffer > 0) {
-        DEBUGF(infof(data, "schannel: encrypted data length: %lu",
-                     inbuf[3].cbBuffer));
-
-        /* check if the remaining data is less than the total amount
-         * and therefore begins after the already processed data
-         */
-        if(backend->encdata_offset > inbuf[3].cbBuffer) {
-          /* move remaining encrypted data forward to the beginning of
-             buffer */
-          memmove(backend->encdata_buffer,
-                  (backend->encdata_buffer + backend->encdata_offset) -
-                  inbuf[3].cbBuffer, inbuf[3].cbBuffer);
-          backend->encdata_offset = inbuf[3].cbBuffer;
-        }
-
-        DEBUGF(infof(data,
-                     "schannel: encrypted cached: offset %zu length %zu",
-                     backend->encdata_offset, backend->encdata_length));
-      }
-      else {
-        /* reset encrypted buffer offset, because there is no data remaining */
-        backend->encdata_offset = 0;
-      }
-
-      /* check if server wants to renegotiate the connection context */
-      if(sspi_status == SEC_I_RENEGOTIATE) {
-        infof(data, "schannel: remote party requests renegotiation");
-        if(*err && *err != CURLE_AGAIN) {
-          infof(data, "schannel: can't renegotiate, an error is pending");
-          goto cleanup;
-        }
-
-        /* begin renegotiation */
-        infof(data, "schannel: renegotiating SSL/TLS connection");
-        connssl->state = ssl_connection_negotiating;
-        connssl->connecting_state = ssl_connect_2_writing;
-        backend->recv_renegotiating = true;
-        *err = schannel_connect_common(cf, data, FALSE, &done);
-        backend->recv_renegotiating = false;
-        if(*err) {
-          infof(data, "schannel: renegotiation failed");
-          goto cleanup;
-        }
-        /* now retry receiving data */
-        sspi_status = SEC_E_OK;
-        infof(data, "schannel: SSL/TLS connection renegotiated");
-        continue;
-      }
-      /* check if the server closed the connection */
-      else if(sspi_status == SEC_I_CONTEXT_EXPIRED) {
-        /* In Windows 2000 SEC_I_CONTEXT_EXPIRED (close_notify) is not
-           returned so we have to work around that in cleanup. */
-        backend->recv_sspi_close_notify = true;
-        if(!backend->recv_connection_closed) {
-          backend->recv_connection_closed = true;
-          infof(data, "schannel: server closed the connection");
-        }
-        goto cleanup;
-      }
-    }
-    else if(sspi_status == SEC_E_INCOMPLETE_MESSAGE) {
-      backend->encdata_is_incomplete = true;
-      if(!*err)
-        *err = CURLE_AGAIN;
-      infof(data, "schannel: failed to decrypt data, need more data");
-      goto cleanup;
-    }
-    else {
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-      char buffer[STRERROR_LEN];
-#endif
-      *err = CURLE_RECV_ERROR;
-      infof(data, "schannel: failed to read data from server: %s",
-            Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
-      goto cleanup;
-    }
-  }
-
-  DEBUGF(infof(data,
-               "schannel: encrypted data buffer: offset %zu length %zu",
-               backend->encdata_offset, backend->encdata_length));
-
-  DEBUGF(infof(data,
-               "schannel: decrypted data buffer: offset %zu length %zu",
-               backend->decdata_offset, backend->decdata_length));
-
-cleanup:
-  /* Warning- there is no guarantee the encdata state is valid at this point */
-  DEBUGF(infof(data, "schannel: schannel_recv cleanup"));
-
-  /* Error if the connection has closed without a close_notify.
-
-     The behavior here is a matter of debate. We don't want to be vulnerable
-     to a truncation attack however there's some browser precedent for
-     ignoring the close_notify for compatibility reasons.
-
-     Additionally, Windows 2000 (v5.0) is a special case since it seems it
-     doesn't return close_notify. In that case if the connection was closed we
-     assume it was graceful (close_notify) since there doesn't seem to be a
-     way to tell.
-  */
-  if(len && !backend->decdata_offset && backend->recv_connection_closed &&
-     !backend->recv_sspi_close_notify) {
-    bool isWin2k = curlx_verify_windows_version(5, 0, 0, PLATFORM_WINNT,
-                                                VERSION_EQUAL);
-
-    if(isWin2k && sspi_status == SEC_E_OK)
-      backend->recv_sspi_close_notify = true;
-    else {
-      *err = CURLE_RECV_ERROR;
-      infof(data, "schannel: server closed abruptly (missing close_notify)");
-    }
-  }
-
-  /* Any error other than CURLE_AGAIN is an unrecoverable error. */
-  if(*err && *err != CURLE_AGAIN)
-    backend->recv_unrecoverable_err = *err;
-
-  size = len < backend->decdata_offset ? len : backend->decdata_offset;
-  if(size) {
-    memcpy(buf, backend->decdata_buffer, size);
-    memmove(backend->decdata_buffer, backend->decdata_buffer + size,
-            backend->decdata_offset - size);
-    backend->decdata_offset -= size;
-    DEBUGF(infof(data, "schannel: decrypted data returned %zu", size));
-    DEBUGF(infof(data,
-                 "schannel: decrypted data buffer: offset %zu length %zu",
-                 backend->decdata_offset, backend->decdata_length));
-    *err = CURLE_OK;
-    return (ssize_t)size;
-  }
-
-  if(!*err && !backend->recv_connection_closed)
-    *err = CURLE_AGAIN;
-
-  /* It's debatable what to return when !len. We could return whatever error
-     we got from decryption but instead we override here so the return is
-     consistent.
-  */
-  if(!len)
-    *err = CURLE_OK;
-
-  return *err ? -1 : 0;
-}
-
-static CURLcode schannel_connect_nonblocking(struct Curl_cfilter *cf,
-                                             struct Curl_easy *data,
-                                             bool *done)
-{
-  return schannel_connect_common(cf, data, TRUE, done);
-}
-
-static CURLcode schannel_connect(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data)
-{
-  CURLcode result;
-  bool done = FALSE;
-
-  result = schannel_connect_common(cf, data, FALSE, &done);
-  if(result)
-    return result;
-
-  DEBUGASSERT(done);
-
-  return CURLE_OK;
-}
-
-static bool schannel_data_pending(struct Curl_cfilter *cf,
-                                  const struct Curl_easy *data)
-{
-  const struct ssl_connect_data *connssl = cf->ctx;
-  struct schannel_ssl_backend_data *backend =
-    (struct schannel_ssl_backend_data *)connssl->backend;
-
-  (void)data;
-  DEBUGASSERT(backend);
-
-  if(backend->ctxt) /* SSL/TLS is in use */
-    return (backend->decdata_offset > 0 ||
-            (backend->encdata_offset > 0 && !backend->encdata_is_incomplete));
-  else
-    return FALSE;
-}
-
-static void schannel_session_free(void *ptr)
-{
-  /* this is expected to be called under sessionid lock */
-  struct Curl_schannel_cred *cred = ptr;
-
-  if(cred) {
-    cred->refcount--;
-    if(cred->refcount == 0) {
-      s_pSecFn->FreeCredentialsHandle(&cred->cred_handle);
-      curlx_unicodefree(cred->sni_hostname);
-#ifdef HAS_CLIENT_CERT_PATH
-      if(cred->client_cert_store) {
-        CertCloseStore(cred->client_cert_store, 0);
-        cred->client_cert_store = NULL;
-      }
-#endif
-      Curl_safefree(cred);
-    }
-  }
-}
-
-/* shut down the SSL connection and clean up related memory.
-   this function can be called multiple times on the same connection including
-   if the SSL connection failed (eg connection made but failed handshake). */
-static int schannel_shutdown(struct Curl_cfilter *cf,
-                             struct Curl_easy *data)
-{
-  /* See https://msdn.microsoft.com/en-us/library/windows/desktop/aa380138.aspx
-   * Shutting Down an Schannel Connection
-   */
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct schannel_ssl_backend_data *backend =
-    (struct schannel_ssl_backend_data *)connssl->backend;
-
-  DEBUGASSERT(data);
-  DEBUGASSERT(backend);
-
-  if(backend->ctxt) {
-    infof(data, "schannel: shutting down SSL/TLS connection with %s port %d",
-          connssl->hostname, connssl->port);
-  }
-
-  if(backend->cred && backend->ctxt) {
-    SecBufferDesc BuffDesc;
-    SecBuffer Buffer;
-    SECURITY_STATUS sspi_status;
-    SecBuffer outbuf;
-    SecBufferDesc outbuf_desc;
-    CURLcode result;
-    DWORD dwshut = SCHANNEL_SHUTDOWN;
-
-    InitSecBuffer(&Buffer, SECBUFFER_TOKEN, &dwshut, sizeof(dwshut));
-    InitSecBufferDesc(&BuffDesc, &Buffer, 1);
-
-    sspi_status = s_pSecFn->ApplyControlToken(&backend->ctxt->ctxt_handle,
-                                              &BuffDesc);
-
-    if(sspi_status != SEC_E_OK) {
-      char buffer[STRERROR_LEN];
-      failf(data, "schannel: ApplyControlToken failure: %s",
-            Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
-    }
-
-    /* setup output buffer */
-    InitSecBuffer(&outbuf, SECBUFFER_EMPTY, NULL, 0);
-    InitSecBufferDesc(&outbuf_desc, &outbuf, 1);
-
-    sspi_status = s_pSecFn->InitializeSecurityContext(
-      &backend->cred->cred_handle,
-      &backend->ctxt->ctxt_handle,
-      backend->cred->sni_hostname,
-      backend->req_flags,
-      0,
-      0,
-      NULL,
-      0,
-      &backend->ctxt->ctxt_handle,
-      &outbuf_desc,
-      &backend->ret_flags,
-      &backend->ctxt->time_stamp);
-
-    if((sspi_status == SEC_E_OK) || (sspi_status == SEC_I_CONTEXT_EXPIRED)) {
-      /* send close message which is in output buffer */
-      ssize_t written = Curl_conn_cf_send(cf->next, data,
-                                          outbuf.pvBuffer, outbuf.cbBuffer,
-                                          &result);
-      s_pSecFn->FreeContextBuffer(outbuf.pvBuffer);
-      if((result != CURLE_OK) || (outbuf.cbBuffer != (size_t) written)) {
-        infof(data, "schannel: failed to send close msg: %s"
-              " (bytes written: %zd)", curl_easy_strerror(result), written);
-      }
-    }
-  }
-
-  /* free SSPI Schannel API security context handle */
-  if(backend->ctxt) {
-    DEBUGF(infof(data, "schannel: clear security context handle"));
-    s_pSecFn->DeleteSecurityContext(&backend->ctxt->ctxt_handle);
-    Curl_safefree(backend->ctxt);
-  }
-
-  /* free SSPI Schannel API credential handle */
-  if(backend->cred) {
-    Curl_ssl_sessionid_lock(data);
-    schannel_session_free(backend->cred);
-    Curl_ssl_sessionid_unlock(data);
-    backend->cred = NULL;
-  }
-
-  /* free internal buffer for received encrypted data */
-  if(backend->encdata_buffer) {
-    Curl_safefree(backend->encdata_buffer);
-    backend->encdata_length = 0;
-    backend->encdata_offset = 0;
-    backend->encdata_is_incomplete = false;
-  }
-
-  /* free internal buffer for received decrypted data */
-  if(backend->decdata_buffer) {
-    Curl_safefree(backend->decdata_buffer);
-    backend->decdata_length = 0;
-    backend->decdata_offset = 0;
-  }
-
-  return CURLE_OK;
-}
-
-static void schannel_close(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  schannel_shutdown(cf, data);
-}
-
-static int schannel_init(void)
-{
-  return (Curl_sspi_global_init() == CURLE_OK ? 1 : 0);
-}
-
-static void schannel_cleanup(void)
-{
-  Curl_sspi_global_cleanup();
-}
-
-static size_t schannel_version(char *buffer, size_t size)
-{
-  size = msnprintf(buffer, size, "Schannel");
-
-  return size;
-}
-
-static CURLcode schannel_random(struct Curl_easy *data UNUSED_PARAM,
-                                unsigned char *entropy, size_t length)
-{
-  (void)data;
-
-  return Curl_win32_random(entropy, length);
 }
 
 static CURLcode schannel_pkp_pin_peer_pubkey(struct Curl_cfilter *cf,
@@ -2671,7 +1111,7 @@ static CURLcode schannel_pkp_pin_peer_pubkey(struct Curl_cfilter *cf,
 
   DEBUGASSERT(backend);
 
-  /* if a path wasn't specified, don't pin */
+  /* if a path was not specified, do not pin */
   if(!pinnedpubkey)
     return CURLE_OK;
 
@@ -2683,9 +1123,9 @@ static CURLcode schannel_pkp_pin_peer_pubkey(struct Curl_cfilter *cf,
     struct Curl_asn1Element *pubkey;
 
     sspi_status =
-      s_pSecFn->QueryContextAttributes(&backend->ctxt->ctxt_handle,
-                                       SECPKG_ATTR_REMOTE_CERT_CONTEXT,
-                                       &pCertContextServer);
+      Curl_pSecFn->QueryContextAttributes(&backend->ctxt->ctxt_handle,
+                                          SECPKG_ATTR_REMOTE_CERT_CONTEXT,
+                                          &pCertContextServer);
 
     if((sspi_status != SEC_E_OK) || !pCertContextServer) {
       char buffer[STRERROR_LEN];
@@ -2694,7 +1134,6 @@ static CURLcode schannel_pkp_pin_peer_pubkey(struct Curl_cfilter *cf,
       break; /* failed */
     }
 
-
     if(!(((pCertContextServer->dwCertEncodingType & X509_ASN_ENCODING) != 0) &&
          (pCertContextServer->cbCertEncoded > 0)))
       break;
@@ -2726,18 +1165,1501 @@ static CURLcode schannel_pkp_pin_peer_pubkey(struct Curl_cfilter *cf,
   return result;
 }
 
-static void schannel_checksum(const unsigned char *input,
-                              size_t inputlen,
-                              unsigned char *checksum,
-                              size_t checksumlen,
-                              DWORD provType,
-                              const unsigned int algId)
+static CURLcode ensure_encoding_size(struct Curl_easy *data,
+                                     struct sbuffer *encdata,
+                                     size_t min_length)
 {
+  size_t size;
+  DEBUGASSERT(encdata->length >= encdata->offset);
+  if(encdata->length < encdata->offset)
+    return CURLE_FAILED_INIT;
+  size = encdata->length - encdata->offset;
+  if(size < CURL_SCHANNEL_BUFFER_FREE_SIZE || encdata->length < min_length) {
+    unsigned char *buffer;
+    size_t length = encdata->offset + CURL_SCHANNEL_BUFFER_FREE_SIZE;
+    if(length < min_length)
+      length = min_length;
+    buffer = curlx_realloc(encdata->buffer, length);
+    if(!buffer) {
+      failf(data, "schannel: unable to re-allocate memory");
+      return CURLE_OUT_OF_MEMORY;
+    }
+
+    encdata->buffer = buffer;
+    encdata->length = length;
+    SCH_DEV(infof(data, "schannel: encdata.buffer resized %zu",
+                  encdata->length));
+  }
+  return CURLE_OK;
+}
+
+static CURLcode ensure_decoding_size(struct Curl_easy *data,
+                                     struct sbuffer *decdata,
+                                     size_t nowsize,
+                                     size_t len)
+{
+  size_t size = nowsize > CURL_SCHANNEL_BUFFER_FREE_SIZE ?
+    nowsize : CURL_SCHANNEL_BUFFER_FREE_SIZE;
+  DEBUGASSERT(decdata->length >= decdata->offset);
+  if(decdata->length < decdata->offset)
+    return CURLE_FAILED_INIT;
+  else if(decdata->length - decdata->offset < size ||
+          decdata->length < len) {
+    /* increase internal decrypted data buffer */
+    size_t length = decdata->offset + size;
+    unsigned char *buffer;
+    /* make sure that the requested amount of data fits */
+    if(length < len)
+      length = len;
+
+    buffer = curlx_realloc(decdata->buffer, length);
+    if(!buffer) {
+      failf(data, "schannel: unable to re-allocate memory");
+      return CURLE_OUT_OF_MEMORY;
+    }
+    decdata->buffer = buffer;
+    decdata->length = length;
+  }
+  return CURLE_OK;
+}
+
+static CURLcode schannel_connect_step2(struct Curl_cfilter *cf,
+                                       struct Curl_easy *data)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct schannel_ssl_backend_data *backend =
+    (struct schannel_ssl_backend_data *)connssl->backend;
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  int i;
+  size_t nread = 0;
+  SecBuffer outbuf[3];
+  SecBufferDesc outbuf_desc;
+  SecBuffer inbuf[2];
+  SecBufferDesc inbuf_desc;
+  SECURITY_STATUS sspi_status = SEC_E_OK;
+  CURLcode result;
+  bool doread;
+  const char *pubkey_ptr;
+
+  DEBUGASSERT(backend);
+
+  doread = (connssl->io_need & CURL_SSL_IO_NEED_SEND) ? FALSE : TRUE;
+  connssl->io_need = CURL_SSL_IO_NEED_NONE;
+
+  DEBUGF(infof(data, "schannel: SSL/TLS connection with %s port %d (step 2/3)",
+               connssl->peer.origin->hostname, connssl->peer.origin->port));
+
+  if(!backend->cred || !backend->ctxt)
+    return CURLE_SSL_CONNECT_ERROR;
+
+  /* buffer to store previously received and decrypted data */
+  if(!backend->decdata.buffer) {
+    backend->decdata.offset = 0;
+    backend->decdata.length = CURL_SCHANNEL_BUFFER_INIT_SIZE;
+    backend->decdata.buffer = curlx_malloc(backend->decdata.length);
+    if(!backend->decdata.buffer) {
+      failf(data, "schannel: unable to allocate memory");
+      return CURLE_OUT_OF_MEMORY;
+    }
+  }
+
+  /* buffer to store previously received and encrypted data */
+  if(!backend->encdata.buffer) {
+    backend->encdata_is_incomplete = FALSE;
+    backend->encdata.offset = 0;
+    backend->encdata.length = CURL_SCHANNEL_BUFFER_INIT_SIZE;
+    backend->encdata.buffer = curlx_malloc(backend->encdata.length);
+    if(!backend->encdata.buffer) {
+      failf(data, "schannel: unable to allocate memory");
+      return CURLE_OUT_OF_MEMORY;
+    }
+  }
+
+  result = ensure_encoding_size(data, &backend->encdata, 0);
+  if(result)
+    return result;
+
+  for(;;) {
+    if(doread) {
+      /* read encrypted handshake data from socket */
+      result = Curl_conn_cf_recv(cf->next, data,
+                                 (char *)(backend->encdata.buffer +
+                                          backend->encdata.offset),
+                                 backend->encdata.length -
+                                 backend->encdata.offset,
+                                 &nread);
+      if(result == CURLE_AGAIN) {
+        if(!backend->encdata.offset || backend->encdata_is_incomplete) {
+          connssl->io_need = CURL_SSL_IO_NEED_RECV;
+          DEBUGF(infof(data, "schannel: failed to receive handshake, "
+                       "need more data"));
+          return CURLE_OK;
+        }
+        else {
+          DEBUGF(infof(data, "schannel: no new handshake data received, "
+                       "continuing to process existing handshake data"));
+        }
+      }
+      else if(result || (nread == 0)) {
+        failf(data, "schannel: failed to receive handshake, "
+              "SSL/TLS connection failed");
+        return CURLE_SSL_CONNECT_ERROR;
+      }
+      else {
+        /* increase encrypted data buffer offset */
+        backend->encdata.offset += nread;
+        backend->encdata_is_incomplete = FALSE;
+        SCH_DEV(infof(data, "schannel: encrypted data got %zu", nread));
+      }
+    }
+
+    SCH_DEV(infof(data,
+                  "schannel: encrypted data buffer: offset %zu length %zu",
+                  backend->encdata.offset, backend->encdata.length));
+
+    /* setup input buffers */
+    InitSecBuffer(&inbuf[0], SECBUFFER_TOKEN,
+                  curlx_malloc(backend->encdata.offset),
+                  curlx_uztoul(backend->encdata.offset));
+    InitSecBuffer(&inbuf[1], SECBUFFER_EMPTY, NULL, 0);
+    InitSecBufferDesc(&inbuf_desc, inbuf, 2);
+
+    /* setup output buffers */
+    InitSecBuffer(&outbuf[0], SECBUFFER_TOKEN, NULL, 0);
+    InitSecBuffer(&outbuf[1], SECBUFFER_ALERT, NULL, 0);
+    InitSecBuffer(&outbuf[2], SECBUFFER_EMPTY, NULL, 0);
+    InitSecBufferDesc(&outbuf_desc, outbuf, 3);
+
+    if(!inbuf[0].pvBuffer) {
+      failf(data, "schannel: unable to allocate memory");
+      return CURLE_OUT_OF_MEMORY;
+    }
+
+    /* copy received handshake data into input buffer */
+    memcpy(inbuf[0].pvBuffer, backend->encdata.buffer,
+           backend->encdata.offset);
+
+    /* The socket must be writable (or a poll error occurred) before we call
+       InitializeSecurityContext to continue processing the received TLS
+       records. This is because that function is not idempotent and we do not
+       support partial save/resume sending replies of handshake tokens. */
+    if(!SOCKET_WRITABLE(Curl_conn_cf_get_socket(cf, data), 0)) {
+      SCH_DEV(infof(data, "schannel: handshake waiting for writable socket"));
+      connssl->io_need = CURL_SSL_IO_NEED_SEND;
+      curlx_free(inbuf[0].pvBuffer);
+      return CURLE_OK;
+    }
+
+    sspi_status = Curl_pSecFn->InitializeSecurityContext(
+      &backend->cred->cred_handle, &backend->ctxt->ctxt_handle,
+      backend->cred->sni_hostname, backend->req_flags,
+      0, 0, &inbuf_desc, 0, NULL,
+      &outbuf_desc, &backend->ret_flags, NULL);
+
+    /* free buffer for received handshake data */
+    curlx_safefree(inbuf[0].pvBuffer);
+
+    /* check if the handshake was incomplete */
+    switch(sspi_status) {
+    case SEC_E_INCOMPLETE_MESSAGE:
+      backend->encdata_is_incomplete = TRUE;
+      connssl->io_need = CURL_SSL_IO_NEED_RECV;
+      DEBUGF(infof(data,
+                   "schannel: received incomplete message, need more data"));
+      return CURLE_OK;
+
+    case SEC_I_CONTINUE_NEEDED:
+    case SEC_E_OK:
+      /* check if the handshake needs to be continued */
+      result = CURLE_OK;
+      for(i = 0; i < 3; i++) {
+        /* search for handshake tokens that need to be send */
+        if(outbuf[i].BufferType == SECBUFFER_TOKEN && outbuf[i].cbBuffer > 0) {
+          size_t written = 0;
+          DEBUGF(infof(data, "schannel: sending next handshake data: "
+                       "sending %lu bytes.", outbuf[i].cbBuffer));
+
+          /* send handshake token to server */
+          result = Curl_conn_cf_send(cf->next, data,
+                                     (const uint8_t *)outbuf[i].pvBuffer,
+                                     outbuf[i].cbBuffer,
+                                     FALSE, &written);
+          if(result || (outbuf[i].cbBuffer != written)) {
+            failf(data, "schannel: failed to send next handshake data: "
+                  "sent %zu of %lu bytes", written, outbuf[i].cbBuffer);
+            result = CURLE_SSL_CONNECT_ERROR;
+          }
+        }
+      }
+      for(i = 0; i < 3; i++) {
+        /* free obsolete buffer */
+        if(outbuf[i].pvBuffer)
+          Curl_pSecFn->FreeContextBuffer(outbuf[i].pvBuffer);
+      }
+      if(result)
+        return result;
+      break;
+
+    case SEC_I_INCOMPLETE_CREDENTIALS:
+      if(!(backend->req_flags & ISC_REQ_USE_SUPPLIED_CREDS)) {
+        /* If the server has requested a client certificate, attempt to
+           continue the handshake without one. This allows connections to
+           servers which request a client certificate but do not require
+           it. */
+        backend->req_flags |= ISC_REQ_USE_SUPPLIED_CREDS;
+        connssl->io_need = CURL_SSL_IO_NEED_SEND;
+        DEBUGF(infof(data,
+                     "schannel: a client certificate has been requested"));
+        return CURLE_OK;
+      }
+      FALLTHROUGH();
+
+    default:
+      return schannel_error(data, sspi_status);
+    }
+
+    /* check if there was additional remaining encrypted data */
+    if(inbuf[1].BufferType == SECBUFFER_EXTRA && inbuf[1].cbBuffer > 0) {
+      SCH_DEV(infof(data, "schannel: encrypted data length: %lu",
+                    inbuf[1].cbBuffer));
+      /*
+        There are two cases where we could be getting extra data here:
+        1. If we are renegotiating a connection and the handshake is already
+           complete (from the server perspective), it can encrypted app data
+           (not handshake data) in an extra buffer at this point.
+        2. (sspi_status == SEC_I_CONTINUE_NEEDED) We are negotiating a
+           connection and this extra data is part of the handshake.
+           We should process the data immediately; waiting for the socket to
+           be ready may fail since the server is done sending handshake data.
+      */
+      /* check if the remaining data is less than the total amount
+         and therefore begins after the already processed data */
+      if(backend->encdata.offset > inbuf[1].cbBuffer) {
+        memmove(backend->encdata.buffer,
+                (backend->encdata.buffer + backend->encdata.offset) -
+                inbuf[1].cbBuffer, inbuf[1].cbBuffer);
+        backend->encdata.offset = inbuf[1].cbBuffer;
+        if(sspi_status == SEC_I_CONTINUE_NEEDED) {
+          doread = FALSE;
+          continue;
+        }
+      }
+    }
+    else {
+      backend->encdata.offset = 0;
+    }
+    break;
+  }
+
+  /* check if the handshake needs to be continued */
+  if(sspi_status == SEC_I_CONTINUE_NEEDED) {
+    connssl->io_need = CURL_SSL_IO_NEED_RECV;
+    return CURLE_OK;
+  }
+
+  /* check if the handshake is complete */
+  if(sspi_status == SEC_E_OK) {
+    connssl->connecting_state = ssl_connect_3;
+    DEBUGF(infof(data, "schannel: SSL/TLS handshake complete"));
+  }
+
+#ifndef CURL_DISABLE_PROXY
+  pubkey_ptr = Curl_ssl_cf_is_proxy(cf) ?
+    data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
+    data->set.str[STRING_SSL_PINNEDPUBLICKEY];
+#else
+  pubkey_ptr = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
+#endif
+  if(pubkey_ptr) {
+    result = schannel_pkp_pin_peer_pubkey(cf, data, pubkey_ptr);
+    if(result) {
+      failf(data, "SSL: public key does not match pinned public key");
+      return result;
+    }
+  }
+
+  if(conn_config->verifypeer && backend->use_manual_cred_validation) {
+    /* Certificate verification also verifies the hostname if verifyhost */
+    return Curl_verify_certificate(cf, data);
+  }
+
+  /* Verify the hostname manually when certificate verification is disabled,
+     because in that case Schannel does not verify it. */
+  if(!conn_config->verifypeer && conn_config->verifyhost)
+    return Curl_verify_host(cf, data);
+
+  return CURLE_OK;
+}
+
+static bool valid_cert_encoding(const CERT_CONTEXT *cert_context)
+{
+  return cert_context &&
+    ((cert_context->dwCertEncodingType & X509_ASN_ENCODING) != 0) &&
+    cert_context->pbCertEncoded &&
+    (cert_context->cbCertEncoded > 0);
+}
+
+typedef bool (*Read_crt_func)(const CERT_CONTEXT *ccert_context,
+                              bool reverse_order, void *arg);
+
+static void traverse_cert_store(const CERT_CONTEXT *context,
+                                Read_crt_func func, void *arg)
+{
+  const CERT_CONTEXT *current_context = NULL;
+  bool should_continue = TRUE;
+  bool first = TRUE;
+  bool reverse_order = FALSE;
+  while(should_continue &&
+        (current_context = CertEnumCertificatesInStore(
+          context->hCertStore,
+          current_context)) != NULL) {
+    /* Windows 11 22H2 OS Build 22621.674 or higher enumerates certificates in
+       leaf-to-root order while all previous versions of Windows enumerate
+       certificates in root-to-leaf order. Determine the order of enumeration
+       by comparing SECPKG_ATTR_REMOTE_CERT_CONTEXT's pbCertContext with the
+       first certificate's pbCertContext. */
+    if(first && context->pbCertEncoded != current_context->pbCertEncoded)
+      reverse_order = TRUE;
+    should_continue = func(current_context, reverse_order, arg);
+    first = FALSE;
+  }
+
+  if(current_context)
+    CertFreeCertificateContext(current_context);
+}
+
+static bool cert_counter_callback(const CERT_CONTEXT *ccert_context,
+                                  bool reverse_order, void *certs_count)
+{
+  (void)reverse_order;
+  if(valid_cert_encoding(ccert_context))
+    (*(int *)certs_count)++;
+  if(*(int *)certs_count > MAX_ALLOWED_CERT_AMOUNT)
+    return FALSE;
+  return TRUE;
+}
+
+struct Adder_args {
+  struct Curl_easy *data;
+  CURLcode result;
+  int idx;
+  int certs_count;
+};
+
+static bool add_cert_to_certinfo(const CERT_CONTEXT *ccert_context,
+                                 bool reverse_order, void *raw_arg)
+{
+  struct Adder_args *args = (struct Adder_args *)raw_arg;
+  args->result = CURLE_OK;
+  if(valid_cert_encoding(ccert_context)) {
+    const char *beg = (const char *)ccert_context->pbCertEncoded;
+    const char *end = beg + ccert_context->cbCertEncoded;
+    int insert_index = reverse_order ? (args->certs_count - 1) - args->idx :
+                       args->idx;
+    args->result = Curl_extract_certinfo(args->data, insert_index,
+                                         beg, end);
+    args->idx++;
+  }
+  return args->result == CURLE_OK;
+}
+
+static void schannel_session_free(void *sessionid)
+{
+  /* this is expected to be called under sessionid lock */
+  struct Curl_schannel_cred *cred = sessionid;
+
+  if(cred) {
+    cred->refcount--;
+    if(cred->refcount == 0) {
+      Curl_pSecFn->FreeCredentialsHandle(&cred->cred_handle);
+      curlx_free(cred->sni_hostname);
+      if(cred->client_cert_store) {
+        CertCloseStore(cred->client_cert_store, 0);
+        cred->client_cert_store = NULL;
+      }
+      curlx_safefree(cred);
+    }
+  }
+}
+
+static CURLcode schannel_connect_step3(struct Curl_cfilter *cf,
+                                       struct Curl_easy *data)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct schannel_ssl_backend_data *backend =
+    (struct schannel_ssl_backend_data *)connssl->backend;
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+  CURLcode result = CURLE_OK;
+  SECURITY_STATUS sspi_status = SEC_E_OK;
+  CERT_CONTEXT *ccert_context = NULL;
+#ifdef HAS_ALPN_SCHANNEL
+  SecPkgContext_ApplicationProtocol alpn_result;
+#endif
+
+  DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);
+  DEBUGASSERT(backend);
+
+  DEBUGF(infof(data, "schannel: SSL/TLS connection with %s port %d (step 3/3)",
+               connssl->peer.origin->hostname, connssl->peer.origin->port));
+
+  if(!backend->cred)
+    return CURLE_SSL_CONNECT_ERROR;
+
+  /* check if the required context attributes are met */
+  if(backend->ret_flags != backend->req_flags) {
+    if(!(backend->ret_flags & ISC_RET_SEQUENCE_DETECT))
+      failf(data, "schannel: failed to setup sequence detection");
+    if(!(backend->ret_flags & ISC_RET_REPLAY_DETECT))
+      failf(data, "schannel: failed to setup replay detection");
+    if(!(backend->ret_flags & ISC_RET_CONFIDENTIALITY))
+      failf(data, "schannel: failed to setup confidentiality");
+    if(!(backend->ret_flags & ISC_RET_ALLOCATED_MEMORY))
+      failf(data, "schannel: failed to setup memory allocation");
+    if(!(backend->ret_flags & ISC_RET_STREAM))
+      failf(data, "schannel: failed to setup stream orientation");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+#ifdef HAS_ALPN_SCHANNEL
+  if(backend->use_alpn) {
+    sspi_status =
+      Curl_pSecFn->QueryContextAttributes(&backend->ctxt->ctxt_handle,
+                                          SECPKG_ATTR_APPLICATION_PROTOCOL,
+                                          &alpn_result);
+
+    if(sspi_status != SEC_E_OK) {
+      failf(data, "schannel: failed to retrieve ALPN result");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+
+    if(alpn_result.ProtoNegoStatus ==
+       SecApplicationProtocolNegotiationStatus_Success) {
+      if(backend->recv_renegotiating &&
+         connssl->negotiated.alpn &&
+         strncmp(connssl->negotiated.alpn,
+                 (const char *)alpn_result.ProtocolId,
+                 alpn_result.ProtocolIdSize)) {
+        /* Renegotiation selected a different protocol now, we cannot
+         * deal with this */
+        failf(data, "schannel: server selected an ALPN protocol too late");
+        return CURLE_SSL_CONNECT_ERROR;
+      }
+      Curl_alpn_set_negotiated(cf, data, connssl, alpn_result.ProtocolId,
+                               alpn_result.ProtocolIdSize);
+    }
+    else {
+      if(!backend->recv_renegotiating)
+        Curl_alpn_set_negotiated(cf, data, connssl, NULL, 0);
+    }
+  }
+#endif
+
+  /* save the current session data for possible reuse */
+  if(Curl_ssl_scache_use(cf, data)) {
+    Curl_ssl_scache_lock(data);
+    /* Up ref count since call takes ownership */
+    backend->cred->refcount++;
+    result = Curl_ssl_scache_add_obj(cf, data, connssl->peer.scache_key,
+                                     backend->cred, schannel_session_free);
+    Curl_ssl_scache_unlock(data);
+    if(result)
+      return result;
+  }
+
+  if(ssl_config->certinfo) {
+    int certs_count = 0;
+    sspi_status =
+      Curl_pSecFn->QueryContextAttributes(&backend->ctxt->ctxt_handle,
+                                          SECPKG_ATTR_REMOTE_CERT_CONTEXT,
+                                          &ccert_context);
+
+    if((sspi_status != SEC_E_OK) || !ccert_context) {
+      failf(data, "schannel: failed to retrieve remote cert context");
+      return CURLE_PEER_FAILED_VERIFICATION;
+    }
+
+    traverse_cert_store(ccert_context, cert_counter_callback, &certs_count);
+    if(certs_count > MAX_ALLOWED_CERT_AMOUNT) {
+      failf(data, "%d certificates is more than allowed (%d)",
+            certs_count, MAX_ALLOWED_CERT_AMOUNT);
+      CertFreeCertificateContext(ccert_context);
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+
+    result = Curl_ssl_init_certinfo(data, certs_count);
+    if(!result) {
+      struct Adder_args args;
+      args.data = data;
+      args.idx = 0;
+      args.certs_count = certs_count;
+      args.result = CURLE_OK;
+      traverse_cert_store(ccert_context, add_cert_to_certinfo, &args);
+      result = args.result;
+    }
+    CertFreeCertificateContext(ccert_context);
+    if(result)
+      return result;
+  }
+
+  connssl->connecting_state = ssl_connect_done;
+
+  return CURLE_OK;
+}
+
+static CURLcode schannel_connect(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 bool *done)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  CURLcode result;
+
+  /* check if the connection has already been established */
+  if(ssl_connection_complete == connssl->state) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  *done = FALSE;
+
+  if(ssl_connect_1 == connssl->connecting_state) {
+    result = schannel_connect_step1(cf, data);
+    if(result)
+      return result;
+  }
+
+  if(ssl_connect_2 == connssl->connecting_state) {
+    result = schannel_connect_step2(cf, data);
+    if(result)
+      return result;
+  }
+
+  if(ssl_connect_3 == connssl->connecting_state) {
+    result = schannel_connect_step3(cf, data);
+    if(result)
+      return result;
+  }
+
+  if(ssl_connect_done == connssl->connecting_state) {
+    connssl->state = ssl_connection_complete;
+
+#ifdef SECPKG_ATTR_ENDPOINT_BINDINGS  /* mingw-w64 v9+, MS SDK 7.0A/VS2010+ */
+    /* When SSPI is used in combination with Schannel
+     * we need the Schannel context to create the Schannel
+     * binding to pass the IIS extended protection checks.
+     * Available on Windows 7 or later.
+     */
+    {
+      struct schannel_ssl_backend_data *backend =
+        (struct schannel_ssl_backend_data *)connssl->backend;
+      DEBUGASSERT(backend);
+      cf->conn->sslContext = &backend->ctxt->ctxt_handle;
+    }
+#endif
+
+    *done = TRUE;
+  }
+
+  return CURLE_OK;
+}
+
+enum schannel_renegotiate_caller_t {
+  SCH_RENEG_CALLER_IS_RECV,
+  SCH_RENEG_CALLER_IS_SEND
+};
+
+/* The maximum time we allow for Schannel renegotiation which may in some
+   rare cases block either due to libcurl (waiting on the socket) or Windows
+   (waiting on an interactive security prompt). Note Schannel "renegotiation"
+   is not necessarily literal TLS renegotiation, but means DecryptMessage
+   returned SEC_I_RENEGOTIATE which means at least the security context needs
+   to be re-established. */
+#define MAX_RENEG_BLOCK_TIME (60 * 1000) /* 60 seconds in milliseconds */
+
+/* This function renegotiates the connection due to a server request received
+   by schannel_recv. This function returns CURLE_AGAIN if the renegotiation is
+   incomplete. In that case, we remain in the renegotiation (connecting) stage
+   and future calls to schannel_recv and schannel_send must call this function
+   first to complete the renegotiation. */
+static CURLcode schannel_recv_renegotiate(
+  struct Curl_cfilter *cf, struct Curl_easy *data,
+  enum schannel_renegotiate_caller_t caller)
+{
+  CURLcode result;
+  curl_socket_t sockfd;
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct schannel_ssl_backend_data *backend =
+    (struct schannel_ssl_backend_data *)connssl->backend;
+  struct schannel_renegotiate_state *rs = &backend->renegotiate_state;
+
+  if(!backend || !backend->recv_renegotiating) {
+    failf(data, "schannel: unexpected call to schannel_recv_renegotiate");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+  DEBUGASSERT(caller <= SCH_RENEG_CALLER_IS_SEND);
+  if(caller == SCH_RENEG_CALLER_IS_RECV)
+    SCH_DEV(infof(data, "schannel: renegotiation caller is schannel_recv"));
+  else
+    SCH_DEV(infof(data, "schannel: renegotiation caller is schannel_send"));
+
+  sockfd = Curl_conn_cf_get_socket(cf, data);
+
+  if(sockfd == CURL_SOCKET_BAD) {
+    failf(data, "schannel: renegotiation missing socket");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  if(!rs->started) { /* new renegotiation */
+    infof(data, "schannel: renegotiating SSL/TLS connection");
+    DEBUGASSERT(connssl->state == ssl_connection_complete);
+    DEBUGASSERT(connssl->connecting_state == ssl_connect_done);
+    connssl->state = ssl_connection_negotiating;
+    connssl->connecting_state = ssl_connect_2;
+    memset(rs, 0, sizeof(*rs));
+    rs->io_need = CURL_SSL_IO_NEED_SEND;
+    rs->start_time = *Curl_pgrs_now(data);
+    rs->started = TRUE;
+  }
+
+  for(;;) {
+    bool block_read, block_write, blocking, done;
+    curl_socket_t readfd, writefd;
+    timediff_t elapsed;
+
+    elapsed = curlx_ptimediff_ms(Curl_pgrs_now(data), &rs->start_time);
+    if(elapsed >= MAX_RENEG_BLOCK_TIME) {
+      failf(data, "schannel: renegotiation timeout");
+      result = CURLE_SSL_CONNECT_ERROR;
+      break;
+    }
+
+    /* the current io_need state may have been overwritten since the last time
+       this function was called. restore the io_need state needed to continue
+       the renegotiation. */
+
+    connssl->io_need = rs->io_need;
+
+    result = schannel_connect(cf, data, &done);
+
+    rs->io_need = connssl->io_need;
+
+    if(!result && !done)
+      result = CURLE_AGAIN;
+
+    if(result != CURLE_AGAIN)
+      break;
+
+    readfd = (rs->io_need & CURL_SSL_IO_NEED_RECV) ? sockfd : CURL_SOCKET_BAD;
+    writefd = (rs->io_need & CURL_SSL_IO_NEED_SEND) ? sockfd : CURL_SOCKET_BAD;
+
+    if(readfd == CURL_SOCKET_BAD && writefd == CURL_SOCKET_BAD)
+      continue;
+
+    /* connect should not have requested io read and write together */
+    DEBUGASSERT(readfd == CURL_SOCKET_BAD || writefd == CURL_SOCKET_BAD);
+
+    /* This function is partially blocking to avoid a stoppage that would
+     * occur if the user is waiting on the socket only in one direction.
+     *
+     * For example, if the user has called recv then they may not be waiting
+     * for a writable socket and vice versa, so we block to avoid that.
+     *
+     * In practice a wait is unlikely to occur. For caller recv if handshake
+     * data needs to be sent then we block for a writable socket that should
+     * be writable immediately except for OS resource constraints. For caller
+     * send if handshake data needs to be received then we block for a readable
+     * socket, which could take some time, but it is more likely the user has
+     * called recv since they had called it prior (only recv can start
+     * renegotiation and probably the user is going to call it again to get
+     * more of their data before calling send).
+     */
+
+    block_read = (caller == SCH_RENEG_CALLER_IS_SEND) ? TRUE : FALSE;
+    block_write = (caller == SCH_RENEG_CALLER_IS_RECV) ? TRUE : FALSE;
+
+    blocking = (block_read && (readfd != CURL_SOCKET_BAD)) ||
+               (block_write && (writefd != CURL_SOCKET_BAD));
+
+    SCH_DEV_SHOWBOOL(block_read);
+    SCH_DEV_SHOWBOOL(block_write);
+    SCH_DEV_SHOWBOOL(blocking);
+
+    for(;;) {
+      int what;
+      timediff_t timeout_ms, remaining;
+
+      result = Curl_pgrsUpdate(data);
+      if(result)
+        break;
+
+      elapsed = curlx_ptimediff_ms(Curl_pgrs_now(data), &rs->start_time);
+      if(elapsed >= MAX_RENEG_BLOCK_TIME) {
+        failf(data, "schannel: renegotiation timeout");
+        result = CURLE_SSL_CONNECT_ERROR;
+        break;
+      }
+      remaining = MAX_RENEG_BLOCK_TIME - elapsed;
+
+      if(blocking) {
+        timeout_ms = Curl_timeleft_ms(data);
+
+        if(timeout_ms < 0) {
+          result = CURLE_OPERATION_TIMEDOUT;
+          break;
+        }
+
+        /* the blocking is in intervals so that the progress function can be
+           called every second */
+        if(!timeout_ms || timeout_ms > 1000)
+          timeout_ms = 1000;
+
+        if(timeout_ms > remaining)
+          timeout_ms = remaining;
+      }
+      else
+        timeout_ms = 0;
+
+      SCH_DEV(infof(data, "schannel: renegotiation wait until socket is"
+                    "%s%s for up to %" FMT_TIMEDIFF_T " ms",
+                    ((readfd != CURL_SOCKET_BAD) ? " readable" : ""),
+                    ((writefd != CURL_SOCKET_BAD) ? " writable" : ""),
+                    timeout_ms));
+
+      what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd, timeout_ms);
+
+      if(what > 0 && (what & (CURL_CSELECT_IN | CURL_CSELECT_OUT))) {
+        SCH_DEV(infof(data, "schannel: renegotiation socket %s%s",
+                      ((what & CURL_CSELECT_IN) ? "CURL_CSELECT_IN " : ""),
+                      ((what & CURL_CSELECT_OUT) ? "CURL_CSELECT_OUT " : "")));
+        result = CURLE_AGAIN;
+        break;
+      }
+      else if(!what) {
+        SCH_DEV(infof(data, "schannel: renegotiation socket timeout"));
+        if(blocking)
+          continue;
+        else
+          return CURLE_AGAIN;
+      }
+
+      failf(data, "schannel: socket error during renegotiation");
+      result = CURLE_SSL_CONNECT_ERROR;
+      break;
+    }
+    if(result != CURLE_AGAIN)
+      break;
+  }
+
+  DEBUGASSERT(result != CURLE_AGAIN);
+
+  rs->started = FALSE;
+  backend->recv_renegotiating = FALSE;
+  connssl->io_need = CURL_SSL_IO_NEED_NONE;
+
+  if(result)
+    failf(data, "schannel: renegotiation failed");
+  else
+    infof(data, "schannel: SSL/TLS connection renegotiated");
+
+  return result;
+}
+
+static CURLcode schannel_send(struct Curl_cfilter *cf, struct Curl_easy *data,
+                              const void *buf, size_t len, size_t *pnwritten)
+{
+  size_t data_len = 0;
+  unsigned char *ptr = NULL;
+  struct ssl_connect_data *connssl = cf->ctx;
+  SecBuffer outbuf[4];
+  SecBufferDesc outbuf_desc;
+  SECURITY_STATUS sspi_status = SEC_E_OK;
+  CURLcode result = CURLE_OK;
+  struct schannel_ssl_backend_data *backend =
+    (struct schannel_ssl_backend_data *)connssl->backend;
+
+  DEBUGASSERT(backend);
+  *pnwritten = 0;
+
+  if(backend->recv_renegotiating) {
+    result = schannel_recv_renegotiate(cf, data, SCH_RENEG_CALLER_IS_SEND);
+    if(result)
+      return result;
+  }
+
+  /* check if the maximum stream sizes were queried */
+  if(backend->stream_sizes.cbMaximumMessage == 0) {
+    sspi_status = Curl_pSecFn->QueryContextAttributes(
+      &backend->ctxt->ctxt_handle,
+      SECPKG_ATTR_STREAM_SIZES,
+      &backend->stream_sizes);
+    if(sspi_status != SEC_E_OK) {
+      return CURLE_SEND_ERROR;
+    }
+  }
+
+  /* check if the buffer is longer than the maximum message length */
+  if(len > backend->stream_sizes.cbMaximumMessage) {
+    len = backend->stream_sizes.cbMaximumMessage;
+  }
+
+  /* calculate the complete message length and allocate a buffer for it */
+  data_len = backend->stream_sizes.cbHeader + len +
+    backend->stream_sizes.cbTrailer;
+  ptr = curlx_malloc(data_len);
+  if(!ptr) {
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  /* setup output buffers (header, data, trailer, empty) */
+  InitSecBuffer(&outbuf[0], SECBUFFER_STREAM_HEADER,
+                ptr, backend->stream_sizes.cbHeader);
+  InitSecBuffer(&outbuf[1], SECBUFFER_DATA,
+                ptr + backend->stream_sizes.cbHeader, curlx_uztoul(len));
+  InitSecBuffer(&outbuf[2], SECBUFFER_STREAM_TRAILER,
+                ptr + backend->stream_sizes.cbHeader + len,
+                backend->stream_sizes.cbTrailer);
+  InitSecBuffer(&outbuf[3], SECBUFFER_EMPTY, NULL, 0);
+  InitSecBufferDesc(&outbuf_desc, outbuf, 4);
+
+  /* copy data into output buffer */
+  memcpy(outbuf[1].pvBuffer, buf, len);
+
+  /* https://learn.microsoft.com/windows/win32/api/sspi/nf-sspi-encryptmessage */
+  sspi_status = Curl_pSecFn->EncryptMessage(&backend->ctxt->ctxt_handle, 0,
+                                            &outbuf_desc, 0);
+
+  /* check if the message was encrypted */
+  if(sspi_status == SEC_E_OK) {
+
+    /* send the encrypted message including header, data and trailer */
+    len = outbuf[0].cbBuffer + outbuf[1].cbBuffer + outbuf[2].cbBuffer;
+
+    /*
+      it is important to send the full message which includes the header,
+      encrypted payload, and trailer. Until the client receives all the
+      data a coherent message has not been delivered and the client
+      cannot read any of it.
+
+      If we wanted to buffer the unwritten encrypted bytes, we would
+      tell the client that all data it has requested to be sent has been
+      sent. The unwritten encrypted bytes would be the first bytes to
+      send on the next invocation.
+      Here's the catch with this - if we tell the client that all the
+      bytes have been sent, does the client call this method again to
+      send the buffered data?  Looking at who calls this function, it
+      seems the answer is NO.
+    */
+
+    /* send entire message or fail */
+    while(len > *pnwritten) {
+      size_t this_write = 0;
+      int what;
+      timediff_t timeout_ms = Curl_timeleft_ms(data);
+      if(timeout_ms < 0) {
+        /* we already got the timeout */
+        failf(data, "schannel: timed out sending data (bytes sent: %zu)",
+              *pnwritten);
+        result = CURLE_OPERATION_TIMEDOUT;
+        break;
+      }
+      else if(!timeout_ms)
+        timeout_ms = TIMEDIFF_T_MAX;
+      what = SOCKET_WRITABLE(Curl_conn_cf_get_socket(cf, data), timeout_ms);
+      if(what < 0) {
+        /* fatal error */
+        failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
+        result = CURLE_SEND_ERROR;
+        break;
+      }
+      else if(what == 0) {
+        failf(data, "schannel: timed out sending data (bytes sent: %zu)",
+              *pnwritten);
+        result = CURLE_OPERATION_TIMEDOUT;
+        break;
+      }
+      /* socket is writable */
+
+       result = Curl_conn_cf_send(cf->next, data,
+                                  (const uint8_t *)ptr + *pnwritten,
+                                  len - *pnwritten,
+                                  FALSE, &this_write);
+      if(result == CURLE_AGAIN)
+        continue;
+      else if(result) {
+        break;
+      }
+
+      *pnwritten += this_write;
+    }
+  }
+  else if(sspi_status == SEC_E_INSUFFICIENT_MEMORY) {
+    result = CURLE_OUT_OF_MEMORY;
+  }
+  else {
+    result = CURLE_SEND_ERROR;
+  }
+
+  curlx_safefree(ptr);
+
+  if(len == *pnwritten)
+    /* Encrypted message including header, data and trailer entirely sent.
+       The return value is the number of unencrypted bytes that were sent. */
+    *pnwritten = outbuf[1].cbBuffer;
+
+  return result;
+}
+
+static CURLcode schannel_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
+                              char *buf, size_t len, size_t *pnread)
+{
+  size_t size = 0;
+  size_t nread = 0;
+  struct ssl_connect_data *connssl = cf->ctx;
+  SecBuffer inbuf[4];
+  SecBufferDesc inbuf_desc;
+  SECURITY_STATUS sspi_status = SEC_E_OK;
+  struct schannel_ssl_backend_data *backend =
+    (struct schannel_ssl_backend_data *)connssl->backend;
+  CURLcode result = CURLE_OK;
+
+  DEBUGASSERT(backend);
+  *pnread = 0;
+
+  if(backend->recv_renegotiating) {
+    result = schannel_recv_renegotiate(cf, data, SCH_RENEG_CALLER_IS_RECV);
+    if(result)
+      return result;
+  }
+
+  /****************************************************************************
+   * Do not return or set backend->recv_unrecoverable_err unless in the
+   * cleanup. The pattern for return error is set *err, optional infof, goto
+   * cleanup.
+   *
+   * Some verbose debug messages are wrapped by SCH_DEV() instead of DEBUGF()
+   * and only shown if CURL_SCHANNEL_DEV_DEBUG was defined at build time. These
+   * messages are extra verbose and intended for curl developers debugging
+   * Schannel recv decryption.
+   *
+   * Our priority is to always return as much decrypted data to the caller as
+   * possible, even if an error occurs. The state of the decrypted buffer must
+   * always be valid. Transfer of decrypted data to the caller's buffer is
+   * handled in the cleanup.
+   */
+
+  SCH_DEV(infof(data, "schannel: client wants to read %zu bytes", len));
+
+  if(len && len <= backend->decdata.offset) {
+    SCH_DEV(infof(data,
+                  "schannel: enough decrypted data is already available"));
+    goto cleanup;
+  }
+  else if(backend->recv_unrecoverable_err) {
+    result = backend->recv_unrecoverable_err;
+    infof(data, "schannel: an unrecoverable error occurred in a prior call");
+    goto cleanup;
+  }
+  else if(backend->recv_sspi_close_notify) {
+    /* once a server has indicated shutdown there is no more encrypted data */
+    infof(data, "schannel: server indicated shutdown in a prior call");
+    goto cleanup;
+  }
+  /* it is debatable what to return when !len. Regardless we cannot return
+     immediately because there may be data to decrypt (in the case we want to
+     decrypt all encrypted cached data) so handle !len later in cleanup.
+  */
+  else if(len && !backend->recv_connection_closed) {
+    /* the encrypted buffer must be large enough to hold all the bytes
+       requested and some TLS record overhead. 'len' is a buffer size, so this
+       integer math cannot overflow. */
+    const size_t min_encdata_length = len + CURL_SCHANNEL_BUFFER_FREE_SIZE;
+
+    /* make sure encrypt buffer fits the requested amount of data */
+    result = ensure_encoding_size(data, &backend->encdata, min_encdata_length);
+    if(result)
+      goto cleanup;
+
+    SCH_DEV(infof(data,
+                  "schannel: encrypted data buffer: offset %zu length %zu",
+                  backend->encdata.offset, backend->encdata.length));
+
+    /* read encrypted data from socket */
+    result = Curl_conn_cf_recv(cf->next, data,
+                               (char *)(backend->encdata.buffer +
+                                        backend->encdata.offset),
+                               backend->encdata.length -
+                               backend->encdata.offset,
+                               &nread);
+    if(result) {
+      if(result == CURLE_AGAIN)
+        SCH_DEV(infof(data, "schannel: recv returned CURLE_AGAIN"));
+      else {
+        infof(data, "schannel: recv returned error %d", (int)result);
+        backend->recv_unrecoverable_err = result;
+      }
+    }
+    else if(nread == 0) {
+      backend->recv_connection_closed = TRUE;
+      DEBUGF(infof(data, "schannel: server closed the connection"));
+    }
+    else {
+      backend->encdata.offset += nread;
+      backend->encdata_is_incomplete = FALSE;
+      SCH_DEV(infof(data, "schannel: encrypted data got %zu", nread));
+    }
+  }
+
+  SCH_DEV(infof(data, "schannel: encrypted data buffer: offset %zu length %zu",
+                backend->encdata.offset, backend->encdata.length));
+
+  /* decrypt loop */
+  while(backend->encdata.offset > 0 && sspi_status == SEC_E_OK &&
+        (!len || backend->decdata.offset < len ||
+         backend->recv_connection_closed)) {
+    /* prepare data buffer for DecryptMessage call */
+    InitSecBuffer(&inbuf[0], SECBUFFER_DATA, backend->encdata.buffer,
+                  curlx_uztoul(backend->encdata.offset));
+
+    /* we need 3 more empty input buffers for possible output */
+    InitSecBuffer(&inbuf[1], SECBUFFER_EMPTY, NULL, 0);
+    InitSecBuffer(&inbuf[2], SECBUFFER_EMPTY, NULL, 0);
+    InitSecBuffer(&inbuf[3], SECBUFFER_EMPTY, NULL, 0);
+    InitSecBufferDesc(&inbuf_desc, inbuf, 4);
+
+    /* https://learn.microsoft.com/windows/win32/api/sspi/nf-sspi-decryptmessage
+     */
+    sspi_status = Curl_pSecFn->DecryptMessage(&backend->ctxt->ctxt_handle,
+                                              &inbuf_desc, 0, NULL);
+
+    /* check if everything went fine (server may want to renegotiate
+       or shutdown the connection context) */
+    if(sspi_status == SEC_E_OK || sspi_status == SEC_I_RENEGOTIATE ||
+       sspi_status == SEC_I_CONTEXT_EXPIRED) {
+      /* check for successfully decrypted data, even before actual
+         renegotiation or shutdown of the connection context */
+      if(inbuf[1].BufferType == SECBUFFER_DATA) {
+        SCH_DEV(infof(data, "schannel: decrypted data length: %lu",
+                      inbuf[1].cbBuffer));
+
+        /* ensure the decode buffer fits the received amount of data */
+        result = ensure_decoding_size(data, &backend->decdata,
+                                      inbuf[1].cbBuffer, len);
+        if(result)
+          goto cleanup;
+
+        /* copy decrypted data to internal buffer */
+        size = inbuf[1].cbBuffer;
+        if(size) {
+          memcpy(backend->decdata.buffer + backend->decdata.offset,
+                 inbuf[1].pvBuffer, size);
+          backend->decdata.offset += size;
+        }
+
+        SCH_DEV(infof(data, "schannel: decrypted data added: %zu", size));
+        SCH_DEV(infof(data,
+                      "schannel: decrypted cached: offset %zu length %zu",
+                      backend->decdata.offset, backend->decdata.length));
+      }
+
+      /* check for remaining encrypted data */
+      if(inbuf[3].BufferType == SECBUFFER_EXTRA && inbuf[3].cbBuffer > 0) {
+        SCH_DEV(infof(data, "schannel: encrypted data length: %lu",
+                      inbuf[3].cbBuffer));
+
+        /* check if the remaining data is less than the total amount
+         * and therefore begins after the already processed data
+         */
+        if(backend->encdata.offset > inbuf[3].cbBuffer) {
+          /* move remaining encrypted data forward to the beginning of
+             buffer */
+          memmove(backend->encdata.buffer,
+                  (backend->encdata.buffer + backend->encdata.offset) -
+                  inbuf[3].cbBuffer, inbuf[3].cbBuffer);
+          backend->encdata.offset = inbuf[3].cbBuffer;
+        }
+
+        SCH_DEV(infof(data,
+                      "schannel: encrypted cached: offset %zu length %zu",
+                      backend->encdata.offset, backend->encdata.length));
+      }
+      else {
+        /* reset encrypted buffer offset, because there is no data remaining */
+        backend->encdata.offset = 0;
+      }
+
+      /* check if server wants to renegotiate the connection context */
+      if(sspi_status == SEC_I_RENEGOTIATE) {
+        infof(data, "schannel: remote party requests renegotiation");
+        if(result && result != CURLE_AGAIN) {
+          infof(data, "schannel: cannot renegotiate, an error is pending");
+          goto cleanup;
+        }
+
+        backend->recv_renegotiating = TRUE;
+        result = schannel_recv_renegotiate(cf, data, SCH_RENEG_CALLER_IS_RECV);
+        if(result)
+          goto cleanup;
+
+        /* now retry receiving data */
+        sspi_status = SEC_E_OK;
+        continue;
+      }
+      /* check if the server closed the connection */
+      else if(sspi_status == SEC_I_CONTEXT_EXPIRED) {
+        /* In Windows 2000 SEC_I_CONTEXT_EXPIRED (close_notify) is not
+           returned so we have to work around that in cleanup. */
+        backend->recv_sspi_close_notify = TRUE;
+        if(!backend->recv_connection_closed)
+          backend->recv_connection_closed = TRUE;
+        /* We received the close notify fine, any error we got
+         * from the lower filters afterwards (e.g. the socket), is not
+         * an error on the TLS data stream. That one ended here. */
+        if(result == CURLE_RECV_ERROR)
+          result = CURLE_OK;
+        infof(data,
+              "schannel: server close notification received (close_notify)");
+        goto cleanup;
+      }
+    }
+    else if(sspi_status == SEC_E_INCOMPLETE_MESSAGE) {
+      backend->encdata_is_incomplete = TRUE;
+      if(!result)
+        result = CURLE_AGAIN;
+      SCH_DEV(infof(data, "schannel: failed to decrypt data, need more data"));
+      goto cleanup;
+    }
+    else {
+      char buffer[STRERROR_LEN];
+      failf(data, "schannel: failed to read data from server: %s",
+            Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
+      result = CURLE_RECV_ERROR;
+      goto cleanup;
+    }
+  }
+
+  SCH_DEV(infof(data, "schannel: encrypted data buffer: offset %zu length %zu",
+                backend->encdata.offset, backend->encdata.length));
+
+  SCH_DEV(infof(data, "schannel: decrypted data buffer: offset %zu length %zu",
+                backend->decdata.offset, backend->decdata.length));
+
+cleanup:
+  /* Warning- there is no guarantee the encdata state is valid at this point */
+  SCH_DEV(infof(data, "schannel: schannel_recv cleanup"));
+
+  /* Error if the connection has closed without a close_notify.
+
+     The behavior here is a matter of debate. We do not want to be vulnerable
+     to a truncation attack however there is some browser precedent for
+     ignoring the close_notify for compatibility reasons.
+  */
+  if(len && !backend->decdata.offset && backend->recv_connection_closed &&
+     !backend->recv_sspi_close_notify) {
+    result = CURLE_RECV_ERROR;
+    failf(data, "schannel: server closed abruptly (missing close_notify)");
+  }
+
+  /* Any error other than CURLE_AGAIN is an unrecoverable error. */
+  if(result && result != CURLE_AGAIN)
+    backend->recv_unrecoverable_err = result;
+
+  size = len < backend->decdata.offset ? len : backend->decdata.offset;
+  if(size) {
+    memcpy(buf, backend->decdata.buffer, size);
+    memmove(backend->decdata.buffer, backend->decdata.buffer + size,
+            backend->decdata.offset - size);
+    backend->decdata.offset -= size;
+    SCH_DEV(infof(data, "schannel: decrypted data returned %zu", size));
+    SCH_DEV(infof(data,
+                  "schannel: decrypted data buffer: offset %zu length %zu",
+                  backend->decdata.offset, backend->decdata.length));
+    *pnread = size;
+    return CURLE_OK;
+  }
+
+  if(!result && !backend->recv_connection_closed)
+    result = CURLE_AGAIN;
+
+  /* it is debatable what to return when !len. We could return whatever error
+     we got from decryption but instead we override here so the return is
+     consistent.
+  */
+  if(!len)
+    return CURLE_OK;
+
+  return result;
+}
+
+static bool schannel_data_pending(struct Curl_cfilter *cf,
+                                  const struct Curl_easy *data)
+{
+  const struct ssl_connect_data *connssl = cf->ctx;
+  struct schannel_ssl_backend_data *backend =
+    (struct schannel_ssl_backend_data *)connssl->backend;
+
+  (void)data;
+  DEBUGASSERT(backend);
+
+  if(backend->ctxt) /* SSL/TLS is in use */
+    return backend->decdata.offset > 0 ||
+           (backend->encdata.offset > 0 && !backend->encdata_is_incomplete) ||
+           backend->recv_connection_closed ||
+           backend->recv_sspi_close_notify ||
+           backend->recv_unrecoverable_err;
+  else
+    return FALSE;
+}
+
+/* shut down the SSL connection and clean up related memory.
+   this function can be called multiple times on the same connection including
+   if the SSL connection failed (eg connection made but failed handshake). */
+static CURLcode schannel_shutdown(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  bool send_shutdown, bool *done)
+{
+  /* See https://learn.microsoft.com/windows/win32/secauthn/shutting-down-an-schannel-connection
+   * Shutting Down an Schannel Connection
+   */
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct schannel_ssl_backend_data *backend =
+    (struct schannel_ssl_backend_data *)connssl->backend;
+  CURLcode result = CURLE_OK;
+
+  if(cf->shutdown) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  DEBUGASSERT(data);
+  DEBUGASSERT(backend);
+
+  /* Not supported in schannel */
+  (void)send_shutdown;
+
+  *done = FALSE;
+  if(backend->ctxt) {
+    infof(data, "schannel: shutting down SSL/TLS connection with %s port %d",
+          connssl->peer.origin->hostname, connssl->peer.origin->port);
+  }
+
+  if(!backend->ctxt || cf->shutdown) {
+    *done = TRUE;
+    goto out;
+  }
+
+  if(backend->cred && backend->ctxt && !backend->sent_shutdown) {
+    SecBufferDesc BuffDesc;
+    SecBuffer Buffer;
+    SECURITY_STATUS sspi_status;
+    SecBuffer outbuf;
+    SecBufferDesc outbuf_desc;
+    DWORD dwshut = SCHANNEL_SHUTDOWN;
+
+    InitSecBuffer(&Buffer, SECBUFFER_TOKEN, &dwshut, sizeof(dwshut));
+    InitSecBufferDesc(&BuffDesc, &Buffer, 1);
+
+    sspi_status = Curl_pSecFn->ApplyControlToken(&backend->ctxt->ctxt_handle,
+                                                 &BuffDesc);
+
+    if(sspi_status != SEC_E_OK) {
+      char buffer[STRERROR_LEN];
+      failf(data, "schannel: ApplyControlToken failure: %s",
+            Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
+      result = CURLE_SEND_ERROR;
+      goto out;
+    }
+
+    /* setup output buffer */
+    InitSecBuffer(&outbuf, SECBUFFER_EMPTY, NULL, 0);
+    InitSecBufferDesc(&outbuf_desc, &outbuf, 1);
+
+    sspi_status = Curl_pSecFn->InitializeSecurityContext(
+      &backend->cred->cred_handle,
+      &backend->ctxt->ctxt_handle,
+      backend->cred->sni_hostname,
+      backend->req_flags,
+      0,
+      0,
+      NULL,
+      0,
+      &backend->ctxt->ctxt_handle,
+      &outbuf_desc,
+      &backend->ret_flags, NULL);
+
+    if((sspi_status == SEC_E_OK) || (sspi_status == SEC_I_CONTEXT_EXPIRED)) {
+      /* send close message which is in output buffer */
+      size_t written;
+
+      result = Curl_conn_cf_send(cf->next, data,
+                                 (const uint8_t *)outbuf.pvBuffer,
+                                 outbuf.cbBuffer,
+                                 FALSE, &written);
+      Curl_pSecFn->FreeContextBuffer(outbuf.pvBuffer);
+      if(!result) {
+        if(written < outbuf.cbBuffer) {
+          result = CURLE_SEND_ERROR;
+          failf(data, "schannel: failed to send close msg: %s"
+                " (bytes written: %zu)", curl_easy_strerror(result), written);
+          goto out;
+        }
+        backend->sent_shutdown = TRUE;
+        *done = TRUE;
+      }
+      else if(result == CURLE_AGAIN) {
+        connssl->io_need = CURL_SSL_IO_NEED_SEND;
+        result = CURLE_OK;
+        goto out;
+      }
+      else {
+        if(!backend->recv_connection_closed) {
+          result = CURLE_SEND_ERROR;
+          failf(data, "schannel: error sending close msg: %d", (int)result);
+          goto out;
+        }
+        /* Looks like server already closed the connection.
+         * An error to send our close notify is not a failure. */
+        *done = TRUE;
+        result = CURLE_OK;
+      }
+    }
+  }
+
+  /* If the connection seems open and we have not seen the close notify
+   * from the server yet, try to receive it. */
+  if(backend->cred && backend->ctxt &&
+     !backend->recv_sspi_close_notify && !backend->recv_connection_closed) {
+    char buffer[1024];
+    size_t nread;
+
+    result = schannel_recv(cf, data, buffer, sizeof(buffer), &nread);
+    if(result == CURLE_AGAIN) {
+      connssl->io_need = CURL_SSL_IO_NEED_RECV;
+    }
+    else if(result) {
+      CURL_TRC_CF(data, cf, "SSL shutdown, error %d", (int)result);
+      result = CURLE_RECV_ERROR;
+    }
+    else if(nread == 0) {
+      /* We got the close notify alert and are done. */
+      backend->recv_connection_closed = TRUE;
+      *done = TRUE;
+    }
+    else {
+      /* still data coming in? */
+    }
+  }
+
+out:
+  cf->shutdown = (result || *done);
+  return result;
+}
+
+static void schannel_close(struct Curl_cfilter *cf, struct Curl_easy *data)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct schannel_ssl_backend_data *backend =
+    (struct schannel_ssl_backend_data *)connssl->backend;
+
+  DEBUGASSERT(data);
+  DEBUGASSERT(backend);
+
+  /* free SSPI Schannel API security context handle */
+  if(backend->ctxt) {
+    DEBUGF(infof(data, "schannel: clear security context handle"));
+    Curl_pSecFn->DeleteSecurityContext(&backend->ctxt->ctxt_handle);
+    curlx_safefree(backend->ctxt);
+  }
+
+  /* free SSPI Schannel API credential handle */
+  if(backend->cred) {
+    Curl_ssl_scache_lock(data);
+    schannel_session_free(backend->cred);
+    Curl_ssl_scache_unlock(data);
+    backend->cred = NULL;
+  }
+
+  /* free internal buffer for received encrypted data */
+  if(backend->encdata.buffer) {
+    curlx_safefree(backend->encdata.buffer);
+    backend->encdata.length = 0;
+    backend->encdata.offset = 0;
+    backend->encdata_is_incomplete = FALSE;
+  }
+
+  /* free internal buffer for received decrypted data */
+  if(backend->decdata.buffer) {
+    curlx_safefree(backend->decdata.buffer);
+    backend->decdata.length = 0;
+    backend->decdata.offset = 0;
+  }
+}
+
+static int schannel_init(void)
+{
+#ifdef HAS_ALPN_SCHANNEL
+  typedef const char *(APIENTRY *WINE_GET_VERSION_FN)(void);
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wcast-function-type-strict"
+#endif
+  WINE_GET_VERSION_FN p_wine_get_version =
+    CURLX_FUNCTION_CAST(WINE_GET_VERSION_FN,
+      GetProcAddress(GetModuleHandle(TEXT("ntdll")), "wine_get_version"));
+#if defined(__clang__) && __clang_major__ >= 16
+#pragma clang diagnostic pop
+#endif
+  if(p_wine_get_version) {  /* WINE detected */
+    curl_off_t ver = 0;
+    const char *wine_version = p_wine_get_version();  /* e.g. "6.0.2" */
+    /* Assume ALPN support with WINE 6.0 or upper */
+    if(wine_version)
+      curlx_str_number(&wine_version, &ver, 20);
+    s_win_has_alpn = (ver >= 6);
+  }
+  else {
+    /* ALPN is supported on Windows 8.1 / Server 2012 R2 and above. */
+    s_win_has_alpn = curlx_verify_windows_version(6, 3, 0, PLATFORM_WINNT,
+                                                  VERSION_GREATER_THAN_EQUAL);
+  }
+#endif /* HAS_ALPN_SCHANNEL */
+
+  return Curl_sspi_global_init() == CURLE_OK ? 1 : 0;
+}
+
+static void schannel_cleanup(void)
+{
+  Curl_sspi_global_cleanup();
+}
+
+static size_t schannel_version(char *buffer, size_t size)
+{
+  return curl_msnprintf(buffer, size, "Schannel");
+}
+
+static CURLcode schannel_random(struct Curl_easy *data,
+                                unsigned char *entropy, size_t length)
+{
+  (void)data;
+
+  return Curl_win32_random(entropy, length);
+}
+
+static CURLcode schannel_checksum(const unsigned char *input,
+                                  size_t inputlen,
+                                  unsigned char *checksum,
+                                  size_t checksumlen,
+                                  DWORD provType,
+                                  const unsigned int algId)
+{
+  CURLcode result = CURLE_FAILED_INIT;
+
   HCRYPTPROV hProv = 0;
   HCRYPTHASH hHash = 0;
-  DWORD cbHashSize = 0;
-  DWORD dwHashSizeLen = (DWORD)sizeof(cbHashSize);
-  DWORD dwChecksumLen = (DWORD)checksumlen;
+
+  size_t off;
+
+  DWORD cbHashSize;
+  DWORD dwHashSizeLen;
+  DWORD dwChecksumLen;
 
   /* since this can fail in multiple ways, zero memory first so we never
    * return old data
@@ -2746,34 +2668,45 @@ static void schannel_checksum(const unsigned char *input,
 
   if(!CryptAcquireContext(&hProv, NULL, NULL, provType,
                           CRYPT_VERIFYCONTEXT | CRYPT_SILENT))
-    return; /* failed */
+    goto out;
 
-  do {
-    if(!CryptCreateHash(hProv, algId, 0, 0, &hHash))
-      break; /* failed */
+  if(!CryptCreateHash(hProv, algId, 0, 0, &hHash))
+    goto out;
 
-    /* workaround for original MinGW, should be (const BYTE*) */
-    if(!CryptHashData(hHash, (BYTE*)input, (DWORD)inputlen, 0))
-      break; /* failed */
+  result = CURLE_BAD_FUNCTION_ARGUMENT;
 
-    /* get hash size */
-    if(!CryptGetHashParam(hHash, HP_HASHSIZE, (BYTE *)&cbHashSize,
-                          &dwHashSizeLen, 0))
-      break; /* failed */
+  off = 0;
+  while(off < inputlen) {
+    DWORD chunk = (DWORD)CURLMIN(inputlen - off, 0xffffffffUL);
+    if(!CryptHashData(hHash, input + off, chunk, 0))
+      goto out;
+    off += chunk;
+  }
 
-    /* check hash size */
-    if(checksumlen < cbHashSize)
-      break; /* failed */
+  /* get hash size */
+  cbHashSize = 0;
+  dwHashSizeLen = (DWORD)sizeof(cbHashSize);
+  if(!CryptGetHashParam(hHash, HP_HASHSIZE, (BYTE *)&cbHashSize,
+                        &dwHashSizeLen, 0))
+    goto out;
 
-    if(CryptGetHashParam(hHash, HP_HASHVAL, checksum, &dwChecksumLen, 0))
-      break; /* failed */
-  } while(0);
+  /* check if hash fits into the return buffer */
+  if(checksumlen < cbHashSize)
+    goto out;
 
+  dwChecksumLen = (DWORD)checksumlen;
+  if(CryptGetHashParam(hHash, HP_HASHVAL, checksum, &dwChecksumLen, 0) &&
+     dwChecksumLen == cbHashSize)
+    result = CURLE_OK;
+
+out:
   if(hHash)
     CryptDestroyHash(hHash);
 
   if(hProv)
     CryptReleaseContext(hProv, 0);
+
+  return result;
 }
 
 static CURLcode schannel_sha256sum(const unsigned char *input,
@@ -2781,13 +2714,12 @@ static CURLcode schannel_sha256sum(const unsigned char *input,
                                    unsigned char *sha256sum,
                                    size_t sha256len)
 {
-  schannel_checksum(input, inputlen, sha256sum, sha256len,
-                    PROV_RSA_AES, CALG_SHA_256);
-  return CURLE_OK;
+  return schannel_checksum(input, inputlen, sha256sum, sha256len,
+                           PROV_RSA_AES, CALG_SHA_256);
 }
 
 static void *schannel_get_internals(struct ssl_connect_data *connssl,
-                                    CURLINFO info UNUSED_PARAM)
+                                    CURLINFO info)
 {
   struct schannel_ssl_backend_data *backend =
     (struct schannel_ssl_backend_data *)connssl->backend;
@@ -2796,44 +2728,184 @@ static void *schannel_get_internals(struct ssl_connect_data *connssl,
   return &backend->ctxt->ctxt_handle;
 }
 
+HCERTSTORE Curl_schannel_get_cached_cert_store(struct Curl_cfilter *cf,
+                                               struct Curl_easy *data)
+{
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  struct Curl_multi *multi = data->multi;
+  const struct curl_blob *ca_info_blob = conn_config->ca_info_blob;
+  struct schannel_cert_share *share;
+  const struct ssl_general_config *cfg = &data->set.general_ssl;
+  timediff_t timeout_ms;
+  unsigned char info_blob_digest[CURL_SHA256_DIGEST_LENGTH];
+
+  DEBUGASSERT(multi);
+
+  if(!multi) {
+    return NULL;
+  }
+
+  share = Curl_hash_pick(&multi->proto_hash,
+                         CURL_UNCONST(MPROTO_SCHANNEL_CERT_SHARE_KEY),
+                         sizeof(MPROTO_SCHANNEL_CERT_SHARE_KEY) - 1);
+  if(!share || !share->cert_store) {
+    return NULL;
+  }
+
+  /* zero ca_cache_timeout completely disables caching */
+  if(!cfg->ca_cache_timeout) {
+    return NULL;
+  }
+
+  /* check for cache timeout by using the cached_x509_store_expired timediff
+     calculation pattern from openssl.c.
+     negative timeout means retain forever. */
+  timeout_ms = cfg->ca_cache_timeout * (timediff_t)1000;
+  if(timeout_ms >= 0) {
+    timediff_t elapsed_ms =
+      curlx_ptimediff_ms(Curl_pgrs_now(data), &share->time);
+    if(elapsed_ms >= timeout_ms) {
+      return NULL;
+    }
+  }
+
+  if(ca_info_blob) {
+    if(share->CAinfo_blob_size != ca_info_blob->len) {
+      return NULL;
+    }
+    if(schannel_sha256sum((const unsigned char *)ca_info_blob->data,
+                          ca_info_blob->len,
+                          info_blob_digest,
+                          CURL_SHA256_DIGEST_LENGTH))
+      return NULL;
+    if(memcmp(share->CAinfo_blob_digest, info_blob_digest,
+              CURL_SHA256_DIGEST_LENGTH)) {
+      return NULL;
+    }
+  }
+  else {
+    if(!conn_config->CAfile || !share->CAfile ||
+       strcmp(share->CAfile, conn_config->CAfile)) {
+      return NULL;
+    }
+  }
+
+  return share->cert_store;
+}
+
+static void schannel_cert_share_free(void *key, size_t key_len, void *p)
+{
+  struct schannel_cert_share *share = p;
+  DEBUGASSERT(key_len == (sizeof(MPROTO_SCHANNEL_CERT_SHARE_KEY) - 1));
+  DEBUGASSERT(!memcmp(MPROTO_SCHANNEL_CERT_SHARE_KEY, key, key_len));
+  (void)key;
+  (void)key_len;
+  if(share->cert_store) {
+    CertCloseStore(share->cert_store, 0);
+  }
+  curlx_free(share->CAfile);
+  curlx_free(share);
+}
+
+bool Curl_schannel_set_cached_cert_store(struct Curl_cfilter *cf,
+                                         struct Curl_easy *data,
+                                         HCERTSTORE cert_store)
+{
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  struct Curl_multi *multi = data->multi;
+  const struct curl_blob *ca_info_blob = conn_config->ca_info_blob;
+  struct schannel_cert_share *share;
+  unsigned char digest[CURL_SHA256_DIGEST_LENGTH];
+  char *CAfile = NULL;
+
+  DEBUGASSERT(multi);
+
+  if(!multi) {
+    return FALSE;
+  }
+
+  if(ca_info_blob) {
+    if(schannel_sha256sum((const unsigned char *)ca_info_blob->data,
+                          ca_info_blob->len, digest, sizeof(digest))) {
+      return FALSE;
+    }
+  }
+  else if(conn_config->CAfile) {
+    CAfile = curlx_strdup(conn_config->CAfile);
+    if(!CAfile) {
+      return FALSE;
+    }
+  }
+
+  share = Curl_hash_pick(&multi->proto_hash,
+                         CURL_UNCONST(MPROTO_SCHANNEL_CERT_SHARE_KEY),
+                         sizeof(MPROTO_SCHANNEL_CERT_SHARE_KEY) - 1);
+  if(!share) {
+    share = curlx_calloc(1, sizeof(*share));
+    if(!share) {
+      curlx_free(CAfile);
+      return FALSE;
+    }
+    if(!Curl_hash_add2(&multi->proto_hash,
+                       CURL_UNCONST(MPROTO_SCHANNEL_CERT_SHARE_KEY),
+                       sizeof(MPROTO_SCHANNEL_CERT_SHARE_KEY) - 1,
+                       share, schannel_cert_share_free)) {
+      curlx_free(share);
+      curlx_free(CAfile);
+      return FALSE;
+    }
+  }
+
+  /* free old cache data */
+  if(share->cert_store) {
+    CertCloseStore(share->cert_store, 0);
+  }
+  curlx_free(share->CAfile);
+
+  if(ca_info_blob) {
+    memcpy(share->CAinfo_blob_digest, digest, sizeof(digest));
+    share->CAinfo_blob_size = ca_info_blob->len;
+  }
+  else
+    share->CAinfo_blob_size = 0;
+
+  share->time = curlx_now();
+  share->cert_store = cert_store;
+  share->CAfile = CAfile;
+  return TRUE;
+}
+
 const struct Curl_ssl Curl_ssl_schannel = {
   { CURLSSLBACKEND_SCHANNEL, "schannel" }, /* info */
 
   SSLSUPP_CERTINFO |
-#ifdef HAS_MANUAL_VERIFY_API
   SSLSUPP_CAINFO_BLOB |
-#endif
   SSLSUPP_PINNEDPUBKEY |
-  SSLSUPP_TLS13_CIPHERSUITES |
-  SSLSUPP_HTTPS_PROXY,
+  SSLSUPP_CA_CACHE |
+  SSLSUPP_HTTPS_PROXY |
+  SSLSUPP_CIPHER_LIST,
 
   sizeof(struct schannel_ssl_backend_data),
 
   schannel_init,                     /* init */
   schannel_cleanup,                  /* cleanup */
   schannel_version,                  /* version */
-  Curl_none_check_cxn,               /* check_cxn */
   schannel_shutdown,                 /* shutdown */
   schannel_data_pending,             /* data_pending */
   schannel_random,                   /* random */
-  Curl_none_cert_status_request,     /* cert_status_request */
+  NULL,                              /* cert_status_request */
   schannel_connect,                  /* connect */
-  schannel_connect_nonblocking,      /* connect_nonblocking */
-  Curl_ssl_get_select_socks,         /* getsock */
+  Curl_ssl_adjust_pollset,           /* adjust_pollset */
   schannel_get_internals,            /* get_internals */
   schannel_close,                    /* close_one */
-  Curl_none_close_all,               /* close_all */
-  schannel_session_free,             /* session_free */
-  Curl_none_set_engine,              /* set_engine */
-  Curl_none_set_engine_default,      /* set_engine_default */
-  Curl_none_engines_list,            /* engines_list */
-  Curl_none_false_start,             /* false_start */
+  NULL,                              /* close_all */
+  NULL,                              /* set_engine */
+  NULL,                              /* set_engine_default */
+  NULL,                              /* engines_list */
   schannel_sha256sum,                /* sha256sum */
-  NULL,                              /* associate_connection */
-  NULL,                              /* disassociate_connection */
-  NULL,                              /* free_multi_ssl_backend_data */
   schannel_recv,                     /* recv decrypted data */
   schannel_send,                     /* send data to encrypt */
+  NULL,                              /* get_channel_binding */
 };
 
 #endif /* USE_SCHANNEL */
diff --git a/third-party/curl/lib/vtls/schannel.h b/third-party/curl/lib/vtls/schannel.h
index be23567302..fe49e9a9d0 100644
--- a/third-party/curl/lib/vtls/schannel.h
+++ b/third-party/curl/lib/vtls/schannel.h
@@ -28,56 +28,15 @@
 
 #ifdef USE_SCHANNEL
 
-#ifdef _MSC_VER
-#pragma warning(push)
-#pragma warning(disable: 4201)
-#endif
-#include <subauth.h>
-#ifdef _MSC_VER
-#pragma warning(pop)
-#endif
-/* Wincrypt must be included before anything that could include OpenSSL. */
-#if defined(USE_WIN32_CRYPTO)
-#include <wincrypt.h>
-/* Undefine wincrypt conflicting symbols for BoringSSL. */
-#undef X509_NAME
-#undef X509_EXTENSIONS
-#undef PKCS7_ISSUER_AND_SERIAL
-#undef PKCS7_SIGNER_INFO
-#undef OCSP_REQUEST
-#undef OCSP_RESPONSE
-#endif
-
-#include <schnlsp.h>
 #include <schannel.h>
-#include "curl_sspi.h"
 
+#include "curl_sspi.h"
 #include "cfilters.h"
 #include "urldata.h"
 
-/* <wincrypt.h> has been included via the above <schnlsp.h>.
- * Or in case of ldap.c, it was included via <winldap.h>.
- * And since <wincrypt.h> has this:
- *   #define X509_NAME  ((LPCSTR) 7)
- *
- * And in BoringSSL's <openssl/base.h> there is:
- *  typedef struct X509_name_st X509_NAME;
- *  etc.
- *
- * this will cause all kinds of C-preprocessing paste errors in
- * BoringSSL's <openssl/x509.h>: So just undefine those defines here
- * (and only here).
- */
-#if defined(HAVE_BORINGSSL) || defined(OPENSSL_IS_BORINGSSL)
-# undef X509_NAME
-# undef X509_CERT_PAIR
-# undef X509_EXTENSIONS
-#endif
-
 extern const struct Curl_ssl Curl_ssl_schannel;
 
-CURLcode Curl_verify_host(struct Curl_cfilter *cf,
-                          struct Curl_easy *data);
+CURLcode Curl_verify_host(struct Curl_cfilter *cf, struct Curl_easy *data);
 
 CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
                                  struct Curl_easy *data);
diff --git a/third-party/curl/lib/vtls/schannel_int.h b/third-party/curl/lib/vtls/schannel_int.h
index edb20bcd23..b65ff79926 100644
--- a/third-party/curl/lib/vtls/schannel_int.h
+++ b/third-party/curl/lib/vtls/schannel_int.h
@@ -28,167 +28,142 @@
 
 #ifdef USE_SCHANNEL
 
-#ifdef __MINGW32__
-#ifdef __MINGW64_VERSION_MAJOR
-#define HAS_MANUAL_VERIFY_API
-#endif
-#else
-#ifdef CERT_CHAIN_REVOCATION_CHECK_CHAIN
-#define HAS_MANUAL_VERIFY_API
-#endif
-#endif
-
-#if defined(CryptStringToBinary) && defined(CRYPT_STRING_HEX)   \
-  && !defined(DISABLE_SCHANNEL_CLIENT_CERT)
-#define HAS_CLIENT_CERT_PATH
-#endif
-
-#ifndef CRYPT_DECODE_NOCOPY_FLAG
-#define CRYPT_DECODE_NOCOPY_FLAG 0x1
-#endif
-
-#ifndef CRYPT_DECODE_ALLOC_FLAG
-#define CRYPT_DECODE_ALLOC_FLAG 0x8000
-#endif
-
-#ifndef CERT_ALT_NAME_DNS_NAME
-#define CERT_ALT_NAME_DNS_NAME 3
-#endif
-
-#ifndef CERT_ALT_NAME_IP_ADDRESS
-#define CERT_ALT_NAME_IP_ADDRESS 8
-#endif
-
-
-#if defined(__MINGW32__) && !defined(__MINGW64_VERSION_MAJOR)
-/* Original mingw is missing CERT structs or they're disabled.
-   Refer to w32api-5.0.2-mingw32-dev\include\wincrypt.h. */
-
-/* !checksrc! disable TYPEDEFSTRUCT 4 */
-typedef struct _CERT_OTHER_NAME {
-  LPSTR pszObjId;
-  CRYPT_OBJID_BLOB Value;
-} CERT_OTHER_NAME, *PCERT_OTHER_NAME;
-
-typedef struct _CERT_ALT_NAME_ENTRY {
-  DWORD dwAltNameChoice;
-  union {
-    PCERT_OTHER_NAME pOtherName;
-    LPWSTR pwszRfc822Name;
-    LPWSTR pwszDNSName;
-    CERT_NAME_BLOB DirectoryName;
-    LPWSTR pwszURL;
-    CRYPT_DATA_BLOB IPAddress;
-    LPSTR pszRegisteredID;
-  };
-} CERT_ALT_NAME_ENTRY, *PCERT_ALT_NAME_ENTRY;
-
-typedef struct _CERT_ALT_NAME_INFO {
-  DWORD cAltEntry;
-  PCERT_ALT_NAME_ENTRY rgAltEntry;
-} CERT_ALT_NAME_INFO, *PCERT_ALT_NAME_INFO;
-
-typedef struct _CRYPT_DECODE_PARA {
-  DWORD cbSize;
-  PFN_CRYPT_ALLOC pfnAlloc;
-  PFN_CRYPT_FREE pfnFree;
-} CRYPT_DECODE_PARA, *PCRYPT_DECODE_PARA;
+#include "vtls/vtls.h"
+#include "curl_sha256.h"
+
+#if defined(_MSC_VER) && (_MSC_VER < 1700)
+/* Workaround for warning:
+   'type cast' : conversion from 'int' to 'LPCSTR' of greater size */
+#undef CERT_STORE_PROV_MEMORY
+#undef CERT_STORE_PROV_SYSTEM_A
+#undef CERT_STORE_PROV_SYSTEM_W
+#define CERT_STORE_PROV_MEMORY    ((LPCSTR)(size_t)2)
+#define CERT_STORE_PROV_SYSTEM_A  ((LPCSTR)(size_t)9)
+#define CERT_STORE_PROV_SYSTEM_W  ((LPCSTR)(size_t)10)
 #endif
 
+/* Offered by mingw-w64 v8+, MS SDK 10.0.17763.0/VS2017 15.8+ */
 #ifndef SCH_CREDENTIALS_VERSION
-
 #define SCH_CREDENTIALS_VERSION  0x00000005
 
-typedef enum _eTlsAlgorithmUsage
-{
-    TlsParametersCngAlgUsageKeyExchange,
-    TlsParametersCngAlgUsageSignature,
-    TlsParametersCngAlgUsageCipher,
-    TlsParametersCngAlgUsageDigest,
-    TlsParametersCngAlgUsageCertSig
+typedef enum _eTlsAlgorithmUsage {
+  TlsParametersCngAlgUsageKeyExchange,
+  TlsParametersCngAlgUsageSignature,
+  TlsParametersCngAlgUsageCipher,
+  TlsParametersCngAlgUsageDigest,
+  TlsParametersCngAlgUsageCertSig
 } eTlsAlgorithmUsage;
 
-typedef struct _CRYPTO_SETTINGS
-{
-    eTlsAlgorithmUsage  eAlgorithmUsage;
-    UNICODE_STRING      strCngAlgId;
-    DWORD               cChainingModes;
-    PUNICODE_STRING     rgstrChainingModes;
-    DWORD               dwMinBitLength;
-    DWORD               dwMaxBitLength;
-} CRYPTO_SETTINGS, * PCRYPTO_SETTINGS;
+/* !checksrc! disable TYPEDEFSTRUCT 1 */
+typedef struct _CRYPTO_SETTINGS {
+  eTlsAlgorithmUsage eAlgorithmUsage;
+  UNICODE_STRING strCngAlgId;
+  DWORD cChainingModes;
+  PUNICODE_STRING rgstrChainingModes; /* spellchecker:disable-line */
+  DWORD dwMinBitLength;
+  DWORD dwMaxBitLength;
+} CRYPTO_SETTINGS, *PCRYPTO_SETTINGS;
 
-typedef struct _TLS_PARAMETERS
-{
-    DWORD               cAlpnIds;
-    PUNICODE_STRING     rgstrAlpnIds;
-    DWORD               grbitDisabledProtocols;
-    DWORD               cDisabledCrypto;
-    PCRYPTO_SETTINGS    pDisabledCrypto;
-    DWORD               dwFlags;
-} TLS_PARAMETERS, * PTLS_PARAMETERS;
+/* !checksrc! disable TYPEDEFSTRUCT 1 */
+typedef struct _TLS_PARAMETERS {
+  DWORD cAlpnIds;
+  PUNICODE_STRING rgstrAlpnIds; /* spellchecker:disable-line */
+  DWORD grbitDisabledProtocols;
+  DWORD cDisabledCrypto;
+  PCRYPTO_SETTINGS pDisabledCrypto;
+  DWORD dwFlags;
+} TLS_PARAMETERS, *PTLS_PARAMETERS;
 
-typedef struct _SCH_CREDENTIALS
-{
-    DWORD               dwVersion;
-    DWORD               dwCredFormat;
-    DWORD               cCreds;
-    PCCERT_CONTEXT* paCred;
-    HCERTSTORE          hRootStore;
+/* !checksrc! disable TYPEDEFSTRUCT 1 */
+typedef struct _SCH_CREDENTIALS {
+  DWORD dwVersion;
+  DWORD dwCredFormat;
+  DWORD cCreds;
+  PCCERT_CONTEXT *paCred;
+  HCERTSTORE hRootStore;
 
-    DWORD               cMappers;
-    struct _HMAPPER **aphMappers;
+  DWORD cMappers;
+  struct _HMAPPER **aphMappers;
 
-    DWORD               dwSessionLifespan;
-    DWORD               dwFlags;
-    DWORD               cTlsParameters;
-    PTLS_PARAMETERS     pTlsParameters;
-} SCH_CREDENTIALS, * PSCH_CREDENTIALS;
+  DWORD dwSessionLifespan;
+  DWORD dwFlags;
+  DWORD cTlsParameters;
+  PTLS_PARAMETERS pTlsParameters;
+} SCH_CREDENTIALS, *PSCH_CREDENTIALS;
 
-#define SCH_CRED_MAX_SUPPORTED_PARAMETERS 16
-#define SCH_CRED_MAX_SUPPORTED_ALPN_IDS 16
-#define SCH_CRED_MAX_SUPPORTED_CRYPTO_SETTINGS 16
-#define SCH_CRED_MAX_SUPPORTED_CHAINING_MODES 16
-
-#endif /* SCH_CREDENTIALS_VERSION */
+#endif /* !SCH_CREDENTIALS_VERSION */
 
 struct Curl_schannel_cred {
   CredHandle cred_handle;
-  TimeStamp time_stamp;
   TCHAR *sni_hostname;
-#ifdef HAS_CLIENT_CERT_PATH
   HCERTSTORE client_cert_store;
-#endif
   int refcount;
 };
 
 struct Curl_schannel_ctxt {
   CtxtHandle ctxt_handle;
-  TimeStamp time_stamp;
+};
+
+/* handle encoding/decoding buffers */
+struct sbuffer {
+  size_t length;
+  size_t offset;
+  unsigned char *buffer;
 };
 
 struct schannel_ssl_backend_data {
+  struct sbuffer encdata;
+  struct sbuffer decdata;
   struct Curl_schannel_cred *cred;
   struct Curl_schannel_ctxt *ctxt;
   SecPkgContext_StreamSizes stream_sizes;
-  size_t encdata_length, decdata_length;
-  size_t encdata_offset, decdata_offset;
-  unsigned char *encdata_buffer, *decdata_buffer;
-  /* encdata_is_incomplete: if encdata contains only a partial record that
-     can't be decrypted without another recv() (that is, status is
-     SEC_E_INCOMPLETE_MESSAGE) then set this true. after an recv() adds
-     more bytes into encdata then set this back to false. */
-  bool encdata_is_incomplete;
   unsigned long req_flags, ret_flags;
   CURLcode recv_unrecoverable_err; /* schannel_recv had an unrecoverable err */
-  bool recv_sspi_close_notify; /* true if connection closed by close_notify */
-  bool recv_connection_closed; /* true if connection closed, regardless how */
-  bool recv_renegotiating;     /* true if recv is doing renegotiation */
-  bool use_alpn; /* true if ALPN is used for this connection */
-#ifdef HAS_MANUAL_VERIFY_API
-  bool use_manual_cred_validation; /* true if manual cred validation is used */
-#endif
+  struct schannel_renegotiate_state {
+    bool started;
+    struct curltime start_time;
+    int io_need;
+  } renegotiate_state;
+  BIT(recv_sspi_close_notify); /* true if connection closed by close_notify */
+  BIT(recv_connection_closed); /* true if connection closed, regardless how */
+  BIT(recv_renegotiating);     /* true if recv is doing renegotiation */
+  BIT(use_alpn); /* true if ALPN is used for this connection */
+  BIT(use_manual_cred_validation); /* true if manual cred validation is used */
+  BIT(sent_shutdown);
+  /* encdata_is_incomplete: if encdata contains only a partial record that
+     cannot be decrypted without another recv() (that is, status is
+     SEC_E_INCOMPLETE_MESSAGE) then set this true. after recv() adds more
+     bytes into encdata then set this back to false. */
+  BIT(encdata_is_incomplete);
 };
 
+struct schannel_cert_share {
+  unsigned char CAinfo_blob_digest[CURL_SHA256_DIGEST_LENGTH];
+  size_t CAinfo_blob_size;           /* CA info blob size */
+  char *CAfile;                      /* CAfile path used to generate
+                                        certificate store */
+  HCERTSTORE cert_store;             /* cached certificate store or
+                                        NULL if none */
+  struct curltime time;              /* when the cached store was created */
+};
+
+/*
+* size of the structure: 20 bytes.
+*/
+struct num_ip_data {
+  DWORD size; /* 04 bytes */
+  union {
+    struct in_addr  ia;  /* 04 bytes */
+    struct in6_addr ia6; /* 16 bytes */
+  } bData;
+};
+
+HCERTSTORE Curl_schannel_get_cached_cert_store(struct Curl_cfilter *cf,
+                                               struct Curl_easy *data);
+
+bool Curl_schannel_set_cached_cert_store(struct Curl_cfilter *cf,
+                                         struct Curl_easy *data,
+                                         HCERTSTORE cert_store);
+
 #endif /* USE_SCHANNEL */
 #endif /* HEADER_CURL_SCHANNEL_INT_H */
diff --git a/third-party/curl/lib/vtls/schannel_verify.c b/third-party/curl/lib/vtls/schannel_verify.c
index a5d5c98bb7..e5fe2249a6 100644
--- a/third-party/curl/lib/vtls/schannel_verify.c
+++ b/third-party/curl/lib/vtls/schannel_verify.c
@@ -23,44 +23,60 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /*
  * Source file for Schannel-specific certificate verification. This code should
  * only be invoked by code in schannel.c.
  */
-
 #include "curl_setup.h"
 
 #ifdef USE_SCHANNEL
+
 #ifndef USE_WINDOWS_SSPI
-#  error "Can't compile SCHANNEL support without SSPI."
+#error "cannot compile Schannel support without SSPI."
 #endif
 
-#include "schannel.h"
-#include "schannel_int.h"
+#include "vtls/schannel.h"
+#include "vtls/schannel_int.h"
 
-#include "vtls.h"
-#include "vtls_int.h"
-#include "sendf.h"
+#include "vtls/hostcheck.h"
+#include "vtls/vtls.h"
+#include "vtls/vtls_int.h"
+#include "curl_trc.h"
 #include "strerror.h"
-#include "curl_multibyte.h"
-#include "curl_printf.h"
-#include "hostcheck.h"
-#include "version_win32.h"
-
-/* The last #include file should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curlx/fopen.h"
+#include "curlx/inet_pton.h"
+#include "curlx/multibyte.h"
+#include "curlx/version_win32.h"
+#include "curlx/winapi.h"
 
 #define BACKEND ((struct schannel_ssl_backend_data *)connssl->backend)
 
+#define MAX_CAFILE_SIZE (1024 * 1024) /* 1 MiB */
+#define BEGIN_CERT      "-----BEGIN CERTIFICATE-----"
+#define END_CERT        "\n-----END CERTIFICATE-----"
 
-#ifdef HAS_MANUAL_VERIFY_API
+struct cert_chain_engine_config_win8 {
+  DWORD cbSize;
+  HCERTSTORE hRestrictedRoot;
+  HCERTSTORE hRestrictedTrust;
+  HCERTSTORE hRestrictedOther;
+  DWORD cAdditionalStore;
+  HCERTSTORE *rghAdditionalStore;
+  DWORD dwFlags;
+  DWORD dwUrlRetrievalTimeout;
+  DWORD MaximumCachedCertificates;
+  DWORD CycleDetectionModulus;
+  HCERTSTORE hExclusiveRoot;
+  HCERTSTORE hExclusiveTrustedPeople;
+  DWORD dwExclusiveFlags;
+};
 
-#define MAX_CAFILE_SIZE 1048576 /* 1 MiB */
-#define BEGIN_CERT "-----BEGIN CERTIFICATE-----"
-#define END_CERT "\n-----END CERTIFICATE-----"
+/* Offered by mingw-w64 v4+, MS SDK 8.0/~VS2012+ */
+#ifndef CERT_CHAIN_EXCLUSIVE_ENABLE_CA_FLAG
+#define CERT_CHAIN_EXCLUSIVE_ENABLE_CA_FLAG 0x00000001
+#endif
 
+/* Legacy structure to supply size to Win7 clients */
 struct cert_chain_engine_config_win7 {
   DWORD cbSize;
   HCERTSTORE hRestrictedRoot;
@@ -76,14 +92,9 @@ struct cert_chain_engine_config_win7 {
   HCERTSTORE hExclusiveTrustedPeople;
 };
 
-static int is_cr_or_lf(char c)
-{
-  return c == '\r' || c == '\n';
-}
-
 /* Search the substring needle,needlelen into string haystack,haystacklen
- * Strings don't need to be terminated by a '\0'.
- * Similar of OSX/Linux memmem (not available on Visual Studio).
+ * Strings do not need to be terminated by a '\0'.
+ * Similar of macOS/Linux memmem (not available on Visual Studio).
  * Return position of beginning of first occurrence or NULL if not found
  */
 static const char *c_memmem(const void *haystack, size_t haystacklen,
@@ -96,7 +107,7 @@ static const char *c_memmem(const void *haystack, size_t haystacklen,
     return NULL;
   first = *(const char *)needle;
   for(p = (const char *)haystack; p <= (str_limit - needlelen); p++)
-    if(((*p) == first) && (memcmp(p, needle, needlelen) == 0))
+    if((*p == first) && !memcmp(p, needle, needlelen))
       return p;
 
   return NULL;
@@ -116,12 +127,13 @@ static CURLcode add_certs_data_to_store(HCERTSTORE trust_store,
   const char *current_ca_file_ptr = ca_buffer;
   const char *ca_buffer_limit = ca_buffer + ca_buffer_size;
 
-  while(more_certs && (current_ca_file_ptr<ca_buffer_limit)) {
+  while(more_certs && (current_ca_file_ptr < ca_buffer_limit)) {
     const char *begin_cert_ptr = c_memmem(current_ca_file_ptr,
-                                          ca_buffer_limit-current_ca_file_ptr,
+                                          ca_buffer_limit -
+                                          current_ca_file_ptr - 1,
                                           BEGIN_CERT,
                                           begin_cert_len);
-    if(!begin_cert_ptr || !is_cr_or_lf(begin_cert_ptr[begin_cert_len])) {
+    if(!begin_cert_ptr || !ISNEWLINE(begin_cert_ptr[begin_cert_len])) {
       more_certs = 0;
     }
     else {
@@ -138,68 +150,58 @@ static CURLcode add_certs_data_to_store(HCERTSTORE trust_store,
       }
       else {
         CERT_BLOB cert_blob;
-        CERT_CONTEXT *cert_context = NULL;
+        const CERT_CONTEXT *cert_context = NULL;
         BOOL add_cert_result = FALSE;
-        DWORD actual_content_type = 0;
-        DWORD cert_size = (DWORD)
-          ((end_cert_ptr + end_cert_len) - begin_cert_ptr);
+        DWORD cert_size =
+          (DWORD)((end_cert_ptr + end_cert_len) - begin_cert_ptr);
 
-        cert_blob.pbData = (BYTE *)begin_cert_ptr;
+        cert_blob.pbData = (BYTE *)CURL_UNCONST(begin_cert_ptr);
         cert_blob.cbData = cert_size;
+        /* Caution: CryptQueryObject() is deprecated */
         if(!CryptQueryObject(CERT_QUERY_OBJECT_BLOB,
                              &cert_blob,
                              CERT_QUERY_CONTENT_FLAG_CERT,
-                             CERT_QUERY_FORMAT_FLAG_ALL,
+                             CERT_QUERY_FORMAT_FLAG_BASE64_ENCODED,
                              0,
                              NULL,
-                             &actual_content_type,
+                             NULL,
                              NULL,
                              NULL,
                              NULL,
                              (const void **)&cert_context)) {
-          char buffer[STRERROR_LEN];
+          char buffer[WINAPI_ERROR_LEN];
           failf(data,
                 "schannel: failed to extract certificate from CA file "
                 "'%s': %s",
                 ca_file_text,
-                Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
+                curlx_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
           result = CURLE_SSL_CACERT_BADFILE;
           more_certs = 0;
         }
         else {
           current_ca_file_ptr = begin_cert_ptr + cert_size;
 
-          /* Sanity check that the cert_context object is the right type */
-          if(CERT_QUERY_CONTENT_CERT != actual_content_type) {
+          add_cert_result =
+            CertAddCertificateContextToStore(trust_store,
+                                             cert_context,
+                                             CERT_STORE_ADD_ALWAYS,
+                                             NULL);
+          if(!add_cert_result) {
+            char buffer[WINAPI_ERROR_LEN];
             failf(data,
-                  "schannel: unexpected content type '%d' when extracting "
-                  "certificate from CA file '%s'",
-                  actual_content_type, ca_file_text);
+                  "schannel: failed to add certificate from CA file '%s' "
+                  "to certificate store: %s",
+                  ca_file_text,
+                  curlx_winapi_strerror(GetLastError(), buffer,
+                                        sizeof(buffer)));
             result = CURLE_SSL_CACERT_BADFILE;
             more_certs = 0;
           }
           else {
-            add_cert_result =
-              CertAddCertificateContextToStore(trust_store,
-                                               cert_context,
-                                               CERT_STORE_ADD_ALWAYS,
-                                               NULL);
-            CertFreeCertificateContext(cert_context);
-            if(!add_cert_result) {
-              char buffer[STRERROR_LEN];
-              failf(data,
-                    "schannel: failed to add certificate from CA file '%s' "
-                    "to certificate store: %s",
-                    ca_file_text,
-                    Curl_winapi_strerror(GetLastError(), buffer,
-                                         sizeof(buffer)));
-              result = CURLE_SSL_CACERT_BADFILE;
-              more_certs = 0;
-            }
-            else {
-              num_certs++;
-            }
+            num_certs++;
           }
+
+          CertFreeCertificateContext(cert_context);
         }
       }
     }
@@ -207,13 +209,11 @@ static CURLcode add_certs_data_to_store(HCERTSTORE trust_store,
 
   if(result == CURLE_OK) {
     if(!num_certs) {
-      infof(data,
-            "schannel: did not add any certificates from CA file '%s'",
+      infof(data, "schannel: did not add any certificates from CA file '%s'",
             ca_file_text);
     }
     else {
-      infof(data,
-            "schannel: added %d certificate(s) from CA file '%s'",
+      infof(data, "schannel: added %d certificate(s) from CA file '%s'",
             num_certs, ca_file_text);
     }
   }
@@ -225,95 +225,77 @@ static CURLcode add_certs_file_to_store(HCERTSTORE trust_store,
                                         struct Curl_easy *data)
 {
   CURLcode result;
-  HANDLE ca_file_handle = INVALID_HANDLE_VALUE;
-  LARGE_INTEGER file_size;
+  FILE *ca_file_handle;
   char *ca_file_buffer = NULL;
-  TCHAR *ca_file_tstr = NULL;
-  size_t ca_file_bufsize = 0;
-  DWORD total_bytes_read = 0;
-
-  ca_file_tstr = curlx_convert_UTF8_to_tchar((char *)ca_file);
-  if(!ca_file_tstr) {
-    char buffer[STRERROR_LEN];
-    failf(data,
-          "schannel: invalid path name for CA file '%s': %s",
-          ca_file,
-          Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
-    result = CURLE_SSL_CACERT_BADFILE;
-    goto cleanup;
-  }
+  long ca_file_bufsize = 0;
+  long total_bytes_read = 0;
 
   /*
    * Read the CA file completely into memory before parsing it. This
-   * optimizes for the common case where the CA file will be relatively
+   * optimizes for the common case where the CA file is relatively
    * small ( < 1 MiB ).
    */
-  ca_file_handle = CreateFile(ca_file_tstr,
-                              GENERIC_READ,
-                              FILE_SHARE_READ,
-                              NULL,
-                              OPEN_EXISTING,
-                              FILE_ATTRIBUTE_NORMAL,
-                              NULL);
-  if(ca_file_handle == INVALID_HANDLE_VALUE) {
-    char buffer[STRERROR_LEN];
-    failf(data,
-          "schannel: failed to open CA file '%s': %s",
-          ca_file,
-          Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
+  ca_file_handle = curlx_fopen(ca_file, "rb");
+  if(!ca_file_handle) {
+    failf(data, "schannel: failed to open CA file '%s'", ca_file);
     result = CURLE_SSL_CACERT_BADFILE;
     goto cleanup;
   }
 
-  if(!GetFileSizeEx(ca_file_handle, &file_size)) {
-    char buffer[STRERROR_LEN];
-    failf(data,
-          "schannel: failed to determine size of CA file '%s': %s",
-          ca_file,
-          Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
+  if(curlx_fseek(ca_file_handle, 0, SEEK_END)) {
+    failf(data, "schannel: failed seeking to end of CA file '%s'", ca_file);
     result = CURLE_SSL_CACERT_BADFILE;
     goto cleanup;
   }
 
-  if(file_size.QuadPart > MAX_CAFILE_SIZE) {
-    failf(data,
-          "schannel: CA file exceeds max size of %u bytes",
+  ca_file_bufsize = ftell(ca_file_handle);
+
+  if(curlx_fseek(ca_file_handle, 0, SEEK_SET)) {
+    failf(data, "schannel: failed seeking to beginning of CA file '%s'",
+          ca_file);
+    result = CURLE_SSL_CACERT_BADFILE;
+    goto cleanup;
+  }
+
+  if(ca_file_bufsize < 0) {
+    failf(data, "schannel: failed to get length of CA file '%s'", ca_file);
+    result = CURLE_SSL_CACERT_BADFILE;
+    goto cleanup;
+  }
+
+  if(ca_file_bufsize > MAX_CAFILE_SIZE) {
+    failf(data, "schannel: CA file exceeds max size of %d bytes",
           MAX_CAFILE_SIZE);
     result = CURLE_SSL_CACERT_BADFILE;
     goto cleanup;
   }
 
-  ca_file_bufsize = (size_t)file_size.QuadPart;
-  ca_file_buffer = (char *)malloc(ca_file_bufsize + 1);
+  ca_file_buffer = curlx_malloc(ca_file_bufsize + 1);
   if(!ca_file_buffer) {
     result = CURLE_OUT_OF_MEMORY;
     goto cleanup;
   }
 
   while(total_bytes_read < ca_file_bufsize) {
-    DWORD bytes_to_read = (DWORD)(ca_file_bufsize - total_bytes_read);
-    DWORD bytes_read = 0;
+    size_t nread = fread(ca_file_buffer + total_bytes_read, 1,
+                         ca_file_bufsize - total_bytes_read, ca_file_handle);
 
-    if(!ReadFile(ca_file_handle, ca_file_buffer + total_bytes_read,
-                 bytes_to_read, &bytes_read, NULL)) {
-      char buffer[STRERROR_LEN];
-      failf(data,
-            "schannel: failed to read from CA file '%s': %s",
-            ca_file,
-            Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
+    if(ferror(ca_file_handle)) {
+      failf(data, "schannel: failed to read from CA file '%s'", ca_file);
       result = CURLE_SSL_CACERT_BADFILE;
       goto cleanup;
     }
-    if(bytes_read == 0) {
+
+    if(nread == 0) {
       /* Premature EOF -- adjust the bufsize to the new value */
       ca_file_bufsize = total_bytes_read;
     }
     else {
-      total_bytes_read += bytes_read;
+      total_bytes_read += (long)nread;
     }
   }
 
-  /* Null terminate the buffer */
+  /* null-terminate the buffer */
   ca_file_buffer[ca_file_bufsize] = '\0';
 
   result = add_certs_data_to_store(trust_store,
@@ -322,20 +304,17 @@ static CURLcode add_certs_file_to_store(HCERTSTORE trust_store,
                                    data);
 
 cleanup:
-  if(ca_file_handle != INVALID_HANDLE_VALUE) {
-    CloseHandle(ca_file_handle);
+  if(ca_file_handle) {
+    curlx_fclose(ca_file_handle);
   }
-  Curl_safefree(ca_file_buffer);
-  curlx_unicodefree(ca_file_tstr);
+  curlx_safefree(ca_file_buffer);
 
   return result;
 }
 
-#endif /* HAS_MANUAL_VERIFY_API */
-
 /*
  * Returns the number of characters necessary to populate all the host_names.
- * If host_names is not NULL, populate it with all the host names. Each string
+ * If host_names is not NULL, populate it with all the hostnames. Each string
  * in the host_names is null-terminated and the last string is double
  * null-terminated. If no DNS names are found, a single null-terminated empty
  * string is returned.
@@ -343,24 +322,22 @@ cleanup:
 static DWORD cert_get_name_string(struct Curl_easy *data,
                                   CERT_CONTEXT *cert_context,
                                   LPTSTR host_names,
-                                  DWORD length)
+                                  DWORD length,
+                                  PCERT_ALT_NAME_INFO alt_name_info,
+                                  BOOL Win8_compat)
 {
   DWORD actual_length = 0;
   BOOL compute_content = FALSE;
-  CERT_INFO *cert_info = NULL;
-  CERT_EXTENSION *extension = NULL;
-  CRYPT_DECODE_PARA decode_para = {0, 0, 0};
-  CERT_ALT_NAME_INFO *alt_name_info = NULL;
-  DWORD alt_name_info_size = 0;
-  BOOL ret_val = FALSE;
   LPTSTR current_pos = NULL;
   DWORD i;
 
-#ifdef CERT_NAME_SEARCH_ALL_NAMES_FLAG
   /* CERT_NAME_SEARCH_ALL_NAMES_FLAG is available from Windows 8 onwards. */
-  if(curlx_verify_windows_version(6, 2, 0, PLATFORM_WINNT,
-                                  VERSION_GREATER_THAN_EQUAL)) {
-    /* CertGetNameString will provide the 8-bit character string without
+  if(Win8_compat) {
+/* Offered by mingw-w64 v4+, MS SDK 8.0/~VS2012+ */
+#ifndef CERT_NAME_SEARCH_ALL_NAMES_FLAG
+#define CERT_NAME_SEARCH_ALL_NAMES_FLAG 0x2
+#endif
+    /* CertGetNameString provides the 8-bit character string without
      * any decoding */
     DWORD name_flags =
       CERT_NAME_DISABLE_IE4_UTF8_FLAG | CERT_NAME_SEARCH_ALL_NAMES_FLAG;
@@ -372,9 +349,11 @@ static DWORD cert_get_name_string(struct Curl_easy *data,
                                       length);
     return actual_length;
   }
-#endif
 
-  compute_content = host_names != NULL && length != 0;
+  if(!alt_name_info)
+    return 0;
+
+  compute_content = host_names && length != 0;
 
   /* Initialize default return values. */
   actual_length = 1;
@@ -382,43 +361,6 @@ static DWORD cert_get_name_string(struct Curl_easy *data,
     *host_names = '\0';
   }
 
-  if(!cert_context) {
-    failf(data, "schannel: Null certificate context.");
-    return actual_length;
-  }
-
-  cert_info = cert_context->pCertInfo;
-  if(!cert_info) {
-    failf(data, "schannel: Null certificate info.");
-    return actual_length;
-  }
-
-  extension = CertFindExtension(szOID_SUBJECT_ALT_NAME2,
-                                cert_info->cExtension,
-                                cert_info->rgExtension);
-  if(!extension) {
-    failf(data, "schannel: CertFindExtension() returned no extension.");
-    return actual_length;
-  }
-
-  decode_para.cbSize = sizeof(CRYPT_DECODE_PARA);
-
-  ret_val =
-    CryptDecodeObjectEx(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
-                        szOID_SUBJECT_ALT_NAME2,
-                        extension->Value.pbData,
-                        extension->Value.cbData,
-                        CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG,
-                        &decode_para,
-                        &alt_name_info,
-                        &alt_name_info_size);
-  if(!ret_val) {
-    failf(data,
-          "schannel: CryptDecodeObjectEx() returned no alternate name "
-          "information.");
-    return actual_length;
-  }
-
   current_pos = host_names;
 
   /* Iterate over the alternate names and populate host_names. */
@@ -441,14 +383,14 @@ static DWORD cert_get_name_string(struct Curl_easy *data,
     }
     /* Sanity check to prevent buffer overrun. */
     if((actual_length + current_length) > length) {
-      failf(data, "schannel: Not enough memory to list all host names.");
+      failf(data, "schannel: Not enough memory to list all hostnames.");
       break;
     }
     dns_w = entry->pwszDNSName;
-    /* pwszDNSName is in ia5 string format and hence doesn't contain any
-     * non-ascii characters. */
+    /* pwszDNSName is in ia5 string format and hence does not contain any
+     * non-ASCII characters. */
     while(*dns_w != '\0') {
-      *current_pos++ = (char)(*dns_w++);
+      *current_pos++ = (TCHAR)(*dns_w++);
     }
     *current_pos++ = '\0';
     actual_length += (DWORD)current_length;
@@ -460,124 +402,223 @@ static DWORD cert_get_name_string(struct Curl_easy *data,
   return actual_length;
 }
 
-/* Verify the server's hostname */
-CURLcode Curl_verify_host(struct Curl_cfilter *cf,
-                          struct Curl_easy *data)
+/*
+ * Returns TRUE if the hostname is a numeric IPv4/IPv6 Address,
+ * and populates the buffer with IPv4/IPv6 info.
+ */
+
+static bool get_num_host_info(struct num_ip_data *ip_blob, LPCSTR hostname)
+{
+  struct in_addr ia;
+  int res = curlx_inet_pton(AF_INET, hostname, &ia);
+  if(res) {
+    ip_blob->size = sizeof(struct in_addr);
+    memcpy(&ip_blob->bData.ia, &ia, sizeof(struct in_addr));
+    return TRUE;
+  }
+  else {
+    struct in6_addr ia6;
+    res = curlx_inet_pton(AF_INET6, hostname, &ia6);
+    if(res) {
+      ip_blob->size = sizeof(struct in6_addr);
+      memcpy(&ip_blob->bData.ia6, &ia6, sizeof(struct in6_addr));
+      return TRUE;
+    }
+  }
+  return FALSE;
+}
+
+static bool get_alt_name_info(struct Curl_easy *data,
+                              PCCERT_CONTEXT ctx,
+                              PCERT_ALT_NAME_INFO *alt_name_info,
+                              LPDWORD alt_name_info_size)
+{
+  PCERT_INFO cert_info = NULL;
+  PCERT_EXTENSION extension = NULL;
+  CRYPT_DECODE_PARA decode_para = { sizeof(CRYPT_DECODE_PARA), NULL, NULL };
+
+  if(!ctx) {
+    failf(data, "schannel: Null certificate context.");
+    return FALSE;
+  }
+
+  cert_info = ctx->pCertInfo;
+  if(!cert_info) {
+    failf(data, "schannel: Null certificate info.");
+    return FALSE;
+  }
+
+  extension = CertFindExtension(szOID_SUBJECT_ALT_NAME2,
+                                cert_info->cExtension,
+                                cert_info->rgExtension);
+  if(!extension) {
+    failf(data, "schannel: CertFindExtension() returned no extension.");
+    return FALSE;
+  }
+
+  if(!CryptDecodeObjectEx(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
+                          szOID_SUBJECT_ALT_NAME2,
+                          extension->Value.pbData,
+                          extension->Value.cbData,
+                          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG,
+                          &decode_para,
+                          alt_name_info,
+                          alt_name_info_size)) {
+    failf(data, "schannel: CryptDecodeObjectEx() returned no alternate name "
+          "information.");
+    return FALSE;
+  }
+  return TRUE;
+}
+
+/* Verify the server's hostname */
+CURLcode Curl_verify_host(struct Curl_cfilter *cf, struct Curl_easy *data)
 {
-  struct ssl_connect_data *connssl = cf->ctx;
-  SECURITY_STATUS sspi_status;
   CURLcode result = CURLE_PEER_FAILED_VERIFICATION;
+  struct ssl_connect_data *connssl = cf->ctx;
   CERT_CONTEXT *pCertContextServer = NULL;
+  SECURITY_STATUS sspi_status;
   TCHAR *cert_hostname_buff = NULL;
   size_t cert_hostname_buff_index = 0;
-  const char *conn_hostname = connssl->hostname;
+  const char *conn_hostname = connssl->peer.origin->hostname;
   size_t hostlen = strlen(conn_hostname);
   DWORD len = 0;
   DWORD actual_len = 0;
+  PCERT_ALT_NAME_INFO alt_name_info = NULL;
+  DWORD alt_name_info_size = 0;
+  struct num_ip_data ip_blob = { 0 };
+  bool Win8_compat;
+  struct num_ip_data *p = &ip_blob;
+  DWORD i;
 
   sspi_status =
-    s_pSecFn->QueryContextAttributes(&BACKEND->ctxt->ctxt_handle,
-                                     SECPKG_ATTR_REMOTE_CERT_CONTEXT,
-                                     &pCertContextServer);
+    Curl_pSecFn->QueryContextAttributes(&BACKEND->ctxt->ctxt_handle,
+                                        SECPKG_ATTR_REMOTE_CERT_CONTEXT,
+                                        &pCertContextServer);
 
   if((sspi_status != SEC_E_OK) || !pCertContextServer) {
-    char buffer[STRERROR_LEN];
+    char buffer[WINAPI_ERROR_LEN];
     failf(data, "schannel: Failed to read remote certificate context: %s",
           Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
-    result = CURLE_PEER_FAILED_VERIFICATION;
     goto cleanup;
   }
 
-  /* Determine the size of the string needed for the cert hostname */
-  len = cert_get_name_string(data, pCertContextServer, NULL, 0);
-  if(len == 0) {
-    failf(data,
-          "schannel: CertGetNameString() returned no "
-          "certificate name information");
-    result = CURLE_PEER_FAILED_VERIFICATION;
-    goto cleanup;
-  }
-
-  /* CertGetNameString guarantees that the returned name will not contain
-   * embedded null bytes. This appears to be undocumented behavior.
-   */
-  cert_hostname_buff = (LPTSTR)malloc(len * sizeof(TCHAR));
-  if(!cert_hostname_buff) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto cleanup;
-  }
-  actual_len = cert_get_name_string(
-    data, pCertContextServer, (LPTSTR)cert_hostname_buff, len);
-
-  /* Sanity check */
-  if(actual_len != len) {
-    failf(data,
-          "schannel: CertGetNameString() returned certificate "
-          "name information of unexpected size");
-    result = CURLE_PEER_FAILED_VERIFICATION;
-    goto cleanup;
-  }
-
-  /* cert_hostname_buff contains all DNS names, where each name is
-   * null-terminated and the last DNS name is double null-terminated. Due to
-   * this encoding, use the length of the buffer to iterate over all names.
-   */
-  result = CURLE_PEER_FAILED_VERIFICATION;
-  while(cert_hostname_buff_index < len &&
-        cert_hostname_buff[cert_hostname_buff_index] != TEXT('\0') &&
-        result == CURLE_PEER_FAILED_VERIFICATION) {
-
-    char *cert_hostname;
-
-    /* Comparing the cert name and the connection hostname encoded as UTF-8
-     * is acceptable since both values are assumed to use ASCII
-     * (or some equivalent) encoding
-     */
-    cert_hostname = curlx_convert_tchar_to_UTF8(
-      &cert_hostname_buff[cert_hostname_buff_index]);
-    if(!cert_hostname) {
-      result = CURLE_OUT_OF_MEMORY;
+  Win8_compat = curlx_verify_windows_version(6, 2, 0, PLATFORM_WINNT,
+                                             VERSION_GREATER_THAN_EQUAL);
+  if(get_num_host_info(p, conn_hostname) || !Win8_compat) {
+    if(!get_alt_name_info(data, pCertContextServer,
+                          &alt_name_info, &alt_name_info_size)) {
+      goto cleanup;
     }
-    else {
-      if(Curl_cert_hostcheck(cert_hostname, strlen(cert_hostname),
-                             conn_hostname, hostlen)) {
-        infof(data,
-              "schannel: connection hostname (%s) validated "
-              "against certificate name (%s)",
-              conn_hostname, cert_hostname);
-        result = CURLE_OK;
+  }
+
+  if(p->size && alt_name_info) {
+    for(i = 0; i < alt_name_info->cAltEntry; ++i) {
+      PCERT_ALT_NAME_ENTRY entry = &alt_name_info->rgAltEntry[i];
+      if(entry->dwAltNameChoice == CERT_ALT_NAME_IP_ADDRESS) {
+        if(entry->IPAddress.cbData == p->size) {
+          if(!memcmp(entry->IPAddress.pbData, &p->bData,
+                     entry->IPAddress.cbData)) {
+            result = CURLE_OK;
+            infof(data,
+             "schannel: connection hostname (%s) matched cert's IP address!",
+             conn_hostname);
+            break;
+          }
+        }
+      }
+    }
+  }
+  else {
+    /* Determine the size of the string needed for the cert hostname */
+    len = cert_get_name_string(data, pCertContextServer,
+                               NULL, 0, alt_name_info, Win8_compat);
+    if(len == 0) {
+      failf(data,
+            "schannel: CertGetNameString() returned no "
+            "certificate name information");
+      goto cleanup;
+    }
+
+    /* CertGetNameString guarantees that the returned name does not contain
+     * embedded null bytes. This appears to be undocumented behavior.
+     */
+    cert_hostname_buff = curlx_malloc(len * sizeof(TCHAR));
+    if(!cert_hostname_buff) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto cleanup;
+    }
+    actual_len = cert_get_name_string(data, pCertContextServer,
+                                      (LPTSTR)cert_hostname_buff, len,
+                                      alt_name_info, Win8_compat);
+
+    /* Sanity check */
+    if(actual_len != len) {
+      failf(data,
+            "schannel: CertGetNameString() returned certificate "
+            "name information of unexpected size");
+      goto cleanup;
+    }
+
+    /* cert_hostname_buff contains all DNS names, where each name is
+     * null-terminated and the last DNS name is double null-terminated. Due to
+     * this encoding, use the length of the buffer to iterate over all names.
+     */
+    while(cert_hostname_buff_index < len &&
+          cert_hostname_buff[cert_hostname_buff_index] != TEXT('\0') &&
+          result == CURLE_PEER_FAILED_VERIFICATION) {
+      char *cert_hostname;
+
+      /* Comparing the cert name and the connection hostname encoded as UTF-8
+       * is acceptable since both values are assumed to use ASCII
+       * (or some equivalent) encoding
+       */
+      cert_hostname = curlx_convert_tchar_to_UTF8(
+        &cert_hostname_buff[cert_hostname_buff_index]);
+      if(!cert_hostname) {
+        result = CURLE_OUT_OF_MEMORY;
       }
       else {
-        size_t cert_hostname_len;
+        if(Curl_cert_hostcheck(cert_hostname, strlen(cert_hostname),
+                               conn_hostname, hostlen)) {
+          infof(data, "schannel: connection hostname (%s) validated "
+                "against certificate name (%s)",
+                conn_hostname, cert_hostname);
+          result = CURLE_OK;
+        }
+        else {
+          size_t cert_hostname_len;
 
-        infof(data,
-              "schannel: connection hostname (%s) did not match "
-              "against certificate name (%s)",
-              conn_hostname, cert_hostname);
+          infof(data,
+                "schannel: connection hostname (%s) did not match "
+                "against certificate name (%s)",
+                conn_hostname, cert_hostname);
 
-        cert_hostname_len =
-          _tcslen(&cert_hostname_buff[cert_hostname_buff_index]);
+          cert_hostname_len =
+            _tcslen(&cert_hostname_buff[cert_hostname_buff_index]);
 
-        /* Move on to next cert name */
-        cert_hostname_buff_index += cert_hostname_len + 1;
+          /* Move on to next cert name */
+          cert_hostname_buff_index += cert_hostname_len + 1;
 
-        result = CURLE_PEER_FAILED_VERIFICATION;
+          result = CURLE_PEER_FAILED_VERIFICATION;
+        }
+        curlx_free(cert_hostname);
       }
-      curlx_unicodefree(cert_hostname);
     }
-  }
 
-  if(result == CURLE_PEER_FAILED_VERIFICATION) {
-    failf(data,
-          "schannel: CertGetNameString() failed to match "
-          "connection hostname (%s) against server certificate names",
-          conn_hostname);
+    if(result == CURLE_PEER_FAILED_VERIFICATION) {
+      failf(data,
+            "schannel: CertGetNameString() failed to match "
+            "connection hostname (%s) against server certificate names",
+            conn_hostname);
+    }
+    else if(result != CURLE_OK)
+      failf(data, "schannel: server certificate name verification failed");
   }
-  else if(result != CURLE_OK)
-    failf(data, "schannel: server certificate name verification failed");
 
 cleanup:
-  Curl_safefree(cert_hostname_buff);
+  LocalFree(alt_name_info);
+  curlx_safefree(cert_hostname_buff);
 
   if(pCertContextServer)
     CertFreeCertificateContext(pCertContextServer);
@@ -585,8 +626,6 @@ cleanup:
   return result;
 }
 
-
-#ifdef HAS_MANUAL_VERIFY_API
 /* Verify the server's certificate and hostname */
 CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
                                  struct Curl_easy *data)
@@ -600,24 +639,25 @@ CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
   const CERT_CHAIN_CONTEXT *pChainContext = NULL;
   HCERTCHAINENGINE cert_chain_engine = NULL;
   HCERTSTORE trust_store = NULL;
+  HCERTSTORE own_trust_store = NULL;
 
   DEBUGASSERT(BACKEND);
 
   sspi_status =
-    s_pSecFn->QueryContextAttributes(&BACKEND->ctxt->ctxt_handle,
-                                     SECPKG_ATTR_REMOTE_CERT_CONTEXT,
-                                     &pCertContextServer);
+    Curl_pSecFn->QueryContextAttributes(&BACKEND->ctxt->ctxt_handle,
+                                        SECPKG_ATTR_REMOTE_CERT_CONTEXT,
+                                        &pCertContextServer);
 
   if((sspi_status != SEC_E_OK) || !pCertContextServer) {
-    char buffer[STRERROR_LEN];
+    char buffer[WINAPI_ERROR_LEN];
     failf(data, "schannel: Failed to read remote certificate context: %s",
           Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
     result = CURLE_PEER_FAILED_VERIFICATION;
   }
 
   if(result == CURLE_OK &&
-      (conn_config->CAfile || conn_config->ca_info_blob) &&
-      BACKEND->use_manual_cred_validation) {
+     (conn_config->CAfile || conn_config->ca_info_blob) &&
+     BACKEND->use_manual_cred_validation) {
     /*
      * Create a chain engine that uses the certificates in the CA file as
      * trusted certificates. This is only supported on Windows 7+.
@@ -630,44 +670,68 @@ CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
       result = CURLE_SSL_CACERT_BADFILE;
     }
     else {
-      /* Open the certificate store */
-      trust_store = CertOpenStore(CERT_STORE_PROV_MEMORY,
-                                  0,
-                                  (HCRYPTPROV)NULL,
-                                  CERT_STORE_CREATE_NEW_FLAG,
-                                  NULL);
-      if(!trust_store) {
-        char buffer[STRERROR_LEN];
-        failf(data, "schannel: failed to create certificate store: %s",
-              Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
-        result = CURLE_SSL_CACERT_BADFILE;
+      /* try cache */
+      trust_store = Curl_schannel_get_cached_cert_store(cf, data);
+
+      if(trust_store) {
+        infof(data, "schannel: reusing certificate store from cache");
       }
       else {
-        const struct curl_blob *ca_info_blob = conn_config->ca_info_blob;
-        if(ca_info_blob) {
-          result = add_certs_data_to_store(trust_store,
-                                           (const char *)ca_info_blob->data,
-                                           ca_info_blob->len,
-                                           "(memory blob)",
-                                           data);
+        /* Open the certificate store */
+        trust_store = CertOpenStore(CERT_STORE_PROV_MEMORY,
+                                    0,
+                                    (HCRYPTPROV)NULL,
+                                    CERT_STORE_CREATE_NEW_FLAG,
+                                    NULL);
+        if(!trust_store) {
+          char buffer[WINAPI_ERROR_LEN];
+          failf(data, "schannel: failed to create certificate store: %s",
+                curlx_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
+          result = CURLE_SSL_CACERT_BADFILE;
         }
         else {
-          result = add_certs_file_to_store(trust_store,
-                                           conn_config->CAfile,
-                                           data);
+          const struct curl_blob *ca_info_blob = conn_config->ca_info_blob;
+          own_trust_store = trust_store;
+
+          if(ca_info_blob) {
+            result = add_certs_data_to_store(trust_store,
+                                             (const char *)ca_info_blob->data,
+                                             ca_info_blob->len,
+                                             "(memory blob)",
+                                             data);
+          }
+          else {
+            result = add_certs_file_to_store(trust_store,
+                                             conn_config->CAfile,
+                                             data);
+          }
+          if(result == CURLE_OK) {
+            if(Curl_schannel_set_cached_cert_store(cf, data, trust_store)) {
+              own_trust_store = NULL;
+            }
+          }
         }
       }
     }
 
     if(result == CURLE_OK) {
-      struct cert_chain_engine_config_win7 engine_config;
+      struct cert_chain_engine_config_win8 engine_config;
       BOOL create_engine_result;
 
       memset(&engine_config, 0, sizeof(engine_config));
-      engine_config.cbSize = sizeof(engine_config);
       engine_config.hExclusiveRoot = trust_store;
 
-      /* CertCreateCertificateChainEngine will check the expected size of the
+      /* Win8/Server2012 allows us to match partial chains */
+      if(curlx_verify_windows_version(6, 2, 0, PLATFORM_WINNT,
+                                      VERSION_GREATER_THAN_EQUAL) &&
+         !ssl_config->no_partialchain) {
+        engine_config.cbSize = sizeof(engine_config);
+        engine_config.dwExclusiveFlags = CERT_CHAIN_EXCLUSIVE_ENABLE_CA_FLAG;
+      }
+      else
+        engine_config.cbSize = sizeof(struct cert_chain_engine_config_win7);
+
+      /* CertCreateCertificateChainEngine checks the expected size of the
        * CERT_CHAIN_ENGINE_CONFIG structure and fail if the specified size
        * does not match the expected size. When this occurs, it indicates that
        * CAINFO is not supported on the version of Windows in use.
@@ -676,10 +740,10 @@ CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
         CertCreateCertificateChainEngine(
           (CERT_CHAIN_ENGINE_CONFIG *)&engine_config, &cert_chain_engine);
       if(!create_engine_result) {
-        char buffer[STRERROR_LEN];
+        char buffer[WINAPI_ERROR_LEN];
         failf(data,
               "schannel: failed to create certificate chain engine: %s",
-              Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
+              curlx_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
         result = CURLE_SSL_CACERT_BADFILE;
       }
     }
@@ -687,9 +751,13 @@ CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
 
   if(result == CURLE_OK) {
     CERT_CHAIN_PARA ChainPara;
+    LPSTR serverAuthOID = CURL_UNCONST(szOID_PKIX_KP_SERVER_AUTH);
 
     memset(&ChainPara, 0, sizeof(ChainPara));
     ChainPara.cbSize = sizeof(ChainPara);
+    ChainPara.RequestedUsage.dwType = USAGE_MATCH_TYPE_AND;
+    ChainPara.RequestedUsage.Usage.cUsageIdentifier = 1;
+    ChainPara.RequestedUsage.Usage.rgpszUsageIdentifier = &serverAuthOID;
 
     if(!CertGetCertificateChain(cert_chain_engine,
                                 pCertContextServer,
@@ -700,9 +768,9 @@ CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
                                  CERT_CHAIN_REVOCATION_CHECK_CHAIN),
                                 NULL,
                                 &pChainContext)) {
-      char buffer[STRERROR_LEN];
-      failf(data, "schannel: CertGetCertificateChain failed: %s",
-            Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
+      char buffer[WINAPI_ERROR_LEN];
+      failf(data, "schannel: failed to get the certificate chain: %s",
+            curlx_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
       pChainContext = NULL;
       result = CURLE_PEER_FAILED_VERIFICATION;
     }
@@ -712,33 +780,30 @@ CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
       DWORD dwTrustErrorMask = ~(DWORD)(CERT_TRUST_IS_NOT_TIME_NESTED);
       dwTrustErrorMask &= pSimpleChain->TrustStatus.dwErrorStatus;
 
-      if(data->set.ssl.revoke_best_effort) {
+      if(ssl_config->revoke_best_effort) {
         /* Ignore errors when root certificates are missing the revocation
          * list URL, or when the list could not be downloaded because the
          * server is currently unreachable. */
         dwTrustErrorMask &= ~(DWORD)(CERT_TRUST_REVOCATION_STATUS_UNKNOWN |
-          CERT_TRUST_IS_OFFLINE_REVOCATION);
+                                     CERT_TRUST_IS_OFFLINE_REVOCATION);
       }
 
       if(dwTrustErrorMask) {
         if(dwTrustErrorMask & CERT_TRUST_IS_REVOKED)
-          failf(data, "schannel: CertGetCertificateChain trust error"
-                " CERT_TRUST_IS_REVOKED");
+          failf(data, "schannel: trust for this certificate or one of "
+                "the certificates in the certificate chain has been revoked");
         else if(dwTrustErrorMask & CERT_TRUST_IS_PARTIAL_CHAIN)
-          failf(data, "schannel: CertGetCertificateChain trust error"
-                " CERT_TRUST_IS_PARTIAL_CHAIN");
+          failf(data, "schannel: the certificate chain is incomplete");
         else if(dwTrustErrorMask & CERT_TRUST_IS_UNTRUSTED_ROOT)
-          failf(data, "schannel: CertGetCertificateChain trust error"
-                " CERT_TRUST_IS_UNTRUSTED_ROOT");
+          failf(data, "schannel: the certificate or certificate chain is "
+                "based on an untrusted root");
         else if(dwTrustErrorMask & CERT_TRUST_IS_NOT_TIME_VALID)
-          failf(data, "schannel: CertGetCertificateChain trust error"
-                " CERT_TRUST_IS_NOT_TIME_VALID");
+          failf(data, "schannel: this certificate or one of the certificates "
+                "in the certificate chain is not time valid");
         else if(dwTrustErrorMask & CERT_TRUST_REVOCATION_STATUS_UNKNOWN)
-          failf(data, "schannel: CertGetCertificateChain trust error"
-                " CERT_TRUST_REVOCATION_STATUS_UNKNOWN");
+          failf(data, "schannel: the revocation status is unknown");
         else
-          failf(data, "schannel: CertGetCertificateChain error mask: 0x%08x",
-                dwTrustErrorMask);
+          failf(data, "schannel: error 0x%08lx", dwTrustErrorMask);
         result = CURLE_PEER_FAILED_VERIFICATION;
       }
     }
@@ -754,8 +819,8 @@ CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
     CertFreeCertificateChainEngine(cert_chain_engine);
   }
 
-  if(trust_store) {
-    CertCloseStore(trust_store, 0);
+  if(own_trust_store) {
+    CertCloseStore(own_trust_store, 0);
   }
 
   if(pChainContext)
@@ -767,5 +832,4 @@ CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
   return result;
 }
 
-#endif /* HAS_MANUAL_VERIFY_API */
 #endif /* USE_SCHANNEL */
diff --git a/third-party/curl/lib/vtls/sectransp.c b/third-party/curl/lib/vtls/sectransp.c
deleted file mode 100644
index e6a114ad5f..0000000000
--- a/third-party/curl/lib/vtls/sectransp.c
+++ /dev/null
@@ -1,3505 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- * Copyright (C) Nick Zitzmann, <nickzman@gmail.com>.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-/*
- * Source file for all iOS and macOS SecureTransport-specific code for the
- * TLS/SSL layer. No code but vtls.c should ever call or use these functions.
- */
-
-#include "curl_setup.h"
-
-#include "urldata.h" /* for the Curl_easy definition */
-#include "curl_base64.h"
-#include "strtok.h"
-#include "multiif.h"
-#include "strcase.h"
-#include "x509asn1.h"
-#include "strerror.h"
-
-#ifdef USE_SECTRANSP
-
-#ifdef __clang__
-#pragma clang diagnostic push
-#pragma clang diagnostic ignored "-Wtautological-pointer-compare"
-#endif /* __clang__ */
-
-#ifdef __GNUC__
-#pragma GCC diagnostic ignored "-Waddress"
-#pragma GCC diagnostic ignored "-Wundef"
-#endif
-
-#include <limits.h>
-
-#include <Security/Security.h>
-/* For some reason, when building for iOS, the omnibus header above does
- * not include SecureTransport.h as of iOS SDK 5.1. */
-#include <Security/SecureTransport.h>
-#include <CoreFoundation/CoreFoundation.h>
-#include <CommonCrypto/CommonDigest.h>
-
-/* The Security framework has changed greatly between iOS and different macOS
-   versions, and we will try to support as many of them as we can (back to
-   Leopard and iOS 5) by using macros and weak-linking.
-
-   In general, you want to build this using the most recent OS SDK, since some
-   features require curl to be built against the latest SDK. TLS 1.1 and 1.2
-   support, for instance, require the macOS 10.8 SDK or later. TLS 1.3
-   requires the macOS 10.13 or iOS 11 SDK or later. */
-#if (TARGET_OS_MAC && !(TARGET_OS_EMBEDDED || TARGET_OS_IPHONE))
-
-#if MAC_OS_X_VERSION_MAX_ALLOWED < 1050
-#error "The Secure Transport back-end requires Leopard or later."
-#endif /* MAC_OS_X_VERSION_MAX_ALLOWED < 1050 */
-
-#define CURL_BUILD_IOS 0
-#define CURL_BUILD_IOS_7 0
-#define CURL_BUILD_IOS_9 0
-#define CURL_BUILD_IOS_11 0
-#define CURL_BUILD_IOS_13 0
-#define CURL_BUILD_MAC 1
-/* This is the maximum API level we are allowed to use when building: */
-#define CURL_BUILD_MAC_10_5 MAC_OS_X_VERSION_MAX_ALLOWED >= 1050
-#define CURL_BUILD_MAC_10_6 MAC_OS_X_VERSION_MAX_ALLOWED >= 1060
-#define CURL_BUILD_MAC_10_7 MAC_OS_X_VERSION_MAX_ALLOWED >= 1070
-#define CURL_BUILD_MAC_10_8 MAC_OS_X_VERSION_MAX_ALLOWED >= 1080
-#define CURL_BUILD_MAC_10_9 MAC_OS_X_VERSION_MAX_ALLOWED >= 1090
-#define CURL_BUILD_MAC_10_11 MAC_OS_X_VERSION_MAX_ALLOWED >= 101100
-#define CURL_BUILD_MAC_10_13 MAC_OS_X_VERSION_MAX_ALLOWED >= 101300
-#define CURL_BUILD_MAC_10_15 MAC_OS_X_VERSION_MAX_ALLOWED >= 101500
-/* These macros mean "the following code is present to allow runtime backward
-   compatibility with at least this cat or earlier":
-   (You set this at build-time using the compiler command line option
-   "-mmacosx-version-min.") */
-#define CURL_SUPPORT_MAC_10_5 MAC_OS_X_VERSION_MIN_REQUIRED <= 1050
-#define CURL_SUPPORT_MAC_10_6 MAC_OS_X_VERSION_MIN_REQUIRED <= 1060
-#define CURL_SUPPORT_MAC_10_7 MAC_OS_X_VERSION_MIN_REQUIRED <= 1070
-#define CURL_SUPPORT_MAC_10_8 MAC_OS_X_VERSION_MIN_REQUIRED <= 1080
-#define CURL_SUPPORT_MAC_10_9 MAC_OS_X_VERSION_MIN_REQUIRED <= 1090
-
-#elif TARGET_OS_EMBEDDED || TARGET_OS_IPHONE
-#define CURL_BUILD_IOS 1
-#define CURL_BUILD_IOS_7 __IPHONE_OS_VERSION_MAX_ALLOWED >= 70000
-#define CURL_BUILD_IOS_9 __IPHONE_OS_VERSION_MAX_ALLOWED >= 90000
-#define CURL_BUILD_IOS_11 __IPHONE_OS_VERSION_MAX_ALLOWED >= 110000
-#define CURL_BUILD_IOS_13 __IPHONE_OS_VERSION_MAX_ALLOWED >= 130000
-#define CURL_BUILD_MAC 0
-#define CURL_BUILD_MAC_10_5 0
-#define CURL_BUILD_MAC_10_6 0
-#define CURL_BUILD_MAC_10_7 0
-#define CURL_BUILD_MAC_10_8 0
-#define CURL_BUILD_MAC_10_9 0
-#define CURL_BUILD_MAC_10_11 0
-#define CURL_BUILD_MAC_10_13 0
-#define CURL_BUILD_MAC_10_15 0
-#define CURL_SUPPORT_MAC_10_5 0
-#define CURL_SUPPORT_MAC_10_6 0
-#define CURL_SUPPORT_MAC_10_7 0
-#define CURL_SUPPORT_MAC_10_8 0
-#define CURL_SUPPORT_MAC_10_9 0
-
-#else
-#error "The Secure Transport back-end requires iOS or macOS."
-#endif /* (TARGET_OS_MAC && !(TARGET_OS_EMBEDDED || TARGET_OS_IPHONE)) */
-
-#if CURL_BUILD_MAC
-#include <sys/sysctl.h>
-#endif /* CURL_BUILD_MAC */
-
-#include "sendf.h"
-#include "inet_pton.h"
-#include "connect.h"
-#include "select.h"
-#include "vtls.h"
-#include "vtls_int.h"
-#include "sectransp.h"
-#include "curl_printf.h"
-#include "strdup.h"
-
-#include "curl_memory.h"
-/* The last #include file should be: */
-#include "memdebug.h"
-
-
-/* From MacTypes.h (which we can't include because it isn't present in iOS: */
-#define ioErr -36
-#define paramErr -50
-
-struct st_ssl_backend_data {
-  SSLContextRef ssl_ctx;
-  bool ssl_direction; /* true if writing, false if reading */
-  size_t ssl_write_buffered_length;
-};
-
-struct st_cipher {
-  const char *name; /* Cipher suite IANA name. It starts with "TLS_" prefix */
-  const char *alias_name; /* Alias name is the same as OpenSSL cipher name */
-  SSLCipherSuite num; /* Cipher suite code/number defined in IANA registry */
-  bool weak; /* Flag to mark cipher as weak based on previous implementation
-                of Secure Transport back-end by CURL */
-};
-
-/* Macro to initialize st_cipher data structure: stringify id to name, cipher
-   number/id, 'weak' suite flag
- */
-#define CIPHER_DEF(num, alias, weak) \
-  { #num, alias, num, weak }
-
-/*
- Macro to initialize st_cipher data structure with name, code (IANA cipher
- number/id value), and 'weak' suite flag. The first 28 cipher suite numbers
- have the same IANA code for both SSL and TLS standards: numbers 0x0000 to
- 0x001B. They have different names though. The first 4 letters of the cipher
- suite name are the protocol name: "SSL_" or "TLS_", rest of the IANA name is
- the same for both SSL and TLS cipher suite name.
- The second part of the problem is that macOS/iOS SDKs don't define all TLS
- codes but only 12 of them. The SDK defines all SSL codes though, i.e. SSL_NUM
- constant is always defined for those 28 ciphers while TLS_NUM is defined only
- for 12 of the first 28 ciphers. Those 12 TLS cipher codes match to
- corresponding SSL enum value and represent the same cipher suite. Therefore
- we'll use the SSL enum value for those cipher suites because it is defined
- for all 28 of them.
- We make internal data consistent and based on TLS names, i.e. all st_cipher
- item names start with the "TLS_" prefix.
- Summarizing all the above, those 28 first ciphers are presented in our table
- with both TLS and SSL names. Their cipher numbers are assigned based on the
- SDK enum value for the SSL cipher, which matches to IANA TLS number.
- */
-#define CIPHER_DEF_SSLTLS(num_wo_prefix, alias, weak) \
-  { "TLS_" #num_wo_prefix, alias, SSL_##num_wo_prefix, weak }
-
-/*
- Cipher suites were marked as weak based on the following:
- RC4 encryption - rfc7465, the document contains a list of deprecated ciphers.
-     Marked in the code below as weak.
- RC2 encryption - many mentions, was found vulnerable to a relatively easy
-     attack https://link.springer.com/chapter/10.1007%2F3-540-69710-1_14
-     Marked in the code below as weak.
- DES and IDEA encryption - rfc5469, has a list of deprecated ciphers.
-     Marked in the code below as weak.
- Anonymous Diffie-Hellman authentication and anonymous elliptic curve
-     Diffie-Hellman - vulnerable to a man-in-the-middle attack. Deprecated by
-     RFC 4346 aka TLS 1.1 (section A.5, page 60)
- Null bulk encryption suites - not encrypted communication
- Export ciphers, i.e. ciphers with restrictions to be used outside the US for
-     software exported to some countries, they were excluded from TLS 1.1
-     version. More precisely, they were noted as ciphers which MUST NOT be
-     negotiated in RFC 4346 aka TLS 1.1 (section A.5, pages 60 and 61).
-     All of those filters were considered weak because they contain a weak
-     algorithm like DES, RC2 or RC4, and already considered weak by other
-     criteria.
- 3DES - NIST deprecated it and is going to retire it by 2023
- https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA
-     OpenSSL https://www.openssl.org/blog/blog/2016/08/24/sweet32/ also
-     deprecated those ciphers. Some other libraries also consider it
-     vulnerable or at least not strong enough.
-
- CBC ciphers are vulnerable with SSL3.0 and TLS1.0:
- https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance
- /118518-technote-esa-00.html
-     We don't take care of this issue because it is resolved by later TLS
-     versions and for us, it requires more complicated checks, we need to
-     check a protocol version also. Vulnerability doesn't look very critical
-     and we do not filter out those cipher suites.
- */
-
-#define CIPHER_WEAK_NOT_ENCRYPTED   TRUE
-#define CIPHER_WEAK_RC_ENCRYPTION   TRUE
-#define CIPHER_WEAK_DES_ENCRYPTION  TRUE
-#define CIPHER_WEAK_IDEA_ENCRYPTION TRUE
-#define CIPHER_WEAK_ANON_AUTH       TRUE
-#define CIPHER_WEAK_3DES_ENCRYPTION TRUE
-#define CIPHER_STRONG_ENOUGH        FALSE
-
-/* Please do not change the order of the first ciphers available for SSL.
-   Do not insert and do not delete any of them. Code below
-   depends on their order and continuity.
-   If you add a new cipher, please maintain order by number, i.e.
-   insert in between existing items to appropriate place based on
-   cipher suite IANA number
-*/
-static const struct st_cipher ciphertable[] = {
-  /* SSL version 3.0 and initial TLS 1.0 cipher suites.
-     Defined since SDK 10.2.8 */
-  CIPHER_DEF_SSLTLS(NULL_WITH_NULL_NULL,                           /* 0x0000 */
-                    NULL,
-                    CIPHER_WEAK_NOT_ENCRYPTED),
-  CIPHER_DEF_SSLTLS(RSA_WITH_NULL_MD5,                             /* 0x0001 */
-                    "NULL-MD5",
-                    CIPHER_WEAK_NOT_ENCRYPTED),
-  CIPHER_DEF_SSLTLS(RSA_WITH_NULL_SHA,                             /* 0x0002 */
-                    "NULL-SHA",
-                    CIPHER_WEAK_NOT_ENCRYPTED),
-  CIPHER_DEF_SSLTLS(RSA_EXPORT_WITH_RC4_40_MD5,                    /* 0x0003 */
-                    "EXP-RC4-MD5",
-                    CIPHER_WEAK_RC_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(RSA_WITH_RC4_128_MD5,                          /* 0x0004 */
-                    "RC4-MD5",
-                    CIPHER_WEAK_RC_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(RSA_WITH_RC4_128_SHA,                          /* 0x0005 */
-                    "RC4-SHA",
-                    CIPHER_WEAK_RC_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(RSA_EXPORT_WITH_RC2_CBC_40_MD5,                /* 0x0006 */
-                    "EXP-RC2-CBC-MD5",
-                    CIPHER_WEAK_RC_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(RSA_WITH_IDEA_CBC_SHA,                         /* 0x0007 */
-                    "IDEA-CBC-SHA",
-                    CIPHER_WEAK_IDEA_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(RSA_EXPORT_WITH_DES40_CBC_SHA,                 /* 0x0008 */
-                    "EXP-DES-CBC-SHA",
-                    CIPHER_WEAK_DES_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(RSA_WITH_DES_CBC_SHA,                          /* 0x0009 */
-                    "DES-CBC-SHA",
-                    CIPHER_WEAK_DES_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(RSA_WITH_3DES_EDE_CBC_SHA,                     /* 0x000A */
-                    "DES-CBC3-SHA",
-                    CIPHER_WEAK_3DES_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(DH_DSS_EXPORT_WITH_DES40_CBC_SHA,              /* 0x000B */
-                    "EXP-DH-DSS-DES-CBC-SHA",
-                    CIPHER_WEAK_DES_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(DH_DSS_WITH_DES_CBC_SHA,                       /* 0x000C */
-                    "DH-DSS-DES-CBC-SHA",
-                    CIPHER_WEAK_DES_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(DH_DSS_WITH_3DES_EDE_CBC_SHA,                  /* 0x000D */
-                    "DH-DSS-DES-CBC3-SHA",
-                    CIPHER_WEAK_3DES_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(DH_RSA_EXPORT_WITH_DES40_CBC_SHA,              /* 0x000E */
-                    "EXP-DH-RSA-DES-CBC-SHA",
-                    CIPHER_WEAK_DES_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(DH_RSA_WITH_DES_CBC_SHA,                       /* 0x000F */
-                    "DH-RSA-DES-CBC-SHA",
-                    CIPHER_WEAK_DES_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(DH_RSA_WITH_3DES_EDE_CBC_SHA,                  /* 0x0010 */
-                    "DH-RSA-DES-CBC3-SHA",
-                    CIPHER_WEAK_3DES_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(DHE_DSS_EXPORT_WITH_DES40_CBC_SHA,             /* 0x0011 */
-                    "EXP-EDH-DSS-DES-CBC-SHA",
-                    CIPHER_WEAK_DES_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(DHE_DSS_WITH_DES_CBC_SHA,                      /* 0x0012 */
-                    "EDH-DSS-CBC-SHA",
-                    CIPHER_WEAK_DES_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(DHE_DSS_WITH_3DES_EDE_CBC_SHA,                 /* 0x0013 */
-                    "DHE-DSS-DES-CBC3-SHA",
-                    CIPHER_WEAK_3DES_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,             /* 0x0014 */
-                    "EXP-EDH-RSA-DES-CBC-SHA",
-                    CIPHER_WEAK_DES_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(DHE_RSA_WITH_DES_CBC_SHA,                      /* 0x0015 */
-                    "EDH-RSA-DES-CBC-SHA",
-                    CIPHER_WEAK_DES_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(DHE_RSA_WITH_3DES_EDE_CBC_SHA,                 /* 0x0016 */
-                    "DHE-RSA-DES-CBC3-SHA",
-                    CIPHER_WEAK_3DES_ENCRYPTION),
-  CIPHER_DEF_SSLTLS(DH_anon_EXPORT_WITH_RC4_40_MD5,                /* 0x0017 */
-                    "EXP-ADH-RC4-MD5",
-                    CIPHER_WEAK_ANON_AUTH),
-  CIPHER_DEF_SSLTLS(DH_anon_WITH_RC4_128_MD5,                      /* 0x0018 */
-                    "ADH-RC4-MD5",
-                    CIPHER_WEAK_ANON_AUTH),
-  CIPHER_DEF_SSLTLS(DH_anon_EXPORT_WITH_DES40_CBC_SHA,             /* 0x0019 */
-                    "EXP-ADH-DES-CBC-SHA",
-                    CIPHER_WEAK_ANON_AUTH),
-  CIPHER_DEF_SSLTLS(DH_anon_WITH_DES_CBC_SHA,                      /* 0x001A */
-                    "ADH-DES-CBC-SHA",
-                    CIPHER_WEAK_ANON_AUTH),
-  CIPHER_DEF_SSLTLS(DH_anon_WITH_3DES_EDE_CBC_SHA,                 /* 0x001B */
-                    "ADH-DES-CBC3-SHA",
-                    CIPHER_WEAK_3DES_ENCRYPTION),
-  CIPHER_DEF(SSL_FORTEZZA_DMS_WITH_NULL_SHA,                       /* 0x001C */
-             NULL,
-             CIPHER_WEAK_NOT_ENCRYPTED),
-  CIPHER_DEF(SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,               /* 0x001D */
-             NULL,
-             CIPHER_STRONG_ENOUGH),
-
-#if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7
-  /* RFC 4785 - Pre-Shared Key (PSK) Ciphersuites with NULL Encryption */
-  CIPHER_DEF(TLS_PSK_WITH_NULL_SHA,                                /* 0x002C */
-             "PSK-NULL-SHA",
-             CIPHER_WEAK_NOT_ENCRYPTED),
-  CIPHER_DEF(TLS_DHE_PSK_WITH_NULL_SHA,                            /* 0x002D */
-             "DHE-PSK-NULL-SHA",
-             CIPHER_WEAK_NOT_ENCRYPTED),
-  CIPHER_DEF(TLS_RSA_PSK_WITH_NULL_SHA,                            /* 0x002E */
-             "RSA-PSK-NULL-SHA",
-             CIPHER_WEAK_NOT_ENCRYPTED),
-#endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */
-
-  /* TLS addenda using AES, per RFC 3268. Defined since SDK 10.4u */
-  CIPHER_DEF(TLS_RSA_WITH_AES_128_CBC_SHA,                         /* 0x002F */
-             "AES128-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DH_DSS_WITH_AES_128_CBC_SHA,                      /* 0x0030 */
-             "DH-DSS-AES128-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DH_RSA_WITH_AES_128_CBC_SHA,                      /* 0x0031 */
-             "DH-RSA-AES128-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DHE_DSS_WITH_AES_128_CBC_SHA,                     /* 0x0032 */
-             "DHE-DSS-AES128-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DHE_RSA_WITH_AES_128_CBC_SHA,                     /* 0x0033 */
-             "DHE-RSA-AES128-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DH_anon_WITH_AES_128_CBC_SHA,                     /* 0x0034 */
-             "ADH-AES128-SHA",
-             CIPHER_WEAK_ANON_AUTH),
-  CIPHER_DEF(TLS_RSA_WITH_AES_256_CBC_SHA,                         /* 0x0035 */
-             "AES256-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DH_DSS_WITH_AES_256_CBC_SHA,                      /* 0x0036 */
-             "DH-DSS-AES256-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DH_RSA_WITH_AES_256_CBC_SHA,                      /* 0x0037 */
-             "DH-RSA-AES256-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DHE_DSS_WITH_AES_256_CBC_SHA,                     /* 0x0038 */
-             "DHE-DSS-AES256-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DHE_RSA_WITH_AES_256_CBC_SHA,                     /* 0x0039 */
-             "DHE-RSA-AES256-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DH_anon_WITH_AES_256_CBC_SHA,                     /* 0x003A */
-             "ADH-AES256-SHA",
-             CIPHER_WEAK_ANON_AUTH),
-
-#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
-  /* TLS 1.2 addenda, RFC 5246 */
-  /* Server provided RSA certificate for key exchange. */
-  CIPHER_DEF(TLS_RSA_WITH_NULL_SHA256,                             /* 0x003B */
-             "NULL-SHA256",
-             CIPHER_WEAK_NOT_ENCRYPTED),
-  CIPHER_DEF(TLS_RSA_WITH_AES_128_CBC_SHA256,                      /* 0x003C */
-             "AES128-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_RSA_WITH_AES_256_CBC_SHA256,                      /* 0x003D */
-             "AES256-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  /* Server-authenticated (and optionally client-authenticated)
-     Diffie-Hellman. */
-  CIPHER_DEF(TLS_DH_DSS_WITH_AES_128_CBC_SHA256,                   /* 0x003E */
-             "DH-DSS-AES128-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DH_RSA_WITH_AES_128_CBC_SHA256,                   /* 0x003F */
-             "DH-RSA-AES128-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,                  /* 0x0040 */
-             "DHE-DSS-AES128-SHA256",
-             CIPHER_STRONG_ENOUGH),
-
-  /* TLS 1.2 addenda, RFC 5246 */
-  CIPHER_DEF(TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,                  /* 0x0067 */
-             "DHE-RSA-AES128-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DH_DSS_WITH_AES_256_CBC_SHA256,                   /* 0x0068 */
-             "DH-DSS-AES256-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DH_RSA_WITH_AES_256_CBC_SHA256,                   /* 0x0069 */
-             "DH-RSA-AES256-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,                  /* 0x006A */
-             "DHE-DSS-AES256-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,                  /* 0x006B */
-             "DHE-RSA-AES256-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DH_anon_WITH_AES_128_CBC_SHA256,                  /* 0x006C */
-             "ADH-AES128-SHA256",
-             CIPHER_WEAK_ANON_AUTH),
-  CIPHER_DEF(TLS_DH_anon_WITH_AES_256_CBC_SHA256,                  /* 0x006D */
-             "ADH-AES256-SHA256",
-             CIPHER_WEAK_ANON_AUTH),
-#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
-
-#if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7
-  /* Addendum from RFC 4279, TLS PSK */
-  CIPHER_DEF(TLS_PSK_WITH_RC4_128_SHA,                             /* 0x008A */
-             "PSK-RC4-SHA",
-             CIPHER_WEAK_RC_ENCRYPTION),
-  CIPHER_DEF(TLS_PSK_WITH_3DES_EDE_CBC_SHA,                        /* 0x008B */
-             "PSK-3DES-EDE-CBC-SHA",
-             CIPHER_WEAK_3DES_ENCRYPTION),
-  CIPHER_DEF(TLS_PSK_WITH_AES_128_CBC_SHA,                         /* 0x008C */
-             "PSK-AES128-CBC-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_PSK_WITH_AES_256_CBC_SHA,                         /* 0x008D */
-             "PSK-AES256-CBC-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DHE_PSK_WITH_RC4_128_SHA,                         /* 0x008E */
-             "DHE-PSK-RC4-SHA",
-             CIPHER_WEAK_RC_ENCRYPTION),
-  CIPHER_DEF(TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA,                    /* 0x008F */
-             "DHE-PSK-3DES-EDE-CBC-SHA",
-             CIPHER_WEAK_3DES_ENCRYPTION),
-  CIPHER_DEF(TLS_DHE_PSK_WITH_AES_128_CBC_SHA,                     /* 0x0090 */
-             "DHE-PSK-AES128-CBC-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DHE_PSK_WITH_AES_256_CBC_SHA,                     /* 0x0091 */
-             "DHE-PSK-AES256-CBC-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_RSA_PSK_WITH_RC4_128_SHA,                         /* 0x0092 */
-             "RSA-PSK-RC4-SHA",
-             CIPHER_WEAK_RC_ENCRYPTION),
-  CIPHER_DEF(TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA,                    /* 0x0093 */
-             "RSA-PSK-3DES-EDE-CBC-SHA",
-             CIPHER_WEAK_3DES_ENCRYPTION),
-  CIPHER_DEF(TLS_RSA_PSK_WITH_AES_128_CBC_SHA,                     /* 0x0094 */
-             "RSA-PSK-AES128-CBC-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_RSA_PSK_WITH_AES_256_CBC_SHA,                     /* 0x0095 */
-             "RSA-PSK-AES256-CBC-SHA",
-             CIPHER_STRONG_ENOUGH),
-#endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */
-
-#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
-  /* Addenda from rfc 5288 AES Galois Counter Mode (GCM) Cipher Suites
-     for TLS. */
-  CIPHER_DEF(TLS_RSA_WITH_AES_128_GCM_SHA256,                      /* 0x009C */
-             "AES128-GCM-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_RSA_WITH_AES_256_GCM_SHA384,                      /* 0x009D */
-             "AES256-GCM-SHA384",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,                  /* 0x009E */
-             "DHE-RSA-AES128-GCM-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,                  /* 0x009F */
-             "DHE-RSA-AES256-GCM-SHA384",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DH_RSA_WITH_AES_128_GCM_SHA256,                   /* 0x00A0 */
-             "DH-RSA-AES128-GCM-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DH_RSA_WITH_AES_256_GCM_SHA384,                   /* 0x00A1 */
-             "DH-RSA-AES256-GCM-SHA384",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,                  /* 0x00A2 */
-             "DHE-DSS-AES128-GCM-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DHE_DSS_WITH_AES_256_GCM_SHA384,                  /* 0x00A3 */
-             "DHE-DSS-AES256-GCM-SHA384",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DH_DSS_WITH_AES_128_GCM_SHA256,                   /* 0x00A4 */
-             "DH-DSS-AES128-GCM-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DH_DSS_WITH_AES_256_GCM_SHA384,                   /* 0x00A5 */
-             "DH-DSS-AES256-GCM-SHA384",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DH_anon_WITH_AES_128_GCM_SHA256,                  /* 0x00A6 */
-             "ADH-AES128-GCM-SHA256",
-             CIPHER_WEAK_ANON_AUTH),
-  CIPHER_DEF(TLS_DH_anon_WITH_AES_256_GCM_SHA384,                  /* 0x00A7 */
-             "ADH-AES256-GCM-SHA384",
-             CIPHER_WEAK_ANON_AUTH),
-#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
-
-#if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7
-  /* RFC 5487 - PSK with SHA-256/384 and AES GCM */
-  CIPHER_DEF(TLS_PSK_WITH_AES_128_GCM_SHA256,                      /* 0x00A8 */
-             "PSK-AES128-GCM-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_PSK_WITH_AES_256_GCM_SHA384,                      /* 0x00A9 */
-             "PSK-AES256-GCM-SHA384",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DHE_PSK_WITH_AES_128_GCM_SHA256,                  /* 0x00AA */
-             "DHE-PSK-AES128-GCM-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DHE_PSK_WITH_AES_256_GCM_SHA384,                  /* 0x00AB */
-             "DHE-PSK-AES256-GCM-SHA384",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_RSA_PSK_WITH_AES_128_GCM_SHA256,                  /* 0x00AC */
-             "RSA-PSK-AES128-GCM-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_RSA_PSK_WITH_AES_256_GCM_SHA384,                  /* 0x00AD */
-             "RSA-PSK-AES256-GCM-SHA384",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_PSK_WITH_AES_128_CBC_SHA256,                      /* 0x00AE */
-             "PSK-AES128-CBC-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_PSK_WITH_AES_256_CBC_SHA384,                      /* 0x00AF */
-             "PSK-AES256-CBC-SHA384",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_PSK_WITH_NULL_SHA256,                             /* 0x00B0 */
-             "PSK-NULL-SHA256",
-             CIPHER_WEAK_NOT_ENCRYPTED),
-  CIPHER_DEF(TLS_PSK_WITH_NULL_SHA384,                             /* 0x00B1 */
-             "PSK-NULL-SHA384",
-             CIPHER_WEAK_NOT_ENCRYPTED),
-  CIPHER_DEF(TLS_DHE_PSK_WITH_AES_128_CBC_SHA256,                  /* 0x00B2 */
-             "DHE-PSK-AES128-CBC-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DHE_PSK_WITH_AES_256_CBC_SHA384,                  /* 0x00B3 */
-             "DHE-PSK-AES256-CBC-SHA384",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_DHE_PSK_WITH_NULL_SHA256,                         /* 0x00B4 */
-             "DHE-PSK-NULL-SHA256",
-             CIPHER_WEAK_NOT_ENCRYPTED),
-  CIPHER_DEF(TLS_DHE_PSK_WITH_NULL_SHA384,                         /* 0x00B5 */
-             "DHE-PSK-NULL-SHA384",
-             CIPHER_WEAK_NOT_ENCRYPTED),
-  CIPHER_DEF(TLS_RSA_PSK_WITH_AES_128_CBC_SHA256,                  /* 0x00B6 */
-             "RSA-PSK-AES128-CBC-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_RSA_PSK_WITH_AES_256_CBC_SHA384,                  /* 0x00B7 */
-             "RSA-PSK-AES256-CBC-SHA384",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_RSA_PSK_WITH_NULL_SHA256,                         /* 0x00B8 */
-             "RSA-PSK-NULL-SHA256",
-             CIPHER_WEAK_NOT_ENCRYPTED),
-  CIPHER_DEF(TLS_RSA_PSK_WITH_NULL_SHA384,                         /* 0x00B9 */
-             "RSA-PSK-NULL-SHA384",
-             CIPHER_WEAK_NOT_ENCRYPTED),
-#endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */
-
-  /* RFC 5746 - Secure Renegotiation. This is not a real suite,
-     it is a response to initiate negotiation again */
-  CIPHER_DEF(TLS_EMPTY_RENEGOTIATION_INFO_SCSV,                    /* 0x00FF */
-             NULL,
-             CIPHER_STRONG_ENOUGH),
-
-#if CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11
-  /* TLS 1.3 standard cipher suites for ChaCha20+Poly1305.
-     Note: TLS 1.3 ciphersuites do not specify the key exchange
-     algorithm -- they only specify the symmetric ciphers.
-     Cipher alias name matches to OpenSSL cipher name, and for
-     TLS 1.3 ciphers */
-  CIPHER_DEF(TLS_AES_128_GCM_SHA256,                               /* 0x1301 */
-             NULL,  /* The OpenSSL cipher name matches to the IANA name */
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_AES_256_GCM_SHA384,                               /* 0x1302 */
-             NULL,  /* The OpenSSL cipher name matches to the IANA name */
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_CHACHA20_POLY1305_SHA256,                         /* 0x1303 */
-             NULL,  /* The OpenSSL cipher name matches to the IANA name */
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_AES_128_CCM_SHA256,                               /* 0x1304 */
-             NULL,  /* The OpenSSL cipher name matches to the IANA name */
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_AES_128_CCM_8_SHA256,                             /* 0x1305 */
-             NULL,  /* The OpenSSL cipher name matches to the IANA name */
-             CIPHER_STRONG_ENOUGH),
-#endif /* CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 */
-
-#if CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS
-  /* ECDSA addenda, RFC 4492 */
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_NULL_SHA,                         /* 0xC001 */
-             "ECDH-ECDSA-NULL-SHA",
-             CIPHER_WEAK_NOT_ENCRYPTED),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_RC4_128_SHA,                      /* 0xC002 */
-             "ECDH-ECDSA-RC4-SHA",
-             CIPHER_WEAK_RC_ENCRYPTION),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,                 /* 0xC003 */
-             "ECDH-ECDSA-DES-CBC3-SHA",
-             CIPHER_WEAK_3DES_ENCRYPTION),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,                  /* 0xC004 */
-             "ECDH-ECDSA-AES128-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,                  /* 0xC005 */
-             "ECDH-ECDSA-AES256-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_NULL_SHA,                        /* 0xC006 */
-             "ECDHE-ECDSA-NULL-SHA",
-             CIPHER_WEAK_NOT_ENCRYPTED),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,                     /* 0xC007 */
-             "ECDHE-ECDSA-RC4-SHA",
-             CIPHER_WEAK_RC_ENCRYPTION),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,                /* 0xC008 */
-             "ECDHE-ECDSA-DES-CBC3-SHA",
-             CIPHER_WEAK_3DES_ENCRYPTION),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,                 /* 0xC009 */
-             "ECDHE-ECDSA-AES128-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,                 /* 0xC00A */
-             "ECDHE-ECDSA-AES256-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_NULL_SHA,                           /* 0xC00B */
-             "ECDH-RSA-NULL-SHA",
-             CIPHER_WEAK_NOT_ENCRYPTED),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_RC4_128_SHA,                        /* 0xC00C */
-             "ECDH-RSA-RC4-SHA",
-             CIPHER_WEAK_RC_ENCRYPTION),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,                   /* 0xC00D */
-             "ECDH-RSA-DES-CBC3-SHA",
-             CIPHER_WEAK_3DES_ENCRYPTION),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,                    /* 0xC00E */
-             "ECDH-RSA-AES128-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,                    /* 0xC00F */
-             "ECDH-RSA-AES256-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_NULL_SHA,                          /* 0xC010 */
-             "ECDHE-RSA-NULL-SHA",
-             CIPHER_WEAK_NOT_ENCRYPTED),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_RC4_128_SHA,                       /* 0xC011 */
-             "ECDHE-RSA-RC4-SHA",
-             CIPHER_WEAK_RC_ENCRYPTION),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,                  /* 0xC012 */
-             "ECDHE-RSA-DES-CBC3-SHA",
-             CIPHER_WEAK_3DES_ENCRYPTION),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,                   /* 0xC013 */
-             "ECDHE-RSA-AES128-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,                   /* 0xC014 */
-             "ECDHE-RSA-AES256-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDH_anon_WITH_NULL_SHA,                          /* 0xC015 */
-             "AECDH-NULL-SHA",
-             CIPHER_WEAK_ANON_AUTH),
-  CIPHER_DEF(TLS_ECDH_anon_WITH_RC4_128_SHA,                       /* 0xC016 */
-             "AECDH-RC4-SHA",
-             CIPHER_WEAK_ANON_AUTH),
-  CIPHER_DEF(TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA,                  /* 0xC017 */
-             "AECDH-DES-CBC3-SHA",
-             CIPHER_WEAK_3DES_ENCRYPTION),
-  CIPHER_DEF(TLS_ECDH_anon_WITH_AES_128_CBC_SHA,                   /* 0xC018 */
-             "AECDH-AES128-SHA",
-             CIPHER_WEAK_ANON_AUTH),
-  CIPHER_DEF(TLS_ECDH_anon_WITH_AES_256_CBC_SHA,                   /* 0xC019 */
-             "AECDH-AES256-SHA",
-             CIPHER_WEAK_ANON_AUTH),
-#endif /* CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS */
-
-#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
-  /* Addenda from rfc 5289  Elliptic Curve Cipher Suites with
-     HMAC SHA-256/384. */
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,              /* 0xC023 */
-             "ECDHE-ECDSA-AES128-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,              /* 0xC024 */
-             "ECDHE-ECDSA-AES256-SHA384",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,               /* 0xC025 */
-             "ECDH-ECDSA-AES128-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,               /* 0xC026 */
-             "ECDH-ECDSA-AES256-SHA384",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,                /* 0xC027 */
-             "ECDHE-RSA-AES128-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,                /* 0xC028 */
-             "ECDHE-RSA-AES256-SHA384",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,                 /* 0xC029 */
-             "ECDH-RSA-AES128-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,                 /* 0xC02A */
-             "ECDH-RSA-AES256-SHA384",
-             CIPHER_STRONG_ENOUGH),
-  /* Addenda from rfc 5289  Elliptic Curve Cipher Suites with
-     SHA-256/384 and AES Galois Counter Mode (GCM) */
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,              /* 0xC02B */
-             "ECDHE-ECDSA-AES128-GCM-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,              /* 0xC02C */
-             "ECDHE-ECDSA-AES256-GCM-SHA384",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,               /* 0xC02D */
-             "ECDH-ECDSA-AES128-GCM-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,               /* 0xC02E */
-             "ECDH-ECDSA-AES256-GCM-SHA384",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,                /* 0xC02F */
-             "ECDHE-RSA-AES128-GCM-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,                /* 0xC030 */
-             "ECDHE-RSA-AES256-GCM-SHA384",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,                 /* 0xC031 */
-             "ECDH-RSA-AES128-GCM-SHA256",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,                 /* 0xC032 */
-             "ECDH-RSA-AES256-GCM-SHA384",
-             CIPHER_STRONG_ENOUGH),
-#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
-
-#if CURL_BUILD_MAC_10_15 || CURL_BUILD_IOS_13
-  /* ECDHE_PSK Cipher Suites for Transport Layer Security (TLS), RFC 5489 */
-  CIPHER_DEF(TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA,                   /* 0xC035 */
-             "ECDHE-PSK-AES128-CBC-SHA",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA,                   /* 0xC036 */
-             "ECDHE-PSK-AES256-CBC-SHA",
-             CIPHER_STRONG_ENOUGH),
-#endif /* CURL_BUILD_MAC_10_15 || CURL_BUILD_IOS_13 */
-
-#if CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11
-  /* Addenda from rfc 7905  ChaCha20-Poly1305 Cipher Suites for
-     Transport Layer Security (TLS). */
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,          /* 0xCCA8 */
-             "ECDHE-RSA-CHACHA20-POLY1305",
-             CIPHER_STRONG_ENOUGH),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,        /* 0xCCA9 */
-             "ECDHE-ECDSA-CHACHA20-POLY1305",
-             CIPHER_STRONG_ENOUGH),
-#endif /* CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 */
-
-#if CURL_BUILD_MAC_10_15 || CURL_BUILD_IOS_13
-  /* ChaCha20-Poly1305 Cipher Suites for Transport Layer Security (TLS),
-     RFC 7905 */
-  CIPHER_DEF(TLS_PSK_WITH_CHACHA20_POLY1305_SHA256,                /* 0xCCAB */
-             "PSK-CHACHA20-POLY1305",
-             CIPHER_STRONG_ENOUGH),
-#endif /* CURL_BUILD_MAC_10_15 || CURL_BUILD_IOS_13 */
-
-  /* Tags for SSL 2 cipher kinds which are not specified for SSL 3.
-     Defined since SDK 10.2.8 */
-  CIPHER_DEF(SSL_RSA_WITH_RC2_CBC_MD5,                             /* 0xFF80 */
-             NULL,
-             CIPHER_WEAK_RC_ENCRYPTION),
-  CIPHER_DEF(SSL_RSA_WITH_IDEA_CBC_MD5,                            /* 0xFF81 */
-             NULL,
-             CIPHER_WEAK_IDEA_ENCRYPTION),
-  CIPHER_DEF(SSL_RSA_WITH_DES_CBC_MD5,                             /* 0xFF82 */
-             NULL,
-             CIPHER_WEAK_DES_ENCRYPTION),
-  CIPHER_DEF(SSL_RSA_WITH_3DES_EDE_CBC_MD5,                        /* 0xFF83 */
-             NULL,
-             CIPHER_WEAK_3DES_ENCRYPTION),
-};
-
-#define NUM_OF_CIPHERS sizeof(ciphertable)/sizeof(ciphertable[0])
-
-
-/* pinned public key support tests */
-
-/* version 1 supports macOS 10.12+ and iOS 10+ */
-#if ((TARGET_OS_IPHONE && __IPHONE_OS_VERSION_MIN_REQUIRED >= 100000) || \
-    (!TARGET_OS_IPHONE && __MAC_OS_X_VERSION_MIN_REQUIRED  >= 101200))
-#define SECTRANSP_PINNEDPUBKEY_V1 1
-#endif
-
-/* version 2 supports MacOSX 10.7+ */
-#if (!TARGET_OS_IPHONE && __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070)
-#define SECTRANSP_PINNEDPUBKEY_V2 1
-#endif
-
-#if defined(SECTRANSP_PINNEDPUBKEY_V1) || defined(SECTRANSP_PINNEDPUBKEY_V2)
-/* this backend supports CURLOPT_PINNEDPUBLICKEY */
-#define SECTRANSP_PINNEDPUBKEY 1
-#endif /* SECTRANSP_PINNEDPUBKEY */
-
-#ifdef SECTRANSP_PINNEDPUBKEY
-/* both new and old APIs return rsa keys missing the spki header (not DER) */
-static const unsigned char rsa4096SpkiHeader[] = {
-                                       0x30, 0x82, 0x02, 0x22, 0x30, 0x0d,
-                                       0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
-                                       0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05,
-                                       0x00, 0x03, 0x82, 0x02, 0x0f, 0x00};
-
-static const unsigned char rsa2048SpkiHeader[] = {
-                                       0x30, 0x82, 0x01, 0x22, 0x30, 0x0d,
-                                       0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
-                                       0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05,
-                                       0x00, 0x03, 0x82, 0x01, 0x0f, 0x00};
-#ifdef SECTRANSP_PINNEDPUBKEY_V1
-/* the *new* version doesn't return DER encoded ecdsa certs like the old... */
-static const unsigned char ecDsaSecp256r1SpkiHeader[] = {
-                                       0x30, 0x59, 0x30, 0x13, 0x06, 0x07,
-                                       0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02,
-                                       0x01, 0x06, 0x08, 0x2a, 0x86, 0x48,
-                                       0xce, 0x3d, 0x03, 0x01, 0x07, 0x03,
-                                       0x42, 0x00};
-
-static const unsigned char ecDsaSecp384r1SpkiHeader[] = {
-                                       0x30, 0x76, 0x30, 0x10, 0x06, 0x07,
-                                       0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02,
-                                       0x01, 0x06, 0x05, 0x2b, 0x81, 0x04,
-                                       0x00, 0x22, 0x03, 0x62, 0x00};
-#endif /* SECTRANSP_PINNEDPUBKEY_V1 */
-#endif /* SECTRANSP_PINNEDPUBKEY */
-
-static OSStatus bio_cf_in_read(SSLConnectionRef connection,
-                               void *buf,
-                               size_t *dataLength)  /* IN/OUT */
-{
-  struct Curl_cfilter *cf = (struct Curl_cfilter *)connection;
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct st_ssl_backend_data *backend =
-    (struct st_ssl_backend_data *)connssl->backend;
-  struct Curl_easy *data = CF_DATA_CURRENT(cf);
-  ssize_t nread;
-  CURLcode result;
-  OSStatus rtn = noErr;
-
-  DEBUGASSERT(data);
-  nread = Curl_conn_cf_recv(cf->next, data, buf, *dataLength, &result);
-  CURL_TRC_CF(data, cf, "bio_read(len=%zu) -> %zd, result=%d",
-              *dataLength, nread, result);
-  if(nread < 0) {
-    switch(result) {
-      case CURLE_OK:
-      case CURLE_AGAIN:
-        rtn = errSSLWouldBlock;
-        backend->ssl_direction = false;
-        break;
-      default:
-        rtn = ioErr;
-        break;
-    }
-    nread = 0;
-  }
-  else if(nread == 0) {
-    rtn = errSSLClosedGraceful;
-  }
-  else if((size_t)nread < *dataLength) {
-    rtn = errSSLWouldBlock;
-  }
-  *dataLength = nread;
-  return rtn;
-}
-
-static OSStatus bio_cf_out_write(SSLConnectionRef connection,
-                                 const void *buf,
-                                 size_t *dataLength)  /* IN/OUT */
-{
-  struct Curl_cfilter *cf = (struct Curl_cfilter *)connection;
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct st_ssl_backend_data *backend =
-    (struct st_ssl_backend_data *)connssl->backend;
-  struct Curl_easy *data = CF_DATA_CURRENT(cf);
-  ssize_t nwritten;
-  CURLcode result;
-  OSStatus rtn = noErr;
-
-  DEBUGASSERT(data);
-  nwritten = Curl_conn_cf_send(cf->next, data, buf, *dataLength, &result);
-  CURL_TRC_CF(data, cf, "bio_send(len=%zu) -> %zd, result=%d",
-              *dataLength, nwritten, result);
-  if(nwritten <= 0) {
-    if(result == CURLE_AGAIN) {
-      rtn = errSSLWouldBlock;
-      backend->ssl_direction = true;
-    }
-    else {
-      rtn = ioErr;
-    }
-    nwritten = 0;
-  }
-  else if((size_t)nwritten < *dataLength) {
-    rtn = errSSLWouldBlock;
-  }
-  *dataLength = nwritten;
-  return rtn;
-}
-
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-CF_INLINE const char *TLSCipherNameForNumber(SSLCipherSuite cipher)
-{
-  /* The first ciphers in the ciphertable are continuous. Here we do small
-     optimization and instead of loop directly get SSL name by cipher number.
-  */
-  size_t i;
-  if(cipher <= SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA) {
-    return ciphertable[cipher].name;
-  }
-  /* Iterate through the rest of the ciphers */
-  for(i = SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA + 1; i < NUM_OF_CIPHERS;
-      ++i) {
-    if(ciphertable[i].num == cipher) {
-      return ciphertable[i].name;
-    }
-  }
-  return ciphertable[SSL_NULL_WITH_NULL_NULL].name;
-}
-#endif /* !CURL_DISABLE_VERBOSE_STRINGS */
-
-#if CURL_BUILD_MAC
-CF_INLINE void GetDarwinVersionNumber(int *major, int *minor)
-{
-  int mib[2];
-  char *os_version;
-  size_t os_version_len;
-  char *os_version_major, *os_version_minor;
-  char *tok_buf;
-
-  /* Get the Darwin kernel version from the kernel using sysctl(): */
-  mib[0] = CTL_KERN;
-  mib[1] = KERN_OSRELEASE;
-  if(sysctl(mib, 2, NULL, &os_version_len, NULL, 0) == -1)
-    return;
-  os_version = malloc(os_version_len*sizeof(char));
-  if(!os_version)
-    return;
-  if(sysctl(mib, 2, os_version, &os_version_len, NULL, 0) == -1) {
-    free(os_version);
-    return;
-  }
-
-  /* Parse the version: */
-  os_version_major = strtok_r(os_version, ".", &tok_buf);
-  os_version_minor = strtok_r(NULL, ".", &tok_buf);
-  *major = atoi(os_version_major);
-  *minor = atoi(os_version_minor);
-  free(os_version);
-}
-#endif /* CURL_BUILD_MAC */
-
-/* Apple provides a myriad of ways of getting information about a certificate
-   into a string. Some aren't available under iOS or newer cats. So here's
-   a unified function for getting a string describing the certificate that
-   ought to work in all cats starting with Leopard. */
-CF_INLINE CFStringRef getsubject(SecCertificateRef cert)
-{
-  CFStringRef server_cert_summary = CFSTR("(null)");
-
-#if CURL_BUILD_IOS
-  /* iOS: There's only one way to do this. */
-  server_cert_summary = SecCertificateCopySubjectSummary(cert);
-#else
-#if CURL_BUILD_MAC_10_7
-  /* Lion & later: Get the long description if we can. */
-  if(SecCertificateCopyLongDescription)
-    server_cert_summary =
-      SecCertificateCopyLongDescription(NULL, cert, NULL);
-  else
-#endif /* CURL_BUILD_MAC_10_7 */
-#if CURL_BUILD_MAC_10_6
-  /* Snow Leopard: Get the certificate summary. */
-  if(SecCertificateCopySubjectSummary)
-    server_cert_summary = SecCertificateCopySubjectSummary(cert);
-  else
-#endif /* CURL_BUILD_MAC_10_6 */
-  /* Leopard is as far back as we go... */
-  (void)SecCertificateCopyCommonName(cert, &server_cert_summary);
-#endif /* CURL_BUILD_IOS */
-  return server_cert_summary;
-}
-
-static CURLcode CopyCertSubject(struct Curl_easy *data,
-                                SecCertificateRef cert, char **certp)
-{
-  CFStringRef c = getsubject(cert);
-  CURLcode result = CURLE_OK;
-  const char *direct;
-  char *cbuf = NULL;
-  *certp = NULL;
-
-  if(!c) {
-    failf(data, "SSL: invalid CA certificate subject");
-    return CURLE_PEER_FAILED_VERIFICATION;
-  }
-
-  /* If the subject is already available as UTF-8 encoded (ie 'direct') then
-     use that, else convert it. */
-  direct = CFStringGetCStringPtr(c, kCFStringEncodingUTF8);
-  if(direct) {
-    *certp = strdup(direct);
-    if(!*certp) {
-      failf(data, "SSL: out of memory");
-      result = CURLE_OUT_OF_MEMORY;
-    }
-  }
-  else {
-    size_t cbuf_size = ((size_t)CFStringGetLength(c) * 4) + 1;
-    cbuf = calloc(cbuf_size, 1);
-    if(cbuf) {
-      if(!CFStringGetCString(c, cbuf, cbuf_size,
-                             kCFStringEncodingUTF8)) {
-        failf(data, "SSL: invalid CA certificate subject");
-        result = CURLE_PEER_FAILED_VERIFICATION;
-      }
-      else
-        /* pass back the buffer */
-        *certp = cbuf;
-    }
-    else {
-      failf(data, "SSL: couldn't allocate %zu bytes of memory", cbuf_size);
-      result = CURLE_OUT_OF_MEMORY;
-    }
-  }
-  if(result)
-    free(cbuf);
-  CFRelease(c);
-  return result;
-}
-
-#if CURL_SUPPORT_MAC_10_6
-/* The SecKeychainSearch API was deprecated in Lion, and using it will raise
-   deprecation warnings, so let's not compile this unless it's necessary: */
-static OSStatus CopyIdentityWithLabelOldSchool(char *label,
-                                               SecIdentityRef *out_c_a_k)
-{
-  OSStatus status = errSecItemNotFound;
-  SecKeychainAttributeList attr_list;
-  SecKeychainAttribute attr;
-  SecKeychainSearchRef search = NULL;
-  SecCertificateRef cert = NULL;
-
-  /* Set up the attribute list: */
-  attr_list.count = 1L;
-  attr_list.attr = &attr;
-
-  /* Set up our lone search criterion: */
-  attr.tag = kSecLabelItemAttr;
-  attr.data = label;
-  attr.length = (UInt32)strlen(label);
-
-  /* Start searching: */
-  status = SecKeychainSearchCreateFromAttributes(NULL,
-                                                 kSecCertificateItemClass,
-                                                 &attr_list,
-                                                 &search);
-  if(status == noErr) {
-    status = SecKeychainSearchCopyNext(search,
-                                       (SecKeychainItemRef *)&cert);
-    if(status == noErr && cert) {
-      /* If we found a certificate, does it have a private key? */
-      status = SecIdentityCreateWithCertificate(NULL, cert, out_c_a_k);
-      CFRelease(cert);
-    }
-  }
-
-  if(search)
-    CFRelease(search);
-  return status;
-}
-#endif /* CURL_SUPPORT_MAC_10_6 */
-
-static OSStatus CopyIdentityWithLabel(char *label,
-                                      SecIdentityRef *out_cert_and_key)
-{
-  OSStatus status = errSecItemNotFound;
-
-#if CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS
-  CFArrayRef keys_list;
-  CFIndex keys_list_count;
-  CFIndex i;
-
-  /* SecItemCopyMatching() was introduced in iOS and Snow Leopard.
-     kSecClassIdentity was introduced in Lion. If both exist, let's use them
-     to find the certificate. */
-  if(SecItemCopyMatching && kSecClassIdentity) {
-    CFTypeRef keys[5];
-    CFTypeRef values[5];
-    CFDictionaryRef query_dict;
-    CFStringRef label_cf = CFStringCreateWithCString(NULL, label,
-      kCFStringEncodingUTF8);
-
-    /* Set up our search criteria and expected results: */
-    values[0] = kSecClassIdentity; /* we want a certificate and a key */
-    keys[0] = kSecClass;
-    values[1] = kCFBooleanTrue;    /* we want a reference */
-    keys[1] = kSecReturnRef;
-    values[2] = kSecMatchLimitAll; /* kSecMatchLimitOne would be better if the
-                                    * label matching below worked correctly */
-    keys[2] = kSecMatchLimit;
-    /* identity searches need a SecPolicyRef in order to work */
-    values[3] = SecPolicyCreateSSL(false, NULL);
-    keys[3] = kSecMatchPolicy;
-    /* match the name of the certificate (doesn't work in macOS 10.12.1) */
-    values[4] = label_cf;
-    keys[4] = kSecAttrLabel;
-    query_dict = CFDictionaryCreate(NULL, (const void **)keys,
-                                    (const void **)values, 5L,
-                                    &kCFCopyStringDictionaryKeyCallBacks,
-                                    &kCFTypeDictionaryValueCallBacks);
-    CFRelease(values[3]);
-
-    /* Do we have a match? */
-    status = SecItemCopyMatching(query_dict, (CFTypeRef *) &keys_list);
-
-    /* Because kSecAttrLabel matching doesn't work with kSecClassIdentity,
-     * we need to find the correct identity ourselves */
-    if(status == noErr) {
-      keys_list_count = CFArrayGetCount(keys_list);
-      *out_cert_and_key = NULL;
-      status = 1;
-      for(i = 0; i<keys_list_count; i++) {
-        OSStatus err = noErr;
-        SecCertificateRef cert = NULL;
-        SecIdentityRef identity =
-          (SecIdentityRef) CFArrayGetValueAtIndex(keys_list, i);
-        err = SecIdentityCopyCertificate(identity, &cert);
-        if(err == noErr) {
-          CFStringRef common_name = NULL;
-          OSStatus copy_status = noErr;
-#if CURL_BUILD_IOS
-          common_name = SecCertificateCopySubjectSummary(cert);
-#elif CURL_BUILD_MAC_10_7
-          copy_status = SecCertificateCopyCommonName(cert, &common_name);
-#endif
-          if(copy_status == noErr &&
-            CFStringCompare(common_name, label_cf, 0) == kCFCompareEqualTo) {
-            CFRelease(cert);
-            CFRelease(common_name);
-            CFRetain(identity);
-            *out_cert_and_key = identity;
-            status = noErr;
-            break;
-          }
-          if(common_name)
-            CFRelease(common_name);
-        }
-        CFRelease(cert);
-      }
-    }
-
-    if(keys_list)
-      CFRelease(keys_list);
-    CFRelease(query_dict);
-    CFRelease(label_cf);
-  }
-  else {
-#if CURL_SUPPORT_MAC_10_6
-    /* On Leopard and Snow Leopard, fall back to SecKeychainSearch. */
-    status = CopyIdentityWithLabelOldSchool(label, out_cert_and_key);
-#endif /* CURL_SUPPORT_MAC_10_6 */
-  }
-#elif CURL_SUPPORT_MAC_10_6
-  /* For developers building on older cats, we have no choice but to fall back
-     to SecKeychainSearch. */
-  status = CopyIdentityWithLabelOldSchool(label, out_cert_and_key);
-#endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */
-  return status;
-}
-
-static OSStatus CopyIdentityFromPKCS12File(const char *cPath,
-                                           const struct curl_blob *blob,
-                                           const char *cPassword,
-                                           SecIdentityRef *out_cert_and_key)
-{
-  OSStatus status = errSecItemNotFound;
-  CFURLRef pkcs_url = NULL;
-  CFStringRef password = cPassword ? CFStringCreateWithCString(NULL,
-    cPassword, kCFStringEncodingUTF8) : NULL;
-  CFDataRef pkcs_data = NULL;
-
-  /* We can import P12 files on iOS or OS X 10.7 or later: */
-  /* These constants are documented as having first appeared in 10.6 but they
-     raise linker errors when used on that cat for some reason. */
-#if CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS
-  bool resource_imported;
-
-  if(blob) {
-    pkcs_data = CFDataCreate(kCFAllocatorDefault,
-                             (const unsigned char *)blob->data, blob->len);
-    status = (pkcs_data != NULL) ? errSecSuccess : errSecAllocate;
-    resource_imported = (pkcs_data != NULL);
-  }
-  else {
-    pkcs_url =
-      CFURLCreateFromFileSystemRepresentation(NULL,
-                                              (const UInt8 *)cPath,
-                                              strlen(cPath), false);
-    resource_imported =
-      CFURLCreateDataAndPropertiesFromResource(NULL,
-                                               pkcs_url, &pkcs_data,
-                                               NULL, NULL, &status);
-  }
-
-  if(resource_imported) {
-    CFArrayRef items = NULL;
-
-  /* On iOS SecPKCS12Import will never add the client certificate to the
-   * Keychain.
-   *
-   * It gives us back a SecIdentityRef that we can use directly. */
-#if CURL_BUILD_IOS
-    const void *cKeys[] = {kSecImportExportPassphrase};
-    const void *cValues[] = {password};
-    CFDictionaryRef options = CFDictionaryCreate(NULL, cKeys, cValues,
-      password ? 1L : 0L, NULL, NULL);
-
-    if(options) {
-      status = SecPKCS12Import(pkcs_data, options, &items);
-      CFRelease(options);
-    }
-
-
-  /* On macOS SecPKCS12Import will always add the client certificate to
-   * the Keychain.
-   *
-   * As this doesn't match iOS, and apps may not want to see their client
-   * certificate saved in the user's keychain, we use SecItemImport
-   * with a NULL keychain to avoid importing it.
-   *
-   * This returns a SecCertificateRef from which we can construct a
-   * SecIdentityRef.
-   */
-#elif CURL_BUILD_MAC_10_7
-    SecItemImportExportKeyParameters keyParams;
-    SecExternalFormat inputFormat = kSecFormatPKCS12;
-    SecExternalItemType inputType = kSecItemTypeCertificate;
-
-    memset(&keyParams, 0x00, sizeof(keyParams));
-    keyParams.version    = SEC_KEY_IMPORT_EXPORT_PARAMS_VERSION;
-    keyParams.passphrase = password;
-
-    status = SecItemImport(pkcs_data, NULL, &inputFormat, &inputType,
-                           0, &keyParams, NULL, &items);
-#endif
-
-
-    /* Extract the SecIdentityRef */
-    if(status == errSecSuccess && items && CFArrayGetCount(items)) {
-      CFIndex i, count;
-      count = CFArrayGetCount(items);
-
-      for(i = 0; i < count; i++) {
-        CFTypeRef item = (CFTypeRef) CFArrayGetValueAtIndex(items, i);
-        CFTypeID  itemID = CFGetTypeID(item);
-
-        if(itemID == CFDictionaryGetTypeID()) {
-          CFTypeRef identity = (CFTypeRef) CFDictionaryGetValue(
-                                                 (CFDictionaryRef) item,
-                                                 kSecImportItemIdentity);
-          CFRetain(identity);
-          *out_cert_and_key = (SecIdentityRef) identity;
-          break;
-        }
-#if CURL_BUILD_MAC_10_7
-        else if(itemID == SecCertificateGetTypeID()) {
-          status = SecIdentityCreateWithCertificate(NULL,
-                                                 (SecCertificateRef) item,
-                                                 out_cert_and_key);
-          break;
-        }
-#endif
-      }
-    }
-
-    if(items)
-      CFRelease(items);
-    CFRelease(pkcs_data);
-  }
-#endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */
-  if(password)
-    CFRelease(password);
-  if(pkcs_url)
-    CFRelease(pkcs_url);
-  return status;
-}
-
-/* This code was borrowed from nss.c, with some modifications:
- * Determine whether the nickname passed in is a filename that needs to
- * be loaded as a PEM or a nickname.
- *
- * returns 1 for a file
- * returns 0 for not a file
- */
-CF_INLINE bool is_file(const char *filename)
-{
-  struct_stat st;
-
-  if(!filename)
-    return false;
-
-  if(stat(filename, &st) == 0)
-    return S_ISREG(st.st_mode);
-  return false;
-}
-
-#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
-static CURLcode sectransp_version_from_curl(SSLProtocol *darwinver,
-                                            long ssl_version)
-{
-  switch(ssl_version) {
-    case CURL_SSLVERSION_TLSv1_0:
-      *darwinver = kTLSProtocol1;
-      return CURLE_OK;
-    case CURL_SSLVERSION_TLSv1_1:
-      *darwinver = kTLSProtocol11;
-      return CURLE_OK;
-    case CURL_SSLVERSION_TLSv1_2:
-      *darwinver = kTLSProtocol12;
-      return CURLE_OK;
-    case CURL_SSLVERSION_TLSv1_3:
-      /* TLS 1.3 support first appeared in iOS 11 and macOS 10.13 */
-#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
-      if(__builtin_available(macOS 10.13, iOS 11.0, *)) {
-        *darwinver = kTLSProtocol13;
-        return CURLE_OK;
-      }
-#endif /* (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) &&
-          HAVE_BUILTIN_AVAILABLE == 1 */
-      break;
-  }
-  return CURLE_SSL_CONNECT_ERROR;
-}
-#endif
-
-static CURLcode set_ssl_version_min_max(struct Curl_cfilter *cf,
-                                        struct Curl_easy *data)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct st_ssl_backend_data *backend =
-    (struct st_ssl_backend_data *)connssl->backend;
-  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
-  long ssl_version = conn_config->version;
-  long ssl_version_max = conn_config->version_max;
-  long max_supported_version_by_os;
-
-  DEBUGASSERT(backend);
-
-  /* macOS 10.5-10.7 supported TLS 1.0 only.
-     macOS 10.8 and later, and iOS 5 and later, added TLS 1.1 and 1.2.
-     macOS 10.13 and later, and iOS 11 and later, added TLS 1.3. */
-#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
-  if(__builtin_available(macOS 10.13, iOS 11.0, *)) {
-    max_supported_version_by_os = CURL_SSLVERSION_MAX_TLSv1_3;
-  }
-  else {
-    max_supported_version_by_os = CURL_SSLVERSION_MAX_TLSv1_2;
-  }
-#else
-  max_supported_version_by_os = CURL_SSLVERSION_MAX_TLSv1_2;
-#endif /* (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) &&
-          HAVE_BUILTIN_AVAILABLE == 1 */
-
-  switch(ssl_version) {
-    case CURL_SSLVERSION_DEFAULT:
-    case CURL_SSLVERSION_TLSv1:
-      ssl_version = CURL_SSLVERSION_TLSv1_0;
-      break;
-  }
-
-  switch(ssl_version_max) {
-    case CURL_SSLVERSION_MAX_NONE:
-    case CURL_SSLVERSION_MAX_DEFAULT:
-      ssl_version_max = max_supported_version_by_os;
-      break;
-  }
-
-#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
-  if(SSLSetProtocolVersionMax) {
-    SSLProtocol darwin_ver_min = kTLSProtocol1;
-    SSLProtocol darwin_ver_max = kTLSProtocol1;
-    CURLcode result = sectransp_version_from_curl(&darwin_ver_min,
-                                                  ssl_version);
-    if(result) {
-      failf(data, "unsupported min version passed via CURLOPT_SSLVERSION");
-      return result;
-    }
-    result = sectransp_version_from_curl(&darwin_ver_max,
-                                         ssl_version_max >> 16);
-    if(result) {
-      failf(data, "unsupported max version passed via CURLOPT_SSLVERSION");
-      return result;
-    }
-
-    (void)SSLSetProtocolVersionMin(backend->ssl_ctx, darwin_ver_min);
-    (void)SSLSetProtocolVersionMax(backend->ssl_ctx, darwin_ver_max);
-    return result;
-  }
-  else {
-#if CURL_SUPPORT_MAC_10_8
-    long i = ssl_version;
-    (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                       kSSLProtocolAll,
-                                       false);
-    for(; i <= (ssl_version_max >> 16); i++) {
-      switch(i) {
-        case CURL_SSLVERSION_TLSv1_0:
-          (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                            kTLSProtocol1,
-                                            true);
-          break;
-        case CURL_SSLVERSION_TLSv1_1:
-          (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                            kTLSProtocol11,
-                                            true);
-          break;
-        case CURL_SSLVERSION_TLSv1_2:
-          (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                            kTLSProtocol12,
-                                            true);
-          break;
-        case CURL_SSLVERSION_TLSv1_3:
-          failf(data, "Your version of the OS does not support TLSv1.3");
-          return CURLE_SSL_CONNECT_ERROR;
-      }
-    }
-    return CURLE_OK;
-#endif  /* CURL_SUPPORT_MAC_10_8 */
-  }
-#endif  /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
-  failf(data, "Secure Transport: cannot set SSL protocol");
-  return CURLE_SSL_CONNECT_ERROR;
-}
-
-static bool is_cipher_suite_strong(SSLCipherSuite suite_num)
-{
-  size_t i;
-  for(i = 0; i < NUM_OF_CIPHERS; ++i) {
-    if(ciphertable[i].num == suite_num) {
-      return !ciphertable[i].weak;
-    }
-  }
-  /* If the cipher is not in our list, assume it is a new one
-     and therefore strong. Previous implementation was the same,
-     if cipher suite is not in the list, it was considered strong enough */
-  return true;
-}
-
-static bool is_separator(char c)
-{
-  /* Return whether character is a cipher list separator. */
-  switch(c) {
-  case ' ':
-  case '\t':
-  case ':':
-  case ',':
-  case ';':
-    return true;
-  }
-  return false;
-}
-
-static CURLcode sectransp_set_default_ciphers(struct Curl_easy *data,
-                                              SSLContextRef ssl_ctx)
-{
-  size_t all_ciphers_count = 0UL, allowed_ciphers_count = 0UL, i;
-  SSLCipherSuite *all_ciphers = NULL, *allowed_ciphers = NULL;
-  OSStatus err = noErr;
-
-#if CURL_BUILD_MAC
-  int darwinver_maj = 0, darwinver_min = 0;
-
-  GetDarwinVersionNumber(&darwinver_maj, &darwinver_min);
-#endif /* CURL_BUILD_MAC */
-
-  /* Disable cipher suites that ST supports but are not safe. These ciphers
-     are unlikely to be used in any case since ST gives other ciphers a much
-     higher priority, but it's probably better that we not connect at all than
-     to give the user a false sense of security if the server only supports
-     insecure ciphers. (Note: We don't care about SSLv2-only ciphers.) */
-  err = SSLGetNumberSupportedCiphers(ssl_ctx, &all_ciphers_count);
-  if(err != noErr) {
-    failf(data, "SSL: SSLGetNumberSupportedCiphers() failed: OSStatus %d",
-          err);
-    return CURLE_SSL_CIPHER;
-  }
-  all_ciphers = malloc(all_ciphers_count*sizeof(SSLCipherSuite));
-  if(!all_ciphers) {
-    failf(data, "SSL: Failed to allocate memory for all ciphers");
-    return CURLE_OUT_OF_MEMORY;
-  }
-  allowed_ciphers = malloc(all_ciphers_count*sizeof(SSLCipherSuite));
-  if(!allowed_ciphers) {
-    Curl_safefree(all_ciphers);
-    failf(data, "SSL: Failed to allocate memory for allowed ciphers");
-    return CURLE_OUT_OF_MEMORY;
-  }
-  err = SSLGetSupportedCiphers(ssl_ctx, all_ciphers,
-                               &all_ciphers_count);
-  if(err != noErr) {
-    Curl_safefree(all_ciphers);
-    Curl_safefree(allowed_ciphers);
-    return CURLE_SSL_CIPHER;
-  }
-  for(i = 0UL ; i < all_ciphers_count ; i++) {
-#if CURL_BUILD_MAC
-   /* There's a known bug in early versions of Mountain Lion where ST's ECC
-      ciphers (cipher suite 0xC001 through 0xC032) simply do not work.
-      Work around the problem here by disabling those ciphers if we are
-      running in an affected version of OS X. */
-    if(darwinver_maj == 12 && darwinver_min <= 3 &&
-       all_ciphers[i] >= 0xC001 && all_ciphers[i] <= 0xC032) {
-      continue;
-    }
-#endif /* CURL_BUILD_MAC */
-    if(is_cipher_suite_strong(all_ciphers[i])) {
-      allowed_ciphers[allowed_ciphers_count++] = all_ciphers[i];
-    }
-  }
-  err = SSLSetEnabledCiphers(ssl_ctx, allowed_ciphers,
-                             allowed_ciphers_count);
-  Curl_safefree(all_ciphers);
-  Curl_safefree(allowed_ciphers);
-  if(err != noErr) {
-    failf(data, "SSL: SSLSetEnabledCiphers() failed: OSStatus %d", err);
-    return CURLE_SSL_CIPHER;
-  }
-  return CURLE_OK;
-}
-
-static CURLcode sectransp_set_selected_ciphers(struct Curl_easy *data,
-                                               SSLContextRef ssl_ctx,
-                                               const char *ciphers)
-{
-  size_t ciphers_count = 0;
-  const char *cipher_start = ciphers;
-  OSStatus err = noErr;
-  SSLCipherSuite selected_ciphers[NUM_OF_CIPHERS];
-
-  if(!ciphers)
-    return CURLE_OK;
-
-  while(is_separator(*ciphers))     /* Skip initial separators. */
-    ciphers++;
-  if(!*ciphers)
-    return CURLE_OK;
-
-  cipher_start = ciphers;
-  while(*cipher_start && ciphers_count < NUM_OF_CIPHERS) {
-    bool cipher_found = FALSE;
-    size_t cipher_len = 0;
-    const char *cipher_end = NULL;
-    bool tls_name = FALSE;
-    size_t i;
-
-    /* Skip separators */
-    while(is_separator(*cipher_start))
-      cipher_start++;
-    if(*cipher_start == '\0') {
-      break;
-    }
-    /* Find last position of a cipher in the ciphers string */
-    cipher_end = cipher_start;
-    while(*cipher_end != '\0' && !is_separator(*cipher_end)) {
-      ++cipher_end;
-    }
-
-    /* IANA cipher names start with the TLS_ or SSL_ prefix.
-       If the 4th symbol of the cipher is '_' we look for a cipher in the
-       table by its (TLS) name.
-       Otherwise, we try to match cipher by an alias. */
-    if(cipher_start[3] == '_') {
-      tls_name = TRUE;
-    }
-    /* Iterate through the cipher table and look for the cipher, starting
-       the cipher number 0x01 because the 0x00 is not the real cipher */
-    cipher_len = cipher_end - cipher_start;
-    for(i = 1; i < NUM_OF_CIPHERS; ++i) {
-      const char *table_cipher_name = NULL;
-      if(tls_name) {
-        table_cipher_name = ciphertable[i].name;
-      }
-      else if(ciphertable[i].alias_name) {
-        table_cipher_name = ciphertable[i].alias_name;
-      }
-      else {
-        continue;
-      }
-      /* Compare a part of the string between separators with a cipher name
-         in the table and make sure we matched the whole cipher name */
-      if(strncmp(cipher_start, table_cipher_name, cipher_len) == 0
-          && table_cipher_name[cipher_len] == '\0') {
-        selected_ciphers[ciphers_count] = ciphertable[i].num;
-        ++ciphers_count;
-        cipher_found = TRUE;
-        break;
-      }
-    }
-    if(!cipher_found) {
-      /* It would be more human-readable if we print the wrong cipher name
-         but we don't want to allocate any additional memory and copy the name
-         into it, then add it into logs.
-         Also, we do not modify an original cipher list string. We just point
-         to positions where cipher starts and ends in the cipher list string.
-         The message is a bit cryptic and longer than necessary but can be
-         understood by humans. */
-      failf(data, "SSL: cipher string \"%s\" contains unsupported cipher name"
-            " starting position %zd and ending position %zd",
-            ciphers,
-            cipher_start - ciphers,
-            cipher_end - ciphers);
-      return CURLE_SSL_CIPHER;
-    }
-    if(*cipher_end) {
-      cipher_start = cipher_end + 1;
-    }
-    else {
-      break;
-    }
-  }
-  /* All cipher suites in the list are found. Report to logs as-is */
-  infof(data, "SSL: Setting cipher suites list \"%s\"", ciphers);
-
-  err = SSLSetEnabledCiphers(ssl_ctx, selected_ciphers, ciphers_count);
-  if(err != noErr) {
-    failf(data, "SSL: SSLSetEnabledCiphers() failed: OSStatus %d", err);
-    return CURLE_SSL_CIPHER;
-  }
-  return CURLE_OK;
-}
-
-static CURLcode sectransp_connect_step1(struct Curl_cfilter *cf,
-                                        struct Curl_easy *data)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct st_ssl_backend_data *backend =
-    (struct st_ssl_backend_data *)connssl->backend;
-  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
-  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
-  const struct curl_blob *ssl_cablob = conn_config->ca_info_blob;
-  const char * const ssl_cafile =
-    /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
-    (ssl_cablob ? NULL : conn_config->CAfile);
-  const bool verifypeer = conn_config->verifypeer;
-  char * const ssl_cert = ssl_config->primary.clientcert;
-  const struct curl_blob *ssl_cert_blob = ssl_config->primary.cert_blob;
-#ifdef ENABLE_IPV6
-  struct in6_addr addr;
-#else
-  struct in_addr addr;
-#endif /* ENABLE_IPV6 */
-  char *ciphers;
-  OSStatus err = noErr;
-#if CURL_BUILD_MAC
-  int darwinver_maj = 0, darwinver_min = 0;
-
-  DEBUGASSERT(backend);
-
-  CURL_TRC_CF(data, cf, "connect_step1");
-  GetDarwinVersionNumber(&darwinver_maj, &darwinver_min);
-#endif /* CURL_BUILD_MAC */
-
-#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
-  if(SSLCreateContext) {  /* use the newer API if available */
-    if(backend->ssl_ctx)
-      CFRelease(backend->ssl_ctx);
-    backend->ssl_ctx = SSLCreateContext(NULL, kSSLClientSide, kSSLStreamType);
-    if(!backend->ssl_ctx) {
-      failf(data, "SSL: couldn't create a context");
-      return CURLE_OUT_OF_MEMORY;
-    }
-  }
-  else {
-  /* The old ST API does not exist under iOS, so don't compile it: */
-#if CURL_SUPPORT_MAC_10_8
-    if(backend->ssl_ctx)
-      (void)SSLDisposeContext(backend->ssl_ctx);
-    err = SSLNewContext(false, &(backend->ssl_ctx));
-    if(err != noErr) {
-      failf(data, "SSL: couldn't create a context: OSStatus %d", err);
-      return CURLE_OUT_OF_MEMORY;
-    }
-#endif /* CURL_SUPPORT_MAC_10_8 */
-  }
-#else
-  if(backend->ssl_ctx)
-    (void)SSLDisposeContext(backend->ssl_ctx);
-  err = SSLNewContext(false, &(backend->ssl_ctx));
-  if(err != noErr) {
-    failf(data, "SSL: couldn't create a context: OSStatus %d", err);
-    return CURLE_OUT_OF_MEMORY;
-  }
-#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
-  backend->ssl_write_buffered_length = 0UL; /* reset buffered write length */
-
-  /* check to see if we've been told to use an explicit SSL/TLS version */
-#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
-  if(SSLSetProtocolVersionMax) {
-    switch(conn_config->version) {
-    case CURL_SSLVERSION_TLSv1:
-      (void)SSLSetProtocolVersionMin(backend->ssl_ctx, kTLSProtocol1);
-#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
-      if(__builtin_available(macOS 10.13, iOS 11.0, *)) {
-        (void)SSLSetProtocolVersionMax(backend->ssl_ctx, kTLSProtocol13);
-      }
-      else {
-        (void)SSLSetProtocolVersionMax(backend->ssl_ctx, kTLSProtocol12);
-      }
-#else
-      (void)SSLSetProtocolVersionMax(backend->ssl_ctx, kTLSProtocol12);
-#endif /* (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) &&
-          HAVE_BUILTIN_AVAILABLE == 1 */
-      break;
-    case CURL_SSLVERSION_DEFAULT:
-    case CURL_SSLVERSION_TLSv1_0:
-    case CURL_SSLVERSION_TLSv1_1:
-    case CURL_SSLVERSION_TLSv1_2:
-    case CURL_SSLVERSION_TLSv1_3:
-      {
-        CURLcode result = set_ssl_version_min_max(cf, data);
-        if(result != CURLE_OK)
-          return result;
-        break;
-      }
-    case CURL_SSLVERSION_SSLv3:
-    case CURL_SSLVERSION_SSLv2:
-      failf(data, "SSL versions not supported");
-      return CURLE_NOT_BUILT_IN;
-    default:
-      failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-  }
-  else {
-#if CURL_SUPPORT_MAC_10_8
-    (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                       kSSLProtocolAll,
-                                       false);
-    switch(conn_config->version) {
-    case CURL_SSLVERSION_DEFAULT:
-    case CURL_SSLVERSION_TLSv1:
-      (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                         kTLSProtocol1,
-                                         true);
-      (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                         kTLSProtocol11,
-                                         true);
-      (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                         kTLSProtocol12,
-                                         true);
-      break;
-    case CURL_SSLVERSION_TLSv1_0:
-    case CURL_SSLVERSION_TLSv1_1:
-    case CURL_SSLVERSION_TLSv1_2:
-    case CURL_SSLVERSION_TLSv1_3:
-      {
-        CURLcode result = set_ssl_version_min_max(cf, data);
-        if(result != CURLE_OK)
-          return result;
-        break;
-      }
-    case CURL_SSLVERSION_SSLv3:
-    case CURL_SSLVERSION_SSLv2:
-      failf(data, "SSL versions not supported");
-      return CURLE_NOT_BUILT_IN;
-    default:
-      failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-#endif  /* CURL_SUPPORT_MAC_10_8 */
-  }
-#else
-  if(conn_config->version_max != CURL_SSLVERSION_MAX_NONE) {
-    failf(data, "Your version of the OS does not support to set maximum"
-                " SSL/TLS version");
-    return CURLE_SSL_CONNECT_ERROR;
-  }
-  (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx, kSSLProtocolAll, false);
-  switch(conn_config->version) {
-  case CURL_SSLVERSION_DEFAULT:
-  case CURL_SSLVERSION_TLSv1:
-  case CURL_SSLVERSION_TLSv1_0:
-    (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                       kTLSProtocol1,
-                                       true);
-    break;
-  case CURL_SSLVERSION_TLSv1_1:
-    failf(data, "Your version of the OS does not support TLSv1.1");
-    return CURLE_SSL_CONNECT_ERROR;
-  case CURL_SSLVERSION_TLSv1_2:
-    failf(data, "Your version of the OS does not support TLSv1.2");
-    return CURLE_SSL_CONNECT_ERROR;
-  case CURL_SSLVERSION_TLSv1_3:
-    failf(data, "Your version of the OS does not support TLSv1.3");
-    return CURLE_SSL_CONNECT_ERROR;
-  case CURL_SSLVERSION_SSLv2:
-  case CURL_SSLVERSION_SSLv3:
-    failf(data, "SSL versions not supported");
-    return CURLE_NOT_BUILT_IN;
-  default:
-    failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
-    return CURLE_SSL_CONNECT_ERROR;
-  }
-#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
-
-#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
-  if(connssl->alpn) {
-    if(__builtin_available(macOS 10.13.4, iOS 11, tvOS 11, *)) {
-      struct alpn_proto_buf proto;
-      size_t i;
-      CFStringRef cstr;
-      CFMutableArrayRef alpnArr = CFArrayCreateMutable(NULL, 0,
-                                                       &kCFTypeArrayCallBacks);
-      for(i = 0; i < connssl->alpn->count; ++i) {
-        cstr = CFStringCreateWithCString(NULL, connssl->alpn->entries[i],
-                                         kCFStringEncodingUTF8);
-        if(!cstr)
-          return CURLE_OUT_OF_MEMORY;
-        CFArrayAppendValue(alpnArr, cstr);
-        CFRelease(cstr);
-      }
-      err = SSLSetALPNProtocols(backend->ssl_ctx, alpnArr);
-      if(err != noErr)
-        infof(data, "WARNING: failed to set ALPN protocols; OSStatus %d",
-              err);
-      CFRelease(alpnArr);
-      Curl_alpn_to_proto_str(&proto, connssl->alpn);
-      infof(data, VTLS_INFOF_ALPN_OFFER_1STR, proto.data);
-    }
-  }
-#endif
-
-  if(ssl_config->key) {
-    infof(data, "WARNING: SSL: CURLOPT_SSLKEY is ignored by Secure "
-          "Transport. The private key must be in the Keychain.");
-  }
-
-  if(ssl_cert || ssl_cert_blob) {
-    bool is_cert_data = ssl_cert_blob != NULL;
-    bool is_cert_file = (!is_cert_data) && is_file(ssl_cert);
-    SecIdentityRef cert_and_key = NULL;
-
-    /* User wants to authenticate with a client cert. Look for it. Assume that
-       the user wants to use an identity loaded from the Keychain. If not, try
-       it as a file on disk */
-
-    if(!is_cert_data)
-      err = CopyIdentityWithLabel(ssl_cert, &cert_and_key);
-    else
-      err = !noErr;
-    if((err != noErr) && (is_cert_file || is_cert_data)) {
-      if(!ssl_config->cert_type)
-        infof(data, "SSL: Certificate type not set, assuming "
-              "PKCS#12 format.");
-      else if(!strcasecompare(ssl_config->cert_type, "P12")) {
-        failf(data, "SSL: The Security framework only supports "
-              "loading identities that are in PKCS#12 format.");
-        return CURLE_SSL_CERTPROBLEM;
-      }
-
-      err = CopyIdentityFromPKCS12File(ssl_cert, ssl_cert_blob,
-                                       ssl_config->key_passwd,
-                                       &cert_and_key);
-    }
-
-    if(err == noErr && cert_and_key) {
-      SecCertificateRef cert = NULL;
-      CFTypeRef certs_c[1];
-      CFArrayRef certs;
-
-      /* If we found one, print it out: */
-      err = SecIdentityCopyCertificate(cert_and_key, &cert);
-      if(err == noErr) {
-        char *certp;
-        CURLcode result = CopyCertSubject(data, cert, &certp);
-        if(!result) {
-          infof(data, "Client certificate: %s", certp);
-          free(certp);
-        }
-
-        CFRelease(cert);
-        if(result == CURLE_PEER_FAILED_VERIFICATION)
-          return CURLE_SSL_CERTPROBLEM;
-        if(result)
-          return result;
-      }
-      certs_c[0] = cert_and_key;
-      certs = CFArrayCreate(NULL, (const void **)certs_c, 1L,
-                            &kCFTypeArrayCallBacks);
-      err = SSLSetCertificate(backend->ssl_ctx, certs);
-      if(certs)
-        CFRelease(certs);
-      if(err != noErr) {
-        failf(data, "SSL: SSLSetCertificate() failed: OSStatus %d", err);
-        return CURLE_SSL_CERTPROBLEM;
-      }
-      CFRelease(cert_and_key);
-    }
-    else {
-      const char *cert_showfilename_error =
-        is_cert_data ? "(memory blob)" : ssl_cert;
-
-      switch(err) {
-      case errSecAuthFailed: case -25264: /* errSecPkcs12VerifyFailure */
-        failf(data, "SSL: Incorrect password for the certificate \"%s\" "
-                    "and its private key.", cert_showfilename_error);
-        break;
-      case -26275: /* errSecDecode */ case -25257: /* errSecUnknownFormat */
-        failf(data, "SSL: Couldn't make sense of the data in the "
-                    "certificate \"%s\" and its private key.",
-                    cert_showfilename_error);
-        break;
-      case -25260: /* errSecPassphraseRequired */
-        failf(data, "SSL The certificate \"%s\" requires a password.",
-                    cert_showfilename_error);
-        break;
-      case errSecItemNotFound:
-        failf(data, "SSL: Can't find the certificate \"%s\" and its private "
-                    "key in the Keychain.", cert_showfilename_error);
-        break;
-      default:
-        failf(data, "SSL: Can't load the certificate \"%s\" and its private "
-                    "key: OSStatus %d", cert_showfilename_error, err);
-        break;
-      }
-      return CURLE_SSL_CERTPROBLEM;
-    }
-  }
-
-  /* SSL always tries to verify the peer, this only says whether it should
-   * fail to connect if the verification fails, or if it should continue
-   * anyway. In the latter case the result of the verification is checked with
-   * SSL_get_verify_result() below. */
-#if CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS
-  /* Snow Leopard introduced the SSLSetSessionOption() function, but due to
-     a library bug with the way the kSSLSessionOptionBreakOnServerAuth flag
-     works, it doesn't work as expected under Snow Leopard, Lion or
-     Mountain Lion.
-     So we need to call SSLSetEnableCertVerify() on those older cats in order
-     to disable certificate validation if the user turned that off.
-     (SecureTransport will always validate the certificate chain by
-     default.)
-  Note:
-  Darwin 11.x.x is Lion (10.7)
-  Darwin 12.x.x is Mountain Lion (10.8)
-  Darwin 13.x.x is Mavericks (10.9)
-  Darwin 14.x.x is Yosemite (10.10)
-  Darwin 15.x.x is El Capitan (10.11)
-  */
-#if CURL_BUILD_MAC
-  if(SSLSetSessionOption && darwinver_maj >= 13) {
-#else
-  if(SSLSetSessionOption) {
-#endif /* CURL_BUILD_MAC */
-    bool break_on_auth = !conn_config->verifypeer ||
-      ssl_cafile || ssl_cablob;
-    err = SSLSetSessionOption(backend->ssl_ctx,
-                              kSSLSessionOptionBreakOnServerAuth,
-                              break_on_auth);
-    if(err != noErr) {
-      failf(data, "SSL: SSLSetSessionOption() failed: OSStatus %d", err);
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-  }
-  else {
-#if CURL_SUPPORT_MAC_10_8
-    err = SSLSetEnableCertVerify(backend->ssl_ctx,
-                                 conn_config->verifypeer?true:false);
-    if(err != noErr) {
-      failf(data, "SSL: SSLSetEnableCertVerify() failed: OSStatus %d", err);
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-#endif /* CURL_SUPPORT_MAC_10_8 */
-  }
-#else
-  err = SSLSetEnableCertVerify(backend->ssl_ctx,
-                               conn_config->verifypeer?true:false);
-  if(err != noErr) {
-    failf(data, "SSL: SSLSetEnableCertVerify() failed: OSStatus %d", err);
-    return CURLE_SSL_CONNECT_ERROR;
-  }
-#endif /* CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS */
-
-  if((ssl_cafile || ssl_cablob) && verifypeer) {
-    bool is_cert_data = ssl_cablob != NULL;
-    bool is_cert_file = (!is_cert_data) && is_file(ssl_cafile);
-
-    if(!(is_cert_file || is_cert_data)) {
-      failf(data, "SSL: can't load CA certificate file %s",
-            ssl_cafile ? ssl_cafile : "(blob memory)");
-      return CURLE_SSL_CACERT_BADFILE;
-    }
-  }
-
-  /* Configure hostname check. SNI is used if available.
-   * Both hostname check and SNI require SSLSetPeerDomainName().
-   * Also: the verifyhost setting influences SNI usage */
-  if(conn_config->verifyhost) {
-    size_t snilen;
-    char *snihost = Curl_ssl_snihost(data, connssl->hostname, &snilen);
-    if(!snihost) {
-      failf(data, "Failed to set SNI");
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-    err = SSLSetPeerDomainName(backend->ssl_ctx, snihost, snilen);
-
-    if(err != noErr) {
-      failf(data, "SSL: SSLSetPeerDomainName() failed: OSStatus %d",
-            err);
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-
-    if((Curl_inet_pton(AF_INET, connssl->hostname, &addr))
-  #ifdef ENABLE_IPV6
-    || (Curl_inet_pton(AF_INET6, connssl->hostname, &addr))
-  #endif
-       ) {
-      infof(data, "WARNING: using IP address, SNI is being disabled by "
-            "the OS.");
-    }
-  }
-  else {
-    infof(data, "WARNING: disabling hostname validation also disables SNI.");
-  }
-
-  ciphers = conn_config->cipher_list;
-  if(ciphers) {
-    err = sectransp_set_selected_ciphers(data, backend->ssl_ctx, ciphers);
-  }
-  else {
-    err = sectransp_set_default_ciphers(data, backend->ssl_ctx);
-  }
-  if(err != noErr) {
-    failf(data, "SSL: Unable to set ciphers for SSL/TLS handshake. "
-          "Error code: %d", err);
-    return CURLE_SSL_CIPHER;
-  }
-
-#if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7
-  /* We want to enable 1/n-1 when using a CBC cipher unless the user
-     specifically doesn't want us doing that: */
-  if(SSLSetSessionOption) {
-    SSLSetSessionOption(backend->ssl_ctx, kSSLSessionOptionSendOneByteRecord,
-                        !ssl_config->enable_beast);
-    SSLSetSessionOption(backend->ssl_ctx, kSSLSessionOptionFalseStart,
-                      ssl_config->falsestart); /* false start support */
-  }
-#endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */
-
-  /* Check if there's a cached ID we can/should use here! */
-  if(ssl_config->primary.sessionid) {
-    char *ssl_sessionid;
-    size_t ssl_sessionid_len;
-
-    Curl_ssl_sessionid_lock(data);
-    if(!Curl_ssl_getsessionid(cf, data, (void **)&ssl_sessionid,
-                              &ssl_sessionid_len)) {
-      /* we got a session id, use it! */
-      err = SSLSetPeerID(backend->ssl_ctx, ssl_sessionid, ssl_sessionid_len);
-      Curl_ssl_sessionid_unlock(data);
-      if(err != noErr) {
-        failf(data, "SSL: SSLSetPeerID() failed: OSStatus %d", err);
-        return CURLE_SSL_CONNECT_ERROR;
-      }
-      /* Informational message */
-      infof(data, "SSL reusing session ID");
-    }
-    /* If there isn't one, then let's make one up! This has to be done prior
-       to starting the handshake. */
-    else {
-      CURLcode result;
-      ssl_sessionid =
-        aprintf("%s:%d:%d:%s:%d",
-                ssl_cafile ? ssl_cafile : "(blob memory)",
-                verifypeer, conn_config->verifyhost, connssl->hostname,
-                connssl->port);
-      ssl_sessionid_len = strlen(ssl_sessionid);
-
-      err = SSLSetPeerID(backend->ssl_ctx, ssl_sessionid, ssl_sessionid_len);
-      if(err != noErr) {
-        Curl_ssl_sessionid_unlock(data);
-        failf(data, "SSL: SSLSetPeerID() failed: OSStatus %d", err);
-        return CURLE_SSL_CONNECT_ERROR;
-      }
-
-      result = Curl_ssl_addsessionid(cf, data, ssl_sessionid,
-                                     ssl_sessionid_len, NULL);
-      Curl_ssl_sessionid_unlock(data);
-      if(result) {
-        failf(data, "failed to store ssl session");
-        return result;
-      }
-    }
-  }
-
-  err = SSLSetIOFuncs(backend->ssl_ctx, bio_cf_in_read, bio_cf_out_write);
-  if(err != noErr) {
-    failf(data, "SSL: SSLSetIOFuncs() failed: OSStatus %d", err);
-    return CURLE_SSL_CONNECT_ERROR;
-  }
-
-  err = SSLSetConnection(backend->ssl_ctx, cf);
-  if(err != noErr) {
-    failf(data, "SSL: SSLSetConnection() failed: %d", err);
-    return CURLE_SSL_CONNECT_ERROR;
-  }
-
-  connssl->connecting_state = ssl_connect_2;
-  return CURLE_OK;
-}
-
-static long pem_to_der(const char *in, unsigned char **out, size_t *outlen)
-{
-  char *sep_start, *sep_end, *cert_start, *cert_end;
-  size_t i, j, err;
-  size_t len;
-  unsigned char *b64;
-
-  /* Jump through the separators at the beginning of the certificate. */
-  sep_start = strstr(in, "-----");
-  if(!sep_start)
-    return 0;
-  cert_start = strstr(sep_start + 1, "-----");
-  if(!cert_start)
-    return -1;
-
-  cert_start += 5;
-
-  /* Find separator after the end of the certificate. */
-  cert_end = strstr(cert_start, "-----");
-  if(!cert_end)
-    return -1;
-
-  sep_end = strstr(cert_end + 1, "-----");
-  if(!sep_end)
-    return -1;
-  sep_end += 5;
-
-  len = cert_end - cert_start;
-  b64 = malloc(len + 1);
-  if(!b64)
-    return -1;
-
-  /* Create base64 string without linefeeds. */
-  for(i = 0, j = 0; i < len; i++) {
-    if(cert_start[i] != '\r' && cert_start[i] != '\n')
-      b64[j++] = cert_start[i];
-  }
-  b64[j] = '\0';
-
-  err = Curl_base64_decode((const char *)b64, out, outlen);
-  free(b64);
-  if(err) {
-    free(*out);
-    return -1;
-  }
-
-  return sep_end - in;
-}
-
-#define MAX_CERTS_SIZE (50*1024*1024) /* arbitrary - to catch mistakes */
-
-static int read_cert(const char *file, unsigned char **out, size_t *outlen)
-{
-  int fd;
-  ssize_t n;
-  unsigned char buf[512];
-  struct dynbuf certs;
-
-  Curl_dyn_init(&certs, MAX_CERTS_SIZE);
-
-  fd = open(file, 0);
-  if(fd < 0)
-    return -1;
-
-  for(;;) {
-    n = read(fd, buf, sizeof(buf));
-    if(!n)
-      break;
-    if(n < 0) {
-      close(fd);
-      Curl_dyn_free(&certs);
-      return -1;
-    }
-    if(Curl_dyn_addn(&certs, buf, n)) {
-      close(fd);
-      return -1;
-    }
-  }
-  close(fd);
-
-  *out = Curl_dyn_uptr(&certs);
-  *outlen = Curl_dyn_len(&certs);
-
-  return 0;
-}
-
-static int append_cert_to_array(struct Curl_easy *data,
-                                const unsigned char *buf, size_t buflen,
-                                CFMutableArrayRef array)
-{
-    char *certp;
-    CURLcode result;
-    SecCertificateRef cacert;
-    CFDataRef certdata;
-
-    certdata = CFDataCreate(kCFAllocatorDefault, buf, buflen);
-    if(!certdata) {
-      failf(data, "SSL: failed to allocate array for CA certificate");
-      return CURLE_OUT_OF_MEMORY;
-    }
-
-    cacert = SecCertificateCreateWithData(kCFAllocatorDefault, certdata);
-    CFRelease(certdata);
-    if(!cacert) {
-      failf(data, "SSL: failed to create SecCertificate from CA certificate");
-      return CURLE_SSL_CACERT_BADFILE;
-    }
-
-    /* Check if cacert is valid. */
-    result = CopyCertSubject(data, cacert, &certp);
-    switch(result) {
-      case CURLE_OK:
-        break;
-      case CURLE_PEER_FAILED_VERIFICATION:
-        return CURLE_SSL_CACERT_BADFILE;
-      case CURLE_OUT_OF_MEMORY:
-      default:
-        return result;
-    }
-    free(certp);
-
-    CFArrayAppendValue(array, cacert);
-    CFRelease(cacert);
-
-    return CURLE_OK;
-}
-
-static CURLcode verify_cert_buf(struct Curl_cfilter *cf,
-                                struct Curl_easy *data,
-                                const unsigned char *certbuf, size_t buflen,
-                                SSLContextRef ctx)
-{
-  int n = 0, rc;
-  long res;
-  unsigned char *der;
-  size_t derlen, offset = 0;
-  OSStatus ret;
-  SecTrustResultType trust_eval;
-  CFMutableArrayRef array = NULL;
-  SecTrustRef trust = NULL;
-  CURLcode result = CURLE_PEER_FAILED_VERIFICATION;
-  (void)cf;
-  /*
-   * Certbuf now contains the contents of the certificate file, which can be
-   * - a single DER certificate,
-   * - a single PEM certificate or
-   * - a bunch of PEM certificates (certificate bundle).
-   *
-   * Go through certbuf, and convert any PEM certificate in it into DER
-   * format.
-   */
-  array = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
-  if(!array) {
-    failf(data, "SSL: out of memory creating CA certificate array");
-    result = CURLE_OUT_OF_MEMORY;
-    goto out;
-  }
-
-  while(offset < buflen) {
-    n++;
-
-    /*
-     * Check if the certificate is in PEM format, and convert it to DER. If
-     * this fails, we assume the certificate is in DER format.
-     */
-    res = pem_to_der((const char *)certbuf + offset, &der, &derlen);
-    if(res < 0) {
-      failf(data, "SSL: invalid CA certificate #%d (offset %zu) in bundle",
-            n, offset);
-      result = CURLE_SSL_CACERT_BADFILE;
-      goto out;
-    }
-    offset += res;
-
-    if(res == 0 && offset == 0) {
-      /* This is not a PEM file, probably a certificate in DER format. */
-      rc = append_cert_to_array(data, certbuf, buflen, array);
-      if(rc != CURLE_OK) {
-        CURL_TRC_CF(data, cf, "append_cert for CA failed");
-        result = rc;
-        goto out;
-      }
-      break;
-    }
-    else if(res == 0) {
-      /* No more certificates in the bundle. */
-      break;
-    }
-
-    rc = append_cert_to_array(data, der, derlen, array);
-    free(der);
-    if(rc != CURLE_OK) {
-      CURL_TRC_CF(data, cf, "append_cert for CA failed");
-      result = rc;
-      goto out;
-    }
-  }
-
-  ret = SSLCopyPeerTrust(ctx, &trust);
-  if(!trust) {
-    failf(data, "SSL: error getting certificate chain");
-    goto out;
-  }
-  else if(ret != noErr) {
-    failf(data, "SSLCopyPeerTrust() returned error %d", ret);
-    goto out;
-  }
-
-  CURL_TRC_CF(data, cf, "setting %d trust anchors", n);
-  ret = SecTrustSetAnchorCertificates(trust, array);
-  if(ret != noErr) {
-    failf(data, "SecTrustSetAnchorCertificates() returned error %d", ret);
-    goto out;
-  }
-  ret = SecTrustSetAnchorCertificatesOnly(trust, true);
-  if(ret != noErr) {
-    failf(data, "SecTrustSetAnchorCertificatesOnly() returned error %d", ret);
-    goto out;
-  }
-
-  trust_eval = 0;
-  ret = SecTrustEvaluate(trust, &trust_eval);
-  if(ret != noErr) {
-    failf(data, "SecTrustEvaluate() returned error %d", ret);
-    goto out;
-  }
-
-  switch(trust_eval) {
-    case kSecTrustResultUnspecified:
-      /* what does this really mean? */
-      CURL_TRC_CF(data, cf, "trust result: Unspecified");
-      result = CURLE_OK;
-      goto out;
-    case kSecTrustResultProceed:
-      CURL_TRC_CF(data, cf, "trust result: Proceed");
-      result = CURLE_OK;
-      goto out;
-
-    case kSecTrustResultRecoverableTrustFailure:
-      failf(data, "SSL: peer not verified:  RecoverableTrustFailure");
-      goto out;
-    case kSecTrustResultDeny:
-      failf(data, "SSL: peer not verified:  Deny");
-      goto out;
-    default:
-      failf(data, "SSL: perr not verified: result=%d", trust_eval);
-      goto out;
-  }
-
-out:
-  if(trust)
-    CFRelease(trust);
-  if(array)
-    CFRelease(array);
-  return result;
-}
-
-static CURLcode verify_cert(struct Curl_cfilter *cf,
-                            struct Curl_easy *data, const char *cafile,
-                            const struct curl_blob *ca_info_blob,
-                            SSLContextRef ctx)
-{
-  int result;
-  unsigned char *certbuf;
-  size_t buflen;
-
-  if(ca_info_blob) {
-    CURL_TRC_CF(data, cf, "verify_peer, CA from config blob");
-    certbuf = (unsigned char *)malloc(ca_info_blob->len + 1);
-    if(!certbuf) {
-      return CURLE_OUT_OF_MEMORY;
-    }
-    buflen = ca_info_blob->len;
-    memcpy(certbuf, ca_info_blob->data, ca_info_blob->len);
-    certbuf[ca_info_blob->len]='\0';
-  }
-  else if(cafile) {
-    CURL_TRC_CF(data, cf, "verify_peer, CA from file '%s'", cafile);
-    if(read_cert(cafile, &certbuf, &buflen) < 0) {
-      failf(data, "SSL: failed to read or invalid CA certificate");
-      return CURLE_SSL_CACERT_BADFILE;
-    }
-  }
-  else
-    return CURLE_SSL_CACERT_BADFILE;
-
-  result = verify_cert_buf(cf, data, certbuf, buflen, ctx);
-  free(certbuf);
-  return result;
-}
-
-
-#ifdef SECTRANSP_PINNEDPUBKEY
-static CURLcode pkp_pin_peer_pubkey(struct Curl_easy *data,
-                                    SSLContextRef ctx,
-                                    const char *pinnedpubkey)
-{  /* Scratch */
-  size_t pubkeylen, realpubkeylen, spkiHeaderLength = 24;
-  unsigned char *pubkey = NULL, *realpubkey = NULL;
-  const unsigned char *spkiHeader = NULL;
-  CFDataRef publicKeyBits = NULL;
-
-  /* Result is returned to caller */
-  CURLcode result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
-
-  /* if a path wasn't specified, don't pin */
-  if(!pinnedpubkey)
-    return CURLE_OK;
-
-
-  if(!ctx)
-    return result;
-
-  do {
-    SecTrustRef trust;
-    OSStatus ret;
-    SecKeyRef keyRef;
-
-    ret = SSLCopyPeerTrust(ctx, &trust);
-    if(ret != noErr || !trust)
-      break;
-
-    keyRef = SecTrustCopyPublicKey(trust);
-    CFRelease(trust);
-    if(!keyRef)
-      break;
-
-#ifdef SECTRANSP_PINNEDPUBKEY_V1
-
-    publicKeyBits = SecKeyCopyExternalRepresentation(keyRef, NULL);
-    CFRelease(keyRef);
-    if(!publicKeyBits)
-      break;
-
-#elif SECTRANSP_PINNEDPUBKEY_V2
-
-    {
-        OSStatus success;
-        success = SecItemExport(keyRef, kSecFormatOpenSSL, 0, NULL,
-                                &publicKeyBits);
-        CFRelease(keyRef);
-        if(success != errSecSuccess || !publicKeyBits)
-          break;
-    }
-
-#endif /* SECTRANSP_PINNEDPUBKEY_V2 */
-
-    pubkeylen = CFDataGetLength(publicKeyBits);
-    pubkey = (unsigned char *)CFDataGetBytePtr(publicKeyBits);
-
-    switch(pubkeylen) {
-      case 526:
-        /* 4096 bit RSA pubkeylen == 526 */
-        spkiHeader = rsa4096SpkiHeader;
-        break;
-      case 270:
-        /* 2048 bit RSA pubkeylen == 270 */
-        spkiHeader = rsa2048SpkiHeader;
-        break;
-#ifdef SECTRANSP_PINNEDPUBKEY_V1
-      case 65:
-        /* ecDSA secp256r1 pubkeylen == 65 */
-        spkiHeader = ecDsaSecp256r1SpkiHeader;
-        spkiHeaderLength = 26;
-        break;
-      case 97:
-        /* ecDSA secp384r1 pubkeylen == 97 */
-        spkiHeader = ecDsaSecp384r1SpkiHeader;
-        spkiHeaderLength = 23;
-        break;
-      default:
-        infof(data, "SSL: unhandled public key length: %zu", pubkeylen);
-#elif SECTRANSP_PINNEDPUBKEY_V2
-      default:
-        /* ecDSA secp256r1 pubkeylen == 91 header already included?
-         * ecDSA secp384r1 header already included too
-         * we assume rest of algorithms do same, so do nothing
-         */
-        result = Curl_pin_peer_pubkey(data, pinnedpubkey, pubkey,
-                                    pubkeylen);
-#endif /* SECTRANSP_PINNEDPUBKEY_V2 */
-        continue; /* break from loop */
-    }
-
-    realpubkeylen = pubkeylen + spkiHeaderLength;
-    realpubkey = malloc(realpubkeylen);
-    if(!realpubkey)
-      break;
-
-    memcpy(realpubkey, spkiHeader, spkiHeaderLength);
-    memcpy(realpubkey + spkiHeaderLength, pubkey, pubkeylen);
-
-    result = Curl_pin_peer_pubkey(data, pinnedpubkey, realpubkey,
-                                  realpubkeylen);
-
-  } while(0);
-
-  Curl_safefree(realpubkey);
-  if(publicKeyBits)
-    CFRelease(publicKeyBits);
-
-  return result;
-}
-#endif /* SECTRANSP_PINNEDPUBKEY */
-
-static CURLcode sectransp_connect_step2(struct Curl_cfilter *cf,
-                                        struct Curl_easy *data)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct st_ssl_backend_data *backend =
-    (struct st_ssl_backend_data *)connssl->backend;
-  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
-  OSStatus err;
-  SSLCipherSuite cipher;
-  SSLProtocol protocol = 0;
-
-  DEBUGASSERT(ssl_connect_2 == connssl->connecting_state
-              || ssl_connect_2_reading == connssl->connecting_state
-              || ssl_connect_2_writing == connssl->connecting_state);
-  DEBUGASSERT(backend);
-  CURL_TRC_CF(data, cf, "connect_step2");
-
-  /* Here goes nothing: */
-check_handshake:
-  err = SSLHandshake(backend->ssl_ctx);
-
-  if(err != noErr) {
-    switch(err) {
-      case errSSLWouldBlock:  /* they're not done with us yet */
-        connssl->connecting_state = backend->ssl_direction ?
-            ssl_connect_2_writing : ssl_connect_2_reading;
-        return CURLE_OK;
-
-      /* The below is errSSLServerAuthCompleted; it's not defined in
-        Leopard's headers */
-      case -9841:
-        if((conn_config->CAfile || conn_config->ca_info_blob) &&
-           conn_config->verifypeer) {
-          CURLcode result = verify_cert(cf, data, conn_config->CAfile,
-                                        conn_config->ca_info_blob,
-                                        backend->ssl_ctx);
-          if(result)
-            return result;
-        }
-        /* the documentation says we need to call SSLHandshake() again */
-        goto check_handshake;
-
-      /* Problem with encrypt / decrypt */
-      case errSSLPeerDecodeError:
-        failf(data, "Decode failed");
-        break;
-      case errSSLDecryptionFail:
-      case errSSLPeerDecryptionFail:
-        failf(data, "Decryption failed");
-        break;
-      case errSSLPeerDecryptError:
-        failf(data, "A decryption error occurred");
-        break;
-      case errSSLBadCipherSuite:
-        failf(data, "A bad SSL cipher suite was encountered");
-        break;
-      case errSSLCrypto:
-        failf(data, "An underlying cryptographic error was encountered");
-        break;
-#if CURL_BUILD_MAC_10_11 || CURL_BUILD_IOS_9
-      case errSSLWeakPeerEphemeralDHKey:
-        failf(data, "Indicates a weak ephemeral Diffie-Hellman key");
-        break;
-#endif
-
-      /* Problem with the message record validation */
-      case errSSLBadRecordMac:
-      case errSSLPeerBadRecordMac:
-        failf(data, "A record with a bad message authentication code (MAC) "
-                    "was encountered");
-        break;
-      case errSSLRecordOverflow:
-      case errSSLPeerRecordOverflow:
-        failf(data, "A record overflow occurred");
-        break;
-
-      /* Problem with zlib decompression */
-      case errSSLPeerDecompressFail:
-        failf(data, "Decompression failed");
-        break;
-
-      /* Problem with access */
-      case errSSLPeerAccessDenied:
-        failf(data, "Access was denied");
-        break;
-      case errSSLPeerInsufficientSecurity:
-        failf(data, "There is insufficient security for this operation");
-        break;
-
-      /* These are all certificate problems with the server: */
-      case errSSLXCertChainInvalid:
-        failf(data, "SSL certificate problem: Invalid certificate chain");
-        return CURLE_PEER_FAILED_VERIFICATION;
-      case errSSLUnknownRootCert:
-        failf(data, "SSL certificate problem: Untrusted root certificate");
-        return CURLE_PEER_FAILED_VERIFICATION;
-      case errSSLNoRootCert:
-        failf(data, "SSL certificate problem: No root certificate");
-        return CURLE_PEER_FAILED_VERIFICATION;
-      case errSSLCertNotYetValid:
-        failf(data, "SSL certificate problem: The certificate chain had a "
-                    "certificate that is not yet valid");
-        return CURLE_PEER_FAILED_VERIFICATION;
-      case errSSLCertExpired:
-      case errSSLPeerCertExpired:
-        failf(data, "SSL certificate problem: Certificate chain had an "
-              "expired certificate");
-        return CURLE_PEER_FAILED_VERIFICATION;
-      case errSSLBadCert:
-      case errSSLPeerBadCert:
-        failf(data, "SSL certificate problem: Couldn't understand the server "
-              "certificate format");
-        return CURLE_PEER_FAILED_VERIFICATION;
-      case errSSLPeerUnsupportedCert:
-        failf(data, "SSL certificate problem: An unsupported certificate "
-                    "format was encountered");
-        return CURLE_PEER_FAILED_VERIFICATION;
-      case errSSLPeerCertRevoked:
-        failf(data, "SSL certificate problem: The certificate was revoked");
-        return CURLE_PEER_FAILED_VERIFICATION;
-      case errSSLPeerCertUnknown:
-        failf(data, "SSL certificate problem: The certificate is unknown");
-        return CURLE_PEER_FAILED_VERIFICATION;
-
-      /* These are all certificate problems with the client: */
-      case errSecAuthFailed:
-        failf(data, "SSL authentication failed");
-        break;
-      case errSSLPeerHandshakeFail:
-        failf(data, "SSL peer handshake failed, the server most likely "
-              "requires a client certificate to connect");
-        break;
-      case errSSLPeerUnknownCA:
-        failf(data, "SSL server rejected the client certificate due to "
-              "the certificate being signed by an unknown certificate "
-              "authority");
-        break;
-
-      /* This error is raised if the server's cert didn't match the server's
-         host name: */
-      case errSSLHostNameMismatch:
-        failf(data, "SSL certificate peer verification failed, the "
-              "certificate did not match \"%s\"\n", connssl->dispname);
-        return CURLE_PEER_FAILED_VERIFICATION;
-
-      /* Problem with SSL / TLS negotiation */
-      case errSSLNegotiation:
-        failf(data, "Could not negotiate an SSL cipher suite with the server");
-        break;
-      case errSSLBadConfiguration:
-        failf(data, "A configuration error occurred");
-        break;
-      case errSSLProtocol:
-        failf(data, "SSL protocol error");
-        break;
-      case errSSLPeerProtocolVersion:
-        failf(data, "A bad protocol version was encountered");
-        break;
-      case errSSLPeerNoRenegotiation:
-        failf(data, "No renegotiation is allowed");
-        break;
-
-      /* Generic handshake errors: */
-      case errSSLConnectionRefused:
-        failf(data, "Server dropped the connection during the SSL handshake");
-        break;
-      case errSSLClosedAbort:
-        failf(data, "Server aborted the SSL handshake");
-        break;
-      case errSSLClosedGraceful:
-        failf(data, "The connection closed gracefully");
-        break;
-      case errSSLClosedNoNotify:
-        failf(data, "The server closed the session with no notification");
-        break;
-      /* Sometimes paramErr happens with buggy ciphers: */
-      case paramErr:
-      case errSSLInternal:
-      case errSSLPeerInternalError:
-        failf(data, "Internal SSL engine error encountered during the "
-              "SSL handshake");
-        break;
-      case errSSLFatalAlert:
-        failf(data, "Fatal SSL engine error encountered during the SSL "
-              "handshake");
-        break;
-      /* Unclassified error */
-      case errSSLBufferOverflow:
-        failf(data, "An insufficient buffer was provided");
-        break;
-      case errSSLIllegalParam:
-        failf(data, "An illegal parameter was encountered");
-        break;
-      case errSSLModuleAttach:
-        failf(data, "Module attach failure");
-        break;
-      case errSSLSessionNotFound:
-        failf(data, "An attempt to restore an unknown session failed");
-        break;
-      case errSSLPeerExportRestriction:
-        failf(data, "An export restriction occurred");
-        break;
-      case errSSLPeerUserCancelled:
-        failf(data, "The user canceled the operation");
-        break;
-      case errSSLPeerUnexpectedMsg:
-        failf(data, "Peer rejected unexpected message");
-        break;
-#if CURL_BUILD_MAC_10_11 || CURL_BUILD_IOS_9
-      /* Treating non-fatal error as fatal like before */
-      case errSSLClientHelloReceived:
-        failf(data, "A non-fatal result for providing a server name "
-                    "indication");
-        break;
-#endif
-
-      /* Error codes defined in the enum but should never be returned.
-         We list them here just in case. */
-#if CURL_BUILD_MAC_10_6
-      /* Only returned when kSSLSessionOptionBreakOnCertRequested is set */
-      case errSSLClientCertRequested:
-        failf(data, "Server requested a client certificate during the "
-              "handshake");
-        return CURLE_SSL_CLIENTCERT;
-#endif
-#if CURL_BUILD_MAC_10_9
-      /* Alias for errSSLLast, end of error range */
-      case errSSLUnexpectedRecord:
-        failf(data, "Unexpected (skipped) record in DTLS");
-        break;
-#endif
-      default:
-        /* May also return codes listed in Security Framework Result Codes */
-        failf(data, "Unknown SSL protocol error in connection to %s:%d",
-              connssl->hostname, err);
-        break;
-    }
-    return CURLE_SSL_CONNECT_ERROR;
-  }
-  else {
-    /* we have been connected fine, we're not waiting for anything else. */
-    connssl->connecting_state = ssl_connect_3;
-
-#ifdef SECTRANSP_PINNEDPUBKEY
-    if(data->set.str[STRING_SSL_PINNEDPUBLICKEY]) {
-      CURLcode result =
-        pkp_pin_peer_pubkey(data, backend->ssl_ctx,
-                            data->set.str[STRING_SSL_PINNEDPUBLICKEY]);
-      if(result) {
-        failf(data, "SSL: public key does not match pinned public key");
-        return result;
-      }
-    }
-#endif /* SECTRANSP_PINNEDPUBKEY */
-
-    /* Informational message */
-    (void)SSLGetNegotiatedCipher(backend->ssl_ctx, &cipher);
-    (void)SSLGetNegotiatedProtocolVersion(backend->ssl_ctx, &protocol);
-    switch(protocol) {
-      case kSSLProtocol2:
-        infof(data, "SSL 2.0 connection using %s",
-              TLSCipherNameForNumber(cipher));
-        break;
-      case kSSLProtocol3:
-        infof(data, "SSL 3.0 connection using %s",
-              TLSCipherNameForNumber(cipher));
-        break;
-      case kTLSProtocol1:
-        infof(data, "TLS 1.0 connection using %s",
-              TLSCipherNameForNumber(cipher));
-        break;
-#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
-      case kTLSProtocol11:
-        infof(data, "TLS 1.1 connection using %s",
-              TLSCipherNameForNumber(cipher));
-        break;
-      case kTLSProtocol12:
-        infof(data, "TLS 1.2 connection using %s",
-              TLSCipherNameForNumber(cipher));
-        break;
-#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
-#if CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11
-      case kTLSProtocol13:
-        infof(data, "TLS 1.3 connection using %s",
-              TLSCipherNameForNumber(cipher));
-        break;
-#endif /* CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 */
-      default:
-        infof(data, "Unknown protocol connection");
-        break;
-    }
-
-#if(CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
-    if(connssl->alpn) {
-      if(__builtin_available(macOS 10.13.4, iOS 11, tvOS 11, *)) {
-        CFArrayRef alpnArr = NULL;
-        CFStringRef chosenProtocol = NULL;
-        err = SSLCopyALPNProtocols(backend->ssl_ctx, &alpnArr);
-
-        if(err == noErr && alpnArr && CFArrayGetCount(alpnArr) >= 1)
-          chosenProtocol = CFArrayGetValueAtIndex(alpnArr, 0);
-
-#ifdef USE_HTTP2
-        if(chosenProtocol &&
-           !CFStringCompare(chosenProtocol, CFSTR(ALPN_H2), 0)) {
-          cf->conn->alpn = CURL_HTTP_VERSION_2;
-        }
-        else
-#endif
-        if(chosenProtocol &&
-           !CFStringCompare(chosenProtocol, CFSTR(ALPN_HTTP_1_1), 0)) {
-          cf->conn->alpn = CURL_HTTP_VERSION_1_1;
-        }
-        else
-          infof(data, VTLS_INFOF_NO_ALPN);
-
-        Curl_multiuse_state(data, cf->conn->alpn == CURL_HTTP_VERSION_2 ?
-                            BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE);
-
-        /* chosenProtocol is a reference to the string within alpnArr
-           and doesn't need to be freed separately */
-        if(alpnArr)
-          CFRelease(alpnArr);
-      }
-    }
-#endif
-
-    return CURLE_OK;
-  }
-}
-
-static CURLcode
-add_cert_to_certinfo(struct Curl_easy *data,
-                     SecCertificateRef server_cert,
-                     int idx)
-{
-  CURLcode result = CURLE_OK;
-  const char *beg;
-  const char *end;
-  CFDataRef cert_data = SecCertificateCopyData(server_cert);
-
-  if(!cert_data)
-    return CURLE_PEER_FAILED_VERIFICATION;
-
-  beg = (const char *)CFDataGetBytePtr(cert_data);
-  end = beg + CFDataGetLength(cert_data);
-  result = Curl_extract_certinfo(data, idx, beg, end);
-  CFRelease(cert_data);
-  return result;
-}
-
-static CURLcode
-collect_server_cert_single(struct Curl_cfilter *cf, struct Curl_easy *data,
-                           SecCertificateRef server_cert,
-                           CFIndex idx)
-{
-  CURLcode result = CURLE_OK;
-  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-  if(data->set.verbose) {
-    char *certp;
-    result = CopyCertSubject(data, server_cert, &certp);
-    if(!result) {
-      infof(data, "Server certificate: %s", certp);
-      free(certp);
-    }
-  }
-#endif
-  if(ssl_config->certinfo)
-    result = add_cert_to_certinfo(data, server_cert, (int)idx);
-  return result;
-}
-
-/* This should be called during step3 of the connection at the earliest */
-static CURLcode collect_server_cert(struct Curl_cfilter *cf,
-                                    struct Curl_easy *data)
-{
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-  const bool show_verbose_server_cert = data->set.verbose;
-#else
-  const bool show_verbose_server_cert = false;
-#endif
-  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
-  CURLcode result = ssl_config->certinfo ?
-    CURLE_PEER_FAILED_VERIFICATION : CURLE_OK;
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct st_ssl_backend_data *backend =
-    (struct st_ssl_backend_data *)connssl->backend;
-  CFArrayRef server_certs = NULL;
-  SecCertificateRef server_cert;
-  OSStatus err;
-  CFIndex i, count;
-  SecTrustRef trust = NULL;
-
-  DEBUGASSERT(backend);
-
-  if(!show_verbose_server_cert && !ssl_config->certinfo)
-    return CURLE_OK;
-
-  if(!backend->ssl_ctx)
-    return result;
-
-#if CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS
-#if CURL_BUILD_IOS
-#pragma unused(server_certs)
-  err = SSLCopyPeerTrust(backend->ssl_ctx, &trust);
-  /* For some reason, SSLCopyPeerTrust() can return noErr and yet return
-     a null trust, so be on guard for that: */
-  if(err == noErr && trust) {
-    count = SecTrustGetCertificateCount(trust);
-    if(ssl_config->certinfo)
-      result = Curl_ssl_init_certinfo(data, (int)count);
-    for(i = 0L ; !result && (i < count) ; i++) {
-      server_cert = SecTrustGetCertificateAtIndex(trust, i);
-      result = collect_server_cert_single(cf, data, server_cert, i);
-    }
-    CFRelease(trust);
-  }
-#else
-  /* SSLCopyPeerCertificates() is deprecated as of Mountain Lion.
-     The function SecTrustGetCertificateAtIndex() is officially present
-     in Lion, but it is unfortunately also present in Snow Leopard as
-     private API and doesn't work as expected. So we have to look for
-     a different symbol to make sure this code is only executed under
-     Lion or later. */
-  if(SecTrustCopyPublicKey) {
-#pragma unused(server_certs)
-    err = SSLCopyPeerTrust(backend->ssl_ctx, &trust);
-    /* For some reason, SSLCopyPeerTrust() can return noErr and yet return
-       a null trust, so be on guard for that: */
-    if(err == noErr && trust) {
-      count = SecTrustGetCertificateCount(trust);
-      if(ssl_config->certinfo)
-        result = Curl_ssl_init_certinfo(data, (int)count);
-      for(i = 0L ; !result && (i < count) ; i++) {
-        server_cert = SecTrustGetCertificateAtIndex(trust, i);
-        result = collect_server_cert_single(cf, data, server_cert, i);
-      }
-      CFRelease(trust);
-    }
-  }
-  else {
-#if CURL_SUPPORT_MAC_10_8
-    err = SSLCopyPeerCertificates(backend->ssl_ctx, &server_certs);
-    /* Just in case SSLCopyPeerCertificates() returns null too... */
-    if(err == noErr && server_certs) {
-      count = CFArrayGetCount(server_certs);
-      if(ssl_config->certinfo)
-        result = Curl_ssl_init_certinfo(data, (int)count);
-      for(i = 0L ; !result && (i < count) ; i++) {
-        server_cert = (SecCertificateRef)CFArrayGetValueAtIndex(server_certs,
-                                                                i);
-        result = collect_server_cert_single(cf, data, server_cert, i);
-      }
-      CFRelease(server_certs);
-    }
-#endif /* CURL_SUPPORT_MAC_10_8 */
-  }
-#endif /* CURL_BUILD_IOS */
-#else
-#pragma unused(trust)
-  err = SSLCopyPeerCertificates(backend->ssl_ctx, &server_certs);
-  if(err == noErr) {
-    count = CFArrayGetCount(server_certs);
-    if(ssl_config->certinfo)
-      result = Curl_ssl_init_certinfo(data, (int)count);
-    for(i = 0L ; !result && (i < count) ; i++) {
-      server_cert = (SecCertificateRef)CFArrayGetValueAtIndex(server_certs, i);
-      result = collect_server_cert_single(cf, data, server_cert, i);
-    }
-    CFRelease(server_certs);
-  }
-#endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */
-  return result;
-}
-
-static CURLcode sectransp_connect_step3(struct Curl_cfilter *cf,
-                                        struct Curl_easy *data)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  CURLcode result;
-
-  CURL_TRC_CF(data, cf, "connect_step3");
-  /* There is no step 3!
-   * Well, okay, let's collect server certificates, and if verbose mode is on,
-   * let's print the details of the server certificates. */
-  result = collect_server_cert(cf, data);
-  if(result)
-    return result;
-
-  connssl->connecting_state = ssl_connect_done;
-  return CURLE_OK;
-}
-
-static CURLcode
-sectransp_connect_common(struct Curl_cfilter *cf, struct Curl_easy *data,
-                         bool nonblocking,
-                         bool *done)
-{
-  CURLcode result;
-  struct ssl_connect_data *connssl = cf->ctx;
-  curl_socket_t sockfd = Curl_conn_cf_get_socket(cf, data);
-  int what;
-
-  /* check if the connection has already been established */
-  if(ssl_connection_complete == connssl->state) {
-    *done = TRUE;
-    return CURLE_OK;
-  }
-
-  if(ssl_connect_1 == connssl->connecting_state) {
-    /* Find out how much more time we're allowed */
-    const timediff_t timeout_ms = Curl_timeleft(data, NULL, TRUE);
-
-    if(timeout_ms < 0) {
-      /* no need to continue if time already is up */
-      failf(data, "SSL connection timeout");
-      return CURLE_OPERATION_TIMEDOUT;
-    }
-
-    result = sectransp_connect_step1(cf, data);
-    if(result)
-      return result;
-  }
-
-  while(ssl_connect_2 == connssl->connecting_state ||
-        ssl_connect_2_reading == connssl->connecting_state ||
-        ssl_connect_2_writing == connssl->connecting_state) {
-
-    /* check allowed time left */
-    const timediff_t timeout_ms = Curl_timeleft(data, NULL, TRUE);
-
-    if(timeout_ms < 0) {
-      /* no need to continue if time already is up */
-      failf(data, "SSL connection timeout");
-      return CURLE_OPERATION_TIMEDOUT;
-    }
-
-    /* if ssl is expecting something, check if it's available. */
-    if(connssl->connecting_state == ssl_connect_2_reading ||
-       connssl->connecting_state == ssl_connect_2_writing) {
-
-      curl_socket_t writefd = ssl_connect_2_writing ==
-      connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
-      curl_socket_t readfd = ssl_connect_2_reading ==
-      connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
-
-      what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd,
-                               nonblocking ? 0 : timeout_ms);
-      if(what < 0) {
-        /* fatal error */
-        failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
-        return CURLE_SSL_CONNECT_ERROR;
-      }
-      else if(0 == what) {
-        if(nonblocking) {
-          *done = FALSE;
-          return CURLE_OK;
-        }
-        else {
-          /* timeout */
-          failf(data, "SSL connection timeout");
-          return CURLE_OPERATION_TIMEDOUT;
-        }
-      }
-      /* socket is readable or writable */
-    }
-
-    /* Run transaction, and return to the caller if it failed or if this
-     * connection is done nonblocking and this loop would execute again. This
-     * permits the owner of a multi handle to abort a connection attempt
-     * before step2 has completed while ensuring that a client using select()
-     * or epoll() will always have a valid fdset to wait on.
-     */
-    result = sectransp_connect_step2(cf, data);
-    if(result || (nonblocking &&
-                  (ssl_connect_2 == connssl->connecting_state ||
-                   ssl_connect_2_reading == connssl->connecting_state ||
-                   ssl_connect_2_writing == connssl->connecting_state)))
-      return result;
-
-  } /* repeat step2 until all transactions are done. */
-
-
-  if(ssl_connect_3 == connssl->connecting_state) {
-    result = sectransp_connect_step3(cf, data);
-    if(result)
-      return result;
-  }
-
-  if(ssl_connect_done == connssl->connecting_state) {
-    CURL_TRC_CF(data, cf, "connected");
-    connssl->state = ssl_connection_complete;
-    *done = TRUE;
-  }
-  else
-    *done = FALSE;
-
-  /* Reset our connect state machine */
-  connssl->connecting_state = ssl_connect_1;
-
-  return CURLE_OK;
-}
-
-static CURLcode sectransp_connect_nonblocking(struct Curl_cfilter *cf,
-                                              struct Curl_easy *data,
-                                              bool *done)
-{
-  return sectransp_connect_common(cf, data, TRUE, done);
-}
-
-static CURLcode sectransp_connect(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data)
-{
-  CURLcode result;
-  bool done = FALSE;
-
-  result = sectransp_connect_common(cf, data, FALSE, &done);
-
-  if(result)
-    return result;
-
-  DEBUGASSERT(done);
-
-  return CURLE_OK;
-}
-
-static void sectransp_close(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct st_ssl_backend_data *backend =
-    (struct st_ssl_backend_data *)connssl->backend;
-
-  (void) data;
-
-  DEBUGASSERT(backend);
-
-  if(backend->ssl_ctx) {
-    CURL_TRC_CF(data, cf, "close");
-    (void)SSLClose(backend->ssl_ctx);
-#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
-    if(SSLCreateContext)
-      CFRelease(backend->ssl_ctx);
-#if CURL_SUPPORT_MAC_10_8
-    else
-      (void)SSLDisposeContext(backend->ssl_ctx);
-#endif  /* CURL_SUPPORT_MAC_10_8 */
-#else
-    (void)SSLDisposeContext(backend->ssl_ctx);
-#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
-    backend->ssl_ctx = NULL;
-  }
-}
-
-static int sectransp_shutdown(struct Curl_cfilter *cf,
-                              struct Curl_easy *data)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct st_ssl_backend_data *backend =
-    (struct st_ssl_backend_data *)connssl->backend;
-  ssize_t nread;
-  int what;
-  int rc;
-  char buf[120];
-  int loop = 10; /* avoid getting stuck */
-  CURLcode result;
-
-  DEBUGASSERT(backend);
-
-  if(!backend->ssl_ctx)
-    return 0;
-
-#ifndef CURL_DISABLE_FTP
-  if(data->set.ftp_ccc != CURLFTPSSL_CCC_ACTIVE)
-    return 0;
-#endif
-
-  sectransp_close(cf, data);
-
-  rc = 0;
-
-  what = SOCKET_READABLE(Curl_conn_cf_get_socket(cf, data),
-                         SSL_SHUTDOWN_TIMEOUT);
-
-  CURL_TRC_CF(data, cf, "shutdown");
-  while(loop--) {
-    if(what < 0) {
-      /* anything that gets here is fatally bad */
-      failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
-      rc = -1;
-      break;
-    }
-
-    if(!what) {                                /* timeout */
-      failf(data, "SSL shutdown timeout");
-      break;
-    }
-
-    /* Something to read, let's do it and hope that it is the close
-     notify alert from the server. No way to SSL_Read now, so use read(). */
-
-    nread = Curl_conn_cf_recv(cf->next, data, buf, sizeof(buf), &result);
-
-    if(nread < 0) {
-      failf(data, "read: %s", curl_easy_strerror(result));
-      rc = -1;
-    }
-
-    if(nread <= 0)
-      break;
-
-    what = SOCKET_READABLE(Curl_conn_cf_get_socket(cf, data), 0);
-  }
-
-  return rc;
-}
-
-static void sectransp_session_free(void *ptr)
-{
-  /* ST, as of iOS 5 and Mountain Lion, has no public method of deleting a
-     cached session ID inside the Security framework. There is a private
-     function that does this, but I don't want to have to explain to you why I
-     got your application rejected from the App Store due to the use of a
-     private API, so the best we can do is free up our own char array that we
-     created way back in sectransp_connect_step1... */
-  Curl_safefree(ptr);
-}
-
-static size_t sectransp_version(char *buffer, size_t size)
-{
-  return msnprintf(buffer, size, "SecureTransport");
-}
-
-static bool sectransp_data_pending(struct Curl_cfilter *cf,
-                                   const struct Curl_easy *data)
-{
-  const struct ssl_connect_data *connssl = cf->ctx;
-  struct st_ssl_backend_data *backend =
-    (struct st_ssl_backend_data *)connssl->backend;
-  OSStatus err;
-  size_t buffer;
-
-  (void)data;
-  DEBUGASSERT(backend);
-
-  if(backend->ssl_ctx) {  /* SSL is in use */
-    CURL_TRC_CF((struct Curl_easy *)data, cf, "data_pending");
-    err = SSLGetBufferedReadSize(backend->ssl_ctx, &buffer);
-    if(err == noErr)
-      return buffer > 0UL;
-    return false;
-  }
-  else
-    return false;
-}
-
-static CURLcode sectransp_random(struct Curl_easy *data UNUSED_PARAM,
-                                 unsigned char *entropy, size_t length)
-{
-  /* arc4random_buf() isn't available on cats older than Lion, so let's
-     do this manually for the benefit of the older cats. */
-  size_t i;
-  u_int32_t random_number = 0;
-
-  (void)data;
-
-  for(i = 0 ; i < length ; i++) {
-    if(i % sizeof(u_int32_t) == 0)
-      random_number = arc4random();
-    entropy[i] = random_number & 0xFF;
-    random_number >>= 8;
-  }
-  i = random_number = 0;
-  return CURLE_OK;
-}
-
-static CURLcode sectransp_sha256sum(const unsigned char *tmp, /* input */
-                                    size_t tmplen,
-                                    unsigned char *sha256sum, /* output */
-                                    size_t sha256len)
-{
-  (void)sha256len;
-  assert(sha256len >= CURL_SHA256_DIGEST_LENGTH);
-  (void)CC_SHA256(tmp, (CC_LONG)tmplen, sha256sum);
-  return CURLE_OK;
-}
-
-static bool sectransp_false_start(void)
-{
-#if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7
-  if(SSLSetSessionOption)
-    return TRUE;
-#endif
-  return FALSE;
-}
-
-static ssize_t sectransp_send(struct Curl_cfilter *cf,
-                              struct Curl_easy *data,
-                              const void *mem,
-                              size_t len,
-                              CURLcode *curlcode)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct st_ssl_backend_data *backend =
-    (struct st_ssl_backend_data *)connssl->backend;
-  size_t processed = 0UL;
-  OSStatus err;
-
-  DEBUGASSERT(backend);
-
-  /* The SSLWrite() function works a little differently than expected. The
-     fourth argument (processed) is currently documented in Apple's
-     documentation as: "On return, the length, in bytes, of the data actually
-     written."
-
-     Now, one could interpret that as "written to the socket," but actually,
-     it returns the amount of data that was written to a buffer internal to
-     the SSLContextRef instead. So it's possible for SSLWrite() to return
-     errSSLWouldBlock and a number of bytes "written" because those bytes were
-     encrypted and written to a buffer, not to the socket.
-
-     So if this happens, then we need to keep calling SSLWrite() over and
-     over again with no new data until it quits returning errSSLWouldBlock. */
-
-  /* Do we have buffered data to write from the last time we were called? */
-  if(backend->ssl_write_buffered_length) {
-    /* Write the buffered data: */
-    err = SSLWrite(backend->ssl_ctx, NULL, 0UL, &processed);
-    switch(err) {
-      case noErr:
-        /* processed is always going to be 0 because we didn't write to
-           the buffer, so return how much was written to the socket */
-        processed = backend->ssl_write_buffered_length;
-        backend->ssl_write_buffered_length = 0UL;
-        break;
-      case errSSLWouldBlock: /* argh, try again */
-        *curlcode = CURLE_AGAIN;
-        return -1L;
-      default:
-        failf(data, "SSLWrite() returned error %d", err);
-        *curlcode = CURLE_SEND_ERROR;
-        return -1L;
-    }
-  }
-  else {
-    /* We've got new data to write: */
-    err = SSLWrite(backend->ssl_ctx, mem, len, &processed);
-    if(err != noErr) {
-      switch(err) {
-        case errSSLWouldBlock:
-          /* Data was buffered but not sent, we have to tell the caller
-             to try sending again, and remember how much was buffered */
-          backend->ssl_write_buffered_length = len;
-          *curlcode = CURLE_AGAIN;
-          return -1L;
-        default:
-          failf(data, "SSLWrite() returned error %d", err);
-          *curlcode = CURLE_SEND_ERROR;
-          return -1L;
-      }
-    }
-  }
-  return (ssize_t)processed;
-}
-
-static ssize_t sectransp_recv(struct Curl_cfilter *cf,
-                              struct Curl_easy *data,
-                              char *buf,
-                              size_t buffersize,
-                              CURLcode *curlcode)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct st_ssl_backend_data *backend =
-    (struct st_ssl_backend_data *)connssl->backend;
-  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
-  size_t processed = 0UL;
-  OSStatus err;
-
-  DEBUGASSERT(backend);
-
-again:
-  *curlcode = CURLE_OK;
-  err = SSLRead(backend->ssl_ctx, buf, buffersize, &processed);
-
-  if(err != noErr) {
-    switch(err) {
-      case errSSLWouldBlock:  /* return how much we read (if anything) */
-        if(processed) {
-          return (ssize_t)processed;
-        }
-        *curlcode = CURLE_AGAIN;
-        return -1L;
-        break;
-
-      /* errSSLClosedGraceful - server gracefully shut down the SSL session
-         errSSLClosedNoNotify - server hung up on us instead of sending a
-           closure alert notice, read() is returning 0
-         Either way, inform the caller that the server disconnected. */
-      case errSSLClosedGraceful:
-      case errSSLClosedNoNotify:
-        *curlcode = CURLE_OK;
-        return 0;
-        break;
-
-        /* The below is errSSLPeerAuthCompleted; it's not defined in
-           Leopard's headers */
-      case -9841:
-        if((conn_config->CAfile || conn_config->ca_info_blob) &&
-           conn_config->verifypeer) {
-          CURLcode result = verify_cert(cf, data, conn_config->CAfile,
-                                        conn_config->ca_info_blob,
-                                        backend->ssl_ctx);
-          if(result) {
-            *curlcode = result;
-            return -1;
-          }
-        }
-        goto again;
-      default:
-        failf(data, "SSLRead() return error %d", err);
-        *curlcode = CURLE_RECV_ERROR;
-        return -1L;
-        break;
-    }
-  }
-  return (ssize_t)processed;
-}
-
-static void *sectransp_get_internals(struct ssl_connect_data *connssl,
-                                     CURLINFO info UNUSED_PARAM)
-{
-  struct st_ssl_backend_data *backend =
-    (struct st_ssl_backend_data *)connssl->backend;
-  (void)info;
-  DEBUGASSERT(backend);
-  return backend->ssl_ctx;
-}
-
-const struct Curl_ssl Curl_ssl_sectransp = {
-  { CURLSSLBACKEND_SECURETRANSPORT, "secure-transport" }, /* info */
-
-  SSLSUPP_CAINFO_BLOB |
-  SSLSUPP_CERTINFO |
-#ifdef SECTRANSP_PINNEDPUBKEY
-  SSLSUPP_PINNEDPUBKEY |
-#endif /* SECTRANSP_PINNEDPUBKEY */
-  SSLSUPP_HTTPS_PROXY,
-
-  sizeof(struct st_ssl_backend_data),
-
-  Curl_none_init,                     /* init */
-  Curl_none_cleanup,                  /* cleanup */
-  sectransp_version,                  /* version */
-  Curl_none_check_cxn,                /* check_cxn */
-  sectransp_shutdown,                 /* shutdown */
-  sectransp_data_pending,             /* data_pending */
-  sectransp_random,                   /* random */
-  Curl_none_cert_status_request,      /* cert_status_request */
-  sectransp_connect,                  /* connect */
-  sectransp_connect_nonblocking,      /* connect_nonblocking */
-  Curl_ssl_get_select_socks,          /* getsock */
-  sectransp_get_internals,            /* get_internals */
-  sectransp_close,                    /* close_one */
-  Curl_none_close_all,                /* close_all */
-  sectransp_session_free,             /* session_free */
-  Curl_none_set_engine,               /* set_engine */
-  Curl_none_set_engine_default,       /* set_engine_default */
-  Curl_none_engines_list,             /* engines_list */
-  sectransp_false_start,              /* false_start */
-  sectransp_sha256sum,                /* sha256sum */
-  NULL,                               /* associate_connection */
-  NULL,                               /* disassociate_connection */
-  NULL,                               /* free_multi_ssl_backend_data */
-  sectransp_recv,                     /* recv decrypted data */
-  sectransp_send,                     /* send data to encrypt */
-};
-
-#ifdef __clang__
-#pragma clang diagnostic pop
-#endif
-
-#endif /* USE_SECTRANSP */
diff --git a/third-party/curl/lib/vtls/sectransp.h b/third-party/curl/lib/vtls/sectransp.h
deleted file mode 100644
index 0f1085ad91..0000000000
--- a/third-party/curl/lib/vtls/sectransp.h
+++ /dev/null
@@ -1,34 +0,0 @@
-#ifndef HEADER_CURL_SECTRANSP_H
-#define HEADER_CURL_SECTRANSP_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Nick Zitzmann, <nickzman@gmail.com>.
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "curl_setup.h"
-
-#ifdef USE_SECTRANSP
-
-extern const struct Curl_ssl Curl_ssl_sectransp;
-
-#endif /* USE_SECTRANSP */
-#endif /* HEADER_CURL_SECTRANSP_H */
diff --git a/third-party/curl/lib/vtls/vtls.c b/third-party/curl/lib/vtls/vtls.c
index 38a20e8bea..82ce007b3d 100644
--- a/third-party/curl/lib/vtls/vtls.c
+++ b/third-party/curl/lib/vtls/vtls.c
@@ -43,204 +43,89 @@
 #ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
 #endif
-#ifdef HAVE_SYS_STAT_H
-#include <sys/stat.h>
-#endif
-#ifdef HAVE_FCNTL_H
-#include <fcntl.h>
-#endif
 
 #include "urldata.h"
 #include "cfilters.h"
 
-#include "vtls.h" /* generic SSL protos etc */
-#include "vtls_int.h"
+#include "vtls/vtls.h" /* generic SSL protos etc */
+#include "vtls/vtls_int.h"
+#include "vtls/vtls_scache.h"
+#include "vtls/keylog.h"
+
+#include "vtls/openssl.h"        /* OpenSSL versions */
+#include "vtls/gtls.h"           /* GnuTLS versions */
+#include "vtls/wolfssl.h"        /* wolfSSL versions */
+#include "vtls/schannel.h"       /* Schannel SSPI version */
+#include "vtls/mbedtls.h"        /* mbedTLS versions */
+#include "vtls/rustls.h"         /* Rustls versions */
+
 #include "slist.h"
-#include "sendf.h"
+#include "curl_trc.h"
 #include "strcase.h"
 #include "url.h"
 #include "progress.h"
-#include "share.h"
-#include "multiif.h"
-#include "timeval.h"
-#include "curl_md5.h"
-#include "warnless.h"
-#include "curl_base64.h"
-#include "curl_printf.h"
-#include "strdup.h"
+#include "curlx/fopen.h"
+#include "curl_sha256.h"
+#include "curlx/base64.h"
+#include "curlx/inet_pton.h"
+#include "connect.h"
+#include "select.h"
+#include "setopt.h"
+#include "curlx/strdup.h"
+#include "curlx/strcopy.h"
 
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
-
-
-/* convenience macro to check if this handle is using a shared SSL session */
-#define SSLSESSION_SHARED(data) (data->share &&                        \
-                                 (data->share->specifier &             \
-                                  (1<<CURL_LOCK_DATA_SSL_SESSION)))
-
-#define CLONE_STRING(var)                    \
-  do {                                       \
-    if(source->var) {                        \
-      dest->var = strdup(source->var);       \
-      if(!dest->var)                         \
-        return FALSE;                        \
-    }                                        \
-    else                                     \
-      dest->var = NULL;                      \
-  } while(0)
-
-#define CLONE_BLOB(var)                        \
-  do {                                         \
-    if(blobdup(&dest->var, source->var))       \
-      return FALSE;                            \
-  } while(0)
-
-static CURLcode blobdup(struct curl_blob **dest,
-                        struct curl_blob *src)
-{
-  DEBUGASSERT(dest);
-  DEBUGASSERT(!*dest);
-  if(src) {
-    /* only if there's data to dupe! */
-    struct curl_blob *d;
-    d = malloc(sizeof(struct curl_blob) + src->len);
-    if(!d)
-      return CURLE_OUT_OF_MEMORY;
-    d->len = src->len;
-    /* Always duplicate because the connection may survive longer than the
-       handle that passed in the blob. */
-    d->flags = CURL_BLOB_COPY;
-    d->data = (void *)((char *)d + sizeof(struct curl_blob));
-    memcpy(d->data, src->data, src->len);
-    *dest = d;
-  }
-  return CURLE_OK;
-}
-
-/* returns TRUE if the blobs are identical */
-static bool blobcmp(struct curl_blob *first, struct curl_blob *second)
-{
-  if(!first && !second) /* both are NULL */
-    return TRUE;
-  if(!first || !second) /* one is NULL */
-    return FALSE;
-  if(first->len != second->len) /* different sizes */
-    return FALSE;
-  return !memcmp(first->data, second->data, first->len); /* same data */
-}
+#ifdef USE_APPLE_SECTRUST
+#include <Security/Security.h>
+#endif
 
 #ifdef USE_SSL
-static const struct alpn_spec ALPN_SPEC_H10 = {
-  { ALPN_HTTP_1_0 }, 1
-};
+#if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_PROXY)
 static const struct alpn_spec ALPN_SPEC_H11 = {
   { ALPN_HTTP_1_1 }, 1
 };
+static const struct alpn_spec ALPN_SPEC_H10_H11 = {
+  { ALPN_HTTP_1_0, ALPN_HTTP_1_1 }, 2
+};
 #ifdef USE_HTTP2
+static const struct alpn_spec ALPN_SPEC_H2 = {
+  { ALPN_H2 }, 1
+};
 static const struct alpn_spec ALPN_SPEC_H2_H11 = {
   { ALPN_H2, ALPN_HTTP_1_1 }, 2
 };
-#endif
+static const struct alpn_spec ALPN_SPEC_H11_H2 = {
+  { ALPN_HTTP_1_1, ALPN_H2 }, 2
+};
+#endif /* USE_HTTP2 */
 
-static const struct alpn_spec *alpn_get_spec(int httpwant, bool use_alpn)
+static const struct alpn_spec *alpn_get_spec(http_majors wanted,
+                                             http_majors preferred,
+                                             bool only_http_10,
+                                             bool use_alpn)
 {
   if(!use_alpn)
     return NULL;
-  if(httpwant == CURL_HTTP_VERSION_1_0)
-    return &ALPN_SPEC_H10;
+  /* If HTTP/1.0 is the wanted protocol then use ALPN http/1.0 and http/1.1.
+     This is for compatibility reasons since some HTTP/1.0 servers with old
+     ALPN implementations understand ALPN http/1.1 but not http/1.0. */
+  if(only_http_10 && (wanted & CURL_HTTP_V1x))
+    return &ALPN_SPEC_H10_H11;
 #ifdef USE_HTTP2
-  if(httpwant >= CURL_HTTP_VERSION_2)
-    return &ALPN_SPEC_H2_H11;
+  if(wanted & CURL_HTTP_V2x) {
+    if(wanted & CURL_HTTP_V1x)
+      return (preferred == CURL_HTTP_V1x) ?
+        &ALPN_SPEC_H11_H2 : &ALPN_SPEC_H2_H11;
+    return &ALPN_SPEC_H2;
+  }
+#else
+  (void)wanted;
+  (void)preferred;
 #endif
   return &ALPN_SPEC_H11;
 }
+#endif /* !CURL_DISABLE_HTTP || !CURL_DISABLE_PROXY */
 #endif /* USE_SSL */
 
-
-bool
-Curl_ssl_config_matches(struct ssl_primary_config *data,
-                        struct ssl_primary_config *needle)
-{
-  if((data->version == needle->version) &&
-     (data->version_max == needle->version_max) &&
-     (data->ssl_options == needle->ssl_options) &&
-     (data->verifypeer == needle->verifypeer) &&
-     (data->verifyhost == needle->verifyhost) &&
-     (data->verifystatus == needle->verifystatus) &&
-     blobcmp(data->cert_blob, needle->cert_blob) &&
-     blobcmp(data->ca_info_blob, needle->ca_info_blob) &&
-     blobcmp(data->issuercert_blob, needle->issuercert_blob) &&
-     Curl_safecmp(data->CApath, needle->CApath) &&
-     Curl_safecmp(data->CAfile, needle->CAfile) &&
-     Curl_safecmp(data->issuercert, needle->issuercert) &&
-     Curl_safecmp(data->clientcert, needle->clientcert) &&
-#ifdef USE_TLS_SRP
-     !Curl_timestrcmp(data->username, needle->username) &&
-     !Curl_timestrcmp(data->password, needle->password) &&
-#endif
-     strcasecompare(data->cipher_list, needle->cipher_list) &&
-     strcasecompare(data->cipher_list13, needle->cipher_list13) &&
-     strcasecompare(data->curves, needle->curves) &&
-     strcasecompare(data->CRLfile, needle->CRLfile) &&
-     strcasecompare(data->pinned_key, needle->pinned_key))
-    return TRUE;
-
-  return FALSE;
-}
-
-bool
-Curl_clone_primary_ssl_config(struct ssl_primary_config *source,
-                              struct ssl_primary_config *dest)
-{
-  dest->version = source->version;
-  dest->version_max = source->version_max;
-  dest->verifypeer = source->verifypeer;
-  dest->verifyhost = source->verifyhost;
-  dest->verifystatus = source->verifystatus;
-  dest->sessionid = source->sessionid;
-  dest->ssl_options = source->ssl_options;
-
-  CLONE_BLOB(cert_blob);
-  CLONE_BLOB(ca_info_blob);
-  CLONE_BLOB(issuercert_blob);
-  CLONE_STRING(CApath);
-  CLONE_STRING(CAfile);
-  CLONE_STRING(issuercert);
-  CLONE_STRING(clientcert);
-  CLONE_STRING(cipher_list);
-  CLONE_STRING(cipher_list13);
-  CLONE_STRING(pinned_key);
-  CLONE_STRING(curves);
-  CLONE_STRING(CRLfile);
-#ifdef USE_TLS_SRP
-  CLONE_STRING(username);
-  CLONE_STRING(password);
-#endif
-
-  return TRUE;
-}
-
-void Curl_free_primary_ssl_config(struct ssl_primary_config *sslc)
-{
-  Curl_safefree(sslc->CApath);
-  Curl_safefree(sslc->CAfile);
-  Curl_safefree(sslc->issuercert);
-  Curl_safefree(sslc->clientcert);
-  Curl_safefree(sslc->cipher_list);
-  Curl_safefree(sslc->cipher_list13);
-  Curl_safefree(sslc->pinned_key);
-  Curl_safefree(sslc->cert_blob);
-  Curl_safefree(sslc->ca_info_blob);
-  Curl_safefree(sslc->issuercert_blob);
-  Curl_safefree(sslc->curves);
-  Curl_safefree(sslc->CRLfile);
-#ifdef USE_TLS_SRP
-  Curl_safefree(sslc->username);
-  Curl_safefree(sslc->password);
-#endif
-}
-
 #ifdef USE_SSL
 static int multissl_setup(const struct Curl_ssl *backend);
 #endif
@@ -273,24 +158,9 @@ int Curl_ssl_init(void)
     return 1;
   init_ssl = TRUE; /* never again */
 
-  return Curl_ssl->init();
-}
-
-#if defined(CURL_WITH_MULTI_SSL)
-static const struct Curl_ssl Curl_ssl_multi;
-#endif
-
-/* Global cleanup */
-void Curl_ssl_cleanup(void)
-{
-  if(init_ssl) {
-    /* only cleanup if we did a previous init */
-    Curl_ssl->cleanup();
-#if defined(CURL_WITH_MULTI_SSL)
-    Curl_ssl = &Curl_ssl_multi;
-#endif
-    init_ssl = FALSE;
-  }
+  if(Curl_ssl->init)
+    return Curl_ssl->init();
+  return 1;
 }
 
 static bool ssl_prefs_check(struct Curl_easy *data)
@@ -318,19 +188,21 @@ static bool ssl_prefs_check(struct Curl_easy *data)
 }
 
 static struct ssl_connect_data *cf_ctx_new(struct Curl_easy *data,
-                                     const struct alpn_spec *alpn)
+                                           const struct alpn_spec *alpn)
 {
   struct ssl_connect_data *ctx;
 
   (void)data;
-  ctx = calloc(1, sizeof(*ctx));
+  ctx = curlx_calloc(1, sizeof(*ctx));
   if(!ctx)
     return NULL;
 
+  ctx->ssl_impl = Curl_ssl;
   ctx->alpn = alpn;
-  ctx->backend = calloc(1, Curl_ssl->sizeof_ssl_backend_data);
+  Curl_bufq_init2(&ctx->earlydata, CURL_SSL_EARLY_MAX, 1, BUFQ_OPT_NO_SPARES);
+  ctx->backend = curlx_calloc(1, ctx->ssl_impl->sizeof_ssl_backend_data);
   if(!ctx->backend) {
-    free(ctx);
+    curlx_free(ctx);
     return NULL;
   }
   return ctx;
@@ -339,355 +211,77 @@ static struct ssl_connect_data *cf_ctx_new(struct Curl_easy *data,
 static void cf_ctx_free(struct ssl_connect_data *ctx)
 {
   if(ctx) {
-    free(ctx->backend);
-    free(ctx);
+    curlx_safefree(ctx->negotiated.alpn);
+    Curl_bufq_free(&ctx->earlydata);
+    curlx_free(ctx->backend);
+    curlx_free(ctx);
   }
 }
 
-static CURLcode ssl_connect(struct Curl_cfilter *cf, struct Curl_easy *data)
+CURLcode Curl_ssl_get_channel_binding(struct Curl_easy *data, int sockindex,
+                                      struct dynbuf *binding)
 {
-  struct ssl_connect_data *connssl = cf->ctx;
-  CURLcode result;
-
-  if(!ssl_prefs_check(data))
-    return CURLE_SSL_CONNECT_ERROR;
-
-  /* mark this is being ssl-enabled from here on. */
-  connssl->state = ssl_connection_negotiating;
-
-  result = Curl_ssl->connect_blocking(cf, data);
-
-  if(!result) {
-    DEBUGASSERT(connssl->state == ssl_connection_complete);
-  }
-
-  return result;
-}
-
-static CURLcode
-ssl_connect_nonblocking(struct Curl_cfilter *cf, struct Curl_easy *data,
-                        bool *done)
-{
-  if(!ssl_prefs_check(data))
-    return CURLE_SSL_CONNECT_ERROR;
-
-  /* mark this is being ssl requested from here on. */
-  return Curl_ssl->connect_nonblocking(cf, data, done);
-}
-
-/*
- * Lock shared SSL session data
- */
-void Curl_ssl_sessionid_lock(struct Curl_easy *data)
-{
-  if(SSLSESSION_SHARED(data))
-    Curl_share_lock(data, CURL_LOCK_DATA_SSL_SESSION, CURL_LOCK_ACCESS_SINGLE);
-}
-
-/*
- * Unlock shared SSL session data
- */
-void Curl_ssl_sessionid_unlock(struct Curl_easy *data)
-{
-  if(SSLSESSION_SHARED(data))
-    Curl_share_unlock(data, CURL_LOCK_DATA_SSL_SESSION);
-}
-
-/*
- * Check if there's a session ID for the given connection in the cache, and if
- * there's one suitable, it is provided. Returns TRUE when no entry matched.
- */
-bool Curl_ssl_getsessionid(struct Curl_cfilter *cf,
-                           struct Curl_easy *data,
-                           void **ssl_sessionid,
-                           size_t *idsize) /* set 0 if unknown */
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
-  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
-  struct Curl_ssl_session *check;
-  size_t i;
-  long *general_age;
-  bool no_match = TRUE;
-
-  *ssl_sessionid = NULL;
-  if(!ssl_config)
-    return TRUE;
-
-  DEBUGASSERT(ssl_config->primary.sessionid);
-
-  if(!ssl_config->primary.sessionid || !data->state.session)
-    /* session ID reuse is disabled or the session cache has not been
-       setup */
-    return TRUE;
-
-  /* Lock if shared */
-  if(SSLSESSION_SHARED(data))
-    general_age = &data->share->sessionage;
-  else
-    general_age = &data->state.sessionage;
-
-  for(i = 0; i < data->set.general_ssl.max_ssl_sessions; i++) {
-    check = &data->state.session[i];
-    if(!check->sessionid)
-      /* not session ID means blank entry */
-      continue;
-    if(strcasecompare(connssl->hostname, check->name) &&
-       ((!cf->conn->bits.conn_to_host && !check->conn_to_host) ||
-        (cf->conn->bits.conn_to_host && check->conn_to_host &&
-         strcasecompare(cf->conn->conn_to_host.name, check->conn_to_host))) &&
-       ((!cf->conn->bits.conn_to_port && check->conn_to_port == -1) ||
-        (cf->conn->bits.conn_to_port && check->conn_to_port != -1 &&
-         cf->conn->conn_to_port == check->conn_to_port)) &&
-       (connssl->port == check->remote_port) &&
-       strcasecompare(cf->conn->handler->scheme, check->scheme) &&
-       Curl_ssl_config_matches(conn_config, &check->ssl_config)) {
-      /* yes, we have a session ID! */
-      (*general_age)++;          /* increase general age */
-      check->age = *general_age; /* set this as used in this age */
-      *ssl_sessionid = check->sessionid;
-      if(idsize)
-        *idsize = check->idsize;
-      no_match = FALSE;
-      break;
-    }
-  }
-
-  DEBUGF(infof(data, "%s Session ID in cache for %s %s://%s:%d",
-               no_match? "Didn't find": "Found",
-               Curl_ssl_cf_is_proxy(cf) ? "proxy" : "host",
-               cf->conn->handler->scheme, connssl->hostname, connssl->port));
-  return no_match;
-}
-
-/*
- * Kill a single session ID entry in the cache.
- */
-void Curl_ssl_kill_session(struct Curl_ssl_session *session)
-{
-  if(session->sessionid) {
-    /* defensive check */
-
-    /* free the ID the SSL-layer specific way */
-    Curl_ssl->session_free(session->sessionid);
-
-    session->sessionid = NULL;
-    session->age = 0; /* fresh */
-
-    Curl_free_primary_ssl_config(&session->ssl_config);
-
-    Curl_safefree(session->name);
-    Curl_safefree(session->conn_to_host);
-  }
-}
-
-/*
- * Delete the given session ID from the cache.
- */
-void Curl_ssl_delsessionid(struct Curl_easy *data, void *ssl_sessionid)
-{
-  size_t i;
-
-  for(i = 0; i < data->set.general_ssl.max_ssl_sessions; i++) {
-    struct Curl_ssl_session *check = &data->state.session[i];
-
-    if(check->sessionid == ssl_sessionid) {
-      Curl_ssl_kill_session(check);
-      break;
-    }
-  }
-}
-
-/*
- * Store session id in the session cache. The ID passed on to this function
- * must already have been extracted and allocated the proper way for the SSL
- * layer. Curl_XXXX_session_free() will be called to free/kill the session ID
- * later on.
- */
-CURLcode Curl_ssl_addsessionid(struct Curl_cfilter *cf,
-                               struct Curl_easy *data,
-                               void *ssl_sessionid,
-                               size_t idsize,
-                               bool *added)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
-  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
-  size_t i;
-  struct Curl_ssl_session *store;
-  long oldest_age;
-  char *clone_host;
-  char *clone_conn_to_host;
-  int conn_to_port;
-  long *general_age;
-
-  if(added)
-    *added = FALSE;
-
-  if(!data->state.session)
-    return CURLE_OK;
-
-  store = &data->state.session[0];
-  oldest_age = data->state.session[0].age; /* zero if unused */
-  (void)ssl_config;
-  DEBUGASSERT(ssl_config->primary.sessionid);
-
-  clone_host = strdup(connssl->hostname);
-  if(!clone_host)
-    return CURLE_OUT_OF_MEMORY; /* bail out */
-
-  if(cf->conn->bits.conn_to_host) {
-    clone_conn_to_host = strdup(cf->conn->conn_to_host.name);
-    if(!clone_conn_to_host) {
-      free(clone_host);
-      return CURLE_OUT_OF_MEMORY; /* bail out */
-    }
-  }
-  else
-    clone_conn_to_host = NULL;
-
-  if(cf->conn->bits.conn_to_port)
-    conn_to_port = cf->conn->conn_to_port;
-  else
-    conn_to_port = -1;
-
-  /* Now we should add the session ID and the host name to the cache, (remove
-     the oldest if necessary) */
-
-  /* If using shared SSL session, lock! */
-  if(SSLSESSION_SHARED(data)) {
-    general_age = &data->share->sessionage;
-  }
-  else {
-    general_age = &data->state.sessionage;
-  }
-
-  /* find an empty slot for us, or find the oldest */
-  for(i = 1; (i < data->set.general_ssl.max_ssl_sessions) &&
-        data->state.session[i].sessionid; i++) {
-    if(data->state.session[i].age < oldest_age) {
-      oldest_age = data->state.session[i].age;
-      store = &data->state.session[i];
-    }
-  }
-  if(i == data->set.general_ssl.max_ssl_sessions)
-    /* cache is full, we must "kill" the oldest entry! */
-    Curl_ssl_kill_session(store);
-  else
-    store = &data->state.session[i]; /* use this slot */
-
-  /* now init the session struct wisely */
-  store->sessionid = ssl_sessionid;
-  store->idsize = idsize;
-  store->age = *general_age;    /* set current age */
-  /* free it if there's one already present */
-  free(store->name);
-  free(store->conn_to_host);
-  store->name = clone_host;               /* clone host name */
-  store->conn_to_host = clone_conn_to_host; /* clone connect to host name */
-  store->conn_to_port = conn_to_port; /* connect to port number */
-  /* port number */
-  store->remote_port = connssl->port;
-  store->scheme = cf->conn->handler->scheme;
-
-  if(!Curl_clone_primary_ssl_config(conn_config, &store->ssl_config)) {
-    Curl_free_primary_ssl_config(&store->ssl_config);
-    store->sessionid = NULL; /* let caller free sessionid */
-    free(clone_host);
-    free(clone_conn_to_host);
-    return CURLE_OUT_OF_MEMORY;
-  }
-
-  if(added)
-    *added = TRUE;
-
-  DEBUGF(infof(data, "Added Session ID to cache for %s://%s:%d [%s]",
-               store->scheme, store->name, store->remote_port,
-               Curl_ssl_cf_is_proxy(cf) ? "PROXY" : "server"));
+  if(Curl_ssl->get_channel_binding)
+    return Curl_ssl->get_channel_binding(data, sockindex, binding);
   return CURLE_OK;
 }
 
-void Curl_free_multi_ssl_backend_data(struct multi_ssl_backend_data *mbackend)
-{
-  if(Curl_ssl->free_multi_ssl_backend_data && mbackend)
-    Curl_ssl->free_multi_ssl_backend_data(mbackend);
-}
-
 void Curl_ssl_close_all(struct Curl_easy *data)
 {
-  /* kill the session ID cache if not shared */
-  if(data->state.session && !SSLSESSION_SHARED(data)) {
-    size_t i;
-    for(i = 0; i < data->set.general_ssl.max_ssl_sessions; i++)
-      /* the single-killer function handles empty table slots */
-      Curl_ssl_kill_session(&data->state.session[i]);
-
-    /* free the cache data */
-    Curl_safefree(data->state.session);
-  }
-
-  Curl_ssl->close_all(data);
+  if(Curl_ssl->close_all)
+    Curl_ssl->close_all(data);
 }
 
-int Curl_ssl_get_select_socks(struct Curl_cfilter *cf, struct Curl_easy *data,
-                              curl_socket_t *socks)
+CURLcode Curl_ssl_adjust_pollset(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 struct easy_pollset *ps)
 {
   struct ssl_connect_data *connssl = cf->ctx;
-  curl_socket_t sock = Curl_conn_cf_get_socket(cf->next, data);
 
-  if(sock == CURL_SOCKET_BAD)
-    return GETSOCK_BLANK;
-
-  if(connssl->connecting_state == ssl_connect_2_writing) {
-    /* we are only interested in writing */
-    socks[0] = sock;
-    return GETSOCK_WRITESOCK(0);
+  if(connssl->io_need) {
+    curl_socket_t sock = Curl_conn_cf_get_socket(cf->next, data);
+    CURLcode result = CURLE_OK;
+    if(sock != CURL_SOCKET_BAD) {
+      if(connssl->io_need & CURL_SSL_IO_NEED_SEND) {
+        result = Curl_pollset_set_out_only(data, ps, sock);
+        CURL_TRC_CF(data, cf, "adjust_pollset, POLLOUT fd=%" FMT_SOCKET_T,
+                    sock);
+      }
+      else {
+        result = Curl_pollset_set_in_only(data, ps, sock);
+        CURL_TRC_CF(data, cf, "adjust_pollset, POLLIN fd=%" FMT_SOCKET_T,
+                    sock);
+      }
+    }
+    return result;
   }
-  socks[0] = sock;
-  return GETSOCK_READSOCK(0);
+  return CURLE_OK;
 }
 
 /* Selects an SSL crypto engine
  */
 CURLcode Curl_ssl_set_engine(struct Curl_easy *data, const char *engine)
 {
-  return Curl_ssl->set_engine(data, engine);
+  if(Curl_ssl->set_engine)
+    return Curl_ssl->set_engine(data, engine);
+  return CURLE_NOT_BUILT_IN;
 }
 
 /* Selects the default SSL crypto engine
  */
 CURLcode Curl_ssl_set_engine_default(struct Curl_easy *data)
 {
-  return Curl_ssl->set_engine_default(data);
+  if(Curl_ssl->set_engine_default)
+    return Curl_ssl->set_engine_default(data);
+  return CURLE_NOT_BUILT_IN;
 }
 
 /* Return list of OpenSSL crypto engine names. */
 struct curl_slist *Curl_ssl_engines_list(struct Curl_easy *data)
 {
-  return Curl_ssl->engines_list(data);
-}
-
-/*
- * This sets up a session ID cache to the specified size. Make sure this code
- * is agnostic to what underlying SSL technology we use.
- */
-CURLcode Curl_ssl_initsessions(struct Curl_easy *data, size_t amount)
-{
-  struct Curl_ssl_session *session;
-
-  if(data->state.session)
-    /* this is just a precaution to prevent multiple inits */
-    return CURLE_OK;
-
-  session = calloc(amount, sizeof(struct Curl_ssl_session));
-  if(!session)
-    return CURLE_OUT_OF_MEMORY;
-
-  /* store the info in the SSL section */
-  data->set.general_ssl.max_ssl_sessions = amount;
-  data->state.session = session;
-  data->state.sessionage = 1; /* this is brand new */
-  return CURLE_OK;
+  if(Curl_ssl->engines_list)
+    return Curl_ssl->engines_list(data);
+  return NULL;
 }
 
 static size_t multissl_version(char *buffer, size_t size);
@@ -708,13 +302,12 @@ void Curl_ssl_free_certinfo(struct Curl_easy *data)
   if(ci->num_of_certs) {
     /* free all individual lists used */
     int i;
-    for(i = 0; i<ci->num_of_certs; i++) {
+    for(i = 0; i < ci->num_of_certs; i++) {
       curl_slist_free_all(ci->certinfo[i]);
       ci->certinfo[i] = NULL;
     }
 
-    free(ci->certinfo); /* free the actual array too */
-    ci->certinfo = NULL;
+    curlx_safefree(ci->certinfo); /* free the actual array too */
     ci->num_of_certs = 0;
   }
 }
@@ -728,7 +321,7 @@ CURLcode Curl_ssl_init_certinfo(struct Curl_easy *data, int num)
   Curl_ssl_free_certinfo(data);
 
   /* Allocate the required certificate information structures */
-  table = calloc((size_t) num, sizeof(struct curl_slist *));
+  table = curlx_calloc((size_t)num, sizeof(struct curl_slist *));
   if(!table)
     return CURLE_OUT_OF_MEMORY;
 
@@ -748,28 +341,22 @@ CURLcode Curl_ssl_push_certinfo_len(struct Curl_easy *data,
                                     size_t valuelen)
 {
   struct curl_certinfo *ci = &data->info.certs;
-  char *output;
   struct curl_slist *nl;
   CURLcode result = CURLE_OK;
-  size_t labellen = strlen(label);
-  size_t outlen = labellen + 1 + valuelen + 1; /* label:value\0 */
+  struct dynbuf build;
 
-  output = malloc(outlen);
-  if(!output)
+  DEBUGASSERT(certnum < ci->num_of_certs);
+
+  curlx_dyn_init(&build, CURL_X509_STR_MAX);
+
+  if(curlx_dyn_add(&build, label) ||
+     curlx_dyn_addn(&build, ":", 1) ||
+     curlx_dyn_addn(&build, value, valuelen))
     return CURLE_OUT_OF_MEMORY;
 
-  /* sprintf the label and colon */
-  msnprintf(output, outlen, "%s:", label);
-
-  /* memcpy the value (it might not be null-terminated) */
-  memcpy(&output[labellen + 1], value, valuelen);
-
-  /* null-terminate the output */
-  output[labellen + 1 + valuelen] = 0;
-
-  nl = Curl_slist_append_nodup(ci->certinfo[certnum], output);
+  nl = Curl_slist_append_nodup(ci->certinfo[certnum], curlx_dyn_ptr(&build));
   if(!nl) {
-    free(output);
+    curlx_dyn_free(&build);
     curl_slist_free_all(ci->certinfo[certnum]);
     result = CURLE_OUT_OF_MEMORY;
   }
@@ -778,37 +365,15 @@ CURLcode Curl_ssl_push_certinfo_len(struct Curl_easy *data,
   return result;
 }
 
+/* get length bytes of randomness */
 CURLcode Curl_ssl_random(struct Curl_easy *data,
-                         unsigned char *entropy,
-                         size_t length)
+                         unsigned char *buffer, size_t length)
 {
-  return Curl_ssl->random(data, entropy, length);
-}
-
-/*
- * Curl_ssl_snihost() converts the input host name to a suitable SNI name put
- * in data->state.buffer. Returns a pointer to the name (or NULL if a problem)
- * and stores the new length in 'olen'.
- *
- * SNI fields must not have any trailing dot and while RFC 6066 section 3 says
- * the SNI field is case insensitive, browsers always send the data lowercase
- * and subsequently there are numerous servers out there that don't work
- * unless the name is lowercased.
- */
-
-char *Curl_ssl_snihost(struct Curl_easy *data, const char *host, size_t *olen)
-{
-  size_t len = strlen(host);
-  if(len && (host[len-1] == '.'))
-    len--;
-  if(len >= data->set.buffer_size)
-    return NULL;
-
-  Curl_strntolower(data->state.buffer, host, len);
-  data->state.buffer[len] = 0;
-  if(olen)
-    *olen = len;
-  return data->state.buffer;
+  DEBUGASSERT(length == sizeof(int));
+  if(Curl_ssl->random)
+    return Curl_ssl->random(data, buffer, length);
+  else
+    return CURLE_NOT_BUILT_IN;
 }
 
 /*
@@ -818,21 +383,24 @@ char *Curl_ssl_snihost(struct Curl_easy *data, const char *host, size_t *olen)
 static CURLcode pubkey_pem_to_der(const char *pem,
                                   unsigned char **der, size_t *der_len)
 {
-  char *stripped_pem, *begin_pos, *end_pos;
-  size_t pem_count, stripped_pem_count = 0, pem_len;
+  const char *begin_pos, *end_pos;
+  size_t pem_count, pem_len;
   CURLcode result;
+  struct dynbuf pbuf;
 
   /* if no pem, exit. */
   if(!pem)
     return CURLE_BAD_CONTENT_ENCODING;
 
+  curlx_dyn_init(&pbuf, MAX_PINNED_PUBKEY_SIZE);
+
   begin_pos = strstr(pem, "-----BEGIN PUBLIC KEY-----");
   if(!begin_pos)
     return CURLE_BAD_CONTENT_ENCODING;
 
   pem_count = begin_pos - pem;
   /* Invalid if not at beginning AND not directly following \n */
-  if(0 != pem_count && '\n' != pem[pem_count - 1])
+  if(pem_count && '\n' != pem[pem_count - 1])
     return CURLE_BAD_CONTENT_ENCODING;
 
   /* 26 is length of "-----BEGIN PUBLIC KEY-----" */
@@ -845,26 +413,26 @@ static CURLcode pubkey_pem_to_der(const char *pem,
 
   pem_len = end_pos - pem;
 
-  stripped_pem = malloc(pem_len - pem_count + 1);
-  if(!stripped_pem)
-    return CURLE_OUT_OF_MEMORY;
-
   /*
    * Here we loop through the pem array one character at a time between the
    * correct indices, and place each character that is not '\n' or '\r'
    * into the stripped_pem array, which should represent the raw base64 string
    */
   while(pem_count < pem_len) {
-    if('\n' != pem[pem_count] && '\r' != pem[pem_count])
-      stripped_pem[stripped_pem_count++] = pem[pem_count];
+    if('\n' != pem[pem_count] && '\r' != pem[pem_count]) {
+      result = curlx_dyn_addn(&pbuf, &pem[pem_count], 1);
+      if(result)
+        return result;
+    }
     ++pem_count;
   }
-  /* Place the null terminator in the correct place */
-  stripped_pem[stripped_pem_count] = '\0';
 
-  result = Curl_base64_decode(stripped_pem, der, der_len);
-
-  Curl_safefree(stripped_pem);
+  if(curlx_dyn_len(&pbuf)) {
+    result = curlx_base64_decode(curlx_dyn_ptr(&pbuf), der, der_len);
+    curlx_dyn_free(&pbuf);
+  }
+  else
+    result = CURLE_BAD_CONTENT_ENCODING;
 
   return result;
 }
@@ -877,24 +445,20 @@ CURLcode Curl_pin_peer_pubkey(struct Curl_easy *data,
                               const char *pinnedpubkey,
                               const unsigned char *pubkey, size_t pubkeylen)
 {
-  FILE *fp;
-  unsigned char *buf = NULL, *pem_ptr = NULL;
   CURLcode result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
-#ifdef CURL_DISABLE_VERBOSE_STRINGS
-  (void)data;
-#endif
 
-  /* if a path wasn't specified, don't pin */
+  /* if a path was not specified, do not pin */
   if(!pinnedpubkey)
     return CURLE_OK;
   if(!pubkey || !pubkeylen)
     return result;
 
   /* only do this if pinnedpubkey starts with "sha256//", length 8 */
-  if(strncmp(pinnedpubkey, "sha256//", 8) == 0) {
+  if(!strncmp(pinnedpubkey, "sha256//", 8)) {
     CURLcode encode;
-    size_t encodedlen = 0, pinkeylen;
-    char *encoded = NULL, *pinkeycopy, *begin_pos, *end_pos;
+    char *cert_hash = NULL;
+    const char *pinned_hash, *end_pos;
+    size_t cert_hash_len = 0, pinned_hash_len;
     unsigned char *sha256sumdigest;
 
     if(!Curl_ssl->sha256sum) {
@@ -903,129 +467,117 @@ CURLcode Curl_pin_peer_pubkey(struct Curl_easy *data,
     }
 
     /* compute sha256sum of public key */
-    sha256sumdigest = malloc(CURL_SHA256_DIGEST_LENGTH);
+    sha256sumdigest = curlx_malloc(CURL_SHA256_DIGEST_LENGTH);
     if(!sha256sumdigest)
       return CURLE_OUT_OF_MEMORY;
     encode = Curl_ssl->sha256sum(pubkey, pubkeylen,
                                  sha256sumdigest, CURL_SHA256_DIGEST_LENGTH);
 
     if(!encode)
-      encode = Curl_base64_encode((char *)sha256sumdigest,
-                                  CURL_SHA256_DIGEST_LENGTH, &encoded,
-                                  &encodedlen);
-    Curl_safefree(sha256sumdigest);
+      encode = curlx_base64_encode(sha256sumdigest,
+                                   CURL_SHA256_DIGEST_LENGTH,
+                                   &cert_hash, &cert_hash_len);
+    curlx_safefree(sha256sumdigest);
 
     if(encode)
       return encode;
 
-    infof(data, " public key hash: sha256//%s", encoded);
+    infof(data, " public key hash: sha256//%s", cert_hash);
 
-    /* it starts with sha256//, copy so we can modify it */
-    pinkeylen = strlen(pinnedpubkey) + 1;
-    pinkeycopy = malloc(pinkeylen);
-    if(!pinkeycopy) {
-      Curl_safefree(encoded);
-      return CURLE_OUT_OF_MEMORY;
-    }
-    memcpy(pinkeycopy, pinnedpubkey, pinkeylen);
-    /* point begin_pos to the copy, and start extracting keys */
-    begin_pos = pinkeycopy;
-    do {
-      end_pos = strstr(begin_pos, ";sha256//");
-      /*
-       * if there is an end_pos, null terminate,
-       * otherwise it'll go to the end of the original string
-       */
-      if(end_pos)
-        end_pos[0] = '\0';
+    pinned_hash = pinnedpubkey;
+    while(pinned_hash &&
+          !strncmp(pinned_hash, "sha256//", (sizeof("sha256//") - 1))) {
+      pinned_hash = pinned_hash + (sizeof("sha256//") - 1);
+      end_pos = strchr(pinned_hash, ';');
+      pinned_hash_len = end_pos ?
+                        (size_t)(end_pos - pinned_hash) : strlen(pinned_hash);
 
-      /* compare base64 sha256 digests, 8 is the length of "sha256//" */
-      if(encodedlen == strlen(begin_pos + 8) &&
-         !memcmp(encoded, begin_pos + 8, encodedlen)) {
+      /* compare base64 sha256 digests */
+      if(cert_hash_len == pinned_hash_len &&
+         !memcmp(cert_hash, pinned_hash, cert_hash_len)) {
+        DEBUGF(infof(data, "public key hash matches pinned value"));
         result = CURLE_OK;
         break;
       }
 
-      /*
-       * change back the null-terminator we changed earlier,
-       * and look for next begin
-       */
-      if(end_pos) {
-        end_pos[0] = ';';
-        begin_pos = strstr(end_pos, "sha256//");
-      }
-    } while(end_pos && begin_pos);
-    Curl_safefree(encoded);
-    Curl_safefree(pinkeycopy);
-    return result;
+      DEBUGF(infof(data, "public key hash does not match 'sha256//%.*s'",
+                   (int)pinned_hash_len, pinned_hash));
+      /* next one or we are at the end */
+      pinned_hash = end_pos ? (end_pos + 1) : NULL;
+    }
+    curlx_safefree(cert_hash);
   }
-
-  fp = fopen(pinnedpubkey, "rb");
-  if(!fp)
-    return result;
-
-  do {
+  else {
     long filesize;
     size_t size, pem_len;
     CURLcode pem_read;
+    struct dynbuf buf;
+    unsigned char *pem_ptr = NULL;
+    size_t left;
+    FILE *fp = curlx_fopen(pinnedpubkey, "rb");
+    if(!fp)
+      return result;
+
+    curlx_dyn_init(&buf, MAX_PINNED_PUBKEY_SIZE);
 
     /* Determine the file's size */
     if(fseek(fp, 0, SEEK_END))
-      break;
+      goto end;
     filesize = ftell(fp);
     if(fseek(fp, 0, SEEK_SET))
-      break;
+      goto end;
     if(filesize < 0 || filesize > MAX_PINNED_PUBKEY_SIZE)
-      break;
+      goto end;
 
     /*
      * if the size of our certificate is bigger than the file
-     * size then it can't match
+     * size then it cannot match
      */
-    size = curlx_sotouz((curl_off_t) filesize);
+    size = curlx_sotouz((curl_off_t)filesize);
     if(pubkeylen > size)
-      break;
+      goto end;
 
     /*
-     * Allocate buffer for the pinned key
-     * With 1 additional byte for null terminator in case of PEM key
+     * Read the file into the dynbuf
      */
-    buf = malloc(size + 1);
-    if(!buf)
-      break;
+    left = size;
+    do {
+      char buffer[1024];
+      size_t want = left > sizeof(buffer) ? sizeof(buffer) : left;
+      if(want != fread(buffer, 1, want, fp))
+        goto end;
+      if(curlx_dyn_addn(&buf, buffer, want))
+        goto end;
+      left -= want;
+    } while(left);
 
-    /* Returns number of elements read, which should be 1 */
-    if((int) fread(buf, size, 1, fp) != 1)
-      break;
-
-    /* If the sizes are the same, it can't be base64 encoded, must be der */
+    /* If the sizes are the same, it cannot be base64 encoded, must be der */
     if(pubkeylen == size) {
-      if(!memcmp(pubkey, buf, pubkeylen))
+      if(!memcmp(pubkey, curlx_dyn_ptr(&buf), pubkeylen))
         result = CURLE_OK;
-      break;
+      goto end;
     }
 
     /*
-     * Otherwise we will assume it's PEM and try to decode it
-     * after placing null terminator
+     * Otherwise we assume it is PEM and try to decode it after placing
+     * null-terminator
      */
-    buf[size] = '\0';
-    pem_read = pubkey_pem_to_der((const char *)buf, &pem_ptr, &pem_len);
-    /* if it wasn't read successfully, exit */
+    pem_read = pubkey_pem_to_der(curlx_dyn_ptr(&buf), &pem_ptr, &pem_len);
+    /* if it was not read successfully, exit */
     if(pem_read)
-      break;
+      goto end;
 
     /*
-     * if the size of our certificate doesn't match the size of
-     * the decoded file, they can't be the same, otherwise compare
+     * if the size of our certificate does not match the size of
+     * the decoded file, they cannot be the same, otherwise compare
      */
     if(pubkeylen == pem_len && !memcmp(pubkey, pem_ptr, pubkeylen))
       result = CURLE_OK;
-  } while(0);
-
-  Curl_safefree(buf);
-  Curl_safefree(pem_ptr);
-  fclose(fp);
+end:
+    curlx_dyn_free(&buf);
+    curlx_safefree(pem_ptr);
+    curlx_fclose(fp);
+  }
 
   return result;
 }
@@ -1035,100 +587,8 @@ CURLcode Curl_pin_peer_pubkey(struct Curl_easy *data,
  */
 bool Curl_ssl_cert_status_request(void)
 {
-  return Curl_ssl->cert_status_request();
-}
-
-/*
- * Check whether the SSL backend supports false start.
- */
-bool Curl_ssl_false_start(struct Curl_easy *data)
-{
-  (void)data;
-  return Curl_ssl->false_start();
-}
-
-/*
- * Default implementations for unsupported functions.
- */
-
-int Curl_none_init(void)
-{
-  return 1;
-}
-
-void Curl_none_cleanup(void)
-{ }
-
-int Curl_none_shutdown(struct Curl_cfilter *cf UNUSED_PARAM,
-                       struct Curl_easy *data UNUSED_PARAM)
-{
-  (void)data;
-  (void)cf;
-  return 0;
-}
-
-int Curl_none_check_cxn(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  (void)cf;
-  (void)data;
-  return -1;
-}
-
-CURLcode Curl_none_random(struct Curl_easy *data UNUSED_PARAM,
-                          unsigned char *entropy UNUSED_PARAM,
-                          size_t length UNUSED_PARAM)
-{
-  (void)data;
-  (void)entropy;
-  (void)length;
-  return CURLE_NOT_BUILT_IN;
-}
-
-void Curl_none_close_all(struct Curl_easy *data UNUSED_PARAM)
-{
-  (void)data;
-}
-
-void Curl_none_session_free(void *ptr UNUSED_PARAM)
-{
-  (void)ptr;
-}
-
-bool Curl_none_data_pending(struct Curl_cfilter *cf UNUSED_PARAM,
-                            const struct Curl_easy *data UNUSED_PARAM)
-{
-  (void)cf;
-  (void)data;
-  return 0;
-}
-
-bool Curl_none_cert_status_request(void)
-{
-  return FALSE;
-}
-
-CURLcode Curl_none_set_engine(struct Curl_easy *data UNUSED_PARAM,
-                              const char *engine UNUSED_PARAM)
-{
-  (void)data;
-  (void)engine;
-  return CURLE_NOT_BUILT_IN;
-}
-
-CURLcode Curl_none_set_engine_default(struct Curl_easy *data UNUSED_PARAM)
-{
-  (void)data;
-  return CURLE_NOT_BUILT_IN;
-}
-
-struct curl_slist *Curl_none_engines_list(struct Curl_easy *data UNUSED_PARAM)
-{
-  (void)data;
-  return (struct curl_slist *)NULL;
-}
-
-bool Curl_none_false_start(void)
-{
+  if(Curl_ssl->cert_status_request)
+    return Curl_ssl->cert_status_request();
   return FALSE;
 }
 
@@ -1136,33 +596,34 @@ static int multissl_init(void)
 {
   if(multissl_setup(NULL))
     return 1;
-  return Curl_ssl->init();
+  if(Curl_ssl->init)
+    return Curl_ssl->init();
+  return 1;
+}
+
+static CURLcode multissl_random(struct Curl_easy *data,
+                                unsigned char *entropy, size_t length)
+{
+  if(multissl_setup(NULL))
+    return CURLE_FAILED_INIT;
+  return Curl_ssl->random(data, entropy, length);
 }
 
 static CURLcode multissl_connect(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data)
+                                 struct Curl_easy *data, bool *done)
 {
   if(multissl_setup(NULL))
     return CURLE_FAILED_INIT;
-  return Curl_ssl->connect_blocking(cf, data);
+  return Curl_ssl->do_connect(cf, data, done);
 }
 
-static CURLcode multissl_connect_nonblocking(struct Curl_cfilter *cf,
-                                             struct Curl_easy *data,
-                                             bool *done)
+static CURLcode multissl_adjust_pollset(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data,
+                                        struct easy_pollset *ps)
 {
   if(multissl_setup(NULL))
-    return CURLE_FAILED_INIT;
-  return Curl_ssl->connect_nonblocking(cf, data, done);
-}
-
-static int multissl_get_select_socks(struct Curl_cfilter *cf,
-                                     struct Curl_easy *data,
-                                     curl_socket_t *socks)
-{
-  if(multissl_setup(NULL))
-    return 0;
-  return Curl_ssl->get_select_socks(cf, data, socks);
+    return CURLE_OK;
+  return Curl_ssl->adjust_pollset(cf, data, ps);
 }
 
 static void *multissl_get_internals(struct ssl_connect_data *connssl,
@@ -1180,23 +641,23 @@ static void multissl_close(struct Curl_cfilter *cf, struct Curl_easy *data)
   Curl_ssl->close(cf, data);
 }
 
-static ssize_t multissl_recv_plain(struct Curl_cfilter *cf,
-                                   struct Curl_easy *data,
-                                   char *buf, size_t len, CURLcode *code)
+static CURLcode multissl_recv_plain(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    char *buf, size_t len, size_t *pnread)
 {
   if(multissl_setup(NULL))
     return CURLE_FAILED_INIT;
-  return Curl_ssl->recv_plain(cf, data, buf, len, code);
+  return Curl_ssl->recv_plain(cf, data, buf, len, pnread);
 }
 
-static ssize_t multissl_send_plain(struct Curl_cfilter *cf,
-                                   struct Curl_easy *data,
-                                   const void *mem, size_t len,
-                                   CURLcode *code)
+static CURLcode multissl_send_plain(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    const void *mem, size_t len,
+                                    size_t *pnwritten)
 {
   if(multissl_setup(NULL))
     return CURLE_FAILED_INIT;
-  return Curl_ssl->send_plain(cf, data, mem, len, code);
+  return Curl_ssl->send_plain(cf, data, mem, len, pnwritten);
 }
 
 static const struct Curl_ssl Curl_ssl_multi = {
@@ -1205,39 +666,31 @@ static const struct Curl_ssl Curl_ssl_multi = {
   (size_t)-1, /* something insanely large to be on the safe side */
 
   multissl_init,                     /* init */
-  Curl_none_cleanup,                 /* cleanup */
+  NULL,                              /* cleanup */
   multissl_version,                  /* version */
-  Curl_none_check_cxn,               /* check_cxn */
-  Curl_none_shutdown,                /* shutdown */
-  Curl_none_data_pending,            /* data_pending */
-  Curl_none_random,                  /* random */
-  Curl_none_cert_status_request,     /* cert_status_request */
+  NULL,                              /* shutdown */
+  NULL,                              /* data_pending */
+  multissl_random,                   /* random */
+  NULL,                              /* cert_status_request */
   multissl_connect,                  /* connect */
-  multissl_connect_nonblocking,      /* connect_nonblocking */
-  multissl_get_select_socks,         /* getsock */
+  multissl_adjust_pollset,           /* adjust_pollset */
   multissl_get_internals,            /* get_internals */
   multissl_close,                    /* close_one */
-  Curl_none_close_all,               /* close_all */
-  Curl_none_session_free,            /* session_free */
-  Curl_none_set_engine,              /* set_engine */
-  Curl_none_set_engine_default,      /* set_engine_default */
-  Curl_none_engines_list,            /* engines_list */
-  Curl_none_false_start,             /* false_start */
+  NULL,                              /* close_all */
+  NULL,                              /* set_engine */
+  NULL,                              /* set_engine_default */
+  NULL,                              /* engines_list */
   NULL,                              /* sha256sum */
-  NULL,                              /* associate_connection */
-  NULL,                              /* disassociate_connection */
-  NULL,                              /* free_multi_ssl_backend_data */
   multissl_recv_plain,               /* recv decrypted data */
   multissl_send_plain,               /* send data to encrypt */
+  NULL,                              /* get_channel_binding */
 };
 
 const struct Curl_ssl *Curl_ssl =
-#if defined(CURL_WITH_MULTI_SSL)
+#ifdef CURL_WITH_MULTI_SSL
   &Curl_ssl_multi;
 #elif defined(USE_WOLFSSL)
   &Curl_ssl_wolfssl;
-#elif defined(USE_SECTRANSP)
-  &Curl_ssl_sectransp;
 #elif defined(USE_GNUTLS)
   &Curl_ssl_gnutls;
 #elif defined(USE_MBEDTLS)
@@ -1248,40 +701,46 @@ const struct Curl_ssl *Curl_ssl =
   &Curl_ssl_openssl;
 #elif defined(USE_SCHANNEL)
   &Curl_ssl_schannel;
-#elif defined(USE_BEARSSL)
-  &Curl_ssl_bearssl;
 #else
 #error "Missing struct Curl_ssl for selected SSL backend"
 #endif
 
 static const struct Curl_ssl *available_backends[] = {
-#if defined(USE_WOLFSSL)
+#ifdef USE_WOLFSSL
   &Curl_ssl_wolfssl,
 #endif
-#if defined(USE_SECTRANSP)
-  &Curl_ssl_sectransp,
-#endif
-#if defined(USE_GNUTLS)
+#ifdef USE_GNUTLS
   &Curl_ssl_gnutls,
 #endif
-#if defined(USE_MBEDTLS)
+#ifdef USE_MBEDTLS
   &Curl_ssl_mbedtls,
 #endif
-#if defined(USE_OPENSSL)
+#ifdef USE_OPENSSL
   &Curl_ssl_openssl,
 #endif
-#if defined(USE_SCHANNEL)
+#ifdef USE_SCHANNEL
   &Curl_ssl_schannel,
 #endif
-#if defined(USE_BEARSSL)
-  &Curl_ssl_bearssl,
-#endif
-#if defined(USE_RUSTLS)
+#ifdef USE_RUSTLS
   &Curl_ssl_rustls,
 #endif
   NULL
 };
 
+/* Global cleanup */
+void Curl_ssl_cleanup(void)
+{
+  if(init_ssl) {
+    /* only cleanup if we did a previous init */
+    if(Curl_ssl->cleanup)
+      Curl_ssl->cleanup();
+#ifdef CURL_WITH_MULTI_SSL
+    Curl_ssl = &Curl_ssl_multi;
+#endif
+    init_ssl = FALSE;
+  }
+}
+
 static size_t multissl_version(char *buffer, size_t size)
 {
   static const struct Curl_ssl *selected;
@@ -1293,7 +752,7 @@ static size_t multissl_version(char *buffer, size_t size)
 
   if(current != selected) {
     char *p = backends;
-    char *end = backends + sizeof(backends);
+    const char *end = backends + sizeof(backends);
     int i;
 
     selected = current;
@@ -1305,31 +764,24 @@ static size_t multissl_version(char *buffer, size_t size)
       bool paren = (selected != available_backends[i]);
 
       if(available_backends[i]->version(vb, sizeof(vb))) {
-        p += msnprintf(p, end - p, "%s%s%s%s", (p != backends ? " " : ""),
-                       (paren ? "(" : ""), vb, (paren ? ")" : ""));
+        p += curl_msnprintf(p, end - p, "%s%s%s%s", (p != backends ? " " : ""),
+                            (paren ? "(" : ""), vb, (paren ? ")" : ""));
       }
     }
 
     backends_len = p - backends;
   }
 
-  if(!size)
-    return 0;
-
-  if(size <= backends_len) {
-    strncpy(buffer, backends, size - 1);
-    buffer[size - 1] = '\0';
-    return size - 1;
+  if(size) {
+    curlx_strcopy(buffer, size, backends, backends_len);
   }
-
-  strcpy(buffer, backends);
-  return backends_len;
+  return 0;
 }
 
 static int multissl_setup(const struct Curl_ssl *backend)
 {
-  const char *env;
-  char *env_tmp;
+  int i;
+  char *env;
 
   if(Curl_ssl != &Curl_ssl_multi)
     return 1;
@@ -1342,25 +794,31 @@ static int multissl_setup(const struct Curl_ssl *backend)
   if(!available_backends[0])
     return 1;
 
-  env = env_tmp = curl_getenv("CURL_SSL_BACKEND");
-#ifdef CURL_DEFAULT_SSL_BACKEND
-  if(!env)
-    env = CURL_DEFAULT_SSL_BACKEND;
-#endif
+  env = curl_getenv("CURL_SSL_BACKEND");
   if(env) {
-    int i;
     for(i = 0; available_backends[i]; i++) {
-      if(strcasecompare(env, available_backends[i]->info.name)) {
+      if(curl_strequal(env, available_backends[i]->info.name)) {
         Curl_ssl = available_backends[i];
-        free(env_tmp);
+        curlx_free(env);
         return 0;
       }
     }
   }
 
+#ifdef CURL_DEFAULT_SSL_BACKEND
+  for(i = 0; available_backends[i]; i++) {
+    if(curl_strequal(CURL_DEFAULT_SSL_BACKEND,
+                     available_backends[i]->info.name)) {
+      Curl_ssl = available_backends[i];
+      curlx_free(env);
+      return 0;
+    }
+  }
+#endif
+
   /* Fall back to first available backend */
   Curl_ssl = available_backends[0];
-  free(env_tmp);
+  curlx_free(env);
   return 0;
 }
 
@@ -1376,9 +834,9 @@ CURLsslset Curl_init_sslset_nolock(curl_sslbackend id, const char *name,
 
   if(Curl_ssl != &Curl_ssl_multi)
     return id == Curl_ssl->info.id ||
-           (name && strcasecompare(name, Curl_ssl->info.name)) ?
+           (name && curl_strequal(name, Curl_ssl->info.name)) ?
            CURLSSLSET_OK :
-#if defined(CURL_WITH_MULTI_SSL)
+#ifdef CURL_WITH_MULTI_SSL
            CURLSSLSET_TOO_LATE;
 #else
            CURLSSLSET_UNKNOWN_BACKEND;
@@ -1386,7 +844,7 @@ CURLsslset Curl_init_sslset_nolock(curl_sslbackend id, const char *name,
 
   for(i = 0; available_backends[i]; i++) {
     if(available_backends[i]->info.id == id ||
-       (name && strcasecompare(available_backends[i]->info.name, name))) {
+       (name && curl_strequal(available_backends[i]->info.name, name))) {
       multissl_setup(available_backends[i]);
       return CURLSSLSET_OK;
     }
@@ -1409,71 +867,92 @@ CURLsslset Curl_init_sslset_nolock(curl_sslbackend id, const char *name,
 
 #ifdef USE_SSL
 
-static void free_hostname(struct ssl_connect_data *connssl)
+void Curl_ssl_peer_cleanup(struct ssl_peer *peer)
 {
-  if(connssl->dispname != connssl->hostname)
-    free(connssl->dispname);
-  free(connssl->hostname);
-  connssl->hostname = connssl->dispname = NULL;
+  Curl_peer_unlink(&peer->origin);
+  Curl_peer_unlink(&peer->peer);
+  curlx_safefree(peer->sni);
+  curlx_safefree(peer->scache_key);
+  peer->transport = TRNSPRT_NONE;
+  peer->type = CURL_SSL_PEER_DNS;
 }
 
 static void cf_close(struct Curl_cfilter *cf, struct Curl_easy *data)
 {
   struct ssl_connect_data *connssl = cf->ctx;
   if(connssl) {
-    Curl_ssl->close(cf, data);
+    connssl->ssl_impl->close(cf, data);
     connssl->state = ssl_connection_none;
-    free_hostname(connssl);
+    connssl->connecting_state = ssl_connect_1;
+    connssl->prefs_checked = FALSE;
+    Curl_ssl_peer_cleanup(&connssl->peer);
   }
   cf->connected = FALSE;
 }
 
-static CURLcode reinit_hostname(struct Curl_cfilter *cf)
+static ssl_peer_type get_peer_type(const char *hostname)
 {
-  struct ssl_connect_data *connssl = cf->ctx;
-  const char *ehostname, *edispname;
-  int eport;
-
-  /* We need the hostname for SNI negotiation. Once handshaked, this
-   * remains the SNI hostname for the TLS connection. But when the
-   * connection is reused, the settings in cf->conn might change.
-   * So we keep a copy of the hostname we use for SNI.
-   */
-#ifndef CURL_DISABLE_PROXY
-  if(Curl_ssl_cf_is_proxy(cf)) {
-    ehostname = cf->conn->http_proxy.host.name;
-    edispname = cf->conn->http_proxy.host.dispname;
-    eport = cf->conn->http_proxy.port;
-  }
-  else
+  if(hostname && hostname[0]) {
+#ifdef USE_IPV6
+    struct in6_addr addr;
+#else
+    struct in_addr addr;
 #endif
-  {
-    ehostname = cf->conn->host.name;
-    edispname = cf->conn->host.dispname;
-    eport = cf->conn->remote_port;
+    if(curlx_inet_pton(AF_INET, hostname, &addr))
+      return CURL_SSL_PEER_IPV4;
+#ifdef USE_IPV6
+    else if(curlx_inet_pton(AF_INET6, hostname, &addr)) {
+      return CURL_SSL_PEER_IPV6;
+    }
+#endif
+  }
+  return CURL_SSL_PEER_DNS;
+}
+
+CURLcode Curl_ssl_peer_init(struct ssl_peer *ssl_peer,
+                            struct Curl_peer *origin,
+                            struct Curl_peer *peer,
+                            struct ssl_primary_config *sslc,
+                            const char *tls_id,
+                            uint8_t transport)
+{
+  CURLcode result = CURLE_OUT_OF_MEMORY;
+
+  /* We expect a clean struct, e.g. called only ONCE */
+  if(!ssl_peer || !origin) {
+    DEBUGASSERT(0);
+    return CURLE_FAILED_INIT;
+  }
+  DEBUGASSERT(!ssl_peer->origin);
+  DEBUGASSERT(!ssl_peer->peer);
+  DEBUGASSERT(!ssl_peer->sni);
+  ssl_peer->transport = transport;
+
+  Curl_peer_link(&ssl_peer->origin, origin);
+  Curl_peer_link(&ssl_peer->peer, peer);
+  ssl_peer->type = get_peer_type(origin->hostname);
+  if(ssl_peer->type == CURL_SSL_PEER_DNS) {
+    /* not an IP address, normalize according to RCC 6066 ch. 3,
+     * max len of SNI is 2^16-1, no trailing dot */
+    size_t len = strlen(origin->hostname);
+    if(len && (origin->hostname[len - 1] == '.'))
+      len--;
+    if(len < USHRT_MAX) {
+      ssl_peer->sni = curlx_calloc(1, len + 1);
+      if(!ssl_peer->sni)
+        goto out;
+      Curl_strntolower(ssl_peer->sni, origin->hostname, len);
+      ssl_peer->sni[len] = 0;
+    }
   }
 
-  /* change if ehostname changed */
-  if(ehostname && (!connssl->hostname
-                   || strcmp(ehostname, connssl->hostname))) {
-    free_hostname(connssl);
-    connssl->hostname = strdup(ehostname);
-    if(!connssl->hostname) {
-      free_hostname(connssl);
-      return CURLE_OUT_OF_MEMORY;
-    }
-    if(!edispname || !strcmp(ehostname, edispname))
-      connssl->dispname = connssl->hostname;
-    else {
-      connssl->dispname = strdup(edispname);
-      if(!connssl->dispname) {
-        free_hostname(connssl);
-        return CURLE_OUT_OF_MEMORY;
-      }
-    }
-  }
-  connssl->port = eport;
-  return CURLE_OK;
+  result = Curl_ssl_peer_key_make(ssl_peer, sslc, tls_id,
+                                  &ssl_peer->scache_key);
+
+out:
+  if(result)
+    Curl_ssl_peer_cleanup(ssl_peer);
+  return result;
 }
 
 static void ssl_cf_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
@@ -1487,162 +966,274 @@ static void ssl_cf_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
   cf->ctx = NULL;
 }
 
-static void ssl_cf_close(struct Curl_cfilter *cf,
-                         struct Curl_easy *data)
-{
-  struct cf_call_data save;
-
-  CF_DATA_SAVE(save, cf, data);
-  cf_close(cf, data);
-  cf->next->cft->do_close(cf->next, data);
-  CF_DATA_RESTORE(cf, save);
-}
-
 static CURLcode ssl_cf_connect(struct Curl_cfilter *cf,
                                struct Curl_easy *data,
-                               bool blocking, bool *done)
+                               bool *done)
 {
   struct ssl_connect_data *connssl = cf->ctx;
   struct cf_call_data save;
   CURLcode result;
 
-  if(cf->connected) {
+  if(cf->connected && (connssl->state != ssl_connection_deferred)) {
     *done = TRUE;
     return CURLE_OK;
   }
 
+  if(!cf->next || !connssl->peer.origin) {
+    *done = FALSE;
+    return CURLE_FAILED_INIT;
+  }
+
+  if(!cf->next->connected) {
+    result = cf->next->cft->do_connect(cf->next, data, done);
+    if(result || !*done)
+      return result;
+  }
+
   CF_DATA_SAVE(save, cf, data);
   CURL_TRC_CF(data, cf, "cf_connect()");
-  (void)connssl;
-  DEBUGASSERT(data->conn);
-  DEBUGASSERT(data->conn == cf->conn);
   DEBUGASSERT(connssl);
-  DEBUGASSERT(cf->conn->host.name);
-
-  result = cf->next->cft->do_connect(cf->next, data, blocking, done);
-  if(result || !*done)
-    goto out;
 
   *done = FALSE;
-  result = reinit_hostname(cf);
-  if(result)
-    goto out;
 
-  if(blocking) {
-    result = ssl_connect(cf, data);
-    *done = (result == CURLE_OK);
-  }
-  else {
-    result = ssl_connect_nonblocking(cf, data, done);
+  if(!connssl->prefs_checked) {
+    if(!ssl_prefs_check(data)) {
+      result = CURLE_SSL_CONNECT_ERROR;
+      goto out;
+    }
+    connssl->prefs_checked = TRUE;
   }
 
+  result = connssl->ssl_impl->do_connect(cf, data, done);
+
   if(!result && *done) {
     cf->connected = TRUE;
-    connssl->handshake_done = Curl_now();
-    DEBUGASSERT(connssl->state == ssl_connection_complete);
+    if(connssl->state == ssl_connection_complete) {
+      connssl->handshake_done = *Curl_pgrs_now(data);
+    }
+    if(Curl_tls_keylog_enabled()) {
+      infof(data, "SSLKEYLOGFILE set, all TLS secrets are logged to '%s'",
+            Curl_tls_keylog_file_name());
+#ifdef LIBRESSL_VERSION_NUMBER
+      infof(data, "Note LibreSSL only supports SSLKEYLOGFILE for TLS <= 1.2");
+#endif
+    }
+    /* Connection can be deferred when sending early data */
+    DEBUGASSERT(connssl->state == ssl_connection_complete ||
+                connssl->state == ssl_connection_deferred);
+    DEBUGASSERT(connssl->state != ssl_connection_deferred ||
+                connssl->earlydata_state > ssl_earlydata_none);
   }
 out:
-  CURL_TRC_CF(data, cf, "cf_connect() -> %d, done=%d", result, *done);
+  CURL_TRC_CF(data, cf, "cf_connect() -> %d, done=%d", (int)result, *done);
   CF_DATA_RESTORE(cf, save);
   return result;
 }
 
+static CURLcode ssl_cf_set_earlydata(struct Curl_cfilter *cf,
+                                     struct Curl_easy *data,
+                                     const void *buf, size_t blen)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  size_t nwritten = 0;
+  CURLcode result = CURLE_OK;
+
+  DEBUGASSERT(connssl->earlydata_state == ssl_earlydata_await);
+  DEBUGASSERT(Curl_bufq_is_empty(&connssl->earlydata));
+  if(blen) {
+    if(blen > connssl->earlydata_max)
+      blen = connssl->earlydata_max;
+    result = Curl_bufq_write(&connssl->earlydata, buf, blen, &nwritten);
+    CURL_TRC_CF(data, cf, "ssl_cf_set_earlydata(len=%zu) -> %zu",
+                blen, nwritten);
+    if(result)
+      return result;
+  }
+  return CURLE_OK;
+}
+
+static CURLcode ssl_cf_connect_deferred(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data,
+                                        const void *buf, size_t blen,
+                                        bool *done)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  DEBUGASSERT(connssl->state == ssl_connection_deferred);
+  *done = FALSE;
+  if(connssl->earlydata_state == ssl_earlydata_await) {
+    result = ssl_cf_set_earlydata(cf, data, buf, blen);
+    if(result)
+      return result;
+    /* we buffered any early data we would like to send. Actually
+     * do the connect now which sends it and performs the handshake. */
+    connssl->earlydata_state = ssl_earlydata_sending;
+    connssl->earlydata_skip = Curl_bufq_len(&connssl->earlydata);
+  }
+
+  result = ssl_cf_connect(cf, data, done);
+
+  if(!result && *done) {
+    Curl_pgrsTimeWas(data, TIMER_APPCONNECT, connssl->handshake_done);
+    switch(connssl->earlydata_state) {
+    case ssl_earlydata_none:
+      break;
+    case ssl_earlydata_accepted:
+      if(!Curl_ssl_cf_is_proxy(cf))
+        Curl_pgrsEarlyData(data, (curl_off_t)connssl->earlydata_skip);
+      infof(data, "Server accepted %zu bytes of TLS early data.",
+            connssl->earlydata_skip);
+      break;
+    case ssl_earlydata_rejected:
+      if(!Curl_ssl_cf_is_proxy(cf))
+        Curl_pgrsEarlyData(data, -(curl_off_t)connssl->earlydata_skip);
+      infof(data, "Server rejected TLS early data.");
+      connssl->earlydata_skip = 0;
+      break;
+    default:
+      /* This should not happen. Either we do not use early data or we
+       * should know if it was accepted or not. */
+      DEBUGASSERT(NULL);
+      break;
+    }
+  }
+  return result;
+}
+
 static bool ssl_cf_data_pending(struct Curl_cfilter *cf,
                                 const struct Curl_easy *data)
 {
+  struct ssl_connect_data *connssl = cf->ctx;
   struct cf_call_data save;
-  bool result;
+  bool pending;
 
   CF_DATA_SAVE(save, cf, data);
-  if(Curl_ssl->data_pending(cf, data))
-    result = TRUE;
+  if(connssl->ssl_impl->data_pending &&
+     connssl->ssl_impl->data_pending(cf, data))
+    pending = TRUE;
   else
-    result = cf->next->cft->has_data_pending(cf->next, data);
+    pending = cf->next->cft->has_data_pending(cf->next, data);
+  CF_DATA_RESTORE(cf, save);
+  return pending;
+}
+
+static CURLcode ssl_cf_send(struct Curl_cfilter *cf,
+                            struct Curl_easy *data,
+                            const uint8_t *buf, size_t blen,
+                            bool eos, size_t *pnwritten)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct cf_call_data save;
+  CURLcode result = CURLE_OK;
+
+  (void)eos;
+  *pnwritten = 0;
+  CF_DATA_SAVE(save, cf, data);
+
+  if(connssl->state == ssl_connection_deferred) {
+    bool done = FALSE;
+    result = ssl_cf_connect_deferred(cf, data, buf, blen, &done);
+    if(result)
+      goto out;
+    else if(!done) {
+      result = CURLE_AGAIN;
+      goto out;
+    }
+    DEBUGASSERT(connssl->state == ssl_connection_complete);
+  }
+
+  if(connssl->earlydata_skip) {
+    if(connssl->earlydata_skip >= blen) {
+      connssl->earlydata_skip -= blen;
+      result = CURLE_OK;
+      *pnwritten = blen;
+      goto out;
+    }
+    else {
+      *pnwritten = connssl->earlydata_skip;
+      buf = buf + connssl->earlydata_skip;
+      blen -= connssl->earlydata_skip;
+      connssl->earlydata_skip = 0;
+    }
+  }
+
+  /* OpenSSL and maybe other TLS libs do not like 0-length writes. Skip. */
+  if(blen > 0) {
+    size_t nwritten;
+    result = connssl->ssl_impl->send_plain(cf, data, buf, blen, &nwritten);
+    if(!result)
+      *pnwritten += nwritten;
+  }
+
+out:
   CF_DATA_RESTORE(cf, save);
   return result;
 }
 
-static ssize_t ssl_cf_send(struct Curl_cfilter *cf,
-                           struct Curl_easy *data, const void *buf, size_t len,
-                           CURLcode *err)
+static CURLcode ssl_cf_recv(struct Curl_cfilter *cf,
+                            struct Curl_easy *data, char *buf, size_t len,
+                            size_t *pnread)
 {
+  struct ssl_connect_data *connssl = cf->ctx;
   struct cf_call_data save;
-  ssize_t nwritten;
+  CURLcode result = CURLE_OK;
 
   CF_DATA_SAVE(save, cf, data);
-  *err = CURLE_OK;
-  nwritten = Curl_ssl->send_plain(cf, data, buf, len, err);
+  *pnread = 0;
+  if(connssl->state == ssl_connection_deferred) {
+    bool done = FALSE;
+    result = ssl_cf_connect_deferred(cf, data, NULL, 0, &done);
+    if(result)
+      goto out;
+    else if(!done) {
+      result = CURLE_AGAIN;
+      goto out;
+    }
+    DEBUGASSERT(connssl->state == ssl_connection_complete);
+  }
+
+  result = connssl->ssl_impl->recv_plain(cf, data, buf, len, pnread);
+
+out:
   CF_DATA_RESTORE(cf, save);
-  return nwritten;
+  return result;
 }
 
-static ssize_t ssl_cf_recv(struct Curl_cfilter *cf,
-                           struct Curl_easy *data, char *buf, size_t len,
-                           CURLcode *err)
+static CURLcode ssl_cf_shutdown(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                bool *done)
 {
-  struct cf_call_data save;
-  ssize_t nread;
+  struct ssl_connect_data *connssl = cf->ctx;
+  CURLcode result = CURLE_OK;
 
-  CF_DATA_SAVE(save, cf, data);
-  *err = CURLE_OK;
-  nread = Curl_ssl->recv_plain(cf, data, buf, len, err);
-  if(nread > 0) {
-    DEBUGASSERT((size_t)nread <= len);
-  }
-  else if(nread == 0) {
-    /* eof */
-    *err = CURLE_OK;
-  }
-  CURL_TRC_CF(data, cf, "cf_recv(len=%zu) -> %zd, %d", len, nread, *err);
-  CF_DATA_RESTORE(cf, save);
-  return nread;
-}
+  *done = TRUE;
+  /* If we have done the SSL handshake, shut down the connection cleanly */
+  if(cf->connected && (connssl->state == ssl_connection_complete) &&
+     !cf->shutdown && Curl_ssl->shut_down) {
+    struct cf_call_data save;
 
-static int ssl_cf_get_select_socks(struct Curl_cfilter *cf,
-                                   struct Curl_easy *data,
-                                   curl_socket_t *socks)
-{
-  struct cf_call_data save;
-  int fds = GETSOCK_BLANK;
-
-  if(!cf->next->connected) {
-    fds = cf->next->cft->get_select_socks(cf->next, data, socks);
-  }
-  else if(!cf->connected) {
     CF_DATA_SAVE(save, cf, data);
-    fds = Curl_ssl->get_select_socks(cf, data, socks);
+    result = connssl->ssl_impl->shut_down(cf, data, TRUE, done);
+    CURL_TRC_CF(data, cf, "cf_shutdown -> %d, done=%d", (int)result, *done);
     CF_DATA_RESTORE(cf, save);
+    cf->shutdown = (result || *done);
   }
-  return fds;
+  return result;
 }
 
-static CURLcode ssl_cf_cntrl(struct Curl_cfilter *cf,
-                             struct Curl_easy *data,
-                             int event, int arg1, void *arg2)
+static CURLcode ssl_cf_adjust_pollset(struct Curl_cfilter *cf,
+                                      struct Curl_easy *data,
+                                      struct easy_pollset *ps)
 {
+  struct ssl_connect_data *connssl = cf->ctx;
   struct cf_call_data save;
+  CURLcode result;
 
-  (void)arg1;
-  (void)arg2;
-  switch(event) {
-  case CF_CTRL_DATA_ATTACH:
-    if(Curl_ssl->attach_data) {
-      CF_DATA_SAVE(save, cf, data);
-      Curl_ssl->attach_data(cf, data);
-      CF_DATA_RESTORE(cf, save);
-    }
-    break;
-  case CF_CTRL_DATA_DETACH:
-    if(Curl_ssl->detach_data) {
-      CF_DATA_SAVE(save, cf, data);
-      Curl_ssl->detach_data(cf, data);
-      CF_DATA_RESTORE(cf, save);
-    }
-    break;
-  default:
-    break;
-  }
-  return CURLE_OK;
+  CF_DATA_SAVE(save, cf, data);
+  result = connssl->ssl_impl->adjust_pollset(cf, data, ps);
+  CF_DATA_RESTORE(cf, save);
+  return result;
 }
 
 static CURLcode ssl_cf_query(struct Curl_cfilter *cf,
@@ -1658,40 +1249,66 @@ static CURLcode ssl_cf_query(struct Curl_cfilter *cf,
       *when = connssl->handshake_done;
     return CURLE_OK;
   }
+  case CF_QUERY_SSL_INFO:
+  case CF_QUERY_SSL_CTX_INFO:
+    if(!Curl_ssl_cf_is_proxy(cf)) {
+      struct curl_tlssessioninfo *info = pres2;
+      struct cf_call_data save;
+      CF_DATA_SAVE(save, cf, data);
+      info->backend = Curl_ssl_backend();
+      info->internals = connssl->ssl_impl->get_internals(
+        cf->ctx, (query == CF_QUERY_SSL_INFO) ?
+        CURLINFO_TLS_SSL_PTR : CURLINFO_TLS_SESSION);
+      CF_DATA_RESTORE(cf, save);
+      return CURLE_OK;
+    }
+    break;
+  case CF_QUERY_ALPN_NEGOTIATED: {
+    const char **palpn = pres2;
+    DEBUGASSERT(palpn);
+    *palpn = connssl->negotiated.alpn;
+    CURL_TRC_CF(data, cf, "query ALPN: returning '%s'", *palpn);
+    return CURLE_OK;
+  }
   default:
     break;
   }
-  return cf->next?
+  return cf->next ?
     cf->next->cft->query(cf->next, data, query, pres1, pres2) :
     CURLE_UNKNOWN_OPTION;
 }
 
+static CURLcode ssl_cf_cntrl(struct Curl_cfilter *cf,
+                             struct Curl_easy *data,
+                             int event, int arg1, void *arg2)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+
+  (void)arg1;
+  (void)arg2;
+  (void)data;
+  switch(event) {
+  case CF_CTRL_CONN_INFO_UPDATE:
+    if(connssl->negotiated.alpn && !cf->sockindex) {
+      if(!strcmp("http/1.1", connssl->negotiated.alpn))
+        cf->conn->httpversion_seen = 11;
+      else if(!strcmp("h2", connssl->negotiated.alpn))
+        cf->conn->httpversion_seen = 20;
+      else if(!strcmp("h3", connssl->negotiated.alpn))
+        cf->conn->httpversion_seen = 30;
+    }
+    break;
+  }
+  return CURLE_OK;
+}
+
 static bool cf_ssl_is_alive(struct Curl_cfilter *cf, struct Curl_easy *data,
                             bool *input_pending)
 {
-  struct cf_call_data save;
-  int result;
   /*
    * This function tries to determine connection status.
-   *
-   * Return codes:
-   *     1 means the connection is still in place
-   *     0 means the connection has been closed
-   *    -1 means the connection status is unknown
    */
-  CF_DATA_SAVE(save, cf, data);
-  result = Curl_ssl->check_cxn(cf, data);
-  CF_DATA_RESTORE(cf, save);
-  if(result > 0) {
-    *input_pending = TRUE;
-    return TRUE;
-  }
-  if(result == 0) {
-    *input_pending = FALSE;
-    return FALSE;
-  }
-  /* ssl backend does not know */
-  return cf->next?
+  return cf->next ?
     cf->next->cft->is_alive(cf->next, data, input_pending) :
     FALSE; /* pessimistic in absence of data */
 }
@@ -1702,9 +1319,8 @@ struct Curl_cftype Curl_cft_ssl = {
   CURL_LOG_LVL_NONE,
   ssl_cf_destroy,
   ssl_cf_connect,
-  ssl_cf_close,
-  Curl_cf_def_get_host,
-  ssl_cf_get_select_socks,
+  ssl_cf_shutdown,
+  ssl_cf_adjust_pollset,
   ssl_cf_data_pending,
   ssl_cf_send,
   ssl_cf_recv,
@@ -1714,24 +1330,27 @@ struct Curl_cftype Curl_cft_ssl = {
   ssl_cf_query,
 };
 
+#ifndef CURL_DISABLE_PROXY
+
 struct Curl_cftype Curl_cft_ssl_proxy = {
   "SSL-PROXY",
-  CF_TYPE_SSL,
+  CF_TYPE_SSL | CF_TYPE_PROXY,
   CURL_LOG_LVL_NONE,
   ssl_cf_destroy,
   ssl_cf_connect,
-  ssl_cf_close,
-  Curl_cf_def_get_host,
-  ssl_cf_get_select_socks,
+  ssl_cf_shutdown,
+  ssl_cf_adjust_pollset,
   ssl_cf_data_pending,
   ssl_cf_send,
   ssl_cf_recv,
-  ssl_cf_cntrl,
+  Curl_cf_def_cntrl,
   cf_ssl_is_alive,
   Curl_cf_def_conn_keep_alive,
-  Curl_cf_def_query,
+  ssl_cf_query,
 };
 
+#endif /* !CURL_DISABLE_PROXY */
+
 static CURLcode cf_ssl_create(struct Curl_cfilter **pcf,
                               struct Curl_easy *data,
                               struct connectdata *conn)
@@ -1742,8 +1361,17 @@ static CURLcode cf_ssl_create(struct Curl_cfilter **pcf,
 
   DEBUGASSERT(data->conn);
 
-  ctx = cf_ctx_new(data, alpn_get_spec(data->state.httpwant,
-                                       conn->bits.tls_enable_alpn));
+#ifdef CURL_DISABLE_HTTP
+  (void)conn;
+  /* We only support ALPN for HTTP so far. */
+  DEBUGASSERT(!conn->bits.tls_enable_alpn);
+  ctx = cf_ctx_new(data, NULL);
+#else
+  ctx = cf_ctx_new(data, alpn_get_spec(data->state.http_neg.wanted,
+                                       data->state.http_neg.preferred,
+                                       (bool)data->state.http_neg.only_10,
+                                       (bool)conn->bits.tls_enable_alpn));
+#endif
   if(!ctx) {
     result = CURLE_OUT_OF_MEMORY;
     goto out;
@@ -1754,32 +1382,57 @@ static CURLcode cf_ssl_create(struct Curl_cfilter **pcf,
 out:
   if(result)
     cf_ctx_free(ctx);
-  *pcf = result? NULL : cf;
+  *pcf = result ? NULL : cf;
   return result;
 }
 
+static CURLcode cf_ssl_peer_init(struct Curl_cfilter *cf,
+                                 struct Curl_peer *origin,
+                                 struct Curl_peer *peer,
+                                 struct ssl_primary_config *sslc)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  char tls_id[80];
+  connssl->ssl_impl->version(tls_id, sizeof(tls_id) - 1);
+  return Curl_ssl_peer_init(&connssl->peer, origin, peer, sslc,
+                            tls_id, TRNSPRT_TCP);
+}
+
 CURLcode Curl_ssl_cfilter_add(struct Curl_easy *data,
+                              struct Curl_peer *origin,
                               struct connectdata *conn,
                               int sockindex)
 {
   struct Curl_cfilter *cf;
+  struct Curl_peer *peer = (sockindex == SECONDARYSOCKET) ?
+    conn->via_peer2 : conn->via_peer;
   CURLcode result;
 
   result = cf_ssl_create(&cf, data, conn);
+  if(!result)
+    result = cf_ssl_peer_init(cf, origin, peer, &conn->ssl_config);
   if(!result)
     Curl_conn_cf_add(data, conn, sockindex, cf);
+  else if(cf)
+    Curl_conn_cf_discard_chain(&cf, data);
   return result;
 }
 
 CURLcode Curl_cf_ssl_insert_after(struct Curl_cfilter *cf_at,
-                                  struct Curl_easy *data)
+                                  struct Curl_easy *data,
+                                  struct Curl_peer *origin,
+                                  struct Curl_peer *peer)
 {
   struct Curl_cfilter *cf;
   CURLcode result;
 
   result = cf_ssl_create(&cf, data, cf_at->conn);
+  if(!result)
+    result = cf_ssl_peer_init(cf, origin, peer, &cf_at->conn->ssl_config);
   if(!result)
     Curl_conn_cf_insert_after(cf_at, cf);
+  else if(cf)
+    Curl_conn_cf_discard_chain(&cf, data);
   return result;
 }
 
@@ -1792,17 +1445,19 @@ static CURLcode cf_ssl_proxy_create(struct Curl_cfilter **pcf,
   struct Curl_cfilter *cf = NULL;
   struct ssl_connect_data *ctx;
   CURLcode result;
-  bool use_alpn = conn->bits.tls_enable_alpn;
-  int httpwant = CURL_HTTP_VERSION_1_1;
+  /* ALPN is default, but if user explicitly disables it, obey */
+  bool use_alpn = (bool)data->set.ssl_enable_alpn;
+  http_majors wanted = CURL_HTTP_V1x;
 
+  (void)conn;
 #ifdef USE_HTTP2
   if(conn->http_proxy.proxytype == CURLPROXY_HTTPS2) {
     use_alpn = TRUE;
-    httpwant = CURL_HTTP_VERSION_2;
+    wanted = (CURL_HTTP_V1x | CURL_HTTP_V2x);
   }
 #endif
 
-  ctx = cf_ctx_new(data, alpn_get_spec(httpwant, use_alpn));
+  ctx = cf_ctx_new(data, alpn_get_spec(wanted, 0, FALSE, use_alpn));
   if(!ctx) {
     result = CURLE_OUT_OF_MEMORY;
     goto out;
@@ -1812,132 +1467,141 @@ static CURLcode cf_ssl_proxy_create(struct Curl_cfilter **pcf,
 out:
   if(result)
     cf_ctx_free(ctx);
-  *pcf = result? NULL : cf;
+  *pcf = result ? NULL : cf;
   return result;
 }
 
 CURLcode Curl_cf_ssl_proxy_insert_after(struct Curl_cfilter *cf_at,
-                                        struct Curl_easy *data)
+                                        struct Curl_easy *data,
+                                        struct Curl_peer *peer)
 {
   struct Curl_cfilter *cf;
   CURLcode result;
 
   result = cf_ssl_proxy_create(&cf, data, cf_at->conn);
+  if(!result)
+    result = cf_ssl_peer_init(cf, peer, NULL, &cf_at->conn->proxy_ssl_config);
   if(!result)
     Curl_conn_cf_insert_after(cf_at, cf);
+  else if(cf)
+    Curl_conn_cf_discard_chain(&cf, data);
   return result;
 }
 
 #endif /* !CURL_DISABLE_PROXY */
 
-bool Curl_ssl_supports(struct Curl_easy *data, int option)
+bool Curl_ssl_supports(struct Curl_easy *data, unsigned int ssl_option)
 {
   (void)data;
-  return (Curl_ssl->supports & option)? TRUE : FALSE;
+  return (Curl_ssl->supports & ssl_option);
 }
 
-void *Curl_ssl_get_internals(struct Curl_easy *data, int sockindex,
-                             CURLINFO info, int n)
+static CURLcode vtls_shutdown_blocking(struct Curl_cfilter *cf,
+                                       struct Curl_easy *data,
+                                       bool send_shutdown, bool *done)
 {
-  void *result = NULL;
-  (void)n;
-  if(data->conn) {
-    struct Curl_cfilter *cf;
-    /* get first filter in chain, if any is present */
-    cf = Curl_ssl_cf_get_ssl(data->conn->cfilter[sockindex]);
-    if(cf) {
-      struct cf_call_data save;
-      CF_DATA_SAVE(save, cf, data);
-      result = Curl_ssl->get_internals(cf->ctx, info);
-      CF_DATA_RESTORE(cf, save);
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct cf_call_data save;
+  CURLcode result = CURLE_OK;
+  timediff_t timeout_ms;
+  int what, loop = 10;
+
+  if(cf->shutdown) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+  CF_DATA_SAVE(save, cf, data);
+
+  *done = FALSE;
+  while(!result && !*done && loop--) {
+    timeout_ms = Curl_shutdown_timeleft(data, cf->conn, cf->sockindex);
+
+    if(timeout_ms < 0) {
+      /* no need to continue if time is already up */
+      failf(data, "SSL shutdown timeout");
+      result = CURLE_OPERATION_TIMEDOUT;
+      goto out;
+    }
+
+    result = connssl->ssl_impl->shut_down(cf, data, send_shutdown, done);
+    if(result || *done)
+      goto out;
+
+    if(connssl->io_need) {
+      what = Curl_conn_cf_poll(cf, data, timeout_ms);
+      if(what < 0) {
+        /* fatal error */
+        failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
+        result = CURLE_RECV_ERROR;
+        goto out;
+      }
+      else if(what == 0) {
+        /* timeout */
+        failf(data, "SSL shutdown timeout");
+        result = CURLE_OPERATION_TIMEDOUT;
+        goto out;
+      }
+      /* socket is readable or writable */
     }
   }
+out:
+  CF_DATA_RESTORE(cf, save);
+  cf->shutdown = (result || *done);
   return result;
 }
 
 CURLcode Curl_ssl_cfilter_remove(struct Curl_easy *data,
-                                 int sockindex)
+                                 int sockindex, bool send_shutdown)
 {
   struct Curl_cfilter *cf, *head;
   CURLcode result = CURLE_OK;
 
-  (void)data;
-  head = data->conn? data->conn->cfilter[sockindex] : NULL;
+  head = data->conn ? data->conn->cfilter[sockindex] : NULL;
   for(cf = head; cf; cf = cf->next) {
     if(cf->cft == &Curl_cft_ssl) {
-      if(Curl_ssl->shut_down(cf, data))
+      bool done;
+      CURL_TRC_CF(data, cf, "shutdown and remove SSL, start");
+      Curl_shutdown_start(data, sockindex, 0);
+      result = vtls_shutdown_blocking(cf, data, send_shutdown, &done);
+      Curl_shutdown_clear(data, sockindex);
+      if(!result && !done) /* blocking failed? */
         result = CURLE_SSL_SHUTDOWN_FAILED;
-      Curl_conn_cf_discard_sub(head, cf, data, FALSE);
+      Curl_conn_cf_discard(&cf, data);
+      CURL_TRC_CF(data, cf, "shutdown and remove SSL, done -> %d",
+                  (int)result);
       break;
     }
   }
   return result;
 }
 
-static struct Curl_cfilter *get_ssl_cf_engaged(struct connectdata *conn,
-                                               int sockindex)
-{
-  struct Curl_cfilter *cf, *lowest_ssl_cf = NULL;
-
-  for(cf = conn->cfilter[sockindex]; cf; cf = cf->next) {
-    if(cf->cft == &Curl_cft_ssl || cf->cft == &Curl_cft_ssl_proxy) {
-      lowest_ssl_cf = cf;
-      if(cf->connected || (cf->next && cf->next->connected)) {
-        /* connected or about to start */
-        return cf;
-      }
-    }
-  }
-  return lowest_ssl_cf;
-}
-
 bool Curl_ssl_cf_is_proxy(struct Curl_cfilter *cf)
 {
-  return (cf->cft == &Curl_cft_ssl_proxy);
+  return (cf->cft->flags & CF_TYPE_SSL) && (cf->cft->flags & CF_TYPE_PROXY);
 }
 
-struct ssl_config_data *
-Curl_ssl_cf_get_config(struct Curl_cfilter *cf, struct Curl_easy *data)
+struct ssl_config_data *Curl_ssl_cf_get_config(struct Curl_cfilter *cf,
+                                               struct Curl_easy *data)
 {
 #ifdef CURL_DISABLE_PROXY
   (void)cf;
   return &data->set.ssl;
 #else
-  return Curl_ssl_cf_is_proxy(cf)? &data->set.proxy_ssl : &data->set.ssl;
+  return Curl_ssl_cf_is_proxy(cf) ? &data->set.proxy_ssl : &data->set.ssl;
 #endif
 }
 
-struct ssl_config_data *
-Curl_ssl_get_config(struct Curl_easy *data, int sockindex)
-{
-  struct Curl_cfilter *cf;
-
-  (void)data;
-  DEBUGASSERT(data->conn);
-  cf = get_ssl_cf_engaged(data->conn, sockindex);
-  return cf? Curl_ssl_cf_get_config(cf, data) : &data->set.ssl;
-}
-
-struct ssl_primary_config *
-Curl_ssl_cf_get_primary_config(struct Curl_cfilter *cf)
+struct ssl_primary_config *Curl_ssl_cf_get_primary_config(
+  struct Curl_cfilter *cf)
 {
 #ifdef CURL_DISABLE_PROXY
   return &cf->conn->ssl_config;
 #else
-  return Curl_ssl_cf_is_proxy(cf)?
+  return Curl_ssl_cf_is_proxy(cf) ?
     &cf->conn->proxy_ssl_config : &cf->conn->ssl_config;
 #endif
 }
 
-struct Curl_cfilter *Curl_ssl_cf_get_ssl(struct Curl_cfilter *cf)
-{
-  for(; cf; cf = cf->next) {
-    if(cf->cft == &Curl_cft_ssl || cf->cft == &Curl_cft_ssl_proxy)
-      return cf;
-  }
-  return NULL;
-}
-
 CURLcode Curl_alpn_to_proto_buf(struct alpn_proto_buf *buf,
                                 const struct alpn_spec *spec)
 {
@@ -1950,7 +1614,7 @@ CURLcode Curl_alpn_to_proto_buf(struct alpn_proto_buf *buf,
     len = strlen(spec->entries[i]);
     if(len >= ALPN_NAME_MAX)
       return CURLE_FAILED_INIT;
-    blen = (unsigned  char)len;
+    blen = (unsigned char)len;
     if(off + blen + 1 >= (int)sizeof(buf->data))
       return CURLE_FAILED_INIT;
     buf->data[off++] = blen;
@@ -1984,64 +1648,132 @@ CURLcode Curl_alpn_to_proto_str(struct alpn_proto_buf *buf,
   return CURLE_OK;
 }
 
+bool Curl_alpn_contains_proto(const struct alpn_spec *spec,
+                              const char *proto)
+{
+  size_t i, plen = proto ? strlen(proto) : 0;
+  for(i = 0; spec && plen && i < spec->count; ++i) {
+    size_t slen = strlen(spec->entries[i]);
+    if((slen == plen) && !memcmp(proto, spec->entries[i], plen))
+      return TRUE;
+  }
+  return FALSE;
+}
+
+void Curl_alpn_restrict_to(struct alpn_spec *spec, const char *proto)
+{
+  size_t plen = strlen(proto);
+  DEBUGASSERT(plen < sizeof(spec->entries[0]));
+  if(plen < sizeof(spec->entries[0])) {
+    memcpy(spec->entries[0], proto, plen + 1);
+    spec->count = 1;
+  }
+}
+
+void Curl_alpn_copy(struct alpn_spec *dest, const struct alpn_spec *src)
+{
+  if(src)
+    memcpy(dest, src, sizeof(*dest));
+  else
+    memset(dest, 0, sizeof(*dest));
+}
+
 CURLcode Curl_alpn_set_negotiated(struct Curl_cfilter *cf,
                                   struct Curl_easy *data,
+                                  struct ssl_connect_data *connssl,
                                   const unsigned char *proto,
                                   size_t proto_len)
 {
-  int can_multi = 0;
-  unsigned char *palpn =
-#ifndef CURL_DISABLE_PROXY
-    (cf->conn->bits.tunnel_proxy && Curl_ssl_cf_is_proxy(cf))?
-    &cf->conn->proxy_alpn : &cf->conn->alpn
-#else
-    &cf->conn->alpn
-#endif
-    ;
+  CURLcode result = CURLE_OK;
+  (void)cf;
 
-  if(proto && proto_len) {
-    if(proto_len == ALPN_HTTP_1_1_LENGTH &&
-       !memcmp(ALPN_HTTP_1_1, proto, ALPN_HTTP_1_1_LENGTH)) {
-      *palpn = CURL_HTTP_VERSION_1_1;
-    }
-    else if(proto_len == ALPN_HTTP_1_0_LENGTH &&
-            !memcmp(ALPN_HTTP_1_0, proto, ALPN_HTTP_1_0_LENGTH)) {
-      *palpn = CURL_HTTP_VERSION_1_0;
-    }
-#ifdef USE_HTTP2
-    else if(proto_len == ALPN_H2_LENGTH &&
-            !memcmp(ALPN_H2, proto, ALPN_H2_LENGTH)) {
-      *palpn = CURL_HTTP_VERSION_2;
-      can_multi = 1;
-    }
-#endif
-#ifdef USE_HTTP3
-    else if(proto_len == ALPN_H3_LENGTH &&
-            !memcmp(ALPN_H3, proto, ALPN_H3_LENGTH)) {
-      *palpn = CURL_HTTP_VERSION_3;
-      can_multi = 1;
-    }
-#endif
-    else {
-      *palpn = CURL_HTTP_VERSION_NONE;
-      failf(data, "unsupported ALPN protocol: '%.*s'", (int)proto_len, proto);
-      /* TODO: do we want to fail this? Previous code just ignored it and
-       * some vtls backends even ignore the return code of this function. */
-      /* return CURLE_NOT_BUILT_IN; */
+  if(connssl->negotiated.alpn) {
+    /* When we ask for a specific ALPN protocol, we need the confirmation
+     * of it by the server, as we have installed protocol handler and
+     * connection filter chain for exactly this protocol. */
+    if(!proto_len) {
+      failf(data, "ALPN: asked for '%s' from previous session, "
+            "but server did not confirm it. Refusing to continue.",
+            connssl->negotiated.alpn);
+      result = CURLE_SSL_CONNECT_ERROR;
       goto out;
     }
-    infof(data, VTLS_INFOF_ALPN_ACCEPTED_LEN_1STR, (int)proto_len, proto);
+    else if(!proto) {
+      DEBUGASSERT(0); /* with length, we need a pointer */
+      result = CURLE_SSL_CONNECT_ERROR;
+      goto out;
+    }
+    else if((strlen(connssl->negotiated.alpn) != proto_len) ||
+            memcmp(connssl->negotiated.alpn, proto, proto_len)) {
+      failf(data, "ALPN: asked for '%s' from previous session, but server "
+            "selected '%.*s'. Refusing to continue.",
+            connssl->negotiated.alpn, (int)proto_len, proto);
+      result = CURLE_SSL_CONNECT_ERROR;
+      goto out;
+    }
+    /* ALPN is exactly what we asked for, done. */
+    infof(data, "ALPN: server confirmed to use '%s'",
+          connssl->negotiated.alpn);
+    goto out;
+  }
+
+  if(proto && proto_len) {
+    if(memchr(proto, '\0', proto_len)) {
+      failf(data, "ALPN: server selected protocol contains NUL. "
+                  "Refusing to continue.");
+      result = CURLE_SSL_CONNECT_ERROR;
+      goto out;
+    }
+    connssl->negotiated.alpn = curlx_memdup0((const char *)proto, proto_len);
+    if(!connssl->negotiated.alpn)
+      return CURLE_OUT_OF_MEMORY;
+  }
+
+  if(proto && proto_len) {
+    if(connssl->state == ssl_connection_deferred)
+      infof(data, VTLS_INFOF_ALPN_DEFERRED, (int)proto_len, proto);
+    else
+      infof(data, VTLS_INFOF_ALPN_ACCEPTED, (int)proto_len, proto);
   }
   else {
-    *palpn = CURL_HTTP_VERSION_NONE;
-    infof(data, VTLS_INFOF_NO_ALPN);
+    if(connssl->state == ssl_connection_deferred)
+      infof(data, VTLS_INFOF_NO_ALPN_DEFERRED);
+    else
+      infof(data, VTLS_INFOF_NO_ALPN);
   }
 
 out:
-  if(!Curl_ssl_cf_is_proxy(cf))
-    Curl_multiuse_state(data, can_multi?
-                        BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE);
-  return CURLE_OK;
+  return result;
+}
+
+CURLcode Curl_on_session_reuse(struct Curl_cfilter *cf,
+                               struct Curl_easy *data,
+                               struct alpn_spec *alpns,
+                               struct Curl_ssl_session *scs,
+                               bool *do_early_data, bool early_data_allowed)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  *do_early_data = FALSE;
+
+  if(!early_data_allowed) {
+    CURL_TRC_CF(data, cf, "SSL session does not allow earlydata");
+  }
+  else if(!Curl_alpn_contains_proto(alpns, scs->alpn)) {
+    CURL_TRC_CF(data, cf, "SSL session has different ALPN, no early data");
+  }
+  else {
+    infof(data, "SSL session allows %zu bytes of early data, "
+          "reusing ALPN '%s'", connssl->earlydata_max, scs->alpn);
+    connssl->earlydata_state = ssl_earlydata_await;
+    connssl->state = ssl_connection_deferred;
+    result = Curl_alpn_set_negotiated(cf, data, connssl,
+                                      (const unsigned char *)scs->alpn,
+                                      scs->alpn ? strlen(scs->alpn) : 0);
+    *do_early_data = !result;
+  }
+  return result;
 }
 
 #endif /* USE_SSL */
diff --git a/third-party/curl/lib/vtls/vtls.h b/third-party/curl/lib/vtls/vtls.h
index 8ad1cf6def..96cb7d15ed 100644
--- a/third-party/curl/lib/vtls/vtls.h
+++ b/third-party/curl/lib/vtls/vtls.h
@@ -28,52 +28,96 @@
 struct connectdata;
 struct ssl_config_data;
 struct ssl_primary_config;
-struct Curl_ssl_session;
+struct Curl_cfilter;
+struct Curl_easy;
+struct dynbuf;
 
-#define SSLSUPP_CA_PATH      (1<<0) /* supports CAPATH */
-#define SSLSUPP_CERTINFO     (1<<1) /* supports CURLOPT_CERTINFO */
-#define SSLSUPP_PINNEDPUBKEY (1<<2) /* supports CURLOPT_PINNEDPUBLICKEY */
-#define SSLSUPP_SSL_CTX      (1<<3) /* supports CURLOPT_SSL_CTX */
-#define SSLSUPP_HTTPS_PROXY  (1<<4) /* supports access via HTTPS proxies */
-#define SSLSUPP_TLS13_CIPHERSUITES (1<<5) /* supports TLS 1.3 ciphersuites */
-#define SSLSUPP_CAINFO_BLOB  (1<<6)
+#define SSLSUPP_CA_PATH      (1 << 0) /* supports CAPATH */
+#define SSLSUPP_CERTINFO     (1 << 1) /* supports CURLOPT_CERTINFO */
+#define SSLSUPP_PINNEDPUBKEY (1 << 2) /* supports CURLOPT_PINNEDPUBLICKEY */
+#define SSLSUPP_SSL_CTX      (1 << 3) /* supports CURLOPT_SSL_CTX */
+#define SSLSUPP_HTTPS_PROXY  (1 << 4) /* supports access via HTTPS proxies */
+#define SSLSUPP_TLS13_CIPHERSUITES (1 << 5) /* supports TLS 1.3 ciphersuites */
+#define SSLSUPP_CAINFO_BLOB  (1 << 6)
+#define SSLSUPP_ECH          (1 << 7)
+#define SSLSUPP_CA_CACHE     (1 << 8)
+#define SSLSUPP_CIPHER_LIST  (1 << 9) /* supports TLS 1.0-1.2 ciphersuites */
+#define SSLSUPP_SIGNATURE_ALGORITHMS (1 << 10) /* supports TLS sigalgs */
+#define SSLSUPP_ISSUERCERT   (1 << 11) /* supports CURLOPT_ISSUERCERT */
+#define SSLSUPP_SSL_EC_CURVES (1 << 12) /* supports CURLOPT_SSL_EC_CURVES */
+#define SSLSUPP_CRLFILE      (1 << 13) /* supports CURLOPT_CRLFILE */
+#define SSLSUPP_ISSUERCERT_BLOB (1 << 14) /* CURLOPT_ISSUERCERT_BLOB */
+
+#ifdef USE_ECH
+/* CURLECH_ values for the tls_ech option */
+#define CURLECH_DISABLE    0
+#define CURLECH_GREASE     1
+#define CURLECH_ENABLE     2
+#define CURLECH_HARD       3
+
+#define CURLECH_ENABLED(data) ((data)->set.tls_ech)
+#endif /* USE_ECH */
 
 #define ALPN_ACCEPTED "ALPN: server accepted "
 
-#define VTLS_INFOF_NO_ALPN                                      \
+#define VTLS_INFOF_NO_ALPN            \
   "ALPN: server did not agree on a protocol. Uses default."
-#define VTLS_INFOF_ALPN_OFFER_1STR              \
+#define VTLS_INFOF_ALPN_OFFER_1STR    \
   "ALPN: curl offers %s"
-#define VTLS_INFOF_ALPN_ACCEPTED_1STR           \
-  ALPN_ACCEPTED "%s"
-#define VTLS_INFOF_ALPN_ACCEPTED_LEN_1STR       \
+#define VTLS_INFOF_ALPN_ACCEPTED      \
   ALPN_ACCEPTED "%.*s"
 
-/* Curl_multi SSL backend-specific data; declared differently by each SSL
-   backend */
-struct multi_ssl_backend_data;
-struct Curl_cfilter;
+#define VTLS_INFOF_NO_ALPN_DEFERRED   \
+  "ALPN: deferred handshake for early data without specific protocol."
+#define VTLS_INFOF_ALPN_DEFERRED      \
+  "ALPN: deferred handshake for early data using '%.*s'."
+
+/* IETF defined version numbers used in TLS protocol negotiation */
+#define CURL_IETF_PROTO_UNKNOWN       0x0
+#define CURL_IETF_PROTO_SSL3          0x0300
+#define CURL_IETF_PROTO_TLS1          0x0301
+#define CURL_IETF_PROTO_TLS1_1        0x0302
+#define CURL_IETF_PROTO_TLS1_2        0x0303
+#define CURL_IETF_PROTO_TLS1_3        0x0304
+#define CURL_IETF_PROTO_DTLS1         0xFEFF
+#define CURL_IETF_PROTO_DTLS1_2       0xFEFD
+
+typedef enum {
+  CURL_SSL_PEER_DNS,
+  CURL_SSL_PEER_IPV4,
+  CURL_SSL_PEER_IPV6
+} ssl_peer_type;
+
+struct ssl_peer {
+  struct Curl_peer *origin; /* the authority we talk to */
+  struct Curl_peer *peer;   /* the machine we are connected to */
+  char *sni;             /* SNI version of hostname or NULL if not usable */
+  char *scache_key;      /* for lookups in session cache */
+  ssl_peer_type type;    /* type of the peer information */
+  uint8_t transport;     /* one of TRNSPRT_* defines */
+};
 
 CURLsslset Curl_init_sslset_nolock(curl_sslbackend id, const char *name,
                                    const curl_ssl_backend ***avail);
 
-#ifndef MAX_PINNED_PUBKEY_SIZE
-#define MAX_PINNED_PUBKEY_SIZE 1048576 /* 1MB */
-#endif
-
-#ifndef CURL_SHA256_DIGEST_LENGTH
-#define CURL_SHA256_DIGEST_LENGTH 32 /* fixed size */
-#endif
-
-char *Curl_ssl_snihost(struct Curl_easy *data, const char *host, size_t *olen);
-bool Curl_ssl_config_matches(struct ssl_primary_config *data,
-                             struct ssl_primary_config *needle);
-bool Curl_clone_primary_ssl_config(struct ssl_primary_config *source,
-                                   struct ssl_primary_config *dest);
-void Curl_free_primary_ssl_config(struct ssl_primary_config *sslc);
+#define MAX_PINNED_PUBKEY_SIZE (1024 * 1024) /* 1 MiB */
 
 curl_sslbackend Curl_ssl_backend(void);
 
+/**
+ * Init SSL peer information for filter. Can be called repeatedly.
+ */
+CURLcode Curl_ssl_peer_init(struct ssl_peer *ssl_peer,
+                            struct Curl_peer *origin,
+                            struct Curl_peer *peer,
+                            struct ssl_primary_config *sslc,
+                            const char *tls_id,
+                            uint8_t transport);
+/**
+ * Free all allocated data and reset peer information.
+ */
+void Curl_ssl_peer_cleanup(struct ssl_peer *peer);
+
 #ifdef USE_SSL
 int Curl_ssl_init(void);
 void Curl_ssl_cleanup(void);
@@ -85,11 +129,11 @@ CURLcode Curl_ssl_set_engine(struct Curl_easy *data, const char *engine);
 CURLcode Curl_ssl_set_engine_default(struct Curl_easy *data);
 struct curl_slist *Curl_ssl_engines_list(struct Curl_easy *data);
 
-/* init the SSL session ID cache */
-CURLcode Curl_ssl_initsessions(struct Curl_easy *, size_t);
 void Curl_ssl_version(char *buffer, size_t size);
 
 /* Certificate information list handling. */
+#define CURL_X509_STR_MAX  100000
+#define MAX_ALLOWED_CERT_AMOUNT 100
 
 void Curl_ssl_free_certinfo(struct Curl_easy *data);
 CURLcode Curl_ssl_init_certinfo(struct Curl_easy *data, int num);
@@ -101,36 +145,9 @@ CURLcode Curl_ssl_push_certinfo(struct Curl_easy *data, int certnum,
 
 /* Functions to be used by SSL library adaptation functions */
 
-/* Lock session cache mutex.
- * Call this before calling other Curl_ssl_*session* functions
- * Caller should unlock this mutex as soon as possible, as it may block
- * other SSL connection from making progress.
- * The purpose of explicitly locking SSL session cache data is to allow
- * individual SSL engines to manage session lifetime in their specific way.
- */
-void Curl_ssl_sessionid_lock(struct Curl_easy *data);
-
-/* Unlock session cache mutex */
-void Curl_ssl_sessionid_unlock(struct Curl_easy *data);
-
-/* Kill a single session ID entry in the cache
- * Sessionid mutex must be locked (see Curl_ssl_sessionid_lock).
- * This will call engine-specific curlssl_session_free function, which must
- * take sessionid object ownership from sessionid cache
- * (e.g. decrement refcount).
- */
-void Curl_ssl_kill_session(struct Curl_ssl_session *session);
-/* delete a session from the cache
- * Sessionid mutex must be locked (see Curl_ssl_sessionid_lock).
- * This will call engine-specific curlssl_session_free function, which must
- * take sessionid object ownership from sessionid cache
- * (e.g. decrement refcount).
- */
-void Curl_ssl_delsessionid(struct Curl_easy *data, void *ssl_sessionid);
-
 /* get N random bytes into the buffer */
-CURLcode Curl_ssl_random(struct Curl_easy *data, unsigned char *buffer,
-                         size_t length);
+CURLcode Curl_ssl_random(struct Curl_easy *data,
+                         unsigned char *buffer, size_t length);
 /* Check pinned public key. */
 CURLcode Curl_pin_peer_pubkey(struct Curl_easy *data,
                               const char *pinnedpubkey,
@@ -138,79 +155,87 @@ CURLcode Curl_pin_peer_pubkey(struct Curl_easy *data,
 
 bool Curl_ssl_cert_status_request(void);
 
-bool Curl_ssl_false_start(struct Curl_easy *data);
+/* The maximum size of the SSL channel binding is 85 bytes, as defined in
+ * RFC 5929, Section 4.1. The 'tls-server-end-point:' prefix is 21 bytes,
+ * and SHA-512 is the longest supported hash algorithm, with a digest length of
+ * 64 bytes.
+ * The maximum size of the channel binding is therefore 21 + 64 = 85 bytes.
+ */
+#define SSL_CB_MAX_SIZE 85
 
-void Curl_free_multi_ssl_backend_data(struct multi_ssl_backend_data *mbackend);
+/* Return the tls-server-end-point channel binding, including the
+ * 'tls-server-end-point:' prefix.
+ * If successful, the data is written to the dynbuf, and CURLE_OK is returned.
+ * The dynbuf MUST HAVE a minimum toobig size of SSL_CB_MAX_SIZE.
+ * If the dynbuf is too small, CURLE_OUT_OF_MEMORY is returned.
+ * If channel binding is not supported, binding stays empty and CURLE_OK is
+ * returned.
+ */
+CURLcode Curl_ssl_get_channel_binding(struct Curl_easy *data, int sockindex,
+                                      struct dynbuf *binding);
 
 #define SSL_SHUTDOWN_TIMEOUT 10000 /* ms */
 
 CURLcode Curl_ssl_cfilter_add(struct Curl_easy *data,
+                              struct Curl_peer *origin,
                               struct connectdata *conn,
                               int sockindex);
 
 CURLcode Curl_cf_ssl_insert_after(struct Curl_cfilter *cf_at,
-                                  struct Curl_easy *data);
+                                  struct Curl_easy *data,
+                                  struct Curl_peer *origin,
+                                  struct Curl_peer *peer);
 
 CURLcode Curl_ssl_cfilter_remove(struct Curl_easy *data,
-                                 int sockindex);
+                                 int sockindex, bool send_shutdown);
 
 #ifndef CURL_DISABLE_PROXY
 CURLcode Curl_cf_ssl_proxy_insert_after(struct Curl_cfilter *cf_at,
-                                        struct Curl_easy *data);
+                                        struct Curl_easy *data,
+                                        struct Curl_peer *peer);
 #endif /* !CURL_DISABLE_PROXY */
 
-/**
- * Get the SSL configuration that is used on the connection.
- * This returns NULL if no SSL is configured.
- * Otherwise it returns the config of the first (highest) one that is
- * either connected, in handshake or about to start
- * (e.g. all filters below it are connected). If SSL filters are present,
- * but neither can start operating, return the config of the lowest one
- * that will first come into effect when connecting.
- */
-struct ssl_config_data *Curl_ssl_get_config(struct Curl_easy *data,
-                                            int sockindex);
-
 /**
  * True iff the underlying SSL implementation supports the option.
  * Option is one of the defined SSLSUPP_* values.
  * `data` maybe NULL for the features of the default implementation.
  */
-bool Curl_ssl_supports(struct Curl_easy *data, int ssl_option);
+bool Curl_ssl_supports(struct Curl_easy *data, unsigned int ssl_option);
 
 /**
- * Get the internal ssl instance (like OpenSSL's SSL*) from the filter
- * chain at `sockindex` of type specified by `info`.
- * For `n` == 0, the first active (top down) instance is returned.
- * 1 gives the second active, etc.
- * NULL is returned when no active SSL filter is present.
+ * Get the ssl_config_data in `data` that is relevant for cfilter `cf`.
  */
-void *Curl_ssl_get_internals(struct Curl_easy *data, int sockindex,
-                             CURLINFO info, int n);
+struct ssl_config_data *Curl_ssl_cf_get_config(struct Curl_cfilter *cf,
+                                               struct Curl_easy *data);
+
+/**
+ * Get the primary config relevant for the filter from its connection.
+ */
+struct ssl_primary_config *Curl_ssl_cf_get_primary_config(
+  struct Curl_cfilter *cf);
 
 extern struct Curl_cftype Curl_cft_ssl;
+#ifndef CURL_DISABLE_PROXY
 extern struct Curl_cftype Curl_cft_ssl_proxy;
+#endif
 
 #else /* if not USE_SSL */
 
-/* When SSL support is not present, just define away these function calls */
+/* When SSL support is not present, define away these function calls */
 #define Curl_ssl_init() 1
 #define Curl_ssl_cleanup() Curl_nop_stmt
 #define Curl_ssl_close_all(x) Curl_nop_stmt
-#define Curl_ssl_set_engine(x,y) CURLE_NOT_BUILT_IN
+#define Curl_ssl_set_engine(x, y) CURLE_NOT_BUILT_IN
 #define Curl_ssl_set_engine_default(x) CURLE_NOT_BUILT_IN
 #define Curl_ssl_engines_list(x) NULL
-#define Curl_ssl_initsessions(x,y) CURLE_OK
 #define Curl_ssl_free_certinfo(x) Curl_nop_stmt
-#define Curl_ssl_kill_session(x) Curl_nop_stmt
-#define Curl_ssl_random(x,y,z) ((void)x, CURLE_NOT_BUILT_IN)
+#define Curl_ssl_random(x, y, z) ((void)(x), CURLE_NOT_BUILT_IN)
 #define Curl_ssl_cert_status_request() FALSE
-#define Curl_ssl_false_start(a) FALSE
-#define Curl_ssl_get_internals(a,b,c,d) NULL
-#define Curl_ssl_supports(a,b) FALSE
-#define Curl_ssl_cfilter_add(a,b,c) CURLE_NOT_BUILT_IN
-#define Curl_ssl_get_config(a,b) NULL
-#define Curl_ssl_cfilter_remove(a,b) CURLE_OK
+#define Curl_ssl_supports(a, b) FALSE
+#define Curl_ssl_cfilter_add(a, b, c, d) CURLE_NOT_BUILT_IN
+#define Curl_ssl_cfilter_remove(a, b, c) CURLE_OK
+#define Curl_ssl_cf_get_config(a, b) NULL
+#define Curl_ssl_cf_get_primary_config(a) NULL
 #endif
 
 #endif /* HEADER_CURL_VTLS_H */
diff --git a/third-party/curl/lib/vtls/vtls_config.c b/third-party/curl/lib/vtls/vtls_config.c
new file mode 100644
index 0000000000..4a9b69654b
--- /dev/null
+++ b/third-party/curl/lib/vtls/vtls_config.c
@@ -0,0 +1,423 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+/* This file is for implementing all "generic" SSL functions that all libcurl
+   internals should use. It is then responsible for calling the proper
+   "backend" function.
+
+   SSL-functions in libcurl should call functions in this source file, and not
+   to any specific SSL-layer.
+
+   Curl_ssl_ - prefix for generic ones
+
+   Note that this source code uses the functions of the configured SSL
+   backend via the global Curl_ssl instance.
+
+   "SSL/TLS Strong Encryption: An Introduction"
+   https://httpd.apache.org/docs/2.0/ssl/ssl_intro.html
+*/
+
+#include "curl_setup.h"
+
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+
+#include "urldata.h"
+#include "setopt.h"
+#include "strcase.h"
+#include "vtls/vtls.h"
+#include "vtls/vtls_config.h"
+
+
+#define CLONE_STRING(var)                    \
+  do {                                       \
+    if(source->var) {                        \
+      dest->var = curlx_strdup(source->var); \
+      if(!dest->var)                         \
+        return FALSE;                        \
+    }                                        \
+    else                                     \
+      dest->var = NULL;                      \
+  } while(0)
+
+#define CLONE_BLOB(var)                  \
+  do {                                   \
+    if(blobdup(&dest->var, source->var)) \
+      return FALSE;                      \
+  } while(0)
+
+static CURLcode blobdup(struct curl_blob **dest, struct curl_blob *src)
+{
+  DEBUGASSERT(dest);
+  DEBUGASSERT(!*dest);
+  if(src) {
+    /* only if there is data to dupe! */
+    struct curl_blob *d;
+    d = curlx_malloc(sizeof(struct curl_blob) + src->len);
+    if(!d)
+      return CURLE_OUT_OF_MEMORY;
+    d->len = src->len;
+    /* Always duplicate because the connection may survive longer than the
+       handle that passed in the blob. */
+    d->flags = CURL_BLOB_COPY;
+    d->data = (void *)((char *)d + sizeof(struct curl_blob));
+    memcpy(d->data, src->data, src->len);
+    *dest = d;
+  }
+  return CURLE_OK;
+}
+
+/* returns TRUE if the blobs are identical */
+static bool blobcmp(struct curl_blob *first, struct curl_blob *second)
+{
+  if(!first && !second) /* both are NULL */
+    return TRUE;
+  if(!first || !second) /* one is NULL */
+    return FALSE;
+  if(first->len != second->len) /* different sizes */
+    return FALSE;
+  return !memcmp(first->data, second->data, first->len); /* same data */
+}
+
+void Curl_ssl_config_init(struct ssl_primary_config *sslc)
+{
+  /*
+   * libcurl 7.10 introduced SSL verification *by default*! This needs to be
+   * switched off unless wanted.
+   */
+  sslc->verifypeer = TRUE;
+  sslc->verifyhost = TRUE;
+  sslc->cache_session = TRUE; /* caching by default */
+}
+
+void Curl_ssl_config_cleanup(struct ssl_primary_config *sslc)
+{
+  if(sslc->deep_copy) {
+    curlx_safefree(sslc->CApath);
+    curlx_safefree(sslc->CAfile);
+    curlx_safefree(sslc->issuercert);
+    curlx_safefree(sslc->clientcert);
+    curlx_safefree(sslc->cipher_list);
+    curlx_safefree(sslc->cipher_list13);
+    curlx_safefree(sslc->pinned_key);
+    curlx_safefree(sslc->cert_blob);
+    curlx_safefree(sslc->ca_info_blob);
+    curlx_safefree(sslc->issuercert_blob);
+    curlx_safefree(sslc->key_blob);
+    curlx_safefree(sslc->curves);
+    curlx_safefree(sslc->signature_algorithms);
+    curlx_safefree(sslc->CRLfile);
+    curlx_safefree(sslc->cert_type);
+    curlx_safefree(sslc->key);
+    curlx_safefree(sslc->key_type);
+    curlx_safefree(sslc->key_passwd);
+#ifdef USE_TLS_SRP
+    curlx_safefree(sslc->username);
+    curlx_safefree(sslc->password);
+#endif
+    sslc->deep_copy = FALSE;
+  }
+}
+
+static bool match_ssl_primary_config(struct Curl_easy *data,
+                                     struct ssl_primary_config *c1,
+                                     struct ssl_primary_config *c2)
+{
+  (void)data;
+  if((c1->version == c2->version) &&
+     (c1->version_max == c2->version_max) &&
+     (c1->ssl_options == c2->ssl_options) &&
+     (c1->verifypeer == c2->verifypeer) &&
+     (c1->verifyhost == c2->verifyhost) &&
+     (c1->verifystatus == c2->verifystatus) &&
+     blobcmp(c1->cert_blob, c2->cert_blob) &&
+     blobcmp(c1->ca_info_blob, c2->ca_info_blob) &&
+     blobcmp(c1->issuercert_blob, c2->issuercert_blob) &&
+     blobcmp(c1->key_blob, c2->key_blob) &&
+     Curl_safecmp(c1->CApath, c2->CApath) &&
+     Curl_safecmp(c1->CAfile, c2->CAfile) &&
+     Curl_safecmp(c1->issuercert, c2->issuercert) &&
+     Curl_safecmp(c1->clientcert, c2->clientcert) &&
+#ifdef USE_TLS_SRP
+     !Curl_timestrcmp(c1->username, c2->username) &&
+     !Curl_timestrcmp(c1->password, c2->password) &&
+#endif
+     curl_strequal(c1->cipher_list, c2->cipher_list) &&
+     curl_strequal(c1->cipher_list13, c2->cipher_list13) &&
+     curl_strequal(c1->curves, c2->curves) &&
+     curl_strequal(c1->signature_algorithms, c2->signature_algorithms) &&
+     Curl_safecmp(c1->CRLfile, c2->CRLfile) &&
+     Curl_safecmp(c1->pinned_key, c2->pinned_key) &&
+     curl_strequal(c1->cert_type, c2->cert_type) &&
+     Curl_safecmp(c1->key, c2->key) &&
+     curl_strequal(c1->key_type, c2->key_type) &&
+     !Curl_timestrcmp(c1->key_passwd, c2->key_passwd))
+    return TRUE;
+
+  return FALSE;
+}
+
+bool Curl_ssl_conn_config_match(struct Curl_easy *data,
+                                struct connectdata *candidate,
+                                bool proxy)
+{
+#ifndef CURL_DISABLE_PROXY
+  if(proxy)
+    return match_ssl_primary_config(data, &data->set.proxy_ssl.primary,
+                                    &candidate->proxy_ssl_config);
+#else
+  (void)proxy;
+#endif
+  return match_ssl_primary_config(data, &data->set.ssl.primary,
+                                  &candidate->ssl_config);
+}
+
+static bool clone_ssl_primary_config(struct ssl_primary_config *source,
+                                     struct ssl_primary_config *dest)
+{
+  DEBUGASSERT(!dest->deep_copy);
+  dest->deep_copy = TRUE;
+  dest->version = source->version;
+  dest->version_max = source->version_max;
+  dest->verifypeer = source->verifypeer;
+  dest->verifyhost = source->verifyhost;
+  dest->verifystatus = source->verifystatus;
+  dest->cache_session = source->cache_session;
+  dest->ssl_options = source->ssl_options;
+
+  CLONE_BLOB(cert_blob);
+  CLONE_BLOB(ca_info_blob);
+  CLONE_BLOB(issuercert_blob);
+  CLONE_STRING(CApath);
+  CLONE_STRING(CAfile);
+  CLONE_STRING(issuercert);
+  CLONE_STRING(cipher_list);
+  CLONE_STRING(cipher_list13);
+  CLONE_STRING(pinned_key);
+  CLONE_STRING(curves);
+  CLONE_STRING(signature_algorithms);
+  CLONE_STRING(CRLfile);
+  /* SSL credentials: client certificate, SRP auth */
+  CLONE_STRING(clientcert);
+  CLONE_STRING(cert_type);
+  CLONE_STRING(key);
+  CLONE_STRING(key_type);
+  CLONE_STRING(key_passwd);
+  CLONE_BLOB(key_blob);
+#ifdef USE_TLS_SRP
+  CLONE_STRING(username);
+  CLONE_STRING(password);
+#endif
+
+  return TRUE;
+}
+
+static void ssl_easy_config_compl_options(struct Curl_peer *origin,
+                                          struct Curl_peer *initial_origin,
+                                          struct ssl_config_data *sslc)
+{
+  uint8_t options = sslc->primary.ssl_options;
+  /* If set via CURLOPT_(PROXY_)SSL_OPTIONS, we definitely use it.
+   * If not, we switch it on for supported backends if no custom
+   * CA settings exist. */
+  sslc->native_ca_store = !!(options & CURLSSLOPT_NATIVE_CA);
+  sslc->enable_beast = !!(options & CURLSSLOPT_ALLOW_BEAST);
+  sslc->no_partialchain = !!(options & CURLSSLOPT_NO_PARTIALCHAIN);
+  sslc->no_revoke = !!(options & CURLSSLOPT_NO_REVOKE);
+  sslc->revoke_best_effort = !!(options & CURLSSLOPT_REVOKE_BEST_EFFORT);
+  sslc->earlydata = !!(options & CURLSSLOPT_EARLYDATA);
+
+  sslc->auto_client_cert = Curl_peer_equal(origin, initial_origin) &&
+                           !!(options & CURLSSLOPT_AUTO_CLIENT_CERT);
+}
+
+CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data,
+                                       struct Curl_peer *origin)
+{
+  struct ssl_config_data *sslc = &data->set.ssl;
+#if defined(CURL_CA_PATH) || defined(CURL_CA_BUNDLE)
+  struct UserDefined *set = &data->set;
+  CURLcode result;
+#endif
+
+  ssl_easy_config_compl_options(origin, data->state.initial_origin, sslc);
+
+  if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
+#if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
+    if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
+      sslc->native_ca_store = TRUE;
+#endif
+#ifdef CURL_CA_PATH
+    if(!sslc->custom_capath && !set->str[STRING_SSL_CAPATH]) {
+      result = Curl_setstropt(&set->str[STRING_SSL_CAPATH], CURL_CA_PATH);
+      if(result)
+        return result;
+    }
+#endif
+#ifdef CURL_CA_BUNDLE
+    if(!sslc->custom_cafile && !set->str[STRING_SSL_CAFILE]) {
+      result = Curl_setstropt(&set->str[STRING_SSL_CAFILE], CURL_CA_BUNDLE);
+      if(result)
+        return result;
+    }
+#endif
+  }
+  sslc->primary.CAfile = data->set.str[STRING_SSL_CAFILE];
+  sslc->primary.CRLfile = data->set.str[STRING_SSL_CRLFILE];
+  sslc->primary.CApath = data->set.str[STRING_SSL_CAPATH];
+  sslc->primary.cipher_list = data->set.str[STRING_SSL_CIPHER_LIST];
+  sslc->primary.cipher_list13 = data->set.str[STRING_SSL_CIPHER13_LIST];
+  sslc->primary.signature_algorithms =
+    data->set.str[STRING_SSL_SIGNATURE_ALGORITHMS];
+  sslc->primary.ca_info_blob = data->set.blobs[BLOB_CAINFO];
+  sslc->primary.curves = data->set.str[STRING_SSL_EC_CURVES];
+  /* Maybe these should not be used for another origin. But for
+   * backwards compatibility, keep them in. */
+  sslc->primary.issuercert = data->set.str[STRING_SSL_ISSUERCERT];
+  sslc->primary.issuercert_blob = data->set.blobs[BLOB_SSL_ISSUERCERT];
+
+  if(Curl_peer_equal(data->state.initial_origin, origin)) {
+    sslc->primary.pinned_key = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
+    sslc->primary.cert_blob = data->set.blobs[BLOB_CERT];
+    sslc->primary.cert_type = data->set.str[STRING_CERT_TYPE];
+    sslc->primary.key = data->set.str[STRING_KEY];
+    sslc->primary.key_type = data->set.str[STRING_KEY_TYPE];
+    sslc->primary.key_passwd = data->set.str[STRING_KEY_PASSWD];
+    sslc->primary.clientcert = data->set.str[STRING_CERT];
+    sslc->primary.key_blob = data->set.blobs[BLOB_KEY];
+#ifdef USE_TLS_SRP
+    sslc->primary.username = data->set.str[STRING_TLSAUTH_USERNAME];
+    sslc->primary.password = data->set.str[STRING_TLSAUTH_PASSWORD];
+#endif
+  }
+  else {
+    sslc->primary.pinned_key = NULL;
+    sslc->primary.cert_blob = NULL;
+    sslc->primary.cert_type = NULL;
+    sslc->primary.key = NULL;
+    sslc->primary.key_type = NULL;
+    sslc->primary.key_passwd = NULL;
+    sslc->primary.clientcert = NULL;
+    sslc->primary.key_blob = NULL;
+#ifdef USE_TLS_SRP
+    sslc->primary.username = NULL;
+    sslc->primary.password = NULL;
+#endif
+  }
+
+#ifndef CURL_DISABLE_PROXY
+  sslc = &data->set.proxy_ssl;
+  /* no initial origin for proxy, it is not changed for redirects */
+  ssl_easy_config_compl_options(NULL, NULL, sslc);
+
+  if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
+#if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
+    if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
+      sslc->native_ca_store = TRUE;
+#endif
+#ifdef CURL_CA_PATH
+    if(!sslc->custom_capath && !set->str[STRING_SSL_CAPATH_PROXY]) {
+      result = Curl_setstropt(&set->str[STRING_SSL_CAPATH_PROXY],
+                              CURL_CA_PATH);
+      if(result)
+        return result;
+    }
+#endif
+#ifdef CURL_CA_BUNDLE
+    if(!sslc->custom_cafile && !set->str[STRING_SSL_CAFILE_PROXY]) {
+      result = Curl_setstropt(&set->str[STRING_SSL_CAFILE_PROXY],
+                              CURL_CA_BUNDLE);
+      if(result)
+        return result;
+    }
+#endif
+  }
+  sslc->primary.CAfile = data->set.str[STRING_SSL_CAFILE_PROXY];
+  sslc->primary.CApath = data->set.str[STRING_SSL_CAPATH_PROXY];
+  sslc->primary.cipher_list = data->set.str[STRING_SSL_CIPHER_LIST_PROXY];
+  sslc->primary.cipher_list13 = data->set.str[STRING_SSL_CIPHER13_LIST_PROXY];
+  sslc->primary.pinned_key = data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY];
+  sslc->primary.cert_blob = data->set.blobs[BLOB_CERT_PROXY];
+  sslc->primary.ca_info_blob = data->set.blobs[BLOB_CAINFO_PROXY];
+  sslc->primary.issuercert = data->set.str[STRING_SSL_ISSUERCERT_PROXY];
+  sslc->primary.issuercert_blob = data->set.blobs[BLOB_SSL_ISSUERCERT_PROXY];
+  sslc->primary.CRLfile = data->set.str[STRING_SSL_CRLFILE_PROXY];
+  sslc->primary.cert_type = data->set.str[STRING_CERT_TYPE_PROXY];
+  sslc->primary.key = data->set.str[STRING_KEY_PROXY];
+  sslc->primary.key_type = data->set.str[STRING_KEY_TYPE_PROXY];
+  sslc->primary.key_passwd = data->set.str[STRING_KEY_PASSWD_PROXY];
+  sslc->primary.clientcert = data->set.str[STRING_CERT_PROXY];
+  sslc->primary.key_blob = data->set.blobs[BLOB_KEY_PROXY];
+#ifdef USE_TLS_SRP
+  sslc->primary.username = data->set.str[STRING_TLSAUTH_USERNAME_PROXY];
+  sslc->primary.password = data->set.str[STRING_TLSAUTH_PASSWORD_PROXY];
+#endif
+#endif /* CURL_DISABLE_PROXY */
+
+  return CURLE_OK;
+}
+
+CURLcode Curl_ssl_conn_config_init(struct Curl_easy *data,
+                                   struct connectdata *conn)
+{
+  /* Clone "primary" SSL configurations from the easy handle to
+   * the connection. They are used for connection cache matching and
+   * probably outlive the easy handle */
+  if(!clone_ssl_primary_config(&data->set.ssl.primary, &conn->ssl_config))
+    return CURLE_OUT_OF_MEMORY;
+#ifndef CURL_DISABLE_PROXY
+  if(!clone_ssl_primary_config(&data->set.proxy_ssl.primary,
+                               &conn->proxy_ssl_config))
+    return CURLE_OUT_OF_MEMORY;
+#endif
+  return CURLE_OK;
+}
+
+void Curl_ssl_conn_config_cleanup(struct connectdata *conn)
+{
+  Curl_ssl_config_cleanup(&conn->ssl_config);
+#ifndef CURL_DISABLE_PROXY
+  Curl_ssl_config_cleanup(&conn->proxy_ssl_config);
+#endif
+}
+
+void Curl_ssl_conn_config_update(struct Curl_easy *data, bool for_proxy)
+{
+  /* May be called on an easy that has no connection yet */
+  if(data->conn) {
+    struct ssl_primary_config *src, *dest;
+#ifndef CURL_DISABLE_PROXY
+    src = for_proxy ? &data->set.proxy_ssl.primary : &data->set.ssl.primary;
+    dest = for_proxy ? &data->conn->proxy_ssl_config : &data->conn->ssl_config;
+#else
+    (void)for_proxy;
+    src = &data->set.ssl.primary;
+    dest = &data->conn->ssl_config;
+#endif
+    dest->verifyhost = src->verifyhost;
+    dest->verifypeer = src->verifypeer;
+    dest->verifystatus = src->verifystatus;
+  }
+}
diff --git a/third-party/curl/lib/vtls/vtls_config.h b/third-party/curl/lib/vtls/vtls_config.h
new file mode 100644
index 0000000000..44e691dd26
--- /dev/null
+++ b/third-party/curl/lib/vtls/vtls_config.h
@@ -0,0 +1,125 @@
+#ifndef HEADER_CURL_VTLS_CONFIG_H
+#define HEADER_CURL_VTLS_CONFIG_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+struct Curl_easy;
+struct connectdata;
+struct Curl_peer;
+
+struct ssl_primary_config {
+  char *CApath;          /* certificate directory (does not work on Windows) */
+  char *CAfile;          /* certificate to verify peer against */
+  char *issuercert;      /* optional issuer certificate filename */
+  char *clientcert;
+  char *cipher_list;     /* list of ciphers to use */
+  char *cipher_list13;   /* list of TLS 1.3 cipher suites to use */
+  char *signature_algorithms; /* list of signature algorithms to use */
+  char *pinned_key;
+  char *CRLfile;         /* CRL to check certificate revocation */
+  char *cert_type;       /* format for certificate (default: PEM) */
+  char *key;             /* private key filename */
+  char *key_type;        /* format for private key (default: PEM) */
+  char *key_passwd;      /* plain text private key password */
+  struct curl_blob *cert_blob;
+  struct curl_blob *ca_info_blob;
+  struct curl_blob *issuercert_blob;
+  struct curl_blob *key_blob;
+#ifdef USE_TLS_SRP
+  char *username; /* TLS username (for, e.g., SRP) */
+  char *password; /* TLS password (for, e.g., SRP) */
+#endif
+  char *curves;          /* list of curves to use */
+  uint32_t version_max; /* max supported version the client wants to use */
+  uint8_t ssl_options;  /* the CURLOPT_SSL_OPTIONS bitmask */
+  uint8_t version;    /* what version the client wants to use */
+  BIT(verifypeer);       /* set TRUE if this is desired */
+  BIT(verifyhost);       /* set TRUE if CN/SAN must match hostname */
+  BIT(verifystatus);     /* set TRUE if certificate status must be checked */
+  BIT(cache_session);    /* cache session or not */
+  BIT(deep_copy);        /* members are deep copies, eg. owned here */
+};
+
+struct ssl_config_data {
+  struct ssl_primary_config primary;
+  long certverifyresult; /* result from the certificate verification */
+  curl_ssl_ctx_callback fsslctx; /* function to initialize SSL ctx */
+  void *fsslctxp;        /* parameter for call back */
+  BIT(certinfo);     /* gather lots of certificate info */
+  BIT(earlydata);    /* use TLS 1.3 early data */
+  BIT(enable_beast); /* allow this flaw for interoperability's sake */
+  BIT(no_revoke);    /* disable SSL certificate revocation checks */
+  BIT(no_partialchain); /* do not accept partial certificate chains */
+  BIT(revoke_best_effort); /* ignore SSL revocation offline/missing revocation
+                              list errors */
+  BIT(native_ca_store); /* use the native CA store of operating system */
+  BIT(auto_client_cert);   /* automatically locate and use a client
+                              certificate for authentication (Schannel) */
+  BIT(custom_cafile); /* application has set custom CA file */
+  BIT(custom_capath); /* application has set custom CA path */
+  BIT(custom_cablob); /* application has set custom CA blob */
+};
+
+struct ssl_general_config {
+  int ca_cache_timeout;  /* Certificate store cache timeout (seconds) */
+};
+
+void Curl_ssl_config_init(struct ssl_primary_config *sslc);
+void Curl_ssl_config_cleanup(struct ssl_primary_config *sslc);
+
+/**
+ * Init the `data->set.ssl` and `data->set.proxy_ssl` for
+ * connection matching use.
+ */
+CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data,
+                                       struct Curl_peer *origin);
+
+/**
+ * Init SSL configs (main + proxy) for a new connection from the easy handle.
+ */
+CURLcode Curl_ssl_conn_config_init(struct Curl_easy *data,
+                                   struct connectdata *conn);
+
+/**
+ * Free allocated resources in SSL configs (main + proxy) for
+ * the given connection.
+ */
+void Curl_ssl_conn_config_cleanup(struct connectdata *conn);
+
+/**
+ * Return TRUE iff SSL configuration from `data` is functionally the
+ * same as the one on `candidate`.
+ * @param proxy   match the proxy SSL config or the main one
+ */
+bool Curl_ssl_conn_config_match(struct Curl_easy *data,
+                                struct connectdata *candidate,
+                                bool proxy);
+
+/* Update certain connection SSL config flags after they have
+ * been changed on the easy handle. Works for `verifypeer`,
+ * `verifyhost` and `verifystatus`. */
+void Curl_ssl_conn_config_update(struct Curl_easy *data, bool for_proxy);
+
+#endif /* HEADER_CURL_VTLS_CONFIG_H */
diff --git a/third-party/curl/lib/vtls/vtls_int.h b/third-party/curl/lib/vtls/vtls_int.h
index a6e4544a87..fa5da6e4d5 100644
--- a/third-party/curl/lib/vtls/vtls_int.h
+++ b/third-party/curl/lib/vtls/vtls_int.h
@@ -24,30 +24,37 @@
  *
  ***************************************************************************/
 #include "curl_setup.h"
-#include "cfilters.h"
-#include "urldata.h"
 
 #ifdef USE_SSL
 
+#include "cfilters.h"
+#include "select.h"
+#include "urldata.h"
+#include "vtls/vtls.h"
+
+struct Curl_ssl;
+struct ssl_connect_data;
+struct Curl_ssl_session;
+
 /* see https://www.iana.org/assignments/tls-extensiontype-values/ */
-#define ALPN_HTTP_1_1_LENGTH 8
-#define ALPN_HTTP_1_1 "http/1.1"
 #define ALPN_HTTP_1_0_LENGTH 8
-#define ALPN_HTTP_1_0 "http/1.0"
-#define ALPN_H2_LENGTH 2
-#define ALPN_H2 "h2"
-#define ALPN_H3_LENGTH 2
-#define ALPN_H3 "h3"
+#define ALPN_HTTP_1_0        "http/1.0"
+#define ALPN_HTTP_1_1_LENGTH 8
+#define ALPN_HTTP_1_1        "http/1.1"
+#define ALPN_H2_LENGTH       2
+#define ALPN_H2              "h2"
+#define ALPN_H3_LENGTH       2
+#define ALPN_H3              "h3"
 
 /* conservative sizes on the ALPN entries and count we are handling,
  * we can increase these if we ever feel the need or have to accommodate
  * ALPN strings from the "outside". */
-#define ALPN_NAME_MAX     10
-#define ALPN_ENTRIES_MAX  3
-#define ALPN_PROTO_BUF_MAX   (ALPN_ENTRIES_MAX * (ALPN_NAME_MAX + 1))
+#define ALPN_NAME_MAX      10
+#define ALPN_ENTRIES_MAX   3
+#define ALPN_PROTO_BUF_MAX (ALPN_ENTRIES_MAX * (ALPN_NAME_MAX + 1))
 
 struct alpn_spec {
-  const char entries[ALPN_ENTRIES_MAX][ALPN_NAME_MAX];
+  char entries[ALPN_ENTRIES_MAX][ALPN_NAME_MAX];
   size_t count; /* number of entries */
 };
 
@@ -60,32 +67,72 @@ CURLcode Curl_alpn_to_proto_buf(struct alpn_proto_buf *buf,
                                 const struct alpn_spec *spec);
 CURLcode Curl_alpn_to_proto_str(struct alpn_proto_buf *buf,
                                 const struct alpn_spec *spec);
+void Curl_alpn_restrict_to(struct alpn_spec *spec, const char *proto);
+void Curl_alpn_copy(struct alpn_spec *dest, const struct alpn_spec *src);
 
 CURLcode Curl_alpn_set_negotiated(struct Curl_cfilter *cf,
                                   struct Curl_easy *data,
+                                  struct ssl_connect_data *connssl,
                                   const unsigned char *proto,
                                   size_t proto_len);
 
+bool Curl_alpn_contains_proto(const struct alpn_spec *spec, const char *proto);
+
+/* enum for the nonblocking SSL connection state machine */
+typedef enum {
+  ssl_connect_1,
+  ssl_connect_2,
+  ssl_connect_3,
+  ssl_connect_done
+} ssl_connect_state;
+
+typedef enum {
+  ssl_connection_none,
+  ssl_connection_deferred,
+  ssl_connection_negotiating,
+  ssl_connection_complete
+} ssl_connection_state;
+
+typedef enum {
+  ssl_earlydata_none,
+  ssl_earlydata_await,
+  ssl_earlydata_sending,
+  ssl_earlydata_sent,
+  ssl_earlydata_accepted,
+  ssl_earlydata_rejected
+} ssl_earlydata_state;
+
+#define CURL_SSL_IO_NEED_NONE   0
+#define CURL_SSL_IO_NEED_RECV   (1 << 0)
+#define CURL_SSL_IO_NEED_SEND   (1 << 1)
+
+/* Max earlydata payload we want to send */
+#define CURL_SSL_EARLY_MAX      (64 * 1024)
+
 /* Information in each SSL cfilter context: cf->ctx */
 struct ssl_connect_data {
-  ssl_connection_state state;
-  ssl_connect_state connecting_state;
-  char *hostname;                   /* hostname for verification */
-  char *dispname;                   /* display version of hostname */
+  const struct Curl_ssl *ssl_impl;  /* TLS backend for this filter */
+  struct ssl_peer peer;             /* peer the filter talks to */
   const struct alpn_spec *alpn;     /* ALPN to use or NULL for none */
   void *backend;                    /* vtls backend specific props */
   struct cf_call_data call_data;    /* data handle used in current call */
   struct curltime handshake_done;   /* time when handshake finished */
-  int port;                         /* remote port at origin */
-  BIT(use_alpn);                    /* if ALPN shall be used in handshake */
+  struct {
+    char *alpn;                     /* ALPN value or NULL */
+  } negotiated;
+  struct bufq earlydata;            /* earlydata to be send to peer */
+  size_t earlydata_max;             /* max earlydata allowed by peer */
+  size_t earlydata_skip;            /* sending bytes to skip when earlydata
+                                     * is accepted by peer */
+  ssl_connection_state state;
+  ssl_connect_state connecting_state;
+  ssl_earlydata_state earlydata_state;
+  int io_need;                      /* TLS signals special SEND/RECV needs */
+  BIT(peer_closed);                 /* peer has closed connection */
+  BIT(prefs_checked);               /* SSL preferences have been checked */
+  BIT(input_pending);               /* data for SSL_read() may be available */
 };
 
-
-#undef CF_CTX_CALL_DATA
-#define CF_CTX_CALL_DATA(cf)  \
-  ((struct ssl_connect_data *)(cf)->ctx)->call_data
-
-
 /* Definitions for SSL Implementations */
 
 struct Curl_ssl {
@@ -101,129 +148,67 @@ struct Curl_ssl {
   void (*cleanup)(void);
 
   size_t (*version)(char *buffer, size_t size);
-  int (*check_cxn)(struct Curl_cfilter *cf, struct Curl_easy *data);
-  int (*shut_down)(struct Curl_cfilter *cf,
-                   struct Curl_easy *data);
-  bool (*data_pending)(struct Curl_cfilter *cf,
-                       const struct Curl_easy *data);
+  CURLcode (*shut_down)(struct Curl_cfilter *cf, struct Curl_easy *data,
+                        bool send_shutdown, bool *done);
+
+  /* data_pending() shall return TRUE when it wants to get called again to
+     drain internal buffers and deliver data instead of waiting for the socket
+     to get readable */
+  bool (*data_pending)(struct Curl_cfilter *cf, const struct Curl_easy *data);
 
   /* return 0 if a find random is filled in */
   CURLcode (*random)(struct Curl_easy *data, unsigned char *entropy,
                      size_t length);
   bool (*cert_status_request)(void);
 
-  CURLcode (*connect_blocking)(struct Curl_cfilter *cf,
-                               struct Curl_easy *data);
-  CURLcode (*connect_nonblocking)(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  bool *done);
-
-  /* If the SSL backend wants to read or write on this connection during a
-     handshake, set socks[0] to the connection's FIRSTSOCKET, and return
-     a bitmap indicating read or write with GETSOCK_WRITESOCK(0) or
-     GETSOCK_READSOCK(0). Otherwise return GETSOCK_BLANK.
-     Mandatory. */
-  int (*get_select_socks)(struct Curl_cfilter *cf, struct Curl_easy *data,
-                          curl_socket_t *socks);
+  CURLcode (*do_connect)(struct Curl_cfilter *cf, struct Curl_easy *data,
+                         bool *done);
 
+  /* During handshake/shutdown, adjust the pollset to include the socket
+   * for POLLOUT or POLLIN as needed. Mandatory. */
+  CURLcode (*adjust_pollset)(struct Curl_cfilter *cf, struct Curl_easy *data,
+                             struct easy_pollset *ps);
   void *(*get_internals)(struct ssl_connect_data *connssl, CURLINFO info);
   void (*close)(struct Curl_cfilter *cf, struct Curl_easy *data);
   void (*close_all)(struct Curl_easy *data);
-  void (*session_free)(void *ptr);
 
   CURLcode (*set_engine)(struct Curl_easy *data, const char *engine);
   CURLcode (*set_engine_default)(struct Curl_easy *data);
   struct curl_slist *(*engines_list)(struct Curl_easy *data);
 
-  bool (*false_start)(void);
   CURLcode (*sha256sum)(const unsigned char *input, size_t inputlen,
-                    unsigned char *sha256sum, size_t sha256sumlen);
-
-  bool (*attach_data)(struct Curl_cfilter *cf, struct Curl_easy *data);
-  void (*detach_data)(struct Curl_cfilter *cf, struct Curl_easy *data);
-
-  void (*free_multi_ssl_backend_data)(struct multi_ssl_backend_data *mbackend);
-
-  ssize_t (*recv_plain)(struct Curl_cfilter *cf, struct Curl_easy *data,
-                        char *buf, size_t len, CURLcode *code);
-  ssize_t (*send_plain)(struct Curl_cfilter *cf, struct Curl_easy *data,
-                        const void *mem, size_t len, CURLcode *code);
+                        unsigned char *sha256sum, size_t sha256sumlen);
+  CURLcode (*recv_plain)(struct Curl_cfilter *cf, struct Curl_easy *data,
+                         char *buf, size_t len, size_t *pnread);
+  CURLcode (*send_plain)(struct Curl_cfilter *cf, struct Curl_easy *data,
+                         const void *mem, size_t len, size_t *pnwritten);
 
+  CURLcode (*get_channel_binding)(struct Curl_easy *data, int sockindex,
+                                  struct dynbuf *binding);
 };
 
 extern const struct Curl_ssl *Curl_ssl;
 
-
-int Curl_none_init(void);
-void Curl_none_cleanup(void);
-int Curl_none_shutdown(struct Curl_cfilter *cf, struct Curl_easy *data);
-int Curl_none_check_cxn(struct Curl_cfilter *cf, struct Curl_easy *data);
-CURLcode Curl_none_random(struct Curl_easy *data, unsigned char *entropy,
-                          size_t length);
-void Curl_none_close_all(struct Curl_easy *data);
-void Curl_none_session_free(void *ptr);
-bool Curl_none_data_pending(struct Curl_cfilter *cf,
-                            const struct Curl_easy *data);
-bool Curl_none_cert_status_request(void);
-CURLcode Curl_none_set_engine(struct Curl_easy *data, const char *engine);
-CURLcode Curl_none_set_engine_default(struct Curl_easy *data);
-struct curl_slist *Curl_none_engines_list(struct Curl_easy *data);
-bool Curl_none_false_start(void);
-int Curl_ssl_get_select_socks(struct Curl_cfilter *cf, struct Curl_easy *data,
-                              curl_socket_t *socks);
-
-/**
- * Get the ssl_config_data in `data` that is relevant for cfilter `cf`.
- */
-struct ssl_config_data *Curl_ssl_cf_get_config(struct Curl_cfilter *cf,
-                                               struct Curl_easy *data);
-
-/**
- * Get the primary config relevant for the filter from its connection.
- */
-struct ssl_primary_config *
-  Curl_ssl_cf_get_primary_config(struct Curl_cfilter *cf);
-
-/**
- * Get the first SSL filter in the chain starting with `cf`, or NULL.
- */
-struct Curl_cfilter *Curl_ssl_cf_get_ssl(struct Curl_cfilter *cf);
+CURLcode Curl_ssl_adjust_pollset(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 struct easy_pollset *ps);
 
 /**
  * Get the SSL filter below the given one or NULL if there is none.
  */
 bool Curl_ssl_cf_is_proxy(struct Curl_cfilter *cf);
 
-/* extract a session ID
- * Sessionid mutex must be locked (see Curl_ssl_sessionid_lock).
- * Caller must make sure that the ownership of returned sessionid object
- * is properly taken (e.g. its refcount is incremented
- * under sessionid mutex).
- */
-bool Curl_ssl_getsessionid(struct Curl_cfilter *cf,
-                           struct Curl_easy *data,
-                           void **ssl_sessionid,
-                           size_t *idsize); /* set 0 if unknown */
-/* add a new session ID
- * Sessionid mutex must be locked (see Curl_ssl_sessionid_lock).
- * Caller must ensure that it has properly shared ownership of this sessionid
- * object with cache (e.g. incrementing refcount on success)
- */
-CURLcode Curl_ssl_addsessionid(struct Curl_cfilter *cf,
+CURLcode Curl_on_session_reuse(struct Curl_cfilter *cf,
                                struct Curl_easy *data,
-                               void *ssl_sessionid,
-                               size_t idsize,
-                               bool *added);
-
-#include "openssl.h"        /* OpenSSL versions */
-#include "gtls.h"           /* GnuTLS versions */
-#include "wolfssl.h"        /* wolfSSL versions */
-#include "schannel.h"       /* Schannel SSPI version */
-#include "sectransp.h"      /* SecureTransport (Darwin) version */
-#include "mbedtls.h"        /* mbedTLS versions */
-#include "bearssl.h"        /* BearSSL versions */
-#include "rustls.h"         /* rustls versions */
-
+                               struct alpn_spec *alpns,
+                               struct Curl_ssl_session *scs,
+                               bool *do_early_data, bool early_data_allowed);
 #endif /* USE_SSL */
 
 #endif /* HEADER_CURL_VTLS_INT_H */
+
+#ifdef USE_SSL
+/* Restore the default SSL filter call_data accessor for unity builds. */
+#undef CF_CTX_CALL_DATA
+#define CF_CTX_CALL_DATA(cf) ((struct ssl_connect_data *)(cf)->ctx)->call_data
+#endif
diff --git a/third-party/curl/lib/vtls/vtls_scache.c b/third-party/curl/lib/vtls/vtls_scache.c
new file mode 100644
index 0000000000..98beeac036
--- /dev/null
+++ b/third-party/curl/lib/vtls/vtls_scache.c
@@ -0,0 +1,1316 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef USE_SSL
+
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+
+#include "urldata.h"
+#include "cfilters.h"
+
+#include "vtls/vtls.h" /* generic SSL protos etc */
+#include "vtls/vtls_int.h"
+#include "vtls/vtls_scache.h"
+#include "vtls/vtls_spack.h"
+
+#include "strcase.h"
+#include "url.h"
+#include "llist.h"
+#include "curl_share.h"
+#include "curl_trc.h"
+#include "curl_sha256.h"
+#include "rand.h"
+
+
+/* a peer+tls-config we cache sessions for */
+struct Curl_ssl_scache_peer {
+  char *ssl_peer_key;      /* id for peer + relevant TLS configuration */
+  char *clientcert;
+  char *key_passwd;
+  char *srp_username;
+  char *srp_password;
+  struct Curl_llist sessions;
+  void *sobj;              /* object instance or NULL */
+  Curl_ssl_scache_obj_dtor *sobj_free; /* free `sobj` callback */
+  unsigned char key_salt[CURL_SHA256_DIGEST_LENGTH]; /* for entry export */
+  unsigned char key_hmac[CURL_SHA256_DIGEST_LENGTH]; /* for entry export */
+  size_t max_sessions;
+  long age;                /* a number, the higher the more recent */
+  BIT(hmac_set);           /* if key_salt and key_hmac are present */
+  BIT(exportable);         /* sessions for this peer can be exported */
+};
+
+#define CURL_SCACHE_MAGIC 0x000e1551
+
+#define GOOD_SCACHE(x) ((x) && (x)->magic == CURL_SCACHE_MAGIC)
+
+static CURLcode cf_ssl_peer_key_add_path(struct dynbuf *buf,
+                                         const char *name,
+                                         const char *path,
+                                         bool *is_local)
+{
+  if(path && path[0]) {
+    /* We try to add absolute paths, so that the session key can stay valid
+     * when used in another process with different CWD. When a path does not
+     * exist, this does not work. Then, we add the path as is. */
+#ifdef _WIN32
+    char abspath[_MAX_PATH];
+    if(_fullpath(abspath, path, _MAX_PATH))
+      return curlx_dyn_addf(buf, ":%s-%s", name, abspath);
+    *is_local = TRUE;
+#elif defined(HAVE_REALPATH)
+    if(path[0] != '/') {
+      char *abspath = realpath(path, NULL);
+      if(abspath) {
+        CURLcode result = curlx_dyn_addf(buf, ":%s-%s", name, abspath);
+        /* !checksrc! disable BANNEDFUNC 1 */
+        free(abspath); /* allocated by libc, free without memdebug */
+        return result;
+      }
+      *is_local = TRUE;
+    }
+#endif
+    return curlx_dyn_addf(buf, ":%s-%s", name, path);
+  }
+  return CURLE_OK;
+}
+
+static CURLcode cf_ssl_peer_key_add_hash(struct dynbuf *buf,
+                                         const char *name,
+                                         struct curl_blob *blob)
+{
+  CURLcode result = CURLE_OK;
+  if(blob && blob->len) {
+    unsigned char hash[CURL_SHA256_DIGEST_LENGTH];
+    size_t i;
+
+    result = curlx_dyn_addf(buf, ":%s-", name);
+    if(result)
+      goto out;
+    result = Curl_sha256it(hash, blob->data, blob->len);
+    if(result)
+      goto out;
+    for(i = 0; i < CURL_SHA256_DIGEST_LENGTH; ++i) {
+      result = curlx_dyn_addf(buf, "%02x", hash[i]);
+      if(result)
+        goto out;
+    }
+  }
+out:
+  return result;
+}
+
+static CURLcode cf_ssl_peer_key_add_mtls(struct dynbuf *buf,
+                                         struct ssl_primary_config *ssl,
+                                         bool *is_local)
+{
+  CURLcode result = CURLE_OK;
+  if(ssl->clientcert && ssl->clientcert[0]) {
+    result = cf_ssl_peer_key_add_path(buf, "CCERT", ssl->clientcert, is_local);
+    if(result)
+      goto out;
+  }
+  if(ssl->key && ssl->key[0]) {
+    result = cf_ssl_peer_key_add_path(buf, "KEY", ssl->key, is_local);
+    if(result)
+      goto out;
+  }
+  if(ssl->key_blob) {
+    result = cf_ssl_peer_key_add_hash(buf, "KEYBlob", ssl->key_blob);
+    if(result)
+      goto out;
+  }
+  if(ssl->cert_type && ssl->cert_type[0]) {
+    size_t i;
+    result = curlx_dyn_add(buf, ":CT-");
+    for(i = 0; !result && ssl->cert_type[i]; i++) {
+      char c = Curl_raw_toupper(ssl->cert_type[i]);
+      result = curlx_dyn_addn(buf, &c, 1);
+    }
+    if(result)
+      goto out;
+  }
+  if(ssl->key_type && ssl->key_type[0]) {
+    size_t i;
+    result = curlx_dyn_add(buf, ":KT-");
+    for(i = 0; !result && ssl->key_type[i]; i++) {
+      char c = Curl_raw_toupper(ssl->key_type[i]);
+      result = curlx_dyn_addn(buf, &c, 1);
+    }
+  }
+out:
+  return result;
+}
+
+#define CURL_SSLS_LOCAL_SUFFIX     ":L"
+#define CURL_SSLS_GLOBAL_SUFFIX    ":G"
+
+static bool cf_ssl_peer_key_is_global(const char *peer_key)
+{
+  size_t len = peer_key ? strlen(peer_key) : 0;
+  return (len > 2) &&
+         (peer_key[len - 1] == 'G') &&
+         (peer_key[len - 2] == ':');
+}
+
+static CURLcode ssl_peer_key_add_transport(struct dynbuf *buf,
+                                           uint8_t transport)
+{
+  switch(transport) {
+  case TRNSPRT_TCP:
+    return CURLE_OK;
+  case TRNSPRT_UDP:
+    return curlx_dyn_add(buf, ":UDP");
+  case TRNSPRT_QUIC:
+    return curlx_dyn_add(buf, ":QUIC");
+  case TRNSPRT_UNIX:
+    return curlx_dyn_add(buf, ":UNIX");
+  default:
+    return curlx_dyn_addf(buf, ":TRNSPRT-%d", transport);
+  }
+}
+
+static CURLcode ssl_peer_key_add_vrfy(struct dynbuf *buf,
+                                      struct ssl_primary_config *ssl,
+                                      const struct ssl_peer *peer)
+{
+  CURLcode result;
+
+  if(!ssl->verifypeer) {
+    result = curlx_dyn_add(buf, ":NO-VRFY-PEER");
+    if(result)
+      return result;
+  }
+  if(!ssl->verifyhost) {
+    result = curlx_dyn_add(buf, ":NO-VRFY-HOST");
+    if(result)
+      return result;
+  }
+  if(ssl->verifystatus) {
+    result = curlx_dyn_add(buf, ":VRFY-STATUS");
+    if(result)
+      return result;
+  }
+  if((!ssl->verifypeer || !ssl->verifyhost) &&
+     peer->peer && !Curl_peer_equal(peer->origin, peer->peer)) {
+    result = curlx_dyn_addf(buf, ":CHOST-%s:CPORT-%u",
+                            peer->peer->hostname,
+                            peer->peer->port);
+    if(result)
+      return result;
+  }
+  return CURLE_OK;
+}
+
+static CURLcode ssl_peer_key_build(struct ssl_primary_config *ssl,
+                                   const struct ssl_peer *peer,
+                                   const char *tls_id,
+                                   char **ppeer_key)
+{
+  struct dynbuf buf;
+  size_t key_len;
+  bool is_local = FALSE;
+  CURLcode result;
+
+  *ppeer_key = NULL;
+  curlx_dyn_init(&buf, 10 * 1024);
+
+  result = curlx_dyn_addf(&buf, "%s:%d",
+                          peer->origin->hostname, peer->origin->port);
+  if(result)
+    goto out;
+  result = ssl_peer_key_add_transport(&buf, peer->transport);
+  if(result)
+    goto out;
+  result = ssl_peer_key_add_vrfy(&buf, ssl, peer);
+  if(result)
+    goto out;
+  if(ssl->version || ssl->version_max) {
+    result = curlx_dyn_addf(&buf, ":TLSVER-%d-%u", ssl->version,
+                            (ssl->version_max >> 16));
+    if(result)
+      goto out;
+  }
+  if(ssl->ssl_options) {
+    result = curlx_dyn_addf(&buf, ":TLSOPT-%x", ssl->ssl_options);
+    if(result)
+      goto out;
+  }
+  if(ssl->cipher_list) {
+    result = curlx_dyn_addf(&buf, ":CIPHER-%s", ssl->cipher_list);
+    if(result)
+      goto out;
+  }
+  if(ssl->cipher_list13) {
+    result = curlx_dyn_addf(&buf, ":CIPHER13-%s", ssl->cipher_list13);
+    if(result)
+      goto out;
+  }
+  if(ssl->curves) {
+    result = curlx_dyn_addf(&buf, ":CURVES-%s", ssl->curves);
+    if(result)
+      goto out;
+  }
+  if(ssl->signature_algorithms) {
+    result = curlx_dyn_addf(&buf, ":SIGALGS-%s",
+                            ssl->signature_algorithms);
+    if(result)
+      goto out;
+  }
+  if(ssl->verifypeer) {
+    result = cf_ssl_peer_key_add_path(&buf, "CA", ssl->CAfile, &is_local);
+    if(result)
+      goto out;
+    result = cf_ssl_peer_key_add_path(&buf, "CApath", ssl->CApath, &is_local);
+    if(result)
+      goto out;
+    result = cf_ssl_peer_key_add_path(&buf, "CRL", ssl->CRLfile, &is_local);
+    if(result)
+      goto out;
+    result = cf_ssl_peer_key_add_path(&buf, "Issuer", ssl->issuercert,
+                                      &is_local);
+    if(result)
+      goto out;
+    if(ssl->ca_info_blob) {
+      result = cf_ssl_peer_key_add_hash(&buf, "CAInfoBlob", ssl->ca_info_blob);
+      if(result)
+        goto out;
+    }
+    if(ssl->issuercert_blob) {
+      result = cf_ssl_peer_key_add_hash(&buf, "IssuerBlob",
+                                        ssl->issuercert_blob);
+      if(result)
+        goto out;
+    }
+  }
+  if(ssl->cert_blob) {
+    result = cf_ssl_peer_key_add_hash(&buf, "CertBlob", ssl->cert_blob);
+    if(result)
+      goto out;
+  }
+  if(ssl->pinned_key && ssl->pinned_key[0]) {
+    result = curlx_dyn_addf(&buf, ":Pinned-%s", ssl->pinned_key);
+    if(result)
+      goto out;
+  }
+
+  result = cf_ssl_peer_key_add_mtls(&buf, ssl, &is_local);
+  if(result)
+    goto out;
+#ifdef USE_TLS_SRP
+  if(ssl->username || ssl->password) {
+    result = curlx_dyn_add(&buf, ":SRP-AUTH");
+    if(result)
+      goto out;
+  }
+#endif
+
+  if(!tls_id || !tls_id[0]) {
+    result = CURLE_FAILED_INIT;
+    goto out;
+  }
+  result = curlx_dyn_addf(&buf, ":IMPL-%s", tls_id);
+  if(result)
+    goto out;
+
+  result = curlx_dyn_addf(&buf, is_local ?
+                          CURL_SSLS_LOCAL_SUFFIX : CURL_SSLS_GLOBAL_SUFFIX);
+  if(result)
+    goto out;
+
+  *ppeer_key = curlx_dyn_take(&buf, &key_len);
+  /* we added printable char, and dynbuf always null-terminates, no need
+   * to track length */
+
+out:
+  curlx_dyn_free(&buf);
+  return result;
+}
+
+CURLcode Curl_ssl_peer_key_make(const struct ssl_peer *peer,
+                                struct ssl_primary_config *sslc,
+                                const char *tls_id,
+                                char **ppeer_key)
+{
+  return ssl_peer_key_build(sslc, peer, tls_id, ppeer_key);
+}
+
+struct Curl_ssl_scache {
+  unsigned int magic;
+  struct Curl_ssl_scache_peer *peers;
+  size_t peer_count;
+  int default_lifetime_secs;
+  long age;
+  BIT(is_locked);
+};
+
+static struct Curl_ssl_scache *cf_ssl_scache_get(struct Curl_easy *data)
+{
+  struct Curl_ssl_scache *scache = NULL;
+  /* If a share is present, its ssl_scache has preference over the multi */
+  if(data->share && data->share->ssl_scache)
+    scache = data->share->ssl_scache;
+  else if(data->multi && data->multi->ssl_scache)
+    scache = data->multi->ssl_scache;
+  if(scache && !GOOD_SCACHE(scache)) {
+    failf(data, "transfer would use an invalid scache at %p, denied",
+          (void *)scache);
+    DEBUGASSERT(0);
+    return NULL;
+  }
+  return scache;
+}
+
+static void cf_ssl_scache_session_ldestroy(void *udata, void *obj)
+{
+  struct Curl_ssl_session *s = obj;
+  (void)udata;
+  curlx_free(CURL_UNCONST(s->sdata));
+  curlx_free(CURL_UNCONST(s->quic_tp));
+  curlx_free((void *)s->alpn);
+  curlx_free(s);
+}
+
+CURLcode Curl_ssl_session_create(void *sdata, size_t sdata_len,
+                                 int ietf_tls_id, const char *alpn,
+                                 curl_off_t valid_until, size_t earlydata_max,
+                                 struct Curl_ssl_session **psession)
+{
+  return Curl_ssl_session_create2(sdata, sdata_len, ietf_tls_id, alpn,
+                                  valid_until, earlydata_max,
+                                  NULL, 0, psession);
+}
+
+CURLcode Curl_ssl_session_create2(void *sdata, size_t sdata_len,
+                                  int ietf_tls_id, const char *alpn,
+                                  curl_off_t valid_until, size_t earlydata_max,
+                                  unsigned char *quic_tp, size_t quic_tp_len,
+                                  struct Curl_ssl_session **psession)
+{
+  struct Curl_ssl_session *s;
+
+  if(!sdata || !sdata_len) {
+    curlx_free(sdata);
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
+
+  *psession = NULL;
+  s = curlx_calloc(1, sizeof(*s));
+  if(!s) {
+    curlx_free(sdata);
+    curlx_free(quic_tp);
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  s->ietf_tls_id = ietf_tls_id;
+  s->valid_until = valid_until;
+  s->earlydata_max = earlydata_max;
+  s->sdata = sdata;
+  s->sdata_len = sdata_len;
+  s->quic_tp = quic_tp;
+  s->quic_tp_len = quic_tp_len;
+  if(alpn) {
+    s->alpn = curlx_strdup(alpn);
+    if(!s->alpn) {
+      cf_ssl_scache_session_ldestroy(NULL, s);
+      return CURLE_OUT_OF_MEMORY;
+    }
+  }
+  *psession = s;
+  return CURLE_OK;
+}
+
+void Curl_ssl_session_destroy(struct Curl_ssl_session *s)
+{
+  if(s) {
+    /* if in the list, the list destructor takes care of it */
+    if(Curl_node_llist(&s->list))
+      Curl_node_remove(&s->list);
+    else {
+      cf_ssl_scache_session_ldestroy(NULL, s);
+    }
+  }
+}
+
+static void cf_ssl_scache_clear_peer(struct Curl_ssl_scache_peer *peer)
+{
+  Curl_llist_destroy(&peer->sessions, NULL);
+  if(peer->sobj) {
+    DEBUGASSERT(peer->sobj_free);
+    if(peer->sobj_free)
+      peer->sobj_free(peer->sobj);
+    peer->sobj = NULL;
+  }
+  peer->sobj_free = NULL;
+  curlx_safefree(peer->clientcert);
+  curlx_safefree(peer->key_passwd);
+#ifdef USE_TLS_SRP
+  curlx_safefree(peer->srp_username);
+  curlx_safefree(peer->srp_password);
+#endif
+  curlx_safefree(peer->ssl_peer_key);
+  peer->age = 0;
+  peer->hmac_set = FALSE;
+}
+
+static void cf_ssl_scache_peer_set_obj(struct Curl_ssl_scache_peer *peer,
+                                       void *sobj,
+                                       Curl_ssl_scache_obj_dtor *sobj_free)
+{
+  DEBUGASSERT(peer);
+  if(peer->sobj_free) {
+    peer->sobj_free(peer->sobj);
+  }
+  peer->sobj = sobj;
+  peer->sobj_free = sobj_free;
+}
+
+static void cf_ssl_cache_peer_update(struct Curl_ssl_scache_peer *peer)
+{
+  /* The sessions of this peer are exportable if
+   * - it has no confidential information
+   * - its peer key is not yet known, because sessions were
+   *   imported using only the salt+hmac
+   * - the peer key is global, e.g. carrying no relative paths */
+  peer->exportable = (!peer->clientcert && !peer->key_passwd &&
+                      !peer->srp_username && !peer->srp_password &&
+                      (!peer->ssl_peer_key ||
+                       cf_ssl_peer_key_is_global(peer->ssl_peer_key)));
+}
+
+static CURLcode cf_ssl_scache_peer_init(struct Curl_ssl_scache_peer *peer,
+                                        const char *ssl_peer_key,
+                                        const char *clientcert,
+                                        const char *key_passwd,
+                                        const char *srp_username,
+                                        const char *srp_password,
+                                        const unsigned char *salt,
+                                        const unsigned char *hmac)
+{
+  CURLcode result = CURLE_OUT_OF_MEMORY;
+
+  DEBUGASSERT(!peer->ssl_peer_key);
+  if(ssl_peer_key) {
+    peer->ssl_peer_key = curlx_strdup(ssl_peer_key);
+    if(!peer->ssl_peer_key)
+      goto out;
+    peer->hmac_set = FALSE;
+  }
+  else if(salt && hmac) {
+    memcpy(peer->key_salt, salt, sizeof(peer->key_salt));
+    memcpy(peer->key_hmac, hmac, sizeof(peer->key_hmac));
+    peer->hmac_set = TRUE;
+  }
+  else {
+    result = CURLE_BAD_FUNCTION_ARGUMENT;
+    goto out;
+  }
+  if(clientcert) {
+    peer->clientcert = curlx_strdup(clientcert);
+    if(!peer->clientcert)
+      goto out;
+  }
+  if(key_passwd) {
+    peer->key_passwd = curlx_strdup(key_passwd);
+    if(!peer->key_passwd)
+      goto out;
+  }
+  if(srp_username) {
+    peer->srp_username = curlx_strdup(srp_username);
+    if(!peer->srp_username)
+      goto out;
+  }
+  if(srp_password) {
+    peer->srp_password = curlx_strdup(srp_password);
+    if(!peer->srp_password)
+      goto out;
+  }
+
+  cf_ssl_cache_peer_update(peer);
+  result = CURLE_OK;
+out:
+  if(result)
+    cf_ssl_scache_clear_peer(peer);
+  return result;
+}
+
+static void cf_scache_session_remove(struct Curl_ssl_scache_peer *peer,
+                                     struct Curl_ssl_session *s)
+{
+  (void)peer;
+  DEBUGASSERT(Curl_node_llist(&s->list) == &peer->sessions);
+  Curl_ssl_session_destroy(s);
+}
+
+static bool cf_scache_session_expired(struct Curl_ssl_session *s,
+                                      curl_off_t now)
+{
+  return (s->valid_until > 0) && (s->valid_until < now);
+}
+
+static void cf_scache_peer_remove_expired(struct Curl_ssl_scache_peer *peer,
+                                          curl_off_t now)
+{
+  struct Curl_llist_node *n = Curl_llist_head(&peer->sessions);
+  while(n) {
+    struct Curl_ssl_session *s = Curl_node_elem(n);
+    n = Curl_node_next(n);
+    if(cf_scache_session_expired(s, now))
+      cf_scache_session_remove(peer, s);
+  }
+}
+
+static void cf_scache_peer_remove_non13(struct Curl_ssl_scache_peer *peer)
+{
+  struct Curl_llist_node *n = Curl_llist_head(&peer->sessions);
+  while(n) {
+    struct Curl_ssl_session *s = Curl_node_elem(n);
+    n = Curl_node_next(n);
+    if(s->ietf_tls_id != CURL_IETF_PROTO_TLS1_3)
+      cf_scache_session_remove(peer, s);
+  }
+}
+
+CURLcode Curl_ssl_scache_create(size_t max_peers,
+                                size_t max_sessions_per_peer,
+                                struct Curl_ssl_scache **pscache)
+{
+  struct Curl_ssl_scache *scache;
+  struct Curl_ssl_scache_peer *peers;
+  size_t i;
+
+  *pscache = NULL;
+  peers = curlx_calloc(max_peers, sizeof(*peers));
+  if(!peers)
+    return CURLE_OUT_OF_MEMORY;
+
+  scache = curlx_calloc(1, sizeof(*scache));
+  if(!scache) {
+    curlx_free(peers);
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  scache->magic = CURL_SCACHE_MAGIC;
+  scache->default_lifetime_secs = (24 * 60 * 60); /* 1 day */
+  scache->peer_count = max_peers;
+  scache->peers = peers;
+  scache->age = 1;
+  for(i = 0; i < scache->peer_count; ++i) {
+    scache->peers[i].max_sessions = max_sessions_per_peer;
+    Curl_llist_init(&scache->peers[i].sessions,
+                    cf_ssl_scache_session_ldestroy);
+  }
+
+  *pscache = scache;
+  return CURLE_OK;
+}
+
+void Curl_ssl_scache_destroy(struct Curl_ssl_scache *scache)
+{
+  if(GOOD_SCACHE(scache)) {
+    size_t i;
+    scache->magic = 0;
+    for(i = 0; i < scache->peer_count; ++i) {
+      cf_ssl_scache_clear_peer(&scache->peers[i]);
+    }
+    curlx_free(scache->peers);
+    curlx_free(scache);
+  }
+}
+
+bool Curl_ssl_scache_use(struct Curl_cfilter *cf, struct Curl_easy *data)
+{
+  if(cf_ssl_scache_get(data)) {
+    struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+    return ssl_config ? ssl_config->primary.cache_session : FALSE;
+  }
+  return FALSE;
+}
+
+/* Lock shared SSL session data */
+void Curl_ssl_scache_lock(struct Curl_easy *data)
+{
+  struct Curl_ssl_scache *scache = cf_ssl_scache_get(data);
+  if(scache) {
+    if(CURL_SHARE_ssl_scache(data))
+      Curl_share_lock(data, CURL_LOCK_DATA_SSL_SESSION,
+                      CURL_LOCK_ACCESS_SINGLE);
+    DEBUGASSERT(!scache->is_locked);
+    scache->is_locked = TRUE;
+  }
+}
+
+/* Unlock shared SSL session data */
+void Curl_ssl_scache_unlock(struct Curl_easy *data)
+{
+  struct Curl_ssl_scache *scache = cf_ssl_scache_get(data);
+  if(scache) {
+    DEBUGASSERT(scache->is_locked);
+    scache->is_locked = FALSE;
+    if(CURL_SHARE_ssl_scache(data))
+      Curl_share_unlock(data, CURL_LOCK_DATA_SSL_SESSION);
+  }
+}
+
+static bool cf_ssl_scache_match_auth(struct Curl_ssl_scache_peer *peer,
+                                     struct ssl_primary_config *conn_config)
+{
+  if(!conn_config) {
+    if(peer->clientcert || peer->key_passwd)
+      return FALSE;
+#ifdef USE_TLS_SRP
+    if(peer->srp_username || peer->srp_password)
+      return FALSE;
+#endif
+    return TRUE;
+  }
+  else if(!Curl_safecmp(peer->clientcert, conn_config->clientcert))
+    return FALSE;
+  if(Curl_timestrcmp(peer->key_passwd, conn_config->key_passwd))
+    return FALSE;
+#ifdef USE_TLS_SRP
+  if(Curl_timestrcmp(peer->srp_username, conn_config->username) ||
+     Curl_timestrcmp(peer->srp_password, conn_config->password))
+    return FALSE;
+#endif
+  return TRUE;
+}
+
+static CURLcode cf_ssl_find_peer_by_key(struct Curl_easy *data,
+                                        struct Curl_ssl_scache *scache,
+                                        const char *ssl_peer_key,
+                                        struct ssl_primary_config *conn_config,
+                                        struct Curl_ssl_scache_peer **ppeer)
+{
+  size_t i, peer_key_len = 0;
+  CURLcode result = CURLE_OK;
+
+  *ppeer = NULL;
+  if(!GOOD_SCACHE(scache)) {
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
+
+  CURL_TRC_SSLS(data, "find peer slot for %s among %zu slots",
+                ssl_peer_key, scache->peer_count);
+
+  /* check for entries with known peer_key */
+  for(i = 0; scache && i < scache->peer_count; i++) {
+    if(scache->peers[i].ssl_peer_key &&
+       curl_strequal(ssl_peer_key, scache->peers[i].ssl_peer_key) &&
+       cf_ssl_scache_match_auth(&scache->peers[i], conn_config)) {
+      /* yes, we have a cached session for this! */
+      *ppeer = &scache->peers[i];
+      goto out;
+    }
+  }
+  /* check for entries with HMAC set but no known peer_key */
+  for(i = 0; scache && i < scache->peer_count; i++) {
+    if(!scache->peers[i].ssl_peer_key &&
+       scache->peers[i].hmac_set &&
+       cf_ssl_scache_match_auth(&scache->peers[i], conn_config)) {
+      /* possible entry with unknown peer_key, check hmac */
+      unsigned char my_hmac[CURL_SHA256_DIGEST_LENGTH];
+      if(!peer_key_len) /* we are lazy */
+        peer_key_len = strlen(ssl_peer_key);
+      result = Curl_hmacit(&Curl_HMAC_SHA256,
+                           scache->peers[i].key_salt,
+                           sizeof(scache->peers[i].key_salt),
+                           (const unsigned char *)ssl_peer_key,
+                           peer_key_len,
+                           my_hmac);
+      if(result)
+        goto out;
+      if(!memcmp(scache->peers[i].key_hmac, my_hmac, sizeof(my_hmac))) {
+        /* remember peer_key for future lookups */
+        CURL_TRC_SSLS(data, "peer entry %zu key recovered: %s",
+                      i, ssl_peer_key);
+        scache->peers[i].ssl_peer_key = curlx_strdup(ssl_peer_key);
+        if(!scache->peers[i].ssl_peer_key) {
+          result = CURLE_OUT_OF_MEMORY;
+          goto out;
+        }
+        cf_ssl_cache_peer_update(&scache->peers[i]);
+        *ppeer = &scache->peers[i];
+        goto out;
+      }
+    }
+  }
+  CURL_TRC_SSLS(data, "peer not found for %s", ssl_peer_key);
+out:
+  return result;
+}
+
+static struct Curl_ssl_scache_peer *cf_ssl_get_free_peer(
+  struct Curl_ssl_scache *scache)
+{
+  struct Curl_ssl_scache_peer *peer = NULL;
+  size_t i;
+
+  /* find empty or oldest peer */
+  for(i = 0; i < scache->peer_count; ++i) {
+    /* free peer entry? */
+    if(!scache->peers[i].ssl_peer_key && !scache->peers[i].hmac_set) {
+      peer = &scache->peers[i];
+      break;
+    }
+    /* peer without sessions and obj */
+    if(!scache->peers[i].sobj &&
+       !Curl_llist_count(&scache->peers[i].sessions)) {
+      peer = &scache->peers[i];
+      break;
+    }
+    /* remember "oldest" peer */
+    if(!peer || (scache->peers[i].age < peer->age)) {
+      peer = &scache->peers[i];
+    }
+  }
+  DEBUGASSERT(peer);
+  if(peer)
+    cf_ssl_scache_clear_peer(peer);
+  return peer;
+}
+
+static CURLcode cf_ssl_add_peer(struct Curl_easy *data,
+                                struct Curl_ssl_scache *scache,
+                                const char *ssl_peer_key,
+                                struct ssl_primary_config *conn_config,
+                                struct Curl_ssl_scache_peer **ppeer)
+{
+  struct Curl_ssl_scache_peer *peer = NULL;
+  CURLcode result = CURLE_OK;
+
+  *ppeer = NULL;
+  if(ssl_peer_key) {
+    result = cf_ssl_find_peer_by_key(data, scache, ssl_peer_key, conn_config,
+                                     &peer);
+    if(result || !scache->peer_count)
+      return result;
+  }
+
+  if(peer) {
+    *ppeer = peer;
+    return CURLE_OK;
+  }
+
+  peer = cf_ssl_get_free_peer(scache);
+  if(peer) {
+    char buffer[64];
+    const char *ccert = conn_config ? conn_config->clientcert : NULL;
+    const char *kpasswd = conn_config ? conn_config->key_passwd : NULL;
+    const char *username = NULL, *password = NULL;
+#ifdef USE_TLS_SRP
+    username = conn_config ? conn_config->username : NULL;
+    password = conn_config ? conn_config->password : NULL;
+#endif
+    if(!ccert && conn_config && conn_config->cert_blob) {
+      /* when using a client cert blob, create a name for it */
+      curl_msnprintf(buffer, sizeof(buffer),
+                     "cert-%p", conn_config->cert_blob->data);
+      ccert = buffer; /* data is strduped by cf_ssl_scache_peer_init */
+    }
+    result = cf_ssl_scache_peer_init(peer, ssl_peer_key, ccert, kpasswd,
+                                     username, password, NULL, NULL);
+    if(result)
+      goto out;
+    /* all ready */
+    *ppeer = peer;
+    result = CURLE_OK;
+  }
+
+out:
+  if(result) {
+    cf_ssl_scache_clear_peer(peer);
+  }
+  return result;
+}
+
+static void cf_scache_peer_add_session(struct Curl_ssl_scache_peer *peer,
+                                       struct Curl_ssl_session *s,
+                                       curl_off_t now)
+{
+  /* A session not from TLSv1.3 replaces all other. */
+  if(s->ietf_tls_id != CURL_IETF_PROTO_TLS1_3) {
+    Curl_llist_destroy(&peer->sessions, NULL);
+    Curl_llist_append(&peer->sessions, s, &s->list);
+  }
+  else {
+    /* Expire existing, append, trim from head to obey max_sessions */
+    cf_scache_peer_remove_expired(peer, now);
+    cf_scache_peer_remove_non13(peer);
+    Curl_llist_append(&peer->sessions, s, &s->list);
+    while(Curl_llist_count(&peer->sessions) > peer->max_sessions) {
+      Curl_node_remove(Curl_llist_head(&peer->sessions));
+    }
+  }
+}
+
+static CURLcode cf_scache_add_session(struct Curl_cfilter *cf,
+                                      struct Curl_easy *data,
+                                      struct Curl_ssl_scache *scache,
+                                      const char *ssl_peer_key,
+                                      struct Curl_ssl_session *s)
+{
+  struct Curl_ssl_scache_peer *peer = NULL;
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  CURLcode result = CURLE_OUT_OF_MEMORY;
+  curl_off_t now = (curl_off_t)time(NULL);
+  curl_off_t max_lifetime;
+
+  if(!scache || !scache->peer_count) {
+    Curl_ssl_session_destroy(s);
+    return CURLE_OK;
+  }
+
+  if(s->valid_until <= 0)
+    s->valid_until = now + scache->default_lifetime_secs;
+
+  max_lifetime = (s->ietf_tls_id == CURL_IETF_PROTO_TLS1_3) ?
+                 CURL_SCACHE_MAX_13_LIFETIME_SEC :
+                 CURL_SCACHE_MAX_12_LIFETIME_SEC;
+  if(s->valid_until > (now + max_lifetime))
+    s->valid_until = now + max_lifetime;
+
+  if(cf_scache_session_expired(s, now)) {
+    CURL_TRC_SSLS(data, "add, session already expired");
+    Curl_ssl_session_destroy(s);
+    return CURLE_OK;
+  }
+
+  result = cf_ssl_add_peer(data, scache, ssl_peer_key, conn_config, &peer);
+  if(result || !peer) {
+    CURL_TRC_SSLS(data, "unable to add scache peer: %d", (int)result);
+    Curl_ssl_session_destroy(s);
+    goto out;
+  }
+
+  cf_scache_peer_add_session(peer, s, now);
+
+out:
+  if(result) {
+    failf(data, "[SCACHE] failed to add session for %s, error=%d",
+          ssl_peer_key, (int)result);
+  }
+  else
+    CURL_TRC_SSLS(data, "added session for %s [proto=0x%x, "
+                  "valid_secs=%" FMT_OFF_T ", alpn=%s, earlydata=%zu, "
+                  "quic_tp=%s], peer has %zu sessions now", ssl_peer_key,
+                  (unsigned int)s->ietf_tls_id, s->valid_until - now,
+                  s->alpn, s->earlydata_max, s->quic_tp ? "yes" : "no",
+                  peer ? Curl_llist_count(&peer->sessions) : 0);
+  return result;
+}
+
+CURLcode Curl_ssl_scache_put(struct Curl_cfilter *cf,
+                             struct Curl_easy *data,
+                             const char *ssl_peer_key,
+                             struct Curl_ssl_session *s)
+{
+  struct Curl_ssl_scache *scache = cf_ssl_scache_get(data);
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+  CURLcode result;
+  DEBUGASSERT(ssl_config);
+
+  if(!scache || !ssl_config->primary.cache_session) {
+    Curl_ssl_session_destroy(s);
+    return CURLE_OK;
+  }
+
+  Curl_ssl_scache_lock(data);
+  result = cf_scache_add_session(cf, data, scache, ssl_peer_key, s);
+  Curl_ssl_scache_unlock(data);
+  return result;
+}
+
+void Curl_ssl_scache_return(struct Curl_cfilter *cf,
+                            struct Curl_easy *data,
+                            const char *ssl_peer_key,
+                            struct Curl_ssl_session *s)
+{
+  /* See RFC 8446 C.4:
+   * "Clients SHOULD NOT reuse a ticket for multiple connections." */
+  if(s && s->ietf_tls_id < 0x304)
+    (void)Curl_ssl_scache_put(cf, data, ssl_peer_key, s);
+  else
+    Curl_ssl_session_destroy(s);
+}
+
+CURLcode Curl_ssl_scache_take(struct Curl_cfilter *cf,
+                              struct Curl_easy *data,
+                              const char *ssl_peer_key,
+                              struct Curl_ssl_session **ps)
+{
+  struct Curl_ssl_scache *scache = cf_ssl_scache_get(data);
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  struct Curl_ssl_scache_peer *peer = NULL;
+  struct Curl_llist_node *n;
+  struct Curl_ssl_session *s = NULL;
+  CURLcode result;
+
+  *ps = NULL;
+  if(!scache)
+    return CURLE_OK;
+
+  Curl_ssl_scache_lock(data);
+  result = cf_ssl_find_peer_by_key(data, scache, ssl_peer_key, conn_config,
+                                   &peer);
+  if(!result && peer) {
+    cf_scache_peer_remove_expired(peer, (curl_off_t)time(NULL));
+    n = Curl_llist_head(&peer->sessions);
+    if(n) {
+      s = Curl_node_take_elem(n);
+      (scache->age)++;            /* increase general age */
+      peer->age = scache->age; /* set this as used in this age */
+    }
+  }
+  if(s) {
+    *ps = s;
+    CURL_TRC_SSLS(data, "took session for %s [proto=0x%x, "
+                  "alpn=%s, earlydata=%zu, quic_tp=%s], %zu sessions remain",
+                  ssl_peer_key, (unsigned int)s->ietf_tls_id, s->alpn,
+                  s->earlydata_max, s->quic_tp ? "yes" : "no",
+                  Curl_llist_count(&peer->sessions));
+  }
+  else {
+    CURL_TRC_SSLS(data, "no cached session for %s", ssl_peer_key);
+  }
+  Curl_ssl_scache_unlock(data);
+  return result;
+}
+
+CURLcode Curl_ssl_scache_add_obj(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 const char *ssl_peer_key,
+                                 void *sobj,
+                                 Curl_ssl_scache_obj_dtor *sobj_dtor_cb)
+{
+  struct Curl_ssl_scache *scache = cf_ssl_scache_get(data);
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  struct Curl_ssl_scache_peer *peer = NULL;
+  CURLcode result;
+
+  DEBUGASSERT(sobj);
+  DEBUGASSERT(sobj_dtor_cb);
+
+  if(!scache) {
+    result = CURLE_BAD_FUNCTION_ARGUMENT;
+    goto out;
+  }
+
+  result = cf_ssl_add_peer(data, scache, ssl_peer_key, conn_config, &peer);
+  if(result || !peer) {
+    CURL_TRC_SSLS(data, "unable to add scache peer: %d", (int)result);
+    goto out;
+  }
+
+  cf_ssl_scache_peer_set_obj(peer, sobj, sobj_dtor_cb);
+  sobj = NULL;  /* peer took ownership */
+
+out:
+  if(sobj && sobj_dtor_cb)
+    sobj_dtor_cb(sobj);
+  return result;
+}
+
+void *Curl_ssl_scache_get_obj(struct Curl_cfilter *cf,
+                              struct Curl_easy *data,
+                              const char *ssl_peer_key)
+{
+  struct Curl_ssl_scache *scache = cf_ssl_scache_get(data);
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  struct Curl_ssl_scache_peer *peer = NULL;
+  CURLcode result;
+  void *sobj;
+
+  if(!scache)
+    return NULL;
+
+  result = cf_ssl_find_peer_by_key(data, scache, ssl_peer_key, conn_config,
+                                   &peer);
+  if(result)
+    return NULL;
+
+  sobj = peer ? peer->sobj : NULL;
+
+  CURL_TRC_SSLS(data, "%s cached session for '%s'",
+                sobj ? "Found" : "No", ssl_peer_key);
+  return sobj;
+}
+
+void Curl_ssl_scache_remove_all(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                const char *ssl_peer_key)
+{
+  struct Curl_ssl_scache *scache = cf_ssl_scache_get(data);
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  struct Curl_ssl_scache_peer *peer = NULL;
+  CURLcode result;
+
+  (void)cf;
+  if(!scache)
+    return;
+
+  Curl_ssl_scache_lock(data);
+  result = cf_ssl_find_peer_by_key(data, scache, ssl_peer_key, conn_config,
+                                   &peer);
+  if(!result && peer)
+    cf_ssl_scache_clear_peer(peer);
+  Curl_ssl_scache_unlock(data);
+}
+
+#ifdef USE_SSLS_EXPORT
+
+#define CURL_SSL_TICKET_MAX   (16 * 1024)
+
+bool Curl_ssl_scache_is_locked(struct Curl_easy *data)
+{
+  struct Curl_ssl_scache *scache = cf_ssl_scache_get(data);
+  return scache && scache->is_locked;
+}
+
+static CURLcode cf_ssl_scache_peer_set_hmac(struct Curl_ssl_scache_peer *peer)
+{
+  CURLcode result;
+
+  DEBUGASSERT(peer);
+  if(!peer->ssl_peer_key)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  result = Curl_rand(NULL, peer->key_salt, sizeof(peer->key_salt));
+  if(result)
+    return result;
+
+  result = Curl_hmacit(&Curl_HMAC_SHA256,
+                       peer->key_salt, sizeof(peer->key_salt),
+                       (const unsigned char *)peer->ssl_peer_key,
+                       strlen(peer->ssl_peer_key),
+                       peer->key_hmac);
+  if(!result)
+    peer->hmac_set = TRUE;
+  return result;
+}
+
+static CURLcode cf_ssl_find_peer_by_hmac(struct Curl_ssl_scache *scache,
+                                         const unsigned char *salt,
+                                         const unsigned char *hmac,
+                                         struct Curl_ssl_scache_peer **ppeer)
+{
+  size_t i;
+  CURLcode result = CURLE_OK;
+
+  *ppeer = NULL;
+  if(!GOOD_SCACHE(scache))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  /* look for an entry that matches salt+hmac exactly or has a known
+   * ssl_peer_key which salt+hmac's to the same. */
+  for(i = 0; scache && i < scache->peer_count; i++) {
+    struct Curl_ssl_scache_peer *peer = &scache->peers[i];
+    if(!cf_ssl_scache_match_auth(peer, NULL))
+      continue;
+    if(scache->peers[i].hmac_set &&
+       !memcmp(peer->key_salt, salt, sizeof(peer->key_salt)) &&
+       !memcmp(peer->key_hmac, hmac, sizeof(peer->key_hmac))) {
+      /* found exact match, return */
+      *ppeer = peer;
+      goto out;
+    }
+    else if(peer->ssl_peer_key) {
+      unsigned char my_hmac[CURL_SHA256_DIGEST_LENGTH];
+      /* compute hmac for the passed salt */
+      result = Curl_hmacit(&Curl_HMAC_SHA256,
+                           salt, sizeof(peer->key_salt),
+                           (const unsigned char *)peer->ssl_peer_key,
+                           strlen(peer->ssl_peer_key),
+                           my_hmac);
+      if(result)
+        goto out;
+      if(!memcmp(my_hmac, hmac, sizeof(my_hmac))) {
+        /* cryptohash match, take over salt+hmac if no set and return */
+        if(!peer->hmac_set) {
+          memcpy(peer->key_salt, salt, sizeof(peer->key_salt));
+          memcpy(peer->key_hmac, hmac, sizeof(peer->key_hmac));
+          peer->hmac_set = TRUE;
+        }
+        *ppeer = peer;
+        goto out;
+      }
+    }
+  }
+out:
+  return result;
+}
+
+CURLcode Curl_ssl_session_import(struct Curl_easy *data,
+                                 const char *ssl_peer_key,
+                                 const unsigned char *shmac, size_t shmac_len,
+                                 const void *sdata, size_t sdata_len)
+{
+  struct Curl_ssl_scache *scache = cf_ssl_scache_get(data);
+  struct Curl_ssl_scache_peer *peer = NULL;
+  struct Curl_ssl_session *s = NULL;
+  CURLcode result;
+
+  if(!scache) {
+    result = CURLE_BAD_FUNCTION_ARGUMENT;
+    goto out;
+  }
+  if(!ssl_peer_key && (!shmac || !shmac_len)) {
+    result = CURLE_BAD_FUNCTION_ARGUMENT;
+    goto out;
+  }
+
+  result = Curl_ssl_session_unpack(data, sdata, sdata_len, &s);
+  if(result)
+    goto out;
+
+  Curl_ssl_scache_lock(data);
+
+  if(ssl_peer_key) {
+    result = cf_ssl_add_peer(data, scache, ssl_peer_key, NULL, &peer);
+    if(result)
+      goto out;
+  }
+  else if(shmac_len != (sizeof(peer->key_salt) + sizeof(peer->key_hmac))) {
+    /* Either salt+hmac was garbled by caller or is from a curl version
+     * that does things differently */
+    result = CURLE_BAD_FUNCTION_ARGUMENT;
+    goto out;
+  }
+  else {
+    const unsigned char *salt = shmac;
+    const unsigned char *hmac = shmac + sizeof(peer->key_salt);
+
+    result = cf_ssl_find_peer_by_hmac(scache, salt, hmac, &peer);
+    if(result)
+      goto out;
+    if(!peer) {
+      peer = cf_ssl_get_free_peer(scache);
+      if(peer) {
+        result = cf_ssl_scache_peer_init(peer, ssl_peer_key, NULL, NULL,
+                                         NULL, NULL, salt, hmac);
+        if(result)
+          goto out;
+      }
+    }
+  }
+
+  if(peer) {
+    cf_scache_peer_add_session(peer, s, time(NULL));
+    s = NULL; /* peer is now owner */
+    CURL_TRC_SSLS(data, "successfully imported ticket for peer %s, now "
+                  "with %zu tickets",
+                  peer->ssl_peer_key ? peer->ssl_peer_key : "without key",
+                  Curl_llist_count(&peer->sessions));
+  }
+
+out:
+  if(scache && scache->is_locked)
+    Curl_ssl_scache_unlock(data);
+  Curl_ssl_session_destroy(s);
+  return result;
+}
+
+CURLcode Curl_ssl_session_export(struct Curl_easy *data,
+                                 curl_ssls_export_cb *export_fn,
+                                 void *userptr)
+{
+  struct Curl_ssl_scache *scache = cf_ssl_scache_get(data);
+  struct Curl_ssl_scache_peer *peer;
+  struct dynbuf sbuf, hbuf;
+  struct Curl_llist_node *n;
+  size_t i;
+  curl_off_t now = time(NULL);
+  CURLcode result = CURLE_OK;
+#ifdef CURLVERBOSE
+  size_t npeers = 0, ntickets = 0;
+#endif
+
+  if(!export_fn)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  Curl_ssl_scache_lock(data);
+
+  curlx_dyn_init(&hbuf, (CURL_SHA256_DIGEST_LENGTH * 2) + 1);
+  curlx_dyn_init(&sbuf, CURL_SSL_TICKET_MAX);
+
+  for(i = 0; scache && i < scache->peer_count; i++) {
+    peer = &scache->peers[i];
+    if(!peer->ssl_peer_key && !peer->hmac_set)
+      continue; /* skip free entry */
+    if(!peer->exportable)
+      continue;
+
+    curlx_dyn_reset(&hbuf);
+    cf_scache_peer_remove_expired(peer, now);
+    n = Curl_llist_head(&peer->sessions);
+    if(n)
+      VERBOSE(++npeers);
+    while(n) {
+      struct Curl_ssl_session *s = Curl_node_elem(n);
+      if(!peer->hmac_set) {
+        result = cf_ssl_scache_peer_set_hmac(peer);
+        if(result)
+          goto out;
+      }
+      if(!curlx_dyn_len(&hbuf)) {
+        result = curlx_dyn_addn(&hbuf, peer->key_salt, sizeof(peer->key_salt));
+        if(result)
+          goto out;
+        result = curlx_dyn_addn(&hbuf, peer->key_hmac, sizeof(peer->key_hmac));
+        if(result)
+          goto out;
+      }
+      curlx_dyn_reset(&sbuf);
+      result = Curl_ssl_session_pack(data, s, &sbuf);
+      if(result)
+        goto out;
+
+      result = export_fn(data, userptr, peer->ssl_peer_key,
+                         curlx_dyn_uptr(&hbuf), curlx_dyn_len(&hbuf),
+                         curlx_dyn_uptr(&sbuf), curlx_dyn_len(&sbuf),
+                         s->valid_until, s->ietf_tls_id,
+                         s->alpn, s->earlydata_max);
+      if(result)
+        goto out;
+      VERBOSE(++ntickets);
+      n = Curl_node_next(n);
+    }
+  }
+  result = CURLE_OK;
+  CURL_TRC_SSLS(data, "exported %zu session tickets for %zu peers",
+                ntickets, npeers);
+
+out:
+  Curl_ssl_scache_unlock(data);
+  curlx_dyn_free(&hbuf);
+  curlx_dyn_free(&sbuf);
+  return result;
+}
+
+#endif /* USE_SSLS_EXPORT */
+
+#endif /* USE_SSL */
diff --git a/third-party/curl/lib/vtls/vtls_scache.h b/third-party/curl/lib/vtls/vtls_scache.h
new file mode 100644
index 0000000000..effb1d8f96
--- /dev/null
+++ b/third-party/curl/lib/vtls/vtls_scache.h
@@ -0,0 +1,216 @@
+#ifndef HEADER_CURL_VTLS_SCACHE_H
+#define HEADER_CURL_VTLS_SCACHE_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef USE_SSL
+
+#include "cfilters.h"
+#include "urldata.h"
+
+struct Curl_cfilter;
+struct Curl_easy;
+struct Curl_ssl_scache;
+struct Curl_ssl_session;
+struct ssl_peer;
+
+/* RFC 8446 (TLSv1.3) restrict lifetime to one week max, for
+ * other, less secure versions, we restrict it to a day */
+#define CURL_SCACHE_MAX_13_LIFETIME_SEC    (60 * 60 * 24 * 7)
+#define CURL_SCACHE_MAX_12_LIFETIME_SEC    (60 * 60 * 24)
+
+/* Create a session cache for up to max_peers endpoints with a total
+ * of up to max_sessions SSL sessions per peer */
+CURLcode Curl_ssl_scache_create(size_t max_peers,
+                                size_t max_sessions_per_peer,
+                                struct Curl_ssl_scache **pscache);
+
+void Curl_ssl_scache_destroy(struct Curl_ssl_scache *scache);
+
+/* Create a key from peer and TLS configuration information that is
+ * unique for how the connection filter wants to establish a TLS
+ * connection to the peer.
+ * If the filter is a TLS proxy filter, it uses the proxy relevant
+ * information.
+ * @param peer    the peer the filter wants to talk to
+ * @param sslc    the relevant ssl configuration
+ * @param tls_id  identifier of TLS implementation for sessions. Should
+ *                include full version if session data from other versions
+ *                is to be avoided.
+ * @param ppeer_key on successful return, the key generated
+ */
+CURLcode Curl_ssl_peer_key_make(const struct ssl_peer *peer,
+                                struct ssl_primary_config *sslc,
+                                const char *tls_id,
+                                char **ppeer_key);
+
+/* Return if there is a session cache shall be used.
+ * An SSL session might not be configured or not available for
+ * "connect-only" transfers.
+ */
+bool Curl_ssl_scache_use(struct Curl_cfilter *cf, struct Curl_easy *data);
+
+/* Lock session cache mutex.
+ * Call this before calling other Curl_ssl_*session* functions
+ * Caller should unlock this mutex as soon as possible, as it may block
+ * other SSL connection from making progress.
+ * The purpose of explicitly locking SSL session cache data is to allow
+ * individual SSL engines to manage session lifetime in their specific way.
+ */
+void Curl_ssl_scache_lock(struct Curl_easy *data);
+
+/* Unlock session cache mutex */
+void Curl_ssl_scache_unlock(struct Curl_easy *data);
+
+/* Get TLS session object from the cache for the ssl_peer_key.
+ * scache mutex must be locked (see Curl_ssl_scache_lock).
+ * Caller must make sure that the ownership of returned session object
+ * is properly taken (e.g. its refcount is incremented
+ * under scache mutex).
+ * @param cf      the connection filter wanting to use it
+ * @param data    the transfer involved
+ * @param ssl_peer_key the key for lookup
+ * @retval sobj   the object for the peer key or NULL
+ */
+void *Curl_ssl_scache_get_obj(struct Curl_cfilter *cf,
+                              struct Curl_easy *data,
+                              const char *ssl_peer_key);
+
+typedef void Curl_ssl_scache_obj_dtor(void *sobj);
+
+/* Add a TLS session related object to the cache.
+ * Replaces an existing object with the same peer_key.
+ * scache mutex must be locked (see Curl_ssl_scache_lock).
+ * Call takes ownership of `sobj`, using `sobj_dtor_cb`
+ * to deallocate it. Is called in all outcomes, either right away or
+ * later when the session cache is cleaned up.
+ * Caller must ensure that it has properly shared ownership of `sobj`
+ * with cache (e.g. incrementing refcount on success)
+ * @param cf      the connection filter wanting to use it
+ * @param data    the transfer involved
+ * @param ssl_peer_key the key for lookup
+ * @param sobj    the TLS session object
+ * @param sobj_free_cb callback to free the session object
+ */
+CURLcode Curl_ssl_scache_add_obj(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 const char *ssl_peer_key,
+                                 void *sobj,
+                                 Curl_ssl_scache_obj_dtor *sobj_dtor_cb);
+
+/* All about an SSL session ticket */
+struct Curl_ssl_session {
+  const void *sdata;           /* session ticket data, plain bytes */
+  size_t sdata_len;            /* number of bytes in sdata */
+  curl_off_t valid_until;      /* seconds since EPOCH until ticket expires */
+  int ietf_tls_id;             /* TLS protocol identifier negotiated */
+  char *alpn;                  /* APLN TLS negotiated protocol string */
+  size_t earlydata_max;        /* max 0-RTT data supported by peer */
+  const unsigned char *quic_tp; /* Optional QUIC transport param bytes */
+  size_t quic_tp_len;          /* number of bytes in quic_tp */
+  struct Curl_llist_node list; /*  internal storage handling */
+};
+
+/* Create a `session` instance. Does NOT need locking.
+ * Takes ownership of `sdata` and `sobj` regardless of return code.
+ * @param sdata     bytes of SSL session data or NULL (sobj then required)
+ * @param sdata_len amount of session data bytes
+ * @param ietf_tls_id  IETF protocol version, e.g. 0x304 for TLSv1.3
+ * @param alpn      ALPN protocol selected or NULL
+ * @param valid_until seconds since EPOCH when session expires, pass 0
+ *                  in case this is not known.
+ * @param psession on return the scached session instance created
+ */
+CURLcode Curl_ssl_session_create(void *sdata, size_t sdata_len,
+                                 int ietf_tls_id, const char *alpn,
+                                 curl_off_t valid_until, size_t earlydata_max,
+                                 struct Curl_ssl_session **psession);
+
+/* Variation of session creation with quic transport parameter bytes,
+ * Takes ownership of `quic_tp` regardless of return code. */
+CURLcode Curl_ssl_session_create2(void *sdata, size_t sdata_len,
+                                  int ietf_tls_id, const char *alpn,
+                                  curl_off_t valid_until, size_t earlydata_max,
+                                  unsigned char *quic_tp, size_t quic_tp_len,
+                                  struct Curl_ssl_session **psession);
+
+/* Destroy a `session` instance. Can be called with NULL.
+ * Does NOT need locking. */
+void Curl_ssl_session_destroy(struct Curl_ssl_session *s);
+
+/* Put the scache session into the cache. Does NOT need locking.
+ * Call takes ownership of `s` in all outcomes.
+ * @param cf      the connection filter wanting to use it
+ * @param data    the transfer involved
+ * @param ssl_peer_key the key for lookup
+ * @param s       the scache session object
+ */
+CURLcode Curl_ssl_scache_put(struct Curl_cfilter *cf,
+                             struct Curl_easy *data,
+                             const char *ssl_peer_key,
+                             struct Curl_ssl_session *s);
+
+/* Take a matching scache session from the cache. Does NOT need locking.
+ * @param cf      the connection filter wanting to use it
+ * @param data    the transfer involved
+ * @param ssl_peer_key the key for lookup
+ * @param s       on return, the scache session object or NULL
+ */
+CURLcode Curl_ssl_scache_take(struct Curl_cfilter *cf,
+                              struct Curl_easy *data,
+                              const char *ssl_peer_key,
+                              struct Curl_ssl_session **ps);
+
+/* Return a taken scache session to the cache. Does NOT need locking.
+ * Depending on TLS version and other criteria, it may cache it again
+ * or destroy it. Maybe called with a NULL session.
+ */
+void Curl_ssl_scache_return(struct Curl_cfilter *cf,
+                            struct Curl_easy *data,
+                            const char *ssl_peer_key,
+                            struct Curl_ssl_session *s);
+
+/* Remove all sessions and obj for the peer_key. Does NOT need locking. */
+void Curl_ssl_scache_remove_all(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                const char *ssl_peer_key);
+
+#ifdef USE_SSLS_EXPORT
+
+bool Curl_ssl_scache_is_locked(struct Curl_easy *data);
+
+CURLcode Curl_ssl_session_import(struct Curl_easy *data,
+                                 const char *ssl_peer_key,
+                                 const unsigned char *shmac, size_t shmac_len,
+                                 const void *sdata, size_t sdata_len);
+
+CURLcode Curl_ssl_session_export(struct Curl_easy *data,
+                                 curl_ssls_export_cb *export_fn,
+                                 void *userptr);
+
+#endif /* USE_SSLS_EXPORT */
+#endif /* USE_SSL */
+
+#endif /* HEADER_CURL_VTLS_SCACHE_H */
diff --git a/third-party/curl/lib/vtls/vtls_spack.c b/third-party/curl/lib/vtls/vtls_spack.c
new file mode 100644
index 0000000000..9cbdecc901
--- /dev/null
+++ b/third-party/curl/lib/vtls/vtls_spack.c
@@ -0,0 +1,322 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#if defined(USE_SSL) && defined(USE_SSLS_EXPORT)
+
+#include "urldata.h"
+#include "curl_trc.h"
+#include "vtls/vtls_scache.h"
+#include "vtls/vtls_spack.h"
+#include "curlx/strdup.h"
+
+#define CURL_SPACK_VERSION       0x01
+#define CURL_SPACK_IETF_ID       0x02
+#define CURL_SPACK_VALID_UNTIL   0x03
+#define CURL_SPACK_TICKET        0x04
+#define CURL_SPACK_ALPN          0x05
+#define CURL_SPACK_EARLYDATA     0x06
+#define CURL_SPACK_QUICTP        0x07
+
+static CURLcode spack_enc8(struct dynbuf *buf, uint8_t b)
+{
+  return curlx_dyn_addn(buf, &b, 1);
+}
+
+static CURLcode spack_dec8(uint8_t *val, const uint8_t **src,
+                           const uint8_t *end)
+{
+  if(end - *src < 1)
+    return CURLE_READ_ERROR;
+  *val = **src;
+  *src += 1;
+  return CURLE_OK;
+}
+
+static CURLcode spack_enc16(struct dynbuf *buf, uint16_t val)
+{
+  uint8_t nval[2];
+  nval[0] = (uint8_t)(val >> 8);
+  nval[1] = (uint8_t)val;
+  return curlx_dyn_addn(buf, nval, sizeof(nval));
+}
+
+static CURLcode spack_dec16(uint16_t *val, const uint8_t **src,
+                            const uint8_t *end)
+{
+  if(end - *src < 2)
+    return CURLE_READ_ERROR;
+  *val = (uint16_t)((*src)[0] << 8 | (*src)[1]);
+  *src += 2;
+  return CURLE_OK;
+}
+
+static CURLcode spack_enc32(struct dynbuf *buf, uint32_t val)
+{
+  uint8_t nval[4];
+  nval[0] = (uint8_t)(val >> 24);
+  nval[1] = (uint8_t)(val >> 16);
+  nval[2] = (uint8_t)(val >> 8);
+  nval[3] = (uint8_t)val;
+  return curlx_dyn_addn(buf, nval, sizeof(nval));
+}
+
+static CURLcode spack_dec32(uint32_t *val, const uint8_t **src,
+                            const uint8_t *end)
+{
+  if(end - *src < 4)
+    return CURLE_READ_ERROR;
+  *val = (uint32_t)(*src)[0] << 24 | (uint32_t)(*src)[1] << 16 |
+         (uint32_t)(*src)[2] << 8 | (*src)[3];
+  *src += 4;
+  return CURLE_OK;
+}
+
+static CURLcode spack_enc64(struct dynbuf *buf, uint64_t val)
+{
+  uint8_t nval[8];
+  nval[0] = (uint8_t)(val >> 56);
+  nval[1] = (uint8_t)(val >> 48);
+  nval[2] = (uint8_t)(val >> 40);
+  nval[3] = (uint8_t)(val >> 32);
+  nval[4] = (uint8_t)(val >> 24);
+  nval[5] = (uint8_t)(val >> 16);
+  nval[6] = (uint8_t)(val >> 8);
+  nval[7] = (uint8_t)val;
+  return curlx_dyn_addn(buf, nval, sizeof(nval));
+}
+
+static CURLcode spack_dec64(uint64_t *val, const uint8_t **src,
+                            const uint8_t *end)
+{
+  if(end - *src < 8)
+    return CURLE_READ_ERROR;
+  *val = (uint64_t)(*src)[0] << 56 | (uint64_t)(*src)[1] << 48 |
+         (uint64_t)(*src)[2] << 40 | (uint64_t)(*src)[3] << 32 |
+         (uint64_t)(*src)[4] << 24 | (uint64_t)(*src)[5] << 16 |
+         (uint64_t)(*src)[6] << 8 | (*src)[7];
+  *src += 8;
+  return CURLE_OK;
+}
+
+static CURLcode spack_encstr16(struct dynbuf *buf, const char *s)
+{
+  size_t slen = strlen(s);
+  CURLcode result;
+  if(slen > UINT16_MAX)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  result = spack_enc16(buf, (uint16_t)slen);
+  if(!result) {
+    result = curlx_dyn_addn(buf, s, slen);
+  }
+  return result;
+}
+
+static CURLcode spack_decstr16(char **val, const uint8_t **src,
+                               const uint8_t *end)
+{
+  uint16_t slen;
+  CURLcode result;
+
+  *val = NULL;
+  result = spack_dec16(&slen, src, end);
+  if(result)
+    return result;
+  if(end - *src < slen)
+    return CURLE_READ_ERROR;
+  *val = curlx_memdup0((const char *)(*src), slen);
+  *src += slen;
+  return *val ? CURLE_OK : CURLE_OUT_OF_MEMORY;
+}
+
+static CURLcode spack_encdata16(struct dynbuf *buf, const uint8_t *data,
+                                size_t data_len)
+{
+  CURLcode result;
+  if(data_len > UINT16_MAX)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  result = spack_enc16(buf, (uint16_t)data_len);
+  if(!result) {
+    result = curlx_dyn_addn(buf, data, data_len);
+  }
+  return result;
+}
+
+static CURLcode spack_decdata16(uint8_t **val, size_t *val_len,
+                                const uint8_t **src, const uint8_t *end)
+{
+  uint16_t data_len;
+  CURLcode result;
+
+  *val = NULL;
+  result = spack_dec16(&data_len, src, end);
+  if(result)
+    return result;
+  if(end - *src < data_len)
+    return CURLE_READ_ERROR;
+  *val = curlx_memdup0((const char *)(*src), data_len);
+  *val_len = data_len;
+  *src += data_len;
+  return *val ? CURLE_OK : CURLE_OUT_OF_MEMORY;
+}
+
+CURLcode Curl_ssl_session_pack(struct Curl_easy *data,
+                               struct Curl_ssl_session *s,
+                               struct dynbuf *buf)
+{
+  CURLcode result;
+  DEBUGASSERT(s->sdata);
+  DEBUGASSERT(s->sdata_len);
+
+  if(s->valid_until < 0)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  result = spack_enc8(buf, CURL_SPACK_VERSION);
+  if(!result)
+    result = spack_enc8(buf, CURL_SPACK_TICKET);
+  if(!result)
+    result = spack_encdata16(buf, s->sdata, s->sdata_len);
+  if(!result)
+    result = spack_enc8(buf, CURL_SPACK_IETF_ID);
+  if(!result)
+    result = spack_enc16(buf, (uint16_t)s->ietf_tls_id);
+  if(!result)
+    result = spack_enc8(buf, CURL_SPACK_VALID_UNTIL);
+  if(!result)
+    result = spack_enc64(buf, (uint64_t)s->valid_until);
+  if(!result && s->alpn) {
+    result = spack_enc8(buf, CURL_SPACK_ALPN);
+    if(!result)
+      result = spack_encstr16(buf, s->alpn);
+  }
+  if(!result && s->earlydata_max) {
+    if(s->earlydata_max > UINT32_MAX)
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+    if(!result)
+      result = spack_enc8(buf, CURL_SPACK_EARLYDATA);
+    if(!result)
+      result = spack_enc32(buf, (uint32_t)s->earlydata_max);
+  }
+  if(!result && s->quic_tp && s->quic_tp_len) {
+    result = spack_enc8(buf, CURL_SPACK_QUICTP);
+    if(!result)
+      result = spack_encdata16(buf, s->quic_tp, s->quic_tp_len);
+  }
+
+  if(result)
+    CURL_TRC_SSLS(data, "error packing data: %d", (int)result);
+  return result;
+}
+
+CURLcode Curl_ssl_session_unpack(struct Curl_easy *data,
+                                 const void *bufv, size_t buflen,
+                                 struct Curl_ssl_session **ps)
+{
+  struct Curl_ssl_session *s = NULL;
+  const unsigned char *buf = (const unsigned char *)bufv;
+  const unsigned char *end = buf + buflen;
+  uint8_t val8, *pval8;
+  uint16_t val16;
+  uint32_t val32;
+  uint64_t val64;
+  CURLcode result;
+
+  DEBUGASSERT(buf);
+  DEBUGASSERT(buflen);
+  *ps = NULL;
+
+  result = spack_dec8(&val8, &buf, end);
+  if(result)
+    goto out;
+  if(val8 != CURL_SPACK_VERSION) {
+    result = CURLE_READ_ERROR;
+    goto out;
+  }
+
+  s = curlx_calloc(1, sizeof(*s));
+  if(!s) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  while(buf < end) {
+    result = spack_dec8(&val8, &buf, end);
+    if(result)
+      goto out;
+
+    switch(val8) {
+    case CURL_SPACK_ALPN:
+      result = spack_decstr16(&s->alpn, &buf, end);
+      if(result)
+        goto out;
+      break;
+    case CURL_SPACK_EARLYDATA:
+      result = spack_dec32(&val32, &buf, end);
+      if(result)
+        goto out;
+      s->earlydata_max = val32;
+      break;
+    case CURL_SPACK_IETF_ID:
+      result = spack_dec16(&val16, &buf, end);
+      if(result)
+        goto out;
+      s->ietf_tls_id = val16;
+      break;
+    case CURL_SPACK_QUICTP: {
+      result = spack_decdata16(&pval8, &s->quic_tp_len, &buf, end);
+      if(result)
+        goto out;
+      s->quic_tp = pval8;
+      break;
+    }
+    case CURL_SPACK_TICKET: {
+      result = spack_decdata16(&pval8, &s->sdata_len, &buf, end);
+      if(result)
+        goto out;
+      s->sdata = pval8;
+      break;
+    }
+    case CURL_SPACK_VALID_UNTIL:
+      result = spack_dec64(&val64, &buf, end);
+      if(result)
+        goto out;
+      s->valid_until = (curl_off_t)val64;
+      break;
+    default:  /* unknown tag */
+      result = CURLE_READ_ERROR;
+      goto out;
+    }
+  }
+
+out:
+  if(result) {
+    CURL_TRC_SSLS(data, "error unpacking data: %d", (int)result);
+    Curl_ssl_session_destroy(s);
+  }
+  else
+    *ps = s;
+  return result;
+}
+
+#endif /* USE_SSL && USE_SSLS_EXPORT */
diff --git a/third-party/curl/lib/vtls/vtls_spack.h b/third-party/curl/lib/vtls/vtls_spack.h
new file mode 100644
index 0000000000..4479384de9
--- /dev/null
+++ b/third-party/curl/lib/vtls/vtls_spack.h
@@ -0,0 +1,43 @@
+#ifndef HEADER_CURL_VTLS_SPACK_H
+#define HEADER_CURL_VTLS_SPACK_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#if defined(USE_SSL) && defined(USE_SSLS_EXPORT)
+
+struct dynbuf;
+struct Curl_ssl_session;
+
+CURLcode Curl_ssl_session_pack(struct Curl_easy *data,
+                               struct Curl_ssl_session *s,
+                               struct dynbuf *buf);
+
+CURLcode Curl_ssl_session_unpack(struct Curl_easy *data,
+                                 const void *bufv, size_t buflen,
+                                 struct Curl_ssl_session **ps);
+
+#endif /* USE_SSL && USE_SSLS_EXPORT */
+
+#endif /* HEADER_CURL_VTLS_SPACK_H */
diff --git a/third-party/curl/lib/vtls/wolfssl.c b/third-party/curl/lib/vtls/wolfssl.c
index 5f15720742..92eaa7a751 100644
--- a/third-party/curl/lib/vtls/wolfssl.c
+++ b/third-party/curl/lib/vtls/wolfssl.c
@@ -21,20 +21,24 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 /*
  * Source file for all wolfSSL specific code for the TLS/SSL layer. No code
  * but vtls.c should ever call or use these functions.
  *
  */
-
 #include "curl_setup.h"
 
 #ifdef USE_WOLFSSL
 
-#define WOLFSSL_OPTIONS_IGNORE_SYS
-#include <wolfssl/version.h>
 #include <wolfssl/options.h>
+#include <wolfssl/version.h>
+
+#if LIBWOLFSSL_VERSION_HEX < 0x05000000 /* wolfSSL 5.0.0 (2021-11-01) */
+#error "wolfSSL version should be at least 5.0.0"
+#endif
+#if defined(OPENSSL_COEXIST) && LIBWOLFSSL_VERSION_HEX < 0x05007006
+#error "wolfSSL 5.7.6 or newer is required to coexist with OpenSSL"
+#endif
 
 /* To determine what functions are available we rely on one or both of:
    - the user's options.h generated by wolfSSL
@@ -49,30 +53,27 @@
 #endif
 #endif
 
-#include <limits.h>
-
 #include "urldata.h"
-#include "sendf.h"
-#include "inet_pton.h"
-#include "vtls.h"
-#include "vtls_int.h"
-#include "keylog.h"
-#include "parsedate.h"
+#include "curl_trc.h"
+#include "httpsrr.h"
+#include "cf-dns.h"
+#include "vtls/vtls.h"
+#include "vtls/vtls_int.h"
+#include "vtls/vtls_scache.h"
+#include "vtls/keylog.h"
 #include "connect.h" /* for the connect timeout */
-#include "select.h"
-#include "strcase.h"
-#include "x509asn1.h"
-#include "curl_printf.h"
-#include "multiif.h"
+#include "progress.h"
+#include "curlx/strdup.h"
+#include "curlx/strcopy.h"
+#include "vtls/x509asn1.h"
+#ifdef USE_ECH
+#include "curlx/base64.h"
+#endif
 
-#include <wolfssl/openssl/ssl.h>
 #include <wolfssl/ssl.h>
 #include <wolfssl/error-ssl.h>
-#include "wolfssl.h"
 
-/* The last #include files should be: */
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "vtls/wolfssl.h"
 
 /* KEEP_PEER_CERT is a product of the presence of build time symbol
    OPENSSL_EXTRA without NO_CERTS, depending on the version. KEEP_PEER_CERT is
@@ -80,37 +81,47 @@
    options.h. */
 #ifndef KEEP_PEER_CERT
 #if defined(HAVE_WOLFSSL_GET_PEER_CERTIFICATE) || \
-    (defined(OPENSSL_EXTRA) && !defined(NO_CERTS))
+  (defined(OPENSSL_EXTRA) && !defined(NO_CERTS))
 #define KEEP_PEER_CERT
 #endif
 #endif
 
-#if defined(HAVE_WOLFSSL_FULL_BIO) && HAVE_WOLFSSL_FULL_BIO
+#ifdef HAVE_WOLFSSL_BIO_NEW
 #define USE_BIO_CHAIN
-#else
+#ifdef HAVE_WOLFSSL_BIO_SET_SHUTDOWN
+#define USE_FULL_BIO
+#else /* HAVE_WOLFSSL_BIO_SET_SHUTDOWN */
+#undef USE_FULL_BIO
+#endif
+/* wolfSSL 5.7.4 and older do not have these symbols, but only the
+ * OpenSSL ones. */
+#ifndef WOLFSSL_BIO_CTRL_GET_CLOSE
+#define WOLFSSL_BIO_CTRL_GET_CLOSE    BIO_CTRL_GET_CLOSE
+#define WOLFSSL_BIO_CTRL_SET_CLOSE    BIO_CTRL_SET_CLOSE
+#define WOLFSSL_BIO_CTRL_FLUSH        BIO_CTRL_FLUSH
+#define WOLFSSL_BIO_CTRL_DUP          BIO_CTRL_DUP
+#define wolfSSL_BIO_set_retry_write   BIO_set_retry_write
+#define wolfSSL_BIO_set_retry_read    BIO_set_retry_read
+#endif /* !WOLFSSL_BIO_CTRL_GET_CLOSE */
+
+#else /* HAVE_WOLFSSL_BIO_NEW */
 #undef USE_BIO_CHAIN
 #endif
 
-struct wolfssl_ssl_backend_data {
-  WOLFSSL_CTX *ctx;
-  WOLFSSL     *handle;
-  CURLcode    io_result;   /* result of last BIO cfilter operation */
-};
-
 #ifdef OPENSSL_EXTRA
 /*
  * Availability note:
  * The TLS 1.3 secret callback (wolfSSL_set_tls13_secret_cb) was added in
- * WolfSSL 4.4.0, but requires the -DHAVE_SECRET_CALLBACK build option. If that
- * option is not set, then TLS 1.3 will not be logged.
+ * wolfSSL 4.4.0, but requires the -DHAVE_SECRET_CALLBACK build option. If that
+ * option is not set, then TLS 1.3 is not logged.
  * For TLS 1.2 and before, we use wolfSSL_get_keys().
- * SSL_get_client_random and wolfSSL_get_keys require OPENSSL_EXTRA
+ * wolfSSL_get_client_random and wolfSSL_get_keys require OPENSSL_EXTRA
  * (--enable-opensslextra or --enable-all).
  */
 #if defined(HAVE_SECRET_CALLBACK) && defined(WOLFSSL_TLS13)
-static int
-wolfssl_tls13_secret_callback(SSL *ssl, int id, const unsigned char *secret,
-                              int secretSz, void *ctx)
+static int wssl_tls13_secret_callback(SSL *ssl, int id,
+                                      const unsigned char *secret,
+                                      int secretSz, void *ctx)
 {
   const char *label;
   unsigned char client_random[SSL3_RANDOM_SIZE];
@@ -146,7 +157,7 @@ wolfssl_tls13_secret_callback(SSL *ssl, int id, const unsigned char *secret,
     return 0;
   }
 
-  if(SSL_get_client_random(ssl, client_random, SSL3_RANDOM_SIZE) == 0) {
+  if(wolfSSL_get_client_random(ssl, client_random, SSL3_RANDOM_SIZE) == 0) {
     /* Should never happen as wolfSSL_KeepArrays() was called before. */
     return 0;
   }
@@ -154,15 +165,13 @@ wolfssl_tls13_secret_callback(SSL *ssl, int id, const unsigned char *secret,
   Curl_tls_keylog_write(label, client_random, secret, secretSz);
   return 0;
 }
-#endif /* defined(HAVE_SECRET_CALLBACK) && defined(WOLFSSL_TLS13) */
+#endif /* HAVE_SECRET_CALLBACK && WOLFSSL_TLS13 */
 
-static void
-wolfssl_log_tls12_secret(SSL *ssl)
+static void wssl_log_tls12_secret(WOLFSSL *ssl)
 {
   unsigned char *ms, *sr, *cr;
   unsigned int msLen, srLen, crLen, i, x = 0;
 
-#if LIBWOLFSSL_VERSION_HEX >= 0x0300d000 /* >= 3.13.0 */
   /* wolfSSL_GetVersion is available since 3.13, we use it instead of
    * SSL_version since the latter relies on OPENSSL_ALL (--enable-opensslall or
    * --enable-all). Failing to perform this check could result in an unusable
@@ -178,10 +187,9 @@ wolfssl_log_tls12_secret(SSL *ssl)
      * is not directly usable. */
     return;
   }
-#endif
 
   if(wolfSSL_get_keys(ssl, &ms, &msLen, &sr, &srLen, &cr, &crLen) !=
-     SSL_SUCCESS) {
+     WOLFSSL_SUCCESS) {
     return;
   }
 
@@ -199,77 +207,70 @@ wolfssl_log_tls12_secret(SSL *ssl)
 }
 #endif /* OPENSSL_EXTRA */
 
-static int do_file_type(const char *type)
+static int wssl_do_file_type(const char *type)
 {
   if(!type || !type[0])
-    return SSL_FILETYPE_PEM;
-  if(strcasecompare(type, "PEM"))
-    return SSL_FILETYPE_PEM;
-  if(strcasecompare(type, "DER"))
-    return SSL_FILETYPE_ASN1;
+    return WOLFSSL_FILETYPE_PEM;
+  if(curl_strequal(type, "PEM"))
+    return WOLFSSL_FILETYPE_PEM;
+  if(curl_strequal(type, "DER"))
+    return WOLFSSL_FILETYPE_ASN1;
   return -1;
 }
 
-#ifdef HAVE_LIBOQS
-struct group_name_map {
-  const word16 group;
-  const char   *name;
-};
-
-static const struct group_name_map gnm[] = {
-  { WOLFSSL_KYBER_LEVEL1, "KYBER_LEVEL1" },
-  { WOLFSSL_KYBER_LEVEL3, "KYBER_LEVEL3" },
-  { WOLFSSL_KYBER_LEVEL5, "KYBER_LEVEL5" },
-  { WOLFSSL_P256_KYBER_LEVEL1, "P256_KYBER_LEVEL1" },
-  { WOLFSSL_P384_KYBER_LEVEL3, "P384_KYBER_LEVEL3" },
-  { WOLFSSL_P521_KYBER_LEVEL5, "P521_KYBER_LEVEL5" },
-  { 0, NULL }
-};
-#endif
-
 #ifdef USE_BIO_CHAIN
 
-static int bio_cf_create(WOLFSSL_BIO *bio)
+static int wssl_bio_cf_create(WOLFSSL_BIO *bio)
 {
+#ifdef USE_FULL_BIO
   wolfSSL_BIO_set_shutdown(bio, 1);
-  wolfSSL_BIO_set_init(bio, 1);
+#endif
   wolfSSL_BIO_set_data(bio, NULL);
   return 1;
 }
 
-static int bio_cf_destroy(WOLFSSL_BIO *bio)
+static int wssl_bio_cf_destroy(WOLFSSL_BIO *bio)
 {
   if(!bio)
     return 0;
   return 1;
 }
 
-static long bio_cf_ctrl(WOLFSSL_BIO *bio, int cmd, long num, void *ptr)
+static long wssl_bio_cf_ctrl(WOLFSSL_BIO *bio, int cmd, long num, void *ptr)
 {
-  struct Curl_cfilter *cf = BIO_get_data(bio);
+  struct Curl_cfilter *cf = wolfSSL_BIO_get_data(bio);
   long ret = 1;
 
   (void)cf;
   (void)ptr;
+  (void)num;
   switch(cmd) {
-  case BIO_CTRL_GET_CLOSE:
+  case WOLFSSL_BIO_CTRL_GET_CLOSE:
+#ifdef USE_FULL_BIO
     ret = (long)wolfSSL_BIO_get_shutdown(bio);
+#else
+    ret = 0;
+#endif
     break;
-  case BIO_CTRL_SET_CLOSE:
+  case WOLFSSL_BIO_CTRL_SET_CLOSE:
+#ifdef USE_FULL_BIO
     wolfSSL_BIO_set_shutdown(bio, (int)num);
+#endif
     break;
-  case BIO_CTRL_FLUSH:
+  case WOLFSSL_BIO_CTRL_FLUSH:
     /* we do no delayed writes, but if we ever would, this
      * needs to trigger it. */
     ret = 1;
     break;
-  case BIO_CTRL_DUP:
+  case WOLFSSL_BIO_CTRL_DUP:
     ret = 1;
     break;
-#ifdef BIO_CTRL_EOF
-  case BIO_CTRL_EOF:
+#ifdef WOLFSSL_BIO_CTRL_EOF
+  case WOLFSSL_BIO_CTRL_EOF: {
     /* EOF has been reached on input? */
-    return (!cf->next || !cf->next->connected);
+    struct ssl_connect_data *connssl = cf->ctx;
+    return connssl->peer_closed;
+  }
 #endif
   default:
     ret = 0;
@@ -278,494 +279,1399 @@ static long bio_cf_ctrl(WOLFSSL_BIO *bio, int cmd, long num, void *ptr)
   return ret;
 }
 
-static int bio_cf_out_write(WOLFSSL_BIO *bio, const char *buf, int blen)
+static int wssl_bio_cf_out_write(WOLFSSL_BIO *bio, const char *buf, int blen)
 {
   struct Curl_cfilter *cf = wolfSSL_BIO_get_data(bio);
   struct ssl_connect_data *connssl = cf->ctx;
-  struct wolfssl_ssl_backend_data *backend =
-    (struct wolfssl_ssl_backend_data *)connssl->backend;
+  struct wssl_ctx *wssl = (struct wssl_ctx *)connssl->backend;
   struct Curl_easy *data = CF_DATA_CURRENT(cf);
-  ssize_t nwritten;
+  size_t nwritten, skiplen = 0;
   CURLcode result = CURLE_OK;
 
   DEBUGASSERT(data);
-  nwritten = Curl_conn_cf_send(cf->next, data, buf, blen, &result);
-  backend->io_result = result;
-  CURL_TRC_CF(data, cf, "bio_write(len=%d) -> %zd, %d",
-              blen, nwritten, result);
+  if(wssl->shutting_down && wssl->io_send_blocked_len &&
+     (wssl->io_send_blocked_len < blen)) {
+    /* bug in wolfSSL: <https://github.com/wolfSSL/wolfssl/issues/7784>
+     * It adds the close notify message again every time we retry
+     * sending during shutdown. */
+    CURL_TRC_CF(data, cf, "bio_write, shutdown restrict send of %d"
+                " to %d bytes", blen, wssl->io_send_blocked_len);
+    skiplen = (size_t)(blen - wssl->io_send_blocked_len);
+    blen = wssl->io_send_blocked_len;
+  }
+  result = Curl_conn_cf_send(cf->next, data,
+                             (const uint8_t *)buf, blen, FALSE, &nwritten);
+  wssl->io_result = result;
+  CURL_TRC_CF(data, cf, "bio_write(len=%d) -> %d, %zu",
+              blen, (int)result, nwritten);
+#ifdef USE_FULL_BIO
   wolfSSL_BIO_clear_retry_flags(bio);
-  if(nwritten < 0 && CURLE_AGAIN == result)
-    BIO_set_retry_write(bio);
-  return (int)nwritten;
+#endif
+  if(result == CURLE_AGAIN) {
+    wolfSSL_BIO_set_retry_write(bio);
+    if(wssl->shutting_down && !wssl->io_send_blocked_len)
+      wssl->io_send_blocked_len = blen;
+  }
+  else if(!result && skiplen)
+    nwritten += skiplen;
+  return result ? -1 : (int)nwritten;
 }
 
-static int bio_cf_in_read(WOLFSSL_BIO *bio, char *buf, int blen)
+static int wssl_bio_cf_in_read(WOLFSSL_BIO *bio, char *buf, int blen)
 {
   struct Curl_cfilter *cf = wolfSSL_BIO_get_data(bio);
   struct ssl_connect_data *connssl = cf->ctx;
-  struct wolfssl_ssl_backend_data *backend =
-    (struct wolfssl_ssl_backend_data *)connssl->backend;
+  struct wssl_ctx *wssl = (struct wssl_ctx *)connssl->backend;
   struct Curl_easy *data = CF_DATA_CURRENT(cf);
-  ssize_t nread;
+  size_t nread = 0;
   CURLcode result = CURLE_OK;
 
   DEBUGASSERT(data);
-  /* OpenSSL catches this case, so should we. */
-  if(!buf)
+  if(!data || (blen < 0)) {
+    wssl->io_result = CURLE_FAILED_INIT;
+    return -1;
+  }
+  if(!buf || !blen)
     return 0;
 
-  nread = Curl_conn_cf_recv(cf->next, data, buf, blen, &result);
-  backend->io_result = result;
-  CURL_TRC_CF(data, cf, "bio_read(len=%d) -> %zd, %d", blen, nread, result);
+  if((connssl->connecting_state == ssl_connect_2) &&
+     !wssl->x509_store_setup) {
+    /* During handshake, init the x509 store before receiving the
+     * server response. This allows sending of ClientHello without delay. */
+    result = Curl_wssl_setup_x509_store(cf, data, wssl);
+    if(result) {
+      CURL_TRC_CF(data, cf, "Curl_wssl_setup_x509_store() -> %d", (int)result);
+      wssl->io_result = result;
+      return -1;
+    }
+  }
+
+  result = Curl_conn_cf_recv(cf->next, data, buf, blen, &nread);
+  wssl->io_result = result;
+  CURL_TRC_CF(data, cf, "bio_read(len=%d) -> %d, %zu", blen, (int)result,
+              nread);
+#ifdef USE_FULL_BIO
   wolfSSL_BIO_clear_retry_flags(bio);
-  if(nread < 0 && CURLE_AGAIN == result)
-    BIO_set_retry_read(bio);
-  return (int)nread;
+#endif
+  if(result == CURLE_AGAIN)
+    wolfSSL_BIO_set_retry_read(bio);
+  else if(nread == 0)
+    connssl->peer_closed = TRUE;
+  return result ? -1 : (int)nread;
 }
 
-static WOLFSSL_BIO_METHOD *bio_cf_method = NULL;
+static WOLFSSL_BIO_METHOD *wssl_bio_cf_method = NULL;
 
-static void bio_cf_init_methods(void)
+static int wssl_bio_cf_init_methods(void)
 {
-  bio_cf_method = wolfSSL_BIO_meth_new(BIO_TYPE_MEM, "wolfSSL CF BIO");
-  wolfSSL_BIO_meth_set_write(bio_cf_method, &bio_cf_out_write);
-  wolfSSL_BIO_meth_set_read(bio_cf_method, &bio_cf_in_read);
-  wolfSSL_BIO_meth_set_ctrl(bio_cf_method, &bio_cf_ctrl);
-  wolfSSL_BIO_meth_set_create(bio_cf_method, &bio_cf_create);
-  wolfSSL_BIO_meth_set_destroy(bio_cf_method, &bio_cf_destroy);
+  wssl_bio_cf_method = wolfSSL_BIO_meth_new(WOLFSSL_BIO_MEMORY,
+                                            "wolfSSL CF BIO");
+  if(!wssl_bio_cf_method)
+    return FALSE; /* error */
+  wolfSSL_BIO_meth_set_write(wssl_bio_cf_method, &wssl_bio_cf_out_write);
+  wolfSSL_BIO_meth_set_read(wssl_bio_cf_method, &wssl_bio_cf_in_read);
+  wolfSSL_BIO_meth_set_ctrl(wssl_bio_cf_method, &wssl_bio_cf_ctrl);
+  wolfSSL_BIO_meth_set_create(wssl_bio_cf_method, &wssl_bio_cf_create);
+  wolfSSL_BIO_meth_set_destroy(wssl_bio_cf_method, &wssl_bio_cf_destroy);
+  return TRUE; /* fine */
 }
 
-static void bio_cf_free_methods(void)
+static void wssl_bio_cf_free_methods(void)
 {
-  wolfSSL_BIO_meth_free(bio_cf_method);
+  wolfSSL_BIO_meth_free(wssl_bio_cf_method);
+  wssl_bio_cf_method = NULL;
 }
 
 #else /* USE_BIO_CHAIN */
 
-#define bio_cf_init_methods() Curl_nop_stmt
-#define bio_cf_free_methods() Curl_nop_stmt
+#define wssl_bio_cf_init_methods() TRUE
+#define wssl_bio_cf_free_methods() Curl_nop_stmt
 
 #endif /* !USE_BIO_CHAIN */
 
-/*
- * This function loads all the client/CA certificates and CRLs. Setup the TLS
- * layer and do all necessary magic.
- */
-static CURLcode
-wolfssl_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
+#ifdef HAVE_EX_DATA
+CURLcode Curl_wssl_cache_session(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 const char *ssl_peer_key,
+                                 WOLFSSL_SESSION *session,
+                                 int ietf_tls_id,
+                                 const char *alpn,
+                                 unsigned char *quic_tp,
+                                 size_t quic_tp_len)
+{
+  CURLcode result = CURLE_OK;
+  struct Curl_ssl_session *sc_session = NULL;
+  unsigned char *sdata = NULL, *sdata_ptr, *qtp_clone = NULL;
+  unsigned int sdata_len;
+  unsigned int earlydata_max = 0;
+
+  if(!session)
+    goto out;
+
+  sdata_len = wolfSSL_i2d_SSL_SESSION(session, NULL);
+  if(sdata_len <= 0) {
+    CURL_TRC_CF(data, cf, "fail to assess session length: %u", sdata_len);
+    result = CURLE_FAILED_INIT;
+    goto out;
+  }
+  sdata = sdata_ptr = curlx_calloc(1, sdata_len);
+  if(!sdata) {
+    failf(data, "unable to allocate session buffer of %u bytes", sdata_len);
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+  /* wolfSSL right now does not change the last parameter here, but it
+   * might one day decide to do so for OpenSSL compatibility. */
+  sdata_len = wolfSSL_i2d_SSL_SESSION(session, &sdata_ptr);
+  if(sdata_len <= 0) {
+    CURL_TRC_CF(data, cf, "fail to serialize session: %u", sdata_len);
+    result = CURLE_FAILED_INIT;
+    goto out;
+  }
+  if(quic_tp && quic_tp_len) {
+    qtp_clone = curlx_memdup0((const char *)quic_tp, quic_tp_len);
+    if(!qtp_clone) {
+      curlx_free(sdata);
+      return CURLE_OUT_OF_MEMORY;
+    }
+  }
+#ifdef WOLFSSL_EARLY_DATA
+  earlydata_max = wolfSSL_SESSION_get_max_early_data(session);
+#endif
+
+  result = Curl_ssl_session_create2(sdata, sdata_len,
+                                    ietf_tls_id, alpn,
+                                    (curl_off_t)time(NULL) +
+                                    wolfSSL_SESSION_get_timeout(session),
+                                    earlydata_max, qtp_clone, quic_tp_len,
+                                    &sc_session);
+  sdata = NULL;  /* took ownership of sdata */
+  if(!result) {
+    result = Curl_ssl_scache_put(cf, data, ssl_peer_key, sc_session);
+    /* took ownership of `sc_session` */
+  }
+
+out:
+  curlx_free(sdata);
+  return result;
+}
+
+static int wssl_vtls_new_session_cb(WOLFSSL *ssl, WOLFSSL_SESSION *session)
+{
+  struct Curl_cfilter *cf;
+
+  cf = (struct Curl_cfilter *)wolfSSL_get_app_data(ssl);
+  DEBUGASSERT(cf);
+  if(cf && session) {
+    struct ssl_connect_data *connssl = cf->ctx;
+    struct Curl_easy *data = CF_DATA_CURRENT(cf);
+    DEBUGASSERT(connssl);
+    DEBUGASSERT(data);
+    if(connssl && data) {
+      (void)Curl_wssl_cache_session(cf, data, connssl->peer.scache_key,
+                                    session, wolfSSL_version(ssl),
+                                    connssl->negotiated.alpn, NULL, 0);
+    }
+  }
+  return 0;
+}
+#endif
+
+static CURLcode wssl_on_session_reuse(struct Curl_cfilter *cf,
+                                      struct Curl_easy *data,
+                                      struct alpn_spec *alpns,
+                                      struct Curl_ssl_session *scs,
+                                      bool *do_early_data)
 {
-  char *ciphers, *curves;
   struct ssl_connect_data *connssl = cf->ctx;
-  struct wolfssl_ssl_backend_data *backend =
-    (struct wolfssl_ssl_backend_data *)connssl->backend;
+#ifdef WOLFSSL_EARLY_DATA
+  struct wssl_ctx *wssl = (struct wssl_ctx *)connssl->backend;
+
+  connssl->earlydata_max = wolfSSL_SESSION_get_max_early_data(
+    wolfSSL_get_session(wssl->ssl));
+#else
+  connssl->earlydata_max = 0;
+#endif
+
+  /* Seems to be no wolfSSL way to signal no EarlyData in session */
+  return Curl_on_session_reuse(cf, data, alpns, scs, do_early_data,
+                               connssl->earlydata_max);
+}
+
+static CURLcode wssl_setup_session(
+  struct Curl_cfilter *cf,
+  struct Curl_easy *data,
+  struct wssl_ctx *wss,
+  struct alpn_spec *alpns,
+  const char *ssl_peer_key,
+  Curl_wssl_init_session_reuse_cb *sess_reuse_cb)
+{
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+  struct Curl_ssl_session *scs = NULL;
+  CURLcode result;
+
+  result = Curl_ssl_scache_take(cf, data, ssl_peer_key, &scs);
+  if(!result && scs && scs->sdata && scs->sdata_len &&
+     (!scs->alpn || Curl_alpn_contains_proto(alpns, scs->alpn))) {
+    WOLFSSL_SESSION *session;
+    /* wolfSSL changes the passed pointer for whatever reasons, yikes */
+    const unsigned char *sdata = scs->sdata;
+    session = wolfSSL_d2i_SSL_SESSION(NULL, &sdata, (long)scs->sdata_len);
+    if(session) {
+      int ret = wolfSSL_set_session(wss->ssl, session);
+      if(ret != WOLFSSL_SUCCESS) {
+        Curl_ssl_session_destroy(scs);
+        scs = NULL;
+        infof(data, "cached session not accepted (%d), "
+              "removing from cache", ret);
+      }
+      else {
+        infof(data, "SSL reusing session with ALPN '%s'",
+              scs->alpn ? scs->alpn : "-");
+        if(ssl_config->earlydata &&
+           !cf->conn->bits.connect_only &&
+           !strcmp("TLSv1.3", wolfSSL_get_version(wss->ssl))) {
+          bool do_early_data = FALSE;
+          if(sess_reuse_cb) {
+            result = sess_reuse_cb(cf, data, alpns, scs, &do_early_data);
+            if(result) {
+              wolfSSL_SESSION_free(session);
+              goto out;
+            }
+          }
+#ifdef WOLFSSL_EARLY_DATA
+          if(do_early_data) {
+            unsigned int edmax = (scs->earlydata_max < UINT_MAX) ?
+              (unsigned int)scs->earlydata_max : UINT_MAX;
+            /* We only try the ALPN protocol the session used before,
+             * otherwise we might send early data for the wrong protocol */
+            Curl_alpn_restrict_to(alpns, scs->alpn);
+            wolfSSL_set_max_early_data(wss->ssl, edmax);
+          }
+#else
+          /* Should never enable when not supported */
+          DEBUGASSERT(!do_early_data);
+#endif
+        }
+      }
+      wolfSSL_SESSION_free(session);
+    }
+    else {
+      failf(data, "could not decode previous session");
+    }
+  }
+out:
+  Curl_ssl_scache_return(cf, data, ssl_peer_key, scs);
+  return result;
+}
+
+static CURLcode wssl_populate_x509_store(struct Curl_cfilter *cf,
+                                         struct Curl_easy *data,
+                                         WOLFSSL_X509_STORE *store,
+                                         struct wssl_ctx *wssl)
+{
   struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
   const struct curl_blob *ca_info_blob = conn_config->ca_info_blob;
-  const struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
-  WOLFSSL_METHOD* req_method = NULL;
-#ifdef HAVE_LIBOQS
-  word16 oqsAlg = 0;
-  size_t idx = 0;
-#endif
-#ifdef HAVE_SNI
-  bool sni = FALSE;
-#define use_sni(x)  sni = (x)
-#else
-#define use_sni(x)  Curl_nop_stmt
-#endif
-  bool imported_native_ca = false;
-  bool imported_ca_info_blob = false;
+  const char * const ssl_cafile =
+    /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
+    (ca_info_blob ? NULL : conn_config->CAfile);
+  const char * const ssl_capath = conn_config->CApath;
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+  bool imported_native_ca = FALSE;
+  bool imported_ca_info_blob = FALSE;
 
-  DEBUGASSERT(backend);
-
-  if(connssl->state == ssl_connection_complete)
-    return CURLE_OK;
-
-  if(conn_config->version_max != CURL_SSLVERSION_MAX_NONE) {
-    failf(data, "wolfSSL does not support to set maximum SSL/TLS version");
-    return CURLE_SSL_CONNECT_ERROR;
-  }
-
-  /* check to see if we've been told to use an explicit SSL/TLS version */
-  switch(conn_config->version) {
-  case CURL_SSLVERSION_DEFAULT:
-  case CURL_SSLVERSION_TLSv1:
-#if LIBWOLFSSL_VERSION_HEX >= 0x03003000 /* >= 3.3.0 */
-    /* minimum protocol version is set later after the CTX object is created */
-    req_method = SSLv23_client_method();
-#else
-    infof(data, "wolfSSL <3.3.0 cannot be configured to use TLS 1.0-1.2, "
-          "TLS 1.0 is used exclusively");
-    req_method = TLSv1_client_method();
-#endif
-    use_sni(TRUE);
-    break;
-  case CURL_SSLVERSION_TLSv1_0:
-#if defined(WOLFSSL_ALLOW_TLSV10) && !defined(NO_OLD_TLS)
-    req_method = TLSv1_client_method();
-    use_sni(TRUE);
-#else
-    failf(data, "wolfSSL does not support TLS 1.0");
-    return CURLE_NOT_BUILT_IN;
-#endif
-    break;
-  case CURL_SSLVERSION_TLSv1_1:
-#ifndef NO_OLD_TLS
-    req_method = TLSv1_1_client_method();
-    use_sni(TRUE);
-#else
-    failf(data, "wolfSSL does not support TLS 1.1");
-    return CURLE_NOT_BUILT_IN;
-#endif
-    break;
-  case CURL_SSLVERSION_TLSv1_2:
-#ifndef WOLFSSL_NO_TLS12
-    req_method = TLSv1_2_client_method();
-    use_sni(TRUE);
-#else
-    failf(data, "wolfSSL does not support TLS 1.2");
-    return CURLE_NOT_BUILT_IN;
-#endif
-    break;
-  case CURL_SSLVERSION_TLSv1_3:
-#ifdef WOLFSSL_TLS13
-    req_method = wolfTLSv1_3_client_method();
-    use_sni(TRUE);
-    break;
-#else
-    failf(data, "wolfSSL: TLS 1.3 is not yet supported");
-    return CURLE_SSL_CONNECT_ERROR;
-#endif
-  default:
-    failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
-    return CURLE_SSL_CONNECT_ERROR;
-  }
-
-  if(!req_method) {
-    failf(data, "SSL: couldn't create a method");
-    return CURLE_OUT_OF_MEMORY;
-  }
-
-  if(backend->ctx)
-    wolfSSL_CTX_free(backend->ctx);
-  backend->ctx = wolfSSL_CTX_new(req_method);
-
-  if(!backend->ctx) {
-    failf(data, "SSL: couldn't create a context");
-    return CURLE_OUT_OF_MEMORY;
-  }
-
-  switch(conn_config->version) {
-  case CURL_SSLVERSION_DEFAULT:
-  case CURL_SSLVERSION_TLSv1:
-#if LIBWOLFSSL_VERSION_HEX > 0x03004006 /* > 3.4.6 */
-    /* Versions 3.3.0 to 3.4.6 we know the minimum protocol version is
-     * whatever minimum version of TLS was built in and at least TLS 1.0. For
-     * later library versions that could change (eg TLS 1.0 built in but
-     * defaults to TLS 1.1) so we have this short circuit evaluation to find
-     * the minimum supported TLS version.
-    */
-    if((wolfSSL_CTX_SetMinVersion(backend->ctx, WOLFSSL_TLSV1) != 1) &&
-       (wolfSSL_CTX_SetMinVersion(backend->ctx, WOLFSSL_TLSV1_1) != 1) &&
-       (wolfSSL_CTX_SetMinVersion(backend->ctx, WOLFSSL_TLSV1_2) != 1)
-#ifdef WOLFSSL_TLS13
-       && (wolfSSL_CTX_SetMinVersion(backend->ctx, WOLFSSL_TLSV1_3) != 1)
-#endif
-      ) {
-      failf(data, "SSL: couldn't set the minimum protocol version");
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-#endif
-    break;
-  }
-
-  ciphers = conn_config->cipher_list;
-  if(ciphers) {
-    if(!SSL_CTX_set_cipher_list(backend->ctx, ciphers)) {
-      failf(data, "failed setting cipher list: %s", ciphers);
-      return CURLE_SSL_CIPHER;
-    }
-    infof(data, "Cipher selection: %s", ciphers);
-  }
-
-  curves = conn_config->curves;
-  if(curves) {
-
-#ifdef HAVE_LIBOQS
-    for(idx = 0; gnm[idx].name != NULL; idx++) {
-      if(strncmp(curves, gnm[idx].name, strlen(gnm[idx].name)) == 0) {
-        oqsAlg = gnm[idx].group;
-        break;
-      }
-    }
-
-    if(oqsAlg == 0)
-#endif
-    {
-      if(!SSL_CTX_set1_curves_list(backend->ctx, curves)) {
-        failf(data, "failed setting curves list: '%s'", curves);
-        return CURLE_SSL_CIPHER;
-      }
-    }
-  }
+  /* We do not want to do this again, no matter the outcome */
+  wssl->x509_store_setup = TRUE;
 
 #ifndef NO_FILESYSTEM
   /* load native CA certificates */
   if(ssl_config->native_ca_store) {
-    if(wolfSSL_CTX_load_system_CA_certs(backend->ctx) != WOLFSSL_SUCCESS) {
+#ifdef WOLFSSL_SYS_CA_CERTS
+    if(wolfSSL_CTX_load_system_CA_certs(wssl->ssl_ctx) != WOLFSSL_SUCCESS) {
       infof(data, "error importing native CA store, continuing anyway");
     }
     else {
-      imported_native_ca = true;
+      imported_native_ca = TRUE;
       infof(data, "successfully imported native CA store");
     }
+#else
+    infof(data, "ignoring native CA option because wolfSSL was built without "
+                "native CA support");
+#endif
   }
 #endif /* !NO_FILESYSTEM */
 
   /* load certificate blob */
   if(ca_info_blob) {
-    if(wolfSSL_CTX_load_verify_buffer(backend->ctx, ca_info_blob->data,
-                                      ca_info_blob->len,
-                                      SSL_FILETYPE_PEM) != SSL_SUCCESS) {
-      if(imported_native_ca) {
-        infof(data, "error importing CA certificate blob, continuing anyway");
-      }
-      else {
-        failf(data, "error importing CA certificate blob");
-        return CURLE_SSL_CACERT_BADFILE;
-      }
+    if(wolfSSL_CTX_load_verify_buffer(wssl->ssl_ctx, ca_info_blob->data,
+                                      (long)ca_info_blob->len,
+                                      WOLFSSL_FILETYPE_PEM) !=
+       WOLFSSL_SUCCESS) {
+      failf(data, "error importing CA certificate blob");
+      return CURLE_SSL_CACERT_BADFILE;
     }
     else {
-      imported_ca_info_blob = true;
+      imported_ca_info_blob = TRUE;
       infof(data, "successfully imported CA certificate blob");
     }
   }
 
 #ifndef NO_FILESYSTEM
-  /* load trusted cacert */
-  if(conn_config->CAfile) {
-    if(1 != wolfSSL_CTX_load_verify_locations(backend->ctx,
-                                              conn_config->CAfile,
-                                              conn_config->CApath)) {
-      if(conn_config->verifypeer && !imported_ca_info_blob &&
-         !imported_native_ca) {
+  /* load trusted cacert from file if not blob */
+
+  CURL_TRC_CF(data, cf, "wssl_populate_x509_store, path=%s, blob=%d",
+              ssl_cafile ? ssl_cafile : "none", !!ca_info_blob);
+  if(!store)
+    return CURLE_OUT_OF_MEMORY;
+
+  if(ssl_cafile || ssl_capath) {
+    int rc =
+      wolfSSL_CTX_load_verify_locations_ex(wssl->ssl_ctx,
+                                           ssl_cafile,
+                                           ssl_capath,
+                                           WOLFSSL_LOAD_FLAG_IGNORE_ERR);
+    if(WOLFSSL_SUCCESS != rc) {
+      if(conn_config->verifypeer &&
+         !imported_native_ca && !imported_ca_info_blob) {
         /* Fail if we insist on successfully verifying the server. */
         failf(data, "error setting certificate verify locations:"
               " CAfile: %s CApath: %s",
-              conn_config->CAfile?
-              conn_config->CAfile: "none",
-              conn_config->CApath?
-              conn_config->CApath : "none");
+              ssl_cafile ? ssl_cafile : "none",
+              ssl_capath ? ssl_capath : "none");
         return CURLE_SSL_CACERT_BADFILE;
       }
       else {
-        /* Just continue with a warning if no strict certificate
+        /* continue with a warning if no strict certificate
            verification is required. */
         infof(data, "error setting certificate verify locations,"
-              " continuing anyway:");
+                    " continuing anyway:");
       }
     }
     else {
       /* Everything is fine. */
       infof(data, "successfully set certificate verify locations:");
     }
-    infof(data, " CAfile: %s",
-          conn_config->CAfile ? conn_config->CAfile : "none");
-    infof(data, " CApath: %s",
-          conn_config->CApath ? conn_config->CApath : "none");
+    infof(data, " CAfile: %s", ssl_cafile ? ssl_cafile : "none");
+    infof(data, " CApath: %s", ssl_capath ? ssl_capath : "none");
+  }
+#endif
+  (void)store;
+  return CURLE_OK;
+}
+
+/* key to use at `multi->proto_hash` */
+#define MPROTO_WSSL_X509_KEY   "tls:wssl:x509:share"
+
+struct wssl_x509_share {
+  char *CAfile;              /* CAfile path used to generate X509 store */
+  WOLFSSL_X509_STORE *store; /* cached X509 store or NULL if none */
+  struct curltime time;      /* when the cached store was created */
+};
+
+static void wssl_x509_share_free(void *key, size_t key_len, void *p)
+{
+  struct wssl_x509_share *share = p;
+  DEBUGASSERT(key_len == (sizeof(MPROTO_WSSL_X509_KEY) - 1));
+  DEBUGASSERT(!memcmp(MPROTO_WSSL_X509_KEY, key, key_len));
+  (void)key;
+  (void)key_len;
+  if(share->store) {
+    wolfSSL_X509_STORE_free(share->store);
+  }
+  curlx_free(share->CAfile);
+  curlx_free(share);
+}
+
+static bool wssl_cached_x509_store_expired(struct Curl_easy *data,
+                                           const struct wssl_x509_share *mb)
+{
+  const struct ssl_general_config *cfg = &data->set.general_ssl;
+  timediff_t elapsed_ms = curlx_ptimediff_ms(Curl_pgrs_now(data), &mb->time);
+  timediff_t timeout_ms = cfg->ca_cache_timeout * (timediff_t)1000;
+
+  if(timeout_ms < 0)
+    return FALSE;
+
+  return elapsed_ms >= timeout_ms;
+}
+
+static bool wssl_cached_x509_store_different(struct Curl_cfilter *cf,
+                                             const struct wssl_x509_share *mb)
+{
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  if(!mb->CAfile || !conn_config->CAfile)
+    return mb->CAfile != conn_config->CAfile;
+
+  return strcmp(mb->CAfile, conn_config->CAfile);
+}
+
+static WOLFSSL_X509_STORE *wssl_get_cached_x509_store(struct Curl_cfilter *cf,
+                                                      struct Curl_easy *data)
+{
+  struct Curl_multi *multi = data->multi;
+  struct wssl_x509_share *share;
+  WOLFSSL_X509_STORE *store = NULL;
+
+  DEBUGASSERT(multi);
+  share = multi ? Curl_hash_pick(&multi->proto_hash,
+                                 CURL_UNCONST(MPROTO_WSSL_X509_KEY),
+                                 sizeof(MPROTO_WSSL_X509_KEY) - 1) : NULL;
+  if(share && share->store &&
+     !wssl_cached_x509_store_expired(data, share) &&
+     !wssl_cached_x509_store_different(cf, share)) {
+    store = share->store;
   }
 
-  /* Load the client certificate, and private key */
-  if(ssl_config->primary.clientcert && ssl_config->key) {
-    int file_type = do_file_type(ssl_config->cert_type);
+  return store;
+}
 
-    if(wolfSSL_CTX_use_certificate_file(backend->ctx,
-                                        ssl_config->primary.clientcert,
-                                        file_type) != 1) {
-      failf(data, "unable to use client certificate (no key or wrong pass"
-            " phrase?)");
+static void wssl_set_cached_x509_store(struct Curl_cfilter *cf,
+                                       struct Curl_easy *data,
+                                       WOLFSSL_X509_STORE *store)
+{
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  struct Curl_multi *multi = data->multi;
+  struct wssl_x509_share *share;
+
+  DEBUGASSERT(multi);
+  if(!multi)
+    return;
+  share = Curl_hash_pick(&multi->proto_hash,
+                         CURL_UNCONST(MPROTO_WSSL_X509_KEY),
+                         sizeof(MPROTO_WSSL_X509_KEY) - 1);
+
+  if(!share) {
+    share = curlx_calloc(1, sizeof(*share));
+    if(!share)
+      return;
+    if(!Curl_hash_add2(&multi->proto_hash,
+                       CURL_UNCONST(MPROTO_WSSL_X509_KEY),
+                       sizeof(MPROTO_WSSL_X509_KEY) - 1,
+                       share, wssl_x509_share_free)) {
+      curlx_free(share);
+      return;
+    }
+  }
+
+  if(wolfSSL_X509_STORE_up_ref(store)) {
+    char *CAfile = NULL;
+
+    if(conn_config->CAfile) {
+      CAfile = curlx_strdup(conn_config->CAfile);
+      if(!CAfile) {
+        wolfSSL_X509_STORE_free(store);
+        return;
+      }
+    }
+
+    if(share->store) {
+      wolfSSL_X509_STORE_free(share->store);
+      curlx_free(share->CAfile);
+    }
+
+    share->time = *Curl_pgrs_now(data);
+    share->store = store;
+    share->CAfile = CAfile;
+  }
+}
+
+CURLcode Curl_wssl_setup_x509_store(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    struct wssl_ctx *wssl)
+{
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+  CURLcode result = CURLE_OK;
+  WOLFSSL_X509_STORE *cached_store;
+  bool cache_criteria_met;
+
+  /* Consider the X509 store cacheable if it comes exclusively from a CAfile,
+     or no source is provided and we are falling back to wolfSSL's built-in
+     default. */
+  cache_criteria_met = (data->set.general_ssl.ca_cache_timeout != 0) &&
+    conn_config->verifypeer &&
+    !conn_config->CApath &&
+    !conn_config->ca_info_blob &&
+    !ssl_config->primary.CRLfile &&
+    !ssl_config->native_ca_store;
+
+  cached_store = cache_criteria_met ? wssl_get_cached_x509_store(cf, data)
+                                    : NULL;
+  if(cached_store &&
+     wolfSSL_CTX_get_cert_store(wssl->ssl_ctx) == cached_store) {
+    /* The cached store is already in use, do nothing. */
+  }
+  else if(cached_store && wolfSSL_X509_STORE_up_ref(cached_store)) {
+    wolfSSL_CTX_set_cert_store(wssl->ssl_ctx, cached_store);
+  }
+  else if(cache_criteria_met) {
+    /* wolfSSL's initial store in CTX is not shareable by default.
+     * Make a new one, suitable for adding to the cache. See #14278 */
+    WOLFSSL_X509_STORE *store = wolfSSL_X509_STORE_new();
+    if(!store) {
+      failf(data, "SSL: could not create a X509 store");
+      return CURLE_OUT_OF_MEMORY;
+    }
+    wolfSSL_CTX_set_cert_store(wssl->ssl_ctx, store);
+
+    result = wssl_populate_x509_store(cf, data, store, wssl);
+    if(!result) {
+      wssl_set_cached_x509_store(cf, data, store);
+    }
+  }
+  else {
+    /* We never share the CTX's store, use it. */
+    WOLFSSL_X509_STORE *store = wolfSSL_CTX_get_cert_store(wssl->ssl_ctx);
+    result = wssl_populate_x509_store(cf, data, store, wssl);
+  }
+
+  return result;
+}
+
+#ifdef WOLFSSL_TLS13
+static CURLcode wssl_add_default_ciphers(bool tls13, struct dynbuf *buf)
+{
+  int i;
+  char *str;
+
+  for(i = 0; (str = wolfSSL_get_cipher_list(i)) != NULL; i++) {
+    size_t n;
+    if((!strncmp(str, "TLS13", 5)) != tls13)
+      continue;
+
+    /* if there already is data in the string, add colon separator */
+    if(curlx_dyn_len(buf)) {
+      CURLcode result = curlx_dyn_addn(buf, ":", 1);
+      if(result)
+        return result;
+    }
+
+    n = strlen(str);
+    if(curlx_dyn_addn(buf, str, n))
+      return CURLE_OUT_OF_MEMORY;
+  }
+
+  return CURLE_OK;
+}
+#endif
+
+#ifndef OPENSSL_EXTRA
+static int wssl_legacy_CTX_set_min_proto_version(WOLFSSL_CTX *ctx, int version)
+{
+  int res;
+  switch(version) {
+  default:
+  case TLS1_VERSION:
+    res = wolfSSL_CTX_SetMinVersion(ctx, WOLFSSL_TLSV1);
+    if(res == WOLFSSL_SUCCESS)
+      return res;
+    FALLTHROUGH();
+  case TLS1_1_VERSION:
+    res = wolfSSL_CTX_SetMinVersion(ctx, WOLFSSL_TLSV1_1);
+    if(res == WOLFSSL_SUCCESS)
+      return res;
+    FALLTHROUGH();
+  case TLS1_2_VERSION:
+    res = wolfSSL_CTX_SetMinVersion(ctx, WOLFSSL_TLSV1_2);
+#ifdef WOLFSSL_TLS13
+    if(res == WOLFSSL_SUCCESS)
+      return res;
+    FALLTHROUGH();
+  case TLS1_3_VERSION:
+    res = wolfSSL_CTX_SetMinVersion(ctx, WOLFSSL_TLSV1_3);
+#endif
+  }
+  return res;
+}
+
+static int wssl_legacy_CTX_set_max_proto_version(WOLFSSL_CTX *ctx, int version)
+{
+  (void)ctx, (void)version;
+  return WOLFSSL_NOT_IMPLEMENTED;
+}
+#define wolfSSL_CTX_set_min_proto_version wssl_legacy_CTX_set_min_proto_version
+#define wolfSSL_CTX_set_max_proto_version wssl_legacy_CTX_set_max_proto_version
+#endif /* OPENSSL_EXTRA */
+
+static CURLcode wssl_client_cert(struct Curl_easy *data,
+                                 struct ssl_config_data *ssl_config,
+                                 struct wssl_ctx *wctx)
+{
+  /* Load the client certificate, and private key */
+#ifndef NO_FILESYSTEM
+  if(ssl_config->primary.cert_blob || ssl_config->primary.clientcert) {
+    const char *cert_file = ssl_config->primary.clientcert;
+    const char *key_file = ssl_config->primary.key;
+    const struct curl_blob *cert_blob = ssl_config->primary.cert_blob;
+    const struct curl_blob *key_blob = ssl_config->primary.key_blob;
+    int file_type = wssl_do_file_type(ssl_config->primary.cert_type);
+    int rc;
+
+    switch(file_type) {
+    case WOLFSSL_FILETYPE_PEM:
+      rc = cert_blob ?
+        wolfSSL_CTX_use_certificate_chain_buffer(wctx->ssl_ctx,
+                                                 cert_blob->data,
+                                                 (long)cert_blob->len) :
+        wolfSSL_CTX_use_certificate_chain_file(wctx->ssl_ctx, cert_file);
+      break;
+    case WOLFSSL_FILETYPE_ASN1:
+      rc = cert_blob ?
+        wolfSSL_CTX_use_certificate_buffer(wctx->ssl_ctx, cert_blob->data,
+                                           (long)cert_blob->len, file_type) :
+        wolfSSL_CTX_use_certificate_file(wctx->ssl_ctx, cert_file, file_type);
+      break;
+    default:
+      failf(data, "unknown cert type");
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    }
+    if(rc != 1) {
+      failf(data, "unable to use client certificate");
       return CURLE_SSL_CONNECT_ERROR;
     }
 
-    file_type = do_file_type(ssl_config->key_type);
-    if(wolfSSL_CTX_use_PrivateKey_file(backend->ctx, ssl_config->key,
-                                       file_type) != 1) {
+    if(!key_blob && !key_file) {
+      key_blob = cert_blob;
+      key_file = cert_file;
+    }
+    else
+      file_type = wssl_do_file_type(ssl_config->primary.key_type);
+
+    rc = key_blob ?
+      wolfSSL_CTX_use_PrivateKey_buffer(wctx->ssl_ctx, key_blob->data,
+                                        (long)key_blob->len, file_type) :
+      wolfSSL_CTX_use_PrivateKey_file(wctx->ssl_ctx, key_file, file_type);
+    if(rc != 1) {
+      failf(data, "unable to set private key");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+  }
+#else /* NO_FILESYSTEM */
+  if(ssl_config->primary.cert_blob) {
+    const struct curl_blob *cert_blob = ssl_config->primary.cert_blob;
+    const struct curl_blob *key_blob = ssl_config->primary.key_blob;
+    int file_type = wssl_do_file_type(ssl_config->primary.cert_type);
+    int rc;
+
+    switch(file_type) {
+    case WOLFSSL_FILETYPE_PEM:
+      rc = wolfSSL_CTX_use_certificate_chain_buffer(wctx->ssl_ctx,
+                                                    cert_blob->data,
+                                                    (long)cert_blob->len);
+      break;
+    case WOLFSSL_FILETYPE_ASN1:
+      rc = wolfSSL_CTX_use_certificate_buffer(wctx->ssl_ctx, cert_blob->data,
+                                              (long)cert_blob->len, file_type);
+      break;
+    default:
+      failf(data, "unknown cert type");
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    }
+    if(rc != 1) {
+      failf(data, "unable to use client certificate");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+
+    if(!key_blob)
+      key_blob = cert_blob;
+    else
+      file_type = wssl_do_file_type(ssl_config->primary.key_type);
+
+    if(wolfSSL_CTX_use_PrivateKey_buffer(wctx->ssl_ctx, key_blob->data,
+                                         (long)key_blob->len,
+                                         file_type) != 1) {
       failf(data, "unable to set private key");
       return CURLE_SSL_CONNECT_ERROR;
     }
   }
 #endif /* !NO_FILESYSTEM */
+  return CURLE_OK;
+}
 
-  /* SSL always tries to verify the peer, this only says whether it should
-   * fail to connect if the verification fails, or if it should continue
-   * anyway. In the latter case the result of the verification is checked with
-   * SSL_get_verify_result() below. */
-  wolfSSL_CTX_set_verify(backend->ctx,
-                         conn_config->verifypeer?SSL_VERIFY_PEER:
-                         SSL_VERIFY_NONE, NULL);
+static CURLcode ssl_version(struct Curl_easy *data,
+                            struct ssl_primary_config *conn_config,
+                            struct wssl_ctx *wctx,
+                            int *min_version, int *max_version)
+{
+  int res;
+  *min_version = *max_version = 0;
+  DEBUGASSERT(conn_config->version != CURL_SSLVERSION_DEFAULT);
 
-#ifdef HAVE_SNI
-  if(sni) {
-    struct in_addr addr4;
-#ifdef ENABLE_IPV6
-    struct in6_addr addr6;
+  switch(conn_config->version) {
+  case CURL_SSLVERSION_TLSv1:
+  case CURL_SSLVERSION_TLSv1_0:
+    *min_version = TLS1_VERSION;
+    break;
+  case CURL_SSLVERSION_TLSv1_1:
+    *min_version = TLS1_1_VERSION;
+    break;
+  case CURL_SSLVERSION_TLSv1_2:
+    *min_version = TLS1_2_VERSION;
+    break;
+#ifdef WOLFSSL_TLS13
+  case CURL_SSLVERSION_TLSv1_3:
+    *min_version = TLS1_3_VERSION;
+    break;
 #endif
-    size_t hostname_len = strlen(connssl->hostname);
-
-    if((hostname_len < USHRT_MAX) &&
-       !Curl_inet_pton(AF_INET, connssl->hostname, &addr4)
-#ifdef ENABLE_IPV6
-       && !Curl_inet_pton(AF_INET6, connssl->hostname, &addr6)
-#endif
-      ) {
-      size_t snilen;
-      char *snihost = Curl_ssl_snihost(data, connssl->hostname, &snilen);
-      if(!snihost ||
-         wolfSSL_CTX_UseSNI(backend->ctx, WOLFSSL_SNI_HOST_NAME, snihost,
-                            (unsigned short)snilen) != 1) {
-        failf(data, "Failed to set SNI");
-        return CURLE_SSL_CONNECT_ERROR;
-      }
-    }
-  }
-#endif
-
-  /* give application a chance to interfere with SSL set up. */
-  if(data->set.ssl.fsslctx) {
-    CURLcode result = (*data->set.ssl.fsslctx)(data, backend->ctx,
-                                               data->set.ssl.fsslctxp);
-    if(result) {
-      failf(data, "error signaled by ssl ctx callback");
-      return result;
-    }
-  }
-#ifdef NO_FILESYSTEM
-  else if(conn_config->verifypeer) {
-    failf(data, "SSL: Certificates can't be loaded because wolfSSL was built"
-          " with \"no filesystem\". Either disable peer verification"
-          " (insecure) or if you are building an application with libcurl you"
-          " can load certificates via CURLOPT_SSL_CTX_FUNCTION.");
+  default:
+    failf(data, "wolfSSL: unsupported minimum TLS version value");
     return CURLE_SSL_CONNECT_ERROR;
   }
+
+  switch(conn_config->version_max) {
+#ifdef WOLFSSL_TLS13
+  case CURL_SSLVERSION_MAX_TLSv1_3:
+    *max_version = TLS1_3_VERSION;
+    break;
+#endif
+  case CURL_SSLVERSION_MAX_TLSv1_2:
+    *max_version = TLS1_2_VERSION;
+    break;
+  case CURL_SSLVERSION_MAX_TLSv1_1:
+    *max_version = TLS1_1_VERSION;
+    break;
+  case CURL_SSLVERSION_MAX_TLSv1_0:
+    *max_version = TLS1_VERSION;
+    break;
+  case CURL_SSLVERSION_MAX_DEFAULT:
+  case CURL_SSLVERSION_MAX_NONE:
+    break;
+  default:
+    failf(data, "wolfSSL: unsupported maximum TLS version value");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  res = wolfSSL_CTX_set_min_proto_version(wctx->ssl_ctx, *min_version);
+  if(res != WOLFSSL_SUCCESS) {
+    failf(data, "wolfSSL: failed set the minimum TLS version");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  if(*max_version) {
+    res = wolfSSL_CTX_set_max_proto_version(wctx->ssl_ctx, *max_version);
+    if(res != WOLFSSL_SUCCESS) {
+      failf(data, "wolfSSL: failed set the maximum TLS version");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+  }
+  return CURLE_OK;
+}
+
+#ifdef WOLFSSL_TLS13
+#define MAX_CIPHER_LEN 4096
 #endif
 
+static CURLcode wssl_init_ciphers(struct Curl_easy *data,
+                                  struct wssl_ctx *wctx,
+                                  struct ssl_primary_config *conn_config,
+                                  int tls_min, int tls_max)
+{
+#ifndef WOLFSSL_TLS13
+  const char *ciphers = conn_config->cipher_list;
+  (void)tls_min;
+  (void)tls_max;
+  if(ciphers) {
+    if(!SSL_CTX_set_cipher_list(wctx->ssl_ctx, ciphers)) {
+      failf(data, "failed setting cipher list: %s", ciphers);
+      return CURLE_SSL_CIPHER;
+    }
+    infof(data, "Cipher selection: %s", ciphers);
+  }
+  return CURLE_OK;
+#else
+  CURLcode result = CURLE_OK;
+  if(conn_config->cipher_list || conn_config->cipher_list13) {
+    const char *ciphers12 = conn_config->cipher_list;
+    const char *ciphers13 = conn_config->cipher_list13;
+    struct dynbuf c;
+    curlx_dyn_init(&c, MAX_CIPHER_LEN);
+
+    if(!tls_max || (tls_max >= TLS1_3_VERSION)) {
+      if(ciphers13)
+        result = curlx_dyn_add(&c, ciphers13);
+      else
+        result = wssl_add_default_ciphers(TRUE, &c);
+    }
+
+    if(!result && (tls_min < TLS1_3_VERSION)) {
+      if(ciphers12) {
+        if(curlx_dyn_len(&c))
+          result = curlx_dyn_addn(&c, ":", 1);
+        if(!result)
+          result = curlx_dyn_add(&c, ciphers12);
+      }
+      else
+        result = wssl_add_default_ciphers(FALSE, &c);
+    }
+    if(!result) {
+      if(!wolfSSL_CTX_set_cipher_list(wctx->ssl_ctx, curlx_dyn_ptr(&c))) {
+        failf(data, "failed setting cipher list: %s", curlx_dyn_ptr(&c));
+        result = CURLE_SSL_CIPHER;
+      }
+      else
+        infof(data, "Cipher selection: %s", curlx_dyn_ptr(&c));
+    }
+    curlx_dyn_free(&c);
+  }
+  return result;
+#endif
+}
+
+/* wolfSSL_CTX_set1_groups_list() accepts PQC/hybrid groups (e.g.
+   X25519MLKEM768) that wolfSSL_CTX_set1_curves_list() rejects. It needs
+   OPENSSL_EXTRA, which wolfSSL's --enable-curl sets but --enable-curl=tiny
+   does not. */
+#ifdef OPENSSL_EXTRA
+#define wssl_CTX_set1_groups_list wolfSSL_CTX_set1_groups_list
+#else
+#define wssl_CTX_set1_groups_list wolfSSL_CTX_set1_curves_list
+#endif
+
+static CURLcode wssl_init_curves(struct Curl_easy *data,
+                                 struct wssl_ctx *wctx,
+                                 struct ssl_primary_config *conn_config)
+{
+  char *curves = conn_config->curves;
+  /* Without an explicit list, leave the key share group selection to
+     wolfSSL's own default. */
+  if(curves && !wssl_CTX_set1_groups_list(wctx->ssl_ctx, curves)) {
+    failf(data, "failed setting curves list: '%s'", curves);
+    return CURLE_SSL_CIPHER;
+  }
+  return CURLE_OK;
+}
+
+static CURLcode wssl_init_ssl_handle(
+  struct wssl_ctx *wctx,
+  struct Curl_cfilter *cf,
+  struct Curl_easy *data,
+  struct ssl_peer *peer,
+  struct alpn_spec *alpns,
+  void *ssl_user_data,
+  unsigned char transport,
+  Curl_wssl_init_session_reuse_cb *sess_reuse_cb)
+{
   /* Let's make an SSL structure */
-  if(backend->handle)
-    wolfSSL_free(backend->handle);
-  backend->handle = wolfSSL_new(backend->ctx);
-  if(!backend->handle) {
-    failf(data, "SSL: couldn't create a handle");
+  wctx->ssl = wolfSSL_new(wctx->ssl_ctx);
+  if(!wctx->ssl) {
+    failf(data, "SSL: could not create a handle");
     return CURLE_OUT_OF_MEMORY;
   }
 
-#ifdef HAVE_LIBOQS
-  if(oqsAlg) {
-    if(wolfSSL_UseKeyShare(backend->handle, oqsAlg) != WOLFSSL_SUCCESS) {
-      failf(data, "unable to use oqs KEM");
-    }
-  }
+#ifdef HAVE_EX_DATA
+  wolfSSL_set_app_data(wctx->ssl, ssl_user_data);
+#else
+  (void)ssl_user_data;
+#endif
+#ifdef WOLFSSL_QUIC
+  if(transport == TRNSPRT_QUIC)
+    wolfSSL_set_quic_use_legacy_codepoint(wctx->ssl, 0);
+#else
+  (void)transport;
 #endif
 
-#ifdef HAVE_ALPN
-  if(connssl->alpn) {
-    struct alpn_proto_buf proto;
-    CURLcode result;
+  /* Check if there is a cached ID we can/should use here! */
+  if(Curl_ssl_scache_use(cf, data)) {
+    /* Set session from cache if there is one */
+    (void)wssl_setup_session(cf, data, wctx, alpns, peer->scache_key,
+                             sess_reuse_cb);
+  }
 
-    result = Curl_alpn_to_proto_str(&proto, connssl->alpn);
-    if(result ||
-       wolfSSL_UseALPN(backend->handle, (char *)proto.data, proto.len,
-                       WOLFSSL_ALPN_CONTINUE_ON_MISMATCH) != SSL_SUCCESS) {
+#ifdef HAVE_ALPN
+  if(alpns->count) {
+    struct alpn_proto_buf proto;
+    memset(&proto, 0, sizeof(proto));
+    Curl_alpn_to_proto_str(&proto, alpns);
+
+    if(wolfSSL_UseALPN(wctx->ssl, (char *)proto.data,
+                       (unsigned int)proto.len,
+                       WOLFSSL_ALPN_CONTINUE_ON_MISMATCH)
+       != WOLFSSL_SUCCESS) {
       failf(data, "SSL: failed setting ALPN protocols");
       return CURLE_SSL_CONNECT_ERROR;
     }
-    infof(data, VTLS_INFOF_ALPN_OFFER_1STR, proto.data);
+    CURL_TRC_CF(data, cf, "set ALPN: %s", proto.data);
   }
 #endif /* HAVE_ALPN */
 
 #ifdef OPENSSL_EXTRA
   if(Curl_tls_keylog_enabled()) {
     /* Ensure the Client Random is preserved. */
-    wolfSSL_KeepArrays(backend->handle);
+    wolfSSL_KeepArrays(wctx->ssl);
 #if defined(HAVE_SECRET_CALLBACK) && defined(WOLFSSL_TLS13)
-    wolfSSL_set_tls13_secret_cb(backend->handle,
-                                wolfssl_tls13_secret_callback, NULL);
+    wolfSSL_set_tls13_secret_cb(wctx->ssl, wssl_tls13_secret_callback, NULL);
 #endif
   }
 #endif /* OPENSSL_EXTRA */
 
 #ifdef HAVE_SECURE_RENEGOTIATION
-  if(wolfSSL_UseSecureRenegotiation(backend->handle) != SSL_SUCCESS) {
+  if(wolfSSL_UseSecureRenegotiation(wctx->ssl) != SSL_SUCCESS) {
     failf(data, "SSL: failed setting secure renegotiation");
     return CURLE_SSL_CONNECT_ERROR;
   }
 #endif /* HAVE_SECURE_RENEGOTIATION */
 
-  /* Check if there's a cached ID we can/should use here! */
-  if(ssl_config->primary.sessionid) {
-    void *ssl_sessionid = NULL;
+  return CURLE_OK;
+}
 
-    Curl_ssl_sessionid_lock(data);
-    if(!Curl_ssl_getsessionid(cf, data, &ssl_sessionid, NULL)) {
-      /* we got a session id, use it! */
-      if(!SSL_set_session(backend->handle, ssl_sessionid)) {
-        Curl_ssl_delsessionid(data, ssl_sessionid);
-        infof(data, "Can't use session ID, going on without");
-      }
-      else
-        infof(data, "SSL reusing session ID");
+#ifdef HAVE_WOLFSSL_CTX_GENERATEECHCONFIG
+static CURLcode wssl_init_ech(struct wssl_ctx *wctx,
+                              struct Curl_cfilter *cf,
+                              struct Curl_easy *data,
+                              struct ssl_peer *peer)
+{
+  int trying_ech_now = 0;
+
+  if(data->set.str[STRING_ECH_PUBLIC]) {
+    infof(data, "ECH: outername not (yet) supported"
+          " with wolfSSL");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+  if(data->set.tls_ech == CURLECH_GREASE) {
+    infof(data, "ECH: GREASE is done by default by"
+          " wolfSSL: no need to ask");
+  }
+  if(data->set.tls_ech && data->set.str[STRING_ECH_CONFIG]) {
+    char *b64val = data->set.str[STRING_ECH_CONFIG];
+    word32 b64len = 0;
+
+    b64len = (word32)strlen(b64val);
+    if(b64len && wolfSSL_SetEchConfigsBase64(wctx->ssl, b64val,
+                                             b64len) != WOLFSSL_SUCCESS) {
+      if(data->set.tls_ech == CURLECH_HARD)
+        return CURLE_SSL_CONNECT_ERROR;
+    }
+    else {
+      trying_ech_now = 1;
+      infof(data, "ECH: ECHConfig from command line");
+    }
+  }
+  else {
+    const struct Curl_https_rrinfo *rinfo =
+      Curl_conn_dns_get_https(data, cf->sockindex, peer->origin);
+
+    if(rinfo && rinfo->echconfiglist) {
+      const unsigned char *ecl = rinfo->echconfiglist;
+      size_t elen = rinfo->echconfiglist_len;
+
+      infof(data, "ECH: ECHConfig from HTTPS RR");
+      if(wolfSSL_SetEchConfigs(wctx->ssl, ecl, (word32)elen) !=
+         WOLFSSL_SUCCESS) {
+        infof(data, "ECH: wolfSSL_SetEchConfigs failed");
+        if(data->set.tls_ech == CURLECH_HARD) {
+          return CURLE_SSL_CONNECT_ERROR;
+        }
+      }
+      else {
+        trying_ech_now = 1;
+        infof(data, "ECH: imported ECHConfigList of length %zu", elen);
+      }
+    }
+    else {
+      infof(data, "ECH: requested but no ECHConfig available");
+      if(data->set.tls_ech == CURLECH_HARD) {
+        return CURLE_SSL_CONNECT_ERROR;
+      }
+    }
+  }
+
+  if(trying_ech_now &&
+     wolfSSL_set_min_proto_version(wctx->ssl, TLS1_3_VERSION) != 1) {
+    infof(data, "ECH: cannot force TLSv1.3 [ERROR]");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+  return CURLE_OK;
+}
+#endif /* HAVE_WOLFSSL_CTX_GENERATEECHCONFIG */
+
+CURLcode Curl_wssl_ctx_init(struct wssl_ctx *wctx,
+                            struct Curl_cfilter *cf,
+                            struct Curl_easy *data,
+                            struct ssl_peer *peer,
+                            const struct alpn_spec *alpns_requested,
+                            Curl_wssl_ctx_setup_cb *cb_setup,
+                            void *cb_user_data,
+                            void *ssl_user_data,
+                            Curl_wssl_init_session_reuse_cb *sess_reuse_cb)
+{
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+  struct ssl_primary_config *conn_config;
+  WOLFSSL_METHOD *req_method = NULL;
+  struct alpn_spec alpns;
+  CURLcode result = CURLE_FAILED_INIT;
+  unsigned char transport;
+  int tls_min, tls_max;
+
+  DEBUGASSERT(!wctx->ssl_ctx);
+  DEBUGASSERT(!wctx->ssl);
+  conn_config = Curl_ssl_cf_get_primary_config(cf);
+  if(!conn_config) {
+    result = CURLE_FAILED_INIT;
+    goto out;
+  }
+  Curl_alpn_copy(&alpns, alpns_requested);
+  DEBUGASSERT(cf->next);
+  transport = Curl_conn_cf_get_transport(cf->next, data);
+
+  req_method = wolfTLS_client_method();
+  if(!req_method) {
+    failf(data, "wolfSSL: could not create a client method");
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  if(wctx->ssl_ctx)
+    wolfSSL_CTX_free(wctx->ssl_ctx);
+
+  wctx->ssl_ctx = wolfSSL_CTX_new(req_method);
+  if(!wctx->ssl_ctx) {
+    failf(data, "wolfSSL: could not create a context");
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  result = ssl_version(data, conn_config, wctx, &tls_min, &tls_max);
+  if(result)
+    goto out;
+
+  result = wssl_init_ciphers(data, wctx, conn_config, tls_min, tls_max);
+  if(result)
+    goto out;
+
+  result = wssl_init_curves(data, wctx, conn_config);
+  if(result)
+    goto out;
+
+  result = wssl_client_cert(data, ssl_config, wctx);
+  if(result)
+    goto out;
+
+  /* SSL always tries to verify the peer, this only says whether it should
+   * fail to connect if the verification fails, or if it should continue
+   * anyway. In the latter case the result of the verification is checked with
+   * SSL_get_verify_result() below. */
+  wolfSSL_CTX_set_verify(wctx->ssl_ctx, conn_config->verifypeer ?
+                         WOLFSSL_VERIFY_PEER : WOLFSSL_VERIFY_NONE, NULL);
+
+#ifdef HAVE_SNI
+  if(peer->sni) {
+    size_t sni_len = strlen(peer->sni);
+    if((sni_len < USHRT_MAX)) {
+      if(wolfSSL_CTX_UseSNI(wctx->ssl_ctx, WOLFSSL_SNI_HOST_NAME,
+                            peer->sni, (unsigned short)sni_len) != 1) {
+        failf(data, "Failed to set SNI");
+        result = CURLE_SSL_CONNECT_ERROR;
+        goto out;
+      }
+      CURL_TRC_CF(data, cf, "set SNI '%s'", peer->sni);
+    }
+  }
+#endif
+
+#ifdef HAVE_EX_DATA
+  if(Curl_ssl_scache_use(cf, data) && (transport != TRNSPRT_QUIC)) {
+    /* Register to get notified when a new session is received */
+    wolfSSL_CTX_sess_set_new_cb(wctx->ssl_ctx, wssl_vtls_new_session_cb);
+  }
+#endif
+
+  if(cb_setup) {
+    result = cb_setup(cf, data, cb_user_data);
+    if(result)
+      goto out;
+  }
+
+  /* give application a chance to interfere with SSL set up. */
+  if(data->set.ssl.fsslctx) {
+    if(!wctx->x509_store_setup) {
+      result = Curl_wssl_setup_x509_store(cf, data, wctx);
+      if(result)
+        goto out;
+    }
+    result = (*data->set.ssl.fsslctx)(data, wctx->ssl_ctx,
+                                      data->set.ssl.fsslctxp);
+    if(result) {
+      failf(data, "error signaled by SSL ctx callback");
+      goto out;
+    }
+  }
+#ifdef NO_FILESYSTEM
+  else if(conn_config->verifypeer) {
+    failf(data, "SSL: Certificates cannot be loaded because wolfSSL was built"
+          " with no file system. Either disable peer verification"
+          " (insecure) or if you are building an application with libcurl you"
+          " can load certificates via CURLOPT_SSL_CTX_FUNCTION.");
+    result = CURLE_SSL_CONNECT_ERROR;
+    goto out;
+  }
+#endif
+
+  result = wssl_init_ssl_handle(wctx, cf, data, peer, &alpns, ssl_user_data,
+                                transport, sess_reuse_cb);
+  if(result)
+    goto out;
+
+#ifdef HAVE_WOLFSSL_CTX_GENERATEECHCONFIG
+  if(CURLECH_ENABLED(data)) {
+    result = wssl_init_ech(wctx, cf, data, peer);
+    if(result)
+      goto out;
+  }
+#endif /* HAVE_WOLFSSL_CTX_GENERATEECHCONFIG */
+
+  result = CURLE_OK;
+
+out:
+  if(result && wctx->ssl) {
+    wolfSSL_free(wctx->ssl);
+    wctx->ssl = NULL;
+  }
+  if(result && wctx->ssl_ctx) {
+    wolfSSL_CTX_free(wctx->ssl_ctx);
+    wctx->ssl_ctx = NULL;
+  }
+  return result;
+}
+
+bool Curl_wssl_need_httpsrr(struct Curl_easy *data)
+{
+#ifdef HAVE_WOLFSSL_CTX_GENERATEECHCONFIG
+  if(!CURLECH_ENABLED(data))
+    return FALSE;
+  if((data->set.tls_ech == CURLECH_GREASE) ||
+     data->set.str[STRING_ECH_CONFIG])
+    return FALSE;
+  return TRUE;
+#else
+  (void)data;
+  return FALSE;
+#endif
+}
+
+/*
+ * This function loads all the client/CA certificates and CRLs. Setup the TLS
+ * layer and do all necessary magic.
+ */
+static CURLcode wssl_connect_step1(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct wssl_ctx *wssl = (struct wssl_ctx *)connssl->backend;
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  CURLcode result;
+
+  DEBUGASSERT(wssl);
+
+  if(connssl->state == ssl_connection_complete)
+    return CURLE_OK;
+
+  result = Curl_wssl_ctx_init(wssl, cf, data, &connssl->peer, connssl->alpn,
+                              NULL, NULL, cf, wssl_on_session_reuse);
+  if(result)
+    return result;
+
+#ifdef HAVE_ALPN
+  if(connssl->alpn && (connssl->state != ssl_connection_deferred)) {
+    struct alpn_proto_buf proto;
+    memset(&proto, 0, sizeof(proto));
+    Curl_alpn_to_proto_str(&proto, connssl->alpn);
+    infof(data, VTLS_INFOF_ALPN_OFFER_1STR, proto.data);
+  }
+#endif
+
+  /* Enable RFC2818 checks on domain names. This cannot check
+   * IP addresses which we need to do extra after the handshake. */
+  if(conn_config->verifyhost && connssl->peer.sni) {
+    if(wolfSSL_check_domain_name(wssl->ssl, connssl->peer.sni) !=
+       WOLFSSL_SUCCESS) {
+      return CURLE_SSL_CONNECT_ERROR;
     }
-    Curl_ssl_sessionid_unlock(data);
   }
 
 #ifdef USE_BIO_CHAIN
   {
     WOLFSSL_BIO *bio;
 
-    bio = BIO_new(bio_cf_method);
+    if(!wssl_bio_cf_method)
+      return CURLE_FAILED_INIT;
+    bio = wolfSSL_BIO_new(wssl_bio_cf_method);
     if(!bio)
       return CURLE_OUT_OF_MEMORY;
 
     wolfSSL_BIO_set_data(bio, cf);
-    wolfSSL_set_bio(backend->handle, bio, bio);
+    wolfSSL_set_bio(wssl->ssl, bio, bio);
   }
-#else /* USE_BIO_CHAIN */
-  /* pass the raw socket into the SSL layer */
-  if(!wolfSSL_set_fd(backend->handle,
-                     (int)Curl_conn_cf_get_socket(cf, data))) {
-    failf(data, "SSL: SSL_set_fd failed");
+#else /* !USE_BIO_CHAIN */
+  curl_socket_t sockfd = Curl_conn_cf_get_socket(cf, data);
+  if(sockfd > INT_MAX) {
+    failf(data, "SSL: socket value too large");
     return CURLE_SSL_CONNECT_ERROR;
   }
-#endif /* !USE_BIO_CHAIN */
+  /* pass the raw socket into the SSL layer */
+  if(!wolfSSL_set_fd(wssl->ssl, (int)sockfd)) {
+    failf(data, "SSL: wolfSSL_set_fd failed");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+#endif /* USE_BIO_CHAIN */
 
-  connssl->connecting_state = ssl_connect_2;
   return CURLE_OK;
 }
 
-
-static CURLcode
-wolfssl_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
+static char *wssl_strerror(unsigned long error, char *buf, unsigned long size)
 {
-  int ret = -1;
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct wolfssl_ssl_backend_data *backend =
-    (struct wolfssl_ssl_backend_data *)connssl->backend;
-  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
-  const char * const pinnedpubkey = Curl_ssl_cf_is_proxy(cf)?
-    data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY]:
-    data->set.str[STRING_SSL_PINNEDPUBLICKEY];
+  DEBUGASSERT(size > 40);
+  *buf = '\0';
 
-  DEBUGASSERT(backend);
+  wolfSSL_ERR_error_string_n(error, buf, size);
 
-  wolfSSL_ERR_clear_error();
-
-  /* Enable RFC2818 checks */
-  if(conn_config->verifyhost) {
-    char *snihost = Curl_ssl_snihost(data, connssl->hostname, NULL);
-    if(!snihost ||
-       (wolfSSL_check_domain_name(backend->handle, snihost) == SSL_FAILURE))
-      return CURLE_SSL_CONNECT_ERROR;
+  if(!*buf) {
+    const char *msg = error ? "Unknown error" : "No error";
+    curlx_strcopy(buf, size, msg, strlen(msg));
   }
 
-  ret = wolfSSL_connect(backend->handle);
+  return buf;
+}
+
+CURLcode Curl_wssl_verify_pinned(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 struct wssl_ctx *wssl)
+{
+  WOLFSSL_X509 *x509 = NULL;
+  CURLcode result = CURLE_OK;
+#ifndef CURL_DISABLE_PROXY
+  const char * const pinnedpubkey = Curl_ssl_cf_is_proxy(cf) ?
+    data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
+    data->set.str[STRING_SSL_PINNEDPUBLICKEY];
+#else
+  const char * const pinnedpubkey = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
+  (void)cf;
+#endif
+
+  if(pinnedpubkey) {
+#ifdef KEEP_PEER_CERT
+    const char *x509_der;
+    int x509_der_len;
+    struct Curl_X509certificate x509_parsed;
+    struct Curl_asn1Element *pubkey;
+
+    result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
+
+    x509 = wolfSSL_get_peer_certificate(wssl->ssl);
+    if(!x509) {
+      failf(data, "SSL: failed retrieving server certificate");
+      goto end;
+    }
+
+    x509_der = (const char *)wolfSSL_X509_get_der(x509, &x509_der_len);
+    if(!x509_der) {
+      failf(data, "SSL: failed retrieving ASN.1 server certificate");
+      goto end;
+    }
+
+    memset(&x509_parsed, 0, sizeof(x509_parsed));
+    if(Curl_parseX509(&x509_parsed, x509_der, x509_der + x509_der_len))
+      goto end;
+
+    pubkey = &x509_parsed.subjectPublicKeyInfo;
+    if(!pubkey->header || pubkey->end <= pubkey->header) {
+      failf(data, "SSL: failed retrieving public key from server certificate");
+      goto end;
+    }
+
+    result = Curl_pin_peer_pubkey(data, pinnedpubkey,
+                                  (const unsigned char *)pubkey->header,
+                                  (size_t)(pubkey->end - pubkey->header));
+    if(result)
+      failf(data, "SSL: public key does not match pinned public key");
+#else
+    failf(data, "Library lacks pinning support built-in");
+    return CURLE_NOT_BUILT_IN;
+#endif
+  }
+end:
+  wolfSSL_FreeX509(x509);
+  return result;
+}
+
+#ifdef WOLFSSL_EARLY_DATA
+static CURLcode wssl_send_earlydata(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct wssl_ctx *wssl = (struct wssl_ctx *)connssl->backend;
+  const unsigned char *buf;
+  size_t blen;
+
+  DEBUGASSERT(connssl->earlydata_state == ssl_earlydata_sending);
+  wssl->io_result = CURLE_OK;
+  while(Curl_bufq_peek(&connssl->earlydata, &buf, &blen)) {
+    int nwritten = 0, rc;
+
+    wolfSSL_ERR_clear_error();
+    rc = wolfSSL_write_early_data(wssl->ssl, buf, (int)blen, &nwritten);
+    CURL_TRC_CF(data, cf, "wolfSSL_write_early_data(len=%zu) -> %d, %d",
+                blen, rc, nwritten);
+    if(rc < 0) {
+      int err = wolfSSL_get_error(wssl->ssl, rc);
+      char error_buffer[256];
+      switch(err) {
+      case WOLFSSL_ERROR_NONE: /* did not get anything */
+      case WOLFSSL_ERROR_WANT_READ:
+      case WOLFSSL_ERROR_WANT_WRITE:
+        return CURLE_AGAIN;
+      }
+      CURL_TRC_CF(data, cf, "SSL send early data, error: '%s'(%d)",
+                  wssl_strerror((unsigned long)err, error_buffer,
+                                sizeof(error_buffer)), err);
+      return CURLE_SEND_ERROR;
+    }
+
+    Curl_bufq_skip(&connssl->earlydata, (size_t)nwritten);
+  }
+  /* sent everything there was */
+  connssl->earlydata_state = ssl_earlydata_sent;
+  if(!Curl_ssl_cf_is_proxy(cf))
+    Curl_pgrsEarlyData(data, (curl_off_t)connssl->earlydata_skip);
+  infof(data, "SSL sending %zu bytes of early data", connssl->earlydata_skip);
+  return CURLE_OK;
+}
+#endif /* WOLFSSL_EARLY_DATA */
+
+static CURLcode wssl_handshake(struct Curl_cfilter *cf, struct Curl_easy *data)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct wssl_ctx *wssl = (struct wssl_ctx *)connssl->backend;
+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+  int ret = -1, detail;
+  CURLcode result;
+
+  DEBUGASSERT(wssl);
+  connssl->io_need = CURL_SSL_IO_NEED_NONE;
+
+#ifdef WOLFSSL_EARLY_DATA
+  if(connssl->earlydata_state == ssl_earlydata_sending) {
+    result = wssl_send_earlydata(cf, data);
+    if(result)
+      return result;
+  }
+  DEBUGASSERT((connssl->earlydata_state == ssl_earlydata_none) ||
+              (connssl->earlydata_state == ssl_earlydata_sent));
+#else
+  DEBUGASSERT(connssl->earlydata_state == ssl_earlydata_none);
+#endif /* WOLFSSL_EARLY_DATA */
+
+  wolfSSL_ERR_clear_error();
+  ret = wolfSSL_connect(wssl->ssl);
+
+  if(!wssl->x509_store_setup) {
+    /* After having send off the ClientHello, we prepare the x509
+     * store to verify the coming certificate from the server */
+    result = Curl_wssl_setup_x509_store(cf, data, wssl);
+    if(result) {
+      CURL_TRC_CF(data, cf, "Curl_wssl_setup_x509_store() -> %d", (int)result);
+      return result;
+    }
+  }
 
 #ifdef OPENSSL_EXTRA
   if(Curl_tls_keylog_enabled()) {
@@ -780,432 +1686,426 @@ wolfssl_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
      * Note that OpenSSL SSL_want_read() is always true here. If wolfSSL ever
      * changes, the worst case is that no key is logged on error.
      */
-    if(ret == SSL_SUCCESS ||
-       (!wolfSSL_want_read(backend->handle) &&
-        !wolfSSL_want_write(backend->handle))) {
-      wolfssl_log_tls12_secret(backend->handle);
+    if(ret == WOLFSSL_SUCCESS ||
+       (!wolfSSL_want_read(wssl->ssl) &&
+        !wolfSSL_want_write(wssl->ssl))) {
+      wssl_log_tls12_secret(wssl->ssl);
       /* Client Random and master secrets are no longer needed, erase these.
        * Ignored while the handshake is still in progress. */
-      wolfSSL_FreeArrays(backend->handle);
+      wolfSSL_FreeArrays(wssl->ssl);
     }
   }
-#endif  /* OPENSSL_EXTRA */
+#endif /* OPENSSL_EXTRA */
 
-  if(ret != 1) {
-    char error_buffer[WOLFSSL_MAX_ERROR_SZ];
-    int  detail = wolfSSL_get_error(backend->handle, ret);
+  detail = wolfSSL_get_error(wssl->ssl, ret);
+  CURL_TRC_CF(data, cf, "wolfSSL_connect() -> %d, detail=%d", ret, detail);
 
-    if(SSL_ERROR_WANT_READ == detail) {
-      connssl->connecting_state = ssl_connect_2_reading;
-      return CURLE_OK;
-    }
-    else if(SSL_ERROR_WANT_WRITE == detail) {
-      connssl->connecting_state = ssl_connect_2_writing;
-      return CURLE_OK;
-    }
-    /* There is no easy way to override only the CN matching.
-     * This will enable the override of both mismatching SubjectAltNames
-     * as also mismatching CN fields */
-    else if(DOMAIN_NAME_MISMATCH == detail) {
-#if 1
-      failf(data, " subject alt name(s) or common name do not match \"%s\"",
-            connssl->dispname);
+  /* On a successful handshake with an IP address, do an extra check
+   * on the peer certificate */
+  if(ret == WOLFSSL_SUCCESS &&
+     conn_config->verifyhost &&
+     !connssl->peer.sni) {
+    /* we have an IP address as hostname. */
+    WOLFSSL_X509 *cert = wolfSSL_get_peer_certificate(wssl->ssl);
+    if(!cert) {
+      failf(data, "unable to get peer certificate");
+      return CURLE_PEER_FAILED_VERIFICATION;
+    }
+    ret = wolfSSL_X509_check_ip_asc(cert, connssl->peer.origin->hostname, 0);
+    CURL_TRC_CF(data, cf, "check peer certificate for IP match on %s -> %d",
+                connssl->peer.origin->hostname, ret);
+    if(ret != WOLFSSL_SUCCESS)
+      detail = DOMAIN_NAME_MISMATCH;
+    wolfSSL_X509_free(cert);
+  }
+
+  if(ret == WOLFSSL_SUCCESS) {
+    return CURLE_OK;
+  }
+  else {
+    if(WOLFSSL_ERROR_WANT_READ == detail) {
+      connssl->io_need = CURL_SSL_IO_NEED_RECV;
+      return CURLE_AGAIN;
+    }
+    else if(WOLFSSL_ERROR_WANT_WRITE == detail) {
+      connssl->io_need = CURL_SSL_IO_NEED_SEND;
+      return CURLE_AGAIN;
+    }
+    else if(DOMAIN_NAME_MISMATCH == detail) {
+      /* There is no easy way to override only the CN matching.
+       * This enables the override of both mismatching SubjectAltNames
+       * as also mismatching CN fields */
+      failf(data, " subject alt name(s) or common name do not match \"%s\"",
+            connssl->peer.origin->hostname);
       return CURLE_PEER_FAILED_VERIFICATION;
-#else
-      /* When the wolfssl_check_domain_name() is used and you desire to
-       * continue on a DOMAIN_NAME_MISMATCH, i.e. 'ssl_config.verifyhost
-       * == 0', CyaSSL version 2.4.0 will fail with an INCOMPLETE_DATA
-       * error. The only way to do this is currently to switch the
-       * Wolfssl_check_domain_name() in and out based on the
-       * 'ssl_config.verifyhost' value. */
-      if(conn_config->verifyhost) {
-        failf(data,
-              " subject alt name(s) or common name do not match \"%s\"\n",
-              connssl->dispname);
-        return CURLE_PEER_FAILED_VERIFICATION;
-      }
-      else {
-        infof(data,
-              " subject alt name(s) and/or common name do not match \"%s\"",
-              connssl->dispname);
-        return CURLE_OK;
-      }
-#endif
     }
-#if LIBWOLFSSL_VERSION_HEX >= 0x02007000 /* 2.7.0 */
     else if(ASN_NO_SIGNER_E == detail) {
       if(conn_config->verifypeer) {
         failf(data, " CA signer not available for verification");
         return CURLE_SSL_CACERT_BADFILE;
       }
-      else {
-        /* Just continue with a warning if no strict certificate
-           verification is required. */
-        infof(data, "CA signer not available for verification, "
-                    "continuing anyway");
-      }
-    }
-#endif
-    else if(backend->io_result == CURLE_AGAIN) {
+      /* Continue with a warning if no strict certificate
+         verification is required. */
+      infof(data, "CA signer not available for verification, "
+                  "continuing anyway");
       return CURLE_OK;
     }
+    else if(ASN_AFTER_DATE_E == detail) {
+      failf(data, "server verification failed: certificate has expired.");
+      return CURLE_PEER_FAILED_VERIFICATION;
+    }
+    else if(ASN_BEFORE_DATE_E == detail) {
+      failf(data, "server verification failed: certificate not valid yet.");
+      return CURLE_PEER_FAILED_VERIFICATION;
+    }
+    else if(wssl->io_result) {
+      switch(wssl->io_result) {
+      case CURLE_SEND_ERROR:
+      case CURLE_RECV_ERROR:
+        return CURLE_SSL_CONNECT_ERROR;
+      default:
+        return wssl->io_result;
+      }
+    }
+#ifdef HAVE_WOLFSSL_CTX_GENERATEECHCONFIG
+    else if(detail == -1) {
+      /* try access a retry_config ECHConfigList for tracing */
+      byte echConfigs[1000];
+      word32 echConfigsLen = 1000;
+      int rv = 0;
+
+      /* this currently does not produce the retry_configs */
+      rv = wolfSSL_GetEchConfigs(wssl->ssl, echConfigs, &echConfigsLen);
+      if(rv != WOLFSSL_SUCCESS) {
+        infof(data, "Failed to get ECHConfigs");
+      }
+      else {
+        char *b64str = NULL;
+        size_t blen = 0;
+
+        result = curlx_base64_encode(echConfigs, echConfigsLen,
+                                     &b64str, &blen);
+        if(!result && b64str)
+          infof(data, "ECH: (not yet) retry_configs %s", b64str);
+        curlx_free(b64str);
+      }
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+#endif
     else {
+      char error_buffer[256];
       failf(data, "SSL_connect failed with error %d: %s", detail,
-            wolfSSL_ERR_error_string(detail, error_buffer));
+            wssl_strerror((unsigned long)detail, error_buffer,
+                          sizeof(error_buffer)));
       return CURLE_SSL_CONNECT_ERROR;
     }
   }
-
-  if(pinnedpubkey) {
-#ifdef KEEP_PEER_CERT
-    X509 *x509;
-    const char *x509_der;
-    int x509_der_len;
-    struct Curl_X509certificate x509_parsed;
-    struct Curl_asn1Element *pubkey;
-    CURLcode result;
-
-    x509 = wolfSSL_get_peer_certificate(backend->handle);
-    if(!x509) {
-      failf(data, "SSL: failed retrieving server certificate");
-      return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
-    }
-
-    x509_der = (const char *)wolfSSL_X509_get_der(x509, &x509_der_len);
-    if(!x509_der) {
-      failf(data, "SSL: failed retrieving ASN.1 server certificate");
-      return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
-    }
-
-    memset(&x509_parsed, 0, sizeof(x509_parsed));
-    if(Curl_parseX509(&x509_parsed, x509_der, x509_der + x509_der_len))
-      return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
-
-    pubkey = &x509_parsed.subjectPublicKeyInfo;
-    if(!pubkey->header || pubkey->end <= pubkey->header) {
-      failf(data, "SSL: failed retrieving public key from server certificate");
-      return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
-    }
-
-    result = Curl_pin_peer_pubkey(data,
-                                  pinnedpubkey,
-                                  (const unsigned char *)pubkey->header,
-                                  (size_t)(pubkey->end - pubkey->header));
-    if(result) {
-      failf(data, "SSL: public key does not match pinned public key");
-      return result;
-    }
-#else
-    failf(data, "Library lacks pinning support built-in");
-    return CURLE_NOT_BUILT_IN;
-#endif
-  }
-
-#ifdef HAVE_ALPN
-  if(connssl->alpn) {
-    int rc;
-    char *protocol = NULL;
-    unsigned short protocol_len = 0;
-
-    rc = wolfSSL_ALPN_GetProtocol(backend->handle, &protocol, &protocol_len);
-
-    if(rc == SSL_SUCCESS) {
-      Curl_alpn_set_negotiated(cf, data, (const unsigned char *)protocol,
-                               protocol_len);
-    }
-    else if(rc == SSL_ALPN_NOT_FOUND)
-      Curl_alpn_set_negotiated(cf, data, NULL, 0);
-    else {
-      failf(data, "ALPN, failure getting protocol, error %d", rc);
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-  }
-#endif /* HAVE_ALPN */
-
-  connssl->connecting_state = ssl_connect_3;
-#if (LIBWOLFSSL_VERSION_HEX >= 0x03009010)
-  infof(data, "SSL connection using %s / %s",
-        wolfSSL_get_version(backend->handle),
-        wolfSSL_get_cipher_name(backend->handle));
-#else
-  infof(data, "SSL connected");
-#endif
-
-  return CURLE_OK;
 }
 
-
-static CURLcode
-wolfssl_connect_step3(struct Curl_cfilter *cf, struct Curl_easy *data)
+static CURLcode wssl_send(struct Curl_cfilter *cf,
+                          struct Curl_easy *data,
+                          const void *buf, size_t blen,
+                          size_t *pnwritten)
 {
-  CURLcode result = CURLE_OK;
   struct ssl_connect_data *connssl = cf->ctx;
-  struct wolfssl_ssl_backend_data *backend =
-    (struct wolfssl_ssl_backend_data *)connssl->backend;
-  const struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+  struct wssl_ctx *wssl = (struct wssl_ctx *)connssl->backend;
+  CURLcode result = CURLE_OK;
+  int nwritten;
 
-  DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);
-  DEBUGASSERT(backend);
+  DEBUGASSERT(wssl);
+  *pnwritten = 0;
+  wolfSSL_ERR_clear_error();
 
-  if(ssl_config->primary.sessionid) {
-    bool incache;
-    bool added = FALSE;
-    void *old_ssl_sessionid = NULL;
-    /* wolfSSL_get1_session allocates memory that has to be freed. */
-    WOLFSSL_SESSION *our_ssl_sessionid = wolfSSL_get1_session(backend->handle);
+  if(blen) {
+    int memlen = (blen > (size_t)INT_MAX) ? INT_MAX : (int)blen;
 
-    if(our_ssl_sessionid) {
-      Curl_ssl_sessionid_lock(data);
-      incache = !(Curl_ssl_getsessionid(cf, data, &old_ssl_sessionid, NULL));
-      if(incache) {
-        if(old_ssl_sessionid != our_ssl_sessionid) {
-          infof(data, "old SSL session ID is stale, removing");
-          Curl_ssl_delsessionid(data, old_ssl_sessionid);
-          incache = FALSE;
+    nwritten = wolfSSL_write(wssl->ssl, buf, memlen);
+
+    if(nwritten > 0)
+      *pnwritten += (size_t)nwritten;
+    else {
+      int err = wolfSSL_get_error(wssl->ssl, nwritten);
+
+      switch(err) {
+      case WOLFSSL_ERROR_WANT_READ:
+      case WOLFSSL_ERROR_WANT_WRITE:
+        /* there is data pending, re-invoke wolfSSL_write() */
+        if(*pnwritten) {
+          result = CURLE_OK;
+          goto out;
         }
-      }
+        result = CURLE_AGAIN;
+        goto out;
 
-      if(!incache) {
-        result = Curl_ssl_addsessionid(cf, data, our_ssl_sessionid, 0, NULL);
-        if(result) {
-          Curl_ssl_sessionid_unlock(data);
-          wolfSSL_SESSION_free(our_ssl_sessionid);
-          failf(data, "failed to store ssl session");
-          return result;
+      default:
+        if(wssl->io_result == CURLE_AGAIN) {
+          if(*pnwritten) {
+            result = CURLE_OK;
+            goto out;
+          }
+          result = CURLE_AGAIN;
+          goto out;
         }
-        else {
-          added = TRUE;
+        {
+          char error_buffer[256];
+          failf(data, "SSL write: %s, errno %d",
+                wssl_strerror((unsigned long)err, error_buffer,
+                              sizeof(error_buffer)),
+                SOCKERRNO);
         }
-      }
-      Curl_ssl_sessionid_unlock(data);
-
-      if(!added) {
-        /* If the session info wasn't added to the cache, free our copy. */
-        wolfSSL_SESSION_free(our_ssl_sessionid);
+        result = CURLE_SEND_ERROR;
+        goto out;
       }
     }
   }
 
-  connssl->connecting_state = ssl_connect_done;
-
+out:
+  CURL_TRC_CF(data, cf, "wssl_send(len=%zu) -> %d, %zu",
+              blen, (int)result, *pnwritten);
   return result;
 }
 
-
-static ssize_t wolfssl_send(struct Curl_cfilter *cf,
-                            struct Curl_easy *data,
-                            const void *mem,
-                            size_t len,
-                            CURLcode *curlcode)
+static CURLcode wssl_shutdown(struct Curl_cfilter *cf,
+                              struct Curl_easy *data,
+                              bool send_shutdown, bool *done)
 {
   struct ssl_connect_data *connssl = cf->ctx;
-  struct wolfssl_ssl_backend_data *backend =
-    (struct wolfssl_ssl_backend_data *)connssl->backend;
-  char error_buffer[WOLFSSL_MAX_ERROR_SZ];
-  int memlen = (len > (size_t)INT_MAX) ? INT_MAX : (int)len;
-  int rc;
+  struct wssl_ctx *wctx = (struct wssl_ctx *)connssl->backend;
+  CURLcode result = CURLE_OK;
+  char buf[1024];
+  int nread = -1, err;
+  size_t i;
+  VERBOSE(char error_buffer[256]);
 
-  DEBUGASSERT(backend);
+  DEBUGASSERT(wctx);
+  if(!wctx->ssl || cf->shutdown) {
+    *done = TRUE;
+    goto out;
+  }
 
-  wolfSSL_ERR_clear_error();
-
-  rc = wolfSSL_write(backend->handle, mem, memlen);
-  if(rc <= 0) {
-    int err = wolfSSL_get_error(backend->handle, rc);
-
-    switch(err) {
-    case SSL_ERROR_WANT_READ:
-    case SSL_ERROR_WANT_WRITE:
-      /* there's data pending, re-invoke SSL_write() */
-      CURL_TRC_CF(data, cf, "wolfssl_send(len=%zu) -> AGAIN", len);
-      *curlcode = CURLE_AGAIN;
-      return -1;
-    default:
-      if(backend->io_result == CURLE_AGAIN) {
-        CURL_TRC_CF(data, cf, "wolfssl_send(len=%zu) -> AGAIN", len);
-        *curlcode = CURLE_AGAIN;
-        return -1;
+  wctx->shutting_down = TRUE;
+  connssl->io_need = CURL_SSL_IO_NEED_NONE;
+  *done = FALSE;
+  if(!(wolfSSL_get_shutdown(wctx->ssl) & WOLFSSL_SENT_SHUTDOWN)) {
+    /* We have not started the shutdown from our side yet. Check
+     * if the server already sent us one. */
+    wolfSSL_ERR_clear_error();
+    nread = wolfSSL_read(wctx->ssl, buf, (int)sizeof(buf));
+    err = wolfSSL_get_error(wctx->ssl, nread);
+    CURL_TRC_CF(data, cf, "wolfSSL_read, nread=%d, err=%d", nread, err);
+    if(!nread && err == WOLFSSL_ERROR_ZERO_RETURN) {
+      bool input_pending;
+      /* Yes, it did. */
+      if(!send_shutdown) {
+        CURL_TRC_CF(data, cf, "SSL shutdown received, not sending");
+        *done = TRUE;
+        goto out;
+      }
+      else if(!cf->next->cft->is_alive(cf->next, data, &input_pending)) {
+        /* Server closed the connection after its closy notify. It
+         * seems not interested to see our close notify, so do not
+         * send it. We are done. */
+        CURL_TRC_CF(data, cf, "peer closed connection");
+        connssl->peer_closed = TRUE;
+        *done = TRUE;
+        goto out;
       }
-      CURL_TRC_CF(data, cf, "wolfssl_send(len=%zu) -> %d, %d", len, rc, err);
-      failf(data, "SSL write: %s, errno %d",
-            wolfSSL_ERR_error_string(err, error_buffer),
-            SOCKERRNO);
-      *curlcode = CURLE_SEND_ERROR;
-      return -1;
     }
   }
-  CURL_TRC_CF(data, cf, "wolfssl_send(len=%zu) -> %d", len, rc);
-  return rc;
+
+  /* wolfSSL should now have started the shutdown from our side. Since it
+   * was not complete, we are lacking the close notify from the server. */
+  if(send_shutdown) {
+    wolfSSL_ERR_clear_error();
+    nread = wolfSSL_shutdown(wctx->ssl);
+    if(nread == 1) {
+      CURL_TRC_CF(data, cf, "SSL shutdown finished");
+      *done = TRUE;
+      goto out;
+    }
+    if(WOLFSSL_ERROR_WANT_WRITE == wolfSSL_get_error(wctx->ssl, nread)) {
+      CURL_TRC_CF(data, cf, "SSL shutdown still wants to send");
+      connssl->io_need = CURL_SSL_IO_NEED_SEND;
+      goto out;
+    }
+    /* Having sent the close notify, we use wolfSSL_read() to get the
+     * missing close notify from the server. */
+  }
+
+  for(i = 0; i < 10; ++i) {
+    wolfSSL_ERR_clear_error();
+    nread = wolfSSL_read(wctx->ssl, buf, (int)sizeof(buf));
+    if(nread <= 0)
+      break;
+  }
+  err = wolfSSL_get_error(wctx->ssl, nread);
+  switch(err) {
+  case WOLFSSL_ERROR_ZERO_RETURN: /* no more data */
+    CURL_TRC_CF(data, cf, "SSL shutdown received");
+    *done = TRUE;
+    break;
+  case WOLFSSL_ERROR_NONE: /* did not get anything */
+  case WOLFSSL_ERROR_WANT_READ:
+    /* wolfSSL has send its notify and now wants to read the reply
+     * from the server. We are not really interested in that. */
+    CURL_TRC_CF(data, cf, "SSL shutdown sent, want receive");
+    connssl->io_need = CURL_SSL_IO_NEED_RECV;
+    break;
+  case WOLFSSL_ERROR_WANT_WRITE:
+    CURL_TRC_CF(data, cf, "SSL shutdown send blocked");
+    connssl->io_need = CURL_SSL_IO_NEED_SEND;
+    break;
+  default:
+    CURL_TRC_CF(data, cf, "SSL shutdown, error: '%s'(%d)",
+                wssl_strerror((unsigned long)err, error_buffer,
+                              sizeof(error_buffer)),
+                err);
+    result = CURLE_RECV_ERROR;
+    break;
+  }
+
+out:
+  cf->shutdown = (result || *done);
+  return result;
 }
 
-static void wolfssl_close(struct Curl_cfilter *cf, struct Curl_easy *data)
+static void wssl_close(struct Curl_cfilter *cf, struct Curl_easy *data)
 {
   struct ssl_connect_data *connssl = cf->ctx;
-  struct wolfssl_ssl_backend_data *backend =
-    (struct wolfssl_ssl_backend_data *)connssl->backend;
+  struct wssl_ctx *wssl = (struct wssl_ctx *)connssl->backend;
 
-  (void) data;
+  (void)data;
 
-  DEBUGASSERT(backend);
+  DEBUGASSERT(wssl);
 
-  if(backend->handle) {
-    char buf[32];
-    /* Maybe the server has already sent a close notify alert.
-       Read it to avoid an RST on the TCP connection. */
-    (void)wolfSSL_read(backend->handle, buf, (int)sizeof(buf));
-    (void)wolfSSL_shutdown(backend->handle);
-    wolfSSL_free(backend->handle);
-    backend->handle = NULL;
+  if(wssl->ssl) {
+    wolfSSL_free(wssl->ssl);
+    wssl->ssl = NULL;
   }
-  if(backend->ctx) {
-    wolfSSL_CTX_free(backend->ctx);
-    backend->ctx = NULL;
+  if(wssl->ssl_ctx) {
+    wolfSSL_CTX_free(wssl->ssl_ctx);
+    wssl->ssl_ctx = NULL;
   }
 }
 
-static ssize_t wolfssl_recv(struct Curl_cfilter *cf,
-                            struct Curl_easy *data,
-                            char *buf, size_t blen,
-                            CURLcode *curlcode)
+static CURLcode wssl_recv(struct Curl_cfilter *cf,
+                          struct Curl_easy *data,
+                          char *buf, size_t blen,
+                          size_t *pnread)
 {
   struct ssl_connect_data *connssl = cf->ctx;
-  struct wolfssl_ssl_backend_data *backend =
-    (struct wolfssl_ssl_backend_data *)connssl->backend;
-  char error_buffer[WOLFSSL_MAX_ERROR_SZ];
+  struct wssl_ctx *wssl = (struct wssl_ctx *)connssl->backend;
   int buffsize = (blen > (size_t)INT_MAX) ? INT_MAX : (int)blen;
   int nread;
 
-  DEBUGASSERT(backend);
+  DEBUGASSERT(wssl);
 
+  *pnread = 0;
   wolfSSL_ERR_clear_error();
-  *curlcode = CURLE_OK;
 
-  nread = wolfSSL_read(backend->handle, buf, buffsize);
+  nread = wolfSSL_read(wssl->ssl, buf, buffsize);
 
-  if(nread <= 0) {
-    int err = wolfSSL_get_error(backend->handle, nread);
+  if(nread > 0)
+    *pnread = (size_t)nread;
+  else {
+    int err = wolfSSL_get_error(wssl->ssl, nread);
 
     switch(err) {
-    case SSL_ERROR_ZERO_RETURN: /* no more data */
-      CURL_TRC_CF(data, cf, "wolfssl_recv(len=%zu) -> CLOSED", blen);
-      *curlcode = CURLE_OK;
-      return 0;
-    case SSL_ERROR_NONE:
-      /* FALLTHROUGH */
-    case SSL_ERROR_WANT_READ:
-      /* FALLTHROUGH */
-    case SSL_ERROR_WANT_WRITE:
-      /* there's data pending, re-invoke wolfSSL_read() */
-      CURL_TRC_CF(data, cf, "wolfssl_recv(len=%zu) -> AGAIN", blen);
-      *curlcode = CURLE_AGAIN;
-      return -1;
-    default:
-      if(backend->io_result == CURLE_AGAIN) {
-        CURL_TRC_CF(data, cf, "wolfssl_recv(len=%zu) -> AGAIN", blen);
-        *curlcode = CURLE_AGAIN;
-        return -1;
+    case WOLFSSL_ERROR_ZERO_RETURN: /* no more data */
+      CURL_TRC_CF(data, cf, "wssl_recv(len=%zu) -> CLOSED", blen);
+      return CURLE_OK;
+    case WOLFSSL_ERROR_NONE:
+    case WOLFSSL_ERROR_WANT_READ:
+    case WOLFSSL_ERROR_WANT_WRITE:
+      if(!wssl->io_result && !connssl->peer_closed) {
+        /* there is data pending, re-invoke wolfSSL_read() */
+        CURL_TRC_CF(data, cf, "wssl_recv(len=%zu) -> AGAIN", blen);
+        return CURLE_AGAIN;
       }
-      failf(data, "SSL read: %s, errno %d",
-            wolfSSL_ERR_error_string(err, error_buffer), SOCKERRNO);
-      *curlcode = CURLE_RECV_ERROR;
-      return -1;
+      /* fall through to default error handling below */
+      FALLTHROUGH();
+    default:
+      if(wssl->io_result == CURLE_AGAIN) {
+        CURL_TRC_CF(data, cf, "wssl_recv(len=%zu) -> AGAIN", blen);
+        return CURLE_AGAIN;
+      }
+      else if(!wssl->io_result && connssl->peer_closed) {
+        CURL_TRC_CF(data, cf, "wssl_recv(len=%zu) -> CLOSED", blen);
+        failf(data, "Connection closed abruptly");
+      }
+      else {
+        char error_buffer[256];
+        failf(data, "SSL read: %s, errno %d",
+              wssl_strerror((unsigned long)err, error_buffer,
+                            sizeof(error_buffer)),
+              SOCKERRNO);
+      }
+      return CURLE_RECV_ERROR;
     }
   }
-  CURL_TRC_CF(data, cf, "wolfssl_recv(len=%zu) -> %d", blen, nread);
-  return nread;
+
+  CURL_TRC_CF(data, cf, "wssl_recv(len=%zu) -> 0, %zu", blen, *pnread);
+  return CURLE_OK;
 }
 
-
-static void wolfssl_session_free(void *ptr)
+size_t Curl_wssl_version(char *buffer, size_t size)
 {
-  wolfSSL_SESSION_free(ptr);
+  return curl_msnprintf(buffer, size, "wolfSSL/%s", wolfSSL_lib_version());
 }
 
-
-static size_t wolfssl_version(char *buffer, size_t size)
-{
-#if LIBWOLFSSL_VERSION_HEX >= 0x03006000
-  return msnprintf(buffer, size, "wolfSSL/%s", wolfSSL_lib_version());
-#elif defined(WOLFSSL_VERSION)
-  return msnprintf(buffer, size, "wolfSSL/%s", WOLFSSL_VERSION);
-#endif
-}
-
-
-static int wolfssl_init(void)
+static int wssl_init(void)
 {
   int ret;
 
 #ifdef OPENSSL_EXTRA
   Curl_tls_keylog_open();
 #endif
-  ret = (wolfSSL_Init() == SSL_SUCCESS);
-  bio_cf_init_methods();
+  ret = (wolfSSL_Init() == WOLFSSL_SUCCESS);
+  if(ret)
+    ret = wssl_bio_cf_init_methods();
   return ret;
 }
 
-
-static void wolfssl_cleanup(void)
+static void wssl_cleanup(void)
 {
-  bio_cf_free_methods();
+  wssl_bio_cf_free_methods();
   wolfSSL_Cleanup();
 #ifdef OPENSSL_EXTRA
   Curl_tls_keylog_close();
 #endif
 }
 
-
-static bool wolfssl_data_pending(struct Curl_cfilter *cf,
-                                 const struct Curl_easy *data)
+static bool wssl_data_pending(struct Curl_cfilter *cf,
+                              const struct Curl_easy *data)
 {
   struct ssl_connect_data *ctx = cf->ctx;
-  struct wolfssl_ssl_backend_data *backend;
+  struct wssl_ctx *wssl;
 
   (void)data;
   DEBUGASSERT(ctx && ctx->backend);
 
-  backend = (struct wolfssl_ssl_backend_data *)ctx->backend;
-  if(backend->handle)   /* SSL is in use */
-    return (0 != wolfSSL_pending(backend->handle)) ? TRUE : FALSE;
+  wssl = (struct wssl_ctx *)ctx->backend;
+  if(wssl->ssl)   /* wolfSSL is in use */
+    return wolfSSL_pending(wssl->ssl);
   else
     return FALSE;
 }
 
-
-/*
- * This function is called to shut down the SSL layer but keep the
- * socket open (CCC - Clear Command Channel)
- */
-static int wolfssl_shutdown(struct Curl_cfilter *cf,
-                            struct Curl_easy *data)
+void Curl_wssl_report_handshake(struct Curl_easy *data, struct wssl_ctx *wssl)
 {
-  struct ssl_connect_data *ctx = cf->ctx;
-  struct wolfssl_ssl_backend_data *backend;
-  int retval = 0;
-
-  (void)data;
-  DEBUGASSERT(ctx && ctx->backend);
-
-  backend = (struct wolfssl_ssl_backend_data *)ctx->backend;
-  if(backend->handle) {
-    wolfSSL_ERR_clear_error();
-    wolfSSL_free(backend->handle);
-    backend->handle = NULL;
-  }
-  return retval;
+  (void)wssl;
+  infof(data, "SSL connection using %s / %s",
+        wolfSSL_get_version(wssl->ssl),
+        wolfSSL_get_cipher_name(wssl->ssl));
 }
 
-
-static CURLcode
-wolfssl_connect_common(struct Curl_cfilter *cf,
-                       struct Curl_easy *data,
-                       bool nonblocking,
-                       bool *done)
+static CURLcode wssl_connect(struct Curl_cfilter *cf,
+                             struct Curl_easy *data,
+                             bool *done)
 {
-  CURLcode result;
   struct ssl_connect_data *connssl = cf->ctx;
-  curl_socket_t sockfd = Curl_conn_cf_get_socket(cf, data);
-  int what;
+  struct wssl_ctx *wssl = (struct wssl_ctx *)connssl->backend;
+  CURLcode result = CURLE_OK;
 
   /* check if the connection has already been established */
   if(ssl_connection_complete == connssl->state) {
@@ -1213,124 +2113,111 @@ wolfssl_connect_common(struct Curl_cfilter *cf,
     return CURLE_OK;
   }
 
+  *done = FALSE;
+  connssl->io_need = CURL_SSL_IO_NEED_NONE;
+
   if(ssl_connect_1 == connssl->connecting_state) {
-    /* Find out how much more time we're allowed */
-    const timediff_t timeout_ms = Curl_timeleft(data, NULL, TRUE);
-
-    if(timeout_ms < 0) {
-      /* no need to continue if time already is up */
-      failf(data, "SSL connection timeout");
-      return CURLE_OPERATION_TIMEDOUT;
+#ifdef HAVE_WOLFSSL_CTX_GENERATEECHCONFIG
+    /* if we do ECH and need the HTTPS-RR information for it,
+     * we delay the connect until it arrives or DNS resolve fails. */
+    if(Curl_wssl_need_httpsrr(data) &&
+       !Curl_conn_dns_resolved_https(data, cf->sockindex,
+                                     connssl->peer.peer)) {
+      CURL_TRC_CF(data, cf, "need HTTPS-RR for ECH, delaying connect");
+      return CURLE_OK;
     }
-
-    result = wolfssl_connect_step1(cf, data);
+#endif /* HAVE_WOLFSSL_CTX_GENERATEECHCONFIG */
+    result = wssl_connect_step1(cf, data);
     if(result)
       return result;
+    connssl->connecting_state = ssl_connect_2;
   }
 
-  while(ssl_connect_2 == connssl->connecting_state ||
-        ssl_connect_2_reading == connssl->connecting_state ||
-        ssl_connect_2_writing == connssl->connecting_state) {
-
-    /* check allowed time left */
-    const timediff_t timeout_ms = Curl_timeleft(data, NULL, TRUE);
-
-    if(timeout_ms < 0) {
-      /* no need to continue if time already is up */
-      failf(data, "SSL connection timeout");
-      return CURLE_OPERATION_TIMEDOUT;
+  if(ssl_connect_2 == connssl->connecting_state) {
+    if(connssl->earlydata_state == ssl_earlydata_await) {
+      /* We defer the handshake until request data arrives. */
+      DEBUGASSERT(connssl->state == ssl_connection_deferred);
+      goto out;
     }
-
-    /* if ssl is expecting something, check if it's available. */
-    if(connssl->connecting_state == ssl_connect_2_reading
-       || connssl->connecting_state == ssl_connect_2_writing) {
-
-      curl_socket_t writefd = ssl_connect_2_writing ==
-        connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
-      curl_socket_t readfd = ssl_connect_2_reading ==
-        connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
-
-      what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd,
-                               nonblocking?0:timeout_ms);
-      if(what < 0) {
-        /* fatal error */
-        failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
-        return CURLE_SSL_CONNECT_ERROR;
-      }
-      else if(0 == what) {
-        if(nonblocking) {
-          *done = FALSE;
-          return CURLE_OK;
-        }
-        else {
-          /* timeout */
-          failf(data, "SSL connection timeout");
-          return CURLE_OPERATION_TIMEDOUT;
-        }
-      }
-      /* socket is readable or writable */
-    }
-
-    /* Run transaction, and return to the caller if it failed or if
-     * this connection is part of a multi handle and this loop would
-     * execute again. This permits the owner of a multi handle to
-     * abort a connection attempt before step2 has completed while
-     * ensuring that a client using select() or epoll() will always
-     * have a valid fdset to wait on.
-     */
-    result = wolfssl_connect_step2(cf, data);
-    if(result || (nonblocking &&
-                  (ssl_connect_2 == connssl->connecting_state ||
-                   ssl_connect_2_reading == connssl->connecting_state ||
-                   ssl_connect_2_writing == connssl->connecting_state)))
-      return result;
-  } /* repeat step2 until all transactions are done. */
+    result = wssl_handshake(cf, data);
+    if(result == CURLE_AGAIN)
+      goto out;
+    wssl->hs_result = result;
+    connssl->connecting_state = ssl_connect_3;
+  }
 
   if(ssl_connect_3 == connssl->connecting_state) {
-    result = wolfssl_connect_step3(cf, data);
-    if(result)
-      return result;
+    /* Once the handshake has errored, it stays in that state and
+     * errors again on every call. */
+    if(wssl->hs_result) {
+      result = wssl->hs_result;
+      goto out;
+    }
+    result = Curl_wssl_verify_pinned(cf, data, wssl);
+    if(result) {
+      wssl->hs_result = result;
+      goto out;
+    }
+    /* handshake was done without errors */
+#ifdef HAVE_ALPN
+    if(connssl->alpn) {
+      int rc;
+      char *protocol = NULL;
+      unsigned short protocol_len = 0;
+
+      rc = wolfSSL_ALPN_GetProtocol(wssl->ssl, &protocol, &protocol_len);
+
+      if(rc == WOLFSSL_SUCCESS) {
+        Curl_alpn_set_negotiated(cf, data, connssl,
+                                 (const unsigned char *)protocol,
+                                 protocol_len);
+      }
+      else if(rc == WOLFSSL_ALPN_NOT_FOUND)
+        Curl_alpn_set_negotiated(cf, data, connssl, NULL, 0);
+      else {
+        failf(data, "ALPN, failure getting protocol, error %d", rc);
+        wssl->hs_result = result = CURLE_SSL_CONNECT_ERROR;
+        goto out;
+      }
+    }
+#endif /* HAVE_ALPN */
+
+    connssl->connecting_state = ssl_connect_done;
+    connssl->state = ssl_connection_complete;
+    Curl_wssl_report_handshake(data, wssl);
+
+#ifdef WOLFSSL_EARLY_DATA
+    if(connssl->earlydata_state > ssl_earlydata_none) {
+      /* We should be in this state by now */
+      DEBUGASSERT(connssl->earlydata_state == ssl_earlydata_sent);
+      connssl->earlydata_state =
+        (wolfSSL_get_early_data_status(wssl->ssl) ==
+         WOLFSSL_EARLY_DATA_REJECTED) ?
+         ssl_earlydata_rejected : ssl_earlydata_accepted;
+    }
+#endif /* WOLFSSL_EARLY_DATA */
   }
 
-  if(ssl_connect_done == connssl->connecting_state) {
-    connssl->state = ssl_connection_complete;
+  if((connssl->connecting_state == ssl_connect_done) ||
+     (connssl->state == ssl_connection_deferred)) {
     *done = TRUE;
   }
-  else
+
+out:
+  if(result) {
     *done = FALSE;
-
-  /* Reset our connect state machine */
-  connssl->connecting_state = ssl_connect_1;
-
-  return CURLE_OK;
+    if(result == CURLE_AGAIN)
+      return CURLE_OK;
+  }
+  else if((connssl->connecting_state == ssl_connect_done) ||
+          (connssl->state == ssl_connection_deferred)) {
+    *done = TRUE;
+  }
+  return result;
 }
 
-
-static CURLcode wolfssl_connect_nonblocking(struct Curl_cfilter *cf,
-                                            struct Curl_easy *data,
-                                            bool *done)
-{
-  return wolfssl_connect_common(cf, data, TRUE, done);
-}
-
-
-static CURLcode wolfssl_connect(struct Curl_cfilter *cf,
-                                struct Curl_easy *data)
-{
-  CURLcode result;
-  bool done = FALSE;
-
-  result = wolfssl_connect_common(cf, data, FALSE, &done);
-  if(result)
-    return result;
-
-  DEBUGASSERT(done);
-
-  return CURLE_OK;
-}
-
-static CURLcode wolfssl_random(struct Curl_easy *data,
-                               unsigned char *entropy, size_t length)
+static CURLcode wssl_random(struct Curl_easy *data,
+                            unsigned char *entropy, size_t length)
 {
   WC_RNG rng;
   (void)data;
@@ -1345,32 +2232,38 @@ static CURLcode wolfssl_random(struct Curl_easy *data,
   return CURLE_OK;
 }
 
-static CURLcode wolfssl_sha256sum(const unsigned char *tmp, /* input */
-                                  size_t tmplen,
-                                  unsigned char *sha256sum /* output */,
-                                  size_t unused)
+static CURLcode wssl_sha256sum(const unsigned char *input,
+                               size_t len,
+                               unsigned char *sha256sum /* output */,
+                               size_t unused)
 {
   wc_Sha256 SHA256pw;
   (void)unused;
   if(wc_InitSha256(&SHA256pw))
     return CURLE_FAILED_INIT;
-  wc_Sha256Update(&SHA256pw, tmp, (word32)tmplen);
-  wc_Sha256Final(&SHA256pw, sha256sum);
+  do {
+    word32 ilen = (word32)CURLMIN(len, UINT32_MAX);
+    if(wc_Sha256Update(&SHA256pw, input, ilen))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    len -= ilen;
+    input += ilen;
+  } while(len);
+  if(wc_Sha256Final(&SHA256pw, sha256sum))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
   return CURLE_OK;
 }
 
-static void *wolfssl_get_internals(struct ssl_connect_data *connssl,
-                                   CURLINFO info UNUSED_PARAM)
+static void *wssl_get_internals(struct ssl_connect_data *connssl,
+                                CURLINFO info)
 {
-  struct wolfssl_ssl_backend_data *backend =
-    (struct wolfssl_ssl_backend_data *)connssl->backend;
-  (void)info;
-  DEBUGASSERT(backend);
-  return backend->handle;
+  struct wssl_ctx *wssl = (struct wssl_ctx *)connssl->backend;
+  DEBUGASSERT(wssl);
+  return info == CURLINFO_TLS_SESSION ?
+    (void *)wssl->ssl_ctx : (void *)wssl->ssl;
 }
 
 const struct Curl_ssl Curl_ssl_wolfssl = {
-  { CURLSSLBACKEND_WOLFSSL, "WolfSSL" }, /* info */
+  { CURLSSLBACKEND_WOLFSSL, "wolfssl" }, /* info */
 
 #ifdef KEEP_PEER_CERT
   SSLSUPP_PINNEDPUBKEY |
@@ -1378,36 +2271,40 @@ const struct Curl_ssl Curl_ssl_wolfssl = {
 #ifdef USE_BIO_CHAIN
   SSLSUPP_HTTPS_PROXY |
 #endif
+  SSLSUPP_CA_PATH |
   SSLSUPP_CAINFO_BLOB |
-  SSLSUPP_SSL_CTX,
+#ifdef HAVE_WOLFSSL_CTX_GENERATEECHCONFIG
+  SSLSUPP_ECH |
+#endif
+  SSLSUPP_SSL_CTX |
+#ifdef WOLFSSL_TLS13
+  SSLSUPP_TLS13_CIPHERSUITES |
+#endif
+  SSLSUPP_CA_CACHE |
+  SSLSUPP_CIPHER_LIST |
+  SSLSUPP_SSL_EC_CURVES,
 
-  sizeof(struct wolfssl_ssl_backend_data),
+  sizeof(struct wssl_ctx),
 
-  wolfssl_init,                    /* init */
-  wolfssl_cleanup,                 /* cleanup */
-  wolfssl_version,                 /* version */
-  Curl_none_check_cxn,             /* check_cxn */
-  wolfssl_shutdown,                /* shutdown */
-  wolfssl_data_pending,            /* data_pending */
-  wolfssl_random,                  /* random */
-  Curl_none_cert_status_request,   /* cert_status_request */
-  wolfssl_connect,                 /* connect */
-  wolfssl_connect_nonblocking,     /* connect_nonblocking */
-  Curl_ssl_get_select_socks,                /* getsock */
-  wolfssl_get_internals,           /* get_internals */
-  wolfssl_close,                   /* close_one */
-  Curl_none_close_all,             /* close_all */
-  wolfssl_session_free,            /* session_free */
-  Curl_none_set_engine,            /* set_engine */
-  Curl_none_set_engine_default,    /* set_engine_default */
-  Curl_none_engines_list,          /* engines_list */
-  Curl_none_false_start,           /* false_start */
-  wolfssl_sha256sum,               /* sha256sum */
-  NULL,                            /* associate_connection */
-  NULL,                            /* disassociate_connection */
-  NULL,                            /* free_multi_ssl_backend_data */
-  wolfssl_recv,                    /* recv decrypted data */
-  wolfssl_send,                    /* send data to encrypt */
+  wssl_init,                       /* init */
+  wssl_cleanup,                    /* cleanup */
+  Curl_wssl_version,               /* version */
+  wssl_shutdown,                   /* shutdown */
+  wssl_data_pending,               /* data_pending */
+  wssl_random,                     /* random */
+  NULL,                            /* cert_status_request */
+  wssl_connect,                    /* connect */
+  Curl_ssl_adjust_pollset,         /* adjust_pollset */
+  wssl_get_internals,              /* get_internals */
+  wssl_close,                      /* close_one */
+  NULL,                            /* close_all */
+  NULL,                            /* set_engine */
+  NULL,                            /* set_engine_default */
+  NULL,                            /* engines_list */
+  wssl_sha256sum,                  /* sha256sum */
+  wssl_recv,                       /* recv decrypted data */
+  wssl_send,                       /* send data to encrypt */
+  NULL,                            /* get_channel_binding */
 };
 
 #endif
diff --git a/third-party/curl/lib/vtls/wolfssl.h b/third-party/curl/lib/vtls/wolfssl.h
index a5ed848099..2490bf3e9c 100644
--- a/third-party/curl/lib/vtls/wolfssl.h
+++ b/third-party/curl/lib/vtls/wolfssl.h
@@ -27,7 +27,75 @@
 
 #ifdef USE_WOLFSSL
 
+#include "urldata.h"
+
+#include <wolfssl/options.h>
+
+struct alpn_spec;
+struct ssl_peer;
+struct Curl_ssl_session;
+
+struct WOLFSSL;
+struct WOLFSSL_CTX;
+struct WOLFSSL_SESSION;
+
 extern const struct Curl_ssl Curl_ssl_wolfssl;
 
+struct wssl_ctx {
+  struct WOLFSSL_CTX *ssl_ctx;
+  struct WOLFSSL *ssl;
+  CURLcode io_result;      /* result of last BIO cfilter operation */
+  CURLcode hs_result;      /* result of handshake */
+  int io_send_blocked_len; /* length of last BIO write that EAGAIN-ed */
+  BIT(x509_store_setup);   /* x509 store has been set up */
+  BIT(shutting_down);      /* TLS is being shut down */
+};
+
+size_t Curl_wssl_version(char *buffer, size_t size);
+
+typedef CURLcode Curl_wssl_ctx_setup_cb(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data,
+                                        void *user_data);
+
+typedef CURLcode Curl_wssl_init_session_reuse_cb(struct Curl_cfilter *cf,
+                                                 struct Curl_easy *data,
+                                                 struct alpn_spec *alpns,
+                                                 struct Curl_ssl_session *scs,
+                                                 bool *do_early_data);
+
+CURLcode Curl_wssl_ctx_init(struct wssl_ctx *wctx,
+                            struct Curl_cfilter *cf,
+                            struct Curl_easy *data,
+                            struct ssl_peer *peer,
+                            const struct alpn_spec *alpns_requested,
+                            Curl_wssl_ctx_setup_cb *cb_setup,
+                            void *cb_user_data,
+                            void *ssl_user_data,
+                            Curl_wssl_init_session_reuse_cb *sess_reuse_cb);
+
+/* Is a resolved HTTPS-RR needed for initializing wolfSSL? */
+bool Curl_wssl_need_httpsrr(struct Curl_easy *data);
+
+CURLcode Curl_wssl_setup_x509_store(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    struct wssl_ctx *wssl);
+
+#ifdef HAVE_EX_DATA
+CURLcode Curl_wssl_cache_session(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 const char *ssl_peer_key,
+                                 struct WOLFSSL_SESSION *session,
+                                 int ietf_tls_id,
+                                 const char *alpn,
+                                 unsigned char *quic_tp,
+                                 size_t quic_tp_len);
+#endif
+
+CURLcode Curl_wssl_verify_pinned(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 struct wssl_ctx *wssl);
+
+void Curl_wssl_report_handshake(struct Curl_easy *data, struct wssl_ctx *wssl);
+
 #endif /* USE_WOLFSSL */
 #endif /* HEADER_CURL_WOLFSSL_H */
diff --git a/third-party/curl/lib/vtls/x509asn1.c b/third-party/curl/lib/vtls/x509asn1.c
index c3fd3a30bb..4c5dac3e8b 100644
--- a/third-party/curl/lib/vtls/x509asn1.c
+++ b/third-party/curl/lib/vtls/x509asn1.c
@@ -21,83 +21,37 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#if defined(USE_GNUTLS) || defined(USE_WOLFSSL) ||      \
-  defined(USE_SCHANNEL) || defined(USE_SECTRANSP)
+#if defined(USE_GNUTLS) || defined(USE_WOLFSSL) || defined(USE_SCHANNEL) || \
+  defined(USE_MBEDTLS) || defined(USE_RUSTLS)
 
-#if defined(USE_WOLFSSL) || defined(USE_SCHANNEL)
+#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_MBEDTLS) || \
+  defined(USE_WOLFSSL) || defined(USE_RUSTLS)
 #define WANT_PARSEX509 /* uses Curl_parseX509() */
 #endif
 
-#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP)
+#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_MBEDTLS) || \
+  defined(USE_RUSTLS)
 #define WANT_EXTRACT_CERTINFO /* uses Curl_extract_certinfo() */
-#define WANT_PARSEX509 /* ... uses Curl_parseX509() */
 #endif
 
-#include <curl/curl.h>
 #include "urldata.h"
-#include "strcase.h"
-#include "curl_ctype.h"
-#include "hostcheck.h"
 #include "vtls/vtls.h"
-#include "vtls/vtls_int.h"
-#include "sendf.h"
-#include "inet_pton.h"
-#include "curl_base64.h"
-#include "x509asn1.h"
-#include "dynbuf.h"
-
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+#include "curl_trc.h"
+#include "curlx/base64.h"
+#include "vtls/x509asn1.h"
+#include "curlx/dynbuf.h"
 
 /*
  * Constants.
  */
 
 /* Largest supported ASN.1 structure. */
-#define CURL_ASN1_MAX                   ((size_t) 0x40000)      /* 256K */
-
-/* ASN.1 classes. */
-#define CURL_ASN1_UNIVERSAL             0
-#define CURL_ASN1_APPLICATION           1
-#define CURL_ASN1_CONTEXT_SPECIFIC      2
-#define CURL_ASN1_PRIVATE               3
-
-/* ASN.1 types. */
-#define CURL_ASN1_BOOLEAN               1
-#define CURL_ASN1_INTEGER               2
-#define CURL_ASN1_BIT_STRING            3
-#define CURL_ASN1_OCTET_STRING          4
-#define CURL_ASN1_NULL                  5
-#define CURL_ASN1_OBJECT_IDENTIFIER     6
-#define CURL_ASN1_OBJECT_DESCRIPTOR     7
-#define CURL_ASN1_INSTANCE_OF           8
-#define CURL_ASN1_REAL                  9
-#define CURL_ASN1_ENUMERATED            10
-#define CURL_ASN1_EMBEDDED              11
-#define CURL_ASN1_UTF8_STRING           12
-#define CURL_ASN1_RELATIVE_OID          13
-#define CURL_ASN1_SEQUENCE              16
-#define CURL_ASN1_SET                   17
-#define CURL_ASN1_NUMERIC_STRING        18
-#define CURL_ASN1_PRINTABLE_STRING      19
-#define CURL_ASN1_TELETEX_STRING        20
-#define CURL_ASN1_VIDEOTEX_STRING       21
-#define CURL_ASN1_IA5_STRING            22
-#define CURL_ASN1_UTC_TIME              23
-#define CURL_ASN1_GENERALIZED_TIME      24
-#define CURL_ASN1_GRAPHIC_STRING        25
-#define CURL_ASN1_VISIBLE_STRING        26
-#define CURL_ASN1_GENERAL_STRING        27
-#define CURL_ASN1_UNIVERSAL_STRING      28
-#define CURL_ASN1_CHARACTER_STRING      29
-#define CURL_ASN1_BMP_STRING            30
+#define CURL_ASN1_MAX                   ((size_t)0x40000)      /* 256K */
 
 #ifdef WANT_EXTRACT_CERTINFO
+
 /* ASN.1 OID table entry. */
 struct Curl_OID {
   const char *numoid;  /* Dotted-numeric OID. */
@@ -105,15 +59,16 @@ struct Curl_OID {
 };
 
 /* ASN.1 OIDs. */
-static const char       cnOID[] = "2.5.4.3";    /* Common name. */
-static const char       sanOID[] = "2.5.29.17"; /* Subject alternative name. */
-
 static const struct Curl_OID OIDtable[] = {
   { "1.2.840.10040.4.1",        "dsa" },
   { "1.2.840.10040.4.3",        "dsa-with-sha1" },
   { "1.2.840.10045.2.1",        "ecPublicKey" },
   { "1.2.840.10045.3.0.1",      "c2pnb163v1" },
   { "1.2.840.10045.4.1",        "ecdsa-with-SHA1" },
+  { "1.2.840.10045.4.3.1",      "ecdsa-with-SHA224" },
+  { "1.2.840.10045.4.3.2",      "ecdsa-with-SHA256" },
+  { "1.2.840.10045.4.3.3",      "ecdsa-with-SHA384" },
+  { "1.2.840.10045.4.3.4",      "ecdsa-with-SHA512" },
   { "1.2.840.10046.2.1",        "dhpublicnumber" },
   { "1.2.840.113549.1.1.1",     "rsaEncryption" },
   { "1.2.840.113549.1.1.2",     "md2WithRSAEncryption" },
@@ -127,7 +82,7 @@ static const struct Curl_OID OIDtable[] = {
   { "1.2.840.113549.2.2",       "md2" },
   { "1.2.840.113549.2.5",       "md5" },
   { "1.3.14.3.2.26",            "sha1" },
-  { cnOID,                      "CN" },
+  { "2.5.4.3",                  "CN" },
   { "2.5.4.4",                  "SN" },
   { "2.5.4.5",                  "serialNumber" },
   { "2.5.4.6",                  "C" },
@@ -148,14 +103,15 @@ static const struct Curl_OID OIDtable[] = {
   { "2.5.4.65",                 "pseudonym" },
   { "1.2.840.113549.1.9.1",     "emailAddress" },
   { "2.5.4.72",                 "role" },
-  { sanOID,                     "subjectAltName" },
+  { "2.5.29.17",                "subjectAltName" },
   { "2.5.29.18",                "issuerAltName" },
   { "2.5.29.19",                "basicConstraints" },
   { "2.16.840.1.101.3.4.2.4",   "sha224" },
   { "2.16.840.1.101.3.4.2.1",   "sha256" },
   { "2.16.840.1.101.3.4.2.2",   "sha384" },
   { "2.16.840.1.101.3.4.2.3",   "sha512" },
-  { (const char *) NULL,        (const char *) NULL }
+  { "1.2.840.113549.1.9.2",     "unstructuredName" },
+  { NULL,                       NULL }
 };
 
 #endif /* WANT_EXTRACT_CERTINFO */
@@ -169,12 +125,11 @@ static const struct Curl_OID OIDtable[] = {
  * Please note there is no pretension here to rewrite a full SSL library.
  */
 
-static const char *getASN1Element(struct Curl_asn1Element *elem,
-                                  const char *beg, const char *end)
-  WARN_UNUSED_RESULT;
+#define CURL_ASN1_MAX_RECURSIONS    16
 
-static const char *getASN1Element(struct Curl_asn1Element *elem,
-                                  const char *beg, const char *end)
+static const char *getASN1Element_(struct Curl_asn1Element *elem,
+                                   const char *beg, const char *end,
+                                   size_t lvl)
 {
   unsigned char b;
   size_t len;
@@ -185,14 +140,15 @@ static const char *getASN1Element(struct Curl_asn1Element *elem,
      Returns a pointer in source string after the parsed element, or NULL
      if an error occurs. */
   if(!beg || !end || beg >= end || !*beg ||
-     (size_t)(end - beg) > CURL_ASN1_MAX)
+     ((size_t)(end - beg) > CURL_ASN1_MAX) ||
+     lvl >= CURL_ASN1_MAX_RECURSIONS)
     return NULL;
 
   /* Process header byte. */
   elem->header = beg;
-  b = (unsigned char) *beg++;
+  b = (unsigned char)*beg++;
   elem->constructed = (b & 0x20) != 0;
-  elem->class = (b >> 6) & 3;
+  elem->eclass = (b >> 6) & 3;
   b &= 0x1F;
   if(b == 0x1F)
     return NULL; /* Long tag values not supported here. */
@@ -201,35 +157,38 @@ static const char *getASN1Element(struct Curl_asn1Element *elem,
   /* Process length. */
   if(beg >= end)
     return NULL;
-  b = (unsigned char) *beg++;
+  b = (unsigned char)*beg++;
   if(!(b & 0x80))
     len = b;
-  else if(!(b &= 0x7F)) {
-    /* Unspecified length. Since we have all the data, we can determine the
-       effective length by skipping element until an end element is found. */
-    if(!elem->constructed)
-      return NULL;
-    elem->beg = beg;
-    while(beg < end && *beg) {
-      beg = getASN1Element(&lelem, beg, end);
-      if(!beg)
-        return NULL;
-    }
-    if(beg >= end)
-      return NULL;
-    elem->end = beg;
-    return beg + 1;
-  }
-  else if((unsigned)b > (size_t)(end - beg))
-    return NULL; /* Does not fit in source. */
   else {
-    /* Get long length. */
-    len = 0;
-    do {
-      if(len & 0xFF000000L)
-        return NULL;  /* Lengths > 32 bits are not supported. */
-      len = (len << 8) | (unsigned char) *beg++;
-    } while(--b);
+    b &= 0x7F;
+    if(!b) {
+      /* Unspecified length. Since we have all the data, we can determine the
+         effective length by skipping element until an end element is found. */
+      if(!elem->constructed)
+        return NULL;
+      elem->beg = beg;
+      while(beg < end && *beg) {
+        beg = getASN1Element_(&lelem, beg, end, lvl + 1);
+        if(!beg)
+          return NULL;
+      }
+      if(beg >= end)
+        return NULL;
+      elem->end = beg;
+      return beg + 1;
+    }
+    else if((unsigned)b > (size_t)(end - beg))
+      return NULL; /* Does not fit in source. */
+    else {
+      /* Get long length. */
+      len = 0;
+      do {
+        if(len & 0xFF000000L)
+          return NULL;  /* Lengths > 32 bits are not supported. */
+        len = (len << 8) | (unsigned char) *beg++;
+      } while(--b);
+    }
   }
   if(len > (size_t)(end - beg))
     return NULL;  /* Element data does not fit in source. */
@@ -238,105 +197,131 @@ static const char *getASN1Element(struct Curl_asn1Element *elem,
   return elem->end;
 }
 
+/*
+ * @unittest 1657
+ */
+UNITTEST const char *getASN1Element(struct Curl_asn1Element *elem,
+                                    const char *beg, const char *end);
+UNITTEST const char *getASN1Element(struct Curl_asn1Element *elem,
+                                    const char *beg, const char *end)
+{
+  return getASN1Element_(elem, beg, end, 0);
+}
+
 #ifdef WANT_EXTRACT_CERTINFO
 
 /*
- * Search the null terminated OID or OID identifier in local table.
+ * Search the null-terminated OID or OID identifier in local table.
  * Return the table entry pointer or NULL if not found.
  */
 static const struct Curl_OID *searchOID(const char *oid)
 {
   const struct Curl_OID *op;
   for(op = OIDtable; op->numoid; op++)
-    if(!strcmp(op->numoid, oid) || strcasecompare(op->textoid, oid))
+    if(!strcmp(op->numoid, oid) || curl_strequal(op->textoid, oid))
       return op;
 
   return NULL;
 }
 
 /*
- * Convert an ASN.1 Boolean value into its string representation.  Return the
- * dynamically allocated string, or NULL if source is not an ASN.1 Boolean
- * value.
+ * Convert an ASN.1 Boolean value into its string representation.
+ *
+ * Return error code.
  */
 
-static const char *bool2str(const char *beg, const char *end)
+static CURLcode bool2str(struct dynbuf *store,
+                         const char *beg, const char *end)
 {
+  uint8_t val;
   if(end - beg != 1)
-    return NULL;
-  return strdup(*beg? "TRUE": "FALSE");
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  val = (uint8_t)*beg;
+  if((val != 0xff) && (val != 0x00))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  return curlx_dyn_add(store, val ? "TRUE" : "FALSE");
 }
 
 /*
  * Convert an ASN.1 octet string to a printable string.
- * Return the dynamically allocated string, or NULL if an error occurs.
+ *
+ * Return error code.
  */
-static const char *octet2str(const char *beg, const char *end)
+static CURLcode octet2str(struct dynbuf *store,
+                          const char *beg, const char *end)
 {
-  struct dynbuf buf;
-  CURLcode result;
-
-  Curl_dyn_init(&buf, 3 * CURL_ASN1_MAX + 1);
-  result = Curl_dyn_addn(&buf, "", 0);
+  CURLcode result = CURLE_OK;
 
   while(!result && beg < end)
-    result = Curl_dyn_addf(&buf, "%02x:", (unsigned char) *beg++);
+    result = curlx_dyn_addf(store, "%02x:", (unsigned char)*beg++);
 
-  return Curl_dyn_ptr(&buf);
+  return result;
 }
 
-static const char *bit2str(const char *beg, const char *end)
+static CURLcode bit2str(struct dynbuf *store, const char *beg, const char *end)
 {
-  /* Convert an ASN.1 bit string to a printable string.
-     Return the dynamically allocated string, or NULL if an error occurs. */
+  /* Convert an ASN.1 bit string to a printable string. */
 
-  if(++beg > end)
-    return NULL;
-  return octet2str(beg, end);
+  if(beg < end) {
+    uint8_t unused_bits = (uint8_t)*beg++;
+    if(unused_bits > 7)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
+  else
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  return octet2str(store, beg, end);
 }
 
 /*
  * Convert an ASN.1 integer value into its string representation.
- * Return the dynamically allocated string, or NULL if source is not an
- * ASN.1 integer value.
+ *
+ * Returns error.
  */
-static const char *int2str(const char *beg, const char *end)
+static CURLcode int2str(struct dynbuf *store, const char *beg, const char *end)
 {
-  unsigned int val = 0;
+  uint32_t uval = 0;
+  int32_t sval = 0;
   size_t n = end - beg;
+  size_t i;
+  const unsigned char *p = (const unsigned char *)beg;
 
   if(!n)
-    return NULL;
+    return CURLE_BAD_FUNCTION_ARGUMENT;
 
   if(n > 4)
-    return octet2str(beg, end);
+    return octet2str(store, beg, end);
 
-  /* Represent integers <= 32-bit as a single value. */
-  if(*beg & 0x80)
-    val = ~val;
+  if(p[0] & 0x80)
+    uval = ~0U;
 
-  do
-    val = (val << 8) | *(const unsigned char *) beg++;
-  while(beg < end);
-  return curl_maprintf("%s%x", val >= 10? "0x": "", val);
+  for(i = 0; i < n; i++)
+    uval = (uval << 8) | p[i];
+
+  sval = (int32_t)uval;
+
+  /* small values are easier to read as decimals */
+  if(sval > -10000 && sval < 10000)
+    return curlx_dyn_addf(store, "%d", sval);
+
+  /* represent larger values as hex */
+  return curlx_dyn_addf(store, "0x%x", uval);
 }
 
 /*
- * Perform a lazy conversion from an ASN.1 typed string to UTF8. Allocate the
- * destination buffer dynamically. The allocation size will normally be too
- * large: this is to avoid buffer overflows.
- * Terminate the string with a nul byte and return the converted
- * string length.
+ * Convert from an ASN.1 typed string to UTF8.
+ *
+ * The result is stored in a dynbuf that is inited by the user of this
+ * function.
+ *
+ * Returns error.
  */
-static ssize_t
-utf8asn1str(char **to, int type, const char *from, const char *end)
+static CURLcode utf8asn1str(struct dynbuf *to, int type, const char *from,
+                            const char *end)
 {
   size_t inlength = end - from;
   int size = 1;
-  size_t outlength;
-  char *buf;
+  CURLcode result = CURLE_OK;
 
-  *to = NULL;
   switch(type) {
   case CURL_ASN1_BMP_STRING:
     size = 2;
@@ -352,180 +337,165 @@ utf8asn1str(char **to, int type, const char *from, const char *end)
   case CURL_ASN1_UTF8_STRING:
     break;
   default:
-    return -1;  /* Conversion not supported. */
+    return CURLE_BAD_FUNCTION_ARGUMENT;  /* Conversion not supported. */
   }
 
   if(inlength % size)
-    return -1;  /* Length inconsistent with character size. */
-  if(inlength / size > (SIZE_T_MAX - 1) / 4)
-    return -1;  /* Too big. */
-  buf = malloc(4 * (inlength / size) + 1);
-  if(!buf)
-    return -1;  /* Not enough memory. */
+    /* Length inconsistent with character size. */
+    return CURLE_BAD_FUNCTION_ARGUMENT;
 
   if(type == CURL_ASN1_UTF8_STRING) {
-    /* Just copy. */
-    outlength = inlength;
-    if(outlength)
-      memcpy(buf, from, outlength);
+    /* copy. */
+    if(inlength)
+      result = curlx_dyn_addn(to, from, inlength);
   }
   else {
-    for(outlength = 0; from < end;) {
-      int charsize;
-      unsigned int wc;
+    while(!result && (from < end)) {
+      char buf[4]; /* decode buffer */
+      size_t charsize = 1;
+      unsigned int wc = 0;
 
-      wc = 0;
       switch(size) {
       case 4:
-        wc = (wc << 8) | *(const unsigned char *) from++;
-        wc = (wc << 8) | *(const unsigned char *) from++;
-        /* FALLTHROUGH */
+        wc = (wc << 8) | *(const unsigned char *)from++;
+        wc = (wc << 8) | *(const unsigned char *)from++;
+        FALLTHROUGH();
       case 2:
-        wc = (wc << 8) | *(const unsigned char *) from++;
-        /* FALLTHROUGH */
+        wc = (wc << 8) | *(const unsigned char *)from++;
+        FALLTHROUGH();
       default: /* case 1: */
-        wc = (wc << 8) | *(const unsigned char *) from++;
+        wc = (wc << 8) | *(const unsigned char *)from++;
       }
-      charsize = 1;
       if(wc >= 0x00000080) {
         if(wc >= 0x00000800) {
           if(wc >= 0x00010000) {
             if(wc >= 0x00200000) {
-              free(buf);
-              return -1;        /* Invalid char. size for target encoding. */
+              /* Invalid char. size for target encoding. */
+              return CURLE_WEIRD_SERVER_REPLY;
             }
-            buf[outlength + 3] = (char) (0x80 | (wc & 0x3F));
+            buf[3] = (char)(0x80 | (wc & 0x3F));
             wc = (wc >> 6) | 0x00010000;
             charsize++;
           }
-          buf[outlength + 2] = (char) (0x80 | (wc & 0x3F));
+          buf[2] = (char)(0x80 | (wc & 0x3F));
           wc = (wc >> 6) | 0x00000800;
           charsize++;
         }
-        buf[outlength + 1] = (char) (0x80 | (wc & 0x3F));
+        buf[1] = (char)(0x80 | (wc & 0x3F));
         wc = (wc >> 6) | 0x000000C0;
         charsize++;
       }
-      buf[outlength] = (char) wc;
-      outlength += charsize;
+      buf[0] = (char)wc;
+      result = curlx_dyn_addn(to, buf, charsize);
     }
   }
-  buf[outlength] = '\0';
-  *to = buf;
-  return outlength;
+  return result;
 }
 
 /*
- * Convert an ASN.1 String into its UTF-8 string representation.
- * Return the dynamically allocated string, or NULL if an error occurs.
+ * Convert an ASN.1 OID into its dotted string representation. Each field is
+ * limited to unsigned 32-bit values.
+ *
+ * A minor limitation is in the second number, which can be no larger than 32
+ * bits - 80 == 4294967215.
+ *
+ * Return error code.
+ *
+ * @unittest 1666
  */
-static const char *string2str(int type, const char *beg, const char *end)
+UNITTEST CURLcode encodeOID(struct dynbuf *store,
+                            const char *beg, const char *end);
+UNITTEST CURLcode encodeOID(struct dynbuf *store,
+                            const char *beg, const char *end)
 {
-  char *buf;
-  if(utf8asn1str(&buf, type, beg, end) < 0)
-    return NULL;
-  return buf;
-}
+  uint32_t x;
+  uint32_t y;
+  CURLcode result = CURLE_OK;
 
-/*
- * Decimal ASCII encode unsigned integer `x' into the buflen sized buffer at
- * buf.  Return the total number of encoded digits, even if larger than
- * `buflen'.
- */
-static size_t encodeUint(char *buf, size_t buflen, unsigned int x)
-{
-  size_t i = 0;
-  unsigned int y = x / 10;
+  if(end <= beg)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
 
-  if(y) {
-    i = encodeUint(buf, buflen, y);
-    x -= y * 10;
-  }
-  if(i < buflen)
-    buf[i] = (char) ('0' + x);
-  i++;
-  if(i < buflen)
-    buf[i] = '\0';      /* Store a terminator if possible. */
-  return i;
-}
-
-/*
- * Convert an ASN.1 OID into its dotted string representation.
- * Store the result in th `n'-byte buffer at `buf'.
- * Return the converted string length, or 0 on errors.
- */
-static size_t encodeOID(char *buf, size_t buflen,
-                        const char *beg, const char *end)
-{
-  size_t i;
-  unsigned int x;
-  unsigned int y;
-
-  /* Process the first two numbers. */
-  y = *(const unsigned char *) beg++;
-  x = y / 40;
-  y -= x * 40;
-  i = encodeUint(buf, buflen, x);
-  if(i < buflen)
-    buf[i] = '.';
-  i++;
-  if(i >= buflen)
-    i += encodeUint(NULL, 0, y);
+  /* Process the first two numbers. The initial digit cannot be larger than
+     2 */
+  y = *(const unsigned char *)beg++;
+  if(y <= 80)
+    x = y / 40;
   else
-    i += encodeUint(buf + i, buflen - i, y);
+    x = 2;
+  result = curlx_dyn_addf(store, "%u", x);
+  if(result)
+    return result;
+
+  if(y & 0x80) {
+    uint32_t t = (y & 0x7f); /* the second number */
+    if(!t)
+      /* reject leading 0x80 padding */
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    do {
+      if((t & 0xFE000000) || (beg >= end))
+        return CURLE_BAD_FUNCTION_ARGUMENT;
+      y = *(const unsigned char *)beg++;
+      t = (t << 7) | (y & 0x7F);
+    } while(y & 0x80);
+    y = t;
+  }
+
+  result = curlx_dyn_addf(store, ".%u", y - (x * 40));
+  if(result)
+    return result;
 
   /* Process the trailing numbers. */
-  while(beg < end) {
-    if(i < buflen)
-      buf[i] = '.';
-    i++;
+  while((beg < end) && !result) {
     x = 0;
+    y = 0;
     do {
-      if(x & 0xFF000000)
-        return 0;
-      y = *(const unsigned char *) beg++;
+      /* 0x80 as the first value is invalid since it only adds padding */
+      if((y & 0x80) && !x)
+        return CURLE_BAD_FUNCTION_ARGUMENT;
+      else if((x & 0xFE000000) || (beg == end))
+        return CURLE_BAD_FUNCTION_ARGUMENT;
+      y = *(const unsigned char *)beg++;
       x = (x << 7) | (y & 0x7F);
     } while(y & 0x80);
-    if(i >= buflen)
-      i += encodeUint(NULL, 0, x);
-    else
-      i += encodeUint(buf + i, buflen - i, x);
+    result = curlx_dyn_addf(store, ".%u", x);
   }
-  if(i < buflen)
-    buf[i] = '\0';
-  return i;
+  return result;
 }
 
 /*
  * Convert an ASN.1 OID into its dotted or symbolic string representation.
- * Return the dynamically allocated string, or NULL if an error occurs.
+ *
+ * Return error code.
  */
 
-static const char *OID2str(const char *beg, const char *end, bool symbolic)
+static CURLcode OID2str(struct dynbuf *store,
+                        const char *beg, const char *end)
 {
-  char *buf = NULL;
+  CURLcode result = CURLE_OK;
   if(beg < end) {
-    size_t buflen = encodeOID(NULL, 0, beg, end);
-    if(buflen) {
-      buf = malloc(buflen + 1); /* one extra for the zero byte */
-      if(buf) {
-        encodeOID(buf, buflen, beg, end);
-        buf[buflen] = '\0';
+    struct dynbuf buf;
+    curlx_dyn_init(&buf, CURL_X509_STR_MAX);
+    result = encodeOID(&buf, beg, end);
 
-        if(symbolic) {
-          const struct Curl_OID *op = searchOID(buf);
-          if(op) {
-            free(buf);
-            buf = strdup(op->textoid);
-          }
-        }
-      }
+    if(!result) {
+      const struct Curl_OID *op = searchOID(curlx_dyn_ptr(&buf));
+      if(op)
+        result = curlx_dyn_add(store, op->textoid);
+      else
+        result = curlx_dyn_add(store, curlx_dyn_ptr(&buf));
     }
+    curlx_dyn_free(&buf);
   }
-  return buf;
+  return result;
 }
 
-static const char *GTime2str(const char *beg, const char *end)
+/*
+ * @unittest 1656
+ */
+UNITTEST CURLcode GTime2str(struct dynbuf *store,
+                            const char *beg, const char *end);
+UNITTEST CURLcode GTime2str(struct dynbuf *store,
+                            const char *beg, const char *end)
 {
   const char *tzp;
   const char *fracp;
@@ -537,7 +507,7 @@ static const char *GTime2str(const char *beg, const char *end)
   /* Convert an ASN.1 Generalized time to a printable string.
      Return the dynamically allocated string, or NULL if an error occurs. */
 
-  for(fracp = beg; fracp < end && *fracp >= '0' && *fracp <= '9'; fracp++)
+  for(fracp = beg; fracp < end && ISDIGIT(*fracp); fracp++)
     ;
 
   /* Get seconds digits. */
@@ -548,52 +518,67 @@ static const char *GTime2str(const char *beg, const char *end)
     break;
   case 2:
     sec1 = fracp[-2];
-    /* FALLTHROUGH */
+    FALLTHROUGH();
   case 1:
     sec2 = fracp[-1];
     break;
   default:
-    return NULL;
+    return CURLE_BAD_FUNCTION_ARGUMENT;
   }
 
-  /* Scan for timezone, measure fractional seconds. */
+  /* timezone follows optional fractional seconds. */
   tzp = fracp;
-  fracl = 0;
+  fracl = 0; /* no fractional seconds detected so far */
   if(fracp < end && (*fracp == '.' || *fracp == ',')) {
-    fracp++;
-    do
+    /* Have fractional seconds, e.g. "[.,]\d+". How many? */
+    fracp++; /* should be a digit char or BAD ARGUMENT */
+    tzp = fracp;
+    while(tzp < end && ISDIGIT(*tzp))
       tzp++;
-    while(tzp < end && *tzp >= '0' && *tzp <= '9');
-    /* Strip leading zeroes in fractional seconds. */
-    for(fracl = tzp - fracp - 1; fracl && fracp[fracl - 1] == '0'; fracl--)
-      ;
+    if(tzp == fracp) /* never looped, no digit after [.,] */
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    fracl = tzp - fracp; /* number of fractional sec digits */
+    DEBUGASSERT(fracl > 0);
+    /* Strip trailing zeroes in fractional seconds.
+     * May reduce fracl to 0 if only '0's are present. */
+    while(fracl && fracp[fracl - 1] == '0')
+      fracl--;
   }
 
   /* Process timezone. */
-  if(tzp >= end)
-    ;           /* Nothing to do. */
+  if(tzp >= end) {
+    tzp = "";
+    tzl = 0;
+  }
   else if(*tzp == 'Z') {
-    tzp = " GMT";
-    end = tzp + 4;
+    sep = " ";
+    tzp = "GMT";
+    tzl = 3;
+  }
+  else if((*tzp == '+') || (*tzp == '-')) {
+    sep = " UTC";
+    tzl = end - tzp;
   }
   else {
     sep = " ";
-    tzp++;
+    tzl = end - tzp;
   }
 
-  tzl = end - tzp;
-  return curl_maprintf("%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s",
-                       beg, beg + 4, beg + 6,
-                       beg + 8, beg + 10, sec1, sec2,
-                       fracl? ".": "", (int)fracl, fracp,
-                       sep, (int)tzl, tzp);
+  return curlx_dyn_addf(store,
+                        "%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s",
+                        beg, beg + 4, beg + 6,
+                        beg + 8, beg + 10, sec1, sec2,
+                        fracl ? "." : "", (int)fracl, fracp,
+                        sep, (int)tzl, tzp);
 }
 
 /*
- *  Convert an ASN.1 UTC time to a printable string.
- * Return the dynamically allocated string, or NULL if an error occurs.
+ * Convert an ASN.1 UTC time to a printable string.
+ *
+ * Return error code.
  */
-static const char *UTime2str(const char *beg, const char *end)
+static CURLcode UTime2str(struct dynbuf *store,
+                          const char *beg, const char *end)
 {
   const char *tzp;
   size_t tzl;
@@ -606,59 +591,71 @@ static const char *UTime2str(const char *beg, const char *end)
   switch(tzp - sec) {
   case 0:
     sec = "00";
+    FALLTHROUGH();
   case 2:
     break;
   default:
-    return NULL;
+    return CURLE_BAD_FUNCTION_ARGUMENT;
   }
 
   /* Process timezone. */
   if(tzp >= end)
-    return NULL;
+    return CURLE_BAD_FUNCTION_ARGUMENT;
   if(*tzp == 'Z') {
     tzp = "GMT";
     end = tzp + 3;
   }
-  else
-    tzp++;
 
   tzl = end - tzp;
-  return curl_maprintf("%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s",
-                       20 - (*beg >= '5'), beg, beg + 2, beg + 4,
-                       beg + 6, beg + 8, sec,
-                       (int)tzl, tzp);
+  return curlx_dyn_addf(store, "%d%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s",
+                        20 - (*beg >= '5'), beg, beg + 2, beg + 4,
+                        beg + 6, beg + 8, sec,
+                        (int)tzl, tzp);
 }
 
 /*
  * Convert an ASN.1 element to a printable string.
- * Return the dynamically allocated string, or NULL if an error occurs.
+ *
+ * Return error
+ *
+ * @unittest 1667
  */
-static const char *ASN1tostr(struct Curl_asn1Element *elem, int type)
+UNITTEST CURLcode ASN1tostr(struct dynbuf *store,
+                            struct Curl_asn1Element *elem);
+UNITTEST CURLcode ASN1tostr(struct dynbuf *store,
+                            struct Curl_asn1Element *elem)
 {
+  CURLcode result = CURLE_BAD_FUNCTION_ARGUMENT;
+  int type = elem->tag;
   if(elem->constructed)
-    return NULL; /* No conversion of structured elements. */
-
-  if(!type)
-    type = elem->tag;   /* Type not forced: use element tag as type. */
+    return result; /* No conversion of structured elements. */
 
   switch(type) {
   case CURL_ASN1_BOOLEAN:
-    return bool2str(elem->beg, elem->end);
+    result = bool2str(store, elem->beg, elem->end);
+    break;
   case CURL_ASN1_INTEGER:
   case CURL_ASN1_ENUMERATED:
-    return int2str(elem->beg, elem->end);
+    result = int2str(store, elem->beg, elem->end);
+    break;
   case CURL_ASN1_BIT_STRING:
-    return bit2str(elem->beg, elem->end);
+    result = bit2str(store, elem->beg, elem->end);
+    break;
   case CURL_ASN1_OCTET_STRING:
-    return octet2str(elem->beg, elem->end);
+    result = octet2str(store, elem->beg, elem->end);
+    break;
   case CURL_ASN1_NULL:
-    return strdup("");
+    result = curlx_dyn_addn(store, "", 1);
+    break;
   case CURL_ASN1_OBJECT_IDENTIFIER:
-    return OID2str(elem->beg, elem->end, TRUE);
+    result = OID2str(store, elem->beg, elem->end);
+    break;
   case CURL_ASN1_UTC_TIME:
-    return UTime2str(elem->beg, elem->end);
+    result = UTime2str(store, elem->beg, elem->end);
+    break;
   case CURL_ASN1_GENERALIZED_TIME:
-    return GTime2str(elem->beg, elem->end);
+    result = GTime2str(store, elem->beg, elem->end);
+    break;
   case CURL_ASN1_UTF8_STRING:
   case CURL_ASN1_NUMERIC_STRING:
   case CURL_ASN1_PRINTABLE_STRING:
@@ -667,87 +664,101 @@ static const char *ASN1tostr(struct Curl_asn1Element *elem, int type)
   case CURL_ASN1_VISIBLE_STRING:
   case CURL_ASN1_UNIVERSAL_STRING:
   case CURL_ASN1_BMP_STRING:
-    return string2str(type, elem->beg, elem->end);
+    result = utf8asn1str(store, type, elem->beg, elem->end);
+    break;
   }
 
-  return NULL;   /* Unsupported. */
+  return result;
 }
 
 /*
- * ASCII encode distinguished name at `dn' into the `buflen'-sized buffer at
- * `buf'.
+ * ASCII encode distinguished name at `dn' into the store dynbuf.
  *
- * Returns the total string length, even if larger than `buflen' or -1 on
- * error.
+ * Returns error.
  */
-static ssize_t encodeDN(char *buf, size_t buflen, struct Curl_asn1Element *dn)
+static CURLcode encodeDN(struct dynbuf *store, struct Curl_asn1Element *dn)
 {
   struct Curl_asn1Element rdn;
   struct Curl_asn1Element atv;
   struct Curl_asn1Element oid;
   struct Curl_asn1Element value;
-  size_t l = 0;
   const char *p1;
   const char *p2;
   const char *p3;
   const char *str;
+  CURLcode result = CURLE_OK;
+  bool added = FALSE;
+  struct dynbuf temp;
+  curlx_dyn_init(&temp, CURL_X509_STR_MAX);
 
   for(p1 = dn->beg; p1 < dn->end;) {
     p1 = getASN1Element(&rdn, p1, dn->end);
-    if(!p1)
-      return -1;
+    if(!p1) {
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+      goto error;
+    }
     for(p2 = rdn.beg; p2 < rdn.end;) {
       p2 = getASN1Element(&atv, p2, rdn.end);
-      if(!p2)
-        return -1;
+      if(!p2) {
+        result = CURLE_BAD_FUNCTION_ARGUMENT;
+        goto error;
+      }
       p3 = getASN1Element(&oid, atv.beg, atv.end);
-      if(!p3)
-        return -1;
-      if(!getASN1Element(&value, p3, atv.end))
-        return -1;
-      str = ASN1tostr(&oid, 0);
-      if(!str)
-        return -1;
+      if(!p3) {
+        result = CURLE_BAD_FUNCTION_ARGUMENT;
+        goto error;
+      }
+      if(!getASN1Element(&value, p3, atv.end)) {
+        result = CURLE_BAD_FUNCTION_ARGUMENT;
+        goto error;
+      }
+      curlx_dyn_reset(&temp);
+      result = ASN1tostr(&temp, &oid);
+      if(result)
+        goto error;
+
+      str = curlx_dyn_ptr(&temp);
+
+      if(!str) {
+        result = CURLE_BAD_FUNCTION_ARGUMENT;
+        goto error;
+      }
 
       /* Encode delimiter.
          If attribute has a short uppercase name, delimiter is ", ". */
-      if(l) {
-        for(p3 = str; ISUPPER(*p3); p3++)
-          ;
-        for(p3 = (*p3 || p3 - str > 2)? "/": ", "; *p3; p3++) {
-          if(l < buflen)
-            buf[l] = *p3;
-          l++;
-        }
+      for(p3 = str; ISUPPER(*p3); p3++)
+        ;
+      if(added) {
+        if(p3 - str > 2)
+          result = curlx_dyn_addn(store, "/", 1);
+        else
+          result = curlx_dyn_addn(store, ", ", 2);
+        if(result)
+          goto error;
       }
 
       /* Encode attribute name. */
-      for(p3 = str; *p3; p3++) {
-        if(l < buflen)
-          buf[l] = *p3;
-        l++;
-      }
-      free((char *) str);
+      result = curlx_dyn_add(store, str);
+      if(result)
+        goto error;
 
       /* Generate equal sign. */
-      if(l < buflen)
-        buf[l] = '=';
-      l++;
+      result = curlx_dyn_addn(store, "=", 1);
+      if(result)
+        goto error;
 
       /* Generate value. */
-      str = ASN1tostr(&value, 0);
-      if(!str)
-        return -1;
-      for(p3 = str; *p3; p3++) {
-        if(l < buflen)
-          buf[l] = *p3;
-        l++;
-      }
-      free((char *) str);
+      result = ASN1tostr(store, &value);
+      if(result)
+        goto error;
+      curlx_dyn_reset(&temp);
+      added = TRUE; /* use separator for next */
     }
   }
+error:
+  curlx_dyn_free(&temp);
 
-  return l;
+  return result;
 }
 
 #endif /* WANT_EXTRACT_CERTINFO */
@@ -837,7 +848,7 @@ int Curl_parseX509(struct Curl_X509certificate *cert,
   if(!getASN1Element(&cert->subjectPublicKey, ccp,
                      cert->subjectPublicKeyInfo.end))
     return -1;
-  /* Get optional issuerUiqueID, subjectUniqueID and extensions. */
+  /* Get optional issuerUniqueID, subjectUniqueID and extensions. */
   cert->issuerUniqueID.tag = cert->subjectUniqueID.tag = 0;
   cert->extensions.tag = elem.tag = 0;
   cert->issuerUniqueID.header = cert->subjectUniqueID.header = NULL;
@@ -876,25 +887,9 @@ int Curl_parseX509(struct Curl_X509certificate *cert,
 
 #ifdef WANT_EXTRACT_CERTINFO
 
-/*
- * Copy at most 64-characters, terminate with a newline and returns the
- * effective number of stored characters.
- */
-static size_t copySubstring(char *to, const char *from)
-{
-  size_t i;
-  for(i = 0; i < 64; i++) {
-    to[i] = *from;
-    if(!*from++)
-      break;
-  }
-
-  to[i++] = '\n';
-  return i;
-}
-
-static const char *dumpAlgo(struct Curl_asn1Element *param,
-                            const char *beg, const char *end)
+static CURLcode dumpAlgo(struct dynbuf *store,
+                         struct Curl_asn1Element *param,
+                         const char *beg, const char *end)
 {
   struct Curl_asn1Element oid;
 
@@ -902,14 +897,16 @@ static const char *dumpAlgo(struct Curl_asn1Element *param,
 
   beg = getASN1Element(&oid, beg, end);
   if(!beg)
-    return NULL;
+    return CURLE_BAD_FUNCTION_ARGUMENT;
   param->header = NULL;
   param->tag = 0;
   param->beg = param->end = end;
-  if(beg < end)
-    if(!getASN1Element(param, beg, end))
-      return NULL;
-  return OID2str(oid.beg, oid.end, TRUE);
+  if(beg < end) {
+    const char *p = getASN1Element(param, beg, end);
+    if(!p)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
+  return OID2str(store, oid.beg, oid.end);
 }
 
 /*
@@ -926,29 +923,52 @@ static CURLcode ssl_push_certinfo(struct Curl_easy *data,
   return Curl_ssl_push_certinfo_len(data, certnum, label, value, valuelen);
 }
 
-/* return 0 on success, 1 on error */
-static int do_pubkey_field(struct Curl_easy *data, int certnum,
-                           const char *label, struct Curl_asn1Element *elem)
+/*
+ * This is a convenience function for push_certinfo_len that takes a
+ * dynbuf value.
+ *
+ * It also does the verbose output if !certnum.
+ */
+static CURLcode ssl_push_certinfo_dyn(struct Curl_easy *data,
+                                      int certnum,
+                                      const char *label,
+                                      struct dynbuf *ptr)
 {
-  const char *output;
-  CURLcode result = CURLE_OK;
+  size_t valuelen = curlx_dyn_len(ptr);
+  const char *value = curlx_dyn_ptr(ptr);
+
+  CURLcode result = Curl_ssl_push_certinfo_len(data, certnum, label,
+                                               value, valuelen);
+
+  if(!certnum && !result)
+    infof(data, "   %s: %s", label, value);
+
+  return result;
+}
+
+static CURLcode do_pubkey_field(struct Curl_easy *data, int certnum,
+                                const char *label,
+                                struct Curl_asn1Element *elem)
+{
+  CURLcode result;
+  struct dynbuf out;
+
+  curlx_dyn_init(&out, CURL_X509_STR_MAX);
 
   /* Generate a certificate information record for the public key. */
 
-  output = ASN1tostr(elem, 0);
-  if(output) {
+  result = ASN1tostr(&out, elem);
+  if(!result) {
     if(data->set.ssl.certinfo)
-      result = ssl_push_certinfo(data, certnum, label, output);
-    if(!certnum && !result)
-      infof(data, "   %s: %s", label, output);
-    free((char *) output);
+      result = ssl_push_certinfo_dyn(data, certnum, label, &out);
+    curlx_dyn_free(&out);
   }
-  return result ? 1 : 0;
+  return result;
 }
 
 /* return 0 on success, 1 on error */
-static int do_pubkey(struct Curl_easy *data, int certnum,
-                     const char *algo, struct Curl_asn1Element *param,
+static int do_pubkey(struct Curl_easy *data, int certnum, const char *algo,
+                     struct Curl_asn1Element *param,
                      struct Curl_asn1Element *pubkey)
 {
   struct Curl_asn1Element elem;
@@ -957,28 +977,34 @@ static int do_pubkey(struct Curl_easy *data, int certnum,
 
   /* Generate all information records for the public key. */
 
-  if(strcasecompare(algo, "ecPublicKey")) {
+  if(curl_strequal(algo, "ecPublicKey")) {
     /*
      * ECC public key is all the data, a value of type BIT STRING mapped to
      * OCTET STRING and should not be parsed as an ASN.1 value.
      */
-    const size_t len = ((pubkey->end - pubkey->beg - 2) * 4);
+    const size_t dlen = pubkey->end - pubkey->beg;
+    size_t len;
+    if(dlen < 2)
+      /* too small */
+      return 1;
+    len = (dlen - 2) * 4;
     if(!certnum)
-      infof(data, "   ECC Public Key (%lu bits)", len);
+      infof(data, "   ECC Public Key (%zu bits)", len);
     if(data->set.ssl.certinfo) {
-      char q[sizeof(len) * 8 / 3 + 1];
-      (void)msnprintf(q, sizeof(q), "%zu", len);
+      char q[(sizeof(len) * 8 / 3) + 1];
+      (void)curl_msnprintf(q, sizeof(q), "%zu", len);
       if(ssl_push_certinfo(data, certnum, "ECC Public Key", q))
         return 1;
     }
-    return do_pubkey_field(data, certnum, "ecPublicKey", pubkey);
+    return do_pubkey_field(data, certnum, "ecPublicKey", pubkey) == CURLE_OK
+      ? 0 : 1;
   }
 
   /* Get the public key (single element). */
   if(!getASN1Element(&pk, pubkey->beg + 1, pubkey->end))
     return 1;
 
-  if(strcasecompare(algo, "rsaEncryption")) {
+  if(curl_strequal(algo, "rsaEncryption")) {
     const char *q;
     size_t len;
 
@@ -987,21 +1013,21 @@ static int do_pubkey(struct Curl_easy *data, int certnum,
       return 1;
 
     /* Compute key length. */
-    for(q = elem.beg; !*q && q < elem.end; q++)
+    for(q = elem.beg; q < elem.end && !*q; q++)
       ;
     len = ((elem.end - q) * 8);
     if(len) {
       unsigned int i;
-      for(i = *(unsigned char *) q; !(i & 0x80); i <<= 1)
+      for(i = *(const unsigned char *)q; !(i & 0x80); i <<= 1)
         len--;
     }
     if(len > 32)
       elem.beg = q;     /* Strip leading zero bytes. */
     if(!certnum)
-      infof(data, "   RSA Public Key (%lu bits)", len);
+      infof(data, "   RSA Public Key (%zu bits)", len);
     if(data->set.ssl.certinfo) {
-      char r[sizeof(len) * 8 / 3 + 1];
-      msnprintf(r, sizeof(r), "%zu", len);
+      char r[(sizeof(len) * 8 / 3) + 1];
+      curl_msnprintf(r, sizeof(r), "%zu", len);
       if(ssl_push_certinfo(data, certnum, "RSA Public Key", r))
         return 1;
     }
@@ -1013,7 +1039,7 @@ static int do_pubkey(struct Curl_easy *data, int certnum,
     if(do_pubkey_field(data, certnum, "rsa(e)", &elem))
       return 1;
   }
-  else if(strcasecompare(algo, "dsa")) {
+  else if(curl_strequal(algo, "dsa")) {
     p = getASN1Element(&elem, param->beg, param->end);
     if(p) {
       if(do_pubkey_field(data, certnum, "dsa(p)", &elem))
@@ -1031,12 +1057,12 @@ static int do_pubkey(struct Curl_easy *data, int certnum,
       }
     }
   }
-  else if(strcasecompare(algo, "dhpublicnumber")) {
+  else if(curl_strequal(algo, "dhpublicnumber")) {
     p = getASN1Element(&elem, param->beg, param->end);
     if(p) {
       if(do_pubkey_field(data, certnum, "dh(p)", &elem))
         return 1;
-      if(getASN1Element(&elem, param->beg, param->end)) {
+      if(getASN1Element(&elem, p, param->end)) {
         if(do_pubkey_field(data, certnum, "dh(g)", &elem))
           return 1;
         if(do_pubkey_field(data, certnum, "dh(pub_key)", &pk))
@@ -1049,24 +1075,11 @@ static int do_pubkey(struct Curl_easy *data, int certnum,
 
 /*
  * Convert an ASN.1 distinguished name into a printable string.
- * Return the dynamically allocated string, or NULL if an error occurs.
+ * Return error.
  */
-static const char *DNtostr(struct Curl_asn1Element *dn)
+static CURLcode DNtostr(struct dynbuf *store, struct Curl_asn1Element *dn)
 {
-  char *buf = NULL;
-  ssize_t buflen = encodeDN(NULL, 0, dn);
-
-  if(buflen >= 0) {
-    buf = malloc(buflen + 1);
-    if(buf) {
-      if(encodeDN(buf, buflen + 1, dn) == -1) {
-        free(buf);
-        return NULL;
-      }
-      buf[buflen] = '\0';
-    }
-  }
-  return buf;
+  return encodeDN(store, dn);
 }
 
 CURLcode Curl_extract_certinfo(struct Curl_easy *data,
@@ -1076,19 +1089,19 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data,
 {
   struct Curl_X509certificate cert;
   struct Curl_asn1Element param;
-  const char *ccp;
-  char *cp1;
-  size_t cl1;
-  char *cp2;
+  char *certptr;
+  size_t clen;
+  struct dynbuf out;
   CURLcode result = CURLE_OK;
   unsigned int version;
-  size_t i;
-  size_t j;
+  const char *ptr;
+  int rc;
 
   if(!data->set.ssl.certinfo)
     if(certnum)
       return CURLE_OK;
 
+  curlx_dyn_init(&out, CURL_X509_STR_MAX);
   /* Prepare the certificate information for curl_easy_getinfo(). */
 
   /* Extract the certificate ASN.1 elements. */
@@ -1096,135 +1109,125 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data,
     return CURLE_PEER_FAILED_VERIFICATION;
 
   /* Subject. */
-  ccp = DNtostr(&cert.subject);
-  if(!ccp)
-    return CURLE_OUT_OF_MEMORY;
+  result = DNtostr(&out, &cert.subject);
+  if(result)
+    goto done;
   if(data->set.ssl.certinfo) {
-    result = ssl_push_certinfo(data, certnum, "Subject", ccp);
+    result = ssl_push_certinfo_dyn(data, certnum, "Subject", &out);
     if(result)
-      return result;
+      goto done;
   }
-  if(!certnum)
-    infof(data, "%2d Subject: %s", certnum, ccp);
-  free((char *) ccp);
+  curlx_dyn_reset(&out);
 
   /* Issuer. */
-  ccp = DNtostr(&cert.issuer);
-  if(!ccp)
-    return CURLE_OUT_OF_MEMORY;
-  if(data->set.ssl.certinfo) {
-    result = ssl_push_certinfo(data, certnum, "Issuer", ccp);
-  }
-  if(!certnum)
-    infof(data, "   Issuer: %s", ccp);
-  free((char *) ccp);
+  result = DNtostr(&out, &cert.issuer);
   if(result)
-    return result;
+    goto done;
+  if(data->set.ssl.certinfo) {
+    result = ssl_push_certinfo_dyn(data, certnum, "Issuer", &out);
+    if(result)
+      goto done;
+  }
+  curlx_dyn_reset(&out);
 
   /* Version (always fits in less than 32 bits). */
   version = 0;
-  for(ccp = cert.version.beg; ccp < cert.version.end; ccp++)
-    version = (version << 8) | *(const unsigned char *) ccp;
+  for(ptr = cert.version.beg; ptr < cert.version.end; ptr++)
+    version = (version << 8) | *(const unsigned char *)ptr;
   if(data->set.ssl.certinfo) {
-    ccp = curl_maprintf("%x", version);
-    if(!ccp)
-      return CURLE_OUT_OF_MEMORY;
-    result = ssl_push_certinfo(data, certnum, "Version", ccp);
-    free((char *) ccp);
+    result = curlx_dyn_addf(&out, "%x", version);
     if(result)
-      return result;
+      goto done;
+    result = ssl_push_certinfo_dyn(data, certnum, "Version", &out);
+    if(result)
+      goto done;
+    curlx_dyn_reset(&out);
   }
-  if(!certnum)
-    infof(data, "   Version: %u (0x%x)", version + 1, version);
 
   /* Serial number. */
-  ccp = ASN1tostr(&cert.serialNumber, 0);
-  if(!ccp)
-    return CURLE_OUT_OF_MEMORY;
-  if(data->set.ssl.certinfo)
-    result = ssl_push_certinfo(data, certnum, "Serial Number", ccp);
-  if(!certnum)
-    infof(data, "   Serial Number: %s", ccp);
-  free((char *) ccp);
+  result = ASN1tostr(&out, &cert.serialNumber);
   if(result)
-    return result;
+    goto done;
+  if(data->set.ssl.certinfo) {
+    result = ssl_push_certinfo_dyn(data, certnum, "Serial Number", &out);
+    if(result)
+      goto done;
+  }
+  curlx_dyn_reset(&out);
 
   /* Signature algorithm .*/
-  ccp = dumpAlgo(&param, cert.signatureAlgorithm.beg,
-                 cert.signatureAlgorithm.end);
-  if(!ccp)
-    return CURLE_OUT_OF_MEMORY;
-  if(data->set.ssl.certinfo)
-    result = ssl_push_certinfo(data, certnum, "Signature Algorithm", ccp);
-  if(!certnum)
-    infof(data, "   Signature Algorithm: %s", ccp);
-  free((char *) ccp);
+  result = dumpAlgo(&out, &param, cert.signatureAlgorithm.beg,
+                    cert.signatureAlgorithm.end);
   if(result)
-    return result;
+    goto done;
+  if(data->set.ssl.certinfo) {
+    result = ssl_push_certinfo_dyn(data, certnum, "Signature Algorithm", &out);
+    if(result)
+      goto done;
+  }
+  curlx_dyn_reset(&out);
 
   /* Start Date. */
-  ccp = ASN1tostr(&cert.notBefore, 0);
-  if(!ccp)
-    return CURLE_OUT_OF_MEMORY;
-  if(data->set.ssl.certinfo)
-    result = ssl_push_certinfo(data, certnum, "Start Date", ccp);
-  if(!certnum)
-    infof(data, "   Start Date: %s", ccp);
-  free((char *) ccp);
+  result = ASN1tostr(&out, &cert.notBefore);
   if(result)
-    return result;
+    goto done;
+  if(data->set.ssl.certinfo) {
+    result = ssl_push_certinfo_dyn(data, certnum, "Start Date", &out);
+    if(result)
+      goto done;
+  }
+  curlx_dyn_reset(&out);
 
   /* Expire Date. */
-  ccp = ASN1tostr(&cert.notAfter, 0);
-  if(!ccp)
-    return CURLE_OUT_OF_MEMORY;
-  if(data->set.ssl.certinfo)
-    result = ssl_push_certinfo(data, certnum, "Expire Date", ccp);
-  if(!certnum)
-    infof(data, "   Expire Date: %s", ccp);
-  free((char *) ccp);
+  result = ASN1tostr(&out, &cert.notAfter);
   if(result)
-    return result;
+    goto done;
+  if(data->set.ssl.certinfo) {
+    result = ssl_push_certinfo_dyn(data, certnum, "Expire Date", &out);
+    if(result)
+      goto done;
+  }
+  curlx_dyn_reset(&out);
 
   /* Public Key Algorithm. */
-  ccp = dumpAlgo(&param, cert.subjectPublicKeyAlgorithm.beg,
-                 cert.subjectPublicKeyAlgorithm.end);
-  if(!ccp)
-    return CURLE_OUT_OF_MEMORY;
-  if(data->set.ssl.certinfo)
-    result = ssl_push_certinfo(data, certnum, "Public Key Algorithm",
-                                    ccp);
-  if(!result) {
-    int ret;
-    if(!certnum)
-      infof(data, "   Public Key Algorithm: %s", ccp);
-    ret = do_pubkey(data, certnum, ccp, &param, &cert.subjectPublicKey);
-    if(ret)
-      result = CURLE_OUT_OF_MEMORY; /* the most likely error */
-  }
-  free((char *) ccp);
+  result = dumpAlgo(&out, &param, cert.subjectPublicKeyAlgorithm.beg,
+                    cert.subjectPublicKeyAlgorithm.end);
   if(result)
-    return result;
+    goto done;
+  if(data->set.ssl.certinfo) {
+    result = ssl_push_certinfo_dyn(data, certnum, "Public Key Algorithm",
+                                   &out);
+    if(result)
+      goto done;
+  }
+
+  rc = do_pubkey(data, certnum, curlx_dyn_ptr(&out),
+                 &param, &cert.subjectPublicKey);
+  if(rc) {
+    result = CURLE_OUT_OF_MEMORY; /* the most likely error */
+    goto done;
+  }
+  curlx_dyn_reset(&out);
 
   /* Signature. */
-  ccp = ASN1tostr(&cert.signature, 0);
-  if(!ccp)
-    return CURLE_OUT_OF_MEMORY;
-  if(data->set.ssl.certinfo)
-    result = ssl_push_certinfo(data, certnum, "Signature", ccp);
-  if(!certnum)
-    infof(data, "   Signature: %s", ccp);
-  free((char *) ccp);
+  result = ASN1tostr(&out, &cert.signature);
   if(result)
-    return result;
+    goto done;
+  if(data->set.ssl.certinfo) {
+    result = ssl_push_certinfo_dyn(data, certnum, "Signature", &out);
+    if(result)
+      goto done;
+  }
+  curlx_dyn_reset(&out);
 
   /* Generate PEM certificate. */
-  result = Curl_base64_encode(cert.certificate.beg,
-                              cert.certificate.end - cert.certificate.beg,
-                              &cp1, &cl1);
+  result = curlx_base64_encode((const uint8_t *)cert.certificate.beg,
+                               cert.certificate.end - cert.certificate.beg,
+                               &certptr, &clen);
   if(result)
-    return result;
-  /* Compute the number of characters in final certificate string. Format is:
+    goto done;
+
+  /* Generate the final output certificate string. Format is:
      -----BEGIN CERTIFICATE-----\n
      <max 64 base64 characters>\n
      .
@@ -1232,207 +1235,37 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data,
      .
      -----END CERTIFICATE-----\n
    */
-  i = 28 + cl1 + (cl1 + 64 - 1) / 64 + 26;
-  cp2 = malloc(i + 1);
-  if(!cp2) {
-    free(cp1);
-    return CURLE_OUT_OF_MEMORY;
-  }
+
+  curlx_dyn_reset(&out);
+
   /* Build the certificate string. */
-  i = copySubstring(cp2, "-----BEGIN CERTIFICATE-----");
-  for(j = 0; j < cl1; j += 64)
-    i += copySubstring(cp2 + i, cp1 + j);
-  i += copySubstring(cp2 + i, "-----END CERTIFICATE-----");
-  cp2[i] = '\0';
-  free(cp1);
-  if(data->set.ssl.certinfo)
-    result = ssl_push_certinfo(data, certnum, "Cert", cp2);
-  if(!certnum)
-    infof(data, "%s", cp2);
-  free(cp2);
+  result = curlx_dyn_add(&out, "-----BEGIN CERTIFICATE-----\n");
+  if(!result) {
+    size_t j = 0;
+
+    while(!result && (j < clen)) {
+      size_t chunksize = (clen - j) > 64 ? 64 : (clen - j);
+      result = curlx_dyn_addn(&out, &certptr[j], chunksize);
+      if(!result)
+        result = curlx_dyn_addn(&out, "\n", 1);
+      j += chunksize;
+    }
+    if(!result)
+      result = curlx_dyn_add(&out, "-----END CERTIFICATE-----\n");
+  }
+  curlx_free(certptr);
+  if(!result)
+    if(data->set.ssl.certinfo)
+      result = ssl_push_certinfo_dyn(data, certnum, "Cert", &out);
+
+done:
+  if(result)
+    failf(data, "Failed extracting certificate chain");
+  curlx_dyn_free(&out);
   return result;
 }
 
 #endif /* WANT_EXTRACT_CERTINFO */
 
-#endif /* USE_GNUTLS or USE_WOLFSSL or USE_SCHANNEL or USE_SECTRANSP */
-
-#ifdef WANT_VERIFYHOST
-
-static const char *checkOID(const char *beg, const char *end,
-                            const char *oid)
-{
-  struct Curl_asn1Element e;
-  const char *ccp;
-  const char *p;
-  bool matched;
-
-  /* Check if first ASN.1 element at `beg' is the given OID.
-     Return a pointer in the source after the OID if found, else NULL. */
-
-  ccp = getASN1Element(&e, beg, end);
-  if(!ccp || e.tag != CURL_ASN1_OBJECT_IDENTIFIER)
-    return NULL;
-
-  p = OID2str(e.beg, e.end, FALSE);
-  if(!p)
-    return NULL;
-
-  matched = !strcmp(p, oid);
-  free((char *) p);
-  return matched? ccp: NULL;
-}
-
-CURLcode Curl_verifyhost(struct Curl_cfilter *cf,
-                         struct Curl_easy *data,
-                         const char *beg, const char *end)
-{
-  struct ssl_connect_data *connssl = cf->ctx;
-  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
-  struct Curl_X509certificate cert;
-  struct Curl_asn1Element dn;
-  struct Curl_asn1Element elem;
-  struct Curl_asn1Element ext;
-  struct Curl_asn1Element name;
-  const char *p;
-  const char *q;
-  char *dnsname;
-  int matched = -1;
-  size_t addrlen = (size_t) -1;
-  ssize_t len;
-  size_t hostlen;
-
-#ifdef ENABLE_IPV6
-  struct in6_addr addr;
-#else
-  struct in_addr addr;
-#endif
-
-  /* Verify that connection server matches info in X509 certificate at
-     `beg'..`end'. */
-
-  if(!conn_config->verifyhost)
-    return CURLE_OK;
-
-  if(Curl_parseX509(&cert, beg, end))
-    return CURLE_PEER_FAILED_VERIFICATION;
-
-  hostlen = strlen(connssl->hostname);
-
-  /* Get the server IP address. */
-#ifdef ENABLE_IPV6
-  if(cf->conn->bits.ipv6_ip &&
-     Curl_inet_pton(AF_INET6, connssl->hostname, &addr))
-    addrlen = sizeof(struct in6_addr);
-  else
-#endif
-  if(Curl_inet_pton(AF_INET, connssl->hostname, &addr))
-    addrlen = sizeof(struct in_addr);
-
-  /* Process extensions. */
-  for(p = cert.extensions.beg; p < cert.extensions.end && matched != 1;) {
-    p = getASN1Element(&ext, p, cert.extensions.end);
-    if(!p)
-      return CURLE_PEER_FAILED_VERIFICATION;
-
-    /* Check if extension is a subjectAlternativeName. */
-    ext.beg = checkOID(ext.beg, ext.end, sanOID);
-    if(ext.beg) {
-      ext.beg = getASN1Element(&elem, ext.beg, ext.end);
-      if(!ext.beg)
-        return CURLE_PEER_FAILED_VERIFICATION;
-      /* Skip critical if present. */
-      if(elem.tag == CURL_ASN1_BOOLEAN) {
-        ext.beg = getASN1Element(&elem, ext.beg, ext.end);
-        if(!ext.beg)
-          return CURLE_PEER_FAILED_VERIFICATION;
-      }
-      /* Parse the octet string contents: is a single sequence. */
-      if(!getASN1Element(&elem, elem.beg, elem.end))
-        return CURLE_PEER_FAILED_VERIFICATION;
-      /* Check all GeneralNames. */
-      for(q = elem.beg; matched != 1 && q < elem.end;) {
-        q = getASN1Element(&name, q, elem.end);
-        if(!q)
-          break;
-        switch(name.tag) {
-        case 2: /* DNS name. */
-          len = utf8asn1str(&dnsname, CURL_ASN1_IA5_STRING,
-                            name.beg, name.end);
-          if(len > 0 && (size_t)len == strlen(dnsname))
-            matched = Curl_cert_hostcheck(dnsname, (size_t)len,
-                                          connssl->hostname, hostlen);
-          else
-            matched = 0;
-          free(dnsname);
-          break;
-
-        case 7: /* IP address. */
-          matched = (size_t)(name.end - name.beg) == addrlen &&
-            !memcmp(&addr, name.beg, addrlen);
-          break;
-        }
-      }
-    }
-  }
-
-  switch(matched) {
-  case 1:
-    /* an alternative name matched the server hostname */
-    infof(data, "  subjectAltName: %s matched", connssl->dispname);
-    return CURLE_OK;
-  case 0:
-    /* an alternative name field existed, but didn't match and then
-       we MUST fail */
-    infof(data, "  subjectAltName does not match %s", connssl->dispname);
-    return CURLE_PEER_FAILED_VERIFICATION;
-  }
-
-  /* Process subject. */
-  name.header = NULL;
-  name.beg = name.end = "";
-  q = cert.subject.beg;
-  /* we have to look to the last occurrence of a commonName in the
-     distinguished one to get the most significant one. */
-  while(q < cert.subject.end) {
-    q = getASN1Element(&dn, q, cert.subject.end);
-    if(!q)
-      break;
-    for(p = dn.beg; p < dn.end;) {
-      p = getASN1Element(&elem, p, dn.end);
-      if(!p)
-        return CURLE_PEER_FAILED_VERIFICATION;
-      /* We have a DN's AttributeTypeAndValue: check it in case it's a CN. */
-      elem.beg = checkOID(elem.beg, elem.end, cnOID);
-      if(elem.beg)
-        name = elem;    /* Latch CN. */
-    }
-  }
-
-  /* Check the CN if found. */
-  if(!getASN1Element(&elem, name.beg, name.end))
-    failf(data, "SSL: unable to obtain common name from peer certificate");
-  else {
-    len = utf8asn1str(&dnsname, elem.tag, elem.beg, elem.end);
-    if(len < 0) {
-      free(dnsname);
-      return CURLE_OUT_OF_MEMORY;
-    }
-    if(strlen(dnsname) != (size_t) len)         /* Nul byte in string ? */
-      failf(data, "SSL: illegal cert name field");
-    else if(Curl_cert_hostcheck((const char *) dnsname,
-                                len, connssl->hostname, hostlen)) {
-      infof(data, "  common name: %s (matched)", dnsname);
-      free(dnsname);
-      return CURLE_OK;
-    }
-    else
-      failf(data, "SSL: certificate subject name '%s' does not match "
-            "target host name '%s'", dnsname, connssl->dispname);
-    free(dnsname);
-  }
-
-  return CURLE_PEER_FAILED_VERIFICATION;
-}
-
-#endif /* WANT_VERIFYHOST */
+#endif /* USE_GNUTLS || USE_WOLFSSL || USE_SCHANNEL || USE_MBEDTLS ||
+          USE_RUSTLS */
diff --git a/third-party/curl/lib/vtls/x509asn1.h b/third-party/curl/lib/vtls/x509asn1.h
index 23a67b828a..dda55ac77f 100644
--- a/third-party/curl/lib/vtls/x509asn1.h
+++ b/third-party/curl/lib/vtls/x509asn1.h
@@ -24,15 +24,53 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "curl_setup.h"
 
-#if defined(USE_GNUTLS) || defined(USE_WOLFSSL) || \
-  defined(USE_SCHANNEL) || defined(USE_SECTRANSP)
+/* forward-declare to make it visible in all builds */
+struct Curl_asn1Element;
+
+#if defined(USE_GNUTLS) || defined(USE_WOLFSSL) || defined(USE_SCHANNEL) || \
+  defined(USE_MBEDTLS) || defined(USE_RUSTLS)
 
 #include "cfilters.h"
 #include "urldata.h"
 
+/* ASN.1 classes. */
+/* #define CURL_ASN1_UNIVERSAL             0 */
+/* #define CURL_ASN1_APPLICATION           1 */
+/* #define CURL_ASN1_CONTEXT_SPECIFIC      2 */
+/* #define CURL_ASN1_PRIVATE               3 */
+
+/* ASN.1 types. */
+#define CURL_ASN1_BOOLEAN               1
+#define CURL_ASN1_INTEGER               2
+#define CURL_ASN1_BIT_STRING            3
+#define CURL_ASN1_OCTET_STRING          4
+#define CURL_ASN1_NULL                  5
+#define CURL_ASN1_OBJECT_IDENTIFIER     6
+/* #define CURL_ASN1_OBJECT_DESCRIPTOR     7 */
+/* #define CURL_ASN1_INSTANCE_OF           8 */
+/* #define CURL_ASN1_REAL                  9 */
+#define CURL_ASN1_ENUMERATED            10
+/* #define CURL_ASN1_EMBEDDED              11 */
+#define CURL_ASN1_UTF8_STRING           12
+/* #define CURL_ASN1_RELATIVE_OID          13 */
+/* #define CURL_ASN1_SEQUENCE              16 */
+/* #define CURL_ASN1_SET                   17 */
+#define CURL_ASN1_NUMERIC_STRING        18
+#define CURL_ASN1_PRINTABLE_STRING      19
+#define CURL_ASN1_TELETEX_STRING        20
+/* #define CURL_ASN1_VIDEOTEX_STRING       21 */
+#define CURL_ASN1_IA5_STRING            22
+#define CURL_ASN1_UTC_TIME              23
+#define CURL_ASN1_GENERALIZED_TIME      24
+/* #define CURL_ASN1_GRAPHIC_STRING        25 */
+#define CURL_ASN1_VISIBLE_STRING        26
+/* #define CURL_ASN1_GENERAL_STRING        27 */
+#define CURL_ASN1_UNIVERSAL_STRING      28
+/* #define CURL_ASN1_CHARACTER_STRING      29 */
+#define CURL_ASN1_BMP_STRING            30
+
 /*
  * Types.
  */
@@ -42,9 +80,9 @@ struct Curl_asn1Element {
   const char *header;         /* Pointer to header byte. */
   const char *beg;            /* Pointer to element data. */
   const char *end;            /* Pointer to 1st byte after element. */
-  unsigned char class;        /* ASN.1 element class. */
+  unsigned char eclass;       /* ASN.1 element class. */
   unsigned char tag;          /* ASN.1 element tag. */
-  bool          constructed;  /* Element is constructed. */
+  BIT(constructed);           /* Element is constructed. */
 };
 
 /* X509 certificate: RFC 5280. */
@@ -76,5 +114,6 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data, int certnum,
                                const char *beg, const char *end);
 CURLcode Curl_verifyhost(struct Curl_cfilter *cf, struct Curl_easy *data,
                          const char *beg, const char *end);
-#endif /* USE_GNUTLS or USE_WOLFSSL or USE_SCHANNEL or USE_SECTRANSP */
+#endif /* USE_GNUTLS || USE_WOLFSSL || USE_SCHANNEL || USE_MBEDTLS ||
+          USE_RUSTLS */
 #endif /* HEADER_CURL_X509ASN1_H */
diff --git a/third-party/curl/lib/warnless.c b/third-party/curl/lib/warnless.c
deleted file mode 100644
index 65c5ec5354..0000000000
--- a/third-party/curl/lib/warnless.c
+++ /dev/null
@@ -1,437 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#if defined(__INTEL_COMPILER) && defined(__unix__)
-
-#ifdef HAVE_NETINET_IN_H
-#  include <netinet/in.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#  include <arpa/inet.h>
-#endif
-
-#endif /* __INTEL_COMPILER && __unix__ */
-
-#include "warnless.h"
-
-#ifdef WIN32
-#undef read
-#undef write
-#endif
-
-#include <limits.h>
-
-#define CURL_MASK_UCHAR   ((unsigned char)~0)
-#define CURL_MASK_SCHAR   (CURL_MASK_UCHAR >> 1)
-
-#define CURL_MASK_USHORT  ((unsigned short)~0)
-#define CURL_MASK_SSHORT  (CURL_MASK_USHORT >> 1)
-
-#define CURL_MASK_UINT    ((unsigned int)~0)
-#define CURL_MASK_SINT    (CURL_MASK_UINT >> 1)
-
-#define CURL_MASK_ULONG   ((unsigned long)~0)
-#define CURL_MASK_SLONG   (CURL_MASK_ULONG >> 1)
-
-#define CURL_MASK_UCOFFT  ((unsigned CURL_TYPEOF_CURL_OFF_T)~0)
-#define CURL_MASK_SCOFFT  (CURL_MASK_UCOFFT >> 1)
-
-#define CURL_MASK_USIZE_T ((size_t)~0)
-#define CURL_MASK_SSIZE_T (CURL_MASK_USIZE_T >> 1)
-
-/*
-** unsigned long to unsigned short
-*/
-
-unsigned short curlx_ultous(unsigned long ulnum)
-{
-#ifdef __INTEL_COMPILER
-#  pragma warning(push)
-#  pragma warning(disable:810) /* conversion may lose significant bits */
-#endif
-
-  DEBUGASSERT(ulnum <= (unsigned long) CURL_MASK_USHORT);
-  return (unsigned short)(ulnum & (unsigned long) CURL_MASK_USHORT);
-
-#ifdef __INTEL_COMPILER
-#  pragma warning(pop)
-#endif
-}
-
-/*
-** unsigned long to unsigned char
-*/
-
-unsigned char curlx_ultouc(unsigned long ulnum)
-{
-#ifdef __INTEL_COMPILER
-#  pragma warning(push)
-#  pragma warning(disable:810) /* conversion may lose significant bits */
-#endif
-
-  DEBUGASSERT(ulnum <= (unsigned long) CURL_MASK_UCHAR);
-  return (unsigned char)(ulnum & (unsigned long) CURL_MASK_UCHAR);
-
-#ifdef __INTEL_COMPILER
-#  pragma warning(pop)
-#endif
-}
-
-/*
-** unsigned size_t to signed curl_off_t
-*/
-
-curl_off_t curlx_uztoso(size_t uznum)
-{
-#ifdef __INTEL_COMPILER
-#  pragma warning(push)
-#  pragma warning(disable:810) /* conversion may lose significant bits */
-#elif defined(_MSC_VER)
-#  pragma warning(push)
-#  pragma warning(disable:4310) /* cast truncates constant value */
-#endif
-
-  DEBUGASSERT(uznum <= (size_t) CURL_MASK_SCOFFT);
-  return (curl_off_t)(uznum & (size_t) CURL_MASK_SCOFFT);
-
-#if defined(__INTEL_COMPILER) || defined(_MSC_VER)
-#  pragma warning(pop)
-#endif
-}
-
-/*
-** unsigned size_t to signed int
-*/
-
-int curlx_uztosi(size_t uznum)
-{
-#ifdef __INTEL_COMPILER
-#  pragma warning(push)
-#  pragma warning(disable:810) /* conversion may lose significant bits */
-#endif
-
-  DEBUGASSERT(uznum <= (size_t) CURL_MASK_SINT);
-  return (int)(uznum & (size_t) CURL_MASK_SINT);
-
-#ifdef __INTEL_COMPILER
-#  pragma warning(pop)
-#endif
-}
-
-/*
-** unsigned size_t to unsigned long
-*/
-
-unsigned long curlx_uztoul(size_t uznum)
-{
-#ifdef __INTEL_COMPILER
-# pragma warning(push)
-# pragma warning(disable:810) /* conversion may lose significant bits */
-#endif
-
-#if ULONG_MAX < SIZE_T_MAX
-  DEBUGASSERT(uznum <= (size_t) CURL_MASK_ULONG);
-#endif
-  return (unsigned long)(uznum & (size_t) CURL_MASK_ULONG);
-
-#ifdef __INTEL_COMPILER
-# pragma warning(pop)
-#endif
-}
-
-/*
-** unsigned size_t to unsigned int
-*/
-
-unsigned int curlx_uztoui(size_t uznum)
-{
-#ifdef __INTEL_COMPILER
-# pragma warning(push)
-# pragma warning(disable:810) /* conversion may lose significant bits */
-#endif
-
-#if UINT_MAX < SIZE_T_MAX
-  DEBUGASSERT(uznum <= (size_t) CURL_MASK_UINT);
-#endif
-  return (unsigned int)(uznum & (size_t) CURL_MASK_UINT);
-
-#ifdef __INTEL_COMPILER
-# pragma warning(pop)
-#endif
-}
-
-/*
-** signed long to signed int
-*/
-
-int curlx_sltosi(long slnum)
-{
-#ifdef __INTEL_COMPILER
-#  pragma warning(push)
-#  pragma warning(disable:810) /* conversion may lose significant bits */
-#endif
-
-  DEBUGASSERT(slnum >= 0);
-#if INT_MAX < LONG_MAX
-  DEBUGASSERT((unsigned long) slnum <= (unsigned long) CURL_MASK_SINT);
-#endif
-  return (int)(slnum & (long) CURL_MASK_SINT);
-
-#ifdef __INTEL_COMPILER
-#  pragma warning(pop)
-#endif
-}
-
-/*
-** signed long to unsigned int
-*/
-
-unsigned int curlx_sltoui(long slnum)
-{
-#ifdef __INTEL_COMPILER
-#  pragma warning(push)
-#  pragma warning(disable:810) /* conversion may lose significant bits */
-#endif
-
-  DEBUGASSERT(slnum >= 0);
-#if UINT_MAX < LONG_MAX
-  DEBUGASSERT((unsigned long) slnum <= (unsigned long) CURL_MASK_UINT);
-#endif
-  return (unsigned int)(slnum & (long) CURL_MASK_UINT);
-
-#ifdef __INTEL_COMPILER
-#  pragma warning(pop)
-#endif
-}
-
-/*
-** signed long to unsigned short
-*/
-
-unsigned short curlx_sltous(long slnum)
-{
-#ifdef __INTEL_COMPILER
-#  pragma warning(push)
-#  pragma warning(disable:810) /* conversion may lose significant bits */
-#endif
-
-  DEBUGASSERT(slnum >= 0);
-  DEBUGASSERT((unsigned long) slnum <= (unsigned long) CURL_MASK_USHORT);
-  return (unsigned short)(slnum & (long) CURL_MASK_USHORT);
-
-#ifdef __INTEL_COMPILER
-#  pragma warning(pop)
-#endif
-}
-
-/*
-** unsigned size_t to signed ssize_t
-*/
-
-ssize_t curlx_uztosz(size_t uznum)
-{
-#ifdef __INTEL_COMPILER
-#  pragma warning(push)
-#  pragma warning(disable:810) /* conversion may lose significant bits */
-#endif
-
-  DEBUGASSERT(uznum <= (size_t) CURL_MASK_SSIZE_T);
-  return (ssize_t)(uznum & (size_t) CURL_MASK_SSIZE_T);
-
-#ifdef __INTEL_COMPILER
-#  pragma warning(pop)
-#endif
-}
-
-/*
-** signed curl_off_t to unsigned size_t
-*/
-
-size_t curlx_sotouz(curl_off_t sonum)
-{
-#ifdef __INTEL_COMPILER
-#  pragma warning(push)
-#  pragma warning(disable:810) /* conversion may lose significant bits */
-#endif
-
-  DEBUGASSERT(sonum >= 0);
-  return (size_t)(sonum & (curl_off_t) CURL_MASK_USIZE_T);
-
-#ifdef __INTEL_COMPILER
-#  pragma warning(pop)
-#endif
-}
-
-/*
-** signed ssize_t to signed int
-*/
-
-int curlx_sztosi(ssize_t sznum)
-{
-#ifdef __INTEL_COMPILER
-#  pragma warning(push)
-#  pragma warning(disable:810) /* conversion may lose significant bits */
-#endif
-
-  DEBUGASSERT(sznum >= 0);
-#if INT_MAX < SSIZE_T_MAX
-  DEBUGASSERT((size_t) sznum <= (size_t) CURL_MASK_SINT);
-#endif
-  return (int)(sznum & (ssize_t) CURL_MASK_SINT);
-
-#ifdef __INTEL_COMPILER
-#  pragma warning(pop)
-#endif
-}
-
-/*
-** unsigned int to unsigned short
-*/
-
-unsigned short curlx_uitous(unsigned int uinum)
-{
-#ifdef __INTEL_COMPILER
-#  pragma warning(push)
-#  pragma warning(disable:810) /* conversion may lose significant bits */
-#endif
-
-  DEBUGASSERT(uinum <= (unsigned int) CURL_MASK_USHORT);
-  return (unsigned short) (uinum & (unsigned int) CURL_MASK_USHORT);
-
-#ifdef __INTEL_COMPILER
-#  pragma warning(pop)
-#endif
-}
-
-/*
-** signed int to unsigned size_t
-*/
-
-size_t curlx_sitouz(int sinum)
-{
-#ifdef __INTEL_COMPILER
-#  pragma warning(push)
-#  pragma warning(disable:810) /* conversion may lose significant bits */
-#endif
-
-  DEBUGASSERT(sinum >= 0);
-  return (size_t) sinum;
-
-#ifdef __INTEL_COMPILER
-#  pragma warning(pop)
-#endif
-}
-
-#ifdef USE_WINSOCK
-
-/*
-** curl_socket_t to signed int
-*/
-
-int curlx_sktosi(curl_socket_t s)
-{
-  return (int)((ssize_t) s);
-}
-
-/*
-** signed int to curl_socket_t
-*/
-
-curl_socket_t curlx_sitosk(int i)
-{
-  return (curl_socket_t)((ssize_t) i);
-}
-
-#endif /* USE_WINSOCK */
-
-#if defined(WIN32)
-
-ssize_t curlx_read(int fd, void *buf, size_t count)
-{
-  return (ssize_t)read(fd, buf, curlx_uztoui(count));
-}
-
-ssize_t curlx_write(int fd, const void *buf, size_t count)
-{
-  return (ssize_t)write(fd, buf, curlx_uztoui(count));
-}
-
-/* Ensure that warnless.h continues to have an effect in "unity" builds. */
-#undef HEADER_CURL_WARNLESS_H
-
-#endif /* WIN32 */
-
-#if defined(__INTEL_COMPILER) && defined(__unix__)
-
-int curlx_FD_ISSET(int fd, fd_set *fdset)
-{
-  #pragma warning(push)
-  #pragma warning(disable:1469) /* clobber ignored */
-  return FD_ISSET(fd, fdset);
-  #pragma warning(pop)
-}
-
-void curlx_FD_SET(int fd, fd_set *fdset)
-{
-  #pragma warning(push)
-  #pragma warning(disable:1469) /* clobber ignored */
-  FD_SET(fd, fdset);
-  #pragma warning(pop)
-}
-
-void curlx_FD_ZERO(fd_set *fdset)
-{
-  #pragma warning(push)
-  #pragma warning(disable:593) /* variable was set but never used */
-  FD_ZERO(fdset);
-  #pragma warning(pop)
-}
-
-unsigned short curlx_htons(unsigned short usnum)
-{
-#if (__INTEL_COMPILER == 910) && defined(__i386__)
-  return (unsigned short)(((usnum << 8) & 0xFF00) | ((usnum >> 8) & 0x00FF));
-#else
-  #pragma warning(push)
-  #pragma warning(disable:810) /* conversion may lose significant bits */
-  return htons(usnum);
-  #pragma warning(pop)
-#endif
-}
-
-unsigned short curlx_ntohs(unsigned short usnum)
-{
-#if (__INTEL_COMPILER == 910) && defined(__i386__)
-  return (unsigned short)(((usnum << 8) & 0xFF00) | ((usnum >> 8) & 0x00FF));
-#else
-  #pragma warning(push)
-  #pragma warning(disable:810) /* conversion may lose significant bits */
-  return ntohs(usnum);
-  #pragma warning(pop)
-#endif
-}
-
-#endif /* __INTEL_COMPILER && __unix__ */
diff --git a/third-party/curl/lib/warnless.h b/third-party/curl/lib/warnless.h
deleted file mode 100644
index 2a5301628f..0000000000
--- a/third-party/curl/lib/warnless.h
+++ /dev/null
@@ -1,99 +0,0 @@
-#ifndef HEADER_CURL_WARNLESS_H
-#define HEADER_CURL_WARNLESS_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "curl_setup.h"
-
-#ifdef USE_WINSOCK
-#include <curl/curl.h> /* for curl_socket_t */
-#endif
-
-#define CURLX_FUNCTION_CAST(target_type, func) \
-  (target_type)(void (*) (void))(func)
-
-unsigned short curlx_ultous(unsigned long ulnum);
-
-unsigned char curlx_ultouc(unsigned long ulnum);
-
-int curlx_uztosi(size_t uznum);
-
-curl_off_t curlx_uztoso(size_t uznum);
-
-unsigned long curlx_uztoul(size_t uznum);
-
-unsigned int curlx_uztoui(size_t uznum);
-
-int curlx_sltosi(long slnum);
-
-unsigned int curlx_sltoui(long slnum);
-
-unsigned short curlx_sltous(long slnum);
-
-ssize_t curlx_uztosz(size_t uznum);
-
-size_t curlx_sotouz(curl_off_t sonum);
-
-int curlx_sztosi(ssize_t sznum);
-
-unsigned short curlx_uitous(unsigned int uinum);
-
-size_t curlx_sitouz(int sinum);
-
-#ifdef USE_WINSOCK
-
-int curlx_sktosi(curl_socket_t s);
-
-curl_socket_t curlx_sitosk(int i);
-
-#endif /* USE_WINSOCK */
-
-#if defined(WIN32)
-
-ssize_t curlx_read(int fd, void *buf, size_t count);
-
-ssize_t curlx_write(int fd, const void *buf, size_t count);
-
-#undef  read
-#define read(fd, buf, count)  curlx_read(fd, buf, count)
-#undef  write
-#define write(fd, buf, count) curlx_write(fd, buf, count)
-
-#endif /* WIN32 */
-
-#if defined(__INTEL_COMPILER) && defined(__unix__)
-
-int curlx_FD_ISSET(int fd, fd_set *fdset);
-
-void curlx_FD_SET(int fd, fd_set *fdset);
-
-void curlx_FD_ZERO(fd_set *fdset);
-
-unsigned short curlx_htons(unsigned short usnum);
-
-unsigned short curlx_ntohs(unsigned short usnum);
-
-#endif /* __INTEL_COMPILER && __unix__ */
-
-#endif /* HEADER_CURL_WARNLESS_H */
diff --git a/third-party/curl/lib/ws.c b/third-party/curl/lib/ws.c
index 3c1964b860..9820c3e4bd 100644
--- a/third-party/curl/lib/ws.c
+++ b/third-party/curl/lib/ws.c
@@ -22,127 +22,325 @@
  *
  ***************************************************************************/
 #include "curl_setup.h"
-#include <curl/curl.h>
-
-#ifdef USE_WEBSOCKETS
-
 #include "urldata.h"
+#include "ws.h"
+
+#ifndef CURL_DISABLE_WEBSOCKETS
+
+#include "url.h"
 #include "bufq.h"
-#include "dynbuf.h"
+#include "curlx/dynbuf.h"
 #include "rand.h"
-#include "curl_base64.h"
+#include "curlx/base64.h"
+#include "cf-recvbuf.h"
 #include "connect.h"
 #include "sendf.h"
+#include "curl_trc.h"
 #include "multiif.h"
-#include "ws.h"
 #include "easyif.h"
 #include "transfer.h"
-#include "nonblock.h"
+#include "select.h"
+#include "curlx/strparse.h"
+#include "curlx/strcopy.h"
 
-/* The last 3 #include files should be in this order */
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "memdebug.h"
+/***
+    RFC 6455 Section 5.2
 
-
-#define WSBIT_FIN 0x80
-#define WSBIT_OPCODE_CONT  0
-#define WSBIT_OPCODE_TEXT  (1)
-#define WSBIT_OPCODE_BIN   (2)
-#define WSBIT_OPCODE_CLOSE (8)
-#define WSBIT_OPCODE_PING  (9)
-#define WSBIT_OPCODE_PONG  (0xa)
-#define WSBIT_OPCODE_MASK  (0xf)
+      0 1 2 3 4 5 6 7
+     +-+-+-+-+-------+
+     |F|R|R|R| opcode|
+     |I|S|S|S|  (4)  |
+     |N|V|V|V|       |
+     | |1|2|3|       |
+*/
+#define WSBIT_FIN          0x80
+#define WSBIT_RSV1         0x40
+#define WSBIT_RSV2         0x20
+#define WSBIT_RSV3         0x10
+#define WSBIT_RSV_MASK     (WSBIT_RSV1 | WSBIT_RSV2 | WSBIT_RSV3)
+#define WSBIT_OPCODE_CONT  0x0
+#define WSBIT_OPCODE_TEXT  0x1
+#define WSBIT_OPCODE_BIN   0x2
+#define WSBIT_OPCODE_CLOSE 0x8
+#define WSBIT_OPCODE_PING  0x9
+#define WSBIT_OPCODE_PONG  0xa
+#ifdef CURLVERBOSE
+#define WSBIT_OPCODE_MASK  0xf
+#endif
 
 #define WSBIT_MASK 0x80
 
 /* buffer dimensioning */
-#define WS_CHUNK_SIZE 65535
+#define WS_CHUNK_SIZE  65535
 #define WS_CHUNK_COUNT 2
 
-struct ws_frame_meta {
-  char proto_opcode;
-  int flags;
-  const char *name;
+/* a client-side WS frame decoder, parsing frame headers and
+ * payload, keeping track of current position and stats */
+enum ws_dec_state {
+  WS_DEC_INIT,
+  WS_DEC_HEAD,
+  WS_DEC_PAYLOAD
 };
 
-static struct ws_frame_meta WS_FRAMES[] = {
-  { WSBIT_OPCODE_CONT,  CURLWS_CONT,   "CONT" },
-  { WSBIT_OPCODE_TEXT,  CURLWS_TEXT,   "TEXT" },
-  { WSBIT_OPCODE_BIN,   CURLWS_BINARY, "BIN" },
-  { WSBIT_OPCODE_CLOSE, CURLWS_CLOSE,  "CLOSE" },
-  { WSBIT_OPCODE_PING,  CURLWS_PING,   "PING" },
-  { WSBIT_OPCODE_PONG,  CURLWS_PONG,   "PONG" },
+struct ws_decoder {
+  int frame_age;        /* zero */
+  int frame_flags;      /* See the CURLWS_* defines */
+  curl_off_t payload_offset;   /* the offset parsing is at */
+  curl_off_t payload_len;
+  uint8_t head[10];
+  int head_len, head_total;
+  enum ws_dec_state state;
+  int cont_flags;
 };
 
-static const char *ws_frame_name_of_op(unsigned char proto_opcode)
+/* a client-side WS frame encoder, generating frame headers and
+ * converting payloads, tracking remaining data in current frame */
+struct ws_encoder {
+  curl_off_t payload_len;  /* payload length of current frame */
+  curl_off_t payload_remain;  /* remaining payload of current */
+  unsigned int xori; /* xor index */
+  uint8_t mask[4]; /* 32-bit mask for this connection */
+  uint8_t firstbyte; /* first byte of frame we encode */
+  BIT(contfragment); /* set TRUE if the previous fragment sent was not final */
+};
+
+/* Control frames are allowed up to 125 characters, rfc6455, ch. 5.5 */
+#define WS_MAX_CNTRL_LEN    125
+
+struct ws_cntrl_frame {
+  unsigned int type;
+  size_t payload_len;
+  uint8_t payload[WS_MAX_CNTRL_LEN];
+};
+
+/* A websocket connection with en- and decoder that treat frames
+ * and keep track of boundaries. */
+struct websocket {
+  struct Curl_easy *data; /* used for write callback handling */
+  struct ws_decoder dec;  /* decode of ws frames */
+  struct ws_encoder enc;  /* encode of ws frames */
+  struct bufq recvbuf;    /* raw data from the server */
+  struct bufq sendbuf;    /* raw data to be sent to the server */
+  struct curl_ws_frame recvframe;  /* the current WS FRAME received */
+  struct ws_cntrl_frame pending; /* a control frame pending to be sent */
+  size_t sendbuf_payload; /* number of payload bytes in sendbuf */
+};
+
+#ifdef CURLVERBOSE
+static const char *ws_frame_name_of_op(uint8_t firstbyte)
 {
-  unsigned char opcode = proto_opcode & WSBIT_OPCODE_MASK;
-  size_t i;
-  for(i = 0; i < sizeof(WS_FRAMES)/sizeof(WS_FRAMES[0]); ++i) {
-    if(WS_FRAMES[i].proto_opcode == opcode)
-      return WS_FRAMES[i].name;
+  switch(firstbyte & WSBIT_OPCODE_MASK) {
+  case WSBIT_OPCODE_CONT:
+    return "CONT";
+  case WSBIT_OPCODE_TEXT:
+    return "TEXT";
+  case WSBIT_OPCODE_BIN:
+    return "BIN";
+  case WSBIT_OPCODE_CLOSE:
+    return "CLOSE";
+  case WSBIT_OPCODE_PING:
+    return "PING";
+  case WSBIT_OPCODE_PONG:
+    return "PONG";
+  default:
+    return "???";
+  }
+}
+#endif
+
+static int ws_frame_firstbyte2flags(struct Curl_easy *data,
+                                    uint8_t firstbyte, int cont_flags)
+{
+  switch(firstbyte) {
+  /* 0x00 - intermediate TEXT/BINARY fragment */
+  case WSBIT_OPCODE_CONT:
+    if(!(cont_flags & CURLWS_CONT)) {
+      failf(data, "[WS] no ongoing fragmented message to resume");
+      return 0;
+    }
+    return cont_flags | CURLWS_CONT;
+  /* 0x80 - final TEXT/BIN fragment */
+  case (WSBIT_OPCODE_CONT | WSBIT_FIN):
+    if(!(cont_flags & CURLWS_CONT)) {
+      failf(data, "[WS] no ongoing fragmented message to resume");
+      return 0;
+    }
+    return cont_flags & ~CURLWS_CONT;
+  /* 0x01 - first TEXT fragment */
+  case WSBIT_OPCODE_TEXT:
+    if(cont_flags & CURLWS_CONT) {
+      failf(data, "[WS] fragmented message interrupted by new TEXT msg");
+      return 0;
+    }
+    return CURLWS_TEXT | CURLWS_CONT;
+  /* 0x81 - unfragmented TEXT msg */
+  case (WSBIT_OPCODE_TEXT | WSBIT_FIN):
+    if(cont_flags & CURLWS_CONT) {
+      failf(data, "[WS] fragmented message interrupted by new TEXT msg");
+      return 0;
+    }
+    return CURLWS_TEXT;
+  /* 0x02 - first BINARY fragment */
+  case WSBIT_OPCODE_BIN:
+    if(cont_flags & CURLWS_CONT) {
+      failf(data, "[WS] fragmented message interrupted by new BINARY msg");
+      return 0;
+    }
+    return CURLWS_BINARY | CURLWS_CONT;
+  /* 0x82 - unfragmented BINARY msg */
+  case (WSBIT_OPCODE_BIN | WSBIT_FIN):
+    if(cont_flags & CURLWS_CONT) {
+      failf(data, "[WS] fragmented message interrupted by new BINARY msg");
+      return 0;
+    }
+    return CURLWS_BINARY;
+  /* 0x08 - first CLOSE fragment */
+  case WSBIT_OPCODE_CLOSE:
+    failf(data, "[WS] invalid fragmented CLOSE frame");
+    return 0;
+  /* 0x88 - unfragmented CLOSE */
+  case (WSBIT_OPCODE_CLOSE | WSBIT_FIN):
+    return CURLWS_CLOSE;
+  /* 0x09 - first PING fragment */
+  case WSBIT_OPCODE_PING:
+    failf(data, "[WS] invalid fragmented PING frame");
+    return 0;
+  /* 0x89 - unfragmented PING */
+  case (WSBIT_OPCODE_PING | WSBIT_FIN):
+    return CURLWS_PING;
+  /* 0x0a - first PONG fragment */
+  case WSBIT_OPCODE_PONG:
+    failf(data, "[WS] invalid fragmented PONG frame");
+    return 0;
+  /* 0x8a - unfragmented PONG */
+  case (WSBIT_OPCODE_PONG | WSBIT_FIN):
+    return CURLWS_PONG;
+  /* invalid first byte */
+  default:
+    if(firstbyte & WSBIT_RSV_MASK)
+      /* any of the reserved bits 0x40/0x20/0x10 are set */
+      failf(data, "[WS] invalid reserved bits: %02x", firstbyte);
+    else
+      /* any of the reserved opcodes 0x3-0x7 or 0xb-0xf is used */
+      failf(data, "[WS] invalid opcode: %02x", firstbyte);
+    return 0;
   }
-  return "???";
 }
 
-static int ws_frame_op2flags(unsigned char proto_opcode)
+static CURLcode ws_frame_flags2firstbyte(struct Curl_easy *data,
+                                         unsigned int flags,
+                                         bool contfragment,
+                                         uint8_t *pfirstbyte)
 {
-  unsigned char opcode = proto_opcode & WSBIT_OPCODE_MASK;
-  size_t i;
-  for(i = 0; i < sizeof(WS_FRAMES)/sizeof(WS_FRAMES[0]); ++i) {
-    if(WS_FRAMES[i].proto_opcode == opcode)
-      return WS_FRAMES[i].flags;
+  *pfirstbyte = 0;
+  switch(flags & ~CURLWS_OFFSET) {
+  case 0:
+    if(contfragment) {
+      CURL_TRC_WS(data, "no flags given; interpreting as continuation "
+                  "fragment for compatibility");
+      *pfirstbyte = (WSBIT_OPCODE_CONT | WSBIT_FIN);
+      return CURLE_OK;
+    }
+    failf(data, "[WS] no flags given");
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  case CURLWS_CONT:
+    if(contfragment) {
+      infof(data, "[WS] setting CURLWS_CONT flag without message type is "
+                  "supported for compatibility but highly discouraged");
+      *pfirstbyte = WSBIT_OPCODE_CONT;
+      return CURLE_OK;
+    }
+    failf(data, "[WS] No ongoing fragmented message to continue");
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  case CURLWS_TEXT:
+    *pfirstbyte = contfragment ? (WSBIT_OPCODE_CONT | WSBIT_FIN)
+                               : (WSBIT_OPCODE_TEXT | WSBIT_FIN);
+    return CURLE_OK;
+  case (CURLWS_TEXT | CURLWS_CONT):
+    *pfirstbyte = contfragment ? WSBIT_OPCODE_CONT : WSBIT_OPCODE_TEXT;
+    return CURLE_OK;
+  case CURLWS_BINARY:
+    *pfirstbyte = contfragment ? (WSBIT_OPCODE_CONT | WSBIT_FIN)
+                               : (WSBIT_OPCODE_BIN | WSBIT_FIN);
+    return CURLE_OK;
+  case (CURLWS_BINARY | CURLWS_CONT):
+    *pfirstbyte = contfragment ? WSBIT_OPCODE_CONT : WSBIT_OPCODE_BIN;
+    return CURLE_OK;
+  case CURLWS_CLOSE:
+    *pfirstbyte = WSBIT_OPCODE_CLOSE | WSBIT_FIN;
+    return CURLE_OK;
+  case (CURLWS_CLOSE | CURLWS_CONT):
+    failf(data, "[WS] CLOSE frame must not be fragmented");
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  case CURLWS_PING:
+    *pfirstbyte = WSBIT_OPCODE_PING | WSBIT_FIN;
+    return CURLE_OK;
+  case (CURLWS_PING | CURLWS_CONT):
+    failf(data, "[WS] PING frame must not be fragmented");
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  case CURLWS_PONG:
+    *pfirstbyte = WSBIT_OPCODE_PONG | WSBIT_FIN;
+    return CURLE_OK;
+  case (CURLWS_PONG | CURLWS_CONT):
+    failf(data, "[WS] PONG frame must not be fragmented");
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  default:
+    failf(data, "[WS] unknown flags: %x", flags);
+    return CURLE_BAD_FUNCTION_ARGUMENT;
   }
-  return 0;
-}
-
-static unsigned char ws_frame_flags2op(int flags)
-{
-  size_t i;
-  for(i = 0; i < sizeof(WS_FRAMES)/sizeof(WS_FRAMES[0]); ++i) {
-    if(WS_FRAMES[i].flags & flags)
-      return WS_FRAMES[i].proto_opcode;
-  }
-  return 0;
 }
 
 static void ws_dec_info(struct ws_decoder *dec, struct Curl_easy *data,
                         const char *msg)
 {
+  NOVERBOSE((void)msg);
   switch(dec->head_len) {
   case 0:
     break;
   case 1:
-    infof(data, "WS-DEC: %s [%s%s]", msg,
-          ws_frame_name_of_op(dec->head[0]),
-          (dec->head[0] & WSBIT_FIN)? "" : " NON-FINAL");
+    CURL_TRC_WS(data, "decoded %s [%s%s]", msg,
+                ws_frame_name_of_op(dec->head[0]),
+                (dec->head[0] & WSBIT_FIN) ? "" : " NON-FINAL");
     break;
   default:
     if(dec->head_len < dec->head_total) {
-      infof(data, "WS-DEC: %s [%s%s](%d/%d)", msg,
-            ws_frame_name_of_op(dec->head[0]),
-            (dec->head[0] & WSBIT_FIN)? "" : " NON-FINAL",
-            dec->head_len, dec->head_total);
+      CURL_TRC_WS(data, "decoded %s [%s%s](%d/%d)", msg,
+                  ws_frame_name_of_op(dec->head[0]),
+                  (dec->head[0] & WSBIT_FIN) ? "" : " NON-FINAL",
+                  dec->head_len, dec->head_total);
     }
     else {
-      infof(data, "WS-DEC: %s [%s%s payload=%" CURL_FORMAT_CURL_OFF_T
-                  "/%" CURL_FORMAT_CURL_OFF_T "]",
-            msg, ws_frame_name_of_op(dec->head[0]),
-            (dec->head[0] & WSBIT_FIN)? "" : " NON-FINAL",
-            dec->payload_offset, dec->payload_len);
+      CURL_TRC_WS(data, "decoded %s [%s%s payload=%"
+                  FMT_OFF_T "/%" FMT_OFF_T "]",
+                  msg, ws_frame_name_of_op(dec->head[0]),
+                  (dec->head[0] & WSBIT_FIN) ? "" : " NON-FINAL",
+                  dec->payload_offset, dec->payload_len);
     }
     break;
   }
 }
 
-typedef ssize_t ws_write_payload(const unsigned char *buf, size_t buflen,
-                                 int frame_age, int frame_flags,
-                                 curl_off_t payload_offset,
-                                 curl_off_t payload_len,
-                                 void *userp,
-                                 CURLcode *err);
+static CURLcode ws_send_raw_blocking(struct Curl_easy *data,
+                                     struct websocket *ws,
+                                     const char *buffer, size_t buflen);
 
+typedef CURLcode ws_write_payload(const uint8_t *buf, size_t buflen,
+                                  int frame_age, int frame_flags,
+                                  curl_off_t payload_offset,
+                                  curl_off_t payload_len,
+                                  void *userp,
+                                  size_t *pnwritten);
+
+static void ws_dec_next_frame(struct ws_decoder *dec)
+{
+  dec->frame_age = 0;
+  dec->frame_flags = 0;
+  dec->payload_offset = 0;
+  dec->payload_len = 0;
+  dec->head_len = dec->head_total = 0;
+  dec->state = WS_DEC_INIT;
+  /* dec->cont_flags must be carried over to next frame */
+}
 
 static void ws_dec_reset(struct ws_decoder *dec)
 {
@@ -152,6 +350,7 @@ static void ws_dec_reset(struct ws_decoder *dec)
   dec->payload_len = 0;
   dec->head_len = dec->head_total = 0;
   dec->state = WS_DEC_INIT;
+  dec->cont_flags = 0;
 }
 
 static void ws_dec_init(struct ws_decoder *dec)
@@ -163,7 +362,7 @@ static CURLcode ws_dec_read_head(struct ws_decoder *dec,
                                  struct Curl_easy *data,
                                  struct bufq *inraw)
 {
-  const unsigned char *inbuf;
+  const uint8_t *inbuf;
   size_t inlen;
 
   while(Curl_bufq_peek(inraw, &inbuf, &inlen)) {
@@ -171,14 +370,23 @@ static CURLcode ws_dec_read_head(struct ws_decoder *dec,
       dec->head[0] = *inbuf;
       Curl_bufq_skip(inraw, 1);
 
-      dec->frame_flags  = ws_frame_op2flags(dec->head[0]);
+      dec->frame_flags = ws_frame_firstbyte2flags(data, dec->head[0],
+                                                  dec->cont_flags);
       if(!dec->frame_flags) {
-        failf(data, "WS: unknown opcode: %x", dec->head[0]);
         ws_dec_reset(dec);
         return CURLE_RECV_ERROR;
       }
+
+      /* fragmentation only applies to data frames (text/binary);
+       * control frames (close/ping/pong) do not affect the CONT status */
+      if(dec->frame_flags & (CURLWS_TEXT | CURLWS_BINARY)) {
+        dec->cont_flags = dec->frame_flags;
+      }
+
       dec->head_len = 1;
-      /* ws_dec_info(dec, data, "seeing opcode"); */
+#if 0
+      ws_dec_info(dec, data, "seeing opcode");
+#endif
       continue;
     }
     else if(dec->head_len == 1) {
@@ -188,10 +396,29 @@ static CURLcode ws_dec_read_head(struct ws_decoder *dec,
 
       if(dec->head[1] & WSBIT_MASK) {
         /* A client MUST close a connection if it detects a masked frame. */
-        failf(data, "WS: masked input frame");
+        failf(data, "[WS] masked input frame");
         ws_dec_reset(dec);
         return CURLE_RECV_ERROR;
       }
+      if(dec->frame_flags & CURLWS_PING && dec->head[1] > WS_MAX_CNTRL_LEN) {
+        /* The maximum valid size of PING frames is 125 bytes.
+           Accepting overlong pings would mean sending equivalent pongs! */
+        failf(data, "[WS] received PING frame is too big");
+        ws_dec_reset(dec);
+        return CURLE_RECV_ERROR;
+      }
+      if(dec->frame_flags & CURLWS_PONG && dec->head[1] > WS_MAX_CNTRL_LEN) {
+        /* The maximum valid size of PONG frames is 125 bytes. */
+        failf(data, "[WS] received PONG frame is too big");
+        ws_dec_reset(dec);
+        return CURLE_RECV_ERROR;
+      }
+      if(dec->frame_flags & CURLWS_CLOSE && dec->head[1] > WS_MAX_CNTRL_LEN) {
+        failf(data, "[WS] received CLOSE frame is too big");
+        ws_dec_reset(dec);
+        return CURLE_RECV_ERROR;
+      }
+
       /* How long is the frame head? */
       if(dec->head[1] == 126) {
         dec->head_total = 4;
@@ -211,7 +438,9 @@ static CURLcode ws_dec_read_head(struct ws_decoder *dec,
       Curl_bufq_skip(inraw, 1);
       ++dec->head_len;
       if(dec->head_len < dec->head_total) {
-        /* ws_dec_info(dec, data, "decoding head"); */
+#if 0
+        ws_dec_info(dec, data, "decoding head");
+#endif
         continue;
       }
     }
@@ -225,19 +454,24 @@ static CURLcode ws_dec_read_head(struct ws_decoder *dec,
       dec->payload_len = (dec->head[2] << 8) | dec->head[3];
       break;
     case 10:
-      dec->payload_len = ((curl_off_t)dec->head[2] << 56) |
+      if(dec->head[2] > 127) {
+        failf(data, "[WS] frame length longer than 63 bits not supported");
+        return CURLE_RECV_ERROR;
+      }
+      dec->payload_len =
+        (curl_off_t)dec->head[2] << 56 |
         (curl_off_t)dec->head[3] << 48 |
         (curl_off_t)dec->head[4] << 40 |
         (curl_off_t)dec->head[5] << 32 |
         (curl_off_t)dec->head[6] << 24 |
         (curl_off_t)dec->head[7] << 16 |
-        (curl_off_t)dec->head[8] << 8 |
+        (curl_off_t)dec->head[8] <<  8 |
         dec->head[9];
       break;
     default:
       /* this should never happen */
       DEBUGASSERT(0);
-      failf(data, "WS: unexpected frame header length");
+      failf(data, "[WS] unexpected frame header length");
       return CURLE_RECV_ERROR;
     }
 
@@ -252,39 +486,39 @@ static CURLcode ws_dec_read_head(struct ws_decoder *dec,
 static CURLcode ws_dec_pass_payload(struct ws_decoder *dec,
                                     struct Curl_easy *data,
                                     struct bufq *inraw,
-                                    ws_write_payload *write_payload,
+                                    ws_write_payload *write_cb,
                                     void *write_ctx)
 {
-  const unsigned char *inbuf;
+  const uint8_t *inbuf;
   size_t inlen;
-  ssize_t nwritten;
+  size_t nwritten;
   CURLcode result;
-  curl_off_t remain = dec->payload_len - dec->payload_offset;
+  size_t remain = curlx_sotouz_range(dec->payload_len - dec->payload_offset,
+                                     0, SIZE_MAX);
 
-  (void)data;
   while(remain && Curl_bufq_peek(inraw, &inbuf, &inlen)) {
-    if((curl_off_t)inlen > remain)
-      inlen = (size_t)remain;
-    nwritten = write_payload(inbuf, inlen, dec->frame_age, dec->frame_flags,
-                             dec->payload_offset, dec->payload_len,
-                             write_ctx, &result);
-    if(nwritten < 0)
+    if(inlen > remain)
+      inlen = remain;
+    result = write_cb(inbuf, inlen, dec->frame_age, dec->frame_flags,
+                      dec->payload_offset, dec->payload_len,
+                      write_ctx, &nwritten);
+    if(result)
       return result;
-    Curl_bufq_skip(inraw, (size_t)nwritten);
-    dec->payload_offset += (curl_off_t)nwritten;
-    remain = dec->payload_len - dec->payload_offset;
-    /* infof(data, "WS-DEC: passed  %zd bytes payload, %"
-                CURL_FORMAT_CURL_OFF_T " remain",
-          nwritten, remain); */
+    Curl_bufq_skip(inraw, nwritten);
+    dec->payload_offset += nwritten;
+    remain = curlx_sotouz_range(dec->payload_len - dec->payload_offset,
+                                0, SIZE_MAX);
+    CURL_TRC_WS(data, "passed %zu bytes payload, %zu remain",
+                nwritten, remain);
   }
 
-  return remain? CURLE_AGAIN : CURLE_OK;
+  return remain ? CURLE_AGAIN : CURLE_OK;
 }
 
 static CURLcode ws_dec_pass(struct ws_decoder *dec,
                             struct Curl_easy *data,
                             struct bufq *inraw,
-                            ws_write_payload *write_payload,
+                            ws_write_payload *write_cb,
                             void *write_ctx)
 {
   CURLcode result;
@@ -294,14 +528,14 @@ static CURLcode ws_dec_pass(struct ws_decoder *dec,
 
   switch(dec->state) {
   case WS_DEC_INIT:
-    ws_dec_reset(dec);
+    ws_dec_next_frame(dec);
     dec->state = WS_DEC_HEAD;
-    /* FALLTHROUGH */
+    FALLTHROUGH();
   case WS_DEC_HEAD:
     result = ws_dec_read_head(dec, data, inraw);
     if(result) {
       if(result != CURLE_AGAIN) {
-        infof(data, "WS: decode error %d", (int)result);
+        failf(data, "[WS] decode frame error %d", (int)result);
         break;  /* real error */
       }
       /* incomplete ws frame head */
@@ -311,27 +545,27 @@ static CURLcode ws_dec_pass(struct ws_decoder *dec,
     /* head parsing done */
     dec->state = WS_DEC_PAYLOAD;
     if(dec->payload_len == 0) {
-      ssize_t nwritten;
-      const unsigned char tmp = '\0';
+      size_t nwritten;
+      const uint8_t tmp = '\0';
       /* special case of a 0 length frame, need to write once */
-      nwritten = write_payload(&tmp, 0, dec->frame_age, dec->frame_flags,
-                               0, 0, write_ctx, &result);
-      if(nwritten < 0)
+      result = write_cb(&tmp, 0, dec->frame_age, dec->frame_flags,
+                        0, 0, write_ctx, &nwritten);
+      if(result)
         return result;
       dec->state = WS_DEC_INIT;
       break;
     }
-    /* FALLTHROUGH */
+    FALLTHROUGH();
   case WS_DEC_PAYLOAD:
-    result = ws_dec_pass_payload(dec, data, inraw, write_payload, write_ctx);
+    result = ws_dec_pass_payload(dec, data, inraw, write_cb, write_ctx);
     ws_dec_info(dec, data, "passing");
     if(result)
       return result;
-    /* paylod parsing done */
+    /* payload parsing done */
     dec->state = WS_DEC_INIT;
     break;
   default:
-    /* we covered all enums above, but some code analyzers are whimps */
+    /* we covered all enums above, but some code analyzers are wimps */
     result = CURLE_FAILED_INIT;
   }
   return result;
@@ -343,23 +577,217 @@ static void update_meta(struct websocket *ws,
                         curl_off_t payload_len,
                         size_t cur_len)
 {
-  ws->frame.age = frame_age;
-  ws->frame.flags = frame_flags;
-  ws->frame.offset = payload_offset;
-  ws->frame.len = cur_len;
-  ws->frame.bytesleft = (payload_len - payload_offset - cur_len);
+  curl_off_t bytesleft = (payload_len - payload_offset - cur_len);
+
+  ws->recvframe.age = frame_age;
+  ws->recvframe.flags = frame_flags;
+  ws->recvframe.offset = payload_offset;
+  ws->recvframe.len = cur_len;
+  ws->recvframe.bytesleft = bytesleft;
 }
 
+/* WebSocket decoding client writer */
+struct ws_cw_ctx {
+  struct Curl_cwriter super;
+  struct bufq buf;
+};
+
+static CURLcode ws_cw_init(struct Curl_easy *data,
+                           struct Curl_cwriter *writer)
+{
+  struct ws_cw_ctx *ctx = writer->ctx;
+  (void)data;
+  Curl_bufq_init2(&ctx->buf, WS_CHUNK_SIZE, 1, BUFQ_OPT_SOFT_LIMIT);
+  return CURLE_OK;
+}
+
+static void ws_cw_close(struct Curl_easy *data, struct Curl_cwriter *writer)
+{
+  struct ws_cw_ctx *ctx = writer->ctx;
+  (void)data;
+  Curl_bufq_free(&ctx->buf);
+}
+
+struct ws_cw_dec_ctx {
+  struct Curl_easy *data;
+  struct websocket *ws;
+  struct Curl_cwriter *next_writer;
+  int cw_type;
+};
+
+static CURLcode ws_flush(struct Curl_easy *data, struct websocket *ws,
+                         bool blocking);
+static CURLcode ws_enc_send(struct Curl_easy *data,
+                            struct websocket *ws,
+                            const uint8_t *buffer,
+                            size_t buflen,
+                            curl_off_t fragsize,
+                            unsigned int flags,
+                            size_t *pnsent);
+static CURLcode ws_enc_add_pending(struct Curl_easy *data,
+                                   struct websocket *ws);
+
+static CURLcode ws_enc_add_cntrl(struct Curl_easy *data,
+                                 struct websocket *ws,
+                                 const uint8_t *payload,
+                                 size_t plen,
+                                 unsigned int frame_type)
+{
+  (void)data;
+  DEBUGASSERT(plen <= WS_MAX_CNTRL_LEN);
+  if(plen > WS_MAX_CNTRL_LEN)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  /* Overwrite any pending frame with the new one, we keep
+   * only one. */
+  ws->pending.type = frame_type;
+  ws->pending.payload_len = plen;
+  memcpy(ws->pending.payload, payload, plen);
+  return CURLE_OK;
+}
+
+static curl_off_t ws_payload_remain(curl_off_t payload_total,
+                                    curl_off_t payload_offset,
+                                    size_t payload_buffered)
+{
+  curl_off_t buffered, remain = payload_total - payload_offset;
+  if((payload_total < 0) || (payload_offset < 0) || (remain < 0))
+    return -1;
+  buffered = curlx_uztoso(payload_buffered);
+  if(remain < buffered)
+    return -1;
+  return remain - buffered;
+}
+
+static CURLcode ws_cw_dec_next(const uint8_t *buf, size_t buflen,
+                               int frame_age, int frame_flags,
+                               curl_off_t payload_offset,
+                               curl_off_t payload_len,
+                               void *user_data,
+                               size_t *pnwritten)
+{
+  struct ws_cw_dec_ctx *ctx = user_data;
+  struct Curl_easy *data = ctx->data;
+  struct websocket *ws = ctx->ws;
+  bool auto_pong = !data->set.ws_no_auto_pong;
+  curl_off_t remain;
+  CURLcode result;
+
+  (void)frame_age;
+  *pnwritten = 0;
+  remain = ws_payload_remain(payload_len, payload_offset, buflen);
+  if(remain < 0) {
+    DEBUGASSERT(0); /* parameter mismatch */
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
+
+  if(auto_pong && (frame_flags & CURLWS_PING) && !remain) {
+    /* auto-respond to PINGs, only works for single-frame payloads atm */
+    CURL_TRC_WS(data, "auto PONG to [PING payload=%" FMT_OFF_T
+                "/%" FMT_OFF_T "]", payload_offset, payload_len);
+    /* send back the exact same content as a PONG */
+    result = ws_enc_add_cntrl(data, ws, buf, buflen, CURLWS_PONG);
+    if(result)
+      return result;
+  }
+  else if(buflen || !remain) {
+    /* forward the decoded frame to the next client writer. */
+    update_meta(ws, frame_age, frame_flags, payload_offset,
+                payload_len, buflen);
+
+    result = Curl_cwriter_write(data, ctx->next_writer,
+                                (ctx->cw_type | CLIENTWRITE_0LEN),
+                                (const char *)buf, buflen);
+    if(result)
+      return result;
+  }
+  *pnwritten = buflen;
+  return CURLE_OK;
+}
+
+static CURLcode ws_cw_write(struct Curl_easy *data,
+                            struct Curl_cwriter *writer, int type,
+                            const char *buf, size_t nbytes)
+{
+  struct ws_cw_ctx *ctx = writer->ctx;
+  struct websocket *ws;
+  CURLcode result = CURLE_OK;
+
+  CURL_TRC_WRITE(data, "ws_cw_write(len=%zu, type=%d)", nbytes, type);
+  if(!(type & CLIENTWRITE_BODY) || data->set.ws_raw_mode)
+    return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
+
+  ws = Curl_conn_meta_get(data->conn, CURL_META_PROTO_WS_CONN);
+  if(!ws) {
+    failf(data, "[WS] not a websocket transfer");
+    return CURLE_FAILED_INIT;
+  }
+
+  if(nbytes) {
+    size_t nwritten;
+    result = Curl_bufq_write(&ctx->buf, (const uint8_t *)buf,
+                             nbytes, &nwritten);
+    if(result) {
+      infof(data, "[WS] error adding data to buffer %d", (int)result);
+      return result;
+    }
+  }
+
+  while(!Curl_bufq_is_empty(&ctx->buf)) {
+    struct ws_cw_dec_ctx pass_ctx;
+    pass_ctx.data = data;
+    pass_ctx.ws = ws;
+    pass_ctx.next_writer = writer->next;
+    pass_ctx.cw_type = type;
+    result = ws_dec_pass(&ws->dec, data, &ctx->buf,
+                         ws_cw_dec_next, &pass_ctx);
+    if(result == CURLE_AGAIN) {
+      /* insufficient amount of data, keep it for later.
+       * we pretend to have written all since we have a copy */
+      result = CURLE_OK;
+      goto out;
+    }
+    else if(result) {
+      failf(data, "[WS] decode payload error %d", (int)result);
+      return result;
+    }
+  }
+
+  if((type & CLIENTWRITE_EOS) && !Curl_bufq_is_empty(&ctx->buf)) {
+    failf(data, "[WS] decode ending with %zu frame bytes remaining",
+          Curl_bufq_len(&ctx->buf));
+    result = CURLE_RECV_ERROR;
+  }
+
+out:
+  if(!result) {
+    result = ws_flush(data, ws, Curl_is_in_callback(data));
+    if(result == CURLE_AGAIN)
+      result = CURLE_OK;
+  }
+  return result;
+}
+
+/* WebSocket payload decoding client writer. */
+static const struct Curl_cwtype ws_cw_decode = {
+  "ws-decode",
+  NULL,
+  ws_cw_init,
+  ws_cw_write,
+  ws_cw_close,
+  sizeof(struct ws_cw_ctx)
+};
+
 static void ws_enc_info(struct ws_encoder *enc, struct Curl_easy *data,
                         const char *msg)
 {
-  infof(data, "WS-ENC: %s [%s%s%s payload=%" CURL_FORMAT_CURL_OFF_T
-              "/%" CURL_FORMAT_CURL_OFF_T "]",
-        msg, ws_frame_name_of_op(enc->firstbyte),
-        (enc->firstbyte & WSBIT_OPCODE_MASK) == WSBIT_OPCODE_CONT ?
-        " CONT" : "",
-        (enc->firstbyte & WSBIT_FIN)? "" : " NON-FIN",
-        enc->payload_len - enc->payload_remain, enc->payload_len);
+  NOVERBOSE((void)enc);
+  NOVERBOSE((void)msg);
+  CURL_TRC_WS(data, "WS-ENC: %s [%s%s payload=%"
+              FMT_OFF_T "/%" FMT_OFF_T "]",
+              msg, ws_frame_name_of_op(enc->firstbyte),
+              (enc->firstbyte & WSBIT_FIN) ? "" : " NON-FIN",
+              enc->payload_len - enc->payload_remain, enc->payload_len);
 }
 
 static void ws_enc_reset(struct ws_encoder *enc)
@@ -397,165 +825,446 @@ static void ws_enc_init(struct ws_encoder *enc)
      +---------------------------------------------------------------+
 */
 
-static ssize_t ws_enc_write_head(struct Curl_easy *data,
+static CURLcode ws_enc_add_frame(struct Curl_easy *data,
                                  struct ws_encoder *enc,
                                  unsigned int flags,
                                  curl_off_t payload_len,
-                                 struct bufq *out,
-                                 CURLcode *err)
+                                 struct bufq *out)
 {
-  unsigned char firstbyte = 0;
-  unsigned char opcode;
-  unsigned char head[14];
-  size_t hlen;
-  ssize_t n;
+  uint8_t firstb = 0;
+  uint8_t head[14];
+  CURLcode result;
+  size_t hlen, nwritten;
+
+  if(payload_len < 0) {
+    failf(data, "[WS] starting new frame with negative payload length %"
+                FMT_OFF_T, payload_len);
+    return CURLE_SEND_ERROR;
+  }
 
   if(enc->payload_remain > 0) {
     /* trying to write a new frame before the previous one is finished */
-    failf(data, "WS: starting new frame with %zd bytes from last one"
-                "remaining to be sent", (ssize_t)enc->payload_remain);
-    *err = CURLE_SEND_ERROR;
-    return -1;
+    failf(data, "[WS] starting new frame with %" FMT_OFF_T " bytes "
+                "from last one remaining to be sent", enc->payload_remain);
+    return CURLE_SEND_ERROR;
   }
 
-  opcode = ws_frame_flags2op(flags);
-  if(!opcode) {
-    failf(data, "WS: provided flags not recognized '%x'", flags);
-    *err = CURLE_SEND_ERROR;
-    return -1;
+  result = ws_frame_flags2firstbyte(data, flags, (bool)enc->contfragment,
+                                    &firstb);
+  if(result)
+    return result;
+
+  /* fragmentation only applies to data frames (text/binary);
+   * control frames (close/ping/pong) do not affect the CONT status */
+  if(flags & (CURLWS_TEXT | CURLWS_BINARY)) {
+    enc->contfragment = (curl_bit)((flags & CURLWS_CONT) ? TRUE : FALSE);
   }
 
-  if(!(flags & CURLWS_CONT)) {
-    if(!enc->contfragment)
-      /* not marked as continuing, this is the final fragment */
-      firstbyte |= WSBIT_FIN | opcode;
-    else
-      /* marked as continuing, this is the final fragment; set CONT
-         opcode and FIN bit */
-      firstbyte |= WSBIT_FIN | WSBIT_OPCODE_CONT;
-
-    enc->contfragment = FALSE;
+  if(flags & CURLWS_PING && payload_len > WS_MAX_CNTRL_LEN) {
+    failf(data, "[WS] given PING frame is too big");
+    return CURLE_TOO_LARGE;
   }
-  else if(enc->contfragment) {
-    /* the previous fragment was not a final one and this isn't either, keep a
-       CONT opcode and no FIN bit */
-    firstbyte |= WSBIT_OPCODE_CONT;
+  if(flags & CURLWS_PONG && payload_len > WS_MAX_CNTRL_LEN) {
+    failf(data, "[WS] given PONG frame is too big");
+    return CURLE_TOO_LARGE;
   }
-  else {
-    firstbyte = opcode;
-    enc->contfragment = TRUE;
+  if(flags & CURLWS_CLOSE && payload_len > WS_MAX_CNTRL_LEN) {
+    failf(data, "[WS] given CLOSE frame is too big");
+    return CURLE_TOO_LARGE;
   }
 
-  head[0] = enc->firstbyte = firstbyte;
+  head[0] = enc->firstbyte = firstb;
   if(payload_len > 65535) {
     head[1] = 127 | WSBIT_MASK;
-    head[2] = (unsigned char)((payload_len >> 56) & 0xff);
-    head[3] = (unsigned char)((payload_len >> 48) & 0xff);
-    head[4] = (unsigned char)((payload_len >> 40) & 0xff);
-    head[5] = (unsigned char)((payload_len >> 32) & 0xff);
-    head[6] = (unsigned char)((payload_len >> 24) & 0xff);
-    head[7] = (unsigned char)((payload_len >> 16) & 0xff);
-    head[8] = (unsigned char)((payload_len >> 8) & 0xff);
-    head[9] = (unsigned char)(payload_len & 0xff);
+    head[2] = (uint8_t)((payload_len >> 56) & 0xff);
+    head[3] = (uint8_t)((payload_len >> 48) & 0xff);
+    head[4] = (uint8_t)((payload_len >> 40) & 0xff);
+    head[5] = (uint8_t)((payload_len >> 32) & 0xff);
+    head[6] = (uint8_t)((payload_len >> 24) & 0xff);
+    head[7] = (uint8_t)((payload_len >> 16) & 0xff);
+    head[8] = (uint8_t)((payload_len >> 8) & 0xff);
+    head[9] = (uint8_t)(payload_len & 0xff);
     hlen = 10;
   }
   else if(payload_len >= 126) {
     head[1] = 126 | WSBIT_MASK;
-    head[2] = (unsigned char)((payload_len >> 8) & 0xff);
-    head[3] = (unsigned char)(payload_len & 0xff);
+    head[2] = (uint8_t)((payload_len >> 8) & 0xff);
+    head[3] = (uint8_t)(payload_len & 0xff);
     hlen = 4;
   }
   else {
-    head[1] = (unsigned char)payload_len | WSBIT_MASK;
+    head[1] = (uint8_t)payload_len | WSBIT_MASK;
     hlen = 2;
   }
 
   enc->payload_remain = enc->payload_len = payload_len;
   ws_enc_info(enc, data, "sending");
 
+  /* 4 bytes random */
+
+  result = Curl_rand(data, (uint8_t *)&enc->mask, sizeof(enc->mask));
+  if(result)
+    return result;
+
+#ifdef DEBUGBUILD
+  if(getenv("CURL_WS_FORCE_ZERO_MASK"))
+    /* force the bit mask to 0x00000000, effectively disabling masking */
+    memset(&enc->mask, 0, sizeof(enc->mask));
+#endif
+
   /* add 4 bytes mask */
   memcpy(&head[hlen], &enc->mask, 4);
   hlen += 4;
   /* reset for payload to come */
   enc->xori = 0;
 
-  n = Curl_bufq_write(out, head, hlen, err);
-  if(n < 0)
-    return -1;
-  if((size_t)n != hlen) {
+  result = Curl_bufq_write(out, head, hlen, &nwritten);
+  if(result)
+    return result;
+  if(nwritten != hlen) {
     /* We use a bufq with SOFT_LIMIT, writing should always succeed */
     DEBUGASSERT(0);
-    *err = CURLE_SEND_ERROR;
-    return -1;
+    return CURLE_SEND_ERROR;
   }
-  return n;
+  return CURLE_OK;
 }
 
-static ssize_t ws_enc_write_payload(struct ws_encoder *enc,
-                                    struct Curl_easy *data,
-                                    const unsigned char *buf, size_t buflen,
-                                    struct bufq *out, CURLcode *err)
+static CURLcode ws_enc_write_head(struct Curl_easy *data,
+                                  struct websocket *ws,
+                                  struct ws_encoder *enc,
+                                  unsigned int flags,
+                                  curl_off_t payload_len,
+                                  struct bufq *out)
 {
-  ssize_t n;
-  size_t i, len;
-
-  if(Curl_bufq_is_full(out)) {
-    *err = CURLE_AGAIN;
-    return -1;
+  /* starting a new frame, we want a clean sendbuf.
+   * Any pending control frame we can add now as part of the flush. */
+  if(ws->pending.type) {
+    CURLcode result = ws_enc_add_pending(data, ws);
+    if(result)
+      return result;
   }
+  return ws_enc_add_frame(data, enc, flags, payload_len, out);
+}
+
+static CURLcode ws_enc_write_payload(struct ws_encoder *enc,
+                                     struct Curl_easy *data,
+                                     const uint8_t *buf, size_t buflen,
+                                     struct bufq *out, size_t *pnwritten)
+{
+  CURLcode result;
+  size_t i, len, n, remain;
+
+  *pnwritten = 0;
+  if(Curl_bufq_is_full(out))
+    return CURLE_AGAIN;
 
   /* not the most performant way to do this */
   len = buflen;
-  if((curl_off_t)len > enc->payload_remain)
-    len = (size_t)enc->payload_remain;
+  remain = curlx_sotouz_range(enc->payload_remain, 0, SIZE_MAX);
+  if(remain < len)
+    len = remain;
 
   for(i = 0; i < len; ++i) {
-    unsigned char c = buf[i] ^ enc->mask[enc->xori];
-    n = Curl_bufq_write(out, &c, 1, err);
-    if(n < 0) {
-      if((*err != CURLE_AGAIN) || !i)
-        return -1;
+    uint8_t c = buf[i] ^ enc->mask[enc->xori];
+    result = Curl_bufq_write(out, &c, 1, &n);
+    if(result) {
+      if((result != CURLE_AGAIN) || !i)
+        return result;
       break;
     }
     enc->xori++;
     enc->xori &= 3;
   }
+  *pnwritten = i;
   enc->payload_remain -= (curl_off_t)i;
   ws_enc_info(enc, data, "buffered");
-  return (ssize_t)i;
+  return CURLE_OK;
 }
 
+static CURLcode ws_enc_add_pending(struct Curl_easy *data,
+                                   struct websocket *ws)
+{
+  CURLcode result;
+  size_t n;
+
+  if(!ws->pending.type) /* no pending frame here */
+    return CURLE_OK;
+  if(ws->enc.payload_remain) /* in the middle of another frame */
+    return CURLE_AGAIN;
+
+  result = ws_enc_add_frame(data, &ws->enc, ws->pending.type,
+                            (curl_off_t)ws->pending.payload_len,
+                            &ws->sendbuf);
+  if(result) {
+    CURL_TRC_WS(data, "ws_enc_cntrl(), error adding head: %d",
+                (int)result);
+    goto out;
+  }
+  result = ws_enc_write_payload(&ws->enc, data, ws->pending.payload,
+                                ws->pending.payload_len,
+                                &ws->sendbuf, &n);
+  if(result) {
+    CURL_TRC_WS(data, "ws_enc_cntrl(), error adding payload: %d",
+                (int)result);
+    goto out;
+  }
+  if(n != ws->pending.payload_len) {
+    DEBUGASSERT(0); /* buffer should always be able to take all */
+    CURL_TRC_WS(data, "ws_enc_cntrl(), error added only %zu/%zu payload,",
+                n, ws->pending.payload_len);
+    result = CURLE_SEND_ERROR;
+    goto out;
+  }
+  /* the frame should be complete now */
+  DEBUGASSERT(!ws->enc.payload_remain);
+  memset(&ws->pending, 0, sizeof(ws->pending));
+
+out:
+  return result;
+}
+
+static CURLcode ws_enc_send(struct Curl_easy *data,
+                            struct websocket *ws,
+                            const uint8_t *buffer,
+                            size_t buflen,
+                            curl_off_t fragsize,
+                            unsigned int flags,
+                            size_t *pnsent)
+{
+  size_t n;
+  CURLcode result = CURLE_OK;
+
+  DEBUGASSERT(!data->set.ws_raw_mode);
+  *pnsent = 0;
+
+  if(ws->enc.payload_remain || !Curl_bufq_is_empty(&ws->sendbuf)) {
+    /* a frame is ongoing with payload buffered or more payload
+     * that needs to be encoded into the buffer */
+    if(buflen < ws->sendbuf_payload) {
+      /* We have been called with LESS buffer data than before. This
+       * is not how it is supposed too work. */
+      failf(data, "[WS] curl_ws_send() called with smaller 'buflen' than "
+            "bytes already buffered in previous call, %zu vs %zu",
+            buflen, ws->sendbuf_payload);
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    }
+    if((curl_off_t)buflen >
+       (ws->enc.payload_remain + (curl_off_t)ws->sendbuf_payload)) {
+      /* too large buflen beyond payload length of frame */
+      failf(data, "[WS] unaligned frame size (sending %zu instead of "
+            "%" FMT_OFF_T ")", buflen,
+            (curl_off_t)(ws->enc.payload_remain + ws->sendbuf_payload));
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    }
+  }
+  else {
+    result = ws_flush(data, ws, Curl_is_in_callback(data));
+    if(result)
+      return result;
+
+    result = ws_enc_write_head(data, ws, &ws->enc, flags,
+                               (flags & CURLWS_OFFSET) ?
+                               fragsize : (curl_off_t)buflen,
+                               &ws->sendbuf);
+    if(result) {
+      CURL_TRC_WS(data, "curl_ws_send(), error writing frame head %d",
+                  (int)result);
+      return result;
+    }
+  }
+
+  /* While there is either sendbuf to flush OR more payload to encode... */
+  while(!Curl_bufq_is_empty(&ws->sendbuf) || (buflen > ws->sendbuf_payload)) {
+    /* Try to add more payload to sendbuf */
+    if(buflen > ws->sendbuf_payload) {
+      size_t prev_len = Curl_bufq_len(&ws->sendbuf);
+      result = ws_enc_write_payload(&ws->enc, data,
+                                    buffer + ws->sendbuf_payload,
+                                    buflen - ws->sendbuf_payload,
+                                    &ws->sendbuf, &n);
+      if(result && (result != CURLE_AGAIN))
+        return result;
+      ws->sendbuf_payload += Curl_bufq_len(&ws->sendbuf) - prev_len;
+      if(!ws->sendbuf_payload) {
+        return CURLE_AGAIN;
+      }
+    }
+
+    /* flush, blocking when in callback */
+    result = ws_flush(data, ws, Curl_is_in_callback(data));
+    if(!result && ws->sendbuf_payload > 0) {
+      *pnsent += ws->sendbuf_payload;
+      buffer += ws->sendbuf_payload;
+      buflen -= ws->sendbuf_payload;
+      ws->sendbuf_payload = 0;
+    }
+    else if(result == CURLE_AGAIN) {
+      if(ws->sendbuf_payload > Curl_bufq_len(&ws->sendbuf)) {
+        /* blocked, part of payload bytes remain, report length
+         * that we managed to send. */
+        size_t flushed = (ws->sendbuf_payload - Curl_bufq_len(&ws->sendbuf));
+        *pnsent += flushed;
+        ws->sendbuf_payload -= flushed;
+        return CURLE_OK;
+      }
+      else {
+        /* blocked before sending headers or 1st payload byte. We cannot report
+         * OK on 0-length send (caller counts only payload) and EAGAIN */
+        CURL_TRC_WS(data, "EAGAIN flushing sendbuf, payload_encoded: %zu/%zu",
+                    ws->sendbuf_payload, buflen);
+        DEBUGASSERT(*pnsent == 0);
+        return CURLE_AGAIN;
+      }
+    }
+    else
+      return result;  /* real error sending the data */
+  }
+  return CURLE_OK;
+}
+
+struct cr_ws_ctx {
+  struct Curl_creader super;
+  BIT(read_eos);  /* we read an EOS from the next reader */
+  BIT(eos);       /* we have returned an EOS */
+};
+
+static CURLcode cr_ws_init(struct Curl_easy *data, struct Curl_creader *reader)
+{
+  (void)data;
+  (void)reader;
+  return CURLE_OK;
+}
+
+static void cr_ws_close(struct Curl_easy *data, struct Curl_creader *reader)
+{
+  (void)data;
+  (void)reader;
+}
+
+static CURLcode cr_ws_read(struct Curl_easy *data,
+                           struct Curl_creader *reader,
+                           char *buf, size_t blen,
+                           size_t *pnread, bool *peos)
+{
+  struct cr_ws_ctx *ctx = reader->ctx;
+  CURLcode result = CURLE_OK;
+  size_t nread, n;
+  struct websocket *ws;
+  bool eos;
+
+  *pnread = 0;
+  if(ctx->eos) {
+    *peos = TRUE;
+    return CURLE_OK;
+  }
+
+  ws = Curl_conn_meta_get(data->conn, CURL_META_PROTO_WS_CONN);
+  if(!ws) {
+    failf(data, "[WS] not a websocket transfer");
+    return CURLE_FAILED_INIT;
+  }
+
+  if(Curl_bufq_is_empty(&ws->sendbuf)) {
+    if(ctx->read_eos) {
+      ctx->eos = TRUE;
+      *peos = TRUE;
+      return CURLE_OK;
+    }
+
+    if(ws->enc.payload_remain) {
+      CURL_TRC_WS(data, "current frame, %" FMT_OFF_T " remaining",
+                  ws->enc.payload_remain);
+      blen = curlx_sotouz_range(ws->enc.payload_remain, 0, blen);
+    }
+
+    result = Curl_creader_read(data, reader->next, buf, blen, &nread, &eos);
+    if(result)
+      return result;
+    ctx->read_eos = eos;
+
+    if(!Curl_bufq_is_empty(&ws->sendbuf)) {
+      /* client_read started a new frame, we disregard any eos reported */
+      ctx->read_eos = FALSE;
+      Curl_creader_clear_eos(data, reader->next);
+    }
+    else if(!nread) {
+      /* nothing to convert, return this right away */
+      if(ctx->read_eos)
+        ctx->eos = TRUE;
+      *pnread = nread;
+      *peos = (bool)ctx->eos;
+      goto out;
+    }
+
+    if(!ws->enc.payload_remain && Curl_bufq_is_empty(&ws->sendbuf)) {
+      /* encode the data as a new BINARY frame */
+      result = ws_enc_write_head(data, ws, &ws->enc, CURLWS_BINARY, nread,
+                                 &ws->sendbuf);
+      if(result)
+        goto out;
+    }
+
+    result = ws_enc_write_payload(&ws->enc, data, (uint8_t *)buf,
+                                  nread, &ws->sendbuf, &n);
+    if(result)
+      goto out;
+    CURL_TRC_READ(data, "cr_ws_read, added %zu payload, len=%zu", nread, n);
+  }
+
+  DEBUGASSERT(!Curl_bufq_is_empty(&ws->sendbuf));
+  *peos = FALSE;
+  result = Curl_bufq_cread(&ws->sendbuf, buf, blen, pnread);
+  if(!result && ctx->read_eos && Curl_bufq_is_empty(&ws->sendbuf)) {
+    /* no more data, read all, done. */
+    ctx->eos = TRUE;
+    *peos = TRUE;
+  }
+
+out:
+  CURL_TRC_READ(data, "cr_ws_read(len=%zu) -> %d, nread=%zu, eos=%d",
+                blen, (int)result, *pnread, *peos);
+  return result;
+}
+
+static const struct Curl_crtype ws_cr_encode = {
+  "ws-encode",
+  cr_ws_init,
+  cr_ws_read,
+  cr_ws_close,
+  Curl_creader_def_needs_rewind,
+  Curl_creader_def_total_length,
+  Curl_creader_def_resume_from,
+  Curl_creader_def_cntrl,
+  Curl_creader_def_is_paused,
+  Curl_creader_def_done,
+  sizeof(struct cr_ws_ctx)
+};
 
 struct wsfield {
   const char *name;
   const char *val;
 };
 
-CURLcode Curl_ws_request(struct Curl_easy *data, REQTYPE *req)
+CURLcode Curl_ws_request(struct Curl_easy *data, struct dynbuf *req)
 {
   unsigned int i;
   CURLcode result = CURLE_OK;
-  unsigned char rand[16];
+  uint8_t rand[16];
   char *randstr;
   size_t randlen;
   char keyval[40];
   struct SingleRequest *k = &data->req;
-  struct wsfield heads[]= {
+  struct wsfield heads[] = {
     {
       /* The request MUST contain an |Upgrade| header field whose value
          MUST include the "websocket" keyword. */
-      "Upgrade:", "websocket"
-    },
-    {
-      /* The request MUST contain a |Connection| header field whose value
-         MUST include the "Upgrade" token. */
-      "Connection:", "Upgrade",
+      "Upgrade", "websocket"
     },
     {
       /* The request MUST include a header field with the name
          |Sec-WebSocket-Version|. The value of this header field MUST be
          13. */
-      "Sec-WebSocket-Version:", "13",
+      "Sec-WebSocket-Version", "13",
     },
     {
       /* The request MUST include a header field with the name
@@ -563,41 +1272,46 @@ CURLcode Curl_ws_request(struct Curl_easy *data, REQTYPE *req)
          consisting of a randomly selected 16-byte value that has been
          base64-encoded (see Section 4 of [RFC4648]). The nonce MUST be
          selected randomly for each connection. */
-      "Sec-WebSocket-Key:", NULL,
+      "Sec-WebSocket-Key", NULL,
     }
   };
-  heads[3].val = &keyval[0];
+  heads[2].val = &keyval[0];
 
   /* 16 bytes random */
-  result = Curl_rand(data, (unsigned char *)rand, sizeof(rand));
+  result = Curl_rand(data, rand, sizeof(rand));
   if(result)
     return result;
-  result = Curl_base64_encode((char *)rand, sizeof(rand), &randstr, &randlen);
+  result = curlx_base64_encode(rand, sizeof(rand), &randstr, &randlen);
   if(result)
     return result;
   DEBUGASSERT(randlen < sizeof(keyval));
-  if(randlen >= sizeof(keyval))
+  if(randlen >= sizeof(keyval)) {
+    curlx_free(randstr);
     return CURLE_FAILED_INIT;
-  strcpy(keyval, randstr);
-  free(randstr);
-  for(i = 0; !result && (i < sizeof(heads)/sizeof(heads[0])); i++) {
-    if(!Curl_checkheaders(data, STRCONST(heads[i].name))) {
-#ifdef USE_HYPER
-      char field[128];
-      msnprintf(field, sizeof(field), "%s %s", heads[i].name,
-                heads[i].val);
-      result = Curl_hyper_header(data, req, field);
-#else
-      (void)data;
-      result = Curl_dyn_addf(req, "%s %s\r\n", heads[i].name,
-                             heads[i].val);
-#endif
+  }
+  curlx_strcopy(keyval, sizeof(keyval), randstr, randlen);
+  curlx_free(randstr);
+  for(i = 0; !result && (i < CURL_ARRAYSIZE(heads)); i++) {
+    if(!Curl_checkheaders(data, heads[i].name, strlen(heads[i].name))) {
+      result = curlx_dyn_addf(req, "%s: %s\r\n", heads[i].name, heads[i].val);
     }
   }
+  data->state.http_hd_upgrade = TRUE;
   k->upgr101 = UPGR101_WS;
+  data->conn->bits.upgrade_in_progress = TRUE;
   return result;
 }
 
+static void ws_conn_dtor(void *key, size_t klen, void *entry)
+{
+  struct websocket *ws = entry;
+  (void)key;
+  (void)klen;
+  Curl_bufq_free(&ws->recvbuf);
+  Curl_bufq_free(&ws->sendbuf);
+  curlx_free(ws);
+}
+
 /*
  * 'nread' is number of bytes of websocket data already in the buffer at
  * 'mem'.
@@ -607,20 +1321,38 @@ CURLcode Curl_ws_accept(struct Curl_easy *data,
 {
   struct SingleRequest *k = &data->req;
   struct websocket *ws;
+  struct Curl_cwriter *ws_dec_writer = NULL;
+  struct Curl_creader *ws_enc_reader = NULL;
   CURLcode result;
 
   DEBUGASSERT(data->conn);
-  ws = data->conn->proto.ws;
+  ws = Curl_conn_meta_get(data->conn, CURL_META_PROTO_WS_CONN);
   if(!ws) {
-    ws = calloc(1, sizeof(*ws));
+    size_t chunk_size = WS_CHUNK_SIZE;
+    ws = curlx_calloc(1, sizeof(*ws));
     if(!ws)
       return CURLE_OUT_OF_MEMORY;
-    data->conn->proto.ws = ws;
-    Curl_bufq_init(&ws->recvbuf, WS_CHUNK_SIZE, WS_CHUNK_COUNT);
-    Curl_bufq_init2(&ws->sendbuf, WS_CHUNK_SIZE, WS_CHUNK_COUNT,
+#ifdef DEBUGBUILD
+    {
+      const char *p = getenv("CURL_WS_CHUNK_SIZE");
+      if(p) {
+        curl_off_t l;
+        if(!curlx_str_number(&p, &l, 1 * 1024 * 1024))
+          chunk_size = (size_t)l;
+      }
+    }
+#endif
+    CURL_TRC_WS(data, "WS, using chunk size %zu", chunk_size);
+    Curl_bufq_init2(&ws->recvbuf, chunk_size, WS_CHUNK_COUNT,
+                    BUFQ_OPT_SOFT_LIMIT);
+    Curl_bufq_init2(&ws->sendbuf, chunk_size, WS_CHUNK_COUNT,
                     BUFQ_OPT_SOFT_LIMIT);
     ws_dec_init(&ws->dec);
     ws_enc_init(&ws->enc);
+    result = Curl_conn_meta_set(data->conn, CURL_META_PROTO_WS_CONN,
+                                ws, ws_conn_dtor);
+    if(result)
+      return result;
   }
   else {
     Curl_bufq_reset(&ws->recvbuf);
@@ -646,130 +1378,87 @@ CURLcode Curl_ws_accept(struct Curl_easy *data,
      subprotocol not requested by the client), the client MUST Fail
      the WebSocket Connection. */
 
-  /* 4 bytes random */
+  infof(data, "[WS] Received 101, switch to WebSocket");
 
-  result = Curl_rand(data, (unsigned char *)&ws->enc.mask,
-                     sizeof(ws->enc.mask));
+  /* Install our client writer that decodes WS frames payload */
+  result = Curl_cwriter_create(&ws_dec_writer, data, &ws_cw_decode,
+                               CURL_CW_CONTENT_DECODE);
   if(result)
-    return result;
-  infof(data, "Received 101, switch to WebSocket; mask %02x%02x%02x%02x",
-        ws->enc.mask[0], ws->enc.mask[1], ws->enc.mask[2], ws->enc.mask[3]);
+    goto out;
+  result = Curl_cwriter_add(data, ws_dec_writer);
+  if(result)
+    goto out;
+  ws_dec_writer = NULL; /* owned by transfer now */
+
+  k->header = FALSE; /* we will not get more response headers */
 
   if(data->set.connect_only) {
-    ssize_t nwritten;
     /* In CONNECT_ONLY setup, the payloads from `mem` need to be received
-     * when using `curl_ws_recv` later on after this transfer is already
-     * marked as DONE. */
-    nwritten = Curl_bufq_write(&ws->recvbuf, (const unsigned char *)mem,
-                               nread, &result);
-    if(nwritten < 0)
-      return result;
-    infof(data, "%zu bytes websocket payload", nread);
+     * when using `curl_ws_recv/curl_easy_recv` later on, after this transfer
+     * is already marked as DONE.
+     * Since `curl_easy_recv()` is also supposed to work, we need
+     * to buffer the data at connection level. See #22107 */
+    if(nread) {
+      result = Curl_cf_recvbuf_add(data, data->conn, FIRSTSOCKET,
+                                   (const uint8_t *)mem, nread);
+      if(result)
+        goto out;
+    }
+    CURL_REQ_CLEAR_RECV(data); /* read no more content */
   }
+  else { /* !connect_only */
+    if(data->set.method == HTTPREQ_PUT) {
+      CURL_TRC_WS(data, "UPLOAD set, add ws-encode reader");
+      result = Curl_creader_set_fread(data, -1);
+      if(result)
+        goto out;
+
+      if(!data->set.ws_raw_mode) {
+        /* Add our client reader encoding WS BINARY frames */
+        result = Curl_creader_create(&ws_enc_reader, data, &ws_cr_encode,
+                                     CURL_CR_CONTENT_ENCODE);
+        if(result)
+          goto out;
+        result = Curl_creader_add(data, ws_enc_reader);
+        if(result)
+          goto out;
+        ws_enc_reader = NULL; /* owned by transfer now */
+      }
+
+      /* start over with sending */
+      data->req.eos_read = FALSE;
+      data->req.upload_done = FALSE;
+      CURL_REQ_SET_SEND(data);
+    }
+
+    /* Then pass any additional data to the writers */
+    if(nread) {
+      result = Curl_client_write(data, CLIENTWRITE_BODY, mem, nread);
+      if(result)
+        goto out;
+    }
+  }
+
   k->upgr101 = UPGR101_RECEIVED;
+  k->header = FALSE; /* we will not get more responses */
 
+out:
+  if(ws_dec_writer)
+    Curl_cwriter_free(data, ws_dec_writer);
+  if(ws_enc_reader)
+    Curl_creader_free(data, ws_enc_reader);
+  if(result)
+    CURL_TRC_WS(data, "Curl_ws_accept() failed -> %d", (int)result);
+  else
+    CURL_TRC_WS(data, "websocket established, %s mode",
+                data->set.connect_only ? "connect-only" : "callback");
   return result;
 }
 
-static ssize_t ws_client_write(const unsigned char *buf, size_t buflen,
-                               int frame_age, int frame_flags,
-                               curl_off_t payload_offset,
-                               curl_off_t payload_len,
-                               void *userp,
-                               CURLcode *err)
-{
-  struct Curl_easy *data = userp;
-  struct websocket *ws;
-  size_t wrote;
-  curl_off_t remain = (payload_len - (payload_offset + buflen));
-
-  (void)frame_age;
-  if(!data->conn || !data->conn->proto.ws) {
-    *err = CURLE_FAILED_INIT;
-    return -1;
-  }
-  ws = data->conn->proto.ws;
-
-  if((frame_flags & CURLWS_PING) && !remain) {
-    /* auto-respond to PINGs, only works for single-frame payloads atm */
-    size_t bytes;
-    infof(data, "WS: auto-respond to PING with a PONG");
-    /* send back the exact same content as a PONG */
-    *err = curl_ws_send(data, buf, buflen, &bytes, 0, CURLWS_PONG);
-    if(*err)
-      return -1;
-  }
-  else if(buflen || !remain) {
-    /* deliver the decoded frame to the user callback. The application
-     * may invoke curl_ws_meta() to access frame information. */
-    update_meta(ws, frame_age, frame_flags, payload_offset,
-                payload_len, buflen);
-    Curl_set_in_callback(data, true);
-    wrote = data->set.fwrite_func((char *)buf, 1,
-                                  buflen, data->set.out);
-    Curl_set_in_callback(data, false);
-    if(wrote != buflen) {
-      *err = CURLE_RECV_ERROR;
-      return -1;
-    }
-  }
-  *err = CURLE_OK;
-  return (ssize_t)buflen;
-}
-
-/* Curl_ws_writecb() is the write callback for websocket traffic. The
-   websocket data is provided to this raw, in chunks. This function should
-   handle/decode the data and call the "real" underlying callback accordingly.
-*/
-size_t Curl_ws_writecb(char *buffer, size_t size /* 1 */,
-                       size_t nitems, void *userp)
-{
-  struct Curl_easy *data = userp;
-
-  if(data->set.ws_raw_mode)
-    return data->set.fwrite_func(buffer, size, nitems, data->set.out);
-  else if(nitems) {
-    struct websocket *ws;
-    CURLcode result;
-
-    if(!data->conn || !data->conn->proto.ws) {
-      failf(data, "WS: not a websocket transfer");
-      return nitems - 1;
-    }
-    ws = data->conn->proto.ws;
-
-    if(buffer) {
-      ssize_t nwritten;
-
-      nwritten = Curl_bufq_write(&ws->recvbuf, (const unsigned char *)buffer,
-                                 nitems, &result);
-      if(nwritten < 0) {
-        infof(data, "WS: error adding data to buffer %d", (int)result);
-        return nitems - 1;
-      }
-      buffer = NULL;
-    }
-
-    while(!Curl_bufq_is_empty(&ws->recvbuf)) {
-
-      result = ws_dec_pass(&ws->dec, data, &ws->recvbuf,
-                           ws_client_write, data);
-      if(result == CURLE_AGAIN)
-        /* insufficient amount of data, keep it for later.
-         * we pretend to have written all since we have a copy */
-        return nitems;
-      else if(result) {
-        infof(data, "WS: decode error %d", (int)result);
-        return nitems - 1;
-      }
-    }
-  }
-  return nitems;
-}
-
 struct ws_collect {
   struct Curl_easy *data;
-  void *buffer;
+  struct websocket *ws;
+  uint8_t *buffer;
   size_t buflen;
   size_t bufidx;
   int frame_age;
@@ -779,16 +1468,25 @@ struct ws_collect {
   bool written;
 };
 
-static ssize_t ws_client_collect(const unsigned char *buf, size_t buflen,
-                                 int frame_age, int frame_flags,
-                                 curl_off_t payload_offset,
-                                 curl_off_t payload_len,
-                                 void *userp,
-                                 CURLcode *err)
+static CURLcode ws_client_collect(const uint8_t *buf, size_t buflen,
+                                  int frame_age, int frame_flags,
+                                  curl_off_t payload_offset,
+                                  curl_off_t payload_len,
+                                  void *userp,
+                                  size_t *pnwritten)
 {
   struct ws_collect *ctx = userp;
-  size_t nwritten;
-  curl_off_t remain = (payload_len - (payload_offset + buflen));
+  struct Curl_easy *data = ctx->data;
+  bool auto_pong = !data->set.ws_no_auto_pong;
+  curl_off_t remain;
+  CURLcode result = CURLE_OK;
+
+  *pnwritten = 0;
+  remain = ws_payload_remain(payload_len, payload_offset, buflen);
+  if(remain < 0) {
+    DEBUGASSERT(0); /* parameter mismatch */
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
 
   if(!ctx->bufidx) {
     /* first write */
@@ -798,103 +1496,98 @@ static ssize_t ws_client_collect(const unsigned char *buf, size_t buflen,
     ctx->payload_len = payload_len;
   }
 
-  if((frame_flags & CURLWS_PING) && !remain) {
+  if(auto_pong && (frame_flags & CURLWS_PING) && !remain) {
     /* auto-respond to PINGs, only works for single-frame payloads atm */
-    size_t bytes;
-    infof(ctx->data, "WS: auto-respond to PING with a PONG");
+    CURL_TRC_WS(data, "auto PONG to [PING payload=%" FMT_OFF_T
+                "/%" FMT_OFF_T "]", payload_offset, payload_len);
     /* send back the exact same content as a PONG */
-    *err = curl_ws_send(ctx->data, buf, buflen, &bytes, 0, CURLWS_PONG);
-    if(*err)
-      return -1;
-    nwritten = bytes;
+    result = ws_enc_add_cntrl(ctx->data, ctx->ws, buf, buflen, CURLWS_PONG);
+    if(result)
+      return result;
+    *pnwritten = buflen;
   }
   else {
+    size_t write_len;
+
     ctx->written = TRUE;
     DEBUGASSERT(ctx->buflen >= ctx->bufidx);
-    nwritten = CURLMIN(buflen, ctx->buflen - ctx->bufidx);
-    if(!nwritten) {
-      if(!buflen) {  /* 0 length write, we accept that */
-        *err = CURLE_OK;
-        return 0;
-      }
-      *err = CURLE_AGAIN;  /* no more space */
-      return -1;
+    write_len = CURLMIN(buflen, ctx->buflen - ctx->bufidx);
+    if(!write_len) {
+      if(!buflen)  /* 0 length write, we accept that */
+        return CURLE_OK;
+      return CURLE_AGAIN;  /* no more space */
     }
-    *err = CURLE_OK;
-    memcpy(ctx->buffer, buf, nwritten);
-    ctx->bufidx += nwritten;
+    memcpy(ctx->buffer + ctx->bufidx, buf, write_len);
+    ctx->bufidx += write_len;
+    *pnwritten = write_len;
   }
-  return nwritten;
+  return result;
 }
 
-static ssize_t nw_in_recv(void *reader_ctx,
-                          unsigned char *buf, size_t buflen,
-                          CURLcode *err)
+static CURLcode nw_in_recv(void *reader_ctx,
+                           uint8_t *buf, size_t buflen,
+                           size_t *pnread)
 {
   struct Curl_easy *data = reader_ctx;
-  size_t nread;
-
-  *err = curl_easy_recv(data, buf, buflen, &nread);
-  if(*err)
-    return -1;
-  return (ssize_t)nread;
+  return curl_easy_recv(data, buf, buflen, pnread);
 }
 
-CURL_EXTERN CURLcode curl_ws_recv(struct Curl_easy *data, void *buffer,
-                                  size_t buflen, size_t *nread,
-                                  const struct curl_ws_frame **metap)
+CURLcode curl_ws_recv(CURL *curl, void *buffer,
+                      size_t buflen, size_t *recv,
+                      const struct curl_ws_frame **metap)
 {
-  struct connectdata *conn = data->conn;
+  struct Curl_easy *data = curl;
+  struct connectdata *conn;
   struct websocket *ws;
-  bool done = FALSE; /* not filled passed buffer yet */
   struct ws_collect ctx;
-  CURLcode result;
 
+  *recv = 0;
+  *metap = NULL;
+  if(!GOOD_EASY_HANDLE(data) || (buflen && !buffer))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  conn = data->conn;
   if(!conn) {
     /* Unhappy hack with lifetimes of transfers and connection */
     if(!data->set.connect_only) {
-      failf(data, "CONNECT_ONLY is required");
+      failf(data, "[WS] CONNECT_ONLY is required");
       return CURLE_UNSUPPORTED_PROTOCOL;
     }
 
     Curl_getconnectinfo(data, &conn);
     if(!conn) {
-      failf(data, "connection not found");
+      failf(data, "[WS] connection not found");
       return CURLE_BAD_FUNCTION_ARGUMENT;
     }
   }
-  ws = conn->proto.ws;
+  ws = Curl_conn_meta_get(conn, CURL_META_PROTO_WS_CONN);
   if(!ws) {
-    failf(data, "connection is not setup for websocket");
+    failf(data, "[WS] connection is not setup for websocket");
     return CURLE_BAD_FUNCTION_ARGUMENT;
   }
 
-  *nread = 0;
-  *metap = NULL;
-  /* get a download buffer */
-  result = Curl_preconnect(data);
-  if(result)
-    return result;
-
   memset(&ctx, 0, sizeof(ctx));
   ctx.data = data;
+  ctx.ws = ws;
   ctx.buffer = buffer;
   ctx.buflen = buflen;
 
-  while(!done) {
+  while(1) {
+    CURLcode result;
+
     /* receive more when our buffer is empty */
     if(Curl_bufq_is_empty(&ws->recvbuf)) {
-      ssize_t n = Curl_bufq_slurp(&ws->recvbuf, nw_in_recv, data, &result);
-      if(n < 0) {
+      size_t n;
+      result = Curl_bufq_slurp(&ws->recvbuf, nw_in_recv, data, &n);
+      if(result)
         return result;
-      }
       else if(n == 0) {
         /* connection closed */
-        infof(data, "connection expectedly closed?");
+        infof(data, "[WS] connection expectedly closed?");
         return CURLE_GOT_NOTHING;
       }
-      DEBUGF(infof(data, "curl_ws_recv, added %zu bytes from network",
-                   Curl_bufq_len(&ws->recvbuf)));
+      CURL_TRC_WS(data, "curl_ws_recv, added %zu bytes from network",
+                  Curl_bufq_len(&ws->recvbuf));
     }
 
     result = ws_dec_pass(&ws->dec, data, &ws->recvbuf,
@@ -904,7 +1597,6 @@ CURL_EXTERN CURLcode curl_ws_recv(struct Curl_easy *data, void *buffer,
         ws_dec_info(&ws->dec, data, "need more input");
         continue;  /* nothing written, try more input */
       }
-      done = TRUE;
       break;
     }
     else if(result) {
@@ -914,7 +1606,6 @@ CURL_EXTERN CURLcode curl_ws_recv(struct Curl_easy *data, void *buffer,
       /* The decoded frame is passed back to our caller.
        * There are frames like PING were we auto-respond to and
        * that we do not return. For these `ctx.written` is not set. */
-      done = TRUE;
       break;
     }
   }
@@ -922,198 +1613,359 @@ CURL_EXTERN CURLcode curl_ws_recv(struct Curl_easy *data, void *buffer,
   /* update frame information to be passed back */
   update_meta(ws, ctx.frame_age, ctx.frame_flags, ctx.payload_offset,
               ctx.payload_len, ctx.bufidx);
-  *metap = &ws->frame;
-  *nread = ws->frame.len;
-  /* infof(data, "curl_ws_recv(len=%zu) -> %zu bytes (frame at %"
-              CURL_FORMAT_CURL_OFF_T ", %" CURL_FORMAT_CURL_OFF_T " left)",
-        buflen, *nread, ws->frame.offset, ws->frame.bytesleft); */
+  *metap = &ws->recvframe;
+  *recv = ws->recvframe.len;
+  CURL_TRC_WS(data, "curl_ws_recv(len=%zu) -> %zu bytes (frame at %"
+              FMT_OFF_T ", %" FMT_OFF_T " left)",
+              buflen, *recv, ws->recvframe.offset,
+              ws->recvframe.bytesleft);
+  /* all's well, try to send any pending control. we do not know
+   * when the application will call `curl_ws_send()` again. */
+  if(!data->set.ws_raw_mode && ws->pending.type) {
+    CURLcode r2 = ws_enc_add_pending(data, ws);
+    if(!r2)
+      (void)ws_flush(data, ws, Curl_is_in_callback(data));
+  }
   return CURLE_OK;
 }
 
 static CURLcode ws_flush(struct Curl_easy *data, struct websocket *ws,
-                         bool complete)
+                         bool blocking)
 {
+  CURLcode result;
+
+  /* If there is space, add any pending control frame */
+  if(Curl_bufq_len(&ws->sendbuf) < ws->sendbuf.chunk_size) {
+    result = ws_enc_add_pending(data, ws);
+    if(result && (result != CURLE_AGAIN))
+      return result;
+  }
+
   if(!Curl_bufq_is_empty(&ws->sendbuf)) {
-    CURLcode result;
-    const unsigned char *out;
-    size_t outlen;
-    ssize_t n;
+    const uint8_t *out;
+    size_t outlen, n;
+#ifdef DEBUGBUILD
+    /* Simulate a blocking send after this chunk has been sent */
+    bool eagain_next = FALSE;
+    size_t chunk_egain = 0;
+    const char *p = getenv("CURL_WS_CHUNK_EAGAIN");
+    if(p) {
+      curl_off_t l;
+      if(!curlx_str_number(&p, &l, 1 * 1024 * 1024))
+        chunk_egain = (size_t)l;
+    }
+#endif
 
     while(Curl_bufq_peek(&ws->sendbuf, &out, &outlen)) {
-      if(data->set.connect_only)
+#ifdef DEBUGBUILD
+      if(eagain_next)
+        return CURLE_AGAIN;
+      if(chunk_egain && (outlen > chunk_egain)) {
+        outlen = chunk_egain;
+        eagain_next = TRUE;
+      }
+#endif
+      if(blocking) {
+        result = ws_send_raw_blocking(data, ws, (const char *)out, outlen);
+        n = result ? 0 : outlen;
+      }
+      else if(data->set.connect_only || Curl_is_in_callback(data))
         result = Curl_senddata(data, out, outlen, &n);
-      else
-        result = Curl_write(data, data->conn->writesockfd, out, outlen, &n);
-      if(result) {
-        if(result == CURLE_AGAIN) {
-          if(!complete) {
-            infof(data, "WS: flush EAGAIN, %zu bytes remain in buffer",
-                  Curl_bufq_len(&ws->sendbuf));
-            return result;
-          }
-          /* TODO: the current design does not allow for buffered writes.
-           * We need to flush the buffer now. There is no ws_flush() later */
-          n = 0;
-          continue;
-        }
-        else if(result) {
-          failf(data, "WS: flush, write error %d", result);
-          return result;
-        }
+      else {
+        result = Curl_xfer_send(data, out, outlen, FALSE, &n);
+        if(!result && !n && outlen)
+          result = CURLE_AGAIN;
+      }
+
+      if(result == CURLE_AGAIN) {
+        CURL_TRC_WS(data, "flush EAGAIN, %zu bytes remain in buffer",
+                    Curl_bufq_len(&ws->sendbuf));
+        return result;
+      }
+      else if(result) {
+        failf(data, "[WS] flush, write error %d", (int)result);
+        return result;
       }
       else {
-        infof(data, "WS: flushed %zu bytes", (size_t)n);
-        Curl_bufq_skip(&ws->sendbuf, (size_t)n);
+        CURL_TRC_WS(data, "flushed %zu bytes", n);
+        Curl_bufq_skip(&ws->sendbuf, n);
       }
     }
   }
   return CURLE_OK;
 }
 
-CURL_EXTERN CURLcode curl_ws_send(CURL *data, const void *buffer,
-                                  size_t buflen, size_t *sent,
-                                  curl_off_t fragsize,
-                                  unsigned int flags)
+static CURLcode ws_send_raw_blocking(struct Curl_easy *data,
+                                     struct websocket *ws,
+                                     const char *buffer, size_t buflen)
+{
+  CURLcode result = CURLE_OK;
+  size_t nwritten;
+
+  if(!data)
+    return result;
+
+  (void)ws;
+  while(buflen) {
+    result = Curl_xfer_send(data, buffer, buflen, FALSE, &nwritten);
+    if(result)
+      return result;
+    DEBUGASSERT(nwritten <= buflen);
+    buffer += nwritten;
+    buflen -= nwritten;
+    if(buflen) {
+      curl_socket_t sock = data->conn->sock[FIRSTSOCKET];
+      timediff_t left_ms;
+      int ev;
+
+      CURL_TRC_WS(data, "ws_send_raw_blocking() partial, %zu left to send",
+                  buflen);
+      left_ms = Curl_timeleft_ms(data);
+      if(left_ms < 0) {
+        failf(data, "[WS] Timeout waiting for socket becoming writable");
+        return CURLE_SEND_ERROR;
+      }
+
+      /* POLLOUT socket */
+      if(sock == CURL_SOCKET_BAD)
+        return CURLE_SEND_ERROR;
+      ev = SOCKET_WRITABLE(sock, left_ms ? left_ms : 500);
+      if(ev < 0) {
+        failf(data, "[WS] Error while waiting for socket becoming writable");
+        return CURLE_SEND_ERROR;
+      }
+    }
+  }
+  return result;
+}
+
+static CURLcode ws_send_raw(struct Curl_easy *data, const void *buffer,
+                            size_t buflen, size_t *pnwritten)
 {
   struct websocket *ws;
-  ssize_t nwritten, n;
-  size_t space;
   CURLcode result;
 
-  *sent = 0;
+  ws = Curl_conn_meta_get(data->conn, CURL_META_PROTO_WS_CONN);
+  if(!ws) {
+    failf(data, "[WS] Not a websocket transfer");
+    return CURLE_SEND_ERROR;
+  }
+  if(!buflen)
+    return CURLE_OK;
+
+  if(Curl_is_in_callback(data)) {
+    /* When invoked from inside callbacks, we do a blocking send as the
+     * callback will probably not implement partial writes that may then
+     * mess up the ws framing subsequently.
+     * We need any pending data to be flushed before sending. */
+    result = ws_flush(data, ws, TRUE);
+    if(result)
+      return result;
+    result = ws_send_raw_blocking(data, ws, buffer, buflen);
+    if(!result)
+      *pnwritten = buflen;
+  }
+  else {
+    /* We need any pending data to be sent or EAGAIN this call. */
+    result = ws_flush(data, ws, FALSE);
+    if(result)
+      return result;
+    result = Curl_senddata(data, buffer, buflen, pnwritten);
+  }
+
+  CURL_TRC_WS(data, "ws_send_raw(len=%zu) -> %d, %zu",
+              buflen, (int)result, *pnwritten);
+  return result;
+}
+
+CURLcode curl_ws_send(CURL *curl, const void *buffer_arg,
+                      size_t buflen, size_t *sent,
+                      curl_off_t fragsize,
+                      unsigned int flags)
+{
+  struct websocket *ws;
+  const uint8_t *buffer = buffer_arg;
+  CURLcode result = CURLE_OK;
+  struct Curl_easy *data = curl;
+  size_t ndummy;
+  size_t *pnsent = sent ? sent : &ndummy;
+
+  if(!GOOD_EASY_HANDLE(data))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  CURL_TRC_WS(data, "curl_ws_send(len=%zu, fragsize=%" FMT_OFF_T
+              ", flags=%x), raw=%d",
+              buflen, fragsize, flags, data->set.ws_raw_mode);
+
+  *pnsent = 0;
+
+  if(!buffer && buflen) {
+    failf(data, "[WS] buffer is NULL when buflen is not");
+    result = CURLE_BAD_FUNCTION_ARGUMENT;
+    goto out;
+  }
+
   if(!data->conn && data->set.connect_only) {
     result = Curl_connect_only_attach(data);
     if(result)
-      return result;
+      goto out;
   }
   if(!data->conn) {
-    failf(data, "No associated connection");
-    return CURLE_SEND_ERROR;
+    failf(data, "[WS] No associated connection");
+    result = CURLE_SEND_ERROR;
+    goto out;
   }
-  if(!data->conn->proto.ws) {
-    failf(data, "Not a websocket transfer");
-    return CURLE_SEND_ERROR;
+  ws = Curl_conn_meta_get(data->conn, CURL_META_PROTO_WS_CONN);
+  if(!ws) {
+    failf(data, "[WS] Not a websocket transfer");
+    result = CURLE_SEND_ERROR;
+    goto out;
   }
-  ws = data->conn->proto.ws;
 
   if(data->set.ws_raw_mode) {
-    if(fragsize || flags)
+    /* In raw mode, we write directly to the connection */
+    /* try flushing any content still waiting to be sent. */
+    result = ws_flush(data, ws, FALSE);
+    if(result)
+      goto out;
+
+    if(!buffer) {
+      failf(data, "[WS] buffer is NULL in raw mode");
       return CURLE_BAD_FUNCTION_ARGUMENT;
-    if(!buflen)
-      /* nothing to do */
-      return CURLE_OK;
-    /* raw mode sends exactly what was requested, and this is from within
-       the write callback */
-    if(Curl_is_in_callback(data)) {
-      result = Curl_write(data, data->conn->writesockfd, buffer, buflen,
-                          &nwritten);
     }
-    else
-      result = Curl_senddata(data, buffer, buflen, &nwritten);
-
-    infof(data, "WS: wanted to send %zu bytes, sent %zu bytes",
-          buflen, nwritten);
-    *sent = (nwritten >= 0)? (size_t)nwritten : 0;
-    return result;
-  }
-
-  /* Not RAW mode, buf we do the frame encoding */
-  result = ws_flush(data, ws, FALSE);
-  if(result)
-    return result;
-
-  /* TODO: the current design does not allow partial writes, afaict.
-   * It is not clear who the application is supposed to react. */
-  space = Curl_bufq_space(&ws->sendbuf);
-  DEBUGF(infof(data, "curl_ws_send(len=%zu), sendbuf len=%zu space %zu",
-               buflen, Curl_bufq_len(&ws->sendbuf), space));
-  if(space < 14)
-    return CURLE_AGAIN;
-
-  if(flags & CURLWS_OFFSET) {
-    if(fragsize) {
-      /* a frame series 'fragsize' bytes big, this is the first */
-      n = ws_enc_write_head(data, &ws->enc, flags, fragsize,
-                            &ws->sendbuf, &result);
-      if(n < 0)
-        return result;
+    if(!sent) {
+      failf(data, "[WS] sent is NULL in raw mode");
+      return CURLE_BAD_FUNCTION_ARGUMENT;
     }
-    else {
-      if((curl_off_t)buflen > ws->enc.payload_remain) {
-        infof(data, "WS: unaligned frame size (sending %zu instead of %"
-                    CURL_FORMAT_CURL_OFF_T ")",
-              buflen, ws->enc.payload_remain);
-      }
+    if(fragsize || flags) {
+      failf(data, "[WS] fragsize and flags must be zero in raw mode");
+      return CURLE_BAD_FUNCTION_ARGUMENT;
     }
-  }
-  else if(!ws->enc.payload_remain) {
-    n = ws_enc_write_head(data, &ws->enc, flags, (curl_off_t)buflen,
-                          &ws->sendbuf, &result);
-    if(n < 0)
-      return result;
+    result = ws_send_raw(data, buffer, buflen, pnsent);
+    goto out;
   }
 
-  n = ws_enc_write_payload(&ws->enc, data,
-                           buffer, buflen, &ws->sendbuf, &result);
-  if(n < 0)
-    return result;
+  /* Not RAW mode, we do the frame encoding */
+  result = ws_enc_send(data, ws, buffer, buflen, fragsize, flags, pnsent);
 
-  *sent = (size_t)n;
-  return ws_flush(data, ws, TRUE);
+out:
+  CURL_TRC_WS(data, "curl_ws_send(len=%zu, fragsize=%" FMT_OFF_T
+              ", flags=%x, raw=%d) -> %d, %zu",
+              buflen, fragsize, flags, data->set.ws_raw_mode, (int)result,
+              *pnsent);
+  return result;
 }
 
-static void ws_free(struct connectdata *conn)
+static CURLcode ws_setup_conn(struct Curl_easy *data,
+                              struct connectdata *conn)
 {
-  if(conn && conn->proto.ws) {
-    Curl_bufq_free(&conn->proto.ws->recvbuf);
-    Curl_bufq_free(&conn->proto.ws->sendbuf);
-    Curl_safefree(conn->proto.ws);
-  }
+  /* WebSocket is 1.1 only (for now) */
+  data->state.http_neg.accept_09 = FALSE;
+  data->state.http_neg.only_10 = FALSE;
+  data->state.http_neg.wanted = CURL_HTTP_V1x;
+  data->state.http_neg.allowed = CURL_HTTP_V1x;
+  return Curl_http_setup_conn(data, conn);
 }
 
-void Curl_ws_done(struct Curl_easy *data)
-{
-  (void)data;
-}
-
-CURLcode Curl_ws_disconnect(struct Curl_easy *data,
-                            struct connectdata *conn,
-                            bool dead_connection)
-{
-  (void)data;
-  (void)dead_connection;
-  ws_free(conn);
-  return CURLE_OK;
-}
-
-CURL_EXTERN const struct curl_ws_frame *curl_ws_meta(struct Curl_easy *data)
+const struct curl_ws_frame *curl_ws_meta(CURL *curl)
 {
   /* we only return something for websocket, called from within the callback
      when not using raw mode */
-  if(GOOD_EASY_HANDLE(data) && Curl_is_in_callback(data) && data->conn &&
-     data->conn->proto.ws && !data->set.ws_raw_mode)
-    return &data->conn->proto.ws->frame;
+  struct Curl_easy *data = curl;
+  if(GOOD_EASY_HANDLE(data) && Curl_is_in_callback(data) &&
+     data->conn && !data->set.ws_raw_mode) {
+    struct websocket *ws;
+    ws = Curl_conn_meta_get(data->conn, CURL_META_PROTO_WS_CONN);
+    if(ws)
+      return &ws->recvframe;
+  }
   return NULL;
 }
 
+CURL_EXTERN CURLcode curl_ws_start_frame(CURL *curl,
+                                         unsigned int flags,
+                                         curl_off_t frame_len)
+{
+  struct websocket *ws;
+  CURLcode result = CURLE_OK;
+  struct Curl_easy *data = curl;
+
+  if(!GOOD_EASY_HANDLE(data))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  if(data->set.ws_raw_mode) {
+    failf(data, "cannot curl_ws_start_frame() with CURLWS_RAW_MODE enabled");
+    return CURLE_FAILED_INIT;
+  }
+
+  CURL_TRC_WS(data, "curl_ws_start_frame(flags=%x, frame_len=%" FMT_OFF_T,
+              flags, frame_len);
+
+  if(!data->conn) {
+    failf(data, "[WS] No associated connection");
+    result = CURLE_SEND_ERROR;
+    goto out;
+  }
+  ws = Curl_conn_meta_get(data->conn, CURL_META_PROTO_WS_CONN);
+  if(!ws) {
+    failf(data, "[WS] Not a websocket transfer");
+    result = CURLE_SEND_ERROR;
+    goto out;
+  }
+
+  if(ws->enc.payload_remain) {
+    failf(data, "[WS] previous frame not finished");
+    result = CURLE_SEND_ERROR;
+    goto out;
+  }
+
+  result = ws_enc_write_head(data, ws, &ws->enc, flags, frame_len,
+                             &ws->sendbuf);
+  if(result)
+    CURL_TRC_WS(data, "curl_start_frame(), error adding frame head %d",
+                (int)result);
+
+out:
+  return result;
+}
+
+const struct Curl_protocol Curl_protocol_ws = {
+  ws_setup_conn,                        /* setup_connection */
+  Curl_http,                            /* do_it */
+  Curl_http_done,                       /* done */
+  ZERO_NULL,                            /* do_more */
+  ZERO_NULL,                            /* connect_it */
+  ZERO_NULL,                            /* connecting */
+  ZERO_NULL,                            /* doing */
+  ZERO_NULL,                            /* proto_pollset */
+  Curl_http_doing_pollset,              /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  Curl_http_perform_pollset,            /* perform_pollset */
+  ZERO_NULL,                            /* disconnect */
+  Curl_http_write_resp,                 /* write_resp */
+  Curl_http_write_resp_hd,              /* write_resp_hd */
+  ZERO_NULL,                            /* connection_is_dead */
+  ZERO_NULL,                            /* attach connection */
+  Curl_http_follow,                     /* follow */
+};
+
 #else
 
-CURL_EXTERN CURLcode curl_ws_recv(CURL *curl, void *buffer, size_t buflen,
-                                  size_t *nread,
-                                  const struct curl_ws_frame **metap)
+CURLcode curl_ws_recv(CURL *curl, void *buffer, size_t buflen,
+                      size_t *recv,
+                      const struct curl_ws_frame **metap)
 {
   (void)curl;
   (void)buffer;
   (void)buflen;
-  (void)nread;
+  (void)recv;
   (void)metap;
   return CURLE_NOT_BUILT_IN;
 }
 
-CURL_EXTERN CURLcode curl_ws_send(CURL *curl, const void *buffer,
-                                  size_t buflen, size_t *sent,
-                                  curl_off_t fragsize,
-                                  unsigned int flags)
+CURLcode curl_ws_send(CURL *curl, const void *buffer,
+                      size_t buflen, size_t *sent,
+                      curl_off_t fragsize,
+                      unsigned int flags)
 {
   (void)curl;
   (void)buffer;
@@ -1124,9 +1976,20 @@ CURL_EXTERN CURLcode curl_ws_send(CURL *curl, const void *buffer,
   return CURLE_NOT_BUILT_IN;
 }
 
-CURL_EXTERN const struct curl_ws_frame *curl_ws_meta(struct Curl_easy *data)
+const struct curl_ws_frame *curl_ws_meta(CURL *data)
 {
   (void)data;
   return NULL;
 }
-#endif /* USE_WEBSOCKETS */
+
+CURL_EXTERN CURLcode curl_ws_start_frame(CURL *curl,
+                                         unsigned int flags,
+                                         curl_off_t frame_len)
+{
+  (void)curl;
+  (void)flags;
+  (void)frame_len;
+  return CURLE_NOT_BUILT_IN;
+}
+
+#endif /* !CURL_DISABLE_WEBSOCKETS */
diff --git a/third-party/curl/lib/ws.h b/third-party/curl/lib/ws.h
index 0308a42545..71b5b3fff0 100644
--- a/third-party/curl/lib/ws.h
+++ b/third-party/curl/lib/ws.h
@@ -25,65 +25,20 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
-#ifdef USE_WEBSOCKETS
+#if !defined(CURL_DISABLE_WEBSOCKETS) && !defined(CURL_DISABLE_HTTP)
+
+extern const struct Curl_protocol Curl_protocol_ws;
+
+/* meta key for storing protocol meta at connection */
+#define CURL_META_PROTO_WS_CONN   "meta:proto:ws:conn"
+
+CURLcode Curl_ws_request(struct Curl_easy *data, struct dynbuf *req);
+CURLcode Curl_ws_accept(struct Curl_easy *data,
+                        const char *mem, size_t nread);
 
-#ifdef USE_HYPER
-#define REQTYPE void
 #else
-#define REQTYPE struct dynbuf
-#endif
-
-/* a client-side WS frame decoder, parsing frame headers and
- * payload, keeping track of current position and stats */
-enum ws_dec_state {
-  WS_DEC_INIT,
-  WS_DEC_HEAD,
-  WS_DEC_PAYLOAD
-};
-
-struct ws_decoder {
-  int frame_age;        /* zero */
-  int frame_flags;      /* See the CURLWS_* defines */
-  curl_off_t payload_offset;   /* the offset parsing is at */
-  curl_off_t payload_len;
-  unsigned char head[10];
-  int head_len, head_total;
-  enum ws_dec_state state;
-};
-
-/* a client-side WS frame encoder, generating frame headers and
- * converting payloads, tracking remaining data in current frame */
-struct ws_encoder {
-  curl_off_t payload_len;  /* payload length of current frame */
-  curl_off_t payload_remain;  /* remaining payload of current */
-  unsigned int xori; /* xor index */
-  unsigned char mask[4]; /* 32 bit mask for this connection */
-  unsigned char firstbyte; /* first byte of frame we encode */
-  bool contfragment; /* set TRUE if the previous fragment sent was not final */
-};
-
-/* A websocket connection with en- and decoder that treat frames
- * and keep track of boundaries. */
-struct websocket {
-  struct Curl_easy *data; /* used for write callback handling */
-  struct ws_decoder dec;  /* decode of we frames */
-  struct ws_encoder enc;  /* decode of we frames */
-  struct bufq recvbuf;    /* raw data from the server */
-  struct bufq sendbuf;    /* raw data to be sent to the server */
-  struct curl_ws_frame frame;  /* the current WS FRAME received */
-};
-
-CURLcode Curl_ws_request(struct Curl_easy *data, REQTYPE *req);
-CURLcode Curl_ws_accept(struct Curl_easy *data, const char *mem, size_t len);
-size_t Curl_ws_writecb(char *buffer, size_t size, size_t nitems, void *userp);
-void Curl_ws_done(struct Curl_easy *data);
-CURLcode Curl_ws_disconnect(struct Curl_easy *data,
-                            struct connectdata *conn,
-                            bool dead_connection);
-#else
-#define Curl_ws_request(x,y) CURLE_OK
-#define Curl_ws_done(x) Curl_nop_stmt
-#define Curl_ws_free(x) Curl_nop_stmt
+#define Curl_ws_request(x, y) CURLE_OK
+#define Curl_ws_free(x)       Curl_nop_stmt
 #endif
 
 #endif /* HEADER_CURL_WS_H */
diff --git a/third-party/curl/libcurl.pc.in b/third-party/curl/libcurl.pc.in
index 9db6b0f895..c0ba5244a8 100644
--- a/third-party/curl/libcurl.pc.in
+++ b/third-party/curl/libcurl.pc.in
@@ -22,9 +22,6 @@
 #
 ###########################################################################
 
-# This should most probably benefit from getting a "Requires:" field added
-# dynamically by configure.
-#
 prefix=@prefix@
 exec_prefix=@exec_prefix@
 libdir=@libdir@
@@ -34,8 +31,11 @@ supported_features="@SUPPORT_FEATURES@"
 
 Name: libcurl
 URL: https://curl.se/
-Description: Library to transfer files with ftp, http, etc.
+Description: Library to transfer files with HTTP, FTP, etc.
 Version: @CURLVERSION@
-Libs: -L${libdir} -lcurl @LIBCURL_NO_SHARED@
-Libs.private: @LIBCURL_LIBS@
-Cflags: -I${includedir} @CPPFLAG_CURL_STATICLIB@
+Requires: @LIBCURL_PC_REQUIRES@
+Requires.private: @LIBCURL_PC_REQUIRES_PRIVATE@
+Libs: -L${libdir} -lcurl @LIBCURL_PC_LIBS@
+Libs.private: @LIBCURL_PC_LDFLAGS_PRIVATE@ @LIBCURL_PC_LIBS_PRIVATE@
+Cflags: -I${includedir} @LIBCURL_PC_CFLAGS@
+Cflags.private: @LIBCURL_PC_CFLAGS_PRIVATE@
diff --git a/third-party/curl/m4/.gitignore b/third-party/curl/m4/.gitignore
index 59602da5a4..97cc668516 100644
--- a/third-party/curl/m4/.gitignore
+++ b/third-party/curl/m4/.gitignore
@@ -3,7 +3,6 @@
 # SPDX-License-Identifier: curl
 
 libtool.m4
-libtool.m4.tmp
 ltoptions.m4
 ltsugar.m4
 ltversion.m4
diff --git a/third-party/curl/m4/curl-amissl.m4 b/third-party/curl/m4/curl-amissl.m4
index 95208f0c21..e32861e9ef 100644
--- a/third-party/curl/m4/curl-amissl.m4
+++ b/third-party/curl/m4/curl-amissl.m4
@@ -25,7 +25,7 @@
 AC_DEFUN([CURL_WITH_AMISSL], [
 AC_MSG_CHECKING([whether to enable Amiga native SSL/TLS (AmiSSL v5)])
 if test "$HAVE_PROTO_BSDSOCKET_H" = "1"; then
-  if test "x$OPT_AMISSL" != xno; then
+  if test "x$OPT_AMISSL" != "xno"; then
     ssl_msg=
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
@@ -33,8 +33,7 @@ if test "$HAVE_PROTO_BSDSOCKET_H" = "1"; then
         #include <openssl/opensslv.h>
       ]],[[
         #if defined(AMISSL_CURRENT_VERSION) && defined(AMISSL_V3xx) && \
-            defined(OPENSSL_VERSION_MAJOR) && (OPENSSL_VERSION_MAJOR >= 3) && \
-            defined(PROTO_AMISSL_H)
+          (OPENSSL_VERSION_NUMBER >= 0x30000000L) && defined(PROTO_AMISSL_H)
         return 0;
         #else
         #error not AmiSSL v5 / OpenSSL 3
@@ -43,18 +42,17 @@ if test "$HAVE_PROTO_BSDSOCKET_H" = "1"; then
     ],[
       AC_MSG_RESULT([yes])
       ssl_msg="AmiSSL"
-      test amissl != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
+      test "amissl" != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
       AMISSL_ENABLED=1
       OPENSSL_ENABLED=1
-      # Use AmiSSL's built-in ca bundle
+      dnl Use AmiSSL's built-in CA bundle
       check_for_ca_bundle=1
       with_ca_fallback=yes
       LIBS="-lamisslstubs -lamisslauto $LIBS"
+      CURL_NETWORK_AND_TIME_LIBS="-lamisslstubs -lamisslauto $CURL_NETWORK_AND_TIME_LIBS"
       AC_DEFINE(USE_AMISSL, 1, [if AmiSSL is in use])
       AC_DEFINE(USE_OPENSSL, 1, [if OpenSSL is in use])
-      AC_DEFINE_UNQUOTED(HAVE_OPENSSL3, 1, [Define to 1 if using OpenSSL 3 or later.])
-      AC_CHECK_HEADERS(openssl/x509.h openssl/rsa.h openssl/crypto.h \
-                       openssl/pem.h openssl/ssl.h openssl/err.h)
+      AC_CHECK_HEADERS(openssl/rsa.h openssl/crypto.h openssl/pem.h openssl/ssl.h openssl/err.h)
     ],[
       AC_MSG_RESULT([no])
     ])
@@ -65,5 +63,4 @@ if test "$HAVE_PROTO_BSDSOCKET_H" = "1"; then
 else
   AC_MSG_RESULT(no)
 fi
-
 ])
diff --git a/third-party/curl/m4/curl-apple-sectrust.m4 b/third-party/curl/m4/curl-apple-sectrust.m4
new file mode 100644
index 0000000000..c70b7ac8cd
--- /dev/null
+++ b/third-party/curl/m4/curl-apple-sectrust.m4
@@ -0,0 +1,61 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+#***************************************************************************
+
+AC_DEFUN([CURL_WITH_APPLE_SECTRUST], [
+AC_MSG_CHECKING([whether to enable Apple OS native certificate validation])
+if test "x$OPT_APPLE_SECTRUST" = "xyes"; then
+  AC_COMPILE_IFELSE([
+    AC_LANG_PROGRAM([[
+      #include <sys/types.h>
+      #include <TargetConditionals.h>
+    ]],[[
+      #if TARGET_OS_MAC
+        return 0;
+      #else
+      #error Not macOS
+      #endif
+    ]])
+  ],[
+    build_for_apple="yes"
+  ],[
+    build_for_apple="no"
+  ])
+  if test "$build_for_apple" = "no"; then
+    AC_MSG_ERROR([Apple SecTrust can only be enabled for Apple OS targets])
+  fi
+  if test "$OPENSSL_ENABLED" = "1" || test "$GNUTLS_ENABLED" = "1"; then
+    AC_MSG_RESULT(yes)
+    AC_DEFINE(USE_APPLE_SECTRUST, 1, [enable Apple OS certificate validation])
+    APPLE_SECTRUST_ENABLED=1
+    APPLE_SECTRUST_LDFLAGS='-framework CoreFoundation -framework CoreServices -framework Security'
+    LDFLAGS="$LDFLAGS $APPLE_SECTRUST_LDFLAGS"
+    LDFLAGSPC="$LDFLAGSPC $APPLE_SECTRUST_LDFLAGS"
+  else
+    AC_MSG_ERROR([Apple SecTrust is only supported for OpenSSL/GnuTLS builds])
+  fi
+else
+  AC_MSG_RESULT(no)
+fi
+
+])
diff --git a/third-party/curl/m4/curl-bearssl.m4 b/third-party/curl/m4/curl-bearssl.m4
deleted file mode 100644
index f2d661de10..0000000000
--- a/third-party/curl/m4/curl-bearssl.m4
+++ /dev/null
@@ -1,110 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-#***************************************************************************
-
-AC_DEFUN([CURL_WITH_BEARSSL], [
-dnl ----------------------------------------------------
-dnl check for BearSSL
-dnl ----------------------------------------------------
-
-if test "x$OPT_BEARSSL" != xno; then
-  _cppflags=$CPPFLAGS
-  _ldflags=$LDFLAGS
-  ssl_msg=
-
-  if test X"$OPT_BEARSSL" != Xno; then
-
-    if test "$OPT_BEARSSL" = "yes"; then
-      OPT_BEARSSL=""
-    fi
-
-    if test -z "$OPT_BEARSSL" ; then
-      dnl check for lib first without setting any new path
-
-      AC_CHECK_LIB(bearssl, br_ssl_client_init_full,
-      dnl libbearssl found, set the variable
-       [
-         AC_DEFINE(USE_BEARSSL, 1, [if BearSSL is enabled])
-         AC_SUBST(USE_BEARSSL, [1])
-         BEARSSL_ENABLED=1
-         USE_BEARSSL="yes"
-         ssl_msg="BearSSL"
-         test bearssl != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
-        ], [], -lbearssl)
-    fi
-
-    addld=""
-    addlib=""
-    addcflags=""
-    bearssllib=""
-
-    if test "x$USE_BEARSSL" != "xyes"; then
-      dnl add the path and test again
-      addld=-L$OPT_BEARSSL/lib$libsuff
-      addcflags=-I$OPT_BEARSSL/include
-      bearssllib=$OPT_BEARSSL/lib$libsuff
-
-      LDFLAGS="$LDFLAGS $addld"
-      if test "$addcflags" != "-I/usr/include"; then
-         CPPFLAGS="$CPPFLAGS $addcflags"
-      fi
-
-      AC_CHECK_LIB(bearssl, br_ssl_client_init_full,
-       [
-       AC_DEFINE(USE_BEARSSL, 1, [if BearSSL is enabled])
-       AC_SUBST(USE_BEARSSL, [1])
-       BEARSSL_ENABLED=1
-       USE_BEARSSL="yes"
-       ssl_msg="BearSSL"
-       test bearssl != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
-       ],
-       [
-         CPPFLAGS=$_cppflags
-         LDFLAGS=$_ldflags
-       ], -lbearssl)
-    fi
-
-    if test "x$USE_BEARSSL" = "xyes"; then
-      AC_MSG_NOTICE([detected BearSSL])
-      check_for_ca_bundle=1
-
-      LIBS="-lbearssl $LIBS"
-
-      if test -n "$bearssllib"; then
-        dnl when shared libs were found in a path that the run-time
-        dnl linker doesn't search through, we need to add it to
-        dnl CURL_LIBRARY_PATH to prevent further configure tests to fail
-        dnl due to this
-        if test "x$cross_compiling" != "xyes"; then
-          CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$bearssllib"
-          export CURL_LIBRARY_PATH
-          AC_MSG_NOTICE([Added $bearssllib to CURL_LIBRARY_PATH])
-        fi
-      fi
-    fi
-
-  fi dnl BearSSL not disabled
-
-  test -z "$ssl_msg" || ssl_backends="${ssl_backends:+$ssl_backends, }$ssl_msg"
-fi
-])
diff --git a/third-party/curl/m4/curl-compilers.m4 b/third-party/curl/m4/curl-compilers.m4
index caa2b14cb3..8b7da20caa 100644
--- a/third-party/curl/m4/curl-compilers.m4
+++ b/third-party/curl/m4/curl-compilers.m4
@@ -22,38 +22,41 @@
 #
 #***************************************************************************
 
-# File version for 'aclocal' use. Keep it a single number.
-# serial 67
-
+dnl File version for 'aclocal' use. Keep it a single number.
+dnl serial 67
 
 dnl CURL_CHECK_COMPILER
 dnl -------------------------------------------------
 dnl Verify if the C compiler being used is known.
 
 AC_DEFUN([CURL_CHECK_COMPILER], [
-  #
+
   compiler_id="unknown"
+  compiler_ver=""
   compiler_num="0"
-  #
+
   flags_dbg_yes="unknown"
   flags_opt_all="unknown"
   flags_opt_yes="unknown"
   flags_opt_off="unknown"
-  #
+
   flags_prefer_cppflags="no"
-  #
+
   CURL_CHECK_COMPILER_DEC_C
   CURL_CHECK_COMPILER_HPUX_C
   CURL_CHECK_COMPILER_IBM_C
   CURL_CHECK_COMPILER_INTEL_C
   CURL_CHECK_COMPILER_CLANG
   CURL_CHECK_COMPILER_GNU_C
-  CURL_CHECK_COMPILER_LCC
-  CURL_CHECK_COMPILER_SGI_MIPSPRO_C
-  CURL_CHECK_COMPILER_SGI_MIPS_C
+  case $host in
+    mips-sgi-irix*)
+      CURL_CHECK_COMPILER_SGI_MIPSPRO_C
+      CURL_CHECK_COMPILER_SGI_MIPS_C
+    ;;
+  esac
   CURL_CHECK_COMPILER_SUNPRO_C
   CURL_CHECK_COMPILER_TINY_C
-  #
+
   if test "$compiler_id" = "unknown"; then
   cat <<_EOF 1>&2
 ***
@@ -61,11 +64,11 @@ AC_DEFUN([CURL_CHECK_COMPILER], [
 *** compiler you are using, relative to the flags required to enable or
 *** disable generation of debug info, optimization options or warnings.
 ***
-*** Whatever settings are present in CFLAGS will be used for this run.
+*** Whatever settings are present in CFLAGS are used for this run.
 ***
 *** If you wish to help the curl project to better support your compiler
 *** you can report this and the required info on the libcurl development
-*** mailing list: https://lists.haxx.selistinfo/curl-library/
+*** mailing list: https://lists.haxx.se/listinfo/curl-library/
 ***
 _EOF
   fi
@@ -77,14 +80,14 @@ dnl -------------------------------------------------
 dnl Verify if compiler being used is clang.
 
 AC_DEFUN([CURL_CHECK_COMPILER_CLANG], [
-  AC_BEFORE([$0],[CURL_CHECK_COMPILER_GNU_C])dnl
+  AC_BEFORE([$0],[CURL_CHECK_COMPILER_GNU_C])
   AC_MSG_CHECKING([if compiler is clang])
   CURL_CHECK_DEF([__clang__], [], [silent])
   if test "$curl_cv_have_def___clang__" = "yes"; then
     AC_MSG_RESULT([yes])
     AC_MSG_CHECKING([if compiler is xlclang])
     CURL_CHECK_DEF([__ibmxl__], [], [silent])
-    if test "$curl_cv_have_def___ibmxl__" = "yes" ; then
+    if test "$curl_cv_have_def___ibmxl__" = "yes"; then
       dnl IBM's almost-compatible clang version
       AC_MSG_RESULT([yes])
       compiler_id="XLCLANG"
@@ -92,19 +95,48 @@ AC_DEFUN([CURL_CHECK_COMPILER_CLANG], [
       AC_MSG_RESULT([no])
       compiler_id="CLANG"
     fi
+    AC_MSG_CHECKING([if compiler is Apple clang])
     fullclangver=`$CC -v 2>&1 | grep version`
+    if echo $fullclangver | grep 'Apple' >/dev/null; then
+      AC_MSG_RESULT([yes])
+      appleclang=1
+      compiler_id="APPLECLANG"
+    else
+      AC_MSG_RESULT([no])
+      appleclang=0
+    fi
+    AC_MSG_CHECKING([compiler version])
     clangver=`echo $fullclangver | grep "based on LLVM " | "$SED" 's/.*(based on LLVM \(@<:@0-9@:>@*\.@<:@0-9@:>@*\).*)/\1/'`
     if test -z "$clangver"; then
-      if echo $fullclangver | grep "Apple LLVM version " >/dev/null; then
-        dnl Starting with XCode 7 / clang 3.7, Apple clang won't tell its upstream version
-        clangver="3.7"
-      else
-        clangver=`echo $fullclangver | "$SED" 's/.*version \(@<:@0-9@:>@*\.@<:@0-9@:>@*\).*/\1/'`
-      fi
+      clangver=`echo $fullclangver | "$SED" 's/.*version \(@<:@0-9@:>@*\.@<:@0-9@:>@*\).*/\1/'`
+      oldapple=0
+    else
+      oldapple=1
     fi
     clangvhi=`echo $clangver | cut -d . -f1`
     clangvlo=`echo $clangver | cut -d . -f2`
+    compiler_ver="$clangver"
     compiler_num=`(expr $clangvhi "*" 100 + $clangvlo) 2>/dev/null`
+    if test "$appleclang" = "1" && test "$oldapple" = "0"; then
+      dnl Starting with Xcode 7 / clang 3.7, Apple clang does not tell its upstream version
+      if   test "$compiler_num" -ge '2604'; then compiler_num='2101'
+      elif test "$compiler_num" -ge '1700'; then compiler_num='1901'
+      elif test "$compiler_num" -ge '1600'; then compiler_num='1700'
+      elif test "$compiler_num" -ge '1500'; then compiler_num='1600'
+      elif test "$compiler_num" -ge '1400'; then compiler_num='1400'
+      elif test "$compiler_num" -ge '1301'; then compiler_num='1300'
+      elif test "$compiler_num" -ge '1300'; then compiler_num='1200'
+      elif test "$compiler_num" -ge '1200'; then compiler_num='1000'
+      elif test "$compiler_num" -ge '1100'; then compiler_num='800'
+      elif test "$compiler_num" -ge '1000'; then compiler_num='600'
+      elif test "$compiler_num" -ge  '901'; then compiler_num='500'
+      elif test "$compiler_num" -ge  '900'; then compiler_num='400'
+      elif test "$compiler_num" -ge  '801'; then compiler_num='309'
+      elif test "$compiler_num" -ge  '703'; then compiler_num='308'
+      else                                       compiler_num='307'
+      fi
+    fi
+    AC_MSG_RESULT([clang '$compiler_num' (raw: '$fullclangver' / '$clangver')])
     flags_dbg_yes="-g"
     flags_opt_all="-O -O0 -O1 -O2 -Os -O3 -O4"
     flags_opt_yes="-O2"
@@ -124,7 +156,7 @@ AC_DEFUN([CURL_CHECK_COMPILER_DEC_C], [
   CURL_CHECK_DEF([__DECC], [], [silent])
   CURL_CHECK_DEF([__DECC_VER], [], [silent])
   if test "$curl_cv_have_def___DECC" = "yes" &&
-    test "$curl_cv_have_def___DECC_VER" = "yes"; then
+     test "$curl_cv_have_def___DECC_VER" = "yes"; then
     AC_MSG_RESULT([yes])
     compiler_id="DEC_C"
     flags_dbg_yes="-g2"
@@ -141,8 +173,8 @@ dnl CURL_CHECK_COMPILER_GNU_C
 dnl -------------------------------------------------
 dnl Verify if compiler being used is GNU C
 dnl
-dnl $compiler_num will be set to MAJOR * 100 + MINOR for gcc less than version
-dnl 7 and just $MAJOR * 100 for gcc version 7 and later.
+dnl $compiler_num is set to MAJOR * 100 + MINOR for gcc less than version
+dnl 7 and $MAJOR * 100 for gcc version 7 and later.
 dnl
 dnl Examples:
 dnl Version 1.2.3 => 102
@@ -151,23 +183,30 @@ dnl Version 4.7 =>   407
 dnl Version 9.2.1 => 900
 dnl
 AC_DEFUN([CURL_CHECK_COMPILER_GNU_C], [
-  AC_REQUIRE([CURL_CHECK_COMPILER_INTEL_C])dnl
-  AC_REQUIRE([CURL_CHECK_COMPILER_CLANG])dnl
+  AC_REQUIRE([CURL_CHECK_COMPILER_INTEL_C])
+  AC_REQUIRE([CURL_CHECK_COMPILER_CLANG])
   AC_MSG_CHECKING([if compiler is GNU C])
   CURL_CHECK_DEF([__GNUC__], [], [silent])
   if test "$curl_cv_have_def___GNUC__" = "yes" &&
     test "$compiler_id" = "unknown"; then
     AC_MSG_RESULT([yes])
     compiler_id="GNU_C"
-    gccver=`$CC -dumpversion`
+    AC_MSG_CHECKING([compiler version])
+    dnl strip '-suffix' parts, e.g. Ubuntu Windows cross-gcc returns '10-win32'
+    gccver=`$CC -dumpversion | "$SED" 's/-.\{1,\}$//'`
     gccvhi=`echo $gccver | cut -d . -f1`
-    gccvlo=`echo $gccver | cut -d . -f2`
+    if echo $gccver | grep -F '.' >/dev/null; then
+      gccvlo=`echo $gccver | cut -d . -f2`
+    else
+      gccvlo="0"
+    fi
+    compiler_ver="$gccver"
     compiler_num=`(expr $gccvhi "*" 100 + $gccvlo) 2>/dev/null`
+    AC_MSG_RESULT([gcc '$compiler_num' (raw: '$gccver')])
     flags_dbg_yes="-g"
     flags_opt_all="-O -O0 -O1 -O2 -O3 -Os -Og -Ofast"
     flags_opt_yes="-O2"
     flags_opt_off="-O0"
-    CURL_CHECK_DEF([_WIN32], [], [silent])
   else
     AC_MSG_RESULT([no])
   fi
@@ -227,12 +266,15 @@ dnl -------------------------------------------------
 dnl Verify if compiler being used is Intel C.
 
 AC_DEFUN([CURL_CHECK_COMPILER_INTEL_C], [
-  AC_BEFORE([$0],[CURL_CHECK_COMPILER_GNU_C])dnl
+  AC_BEFORE([$0],[CURL_CHECK_COMPILER_GNU_C])
   AC_MSG_CHECKING([if compiler is Intel C])
   CURL_CHECK_DEF([__INTEL_COMPILER], [], [silent])
   if test "$curl_cv_have_def___INTEL_COMPILER" = "yes"; then
     AC_MSG_RESULT([yes])
+    AC_MSG_CHECKING([compiler version])
     compiler_num="$curl_cv_def___INTEL_COMPILER"
+    compiler_ver=`echo "$compiler_num" | cut -c -2 | $SED 's/^0//'`.`echo "$compiler_num" | cut -c 3-4 | $SED 's/^0//'`
+    AC_MSG_RESULT([Intel C '$compiler_num'])
     CURL_CHECK_DEF([__unix__], [], [silent])
     if test "$curl_cv_have_def___unix__" = "yes"; then
       compiler_id="INTEL_UNIX_C"
@@ -253,32 +295,12 @@ AC_DEFUN([CURL_CHECK_COMPILER_INTEL_C], [
 ])
 
 
-dnl CURL_CHECK_COMPILER_LCC
-dnl -------------------------------------------------
-dnl Verify if compiler being used is LCC.
-
-AC_DEFUN([CURL_CHECK_COMPILER_LCC], [
-  AC_MSG_CHECKING([if compiler is LCC])
-  CURL_CHECK_DEF([__LCC__], [], [silent])
-  if test "$curl_cv_have_def___LCC__" = "yes"; then
-    AC_MSG_RESULT([yes])
-    compiler_id="LCC"
-    flags_dbg_yes="-g"
-    flags_opt_all=""
-    flags_opt_yes=""
-    flags_opt_off=""
-  else
-    AC_MSG_RESULT([no])
-  fi
-])
-
-
 dnl CURL_CHECK_COMPILER_SGI_MIPS_C
 dnl -------------------------------------------------
 dnl Verify if compiler being used is SGI MIPS C.
 
 AC_DEFUN([CURL_CHECK_COMPILER_SGI_MIPS_C], [
-  AC_REQUIRE([CURL_CHECK_COMPILER_SGI_MIPSPRO_C])dnl
+  AC_REQUIRE([CURL_CHECK_COMPILER_SGI_MIPSPRO_C])
   AC_MSG_CHECKING([if compiler is SGI MIPS C])
   CURL_CHECK_DEF([__GNUC__], [], [silent])
   CURL_CHECK_DEF([__sgi], [], [silent])
@@ -302,7 +324,7 @@ dnl -------------------------------------------------
 dnl Verify if compiler being used is SGI MIPSpro C.
 
 AC_DEFUN([CURL_CHECK_COMPILER_SGI_MIPSPRO_C], [
-  AC_BEFORE([$0],[CURL_CHECK_COMPILER_SGI_MIPS_C])dnl
+  AC_BEFORE([$0],[CURL_CHECK_COMPILER_SGI_MIPS_C])
   AC_MSG_CHECKING([if compiler is SGI MIPSpro C])
   CURL_CHECK_DEF([__GNUC__], [], [silent])
   CURL_CHECK_DEF([_COMPILER_VERSION], [], [silent])
@@ -370,11 +392,12 @@ dnl headers from these locations, although on ancient
 dnl GNUC versions these warnings are not silenced.
 
 AC_DEFUN([CURL_CONVERT_INCLUDE_TO_ISYSTEM], [
-  AC_REQUIRE([CURL_SHFUNC_SQUEEZE])dnl
-  AC_REQUIRE([CURL_CHECK_COMPILER])dnl
+  AC_REQUIRE([CURL_SHFUNC_SQUEEZE])
+  AC_REQUIRE([CURL_CHECK_COMPILER])
   AC_MSG_CHECKING([convert -I options to -isystem])
   if test "$compiler_id" = "GNU_C" ||
-    test "$compiler_id" = "CLANG"; then
+     test "$compiler_id" = "CLANG" ||
+     test "$compiler_id" = "APPLECLANG"; then
     AC_MSG_RESULT([yes])
     tmp_has_include="no"
     tmp_chg_FLAGS="$CFLAGS"
@@ -453,16 +476,16 @@ AC_DEFUN([CURL_COMPILER_WORKS_IFELSE], [
     ])
   fi
   dnl only do runtime verification when not cross-compiling
-  if test "x$cross_compiling" != "xyes" &&
+  if test "$cross_compiling" != "yes" &&
     test "$tmp_compiler_works" = "yes"; then
     CURL_RUN_IFELSE([
       AC_LANG_PROGRAM([[
-#       ifdef __STDC__
-#         include <stdlib.h>
-#       endif
+        #ifdef __STDC__
+        #  include <stdlib.h>
+        #endif
       ]],[[
         int i = 0;
-        exit(i);
+        return i;
       ]])
     ],[
       tmp_compiler_works="yes"
@@ -489,28 +512,29 @@ dnl depend on configure's debug, optimize or warnings
 dnl options.
 
 AC_DEFUN([CURL_SET_COMPILER_BASIC_OPTS], [
-  AC_REQUIRE([CURL_CHECK_COMPILER])dnl
-  AC_REQUIRE([CURL_SHFUNC_SQUEEZE])dnl
-  #
+  AC_REQUIRE([CURL_CHECK_COMPILER])
+  AC_REQUIRE([CURL_SHFUNC_SQUEEZE])
+
   if test "$compiler_id" != "unknown"; then
-    #
+
     tmp_save_CPPFLAGS="$CPPFLAGS"
     tmp_save_CFLAGS="$CFLAGS"
     tmp_CPPFLAGS=""
     tmp_CFLAGS=""
-    #
+
     case "$compiler_id" in
-        #
-      CLANG)
-        #
-        dnl Disable warnings for unused arguments, otherwise clang will
-        dnl warn about compile-time arguments used during link-time, like
+
+      CLANG|APPLECLANG)
+
+        dnl Disable warnings for unused arguments, otherwise clang warns
+        dnl about compile-time arguments used during link-time, like
         dnl -O and -g and -pedantic.
         tmp_CFLAGS="$tmp_CFLAGS -Qunused-arguments"
+        tmp_CFLAGS="$tmp_CFLAGS -Werror-implicit-function-declaration"
         ;;
-        #
+
       DEC_C)
-        #
+
         dnl Select strict ANSI C compiler mode
         tmp_CFLAGS="$tmp_CFLAGS -std1"
         dnl Turn off optimizer ANSI C aliasing rules
@@ -520,28 +544,28 @@ AC_DEFUN([CURL_SET_COMPILER_BASIC_OPTS], [
         dnl Change some warnings into fatal errors
         tmp_CFLAGS="$tmp_CFLAGS -msg_fatal toofewargs,toomanyargs"
         ;;
-        #
+
       GNU_C)
-        #
+
         dnl turn implicit-function-declaration warning into error,
         dnl at least gcc 2.95 and later support this
         if test "$compiler_num" -ge "295"; then
           tmp_CFLAGS="$tmp_CFLAGS -Werror-implicit-function-declaration"
         fi
         ;;
-        #
+
       HP_UX_C)
-        #
-        dnl Disallow run-time dereferencing of null pointers
+
+        dnl Disallow runtime dereferencing of null pointers
         tmp_CFLAGS="$tmp_CFLAGS -z"
         dnl Disable some remarks
         dnl #4227: padding struct with n bytes to align member
         dnl #4255: padding size of struct with n bytes to alignment boundary
         tmp_CFLAGS="$tmp_CFLAGS +W 4227,4255"
         ;;
-        #
+
       IBM_C)
-        #
+
         dnl Ensure that compiler optimizations are always thread-safe.
         tmp_CPPFLAGS="$tmp_CPPFLAGS -qthreaded"
         dnl Disable type based strict aliasing optimizations, using worst
@@ -553,10 +577,10 @@ AC_DEFUN([CURL_SET_COMPILER_BASIC_OPTS], [
         dnl generating an object code file when compilation has errors.
         tmp_CPPFLAGS="$tmp_CPPFLAGS -qhalt=e"
         ;;
-        #
+
       INTEL_UNIX_C)
-        #
-        dnl On unix this compiler uses gcc's header files, so
+
+        dnl On Unix this compiler uses gcc's header files, so
         dnl we select ANSI C89 dialect plus GNU extensions.
         tmp_CFLAGS="$tmp_CFLAGS -std=gnu89"
         dnl Change some warnings into errors
@@ -573,49 +597,43 @@ AC_DEFUN([CURL_SET_COMPILER_BASIC_OPTS], [
         dnl #2259: non-pointer conversion from X to Y may lose significant bits
         tmp_CPPFLAGS="$tmp_CPPFLAGS -diag-disable 279,981,1025,1469,2259"
         ;;
-        #
+
       INTEL_WINDOWS_C)
-        #
+
         dnl Placeholder
         tmp_CFLAGS="$tmp_CFLAGS"
         ;;
-        #
-      LCC)
-        #
-        dnl Disallow run-time dereferencing of null pointers
-        tmp_CFLAGS="$tmp_CFLAGS -n"
-        ;;
-        #
+
       SGI_MIPS_C)
-        #
+
         dnl Placeholder
         tmp_CFLAGS="$tmp_CFLAGS"
         ;;
-        #
+
       SGI_MIPSPRO_C)
-        #
+
         dnl Placeholder
         tmp_CFLAGS="$tmp_CFLAGS"
         ;;
-        #
+
       SUNPRO_C)
-        #
+
         dnl Placeholder
         tmp_CFLAGS="$tmp_CFLAGS"
         ;;
-        #
+
       TINY_C)
-        #
+
         dnl Placeholder
         tmp_CFLAGS="$tmp_CFLAGS"
         ;;
-        #
+
     esac
-    #
+
     squeeze tmp_CPPFLAGS
     squeeze tmp_CFLAGS
-    #
-    if test ! -z "$tmp_CFLAGS" || test ! -z "$tmp_CPPFLAGS"; then
+
+    if test -n "$tmp_CFLAGS" || test -n "$tmp_CPPFLAGS"; then
       AC_MSG_CHECKING([if compiler accepts some basic options])
       CPPFLAGS="$tmp_save_CPPFLAGS $tmp_CPPFLAGS"
       CFLAGS="$tmp_save_CFLAGS $tmp_CFLAGS"
@@ -632,7 +650,6 @@ AC_DEFUN([CURL_SET_COMPILER_BASIC_OPTS], [
         CFLAGS="$tmp_save_CFLAGS"
       ])
     fi
-    #
   fi
 ])
 
@@ -643,24 +660,24 @@ dnl Sets compiler specific options/flags which depend
 dnl on configure's debug option.
 
 AC_DEFUN([CURL_SET_COMPILER_DEBUG_OPTS], [
-  AC_REQUIRE([CURL_CHECK_OPTION_DEBUG])dnl
-  AC_REQUIRE([CURL_CHECK_COMPILER])dnl
-  AC_REQUIRE([CURL_SHFUNC_SQUEEZE])dnl
-  #
+  AC_REQUIRE([CURL_CHECK_OPTION_DEBUG])
+  AC_REQUIRE([CURL_CHECK_COMPILER])
+  AC_REQUIRE([CURL_SHFUNC_SQUEEZE])
+
   if test "$compiler_id" != "unknown"; then
-    #
+
     tmp_save_CFLAGS="$CFLAGS"
     tmp_save_CPPFLAGS="$CPPFLAGS"
-    #
+
     tmp_options=""
     tmp_CFLAGS="$CFLAGS"
     tmp_CPPFLAGS="$CPPFLAGS"
-    #
+
     if test "$want_debug" = "yes"; then
       AC_MSG_CHECKING([if compiler accepts debug enabling options])
       tmp_options="$flags_dbg_yes"
     fi
-    #
+
     if test "$flags_prefer_cppflags" = "yes"; then
       CPPFLAGS="$tmp_CPPFLAGS $tmp_options"
       CFLAGS="$tmp_CFLAGS"
@@ -680,26 +697,26 @@ dnl Sets compiler specific options/flags which depend
 dnl on configure's optimize option.
 
 AC_DEFUN([CURL_SET_COMPILER_OPTIMIZE_OPTS], [
-  AC_REQUIRE([CURL_CHECK_OPTION_OPTIMIZE])dnl
-  AC_REQUIRE([CURL_CHECK_COMPILER])dnl
-  AC_REQUIRE([CURL_SHFUNC_SQUEEZE])dnl
-  #
+  AC_REQUIRE([CURL_CHECK_OPTION_OPTIMIZE])
+  AC_REQUIRE([CURL_CHECK_COMPILER])
+  AC_REQUIRE([CURL_SHFUNC_SQUEEZE])
+
   if test "$compiler_id" != "unknown"; then
-    #
+
     tmp_save_CFLAGS="$CFLAGS"
     tmp_save_CPPFLAGS="$CPPFLAGS"
-    #
+
     tmp_options=""
     tmp_CFLAGS="$CFLAGS"
     tmp_CPPFLAGS="$CPPFLAGS"
     honor_optimize_option="yes"
-    #
+
     dnl If optimization request setting has not been explicitly specified,
     dnl it has been derived from the debug setting and initially assumed.
-    dnl This initially assumed optimizer setting will finally be ignored
+    dnl This initially assumed optimizer setting are finally ignored
     dnl if CFLAGS or CPPFLAGS already hold optimizer flags. This implies
     dnl that an initially assumed optimizer setting might not be honored.
-    #
+
     if test "$want_optimize" = "assume_no" ||
        test "$want_optimize" = "assume_yes"; then
       AC_MSG_CHECKING([if compiler optimizer assumed setting might be used])
@@ -719,7 +736,7 @@ AC_DEFUN([CURL_SET_COMPILER_OPTIMIZE_OPTS], [
         fi
       fi
     fi
-    #
+
     if test "$honor_optimize_option" = "yes"; then
       CURL_VAR_STRIP([tmp_CFLAGS],[$flags_opt_all])
       CURL_VAR_STRIP([tmp_CPPFLAGS],[$flags_opt_all])
@@ -751,7 +768,6 @@ AC_DEFUN([CURL_SET_COMPILER_OPTIMIZE_OPTS], [
         CFLAGS="$tmp_save_CFLAGS"
       ])
     fi
-    #
   fi
 ])
 
@@ -762,161 +778,266 @@ dnl Sets compiler options/flags which depend on
 dnl configure's warnings given option.
 
 AC_DEFUN([CURL_SET_COMPILER_WARNING_OPTS], [
-  AC_REQUIRE([CURL_CHECK_OPTION_WARNINGS])dnl
-  AC_REQUIRE([CURL_CHECK_COMPILER])dnl
-  AC_REQUIRE([CURL_SHFUNC_SQUEEZE])dnl
-  #
+  AC_REQUIRE([CURL_CHECK_OPTION_WARNINGS])
+  AC_REQUIRE([CURL_CHECK_COMPILER])
+  AC_REQUIRE([CURL_SHFUNC_SQUEEZE])
+
   if test "$compiler_id" != "unknown"; then
-    #
+
     tmp_save_CPPFLAGS="$CPPFLAGS"
     tmp_save_CFLAGS="$CFLAGS"
     tmp_CPPFLAGS=""
     tmp_CFLAGS=""
-    #
+
     case "$compiler_id" in
-        #
-      CLANG)
-        #
+
+      CLANG|APPLECLANG)
+
         if test "$want_warnings" = "yes"; then
-          tmp_CFLAGS="$tmp_CFLAGS -pedantic"
+          if test "$compiler_num" -ge "302"; then
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [pedantic])
+          else
+            tmp_CFLAGS="$tmp_CFLAGS -pedantic"
+          fi
           CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [all extra])
           CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [pointer-arith write-strings])
           CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [shadow])
-          CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [inline nested-externs])
+          CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [nested-externs])
           CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [missing-declarations])
           CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [missing-prototypes])
           tmp_CFLAGS="$tmp_CFLAGS -Wno-long-long"
           CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [float-equal])
-          CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [no-multichar sign-compare])
+          CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [sign-compare])
+          tmp_CFLAGS="$tmp_CFLAGS -Wno-multichar"
           CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [undef])
-          tmp_CFLAGS="$tmp_CFLAGS -Wno-format-nonliteral"
           CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [endif-labels strict-prototypes])
           CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [declaration-after-statement])
           CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [cast-align])
           tmp_CFLAGS="$tmp_CFLAGS -Wno-system-headers"
           CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [shorten-64-to-32])
-          #
+
           dnl Only clang 1.1 or later
           if test "$compiler_num" -ge "101"; then
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [unused])
           fi
-          #
+
+          dnl Only clang 2.7 or later
+          if test "$compiler_num" -ge "207"; then
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [address])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [attributes])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [bad-function-cast])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [cast-qual])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [conversion])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [div-by-zero format-security])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [empty-body])
+            tmp_CFLAGS="$tmp_CFLAGS -Wformat=2"
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [missing-field-initializers])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [missing-noreturn])
+            tmp_CFLAGS="$tmp_CFLAGS -Wno-switch-default"
+            tmp_CFLAGS="$tmp_CFLAGS -Wno-switch-enum"                    # Not used because this basically disallows default case
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [old-style-definition])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [redundant-decls])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [type-limits])
+          # CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [unused-macros])    # Not practical
+          # tmp_CFLAGS="$tmp_CFLAGS -Wno-error=unused-macros"
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [unreachable-code unused-parameter])
+          fi
+
           dnl Only clang 2.8 or later
           if test "$compiler_num" -ge "208"; then
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [ignored-qualifiers])
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [vla])
           fi
-          #
+
           dnl Only clang 2.9 or later
           if test "$compiler_num" -ge "209"; then
+            tmp_CFLAGS="$tmp_CFLAGS -Wno-sign-conversion"
+            tmp_CFLAGS="$tmp_CFLAGS -Wno-padded"                         # Not used because we cannot change public structs
+            tmp_CFLAGS="$tmp_CFLAGS -Wno-used-but-marked-unused"         # for typecheck-gcc.h with clang 14+, dependency headers
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [shift-sign-overflow])
           fi
-          #
-          dnl Only clang 3.0 or later (possibly earlier)
+
+          dnl Only clang 3.0 or later
           if test "$compiler_num" -ge "300"; then
-            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [bad-function-cast])
-            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [conversion])
-            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [empty-body])
-            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [ignored-qualifiers])
-            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [type-limits])
-            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [no-sign-conversion])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [conditional-uninitialized])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [language-extension-token])
           fi
-          #
+
+          dnl Only clang 3.1 or later
+          if test "$compiler_num" -ge "301"; then
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [format-non-iso])
+            tmp_CFLAGS="$tmp_CFLAGS -Wno-covered-switch-default"    # Annoying to fix or silence
+            tmp_CFLAGS="$tmp_CFLAGS -Wno-disabled-macro-expansion"  # for std headers, and curl/curl.h (rare combos)
+          fi
+
           dnl Only clang 3.2 or later
           if test "$compiler_num" -ge "302"; then
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [enum-conversion])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [sometimes-uninitialized])
             case $host_os in
-            cygwin* | mingw*)
-              dnl skip missing-variable-declarations warnings for cygwin and
-              dnl mingw because the libtool wrapper executable causes them
-              ;;
-            *)
-              CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [missing-variable-declarations])
-              ;;
+              cygwin* | mingw*)
+                dnl skip missing-variable-declarations warnings for Cygwin and
+                dnl MinGW because the libtool wrapper executable causes them
+                ;;
+              *)
+                CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [missing-variable-declarations])
+                ;;
             esac
           fi
-          #
+
+          dnl Only clang 3.3 or later
+          if test "$compiler_num" -ge "303"; then
+            tmp_CFLAGS="$tmp_CFLAGS -Wno-documentation-unknown-command"
+          fi
+
           dnl Only clang 3.4 or later
           if test "$compiler_num" -ge "304"; then
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [header-guard])
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [unused-const-variable])
           fi
-          #
+
+          dnl Only clang 3.5 or later
+          if test "$compiler_num" -ge "305"; then
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [pragmas])
+          # CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [unreachable-code-break])  # Not used: Silent in "unity" builds
+          fi
+
           dnl Only clang 3.6 or later
           if test "$compiler_num" -ge "306"; then
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [double-promotion])
           fi
-          #
+
           dnl Only clang 3.9 or later
           if test "$compiler_num" -ge "309"; then
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [comma])
-            # avoid the varargs warning, fixed in 4.0
-            # https://bugs.llvm.org/show_bug.cgi?id=29140
+            dnl avoid the varargs warning, fixed in 4.0
+            dnl https://bugs.llvm.org/show_bug.cgi?id=29140
             if test "$compiler_num" -lt "400"; then
               tmp_CFLAGS="$tmp_CFLAGS -Wno-varargs"
             fi
           fi
+
           dnl clang 7 or later
           if test "$compiler_num" -ge "700"; then
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [assign-enum])
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [extra-semi-stmt])
           fi
+
+          dnl clang 10 or later
+          if test "$compiler_num" -ge "1000"; then
+            tmp_CFLAGS="$tmp_CFLAGS -Wimplicit-fallthrough"  # we have silencing markup for clang 10.0 and above only
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [xor-used-as-pow])
+          fi
+
+          dnl clang 13 or later
+          if test "$compiler_num" -ge "1300"; then
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [cast-function-type])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [reserved-identifier]) # Keep it before -Wno-reserved-macro-identifier
+            tmp_CFLAGS="$tmp_CFLAGS -Wno-reserved-macro-identifier"  # Sometimes such external macros need to be set
+          fi
+
+          dnl clang 16 or later
+          if test "$compiler_num" -ge "1600"; then
+            tmp_CFLAGS="$tmp_CFLAGS -Wno-unsafe-buffer-usage"
+          fi
+
+          dnl clang 17 or later
+          if test "$compiler_num" -ge "1700"; then
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [cast-function-type-strict])  # with Apple clang it requires 16.0 or above
+          fi
+
+          dnl clang 19 or later
+          if test "$compiler_num" -ge "1901"; then
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [format-signedness])
+          fi
+
+          dnl clang 20 or later
+          if test "$compiler_num" -ge "2001"; then
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [array-compare])
+          fi
+
+          dnl clang 21 or later
+          if test "$compiler_num" -ge "2101"; then
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [c++-hidden-decl])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [implicit-int-enum-cast])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [jump-misses-init])
+            tmp_CFLAGS="$tmp_CFLAGS -Wno-implicit-void-ptr-cast"
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [tentative-definition-compat])
+            if test "$curl_cv_native_windows" = "yes"; then
+              tmp_CFLAGS="$tmp_CFLAGS -Wno-c++-keyword"  # `wchar_t` triggers it on Windows
+            else
+              CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [c++-keyword])
+            fi
+          fi
+
+          case "$CFLAGS" in
+            *-std=c89*|*-std=c90*|*-std=gnu89*|*-std=gnu90*)
+              if test "$compiler_num" -ge "300"; then
+                tmp_CFLAGS="$tmp_CFLAGS -Wno-c99-extensions"  # Avoid: warning: '_Bool' is a C99 extension
+              fi
+              if test "$compiler_num" -ge "309"; then
+                tmp_CFLAGS="$tmp_CFLAGS -Wno-comma"  # Silly
+              fi
+              ;;
+          esac
         fi
-        dnl Disable pointer to bool conversion warnings since they cause
-        dnl lib/securetransp.c cause several warnings for checks we want.
-        dnl This option should be placed after -Wconversion.
-        tmp_CFLAGS="$tmp_CFLAGS -Wno-pointer-bool-conversion"
         ;;
-        #
+
       DEC_C)
-        #
+
         if test "$want_warnings" = "yes"; then
           dnl Select a higher warning level than default level2
           tmp_CFLAGS="$tmp_CFLAGS -msg_enable level3"
         fi
         ;;
-        #
+
       GNU_C)
-        #
-        if test "$want_warnings" = "yes"; then
-          tmp_CFLAGS="$tmp_CFLAGS -std=gnu89"
-          #
+
+        dnl Leave disabled for GCC <4.6, because they lack #pragma features to silence locally.
+        if test "$want_warnings" = "yes" && test "$compiler_num" -ge "406"; then
+
           dnl Do not enable -pedantic when cross-compiling with a gcc older
           dnl than 3.0, to avoid warnings from third party system headers.
-          if test "x$cross_compiling" != "xyes" ||
-            test "$compiler_num" -ge "300"; then
-            tmp_CFLAGS="$tmp_CFLAGS -pedantic"
+          if test "$cross_compiling" != "yes" ||
+             test "$compiler_num" -ge "300"; then
+            if test "$compiler_num" -ge "408"; then
+              CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [pedantic])
+            else
+              tmp_CFLAGS="$tmp_CFLAGS -pedantic"
+            fi
           fi
-          #
+
           dnl Set of options we believe *ALL* gcc versions support:
           CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [all])
           tmp_CFLAGS="$tmp_CFLAGS -W"
-          #
+
           dnl Only gcc 1.4 or later
           if test "$compiler_num" -ge "104"; then
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [pointer-arith write-strings])
             dnl If not cross-compiling with a gcc older than 3.0
-            if test "x$cross_compiling" != "xyes" ||
+            if test "$cross_compiling" != "yes" ||
               test "$compiler_num" -ge "300"; then
               CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [unused shadow])
             fi
           fi
-          #
+
           dnl Only gcc 2.7 or later
           if test "$compiler_num" -ge "207"; then
-            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [inline nested-externs])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [nested-externs])
             dnl If not cross-compiling with a gcc older than 3.0
-            if test "x$cross_compiling" != "xyes" ||
+            if test "$cross_compiling" != "yes" ||
               test "$compiler_num" -ge "300"; then
               CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [missing-declarations])
               CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [missing-prototypes])
             fi
           fi
-          #
+
           dnl Only gcc 2.95 or later
           if test "$compiler_num" -ge "295"; then
             tmp_CFLAGS="$tmp_CFLAGS -Wno-long-long"
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [bad-function-cast])
           fi
-          #
+
           dnl Only gcc 2.96 or later
           if test "$compiler_num" -ge "296"; then
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [float-equal])
@@ -927,12 +1048,7 @@ AC_DEFUN([CURL_SET_COMPILER_WARNING_OPTS], [
             dnl headers with gcc 2.95.4 on FreeBSD 4.9
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [undef])
           fi
-          #
-          dnl Only gcc 2.97 or later
-          if test "$compiler_num" -ge "297"; then
-            tmp_CFLAGS="$tmp_CFLAGS -Wno-format-nonliteral"
-          fi
-          #
+
           dnl Only gcc 3.0 or later
           if test "$compiler_num" -ge "300"; then
             dnl -Wunreachable-code seems totally unreliable on my gcc 3.3.2 on
@@ -941,30 +1057,54 @@ AC_DEFUN([CURL_SET_COMPILER_WARNING_OPTS], [
             dnl over making it unusable for generic purposes. Let's not use it.
             tmp_CFLAGS="$tmp_CFLAGS"
           fi
-          #
+
           dnl Only gcc 3.3 or later
           if test "$compiler_num" -ge "303"; then
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [endif-labels strict-prototypes])
           fi
-          #
+
           dnl Only gcc 3.4 or later
           if test "$compiler_num" -ge "304"; then
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [declaration-after-statement])
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [old-style-definition])
           fi
-          #
+
           dnl Only gcc 4.0 or later
           if test "$compiler_num" -ge "400"; then
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [cast-qual])
             tmp_CFLAGS="$tmp_CFLAGS -Wstrict-aliasing=3"
           fi
-          #
+
+          dnl Only gcc 4.1 or later
+          if test "$compiler_num" -ge "401"; then
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [attributes])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [div-by-zero format-security])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [missing-field-initializers])
+            case $host in
+              *-*-msys*)
+                ;;
+              *)
+                CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [missing-noreturn])  # Seen to clash with libtool-generated stub code
+                ;;
+            esac
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [unreachable-code unused-parameter])
+            tmp_CFLAGS="$tmp_CFLAGS -Wno-padded"                         # Not used because we cannot change public structs
+            tmp_CFLAGS="$tmp_CFLAGS -Wno-switch-default"
+            tmp_CFLAGS="$tmp_CFLAGS -Wno-switch-enum"                    # Not used because this basically disallows default case
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [pragmas])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [redundant-decls])
+          # CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [unused-macros])    # Not practical
+          # tmp_CFLAGS="$tmp_CFLAGS -Wno-error=unused-macros"
+          fi
+
           dnl Only gcc 4.2 or later
           if test "$compiler_num" -ge "402"; then
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [cast-align])
           fi
-          #
+
           dnl Only gcc 4.3 or later
           if test "$compiler_num" -ge "403"; then
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [address])
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [type-limits old-style-declaration])
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [missing-parameter-type empty-body])
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [clobbered ignored-qualifiers])
@@ -974,30 +1114,44 @@ AC_DEFUN([CURL_SET_COMPILER_WARNING_OPTS], [
             dnl required for -Warray-bounds, included in -Wall
             tmp_CFLAGS="$tmp_CFLAGS -ftree-vrp"
           fi
-          #
+
+          dnl Only gcc 4.4 or later
+          if test "$compiler_num" -ge "404"; then
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [logical-op])
+          fi
+
           dnl Only gcc 4.5 or later
           if test "$compiler_num" -ge "405"; then
-            dnl Only windows targets
-            if test "$curl_cv_have_def__WIN32" = "yes"; then
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [jump-misses-init])
+            dnl Only Windows targets
+            if test "$curl_cv_native_windows" = "yes"; then
               tmp_CFLAGS="$tmp_CFLAGS -Wno-pedantic-ms-format"
             fi
+            case $host_os in
+              cygwin*)
+                dnl Silence warning in 'lt_fatal' libtool function
+                tmp_CFLAGS="$tmp_CFLAGS -Wno-suggest-attribute=noreturn"
+                ;;
+            esac
           fi
-          #
+
           dnl Only gcc 4.6 or later
           if test "$compiler_num" -ge "406"; then
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [double-promotion])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [trampolines])
           fi
-          #
+
           dnl only gcc 4.8 or later
           if test "$compiler_num" -ge "408"; then
             tmp_CFLAGS="$tmp_CFLAGS -Wformat=2"
           fi
-          #
+
           dnl Only gcc 5 or later
           if test "$compiler_num" -ge "500"; then
             tmp_CFLAGS="$tmp_CFLAGS -Warray-bounds=2"
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [format-signedness])
           fi
-          #
+
           dnl Only gcc 6 or later
           if test "$compiler_num" -ge "600"; then
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [shift-negative-value])
@@ -1007,35 +1161,48 @@ AC_DEFUN([CURL_SET_COMPILER_WARNING_OPTS], [
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [duplicated-cond])
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [unused-const-variable])
           fi
-          #
+
           dnl Only gcc 7 or later
           if test "$compiler_num" -ge "700"; then
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [duplicated-branches])
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [restrict])
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [alloc-zero])
-            tmp_CFLAGS="$tmp_CFLAGS -Wformat-overflow=2"
             tmp_CFLAGS="$tmp_CFLAGS -Wformat-truncation=2"
-            if test "$compiler_num" -lt "1200"; then
-              dnl gcc 12 doesn't acknowledge our comment markups
-              tmp_CFLAGS="$tmp_CFLAGS -Wimplicit-fallthrough=4"
-            fi
+            tmp_CFLAGS="$tmp_CFLAGS -Wimplicit-fallthrough"
           fi
-          #
+
           dnl Only gcc 10 or later
           if test "$compiler_num" -ge "1000"; then
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [arith-conversion])
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [enum-conversion])
           fi
-          #
+
+          dnl Only gcc 12 or later
+          if test "$compiler_num" -ge "1200"; then
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [array-compare])
+          fi
+
+          dnl Only gcc 13 or later
+          if test "$compiler_num" -ge "1300"; then
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [enum-int-mismatch])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [xor-used-as-pow])
+          fi
+
+          dnl Only gcc 15 or later
+          if test "$compiler_num" -ge "1500"; then
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [leading-whitespace=spaces])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [trailing-whitespace=any])
+            CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [unterminated-string-initialization])
+          fi
         fi
-        #
+
         dnl Do not issue warnings for code in system include paths.
         if test "$compiler_num" -ge "300"; then
           tmp_CFLAGS="$tmp_CFLAGS -Wno-system-headers"
         else
           dnl When cross-compiling with a gcc older than 3.0, disable
           dnl some warnings triggered on third party system headers.
-          if test "x$cross_compiling" = "xyes"; then
+          if test "$cross_compiling" = "yes"; then
             if test "$compiler_num" -ge "104"; then
               dnl gcc 1.4 or later
               tmp_CFLAGS="$tmp_CFLAGS -Wno-unused -Wno-shadow"
@@ -1047,24 +1214,36 @@ AC_DEFUN([CURL_SET_COMPILER_WARNING_OPTS], [
             fi
           fi
         fi
+        if test "$compiler_num" -ge "400" && test "$compiler_num" -lt "407"; then
+          dnl https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84685
+          tmp_CFLAGS="$tmp_CFLAGS -Wno-missing-field-initializers"
+        fi
+        if test "$compiler_num" -ge "403" && test "$compiler_num" -lt "408"; then
+          dnl Avoid false positives
+          tmp_CFLAGS="$tmp_CFLAGS -Wno-type-limits"
+        fi
+        if test "$compiler_num" -ge "501" && test "$compiler_num" -lt "505"; then
+          dnl Avoid false positives
+          tmp_CFLAGS="$tmp_CFLAGS -Wno-conversion"
+        fi
         ;;
-        #
+
       HP_UX_C)
-        #
+
         if test "$want_warnings" = "yes"; then
           dnl Issue all warnings
           tmp_CFLAGS="$tmp_CFLAGS +w1"
         fi
         ;;
-        #
+
       IBM_C)
-        #
+
         dnl Placeholder
         tmp_CFLAGS="$tmp_CFLAGS"
         ;;
-        #
+
       INTEL_UNIX_C)
-        #
+
         if test "$want_warnings" = "yes"; then
           if test "$compiler_num" -gt "600"; then
             dnl Show errors, warnings, and remarks
@@ -1081,7 +1260,7 @@ AC_DEFUN([CURL_SET_COMPILER_WARNING_OPTS], [
             tmp_CPPFLAGS="$tmp_CPPFLAGS -Wp64"
             dnl Enable warnings for questionable pointer arithmetic
             tmp_CPPFLAGS="$tmp_CPPFLAGS -Wpointer-arith"
-            dnl Check for function return typw issues
+            dnl Check for function return type issues
             tmp_CPPFLAGS="$tmp_CPPFLAGS -Wreturn-type"
             dnl Warn on variable declarations hiding a previous one
             tmp_CPPFLAGS="$tmp_CPPFLAGS -Wshadow"
@@ -1098,34 +1277,23 @@ AC_DEFUN([CURL_SET_COMPILER_WARNING_OPTS], [
         dnl Value-safe optimizations on floating-point data
         tmp_CFLAGS="$tmp_CFLAGS -fp-model precise"
         ;;
-        #
+
       INTEL_WINDOWS_C)
-        #
+
         dnl Placeholder
         tmp_CFLAGS="$tmp_CFLAGS"
         ;;
-        #
-      LCC)
-        #
-        if test "$want_warnings" = "yes"; then
-          dnl Highest warning level is double -A, next is single -A.
-          dnl Due to the big number of warnings these trigger on third
-          dnl party header files it is impractical for us to use any of
-          dnl them here. If you want them simply define it in CPPFLAGS.
-          tmp_CFLAGS="$tmp_CFLAGS"
-        fi
-        ;;
-        #
+
       SGI_MIPS_C)
-        #
+
         if test "$want_warnings" = "yes"; then
           dnl Perform stricter semantic and lint-like checks
           tmp_CFLAGS="$tmp_CFLAGS -fullwarn"
         fi
         ;;
-        #
+
       SGI_MIPSPRO_C)
-        #
+
         if test "$want_warnings" = "yes"; then
           dnl Perform stricter semantic and lint-like checks
           tmp_CFLAGS="$tmp_CFLAGS -fullwarn"
@@ -1134,17 +1302,17 @@ AC_DEFUN([CURL_SET_COMPILER_WARNING_OPTS], [
           tmp_CFLAGS="$tmp_CFLAGS -woff 1209"
         fi
         ;;
-        #
+
       SUNPRO_C)
-        #
+
         if test "$want_warnings" = "yes"; then
           dnl Perform stricter semantic and lint-like checks
           tmp_CFLAGS="$tmp_CFLAGS -v"
         fi
         ;;
-        #
+
       TINY_C)
-        #
+
         if test "$want_warnings" = "yes"; then
           dnl Activate all warnings
           CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [all])
@@ -1154,13 +1322,13 @@ AC_DEFUN([CURL_SET_COMPILER_WARNING_OPTS], [
           CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [unsupported])
         fi
         ;;
-        #
+
     esac
-    #
+
     squeeze tmp_CPPFLAGS
     squeeze tmp_CFLAGS
-    #
-    if test ! -z "$tmp_CFLAGS" || test ! -z "$tmp_CPPFLAGS"; then
+
+    if test -n "$tmp_CFLAGS" || test -n "$tmp_CPPFLAGS"; then
       AC_MSG_CHECKING([if compiler accepts strict warning options])
       CPPFLAGS="$tmp_save_CPPFLAGS $tmp_CPPFLAGS"
       CFLAGS="$tmp_save_CFLAGS $tmp_CFLAGS"
@@ -1177,7 +1345,6 @@ AC_DEFUN([CURL_SET_COMPILER_WARNING_OPTS], [
         CFLAGS="$tmp_save_CFLAGS"
       ])
     fi
-    #
   fi
 ])
 
@@ -1204,52 +1371,6 @@ squeeze() {
 ])
 
 
-dnl CURL_CHECK_CURLDEBUG
-dnl -------------------------------------------------
-dnl Settings which depend on configure's curldebug given
-dnl option, and other additional configure pre-requisites.
-dnl Actually the curl debug memory tracking feature can
-dnl only be used/enabled when libcurl is built as a static
-dnl library or as a shared one on those systems on which
-dnl shared libraries support undefined symbols.
-
-AC_DEFUN([CURL_CHECK_CURLDEBUG], [
-  AC_REQUIRE([XC_LIBTOOL])dnl
-  AC_REQUIRE([CURL_SHFUNC_SQUEEZE])dnl
-  supports_curldebug="unknown"
-  if test "$want_curldebug" = "yes"; then
-    if test "x$enable_shared" != "xno" &&
-      test "x$enable_shared" != "xyes"; then
-      AC_MSG_WARN([unknown enable_shared setting.])
-      supports_curldebug="no"
-    fi
-    if test "x$enable_static" != "xno" &&
-      test "x$enable_static" != "xyes"; then
-      AC_MSG_WARN([unknown enable_static setting.])
-      supports_curldebug="no"
-    fi
-    if test "$supports_curldebug" != "no"; then
-      if test "$enable_shared" = "yes" &&
-        test "x$xc_lt_shlib_use_no_undefined" = 'xyes'; then
-        supports_curldebug="no"
-        AC_MSG_WARN([shared library does not support undefined symbols.])
-      fi
-    fi
-  fi
-  #
-  if test "$want_curldebug" = "yes"; then
-    AC_MSG_CHECKING([if curl debug memory tracking can be enabled])
-    test "$supports_curldebug" = "no" || supports_curldebug="yes"
-    AC_MSG_RESULT([$supports_curldebug])
-    if test "$supports_curldebug" = "no"; then
-      AC_MSG_WARN([cannot enable curl debug memory tracking.])
-      want_curldebug="no"
-    fi
-  fi
-])
-
-
-
 dnl CURL_CHECK_COMPILER_HALT_ON_ERROR
 dnl -------------------------------------------------
 dnl Verifies if the compiler actually halts after the
@@ -1261,7 +1382,7 @@ AC_DEFUN([CURL_CHECK_COMPILER_HALT_ON_ERROR], [
   AC_COMPILE_IFELSE([
     AC_LANG_PROGRAM([[
     ]],[[
-      force compilation error
+      #error force compilation error
     ]])
   ],[
     AC_MSG_RESULT([no])
@@ -1280,13 +1401,14 @@ dnl code file, when the source code tries to define a
 dnl type for a constant array with negative dimension.
 
 AC_DEFUN([CURL_CHECK_COMPILER_ARRAY_SIZE_NEGATIVE], [
-  AC_REQUIRE([CURL_CHECK_COMPILER_HALT_ON_ERROR])dnl
+  AC_REQUIRE([CURL_CHECK_COMPILER_HALT_ON_ERROR])
   AC_MSG_CHECKING([if compiler halts on negative sized arrays])
   AC_COMPILE_IFELSE([
     AC_LANG_PROGRAM([[
-      typedef char bad_t[sizeof(char) == sizeof(int) ? -1 : -1 ];
+      typedef char bad_t[sizeof(char) == sizeof(int) ? -1 : -1];
     ]],[[
       bad_t dummy;
+      (void)dummy;
     ]])
   ],[
     AC_MSG_RESULT([no])
@@ -1305,7 +1427,7 @@ dnl result, as a compilation-time condition inside the
 dnl type definition of a constant array.
 
 AC_DEFUN([CURL_CHECK_COMPILER_STRUCT_MEMBER_SIZE], [
-  AC_REQUIRE([CURL_CHECK_COMPILER_ARRAY_SIZE_NEGATIVE])dnl
+  AC_REQUIRE([CURL_CHECK_COMPILER_ARRAY_SIZE_NEGATIVE])
   AC_MSG_CHECKING([if compiler struct member size checking works])
   tst_compiler_check_one_works="unknown"
   AC_COMPILE_IFELSE([
@@ -1316,11 +1438,13 @@ AC_DEFUN([CURL_CHECK_COMPILER_STRUCT_MEMBER_SIZE], [
         struct mystruct *next;
       };
       struct mystruct myfunc();
-      typedef char good_t1[sizeof(myfunc().mi) == sizeof(int)  ? 1 : -1 ];
-      typedef char good_t2[sizeof(myfunc().mc) == sizeof(char) ? 1 : -1 ];
+      typedef char good_t1[sizeof(myfunc().mi) == sizeof(int)  ? 1 : -1];
+      typedef char good_t2[sizeof(myfunc().mc) == sizeof(char) ? 1 : -1];
     ]],[[
       good_t1 dummy1;
       good_t2 dummy2;
+      (void)dummy1;
+      (void)dummy2;
     ]])
   ],[
     tst_compiler_check_one_works="yes"
@@ -1338,11 +1462,13 @@ AC_DEFUN([CURL_CHECK_COMPILER_STRUCT_MEMBER_SIZE], [
         struct mystruct *next;
       };
       struct mystruct myfunc();
-      typedef char bad_t1[sizeof(myfunc().mi) != sizeof(int)  ? 1 : -1 ];
-      typedef char bad_t2[sizeof(myfunc().mc) != sizeof(char) ? 1 : -1 ];
+      typedef char bad_t1[sizeof(myfunc().mi) != sizeof(int)  ? 1 : -1];
+      typedef char bad_t2[sizeof(myfunc().mc) != sizeof(char) ? 1 : -1];
     ]],[[
       bad_t1 dummy1;
       bad_t2 dummy2;
+      (void)dummy1;
+      (void)dummy2;
     ]])
   ],[
     tst_compiler_check_two_works="no"
@@ -1366,8 +1492,8 @@ dnl shell variable supports_symbol_hiding value as appropriate, as well as
 dnl variables symbol_hiding_CFLAGS and symbol_hiding_EXTERN when supported.
 
 AC_DEFUN([CURL_CHECK_COMPILER_SYMBOL_HIDING], [
-  AC_REQUIRE([CURL_CHECK_COMPILER])dnl
-  AC_BEFORE([$0],[CURL_CONFIGURE_SYMBOL_HIDING])dnl
+  AC_REQUIRE([CURL_CHECK_COMPILER])
+  AC_BEFORE([$0],[CURL_CONFIGURE_SYMBOL_HIDING])
   AC_MSG_CHECKING([if compiler supports hiding library internal symbols])
   supports_symbol_hiding="no"
   symbol_hiding_CFLAGS=""
@@ -1375,17 +1501,17 @@ AC_DEFUN([CURL_CHECK_COMPILER_SYMBOL_HIDING], [
   tmp_CFLAGS=""
   tmp_EXTERN=""
   case "$compiler_id" in
-    CLANG)
+    CLANG|APPLECLANG)
       dnl All versions of clang support -fvisibility=
-      tmp_EXTERN="__attribute__ ((__visibility__ (\"default\")))"
+      tmp_EXTERN="__attribute__((__visibility__(\"default\")))"
       tmp_CFLAGS="-fvisibility=hidden"
       supports_symbol_hiding="yes"
       ;;
     GNU_C)
       dnl Only gcc 3.4 or later
       if test "$compiler_num" -ge "304"; then
-        if $CC --help --verbose 2>/dev/null | grep fvisibility= >/dev/null ; then
-          tmp_EXTERN="__attribute__ ((__visibility__ (\"default\")))"
+        if $CC --help --verbose 2>/dev/null | grep fvisibility= >/dev/null; then
+          tmp_EXTERN="__attribute__((__visibility__(\"default\")))"
           tmp_CFLAGS="-fvisibility=hidden"
           supports_symbol_hiding="yes"
         fi
@@ -1394,17 +1520,17 @@ AC_DEFUN([CURL_CHECK_COMPILER_SYMBOL_HIDING], [
     INTEL_UNIX_C)
       dnl Only icc 9.0 or later
       if test "$compiler_num" -ge "900"; then
-        if $CC --help --verbose 2>&1 | grep fvisibility= > /dev/null ; then
+        if $CC --help --verbose 2>&1 | grep fvisibility= > /dev/null; then
           tmp_save_CFLAGS="$CFLAGS"
           CFLAGS="$CFLAGS -fvisibility=hidden"
           AC_LINK_IFELSE([
             AC_LANG_PROGRAM([[
-#             include <stdio.h>
+              #include <stdio.h>
             ]],[[
               printf("icc fvisibility bug test");
             ]])
           ],[
-            tmp_EXTERN="__attribute__ ((__visibility__ (\"default\")))"
+            tmp_EXTERN="__attribute__((__visibility__(\"default\")))"
             tmp_CFLAGS="-fvisibility=hidden"
             supports_symbol_hiding="yes"
           ])
@@ -1413,7 +1539,7 @@ AC_DEFUN([CURL_CHECK_COMPILER_SYMBOL_HIDING], [
       fi
       ;;
     SUNPRO_C)
-      if $CC 2>&1 | grep flags >/dev/null && $CC -flags | grep xldscope= >/dev/null ; then
+      if $CC 2>&1 | grep flags >/dev/null && $CC -flags | grep xldscope= >/dev/null; then
         tmp_EXTERN="__global"
         tmp_CFLAGS="-xldscope=hidden"
         supports_symbol_hiding="yes"
@@ -1426,17 +1552,17 @@ AC_DEFUN([CURL_CHECK_COMPILER_SYMBOL_HIDING], [
     squeeze CFLAGS
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
-        $tmp_EXTERN char *dummy(char *buff);
-        char *dummy(char *buff)
+        $tmp_EXTERN const char *dummy(const char *buff);
+        const char *dummy(const char *buff)
         {
-         if(buff)
-           return ++buff;
-         else
-           return buff;
+          if(buff)
+            return ++buff;
+          else
+            return buff;
         }
       ]],[[
-        char b[16];
-        char *r = dummy(&b[0]);
+        const char *b = "example";
+        const char *r = dummy(&b[0]);
         if(r)
           return (int)*r;
       ]])
@@ -1475,11 +1601,11 @@ dnl code file, when the source code tries to redefine
 dnl a prototype which does not match previous one.
 
 AC_DEFUN([CURL_CHECK_COMPILER_PROTOTYPE_MISMATCH], [
-  AC_REQUIRE([CURL_CHECK_COMPILER_HALT_ON_ERROR])dnl
+  AC_REQUIRE([CURL_CHECK_COMPILER_HALT_ON_ERROR])
   AC_MSG_CHECKING([if compiler halts on function prototype mismatch])
   AC_COMPILE_IFELSE([
     AC_LANG_PROGRAM([[
-#     include <stdlib.h>
+      #include <stdlib.h>
       int rand(int n);
       int rand(int n)
       {
@@ -1489,7 +1615,7 @@ AC_DEFUN([CURL_CHECK_COMPILER_PROTOTYPE_MISMATCH], [
           return n;
       }
     ]],[[
-      int i[2]={0,0};
+      int i[2] ={ 0, 0 };
       int j = rand(i[0]);
       if(j)
         return j;
@@ -1547,7 +1673,7 @@ dnl as whitespace separated lists of words. Each word
 dnl from VALUE is removed from VARNAME when present.
 
 AC_DEFUN([CURL_VAR_STRIP], [
-  AC_REQUIRE([CURL_SHFUNC_SQUEEZE])dnl
+  AC_REQUIRE([CURL_SHFUNC_SQUEEZE])
   ac_var_stripped=""
   for word1 in $[$1]; do
     ac_var_strip_word="no"
@@ -1573,7 +1699,7 @@ dnl Add each compiler warning from NEW-WARNINGS that has not
 dnl been disabled via CFLAGS to WARNING-LIST.
 
 AC_DEFUN([CURL_ADD_COMPILER_WARNINGS], [
-  AC_REQUIRE([CURL_SHFUNC_SQUEEZE])dnl
+  AC_REQUIRE([CURL_SHFUNC_SQUEEZE])
   ac_var_added_warnings=""
   for warning in [$2]; do
     CURL_VAR_MATCH(CFLAGS, [-Wno-$warning -W$warning])
diff --git a/third-party/curl/m4/curl-confopts.m4 b/third-party/curl/m4/curl-confopts.m4
index 37f7d4c2e6..d3e1a33b6b 100644
--- a/third-party/curl/m4/curl-confopts.m4
+++ b/third-party/curl/m4/curl-confopts.m4
@@ -22,14 +22,14 @@
 #
 #***************************************************************************
 
-# File version for 'aclocal' use. Keep it a single number.
-# serial 19
+dnl File version for 'aclocal' use. Keep it a single number.
+dnl serial 19
 
 dnl CURL_CHECK_OPTION_THREADED_RESOLVER
 dnl -------------------------------------------------
 dnl Verify if configure has been invoked with option
 dnl --enable-threaded-resolver or --disable-threaded-resolver, and
-dnl set shell variable want_thres as appropriate.
+dnl set shell variable want_threaded_resolver as appropriate.
 
 AC_DEFUN([CURL_CHECK_OPTION_THREADED_RESOLVER], [
   AC_MSG_CHECKING([whether to enable the threaded resolver])
@@ -41,14 +41,29 @@ AS_HELP_STRING([--disable-threaded-resolver],[Disable threaded resolver]),
   case "$OPT_THRES" in
     no)
       dnl --disable-threaded-resolver option used
-      want_thres="no"
+      want_threaded_resolver="no"
+      ;;
+    yes)
+      dnl --enable-threaded-resolver option used
+      want_threaded_resolver="yes"
       ;;
     *)
       dnl configure option not specified
-      want_thres="yes"
+      case $host_os in
+        msdos* | amiga*)
+          want_threaded_resolver="no"
+          ;;
+        *)
+          if test "$want_ares" = "yes"; then
+            want_threaded_resolver="no"
+          else
+            want_threaded_resolver="yes"
+          fi
+          ;;
+      esac
       ;;
   esac
-  AC_MSG_RESULT([$want_thres])
+  AC_MSG_RESULT([$want_threaded_resolver])
 ])
 
 dnl CURL_CHECK_OPTION_ARES
@@ -58,8 +73,7 @@ dnl --enable-ares or --disable-ares, and
 dnl set shell variable want_ares as appropriate.
 
 AC_DEFUN([CURL_CHECK_OPTION_ARES], [
-dnl   AC_BEFORE([$0],[CURL_CHECK_OPTION_THREADS])dnl
-  AC_BEFORE([$0],[CURL_CHECK_LIB_ARES])dnl
+  AC_BEFORE([$0],[CURL_CHECK_LIB_ARES])
   AC_MSG_CHECKING([whether to enable c-ares for DNS lookups])
   OPT_ARES="default"
   AC_ARG_ENABLE(ares,
@@ -78,7 +92,7 @@ AS_HELP_STRING([--disable-ares],[Disable c-ares for DNS lookups]),
     *)
       dnl --enable-ares option used
       want_ares="yes"
-      if test -n "$enableval" && test "$enableval" != "yes"; then
+      if test -n "$enableval" && test "x$enableval" != "xyes"; then
         want_ares_path="$enableval"
       fi
       ;;
@@ -87,59 +101,6 @@ AS_HELP_STRING([--disable-ares],[Disable c-ares for DNS lookups]),
 ])
 
 
-dnl CURL_CHECK_OPTION_CURLDEBUG
-dnl -------------------------------------------------
-dnl Verify if configure has been invoked with option
-dnl --enable-curldebug or --disable-curldebug, and set
-dnl shell variable want_curldebug value as appropriate.
-
-AC_DEFUN([CURL_CHECK_OPTION_CURLDEBUG], [
-  AC_BEFORE([$0],[CURL_CHECK_CURLDEBUG])dnl
-  AC_MSG_CHECKING([whether to enable curl debug memory tracking])
-  OPT_CURLDEBUG_BUILD="default"
-  AC_ARG_ENABLE(curldebug,
-AS_HELP_STRING([--enable-curldebug],[Enable curl debug memory tracking])
-AS_HELP_STRING([--disable-curldebug],[Disable curl debug memory tracking]),
-  OPT_CURLDEBUG_BUILD=$enableval)
-  case "$OPT_CURLDEBUG_BUILD" in
-    no)
-      dnl --disable-curldebug option used
-      want_curldebug="no"
-      AC_MSG_RESULT([no])
-      ;;
-    default)
-      dnl configure's curldebug option not specified. Initially we will
-      dnl handle this as a request to use the same setting as option
-      dnl --enable-debug. IOW, initially, for debug-enabled builds
-      dnl this will be handled as a request to enable curldebug if
-      dnl possible, and for debug-disabled builds this will be handled
-      dnl as a request to disable curldebug.
-      if test "$want_debug" = "yes"; then
-        AC_MSG_RESULT([(assumed) yes])
-        AC_DEFINE(CURLDEBUG, 1, [to enable curl debug memory tracking])
-      else
-        AC_MSG_RESULT([no])
-      fi
-      want_curldebug_assumed="yes"
-      want_curldebug="$want_debug"
-      ;;
-    *)
-      dnl --enable-curldebug option used.
-      dnl The use of this option value is a request to enable curl's
-      dnl debug memory tracking for the libcurl library. This can only
-      dnl be done when some requisites are simultaneously satisfied.
-      dnl Later on, these requisites are verified and if they are not
-      dnl fully satisfied the option will be ignored and act as if
-      dnl --disable-curldebug had been given setting shell variable
-      dnl want_curldebug to 'no'.
-      want_curldebug="yes"
-      AC_DEFINE(CURLDEBUG, 1, [to enable curl debug memory tracking])
-      AC_MSG_RESULT([yes])
-      ;;
-  esac
-])
-
-
 dnl CURL_CHECK_OPTION_DEBUG
 dnl -------------------------------------------------
 dnl Verify if configure has been invoked with option
@@ -147,9 +108,8 @@ dnl --enable-debug or --disable-debug, and set shell
 dnl variable want_debug value as appropriate.
 
 AC_DEFUN([CURL_CHECK_OPTION_DEBUG], [
-  AC_BEFORE([$0],[CURL_CHECK_OPTION_WARNINGS])dnl
-  AC_BEFORE([$0],[CURL_CHECK_OPTION_CURLDEBUG])dnl
-  AC_BEFORE([$0],[XC_CHECK_PROG_CC])dnl
+  AC_BEFORE([$0],[CURL_CHECK_OPTION_WARNINGS])
+  AC_BEFORE([$0],[XC_CHECK_PROG_CC])
   AC_MSG_CHECKING([whether to enable debug build options])
   OPT_DEBUG_BUILD="default"
   AC_ARG_ENABLE(debug,
@@ -168,7 +128,6 @@ AS_HELP_STRING([--disable-debug],[Disable debug build options]),
     *)
       dnl --enable-debug option used
       want_debug="yes"
-      AC_DEFINE(DEBUGBUILD, 1, [enable debug build options])
       ;;
   esac
   AC_MSG_RESULT([$want_debug])
@@ -181,8 +140,8 @@ dnl --enable-optimize or --disable-optimize, and set
 dnl shell variable want_optimize value as appropriate.
 
 AC_DEFUN([CURL_CHECK_OPTION_OPTIMIZE], [
-  AC_REQUIRE([CURL_CHECK_OPTION_DEBUG])dnl
-  AC_BEFORE([$0],[XC_CHECK_PROG_CC])dnl
+  AC_REQUIRE([CURL_CHECK_OPTION_DEBUG])
+  AC_BEFORE([$0],[XC_CHECK_PROG_CC])
   AC_MSG_CHECKING([whether to enable compiler optimizer])
   OPT_COMPILER_OPTIMIZE="default"
   AC_ARG_ENABLE(optimize,
@@ -191,25 +150,25 @@ AS_HELP_STRING([--disable-optimize],[Disable compiler optimizations]),
   OPT_COMPILER_OPTIMIZE=$enableval)
   case "$OPT_COMPILER_OPTIMIZE" in
     no)
-      dnl --disable-optimize option used. We will handle this as
-      dnl a request to disable compiler optimizations if possible.
-      dnl If the compiler is known CFLAGS and CPPFLAGS will be
-      dnl overridden, otherwise this can not be honored.
+      dnl --disable-optimize option used. We handle this as a request
+      dnl to disable compiler optimizations if possible. If the compiler
+      dnl is known CFLAGS and CPPFLAGS are overridden, otherwise this
+      dnl can not be honored.
       want_optimize="no"
       AC_MSG_RESULT([no])
       ;;
     default)
-      dnl configure's optimize option not specified. Initially we will
-      dnl handle this as a request contrary to configure's setting
-      dnl for --enable-debug. IOW, initially, for debug-enabled builds
-      dnl this will be handled as a request to disable optimizations if
-      dnl possible, and for debug-disabled builds this will be handled
-      dnl initially as a request to enable optimizations if possible.
-      dnl Finally, if the compiler is known and CFLAGS and CPPFLAGS do
-      dnl not have any optimizer flag the request will be honored, in
-      dnl any other case the request can not be honored.
+      dnl configure's optimize option not specified. Initially we handle
+      dnl this as a request contrary to configure's setting for
+      dnl --enable-debug. IOW, initially, for debug-enabled builds this
+      dnl is handled as a request to disable optimizations if possible,
+      dnl and for debug-disabled builds this is handled initially as
+      dnl a request to enable optimizations if possible. Finally, if the
+      dnl compiler is known and CFLAGS and CPPFLAGS do not have any
+      dnl optimizer flag the request is honored, in any other case the
+      dnl request can not be honored.
       dnl IOW, existing optimizer flags defined in CFLAGS or CPPFLAGS
-      dnl will always take precedence over any initial assumption.
+      dnl always take precedence over any initial assumption.
       if test "$want_debug" = "yes"; then
         want_optimize="assume_no"
         AC_MSG_RESULT([(assumed) no])
@@ -219,10 +178,10 @@ AS_HELP_STRING([--disable-optimize],[Disable compiler optimizations]),
       fi
       ;;
     *)
-      dnl --enable-optimize option used. We will handle this as
-      dnl a request to enable compiler optimizations if possible.
-      dnl If the compiler is known CFLAGS and CPPFLAGS will be
-      dnl overridden, otherwise this can not be honored.
+      dnl --enable-optimize option used. We handle this as a request
+      dnl to enable compiler optimizations if possible. If the compiler
+      dnl is known CFLAGS and CPPFLAGS are overridden, otherwise this
+      dnl can not be honored.
       want_optimize="yes"
       AC_MSG_RESULT([yes])
       ;;
@@ -237,7 +196,7 @@ dnl --enable-symbol-hiding or --disable-symbol-hiding,
 dnl setting shell variable want_symbol_hiding value.
 
 AC_DEFUN([CURL_CHECK_OPTION_SYMBOL_HIDING], [
-  AC_BEFORE([$0],[CURL_CHECK_COMPILER_SYMBOL_HIDING])dnl
+  AC_BEFORE([$0],[CURL_CHECK_COMPILER_SYMBOL_HIDING])
   AC_MSG_CHECKING([whether to enable hiding of library internal symbols])
   OPT_SYMBOL_HIDING="default"
   AC_ARG_ENABLE(symbol-hiding,
@@ -248,7 +207,7 @@ AS_HELP_STRING([--disable-symbol-hiding],[Disable hiding of library internal sym
     no)
       dnl --disable-symbol-hiding option used.
       dnl This is an indication to not attempt hiding of library internal
-      dnl symbols. Default symbol visibility will be used, which normally
+      dnl symbols. Default symbol visibility is used, which normally
       dnl exposes all library internal symbols.
       want_symbol_hiding="no"
       AC_MSG_RESULT([no])
@@ -270,53 +229,6 @@ AS_HELP_STRING([--disable-symbol-hiding],[Disable hiding of library internal sym
 ])
 
 
-dnl CURL_CHECK_OPTION_THREADS
-dnl -------------------------------------------------
-dnl Verify if configure has been invoked with option
-dnl --enable-threads or --disable-threads, and
-dnl set shell variable want_threads as appropriate.
-
-dnl AC_DEFUN([CURL_CHECK_OPTION_THREADS], [
-dnl   AC_BEFORE([$0],[CURL_CHECK_LIB_THREADS])dnl
-dnl   AC_MSG_CHECKING([whether to enable threads for DNS lookups])
-dnl   OPT_THREADS="default"
-dnl   AC_ARG_ENABLE(threads,
-dnl AS_HELP_STRING([--enable-threads@<:@=PATH@:>@],[Enable threads for DNS lookups])
-dnl AS_HELP_STRING([--disable-threads],[Disable threads for DNS lookups]),
-dnl   OPT_THREADS=$enableval)
-dnl   case "$OPT_THREADS" in
-dnl     no)
-dnl       dnl --disable-threads option used
-dnl       want_threads="no"
-dnl       AC_MSG_RESULT([no])
-dnl       ;;
-dnl     default)
-dnl       dnl configure option not specified
-dnl       want_threads="no"
-dnl       AC_MSG_RESULT([(assumed) no])
-dnl       ;;
-dnl     *)
-dnl       dnl --enable-threads option used
-dnl       want_threads="yes"
-dnl       want_threads_path="$enableval"
-dnl       AC_MSG_RESULT([yes])
-dnl       ;;
-dnl   esac
-dnl   #
-dnl   if test "$want_ares" = "assume_yes"; then
-dnl     if test "$want_threads" = "yes"; then
-dnl       AC_MSG_CHECKING([whether to ignore c-ares enabling assumed setting])
-dnl       AC_MSG_RESULT([yes])
-dnl       want_ares="no"
-dnl     else
-dnl       want_ares="yes"
-dnl     fi
-dnl   fi
-dnl   if test "$want_threads" = "yes" && test "$want_ares" = "yes"; then
-dnl     AC_MSG_ERROR([options --enable-ares and --enable-threads are mutually exclusive, at most one may be enabled.])
-dnl   fi
-dnl ])
-
 dnl CURL_CHECK_OPTION_RT
 dnl -------------------------------------------------
 dnl Verify if configure has been invoked with option
@@ -324,11 +236,11 @@ dnl --disable-rt and set shell variable dontwant_rt
 dnl as appropriate.
 
 AC_DEFUN([CURL_CHECK_OPTION_RT], [
-  AC_BEFORE([$0], [CURL_CHECK_LIB_THREADS])dnl
+  AC_BEFORE([$0], [CURL_CHECK_LIB_THREADS])
   AC_MSG_CHECKING([whether to disable dependency on -lrt])
   OPT_RT="default"
   AC_ARG_ENABLE(rt,
- AS_HELP_STRING([--disable-rt],[disable dependency on -lrt]),
+AS_HELP_STRING([--disable-rt],[disable dependency on -lrt]),
   OPT_RT=$enableval)
   case "$OPT_RT" in
     no)
@@ -356,9 +268,9 @@ dnl --enable-warnings or --disable-warnings, and set
 dnl shell variable want_warnings as appropriate.
 
 AC_DEFUN([CURL_CHECK_OPTION_WARNINGS], [
-  AC_REQUIRE([CURL_CHECK_OPTION_DEBUG])dnl
-  AC_BEFORE([$0],[CURL_CHECK_OPTION_WERROR])dnl
-  AC_BEFORE([$0],[XC_CHECK_PROG_CC])dnl
+  AC_REQUIRE([CURL_CHECK_OPTION_DEBUG])
+  AC_BEFORE([$0],[CURL_CHECK_OPTION_WERROR])
+  AC_BEFORE([$0],[XC_CHECK_PROG_CC])
   AC_MSG_CHECKING([whether to enable strict compiler warnings])
   OPT_COMPILER_WARNINGS="default"
   AC_ARG_ENABLE(warnings,
@@ -390,7 +302,7 @@ dnl --enable-werror or --disable-werror, and set
 dnl shell variable want_werror as appropriate.
 
 AC_DEFUN([CURL_CHECK_OPTION_WERROR], [
-  AC_BEFORE([$0],[CURL_CHECK_COMPILER])dnl
+  AC_BEFORE([$0],[CURL_CHECK_COMPILER])
   AC_MSG_CHECKING([whether to enable compiler warnings as errors])
   OPT_COMPILER_WERROR="default"
   AC_ARG_ENABLE(werror,
@@ -420,22 +332,22 @@ dnl -------------------------------------------------
 dnl Check for how to set a socket into non-blocking state.
 
 AC_DEFUN([CURL_CHECK_NONBLOCKING_SOCKET], [
-  AC_REQUIRE([CURL_CHECK_FUNC_FCNTL])dnl
-  AC_REQUIRE([CURL_CHECK_FUNC_IOCTLSOCKET])dnl
-  AC_REQUIRE([CURL_CHECK_FUNC_IOCTLSOCKET_CAMEL])dnl
-  #
+  AC_REQUIRE([CURL_CHECK_FUNC_FCNTL])
+  AC_REQUIRE([CURL_CHECK_FUNC_IOCTLSOCKET])
+  AC_REQUIRE([CURL_CHECK_FUNC_IOCTLSOCKET_CAMEL])
+
   tst_method="unknown"
 
   AC_MSG_CHECKING([how to set a socket into non-blocking mode])
-  if test "x$curl_cv_func_fcntl_o_nonblock" = "xyes"; then
+  if test "$curl_cv_func_fcntl_o_nonblock" = "yes"; then
     tst_method="fcntl O_NONBLOCK"
-  elif test "x$curl_cv_func_ioctl_fionbio" = "xyes"; then
+  elif test "$curl_cv_func_ioctl_fionbio" = "yes"; then
     tst_method="ioctl FIONBIO"
-  elif test "x$curl_cv_func_ioctlsocket_fionbio" = "xyes"; then
+  elif test "$curl_cv_func_ioctlsocket_fionbio" = "yes"; then
     tst_method="ioctlsocket FIONBIO"
-  elif test "x$curl_cv_func_ioctlsocket_camel_fionbio" = "xyes"; then
+  elif test "$curl_cv_func_ioctlsocket_camel_fionbio" = "yes"; then
     tst_method="IoctlSocket FIONBIO"
-  elif test "x$curl_cv_func_setsockopt_so_nonblock" = "xyes"; then
+  elif test "$curl_cv_func_setsockopt_so_nonblock" = "yes"; then
     tst_method="setsockopt SO_NONBLOCK"
   fi
   AC_MSG_RESULT([$tst_method])
@@ -449,13 +361,13 @@ dnl CURL_CONFIGURE_SYMBOL_HIDING
 dnl -------------------------------------------------
 dnl Depending on --enable-symbol-hiding or --disable-symbol-hiding
 dnl configure option, and compiler capability to actually honor such
-dnl option, this will modify compiler flags as appropriate and also
-dnl provide needed definitions for configuration and Makefile.am files.
+dnl option, this modifies compiler flags as appropriate and also
+dnl provides needed definitions for configuration and Makefile.am files.
 dnl This macro should not be used until all compilation tests have
 dnl been done to prevent interferences on other tests.
 
 AC_DEFUN([CURL_CONFIGURE_SYMBOL_HIDING], [
-  AC_MSG_CHECKING([whether hiding of library internal symbols will actually happen])
+  AC_MSG_CHECKING([whether hiding of library internal symbols does actually happen])
   CFLAG_CURL_SYMBOL_HIDING=""
   doing_symbol_hiding="no"
   if test "$want_symbol_hiding" = "yes" &&
@@ -468,7 +380,7 @@ AC_DEFUN([CURL_CONFIGURE_SYMBOL_HIDING], [
   else
     AC_MSG_RESULT([no])
   fi
-  AM_CONDITIONAL(DOING_CURL_SYMBOL_HIDING, test x$doing_symbol_hiding = xyes)
+  AM_CONDITIONAL(DOING_CURL_SYMBOL_HIDING, test "$doing_symbol_hiding" = "yes")
   AC_SUBST(CFLAG_CURL_SYMBOL_HIDING)
 ])
 
@@ -479,18 +391,19 @@ dnl When c-ares library support has been requested, performs necessary checks
 dnl and adjustments needed to enable support of this library.
 
 AC_DEFUN([CURL_CHECK_LIB_ARES], [
-  #
+
   if test "$want_ares" = "yes"; then
     dnl c-ares library support has been requested
     clean_CPPFLAGS="$CPPFLAGS"
     clean_LDFLAGS="$LDFLAGS"
+    clean_LDFLAGSPC="$LDFLAGSPC"
     clean_LIBS="$LIBS"
     configure_runpath=`pwd`
     if test -n "$want_ares_path"; then
       dnl c-ares library path has been specified
       ARES_PCDIR="$want_ares_path/lib/pkgconfig"
       CURL_CHECK_PKGCONFIG(libcares, [$ARES_PCDIR])
-      if test "$PKGCONFIG" != "no" ; then
+      if test "$PKGCONFIG" != "no"; then
         ares_LIBS=`CURL_EXPORT_PCDIR([$ARES_PCDIR])
           $PKGCONFIG --libs-only-l libcares`
         ares_LDFLAGS=`CURL_EXPORT_PCDIR([$ARES_PCDIR])
@@ -509,7 +422,7 @@ AC_DEFUN([CURL_CHECK_LIB_ARES], [
     else
       dnl c-ares path not specified, use defaults
       CURL_CHECK_PKGCONFIG(libcares)
-      if test "$PKGCONFIG" != "no" ; then
+      if test "$PKGCONFIG" != "no"; then
         ares_LIBS=`$PKGCONFIG --libs-only-l libcares`
         ares_LDFLAGS=`$PKGCONFIG --libs-only-L libcares`
         ares_CPPFLAGS=`$PKGCONFIG --cflags-only-I libcares`
@@ -522,115 +435,71 @@ AC_DEFUN([CURL_CHECK_LIB_ARES], [
         ares_LIBS="-lcares"
       fi
     fi
-    #
+
     CPPFLAGS="$clean_CPPFLAGS $ares_CPPFLAGS"
     LDFLAGS="$clean_LDFLAGS $ares_LDFLAGS"
+    LDFLAGSPC="$clean_LDFLAGSPC $ares_LDFLAGS"
     LIBS="$ares_LIBS $clean_LIBS"
-    #
 
-    dnl check if c-ares new enough
-    AC_MSG_CHECKING([that c-ares is good and recent enough])
-    AC_LINK_IFELSE([
-      AC_LANG_PROGRAM([[
-#include <ares.h>
-        /* set of dummy functions in case c-ares was built with debug */
-        void curl_dofree() { }
-        void curl_sclose() { }
-        void curl_domalloc() { }
-        void curl_docalloc() { }
-        void curl_socket() { }
-      ]],[[
-        ares_channel channel;
-        ares_cancel(channel); /* added in 1.2.0 */
-        ares_process_fd(channel, 0, 0); /* added in 1.4.0 */
-        ares_dup(&channel, channel); /* added in 1.6.0 */
-      ]])
+    dnl check if c-ares new enough, 1.16.0 or newer
+    AC_CHECK_FUNC([ares_getaddrinfo],
+    [
     ],[
-      AC_MSG_RESULT([yes])
-    ],[
-      AC_MSG_RESULT([no])
-      AC_MSG_ERROR([c-ares library defective or too old])
+      AC_MSG_ERROR([c-ares library is defective or too old])
       dnl restore initial settings
       CPPFLAGS="$clean_CPPFLAGS"
       LDFLAGS="$clean_LDFLAGS"
+      LDFLAGSPC="$clean_LDFLAGSPC"
       LIBS="$clean_LIBS"
-      # prevent usage
+      dnl prevent usage
       want_ares="no"
     ])
 
     if test "$want_ares" = "yes"; then
-      dnl finally c-ares will be used
+      dnl finally c-ares is used
       AC_DEFINE(USE_ARES, 1, [Define to enable c-ares support])
-      AC_SUBST([USE_ARES], [1])
+      USE_ARES=1
+      LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE libcares"
       curl_res_msg="c-ares"
     fi
   fi
 ])
 
+dnl CURL_CHECK_OPTION_HTTPSRR
+dnl -----------------------------------------------------
+dnl Verify whether configure has been invoked with option
+dnl --enable-httpsrr or --disable-httpsrr, and set
+dnl shell variable want_httpsrr as appropriate.
 
-dnl CURL_CHECK_OPTION_NTLM_WB
-dnl -------------------------------------------------
-dnl Verify if configure has been invoked with option
-dnl --enable-ntlm-wb or --disable-ntlm-wb, and set
-dnl shell variable want_ntlm_wb and want_ntlm_wb_file
-dnl as appropriate.
-
-AC_DEFUN([CURL_CHECK_OPTION_NTLM_WB], [
-  AC_BEFORE([$0],[CURL_CHECK_NTLM_WB])dnl
-  OPT_NTLM_WB="default"
-  AC_ARG_ENABLE(ntlm-wb,
-AS_HELP_STRING([--enable-ntlm-wb@<:@=FILE@:>@],[Enable NTLM delegation to winbind's ntlm_auth helper, where FILE is ntlm_auth's absolute filename (default: /usr/bin/ntlm_auth)])
-AS_HELP_STRING([--disable-ntlm-wb],[Disable NTLM delegation to winbind's ntlm_auth helper]),
-  OPT_NTLM_WB=$enableval)
-  want_ntlm_wb_file="/usr/bin/ntlm_auth"
-  case "$OPT_NTLM_WB" in
+AC_DEFUN([CURL_CHECK_OPTION_HTTPSRR], [
+  AC_MSG_CHECKING([whether to enable HTTPSRR support])
+  OPT_HTTPSRR="default"
+  AC_ARG_ENABLE(httpsrr,
+AS_HELP_STRING([--enable-httpsrr],[Enable HTTPSRR support (experimental)])
+AS_HELP_STRING([--disable-httpsrr],[Disable HTTPSRR support (experimental)]),
+  OPT_HTTPSRR=$enableval)
+  case "$OPT_HTTPSRR" in
     no)
-      dnl --disable-ntlm-wb option used
-      want_ntlm_wb="no"
+      dnl --disable-httpsrr option used
+      want_httpsrr="no"
+      curl_httpsrr_msg="no      (--enable-httpsrr)"
+      AC_MSG_RESULT([no])
       ;;
     default)
       dnl configure option not specified
-      want_ntlm_wb="yes"
+      want_httpsrr="no"
+      curl_httpsrr_msg="no      (--enable-httpsrr)"
+      AC_MSG_RESULT([no])
       ;;
     *)
-      dnl --enable-ntlm-wb option used
-      want_ntlm_wb="yes"
-      if test -n "$enableval" && test "$enableval" != "yes"; then
-        want_ntlm_wb_file="$enableval"
-      fi
+      dnl --enable-httpsrr option used
+      want_httpsrr="yes"
+      curl_httpsrr_msg="enabled"
+      AC_MSG_RESULT([yes])
       ;;
   esac
 ])
 
-
-dnl CURL_CHECK_NTLM_WB
-dnl -------------------------------------------------
-dnl Check if support for NTLM delegation to winbind's
-dnl ntlm_auth helper will finally be enabled depending
-dnl on given configure options and target platform.
-
-AC_DEFUN([CURL_CHECK_NTLM_WB], [
-  AC_REQUIRE([CURL_CHECK_OPTION_NTLM_WB])dnl
-  AC_REQUIRE([CURL_CHECK_NATIVE_WINDOWS])dnl
-  AC_MSG_CHECKING([whether to enable NTLM delegation to winbind's helper])
-  if test "$curl_cv_native_windows" = "yes" ||
-    test "x$SSL_ENABLED" = "x"; then
-    want_ntlm_wb_file=""
-    want_ntlm_wb="no"
-  elif test "x$ac_cv_func_fork" != "xyes"; then
-    dnl ntlm_wb requires fork
-    want_ntlm_wb="no"
-  fi
-  AC_MSG_RESULT([$want_ntlm_wb])
-  if test "$want_ntlm_wb" = "yes"; then
-    AC_DEFINE(NTLM_WB_ENABLED, 1,
-      [Define to enable NTLM delegation to winbind's ntlm_auth helper.])
-    AC_DEFINE_UNQUOTED(NTLM_WB_FILE, "$want_ntlm_wb_file",
-      [Define absolute filename for winbind's ntlm_auth helper.])
-    NTLM_WB_ENABLED=1
-  fi
-])
-
 dnl CURL_CHECK_OPTION_ECH
 dnl -----------------------------------------------------
 dnl Verify whether configure has been invoked with option
@@ -641,8 +510,8 @@ AC_DEFUN([CURL_CHECK_OPTION_ECH], [
   AC_MSG_CHECKING([whether to enable ECH support])
   OPT_ECH="default"
   AC_ARG_ENABLE(ech,
-AS_HELP_STRING([--enable-ech],[Enable ECH support])
-AS_HELP_STRING([--disable-ech],[Disable ECH support]),
+AS_HELP_STRING([--enable-ech],[Enable ECH support (experimental)])
+AS_HELP_STRING([--disable-ech],[Disable ECH support (experimental)]),
   OPT_ECH=$enableval)
   case "$OPT_ECH" in
     no)
@@ -661,8 +530,46 @@ AS_HELP_STRING([--disable-ech],[Disable ECH support]),
       dnl --enable-ech option used
       want_ech="yes"
       curl_ech_msg="enabled (--disable-ech)"
-      experimental="ech"
       AC_MSG_RESULT([yes])
       ;;
   esac
 ])
+])
+
+dnl CURL_CHECK_OPTION_SSLS_EXPORT
+dnl -----------------------------------------------------
+dnl Verify whether configure has been invoked with option
+dnl --enable-ssl-session-export or --disable-ssl-session-export, and set
+dnl shell variable want_ech as appropriate.
+
+AC_DEFUN([CURL_CHECK_OPTION_SSLS_EXPORT], [
+  AC_MSG_CHECKING([whether to enable SSL session export support])
+  OPT_SSLS_EXPORT="default"
+  AC_ARG_ENABLE(ssls-export,
+AS_HELP_STRING([--enable-ssls-export],
+               [Enable SSL session export support (experimental)])
+AS_HELP_STRING([--disable-ssls-export],
+               [Disable SSL session export support (experimental)]),
+  OPT_SSLS_EXPORT=$enableval)
+  case "$OPT_SSLS_EXPORT" in
+    no)
+      dnl --disable-ssls-export option used
+      want_ssls_export="no"
+      curl_ssls_export_msg="no      (--enable-ssls-export)"
+      AC_MSG_RESULT([no])
+      ;;
+    default)
+      dnl configure option not specified
+      want_ssls_export="no"
+      curl_ssls_export_msg="no      (--enable-ssls-export)"
+      AC_MSG_RESULT([no])
+      ;;
+    *)
+      dnl --enable-ssls-export option used
+      want_ssls_export="yes"
+      curl_ssls_export_msg="enabled (--disable-ssls-export)"
+      AC_MSG_RESULT([yes])
+      ;;
+  esac
+])
+])
diff --git a/third-party/curl/m4/curl-functions.m4 b/third-party/curl/m4/curl-functions.m4
index bd2ebbd019..3a27377016 100644
--- a/third-party/curl/m4/curl-functions.m4
+++ b/third-party/curl/m4/curl-functions.m4
@@ -22,9 +22,8 @@
 #
 #***************************************************************************
 
-# File version for 'aclocal' use. Keep it a single number.
-# serial 73
-
+dnl File version for 'aclocal' use. Keep it a single number.
+dnl serial 73
 
 dnl CURL_INCLUDES_ARPA_INET
 dnl -------------------------------------------------
@@ -37,22 +36,21 @@ curl_includes_arpa_inet="\
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
-#ifdef HAVE_SYS_SOCKET_H
-#  include <sys/socket.h>
-#endif
 #ifdef HAVE_NETINET_IN_H
 #  include <netinet/in.h>
 #endif
 #ifdef HAVE_ARPA_INET_H
 #  include <arpa/inet.h>
 #endif
-#ifdef HAVE_WINSOCK2_H
+#ifdef _WIN32
 #include <winsock2.h>
 #include <ws2tcpip.h>
+#else
+#include <sys/socket.h>
 #endif
 /* includes end */"
   AC_CHECK_HEADERS(
-    sys/types.h sys/socket.h netinet/in.h arpa/inet.h,
+    sys/types.h netinet/in.h arpa/inet.h,
     [], [], [$curl_includes_arpa_inet])
 ])
 
@@ -92,7 +90,7 @@ curl_includes_ifaddrs="\
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
-#ifdef HAVE_SYS_SOCKET_H
+#ifndef _WIN32
 #  include <sys/socket.h>
 #endif
 #ifdef HAVE_NETINET_IN_H
@@ -103,40 +101,11 @@ curl_includes_ifaddrs="\
 #endif
 /* includes end */"
   AC_CHECK_HEADERS(
-    sys/types.h sys/socket.h netinet/in.h ifaddrs.h,
+    sys/types.h netinet/in.h ifaddrs.h,
     [], [], [$curl_includes_ifaddrs])
 ])
 
 
-dnl CURL_INCLUDES_INTTYPES
-dnl -------------------------------------------------
-dnl Set up variable with list of headers that must be
-dnl included when inttypes.h is to be included.
-
-AC_DEFUN([CURL_INCLUDES_INTTYPES], [
-curl_includes_inttypes="\
-/* includes start */
-#ifdef HAVE_SYS_TYPES_H
-# include <sys/types.h>
-#endif
-#ifdef HAVE_STDINT_H
-# include <stdint.h>
-#endif
-#ifdef HAVE_INTTYPES_H
-# include <inttypes.h>
-#endif
-/* includes end */"
-  case $host_os in
-    irix*)
-      ac_cv_header_stdint_h="no"
-      ;;
-  esac
-  AC_CHECK_HEADERS(
-    sys/types.h stdint.h inttypes.h,
-    [], [], [$curl_includes_inttypes])
-])
-
-
 dnl CURL_INCLUDES_LIBGEN
 dnl -------------------------------------------------
 dnl Set up variable with list of headers that must be
@@ -179,30 +148,6 @@ curl_includes_netdb="\
 ])
 
 
-dnl CURL_INCLUDES_POLL
-dnl -------------------------------------------------
-dnl Set up variable with list of headers that must be
-dnl included when poll.h is to be included.
-
-AC_DEFUN([CURL_INCLUDES_POLL], [
-curl_includes_poll="\
-/* includes start */
-#ifdef HAVE_SYS_TYPES_H
-#  include <sys/types.h>
-#endif
-#ifdef HAVE_POLL_H
-#  include <poll.h>
-#endif
-#ifdef HAVE_SYS_POLL_H
-#  include <sys/poll.h>
-#endif
-/* includes end */"
-  AC_CHECK_HEADERS(
-    sys/types.h poll.h sys/poll.h,
-    [], [], [$curl_includes_poll])
-])
-
-
 dnl CURL_INCLUDES_SETJMP
 dnl -------------------------------------------------
 dnl Set up variable with list of headers that must be
@@ -214,12 +159,10 @@ curl_includes_setjmp="\
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
-#ifdef HAVE_SETJMP_H
-#  include <setjmp.h>
-#endif
+#include <setjmp.h>
 /* includes end */"
   AC_CHECK_HEADERS(
-    sys/types.h setjmp.h,
+    sys/types.h,
     [], [], [$curl_includes_setjmp])
 ])
 
@@ -235,37 +178,14 @@ curl_includes_signal="\
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
-#ifdef HAVE_SIGNAL_H
-#  include <signal.h>
-#endif
+#include <signal.h>
 /* includes end */"
   AC_CHECK_HEADERS(
-    sys/types.h signal.h,
+    sys/types.h,
     [], [], [$curl_includes_signal])
 ])
 
 
-dnl CURL_INCLUDES_SOCKET
-dnl -------------------------------------------------
-dnl Set up variable with list of headers that must be
-dnl included when socket.h is to be included.
-
-AC_DEFUN([CURL_INCLUDES_SOCKET], [
-curl_includes_socket="\
-/* includes start */
-#ifdef HAVE_SYS_TYPES_H
-#  include <sys/types.h>
-#endif
-#ifdef HAVE_SOCKET_H
-#  include <socket.h>
-#endif
-/* includes end */"
-  AC_CHECK_HEADERS(
-    sys/types.h socket.h,
-    [], [], [$curl_includes_socket])
-])
-
-
 dnl CURL_INCLUDES_STDLIB
 dnl -------------------------------------------------
 dnl Set up variable with list of headers that must be
@@ -277,12 +197,10 @@ curl_includes_stdlib="\
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
-#ifdef HAVE_STDLIB_H
-#  include <stdlib.h>
-#endif
+#include <stdlib.h>
 /* includes end */"
   AC_CHECK_HEADERS(
-    sys/types.h stdlib.h,
+    sys/types.h,
     [], [], [$curl_includes_stdlib])
 ])
 
@@ -298,15 +216,13 @@ curl_includes_string="\
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
-#ifdef HAVE_STRING_H
-#  include <string.h>
-#endif
+#include <string.h>
 #ifdef HAVE_STRINGS_H
 #  include <strings.h>
 #endif
 /* includes end */"
   AC_CHECK_HEADERS(
-    sys/types.h string.h strings.h,
+    sys/types.h strings.h,
     [], [], [$curl_includes_string])
 ])
 
@@ -325,7 +241,7 @@ curl_includes_stropts="\
 #ifdef HAVE_UNISTD_H
 #  include <unistd.h>
 #endif
-#ifdef HAVE_SYS_SOCKET_H
+#ifndef _WIN32
 #  include <sys/socket.h>
 #endif
 #ifdef HAVE_SYS_IOCTL_H
@@ -336,7 +252,7 @@ curl_includes_stropts="\
 #endif
 /* includes end */"
   AC_CHECK_HEADERS(
-    sys/types.h unistd.h sys/socket.h sys/ioctl.h stropts.h,
+    sys/types.h unistd.h sys/ioctl.h stropts.h,
     [], [], [$curl_includes_stropts])
 ])
 
@@ -352,12 +268,12 @@ curl_includes_sys_socket="\
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
-#ifdef HAVE_SYS_SOCKET_H
+#ifndef _WIN32
 #  include <sys/socket.h>
 #endif
 /* includes end */"
   AC_CHECK_HEADERS(
-    sys/types.h sys/socket.h,
+    sys/types.h,
     [], [], [$curl_includes_sys_socket])
 ])
 
@@ -380,27 +296,6 @@ curl_includes_sys_types="\
 ])
 
 
-dnl CURL_INCLUDES_SYS_UIO
-dnl -------------------------------------------------
-dnl Set up variable with list of headers that must be
-dnl included when sys/uio.h is to be included.
-
-AC_DEFUN([CURL_INCLUDES_SYS_UIO], [
-curl_includes_sys_uio="\
-/* includes start */
-#ifdef HAVE_SYS_TYPES_H
-#  include <sys/types.h>
-#endif
-#ifdef HAVE_SYS_UIO_H
-#  include <sys/uio.h>
-#endif
-/* includes end */"
-  AC_CHECK_HEADERS(
-    sys/types.h sys/uio.h,
-    [], [], [$curl_includes_sys_uio])
-])
-
-
 dnl CURL_INCLUDES_SYS_XATTR
 dnl -------------------------------------------------
 dnl Set up variable with list of headers that must be
@@ -432,13 +327,13 @@ curl_includes_time="\
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
-#ifdef HAVE_SYS_TIME_H
+#if !defined(_WIN32) || defined(__MINGW32__)
 #  include <sys/time.h>
 #endif
 #include <time.h>
 /* includes end */"
   AC_CHECK_HEADERS(
-    sys/types.h sys/time.h,
+    sys/types.h,
     [], [], [$curl_includes_time])
 ])
 
@@ -472,18 +367,14 @@ dnl included when winsock2.h is to be included.
 AC_DEFUN([CURL_INCLUDES_WINSOCK2], [
 curl_includes_winsock2="\
 /* includes start */
-#ifdef HAVE_WINDOWS_H
+#ifdef _WIN32
 #  ifndef WIN32_LEAN_AND_MEAN
-#    define WIN32_LEAN_AND_MEAN
-#  endif
-#  include <windows.h>
-#  ifdef HAVE_WINSOCK2_H
-#    include <winsock2.h>
+#  define WIN32_LEAN_AND_MEAN
 #  endif
+#  include <winsock2.h>
 #endif
 /* includes end */"
-  CURL_CHECK_HEADER_WINDOWS
-  CURL_CHECK_HEADER_WINSOCK2
+  CURL_CHECK_NATIVE_WINDOWS
 ])
 
 
@@ -495,22 +386,15 @@ dnl included when ws2tcpip.h is to be included.
 AC_DEFUN([CURL_INCLUDES_WS2TCPIP], [
 curl_includes_ws2tcpip="\
 /* includes start */
-#ifdef HAVE_WINDOWS_H
+#ifdef _WIN32
 #  ifndef WIN32_LEAN_AND_MEAN
-#    define WIN32_LEAN_AND_MEAN
-#  endif
-#  include <windows.h>
-#  ifdef HAVE_WINSOCK2_H
-#    include <winsock2.h>
-#    ifdef HAVE_WS2TCPIP_H
-#       include <ws2tcpip.h>
-#    endif
+#  define WIN32_LEAN_AND_MEAN
 #  endif
+#  include <winsock2.h>
+#  include <ws2tcpip.h>
 #endif
 /* includes end */"
-  CURL_CHECK_HEADER_WINDOWS
-  CURL_CHECK_HEADER_WINSOCK2
-  CURL_CHECK_HEADER_WS2TCPIP
+  CURL_CHECK_NATIVE_WINDOWS
 ])
 
 
@@ -522,7 +406,7 @@ dnl included when bsdsocket.h is to be included.
 AC_DEFUN([CURL_INCLUDES_BSDSOCKET], [
 curl_includes_bsdsocket="\
 /* includes start */
-#if defined(HAVE_PROTO_BSDSOCKET_H)
+#ifdef HAVE_PROTO_BSDSOCKET_H
 #  define __NO_NET_API
 #  define __USE_INLINE__
 #  include <proto/bsdsocket.h>
@@ -534,7 +418,7 @@ struct SocketIFace *ISocket = NULL;
 #  else
 struct Library *SocketBase = NULL;
 #  endif
-#  define select(a,b,c,d,e) WaitSelect(a,b,c,d,e,0)
+#  define select(a, b, c, d, e)  WaitSelect(a, b, c, d, e, 0)
 #endif
 /* includes end */"
   AC_CHECK_HEADERS(
@@ -568,7 +452,7 @@ dnl defines function calling convention.
 AC_DEFUN([CURL_PREPROCESS_CALLCONV], [
 curl_preprocess_callconv="\
 /* preprocess start */
-#ifdef HAVE_WINDOWS_H
+#ifdef _WIN32
 #  define FUNCALLCONV __stdcall
 #else
 #  define FUNCALLCONV
@@ -583,16 +467,16 @@ dnl Verify if alarm is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_alarm, then
-dnl HAVE_ALARM will be defined.
+dnl HAVE_ALARM is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_ALARM], [
-  AC_REQUIRE([CURL_INCLUDES_UNISTD])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_UNISTD])
+
   tst_links_alarm="unknown"
   tst_proto_alarm="unknown"
   tst_compi_alarm="unknown"
   tst_allow_alarm="unknown"
-  #
+
   AC_MSG_CHECKING([if alarm can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([alarm])
@@ -603,7 +487,7 @@ AC_DEFUN([CURL_CHECK_FUNC_ALARM], [
     AC_MSG_RESULT([no])
     tst_links_alarm="no"
   ])
-  #
+
   if test "$tst_links_alarm" = "yes"; then
     AC_MSG_CHECKING([if alarm is prototyped])
     AC_EGREP_CPP([alarm],[
@@ -616,14 +500,14 @@ AC_DEFUN([CURL_CHECK_FUNC_ALARM], [
       tst_proto_alarm="no"
     ])
   fi
-  #
+
   if test "$tst_proto_alarm" = "yes"; then
     AC_MSG_CHECKING([if alarm is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_unistd
       ]],[[
-        if(0 != alarm(0))
+        if(alarm(0))
           return 1;
       ]])
     ],[
@@ -634,7 +518,7 @@ AC_DEFUN([CURL_CHECK_FUNC_ALARM], [
       tst_compi_alarm="no"
     ])
   fi
-  #
+
   if test "$tst_compi_alarm" = "yes"; then
     AC_MSG_CHECKING([if alarm usage allowed])
     if test "x$curl_disallow_alarm" != "xyes"; then
@@ -645,7 +529,7 @@ AC_DEFUN([CURL_CHECK_FUNC_ALARM], [
       tst_allow_alarm="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if alarm might be used])
   if test "$tst_links_alarm" = "yes" &&
      test "$tst_proto_alarm" = "yes" &&
@@ -668,18 +552,18 @@ dnl Verify if basename is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_basename, then
-dnl HAVE_BASENAME will be defined.
+dnl HAVE_BASENAME is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_BASENAME], [
-  AC_REQUIRE([CURL_INCLUDES_STRING])dnl
-  AC_REQUIRE([CURL_INCLUDES_LIBGEN])dnl
-  AC_REQUIRE([CURL_INCLUDES_UNISTD])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_STRING])
+  AC_REQUIRE([CURL_INCLUDES_LIBGEN])
+  AC_REQUIRE([CURL_INCLUDES_UNISTD])
+
   tst_links_basename="unknown"
   tst_proto_basename="unknown"
   tst_compi_basename="unknown"
   tst_allow_basename="unknown"
-  #
+
   AC_MSG_CHECKING([if basename can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([basename])
@@ -690,7 +574,7 @@ AC_DEFUN([CURL_CHECK_FUNC_BASENAME], [
     AC_MSG_RESULT([no])
     tst_links_basename="no"
   ])
-  #
+
   if test "$tst_links_basename" = "yes"; then
     AC_MSG_CHECKING([if basename is prototyped])
     AC_EGREP_CPP([basename],[
@@ -705,7 +589,7 @@ AC_DEFUN([CURL_CHECK_FUNC_BASENAME], [
       tst_proto_basename="no"
     ])
   fi
-  #
+
   if test "$tst_proto_basename" = "yes"; then
     AC_MSG_CHECKING([if basename is compilable])
     AC_COMPILE_IFELSE([
@@ -714,7 +598,7 @@ AC_DEFUN([CURL_CHECK_FUNC_BASENAME], [
         $curl_includes_libgen
         $curl_includes_unistd
       ]],[[
-        if(0 != basename(0))
+        if(basename(0))
           return 1;
       ]])
     ],[
@@ -725,7 +609,7 @@ AC_DEFUN([CURL_CHECK_FUNC_BASENAME], [
       tst_compi_basename="no"
     ])
   fi
-  #
+
   if test "$tst_compi_basename" = "yes"; then
     AC_MSG_CHECKING([if basename usage allowed])
     if test "x$curl_disallow_basename" != "xyes"; then
@@ -736,7 +620,7 @@ AC_DEFUN([CURL_CHECK_FUNC_BASENAME], [
       tst_allow_basename="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if basename might be used])
   if test "$tst_links_basename" = "yes" &&
      test "$tst_proto_basename" = "yes" &&
@@ -759,24 +643,22 @@ dnl Verify if closesocket is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_closesocket, then
-dnl HAVE_CLOSESOCKET will be defined.
+dnl HAVE_CLOSESOCKET is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_CLOSESOCKET], [
-  AC_REQUIRE([CURL_INCLUDES_WINSOCK2])dnl
-  AC_REQUIRE([CURL_INCLUDES_SOCKET])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_WINSOCK2])
+
   tst_links_closesocket="unknown"
   tst_proto_closesocket="unknown"
   tst_compi_closesocket="unknown"
   tst_allow_closesocket="unknown"
-  #
+
   AC_MSG_CHECKING([if closesocket can be linked])
   AC_LINK_IFELSE([
     AC_LANG_PROGRAM([[
       $curl_includes_winsock2
-      $curl_includes_socket
     ]],[[
-      if(0 != closesocket(0))
+      if(closesocket(0))
         return 1;
     ]])
   ],[
@@ -786,12 +668,11 @@ AC_DEFUN([CURL_CHECK_FUNC_CLOSESOCKET], [
     AC_MSG_RESULT([no])
     tst_links_closesocket="no"
   ])
-  #
+
   if test "$tst_links_closesocket" = "yes"; then
     AC_MSG_CHECKING([if closesocket is prototyped])
     AC_EGREP_CPP([closesocket],[
       $curl_includes_winsock2
-      $curl_includes_socket
     ],[
       AC_MSG_RESULT([yes])
       tst_proto_closesocket="yes"
@@ -800,15 +681,14 @@ AC_DEFUN([CURL_CHECK_FUNC_CLOSESOCKET], [
       tst_proto_closesocket="no"
     ])
   fi
-  #
+
   if test "$tst_proto_closesocket" = "yes"; then
     AC_MSG_CHECKING([if closesocket is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_winsock2
-        $curl_includes_socket
       ]],[[
-        if(0 != closesocket(0))
+        if(closesocket(0))
           return 1;
       ]])
     ],[
@@ -819,7 +699,7 @@ AC_DEFUN([CURL_CHECK_FUNC_CLOSESOCKET], [
       tst_compi_closesocket="no"
     ])
   fi
-  #
+
   if test "$tst_compi_closesocket" = "yes"; then
     AC_MSG_CHECKING([if closesocket usage allowed])
     if test "x$curl_disallow_closesocket" != "xyes"; then
@@ -830,7 +710,7 @@ AC_DEFUN([CURL_CHECK_FUNC_CLOSESOCKET], [
       tst_allow_closesocket="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if closesocket might be used])
   if test "$tst_links_closesocket" = "yes" &&
      test "$tst_proto_closesocket" = "yes" &&
@@ -853,24 +733,23 @@ dnl Verify if CloseSocket is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_closesocket_camel,
-dnl then HAVE_CLOSESOCKET_CAMEL will be defined.
+dnl then HAVE_CLOSESOCKET_CAMEL is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_CLOSESOCKET_CAMEL], [
-  AC_REQUIRE([CURL_INCLUDES_SYS_SOCKET])dnl
-  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_SYS_SOCKET])
+  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])
+
   tst_links_closesocket_camel="unknown"
-  tst_proto_closesocket_camel="unknown"
   tst_compi_closesocket_camel="unknown"
   tst_allow_closesocket_camel="unknown"
-  #
+
   AC_MSG_CHECKING([if CloseSocket can be linked])
   AC_LINK_IFELSE([
     AC_LANG_PROGRAM([[
       $curl_includes_bsdsocket
       $curl_includes_sys_socket
     ]],[[
-      if(0 != CloseSocket(0))
+      if(CloseSocket(0))
         return 1;
     ]])
   ],[
@@ -880,29 +759,15 @@ AC_DEFUN([CURL_CHECK_FUNC_CLOSESOCKET_CAMEL], [
     AC_MSG_RESULT([no])
     tst_links_closesocket_camel="no"
   ])
-  #
+
   if test "$tst_links_closesocket_camel" = "yes"; then
-    AC_MSG_CHECKING([if CloseSocket is prototyped])
-    AC_EGREP_CPP([CloseSocket],[
-      $curl_includes_bsdsocket
-      $curl_includes_sys_socket
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_proto_closesocket_camel="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_proto_closesocket_camel="no"
-    ])
-  fi
-  #
-  if test "$tst_proto_closesocket_camel" = "yes"; then
     AC_MSG_CHECKING([if CloseSocket is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_bsdsocket
         $curl_includes_sys_socket
       ]],[[
-        if(0 != CloseSocket(0))
+        if(CloseSocket(0))
           return 1;
       ]])
     ],[
@@ -913,7 +778,7 @@ AC_DEFUN([CURL_CHECK_FUNC_CLOSESOCKET_CAMEL], [
       tst_compi_closesocket_camel="no"
     ])
   fi
-  #
+
   if test "$tst_compi_closesocket_camel" = "yes"; then
     AC_MSG_CHECKING([if CloseSocket usage allowed])
     if test "x$curl_disallow_closesocket_camel" != "xyes"; then
@@ -924,10 +789,9 @@ AC_DEFUN([CURL_CHECK_FUNC_CLOSESOCKET_CAMEL], [
       tst_allow_closesocket_camel="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if CloseSocket might be used])
   if test "$tst_links_closesocket_camel" = "yes" &&
-     test "$tst_proto_closesocket_camel" = "yes" &&
      test "$tst_compi_closesocket_camel" = "yes" &&
      test "$tst_allow_closesocket_camel" = "yes"; then
     AC_MSG_RESULT([yes])
@@ -940,125 +804,22 @@ AC_DEFUN([CURL_CHECK_FUNC_CLOSESOCKET_CAMEL], [
   fi
 ])
 
-
-dnl CURL_CHECK_FUNC_CONNECT
-dnl -------------------------------------------------
-dnl Verify if connect is available, prototyped, and
-dnl can be compiled. If all of these are true, and
-dnl usage has not been previously disallowed with
-dnl shell variable curl_disallow_connect, then
-dnl HAVE_CONNECT will be defined.
-
-AC_DEFUN([CURL_CHECK_FUNC_CONNECT], [
-  AC_REQUIRE([CURL_INCLUDES_WINSOCK2])dnl
-  AC_REQUIRE([CURL_INCLUDES_SYS_SOCKET])dnl
-  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])dnl
-  AC_REQUIRE([CURL_INCLUDES_SOCKET])dnl
-  #
-  tst_links_connect="unknown"
-  tst_proto_connect="unknown"
-  tst_compi_connect="unknown"
-  tst_allow_connect="unknown"
-  #
-  AC_MSG_CHECKING([if connect can be linked])
-  AC_LINK_IFELSE([
-    AC_LANG_PROGRAM([[
-      $curl_includes_winsock2
-      $curl_includes_bsdsocket
-      $curl_includes_sys_socket
-      $curl_includes_socket
-    ]],[[
-      if(0 != connect(0, 0, 0))
-        return 1;
-    ]])
-  ],[
-    AC_MSG_RESULT([yes])
-    tst_links_connect="yes"
-  ],[
-    AC_MSG_RESULT([no])
-    tst_links_connect="no"
-  ])
-  #
-  if test "$tst_links_connect" = "yes"; then
-    AC_MSG_CHECKING([if connect is prototyped])
-    AC_EGREP_CPP([connect],[
-      $curl_includes_winsock2
-      $curl_includes_bsdsocket
-      $curl_includes_sys_socket
-      $curl_includes_socket
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_proto_connect="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_proto_connect="no"
-    ])
-  fi
-  #
-  if test "$tst_proto_connect" = "yes"; then
-    AC_MSG_CHECKING([if connect is compilable])
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-        $curl_includes_winsock2
-        $curl_includes_bsdsocket
-        $curl_includes_sys_socket
-        $curl_includes_socket
-      ]],[[
-        if(0 != connect(0, 0, 0))
-          return 1;
-      ]])
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_compi_connect="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_compi_connect="no"
-    ])
-  fi
-  #
-  if test "$tst_compi_connect" = "yes"; then
-    AC_MSG_CHECKING([if connect usage allowed])
-    if test "x$curl_disallow_connect" != "xyes"; then
-      AC_MSG_RESULT([yes])
-      tst_allow_connect="yes"
-    else
-      AC_MSG_RESULT([no])
-      tst_allow_connect="no"
-    fi
-  fi
-  #
-  AC_MSG_CHECKING([if connect might be used])
-  if test "$tst_links_connect" = "yes" &&
-     test "$tst_proto_connect" = "yes" &&
-     test "$tst_compi_connect" = "yes" &&
-     test "$tst_allow_connect" = "yes"; then
-    AC_MSG_RESULT([yes])
-    AC_DEFINE_UNQUOTED(HAVE_CONNECT, 1,
-      [Define to 1 if you have the connect function.])
-    curl_cv_func_connect="yes"
-  else
-    AC_MSG_RESULT([no])
-    curl_cv_func_connect="no"
-  fi
-])
-
-
 dnl CURL_CHECK_FUNC_FCNTL
 dnl -------------------------------------------------
 dnl Verify if fcntl is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_fcntl, then
-dnl HAVE_FCNTL will be defined.
+dnl HAVE_FCNTL is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_FCNTL], [
-  AC_REQUIRE([CURL_INCLUDES_FCNTL])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_FCNTL])
+
   tst_links_fcntl="unknown"
   tst_proto_fcntl="unknown"
   tst_compi_fcntl="unknown"
   tst_allow_fcntl="unknown"
-  #
+
   AC_MSG_CHECKING([if fcntl can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([fcntl])
@@ -1069,7 +830,7 @@ AC_DEFUN([CURL_CHECK_FUNC_FCNTL], [
     AC_MSG_RESULT([no])
     tst_links_fcntl="no"
   ])
-  #
+
   if test "$tst_links_fcntl" = "yes"; then
     AC_MSG_CHECKING([if fcntl is prototyped])
     AC_EGREP_CPP([fcntl],[
@@ -1082,14 +843,14 @@ AC_DEFUN([CURL_CHECK_FUNC_FCNTL], [
       tst_proto_fcntl="no"
     ])
   fi
-  #
+
   if test "$tst_proto_fcntl" = "yes"; then
     AC_MSG_CHECKING([if fcntl is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_fcntl
       ]],[[
-        if(0 != fcntl(0, 0, 0))
+        if(fcntl(0, 0, 0))
           return 1;
       ]])
     ],[
@@ -1100,7 +861,7 @@ AC_DEFUN([CURL_CHECK_FUNC_FCNTL], [
       tst_compi_fcntl="no"
     ])
   fi
-  #
+
   if test "$tst_compi_fcntl" = "yes"; then
     AC_MSG_CHECKING([if fcntl usage allowed])
     if test "x$curl_disallow_fcntl" != "xyes"; then
@@ -1111,7 +872,7 @@ AC_DEFUN([CURL_CHECK_FUNC_FCNTL], [
       tst_allow_fcntl="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if fcntl might be used])
   if test "$tst_links_fcntl" = "yes" &&
      test "$tst_proto_fcntl" = "yes" &&
@@ -1134,20 +895,20 @@ dnl -------------------------------------------------
 dnl Verify if fcntl with status flag O_NONBLOCK is
 dnl available, can be compiled, and seems to work. If
 dnl all of these are true, then HAVE_FCNTL_O_NONBLOCK
-dnl will be defined.
+dnl is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_FCNTL_O_NONBLOCK], [
-  #
+
   tst_compi_fcntl_o_nonblock="unknown"
   tst_allow_fcntl_o_nonblock="unknown"
-  #
+
   case $host_os in
     sunos4* | aix3*)
       dnl O_NONBLOCK does not work on these platforms
       curl_disallow_fcntl_o_nonblock="yes"
       ;;
   esac
-  #
+
   if test "$curl_cv_func_fcntl" = "yes"; then
     AC_MSG_CHECKING([if fcntl O_NONBLOCK is compilable])
     AC_COMPILE_IFELSE([
@@ -1155,7 +916,7 @@ AC_DEFUN([CURL_CHECK_FUNC_FCNTL_O_NONBLOCK], [
         $curl_includes_fcntl
       ]],[[
         int flags = 0;
-        if(0 != fcntl(0, F_SETFL, flags | O_NONBLOCK))
+        if(fcntl(0, F_SETFL, flags | O_NONBLOCK))
           return 1;
       ]])
     ],[
@@ -1166,7 +927,7 @@ AC_DEFUN([CURL_CHECK_FUNC_FCNTL_O_NONBLOCK], [
       tst_compi_fcntl_o_nonblock="no"
     ])
   fi
-  #
+
   if test "$tst_compi_fcntl_o_nonblock" = "yes"; then
     AC_MSG_CHECKING([if fcntl O_NONBLOCK usage allowed])
     if test "x$curl_disallow_fcntl_o_nonblock" != "xyes"; then
@@ -1177,7 +938,7 @@ AC_DEFUN([CURL_CHECK_FUNC_FCNTL_O_NONBLOCK], [
       tst_allow_fcntl_o_nonblock="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if fcntl O_NONBLOCK might be used])
   if test "$tst_compi_fcntl_o_nonblock" = "yes" &&
      test "$tst_allow_fcntl_o_nonblock" = "yes"; then
@@ -1191,249 +952,6 @@ AC_DEFUN([CURL_CHECK_FUNC_FCNTL_O_NONBLOCK], [
   fi
 ])
 
-dnl CURL_CHECK_FUNC_FGETXATTR
-dnl -------------------------------------------------
-dnl Verify if fgetxattr is available, prototyped, and
-dnl can be compiled. If all of these are true, and
-dnl usage has not been previously disallowed with
-dnl shell variable curl_disallow_fgetxattr, then
-dnl HAVE_FGETXATTR will be defined.
-
-AC_DEFUN([CURL_CHECK_FUNC_FGETXATTR], [
-  AC_REQUIRE([CURL_INCLUDES_SYS_XATTR])dnl
-  #
-  tst_links_fgetxattr="unknown"
-  tst_proto_fgetxattr="unknown"
-  tst_compi_fgetxattr="unknown"
-  tst_allow_fgetxattr="unknown"
-  tst_nargs_fgetxattr="unknown"
-  #
-  AC_MSG_CHECKING([if fgetxattr can be linked])
-  AC_LINK_IFELSE([
-    AC_LANG_FUNC_LINK_TRY([fgetxattr])
-  ],[
-    AC_MSG_RESULT([yes])
-    tst_links_fgetxattr="yes"
-  ],[
-    AC_MSG_RESULT([no])
-    tst_links_fgetxattr="no"
-  ])
-  #
-  if test "$tst_links_fgetxattr" = "yes"; then
-    AC_MSG_CHECKING([if fgetxattr is prototyped])
-    AC_EGREP_CPP([fgetxattr],[
-      $curl_includes_sys_xattr
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_proto_fgetxattr="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_proto_fgetxattr="no"
-    ])
-  fi
-  #
-  if test "$tst_proto_fgetxattr" = "yes"; then
-    if test "$tst_nargs_fgetxattr" = "unknown"; then
-      AC_MSG_CHECKING([if fgetxattr takes 4 args.])
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-          $curl_includes_sys_xattr
-        ]],[[
-          if(0 != fgetxattr(0, 0, 0, 0))
-            return 1;
-        ]])
-      ],[
-        AC_MSG_RESULT([yes])
-        tst_compi_fgetxattr="yes"
-        tst_nargs_fgetxattr="4"
-      ],[
-        AC_MSG_RESULT([no])
-        tst_compi_fgetxattr="no"
-      ])
-    fi
-    if test "$tst_nargs_fgetxattr" = "unknown"; then
-      AC_MSG_CHECKING([if fgetxattr takes 6 args.])
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-          $curl_includes_sys_xattr
-        ]],[[
-          if(0 != fgetxattr(0, 0, 0, 0, 0, 0))
-            return 1;
-        ]])
-      ],[
-        AC_MSG_RESULT([yes])
-        tst_compi_fgetxattr="yes"
-        tst_nargs_fgetxattr="6"
-      ],[
-        AC_MSG_RESULT([no])
-        tst_compi_fgetxattr="no"
-      ])
-    fi
-    AC_MSG_CHECKING([if fgetxattr is compilable])
-    if test "$tst_compi_fgetxattr" = "yes"; then
-      AC_MSG_RESULT([yes])
-    else
-      AC_MSG_RESULT([no])
-    fi
-  fi
-  #
-  if test "$tst_compi_fgetxattr" = "yes"; then
-    AC_MSG_CHECKING([if fgetxattr usage allowed])
-    if test "x$curl_disallow_fgetxattr" != "xyes"; then
-      AC_MSG_RESULT([yes])
-      tst_allow_fgetxattr="yes"
-    else
-      AC_MSG_RESULT([no])
-      tst_allow_fgetxattr="no"
-    fi
-  fi
-  #
-  AC_MSG_CHECKING([if fgetxattr might be used])
-  if test "$tst_links_fgetxattr" = "yes" &&
-     test "$tst_proto_fgetxattr" = "yes" &&
-     test "$tst_compi_fgetxattr" = "yes" &&
-     test "$tst_allow_fgetxattr" = "yes"; then
-    AC_MSG_RESULT([yes])
-    AC_DEFINE_UNQUOTED(HAVE_FGETXATTR, 1,
-      [Define to 1 if you have the fgetxattr function.])
-    dnl AC_DEFINE_UNQUOTED(FGETXATTR_ARGS, $tst_nargs_fgetxattr,
-    dnl   [Specifies the number of arguments to fgetxattr])
-    #
-    if test "$tst_nargs_fgetxattr" -eq "4"; then
-      AC_DEFINE(HAVE_FGETXATTR_4, 1, [fgetxattr() takes 4 args])
-    elif test "$tst_nargs_fgetxattr" -eq "6"; then
-      AC_DEFINE(HAVE_FGETXATTR_6, 1, [fgetxattr() takes 6 args])
-    fi
-    #
-    curl_cv_func_fgetxattr="yes"
-  else
-    AC_MSG_RESULT([no])
-    curl_cv_func_fgetxattr="no"
-  fi
-])
-
-
-dnl CURL_CHECK_FUNC_FLISTXATTR
-dnl -------------------------------------------------
-dnl Verify if flistxattr is available, prototyped, and
-dnl can be compiled. If all of these are true, and
-dnl usage has not been previously disallowed with
-dnl shell variable curl_disallow_flistxattr, then
-dnl HAVE_FLISTXATTR will be defined.
-
-AC_DEFUN([CURL_CHECK_FUNC_FLISTXATTR], [
-  AC_REQUIRE([CURL_INCLUDES_SYS_XATTR])dnl
-  #
-  tst_links_flistxattr="unknown"
-  tst_proto_flistxattr="unknown"
-  tst_compi_flistxattr="unknown"
-  tst_allow_flistxattr="unknown"
-  tst_nargs_flistxattr="unknown"
-  #
-  AC_MSG_CHECKING([if flistxattr can be linked])
-  AC_LINK_IFELSE([
-    AC_LANG_FUNC_LINK_TRY([flistxattr])
-  ],[
-    AC_MSG_RESULT([yes])
-    tst_links_flistxattr="yes"
-  ],[
-    AC_MSG_RESULT([no])
-    tst_links_flistxattr="no"
-  ])
-  #
-  if test "$tst_links_flistxattr" = "yes"; then
-    AC_MSG_CHECKING([if flistxattr is prototyped])
-    AC_EGREP_CPP([flistxattr],[
-      $curl_includes_sys_xattr
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_proto_flistxattr="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_proto_flistxattr="no"
-    ])
-  fi
-  #
-  if test "$tst_proto_flistxattr" = "yes"; then
-    if test "$tst_nargs_flistxattr" = "unknown"; then
-      AC_MSG_CHECKING([if flistxattr takes 3 args.])
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-          $curl_includes_sys_xattr
-        ]],[[
-          if(0 != flistxattr(0, 0, 0))
-            return 1;
-        ]])
-      ],[
-        AC_MSG_RESULT([yes])
-        tst_compi_flistxattr="yes"
-        tst_nargs_flistxattr="3"
-      ],[
-        AC_MSG_RESULT([no])
-        tst_compi_flistxattr="no"
-      ])
-    fi
-    if test "$tst_nargs_flistxattr" = "unknown"; then
-      AC_MSG_CHECKING([if flistxattr takes 4 args.])
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-          $curl_includes_sys_xattr
-        ]],[[
-          if(0 != flistxattr(0, 0, 0, 0))
-            return 1;
-        ]])
-      ],[
-        AC_MSG_RESULT([yes])
-        tst_compi_flistxattr="yes"
-        tst_nargs_flistxattr="4"
-      ],[
-        AC_MSG_RESULT([no])
-        tst_compi_flistxattr="no"
-      ])
-    fi
-    AC_MSG_CHECKING([if flistxattr is compilable])
-    if test "$tst_compi_flistxattr" = "yes"; then
-      AC_MSG_RESULT([yes])
-    else
-      AC_MSG_RESULT([no])
-    fi
-  fi
-  #
-  if test "$tst_compi_flistxattr" = "yes"; then
-    AC_MSG_CHECKING([if flistxattr usage allowed])
-    if test "x$curl_disallow_flistxattr" != "xyes"; then
-      AC_MSG_RESULT([yes])
-      tst_allow_flistxattr="yes"
-    else
-      AC_MSG_RESULT([no])
-      tst_allow_flistxattr="no"
-    fi
-  fi
-  #
-  AC_MSG_CHECKING([if flistxattr might be used])
-  if test "$tst_links_flistxattr" = "yes" &&
-     test "$tst_proto_flistxattr" = "yes" &&
-     test "$tst_compi_flistxattr" = "yes" &&
-     test "$tst_allow_flistxattr" = "yes"; then
-    AC_MSG_RESULT([yes])
-    AC_DEFINE_UNQUOTED(HAVE_FLISTXATTR, 1,
-      [Define to 1 if you have the flistxattr function.])
-    dnl AC_DEFINE_UNQUOTED(FLISTXATTR_ARGS, $tst_nargs_flistxattr,
-    dnl   [Specifies the number of arguments to flistxattr])
-    #
-    if test "$tst_nargs_flistxattr" -eq "3"; then
-      AC_DEFINE(HAVE_FLISTXATTR_3, 1, [flistxattr() takes 3 args])
-    elif test "$tst_nargs_flistxattr" -eq "4"; then
-      AC_DEFINE(HAVE_FLISTXATTR_4, 1, [flistxattr() takes 4 args])
-    fi
-    #
-    curl_cv_func_flistxattr="yes"
-  else
-    AC_MSG_RESULT([no])
-    curl_cv_func_flistxattr="no"
-  fi
-])
-
 
 dnl CURL_CHECK_FUNC_FREEADDRINFO
 dnl -------------------------------------------------
@@ -1441,18 +959,18 @@ dnl Verify if freeaddrinfo is available, prototyped,
 dnl and can be compiled. If all of these are true,
 dnl and usage has not been previously disallowed with
 dnl shell variable curl_disallow_freeaddrinfo, then
-dnl HAVE_FREEADDRINFO will be defined.
+dnl HAVE_FREEADDRINFO is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_FREEADDRINFO], [
-  AC_REQUIRE([CURL_INCLUDES_WS2TCPIP])dnl
-  AC_REQUIRE([CURL_INCLUDES_SYS_SOCKET])dnl
-  AC_REQUIRE([CURL_INCLUDES_NETDB])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_WS2TCPIP])
+  AC_REQUIRE([CURL_INCLUDES_SYS_SOCKET])
+  AC_REQUIRE([CURL_INCLUDES_NETDB])
+
   tst_links_freeaddrinfo="unknown"
   tst_proto_freeaddrinfo="unknown"
   tst_compi_freeaddrinfo="unknown"
   tst_allow_freeaddrinfo="unknown"
-  #
+
   AC_MSG_CHECKING([if freeaddrinfo can be linked])
   AC_LINK_IFELSE([
     AC_LANG_PROGRAM([[
@@ -1469,7 +987,7 @@ AC_DEFUN([CURL_CHECK_FUNC_FREEADDRINFO], [
     AC_MSG_RESULT([no])
     tst_links_freeaddrinfo="no"
   ])
-  #
+
   if test "$tst_links_freeaddrinfo" = "yes"; then
     AC_MSG_CHECKING([if freeaddrinfo is prototyped])
     AC_EGREP_CPP([freeaddrinfo],[
@@ -1484,7 +1002,7 @@ AC_DEFUN([CURL_CHECK_FUNC_FREEADDRINFO], [
       tst_proto_freeaddrinfo="no"
     ])
   fi
-  #
+
   if test "$tst_proto_freeaddrinfo" = "yes"; then
     AC_MSG_CHECKING([if freeaddrinfo is compilable])
     AC_COMPILE_IFELSE([
@@ -1503,7 +1021,7 @@ AC_DEFUN([CURL_CHECK_FUNC_FREEADDRINFO], [
       tst_compi_freeaddrinfo="no"
     ])
   fi
-  #
+
   if test "$tst_compi_freeaddrinfo" = "yes"; then
     AC_MSG_CHECKING([if freeaddrinfo usage allowed])
     if test "x$curl_disallow_freeaddrinfo" != "xyes"; then
@@ -1514,7 +1032,7 @@ AC_DEFUN([CURL_CHECK_FUNC_FREEADDRINFO], [
       tst_allow_freeaddrinfo="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if freeaddrinfo might be used])
   if test "$tst_links_freeaddrinfo" = "yes" &&
      test "$tst_proto_freeaddrinfo" = "yes" &&
@@ -1531,145 +1049,23 @@ AC_DEFUN([CURL_CHECK_FUNC_FREEADDRINFO], [
 ])
 
 
-dnl CURL_CHECK_FUNC_FREMOVEXATTR
-dnl -------------------------------------------------
-dnl Verify if fremovexattr is available, prototyped, and
-dnl can be compiled. If all of these are true, and
-dnl usage has not been previously disallowed with
-dnl shell variable curl_disallow_fremovexattr, then
-dnl HAVE_FREMOVEXATTR will be defined.
-
-AC_DEFUN([CURL_CHECK_FUNC_FREMOVEXATTR], [
-  AC_REQUIRE([CURL_INCLUDES_SYS_XATTR])dnl
-  #
-  tst_links_fremovexattr="unknown"
-  tst_proto_fremovexattr="unknown"
-  tst_compi_fremovexattr="unknown"
-  tst_allow_fremovexattr="unknown"
-  tst_nargs_fremovexattr="unknown"
-  #
-  AC_MSG_CHECKING([if fremovexattr can be linked])
-  AC_LINK_IFELSE([
-    AC_LANG_FUNC_LINK_TRY([fremovexattr])
-  ],[
-    AC_MSG_RESULT([yes])
-    tst_links_fremovexattr="yes"
-  ],[
-    AC_MSG_RESULT([no])
-    tst_links_fremovexattr="no"
-  ])
-  #
-  if test "$tst_links_fremovexattr" = "yes"; then
-    AC_MSG_CHECKING([if fremovexattr is prototyped])
-    AC_EGREP_CPP([fremovexattr],[
-      $curl_includes_sys_xattr
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_proto_fremovexattr="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_proto_fremovexattr="no"
-    ])
-  fi
-  #
-  if test "$tst_proto_fremovexattr" = "yes"; then
-    if test "$tst_nargs_fremovexattr" = "unknown"; then
-      AC_MSG_CHECKING([if fremovexattr takes 2 args.])
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-          $curl_includes_sys_xattr
-        ]],[[
-          if(0 != fremovexattr(0, 0))
-            return 1;
-        ]])
-      ],[
-        AC_MSG_RESULT([yes])
-        tst_compi_fremovexattr="yes"
-        tst_nargs_fremovexattr="2"
-      ],[
-        AC_MSG_RESULT([no])
-        tst_compi_fremovexattr="no"
-      ])
-    fi
-    if test "$tst_nargs_fremovexattr" = "unknown"; then
-      AC_MSG_CHECKING([if fremovexattr takes 3 args.])
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-          $curl_includes_sys_xattr
-        ]],[[
-          if(0 != fremovexattr(0, 0, 0))
-            return 1;
-        ]])
-      ],[
-        AC_MSG_RESULT([yes])
-        tst_compi_fremovexattr="yes"
-        tst_nargs_fremovexattr="3"
-      ],[
-        AC_MSG_RESULT([no])
-        tst_compi_fremovexattr="no"
-      ])
-    fi
-    AC_MSG_CHECKING([if fremovexattr is compilable])
-    if test "$tst_compi_fremovexattr" = "yes"; then
-      AC_MSG_RESULT([yes])
-    else
-      AC_MSG_RESULT([no])
-    fi
-  fi
-  #
-  if test "$tst_compi_fremovexattr" = "yes"; then
-    AC_MSG_CHECKING([if fremovexattr usage allowed])
-    if test "x$curl_disallow_fremovexattr" != "xyes"; then
-      AC_MSG_RESULT([yes])
-      tst_allow_fremovexattr="yes"
-    else
-      AC_MSG_RESULT([no])
-      tst_allow_fremovexattr="no"
-    fi
-  fi
-  #
-  AC_MSG_CHECKING([if fremovexattr might be used])
-  if test "$tst_links_fremovexattr" = "yes" &&
-     test "$tst_proto_fremovexattr" = "yes" &&
-     test "$tst_compi_fremovexattr" = "yes" &&
-     test "$tst_allow_fremovexattr" = "yes"; then
-    AC_MSG_RESULT([yes])
-    AC_DEFINE_UNQUOTED(HAVE_FREMOVEXATTR, 1,
-      [Define to 1 if you have the fremovexattr function.])
-    dnl AC_DEFINE_UNQUOTED(FREMOVEXATTR_ARGS, $tst_nargs_fremovexattr,
-    dnl   [Specifies the number of arguments to fremovexattr])
-    #
-    if test "$tst_nargs_fremovexattr" -eq "2"; then
-      AC_DEFINE(HAVE_FREMOVEXATTR_2, 1, [fremovexattr() takes 2 args])
-    elif test "$tst_nargs_fremovexattr" -eq "3"; then
-      AC_DEFINE(HAVE_FREMOVEXATTR_3, 1, [fremovexattr() takes 3 args])
-    fi
-    #
-    curl_cv_func_fremovexattr="yes"
-  else
-    AC_MSG_RESULT([no])
-    curl_cv_func_fremovexattr="no"
-  fi
-])
-
-
 dnl CURL_CHECK_FUNC_FSETXATTR
 dnl -------------------------------------------------
 dnl Verify if fsetxattr is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_fsetxattr, then
-dnl HAVE_FSETXATTR will be defined.
+dnl HAVE_FSETXATTR is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_FSETXATTR], [
-  AC_REQUIRE([CURL_INCLUDES_SYS_XATTR])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_SYS_XATTR])
+
   tst_links_fsetxattr="unknown"
   tst_proto_fsetxattr="unknown"
   tst_compi_fsetxattr="unknown"
   tst_allow_fsetxattr="unknown"
   tst_nargs_fsetxattr="unknown"
-  #
+
   AC_MSG_CHECKING([if fsetxattr can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([fsetxattr])
@@ -1680,7 +1076,7 @@ AC_DEFUN([CURL_CHECK_FUNC_FSETXATTR], [
     AC_MSG_RESULT([no])
     tst_links_fsetxattr="no"
   ])
-  #
+
   if test "$tst_links_fsetxattr" = "yes"; then
     AC_MSG_CHECKING([if fsetxattr is prototyped])
     AC_EGREP_CPP([fsetxattr],[
@@ -1693,7 +1089,7 @@ AC_DEFUN([CURL_CHECK_FUNC_FSETXATTR], [
       tst_proto_fsetxattr="no"
     ])
   fi
-  #
+
   if test "$tst_proto_fsetxattr" = "yes"; then
     if test "$tst_nargs_fsetxattr" = "unknown"; then
       AC_MSG_CHECKING([if fsetxattr takes 5 args.])
@@ -1701,7 +1097,7 @@ AC_DEFUN([CURL_CHECK_FUNC_FSETXATTR], [
         AC_LANG_PROGRAM([[
           $curl_includes_sys_xattr
         ]],[[
-          if(0 != fsetxattr(0, 0, 0, 0, 0))
+          if(fsetxattr(0, "", 0, 0, 0))
             return 1;
         ]])
       ],[
@@ -1719,7 +1115,7 @@ AC_DEFUN([CURL_CHECK_FUNC_FSETXATTR], [
         AC_LANG_PROGRAM([[
           $curl_includes_sys_xattr
         ]],[[
-          if(0 != fsetxattr(0, 0, 0, 0, 0, 0))
+          if(fsetxattr(0, 0, 0, 0, 0, 0))
             return 1;
         ]])
       ],[
@@ -1738,7 +1134,7 @@ AC_DEFUN([CURL_CHECK_FUNC_FSETXATTR], [
       AC_MSG_RESULT([no])
     fi
   fi
-  #
+
   if test "$tst_compi_fsetxattr" = "yes"; then
     AC_MSG_CHECKING([if fsetxattr usage allowed])
     if test "x$curl_disallow_fsetxattr" != "xyes"; then
@@ -1749,7 +1145,7 @@ AC_DEFUN([CURL_CHECK_FUNC_FSETXATTR], [
       tst_allow_fsetxattr="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if fsetxattr might be used])
   if test "$tst_links_fsetxattr" = "yes" &&
      test "$tst_proto_fsetxattr" = "yes" &&
@@ -1760,13 +1156,13 @@ AC_DEFUN([CURL_CHECK_FUNC_FSETXATTR], [
       [Define to 1 if you have the fsetxattr function.])
     dnl AC_DEFINE_UNQUOTED(FSETXATTR_ARGS, $tst_nargs_fsetxattr,
     dnl   [Specifies the number of arguments to fsetxattr])
-    #
+
     if test "$tst_nargs_fsetxattr" -eq "5"; then
       AC_DEFINE(HAVE_FSETXATTR_5, 1, [fsetxattr() takes 5 args])
     elif test "$tst_nargs_fsetxattr" -eq "6"; then
       AC_DEFINE(HAVE_FSETXATTR_6, 1, [fsetxattr() takes 6 args])
     fi
-    #
+
     curl_cv_func_fsetxattr="yes"
   else
     AC_MSG_RESULT([no])
@@ -1775,117 +1171,32 @@ AC_DEFUN([CURL_CHECK_FUNC_FSETXATTR], [
 ])
 
 
-dnl CURL_CHECK_FUNC_FTRUNCATE
-dnl -------------------------------------------------
-dnl Verify if ftruncate is available, prototyped, and
-dnl can be compiled. If all of these are true, and
-dnl usage has not been previously disallowed with
-dnl shell variable curl_disallow_ftruncate, then
-dnl HAVE_FTRUNCATE will be defined.
-
-AC_DEFUN([CURL_CHECK_FUNC_FTRUNCATE], [
-  AC_REQUIRE([CURL_INCLUDES_UNISTD])dnl
-  #
-  tst_links_ftruncate="unknown"
-  tst_proto_ftruncate="unknown"
-  tst_compi_ftruncate="unknown"
-  tst_allow_ftruncate="unknown"
-  #
-  AC_MSG_CHECKING([if ftruncate can be linked])
-  AC_LINK_IFELSE([
-    AC_LANG_FUNC_LINK_TRY([ftruncate])
-  ],[
-    AC_MSG_RESULT([yes])
-    tst_links_ftruncate="yes"
-  ],[
-    AC_MSG_RESULT([no])
-    tst_links_ftruncate="no"
-  ])
-  #
-  if test "$tst_links_ftruncate" = "yes"; then
-    AC_MSG_CHECKING([if ftruncate is prototyped])
-    AC_EGREP_CPP([ftruncate],[
-      $curl_includes_unistd
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_proto_ftruncate="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_proto_ftruncate="no"
-    ])
-  fi
-  #
-  if test "$tst_proto_ftruncate" = "yes"; then
-    AC_MSG_CHECKING([if ftruncate is compilable])
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-        $curl_includes_unistd
-      ]],[[
-        if(0 != ftruncate(0, 0))
-          return 1;
-      ]])
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_compi_ftruncate="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_compi_ftruncate="no"
-    ])
-  fi
-  #
-  if test "$tst_compi_ftruncate" = "yes"; then
-    AC_MSG_CHECKING([if ftruncate usage allowed])
-    if test "x$curl_disallow_ftruncate" != "xyes"; then
-      AC_MSG_RESULT([yes])
-      tst_allow_ftruncate="yes"
-    else
-      AC_MSG_RESULT([no])
-      tst_allow_ftruncate="no"
-    fi
-  fi
-  #
-  AC_MSG_CHECKING([if ftruncate might be used])
-  if test "$tst_links_ftruncate" = "yes" &&
-     test "$tst_proto_ftruncate" = "yes" &&
-     test "$tst_compi_ftruncate" = "yes" &&
-     test "$tst_allow_ftruncate" = "yes"; then
-    AC_MSG_RESULT([yes])
-    AC_DEFINE_UNQUOTED(HAVE_FTRUNCATE, 1,
-      [Define to 1 if you have the ftruncate function.])
-    curl_cv_func_ftruncate="yes"
-  else
-    AC_MSG_RESULT([no])
-    curl_cv_func_ftruncate="no"
-  fi
-])
-
-
 dnl CURL_CHECK_FUNC_GETADDRINFO
 dnl -------------------------------------------------
 dnl Verify if getaddrinfo is available, prototyped, can
 dnl be compiled and seems to work. If all of these are
 dnl true, and usage has not been previously disallowed
 dnl with shell variable curl_disallow_getaddrinfo, then
-dnl HAVE_GETADDRINFO will be defined. Additionally when
-dnl HAVE_GETADDRINFO gets defined this will also attempt
-dnl to find out if getaddrinfo happens to be threadsafe,
+dnl HAVE_GETADDRINFO is defined. Additionally when
+dnl HAVE_GETADDRINFO gets defined this also attempts
+dnl to find out if getaddrinfo happens to be thread-safe,
 dnl defining HAVE_GETADDRINFO_THREADSAFE when true.
 
 AC_DEFUN([CURL_CHECK_FUNC_GETADDRINFO], [
-  AC_REQUIRE([CURL_INCLUDES_WS2TCPIP])dnl
-  AC_REQUIRE([CURL_INCLUDES_STDLIB])dnl
-  AC_REQUIRE([CURL_INCLUDES_STRING])dnl
-  AC_REQUIRE([CURL_INCLUDES_SYS_SOCKET])dnl
-  AC_REQUIRE([CURL_INCLUDES_NETDB])dnl
-  AC_REQUIRE([CURL_CHECK_NATIVE_WINDOWS])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_WS2TCPIP])
+  AC_REQUIRE([CURL_INCLUDES_STDLIB])
+  AC_REQUIRE([CURL_INCLUDES_STRING])
+  AC_REQUIRE([CURL_INCLUDES_SYS_SOCKET])
+  AC_REQUIRE([CURL_INCLUDES_NETDB])
+  AC_REQUIRE([CURL_CHECK_NATIVE_WINDOWS])
+
   tst_links_getaddrinfo="unknown"
   tst_proto_getaddrinfo="unknown"
   tst_compi_getaddrinfo="unknown"
   tst_works_getaddrinfo="unknown"
   tst_allow_getaddrinfo="unknown"
   tst_tsafe_getaddrinfo="unknown"
-  #
+
   AC_MSG_CHECKING([if getaddrinfo can be linked])
   AC_LINK_IFELSE([
     AC_LANG_PROGRAM([[
@@ -1893,7 +1204,8 @@ AC_DEFUN([CURL_CHECK_FUNC_GETADDRINFO], [
       $curl_includes_sys_socket
       $curl_includes_netdb
     ]],[[
-      if(0 != getaddrinfo(0, 0, 0, 0))
+      struct addrinfo *ai = 0;
+      if(getaddrinfo(0, 0, 0, &ai))
         return 1;
     ]])
   ],[
@@ -1903,7 +1215,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETADDRINFO], [
     AC_MSG_RESULT([no])
     tst_links_getaddrinfo="no"
   ])
-  #
+
   if test "$tst_links_getaddrinfo" = "yes"; then
     AC_MSG_CHECKING([if getaddrinfo is prototyped])
     AC_EGREP_CPP([getaddrinfo],[
@@ -1918,7 +1230,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETADDRINFO], [
       tst_proto_getaddrinfo="no"
     ])
   fi
-  #
+
   if test "$tst_proto_getaddrinfo" = "yes"; then
     AC_MSG_CHECKING([if getaddrinfo is compilable])
     AC_COMPILE_IFELSE([
@@ -1927,7 +1239,8 @@ AC_DEFUN([CURL_CHECK_FUNC_GETADDRINFO], [
         $curl_includes_sys_socket
         $curl_includes_netdb
       ]],[[
-        if(0 != getaddrinfo(0, 0, 0, 0))
+        struct addrinfo *ai = 0;
+        if(getaddrinfo(0, 0, 0, &ai))
           return 1;
       ]])
     ],[
@@ -1938,9 +1251,9 @@ AC_DEFUN([CURL_CHECK_FUNC_GETADDRINFO], [
       tst_compi_getaddrinfo="no"
     ])
   fi
-  #
+
   dnl only do runtime verification when not cross-compiling
-  if test "x$cross_compiling" != "xyes" &&
+  if test "$cross_compiling" != "yes" &&
     test "$tst_compi_getaddrinfo" = "yes"; then
     AC_MSG_CHECKING([if getaddrinfo seems to work])
     CURL_RUN_IFELSE([
@@ -1954,11 +1267,12 @@ AC_DEFUN([CURL_CHECK_FUNC_GETADDRINFO], [
         struct addrinfo hints;
         struct addrinfo *ai = 0;
         int error;
+        int exitcode;
 
-        #ifdef HAVE_WINSOCK2_H
+        #ifdef _WIN32
         WSADATA wsa;
-        if (WSAStartup(MAKEWORD(2,2), &wsa))
-                exit(2);
+        if(WSAStartup(MAKEWORD(2, 2), &wsa))
+          return 2;
         #endif
 
         memset(&hints, 0, sizeof(hints));
@@ -1967,9 +1281,15 @@ AC_DEFUN([CURL_CHECK_FUNC_GETADDRINFO], [
         hints.ai_socktype = SOCK_STREAM;
         error = getaddrinfo("127.0.0.1", 0, &hints, &ai);
         if(error || !ai)
-          exit(1); /* fail */
-        else
-          exit(0);
+          exitcode = 1; /* fail */
+        else {
+          freeaddrinfo(ai);
+          exitcode = 0;
+        }
+        #ifdef _WIN32
+        WSACleanup();
+        #endif
+        return exitcode;
       ]])
     ],[
       AC_MSG_RESULT([yes])
@@ -1979,7 +1299,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETADDRINFO], [
       tst_works_getaddrinfo="no"
     ])
   fi
-  #
+
   if test "$tst_compi_getaddrinfo" = "yes" &&
     test "$tst_works_getaddrinfo" != "no"; then
     AC_MSG_CHECKING([if getaddrinfo usage allowed])
@@ -1991,10 +1311,9 @@ AC_DEFUN([CURL_CHECK_FUNC_GETADDRINFO], [
       tst_allow_getaddrinfo="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if getaddrinfo might be used])
-  if test "$tst_links_getaddrinfo" = "yes" &&
-     test "$tst_proto_getaddrinfo" = "yes" &&
+  if test "$tst_proto_getaddrinfo" = "yes" &&
      test "$tst_compi_getaddrinfo" = "yes" &&
      test "$tst_allow_getaddrinfo" = "yes" &&
      test "$tst_works_getaddrinfo" != "no"; then
@@ -2007,40 +1326,40 @@ AC_DEFUN([CURL_CHECK_FUNC_GETADDRINFO], [
     curl_cv_func_getaddrinfo="no"
     curl_cv_func_getaddrinfo_threadsafe="no"
   fi
-  #
+
   if test "$curl_cv_func_getaddrinfo" = "yes"; then
-    AC_MSG_CHECKING([if getaddrinfo is threadsafe])
+    AC_MSG_CHECKING([if getaddrinfo is thread-safe])
+    if test "$curl_cv_apple" = "yes"; then
+      dnl Darwin 6.0 and macOS 10.2.X and newer
+      tst_tsafe_getaddrinfo="yes"
+    fi
     case $host_os in
       aix[[1234]].* | aix5.[[01]].*)
-        dnl aix 5.1 and older
+        dnl AIX 5.1 and older
         tst_tsafe_getaddrinfo="no"
         ;;
       aix*)
-        dnl aix 5.2 and newer
+        dnl AIX 5.2 and newer
         tst_tsafe_getaddrinfo="yes"
         ;;
       darwin[[12345]].*)
-        dnl darwin 5.0 and mac os x 10.1.X and older
+        dnl Darwin 5.0 and macOS 10.1.X and older
         tst_tsafe_getaddrinfo="no"
         ;;
-      darwin*)
-        dnl darwin 6.0 and mac os x 10.2.X and newer
-        tst_tsafe_getaddrinfo="yes"
-        ;;
       freebsd[[1234]].* | freebsd5.[[1234]]*)
-        dnl freebsd 5.4 and older
+        dnl FreeBSD 5.4 and older
         tst_tsafe_getaddrinfo="no"
         ;;
       freebsd*)
-        dnl freebsd 5.5 and newer
+        dnl FreeBSD 5.5 and newer
         tst_tsafe_getaddrinfo="yes"
         ;;
       hpux[[123456789]].* | hpux10.* | hpux11.0* | hpux11.10*)
-        dnl hpux 11.10 and older
+        dnl HP-UX 11.10 and older
         tst_tsafe_getaddrinfo="no"
         ;;
       hpux*)
-        dnl hpux 11.11 and newer
+        dnl HP-UX 11.11 and newer
         tst_tsafe_getaddrinfo="yes"
         ;;
       midnightbsd*)
@@ -2048,19 +1367,19 @@ AC_DEFUN([CURL_CHECK_FUNC_GETADDRINFO], [
         tst_tsafe_getaddrinfo="yes"
         ;;
       netbsd[[123]].*)
-        dnl netbsd 3.X and older
+        dnl NetBSD 3.X and older
         tst_tsafe_getaddrinfo="no"
         ;;
       netbsd*)
-        dnl netbsd 4.X and newer
+        dnl NetBSD 4.X and newer
         tst_tsafe_getaddrinfo="yes"
         ;;
       *bsd*)
-        dnl All other bsd's
+        dnl All other BSD's
         tst_tsafe_getaddrinfo="no"
         ;;
       solaris2*)
-        dnl solaris which have it
+        dnl Solaris which have it
         tst_tsafe_getaddrinfo="yes"
         ;;
     esac
@@ -2069,57 +1388,12 @@ AC_DEFUN([CURL_CHECK_FUNC_GETADDRINFO], [
       tst_tsafe_getaddrinfo="yes"
     fi
     if test "$tst_tsafe_getaddrinfo" = "unknown"; then
-      CURL_CHECK_DEF_CC([h_errno], [
-        $curl_includes_sys_socket
-        $curl_includes_netdb
-        ], [silent])
-      if test "$curl_cv_have_def_h_errno" = "yes"; then
-        tst_h_errno_macro="yes"
-      else
-        tst_h_errno_macro="no"
-      fi
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-          $curl_includes_sys_socket
-          $curl_includes_netdb
-        ]],[[
-          h_errno = 2;
-          if(0 != h_errno)
-            return 1;
-        ]])
-      ],[
-        tst_h_errno_modifiable_lvalue="yes"
-      ],[
-        tst_h_errno_modifiable_lvalue="no"
-      ])
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-        ]],[[
-#if defined(_POSIX_C_SOURCE) && (_POSIX_C_SOURCE >= 200809L)
-          return 0;
-#elif defined(_XOPEN_SOURCE) && (_XOPEN_SOURCE >= 700)
-          return 0;
-#else
-          force compilation error
-#endif
-        ]])
-      ],[
-        tst_h_errno_sbs_issue_7="yes"
-      ],[
-        tst_h_errno_sbs_issue_7="no"
-      ])
-      if test "$tst_h_errno_macro" = "no" &&
-         test "$tst_h_errno_modifiable_lvalue" = "no" &&
-         test "$tst_h_errno_sbs_issue_7" = "no"; then
-        tst_tsafe_getaddrinfo="no"
-      else
-        tst_tsafe_getaddrinfo="yes"
-      fi
+      tst_tsafe_getaddrinfo="yes"
     fi
     AC_MSG_RESULT([$tst_tsafe_getaddrinfo])
     if test "$tst_tsafe_getaddrinfo" = "yes"; then
       AC_DEFINE_UNQUOTED(HAVE_GETADDRINFO_THREADSAFE, 1,
-        [Define to 1 if the getaddrinfo function is threadsafe.])
+        [Define to 1 if the getaddrinfo function is thread-safe.])
       curl_cv_func_getaddrinfo_threadsafe="yes"
     else
       curl_cv_func_getaddrinfo_threadsafe="no"
@@ -2128,120 +1402,23 @@ AC_DEFUN([CURL_CHECK_FUNC_GETADDRINFO], [
 ])
 
 
-dnl CURL_CHECK_FUNC_GETHOSTBYNAME
-dnl -------------------------------------------------
-dnl Verify if gethostbyname is available, prototyped,
-dnl and can be compiled. If all of these are true,
-dnl and usage has not been previously disallowed with
-dnl shell variable curl_disallow_gethostbyname, then
-dnl HAVE_GETHOSTBYNAME will be defined.
-
-AC_DEFUN([CURL_CHECK_FUNC_GETHOSTBYNAME], [
-  AC_REQUIRE([CURL_INCLUDES_WINSOCK2])dnl
-  AC_REQUIRE([CURL_INCLUDES_NETDB])dnl
-  #
-  tst_links_gethostbyname="unknown"
-  tst_proto_gethostbyname="unknown"
-  tst_compi_gethostbyname="unknown"
-  tst_allow_gethostbyname="unknown"
-  #
-  AC_MSG_CHECKING([if gethostbyname can be linked])
-  AC_LINK_IFELSE([
-    AC_LANG_PROGRAM([[
-      $curl_includes_winsock2
-      $curl_includes_bsdsocket
-      $curl_includes_netdb
-    ]],[[
-      if(0 != gethostbyname(0))
-        return 1;
-    ]])
-  ],[
-    AC_MSG_RESULT([yes])
-    tst_links_gethostbyname="yes"
-  ],[
-    AC_MSG_RESULT([no])
-    tst_links_gethostbyname="no"
-  ])
-  #
-  if test "$tst_links_gethostbyname" = "yes"; then
-    AC_MSG_CHECKING([if gethostbyname is prototyped])
-    AC_EGREP_CPP([gethostbyname],[
-      $curl_includes_winsock2
-      $curl_includes_bsdsocket
-      $curl_includes_netdb
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_proto_gethostbyname="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_proto_gethostbyname="no"
-    ])
-  fi
-  #
-  if test "$tst_proto_gethostbyname" = "yes"; then
-    AC_MSG_CHECKING([if gethostbyname is compilable])
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-        $curl_includes_winsock2
-        $curl_includes_bsdsocket
-        $curl_includes_netdb
-      ]],[[
-        if(0 != gethostbyname(0))
-          return 1;
-      ]])
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_compi_gethostbyname="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_compi_gethostbyname="no"
-    ])
-  fi
-  #
-  if test "$tst_compi_gethostbyname" = "yes"; then
-    AC_MSG_CHECKING([if gethostbyname usage allowed])
-    if test "x$curl_disallow_gethostbyname" != "xyes"; then
-      AC_MSG_RESULT([yes])
-      tst_allow_gethostbyname="yes"
-    else
-      AC_MSG_RESULT([no])
-      tst_allow_gethostbyname="no"
-    fi
-  fi
-  #
-  AC_MSG_CHECKING([if gethostbyname might be used])
-  if test "$tst_links_gethostbyname" = "yes" &&
-     test "$tst_proto_gethostbyname" = "yes" &&
-     test "$tst_compi_gethostbyname" = "yes" &&
-     test "$tst_allow_gethostbyname" = "yes"; then
-    AC_MSG_RESULT([yes])
-    AC_DEFINE_UNQUOTED(HAVE_GETHOSTBYNAME, 1,
-      [Define to 1 if you have the gethostbyname function.])
-    curl_cv_func_gethostbyname="yes"
-  else
-    AC_MSG_RESULT([no])
-    curl_cv_func_gethostbyname="no"
-  fi
-])
-
-
 dnl CURL_CHECK_FUNC_GETHOSTBYNAME_R
 dnl -------------------------------------------------
 dnl Verify if gethostbyname_r is available, prototyped,
 dnl and can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_gethostbyname_r, then
-dnl HAVE_GETHOSTBYNAME_R will be defined.
+dnl HAVE_GETHOSTBYNAME_R is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_GETHOSTBYNAME_R], [
-  AC_REQUIRE([CURL_INCLUDES_NETDB])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_NETDB])
+
   tst_links_gethostbyname_r="unknown"
   tst_proto_gethostbyname_r="unknown"
   tst_compi_gethostbyname_r="unknown"
   tst_allow_gethostbyname_r="unknown"
   tst_nargs_gethostbyname_r="unknown"
-  #
+
   AC_MSG_CHECKING([if gethostbyname_r can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([gethostbyname_r])
@@ -2252,7 +1429,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETHOSTBYNAME_R], [
     AC_MSG_RESULT([no])
     tst_links_gethostbyname_r="no"
   ])
-  #
+
   if test "$tst_links_gethostbyname_r" = "yes"; then
     AC_MSG_CHECKING([if gethostbyname_r is prototyped])
     AC_EGREP_CPP([gethostbyname_r],[
@@ -2265,7 +1442,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETHOSTBYNAME_R], [
       tst_proto_gethostbyname_r="no"
     ])
   fi
-  #
+
   if test "$tst_proto_gethostbyname_r" = "yes"; then
     if test "$tst_nargs_gethostbyname_r" = "unknown"; then
       AC_MSG_CHECKING([if gethostbyname_r takes 3 args.])
@@ -2274,7 +1451,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETHOSTBYNAME_R], [
           $curl_includes_netdb
           $curl_includes_bsdsocket
         ]],[[
-          if(0 != gethostbyname_r(0, 0, 0))
+          if(gethostbyname_r(0, 0, 0))
             return 1;
         ]])
       ],[
@@ -2293,7 +1470,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETHOSTBYNAME_R], [
           $curl_includes_netdb
           $curl_includes_bsdsocket
         ]],[[
-          if(0 != gethostbyname_r(0, 0, 0, 0, 0))
+          if(gethostbyname_r(0, 0, 0, 0, 0))
             return 1;
         ]])
       ],[
@@ -2312,7 +1489,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETHOSTBYNAME_R], [
           $curl_includes_netdb
           $curl_includes_bsdsocket
         ]],[[
-          if(0 != gethostbyname_r(0, 0, 0, 0, 0, 0))
+          if(gethostbyname_r(0, 0, 0, 0, 0, 0))
             return 1;
         ]])
       ],[
@@ -2331,7 +1508,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETHOSTBYNAME_R], [
       AC_MSG_RESULT([no])
     fi
   fi
-  #
+
   if test "$tst_compi_gethostbyname_r" = "yes"; then
     AC_MSG_CHECKING([if gethostbyname_r usage allowed])
     if test "x$curl_disallow_gethostbyname_r" != "xyes"; then
@@ -2342,7 +1519,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETHOSTBYNAME_R], [
       tst_allow_gethostbyname_r="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if gethostbyname_r might be used])
   if test "$tst_links_gethostbyname_r" = "yes" &&
      test "$tst_proto_gethostbyname_r" = "yes" &&
@@ -2353,7 +1530,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETHOSTBYNAME_R], [
       [Define to 1 if you have the gethostbyname_r function.])
     dnl AC_DEFINE_UNQUOTED(GETHOSTBYNAME_R_ARGS, $tst_nargs_gethostbyname_r,
     dnl   [Specifies the number of arguments to gethostbyname_r])
-    #
+
     if test "$tst_nargs_gethostbyname_r" -eq "3"; then
       AC_DEFINE(HAVE_GETHOSTBYNAME_R_3, 1, [gethostbyname_r() takes 3 args])
     elif test "$tst_nargs_gethostbyname_r" -eq "5"; then
@@ -2361,7 +1538,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETHOSTBYNAME_R], [
     elif test "$tst_nargs_gethostbyname_r" -eq "6"; then
       AC_DEFINE(HAVE_GETHOSTBYNAME_R_6, 1, [gethostbyname_r() takes 6 args])
     fi
-    #
+
     curl_cv_func_gethostbyname_r="yes"
   else
     AC_MSG_RESULT([no])
@@ -2376,19 +1553,19 @@ dnl Verify if gethostname is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_gethostname, then
-dnl HAVE_GETHOSTNAME will be defined.
+dnl HAVE_GETHOSTNAME is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_GETHOSTNAME], [
-  AC_REQUIRE([CURL_INCLUDES_WINSOCK2])dnl
-  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])dnl
-  AC_REQUIRE([CURL_INCLUDES_UNISTD])dnl
-  AC_REQUIRE([CURL_PREPROCESS_CALLCONV])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_WINSOCK2])
+  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])
+  AC_REQUIRE([CURL_INCLUDES_UNISTD])
+  AC_REQUIRE([CURL_PREPROCESS_CALLCONV])
+
   tst_links_gethostname="unknown"
   tst_proto_gethostname="unknown"
   tst_compi_gethostname="unknown"
   tst_allow_gethostname="unknown"
-  #
+
   AC_MSG_CHECKING([if gethostname can be linked])
   AC_LINK_IFELSE([
     AC_LANG_PROGRAM([[
@@ -2396,7 +1573,8 @@ AC_DEFUN([CURL_CHECK_FUNC_GETHOSTNAME], [
       $curl_includes_unistd
       $curl_includes_bsdsocket
     ]],[[
-      if(0 != gethostname(0, 0))
+      char s[1];
+      if(gethostname((void *)s, 0))
         return 1;
     ]])
   ],[
@@ -2406,7 +1584,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETHOSTNAME], [
     AC_MSG_RESULT([no])
     tst_links_gethostname="no"
   ])
-  #
+
   if test "$tst_links_gethostname" = "yes"; then
     AC_MSG_CHECKING([if gethostname is prototyped])
     AC_EGREP_CPP([gethostname],[
@@ -2421,7 +1599,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETHOSTNAME], [
       tst_proto_gethostname="no"
     ])
   fi
-  #
+
   if test "$tst_proto_gethostname" = "yes"; then
     AC_MSG_CHECKING([if gethostname is compilable])
     AC_COMPILE_IFELSE([
@@ -2430,7 +1608,8 @@ AC_DEFUN([CURL_CHECK_FUNC_GETHOSTNAME], [
         $curl_includes_unistd
         $curl_includes_bsdsocket
       ]],[[
-        if(0 != gethostname(0, 0))
+        char s[1];
+        if(gethostname((void *)s, 0))
           return 1;
       ]])
     ],[
@@ -2441,7 +1620,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETHOSTNAME], [
       tst_compi_gethostname="no"
     ])
   fi
-  #
+
   if test "$tst_compi_gethostname" = "yes"; then
     AC_MSG_CHECKING([for gethostname arg 2 data type])
     tst_gethostname_type_arg2="unknown"
@@ -2454,9 +1633,15 @@ AC_DEFUN([CURL_CHECK_FUNC_GETHOSTNAME], [
               $curl_includes_unistd
               $curl_includes_bsdsocket
               $curl_preprocess_callconv
-              extern int FUNCALLCONV gethostname($tst_arg1, $tst_arg2);
+              #if defined(_WIN32) && defined(WINSOCK_API_LINKAGE)
+              WINSOCK_API_LINKAGE
+              #else
+              extern
+              #endif
+              int FUNCALLCONV gethostname($tst_arg1, $tst_arg2);
             ]],[[
-              if(0 != gethostname(0, 0))
+              char s[1];
+              if(gethostname(($tst_arg1)s, 0))
                 return 1;
             ]])
           ],[
@@ -2471,7 +1656,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETHOSTNAME], [
         [Define to the type of arg 2 for gethostname.])
     fi
   fi
-  #
+
   if test "$tst_compi_gethostname" = "yes"; then
     AC_MSG_CHECKING([if gethostname usage allowed])
     if test "x$curl_disallow_gethostname" != "xyes"; then
@@ -2482,7 +1667,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETHOSTNAME], [
       tst_allow_gethostname="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if gethostname might be used])
   if test "$tst_links_gethostname" = "yes" &&
      test "$tst_proto_gethostname" = "yes" &&
@@ -2504,19 +1689,19 @@ dnl Verify if getpeername is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_getpeername, then
-dnl HAVE_GETPEERNAME will be defined.
+dnl HAVE_GETPEERNAME is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_GETPEERNAME], [
-  AC_REQUIRE([CURL_INCLUDES_WINSOCK2])dnl
-  AC_REQUIRE([CURL_INCLUDES_UNISTD])dnl
-  AC_REQUIRE([CURL_PREPROCESS_CALLCONV])dnl
-  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_WINSOCK2])
+  AC_REQUIRE([CURL_INCLUDES_UNISTD])
+  AC_REQUIRE([CURL_PREPROCESS_CALLCONV])
+  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])
+
   tst_links_getpeername="unknown"
   tst_proto_getpeername="unknown"
   tst_compi_getpeername="unknown"
   tst_allow_getpeername="unknown"
-  #
+
   AC_MSG_CHECKING([if getpeername can be linked])
   AC_LINK_IFELSE([
     AC_LANG_PROGRAM([[
@@ -2524,7 +1709,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETPEERNAME], [
       $curl_includes_bsdsocket
       $curl_includes_sys_socket
     ]],[[
-      if(0 != getpeername(0, (void *)0, (void *)0))
+      if(getpeername(0, (void *)0, (void *)0))
         return 1;
     ]])
   ],[
@@ -2534,7 +1719,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETPEERNAME], [
     AC_MSG_RESULT([no])
     tst_links_getpeername="no"
   ])
-  #
+
   if test "$tst_links_getpeername" = "yes"; then
     AC_MSG_CHECKING([if getpeername is prototyped])
     AC_EGREP_CPP([getpeername],[
@@ -2549,7 +1734,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETPEERNAME], [
       tst_proto_getpeername="no"
     ])
   fi
-  #
+
   if test "$tst_proto_getpeername" = "yes"; then
     AC_MSG_CHECKING([if getpeername is compilable])
     AC_COMPILE_IFELSE([
@@ -2558,7 +1743,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETPEERNAME], [
         $curl_includes_bsdsocket
         $curl_includes_sys_socket
       ]],[[
-        if(0 != getpeername(0, (void *)0, (void *)0))
+        if(getpeername(0, (void *)0, (void *)0))
           return 1;
       ]])
     ],[
@@ -2569,7 +1754,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETPEERNAME], [
       tst_compi_getpeername="no"
     ])
   fi
-  #
+
   if test "$tst_compi_getpeername" = "yes"; then
     AC_MSG_CHECKING([if getpeername usage allowed])
     if test "x$curl_disallow_getpeername" != "xyes"; then
@@ -2580,7 +1765,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETPEERNAME], [
       tst_allow_getpeername="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if getpeername might be used])
   if test "$tst_links_getpeername" = "yes" &&
      test "$tst_proto_getpeername" = "yes" &&
@@ -2602,19 +1787,19 @@ dnl Verify if getsockname is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_getsockname, then
-dnl HAVE_GETSOCKNAME will be defined.
+dnl HAVE_GETSOCKNAME is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_GETSOCKNAME], [
-  AC_REQUIRE([CURL_INCLUDES_WINSOCK2])dnl
-  AC_REQUIRE([CURL_INCLUDES_UNISTD])dnl
-  AC_REQUIRE([CURL_PREPROCESS_CALLCONV])dnl
-  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_WINSOCK2])
+  AC_REQUIRE([CURL_INCLUDES_UNISTD])
+  AC_REQUIRE([CURL_PREPROCESS_CALLCONV])
+  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])
+
   tst_links_getsockname="unknown"
   tst_proto_getsockname="unknown"
   tst_compi_getsockname="unknown"
   tst_allow_getsockname="unknown"
-  #
+
   AC_MSG_CHECKING([if getsockname can be linked])
   AC_LINK_IFELSE([
     AC_LANG_PROGRAM([[
@@ -2622,7 +1807,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETSOCKNAME], [
       $curl_includes_bsdsocket
       $curl_includes_sys_socket
     ]],[[
-      if(0 != getsockname(0, (void *)0, (void *)0))
+      if(getsockname(0, (void *)0, (void *)0))
         return 1;
     ]])
   ],[
@@ -2632,7 +1817,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETSOCKNAME], [
     AC_MSG_RESULT([no])
     tst_links_getsockname="no"
   ])
-  #
+
   if test "$tst_links_getsockname" = "yes"; then
     AC_MSG_CHECKING([if getsockname is prototyped])
     AC_EGREP_CPP([getsockname],[
@@ -2647,7 +1832,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETSOCKNAME], [
       tst_proto_getsockname="no"
     ])
   fi
-  #
+
   if test "$tst_proto_getsockname" = "yes"; then
     AC_MSG_CHECKING([if getsockname is compilable])
     AC_COMPILE_IFELSE([
@@ -2656,7 +1841,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETSOCKNAME], [
         $curl_includes_bsdsocket
         $curl_includes_sys_socket
       ]],[[
-        if(0 != getsockname(0, (void *)0, (void *)0))
+        if(getsockname(0, (void *)0, (void *)0))
           return 1;
       ]])
     ],[
@@ -2667,7 +1852,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETSOCKNAME], [
       tst_compi_getsockname="no"
     ])
   fi
-  #
+
   if test "$tst_compi_getsockname" = "yes"; then
     AC_MSG_CHECKING([if getsockname usage allowed])
     if test "x$curl_disallow_getsockname" != "xyes"; then
@@ -2678,7 +1863,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETSOCKNAME], [
       tst_allow_getsockname="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if getsockname might be used])
   if test "$tst_links_getsockname" = "yes" &&
      test "$tst_proto_getsockname" = "yes" &&
@@ -2694,101 +1879,6 @@ AC_DEFUN([CURL_CHECK_FUNC_GETSOCKNAME], [
   fi
 ])
 
-dnl CURL_CHECK_FUNC_IF_NAMETOINDEX
-dnl -------------------------------------------------
-dnl Verify if if_nametoindex is available, prototyped, and
-dnl can be compiled. If all of these are true, and
-dnl usage has not been previously disallowed with
-dnl shell variable curl_disallow_if_nametoindex, then
-dnl HAVE_IF_NAMETOINDEX will be defined.
-
-AC_DEFUN([CURL_CHECK_FUNC_IF_NAMETOINDEX], [
-  AC_REQUIRE([CURL_INCLUDES_WINSOCK2])dnl
-  AC_REQUIRE([CURL_INCLUDES_NETIF])dnl
-  AC_REQUIRE([CURL_PREPROCESS_CALLCONV])dnl
-  #
-  tst_links_if_nametoindex="unknown"
-  tst_proto_if_nametoindex="unknown"
-  tst_compi_if_nametoindex="unknown"
-  tst_allow_if_nametoindex="unknown"
-  #
-  AC_MSG_CHECKING([if if_nametoindex can be linked])
-  AC_LINK_IFELSE([
-    AC_LANG_PROGRAM([[
-      $curl_includes_winsock2
-      $curl_includes_bsdsocket
-      #include <net/if.h>
-    ]],[[
-      if(0 != if_nametoindex(""))
-        return 1;
-    ]])
-  ],[
-    AC_MSG_RESULT([yes])
-    tst_links_if_nametoindex="yes"
-  ],[
-    AC_MSG_RESULT([no])
-    tst_links_if_nametoindex="no"
-  ])
-  #
-  if test "$tst_links_if_nametoindex" = "yes"; then
-    AC_MSG_CHECKING([if if_nametoindex is prototyped])
-    AC_EGREP_CPP([if_nametoindex],[
-      $curl_includes_winsock2
-      $curl_includes_netif
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_proto_if_nametoindex="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_proto_if_nametoindex="no"
-    ])
-  fi
-  #
-  if test "$tst_proto_if_nametoindex" = "yes"; then
-    AC_MSG_CHECKING([if if_nametoindex is compilable])
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-        $curl_includes_winsock2
-        $curl_includes_netif
-      ]],[[
-        if(0 != if_nametoindex(""))
-          return 1;
-      ]])
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_compi_if_nametoindex="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_compi_if_nametoindex="no"
-    ])
-  fi
-  #
-  if test "$tst_compi_if_nametoindex" = "yes"; then
-    AC_MSG_CHECKING([if if_nametoindex usage allowed])
-    if test "x$curl_disallow_if_nametoindex" != "xyes"; then
-      AC_MSG_RESULT([yes])
-      tst_allow_if_nametoindex="yes"
-    else
-      AC_MSG_RESULT([no])
-      tst_allow_if_nametoindex="no"
-    fi
-  fi
-  #
-  AC_MSG_CHECKING([if if_nametoindex might be used])
-  if test "$tst_links_if_nametoindex" = "yes" &&
-     test "$tst_proto_if_nametoindex" = "yes" &&
-     test "$tst_compi_if_nametoindex" = "yes" &&
-     test "$tst_allow_if_nametoindex" = "yes"; then
-    AC_MSG_RESULT([yes])
-    AC_DEFINE_UNQUOTED(HAVE_IF_NAMETOINDEX, 1,
-      [Define to 1 if you have the if_nametoindex function.])
-    curl_cv_func_if_nametoindex="yes"
-  else
-    AC_MSG_RESULT([no])
-    curl_cv_func_if_nametoindex="no"
-  fi
-])
-
 
 dnl CURL_CHECK_FUNC_GETIFADDRS
 dnl -------------------------------------------------
@@ -2796,18 +1886,18 @@ dnl Verify if getifaddrs is available, prototyped, can
 dnl be compiled and seems to work. If all of these are
 dnl true, and usage has not been previously disallowed
 dnl with shell variable curl_disallow_getifaddrs, then
-dnl HAVE_GETIFADDRS will be defined.
+dnl HAVE_GETIFADDRS is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_GETIFADDRS], [
-  AC_REQUIRE([CURL_INCLUDES_STDLIB])dnl
-  AC_REQUIRE([CURL_INCLUDES_IFADDRS])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_STDLIB])
+  AC_REQUIRE([CURL_INCLUDES_IFADDRS])
+
   tst_links_getifaddrs="unknown"
   tst_proto_getifaddrs="unknown"
   tst_compi_getifaddrs="unknown"
   tst_works_getifaddrs="unknown"
   tst_allow_getifaddrs="unknown"
-  #
+
   AC_MSG_CHECKING([if getifaddrs can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([getifaddrs])
@@ -2818,7 +1908,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETIFADDRS], [
     AC_MSG_RESULT([no])
     tst_links_getifaddrs="no"
   ])
-  #
+
   if test "$tst_links_getifaddrs" = "yes"; then
     AC_MSG_CHECKING([if getifaddrs is prototyped])
     AC_EGREP_CPP([getifaddrs],[
@@ -2831,14 +1921,14 @@ AC_DEFUN([CURL_CHECK_FUNC_GETIFADDRS], [
       tst_proto_getifaddrs="no"
     ])
   fi
-  #
+
   if test "$tst_proto_getifaddrs" = "yes"; then
     AC_MSG_CHECKING([if getifaddrs is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_ifaddrs
       ]],[[
-        if(0 != getifaddrs(0))
+        if(getifaddrs(0))
           return 1;
       ]])
     ],[
@@ -2849,9 +1939,9 @@ AC_DEFUN([CURL_CHECK_FUNC_GETIFADDRS], [
       tst_compi_getifaddrs="no"
     ])
   fi
-  #
+
   dnl only do runtime verification when not cross-compiling
-  if test "x$cross_compiling" != "xyes" &&
+  if test "$cross_compiling" != "yes" &&
     test "$tst_compi_getifaddrs" = "yes"; then
     AC_MSG_CHECKING([if getifaddrs seems to work])
     CURL_RUN_IFELSE([
@@ -2864,9 +1954,11 @@ AC_DEFUN([CURL_CHECK_FUNC_GETIFADDRS], [
 
         error = getifaddrs(&ifa);
         if(error || !ifa)
-          exit(1); /* fail */
-        else
-          exit(0);
+          return 1; /* fail */
+        else {
+          freeifaddrs(ifa);
+          return 0;
+        }
       ]])
     ],[
       AC_MSG_RESULT([yes])
@@ -2876,7 +1968,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETIFADDRS], [
       tst_works_getifaddrs="no"
     ])
   fi
-  #
+
   if test "$tst_compi_getifaddrs" = "yes" &&
     test "$tst_works_getifaddrs" != "no"; then
     AC_MSG_CHECKING([if getifaddrs usage allowed])
@@ -2888,7 +1980,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GETIFADDRS], [
       tst_allow_getifaddrs="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if getifaddrs might be used])
   if test "$tst_links_getifaddrs" = "yes" &&
      test "$tst_proto_getifaddrs" = "yes" &&
@@ -2906,146 +1998,24 @@ AC_DEFUN([CURL_CHECK_FUNC_GETIFADDRS], [
 ])
 
 
-dnl CURL_CHECK_FUNC_GETXATTR
-dnl -------------------------------------------------
-dnl Verify if getxattr is available, prototyped, and
-dnl can be compiled. If all of these are true, and
-dnl usage has not been previously disallowed with
-dnl shell variable curl_disallow_getxattr, then
-dnl HAVE_GETXATTR will be defined.
-
-AC_DEFUN([CURL_CHECK_FUNC_GETXATTR], [
-  AC_REQUIRE([CURL_INCLUDES_SYS_XATTR])dnl
-  #
-  tst_links_getxattr="unknown"
-  tst_proto_getxattr="unknown"
-  tst_compi_getxattr="unknown"
-  tst_allow_getxattr="unknown"
-  tst_nargs_getxattr="unknown"
-  #
-  AC_MSG_CHECKING([if getxattr can be linked])
-  AC_LINK_IFELSE([
-    AC_LANG_FUNC_LINK_TRY([getxattr])
-  ],[
-    AC_MSG_RESULT([yes])
-    tst_links_getxattr="yes"
-  ],[
-    AC_MSG_RESULT([no])
-    tst_links_getxattr="no"
-  ])
-  #
-  if test "$tst_links_getxattr" = "yes"; then
-    AC_MSG_CHECKING([if getxattr is prototyped])
-    AC_EGREP_CPP([getxattr],[
-      $curl_includes_sys_xattr
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_proto_getxattr="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_proto_getxattr="no"
-    ])
-  fi
-  #
-  if test "$tst_proto_getxattr" = "yes"; then
-    if test "$tst_nargs_getxattr" = "unknown"; then
-      AC_MSG_CHECKING([if getxattr takes 4 args.])
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-          $curl_includes_sys_xattr
-        ]],[[
-          if(0 != getxattr(0, 0, 0, 0))
-            return 1;
-        ]])
-      ],[
-        AC_MSG_RESULT([yes])
-        tst_compi_getxattr="yes"
-        tst_nargs_getxattr="4"
-      ],[
-        AC_MSG_RESULT([no])
-        tst_compi_getxattr="no"
-      ])
-    fi
-    if test "$tst_nargs_getxattr" = "unknown"; then
-      AC_MSG_CHECKING([if getxattr takes 6 args.])
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-          $curl_includes_sys_xattr
-        ]],[[
-          if(0 != getxattr(0, 0, 0, 0, 0, 0))
-            return 1;
-        ]])
-      ],[
-        AC_MSG_RESULT([yes])
-        tst_compi_getxattr="yes"
-        tst_nargs_getxattr="6"
-      ],[
-        AC_MSG_RESULT([no])
-        tst_compi_getxattr="no"
-      ])
-    fi
-    AC_MSG_CHECKING([if getxattr is compilable])
-    if test "$tst_compi_getxattr" = "yes"; then
-      AC_MSG_RESULT([yes])
-    else
-      AC_MSG_RESULT([no])
-    fi
-  fi
-  #
-  if test "$tst_compi_getxattr" = "yes"; then
-    AC_MSG_CHECKING([if getxattr usage allowed])
-    if test "x$curl_disallow_getxattr" != "xyes"; then
-      AC_MSG_RESULT([yes])
-      tst_allow_getxattr="yes"
-    else
-      AC_MSG_RESULT([no])
-      tst_allow_getxattr="no"
-    fi
-  fi
-  #
-  AC_MSG_CHECKING([if getxattr might be used])
-  if test "$tst_links_getxattr" = "yes" &&
-     test "$tst_proto_getxattr" = "yes" &&
-     test "$tst_compi_getxattr" = "yes" &&
-     test "$tst_allow_getxattr" = "yes"; then
-    AC_MSG_RESULT([yes])
-    AC_DEFINE_UNQUOTED(HAVE_GETXATTR, 1,
-      [Define to 1 if you have the getxattr function.])
-    dnl AC_DEFINE_UNQUOTED(GETXATTR_ARGS, $tst_nargs_getxattr,
-    dnl   [Specifies the number of arguments to getxattr])
-    #
-    if test "$tst_nargs_getxattr" -eq "4"; then
-      AC_DEFINE(HAVE_GETXATTR_4, 1, [getxattr() takes 4 args])
-    elif test "$tst_nargs_getxattr" -eq "6"; then
-      AC_DEFINE(HAVE_GETXATTR_6, 1, [getxattr() takes 6 args])
-    fi
-    #
-    curl_cv_func_getxattr="yes"
-  else
-    AC_MSG_RESULT([no])
-    curl_cv_func_getxattr="no"
-  fi
-])
-
-
 dnl CURL_CHECK_FUNC_GMTIME_R
 dnl -------------------------------------------------
 dnl Verify if gmtime_r is available, prototyped, can
 dnl be compiled and seems to work. If all of these are
 dnl true, and usage has not been previously disallowed
 dnl with shell variable curl_disallow_gmtime_r, then
-dnl HAVE_GMTIME_R will be defined.
+dnl HAVE_GMTIME_R is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_GMTIME_R], [
-  AC_REQUIRE([CURL_INCLUDES_STDLIB])dnl
-  AC_REQUIRE([CURL_INCLUDES_TIME])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_STDLIB])
+  AC_REQUIRE([CURL_INCLUDES_TIME])
+
   tst_links_gmtime_r="unknown"
   tst_proto_gmtime_r="unknown"
   tst_compi_gmtime_r="unknown"
   tst_works_gmtime_r="unknown"
   tst_allow_gmtime_r="unknown"
-  #
+
   AC_MSG_CHECKING([if gmtime_r can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([gmtime_r])
@@ -3056,7 +2026,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GMTIME_R], [
     AC_MSG_RESULT([no])
     tst_links_gmtime_r="no"
   ])
-  #
+
   if test "$tst_links_gmtime_r" = "yes"; then
     AC_MSG_CHECKING([if gmtime_r is prototyped])
     AC_EGREP_CPP([gmtime_r],[
@@ -3069,15 +2039,18 @@ AC_DEFUN([CURL_CHECK_FUNC_GMTIME_R], [
       tst_proto_gmtime_r="no"
     ])
   fi
-  #
+
   if test "$tst_proto_gmtime_r" = "yes"; then
     AC_MSG_CHECKING([if gmtime_r is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_time
       ]],[[
-        if(0 != gmtime_r(0, 0))
+        time_t tm = 1170352587;
+        struct tm result;
+        if(gmtime_r(&tm, &result) == 0)
           return 1;
+        (void)result;
       ]])
     ],[
       AC_MSG_RESULT([yes])
@@ -3087,9 +2060,9 @@ AC_DEFUN([CURL_CHECK_FUNC_GMTIME_R], [
       tst_compi_gmtime_r="no"
     ])
   fi
-  #
+
   dnl only do runtime verification when not cross-compiling
-  if test "x$cross_compiling" != "xyes" &&
+  if test "$cross_compiling" != "yes" &&
     test "$tst_compi_gmtime_r" = "yes"; then
     AC_MSG_CHECKING([if gmtime_r seems to work])
     CURL_RUN_IFELSE([
@@ -3101,10 +2074,11 @@ AC_DEFUN([CURL_CHECK_FUNC_GMTIME_R], [
         struct tm *gmt = 0;
         struct tm result;
         gmt = gmtime_r(&local, &result);
+        (void)result;
         if(gmt)
-          exit(0);
+          return 0;
         else
-          exit(1);
+          return 1;
       ]])
     ],[
       AC_MSG_RESULT([yes])
@@ -3114,7 +2088,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GMTIME_R], [
       tst_works_gmtime_r="no"
     ])
   fi
-  #
+
   if test "$tst_compi_gmtime_r" = "yes" &&
     test "$tst_works_gmtime_r" != "no"; then
     AC_MSG_CHECKING([if gmtime_r usage allowed])
@@ -3126,7 +2100,7 @@ AC_DEFUN([CURL_CHECK_FUNC_GMTIME_R], [
       tst_allow_gmtime_r="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if gmtime_r might be used])
   if test "$tst_links_gmtime_r" = "yes" &&
      test "$tst_proto_gmtime_r" = "yes" &&
@@ -3144,25 +2118,145 @@ AC_DEFUN([CURL_CHECK_FUNC_GMTIME_R], [
 ])
 
 
+dnl CURL_CHECK_FUNC_LOCALTIME_R
+dnl -------------------------------------------------
+dnl Verify if localtime_r is available, prototyped, can
+dnl be compiled and seems to work. If all of these are
+dnl true, and usage has not been previously disallowed
+dnl with shell variable curl_disallow_localtime_r, then
+dnl HAVE_LOCALTIME_R is defined.
+
+AC_DEFUN([CURL_CHECK_FUNC_LOCALTIME_R], [
+  AC_REQUIRE([CURL_INCLUDES_STDLIB])
+  AC_REQUIRE([CURL_INCLUDES_TIME])
+
+  tst_links_localtime_r="unknown"
+  tst_proto_localtime_r="unknown"
+  tst_compi_localtime_r="unknown"
+  tst_works_localtime_r="unknown"
+  tst_allow_localtime_r="unknown"
+
+  AC_MSG_CHECKING([if localtime_r can be linked])
+  AC_LINK_IFELSE([
+    AC_LANG_FUNC_LINK_TRY([localtime_r])
+  ],[
+    AC_MSG_RESULT([yes])
+    tst_links_localtime_r="yes"
+  ],[
+    AC_MSG_RESULT([no])
+    tst_links_localtime_r="no"
+  ])
+
+  if test "$tst_links_localtime_r" = "yes"; then
+    AC_MSG_CHECKING([if localtime_r is prototyped])
+    AC_EGREP_CPP([localtime_r],[
+      $curl_includes_time
+    ],[
+      AC_MSG_RESULT([yes])
+      tst_proto_localtime_r="yes"
+    ],[
+      AC_MSG_RESULT([no])
+      tst_proto_localtime_r="no"
+    ])
+  fi
+
+  if test "$tst_proto_localtime_r" = "yes"; then
+    AC_MSG_CHECKING([if localtime_r is compilable])
+    AC_COMPILE_IFELSE([
+      AC_LANG_PROGRAM([[
+        $curl_includes_time
+      ]],[[
+        time_t clock = 1170352587;
+        struct tm result;
+        if(localtime_r(&clock, &result))
+          return 1;
+        (void)result;
+      ]])
+    ],[
+      AC_MSG_RESULT([yes])
+      tst_compi_localtime_r="yes"
+    ],[
+      AC_MSG_RESULT([no])
+      tst_compi_localtime_r="no"
+    ])
+  fi
+
+  dnl only do runtime verification when not cross-compiling
+  if test "$cross_compiling" != "yes" &&
+    test "$tst_compi_localtime_r" = "yes"; then
+    AC_MSG_CHECKING([if localtime_r seems to work])
+    CURL_RUN_IFELSE([
+      AC_LANG_PROGRAM([[
+        $curl_includes_stdlib
+        $curl_includes_time
+      ]],[[
+        time_t clock = 1170352587;
+        struct tm *tmp = 0;
+        struct tm result;
+        tmp = localtime_r(&clock, &result);
+        (void)result;
+        if(tmp)
+          return 0;
+        else
+          return 1;
+      ]])
+    ],[
+      AC_MSG_RESULT([yes])
+      tst_works_localtime_r="yes"
+    ],[
+      AC_MSG_RESULT([no])
+      tst_works_localtime_r="no"
+    ])
+  fi
+
+  if test "$tst_compi_localtime_r" = "yes" &&
+    test "$tst_works_localtime_r" != "no"; then
+    AC_MSG_CHECKING([if localtime_r usage allowed])
+    if test "x$curl_disallow_localtime_r" != "xyes"; then
+      AC_MSG_RESULT([yes])
+      tst_allow_localtime_r="yes"
+    else
+      AC_MSG_RESULT([no])
+      tst_allow_localtime_r="no"
+    fi
+  fi
+
+  AC_MSG_CHECKING([if localtime_r might be used])
+  if test "$tst_links_localtime_r" = "yes" &&
+     test "$tst_proto_localtime_r" = "yes" &&
+     test "$tst_compi_localtime_r" = "yes" &&
+     test "$tst_allow_localtime_r" = "yes" &&
+     test "$tst_works_localtime_r" != "no"; then
+    AC_MSG_RESULT([yes])
+    AC_DEFINE_UNQUOTED(HAVE_LOCALTIME_R, 1,
+      [Define to 1 if you have a working localtime_r function.])
+    curl_cv_func_localtime_r="yes"
+  else
+    AC_MSG_RESULT([no])
+    curl_cv_func_localtime_r="no"
+  fi
+])
+
+
 dnl CURL_CHECK_FUNC_INET_NTOP
 dnl -------------------------------------------------
 dnl Verify if inet_ntop is available, prototyped, can
 dnl be compiled and seems to work. If all of these are
 dnl true, and usage has not been previously disallowed
 dnl with shell variable curl_disallow_inet_ntop, then
-dnl HAVE_INET_NTOP will be defined.
+dnl HAVE_INET_NTOP is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_INET_NTOP], [
-  AC_REQUIRE([CURL_INCLUDES_STDLIB])dnl
-  AC_REQUIRE([CURL_INCLUDES_ARPA_INET])dnl
-  AC_REQUIRE([CURL_INCLUDES_STRING])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_STDLIB])
+  AC_REQUIRE([CURL_INCLUDES_ARPA_INET])
+  AC_REQUIRE([CURL_INCLUDES_STRING])
+
   tst_links_inet_ntop="unknown"
   tst_proto_inet_ntop="unknown"
   tst_compi_inet_ntop="unknown"
   tst_works_inet_ntop="unknown"
   tst_allow_inet_ntop="unknown"
-  #
+
   AC_MSG_CHECKING([if inet_ntop can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([inet_ntop])
@@ -3173,7 +2267,7 @@ AC_DEFUN([CURL_CHECK_FUNC_INET_NTOP], [
     AC_MSG_RESULT([no])
     tst_links_inet_ntop="no"
   ])
-  #
+
   if test "$tst_links_inet_ntop" = "yes"; then
     AC_MSG_CHECKING([if inet_ntop is prototyped])
     AC_EGREP_CPP([inet_ntop],[
@@ -3186,14 +2280,16 @@ AC_DEFUN([CURL_CHECK_FUNC_INET_NTOP], [
       tst_proto_inet_ntop="no"
     ])
   fi
-  #
+
   if test "$tst_proto_inet_ntop" = "yes"; then
     AC_MSG_CHECKING([if inet_ntop is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_arpa_inet
       ]],[[
-        if(0 != inet_ntop(0, 0, 0, 0))
+        char ipv4res[sizeof("255.255.255.255")];
+        unsigned char ipv4a[5] = "";
+        if(inet_ntop(0, ipv4a, ipv4res, 0))
           return 1;
       ]])
     ],[
@@ -3204,9 +2300,9 @@ AC_DEFUN([CURL_CHECK_FUNC_INET_NTOP], [
       tst_compi_inet_ntop="no"
     ])
   fi
-  #
+
   dnl only do runtime verification when not cross-compiling
-  if test "x$cross_compiling" != "xyes" &&
+  if test "$cross_compiling" != "yes" &&
     test "$tst_compi_inet_ntop" = "yes"; then
     AC_MSG_CHECKING([if inet_ntop seems to work])
     CURL_RUN_IFELSE([
@@ -3216,11 +2312,11 @@ AC_DEFUN([CURL_CHECK_FUNC_INET_NTOP], [
         $curl_includes_string
       ]],[[
         char ipv6res[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")];
-        char ipv4res[sizeof "255.255.255.255"];
+        char ipv4res[sizeof("255.255.255.255")];
         unsigned char ipv6a[26];
         unsigned char ipv4a[5];
-        char *ipv6ptr = 0;
-        char *ipv4ptr = 0;
+        const char *ipv6ptr = 0;
+        const char *ipv4ptr = 0;
         /* - */
         ipv4res[0] = '\0';
         ipv4a[0] = 0xc0;
@@ -3231,13 +2327,13 @@ AC_DEFUN([CURL_CHECK_FUNC_INET_NTOP], [
         /* - */
         ipv4ptr = inet_ntop(AF_INET, ipv4a, ipv4res, sizeof(ipv4res));
         if(!ipv4ptr)
-          exit(1); /* fail */
+          return 1; /* fail */
         if(ipv4ptr != ipv4res)
-          exit(1); /* fail */
+          return 1; /* fail */
         if(!ipv4ptr[0])
-          exit(1); /* fail */
-        if(memcmp(ipv4res, "192.168.100.1", 13) != 0)
-          exit(1); /* fail */
+          return 1; /* fail */
+        if(memcmp(ipv4res, "192.168.100.1", 13))
+          return 1; /* fail */
         /* - */
         ipv6res[0] = '\0';
         memset(ipv6a, 0, sizeof(ipv6a));
@@ -3255,15 +2351,15 @@ AC_DEFUN([CURL_CHECK_FUNC_INET_NTOP], [
         /* - */
         ipv6ptr = inet_ntop(AF_INET6, ipv6a, ipv6res, sizeof(ipv6res));
         if(!ipv6ptr)
-          exit(1); /* fail */
+          return 1; /* fail */
         if(ipv6ptr != ipv6res)
-          exit(1); /* fail */
+          return 1; /* fail */
         if(!ipv6ptr[0])
-          exit(1); /* fail */
-        if(memcmp(ipv6res, "fe80::214:4fff:fe0b:76c8", 24) != 0)
-          exit(1); /* fail */
+          return 1; /* fail */
+        if(memcmp(ipv6res, "fe80::214:4fff:fe0b:76c8", 24))
+          return 1; /* fail */
         /* - */
-        exit(0);
+        return 0;
       ]])
     ],[
       AC_MSG_RESULT([yes])
@@ -3273,7 +2369,7 @@ AC_DEFUN([CURL_CHECK_FUNC_INET_NTOP], [
       tst_works_inet_ntop="no"
     ])
   fi
-  #
+
   if test "$tst_compi_inet_ntop" = "yes" &&
     test "$tst_works_inet_ntop" != "no"; then
     AC_MSG_CHECKING([if inet_ntop usage allowed])
@@ -3285,7 +2381,7 @@ AC_DEFUN([CURL_CHECK_FUNC_INET_NTOP], [
       tst_allow_inet_ntop="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if inet_ntop might be used])
   if test "$tst_links_inet_ntop" = "yes" &&
      test "$tst_proto_inet_ntop" = "yes" &&
@@ -3294,7 +2390,7 @@ AC_DEFUN([CURL_CHECK_FUNC_INET_NTOP], [
      test "$tst_works_inet_ntop" != "no"; then
     AC_MSG_RESULT([yes])
     AC_DEFINE_UNQUOTED(HAVE_INET_NTOP, 1,
-      [Define to 1 if you have a IPv6 capable working inet_ntop function.])
+      [Define to 1 if you have an IPv6 capable working inet_ntop function.])
     curl_cv_func_inet_ntop="yes"
   else
     AC_MSG_RESULT([no])
@@ -3309,19 +2405,19 @@ dnl Verify if inet_pton is available, prototyped, can
 dnl be compiled and seems to work. If all of these are
 dnl true, and usage has not been previously disallowed
 dnl with shell variable curl_disallow_inet_pton, then
-dnl HAVE_INET_PTON will be defined.
+dnl HAVE_INET_PTON is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_INET_PTON], [
-  AC_REQUIRE([CURL_INCLUDES_STDLIB])dnl
-  AC_REQUIRE([CURL_INCLUDES_ARPA_INET])dnl
-  AC_REQUIRE([CURL_INCLUDES_STRING])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_STDLIB])
+  AC_REQUIRE([CURL_INCLUDES_ARPA_INET])
+  AC_REQUIRE([CURL_INCLUDES_STRING])
+
   tst_links_inet_pton="unknown"
   tst_proto_inet_pton="unknown"
   tst_compi_inet_pton="unknown"
   tst_works_inet_pton="unknown"
   tst_allow_inet_pton="unknown"
-  #
+
   AC_MSG_CHECKING([if inet_pton can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([inet_pton])
@@ -3332,7 +2428,7 @@ AC_DEFUN([CURL_CHECK_FUNC_INET_PTON], [
     AC_MSG_RESULT([no])
     tst_links_inet_pton="no"
   ])
-  #
+
   if test "$tst_links_inet_pton" = "yes"; then
     AC_MSG_CHECKING([if inet_pton is prototyped])
     AC_EGREP_CPP([inet_pton],[
@@ -3345,14 +2441,16 @@ AC_DEFUN([CURL_CHECK_FUNC_INET_PTON], [
       tst_proto_inet_pton="no"
     ])
   fi
-  #
+
   if test "$tst_proto_inet_pton" = "yes"; then
     AC_MSG_CHECKING([if inet_pton is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_arpa_inet
       ]],[[
-        if(0 != inet_pton(0, 0, 0))
+        unsigned char ipv4a[4 + 1] = "";
+        const char *ipv4src = "192.168.100.1";
+        if(inet_pton(0, ipv4src, ipv4a))
           return 1;
       ]])
     ],[
@@ -3363,9 +2461,9 @@ AC_DEFUN([CURL_CHECK_FUNC_INET_PTON], [
       tst_compi_inet_pton="no"
     ])
   fi
-  #
+
   dnl only do runtime verification when not cross-compiling
-  if test "x$cross_compiling" != "xyes" &&
+  if test "$cross_compiling" != "yes" &&
     test "$tst_compi_inet_pton" = "yes"; then
     AC_MSG_CHECKING([if inet_pton seems to work])
     CURL_RUN_IFELSE([
@@ -3374,48 +2472,48 @@ AC_DEFUN([CURL_CHECK_FUNC_INET_PTON], [
         $curl_includes_arpa_inet
         $curl_includes_string
       ]],[[
-        unsigned char ipv6a[16+1];
-        unsigned char ipv4a[4+1];
+        unsigned char ipv6a[16 + 1];
+        unsigned char ipv4a[4 + 1];
         const char *ipv6src = "fe80::214:4fff:fe0b:76c8";
         const char *ipv4src = "192.168.100.1";
         /* - */
         memset(ipv4a, 1, sizeof(ipv4a));
-        if(1 != inet_pton(AF_INET, ipv4src, ipv4a))
-          exit(1); /* fail */
+        if(inet_pton(AF_INET, ipv4src, ipv4a) != 1)
+          return 1; /* fail */
         /* - */
-        if( (ipv4a[0] != 0xc0) ||
-            (ipv4a[1] != 0xa8) ||
-            (ipv4a[2] != 0x64) ||
-            (ipv4a[3] != 0x01) ||
-            (ipv4a[4] != 0x01) )
-          exit(1); /* fail */
+        if((ipv4a[0] != 0xc0) ||
+           (ipv4a[1] != 0xa8) ||
+           (ipv4a[2] != 0x64) ||
+           (ipv4a[3] != 0x01) ||
+           (ipv4a[4] != 0x01))
+          return 1; /* fail */
         /* - */
         memset(ipv6a, 1, sizeof(ipv6a));
-        if(1 != inet_pton(AF_INET6, ipv6src, ipv6a))
-          exit(1); /* fail */
+        if(inet_pton(AF_INET6, ipv6src, ipv6a) != 1)
+          return 1; /* fail */
         /* - */
-        if( (ipv6a[0]  != 0xfe) ||
-            (ipv6a[1]  != 0x80) ||
-            (ipv6a[8]  != 0x02) ||
-            (ipv6a[9]  != 0x14) ||
-            (ipv6a[10] != 0x4f) ||
-            (ipv6a[11] != 0xff) ||
-            (ipv6a[12] != 0xfe) ||
-            (ipv6a[13] != 0x0b) ||
-            (ipv6a[14] != 0x76) ||
-            (ipv6a[15] != 0xc8) ||
-            (ipv6a[16] != 0x01) )
-          exit(1); /* fail */
+        if((ipv6a[0]  != 0xfe) ||
+           (ipv6a[1]  != 0x80) ||
+           (ipv6a[8]  != 0x02) ||
+           (ipv6a[9]  != 0x14) ||
+           (ipv6a[10] != 0x4f) ||
+           (ipv6a[11] != 0xff) ||
+           (ipv6a[12] != 0xfe) ||
+           (ipv6a[13] != 0x0b) ||
+           (ipv6a[14] != 0x76) ||
+           (ipv6a[15] != 0xc8) ||
+           (ipv6a[16] != 0x01))
+          return 1; /* fail */
         /* - */
-        if( (ipv6a[2]  != 0x0) ||
-            (ipv6a[3]  != 0x0) ||
-            (ipv6a[4]  != 0x0) ||
-            (ipv6a[5]  != 0x0) ||
-            (ipv6a[6]  != 0x0) ||
-            (ipv6a[7]  != 0x0) )
-          exit(1); /* fail */
+        if((ipv6a[2] != 0x0) ||
+           (ipv6a[3] != 0x0) ||
+           (ipv6a[4] != 0x0) ||
+           (ipv6a[5] != 0x0) ||
+           (ipv6a[6] != 0x0) ||
+           (ipv6a[7] != 0x0))
+          return 1; /* fail */
         /* - */
-        exit(0);
+        return 0;
       ]])
     ],[
       AC_MSG_RESULT([yes])
@@ -3425,7 +2523,7 @@ AC_DEFUN([CURL_CHECK_FUNC_INET_PTON], [
       tst_works_inet_pton="no"
     ])
   fi
-  #
+
   if test "$tst_compi_inet_pton" = "yes" &&
     test "$tst_works_inet_pton" != "no"; then
     AC_MSG_CHECKING([if inet_pton usage allowed])
@@ -3437,7 +2535,7 @@ AC_DEFUN([CURL_CHECK_FUNC_INET_PTON], [
       tst_allow_inet_pton="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if inet_pton might be used])
   if test "$tst_links_inet_pton" = "yes" &&
      test "$tst_proto_inet_pton" = "yes" &&
@@ -3446,7 +2544,7 @@ AC_DEFUN([CURL_CHECK_FUNC_INET_PTON], [
      test "$tst_works_inet_pton" != "no"; then
     AC_MSG_RESULT([yes])
     AC_DEFINE_UNQUOTED(HAVE_INET_PTON, 1,
-      [Define to 1 if you have a IPv6 capable working inet_pton function.])
+      [Define to 1 if you have an IPv6 capable working inet_pton function.])
     curl_cv_func_inet_pton="yes"
   else
     AC_MSG_RESULT([no])
@@ -3455,18 +2553,103 @@ AC_DEFUN([CURL_CHECK_FUNC_INET_PTON], [
 ])
 
 
+dnl CURL_CHECK_FUNC_IOCTL
+dnl -------------------------------------------------
+dnl Verify if ioctl is available, prototyped, and
+dnl can be compiled. If all of these are true, and
+dnl usage has not been previously disallowed with
+dnl shell variable curl_disallow_ioctl, then
+dnl curl_cv_func_ioctl is set to "yes".
+
+AC_DEFUN([CURL_CHECK_FUNC_IOCTL], [
+  AC_REQUIRE([CURL_INCLUDES_STROPTS])
+
+  tst_links_ioctl="unknown"
+  tst_proto_ioctl="unknown"
+  tst_compi_ioctl="unknown"
+  tst_allow_ioctl="unknown"
+
+  AC_MSG_CHECKING([if ioctl can be linked])
+  AC_LINK_IFELSE([
+    AC_LANG_FUNC_LINK_TRY([ioctl])
+  ],[
+    AC_MSG_RESULT([yes])
+    tst_links_ioctl="yes"
+  ],[
+    AC_MSG_RESULT([no])
+    tst_links_ioctl="no"
+  ])
+
+  if test "$tst_links_ioctl" = "yes"; then
+    AC_MSG_CHECKING([if ioctl is prototyped])
+    AC_EGREP_CPP([ioctl],[
+      $curl_includes_stropts
+    ],[
+      AC_MSG_RESULT([yes])
+      tst_proto_ioctl="yes"
+    ],[
+      AC_MSG_RESULT([no])
+      tst_proto_ioctl="no"
+    ])
+  fi
+
+  if test "$tst_proto_ioctl" = "yes"; then
+    AC_MSG_CHECKING([if ioctl is compilable])
+    AC_COMPILE_IFELSE([
+      AC_LANG_PROGRAM([[
+        $curl_includes_stropts
+      ]],[[
+        if(ioctl(0, 0, 0))
+          return 1;
+      ]])
+    ],[
+      AC_MSG_RESULT([yes])
+      tst_compi_ioctl="yes"
+    ],[
+      AC_MSG_RESULT([no])
+      tst_compi_ioctl="no"
+    ])
+  fi
+
+  if test "$tst_compi_ioctl" = "yes"; then
+    AC_MSG_CHECKING([if ioctl usage allowed])
+    if test "x$curl_disallow_ioctl" != "xyes"; then
+      AC_MSG_RESULT([yes])
+      tst_allow_ioctl="yes"
+    else
+      AC_MSG_RESULT([no])
+      tst_allow_ioctl="no"
+    fi
+  fi
+
+  AC_MSG_CHECKING([if ioctl might be used])
+  if test "$tst_links_ioctl" = "yes" &&
+     test "$tst_proto_ioctl" = "yes" &&
+     test "$tst_compi_ioctl" = "yes" &&
+     test "$tst_allow_ioctl" = "yes"; then
+    AC_MSG_RESULT([yes])
+    curl_cv_func_ioctl="yes"
+    CURL_CHECK_FUNC_IOCTL_FIONBIO
+    CURL_CHECK_FUNC_IOCTL_SIOCGIFADDR
+  else
+    AC_MSG_RESULT([no])
+    curl_cv_func_ioctl="no"
+  fi
+])
+
+
 dnl CURL_CHECK_FUNC_IOCTL_FIONBIO
 dnl -------------------------------------------------
 dnl Verify if ioctl with the FIONBIO command is
 dnl available, can be compiled, and seems to work. If
 dnl all of these are true, then HAVE_IOCTL_FIONBIO
-dnl will be defined.
+dnl is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_IOCTL_FIONBIO], [
-  #
+
   tst_compi_ioctl_fionbio="unknown"
   tst_allow_ioctl_fionbio="unknown"
-  #
+
   if test "$curl_cv_func_ioctl" = "yes"; then
     AC_MSG_CHECKING([if ioctl FIONBIO is compilable])
     AC_COMPILE_IFELSE([
@@ -3474,7 +2657,7 @@ AC_DEFUN([CURL_CHECK_FUNC_IOCTL_FIONBIO], [
         $curl_includes_stropts
       ]],[[
         int flags = 0;
-        if(0 != ioctl(0, FIONBIO, &flags))
+        if(ioctl(0, FIONBIO, &flags))
           return 1;
       ]])
     ],[
@@ -3485,7 +2668,7 @@ AC_DEFUN([CURL_CHECK_FUNC_IOCTL_FIONBIO], [
       tst_compi_ioctl_fionbio="no"
     ])
   fi
-  #
+
   if test "$tst_compi_ioctl_fionbio" = "yes"; then
     AC_MSG_CHECKING([if ioctl FIONBIO usage allowed])
     if test "x$curl_disallow_ioctl_fionbio" != "xyes"; then
@@ -3496,7 +2679,7 @@ AC_DEFUN([CURL_CHECK_FUNC_IOCTL_FIONBIO], [
       tst_allow_ioctl_fionbio="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if ioctl FIONBIO might be used])
   if test "$tst_compi_ioctl_fionbio" = "yes" &&
      test "$tst_allow_ioctl_fionbio" = "yes"; then
@@ -3516,13 +2699,13 @@ dnl -------------------------------------------------
 dnl Verify if ioctl with the SIOCGIFADDR command is available,
 dnl struct ifreq is defined, they can be compiled, and seem to
 dnl work. If all of these are true, then HAVE_IOCTL_SIOCGIFADDR
-dnl will be defined.
+dnl is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_IOCTL_SIOCGIFADDR], [
-  #
+
   tst_compi_ioctl_siocgifaddr="unknown"
   tst_allow_ioctl_siocgifaddr="unknown"
-  #
+
   if test "$curl_cv_func_ioctl" = "yes"; then
     AC_MSG_CHECKING([if ioctl SIOCGIFADDR is compilable])
     AC_COMPILE_IFELSE([
@@ -3531,7 +2714,7 @@ AC_DEFUN([CURL_CHECK_FUNC_IOCTL_SIOCGIFADDR], [
         #include <net/if.h>
       ]],[[
         struct ifreq ifr;
-        if(0 != ioctl(0, SIOCGIFADDR, &ifr))
+        if(ioctl(0, SIOCGIFADDR, &ifr))
           return 1;
       ]])
     ],[
@@ -3542,7 +2725,7 @@ AC_DEFUN([CURL_CHECK_FUNC_IOCTL_SIOCGIFADDR], [
       tst_compi_ioctl_siocgifaddr="no"
     ])
   fi
-  #
+
   if test "$tst_compi_ioctl_siocgifaddr" = "yes"; then
     AC_MSG_CHECKING([if ioctl SIOCGIFADDR usage allowed])
     if test "x$curl_disallow_ioctl_siocgifaddr" != "xyes"; then
@@ -3553,7 +2736,7 @@ AC_DEFUN([CURL_CHECK_FUNC_IOCTL_SIOCGIFADDR], [
       tst_allow_ioctl_siocgifaddr="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if ioctl SIOCGIFADDR might be used])
   if test "$tst_compi_ioctl_siocgifaddr" = "yes" &&
      test "$tst_allow_ioctl_siocgifaddr" = "yes"; then
@@ -3574,22 +2757,22 @@ dnl Verify if ioctlsocket is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_ioctlsocket, then
-dnl HAVE_IOCTLSOCKET will be defined.
+dnl HAVE_IOCTLSOCKET is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_IOCTLSOCKET], [
-  AC_REQUIRE([CURL_INCLUDES_WINSOCK2])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_WINSOCK2])
+
   tst_links_ioctlsocket="unknown"
   tst_proto_ioctlsocket="unknown"
   tst_compi_ioctlsocket="unknown"
   tst_allow_ioctlsocket="unknown"
-  #
+
   AC_MSG_CHECKING([if ioctlsocket can be linked])
   AC_LINK_IFELSE([
     AC_LANG_PROGRAM([[
       $curl_includes_winsock2
     ]],[[
-      if(0 != ioctlsocket(0, 0, 0))
+      if(ioctlsocket(0, 0, 0))
         return 1;
     ]])
   ],[
@@ -3599,7 +2782,7 @@ AC_DEFUN([CURL_CHECK_FUNC_IOCTLSOCKET], [
     AC_MSG_RESULT([no])
     tst_links_ioctlsocket="no"
   ])
-  #
+
   if test "$tst_links_ioctlsocket" = "yes"; then
     AC_MSG_CHECKING([if ioctlsocket is prototyped])
     AC_EGREP_CPP([ioctlsocket],[
@@ -3612,14 +2795,14 @@ AC_DEFUN([CURL_CHECK_FUNC_IOCTLSOCKET], [
       tst_proto_ioctlsocket="no"
     ])
   fi
-  #
+
   if test "$tst_proto_ioctlsocket" = "yes"; then
     AC_MSG_CHECKING([if ioctlsocket is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_winsock2
       ]],[[
-        if(0 != ioctlsocket(0, 0, 0))
+        if(ioctlsocket(0, 0, 0))
           return 1;
       ]])
     ],[
@@ -3630,7 +2813,7 @@ AC_DEFUN([CURL_CHECK_FUNC_IOCTLSOCKET], [
       tst_compi_ioctlsocket="no"
     ])
   fi
-  #
+
   if test "$tst_compi_ioctlsocket" = "yes"; then
     AC_MSG_CHECKING([if ioctlsocket usage allowed])
     if test "x$curl_disallow_ioctlsocket" != "xyes"; then
@@ -3641,7 +2824,7 @@ AC_DEFUN([CURL_CHECK_FUNC_IOCTLSOCKET], [
       tst_allow_ioctlsocket="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if ioctlsocket might be used])
   if test "$tst_links_ioctlsocket" = "yes" &&
      test "$tst_proto_ioctlsocket" = "yes" &&
@@ -3664,21 +2847,21 @@ dnl -------------------------------------------------
 dnl Verify if ioctlsocket with the FIONBIO command is
 dnl available, can be compiled, and seems to work. If
 dnl all of these are true, then HAVE_IOCTLSOCKET_FIONBIO
-dnl will be defined.
+dnl is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_IOCTLSOCKET_FIONBIO], [
-  #
+
   tst_compi_ioctlsocket_fionbio="unknown"
   tst_allow_ioctlsocket_fionbio="unknown"
-  #
+
   if test "$curl_cv_func_ioctlsocket" = "yes"; then
     AC_MSG_CHECKING([if ioctlsocket FIONBIO is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_winsock2
       ]],[[
-        int flags = 0;
-        if(0 != ioctlsocket(0, FIONBIO, &flags))
+        unsigned long flags = 0;
+        if(ioctlsocket(0, FIONBIO, &flags))
           return 1;
       ]])
     ],[
@@ -3689,7 +2872,7 @@ AC_DEFUN([CURL_CHECK_FUNC_IOCTLSOCKET_FIONBIO], [
       tst_compi_ioctlsocket_fionbio="no"
     ])
   fi
-  #
+
   if test "$tst_compi_ioctlsocket_fionbio" = "yes"; then
     AC_MSG_CHECKING([if ioctlsocket FIONBIO usage allowed])
     if test "x$curl_disallow_ioctlsocket_fionbio" != "xyes"; then
@@ -3700,7 +2883,7 @@ AC_DEFUN([CURL_CHECK_FUNC_IOCTLSOCKET_FIONBIO], [
       tst_allow_ioctlsocket_fionbio="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if ioctlsocket FIONBIO might be used])
   if test "$tst_compi_ioctlsocket_fionbio" = "yes" &&
      test "$tst_allow_ioctlsocket_fionbio" = "yes"; then
@@ -3721,22 +2904,22 @@ dnl Verify if IoctlSocket is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_ioctlsocket_camel,
-dnl then HAVE_IOCTLSOCKET_CAMEL will be defined.
+dnl then HAVE_IOCTLSOCKET_CAMEL is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_IOCTLSOCKET_CAMEL], [
-  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])
+
   tst_links_ioctlsocket_camel="unknown"
-  tst_proto_ioctlsocket_camel="unknown"
   tst_compi_ioctlsocket_camel="unknown"
   tst_allow_ioctlsocket_camel="unknown"
-  #
+
   AC_MSG_CHECKING([if IoctlSocket can be linked])
   AC_LINK_IFELSE([
     AC_LANG_PROGRAM([[
       $curl_includes_bsdsocket
     ]],[[
-      IoctlSocket(0, 0, 0);
+      if(IoctlSocket(0, 0, 0))
+        return 1;
     ]])
   ],[
     AC_MSG_RESULT([yes])
@@ -3745,27 +2928,14 @@ AC_DEFUN([CURL_CHECK_FUNC_IOCTLSOCKET_CAMEL], [
     AC_MSG_RESULT([no])
     tst_links_ioctlsocket_camel="no"
   ])
-  #
+
   if test "$tst_links_ioctlsocket_camel" = "yes"; then
-    AC_MSG_CHECKING([if IoctlSocket is prototyped])
-    AC_EGREP_CPP([IoctlSocket],[
-      $curl_includes_bsdsocket
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_proto_ioctlsocket_camel="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_proto_ioctlsocket_camel="no"
-    ])
-  fi
-  #
-  if test "$tst_proto_ioctlsocket_camel" = "yes"; then
     AC_MSG_CHECKING([if IoctlSocket is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_bsdsocket
       ]],[[
-        if(0 != IoctlSocket(0, 0, 0))
+        if(IoctlSocket(0, 0, 0))
           return 1;
       ]])
     ],[
@@ -3776,7 +2946,7 @@ AC_DEFUN([CURL_CHECK_FUNC_IOCTLSOCKET_CAMEL], [
       tst_compi_ioctlsocket_camel="no"
     ])
   fi
-  #
+
   if test "$tst_compi_ioctlsocket_camel" = "yes"; then
     AC_MSG_CHECKING([if IoctlSocket usage allowed])
     if test "x$curl_disallow_ioctlsocket_camel" != "xyes"; then
@@ -3787,10 +2957,9 @@ AC_DEFUN([CURL_CHECK_FUNC_IOCTLSOCKET_CAMEL], [
       tst_allow_ioctlsocket_camel="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if IoctlSocket might be used])
   if test "$tst_links_ioctlsocket_camel" = "yes" &&
-     test "$tst_proto_ioctlsocket_camel" = "yes" &&
      test "$tst_compi_ioctlsocket_camel" = "yes" &&
      test "$tst_allow_ioctlsocket_camel" = "yes"; then
     AC_MSG_RESULT([yes])
@@ -3809,14 +2978,14 @@ dnl CURL_CHECK_FUNC_IOCTLSOCKET_CAMEL_FIONBIO
 dnl -------------------------------------------------
 dnl Verify if IoctlSocket with FIONBIO command is available,
 dnl can be compiled, and seems to work. If all of these are
-dnl true, then HAVE_IOCTLSOCKET_CAMEL_FIONBIO will be defined.
+dnl true, then HAVE_IOCTLSOCKET_CAMEL_FIONBIO is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_IOCTLSOCKET_CAMEL_FIONBIO], [
-  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_BSDSOCKET])
+
   tst_compi_ioctlsocket_camel_fionbio="unknown"
   tst_allow_ioctlsocket_camel_fionbio="unknown"
-  #
+
   if test "$curl_cv_func_ioctlsocket_camel" = "yes"; then
     AC_MSG_CHECKING([if IoctlSocket FIONBIO is compilable])
     AC_COMPILE_IFELSE([
@@ -3824,7 +2993,7 @@ AC_DEFUN([CURL_CHECK_FUNC_IOCTLSOCKET_CAMEL_FIONBIO], [
         $curl_includes_bsdsocket
       ]],[[
         long flags = 0;
-        if(0 != IoctlSocket(0, FIONBIO, &flags))
+        if(IoctlSocket(0, FIONBIO, &flags))
           return 1;
       ]])
     ],[
@@ -3835,7 +3004,7 @@ AC_DEFUN([CURL_CHECK_FUNC_IOCTLSOCKET_CAMEL_FIONBIO], [
       tst_compi_ioctlsocket_camel_fionbio="no"
     ])
   fi
-  #
+
   if test "$tst_compi_ioctlsocket_camel_fionbio" = "yes"; then
     AC_MSG_CHECKING([if IoctlSocket FIONBIO usage allowed])
     if test "x$curl_disallow_ioctlsocket_camel_fionbio" != "xyes"; then
@@ -3846,7 +3015,7 @@ AC_DEFUN([CURL_CHECK_FUNC_IOCTLSOCKET_CAMEL_FIONBIO], [
       tst_allow_ioctlsocket_camel_fionbio="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if IoctlSocket FIONBIO might be used])
   if test "$tst_compi_ioctlsocket_camel_fionbio" = "yes" &&
      test "$tst_allow_ioctlsocket_camel_fionbio" = "yes"; then
@@ -3861,145 +3030,23 @@ AC_DEFUN([CURL_CHECK_FUNC_IOCTLSOCKET_CAMEL_FIONBIO], [
 ])
 
 
-dnl CURL_CHECK_FUNC_LISTXATTR
-dnl -------------------------------------------------
-dnl Verify if listxattr is available, prototyped, and
-dnl can be compiled. If all of these are true, and
-dnl usage has not been previously disallowed with
-dnl shell variable curl_disallow_listxattr, then
-dnl HAVE_LISTXATTR will be defined.
-
-AC_DEFUN([CURL_CHECK_FUNC_LISTXATTR], [
-  AC_REQUIRE([CURL_INCLUDES_SYS_XATTR])dnl
-  #
-  tst_links_listxattr="unknown"
-  tst_proto_listxattr="unknown"
-  tst_compi_listxattr="unknown"
-  tst_allow_listxattr="unknown"
-  tst_nargs_listxattr="unknown"
-  #
-  AC_MSG_CHECKING([if listxattr can be linked])
-  AC_LINK_IFELSE([
-    AC_LANG_FUNC_LINK_TRY([listxattr])
-  ],[
-    AC_MSG_RESULT([yes])
-    tst_links_listxattr="yes"
-  ],[
-    AC_MSG_RESULT([no])
-    tst_links_listxattr="no"
-  ])
-  #
-  if test "$tst_links_listxattr" = "yes"; then
-    AC_MSG_CHECKING([if listxattr is prototyped])
-    AC_EGREP_CPP([listxattr],[
-      $curl_includes_sys_xattr
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_proto_listxattr="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_proto_listxattr="no"
-    ])
-  fi
-  #
-  if test "$tst_proto_listxattr" = "yes"; then
-    if test "$tst_nargs_listxattr" = "unknown"; then
-      AC_MSG_CHECKING([if listxattr takes 3 args.])
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-          $curl_includes_sys_xattr
-        ]],[[
-          if(0 != listxattr(0, 0, 0))
-            return 1;
-        ]])
-      ],[
-        AC_MSG_RESULT([yes])
-        tst_compi_listxattr="yes"
-        tst_nargs_listxattr="3"
-      ],[
-        AC_MSG_RESULT([no])
-        tst_compi_listxattr="no"
-      ])
-    fi
-    if test "$tst_nargs_listxattr" = "unknown"; then
-      AC_MSG_CHECKING([if listxattr takes 4 args.])
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-          $curl_includes_sys_xattr
-        ]],[[
-          if(0 != listxattr(0, 0, 0, 0))
-            return 1;
-        ]])
-      ],[
-        AC_MSG_RESULT([yes])
-        tst_compi_listxattr="yes"
-        tst_nargs_listxattr="4"
-      ],[
-        AC_MSG_RESULT([no])
-        tst_compi_listxattr="no"
-      ])
-    fi
-    AC_MSG_CHECKING([if listxattr is compilable])
-    if test "$tst_compi_listxattr" = "yes"; then
-      AC_MSG_RESULT([yes])
-    else
-      AC_MSG_RESULT([no])
-    fi
-  fi
-  #
-  if test "$tst_compi_listxattr" = "yes"; then
-    AC_MSG_CHECKING([if listxattr usage allowed])
-    if test "x$curl_disallow_listxattr" != "xyes"; then
-      AC_MSG_RESULT([yes])
-      tst_allow_listxattr="yes"
-    else
-      AC_MSG_RESULT([no])
-      tst_allow_listxattr="no"
-    fi
-  fi
-  #
-  AC_MSG_CHECKING([if listxattr might be used])
-  if test "$tst_links_listxattr" = "yes" &&
-     test "$tst_proto_listxattr" = "yes" &&
-     test "$tst_compi_listxattr" = "yes" &&
-     test "$tst_allow_listxattr" = "yes"; then
-    AC_MSG_RESULT([yes])
-    AC_DEFINE_UNQUOTED(HAVE_LISTXATTR, 1,
-      [Define to 1 if you have the listxattr function.])
-    dnl AC_DEFINE_UNQUOTED(LISTXATTR_ARGS, $tst_nargs_listxattr,
-    dnl   [Specifies the number of arguments to listxattr])
-    #
-    if test "$tst_nargs_listxattr" -eq "3"; then
-      AC_DEFINE(HAVE_LISTXATTR_3, 1, [listxattr() takes 3 args])
-    elif test "$tst_nargs_listxattr" -eq "4"; then
-      AC_DEFINE(HAVE_LISTXATTR_4, 1, [listxattr() takes 4 args])
-    fi
-    #
-    curl_cv_func_listxattr="yes"
-  else
-    AC_MSG_RESULT([no])
-    curl_cv_func_listxattr="no"
-  fi
-])
-
-
 dnl CURL_CHECK_FUNC_MEMRCHR
 dnl -------------------------------------------------
 dnl Verify if memrchr is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_memrchr, then
-dnl HAVE_MEMRCHR will be defined.
+dnl HAVE_MEMRCHR is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_MEMRCHR], [
-  AC_REQUIRE([CURL_INCLUDES_STRING])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_STRING])
+
   tst_links_memrchr="unknown"
   tst_macro_memrchr="unknown"
   tst_proto_memrchr="unknown"
   tst_compi_memrchr="unknown"
   tst_allow_memrchr="unknown"
-  #
+
   AC_MSG_CHECKING([if memrchr can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([memrchr])
@@ -4010,14 +3057,14 @@ AC_DEFUN([CURL_CHECK_FUNC_MEMRCHR], [
     AC_MSG_RESULT([no])
     tst_links_memrchr="no"
   ])
-  #
+
   if test "$tst_links_memrchr" = "no"; then
     AC_MSG_CHECKING([if memrchr seems a macro])
     AC_LINK_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_string
       ]],[[
-        if(0 != memrchr(0, 0, 0))
+        if(memrchr("", 0, 0))
           return 1;
       ]])
     ],[
@@ -4028,7 +3075,7 @@ AC_DEFUN([CURL_CHECK_FUNC_MEMRCHR], [
       tst_macro_memrchr="no"
     ])
   fi
-  #
+
   if test "$tst_links_memrchr" = "yes"; then
     AC_MSG_CHECKING([if memrchr is prototyped])
     AC_EGREP_CPP([memrchr],[
@@ -4041,7 +3088,7 @@ AC_DEFUN([CURL_CHECK_FUNC_MEMRCHR], [
       tst_proto_memrchr="no"
     ])
   fi
-  #
+
   if test "$tst_proto_memrchr" = "yes" ||
      test "$tst_macro_memrchr" = "yes"; then
     AC_MSG_CHECKING([if memrchr is compilable])
@@ -4049,7 +3096,7 @@ AC_DEFUN([CURL_CHECK_FUNC_MEMRCHR], [
       AC_LANG_PROGRAM([[
         $curl_includes_string
       ]],[[
-        if(0 != memrchr(0, 0, 0))
+        if(memrchr("", 0, 0))
           return 1;
       ]])
     ],[
@@ -4060,7 +3107,7 @@ AC_DEFUN([CURL_CHECK_FUNC_MEMRCHR], [
       tst_compi_memrchr="no"
     ])
   fi
-  #
+
   if test "$tst_compi_memrchr" = "yes"; then
     AC_MSG_CHECKING([if memrchr usage allowed])
     if test "x$curl_disallow_memrchr" != "xyes"; then
@@ -4071,7 +3118,7 @@ AC_DEFUN([CURL_CHECK_FUNC_MEMRCHR], [
       tst_allow_memrchr="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if memrchr might be used])
   if (test "$tst_proto_memrchr" = "yes" ||
       test "$tst_macro_memrchr" = "yes") &&
@@ -4088,466 +3135,22 @@ AC_DEFUN([CURL_CHECK_FUNC_MEMRCHR], [
 ])
 
 
-dnl CURL_CHECK_FUNC_POLL
-dnl -------------------------------------------------
-dnl Verify if poll is available, prototyped, can
-dnl be compiled and seems to work.
-
-AC_DEFUN([CURL_CHECK_FUNC_POLL], [
-  AC_REQUIRE([CURL_INCLUDES_STDLIB])dnl
-  AC_REQUIRE([CURL_INCLUDES_POLL])dnl
-  #
-  tst_links_poll="unknown"
-  tst_proto_poll="unknown"
-  tst_compi_poll="unknown"
-  tst_works_poll="unknown"
-  tst_allow_poll="unknown"
-  #
-  case $host_os in
-    darwin*|interix*)
-      dnl poll() does not work on these platforms
-      dnl Interix: "does provide poll(), but the implementing developer must
-      dnl have been in a bad mood, because poll() only works on the /proc
-      dnl filesystem here"
-      dnl macOS: poll() first didn't exist, then was broken until fixed in 10.9
-      dnl only to break again in 10.12.
-      curl_disallow_poll="yes"
-      tst_compi_poll="no"
-      ;;
-  esac
-  #
-  AC_MSG_CHECKING([if poll can be linked])
-  AC_LINK_IFELSE([
-    AC_LANG_PROGRAM([[
-      $curl_includes_poll
-    ]],[[
-      if(0 != poll(0, 0, 0))
-        return 1;
-    ]])
-  ],[
-    AC_MSG_RESULT([yes])
-    tst_links_poll="yes"
-  ],[
-    AC_MSG_RESULT([no])
-    tst_links_poll="no"
-  ])
-  #
-  if test "$tst_links_poll" = "yes"; then
-    AC_MSG_CHECKING([if poll is prototyped])
-    AC_EGREP_CPP([poll],[
-      $curl_includes_poll
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_proto_poll="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_proto_poll="no"
-    ])
-  fi
-  #
-  if test "$tst_proto_poll" = "yes"; then
-    AC_MSG_CHECKING([if poll is compilable])
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-        $curl_includes_poll
-      ]],[[
-        if(0 != poll(0, 0, 0))
-          return 1;
-      ]])
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_compi_poll="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_compi_poll="no"
-    ])
-  fi
-  #
-  dnl only do runtime verification when not cross-compiling
-  if test "x$cross_compiling" != "xyes" &&
-    test "$tst_compi_poll" = "yes"; then
-    AC_MSG_CHECKING([if poll seems to work])
-    CURL_RUN_IFELSE([
-      AC_LANG_PROGRAM([[
-        $curl_includes_stdlib
-        $curl_includes_poll
-        $curl_includes_time
-      ]],[[
-        /* detect the original poll() breakage */
-        if(0 != poll(0, 0, 10))
-          exit(1); /* fail */
-        else {
-          /* detect the 10.12 poll() breakage */
-          struct timeval before, after;
-          int rc;
-          size_t us;
-
-          gettimeofday(&before, NULL);
-          rc = poll(NULL, 0, 500);
-          gettimeofday(&after, NULL);
-
-          us = (after.tv_sec - before.tv_sec) * 1000000 +
-            (after.tv_usec - before.tv_usec);
-
-          if(us < 400000)
-            exit(1);
-        }
-      ]])
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_works_poll="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_works_poll="no"
-    ])
-  fi
-  #
-  if test "$tst_compi_poll" = "yes" &&
-    test "$tst_works_poll" != "no"; then
-    AC_MSG_CHECKING([if poll usage allowed])
-    if test "x$curl_disallow_poll" != "xyes"; then
-      AC_MSG_RESULT([yes])
-      tst_allow_poll="yes"
-    else
-      AC_MSG_RESULT([no])
-      tst_allow_poll="no"
-    fi
-  fi
-  #
-  AC_MSG_CHECKING([if poll might be used])
-  if test "$tst_links_poll" = "yes" &&
-     test "$tst_proto_poll" = "yes" &&
-     test "$tst_compi_poll" = "yes" &&
-     test "$tst_allow_poll" = "yes" &&
-     test "$tst_works_poll" != "no"; then
-    AC_MSG_RESULT([yes])
-    AC_DEFINE_UNQUOTED(HAVE_POLL_FINE, 1,
-      [If you have a fine poll])
-    curl_cv_func_poll="yes"
-  else
-    AC_MSG_RESULT([no])
-    curl_cv_func_poll="no"
-  fi
-])
-
-
-dnl CURL_CHECK_FUNC_REMOVEXATTR
-dnl -------------------------------------------------
-dnl Verify if removexattr is available, prototyped, and
-dnl can be compiled. If all of these are true, and
-dnl usage has not been previously disallowed with
-dnl shell variable curl_disallow_removexattr, then
-dnl HAVE_REMOVEXATTR will be defined.
-
-AC_DEFUN([CURL_CHECK_FUNC_REMOVEXATTR], [
-  AC_REQUIRE([CURL_INCLUDES_SYS_XATTR])dnl
-  #
-  tst_links_removexattr="unknown"
-  tst_proto_removexattr="unknown"
-  tst_compi_removexattr="unknown"
-  tst_allow_removexattr="unknown"
-  tst_nargs_removexattr="unknown"
-  #
-  AC_MSG_CHECKING([if removexattr can be linked])
-  AC_LINK_IFELSE([
-    AC_LANG_FUNC_LINK_TRY([removexattr])
-  ],[
-    AC_MSG_RESULT([yes])
-    tst_links_removexattr="yes"
-  ],[
-    AC_MSG_RESULT([no])
-    tst_links_removexattr="no"
-  ])
-  #
-  if test "$tst_links_removexattr" = "yes"; then
-    AC_MSG_CHECKING([if removexattr is prototyped])
-    AC_EGREP_CPP([removexattr],[
-      $curl_includes_sys_xattr
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_proto_removexattr="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_proto_removexattr="no"
-    ])
-  fi
-  #
-  if test "$tst_proto_removexattr" = "yes"; then
-    if test "$tst_nargs_removexattr" = "unknown"; then
-      AC_MSG_CHECKING([if removexattr takes 2 args.])
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-          $curl_includes_sys_xattr
-        ]],[[
-          if(0 != removexattr(0, 0))
-            return 1;
-        ]])
-      ],[
-        AC_MSG_RESULT([yes])
-        tst_compi_removexattr="yes"
-        tst_nargs_removexattr="2"
-      ],[
-        AC_MSG_RESULT([no])
-        tst_compi_removexattr="no"
-      ])
-    fi
-    if test "$tst_nargs_removexattr" = "unknown"; then
-      AC_MSG_CHECKING([if removexattr takes 3 args.])
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-          $curl_includes_sys_xattr
-        ]],[[
-          if(0 != removexattr(0, 0, 0))
-            return 1;
-        ]])
-      ],[
-        AC_MSG_RESULT([yes])
-        tst_compi_removexattr="yes"
-        tst_nargs_removexattr="3"
-      ],[
-        AC_MSG_RESULT([no])
-        tst_compi_removexattr="no"
-      ])
-    fi
-    AC_MSG_CHECKING([if removexattr is compilable])
-    if test "$tst_compi_removexattr" = "yes"; then
-      AC_MSG_RESULT([yes])
-    else
-      AC_MSG_RESULT([no])
-    fi
-  fi
-  #
-  if test "$tst_compi_removexattr" = "yes"; then
-    AC_MSG_CHECKING([if removexattr usage allowed])
-    if test "x$curl_disallow_removexattr" != "xyes"; then
-      AC_MSG_RESULT([yes])
-      tst_allow_removexattr="yes"
-    else
-      AC_MSG_RESULT([no])
-      tst_allow_removexattr="no"
-    fi
-  fi
-  #
-  AC_MSG_CHECKING([if removexattr might be used])
-  if test "$tst_links_removexattr" = "yes" &&
-     test "$tst_proto_removexattr" = "yes" &&
-     test "$tst_compi_removexattr" = "yes" &&
-     test "$tst_allow_removexattr" = "yes"; then
-    AC_MSG_RESULT([yes])
-    AC_DEFINE_UNQUOTED(HAVE_REMOVEXATTR, 1,
-      [Define to 1 if you have the removexattr function.])
-    dnl AC_DEFINE_UNQUOTED(REMOVEXATTR_ARGS, $tst_nargs_removexattr,
-    dnl   [Specifies the number of arguments to removexattr])
-    #
-    if test "$tst_nargs_removexattr" -eq "2"; then
-      AC_DEFINE(HAVE_REMOVEXATTR_2, 1, [removexattr() takes 2 args])
-    elif test "$tst_nargs_removexattr" -eq "3"; then
-      AC_DEFINE(HAVE_REMOVEXATTR_3, 1, [removexattr() takes 3 args])
-    fi
-    #
-    curl_cv_func_removexattr="yes"
-  else
-    AC_MSG_RESULT([no])
-    curl_cv_func_removexattr="no"
-  fi
-])
-
-
-dnl CURL_CHECK_FUNC_SETSOCKOPT_SO_NONBLOCK
-dnl -------------------------------------------------
-dnl Verify if setsockopt with the SO_NONBLOCK command is
-dnl available, can be compiled, and seems to work. If
-dnl all of these are true, then HAVE_SETSOCKOPT_SO_NONBLOCK
-dnl will be defined.
-
-AC_DEFUN([CURL_CHECK_FUNC_SETSOCKOPT_SO_NONBLOCK], [
-  #
-  tst_compi_setsockopt_so_nonblock="unknown"
-  tst_allow_setsockopt_so_nonblock="unknown"
-  #
-  if test "$curl_cv_func_setsockopt" = "yes"; then
-    AC_MSG_CHECKING([if setsockopt SO_NONBLOCK is compilable])
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-        $curl_includes_winsock2
-        $curl_includes_bsdsocket
-        $curl_includes_sys_socket
-      ]],[[
-        if(0 != setsockopt(0, SOL_SOCKET, SO_NONBLOCK, 0, 0))
-          return 1;
-      ]])
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_compi_setsockopt_so_nonblock="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_compi_setsockopt_so_nonblock="no"
-    ])
-  fi
-  #
-  if test "$tst_compi_setsockopt_so_nonblock" = "yes"; then
-    AC_MSG_CHECKING([if setsockopt SO_NONBLOCK usage allowed])
-    if test "x$curl_disallow_setsockopt_so_nonblock" != "xyes"; then
-      AC_MSG_RESULT([yes])
-      tst_allow_setsockopt_so_nonblock="yes"
-    else
-      AC_MSG_RESULT([no])
-      tst_allow_setsockopt_so_nonblock="no"
-    fi
-  fi
-  #
-  AC_MSG_CHECKING([if setsockopt SO_NONBLOCK might be used])
-  if test "$tst_compi_setsockopt_so_nonblock" = "yes" &&
-     test "$tst_allow_setsockopt_so_nonblock" = "yes"; then
-    AC_MSG_RESULT([yes])
-    AC_DEFINE_UNQUOTED(HAVE_SETSOCKOPT_SO_NONBLOCK, 1,
-      [Define to 1 if you have a working setsockopt SO_NONBLOCK function.])
-    curl_cv_func_setsockopt_so_nonblock="yes"
-  else
-    AC_MSG_RESULT([no])
-    curl_cv_func_setsockopt_so_nonblock="no"
-  fi
-])
-
-
-dnl CURL_CHECK_FUNC_SETXATTR
-dnl -------------------------------------------------
-dnl Verify if setxattr is available, prototyped, and
-dnl can be compiled. If all of these are true, and
-dnl usage has not been previously disallowed with
-dnl shell variable curl_disallow_setxattr, then
-dnl HAVE_SETXATTR will be defined.
-
-AC_DEFUN([CURL_CHECK_FUNC_SETXATTR], [
-  AC_REQUIRE([CURL_INCLUDES_SYS_XATTR])dnl
-  #
-  tst_links_setxattr="unknown"
-  tst_proto_setxattr="unknown"
-  tst_compi_setxattr="unknown"
-  tst_allow_setxattr="unknown"
-  tst_nargs_setxattr="unknown"
-  #
-  AC_MSG_CHECKING([if setxattr can be linked])
-  AC_LINK_IFELSE([
-    AC_LANG_FUNC_LINK_TRY([setxattr])
-  ],[
-    AC_MSG_RESULT([yes])
-    tst_links_setxattr="yes"
-  ],[
-    AC_MSG_RESULT([no])
-    tst_links_setxattr="no"
-  ])
-  #
-  if test "$tst_links_setxattr" = "yes"; then
-    AC_MSG_CHECKING([if setxattr is prototyped])
-    AC_EGREP_CPP([setxattr],[
-      $curl_includes_sys_xattr
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_proto_setxattr="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_proto_setxattr="no"
-    ])
-  fi
-  #
-  if test "$tst_proto_setxattr" = "yes"; then
-    if test "$tst_nargs_setxattr" = "unknown"; then
-      AC_MSG_CHECKING([if setxattr takes 5 args.])
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-          $curl_includes_sys_xattr
-        ]],[[
-          if(0 != setxattr(0, 0, 0, 0, 0))
-            return 1;
-        ]])
-      ],[
-        AC_MSG_RESULT([yes])
-        tst_compi_setxattr="yes"
-        tst_nargs_setxattr="5"
-      ],[
-        AC_MSG_RESULT([no])
-        tst_compi_setxattr="no"
-      ])
-    fi
-    if test "$tst_nargs_setxattr" = "unknown"; then
-      AC_MSG_CHECKING([if setxattr takes 6 args.])
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-          $curl_includes_sys_xattr
-        ]],[[
-          if(0 != setxattr(0, 0, 0, 0, 0, 0))
-            return 1;
-        ]])
-      ],[
-        AC_MSG_RESULT([yes])
-        tst_compi_setxattr="yes"
-        tst_nargs_setxattr="6"
-      ],[
-        AC_MSG_RESULT([no])
-        tst_compi_setxattr="no"
-      ])
-    fi
-    AC_MSG_CHECKING([if setxattr is compilable])
-    if test "$tst_compi_setxattr" = "yes"; then
-      AC_MSG_RESULT([yes])
-    else
-      AC_MSG_RESULT([no])
-    fi
-  fi
-  #
-  if test "$tst_compi_setxattr" = "yes"; then
-    AC_MSG_CHECKING([if setxattr usage allowed])
-    if test "x$curl_disallow_setxattr" != "xyes"; then
-      AC_MSG_RESULT([yes])
-      tst_allow_setxattr="yes"
-    else
-      AC_MSG_RESULT([no])
-      tst_allow_setxattr="no"
-    fi
-  fi
-  #
-  AC_MSG_CHECKING([if setxattr might be used])
-  if test "$tst_links_setxattr" = "yes" &&
-     test "$tst_proto_setxattr" = "yes" &&
-     test "$tst_compi_setxattr" = "yes" &&
-     test "$tst_allow_setxattr" = "yes"; then
-    AC_MSG_RESULT([yes])
-    AC_DEFINE_UNQUOTED(HAVE_SETXATTR, 1,
-      [Define to 1 if you have the setxattr function.])
-    dnl AC_DEFINE_UNQUOTED(SETXATTR_ARGS, $tst_nargs_setxattr,
-    dnl   [Specifies the number of arguments to setxattr])
-    #
-    if test "$tst_nargs_setxattr" -eq "5"; then
-      AC_DEFINE(HAVE_SETXATTR_5, 1, [setxattr() takes 5 args])
-    elif test "$tst_nargs_setxattr" -eq "6"; then
-      AC_DEFINE(HAVE_SETXATTR_6, 1, [setxattr() takes 6 args])
-    fi
-    #
-    curl_cv_func_setxattr="yes"
-  else
-    AC_MSG_RESULT([no])
-    curl_cv_func_setxattr="no"
-  fi
-])
-
-
 dnl CURL_CHECK_FUNC_SIGACTION
 dnl -------------------------------------------------
 dnl Verify if sigaction is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_sigaction, then
-dnl HAVE_SIGACTION will be defined.
+dnl HAVE_SIGACTION is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_SIGACTION], [
-  AC_REQUIRE([CURL_INCLUDES_SIGNAL])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_SIGNAL])
+
   tst_links_sigaction="unknown"
   tst_proto_sigaction="unknown"
   tst_compi_sigaction="unknown"
   tst_allow_sigaction="unknown"
-  #
+
   AC_MSG_CHECKING([if sigaction can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([sigaction])
@@ -4558,7 +3161,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SIGACTION], [
     AC_MSG_RESULT([no])
     tst_links_sigaction="no"
   ])
-  #
+
   if test "$tst_links_sigaction" = "yes"; then
     AC_MSG_CHECKING([if sigaction is prototyped])
     AC_EGREP_CPP([sigaction],[
@@ -4571,14 +3174,14 @@ AC_DEFUN([CURL_CHECK_FUNC_SIGACTION], [
       tst_proto_sigaction="no"
     ])
   fi
-  #
+
   if test "$tst_proto_sigaction" = "yes"; then
     AC_MSG_CHECKING([if sigaction is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_signal
       ]],[[
-        if(0 != sigaction(0, 0, 0))
+        if(sigaction(0, 0, 0))
           return 1;
       ]])
     ],[
@@ -4589,7 +3192,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SIGACTION], [
       tst_compi_sigaction="no"
     ])
   fi
-  #
+
   if test "$tst_compi_sigaction" = "yes"; then
     AC_MSG_CHECKING([if sigaction usage allowed])
     if test "x$curl_disallow_sigaction" != "xyes"; then
@@ -4600,7 +3203,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SIGACTION], [
       tst_allow_sigaction="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if sigaction might be used])
   if test "$tst_links_sigaction" = "yes" &&
      test "$tst_proto_sigaction" = "yes" &&
@@ -4623,16 +3226,16 @@ dnl Verify if siginterrupt is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_siginterrupt, then
-dnl HAVE_SIGINTERRUPT will be defined.
+dnl HAVE_SIGINTERRUPT is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_SIGINTERRUPT], [
-  AC_REQUIRE([CURL_INCLUDES_SIGNAL])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_SIGNAL])
+
   tst_links_siginterrupt="unknown"
   tst_proto_siginterrupt="unknown"
   tst_compi_siginterrupt="unknown"
   tst_allow_siginterrupt="unknown"
-  #
+
   AC_MSG_CHECKING([if siginterrupt can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([siginterrupt])
@@ -4643,7 +3246,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SIGINTERRUPT], [
     AC_MSG_RESULT([no])
     tst_links_siginterrupt="no"
   ])
-  #
+
   if test "$tst_links_siginterrupt" = "yes"; then
     AC_MSG_CHECKING([if siginterrupt is prototyped])
     AC_EGREP_CPP([siginterrupt],[
@@ -4656,14 +3259,14 @@ AC_DEFUN([CURL_CHECK_FUNC_SIGINTERRUPT], [
       tst_proto_siginterrupt="no"
     ])
   fi
-  #
+
   if test "$tst_proto_siginterrupt" = "yes"; then
     AC_MSG_CHECKING([if siginterrupt is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_signal
       ]],[[
-        if(0 != siginterrupt(0, 0))
+        if(siginterrupt(0, 0))
           return 1;
       ]])
     ],[
@@ -4674,7 +3277,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SIGINTERRUPT], [
       tst_compi_siginterrupt="no"
     ])
   fi
-  #
+
   if test "$tst_compi_siginterrupt" = "yes"; then
     AC_MSG_CHECKING([if siginterrupt usage allowed])
     if test "x$curl_disallow_siginterrupt" != "xyes"; then
@@ -4685,7 +3288,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SIGINTERRUPT], [
       tst_allow_siginterrupt="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if siginterrupt might be used])
   if test "$tst_links_siginterrupt" = "yes" &&
      test "$tst_proto_siginterrupt" = "yes" &&
@@ -4708,16 +3311,16 @@ dnl Verify if signal is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_signal, then
-dnl HAVE_SIGNAL will be defined.
+dnl HAVE_SIGNAL is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_SIGNAL], [
-  AC_REQUIRE([CURL_INCLUDES_SIGNAL])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_SIGNAL])
+
   tst_links_signal="unknown"
   tst_proto_signal="unknown"
   tst_compi_signal="unknown"
   tst_allow_signal="unknown"
-  #
+
   AC_MSG_CHECKING([if signal can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([signal])
@@ -4728,7 +3331,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SIGNAL], [
     AC_MSG_RESULT([no])
     tst_links_signal="no"
   ])
-  #
+
   if test "$tst_links_signal" = "yes"; then
     AC_MSG_CHECKING([if signal is prototyped])
     AC_EGREP_CPP([signal],[
@@ -4741,14 +3344,14 @@ AC_DEFUN([CURL_CHECK_FUNC_SIGNAL], [
       tst_proto_signal="no"
     ])
   fi
-  #
+
   if test "$tst_proto_signal" = "yes"; then
     AC_MSG_CHECKING([if signal is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_signal
       ]],[[
-        if(0 != signal(0, 0))
+        if(signal(0, 0))
           return 1;
       ]])
     ],[
@@ -4759,7 +3362,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SIGNAL], [
       tst_compi_signal="no"
     ])
   fi
-  #
+
   if test "$tst_compi_signal" = "yes"; then
     AC_MSG_CHECKING([if signal usage allowed])
     if test "x$curl_disallow_signal" != "xyes"; then
@@ -4770,7 +3373,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SIGNAL], [
       tst_allow_signal="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if signal might be used])
   if test "$tst_links_signal" = "yes" &&
      test "$tst_proto_signal" = "yes" &&
@@ -4793,17 +3396,17 @@ dnl Verify if sigsetjmp is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_sigsetjmp, then
-dnl HAVE_SIGSETJMP will be defined.
+dnl HAVE_SIGSETJMP is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_SIGSETJMP], [
-  AC_REQUIRE([CURL_INCLUDES_SETJMP])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_SETJMP])
+
   tst_links_sigsetjmp="unknown"
   tst_macro_sigsetjmp="unknown"
   tst_proto_sigsetjmp="unknown"
   tst_compi_sigsetjmp="unknown"
   tst_allow_sigsetjmp="unknown"
-  #
+
   AC_MSG_CHECKING([if sigsetjmp can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([sigsetjmp])
@@ -4814,7 +3417,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SIGSETJMP], [
     AC_MSG_RESULT([no])
     tst_links_sigsetjmp="no"
   ])
-  #
+
   if test "$tst_links_sigsetjmp" = "no"; then
     AC_MSG_CHECKING([if sigsetjmp seems a macro])
     AC_LINK_IFELSE([
@@ -4822,7 +3425,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SIGSETJMP], [
         $curl_includes_setjmp
       ]],[[
         sigjmp_buf env;
-        if(0 != sigsetjmp(env, 0))
+        if(sigsetjmp(env, 0))
           return 1;
       ]])
     ],[
@@ -4833,7 +3436,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SIGSETJMP], [
       tst_macro_sigsetjmp="no"
     ])
   fi
-  #
+
   if test "$tst_links_sigsetjmp" = "yes"; then
     AC_MSG_CHECKING([if sigsetjmp is prototyped])
     AC_EGREP_CPP([sigsetjmp],[
@@ -4846,7 +3449,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SIGSETJMP], [
       tst_proto_sigsetjmp="no"
     ])
   fi
-  #
+
   if test "$tst_proto_sigsetjmp" = "yes" ||
      test "$tst_macro_sigsetjmp" = "yes"; then
     AC_MSG_CHECKING([if sigsetjmp is compilable])
@@ -4855,7 +3458,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SIGSETJMP], [
         $curl_includes_setjmp
       ]],[[
         sigjmp_buf env;
-        if(0 != sigsetjmp(env, 0))
+        if(sigsetjmp(env, 0))
           return 1;
       ]])
     ],[
@@ -4866,7 +3469,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SIGSETJMP], [
       tst_compi_sigsetjmp="no"
     ])
   fi
-  #
+
   if test "$tst_compi_sigsetjmp" = "yes"; then
     AC_MSG_CHECKING([if sigsetjmp usage allowed])
     if test "x$curl_disallow_sigsetjmp" != "xyes"; then
@@ -4877,7 +3480,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SIGSETJMP], [
       tst_allow_sigsetjmp="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if sigsetjmp might be used])
   if (test "$tst_proto_sigsetjmp" = "yes" ||
       test "$tst_macro_sigsetjmp" = "yes") &&
@@ -4900,27 +3503,25 @@ dnl Verify if socket is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_socket, then
-dnl HAVE_SOCKET will be defined.
+dnl HAVE_SOCKET is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_SOCKET], [
-  AC_REQUIRE([CURL_INCLUDES_WINSOCK2])dnl
-  AC_REQUIRE([CURL_INCLUDES_SYS_SOCKET])dnl
-  AC_REQUIRE([CURL_INCLUDES_SOCKET])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_WINSOCK2])
+  AC_REQUIRE([CURL_INCLUDES_SYS_SOCKET])
+
   tst_links_socket="unknown"
   tst_proto_socket="unknown"
   tst_compi_socket="unknown"
   tst_allow_socket="unknown"
-  #
+
   AC_MSG_CHECKING([if socket can be linked])
   AC_LINK_IFELSE([
     AC_LANG_PROGRAM([[
       $curl_includes_winsock2
       $curl_includes_bsdsocket
       $curl_includes_sys_socket
-      $curl_includes_socket
     ]],[[
-      if(0 != socket(0, 0, 0))
+      if(socket(0, 0, 0))
         return 1;
     ]])
   ],[
@@ -4930,14 +3531,13 @@ AC_DEFUN([CURL_CHECK_FUNC_SOCKET], [
     AC_MSG_RESULT([no])
     tst_links_socket="no"
   ])
-  #
+
   if test "$tst_links_socket" = "yes"; then
     AC_MSG_CHECKING([if socket is prototyped])
     AC_EGREP_CPP([socket],[
       $curl_includes_winsock2
       $curl_includes_bsdsocket
       $curl_includes_sys_socket
-      $curl_includes_socket
     ],[
       AC_MSG_RESULT([yes])
       tst_proto_socket="yes"
@@ -4946,7 +3546,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SOCKET], [
       tst_proto_socket="no"
     ])
   fi
-  #
+
   if test "$tst_proto_socket" = "yes"; then
     AC_MSG_CHECKING([if socket is compilable])
     AC_COMPILE_IFELSE([
@@ -4954,9 +3554,8 @@ AC_DEFUN([CURL_CHECK_FUNC_SOCKET], [
         $curl_includes_winsock2
         $curl_includes_bsdsocket
         $curl_includes_sys_socket
-        $curl_includes_socket
       ]],[[
-        if(0 != socket(0, 0, 0))
+        if(socket(0, 0, 0))
           return 1;
       ]])
     ],[
@@ -4967,7 +3566,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SOCKET], [
       tst_compi_socket="no"
     ])
   fi
-  #
+
   if test "$tst_compi_socket" = "yes"; then
     AC_MSG_CHECKING([if socket usage allowed])
     if test "x$curl_disallow_socket" != "xyes"; then
@@ -4978,7 +3577,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SOCKET], [
       tst_allow_socket="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if socket might be used])
   if test "$tst_links_socket" = "yes" &&
      test "$tst_proto_socket" = "yes" &&
@@ -5001,17 +3600,16 @@ dnl Verify if socketpair is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_socketpair, then
-dnl HAVE_SOCKETPAIR will be defined.
+dnl HAVE_SOCKETPAIR is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_SOCKETPAIR], [
-  AC_REQUIRE([CURL_INCLUDES_SYS_SOCKET])dnl
-  AC_REQUIRE([CURL_INCLUDES_SOCKET])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_SYS_SOCKET])
+
   tst_links_socketpair="unknown"
   tst_proto_socketpair="unknown"
   tst_compi_socketpair="unknown"
   tst_allow_socketpair="unknown"
-  #
+
   AC_MSG_CHECKING([if socketpair can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([socketpair])
@@ -5022,12 +3620,11 @@ AC_DEFUN([CURL_CHECK_FUNC_SOCKETPAIR], [
     AC_MSG_RESULT([no])
     tst_links_socketpair="no"
   ])
-  #
+
   if test "$tst_links_socketpair" = "yes"; then
     AC_MSG_CHECKING([if socketpair is prototyped])
     AC_EGREP_CPP([socketpair],[
       $curl_includes_sys_socket
-      $curl_includes_socket
     ],[
       AC_MSG_RESULT([yes])
       tst_proto_socketpair="yes"
@@ -5036,16 +3633,15 @@ AC_DEFUN([CURL_CHECK_FUNC_SOCKETPAIR], [
       tst_proto_socketpair="no"
     ])
   fi
-  #
+
   if test "$tst_proto_socketpair" = "yes"; then
     AC_MSG_CHECKING([if socketpair is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_sys_socket
-        $curl_includes_socket
       ]],[[
         int sv[2];
-        if(0 != socketpair(0, 0, 0, sv))
+        if(socketpair(0, 0, 0, sv))
           return 1;
       ]])
     ],[
@@ -5056,7 +3652,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SOCKETPAIR], [
       tst_compi_socketpair="no"
     ])
   fi
-  #
+
   if test "$tst_compi_socketpair" = "yes"; then
     AC_MSG_CHECKING([if socketpair usage allowed])
     if test "x$curl_disallow_socketpair" != "xyes"; then
@@ -5067,7 +3663,7 @@ AC_DEFUN([CURL_CHECK_FUNC_SOCKETPAIR], [
       tst_allow_socketpair="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if socketpair might be used])
   if test "$tst_links_socketpair" = "yes" &&
      test "$tst_proto_socketpair" = "yes" &&
@@ -5090,16 +3686,16 @@ dnl Verify if strcasecmp is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_strcasecmp, then
-dnl HAVE_STRCASECMP will be defined.
+dnl HAVE_STRCASECMP is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_STRCASECMP], [
-  AC_REQUIRE([CURL_INCLUDES_STRING])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_STRING])
+
   tst_links_strcasecmp="unknown"
   tst_proto_strcasecmp="unknown"
   tst_compi_strcasecmp="unknown"
   tst_allow_strcasecmp="unknown"
-  #
+
   AC_MSG_CHECKING([if strcasecmp can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([strcasecmp])
@@ -5110,7 +3706,7 @@ AC_DEFUN([CURL_CHECK_FUNC_STRCASECMP], [
     AC_MSG_RESULT([no])
     tst_links_strcasecmp="no"
   ])
-  #
+
   if test "$tst_links_strcasecmp" = "yes"; then
     AC_MSG_CHECKING([if strcasecmp is prototyped])
     AC_EGREP_CPP([strcasecmp],[
@@ -5123,14 +3719,14 @@ AC_DEFUN([CURL_CHECK_FUNC_STRCASECMP], [
       tst_proto_strcasecmp="no"
     ])
   fi
-  #
+
   if test "$tst_proto_strcasecmp" = "yes"; then
     AC_MSG_CHECKING([if strcasecmp is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_string
       ]],[[
-        if(0 != strcasecmp(0, 0))
+        if(strcasecmp("", ""))
           return 1;
       ]])
     ],[
@@ -5141,7 +3737,7 @@ AC_DEFUN([CURL_CHECK_FUNC_STRCASECMP], [
       tst_compi_strcasecmp="no"
     ])
   fi
-  #
+
   if test "$tst_compi_strcasecmp" = "yes"; then
     AC_MSG_CHECKING([if strcasecmp usage allowed])
     if test "x$curl_disallow_strcasecmp" != "xyes"; then
@@ -5152,7 +3748,7 @@ AC_DEFUN([CURL_CHECK_FUNC_STRCASECMP], [
       tst_allow_strcasecmp="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if strcasecmp might be used])
   if test "$tst_links_strcasecmp" = "yes" &&
      test "$tst_proto_strcasecmp" = "yes" &&
@@ -5174,16 +3770,16 @@ dnl Verify if strcmpi is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_strcmpi, then
-dnl HAVE_STRCMPI will be defined.
+dnl HAVE_STRCMPI is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_STRCMPI], [
-  AC_REQUIRE([CURL_INCLUDES_STRING])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_STRING])
+
   tst_links_strcmpi="unknown"
   tst_proto_strcmpi="unknown"
   tst_compi_strcmpi="unknown"
   tst_allow_strcmpi="unknown"
-  #
+
   AC_MSG_CHECKING([if strcmpi can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([strcmpi])
@@ -5194,7 +3790,7 @@ AC_DEFUN([CURL_CHECK_FUNC_STRCMPI], [
     AC_MSG_RESULT([no])
     tst_links_strcmpi="no"
   ])
-  #
+
   if test "$tst_links_strcmpi" = "yes"; then
     AC_MSG_CHECKING([if strcmpi is prototyped])
     AC_EGREP_CPP([strcmpi],[
@@ -5207,14 +3803,14 @@ AC_DEFUN([CURL_CHECK_FUNC_STRCMPI], [
       tst_proto_strcmpi="no"
     ])
   fi
-  #
+
   if test "$tst_proto_strcmpi" = "yes"; then
     AC_MSG_CHECKING([if strcmpi is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_string
       ]],[[
-        if(0 != strcmpi(0, 0))
+        if(strcmpi(0, 0))
           return 1;
       ]])
     ],[
@@ -5225,7 +3821,7 @@ AC_DEFUN([CURL_CHECK_FUNC_STRCMPI], [
       tst_compi_strcmpi="no"
     ])
   fi
-  #
+
   if test "$tst_compi_strcmpi" = "yes"; then
     AC_MSG_CHECKING([if strcmpi usage allowed])
     if test "x$curl_disallow_strcmpi" != "xyes"; then
@@ -5236,7 +3832,7 @@ AC_DEFUN([CURL_CHECK_FUNC_STRCMPI], [
       tst_allow_strcmpi="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if strcmpi might be used])
   if test "$tst_links_strcmpi" = "yes" &&
      test "$tst_proto_strcmpi" = "yes" &&
@@ -5253,97 +3849,12 @@ AC_DEFUN([CURL_CHECK_FUNC_STRCMPI], [
 ])
 
 
-dnl CURL_CHECK_FUNC_STRDUP
-dnl -------------------------------------------------
-dnl Verify if strdup is available, prototyped, and
-dnl can be compiled. If all of these are true, and
-dnl usage has not been previously disallowed with
-dnl shell variable curl_disallow_strdup, then
-dnl HAVE_STRDUP will be defined.
-
-AC_DEFUN([CURL_CHECK_FUNC_STRDUP], [
-  AC_REQUIRE([CURL_INCLUDES_STRING])dnl
-  #
-  tst_links_strdup="unknown"
-  tst_proto_strdup="unknown"
-  tst_compi_strdup="unknown"
-  tst_allow_strdup="unknown"
-  #
-  AC_MSG_CHECKING([if strdup can be linked])
-  AC_LINK_IFELSE([
-    AC_LANG_FUNC_LINK_TRY([strdup])
-  ],[
-    AC_MSG_RESULT([yes])
-    tst_links_strdup="yes"
-  ],[
-    AC_MSG_RESULT([no])
-    tst_links_strdup="no"
-  ])
-  #
-  if test "$tst_links_strdup" = "yes"; then
-    AC_MSG_CHECKING([if strdup is prototyped])
-    AC_EGREP_CPP([strdup],[
-      $curl_includes_string
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_proto_strdup="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_proto_strdup="no"
-    ])
-  fi
-  #
-  if test "$tst_proto_strdup" = "yes"; then
-    AC_MSG_CHECKING([if strdup is compilable])
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-        $curl_includes_string
-      ]],[[
-        if(0 != strdup(0))
-          return 1;
-      ]])
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_compi_strdup="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_compi_strdup="no"
-    ])
-  fi
-  #
-  if test "$tst_compi_strdup" = "yes"; then
-    AC_MSG_CHECKING([if strdup usage allowed])
-    if test "x$curl_disallow_strdup" != "xyes"; then
-      AC_MSG_RESULT([yes])
-      tst_allow_strdup="yes"
-    else
-      AC_MSG_RESULT([no])
-      tst_allow_strdup="no"
-    fi
-  fi
-  #
-  AC_MSG_CHECKING([if strdup might be used])
-  if test "$tst_links_strdup" = "yes" &&
-     test "$tst_proto_strdup" = "yes" &&
-     test "$tst_compi_strdup" = "yes" &&
-     test "$tst_allow_strdup" = "yes"; then
-    AC_MSG_RESULT([yes])
-    AC_DEFINE_UNQUOTED(HAVE_STRDUP, 1,
-      [Define to 1 if you have the strdup function.])
-    curl_cv_func_strdup="yes"
-  else
-    AC_MSG_RESULT([no])
-    curl_cv_func_strdup="no"
-  fi
-])
-
-
 dnl CURL_CHECK_FUNC_STRERROR_R
 dnl -------------------------------------------------
 dnl Verify if strerror_r is available, prototyped, can be compiled and
 dnl seems to work. If all of these are true, and usage has not been
 dnl previously disallowed with shell variable curl_disallow_strerror_r,
-dnl then HAVE_STRERROR_R will be defined, as well as one of
+dnl then HAVE_STRERROR_R is defined, as well as one of
 dnl HAVE_GLIBC_STRERROR_R or HAVE_POSIX_STRERROR_R.
 dnl
 dnl glibc-style strerror_r:
@@ -5352,7 +3863,7 @@ dnl      char *strerror_r(int errnum, char *workbuf, size_t bufsize);
 dnl
 dnl  glibc-style strerror_r returns a pointer to the error string,
 dnl  and might use the provided workbuf as a scratch area if needed. A
-dnl  quick test on a few systems shows that it's usually not used at all.
+dnl  quick test on a few systems shows that it is usually not used at all.
 dnl
 dnl POSIX-style strerror_r:
 dnl
@@ -5363,9 +3874,9 @@ dnl  error string in the provided resultbuf.
 dnl
 
 AC_DEFUN([CURL_CHECK_FUNC_STRERROR_R], [
-  AC_REQUIRE([CURL_INCLUDES_STDLIB])dnl
-  AC_REQUIRE([CURL_INCLUDES_STRING])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_STDLIB])
+  AC_REQUIRE([CURL_INCLUDES_STRING])
+
   tst_links_strerror_r="unknown"
   tst_proto_strerror_r="unknown"
   tst_compi_strerror_r="unknown"
@@ -5376,7 +3887,7 @@ AC_DEFUN([CURL_CHECK_FUNC_STRERROR_R], [
   tst_works_posix_strerror_r="unknown"
   tst_glibc_strerror_r_type_arg3="unknown"
   tst_posix_strerror_r_type_arg3="unknown"
-  #
+
   AC_MSG_CHECKING([if strerror_r can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([strerror_r])
@@ -5387,7 +3898,7 @@ AC_DEFUN([CURL_CHECK_FUNC_STRERROR_R], [
     AC_MSG_RESULT([no])
     tst_links_strerror_r="no"
   ])
-  #
+
   if test "$tst_links_strerror_r" = "yes"; then
     AC_MSG_CHECKING([if strerror_r is prototyped])
     AC_EGREP_CPP([strerror_r],[
@@ -5400,14 +3911,15 @@ AC_DEFUN([CURL_CHECK_FUNC_STRERROR_R], [
       tst_proto_strerror_r="no"
     ])
   fi
-  #
+
   if test "$tst_proto_strerror_r" = "yes"; then
     AC_MSG_CHECKING([if strerror_r is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_string
       ]],[[
-        if(0 != strerror_r(0, 0, 0))
+        char s[1];
+        if(strerror_r(0, s, 0))
           return 1;
       ]])
     ],[
@@ -5418,7 +3930,7 @@ AC_DEFUN([CURL_CHECK_FUNC_STRERROR_R], [
       tst_compi_strerror_r="no"
     ])
   fi
-  #
+
   if test "$tst_compi_strerror_r" = "yes"; then
     AC_MSG_CHECKING([if strerror_r is glibc like])
     tst_glibc_strerror_r_type_arg3="unknown"
@@ -5429,8 +3941,10 @@ AC_DEFUN([CURL_CHECK_FUNC_STRERROR_R], [
             $curl_includes_string
             char *strerror_r(int errnum, char *workbuf, $arg3 bufsize);
           ]],[[
-            if(0 != strerror_r(0, 0, 0))
+            char s[1];
+            if(strerror_r(0, s, 0))
               return 1;
+            (void)s;
           ]])
         ],[
           tst_glibc_strerror_r_type_arg3="$arg3"
@@ -5448,27 +3962,27 @@ AC_DEFUN([CURL_CHECK_FUNC_STRERROR_R], [
         ;;
     esac
   fi
-  #
+
   dnl only do runtime verification when not cross-compiling
-  if test "x$cross_compiling" != "xyes" &&
+  if test "$cross_compiling" != "yes" &&
     test "$tst_glibc_strerror_r" = "yes"; then
     AC_MSG_CHECKING([if strerror_r seems to work])
     CURL_RUN_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_stdlib
         $curl_includes_string
-#       include <errno.h>
+        #include <errno.h>
       ]],[[
         char buffer[1024];
         char *string = 0;
         buffer[0] = '\0';
         string = strerror_r(EACCES, buffer, sizeof(buffer));
         if(!string)
-          exit(1); /* fail */
+          return 1; /* fail */
         if(!string[0])
-          exit(1); /* fail */
+          return 1; /* fail */
         else
-          exit(0);
+          return 0;
       ]])
     ],[
       AC_MSG_RESULT([yes])
@@ -5478,7 +3992,7 @@ AC_DEFUN([CURL_CHECK_FUNC_STRERROR_R], [
       tst_works_glibc_strerror_r="no"
     ])
   fi
-  #
+
   if test "$tst_compi_strerror_r" = "yes" &&
     test "$tst_works_glibc_strerror_r" != "yes"; then
     AC_MSG_CHECKING([if strerror_r is POSIX like])
@@ -5490,8 +4004,10 @@ AC_DEFUN([CURL_CHECK_FUNC_STRERROR_R], [
             $curl_includes_string
             int strerror_r(int errnum, char *resultbuf, $arg3 bufsize);
           ]],[[
-            if(0 != strerror_r(0, 0, 0))
+            char s[1];
+            if(strerror_r(0, s, 0))
               return 1;
+            (void)s;
           ]])
         ],[
           tst_posix_strerror_r_type_arg3="$arg3"
@@ -5509,27 +4025,27 @@ AC_DEFUN([CURL_CHECK_FUNC_STRERROR_R], [
         ;;
     esac
   fi
-  #
+
   dnl only do runtime verification when not cross-compiling
-  if test "x$cross_compiling" != "xyes" &&
+  if test "$cross_compiling" != "yes" &&
     test "$tst_posix_strerror_r" = "yes"; then
     AC_MSG_CHECKING([if strerror_r seems to work])
     CURL_RUN_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_stdlib
         $curl_includes_string
-#       include <errno.h>
+        #include <errno.h>
       ]],[[
         char buffer[1024];
         int error = 1;
         buffer[0] = '\0';
         error = strerror_r(EACCES, buffer, sizeof(buffer));
         if(error)
-          exit(1); /* fail */
+          return 1; /* fail */
         if(buffer[0] == '\0')
-          exit(1); /* fail */
+          return 1; /* fail */
         else
-          exit(0);
+          return 0;
       ]])
     ],[
       AC_MSG_RESULT([yes])
@@ -5539,7 +4055,7 @@ AC_DEFUN([CURL_CHECK_FUNC_STRERROR_R], [
       tst_works_posix_strerror_r="no"
     ])
   fi
-  #
+
   if test "$tst_works_glibc_strerror_r" = "yes"; then
     tst_posix_strerror_r="no"
   fi
@@ -5566,7 +4082,7 @@ AC_DEFUN([CURL_CHECK_FUNC_STRERROR_R], [
       tst_allow_strerror_r="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if strerror_r might be used])
   if test "$tst_links_strerror_r" = "yes" &&
      test "$tst_proto_strerror_r" = "yes" &&
@@ -5590,12 +4106,11 @@ AC_DEFUN([CURL_CHECK_FUNC_STRERROR_R], [
     AC_MSG_RESULT([no])
     curl_cv_func_strerror_r="no"
   fi
-  #
+
   if test "$tst_compi_strerror_r" = "yes" &&
      test "$tst_allow_strerror_r" = "unknown"; then
     AC_MSG_WARN([cannot determine strerror_r() style: edit lib/curl_config.h manually.])
   fi
-  #
 ])
 
 
@@ -5605,16 +4120,16 @@ dnl Verify if stricmp is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
 dnl shell variable curl_disallow_stricmp, then
-dnl HAVE_STRICMP will be defined.
+dnl HAVE_STRICMP is defined.
 
 AC_DEFUN([CURL_CHECK_FUNC_STRICMP], [
-  AC_REQUIRE([CURL_INCLUDES_STRING])dnl
-  #
+  AC_REQUIRE([CURL_INCLUDES_STRING])
+
   tst_links_stricmp="unknown"
   tst_proto_stricmp="unknown"
   tst_compi_stricmp="unknown"
   tst_allow_stricmp="unknown"
-  #
+
   AC_MSG_CHECKING([if stricmp can be linked])
   AC_LINK_IFELSE([
     AC_LANG_FUNC_LINK_TRY([stricmp])
@@ -5625,7 +4140,7 @@ AC_DEFUN([CURL_CHECK_FUNC_STRICMP], [
     AC_MSG_RESULT([no])
     tst_links_stricmp="no"
   ])
-  #
+
   if test "$tst_links_stricmp" = "yes"; then
     AC_MSG_CHECKING([if stricmp is prototyped])
     AC_EGREP_CPP([stricmp],[
@@ -5638,14 +4153,14 @@ AC_DEFUN([CURL_CHECK_FUNC_STRICMP], [
       tst_proto_stricmp="no"
     ])
   fi
-  #
+
   if test "$tst_proto_stricmp" = "yes"; then
     AC_MSG_CHECKING([if stricmp is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_string
       ]],[[
-        if(0 != stricmp(0, 0))
+        if(stricmp(0, 0))
           return 1;
       ]])
     ],[
@@ -5656,7 +4171,7 @@ AC_DEFUN([CURL_CHECK_FUNC_STRICMP], [
       tst_compi_stricmp="no"
     ])
   fi
-  #
+
   if test "$tst_compi_stricmp" = "yes"; then
     AC_MSG_CHECKING([if stricmp usage allowed])
     if test "x$curl_disallow_stricmp" != "xyes"; then
@@ -5667,7 +4182,7 @@ AC_DEFUN([CURL_CHECK_FUNC_STRICMP], [
       tst_allow_stricmp="no"
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if stricmp might be used])
   if test "$tst_links_stricmp" = "yes" &&
      test "$tst_proto_stricmp" = "yes" &&
@@ -5684,172 +4199,88 @@ AC_DEFUN([CURL_CHECK_FUNC_STRICMP], [
 ])
 
 
-dnl CURL_CHECK_FUNC_STRTOK_R
+dnl CURL_CHECK_FUNC_MEMSET_S
 dnl -------------------------------------------------
-dnl Verify if strtok_r is available, prototyped, and
+dnl Verify if memset_s is available, prototyped, and
 dnl can be compiled. If all of these are true, and
 dnl usage has not been previously disallowed with
-dnl shell variable curl_disallow_strtok_r, then
-dnl HAVE_STRTOK_R will be defined.
+dnl shell variable curl_disallow_memset_s, then
+dnl HAVE_MEMSET_S is defined.
 
-AC_DEFUN([CURL_CHECK_FUNC_STRTOK_R], [
-  AC_REQUIRE([CURL_INCLUDES_STRING])dnl
-  #
-  tst_links_strtok_r="unknown"
-  tst_proto_strtok_r="unknown"
-  tst_compi_strtok_r="unknown"
-  tst_allow_strtok_r="unknown"
-  #
-  AC_MSG_CHECKING([if strtok_r can be linked])
+AC_DEFUN([CURL_CHECK_FUNC_MEMSET_S], [
+  AC_REQUIRE([CURL_INCLUDES_STRING])
+
+  tst_links_memset_s="unknown"
+  tst_proto_memset_s="unknown"
+  tst_compi_memset_s="unknown"
+  tst_allow_memset_s="unknown"
+
+  AC_MSG_CHECKING([if memset_s can be linked])
   AC_LINK_IFELSE([
-    AC_LANG_FUNC_LINK_TRY([strtok_r])
+    AC_LANG_FUNC_LINK_TRY([memset_s])
   ],[
     AC_MSG_RESULT([yes])
-    tst_links_strtok_r="yes"
+    tst_links_memset_s="yes"
   ],[
     AC_MSG_RESULT([no])
-    tst_links_strtok_r="no"
+    tst_links_memset_s="no"
   ])
-  #
-  if test "$tst_links_strtok_r" = "yes"; then
-    AC_MSG_CHECKING([if strtok_r is prototyped])
-    AC_EGREP_CPP([strtok_r],[
+
+  if test "$tst_links_memset_s" = "yes"; then
+    AC_MSG_CHECKING([if memset_s is prototyped])
+    AC_EGREP_CPP([memset_s],[
       $curl_includes_string
     ],[
       AC_MSG_RESULT([yes])
-      tst_proto_strtok_r="yes"
+      tst_proto_memset_s="yes"
     ],[
       AC_MSG_RESULT([no])
-      tst_proto_strtok_r="no"
+      tst_proto_memset_s="no"
     ])
   fi
-  #
-  if test "$tst_proto_strtok_r" = "yes"; then
-    AC_MSG_CHECKING([if strtok_r is compilable])
+
+  if test "$tst_proto_memset_s" = "yes"; then
+    AC_MSG_CHECKING([if memset_s is compilable])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
         $curl_includes_string
       ]],[[
-        if(0 != strtok_r(0, 0, 0))
+        char buf[2];
+        if(memset_s(buf, sizeof(buf), 0, sizeof(buf)))
           return 1;
       ]])
     ],[
       AC_MSG_RESULT([yes])
-      tst_compi_strtok_r="yes"
+      tst_compi_memset_s="yes"
     ],[
       AC_MSG_RESULT([no])
-      tst_compi_strtok_r="no"
+      tst_compi_memset_s="no"
     ])
   fi
-  #
-  if test "$tst_compi_strtok_r" = "yes"; then
-    AC_MSG_CHECKING([if strtok_r usage allowed])
-    if test "x$curl_disallow_strtok_r" != "xyes"; then
+
+  if test "$tst_compi_memset_s" = "yes"; then
+    AC_MSG_CHECKING([if memset_s usage allowed])
+    if test "x$curl_disallow_memset_s" != "xyes"; then
       AC_MSG_RESULT([yes])
-      tst_allow_strtok_r="yes"
+      tst_allow_memset_s="yes"
     else
       AC_MSG_RESULT([no])
-      tst_allow_strtok_r="no"
+      tst_allow_memset_s="no"
     fi
   fi
-  #
-  AC_MSG_CHECKING([if strtok_r might be used])
-  if test "$tst_links_strtok_r" = "yes" &&
-     test "$tst_proto_strtok_r" = "yes" &&
-     test "$tst_compi_strtok_r" = "yes" &&
-     test "$tst_allow_strtok_r" = "yes"; then
+
+  AC_MSG_CHECKING([if memset_s might be used])
+  if test "$tst_links_memset_s" = "yes" &&
+     test "$tst_proto_memset_s" = "yes" &&
+     test "$tst_compi_memset_s" = "yes" &&
+     test "$tst_allow_memset_s" = "yes"; then
     AC_MSG_RESULT([yes])
-    AC_DEFINE_UNQUOTED(HAVE_STRTOK_R, 1,
-      [Define to 1 if you have the strtok_r function.])
-    curl_cv_func_strtok_r="yes"
+    AC_DEFINE_UNQUOTED(HAVE_MEMSET_S, 1,
+      [Define to 1 if you have the memset_s function.])
+    curl_cv_func_memset_s="yes"
   else
     AC_MSG_RESULT([no])
-    curl_cv_func_strtok_r="no"
-  fi
-])
-
-
-dnl CURL_CHECK_FUNC_STRTOLL
-dnl -------------------------------------------------
-dnl Verify if strtoll is available, prototyped, and
-dnl can be compiled. If all of these are true, and
-dnl usage has not been previously disallowed with
-dnl shell variable curl_disallow_strtoll, then
-dnl HAVE_STRTOLL will be defined.
-
-AC_DEFUN([CURL_CHECK_FUNC_STRTOLL], [
-  AC_REQUIRE([CURL_INCLUDES_STDLIB])dnl
-  #
-  tst_links_strtoll="unknown"
-  tst_proto_strtoll="unknown"
-  tst_compi_strtoll="unknown"
-  tst_allow_strtoll="unknown"
-  #
-  AC_MSG_CHECKING([if strtoll can be linked])
-  AC_LINK_IFELSE([
-    AC_LANG_FUNC_LINK_TRY([strtoll])
-  ],[
-    AC_MSG_RESULT([yes])
-    tst_links_strtoll="yes"
-  ],[
-    AC_MSG_RESULT([no])
-    tst_links_strtoll="no"
-  ])
-  #
-  if test "$tst_links_strtoll" = "yes"; then
-    AC_MSG_CHECKING([if strtoll is prototyped])
-    AC_EGREP_CPP([strtoll],[
-      $curl_includes_stdlib
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_proto_strtoll="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_proto_strtoll="no"
-    ])
-  fi
-  #
-  if test "$tst_proto_strtoll" = "yes"; then
-    AC_MSG_CHECKING([if strtoll is compilable])
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-        $curl_includes_stdlib
-      ]],[[
-        if(0 != strtoll(0, 0, 0))
-          return 1;
-      ]])
-    ],[
-      AC_MSG_RESULT([yes])
-      tst_compi_strtoll="yes"
-    ],[
-      AC_MSG_RESULT([no])
-      tst_compi_strtoll="no"
-    ])
-  fi
-  #
-  if test "$tst_compi_strtoll" = "yes"; then
-    AC_MSG_CHECKING([if strtoll usage allowed])
-    if test "x$curl_disallow_strtoll" != "xyes"; then
-      AC_MSG_RESULT([yes])
-      tst_allow_strtoll="yes"
-    else
-      AC_MSG_RESULT([no])
-      tst_allow_strtoll="no"
-    fi
-  fi
-  #
-  AC_MSG_CHECKING([if strtoll might be used])
-  if test "$tst_links_strtoll" = "yes" &&
-     test "$tst_proto_strtoll" = "yes" &&
-     test "$tst_compi_strtoll" = "yes" &&
-     test "$tst_allow_strtoll" = "yes"; then
-    AC_MSG_RESULT([yes])
-    AC_DEFINE_UNQUOTED(HAVE_STRTOLL, 1,
-      [Define to 1 if you have the strtoll function.])
-    curl_cv_func_strtoll="yes"
-  else
-    AC_MSG_RESULT([no])
-    curl_cv_func_strtoll="no"
+    curl_cv_func_memset_s="no"
   fi
 ])
 
@@ -5861,21 +4292,19 @@ dnl CURL_LIBRARY_PATH variable. It keeps the LD_LIBRARY_PATH
 dnl changes contained within this macro.
 
 AC_DEFUN([CURL_RUN_IFELSE], [
-   case $host_os in
-     darwin*)
-      AC_RUN_IFELSE([AC_LANG_SOURCE([$1])], $2, $3, $4)
-     ;;
-     *)
-      oldcc=$CC
-      old=$LD_LIBRARY_PATH
-      CC="sh ./run-compiler"
-      LD_LIBRARY_PATH=$CURL_LIBRARY_PATH:$old
-      export LD_LIBRARY_PATH
-      AC_RUN_IFELSE([AC_LANG_SOURCE([$1])], $2, $3, $4)
-      LD_LIBRARY_PATH=$old # restore
-      CC=$oldcc
-     ;;
-   esac
+  if test "$curl_cv_apple" = "yes"; then
+    AC_RUN_IFELSE([AC_LANG_SOURCE([$1])], $2, $3, $4)
+  else
+    oldcc=$CC
+    old=$LD_LIBRARY_PATH
+    CC="sh ./run-compiler"
+    LD_LIBRARY_PATH=$CURL_LIBRARY_PATH:$old
+    export LD_LIBRARY_PATH
+    AC_RUN_IFELSE([AC_LANG_SOURCE([$1])], $2, $3, $4)
+    # restore
+    LD_LIBRARY_PATH=$old
+    CC=$oldcc
+  fi
 ])
 
 dnl CURL_COVERAGE
@@ -5892,28 +4321,34 @@ AC_DEFUN([CURL_COVERAGE],[
 
   dnl check if enabled by argument
   AC_ARG_ENABLE(code-coverage,
-     AS_HELP_STRING([--enable-code-coverage], [Provide code coverage]),
-     coverage="$enableval")
+    AS_HELP_STRING([--enable-code-coverage], [Provide code coverage]),
+    coverage="$enableval")
 
-  dnl if not gcc switch off again
-  AS_IF([ test "$GCC" != "yes" ], coverage="no" )
+  dnl if not gcc or clang switch off again
+  AS_IF([test "$compiler_id" != "GNU_C" && test "$compiler_id" != "CLANG" && test "$compiler_id" != "APPLECLANG"], coverage="no" )
   AC_MSG_RESULT($coverage)
 
   if test "x$coverage" = "xyes"; then
     curl_coverage_msg="enabled"
 
-    AC_CHECK_TOOL([GCOV], [gcov], [gcov])
-    if test -z "$GCOV"; then
-      AC_MSG_ERROR([needs gcov for code coverage])
-    fi
-    AC_CHECK_PROG([LCOV], [lcov], [lcov])
-    if test -z "$LCOV"; then
-      AC_MSG_ERROR([needs lcov for code coverage])
-    fi
-
     CPPFLAGS="$CPPFLAGS -DNDEBUG"
-    CFLAGS="$CFLAGS -O0 -g -fprofile-arcs -ftest-coverage"
-    LIBS="$LIBS -lgcov"
+    CFLAGS="$CFLAGS -O0 -g"
+
+    if test "$compiler_id" = "GNU_C"; then
+      AC_CHECK_TOOL([GCOV], [gcov], [gcov])
+      if test -z "$GCOV"; then
+        AC_MSG_ERROR([needs gcov for code coverage])
+      fi
+      AC_CHECK_PROG([LCOV], [lcov], [lcov])
+      if test -z "$LCOV"; then
+        AC_MSG_ERROR([needs lcov for code coverage])
+      fi
+      CFLAGS="$CFLAGS -ftest-coverage -fprofile-arcs"
+      LIBS="$LIBS -lgcov"
+    else
+      CFLAGS="$CFLAGS -fprofile-instr-generate -fcoverage-mapping"
+      LDFLAGS="$LDFLAGS -fprofile-instr-generate -fcoverage-mapping"
+    fi
   fi
 ])
 
@@ -5921,6 +4356,7 @@ dnl CURL_ATOMIC
 dnl -------------------------------------------------------------
 dnl Check if _Atomic works. But only check if stdatomic.h exists.
 dnl
+
 AC_DEFUN([CURL_ATOMIC],[
   AC_CHECK_HEADERS(stdatomic.h, [
     AC_MSG_CHECKING([if _Atomic is available])
@@ -5930,6 +4366,7 @@ AC_DEFUN([CURL_ATOMIC],[
       ]],[[
         _Atomic int i = 0;
         i = 4;  // Force an atomic-write operation.
+        (void)i;
       ]])
     ],[
       AC_MSG_RESULT([yes])
@@ -5943,61 +4380,62 @@ AC_DEFUN([CURL_ATOMIC],[
   ])
 ])
 
-# Rewrite inspired by the functionality once provided by
-# AX_COMPILE_CHECK_SIZEOF. Uses the switch() "trick" to find the size of the
-# given type.
-#
-# This code fails to compile:
-#
-#   switch() { case 0: case 0: }
-#
-# By making the second case number a boolean check, it fails to compile the
-# test code when the boolean is false and thus creating a zero, making it a
-# duplicated case label. If the boolean equals true, it becomes a one, the
-# code compiles and we know it was a match.
-#
-# The check iterates over all possible sizes and stops as soon it compiles
-# error-free.
-#
-# Usage:
-#
-#   CURL_SIZEOF(TYPE, [HEADERS])
-#
+dnl Rewrite inspired by the functionality once provided by
+dnl AX_COMPILE_CHECK_SIZEOF. Uses the switch() "trick" to find the size of the
+dnl given type.
+dnl
+dnl This code fails to compile:
+dnl
+dnl   switch() { case 0: case 0: }
+dnl
+dnl By making the second case number a boolean check, it fails to compile the
+dnl test code when the boolean is false and thus creating a zero, making it a
+dnl duplicated case label. If the boolean equals true, it becomes a one, the
+dnl code compiles and we know it was a match.
+dnl
+dnl The check iterates over all possible sizes and stops as soon it compiles
+dnl error-free.
+dnl
+dnl Usage:
+dnl
+dnl    CURL_SIZEOF(TYPE, [HEADERS])
+dnl
 
 AC_DEFUN([CURL_SIZEOF], [
   dnl The #define name to make autoheader put the name in curl_config.h.in
-  define(TYPE, translit(sizeof_$1, [a-z *], [A-Z_P]))dnl
+  define(TYPE, translit(sizeof_$1, [a-z *], [A-Z_P]))
 
   AC_MSG_CHECKING(size of $1)
   r=0
   dnl Check the sizes in a reasonable order
   for typesize in 8 4 2 16 1; do
-     AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
-#include <sys/types.h>
-$2
-]],
-     [switch(0) {
-       case 0:
-       case (sizeof($1) == $typesize):;
-     }
-    ]) ],
-      [
-       r=$typesize],
-      [
-       r=0])
+    AC_COMPILE_IFELSE([
+      AC_LANG_PROGRAM([[
+        #include <sys/types.h>
+        $2
+      ]],[
+        switch(0) {
+        case 0:
+        case (sizeof($1) == $typesize):;
+        }
+      ])
+    ],[
+      r=$typesize
+    ],[
+      r=0
+    ])
     dnl get out of the loop once matched
-    if test $r -gt 0; then
+    if test "$r" -gt 0; then
       break;
     fi
   done
-  if test $r -eq 0; then
+  if test "$r" -eq 0; then
     AC_MSG_ERROR([Failed to find size of $1])
   fi
   AC_MSG_RESULT($r)
   dnl lowercase and underscore instead of space
-  tname=$(echo "ac_cv_sizeof_$1" | tr A-Z a-z | tr " " "_")
+  tname=`echo "ac_cv_sizeof_$1" | tr A-Z a-z | tr " " "_"`
   eval "$tname=$r"
 
   AC_DEFINE_UNQUOTED(TYPE, [$r], [Size of $1 in number of bytes])
-
 ])
diff --git a/third-party/curl/m4/curl-gnutls.m4 b/third-party/curl/m4/curl-gnutls.m4
index 48813dfad4..3eab1c5d31 100644
--- a/third-party/curl/m4/curl-gnutls.m4
+++ b/third-party/curl/m4/curl-gnutls.m4
@@ -27,141 +27,189 @@ dnl check for GnuTLS
 dnl ----------------------------------------------------
 
 AC_DEFUN([CURL_WITH_GNUTLS], [
-if test "x$OPT_GNUTLS" != xno; then
+if test "x$OPT_GNUTLS" != "xno"; then
   ssl_msg=
 
-  if test X"$OPT_GNUTLS" != Xno; then
+  addld=""
+  addlib=""
+  gtlslib=""
+  version=""
+  addcflags=""
 
-    addld=""
-    addlib=""
-    gtlslib=""
-    version=""
-    addcflags=""
+  if test "x$OPT_GNUTLS" = "xyes"; then
+    dnl this is with no particular path given
+    CURL_CHECK_PKGCONFIG(gnutls)
 
-    if test "x$OPT_GNUTLS" = "xyes"; then
-      dnl this is with no particular path given
-      CURL_CHECK_PKGCONFIG(gnutls)
-
-      if test "$PKGCONFIG" != "no" ; then
-        addlib=`$PKGCONFIG --libs-only-l gnutls`
-        addld=`$PKGCONFIG --libs-only-L gnutls`
-        addcflags=`$PKGCONFIG --cflags-only-I gnutls`
-        version=`$PKGCONFIG --modversion gnutls`
-        gtlslib=`echo $addld | $SED -e 's/^-L//'`
-      else
-        dnl without pkg-config, we try libgnutls-config as that was how it
-        dnl used to be done
-        check=`libgnutls-config --version 2>/dev/null`
-        if test -n "$check"; then
-          addlib=`libgnutls-config --libs`
-          addcflags=`libgnutls-config --cflags`
-          version=`libgnutls-config --version`
-          gtlslib=`libgnutls-config --prefix`/lib$libsuff
-        fi
-      fi
+    if test "$PKGCONFIG" != "no"; then
+      addlib=`$PKGCONFIG --libs-only-l gnutls`
+      addld=`$PKGCONFIG --libs-only-L gnutls`
+      addcflags=`$PKGCONFIG --cflags-only-I gnutls`
+      version=`$PKGCONFIG --modversion gnutls`
+      gtlslib=`echo $addld | $SED -e 's/^-L//'`
     else
-      dnl this is with a given path, first check if there's a libgnutls-config
-      dnl there and if not, make an educated guess
-      cfg=$OPT_GNUTLS/bin/libgnutls-config
-      check=`$cfg --version 2>/dev/null`
+      dnl without pkg-config, we try libgnutls-config as that was how it
+      dnl used to be done
+      check=`libgnutls-config --version 2>/dev/null`
       if test -n "$check"; then
-        addlib=`$cfg --libs`
-        addcflags=`$cfg --cflags`
-        version=`$cfg --version`
-        gtlslib=`$cfg --prefix`/lib$libsuff
-      else
-        dnl without pkg-config and libgnutls-config, we guess a lot!
-        addlib=-lgnutls
-        addld=-L$OPT_GNUTLS/lib$libsuff
-        addcflags=-I$OPT_GNUTLS/include
-        version="" # we just don't know
-        gtlslib=$OPT_GNUTLS/lib$libsuff
+        addlib=`libgnutls-config --libs`
+        addcflags=`libgnutls-config --cflags`
+        version=`libgnutls-config --version`
+        gtlslib=`libgnutls-config --prefix`/lib$libsuff
       fi
     fi
+  else
+    dnl this is with a given path, first check if there is a libgnutls-config
+    dnl there and if not, make an educated guess
+    cfg=$OPT_GNUTLS/bin/libgnutls-config
+    check=`$cfg --version 2>/dev/null`
+    if test -n "$check"; then
+      addlib=`$cfg --libs`
+      addcflags=`$cfg --cflags`
+      version=`$cfg --version`
+      gtlslib=`$cfg --prefix`/lib$libsuff
+    else
+      dnl without pkg-config and libgnutls-config, we guess a lot!
+      addlib=-lgnutls
+      addld=-L$OPT_GNUTLS/lib$libsuff
+      addcflags=-I$OPT_GNUTLS/include
+      dnl we do not know
+      version=""
+      gtlslib=$OPT_GNUTLS/lib$libsuff
+    fi
+  fi
 
-    if test -z "$version"; then
-      dnl lots of efforts, still no go
-      version="unknown"
+  if test -z "$version"; then
+    dnl lots of efforts, still no go
+    version="unknown"
+  fi
+
+  if test -n "$addlib"; then
+
+    CLEANLIBS="$LIBS"
+    CLEANCPPFLAGS="$CPPFLAGS"
+    CLEANLDFLAGS="$LDFLAGS"
+    CLEANLDFLAGSPC="$LDFLAGSPC"
+
+    LIBS="$addlib $LIBS"
+    LDFLAGS="$LDFLAGS $addld"
+    LDFLAGSPC="$LDFLAGSPC $addld"
+    if test "$addcflags" != "-I/usr/include"; then
+      CPPFLAGS="$CPPFLAGS $addcflags"
     fi
 
-    if test -n "$addlib"; then
+    dnl this function is selected since it was introduced in 3.1.10
+    AC_CHECK_LIB(gnutls, gnutls_x509_crt_get_dn2,
+    [
+      AC_DEFINE(USE_GNUTLS, 1, [if GnuTLS is enabled])
+      GNUTLS_ENABLED=1
+      USE_GNUTLS="yes"
+      ssl_msg="GnuTLS"
+      QUIC_ENABLED=yes
+      test "gnutls" != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
+    ],
+    [
+      LIBS="$CLEANLIBS"
+      CPPFLAGS="$CLEANCPPFLAGS"
+      LDFLAGS="$CLEANLDFLAGS"
+      LDFLAGSPC="$CLEANLDFLAGSPC"
+    ])
 
-      CLEANLIBS="$LIBS"
-      CLEANCPPFLAGS="$CPPFLAGS"
-      CLEANLDFLAGS="$LDFLAGS"
-
-      LIBS="$addlib $LIBS"
-      LDFLAGS="$LDFLAGS $addld"
-      if test "$addcflags" != "-I/usr/include"; then
-         CPPFLAGS="$CPPFLAGS $addcflags"
-      fi
-
-      dnl this function is selected since it was introduced in 3.1.10
-      AC_CHECK_LIB(gnutls, gnutls_x509_crt_get_dn2,
-       [
-       AC_DEFINE(USE_GNUTLS, 1, [if GnuTLS is enabled])
-       AC_SUBST(USE_GNUTLS, [1])
-       GNUTLS_ENABLED=1
-       USE_GNUTLS="yes"
-       ssl_msg="GnuTLS"
-       test gnutls != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
-       ],
-       [
-         LIBS="$CLEANLIBS"
-         CPPFLAGS="$CLEANCPPFLAGS"
-       ])
-
-      if test "x$USE_GNUTLS" = "xyes"; then
-        AC_MSG_NOTICE([detected GnuTLS version $version])
-        check_for_ca_bundle=1
-        if test -n "$gtlslib"; then
-          dnl when shared libs were found in a path that the run-time
-          dnl linker doesn't search through, we need to add it to
-          dnl CURL_LIBRARY_PATH to prevent further configure tests to fail
-          dnl due to this
-          if test "x$cross_compiling" != "xyes"; then
-            CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$gtlslib"
-            export CURL_LIBRARY_PATH
-            AC_MSG_NOTICE([Added $gtlslib to CURL_LIBRARY_PATH])
-          fi
+    if test "$USE_GNUTLS" = "yes"; then
+      AC_MSG_NOTICE([detected GnuTLS version $version])
+      check_for_ca_bundle=1
+      if test -n "$gtlslib"; then
+        dnl when shared libs were found in a path that the runtime
+        dnl linker does not search through, we need to add it to
+        dnl CURL_LIBRARY_PATH to prevent further configure tests to fail
+        dnl due to this
+        if test "$cross_compiling" != "yes"; then
+          CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$gtlslib"
+          export CURL_LIBRARY_PATH
+          AC_MSG_NOTICE([Added $gtlslib to CURL_LIBRARY_PATH])
         fi
       fi
-
+      LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE gnutls"
     fi
-
-  fi dnl GNUTLS not disabled
+  fi
 
   test -z "$ssl_msg" || ssl_backends="${ssl_backends:+$ssl_backends, }$ssl_msg"
-fi
+fi dnl GnuTLS not disabled
 
-dnl ---
+dnl
 dnl Check which crypto backend GnuTLS uses
-dnl ---
-
+dnl
 if test "$GNUTLS_ENABLED" = "1"; then
   USE_GNUTLS_NETTLE=
-  # First check if we can detect either crypto library via transitive linking
-  AC_CHECK_LIB(gnutls, nettle_MD5Init, [ USE_GNUTLS_NETTLE=1 ])
+  dnl First check if we can detect either crypto library via transitive linking
+  AC_CHECK_LIB(gnutls, nettle_md5_init, [ USE_GNUTLS_NETTLE=1 ])
 
-  # If not, try linking directly to both of them to see if they are available
-  if test "$USE_GNUTLS_NETTLE" = ""; then
-    AC_CHECK_LIB(nettle, nettle_MD5Init, [ USE_GNUTLS_NETTLE=1 ])
-  fi
-  if test "$USE_GNUTLS_NETTLE" = ""; then
-    AC_MSG_ERROR([GnuTLS found, but nettle was not found])
-  fi
-  LIBS="-lnettle $LIBS"
-fi
+  dnl If not, try linking directly to both of them to see if they are available
+  if test -z "$USE_GNUTLS_NETTLE"; then
 
-dnl ---
-dnl We require GnuTLS with SRP support.
-dnl ---
-if test "$GNUTLS_ENABLED" = "1"; then
+    dnl this is with no particular path given
+    CURL_CHECK_PKGCONFIG(nettle)
+
+    if test "$PKGCONFIG" != "no"; then
+      addlib=`$PKGCONFIG --libs-only-l nettle`
+      addld=`$PKGCONFIG --libs-only-L nettle`
+      addcflags=`$PKGCONFIG --cflags-only-I nettle`
+      version=`$PKGCONFIG --modversion nettle`
+      gtlslib=`echo $addld | $SED -e 's/^-L//'`
+
+      if test -n "$addlib"; then
+
+        CLEANLIBS="$LIBS"
+        CLEANCPPFLAGS="$CPPFLAGS"
+        CLEANLDFLAGS="$LDFLAGS"
+        CLEANLDFLAGSPC="$LDFLAGSPC"
+
+        LIBS="$addlib $LIBS"
+        LDFLAGS="$LDFLAGS $addld"
+        LDFLAGSPC="$LDFLAGSPC $addld"
+        if test "$addcflags" != "-I/usr/include"; then
+          CPPFLAGS="$CPPFLAGS $addcflags"
+        fi
+
+        AC_CHECK_LIB(nettle, nettle_md5_init,
+        [
+          USE_GNUTLS_NETTLE=1
+        ],
+        [
+          LIBS="$CLEANLIBS"
+          CPPFLAGS="$CLEANCPPFLAGS"
+          LDFLAGS="$CLEANLDFLAGS"
+          LDFLAGSPC="$CLEANLDFLAGSPC"
+        ])
+
+        if test "$USE_GNUTLS_NETTLE" = "1"; then
+          if test -z "$version"; then
+            version="unknown"
+          fi
+          AC_MSG_NOTICE([detected nettle version $version])
+        fi
+      fi
+    fi
+    if test -z "$USE_GNUTLS_NETTLE"; then
+      AC_MSG_ERROR([GnuTLS found, but nettle was not found])
+    fi
+  else
+    LIBS="-lnettle $LIBS"
+  fi
+
+  if test "$USE_GNUTLS_NETTLE" = "1"; then
+    LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE nettle"
+  fi
+
+  dnl ---
+  dnl We require GnuTLS with SRP support.
+  dnl
+  dnl In GnuTLS 3.8.0 (2023-02-10) and upper, this check always succeeds.
+  dnl Detecting actual TLS-SRP support needs poking the API at runtime.
+  dnl ---
   AC_CHECK_LIB(gnutls, gnutls_srp_verifier,
-   [
-     AC_DEFINE(HAVE_GNUTLS_SRP, 1, [if you have the function gnutls_srp_verifier])
-     AC_SUBST(HAVE_GNUTLS_SRP, [1])
-   ])
+    [
+      AC_DEFINE(HAVE_GNUTLS_SRP, 1, [if you have the function gnutls_srp_verifier])
+      HAVE_GNUTLS_SRP=1
+    ])
 fi
-
 ])
diff --git a/third-party/curl/m4/curl-mbedtls.m4 b/third-party/curl/m4/curl-mbedtls.m4
index 64116e758b..0c19f07237 100644
--- a/third-party/curl/m4/curl-mbedtls.m4
+++ b/third-party/curl/m4/curl-mbedtls.m4
@@ -27,85 +27,91 @@ dnl check for mbedTLS
 dnl ----------------------------------------------------
 AC_DEFUN([CURL_WITH_MBEDTLS], [
 
-if test "x$OPT_MBEDTLS" != xno; then
+if test "x$OPT_MBEDTLS" != "xno"; then
   _cppflags=$CPPFLAGS
   _ldflags=$LDFLAGS
+  _ldflagspc=$LDFLAGSPC
   ssl_msg=
 
-  if test X"$OPT_MBEDTLS" != Xno; then
+  if test "x$OPT_MBEDTLS" = "xyes"; then
+    OPT_MBEDTLS=""
+  fi
 
-    if test "$OPT_MBEDTLS" = "yes"; then
-      OPT_MBEDTLS=""
+  if test -z "$OPT_MBEDTLS"; then
+    dnl check for lib first without setting any new path
+
+    AC_CHECK_LIB(mbedtls, mbedtls_ssl_init,
+    dnl libmbedtls found, set the variable
+    [
+      AC_DEFINE(USE_MBEDTLS, 1, [if mbedTLS is enabled])
+      MBEDTLS_ENABLED=1
+      USE_MBEDTLS="yes"
+      ssl_msg="mbedTLS"
+      test "mbedtls" != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
+    ], [], -lmbedx509 -lmbedcrypto)
+  fi
+
+  addld=""
+  addlib=""
+  addcflags=""
+  mbedtlslib=""
+
+  if test "$USE_MBEDTLS" != "yes" && test -n "$OPT_MBEDTLS"; then
+    dnl add the path and test again
+    addld=-L$OPT_MBEDTLS/lib$libsuff
+    addcflags=-I$OPT_MBEDTLS/include
+    mbedtlslib=$OPT_MBEDTLS/lib$libsuff
+
+    LDFLAGS="$LDFLAGS $addld"
+    LDFLAGSPC="$LDFLAGSPC $addld"
+    if test "$addcflags" != "-I/usr/include"; then
+      CPPFLAGS="$CPPFLAGS $addcflags"
     fi
 
-    if test -z "$OPT_MBEDTLS" ; then
-      dnl check for lib first without setting any new path
+    AC_CHECK_LIB(mbedtls, mbedtls_ssl_init,
+      [
+      AC_DEFINE(USE_MBEDTLS, 1, [if mbedTLS is enabled])
+      MBEDTLS_ENABLED=1
+      USE_MBEDTLS="yes"
+      ssl_msg="mbedTLS"
+      test "mbedtls" != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
+      ],
+      [
+        CPPFLAGS=$_cppflags
+        LDFLAGS=$_ldflags
+        LDFLAGSPC=$_ldflagspc
+      ], -lmbedx509 -lmbedcrypto)
+  fi
 
-      AC_CHECK_LIB(mbedtls, mbedtls_havege_init,
-      dnl libmbedtls found, set the variable
-       [
-         AC_DEFINE(USE_MBEDTLS, 1, [if mbedTLS is enabled])
-         AC_SUBST(USE_MBEDTLS, [1])
-         MBEDTLS_ENABLED=1
-         USE_MBEDTLS="yes"
-         ssl_msg="mbedTLS"
-         test mbedtls != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
-        ], [], -lmbedx509 -lmbedcrypto)
-    fi
+  if test "$USE_MBEDTLS" = "yes"; then
+    AC_MSG_NOTICE([detected mbedTLS])
+    check_for_ca_bundle=1
 
-    addld=""
-    addlib=""
-    addcflags=""
-    mbedtlslib=""
+    LIBS="-lmbedtls -lmbedx509 -lmbedcrypto $LIBS"
 
-    if test "x$USE_MBEDTLS" != "xyes"; then
-      dnl add the path and test again
-      addld=-L$OPT_MBEDTLS/lib$libsuff
-      addcflags=-I$OPT_MBEDTLS/include
-      mbedtlslib=$OPT_MBEDTLS/lib$libsuff
-
-      LDFLAGS="$LDFLAGS $addld"
-      if test "$addcflags" != "-I/usr/include"; then
-         CPPFLAGS="$CPPFLAGS $addcflags"
-      fi
-
-      AC_CHECK_LIB(mbedtls, mbedtls_ssl_init,
-       [
-       AC_DEFINE(USE_MBEDTLS, 1, [if mbedTLS is enabled])
-       AC_SUBST(USE_MBEDTLS, [1])
-       MBEDTLS_ENABLED=1
-       USE_MBEDTLS="yes"
-       ssl_msg="mbedTLS"
-       test mbedtls != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
-       ],
-       [
-         CPPFLAGS=$_cppflags
-         LDFLAGS=$_ldflags
-       ], -lmbedx509 -lmbedcrypto)
-    fi
-
-    if test "x$USE_MBEDTLS" = "xyes"; then
-      AC_MSG_NOTICE([detected mbedTLS])
-      check_for_ca_bundle=1
-
-      LIBS="-lmbedtls -lmbedx509 -lmbedcrypto $LIBS"
-
-      if test -n "$mbedtlslib"; then
-        dnl when shared libs were found in a path that the run-time
-        dnl linker doesn't search through, we need to add it to
-        dnl CURL_LIBRARY_PATH to prevent further configure tests to fail
-        dnl due to this
-        if test "x$cross_compiling" != "xyes"; then
-          CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$mbedtlslib"
-          export CURL_LIBRARY_PATH
-          AC_MSG_NOTICE([Added $mbedtlslib to CURL_LIBRARY_PATH])
-        fi
+    if test -n "$mbedtlslib"; then
+      dnl when shared libs were found in a path that the runtime
+      dnl linker does not search through, we need to add it to
+      dnl CURL_LIBRARY_PATH to prevent further configure tests to fail
+      dnl due to this
+      if test "$cross_compiling" != "yes"; then
+        CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$mbedtlslib"
+        export CURL_LIBRARY_PATH
+        AC_MSG_NOTICE([Added $mbedtlslib to CURL_LIBRARY_PATH])
       fi
     fi
+    dnl FIXME: Enable when mbedTLS was detected via pkg-config
+    if false; then
+      LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE mbedtls mbedx509 mbedcrypto"
+    fi
 
-  fi dnl mbedTLS not disabled
+    dnl Check DES support in mbedTLS <4.
+    AC_CHECK_FUNCS(mbedtls_des_crypt_ecb)
+    if test "$ac_cv_func_mbedtls_des_crypt_ecb" = 'yes'; then
+      HAVE_MBEDTLS_DES_CRYPT_ECB=1
+    fi
+  fi
 
   test -z "$ssl_msg" || ssl_backends="${ssl_backends:+$ssl_backends, }$ssl_msg"
-fi
-
+fi dnl mbedTLS not disabled
 ])
diff --git a/third-party/curl/m4/curl-openssl.m4 b/third-party/curl/m4/curl-openssl.m4
index 83fcb1428a..816e7631fa 100644
--- a/third-party/curl/m4/curl-openssl.m4
+++ b/third-party/curl/m4/curl-openssl.m4
@@ -22,29 +22,33 @@
 #
 #***************************************************************************
 
-# File version for 'aclocal' use. Keep it a single number.
-# serial 5
+dnl File version for 'aclocal' use. Keep it a single number.
+dnl serial 5
 
 dnl **********************************************************************
 dnl Check for OpenSSL libraries and headers
 dnl **********************************************************************
 
 AC_DEFUN([CURL_WITH_OPENSSL], [
-if test "x$OPT_OPENSSL" != xno; then
+if test "x$OPT_OPENSSL" != "xno"; then
   ssl_msg=
 
-  dnl backup the pre-ssl variables
+  dnl backup the pre-detection variables
   CLEANLDFLAGS="$LDFLAGS"
+  CLEANLDFLAGSPC="$LDFLAGSPC"
   CLEANCPPFLAGS="$CPPFLAGS"
   CLEANLIBS="$LIBS"
 
-  dnl This is for Msys/Mingw
+  dnl This is for MSYS/MinGW
   case $host in
     *-*-msys* | *-*-mingw*)
       AC_MSG_CHECKING([for gdi32])
       my_ac_save_LIBS=$LIBS
       LIBS="-lgdi32 $LIBS"
       AC_LINK_IFELSE([ AC_LANG_PROGRAM([[
+        #ifndef WIN32_LEAN_AND_MEAN
+        #define WIN32_LEAN_AND_MEAN
+        #endif
         #include <windef.h>
         #include <wingdi.h>
         ]],
@@ -61,65 +65,64 @@ if test "x$OPT_OPENSSL" != xno; then
   esac
 
   case "$OPT_OPENSSL" in
-  yes)
-    dnl --with-openssl (without path) used
-    PKGTEST="yes"
-    PREFIX_OPENSSL=
-    ;;
-  *)
-    dnl check the given --with-openssl spot
-    PKGTEST="no"
-    PREFIX_OPENSSL=$OPT_OPENSSL
-
-    dnl Try pkg-config even when cross-compiling.  Since we
-    dnl specify PKG_CONFIG_LIBDIR we're only looking where
-    dnl the user told us to look
-    OPENSSL_PCDIR="$OPT_OPENSSL/lib/pkgconfig"
-    if test -f "$OPENSSL_PCDIR/openssl.pc"; then
-      AC_MSG_NOTICE([PKG_CONFIG_LIBDIR will be set to "$OPENSSL_PCDIR"])
+    yes)
+      dnl --with-openssl (without path) used
       PKGTEST="yes"
-    fi
+      PREFIX_OPENSSL=
+      ;;
+    *)
+      dnl check the given --with-openssl spot
+      PKGTEST="no"
+      PREFIX_OPENSSL=$OPT_OPENSSL
 
-    if test "$PKGTEST" != "yes"; then
-      # try lib64 instead
-      OPENSSL_PCDIR="$OPT_OPENSSL/lib64/pkgconfig"
+      dnl Try pkg-config even when cross-compiling.  Since we
+      dnl specify PKG_CONFIG_LIBDIR we are only looking where
+      dnl the user told us to look
+      OPENSSL_PCDIR="$OPT_OPENSSL/lib/pkgconfig"
       if test -f "$OPENSSL_PCDIR/openssl.pc"; then
-        AC_MSG_NOTICE([PKG_CONFIG_LIBDIR will be set to "$OPENSSL_PCDIR"])
+        AC_MSG_NOTICE([PKG_CONFIG_LIBDIR is set to "$OPENSSL_PCDIR"])
         PKGTEST="yes"
       fi
-    fi
 
-    if test "$PKGTEST" != "yes"; then
-      if test ! -f "$PREFIX_OPENSSL/include/openssl/ssl.h"; then
-        AC_MSG_ERROR([$PREFIX_OPENSSL is a bad --with-openssl prefix!])
+      if test "$PKGTEST" != "yes"; then
+        dnl try lib64 instead
+        OPENSSL_PCDIR="$OPT_OPENSSL/lib64/pkgconfig"
+        if test -f "$OPENSSL_PCDIR/openssl.pc"; then
+          AC_MSG_NOTICE([PKG_CONFIG_LIBDIR is set to "$OPENSSL_PCDIR"])
+          PKGTEST="yes"
+        fi
       fi
-    fi
 
-    dnl in case pkg-config comes up empty, use what we got
-    dnl via --with-openssl
-    LIB_OPENSSL="$PREFIX_OPENSSL/lib$libsuff"
-    if test "$PREFIX_OPENSSL" != "/usr" ; then
-      SSL_LDFLAGS="-L$LIB_OPENSSL"
-      SSL_CPPFLAGS="-I$PREFIX_OPENSSL/include"
-    fi
-    ;;
+      if test "$PKGTEST" != "yes"; then
+        if test ! -f "$PREFIX_OPENSSL/include/openssl/ssl.h"; then
+          AC_MSG_ERROR([$PREFIX_OPENSSL is a bad --with-openssl prefix!])
+        fi
+      fi
+
+      dnl in case pkg-config comes up empty, use what we got
+      dnl via --with-openssl
+      LIB_OPENSSL="$PREFIX_OPENSSL/lib$libsuff"
+      if test "$PREFIX_OPENSSL" != "/usr"; then
+        SSL_LDFLAGS="-L$LIB_OPENSSL"
+        SSL_CPPFLAGS="-I$PREFIX_OPENSSL/include"
+      fi
+      ;;
   esac
 
   if test "$PKGTEST" = "yes"; then
 
     CURL_CHECK_PKGCONFIG(openssl, [$OPENSSL_PCDIR])
 
-    if test "$PKGCONFIG" != "no" ; then
-      SSL_LIBS=`CURL_EXPORT_PCDIR([$OPENSSL_PCDIR]) dnl
+    if test "$PKGCONFIG" != "no"; then
+      SSL_LIBS=`CURL_EXPORT_PCDIR([$OPENSSL_PCDIR])
         $PKGCONFIG --libs-only-l --libs-only-other openssl 2>/dev/null`
 
-      SSL_LDFLAGS=`CURL_EXPORT_PCDIR([$OPENSSL_PCDIR]) dnl
+      SSL_LDFLAGS=`CURL_EXPORT_PCDIR([$OPENSSL_PCDIR])
         $PKGCONFIG --libs-only-L openssl 2>/dev/null`
 
-      SSL_CPPFLAGS=`CURL_EXPORT_PCDIR([$OPENSSL_PCDIR]) dnl
+      SSL_CPPFLAGS=`CURL_EXPORT_PCDIR([$OPENSSL_PCDIR])
         $PKGCONFIG --cflags-only-I openssl 2>/dev/null`
 
-      AC_SUBST(SSL_LIBS)
       AC_MSG_NOTICE([pkg-config: SSL_LIBS: "$SSL_LIBS"])
       AC_MSG_NOTICE([pkg-config: SSL_LDFLAGS: "$SSL_LDFLAGS"])
       AC_MSG_NOTICE([pkg-config: SSL_CPPFLAGS: "$SSL_CPPFLAGS"])
@@ -129,9 +132,9 @@ if test "x$OPT_OPENSSL" != xno; then
       dnl use the values pkg-config reported.  This is here
       dnl instead of below with CPPFLAGS and LDFLAGS because we only
       dnl learn about this via pkg-config.  If we only have
-      dnl the argument to --with-openssl we don't know what
+      dnl the argument to --with-openssl we do not know what
       dnl additional libs may be necessary.  Hope that we
-      dnl don't need any.
+      dnl do not need any.
       LIBS="$SSL_LIBS $LIBS"
     fi
   fi
@@ -139,282 +142,253 @@ if test "x$OPT_OPENSSL" != xno; then
   dnl finally, set flags to use SSL
   CPPFLAGS="$CPPFLAGS $SSL_CPPFLAGS"
   LDFLAGS="$LDFLAGS $SSL_LDFLAGS"
+  LDFLAGSPC="$LDFLAGSPC $SSL_LDFLAGS"
 
   AC_CHECK_LIB(crypto, HMAC_Update,[
-     HAVECRYPTO="yes"
-     LIBS="-lcrypto $LIBS"
-     ],[
-     if test -n "$LIB_OPENSSL" ; then
-       LDFLAGS="$CLEANLDFLAGS -L$LIB_OPENSSL"
-     fi
-     if test "$PKGCONFIG" = "no" -a -n "$PREFIX_OPENSSL" ; then
-       # only set this if pkg-config wasn't used
-       CPPFLAGS="$CLEANCPPFLAGS -I$PREFIX_OPENSSL/include"
-     fi
-     # Linking previously failed, try extra paths from --with-openssl or
-     # pkg-config.  Use a different function name to avoid reusing the earlier
-     # cached result.
-     AC_CHECK_LIB(crypto, HMAC_Init_ex,[
-       HAVECRYPTO="yes"
-       LIBS="-lcrypto $LIBS"], [
+    HAVECRYPTO="yes"
+    LIBS="-lcrypto $LIBS"
+    ],[
+    if test -n "$LIB_OPENSSL"; then
+      LDFLAGS="$CLEANLDFLAGS -L$LIB_OPENSSL"
+      LDFLAGSPC="$CLEANLDFLAGSPC -L$LIB_OPENSSL"
+    fi
+    if test "$PKGCONFIG" = "no" && test -n "$PREFIX_OPENSSL"; then
+      dnl only set this if pkg-config was not used
+      CPPFLAGS="$CLEANCPPFLAGS -I$PREFIX_OPENSSL/include"
+    fi
+    dnl Linking previously failed, try extra paths from --with-openssl or
+    dnl pkg-config.  Use a different function name to avoid reusing the earlier
+    dnl cached result.
+    AC_CHECK_LIB(crypto, HMAC_Init_ex,[
+      HAVECRYPTO="yes"
+      LIBS="-lcrypto $LIBS"], [
 
-       dnl still no, but what about with -ldl?
-       AC_MSG_CHECKING([OpenSSL linking with -ldl])
-       LIBS="-lcrypto $CLEANLIBS -ldl"
-       AC_LINK_IFELSE([ AC_LANG_PROGRAM([[
-         #include <openssl/err.h>
-       ]], [[
-         ERR_clear_error();
-       ]]) ],
-       [
-         AC_MSG_RESULT(yes)
-         HAVECRYPTO="yes"
-       ],
-       [
-         AC_MSG_RESULT(no)
-         dnl ok, so what about both -ldl and -lpthread?
-         dnl This may be necessary for static libraries.
+      dnl still no, but what about with -ldl?
+      AC_MSG_CHECKING([OpenSSL linking with -ldl])
+      LIBS="-lcrypto $CLEANLIBS -ldl"
+      AC_LINK_IFELSE([ AC_LANG_PROGRAM([[
+        #include <openssl/err.h>
+      ]], [[
+        ERR_clear_error();
+      ]]) ],
+      [
+        AC_MSG_RESULT(yes)
+        HAVECRYPTO="yes"
+      ],
+      [
+        AC_MSG_RESULT(no)
+        dnl ok, so what about both -ldl and -lpthread?
+        dnl This may be necessary for static libraries.
 
-         AC_MSG_CHECKING([OpenSSL linking with -ldl and -lpthread])
-         LIBS="-lcrypto $CLEANLIBS -ldl -lpthread"
-         AC_LINK_IFELSE([
-           AC_LANG_PROGRAM([[
-           #include <openssl/err.h>
-         ]], [[
-           ERR_clear_error();
-         ]])],
-         [
-           AC_MSG_RESULT(yes)
-           HAVECRYPTO="yes"
-         ],
-         [
-           AC_MSG_RESULT(no)
-           LDFLAGS="$CLEANLDFLAGS"
-           CPPFLAGS="$CLEANCPPFLAGS"
-           LIBS="$CLEANLIBS"
-
-         ])
-
-       ])
-
-     ])
+        AC_MSG_CHECKING([OpenSSL linking with -ldl and -lpthread])
+        LIBS="-lcrypto $CLEANLIBS -ldl -lpthread"
+        AC_LINK_IFELSE([
+          AC_LANG_PROGRAM([[
+          #include <openssl/err.h>
+        ]], [[
+          ERR_clear_error();
+        ]])],
+        [
+          AC_MSG_RESULT(yes)
+          HAVECRYPTO="yes"
+        ],
+        [
+          AC_MSG_RESULT(no)
+          LDFLAGS="$CLEANLDFLAGS"
+          LDFLAGSPC="$CLEANLDFLAGSPC"
+          CPPFLAGS="$CLEANCPPFLAGS"
+          LIBS="$CLEANLIBS"
+        ])
+      ])
+    ])
   ])
 
-  if test X"$HAVECRYPTO" = X"yes"; then
+  if test "$HAVECRYPTO" = "yes"; then
     dnl This is only reasonable to do if crypto actually is there: check for
     dnl SSL libs NOTE: it is important to do this AFTER the crypto lib
 
     AC_CHECK_LIB(ssl, SSL_connect)
 
-    if test "$ac_cv_lib_ssl_SSL_connect" != yes; then
-        dnl we didn't find the SSL lib, try the RSAglue/rsaref stuff
-        AC_MSG_CHECKING(for ssl with RSAglue/rsaref libs in use);
-        OLIBS=$LIBS
-        LIBS="-lRSAglue -lrsaref $LIBS"
-        AC_CHECK_LIB(ssl, SSL_connect)
-        if test "$ac_cv_lib_ssl_SSL_connect" != yes; then
-            dnl still no SSL_connect
-            AC_MSG_RESULT(no)
-            LIBS=$OLIBS
-        else
-            AC_MSG_RESULT(yes)
-        fi
-
-    else
-
+    if test "$ac_cv_lib_ssl_SSL_connect" = "yes"; then
       dnl Have the libraries--check for OpenSSL headers
-      AC_CHECK_HEADERS(openssl/x509.h openssl/rsa.h openssl/crypto.h \
-                       openssl/pem.h openssl/ssl.h openssl/err.h,
+      AC_CHECK_HEADERS(openssl/rsa.h openssl/crypto.h openssl/pem.h openssl/ssl.h openssl/err.h,
         ssl_msg="OpenSSL"
-        test openssl != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
+        test "openssl" != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
         OPENSSL_ENABLED=1
         AC_DEFINE(USE_OPENSSL, 1, [if OpenSSL is in use]))
-
-      if test $ac_cv_header_openssl_x509_h = no; then
-        dnl we don't use the "action" part of the AC_CHECK_HEADERS macro
-        dnl since 'err.h' might in fact find a krb4 header with the same
-        dnl name
-        AC_CHECK_HEADERS(x509.h rsa.h crypto.h pem.h ssl.h err.h)
-
-        if test $ac_cv_header_x509_h = yes &&
-           test $ac_cv_header_crypto_h = yes &&
-           test $ac_cv_header_ssl_h = yes; then
-          dnl three matches
-          ssl_msg="OpenSSL"
-          OPENSSL_ENABLED=1
-        fi
-      fi
     fi
 
-    if test X"$OPENSSL_ENABLED" != X"1"; then
-       LIBS="$CLEANLIBS"
-    fi
-
-    if test X"$OPT_OPENSSL" != Xoff &&
-       test "$OPENSSL_ENABLED" != "1"; then
+    if test "$OPENSSL_ENABLED" != "1"; then
+      LIBS="$CLEANLIBS"
       AC_MSG_ERROR([OpenSSL libs and/or directories were not found where specified!])
     fi
   fi
 
-  if test X"$OPENSSL_ENABLED" = X"1"; then
+  if test "$OPENSSL_ENABLED" = "1"; then
     dnl These can only exist if OpenSSL exists
 
-    AC_MSG_CHECKING([for BoringSSL])
-    AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-                #include <openssl/base.h>
-                ]],[[
-                #ifndef OPENSSL_IS_BORINGSSL
-                #error not boringssl
-                #endif
-       ]])
-    ],[
-        AC_MSG_RESULT([yes])
-        AC_DEFINE_UNQUOTED(HAVE_BORINGSSL, 1,
-                           [Define to 1 if using BoringSSL.])
-        ssl_msg="BoringSSL"
-    ],[
-        AC_MSG_RESULT([no])
-    ])
-
     AC_MSG_CHECKING([for AWS-LC])
-    AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-                #include <openssl/base.h>
-                ]],[[
-                #ifndef OPENSSL_IS_AWSLC
-                #error not AWS-LC
-                #endif
-       ]])
-    ],[
-        AC_MSG_RESULT([yes])
-        AC_DEFINE_UNQUOTED(HAVE_AWSLC, 1,
-                           [Define to 1 if using AWS-LC.])
-        ssl_msg="AWS-LC"
-    ],[
-        AC_MSG_RESULT([no])
-    ])
-
-    AC_MSG_CHECKING([for libressl])
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
-#include <openssl/opensslv.h>
-      ]],[[
-        int dummy = LIBRESSL_VERSION_NUMBER;
-      ]])
-    ],[
-      AC_MSG_RESULT([yes])
-      AC_DEFINE_UNQUOTED(HAVE_LIBRESSL, 1,
-        [Define to 1 if using libressl.])
-      ssl_msg="libressl"
-    ],[
-      AC_MSG_RESULT([no])
-    ])
-
-    AC_MSG_CHECKING([for OpenSSL >= v3])
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-#include <openssl/opensslv.h>
-      ]],[[
-        #if defined(OPENSSL_VERSION_MAJOR) && (OPENSSL_VERSION_MAJOR >= 3)
-        return 0;
-        #else
-        #error older than 3
+        #include <openssl/base.h>
+        ]],[[
+        #ifndef OPENSSL_IS_AWSLC
+        #error not AWS-LC
         #endif
       ]])
     ],[
       AC_MSG_RESULT([yes])
-      AC_DEFINE_UNQUOTED(HAVE_OPENSSL3, 1,
-        [Define to 1 if using OpenSSL 3 or later.])
-      ssl_msg="OpenSSL v3+"
+      ssl_msg="AWS-LC"
+      OPENSSL_IS_AWSLC=1
     ],[
       AC_MSG_RESULT([no])
     ])
+
+    AC_MSG_CHECKING([for BoringSSL])
+    AC_COMPILE_IFELSE([
+      AC_LANG_PROGRAM([[
+        #include <openssl/base.h>
+        ]],[[
+        #ifndef OPENSSL_IS_BORINGSSL
+        #error not BoringSSL
+        #endif
+      ]])
+    ],[
+      AC_MSG_RESULT([yes])
+      ssl_msg="BoringSSL"
+      OPENSSL_IS_BORINGSSL=1
+    ],[
+      AC_MSG_RESULT([no])
+    ])
+
+    AC_MSG_CHECKING([for LibreSSL])
+    AC_COMPILE_IFELSE([
+      AC_LANG_PROGRAM([[
+        #include <openssl/opensslv.h>
+      ]],[[
+        int dummy = LIBRESSL_VERSION_NUMBER;
+        (void)dummy;
+      ]])
+    ],[
+      AC_MSG_RESULT([yes])
+      ssl_msg="LibreSSL"
+      HAVE_LIBRESSL=1
+    ],[
+      AC_MSG_RESULT([no])
+    ])
+
+    if test "$ssl_msg" = 'OpenSSL'; then
+      AC_MSG_CHECKING([for OpenSSL >= v3])
+      AC_COMPILE_IFELSE([
+        AC_LANG_PROGRAM([[
+          #include <openssl/opensslv.h>
+        ]],[[
+          #if (OPENSSL_VERSION_NUMBER >= 0x30000000L)
+          return 0;
+          #else
+          #error older than 3
+          #endif
+        ]])
+      ],[],[
+        AC_MSG_ERROR([OpenSSL 3.0.0 or upper required.])
+      ])
+    fi
+  fi
+
+  dnl is this OpenSSL (fork) providing the original QUIC API?
+  AC_CHECK_FUNCS([SSL_set_quic_use_legacy_codepoint], [QUIC_ENABLED=yes])
+  if test "$QUIC_ENABLED" = "yes"; then
+    AC_MSG_NOTICE([OpenSSL fork speaks QUIC API])
+  else
+    AC_CHECK_FUNCS([SSL_set_quic_tls_cbs], [QUIC_ENABLED=yes])
+    if test "$QUIC_ENABLED" = "yes"; then
+      AC_MSG_NOTICE([OpenSSL with QUIC APIv2])
+      OPENSSL_QUIC_API2=1
+    else
+      AC_MSG_NOTICE([OpenSSL version does not speak any known QUIC API])
+    fi
   fi
 
   if test "$OPENSSL_ENABLED" = "1"; then
     if test -n "$LIB_OPENSSL"; then
-       dnl when the ssl shared libs were found in a path that the run-time
-       dnl linker doesn't search through, we need to add it to CURL_LIBRARY_PATH
-       dnl to prevent further configure tests to fail due to this
-       if test "x$cross_compiling" != "xyes"; then
-         CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$LIB_OPENSSL"
-         export CURL_LIBRARY_PATH
-         AC_MSG_NOTICE([Added $LIB_OPENSSL to CURL_LIBRARY_PATH])
-       fi
+      dnl when the SSL shared libs were found in a path that the runtime
+      dnl linker does not search through, we need to add it to CURL_LIBRARY_PATH
+      dnl to prevent further configure tests to fail due to this
+      if test "$cross_compiling" != "yes"; then
+        CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$LIB_OPENSSL"
+        export CURL_LIBRARY_PATH
+        AC_MSG_NOTICE([Added $LIB_OPENSSL to CURL_LIBRARY_PATH])
+      fi
     fi
     check_for_ca_bundle=1
+    if test "$OPENSSL_IS_BORINGSSL" != "1"; then  dnl BoringSSL does not provide openssl.pc
+      LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE openssl"
+    fi
+  fi
+
+  if test "$OPENSSL_ENABLED" != "1"; then
+    AC_MSG_NOTICE([OPT_OPENSSL: $OPT_OPENSSL])
+    AC_MSG_NOTICE([OPENSSL_ENABLED: $OPENSSL_ENABLED])
+    AC_MSG_ERROR([--with-openssl was given but OpenSSL could not be detected])
   fi
 
   test -z "$ssl_msg" || ssl_backends="${ssl_backends:+$ssl_backends, }$ssl_msg"
-fi
+fi dnl OpenSSL not disabled
 
-if test X"$OPT_OPENSSL" != Xno &&
-  test "$OPENSSL_ENABLED" != "1"; then
-  AC_MSG_NOTICE([OPT_OPENSSL: $OPT_OPENSSL])
-  AC_MSG_NOTICE([OPENSSL_ENABLED: $OPENSSL_ENABLED])
-  AC_MSG_ERROR([--with-openssl was given but OpenSSL could not be detected])
-fi
-
-dnl **********************************************************************
-dnl Check for the random seed preferences
-dnl **********************************************************************
-
-if test X"$OPENSSL_ENABLED" = X"1"; then
-  dnl Check for user-specified random device
-  AC_ARG_WITH(random,
-  AS_HELP_STRING([--with-random=FILE],
-                 [read randomness from FILE (default=/dev/urandom)]),
-      [ RANDOM_FILE="$withval" ],
-      [
-          if test x$cross_compiling != xyes; then
-            dnl Check for random device
-            AC_CHECK_FILE("/dev/urandom", [ RANDOM_FILE="/dev/urandom"] )
-          else
-            AC_MSG_WARN([skipped the /dev/urandom detection when cross-compiling])
-          fi
-      ]
-  )
-  if test -n "$RANDOM_FILE" && test X"$RANDOM_FILE" != Xno ; then
-          AC_SUBST(RANDOM_FILE)
-          AC_DEFINE_UNQUOTED(RANDOM_FILE, "$RANDOM_FILE",
-          [a suitable file to read random data from])
-  fi
-fi
-
-dnl ---
-dnl We require OpenSSL with SRP support.
-dnl ---
 if test "$OPENSSL_ENABLED" = "1"; then
+  dnl ---
+  dnl We check OpenSSL for DES support.
+  dnl ---
+  AC_MSG_CHECKING([for DES support in OpenSSL])
+  AC_LINK_IFELSE([
+    AC_LANG_PROGRAM([[
+      #ifndef OPENSSL_SUPPRESS_DEPRECATED
+      #define OPENSSL_SUPPRESS_DEPRECATED
+      #endif
+      #include <openssl/des.h>
+    ]],[[
+      DES_ecb_encrypt(0, 0, 0, DES_ENCRYPT);
+    ]])
+  ],[
+    AC_MSG_RESULT([yes])
+    AC_DEFINE(HAVE_DES_ECB_ENCRYPT, 1, [if you have the function DES_ecb_encrypt])
+    HAVE_DES_ECB_ENCRYPT=1
+  ],[
+    AC_MSG_RESULT([no])
+  ])
+
+  dnl ---
+  dnl We require OpenSSL with SRP support.
+  dnl ---
   AC_MSG_CHECKING([for SRP support in OpenSSL])
   AC_LINK_IFELSE([
     AC_LANG_PROGRAM([[
-#include <openssl/ssl.h>
+      #ifndef OPENSSL_SUPPRESS_DEPRECATED
+      #define OPENSSL_SUPPRESS_DEPRECATED
+      #endif
+      #include <openssl/ssl.h>
     ]],[[
-      SSL_CTX_set_srp_username(NULL, "");
-      SSL_CTX_set_srp_password(NULL, "");
+      SSL_CTX_set_srp_username(NULL, NULL);
+      SSL_CTX_set_srp_password(NULL, NULL);
     ]])
   ],[
     AC_MSG_RESULT([yes])
     AC_DEFINE(HAVE_OPENSSL_SRP, 1, [if you have the functions SSL_CTX_set_srp_username and SSL_CTX_set_srp_password])
-    AC_SUBST(HAVE_OPENSSL_SRP, [1])
+    HAVE_OPENSSL_SRP=1
   ],[
     AC_MSG_RESULT([no])
   ])
-fi
 
-dnl ---
-dnl Whether the OpenSSL configuration will be loaded automatically
-dnl ---
-if test X"$OPENSSL_ENABLED" = X"1"; then
-AC_ARG_ENABLE(openssl-auto-load-config,
+  dnl ---
+  dnl Whether the OpenSSL configuration is loaded automatically
+  dnl ---
+  AC_ARG_ENABLE(openssl-auto-load-config,
 AS_HELP_STRING([--enable-openssl-auto-load-config],[Enable automatic loading of OpenSSL configuration])
 AS_HELP_STRING([--disable-openssl-auto-load-config],[Disable automatic loading of OpenSSL configuration]),
-[ if test X"$enableval" = X"no"; then
-    AC_MSG_NOTICE([automatic loading of OpenSSL configuration disabled])
-    AC_DEFINE(CURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG, 1, [if the OpenSSL configuration won't be loaded automatically])
-  fi
-])
+  [ if test "x$enableval" = "xno"; then
+      AC_MSG_NOTICE([automatic loading of OpenSSL configuration disabled])
+      AC_DEFINE(CURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG, 1, [if the OpenSSL configuration is not loaded automatically])
+    fi
+  ])
 fi
-
 ])
diff --git a/third-party/curl/m4/curl-override.m4 b/third-party/curl/m4/curl-override.m4
index b4a8df9bb6..59e6548dbd 100644
--- a/third-party/curl/m4/curl-override.m4
+++ b/third-party/curl/m4/curl-override.m4
@@ -20,17 +20,15 @@
 #
 # SPDX-License-Identifier: curl
 #
-###########################################################################
-#***************************************************************************
 #***************************************************************************
 
-# File version for 'aclocal' use. Keep it a single number.
-# serial 7
+dnl File version for 'aclocal' use. Keep it a single number.
+dnl serial 7
 
 dnl CURL_OVERRIDE_AUTOCONF
 dnl -------------------------------------------------
 dnl Placing a call to this macro in configure.ac after
-dnl the one to AC_INIT will make macros in this file
+dnl the one to AC_INIT makes macros in this file
 dnl visible to the rest of the compilation overriding
 dnl those from Autoconf.
 
@@ -42,17 +40,16 @@ AC_BEFORE([$0],[AC_PROG_LIBTOOL])
 dnl Override Autoconf's AC_LANG_PROGRAM (C)
 dnl -------------------------------------------------
 dnl This is done to prevent compiler warning
-dnl 'function declaration isn't a prototype'
+dnl 'function declaration is not a prototype'
 dnl in function main. This requires at least
-dnl a c89 compiler and does not support K&R.
+dnl a C89 compiler and does not support K&R.
 
 m4_define([AC_LANG_PROGRAM(C)],
 [$1
-int main (void)
+int main(void)
 {
 $2
- ;
- return 0;
+  return 0;
 }])
 
 dnl Override Autoconf's AC_LANG_CALL (C)
@@ -83,9 +80,9 @@ m4_define([AC_LANG_FUNC_LINK_TRY(C)],
 [
 #define $1 innocuous_$1
 #ifdef __STDC__
-# include <limits.h>
+#  include <limits.h>
 #else
-# include <assert.h>
+#  include <assert.h>
 #endif
 #undef $1
 #ifdef __cplusplus
@@ -93,6 +90,6 @@ extern "C"
 #endif
 char $1 ();
 #if defined __stub_$1 || defined __stub___$1
-choke me
+#error force compilation error
 #endif
 ], [return $1 ();])])
diff --git a/third-party/curl/m4/curl-reentrant.m4 b/third-party/curl/m4/curl-reentrant.m4
index c1f333982d..eb585ad64d 100644
--- a/third-party/curl/m4/curl-reentrant.m4
+++ b/third-party/curl/m4/curl-reentrant.m4
@@ -22,8 +22,8 @@
 #
 #***************************************************************************
 
-# File version for 'aclocal' use. Keep it a single number.
-# serial 10
+dnl File version for 'aclocal' use. Keep it a single number.
+dnl serial 10
 
 dnl Note 1
 dnl ------
@@ -40,7 +40,7 @@ dnl makes errno available as a preprocessor macro.
 AC_DEFUN([CURL_CHECK_NEED_REENTRANT_ERRNO], [
   AC_COMPILE_IFELSE([
     AC_LANG_PROGRAM([[
-#include <errno.h>
+      #include <errno.h>
     ]],[[
       if(0 != errno)
         return 1;
@@ -53,27 +53,29 @@ AC_DEFUN([CURL_CHECK_NEED_REENTRANT_ERRNO], [
   if test "$tmp_errno" = "yes"; then
     AC_COMPILE_IFELSE([
       AC_LANG_PROGRAM([[
-#include <errno.h>
+        #include <errno.h>
       ]],[[
-#ifdef errno
-        int dummy=1;
-#else
-        force compilation error
-#endif
+        #ifdef errno
+          int dummy = 1;
+          (void)dummy;
+        #else
+          #error force compilation error
+        #endif
       ]])
     ],[
       tmp_errno="errno_macro_defined"
     ],[
       AC_COMPILE_IFELSE([
         AC_LANG_PROGRAM([[
-#define _REENTRANT
-#include <errno.h>
+          #define _REENTRANT
+          #include <errno.h>
         ]],[[
-#ifdef errno
-          int dummy=1;
-#else
-          force compilation error
-#endif
+          #ifdef errno
+            int dummy = 1;
+            (void)dummy;
+          #else
+            #error force compilation error
+          #endif
         ]])
       ],[
         tmp_errno="errno_macro_needs_reentrant"
@@ -99,15 +101,15 @@ AC_DEFUN([CURL_CHECK_NEED_REENTRANT_GMTIME_R], [
   ])
   if test "$tmp_gmtime_r" = "yes"; then
     AC_EGREP_CPP([gmtime_r],[
-#include <sys/types.h>
-#include <time.h>
+      #include <sys/types.h>
+      #include <time.h>
     ],[
       tmp_gmtime_r="proto_declared"
     ],[
       AC_EGREP_CPP([gmtime_r],[
-#define _REENTRANT
-#include <sys/types.h>
-#include <time.h>
+        #define _REENTRANT
+        #include <sys/types.h>
+        #include <time.h>
       ],[
         tmp_gmtime_r="proto_needs_reentrant"
         tmp_need_reentrant="yes"
@@ -132,15 +134,15 @@ AC_DEFUN([CURL_CHECK_NEED_REENTRANT_LOCALTIME_R], [
   ])
   if test "$tmp_localtime_r" = "yes"; then
     AC_EGREP_CPP([localtime_r],[
-#include <sys/types.h>
-#include <time.h>
+      #include <sys/types.h>
+      #include <time.h>
     ],[
       tmp_localtime_r="proto_declared"
     ],[
       AC_EGREP_CPP([localtime_r],[
-#define _REENTRANT
-#include <sys/types.h>
-#include <time.h>
+        #define _REENTRANT
+        #include <sys/types.h>
+        #include <time.h>
       ],[
         tmp_localtime_r="proto_needs_reentrant"
         tmp_need_reentrant="yes"
@@ -165,15 +167,15 @@ AC_DEFUN([CURL_CHECK_NEED_REENTRANT_STRERROR_R], [
   ])
   if test "$tmp_strerror_r" = "yes"; then
     AC_EGREP_CPP([strerror_r],[
-#include <sys/types.h>
-#include <string.h>
+      #include <sys/types.h>
+      #include <string.h>
     ],[
       tmp_strerror_r="proto_declared"
     ],[
       AC_EGREP_CPP([strerror_r],[
-#define _REENTRANT
-#include <sys/types.h>
-#include <string.h>
+        #define _REENTRANT
+        #include <sys/types.h>
+        #include <string.h>
       ],[
         tmp_strerror_r="proto_needs_reentrant"
         tmp_need_reentrant="yes"
@@ -183,39 +185,6 @@ AC_DEFUN([CURL_CHECK_NEED_REENTRANT_STRERROR_R], [
 ])
 
 
-dnl CURL_CHECK_NEED_REENTRANT_STRTOK_R
-dnl -------------------------------------------------
-dnl Checks if the preprocessor _REENTRANT definition
-dnl makes function strtok_r compiler visible.
-
-AC_DEFUN([CURL_CHECK_NEED_REENTRANT_STRTOK_R], [
-  AC_LINK_IFELSE([
-    AC_LANG_FUNC_LINK_TRY([strtok_r])
-  ],[
-    tmp_strtok_r="yes"
-  ],[
-    tmp_strtok_r="no"
-  ])
-  if test "$tmp_strtok_r" = "yes"; then
-    AC_EGREP_CPP([strtok_r],[
-#include <sys/types.h>
-#include <string.h>
-    ],[
-      tmp_strtok_r="proto_declared"
-    ],[
-      AC_EGREP_CPP([strtok_r],[
-#define _REENTRANT
-#include <sys/types.h>
-#include <string.h>
-      ],[
-        tmp_strtok_r="proto_needs_reentrant"
-        tmp_need_reentrant="yes"
-      ])
-    ])
-  fi
-])
-
-
 dnl CURL_CHECK_NEED_REENTRANT_GETHOSTBYNAME_R
 dnl -------------------------------------------------
 dnl Checks if the preprocessor _REENTRANT definition
@@ -231,15 +200,15 @@ AC_DEFUN([CURL_CHECK_NEED_REENTRANT_GETHOSTBYNAME_R], [
   ])
   if test "$tmp_gethostbyname_r" = "yes"; then
     AC_EGREP_CPP([gethostbyname_r],[
-#include <sys/types.h>
-#include <netdb.h>
+      #include <sys/types.h>
+      #include <netdb.h>
     ],[
       tmp_gethostbyname_r="proto_declared"
     ],[
       AC_EGREP_CPP([gethostbyname_r],[
-#define _REENTRANT
-#include <sys/types.h>
-#include <netdb.h>
+        #define _REENTRANT
+        #include <sys/types.h>
+        #include <netdb.h>
       ],[
         tmp_gethostbyname_r="proto_needs_reentrant"
         tmp_need_reentrant="yes"
@@ -264,15 +233,15 @@ AC_DEFUN([CURL_CHECK_NEED_REENTRANT_GETPROTOBYNAME_R], [
   ])
   if test "$tmp_getprotobyname_r" = "yes"; then
     AC_EGREP_CPP([getprotobyname_r],[
-#include <sys/types.h>
-#include <netdb.h>
+      #include <sys/types.h>
+      #include <netdb.h>
     ],[
       tmp_getprotobyname_r="proto_declared"
     ],[
       AC_EGREP_CPP([getprotobyname_r],[
-#define _REENTRANT
-#include <sys/types.h>
-#include <netdb.h>
+        #define _REENTRANT
+        #include <sys/types.h>
+        #include <netdb.h>
       ],[
         tmp_getprotobyname_r="proto_needs_reentrant"
         tmp_need_reentrant="yes"
@@ -298,9 +267,6 @@ AC_DEFUN([CURL_CHECK_NEED_REENTRANT_FUNCTIONS_R], [
   if test "$tmp_need_reentrant" = "no"; then
     CURL_CHECK_NEED_REENTRANT_STRERROR_R
   fi
-  if test "$tmp_need_reentrant" = "no"; then
-    CURL_CHECK_NEED_REENTRANT_STRTOK_R
-  fi
   if test "$tmp_need_reentrant" = "no"; then
     CURL_CHECK_NEED_REENTRANT_GETHOSTBYNAME_R
   fi
@@ -354,10 +320,10 @@ AC_DEFUN([CURL_CHECK_NEED_THREAD_SAFE_SYSTEM], [
 dnl CURL_CONFIGURE_FROM_NOW_ON_WITH_REENTRANT
 dnl -------------------------------------------------
 dnl This macro ensures that configuration tests done
-dnl after this will execute with preprocessor symbol
-dnl _REENTRANT defined. This macro also ensures that
-dnl the generated config file defines NEED_REENTRANT
-dnl and that in turn curl_setup.h will define _REENTRANT.
+dnl after this execute with preprocessor symbol _REENTRANT
+dnl defined. This macro also ensures that the generated
+dnl config file defines NEED_REENTRANT and that in turn
+dnl curl_setup.h defines _REENTRANT.
 dnl Internal macro for CURL_CONFIGURE_REENTRANT.
 
 AC_DEFUN([CURL_CONFIGURE_FROM_NOW_ON_WITH_REENTRANT], [
@@ -374,10 +340,10 @@ _EOF
 dnl CURL_CONFIGURE_FROM_NOW_ON_WITH_THREAD_SAFE
 dnl -------------------------------------------------
 dnl This macro ensures that configuration tests done
-dnl after this will execute with preprocessor symbol
-dnl _THREAD_SAFE defined. This macro also ensures that
-dnl the generated config file defines NEED_THREAD_SAFE
-dnl and that in turn curl_setup.h will define _THREAD_SAFE.
+dnl after this execute with preprocessor symbol_THREAD_SAFE
+dnl defined. This macro also ensures that the generated
+dnl config file defines NEED_THREAD_SAFE and that in turn
+dnl curl_setup.h defines _THREAD_SAFE.
 dnl Internal macro for CURL_CONFIGURE_THREAD_SAFE.
 
 AC_DEFUN([CURL_CONFIGURE_FROM_NOW_ON_WITH_THREAD_SAFE], [
@@ -394,7 +360,7 @@ _EOF
 dnl CURL_CONFIGURE_REENTRANT
 dnl -------------------------------------------------
 dnl This first checks if the preprocessor _REENTRANT
-dnl symbol is already defined. If it isn't currently
+dnl symbol is already defined. If it is not currently
 dnl defined a set of checks are performed to verify
 dnl if its definition is required to make visible to
 dnl the compiler a set of *_r functions. Finally, if
@@ -404,17 +370,18 @@ dnl that it is defined equally for further configure
 dnl tests and generated config file.
 
 AC_DEFUN([CURL_CONFIGURE_REENTRANT], [
-  AC_PREREQ([2.50])dnl
-  #
+  AC_PREREQ([2.50])
+
   AC_MSG_CHECKING([if _REENTRANT is already defined])
   AC_COMPILE_IFELSE([
     AC_LANG_PROGRAM([[
     ]],[[
-#ifdef _REENTRANT
-      int dummy=1;
-#else
-      force compilation error
-#endif
+      #ifdef _REENTRANT
+        int dummy = 1;
+        (void)dummy;
+      #else
+        #error force compilation error
+      #endif
     ]])
   ],[
     AC_MSG_RESULT([yes])
@@ -423,7 +390,7 @@ AC_DEFUN([CURL_CONFIGURE_REENTRANT], [
     AC_MSG_RESULT([no])
     tmp_reentrant_initially_defined="no"
   ])
-  #
+
   if test "$tmp_reentrant_initially_defined" = "no"; then
     AC_MSG_CHECKING([if _REENTRANT is actually needed])
     CURL_CHECK_NEED_REENTRANT_SYSTEM
@@ -439,7 +406,7 @@ AC_DEFUN([CURL_CONFIGURE_REENTRANT], [
       AC_MSG_RESULT([no])
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if _REENTRANT is onwards defined])
   if test "$tmp_reentrant_initially_defined" = "yes" ||
     test "$tmp_need_reentrant" = "yes"; then
@@ -448,14 +415,13 @@ AC_DEFUN([CURL_CONFIGURE_REENTRANT], [
   else
     AC_MSG_RESULT([no])
   fi
-  #
 ])
 
 
 dnl CURL_CONFIGURE_THREAD_SAFE
 dnl -------------------------------------------------
 dnl This first checks if the preprocessor _THREAD_SAFE
-dnl symbol is already defined. If it isn't currently
+dnl symbol is already defined. If it is not currently
 dnl defined a set of checks are performed to verify
 dnl if its definition is required. Finally, if
 dnl _THREAD_SAFE is already defined or needed it takes
@@ -464,17 +430,18 @@ dnl that it is defined equally for further configure
 dnl tests and generated config file.
 
 AC_DEFUN([CURL_CONFIGURE_THREAD_SAFE], [
-  AC_PREREQ([2.50])dnl
-  #
+  AC_PREREQ([2.50])
+
   AC_MSG_CHECKING([if _THREAD_SAFE is already defined])
   AC_COMPILE_IFELSE([
     AC_LANG_PROGRAM([[
     ]],[[
-#ifdef _THREAD_SAFE
-      int dummy=1;
-#else
-      force compilation error
-#endif
+      #ifdef _THREAD_SAFE
+        int dummy = 1;
+        (void)dummy;
+      #else
+        #error force compilation error
+      #endif
     ]])
   ],[
     AC_MSG_RESULT([yes])
@@ -483,7 +450,7 @@ AC_DEFUN([CURL_CONFIGURE_THREAD_SAFE], [
     AC_MSG_RESULT([no])
     tmp_thread_safe_initially_defined="no"
   ])
-  #
+
   if test "$tmp_thread_safe_initially_defined" = "no"; then
     AC_MSG_CHECKING([if _THREAD_SAFE is actually needed])
     CURL_CHECK_NEED_THREAD_SAFE_SYSTEM
@@ -493,7 +460,7 @@ AC_DEFUN([CURL_CONFIGURE_THREAD_SAFE], [
       AC_MSG_RESULT([no])
     fi
   fi
-  #
+
   AC_MSG_CHECKING([if _THREAD_SAFE is onwards defined])
   if test "$tmp_thread_safe_initially_defined" = "yes" ||
     test "$tmp_need_thread_safe" = "yes"; then
@@ -502,5 +469,4 @@ AC_DEFUN([CURL_CONFIGURE_THREAD_SAFE], [
   else
     AC_MSG_RESULT([no])
   fi
-  #
 ])
diff --git a/third-party/curl/m4/curl-rustls.m4 b/third-party/curl/m4/curl-rustls.m4
index 75542e4a42..86bed3c323 100644
--- a/third-party/curl/m4/curl-rustls.m4
+++ b/third-party/curl/m4/curl-rustls.m4
@@ -24,88 +24,171 @@
 
 AC_DEFUN([CURL_WITH_RUSTLS], [
 dnl ----------------------------------------------------
-dnl check for rustls
+dnl check for Rustls
 dnl ----------------------------------------------------
 
-if test "x$OPT_RUSTLS" != xno; then
-  _cppflags=$CPPFLAGS
-  _ldflags=$LDFLAGS
+if test "x$OPT_RUSTLS" != "xno"; then
   ssl_msg=
 
-  if test X"$OPT_RUSTLS" != Xno; then
+  dnl backup the pre-detection variables
+  CLEANLDFLAGS="$LDFLAGS"
+  CLEANLDFLAGSPC="$LDFLAGSPC"
+  CLEANCPPFLAGS="$CPPFLAGS"
 
-    if test "$OPT_RUSTLS" = "yes"; then
-      OPT_RUSTLS=""
-    fi
+  dnl NEW CODE
 
-    case $host_os in
-      darwin*)
-        LDFLAGS="$LDFLAGS -framework Security"
-        ;;
-      *)
-        ;;
-    esac
+  dnl use pkg-config unless we have been given a path
+  dnl even then, try pkg-config first
 
-    if test -z "$OPT_RUSTLS" ; then
-      dnl check for lib first without setting any new path
+  case "$OPT_RUSTLS" in
+    yes)
+      dnl --with-rustls (without path) used
+      PKGTEST="yes"
+      PREFIX_RUSTLS=
+      ;;
+    *)
+      dnl check the provided --with-rustls path
+      PKGTEST="no"
+      PREFIX_RUSTLS=$OPT_RUSTLS
 
-      AC_CHECK_LIB(rustls, rustls_client_session_read,
-      dnl librustls found, set the variable
-       [
-         AC_DEFINE(USE_RUSTLS, 1, [if rustls is enabled])
-         AC_SUBST(USE_RUSTLS, [1])
-         RUSTLS_ENABLED=1
-         USE_RUSTLS="yes"
-         ssl_msg="rustls"
-         test rustls != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
-        ], [], -lpthread -ldl -lm)
-    fi
+      dnl Try pkg-config even when cross-compiling.  Since we
+      dnl specify PKG_CONFIG_LIBDIR we are only looking where
+      dnl the user told us to look
 
-    if test "x$USE_RUSTLS" != "xyes"; then
-      dnl add the path and test again
-      addld=-L$OPT_RUSTLS/lib$libsuff
-      addcflags=-I$OPT_RUSTLS/include
-      rustlslib=$OPT_RUSTLS/lib$libsuff
-
-      LDFLAGS="$LDFLAGS $addld"
-      if test "$addcflags" != "-I/usr/include"; then
-         CPPFLAGS="$CPPFLAGS $addcflags"
+      RUSTLS_PCDIR="$PREFIX_RUSTLS/lib/pkgconfig"
+      if test -f "$RUSTLS_PCDIR/rustls.pc"; then
+        AC_MSG_NOTICE([PKG_CONFIG_LIBDIR is set to "$RUSTLS_PCDIR"])
+        PKGTEST="yes"
       fi
 
-      AC_CHECK_LIB(rustls, rustls_connection_read,
-       [
-       AC_DEFINE(USE_RUSTLS, 1, [if rustls is enabled])
-       AC_SUBST(USE_RUSTLS, [1])
-       RUSTLS_ENABLED=1
-       USE_RUSTLS="yes"
-       ssl_msg="rustls"
-       test rustls != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
-       ],
-       AC_MSG_ERROR([--with-rustls was specified but could not find rustls.]),
-       -lpthread -ldl -lm)
-    fi
-
-    if test "x$USE_RUSTLS" = "xyes"; then
-      AC_MSG_NOTICE([detected rustls])
-      check_for_ca_bundle=1
-
-      LIBS="-lrustls -lpthread -ldl -lm $LIBS"
-
-      if test -n "$rustlslib"; then
-        dnl when shared libs were found in a path that the run-time
-        dnl linker doesn't search through, we need to add it to
-        dnl CURL_LIBRARY_PATH to prevent further configure tests to fail
-        dnl due to this
-        if test "x$cross_compiling" != "xyes"; then
-          CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$rustlslib"
-          export CURL_LIBRARY_PATH
-          AC_MSG_NOTICE([Added $rustlslib to CURL_LIBRARY_PATH])
+      if test "$PKGTEST" != "yes"; then
+        dnl try lib64 instead
+        RUSTLS_PCDIR="$PREFIX_RUSTLS/lib64/pkgconfig"
+        if test -f "$RUSTLS_PCDIR/rustls.pc"; then
+          AC_MSG_NOTICE([PKG_CONFIG_LIBDIR is set to "$RUSTLS_PCDIR"])
+          PKGTEST="yes"
         fi
       fi
+
+      if test "$PKGTEST" != "yes"; then
+        dnl pkg-config came up empty, use what we got
+        dnl via --with-rustls
+
+        addld=-L$PREFIX_RUSTLS/lib$libsuff
+        addcflags=-I$PREFIX_RUSTLS/include
+
+        LDFLAGS="$LDFLAGS $addld"
+        LDFLAGSPC="$LDFLAGSPC $addld"
+        if test "$addcflags" != "-I/usr/include"; then
+          CPPFLAGS="$CPPFLAGS $addcflags"
+        fi
+
+        if test "$curl_cv_apple" = "yes"; then
+          RUSTLS_LDFLAGS="-framework Security -framework Foundation"
+        else
+          RUSTLS_LDFLAGS="-lpthread -ldl -lm"
+        fi
+
+        LIB_RUSTLS="$PREFIX_RUSTLS/lib$libsuff"
+        if test "$PREFIX_RUSTLS" != "/usr"; then
+          SSL_LDFLAGS="-L$LIB_RUSTLS $RUSTLS_LDFLAGS"
+          SSL_CPPFLAGS="-I$PREFIX_RUSTLS/include"
+        fi
+
+        dnl we verify AC_CHECK_LIB later on
+        AC_DEFINE(USE_RUSTLS, 1, [if Rustls is enabled])
+        USE_RUSTLS="yes"
+      fi
+      ;;
+  esac
+
+  link_pkgconfig=''
+
+  if test "$PKGTEST" = "yes"; then
+
+    CURL_CHECK_PKGCONFIG(rustls, [$RUSTLS_PCDIR])
+
+    if test "$PKGCONFIG" != "no"; then
+      SSL_LIBS=`CURL_EXPORT_PCDIR([$RUSTLS_PCDIR])
+        $PKGCONFIG --libs-only-l --libs-only-other rustls 2>/dev/null`
+
+      SSL_LDFLAGS=`CURL_EXPORT_PCDIR([$RUSTLS_PCDIR])
+        $PKGCONFIG --libs-only-L rustls 2>/dev/null`
+
+      SSL_CPPFLAGS=`CURL_EXPORT_PCDIR([$RUSTLS_PCDIR])
+        $PKGCONFIG --cflags-only-I rustls 2>/dev/null`
+
+      AC_MSG_NOTICE([pkg-config: SSL_LIBS: "$SSL_LIBS"])
+      AC_MSG_NOTICE([pkg-config: SSL_LDFLAGS: "$SSL_LDFLAGS"])
+      AC_MSG_NOTICE([pkg-config: SSL_CPPFLAGS: "$SSL_CPPFLAGS"])
+
+      LIB_RUSTLS=`echo $SSL_LDFLAGS | sed -e 's/^-L//'`
+
+      dnl use the values pkg-config reported.  This is here
+      dnl instead of below with CPPFLAGS and LDFLAGS because we only
+      dnl learn about this via pkg-config.  If we only have
+      dnl the argument to --with-rustls we do not know what
+      dnl additional libs may be necessary.  Hope that we
+      dnl do not need any.
+      LIBS="$SSL_LIBS $LIBS"
+      link_pkgconfig=1
+      ssl_msg="Rustls"
+      AC_DEFINE(USE_RUSTLS, 1, [if Rustls is enabled])
+      USE_RUSTLS="yes"
+      RUSTLS_ENABLED=1
+      test "rustls" != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
+    else
+      AC_MSG_ERROR([pkg-config: Could not find Rustls])
     fi
 
-  fi dnl rustls not disabled
+  else
+    dnl we did not use pkg-config, so we need to add the
+    dnl Rustls lib to LIBS
+    LIBS="-lrustls -lpthread -ldl -lm $LIBS"
+  fi
+
+  dnl finally, set flags to use this TLS backend
+  CPPFLAGS="$CLEANCPPFLAGS $SSL_CPPFLAGS"
+  LDFLAGS="$CLEANLDFLAGS $SSL_LDFLAGS"
+  LDFLAGSPC="$CLEANLDFLAGSPC $SSL_LDFLAGS"
+
+  if test "$USE_RUSTLS" = "yes"; then
+    AC_MSG_NOTICE([detected Rustls])
+    check_for_ca_bundle=1
+
+    if test -n "$LIB_RUSTLS"; then
+      dnl when shared libs were found in a path that the runtime
+      dnl linker does not search through, we need to add it to
+      dnl CURL_LIBRARY_PATH so that further configure tests do not
+      dnl fail due to this
+      if test "$cross_compiling" != "yes"; then
+        CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$LIB_RUSTLS"
+        export CURL_LIBRARY_PATH
+        AC_MSG_NOTICE([Added $LIB_RUSTLS to CURL_LIBRARY_PATH])
+      fi
+    fi
+    if test -n "$link_pkgconfig"; then
+      LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE rustls"
+    fi
+
+    AC_CHECK_LIB(rustls, rustls_supported_hpke,
+        [
+        AC_DEFINE(USE_RUSTLS, 1, [if Rustls is enabled])
+        RUSTLS_ENABLED=1
+        USE_RUSTLS="yes"
+        ssl_msg="Rustls"
+        test "rustls" != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
+        ],
+        AC_MSG_ERROR([--with-rustls was specified but could not find compatible Rustls.]),
+        $RUSTLS_LDFLAGS)
+  fi
 
   test -z "$ssl_msg" || ssl_backends="${ssl_backends:+$ssl_backends, }$ssl_msg"
+
+  if test "$RUSTLS_ENABLED" != "1"; then
+    AC_MSG_NOTICE([OPT_RUSTLS: $OPT_RUSTLS])
+    AC_MSG_NOTICE([RUSTLS_ENABLED: $RUSTLS_ENABLED])
+    AC_MSG_ERROR([--with-rustls was given but Rustls could not be detected])
+  fi
 fi
 ])
diff --git a/third-party/curl/m4/curl-schannel.m4 b/third-party/curl/m4/curl-schannel.m4
index 016bfd4edd..e7358fbf62 100644
--- a/third-party/curl/m4/curl-schannel.m4
+++ b/third-party/curl/m4/curl-schannel.m4
@@ -24,19 +24,20 @@
 
 AC_DEFUN([CURL_WITH_SCHANNEL], [
 AC_MSG_CHECKING([whether to enable Windows native SSL/TLS])
-if test "x$OPT_SCHANNEL" != xno; then
+if test "x$OPT_SCHANNEL" != "xno"; then
   ssl_msg=
-  if test "x$OPT_SCHANNEL" != "xno"  &&
-     test "x$curl_cv_native_windows" = "xyes"; then
+  if test "$curl_cv_native_windows" = "yes"; then
+    if test "$curl_cv_winuwp" = "yes"; then
+      AC_MSG_ERROR([UWP does not support Schannel.])
+    fi
     AC_MSG_RESULT(yes)
     AC_DEFINE(USE_SCHANNEL, 1, [to enable Windows native SSL/TLS support])
-    AC_SUBST(USE_SCHANNEL, [1])
     ssl_msg="Schannel"
-    test schannel != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
+    test "schannel" != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
     SCHANNEL_ENABLED=1
-    # --with-schannel implies --enable-sspi
+    dnl --with-schannel implies --enable-sspi
     AC_DEFINE(USE_WINDOWS_SSPI, 1, [to enable SSPI support])
-    AC_SUBST(USE_WINDOWS_SSPI, [1])
+    USE_WINDOWS_SSPI=1
     curl_sspi_msg="enabled"
   else
     AC_MSG_RESULT(no)
diff --git a/third-party/curl/m4/curl-sectransp.m4 b/third-party/curl/m4/curl-sectransp.m4
deleted file mode 100644
index fc0ad9eb0c..0000000000
--- a/third-party/curl/m4/curl-sectransp.m4
+++ /dev/null
@@ -1,45 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-#***************************************************************************
-
-AC_DEFUN([CURL_WITH_SECURETRANSPORT], [
-AC_MSG_CHECKING([whether to enable Secure Transport])
-if test "x$OPT_SECURETRANSPORT" != xno; then
-  if test "x$OPT_SECURETRANSPORT" != "xno" &&
-     (test "x$cross_compiling" != "xno" || test -d "/System/Library/Frameworks/Security.framework"); then
-    AC_MSG_RESULT(yes)
-    AC_DEFINE(USE_SECTRANSP, 1, [enable Secure Transport])
-    AC_SUBST(USE_SECTRANSP, [1])
-    ssl_msg="Secure Transport"
-    test secure-transport != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
-    SECURETRANSPORT_ENABLED=1
-    LDFLAGS="$LDFLAGS -framework CoreFoundation -framework Security"
-  else
-    AC_MSG_RESULT(no)
-  fi
-  test -z "$ssl_msg" || ssl_backends="${ssl_backends:+$ssl_backends, }$ssl_msg"
-else
-  AC_MSG_RESULT(no)
-fi
-
-])
diff --git a/third-party/curl/m4/curl-sysconfig.m4 b/third-party/curl/m4/curl-sysconfig.m4
index cb787de7e9..7ad1285ef2 100644
--- a/third-party/curl/m4/curl-sysconfig.m4
+++ b/third-party/curl/m4/curl-sysconfig.m4
@@ -23,32 +23,29 @@
 #***************************************************************************
 
 AC_DEFUN([CURL_DARWIN_SYSTEMCONFIGURATION], [
-AC_MSG_CHECKING([whether to link macOS CoreFoundation and SystemConfiguration framework])
-case $host_os in
-  darwin*)
-    AC_COMPILE_IFELSE([
-      AC_LANG_PROGRAM([[
-#include <TargetConditionals.h>
-      ]],[[
-#if TARGET_OS_MAC && !(defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE)
-      return 0;
-#else
-#error Not macOS
-#endif
-      ]])
-    ],[
-      build_for_macos="yes"
-    ],[
-      build_for_macos="no"
-    ])
-    if test "x$build_for_macos" != xno; then
-      AC_MSG_RESULT(yes)
-      LDFLAGS="$LDFLAGS -framework CoreFoundation -framework SystemConfiguration"
-    else
-      AC_MSG_RESULT(no)
-    fi
-    ;;
-  *)
+AC_MSG_CHECKING([whether to link macOS CoreFoundation, CoreServices, and SystemConfiguration frameworks])
+  AC_COMPILE_IFELSE([
+    AC_LANG_PROGRAM([[
+      #include <sys/types.h>
+      #include <TargetConditionals.h>
+    ]],[[
+      #if TARGET_OS_MAC && !(defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE)
+        return 0;
+      #else
+        #error Not macOS
+      #endif
+    ]])
+  ],[
+    build_for_macos="yes"
+  ],[
+    build_for_macos="no"
+  ])
+  if test "$build_for_macos" != "no"; then
+    AC_MSG_RESULT(yes)
+    SYSCONFIG_LDFLAGS='-framework CoreFoundation -framework CoreServices -framework SystemConfiguration'
+    LDFLAGS="$LDFLAGS $SYSCONFIG_LDFLAGS"
+    LDFLAGSPC="$LDFLAGSPC $SYSCONFIG_LDFLAGS"
+  else
     AC_MSG_RESULT(no)
-esac
+  fi
 ])
diff --git a/third-party/curl/m4/curl-wolfssl.m4 b/third-party/curl/m4/curl-wolfssl.m4
index f630685bc2..a18659605e 100644
--- a/third-party/curl/m4/curl-wolfssl.m4
+++ b/third-party/curl/m4/curl-wolfssl.m4
@@ -32,144 +32,140 @@ case "$OPT_WOLFSSL" in
     wolfpkg=""
     ;;
   *)
-    wolfpkg="$withval/lib/pkgconfig"
+    wolfpkg="$OPT_WOLFSSL/lib/pkgconfig"
     ;;
 esac
 
-if test "x$OPT_WOLFSSL" != xno; then
+if test "$OPT_WOLFSSL" != "no"; then
   _cppflags=$CPPFLAGS
   _ldflags=$LDFLAGS
+  _ldflagspc=$LDFLAGSPC
 
   ssl_msg=
 
-  if test X"$OPT_WOLFSSL" != Xno; then
+  if test "$OPT_WOLFSSL" = "yes"; then
+    OPT_WOLFSSL=""
+  fi
 
-    if test "$OPT_WOLFSSL" = "yes"; then
-      OPT_WOLFSSL=""
+  dnl try pkg-config magic
+  CURL_CHECK_PKGCONFIG(wolfssl, [$wolfpkg])
+  AC_MSG_NOTICE([Check directory $wolfpkg])
+
+  addld=""
+  addlib=""
+  addcflags=""
+  if test "$PKGCONFIG" != "no"; then
+    addlib=`CURL_EXPORT_PCDIR([$wolfpkg])
+      $PKGCONFIG --libs-only-l wolfssl`
+    addld=`CURL_EXPORT_PCDIR([$wolfpkg])
+      $PKGCONFIG --libs-only-L wolfssl`
+    addcflags=`CURL_EXPORT_PCDIR([$wolfpkg])
+      $PKGCONFIG --cflags-only-I wolfssl`
+    version=`CURL_EXPORT_PCDIR([$wolfpkg])
+      $PKGCONFIG --modversion wolfssl`
+    wolfssllibpath=`echo $addld | $SED -e 's/^-L//'`
+  else
+    addlib=-lwolfssl
+    dnl use system defaults if user does not supply a path
+    if test -n "$OPT_WOLFSSL"; then
+      addld=-L$OPT_WOLFSSL/lib$libsuff
+      addcflags=-I$OPT_WOLFSSL/include
+      wolfssllibpath=$OPT_WOLFSSL/lib$libsuff
+    fi
+  fi
+
+  if test "$curl_cv_apple" = "yes"; then
+    addlib="$addlib -framework Security -framework CoreFoundation"
+  else
+    addlib="$addlib -lm"
+  fi
+
+  if test "$USE_WOLFSSL" != "yes"; then
+    CPPFLAGS="$CPPFLAGS -DWOLFSSL_OPTIONS_IGNORE_SYS"
+
+    LDFLAGS="$LDFLAGS $addld"
+    LDFLAGSPC="$LDFLAGSPC $addld"
+    AC_MSG_NOTICE([Add $addld to LDFLAGS])
+    if test "$addcflags" != "-I/usr/include"; then
+      CPPFLAGS="$CPPFLAGS $addcflags"
+      AC_MSG_NOTICE([Add $addcflags to CPPFLAGS])
     fi
 
-    dnl try pkg-config magic
-    CURL_CHECK_PKGCONFIG(wolfssl, [$wolfpkg])
-    AC_MSG_NOTICE([Check dir $wolfpkg])
+    my_ac_save_LIBS="$LIBS"
+    LIBS="$addlib $LIBS"
+    AC_MSG_NOTICE([Add $addlib to LIBS])
 
-    addld=""
-    addlib=""
-    addcflags=""
-    if test "$PKGCONFIG" != "no" ; then
-      addlib=`CURL_EXPORT_PCDIR([$wolfpkg])
-        $PKGCONFIG --libs-only-l wolfssl`
-      addld=`CURL_EXPORT_PCDIR([$wolfpkg])
-        $PKGCONFIG --libs-only-L wolfssl`
-      addcflags=`CURL_EXPORT_PCDIR([$wolfpkg])
-        $PKGCONFIG --cflags-only-I wolfssl`
-      version=`CURL_EXPORT_PCDIR([$wolfpkg])
-        $PKGCONFIG --modversion wolfssl`
-      wolfssllibpath=`echo $addld | $SED -e 's/^-L//'`
-    else
-      addlib=-lwolfssl
-      dnl use system defaults if user does not supply a path
-      if test -n "$OPT_WOLFSSL"; then
-        addld=-L$OPT_WOLFSSL/lib$libsuff
-        addcflags=-I$OPT_WOLFSSL/include
-        wolfssllibpath=$OPT_WOLFSSL/lib$libsuff
+    AC_MSG_CHECKING([for wolfSSL_Init in -lwolfssl])
+    AC_LINK_IFELSE([
+      AC_LANG_PROGRAM([[
+        #include <wolfssl/options.h>
+        #include <wolfssl/ssl.h>
+      ]],[[
+        return wolfSSL_Init();
+      ]])
+    ],[
+      AC_MSG_RESULT(yes)
+      AC_DEFINE(USE_WOLFSSL, 1, [if wolfSSL is enabled])
+      WOLFSSL_ENABLED=1
+      USE_WOLFSSL="yes"
+      ssl_msg="wolfSSL"
+      test "wolfssl" != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
+    ],
+    [
+      AC_MSG_RESULT(no)
+      CPPFLAGS=$_cppflags
+      LDFLAGS=$_ldflags
+      LDFLAGSPC=$_ldflagspc
+      wolfssllibpath=""
+    ])
+    LIBS="$my_ac_save_LIBS"
+  fi
+
+  if test "$USE_WOLFSSL" = "yes"; then
+    AC_MSG_NOTICE([detected wolfSSL])
+    check_for_ca_bundle=1
+
+    LIBS="$addlib $LIBS"
+
+    dnl is this wolfSSL providing the original QUIC API?
+    AC_CHECK_FUNCS([wolfSSL_set_quic_use_legacy_codepoint], [QUIC_ENABLED=yes])
+
+    dnl wolfSSL needs configure --enable-opensslextra to have *get_peer*
+    dnl wc_Des_EcbEncrypt is needed for NTLM support.
+    dnl if wolfSSL_BIO_set_shutdown is present, we have the full BIO feature set
+    AC_CHECK_FUNCS(wolfSSL_get_peer_certificate \
+                   wolfSSL_UseALPN \
+                   wolfSSL_BIO_new \
+                   wolfSSL_BIO_set_shutdown \
+                   wc_Des_EcbEncrypt)
+
+    dnl if this symbol is present, we want the include path to include the
+    dnl OpenSSL API root as well
+    if test "$ac_cv_func_wc_Des_EcbEncrypt" = "yes"; then
+      HAVE_WC_DES_ECBENCRYPT=1
+    fi
+
+    dnl if this symbol is present, we can make use of BIO filter chains
+    if test "$ac_cv_func_wolfSSL_BIO_new" = "yes"; then
+      HAVE_WOLFSSL_BIO_NEW=1
+    fi
+
+    if test -n "$wolfssllibpath"; then
+      dnl when shared libs were found in a path that the runtime
+      dnl linker does not search through, we need to add it to
+      dnl CURL_LIBRARY_PATH to prevent further configure tests to fail
+      dnl due to this
+      if test "$cross_compiling" != "yes"; then
+        CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$wolfssllibpath"
+        export CURL_LIBRARY_PATH
+        AC_MSG_NOTICE([Added $wolfssllibpath to CURL_LIBRARY_PATH])
       fi
     fi
-
-    if test "x$USE_WOLFSSL" != "xyes"; then
-
-      LDFLAGS="$LDFLAGS $addld"
-      AC_MSG_NOTICE([Add $addld to LDFLAGS])
-      if test "$addcflags" != "-I/usr/include"; then
-         CPPFLAGS="$CPPFLAGS $addcflags"
-         AC_MSG_NOTICE([Add $addcflags to CPPFLAGS])
-      fi
-
-      my_ac_save_LIBS="$LIBS"
-      LIBS="$addlib $LIBS"
-      AC_MSG_NOTICE([Add $addlib to LIBS])
-
-      AC_MSG_CHECKING([for wolfSSL_Init in -lwolfssl])
-      AC_LINK_IFELSE([
-        AC_LANG_PROGRAM([[
-/* These aren't needed for detection and confuse WolfSSL.
-   They are set up properly later if it is detected.  */
-#undef SIZEOF_LONG
-#undef SIZEOF_LONG_LONG
-#include <wolfssl/options.h>
-#include <wolfssl/ssl.h>
-        ]],[[
-          return wolfSSL_Init();
-        ]])
-      ],[
-         AC_MSG_RESULT(yes)
-         AC_DEFINE(USE_WOLFSSL, 1, [if wolfSSL is enabled])
-         AC_SUBST(USE_WOLFSSL, [1])
-         WOLFSSL_ENABLED=1
-         USE_WOLFSSL="yes"
-         ssl_msg="WolfSSL"
-         test wolfssl != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
-       ],
-       [
-         AC_MSG_RESULT(no)
-         CPPFLAGS=$_cppflags
-         LDFLAGS=$_ldflags
-         wolfssllibpath=""
-       ])
-      LIBS="$my_ac_save_LIBS"
-    fi
-
-    if test "x$USE_WOLFSSL" = "xyes"; then
-      AC_MSG_NOTICE([detected wolfSSL])
-      check_for_ca_bundle=1
-
-      dnl wolfssl/ctaocrypt/types.h needs SIZEOF_LONG_LONG defined!
-      CURL_SIZEOF(long long)
-
-      LIBS="$addlib -lm $LIBS"
-
-      dnl WolfSSL needs configure --enable-opensslextra to have *get_peer*
-      dnl DES* is needed for NTLM support and lives in the OpenSSL compatibility
-      dnl layer
-      AC_CHECK_FUNCS(wolfSSL_get_peer_certificate \
-                     wolfSSL_UseALPN )
-
-      dnl if this symbol is present, we want the include path to include the
-      dnl OpenSSL API root as well
-      AC_CHECK_FUNC(wolfSSL_DES_ecb_encrypt,
-        [
-            AC_DEFINE(HAVE_WOLFSSL_DES_ECB_ENCRYPT, 1,
-                      [if you have wolfSSL_DES_ecb_encrypt])
-            WOLFSSL_NTLM=1
-        ]
-        )
-
-      dnl if this symbol is present, we can make use of BIO filter chains
-      AC_CHECK_FUNC(wolfSSL_BIO_set_shutdown,
-        [
-            AC_DEFINE(HAVE_WOLFSSL_FULL_BIO, 1,
-                      [if you have wolfSSL_BIO_set_shutdown])
-            WOLFSSL_FULL_BIO=1
-        ]
-        )
-
-      if test -n "$wolfssllibpath"; then
-        dnl when shared libs were found in a path that the run-time
-        dnl linker doesn't search through, we need to add it to
-        dnl CURL_LIBRARY_PATH to prevent further configure tests to fail
-        dnl due to this
-        if test "x$cross_compiling" != "xyes"; then
-          CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$wolfssllibpath"
-          export CURL_LIBRARY_PATH
-          AC_MSG_NOTICE([Added $wolfssllibpath to CURL_LIBRARY_PATH])
-        fi
-      fi
-    else
-        AC_MSG_ERROR([--with-wolfssl but wolfSSL was not found or doesn't work])
-    fi
-
-  fi dnl wolfSSL not disabled
+    LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE wolfssl"
+  else
+    AC_MSG_ERROR([--with-wolfssl but wolfSSL was not found or does not work])
+  fi
 
   test -z "$ssl_msg" || ssl_backends="${ssl_backends:+$ssl_backends, }$ssl_msg"
-fi
-
+fi dnl wolfSSL not disabled
 ])
diff --git a/third-party/curl/m4/xc-am-iface.m4 b/third-party/curl/m4/xc-am-iface.m4
index c035f58c56..069490159b 100644
--- a/third-party/curl/m4/xc-am-iface.m4
+++ b/third-party/curl/m4/xc-am-iface.m4
@@ -2,7 +2,7 @@
 #
 # xc-am-iface.m4
 #
-# Copyright (C) Daniel Stenberg <daniel@haxx.se>
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -20,7 +20,7 @@
 #
 #---------------------------------------------------------------------------
 
-# serial 1
+dnl serial 1
 
 
 dnl _XC_AUTOMAKE_BODY
@@ -39,21 +39,20 @@ dnl is used to differentiate automake version 1.14 from older
 dnl ones which lack this macro.
 
 m4_define([_XC_AUTOMAKE_BODY],
-[dnl
-## --------------------------------------- ##
-##  Start of automake initialization code  ##
-## --------------------------------------- ##
+[
+dnl ---------------------------------------
+dnl  Start of automake initialization code
+dnl ---------------------------------------
 m4_ifdef([_AM_PROG_CC_C_O],
 [
 AM_INIT_AUTOMAKE([subdir-objects])
 ],[
 AM_INIT_AUTOMAKE
-])dnl
-## ------------------------------------- ##
-##  End of automake initialization code  ##
-## ------------------------------------- ##
-dnl
-m4_define([$0], [])[]dnl
+])
+dnl -------------------------------------
+dnl  End of automake initialization code
+dnl -------------------------------------
+m4_define([$0], [])[]
 ])
 
 
@@ -71,15 +70,15 @@ dnl generate the configure script, otherwise this option
 dnl is not used.
 
 AC_DEFUN([XC_AUTOMAKE],
-[dnl
-AC_PREREQ([2.50])dnl
-dnl
-AC_BEFORE([$0],[AM_INIT_AUTOMAKE])dnl
-dnl
+[
+AC_PREREQ([2.50])
+
+AC_BEFORE([$0],[AM_INIT_AUTOMAKE])
+
 _XC_AUTOMAKE_BODY
-dnl
+
 m4_ifdef([AM_INIT_AUTOMAKE],
-  [m4_undefine([AM_INIT_AUTOMAKE])])dnl
-dnl
-m4_define([$0], [])[]dnl
+  [m4_undefine([AM_INIT_AUTOMAKE])])
+
+m4_define([$0], [])[]
 ])
diff --git a/third-party/curl/m4/xc-cc-check.m4 b/third-party/curl/m4/xc-cc-check.m4
index a6cfb07eb5..c3294e87f6 100644
--- a/third-party/curl/m4/xc-cc-check.m4
+++ b/third-party/curl/m4/xc-cc-check.m4
@@ -2,7 +2,7 @@
 #
 # xc-cc-check.m4
 #
-# Copyright (C), Daniel Stenberg <daniel@haxx.se>
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -20,7 +20,7 @@
 #
 #---------------------------------------------------------------------------
 
-# serial 1
+dnl serial 1
 
 
 dnl _XC_PROG_CC_PREAMBLE
@@ -46,12 +46,12 @@ AC_DEFUN([_XC_PROG_CC_POSTLUDE], [
   CFLAGS=$xc_prog_cc_prev_CFLAGS
   LDFLAGS=$xc_prog_cc_prev_LDFLAGS
   CPPFLAGS=$xc_prog_cc_prev_CPPFLAGS
-  AC_SUBST([CC])dnl
-  AC_SUBST([CPP])dnl
-  AC_SUBST([LIBS])dnl
-  AC_SUBST([CFLAGS])dnl
-  AC_SUBST([LDFLAGS])dnl
-  AC_SUBST([CPPFLAGS])dnl
+  AC_SUBST([CC])
+  AC_SUBST([CPP])
+  AC_SUBST([LIBS])
+  AC_SUBST([CFLAGS])
+  AC_SUBST([LDFLAGS])
+  AC_SUBST([CPPFLAGS])
 ])
 
 
@@ -60,13 +60,13 @@ dnl -------------------------------------------------
 dnl Private macro.
 
 AC_DEFUN([_XC_PROG_CC], [
-  AC_REQUIRE([_XC_PROG_CC_PREAMBLE])dnl
-  AC_REQUIRE([XC_CHECK_BUILD_FLAGS])dnl
-  AC_REQUIRE([AC_PROG_INSTALL])dnl
-  AC_REQUIRE([AC_PROG_CC])dnl
-  AC_REQUIRE([AM_PROG_CC_C_O])dnl
-  AC_REQUIRE([AC_PROG_CPP])dnl
-  AC_REQUIRE([_XC_PROG_CC_POSTLUDE])dnl
+  AC_REQUIRE([_XC_PROG_CC_PREAMBLE])
+  AC_REQUIRE([XC_CHECK_BUILD_FLAGS])
+  AC_REQUIRE([AC_PROG_INSTALL])
+  AC_REQUIRE([AC_PROG_CC])
+  AC_REQUIRE([AM_PROG_CC_C_O])
+  AC_REQUIRE([AC_PROG_CPP])
+  AC_REQUIRE([_XC_PROG_CC_POSTLUDE])
 ])
 
 
@@ -84,14 +84,14 @@ dnl LIBS, LDFLAGS, CFLAGS, CPPFLAGS and IFS from being
 dnl unexpectedly changed by underlying macros.
 
 AC_DEFUN([XC_CHECK_PROG_CC], [
-  AC_PREREQ([2.50])dnl
-  AC_BEFORE([$0],[_XC_PROG_CC_PREAMBLE])dnl
-  AC_BEFORE([$0],[AC_PROG_INSTALL])dnl
-  AC_BEFORE([$0],[AC_PROG_CC])dnl
-  AC_BEFORE([$0],[AM_PROG_CC_C_O])dnl
-  AC_BEFORE([$0],[AC_PROG_CPP])dnl
-  AC_BEFORE([$0],[AC_PROG_LIBTOOL])dnl
-  AC_BEFORE([$0],[AM_INIT_AUTOMAKE])dnl
-  AC_BEFORE([$0],[_XC_PROG_CC_POSTLUDE])dnl
-  AC_REQUIRE([_XC_PROG_CC])dnl
+  AC_PREREQ([2.50])
+  AC_BEFORE([$0],[_XC_PROG_CC_PREAMBLE])
+  AC_BEFORE([$0],[AC_PROG_INSTALL])
+  AC_BEFORE([$0],[AC_PROG_CC])
+  AC_BEFORE([$0],[AM_PROG_CC_C_O])
+  AC_BEFORE([$0],[AC_PROG_CPP])
+  AC_BEFORE([$0],[AC_PROG_LIBTOOL])
+  AC_BEFORE([$0],[AM_INIT_AUTOMAKE])
+  AC_BEFORE([$0],[_XC_PROG_CC_POSTLUDE])
+  AC_REQUIRE([_XC_PROG_CC])
 ])
diff --git a/third-party/curl/m4/xc-lt-iface.m4 b/third-party/curl/m4/xc-lt-iface.m4
index d5e437ffdc..9f79fdb952 100644
--- a/third-party/curl/m4/xc-lt-iface.m4
+++ b/third-party/curl/m4/xc-lt-iface.m4
@@ -2,7 +2,7 @@
 #
 # xc-lt-iface.m4
 #
-# Copyright (C), Daniel Stenberg <daniel@haxx.se>
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -20,7 +20,7 @@
 #
 #---------------------------------------------------------------------------
 
-# serial 1
+dnl serial 1
 
 
 dnl _XC_LIBTOOL_PREAMBLE
@@ -32,23 +32,23 @@ dnl libtool and customizes its default behavior before
 dnl libtool code is actually used in script.
 
 m4_define([_XC_LIBTOOL_PREAMBLE],
-[dnl
-# ------------------------------------ #
-#  Determine libtool default behavior  #
-# ------------------------------------ #
+[
+dnl ------------------------------------
+dnl  Determine libtool default behavior
+dnl ------------------------------------
 
-#
-# Default behavior is to enable shared and static libraries on systems
-# where libtool knows how to build both library versions, and does not
-# require separate configuration and build runs for each flavor.
-#
+dnl
+dnl Default behavior is to enable shared and static libraries on systems
+dnl where libtool knows how to build both library versions, and does not
+dnl require separate configuration and build runs for each flavor.
+dnl
 
 xc_lt_want_enable_shared='yes'
 xc_lt_want_enable_static='yes'
 
-#
-# User may have disabled shared or static libraries.
-#
+dnl
+dnl User may have disabled shared or static libraries.
+dnl
 case "x$enable_shared" in @%:@ (
   xno)
     xc_lt_want_enable_shared='no'
@@ -59,46 +59,46 @@ case "x$enable_static" in @%:@ (
     xc_lt_want_enable_static='no'
     ;;
 esac
-if test "x$xc_lt_want_enable_shared" = 'xno' &&
-  test "x$xc_lt_want_enable_static" = 'xno'; then
+if test "$xc_lt_want_enable_shared" = "no" &&
+   test "$xc_lt_want_enable_static" = "no"; then
   AC_MSG_ERROR([can not disable shared and static libraries simultaneously])
 fi
 
-#
-# Default behavior on systems that require independent configuration
-# and build runs for shared and static is to enable shared libraries
-# and disable static ones. On these systems option '--disable-shared'
-# must be used in order to build a proper static library.
-#
+dnl
+dnl Default behavior on systems that require independent configuration
+dnl and build runs for shared and static is to enable shared libraries
+dnl and disable static ones. On these systems option '--disable-shared'
+dnl must be used in order to build a proper static library.
+dnl
 
-if test "x$xc_lt_want_enable_shared" = 'xyes' &&
-  test "x$xc_lt_want_enable_static" = 'xyes'; then
+if test "$xc_lt_want_enable_shared" = "yes" &&
+   test "$xc_lt_want_enable_static" = "yes"; then
   case $host_os in @%:@ (
-    pw32* | cegcc* | os2* | aix*)
+    os2* | aix*)
       xc_lt_want_enable_static='no'
       ;;
   esac
 fi
 
-#
-# Make libtool aware of current shared and static library preferences
-# taking in account that, depending on host characteristics, libtool
-# may modify these option preferences later in this configure script.
-#
+dnl
+dnl Make libtool aware of current shared and static library preferences
+dnl taking in account that, depending on host characteristics, libtool
+dnl may modify these option preferences later in this configure script.
+dnl
 
 enable_shared=$xc_lt_want_enable_shared
 enable_static=$xc_lt_want_enable_static
 
-#
-# Default behavior is to build PIC objects for shared libraries and
-# non-PIC objects for static libraries.
-#
+dnl
+dnl Default behavior is to build PIC objects for shared libraries and
+dnl non-PIC objects for static libraries.
+dnl
 
 xc_lt_want_with_pic='default'
 
-#
-# User may have specified PIC preference.
-#
+dnl
+dnl User may have specified PIC preference.
+dnl
 
 case "x$with_pic" in @%:@ ((
   xno)
@@ -109,15 +109,15 @@ case "x$with_pic" in @%:@ ((
     ;;
 esac
 
-#
-# Default behavior on some systems where building a shared library out
-# of non-PIC compiled objects will fail with following linker error
-# "relocation R_X86_64_32 can not be used when making a shared object"
-# is to build PIC objects even for static libraries. This behavior may
-# be overridden using 'configure --disable-shared --without-pic'.
-#
+dnl
+dnl Default behavior on some systems where building a shared library out
+dnl of non-PIC compiled objects fails with following linker error
+dnl "relocation R_X86_64_32 can not be used when making a shared object"
+dnl is to build PIC objects even for static libraries. This behavior may
+dnl be overridden using 'configure --disable-shared --without-pic'.
+dnl
 
-if test "x$xc_lt_want_with_pic" = 'xdefault'; then
+if test "$xc_lt_want_with_pic" = "default"; then
   case $host_cpu in @%:@ (
     x86_64 | amd64 | ia64)
       case $host_os in @%:@ (
@@ -136,8 +136,8 @@ fi
 #
 
 with_pic=$xc_lt_want_with_pic
-dnl
-m4_define([$0],[])dnl
+
+m4_define([$0],[])
 ])
 
 
@@ -150,22 +150,22 @@ dnl configure script, regardless of libtool version in
 dnl use when generating configure script.
 
 m4_define([_XC_LIBTOOL_BODY],
-[dnl
-## ----------------------- ##
-##  Start of libtool code  ##
-## ----------------------- ##
+[
+dnl -----------------------
+dnl  Start of libtool code
+dnl -----------------------
 m4_ifdef([LT_INIT],
-[dnl
+[
 LT_INIT([win32-dll])
-],[dnl
+],[
 AC_LIBTOOL_WIN32_DLL
 AC_PROG_LIBTOOL
-])dnl
-## --------------------- ##
-##  End of libtool code  ##
-## --------------------- ##
+])
+dnl ---------------------
+dnl  End of libtool code
+dnl ---------------------
 dnl
-m4_define([$0], [])[]dnl
+m4_define([$0], [])[]
 ])
 
 
@@ -182,11 +182,11 @@ dnl   xc_lt_build_shared
 dnl   xc_lt_build_static
 
 m4_define([_XC_CHECK_LT_BUILD_LIBRARIES],
-[dnl
-#
-# Verify if finally libtool shared libraries will be built
-#
+[
 
+#
+# Verify if finally libtool shared libraries are built
+#
 case "x$enable_shared" in @%:@ ((
   xyes | xno)
     xc_lt_build_shared=$enable_shared
@@ -197,9 +197,8 @@ case "x$enable_shared" in @%:@ ((
 esac
 
 #
-# Verify if finally libtool static libraries will be built
+# Verify if finally libtool static libraries are built
 #
-
 case "x$enable_static" in @%:@ ((
   xyes | xno)
     xc_lt_build_static=$enable_static
@@ -208,8 +207,8 @@ case "x$enable_static" in @%:@ ((
     AC_MSG_ERROR([unexpected libtool enable_static value: $enable_static])
     ;;
 esac
-dnl
-m4_define([$0],[])dnl
+
+m4_define([$0],[])
 ])
 
 
@@ -222,14 +221,14 @@ dnl provided when building libtool shared libraries.
 dnl Result stored in xc_lt_shlib_use_version_info.
 
 m4_define([_XC_CHECK_LT_SHLIB_USE_VERSION_INFO],
-[dnl
+[
 #
 # Verify if libtool shared libraries should be linked using flag -version-info
 #
 
 AC_MSG_CHECKING([whether to build shared libraries with -version-info])
 xc_lt_shlib_use_version_info='yes'
-if test "x$version_type" = 'xnone'; then
+if test "$version_type" = "none"; then
   xc_lt_shlib_use_version_info='no'
 fi
 case $host_os in @%:@ (
@@ -238,8 +237,8 @@ case $host_os in @%:@ (
     ;;
 esac
 AC_MSG_RESULT([$xc_lt_shlib_use_version_info])
-dnl
-m4_define([$0], [])[]dnl
+
+m4_define([$0], [])[]
 ])
 
 
@@ -252,26 +251,26 @@ dnl provided when building libtool shared libraries.
 dnl Result stored in xc_lt_shlib_use_no_undefined.
 
 m4_define([_XC_CHECK_LT_SHLIB_USE_NO_UNDEFINED],
-[dnl
+[
 #
 # Verify if libtool shared libraries should be linked using flag -no-undefined
 #
 
 AC_MSG_CHECKING([whether to build shared libraries with -no-undefined])
 xc_lt_shlib_use_no_undefined='no'
-if test "x$allow_undefined" = 'xno'; then
+if test "x$allow_undefined" = "xno"; then
   xc_lt_shlib_use_no_undefined='yes'
-elif test "x$allow_undefined_flag" = 'xunsupported'; then
+elif test "x$allow_undefined_flag" = "xunsupported"; then
   xc_lt_shlib_use_no_undefined='yes'
 fi
 case $host_os in @%:@ (
-  cygwin* | mingw* | pw32* | cegcc* | os2* | aix*)
+  cygwin* | mingw* | os2* | aix*)
     xc_lt_shlib_use_no_undefined='yes'
     ;;
 esac
 AC_MSG_RESULT([$xc_lt_shlib_use_no_undefined])
-dnl
-m4_define([$0], [])[]dnl
+
+m4_define([$0], [])[]
 ])
 
 
@@ -284,7 +283,7 @@ dnl provided when building libtool shared libraries.
 dnl Result stored in xc_lt_shlib_use_mimpure_text.
 
 m4_define([_XC_CHECK_LT_SHLIB_USE_MIMPURE_TEXT],
-[dnl
+[
 #
 # Verify if libtool shared libraries should be linked using flag -mimpure-text
 #
@@ -293,14 +292,14 @@ AC_MSG_CHECKING([whether to build shared libraries with -mimpure-text])
 xc_lt_shlib_use_mimpure_text='no'
 case $host_os in @%:@ (
   solaris2*)
-    if test "x$GCC" = 'xyes'; then
+    if test "x$GCC" = "xyes"; then
       xc_lt_shlib_use_mimpure_text='yes'
     fi
     ;;
 esac
 AC_MSG_RESULT([$xc_lt_shlib_use_mimpure_text])
-dnl
-m4_define([$0], [])[]dnl
+
+m4_define([$0], [])[]
 ])
 
 
@@ -317,7 +316,7 @@ dnl   xc_lt_build_shared_with_pic
 dnl   xc_lt_build_static_with_pic
 
 m4_define([_XC_CHECK_LT_BUILD_WITH_PIC],
-[dnl
+[
 #
 # Find out whether libtool libraries would be built with PIC
 #
@@ -345,8 +344,8 @@ AC_MSG_CHECKING([whether to build shared libraries with PIC])
 AC_MSG_RESULT([$xc_lt_build_shared_with_pic])
 AC_MSG_CHECKING([whether to build static libraries with PIC])
 AC_MSG_RESULT([$xc_lt_build_static_with_pic])
-dnl
-m4_define([$0],[])dnl
+
+m4_define([$0],[])
 ])
 
 
@@ -361,14 +360,14 @@ dnl   xc_lt_build_shared_only
 dnl   xc_lt_build_static_only
 
 m4_define([_XC_CHECK_LT_BUILD_SINGLE_VERSION],
-[dnl
-#
-# Verify if libtool shared libraries will be built while static not built
-#
+[
 
+#
+# Verify if libtool shared libraries are built while static not built
+#
 AC_MSG_CHECKING([whether to build shared libraries only])
-if test "$xc_lt_build_shared" = 'yes' &&
-  test "$xc_lt_build_static" = 'no'; then
+if test "$xc_lt_build_shared" = "yes" &&
+   test "$xc_lt_build_static" = "no"; then
   xc_lt_build_shared_only='yes'
 else
   xc_lt_build_shared_only='no'
@@ -376,19 +375,18 @@ fi
 AC_MSG_RESULT([$xc_lt_build_shared_only])
 
 #
-# Verify if libtool static libraries will be built while shared not built
+# Verify if libtool static libraries are built while shared not built
 #
-
 AC_MSG_CHECKING([whether to build static libraries only])
-if test "$xc_lt_build_static" = 'yes' &&
-  test "$xc_lt_build_shared" = 'no'; then
+if test "$xc_lt_build_static" = "yes" &&
+   test "$xc_lt_build_shared" = "no"; then
   xc_lt_build_static_only='yes'
 else
   xc_lt_build_static_only='no'
 fi
 AC_MSG_RESULT([$xc_lt_build_static_only])
-dnl
-m4_define([$0],[])dnl
+
+m4_define([$0],[])
 ])
 
 
@@ -402,15 +400,15 @@ dnl been executed. See individual check descriptions
 dnl for further info.
 
 m4_define([_XC_LIBTOOL_POSTLUDE],
-[dnl
+[
 _XC_CHECK_LT_BUILD_LIBRARIES
 _XC_CHECK_LT_SHLIB_USE_VERSION_INFO
 _XC_CHECK_LT_SHLIB_USE_NO_UNDEFINED
 _XC_CHECK_LT_SHLIB_USE_MIMPURE_TEXT
 _XC_CHECK_LT_BUILD_WITH_PIC
 _XC_CHECK_LT_BUILD_SINGLE_VERSION
-dnl
-m4_define([$0],[])dnl
+
+m4_define([$0],[])
 ])
 
 
@@ -440,27 +438,27 @@ dnl   xc_lt_build_shared_only
 dnl   xc_lt_build_static_only
 
 AC_DEFUN([XC_LIBTOOL],
-[dnl
-AC_PREREQ([2.50])dnl
-dnl
-AC_BEFORE([$0],[LT_INIT])dnl
-AC_BEFORE([$0],[AC_PROG_LIBTOOL])dnl
-AC_BEFORE([$0],[AC_LIBTOOL_WIN32_DLL])dnl
-dnl
-AC_REQUIRE([XC_CHECK_PATH_SEPARATOR])dnl
-AC_REQUIRE([AC_CANONICAL_HOST])dnl
-AC_REQUIRE([AC_PROG_CC])dnl
-dnl
+[
+AC_PREREQ([2.50])
+
+AC_BEFORE([$0],[LT_INIT])
+AC_BEFORE([$0],[AC_PROG_LIBTOOL])
+AC_BEFORE([$0],[AC_LIBTOOL_WIN32_DLL])
+
+AC_REQUIRE([XC_CHECK_PATH_SEPARATOR])
+AC_REQUIRE([AC_CANONICAL_HOST])
+AC_REQUIRE([AC_PROG_CC])
+
 _XC_LIBTOOL_PREAMBLE
 _XC_LIBTOOL_BODY
 _XC_LIBTOOL_POSTLUDE
-dnl
+
 m4_ifdef([AC_LIBTOOL_WIN32_DLL],
-  [m4_undefine([AC_LIBTOOL_WIN32_DLL])])dnl
+  [m4_undefine([AC_LIBTOOL_WIN32_DLL])])
 m4_ifdef([AC_PROG_LIBTOOL],
-  [m4_undefine([AC_PROG_LIBTOOL])])dnl
+  [m4_undefine([AC_PROG_LIBTOOL])])
 m4_ifdef([LT_INIT],
-  [m4_undefine([LT_INIT])])dnl
-dnl
-m4_define([$0],[])dnl
+  [m4_undefine([LT_INIT])])
+
+m4_define([$0],[])
 ])
diff --git a/third-party/curl/m4/xc-translit.m4 b/third-party/curl/m4/xc-translit.m4
deleted file mode 100644
index 6d6677197b..0000000000
--- a/third-party/curl/m4/xc-translit.m4
+++ /dev/null
@@ -1,165 +0,0 @@
-#---------------------------------------------------------------------------
-#
-# xc-translit.m4
-#
-# Copyright (C), Daniel Stenberg <daniel@haxx.se>
-#
-# Permission to use, copy, modify, and distribute this software for any
-# purpose with or without fee is hereby granted, provided that the above
-# copyright notice and this permission notice appear in all copies.
-#
-# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-#
-# SPDX-License-Identifier: ISC
-#
-#---------------------------------------------------------------------------
-
-# File version for 'aclocal' use. Keep it a single number.
-# serial 2
-
-
-dnl XC_SH_TR_SH (expression)
-dnl -------------------------------------------------
-dnl Shell execution time transliteration of 'expression'
-dnl argument, where all non-alfanumeric characters are
-dnl converted to the underscore '_' character.
-dnl Normal shell expansion and substitution takes place
-dnl for given 'expression' at shell execution time before
-dnl transliteration is applied to it.
-
-AC_DEFUN([XC_SH_TR_SH],
-[`echo "$1" | sed 's/[[^a-zA-Z0-9_]]/_/g'`])
-
-
-dnl XC_SH_TR_SH_EX (expression, [extra])
-dnl -------------------------------------------------
-dnl Like XC_SH_TR_SH but transliterating characters
-dnl given in 'extra' argument to lowercase 'p'. For
-dnl example [*+], [*], and [+] are valid 'extra' args.
-
-AC_DEFUN([XC_SH_TR_SH_EX],
-[ifelse([$2], [],
-  [XC_SH_TR_SH([$1])],
-  [`echo "$1" | sed 's/[[$2]]/p/g' | sed 's/[[^a-zA-Z0-9_]]/_/g'`])])
-
-
-dnl XC_M4_TR_SH (expression)
-dnl -------------------------------------------------
-dnl m4 execution time transliteration of 'expression'
-dnl argument, where all non-alfanumeric characters are
-dnl converted to the underscore '_' character.
-
-AC_DEFUN([XC_M4_TR_SH],
-[patsubst(XC_QPATSUBST(XC_QUOTE($1),
-                       [[^a-zA-Z0-9_]], [_]),
-          [\(_\(.*\)_\)], [\2])])
-
-
-dnl XC_M4_TR_SH_EX (expression, [extra])
-dnl -------------------------------------------------
-dnl Like XC_M4_TR_SH but transliterating characters
-dnl given in 'extra' argument to lowercase 'p'. For
-dnl example [*+], [*], and [+] are valid 'extra' args.
-
-AC_DEFUN([XC_M4_TR_SH_EX],
-[ifelse([$2], [],
-  [XC_M4_TR_SH([$1])],
-  [patsubst(XC_QPATSUBST(XC_QPATSUBST(XC_QUOTE($1),
-                                      [[$2]],
-                                      [p]),
-                         [[^a-zA-Z0-9_]], [_]),
-            [\(_\(.*\)_\)], [\2])])])
-
-
-dnl XC_SH_TR_CPP (expression)
-dnl -------------------------------------------------
-dnl Shell execution time transliteration of 'expression'
-dnl argument, where all non-alfanumeric characters are
-dnl converted to the underscore '_' character and alnum
-dnl characters are converted to uppercase.
-dnl Normal shell expansion and substitution takes place
-dnl for given 'expression' at shell execution time before
-dnl transliteration is applied to it.
-
-AC_DEFUN([XC_SH_TR_CPP],
-[`echo "$1" | dnl
-sed 'y/abcdefghijklmnopqrstuvwxyz/ABCDEFGHIJKLMNOPQRSTUVWXYZ/' | dnl
-sed 's/[[^A-Z0-9_]]/_/g'`])
-
-
-dnl XC_SH_TR_CPP_EX (expression, [extra])
-dnl -------------------------------------------------
-dnl Like XC_SH_TR_CPP but transliterating characters
-dnl given in 'extra' argument to uppercase 'P'. For
-dnl example [*+], [*], and [+] are valid 'extra' args.
-
-AC_DEFUN([XC_SH_TR_CPP_EX],
-[ifelse([$2], [],
-  [XC_SH_TR_CPP([$1])],
-  [`echo "$1" | dnl
-sed 's/[[$2]]/P/g' | dnl
-sed 'y/abcdefghijklmnopqrstuvwxyz/ABCDEFGHIJKLMNOPQRSTUVWXYZ/' | dnl
-sed 's/[[^A-Z0-9_]]/_/g'`])])
-
-
-dnl XC_M4_TR_CPP (expression)
-dnl -------------------------------------------------
-dnl m4 execution time transliteration of 'expression'
-dnl argument, where all non-alfanumeric characters are
-dnl converted to the underscore '_' character and alnum
-dnl characters are converted to uppercase.
-
-AC_DEFUN([XC_M4_TR_CPP],
-[patsubst(XC_QPATSUBST(XC_QTRANSLIT(XC_QUOTE($1),
-                                    [abcdefghijklmnopqrstuvwxyz],
-                                    [ABCDEFGHIJKLMNOPQRSTUVWXYZ]),
-                       [[^A-Z0-9_]], [_]),
-          [\(_\(.*\)_\)], [\2])])
-
-
-dnl XC_M4_TR_CPP_EX (expression, [extra])
-dnl -------------------------------------------------
-dnl Like XC_M4_TR_CPP but transliterating characters
-dnl given in 'extra' argument to uppercase 'P'. For
-dnl example [*+], [*], and [+] are valid 'extra' args.
-
-AC_DEFUN([XC_M4_TR_CPP_EX],
-[ifelse([$2], [],
-  [XC_M4_TR_CPP([$1])],
-  [patsubst(XC_QPATSUBST(XC_QTRANSLIT(XC_QPATSUBST(XC_QUOTE($1),
-                                                   [[$2]],
-                                                   [P]),
-                                      [abcdefghijklmnopqrstuvwxyz],
-                                      [ABCDEFGHIJKLMNOPQRSTUVWXYZ]),
-                         [[^A-Z0-9_]], [_]),
-            [\(_\(.*\)_\)], [\2])])])
-
-
-dnl XC_QUOTE (expression)
-dnl -------------------------------------------------
-dnl Expands to quoted result of 'expression' expansion.
-
-AC_DEFUN([XC_QUOTE],
-[[$@]])
-
-
-dnl XC_QPATSUBST (string, regexp[, repl])
-dnl -------------------------------------------------
-dnl Expands to quoted result of 'patsubst' expansion.
-
-AC_DEFUN([XC_QPATSUBST],
-[XC_QUOTE(patsubst([$1], [$2], [$3]))])
-
-
-dnl XC_QTRANSLIT (string, chars, repl)
-dnl -------------------------------------------------
-dnl Expands to quoted result of 'translit' expansion.
-
-AC_DEFUN([XC_QTRANSLIT],
-[XC_QUOTE(translit([$1], [$2], [$3]))])
diff --git a/third-party/curl/m4/xc-val-flgs.m4 b/third-party/curl/m4/xc-val-flgs.m4
index c8f779651e..7d3322b512 100644
--- a/third-party/curl/m4/xc-val-flgs.m4
+++ b/third-party/curl/m4/xc-val-flgs.m4
@@ -2,7 +2,7 @@
 #
 # xc-val-flgs.m4
 #
-# Copyright (C), Daniel Stenberg <daniel@haxx.se>
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -20,7 +20,7 @@
 #
 #---------------------------------------------------------------------------
 
-# serial 1
+dnl serial 1
 
 
 dnl _XC_CHECK_VAR_LIBS
@@ -39,7 +39,7 @@ AC_DEFUN([_XC_CHECK_VAR_LIBS], [
         ;;
     esac
   done
-  if test $xc_bad_var_libs = yes; then
+  if test "$xc_bad_var_libs" = "yes"; then
     AC_MSG_NOTICE([using LIBS: $LIBS])
     AC_MSG_NOTICE([LIBS note: LIBS should only be used to specify libraries (-lname).])
   fi
@@ -68,7 +68,7 @@ AC_DEFUN([_XC_CHECK_VAR_LDFLAGS], [
         ;;
     esac
   done
-  if test $xc_bad_var_ldflags = yes; then
+  if test "$xc_bad_var_ldflags" = "yes"; then
     AC_MSG_NOTICE([using LDFLAGS: $LDFLAGS])
     xc_bad_var_msg="LDFLAGS note: LDFLAGS should only be used to specify linker flags, not"
     for xc_word in $LDFLAGS; do
@@ -110,7 +110,7 @@ AC_DEFUN([_XC_CHECK_VAR_CPPFLAGS], [
         ;;
     esac
   done
-  if test $xc_bad_var_cppflags = yes; then
+  if test "$xc_bad_var_cppflags" = "yes"; then
     AC_MSG_NOTICE([using CPPFLAGS: $CPPFLAGS])
     xc_bad_var_msg="CPPFLAGS note: CPPFLAGS should only be used to specify C preprocessor flags, not"
     for xc_word in $CPPFLAGS; do
@@ -158,7 +158,7 @@ AC_DEFUN([_XC_CHECK_VAR_CFLAGS], [
         ;;
     esac
   done
-  if test $xc_bad_var_cflags = yes; then
+  if test "$xc_bad_var_cflags" = "yes"; then
     AC_MSG_NOTICE([using CFLAGS: $CFLAGS])
     xc_bad_var_msg="CFLAGS note: CFLAGS should only be used to specify C compiler flags, not"
     for xc_word in $CFLAGS; do
@@ -200,18 +200,18 @@ dnl
 dnl Intended to be used early in configure script.
 
 AC_DEFUN([XC_CHECK_USER_FLAGS], [
-  AC_PREREQ([2.50])dnl
-  AC_BEFORE([$0],[XC_CHECK_PROG_CC])dnl
+  AC_PREREQ([2.50])
+  AC_BEFORE([$0],[XC_CHECK_PROG_CC])
   dnl check order below matters
   _XC_CHECK_VAR_LIBS
   _XC_CHECK_VAR_LDFLAGS
   _XC_CHECK_VAR_CPPFLAGS
   _XC_CHECK_VAR_CFLAGS
-  if test $xc_bad_var_libs = yes ||
-     test $xc_bad_var_cflags = yes ||
-     test $xc_bad_var_ldflags = yes ||
-     test $xc_bad_var_cppflags = yes; then
-     AC_MSG_ERROR([Can not continue. Fix errors mentioned immediately above this line.])
+  if test "$xc_bad_var_libs" = "yes" ||
+     test "$xc_bad_var_cflags" = "yes" ||
+     test "$xc_bad_var_ldflags" = "yes" ||
+     test "$xc_bad_var_cppflags" = "yes"; then
+    AC_MSG_ERROR([Can not continue. Fix errors mentioned immediately above this line.])
   fi
 ])
 
@@ -226,19 +226,19 @@ dnl script might have set. When checks fails, user
 dnl is noticed about errors detected in all of them
 dnl but script continues execution.
 dnl
-dnl Intended to be used very late in configure script.
+dnl Intended to be used late in configure script.
 
 AC_DEFUN([XC_CHECK_BUILD_FLAGS], [
-  AC_PREREQ([2.50])dnl
+  AC_PREREQ([2.50])
   dnl check order below matters
   _XC_CHECK_VAR_LIBS
   _XC_CHECK_VAR_LDFLAGS
   _XC_CHECK_VAR_CPPFLAGS
   _XC_CHECK_VAR_CFLAGS
-  if test $xc_bad_var_libs = yes ||
-     test $xc_bad_var_cflags = yes ||
-     test $xc_bad_var_ldflags = yes ||
-     test $xc_bad_var_cppflags = yes; then
-     AC_MSG_WARN([Continuing even with errors mentioned immediately above this line.])
+  if test "$xc_bad_var_libs" = "yes" ||
+     test "$xc_bad_var_cflags" = "yes" ||
+     test "$xc_bad_var_ldflags" = "yes" ||
+     test "$xc_bad_var_cppflags" = "yes"; then
+    AC_MSG_WARN([Continuing even with errors mentioned immediately above this line.])
   fi
 ])
diff --git a/third-party/curl/m4/zz40-xc-ovr.m4 b/third-party/curl/m4/zz40-xc-ovr.m4
index fa457876f0..2713dcc8cb 100644
--- a/third-party/curl/m4/zz40-xc-ovr.m4
+++ b/third-party/curl/m4/zz40-xc-ovr.m4
@@ -2,7 +2,7 @@
 #
 # zz40-xc-ovr.m4
 #
-# Copyright (C) Daniel Stenberg <daniel@haxx.se>
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -31,8 +31,8 @@ dnl Version macros
 dnl -------------------------------------------------
 dnl Public macros.
 
-m4_define([XC_CONFIGURE_PREAMBLE_VER_MAJOR],[1])dnl
-m4_define([XC_CONFIGURE_PREAMBLE_VER_MINOR],[0])dnl
+m4_define([XC_CONFIGURE_PREAMBLE_VER_MAJOR],[1])
+m4_define([XC_CONFIGURE_PREAMBLE_VER_MINOR],[0])
 
 
 dnl _XC_CFG_PRE_PREAMBLE
@@ -50,9 +50,9 @@ XC_CONFIGURE_PREAMBLE_VER_MINOR  ##
 xc_configure_preamble_ver_major='XC_CONFIGURE_PREAMBLE_VER_MAJOR'
 xc_configure_preamble_ver_minor='XC_CONFIGURE_PREAMBLE_VER_MINOR'
 
-#
-# Set IFS to space, tab and newline.
-#
+dnl
+dnl Set IFS to space, tab and newline.
+dnl
 
 xc_space=' '
 xc_tab='	'
@@ -60,9 +60,9 @@ xc_newline='
 '
 IFS="$xc_space$xc_tab$xc_newline"
 
-#
-# Set internationalization behavior variables.
-#
+dnl
+dnl Set internationalization behavior variables.
+dnl
 
 LANG='C'
 LC_ALL='C'
@@ -71,9 +71,9 @@ export LANG
 export LC_ALL
 export LANGUAGE
 
-#
-# Some useful variables.
-#
+dnl
+dnl Some useful variables.
+dnl
 
 xc_msg_warn='configure: WARNING:'
 xc_msg_abrt='Can not continue.'
@@ -89,11 +89,11 @@ dnl Emits shell code that verifies that 'echo' command
 dnl is available, otherwise aborts execution.
 
 AC_DEFUN([_XC_CFG_PRE_BASIC_CHK_CMD_ECHO],
-[dnl
-AC_REQUIRE([_XC_CFG_PRE_PREAMBLE])dnl
-#
-# Verify that 'echo' command is available, otherwise abort.
-#
+[
+AC_REQUIRE([_XC_CFG_PRE_PREAMBLE])
+dnl
+dnl Verify that 'echo' command is available, otherwise abort.
+dnl
 
 xc_tst_str='unknown'
 (`echo "$xc_tst_str" >/dev/null 2>&1`) && xc_tst_str='success'
@@ -102,7 +102,7 @@ case "x$xc_tst_str" in @%:@ ((
     :
     ;;
   *)
-    # Try built-in echo, and fail.
+    dnl Try built-in echo, and fail.
     echo "$xc_msg_err 'echo' command not found. $xc_msg_abrt" >&2
     exit 1
     ;;
@@ -118,11 +118,11 @@ dnl Emits shell code that verifies that 'test' command
 dnl is available, otherwise aborts execution.
 
 AC_DEFUN([_XC_CFG_PRE_BASIC_CHK_CMD_TEST],
-[dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_CMD_ECHO])dnl
-#
-# Verify that 'test' command is available, otherwise abort.
-#
+[
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_CMD_ECHO])
+dnl
+dnl Verify that 'test' command is available, otherwise abort.
+dnl
 
 xc_tst_str='unknown'
 (`test -n "$xc_tst_str" >/dev/null 2>&1`) && xc_tst_str='success'
@@ -146,11 +146,11 @@ dnl Emits shell code that verifies that 'PATH' variable
 dnl is set, otherwise aborts execution.
 
 AC_DEFUN([_XC_CFG_PRE_BASIC_CHK_VAR_PATH],
-[dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_CMD_TEST])dnl
-#
-# Verify that 'PATH' variable is set, otherwise abort.
-#
+[
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_CMD_TEST])
+dnl
+dnl Verify that 'PATH' variable is set, otherwise abort.
+dnl
 
 xc_tst_str='unknown'
 (`test -n "$PATH" >/dev/null 2>&1`) && xc_tst_str='success'
@@ -174,11 +174,11 @@ dnl Emits shell code that verifies that 'expr' command
 dnl is available, otherwise aborts execution.
 
 AC_DEFUN([_XC_CFG_PRE_BASIC_CHK_CMD_EXPR],
-[dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_VAR_PATH])dnl
-#
-# Verify that 'expr' command is available, otherwise abort.
-#
+[
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_VAR_PATH])
+dnl
+dnl Verify that 'expr' command is available, otherwise abort.
+dnl
 
 xc_tst_str='unknown'
 xc_tst_str=`expr "$xc_tst_str" : '.*' 2>/dev/null`
@@ -206,11 +206,11 @@ dnl script bootstrapping itself. No fancy testing for a
 dnl proper 'sed' this early, that should be done later.
 
 AC_DEFUN([_XC_CFG_PRE_BASIC_CHK_UTIL_SED],
-[dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_VAR_PATH])dnl
-#
-# Verify that 'sed' utility is found within 'PATH', otherwise abort.
-#
+[
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_VAR_PATH])
+dnl
+dnl Verify that 'sed' utility is found within 'PATH', otherwise abort.
+dnl
 
 xc_tst_str='unknown'
 xc_tst_str=`echo "$xc_tst_str" 2>/dev/null \
@@ -239,11 +239,11 @@ dnl script bootstrapping itself. No fancy testing for a
 dnl proper 'grep' this early, that should be done later.
 
 AC_DEFUN([_XC_CFG_PRE_BASIC_CHK_UTIL_GREP],
-[dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_VAR_PATH])dnl
-#
-# Verify that 'grep' utility is found within 'PATH', otherwise abort.
-#
+[
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_VAR_PATH])
+dnl
+dnl Verify that 'grep' utility is found within 'PATH', otherwise abort.
+dnl
 
 xc_tst_str='unknown'
 (`echo "$xc_tst_str" 2>/dev/null \
@@ -268,11 +268,11 @@ dnl Emits shell code that verifies that 'tr' utility
 dnl is found within 'PATH', otherwise aborts execution.
 
 AC_DEFUN([_XC_CFG_PRE_BASIC_CHK_UTIL_TR],
-[dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_VAR_PATH])dnl
-#
-# Verify that 'tr' utility is found within 'PATH', otherwise abort.
-#
+[
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_VAR_PATH])
+dnl
+dnl Verify that 'tr' utility is found within 'PATH', otherwise abort.
+dnl
 
 xc_tst_str="${xc_tab}98s7u6c5c4e3s2s10"
 xc_tst_str=`echo "$xc_tst_str" 2>/dev/null \
@@ -297,11 +297,11 @@ dnl Emits shell code that verifies that 'wc' utility
 dnl is found within 'PATH', otherwise aborts execution.
 
 AC_DEFUN([_XC_CFG_PRE_BASIC_CHK_UTIL_WC],
-[dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_TR])dnl
-#
-# Verify that 'wc' utility is found within 'PATH', otherwise abort.
-#
+[
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_TR])
+dnl
+dnl Verify that 'wc' utility is found within 'PATH', otherwise abort.
+dnl
 
 xc_tst_str='unknown unknown unknown unknown'
 xc_tst_str=`echo "$xc_tst_str" 2>/dev/null \
@@ -326,11 +326,11 @@ dnl Emits shell code that verifies that 'cat' utility
 dnl is found within 'PATH', otherwise aborts execution.
 
 AC_DEFUN([_XC_CFG_PRE_BASIC_CHK_UTIL_CAT],
-[dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_WC])dnl
-#
-# Verify that 'cat' utility is found within 'PATH', otherwise abort.
-#
+[
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_WC])
+dnl
+dnl Verify that 'cat' utility is found within 'PATH', otherwise abort.
+dnl
 
 xc_tst_str='unknown'
 xc_tst_str=`cat <<_EOT 2>/dev/null \
@@ -367,13 +367,13 @@ dnl Non-empty user provided 'PATH_SEPARATOR' always
 dnl overrides the auto-detected one.
 
 AC_DEFUN([_XC_CFG_PRE_CHECK_PATH_SEPARATOR],
-[dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_CMD_EXPR])dnl
-#
-# Auto-detect and set 'PATH_SEPARATOR', unless it is already non-empty set.
-#
+[
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_CMD_EXPR])
+dnl
+dnl Auto-detect and set 'PATH_SEPARATOR', unless it is already non-empty set.
+dnl
 
-# Directory count in 'PATH' when using a colon separator.
+dnl Directory count in 'PATH' when using a colon separator.
 xc_tst_dirs_col='x'
 xc_tst_prev_IFS=$IFS; IFS=':'
 for xc_tst_dir in $PATH; do
@@ -383,7 +383,7 @@ done
 IFS=$xc_tst_prev_IFS
 xc_tst_dirs_col=`expr "$xc_tst_dirs_col" : '.*'`
 
-# Directory count in 'PATH' when using a semicolon separator.
+dnl Directory count in 'PATH' when using a semicolon separator.
 xc_tst_dirs_sem='x'
 xc_tst_prev_IFS=$IFS; IFS=';'
 for xc_tst_dir in $PATH; do
@@ -393,31 +393,31 @@ done
 IFS=$xc_tst_prev_IFS
 xc_tst_dirs_sem=`expr "$xc_tst_dirs_sem" : '.*'`
 
-if test $xc_tst_dirs_sem -eq $xc_tst_dirs_col; then
-  # When both counting methods give the same result we do not want to
-  # chose one over the other, and consider auto-detection not possible.
+if test "$xc_tst_dirs_sem" -eq "$xc_tst_dirs_col"; then
+  dnl When both counting methods give the same result we do not want to
+  dnl chose one over the other, and consider auto-detection not possible.
   if test -z "$PATH_SEPARATOR"; then
-    # User should provide the correct 'PATH_SEPARATOR' definition.
-    # Until then, guess that it is colon!
+    dnl User should provide the correct 'PATH_SEPARATOR' definition.
+    dnl Until then, guess that it is colon!
     echo "$xc_msg_warn path separator not determined, guessing colon" >&2
     PATH_SEPARATOR=':'
   fi
 else
-  # Separator with the greater directory count is the auto-detected one.
-  if test $xc_tst_dirs_sem -gt $xc_tst_dirs_col; then
+  dnl Separator with the greater directory count is the auto-detected one.
+  if test "$xc_tst_dirs_sem" -gt "$xc_tst_dirs_col"; then
     xc_tst_auto_separator=';'
   else
     xc_tst_auto_separator=':'
   fi
   if test -z "$PATH_SEPARATOR"; then
-    # Simply use the auto-detected one when not already set.
+    dnl Use the auto-detected one when not already set.
     PATH_SEPARATOR=$xc_tst_auto_separator
   elif test "x$PATH_SEPARATOR" != "x$xc_tst_auto_separator"; then
     echo "$xc_msg_warn 'PATH_SEPARATOR' does not match auto-detected one." >&2
   fi
 fi
 xc_PATH_SEPARATOR=$PATH_SEPARATOR
-AC_SUBST([PATH_SEPARATOR])dnl
+AC_SUBST([PATH_SEPARATOR])
 ])
 
 
@@ -426,19 +426,19 @@ dnl -------------------------------------------------
 dnl Private macro.
 
 AC_DEFUN([_XC_CFG_PRE_POSTLUDE],
-[dnl
-AC_REQUIRE([_XC_CFG_PRE_PREAMBLE])dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_CMD_ECHO])dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_CMD_TEST])dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_VAR_PATH])dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_CMD_EXPR])dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_SED])dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_GREP])dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_TR])dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_WC])dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_CAT])dnl
-AC_REQUIRE([_XC_CFG_PRE_CHECK_PATH_SEPARATOR])dnl
-dnl
+[
+AC_REQUIRE([_XC_CFG_PRE_PREAMBLE])
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_CMD_ECHO])
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_CMD_TEST])
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_VAR_PATH])
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_CMD_EXPR])
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_SED])
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_GREP])
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_TR])
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_WC])
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_CAT])
+AC_REQUIRE([_XC_CFG_PRE_CHECK_PATH_SEPARATOR])
+
 xc_configure_preamble_result='yes'
 ])
 
@@ -448,7 +448,7 @@ dnl -------------------------------------------------
 dnl Public macro.
 dnl
 dnl This macro emits shell code which does some
-dnl very basic checks related with the availability
+dnl basic checks related with the availability
 dnl of some commands and utilities needed to allow
 dnl configure script bootstrapping itself when using
 dnl these to figure out other settings. Also emits
@@ -471,58 +471,58 @@ dnl script is making it override autoconf and libtool
 dnl PATH_SEPARATOR check.
 
 AC_DEFUN([XC_CONFIGURE_PREAMBLE],
-[dnl
-AC_PREREQ([2.50])dnl
-dnl
-AC_BEFORE([$0],[_XC_CFG_PRE_PREAMBLE])dnl
-AC_BEFORE([$0],[_XC_CFG_PRE_BASIC_CHK_CMD_ECHO])dnl
-AC_BEFORE([$0],[_XC_CFG_PRE_BASIC_CHK_CMD_TEST])dnl
-AC_BEFORE([$0],[_XC_CFG_PRE_BASIC_CHK_VAR_PATH])dnl
-AC_BEFORE([$0],[_XC_CFG_PRE_BASIC_CHK_CMD_EXPR])dnl
-AC_BEFORE([$0],[_XC_CFG_PRE_BASIC_CHK_UTIL_SED])dnl
-AC_BEFORE([$0],[_XC_CFG_PRE_BASIC_CHK_UTIL_GREP])dnl
-AC_BEFORE([$0],[_XC_CFG_PRE_BASIC_CHK_UTIL_TR])dnl
-AC_BEFORE([$0],[_XC_CFG_PRE_BASIC_CHK_UTIL_WC])dnl
-AC_BEFORE([$0],[_XC_CFG_PRE_BASIC_CHK_UTIL_CAT])dnl
-AC_BEFORE([$0],[_XC_CFG_PRE_CHECK_PATH_SEPARATOR])dnl
-AC_BEFORE([$0],[_XC_CFG_PRE_POSTLUDE])dnl
-dnl
-AC_BEFORE([$0],[AC_CHECK_TOOL])dnl
-AC_BEFORE([$0],[AC_CHECK_PROG])dnl
-AC_BEFORE([$0],[AC_CHECK_TOOLS])dnl
-AC_BEFORE([$0],[AC_CHECK_PROGS])dnl
-dnl
-AC_BEFORE([$0],[AC_PATH_TOOL])dnl
-AC_BEFORE([$0],[AC_PATH_PROG])dnl
-AC_BEFORE([$0],[AC_PATH_PROGS])dnl
-dnl
-AC_BEFORE([$0],[AC_PROG_SED])dnl
-AC_BEFORE([$0],[AC_PROG_GREP])dnl
-AC_BEFORE([$0],[AC_PROG_LN_S])dnl
-AC_BEFORE([$0],[AC_PROG_MKDIR_P])dnl
-AC_BEFORE([$0],[AC_PROG_INSTALL])dnl
-AC_BEFORE([$0],[AC_PROG_MAKE_SET])dnl
-AC_BEFORE([$0],[AC_PROG_LIBTOOL])dnl
-dnl
-AC_BEFORE([$0],[LT_INIT])dnl
-AC_BEFORE([$0],[AM_INIT_AUTOMAKE])dnl
-AC_BEFORE([$0],[AC_LIBTOOL_WIN32_DLL])dnl
-dnl
-AC_REQUIRE([_XC_CFG_PRE_PREAMBLE])dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_CMD_ECHO])dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_CMD_TEST])dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_VAR_PATH])dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_CMD_EXPR])dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_SED])dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_GREP])dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_TR])dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_WC])dnl
-AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_CAT])dnl
-AC_REQUIRE([_XC_CFG_PRE_CHECK_PATH_SEPARATOR])dnl
-AC_REQUIRE([_XC_CFG_PRE_POSTLUDE])dnl
-dnl
-m4_pattern_forbid([^_*XC])dnl
-m4_define([$0],[])dnl
+[
+AC_PREREQ([2.50])
+
+AC_BEFORE([$0],[_XC_CFG_PRE_PREAMBLE])
+AC_BEFORE([$0],[_XC_CFG_PRE_BASIC_CHK_CMD_ECHO])
+AC_BEFORE([$0],[_XC_CFG_PRE_BASIC_CHK_CMD_TEST])
+AC_BEFORE([$0],[_XC_CFG_PRE_BASIC_CHK_VAR_PATH])
+AC_BEFORE([$0],[_XC_CFG_PRE_BASIC_CHK_CMD_EXPR])
+AC_BEFORE([$0],[_XC_CFG_PRE_BASIC_CHK_UTIL_SED])
+AC_BEFORE([$0],[_XC_CFG_PRE_BASIC_CHK_UTIL_GREP])
+AC_BEFORE([$0],[_XC_CFG_PRE_BASIC_CHK_UTIL_TR])
+AC_BEFORE([$0],[_XC_CFG_PRE_BASIC_CHK_UTIL_WC])
+AC_BEFORE([$0],[_XC_CFG_PRE_BASIC_CHK_UTIL_CAT])
+AC_BEFORE([$0],[_XC_CFG_PRE_CHECK_PATH_SEPARATOR])
+AC_BEFORE([$0],[_XC_CFG_PRE_POSTLUDE])
+
+AC_BEFORE([$0],[AC_CHECK_TOOL])
+AC_BEFORE([$0],[AC_CHECK_PROG])
+AC_BEFORE([$0],[AC_CHECK_TOOLS])
+AC_BEFORE([$0],[AC_CHECK_PROGS])
+
+AC_BEFORE([$0],[AC_PATH_TOOL])
+AC_BEFORE([$0],[AC_PATH_PROG])
+AC_BEFORE([$0],[AC_PATH_PROGS])
+
+AC_BEFORE([$0],[AC_PROG_SED])
+AC_BEFORE([$0],[AC_PROG_GREP])
+AC_BEFORE([$0],[AC_PROG_LN_S])
+AC_BEFORE([$0],[AC_PROG_MKDIR_P])
+AC_BEFORE([$0],[AC_PROG_INSTALL])
+AC_BEFORE([$0],[AC_PROG_MAKE_SET])
+AC_BEFORE([$0],[AC_PROG_LIBTOOL])
+
+AC_BEFORE([$0],[LT_INIT])
+AC_BEFORE([$0],[AM_INIT_AUTOMAKE])
+AC_BEFORE([$0],[AC_LIBTOOL_WIN32_DLL])
+
+AC_REQUIRE([_XC_CFG_PRE_PREAMBLE])
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_CMD_ECHO])
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_CMD_TEST])
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_VAR_PATH])
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_CMD_EXPR])
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_SED])
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_GREP])
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_TR])
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_WC])
+AC_REQUIRE([_XC_CFG_PRE_BASIC_CHK_UTIL_CAT])
+AC_REQUIRE([_XC_CFG_PRE_CHECK_PATH_SEPARATOR])
+AC_REQUIRE([_XC_CFG_PRE_POSTLUDE])
+
+m4_pattern_forbid([^_*XC])
+m4_define([$0],[])
 ])
 
 
@@ -540,13 +540,13 @@ dnl Override when using autoconf 2.53 and newer.
 dnl
 
 m4_ifdef([_AS_PATH_SEPARATOR_PREPARE],
-[dnl
-m4_undefine([_AS_PATH_SEPARATOR_PREPARE])dnl
+[
+m4_undefine([_AS_PATH_SEPARATOR_PREPARE])
 m4_defun([_AS_PATH_SEPARATOR_PREPARE],
-[dnl
-AC_REQUIRE([XC_CONFIGURE_PREAMBLE])dnl
-m4_define([$0],[])dnl
-])dnl
+[
+AC_REQUIRE([XC_CONFIGURE_PREAMBLE])
+m4_define([$0],[])
+])
 ])
 
 dnl
@@ -554,14 +554,14 @@ dnl Override when using autoconf 2.50 to 2.52
 dnl
 
 m4_ifdef([_AC_INIT_PREPARE_FS_SEPARATORS],
-[dnl
-m4_undefine([_AC_INIT_PREPARE_FS_SEPARATORS])dnl
+[
+m4_undefine([_AC_INIT_PREPARE_FS_SEPARATORS])
 m4_defun([_AC_INIT_PREPARE_FS_SEPARATORS],
-[dnl
-AC_REQUIRE([XC_CONFIGURE_PREAMBLE])dnl
+[
+AC_REQUIRE([XC_CONFIGURE_PREAMBLE])
 ac_path_separator=$PATH_SEPARATOR
-m4_define([$0],[])dnl
-])dnl
+m4_define([$0],[])
+])
 ])
 
 dnl
@@ -569,14 +569,14 @@ dnl Override when using libtool 1.4.2
 dnl
 
 m4_ifdef([_LT_AC_LIBTOOL_SYS_PATH_SEPARATOR],
-[dnl
-m4_undefine([_LT_AC_LIBTOOL_SYS_PATH_SEPARATOR])dnl
+[
+m4_undefine([_LT_AC_LIBTOOL_SYS_PATH_SEPARATOR])
 m4_defun([_LT_AC_LIBTOOL_SYS_PATH_SEPARATOR],
-[dnl
-AC_REQUIRE([XC_CONFIGURE_PREAMBLE])dnl
+[
+AC_REQUIRE([XC_CONFIGURE_PREAMBLE])
 lt_cv_sys_path_separator=$PATH_SEPARATOR
-m4_define([$0],[])dnl
-])dnl
+m4_define([$0],[])
+])
 ])
 
 
@@ -602,51 +602,51 @@ dnl overrides the auto-detected one.
 dnl
 dnl Strictly speaking the check is done in two steps. The
 dnl first, which does the actual check, takes place in
-dnl XC_CONFIGURE_PREAMBLE macro and happens very early in
+dnl XC_CONFIGURE_PREAMBLE macro and happens early in
 dnl generated configure script. The second one shows and
 dnl logs the result of the check into config.log at a later
 dnl configure stage. Placement of this second stage in
-dnl generated configure script will be done where first
+dnl generated configure script is done where first
 dnl direct or indirect usage of this macro happens.
 
 AC_DEFUN([XC_CHECK_PATH_SEPARATOR],
-[dnl
-AC_PREREQ([2.50])dnl
+[
+AC_PREREQ([2.50])
+
+AC_BEFORE([$0],[AC_CHECK_TOOL])
+AC_BEFORE([$0],[AC_CHECK_PROG])
+AC_BEFORE([$0],[AC_CHECK_TOOLS])
+AC_BEFORE([$0],[AC_CHECK_PROGS])
+
+AC_BEFORE([$0],[AC_PATH_TOOL])
+AC_BEFORE([$0],[AC_PATH_PROG])
+AC_BEFORE([$0],[AC_PATH_PROGS])
+
+AC_BEFORE([$0],[AC_PROG_SED])
+AC_BEFORE([$0],[AC_PROG_GREP])
+AC_BEFORE([$0],[AC_PROG_LN_S])
+AC_BEFORE([$0],[AC_PROG_MKDIR_P])
+AC_BEFORE([$0],[AC_PROG_INSTALL])
+AC_BEFORE([$0],[AC_PROG_MAKE_SET])
+AC_BEFORE([$0],[AC_PROG_LIBTOOL])
+
+AC_BEFORE([$0],[LT_INIT])
+AC_BEFORE([$0],[AM_INIT_AUTOMAKE])
+AC_BEFORE([$0],[AC_LIBTOOL_WIN32_DLL])
+
+AC_REQUIRE([XC_CONFIGURE_PREAMBLE])
+
 dnl
-AC_BEFORE([$0],[AC_CHECK_TOOL])dnl
-AC_BEFORE([$0],[AC_CHECK_PROG])dnl
-AC_BEFORE([$0],[AC_CHECK_TOOLS])dnl
-AC_BEFORE([$0],[AC_CHECK_PROGS])dnl
+dnl Check that 'XC_CONFIGURE_PREAMBLE' has already run.
 dnl
-AC_BEFORE([$0],[AC_PATH_TOOL])dnl
-AC_BEFORE([$0],[AC_PATH_PROG])dnl
-AC_BEFORE([$0],[AC_PATH_PROGS])dnl
-dnl
-AC_BEFORE([$0],[AC_PROG_SED])dnl
-AC_BEFORE([$0],[AC_PROG_GREP])dnl
-AC_BEFORE([$0],[AC_PROG_LN_S])dnl
-AC_BEFORE([$0],[AC_PROG_MKDIR_P])dnl
-AC_BEFORE([$0],[AC_PROG_INSTALL])dnl
-AC_BEFORE([$0],[AC_PROG_MAKE_SET])dnl
-AC_BEFORE([$0],[AC_PROG_LIBTOOL])dnl
-dnl
-AC_BEFORE([$0],[LT_INIT])dnl
-AC_BEFORE([$0],[AM_INIT_AUTOMAKE])dnl
-AC_BEFORE([$0],[AC_LIBTOOL_WIN32_DLL])dnl
-dnl
-AC_REQUIRE([XC_CONFIGURE_PREAMBLE])dnl
-dnl
-#
-# Check that 'XC_CONFIGURE_PREAMBLE' has already run.
-#
 
 if test -z "$xc_configure_preamble_result"; then
   AC_MSG_ERROR([xc_configure_preamble_result not set (internal problem)])
 fi
 
-#
-# Check that 'PATH_SEPARATOR' has already been set.
-#
+dnl
+dnl Check that 'PATH_SEPARATOR' has already been set.
+dnl
 
 if test -z "$xc_PATH_SEPARATOR"; then
   AC_MSG_ERROR([xc_PATH_SEPARATOR not set (internal problem)])
@@ -661,7 +661,7 @@ if test "x$PATH_SEPARATOR" != "x$xc_PATH_SEPARATOR"; then
   AC_MSG_RESULT([$xc_PATH_SEPARATOR])
   AC_MSG_ERROR([path separator mismatch (internal or config.site problem)])
 fi
-dnl
-m4_pattern_forbid([^_*XC])dnl
-m4_define([$0],[])dnl
+
+m4_pattern_forbid([^_*XC])
+m4_define([$0],[])
 ])
diff --git a/third-party/curl/m4/zz50-xc-ovr.m4 b/third-party/curl/m4/zz50-xc-ovr.m4
index 18c1f0aba3..563c5ab25a 100644
--- a/third-party/curl/m4/zz50-xc-ovr.m4
+++ b/third-party/curl/m4/zz50-xc-ovr.m4
@@ -2,7 +2,7 @@
 #
 # zz50-xc-ovr.m4
 #
-# Copyright (C), Daniel Stenberg <daniel@haxx.se>
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -20,7 +20,7 @@
 #
 #---------------------------------------------------------------------------
 
-# serial 1
+dnl serial 1
 
 
 dnl The funny name of this file is intentional in order to make it
@@ -35,7 +35,7 @@ dnl -------------------------------------------------
 dnl This is done to prevent Libtool 1.5.X from doing
 dnl unnecessary C++, Fortran and Java tests when only
 dnl using C language and reduce resulting configure
-dnl script by nearly 300 Kb.
+dnl script by nearly 300 KB.
 
 m4_ifdef([AC_LIBTOOL_LANG_CXX_CONFIG],
   [m4_undefine([AC_LIBTOOL_LANG_CXX_CONFIG])])
@@ -52,8 +52,8 @@ m4_define([AC_LIBTOOL_LANG_GCJ_CONFIG],[:])
 
 dnl XC_OVR_ZZ50
 dnl -------------------------------------------------
-dnl Placing a call to this macro in configure.ac will
-dnl make macros in this file visible to other macros
+dnl Placing a call to this macro in configure.ac
+dnl makes macros in this file visible to other macros
 dnl used for same configure script, overriding those
 dnl provided elsewhere.
 
diff --git a/third-party/curl/m4/zz60-xc-ovr.m4 b/third-party/curl/m4/zz60-xc-ovr.m4
deleted file mode 100644
index 5316686729..0000000000
--- a/third-party/curl/m4/zz60-xc-ovr.m4
+++ /dev/null
@@ -1,65 +0,0 @@
-#---------------------------------------------------------------------------
-#
-# zz60-xc-ovr.m4
-#
-# Copyright (C), Daniel Stenberg <daniel@haxx.se>
-#
-# Permission to use, copy, modify, and distribute this software for any
-# purpose with or without fee is hereby granted, provided that the above
-# copyright notice and this permission notice appear in all copies.
-#
-# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-#
-# SPDX-License-Identifier: ISC
-#
-#---------------------------------------------------------------------------
-
-# serial 1
-
-
-dnl The funny name of this file is intentional in order to make it
-dnl sort alphabetically after any libtool, autoconf or automake
-dnl provided .m4 macro file that might get copied into this same
-dnl subdirectory. This allows that macro (re)definitions from this
-dnl file may override those provided in other files.
-
-
-dnl Override an autoconf provided macro
-dnl -------------------------------------------------
-dnl This macro overrides the one provided by autoconf
-dnl 2.58 or newer, and provides macro definition for
-dnl autoconf 2.57 or older which lack it. This allows
-dnl using libtool 2.2 or newer, which requires that
-dnl this macro is used in configure.ac, with autoconf
-dnl 2.57 or older.
-
-m4_ifdef([AC_CONFIG_MACRO_DIR],
-[dnl
-m4_undefine([AC_CONFIG_MACRO_DIR])dnl
-])
-m4_define([AC_CONFIG_MACRO_DIR],[])
-
-
-dnl XC_OVR_ZZ60
-dnl -------------------------------------------------
-dnl Placing a call to this macro in configure.ac will
-dnl make macros in this file visible to other macros
-dnl used for same configure script, overriding those
-dnl provided elsewhere.
-
-AC_DEFUN([XC_OVR_ZZ60],
-[dnl
-AC_BEFORE([$0],[LT_INIT])dnl
-AC_BEFORE([$0],[AM_INIT_AUTOMAKE])dnl
-AC_BEFORE([$0],[AC_LIBTOOL_WIN32_DLL])dnl
-AC_BEFORE([$0],[AC_PROG_LIBTOOL])dnl
-dnl
-AC_BEFORE([$0],[AC_CONFIG_MACRO_DIR])dnl
-AC_BEFORE([$0],[AC_CONFIG_MACRO_DIRS])dnl
-])
diff --git a/third-party/curl/maketgz b/third-party/curl/maketgz
deleted file mode 100644
index a0fcd878f7..0000000000
--- a/third-party/curl/maketgz
+++ /dev/null
@@ -1,225 +0,0 @@
-#!/bin/sh
-# Script to build release-archives with. Note that this requires a checkout
-# from git and you should first run ./buildconf and build curl once.
-#
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-version=$1
-
-if [ -z "$version" ]; then
-  echo "Specify a version number!"
-  exit
-fi
-
-if [ "xonly" = "x$2" ]; then
-  echo "Setup version number only!"
-  only=1
-fi
-
-libversion="$version"
-
-# we make curl the same version as libcurl
-curlversion=$libversion
-
-major=`echo $libversion | cut -d. -f1 | sed -e "s/[^0-9]//g"`
-minor=`echo $libversion | cut -d. -f2 | sed -e "s/[^0-9]//g"`
-patch=`echo $libversion | cut -d. -f3 | cut -d- -f1 | sed -e "s/[^0-9]//g"`
-
-if test -z "$patch"; then
-  echo "invalid version number? needs to be z.y.z"
-  exit
-fi
-
-#
-# As a precaution, remove all *.dist files that may be lying around, to reduce
-# the risk of old leftovers getting shipped. The root 'Makefile.dist' is the
-# exception.
-echo "removing all old *.dist files"
-find . -name "*.dist" -a ! -name Makefile.dist -exec rm {} \;
-
-numeric=`perl -e 'printf("%02x%02x%02x\n", '"$major, $minor, $patch);"`
-
-HEADER=include/curl/curlver.h
-CHEADER=src/tool_version.h
-PLIST=lib/libcurl.plist
-PLISTO=$PLIST
-
-if test -z "$only"; then
-  ext=".dist"
-  # when not setting up version numbers locally
-  for a in $HEADER $CHEADER $PLIST; do
-    cp $a "$a$ext"
-  done
-  HEADER="$HEADER$ext"
-  CHEADER="$CHEADER$ext"
-  PLIST="$PLIST$ext"
-fi
-
-# requires a date command that knows + for format
-datestamp=`date +"%F"`
-
-# Replace version number in header file:
-sed -i.bak \
-    -e 's/^#define LIBCURL_VERSION .*/#define LIBCURL_VERSION "'$libversion'"/g' \
-    -e 's/^#define LIBCURL_VERSION_NUM .*/#define LIBCURL_VERSION_NUM 0x'$numeric'/g' \
-    -e 's/^#define LIBCURL_VERSION_MAJOR .*/#define LIBCURL_VERSION_MAJOR '$major'/g' \
-    -e 's/^#define LIBCURL_VERSION_MINOR .*/#define LIBCURL_VERSION_MINOR '$minor'/g' \
-    -e 's/^#define LIBCURL_VERSION_PATCH .*/#define LIBCURL_VERSION_PATCH '$patch'/g' \
-    -e "s/^#define LIBCURL_TIMESTAMP .*/#define LIBCURL_TIMESTAMP \"$datestamp\"/g" \
-    $HEADER
-rm -f "$HEADER.bak"
-
-# Replace version number in header file:
-sed -i.bak 's/#define CURL_VERSION .*/#define CURL_VERSION "'$curlversion'"/g' $CHEADER
-rm -f "$CHEADER.bak"
-
-# Replace version number in plist file:
-sed "s/@CURL_PLIST_VERSION@/$curlversion/g" < $PLISTO.in >$PLIST
-
-if test -n "$only"; then
-  # done!
-  exit;
-fi
-
-echo "curl version $curlversion"
-echo "libcurl version $libversion"
-echo "libcurl numerical $numeric"
-echo "datestamp $datestamp"
-
-findprog() {
-  file="$1"
-  for part in `echo $PATH| tr ':' ' '`; do
-    path="$part/$file"
-    if [ -x "$path" ]; then
-      # there it is!
-      return 1
-    fi
-  done
-
-  # no such executable
-  return 0
-}
-
-############################################################################
-#
-# Enforce a rerun of configure (updates the VERSION)
-#
-
-echo "Re-running config.status"
-./config.status --recheck >/dev/null
-
-############################################################################
-#
-# automake is needed to run to make a non-GNU Makefile.in if Makefile.am has
-# been modified.
-#
-
-if { findprog automake >/dev/null 2>/dev/null; } then
-  echo "- Could not find or run automake, I hope you know what you're doing!"
-else
-  echo "Runs automake --include-deps"
-  automake --include-deps Makefile >/dev/null
-fi
-
-############################################################################
-#
-# Modify the man pages to display the version number and date.
-#
-
-echo "update man pages"
-./scripts/updatemanpages.pl $version >/dev/null
-
-# make the generated file newer than the man page
-touch src/tool_hugehelp.c
-
-############################################################################
-#
-# Update the IDE files
-echo "make vc-ide"
-make -s vc-ide
-
-echo "produce CHANGES"
-git log --pretty=fuller --no-color --date=short --decorate=full -1000 | ./scripts/log2changes.pl > CHANGES.dist
-
-############################################################################
-#
-# Now run make dist to generate a tar.gz archive
-#
-
-echo "make dist"
-targz="curl-$version.tar.gz"
-make -sj dist VERSION=$version
-res=$?
-
-if test "$res" != 0; then
-    echo "make dist failed"
-    exit 2
-fi
-
-############################################################################
-#
-# Now make a bz2 archive from the tar.gz original
-#
-
-bzip2="curl-$version.tar.bz2"
-echo "Generating $bzip2"
-gzip -dc $targz | bzip2 --best > $bzip2
-
-############################################################################
-#
-# Now make an xz archive from the tar.gz original
-#
-
-xz="curl-$version.tar.xz"
-echo "Generating $xz"
-gzip -dc $targz | xz -6e - > $xz
-
-############################################################################
-#
-# Now make a zip archive from the tar.gz original
-#
-makezip() {
-  rm -rf $tempdir
-  mkdir $tempdir
-  cd $tempdir
-  gzip -dc ../$targz | tar -xf -
-  find . | zip $zip -@ >/dev/null
-  mv $zip ../
-  cd ..
-  rm -rf $tempdir
-}
-
-zip="curl-$version.zip"
-echo "Generating $zip"
-tempdir=".builddir"
-makezip
-
-echo "------------------"
-echo "maketgz report:"
-echo ""
-ls -l $targz $bzip2 $zip $xz
-
-echo "Run this:"
-echo "gpg -b -a $targz && gpg -b -a $bzip2 && gpg -b -a $zip && gpg -b -a $xz"
diff --git a/third-party/curl/packages/Makefile.am b/third-party/curl/packages/Makefile.am
deleted file mode 100644
index b7bf1e5916..0000000000
--- a/third-party/curl/packages/Makefile.am
+++ /dev/null
@@ -1,51 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-SUBDIRS = vms
-
-EXTRA_DIST = README.md \
-  OS400/README.OS400 \
-  OS400/rpg-examples \
-  OS400/ccsidcurl.c \
-  OS400/ccsidcurl.h \
-  OS400/curlcl.c \
-  OS400/curlmain.c \
-  OS400/curl.inc.in \
-  OS400/initscript.sh \
-  OS400/config400.default \
-  OS400/make-include.sh \
-  OS400/make-lib.sh \
-  OS400/make-src.sh \
-  OS400/make-tests.sh \
-  OS400/makefile.sh \
-  OS400/os400sys.c \
-  OS400/os400sys.h \
-  OS400/curl.cmd
-
-CHECKSRC = $(CS_$(V))
-CS_0 = @echo "  RUN     " $@;
-CS_1 =
-CS_ = $(CS_0)
-
-checksrc:
-	$(CHECKSRC)(@PERL@ $(top_srcdir)/scripts/checksrc.pl -D$(srcdir) $(srcdir)/OS400/*.[ch])
diff --git a/third-party/curl/packages/OS400/ccsidcurl.c b/third-party/curl/packages/OS400/ccsidcurl.c
deleted file mode 100644
index 48f1f5fbdc..0000000000
--- a/third-party/curl/packages/OS400/ccsidcurl.c
+++ /dev/null
@@ -1,1527 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- *
- ***************************************************************************/
-
-/* CCSID API wrappers for OS/400. */
-
-#include <iconv.h>
-#include <string.h>
-#include <stdlib.h>
-#include <stddef.h>
-#include <errno.h>
-#include <stdarg.h>
-
-#pragma enum(int)
-
-#include "curl.h"
-#include "mprintf.h"
-#include "slist.h"
-#include "urldata.h"
-#include "url.h"
-#include "setopt.h"
-#include "getinfo.h"
-#include "ccsidcurl.h"
-
-#include "os400sys.h"
-
-#ifndef SIZE_MAX
-#define SIZE_MAX        ((size_t) ~0)   /* Is unsigned on OS/400. */
-#endif
-
-
-#define ASCII_CCSID     819     /* Use ISO-8859-1 as ASCII. */
-#define NOCONV_CCSID    65535   /* No conversion. */
-#define ICONV_ID_SIZE   32      /* Size of iconv_open() code identifier. */
-#define ICONV_OPEN_ERROR(t)     ((t).return_value == -1)
-
-#define ALLOC_GRANULE   8       /* Alloc. granule for curl_formadd_ccsid(). */
-
-
-static void
-makeOS400IconvCode(char buf[ICONV_ID_SIZE], unsigned int ccsid)
-{
-  /**
-  *** Convert a CCSID to the corresponding IBM iconv_open() character
-  ***  code identifier.
-  ***  This code is specific to the OS400 implementation of the iconv library.
-  ***  CCSID 65535 (no conversion) is replaced by the ASCII CCSID.
-  ***  CCSID 0 is interpreted by the OS400 as the job's CCSID.
-  **/
-
-  ccsid &= 0xFFFF;
-
-  if(ccsid == NOCONV_CCSID)
-    ccsid = ASCII_CCSID;
-
-  memset(buf, 0, ICONV_ID_SIZE);
-  curl_msprintf(buf, "IBMCCSID%05u0000000", ccsid);
-}
-
-
-static iconv_t
-iconv_open_CCSID(unsigned int ccsidout, unsigned int ccsidin,
-                 unsigned int cstr)
-{
-  char fromcode[ICONV_ID_SIZE];
-  char tocode[ICONV_ID_SIZE];
-
-  /**
-  ***  Like iconv_open(), but character codes are given as CCSIDs.
-  ***  If `cstr' is non-zero, conversion is set up to stop whenever a
-  ***   null character is encountered.
-  ***  See iconv_open() IBM description in "National Language Support API".
-  **/
-
-  makeOS400IconvCode(fromcode, ccsidin);
-  makeOS400IconvCode(tocode, ccsidout);
-  memset(tocode + 13, 0, sizeof(tocode) - 13);   /* Dest. code id format. */
-
-  if(cstr)
-    fromcode[18] = '1';                         /* Set null-terminator flag. */
-
-  return iconv_open(tocode, fromcode);
-}
-
-
-static int
-convert(char *d, size_t dlen, int dccsid,
-        const char *s, int slen, int sccsid)
-{
-  int i;
-  iconv_t cd;
-  size_t lslen;
-
-  /**
-  ***  Convert `sccsid'-coded `slen'-data bytes at `s' into `dccsid'-coded
-  ***   data stored in the `dlen'-byte buffer at `d'.
-  ***  If `slen' < 0, source string is null-terminated.
-  ***  CCSID 65535 (no conversion) is replaced by the ASCII CCSID.
-  ***  Return the converted destination byte count, or -1 if error.
-  **/
-
-  if(sccsid == 65535)
-    sccsid = ASCII_CCSID;
-
-  if(dccsid == 65535)
-    dccsid = ASCII_CCSID;
-
-  if(sccsid == dccsid) {
-    lslen = slen >= 0? slen: strlen(s) + 1;
-    i = lslen < dlen? lslen: dlen;
-
-    if(s != d && i > 0)
-      memcpy(d, s, i);
-
-    return i;
-    }
-
-  if(slen < 0) {
-    lslen = 0;
-    cd = iconv_open_CCSID(dccsid, sccsid, 1);
-    }
-  else {
-    lslen = (size_t) slen;
-    cd = iconv_open_CCSID(dccsid, sccsid, 0);
-    }
-
-  if(ICONV_OPEN_ERROR(cd))
-    return -1;
-
-  i = dlen;
-
-  if((int) iconv(cd, (char * *) &s, &lslen, &d, &dlen) < 0)
-    i = -1;
-  else
-    i -= dlen;
-
-  iconv_close(cd);
-  return i;
-}
-
-
-static char *dynconvert(int dccsid, const char *s, int slen, int sccsid)
-{
-  char *d;
-  char *cp;
-  size_t dlen;
-  int l;
-  static const char nullbyte = 0;
-
-  /* Like convert, but the destination is allocated and returned. */
-
-  dlen = (size_t) (slen < 0? strlen(s): slen) + 1;
-  dlen *= MAX_CONV_EXPANSION;           /* Allow some expansion. */
-  d = malloc(dlen);
-
-  if(!d)
-    return (char *) NULL;
-
-  l = convert(d, dlen, dccsid, s, slen, sccsid);
-
-  if(l < 0) {
-    free(d);
-    return (char *) NULL;
-    }
-
-  if(slen < 0) {
-    /* Need to null-terminate even when source length is given.
-       Since destination code size is unknown, use a conversion to generate
-       terminator. */
-
-    int l2 = convert(d + l, dlen - l, dccsid, &nullbyte, -1, ASCII_CCSID);
-
-    if(l2 < 0) {
-      free(d);
-      return (char *) NULL;
-      }
-
-    l += l2;
-    }
-
-  if((size_t) l < dlen) {
-    cp = realloc(d, l);         /* Shorten to minimum needed. */
-
-    if(cp)
-      d = cp;
-    }
-
-  return d;
-}
-
-
-static struct curl_slist *
-slist_convert(int dccsid, struct curl_slist *from, int sccsid)
-{
-  struct curl_slist *to = (struct curl_slist *) NULL;
-
-  for(; from; from = from->next) {
-    struct curl_slist *nl;
-    char *cp = dynconvert(dccsid, from->data, -1, sccsid);
-
-    if(!cp) {
-      curl_slist_free_all(to);
-      return (struct curl_slist *) NULL;
-    }
-    nl = Curl_slist_append_nodup(to, cp);
-    if(!nl) {
-      curl_slist_free_all(to);
-      free(cp);
-      return NULL;
-    }
-    to = nl;
-  }
-  return to;
-}
-
-
-static char *
-keyed_string(localkey_t key, const char *ascii, unsigned int ccsid)
-{
-  int i;
-  char *ebcdic;
-
-  if(!ascii)
-    return (char *) NULL;
-
-  i = MAX_CONV_EXPANSION * (strlen(ascii) + 1);
-
-  ebcdic = Curl_thread_buffer(key, i);
-  if(!ebcdic)
-    return ebcdic;
-
-  if(convert(ebcdic, i, ccsid, ascii, -1, ASCII_CCSID) < 0)
-    return (char *) NULL;
-
-  return ebcdic;
-}
-
-
-const char *
-curl_to_ccsid(const char *s, unsigned int ccsid)
-{
-  if(s)
-    s = dynconvert(ccsid, s, -1, ASCII_CCSID);
-  return s;
-}
-
-
-const char *
-curl_from_ccsid(const char *s, unsigned int ccsid)
-{
-  if(s)
-    s = dynconvert(ASCII_CCSID, s, -1, ccsid);
-  return s;
-}
-
-
-char *
-curl_version_ccsid(unsigned int ccsid)
-{
-  return keyed_string(LK_CURL_VERSION, curl_version(), ccsid);
-}
-
-
-char *
-curl_easy_escape_ccsid(CURL *handle, const char *string, int length,
-                       unsigned int sccsid, unsigned int dccsid)
-{
-  char *s;
-  char *d;
-
-  if(!string) {
-    errno = EINVAL;
-    return (char *) NULL;
-    }
-
-  s = dynconvert(ASCII_CCSID, string, length? length: -1, sccsid);
-
-  if(!s)
-    return (char *) NULL;
-
-  d = curl_easy_escape(handle, s, 0);
-  free(s);
-
-  if(!d)
-    return (char *) NULL;
-
-  s = dynconvert(dccsid, d, -1, ASCII_CCSID);
-  free(d);
-  return s;
-}
-
-
-char *
-curl_easy_unescape_ccsid(CURL *handle, const char *string, int length,
-                         int *outlength,
-                         unsigned int sccsid, unsigned int dccsid)
-{
-  char *s;
-  char *d;
-
-  if(!string) {
-    errno = EINVAL;
-    return (char *) NULL;
-    }
-
-  s = dynconvert(ASCII_CCSID, string, length? length: -1, sccsid);
-
-  if(!s)
-    return (char *) NULL;
-
-  d = curl_easy_unescape(handle, s, 0, outlength);
-  free(s);
-
-  if(!d)
-    return (char *) NULL;
-
-  s = dynconvert(dccsid, d, -1, ASCII_CCSID);
-  free(d);
-
-  if(s && outlength)
-    *outlength = strlen(s);
-
-  return s;
-}
-
-
-struct curl_slist *
-curl_slist_append_ccsid(struct curl_slist *list,
-                        const char *data, unsigned int ccsid)
-{
-  char *s;
-
-  s = (char *) NULL;
-
-  if(!data)
-    return curl_slist_append(list, data);
-
-  s = dynconvert(ASCII_CCSID, data, -1, ccsid);
-
-  if(!s)
-    return (struct curl_slist *) NULL;
-
-  list = curl_slist_append(list, s);
-  free(s);
-  return list;
-}
-
-
-time_t
-curl_getdate_ccsid(const char *p, const time_t *unused, unsigned int ccsid)
-{
-  char *s;
-  time_t t;
-
-  if(!p)
-    return curl_getdate(p, unused);
-
-  s = dynconvert(ASCII_CCSID, p, -1, ccsid);
-
-  if(!s)
-    return (time_t) -1;
-
-  t = curl_getdate(s, unused);
-  free(s);
-  return t;
-}
-
-
-static int
-convert_version_info_string(const char **stringp,
-                            char **bufp, int *left, unsigned int ccsid)
-{
-  /* Helper for curl_version_info_ccsid(): convert a string if defined.
-     Result is stored in the `*left'-byte buffer at `*bufp'.
-     `*bufp' and `*left' are updated accordingly.
-     Return 0 if ok, else -1. */
-
-  if(*stringp) {
-    int l = convert(*bufp, *left, ccsid, *stringp, -1, ASCII_CCSID);
-
-    if(l <= 0)
-      return -1;
-
-    *stringp = *bufp;
-    *bufp += l;
-    *left -= l;
-    }
-
-  return 0;
-}
-
-
-curl_version_info_data *
-curl_version_info_ccsid(CURLversion stamp, unsigned int ccsid)
-{
-  curl_version_info_data *p;
-  char *cp;
-  int n;
-  int nproto;
-  curl_version_info_data *id;
-  int i;
-  const char **cpp;
-  static const size_t charfields[] = {
-    offsetof(curl_version_info_data, version),
-    offsetof(curl_version_info_data, host),
-    offsetof(curl_version_info_data, ssl_version),
-    offsetof(curl_version_info_data, libz_version),
-    offsetof(curl_version_info_data, ares),
-    offsetof(curl_version_info_data, libidn),
-    offsetof(curl_version_info_data, libssh_version),
-    offsetof(curl_version_info_data, brotli_version),
-    offsetof(curl_version_info_data, nghttp2_version),
-    offsetof(curl_version_info_data, quic_version),
-    offsetof(curl_version_info_data, cainfo),
-    offsetof(curl_version_info_data, capath),
-    offsetof(curl_version_info_data, zstd_version),
-    offsetof(curl_version_info_data, hyper_version),
-    offsetof(curl_version_info_data, gsasl_version),
-    offsetof(curl_version_info_data, feature_names)
-  };
-
-  /* The assertion below is possible, because although the second operand
-     is an enum member, the first is a #define. In that case, the OS/400 C
-     compiler seems to compare string values after substitution. */
-
-#if CURLVERSION_NOW != CURLVERSION_ELEVENTH
-#error curl_version_info_data structure has changed: upgrade this procedure.
-#endif
-
-  /* If caller has been compiled with a newer version, error. */
-
-  if(stamp > CURLVERSION_NOW)
-    return (curl_version_info_data *) NULL;
-
-  p = curl_version_info(stamp);
-
-  if(!p)
-    return p;
-
-  /* Measure thread space needed. */
-
-  n = 0;
-  nproto = 0;
-
-  if(p->protocols) {
-    while(p->protocols[nproto])
-      n += strlen(p->protocols[nproto++]);
-
-    n += nproto++;
-    }
-
-  for(i = 0; i < sizeof(charfields) / sizeof(charfields[0]); i++) {
-    cpp = (const char **) ((char *) p + charfields[i]);
-    if(*cpp)
-      n += strlen(*cpp) + 1;
-  }
-
-  /* Allocate thread space. */
-
-  n *= MAX_CONV_EXPANSION;
-
-  if(nproto)
-    n += nproto * sizeof(const char *);
-
-  cp = Curl_thread_buffer(LK_VERSION_INFO_DATA, n);
-  id = (curl_version_info_data *) Curl_thread_buffer(LK_VERSION_INFO,
-                                                     sizeof(*id));
-
-  if(!id || !cp)
-    return (curl_version_info_data *) NULL;
-
-  /* Copy data and convert strings. */
-
-  memcpy((char *) id, (char *) p, sizeof(*p));
-
-  if(id->protocols) {
-    i = nproto * sizeof(id->protocols[0]);
-
-    id->protocols = (const char * const *) cp;
-    memcpy(cp, (char *) p->protocols, i);
-    cp += i;
-    n -= i;
-
-    for(i = 0; id->protocols[i]; i++)
-      if(convert_version_info_string(((const char * *) id->protocols) + i,
-                                      &cp, &n, ccsid))
-        return (curl_version_info_data *) NULL;
-  }
-
-  for(i = 0; i < sizeof(charfields) / sizeof(charfields[0]); i++) {
-    cpp = (const char **) ((char *) p + charfields[i]);
-    if(*cpp && convert_version_info_string(cpp, &cp, &n, ccsid))
-      return (curl_version_info_data *) NULL;
-  }
-
-  return id;
-}
-
-
-const char *
-curl_easy_strerror_ccsid(CURLcode error, unsigned int ccsid)
-{
-  return keyed_string(LK_EASY_STRERROR, curl_easy_strerror(error), ccsid);
-}
-
-
-const char *
-curl_share_strerror_ccsid(CURLSHcode error, unsigned int ccsid)
-{
-  return keyed_string(LK_SHARE_STRERROR, curl_share_strerror(error), ccsid);
-}
-
-
-const char *
-curl_multi_strerror_ccsid(CURLMcode error, unsigned int ccsid)
-{
-  return keyed_string(LK_MULTI_STRERROR, curl_multi_strerror(error), ccsid);
-}
-
-
-const char *
-curl_url_strerror_ccsid(CURLUcode error, unsigned int ccsid)
-{
-  return keyed_string(LK_URL_STRERROR, curl_url_strerror(error), ccsid);
-}
-
-
-void
-curl_certinfo_free_all(struct curl_certinfo *info)
-{
-  /* Free all memory used by certificate info. */
-  if(info) {
-    if(info->certinfo) {
-      int i;
-
-      for(i = 0; i < info->num_of_certs; i++)
-        curl_slist_free_all(info->certinfo[i]);
-      free((char *) info->certinfo);
-    }
-    free((char *) info);
-  }
-}
-
-
-CURLcode
-curl_easy_getinfo_ccsid(CURL *curl, CURLINFO info, ...)
-{
-  va_list arg;
-  void *paramp;
-  CURLcode ret;
-  struct Curl_easy *data;
-
-  /* WARNING: unlike curl_easy_getinfo(), the strings returned by this
-     procedure have to be free'ed. */
-
-  data = (struct Curl_easy *) curl;
-  va_start(arg, info);
-  paramp = va_arg(arg, void *);
-  ret = Curl_getinfo(data, info, paramp);
-
-  if(ret == CURLE_OK) {
-    unsigned int ccsid;
-    char **cpp;
-    struct curl_slist **slp;
-    struct curl_certinfo *cipf;
-    struct curl_certinfo *cipt;
-
-    switch((int) info & CURLINFO_TYPEMASK) {
-
-    case CURLINFO_STRING:
-      ccsid = va_arg(arg, unsigned int);
-      cpp = (char * *) paramp;
-
-      if(*cpp) {
-        *cpp = dynconvert(ccsid, *cpp, -1, ASCII_CCSID);
-
-        if(!*cpp)
-          ret = CURLE_OUT_OF_MEMORY;
-      }
-
-      break;
-
-    case CURLINFO_SLIST:
-      ccsid = va_arg(arg, unsigned int);
-      switch(info) {
-      case CURLINFO_CERTINFO:
-        cipf = *(struct curl_certinfo * *) paramp;
-        if(cipf) {
-          cipt = (struct curl_certinfo *) malloc(sizeof(*cipt));
-          if(!cipt)
-            ret = CURLE_OUT_OF_MEMORY;
-          else {
-            cipt->certinfo = (struct curl_slist **)
-              calloc(cipf->num_of_certs +
-                     1, sizeof(struct curl_slist *));
-            if(!cipt->certinfo)
-              ret = CURLE_OUT_OF_MEMORY;
-            else {
-              int i;
-
-              cipt->num_of_certs = cipf->num_of_certs;
-              for(i = 0; i < cipf->num_of_certs; i++)
-                if(cipf->certinfo[i])
-                  if(!(cipt->certinfo[i] = slist_convert(ccsid,
-                                                          cipf->certinfo[i],
-                                                          ASCII_CCSID))) {
-                    ret = CURLE_OUT_OF_MEMORY;
-                    break;
-                  }
-              }
-            }
-
-          if(ret != CURLE_OK) {
-            curl_certinfo_free_all(cipt);
-            cipt = (struct curl_certinfo *) NULL;
-          }
-
-          *(struct curl_certinfo * *) paramp = cipt;
-        }
-
-        break;
-
-      case CURLINFO_TLS_SESSION:
-      case CURLINFO_TLS_SSL_PTR:
-      case CURLINFO_SOCKET:
-        break;
-
-      default:
-        slp = (struct curl_slist **) paramp;
-        if(*slp) {
-          *slp = slist_convert(ccsid, *slp, ASCII_CCSID);
-          if(!*slp)
-            ret = CURLE_OUT_OF_MEMORY;
-        }
-        break;
-      }
-    }
-  }
-
-  va_end(arg);
-  return ret;
-}
-
-
-static int
-Curl_is_formadd_string(CURLformoption option)
-{
-  switch(option) {
-
-  case CURLFORM_FILENAME:
-  case CURLFORM_CONTENTTYPE:
-  case CURLFORM_BUFFER:
-  case CURLFORM_FILE:
-  case CURLFORM_FILECONTENT:
-  case CURLFORM_COPYCONTENTS:
-  case CURLFORM_COPYNAME:
-    return 1;
-  }
-
-  return 0;
-}
-
-
-static void
-Curl_formadd_release_local(struct curl_forms *forms, int nargs, int skip)
-{
-  while(nargs--)
-    if(nargs != skip)
-      if(Curl_is_formadd_string(forms[nargs].option))
-        if(forms[nargs].value)
-          free((char *) forms[nargs].value);
-
-  free((char *) forms);
-}
-
-
-static int
-Curl_formadd_convert(struct curl_forms *forms,
-                     int formx, int lengthx, unsigned int ccsid)
-{
-  int l;
-  char *cp;
-  char *cp2;
-
-  if(formx < 0 || !forms[formx].value)
-    return 0;
-
-  if(lengthx >= 0)
-    l = (int) forms[lengthx].value;
-  else
-    l = strlen(forms[formx].value) + 1;
-
-  cp = malloc(MAX_CONV_EXPANSION * l);
-
-  if(!cp)
-    return -1;
-
-  l = convert(cp, MAX_CONV_EXPANSION * l, ASCII_CCSID,
-              forms[formx].value, l, ccsid);
-
-  if(l < 0) {
-    free(cp);
-    return -1;
-    }
-
-  cp2 = realloc(cp, l);         /* Shorten buffer to the string size. */
-
-  if(cp2)
-    cp = cp2;
-
-  forms[formx].value = cp;
-
-  if(lengthx >= 0)
-    forms[lengthx].value = (char *) l;  /* Update length after conversion. */
-
-  return l;
-}
-
-
-CURLFORMcode
-curl_formadd_ccsid(struct curl_httppost **httppost,
-                   struct curl_httppost **last_post, ...)
-{
-  va_list arg;
-  CURLformoption option;
-  CURLFORMcode result;
-  struct curl_forms *forms;
-  struct curl_forms *lforms;
-  struct curl_forms *tforms;
-  unsigned int lformlen;
-  const char *value;
-  unsigned int ccsid;
-  int nargs;
-  int namex;
-  int namelengthx;
-  int contentx;
-  int lengthx;
-  unsigned int contentccsid;
-  unsigned int nameccsid;
-
-  /* A single curl_formadd() call cannot be split in several calls to deal
-     with all parameters: the original parameters are thus copied to a local
-     curl_forms array and converted to ASCII when needed.
-     CURLFORM_PTRNAME is processed as if it were CURLFORM_COPYNAME.
-     CURLFORM_COPYNAME and CURLFORM_NAMELENGTH occurrence order in
-     parameters is not defined; for this reason, the actual conversion is
-     delayed to the end of parameter processing. The same applies to
-     CURLFORM_COPYCONTENTS/CURLFORM_CONTENTSLENGTH, but these may appear
-     several times in the parameter list; the problem resides here in knowing
-     which CURLFORM_CONTENTSLENGTH applies to which CURLFORM_COPYCONTENTS and
-     when we can be sure to have both info for conversion: end of parameter
-     list is such a point, but CURLFORM_CONTENTTYPE is also used here as a
-     natural separator between content data definitions; this seems to be
-     in accordance with FormAdd() behavior. */
-
-  /* Allocate the local curl_forms array. */
-
-  lformlen = ALLOC_GRANULE;
-  lforms = malloc(lformlen * sizeof(*lforms));
-
-  if(!lforms)
-    return CURL_FORMADD_MEMORY;
-
-  /* Process the arguments, copying them into local array, latching conversion
-     indexes and converting when needed. */
-
-  result = CURL_FORMADD_OK;
-  nargs = 0;
-  contentx = -1;
-  lengthx = -1;
-  namex = -1;
-  namelengthx = -1;
-  forms = (struct curl_forms *) NULL;
-  va_start(arg, last_post);
-
-  for(;;) {
-    /* Make sure there is still room for an item in local array. */
-
-    if(nargs >= lformlen) {
-      lformlen += ALLOC_GRANULE;
-      tforms = realloc(lforms, lformlen * sizeof(*lforms));
-
-      if(!tforms) {
-        result = CURL_FORMADD_MEMORY;
-        break;
-        }
-
-      lforms = tforms;
-      }
-
-    /* Get next option. */
-
-    if(forms) {
-      /* Get option from array. */
-
-      option = forms->option;
-      value = forms->value;
-      forms++;
-      }
-    else {
-      /* Get option from arguments. */
-
-      option = va_arg(arg, CURLformoption);
-
-      if(option == CURLFORM_END)
-        break;
-      }
-
-    /* Dispatch by option. */
-
-    switch(option) {
-
-    case CURLFORM_END:
-      forms = (struct curl_forms *) NULL;       /* Leave array mode. */
-      continue;
-
-    case CURLFORM_ARRAY:
-      if(!forms) {
-        forms = va_arg(arg, struct curl_forms *);
-        continue;
-        }
-
-      result = CURL_FORMADD_ILLEGAL_ARRAY;
-      break;
-
-    case CURLFORM_COPYNAME:
-      option = CURLFORM_PTRNAME;                /* Static for now. */
-
-    case CURLFORM_PTRNAME:
-      if(namex >= 0)
-        result = CURL_FORMADD_OPTION_TWICE;
-
-      namex = nargs;
-
-      if(!forms) {
-        value = va_arg(arg, char *);
-        nameccsid = (unsigned int) va_arg(arg, long);
-        }
-      else {
-        nameccsid = (unsigned int) forms->value;
-        forms++;
-        }
-
-      break;
-
-    case CURLFORM_COPYCONTENTS:
-      if(contentx >= 0)
-        result = CURL_FORMADD_OPTION_TWICE;
-
-      contentx = nargs;
-
-      if(!forms) {
-        value = va_arg(arg, char *);
-        contentccsid = (unsigned int) va_arg(arg, long);
-        }
-      else {
-        contentccsid = (unsigned int) forms->value;
-        forms++;
-        }
-
-      break;
-
-    case CURLFORM_PTRCONTENTS:
-    case CURLFORM_BUFFERPTR:
-      if(!forms)
-        value = va_arg(arg, char *);            /* No conversion. */
-
-      break;
-
-    case CURLFORM_CONTENTSLENGTH:
-      lengthx = nargs;
-
-      if(!forms)
-        value = (char *) va_arg(arg, long);
-
-      break;
-
-    case CURLFORM_CONTENTLEN:
-      lengthx = nargs;
-
-      if(!forms)
-        value = (char *) va_arg(arg, curl_off_t);
-
-      break;
-
-    case CURLFORM_NAMELENGTH:
-      namelengthx = nargs;
-
-      if(!forms)
-        value = (char *) va_arg(arg, long);
-
-      break;
-
-    case CURLFORM_BUFFERLENGTH:
-      if(!forms)
-        value = (char *) va_arg(arg, long);
-
-      break;
-
-    case CURLFORM_CONTENTHEADER:
-      if(!forms)
-        value = (char *) va_arg(arg, struct curl_slist *);
-
-      break;
-
-    case CURLFORM_STREAM:
-      if(!forms)
-        value = (char *) va_arg(arg, void *);
-
-      break;
-
-    case CURLFORM_CONTENTTYPE:
-      /* If a previous content has been encountered, convert it now. */
-
-      if(Curl_formadd_convert(lforms, contentx, lengthx, contentccsid) < 0) {
-        result = CURL_FORMADD_MEMORY;
-        break;
-        }
-
-      contentx = -1;
-      lengthx = -1;
-      /* Fall into default. */
-
-    default:
-      /* Must be a convertible string. */
-
-      if(!Curl_is_formadd_string(option)) {
-        result = CURL_FORMADD_UNKNOWN_OPTION;
-        break;
-        }
-
-      if(!forms) {
-        value = va_arg(arg, char *);
-        ccsid = (unsigned int) va_arg(arg, long);
-        }
-      else {
-        ccsid = (unsigned int) forms->value;
-        forms++;
-        }
-
-      /* Do the conversion. */
-
-      lforms[nargs].value = value;
-
-      if(Curl_formadd_convert(lforms, nargs, -1, ccsid) < 0) {
-        result = CURL_FORMADD_MEMORY;
-        break;
-        }
-
-      value = lforms[nargs].value;
-      }
-
-    if(result != CURL_FORMADD_OK)
-      break;
-
-    lforms[nargs].value = value;
-    lforms[nargs++].option = option;
-    }
-
-  va_end(arg);
-
-  /* Convert the name and the last content, now that we know their lengths. */
-
-  if(result == CURL_FORMADD_OK && namex >= 0) {
-    if(Curl_formadd_convert(lforms, namex, namelengthx, nameccsid) < 0)
-      result = CURL_FORMADD_MEMORY;
-    else
-      lforms[namex].option = CURLFORM_COPYNAME;         /* Force copy. */
-    }
-
-  if(result == CURL_FORMADD_OK) {
-    if(Curl_formadd_convert(lforms, contentx, lengthx, contentccsid) < 0)
-      result = CURL_FORMADD_MEMORY;
-    else
-      contentx = -1;
-    }
-
-  /* Do the formadd with our converted parameters. */
-
-  if(result == CURL_FORMADD_OK) {
-    lforms[nargs].option = CURLFORM_END;
-    result = curl_formadd(httppost, last_post,
-                          CURLFORM_ARRAY, lforms, CURLFORM_END);
-    }
-
-  /* Terminate. */
-
-  Curl_formadd_release_local(lforms, nargs, contentx);
-  return result;
-}
-
-
-struct cfcdata {
-  curl_formget_callback append;
-  void *                arg;
-  unsigned int          ccsid;
-};
-
-
-static size_t
-Curl_formget_callback_ccsid(void *arg, const char *buf, size_t len)
-{
-  struct cfcdata *p;
-  char *b;
-  int l;
-  size_t ret;
-
-  p = (struct cfcdata *) arg;
-
-  if((long) len <= 0)
-    return (*p->append)(p->arg, buf, len);
-
-  b = malloc(MAX_CONV_EXPANSION * len);
-
-  if(!b)
-    return (size_t) -1;
-
-  l = convert(b, MAX_CONV_EXPANSION * len, p->ccsid, buf, len, ASCII_CCSID);
-
-  if(l < 0) {
-    free(b);
-    return (size_t) -1;
-    }
-
-  ret = (*p->append)(p->arg, b, l);
-  free(b);
-  return ret == l? len: -1;
-}
-
-
-int
-curl_formget_ccsid(struct curl_httppost *form, void *arg,
-                   curl_formget_callback append, unsigned int ccsid)
-{
-  struct cfcdata lcfc;
-
-  lcfc.append = append;
-  lcfc.arg = arg;
-  lcfc.ccsid = ccsid;
-  return curl_formget(form, (void *) &lcfc, Curl_formget_callback_ccsid);
-}
-
-
-CURLcode
-curl_easy_setopt_ccsid(CURL *easy, CURLoption tag, ...)
-{
-  CURLcode result;
-  va_list arg;
-  char *s;
-  char *cp = NULL;
-  unsigned int ccsid;
-  curl_off_t pfsize;
-
-  va_start(arg, tag);
-
-  switch(tag) {
-
-  /* BEGIN TRANSLATABLE STRING OPTIONS */
-  /* Keep option symbols in alphanumeric order and retain the BEGIN/END
-     armor comments. */
-  case CURLOPT_ABSTRACT_UNIX_SOCKET:
-  case CURLOPT_ACCEPT_ENCODING:
-  case CURLOPT_ALTSVC:
-  case CURLOPT_AWS_SIGV4:
-  case CURLOPT_CAINFO:
-  case CURLOPT_CAPATH:
-  case CURLOPT_COOKIE:
-  case CURLOPT_COOKIEFILE:
-  case CURLOPT_COOKIEJAR:
-  case CURLOPT_COOKIELIST:
-  case CURLOPT_CRLFILE:
-  case CURLOPT_CUSTOMREQUEST:
-  case CURLOPT_DEFAULT_PROTOCOL:
-  case CURLOPT_DNS_INTERFACE:
-  case CURLOPT_DNS_LOCAL_IP4:
-  case CURLOPT_DNS_LOCAL_IP6:
-  case CURLOPT_DNS_SERVERS:
-  case CURLOPT_DOH_URL:
-  case CURLOPT_EGDSOCKET:
-  case CURLOPT_FTPPORT:
-  case CURLOPT_FTP_ACCOUNT:
-  case CURLOPT_FTP_ALTERNATIVE_TO_USER:
-  case CURLOPT_HAPROXY_CLIENT_IP:
-  case CURLOPT_HSTS:
-  case CURLOPT_INTERFACE:
-  case CURLOPT_ISSUERCERT:
-  case CURLOPT_KEYPASSWD:
-  case CURLOPT_KRBLEVEL:
-  case CURLOPT_LOGIN_OPTIONS:
-  case CURLOPT_MAIL_AUTH:
-  case CURLOPT_MAIL_FROM:
-  case CURLOPT_NETRC_FILE:
-  case CURLOPT_NOPROXY:
-  case CURLOPT_PASSWORD:
-  case CURLOPT_PINNEDPUBLICKEY:
-  case CURLOPT_PRE_PROXY:
-  case CURLOPT_PROTOCOLS_STR:
-  case CURLOPT_PROXY:
-  case CURLOPT_PROXYPASSWORD:
-  case CURLOPT_PROXYUSERNAME:
-  case CURLOPT_PROXYUSERPWD:
-  case CURLOPT_PROXY_CAINFO:
-  case CURLOPT_PROXY_CAPATH:
-  case CURLOPT_PROXY_CRLFILE:
-  case CURLOPT_PROXY_ISSUERCERT:
-  case CURLOPT_PROXY_KEYPASSWD:
-  case CURLOPT_PROXY_PINNEDPUBLICKEY:
-  case CURLOPT_PROXY_SERVICE_NAME:
-  case CURLOPT_PROXY_SSLCERT:
-  case CURLOPT_PROXY_SSLCERTTYPE:
-  case CURLOPT_PROXY_SSLKEY:
-  case CURLOPT_PROXY_SSLKEYTYPE:
-  case CURLOPT_PROXY_SSL_CIPHER_LIST:
-  case CURLOPT_PROXY_TLS13_CIPHERS:
-  case CURLOPT_PROXY_TLSAUTH_PASSWORD:
-  case CURLOPT_PROXY_TLSAUTH_TYPE:
-  case CURLOPT_PROXY_TLSAUTH_USERNAME:
-  case CURLOPT_RANDOM_FILE:
-  case CURLOPT_RANGE:
-  case CURLOPT_REDIR_PROTOCOLS_STR:
-  case CURLOPT_REFERER:
-  case CURLOPT_REQUEST_TARGET:
-  case CURLOPT_RTSP_SESSION_ID:
-  case CURLOPT_RTSP_STREAM_URI:
-  case CURLOPT_RTSP_TRANSPORT:
-  case CURLOPT_SASL_AUTHZID:
-  case CURLOPT_SERVICE_NAME:
-  case CURLOPT_SOCKS5_GSSAPI_SERVICE:
-  case CURLOPT_SSH_HOST_PUBLIC_KEY_MD5:
-  case CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256:
-  case CURLOPT_SSH_KNOWNHOSTS:
-  case CURLOPT_SSH_PRIVATE_KEYFILE:
-  case CURLOPT_SSH_PUBLIC_KEYFILE:
-  case CURLOPT_SSLCERT:
-  case CURLOPT_SSLCERTTYPE:
-  case CURLOPT_SSLENGINE:
-  case CURLOPT_SSLKEY:
-  case CURLOPT_SSLKEYTYPE:
-  case CURLOPT_SSL_CIPHER_LIST:
-  case CURLOPT_SSL_EC_CURVES:
-  case CURLOPT_TLS13_CIPHERS:
-  case CURLOPT_TLSAUTH_PASSWORD:
-  case CURLOPT_TLSAUTH_TYPE:
-  case CURLOPT_TLSAUTH_USERNAME:
-  case CURLOPT_UNIX_SOCKET_PATH:
-  case CURLOPT_URL:
-  case CURLOPT_USERAGENT:
-  case CURLOPT_USERNAME:
-  case CURLOPT_USERPWD:
-  case CURLOPT_XOAUTH2_BEARER:
-  /* END TRANSLATABLE STRING OPTIONS */
-    s = va_arg(arg, char *);
-    ccsid = va_arg(arg, unsigned int);
-
-    if(s) {
-      s = dynconvert(ASCII_CCSID, s, -1, ccsid);
-
-      if(!s) {
-        result = CURLE_OUT_OF_MEMORY;
-        break;
-      }
-    }
-
-    result = curl_easy_setopt(easy, tag, s);
-    free(s);
-    break;
-
-  case CURLOPT_COPYPOSTFIELDS:
-    /* Special case: byte count may have been given by CURLOPT_POSTFIELDSIZE
-       prior to this call. In this case, convert the given byte count and
-       replace the length according to the conversion result. */
-    s = va_arg(arg, char *);
-    ccsid = va_arg(arg, unsigned int);
-
-    pfsize = easy->set.postfieldsize;
-
-    if(!s || !pfsize || ccsid == NOCONV_CCSID || ccsid == ASCII_CCSID) {
-      result = curl_easy_setopt(easy, CURLOPT_COPYPOSTFIELDS, s);
-      break;
-    }
-
-    if(pfsize == -1) {
-      /* Data is null-terminated. */
-      s = dynconvert(ASCII_CCSID, s, -1, ccsid);
-
-      if(!s) {
-        result = CURLE_OUT_OF_MEMORY;
-        break;
-        }
-      }
-    else {
-      /* Data length specified. */
-      size_t len;
-
-      if(pfsize < 0 || pfsize > SIZE_MAX) {
-        result = CURLE_OUT_OF_MEMORY;
-        break;
-      }
-
-      len = pfsize;
-      pfsize = len * MAX_CONV_EXPANSION;
-
-      if(pfsize > SIZE_MAX)
-        pfsize = SIZE_MAX;
-
-      cp = malloc(pfsize);
-
-      if(!cp) {
-        result = CURLE_OUT_OF_MEMORY;
-        break;
-      }
-
-      pfsize = convert(cp, pfsize, ASCII_CCSID, s, len, ccsid);
-
-      if(pfsize < 0) {
-        result = CURLE_OUT_OF_MEMORY;
-        break;
-      }
-
-      easy->set.postfieldsize = pfsize;         /* Replace data size. */
-      s = cp;
-    }
-
-    result = curl_easy_setopt(easy, CURLOPT_POSTFIELDS, s);
-    easy->set.str[STRING_COPYPOSTFIELDS] = s;   /* Give to library. */
-    break;
-
-  default:
-    if(tag / 10000 == CURLOPTTYPE_BLOB) {
-      struct curl_blob *bp = va_arg(arg, struct curl_blob *);
-      struct curl_blob blob;
-
-      ccsid = va_arg(arg, unsigned int);
-
-      if(bp && bp->data && bp->len &&
-         ccsid != NOCONV_CCSID && ccsid != ASCII_CCSID) {
-        pfsize = (curl_off_t) bp->len * MAX_CONV_EXPANSION;
-
-        if(pfsize > SIZE_MAX)
-          pfsize = SIZE_MAX;
-
-        cp = malloc(pfsize);
-
-        if(!cp) {
-          result = CURLE_OUT_OF_MEMORY;
-          break;
-        }
-
-        pfsize = convert(cp, pfsize, ASCII_CCSID, bp->data, bp->len, ccsid);
-
-        if(pfsize < 0) {
-          result = CURLE_OUT_OF_MEMORY;
-          break;
-        }
-
-        blob.data = cp;
-        blob.len = pfsize;
-        blob.flags = bp->flags | CURL_BLOB_COPY;
-        bp = &blob;
-      }
-      result = curl_easy_setopt(easy, tag, &blob);
-      break;
-    }
-    /* FALLTHROUGH */
-  case CURLOPT_ERRORBUFFER:                     /* This is an output buffer. */
-    result = Curl_vsetopt(easy, tag, arg);
-    break;
-  }
-
-  va_end(arg);
-  free(cp);
-  return result;
-}
-
-
-/* ILE/RPG helper functions. */
-
-char *
-curl_form_long_value(long value)
-{
-  /* ILE/RPG cannot cast an integer to a pointer. This procedure does it. */
-
-  return (char *) value;
-}
-
-
-CURLcode
-curl_easy_setopt_RPGnum_(CURL *easy, CURLoption tag, curl_off_t arg)
-{
-  /* ILE/RPG procedure overloading cannot discriminate between different
-     size and/or signedness of format arguments. This provides a generic
-     wrapper that adapts size to the given tag expectation.
-     This procedure is not intended to be explicitly called from user code. */
-  if(tag / 10000 != CURLOPTTYPE_OFF_T)
-    return curl_easy_setopt(easy, tag, (long) arg);
-  return curl_easy_setopt(easy, tag, arg);
-}
-
-
-CURLcode
-curl_multi_setopt_RPGnum_(CURLM *multi, CURLMoption tag, curl_off_t arg)
-{
-  /* Likewise, for multi handle. */
-  if(tag / 10000 != CURLOPTTYPE_OFF_T)
-    return curl_multi_setopt(multi, tag, (long) arg);
-  return curl_multi_setopt(multi, tag, arg);
-}
-
-
-char *
-curl_pushheader_bynum_cssid(struct curl_pushheaders *h,
-                            size_t num, unsigned int ccsid)
-{
-  char *d = (char *) NULL;
-  char *s = curl_pushheader_bynum(h, num);
-
-  if(s)
-    d = dynconvert(ccsid, s, -1, ASCII_CCSID);
-
-  return d;
-}
-
-
-char *
-curl_pushheader_byname_ccsid(struct curl_pushheaders *h, const char *header,
-                             unsigned int ccsidin, unsigned int ccsidout)
-{
-  char *d = (char *) NULL;
-
-  if(header) {
-    header = dynconvert(ASCII_CCSID, header, -1, ccsidin);
-
-    if(header) {
-      char *s = curl_pushheader_byname(h, header);
-      free((char *) header);
-
-      if(s)
-        d = dynconvert(ccsidout, s, -1, ASCII_CCSID);
-    }
-  }
-
-  return d;
-}
-
-static CURLcode
-mime_string_call(curl_mimepart *part, const char *string, unsigned int ccsid,
-                 CURLcode (*mimefunc)(curl_mimepart *part, const char *string))
-{
-  char *s = (char *) NULL;
-  CURLcode result;
-
-  if(!string)
-    return mimefunc(part, string);
-  s = dynconvert(ASCII_CCSID, string, -1, ccsid);
-  if(!s)
-    return CURLE_OUT_OF_MEMORY;
-
-  result = mimefunc(part, s);
-  free(s);
-  return result;
-}
-
-CURLcode
-curl_mime_name_ccsid(curl_mimepart *part, const char *name, unsigned int ccsid)
-{
-  return mime_string_call(part, name, ccsid, curl_mime_name);
-}
-
-CURLcode
-curl_mime_filename_ccsid(curl_mimepart *part,
-                         const char *filename, unsigned int ccsid)
-{
-  return mime_string_call(part, filename, ccsid, curl_mime_filename);
-}
-
-CURLcode
-curl_mime_type_ccsid(curl_mimepart *part,
-                     const char *mimetype, unsigned int ccsid)
-{
-  return mime_string_call(part, mimetype, ccsid, curl_mime_type);
-}
-
-CURLcode
-curl_mime_encoder_ccsid(curl_mimepart *part,
-                       const char *encoding, unsigned int ccsid)
-{
-  return mime_string_call(part, encoding, ccsid, curl_mime_encoder);
-}
-
-CURLcode
-curl_mime_filedata_ccsid(curl_mimepart *part,
-                         const char *filename, unsigned int ccsid)
-{
-  return mime_string_call(part, filename, ccsid, curl_mime_filedata);
-}
-
-CURLcode
-curl_mime_data_ccsid(curl_mimepart *part,
-                     const char *data, size_t datasize, unsigned int ccsid)
-{
-  char *s = (char *) NULL;
-  CURLcode result;
-
-  if(!data)
-    return curl_mime_data(part, data, datasize);
-  s = dynconvert(ASCII_CCSID, data, datasize, ccsid);
-  if(!s)
-    return CURLE_OUT_OF_MEMORY;
-
-  result = curl_mime_data(part, s, datasize);
-  free(s);
-  return result;
-}
-
-CURLUcode
-curl_url_get_ccsid(CURLU *handle, CURLUPart what, char **part,
-                   unsigned int flags, unsigned int ccsid)
-{
-  char *s = (char *)NULL;
-  CURLUcode result;
-
-  if(!part)
-    return CURLUE_BAD_PARTPOINTER;
-
-  *part = (char *)NULL;
-  result = curl_url_get(handle, what, &s, flags);
-  if(result == CURLUE_OK) {
-    if(s) {
-      *part = dynconvert(ccsid, s, -1, ASCII_CCSID);
-      if(!*part)
-        result = CURLUE_OUT_OF_MEMORY;
-    }
-  }
-  if(s)
-    free(s);
-  return result;
-}
-
-CURLUcode
-curl_url_set_ccsid(CURLU *handle, CURLUPart what, const char *part,
-                   unsigned int flags, unsigned int ccsid)
-{
-  char *s = (char *)NULL;
-  CURLUcode result;
-
-  if(part) {
-    s = dynconvert(ASCII_CCSID, part, -1, ccsid);
-    if(!s)
-      return CURLUE_OUT_OF_MEMORY;
-  }
-  result = curl_url_set(handle, what, s, flags);
-  if(s)
-    free(s);
-  return result;
-}
-
-const struct curl_easyoption *
-curl_easy_option_by_name_ccsid(const char *name, unsigned int ccsid)
-{
-  const struct curl_easyoption *option = NULL;
-
-  if(name) {
-    char *s = dynconvert(ASCII_CCSID, name, -1, ccsid);
-
-    if(s) {
-      option = curl_easy_option_by_name(s);
-      free(s);
-    }
-  }
-
-  return option;
-}
-
-/* Return option name in the given ccsid. */
-const char *
-curl_easy_option_get_name_ccsid(const struct curl_easyoption *option,
-                                unsigned int ccsid)
-{
-  char *name = NULL;
-
-  if(option && option->name)
-    name = dynconvert(ccsid, option->name, -1, ASCII_CCSID);
-
-  return (const char *) name;
-}
-
-/* Header API CCSID support. */
-CURLHcode
-curl_easy_header_ccsid(CURL *easy, const char *name, size_t index,
-                       unsigned int origin, int request,
-                       struct curl_header **hout, unsigned int ccsid)
-{
-  CURLHcode result = CURLHE_BAD_ARGUMENT;
-
-  if(name) {
-    char *s = dynconvert(ASCII_CCSID, name, -1, ccsid);
-
-    result = CURLHE_OUT_OF_MEMORY;
-    if(s) {
-      result = curl_easy_header(easy, s, index, origin, request, hout);
-      free(s);
-    }
-  }
-
-  return result;
-}
diff --git a/third-party/curl/packages/OS400/make-lib.sh b/third-party/curl/packages/OS400/make-lib.sh
deleted file mode 100644
index 860cb5d76d..0000000000
--- a/third-party/curl/packages/OS400/make-lib.sh
+++ /dev/null
@@ -1,183 +0,0 @@
-#!/bin/sh
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-#
-#       libcurl compilation script for the OS/400.
-#
-
-SCRIPTDIR=`dirname "${0}"`
-. "${SCRIPTDIR}/initscript.sh"
-cd "${TOPDIR}/lib"
-
-#       Need to have IFS access to the mih/cipher header file.
-
-if action_needed cipher.mih '/QSYS.LIB/QSYSINC.LIB/MIH.FILE/CIPHER.MBR'
-then    rm -f cipher.mih
-        ln -s '/QSYS.LIB/QSYSINC.LIB/MIH.FILE/CIPHER.MBR' cipher.mih
-fi
-
-
-#      Create and compile the identification source file.
-
-echo '#pragma comment(user, "libcurl version '"${LIBCURL_VERSION}"'")' > os400.c
-echo '#pragma comment(user, __DATE__)' >> os400.c
-echo '#pragma comment(user, __TIME__)' >> os400.c
-echo '#pragma comment(copyright, "Copyright (C) Daniel Stenberg et al. OS/400 version by P. Monnerat")' >> os400.c
-make_module     OS400           os400.c         BUILDING_LIBCURL
-LINK=                           # No need to rebuild service program yet.
-MODULES=
-
-
-#       Get source list (CSOURCES variable).
-
-get_make_vars Makefile.inc
-
-
-#       Compile the sources into modules.
-
-INCLUDES="'`pwd`'"
-
-make_module     OS400SYS        "${SCRIPTDIR}/os400sys.c"       BUILDING_LIBCURL
-make_module     CCSIDCURL       "${SCRIPTDIR}/ccsidcurl.c"      BUILDING_LIBCURL
-
-for SRC in ${CSOURCES}
-do      MODULE=`db2_name "${SRC}"`
-        make_module "${MODULE}" "${SRC}" BUILDING_LIBCURL
-done
-
-
-#       If needed, (re)create the static binding directory.
-
-if action_needed "${LIBIFSNAME}/${STATBNDDIR}.BNDDIR"
-then    LINK=YES
-fi
-
-if [ "${LINK}" ]
-then    rm -rf "${LIBIFSNAME}/${STATBNDDIR}.BNDDIR"
-        CMD="CRTBNDDIR BNDDIR(${TARGETLIB}/${STATBNDDIR})"
-        CMD="${CMD} TEXT('LibCurl API static binding directory')"
-        CLcommand "${CMD}"
-
-        for MODULE in ${MODULES}
-        do      CMD="ADDBNDDIRE BNDDIR(${TARGETLIB}/${STATBNDDIR})"
-                CMD="${CMD} OBJ((${TARGETLIB}/${MODULE} *MODULE))"
-                CLcommand "${CMD}"
-        done
-fi
-
-
-#       The exportation file for service program creation must be in a DB2
-#               source file, so make sure it exists.
-
-if action_needed "${LIBIFSNAME}/TOOLS.FILE"
-then    CMD="CRTSRCPF FILE(${TARGETLIB}/TOOLS) RCDLEN(112)"
-        CMD="${CMD} TEXT('curl: build tools')"
-        CLcommand "${CMD}"
-fi
-
-
-#       Gather the list of symbols to export.
-#       First use awk to pull all CURL_EXTERN function prototypes from
-#       the header files, pass through to sed to strip CURL_DEPRECATED(..)
-#       and CURL_TEMP_PRINTF(..) then back to awk to pull the string
-#       immediately to the left of a bracket stripping any spaces or *'s.
-
-EXPORTS=`awk '/^CURL_EXTERN/,/;/'                                       \
-              "${TOPDIR}"/include/curl/*.h                              \
-              "${SCRIPTDIR}/ccsidcurl.h"                                |
-         sed 's/ CURL_DEPRECATED(.*)//g;s/ CURL_TEMP_PRINTF(.*)//g'     |
-         awk '{br=index($0,"(");                                        \
-              if (br) {                                                 \
-                for(c=br-1; ;c--) {                                     \
-                  if (c==1) {                                           \
-                    print substr($0,c,br-1); break                      \
-                  } else if (match(substr($0, c, br-c), "[ *]") != 0) { \
-                    print substr($0, c+1, br-c-1); break                \
-                  }                                                     \
-                }                                                       \
-              }                                                         \
-        }'`
-
-#       Create the service program exportation file in DB2 member if needed.
-
-BSF="${LIBIFSNAME}/TOOLS.FILE/BNDSRC.MBR"
-
-if action_needed "${BSF}" Makefile.am
-then    LINK=YES
-fi
-
-if [ "${LINK}" ]
-then    echo " STRPGMEXP PGMLVL(*CURRENT) SIGNATURE('LIBCURL_${SONAME}')" \
-            > "${BSF}"
-        for EXPORT in ${EXPORTS}
-        do      echo ' EXPORT    SYMBOL("'"${EXPORT}"'")' >> "${BSF}"
-        done
-
-        echo ' ENDPGMEXP' >> "${BSF}"
-fi
-
-
-#       Build the service program if needed.
-
-if action_needed "${LIBIFSNAME}/${SRVPGM}.SRVPGM"
-then    LINK=YES
-fi
-
-if [ "${LINK}" ]
-then    CMD="CRTSRVPGM SRVPGM(${TARGETLIB}/${SRVPGM})"
-        CMD="${CMD} SRCFILE(${TARGETLIB}/TOOLS) SRCMBR(BNDSRC)"
-        CMD="${CMD} MODULE(${TARGETLIB}/OS400)"
-        CMD="${CMD} BNDDIR(${TARGETLIB}/${STATBNDDIR}"
-        if [ "${WITH_ZLIB}" != 0 ]
-        then    CMD="${CMD} ${ZLIB_LIB}/${ZLIB_BNDDIR}"
-                liblist -a "${ZLIB_LIB}"
-        fi
-        if [ "${WITH_LIBSSH2}" != 0 ]
-        then    CMD="${CMD} ${LIBSSH2_LIB}/${LIBSSH2_BNDDIR}"
-                liblist -a "${LIBSSH2_LIB}"
-        fi
-        CMD="${CMD})"
-        CMD="${CMD} BNDSRVPGM(QADRTTS QGLDCLNT QGLDBRDR)"
-        CMD="${CMD} TEXT('curl API library')"
-        CMD="${CMD} TGTRLS(${TGTRLS})"
-        CLcommand "${CMD}"
-        LINK=YES
-fi
-
-
-#       If needed, (re)create the dynamic binding directory.
-
-if action_needed "${LIBIFSNAME}/${DYNBNDDIR}.BNDDIR"
-then    LINK=YES
-fi
-
-if [ "${LINK}" ]
-then    rm -rf "${LIBIFSNAME}/${DYNBNDDIR}.BNDDIR"
-        CMD="CRTBNDDIR BNDDIR(${TARGETLIB}/${DYNBNDDIR})"
-        CMD="${CMD} TEXT('LibCurl API dynamic binding directory')"
-        CLcommand "${CMD}"
-        CMD="ADDBNDDIRE BNDDIR(${TARGETLIB}/${DYNBNDDIR})"
-        CMD="${CMD} OBJ((*LIBL/${SRVPGM} *SRVPGM))"
-        CLcommand "${CMD}"
-fi
diff --git a/third-party/curl/packages/OS400/make-src.sh b/third-party/curl/packages/OS400/make-src.sh
deleted file mode 100644
index 931c1f3359..0000000000
--- a/third-party/curl/packages/OS400/make-src.sh
+++ /dev/null
@@ -1,99 +0,0 @@
-#!/bin/sh
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-#
-#       Command line interface tool compilation script for the OS/400.
-
-SCRIPTDIR=`dirname "${0}"`
-. "${SCRIPTDIR}/initscript.sh"
-cd "${TOPDIR}/src"
-
-
-#       Get source lists.
-#       CURL_CFILES are in the current directory.
-#       CURLX_CFILES are in the lib directory and need to be recompiled because
-#               some function names change using macros.
-
-get_make_vars Makefile.inc
-
-
-#       Compile the sources into modules.
-
-LINK=
-MODULES=
-INCLUDES="'${TOPDIR}/lib'"
-
-for SRC in ${CURLX_CFILES}
-do      MODULE=`db2_name "${SRC}"`
-        MODULE=`db2_name "X${MODULE}"`
-        make_module "${MODULE}" "${SRC}"
-done
-
-for SRC in ${CURL_CFILES}
-do      MODULE=`db2_name "${SRC}"`
-        make_module "${MODULE}" "${SRC}"
-done
-
-
-#       Link modules into program.
-
-MODULES="`echo \"${MODULES}\" | sed \"s/[^ ][^ ]*/${TARGETLIB}\/&/g\"`"
-CMD="CRTPGM PGM(${TARGETLIB}/${CURLPGM})"
-CMD="${CMD} ENTMOD(${TARGETLIB}/CURLMAIN)"
-CMD="${CMD} MODULE(${MODULES})"
-CMD="${CMD} BNDSRVPGM(${TARGETLIB}/${SRVPGM} QADRTTS)"
-CMD="${CMD} TGTRLS(${TGTRLS})"
-CLcommand "${CMD}"
-
-
-#       Create the IFS command.
-
-IFSBIN="${IFSDIR}/bin"
-
-if action_needed "${IFSBIN}"
-then    mkdir -p "${IFSBIN}"
-fi
-
-rm -f "${IFSBIN}/curl"
-ln -s "/QSYS.LIB/${TARGETLIB}.LIB/${CURLPGM}.PGM" "${IFSBIN}/curl"
-
-
-#       Create the CL interface program.
-
-if action_needed "${LIBIFSNAME}/CURLCL.PGM" "${SCRIPTDIR}/curlcl.c"
-then    CMD="CRTBNDC PGM(${TARGETLIB}/${CURLCLI})"
-        CMD="${CMD} SRCSTMF('${SCRIPTDIR}/curlcl.c')"
-        CMD="${CMD} DEFINE('CURLPGM=\"${CURLPGM}\"')"
-        CMD="${CMD} TGTCCSID(${TGTCCSID})"
-        CLcommand "${CMD}"
-fi
-
-
-#       Create the CL command.
-
-if action_needed "${LIBIFSNAME}/${CURLCMD}.CMD" "${SCRIPTDIR}/curl.cmd"
-then    CMD="CRTCMD CMD(${TARGETLIB}/${CURLCMD}) PGM(${TARGETLIB}/${CURLCLI})"
-        CMD="${CMD} SRCSTMF('${SCRIPTDIR}/curl.cmd')"
-        CLcommand "${CMD}"
-fi
diff --git a/third-party/curl/packages/OS400/os400sys.c b/third-party/curl/packages/OS400/os400sys.c
deleted file mode 100644
index 510c1c4ec4..0000000000
--- a/third-party/curl/packages/OS400/os400sys.c
+++ /dev/null
@@ -1,1040 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- *
- ***************************************************************************/
-
-/* OS/400 additional support. */
-
-#include <curl/curl.h>
-#include "config-os400.h"  /* Not curl_setup.h: we only need some defines. */
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/un.h>
-
-#include <stdlib.h>
-#include <stddef.h>
-#include <string.h>
-#include <pthread.h>
-#include <netdb.h>
-#include <qadrt.h>
-#include <errno.h>
-
-#ifdef HAVE_LIBZ
-#include <zlib.h>
-#endif
-
-#ifdef HAVE_GSSAPI
-#include <gssapi.h>
-#endif
-
-#ifndef CURL_DISABLE_LDAP
-#include <ldap.h>
-#endif
-
-#include <netinet/in.h>
-#include <arpa/inet.h>
-
-#include "os400sys.h"
-
-/**
-*** QADRT OS/400 ASCII runtime defines only the most used procedures, but a
-*** lot of them are not supported. This module implements ASCII wrappers for
-*** those that are used by libcurl, but not defined by QADRT.
-**/
-
-#pragma convert(0)                              /* Restore EBCDIC. */
-
-#define MIN_BYTE_GAIN   1024    /* Minimum gain when shortening a buffer. */
-
-struct buffer_t {
-  unsigned long size;            /* Buffer size. */
-  char *buf;                     /* Buffer address. */
-};
-
-
-static char *buffer_undef(localkey_t key, long size);
-static char *buffer_threaded(localkey_t key, long size);
-static char *buffer_unthreaded(localkey_t key, long size);
-
-static pthread_mutex_t  mutex = PTHREAD_MUTEX_INITIALIZER;
-static pthread_key_t    thdkey;
-static struct buffer_t *locbufs;
-
-char *(*Curl_thread_buffer)(localkey_t key, long size) = buffer_undef;
-
-static void thdbufdestroy(void *private)
-{
-  if(private) {
-    struct buffer_t *p = (struct buffer_t *) private;
-    localkey_t i;
-
-    for(i = (localkey_t) 0; i < LK_LAST; i++) {
-      free(p->buf);
-      p++;
-    }
-
-    free(private);
-  }
-}
-
-
-static void
-terminate(void)
-{
-  if(Curl_thread_buffer == buffer_threaded) {
-    locbufs = pthread_getspecific(thdkey);
-    pthread_setspecific(thdkey, (void *) NULL);
-    pthread_key_delete(thdkey);
-  }
-
-  if(Curl_thread_buffer != buffer_undef) {
-    thdbufdestroy((void *) locbufs);
-    locbufs = (struct buffer_t *) NULL;
-  }
-
-  Curl_thread_buffer = buffer_undef;
-}
-
-
-static char *
-get_buffer(struct buffer_t *buf, long size)
-{
-  char *cp;
-
-  /* If `size' >= 0, make sure buffer at `buf' is at least `size'-byte long.
-     Return the buffer address. */
-
-  if(size < 0)
-    return buf->buf;
-
-  if(!buf->buf) {
-    buf->buf = malloc(size);
-    if(buf->buf)
-      buf->size = size;
-
-    return buf->buf;
-  }
-
-  if((unsigned long) size <= buf->size) {
-    /* Shorten the buffer only if it frees a significant byte count. This
-       avoids some realloc() overhead. */
-
-    if(buf->size - size < MIN_BYTE_GAIN)
-      return buf->buf;
-  }
-
-  /* Resize the buffer. */
-
-  cp = realloc(buf->buf, size);
-  if(cp) {
-    buf->buf = cp;
-    buf->size = size;
-  }
-  else if(size <= buf->size)
-    cp = buf->buf;
-
-  return cp;
-}
-
-
-static char *
-buffer_unthreaded(localkey_t key, long size)
-{
-  return get_buffer(locbufs + key, size);
-}
-
-
-static char *
-buffer_threaded(localkey_t key, long size)
-{
-  struct buffer_t *bufs;
-
-  /* Get the buffer for the given local key in the current thread, and
-     make sure it is at least `size'-byte long. Set `size' to < 0 to get
-     its address only. */
-
-  bufs = (struct buffer_t *) pthread_getspecific(thdkey);
-
-  if(!bufs) {
-    if(size < 0)
-      return (char *) NULL;             /* No buffer yet. */
-
-    /* Allocate buffer descriptors for the current thread. */
-
-    bufs = calloc((size_t) LK_LAST, sizeof(*bufs));
-    if(!bufs)
-      return (char *) NULL;
-
-    if(pthread_setspecific(thdkey, (void *) bufs)) {
-      free(bufs);
-      return (char *) NULL;
-    }
-  }
-
-  return get_buffer(bufs + key, size);
-}
-
-
-static char *
-buffer_undef(localkey_t key, long size)
-{
-  /* Define the buffer system, get the buffer for the given local key in
-     the current thread, and make sure it is at least `size'-byte long.
-     Set `size' to < 0 to get its address only. */
-
-  pthread_mutex_lock(&mutex);
-
-  /* Determine if we can use pthread-specific data. */
-
-  if(Curl_thread_buffer == buffer_undef) {      /* If unchanged during lock. */
-    if(!pthread_key_create(&thdkey, thdbufdestroy))
-      Curl_thread_buffer = buffer_threaded;
-    else {
-      locbufs = calloc((size_t) LK_LAST, sizeof(*locbufs));
-      if(!locbufs) {
-        pthread_mutex_unlock(&mutex);
-        return (char *) NULL;
-      }
-      else
-        Curl_thread_buffer = buffer_unthreaded;
-    }
-
-    atexit(terminate);
-  }
-
-  pthread_mutex_unlock(&mutex);
-  return Curl_thread_buffer(key, size);
-}
-
-
-static char *
-set_thread_string(localkey_t key, const char *s)
-{
-  int i;
-  char *cp;
-
-  if(!s)
-    return (char *) NULL;
-
-  i = strlen(s) + 1;
-  cp = Curl_thread_buffer(key, MAX_CONV_EXPANSION * i + 1);
-
-  if(cp) {
-    i = QadrtConvertE2A(cp, s, MAX_CONV_EXPANSION * i, i);
-    cp[i] = '\0';
-  }
-
-  return cp;
-}
-
-
-int
-Curl_getnameinfo_a(const struct sockaddr *sa, socklen_t salen,
-                   char *nodename, socklen_t nodenamelen,
-                   char *servname, socklen_t servnamelen,
-                   int flags)
-{
-  char *enodename = NULL;
-  char *eservname = NULL;
-  int status;
-
-  if(nodename && nodenamelen) {
-    enodename = malloc(nodenamelen);
-    if(!enodename)
-      return EAI_MEMORY;
-  }
-
-  if(servname && servnamelen) {
-    eservname = malloc(servnamelen);
-    if(!eservname) {
-      free(enodename);
-      return EAI_MEMORY;
-    }
-  }
-
-  status = getnameinfo(sa, salen, enodename, nodenamelen,
-                       eservname, servnamelen, flags);
-
-  if(!status) {
-    int i;
-    if(enodename) {
-      i = QadrtConvertE2A(nodename, enodename,
-                          nodenamelen - 1, strlen(enodename));
-      nodename[i] = '\0';
-    }
-
-    if(eservname) {
-      i = QadrtConvertE2A(servname, eservname,
-                          servnamelen - 1, strlen(eservname));
-      servname[i] = '\0';
-    }
-  }
-
-  free(enodename);
-  free(eservname);
-  return status;
-}
-
-int
-Curl_getaddrinfo_a(const char *nodename, const char *servname,
-                   const struct addrinfo *hints,
-                   struct addrinfo **res)
-{
-  char *enodename;
-  char *eservname;
-  int status;
-  int i;
-
-  enodename = (char *) NULL;
-  eservname = (char *) NULL;
-
-  if(nodename) {
-    i = strlen(nodename);
-
-    enodename = malloc(i + 1);
-    if(!enodename)
-      return EAI_MEMORY;
-
-    i = QadrtConvertA2E(enodename, nodename, i, i);
-    enodename[i] = '\0';
-  }
-
-  if(servname) {
-    i = strlen(servname);
-
-    eservname = malloc(i + 1);
-    if(!eservname) {
-      free(enodename);
-      return EAI_MEMORY;
-    }
-
-    QadrtConvertA2E(eservname, servname, i, i);
-    eservname[i] = '\0';
-  }
-
-  status = getaddrinfo(enodename, eservname, hints, res);
-  free(enodename);
-  free(eservname);
-  return status;
-}
-
-#ifdef HAVE_GSSAPI
-
-/* ASCII wrappers for the GSSAPI procedures. */
-
-static int
-Curl_gss_convert_in_place(OM_uint32 *minor_status, gss_buffer_t buf)
-{
-  unsigned int i = buf->length;
-
-  /* Convert `buf' in place, from EBCDIC to ASCII.
-     If error, release the buffer and return -1. Else return 0. */
-
-  if(i) {
-    char *t = malloc(i);
-    if(!t) {
-      gss_release_buffer(minor_status, buf);
-
-      if(minor_status)
-        *minor_status = ENOMEM;
-
-      return -1;
-    }
-
-    QadrtConvertE2A(t, buf->value, i, i);
-    memcpy(buf->value, t, i);
-    free(t);
-  }
-
-  return 0;
-}
-
-
-OM_uint32
-Curl_gss_import_name_a(OM_uint32 *minor_status, gss_buffer_t in_name,
-                       gss_OID in_name_type, gss_name_t *out_name)
-{
-  OM_uint32 rc;
-  unsigned int i;
-  gss_buffer_desc in;
-
-  if(!in_name || !in_name->value || !in_name->length)
-    return gss_import_name(minor_status, in_name, in_name_type, out_name);
-
-  memcpy((char *) &in, (char *) in_name, sizeof(in));
-  i = in.length;
-
-  in.value = malloc(i + 1);
-  if(!in.value) {
-    if(minor_status)
-      *minor_status = ENOMEM;
-
-    return GSS_S_FAILURE;
-  }
-
-  QadrtConvertA2E(in.value, in_name->value, i, i);
-  ((char *) in.value)[i] = '\0';
-  rc = gss_import_name(minor_status, &in, in_name_type, out_name);
-  free(in.value);
-  return rc;
-}
-
-OM_uint32
-Curl_gss_display_status_a(OM_uint32 *minor_status, OM_uint32 status_value,
-                          int status_type, gss_OID mech_type,
-                          gss_msg_ctx_t *message_context,
-                          gss_buffer_t status_string)
-{
-  int rc;
-
-  rc = gss_display_status(minor_status, status_value, status_type,
-                          mech_type, message_context, status_string);
-
-  if(rc != GSS_S_COMPLETE || !status_string ||
-     !status_string->length || !status_string->value)
-    return rc;
-
-  /* No way to allocate a buffer here, because it will be released by
-     gss_release_buffer(). The solution is to overwrite the EBCDIC buffer
-     with ASCII to return it. */
-
-  if(Curl_gss_convert_in_place(minor_status, status_string))
-    return GSS_S_FAILURE;
-
-  return rc;
-}
-
-OM_uint32
-Curl_gss_init_sec_context_a(OM_uint32 *minor_status,
-                            gss_cred_id_t cred_handle,
-                            gss_ctx_id_t *context_handle,
-                            gss_name_t target_name, gss_OID mech_type,
-                            gss_flags_t req_flags, OM_uint32 time_req,
-                            gss_channel_bindings_t input_chan_bindings,
-                            gss_buffer_t input_token,
-                            gss_OID *actual_mech_type,
-                            gss_buffer_t output_token, gss_flags_t *ret_flags,
-                            OM_uint32 *time_rec)
-{
-  int rc;
-  gss_buffer_desc in;
-  gss_buffer_t inp;
-
-  in.value = NULL;
-  inp = input_token;
-
-  if(inp) {
-    if(inp->length && inp->value) {
-      unsigned int i = inp->length;
-
-      in.value = malloc(i + 1);
-      if(!in.value) {
-        if(minor_status)
-          *minor_status = ENOMEM;
-
-        return GSS_S_FAILURE;
-      }
-
-      QadrtConvertA2E(in.value, input_token->value, i, i);
-      ((char *) in.value)[i] = '\0';
-      in.length = i;
-      inp = &in;
-    }
-  }
-
-  rc = gss_init_sec_context(minor_status, cred_handle, context_handle,
-                            target_name, mech_type, req_flags, time_req,
-                            input_chan_bindings, inp, actual_mech_type,
-                            output_token, ret_flags, time_rec);
-  free(in.value);
-
-  if(rc != GSS_S_COMPLETE || !output_token ||
-     !output_token->length || !output_token->value)
-    return rc;
-
-  /* No way to allocate a buffer here, because it will be released by
-     gss_release_buffer(). The solution is to overwrite the EBCDIC buffer
-     with ASCII to return it. */
-
-  if(Curl_gss_convert_in_place(minor_status, output_token))
-    return GSS_S_FAILURE;
-
-  return rc;
-}
-
-
-OM_uint32
-Curl_gss_delete_sec_context_a(OM_uint32 *minor_status,
-                              gss_ctx_id_t *context_handle,
-                              gss_buffer_t output_token)
-{
-  OM_uint32 rc;
-
-  rc = gss_delete_sec_context(minor_status, context_handle, output_token);
-
-  if(rc != GSS_S_COMPLETE || !output_token ||
-     !output_token->length || !output_token->value)
-    return rc;
-
-  /* No way to allocate a buffer here, because it will be released by
-     gss_release_buffer(). The solution is to overwrite the EBCDIC buffer
-     with ASCII to return it. */
-
-  if(Curl_gss_convert_in_place(minor_status, output_token))
-    return GSS_S_FAILURE;
-
-  return rc;
-}
-
-#endif /* HAVE_GSSAPI */
-
-#ifndef CURL_DISABLE_LDAP
-
-/* ASCII wrappers for the LDAP procedures. */
-
-void *
-Curl_ldap_init_a(char *host, int port)
-{
-  size_t i;
-  char *ehost;
-  void *result;
-
-  if(!host)
-    return (void *) ldap_init(host, port);
-
-  i = strlen(host);
-
-  ehost = malloc(i + 1);
-  if(!ehost)
-    return (void *) NULL;
-
-  QadrtConvertA2E(ehost, host, i, i);
-  ehost[i] = '\0';
-  result = (void *) ldap_init(ehost, port);
-  free(ehost);
-  return result;
-}
-
-int
-Curl_ldap_simple_bind_s_a(void *ld, char *dn, char *passwd)
-{
-  int i;
-  char *edn;
-  char *epasswd;
-
-  edn = (char *) NULL;
-  epasswd = (char *) NULL;
-
-  if(dn) {
-    i = strlen(dn);
-
-    edn = malloc(i + 1);
-    if(!edn)
-      return LDAP_NO_MEMORY;
-
-    QadrtConvertA2E(edn, dn, i, i);
-    edn[i] = '\0';
-  }
-
-  if(passwd) {
-    i = strlen(passwd);
-
-    epasswd = malloc(i + 1);
-    if(!epasswd) {
-      free(edn);
-      return LDAP_NO_MEMORY;
-    }
-
-    QadrtConvertA2E(epasswd, passwd, i, i);
-    epasswd[i] = '\0';
-  }
-
-  i = ldap_simple_bind_s(ld, edn, epasswd);
-  free(epasswd);
-  free(edn);
-  return i;
-}
-
-int
-Curl_ldap_search_s_a(void *ld, char *base, int scope, char *filter,
-                     char **attrs, int attrsonly, LDAPMessage **res)
-{
-  int i;
-  int j;
-  char *ebase;
-  char *efilter;
-  char **eattrs;
-  int status;
-
-  ebase = (char *) NULL;
-  efilter = (char *) NULL;
-  eattrs = (char **) NULL;
-  status = LDAP_SUCCESS;
-
-  if(base) {
-    i = strlen(base);
-
-    ebase = malloc(i + 1);
-    if(!ebase)
-      status = LDAP_NO_MEMORY;
-    else {
-      QadrtConvertA2E(ebase, base, i, i);
-      ebase[i] = '\0';
-    }
-  }
-
-  if(filter && status == LDAP_SUCCESS) {
-    i = strlen(filter);
-
-    efilter = malloc(i + 1);
-    if(!efilter)
-      status = LDAP_NO_MEMORY;
-    else {
-      QadrtConvertA2E(efilter, filter, i, i);
-      efilter[i] = '\0';
-    }
-  }
-
-  if(attrs && status == LDAP_SUCCESS) {
-    for(i = 0; attrs[i++];)
-      ;
-
-    eattrs = calloc(i, sizeof(*eattrs));
-    if(!eattrs)
-      status = LDAP_NO_MEMORY;
-    else {
-      for(j = 0; attrs[j]; j++) {
-        i = strlen(attrs[j]);
-
-        eattrs[j] = malloc(i + 1);
-        if(!eattrs[j]) {
-          status = LDAP_NO_MEMORY;
-          break;
-        }
-
-        QadrtConvertA2E(eattrs[j], attrs[j], i, i);
-        eattrs[j][i] = '\0';
-      }
-    }
-  }
-
-  if(status == LDAP_SUCCESS)
-    status = ldap_search_s(ld, ebase? ebase: "", scope,
-                           efilter? efilter: "(objectclass=*)",
-                           eattrs, attrsonly, res);
-
-  if(eattrs) {
-    for(j = 0; eattrs[j]; j++)
-      free(eattrs[j]);
-
-    free(eattrs);
-  }
-
-  free(efilter);
-  free(ebase);
-  return status;
-}
-
-
-struct berval **
-Curl_ldap_get_values_len_a(void *ld, LDAPMessage *entry, const char *attr)
-{
-  char *cp;
-  struct berval **result;
-
-  cp = (char *) NULL;
-
-  if(attr) {
-    int i = strlen(attr);
-
-    cp = malloc(i + 1);
-    if(!cp) {
-      ldap_set_lderrno(ld, LDAP_NO_MEMORY, NULL,
-                       ldap_err2string(LDAP_NO_MEMORY));
-      return (struct berval **) NULL;
-    }
-
-    QadrtConvertA2E(cp, attr, i, i);
-    cp[i] = '\0';
-  }
-
-  result = ldap_get_values_len(ld, entry, cp);
-  free(cp);
-
-  /* Result data are binary in nature, so they haven't been
-     converted to EBCDIC. Therefore do not convert. */
-
-  return result;
-}
-
-char *
-Curl_ldap_err2string_a(int error)
-{
-  return set_thread_string(LK_LDAP_ERROR, ldap_err2string(error));
-}
-
-char *
-Curl_ldap_get_dn_a(void *ld, LDAPMessage *entry)
-{
-  int i;
-  char *cp;
-  char *cp2;
-
-  cp = ldap_get_dn(ld, entry);
-
-  if(!cp)
-    return cp;
-
-  i = strlen(cp);
-
-  cp2 = malloc(i + 1);
-  if(!cp2)
-    return cp2;
-
-  QadrtConvertE2A(cp2, cp, i, i);
-  cp2[i] = '\0';
-
-  /* No way to allocate a buffer here, because it will be released by
-     ldap_memfree() and ldap_memalloc() does not exist. The solution is to
-     overwrite the EBCDIC buffer with ASCII to return it. */
-
-  strcpy(cp, cp2);
-  free(cp2);
-  return cp;
-}
-
-char *
-Curl_ldap_first_attribute_a(void *ld,
-                            LDAPMessage *entry, BerElement **berptr)
-{
-  int i;
-  char *cp;
-  char *cp2;
-
-  cp = ldap_first_attribute(ld, entry, berptr);
-
-  if(!cp)
-    return cp;
-
-  i = strlen(cp);
-
-  cp2 = malloc(i + 1);
-  if(!cp2)
-    return cp2;
-
-  QadrtConvertE2A(cp2, cp, i, i);
-  cp2[i] = '\0';
-
-  /* No way to allocate a buffer here, because it will be released by
-     ldap_memfree() and ldap_memalloc() does not exist. The solution is to
-     overwrite the EBCDIC buffer with ASCII to return it. */
-
-  strcpy(cp, cp2);
-  free(cp2);
-  return cp;
-}
-
-char *
-Curl_ldap_next_attribute_a(void *ld,
-                           LDAPMessage *entry, BerElement *berptr)
-{
-  int i;
-  char *cp;
-  char *cp2;
-
-  cp = ldap_next_attribute(ld, entry, berptr);
-
-  if(!cp)
-    return cp;
-
-  i = strlen(cp);
-
-  cp2 = malloc(i + 1);
-  if(!cp2)
-    return cp2;
-
-  QadrtConvertE2A(cp2, cp, i, i);
-  cp2[i] = '\0';
-
-  /* No way to allocate a buffer here, because it will be released by
-     ldap_memfree() and ldap_memalloc() does not exist. The solution is to
-     overwrite the EBCDIC buffer with ASCII to return it. */
-
-  strcpy(cp, cp2);
-  free(cp2);
-  return cp;
-}
-
-#endif /* CURL_DISABLE_LDAP */
-
-static int
-sockaddr2ebcdic(struct sockaddr_storage *dstaddr,
-                const struct sockaddr *srcaddr, int srclen)
-{
-  const struct sockaddr_un *srcu;
-  struct sockaddr_un *dstu;
-  unsigned int i;
-  unsigned int dstsize;
-
-  /* Convert a socket address to job CCSID, if needed. */
-
-  if(!srcaddr || srclen < offsetof(struct sockaddr, sa_family) +
-     sizeof(srcaddr->sa_family) || srclen > sizeof(*dstaddr)) {
-    errno = EINVAL;
-    return -1;
-  }
-
-  memcpy((char *) dstaddr, (char *) srcaddr, srclen);
-
-  switch(srcaddr->sa_family) {
-
-  case AF_UNIX:
-    srcu = (const struct sockaddr_un *) srcaddr;
-    dstu = (struct sockaddr_un *) dstaddr;
-    dstsize = sizeof(*dstaddr) - offsetof(struct sockaddr_un, sun_path);
-    srclen -= offsetof(struct sockaddr_un, sun_path);
-    i = QadrtConvertA2E(dstu->sun_path, srcu->sun_path, dstsize - 1, srclen);
-    dstu->sun_path[i] = '\0';
-    srclen = i + offsetof(struct sockaddr_un, sun_path);
-  }
-
-  return srclen;
-}
-
-
-static int
-sockaddr2ascii(struct sockaddr *dstaddr, int dstlen,
-               const struct sockaddr_storage *srcaddr, int srclen)
-{
-  const struct sockaddr_un *srcu;
-  struct sockaddr_un *dstu;
-  unsigned int dstsize;
-
-  /* Convert a socket address to ASCII, if needed. */
-
-  if(!srclen)
-    return 0;
-  if(srclen > dstlen)
-    srclen = dstlen;
-  if(!srcaddr || srclen < 0) {
-    errno = EINVAL;
-    return -1;
-  }
-
-  memcpy((char *) dstaddr, (char *) srcaddr, srclen);
-
-  if(srclen >= offsetof(struct sockaddr_storage, ss_family) +
-     sizeof(srcaddr->ss_family)) {
-    switch(srcaddr->ss_family) {
-
-    case AF_UNIX:
-      srcu = (const struct sockaddr_un *) srcaddr;
-      dstu = (struct sockaddr_un *) dstaddr;
-      dstsize = dstlen - offsetof(struct sockaddr_un, sun_path);
-      srclen -= offsetof(struct sockaddr_un, sun_path);
-      if(dstsize > 0 && srclen > 0) {
-        srclen = QadrtConvertE2A(dstu->sun_path, srcu->sun_path,
-                                 dstsize - 1, srclen);
-        dstu->sun_path[srclen] = '\0';
-      }
-      srclen += offsetof(struct sockaddr_un, sun_path);
-    }
-  }
-
-  return srclen;
-}
-
-int
-Curl_os400_connect(int sd, struct sockaddr *destaddr, int addrlen)
-{
-  int i;
-  struct sockaddr_storage laddr;
-
-  i = sockaddr2ebcdic(&laddr, destaddr, addrlen);
-
-  if(i < 0)
-    return -1;
-
-  return connect(sd, (struct sockaddr *) &laddr, i);
-}
-
-int
-Curl_os400_bind(int sd, struct sockaddr *localaddr, int addrlen)
-{
-  int i;
-  struct sockaddr_storage laddr;
-
-  i = sockaddr2ebcdic(&laddr, localaddr, addrlen);
-
-  if(i < 0)
-    return -1;
-
-  return bind(sd, (struct sockaddr *) &laddr, i);
-}
-
-int
-Curl_os400_sendto(int sd, char *buffer, int buflen, int flags,
-                  const struct sockaddr *dstaddr, int addrlen)
-{
-  int i;
-  struct sockaddr_storage laddr;
-
-  i = sockaddr2ebcdic(&laddr, dstaddr, addrlen);
-
-  if(i < 0)
-    return -1;
-
-  return sendto(sd, buffer, buflen, flags, (struct sockaddr *) &laddr, i);
-}
-
-int
-Curl_os400_recvfrom(int sd, char *buffer, int buflen, int flags,
-                    struct sockaddr *fromaddr, int *addrlen)
-{
-  int rcvlen;
-  struct sockaddr_storage laddr;
-  int laddrlen = sizeof(laddr);
-
-  if(!fromaddr || !addrlen || *addrlen <= 0)
-    return recvfrom(sd, buffer, buflen, flags, fromaddr, addrlen);
-
-  laddr.ss_family = AF_UNSPEC;          /* To detect if unused. */
-  rcvlen = recvfrom(sd, buffer, buflen, flags,
-                    (struct sockaddr *) &laddr, &laddrlen);
-
-  if(rcvlen < 0)
-    return rcvlen;
-
-  if(laddr.ss_family == AF_UNSPEC)
-    laddrlen = 0;
-  else {
-    laddrlen = sockaddr2ascii(fromaddr, *addrlen, &laddr, laddrlen);
-    if(laddrlen < 0)
-      return laddrlen;
-  }
-  *addrlen = laddrlen;
-  return rcvlen;
-}
-
-int
-Curl_os400_getpeername(int sd, struct sockaddr *addr, int *addrlen)
-{
-  struct sockaddr_storage laddr;
-  int laddrlen = sizeof(laddr);
-  int retcode = getpeername(sd, (struct sockaddr *) &laddr, &laddrlen);
-
-  if(!retcode) {
-    laddrlen = sockaddr2ascii(addr, *addrlen, &laddr, laddrlen);
-    if(laddrlen < 0)
-      return laddrlen;
-    *addrlen = laddrlen;
-  }
-
-  return retcode;
-}
-
-int
-Curl_os400_getsockname(int sd, struct sockaddr *addr, int *addrlen)
-{
-  struct sockaddr_storage laddr;
-  int laddrlen = sizeof(laddr);
-  int retcode = getsockname(sd, (struct sockaddr *) &laddr, &laddrlen);
-
-  if(!retcode) {
-    laddrlen = sockaddr2ascii(addr, *addrlen, &laddr, laddrlen);
-    if(laddrlen < 0)
-      return laddrlen;
-    *addrlen = laddrlen;
-  }
-
-  return retcode;
-}
-
-
-#ifdef HAVE_LIBZ
-const char *
-Curl_os400_zlibVersion(void)
-{
-  return set_thread_string(LK_ZLIB_VERSION, zlibVersion());
-}
-
-
-int
-Curl_os400_inflateInit_(z_streamp strm, const char *version, int stream_size)
-{
-  z_const char *msgb4 = strm->msg;
-  int ret;
-
-  ret = inflateInit(strm);
-
-  if(strm->msg != msgb4)
-    strm->msg = set_thread_string(LK_ZLIB_MSG, strm->msg);
-
-  return ret;
-}
-
-int
-Curl_os400_inflateInit2_(z_streamp strm, int windowBits,
-                         const char *version, int stream_size)
-{
-  z_const char *msgb4 = strm->msg;
-  int ret;
-
-  ret = inflateInit2(strm, windowBits);
-
-  if(strm->msg != msgb4)
-    strm->msg = set_thread_string(LK_ZLIB_MSG, strm->msg);
-
-  return ret;
-}
-
-int
-Curl_os400_inflate(z_streamp strm, int flush)
-{
-  z_const char *msgb4 = strm->msg;
-  int ret;
-
-  ret = inflate(strm, flush);
-
-  if(strm->msg != msgb4)
-    strm->msg = set_thread_string(LK_ZLIB_MSG, strm->msg);
-
-  return ret;
-}
-
-int
-Curl_os400_inflateEnd(z_streamp strm)
-{
-  z_const char *msgb4 = strm->msg;
-  int ret;
-
-  ret = inflateEnd(strm);
-
-  if(strm->msg != msgb4)
-    strm->msg = set_thread_string(LK_ZLIB_MSG, strm->msg);
-
-  return ret;
-}
-
-#endif
diff --git a/third-party/curl/packages/OS400/os400sys.h b/third-party/curl/packages/OS400/os400sys.h
deleted file mode 100644
index d5ff412f28..0000000000
--- a/third-party/curl/packages/OS400/os400sys.h
+++ /dev/null
@@ -1,57 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- *
- ***************************************************************************/
-
-/* OS/400 additional definitions. */
-
-#ifndef __OS400_SYS_
-#define __OS400_SYS_
-
-
-/* Per-thread item identifiers. */
-
-typedef enum {
-        LK_GSK_ERROR,
-        LK_LDAP_ERROR,
-        LK_CURL_VERSION,
-        LK_VERSION_INFO,
-        LK_VERSION_INFO_DATA,
-        LK_EASY_STRERROR,
-        LK_SHARE_STRERROR,
-        LK_MULTI_STRERROR,
-        LK_URL_STRERROR,
-        LK_ZLIB_VERSION,
-        LK_ZLIB_MSG,
-        LK_LAST
-}               localkey_t;
-
-
-extern char *   (* Curl_thread_buffer)(localkey_t key, long size);
-
-
-/* Maximum string expansion factor due to character code conversion. */
-
-#define MAX_CONV_EXPANSION      4       /* Can deal with UTF-8. */
-
-#endif
diff --git a/third-party/curl/packages/README.md b/third-party/curl/packages/README.md
deleted file mode 100644
index f52f8e477f..0000000000
--- a/third-party/curl/packages/README.md
+++ /dev/null
@@ -1,12 +0,0 @@
-<!--
-Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-
-SPDX-License-Identifier: curl
--->
-
-# Packages
-
- This directory and all its subdirectories are for special package
-information, templates, scripts and docs. The files herein should be of use
-for those of you who want to package curl in a binary or source format for
-these platforms.
diff --git a/third-party/curl/packages/vms/Makefile.am b/third-party/curl/packages/vms/Makefile.am
deleted file mode 100644
index e869a8978c..0000000000
--- a/third-party/curl/packages/vms/Makefile.am
+++ /dev/null
@@ -1,59 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-EXTRA_DIST = \
- backup_gnv_curl_src.com \
- build_curl-config_script.com \
- build_gnv_curl.com \
- build_gnv_curl_pcsi_desc.com \
- build_gnv_curl_pcsi_text.com \
- build_gnv_curl_release_notes.com \
- build_libcurl_pc.com \
- build_vms.com \
- clean_gnv_curl.com \
- compare_curl_source.com \
- config_h.com \
- curl_crtl_init.c \
- curl_gnv_build_steps.txt \
- curl_release_note_start.txt \
- curl_startup.com \
- curlmsg.h \
- curlmsg.msg \
- curlmsg.sdl \
- curlmsg_vms.h \
- generate_config_vms_h_curl.com \
- generate_vax_transfer.com \
- gnv_conftest.c_first \
- gnv_curl_configure.sh \
- gnv_libcurl_symbols.opt \
- gnv_link_curl.com \
- macro32_exactcase.patch \
- make_gnv_curl_install.sh \
- make_pcsi_curl_kit_name.com \
- pcsi_gnv_curl_file_list.txt \
- pcsi_product_gnv_curl.com \
- readme \
- report_openssl_version.c \
- setup_gnv_curl_build.com \
- stage_curl_install.com \
- vms_eco_level.h
diff --git a/third-party/curl/packages/vms/config_h.com b/third-party/curl/packages/vms/config_h.com
deleted file mode 100644
index 6e4e039636..0000000000
--- a/third-party/curl/packages/vms/config_h.com
+++ /dev/null
@@ -1,2004 +0,0 @@
-$! File: config_h.com
-$!
-$! This procedure attempts to figure out how to build a config.h file
-$! for the current project.
-$!
-$! P1 specifies the config.h.in file or equivalent.  If it is not specified
-$! then this procedure will search for several common names of the file.
-$!
-$! The CONFIGURE shell script will be examined for hints and a few symbols
-$! but most of the tests will not produce valid results on OpenVMS.  Some
-$! will produce false positives and some will produce false negatives.
-$!
-$! It is easier to just read the config.h_in file and make up tests based
-$! on what is in it!
-$!
-$! This file will create an empty config_vms.h file if one does not exist.
-$! The config_vms.h is intended for manual edits to handle things that
-$! this procedure can not.
-$!
-$! The config_vms.h will be invoked by the resulting config.h file.
-$!
-$! This procedure knows about the DEC C RTL on the system it is on.
-$! Future versions may be handle the GNV, the OpenVMS porting library,
-$! and others.
-$!
-$! This procedure may not guess the options correctly for all architectures,
-$! and is a work in progress.
-$!
-$! Copyright (C) John Malmberg
-$!
-$! Permission to use, copy, modify, and/or distribute this software for any
-$! purpose with or without fee is hereby granted, provided that the above
-$! copyright notice and this permission notice appear in all copies.
-$!
-$! THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-$! WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-$! MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-$! ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-$! WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-$! ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
-$! OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-$!
-$! SPDX-License-Identifier: ISC
-$!
-$!============================================================================
-$!
-$ss_normal = 1
-$ss_abort = 44
-$ss_control_y = 1556
-$status = ss_normal
-$on control_y then goto control_y
-$on warning then goto general_error
-$!on warning then set ver
-$!
-$! Some information for writing timestamps to created files
-$!----------------------------------------------------------
-$my_proc = f$environment("PROCEDURE")
-$my_proc_file = f$parse(my_proc,,,"NAME") + f$parse(my_proc,,,"TYPE")
-$tab[0,8] = 9
-$datetime = f$element(0,".",f$cvtime(,"ABSOLUTE","DATETIME"))
-$username = f$edit(f$getjpi("","USERNAME"),"TRIM")
-$!
-$pid = f$getjpi("","PID")
-$tfile1 = "SYS$SCRATCH:config_h_temp1_''pid'.TEMP"
-$dchfile = "SYS$SCRATCH:config_h_decc_''pid'.TEMP"
-$starhfile = "SYS$SCRATCH:config_h_starlet_''pid'.TEMP"
-$configure_script = "SYS$SCRATCH:configure_script_''pid'.TEMP"
-$!
-$!  Get the system type
-$!----------------------
-$arch_type = f$getsyi("arch_type")
-$!
-$! Does config_vms.h exist?
-$!-------------------------
-$update_config_vms = 0
-$file = f$search("sys$disk:[]config_vms.h")
-$if file .nes. ""
-$then
-$   write sys$output "Found existing custom file ''file'."
-$else
-$   update_config_vms = 1
-$   write sys$output "Creating new sys$disk:[]config_vms.h for you."
-$   gosub write_config_vms
-$endif
-$!
-$!
-$! On some platforms, DCL search has problems with searching a file
-$! on a NFS mounted volume.  So copy it to sys$scratch:
-$!
-$if f$search(configure_script) .nes. "" then delete 'configure_script';*
-$copy sys$disk:[]configure 'configure_script'
-$!
-$ssl_header_dir = "OPENSSL:"
-$if f$trnlnm("OPENSSL") .eqs. ""
-$then
-$    ssl_header_dir = "SSL$INCLUDE:"
-$endif
-$!
-$!
-$! Write out the header
-$!----------------------
-$gosub write_config_h_header
-$!
-$!
-$!
-$! config.h.in could have at least five different names depending
-$! on how it was transferred to OpenVMS
-$!------------------------------------------------------------------
-$if p1 .nes. ""
-$then
-$   cfile = p1
-$else
-$   cfile = f$search("sys$disk:[]config.h.in")
-$   if cfile .eqs. ""
-$   then
-$	cfile = f$search("sys$disk:[]config.h_in")
-$	if cfile .eqs. ""
-$	then
-$	    cfile = f$search("sys$disk:[]configh.in")
-$	    if cfile .eqs. ""
-$	    then
-$		cfile = f$search("sys$disk:[]config__2eh.in")
-$		if cfile .eqs. ""
-$		then
-$		    cfile = f$search("sys$disk:[]config.h__2ein")
-$		endif
-$	    endif
-$	endif
-$   endif
-$endif
-$if f$trnlnm("PRJ_INCLUDE") .nes. ""
-$then
-$   cfile = f$search("PRJ_INCLUDE:config.h.in")
-$   if cfile .eqs. ""
-$   then
-$	cfile = f$search("PRJ_INCLUDE:config.h_in")
-$	if cfile .eqs. ""
-$	then
-$	    cfile = f$search("PRJ_INCLUDE:config__2eh.in")
-$	    if cfile .eqs. ""
-$	    then
-$		cfile = f$search("PRJ_INCLUDE:config__2eh.in")
-$		if cfile .eqs. ""
-$		then
-$		    cfile = f$search("PRJ_INCLUDE:config.h__2ein")
-$		endif
-$	    endif
-$	endif
-$    endif
-$endif
-$if cfile .eqs. ""
-$then
-$   write sys$output "Can not find sys$disk:config.h.in"
-$   line_out = "Looked for config.h.in, config.h_in, configh.in, "
-$   line_out = line_out + "config__2eh.in, config.h__2ein"
-$   write/symbol sys$output line_out
-$   if f$trnlnm("PRJ_INCLUDE") .nes. ""
-$   then
-$	write sys$output "Also looked in PRJ_INCLUDE: for these files."
-$   endif
-$!
-$   write tf ""
-$   write tf -
-	"   /* Could not find sys$disk:config.h.in                           */"
-$   write tf -
-	"  /*  Looked also for config.h_in, configh.in, config__2eh.in,     */"
-$   write tf -
-	" /*   config.h__2ein						   */"
-$   if f$trnlnm("PRJ_INCLUDE") .nes. ""
-$   then
-$	write tf -
-	" /* Also looked in PRJ_INCLUDE: for these files.		  */"
-$   endif
-$   write tf -
-	"/*--------------------------------------------------------------*/
-$   write tf ""
-$   goto write_tail
-$endif
-$!
-$!
-$! Locate the DECC libraries in use
-$!-----------------------------------
-$decc_rtldef = f$parse("decc$rtldef","sys$library:.tlb;0")
-$decc_starletdef = f$parse("sys$starlet_c","sys$library:.tlb;0")
-$decc_shr = f$parse("decc$shr","sys$share:.exe;0")
-$!
-$! Dump the DECC header names into a file
-$!----------------------------------------
-$if f$search(dchfile) .nes. "" then delete 'dchfile';*
-$if f$search(tfile1) .nes. "" then delete 'tfile1';*
-$define/user sys$output 'tfile1'
-$library/list 'decc_rtldef'
-$open/read/error=rtldef_loop1_end tf1 'tfile1'
-$open/write/error=rtldef_loop1_end tf2 'dchfile'
-$rtldef_loop1:
-$   read/end=rtldef_loop1_end tf1 line_in
-$   line_in = f$edit(line_in,"TRIM,COMPRESS")
-$   key1 = f$element(0," ",line_in)
-$   key2 = f$element(1," ",line_in)
-$   if key1 .eqs. " " .or. key1 .eqs. "" then goto rtldef_loop1
-$   if key2 .nes. " " .and. key2 .nes. "" then goto rtldef_loop1
-$   write tf2 "|",key1,"|"
-$   goto rtldef_loop1
-$rtldef_loop1_end:
-$if f$trnlnm("tf1","lnm$process",,"SUPERVISOR") .nes. "" then close tf1
-$if f$trnlnm("tf2","lnm$process",,"SUPERVISOR") .nes. "" then close tf2
-$if f$search(tfile1) .nes. "" then delete 'tfile1';*
-$!
-$! Dump the STARLET header names into a file
-$!----------------------------------------
-$if f$search(starhfile) .nes. "" then delete 'starhfile';*
-$if f$search(tfile1) .nes. "" then delete 'tfile1';*
-$define/user sys$output 'tfile1'
-$library/list 'decc_starletdef'
-$open/read/error=stardef_loop1_end tf1 'tfile1'
-$open/write/error=stardef_loop1_end tf2 'starhfile'
-$stardef_loop1:
-$   read/end=stardef_loop1_end tf1 line_in
-$   line_in = f$edit(line_in,"TRIM,COMPRESS")
-$   key1 = f$element(0," ",line_in)
-$   key2 = f$element(1," ",line_in)
-$   if key1 .eqs. " " .or. key1 .eqs. "" then goto stardef_loop1
-$   if key2 .nes. " " .and. key2 .nes. "" then goto stardef_loop1
-$   write tf2 "|",key1,"|"
-$   goto stardef_loop1
-$stardef_loop1_end:
-$if f$trnlnm("tf1","lnm$process",,"SUPERVISOR") .nes. "" then close tf1
-$if f$trnlnm("tf2","lnm$process",,"SUPERVISOR") .nes. "" then close tf2
-$if f$search(tfile1) .nes. "" then delete 'tfile1';*
-$!
-$!
-$! Now calculate what should be in the file from reading
-$! config.h.in and CONFIGURE.
-$!---------------------------------------------------------------
-$open/read inf 'cfile'
-$do_comment = 0
-$if_block = 0
-$cfgh_in_loop1:
-$!set nover
-$   read/end=cfgh_in_loop1_end inf line_in
-$   xline = f$edit(line_in,"TRIM,COMPRESS")
-$!
-$!  Blank line handling
-$!---------------------
-$   if xline .eqs. ""
-$   then
-$	write tf ""
-$	goto cfgh_in_loop1
-$   endif
-$   xlen = f$length(xline)
-$   key = f$extract(0,2,xline)
-$!
-$!  deal with comments by copying exactly
-$!-----------------------------------------
-$   if (do_comment .eq. 1) .or. (key .eqs. "/*")
-$   then
-$	do_comment = 1
-$	write tf line_in
-$	key = f$extract(xlen - 2, 2, xline)
-$	if key .eqs. "*/" then do_comment = 0
-$	goto cfgh_in_loop1
-$   endif
-$!
-$!  Some quick parsing
-$!----------------------
-$   keyif = f$extract(0,3,xline)
-$   key1 = f$element(0," ",xline)
-$   key2 = f$element(1," ",xline)
-$   key2a = f$element(0,"_",key2)
-$   key2b = f$element(1,"_",key2)
-$   key2_len = f$length(key2)
-$   key2_h = f$extract(key2_len - 2, 2, key2)
-$   key2_t = f$extract(key2_len - 5, 5, key2)
-$   if key2_t .eqs. "_TYPE" then key2_h = "_T"
-$   key64 = 0
-$   if f$locate("64", xline) .lt. xlen then key64 = 1
-$!
-$!write sys$output "xline = ''xline'"
-$!
-$!  Comment out this section of the ifblock
-$!-----------------------------------------
-$   if if_block .ge. 3
-$   then
-$	write tf "/* ", xline, " */"
-$	if keyif .eqs. "#en" then if_block = 0
-$	goto cfgh_in_loop1
-$   endif
-$!
-$!  Handle the end of an ifblock
-$!-------------------------------
-$   if keyif .eqs. "#en"
-$   then
-$	write tf xline
-$	if_block = 0
-$	goto cfgh_in_loop1
-$   endif
-$!
-$   if key1 .eqs. "#ifndef"
-$   then
-$!	Manual check for _ALL_SOURCE on AIX error
-$!-----------------------------------------------
-$	if key2 .eqs. "_ALL_SOURCE"
-$	then
-$	   write tf "/* ", xline, " */"
-$!
-$!	   Ignore the rest of the block
-$!--------------------------------------
-$	   if_block = 3
-$	   goto cfgh_in_loop1
-$	endif
-$   endif
-$!
-$!
-$!  Default action for an #if/#else/#endif
-$!------------------------------------------
-$   if keyif .eqs. "#if" .or. keyif .eqs. "#el"
-$   then
-$	if_block = 1
-$	write tf xline
-$	goto cfgh_in_loop1
-$   endif
-$!
-$!
-$!  Process "normal?" stuff
-$!---------------------------
-$   if key1 .eqs. "#undef"
-$   then
-$	key2c = f$element(2, "_", key2)
-$	if (key2c .eqs. "_") .or. (key2c .eqs. "H") then key2c = ""
-$	key2d = f$element(3, "_", key2)
-$	if (key2d .eqs. "_") .or. (key2d .eqs. "H") then key2d = ""
-$	key2e = f$element(4, "_", key2)
-$	if (key2e .eqs. "_") .or. (key2e .eqs. "H") then key2e = ""
-$	if key2d .eqs. "T"
-$	then
-$	    if key2e .eqs. "TYPE"
-$	    then
-$		key2_h = "_T"
-$		key2d = ""
-$	    endif
-$	endif
-$!
-$	double_under = 0
-$!
-$!	Process FCNTL directives
-$!-------------------------------------
-$	if (key2b .eqs. "FCNTL") .and. (key2c .eqs. "O") .and. -
-	   (key2d .eqs. "NONBLOCK")
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$!	Process GETADDRINFO directives
-$!-------------------------------------
-$	if key2 .eqs. "GETADDRINFO_THREADSAFE"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$!	Process IOCTL directives
-$!-------------------------------------
-$	if (key2b .eqs. "IOCTL") .and. (key2c .nes. "")
-$	then
-$	    if (key2c .eqs. "FIONBIO") .or. (key2c .eqs. "SIOCGIFADDR")
-$	    then
-$		write tf "#ifndef ''key2'"
-$		write tf "#define ''key2' 1"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	endif
-$!
-$!
-$!	Manual check for LL on
-$!-----------------------------------------------
-$	if key2 .eqs. "LL"
-$	then
-$	   write tf "#ifndef __VAX
-$	   write tf "#define HAVE_''key2' 1"
-$	   write tf "#endif"
-$	   goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "bool_t"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' short"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "bits16_t"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' short"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "u_bits16_t"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' unsigned short"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "bits32_t"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' int"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "u_bits32_t"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' unsigned int"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "intmax_t"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#ifdef __VAX"
-$	    write tf "#define ''key2' long"
-$	    write tf "#else"
-$	    write tf "#define ''key2' long long"
-$	    write tf "#endif"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "uintmax_t"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#ifdef __VAX"
-$	    write tf "#define ''key2' unsigned long"
-$	    write tf "#else"
-$	    write tf "#define ''key2' unsigned long long"
-$	    write tf "#endif"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "socklen_t"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' int"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "GETGROUPS_T"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' gid_t"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_DECL_SYS_SIGLIST"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 0"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_SYS_ERRLIST"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_STRUCT_DIRENT_D_INO"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_STRUCT_TIMEVAL"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$!	! The header files have this information, however
-$!      ! The ioctl() call only works on sockets.
-$!	if key2 .eqs. "FIONREAD_IN_SYS_IOCTL"
-$!	then
-$!	    write tf "#ifndef ''key2'"
-$!	    write tf "#define ''key2' 1"
-$!	    write tf "#endif"
-$!	    goto cfgh_in_loop1
-$!	endif
-$!
-$!	! The header files have this information, however
-$!      ! The ioctl() call only works on sockets.
-$!	if key2 .eqs. "GWINSZ_IN_SYS_IOCTL"
-$!	then
-$!	    write tf "#ifndef ''key2'"
-$!	    write tf "#define ''key2' 1"
-$!	    write tf "#endif"
-$!	    goto cfgh_in_loop1
-$!	endif
-$!
-$!	! The header files have this information, however
-$!      ! The ioctl() call only works on sockets.
-$!	if key2 .eqs. "STRUCT_WINSIZE_IN_SYS_IOCTL"
-$!	then
-$!	    write tf "#ifndef ''key2'"
-$!	    write tf "#define ''key2' 0"
-$!	    write tf "#endif"
-$!	    goto cfgh_in_loop1
-$!	endif
-$!
-$	if key2 .eqs. "HAVE_STRUCT_TM_TM_ZONE"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_TM_ZONE"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_TIMEVAL"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "WEXITSTATUS_OFFSET"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 2"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_GETPW_DECLS"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_DECL_CONFSTR"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_DECL_PRINTF"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_DECL_SBRK"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_DECL_STRSIGNAL"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 0"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2a .eqs. "HAVE_DECL_STRTOLD"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 0"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_DECL_STRTOIMAX"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 0"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_DECL_STRTOL"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_DECL_STRTOLL"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_DECL_STRTOUL"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_DECL_STRTOULL"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_DECL_STRTOUMAX"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 0"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "GETPGRP_VOID"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "NAMED_PIPES_MISSING"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "OPENDIR_NOT_ROBUST"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "PGRP_PIPE"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "CAN_REDEFINE_GETENV"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_PRINTF_A_FORMAT"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "CTYPE_NON_ASCII"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_LANGINFO_CODESET"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 0"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$!      This wants execve() to do this automagically to pass.
-$!	if key2 .eqs. "HAVE_HASH_BANG_EXEC"
-$!	then
-$!	    write tf "#ifndef ''key2'"
-$!	    write tf "#define ''key2' 1"
-$!	    write tf "#endif"
-$!	    goto cfgh_in_loop1
-$!	endif
-$!
-$	if key2 .eqs. "ICONV_CONST"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2'"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "VOID_SIGHANDLER"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_POSIX_SIGNALS"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "UNUSABLE_RT_SIGNALS"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2a .eqs. "HAVE_DECL_FPURGE"
-$	then
-$	    write tf "#ifndef ''key2a'"
-$	    write tf "#define ''key2a' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_DECL_SETREGID"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "HAVE_POSIX_SIGSETJMP"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2b .eqs. "RAND" .and. key2c .nes. "" .and. key2d .eqs. ""
-$	then
-$	    if (key2c .eqs. "EGD") .or. -
-	       (key2c .eqs. "STATUS") .or. -
-	       (key2c .eqs. "SCREEN")
-$	    then
-$		if f$search("''ssl_header_dir'rand.h") .nes. ""
-$		then
-$		    write tf "#ifndef ''key2'"
-$		    write tf "#define ''key2' 1"
-$		    write tf "#endif"
-$		else
-$		    write tf "/* #undef ''key2' */"
-$		endif
-$	    endif
-$	endif
-$!
-$	if key2 .eqs. "STRCOLL_BROKEN"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if key2 .eqs. "DUP_BROKEN"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#define ''key2' 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$!	This is for a test that getcwd(0,0) works.
-$!	It does not on VMS.
-$!--------------------------
-$	if key2 .eqs. "GETCWD_BROKEN"
-$	then
-$	    write sys$output ""
-$	    write sys$output -
-  "%CONFIG_H-I-NONPORT, ''key2' being tested for!"
-$		   write sys$output -
- "-CONFIG_H-I-GETCWD, GETCWD(0,0) does not work on VMS."
-$		   write sys$output -
- "-CONFIG_H-I-GETCWD2, Work around hack probably required."
-$		   write sys$output -
- "-CONFIG_H-I-REVIEW, Manual Code review required!"
-$		    if update_config_vms
-$		    then
-$			open/append tfcv sys$disk:[]config_vms.h
-$			write tfcv ""
-$			write tfcv -
-		"/* Check config.h for use of ''key2' settings */"
-$			write tfcv ""
-$			close tfcv
-$		    endif
-$
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$	if (key2a .eqs. "HAVE") .or. (key2a .eqs. "STAT") .or. -
-	   (key2 .eqs. "ENABLE_IPV6") .or. (key2b .eqs. "LDAP")
-$	then
-$!
-$!	    Process extra underscores
-$!------------------------------------
-$	    if f$locate("HAVE___", key2) .lt. key2_len
-$	    then
-$		key2b = "__" + key2d
-$		key2d = ""
-$		double_under = 1
-$	    else
-$		if f$locate("HAVE__", key2) .lt. key2_len
-$		then
-$		    key2b = "_" + key2c
-$		    key2c = ""
-$		    double_under = 1
-$		endif
-$	    endif
-$!
-$	    if (key2_h .eqs. "_H") .or. (key2 .eqs. "ENABLE_IPV6") .or. -
-	       (key2b .eqs. "LDAP")
-$	    then
-$!
-$!		Looking for a header file
-$!---------------------------------------
-$		headf = key2b
-$		if key2c .nes. "" then headf = headf + "_" + key2c
-$		if key2d .nes. "" then headf = headf + "_" + key2d
-$!
-$!		   (key2b .eqs. "READLINE")
-$!
-$!		Some special parsing
-$!------------------------------------------
-$		if (key2b .eqs. "SYS") .or. (key2b .eqs. "ARPA") .or. -
-		   (key2b .eqs. "NET") .or. (key2b .eqs. "NETINET")
-$		then
-$		    if key2c .nes. ""
-$		    then
-$			headf = key2c
-$			if key2d .nes. "" then headf = key2c + "_" + key2d
-$		    endif
-$		endif
-$!
-$!		And of course what's life with out some special cases
-$!--------------------------------------------------------------------
-$		if key2 .eqs. "ENABLE_IPV6"
-$		then
-$		    headf = "in6"
-$		endif
-$!
-$		if key2b .eqs. "LDAP"
-$		then
-$		    if (key2 .eqs. "HAVE_LDAP_SSL") .or. -
-		       (key2 .eqs. "HAVE_LDAP_URL_PARSE")
-$		    then
-$			headf = "ldap"
-$		    endif
-$		endif
-$!
-$!
-$		if key2b .eqs. "FILE"
-$		then
-$		   write sys$output ""
-$		   write sys$output -
-  "%CONFIG_H-I-NONPORT, ''key2' being asked for!"
-$		   write sys$output -
- "-CONFIG_H-I-FILE_OLD, file.h will not be configured as is obsolete!"
-$		   write sys$output -
- "-CONFIG_H_I-FCNTL_NEW, "Expecting fcntl.h to be configured instead!"
-$		   write sys$output -
- "-CONFIG_H_I-FCNTL_CHK, "Unable to verify at this time!"
-$		   write sys$output -
- "-CONFIG_H-I-REVIEW, Manual Code review required!"
-$!
-$		    if update_config_vms
-$		    then
-$			open/append tfcv sys$disk:[]config_vms.h
-$			write tfcv ""
-$			write tfcv -
-		"/* Check config.h for use of fcntl.h instead of file.h */"
-$			write tfcv ""
-$			close tfcv
-$		    endif
-$		endif
-$!
-$!		Now look it up in the DEC C RTL
-$!---------------------------------------------
-$		define/user sys$output nl:
-$		define/user sys$error nl:
-$		search/output=nl: 'dchfile' |'headf'|/exact
-$		if '$severity' .eq. 1
-$		then
-$		    if key64 then write tf "#ifndef __VAX"
-$		    write tf "#ifndef ''key2'"
-$		    write tf "#define ''key2' 1"
-$if p2 .nes. "" then write sys$output "''dchfile' - #define ''key2' 1"
-$		    write tf "#endif"
-$		    if key64 then write tf "#endif"
-$set nover
-$		    goto cfgh_in_loop1
-$		endif
-$!
-$!
-$!		Now look it up in the DEC C STARLET_C
-$!---------------------------------------------
-$		define/user sys$output nl:
-$		define/user sys$error nl:
-$		search/output=nl: 'starhfile' |'headf'|/exact
-$		if '$severity' .eq. 1
-$		then
-$		    if key64 then write tf "#ifndef __VAX"
-$		    write tf "#ifndef ''key2'"
-$		    write tf "#define ''key2' 1"
-$if p2 .nes. "" then write sys$output "''starfile' - #define ''key2' 1"
-$		    write tf "#endif"
-$		    if key64 then write tf "#endif"
-$set nover
-$		    goto cfgh_in_loop1
-$		endif
-$!
-$!		Now look for OPENSSL headers
-$!---------------------------------------------------------
-$		if key2b .eqs. "OPENSSL"
-$		then
-$		    headf = headf - "OPENSSL_"
-$		    header = f$search("''ssl_header_dir'''headf'.h")
-$		    if header .nes. ""
-$		    then
-$			write tf "#ifndef ''key2'"
-$			write tf "#define ''key2' 1"
-$			write tf "#endif"
-$set nover
-$			goto cfgh_in_loop1
-$		    endif
-$		endif
-$!
-$!		Now look for Kerberos
-$!------------------------------------------------------------
-$		if key2b .eqs. "GSSAPI"
-$		then
-$		    header_dir = "sys$sysroot:[kerberos.include]"
-$		    headf = headf - "GSSAPI_"
-$		    header = f$search("''header_dir'''headf'.h")
-$		    if header .nes. ""
-$		    then
-$			write tf "#ifndef ''key2'"
-$			write tf "#define ''key2' 1"
-$			write tf "#endif"
-$set nover
-$			goto cfgh_in_loop1
-$		    endif
-$		endif
-$!
-$set nover
-$	    else
-$!
-$!		Looking for a routine or a symbol
-$!------------------------------------------------
-$		if key2c .eqs. "MACRO"
-$		then
-$		    if (key2b .eqs. "FILE") .or. (key2b .eqs. "DATE") -
-			.or. (key2b .eqs. "LINE") .or. (key2b .eqs. "TIME")
-$		    then
-$			write tf "#ifndef HAVE_''key2b'"
-$			write tf "#define HAVE_''key2b' 1"
-$			write tf "#endif"
-$		    endif
-$		    goto cfgh_in_loop1
-$		endif
-$!
-$!		Special false tests
-$!-------------------------------------
-$		if double_under
-$		then
-$		    if key2b .eqs. "_FCNTL" .or. key2b .eqs. "__FCNTL"
-$		    then
-$			write tf "/* #undef HAVE_''key2b' */"
-$			goto cfgh_in_loop1
-$		    endif
-$!
-$		    if key2b .eqs. "_STAT" .or. key2b .eqs. "__STAT"
-$		    then
-$			write tf "/* #undef HAVE_''key2b' */"
-$			goto cfgh_in_loop1
-$		    endif
-$!
-$		    if key2b .eqs. "_READ" .or. key2b .eqs. "__READ"
-$		    then
-$			write tf "/* #undef HAVE_''key2b' */"
-$			goto cfgh_in_loop1
-$		    endif
-$		endif
-$!
-$		keysym = key2b
-$		if key2c .nes. "" then keysym = keysym + "_" + key2c
-$		if key2d .nes. "" then keysym = keysym + "_" + key2d
-$		if key2e .nes. "" then keysym = keysym + "_" + key2e
-$!
-$!
-$!		Stat structure members
-$!-------------------------------------
-$		if key2b .eqs. "STRUCT"
-$		then
-$		    if key2c .eqs. "STAT" .and (key2d .nes. "")
-$		    then
-$			key2b = key2b + "_" + key2c + "_" + key2d
-$			key2c = key2e
-$			key2d = ""
-$			key2e = ""
-$		    endif
-$		endif
-$		if (key2b .eqs. "ST") .or. (key2b .eqs. "STRUCT_STAT_ST")
-$		then
-$		    keysym = "ST" + "_" + key2c
-$		    keysym = f$edit(keysym,"LOWERCASE")
-$		endif
-$		if key2a .eqs. "STAT"
-$		then
-$		    if (f$locate("STATVFS", key2b) .eq. 0) .and. key2c .eqs. ""
-$		    then
-$			keysym = f$edit(key2b, "LOWERCASE")
-$		    endif
-$!$		    if (key2b .eqs. "STATVFS" .or. key2b .eqs. "STATFS2" -
-$!			.or. key2b .eqs. "STATFS3") .and. key2c .nes. ""
-$!
-$		    if (key2b .eqs. "STATVFS") .and. key2c .nes. ""
-$		    then
-$!			Should really verify that the structure
-$!			named by key2b actually exists first.
-$!------------------------------------------------------------
-$!
-$!			Statvfs structure members
-$!-------------------------------------------------
-$			keysym = "f_" + f$edit(key2c,"LOWERCASE")
-$		    endif
-$		endif
-$!
-$!		UTMPX structure members
-$!--------------------------------------
-$		if key2b .eqs. "UT" .and. key2c .eqs. "UT"
-$		then
-$		    keysym = "ut_" + f$edit(key2d,"LOWERCASE")
-$		endif
-$!
-$		if f$locate("MMAP",key2) .lt. key2_len
-$		then
-$		   write sys$output ""
-$		   write sys$output -
-  "%CONFIG_H-I-NONPORT, ''key2' being asked for!"
-$		   write sys$output -
- "-CONFIG_H-I-MMAP, MMAP operations only work on STREAM and BINARY files!"
-$		   write sys$output -
- "-CONFIG_H-I-REVIEW, Manual Code review required!"
-$		    if update_config_vms
-$		    then
-$			open/append tfcv sys$disk:[]config_vms.h
-$			write tfcv ""
-$			write tfcv -
-		"/* Check config.h for use of ''key2' settings */"
-$			write tfcv ""
-$			close tfcv
-$		    endif
-$		endif
-$!
-$!
-$		if keysym .eqs. "CRYPT"
-$		then
-$		   write sys$output ""
-$		   write sys$output -
-  "%CONFIG_H-I-NONPORT, ''key2' being asked for!"
-$		   write sys$output -
- "-CONFIG_H-I-CRYPT, CRYPT operations on the VMS SYSUAF may not work!"
-$		   write sys$output -
- "-CONFIG_H-I-REVIEW, Manual Code review required!"
-$		    if update_config_vms
-$		    then
-$			open/append tfcv sys$disk:[]config_vms.h
-$			write tfcv ""
-$			write tfcv -
-		"/* Check config.h for use of ''keysym' */"
-$			write tfcv ""
-$			close tfcv
-$		    endif
-$		endif
-$!
-$!
-$		if keysym .eqs. "EXECL"
-$		then
-$		   write sys$output ""
-$		   write sys$output -
-  "%CONFIG_H-I-NONPORT, ''key2' being asked for!"
-$		   write sys$output -
- "-CONFIG_H-I-EXCEL, EXECL configured, Will probably not work."
-$		   write sys$output -
- "-CONFIG_H-I-REVIEW, Manual Code review required!"
-$		    if update_config_vms
-$		    then
-$			open/append tfcv sys$disk:[]config_vms.h
-$			write tfcv ""
-$			write tfcv -
-		"/* Check config.h for use of ''keysym' */"
-$			write tfcv ""
-$			close tfcv
-$		    endif
-$		endif
-$!
-$!
-$!		Process if cpp supports ANSI-C stringizing '#' operator
-$!-----------------------------------------------------------------------
-$		if keysym .eqs. "STRINGIZE"
-$		then
-$		    write tf "#ifndef HAVE_STRINGIZE"
-$		    write tf "#define HAVE_STRINGSIZE 1"
-$		    write tf "#endif"
-$		    goto cfgh_in_loop1
-$		endif
-$!
-$		if keysym .eqs. "VOLATILE"
-$		then
-$		    write tf "#ifndef HAVE_VOLATILE"
-$		    write tf "#define HAVE_VOLATILE 1"
-$		    write tf "#endif"
-$		    goto cfgh_in_loop1
-$		endif
-$!
-$		if keysym .eqs. "ALLOCA"
-$		then
-$		    write tf "#ifndef HAVE_ALLOCA"
-$		    write tf "#define HAVE_ALLOCA 1"
-$		    write tf "#endif"
-$		    goto cfgh_in_loop1
-$		endif
-$!
-$		if keysym .eqs. "ERRNO_DECL"
-$		then
-$		    write tf "#ifndef HAVE_ERRNO_DECL"
-$		    write tf "#define HAVE_ERRNO_DECL 1"
-$		    write tf "#endif"
-$		    goto cfgh_in_loop1
-$		endif
-$!
-$		if keysym .eqs. "LONGLONG"
-$		then
-$		    write tf "#ifndef __VAX"
-$		    write tf "#pragma message disable longlongtype"
-$		    write tf "#ifndef HAVE_LONGLONG"
-$		    write tf "#define HAVE_LONGLONG 1"
-$		    write tf "#endif"
-$		    write tf "#endif"
-$		    goto cfgh_in_loop1
-$		endif
-$!
-$!		May need to test compiler version
-$!-----------------------------------------------
-$		if keysym .eqs. "LONG_LONG"
-$		then
-$		    write tf "#ifndef __VAX"
-$		    write tf "#pragma message disable longlongtype"
-$		    write tf "#ifndef HAVE_LONG_LONG"
-$		    write tf "#define HAVE_LONG_LONG 1"
-$		    write tf "#endif"
-$		    write tf "#endif"
-$		    goto cfgh_in_loop1
-$		endif
-$!
-$!		May need to test compiler version
-$!-----------------------------------------------
-$		if keysym .eqs. "UNSIGNED_LONG_LONG"
-$		then
-$		    write tf "#ifndef __VAX"
-$		    write tf "#pragma message disable longlongtype"
-$		    write tf "#ifndef HAVE_UNSIGNED_LONG_LONG"
-$		    write tf "#define HAVE_UNSIGNED_LONG_LONG 1"
-$		    write tf "#endif"
-$		    write tf "#endif"
-$		    goto cfgh_in_loop1
-$		endif
-$!
-$!		May need to test compiler version
-$!-----------------------------------------------
-$		if keysym .eqs. "UNSIGNED_LONG_LONG_INT"
-$		then
-$		    write tf "#ifndef __VAX"
-$		    write tf "#pragma message disable longlongtype"
-$		    write tf "#ifndef HAVE_UNSIGNED_LONG_LONG_INT"
-$		    write tf "#define HAVE_UNSIGNED_LONG_LONG_INT 1"
-$		    write tf "#endif"
-$		    write tf "#endif"
-$		    goto cfgh_in_loop1
-$		endif
-$!
-$!		May need to test compiler version
-$!-----------------------------------------------
-$		if keysym .eqs. "LONG_DOUBLE"
-$		then
-$		    write tf "#ifndef __VAX"
-$		    write tf "#pragma message disable longlongtype"
-$		    write tf "#ifndef HAVE_LONG_DOUBLE"
-$		    write tf "#define HAVE_LONG_DOUBLE 1"
-$		    write tf "#endif"
-$		    write tf "#endif"
-$		    goto cfgh_in_loop1
-$		endif
-$!
-$		if keysym .eqs. "FCNTL_LOCK"
-$		then
-$		    write sys$output -
-  "%CONFIG_H-I-NONPORT, ''key2' being asked for!
-$		   write sys$output -
- "-CONFIG_H-I-REVIEW, Manual Code review required!"
-$		    goto cfgh_in_loop1
-$		endif
-$!
-$!
-$!		These libraries are provided by the DEC C RTL
-$!-------------------------------------------------------------
-$		if keysym .eqs. "LIBINET" .or. keysym .eqs. "LIBSOCKET"
-$		then
-$		    write tf "#ifndef HAVE_''keysym'"
-$		    write tf "#define HAVE_''keysym' 1"
-$if p2 .nes. "" then write sys$output "''decc_shr' #define ''keysym' 1"
-$		    write tf "#endif
-$		    goto cfgh_in_loop1
-$		endif
-$!
-$		if keysym .eqs. "HERRNO" then keysym = "h_errno"
-$		if keysym .eqs. "UTIMBUF" then keysym = "utimbuf"
-$		if key2c .eqs. "STRUCT"
-$		then
-$		    keysym = f$edit(key2d,"LOWERCASE")
-$		else
-$		    if key2_h .eqs. "_T"
-$		    then
-$			if key2_t .eqs. "_TYPE"
-$			then
-$			    keysym = f$extract(0, key2_len - 5, key2) - "HAVE_"
-$			endif
-$			keysym = f$edit(keysym,"LOWERCASE")
-$		    endif
-$		endif
-$!
-$!		Check the DEC C RTL shared image first
-$!------------------------------------------------------
-$		if f$search(tfile1) .nes. "" then delete 'tfile1';*
-$		define/user sys$output nl:
-$		define/user sys$error nl:
-$		search/format=nonull/out='tfile1' 'decc_shr' 'keysym'
-$		if '$severity' .eq. 1
-$		then
-$!
-$!		    Not documented, but from observation
-$!------------------------------------------------------
-$		    define/user sys$output nl:
-$		    define/user sys$error nl:
-$		    if arch_type .eq. 3
-$		    then
-$			keyterm = "''keysym'<SOH>"
-$		    else
-$			if arch_type .eq. 2
-$			then
-$			    keyterm = "''keysym'<BS>"
-$			else
-$			    keyterm = "''keysym'<STX>"
-$			endif
-$		    endif
-$		    search/out=nl: 'tfile1' -
-   "$''keyterm'","$g''keyterm'","$__utc_''keyterm'",-
-   "$__utctz_''keyterm'","$__bsd44_''keyterm'","$bsd_''keyterm'",-
-   "$''keysym'decc$","$G''keysym'decc$","$GX''keyterm'"
-$		    severity = '$severity'
-$!
-$!
-$!		    Of course the 64 bit stuff is different
-$!---------------------------------------------------------
-$		    if severity .ne. 1 .and. key64
-$		    then
-$			define/user sys$output nl:
-$		        define/user sys$error nl:
-$			search/out=nl: 'tfile1' "$_''keyterm'"
-$!			search/out 'tfile1' "$_''keyterm'"
-$			severity = '$severity'
-$		    endif
-$!
-$!		    Unix compatibility routines
-$!---------------------------------------------
-$		    if severity .ne. 1
-$		    then
-$			define/user sys$output nl:
-$			define/user sys$error nl:
-$			search/out=nl: 'tfile1' -
-    "$__unix_''keyterm'","$__vms_''keyterm'","$_posix_''keyterm'"
-$			severity = '$severity'
-$		    endif
-$!
-$!		    Show the result of the search
-$!------------------------------------------------
-$		    if 'severity' .eq. 1
-$		    then
-$			if key64 then write tf "#ifndef __VAX"
-$			write tf "#ifndef ''key2'"
-$			write tf "#define ''key2' 1"
-$if p2 .nes. "" then write sys$output "''decc_shr' #define ''key2' 1"
-$			write tf "#endif"
-$			if key64 then write tf "#endif"
-$			goto cfgh_in_loop1
-$		    endif
-$		endif
-$		if f$search(tfile1) .nes. "" then delete 'tfile1';*
-$!
-$!		Check the DECC Header files next
-$!----------------------------------------------
-$		define/user sys$output nl:
-$		define/user sys$error nl:
-$		search/out=nl: 'decc_rtldef' -
-		    "''keysym';", "''keysym'[", "struct ''keysym'"/exact
-$		severity = '$severity'
-$		if severity .eq. 1
-$		then
-$		    if key64 then write tf "#ifndef __VAX"
-$		    write tf "#ifndef ''key2'"
-$		    write tf "#define ''key2' 1"
-$if p2 .nes. "" then write sys$output "''decc_rtldef' #define ''key2' 1"
-$		    write tf "#endif"
-$		    if key64 then write tf "#endif"
-$		    goto cfgh_in_loop1
-$		endif
-$!
-$!		Check kerberos
-$!--------------------------------------------
-$		if f$search("SYS$SYSROOT:[kerberos]include.dir") .nes. ""
-$		then
-$		    test_mit = "SYS$SYSROOT:[kerberos.include]gssapi_krb5.h"
-$		    if (key2 .eqs. "HAVE_GSSAPI")
-$		    then
-$			write tf "#ifndef ''key2'"
-$			write tf "#define ''key2' 1"
-$			write tf "#endif"
-$			goto cfgh_in_loop1
-$		    endif
-$!
-$!		    This is really do we have the newer MIT Kerberos
-$!----------------------------------------------------------------------
-$		    if (key2 .eqs. "HAVE_GSSMIT")
-$		    then
-$			if f$search(test_mit) .nes. ""
-$			then
-$			    write tf "#ifndef ''key2'"
-$			    write tf "#define ''key2' 1"
-$			else
-$			    write tf "#ifdef ''key2'"
-$			    write tf "#undef ''key2'"
-$			endif
-$			write tf "#endif"
-$			goto cfgh_in_loop1
-$		    endif
-$!
-$!		    Older MIT looks like Heimdal
-$!------------------------------------------------
-$		    if (key2 .eqs. "HAVE_HEIMDAL")
-$		    then
-$			if f$search(test_mit) .eqs. ""
-$			then
-$			    write tf "#ifndef ''key2'"
-$			    write tf "#define ''key2' 1"
-$			else
-$			    write tf "#ifdef ''key2'"
-$			    write tf "#undef ''key2'"
-$			endif
-$			write tf "#endif"
-$			goto cfgh_in_loop1
-$		    endif
-$		endif
-$!
-$	    endif
-$	    write tf "/* ", xline, " */"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$!
-$!	Process SIZEOF directives found in SAMBA and others
-$!----------------------------------------------------------
-$	if key2a .eqs. "SIZEOF"
-$	then
-$	    if key2b .eqs. "INO" .and. key2_h .eqs. "_T"
-$	    then
-$		write tf "#ifndef SIZEOF_INO_T"
-$		write tf "#if !__USING_STD_STAT
-$		write tf "#define SIZEOF_INO_T 6"
-$		write tf "#else
-$		write tf "#define SIZEOF_INO_T 8"
-$		write tf "#endif
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2b .eqs. "INTMAX" .and. key2_h .eqs. "_T"
-$	    then
-$		write tf "#ifndef SIZEOF_INTMAX_T"
-$		write tf "#ifdef __VAX"
-$		write tf "#define SIZEOF_INTMAX_T 4"
-$		write tf "#else"
-$		write tf "#define SIZEOF_INTMAX_T 8"
-$		write tf "#endif"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2b .eqs. "OFF" .and. key2_h .eqs. "_T"
-$	    then
-$		write tf "#ifndef SIZEOF_OFF_T"
-$		write tf "#if __USE_OFF64_T"
-$		write tf "#define SIZEOF_OFF_T 8"
-$		write tf "#else"
-$		write tf "#define SIZEOF_OFF_T 4"
-$		write tf "#endif"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2b .eqs. "CHAR" .and. key2_h .eqs. "_P"
-$	    then
-$		write tf "#ifndef SIZEOF_CHAR_P"
-$		write tf "#if __INITIAL_POINTER_SIZE == 64"
-$		write tf "#define SIZEOF_CHAR_P 8"
-$		write tf "#else"
-$		write tf "#define SIZEOF_CHAR_P 4"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2b .eqs. "VOIDP"
-$	    then
-$		write tf "#ifndef SIZEOF_VOIDP"
-$		write tf "#if __INITIAL_POINTER_SIZE == 64"
-$		write tf "#define SIZEOF_VOIDP 8"
-$		write tf "#else"
-$		write tf "#define SIZEOF_VOIDP 4"
-$		write tf "#endif"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2b .eqs. "INT"
-$	    then
-$		write tf "#ifndef SIZEOF_INT"
-$		write tf "#define SIZEOF_INT 4"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2b .eqs. "SIZE" .and. key2_h .eqs. "_T"
-$	    then
-$		write tf "#ifndef SIZEOF_SIZE_T"
-$		write tf "#define SIZEOF_SIZE_T 4"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2b .eqs. "TIME" .and. key2_h .eqs. "_T"
-$	    then
-$		write tf "#ifndef SIZEOF_TIME_T"
-$		write tf "#define SIZEOF_TIME_T 4"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2b .eqs. "DOUBLE"
-$	    then
-$		write tf "#ifndef SIZEOF_DOUBLE"
-$		write tf "#define SIZEOF_DOUBLE 8"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2b .eqs. "LONG"
-$	    then
-$		if key2c .eqs. ""
-$		then
-$		    write tf "#ifndef SIZEOF_LONG"
-$		    write tf "#define SIZEOF_LONG 4"
-$		    write tf "#endif"
-$		else
-$		    write tf "#ifndef SIZEOF_LONG_LONG"
-$		    write tf "#ifndef __VAX"
-$		    write tf "#define SIZEOF_LONG_LONG 8"
-$		    write tf "#endif"
-$		    write tf "#endif"
-$		endif
-$		goto cfgh_in_loop1
-$	    endif
-$	    write tf "/* ", xline, " */"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$!	Process NEED directives
-$!-------------------------------
-$	if key2a .eqs. "NEED"
-$	then
-$	    if key2b .eqs. "STRINGS" .and. key2_h .eqs. "_H"
-$	    then
-$		write tf "#ifndef NEED_STRINGS_H"
-$		write tf "#define NEED_STRINGS_H 1"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    write tf "/* ", xline, " */"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$!	Process GETHOSTNAME directives
-$!-------------------------------------
-$	if key2 .eqs. "GETHOSTNAME_TYPE_ARG2"
-$	then
-$	    write tf "#ifndef ''key2'"
-$	    write tf "#ifdef _DECC_V4_SOURCE"
-$	    write tf "#define ''key2' int"
-$	    write tf "#else"
-$	    write tf "#define ''key2' size_t"
-$	    write tf "#endif"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$!	Process GETNAMEINFO directives
-$!-------------------------------------
-$	if key2a .eqs. "GETNAMEINFO"
-$	then
-$	    if key2 .eqs. "GETNAMEINFO_QUAL_ARG1"
-$	    then
-$		write tf "#ifndef ''key2'"
-$		write tf "#define ''key2' const"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2 .eqs. "GETNAMEINFO_TYPE_ARG1"
-$	    then
-$		write tf "#ifndef ''key2'"
-$		write tf "#define ''key2' struct sockaddr *"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2 .eqs. "GETNAMEINFO_TYPE_ARG2"
-$	    then
-$		write tf "#ifndef ''key2'"
-$		write tf "#define ''key2' size_t"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2 .eqs. "GETNAMEINFO_TYPE_ARG46"
-$	    then
-$		write tf "#ifndef ''key2'"
-$		write tf "#define ''key2' size_t"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2 .eqs. "GETNAMEINFO_TYPE_ARG7"
-$	    then
-$		write tf "#ifndef ''key2'"
-$		write tf "#define ''key2' int"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	endif
-$!
-$!	Process RECV directives
-$!-------------------------------------
-$	if key2a .eqs. "RECV"
-$	then
-$	    if key2 .eqs. "RECV_TYPE_ARG1"
-$	    then
-$		write tf "#ifndef ''key2'"
-$		write tf "#define ''key2' int"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2 .eqs. "RECV_TYPE_ARG2"
-$	    then
-$		write tf "#ifndef ''key2'"
-$		write tf "#define ''key2' void *"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2 .eqs. "RECV_TYPE_ARG3"
-$	    then
-$		write tf "#ifndef ''key2'"
-$		write tf "#define ''key2' size_t"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2 .eqs. "RECV_TYPE_ARG4"
-$	    then
-$		write tf "#ifndef ''key2'"
-$		write tf "#define ''key2' int"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2 .eqs. "RECV_TYPE_RETV"
-$	    then
-$		write tf "#ifndef ''key2'"
-$		write tf "#define ''key2' int"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	endif
-$!
-$!	Process SEND directives
-$!-------------------------------------
-$	if key2a .eqs. "SEND"
-$	then
-$	    if key2 .eqs. "SEND_QUAL_ARG2"
-$	    then
-$		write tf "#ifndef ''key2'"
-$		write tf "#define ''key2' const"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2 .eqs. "SEND_TYPE_ARG1"
-$	    then
-$		write tf "#ifndef ''key2'"
-$		write tf "#define ''key2' int"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2 .eqs. "SEND_TYPE_ARG2"
-$	    then
-$		write tf "#ifndef ''key2'"
-$		write tf "#define ''key2' void *"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2 .eqs. "SEND_TYPE_ARG3"
-$	    then
-$		write tf "#ifndef ''key2'"
-$		write tf "#define ''key2' size_t"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2 .eqs. "SEND_TYPE_ARG4"
-$	    then
-$		write tf "#ifndef ''key2'"
-$		write tf "#define ''key2' int"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	    if key2 .eqs. "SEND_TYPE_RETV"
-$	    then
-$		write tf "#ifndef ''key2'"
-$		write tf "#define ''key2' int"
-$		write tf "#endif"
-$		goto cfgh_in_loop1
-$	    endif
-$	endif
-$!
-$!
-$!	Process STATFS directives
-$!-------------------------------
-$!	if key2a .eqs. "STATFS"
-$!	then
-$!	    write tf "/* ", xline, " */"
-$!	    goto cfgh_in_loop1
-$!	endif
-$!
-$!	Process inline directive
-$!------------------------------
-$	if key2 .eqs. "inline"
-$	then
-$	    write tf "#ifndef inline"
-$	    write tf "#define inline __inline"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$!	Process restrict directive
-$!--------------------------------
-$	if key2 .eqs. "restrict"
-$	then
-$	    write tf "#ifndef restrict"
-$	    write tf "#define restrict __restrict"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$!	Process STDC_HEADERS (SAMBA!)
-$!---------------------------
-$	if key2 .eqs. "STDC_HEADERS"
-$	then
-$	    write tf "#ifndef STDC_HEADERS"
-$	    write tf "#define STDC_HEADERS 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$!	Process PROTOTYPES directive
-$!-------------------------------------
-$	if key2 .eqs. "PROTOTYPES"
-$	then
-$	    write tf "#ifndef PROTOTYPES"
-$	    write tf "#define PROTOTYPES 1"
-$	    write tf "#endif"
-$	    goto cfgh_in_loop1
-$	endif
-$!
-$!	Special for SEEKDIR_RETURNS_VOID
-$!---------------------------------------
-$	if key2 .eqs. "SEEKDIR_RETURNS_VOID"
-$	then
-$	    write tf "#ifndef SEEKDIR_RETURNS_VOID"
-$	    write tf "#define SEEKDIR_RETURNS_VOID 1"
-$	    write tf "#endif"
-$	endif
-$!
-$!	Unknown - See if CONFIGURE can give a clue for this
-$!----------------------------------------------------------
-$	pflag = 0
-$	set_flag = 0
-$!	gproj_name = proj_name - "_VMS" - "-VMS"
-$	if f$search(tfile1) .nes. "" then delete 'tfile1';*
-$	define/user sys$output nl:
-$	define/user sys$error nl:
-$!	if f$locate("FILE", key2) .lt. key2_len then pflag = 1
-$!	if f$locate("DIR", key2) .eq. key2_len - 3 then pflag = 1
-$!	if f$locate("PATH", key2) .eq. key2_len - 4 then pflag = 1
-$!
-$	search/out='tfile1' 'configure_script' "''key2'="/exact
-$	search_sev = '$severity'
-$	if 'search_sev' .eq. 1
-$	then
-$	    open/read/err=unknown_cf_rd_error sf 'tfile1'
-$search_file_rd_loop:
-$	    read/end=unknown_cf_rd_err sf line_in
-$	    line_in = f$edit(line_in, "TRIM")
-$	    skey1 = f$element(0,"=",line_in)
-$	    if skey1 .eqs. key2
-$	    then
-$		skey2 = f$element(1,"=",line_in)
-$		skey2a = f$extract(0,2,skey2)
-$!
-$!
-$!		We can not handle assignment to shell symbols.
-$!		For now skip them.
-$!------------------------------------------------------------
-$		if f$locate("$", skey2) .lt. f$length(skey2)
-$		then
-$		    write tf "/* ", xline, " */"
-$		    set_flag = 1
-$		    goto found_in_configure
-$		endif
-$!
-$!		Keep these two cases separate to make it easier to add
-$!		more future intelligence to this routine
-$!----------------------------------------------------------------------
-$		if skey2a .eqs. """`"
-$		then
-$!		    if pflag .eq. 1
-$!		    then
-$!			write tf "#ifndef ''key2'"
-$!			write tf "#define ",key2," """,gproj_name,"_",key2,""""
-$!			write tf "#endif"
-$!		    else
-$!			Ignore this for now
-$!------------------------------------------
-$			write tf "/* ", xline, " */"
-$!		    endif
-$		    set_flag = 1
-$		    goto found_in_configure
-$		endif
-$		if skey2a .eqs. """$"
-$		then
-$!		    if pflag .eq. 1
-$!		    then
-$!			write tf "#ifndef ''key2'"
-$!			write tf "#define ",key2," """,gproj_name,"_",key2,""""
-$!			write tf "#endif"
-$!		    else
-$!			Ignore this for now
-$!-------------------------------------------
-$			write tf "/* ", xline, " */"
-$!		    endif
-$		    set_flag = 1
-$		    goto found_in_configure
-$		endif
-$!
-$!		Remove multiple layers of quotes if present
-$!----------------------------------------------------------
-$		if f$extract(0, 1, skey2) .eqs. "'"
-$		then
-$		    skey2 = skey2 - "'" - "'" - "'" - "'"
-$		endif
-$		if f$extract(0, 1, skey2) .eqs. """"
-$		then
-$		    skey2 = skey2 - """" - """" - """" - """"
-$		endif
-$		write tf "#ifndef ''key2'"
-$		if skey2 .eqs. ""
-$		then
-$		    write tf "#define ",key2
-$		else
-$!		    Only quote non-numbers
-$!----------------------------------------
-$		    if f$string(skey2+0) .eqs. skey2
-$		    then
-$			write tf "#define ",key2," ",skey2
-$		    else
-$			write tf "#define ",key2," """,skey2,""""
-$		    endif
-$		endif
-$		write tf "#endif"
-$		set_flag = 1
-$	    else
-$		goto search_file_rd_loop
-$!		if pflag .eq. 1
-$!		then
-$!		    write tf "#ifndef ''key2'"
-$!		    write tf "#define ",key2," """,gproj_name,"_",key2,""""
-$!		    write tf "#endif"
-$!		    set_flag = 1
-$!		endif
-$	    endif
-$found_in_configure:
-$unknown_cf_rd_err:
-$	    if f$trnlnm("sf","lnm$process",,"SUPERVISOR") .nes. ""
-$	    then
-$		close sf
-$	    endif
-$	    if f$search(tfile1) .nes. "" then delete 'tfile1';*
-$	    if set_flag .eq. 1 then goto cfgh_in_loop1
-$	endif
-$   endif
-$!
-$!
-$!
-$!  If it falls through everything else, comment it out
-$!-----------------------------------------------------
-$   write tf "/* ", xline, " */"
-$   goto cfgh_in_loop1
-$cfgh_in_loop1_end:
-$close inf
-$!
-$!
-$! Write out the tail
-$!--------------------
-$write_tail:
-$gosub write_config_h_tail
-$!
-$! Exit and clean up
-$!--------------------
-$general_error:
-$status = '$status'
-$all_exit:
-$set noon
-$if f$trnlnm("sf","lnm$process",,"SUPERVISOR") .nes. "" then close sf
-$if f$trnlnm("tf","lnm$process",,"SUPERVISOR") .nes. "" then close tf
-$if f$trnlnm("inf","lnm$process",,"SUPERVISOR") .nes. "" then close inf
-$if f$trnlnm("tf1","lnm$process",,"SUPERVISOR") .nes. "" then close tf1
-$if f$trnlnm("tf2","lnm$process",,"SUPERVISOR") .nes. "" then close tf2
-$if f$trnlnm("tfcv","lnm$process",,"SUPERVISOR") .nes. "" then close tfcv
-$if f$type(tfile1) .eqs. "STRING"
-$then
-$   if f$search(tfile1) .nes. "" then delete 'tfile1';*
-$endif
-$if f$type(dchfile) .eqs. "STRING"
-$then
-$   if f$search(dchfile) .nes. "" then delete 'dchfile';*
-$endif
-$if f$type(starhfile) .eqs. "STRING"
-$then
-$   if f$search(starhfile) .nes. "" then delete 'starhfile';*
-$endif
-$if f$type(configure_script) .eqs. "STRING"
-$then
-$   if f$search(configure_script) .nes. "" then delete 'configure_script';*
-$endif
-$exit 'status'
-$!
-$!
-$control_y:
-$   status = ss_control_y
-$   goto all_exit
-$!
-$!
-$!
-$! Gosub to write a new config_vms.h
-$!-----------------------------------
-$write_config_vms:
-$outfile = "sys$disk:[]config_vms.h"
-$create 'outfile'
-$open/append tf 'outfile'
-$write tf "/* File: config_vms.h"
-$write tf "**"
-$write tf "** This file contains the manual edits needed for porting"
-$!write tf "** the ''proj_name' package to OpenVMS.
-$write tf "**"
-$write tf "** Edit this file as needed.  The procedure that automatically"
-$write tf "** generated this header stub will not overwrite or make any"
-$write tf "** changes to this file."
-$write tf "**"
-$write tf -
- "** ", datetime, tab, username, tab, "Generated by ''my_proc_file'"
-$write tf "**"
-$write tf -
- "**========================================================================*/"
-$write tf ""
-$close tf
-$return
-$!
-$! gosub to write out a documentation header for config.h
-$!----------------------------------------------------------------
-$write_config_h_header:
-$outfile = "sys$disk:[]config.h"
-$create 'outfile'
-$open/append tf 'outfile'
-$write tf "#ifndef CONFIG_H"
-$write tf "#define CONFIG_H"
-$write tf "/* File: config.h"
-$write tf "**"
-$write tf -
-  "** This file contains the options needed for porting "
-$write tf "** the project on a VMS system."
-$write tf "**"
-$write tf "** Try not to make any edits to this file, as it is"
-$write tf "** automagically generated."
-$write tf "**"
-$write tf "** Manual edits should be made to the config_vms.h file."
-$write tf "**"
-$write tf -
- "** ", datetime, tab, username, tab, "Generated by ''my_proc_file'"
-$write tf "**"
-$write tf -
- "**========================================================================*/"
-$write tf ""
-$write tf "#if (__CRTL_VER >= 70200000) && !defined (__VAX)"
-$write tf "#define _LARGEFILE 1"
-$write tf "#endif"
-$write tf ""
-$write tf "#ifndef __VAX"
-$write tf "#ifdef __CRTL_VER"
-$write tf "#if __CRTL_VER >= 80200000"
-$write tf "#define _USE_STD_STAT 1"
-$write tf "#endif"
-$write tf "#endif"
-$write tf "#endif"
-$write tf ""
-$!
-$write tf " /* Allow compiler builtins */"
-$write tf "/*-------------------------*/"
-$write tf "#ifdef __DECC_VER"
-$write tf "#include <non_existent_dir:builtins.h>"
-$write tf "#endif"
-$!
-$write tf ""
-$return
-$!
-$! gosub to write out the tail for config.h and close it
-$!---------------------------------------------------------
-$write_config_h_tail:
-$write tf ""
-$write tf " /* Include the hand customized settings */"
-$write tf "/*--------------------------------------*/"
-$write tf "#include ""config_vms.h"""
-$write tf ""
-$write tf "#endif /* CONFIG_H */"
-$close tf
-$return
-$!
diff --git a/third-party/curl/packages/vms/curl_crtl_init.c b/third-party/curl/packages/vms/curl_crtl_init.c
deleted file mode 100644
index 6ae7e8c3a6..0000000000
--- a/third-party/curl/packages/vms/curl_crtl_init.c
+++ /dev/null
@@ -1,333 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-/* File: curl_crtl_init.c
- *
- * This file makes sure that the DECC Unix settings are correct for
- * the mode the program is run in.
- *
- * The CRTL has not been initialized at the time that these routines
- * are called, so many routines can not be called.
- *
- * This is a module that provides a LIB$INITIALIZE routine that
- * will turn on some CRTL features that are not enabled by default.
- *
- * The CRTL features can also be turned on via logical names, but that
- * impacts all programs and some aren't ready, willing, or able to handle
- * those settings.
- *
- * On VMS versions that are too old to use the feature setting API, this
- * module falls back to using logical names.
- *
- * Copyright (C) John Malmberg
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
- * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- */
-
-/* Unix headers */
-#include <stdio.h>
-#include <string.h>
-
-/* VMS specific headers */
-#include <descrip.h>
-#include <lnmdef.h>
-#include <stsdef.h>
-
-#pragma member_alignment save
-#pragma nomember_alignment longword
-#pragma message save
-#pragma message disable misalgndmem
-struct itmlst_3 {
-  unsigned short int buflen;
-  unsigned short int itmcode;
-  void *bufadr;
-  unsigned short int *retlen;
-};
-#pragma message restore
-#pragma member_alignment restore
-
-#ifdef __VAX
-#define ENABLE "ENABLE"
-#define DISABLE "DISABLE"
-#else
-
-#define ENABLE TRUE
-#define DISABLE 0
-int   decc$feature_get_index (const char *name);
-int   decc$feature_set_value (int index, int mode, int value);
-#endif
-
-int   SYS$TRNLNM(
-    const unsigned long * attr,
-    const struct dsc$descriptor_s * table_dsc,
-    struct dsc$descriptor_s * name_dsc,
-    const unsigned char * acmode,
-    const struct itmlst_3 * item_list);
-int   SYS$CRELNM(
-    const unsigned long * attr,
-    const struct dsc$descriptor_s * table_dsc,
-    const struct dsc$descriptor_s * name_dsc,
-    const unsigned char * acmode,
-    const struct itmlst_3 * item_list);
-
-
-/* Take all the fun out of simply looking up a logical name */
-static int sys_trnlnm
-   (const char * logname,
-    char * value,
-    int value_len)
-{
-    const $DESCRIPTOR(table_dsc, "LNM$FILE_DEV");
-    const unsigned long attr = LNM$M_CASE_BLIND;
-    struct dsc$descriptor_s name_dsc;
-    int status;
-    unsigned short result;
-    struct itmlst_3 itlst[2];
-
-    itlst[0].buflen = value_len;
-    itlst[0].itmcode = LNM$_STRING;
-    itlst[0].bufadr = value;
-    itlst[0].retlen = &result;
-
-    itlst[1].buflen = 0;
-    itlst[1].itmcode = 0;
-
-    name_dsc.dsc$w_length = strlen(logname);
-    name_dsc.dsc$a_pointer = (char *)logname;
-    name_dsc.dsc$b_dtype = DSC$K_DTYPE_T;
-    name_dsc.dsc$b_class = DSC$K_CLASS_S;
-
-    status = SYS$TRNLNM(&attr, &table_dsc, &name_dsc, 0, itlst);
-
-    if($VMS_STATUS_SUCCESS(status)) {
-
-         /* Null terminate and return the string */
-        /*--------------------------------------*/
-        value[result] = '\0';
-    }
-
-    return status;
-}
-
-/* How to simply create a logical name */
-static int sys_crelnm
-   (const char * logname,
-    const char * value)
-{
-    int ret_val;
-    const char * proc_table = "LNM$PROCESS_TABLE";
-    struct dsc$descriptor_s proc_table_dsc;
-    struct dsc$descriptor_s logname_dsc;
-    struct itmlst_3 item_list[2];
-
-    proc_table_dsc.dsc$a_pointer = (char *) proc_table;
-    proc_table_dsc.dsc$w_length = strlen(proc_table);
-    proc_table_dsc.dsc$b_dtype = DSC$K_DTYPE_T;
-    proc_table_dsc.dsc$b_class = DSC$K_CLASS_S;
-
-    logname_dsc.dsc$a_pointer = (char *) logname;
-    logname_dsc.dsc$w_length = strlen(logname);
-    logname_dsc.dsc$b_dtype = DSC$K_DTYPE_T;
-    logname_dsc.dsc$b_class = DSC$K_CLASS_S;
-
-    item_list[0].buflen = strlen(value);
-    item_list[0].itmcode = LNM$_STRING;
-    item_list[0].bufadr = (char *)value;
-    item_list[0].retlen = NULL;
-
-    item_list[1].buflen = 0;
-    item_list[1].itmcode = 0;
-
-    ret_val = SYS$CRELNM(NULL, &proc_table_dsc, &logname_dsc, NULL, item_list);
-
-    return ret_val;
-}
-
-
- /* Start of DECC RTL Feature handling */
-
-/*
-** Sets default value for a feature
-*/
-#ifdef __VAX
-static void set_feature_default(const char *name, const char *value)
-{
-    sys_crelnm(name, value);
-}
-#else
-static void set_feature_default(const char *name, int value)
-{
-    int index;
-
-    index = decc$feature_get_index(name);
-
-    if(index > 0)
-        decc$feature_set_value (index, 0, value);
-}
-#endif
-
-static void set_features(void)
-{
-    int status;
-    char unix_shell_name[255];
-    int use_unix_settings = 1;
-
-    status = sys_trnlnm("GNV$UNIX_SHELL",
-                        unix_shell_name, sizeof unix_shell_name -1);
-    if(!$VMS_STATUS_SUCCESS(status)) {
-        use_unix_settings = 0;
-    }
-
-    /* ACCESS should check ACLs or it is lying. */
-    set_feature_default("DECC$ACL_ACCESS_CHECK", ENABLE);
-
-    /* We always want the new parse style */
-    set_feature_default ("DECC$ARGV_PARSE_STYLE" , ENABLE);
-
-
-    /* Unless we are in POSIX compliant mode, we want the old POSIX root
-     * enabled.
-     */
-    set_feature_default("DECC$DISABLE_POSIX_ROOT", DISABLE);
-
-    /* EFS charset, means UTF-8 support */
-    /* VTF-7 support is controlled by a feature setting called UTF8 */
-    set_feature_default ("DECC$EFS_CHARSET", ENABLE);
-    set_feature_default ("DECC$EFS_CASE_PRESERVE", ENABLE);
-
-    /* Support timestamps when available */
-    set_feature_default ("DECC$EFS_FILE_TIMESTAMPS", ENABLE);
-
-    /* Cache environment variables - performance improvements */
-    set_feature_default ("DECC$ENABLE_GETENV_CACHE", ENABLE);
-
-    /* Start out with new file attribute inheritance */
-#ifdef __VAX
-    set_feature_default ("DECC$EXEC_FILEATTR_INHERITANCE", "2");
-#else
-    set_feature_default ("DECC$EXEC_FILEATTR_INHERITANCE", 2);
-#endif
-
-    /* Don't display trailing dot after files without type */
-    set_feature_default ("DECC$READDIR_DROPDOTNOTYPE", ENABLE);
-
-    /* For standard output channels buffer output until terminator */
-    /* Gets rid of output logs with single character lines in them. */
-    set_feature_default ("DECC$STDIO_CTX_EOL", ENABLE);
-
-    /* Fix mv aa.bb aa  */
-    set_feature_default ("DECC$RENAME_NO_INHERIT", ENABLE);
-
-    if(use_unix_settings) {
-
-        /* POSIX requires that open files be able to be removed */
-        set_feature_default ("DECC$ALLOW_REMOVE_OPEN_FILES", ENABLE);
-
-        /* Default to outputting Unix filenames in VMS routines */
-        set_feature_default ("DECC$FILENAME_UNIX_ONLY", ENABLE);
-        /* FILENAME_UNIX_ONLY Implicitly sets */
-        /* decc$disable_to_vms_logname_translation */
-
-        set_feature_default ("DECC$FILE_PERMISSION_UNIX", ENABLE);
-
-        set_feature_default ("DECC$FILE_SHARING", ENABLE);
-
-        set_feature_default ("DECC$FILE_OWNER_UNIX", ENABLE);
-        set_feature_default ("DECC$POSIX_SEEK_STREAM_FILE", ENABLE);
-
-    } else {
-        set_feature_default("DECC$FILENAME_UNIX_REPORT", ENABLE);
-    }
-
-    /* When reporting Unix filenames, glob the same way */
-    set_feature_default ("DECC$GLOB_UNIX_STYLE", ENABLE);
-
-    /* The VMS version numbers on Unix filenames is incompatible with most */
-    /* ported packages. */
-    set_feature_default("DECC$FILENAME_UNIX_NO_VERSION", ENABLE);
-
-    /* The VMS version numbers on Unix filenames is incompatible with most */
-    /* ported packages. */
-    set_feature_default("DECC$UNIX_PATH_BEFORE_LOGNAME", ENABLE);
-
-    /* Set strtol to proper behavior */
-    set_feature_default("DECC$STRTOL_ERANGE", ENABLE);
-
-    /* Commented here to prevent future bugs:  A program or user should */
-    /* never ever enable DECC$POSIX_STYLE_UID. */
-    /* It will probably break all code that accesses UIDs */
-    /*  do_not_set_default ("DECC$POSIX_STYLE_UID", TRUE); */
-}
-
-
-/* Some boilerplate to force this to be a proper LIB$INITIALIZE section */
-
-#pragma nostandard
-#pragma extern_model save
-#ifdef __VAX
-#pragma extern_model strict_refdef "LIB$INITIALIZE" nowrt, long, nopic
-#else
-#pragma extern_model strict_refdef "LIB$INITIALIZE" nowrt, long
-#    if __INITIAL_POINTER_SIZE
-#        pragma __pointer_size __save
-#        pragma __pointer_size 32
-#    else
-#        pragma __required_pointer_size __save
-#        pragma __required_pointer_size 32
-#    endif
-#endif
-/* Set our contribution to the LIB$INITIALIZE array */
-void (* const iniarray[])(void) = {set_features, } ;
-#ifndef __VAX
-#    if __INITIAL_POINTER_SIZE
-#        pragma __pointer_size __restore
-#    else
-#        pragma __required_pointer_size __restore
-#    endif
-#endif
-
-
-/*
-** Force a reference to LIB$INITIALIZE to ensure it
-** exists in the image.
-*/
-int LIB$INITIALIZE(void);
-#ifdef __DECC
-#pragma extern_model strict_refdef
-#endif
-    int lib_init_ref = (int) LIB$INITIALIZE;
-#ifdef __DECC
-#pragma extern_model restore
-#pragma standard
-#endif
diff --git a/third-party/curl/packages/vms/curlmsg.h b/third-party/curl/packages/vms/curlmsg.h
deleted file mode 100644
index 9b5c4c76d1..0000000000
--- a/third-party/curl/packages/vms/curlmsg.h
+++ /dev/null
@@ -1,143 +0,0 @@
-#ifndef HEADER_CURLMSG_H
-#define HEADER_CURLMSG_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#pragma __member_alignment __save
-#pragma __nomember_alignment
-
-/*                                                                          */
-/* CURLMSG.H                                                                */
-/*                                                                          */
-/* SDL File Generated by VAX-11 Message V04-00 on 3-SEP-2008 13:33:54.09    */
-/*                                                                          */
-/* THESE VMS ERROR CODES ARE GENERATED BY TAKING APART THE CURL.H           */
-/* FILE AND PUTTING ALL THE CURLE_* ENUM STUFF INTO THIS FILE,              */
-/* CURLMSG.MSG.  AN .SDL FILE IS CREATED FROM THIS FILE WITH                */
-/* MESSAGE/SDL.  THE .H FILE IS CREATED USING THE FREEWARE SDL TOOL         */
-/* AGAINST THE .SDL FILE WITH SDL/ALPHA/LANG=CC COMMAND.                    */
-/*                                                                          */
-/* WITH THE EXCEPTION OF CURLE_OK, ALL OF THE MESSAGES ARE AT               */
-/* THE ERROR SEVERITY LEVEL.  WITH THE EXCEPTION OF                         */
-/* PEER_FAILED_VERIF, WHICH IS A SHORTENED FORM OF                          */
-/* PEER_FAILED_VERIFICATION, THESE ARE THE SAME NAMES AS THE                */
-/* CURLE_ ONES IN INCLUDE/CURL.H.  THE MESSAGE UTILITY MANUAL STATES        */
-/* "THE COMBINED LENGTH OF THE PREFIX AND THE MESSAGE SYMBOL NAME CANNOT    */
-/* EXCEED 31 CHARACTERS."  WITH A PREFIX OF FIVE THAT LEAVES US WITH 26     */
-/* FOR THE MESSAGE NAME.                                                    */
-/*                                                                          */
-/* IF YOU UPDATE THIS FILE, UPDATE CURLMSG_VMS.H SO THAT THEY ARE IN SYNC   */
-/*                                                                          */
-
-#define CURL_FACILITY 3841
-#define CURL_OK 251756553
-#define CURL_UNSUPPORTED_PROTOCOL 251756562
-#define CURL_FAILED_INIT 251756570
-#define CURL_URL_MALFORMAT 251756578
-#define CURL_OBSOLETE4 251756586
-#define CURL_COULDNT_RESOLVE_PROXY 251756594
-#define CURL_COULDNT_RESOLVE_HOST 251756602
-#define CURL_COULDNT_CONNECT 251756610
-#define CURL_WEIRD_SERVER_REPLY 251756618
-#define CURL_FTP_WEIRD_SERVER_REPLY CURL_WEIRD_SERVER_REPLY
-#define CURL_FTP_ACCESS_DENIED 251756626
-#define CURL_OBSOLETE10 251756634
-#define CURL_FTP_WEIRD_PASS_REPLY 251756642
-#define CURL_OBSOLETE12 251756650
-#define CURL_FTP_WEIRD_PASV_REPLY 251756658
-#define CURL_FTP_WEIRD_227_FORMAT 251756666
-#define CURL_FTP_CANT_GET_HOST 251756674
-#define CURL_OBSOLETE16 251756682
-#define CURL_FTP_COULDNT_SET_TYPE 251756690
-#define CURL_PARTIAL_FILE 251756698
-#define CURL_FTP_COULDNT_RETR_FILE 251756706
-#define CURL_OBSOLETE20 251756714
-#define CURL_QUOTE_ERROR 251756722
-#define CURL_HTTP_RETURNED_ERROR 251756730
-#define CURL_WRITE_ERROR 251756738
-#define CURL_OBSOLETE24 251756746
-#define CURL_UPLOAD_FAILED 251756754
-#define CURL_READ_ERROR 251756762
-#define CURL_OUT_OF_MEMORY 251756770
-#define CURL_OPERATION_TIMEOUTED 251756778
-#define CURL_OBSOLETE29 251756786
-#define CURL_FTP_PORT_FAILED 251756794
-#define CURL_FTP_COULDNT_USE_REST 251756802
-#define CURL_OBSOLETE32 251756810
-#define CURL_RANGE_ERROR 251756818
-#define CURL_HTTP_POST_ERROR 251756826
-#define CURL_SSL_CONNECT_ERROR 251756834
-#define CURL_BAD_DOWNLOAD_RESUME 251756842
-#define CURL_FILE_COULDNT_READ_FILE 251756850
-#define CURL_LDAP_CANNOT_BIND 251756858
-#define CURL_LDAP_SEARCH_FAILED 251756866
-#define CURL_OBSOLETE40 251756874
-#define CURL_FUNCTION_NOT_FOUND 251756882
-#define CURL_ABORTED_BY_CALLBACK 251756890
-#define CURL_BAD_FUNCTION_ARGUMENT 251756898
-#define CURL_OBSOLETE44 251756906
-#define CURL_INTERFACE_FAILED 251756914
-#define CURL_OBSOLETE46 251756922
-#define CURL_TOO_MANY_REDIRECTS 251756930
-#define CURL_UNKNOWN_TELNET_OPTION 251756938
-#define CURL_TELNET_OPTION_SYNTAX 251756946
-#define CURL_OBSOLETE50 251756954
-#define CURL_PEER_FAILED_VERIF 251756962
-#define CURL_GOT_NOTHING 251756970
-#define CURL_SSL_ENGINE_NOTFOUND 251756978
-#define CURL_SSL_ENGINE_SETFAILED 251756986
-#define CURL_SEND_ERROR 251756994
-#define CURL_RECV_ERROR 251757002
-#define CURL_OBSOLETE57 251757010
-#define CURL_SSL_CERTPROBLEM 251757018
-#define CURL_SSL_CIPHER 251757026
-#define CURL_SSL_CACERT 251757034
-#define CURL_BAD_CONTENT_ENCODING 251757042
-#define CURL_LDAP_INVALID_URL 251757050
-#define CURL_FILESIZE_EXCEEDED 251757058
-#define CURL_USE_SSL_FAILED 251757066
-#define CURL_SEND_FAIL_REWIND 251757074
-#define CURL_SSL_ENGINE_INITFAILED 251757082
-#define CURL_LOGIN_DENIED 251757090
-#define CURL_TFTP_NOTFOUND 251757098
-#define CURL_TFTP_PERM 251757106
-#define CURL_REMOTE_DISK_FULL 251757114
-#define CURL_TFTP_ILLEGAL 251757122
-#define CURL_TFTP_UNKNOWNID 251757130
-#define CURL_REMOTE_FILE_EXISTS 251757138
-#define CURL_TFTP_NOSUCHUSER 251757146
-#define CURL_CONV_FAILED 251757154
-#define CURL_CONV_REQD 251757162
-#define CURL_SSL_CACERT_BADFILE 251757170
-#define CURL_REMOTE_FILE_NOT_FOUND 251757178
-#define CURL_SSH 251757186
-#define CURL_SSL_SHUTDOWN_FAILED 251757194
-#define CURL_AGAIN 251757202
-#define CURL_SSL_CRL_BADFILE 251757210
-#define CURL_SSL_ISSUER_ERROR 251757218
-#define CURL_CURL_LAST 251757226
-
-#pragma __member_alignment __restore
-
-#endif /* HEADER_CURLMSG_H */
diff --git a/third-party/curl/packages/vms/curlmsg.msg b/third-party/curl/packages/vms/curlmsg.msg
deleted file mode 100644
index ac2d508e3b..0000000000
--- a/third-party/curl/packages/vms/curlmsg.msg
+++ /dev/null
@@ -1,134 +0,0 @@
-!***************************************************************************
-!                                  _   _ ____  _
-!  Project                     ___| | | |  _ \| |
-!                             / __| | | | |_) | |
-!                            | (__| |_| |  _ <| |___
-!                             \___|\___/|_| \_\_____|
-!
-! Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-!
-! This software is licensed as described in the file COPYING, which
-! you should have received as part of this distribution. The terms
-! are also available at https://curl.se/docs/copyright.html.
-!
-! You may opt to use, copy, modify, merge, publish, distribute and/or sell
-! copies of the Software, and permit persons to whom the Software is
-! furnished to do so, under the terms of the COPYING file.
-!
-! This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-! KIND, either express or implied.
-!
-! SPDX-License-Identifier: curl
-!
-!##########################################################################
-!
-! These VMS error codes are generated by taking apart the curl.h
-! file and putting all the CURLE_* enum stuff into this file,
-! CURLMSG.MSG.  An .SDL file is created from this file with
-! MESSAGE/SDL.  The .H file is created using the freeware SDL tool
-! against the .SDL file with SDL/ALPHA/LANG=CC command.
-!
-! With the exception of CURLE_OK, all of the messages are at
-! the error severity level.  With the exception of
-! PEER_FAILED_VERIF, which is a shortened form of
-! PEER_FAILED_VERIFICATION, these are the same names as the
-! CURLE_ ones in include/curl.h.  The Message Utility manual states
-! "The combined length of the prefix and the message symbol name cannot
-! exceed 31 characters."  With a prefix of five that leaves us with 26
-! for the message name.
-!
-! If you update this file also update curlmsg_vms.h so that they are in sync
-!
-.TITLE		CURLMSG Message files
-.FACILITY	CURL,1793	/PREFIX=CURL_
-.BASE		1
-.SEVERITY	SUCCESS
-OK		<normal successful completion>
-
-.SEVERITY	ERROR
-UNSUPPORTED_PROTOCOL	<unsupported protocol>
-FAILED_INIT		<failed init>
-URL_MALFORMAT		<URL malformat>
-OBSOLETE4		<obsolete error code>
-COULDNT_RESOLVE_PROXY	<could not resolve proxy>
-COULDNT_RESOLVE_HOST	<could not resolve host>
-COULDNT_CONNECT		<could not connect>
-WEIRD_SERVER_REPLY	<weird server reply>
-FTP_ACCESS_DENIED	<FTP access denied>
-OBSOLETE10		<obsolete error code>
-FTP_WEIRD_PASS_REPLY	<FTP weird PASS reply>
-OBSOLETE12		<obsolete error code>
-FTP_WEIRD_PASV_REPLY	<FTP weird PASV reply>
-FTP_WEIRD_227_FORMAT	<FTP weird 227 format>
-FTP_CANT_GET_HOST	<FTP can not get host>
-OBSOLETE16		<obsolete error code>
-FTP_COULDNT_SET_TYPE	<FTP could not set type>
-PARTIAL_FILE		<partial file>
-FTP_COULDNT_RETR_FILE	<FTP could not RETR file>
-OBSOLETE20		<obsolete error code>
-QUOTE_ERROR		<quote command error>
-HTTP_RETURNED_ERROR	<HTTP returned error>
-WRITE_ERROR		<write error>
-OBSOLETE24    		<obsolete error code>
-UPLOAD_FAILED		<failed upload command>
-READ_ERROR		<read error, could not open/read file>
-OUT_OF_MEMORY		<out of memory>
-OPERATION_TIMEOUTED	<operation timed out, timeout time was reached>
-OBSOLETE29		<obsolete error code>
-FTP_PORT_FAILED		<FTP PORT operation failed>
-FTP_COULDNT_USE_REST	<FTP REST command failed>
-OBSOLETE32		<obsolete error code>
-RANGE_ERROR		<RANGE command error>
-HTTP_POST_ERROR		<HTTP POST error>
-SSL_CONNECT_ERROR	<SSL connect error>
-BAD_DOWNLOAD_RESUME	<bad download resume>
-FILE_COULDNT_READ_FILE	<FILE could not read file>
-LDAP_CANNOT_BIND	<LDAP cannot bind>
-LDAP_SEARCH_FAILED	<LDAP search failed>
-OBSOLETE40		<obsolete error code>
-FUNCTION_NOT_FOUND	<function not found>
-ABORTED_BY_CALLBACK	<aborted by callback>
-BAD_FUNCTION_ARGUMENT	<bad function argument>
-OBSOLETE44		<obsolete error code>
-INTERFACE_FAILED	<CURLOPT_INTERFACE failed>
-OBSOLETE46		<obsolete error code>
-TOO_MANY_REDIRECTS	<too many redirects>
-UNKNOWN_TELNET_OPTION	<unknown TELNET option>
-TELNET_OPTION_SYNTAX	<malformed TELNET option syntax>
-OBSOLETE50		<obsolete error code>
-PEER_FAILED_VERIF	<peer certificate or fingerprint failed>
-GOT_NOTHING		<got nothing>
-SSL_ENGINE_NOTFOUND	<SSL crypto engine not found>
-SSL_ENGINE_SETFAILED	<SSL can not set SSL crypto engine as default>
-SEND_ERROR		<SEND error, failure sending network data>
-RECV_ERROR		<RECV error, failure receiving network data>
-OBSOLETE57  		<obsolete error code>
-SSL_CERTPROBLEM		<SSL problem with the local certificate>
-SSL_CIPHER              <SSL CIPHER, could not use specified cipher>
-SSL_CACERT		<SSL CACERT, problem with the CA cert (path?)>
-BAD_CONTENT_ENCODING	<unrecognized transfer encoding>
-LDAP_INVALID_URL	<LDAP invalid url>
-FILESIZE_EXCEEDED	<maximum file size exceeded>
-USE_SSL_FAILED		<requested FTP SSL level failed>
-SEND_FAIL_REWIND	<sending data requires a rewind that failed>
-SSL_ENGINE_INITFAILED	<failed to initialise ENGINE>
-LOGIN_DENIED		<user or password not accepted. failed to login>
-TFTP_NOTFOUND		<file not found on server>
-TFTP_PERM		<permission problem on server>
-REMOTE_DISK_FULL	<out of disk space on server>
-TFTP_ILLEGAL		<illegal TFTP operation>
-TFTP_UNKNOWNID		<unknown transfer ID>
-REMOTE_FILE_EXISTS	<file already exists>
-TFTP_NOSUCHUSER		<no such user>
-CONV_FAILED		<conversion failed>
-CONV_REQD		<caller must register conversion callbacks>
-SSL_CACERT_BADFILE	<could not load CACERT file>
-REMOTE_FILE_NOT_FOUND	<remote file not found>
-SSH			<unspecified error from the SSH layer>
-SSL_SHUTDOWN_FAILED	<failed to shut down the SSL connection>
-AGAIN			<socket not ready, wait and try again>
-SSL_CRL_BADFILE		<could not load CRL file, missing or wrong format>
-SSL_ISSUER_ERROR	<issuer check failed>
-CURL_LAST		<CURLMSG.MSG is out of sync with the source code>
-
-.END
diff --git a/third-party/curl/packages/vms/curlmsg_vms.h b/third-party/curl/packages/vms/curlmsg_vms.h
deleted file mode 100644
index 982d0c6a07..0000000000
--- a/third-party/curl/packages/vms/curlmsg_vms.h
+++ /dev/null
@@ -1,143 +0,0 @@
-#ifndef HEADER_CURLMSG_VMS_H
-#define HEADER_CURLMSG_VMS_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-/*                                                                          */
-/* CURLMSG_VMS.H                                                            */
-/*                                                                          */
-/* This defines the necessary bits to change CURLE_* error codes to VMS     */
-/* style error codes.  CURLMSG.H is built from CURLMSG.SDL which is built   */
-/* from CURLMSG.MSG.  The vms_cond array is used to return VMS errors by    */
-/* putting the VMS error codes into the array offset based on CURLE_* code. */
-/*                                                                          */
-/* If you update CURLMSG.MSG make sure to update this file to match.        */
-/*                                                                          */
-
-#include "curlmsg.h"
-
-/*
-#define   FAC_CURL      0xC01
-#define   FAC_SYSTEM    0
-#define   MSG_NORMAL    0
-*/
-
-/*
-#define   SEV_WARNING   0
-#define   SEV_SUCCESS   1
-#define   SEV_ERROR     2
-#define   SEV_INFO      3
-#define   SEV_FATAL     4
-*/
-
-static const long vms_cond[] =
-        {
-        CURL_OK,
-	CURL_UNSUPPORTED_PROTOCOL,
-	CURL_FAILED_INIT,
-	CURL_URL_MALFORMAT,
-	CURL_OBSOLETE4,
-	CURL_COULDNT_RESOLVE_PROXY,
-	CURL_COULDNT_RESOLVE_HOST,
-	CURL_COULDNT_CONNECT,
-	CURL_WEIRD_SERVER_REPLY,
-	CURL_FTP_ACCESS_DENIED,
-	CURL_OBSOLETE10,
-	CURL_FTP_WEIRD_PASS_REPLY,
-	CURL_OBSOLETE12,
-	CURL_FTP_WEIRD_PASV_REPLY,
-	CURL_FTP_WEIRD_227_FORMAT,
-	CURL_FTP_CANT_GET_HOST,
-	CURL_OBSOLETE16,
-	CURL_FTP_COULDNT_SET_TYPE,
-	CURL_PARTIAL_FILE,
-	CURL_FTP_COULDNT_RETR_FILE,
-	CURL_OBSOLETE20,
-	CURL_QUOTE_ERROR,
-	CURL_HTTP_RETURNED_ERROR,
-	CURL_WRITE_ERROR,
-	CURL_OBSOLETE24,
-	CURL_UPLOAD_FAILED,
-	CURL_READ_ERROR,
-	CURL_OUT_OF_MEMORY,
-	CURL_OPERATION_TIMEOUTED,
-	CURL_OBSOLETE29,
-	CURL_FTP_PORT_FAILED,
-	CURL_FTP_COULDNT_USE_REST,
-	CURL_OBSOLETE32,
-	CURL_RANGE_ERROR,
-	CURL_HTTP_POST_ERROR,
-	CURL_SSL_CONNECT_ERROR,
-	CURL_BAD_DOWNLOAD_RESUME,
-	CURL_FILE_COULDNT_READ_FILE,
-	CURL_LDAP_CANNOT_BIND,
-	CURL_LDAP_SEARCH_FAILED,
-	CURL_OBSOLETE40,
-	CURL_FUNCTION_NOT_FOUND,
-	CURL_ABORTED_BY_CALLBACK,
-	CURL_BAD_FUNCTION_ARGUMENT,
-	CURL_OBSOLETE44,
-	CURL_INTERFACE_FAILED,
-	CURL_OBSOLETE46,
-	CURL_TOO_MANY_REDIRECTS,
-	CURL_UNKNOWN_TELNET_OPTION,
-	CURL_TELNET_OPTION_SYNTAX,
-	CURL_OBSOLETE50,
-	CURL_PEER_FAILED_VERIF,
-	CURL_GOT_NOTHING,
-	CURL_SSL_ENGINE_NOTFOUND,
-	CURL_SSL_ENGINE_SETFAILED,
-	CURL_SEND_ERROR,
-	CURL_RECV_ERROR,
-	CURL_OBSOLETE57,
-	CURL_SSL_CERTPROBLEM,
-	CURL_SSL_CIPHER,
-	CURL_SSL_CACERT,
-	CURL_BAD_CONTENT_ENCODING,
-	CURL_LDAP_INVALID_URL,
-	CURL_FILESIZE_EXCEEDED,
-	CURL_USE_SSL_FAILED,
-	CURL_SEND_FAIL_REWIND,
-	CURL_SSL_ENGINE_INITFAILED,
-	CURL_LOGIN_DENIED,
-	CURL_TFTP_NOTFOUND,
-	CURL_TFTP_PERM,
-	CURL_REMOTE_DISK_FULL,
-	CURL_TFTP_ILLEGAL,
-	CURL_TFTP_UNKNOWNID,
-	CURL_REMOTE_FILE_EXISTS,
-	CURL_TFTP_NOSUCHUSER,
-	CURL_CONV_FAILED,
-	CURL_CONV_REQD,
-	CURL_SSL_CACERT_BADFILE,
-	CURL_REMOTE_FILE_NOT_FOUND,
-	CURL_SSH,
-	CURL_SSL_SHUTDOWN_FAILED,
-	CURL_AGAIN,
-	CURLE_SSL_CRL_BADFILE,
-	CURLE_SSL_ISSUER_ERROR,
-        CURL_CURL_LAST
-        };
-
-#endif /* HEADER_CURLMSG_VMS_H */
diff --git a/third-party/curl/packages/vms/report_openssl_version.c b/third-party/curl/packages/vms/report_openssl_version.c
deleted file mode 100644
index 64e1ee0522..0000000000
--- a/third-party/curl/packages/vms/report_openssl_version.c
+++ /dev/null
@@ -1,100 +0,0 @@
-/* File: report_openssl_version.c
- *
- * This file dynamically loads the openssl shared image to report the
- * version string.
- *
- * It will optionally place that version string in a DCL symbol.
- *
- * Usage:  report_openssl_version <shared_image> [<dcl_symbol>]
- *
- * Copyright (C) John Malmberg
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
- * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * SPDX-License-Identifier: ISC
- *
- */
-
-#include <dlfcn.h>
-#include <openssl/opensslv.h>
-#include <openssl/crypto.h>
-
-#include <string.h>
-#include <descrip.h>
-#include <libclidef.h>
-#include <stsdef.h>
-#include <errno.h>
-
-unsigned long LIB$SET_SYMBOL(
-    const struct dsc$descriptor_s * symbol,
-    const struct dsc$descriptor_s * value,
-    const unsigned long * table_type);
-
-int main(int argc, char ** argv) {
-
-
-void * libptr;
-const char * (*ssl_version)(int t);
-const char * version;
-
-   if(argc < 1) {
-       puts("report_openssl_version filename");
-       exit(1);
-   }
-
-   libptr = dlopen(argv[1], 0);
-
-   ssl_version = (const char * (*)(int))dlsym(libptr, "SSLeay_version");
-   if(ssl_version == NULL) {
-      ssl_version = (const char * (*)(int))dlsym(libptr, "ssleay_version");
-      if(ssl_version == NULL) {
-         ssl_version = (const char * (*)(int))dlsym(libptr, "SSLEAY_VERSION");
-      }
-   }
-
-   dlclose(libptr);
-
-   if(ssl_version == NULL) {
-      puts("Unable to lookup version of OpenSSL");
-      exit(1);
-   }
-
-   version = ssl_version(SSLEAY_VERSION);
-
-   puts(version);
-
-   /* Was a symbol argument given? */
-   if(argc > 1) {
-      int status;
-      struct dsc$descriptor_s symbol_dsc;
-      struct dsc$descriptor_s value_dsc;
-      const unsigned long table_type = LIB$K_CLI_LOCAL_SYM;
-
-      symbol_dsc.dsc$a_pointer = argv[2];
-      symbol_dsc.dsc$w_length = strlen(argv[2]);
-      symbol_dsc.dsc$b_dtype = DSC$K_DTYPE_T;
-      symbol_dsc.dsc$b_class = DSC$K_CLASS_S;
-
-      value_dsc.dsc$a_pointer = (char *)version; /* Cast ok */
-      value_dsc.dsc$w_length = strlen(version);
-      value_dsc.dsc$b_dtype = DSC$K_DTYPE_T;
-      value_dsc.dsc$b_class = DSC$K_CLASS_S;
-
-      status = LIB$SET_SYMBOL(&symbol_dsc, &value_dsc, &table_type);
-      if(!$VMS_STATUS_SUCCESS(status)) {
-         exit(status);
-      }
-   }
-
-   exit(0);
-}
diff --git a/third-party/curl/plan9/README b/third-party/curl/plan9/README
deleted file mode 100644
index 6df23d31a7..0000000000
--- a/third-party/curl/plan9/README
+++ /dev/null
@@ -1,55 +0,0 @@
-Prerequirement
-==============
-This document describes how to compile, build and install curl and libcurl
-from sources using mk. To build it, you will require to install latest
-9legacy patches into Plan 9. Also Plan 9 still have no configuration option so
-both zlib and libopenssl are required too.
-
-The zlib that is available on Plan 9 can be downloaded from:
-
-  https://github.com/madler/zlib/pull/398
-
-LibreSSL Portable can be downloaded from:
-
-  https://github.com/libressl-portable/portable/pull/510
-
-Instruction
-===========
-First, you should construct namespace as like described below:
-
-% bind -ac ../lib lib
-% bind -ac ../src src
-% bind -ac ../include include
-% bind -ac .. .
-
-Then you will see as shown below (excerpt):
-
-  curl.git/
-   |_plan9
-   | |_BUILD.PLAN9.txt
-   | |_CHANGES
-   | |_CMake
-   | |  :
-   | |_mkfile
-   | |_mkfile.proto
-   | |_include
-   | | |_Makefile.am
-   | | |  :
-   | | |_mkfile
-   | |_lib
-   | | |_CMakeLists.txt
-   | | |  :
-   | | |_mkfile
-   | | |_mkfile.inc
-   | |_src
-   | | |_CMakeLists.txt
-   | | |  :
-   | | |_mkfile
-   | | |_mkfile.inc
-   |_lib
-   |_src
-
-After constructing namespace, you can run mk on plan9 directory.
-
-% mk
-% mk install
diff --git a/third-party/curl/plan9/include/mkfile b/third-party/curl/plan9/include/mkfile
deleted file mode 100644
index a0970e932a..0000000000
--- a/third-party/curl/plan9/include/mkfile
+++ /dev/null
@@ -1,36 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-DIR=/sys/include/ape/curl
-HFILES=`{ls curl/*.h}
-
-all:V: $HFILES
-
-install:V: all
-	mkdir -p $DIR
-	cp curl/*.h $DIR/
-
-clean:V: $HFILES  # do nothing
-
-nuke:V: clean
diff --git a/third-party/curl/plan9/lib/mkfile b/third-party/curl/plan9/lib/mkfile
deleted file mode 100644
index 04b54a8378..0000000000
--- a/third-party/curl/plan9/lib/mkfile
+++ /dev/null
@@ -1,41 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-<../mkfile.proto
-<|mkfile.inc
-
-CFLAGS=$CFLAGS -I../include -I. -c
-
-OFILES=${CSOURCES:%.c=%.$O}
-HFILES=$HHEADERS
-LIB=/$objtype/lib/ape/libcurl.a
-
-CLEANFILES=\
-	${LIB_VAUTH_CFILES:%.c=%.$O}\
-	${LIB_VTLS_CFILES:%.c=%.$O}\
-
-</sys/src/cmd/mklib
-
-%.$O: %.c
-	$CC $CFLAGS -o $target $stem.c
diff --git a/third-party/curl/plan9/lib/mkfile.inc b/third-party/curl/plan9/lib/mkfile.inc
deleted file mode 100644
index 5c2cc128f7..0000000000
--- a/third-party/curl/plan9/lib/mkfile.inc
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/bin/rc
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-# rename $(VAR) -> $VAR
-sed 's/\$\(([A-Z_]+)\)/$\1/g' Makefile.inc
diff --git a/third-party/curl/plan9/mkfile b/third-party/curl/plan9/mkfile
deleted file mode 100644
index 2133a49702..0000000000
--- a/third-party/curl/plan9/mkfile
+++ /dev/null
@@ -1,38 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-</sys/src/ape/config
-
-DIRS=\
-	lib\
-	src\
-	include\
-
-default:V: all
-
-all install clean nuke:V:
-	for(i in $DIRS) @{
-		cd $i
-		mk $target
-	}
diff --git a/third-party/curl/plan9/mkfile.proto b/third-party/curl/plan9/mkfile.proto
deleted file mode 100644
index 4ad41a1c71..0000000000
--- a/third-party/curl/plan9/mkfile.proto
+++ /dev/null
@@ -1,32 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-</sys/src/ape/config
-
-CFLAGS=\
-	-D__PLAN9__\
-	-D_POSIX_SOURCE\
-	-D_BSD_EXTENSION\
-	-D_SUSV2_SOURCE\
-	-D_REENTRANT_SOURCE\
diff --git a/third-party/curl/plan9/src/mkfile b/third-party/curl/plan9/src/mkfile
deleted file mode 100644
index beb98cbd60..0000000000
--- a/third-party/curl/plan9/src/mkfile
+++ /dev/null
@@ -1,47 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-<../mkfile.proto
-<|mkfile.inc
-
-CFLAGS=$CFLAGS -I../include -I../lib -c
-
-OFILES=${CURL_CFILES:%.c=%.$O}
-HFILES=$CURL_HFILES
-
-LIB=\
-	/$objtype/lib/ape/libcurl.a\
-	/$objtype/lib/ape/libssl.a\
-	/$objtype/lib/ape/libcrypto.a\
-	/$objtype/lib/ape/libz.a\
-
-BIN=/$objtype/bin
-TARG=curl
-
-CLEANFILES=tool_hugehelp.c
-
-</sys/src/cmd/mkone
-
-tool_hugehelp.c:
-	echo 'void hugehelp(void) {}' >$target
diff --git a/third-party/curl/plan9/src/mkfile.inc b/third-party/curl/plan9/src/mkfile.inc
deleted file mode 100644
index 5c2cc128f7..0000000000
--- a/third-party/curl/plan9/src/mkfile.inc
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/bin/rc
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-# rename $(VAR) -> $VAR
-sed 's/\$\(([A-Z_]+)\)/$\1/g' Makefile.inc
diff --git a/third-party/curl/projects/Makefile.am b/third-party/curl/projects/Makefile.am
new file mode 100644
index 0000000000..bf7f3a05ab
--- /dev/null
+++ b/third-party/curl/projects/Makefile.am
@@ -0,0 +1,60 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+SUBDIRS = vms
+
+EXTRA_DIST = README.md \
+  OS400/.checksrc \
+  OS400/README.OS400 \
+  OS400/rpg-examples \
+  OS400/ccsidcurl.c \
+  OS400/ccsidcurl.h \
+  OS400/curlcl.c \
+  OS400/curlmain.c \
+  OS400/curl.inc.in \
+  OS400/initscript.sh \
+  OS400/config400.default \
+  OS400/make-docs.sh \
+  OS400/make-include.sh \
+  OS400/make-lib.sh \
+  OS400/make-src.sh \
+  OS400/make-tests.sh \
+  OS400/makefile.sh \
+  OS400/os400sys.c \
+  OS400/os400sys.h \
+  OS400/curl.cmd
+
+CHECKSRC = $(CS_$(V))
+CS_0 = @echo "  RUN     " $@;
+CS_1 =
+CS_ = $(CS_0)
+
+checksrc:
+	$(CHECKSRC)(@PERL@ $(top_srcdir)/scripts/checksrc.pl -D$(srcdir)/OS400 $(srcdir)/OS400/*.[ch])
+
+if NOT_CURL_CI
+if DEBUGBUILD
+# for debug builds, we scan the sources on all regular make invokes
+all-local: checksrc
+endif
+endif
diff --git a/third-party/curl/projects/OS400/.checksrc b/third-party/curl/projects/OS400/.checksrc
new file mode 100644
index 0000000000..e27d5729de
--- /dev/null
+++ b/third-party/curl/projects/OS400/.checksrc
@@ -0,0 +1,9 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+# Possibly not what we want, but cannot test, thus silence the warnings
+allowfunc calloc
+allowfunc free
+allowfunc malloc
+allowfunc realloc
diff --git a/third-party/curl/packages/OS400/README.OS400 b/third-party/curl/projects/OS400/README.OS400
similarity index 93%
rename from third-party/curl/packages/OS400/README.OS400
rename to third-party/curl/projects/OS400/README.OS400
index 38b2c7f06c..5d4b643a5e 100644
--- a/third-party/curl/packages/OS400/README.OS400
+++ b/third-party/curl/projects/OS400/README.OS400
@@ -4,10 +4,10 @@ Implementation notes:
   This is a true OS/400 ILE implementation, not a PASE implementation (for
 PASE, use AIX implementation).
 
-  The biggest problem with OS/400 is EBCDIC. Libcurl implements an internal
+  The biggest problem with OS/400 is EBCDIC. libcurl implements an internal
 conversion mechanism, but it has been designed for computers that have a
 single native character set. OS/400 default native character set varies
-depending on the country for which it has been localized. And more, a job
+depending on the country for which it has been localized. Further, a job
 may dynamically alter its "native" character set.
   Several characters that do not have fixed code in EBCDIC variants are
 used in libcurl strings. As a consequence, using the existing conversion
@@ -33,7 +33,7 @@ NOT converted, so text gathered this way is (probably !) ASCII.
   Another OS/400 problem comes from the fact that the last fixed argument of a
 vararg procedure may not be of type char, unsigned char, short or unsigned
 short. Enums that are internally implemented by the C compiler as one of these
-types are also forbidden. Libcurl uses enums as vararg procedure tagfields...
+types are also forbidden. libcurl uses enums as vararg procedure tagfields...
 Happily, there is a pragma forcing enums to type "int". The original libcurl
 header files are thus altered during build process to use this pragma, in
 order to force libcurl enums of being type int (the pragma disposition in use
@@ -127,6 +127,7 @@ options:
         CURLOPT_SSLKEYTYPE
         CURLOPT_SSL_CIPHER_LIST
         CURLOPT_SSL_EC_CURVES
+        CURLOPT_SSL_SIGNATURE_ALGORITHMS
         CURLOPT_TLS13_CIPHERS
         CURLOPT_TLSAUTH_PASSWORD
         CURLOPT_TLSAUTH_TYPE
@@ -201,7 +202,7 @@ _ curl_pushheader_bynum_cssid() and curl_pushheader_byname_ccsid()
 should be released with curl_free() after use, as opposite to the non-ccsid
 versions of these procedures.
   Please note that HTTP2 is not (yet) implemented on OS/400, thus these
-functions will always return NULL.
+functions always return NULL.
 
 _ curl_easy_option_by_name_ccsid() returns a pointer to an untranslated option
 metadata structure. As each curl_easyoption structure holds the option name in
@@ -216,51 +217,43 @@ hout parameter is kept in libcurl's encoding and should not be altered.
 _ curl_from_ccsid() and curl_to_ccsid() are string encoding conversion
 functions between ASCII (latin1) and the given CCSID. The first parameter is
 the source string, the second is the CCSID and the returned value is a pointer
-to the dynamically allocated string. These functions do not impact on Curl's
+to the dynamically allocated string. These functions do not impact on curl's
 behavior and are only provided for user convenience. After use, returned values
 must be released with curl_free().
 
 
-  Standard compilation environment does support neither autotools nor make;
-in fact, very few common utilities are available. As a consequence, the
-config-os400.h has been coded manually and the compilation scripts are
-a set of shell scripts stored in subdirectory packages/OS400.
+  Standard compilation environment does support neither autotools nor make; in
+fact, few common utilities are available. As a consequence, the config-os400.h
+has been coded manually and the compilation scripts are a set of shell scripts
+stored in subdirectory projects/OS400.
 
-  The "curl" command and the test environment are currently not supported on
-OS/400.
+  The test environment is currently not supported on OS/400.
 
 
 Protocols currently implemented on OS/400:
 _ DICT
 _ FILE
 _ FTP
-_ FTPS
-_ FTP with secure transmission
 _ GOPHER
 _ HTTP
-_ HTTPS
 _ IMAP
-_ IMAPS
-_ IMAP with secure transmission
 _ LDAP
+_ MQTT
 _ POP3
-_ POP3S
-_ POP3 with secure transmission
 _ RTSP
 _ SCP if libssh2 is enabled
 _ SFTP if libssh2 is enabled
+_ SMB
 _ SMTP
-_ SMTPS
-_ SMTP with secure transmission
 _ TELNET
 _ TFTP
-
+_ WS
 
 
 Compiling on OS/400:
 
   These instructions targets people who knows about OS/400, compiling, IFS and
-archive extraction. Do not ask questions about these subjects if you're not
+archive extraction. Do not ask questions about these subjects if you are not
 familiar with.
 
 _ As a prerequisite, QADRT development environment must be installed.
@@ -269,12 +262,12 @@ _ As a prerequisite, QADRT development environment must be installed.
 _ If data compression has to be supported, ZLIB development environment must
   be installed.
 _ Likewise, if SCP and SFTP protocols have to be compiled in, LIBSSH2
-  developent environment must be installed.
+  development environment must be installed.
 _ Install the curl source directory in IFS. Do NOT install it in the
   installation target directory (which defaults to /curl).
 _ Enter Qshell (QSH, not PASE)
 _ Change current directory to the curl installation directory
-_ Change current directory to ./packages/OS400
+_ Change current directory to ./projects/OS400
 - If you want to change the default configuration parameters like debug info
   generation, optimization level, listing option, target library, ZLIB/LIBSSH2
   availability and location, etc., copy file config400.default to
@@ -287,20 +280,20 @@ _ Enter the command "sh makefile.sh > makelog 2>&1"
 _ Examine the makelog file to check for compilation errors. CZM0383 warnings on
   C or system standard API come from QADRT inlining and can safely be ignored.
 
-  Without configuration parameters override, this will produce the following
+  Without configuration parameters override, this produces the following
 OS/400 objects:
-_ Library CURL. All other objects will be stored in this library.
+_ libcurl. All other objects are stored in this library.
 _ Modules for all libcurl units.
 _ Binding directory CURL_A, to be used at calling program link time for
   statically binding the modules (specify BNDSRVPGM(QADRTTS QGLDCLNT QGLDBRDR)
   when creating a program using CURL_A).
 _ Service program CURL.<soname>, where <soname> is extracted from the
-  lib/Makefile.am VERSION variable. To be used at calling program run-time
+  lib/Makefile.am VERSION variable. To be used at calling program runtime
   when this program has dynamically bound curl at link time.
 _ Binding directory CURL. To be used to dynamically bind libcurl when linking a
   calling program.
-- CLI tool bound program CURL.
-- CLI command CURL.
+- CLI tool bound program curl.
+- CLI command curl.
 _ Source file H. It contains all the include members needed to compile a C/C++
   module using libcurl, and an ILE/RPG /copy member for support in this
   language.
@@ -328,7 +321,6 @@ _ Do not use original source include files unless you know what you are doing.
   /curl/include/curl).
 
 
-
 ILE/RPG support:
 
   Since most of the ILE OS/400 programmers use ILE/RPG exclusively, a
diff --git a/third-party/curl/projects/OS400/ccsidcurl.c b/third-party/curl/projects/OS400/ccsidcurl.c
new file mode 100644
index 0000000000..cba89f8642
--- /dev/null
+++ b/third-party/curl/projects/OS400/ccsidcurl.c
@@ -0,0 +1,1471 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ *
+ ***************************************************************************/
+
+/* CCSID API wrappers for OS/400. */
+
+#include <iconv.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stddef.h>
+#include <errno.h>
+#include <stdarg.h>
+
+#pragma enum(int)
+
+#include "curl.h"
+#include "mprintf.h"
+#include "slist.h"
+#include "urldata.h"
+#include "url.h"
+#include "setopt.h"
+#include "getinfo.h"
+#include "ccsidcurl.h"
+
+#include "os400sys.h"
+
+#ifndef SIZE_MAX
+#define SIZE_MAX ((size_t)~0)   /* Is unsigned on OS/400. */
+#endif
+
+#define ASCII_CCSID         819     /* Use ISO-8859-1 as ASCII. */
+#define NOCONV_CCSID        65535   /* No conversion. */
+#define ICONV_ID_SIZE       32 /* Size of iconv_open() code identifier. */
+#define ICONV_OPEN_ERROR(t) ((t).return_value == -1)
+
+#define ALLOC_GRANULE 8 /* Alloc. granule for curl_formadd_ccsid(). */
+
+static void makeOS400IconvCode(char buf[ICONV_ID_SIZE], unsigned int ccsid)
+{
+  /**
+  *** Convert a CCSID to the corresponding IBM iconv_open() character
+  ***  code identifier.
+  ***  This code is specific to the OS400 implementation of the iconv library.
+  ***  CCSID 65535 (no conversion) is replaced by the ASCII CCSID.
+  ***  CCSID 0 is interpreted by the OS400 as the job's CCSID.
+  **/
+
+  ccsid &= 0xFFFF;
+
+  if(ccsid == NOCONV_CCSID)
+    ccsid = ASCII_CCSID;
+
+  memset(buf, 0, ICONV_ID_SIZE);
+  curl_msprintf(buf, "IBMCCSID%05u0000000", ccsid);
+}
+
+static iconv_t iconv_open_CCSID(unsigned int ccsidout, unsigned int ccsidin,
+                                unsigned int cstr)
+{
+  char fromcode[ICONV_ID_SIZE];
+  char tocode[ICONV_ID_SIZE];
+
+  /**
+  ***  Like iconv_open(), but character codes are given as CCSIDs.
+  ***  If `cstr' is non-zero, conversion is set up to stop whenever a
+  ***   null character is encountered.
+  ***  See iconv_open() IBM description in "National Language Support API".
+  **/
+
+  makeOS400IconvCode(fromcode, ccsidin);
+  makeOS400IconvCode(tocode, ccsidout);
+  memset(tocode + 13, 0, sizeof(tocode) - 13); /* Dest. code id format. */
+
+  if(cstr)
+    fromcode[18] = '1'; /* Set null-terminator flag. */
+
+  return iconv_open(tocode, fromcode);
+}
+
+static int convert(char *d, size_t dlen, int dccsid, const char *s, int slen,
+                   int sccsid)
+{
+  int i;
+  iconv_t cd;
+  size_t lslen;
+
+  /**
+  ***  Convert `sccsid'-coded `slen'-data bytes at `s' into `dccsid'-coded
+  ***   data stored in the `dlen'-byte buffer at `d'.
+  ***  If `slen' < 0, source string is null-terminated.
+  ***  CCSID 65535 (no conversion) is replaced by the ASCII CCSID.
+  ***  Return the converted destination byte count, or -1 if error.
+  **/
+
+  if(sccsid == 65535)
+    sccsid = ASCII_CCSID;
+
+  if(dccsid == 65535)
+    dccsid = ASCII_CCSID;
+
+  if(sccsid == dccsid) {
+    lslen = slen >= 0 ? slen : strlen(s) + 1;
+    i = lslen < dlen ? lslen : dlen;
+
+    if(s != d && i > 0)
+      memcpy(d, s, i);
+
+    return i;
+  }
+
+  if(slen < 0) {
+    lslen = 0;
+    cd = iconv_open_CCSID(dccsid, sccsid, 1);
+  }
+  else {
+    lslen = (size_t)slen;
+    cd = iconv_open_CCSID(dccsid, sccsid, 0);
+  }
+
+  if(ICONV_OPEN_ERROR(cd))
+    return -1;
+
+  i = dlen;
+
+  if((int)iconv(cd, (char **)&s, &lslen, &d, &dlen) < 0)
+    i = -1;
+  else
+    i -= dlen;
+
+  iconv_close(cd);
+  return i;
+}
+
+static char *dynconvert(int dccsid, const char *s, int slen, int sccsid,
+                        int *olen)
+{
+  char *d;
+  char *cp;
+  size_t dlen;
+  int l;
+  static const char nullbyte = 0;
+
+  /* Like convert, but the destination is allocated and returned. */
+
+  dlen = (size_t)(slen < 0 ? strlen(s) : slen) + 1;
+  dlen *= MAX_CONV_EXPANSION; /* Allow some expansion. */
+  d = malloc(dlen);
+
+  if(!d)
+    return (char *)NULL;
+
+  l = convert(d, dlen, dccsid, s, slen, sccsid);
+
+  if(l < 0) {
+    free(d);
+    return (char *)NULL;
+  }
+
+  if(slen < 0) {
+    /* Need to null-terminate even when source length is given.
+       Since destination code size is unknown, use a conversion to generate
+       terminator. */
+
+    int l2 = convert(d + l, dlen - l, dccsid, &nullbyte, -1, ASCII_CCSID);
+
+    if(l2 < 0) {
+      free(d);
+      return (char *)NULL;
+    }
+
+    l += l2;
+  }
+
+  if((size_t)l < dlen) {
+    cp = realloc(d, l); /* Shorten to minimum needed. */
+
+    if(cp)
+      d = cp;
+  }
+  if(olen)
+    *olen = l;
+
+  return d;
+}
+
+static struct curl_slist *slist_convert(int dccsid, struct curl_slist *from,
+                                        int sccsid)
+{
+  struct curl_slist *to = (struct curl_slist *)NULL;
+
+  for(; from; from = from->next) {
+    struct curl_slist *nl;
+    char *cp = dynconvert(dccsid, from->data, -1, sccsid, NULL);
+
+    if(!cp) {
+      curl_slist_free_all(to);
+      return (struct curl_slist *)NULL;
+    }
+    nl = Curl_slist_append_nodup(to, cp);
+    if(!nl) {
+      curl_slist_free_all(to);
+      free(cp);
+      return NULL;
+    }
+    to = nl;
+  }
+  return to;
+}
+
+static char *keyed_string(localkey_t key, const char *ascii,
+                          unsigned int ccsid)
+{
+  int i;
+  char *ebcdic;
+
+  if(!ascii)
+    return (char *)NULL;
+
+  i = MAX_CONV_EXPANSION * (strlen(ascii) + 1);
+
+  ebcdic = Curl_thread_buffer(key, i);
+  if(!ebcdic)
+    return ebcdic;
+
+  if(convert(ebcdic, i, ccsid, ascii, -1, ASCII_CCSID) < 0)
+    return (char *)NULL;
+
+  return ebcdic;
+}
+
+const char *curl_to_ccsid(const char *s, unsigned int ccsid)
+{
+  if(s)
+    s = dynconvert(ccsid, s, -1, ASCII_CCSID, NULL);
+  return s;
+}
+
+const char *curl_from_ccsid(const char *s, unsigned int ccsid)
+{
+  if(s)
+    s = dynconvert(ASCII_CCSID, s, -1, ccsid, NULL);
+  return s;
+}
+
+char *curl_version_ccsid(unsigned int ccsid)
+{
+  return keyed_string(LK_CURL_VERSION, curl_version(), ccsid);
+}
+
+char *curl_easy_escape_ccsid(CURL *handle, const char *string, int length,
+                             unsigned int sccsid, unsigned int dccsid)
+{
+  char *s;
+  char *d;
+
+  if(!string) {
+    /* !checksrc! disable ERRNOVAR 1 */
+    errno = EINVAL;
+    return (char *)NULL;
+  }
+
+  s = dynconvert(ASCII_CCSID, string, length ? length : -1, sccsid, NULL);
+
+  if(!s)
+    return (char *)NULL;
+
+  d = curl_easy_escape(handle, s, 0);
+  free(s);
+
+  if(!d)
+    return (char *)NULL;
+
+  s = dynconvert(dccsid, d, -1, ASCII_CCSID, NULL);
+  free(d);
+  return s;
+}
+
+char *curl_easy_unescape_ccsid(CURL *handle, const char *string, int length,
+                               int *outlength, unsigned int sccsid,
+                               unsigned int dccsid)
+{
+  char *s;
+  char *d;
+
+  if(!string) {
+    /* !checksrc! disable ERRNOVAR 1 */
+    errno = EINVAL;
+    return (char *)NULL;
+  }
+
+  s = dynconvert(ASCII_CCSID, string, length ? length : -1, sccsid, NULL);
+
+  if(!s)
+    return (char *)NULL;
+
+  d = curl_easy_unescape(handle, s, 0, outlength);
+  free(s);
+
+  if(!d)
+    return (char *)NULL;
+
+  s = dynconvert(dccsid, d, -1, ASCII_CCSID, NULL);
+  free(d);
+
+  if(s && outlength)
+    *outlength = strlen(s);
+
+  return s;
+}
+
+struct curl_slist *curl_slist_append_ccsid(struct curl_slist *list,
+                                           const char *data,
+                                           unsigned int ccsid)
+{
+  char *s;
+
+  s = (char *)NULL;
+
+  if(!data)
+    return curl_slist_append(list, data);
+
+  s = dynconvert(ASCII_CCSID, data, -1, ccsid, NULL);
+
+  if(!s)
+    return (struct curl_slist *)NULL;
+
+  list = curl_slist_append(list, s);
+  free(s);
+  return list;
+}
+
+time_t curl_getdate_ccsid(const char *p, const time_t *unused,
+                          unsigned int ccsid)
+{
+  char *s;
+  time_t t;
+
+  if(!p)
+    return curl_getdate(p, unused);
+
+  s = dynconvert(ASCII_CCSID, p, -1, ccsid, NULL);
+
+  if(!s)
+    return (time_t)-1;
+
+  t = curl_getdate(s, unused);
+  free(s);
+  return t;
+}
+
+static int convert_version_info_string(const char **stringp, char **bufp,
+                                       int *left, unsigned int ccsid)
+{
+  /* Helper for curl_version_info_ccsid(): convert a string if defined.
+     Result is stored in the `*left'-byte buffer at `*bufp'.
+     `*bufp' and `*left' are updated accordingly.
+     Return 0 if ok, else -1. */
+
+  if(*stringp) {
+    int l = convert(*bufp, *left, ccsid, *stringp, -1, ASCII_CCSID);
+
+    if(l <= 0)
+      return -1;
+
+    *stringp = *bufp;
+    *bufp += l;
+    *left -= l;
+  }
+
+  return 0;
+}
+
+curl_version_info_data *curl_version_info_ccsid(CURLversion stamp,
+                                                unsigned int ccsid)
+{
+  curl_version_info_data *p;
+  char *cp;
+  int n;
+  int nproto;
+  curl_version_info_data *id;
+  int i;
+  const char **cpp;
+  static const size_t charfields[] = {
+    offsetof(curl_version_info_data, version),
+    offsetof(curl_version_info_data, host),
+    offsetof(curl_version_info_data, ssl_version),
+    offsetof(curl_version_info_data, libz_version),
+    offsetof(curl_version_info_data, ares),
+    offsetof(curl_version_info_data, libidn),
+    offsetof(curl_version_info_data, libssh_version),
+    offsetof(curl_version_info_data, brotli_version),
+    offsetof(curl_version_info_data, nghttp2_version),
+    offsetof(curl_version_info_data, quic_version),
+    offsetof(curl_version_info_data, cainfo),
+    offsetof(curl_version_info_data, capath),
+    offsetof(curl_version_info_data, zstd_version),
+    offsetof(curl_version_info_data, hyper_version),
+    offsetof(curl_version_info_data, gsasl_version),
+    offsetof(curl_version_info_data, feature_names),
+    offsetof(curl_version_info_data, rtmp_version)
+  };
+
+  /* The assertion below is possible, because although the second operand
+     is an enum member, the first is a #define. In that case, the OS/400 C
+     compiler seems to compare string values after substitution. */
+
+#if CURLVERSION_NOW != CURLVERSION_ELEVENTH
+#error curl_version_info_data structure has changed: upgrade this procedure.
+#endif
+
+  /* If caller has been compiled with a newer version, error. */
+
+  if(stamp > CURLVERSION_NOW)
+    return (curl_version_info_data *)NULL;
+
+  p = curl_version_info(stamp);
+
+  if(!p)
+    return p;
+
+  /* Measure thread space needed. */
+
+  n = 0;
+  nproto = 0;
+
+  if(p->protocols) {
+    while(p->protocols[nproto])
+      n += strlen(p->protocols[nproto++]);
+
+    n += nproto++;
+  }
+
+  for(i = 0; i < sizeof(charfields) / sizeof(charfields[0]); i++) {
+    cpp = (const char **)((char *)p + charfields[i]);
+    if(*cpp)
+      n += strlen(*cpp) + 1;
+  }
+
+  /* Allocate thread space. */
+
+  n *= MAX_CONV_EXPANSION;
+
+  if(nproto)
+    n += nproto * sizeof(const char *);
+
+  cp = Curl_thread_buffer(LK_VERSION_INFO_DATA, n);
+  id = (curl_version_info_data *)Curl_thread_buffer(LK_VERSION_INFO,
+                                                    sizeof(*id));
+
+  if(!id || !cp)
+    return (curl_version_info_data *)NULL;
+
+  /* Copy data and convert strings. */
+
+  memcpy((char *)id, (char *)p, sizeof(*p));
+
+  if(id->protocols) {
+    i = nproto * sizeof(id->protocols[0]);
+
+    id->protocols = (const char * const *)cp;
+    memcpy(cp, (char *)p->protocols, i);
+    cp += i;
+    n -= i;
+
+    for(i = 0; id->protocols[i]; i++)
+      if(convert_version_info_string(((const char **)id->protocols) + i,
+                                     &cp, &n, ccsid))
+        return (curl_version_info_data *)NULL;
+  }
+
+  for(i = 0; i < sizeof(charfields) / sizeof(charfields[0]); i++) {
+    cpp = (const char **)((char *)p + charfields[i]);
+    if(*cpp && convert_version_info_string(cpp, &cp, &n, ccsid))
+      return (curl_version_info_data *)NULL;
+  }
+
+  return id;
+}
+
+const char *curl_easy_strerror_ccsid(CURLcode error, unsigned int ccsid)
+{
+  return keyed_string(LK_EASY_STRERROR, curl_easy_strerror(error), ccsid);
+}
+
+const char *curl_share_strerror_ccsid(CURLSHcode error, unsigned int ccsid)
+{
+  return keyed_string(LK_SHARE_STRERROR, curl_share_strerror(error), ccsid);
+}
+
+const char *curl_multi_strerror_ccsid(CURLMcode error, unsigned int ccsid)
+{
+  return keyed_string(LK_MULTI_STRERROR, curl_multi_strerror(error), ccsid);
+}
+
+const char *curl_url_strerror_ccsid(CURLUcode error, unsigned int ccsid)
+{
+  return keyed_string(LK_URL_STRERROR, curl_url_strerror(error), ccsid);
+}
+
+void curl_certinfo_free_all(struct curl_certinfo *info)
+{
+  /* Free all memory used by certificate info. */
+  if(info) {
+    if(info->certinfo) {
+      int i;
+
+      for(i = 0; i < info->num_of_certs; i++)
+        curl_slist_free_all(info->certinfo[i]);
+      free((char *)info->certinfo);
+    }
+    free((char *)info);
+  }
+}
+
+CURLcode curl_easy_getinfo_ccsid(CURL *curl, CURLINFO info, ...)
+{
+  va_list arg;
+  void *paramp;
+  CURLcode result;
+  struct Curl_easy *data;
+
+  /* WARNING: unlike curl_easy_getinfo(), the strings returned by this
+     procedure have to be free'ed. */
+
+  data = (struct Curl_easy *)curl;
+  va_start(arg, info);
+  paramp = va_arg(arg, void *);
+  result = Curl_getinfo(data, info, paramp);
+
+  if(result == CURLE_OK) {
+    unsigned int ccsid;
+    char **cpp;
+    struct curl_slist **slp;
+    struct curl_certinfo *cipf;
+    struct curl_certinfo *cipt;
+
+    switch((int)info & CURLINFO_TYPEMASK) {
+
+    case CURLINFO_STRING:
+      ccsid = va_arg(arg, unsigned int);
+      cpp = (char **)paramp;
+
+      if(*cpp) {
+        *cpp = dynconvert(ccsid, *cpp, -1, ASCII_CCSID, NULL);
+
+        if(!*cpp)
+          result = CURLE_OUT_OF_MEMORY;
+      }
+
+      break;
+
+    case CURLINFO_SLIST:
+      ccsid = va_arg(arg, unsigned int);
+      switch(info) {
+      case CURLINFO_CERTINFO:
+        cipf = *(struct curl_certinfo **)paramp;
+        if(cipf) {
+          cipt = malloc(sizeof(*cipt));
+          if(!cipt)
+            result = CURLE_OUT_OF_MEMORY;
+          else {
+            cipt->certinfo = calloc(cipf->num_of_certs + 1,
+                                    sizeof(struct curl_slist *));
+            if(!cipt->certinfo)
+              result = CURLE_OUT_OF_MEMORY;
+            else {
+              int i;
+
+              cipt->num_of_certs = cipf->num_of_certs;
+              for(i = 0; i < cipf->num_of_certs; i++)
+                if(cipf->certinfo[i])
+                  if(!(cipt->certinfo[i] = slist_convert(ccsid,
+                                                         cipf->certinfo[i],
+                                                         ASCII_CCSID))) {
+                    result = CURLE_OUT_OF_MEMORY;
+                    break;
+                  }
+            }
+          }
+
+          if(result != CURLE_OK) {
+            curl_certinfo_free_all(cipt);
+            cipt = (struct curl_certinfo *)NULL;
+          }
+
+          *(struct curl_certinfo **)paramp = cipt;
+        }
+
+        break;
+
+      case CURLINFO_TLS_SESSION:
+      case CURLINFO_TLS_SSL_PTR:
+      case CURLINFO_SOCKET:
+        break;
+
+      default:
+        slp = (struct curl_slist **)paramp;
+        if(*slp) {
+          *slp = slist_convert(ccsid, *slp, ASCII_CCSID);
+          if(!*slp)
+            result = CURLE_OUT_OF_MEMORY;
+        }
+        break;
+      }
+    }
+  }
+
+  va_end(arg);
+  return result;
+}
+
+static int Curl_is_formadd_string(CURLformoption option)
+{
+  switch(option) {
+
+  case CURLFORM_FILENAME:
+  case CURLFORM_CONTENTTYPE:
+  case CURLFORM_BUFFER:
+  case CURLFORM_FILE:
+  case CURLFORM_FILECONTENT:
+  case CURLFORM_COPYCONTENTS:
+  case CURLFORM_COPYNAME:
+    return 1;
+  }
+
+  return 0;
+}
+
+static void Curl_formadd_release_local(struct curl_forms *forms, int nargs,
+                                       int skip)
+{
+  while(nargs--)
+    if(nargs != skip)
+      if(Curl_is_formadd_string(forms[nargs].option))
+        if(forms[nargs].value)
+          free((char *)forms[nargs].value);
+
+  free((char *)forms);
+}
+
+static int Curl_formadd_convert(struct curl_forms *forms, int formx,
+                                int lengthx, unsigned int ccsid)
+{
+  int l;
+  char *cp;
+  char *cp2;
+
+  if(formx < 0 || !forms[formx].value)
+    return 0;
+
+  if(lengthx >= 0)
+    l = (int)forms[lengthx].value;
+  else
+    l = strlen(forms[formx].value) + 1;
+
+  cp = malloc(MAX_CONV_EXPANSION * l);
+
+  if(!cp)
+    return -1;
+
+  l = convert(cp, MAX_CONV_EXPANSION * l, ASCII_CCSID, forms[formx].value, l,
+              ccsid);
+
+  if(l < 0) {
+    free(cp);
+    return -1;
+  }
+
+  cp2 = realloc(cp, l); /* Shorten buffer to the string size. */
+
+  if(cp2)
+    cp = cp2;
+
+  forms[formx].value = cp;
+
+  if(lengthx >= 0)
+    forms[lengthx].value = (char *)l; /* Update length after conversion. */
+
+  return l;
+}
+
+CURLFORMcode curl_formadd_ccsid(struct curl_httppost **httppost,
+                                struct curl_httppost **last_post, ...)
+{
+  va_list arg;
+  CURLformoption option;
+  CURLFORMcode result;
+  struct curl_forms *forms;
+  struct curl_forms *lforms;
+  struct curl_forms *tforms;
+  unsigned int lformlen;
+  const char *value;
+  unsigned int ccsid;
+  int nargs;
+  int namex;
+  int namelengthx;
+  int contentx;
+  int lengthx;
+  unsigned int contentccsid;
+  unsigned int nameccsid;
+
+  /* A single curl_formadd() call cannot be split in several calls to deal
+     with all parameters: the original parameters are thus copied to a local
+     curl_forms array and converted to ASCII when needed.
+     CURLFORM_PTRNAME is processed as if it were CURLFORM_COPYNAME.
+     CURLFORM_COPYNAME and CURLFORM_NAMELENGTH occurrence order in
+     parameters is not defined; for this reason, the actual conversion is
+     delayed to the end of parameter processing. The same applies to
+     CURLFORM_COPYCONTENTS/CURLFORM_CONTENTSLENGTH, but these may appear
+     several times in the parameter list; the problem resides here in knowing
+     which CURLFORM_CONTENTSLENGTH applies to which CURLFORM_COPYCONTENTS and
+     when we can be sure to have both info for conversion: end of parameter
+     list is such a point, but CURLFORM_CONTENTTYPE is also used here as a
+     natural separator between content data definitions; this seems to be
+     in accordance with FormAdd() behavior. */
+
+  /* Allocate the local curl_forms array. */
+
+  lformlen = ALLOC_GRANULE;
+  lforms = malloc(lformlen * sizeof(*lforms));
+
+  if(!lforms)
+    return CURL_FORMADD_MEMORY;
+
+  /* Process the arguments, copying them into local array, latching conversion
+     indexes and converting when needed. */
+
+  result = CURL_FORMADD_OK;
+  nargs = 0;
+  contentx = -1;
+  lengthx = -1;
+  namex = -1;
+  namelengthx = -1;
+  forms = (struct curl_forms *)NULL;
+  va_start(arg, last_post);
+
+  for(;;) {
+    /* Make sure there is still room for an item in local array. */
+
+    if(nargs >= lformlen) {
+      lformlen += ALLOC_GRANULE;
+      tforms = realloc(lforms, lformlen * sizeof(*lforms));
+
+      if(!tforms) {
+        result = CURL_FORMADD_MEMORY;
+        break;
+      }
+
+      lforms = tforms;
+    }
+
+    /* Get next option. */
+
+    if(forms) {
+      /* Get option from array. */
+
+      option = forms->option;
+      value = forms->value;
+      forms++;
+    }
+    else {
+      /* Get option from arguments. */
+
+      option = va_arg(arg, CURLformoption);
+
+      if(option == CURLFORM_END)
+        break;
+    }
+
+    /* Dispatch by option. */
+
+    switch(option) {
+
+    case CURLFORM_END:
+      forms = (struct curl_forms *)NULL; /* Leave array mode. */
+      continue;
+
+    case CURLFORM_ARRAY:
+      if(!forms) {
+        forms = va_arg(arg, struct curl_forms *);
+        continue;
+      }
+
+      result = CURL_FORMADD_ILLEGAL_ARRAY;
+      break;
+
+    case CURLFORM_COPYNAME:
+      option = CURLFORM_PTRNAME; /* Static for now. */
+
+    case CURLFORM_PTRNAME:
+      if(namex >= 0)
+        result = CURL_FORMADD_OPTION_TWICE;
+
+      namex = nargs;
+
+      if(!forms) {
+        value = va_arg(arg, char *);
+        nameccsid = (unsigned int)va_arg(arg, long);
+      }
+      else {
+        nameccsid = (unsigned int)forms->value;
+        forms++;
+      }
+
+      break;
+
+    case CURLFORM_COPYCONTENTS:
+      if(contentx >= 0)
+        result = CURL_FORMADD_OPTION_TWICE;
+
+      contentx = nargs;
+
+      if(!forms) {
+        value = va_arg(arg, char *);
+        contentccsid = (unsigned int)va_arg(arg, long);
+      }
+      else {
+        contentccsid = (unsigned int)forms->value;
+        forms++;
+      }
+
+      break;
+
+    case CURLFORM_PTRCONTENTS:
+    case CURLFORM_BUFFERPTR:
+      if(!forms)
+        value = va_arg(arg, char *); /* No conversion. */
+
+      break;
+
+    case CURLFORM_CONTENTSLENGTH:
+      lengthx = nargs;
+
+      if(!forms)
+        value = (char *)va_arg(arg, long);
+
+      break;
+
+    case CURLFORM_CONTENTLEN:
+      lengthx = nargs;
+
+      if(!forms)
+        value = (char *)va_arg(arg, curl_off_t);
+
+      break;
+
+    case CURLFORM_NAMELENGTH:
+      namelengthx = nargs;
+
+      if(!forms)
+        value = (char *)va_arg(arg, long);
+
+      break;
+
+    case CURLFORM_BUFFERLENGTH:
+      if(!forms)
+        value = (char *)va_arg(arg, long);
+
+      break;
+
+    case CURLFORM_CONTENTHEADER:
+      if(!forms)
+        value = (char *)va_arg(arg, struct curl_slist *);
+
+      break;
+
+    case CURLFORM_STREAM:
+      if(!forms)
+        value = (char *)va_arg(arg, void *);
+
+      break;
+
+    case CURLFORM_CONTENTTYPE:
+      /* If a previous content has been encountered, convert it now. */
+
+      if(Curl_formadd_convert(lforms, contentx, lengthx, contentccsid) < 0) {
+        result = CURL_FORMADD_MEMORY;
+        break;
+      }
+
+      contentx = -1;
+      lengthx = -1;
+      /* Fall into default. */
+
+    default:
+      /* Must be a convertible string. */
+
+      if(!Curl_is_formadd_string(option)) {
+        result = CURL_FORMADD_UNKNOWN_OPTION;
+        break;
+      }
+
+      if(!forms) {
+        value = va_arg(arg, char *);
+        ccsid = (unsigned int)va_arg(arg, long);
+      }
+      else {
+        ccsid = (unsigned int)forms->value;
+        forms++;
+      }
+
+      /* Do the conversion. */
+
+      lforms[nargs].value = value;
+
+      if(Curl_formadd_convert(lforms, nargs, -1, ccsid) < 0) {
+        result = CURL_FORMADD_MEMORY;
+        break;
+      }
+
+      value = lforms[nargs].value;
+    }
+
+    if(result != CURL_FORMADD_OK)
+      break;
+
+    lforms[nargs].value = value;
+    lforms[nargs++].option = option;
+  }
+
+  va_end(arg);
+
+  /* Convert the name and the last content, now that we know their lengths. */
+
+  if(result == CURL_FORMADD_OK && namex >= 0) {
+    if(Curl_formadd_convert(lforms, namex, namelengthx, nameccsid) < 0)
+      result = CURL_FORMADD_MEMORY;
+    else
+      lforms[namex].option = CURLFORM_COPYNAME; /* Force copy. */
+  }
+
+  if(result == CURL_FORMADD_OK) {
+    if(Curl_formadd_convert(lforms, contentx, lengthx, contentccsid) < 0)
+      result = CURL_FORMADD_MEMORY;
+    else
+      contentx = -1;
+  }
+
+  /* Do the formadd with our converted parameters. */
+
+  if(result == CURL_FORMADD_OK) {
+    lforms[nargs].option = CURLFORM_END;
+    result = curl_formadd(httppost, last_post,
+                          CURLFORM_ARRAY, lforms, CURLFORM_END);
+  }
+
+  /* Terminate. */
+
+  Curl_formadd_release_local(lforms, nargs, contentx);
+  return result;
+}
+
+struct cfcdata {
+  curl_formget_callback append;
+  void *                arg;
+  unsigned int          ccsid;
+};
+
+static size_t Curl_formget_callback_ccsid(void *arg, const char *buf,
+                                          size_t len)
+{
+  struct cfcdata *p;
+  char *b;
+  int l;
+  size_t ret;
+
+  p = (struct cfcdata *)arg;
+
+  if((long)len <= 0)
+    return (*p->append)(p->arg, buf, len);
+
+  b = malloc(MAX_CONV_EXPANSION * len);
+
+  if(!b)
+    return (size_t)-1;
+
+  l = convert(b, MAX_CONV_EXPANSION * len, p->ccsid, buf, len, ASCII_CCSID);
+
+  if(l < 0) {
+    free(b);
+    return (size_t)-1;
+  }
+
+  ret = (*p->append)(p->arg, b, l);
+  free(b);
+  return ret == l ? len : -1;
+}
+
+int curl_formget_ccsid(struct curl_httppost *form, void *arg,
+                       curl_formget_callback append, unsigned int ccsid)
+{
+  struct cfcdata lcfc;
+
+  lcfc.append = append;
+  lcfc.arg = arg;
+  lcfc.ccsid = ccsid;
+  return curl_formget(form, (void *)&lcfc, Curl_formget_callback_ccsid);
+}
+
+CURLcode curl_easy_setopt_ccsid(CURL *easy, CURLoption tag, ...)
+{
+  CURLcode result;
+  va_list arg;
+  char *s;
+  char *cp = NULL;
+  unsigned int ccsid;
+  curl_off_t pfsize;
+  struct Curl_easy *data = easy;
+
+  va_start(arg, tag);
+
+  switch(tag) {
+
+  /* BEGIN TRANSLATABLE STRING OPTIONS */
+  /* Keep option symbols in alphanumeric order and retain the BEGIN/END
+     armor comments. */
+  case CURLOPT_ABSTRACT_UNIX_SOCKET:
+  case CURLOPT_ACCEPT_ENCODING:
+  case CURLOPT_ALTSVC:
+  case CURLOPT_AWS_SIGV4:
+  case CURLOPT_CAINFO:
+  case CURLOPT_CAPATH:
+  case CURLOPT_COOKIE:
+  case CURLOPT_COOKIEFILE:
+  case CURLOPT_COOKIEJAR:
+  case CURLOPT_COOKIELIST:
+  case CURLOPT_CRLFILE:
+  case CURLOPT_CUSTOMREQUEST:
+  case CURLOPT_DEFAULT_PROTOCOL:
+  case CURLOPT_DNS_INTERFACE:
+  case CURLOPT_DNS_LOCAL_IP4:
+  case CURLOPT_DNS_LOCAL_IP6:
+  case CURLOPT_DNS_SERVERS:
+  case CURLOPT_DOH_URL:
+  case CURLOPT_ECH:
+  case CURLOPT_EGDSOCKET:
+  case CURLOPT_FTPPORT:
+  case CURLOPT_FTP_ACCOUNT:
+  case CURLOPT_FTP_ALTERNATIVE_TO_USER:
+  case CURLOPT_HAPROXY_CLIENT_IP:
+  case CURLOPT_HSTS:
+  case CURLOPT_INTERFACE:
+  case CURLOPT_ISSUERCERT:
+  case CURLOPT_KEYPASSWD:
+  case CURLOPT_KRBLEVEL:
+  case CURLOPT_LOGIN_OPTIONS:
+  case CURLOPT_MAIL_AUTH:
+  case CURLOPT_MAIL_FROM:
+  case CURLOPT_NETRC_FILE:
+  case CURLOPT_NOPROXY:
+  case CURLOPT_PASSWORD:
+  case CURLOPT_PINNEDPUBLICKEY:
+  case CURLOPT_PRE_PROXY:
+  case CURLOPT_PROTOCOLS_STR:
+  case CURLOPT_PROXY:
+  case CURLOPT_PROXYPASSWORD:
+  case CURLOPT_PROXYUSERNAME:
+  case CURLOPT_PROXYUSERPWD:
+  case CURLOPT_PROXY_CAINFO:
+  case CURLOPT_PROXY_CAPATH:
+  case CURLOPT_PROXY_CRLFILE:
+  case CURLOPT_PROXY_ISSUERCERT:
+  case CURLOPT_PROXY_KEYPASSWD:
+  case CURLOPT_PROXY_PINNEDPUBLICKEY:
+  case CURLOPT_PROXY_SERVICE_NAME:
+  case CURLOPT_PROXY_SSLCERT:
+  case CURLOPT_PROXY_SSLCERTTYPE:
+  case CURLOPT_PROXY_SSLKEY:
+  case CURLOPT_PROXY_SSLKEYTYPE:
+  case CURLOPT_PROXY_SSL_CIPHER_LIST:
+  case CURLOPT_PROXY_TLS13_CIPHERS:
+  case CURLOPT_PROXY_TLSAUTH_PASSWORD:
+  case CURLOPT_PROXY_TLSAUTH_TYPE:
+  case CURLOPT_PROXY_TLSAUTH_USERNAME:
+  case CURLOPT_RANDOM_FILE:
+  case CURLOPT_RANGE:
+  case CURLOPT_REDIR_PROTOCOLS_STR:
+  case CURLOPT_REFERER:
+  case CURLOPT_REQUEST_TARGET:
+  case CURLOPT_RTSP_SESSION_ID:
+  case CURLOPT_RTSP_STREAM_URI:
+  case CURLOPT_RTSP_TRANSPORT:
+  case CURLOPT_SASL_AUTHZID:
+  case CURLOPT_SERVICE_NAME:
+  case CURLOPT_SOCKS5_GSSAPI_SERVICE:
+  case CURLOPT_SSH_HOST_PUBLIC_KEY_MD5:
+  case CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256:
+  case CURLOPT_SSH_KNOWNHOSTS:
+  case CURLOPT_SSH_PRIVATE_KEYFILE:
+  case CURLOPT_SSH_PUBLIC_KEYFILE:
+  case CURLOPT_SSLCERT:
+  case CURLOPT_SSLCERTTYPE:
+  case CURLOPT_SSLENGINE:
+  case CURLOPT_SSLKEY:
+  case CURLOPT_SSLKEYTYPE:
+  case CURLOPT_SSL_CIPHER_LIST:
+  case CURLOPT_SSL_EC_CURVES:
+  case CURLOPT_SSL_SIGNATURE_ALGORITHMS:
+  case CURLOPT_TLS13_CIPHERS:
+  case CURLOPT_TLSAUTH_PASSWORD:
+  case CURLOPT_TLSAUTH_TYPE:
+  case CURLOPT_TLSAUTH_USERNAME:
+  case CURLOPT_UNIX_SOCKET_PATH:
+  case CURLOPT_URL:
+  case CURLOPT_USERAGENT:
+  case CURLOPT_USERNAME:
+  case CURLOPT_USERPWD:
+  case CURLOPT_XOAUTH2_BEARER:
+  /* END TRANSLATABLE STRING OPTIONS */
+    s = va_arg(arg, char *);
+    ccsid = va_arg(arg, unsigned int);
+
+    if(s) {
+      s = dynconvert(ASCII_CCSID, s, -1, ccsid, NULL);
+
+      if(!s) {
+        result = CURLE_OUT_OF_MEMORY;
+        break;
+      }
+    }
+
+    result = curl_easy_setopt(easy, tag, s);
+    free(s);
+    break;
+
+  case CURLOPT_COPYPOSTFIELDS:
+    /* Special case: byte count may have been given by CURLOPT_POSTFIELDSIZE
+       prior to this call. In this case, convert the given byte count and
+       replace the length according to the conversion result. */
+    s = va_arg(arg, char *);
+    ccsid = va_arg(arg, unsigned int);
+
+    pfsize = data->set.postfieldsize;
+
+    if(!s || !pfsize || ccsid == NOCONV_CCSID || ccsid == ASCII_CCSID) {
+      result = curl_easy_setopt(easy, CURLOPT_COPYPOSTFIELDS, s);
+      break;
+    }
+
+    if(pfsize == -1) {
+      /* Data is null-terminated. */
+      s = dynconvert(ASCII_CCSID, s, -1, ccsid, NULL);
+
+      if(!s) {
+        result = CURLE_OUT_OF_MEMORY;
+        break;
+      }
+    }
+    else {
+      /* Data length specified. */
+      size_t len;
+
+      if(pfsize < 0 || pfsize > SIZE_MAX) {
+        result = CURLE_OUT_OF_MEMORY;
+        break;
+      }
+
+      len = pfsize;
+      pfsize = len * MAX_CONV_EXPANSION;
+
+      if(pfsize > SIZE_MAX)
+        pfsize = SIZE_MAX;
+
+      cp = malloc(pfsize);
+
+      if(!cp) {
+        result = CURLE_OUT_OF_MEMORY;
+        break;
+      }
+
+      pfsize = convert(cp, pfsize, ASCII_CCSID, s, len, ccsid);
+
+      if(pfsize < 0) {
+        result = CURLE_OUT_OF_MEMORY;
+        break;
+      }
+
+      data->set.postfieldsize = pfsize; /* Replace data size. */
+      s = cp;
+      cp = NULL;
+    }
+
+    result = curl_easy_setopt(easy, CURLOPT_POSTFIELDS, s);
+    data->set.str[STRING_COPYPOSTFIELDS] = s; /* Give to library. */
+    break;
+
+  default:
+    if(tag / 10000 == CURLOPTTYPE_BLOB) {
+      struct curl_blob *bp = va_arg(arg, struct curl_blob *);
+      struct curl_blob blob;
+
+      ccsid = va_arg(arg, unsigned int);
+
+      if(bp && bp->data && bp->len &&
+         ccsid != NOCONV_CCSID && ccsid != ASCII_CCSID) {
+        pfsize = (curl_off_t)bp->len * MAX_CONV_EXPANSION;
+
+        if(pfsize > SIZE_MAX)
+          pfsize = SIZE_MAX;
+
+        cp = malloc(pfsize);
+
+        if(!cp) {
+          result = CURLE_OUT_OF_MEMORY;
+          break;
+        }
+
+        pfsize = convert(cp, pfsize, ASCII_CCSID, bp->data, bp->len, ccsid);
+
+        if(pfsize < 0) {
+          result = CURLE_OUT_OF_MEMORY;
+          break;
+        }
+
+        blob.data = cp;
+        blob.len = pfsize;
+        blob.flags = bp->flags | CURL_BLOB_COPY;
+        bp = &blob;
+      }
+      result = curl_easy_setopt(easy, tag, bp);
+      break;
+    }
+    FALLTHROUGH();
+  case CURLOPT_ERRORBUFFER: /* This is an output buffer. */
+    result = Curl_vsetopt(easy, tag, arg);
+    break;
+  }
+
+  va_end(arg);
+  free(cp);
+  return result;
+}
+
+/* ILE/RPG helper functions. */
+
+char *curl_form_long_value(long value)
+{
+  /* ILE/RPG cannot cast an integer to a pointer. This procedure does it. */
+
+  return (char *)value;
+}
+
+CURLcode curl_easy_setopt_RPGnum_(CURL *easy, CURLoption tag, curl_off_t arg)
+{
+  /* ILE/RPG procedure overloading cannot discriminate between different
+     size and/or signedness of format arguments. This provides a generic
+     wrapper that adapts size to the given tag expectation.
+     This procedure is not intended to be explicitly called from user code. */
+  if(tag / 10000 != CURLOPTTYPE_OFF_T)
+    return curl_easy_setopt(easy, tag, (long)arg);
+  return curl_easy_setopt(easy, tag, arg);
+}
+
+CURLcode curl_multi_setopt_RPGnum_(CURLM *multi, CURLMoption tag,
+                                   curl_off_t arg)
+{
+  /* Likewise, for multi handle. */
+  if(tag / 10000 != CURLOPTTYPE_OFF_T)
+    return curl_multi_setopt(multi, tag, (long)arg);
+  return curl_multi_setopt(multi, tag, arg);
+}
+
+char *curl_pushheader_bynum_cssid(struct curl_pushheaders *h, size_t num,
+                                  unsigned int ccsid)
+{
+  char *d = (char *)NULL;
+  char *s = curl_pushheader_bynum(h, num);
+
+  if(s)
+    d = dynconvert(ccsid, s, -1, ASCII_CCSID, NULL);
+
+  return d;
+}
+
+char *curl_pushheader_byname_ccsid(struct curl_pushheaders *h,
+                                   const char *header, unsigned int ccsidin,
+                                   unsigned int ccsidout)
+{
+  char *d = (char *)NULL;
+
+  if(header) {
+    header = dynconvert(ASCII_CCSID, header, -1, ccsidin, NULL);
+
+    if(header) {
+      char *s = curl_pushheader_byname(h, header);
+      free((char *)header);
+
+      if(s)
+        d = dynconvert(ccsidout, s, -1, ASCII_CCSID, NULL);
+    }
+  }
+
+  return d;
+}
+
+static CURLcode
+mime_string_call(curl_mimepart *part, const char *string, unsigned int ccsid,
+                 CURLcode (*mimefunc)(curl_mimepart *part, const char *string))
+{
+  char *s = (char *)NULL;
+  CURLcode result;
+
+  if(!string)
+    return mimefunc(part, string);
+  s = dynconvert(ASCII_CCSID, string, -1, ccsid, NULL);
+  if(!s)
+    return CURLE_OUT_OF_MEMORY;
+
+  result = mimefunc(part, s);
+  free(s);
+  return result;
+}
+
+CURLcode curl_mime_name_ccsid(curl_mimepart *part, const char *name,
+                              unsigned int ccsid)
+{
+  return mime_string_call(part, name, ccsid, curl_mime_name);
+}
+
+CURLcode curl_mime_filename_ccsid(curl_mimepart *part, const char *filename,
+                                  unsigned int ccsid)
+{
+  return mime_string_call(part, filename, ccsid, curl_mime_filename);
+}
+
+CURLcode curl_mime_type_ccsid(curl_mimepart *part, const char *mimetype,
+                              unsigned int ccsid)
+{
+  return mime_string_call(part, mimetype, ccsid, curl_mime_type);
+}
+
+CURLcode curl_mime_encoder_ccsid(curl_mimepart *part, const char *encoding,
+                                 unsigned int ccsid)
+{
+  return mime_string_call(part, encoding, ccsid, curl_mime_encoder);
+}
+
+CURLcode curl_mime_filedata_ccsid(curl_mimepart *part, const char *filename,
+                                  unsigned int ccsid)
+{
+  return mime_string_call(part, filename, ccsid, curl_mime_filedata);
+}
+
+CURLcode curl_mime_data_ccsid(curl_mimepart *part, const char *data,
+                              size_t datasize, unsigned int ccsid)
+{
+  char *s = (char *)NULL;
+  CURLcode result;
+  int osize;
+
+  if(!data)
+    return curl_mime_data(part, data, datasize);
+  s = dynconvert(ASCII_CCSID, data, datasize, ccsid, &osize);
+  if(!s)
+    return CURLE_OUT_OF_MEMORY;
+
+  result = curl_mime_data(part, s, osize);
+  free(s);
+  return result;
+}
+
+CURLUcode curl_url_get_ccsid(CURLU *handle, CURLUPart what, char **part,
+                             unsigned int flags, unsigned int ccsid)
+{
+  char *s = (char *)NULL;
+  CURLUcode result;
+
+  if(!part)
+    return CURLUE_BAD_PARTPOINTER;
+
+  *part = (char *)NULL;
+  result = curl_url_get(handle, what, &s, flags);
+  if(result == CURLUE_OK) {
+    if(s) {
+      *part = dynconvert(ccsid, s, -1, ASCII_CCSID, NULL);
+      if(!*part)
+        result = CURLUE_OUT_OF_MEMORY;
+    }
+  }
+  if(s)
+    free(s);
+  return result;
+}
+
+CURLUcode curl_url_set_ccsid(CURLU *handle, CURLUPart what, const char *part,
+                             unsigned int flags, unsigned int ccsid)
+{
+  char *s = (char *)NULL;
+  CURLUcode result;
+
+  if(part) {
+    s = dynconvert(ASCII_CCSID, part, -1, ccsid, NULL);
+    if(!s)
+      return CURLUE_OUT_OF_MEMORY;
+  }
+  result = curl_url_set(handle, what, s, flags);
+  if(s)
+    free(s);
+  return result;
+}
+
+const struct curl_easyoption *
+curl_easy_option_by_name_ccsid(const char *name, unsigned int ccsid)
+{
+  const struct curl_easyoption *option = NULL;
+
+  if(name) {
+    char *s = dynconvert(ASCII_CCSID, name, -1, ccsid, NULL);
+
+    if(s) {
+      option = curl_easy_option_by_name(s);
+      free(s);
+    }
+  }
+
+  return option;
+}
+
+/* Return option name in the given ccsid. */
+const char *
+curl_easy_option_get_name_ccsid(const struct curl_easyoption *option,
+                                unsigned int ccsid)
+{
+  char *name = NULL;
+
+  if(option && option->name)
+    name = dynconvert(ccsid, option->name, -1, ASCII_CCSID, NULL);
+
+  return (const char *)name;
+}
+
+/* Header API CCSID support. */
+CURLHcode curl_easy_header_ccsid(CURL *easy, const char *name, size_t index,
+                                 unsigned int origin, int request,
+                                 struct curl_header **hout, unsigned int ccsid)
+{
+  CURLHcode result = CURLHE_BAD_ARGUMENT;
+
+  if(name) {
+    char *s = dynconvert(ASCII_CCSID, name, -1, ccsid, NULL);
+
+    result = CURLHE_OUT_OF_MEMORY;
+    if(s) {
+      result = curl_easy_header(easy, s, index, origin, request, hout);
+      free(s);
+    }
+  }
+
+  return result;
+}
diff --git a/third-party/curl/packages/OS400/ccsidcurl.h b/third-party/curl/projects/OS400/ccsidcurl.h
similarity index 99%
rename from third-party/curl/packages/OS400/ccsidcurl.h
rename to third-party/curl/projects/OS400/ccsidcurl.h
index ab01d32b85..f9e667a9e4 100644
--- a/third-party/curl/packages/OS400/ccsidcurl.h
+++ b/third-party/curl/projects/OS400/ccsidcurl.h
@@ -28,7 +28,6 @@
 #include "easy.h"
 #include "multi.h"
 
-
 CURL_EXTERN char *curl_version_ccsid(unsigned int ccsid);
 CURL_EXTERN char *curl_easy_escape_ccsid(CURL *handle,
                                          const char *string, int length,
diff --git a/third-party/curl/packages/OS400/config400.default b/third-party/curl/projects/OS400/config400.default
similarity index 97%
rename from third-party/curl/packages/OS400/config400.default
rename to third-party/curl/projects/OS400/config400.default
index 91a82771fb..4e7ddbac57 100644
--- a/third-party/curl/packages/OS400/config400.default
+++ b/third-party/curl/projects/OS400/config400.default
@@ -39,6 +39,7 @@ setenv OUTPUT           '*NONE'                 # Compilation output option.
 setenv TGTRLS           '*CURRENT'              # Target OS release.
 setenv IFSDIR           '/curl'                 # Installation IFS directory.
 setenv QADRTDIR         '/QIBM/ProdData/qadrt'  # QADRT IFS directory.
+setenv PASEPERL         '/QOpenSys/pkgs/bin/perl'       # PASE Perl interpreter.
 
 #       Define ZLIB availability and locations.
 
diff --git a/third-party/curl/packages/OS400/curl.cmd b/third-party/curl/projects/OS400/curl.cmd
similarity index 97%
rename from third-party/curl/packages/OS400/curl.cmd
rename to third-party/curl/projects/OS400/curl.cmd
index 822f4db207..fa6aaa59a5 100644
--- a/third-party/curl/packages/OS400/curl.cmd
+++ b/third-party/curl/projects/OS400/curl.cmd
@@ -29,4 +29,4 @@
 
              PARM       KWD(CMDARGS) TYPE(*CHAR) LEN(5000) VARY(*YES *INT2)   +
                           CASE(*MIXED) EXPR(*YES) MIN(1)                      +
-                          PROMPT('Curl command arguments')
+                          PROMPT('curl command arguments')
diff --git a/third-party/curl/packages/OS400/curl.inc.in b/third-party/curl/projects/OS400/curl.inc.in
similarity index 95%
rename from third-party/curl/packages/OS400/curl.inc.in
rename to third-party/curl/projects/OS400/curl.inc.in
index d1254ce49d..f97f26e012 100644
--- a/third-party/curl/packages/OS400/curl.inc.in
+++ b/third-party/curl/projects/OS400/curl.inc.in
@@ -117,7 +117,7 @@
      d CURL_VERSION_CONV...
      d                 c                   X'00001000'
      d CURL_VERSION_CURLDEBUG...
-     d                 c                   X'00002000'
+     d                 c                   X'00002000'                          Deprecated
      d CURL_VERSION_TLSAUTH_SRP...
      d                 c                   X'00004000'
      d CURL_VERSION_NTLM_WB...
@@ -206,8 +206,10 @@
      d CURLAUTH_NTLM   c                   X'00000008'
      d CURLAUTH_DIGEST_IE...
      d                 c                   X'00000010'
+      /if not defined(CURL_NO_OLDIES)
      d CURLAUTH_NTLM_WB...
      d                 c                   X'00000020'
+      /endif
      d CURLAUTH_BEARER...
      d                 c                   X'00000040'
      d CURLAUTH_AWS_SIGV4...
@@ -364,6 +366,13 @@
       *
      d CURL_PUSH_OK    c                   0
      d CURL_PUSH_DENY  c                   1
+     d CURL_PUSH_ERROROUT...
+     d                 c                   2
+      *
+     d CURLMNOTIFY_INFO_READ...
+     d                 c                   0
+     d CURLMNOTIFY_EASY_DONE...
+     d                 c                   1
       *
      d CURLPAUSE_RECV  c                   X'00000001'
      d CURLPAUSE_RECV_CONT...
@@ -441,8 +450,12 @@
      d                 c                   X'00000400'
      d CURLU_ALLOW_SPACE...
      d                 c                   X'00000800'
-     d CURLU_PUNYCODE...
-     d                 c                   X'00001000'
+     d CURLU_PUNYCODE  c                   X'00001000'
+     d CURLU_PUNY2IDN  c                   X'00002000'
+     d CURLU_GET_EMPTY...
+     d                 c                   X'00004000'
+     d CURLU_NO_GUESS_SCHEME...
+     d                 c                   X'00008000'
       *
      d CURLOT_FLAG_ALIAS...
      d                 c                   X'00000001'
@@ -463,6 +476,8 @@
       *
      d CURLWS_RAW_MODE...
      d                 c                   X'00000001'
+     d CURLWS_NOAUTOPONG...
+     d                 c                   X'00000002'
       *
       **************************************************************************
       *                                Types
@@ -667,6 +682,10 @@
      d                 c                   98
      d  CURLE_UNRECOVERABLE_POLL...
      d                 c                   99
+     d  CURLE_TOO_LARGE...
+     d                 c                   100
+     d  CURLE_ECH_REQUIRED...
+     d                 c                   101
       *
       /if not defined(CURL_NO_OLDIES)
      d  CURLE_URL_MALFORMAT_USER...
@@ -911,17 +930,23 @@
      d                 c                   3
       *
      d CURLSSLOPT_ALLOW_BEAST...
-     d                 c                   X'0001'
+     d                 c                   X'00000001'
      d CURLSSLOPT_NO_REVOKE...
-     d                 c                   X'0002'
+     d                 c                   X'00000002'
      d CURLSSLOPT_NO_PARTIALCHAIN...
-     d                 c                   X'0004'
+     d                 c                   X'00000004'
      d CURLSSLOPT_REVOKE_BEST_EFFORT...
-     d                 c                   X'0008'
+     d                 c                   X'00000008'
      d CURLSSLOPT_NATIVE_CA...
-     d                 c                   X'0010'
+     d                 c                   X'00000010'
      d CURLSSLOPT_AUTO_CLIENT_CERT...
-     d                 c                   X'0020'
+     d                 c                   X'00000020'
+      *
+     d CURLFOLLOW_ALL  c                   1
+     d CURLFOLLOW_OBEYCODE...
+     d                 c                   2
+     d CURLFOLLOW_FIRSTONLY...
+     d                 c                   3
       *
      d CURL_HET_DEFAULT...
      d                 c                   200
@@ -991,6 +1016,17 @@
      d  CURLALTSVC_H3...
      d                 c                   X'00000020'
       *
+     d  CURLULFLAG_ANSWERED...
+     d                 c                   X'00000001'
+     d  CURLULFLAG_DELETED...
+     d                 c                   X'00000002'
+     d  CURLULFLAG_DRAFT...
+     d                 c                   X'00000004'
+     d  CURLULFLAG_FLAGGED...
+     d                 c                   X'00000008'
+     d  CURLULFLAG_SEEN...
+     d                 c                   X'00000010'
+      *
      d  CURLHSTS_ENABLE...
      d                 c                   X'00000001'
      d  CURLHSTS_READONLYFILE...
@@ -1056,6 +1092,9 @@
      d                 c                   X'10000000'
      d  CURLPROTO_GOPHERS...
      d                 c                   X'20000000'
+     d  CURLPROTO_MQTTS...
+     d                 c                   X'40000000'
+     d  CURLPROTO_ALL  c                   X'FFFFFFFF'
       *
      d CURLoption      s             10i 0 based(######ptr######)               Enum
      d  CURLOPT_WRITEDATA...
@@ -1655,6 +1694,17 @@
      d                 c                   00321
      d  CURLOPT_QUICK_EXIT...
      d                 c                   00322
+     d  CURLOPT_HAPROXY_CLIENT_IP...
+     d                 c                   10323
+     d  CURLOPT_SERVER_RESPONSE_TIMEOUT_MS...
+     d                 c                   00324
+     d  CURLOPT_ECH    c                   10325
+     d  CURLOPT_TCP_KEEPCNT...
+     d                 c                   00326
+     d  CURLOPT_UPLOAD_FLAGS...
+     d                 c                   00327
+     d  CURLOPT_SSL_SIGNATURE_ALGORITHMS...
+     d                 c                   10328
       *
       /if not defined(CURL_NO_OLDIES)
      d  CURLOPT_FILE   c                   10001
@@ -1890,6 +1940,14 @@
      d                 c                   X'0010003D'
      d  CURLINFO_CAPATH...                                                      CURLINFO_STRING + 62
      d                 c                   X'0010003E'
+     d  CURLINFO_XFER_ID...                                                     CURLINFO_OFF_T  + 63
+     d                 c                   X'0060003F'
+     d  CURLINFO_CONN_ID...                                                     CURLINFO_OFF_T  + 64
+     d                 c                   X'00600040'
+     d  CURLINFO_QUEUE_TIME_T...                                                CURLINFO_OFF_T  + 65
+     d                 c                   X'00600041'
+     d  CURLINFO_USED_PROXY...                                                  CURLINFO_LONG + 66
+     d                 c                   X'00200042'
       *
      d  CURLINFO_HTTP_CODE...                                                   Old ...RESPONSE_CODE
      d                 c                   X'00200002'
@@ -2053,8 +2111,10 @@
      d                 c                   9
      d  CURLVERSION_ELEVENTH...
      d                 c                   10
+     d  CURLVERSION_TWELFTH...
+     d                 c                   11
      d  CURLVERSION_NOW...
-     d                 c                   10                                   CURLVERSION_ELEVENTH
+     d                 c                   11                                   CURLVERSION_ELEVENTH
       *
      d CURLHcode       s             10i 0 based(######ptr######)               Enum
      d  CURLHE_OK      c                   0
@@ -2151,8 +2211,35 @@
      d                 c                   10015
      d  CURLMOPT_MAX_CONCURRENT_STREAMS...
      d                 c                   10016
+     d  CURLMOPT_NETWORK_CHANGED...
+     d                 c                   10017
+     d  CURLMOPT_NOTIFYFUNCTION...
+     d                 c                   20018
+     d  CURLMOPT_NOTIFYDATA...
+     d                 c                   10019
       *
-      * Bitmask bits for CURLMOPT_PIPELING.
+     d CURLMinfo_offt  s             10i 0 based(######ptr######)               Enum
+     d  CURLMINFO_NONE...
+     d                 c                   0
+     d  CURLMINFO_XFERS_CURRENT...
+     d                 c                   1
+     d  CURLMINFO_XFERS_RUNNING...
+     d                 c                   2
+     d  CURLMINFO_XFERS_PENDING...
+     d                 c                   3
+     d  CURLMINFO_XFERS_DONE...
+     d                 c                   4
+     d  CURLMINFO_XFERS_ADDED...
+     d                 c                   5
+      *
+      * Definition of bits for the CURLMOPT_NETWORK_CHANGED argument.
+      *
+     d CURLMNWC_CLEAR_CONNS...
+     d                 c                   x'00000001'
+     d CURLMNWC_CLEAR_DNS...
+     d                 c                   x'00000002'
+      *
+      * Bitmask bits for CURLMOPT_PIPELINING.
       *
      d CURLPIPE_NOTHING...
      d                 c                   x'00000000'
@@ -2251,6 +2338,8 @@
      d                 c                   29
      d  CURLUE_LACKS_IDN...
      d                 c                   30
+     d  CURLUE_TOO_LARGE...
+     d                 c                   31
       *
      d CURLUPart       s             10i 0 based(######ptr######)               Enum
      d  CURLUPART_URL  c                   0
@@ -2399,6 +2488,8 @@
      d  gsasl_version...
      d                                 *                                        const char *
      d  feature_names...
+     d                                 *                                        const char *
+     d  rtmp_version...
      d                                 *                                        const char *
       *
      d curl_certinfo   ds                  based(######ptr######)
@@ -2581,6 +2672,9 @@
      d                 s               *   based(######ptr######) procptr
       *
      d curl_ws_write_callback...
+     d                 s               *   based(######ptr######) procptr
+      *
+     d curl_notify_callback...
      d                 s               *   based(######ptr######) procptr
       *
       **************************************************************************
@@ -3001,6 +3095,14 @@
      d  running_handles...
      d                               10i 0
       *
+     d curl_multi_waitfds...
+     d                 pr                  extproc('curl_multi_waitfds')
+     d                                     like(CURLMcode)
+     d  multi                          *   value                                CURLM *
+     d  ufds                           *   value                                curl_waitfd *
+     d  size                         10u 0 value
+     d  fd_count                     10u 0
+      *
      d curl_multi_socket_action...
      d                 pr                  extproc('curl_multi_socket_action')
      d                                     like(CURLMcode)
@@ -3062,6 +3164,29 @@
      d  sockfd                             value like(curl_socket_t)
      d  sockp                          *   value                                void *
       *
+     d curl_multi_get_handles...
+     d                 pr              *   extproc('curl_multi_get_handles')    CURL **
+     d  multi_handle                   *   value                                CURLM *
+      *
+     d curl_multi_get_offt...
+     d                 pr                  extproc('curl_multi_get_offt')
+     d                                     like(CURLMcode)
+     d  multi_handle                   *   value                                CURLM *
+     d  info                               value like(CURLMinfo_offt)
+     d  pvalue                             like(curl_off_t)
+      *
+     d curl_multi_notify_disable...
+     d                 pr                  extproc('curl_multi_notify_disable')
+     d                                     like(CURLMcode)
+     d  multi_handle                   *   value                                CURLM *
+     d  notification                 10i 0 value
+      *
+     d curl_multi_notify_enable...
+     d                 pr                  extproc('curl_multi_notify_enable')
+     d                                     like(CURLMcode)
+     d  multi_handle                   *   value                                CURLM *
+     d  notification                 10i 0 value
+      *
      d curl_url        pr              *   extproc('curl_url')                  CURLU *
       *
      d curl_url_cleanup...
@@ -3121,6 +3246,12 @@
      d curl_ws_meta    pr              *   extproc('curl_ws_meta')              curl_ws_frame *
      d  curl                           *   value                                CURL *
       *
+     d curl_ws_start   pr                  extproc('curl_ws_start')
+     d                                     like(CURLcode)
+     d  curl                           *   value                                CURL *
+     d  flags                        10u 0 value
+     d  frame_len                          value like(curl_off_t)
+      *
      d curl_easy_header...
      d                 pr                  extproc('curl_easy_header')          curl_header *
      d                                     like(CURLHcode)
diff --git a/third-party/curl/packages/OS400/curlcl.c b/third-party/curl/projects/OS400/curlcl.c
similarity index 86%
rename from third-party/curl/packages/OS400/curlcl.c
rename to third-party/curl/projects/OS400/curlcl.c
index 02edcd63c0..8085307f31 100644
--- a/third-party/curl/packages/OS400/curlcl.c
+++ b/third-party/curl/projects/OS400/curlcl.c
@@ -48,16 +48,13 @@ struct arguments {
   struct vary2 *cmdargs;        /* Command line arguments. */
 };
 
-static int
-is_ifs(char c)
+static int is_ifs(char c)
 {
   return c == ' ' || c == '\t' || c == '\r' || c == '\n';
 }
 
-static int
-parse_command_line(const char *cmdargs, size_t len,
-                   size_t *argc, char **argv,
-                   size_t *argsize, char *argbuf)
+static int parse_command_line(const char *cmdargs, size_t len, size_t *argc,
+                              char **argv, size_t *argsize, char *argbuf)
 {
   const char *endline = cmdargs + len;
   char quote = '\0';
@@ -107,6 +104,7 @@ parse_command_line(const char *cmdargs, size_t len,
   }
 
   if(quote) {
+    /* !checksrc! disable BANNEDFUNC 1 */
     fprintf(stderr, "Unterminated quote: %c\n", quote);
     return -1;
   }
@@ -125,9 +123,7 @@ parse_command_line(const char *cmdargs, size_t len,
   return 0;
 }
 
-
-int
-main(int argsc, struct arguments *args)
+int main(int argsc, struct arguments *args)
 {
   size_t argc;
   char **argv;
@@ -153,20 +149,20 @@ main(int argsc, struct arguments *args)
 
   if(!exitcode) {
     /* Allocate space for parsed arguments. */
-    argv = (char **) malloc((argc + 1) * sizeof(*argv) + argsize);
+    argv = malloc((argc + 1) * sizeof(*argv) + argsize);
     if(!argv) {
       fputs("Memory allocation error\n", stderr);
       exitcode = -2;
     }
     else {
-      _SYSPTR pgmptr = rslvsp(WLI_PGM, (char *) CURLPGM, library, _AUTH_NONE);
-      _LU_Work_Area_T *luwrka = (_LU_Work_Area_T *) _LUWRKA();
+      _SYSPTR pgmptr = rslvsp(WLI_PGM, (char *)CURLPGM, library, _AUTH_NONE);
+      _LU_Work_Area_T *luwrka = (_LU_Work_Area_T *)_LUWRKA();
 
-      parse_command_line(args->cmdargs->string, args->cmdargs->len,
-                         &argc, argv, &argsize, (char *) (argv + argc + 1));
+      parse_command_line(args->cmdargs->string, args->cmdargs->len, &argc,
+                         argv, &argsize, (char *)(argv + argc + 1));
 
       /* Call program. */
-      _CALLPGMV((void *) &pgmptr, argv, argc);
+      _CALLPGMV((void *)&pgmptr, argv, argc);
       exitcode = luwrka->LU_RC;
 
       free(argv);
diff --git a/third-party/curl/packages/OS400/curlmain.c b/third-party/curl/projects/OS400/curlmain.c
similarity index 89%
rename from third-party/curl/packages/OS400/curlmain.c
rename to third-party/curl/projects/OS400/curlmain.c
index 1b030b7ca3..690e8c6221 100644
--- a/third-party/curl/packages/OS400/curlmain.c
+++ b/third-party/curl/projects/OS400/curlmain.c
@@ -41,15 +41,13 @@ extern int      QadrtFreeConversionTable(void);
 extern int      QadrtFreeEnviron(void);
 extern char *   setlocale_a(int, const char *);
 
-
 /* The ASCII main program. */
-extern int      main_a(int argc, char * * argv);
+extern int      main_a(int argc, char **argv);
 
 /* Global values of original EBCDIC arguments. */
 int             ebcdic_argc;
 char **         ebcdic_argv;
 
-
 int main(int argc, char **argv)
 {
   int i;
@@ -61,15 +59,15 @@ int main(int argc, char **argv)
   size_t inbytesleft;
   size_t outbytesleft;
   char dummybuf[128];
-  char tocode[32];
-  char fromcode[32];
+  /* To/From codes are 32-byte strings with
+     reserved fields initialized to ZEROs */
+  const char tocode[32]   = { "IBMCCSID01208" }; /* Use UTF-8. */
+  const char fromcode[32] = { "IBMCCSID000000000010" };
 
   ebcdic_argc = argc;
   ebcdic_argv = argv;
 
   /* Build the encoding converter. */
-  strncpy(tocode, "IBMCCSID01208", sizeof(tocode));      /* Use UTF-8. */
-  strncpy(fromcode, "IBMCCSID000000000010", sizeof(fromcode));
   cd = iconv_open(tocode, fromcode);
 
   /* Measure the arguments. */
@@ -85,13 +83,13 @@ int main(int argc, char **argv)
 
     /* Reset the shift state. */
     iconv(cd, NULL, &inbytesleft, &outbuf, &outbytesleft);
-   }
+  }
 
   /* Allocate memory for the ASCII arguments and vector. */
-  argv = (char **) malloc((argc + 1) * sizeof(*argv) + bytecount);
+  argv = malloc((argc + 1) * sizeof(*argv) + bytecount);
 
   /* Build the vector and convert argument encoding. */
-  outbuf = (char *) (argv + argc + 1);
+  outbuf = (char *)(argv + argc + 1);
   outbytesleft = bytecount;
 
   for(i = 0; i < argc; i++) {
@@ -112,7 +110,7 @@ int main(int argc, char **argv)
   i = main_a(argc, argv);
 
   /* Clean-up allocated items. */
-  free((char *) argv);
+  free((char *)argv);
   QadrtFreeConversionTable();
   QadrtFreeEnviron();
 
diff --git a/third-party/curl/packages/OS400/initscript.sh b/third-party/curl/projects/OS400/initscript.sh
similarity index 77%
rename from third-party/curl/packages/OS400/initscript.sh
rename to third-party/curl/projects/OS400/initscript.sh
index b75055a8dc..dcdcfa8000 100644
--- a/third-party/curl/packages/OS400/initscript.sh
+++ b/third-party/curl/projects/OS400/initscript.sh
@@ -33,14 +33,14 @@ setenv()
 {
         #       Define and export.
 
-        eval ${1}="${2}"
-        export ${1}
+        eval "${1}=${2}"
+        export "${1?}"
 }
 
 
 case "${SCRIPTDIR}" in
 /*)     ;;
-*)      SCRIPTDIR="`pwd`/${SCRIPTDIR}"
+*)      SCRIPTDIR="$(pwd)/${SCRIPTDIR}"
 esac
 
 while true
@@ -50,16 +50,16 @@ do      case "${SCRIPTDIR}" in
         esac
 done
 
-#  The script directory is supposed to be in $TOPDIR/packages/os400.
+#  The script directory is supposed to be in $TOPDIR/projects/os400.
 
-TOPDIR=`dirname "${SCRIPTDIR}"`
-TOPDIR=`dirname "${TOPDIR}"`
+TOPDIR=$(dirname "${SCRIPTDIR}")
+TOPDIR=$(dirname "${TOPDIR}")
 export SCRIPTDIR TOPDIR
 
 #  Extract the SONAME from the library makefile.
 
-SONAME=`sed -e '/^VERSIONCHANGE=/!d;s/^.*=\([0-9]*\).*/\1/'             \
-                                        < "${TOPDIR}/lib/Makefile.soname"`
+SONAME="$(sed -e '/^VERSIONCHANGE=/!d;s/^.*=\([0-9]*\).*/\1/'           \
+                                        < "${TOPDIR}/lib/Makefile.soname")"
 export SONAME
 
 #       Get OS/400 configuration parameters.
@@ -69,26 +69,29 @@ if [ -f "${SCRIPTDIR}/config400.override" ]
 then    . "${SCRIPTDIR}/config400.override"
 fi
 
+#       Check if perl available.
+{ [ -n "${PASEPERL}" ] && [ -x "${PASEPERL}" ]; } || PASEPERL=
+
 #       Need to get the version definitions.
 
-LIBCURL_VERSION=`grep '^#define  *LIBCURL_VERSION '                     \
+LIBCURL_VERSION=$(grep '^#define  *LIBCURL_VERSION '                    \
                         "${TOPDIR}/include/curl/curlver.h"              |
-                sed 's/.*"\(.*\)".*/\1/'`
-LIBCURL_VERSION_MAJOR=`grep '^#define  *LIBCURL_VERSION_MAJOR '         \
+                sed 's/.*"\(.*\)".*/\1/')
+LIBCURL_VERSION_MAJOR=$(grep '^#define  *LIBCURL_VERSION_MAJOR '        \
                         "${TOPDIR}/include/curl/curlver.h"              |
-                sed 's/^#define  *LIBCURL_VERSION_MAJOR  *\([^ ]*\).*/\1/'`
-LIBCURL_VERSION_MINOR=`grep '^#define  *LIBCURL_VERSION_MINOR '         \
+                sed 's/^#define  *LIBCURL_VERSION_MAJOR  *\([^ ]*\).*/\1/')
+LIBCURL_VERSION_MINOR=$(grep '^#define  *LIBCURL_VERSION_MINOR '        \
                         "${TOPDIR}/include/curl/curlver.h"              |
-                sed 's/^#define  *LIBCURL_VERSION_MINOR  *\([^ ]*\).*/\1/'`
-LIBCURL_VERSION_PATCH=`grep '^#define  *LIBCURL_VERSION_PATCH '         \
+                sed 's/^#define  *LIBCURL_VERSION_MINOR  *\([^ ]*\).*/\1/')
+LIBCURL_VERSION_PATCH=$(grep '^#define  *LIBCURL_VERSION_PATCH '        \
                         "${TOPDIR}/include/curl/curlver.h"              |
-                sed 's/^#define  *LIBCURL_VERSION_PATCH  *\([^ ]*\).*/\1/'`
-LIBCURL_VERSION_NUM=`grep '^#define  *LIBCURL_VERSION_NUM '             \
+                sed 's/^#define  *LIBCURL_VERSION_PATCH  *\([^ ]*\).*/\1/')
+LIBCURL_VERSION_NUM=$(grep '^#define  *LIBCURL_VERSION_NUM '            \
                         "${TOPDIR}/include/curl/curlver.h"              |
-                sed 's/^#define  *LIBCURL_VERSION_NUM  *0x\([^ ]*\).*/\1/'`
-LIBCURL_TIMESTAMP=`grep '^#define  *LIBCURL_TIMESTAMP '                 \
+                sed 's/^#define  *LIBCURL_VERSION_NUM  *0x\([^ ]*\).*/\1/')
+LIBCURL_TIMESTAMP=$(grep '^#define  *LIBCURL_TIMESTAMP '                \
                         "${TOPDIR}/include/curl/curlver.h"              |
-                sed 's/.*"\(.*\)".*/\1/'`
+                sed 's/.*"\(.*\)".*/\1/')
 export LIBCURL_VERSION
 export LIBCURL_VERSION_MAJOR LIBCURL_VERSION_MINOR LIBCURL_VERSION_PATCH
 export LIBCURL_VERSION_NUM LIBCURL_TIMESTAMP
@@ -119,7 +122,8 @@ action_needed()
 
 {
         [ ! -e "${1}" ] && return 0
-        [ "${2}" ] || return 1
+        [ -n "${2}" ] || return 1
+        # shellcheck disable=SC3013
         [ "${1}" -ot "${2}" ] && return 0
         return 1
 }
@@ -136,7 +140,7 @@ canonicalize_path()
 {
         if expr "${1}" : '^/' > /dev/null
         then    P="${1}"
-        else    P="`pwd`/${1}"
+        else    P="$(pwd)/${1}"
         fi
 
         R=
@@ -147,7 +151,7 @@ canonicalize_path()
         do      IFS="${IFSSAVE}"
                 case "${C}" in
                 .)      ;;
-                ..)     R=`expr "${R}" : '^\(.*/\)..*'`
+                ..)     R="$(expr "${R}" : '^\(.*/\)..*')"
                         ;;
                 ?*)     R="${R}${C}/"
                         ;;
@@ -156,7 +160,7 @@ canonicalize_path()
         done
 
         IFS="${IFSSAVE}"
-        echo "/`expr "${R}" : '^\(.*\)/'`"
+        echo "/$(expr "${R}" : '^\(.*\)/')"
 }
 
 
@@ -172,7 +176,7 @@ make_module()
         MODULES="${MODULES} ${1}"
         MODIFSNAME="${LIBIFSNAME}/${1}.MODULE"
         action_needed "${MODIFSNAME}" "${2}" || return 0;
-        SRCDIR=`dirname \`canonicalize_path "${2}"\``
+        SRCDIR="$(dirname "$(canonicalize_path "${2}")")"
 
         #       #pragma convert has to be in the source file itself, i.e.
         #               putting it in an include file makes it only active
@@ -180,18 +184,20 @@ make_module()
         #       Thus we build a temporary file with the pragma prepended to
         #               the source file and we compile that temporary file.
 
-        echo "#line 1 \"${2}\"" > __tmpsrcf.c
-        echo "#pragma convert(819)" >> __tmpsrcf.c
-        echo "#line 1" >> __tmpsrcf.c
-        cat "${2}" >> __tmpsrcf.c
-        CMD="CRTCMOD MODULE(${TARGETLIB}/${1}) SRCSTMF('__tmpsrcf.c')"
+        {
+                echo "#line 1 \"${2}\""
+                echo "#pragma convert(819)"
+                echo "#line 1"
+                cat "${2}"
+        } > "${1}"__819.c
+        CMD="CRTCMOD MODULE(${TARGETLIB}/${1}) SRCSTMF('${1}__819.c')"
         CMD="${CMD} SYSIFCOPT(*IFS64IO *ASYNCSIGNAL)"
 #       CMD="${CMD} OPTION(*INCDIRFIRST *SHOWINC *SHOWSYS)"
         CMD="${CMD} OPTION(*INCDIRFIRST)"
         CMD="${CMD} LOCALETYPE(*LOCALE) FLAG(10)"
         CMD="${CMD} INCDIR('${QADRTDIR}/include'"
         CMD="${CMD} '${TOPDIR}/include/curl' '${TOPDIR}/include' '${SRCDIR}'"
-        CMD="${CMD} '${TOPDIR}/packages/OS400'"
+        CMD="${CMD} '${TOPDIR}/projects/OS400'"
 
         if [ "${WITH_ZLIB}" != "0" ]
         then    CMD="${CMD} '${ZLIB_INCLUDE}'"
@@ -217,12 +223,15 @@ make_module()
         then    DEFINES="${DEFINES} USE_LIBSSH2"
         fi
 
-        if [ "${DEFINES}" ]
+        if [ -n "${DEFINES}" ]
         then    CMD="${CMD} DEFINE(${DEFINES})"
         fi
 
         CLcommand "${CMD}"
-        rm -f __tmpsrcf.c
+        if [ "${DEBUG}" = "*NONE" ]
+        then    rm -f "${1}"__819.c
+        fi
+        # shellcheck disable=SC2034
         LINK=YES
 }
 
@@ -272,16 +281,17 @@ versioned_copy()
 get_make_vars()
 
 {
-        eval "`sed -e ': begin'                                         \
-                -e '/\\\\$/{'                                           \
+        eval "$(sed -e ': begin'                                        \
+                -e '/\\$/{'                                             \
                 -e 'N'                                                  \
-                -e 's/\\\\\\n/ /'                                       \
+                -e 's/\\\n/ /'                                          \
                 -e 'b begin'                                            \
                 -e '}'                                                  \
-                -e '/^[A-Za-z_][A-Za-z0-9_]*[[:space:]]*=/!d'           \
-                -e 's/@\\([A-Za-z0-9_]*\\)@/${\\1}/g'                   \
-                -e 's/[[:space:]]*=[[:space:]]*/=/'                     \
-                -e 's/=\\(.*[^[:space:]]\\)[[:space:]]*$/=\\"\\1\\"/'   \
-                -e 's/\\\$(\\([^)]*\\))/\${\\1}/g'                      \
-                < \"${1}\"`"
+                -e 's/[[:space:]][[:space:]]*/ /g'                      \
+                -e '/^[A-Za-z_][A-Za-z0-9_]* *=/!d'                     \
+                -e 's/@\([A-Za-z0-9_]*\)@/${\1}/g'                      \
+                -e 's/ *= */=/'                                         \
+                -e 's/=\(.*[^ ]\) *$/="\1"/'                            \
+                -e 's/\$(\([^)]*\))/${\1}/g'                            \
+                < "${1}")"
 }
diff --git a/third-party/curl/projects/OS400/make-docs.sh b/third-party/curl/projects/OS400/make-docs.sh
new file mode 100644
index 0000000000..b79b19e928
--- /dev/null
+++ b/third-party/curl/projects/OS400/make-docs.sh
@@ -0,0 +1,65 @@
+#!/bin/sh
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+#       Documentation build script for the OS/400.
+#
+
+
+SCRIPTDIR=$(dirname "${0}")
+. "${SCRIPTDIR}/initscript.sh"
+
+[ -n "${PASEPERL}" ] || exit 0  # Perl needed for doc build.
+cd "${TOPDIR}/docs" || exit 1
+[ -d "${IFSDIR}/docs" ] || mkdir "${IFSDIR}/docs"
+
+
+#       Command line options.
+
+(
+        cd cmdline-opts || exit 1
+        MANPAGE=curl.1
+        TEXTPAGE=curl.txt
+        get_make_vars Makefile.inc
+        rm -f "${IFSDIR}/docs/${MANPAGE}" "${IFSDIR}/docs/${TEXTPAGE}"
+
+        #       Prepare online manual.
+        # shellcheck disable=SC2086
+        ${PASEPERL} "${TOPDIR}/scripts/managen" -c 75                   \
+                listhelp ${DPAGES} > "${TOPDIR}/src/tool_listhelp.c"
+
+        #       Generate text manual and copy it to DB2.
+        # shellcheck disable=SC2086
+        ${PASEPERL} "${TOPDIR}/scripts/managen" -I "${TOPDIR}/include"  \
+               -c 75 ascii ${DPAGES} > "${IFSDIR}/docs/${TEXTPAGE}"
+        MEMBER="${LIBIFSNAME}/DOCS.FILE/MANUAL.MBR"
+        CMD="CPY OBJ('${IFSDIR}/docs/${TEXTPAGE}') TOOBJ('${MEMBER}')"
+        CMD="${CMD} TOCCSID(${TGTCCSID}) DTAFMT(*TEXT) REPLACE(*YES)"
+        CLcommand "${CMD}"
+
+#       Man page is useless as OS/400 has no man command.
+#       # shellcheck disable=SC2086
+#       ${PASEPERL} "${TOPDIR}/scripts/managen" -I "${TOPDIR}/include"  \
+#               mainpage ${DPAGES} > "${IFSDIR}/docs/${MANPAGE}"
+)
diff --git a/third-party/curl/packages/OS400/make-include.sh b/third-party/curl/projects/OS400/make-include.sh
similarity index 92%
rename from third-party/curl/packages/OS400/make-include.sh
rename to third-party/curl/projects/OS400/make-include.sh
index 30235eb790..e30e950539 100644
--- a/third-party/curl/packages/OS400/make-include.sh
+++ b/third-party/curl/projects/OS400/make-include.sh
@@ -26,9 +26,9 @@
 #       Installation of the header files in the OS/400 library.
 #
 
-SCRIPTDIR=`dirname "${0}"`
+SCRIPTDIR=$(dirname "${0}")
 . "${SCRIPTDIR}/initscript.sh"
-cd "${TOPDIR}/include"
+cd "${TOPDIR}/include" || exit 1
 
 
 #       Create the OS/400 source program file for the header files.
@@ -71,16 +71,16 @@ copy_hfile()
 #       Copy the header files.
 
 for HFILE in curl/*.h ${SCRIPTDIR}/ccsidcurl.h
-do      case "`basename \"${HFILE}\" .h`" in
+do      case "$(basename "${HFILE}" .h)" in
         stdcheaders|typecheck-gcc)
                 continue;;
         esac
 
-        DEST="${SRCPF}/`db2_name \"${HFILE}\" nomangle`.MBR"
+        DEST="${SRCPF}/$(db2_name "${HFILE}" nomangle).MBR"
 
         if action_needed "${DEST}" "${HFILE}"
         then    copy_hfile "${DEST}" "${HFILE}"
-                IFSDEST="${IFSINCLUDE}/`basename \"${HFILE}\"`"
+                IFSDEST="${IFSINCLUDE}/$(basename "${HFILE}")"
                 rm -f "${IFSDEST}"
                 ln -s "${DEST}" "${IFSDEST}"
         fi
diff --git a/third-party/curl/projects/OS400/make-lib.sh b/third-party/curl/projects/OS400/make-lib.sh
new file mode 100644
index 0000000000..cd3f71897f
--- /dev/null
+++ b/third-party/curl/projects/OS400/make-lib.sh
@@ -0,0 +1,181 @@
+#!/bin/sh
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+#       libcurl compilation script for the OS/400.
+#
+
+SCRIPTDIR=$(dirname "${0}")
+. "${SCRIPTDIR}/initscript.sh"
+cd "${TOPDIR}/lib" || exit 1
+
+#       Need to have IFS access to the mih/cipher header file.
+
+if action_needed cipher.mih '/QSYS.LIB/QSYSINC.LIB/MIH.FILE/CIPHER.MBR'
+then    rm -f cipher.mih
+        ln -s '/QSYS.LIB/QSYSINC.LIB/MIH.FILE/CIPHER.MBR' cipher.mih
+fi
+
+
+#      Create and compile the identification source file.
+
+{
+        echo '#pragma comment(user, "libcurl version '"${LIBCURL_VERSION}"'")'
+        echo '#pragma comment(user, __DATE__)'
+        echo '#pragma comment(user, __TIME__)'
+        echo '#pragma comment(copyright, "Copyright (C) Daniel Stenberg et al. OS/400 version by P. Monnerat")'
+} > os400.c
+make_module     OS400           os400.c         BUILDING_LIBCURL
+LINK=                           # No need to rebuild service program yet.
+MODULES=
+
+
+#       Get source list (CSOURCES variable).
+
+get_make_vars Makefile.inc
+
+
+#       Compile the sources into modules.
+
+# shellcheck disable=SC2034
+INCLUDES="'$(pwd)'"
+
+make_module     OS400SYS        "${SCRIPTDIR}/os400sys.c"       BUILDING_LIBCURL
+make_module     CCSIDCURL       "${SCRIPTDIR}/ccsidcurl.c"      BUILDING_LIBCURL
+
+for SRC in ${CSOURCES}
+do      MODULE=$(db2_name "${SRC}")
+        make_module "${MODULE}" "${SRC}" BUILDING_LIBCURL
+done
+
+
+#       If needed, (re)create the static binding directory.
+
+if action_needed "${LIBIFSNAME}/${STATBNDDIR}.BNDDIR"
+then    LINK=YES
+fi
+
+if [ -n "${LINK}" ]
+then    rm -rf "${LIBIFSNAME}/${STATBNDDIR}.BNDDIR"
+        CMD="CRTBNDDIR BNDDIR(${TARGETLIB}/${STATBNDDIR})"
+        CMD="${CMD} TEXT('libcurl API static binding directory')"
+        CLcommand "${CMD}"
+
+        for MODULE in ${MODULES}
+        do      CMD="ADDBNDDIRE BNDDIR(${TARGETLIB}/${STATBNDDIR})"
+                CMD="${CMD} OBJ((${TARGETLIB}/${MODULE} *MODULE))"
+                CLcommand "${CMD}"
+        done
+fi
+
+
+#       The exportation file for service program creation must be in a DB2
+#               source file, so make sure it exists.
+
+if action_needed "${LIBIFSNAME}/TOOLS.FILE"
+then    CMD="CRTSRCPF FILE(${TARGETLIB}/TOOLS) RCDLEN(112)"
+        CMD="${CMD} TEXT('curl: build tools')"
+        CLcommand "${CMD}"
+fi
+
+
+#       Gather the list of symbols to export.
+#       - Unfold lines from the header files so that they contain a semicolon.
+#       - Keep only CURL_EXTERN definitions.
+#       - Remove the CURL_DEPRECATED and CURL_TEMP_PRINTF macro calls.
+#       - Drop the parenthesized function arguments and what follows.
+#       - Keep the trailing function name only.
+
+EXPORTS=$(cat "${TOPDIR}"/include/curl/*.h "${SCRIPTDIR}/ccsidcurl.h"   |
+         sed -e 'H;s/.*//;x;s/\n//;s/.*/& /'                            \
+             -e '/^CURL_EXTERN[[:space:]]/!d'                           \
+             -e '/\;/!{x;d;}'                                           \
+             -e 's/ CURL_DEPRECATED([^)]*)//g'                          \
+             -e 's/ CURL_TEMP_PRINTF([^)]*)//g'                         \
+             -e 's/[[:space:]]*(.*$//'                                  \
+             -e 's/^.*[^A-Za-z0-9_]\([A-Za-z0-9_]*\)$/\1/')
+
+
+#       Create the service program exportation file in DB2 member if needed.
+
+BSF="${LIBIFSNAME}/TOOLS.FILE/BNDSRC.MBR"
+
+if action_needed "${BSF}" Makefile.am
+then    LINK=YES
+fi
+
+if [ -n "${LINK}" ]
+then    echo " STRPGMEXP PGMLVL(*CURRENT) SIGNATURE('LIBCURL_${SONAME}')" \
+            > "${BSF}"
+        for EXPORT in ${EXPORTS}
+        do      echo ' EXPORT    SYMBOL("'"${EXPORT}"'")' >> "${BSF}"
+        done
+
+        echo ' ENDPGMEXP' >> "${BSF}"
+fi
+
+
+#       Build the service program if needed.
+
+if action_needed "${LIBIFSNAME}/${SRVPGM}.SRVPGM"
+then    LINK=YES
+fi
+
+if [ -n "${LINK}" ]
+then    CMD="CRTSRVPGM SRVPGM(${TARGETLIB}/${SRVPGM})"
+        CMD="${CMD} SRCFILE(${TARGETLIB}/TOOLS) SRCMBR(BNDSRC)"
+        CMD="${CMD} MODULE(${TARGETLIB}/OS400)"
+        CMD="${CMD} BNDDIR(${TARGETLIB}/${STATBNDDIR}"
+        if [ "${WITH_ZLIB}" != 0 ]
+        then    CMD="${CMD} ${ZLIB_LIB}/${ZLIB_BNDDIR}"
+                liblist -a "${ZLIB_LIB}"
+        fi
+        if [ "${WITH_LIBSSH2}" != 0 ]
+        then    CMD="${CMD} ${LIBSSH2_LIB}/${LIBSSH2_BNDDIR}"
+                liblist -a "${LIBSSH2_LIB}"
+        fi
+        CMD="${CMD})"
+        CMD="${CMD} BNDSRVPGM(QADRTTS QGLDCLNT QGLDBRDR)"
+        CMD="${CMD} TEXT('curl API library')"
+        CMD="${CMD} TGTRLS(${TGTRLS})"
+        CLcommand "${CMD}"
+        LINK=YES
+fi
+
+
+#       If needed, (re)create the dynamic binding directory.
+
+if action_needed "${LIBIFSNAME}/${DYNBNDDIR}.BNDDIR"
+then    LINK=YES
+fi
+
+if [ -n "${LINK}" ]
+then    rm -rf "${LIBIFSNAME}/${DYNBNDDIR}.BNDDIR"
+        CMD="CRTBNDDIR BNDDIR(${TARGETLIB}/${DYNBNDDIR})"
+        CMD="${CMD} TEXT('libcurl API dynamic binding directory')"
+        CLcommand "${CMD}"
+        CMD="ADDBNDDIRE BNDDIR(${TARGETLIB}/${DYNBNDDIR})"
+        CMD="${CMD} OBJ((*LIBL/${SRVPGM} *SRVPGM))"
+        CLcommand "${CMD}"
+fi
diff --git a/third-party/curl/projects/OS400/make-src.sh b/third-party/curl/projects/OS400/make-src.sh
new file mode 100644
index 0000000000..5ca84be9b5
--- /dev/null
+++ b/third-party/curl/projects/OS400/make-src.sh
@@ -0,0 +1,118 @@
+#!/bin/sh
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+#       Command line interface tool compilation script for the OS/400.
+
+SCRIPTDIR=$(dirname "${0}")
+. "${SCRIPTDIR}/initscript.sh"
+cd "${TOPDIR}/src" || exit 1
+
+
+#       Check if built-in manual can be generated.
+
+USE_MANUAL=
+if [ -f "${IFSDIR}/docs/curl.txt" ] && [ -n "${PASEPERL}" ]
+then    "${PASEPERL}" ./mkhelp.pl < "${IFSDIR}/docs/curl.txt" > tool_hugehelp.c
+        USE_MANUAL="'USE_MANUAL'"
+fi
+
+
+#       Get source lists.
+#       CURL_CFILES are in the current directory.
+#       CURLX_CFILES are in the lib directory and need to be recompiled because
+#               some function names change using macros.
+
+get_make_vars Makefile.inc
+
+
+#       Add hugehelp, as it is not included in Makefile.inc.
+if [ "${USE_MANUAL}" = "'USE_MANUAL'" ]
+then
+        CURL_CFILES="${CURL_CFILES} tool_hugehelp.c"
+        CURL_HFILES="${CURL_HFILES} tool_hugehelp.h"
+fi
+
+#       Compile the sources into modules.
+
+# shellcheck disable=SC2034
+LINK=
+MODULES=
+# shellcheck disable=SC2034
+INCLUDES="'${TOPDIR}/lib' '${TOPDIR}/lib/curlx'"
+
+# shellcheck disable=SC2153
+for SRC in ${CURLX_CFILES}
+do      MODULE=$(db2_name "${SRC}")
+        MODULE=$(db2_name "X${MODULE}")
+        make_module "${MODULE}" "${SRC}" "${USE_MANUAL}"
+done
+
+for SRC in ${CURL_CFILES}
+do      MODULE=$(db2_name "${SRC}")
+        make_module "${MODULE}" "${SRC}" "${USE_MANUAL}"
+done
+
+
+#       Link modules into program.
+
+MODULES="$(echo "${MODULES}" | sed "s/[^ ][^ ]*/${TARGETLIB}\/&/g")"
+CMD="CRTPGM PGM(${TARGETLIB}/${CURLPGM})"
+CMD="${CMD} ENTMOD(${TARGETLIB}/CURLMAIN)"
+CMD="${CMD} MODULE(${MODULES})"
+CMD="${CMD} BNDSRVPGM(${TARGETLIB}/${SRVPGM} QADRTTS)"
+CMD="${CMD} TGTRLS(${TGTRLS})"
+CLcommand "${CMD}"
+
+
+#       Create the IFS command.
+
+IFSBIN="${IFSDIR}/bin"
+
+if action_needed "${IFSBIN}"
+then    mkdir -p "${IFSBIN}"
+fi
+
+rm -f "${IFSBIN}/curl"
+ln -s "/QSYS.LIB/${TARGETLIB}.LIB/${CURLPGM}.PGM" "${IFSBIN}/curl"
+
+
+#       Create the CL interface program.
+
+if action_needed "${LIBIFSNAME}/CURLCL.PGM" "${SCRIPTDIR}/curlcl.c"
+then    CMD="CRTBNDC PGM(${TARGETLIB}/${CURLCLI})"
+        CMD="${CMD} SRCSTMF('${SCRIPTDIR}/curlcl.c')"
+        CMD="${CMD} DEFINE('CURLPGM=\"${CURLPGM}\"')"
+        CMD="${CMD} TGTCCSID(${TGTCCSID})"
+        CLcommand "${CMD}"
+fi
+
+
+#       Create the CL command.
+
+if action_needed "${LIBIFSNAME}/${CURLCMD}.CMD" "${SCRIPTDIR}/curl.cmd"
+then    CMD="CRTCMD CMD(${TARGETLIB}/${CURLCMD}) PGM(${TARGETLIB}/${CURLCLI})"
+        CMD="${CMD} SRCSTMF('${SCRIPTDIR}/curl.cmd')"
+        CLcommand "${CMD}"
+fi
diff --git a/third-party/curl/packages/OS400/make-tests.sh b/third-party/curl/projects/OS400/make-tests.sh
similarity index 78%
rename from third-party/curl/packages/OS400/make-tests.sh
rename to third-party/curl/projects/OS400/make-tests.sh
index ed475956c9..4ddc537487 100644
--- a/third-party/curl/packages/OS400/make-tests.sh
+++ b/third-party/curl/projects/OS400/make-tests.sh
@@ -27,9 +27,9 @@
 #
 
 
-SCRIPTDIR=`dirname "${0}"`
+SCRIPTDIR=$(dirname "${0}")
 . "${SCRIPTDIR}/initscript.sh"
-cd "${TOPDIR}/tests"
+cd "${TOPDIR}/tests" || exit 1
 
 
 #       Build programs in a directory.
@@ -40,23 +40,26 @@ build_all_programs()
         #       Compile all programs.
         #       The list is found in variable "noinst_PROGRAMS"
 
-        INCLUDES="'`pwd`' '${TOPDIR}/lib' '${TOPDIR}/src'"
+        # shellcheck disable=SC2034
+        INCLUDES="'$(pwd)' '${TOPDIR}/lib' '${TOPDIR}/src'"
         MODS="${1}"
         SRVPGMS="${2}"
 
+        # shellcheck disable=SC2154
         for PGM in ${noinst_PROGRAMS}
-        do      DB2PGM=`db2_name "${PGM}"`
+        do      DB2PGM=$(db2_name "${PGM}")
                 PGMIFSNAME="${LIBIFSNAME}/${DB2PGM}.PGM"
 
                 #       Extract preprocessor symbol definitions from
                 #               compilation options for the program.
 
-                PGMCFLAGS="`eval echo \"\\${${PGM}_CFLAGS}\"`"
+                PGMCFLAGS="$(eval echo "\${${PGM}_CFLAGS}")"
                 PGMDFNS=
 
                 for FLAG in ${PGMCFLAGS}
                 do      case "${FLAG}" in
-                        -D?*)   DEFINE="`echo \"${FLAG}\" | sed 's/^..//'`"
+                        -D?*)
+                                DEFINE="$(echo "${FLAG}" | sed 's/^..//')"
                                 PGMDFNS="${PGMDFNS} '${DEFINE}'"
                                 ;;
                         esac
@@ -64,7 +67,7 @@ build_all_programs()
 
                 #        Compile all C sources for the program into modules.
 
-                PGMSOURCES="`eval echo \"\\${${PGM}_SOURCES}\"`"
+                PGMSOURCES="$(eval echo "\${${PGM}_SOURCES}")"
                 LINK=
                 MODULES=
 
@@ -77,7 +80,7 @@ build_all_programs()
                                 case "${SOURCE}" in
                                 lib*.c) MODULE="${DB2PGM}"
                                         ;;
-                                *)      MODULE=`db2_name "${SOURCE}"`
+                                *)      MODULE=$(db2_name "${SOURCE}")
                                         ;;
                                 esac
 
@@ -85,7 +88,7 @@ build_all_programs()
                                 #               prefix module name with 'X'.
 
                                 case "${SOURCE}" in
-                                ../*)   MODULE=`db2_name "X${MODULE}"`
+                                ../*)   MODULE=$(db2_name "X${MODULE}")
                                             ;;
                                 esac
 
@@ -99,17 +102,17 @@ build_all_programs()
 
                 #       Link program if needed.
 
-                if [ "${LINK}" ]
-                then    PGMLDADD="`eval echo \"\\${${PGM}_LDADD}\"`"
-                        for ARG in ${PGMLDADD}
-                        do      case "${ARG}" in
+                if [ -n "${LINK}" ]
+                then    PGMLDADD="$(eval echo "\${${PGM}_LDADD}")"
+                        for M in ${PGMLDADD}
+                        do      case "${M}" in
                                 -*)     ;;              # Ignore non-module.
-                                *)      MODULES="${MODULES} "`db2_name "${ARG}"`
+                                *)      MODULES="${MODULES} $(db2_name "${M}")"
                                         ;;
                                 esac
                         done
-                        MODULES="`echo \"${MODULES}\" |
-                            sed \"s/[^ ][^ ]*/${TARGETLIB}\/&/g\"`"
+                        MODULES="$(echo "${MODULES}" |
+                            sed "s/[^ ][^ ]*/${TARGETLIB}\/&/g")"
                         CMD="CRTPGM PGM(${TARGETLIB}/${DB2PGM})"
                         CMD="${CMD} ENTMOD(${TARGETLIB}/CURLMAIN)"
                         CMD="${CMD} MODULE(${MODULES} ${MODS})"
@@ -124,7 +127,7 @@ build_all_programs()
 #       Build programs in the server directory.
 
 (
-        cd server
+        cd server || exit 1
         get_make_vars Makefile.inc
         build_all_programs "${TARGETLIB}/OS400SYS"
 )
@@ -133,13 +136,9 @@ build_all_programs()
 #       Build all programs in the libtest subdirectory.
 
 (
-        cd libtest
+        cd libtest || exit 1
         get_make_vars Makefile.inc
 
-        #       Special case: redefine chkhostname compilation parameters.
-
-        chkhostname_SOURCES=chkhostname.c
-        chkhostname_LDADD=curl_gethostname.o
-
+        # shellcheck disable=SC2153
         build_all_programs "" "${TARGETLIB}/${SRVPGM}"
 )
diff --git a/third-party/curl/packages/OS400/makefile.sh b/third-party/curl/projects/OS400/makefile.sh
similarity index 76%
rename from third-party/curl/packages/OS400/makefile.sh
rename to third-party/curl/projects/OS400/makefile.sh
index 3d659645dc..2b688a4421 100644
--- a/third-party/curl/packages/OS400/makefile.sh
+++ b/third-party/curl/projects/OS400/makefile.sh
@@ -28,9 +28,23 @@
 #
 #       This is a shell script since make is not a standard component of OS/400.
 
-SCRIPTDIR=`dirname "${0}"`
+SCRIPTDIR=$(dirname "${0}")
 . "${SCRIPTDIR}/initscript.sh"
-cd "${TOPDIR}"
+cd "${TOPDIR}" || exit 1
+
+
+#       Make sure all files are UTF8-encoded.
+
+# Qshell does not support -print0. ls -S has a non-POSIX meaning.
+#   https://www.ibm.com/docs/en/i/7.1.0?topic=qshell-command-language
+# shellcheck disable=SC2038
+find "${TOPDIR}" -type f | xargs ls -S -- | while read -r CCSID FILE
+do      if [ "${CCSID}" != 1208 ]
+        then    CMD="CPY OBJ('${FILE}') TOOBJ('${FILE}') FROMCCSID(*OBJ)"
+                CMD="${CMD} TOCCSID(1208) DTAFMT(*TEXT) REPLACE(*YES)"
+                (CLcommand "${CMD}")
+        fi
+done
 
 
 #       Create the OS/400 library if it does not exist.
@@ -53,13 +67,13 @@ fi
 #       Copy some documentation files if needed.
 
 for TEXT in "${TOPDIR}/COPYING" "${SCRIPTDIR}/README.OS400"             \
-    "${TOPDIR}/CHANGES" "${TOPDIR}/docs/THANKS" "${TOPDIR}/docs/FAQ"    \
+    "${TOPDIR}/CHANGES.md" "${TOPDIR}/docs/THANKS" "${TOPDIR}/docs/FAQ.md"    \
     "${TOPDIR}/docs/FEATURES" "${TOPDIR}/docs/SSLCERTS.md"              \
     "${TOPDIR}/docs/RESOURCES" "${TOPDIR}/docs/VERSIONS.md"             \
     "${TOPDIR}/docs/HISTORY.md"
-do      MEMBER="`basename \"${TEXT}\" .OS400`"
-        MEMBER="`basename \"${MEMBER}\" .md`"
-        MEMBER="${LIBIFSNAME}/DOCS.FILE/`db2_name \"${MEMBER}\"`.MBR"
+do      MEMBER="$(basename "${TEXT}" .OS400)"
+        MEMBER="$(basename "${MEMBER}" .md)"
+        MEMBER="${LIBIFSNAME}/DOCS.FILE/$(db2_name "${MEMBER}").MBR"
 
         [ -e "${TEXT}" ] || continue
 
@@ -83,8 +97,8 @@ fi
 #       Copy RPG examples if needed.
 
 for EXAMPLE in "${SCRIPTDIR}/rpg-examples"/*
-do      MEMBER="`basename \"${EXAMPLE}\"`"
-        IFSMEMBER="${LIBIFSNAME}/RPGXAMPLES.FILE/`db2_name \"${MEMBER}\"`.MBR"
+do      MEMBER="$(basename "${EXAMPLE}")"
+        IFSMEMBER="${LIBIFSNAME}/RPGXAMPLES.FILE/$(db2_name "${MEMBER}").MBR"
 
         [ -e "${EXAMPLE}" ] || continue
 
@@ -92,8 +106,8 @@ do      MEMBER="`basename \"${EXAMPLE}\"`"
         then    CMD="CPY OBJ('${EXAMPLE}') TOOBJ('${IFSMEMBER}')"
                 CMD="${CMD} TOCCSID(${TGTCCSID}) DTAFMT(*TEXT) REPLACE(*YES)"
                 CLcommand "${CMD}"
-                MBRTEXT=`sed -e '1!d;/^      \*/!d;s/^ *\* *//'         \
-                             -e 's/ *$//;s/'"'"'/&&/g' < "${EXAMPLE}"`
+                MBRTEXT=$(sed -e '1!d;/^      \*/!d;s/^ *\* *//'        \
+                              -e 's/ *$//;s/'"'"'/&&/g' < "${EXAMPLE}")
                 CMD="CHGPFM FILE(${TARGETLIB}/RPGXAMPLES) MBR(${MEMBER})"
                 CMD="${CMD} SRCTYPE(RPGLE) TEXT('${MBRTEXT}')"
                 CLcommand "${CMD}"
@@ -117,7 +131,7 @@ fi
 
 #       Build in each directory.
 
-# for SUBDIR in include lib src tests
-for SUBDIR in include lib src
+# for SUBDIR in include lib docs src tests
+for SUBDIR in include lib docs src
 do      "${SCRIPTDIR}/make-${SUBDIR}.sh"
 done
diff --git a/third-party/curl/projects/OS400/os400sys.c b/third-party/curl/projects/OS400/os400sys.c
new file mode 100644
index 0000000000..fc7ae3c612
--- /dev/null
+++ b/third-party/curl/projects/OS400/os400sys.c
@@ -0,0 +1,1038 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ *
+ ***************************************************************************/
+
+/* OS/400 additional support. */
+
+#include <curl/curl.h>
+#include "config-os400.h"  /* Not curl_setup.h: we only need some defines. */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+
+#include <stdlib.h>
+#include <stddef.h>
+#include <string.h>
+#include <pthread.h>
+#include <netdb.h>
+#include <qadrt.h>
+#include <errno.h>
+
+#ifdef HAVE_LIBZ
+#include <zlib.h>
+#endif
+
+#ifdef HAVE_GSSAPI
+#include <gssapi.h>
+#endif
+
+#ifndef CURL_DISABLE_LDAP
+#include <ldap.h>
+#endif
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include "os400sys.h"
+
+/**
+*** QADRT OS/400 ASCII runtime defines only the most used procedures, but a
+*** lot of them are not supported. This module implements ASCII wrappers for
+*** those that are used by libcurl, but not defined by QADRT.
+**/
+
+#pragma convert(0)                              /* Restore EBCDIC. */
+
+#define MIN_BYTE_GAIN 1024    /* Minimum gain when shortening a buffer. */
+
+struct buffer_t {
+  unsigned long size;            /* Buffer size. */
+  char *buf;                     /* Buffer address. */
+};
+
+static char *buffer_undef(localkey_t key, long size);
+static char *buffer_threaded(localkey_t key, long size);
+static char *buffer_unthreaded(localkey_t key, long size);
+
+static pthread_mutex_t  mutex = PTHREAD_MUTEX_INITIALIZER;
+static pthread_key_t    thdkey;
+static struct buffer_t *locbufs;
+
+char *(*Curl_thread_buffer)(localkey_t key, long size) = buffer_undef;
+
+static void thdbufdestroy(void *private)
+{
+  if(private) {
+    struct buffer_t *p = (struct buffer_t *)private;
+    localkey_t i;
+
+    for(i = (localkey_t)0; i < LK_LAST; i++) {
+      free(p->buf);
+      p++;
+    }
+
+    free(private);
+  }
+}
+
+static void terminate(void)
+{
+  if(Curl_thread_buffer == buffer_threaded) {
+    locbufs = pthread_getspecific(thdkey);
+    pthread_setspecific(thdkey, (void *)NULL);
+    pthread_key_delete(thdkey);
+  }
+
+  if(Curl_thread_buffer != buffer_undef) {
+    thdbufdestroy((void *)locbufs);
+    locbufs = (struct buffer_t *)NULL;
+  }
+
+  Curl_thread_buffer = buffer_undef;
+}
+
+static char *get_buffer(struct buffer_t *buf, long size)
+{
+  char *cp;
+
+  /* If `size' >= 0, make sure buffer at `buf' is at least `size'-byte long.
+     Return the buffer address. */
+
+  if(size < 0)
+    return buf->buf;
+
+  if(!buf->buf) {
+    buf->buf = malloc(size);
+    if(buf->buf)
+      buf->size = size;
+
+    return buf->buf;
+  }
+
+  if((unsigned long)size <= buf->size) {
+    /* Shorten the buffer only if it frees a significant byte count. This
+       avoids some realloc() overhead. */
+
+    if(buf->size - size < MIN_BYTE_GAIN)
+      return buf->buf;
+  }
+
+  /* Resize the buffer. */
+
+  cp = realloc(buf->buf, size);
+  if(cp) {
+    buf->buf = cp;
+    buf->size = size;
+  }
+  else if(size <= buf->size)
+    cp = buf->buf;
+
+  return cp;
+}
+
+/*
+ * Get buffer address for the given local key.
+ * This is always called though `Curl_thread_buffer' and when threads are
+ * NOT made available by the os, so no mutex lock/unlock occurs.
+ */
+static char *buffer_unthreaded(localkey_t key, long size)
+{
+  return get_buffer(locbufs + key, size);
+}
+
+/*
+ * Get buffer address for the given local key, taking care of
+ * concurrent threads.
+ * This is always called though `Curl_thread_buffer' and when threads are
+ * made available by the os.
+ */
+static char *buffer_threaded(localkey_t key, long size)
+{
+  struct buffer_t *bufs;
+
+  /* Get the buffer for the given local key in the current thread, and
+     make sure it is at least `size'-byte long. Set `size' to < 0 to get
+     its address only. */
+
+  bufs = (struct buffer_t *)pthread_getspecific(thdkey);
+
+  if(!bufs) {
+    if(size < 0)
+      return (char *)NULL;             /* No buffer yet. */
+
+    /* Allocate buffer descriptors for the current thread. */
+
+    bufs = calloc((size_t)LK_LAST, sizeof(*bufs));
+    if(!bufs)
+      return (char *)NULL;
+
+    if(pthread_setspecific(thdkey, (void *)bufs)) {
+      free(bufs);
+      return (char *)NULL;
+    }
+  }
+
+  return get_buffer(bufs + key, size);
+}
+
+static char *buffer_undef(localkey_t key, long size)
+{
+  /* Define the buffer system, get the buffer for the given local key in
+     the current thread, and make sure it is at least `size'-byte long.
+     Set `size' to < 0 to get its address only. */
+
+  pthread_mutex_lock(&mutex);
+
+  /* Determine if we can use pthread-specific data. */
+
+  if(Curl_thread_buffer == buffer_undef) { /* If unchanged during lock. */
+    /* OS400 interactive jobs do not support threads: check here. */
+    if(!pthread_key_create(&thdkey, thdbufdestroy)) {
+      /* Threads are supported: use the thread-aware buffer procedure. */
+      Curl_thread_buffer = buffer_threaded;
+    }
+    else {
+      /* No multi-threading available: allocate storage for single-thread
+       * buffer headers. */
+      locbufs = calloc((size_t)LK_LAST, sizeof(*locbufs));
+      if(!locbufs) {
+        pthread_mutex_unlock(&mutex); /* For symmetry: will probably fail. */
+        return (char *)NULL;
+      }
+      else
+        Curl_thread_buffer = buffer_unthreaded; /* Use unthreaded version. */
+    }
+
+    atexit(terminate);
+  }
+
+  pthread_mutex_unlock(&mutex);
+  return Curl_thread_buffer(key, size);
+}
+
+static char *set_thread_string(localkey_t key, const char *s)
+{
+  int i;
+  char *cp;
+
+  if(!s)
+    return (char *)NULL;
+
+  i = strlen(s) + 1;
+  cp = Curl_thread_buffer(key, MAX_CONV_EXPANSION * i + 1);
+
+  if(cp) {
+    i = QadrtConvertE2A(cp, s, MAX_CONV_EXPANSION * i, i);
+    cp[i] = '\0';
+  }
+
+  return cp;
+}
+
+int Curl_getnameinfo_a(const struct sockaddr *sa, socklen_t salen,
+                       char *nodename, socklen_t nodenamelen,
+                       char *servname, socklen_t servnamelen,
+                       int flags)
+{
+  char *enodename = NULL;
+  char *eservname = NULL;
+  int status;
+
+  if(nodename && nodenamelen) {
+    enodename = malloc(nodenamelen);
+    if(!enodename)
+      return EAI_MEMORY;
+  }
+
+  if(servname && servnamelen) {
+    eservname = malloc(servnamelen);
+    if(!eservname) {
+      free(enodename);
+      return EAI_MEMORY;
+    }
+  }
+
+  status = getnameinfo(sa, salen, enodename, nodenamelen, eservname,
+                       servnamelen, flags);
+
+  if(!status) {
+    int i;
+    if(enodename) {
+      i = QadrtConvertE2A(nodename, enodename, nodenamelen - 1,
+                          strlen(enodename));
+      nodename[i] = '\0';
+    }
+
+    if(eservname) {
+      i = QadrtConvertE2A(servname, eservname, servnamelen - 1,
+                          strlen(eservname));
+      servname[i] = '\0';
+    }
+  }
+
+  free(enodename);
+  free(eservname);
+  return status;
+}
+
+int Curl_getaddrinfo_a(const char *nodename, const char *servname,
+                       const struct addrinfo *hints, struct addrinfo **res)
+{
+  char *enodename;
+  char *eservname;
+  int status;
+  int i;
+
+  enodename = (char *)NULL;
+  eservname = (char *)NULL;
+
+  if(nodename) {
+    i = strlen(nodename);
+
+    enodename = malloc(i + 1);
+    if(!enodename)
+      return EAI_MEMORY;
+
+    i = QadrtConvertA2E(enodename, nodename, i, i);
+    enodename[i] = '\0';
+  }
+
+  if(servname) {
+    i = strlen(servname);
+
+    eservname = malloc(i + 1);
+    if(!eservname) {
+      free(enodename);
+      return EAI_MEMORY;
+    }
+
+    QadrtConvertA2E(eservname, servname, i, i);
+    eservname[i] = '\0';
+  }
+
+  /* !checksrc! disable BANNEDFUNC 1 */
+  status = getaddrinfo(enodename, eservname, hints, res);
+  free(enodename);
+  free(eservname);
+  return status;
+}
+
+#ifdef HAVE_GSSAPI
+
+/* ASCII wrappers for the GSSAPI procedures. */
+
+static int Curl_gss_convert_in_place(OM_uint32 *minor_status, gss_buffer_t buf)
+{
+  unsigned int i = buf->length;
+
+  /* Convert `buf' in place, from EBCDIC to ASCII.
+     If error, release the buffer and return -1. Else return 0. */
+
+  if(i) {
+    char *t = malloc(i);
+    if(!t) {
+      gss_release_buffer(minor_status, buf);
+
+      if(minor_status)
+        /* !checksrc! disable ERRNOVAR 1 */
+        *minor_status = ENOMEM;
+
+      return -1;
+    }
+
+    QadrtConvertE2A(t, buf->value, i, i);
+    memcpy(buf->value, t, i);
+    free(t);
+  }
+
+  return 0;
+}
+
+/* Max string input length is a precaution against abuse and to detect junk
+   input easier and better. */
+#define CURL_MAX_INPUT_LENGTH 8000000
+
+OM_uint32 Curl_gss_import_name_a(OM_uint32 *minor_status, gss_buffer_t in_name,
+                                 gss_OID in_name_type, gss_name_t *out_name)
+{
+  OM_uint32 rc;
+  unsigned int i;
+  gss_buffer_desc in;
+
+  if(!in_name || !in_name->value || !in_name->length)
+    return gss_import_name(minor_status, in_name, in_name_type, out_name);
+
+  memcpy((char *)&in, (char *)in_name, sizeof(in));
+  if(in.length > CURL_MAX_INPUT_LENGTH) {
+    if(minor_status)
+      /* !checksrc! disable ERRNOVAR 1 */
+      *minor_status = ENOMEM;
+
+    return GSS_S_FAILURE;
+  }
+  i = (unsigned int)in.length;
+
+  in.value = malloc(i + 1);
+  if(!in.value) {
+    if(minor_status)
+      /* !checksrc! disable ERRNOVAR 1 */
+      *minor_status = ENOMEM;
+
+    return GSS_S_FAILURE;
+  }
+
+  QadrtConvertA2E(in.value, in_name->value, i, i);
+  ((char *)in.value)[i] = '\0';
+  rc = gss_import_name(minor_status, &in, in_name_type, out_name);
+  free(in.value);
+  return rc;
+}
+
+OM_uint32 Curl_gss_display_status_a(OM_uint32 *minor_status,
+                                    OM_uint32 status_value, int status_type,
+                                    gss_OID mech_type,
+                                    gss_msg_ctx_t *message_context,
+                                    gss_buffer_t status_string)
+{
+  int rc;
+
+  rc = gss_display_status(minor_status, status_value, status_type,
+                          mech_type, message_context, status_string);
+
+  if(rc != GSS_S_COMPLETE || !status_string ||
+     !status_string->length || !status_string->value)
+    return rc;
+
+  /* No way to allocate a buffer here, because it will be released by
+     gss_release_buffer(). The solution is to overwrite the EBCDIC buffer
+     with ASCII to return it. */
+
+  if(Curl_gss_convert_in_place(minor_status, status_string))
+    return GSS_S_FAILURE;
+
+  return rc;
+}
+
+OM_uint32 Curl_gss_init_sec_context_a(
+  OM_uint32 *minor_status,
+  gss_cred_id_t cred_handle,
+  gss_ctx_id_t *context_handle,
+  gss_name_t target_name, gss_OID mech_type,
+  gss_flags_t req_flags, OM_uint32 time_req,
+  gss_channel_bindings_t input_chan_bindings,
+  gss_buffer_t input_token,
+  gss_OID *actual_mech_type,
+  gss_buffer_t output_token, gss_flags_t *ret_flags,
+  OM_uint32 *time_rec)
+{
+  int rc;
+  gss_buffer_desc in;
+  gss_buffer_t inp;
+
+  in.value = NULL;
+  inp = input_token;
+
+  if(inp) {
+    if(inp->length && inp->value) {
+      unsigned int i;
+      if(inp->length > CURL_MAX_INPUT_LENGTH) {
+        if(minor_status)
+          /* !checksrc! disable ERRNOVAR 1 */
+          *minor_status = ENOMEM;
+
+        return GSS_S_FAILURE;
+      }
+      i = (unsigned int)inp->length;
+      in.value = malloc(i + 1);
+      if(!in.value) {
+        if(minor_status)
+          /* !checksrc! disable ERRNOVAR 1 */
+          *minor_status = ENOMEM;
+
+        return GSS_S_FAILURE;
+      }
+
+      QadrtConvertA2E(in.value, input_token->value, i, i);
+      ((char *)in.value)[i] = '\0';
+      in.length = i;
+      inp = &in;
+    }
+  }
+
+  rc = gss_init_sec_context(minor_status, cred_handle, context_handle,
+                            target_name, mech_type, req_flags, time_req,
+                            input_chan_bindings, inp, actual_mech_type,
+                            output_token, ret_flags, time_rec);
+  free(in.value);
+
+  if(rc != GSS_S_COMPLETE || !output_token ||
+     !output_token->length || !output_token->value)
+    return rc;
+
+  /* No way to allocate a buffer here, because it will be released by
+     gss_release_buffer(). The solution is to overwrite the EBCDIC buffer
+     with ASCII to return it. */
+
+  if(Curl_gss_convert_in_place(minor_status, output_token))
+    return GSS_S_FAILURE;
+
+  return rc;
+}
+
+OM_uint32 Curl_gss_delete_sec_context_a(OM_uint32 *minor_status,
+                                        gss_ctx_id_t *context_handle,
+                                        gss_buffer_t output_token)
+{
+  OM_uint32 rc;
+
+  rc = gss_delete_sec_context(minor_status, context_handle, output_token);
+
+  if(rc != GSS_S_COMPLETE || !output_token ||
+     !output_token->length || !output_token->value)
+    return rc;
+
+  /* No way to allocate a buffer here, because it will be released by
+     gss_release_buffer(). The solution is to overwrite the EBCDIC buffer
+     with ASCII to return it. */
+
+  if(Curl_gss_convert_in_place(minor_status, output_token))
+    return GSS_S_FAILURE;
+
+  return rc;
+}
+
+#endif /* HAVE_GSSAPI */
+
+#ifndef CURL_DISABLE_LDAP
+
+/* ASCII wrappers for the LDAP procedures. */
+
+void *Curl_ldap_init_a(char *host, int port)
+{
+  size_t i;
+  char *ehost;
+  void *result;
+
+  if(!host)
+    return (void *)ldap_init(host, port);
+
+  i = strlen(host);
+
+  ehost = malloc(i + 1);
+  if(!ehost)
+    return (void *)NULL;
+
+  QadrtConvertA2E(ehost, host, i, i);
+  ehost[i] = '\0';
+  result = (void *)ldap_init(ehost, port);
+  free(ehost);
+  return result;
+}
+
+int Curl_ldap_simple_bind_s_a(void *ld, char *dn, char *passwd)
+{
+  int i;
+  char *edn;
+  char *epasswd;
+
+  edn = (char *)NULL;
+  epasswd = (char *)NULL;
+
+  if(dn) {
+    i = strlen(dn);
+
+    edn = malloc(i + 1);
+    if(!edn)
+      return LDAP_NO_MEMORY;
+
+    QadrtConvertA2E(edn, dn, i, i);
+    edn[i] = '\0';
+  }
+
+  if(passwd) {
+    i = strlen(passwd);
+
+    epasswd = malloc(i + 1);
+    if(!epasswd) {
+      free(edn);
+      return LDAP_NO_MEMORY;
+    }
+
+    QadrtConvertA2E(epasswd, passwd, i, i);
+    epasswd[i] = '\0';
+  }
+
+  i = ldap_simple_bind_s(ld, edn, epasswd);
+  free(epasswd);
+  free(edn);
+  return i;
+}
+
+int Curl_ldap_search_s_a(void *ld, char *base, int scope, char *filter,
+                         char **attrs, int attrsonly, LDAPMessage **res)
+{
+  int i;
+  int j;
+  char *ebase;
+  char *efilter;
+  char **eattrs;
+  int status;
+
+  ebase = (char *)NULL;
+  efilter = (char *)NULL;
+  eattrs = (char **)NULL;
+  status = LDAP_SUCCESS;
+
+  if(base) {
+    i = strlen(base);
+
+    ebase = malloc(i + 1);
+    if(!ebase)
+      status = LDAP_NO_MEMORY;
+    else {
+      QadrtConvertA2E(ebase, base, i, i);
+      ebase[i] = '\0';
+    }
+  }
+
+  if(filter && status == LDAP_SUCCESS) {
+    i = strlen(filter);
+
+    efilter = malloc(i + 1);
+    if(!efilter)
+      status = LDAP_NO_MEMORY;
+    else {
+      QadrtConvertA2E(efilter, filter, i, i);
+      efilter[i] = '\0';
+    }
+  }
+
+  if(attrs && status == LDAP_SUCCESS) {
+    for(i = 0; attrs[i++];)
+      ;
+
+    eattrs = calloc(i, sizeof(*eattrs));
+    if(!eattrs)
+      status = LDAP_NO_MEMORY;
+    else {
+      for(j = 0; attrs[j]; j++) {
+        i = strlen(attrs[j]);
+
+        eattrs[j] = malloc(i + 1);
+        if(!eattrs[j]) {
+          status = LDAP_NO_MEMORY;
+          break;
+        }
+
+        QadrtConvertA2E(eattrs[j], attrs[j], i, i);
+        eattrs[j][i] = '\0';
+      }
+    }
+  }
+
+  if(status == LDAP_SUCCESS)
+    status = ldap_search_s(ld, ebase ? ebase : "", scope,
+                           efilter ? efilter : "(objectclass=*)",
+                           eattrs, attrsonly, res);
+
+  if(eattrs) {
+    for(j = 0; eattrs[j]; j++)
+      free(eattrs[j]);
+
+    free(eattrs);
+  }
+
+  free(efilter);
+  free(ebase);
+  return status;
+}
+
+struct berval **Curl_ldap_get_values_len_a(void *ld, LDAPMessage *entry,
+                                           const char *attr)
+{
+  char *cp;
+  struct berval **result;
+
+  cp = (char *)NULL;
+
+  if(attr) {
+    int i = strlen(attr);
+
+    cp = malloc(i + 1);
+    if(!cp) {
+      ldap_set_lderrno(ld, LDAP_NO_MEMORY, NULL,
+                       ldap_err2string(LDAP_NO_MEMORY));
+      return (struct berval **)NULL;
+    }
+
+    QadrtConvertA2E(cp, attr, i, i);
+    cp[i] = '\0';
+  }
+
+  result = ldap_get_values_len(ld, entry, cp);
+  free(cp);
+
+  /* Result data are binary in nature, so they have not been
+     converted to EBCDIC. Therefore do not convert. */
+
+  return result;
+}
+
+char *Curl_ldap_err2string_a(int error)
+{
+  return set_thread_string(LK_LDAP_ERROR, ldap_err2string(error));
+}
+
+char *Curl_ldap_get_dn_a(void *ld, LDAPMessage *entry)
+{
+  int i;
+  char *cp;
+  char *cp2;
+
+  cp = ldap_get_dn(ld, entry);
+
+  if(!cp)
+    return cp;
+
+  i = strlen(cp);
+
+  cp2 = malloc(i + 1);
+  if(!cp2)
+    return cp2;
+
+  QadrtConvertE2A(cp2, cp, i, i);
+
+  /* No way to allocate a buffer here, because it will be released by
+     ldap_memfree() and ldap_memalloc() does not exist. The solution is to
+     overwrite the EBCDIC buffer with ASCII to return it.
+
+     The destination buffer already has a null-terminator at the correct
+     position. Keep it outouched and copy the buffer without a terminator. */
+  memcpy(cp, cp2, i);
+  free(cp2);
+  return cp;
+}
+
+char *Curl_ldap_first_attribute_a(void *ld, LDAPMessage *entry,
+                                  BerElement **berptr)
+{
+  int i;
+  char *cp;
+  char *cp2;
+
+  cp = ldap_first_attribute(ld, entry, berptr);
+
+  if(!cp)
+    return cp;
+
+  i = strlen(cp);
+
+  cp2 = malloc(i + 1);
+  if(!cp2)
+    return cp2;
+
+  QadrtConvertE2A(cp2, cp, i, i);
+
+  /* No way to allocate a buffer here, because it will be released by
+     ldap_memfree() and ldap_memalloc() does not exist. The solution is to
+     overwrite the EBCDIC buffer with ASCII to return it.
+
+     The destination buffer already has a null-terminator at the correct
+     position. Keep it outouched and copy the buffer without a terminator. */
+  memcpy(cp, cp2, i);
+  free(cp2);
+  return cp;
+}
+
+char *Curl_ldap_next_attribute_a(void *ld, LDAPMessage *entry,
+                                 BerElement *berptr)
+{
+  int i;
+  char *cp;
+  char *cp2;
+
+  cp = ldap_next_attribute(ld, entry, berptr);
+
+  if(!cp)
+    return cp;
+
+  i = strlen(cp);
+
+  cp2 = malloc(i + 1);
+  if(!cp2)
+    return cp2;
+
+  QadrtConvertE2A(cp2, cp, i, i);
+
+  /* No way to allocate a buffer here, because it will be released by
+     ldap_memfree() and ldap_memalloc() does not exist. The solution is to
+     overwrite the EBCDIC buffer with ASCII to return it.
+
+     The destination buffer already has a null-terminator at the correct
+     position. Keep it outouched and copy the buffer without a terminator. */
+  memcpy(cp, cp2, i);
+  free(cp2);
+  return cp;
+}
+
+#endif /* CURL_DISABLE_LDAP */
+
+static int sockaddr2ebcdic(struct sockaddr_storage *dstaddr,
+                           const struct sockaddr *srcaddr, int srclen)
+{
+  const struct sockaddr_un *srcu;
+  struct sockaddr_un *dstu;
+  unsigned int i;
+  unsigned int dstsize;
+
+  /* Convert a socket address to job CCSID, if needed. */
+
+  if(!srcaddr || srclen < offsetof(struct sockaddr, sa_family) +
+     sizeof(srcaddr->sa_family) || srclen > sizeof(*dstaddr)) {
+    /* !checksrc! disable ERRNOVAR 1 */
+    errno = EINVAL;
+    return -1;
+  }
+
+  memcpy((char *)dstaddr, (char *)srcaddr, srclen);
+
+  switch(srcaddr->sa_family) {
+
+  case AF_UNIX:
+    srcu = (const struct sockaddr_un *)srcaddr;
+    dstu = (struct sockaddr_un *)dstaddr;
+    dstsize = sizeof(*dstaddr) - offsetof(struct sockaddr_un, sun_path);
+    srclen -= offsetof(struct sockaddr_un, sun_path);
+    i = QadrtConvertA2E(dstu->sun_path, srcu->sun_path, dstsize - 1, srclen);
+    dstu->sun_path[i] = '\0';
+    srclen = i + offsetof(struct sockaddr_un, sun_path);
+  }
+
+  return srclen;
+}
+
+static int sockaddr2ascii(struct sockaddr *dstaddr, int dstlen,
+                          const struct sockaddr_storage *srcaddr, int srclen)
+{
+  const struct sockaddr_un *srcu;
+  struct sockaddr_un *dstu;
+  unsigned int dstsize;
+
+  /* Convert a socket address to ASCII, if needed. */
+
+  if(!srclen)
+    return 0;
+  if(srclen > dstlen)
+    srclen = dstlen;
+  if(!srcaddr || srclen < 0) {
+    /* !checksrc! disable ERRNOVAR 1 */
+    errno = EINVAL;
+    return -1;
+  }
+
+  memcpy((char *)dstaddr, (char *)srcaddr, srclen);
+
+  if(srclen >= offsetof(struct sockaddr_storage, ss_family) +
+     sizeof(srcaddr->ss_family)) {
+    switch(srcaddr->ss_family) {
+
+    case AF_UNIX:
+      srcu = (const struct sockaddr_un *)srcaddr;
+      dstu = (struct sockaddr_un *)dstaddr;
+      dstsize = dstlen - offsetof(struct sockaddr_un, sun_path);
+      srclen -= offsetof(struct sockaddr_un, sun_path);
+      if(dstsize > 0 && srclen > 0) {
+        srclen = QadrtConvertE2A(dstu->sun_path, srcu->sun_path,
+                                 dstsize - 1, srclen);
+        dstu->sun_path[srclen] = '\0';
+      }
+      srclen += offsetof(struct sockaddr_un, sun_path);
+    }
+  }
+
+  return srclen;
+}
+
+int Curl_os400_connect(int sd, struct sockaddr *destaddr, int addrlen)
+{
+  int i;
+  struct sockaddr_storage laddr;
+
+  i = sockaddr2ebcdic(&laddr, destaddr, addrlen);
+
+  if(i < 0)
+    return -1;
+
+  return connect(sd, (struct sockaddr *)&laddr, i);
+}
+
+int Curl_os400_bind(int sd, struct sockaddr *localaddr, int addrlen)
+{
+  int i;
+  struct sockaddr_storage laddr;
+
+  i = sockaddr2ebcdic(&laddr, localaddr, addrlen);
+
+  if(i < 0)
+    return -1;
+
+  return bind(sd, (struct sockaddr *)&laddr, i);
+}
+
+int Curl_os400_sendto(int sd, char *buffer, int buflen, int flags,
+                      const struct sockaddr *dstaddr, int addrlen)
+{
+  int i;
+  struct sockaddr_storage laddr;
+
+  i = sockaddr2ebcdic(&laddr, dstaddr, addrlen);
+
+  if(i < 0)
+    return -1;
+
+  return sendto(sd, buffer, buflen, flags, (struct sockaddr *)&laddr, i);
+}
+
+int Curl_os400_recvfrom(int sd, char *buffer, int buflen, int flags,
+                        struct sockaddr *fromaddr, int *addrlen)
+{
+  int rcvlen;
+  struct sockaddr_storage laddr;
+  int laddrlen = sizeof(laddr);
+
+  if(!fromaddr || !addrlen || *addrlen <= 0)
+    return recvfrom(sd, buffer, buflen, flags, fromaddr, addrlen);
+
+  laddr.ss_family = AF_UNSPEC;          /* To detect if unused. */
+  rcvlen = recvfrom(sd, buffer, buflen, flags,
+                    (struct sockaddr *)&laddr, &laddrlen);
+
+  if(rcvlen < 0)
+    return rcvlen;
+
+  if(laddr.ss_family == AF_UNSPEC)
+    laddrlen = 0;
+  else {
+    laddrlen = sockaddr2ascii(fromaddr, *addrlen, &laddr, laddrlen);
+    if(laddrlen < 0)
+      return laddrlen;
+  }
+  *addrlen = laddrlen;
+  return rcvlen;
+}
+
+int Curl_os400_getpeername(int sd, struct sockaddr *addr, int *addrlen)
+{
+  struct sockaddr_storage laddr;
+  int laddrlen = sizeof(laddr);
+  int retcode = getpeername(sd, (struct sockaddr *)&laddr, &laddrlen);
+
+  if(!retcode) {
+    laddrlen = sockaddr2ascii(addr, *addrlen, &laddr, laddrlen);
+    if(laddrlen < 0)
+      return laddrlen;
+    *addrlen = laddrlen;
+  }
+
+  return retcode;
+}
+
+int Curl_os400_getsockname(int sd, struct sockaddr *addr, int *addrlen)
+{
+  struct sockaddr_storage laddr;
+  int laddrlen = sizeof(laddr);
+  int retcode = getsockname(sd, (struct sockaddr *)&laddr, &laddrlen);
+
+  if(!retcode) {
+    laddrlen = sockaddr2ascii(addr, *addrlen, &laddr, laddrlen);
+    if(laddrlen < 0)
+      return laddrlen;
+    *addrlen = laddrlen;
+  }
+
+  return retcode;
+}
+
+#ifdef HAVE_LIBZ
+const char *Curl_os400_zlibVersion(void)
+{
+  return set_thread_string(LK_ZLIB_VERSION, zlibVersion());
+}
+
+int Curl_os400_inflateInit_(z_streamp strm, const char *version,
+                            int stream_size)
+{
+  z_const char *msgb4 = strm->msg;
+  int ret;
+
+  ret = inflateInit(strm);
+
+  if(strm->msg != msgb4)
+    strm->msg = set_thread_string(LK_ZLIB_MSG, strm->msg);
+
+  return ret;
+}
+
+int Curl_os400_inflateInit2_(z_streamp strm, int windowBits,
+                             const char *version, int stream_size)
+{
+  z_const char *msgb4 = strm->msg;
+  int ret;
+
+  ret = inflateInit2(strm, windowBits);
+
+  if(strm->msg != msgb4)
+    strm->msg = set_thread_string(LK_ZLIB_MSG, strm->msg);
+
+  return ret;
+}
+
+int Curl_os400_inflate(z_streamp strm, int flush)
+{
+  z_const char *msgb4 = strm->msg;
+  int ret;
+
+  ret = inflate(strm, flush);
+
+  if(strm->msg != msgb4)
+    strm->msg = set_thread_string(LK_ZLIB_MSG, strm->msg);
+
+  return ret;
+}
+
+int Curl_os400_inflateEnd(z_streamp strm)
+{
+  z_const char *msgb4 = strm->msg;
+  int ret;
+
+  ret = inflateEnd(strm);
+
+  if(strm->msg != msgb4)
+    strm->msg = set_thread_string(LK_ZLIB_MSG, strm->msg);
+
+  return ret;
+}
+
+#endif
diff --git a/third-party/curl/projects/OS400/os400sys.h b/third-party/curl/projects/OS400/os400sys.h
new file mode 100644
index 0000000000..eb2cdb828a
--- /dev/null
+++ b/third-party/curl/projects/OS400/os400sys.h
@@ -0,0 +1,54 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ *
+ ***************************************************************************/
+
+/* OS/400 additional definitions. */
+
+#ifndef __OS400_SYS_
+#define __OS400_SYS_
+
+/* Per-thread item identifiers. */
+
+typedef enum {
+  LK_GSK_ERROR,
+  LK_LDAP_ERROR,
+  LK_CURL_VERSION,
+  LK_VERSION_INFO,
+  LK_VERSION_INFO_DATA,
+  LK_EASY_STRERROR,
+  LK_SHARE_STRERROR,
+  LK_MULTI_STRERROR,
+  LK_URL_STRERROR,
+  LK_ZLIB_VERSION,
+  LK_ZLIB_MSG,
+  LK_LAST
+} localkey_t;
+
+extern char *(*Curl_thread_buffer)(localkey_t key, long size);
+
+/* Maximum string expansion factor due to character code conversion. */
+
+#define MAX_CONV_EXPANSION 4       /* Can deal with UTF-8. */
+
+#endif
diff --git a/third-party/curl/packages/OS400/rpg-examples/HEADERAPI b/third-party/curl/projects/OS400/rpg-examples/HEADERAPI
similarity index 98%
rename from third-party/curl/packages/OS400/rpg-examples/HEADERAPI
rename to third-party/curl/projects/OS400/rpg-examples/HEADERAPI
index 2c2407ea24..f6ef80bbd4 100644
--- a/third-party/curl/packages/OS400/rpg-examples/HEADERAPI
+++ b/third-party/curl/projects/OS400/rpg-examples/HEADERAPI
@@ -1,4 +1,4 @@
-      * Curl header API: extract headers post transfer
+      * curl header API: extract headers post transfer
       *
      h DFTACTGRP(*NO) ACTGRP(*NEW)
      h OPTION(*NOSHOWCPY)
@@ -135,7 +135,7 @@
       *
      d len             s             10u 0
       *
-        len = %scan(X'00': string: 1: length); // Limit to zero-terminated string
+        len = %scan(X'00': string: 1: length); // Limit to null-terminated string
         if len = 0;
             len = length + 1;
         endif;
diff --git a/third-party/curl/packages/OS400/rpg-examples/HTTPPOST b/third-party/curl/projects/OS400/rpg-examples/HTTPPOST
similarity index 97%
rename from third-party/curl/packages/OS400/rpg-examples/HTTPPOST
rename to third-party/curl/projects/OS400/rpg-examples/HTTPPOST
index 21202ebe02..8e5d0d74bb 100644
--- a/third-party/curl/packages/OS400/rpg-examples/HTTPPOST
+++ b/third-party/curl/projects/OS400/rpg-examples/HTTPPOST
@@ -1,4 +1,4 @@
-      * Curl MIME post data and display response
+      * curl MIME post data and display response
       *
      h DFTACTGRP(*NO) ACTGRP(*NEW)
      h OPTION(*NOSHOWCPY)
@@ -118,7 +118,7 @@
       *
      d len             s             10u 0
       *
-        len = %scan(X'00': string: 1: length); // Limit to zero-terminated string
+        len = %scan(X'00': string: 1: length); // Limit to null-terminated string
         if len = 0;
             len = length + 1;
         endif;
diff --git a/third-party/curl/packages/OS400/rpg-examples/INMEMORY b/third-party/curl/projects/OS400/rpg-examples/INMEMORY
similarity index 98%
rename from third-party/curl/packages/OS400/rpg-examples/INMEMORY
rename to third-party/curl/projects/OS400/rpg-examples/INMEMORY
index e6f43abc84..7111d565e9 100644
--- a/third-party/curl/packages/OS400/rpg-examples/INMEMORY
+++ b/third-party/curl/projects/OS400/rpg-examples/INMEMORY
@@ -1,4 +1,4 @@
-      * Curl get in memory and count HTML tags
+      * curl get in memory and count HTML tags
       *
      h DFTACTGRP(*NO) ACTGRP(*NEW)
      h OPTION(*NOSHOWCPY)
@@ -148,7 +148,7 @@
       *
      d len             s             10u 0
       *
-        len = %scan(X'00': string: 1: length); // Limit to zero-terminated string
+        len = %scan(X'00': string: 1: length); // Limit to null-terminated string
         if len = 0;
             len = length + 1;
         endif;
diff --git a/third-party/curl/packages/OS400/rpg-examples/SIMPLE1 b/third-party/curl/projects/OS400/rpg-examples/SIMPLE1
similarity index 98%
rename from third-party/curl/packages/OS400/rpg-examples/SIMPLE1
rename to third-party/curl/projects/OS400/rpg-examples/SIMPLE1
index 52c0c93e89..2d2296ed40 100644
--- a/third-party/curl/packages/OS400/rpg-examples/SIMPLE1
+++ b/third-party/curl/projects/OS400/rpg-examples/SIMPLE1
@@ -1,4 +1,4 @@
-      * Curl simple URL request
+      * curl simple URL request
       *
      h DFTACTGRP(*NO) ACTGRP(*NEW)
      h OPTION(*NOSHOWCPY)
@@ -97,7 +97,7 @@
       *
      d len             s             10u 0
       *
-     c                   eval      len = %scan(X'00': string: 1: length)        Limit 0-terminated
+     c                   eval      len = %scan(X'00': string: 1: length)        Limit null-terminated
      c                   if        len = 0
      c                   eval      len = length + 1
      c                   endif
diff --git a/third-party/curl/packages/OS400/rpg-examples/SIMPLE2 b/third-party/curl/projects/OS400/rpg-examples/SIMPLE2
similarity index 96%
rename from third-party/curl/packages/OS400/rpg-examples/SIMPLE2
rename to third-party/curl/projects/OS400/rpg-examples/SIMPLE2
index 493c91ee23..2fead8517c 100644
--- a/third-party/curl/packages/OS400/rpg-examples/SIMPLE2
+++ b/third-party/curl/projects/OS400/rpg-examples/SIMPLE2
@@ -1,4 +1,4 @@
-      * Curl simple URL request (free-format RPG)
+      * curl simple URL request (free-format RPG)
       *
         ctl-opt dftactgrp(*NO) actgrp(*NEW)
                 option(*NOSHOWCPY)
@@ -97,7 +97,7 @@
 
             dcl-s len uns(10);
 
-            len = %scan(X'00': string: 1: length); // Limit to zero-terminated string
+            len = %scan(X'00': string: 1: length); // Limit to null-terminated string
             if len = 0;
                 len = length + 1;
             endif;
diff --git a/third-party/curl/packages/OS400/rpg-examples/SMTPSRCMBR b/third-party/curl/projects/OS400/rpg-examples/SMTPSRCMBR
similarity index 98%
rename from third-party/curl/packages/OS400/rpg-examples/SMTPSRCMBR
rename to third-party/curl/projects/OS400/rpg-examples/SMTPSRCMBR
index 88f4fd25ca..7e3a3fce6c 100644
--- a/third-party/curl/packages/OS400/rpg-examples/SMTPSRCMBR
+++ b/third-party/curl/projects/OS400/rpg-examples/SMTPSRCMBR
@@ -1,4 +1,4 @@
-      * Curl SMTP send source member as attachment
+      * curl SMTP send source member as attachment
       *
      h DFTACTGRP(*NO) ACTGRP(*NEW)
      h OPTION(*NOSHOWCPY)
@@ -228,7 +228,7 @@
      d addrdiff        s             10i 0
      d len             s             10u 0
       *
-        len = %scan(X'00': string: 1: length); // Limit to zero-terminated string
+        len = %scan(X'00': string: 1: length); // Limit to null-terminated string
         if len = 0;
             len = length + 1;
         endif;
diff --git a/third-party/curl/projects/README.md b/third-party/curl/projects/README.md
index 9b18ccd331..802a78f86a 100644
--- a/third-party/curl/projects/README.md
+++ b/third-party/curl/projects/README.md
@@ -4,157 +4,9 @@ Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
 SPDX-License-Identifier: curl
 -->
 
-Building via IDE Project Files
-==============================
+# Packages
 
-This document describes how to compile, build and install curl and libcurl
-from sources using an IDE based development tool such as Visual Studio.
-
-Project files are available for several different Visual C++ versions. The
-following directory structure has been used to cater for this:
-
-    somedirectory\
-     |_curl
-       |_projects
-         |_<platform>
-           |_<ide>
-             |_lib
-             |_src
-
-This structure allows for side-by-side compilation of curl on the same machine
-using different versions of a given compiler (for example VC10 and VC12) and
-allows for your own application or product to be compiled against those
-variants of libcurl for example.
-
-Note: Typically this side-by-side compilation is generally only required when
-a library is being compiled against dynamic runtime libraries.
-
-## Dependencies
-
-The projects files also support build configurations that require third party
-dependencies such as OpenSSL, wolfSSL and libssh2. If you wish to support
-these, you will also need to download and compile those libraries as well.
-
-To support compilation of these libraries using different versions of
-compilers, the following directory structure has been used for both the output
-of curl and libcurl as well as these dependencies.
-
-    somedirectory\
-     |_curl
-     | |_ build
-     |    |_<architecture>
-     |      |_<ide>
-     |        |_<configuration>
-     |          |_lib
-     |          |_src
-     |
-     |_openssl
-     | |_ build
-     |    |_<architecture>
-     |      |_VC <version>
-     |        |_<configuration>
-     |
-     |_libssh2
-       |_ build
-          |_<architecture>
-            |_VC <version>
-              |_<configuration>
-
-As OpenSSL and wolfSSL don't support side-by-side compilation when using
-different versions of Visual Studio, build helper batch files have been
-provided to assist with this. Please run `build-openssl -help` and/or
-`build-wolfssl -help` for usage details.
-
-## Building with Visual C++
-
-To build with VC++, you will of course have to first install VC++ which is
-part of Visual Studio.
-
-Once you have VC++ installed you should launch the application and open one of
-the solution or workspace files. The VC directory names are based on the
-version of Visual C++ that you will be using. Each version of Visual Studio
-has a default version of Visual C++. We offer these versions:
-
- - VC10      (Visual Studio 2010 Version 10.0)
- - VC11      (Visual Studio 2012 Version 11.0)
- - VC12      (Visual Studio 2013 Version 12.0)
- - VC14      (Visual Studio 2015 Version 14.0)
- - VC14.10   (Visual Studio 2017 Version 15.0)
- - VC14.30   (Visual Studio 2022 Version 17.0)
-
-Separate solutions are provided for both libcurl and the curl command line
-tool as well as a solution that includes both projects. libcurl.sln, curl.sln
-and curl-all.sln, respectively. We recommend using curl-all.sln to build both
-projects.
-
-For example, if you are using Visual Studio 2022 then you should be able to
-use `VC14.30\curl-all.sln` to build curl and libcurl.
-
-## Running DLL based configurations
-
-If you are a developer and plan to run the curl tool from Visual Studio with
-any third-party libraries (such as OpenSSL, wolfSSL or LibSSH2) then you will
-need to add the search path of these DLLs to the configuration's PATH
-environment. To do that:
-
- 1. Open the 'curl-all.sln' or 'curl.sln' solutions
- 2. Right-click on the 'curl' project and select Properties
- 3. Navigate to 'Configuration Properties > Debugging > Environment'
- 4. Add `PATH='Path to DLL';C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem`
-
-... where 'Path to DLL` is the configuration specific path. For example the
-following configurations in Visual Studio 2010 might be:
-
-DLL Debug - DLL OpenSSL (Win32):
-
-    PATH=..\..\..\..\..\openssl\build\Win32\VC10\DLL Debug;C:\Windows\system32;
-    C:\Windows;C:\Windows\System32\Wbem
-
-DLL Debug - DLL OpenSSL (x64):
-
-    PATH=..\..\..\..\..\openssl\build\Win64\VC10\DLL Debug;C:\Windows\system32;
-    C:\Windows;C:\Windows\System32\Wbem
-
-DLL Debug - DLL wolfSSL (Win32):
-
-    PATH=..\..\..\..\..\wolfssl\build\Win32\VC10\DLL Debug;C:\Windows\system32;
-    C:\Windows;C:\Windows\System32\Wbem
-
-DLL Debug - DLL wolfSSL (x64):
-
-    PATH=..\..\..\..\..\wolfssl\build\Win64\VC10\DLL Debug;C:\Windows\system32;
-    C:\Windows;C:\Windows\System32\Wbem
-
-If you are using a configuration that uses multiple third-party library DLLs
-(such as DLL Debug - DLL OpenSSL - DLL LibSSH2) then 'Path to DLL' will need
-to contain the path to both of these.
-
-## Notes
-
-The following keywords have been used in the directory hierarchy:
-
- - `<platform>`      - The platform (For example: Windows)
- - `<ide>`           - The IDE (For example: VC10)
- - `<architecture>`  - The platform architecture (For example: Win32, Win64)
- - `<configuration>` - The target configuration (For example: DLL Debug, LIB
-   Release - LIB OpenSSL)
-
-If you are using the source code from the git repository, rather than a
-release archive or nightly build, you will need to generate the project
-files. Please run "generate -help" for usage details.
-
-Should you wish to help out with some of the items on the TODO list, or find
-bugs in the project files that need correcting, and would like to submit
-updated files back then please note that, whilst the solution files can be
-edited directly, the templates for the project files (which are stored in the
-git repository) will need to be modified rather than the generated project
-files that Visual Studio uses.
-
-## Legacy Windows and SSL
-
-Some of the project configurations allow the use of Schannel, the native SSL
-library in Windows which forms part of Windows SSPI. However, Schannel in
-Windows <= XP is unable to connect to servers that no longer support the
-legacy handshakes and algorithms used by those versions. If you will be using
-curl in one of those earlier versions of Windows you should choose another SSL
-backend such as OpenSSL.
+This directory and all its subdirectories are for special package
+information, templates, scripts and docs. The files herein should be of
+use for those of you who want to package curl in a binary or source
+format for these platforms.
diff --git a/third-party/curl/projects/Windows/.gitignore b/third-party/curl/projects/Windows/.gitignore
index 257839afe4..23ef635062 100644
--- a/third-party/curl/projects/Windows/.gitignore
+++ b/third-party/curl/projects/Windows/.gitignore
@@ -2,7 +2,6 @@
 #
 # SPDX-License-Identifier: curl
 
-VC*/src/*curl.vcproj.dist
-VC*/lib/*curl.vcproj.dist
-VC*/src/*curl.vcxproj.dist
-VC*/lib/*curl.vcxproj.dist
+VC10/
+VC11/
+VC12/
diff --git a/third-party/curl/projects/Windows/README.md b/third-party/curl/projects/Windows/README.md
new file mode 100644
index 0000000000..1ce72f2b50
--- /dev/null
+++ b/third-party/curl/projects/Windows/README.md
@@ -0,0 +1,148 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# Building via IDE Project Files
+
+This document describes how to compile, build and install curl and libcurl
+from sources using legacy versions of Visual Studio 2010 - 2013.
+
+You need to generate the project files before using them. Please run "generate
+-help" for usage details.
+
+To generate project files for recent versions of Visual Studio instead, use
+cmake. Refer to INSTALL-CMAKE.md in the docs directory.
+
+## Directory Structure
+
+The following directory structure is used for the legacy project files:
+
+    somedirectory\
+     |_curl
+       |_projects
+         |_<platform>
+           |_<ide>
+             |_lib
+             |_src
+
+This structure allows for side-by-side compilation of curl on the same machine
+using different versions of a given compiler (for example VC10 and VC12) and
+allows for your own application or product to be compiled against those
+variants of libcurl for example.
+
+Note: Typically this side-by-side compilation is generally only required when
+a library is being compiled against dynamic runtime libraries.
+
+## Dependencies
+
+The projects files also support build configurations that require third party
+dependencies such as OpenSSL and libssh2. If you wish to support these, you
+also need to download and compile those libraries as well.
+
+To support compilation of these libraries using different versions of
+compilers, the following directory structure has been used for both the output
+of curl and libcurl as well as these dependencies.
+
+    somedirectory\
+     |_curl
+     | |_ build
+     |    |_<architecture>
+     |      |_<ide>
+     |        |_<configuration>
+     |          |_lib
+     |          |_src
+     |
+     |_openssl
+     | |_ build
+     |    |_<architecture>
+     |      |_VC <version>
+     |        |_<configuration>
+     |
+     |_libssh2
+       |_ build
+          |_<architecture>
+            |_VC <version>
+              |_<configuration>
+
+As OpenSSL does not support side-by-side compilation when using different
+versions of Visual Studio, a helper batch file has been provided to assist
+with this. Please run `build-openssl -help` for usage details.
+
+## Building with Visual C++
+
+To build with VC++, you have to first install VC++ which is part of Visual
+Studio.
+
+Once you have VC++ installed you should launch the application and open one of
+the solution or workspace files. The VC directory names are based on the
+version of Visual C++ that you use. Each version of Visual Studio has a
+default version of Visual C++. We offer these versions:
+
+- VC10      (Visual Studio 2010 Version 10.0)
+- VC11      (Visual Studio 2012 Version 11.0)
+- VC12      (Visual Studio 2013 Version 12.0)
+
+Separate solutions are provided for both libcurl and the curl command line
+tool as well as a solution that includes both projects. libcurl.sln, curl.sln
+and curl-all.sln, respectively. We recommend using curl-all.sln to build both
+projects.
+
+For example, if you are using Visual Studio 2010 then you should be able to
+use `VC10\curl-all.sln` to build curl and libcurl.
+
+## Running DLL based configurations
+
+If you are a developer and plan to run the curl tool from Visual Studio with
+any third-party libraries (such as OpenSSL or libssh2) then you need to add
+the search path of these DLLs to the configuration's PATH environment. To do
+that:
+
+1. Open the 'curl-all.sln' or 'curl.sln' solutions
+2. Right-click on the 'curl' project and select Properties
+3. Navigate to 'Configuration Properties > Debugging > Environment'
+4. Add `PATH='Path to DLL';C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem`
+
+... where `Path to DLL` is the configuration specific path. For example the
+following configurations in Visual Studio 2010 might be:
+
+DLL Debug - DLL OpenSSL (Win32):
+
+    PATH=..\..\..\..\..\openssl\build\Win32\VC10\DLL Debug;C:\Windows\System32;
+    C:\Windows;C:\Windows\System32\Wbem
+
+DLL Debug - DLL OpenSSL (x64):
+
+    PATH=..\..\..\..\..\openssl\build\Win64\VC10\DLL Debug;C:\Windows\System32;
+    C:\Windows;C:\Windows\System32\Wbem
+
+If you are using a configuration that uses multiple third-party library DLLs
+(such as `DLL Debug - DLL OpenSSL - DLL libssh2`) then 'Path to DLL' need to
+contain the path to both of these.
+
+## Notes
+
+The following keywords have been used in the directory hierarchy:
+
+- `<platform>`      - The platform (For example: Windows)
+- `<ide>`           - The IDE (For example: VC10)
+- `<architecture>`  - The platform architecture (For example: Win32, Win64)
+- `<configuration>` - The target configuration (For example: DLL Debug, LIB
+  Release - LIB OpenSSL)
+
+Should you wish to help out with some of the items on the TODO list, or find
+bugs in the project files that need correcting, and would like to submit
+updated files back then please note that, whilst the solution files can be
+edited directly, the templates for the project files (which are stored in the
+git repository) need to be modified rather than the generated project files
+that Visual Studio uses.
+
+## Legacy Windows and SSL
+
+Some of the project configurations use Schannel (Windows SSPI), the native SSL
+library that comes with the Windows OS. Schannel in Windows 8 and earlier is
+not able to connect to servers that no longer support the legacy handshakes
+and algorithms used by those versions. If you are using curl in one of those
+earlier versions of Windows you should choose another SSL backend like
+OpenSSL.
diff --git a/third-party/curl/projects/Windows/VC10/.gitignore b/third-party/curl/projects/Windows/VC10/.gitignore
deleted file mode 100644
index 53e3845a53..0000000000
--- a/third-party/curl/projects/Windows/VC10/.gitignore
+++ /dev/null
@@ -1,8 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-/*.ncb
-/*.opensdf
-/*.sdf
-/*.suo
diff --git a/third-party/curl/projects/Windows/VC10/curl-all.sln b/third-party/curl/projects/Windows/VC10/curl-all.sln
deleted file mode 100644
index 7bd131c35e..0000000000
--- a/third-party/curl/projects/Windows/VC10/curl-all.sln
+++ /dev/null
@@ -1,298 +0,0 @@
-Microsoft Visual Studio Solution File, Format Version 11.00
-# Visual Studio 2010
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "curl", "src\curl.vcxproj", "{5228E9CE-A216-422F-A5E6-58E95E2DD71D}"
-	ProjectSection(ProjectDependencies) = postProject
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB} = {DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}
-	EndProjectSection
-EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libcurl", "lib\libcurl.vcxproj", "{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|x64 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
-		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
-		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
-		DLL Debug - DLL wolfSSL|Win32 = DLL Debug - DLL wolfSSL|Win32
-		DLL Debug - DLL wolfSSL|x64 = DLL Debug - DLL wolfSSL|x64
-		DLL Debug|Win32 = DLL Debug|Win32
-		DLL Debug|x64 = DLL Debug|x64
-		DLL Release - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Release - DLL OpenSSL - DLL LibSSH2|x64 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
-		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
-		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
-		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
-		DLL Release - DLL wolfSSL|Win32 = DLL Release - DLL wolfSSL|Win32
-		DLL Release - DLL wolfSSL|x64 = DLL Release - DLL wolfSSL|x64
-		DLL Release|Win32 = DLL Release|Win32
-		DLL Release|x64 = DLL Release|x64
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|x64 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
-		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
-		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|x64 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
-		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
-		LIB Debug - LIB wolfSSL|Win32 = LIB Debug - LIB wolfSSL|Win32
-		LIB Debug - LIB wolfSSL|x64 = LIB Debug - LIB wolfSSL|x64
-		LIB Debug|Win32 = LIB Debug|Win32
-		LIB Debug|x64 = LIB Debug|x64
-		LIB Release - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Release - DLL OpenSSL - DLL LibSSH2|x64 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
-		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
-		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
-		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
-		LIB Release - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Release - LIB OpenSSL - LIB LibSSH2|x64 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
-		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
-		LIB Release - LIB wolfSSL|Win32 = LIB Release - LIB wolfSSL|Win32
-		LIB Release - LIB wolfSSL|x64 = LIB Release - LIB wolfSSL|x64
-		LIB Release|Win32 = LIB Release|Win32
-		LIB Release|x64 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.Build.0 = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.Build.0 = LIB Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.Build.0 = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.Build.0 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
diff --git a/third-party/curl/projects/Windows/VC10/lib/.gitignore b/third-party/curl/projects/Windows/VC10/lib/.gitignore
deleted file mode 100644
index 853b57dbc6..0000000000
--- a/third-party/curl/projects/Windows/VC10/lib/.gitignore
+++ /dev/null
@@ -1,10 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-/*.ncb
-/*.opensdf
-/*.sdf
-/*.suo
-/*.user
-/*.vcxproj
diff --git a/third-party/curl/projects/Windows/VC10/lib/libcurl.sln b/third-party/curl/projects/Windows/VC10/lib/libcurl.sln
deleted file mode 100644
index 15461ef9a2..0000000000
--- a/third-party/curl/projects/Windows/VC10/lib/libcurl.sln
+++ /dev/null
@@ -1,181 +0,0 @@
-Microsoft Visual Studio Solution File, Format Version 11.00
-# Visual Studio 2010
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libcurl", "libcurl.vcxproj", "{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|x64 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
-		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
-		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
-		DLL Debug - DLL wolfSSL|Win32 = DLL Debug - DLL wolfSSL|Win32
-		DLL Debug - DLL wolfSSL|x64 = DLL Debug - DLL wolfSSL|x64
-		DLL Debug|Win32 = DLL Debug|Win32
-		DLL Debug|x64 = DLL Debug|x64
-		DLL Release - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Release - DLL OpenSSL - DLL LibSSH2|x64 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
-		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
-		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
-		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
-		DLL Release - DLL wolfSSL|Win32 = DLL Release - DLL wolfSSL|Win32
-		DLL Release - DLL wolfSSL|x64 = DLL Release - DLL wolfSSL|x64
-		DLL Release|Win32 = DLL Release|Win32
-		DLL Release|x64 = DLL Release|x64
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|x64 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
-		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
-		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|x64 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
-		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
-		LIB Debug - LIB wolfSSL|Win32 = LIB Debug - LIB wolfSSL|Win32
-		LIB Debug - LIB wolfSSL|x64 = LIB Debug - LIB wolfSSL|x64
-		LIB Debug|Win32 = LIB Debug|Win32
-		LIB Debug|x64 = LIB Debug|x64
-		LIB Release - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Release - DLL OpenSSL - DLL LibSSH2|x64 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
-		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
-		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
-		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
-		LIB Release - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Release - LIB OpenSSL - LIB LibSSH2|x64 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
-		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
-		LIB Release - LIB wolfSSL|Win32 = LIB Release - LIB wolfSSL|Win32
-		LIB Release - LIB wolfSSL|x64 = LIB Release - LIB wolfSSL|x64
-		LIB Release|Win32 = LIB Release|Win32
-		LIB Release|x64 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.Build.0 = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.Build.0 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
diff --git a/third-party/curl/projects/Windows/VC10/lib/libcurl.tmpl b/third-party/curl/projects/Windows/VC10/lib/libcurl.tmpl
deleted file mode 100644
index 7a37c270f1..0000000000
--- a/third-party/curl/projects/Windows/VC10/lib/libcurl.tmpl
+++ /dev/null
@@ -1,2353 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup Label="ProjectConfigurations">
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|Win32">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|x64">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|x64">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|Win32">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|x64">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|Win32">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|x64">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|Win32">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|x64">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|x64">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|Win32">
-      <Configuration>DLL Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|x64">
-      <Configuration>DLL Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|x64">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|Win32">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|x64">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|x64">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|Win32">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|x64">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|Win32">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|x64">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|x64">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|Win32">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|x64">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|Win32">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|x64">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|Win32">
-      <Configuration>LIB Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|x64">
-      <Configuration>LIB Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-  </ItemGroup>
-  <PropertyGroup Label="Globals">
-    <ProjectGuid>{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}</ProjectGuid>
-    <RootNamespace>libcurl</RootNamespace>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
-  <ImportGroup Label="ExtensionSettings">
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <PropertyGroup Label="UserMacros" />
-  <PropertyGroup>
-    <_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(ProjectName)d</TargetName>
-  </PropertyGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win32\VC10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win64\VC10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win32\VC10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win64\VC10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC10\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC10\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC10\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC10\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC10\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC10\DLL Debug;..\..\..\..\..\libssh2\build\Win32\VC10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC10\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC10\DLL Debug;..\..\..\..\..\libssh2\build\Win64\VC10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC10\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC10\DLL Release;..\..\..\..\..\libssh2\build\Win32\VC10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC10\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC10\DLL Release;..\..\..\..\..\libssh2\build\Win64\VC10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC10\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC10\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC10\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC10\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC10\LIB Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC10\LIB Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC10\LIB Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC10\LIB Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC10\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC10\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC10\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC10\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC10\LIB Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC10\LIB Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC10\LIB Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC10\LIB Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemGroup>
-CURL_LIB_C_FILES
-CURL_LIB_VAUTH_C_FILES
-CURL_LIB_VQUIC_C_FILES
-CURL_LIB_VSSH_C_FILES
-CURL_LIB_VTLS_C_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_LIB_H_FILES
-CURL_LIB_VAUTH_H_FILES
-CURL_LIB_VQUIC_H_FILES
-CURL_LIB_VSSH_H_FILES
-CURL_LIB_VTLS_H_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_LIB_RC_FILES
-  </ItemGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
-  <ImportGroup Label="ExtensionTargets">
-  </ImportGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC10/lib/libcurl.vcxproj.filters b/third-party/curl/projects/Windows/VC10/lib/libcurl.vcxproj.filters
deleted file mode 100644
index 4d6341d749..0000000000
--- a/third-party/curl/projects/Windows/VC10/lib/libcurl.vcxproj.filters
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup>
-    <Filter Include="Source Files">
-      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
-      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
-    </Filter>
-    <Filter Include="Header Files">
-      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
-      <Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
-    </Filter>
-    <Filter Include="Resource Files">
-      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
-      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
-    </Filter>
-  </ItemGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC10/src/.gitignore b/third-party/curl/projects/Windows/VC10/src/.gitignore
deleted file mode 100644
index 853b57dbc6..0000000000
--- a/third-party/curl/projects/Windows/VC10/src/.gitignore
+++ /dev/null
@@ -1,10 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-/*.ncb
-/*.opensdf
-/*.sdf
-/*.suo
-/*.user
-/*.vcxproj
diff --git a/third-party/curl/projects/Windows/VC10/src/curl.sln b/third-party/curl/projects/Windows/VC10/src/curl.sln
deleted file mode 100644
index 131f27b7a7..0000000000
--- a/third-party/curl/projects/Windows/VC10/src/curl.sln
+++ /dev/null
@@ -1,181 +0,0 @@
-Microsoft Visual Studio Solution File, Format Version 11.00
-# Visual Studio 2010
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "curl", "curl.vcxproj", "{5228E9CE-A216-422F-A5E6-58E95E2DD71D}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|x64 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
-		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
-		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
-		DLL Debug - DLL wolfSSL|Win32 = DLL Debug - DLL wolfSSL|Win32
-		DLL Debug - DLL wolfSSL|x64 = DLL Debug - DLL wolfSSL|x64
-		DLL Debug|Win32 = DLL Debug|Win32
-		DLL Debug|x64 = DLL Debug|x64
-		DLL Release - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Release - DLL OpenSSL - DLL LibSSH2|x64 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
-		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
-		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
-		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
-		DLL Release - DLL wolfSSL|Win32 = DLL Release - DLL wolfSSL|Win32
-		DLL Release - DLL wolfSSL|x64 = DLL Release - DLL wolfSSL|x64
-		DLL Release|Win32 = DLL Release|Win32
-		DLL Release|x64 = DLL Release|x64
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|x64 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
-		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
-		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|x64 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
-		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
-		LIB Debug - LIB wolfSSL|Win32 = LIB Debug - LIB wolfSSL|Win32
-		LIB Debug - LIB wolfSSL|x64 = LIB Debug - LIB wolfSSL|x64
-		LIB Debug|Win32 = LIB Debug|Win32
-		LIB Debug|x64 = LIB Debug|x64
-		LIB Release - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Release - DLL OpenSSL - DLL LibSSH2|x64 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
-		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
-		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
-		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
-		LIB Release - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Release - LIB OpenSSL - LIB LibSSH2|x64 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
-		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
-		LIB Release - LIB wolfSSL|Win32 = LIB Release - LIB wolfSSL|Win32
-		LIB Release - LIB wolfSSL|x64 = LIB Release - LIB wolfSSL|x64
-		LIB Release|Win32 = LIB Release|Win32
-		LIB Release|x64 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.Build.0 = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.Build.0 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
diff --git a/third-party/curl/projects/Windows/VC10/src/curl.tmpl b/third-party/curl/projects/Windows/VC10/src/curl.tmpl
deleted file mode 100644
index 5e24977a4e..0000000000
--- a/third-party/curl/projects/Windows/VC10/src/curl.tmpl
+++ /dev/null
@@ -1,2643 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup Label="ProjectConfigurations">
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|Win32">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|x64">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|x64">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|Win32">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|x64">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|Win32">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|x64">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|Win32">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|x64">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|x64">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|Win32">
-      <Configuration>DLL Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|x64">
-      <Configuration>DLL Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|x64">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|Win32">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|x64">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|x64">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|Win32">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|x64">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|Win32">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|x64">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|x64">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|Win32">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|x64">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|Win32">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|x64">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|Win32">
-      <Configuration>LIB Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|x64">
-      <Configuration>LIB Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-  </ItemGroup>
-  <PropertyGroup Label="Globals">
-    <ProjectGuid>{5228E9CE-A216-422F-A5E6-58E95E2DD71D}</ProjectGuid>
-    <RootNamespace>curl</RootNamespace>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
-  <ImportGroup Label="ExtensionSettings">
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <PropertyGroup Label="UserMacros" />
-  <PropertyGroup>
-    <_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">$(ProjectName)</TargetName>
-  </PropertyGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);..\..\..\..\..\wolfssl\build\Win32\VC10\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);..\..\..\..\..\wolfssl\build\Win64\VC10\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);..\..\..\..\..\wolfssl\build\Win32\VC10\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);..\..\..\..\..\wolfssl\build\Win64\VC10\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC10\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC10\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC10\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC10\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC10\LIB Debug;..\..\..\..\..\libssh2\build\Win32\VC10\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC10\LIB Debug;..\..\..\..\..\libssh2\build\Win64\VC10\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC10\LIB Release;..\..\..\..\..\libssh2\build\Win32\VC10\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC10\LIB Release;..\..\..\..\..\libssh2\build\Win64\VC10\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC10\DLL Debug;..\..\..\..\..\libssh2\build\Win32\VC10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC10\DLL Debug;..\..\..\..\..\libssh2\build\Win64\VC10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC10\DLL Release;..\..\..\..\..\libssh2\build\Win32\VC10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libssh2.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC10\DLL Release;..\..\..\..\..\libssh2\build\Win64\VC10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemGroup>
-CURL_SRC_X_C_FILES
-CURL_SRC_C_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_SRC_X_H_FILES
-CURL_SRC_H_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_SRC_RC_FILES
-  </ItemGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
-  <ImportGroup Label="ExtensionTargets">
-  </ImportGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC10/src/curl.vcxproj.filters b/third-party/curl/projects/Windows/VC10/src/curl.vcxproj.filters
deleted file mode 100644
index 4d6341d749..0000000000
--- a/third-party/curl/projects/Windows/VC10/src/curl.vcxproj.filters
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup>
-    <Filter Include="Source Files">
-      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
-      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
-    </Filter>
-    <Filter Include="Header Files">
-      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
-      <Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
-    </Filter>
-    <Filter Include="Resource Files">
-      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
-      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
-    </Filter>
-  </ItemGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC11/.gitignore b/third-party/curl/projects/Windows/VC11/.gitignore
deleted file mode 100644
index 53e3845a53..0000000000
--- a/third-party/curl/projects/Windows/VC11/.gitignore
+++ /dev/null
@@ -1,8 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-/*.ncb
-/*.opensdf
-/*.sdf
-/*.suo
diff --git a/third-party/curl/projects/Windows/VC11/curl-all.sln b/third-party/curl/projects/Windows/VC11/curl-all.sln
deleted file mode 100644
index bec0ad84c7..0000000000
--- a/third-party/curl/projects/Windows/VC11/curl-all.sln
+++ /dev/null
@@ -1,298 +0,0 @@
-Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 2012
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "curl", "src\curl.vcxproj", "{5228E9CE-A216-422F-A5E6-58E95E2DD71D}"
-	ProjectSection(ProjectDependencies) = postProject
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB} = {DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}
-	EndProjectSection
-EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libcurl", "lib\libcurl.vcxproj", "{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|x64 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
-		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
-		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
-		DLL Debug - DLL wolfSSL|Win32 = DLL Debug - DLL wolfSSL|Win32
-		DLL Debug - DLL wolfSSL|x64 = DLL Debug - DLL wolfSSL|x64
-		DLL Debug|Win32 = DLL Debug|Win32
-		DLL Debug|x64 = DLL Debug|x64
-		DLL Release - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Release - DLL OpenSSL - DLL LibSSH2|x64 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
-		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
-		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
-		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
-		DLL Release - DLL wolfSSL|Win32 = DLL Release - DLL wolfSSL|Win32
-		DLL Release - DLL wolfSSL|x64 = DLL Release - DLL wolfSSL|x64
-		DLL Release|Win32 = DLL Release|Win32
-		DLL Release|x64 = DLL Release|x64
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|x64 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
-		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
-		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|x64 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
-		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
-		LIB Debug - LIB wolfSSL|Win32 = LIB Debug - LIB wolfSSL|Win32
-		LIB Debug - LIB wolfSSL|x64 = LIB Debug - LIB wolfSSL|x64
-		LIB Debug|Win32 = LIB Debug|Win32
-		LIB Debug|x64 = LIB Debug|x64
-		LIB Release - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Release - DLL OpenSSL - DLL LibSSH2|x64 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
-		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
-		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
-		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
-		LIB Release - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Release - LIB OpenSSL - LIB LibSSH2|x64 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
-		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
-		LIB Release - LIB wolfSSL|Win32 = LIB Release - LIB wolfSSL|Win32
-		LIB Release - LIB wolfSSL|x64 = LIB Release - LIB wolfSSL|x64
-		LIB Release|Win32 = LIB Release|Win32
-		LIB Release|x64 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.Build.0 = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.Build.0 = LIB Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.Build.0 = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.Build.0 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
diff --git a/third-party/curl/projects/Windows/VC11/lib/.gitignore b/third-party/curl/projects/Windows/VC11/lib/.gitignore
deleted file mode 100644
index 853b57dbc6..0000000000
--- a/third-party/curl/projects/Windows/VC11/lib/.gitignore
+++ /dev/null
@@ -1,10 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-/*.ncb
-/*.opensdf
-/*.sdf
-/*.suo
-/*.user
-/*.vcxproj
diff --git a/third-party/curl/projects/Windows/VC11/lib/libcurl.sln b/third-party/curl/projects/Windows/VC11/lib/libcurl.sln
deleted file mode 100644
index 780dc91a2a..0000000000
--- a/third-party/curl/projects/Windows/VC11/lib/libcurl.sln
+++ /dev/null
@@ -1,181 +0,0 @@
-Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 2012
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libcurl", "libcurl.vcxproj", "{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|x64 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
-		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
-		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
-		DLL Debug - DLL wolfSSL|Win32 = DLL Debug - DLL wolfSSL|Win32
-		DLL Debug - DLL wolfSSL|x64 = DLL Debug - DLL wolfSSL|x64
-		DLL Debug|Win32 = DLL Debug|Win32
-		DLL Debug|x64 = DLL Debug|x64
-		DLL Release - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Release - DLL OpenSSL - DLL LibSSH2|x64 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
-		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
-		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
-		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
-		DLL Release - DLL wolfSSL|Win32 = DLL Release - DLL wolfSSL|Win32
-		DLL Release - DLL wolfSSL|x64 = DLL Release - DLL wolfSSL|x64
-		DLL Release|Win32 = DLL Release|Win32
-		DLL Release|x64 = DLL Release|x64
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|x64 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
-		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
-		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|x64 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
-		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
-		LIB Debug - LIB wolfSSL|Win32 = LIB Debug - LIB wolfSSL|Win32
-		LIB Debug - LIB wolfSSL|x64 = LIB Debug - LIB wolfSSL|x64
-		LIB Debug|Win32 = LIB Debug|Win32
-		LIB Debug|x64 = LIB Debug|x64
-		LIB Release - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Release - DLL OpenSSL - DLL LibSSH2|x64 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
-		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
-		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
-		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
-		LIB Release - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Release - LIB OpenSSL - LIB LibSSH2|x64 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
-		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
-		LIB Release - LIB wolfSSL|Win32 = LIB Release - LIB wolfSSL|Win32
-		LIB Release - LIB wolfSSL|x64 = LIB Release - LIB wolfSSL|x64
-		LIB Release|Win32 = LIB Release|Win32
-		LIB Release|x64 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.Build.0 = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.Build.0 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
diff --git a/third-party/curl/projects/Windows/VC11/lib/libcurl.tmpl b/third-party/curl/projects/Windows/VC11/lib/libcurl.tmpl
deleted file mode 100644
index 95cc9f6ca5..0000000000
--- a/third-party/curl/projects/Windows/VC11/lib/libcurl.tmpl
+++ /dev/null
@@ -1,2409 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup Label="ProjectConfigurations">
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|Win32">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|x64">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|x64">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|Win32">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|x64">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|Win32">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|x64">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|Win32">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|x64">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|x64">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|Win32">
-      <Configuration>DLL Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|x64">
-      <Configuration>DLL Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|x64">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|Win32">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|x64">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|x64">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|Win32">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|x64">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|Win32">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|x64">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|x64">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|Win32">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|x64">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|Win32">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|x64">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|Win32">
-      <Configuration>LIB Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|x64">
-      <Configuration>LIB Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-  </ItemGroup>
-  <PropertyGroup Label="Globals">
-    <ProjectGuid>{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}</ProjectGuid>
-    <RootNamespace>libcurl</RootNamespace>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
-  <ImportGroup Label="ExtensionSettings">
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <PropertyGroup Label="UserMacros" />
-  <PropertyGroup>
-    <_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(ProjectName)d</TargetName>
-  </PropertyGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win32\VC11\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win64\VC11\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win32\VC11\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win64\VC11\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC11\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC11\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC11\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC11\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC11\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC11\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC11\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC11\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC11\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC11\DLL Debug;..\..\..\..\..\libssh2\build\Win32\VC11\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC11\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC11\DLL Debug;..\..\..\..\..\libssh2\build\Win64\VC11\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC11\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC11\DLL Release;..\..\..\..\..\libssh2\build\Win32\VC11\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC11\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC11\DLL Release;..\..\..\..\..\libssh2\build\Win64\VC11\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC11\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC11\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC11\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC11\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC11\LIB Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC11\LIB Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC11\LIB Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC11\LIB Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC11\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC11\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC11\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC11\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC11\LIB Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC11\LIB Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC11\LIB Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC11\LIB Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemGroup>
-CURL_LIB_C_FILES
-CURL_LIB_VAUTH_C_FILES
-CURL_LIB_VQUIC_C_FILES
-CURL_LIB_VSSH_C_FILES
-CURL_LIB_VTLS_C_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_LIB_H_FILES
-CURL_LIB_VAUTH_H_FILES
-CURL_LIB_VQUIC_H_FILES
-CURL_LIB_VSSH_H_FILES
-CURL_LIB_VTLS_H_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_LIB_RC_FILES
-  </ItemGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
-  <ImportGroup Label="ExtensionTargets">
-  </ImportGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC11/lib/libcurl.vcxproj.filters b/third-party/curl/projects/Windows/VC11/lib/libcurl.vcxproj.filters
deleted file mode 100644
index 4d6341d749..0000000000
--- a/third-party/curl/projects/Windows/VC11/lib/libcurl.vcxproj.filters
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup>
-    <Filter Include="Source Files">
-      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
-      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
-    </Filter>
-    <Filter Include="Header Files">
-      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
-      <Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
-    </Filter>
-    <Filter Include="Resource Files">
-      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
-      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
-    </Filter>
-  </ItemGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC11/src/.gitignore b/third-party/curl/projects/Windows/VC11/src/.gitignore
deleted file mode 100644
index 853b57dbc6..0000000000
--- a/third-party/curl/projects/Windows/VC11/src/.gitignore
+++ /dev/null
@@ -1,10 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-/*.ncb
-/*.opensdf
-/*.sdf
-/*.suo
-/*.user
-/*.vcxproj
diff --git a/third-party/curl/projects/Windows/VC11/src/curl.sln b/third-party/curl/projects/Windows/VC11/src/curl.sln
deleted file mode 100644
index e12253e9b5..0000000000
--- a/third-party/curl/projects/Windows/VC11/src/curl.sln
+++ /dev/null
@@ -1,181 +0,0 @@
-Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 2012
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "curl", "curl.vcxproj", "{5228E9CE-A216-422F-A5E6-58E95E2DD71D}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|x64 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
-		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
-		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
-		DLL Debug - DLL wolfSSL|Win32 = DLL Debug - DLL wolfSSL|Win32
-		DLL Debug - DLL wolfSSL|x64 = DLL Debug - DLL wolfSSL|x64
-		DLL Debug|Win32 = DLL Debug|Win32
-		DLL Debug|x64 = DLL Debug|x64
-		DLL Release - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Release - DLL OpenSSL - DLL LibSSH2|x64 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
-		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
-		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
-		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
-		DLL Release - DLL wolfSSL|Win32 = DLL Release - DLL wolfSSL|Win32
-		DLL Release - DLL wolfSSL|x64 = DLL Release - DLL wolfSSL|x64
-		DLL Release|Win32 = DLL Release|Win32
-		DLL Release|x64 = DLL Release|x64
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|x64 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
-		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
-		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|x64 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
-		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
-		LIB Debug - LIB wolfSSL|Win32 = LIB Debug - LIB wolfSSL|Win32
-		LIB Debug - LIB wolfSSL|x64 = LIB Debug - LIB wolfSSL|x64
-		LIB Debug|Win32 = LIB Debug|Win32
-		LIB Debug|x64 = LIB Debug|x64
-		LIB Release - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Release - DLL OpenSSL - DLL LibSSH2|x64 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
-		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
-		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
-		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
-		LIB Release - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Release - LIB OpenSSL - LIB LibSSH2|x64 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
-		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
-		LIB Release - LIB wolfSSL|Win32 = LIB Release - LIB wolfSSL|Win32
-		LIB Release - LIB wolfSSL|x64 = LIB Release - LIB wolfSSL|x64
-		LIB Release|Win32 = LIB Release|Win32
-		LIB Release|x64 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.Build.0 = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.Build.0 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
diff --git a/third-party/curl/projects/Windows/VC11/src/curl.tmpl b/third-party/curl/projects/Windows/VC11/src/curl.tmpl
deleted file mode 100644
index 31df7d640f..0000000000
--- a/third-party/curl/projects/Windows/VC11/src/curl.tmpl
+++ /dev/null
@@ -1,2699 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup Label="ProjectConfigurations">
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|Win32">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|x64">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|x64">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|Win32">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|x64">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|Win32">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|x64">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|Win32">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|x64">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|x64">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|Win32">
-      <Configuration>DLL Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|x64">
-      <Configuration>DLL Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|x64">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|Win32">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|x64">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|x64">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|Win32">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|x64">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|Win32">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|x64">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|x64">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|Win32">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|x64">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|Win32">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|x64">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|Win32">
-      <Configuration>LIB Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|x64">
-      <Configuration>LIB Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-  </ItemGroup>
-  <PropertyGroup Label="Globals">
-    <ProjectGuid>{5228E9CE-A216-422F-A5E6-58E95E2DD71D}</ProjectGuid>
-    <RootNamespace>curl</RootNamespace>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v110</PlatformToolset>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
-  <ImportGroup Label="ExtensionSettings">
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <PropertyGroup Label="UserMacros" />
-  <PropertyGroup>
-    <_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC11\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">$(ProjectName)</TargetName>
-  </PropertyGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);..\..\..\..\..\wolfssl\build\Win32\VC11\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);..\..\..\..\..\wolfssl\build\Win64\VC11\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);..\..\..\..\..\wolfssl\build\Win32\VC11\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);..\..\..\..\..\wolfssl\build\Win64\VC11\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC11\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC11\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC11\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC11\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC11\LIB Debug;..\..\..\..\..\libssh2\build\Win32\VC11\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC11\LIB Debug;..\..\..\..\..\libssh2\build\Win64\VC11\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC11\LIB Release;..\..\..\..\..\libssh2\build\Win32\VC11\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC11\LIB Release;..\..\..\..\..\libssh2\build\Win64\VC11\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC11\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC11\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC11\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC11\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC11\DLL Debug;..\..\..\..\..\libssh2\build\Win32\VC11\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC11\DLL Debug;..\..\..\..\..\libssh2\build\Win64\VC11\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC11\DLL Release;..\..\..\..\..\libssh2\build\Win32\VC11\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libssh2.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC11\DLL Release;..\..\..\..\..\libssh2\build\Win64\VC11\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC11\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemGroup>
-CURL_SRC_X_C_FILES
-CURL_SRC_C_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_SRC_X_H_FILES
-CURL_SRC_H_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_SRC_RC_FILES
-  </ItemGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
-  <ImportGroup Label="ExtensionTargets">
-  </ImportGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC11/src/curl.vcxproj.filters b/third-party/curl/projects/Windows/VC11/src/curl.vcxproj.filters
deleted file mode 100644
index 4d6341d749..0000000000
--- a/third-party/curl/projects/Windows/VC11/src/curl.vcxproj.filters
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup>
-    <Filter Include="Source Files">
-      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
-      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
-    </Filter>
-    <Filter Include="Header Files">
-      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
-      <Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
-    </Filter>
-    <Filter Include="Resource Files">
-      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
-      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
-    </Filter>
-  </ItemGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC12/.gitignore b/third-party/curl/projects/Windows/VC12/.gitignore
deleted file mode 100644
index 53e3845a53..0000000000
--- a/third-party/curl/projects/Windows/VC12/.gitignore
+++ /dev/null
@@ -1,8 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-/*.ncb
-/*.opensdf
-/*.sdf
-/*.suo
diff --git a/third-party/curl/projects/Windows/VC12/curl-all.sln b/third-party/curl/projects/Windows/VC12/curl-all.sln
deleted file mode 100644
index 38b33e6f54..0000000000
--- a/third-party/curl/projects/Windows/VC12/curl-all.sln
+++ /dev/null
@@ -1,298 +0,0 @@
-Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 2013
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "curl", "src\curl.vcxproj", "{5228E9CE-A216-422F-A5E6-58E95E2DD71D}"
-	ProjectSection(ProjectDependencies) = postProject
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB} = {DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}
-	EndProjectSection
-EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libcurl", "lib\libcurl.vcxproj", "{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|x64 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
-		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
-		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
-		DLL Debug - DLL wolfSSL|Win32 = DLL Debug - DLL wolfSSL|Win32
-		DLL Debug - DLL wolfSSL|x64 = DLL Debug - DLL wolfSSL|x64
-		DLL Debug|Win32 = DLL Debug|Win32
-		DLL Debug|x64 = DLL Debug|x64
-		DLL Release - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Release - DLL OpenSSL - DLL LibSSH2|x64 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
-		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
-		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
-		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
-		DLL Release - DLL wolfSSL|Win32 = DLL Release - DLL wolfSSL|Win32
-		DLL Release - DLL wolfSSL|x64 = DLL Release - DLL wolfSSL|x64
-		DLL Release|Win32 = DLL Release|Win32
-		DLL Release|x64 = DLL Release|x64
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|x64 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
-		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
-		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|x64 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
-		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
-		LIB Debug - LIB wolfSSL|Win32 = LIB Debug - LIB wolfSSL|Win32
-		LIB Debug - LIB wolfSSL|x64 = LIB Debug - LIB wolfSSL|x64
-		LIB Debug|Win32 = LIB Debug|Win32
-		LIB Debug|x64 = LIB Debug|x64
-		LIB Release - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Release - DLL OpenSSL - DLL LibSSH2|x64 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
-		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
-		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
-		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
-		LIB Release - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Release - LIB OpenSSL - LIB LibSSH2|x64 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
-		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
-		LIB Release - LIB wolfSSL|Win32 = LIB Release - LIB wolfSSL|Win32
-		LIB Release - LIB wolfSSL|x64 = LIB Release - LIB wolfSSL|x64
-		LIB Release|Win32 = LIB Release|Win32
-		LIB Release|x64 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.Build.0 = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.Build.0 = LIB Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.Build.0 = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.Build.0 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
diff --git a/third-party/curl/projects/Windows/VC12/lib/.gitignore b/third-party/curl/projects/Windows/VC12/lib/.gitignore
deleted file mode 100644
index 853b57dbc6..0000000000
--- a/third-party/curl/projects/Windows/VC12/lib/.gitignore
+++ /dev/null
@@ -1,10 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-/*.ncb
-/*.opensdf
-/*.sdf
-/*.suo
-/*.user
-/*.vcxproj
diff --git a/third-party/curl/projects/Windows/VC12/lib/libcurl.sln b/third-party/curl/projects/Windows/VC12/lib/libcurl.sln
deleted file mode 100644
index 860a06028e..0000000000
--- a/third-party/curl/projects/Windows/VC12/lib/libcurl.sln
+++ /dev/null
@@ -1,181 +0,0 @@
-Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 2013
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libcurl", "libcurl.vcxproj", "{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|x64 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
-		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
-		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
-		DLL Debug - DLL wolfSSL|Win32 = DLL Debug - DLL wolfSSL|Win32
-		DLL Debug - DLL wolfSSL|x64 = DLL Debug - DLL wolfSSL|x64
-		DLL Debug|Win32 = DLL Debug|Win32
-		DLL Debug|x64 = DLL Debug|x64
-		DLL Release - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Release - DLL OpenSSL - DLL LibSSH2|x64 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
-		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
-		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
-		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
-		DLL Release - DLL wolfSSL|Win32 = DLL Release - DLL wolfSSL|Win32
-		DLL Release - DLL wolfSSL|x64 = DLL Release - DLL wolfSSL|x64
-		DLL Release|Win32 = DLL Release|Win32
-		DLL Release|x64 = DLL Release|x64
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|x64 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
-		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
-		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|x64 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
-		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
-		LIB Debug - LIB wolfSSL|Win32 = LIB Debug - LIB wolfSSL|Win32
-		LIB Debug - LIB wolfSSL|x64 = LIB Debug - LIB wolfSSL|x64
-		LIB Debug|Win32 = LIB Debug|Win32
-		LIB Debug|x64 = LIB Debug|x64
-		LIB Release - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Release - DLL OpenSSL - DLL LibSSH2|x64 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
-		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
-		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
-		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
-		LIB Release - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Release - LIB OpenSSL - LIB LibSSH2|x64 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
-		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
-		LIB Release - LIB wolfSSL|Win32 = LIB Release - LIB wolfSSL|Win32
-		LIB Release - LIB wolfSSL|x64 = LIB Release - LIB wolfSSL|x64
-		LIB Release|Win32 = LIB Release|Win32
-		LIB Release|x64 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.Build.0 = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.Build.0 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
diff --git a/third-party/curl/projects/Windows/VC12/lib/libcurl.tmpl b/third-party/curl/projects/Windows/VC12/lib/libcurl.tmpl
deleted file mode 100644
index a2d666c255..0000000000
--- a/third-party/curl/projects/Windows/VC12/lib/libcurl.tmpl
+++ /dev/null
@@ -1,2409 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup Label="ProjectConfigurations">
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|Win32">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|x64">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|x64">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|Win32">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|x64">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|Win32">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|x64">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|Win32">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|x64">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|x64">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|Win32">
-      <Configuration>DLL Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|x64">
-      <Configuration>DLL Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|x64">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|Win32">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|x64">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|x64">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|Win32">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|x64">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|Win32">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|x64">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|x64">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|Win32">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|x64">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|Win32">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|x64">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|Win32">
-      <Configuration>LIB Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|x64">
-      <Configuration>LIB Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-  </ItemGroup>
-  <PropertyGroup Label="Globals">
-    <ProjectGuid>{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}</ProjectGuid>
-    <RootNamespace>libcurl</RootNamespace>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
-  <ImportGroup Label="ExtensionSettings">
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <PropertyGroup Label="UserMacros" />
-  <PropertyGroup>
-    <_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(ProjectName)d</TargetName>
-  </PropertyGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win32\VC12\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win64\VC12\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win32\VC12\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win64\VC12\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC12\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC12\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC12\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC12\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC12\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC12\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC12\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC12\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC12\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC12\DLL Debug;..\..\..\..\..\libssh2\build\Win32\VC12\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC12\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC12\DLL Debug;..\..\..\..\..\libssh2\build\Win64\VC12\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC12\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC12\DLL Release;..\..\..\..\..\libssh2\build\Win32\VC12\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC12\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC12\DLL Release;..\..\..\..\..\libssh2\build\Win64\VC12\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC12\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC12\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC12\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC12\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC12\LIB Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC12\LIB Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC12\LIB Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC12\LIB Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC12\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC12\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC12\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC12\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC12\LIB Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC12\LIB Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC12\LIB Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC12\LIB Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemGroup>
-CURL_LIB_C_FILES
-CURL_LIB_VAUTH_C_FILES
-CURL_LIB_VQUIC_C_FILES
-CURL_LIB_VSSH_C_FILES
-CURL_LIB_VTLS_C_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_LIB_H_FILES
-CURL_LIB_VAUTH_H_FILES
-CURL_LIB_VQUIC_H_FILES
-CURL_LIB_VSSH_H_FILES
-CURL_LIB_VTLS_H_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_LIB_RC_FILES
-  </ItemGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
-  <ImportGroup Label="ExtensionTargets">
-  </ImportGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC12/lib/libcurl.vcxproj.filters b/third-party/curl/projects/Windows/VC12/lib/libcurl.vcxproj.filters
deleted file mode 100644
index 4d6341d749..0000000000
--- a/third-party/curl/projects/Windows/VC12/lib/libcurl.vcxproj.filters
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup>
-    <Filter Include="Source Files">
-      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
-      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
-    </Filter>
-    <Filter Include="Header Files">
-      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
-      <Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
-    </Filter>
-    <Filter Include="Resource Files">
-      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
-      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
-    </Filter>
-  </ItemGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC12/src/.gitignore b/third-party/curl/projects/Windows/VC12/src/.gitignore
deleted file mode 100644
index 853b57dbc6..0000000000
--- a/third-party/curl/projects/Windows/VC12/src/.gitignore
+++ /dev/null
@@ -1,10 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-/*.ncb
-/*.opensdf
-/*.sdf
-/*.suo
-/*.user
-/*.vcxproj
diff --git a/third-party/curl/projects/Windows/VC12/src/curl.sln b/third-party/curl/projects/Windows/VC12/src/curl.sln
deleted file mode 100644
index 7b5244c1fb..0000000000
--- a/third-party/curl/projects/Windows/VC12/src/curl.sln
+++ /dev/null
@@ -1,181 +0,0 @@
-Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 2013
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "curl", "curl.vcxproj", "{5228E9CE-A216-422F-A5E6-58E95E2DD71D}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|x64 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
-		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
-		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
-		DLL Debug - DLL wolfSSL|Win32 = DLL Debug - DLL wolfSSL|Win32
-		DLL Debug - DLL wolfSSL|x64 = DLL Debug - DLL wolfSSL|x64
-		DLL Debug|Win32 = DLL Debug|Win32
-		DLL Debug|x64 = DLL Debug|x64
-		DLL Release - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Release - DLL OpenSSL - DLL LibSSH2|x64 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
-		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
-		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
-		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
-		DLL Release - DLL wolfSSL|Win32 = DLL Release - DLL wolfSSL|Win32
-		DLL Release - DLL wolfSSL|x64 = DLL Release - DLL wolfSSL|x64
-		DLL Release|Win32 = DLL Release|Win32
-		DLL Release|x64 = DLL Release|x64
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|x64 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
-		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
-		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|x64 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
-		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
-		LIB Debug - LIB wolfSSL|Win32 = LIB Debug - LIB wolfSSL|Win32
-		LIB Debug - LIB wolfSSL|x64 = LIB Debug - LIB wolfSSL|x64
-		LIB Debug|Win32 = LIB Debug|Win32
-		LIB Debug|x64 = LIB Debug|x64
-		LIB Release - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Release - DLL OpenSSL - DLL LibSSH2|x64 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
-		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
-		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
-		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
-		LIB Release - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Release - LIB OpenSSL - LIB LibSSH2|x64 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
-		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
-		LIB Release - LIB wolfSSL|Win32 = LIB Release - LIB wolfSSL|Win32
-		LIB Release - LIB wolfSSL|x64 = LIB Release - LIB wolfSSL|x64
-		LIB Release|Win32 = LIB Release|Win32
-		LIB Release|x64 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.Build.0 = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.Build.0 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
diff --git a/third-party/curl/projects/Windows/VC12/src/curl.tmpl b/third-party/curl/projects/Windows/VC12/src/curl.tmpl
deleted file mode 100644
index 77c244e40c..0000000000
--- a/third-party/curl/projects/Windows/VC12/src/curl.tmpl
+++ /dev/null
@@ -1,2699 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup Label="ProjectConfigurations">
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|Win32">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|x64">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|x64">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|Win32">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|x64">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|Win32">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|x64">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|Win32">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|x64">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|x64">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|Win32">
-      <Configuration>DLL Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|x64">
-      <Configuration>DLL Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|x64">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|Win32">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|x64">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|x64">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|Win32">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|x64">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|Win32">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|x64">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|x64">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|Win32">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|x64">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|Win32">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|x64">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|Win32">
-      <Configuration>LIB Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|x64">
-      <Configuration>LIB Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-  </ItemGroup>
-  <PropertyGroup Label="Globals">
-    <ProjectGuid>{5228E9CE-A216-422F-A5E6-58E95E2DD71D}</ProjectGuid>
-    <RootNamespace>curl</RootNamespace>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v120</PlatformToolset>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
-  <ImportGroup Label="ExtensionSettings">
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <PropertyGroup Label="UserMacros" />
-  <PropertyGroup>
-    <_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC12\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">$(ProjectName)</TargetName>
-  </PropertyGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);..\..\..\..\..\wolfssl\build\Win32\VC12\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);..\..\..\..\..\wolfssl\build\Win64\VC12\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);..\..\..\..\..\wolfssl\build\Win32\VC12\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);..\..\..\..\..\wolfssl\build\Win64\VC12\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC12\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC12\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC12\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC12\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC12\LIB Debug;..\..\..\..\..\libssh2\build\Win32\VC12\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC12\LIB Debug;..\..\..\..\..\libssh2\build\Win64\VC12\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC12\LIB Release;..\..\..\..\..\libssh2\build\Win32\VC12\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC12\LIB Release;..\..\..\..\..\libssh2\build\Win64\VC12\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC12\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC12\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC12\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC12\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC12\DLL Debug;..\..\..\..\..\libssh2\build\Win32\VC12\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC12\DLL Debug;..\..\..\..\..\libssh2\build\Win64\VC12\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC12\DLL Release;..\..\..\..\..\libssh2\build\Win32\VC12\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libssh2.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC12\DLL Release;..\..\..\..\..\libssh2\build\Win64\VC12\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC12\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemGroup>
-CURL_SRC_X_C_FILES
-CURL_SRC_C_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_SRC_X_H_FILES
-CURL_SRC_H_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_SRC_RC_FILES
-  </ItemGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
-  <ImportGroup Label="ExtensionTargets">
-  </ImportGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC12/src/curl.vcxproj.filters b/third-party/curl/projects/Windows/VC12/src/curl.vcxproj.filters
deleted file mode 100644
index 4d6341d749..0000000000
--- a/third-party/curl/projects/Windows/VC12/src/curl.vcxproj.filters
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup>
-    <Filter Include="Source Files">
-      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
-      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
-    </Filter>
-    <Filter Include="Header Files">
-      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
-      <Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
-    </Filter>
-    <Filter Include="Resource Files">
-      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
-      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
-    </Filter>
-  </ItemGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC14.10/.gitignore b/third-party/curl/projects/Windows/VC14.10/.gitignore
deleted file mode 100644
index 11504d2c11..0000000000
--- a/third-party/curl/projects/Windows/VC14.10/.gitignore
+++ /dev/null
@@ -1,9 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-/*.opendb
-/*.opensdf
-/*.sdf
-/*.vc.db
-/.vs
diff --git a/third-party/curl/projects/Windows/VC14.10/curl-all.sln b/third-party/curl/projects/Windows/VC14.10/curl-all.sln
deleted file mode 100644
index e563caeea7..0000000000
--- a/third-party/curl/projects/Windows/VC14.10/curl-all.sln
+++ /dev/null
@@ -1,298 +0,0 @@
-Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 15
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "curl", "src\curl.vcxproj", "{5228E9CE-A216-422F-A5E6-58E95E2DD71D}"
-	ProjectSection(ProjectDependencies) = postProject
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB} = {DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}
-	EndProjectSection
-EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libcurl", "lib\libcurl.vcxproj", "{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|x64 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
-		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
-		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
-		DLL Debug - DLL wolfSSL|Win32 = DLL Debug - DLL wolfSSL|Win32
-		DLL Debug - DLL wolfSSL|x64 = DLL Debug - DLL wolfSSL|x64
-		DLL Debug|Win32 = DLL Debug|Win32
-		DLL Debug|x64 = DLL Debug|x64
-		DLL Release - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Release - DLL OpenSSL - DLL LibSSH2|x64 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
-		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
-		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
-		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
-		DLL Release - DLL wolfSSL|Win32 = DLL Release - DLL wolfSSL|Win32
-		DLL Release - DLL wolfSSL|x64 = DLL Release - DLL wolfSSL|x64
-		DLL Release|Win32 = DLL Release|Win32
-		DLL Release|x64 = DLL Release|x64
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|x64 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
-		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
-		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|x64 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
-		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
-		LIB Debug - LIB wolfSSL|Win32 = LIB Debug - LIB wolfSSL|Win32
-		LIB Debug - LIB wolfSSL|x64 = LIB Debug - LIB wolfSSL|x64
-		LIB Debug|Win32 = LIB Debug|Win32
-		LIB Debug|x64 = LIB Debug|x64
-		LIB Release - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Release - DLL OpenSSL - DLL LibSSH2|x64 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
-		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
-		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
-		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
-		LIB Release - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Release - LIB OpenSSL - LIB LibSSH2|x64 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
-		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
-		LIB Release - LIB wolfSSL|Win32 = LIB Release - LIB wolfSSL|Win32
-		LIB Release - LIB wolfSSL|x64 = LIB Release - LIB wolfSSL|x64
-		LIB Release|Win32 = LIB Release|Win32
-		LIB Release|x64 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.Build.0 = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.Build.0 = LIB Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.Build.0 = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.Build.0 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
diff --git a/third-party/curl/projects/Windows/VC14.10/lib/.gitignore b/third-party/curl/projects/Windows/VC14.10/lib/.gitignore
deleted file mode 100644
index 5baee83423..0000000000
--- a/third-party/curl/projects/Windows/VC14.10/lib/.gitignore
+++ /dev/null
@@ -1,10 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-/*.opensdf
-/*.sdf
-/*.user
-/*.vc.db
-/*.vcxproj
-/.vs
diff --git a/third-party/curl/projects/Windows/VC14.10/lib/libcurl.sln b/third-party/curl/projects/Windows/VC14.10/lib/libcurl.sln
deleted file mode 100644
index 595bdb209a..0000000000
--- a/third-party/curl/projects/Windows/VC14.10/lib/libcurl.sln
+++ /dev/null
@@ -1,181 +0,0 @@
-Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 15
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libcurl", "libcurl.vcxproj", "{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|x64 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
-		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
-		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
-		DLL Debug - DLL wolfSSL|Win32 = DLL Debug - DLL wolfSSL|Win32
-		DLL Debug - DLL wolfSSL|x64 = DLL Debug - DLL wolfSSL|x64
-		DLL Debug|Win32 = DLL Debug|Win32
-		DLL Debug|x64 = DLL Debug|x64
-		DLL Release - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Release - DLL OpenSSL - DLL LibSSH2|x64 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
-		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
-		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
-		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
-		DLL Release - DLL wolfSSL|Win32 = DLL Release - DLL wolfSSL|Win32
-		DLL Release - DLL wolfSSL|x64 = DLL Release - DLL wolfSSL|x64
-		DLL Release|Win32 = DLL Release|Win32
-		DLL Release|x64 = DLL Release|x64
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|x64 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
-		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
-		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|x64 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
-		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
-		LIB Debug - LIB wolfSSL|Win32 = LIB Debug - LIB wolfSSL|Win32
-		LIB Debug - LIB wolfSSL|x64 = LIB Debug - LIB wolfSSL|x64
-		LIB Debug|Win32 = LIB Debug|Win32
-		LIB Debug|x64 = LIB Debug|x64
-		LIB Release - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Release - DLL OpenSSL - DLL LibSSH2|x64 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
-		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
-		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
-		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
-		LIB Release - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Release - LIB OpenSSL - LIB LibSSH2|x64 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
-		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
-		LIB Release - LIB wolfSSL|Win32 = LIB Release - LIB wolfSSL|Win32
-		LIB Release - LIB wolfSSL|x64 = LIB Release - LIB wolfSSL|x64
-		LIB Release|Win32 = LIB Release|Win32
-		LIB Release|x64 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.Build.0 = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.Build.0 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
diff --git a/third-party/curl/projects/Windows/VC14.10/lib/libcurl.tmpl b/third-party/curl/projects/Windows/VC14.10/lib/libcurl.tmpl
deleted file mode 100644
index 5560ad6a2c..0000000000
--- a/third-party/curl/projects/Windows/VC14.10/lib/libcurl.tmpl
+++ /dev/null
@@ -1,2381 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup Label="ProjectConfigurations">
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|Win32">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|x64">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|x64">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|Win32">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|x64">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|Win32">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|x64">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|Win32">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|x64">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|x64">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|Win32">
-      <Configuration>DLL Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|x64">
-      <Configuration>DLL Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|x64">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|Win32">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|x64">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|x64">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|Win32">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|x64">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|Win32">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|x64">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|x64">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|Win32">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|x64">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|Win32">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|x64">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|Win32">
-      <Configuration>LIB Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|x64">
-      <Configuration>LIB Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-  </ItemGroup>
-  <PropertyGroup Label="Globals">
-    <ProjectGuid>{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}</ProjectGuid>
-    <RootNamespace>libcurl</RootNamespace>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
-  <ImportGroup Label="ExtensionSettings">
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <PropertyGroup Label="UserMacros" />
-  <PropertyGroup>
-    <_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(ProjectName)d</TargetName>
-  </PropertyGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win32\VC14.10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win64\VC14.10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win32\VC14.10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win64\VC14.10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.10\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC14.10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.10\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC14.10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.10\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC14.10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.10\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC14.10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.10\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC14.10\DLL Debug;..\..\..\..\..\libssh2\build\Win32\VC14.10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.10\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC14.10\DLL Debug;..\..\..\..\..\libssh2\build\Win64\VC14.10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.10\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC14.10\DLL Release;..\..\..\..\..\libssh2\build\Win32\VC14.10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.10\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC14.10\DLL Release;..\..\..\..\..\libssh2\build\Win64\VC14.10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.10\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.10\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.10\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.10\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.10\LIB Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.10\LIB Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.10\LIB Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.10\LIB Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.10\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.10\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.10\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.10\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.10\LIB Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.10\LIB Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.10\LIB Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.10\LIB Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemGroup>
-CURL_LIB_C_FILES
-CURL_LIB_VAUTH_C_FILES
-CURL_LIB_VQUIC_C_FILES
-CURL_LIB_VSSH_C_FILES
-CURL_LIB_VTLS_C_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_LIB_H_FILES
-CURL_LIB_VAUTH_H_FILES
-CURL_LIB_VQUIC_H_FILES
-CURL_LIB_VSSH_H_FILES
-CURL_LIB_VTLS_H_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_LIB_RC_FILES
-  </ItemGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
-  <ImportGroup Label="ExtensionTargets">
-  </ImportGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC14.10/lib/libcurl.vcxproj.filters b/third-party/curl/projects/Windows/VC14.10/lib/libcurl.vcxproj.filters
deleted file mode 100644
index 4d6341d749..0000000000
--- a/third-party/curl/projects/Windows/VC14.10/lib/libcurl.vcxproj.filters
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup>
-    <Filter Include="Source Files">
-      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
-      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
-    </Filter>
-    <Filter Include="Header Files">
-      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
-      <Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
-    </Filter>
-    <Filter Include="Resource Files">
-      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
-      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
-    </Filter>
-  </ItemGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC14.10/src/.gitignore b/third-party/curl/projects/Windows/VC14.10/src/.gitignore
deleted file mode 100644
index 5baee83423..0000000000
--- a/third-party/curl/projects/Windows/VC14.10/src/.gitignore
+++ /dev/null
@@ -1,10 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-/*.opensdf
-/*.sdf
-/*.user
-/*.vc.db
-/*.vcxproj
-/.vs
diff --git a/third-party/curl/projects/Windows/VC14.10/src/curl.sln b/third-party/curl/projects/Windows/VC14.10/src/curl.sln
deleted file mode 100644
index 2af0959165..0000000000
--- a/third-party/curl/projects/Windows/VC14.10/src/curl.sln
+++ /dev/null
@@ -1,181 +0,0 @@
-Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 15
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "curl", "curl.vcxproj", "{5228E9CE-A216-422F-A5E6-58E95E2DD71D}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|x64 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
-		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
-		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
-		DLL Debug - DLL wolfSSL|Win32 = DLL Debug - DLL wolfSSL|Win32
-		DLL Debug - DLL wolfSSL|x64 = DLL Debug - DLL wolfSSL|x64
-		DLL Debug|Win32 = DLL Debug|Win32
-		DLL Debug|x64 = DLL Debug|x64
-		DLL Release - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Release - DLL OpenSSL - DLL LibSSH2|x64 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
-		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
-		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
-		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
-		DLL Release - DLL wolfSSL|Win32 = DLL Release - DLL wolfSSL|Win32
-		DLL Release - DLL wolfSSL|x64 = DLL Release - DLL wolfSSL|x64
-		DLL Release|Win32 = DLL Release|Win32
-		DLL Release|x64 = DLL Release|x64
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|x64 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
-		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
-		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|x64 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
-		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
-		LIB Debug - LIB wolfSSL|Win32 = LIB Debug - LIB wolfSSL|Win32
-		LIB Debug - LIB wolfSSL|x64 = LIB Debug - LIB wolfSSL|x64
-		LIB Debug|Win32 = LIB Debug|Win32
-		LIB Debug|x64 = LIB Debug|x64
-		LIB Release - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Release - DLL OpenSSL - DLL LibSSH2|x64 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
-		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
-		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
-		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
-		LIB Release - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Release - LIB OpenSSL - LIB LibSSH2|x64 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
-		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
-		LIB Release - LIB wolfSSL|Win32 = LIB Release - LIB wolfSSL|Win32
-		LIB Release - LIB wolfSSL|x64 = LIB Release - LIB wolfSSL|x64
-		LIB Release|Win32 = LIB Release|Win32
-		LIB Release|x64 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.Build.0 = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.Build.0 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
diff --git a/third-party/curl/projects/Windows/VC14.10/src/curl.tmpl b/third-party/curl/projects/Windows/VC14.10/src/curl.tmpl
deleted file mode 100644
index 307b4b167e..0000000000
--- a/third-party/curl/projects/Windows/VC14.10/src/curl.tmpl
+++ /dev/null
@@ -1,2671 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup Label="ProjectConfigurations">
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|Win32">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|x64">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|x64">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|Win32">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|x64">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|Win32">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|x64">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|Win32">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|x64">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|x64">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|Win32">
-      <Configuration>DLL Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|x64">
-      <Configuration>DLL Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|x64">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|Win32">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|x64">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|x64">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|Win32">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|x64">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|Win32">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|x64">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|x64">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|Win32">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|x64">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|Win32">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|x64">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|Win32">
-      <Configuration>LIB Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|x64">
-      <Configuration>LIB Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-  </ItemGroup>
-  <PropertyGroup Label="Globals">
-    <ProjectGuid>{5228E9CE-A216-422F-A5E6-58E95E2DD71D}</ProjectGuid>
-    <RootNamespace>curl</RootNamespace>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v141</PlatformToolset>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
-  <ImportGroup Label="ExtensionSettings">
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <PropertyGroup Label="UserMacros" />
-  <PropertyGroup>
-    <_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14.10\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">$(ProjectName)</TargetName>
-  </PropertyGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);..\..\..\..\..\wolfssl\build\Win32\VC14.10\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);..\..\..\..\..\wolfssl\build\Win64\VC14.10\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);..\..\..\..\..\wolfssl\build\Win32\VC14.10\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);..\..\..\..\..\wolfssl\build\Win64\VC14.10\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14.10\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14.10\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14.10\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14.10\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14.10\LIB Debug;..\..\..\..\..\libssh2\build\Win32\VC14.10\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14.10\LIB Debug;..\..\..\..\..\libssh2\build\Win64\VC14.10\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14.10\LIB Release;..\..\..\..\..\libssh2\build\Win32\VC14.10\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14.10\LIB Release;..\..\..\..\..\libssh2\build\Win64\VC14.10\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14.10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14.10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14.10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14.10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14.10\DLL Debug;..\..\..\..\..\libssh2\build\Win32\VC14.10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14.10\DLL Debug;..\..\..\..\..\libssh2\build\Win64\VC14.10\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14.10\DLL Release;..\..\..\..\..\libssh2\build\Win32\VC14.10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libssh2.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14.10\DLL Release;..\..\..\..\..\libssh2\build\Win64\VC14.10\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.10\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemGroup>
-CURL_SRC_X_C_FILES
-CURL_SRC_C_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_SRC_X_H_FILES
-CURL_SRC_H_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_SRC_RC_FILES
-  </ItemGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
-  <ImportGroup Label="ExtensionTargets">
-  </ImportGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC14.10/src/curl.vcxproj.filters b/third-party/curl/projects/Windows/VC14.10/src/curl.vcxproj.filters
deleted file mode 100644
index 4d6341d749..0000000000
--- a/third-party/curl/projects/Windows/VC14.10/src/curl.vcxproj.filters
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup>
-    <Filter Include="Source Files">
-      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
-      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
-    </Filter>
-    <Filter Include="Header Files">
-      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
-      <Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
-    </Filter>
-    <Filter Include="Resource Files">
-      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
-      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
-    </Filter>
-  </ItemGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC14.30/.gitignore b/third-party/curl/projects/Windows/VC14.30/.gitignore
deleted file mode 100644
index 11504d2c11..0000000000
--- a/third-party/curl/projects/Windows/VC14.30/.gitignore
+++ /dev/null
@@ -1,9 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-/*.opendb
-/*.opensdf
-/*.sdf
-/*.vc.db
-/.vs
diff --git a/third-party/curl/projects/Windows/VC14.30/curl-all.sln b/third-party/curl/projects/Windows/VC14.30/curl-all.sln
deleted file mode 100644
index fc56613f9e..0000000000
--- a/third-party/curl/projects/Windows/VC14.30/curl-all.sln
+++ /dev/null
@@ -1,298 +0,0 @@
-Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 17
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "curl", "src\curl.vcxproj", "{5228E9CE-A216-422F-A5E6-58E95E2DD71D}"
-	ProjectSection(ProjectDependencies) = postProject
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB} = {DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}
-	EndProjectSection
-EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libcurl", "lib\libcurl.vcxproj", "{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|x64 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
-		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
-		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
-		DLL Debug - DLL wolfSSL|Win32 = DLL Debug - DLL wolfSSL|Win32
-		DLL Debug - DLL wolfSSL|x64 = DLL Debug - DLL wolfSSL|x64
-		DLL Debug|Win32 = DLL Debug|Win32
-		DLL Debug|x64 = DLL Debug|x64
-		DLL Release - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Release - DLL OpenSSL - DLL LibSSH2|x64 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
-		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
-		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
-		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
-		DLL Release - DLL wolfSSL|Win32 = DLL Release - DLL wolfSSL|Win32
-		DLL Release - DLL wolfSSL|x64 = DLL Release - DLL wolfSSL|x64
-		DLL Release|Win32 = DLL Release|Win32
-		DLL Release|x64 = DLL Release|x64
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|x64 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
-		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
-		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|x64 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
-		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
-		LIB Debug - LIB wolfSSL|Win32 = LIB Debug - LIB wolfSSL|Win32
-		LIB Debug - LIB wolfSSL|x64 = LIB Debug - LIB wolfSSL|x64
-		LIB Debug|Win32 = LIB Debug|Win32
-		LIB Debug|x64 = LIB Debug|x64
-		LIB Release - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Release - DLL OpenSSL - DLL LibSSH2|x64 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
-		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
-		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
-		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
-		LIB Release - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Release - LIB OpenSSL - LIB LibSSH2|x64 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
-		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
-		LIB Release - LIB wolfSSL|Win32 = LIB Release - LIB wolfSSL|Win32
-		LIB Release - LIB wolfSSL|x64 = LIB Release - LIB wolfSSL|x64
-		LIB Release|Win32 = LIB Release|Win32
-		LIB Release|x64 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.Build.0 = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.Build.0 = LIB Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.Build.0 = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.Build.0 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
diff --git a/third-party/curl/projects/Windows/VC14.30/lib/.gitignore b/third-party/curl/projects/Windows/VC14.30/lib/.gitignore
deleted file mode 100644
index 5baee83423..0000000000
--- a/third-party/curl/projects/Windows/VC14.30/lib/.gitignore
+++ /dev/null
@@ -1,10 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-/*.opensdf
-/*.sdf
-/*.user
-/*.vc.db
-/*.vcxproj
-/.vs
diff --git a/third-party/curl/projects/Windows/VC14.30/lib/libcurl.sln b/third-party/curl/projects/Windows/VC14.30/lib/libcurl.sln
deleted file mode 100644
index e34b5eb5d5..0000000000
--- a/third-party/curl/projects/Windows/VC14.30/lib/libcurl.sln
+++ /dev/null
@@ -1,181 +0,0 @@
-Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 17
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libcurl", "libcurl.vcxproj", "{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|x64 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
-		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
-		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
-		DLL Debug - DLL wolfSSL|Win32 = DLL Debug - DLL wolfSSL|Win32
-		DLL Debug - DLL wolfSSL|x64 = DLL Debug - DLL wolfSSL|x64
-		DLL Debug|Win32 = DLL Debug|Win32
-		DLL Debug|x64 = DLL Debug|x64
-		DLL Release - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Release - DLL OpenSSL - DLL LibSSH2|x64 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
-		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
-		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
-		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
-		DLL Release - DLL wolfSSL|Win32 = DLL Release - DLL wolfSSL|Win32
-		DLL Release - DLL wolfSSL|x64 = DLL Release - DLL wolfSSL|x64
-		DLL Release|Win32 = DLL Release|Win32
-		DLL Release|x64 = DLL Release|x64
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|x64 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
-		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
-		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|x64 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
-		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
-		LIB Debug - LIB wolfSSL|Win32 = LIB Debug - LIB wolfSSL|Win32
-		LIB Debug - LIB wolfSSL|x64 = LIB Debug - LIB wolfSSL|x64
-		LIB Debug|Win32 = LIB Debug|Win32
-		LIB Debug|x64 = LIB Debug|x64
-		LIB Release - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Release - DLL OpenSSL - DLL LibSSH2|x64 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
-		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
-		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
-		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
-		LIB Release - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Release - LIB OpenSSL - LIB LibSSH2|x64 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
-		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
-		LIB Release - LIB wolfSSL|Win32 = LIB Release - LIB wolfSSL|Win32
-		LIB Release - LIB wolfSSL|x64 = LIB Release - LIB wolfSSL|x64
-		LIB Release|Win32 = LIB Release|Win32
-		LIB Release|x64 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.Build.0 = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.Build.0 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
diff --git a/third-party/curl/projects/Windows/VC14.30/lib/libcurl.tmpl b/third-party/curl/projects/Windows/VC14.30/lib/libcurl.tmpl
deleted file mode 100644
index a7afb4f23f..0000000000
--- a/third-party/curl/projects/Windows/VC14.30/lib/libcurl.tmpl
+++ /dev/null
@@ -1,2381 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="17.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup Label="ProjectConfigurations">
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|Win32">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|x64">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|x64">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|Win32">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|x64">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|Win32">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|x64">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|Win32">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|x64">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|x64">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|Win32">
-      <Configuration>DLL Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|x64">
-      <Configuration>DLL Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|x64">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|Win32">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|x64">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|x64">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|Win32">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|x64">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|Win32">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|x64">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|x64">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|Win32">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|x64">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|Win32">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|x64">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|Win32">
-      <Configuration>LIB Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|x64">
-      <Configuration>LIB Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-  </ItemGroup>
-  <PropertyGroup Label="Globals">
-    <ProjectGuid>{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}</ProjectGuid>
-    <RootNamespace>libcurl</RootNamespace>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
-  <ImportGroup Label="ExtensionSettings">
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <PropertyGroup Label="UserMacros" />
-  <PropertyGroup>
-    <_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(ProjectName)d</TargetName>
-  </PropertyGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win32\VC14.30\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win64\VC14.30\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win32\VC14.30\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win64\VC14.30\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.30\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC14.30\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.30\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC14.30\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.30\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC14.30\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.30\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC14.30\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.30\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC14.30\DLL Debug;..\..\..\..\..\libssh2\build\Win32\VC14.30\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.30\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC14.30\DLL Debug;..\..\..\..\..\libssh2\build\Win64\VC14.30\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.30\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC14.30\DLL Release;..\..\..\..\..\libssh2\build\Win32\VC14.30\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.30\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC14.30\DLL Release;..\..\..\..\..\libssh2\build\Win64\VC14.30\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.30\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.30\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.30\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.30\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.30\LIB Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.30\LIB Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.30\LIB Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.30\LIB Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.30\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.30\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.30\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.30\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.30\LIB Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.30\LIB Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14.30\LIB Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14.30\LIB Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemGroup>
-CURL_LIB_C_FILES
-CURL_LIB_VAUTH_C_FILES
-CURL_LIB_VQUIC_C_FILES
-CURL_LIB_VSSH_C_FILES
-CURL_LIB_VTLS_C_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_LIB_H_FILES
-CURL_LIB_VAUTH_H_FILES
-CURL_LIB_VQUIC_H_FILES
-CURL_LIB_VSSH_H_FILES
-CURL_LIB_VTLS_H_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_LIB_RC_FILES
-  </ItemGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
-  <ImportGroup Label="ExtensionTargets">
-  </ImportGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC14.30/lib/libcurl.vcxproj.filters b/third-party/curl/projects/Windows/VC14.30/lib/libcurl.vcxproj.filters
deleted file mode 100644
index 4d6341d749..0000000000
--- a/third-party/curl/projects/Windows/VC14.30/lib/libcurl.vcxproj.filters
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup>
-    <Filter Include="Source Files">
-      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
-      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
-    </Filter>
-    <Filter Include="Header Files">
-      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
-      <Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
-    </Filter>
-    <Filter Include="Resource Files">
-      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
-      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
-    </Filter>
-  </ItemGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC14.30/src/.gitignore b/third-party/curl/projects/Windows/VC14.30/src/.gitignore
deleted file mode 100644
index 5baee83423..0000000000
--- a/third-party/curl/projects/Windows/VC14.30/src/.gitignore
+++ /dev/null
@@ -1,10 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-/*.opensdf
-/*.sdf
-/*.user
-/*.vc.db
-/*.vcxproj
-/.vs
diff --git a/third-party/curl/projects/Windows/VC14.30/src/curl.sln b/third-party/curl/projects/Windows/VC14.30/src/curl.sln
deleted file mode 100644
index 2af0959165..0000000000
--- a/third-party/curl/projects/Windows/VC14.30/src/curl.sln
+++ /dev/null
@@ -1,181 +0,0 @@
-Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 15
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "curl", "curl.vcxproj", "{5228E9CE-A216-422F-A5E6-58E95E2DD71D}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|x64 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
-		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
-		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
-		DLL Debug - DLL wolfSSL|Win32 = DLL Debug - DLL wolfSSL|Win32
-		DLL Debug - DLL wolfSSL|x64 = DLL Debug - DLL wolfSSL|x64
-		DLL Debug|Win32 = DLL Debug|Win32
-		DLL Debug|x64 = DLL Debug|x64
-		DLL Release - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Release - DLL OpenSSL - DLL LibSSH2|x64 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
-		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
-		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
-		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
-		DLL Release - DLL wolfSSL|Win32 = DLL Release - DLL wolfSSL|Win32
-		DLL Release - DLL wolfSSL|x64 = DLL Release - DLL wolfSSL|x64
-		DLL Release|Win32 = DLL Release|Win32
-		DLL Release|x64 = DLL Release|x64
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|x64 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
-		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
-		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|x64 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
-		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
-		LIB Debug - LIB wolfSSL|Win32 = LIB Debug - LIB wolfSSL|Win32
-		LIB Debug - LIB wolfSSL|x64 = LIB Debug - LIB wolfSSL|x64
-		LIB Debug|Win32 = LIB Debug|Win32
-		LIB Debug|x64 = LIB Debug|x64
-		LIB Release - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Release - DLL OpenSSL - DLL LibSSH2|x64 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
-		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
-		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
-		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
-		LIB Release - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Release - LIB OpenSSL - LIB LibSSH2|x64 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
-		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
-		LIB Release - LIB wolfSSL|Win32 = LIB Release - LIB wolfSSL|Win32
-		LIB Release - LIB wolfSSL|x64 = LIB Release - LIB wolfSSL|x64
-		LIB Release|Win32 = LIB Release|Win32
-		LIB Release|x64 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.Build.0 = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.Build.0 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
diff --git a/third-party/curl/projects/Windows/VC14.30/src/curl.tmpl b/third-party/curl/projects/Windows/VC14.30/src/curl.tmpl
deleted file mode 100644
index 2d8772ef7c..0000000000
--- a/third-party/curl/projects/Windows/VC14.30/src/curl.tmpl
+++ /dev/null
@@ -1,2671 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="17.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup Label="ProjectConfigurations">
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|Win32">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|x64">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|x64">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|Win32">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|x64">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|Win32">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|x64">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|Win32">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|x64">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|x64">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|Win32">
-      <Configuration>DLL Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|x64">
-      <Configuration>DLL Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|x64">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|Win32">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|x64">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|x64">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|Win32">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|x64">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|Win32">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|x64">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|x64">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|Win32">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|x64">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|Win32">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|x64">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|Win32">
-      <Configuration>LIB Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|x64">
-      <Configuration>LIB Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-  </ItemGroup>
-  <PropertyGroup Label="Globals">
-    <ProjectGuid>{5228E9CE-A216-422F-A5E6-58E95E2DD71D}</ProjectGuid>
-    <RootNamespace>curl</RootNamespace>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v143</PlatformToolset>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
-  <ImportGroup Label="ExtensionSettings">
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <PropertyGroup Label="UserMacros" />
-  <PropertyGroup>
-    <_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14.30\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">$(ProjectName)</TargetName>
-  </PropertyGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);..\..\..\..\..\wolfssl\build\Win32\VC14.30\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);..\..\..\..\..\wolfssl\build\Win64\VC14.30\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);..\..\..\..\..\wolfssl\build\Win32\VC14.30\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);..\..\..\..\..\wolfssl\build\Win64\VC14.30\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14.30\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14.30\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14.30\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14.30\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14.30\LIB Debug;..\..\..\..\..\libssh2\build\Win32\VC14.30\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14.30\LIB Debug;..\..\..\..\..\libssh2\build\Win64\VC14.30\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14.30\LIB Release;..\..\..\..\..\libssh2\build\Win32\VC14.30\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14.30\LIB Release;..\..\..\..\..\libssh2\build\Win64\VC14.30\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14.30\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14.30\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14.30\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14.30\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14.30\DLL Debug;..\..\..\..\..\libssh2\build\Win32\VC14.30\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14.30\DLL Debug;..\..\..\..\..\libssh2\build\Win64\VC14.30\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14.30\DLL Release;..\..\..\..\..\libssh2\build\Win32\VC14.30\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libssh2.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14.30\DLL Release;..\..\..\..\..\libssh2\build\Win64\VC14.30\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14.30\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemGroup>
-CURL_SRC_X_C_FILES
-CURL_SRC_C_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_SRC_X_H_FILES
-CURL_SRC_H_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_SRC_RC_FILES
-  </ItemGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
-  <ImportGroup Label="ExtensionTargets">
-  </ImportGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC14.30/src/curl.vcxproj.filters b/third-party/curl/projects/Windows/VC14.30/src/curl.vcxproj.filters
deleted file mode 100644
index 4d6341d749..0000000000
--- a/third-party/curl/projects/Windows/VC14.30/src/curl.vcxproj.filters
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup>
-    <Filter Include="Source Files">
-      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
-      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
-    </Filter>
-    <Filter Include="Header Files">
-      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
-      <Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
-    </Filter>
-    <Filter Include="Resource Files">
-      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
-      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
-    </Filter>
-  </ItemGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC14/.gitignore b/third-party/curl/projects/Windows/VC14/.gitignore
deleted file mode 100644
index 11504d2c11..0000000000
--- a/third-party/curl/projects/Windows/VC14/.gitignore
+++ /dev/null
@@ -1,9 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-/*.opendb
-/*.opensdf
-/*.sdf
-/*.vc.db
-/.vs
diff --git a/third-party/curl/projects/Windows/VC14/curl-all.sln b/third-party/curl/projects/Windows/VC14/curl-all.sln
deleted file mode 100644
index 05820e1f44..0000000000
--- a/third-party/curl/projects/Windows/VC14/curl-all.sln
+++ /dev/null
@@ -1,298 +0,0 @@
-Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 2015
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "curl", "src\curl.vcxproj", "{5228E9CE-A216-422F-A5E6-58E95E2DD71D}"
-	ProjectSection(ProjectDependencies) = postProject
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB} = {DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}
-	EndProjectSection
-EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libcurl", "lib\libcurl.vcxproj", "{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|x64 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
-		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
-		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
-		DLL Debug - DLL wolfSSL|Win32 = DLL Debug - DLL wolfSSL|Win32
-		DLL Debug - DLL wolfSSL|x64 = DLL Debug - DLL wolfSSL|x64
-		DLL Debug|Win32 = DLL Debug|Win32
-		DLL Debug|x64 = DLL Debug|x64
-		DLL Release - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Release - DLL OpenSSL - DLL LibSSH2|x64 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
-		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
-		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
-		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
-		DLL Release - DLL wolfSSL|Win32 = DLL Release - DLL wolfSSL|Win32
-		DLL Release - DLL wolfSSL|x64 = DLL Release - DLL wolfSSL|x64
-		DLL Release|Win32 = DLL Release|Win32
-		DLL Release|x64 = DLL Release|x64
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|x64 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
-		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
-		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|x64 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
-		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
-		LIB Debug - LIB wolfSSL|Win32 = LIB Debug - LIB wolfSSL|Win32
-		LIB Debug - LIB wolfSSL|x64 = LIB Debug - LIB wolfSSL|x64
-		LIB Debug|Win32 = LIB Debug|Win32
-		LIB Debug|x64 = LIB Debug|x64
-		LIB Release - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Release - DLL OpenSSL - DLL LibSSH2|x64 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
-		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
-		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
-		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
-		LIB Release - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Release - LIB OpenSSL - LIB LibSSH2|x64 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
-		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
-		LIB Release - LIB wolfSSL|Win32 = LIB Release - LIB wolfSSL|Win32
-		LIB Release - LIB wolfSSL|x64 = LIB Release - LIB wolfSSL|x64
-		LIB Release|Win32 = LIB Release|Win32
-		LIB Release|x64 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.Build.0 = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.Build.0 = LIB Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.Build.0 = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.Build.0 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
diff --git a/third-party/curl/projects/Windows/VC14/lib/.gitignore b/third-party/curl/projects/Windows/VC14/lib/.gitignore
deleted file mode 100644
index 5baee83423..0000000000
--- a/third-party/curl/projects/Windows/VC14/lib/.gitignore
+++ /dev/null
@@ -1,10 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-/*.opensdf
-/*.sdf
-/*.user
-/*.vc.db
-/*.vcxproj
-/.vs
diff --git a/third-party/curl/projects/Windows/VC14/lib/libcurl.sln b/third-party/curl/projects/Windows/VC14/lib/libcurl.sln
deleted file mode 100644
index cd8afe2485..0000000000
--- a/third-party/curl/projects/Windows/VC14/lib/libcurl.sln
+++ /dev/null
@@ -1,181 +0,0 @@
-Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 2015
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libcurl", "libcurl.vcxproj", "{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|x64 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
-		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
-		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
-		DLL Debug - DLL wolfSSL|Win32 = DLL Debug - DLL wolfSSL|Win32
-		DLL Debug - DLL wolfSSL|x64 = DLL Debug - DLL wolfSSL|x64
-		DLL Debug|Win32 = DLL Debug|Win32
-		DLL Debug|x64 = DLL Debug|x64
-		DLL Release - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Release - DLL OpenSSL - DLL LibSSH2|x64 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
-		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
-		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
-		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
-		DLL Release - DLL wolfSSL|Win32 = DLL Release - DLL wolfSSL|Win32
-		DLL Release - DLL wolfSSL|x64 = DLL Release - DLL wolfSSL|x64
-		DLL Release|Win32 = DLL Release|Win32
-		DLL Release|x64 = DLL Release|x64
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|x64 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
-		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
-		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|x64 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
-		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
-		LIB Debug - LIB wolfSSL|Win32 = LIB Debug - LIB wolfSSL|Win32
-		LIB Debug - LIB wolfSSL|x64 = LIB Debug - LIB wolfSSL|x64
-		LIB Debug|Win32 = LIB Debug|Win32
-		LIB Debug|x64 = LIB Debug|x64
-		LIB Release - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Release - DLL OpenSSL - DLL LibSSH2|x64 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
-		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
-		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
-		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
-		LIB Release - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Release - LIB OpenSSL - LIB LibSSH2|x64 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
-		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
-		LIB Release - LIB wolfSSL|Win32 = LIB Release - LIB wolfSSL|Win32
-		LIB Release - LIB wolfSSL|x64 = LIB Release - LIB wolfSSL|x64
-		LIB Release|Win32 = LIB Release|Win32
-		LIB Release|x64 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.Build.0 = DLL Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.Build.0 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
diff --git a/third-party/curl/projects/Windows/VC14/lib/libcurl.tmpl b/third-party/curl/projects/Windows/VC14/lib/libcurl.tmpl
deleted file mode 100644
index 07823b2934..0000000000
--- a/third-party/curl/projects/Windows/VC14/lib/libcurl.tmpl
+++ /dev/null
@@ -1,2409 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="14.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup Label="ProjectConfigurations">
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|Win32">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|x64">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|x64">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|Win32">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|x64">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|Win32">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|x64">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|Win32">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|x64">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|x64">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|Win32">
-      <Configuration>DLL Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|x64">
-      <Configuration>DLL Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|x64">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|Win32">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|x64">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|x64">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|Win32">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|x64">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|Win32">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|x64">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|x64">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|Win32">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|x64">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|Win32">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|x64">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|Win32">
-      <Configuration>LIB Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|x64">
-      <Configuration>LIB Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-  </ItemGroup>
-  <PropertyGroup Label="Globals">
-    <ProjectGuid>{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}</ProjectGuid>
-    <RootNamespace>libcurl</RootNamespace>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>StaticLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>DynamicLibrary</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
-  <ImportGroup Label="ExtensionSettings">
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <PropertyGroup Label="UserMacros" />
-  <PropertyGroup>
-    <_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)lib\</IntDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)lib\</IntDir>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(ProjectName)d</TargetName>
-  </PropertyGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win32\VC14\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win64\VC14\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win32\VC14\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WOLFSSL;USE_IPV6;WOLFSSL_DLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\wolfssl\build\Win64\VC14\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\wolfssl;..\..\..\..\..\wolfssl\wolfssl;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WOLFSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-      <DisableSpecificWarnings>4214</DisableSpecificWarnings>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC14\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC14\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC14\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC14\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC14\DLL Debug;..\..\..\..\..\libssh2\build\Win32\VC14\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC14\DLL Debug;..\..\..\..\..\libssh2\build\Win64\VC14\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>Win32</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\VC14\DLL Release;..\..\..\..\..\libssh2\build\Win32\VC14\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MkTypLibCompatible>true</MkTypLibCompatible>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\VC14\DLL Release;..\..\..\..\..\libssh2\build\Win64\VC14\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14\LIB Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14\LIB Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14\LIB Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14\LIB Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14\LIB Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14\LIB Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\VC14\LIB Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\VC14\LIB Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-    </ResourceCompile>
-    <Lib>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Lib>
-  </ItemDefinitionGroup>
-  <ItemGroup>
-CURL_LIB_C_FILES
-CURL_LIB_VAUTH_C_FILES
-CURL_LIB_VQUIC_C_FILES
-CURL_LIB_VSSH_C_FILES
-CURL_LIB_VTLS_C_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_LIB_H_FILES
-CURL_LIB_VAUTH_H_FILES
-CURL_LIB_VQUIC_H_FILES
-CURL_LIB_VSSH_H_FILES
-CURL_LIB_VTLS_H_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_LIB_RC_FILES
-  </ItemGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
-  <ImportGroup Label="ExtensionTargets">
-  </ImportGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC14/lib/libcurl.vcxproj.filters b/third-party/curl/projects/Windows/VC14/lib/libcurl.vcxproj.filters
deleted file mode 100644
index 4d6341d749..0000000000
--- a/third-party/curl/projects/Windows/VC14/lib/libcurl.vcxproj.filters
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup>
-    <Filter Include="Source Files">
-      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
-      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
-    </Filter>
-    <Filter Include="Header Files">
-      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
-      <Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
-    </Filter>
-    <Filter Include="Resource Files">
-      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
-      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
-    </Filter>
-  </ItemGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC14/src/.gitignore b/third-party/curl/projects/Windows/VC14/src/.gitignore
deleted file mode 100644
index 5baee83423..0000000000
--- a/third-party/curl/projects/Windows/VC14/src/.gitignore
+++ /dev/null
@@ -1,10 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-/*.opensdf
-/*.sdf
-/*.user
-/*.vc.db
-/*.vcxproj
-/.vs
diff --git a/third-party/curl/projects/Windows/VC14/src/curl.sln b/third-party/curl/projects/Windows/VC14/src/curl.sln
deleted file mode 100644
index b40c18bede..0000000000
--- a/third-party/curl/projects/Windows/VC14/src/curl.sln
+++ /dev/null
@@ -1,181 +0,0 @@
-Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 2015
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "curl", "curl.vcxproj", "{5228E9CE-A216-422F-A5E6-58E95E2DD71D}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Debug - DLL OpenSSL - DLL LibSSH2|x64 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
-		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
-		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
-		DLL Debug - DLL wolfSSL|Win32 = DLL Debug - DLL wolfSSL|Win32
-		DLL Debug - DLL wolfSSL|x64 = DLL Debug - DLL wolfSSL|x64
-		DLL Debug|Win32 = DLL Debug|Win32
-		DLL Debug|x64 = DLL Debug|x64
-		DLL Release - DLL OpenSSL - DLL LibSSH2|Win32 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		DLL Release - DLL OpenSSL - DLL LibSSH2|x64 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
-		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
-		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
-		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
-		DLL Release - DLL wolfSSL|Win32 = DLL Release - DLL wolfSSL|Win32
-		DLL Release - DLL wolfSSL|x64 = DLL Release - DLL wolfSSL|x64
-		DLL Release|Win32 = DLL Release|Win32
-		DLL Release|x64 = DLL Release|x64
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Debug - DLL OpenSSL - DLL LibSSH2|x64 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
-		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
-		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Debug - LIB OpenSSL - LIB LibSSH2|x64 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
-		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
-		LIB Debug - LIB wolfSSL|Win32 = LIB Debug - LIB wolfSSL|Win32
-		LIB Debug - LIB wolfSSL|x64 = LIB Debug - LIB wolfSSL|x64
-		LIB Debug|Win32 = LIB Debug|Win32
-		LIB Debug|x64 = LIB Debug|x64
-		LIB Release - DLL OpenSSL - DLL LibSSH2|Win32 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		LIB Release - DLL OpenSSL - DLL LibSSH2|x64 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
-		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
-		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
-		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
-		LIB Release - LIB OpenSSL - LIB LibSSH2|Win32 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		LIB Release - LIB OpenSSL - LIB LibSSH2|x64 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
-		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
-		LIB Release - LIB wolfSSL|Win32 = LIB Release - LIB wolfSSL|Win32
-		LIB Release - LIB wolfSSL|x64 = LIB Release - LIB wolfSSL|x64
-		LIB Release|Win32 = LIB Release|Win32
-		LIB Release|x64 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.ActiveCfg = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|Win32.Build.0 = DLL Debug - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.ActiveCfg = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL wolfSSL|x64.Build.0 = DLL Debug - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.Build.0 = DLL Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.ActiveCfg = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|Win32.Build.0 = DLL Release - DLL wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.ActiveCfg = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL wolfSSL|x64.Build.0 = DLL Release - DLL wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.Build.0 = DLL Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.ActiveCfg = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.Build.0 = DLL Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.ActiveCfg = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|Win32.Build.0 = LIB Debug - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.ActiveCfg = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB wolfSSL|x64.Build.0 = LIB Debug - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.Build.0 = LIB Debug|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL LibSSH2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB LibSSH2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB LibSSH2|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.ActiveCfg = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|Win32.Build.0 = LIB Release - LIB wolfSSL|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.ActiveCfg = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB wolfSSL|x64.Build.0 = LIB Release - LIB wolfSSL|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.Build.0 = LIB Release|Win32
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.ActiveCfg = LIB Release|x64
-		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.Build.0 = LIB Release|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
diff --git a/third-party/curl/projects/Windows/VC14/src/curl.tmpl b/third-party/curl/projects/Windows/VC14/src/curl.tmpl
deleted file mode 100644
index 9f0e54b4c2..0000000000
--- a/third-party/curl/projects/Windows/VC14/src/curl.tmpl
+++ /dev/null
@@ -1,2699 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="14.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup Label="ProjectConfigurations">
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|Win32">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL wolfSSL|x64">
-      <Configuration>DLL Debug - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|Win32">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|x64">
-      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|Win32">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|x64">
-      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|Win32">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Debug|x64">
-      <Configuration>DLL Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|Win32">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL wolfSSL|x64">
-      <Configuration>DLL Release - DLL wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>DLL Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|Win32">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|x64">
-      <Configuration>DLL Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|Win32">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|x64">
-      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|Win32">
-      <Configuration>DLL Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="DLL Release|x64">
-      <Configuration>DLL Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Debug - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|Win32">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|x64">
-      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|Win32">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|x64">
-      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|Win32">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB wolfSSL|x64">
-      <Configuration>LIB Debug - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Debug - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|Win32">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|x64">
-      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|Win32">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Debug|x64">
-      <Configuration>LIB Debug</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|Win32">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL LibSSH2|x64">
-      <Configuration>LIB Release - DLL OpenSSL - DLL LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|Win32">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|x64">
-      <Configuration>LIB Release - DLL OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|x64">
-      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|Win32">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|x64">
-      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|Win32">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB wolfSSL|x64">
-      <Configuration>LIB Release - LIB wolfSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|Win32">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB LibSSH2|x64">
-      <Configuration>LIB Release - LIB OpenSSL - LIB LibSSH2</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|Win32">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|x64">
-      <Configuration>LIB Release - LIB OpenSSL</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|Win32">
-      <Configuration>LIB Release</Configuration>
-      <Platform>Win32</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="LIB Release|x64">
-      <Configuration>LIB Release</Configuration>
-      <Platform>x64</Platform>
-    </ProjectConfiguration>
-  </ItemGroup>
-  <PropertyGroup Label="Globals">
-    <ProjectGuid>{5228E9CE-A216-422F-A5E6-58E95E2DD71D}</ProjectGuid>
-    <RootNamespace>curl</RootNamespace>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseOfMfc>false</UseOfMfc>
-    <CharacterSet>Unicode</CharacterSet>
-    <PlatformToolset>v140</PlatformToolset>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
-  <ImportGroup Label="ExtensionSettings">
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'" Label="PropertySheets">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <PropertyGroup Label="UserMacros" />
-  <PropertyGroup>
-    <_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\VC14\$(Configuration)\</OutDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
-    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">false</LinkIncremental>
-    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">$(ProjectName)d</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(ProjectName)</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">$(ProjectName)</TargetName>
-  </PropertyGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);..\..\..\..\..\wolfssl\build\Win32\VC14\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);..\..\..\..\..\wolfssl\build\Win64\VC14\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);..\..\..\..\..\wolfssl\build\Win32\VC14\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;wolfssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);..\..\..\..\..\wolfssl\build\Win64\VC14\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL wolfSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14\LIB Debug;..\..\..\..\..\libssh2\build\Win32\VC14\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14\LIB Debug;..\..\..\..\..\libssh2\build\Win64\VC14\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14\LIB Release;..\..\..\..\..\libssh2\build\Win32\VC14\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14\LIB Release;..\..\..\..\..\libssh2\build\Win64\VC14\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14\DLL Debug;..\..\..\..\..\libssh2\build\Win32\VC14\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14\DLL Debug;..\..\..\..\..\libssh2\build\Win64\VC14\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);..\..\..\..\..\openssl\build\Win32\VC14\DLL Release;..\..\..\..\..\libssh2\build\Win32\VC14\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL LibSSH2|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>crypt32.lib;ws2_32.lib;wldap32.lib;libcurl.lib;libssh2.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);..\..\..\..\..\openssl\build\Win64\VC14\DLL Release;..\..\..\..\..\libssh2\build\Win64\VC14\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>Disabled</Optimization>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <MinimalRebuild>true</MinimalRebuild>
-      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
-      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
-      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">
-    <Midl>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX86</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">
-    <Midl>
-      <TargetEnvironment>X64</TargetEnvironment>
-      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
-      <HeaderFileName>
-      </HeaderFileName>
-    </Midl>
-    <ClCompile>
-      <Optimization>MaxSpeed</Optimization>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <StringPooling>true</StringPooling>
-      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <WarningLevel>Level4</WarningLevel>
-    </ClCompile>
-    <ResourceCompile>
-      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <Culture>0x0409</Culture>
-      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-    </ResourceCompile>
-    <Link>
-      <AdditionalDependencies>ws2_32.lib;wldap32.lib;crypt32.lib;normaliz.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\VC14\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <SubSystem>Console</SubSystem>
-      <TargetMachine>MachineX64</TargetMachine>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemGroup>
-CURL_SRC_X_C_FILES
-CURL_SRC_C_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_SRC_X_H_FILES
-CURL_SRC_H_FILES
-  </ItemGroup>
-  <ItemGroup>
-CURL_SRC_RC_FILES
-  </ItemGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
-  <ImportGroup Label="ExtensionTargets">
-  </ImportGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/VC14/src/curl.vcxproj.filters b/third-party/curl/projects/Windows/VC14/src/curl.vcxproj.filters
deleted file mode 100644
index 4d6341d749..0000000000
--- a/third-party/curl/projects/Windows/VC14/src/curl.vcxproj.filters
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup>
-    <Filter Include="Source Files">
-      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
-      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
-    </Filter>
-    <Filter Include="Header Files">
-      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
-      <Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
-    </Filter>
-    <Filter Include="Resource Files">
-      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
-      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
-    </Filter>
-  </ItemGroup>
-</Project>
\ No newline at end of file
diff --git a/third-party/curl/projects/Windows/generate.bat b/third-party/curl/projects/Windows/generate.bat
new file mode 100644
index 0000000000..b5da6d9a79
--- /dev/null
+++ b/third-party/curl/projects/Windows/generate.bat
@@ -0,0 +1,355 @@
+@echo off
+rem ***************************************************************************
+rem *                                  _   _ ____  _
+rem *  Project                     ___| | | |  _ \| |
+rem *                             / __| | | | |_) | |
+rem *                            | (__| |_| |  _ <| |___
+rem *                             \___|\___/|_| \_\_____|
+rem *
+rem * Copyright (C) Steve Holme, <steve_holme@hotmail.com>.
+rem *
+rem * This software is licensed as described in the file COPYING, which
+rem * you should have received as part of this distribution. The terms
+rem * are also available at https://curl.se/docs/copyright.html.
+rem *
+rem * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+rem * copies of the Software, and permit persons to whom the Software is
+rem * furnished to do so, under the terms of the COPYING file.
+rem *
+rem * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+rem * KIND, either express or implied.
+rem *
+rem * SPDX-License-Identifier: curl
+rem *
+rem ***************************************************************************
+
+:begin
+  rem Check we are running on a Windows NT derived OS
+  if not "%OS%" == "Windows_NT" goto nodos
+
+  rem Set our variables
+  setlocal ENABLEEXTENSIONS
+  set VERSION=ALL
+  set MODE=GENERATE
+
+  rem Check we are not running on a network drive
+  if "%~d0."=="\\." goto nonetdrv
+
+  rem Switch to this batch file's directory
+  cd /d "%~0\.." 1>NUL 2>&1
+
+  rem Check we are running from a curl git repository
+  if not exist ..\..\GIT-INFO.md goto norepo
+
+:parseArgs
+  if "%~1" == "" goto start
+
+  if /i "%~1" == "vc10" (
+    set VERSION=VC10
+  ) else if /i "%~1" == "vc11" (
+    set VERSION=VC11
+  ) else if /i "%~1" == "vc12" (
+    set VERSION=VC12
+  ) else if /i "%~1" == "-clean" (
+    set MODE=CLEAN
+  ) else if /i "%~1" == "-?" (
+    goto syntax
+  ) else if /i "%~1" == "/?" (
+    goto syntax
+  ) else if /i "%~1" == "-h" (
+    goto syntax
+  ) else if /i "%~1" == "-help" (
+    goto syntax
+  ) else if /i "%~1" == "--help" (
+    goto syntax
+  ) else (
+    goto unknown
+  )
+
+  shift & goto parseArgs
+
+:start
+  if "%VERSION%" == "VC10" goto vc10
+  if "%VERSION%" == "VC11" goto vc11
+  if "%VERSION%" == "VC12" goto vc12
+
+:vc10
+  if "%MODE%" == "GENERATE" (
+    call :generate_proj VC10
+  ) else (
+    call :clean_proj VC10
+  )
+
+  if not "%VERSION%" == "ALL" goto success
+
+:vc11
+  if "%MODE%" == "GENERATE" (
+    call :generate_proj VC11
+  ) else (
+    call :clean_proj VC11
+  )
+
+  if not "%VERSION%" == "ALL" goto success
+
+:vc12
+  if "%MODE%" == "GENERATE" (
+    call :generate_proj VC12
+  ) else (
+    call :clean_proj VC12
+  )
+
+  goto success
+
+rem Main project generate function.
+rem
+rem %1 - version
+rem %2 - Input template file
+rem %3 - Output project file
+rem
+:generate_proj
+  echo.
+  echo Generating %1 project files
+  if not exist %1\lib md %1\lib
+  if not exist %1\src md %1\src
+  call :generate %1 tmpl\curl-all.sln            %1\curl-all.sln
+  call :generate %1 tmpl\curl.sln                %1\src\curl.sln
+  call :generate %1 tmpl\curl.vcxproj            %1\src\curl.vcxproj
+  call :generate %1 tmpl\curl.vcxproj.filters    %1\src\curl.vcxproj.filters
+  call :generate %1 tmpl\libcurl.sln             %1\lib\libcurl.sln
+  call :generate %1 tmpl\libcurl.vcxproj         %1\lib\libcurl.vcxproj
+  call :generate %1 tmpl\libcurl.vcxproj.filters %1\lib\libcurl.vcxproj.filters
+
+  exit /B
+
+rem Main project clean function.
+rem
+rem %1 - version
+rem
+:clean_proj
+  echo.
+  echo Removing %1 project files
+  call :clean %1\curl-all.sln
+  call :clean %1\src\curl.sln
+  call :clean %1\src\curl.vcxproj
+  call :clean %1\src\curl.vcxproj.filters
+  call :clean %1\lib\libcurl.sln
+  call :clean %1\lib\libcurl.vcxproj
+  call :clean %1\lib\libcurl.vcxproj.filters
+
+  exit /B
+
+rem Main file generate function.
+rem
+rem %1 - version
+rem %2 - Input template file
+rem %3 - Output project file
+rem
+:generate
+  if not exist %2 (
+    echo.
+    echo Error: Cannot open %2
+    exit /B
+  )
+
+  if exist %3 (
+    del %3
+  )
+
+  set "S01=$FORMATVER"
+  set "S02=$PLATFORMTOOLSET"
+  set "S03=$SUBDIR"
+  set "S04=$TOOLSVER"
+
+  if "%1" == "VC10" (
+    set "R01=11.00"
+    set "R02=v100"
+    set "R03=VC10"
+    set "R04=4.0"
+  ) else if "%1" == "VC11" (
+    set "R01=12.00"
+    set "R02=v110"
+    set "R03=VC11"
+    set "R04=4.0"
+  ) else if "%1" == "VC12" (
+    set "R01=12.00"
+    set "R02=v120"
+    set "R03=VC12"
+    set "R04=12.0"
+  )
+
+  echo * %CD%\%3
+  for /f "usebackq delims=" %%i in (`"findstr /n ^^ %2"`) do (
+    set "var=%%i"
+    setlocal enabledelayedexpansion
+    set "var=!var:%S01%=%R01%!"
+    set "var=!var:%S02%=%R02%!"
+    set "var=!var:%S03%=%R03%!"
+    set "var=!var:%S04%=%R04%!"
+
+    set "var=!var:*:=!"
+
+    if "!var!" == "CURL_SRC_C_FILES" (
+      for /f "delims=" %%c in ('dir /b ..\..\src\*.c') do (
+        if /i "%%c" NEQ "curlinfo.c" call :element src "%%c" %3
+      )
+    ) else if "!var!" == "CURL_SRC_H_FILES" (
+      for /f "delims=" %%h in ('dir /b ..\..\src\*.h') do call :element src "%%h" %3
+    ) else if "!var!" == "CURL_SRC_RC_FILES" (
+      for /f "delims=" %%r in ('dir /b ..\..\src\*.rc') do call :element src "%%r" %3
+    ) else if "!var!" == "CURL_SRC_X_H_FILES" (
+      call :element lib "config-win32.h" %3
+      call :element lib "curl_setup.h" %3
+    ) else if "!var!" == "CURL_LIB_C_FILES" (
+      for /f "delims=" %%c in ('dir /b ..\..\lib\*.c') do call :element lib "%%c" %3
+    ) else if "!var!" == "CURL_LIB_H_FILES" (
+      for /f "delims=" %%h in ('dir /b ..\..\include\curl\*.h') do call :element include\curl "%%h" %3
+      for /f "delims=" %%h in ('dir /b ..\..\lib\*.h') do call :element lib "%%h" %3
+    ) else if "!var!" == "CURL_LIB_RC_FILES" (
+      for /f "delims=" %%r in ('dir /b ..\..\lib\*.rc') do call :element lib "%%r" %3
+    ) else if "!var!" == "CURL_LIB_CURLX_C_FILES" (
+      for /f "delims=" %%c in ('dir /b ..\..\lib\curlx\*.c') do call :element lib\curlx "%%c" %3
+    ) else if "!var!" == "CURL_LIB_CURLX_H_FILES" (
+      for /f "delims=" %%h in ('dir /b ..\..\lib\curlx\*.h') do call :element lib\curlx "%%h" %3
+    ) else if "!var!" == "CURL_LIB_VAUTH_C_FILES" (
+      for /f "delims=" %%c in ('dir /b ..\..\lib\vauth\*.c') do call :element lib\vauth "%%c" %3
+    ) else if "!var!" == "CURL_LIB_VAUTH_H_FILES" (
+      for /f "delims=" %%h in ('dir /b ..\..\lib\vauth\*.h') do call :element lib\vauth "%%h" %3
+    ) else if "!var!" == "CURL_LIB_VQUIC_C_FILES" (
+      for /f "delims=" %%c in ('dir /b ..\..\lib\vquic\*.c') do call :element lib\vquic "%%c" %3
+    ) else if "!var!" == "CURL_LIB_VQUIC_H_FILES" (
+      for /f "delims=" %%h in ('dir /b ..\..\lib\vquic\*.h') do call :element lib\vquic "%%h" %3
+    ) else if "!var!" == "CURL_LIB_VSSH_C_FILES" (
+      for /f "delims=" %%c in ('dir /b ..\..\lib\vssh\*.c') do call :element lib\vssh "%%c" %3
+    ) else if "!var!" == "CURL_LIB_VSSH_H_FILES" (
+      for /f "delims=" %%h in ('dir /b ..\..\lib\vssh\*.h') do call :element lib\vssh "%%h" %3
+    ) else if "!var!" == "CURL_LIB_VTLS_C_FILES" (
+      for /f "delims=" %%c in ('dir /b ..\..\lib\vtls\*.c') do call :element lib\vtls "%%c" %3
+    ) else if "!var!" == "CURL_LIB_VTLS_H_FILES" (
+      for /f "delims=" %%h in ('dir /b ..\..\lib\vtls\*.h') do call :element lib\vtls "%%h" %3
+    ) else if "!var!" == "CURL_SRC_TOOLX_C_FILES" (
+      for /f "delims=" %%c in ('dir /b ..\..\src\toolx\*.c') do call :element src\toolx "%%c" %3
+    ) else if "!var!" == "CURL_SRC_TOOLX_H_FILES" (
+      for /f "delims=" %%h in ('dir /b ..\..\src\toolx\*.h') do call :element src\toolx "%%h" %3
+    ) else (
+      echo.!var!>> %3
+    )
+
+    endlocal
+  )
+  exit /B
+
+rem Generates a single file xml element.
+rem
+rem %1 - Directory (src, lib, lib\vauth, lib\vquic, lib\vssh, lib\vtls)
+rem %2 - Source filename
+rem %3 - Output project file
+rem
+:element
+  set "SPACES=    "
+
+  call :extension %2 ext
+
+  if "%ext%" == "c" (
+    echo %SPACES%^<ClCompile Include=^"..\..\..\..\%1\%~2^" /^>>> %3
+  ) else if "%ext%" == "h" (
+    echo %SPACES%^<ClInclude Include=^"..\..\..\..\%1\%~2^" /^>>> %3
+  ) else if "%ext%" == "rc" (
+    echo %SPACES%^<ResourceCompile Include=^"..\..\..\..\%1\%~2^" /^>>> %3
+  )
+
+  exit /B
+
+rem Returns the extension for a given filename.
+rem
+rem %1 - The filename
+rem %2 - The return value
+rem
+:extension
+  set fname=%~1
+  set ename=
+:loop1
+  if "%fname%"=="" (
+    set %2=
+    exit /B
+  )
+
+  if not "%fname:~-1%"=="." (
+    set ename=%fname:~-1%%ename%
+    set fname=%fname:~0,-1%
+    goto loop1
+  )
+
+  set %2=%ename%
+  exit /B
+
+rem Removes the given project file.
+rem
+rem %1 - The filename
+rem
+:clean
+  echo * %CD%\%1
+
+  if exist %1 (
+    del %1
+  )
+
+  exit /B
+
+:syntax
+  rem Display the help
+  echo.
+  echo Usage: generate [what] [-clean]
+  echo.
+  echo What to generate:
+  echo.
+  echo vc10      - Use Visual Studio 2010
+  echo vc11      - Use Visual Studio 2012
+  echo vc12      - Use Visual Studio 2013
+  echo.
+  echo Only legacy Visual Studio project files can be generated.
+  echo.
+  echo To generate recent versions of Visual Studio project files use cmake.
+  echo Refer to INSTALL-CMAKE.md in the docs directory.
+  echo.
+  echo -clean    - Removes the project files
+  goto error
+
+:unknown
+  echo.
+  echo Error: Unknown argument '%1'
+  goto error
+
+:nodos
+  echo.
+  echo Error: Only a Windows NT based Operating System is supported
+  goto error
+
+:nonetdrv
+  echo.
+  echo Error: This batch file cannot run from a network drive
+  goto error
+
+:norepo
+  echo.
+  echo Error: This batch file should only be used from a curl git repository
+  goto error
+
+:seterr
+  rem Set the caller's errorlevel.
+  rem %1[opt]: Errorlevel as integer.
+  rem If %1 is empty the errorlevel is set to 0.
+  rem If %1 is not empty and not an integer the errorlevel is set to 1.
+  setlocal
+  set EXITCODE=%~1
+  if not defined EXITCODE set EXITCODE=0
+  echo %EXITCODE%|findstr /r "[^0-9\-]" 1>NUL 2>&1
+  if %ERRORLEVEL% EQU 0 set EXITCODE=1
+  exit /b %EXITCODE%
+
+:error
+  if "%OS%" == "Windows_NT" endlocal
+  exit /B 1
+
+:success
+  endlocal
+  exit /B 0
diff --git a/third-party/curl/projects/Windows/.gitattributes b/third-party/curl/projects/Windows/tmpl/.gitattributes
similarity index 100%
rename from third-party/curl/projects/Windows/.gitattributes
rename to third-party/curl/projects/Windows/tmpl/.gitattributes
diff --git a/third-party/curl/projects/Windows/tmpl/README.txt b/third-party/curl/projects/Windows/tmpl/README.txt
new file mode 100644
index 0000000000..08b2908a20
--- /dev/null
+++ b/third-party/curl/projects/Windows/tmpl/README.txt
@@ -0,0 +1,6 @@
+The files in this directory are not meant to be opened with Visual Studio.
+
+This directory contains template files that are used to generate project files
+for legacy versions of Visual Studio 2010, 2012 and 2013. To generate the
+files run generate.bat in the projects directory and refer to that directory's
+README.
diff --git a/third-party/curl/projects/Windows/tmpl/curl-all.sln b/third-party/curl/projects/Windows/tmpl/curl-all.sln
new file mode 100644
index 0000000000..8f6afd4e13
--- /dev/null
+++ b/third-party/curl/projects/Windows/tmpl/curl-all.sln
@@ -0,0 +1,257 @@
+Microsoft Visual Studio Solution File, Format Version $FORMATVER
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "curl", "src\curl.vcxproj", "{5228E9CE-A216-422F-A5E6-58E95E2DD71D}"
+	ProjectSection(ProjectDependencies) = postProject
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB} = {DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}
+	EndProjectSection
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libcurl", "lib\libcurl.vcxproj", "{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		DLL Debug - DLL OpenSSL - DLL libssh2|Win32 = DLL Debug - DLL OpenSSL - DLL libssh2|Win32
+		DLL Debug - DLL OpenSSL - DLL libssh2|x64 = DLL Debug - DLL OpenSSL - DLL libssh2|x64
+		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
+		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
+		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
+		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
+		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
+		DLL Debug|Win32 = DLL Debug|Win32
+		DLL Debug|x64 = DLL Debug|x64
+		DLL Release - DLL OpenSSL - DLL libssh2|Win32 = DLL Release - DLL OpenSSL - DLL libssh2|Win32
+		DLL Release - DLL OpenSSL - DLL libssh2|x64 = DLL Release - DLL OpenSSL - DLL libssh2|x64
+		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
+		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
+		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
+		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
+		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
+		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
+		DLL Release|Win32 = DLL Release|Win32
+		DLL Release|x64 = DLL Release|x64
+		LIB Debug - DLL OpenSSL - DLL libssh2|Win32 = LIB Debug - DLL OpenSSL - DLL libssh2|Win32
+		LIB Debug - DLL OpenSSL - DLL libssh2|x64 = LIB Debug - DLL OpenSSL - DLL libssh2|x64
+		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
+		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
+		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
+		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
+		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
+		LIB Debug - LIB OpenSSL - LIB libssh2|Win32 = LIB Debug - LIB OpenSSL - LIB libssh2|Win32
+		LIB Debug - LIB OpenSSL - LIB libssh2|x64 = LIB Debug - LIB OpenSSL - LIB libssh2|x64
+		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
+		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
+		LIB Debug|Win32 = LIB Debug|Win32
+		LIB Debug|x64 = LIB Debug|x64
+		LIB Release - DLL OpenSSL - DLL libssh2|Win32 = LIB Release - DLL OpenSSL - DLL libssh2|Win32
+		LIB Release - DLL OpenSSL - DLL libssh2|x64 = LIB Release - DLL OpenSSL - DLL libssh2|x64
+		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
+		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
+		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
+		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
+		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
+		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
+		LIB Release - LIB OpenSSL - LIB libssh2|Win32 = LIB Release - LIB OpenSSL - LIB libssh2|Win32
+		LIB Release - LIB OpenSSL - LIB libssh2|x64 = LIB Release - LIB OpenSSL - LIB libssh2|x64
+		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
+		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
+		LIB Release|Win32 = LIB Release|Win32
+		LIB Release|x64 = LIB Release|x64
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL libssh2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL libssh2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL libssh2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL libssh2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.Build.0 = DLL Debug|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL libssh2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL libssh2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL libssh2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL libssh2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.Build.0 = DLL Release|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.ActiveCfg = DLL Release|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.Build.0 = DLL Release|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL libssh2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL libssh2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL libssh2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL libssh2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB libssh2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB libssh2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB libssh2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB libssh2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.Build.0 = LIB Debug|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL libssh2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL libssh2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL libssh2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL libssh2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB libssh2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB libssh2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB libssh2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB libssh2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.Build.0 = LIB Release|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.ActiveCfg = LIB Release|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.Build.0 = LIB Release|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL libssh2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL libssh2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL libssh2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL libssh2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.Build.0 = DLL Debug|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL libssh2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL libssh2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL libssh2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL libssh2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.Build.0 = DLL Release|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.ActiveCfg = DLL Release|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.Build.0 = DLL Release|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL libssh2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL libssh2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL libssh2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL libssh2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB libssh2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB libssh2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB libssh2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB libssh2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.Build.0 = LIB Debug|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL libssh2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL libssh2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL libssh2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL libssh2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB libssh2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB libssh2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB libssh2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB libssh2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.Build.0 = LIB Release|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.ActiveCfg = LIB Release|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.Build.0 = LIB Release|x64
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal
diff --git a/third-party/curl/projects/Windows/tmpl/curl.sln b/third-party/curl/projects/Windows/tmpl/curl.sln
new file mode 100644
index 0000000000..7e50eed99d
--- /dev/null
+++ b/third-party/curl/projects/Windows/tmpl/curl.sln
@@ -0,0 +1,156 @@
+Microsoft Visual Studio Solution File, Format Version $FORMATVER
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "curl", "curl.vcxproj", "{5228E9CE-A216-422F-A5E6-58E95E2DD71D}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		DLL Debug - DLL OpenSSL - DLL libssh2|Win32 = DLL Debug - DLL OpenSSL - DLL libssh2|Win32
+		DLL Debug - DLL OpenSSL - DLL libssh2|x64 = DLL Debug - DLL OpenSSL - DLL libssh2|x64
+		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
+		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
+		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
+		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
+		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
+		DLL Debug|Win32 = DLL Debug|Win32
+		DLL Debug|x64 = DLL Debug|x64
+		DLL Release - DLL OpenSSL - DLL libssh2|Win32 = DLL Release - DLL OpenSSL - DLL libssh2|Win32
+		DLL Release - DLL OpenSSL - DLL libssh2|x64 = DLL Release - DLL OpenSSL - DLL libssh2|x64
+		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
+		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
+		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
+		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
+		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
+		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
+		DLL Release|Win32 = DLL Release|Win32
+		DLL Release|x64 = DLL Release|x64
+		LIB Debug - DLL OpenSSL - DLL libssh2|Win32 = LIB Debug - DLL OpenSSL - DLL libssh2|Win32
+		LIB Debug - DLL OpenSSL - DLL libssh2|x64 = LIB Debug - DLL OpenSSL - DLL libssh2|x64
+		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
+		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
+		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
+		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
+		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
+		LIB Debug - LIB OpenSSL - LIB libssh2|Win32 = LIB Debug - LIB OpenSSL - LIB libssh2|Win32
+		LIB Debug - LIB OpenSSL - LIB libssh2|x64 = LIB Debug - LIB OpenSSL - LIB libssh2|x64
+		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
+		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
+		LIB Debug|Win32 = LIB Debug|Win32
+		LIB Debug|x64 = LIB Debug|x64
+		LIB Release - DLL OpenSSL - DLL libssh2|Win32 = LIB Release - DLL OpenSSL - DLL libssh2|Win32
+		LIB Release - DLL OpenSSL - DLL libssh2|x64 = LIB Release - DLL OpenSSL - DLL libssh2|x64
+		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
+		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
+		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
+		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
+		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
+		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
+		LIB Release - LIB OpenSSL - LIB libssh2|Win32 = LIB Release - LIB OpenSSL - LIB libssh2|Win32
+		LIB Release - LIB OpenSSL - LIB libssh2|x64 = LIB Release - LIB OpenSSL - LIB libssh2|x64
+		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
+		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
+		LIB Release|Win32 = LIB Release|Win32
+		LIB Release|x64 = LIB Release|x64
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL libssh2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL libssh2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL libssh2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL - DLL libssh2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Debug|x64.Build.0 = DLL Debug|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL libssh2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL libssh2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL libssh2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL - DLL libssh2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|Win32.Build.0 = DLL Release|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.ActiveCfg = DLL Release|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.DLL Release|x64.Build.0 = DLL Release|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL libssh2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL libssh2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL libssh2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL - DLL libssh2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB libssh2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB libssh2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB libssh2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL - LIB libssh2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Debug|x64.Build.0 = LIB Debug|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL libssh2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL libssh2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL libssh2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL - DLL libssh2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB libssh2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB libssh2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB libssh2|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB libssh2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL - LIB libssh2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB libssh2|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|Win32.Build.0 = LIB Release|Win32
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.ActiveCfg = LIB Release|x64
+		{5228E9CE-A216-422F-A5E6-58E95E2DD71D}.LIB Release|x64.Build.0 = LIB Release|x64
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal
diff --git a/third-party/curl/projects/Windows/tmpl/curl.vcxproj b/third-party/curl/projects/Windows/tmpl/curl.vcxproj
new file mode 100644
index 0000000000..6d63601b6b
--- /dev/null
+++ b/third-party/curl/projects/Windows/tmpl/curl.vcxproj
@@ -0,0 +1,2314 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="$TOOLSVER" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL libssh2|Win32">
+      <Configuration>DLL Debug - DLL OpenSSL - DLL libssh2</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL libssh2|x64">
+      <Configuration>DLL Debug - DLL OpenSSL - DLL libssh2</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|Win32">
+      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|x64">
+      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32">
+      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|x64">
+      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|Win32">
+      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|x64">
+      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Debug|Win32">
+      <Configuration>DLL Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Debug|x64">
+      <Configuration>DLL Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL libssh2|Win32">
+      <Configuration>DLL Release - DLL OpenSSL - DLL libssh2</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL libssh2|x64">
+      <Configuration>DLL Release - DLL OpenSSL - DLL libssh2</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|Win32">
+      <Configuration>DLL Release - DLL OpenSSL</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|x64">
+      <Configuration>DLL Release - DLL OpenSSL</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|Win32">
+      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|x64">
+      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|Win32">
+      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|x64">
+      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release|Win32">
+      <Configuration>DLL Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release|x64">
+      <Configuration>DLL Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL libssh2|Win32">
+      <Configuration>LIB Debug - DLL OpenSSL - DLL libssh2</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL libssh2|x64">
+      <Configuration>LIB Debug - DLL OpenSSL - DLL libssh2</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|Win32">
+      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|x64">
+      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32">
+      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|x64">
+      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|Win32">
+      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|x64">
+      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB libssh2|Win32">
+      <Configuration>LIB Debug - LIB OpenSSL - LIB libssh2</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB libssh2|x64">
+      <Configuration>LIB Debug - LIB OpenSSL - LIB libssh2</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|Win32">
+      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|x64">
+      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug|Win32">
+      <Configuration>LIB Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug|x64">
+      <Configuration>LIB Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL libssh2|Win32">
+      <Configuration>LIB Release - DLL OpenSSL - DLL libssh2</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL libssh2|x64">
+      <Configuration>LIB Release - DLL OpenSSL - DLL libssh2</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|Win32">
+      <Configuration>LIB Release - DLL OpenSSL</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|x64">
+      <Configuration>LIB Release - DLL OpenSSL</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|Win32">
+      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|x64">
+      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|Win32">
+      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|x64">
+      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB libssh2|Win32">
+      <Configuration>LIB Release - LIB OpenSSL - LIB libssh2</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB libssh2|x64">
+      <Configuration>LIB Release - LIB OpenSSL - LIB libssh2</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|Win32">
+      <Configuration>LIB Release - LIB OpenSSL</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|x64">
+      <Configuration>LIB Release - LIB OpenSSL</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release|Win32">
+      <Configuration>LIB Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release|x64">
+      <Configuration>LIB Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{5228E9CE-A216-422F-A5E6-58E95E2DD71D}</ProjectGuid>
+    <RootNamespace>curl</RootNamespace>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup>
+    <_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">false</LinkIncremental>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(OutDir)src\</IntDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(OutDir)src\</IntDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)src\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">false</LinkIncremental>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|Win32'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|Win32'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|Win32'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|x64'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|x64'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|x64'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(ProjectName)</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(ProjectName)</TargetName>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);..\..\..\..\..\openssl\build\Win32\$SUBDIR\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);..\..\..\..\..\openssl\build\Win64\$SUBDIR\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);..\..\..\..\..\openssl\build\Win32\$SUBDIR\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);..\..\..\..\..\openssl\build\Win64\$SUBDIR\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);..\..\..\..\..\openssl\build\Win32\$SUBDIR\LIB Debug;..\..\..\..\..\libssh2\build\Win32\$SUBDIR\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);..\..\..\..\..\openssl\build\Win64\$SUBDIR\LIB Debug;..\..\..\..\..\libssh2\build\Win64\$SUBDIR\LIB Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);..\..\..\..\..\openssl\build\Win32\$SUBDIR\LIB Release;..\..\..\..\..\libssh2\build\Win32\$SUBDIR\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);..\..\..\..\..\openssl\build\Win64\$SUBDIR\LIB Release;..\..\..\..\..\libssh2\build\Win64\$SUBDIR\LIB Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);..\..\..\..\..\openssl\build\Win32\$SUBDIR\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);..\..\..\..\..\openssl\build\Win64\$SUBDIR\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);..\..\..\..\..\openssl\build\Win32\$SUBDIR\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);..\..\..\..\..\openssl\build\Win64\$SUBDIR\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);..\..\..\..\..\openssl\build\Win32\$SUBDIR\DLL Debug;..\..\..\..\..\libssh2\build\Win32\$SUBDIR\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurld.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);..\..\..\..\..\openssl\build\Win64\$SUBDIR\DLL Debug;..\..\..\..\..\libssh2\build\Win64\$SUBDIR\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);..\..\..\..\..\openssl\build\Win32\$SUBDIR\DLL Release;..\..\..\..\..\libssh2\build\Win32\$SUBDIR\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcurl.lib;libssh2.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);..\..\..\..\..\openssl\build\Win64\$SUBDIR\DLL Release;..\..\..\..\..\libssh2\build\Win64\$SUBDIR\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;secur32.lib;bcrypt.lib;crypt32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;secur32.lib;bcrypt.lib;crypt32.lib;normaliz.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;secur32.lib;bcrypt.lib;crypt32.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;DEBUGBUILD;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;secur32.lib;bcrypt.lib;crypt32.lib;normaliz.lib;libcurld.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;secur32.lib;bcrypt.lib;crypt32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">
+    <Midl>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;secur32.lib;bcrypt.lib;crypt32.lib;normaliz.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win32\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;secur32.lib;bcrypt.lib;crypt32.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(TargetDir)$(TargetName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;CURL_STATICLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+      <AdditionalIncludeDirectories>..\..\..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;secur32.lib;bcrypt.lib;crypt32.lib;normaliz.lib;libcurl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\build\Win64\$SUBDIR\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+CURL_LIB_CURLX_C_FILES
+CURL_SRC_TOOLX_C_FILES
+CURL_SRC_C_FILES
+  </ItemGroup>
+  <ItemGroup>
+CURL_LIB_CURLX_H_FILES
+CURL_SRC_TOOLX_H_FILES
+CURL_SRC_X_H_FILES
+CURL_SRC_H_FILES
+  </ItemGroup>
+  <ItemGroup>
+CURL_SRC_RC_FILES
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
diff --git a/third-party/curl/projects/Windows/tmpl/curl.vcxproj.filters b/third-party/curl/projects/Windows/tmpl/curl.vcxproj.filters
new file mode 100644
index 0000000000..793a698a45
--- /dev/null
+++ b/third-party/curl/projects/Windows/tmpl/curl.vcxproj.filters
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>c</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc</Extensions>
+    </Filter>
+  </ItemGroup>
+</Project>
diff --git a/third-party/curl/projects/Windows/tmpl/libcurl.sln b/third-party/curl/projects/Windows/tmpl/libcurl.sln
new file mode 100644
index 0000000000..2eeb679dbc
--- /dev/null
+++ b/third-party/curl/projects/Windows/tmpl/libcurl.sln
@@ -0,0 +1,156 @@
+Microsoft Visual Studio Solution File, Format Version $FORMATVER
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libcurl", "libcurl.vcxproj", "{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		DLL Debug - DLL OpenSSL - DLL libssh2|Win32 = DLL Debug - DLL OpenSSL - DLL libssh2|Win32
+		DLL Debug - DLL OpenSSL - DLL libssh2|x64 = DLL Debug - DLL OpenSSL - DLL libssh2|x64
+		DLL Debug - DLL OpenSSL|Win32 = DLL Debug - DLL OpenSSL|Win32
+		DLL Debug - DLL OpenSSL|x64 = DLL Debug - DLL OpenSSL|x64
+		DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		DLL Debug - DLL Windows SSPI - DLL WinIDN|x64 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
+		DLL Debug - DLL Windows SSPI|Win32 = DLL Debug - DLL Windows SSPI|Win32
+		DLL Debug - DLL Windows SSPI|x64 = DLL Debug - DLL Windows SSPI|x64
+		DLL Debug|Win32 = DLL Debug|Win32
+		DLL Debug|x64 = DLL Debug|x64
+		DLL Release - DLL OpenSSL - DLL libssh2|Win32 = DLL Release - DLL OpenSSL - DLL libssh2|Win32
+		DLL Release - DLL OpenSSL - DLL libssh2|x64 = DLL Release - DLL OpenSSL - DLL libssh2|x64
+		DLL Release - DLL OpenSSL|Win32 = DLL Release - DLL OpenSSL|Win32
+		DLL Release - DLL OpenSSL|x64 = DLL Release - DLL OpenSSL|x64
+		DLL Release - DLL Windows SSPI - DLL WinIDN|Win32 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
+		DLL Release - DLL Windows SSPI - DLL WinIDN|x64 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
+		DLL Release - DLL Windows SSPI|Win32 = DLL Release - DLL Windows SSPI|Win32
+		DLL Release - DLL Windows SSPI|x64 = DLL Release - DLL Windows SSPI|x64
+		DLL Release|Win32 = DLL Release|Win32
+		DLL Release|x64 = DLL Release|x64
+		LIB Debug - DLL OpenSSL - DLL libssh2|Win32 = LIB Debug - DLL OpenSSL - DLL libssh2|Win32
+		LIB Debug - DLL OpenSSL - DLL libssh2|x64 = LIB Debug - DLL OpenSSL - DLL libssh2|x64
+		LIB Debug - DLL OpenSSL|Win32 = LIB Debug - DLL OpenSSL|Win32
+		LIB Debug - DLL OpenSSL|x64 = LIB Debug - DLL OpenSSL|x64
+		LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		LIB Debug - DLL Windows SSPI - DLL WinIDN|x64 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
+		LIB Debug - DLL Windows SSPI|Win32 = LIB Debug - DLL Windows SSPI|Win32
+		LIB Debug - DLL Windows SSPI|x64 = LIB Debug - DLL Windows SSPI|x64
+		LIB Debug - LIB OpenSSL - LIB libssh2|Win32 = LIB Debug - LIB OpenSSL - LIB libssh2|Win32
+		LIB Debug - LIB OpenSSL - LIB libssh2|x64 = LIB Debug - LIB OpenSSL - LIB libssh2|x64
+		LIB Debug - LIB OpenSSL|Win32 = LIB Debug - LIB OpenSSL|Win32
+		LIB Debug - LIB OpenSSL|x64 = LIB Debug - LIB OpenSSL|x64
+		LIB Debug|Win32 = LIB Debug|Win32
+		LIB Debug|x64 = LIB Debug|x64
+		LIB Release - DLL OpenSSL - DLL libssh2|Win32 = LIB Release - DLL OpenSSL - DLL libssh2|Win32
+		LIB Release - DLL OpenSSL - DLL libssh2|x64 = LIB Release - DLL OpenSSL - DLL libssh2|x64
+		LIB Release - DLL OpenSSL|Win32 = LIB Release - DLL OpenSSL|Win32
+		LIB Release - DLL OpenSSL|x64 = LIB Release - DLL OpenSSL|x64
+		LIB Release - DLL Windows SSPI - DLL WinIDN|Win32 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
+		LIB Release - DLL Windows SSPI - DLL WinIDN|x64 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
+		LIB Release - DLL Windows SSPI|Win32 = LIB Release - DLL Windows SSPI|Win32
+		LIB Release - DLL Windows SSPI|x64 = LIB Release - DLL Windows SSPI|x64
+		LIB Release - LIB OpenSSL - LIB libssh2|Win32 = LIB Release - LIB OpenSSL - LIB libssh2|Win32
+		LIB Release - LIB OpenSSL - LIB libssh2|x64 = LIB Release - LIB OpenSSL - LIB libssh2|x64
+		LIB Release - LIB OpenSSL|Win32 = LIB Release - LIB OpenSSL|Win32
+		LIB Release - LIB OpenSSL|x64 = LIB Release - LIB OpenSSL|x64
+		LIB Release|Win32 = LIB Release|Win32
+		LIB Release|x64 = LIB Release|x64
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL libssh2|Win32.ActiveCfg = DLL Debug - DLL OpenSSL - DLL libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL libssh2|Win32.Build.0 = DLL Debug - DLL OpenSSL - DLL libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL libssh2|x64.ActiveCfg = DLL Debug - DLL OpenSSL - DLL libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL - DLL libssh2|x64.Build.0 = DLL Debug - DLL OpenSSL - DLL libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.ActiveCfg = DLL Debug - DLL OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|Win32.Build.0 = DLL Debug - DLL OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.ActiveCfg = DLL Debug - DLL OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL OpenSSL|x64.Build.0 = DLL Debug - DLL OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Debug - DLL Windows SSPI - DLL WinIDN|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.ActiveCfg = DLL Debug - DLL Windows SSPI|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|Win32.Build.0 = DLL Debug - DLL Windows SSPI|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.ActiveCfg = DLL Debug - DLL Windows SSPI|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug - DLL Windows SSPI|x64.Build.0 = DLL Debug - DLL Windows SSPI|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.ActiveCfg = DLL Debug|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|Win32.Build.0 = DLL Debug|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.ActiveCfg = DLL Debug|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Debug|x64.Build.0 = DLL Debug|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL libssh2|Win32.ActiveCfg = DLL Release - DLL OpenSSL - DLL libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL libssh2|Win32.Build.0 = DLL Release - DLL OpenSSL - DLL libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL libssh2|x64.ActiveCfg = DLL Release - DLL OpenSSL - DLL libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL - DLL libssh2|x64.Build.0 = DLL Release - DLL OpenSSL - DLL libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.ActiveCfg = DLL Release - DLL OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|Win32.Build.0 = DLL Release - DLL OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.ActiveCfg = DLL Release - DLL OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL OpenSSL|x64.Build.0 = DLL Release - DLL OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = DLL Release - DLL Windows SSPI - DLL WinIDN|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.ActiveCfg = DLL Release - DLL Windows SSPI|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|Win32.Build.0 = DLL Release - DLL Windows SSPI|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.ActiveCfg = DLL Release - DLL Windows SSPI|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release - DLL Windows SSPI|x64.Build.0 = DLL Release - DLL Windows SSPI|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.ActiveCfg = DLL Release|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|Win32.Build.0 = DLL Release|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.ActiveCfg = DLL Release|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.DLL Release|x64.Build.0 = DLL Release|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL libssh2|Win32.ActiveCfg = LIB Debug - DLL OpenSSL - DLL libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL libssh2|Win32.Build.0 = LIB Debug - DLL OpenSSL - DLL libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL libssh2|x64.ActiveCfg = LIB Debug - DLL OpenSSL - DLL libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL - DLL libssh2|x64.Build.0 = LIB Debug - DLL OpenSSL - DLL libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.ActiveCfg = LIB Debug - DLL OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|Win32.Build.0 = LIB Debug - DLL OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.ActiveCfg = LIB Debug - DLL OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL OpenSSL|x64.Build.0 = LIB Debug - DLL OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Debug - DLL Windows SSPI - DLL WinIDN|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.ActiveCfg = LIB Debug - DLL Windows SSPI|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|Win32.Build.0 = LIB Debug - DLL Windows SSPI|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.ActiveCfg = LIB Debug - DLL Windows SSPI|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - DLL Windows SSPI|x64.Build.0 = LIB Debug - DLL Windows SSPI|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB libssh2|Win32.ActiveCfg = LIB Debug - LIB OpenSSL - LIB libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB libssh2|Win32.Build.0 = LIB Debug - LIB OpenSSL - LIB libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB libssh2|x64.ActiveCfg = LIB Debug - LIB OpenSSL - LIB libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL - LIB libssh2|x64.Build.0 = LIB Debug - LIB OpenSSL - LIB libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.ActiveCfg = LIB Debug - LIB OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|Win32.Build.0 = LIB Debug - LIB OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.ActiveCfg = LIB Debug - LIB OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug - LIB OpenSSL|x64.Build.0 = LIB Debug - LIB OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.ActiveCfg = LIB Debug|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|Win32.Build.0 = LIB Debug|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.ActiveCfg = LIB Debug|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Debug|x64.Build.0 = LIB Debug|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL libssh2|Win32.ActiveCfg = LIB Release - DLL OpenSSL - DLL libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL libssh2|Win32.Build.0 = LIB Release - DLL OpenSSL - DLL libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL libssh2|x64.ActiveCfg = LIB Release - DLL OpenSSL - DLL libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL - DLL libssh2|x64.Build.0 = LIB Release - DLL OpenSSL - DLL libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.ActiveCfg = LIB Release - DLL OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|Win32.Build.0 = LIB Release - DLL OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.ActiveCfg = LIB Release - DLL OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL OpenSSL|x64.Build.0 = LIB Release - DLL OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|Win32.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.ActiveCfg = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI - DLL WinIDN|x64.Build.0 = LIB Release - DLL Windows SSPI - DLL WinIDN|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.ActiveCfg = LIB Release - DLL Windows SSPI|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|Win32.Build.0 = LIB Release - DLL Windows SSPI|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.ActiveCfg = LIB Release - DLL Windows SSPI|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - DLL Windows SSPI|x64.Build.0 = LIB Release - DLL Windows SSPI|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB libssh2|Win32.ActiveCfg = LIB Release - LIB OpenSSL - LIB libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB libssh2|Win32.Build.0 = LIB Release - LIB OpenSSL - LIB libssh2|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB libssh2|x64.ActiveCfg = LIB Release - LIB OpenSSL - LIB libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL - LIB libssh2|x64.Build.0 = LIB Release - LIB OpenSSL - LIB libssh2|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.ActiveCfg = LIB Release - LIB OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|Win32.Build.0 = LIB Release - LIB OpenSSL|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.ActiveCfg = LIB Release - LIB OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release - LIB OpenSSL|x64.Build.0 = LIB Release - LIB OpenSSL|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.ActiveCfg = LIB Release|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|Win32.Build.0 = LIB Release|Win32
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.ActiveCfg = LIB Release|x64
+		{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}.LIB Release|x64.Build.0 = LIB Release|x64
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal
diff --git a/third-party/curl/projects/Windows/tmpl/libcurl.vcxproj b/third-party/curl/projects/Windows/tmpl/libcurl.vcxproj
new file mode 100644
index 0000000000..af141d0bd1
--- /dev/null
+++ b/third-party/curl/projects/Windows/tmpl/libcurl.vcxproj
@@ -0,0 +1,2055 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="$TOOLSVER" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL libssh2|Win32">
+      <Configuration>DLL Debug - DLL OpenSSL - DLL libssh2</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL - DLL libssh2|x64">
+      <Configuration>DLL Debug - DLL OpenSSL - DLL libssh2</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|Win32">
+      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Debug - DLL OpenSSL|x64">
+      <Configuration>DLL Debug - DLL OpenSSL</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32">
+      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI - DLL WinIDN|x64">
+      <Configuration>DLL Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|Win32">
+      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Debug - DLL Windows SSPI|x64">
+      <Configuration>DLL Debug - DLL Windows SSPI</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Debug|Win32">
+      <Configuration>DLL Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Debug|x64">
+      <Configuration>DLL Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL libssh2|Win32">
+      <Configuration>DLL Release - DLL OpenSSL - DLL libssh2</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release - DLL OpenSSL - DLL libssh2|x64">
+      <Configuration>DLL Release - DLL OpenSSL - DLL libssh2</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|Win32">
+      <Configuration>DLL Release - DLL OpenSSL</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release - DLL OpenSSL|x64">
+      <Configuration>DLL Release - DLL OpenSSL</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|Win32">
+      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI - DLL WinIDN|x64">
+      <Configuration>DLL Release - DLL Windows SSPI - DLL WinIDN</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|Win32">
+      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release - DLL Windows SSPI|x64">
+      <Configuration>DLL Release - DLL Windows SSPI</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release|Win32">
+      <Configuration>DLL Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="DLL Release|x64">
+      <Configuration>DLL Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL libssh2|Win32">
+      <Configuration>LIB Debug - DLL OpenSSL - DLL libssh2</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL - DLL libssh2|x64">
+      <Configuration>LIB Debug - DLL OpenSSL - DLL libssh2</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|Win32">
+      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - DLL OpenSSL|x64">
+      <Configuration>LIB Debug - DLL OpenSSL</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32">
+      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI - DLL WinIDN|x64">
+      <Configuration>LIB Debug - DLL Windows SSPI - DLL WinIDN</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|Win32">
+      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - DLL Windows SSPI|x64">
+      <Configuration>LIB Debug - DLL Windows SSPI</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB libssh2|Win32">
+      <Configuration>LIB Debug - LIB OpenSSL - LIB libssh2</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL - LIB libssh2|x64">
+      <Configuration>LIB Debug - LIB OpenSSL - LIB libssh2</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|Win32">
+      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug - LIB OpenSSL|x64">
+      <Configuration>LIB Debug - LIB OpenSSL</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug|Win32">
+      <Configuration>LIB Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Debug|x64">
+      <Configuration>LIB Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL libssh2|Win32">
+      <Configuration>LIB Release - DLL OpenSSL - DLL libssh2</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - DLL OpenSSL - DLL libssh2|x64">
+      <Configuration>LIB Release - DLL OpenSSL - DLL libssh2</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|Win32">
+      <Configuration>LIB Release - DLL OpenSSL</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - DLL OpenSSL|x64">
+      <Configuration>LIB Release - DLL OpenSSL</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|Win32">
+      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI - DLL WinIDN|x64">
+      <Configuration>LIB Release - DLL Windows SSPI - DLL WinIDN</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|Win32">
+      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - DLL Windows SSPI|x64">
+      <Configuration>LIB Release - DLL Windows SSPI</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB libssh2|Win32">
+      <Configuration>LIB Release - LIB OpenSSL - LIB libssh2</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - LIB OpenSSL - LIB libssh2|x64">
+      <Configuration>LIB Release - LIB OpenSSL - LIB libssh2</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|Win32">
+      <Configuration>LIB Release - LIB OpenSSL</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release - LIB OpenSSL|x64">
+      <Configuration>LIB Release - LIB OpenSSL</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release|Win32">
+      <Configuration>LIB Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="LIB Release|x64">
+      <Configuration>LIB Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{DA6F56B4-06A4-441D-AD70-AC5A7D51FADB}</ProjectGuid>
+    <RootNamespace>libcurl</RootNamespace>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|Win32'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|Win32'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|Win32'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|Win32'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>$PLATFORMTOOLSET</PlatformToolset>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup>
+    <_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(OutDir)lib\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(OutDir)lib\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">$(OutDir)lib\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">$(OutDir)lib\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">false</LinkIncremental>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">false</LinkIncremental>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">false</LinkIncremental>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">false</LinkIncremental>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|Win32'">$(OutDir)lib\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|x64'">$(OutDir)lib\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|Win32'">$(OutDir)lib\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|Win32'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|x64'">$(OutDir)lib\</IntDir>
+    <LinkIncremental Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|x64'">false</LinkIncremental>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|Win32'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|x64'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|Win32'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|x64'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|Win32'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|x64'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">$(OutDir)lib\</IntDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">$(OutDir)lib\</IntDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|Win32'">..\..\..\..\build\Win32\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|Win32'">$(OutDir)lib\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|x64'">..\..\..\..\build\Win64\$SUBDIR\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|x64'">$(OutDir)lib\</IntDir>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|Win32'">$(ProjectName)d</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|x64'">$(ProjectName)d</TargetName>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">
+    <Midl>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>Win32</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">
+    <Midl>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">
+    <Midl>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>Win32</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">
+    <Midl>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|Win32'">
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|Win32'">
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|Win32'">
+    <Midl>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>Win32</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\$SUBDIR\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\$SUBDIR\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL|x64'">
+    <Midl>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\$SUBDIR\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\$SUBDIR\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|Win32'">
+    <Midl>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>Win32</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\$SUBDIR\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\$SUBDIR\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL|x64'">
+    <Midl>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\$SUBDIR\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\$SUBDIR\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|Win32'">
+    <Midl>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>Win32</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;secur32.lib;bcrypt.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
+    <Midl>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>Win32</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;secur32.lib;bcrypt.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI|x64'">
+    <Midl>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;secur32.lib;bcrypt.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL Windows SSPI - DLL WinIDN|x64'">
+    <Midl>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;secur32.lib;bcrypt.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|Win32'">
+    <Midl>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>Win32</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;secur32.lib;bcrypt.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|Win32'">
+    <Midl>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>Win32</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;secur32.lib;bcrypt.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI|x64'">
+    <Midl>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;secur32.lib;bcrypt.lib;crypt32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL Windows SSPI - DLL WinIDN|x64'">
+    <Midl>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;iphlpapi.lib;wldap32.lib;secur32.lib;bcrypt.lib;crypt32.lib;normaliz.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|Win32'">
+    <Midl>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>Win32</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\$SUBDIR\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\$SUBDIR\DLL Debug;..\..\..\..\..\libssh2\build\Win32\$SUBDIR\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug - DLL OpenSSL - DLL libssh2|x64'">
+    <Midl>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\$SUBDIR\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2d.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\$SUBDIR\DLL Debug;..\..\..\..\..\libssh2\build\Win64\$SUBDIR\DLL Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <ProgramDatabaseFile>$(TargetDir)$(TargetName).pdb</ProgramDatabaseFile>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|Win32'">
+    <Midl>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>Win32</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\$SUBDIR\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win32\$SUBDIR\DLL Release;..\..\..\..\..\libssh2\build\Win32\$SUBDIR\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <ManifestFile>$(IntDir)$(TargetFileName).intermediate.manifest</ManifestFile>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release - DLL OpenSSL - DLL libssh2|x64'">
+    <Midl>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MkTypLibCompatible>true</MkTypLibCompatible>
+      <TargetEnvironment>X64</TargetEnvironment>
+      <TypeLibraryName>$(OutDir)$(ProjectName).tlb</TypeLibraryName>
+      <HeaderFileName>
+      </HeaderFileName>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\$SUBDIR\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>secur32.lib;bcrypt.lib;crypt32.lib;ws2_32.lib;iphlpapi.lib;wldap32.lib;libcrypto.lib;libssl.lib;libssh2.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\..\..\openssl\build\Win64\$SUBDIR\DLL Release;..\..\..\..\..\libssh2\build\Win64\$SUBDIR\DLL Release;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <ImportLibrary>$(TargetDir)$(TargetName).lib</ImportLibrary>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|Win32'">
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\$SUBDIR\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\$SUBDIR\DLL Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|Win32'">
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\$SUBDIR\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL OpenSSL - DLL libssh2|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\$SUBDIR\DLL Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|Win32'">
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|Win32'">
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - DLL Windows SSPI - DLL WinIDN|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|Win32'">
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\$SUBDIR\LIB Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\$SUBDIR\LIB Debug\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|Win32'">
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\$SUBDIR\LIB Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Debug - LIB OpenSSL - LIB libssh2|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\$SUBDIR\LIB Debug\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>_DEBUG;BUILDING_LIBCURL;DEBUGBUILD;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <WarningLevel>Level4</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|Win32'">
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\$SUBDIR\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\$SUBDIR\DLL Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|Win32'">
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\$SUBDIR\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL OpenSSL - DLL libssh2|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\$SUBDIR\DLL Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|Win32'">
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|Win32'">
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - DLL Windows SSPI - DLL WinIDN|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_WINDOWS_SSPI;USE_SCHANNEL;USE_WIN32_IDN;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|Win32'">
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\$SUBDIR\LIB Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\$SUBDIR\LIB Release\include;..\..\..\..\..\openssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|Win32'">
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win32\$SUBDIR\LIB Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='LIB Release - LIB OpenSSL - LIB libssh2|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <AdditionalIncludeDirectories>..\..\..\..\include;..\..\..\..\lib;..\..\..\..\..\openssl\include\..\build\Win64\$SUBDIR\LIB Release\include;..\..\..\..\..\openssl\include;..\..\..\..\..\libssh2\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>NDEBUG;BUILDING_LIBCURL;CURL_STATICLIB;USE_OPENSSL;USE_LIBSSH2;USE_IPV6;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WarningLevel>Level4</WarningLevel>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Culture>0x0409</Culture>
+    </ResourceCompile>
+    <Lib>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Lib>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+CURL_LIB_C_FILES
+CURL_LIB_CURLX_C_FILES
+CURL_LIB_VAUTH_C_FILES
+CURL_LIB_VQUIC_C_FILES
+CURL_LIB_VSSH_C_FILES
+CURL_LIB_VTLS_C_FILES
+  </ItemGroup>
+  <ItemGroup>
+CURL_LIB_H_FILES
+CURL_LIB_CURLX_H_FILES
+CURL_LIB_VAUTH_H_FILES
+CURL_LIB_VQUIC_H_FILES
+CURL_LIB_VSSH_H_FILES
+CURL_LIB_VTLS_H_FILES
+  </ItemGroup>
+  <ItemGroup>
+CURL_LIB_RC_FILES
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
diff --git a/third-party/curl/projects/Windows/tmpl/libcurl.vcxproj.filters b/third-party/curl/projects/Windows/tmpl/libcurl.vcxproj.filters
new file mode 100644
index 0000000000..793a698a45
--- /dev/null
+++ b/third-party/curl/projects/Windows/tmpl/libcurl.vcxproj.filters
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>c</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc</Extensions>
+    </Filter>
+  </ItemGroup>
+</Project>
diff --git a/third-party/curl/projects/build-openssl.bat b/third-party/curl/projects/build-openssl.bat
deleted file mode 100644
index b645383419..0000000000
--- a/third-party/curl/projects/build-openssl.bat
+++ /dev/null
@@ -1,739 +0,0 @@
-@echo off
-rem ***************************************************************************
-rem *                                  _   _ ____  _
-rem *  Project                     ___| | | |  _ \| |
-rem *                             / __| | | | |_) | |
-rem *                            | (__| |_| |  _ <| |___
-rem *                             \___|\___/|_| \_\_____|
-rem *
-rem * Copyright (C) Steve Holme, <steve_holme@hotmail.com>.
-rem *
-rem * This software is licensed as described in the file COPYING, which
-rem * you should have received as part of this distribution. The terms
-rem * are also available at https://curl.se/docs/copyright.html.
-rem *
-rem * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-rem * copies of the Software, and permit persons to whom the Software is
-rem * furnished to do so, under the terms of the COPYING file.
-rem *
-rem * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-rem * KIND, either express or implied.
-rem *
-rem * SPDX-License-Identifier: curl
-rem *
-rem ***************************************************************************
-
-:begin
-  rem Check we are running on a Windows NT derived OS
-  if not "%OS%" == "Windows_NT" goto nodos
-
-  rem Set our variables
-  setlocal ENABLEDELAYEDEXPANSION
-  set BUILD_CONFIG=
-  set BUILD_PLATFORM=
-  set SAVED_PATH=
-  set SOURCE_PATH=
-  set TMP_BUILD_PATH=
-  set TMP_INSTALL_PATH=
-  set VC_VER=
-
-  rem Ensure we have the required arguments
-  if /i "%~1" == "" goto syntax
-
-  rem Calculate the program files directory
-  if defined PROGRAMFILES (
-    set "PF=%PROGRAMFILES%"
-    set OS_PLATFORM=x86
-  )
-  if defined PROGRAMFILES(x86) (
-    rem Visual Studio was x86-only prior to 14.3
-    if /i "%~1" == "vc14.3" (
-      set "PF=%PROGRAMFILES%"
-    ) else (
-      set "PF=%PROGRAMFILES(x86)%"
-    )
-    set OS_PLATFORM=x64
-  )
-
-:parseArgs
-  if not "%~1" == "" (
-    if /i "%~1" == "vc10" (
-      set VC_VER=10.0
-      set VC_DESC=VC10
-      set "VC_PATH=Microsoft Visual Studio 10.0\VC"
-    ) else if /i "%~1" == "vc11" (
-      set VC_VER=11.0
-      set VC_DESC=VC11
-      set "VC_PATH=Microsoft Visual Studio 11.0\VC"
-    ) else if /i "%~1" == "vc12" (
-      set VC_VER=12.0
-      set VC_DESC=VC12
-      set "VC_PATH=Microsoft Visual Studio 12.0\VC"
-    ) else if /i "%~1" == "vc14" (
-      set VC_VER=14.0
-      set VC_DESC=VC14
-      set "VC_PATH=Microsoft Visual Studio 14.0\VC"
-    ) else if /i "%~1" == "vc14.1" (
-      set VC_VER=14.1
-      set VC_DESC=VC14.10
-
-      rem Determine the VC14.1 path based on the installed edition in descending
-      rem order (Enterprise, then Professional and finally Community)
-      if exist "%PF%\Microsoft Visual Studio\2017\Enterprise\VC" (
-        set "VC_PATH=Microsoft Visual Studio\2017\Enterprise\VC"
-      ) else if exist "%PF%\Microsoft Visual Studio\2017\Professional\VC" (
-        set "VC_PATH=Microsoft Visual Studio\2017\Professional\VC"
-      ) else (
-        set "VC_PATH=Microsoft Visual Studio\2017\Community\VC"
-      )
-    ) else if /i "%~1" == "vc14.2" (
-      set VC_VER=14.2
-      set VC_DESC=VC14.20
-
-      rem Determine the VC14.2 path based on the installed edition in descending
-      rem order (Enterprise, then Professional and finally Community)
-      if exist "%PF%\Microsoft Visual Studio\2019\Enterprise\VC" (
-        set "VC_PATH=Microsoft Visual Studio\2019\Enterprise\VC"
-      ) else if exist "%PF%\Microsoft Visual Studio\2019\Professional\VC" (
-        set "VC_PATH=Microsoft Visual Studio\2019\Professional\VC"
-      ) else (
-        set "VC_PATH=Microsoft Visual Studio\2019\Community\VC"
-      )
-    ) else if /i "%~1" == "vc14.3" (
-      set VC_VER=14.3
-      set VC_DESC=VC14.30
-
-      rem Determine the VC14.3 path based on the installed edition in descending
-      rem order (Enterprise, then Professional and finally Community)
-      if exist "%PF%\Microsoft Visual Studio\2022\Enterprise\VC" (
-        set "VC_PATH=Microsoft Visual Studio\2022\Enterprise\VC"
-      ) else if exist "%PF%\Microsoft Visual Studio\2022\Professional\VC" (
-        set "VC_PATH=Microsoft Visual Studio\2022\Professional\VC"
-      ) else (
-        set "VC_PATH=Microsoft Visual Studio\2022\Community\VC"
-      )
-    ) else if /i "%~1%" == "x86" (
-      set BUILD_PLATFORM=x86
-    ) else if /i "%~1%" == "x64" (
-      set BUILD_PLATFORM=x64
-    ) else if /i "%~1%" == "debug" (
-      set BUILD_CONFIG=debug
-    ) else if /i "%~1%" == "release" (
-      set BUILD_CONFIG=release
-    ) else if /i "%~1" == "-?" (
-      goto syntax
-    ) else if /i "%~1" == "-h" (
-      goto syntax
-    ) else if /i "%~1" == "-help" (
-      goto syntax
-    ) else if /i "%~1" == "-VSpath" (
-      if "%~2" == "" (
-        echo.
-        echo Error. Please provide VS Path.
-        goto error
-      ) else (
-        set "ABS_VC_PATH=%~2\VC"
-        shift
-      )
-    ) else if /i "%~1" == "-perlpath" (
-      if "%~2" == "" (
-        echo.
-        echo Error. Please provide Perl root Path.
-        goto error
-      ) else (
-        set "PERL_PATH=%~2"
-        shift
-      )
-    ) else (
-      if not defined START_DIR (
-        set "START_DIR=%~1%"
-      ) else (
-        goto unknown
-      )
-    )
-
-    shift & goto parseArgs
-  )
-
-:prerequisites
-  rem Compiler is a required parameter
-  if not defined VC_VER goto syntax
-
-  rem Default the start directory if one isn't specified
-  if not defined START_DIR set START_DIR=..\..\openssl
-
-  if not defined ABS_VC_PATH (
-    rem Check we have a program files directory
-    if not defined PF goto nopf
-    set "ABS_VC_PATH=%PF%\%VC_PATH%"
-  )
-
-  rem Check we have Visual Studio installed
-  if not exist "%ABS_VC_PATH%" goto novc
-
-  if not defined PERL_PATH (
-    rem Check we have Perl in our path
-    perl --version <NUL 1>NUL 2>&1
-    if errorlevel 1 (
-      rem It isn't so check we have it installed and set the path if it is
-      if exist "%SystemDrive%\Perl" (
-        set "PATH=%SystemDrive%\Perl\bin;%PATH%"
-      ) else (
-        if exist "%SystemDrive%\Perl64" (
-          set "PATH=%SystemDrive%\Perl64\bin;%PATH%"
-        ) else (
-          goto noperl
-        )
-      )
-    )
-  ) else (
-    set "PATH=%PERL_PATH%\Perl\bin;%PATH%"
-  )
-
-  rem Check the start directory exists
-  if not exist "%START_DIR%" goto noopenssl
-
-:setup
-  if "%BUILD_PLATFORM%" == "" (
-    if "%VC_VER%" == "6.0" (
-      set BUILD_PLATFORM=x86
-    ) else if "%VC_VER%" == "7.0" (
-      set BUILD_PLATFORM=x86
-    ) else if "%VC_VER%" == "7.1" (
-      set BUILD_PLATFORM=x86
-    ) else (
-      set BUILD_PLATFORM=%OS_PLATFORM%
-    )
-  )
-
-  if "%BUILD_PLATFORM%" == "x86" (
-    set VCVARS_PLATFORM=x86
-  ) else if "%BUILD_PLATFORM%" == "x64" (
-    if "%VC_VER%" == "10.0" set VCVARS_PLATFORM=%BUILD_PLATFORM%
-    if "%VC_VER%" == "11.0" set VCVARS_PLATFORM=amd64
-    if "%VC_VER%" == "12.0" set VCVARS_PLATFORM=amd64
-    if "%VC_VER%" == "14.0" set VCVARS_PLATFORM=amd64
-    if "%VC_VER%" == "14.1" set VCVARS_PLATFORM=amd64
-    if "%VC_VER%" == "14.2" set VCVARS_PLATFORM=amd64
-    if "%VC_VER%" == "14.3" set VCVARS_PLATFORM=amd64
-  )
-
-  if exist "%START_DIR%\ms\do_ms.bat" (
-    set LEGACY_BUILD=TRUE
-  ) else (
-    set LEGACY_BUILD=FALSE
-  )
-
-:start
-  echo.
-  set "SAVED_PATH=%CD%"
-
-  if "%VC_VER%" == "14.1" (
-    call "%ABS_VC_PATH%\Auxiliary\Build\vcvarsall" %VCVARS_PLATFORM%
-  ) else if "%VC_VER%" == "14.2" (
-    call "%ABS_VC_PATH%\Auxiliary\Build\vcvarsall" %VCVARS_PLATFORM%
-  ) else if "%VC_VER%" == "14.3" (
-    call "%ABS_VC_PATH%\Auxiliary\Build\vcvarsall" %VCVARS_PLATFORM%
-  ) else (
-    call "%ABS_VC_PATH%\vcvarsall" %VCVARS_PLATFORM%
-  )
-
-  echo.
-
-  cd /d "%START_DIR%" || (echo Error: Failed cd start & exit /B 1)
-  rem Save the full path of the openssl source dir
-  set "SOURCE_PATH=%CD%"
-
-  rem Set temporary paths for building and installing OpenSSL. If a temporary
-  rem path is not the same as the source path then it is *removed* after the
-  rem installation is completed.
-  rem
-  rem For legacy OpenSSL the temporary build path must be the source path.
-  rem
-  rem For OpenSSL 1.1.x the temporary paths must be separate not a descendant
-  rem of the other, otherwise pdb files will be lost between builds.
-  rem https://github.com/openssl/openssl/issues/10005
-  rem
-  if "%LEGACY_BUILD%" == "TRUE" (
-    set "TMP_BUILD_PATH=%SOURCE_PATH%"
-    set "TMP_INSTALL_PATH=%SOURCE_PATH%"
-  ) else (
-    set "TMP_BUILD_PATH=%SOURCE_PATH%\build\tmp_build"
-    set "TMP_INSTALL_PATH=%SOURCE_PATH%\build\tmp_install"
-  )
-
-  goto %BUILD_PLATFORM%
-
-:x64
-  rem Calculate our output directory
-  set OUTDIR=build\Win64\%VC_DESC%
-  if not exist %OUTDIR% md %OUTDIR%
-
-  if not "%BUILD_CONFIG%" == "release" (
-    rem Configuring 64-bit Static Library Debug Build
-    call :configure x64 debug static %LEGACY_BUILD%
-
-    rem Perform the build
-    call :build x64 static %LEGACY_BUILD%
-
-    rem Perform the install
-    call :install debug static %LEGACY_BUILD%
-
-    rem Configuring 64-bit Shared Library Debug Build
-    call :configure x64 debug shared %LEGACY_BUILD%
-
-    rem Perform the build
-    call :build x64 shared %LEGACY_BUILD%
-
-    rem Perform the install
-    call :install debug shared %LEGACY_BUILD%
-  )
-
-  if not "%BUILD_CONFIG%" == "debug" (
-    rem Configuring 64-bit Static Library Release Build
-    call :configure x64 release static %LEGACY_BUILD%
-
-    rem Perform the build
-    call :build x64 static %LEGACY_BUILD%
-
-    rem Perform the install
-    call :install release static %LEGACY_BUILD%
-
-    rem Configuring 64-bit Shared Library Release Build
-    call :configure x64 release shared %LEGACY_BUILD%
-
-    rem Perform the build
-    call :build x64 shared %LEGACY_BUILD%
-
-    rem Perform the install
-    call :install release shared %LEGACY_BUILD%
-  )
-
-  goto success
-
-:x86
-  rem Calculate our output directory
-  set OUTDIR=build\Win32\%VC_DESC%
-  if not exist %OUTDIR% md %OUTDIR%
-
-  if not "%BUILD_CONFIG%" == "release" (
-    rem Configuring 32-bit Static Library Debug Build
-    call :configure x86 debug static %LEGACY_BUILD%
-
-    rem Perform the build
-    call :build x86 static %LEGACY_BUILD%
-
-    rem Perform the install
-    call :install debug static %LEGACY_BUILD%
-
-    rem Configuring 32-bit Shared Library Debug Build
-    call :configure x86 debug shared %LEGACY_BUILD%
-
-    rem Perform the build
-    call :build x86 shared %LEGACY_BUILD%
-
-    rem Perform the install
-    call :install debug shared %LEGACY_BUILD%
-  )
-
-  if not "%BUILD_CONFIG%" == "debug" (
-    rem Configuring 32-bit Static Library Release Build
-    call :configure x86 release static %LEGACY_BUILD%
-
-    rem Perform the build
-    call :build x86 static %LEGACY_BUILD%
-
-    rem Perform the install
-    call :install release static %LEGACY_BUILD%
-
-    rem Configuring 32-bit Shared Library Release Build
-    call :configure x86 release shared %LEGACY_BUILD%
-
-    rem Perform the build
-    call :build x86 shared %LEGACY_BUILD%
-
-    rem Perform the install
-    call :install release shared %LEGACY_BUILD%
-  )
-
-  goto success
-
-rem Function to configure the build.
-rem
-rem %1 - Platform (x86 or x64)
-rem %2 - Configuration (release or debug)
-rem %3 - Build Type (static or shared)
-rem %4 - Build type (TRUE for legacy aka pre v1.1.0; otherwise FALSE)
-rem
-:configure
-  setlocal
-
-  if "%1" == "" exit /B 1
-  if "%2" == "" exit /B 1
-  if "%3" == "" exit /B 1
-  if "%4" == "" exit /B 1
-
-  if not exist "%TMP_BUILD_PATH%" mkdir "%TMP_BUILD_PATH%"
-  cd /d "%TMP_BUILD_PATH%" || (echo Error: Failed cd build & exit /B 1)
-
-  if "%4" == "TRUE" (
-    rem Calculate the configure options
-    if "%1" == "x86" (
-      if "%2" == "debug" (
-        set options=debug-VC-WIN32
-      ) else if "%2" == "release" (
-        set options=VC-WIN32
-      ) else (
-        exit /B 1
-      )
-
-      set options=!options! no-asm
-    ) else if "%1" == "x64" (
-      if "%2" == "debug" (
-        set options=debug-VC-WIN64A
-      ) else if "%2" == "release" (
-        set options=VC-WIN64A
-      ) else (
-        exit /B 1
-      )
-    ) else (
-      exit /B 1
-    )
-  ) else if "%4" == "FALSE" (
-    rem Has configure already been ran?
-    if exist makefile (
-      rem Clean up the previous build
-      nmake clean
-
-      rem Remove the old makefile
-      del makefile 1>nul
-    )
-
-    rem Calculate the configure options
-    if "%1" == "x86" (
-      set options=VC-WIN32
-    ) else if "%1" == "x64" (
-      set options=VC-WIN64A
-    ) else (
-      exit /B 1
-    )
-
-    if "%2" == "debug" (
-      set options=!options! --debug
-    ) else if "%2" == "release" (
-      set options=!options! --release
-    ) else (
-      exit /B 1
-    )
-
-    if "%3" == "static" (
-      set options=!options! no-shared
-    ) else if not "%3" == "shared" (
-      exit /B 1
-    )
-
-    set options=!options! no-asm
-  ) else (
-    exit /B 1
-  )
-
-  rem Run the configure
-  perl "%SOURCE_PATH%\Configure" %options% "--prefix=%TMP_INSTALL_PATH%"
-
-  exit /B %ERRORLEVEL%
-
-rem Main build function.
-rem
-rem %1 - Platform (x86 or x64)
-rem %2 - Build Type (static or shared)
-rem %3 - Build type (TRUE for legacy aka pre v1.1.0; otherwise FALSE)
-rem
-:build
-  setlocal
-
-  if "%1" == "" exit /B 1
-  if "%2" == "" exit /B 1
-  if "%3" == "" exit /B 1
-
-  cd /d "%TMP_BUILD_PATH%" || (echo Error: Failed cd build & exit /B 1)
-
-  if "%3" == "TRUE" (
-    if "%1" == "x86" (
-      call ms\do_ms.bat
-    ) else if "%1" == "x64" (
-      call ms\do_win64a.bat
-    ) else (
-      exit /B 1
-    )
-
-    if "%2" == "static" (
-      nmake -f ms\nt.mak
-    ) else if "%2" == "shared" (
-      nmake -f ms\ntdll.mak
-    ) else (
-      exit /B 1
-    )
-  ) else if "%3" == "FALSE" (
-    nmake
-  ) else (
-    exit /B 1
-  )
-
-  exit /B 0
-
-rem Main installation function.
-rem
-rem %1 - Configuration (release or debug)
-rem %2 - Build Type (static or shared)
-rem %3 - Build type (TRUE for legacy aka pre v1.1.0; otherwise FALSE)
-rem
-:install
-  setlocal
-
-  if "%1" == "" exit /B 1
-  if "%2" == "" exit /B 1
-  if "%3" == "" exit /B 1
-
-  rem Copy the generated files to our directory structure
-  if "%3" == "TRUE" (
-    rem There's no actual installation for legacy OpenSSL, the files are copied
-    rem from the build dir (for legacy this is same as source dir) to the final
-    rem location.
-    cd /d "%SOURCE_PATH%" || (echo Error: Failed cd source & exit /B 1)
-    if "%1" == "debug" (
-      if "%2" == "static" (
-        rem Move the output directories
-        if exist "%OUTDIR%\LIB Debug" (
-          copy /y out32.dbg\* "%OUTDIR%\LIB Debug" 1>nul
-          rd out32.dbg /s /q
-        ) else (
-          move out32.dbg "%OUTDIR%\LIB Debug" 1>nul
-        )
-
-        rem Move the PDB files
-        move tmp32.dbg\lib.pdb "%OUTDIR%\LIB Debug" 1>nul
-
-        rem Remove the intermediate directories
-        rd tmp32.dbg /s /q
-      ) else if "%2" == "shared" (
-        if exist "%OUTDIR%\DLL Debug" (
-          copy /y out32dll.dbg\* "%OUTDIR%\DLL Debug" 1>nul
-          rd out32dll.dbg /s /q
-        ) else (
-          move out32dll.dbg "%OUTDIR%\DLL Debug" 1>nul
-        )
-
-        rem Move the PDB files
-        move tmp32dll.dbg\lib.pdb "%OUTDIR%\DLL Debug" 1>nul
-
-        rem Remove the intermediate directories
-        rd tmp32dll.dbg /s /q
-      ) else (
-        exit /B 1
-      )
-    ) else if "%1" == "release" (
-      if "%2" == "static" (
-        rem Move the output directories
-        if exist "%OUTDIR%\LIB Release" (
-          copy /y out32\* "%OUTDIR%\LIB Release" 1>nul
-          rd out32 /s /q
-        ) else (
-          move out32 "%OUTDIR%\LIB Release" 1>nul
-        )
-
-        rem Move the PDB files
-        move tmp32\lib.pdb "%OUTDIR%\LIB Release" 1>nul
-
-        rem Remove the intermediate directories
-        rd tmp32 /s /q
-      ) else if "%2" == "shared" (
-        if exist "%OUTDIR%\DLL Release" (
-          copy /y out32dll\* "%OUTDIR%\DLL Release" 1>nul
-          rd out32dll /s /q
-        ) else (
-          move out32dll "%OUTDIR%\DLL Release" 1>nul
-        )
-
-        rem Move the PDB files
-        move tmp32dll\lib.pdb "%OUTDIR%\DLL Release" 1>nul
-
-        rem Remove the intermediate directories
-        rd tmp32dll /s /q
-      ) else (
-        exit /B 1
-      )
-    )
-  ) else if "%3" == "FALSE" (
-    cd /d "%TMP_BUILD_PATH%" || (echo Error: Failed cd build & exit /B 1)
-
-    rem Perform the installation
-    nmake install_sw
-
-    cd /d "%SOURCE_PATH%" || (echo Error: Failed cd source & exit /B 1)
-
-    rem Move the output directories
-    if "%1" == "debug" (
-      if "%2" == "static" (
-        if not exist "%OUTDIR%\LIB Debug" (
-          mkdir "%OUTDIR%\LIB Debug" 1>nul
-        )
-
-        move "%TMP_INSTALL_PATH%\lib\*.lib" "%OUTDIR%\LIB Debug" 1>nul
-        move "%TMP_INSTALL_PATH%\lib\*.pdb" "%OUTDIR%\LIB Debug" 1>nul
-        move "%TMP_INSTALL_PATH%\bin\*.exe" "%OUTDIR%\LIB Debug" 1>nul
-        move "%TMP_INSTALL_PATH%\bin\*.pdb" "%OUTDIR%\LIB Debug" 1>nul
-        xcopy /E /I /Y "%TMP_INSTALL_PATH%\include" "%OUTDIR%\LIB Debug\include" 1>nul
-      ) else if "%2" == "shared" (
-        if not exist "%OUTDIR%\DLL Debug" (
-          mkdir "%OUTDIR%\DLL Debug" 1>nul
-        )
-
-        move "%TMP_INSTALL_PATH%\lib\*.lib" "%OUTDIR%\DLL Debug" 1>nul
-        if exist "%TMP_INSTALL_PATH%\lib\engines-3" (
-          move "%TMP_INSTALL_PATH%\lib\engines-3\*.dll" "%OUTDIR%\DLL Debug" 1>nul
-          move "%TMP_INSTALL_PATH%\lib\engines-3\*.pdb" "%OUTDIR%\DLL Debug" 1>nul
-        ) else if exist "%TMP_INSTALL_PATH%\lib\engines-1_1" (
-          move "%TMP_INSTALL_PATH%\lib\engines-1_1\*.dll" "%OUTDIR%\DLL Debug" 1>nul
-          move "%TMP_INSTALL_PATH%\lib\engines-1_1\*.pdb" "%OUTDIR%\DLL Debug" 1>nul
-        )
-        move "%TMP_INSTALL_PATH%\bin\*.dll" "%OUTDIR%\DLL Debug" 1>nul
-        move "%TMP_INSTALL_PATH%\bin\*.exe" "%OUTDIR%\DLL Debug" 1>nul
-        move "%TMP_INSTALL_PATH%\bin\*.pdb" "%OUTDIR%\DLL Debug" 1>nul
-        xcopy /E /I /Y "%TMP_INSTALL_PATH%\include" "%OUTDIR%\DLL Debug\include" 1>nul
-      ) else (
-        exit /B 1
-      )
-    ) else if "%1" == "release" (
-      if "%2" == "static" (
-        if not exist "%OUTDIR%\LIB Release" (
-          mkdir "%OUTDIR%\LIB Release" 1>nul
-        )
-
-        move "%TMP_INSTALL_PATH%\lib\*.lib" "%OUTDIR%\LIB Release" 1>nul
-        move "%TMP_INSTALL_PATH%\lib\*.pdb" "%OUTDIR%\LIB Release" 1>nul
-        move "%TMP_INSTALL_PATH%\bin\*.exe" "%OUTDIR%\LIB Release" 1>nul
-        move "%TMP_INSTALL_PATH%\bin\*.pdb" "%OUTDIR%\LIB Release" 1>nul
-        xcopy /E /I /Y "%TMP_INSTALL_PATH%\include" "%OUTDIR%\LIB Release\include" 1>nul
-      ) else if "%2" == "shared" (
-        if not exist "%OUTDIR%\DLL Release" (
-          mkdir "%OUTDIR%\DLL Release" 1>nul
-        )
-
-        move "%TMP_INSTALL_PATH%\lib\*.lib" "%OUTDIR%\DLL Release" 1>nul
-        if exist "%TMP_INSTALL_PATH%\lib\engines-3" (
-          move "%TMP_INSTALL_PATH%\lib\engines-3\*.dll" "%OUTDIR%\DLL Release" 1>nul
-          move "%TMP_INSTALL_PATH%\lib\engines-3\*.pdb" "%OUTDIR%\DLL Release" 1>nul
-        ) else if exist "%TMP_INSTALL_PATH%\lib\engines-1_1" (
-          move "%TMP_INSTALL_PATH%\lib\engines-1_1\*.dll" "%OUTDIR%\DLL Release" 1>nul
-          move "%TMP_INSTALL_PATH%\lib\engines-1_1\*.pdb" "%OUTDIR%\DLL Release" 1>nul
-        )
-        move "%TMP_INSTALL_PATH%\bin\*.dll" "%OUTDIR%\DLL Release" 1>nul
-        move "%TMP_INSTALL_PATH%\bin\*.exe" "%OUTDIR%\DLL Release" 1>nul
-        move "%TMP_INSTALL_PATH%\bin\*.pdb" "%OUTDIR%\DLL Release" 1>nul
-        xcopy /E /I /Y "%TMP_INSTALL_PATH%\include" "%OUTDIR%\DLL Release\include" 1>nul
-      ) else (
-        exit /B 1
-      )
-    ) else (
-      exit /B 1
-    )
-
-    rem Remove the output directories
-    if not "%SOURCE_PATH%" == "%TMP_BUILD_PATH%" (
-      rd "%TMP_BUILD_PATH%" /s /q
-    )
-    if not "%SOURCE_PATH%" == "%TMP_INSTALL_PATH%" (
-      rd "%TMP_INSTALL_PATH%" /s /q
-    )
-  ) else (
-    exit /B 1
-  )
-
-  exit /B 0
-
-:syntax
-  rem Display the help
-  echo.
-  echo Usage: build-openssl ^<compiler^> [platform] [configuration] [directory] [-VSpath] ["VSpath"] [-perlpath] ["perlpath"]
-  echo.
-  echo Compiler:
-  echo.
-  echo vc10      - Use Visual Studio 2010
-  echo vc11      - Use Visual Studio 2012
-  echo vc12      - Use Visual Studio 2013
-  echo vc14      - Use Visual Studio 2015
-  echo vc14.1    - Use Visual Studio 2017
-  echo vc14.2    - Use Visual Studio 2019
-  echo vc14.3    - Use Visual Studio 2022
-  echo.
-  echo Platform:
-  echo.
-  echo x86       - Perform a 32-bit build
-  echo x64       - Perform a 64-bit build
-  echo.
-  echo Configuration:
-  echo.
-  echo debug     - Perform a debug build
-  echo release   - Perform a release build
-  echo.
-  echo Other:
-  echo.
-  echo directory - Specifies the OpenSSL source directory
-  echo.
-  echo -VSpath - Specify the custom VS path if Visual Studio is not located at
-  echo           "C:\<ProgramFiles>\Microsoft Visual Studio <version>"
-  echo           For e.g. -VSpath "C:\apps\MVS14"
-  echo.
-  echo -perlpath - Specify the custom perl root path if perl is not located at
-  echo             "C:\Perl" and it is a portable copy of perl and not
-  echo             installed on the win system.
-  echo             For e.g. -perlpath "D:\strawberry-perl-5.24.3.1-64bit-portable"
-  goto error
-
-:unknown
-  echo.
-  echo Error: Unknown argument '%1'
-  goto error
-
-:nodos
-  echo.
-  echo Error: Only a Windows NT based Operating System is supported
-  goto error
-
-:nopf
-  echo.
-  echo Error: Cannot obtain the directory for Program Files
-  goto error
-
-:novc
-  echo.
-  echo Error: %VC_DESC% is not installed
-  echo Error: Please check whether Visual compiler is installed at the path "%ABS_VC_PATH%"
-  echo Error: Please provide proper VS Path by using -VSpath
-  goto error
-
-:noperl
-  echo.
-  echo Error: Perl is not installed
-  echo Error: Please check whether Perl is installed or it is at location "C:\Perl"
-  echo Error: If Perl is portable please provide perl root path by using -perlpath
-  goto error
-
-:nox64
-  echo.
-  echo Error: %VC_DESC% does not support 64-bit builds
-  goto error
-
-:noopenssl
-  echo.
-  echo Error: Cannot locate OpenSSL source directory
-  goto error
-
-:error
-  if "%OS%" == "Windows_NT" endlocal
-  exit /B 1
-
-:success
-  cd /d "%SAVED_PATH%"
-  endlocal
-  exit /B 0
diff --git a/third-party/curl/projects/build-wolfssl.bat b/third-party/curl/projects/build-wolfssl.bat
deleted file mode 100644
index 6f9bad9d17..0000000000
--- a/third-party/curl/projects/build-wolfssl.bat
+++ /dev/null
@@ -1,429 +0,0 @@
-@echo off
-rem ***************************************************************************
-rem *                                  _   _ ____  _
-rem *  Project                     ___| | | |  _ \| |
-rem *                             / __| | | | |_) | |
-rem *                            | (__| |_| |  _ <| |___
-rem *                             \___|\___/|_| \_\_____|
-rem *
-rem * Copyright (C) Steve Holme, <steve_holme@hotmail.com>.
-rem * Copyright (C) Jay Satiro, <raysatiro@yahoo.com>.
-rem *
-rem * This software is licensed as described in the file COPYING, which
-rem * you should have received as part of this distribution. The terms
-rem * are also available at https://curl.se/docs/copyright.html.
-rem *
-rem * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-rem * copies of the Software, and permit persons to whom the Software is
-rem * furnished to do so, under the terms of the COPYING file.
-rem *
-rem * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-rem * KIND, either express or implied.
-rem *
-rem * SPDX-License-Identifier: curl
-rem *
-rem ***************************************************************************
-
-:begin
-  rem Check we are running on a Windows NT derived OS
-  if not "%OS%" == "Windows_NT" goto nodos
-
-  rem Set our variables
-  setlocal
-  set SUCCESSFUL_BUILDS=
-  set VC_VER=
-  set BUILD_PLATFORM=
-  set DEFAULT_START_DIR=..\..\wolfssl
-
-  rem Calculate the program files directory
-  if defined PROGRAMFILES (
-    set "PF=%PROGRAMFILES%"
-    set OS_PLATFORM=x86
-  )
-  if defined PROGRAMFILES(x86) (
-    rem Visual Studio was x86-only prior to 14.3
-    if /i "%~1" == "vc14.3" (
-      set "PF=%PROGRAMFILES%"
-    ) else (
-      set "PF=%PROGRAMFILES(x86)%"
-    )
-    set OS_PLATFORM=x64
-  )
-
-  rem Ensure we have the required arguments
-  if /i "%~1" == "" goto syntax
-
-:parseArgs
-  if "%~1" == "" goto prerequisites
-
-  if /i "%~1" == "vc10" (
-    set VC_VER=10.0
-    set VC_DESC=VC10
-    set VC_TOOLSET=v100
-    set "VC_PATH=Microsoft Visual Studio 10.0\VC"
-  ) else if /i "%~1" == "vc11" (
-    set VC_VER=11.0
-    set VC_DESC=VC11
-    set VC_TOOLSET=v110
-    set "VC_PATH=Microsoft Visual Studio 11.0\VC"
-  ) else if /i "%~1" == "vc12" (
-    set VC_VER=12.0
-    set VC_DESC=VC12
-    set VC_TOOLSET=v120
-    set "VC_PATH=Microsoft Visual Studio 12.0\VC"
-  ) else if /i "%~1" == "vc14" (
-    set VC_VER=14.0
-    set VC_DESC=VC14
-    set VC_TOOLSET=v140
-    set "VC_PATH=Microsoft Visual Studio 14.0\VC"
-  ) else if /i "%~1" == "vc14.1" (
-    set VC_VER=14.1
-    set VC_DESC=VC14.10
-    set VC_TOOLSET=v141
-
-    rem Determine the VC14.1 path based on the installed edition in descending
-    rem order (Enterprise, then Professional and finally Community)
-    if exist "%PF%\Microsoft Visual Studio\2017\Enterprise\VC" (
-      set "VC_PATH=Microsoft Visual Studio\2017\Enterprise\VC"
-    ) else if exist "%PF%\Microsoft Visual Studio\2017\Professional\VC" (
-      set "VC_PATH=Microsoft Visual Studio\2017\Professional\VC"
-    ) else (
-      set "VC_PATH=Microsoft Visual Studio\2017\Community\VC"
-    )
-  ) else if /i "%~1" == "vc14.2" (
-    set VC_VER=14.2
-    set VC_DESC=VC14.20
-    set VC_TOOLSET=v142
-
-    rem Determine the VC14.2 path based on the installed edition in descending
-    rem order (Enterprise, then Professional and finally Community)
-    if exist "%PF%\Microsoft Visual Studio\2019\Enterprise\VC" (
-      set "VC_PATH=Microsoft Visual Studio\2019\Enterprise\VC"
-    ) else if exist "%PF%\Microsoft Visual Studio\2019\Professional\VC" (
-      set "VC_PATH=Microsoft Visual Studio\2019\Professional\VC"
-    ) else (
-      set "VC_PATH=Microsoft Visual Studio\2019\Community\VC"
-    )
-  ) else if /i "%~1" == "vc14.3" (
-    set VC_VER=14.3
-    set VC_DESC=VC14.30
-    set VC_TOOLSET=v143
-
-    rem Determine the VC14.3 path based on the installed edition in descending
-    rem order (Enterprise, then Professional and finally Community)
-    if exist "%PF%\Microsoft Visual Studio\2022\Enterprise\VC" (
-      set "VC_PATH=Microsoft Visual Studio\2022\Enterprise\VC"
-    ) else if exist "%PF%\Microsoft Visual Studio\2022\Professional\VC" (
-      set "VC_PATH=Microsoft Visual Studio\2022\Professional\VC"
-    ) else (
-      set "VC_PATH=Microsoft Visual Studio\2022\Community\VC"
-    )
-  ) else if /i "%~1" == "x86" (
-    set BUILD_PLATFORM=x86
-  ) else if /i "%~1" == "x64" (
-    set BUILD_PLATFORM=x64
-  ) else if /i "%~1" == "debug" (
-    set BUILD_CONFIG=debug
-  ) else if /i "%~1" == "release" (
-    set BUILD_CONFIG=release
-  ) else if /i "%~1" == "-?" (
-    goto syntax
-  ) else if /i "%~1" == "-h" (
-    goto syntax
-  ) else if /i "%~1" == "-help" (
-    goto syntax
-  ) else (
-    if not defined START_DIR (
-      set START_DIR=%~1
-    ) else (
-      goto unknown
-    )
-  )
-
-  shift & goto parseArgs
-
-:prerequisites
-  rem Compiler is a required parameter
-  if not defined VC_VER goto syntax
-
-  rem Default the start directory if one isn't specified
-  if not defined START_DIR set "START_DIR=%DEFAULT_START_DIR%"
-
-  rem Check we have a program files directory
-  if not defined PF goto nopf
-
-  rem Check we have Visual Studio installed
-  if not exist "%PF%\%VC_PATH%" goto novc
-
-  rem Check the start directory exists
-  if not exist "%START_DIR%" goto nowolfssl
-
-:configure
-  if "%BUILD_PLATFORM%" == "" set BUILD_PLATFORM=%OS_PLATFORM%
-
-  if "%BUILD_PLATFORM%" == "x86" (
-    set VCVARS_PLATFORM=x86
-  ) else if "%BUILD_PLATFORM%" == "x64" (
-    if "%VC_VER%" == "10.0" set VCVARS_PLATFORM=%BUILD_PLATFORM%
-    if "%VC_VER%" == "11.0" set VCVARS_PLATFORM=amd64
-    if "%VC_VER%" == "12.0" set VCVARS_PLATFORM=amd64
-    if "%VC_VER%" == "14.0" set VCVARS_PLATFORM=amd64
-    if "%VC_VER%" == "14.1" set VCVARS_PLATFORM=amd64
-    if "%VC_VER%" == "14.2" set VCVARS_PLATFORM=amd64
-    if "%VC_VER%" == "14.3" set VCVARS_PLATFORM=amd64
-  )
-
-:start
-  echo.
-  set SAVED_PATH=%CD%
-
-  if "%VC_VER%" == "14.1" (
-    call "%PF%\%VC_PATH%\Auxiliary\Build\vcvarsall" %VCVARS_PLATFORM%
-  ) else if "%VC_VER%" == "14.2" (
-    call "%PF%\%VC_PATH%\Auxiliary\Build\vcvarsall" %VCVARS_PLATFORM%
-  ) else if "%VC_VER%" == "14.3" (
-    call "%PF%\%VC_PATH%\Auxiliary\Build\vcvarsall" %VCVARS_PLATFORM%
-  ) else (
-    call "%PF%\%VC_PATH%\vcvarsall" %VCVARS_PLATFORM%
-  )
-
-  echo.
-  cd /d %SAVED_PATH%
-  if defined START_DIR cd /d %START_DIR%
-  goto %BUILD_PLATFORM%
-
-:x64
-  rem Calculate our output directory
-  set OUTDIR=build\Win64\%VC_DESC%
-  if not exist %OUTDIR% md %OUTDIR%
-
-  if "%BUILD_CONFIG%" == "release" goto x64release
-
-:x64debug
-  rem Perform 64-bit Debug Build
-
-  call :build Debug x64
-  if errorlevel 1 goto error
-
-  call :build "DLL Debug" x64
-  if errorlevel 1 goto error
-
-  if "%BUILD_CONFIG%" == "debug" goto success
-
-:x64release
-  rem Perform 64-bit Release Build
-
-  call :build Release x64
-  if errorlevel 1 goto error
-
-  call :build "DLL Release" x64
-  if errorlevel 1 goto error
-
-  goto success
-
-:x86
-  rem Calculate our output directory
-  set OUTDIR=build\Win32\%VC_DESC%
-  if not exist %OUTDIR% md %OUTDIR%
-
-  if "%BUILD_CONFIG%" == "release" goto x86release
-
-:x86debug
-  rem Perform 32-bit Debug Build
-
-  call :build Debug Win32
-  if errorlevel 1 goto error
-
-  call :build "DLL Debug" Win32
-  if errorlevel 1 goto error
-
-  if "%BUILD_CONFIG%" == "debug" goto success
-
-:x86release
-  rem Perform 32-bit Release Build
-
-  call :build Release Win32
-  if errorlevel 1 goto error
-
-  call :build "DLL Release" Win32
-  if errorlevel 1 goto error
-
-  goto success
-
-:build
-  rem This function builds wolfSSL.
-  rem Usage: CALL :build <configuration> <platform>
-  rem The current directory must be the wolfSSL directory.
-  rem VS Configuration: Debug, Release, DLL Debug or DLL Release.
-  rem VS Platform: Win32 or x64.
-  rem Returns: 1 on fail, 0 on success.
-  rem An informational message should be shown before any return.
-  setlocal
-  set MSBUILD_CONFIG=%~1
-  set MSBUILD_PLATFORM=%~2
-
-  if not exist wolfssl64.sln (
-    echo.
-    echo Error: build: wolfssl64.sln not found in "%CD%"
-    exit /b 1
-  )
-
-  rem OUTDIR isn't a full path, only relative. MSBUILD_OUTDIR must be full and
-  rem not have trailing backslashes, which are handled later.
-  if "%MSBUILD_CONFIG%" == "Debug" (
-    set "MSBUILD_OUTDIR=%CD%\%OUTDIR%\LIB Debug"
-  ) else if "%MSBUILD_CONFIG%" == "Release" (
-    set "MSBUILD_OUTDIR=%CD%\%OUTDIR%\LIB Release"
-  ) else if "%MSBUILD_CONFIG%" == "DLL Debug" (
-    set "MSBUILD_OUTDIR=%CD%\%OUTDIR%\DLL Debug"
-  ) else if "%MSBUILD_CONFIG%" == "DLL Release" (
-    set "MSBUILD_OUTDIR=%CD%\%OUTDIR%\DLL Release"
-  ) else (
-    echo.
-    echo Error: build: Configuration not recognized.
-    exit /b 1
-  )
-
-  if not "%MSBUILD_PLATFORM%" == "Win32" if not "%MSBUILD_PLATFORM%" == "x64" (
-    echo.
-    echo Error: build: Platform not recognized.
-    exit /b 1
-  )
-
-  copy /v /y "%~dp0\wolfssl_options.h" .\cyassl\options.h
-  if %ERRORLEVEL% neq 0 (
-    echo.
-    echo Error: build: Couldn't replace .\cyassl\options.h
-    exit /b 1
-  )
-
-  copy /v /y "%~dp0\wolfssl_options.h" .\wolfssl\options.h
-  if %ERRORLEVEL% neq 0 (
-    echo.
-    echo Error: build: Couldn't replace .\wolfssl\options.h
-    exit /b 1
-  )
-
-  rem Extra trailing \ in Dirs because otherwise it thinks a quote is escaped
-  msbuild wolfssl64.sln ^
-    -p:CustomAfterMicrosoftCommonTargets="%~dp0\wolfssl_override.props" ^
-    -p:Configuration="%MSBUILD_CONFIG%" ^
-    -p:Platform="%MSBUILD_PLATFORM%" ^
-    -p:PlatformToolset="%VC_TOOLSET%" ^
-    -p:OutDir="%MSBUILD_OUTDIR%\\" ^
-    -p:IntDir="%MSBUILD_OUTDIR%\obj\\"
-
-  if %ERRORLEVEL% neq 0 (
-    echo.
-    echo Error: Failed building wolfSSL %MSBUILD_CONFIG%^|%MSBUILD_PLATFORM%.
-    exit /b 1
-  )
-
-  rem For tests to run properly the wolfSSL directory must remain the current.
-  set "PATH=%MSBUILD_OUTDIR%;%PATH%"
-  "%MSBUILD_OUTDIR%\testsuite.exe"
-
-  if %ERRORLEVEL% neq 0 (
-    echo.
-    echo Error: Failed testing wolfSSL %MSBUILD_CONFIG%^|%MSBUILD_PLATFORM%.
-    exit /b 1
-  )
-
-  echo.
-  echo Success: Built and tested wolfSSL %MSBUILD_CONFIG%^|%MSBUILD_PLATFORM%.
-  echo.
-  echo.
-  rem This is necessary to export our local variables back to the caller.
-  endlocal & set SUCCESSFUL_BUILDS="%MSBUILD_CONFIG%|%MSBUILD_PLATFORM%" ^
-    %SUCCESSFUL_BUILDS%
-  exit /b 0
-
-:syntax
-  rem Display the help
-  echo.
-  echo Usage: build-wolfssl ^<compiler^> [platform] [configuration] [directory]
-  echo.
-  echo.
-  echo Compiler:
-  echo.
-  echo vc10      - Use Visual Studio 2010
-  echo vc11      - Use Visual Studio 2012
-  echo vc12      - Use Visual Studio 2013
-  echo vc14      - Use Visual Studio 2015
-  echo vc14.1    - Use Visual Studio 2017
-  echo vc14.2    - Use Visual Studio 2019
-  echo vc14.3    - Use Visual Studio 2022
-  echo.
-  echo.
-  echo Platform:
-  echo.
-  echo x86       - Perform a 32-bit build
-  echo x64       - Perform a 64-bit build
-  echo.
-  echo If this parameter is unset the OS platform is used ^(%OS_PLATFORM%^).
-  echo.
-  echo.
-  echo Configuration:
-  echo.
-  echo debug     - Perform a debug build
-  echo release   - Perform a release build
-  echo.
-  echo If this parameter is unset both configurations are built.
-  echo.
-  echo.
-  echo Other:
-  echo.
-  echo directory - Specifies the wolfSSL source directory
-  echo.
-  echo If this parameter is unset the directory used is "%DEFAULT_START_DIR%".
-  echo.
-  goto error
-
-:unknown
-  echo.
-  echo Error: Unknown argument '%1'
-  goto error
-
-:nodos
-  echo.
-  echo Error: Only a Windows NT based Operating System is supported
-  goto error
-
-:nopf
-  echo.
-  echo Error: Cannot obtain the directory for Program Files
-  goto error
-
-:novc
-  echo.
-  echo Error: %VC_DESC% is not installed
-  goto error
-
-:nox64
-  echo.
-  echo Error: %VC_DESC% does not support 64-bit builds
-  goto error
-
-:nowolfssl
-  echo.
-  echo Error: Cannot locate wolfSSL source directory, expected "%START_DIR%"
-  goto error
-
-:error
-  if "%OS%" == "Windows_NT" endlocal
-  exit /B 1
-
-:success
-  if defined SUCCESSFUL_BUILDS (
-    echo.
-    echo.
-    echo Build complete.
-    echo.
-    echo The following configurations were built and tested successfully:
-    echo.
-    echo %SUCCESSFUL_BUILDS%
-    echo.
-  )
-  cd /d %SAVED_PATH%
-  endlocal
-  exit /B 0
diff --git a/third-party/curl/projects/checksrc.bat b/third-party/curl/projects/checksrc.bat
deleted file mode 100644
index 018dc59605..0000000000
--- a/third-party/curl/projects/checksrc.bat
+++ /dev/null
@@ -1,225 +0,0 @@
-@echo off
-rem ***************************************************************************
-rem *                                  _   _ ____  _
-rem *  Project                     ___| | | |  _ \| |
-rem *                             / __| | | | |_) | |
-rem *                            | (__| |_| |  _ <| |___
-rem *                             \___|\___/|_| \_\_____|
-rem *
-rem * Copyright (C) Steve Holme, <steve_holme@hotmail.com>.
-rem *
-rem * This software is licensed as described in the file COPYING, which
-rem * you should have received as part of this distribution. The terms
-rem * are also available at https://curl.se/docs/copyright.html.
-rem *
-rem * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-rem * copies of the Software, and permit persons to whom the Software is
-rem * furnished to do so, under the terms of the COPYING file.
-rem *
-rem * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-rem * KIND, either express or implied.
-rem *
-rem * SPDX-License-Identifier: curl
-rem *
-rem ***************************************************************************
-
-:begin
-  rem Check we are running on a Windows NT derived OS
-  if not "%OS%" == "Windows_NT" goto nodos
-
-  rem Set our variables
-  setlocal
-  set CHECK_LIB=TRUE
-  set CHECK_SRC=TRUE
-  set CHECK_TESTS=TRUE
-  set CHECK_EXAMPLES=TRUE
-  set SRC_DIR=
-  set CUR_DIR=%cd%
-  set ARG0_DIR=%~dp0
-
-:parseArgs
-  if "%~1" == "" goto prerequisites
-
-  if /i "%~1" == "-?" (
-    goto syntax
-  ) else if /i "%~1" == "-h" (
-    goto syntax
-  ) else if /i "%~1" == "-help" (
-    goto syntax
-  ) else if /i "%~1" == "lib" (
-    set CHECK_LIB=TRUE
-    set CHECK_SRC=FALSE
-    set CHECK_TESTS=FALSE
-    set CHECK_EXAMPLES=FALSE
-  ) else if /i "%~1" == "src" (
-    set CHECK_LIB=FALSE
-    set CHECK_SRC=TRUE
-    set CHECK_TESTS=FALSE
-    set CHECK_EXAMPLES=FALSE
-  ) else if /i "%~1" == "tests" (
-    set CHECK_LIB=FALSE
-    set CHECK_SRC=FALSE
-    set CHECK_TESTS=TRUE
-    set CHECK_EXAMPLES=FALSE
-  ) else if /i "%~1" == "examples" (
-    set CHECK_LIB=FALSE
-    set CHECK_SRC=FALSE
-    set CHECK_TESTS=FALSE
-    set CHECK_EXAMPLES=TRUE
-  ) else (
-    if not defined SRC_DIR (
-      set SRC_DIR=%~1%
-    ) else (
-      goto unknown
-    )
-  )
-
-  shift & goto parseArgs
-
-:prerequisites
-  rem Check we have Perl in our path
-  perl --version <NUL 1>NUL 2>&1
-  if errorlevel 1 (
-    rem It isn't so check we have it installed and set the path if it is
-    if exist "%SystemDrive%\Perl" (
-      set "PATH=%SystemDrive%\Perl\bin;%PATH%"
-    ) else (
-      if exist "%SystemDrive%\Perl64" (
-        set "PATH=%SystemDrive%\Perl64\bin;%PATH%"
-      ) else (
-        goto noperl
-      )
-    )
-  )
-
-:configure
-  if "%SRC_DIR%" == "" (
-    rem Are we being executed from the "projects" or main directory?
-    if "%CUR_DIR%\" == "%ARG0_DIR%" (
-      set SRC_DIR=..
-    ) else if exist projects (
-      if exist docs (
-        if exist lib (
-          if exist src (
-            if exist tests (
-              set SRC_DIR=.
-            )
-          )
-        )
-      )
-    )
-  )
-  if not exist "%SRC_DIR%" goto nosrc
-
-:start
-  if "%CHECK_SRC%" == "TRUE" (
-    rem Check the src directory
-    if exist %SRC_DIR%\src (
-      for /f "delims=" %%i in ('dir "%SRC_DIR%\src\*.c.*" /b 2^>NUL') do @perl "%SRC_DIR%\scripts\checksrc.pl" "-D%SRC_DIR%\src" -Wtool_hugehelp.c "%%i"
-      for /f "delims=" %%i in ('dir "%SRC_DIR%\src\*.h.*" /b 2^>NUL') do @perl "%SRC_DIR%\scripts\checksrc.pl" "-D%SRC_DIR%\src" "%%i"
-    )
-  )
-
-  if "%CHECK_LIB%" == "TRUE" (
-    rem Check the lib directory
-    if exist %SRC_DIR%\lib (
-      for /f "delims=" %%i in ('dir "%SRC_DIR%\lib\*.c.*" /b 2^>NUL') do @perl "%SRC_DIR%\scripts\checksrc.pl" "-D%SRC_DIR%\lib" "%%i"
-      for /f "delims=" %%i in ('dir "%SRC_DIR%\lib\*.h.*" /b 2^>NUL') do @perl "%SRC_DIR%\scripts\checksrc.pl" "-D%SRC_DIR%\lib" -Wcurl_config.h.cmake -Wcurl_config.h.in -Wcurl_config.h "%%i"
-    )
-
-    rem Check the lib\vauth directory
-    if exist %SRC_DIR%\lib\vauth (
-      for /f "delims=" %%i in ('dir "%SRC_DIR%\lib\vauth\*.c.*" /b 2^>NUL') do @perl "%SRC_DIR%\scripts\checksrc.pl" "-D%SRC_DIR%\lib\vauth" "%%i"
-      for /f "delims=" %%i in ('dir "%SRC_DIR%\lib\vauth\*.h.*" /b 2^>NUL') do @perl "%SRC_DIR%\scripts\checksrc.pl" "-D%SRC_DIR%\lib\vauth" "%%i"
-    )
-
-    rem Check the lib\vquic directory
-    if exist %SRC_DIR%\lib\vquic (
-      for /f "delims=" %%i in ('dir "%SRC_DIR%\lib\vquic\*.c.*" /b 2^>NUL') do @perl "%SRC_DIR%\scripts\checksrc.pl" "-D%SRC_DIR%\lib\vquic" "%%i"
-      for /f "delims=" %%i in ('dir "%SRC_DIR%\lib\vquic\*.h.*" /b 2^>NUL') do @perl "%SRC_DIR%\scripts\checksrc.pl" "-D%SRC_DIR%\lib\vquic" "%%i"
-    )
-
-    rem Check the lib\vssh directory
-    if exist %SRC_DIR%\lib\vssh (
-      for /f "delims=" %%i in ('dir "%SRC_DIR%\lib\vssh\*.c.*" /b 2^>NUL') do @perl "%SRC_DIR%\scripts\checksrc.pl" "-D%SRC_DIR%\lib\vssh" "%%i"
-      for /f "delims=" %%i in ('dir "%SRC_DIR%\lib\vssh\*.h.*" /b 2^>NUL') do @perl "%SRC_DIR%\scripts\checksrc.pl" "-D%SRC_DIR%\lib\vssh" "%%i"
-    )
-
-    rem Check the lib\vtls directory
-    if exist %SRC_DIR%\lib\vtls (
-      for /f "delims=" %%i in ('dir "%SRC_DIR%\lib\vtls\*.c.*" /b 2^>NUL') do @perl "%SRC_DIR%\scripts\checksrc.pl" "-D%SRC_DIR%\lib\vtls" "%%i"
-      for /f "delims=" %%i in ('dir "%SRC_DIR%\lib\vtls\*.h.*" /b 2^>NUL') do @perl "%SRC_DIR%\scripts\checksrc.pl" "-D%SRC_DIR%\lib\vtls" "%%i"
-    )
-  )
-
-  if "%CHECK_TESTS%" == "TRUE" (
-    rem Check the tests\libtest directory
-    if exist %SRC_DIR%\tests\libtest (
-      for /f "delims=" %%i in ('dir "%SRC_DIR%\tests\libtest\*.c.*" /b 2^>NUL') do @perl "%SRC_DIR%\scripts\checksrc.pl" "-D%SRC_DIR%\tests\libtest" "%%i"
-      for /f "delims=" %%i in ('dir "%SRC_DIR%\tests\libtest\*.h.*" /b 2^>NUL') do @perl "%SRC_DIR%\scripts\checksrc.pl" "-D%SRC_DIR%\tests\libtest" "%%i"
-    )
-
-    rem Check the tests\unit directory
-    if exist %SRC_DIR%\tests\unit (
-      for /f "delims=" %%i in ('dir "%SRC_DIR%\tests\unit\*.c.*" /b 2^>NUL') do @perl "%SRC_DIR%\scripts\checksrc.pl" "-D%SRC_DIR%\tests\unit" "%%i"
-      for /f "delims=" %%i in ('dir "%SRC_DIR%\tests\unit\*.h.*" /b 2^>NUL') do @perl "%SRC_DIR%\scripts\checksrc.pl" "-D%SRC_DIR%\tests\unit" "%%i"
-    )
-
-    rem Check the tests\server directory
-    if exist %SRC_DIR%\tests\server (
-      for /f "delims=" %%i in ('dir "%SRC_DIR%\tests\server\*.c.*" /b 2^>NUL') do @perl "%SRC_DIR%\scripts\checksrc.pl" "-D%SRC_DIR%\tests\server" "%%i"
-      for /f "delims=" %%i in ('dir "%SRC_DIR%\tests\server\*.h.*" /b 2^>NUL') do @perl "%SRC_DIR%\scripts\checksrc.pl" "-D%SRC_DIR%\tests\server" "%%i"
-    )
-  )
-
-  if "%CHECK_EXAMPLES%" == "TRUE" (
-    rem Check the docs\examples directory
-    if exist %SRC_DIR%\docs\examples (
-      for /f "delims=" %%i in ('dir "%SRC_DIR%\docs\examples\*.c.*" /b 2^>NUL') do @perl "%SRC_DIR%\scripts\checksrc.pl" "-D%SRC_DIR%\docs\examples" -ASNPRINTF "%%i"
-    )
-  )
-
-  goto success
-
-:syntax
-  rem Display the help
-  echo.
-  echo Usage: checksrc [what] [directory]
-  echo.
-  echo What to scan:
-  echo.
-  echo lib       - Scan the libcurl source
-  echo src       - Scan the command-line tool source
-  echo tests     - Scan the library tests and unit tests
-  echo examples  - Scan the examples
-  echo.
-  echo directory - Specifies the curl source directory
-  goto success
-
-:unknown
-  echo.
-  echo Error: Unknown argument '%1'
-  goto error
-
-:nodos
-  echo.
-  echo Error: Only a Windows NT based Operating System is supported
-  goto error
-
-:noperl
-  echo.
-  echo Error: Perl is not installed
-  goto error
-
-:nosrc
-  echo.
-  echo Error: "%SRC_DIR%" does not exist
-  goto error
-
-:error
-  if "%OS%" == "Windows_NT" endlocal
-  exit /B 1
-
-:success
-  endlocal
-  exit /B 0
diff --git a/third-party/curl/projects/generate.bat b/third-party/curl/projects/generate.bat
deleted file mode 100644
index d57d4ebb91..0000000000
--- a/third-party/curl/projects/generate.bat
+++ /dev/null
@@ -1,405 +0,0 @@
-@echo off
-rem ***************************************************************************
-rem *                                  _   _ ____  _
-rem *  Project                     ___| | | |  _ \| |
-rem *                             / __| | | | |_) | |
-rem *                            | (__| |_| |  _ <| |___
-rem *                             \___|\___/|_| \_\_____|
-rem *
-rem * Copyright (C) Steve Holme, <steve_holme@hotmail.com>.
-rem *
-rem * This software is licensed as described in the file COPYING, which
-rem * you should have received as part of this distribution. The terms
-rem * are also available at https://curl.se/docs/copyright.html.
-rem *
-rem * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-rem * copies of the Software, and permit persons to whom the Software is
-rem * furnished to do so, under the terms of the COPYING file.
-rem *
-rem * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-rem * KIND, either express or implied.
-rem *
-rem * SPDX-License-Identifier: curl
-rem *
-rem ***************************************************************************
-
-:begin
-  rem Check we are running on a Windows NT derived OS
-  if not "%OS%" == "Windows_NT" goto nodos
-
-  rem Set our variables
-  setlocal ENABLEEXTENSIONS
-  set VERSION=ALL
-  set MODE=GENERATE
-
-  rem Check we are not running on a network drive
-  if "%~d0."=="\\." goto nonetdrv
-
-  rem Switch to this batch file's directory
-  cd /d "%~0\.." 1>NUL 2>&1
-
-  rem Check we are running from a curl git repository
-  if not exist ..\GIT-INFO goto norepo
-
-:parseArgs
-  if "%~1" == "" goto start
-
-  if /i "%~1" == "pre" (
-    set VERSION=PRE
-  ) else if /i "%~1" == "vc10" (
-    set VERSION=VC10
-  ) else if /i "%~1" == "vc11" (
-    set VERSION=VC11
-  ) else if /i "%~1" == "vc12" (
-    set VERSION=VC12
-  ) else if /i "%~1" == "vc14" (
-    set VERSION=VC14
-  ) else if /i "%~1" == "vc14.10" (
-    set VERSION=VC14.10
-  ) else if /i "%~1" == "vc14.30" (
-    set VERSION=VC14.30
-  ) else if /i "%~1" == "-clean" (
-    set MODE=CLEAN
-  ) else if /i "%~1" == "-?" (
-    goto syntax
-  ) else if /i "%~1" == "-h" (
-    goto syntax
-  ) else if /i "%~1" == "-help" (
-    goto syntax
-  ) else (
-    goto unknown
-  )
-
-  shift & goto parseArgs
-
-:start
-  if exist ..\buildconf.bat (
-    if "%MODE%" == "GENERATE" (
-      call ..\buildconf
-    ) else if "%VERSION%" == "PRE" (
-      call ..\buildconf -clean
-    ) else if "%VERSION%" == "ALL" (
-      call ..\buildconf -clean
-    )
-  )
-  if "%VERSION%" == "PRE" goto success
-  if "%VERSION%" == "VC10" goto vc10
-  if "%VERSION%" == "VC11" goto vc11
-  if "%VERSION%" == "VC12" goto vc12
-  if "%VERSION%" == "VC14" goto vc14
-  if "%VERSION%" == "VC14.10" goto vc14.10
-  if "%VERSION%" == "VC14.30" goto vc14.30
-
-:vc10
-  echo.
-
-  if "%MODE%" == "GENERATE" (
-    echo Generating VC10 project files
-    call :generate vcxproj Windows\VC10\src\curl.tmpl Windows\VC10\src\curl.vcxproj
-    call :generate vcxproj Windows\VC10\lib\libcurl.tmpl Windows\VC10\lib\libcurl.vcxproj
-  ) else (
-    echo Removing VC10 project files
-    call :clean Windows\VC10\src\curl.vcxproj
-    call :clean Windows\VC10\lib\libcurl.vcxproj
-  )
-
-  if not "%VERSION%" == "ALL" goto success
-
-:vc11
-  echo.
-
-  if "%MODE%" == "GENERATE" (
-    echo Generating VC11 project files
-    call :generate vcxproj Windows\VC11\src\curl.tmpl Windows\VC11\src\curl.vcxproj
-    call :generate vcxproj Windows\VC11\lib\libcurl.tmpl Windows\VC11\lib\libcurl.vcxproj
-  ) else (
-    echo Removing VC11 project files
-    call :clean Windows\VC11\src\curl.vcxproj
-    call :clean Windows\VC11\lib\libcurl.vcxproj
-  )
-
-  if not "%VERSION%" == "ALL" goto success
-
-:vc12
-  echo.
-
-  if "%MODE%" == "GENERATE" (
-    echo Generating VC12 project files
-    call :generate vcxproj Windows\VC12\src\curl.tmpl Windows\VC12\src\curl.vcxproj
-    call :generate vcxproj Windows\VC12\lib\libcurl.tmpl Windows\VC12\lib\libcurl.vcxproj
-  ) else (
-    echo Removing VC12 project files
-    call :clean Windows\VC12\src\curl.vcxproj
-    call :clean Windows\VC12\lib\libcurl.vcxproj
-  )
-
-  if not "%VERSION%" == "ALL" goto success
-
-:vc14
-  echo.
-
-  if "%MODE%" == "GENERATE" (
-    echo Generating VC14 project files
-    call :generate vcxproj Windows\VC14\src\curl.tmpl Windows\VC14\src\curl.vcxproj
-    call :generate vcxproj Windows\VC14\lib\libcurl.tmpl Windows\VC14\lib\libcurl.vcxproj
-  ) else (
-    echo Removing VC14 project files
-    call :clean Windows\VC14\src\curl.vcxproj
-    call :clean Windows\VC14\lib\libcurl.vcxproj
-  )
-
-  if not "%VERSION%" == "ALL" goto success
-
-:vc14.10
-  echo.
-
-  if "%MODE%" == "GENERATE" (
-    echo Generating VC14.10 project files
-    call :generate vcxproj Windows\VC14.10\src\curl.tmpl Windows\VC14.10\src\curl.vcxproj
-    call :generate vcxproj Windows\VC14.10\lib\libcurl.tmpl Windows\VC14.10\lib\libcurl.vcxproj
-  ) else (
-    echo Removing VC14.10 project files
-    call :clean Windows\VC14.10\src\curl.vcxproj
-    call :clean Windows\VC14.10\lib\libcurl.vcxproj
-  )
-
-  if not "%VERSION%" == "ALL" goto success
-
-:vc14.30
-  echo.
-
-  if "%MODE%" == "GENERATE" (
-    echo Generating VC14.30 project files
-    call :generate vcxproj Windows\VC14.30\src\curl.tmpl Windows\VC14.30\src\curl.vcxproj
-    call :generate vcxproj Windows\VC14.30\lib\libcurl.tmpl Windows\VC14.30\lib\libcurl.vcxproj
-  ) else (
-    echo Removing VC14.30 project files
-    call :clean Windows\VC14.30\src\curl.vcxproj
-    call :clean Windows\VC14.30\lib\libcurl.vcxproj
-  )
-
-  goto success
-
-rem Main generate function.
-rem
-rem %1 - Project Type (vcxproj for VC10, VC11, VC12, VC14, VC14.10 and VC14.30)
-rem %2 - Input template file
-rem %3 - Output project file
-rem
-:generate
-  if not exist %2 (
-    echo.
-    echo Error: Cannot open %2
-    exit /B
-  )
-
-  if exist %3 (
-    del %3
-  )
-
-  echo * %CD%\%3
-  for /f "usebackq delims=" %%i in (`"findstr /n ^^ %2"`) do (
-    set "var=%%i"
-    setlocal enabledelayedexpansion
-    set "var=!var:*:=!"
-
-    if "!var!" == "CURL_SRC_C_FILES" (
-      for /f "delims=" %%c in ('dir /b ..\src\*.c') do call :element %1 src "%%c" %3
-    ) else if "!var!" == "CURL_SRC_H_FILES" (
-      for /f "delims=" %%h in ('dir /b ..\src\*.h') do call :element %1 src "%%h" %3
-    ) else if "!var!" == "CURL_SRC_RC_FILES" (
-      for /f "delims=" %%r in ('dir /b ..\src\*.rc') do call :element %1 src "%%r" %3
-    ) else if "!var!" == "CURL_SRC_X_C_FILES" (
-      call :element %1 lib "strtoofft.c" %3
-      call :element %1 lib "timediff.c" %3
-      call :element %1 lib "nonblock.c" %3
-      call :element %1 lib "warnless.c" %3
-      call :element %1 lib "curl_multibyte.c" %3
-      call :element %1 lib "version_win32.c" %3
-      call :element %1 lib "dynbuf.c" %3
-      call :element %1 lib "base64.c" %3
-    ) else if "!var!" == "CURL_SRC_X_H_FILES" (
-      call :element %1 lib "config-win32.h" %3
-      call :element %1 lib "curl_setup.h" %3
-      call :element %1 lib "strtoofft.h" %3
-      call :element %1 lib "timediff.h" %3
-      call :element %1 lib "nonblock.h" %3
-      call :element %1 lib "warnless.h" %3
-      call :element %1 lib "curl_ctype.h" %3
-      call :element %1 lib "curl_multibyte.h" %3
-      call :element %1 lib "version_win32.h" %3
-      call :element %1 lib "dynbuf.h" %3
-      call :element %1 lib "curl_base64.h" %3
-    ) else if "!var!" == "CURL_LIB_C_FILES" (
-      for /f "delims=" %%c in ('dir /b ..\lib\*.c') do call :element %1 lib "%%c" %3
-    ) else if "!var!" == "CURL_LIB_H_FILES" (
-      for /f "delims=" %%h in ('dir /b ..\include\curl\*.h') do call :element %1 include\curl "%%h" %3
-      for /f "delims=" %%h in ('dir /b ..\lib\*.h') do call :element %1 lib "%%h" %3
-    ) else if "!var!" == "CURL_LIB_RC_FILES" (
-      for /f "delims=" %%r in ('dir /b ..\lib\*.rc') do call :element %1 lib "%%r" %3
-    ) else if "!var!" == "CURL_LIB_VAUTH_C_FILES" (
-      for /f "delims=" %%c in ('dir /b ..\lib\vauth\*.c') do call :element %1 lib\vauth "%%c" %3
-    ) else if "!var!" == "CURL_LIB_VAUTH_H_FILES" (
-      for /f "delims=" %%h in ('dir /b ..\lib\vauth\*.h') do call :element %1 lib\vauth "%%h" %3
-    ) else if "!var!" == "CURL_LIB_VQUIC_C_FILES" (
-      for /f "delims=" %%c in ('dir /b ..\lib\vquic\*.c') do call :element %1 lib\vquic "%%c" %3
-    ) else if "!var!" == "CURL_LIB_VQUIC_H_FILES" (
-      for /f "delims=" %%h in ('dir /b ..\lib\vquic\*.h') do call :element %1 lib\vquic "%%h" %3
-    ) else if "!var!" == "CURL_LIB_VSSH_C_FILES" (
-      for /f "delims=" %%c in ('dir /b ..\lib\vssh\*.c') do call :element %1 lib\vssh "%%c" %3
-    ) else if "!var!" == "CURL_LIB_VSSH_H_FILES" (
-      for /f "delims=" %%h in ('dir /b ..\lib\vssh\*.h') do call :element %1 lib\vssh "%%h" %3
-    ) else if "!var!" == "CURL_LIB_VTLS_C_FILES" (
-      for /f "delims=" %%c in ('dir /b ..\lib\vtls\*.c') do call :element %1 lib\vtls "%%c" %3
-    ) else if "!var!" == "CURL_LIB_VTLS_H_FILES" (
-      for /f "delims=" %%h in ('dir /b ..\lib\vtls\*.h') do call :element %1 lib\vtls "%%h" %3
-    ) else (
-      echo.!var!>> %3
-    )
-
-    endlocal
-  )
-  exit /B
-
-rem Generates a single file xml element.
-rem
-rem %1 - Project Type (vcxproj for VC10, VC11, VC12, VC14, VC14.10 and VC14.30)
-rem %2 - Directory (src, lib, lib\vauth, lib\vquic, lib\vssh, lib\vtls)
-rem %3 - Source filename
-rem %4 - Output project file
-rem
-:element
-  set "SPACES=    "
-  if "%2" == "lib\vauth" (
-    set "TABS=				"
-  ) else if "%2" == "lib\vquic" (
-    set "TABS=				"
-  ) else if "%2" == "lib\vssh" (
-    set "TABS=				"
-  ) else if "%2" == "lib\vtls" (
-    set "TABS=				"
-  ) else (
-    set "TABS=			"
-  )
-
-  call :extension %3 ext
-
-  if "%1" == "dsp" (
-    echo # Begin Source File>> %4
-    echo.>> %4
-    echo SOURCE=..\..\..\..\%2\%~3>> %4
-    echo # End Source File>> %4
-  ) else if "%1" == "vcproj1" (
-    echo %TABS%^<File>> %4
-    echo %TABS%	RelativePath="..\..\..\..\%2\%~3"^>>> %4
-    echo %TABS%^</File^>>> %4
-  ) else if "%1" == "vcproj2" (
-    echo %TABS%^<File>> %4
-    echo %TABS%	RelativePath="..\..\..\..\%2\%~3">> %4
-    echo %TABS%^>>> %4
-    echo %TABS%^</File^>>> %4
-  ) else if "%1" == "vcxproj" (
-    if "%ext%" == "c" (
-      echo %SPACES%^<ClCompile Include=^"..\..\..\..\%2\%~3^" /^>>> %4
-    ) else if "%ext%" == "h" (
-      echo %SPACES%^<ClInclude Include=^"..\..\..\..\%2\%~3^" /^>>> %4
-    ) else if "%ext%" == "rc" (
-      echo %SPACES%^<ResourceCompile Include=^"..\..\..\..\%2\%~3^" /^>>> %4
-    )
-  )
-
-  exit /B
-
-rem Returns the extension for a given filename.
-rem
-rem %1 - The filename
-rem %2 - The return value
-rem
-:extension
-  set fname=%~1
-  set ename=
-:loop1
-  if "%fname%"=="" (
-    set %2=
-    exit /B
-  )
-
-  if not "%fname:~-1%"=="." (
-    set ename=%fname:~-1%%ename%
-    set fname=%fname:~0,-1%
-    goto loop1
-  )
-
-  set %2=%ename%
-  exit /B
-
-rem Removes the given project file.
-rem
-rem %1 - The filename
-rem
-:clean
-  echo * %CD%\%1
-
-  if exist %1 (
-    del %1
-  )
-
-  exit /B
-
-:syntax
-  rem Display the help
-  echo.
-  echo Usage: generate [what] [-clean]
-  echo.
-  echo What to generate:
-  echo.
-  echo pre       - Prerequisites only
-  echo vc10      - Use Visual Studio 2010
-  echo vc11      - Use Visual Studio 2012
-  echo vc12      - Use Visual Studio 2013
-  echo vc14      - Use Visual Studio 2015
-  echo vc14.10   - Use Visual Studio 2017
-  echo vc14.30   - Use Visual Studio 2022
-  echo.
-  echo -clean    - Removes the project files
-  goto error
-
-:unknown
-  echo.
-  echo Error: Unknown argument '%1'
-  goto error
-
-:nodos
-  echo.
-  echo Error: Only a Windows NT based Operating System is supported
-  goto error
-
-:nonetdrv
-  echo.
-  echo Error: This batch file cannot run from a network drive
-  goto error
-
-:norepo
-  echo.
-  echo Error: This batch file should only be used from a curl git repository
-  goto error
-
-:seterr
-  rem Set the caller's errorlevel.
-  rem %1[opt]: Errorlevel as integer.
-  rem If %1 is empty the errorlevel will be set to 0.
-  rem If %1 is not empty and not an integer the errorlevel will be set to 1.
-  setlocal
-  set EXITCODE=%~1
-  if not defined EXITCODE set EXITCODE=0
-  echo %EXITCODE%|findstr /r "[^0-9\-]" 1>NUL 2>&1
-  if %ERRORLEVEL% EQU 0 set EXITCODE=1
-  exit /b %EXITCODE%
-
-:error
-  if "%OS%" == "Windows_NT" endlocal
-  exit /B 1
-
-:success
-  endlocal
-  exit /B 0
diff --git a/third-party/curl/projects/vms/Makefile.am b/third-party/curl/projects/vms/Makefile.am
new file mode 100644
index 0000000000..0a061bf20b
--- /dev/null
+++ b/third-party/curl/projects/vms/Makefile.am
@@ -0,0 +1,59 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+EXTRA_DIST = \
+  backup_gnv_curl_src.com \
+  build_curl-config_script.com \
+  build_gnv_curl.com \
+  build_gnv_curl_pcsi_desc.com \
+  build_gnv_curl_pcsi_text.com \
+  build_gnv_curl_release_notes.com \
+  build_libcurl_pc.com \
+  build_vms.com \
+  clean_gnv_curl.com \
+  compare_curl_source.com \
+  config_h.com \
+  curl_crtl_init.c \
+  curl_gnv_build_steps.txt \
+  curl_release_note_start.txt \
+  curl_startup.com \
+  curlmsg.h \
+  curlmsg.msg \
+  curlmsg.sdl \
+  curlmsg_vms.h \
+  generate_config_vms_h_curl.com \
+  generate_vax_transfer.com \
+  gnv_conftest.c_first \
+  gnv_curl_configure.sh \
+  gnv_libcurl_symbols.opt \
+  gnv_link_curl.com \
+  macro32_exactcase.patch \
+  make_gnv_curl_install.sh \
+  make_pcsi_curl_kit_name.com \
+  pcsi_gnv_curl_file_list.txt \
+  pcsi_product_gnv_curl.com \
+  readme \
+  report_openssl_version.c \
+  setup_gnv_curl_build.com \
+  stage_curl_install.com \
+  vms_eco_level.h
diff --git a/third-party/curl/packages/vms/backup_gnv_curl_src.com b/third-party/curl/projects/vms/backup_gnv_curl_src.com
similarity index 100%
rename from third-party/curl/packages/vms/backup_gnv_curl_src.com
rename to third-party/curl/projects/vms/backup_gnv_curl_src.com
diff --git a/third-party/curl/packages/vms/build_curl-config_script.com b/third-party/curl/projects/vms/build_curl-config_script.com
similarity index 98%
rename from third-party/curl/packages/vms/build_curl-config_script.com
rename to third-party/curl/projects/vms/build_curl-config_script.com
index 1667d0745c..1902b0c215 100644
--- a/third-party/curl/packages/vms/build_curl-config_script.com
+++ b/third-party/curl/projects/vms/build_curl-config_script.com
@@ -120,7 +120,7 @@ $   i = 0
 $   line_out = ""
 $sub_loop:
 $       ! Replace between pairs of @ by alternating the elements.
-$       ! If mis-matched pairs, do not substitute anything.
+$       ! If mismatched pairs, do not substitute anything.
 $       section1 = f$element(i, "@", line_in)
 $       if section1 .eqs. "@"
 $       then
diff --git a/third-party/curl/packages/vms/build_gnv_curl.com b/third-party/curl/projects/vms/build_gnv_curl.com
similarity index 100%
rename from third-party/curl/packages/vms/build_gnv_curl.com
rename to third-party/curl/projects/vms/build_gnv_curl.com
diff --git a/third-party/curl/packages/vms/build_gnv_curl_pcsi_desc.com b/third-party/curl/projects/vms/build_gnv_curl_pcsi_desc.com
similarity index 99%
rename from third-party/curl/packages/vms/build_gnv_curl_pcsi_desc.com
rename to third-party/curl/projects/vms/build_gnv_curl_pcsi_desc.com
index 85674261ce..7726b4aa9f 100644
--- a/third-party/curl/packages/vms/build_gnv_curl_pcsi_desc.com
+++ b/third-party/curl/projects/vms/build_gnv_curl_pcsi_desc.com
@@ -22,7 +22,7 @@ $!
 $! The PCSI system can really only handle ODS-2 format filenames and
 $! assumes that there is only one source directory.  It also assumes that
 $! all destination files with the same name come from the same source file.
-$! Fortunately CURL does not trip most of these issues, so those steps
+$! Fortunately curl does not trip most of these issues, so those steps
 $! above are marked N/A.
 $!
 $! A rename action section is needed to make sure that the files are
@@ -134,7 +134,7 @@ $ write pdsc "   end if;"
 $!
 $write pdsc "   software VMSPORTS ''base' ZLIB ;"
 $write pdsc -
-    "   if (not <software VMSPORTS ''base' ZLIB version minimum V1.2-8>) ;"
+    "   if (not <software VMSPORTS ''base' ZLIB version minimum v1.2-8>) ;"
 $write pdsc "      error NEED_ZLIB;"
 $write pdsc "   end if;"
 $!
@@ -425,7 +425,7 @@ $           destname = "[gnv.beta" + destname - "[gnv.usr"
 $       endif
 $   endif
 $!
-$!  It should be just a directory then.
+$!  It should be a directory then.
 $!-------------------------------------
 $   filedir = f$edit(f$parse(filename,,,"DIRECTORY"), "lowercase")
 $!  If this is not a directory then start processing files.
diff --git a/third-party/curl/packages/vms/build_gnv_curl_pcsi_text.com b/third-party/curl/projects/vms/build_gnv_curl_pcsi_text.com
similarity index 97%
rename from third-party/curl/packages/vms/build_gnv_curl_pcsi_text.com
rename to third-party/curl/projects/vms/build_gnv_curl_pcsi_text.com
index 8f109c1e7e..b67ad8f187 100644
--- a/third-party/curl/packages/vms/build_gnv_curl_pcsi_text.com
+++ b/third-party/curl/projects/vms/build_gnv_curl_pcsi_text.com
@@ -2,9 +2,9 @@ $! File: Build_GNV_curl_pcsi_text.com
 $!
 $! Build the *.pcsi$text file from the four components:
 $!    1. Generated =product header section
-$!    2. [--]readme. file from the Curl distribution, modified to fit
+$!    2. [--]readme. file from the curl distribution, modified to fit
 $!       a pcsi$text file format.
-$!    3. [--]copying file from the Curl distribution, modified to fit
+$!    3. [--]copying file from the curl distribution, modified to fit
 $!       a pcsi$text file format.
 $!    4. Generated Producer section.
 $!
diff --git a/third-party/curl/packages/vms/build_gnv_curl_release_notes.com b/third-party/curl/projects/vms/build_gnv_curl_release_notes.com
similarity index 90%
rename from third-party/curl/packages/vms/build_gnv_curl_release_notes.com
rename to third-party/curl/projects/vms/build_gnv_curl_release_notes.com
index 0da94454d5..89b30ecbe9 100644
--- a/third-party/curl/packages/vms/build_gnv_curl_release_notes.com
+++ b/third-party/curl/projects/vms/build_gnv_curl_release_notes.com
@@ -3,7 +3,7 @@ $!
 $! Build the release note file from the four components:
 $!    1. The curl_release_note_start.txt
 $!    2. The hp_ssl_release_info.txt
-$!    3. [--]readme. file from the Curl distribution.
+$!    3. [--]readme. file from the curl distribution.
 $!    4. The Curl_gnv-build_steps.txt.
 $!
 $! Set the name of the release notes from the GNV_PCSI_FILENAME_BASE
@@ -42,7 +42,7 @@ $   curl_readme = f$search("sys$disk:[--]$README.")
 $ endif
 $ if curl_readme .eqs. ""
 $ then
-$    write sys$output "Can not find Curl readme file."
+$    write sys$output "Can not find curl readme file."
 $    goto all_exit
 $ endif
 $!
@@ -53,7 +53,7 @@ $   curl_copying = f$search("sys$disk:[--]$COPYING.")
 $ endif
 $ if curl_copying .eqs. ""
 $ then
-$    write sys$output "Can not find Curl copying file."
+$    write sys$output "Can not find curl copying file."
 $    goto all_exit
 $ endif
 $!
@@ -64,7 +64,7 @@ $   vms_readme = f$search("sys$disk:[]$README.")
 $ endif
 $ if vms_readme .eqs. ""
 $ then
-$   write sys$output "Can not find VMS specific Curl readme file."
+$   write sys$output "Can not find VMS specific curl readme file."
 $   goto all_exit
 $ endif
 $!
@@ -75,7 +75,7 @@ $   curl_release_notes = f$search("sys$disk:[--]$RELEASE-NOTES.")
 $ endif
 $ if curl_release_notes .eqs. ""
 $ then
-$    write sys$output "Can not find Curl release-notes file."
+$    write sys$output "Can not find curl release-notes file."
 $    goto all_exit
 $ endif
 $!
diff --git a/third-party/curl/packages/vms/build_libcurl_pc.com b/third-party/curl/projects/vms/build_libcurl_pc.com
similarity index 97%
rename from third-party/curl/packages/vms/build_libcurl_pc.com
rename to third-party/curl/projects/vms/build_libcurl_pc.com
index 294ae084f4..de7db26958 100644
--- a/third-party/curl/packages/vms/build_libcurl_pc.com
+++ b/third-party/curl/projects/vms/build_libcurl_pc.com
@@ -178,7 +178,7 @@ $ then
 $    write pco "Version: ''curl_version'"
 $    goto pc_file_loop
 $ endif
-$ if f$locate("@LIBCURL_LIBS@", line_in) .lt line_in_len
+$ if f$locate("@LIBCURL_PC_LIBS_PRIVATE@", line_in) .lt line_in_len
 $ then
 $    if arch_name .eqs. "VAX"
 $    then
@@ -188,7 +188,7 @@ $        write pco "Libs.private: -lssl -lcrypto -lgssapi -lz"
 $    endif
 $    goto pc_file_loop
 $ endif
-$ if f$locate("@CPPFLAG_CURL_STATICLIB@", line_in) .lt line_in_len
+$ if f$locate("@LIBCURL_PC_CFLAGS@", line_in) .lt line_in_len
 $ then
 $    write pco "Cflags: -I${includedir} -DCURL_STATICLIB"
 $    goto pc_file_loop
diff --git a/third-party/curl/packages/vms/build_vms.com b/third-party/curl/projects/vms/build_vms.com
similarity index 96%
rename from third-party/curl/packages/vms/build_vms.com
rename to third-party/curl/projects/vms/build_vms.com
index 1b023649f4..d79fdb5940 100644
--- a/third-party/curl/packages/vms/build_vms.com
+++ b/third-party/curl/projects/vms/build_vms.com
@@ -1,6 +1,6 @@
 $! BUILD_VMS.COM
 $!
-$! I've taken the original build_vms.com, supplied by Nico Baggus, if
+$! I have taken the original build_vms.com, supplied by Nico Baggus, if
 $! memory serves me correctly, and made some modifications.
 $!
 $! SSL support is controlled by logical names.  If SSL$INCLUDE is
@@ -20,10 +20,10 @@ $!
 $!    64        Compile with 64-bit pointers.
 $!              Note, you must match the pointer size that the OpenSSL
 $!              shared image expects.
-$!              Currently curl is not building properly with 64 bit pointers
-$!              on VMS because it is trying to cast pointers to 32 bit
+$!              Currently curl is not building properly with 64-bit pointers
+$!              on VMS because it is trying to cast pointers to 32-bit
 $!              integers and some OpenVMS library routines called by curl
-$!              do not yet support 64 bit pointers.
+$!              do not yet support 64-bit pointers.
 $!    CCQUAL=x  Add "x" to the C compiler qualifiers.
 $!              Default qualifiers are:
 $!                  /standard=relaxed
@@ -38,21 +38,21 @@ $!              Always link a debug image.
 $!    NOIEEE    Do not use IEEE floating point.  (Alpha/I64)
 $!              VAX must always use DFLOAT
 $!    NOLARGE   Disable large-file support if large file support available.
-$!              (Non-VAX, VMS >= V7.2.)
+$!              (Non-VAX, VMS >= v7.2.)
 $!    NOLDAP    Disable LDAP support if LDAP is available.
 $!    NOKERBEROS   Disable Kerberos support if Kerberos is available.
 $!    LIST      Create C compiler listings and linker maps.
 $!                 /list/show=(expan,includ)/machine
 $!    FULLLIST  Full detailed listing.
 $!                 /list/show=(all, nomessages)/machine
-$!    NOHPSSL   Don't use HP SSL, even if available.
+$!    NOHPSSL   Do not use HP SSL, even if available.
 $!              Note, you must match the pointer size that the OpenSSL
 $!              shared image expects.  This procedure will select the
 $!              correct HP OpenSSL image.
-$!    NOSSL     Don't use any SSL, even if available.
+$!    NOSSL     Do not use any SSL, even if available.
 $!    OSSLOLB   Use OpenSSL object libraries (.OLB), even if shared
 $!              images (.EXE) are available.
-$!    NOZLIB    Don't use GNV$ZLIB shared image even if available.
+$!    NOZLIB    Do not use GNV$ZLIB shared image even if available.
 $!    REALCLEAN Delete product files for all host architectures.  (No
 $!              build done.)  Alias for CLEAN_ALL
 $!
@@ -65,7 +65,7 @@ $! Revisions:
 $!
 $!  2-DEC-2003, MSK, the "original" version.
 $!                   It works for me.  Your mileage may vary.
-$! 13-JAN-2004, MSK, moved this procedure to the [.packages.vms] directory
+$! 13-JAN-2004, MSK, moved this procedure to the [.projects.vms] directory
 $!                   and updated it to do hardware dependent builds.
 $! 29-JAN-2004, MSK, moved logical defines into defines.com
 $!  6-FEB-2004, MSK, put in various SSL support bits
@@ -516,7 +516,7 @@ $ endif
 $!
 $!
 $! CC /LIST, LINK /MAP, and MESSAGE /LIST are defaults in batch mode,
-$! so be explicit when they're not desired.
+$! so be explicit when they are not desired.
 $!
 $
 $ if list .eq. 0
@@ -638,21 +638,21 @@ $ libzshr_line = ""
 $ try_shr = "gnv$libzshr"
 $ if build_64
 $ then
-$!  First look for 64 bit
+$!  First look for 64-bit
 $   if f$search("''try_shr'64") .eqs. ""
 $   then
-$!      Second look for the J.F. Pieronne 64 bit shared image
+$!      Second look for the J.F. Pieronne 64-bit shared image
 $       try_shr = "LIBZ_SHR64"
 $       if f$search(try_shr) .eqs. "" then nozlib = 1
 $   endif
 $ else
-$!  First look for 32 bit
+$!  First look for 32-bit
 $   if f$search("''try_shr'32") .eqs. ""
 $   then
-$!      Second look for old 32 bit image
+$!      Second look for old 32-bit image
 $       if f$search(try_shr) .eqs. ""
 $       then
-$!          Third look for the J.F. Pieronne 32 bit shared image
+$!          Third look for the J.F. Pieronne 32-bit shared image
 $           try_shr = "LIBZ_SHR32"
 $           if f$search(try_shr) .eqs. "" then nozlib = 1
 $       endif
@@ -723,7 +723,7 @@ $   endif
 $   'vo_c' "   SSLLIB = ''ssllib'"
 $!
 $! TODO: Why are we translating the logical name?
-$! The logical aname used to find the shared image should just be used
+$! The logical aname used to find the shared image should be used
 $! as translating it could result in the wrong location at run time.
 $   if (openssl .eq. 1)
 $   then
@@ -744,7 +744,7 @@ $   endif
 $   if ((f$search(ossl_lib1) .eqs. "") .or. -
         (f$search(ossl_lib2) .eqs. ""))
 $   then
-$       write sys$output "Can't find OpenSSL ''msg':"
+$       write sys$output "Cannot find OpenSSL ''msg':"
 $       write sys$output "   ''ossl_lib1'"
 $       write sys$output "   ''ossl_lib2'"
 $       goto Common_Exit
@@ -820,17 +820,17 @@ $ then
 $   sys_inc = sys_inc + ",''curl_sys_zlibinc'"
 $ endif
 $! Build LIB
-$ cc_include = "/include=([-.lib],[-.lib.vtls],[-.packages.vms]"
-$ cc_include = cc_include + ",[-.packages.vms.''arch_name'])"
+$ cc_include = "/include=([-.lib],[-.lib.vtls],[-.projects.vms]"
+$ cc_include = cc_include + ",[-.projects.vms.''arch_name'])"
 $ call build "[--.lib]" "*.c" "''objdir'CURLLIB.OLB" "amigaos, nwlib, nwos"
 $ if ($status .eq. ctrl_y) then goto Common_Exit
 $! Build VTLS
 $ cc_include = "/include=([--.lib.vtls],[--.lib],[--.src]"
-$ cc_include = cc_include + ",[--.packages.vms],[--.packages.vms.''arch_name'])"
+$ cc_include = cc_include + ",[--.projects.vms],[--.projects.vms.''arch_name'])"
 $ call build "[--.lib.vtls]" "*.c" "''objdir'CURLLIB.OLB" "amigaos, nwlib, nwos"
 $! Build SRC
 $ cc_include = "/include=([-.src],[-.lib],[-.lib.vtls]"
-$ cc_include = cc_include + ",[-.packages.vms],[-.packages.vms.''arch_name'])"
+$ cc_include = cc_include + ",[-.projects.vms],[-.projects.vms.''arch_name'])"
 $ call build "[--.src]" "*.c" "''objdir'CURLSRC.OLB"
 $ if ($status .eq. ctrl_y) then goto Common_Exit
 $! Build MSG
@@ -943,7 +943,7 @@ $   reset = f$search( "reset", 1)
 $Loop:
 $   file = f$search( search, 1)
 $   if file .eqs. "" then goto EndLoop
-$!  Skip a name if it's in the P4 exclusion list.
+$!  Skip a name if it is in the P4 exclusion list.
 $   if (p4 .nes. "")
 $   then
 $       name__ = "," + -
@@ -1016,7 +1016,7 @@ $   endif
 $ ENDSUBROUTINE   ! Compile
 $!
 $! Do a diff of the file specified in P1 with that in P2.  If different
-$! copy P1 to P2.  This also covers if P2 doesn't exist, but not if P2
+$! copy P1 to P2.  This also covers if P2 does not exist, but not if P2
 $! is an invalid filespec.
 $!
 $MoveIfDiff:  subroutine
diff --git a/third-party/curl/packages/vms/clean_gnv_curl.com b/third-party/curl/projects/vms/clean_gnv_curl.com
similarity index 88%
rename from third-party/curl/packages/vms/clean_gnv_curl.com
rename to third-party/curl/projects/vms/clean_gnv_curl.com
index 198c0debfd..ab515ede6a 100644
--- a/third-party/curl/packages/vms/clean_gnv_curl.com
+++ b/third-party/curl/projects/vms/clean_gnv_curl.com
@@ -103,34 +103,34 @@ $!
 $ file = "lcl_root:[...]*.lai"
 $ if f$search(file) .nes. "" then delete 'file';*
 $!
-$ file = "lcl_root:[.packages.vms]curl-*_original_src.bck"
+$ file = "lcl_root:[.projects.vms]curl-*_original_src.bck"
 $ if f$search(file) .nes. "" then delete 'file';*
 $!
-$ file = "lcl_root:[.packages.vms]curl_d-*_original_src.bck"
+$ file = "lcl_root:[.projects.vms]curl_d-*_original_src.bck"
 $ if f$search(file) .nes. "" then delete 'file';*
 $!
-$ file = "lcl_root:[.packages.vms]curl-*_vms_src.bck"
+$ file = "lcl_root:[.projects.vms]curl-*_vms_src.bck"
 $ if f$search(file) .nes. "" then delete 'file';*
 $!
-$ file = "lcl_root:[.packages.vms]curl_d-*_vms_src.bck"
+$ file = "lcl_root:[.projects.vms]curl_d-*_vms_src.bck"
 $ if f$search(file) .nes. "" then delete 'file';*
 $!
-$ file = "lcl_root:[.packages.vms]curl-*.release_notes"
+$ file = "lcl_root:[.projects.vms]curl-*.release_notes"
 $ if f$search(file) .nes. "" then delete 'file';*
 $!
-$ file = "lcl_root:[.packages.vms]curl_d-*.release_notes"
+$ file = "lcl_root:[.projects.vms]curl_d-*.release_notes"
 $ if f$search(file) .nes. "" then delete 'file';*
 $!
-$ file = "lcl_root:[.packages.vms]*-curl-*.pcsi$desc"
+$ file = "lcl_root:[.projects.vms]*-curl-*.pcsi$desc"
 $ if f$search(file) .nes. "" then delete 'file';*
 $!
-$ file = "lcl_root:[.packages.vms]*-curl_d-*.pcsi$desc"
+$ file = "lcl_root:[.projects.vms]*-curl_d-*.pcsi$desc"
 $ if f$search(file) .nes. "" then delete 'file';*
 $!
-$ file = "lcl_root:[.packages.vms]*-curl-*.pcsi$text"
+$ file = "lcl_root:[.projects.vms]*-curl-*.pcsi$text"
 $ if f$search(file) .nes. "" then delete 'file';*
 $!
-$ file = "lcl_root:[.packages.vms]*-curl_d-*.pcsi$text"
+$ file = "lcl_root:[.projects.vms]*-curl_d-*.pcsi$text"
 $ if f$search(file) .nes. "" then delete 'file';*
 $!
 $!======================================================================
@@ -179,9 +179,6 @@ $!
 $ file = "lcl_root:[.lib]libcurl.vers"
 $ if f$search(file) .nes. "" then delete 'file';*
 $!
-$ file = "lcl_root:[.lib]libcurl.plist"
-$ if f$search(file) .nes. "" then delete 'file';*
-$!
 $ file = "lcl_root:[]ca-bundle.h"
 $ if f$search(file) .nes. "" then delete 'file';*
 $!
@@ -221,13 +218,13 @@ $!
 $ file = "lcl_root:[...]gnv*.opt"
 $ if f$search(file) .nes. "" then delete 'file';*
 $!
-$ file = "lcl_root:[.packages.vms]macro32_exactcase.exe"
+$ file = "lcl_root:[.projects.vms]macro32_exactcase.exe"
 $ if f$search(file) .nes. "" then delete 'file';*
 $!
-$ file = "lcl_root:[.packages.vms]report_openssl_version.exe"
+$ file = "lcl_root:[.projects.vms]report_openssl_version.exe"
 $ if f$search(file) .nes. "" then delete 'file';*
 $!
-$ file = "lcl_root:[.packages.vms]hp_ssl_release_info.txt"
+$ file = "lcl_root:[.projects.vms]hp_ssl_release_info.txt"
 $ if f$search(file) .nes. "" then delete 'file';*
 $!
 $ file = "lcl_root:[.src]curl.exe"
diff --git a/third-party/curl/packages/vms/compare_curl_source.com b/third-party/curl/projects/vms/compare_curl_source.com
similarity index 98%
rename from third-party/curl/packages/vms/compare_curl_source.com
rename to third-party/curl/projects/vms/compare_curl_source.com
index 3f7542de0e..b63080620e 100644
--- a/third-party/curl/packages/vms/compare_curl_source.com
+++ b/third-party/curl/projects/vms/compare_curl_source.com
@@ -17,9 +17,9 @@ $!
 $! First the files in the original source directory which is assumed to be
 $! under source code control are compared with the copy directory.
 $!
-$! Then the files are are only in the copy directory are listed.
+$! Only files present in the copy directory are listed.
 $!
-$! The result will five diagnostics about of files:
+$! Diagnostics are displayed about the files:
 $!    1. Files that are not generation 1.
 $!    2. Files missing in the copy directory.
 $!    3. Files in the copy directory not in the source directory.
@@ -255,7 +255,7 @@ $   then
 $       ref_fname = f$edit(ref_fname, "LOWERCASE")
 $   endif
 $!
-$!  These files are in the wrong format for VMS diff, and we don't change them.
+$!  These files are in the wrong format for VMS diff, and we do not change them.
 $   ref_skip = 0
 $   if ref_type .eqs. ".PDF" then ref_skip = 1
 $   if ref_type .eqs. ".HTML" then ref_skip = 1
diff --git a/third-party/curl/projects/vms/config_h.com b/third-party/curl/projects/vms/config_h.com
new file mode 100644
index 0000000000..0b23cc6633
--- /dev/null
+++ b/third-party/curl/projects/vms/config_h.com
@@ -0,0 +1,1932 @@
+$! File: config_h.com
+$!
+$! This procedure attempts to figure out how to build a config.h file
+$! for the current project.
+$!
+$! P1 specifies the config.h.in file or equivalent.  If it is not specified
+$! then this procedure will search for several common names of the file.
+$!
+$! The CONFIGURE shell script will be examined for hints and a few symbols
+$! but most of the tests will not produce valid results on OpenVMS.  Some
+$! will produce false positives and some will produce false negatives.
+$!
+$! It is easier to read the config.h_in file and make up tests based
+$! on what is in it!
+$!
+$! This file will create an empty config_vms.h file if one does not exist.
+$! The config_vms.h is intended for manual edits to handle things that
+$! this procedure can not.
+$!
+$! The config_vms.h will be invoked by the resulting config.h file.
+$!
+$! This procedure knows about the DEC C RTL on the system it is on.
+$! Future versions may be handle the GNV, the OpenVMS porting library,
+$! and others.
+$!
+$! This procedure may not guess the options correctly for all architectures,
+$! and is a work in progress.
+$!
+$! Copyright (C) John Malmberg
+$!
+$! Permission to use, copy, modify, and/or distribute this software for any
+$! purpose with or without fee is hereby granted, provided that the above
+$! copyright notice and this permission notice appear in all copies.
+$!
+$! THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+$! WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+$! MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+$! ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+$! WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+$! ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+$! OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+$!
+$! SPDX-License-Identifier: ISC
+$!
+$!============================================================================
+$!
+$ss_normal = 1
+$ss_abort = 44
+$ss_control_y = 1556
+$status = ss_normal
+$on control_y then goto control_y
+$on warning then goto general_error
+$!on warning then set ver
+$!
+$! Some information for writing timestamps to created files
+$!----------------------------------------------------------
+$my_proc = f$environment("PROCEDURE")
+$my_proc_file = f$parse(my_proc,,,"NAME") + f$parse(my_proc,,,"TYPE")
+$tab[0,8] = 9
+$datetime = f$element(0,".",f$cvtime(,"ABSOLUTE","DATETIME"))
+$username = f$edit(f$getjpi("","USERNAME"),"TRIM")
+$!
+$pid = f$getjpi("","PID")
+$tfile1 = "SYS$SCRATCH:config_h_temp1_''pid'.TEMP"
+$dchfile = "SYS$SCRATCH:config_h_decc_''pid'.TEMP"
+$starhfile = "SYS$SCRATCH:config_h_starlet_''pid'.TEMP"
+$configure_script = "SYS$SCRATCH:configure_script_''pid'.TEMP"
+$!
+$!  Get the system type
+$!----------------------
+$arch_type = f$getsyi("arch_type")
+$!
+$! Does config_vms.h exist?
+$!-------------------------
+$update_config_vms = 0
+$file = f$search("sys$disk:[]config_vms.h")
+$if file .nes. ""
+$then
+$   write sys$output "Found existing custom file ''file'."
+$else
+$   update_config_vms = 1
+$   write sys$output "Creating new sys$disk:[]config_vms.h for you."
+$   gosub write_config_vms
+$endif
+$!
+$!
+$! On some platforms, DCL search has problems with searching a file
+$! on a NFS mounted volume.  So copy it to sys$scratch:
+$!
+$if f$search(configure_script) .nes. "" then delete 'configure_script';*
+$copy sys$disk:[]configure 'configure_script'
+$!
+$ssl_header_dir = "OPENSSL:"
+$if f$trnlnm("OPENSSL") .eqs. ""
+$then
+$    ssl_header_dir = "SSL$INCLUDE:"
+$endif
+$!
+$!
+$! Write out the header
+$!----------------------
+$gosub write_config_h_header
+$!
+$!
+$!
+$! config.h.in could have at least five different names depending
+$! on how it was transferred to OpenVMS
+$!------------------------------------------------------------------
+$if p1 .nes. ""
+$then
+$   cfile = p1
+$else
+$   cfile = f$search("sys$disk:[]config.h.in")
+$   if cfile .eqs. ""
+$   then
+$       cfile = f$search("sys$disk:[]config.h_in")
+$       if cfile .eqs. ""
+$       then
+$           cfile = f$search("sys$disk:[]configh.in")
+$           if cfile .eqs. ""
+$           then
+$               cfile = f$search("sys$disk:[]config__2eh.in")
+$               if cfile .eqs. ""
+$               then
+$                   cfile = f$search("sys$disk:[]config.h__2ein")
+$               endif
+$           endif
+$       endif
+$   endif
+$endif
+$if f$trnlnm("PRJ_INCLUDE") .nes. ""
+$then
+$   cfile = f$search("PRJ_INCLUDE:config.h.in")
+$   if cfile .eqs. ""
+$   then
+$       cfile = f$search("PRJ_INCLUDE:config.h_in")
+$       if cfile .eqs. ""
+$       then
+$           cfile = f$search("PRJ_INCLUDE:config__2eh.in")
+$           if cfile .eqs. ""
+$           then
+$               cfile = f$search("PRJ_INCLUDE:config__2eh.in")
+$               if cfile .eqs. ""
+$               then
+$                   cfile = f$search("PRJ_INCLUDE:config.h__2ein")
+$               endif
+$           endif
+$       endif
+$    endif
+$endif
+$if cfile .eqs. ""
+$then
+$   write sys$output "Can not find sys$disk:config.h.in"
+$   line_out = "Looked for config.h.in, config.h_in, configh.in, "
+$   line_out = line_out + "config__2eh.in, config.h__2ein"
+$   write/symbol sys$output line_out
+$   if f$trnlnm("PRJ_INCLUDE") .nes. ""
+$   then
+$       write sys$output "Also looked in PRJ_INCLUDE: for these files."
+$   endif
+$!
+$   write tf ""
+$   write tf -
+        "   /* Could not find sys$disk:config.h.in                           */"
+$   write tf -
+        "  /*  Looked also for config.h_in, configh.in, config__2eh.in,     */"
+$   write tf -
+        " /*   config.h__2ein                                              */"
+$   if f$trnlnm("PRJ_INCLUDE") .nes. ""
+$   then
+$       write tf -
+        " /* Also looked in PRJ_INCLUDE: for these files.                 */"
+$   endif
+$   write tf -
+        "/*--------------------------------------------------------------*/
+$   write tf ""
+$   goto write_tail
+$endif
+$!
+$!
+$! Locate the DECC libraries in use
+$!-----------------------------------
+$decc_rtldef = f$parse("decc$rtldef","sys$library:.tlb;0")
+$decc_starletdef = f$parse("sys$starlet_c","sys$library:.tlb;0")
+$decc_shr = f$parse("decc$shr","sys$share:.exe;0")
+$!
+$! Dump the DECC header names into a file
+$!----------------------------------------
+$if f$search(dchfile) .nes. "" then delete 'dchfile';*
+$if f$search(tfile1) .nes. "" then delete 'tfile1';*
+$define/user sys$output 'tfile1'
+$library/list 'decc_rtldef'
+$open/read/error=rtldef_loop1_end tf1 'tfile1'
+$open/write/error=rtldef_loop1_end tf2 'dchfile'
+$rtldef_loop1:
+$   read/end=rtldef_loop1_end tf1 line_in
+$   line_in = f$edit(line_in,"TRIM,COMPRESS")
+$   key1 = f$element(0," ",line_in)
+$   key2 = f$element(1," ",line_in)
+$   if key1 .eqs. " " .or. key1 .eqs. "" then goto rtldef_loop1
+$   if key2 .nes. " " .and. key2 .nes. "" then goto rtldef_loop1
+$   write tf2 "|",key1,"|"
+$   goto rtldef_loop1
+$rtldef_loop1_end:
+$if f$trnlnm("tf1","lnm$process",,"SUPERVISOR") .nes. "" then close tf1
+$if f$trnlnm("tf2","lnm$process",,"SUPERVISOR") .nes. "" then close tf2
+$if f$search(tfile1) .nes. "" then delete 'tfile1';*
+$!
+$! Dump the STARLET header names into a file
+$!----------------------------------------
+$if f$search(starhfile) .nes. "" then delete 'starhfile';*
+$if f$search(tfile1) .nes. "" then delete 'tfile1';*
+$define/user sys$output 'tfile1'
+$library/list 'decc_starletdef'
+$open/read/error=stardef_loop1_end tf1 'tfile1'
+$open/write/error=stardef_loop1_end tf2 'starhfile'
+$stardef_loop1:
+$   read/end=stardef_loop1_end tf1 line_in
+$   line_in = f$edit(line_in,"TRIM,COMPRESS")
+$   key1 = f$element(0," ",line_in)
+$   key2 = f$element(1," ",line_in)
+$   if key1 .eqs. " " .or. key1 .eqs. "" then goto stardef_loop1
+$   if key2 .nes. " " .and. key2 .nes. "" then goto stardef_loop1
+$   write tf2 "|",key1,"|"
+$   goto stardef_loop1
+$stardef_loop1_end:
+$if f$trnlnm("tf1","lnm$process",,"SUPERVISOR") .nes. "" then close tf1
+$if f$trnlnm("tf2","lnm$process",,"SUPERVISOR") .nes. "" then close tf2
+$if f$search(tfile1) .nes. "" then delete 'tfile1';*
+$!
+$!
+$! Now calculate what should be in the file from reading
+$! config.h.in and CONFIGURE.
+$!---------------------------------------------------------------
+$open/read inf 'cfile'
+$do_comment = 0
+$if_block = 0
+$cfgh_in_loop1:
+$!set nover
+$   read/end=cfgh_in_loop1_end inf line_in
+$   xline = f$edit(line_in,"TRIM,COMPRESS")
+$!
+$!  Blank line handling
+$!---------------------
+$   if xline .eqs. ""
+$   then
+$       write tf ""
+$       goto cfgh_in_loop1
+$   endif
+$   xlen = f$length(xline)
+$   key = f$extract(0,2,xline)
+$!
+$!  deal with comments by copying exactly
+$!-----------------------------------------
+$   if (do_comment .eq. 1) .or. (key .eqs. "/*")
+$   then
+$       do_comment = 1
+$       write tf line_in
+$       key = f$extract(xlen - 2, 2, xline)
+$       if key .eqs. "*/" then do_comment = 0
+$       goto cfgh_in_loop1
+$   endif
+$!
+$!  Some quick parsing
+$!----------------------
+$   keyif = f$extract(0,3,xline)
+$   key1 = f$element(0," ",xline)
+$   key2 = f$element(1," ",xline)
+$   key2a = f$element(0,"_",key2)
+$   key2b = f$element(1,"_",key2)
+$   key2_len = f$length(key2)
+$   key2_h = f$extract(key2_len - 2, 2, key2)
+$   key2_t = f$extract(key2_len - 5, 5, key2)
+$   if key2_t .eqs. "_TYPE" then key2_h = "_T"
+$   key64 = 0
+$   if f$locate("64", xline) .lt. xlen then key64 = 1
+$!
+$!write sys$output "xline = ''xline'"
+$!
+$!  Comment out this section of the ifblock
+$!-----------------------------------------
+$   if if_block .ge. 3
+$   then
+$       write tf "/* ", xline, " */"
+$       if keyif .eqs. "#en" then if_block = 0
+$       goto cfgh_in_loop1
+$   endif
+$!
+$!  Handle the end of an ifblock
+$!-------------------------------
+$   if keyif .eqs. "#en"
+$   then
+$       write tf xline
+$       if_block = 0
+$       goto cfgh_in_loop1
+$   endif
+$!
+$   if key1 .eqs. "#ifndef"
+$   then
+$!      Manual check for _ALL_SOURCE on AIX error
+$!-----------------------------------------------
+$       if key2 .eqs. "_ALL_SOURCE"
+$       then
+$          write tf "/* ", xline, " */"
+$!
+$!         Ignore the rest of the block
+$!--------------------------------------
+$          if_block = 3
+$          goto cfgh_in_loop1
+$       endif
+$   endif
+$!
+$!
+$!  Default action for an #if/#else/#endif
+$!------------------------------------------
+$   if keyif .eqs. "#if" .or. keyif .eqs. "#el"
+$   then
+$       if_block = 1
+$       write tf xline
+$       goto cfgh_in_loop1
+$   endif
+$!
+$!
+$!  Process "normal?" stuff
+$!---------------------------
+$   if key1 .eqs. "#undef"
+$   then
+$       key2c = f$element(2, "_", key2)
+$       if (key2c .eqs. "_") .or. (key2c .eqs. "H") then key2c = ""
+$       key2d = f$element(3, "_", key2)
+$       if (key2d .eqs. "_") .or. (key2d .eqs. "H") then key2d = ""
+$       key2e = f$element(4, "_", key2)
+$       if (key2e .eqs. "_") .or. (key2e .eqs. "H") then key2e = ""
+$       if key2d .eqs. "T"
+$       then
+$           if key2e .eqs. "TYPE"
+$           then
+$               key2_h = "_T"
+$               key2d = ""
+$           endif
+$       endif
+$!
+$       double_under = 0
+$!
+$!      Process FCNTL directives
+$!-------------------------------------
+$       if (key2b .eqs. "FCNTL") .and. (key2c .eqs. "O") .and. -
+           (key2d .eqs. "NONBLOCK")
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$!      Process GETADDRINFO directives
+$!-------------------------------------
+$       if key2 .eqs. "GETADDRINFO_THREADSAFE"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$!      Process IOCTL directives
+$!-------------------------------------
+$       if (key2b .eqs. "IOCTL") .and. (key2c .nes. "")
+$       then
+$           if (key2c .eqs. "FIONBIO") .or. (key2c .eqs. "SIOCGIFADDR")
+$           then
+$               write tf "#ifndef ''key2'"
+$               write tf "#define ''key2' 1"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$       endif
+$!
+$!
+$!      Manual check for LL on
+$!-----------------------------------------------
+$       if key2 .eqs. "LL"
+$       then
+$          write tf "#ifndef __VAX
+$          write tf "#define HAVE_''key2' 1"
+$          write tf "#endif"
+$          goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "bool_t"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' short"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "bits16_t"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' short"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "u_bits16_t"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' unsigned short"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "bits32_t"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' int"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "u_bits32_t"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' unsigned int"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "intmax_t"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#ifdef __VAX"
+$           write tf "#define ''key2' long"
+$           write tf "#else"
+$           write tf "#define ''key2' long long"
+$           write tf "#endif"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "uintmax_t"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#ifdef __VAX"
+$           write tf "#define ''key2' unsigned long"
+$           write tf "#else"
+$           write tf "#define ''key2' unsigned long long"
+$           write tf "#endif"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "socklen_t"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' int"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "GETGROUPS_T"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' gid_t"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_DECL_SYS_SIGLIST"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 0"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_SYS_ERRLIST"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_STRUCT_DIRENT_D_INO"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_STRUCT_TIMEVAL"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$!      ! The header files have this information, however
+$!      ! The ioctl() call only works on sockets.
+$!      if key2 .eqs. "FIONREAD_IN_SYS_IOCTL"
+$!      then
+$!          write tf "#ifndef ''key2'"
+$!          write tf "#define ''key2' 1"
+$!          write tf "#endif"
+$!          goto cfgh_in_loop1
+$!      endif
+$!
+$!      ! The header files have this information, however
+$!      ! The ioctl() call only works on sockets.
+$!      if key2 .eqs. "GWINSZ_IN_SYS_IOCTL"
+$!      then
+$!          write tf "#ifndef ''key2'"
+$!          write tf "#define ''key2' 1"
+$!          write tf "#endif"
+$!          goto cfgh_in_loop1
+$!      endif
+$!
+$!      ! The header files have this information, however
+$!      ! The ioctl() call only works on sockets.
+$!      if key2 .eqs. "STRUCT_WINSIZE_IN_SYS_IOCTL"
+$!      then
+$!          write tf "#ifndef ''key2'"
+$!          write tf "#define ''key2' 0"
+$!          write tf "#endif"
+$!          goto cfgh_in_loop1
+$!      endif
+$!
+$       if key2 .eqs. "HAVE_STRUCT_TM_TM_ZONE"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_TM_ZONE"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_TIMEVAL"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "WEXITSTATUS_OFFSET"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 2"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_GETPW_DECLS"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_DECL_CONFSTR"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_DECL_PRINTF"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_DECL_SBRK"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_DECL_STRSIGNAL"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 0"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2a .eqs. "HAVE_DECL_STRTOLD"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 0"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_DECL_STRTOIMAX"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 0"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_DECL_STRTOL"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_DECL_STRTOUL"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_DECL_STRTOUMAX"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 0"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "GETPGRP_VOID"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "NAMED_PIPES_MISSING"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "OPENDIR_NOT_ROBUST"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "PGRP_PIPE"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "CAN_REDEFINE_GETENV"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_PRINTF_A_FORMAT"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "CTYPE_NON_ASCII"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_LANGINFO_CODESET"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 0"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$!      This wants execve() to do this automagically to pass.
+$!      if key2 .eqs. "HAVE_HASH_BANG_EXEC"
+$!      then
+$!          write tf "#ifndef ''key2'"
+$!          write tf "#define ''key2' 1"
+$!          write tf "#endif"
+$!          goto cfgh_in_loop1
+$!      endif
+$!
+$       if key2 .eqs. "ICONV_CONST"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2'"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "VOID_SIGHANDLER"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_POSIX_SIGNALS"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "UNUSABLE_RT_SIGNALS"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2a .eqs. "HAVE_DECL_FPURGE"
+$       then
+$           write tf "#ifndef ''key2a'"
+$           write tf "#define ''key2a' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_DECL_SETREGID"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "HAVE_POSIX_SIGSETJMP"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2b .eqs. "RAND" .and. key2c .nes. "" .and. key2d .eqs. ""
+$       then
+$           if (key2c .eqs. "EGD") .or. -
+               (key2c .eqs. "STATUS") .or. -
+               (key2c .eqs. "SCREEN")
+$           then
+$               if f$search("''ssl_header_dir'rand.h") .nes. ""
+$               then
+$                   write tf "#ifndef ''key2'"
+$                   write tf "#define ''key2' 1"
+$                   write tf "#endif"
+$               else
+$                   write tf "/* #undef ''key2' */"
+$               endif
+$           endif
+$       endif
+$!
+$       if key2 .eqs. "STRCOLL_BROKEN"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if key2 .eqs. "DUP_BROKEN"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#define ''key2' 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$!      This is for a test that getcwd(0,0) works.
+$!      It does not on VMS.
+$!--------------------------
+$       if key2 .eqs. "GETCWD_BROKEN"
+$       then
+$           write sys$output ""
+$           write sys$output -
+  "%CONFIG_H-I-NONPORT, ''key2' being tested for!"
+$                  write sys$output -
+ "-CONFIG_H-I-GETCWD, GETCWD(0,0) does not work on VMS."
+$                  write sys$output -
+ "-CONFIG_H-I-GETCWD2, Work around hack probably required."
+$                  write sys$output -
+ "-CONFIG_H-I-REVIEW, Manual Code review required!"
+$                   if update_config_vms
+$                   then
+$                       open/append tfcv sys$disk:[]config_vms.h
+$                       write tfcv ""
+$                       write tfcv -
+                "/* Check config.h for use of ''key2' settings */"
+$                       write tfcv ""
+$                       close tfcv
+$                   endif
+$
+$           goto cfgh_in_loop1
+$       endif
+$!
+$       if (key2a .eqs. "HAVE") .or. (key2a .eqs. "STAT") .or. -
+           (key2 .eqs. "USE_IPV6") .or. (key2b .eqs. "LDAP")
+$       then
+$!
+$!          Process extra underscores
+$!------------------------------------
+$           if f$locate("HAVE___", key2) .lt. key2_len
+$           then
+$               key2b = "__" + key2d
+$               key2d = ""
+$               double_under = 1
+$           else
+$               if f$locate("HAVE__", key2) .lt. key2_len
+$               then
+$                   key2b = "_" + key2c
+$                   key2c = ""
+$                   double_under = 1
+$               endif
+$           endif
+$!
+$           if (key2_h .eqs. "_H") .or. (key2 .eqs. "USE_IPV6") .or. -
+               (key2b .eqs. "LDAP")
+$           then
+$!
+$!              Looking for a header file
+$!---------------------------------------
+$               headf = key2b
+$               if key2c .nes. "" then headf = headf + "_" + key2c
+$               if key2d .nes. "" then headf = headf + "_" + key2d
+$!
+$!                 (key2b .eqs. "READLINE")
+$!
+$!              Some special parsing
+$!------------------------------------------
+$               if (key2b .eqs. "SYS") .or. (key2b .eqs. "ARPA") .or. -
+                   (key2b .eqs. "NET") .or. (key2b .eqs. "NETINET")
+$               then
+$                   if key2c .nes. ""
+$                   then
+$                       headf = key2c
+$                       if key2d .nes. "" then headf = key2c + "_" + key2d
+$                   endif
+$               endif
+$!
+$!              And of course what's life with out some special cases
+$!--------------------------------------------------------------------
+$               if key2 .eqs. "USE_IPV6"
+$               then
+$                   headf = "in6"
+$               endif
+$!
+$               if key2b .eqs. "LDAP"
+$               then
+$                   if (key2 .eqs. "HAVE_LDAP_SSL") .or. -
+                       (key2 .eqs. "HAVE_LDAP_URL_PARSE")
+$                   then
+$                       headf = "ldap"
+$                   endif
+$               endif
+$!
+$!
+$               if key2b .eqs. "FILE"
+$               then
+$                  write sys$output ""
+$                  write sys$output -
+  "%CONFIG_H-I-NONPORT, ''key2' being asked for!"
+$                  write sys$output -
+ "-CONFIG_H-I-FILE_OLD, file.h will not be configured as is obsolete!"
+$                  write sys$output -
+ "-CONFIG_H_I-FCNTL_NEW, "Expecting fcntl.h to be configured instead!"
+$                  write sys$output -
+ "-CONFIG_H_I-FCNTL_CHK, "Unable to verify at this time!"
+$                  write sys$output -
+ "-CONFIG_H-I-REVIEW, Manual Code review required!"
+$!
+$                   if update_config_vms
+$                   then
+$                       open/append tfcv sys$disk:[]config_vms.h
+$                       write tfcv ""
+$                       write tfcv -
+                "/* Check config.h for use of fcntl.h instead of file.h */"
+$                       write tfcv ""
+$                       close tfcv
+$                   endif
+$               endif
+$!
+$!              Now look it up in the DEC C RTL
+$!---------------------------------------------
+$               define/user sys$output nl:
+$               define/user sys$error nl:
+$               search/output=nl: 'dchfile' |'headf'|/exact
+$               if '$severity' .eq. 1
+$               then
+$                   if key64 then write tf "#ifndef __VAX"
+$                   write tf "#ifndef ''key2'"
+$                   write tf "#define ''key2' 1"
+$if p2 .nes. "" then write sys$output "''dchfile' - #define ''key2' 1"
+$                   write tf "#endif"
+$                   if key64 then write tf "#endif"
+$set nover
+$                   goto cfgh_in_loop1
+$               endif
+$!
+$!
+$!              Now look it up in the DEC C STARLET_C
+$!---------------------------------------------
+$               define/user sys$output nl:
+$               define/user sys$error nl:
+$               search/output=nl: 'starhfile' |'headf'|/exact
+$               if '$severity' .eq. 1
+$               then
+$                   if key64 then write tf "#ifndef __VAX"
+$                   write tf "#ifndef ''key2'"
+$                   write tf "#define ''key2' 1"
+$if p2 .nes. "" then write sys$output "''starfile' - #define ''key2' 1"
+$                   write tf "#endif"
+$                   if key64 then write tf "#endif"
+$set nover
+$                   goto cfgh_in_loop1
+$               endif
+$!
+$!              Now look for OPENSSL headers
+$!---------------------------------------------------------
+$               if key2b .eqs. "OPENSSL"
+$               then
+$                   headf = headf - "OPENSSL_"
+$                   header = f$search("''ssl_header_dir'''headf'.h")
+$                   if header .nes. ""
+$                   then
+$                       write tf "#ifndef ''key2'"
+$                       write tf "#define ''key2' 1"
+$                       write tf "#endif"
+$set nover
+$                       goto cfgh_in_loop1
+$                   endif
+$               endif
+$!
+$!              Now look for Kerberos
+$!------------------------------------------------------------
+$               if key2b .eqs. "GSSAPI"
+$               then
+$                   header_dir = "sys$sysroot:[kerberos.include]"
+$                   headf = headf - "GSSAPI_"
+$                   header = f$search("''header_dir'''headf'.h")
+$                   if header .nes. ""
+$                   then
+$                       write tf "#ifndef ''key2'"
+$                       write tf "#define ''key2' 1"
+$                       write tf "#endif"
+$set nover
+$                       goto cfgh_in_loop1
+$                   endif
+$               endif
+$!
+$set nover
+$           else
+$!
+$!              Looking for a routine or a symbol
+$!------------------------------------------------
+$               if key2c .eqs. "MACRO"
+$               then
+$                   if (key2b .eqs. "FILE") .or. (key2b .eqs. "DATE") -
+                        .or. (key2b .eqs. "LINE") .or. (key2b .eqs. "TIME")
+$                   then
+$                       write tf "#ifndef HAVE_''key2b'"
+$                       write tf "#define HAVE_''key2b' 1"
+$                       write tf "#endif"
+$                   endif
+$                   goto cfgh_in_loop1
+$               endif
+$!
+$!              Special false tests
+$!-------------------------------------
+$               if double_under
+$               then
+$                   if key2b .eqs. "_FCNTL" .or. key2b .eqs. "__FCNTL"
+$                   then
+$                       write tf "/* #undef HAVE_''key2b' */"
+$                       goto cfgh_in_loop1
+$                   endif
+$!
+$                   if key2b .eqs. "_STAT" .or. key2b .eqs. "__STAT"
+$                   then
+$                       write tf "/* #undef HAVE_''key2b' */"
+$                       goto cfgh_in_loop1
+$                   endif
+$!
+$                   if key2b .eqs. "_READ" .or. key2b .eqs. "__READ"
+$                   then
+$                       write tf "/* #undef HAVE_''key2b' */"
+$                       goto cfgh_in_loop1
+$                   endif
+$               endif
+$!
+$               keysym = key2b
+$               if key2c .nes. "" then keysym = keysym + "_" + key2c
+$               if key2d .nes. "" then keysym = keysym + "_" + key2d
+$               if key2e .nes. "" then keysym = keysym + "_" + key2e
+$!
+$!
+$!              Stat structure members
+$!-------------------------------------
+$               if key2b .eqs. "STRUCT"
+$               then
+$                   if key2c .eqs. "STAT" .and (key2d .nes. "")
+$                   then
+$                       key2b = key2b + "_" + key2c + "_" + key2d
+$                       key2c = key2e
+$                       key2d = ""
+$                       key2e = ""
+$                   endif
+$               endif
+$               if (key2b .eqs. "ST") .or. (key2b .eqs. "STRUCT_STAT_ST")
+$               then
+$                   keysym = "ST" + "_" + key2c
+$                   keysym = f$edit(keysym,"LOWERCASE")
+$               endif
+$               if key2a .eqs. "STAT"
+$               then
+$                   if (f$locate("STATVFS", key2b) .eq. 0) .and. key2c .eqs. ""
+$                   then
+$                       keysym = f$edit(key2b, "LOWERCASE")
+$                   endif
+$!$                 if (key2b .eqs. "STATVFS" .or. key2b .eqs. "STATFS2" -
+$!                      .or. key2b .eqs. "STATFS3") .and. key2c .nes. ""
+$!
+$                   if (key2b .eqs. "STATVFS") .and. key2c .nes. ""
+$                   then
+$!                      Should really verify that the structure
+$!                      named by key2b actually exists first.
+$!------------------------------------------------------------
+$!
+$!                      Statvfs structure members
+$!-------------------------------------------------
+$                       keysym = "f_" + f$edit(key2c,"LOWERCASE")
+$                   endif
+$               endif
+$!
+$!              UTMPX structure members
+$!--------------------------------------
+$               if key2b .eqs. "UT" .and. key2c .eqs. "UT"
+$               then
+$                   keysym = "ut_" + f$edit(key2d,"LOWERCASE")
+$               endif
+$!
+$               if f$locate("MMAP",key2) .lt. key2_len
+$               then
+$                  write sys$output ""
+$                  write sys$output -
+  "%CONFIG_H-I-NONPORT, ''key2' being asked for!"
+$                  write sys$output -
+ "-CONFIG_H-I-MMAP, MMAP operations only work on STREAM and BINARY files!"
+$                  write sys$output -
+ "-CONFIG_H-I-REVIEW, Manual Code review required!"
+$                   if update_config_vms
+$                   then
+$                       open/append tfcv sys$disk:[]config_vms.h
+$                       write tfcv ""
+$                       write tfcv -
+                "/* Check config.h for use of ''key2' settings */"
+$                       write tfcv ""
+$                       close tfcv
+$                   endif
+$               endif
+$!
+$!
+$               if keysym .eqs. "CRYPT"
+$               then
+$                  write sys$output ""
+$                  write sys$output -
+  "%CONFIG_H-I-NONPORT, ''key2' being asked for!"
+$                  write sys$output -
+ "-CONFIG_H-I-CRYPT, CRYPT operations on the VMS SYSUAF may not work!"
+$                  write sys$output -
+ "-CONFIG_H-I-REVIEW, Manual Code review required!"
+$                   if update_config_vms
+$                   then
+$                       open/append tfcv sys$disk:[]config_vms.h
+$                       write tfcv ""
+$                       write tfcv -
+                "/* Check config.h for use of ''keysym' */"
+$                       write tfcv ""
+$                       close tfcv
+$                   endif
+$               endif
+$!
+$!
+$               if keysym .eqs. "EXECL"
+$               then
+$                  write sys$output ""
+$                  write sys$output -
+  "%CONFIG_H-I-NONPORT, ''key2' being asked for!"
+$                  write sys$output -
+ "-CONFIG_H-I-EXCEL, EXECL configured, Will probably not work."
+$                  write sys$output -
+ "-CONFIG_H-I-REVIEW, Manual Code review required!"
+$                   if update_config_vms
+$                   then
+$                       open/append tfcv sys$disk:[]config_vms.h
+$                       write tfcv ""
+$                       write tfcv -
+                "/* Check config.h for use of ''keysym' */"
+$                       write tfcv ""
+$                       close tfcv
+$                   endif
+$               endif
+$!
+$!
+$!              Process if cpp supports ANSI-C stringizing '#' operator
+$!-----------------------------------------------------------------------
+$               if keysym .eqs. "STRINGIZE"
+$               then
+$                   write tf "#ifndef HAVE_STRINGIZE"
+$                   write tf "#define HAVE_STRINGSIZE 1"
+$                   write tf "#endif"
+$                   goto cfgh_in_loop1
+$               endif
+$!
+$               if keysym .eqs. "VOLATILE"
+$               then
+$                   write tf "#ifndef HAVE_VOLATILE"
+$                   write tf "#define HAVE_VOLATILE 1"
+$                   write tf "#endif"
+$                   goto cfgh_in_loop1
+$               endif
+$!
+$               if keysym .eqs. "ALLOCA"
+$               then
+$                   write tf "#ifndef HAVE_ALLOCA"
+$                   write tf "#define HAVE_ALLOCA 1"
+$                   write tf "#endif"
+$                   goto cfgh_in_loop1
+$               endif
+$!
+$               if keysym .eqs. "ERRNO_DECL"
+$               then
+$                   write tf "#ifndef HAVE_ERRNO_DECL"
+$                   write tf "#define HAVE_ERRNO_DECL 1"
+$                   write tf "#endif"
+$                   goto cfgh_in_loop1
+$               endif
+$!
+$!              May need to test compiler version
+$!-----------------------------------------------
+$               if keysym .eqs. "LONG_LONG"
+$               then
+$                   write tf "#ifndef __VAX"
+$                   write tf "#pragma message disable longlongtype"
+$                   write tf "#ifndef HAVE_LONG_LONG"
+$                   write tf "#define HAVE_LONG_LONG 1"
+$                   write tf "#endif"
+$                   write tf "#endif"
+$                   goto cfgh_in_loop1
+$               endif
+$!
+$!              May need to test compiler version
+$!-----------------------------------------------
+$               if keysym .eqs. "UNSIGNED_LONG_LONG"
+$               then
+$                   write tf "#ifndef __VAX"
+$                   write tf "#pragma message disable longlongtype"
+$                   write tf "#ifndef HAVE_UNSIGNED_LONG_LONG"
+$                   write tf "#define HAVE_UNSIGNED_LONG_LONG 1"
+$                   write tf "#endif"
+$                   write tf "#endif"
+$                   goto cfgh_in_loop1
+$               endif
+$!
+$!              May need to test compiler version
+$!-----------------------------------------------
+$               if keysym .eqs. "UNSIGNED_LONG_LONG_INT"
+$               then
+$                   write tf "#ifndef __VAX"
+$                   write tf "#pragma message disable longlongtype"
+$                   write tf "#ifndef HAVE_UNSIGNED_LONG_LONG_INT"
+$                   write tf "#define HAVE_UNSIGNED_LONG_LONG_INT 1"
+$                   write tf "#endif"
+$                   write tf "#endif"
+$                   goto cfgh_in_loop1
+$               endif
+$!
+$!              May need to test compiler version
+$!-----------------------------------------------
+$               if keysym .eqs. "LONG_DOUBLE"
+$               then
+$                   write tf "#ifndef __VAX"
+$                   write tf "#pragma message disable longlongtype"
+$                   write tf "#ifndef HAVE_LONG_DOUBLE"
+$                   write tf "#define HAVE_LONG_DOUBLE 1"
+$                   write tf "#endif"
+$                   write tf "#endif"
+$                   goto cfgh_in_loop1
+$               endif
+$!
+$               if keysym .eqs. "FCNTL_LOCK"
+$               then
+$                   write sys$output -
+  "%CONFIG_H-I-NONPORT, ''key2' being asked for!
+$                  write sys$output -
+ "-CONFIG_H-I-REVIEW, Manual Code review required!"
+$                   goto cfgh_in_loop1
+$               endif
+$!
+$!
+$!              These libraries are provided by the DEC C RTL
+$!-------------------------------------------------------------
+$               if keysym .eqs. "LIBINET" .or. keysym .eqs. "LIBSOCKET"
+$               then
+$                   write tf "#ifndef HAVE_''keysym'"
+$                   write tf "#define HAVE_''keysym' 1"
+$if p2 .nes. "" then write sys$output "''decc_shr' #define ''keysym' 1"
+$                   write tf "#endif
+$                   goto cfgh_in_loop1
+$               endif
+$!
+$               if keysym .eqs. "HERRNO" then keysym = "h_errno"
+$               if keysym .eqs. "UTIMBUF" then keysym = "utimbuf"
+$               if key2c .eqs. "STRUCT"
+$               then
+$                   keysym = f$edit(key2d,"LOWERCASE")
+$               else
+$                   if key2_h .eqs. "_T"
+$                   then
+$                       if key2_t .eqs. "_TYPE"
+$                       then
+$                           keysym = f$extract(0, key2_len - 5, key2) - "HAVE_"
+$                       endif
+$                       keysym = f$edit(keysym,"LOWERCASE")
+$                   endif
+$               endif
+$!
+$!              Check the DEC C RTL shared image first
+$!------------------------------------------------------
+$               if f$search(tfile1) .nes. "" then delete 'tfile1';*
+$               define/user sys$output nl:
+$               define/user sys$error nl:
+$               search/format=nonull/out='tfile1' 'decc_shr' 'keysym'
+$               if '$severity' .eq. 1
+$               then
+$!
+$!                  Not documented, but from observation
+$!------------------------------------------------------
+$                   define/user sys$output nl:
+$                   define/user sys$error nl:
+$                   if arch_type .eq. 3
+$                   then
+$                       keyterm = "''keysym'<SOH>"
+$                   else
+$                       if arch_type .eq. 2
+$                       then
+$                           keyterm = "''keysym'<BS>"
+$                       else
+$                           keyterm = "''keysym'<STX>"
+$                       endif
+$                   endif
+$                   search/out=nl: 'tfile1' -
+   "$''keyterm'","$g''keyterm'","$__utc_''keyterm'",-
+   "$__utctz_''keyterm'","$__bsd44_''keyterm'","$bsd_''keyterm'",-
+   "$''keysym'decc$","$G''keysym'decc$","$GX''keyterm'"
+$                   severity = '$severity'
+$!
+$!
+$!                  Of course the 64-bit stuff is different
+$!---------------------------------------------------------
+$                   if severity .ne. 1 .and. key64
+$                   then
+$                       define/user sys$output nl:
+$                       define/user sys$error nl:
+$                       search/out=nl: 'tfile1' "$_''keyterm'"
+$!                      search/out 'tfile1' "$_''keyterm'"
+$                       severity = '$severity'
+$                   endif
+$!
+$!                  Unix compatibility routines
+$!---------------------------------------------
+$                   if severity .ne. 1
+$                   then
+$                       define/user sys$output nl:
+$                       define/user sys$error nl:
+$                       search/out=nl: 'tfile1' -
+    "$__unix_''keyterm'","$__vms_''keyterm'","$_posix_''keyterm'"
+$                       severity = '$severity'
+$                   endif
+$!
+$!                  Show the result of the search
+$!------------------------------------------------
+$                   if 'severity' .eq. 1
+$                   then
+$                       if key64 then write tf "#ifndef __VAX"
+$                       write tf "#ifndef ''key2'"
+$                       write tf "#define ''key2' 1"
+$if p2 .nes. "" then write sys$output "''decc_shr' #define ''key2' 1"
+$                       write tf "#endif"
+$                       if key64 then write tf "#endif"
+$                       goto cfgh_in_loop1
+$                   endif
+$               endif
+$               if f$search(tfile1) .nes. "" then delete 'tfile1';*
+$!
+$!              Check the DECC Header files next
+$!----------------------------------------------
+$               define/user sys$output nl:
+$               define/user sys$error nl:
+$               search/out=nl: 'decc_rtldef' -
+                    "''keysym';", "''keysym'[", "struct ''keysym'"/exact
+$               severity = '$severity'
+$               if severity .eq. 1
+$               then
+$                   if key64 then write tf "#ifndef __VAX"
+$                   write tf "#ifndef ''key2'"
+$                   write tf "#define ''key2' 1"
+$if p2 .nes. "" then write sys$output "''decc_rtldef' #define ''key2' 1"
+$                   write tf "#endif"
+$                   if key64 then write tf "#endif"
+$                   goto cfgh_in_loop1
+$               endif
+$!
+$!              Check kerberos
+$!--------------------------------------------
+$               if f$search("SYS$SYSROOT:[kerberos]include.dir") .nes. ""
+$               then
+$                   test_mit = "SYS$SYSROOT:[kerberos.include]gssapi_krb5.h"
+$                   if (key2 .eqs. "HAVE_GSSAPI")
+$                   then
+$                       write tf "#ifndef ''key2'"
+$                       write tf "#define ''key2' 1"
+$                       write tf "#endif"
+$                       goto cfgh_in_loop1
+$                   endif
+$               endif
+$!
+$           endif
+$           write tf "/* ", xline, " */"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$!
+$!      Process SIZEOF directives found in SAMBA and others
+$!----------------------------------------------------------
+$       if key2a .eqs. "SIZEOF"
+$       then
+$           if key2b .eqs. "INO" .and. key2_h .eqs. "_T"
+$           then
+$               write tf "#ifndef SIZEOF_INO_T"
+$               write tf "#if !__USING_STD_STAT
+$               write tf "#define SIZEOF_INO_T 6"
+$               write tf "#else
+$               write tf "#define SIZEOF_INO_T 8"
+$               write tf "#endif
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2b .eqs. "INTMAX" .and. key2_h .eqs. "_T"
+$           then
+$               write tf "#ifndef SIZEOF_INTMAX_T"
+$               write tf "#ifdef __VAX"
+$               write tf "#define SIZEOF_INTMAX_T 4"
+$               write tf "#else"
+$               write tf "#define SIZEOF_INTMAX_T 8"
+$               write tf "#endif"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2b .eqs. "OFF" .and. key2_h .eqs. "_T"
+$           then
+$               write tf "#ifndef SIZEOF_OFF_T"
+$               write tf "#if __USE_OFF64_T"
+$               write tf "#define SIZEOF_OFF_T 8"
+$               write tf "#else"
+$               write tf "#define SIZEOF_OFF_T 4"
+$               write tf "#endif"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2b .eqs. "CHAR" .and. key2_h .eqs. "_P"
+$           then
+$               write tf "#ifndef SIZEOF_CHAR_P"
+$               write tf "#if __INITIAL_POINTER_SIZE == 64"
+$               write tf "#define SIZEOF_CHAR_P 8"
+$               write tf "#else"
+$               write tf "#define SIZEOF_CHAR_P 4"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2b .eqs. "VOIDP"
+$           then
+$               write tf "#ifndef SIZEOF_VOIDP"
+$               write tf "#if __INITIAL_POINTER_SIZE == 64"
+$               write tf "#define SIZEOF_VOIDP 8"
+$               write tf "#else"
+$               write tf "#define SIZEOF_VOIDP 4"
+$               write tf "#endif"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2b .eqs. "INT"
+$           then
+$               write tf "#ifndef SIZEOF_INT"
+$               write tf "#define SIZEOF_INT 4"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2b .eqs. "SIZE" .and. key2_h .eqs. "_T"
+$           then
+$               write tf "#ifndef SIZEOF_SIZE_T"
+$               write tf "#define SIZEOF_SIZE_T 4"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2b .eqs. "TIME" .and. key2_h .eqs. "_T"
+$           then
+$               write tf "#ifndef SIZEOF_TIME_T"
+$               write tf "#define SIZEOF_TIME_T 4"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2b .eqs. "DOUBLE"
+$           then
+$               write tf "#ifndef SIZEOF_DOUBLE"
+$               write tf "#define SIZEOF_DOUBLE 8"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2b .eqs. "LONG"
+$           then
+$               if key2c .eqs. ""
+$               then
+$                   write tf "#ifndef SIZEOF_LONG"
+$                   write tf "#define SIZEOF_LONG 4"
+$                   write tf "#endif"
+$               endif
+$               goto cfgh_in_loop1
+$           endif
+$           write tf "/* ", xline, " */"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$!      Process NEED directives
+$!-------------------------------
+$       if key2a .eqs. "NEED"
+$       then
+$           if key2b .eqs. "STRINGS" .and. key2_h .eqs. "_H"
+$           then
+$               write tf "#ifndef NEED_STRINGS_H"
+$               write tf "#define NEED_STRINGS_H 1"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           write tf "/* ", xline, " */"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$!      Process GETHOSTNAME directives
+$!-------------------------------------
+$       if key2 .eqs. "GETHOSTNAME_TYPE_ARG2"
+$       then
+$           write tf "#ifndef ''key2'"
+$           write tf "#ifdef _DECC_V4_SOURCE"
+$           write tf "#define ''key2' int"
+$           write tf "#else"
+$           write tf "#define ''key2' size_t"
+$           write tf "#endif"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$!      Process GETNAMEINFO directives
+$!-------------------------------------
+$       if key2a .eqs. "GETNAMEINFO"
+$       then
+$           if key2 .eqs. "GETNAMEINFO_QUAL_ARG1"
+$           then
+$               write tf "#ifndef ''key2'"
+$               write tf "#define ''key2' const"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2 .eqs. "GETNAMEINFO_TYPE_ARG1"
+$           then
+$               write tf "#ifndef ''key2'"
+$               write tf "#define ''key2' struct sockaddr *"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2 .eqs. "GETNAMEINFO_TYPE_ARG2"
+$           then
+$               write tf "#ifndef ''key2'"
+$               write tf "#define ''key2' size_t"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2 .eqs. "GETNAMEINFO_TYPE_ARG46"
+$           then
+$               write tf "#ifndef ''key2'"
+$               write tf "#define ''key2' size_t"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2 .eqs. "GETNAMEINFO_TYPE_ARG7"
+$           then
+$               write tf "#ifndef ''key2'"
+$               write tf "#define ''key2' int"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$       endif
+$!
+$!      Process RECV directives
+$!-------------------------------------
+$       if key2a .eqs. "RECV"
+$       then
+$           if key2 .eqs. "RECV_TYPE_ARG1"
+$           then
+$               write tf "#ifndef ''key2'"
+$               write tf "#define ''key2' int"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2 .eqs. "RECV_TYPE_ARG2"
+$           then
+$               write tf "#ifndef ''key2'"
+$               write tf "#define ''key2' void *"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2 .eqs. "RECV_TYPE_ARG3"
+$           then
+$               write tf "#ifndef ''key2'"
+$               write tf "#define ''key2' size_t"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2 .eqs. "RECV_TYPE_ARG4"
+$           then
+$               write tf "#ifndef ''key2'"
+$               write tf "#define ''key2' int"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2 .eqs. "RECV_TYPE_RETV"
+$           then
+$               write tf "#ifndef ''key2'"
+$               write tf "#define ''key2' int"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$       endif
+$!
+$!      Process SEND directives
+$!-------------------------------------
+$       if key2a .eqs. "SEND"
+$       then
+$           if key2 .eqs. "SEND_TYPE_ARG1"
+$           then
+$               write tf "#ifndef ''key2'"
+$               write tf "#define ''key2' int"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2 .eqs. "SEND_TYPE_ARG2"
+$           then
+$               write tf "#ifndef ''key2'"
+$               write tf "#define ''key2' void *"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2 .eqs. "SEND_TYPE_ARG3"
+$           then
+$               write tf "#ifndef ''key2'"
+$               write tf "#define ''key2' size_t"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2 .eqs. "SEND_TYPE_ARG4"
+$           then
+$               write tf "#ifndef ''key2'"
+$               write tf "#define ''key2' int"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$           if key2 .eqs. "SEND_TYPE_RETV"
+$           then
+$               write tf "#ifndef ''key2'"
+$               write tf "#define ''key2' int"
+$               write tf "#endif"
+$               goto cfgh_in_loop1
+$           endif
+$       endif
+$!
+$!
+$!      Process STATFS directives
+$!-------------------------------
+$!      if key2a .eqs. "STATFS"
+$!      then
+$!          write tf "/* ", xline, " */"
+$!          goto cfgh_in_loop1
+$!      endif
+$!
+$!      Process inline directive
+$!------------------------------
+$       if key2 .eqs. "inline"
+$       then
+$           write tf "#ifndef inline"
+$           write tf "#define inline __inline"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$!      Process restrict directive
+$!--------------------------------
+$       if key2 .eqs. "restrict"
+$       then
+$           write tf "#ifndef restrict"
+$           write tf "#define restrict __restrict"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$!      Process STDC_HEADERS (SAMBA!)
+$!---------------------------
+$       if key2 .eqs. "STDC_HEADERS"
+$       then
+$           write tf "#ifndef STDC_HEADERS"
+$           write tf "#define STDC_HEADERS 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$!      Process PROTOTYPES directive
+$!-------------------------------------
+$       if key2 .eqs. "PROTOTYPES"
+$       then
+$           write tf "#ifndef PROTOTYPES"
+$           write tf "#define PROTOTYPES 1"
+$           write tf "#endif"
+$           goto cfgh_in_loop1
+$       endif
+$!
+$!      Special for SEEKDIR_RETURNS_VOID
+$!---------------------------------------
+$       if key2 .eqs. "SEEKDIR_RETURNS_VOID"
+$       then
+$           write tf "#ifndef SEEKDIR_RETURNS_VOID"
+$           write tf "#define SEEKDIR_RETURNS_VOID 1"
+$           write tf "#endif"
+$       endif
+$!
+$!      Unknown - See if CONFIGURE can give a clue for this
+$!----------------------------------------------------------
+$       pflag = 0
+$       set_flag = 0
+$!      gproj_name = proj_name - "_VMS" - "-VMS"
+$       if f$search(tfile1) .nes. "" then delete 'tfile1';*
+$       define/user sys$output nl:
+$       define/user sys$error nl:
+$!      if f$locate("FILE", key2) .lt. key2_len then pflag = 1
+$!      if f$locate("DIR", key2) .eq. key2_len - 3 then pflag = 1
+$!      if f$locate("PATH", key2) .eq. key2_len - 4 then pflag = 1
+$!
+$       search/out='tfile1' 'configure_script' "''key2'="/exact
+$       search_sev = '$severity'
+$       if 'search_sev' .eq. 1
+$       then
+$           open/read/err=unknown_cf_rd_error sf 'tfile1'
+$search_file_rd_loop:
+$           read/end=unknown_cf_rd_err sf line_in
+$           line_in = f$edit(line_in, "TRIM")
+$           skey1 = f$element(0,"=",line_in)
+$           if skey1 .eqs. key2
+$           then
+$               skey2 = f$element(1,"=",line_in)
+$               skey2a = f$extract(0,2,skey2)
+$!
+$!
+$!              We can not handle assignment to shell symbols.
+$!              For now skip them.
+$!------------------------------------------------------------
+$               if f$locate("$", skey2) .lt. f$length(skey2)
+$               then
+$                   write tf "/* ", xline, " */"
+$                   set_flag = 1
+$                   goto found_in_configure
+$               endif
+$!
+$!              Keep these two cases separate to make it easier to add
+$!              more future intelligence to this routine
+$!----------------------------------------------------------------------
+$               if skey2a .eqs. """`"
+$               then
+$!                  if pflag .eq. 1
+$!                  then
+$!                      write tf "#ifndef ''key2'"
+$!                      write tf "#define ",key2," """,gproj_name,"_",key2,""""
+$!                      write tf "#endif"
+$!                  else
+$!                      Ignore this for now
+$!------------------------------------------
+$                       write tf "/* ", xline, " */"
+$!                  endif
+$                   set_flag = 1
+$                   goto found_in_configure
+$               endif
+$               if skey2a .eqs. """$"
+$               then
+$!                  if pflag .eq. 1
+$!                  then
+$!                      write tf "#ifndef ''key2'"
+$!                      write tf "#define ",key2," """,gproj_name,"_",key2,""""
+$!                      write tf "#endif"
+$!                  else
+$!                      Ignore this for now
+$!-------------------------------------------
+$                       write tf "/* ", xline, " */"
+$!                  endif
+$                   set_flag = 1
+$                   goto found_in_configure
+$               endif
+$!
+$!              Remove multiple layers of quotes if present
+$!----------------------------------------------------------
+$               if f$extract(0, 1, skey2) .eqs. "'"
+$               then
+$                   skey2 = skey2 - "'" - "'" - "'" - "'"
+$               endif
+$               if f$extract(0, 1, skey2) .eqs. """"
+$               then
+$                   skey2 = skey2 - """" - """" - """" - """"
+$               endif
+$               write tf "#ifndef ''key2'"
+$               if skey2 .eqs. ""
+$               then
+$                   write tf "#define ",key2
+$               else
+$!                  Only quote non-numbers
+$!----------------------------------------
+$                   if f$string(skey2+0) .eqs. skey2
+$                   then
+$                       write tf "#define ",key2," ",skey2
+$                   else
+$                       write tf "#define ",key2," """,skey2,""""
+$                   endif
+$               endif
+$               write tf "#endif"
+$               set_flag = 1
+$           else
+$               goto search_file_rd_loop
+$!              if pflag .eq. 1
+$!              then
+$!                  write tf "#ifndef ''key2'"
+$!                  write tf "#define ",key2," """,gproj_name,"_",key2,""""
+$!                  write tf "#endif"
+$!                  set_flag = 1
+$!              endif
+$           endif
+$found_in_configure:
+$unknown_cf_rd_err:
+$           if f$trnlnm("sf","lnm$process",,"SUPERVISOR") .nes. ""
+$           then
+$               close sf
+$           endif
+$           if f$search(tfile1) .nes. "" then delete 'tfile1';*
+$           if set_flag .eq. 1 then goto cfgh_in_loop1
+$       endif
+$   endif
+$!
+$!
+$!
+$!  If it falls through everything else, comment it out
+$!-----------------------------------------------------
+$   write tf "/* ", xline, " */"
+$   goto cfgh_in_loop1
+$cfgh_in_loop1_end:
+$close inf
+$!
+$!
+$! Write out the tail
+$!--------------------
+$write_tail:
+$gosub write_config_h_tail
+$!
+$! Exit and clean up
+$!--------------------
+$general_error:
+$status = '$status'
+$all_exit:
+$set noon
+$if f$trnlnm("sf","lnm$process",,"SUPERVISOR") .nes. "" then close sf
+$if f$trnlnm("tf","lnm$process",,"SUPERVISOR") .nes. "" then close tf
+$if f$trnlnm("inf","lnm$process",,"SUPERVISOR") .nes. "" then close inf
+$if f$trnlnm("tf1","lnm$process",,"SUPERVISOR") .nes. "" then close tf1
+$if f$trnlnm("tf2","lnm$process",,"SUPERVISOR") .nes. "" then close tf2
+$if f$trnlnm("tfcv","lnm$process",,"SUPERVISOR") .nes. "" then close tfcv
+$if f$type(tfile1) .eqs. "STRING"
+$then
+$   if f$search(tfile1) .nes. "" then delete 'tfile1';*
+$endif
+$if f$type(dchfile) .eqs. "STRING"
+$then
+$   if f$search(dchfile) .nes. "" then delete 'dchfile';*
+$endif
+$if f$type(starhfile) .eqs. "STRING"
+$then
+$   if f$search(starhfile) .nes. "" then delete 'starhfile';*
+$endif
+$if f$type(configure_script) .eqs. "STRING"
+$then
+$   if f$search(configure_script) .nes. "" then delete 'configure_script';*
+$endif
+$exit 'status'
+$!
+$!
+$control_y:
+$   status = ss_control_y
+$   goto all_exit
+$!
+$!
+$!
+$! Gosub to write a new config_vms.h
+$!-----------------------------------
+$write_config_vms:
+$outfile = "sys$disk:[]config_vms.h"
+$create 'outfile'
+$open/append tf 'outfile'
+$write tf "/* File: config_vms.h"
+$write tf "**"
+$write tf "** This file contains the manual edits needed for porting"
+$!write tf "** the ''proj_name' package to OpenVMS.
+$write tf "**"
+$write tf "** Edit this file as needed.  The procedure that automatically"
+$write tf "** generated this header stub will not overwrite or make any"
+$write tf "** changes to this file."
+$write tf "**"
+$write tf -
+ "** ", datetime, tab, username, tab, "Generated by ''my_proc_file'"
+$write tf "**"
+$write tf -
+ "**========================================================================*/"
+$write tf ""
+$close tf
+$return
+$!
+$! gosub to write out a documentation header for config.h
+$!----------------------------------------------------------------
+$write_config_h_header:
+$outfile = "sys$disk:[]config.h"
+$create 'outfile'
+$open/append tf 'outfile'
+$write tf "#ifndef CONFIG_H"
+$write tf "#define CONFIG_H"
+$write tf "/* File: config.h"
+$write tf "**"
+$write tf -
+  "** This file contains the options needed for porting "
+$write tf "** the project on a VMS system."
+$write tf "**"
+$write tf "** Try not to make any edits to this file, as it is"
+$write tf "** automagically generated."
+$write tf "**"
+$write tf "** Manual edits should be made to the config_vms.h file."
+$write tf "**"
+$write tf -
+ "** ", datetime, tab, username, tab, "Generated by ''my_proc_file'"
+$write tf "**"
+$write tf -
+ "**========================================================================*/"
+$write tf ""
+$write tf "#if (__CRTL_VER >= 70200000) && !defined (__VAX)"
+$write tf "#define _LARGEFILE 1"
+$write tf "#endif"
+$write tf ""
+$write tf "#ifndef __VAX"
+$write tf "#ifdef __CRTL_VER"
+$write tf "#if __CRTL_VER >= 80200000"
+$write tf "#define _USE_STD_STAT 1"
+$write tf "#endif"
+$write tf "#endif"
+$write tf "#endif"
+$write tf ""
+$!
+$write tf " /* Allow compiler builtins */"
+$write tf "/*-------------------------*/"
+$write tf "#ifdef __DECC_VER"
+$write tf "#include <non_existent_dir:builtins.h>"
+$write tf "#endif"
+$!
+$write tf ""
+$return
+$!
+$! gosub to write out the tail for config.h and close it
+$!---------------------------------------------------------
+$write_config_h_tail:
+$write tf ""
+$write tf " /* Include the hand customized settings */"
+$write tf "/*--------------------------------------*/"
+$write tf "#include ""config_vms.h"""
+$write tf ""
+$write tf "#endif /* CONFIG_H */"
+$close tf
+$return
+$!
diff --git a/third-party/curl/projects/vms/curl_crtl_init.c b/third-party/curl/projects/vms/curl_crtl_init.c
new file mode 100644
index 0000000000..a044ee72e0
--- /dev/null
+++ b/third-party/curl/projects/vms/curl_crtl_init.c
@@ -0,0 +1,323 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/* File: curl_crtl_init.c
+ *
+ * This file makes sure that the DECC Unix settings are correct for
+ * the mode the program is run in.
+ *
+ * The CRTL has not been initialized at the time that these routines
+ * are called, so many routines can not be called.
+ *
+ * This is a module that provides a LIB$INITIALIZE routine that
+ * will turn on some CRTL features that are not enabled by default.
+ *
+ * The CRTL features can also be turned on via logical names, but that
+ * impacts all programs and some are not ready, willing, or able to handle
+ * those settings.
+ *
+ * On VMS versions that are too old to use the feature setting API, this
+ * module falls back to using logical names.
+ *
+ * Copyright (C) John Malmberg
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ */
+
+/* Unix headers */
+#include <stdio.h>
+#include <string.h>
+
+/* VMS specific headers */
+#include <descrip.h>
+#include <lnmdef.h>
+#include <stsdef.h>
+
+#pragma member_alignment save
+#pragma nomember_alignment longword
+#pragma message save
+#pragma message disable misalgndmem
+struct itmlst_3 {
+  unsigned short int buflen;
+  unsigned short int itmcode;
+  void *bufadr;
+  unsigned short int *retlen;
+};
+#pragma message restore
+#pragma member_alignment restore
+
+#ifdef __VAX
+#define ENABLE  "ENABLE"
+#define DISABLE "DISABLE"
+#else
+
+#define ENABLE  TRUE
+#define DISABLE 0
+int decc$feature_get_index(const char *name);
+int decc$feature_set_value(int index, int mode, int value);
+#endif
+
+int SYS$TRNLNM(const unsigned long *attr,
+               const struct dsc$descriptor_s *table_dsc,
+               struct dsc$descriptor_s *name_dsc,
+               const unsigned char *acmode,
+               const struct itmlst_3 *item_list);
+int SYS$CRELNM(const unsigned long *attr,
+               const struct dsc$descriptor_s *table_dsc,
+               const struct dsc$descriptor_s *name_dsc,
+               const unsigned char *acmode,
+               const struct itmlst_3 *item_list);
+
+/* Take all the fun out of looking up a logical name */
+static int sys_trnlnm(const char *logname, char *value, int value_len)
+{
+  const $DESCRIPTOR(table_dsc, "LNM$FILE_DEV");
+  const unsigned long attr = LNM$M_CASE_BLIND;
+  struct dsc$descriptor_s name_dsc;
+  int status;
+  unsigned short result;
+  struct itmlst_3 itlst[2];
+
+  itlst[0].buflen = value_len;
+  itlst[0].itmcode = LNM$_STRING;
+  itlst[0].bufadr = value;
+  itlst[0].retlen = &result;
+
+  itlst[1].buflen = 0;
+  itlst[1].itmcode = 0;
+
+  name_dsc.dsc$w_length = strlen(logname);
+  name_dsc.dsc$a_pointer = (char *)logname;
+  name_dsc.dsc$b_dtype = DSC$K_DTYPE_T;
+  name_dsc.dsc$b_class = DSC$K_CLASS_S;
+
+  status = SYS$TRNLNM(&attr, &table_dsc, &name_dsc, 0, itlst);
+
+  if($VMS_STATUS_SUCCESS(status)) {
+
+    /* Null-terminate and return the string */
+    /*--------------------------------------*/
+    value[result] = '\0';
+  }
+
+  return status;
+}
+
+/* How to create a logical name */
+static int sys_crelnm(const char *logname, const char *value)
+{
+  int ret_val;
+  const char *proc_table = "LNM$PROCESS_TABLE";
+  struct dsc$descriptor_s proc_table_dsc;
+  struct dsc$descriptor_s logname_dsc;
+  struct itmlst_3 item_list[2];
+
+  proc_table_dsc.dsc$a_pointer = (char *)proc_table;
+  proc_table_dsc.dsc$w_length = strlen(proc_table);
+  proc_table_dsc.dsc$b_dtype = DSC$K_DTYPE_T;
+  proc_table_dsc.dsc$b_class = DSC$K_CLASS_S;
+
+  logname_dsc.dsc$a_pointer = (char *)logname;
+  logname_dsc.dsc$w_length = strlen(logname);
+  logname_dsc.dsc$b_dtype = DSC$K_DTYPE_T;
+  logname_dsc.dsc$b_class = DSC$K_CLASS_S;
+
+  item_list[0].buflen = strlen(value);
+  item_list[0].itmcode = LNM$_STRING;
+  item_list[0].bufadr = (char *)value;
+  item_list[0].retlen = NULL;
+
+  item_list[1].buflen = 0;
+  item_list[1].itmcode = 0;
+
+  ret_val = SYS$CRELNM(NULL, &proc_table_dsc, &logname_dsc, NULL, item_list);
+
+  return ret_val;
+}
+
+/* Start of DECC RTL Feature handling */
+
+/*
+** Sets default value for a feature
+*/
+#ifdef __VAX
+static void set_feature_default(const char *name, const char *value)
+{
+  sys_crelnm(name, value);
+}
+#else
+static void set_feature_default(const char *name, int value)
+{
+  int index;
+
+  index = decc$feature_get_index(name);
+
+  if(index > 0)
+    decc$feature_set_value(index, 0, value);
+}
+#endif
+
+static void set_features(void)
+{
+  int status;
+  char unix_shell_name[255];
+  int use_unix_settings = 1;
+
+  status = sys_trnlnm("GNV$UNIX_SHELL",
+                      unix_shell_name, sizeof(unix_shell_name) - 1);
+  if(!$VMS_STATUS_SUCCESS(status)) {
+    use_unix_settings = 0;
+  }
+
+  /* ACCESS should check ACLs or it is lying. */
+  set_feature_default("DECC$ACL_ACCESS_CHECK", ENABLE);
+
+  /* We always want the new parse style */
+  set_feature_default("DECC$ARGV_PARSE_STYLE", ENABLE);
+
+  /* Unless we are in POSIX compliant mode, we want the old POSIX root
+   * enabled.
+   */
+  set_feature_default("DECC$DISABLE_POSIX_ROOT", DISABLE);
+
+  /* EFS charset, means UTF-8 support */
+  /* VTF-7 support is controlled by a feature setting called UTF8 */
+  set_feature_default("DECC$EFS_CHARSET", ENABLE);
+  set_feature_default("DECC$EFS_CASE_PRESERVE", ENABLE);
+
+  /* Support timestamps when available */
+  set_feature_default("DECC$EFS_FILE_TIMESTAMPS", ENABLE);
+
+  /* Cache environment variables - performance improvements */
+  set_feature_default("DECC$ENABLE_GETENV_CACHE", ENABLE);
+
+  /* Start out with new file attribute inheritance */
+#ifdef __VAX
+  set_feature_default("DECC$EXEC_FILEATTR_INHERITANCE", "2");
+#else
+  set_feature_default("DECC$EXEC_FILEATTR_INHERITANCE", 2);
+#endif
+
+  /* Do not display trailing dot after files without type */
+  set_feature_default("DECC$READDIR_DROPDOTNOTYPE", ENABLE);
+
+  /* For standard output channels buffer output until terminator */
+  /* Gets rid of output logs with single character lines in them. */
+  set_feature_default("DECC$STDIO_CTX_EOL", ENABLE);
+
+  /* Fix mv aa.bb aa */
+  set_feature_default("DECC$RENAME_NO_INHERIT", ENABLE);
+
+  if(use_unix_settings) {
+
+    /* POSIX requires that open files be able to be removed */
+    set_feature_default("DECC$ALLOW_REMOVE_OPEN_FILES", ENABLE);
+
+    /* Default to outputting Unix filenames in VMS routines */
+    set_feature_default("DECC$FILENAME_UNIX_ONLY", ENABLE);
+    /* FILENAME_UNIX_ONLY Implicitly sets */
+    /* decc$disable_to_vms_logname_translation */
+
+    set_feature_default("DECC$FILE_PERMISSION_UNIX", ENABLE);
+
+    set_feature_default("DECC$FILE_SHARING", ENABLE);
+
+    set_feature_default("DECC$FILE_OWNER_UNIX", ENABLE);
+    set_feature_default("DECC$POSIX_SEEK_STREAM_FILE", ENABLE);
+  }
+  else {
+    set_feature_default("DECC$FILENAME_UNIX_REPORT", ENABLE);
+  }
+
+  /* When reporting Unix filenames, glob the same way */
+  set_feature_default("DECC$GLOB_UNIX_STYLE", ENABLE);
+
+  /* The VMS version numbers on Unix filenames is incompatible with most */
+  /* ported packages. */
+  set_feature_default("DECC$FILENAME_UNIX_NO_VERSION", ENABLE);
+
+  /* The VMS version numbers on Unix filenames is incompatible with most */
+  /* ported packages. */
+  set_feature_default("DECC$UNIX_PATH_BEFORE_LOGNAME", ENABLE);
+
+  /* Set strtol to proper behavior */
+  set_feature_default("DECC$STRTOL_ERANGE", ENABLE);
+
+  /* Commented here to prevent future bugs: A program or user should */
+  /* never ever enable DECC$POSIX_STYLE_UID. */
+  /* It will probably break all code that accesses UIDs */
+#if 0
+  do_not_set_default("DECC$POSIX_STYLE_UID", TRUE);
+#endif
+}
+
+/* Some boilerplate to force this to be a proper LIB$INITIALIZE section */
+
+#pragma nostandard
+#pragma extern_model save
+#ifdef __VAX
+#pragma extern_model strict_refdef "LIB$INITIALIZE" nowrt, long, nopic
+#else
+#pragma extern_model strict_refdef "LIB$INITIALIZE" nowrt, long
+#  if __INITIAL_POINTER_SIZE
+#    pragma __pointer_size __save
+#    pragma __pointer_size 32
+#  else
+#    pragma __required_pointer_size __save
+#    pragma __required_pointer_size 32
+#  endif
+#endif
+/* Set our contribution to the LIB$INITIALIZE array */
+void (* const iniarray[])(void) = { set_features };
+#ifndef __VAX
+#  if __INITIAL_POINTER_SIZE
+#    pragma __pointer_size __restore
+#  else
+#    pragma __required_pointer_size __restore
+#  endif
+#endif
+
+/*
+** Force a reference to LIB$INITIALIZE to ensure it
+** exists in the image.
+*/
+int LIB$INITIALIZE(void);
+#ifdef __DECC
+#pragma extern_model strict_refdef
+#endif
+int lib_init_ref = (int)LIB$INITIALIZE;
+#ifdef __DECC
+#pragma extern_model restore
+#pragma standard
+#endif
diff --git a/third-party/curl/packages/vms/curl_gnv_build_steps.txt b/third-party/curl/projects/vms/curl_gnv_build_steps.txt
similarity index 96%
rename from third-party/curl/packages/vms/curl_gnv_build_steps.txt
rename to third-party/curl/projects/vms/curl_gnv_build_steps.txt
index b7ea95219b..88af34f580 100644
--- a/third-party/curl/packages/vms/curl_gnv_build_steps.txt
+++ b/third-party/curl/projects/vms/curl_gnv_build_steps.txt
@@ -16,11 +16,11 @@ From File: curl_gnv_build_steps.txt
 
  SPDX-License-Identifier: ISC
 
-Currently building Curl using GNV takes longer than building Curl via DCL.
+Currently building curl using GNV takes longer than building curl via DCL.
 The GNV procedure actually uses the same configure and makefiles that
 Unix builds use.
 
-Building CURL on OpenVMS using GNV requires GNV V2.1-2 or the updated
+Building curl on OpenVMS using GNV requires GNV v2.1-2 or the updated
 images that are available via anonymous FTP at encompasserve.org in the gnv
 directory.  It also requires the GNV Bash 4.2.45 kit as an update from the
 same location or from the sourceforge.net GNV project.
@@ -38,7 +38,7 @@ time that this document was written.
 [gnv.common_src]curl_*_original_src.bck is the original source of the curl kit
 as provided by the curl project.  [gnv.vms_src]curl-*_vms_src.bck, if present,
 has the OpenVMS specific files that are used for building that are not yet in
-the curl source kits for that release distributed https://curl.se
+the curl source kits for that release distributed https://curl.se/
 
 These backup savesets should be restored to different directory trees on
 an ODS-5 volume(s) which are referenced by concealed rooted logical names.
@@ -48,7 +48,7 @@ VMS_ROOT: is for the source files that are specific to OpenVMS.
           Note, you should create the VMS_ROOT: directory tree even if it is
           initially empty.  This is where you should put edits if you are
           making changes.
-LCL_ROOT: is manually created to have the same base and sub-directories as
+LCL_ROOT: is manually created to have the same base and subdirectories as
           SRC_ROOT: and VMS_ROOT:
 
 The logical name REF_ROOT: may be defined to be a search list for
@@ -100,7 +100,7 @@ Note to builders:
 
 GNV currently has a bug where configure scripts take a long time to run.
 Some of the configure steps take a while to complete, and on a 600 Mhz
-DS10 with IDE disks, taking an hour to run the CURL configure is normal.
+DS10 with IDE disks, taking an hour to run the curl configure is normal.
 
 The following messages can be ignored and may get fixed in a future version
 of GNV.  The GNV$*.OPT files are used to find the libraries as many have
@@ -117,7 +117,7 @@ u unimplemented switch - ignored
 
 
 With these search lists set up and the properly, curl can be built by
-setting your default to PRJ_ROOT:[curl.packages.vms] and then issuing
+setting your default to PRJ_ROOT:[curl.projects.vms] and then issuing
 either the command:
 
   $ @pcsi_product_gnv_curl.com
@@ -268,7 +268,7 @@ branding the PCSI kit based on who is making the kit.
          This compares the VMS specific source with the backup
          staging directory for it and updates with any changes.
 
-         Leave off "UPDATE" to just check without doing any changes.
+         Leave off "UPDATE" to check without doing any changes.
 
       If you are not using NFS mounted disks and do not want to have a
       separate directory for staging the sources for backup make sure
diff --git a/third-party/curl/packages/vms/curl_release_note_start.txt b/third-party/curl/projects/vms/curl_release_note_start.txt
similarity index 91%
rename from third-party/curl/packages/vms/curl_release_note_start.txt
rename to third-party/curl/projects/vms/curl_release_note_start.txt
index 62b2836359..184b458dd6 100644
--- a/third-party/curl/packages/vms/curl_release_note_start.txt
+++ b/third-party/curl/projects/vms/curl_release_note_start.txt
@@ -16,16 +16,16 @@ OpenVMS specific building and kitting instructions are after the standard
 curl readme file.
 
 This product may be available for your platform in a PCSI kit.  The source kit
-contains files for building CURL using GNV or with a DCL procedure.
+contains files for building curl using GNV or with a DCL procedure.
 
 The GNV based build creates a libcurl share imaged which is supplied in the
 PCSI kit.
 
-This version of CURL will return VMS compatible status codes when run from
+This version of curl will return VMS compatible status codes when run from
 DCL and Unix compatible exit codes and messages when run with the SHELL
 environment variable set.
 
-This port of Curl uses the OpenSSL, Ldap, and Kerberos V5 that are bundled
+This port of curl uses the OpenSSL, Ldap, and Kerberos V5 that are bundled
 with OpenVMS or supplied as updates by HP.  Ldap and Kerberos are not available
 on the VAX platform.  See section below for a special note about HP OpenSSL
 on Alpha and IA64.
@@ -36,7 +36,7 @@ the GNV$LIBCURL shared image and create logical names GNV$LIBCURL to reference
 it.  It will create the GNV$CURL_INCLUDE logical name for build procedures
 to access the header files.
 
-Normally to use curl from DCL, just create a foreign command as:
+Normally to use curl from DCL, create a foreign command as:
    curl :== $gnv$gnu:[usr.bin]gnv$curl.exe
 
 If you need to work around having the older HP SSL kit installed, then
@@ -61,7 +61,7 @@ For the HP SSL work around to work for GNV do the following:
 Similar workarounds will be needed for any program linked with GNV$LIBCURL
 until the HP OpenSSL is upgraded to the current 1.4 version or later.
 
-If you are installing a "daily" build instead of a release build of Curl, some
+If you are installing a "daily" build instead of a release build of curl, some
 things have been changed so that it can be installed at the same time as
 a production build without conflicts.
 
diff --git a/third-party/curl/packages/vms/curl_startup.com b/third-party/curl/projects/vms/curl_startup.com
similarity index 97%
rename from third-party/curl/packages/vms/curl_startup.com
rename to third-party/curl/projects/vms/curl_startup.com
index e90bbecbb9..7e5b2729d8 100644
--- a/third-party/curl/packages/vms/curl_startup.com
+++ b/third-party/curl/projects/vms/curl_startup.com
@@ -1,6 +1,6 @@
 $! File: curl_Startup.com
 $!
-$! Procedure to setup the CURL libraries for use by programs from the
+$! Procedure to setup the curl libraries for use by programs from the
 $! VMS SYSTARTUP*.COM procedure.
 $!
 $! Copyright (C) John Malmberg
@@ -75,7 +75,7 @@ $ define/system/exec gnv$curl_ssl_libcryptoshr32 'curl_ssl_libcrypto32'
 $ define/system/exec gnv$curl_ssl_libsslshr32 'curl_ssl_libssl32'
 $!
 $!
-$! CURL setup
+$! curl setup
 $ define/system/exec gnv$libcurl gnv$gnu:[usr.lib]GNV$LIBCURL.EXE
 $ define/system/exec gnv$curl_include gnv$gnu:[usr.include.curl]
 $ if .not. f$file_attributes("gnv$libcurl", "known")
diff --git a/third-party/curl/projects/vms/curlmsg.h b/third-party/curl/projects/vms/curlmsg.h
new file mode 100644
index 0000000000..f05c3a8f5a
--- /dev/null
+++ b/third-party/curl/projects/vms/curlmsg.h
@@ -0,0 +1,143 @@
+#ifndef HEADER_CURLMSG_H
+#define HEADER_CURLMSG_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+#pragma __member_alignment __save
+#pragma __nomember_alignment
+
+/*                                                                          */
+/* CURLMSG.H                                                                */
+/*                                                                          */
+/* SDL File Generated by VAX-11 Message V04-00 on 3-SEP-2008 13:33:54.09    */
+/*                                                                          */
+/* THESE VMS ERROR CODES ARE GENERATED BY TAKING APART THE CURL.H           */
+/* FILE AND PUTTING ALL THE CURLE_* ENUM STUFF INTO THIS FILE,              */
+/* CURLMSG.MSG.  AN .SDL FILE IS CREATED FROM THIS FILE WITH                */
+/* MESSAGE/SDL.  THE .H FILE IS CREATED USING THE FREEWARE SDL TOOL         */
+/* AGAINST THE .SDL FILE WITH SDL/ALPHA/LANG=CC COMMAND.                    */
+/*                                                                          */
+/* WITH THE EXCEPTION OF CURLE_OK, ALL OF THE MESSAGES ARE AT               */
+/* THE ERROR SEVERITY LEVEL.  WITH THE EXCEPTION OF                         */
+/* PEER_FAILED_VERIF, WHICH IS A SHORTENED FORM OF                          */
+/* PEER_FAILED_VERIFICATION, THESE ARE THE SAME NAMES AS THE                */
+/* CURLE_ ONES IN INCLUDE/CURL.H.  THE MESSAGE UTILITY MANUAL STATES        */
+/* "THE COMBINED LENGTH OF THE PREFIX AND THE MESSAGE SYMBOL NAME CANNOT    */
+/* EXCEED 31 CHARACTERS."  WITH A PREFIX OF FIVE THAT LEAVES US WITH 26     */
+/* FOR THE MESSAGE NAME.                                                    */
+/*                                                                          */
+/* IF YOU UPDATE THIS FILE, UPDATE CURLMSG_VMS.H SO THAT THEY ARE IN SYNC   */
+/*                                                                          */
+
+#define CURL_FACILITY               3841
+#define CURL_OK                     251756553
+#define CURL_UNSUPPORTED_PROTOCOL   251756562
+#define CURL_FAILED_INIT            251756570
+#define CURL_URL_MALFORMAT          251756578
+#define CURL_OBSOLETE4              251756586
+#define CURL_COULDNT_RESOLVE_PROXY  251756594
+#define CURL_COULDNT_RESOLVE_HOST   251756602
+#define CURL_COULDNT_CONNECT        251756610
+#define CURL_WEIRD_SERVER_REPLY     251756618
+#define CURL_FTP_WEIRD_SERVER_REPLY CURL_WEIRD_SERVER_REPLY
+#define CURL_FTP_ACCESS_DENIED      251756626
+#define CURL_OBSOLETE10             251756634
+#define CURL_FTP_WEIRD_PASS_REPLY   251756642
+#define CURL_OBSOLETE12             251756650
+#define CURL_FTP_WEIRD_PASV_REPLY   251756658
+#define CURL_FTP_WEIRD_227_FORMAT   251756666
+#define CURL_FTP_CANT_GET_HOST      251756674
+#define CURL_OBSOLETE16             251756682
+#define CURL_FTP_COULDNT_SET_TYPE   251756690
+#define CURL_PARTIAL_FILE           251756698
+#define CURL_FTP_COULDNT_RETR_FILE  251756706
+#define CURL_OBSOLETE20             251756714
+#define CURL_QUOTE_ERROR            251756722
+#define CURL_HTTP_RETURNED_ERROR    251756730
+#define CURL_WRITE_ERROR            251756738
+#define CURL_OBSOLETE24             251756746
+#define CURL_UPLOAD_FAILED          251756754
+#define CURL_READ_ERROR             251756762
+#define CURL_OUT_OF_MEMORY          251756770
+#define CURL_OPERATION_TIMEOUTED    251756778
+#define CURL_OBSOLETE29             251756786
+#define CURL_FTP_PORT_FAILED        251756794
+#define CURL_FTP_COULDNT_USE_REST   251756802
+#define CURL_OBSOLETE32             251756810
+#define CURL_RANGE_ERROR            251756818
+#define CURL_HTTP_POST_ERROR        251756826
+#define CURL_SSL_CONNECT_ERROR      251756834
+#define CURL_BAD_DOWNLOAD_RESUME    251756842
+#define CURL_FILE_COULDNT_READ_FILE 251756850
+#define CURL_LDAP_CANNOT_BIND       251756858
+#define CURL_LDAP_SEARCH_FAILED     251756866
+#define CURL_OBSOLETE40             251756874
+#define CURL_FUNCTION_NOT_FOUND     251756882
+#define CURL_ABORTED_BY_CALLBACK    251756890
+#define CURL_BAD_FUNCTION_ARGUMENT  251756898
+#define CURL_OBSOLETE44             251756906
+#define CURL_INTERFACE_FAILED       251756914
+#define CURL_OBSOLETE46             251756922
+#define CURL_TOO_MANY_REDIRECTS     251756930
+#define CURL_UNKNOWN_TELNET_OPTION  251756938
+#define CURL_TELNET_OPTION_SYNTAX   251756946
+#define CURL_OBSOLETE50             251756954
+#define CURL_PEER_FAILED_VERIF      251756962
+#define CURL_GOT_NOTHING            251756970
+#define CURL_SSL_ENGINE_NOTFOUND    251756978
+#define CURL_SSL_ENGINE_SETFAILED   251756986
+#define CURL_SEND_ERROR             251756994
+#define CURL_RECV_ERROR             251757002
+#define CURL_OBSOLETE57             251757010
+#define CURL_SSL_CERTPROBLEM        251757018
+#define CURL_SSL_CIPHER             251757026
+#define CURL_SSL_CACERT             251757034
+#define CURL_BAD_CONTENT_ENCODING   251757042
+#define CURL_LDAP_INVALID_URL       251757050
+#define CURL_FILESIZE_EXCEEDED      251757058
+#define CURL_USE_SSL_FAILED         251757066
+#define CURL_SEND_FAIL_REWIND       251757074
+#define CURL_SSL_ENGINE_INITFAILED  251757082
+#define CURL_LOGIN_DENIED           251757090
+#define CURL_TFTP_NOTFOUND          251757098
+#define CURL_TFTP_PERM              251757106
+#define CURL_REMOTE_DISK_FULL       251757114
+#define CURL_TFTP_ILLEGAL           251757122
+#define CURL_TFTP_UNKNOWNID         251757130
+#define CURL_REMOTE_FILE_EXISTS     251757138
+#define CURL_TFTP_NOSUCHUSER        251757146
+#define CURL_CONV_FAILED            251757154
+#define CURL_CONV_REQD              251757162
+#define CURL_SSL_CACERT_BADFILE     251757170
+#define CURL_REMOTE_FILE_NOT_FOUND  251757178
+#define CURL_SSH                    251757186
+#define CURL_SSL_SHUTDOWN_FAILED    251757194
+#define CURL_AGAIN                  251757202
+#define CURL_SSL_CRL_BADFILE        251757210
+#define CURL_SSL_ISSUER_ERROR       251757218
+#define CURL_CURL_LAST              251757226
+
+#pragma __member_alignment __restore
+
+#endif /* HEADER_CURLMSG_H */
diff --git a/third-party/curl/projects/vms/curlmsg.msg b/third-party/curl/projects/vms/curlmsg.msg
new file mode 100644
index 0000000000..b02fe5649c
--- /dev/null
+++ b/third-party/curl/projects/vms/curlmsg.msg
@@ -0,0 +1,134 @@
+!***************************************************************************
+!                                  _   _ ____  _
+!  Project                     ___| | | |  _ \| |
+!                             / __| | | | |_) | |
+!                            | (__| |_| |  _ <| |___
+!                             \___|\___/|_| \_\_____|
+!
+! Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+!
+! This software is licensed as described in the file COPYING, which
+! you should have received as part of this distribution. The terms
+! are also available at https://curl.se/docs/copyright.html.
+!
+! You may opt to use, copy, modify, merge, publish, distribute and/or sell
+! copies of the Software, and permit persons to whom the Software is
+! furnished to do so, under the terms of the COPYING file.
+!
+! This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+! KIND, either express or implied.
+!
+! SPDX-License-Identifier: curl
+!
+!##########################################################################
+!
+! These VMS error codes are generated by taking apart the curl.h
+! file and putting all the CURLE_* enum stuff into this file,
+! CURLMSG.MSG.  An .SDL file is created from this file with
+! MESSAGE/SDL.  The .H file is created using the freeware SDL tool
+! against the .SDL file with SDL/ALPHA/LANG=CC command.
+!
+! With the exception of CURLE_OK, all of the messages are at
+! the error severity level.  With the exception of
+! PEER_FAILED_VERIF, which is a shortened form of
+! PEER_FAILED_VERIFICATION, these are the same names as the
+! CURLE_ ones in include/curl.h.  The Message Utility manual states
+! "The combined length of the prefix and the message symbol name cannot
+! exceed 31 characters."  With a prefix of five that leaves us with 26
+! for the message name.
+!
+! If you update this file also update curlmsg_vms.h so that they are in sync
+!
+.TITLE          CURLMSG Message files
+.FACILITY       CURL,1793       /PREFIX=CURL_
+.BASE           1
+.SEVERITY       SUCCESS
+OK              <normal successful completion>
+
+.SEVERITY       ERROR
+UNSUPPORTED_PROTOCOL    <unsupported protocol>
+FAILED_INIT             <failed init>
+URL_MALFORMAT           <URL malformat>
+OBSOLETE4               <obsolete error code>
+COULDNT_RESOLVE_PROXY   <could not resolve proxy>
+COULDNT_RESOLVE_HOST    <could not resolve host>
+COULDNT_CONNECT         <could not connect>
+WEIRD_SERVER_REPLY      <weird server reply>
+FTP_ACCESS_DENIED       <FTP access denied>
+OBSOLETE10              <obsolete error code>
+FTP_WEIRD_PASS_REPLY    <FTP weird PASS reply>
+OBSOLETE12              <obsolete error code>
+FTP_WEIRD_PASV_REPLY    <FTP weird PASV reply>
+FTP_WEIRD_227_FORMAT    <FTP weird 227 format>
+FTP_CANT_GET_HOST       <FTP can not get host>
+OBSOLETE16              <obsolete error code>
+FTP_COULDNT_SET_TYPE    <FTP could not set type>
+PARTIAL_FILE            <partial file>
+FTP_COULDNT_RETR_FILE   <FTP could not RETR file>
+OBSOLETE20              <obsolete error code>
+QUOTE_ERROR             <quote command error>
+HTTP_RETURNED_ERROR     <HTTP returned error>
+WRITE_ERROR             <write error>
+OBSOLETE24              <obsolete error code>
+UPLOAD_FAILED           <failed upload command>
+READ_ERROR              <read error, could not open/read file>
+OUT_OF_MEMORY           <out of memory>
+OPERATION_TIMEOUTED     <operation timed out, timeout time was reached>
+OBSOLETE29              <obsolete error code>
+FTP_PORT_FAILED         <FTP PORT operation failed>
+FTP_COULDNT_USE_REST    <FTP REST command failed>
+OBSOLETE32              <obsolete error code>
+RANGE_ERROR             <RANGE command error>
+HTTP_POST_ERROR         <HTTP POST error>
+SSL_CONNECT_ERROR       <SSL connect error>
+BAD_DOWNLOAD_RESUME     <bad download resume>
+FILE_COULDNT_READ_FILE  <FILE could not read file>
+LDAP_CANNOT_BIND        <LDAP cannot bind>
+LDAP_SEARCH_FAILED      <LDAP search failed>
+OBSOLETE40              <obsolete error code>
+FUNCTION_NOT_FOUND      <function not found>
+ABORTED_BY_CALLBACK     <aborted by callback>
+BAD_FUNCTION_ARGUMENT   <bad function argument>
+OBSOLETE44              <obsolete error code>
+INTERFACE_FAILED        <CURLOPT_INTERFACE failed>
+OBSOLETE46              <obsolete error code>
+TOO_MANY_REDIRECTS      <too many redirects>
+UNKNOWN_TELNET_OPTION   <unknown TELNET option>
+TELNET_OPTION_SYNTAX    <malformed TELNET option syntax>
+OBSOLETE50              <obsolete error code>
+PEER_FAILED_VERIF       <peer certificate or fingerprint failed>
+GOT_NOTHING             <got nothing>
+SSL_ENGINE_NOTFOUND     <SSL crypto engine not found>
+SSL_ENGINE_SETFAILED    <SSL can not set SSL crypto engine as default>
+SEND_ERROR              <SEND error, failure sending network data>
+RECV_ERROR              <RECV error, failure receiving network data>
+OBSOLETE57              <obsolete error code>
+SSL_CERTPROBLEM         <SSL problem with the local certificate>
+SSL_CIPHER              <SSL CIPHER, could not use specified cipher>
+SSL_CACERT              <SSL CACERT, problem with the CA cert (path?)>
+BAD_CONTENT_ENCODING    <unrecognized transfer encoding>
+LDAP_INVALID_URL        <LDAP invalid url>
+FILESIZE_EXCEEDED       <maximum file size exceeded>
+USE_SSL_FAILED          <requested FTP SSL level failed>
+SEND_FAIL_REWIND        <sending data requires a rewind that failed>
+SSL_ENGINE_INITFAILED   <failed to initialize ENGINE>
+LOGIN_DENIED            <user or password not accepted. failed to login>
+TFTP_NOTFOUND           <file not found on server>
+TFTP_PERM               <permission problem on server>
+REMOTE_DISK_FULL        <out of disk space on server>
+TFTP_ILLEGAL            <illegal TFTP operation>
+TFTP_UNKNOWNID          <unknown transfer ID>
+REMOTE_FILE_EXISTS      <file already exists>
+TFTP_NOSUCHUSER         <no such user>
+CONV_FAILED             <conversion failed>
+CONV_REQD               <caller must register conversion callbacks>
+SSL_CACERT_BADFILE      <could not load CACERT file>
+REMOTE_FILE_NOT_FOUND   <remote file not found>
+SSH                     <unspecified error from the SSH layer>
+SSL_SHUTDOWN_FAILED     <failed to shut down the SSL connection>
+AGAIN                   <socket not ready, wait and try again>
+SSL_CRL_BADFILE         <could not load CRL file, missing or wrong format>
+SSL_ISSUER_ERROR        <issuer check failed>
+CURL_LAST               <CURLMSG.MSG is out of sync with the source code>
+
+.END
diff --git a/third-party/curl/packages/vms/curlmsg.sdl b/third-party/curl/projects/vms/curlmsg.sdl
similarity index 100%
rename from third-party/curl/packages/vms/curlmsg.sdl
rename to third-party/curl/projects/vms/curlmsg.sdl
diff --git a/third-party/curl/projects/vms/curlmsg_vms.h b/third-party/curl/projects/vms/curlmsg_vms.h
new file mode 100644
index 0000000000..83af6400f0
--- /dev/null
+++ b/third-party/curl/projects/vms/curlmsg_vms.h
@@ -0,0 +1,129 @@
+#ifndef HEADER_CURLMSG_VMS_H
+#define HEADER_CURLMSG_VMS_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+/*                                                                          */
+/* CURLMSG_VMS.H                                                            */
+/*                                                                          */
+/* This defines the necessary bits to change CURLE_* error codes to VMS     */
+/* style error codes.  CURLMSG.H is built from CURLMSG.SDL which is built   */
+/* from CURLMSG.MSG.  The vms_cond array is used to return VMS errors by    */
+/* putting the VMS error codes into the array offset based on CURLE_* code. */
+/*                                                                          */
+/* If you update CURLMSG.MSG make sure to update this file to match.        */
+/*                                                                          */
+
+#include "curlmsg.h"
+
+static const long vms_cond[] =
+{
+  CURL_OK,
+  CURL_UNSUPPORTED_PROTOCOL,
+  CURL_FAILED_INIT,
+  CURL_URL_MALFORMAT,
+  CURL_OBSOLETE4,
+  CURL_COULDNT_RESOLVE_PROXY,
+  CURL_COULDNT_RESOLVE_HOST,
+  CURL_COULDNT_CONNECT,
+  CURL_WEIRD_SERVER_REPLY,
+  CURL_FTP_ACCESS_DENIED,
+  CURL_OBSOLETE10,
+  CURL_FTP_WEIRD_PASS_REPLY,
+  CURL_OBSOLETE12,
+  CURL_FTP_WEIRD_PASV_REPLY,
+  CURL_FTP_WEIRD_227_FORMAT,
+  CURL_FTP_CANT_GET_HOST,
+  CURL_OBSOLETE16,
+  CURL_FTP_COULDNT_SET_TYPE,
+  CURL_PARTIAL_FILE,
+  CURL_FTP_COULDNT_RETR_FILE,
+  CURL_OBSOLETE20,
+  CURL_QUOTE_ERROR,
+  CURL_HTTP_RETURNED_ERROR,
+  CURL_WRITE_ERROR,
+  CURL_OBSOLETE24,
+  CURL_UPLOAD_FAILED,
+  CURL_READ_ERROR,
+  CURL_OUT_OF_MEMORY,
+  CURL_OPERATION_TIMEOUTED,
+  CURL_OBSOLETE29,
+  CURL_FTP_PORT_FAILED,
+  CURL_FTP_COULDNT_USE_REST,
+  CURL_OBSOLETE32,
+  CURL_RANGE_ERROR,
+  CURL_HTTP_POST_ERROR,
+  CURL_SSL_CONNECT_ERROR,
+  CURL_BAD_DOWNLOAD_RESUME,
+  CURL_FILE_COULDNT_READ_FILE,
+  CURL_LDAP_CANNOT_BIND,
+  CURL_LDAP_SEARCH_FAILED,
+  CURL_OBSOLETE40,
+  CURL_FUNCTION_NOT_FOUND,
+  CURL_ABORTED_BY_CALLBACK,
+  CURL_BAD_FUNCTION_ARGUMENT,
+  CURL_OBSOLETE44,
+  CURL_INTERFACE_FAILED,
+  CURL_OBSOLETE46,
+  CURL_TOO_MANY_REDIRECTS,
+  CURL_UNKNOWN_TELNET_OPTION,
+  CURL_TELNET_OPTION_SYNTAX,
+  CURL_OBSOLETE50,
+  CURL_PEER_FAILED_VERIF,
+  CURL_GOT_NOTHING,
+  CURL_SSL_ENGINE_NOTFOUND,
+  CURL_SSL_ENGINE_SETFAILED,
+  CURL_SEND_ERROR,
+  CURL_RECV_ERROR,
+  CURL_OBSOLETE57,
+  CURL_SSL_CERTPROBLEM,
+  CURL_SSL_CIPHER,
+  CURL_SSL_CACERT,
+  CURL_BAD_CONTENT_ENCODING,
+  CURL_LDAP_INVALID_URL,
+  CURL_FILESIZE_EXCEEDED,
+  CURL_USE_SSL_FAILED,
+  CURL_SEND_FAIL_REWIND,
+  CURL_SSL_ENGINE_INITFAILED,
+  CURL_LOGIN_DENIED,
+  CURL_TFTP_NOTFOUND,
+  CURL_TFTP_PERM,
+  CURL_REMOTE_DISK_FULL,
+  CURL_TFTP_ILLEGAL,
+  CURL_TFTP_UNKNOWNID,
+  CURL_REMOTE_FILE_EXISTS,
+  CURL_TFTP_NOSUCHUSER,
+  CURL_CONV_FAILED,
+  CURL_CONV_REQD,
+  CURL_SSL_CACERT_BADFILE,
+  CURL_REMOTE_FILE_NOT_FOUND,
+  CURL_SSH,
+  CURL_SSL_SHUTDOWN_FAILED,
+  CURL_AGAIN,
+  CURLE_SSL_CRL_BADFILE,
+  CURLE_SSL_ISSUER_ERROR,
+  CURL_CURL_LAST
+};
+
+#endif /* HEADER_CURLMSG_VMS_H */
diff --git a/third-party/curl/packages/vms/generate_config_vms_h_curl.com b/third-party/curl/projects/vms/generate_config_vms_h_curl.com
similarity index 83%
rename from third-party/curl/packages/vms/generate_config_vms_h_curl.com
rename to third-party/curl/projects/vms/generate_config_vms_h_curl.com
index 99a39c8441..6e78b801f2 100644
--- a/third-party/curl/packages/vms/generate_config_vms_h_curl.com
+++ b/third-party/curl/projects/vms/generate_config_vms_h_curl.com
@@ -1,6 +1,6 @@
 $! File: GENERATE_CONFIG_H_CURL.COM
 $!
-$! Curl like most open source products uses a variant of a config.h file.
+$! curl like most open source products uses a variant of a config.h file.
 $! Depending on the curl version, this could be config.h or curl_config.h.
 $!
 $! For GNV based builds, the configure script is run and that produces
@@ -67,12 +67,12 @@ $if f$locate(",nossl,", args_lower) .lt. args_len then nossl = 1
 $if .not. nossl
 $then
 $!
-$!  ssl$* logicals means HP ssl is present
+$!  ssl$* logicals means HP SSL is present
 $!----------------------------------------
 $   if f$trnlnm("ssl$root") .nes. ""
 $   then
-$	nohpssl = 0
-$	hpssl = 1
+$       nohpssl = 0
+$       hpssl = 1
 $   endif
 $!
 $!  HP defines OPENSSL as SSL$INCLUDE as a convenience for linking.
@@ -83,25 +83,25 @@ $!------------------------------------
 $   openssl_lnm = f$trnlnm("OPENSSL")
 $   if (openssl_lnm .nes. "SYS$INCLUDE")
 $   then
-$!	Non HP SSL is installed, default to use it.
-$	nohpssl = 1
-$	hpssl = 0
+$!      Non HP SSL is installed, default to use it.
+$       nohpssl = 1
+$       hpssl = 0
 $   endif
 $!
 $!  Now check to see if hpssl has been specifically disabled
 $!----------------------------------------------------------
 $   if f$locate(",nohpssl,", args_lower) .lt. args_len
 $   then
-$	nohpssl = 1
-$	hpssl = 0
+$       nohpssl = 1
+$       hpssl = 0
 $   endif
 $!
-$!  Finally check to see if hp ssl has been specifically included.
+$!  Finally check to see if HP SSL has been specifically included.
 $!----------------------------------------------------------------
 $   if f$locate(",nohpssl,", args_lower) .lt. args_len
 $   then
-$	nohpssl = 1
-$	hpssl = 0
+$       nohpssl = 1
+$       hpssl = 0
 $   endif
 $endif
 $!
@@ -113,14 +113,14 @@ $   write sys$output "NOTICE:  A LIBIDN port has been detected."
 $   write sys$output " This port of curl for VMS has not been tested with it."
 $   if f$locate(",libidn,", args_lower) .lt. args_len
 $   then
-$	libidn = 1
+$       libidn = 1
 $   endif
 $   if .not. libidn
 $   then
-$	write sys$output " LIBIDN support is not enabled."
-$	write sys$output "Run with the ""libidn"" parameter to attempt to use."
+$       write sys$output " LIBIDN support is not enabled."
+$       write sys$output "Run with the ""libidn"" parameter to attempt to use."
 $   else
-$	write sys$output " Untested LIBIDN support requested."
+$       write sys$output " Untested LIBIDN support requested."
 $   endif
 $endif
 $!
@@ -132,14 +132,14 @@ $   write sys$output "NOTICE:  A LIBSSH2 port has been detected."
 $   write sys$output " This port of curl for VMS has not been tested with it."
 $   if f$locate(",libssh2,", args_lower) .lt. args_len
 $   then
-$	libssh2 = 1
+$       libssh2 = 1
 $   endif
 $   if .not. libssh2
 $   then
-$	write sys$output " LIBSSH2 support is not enabled."
-$	write sys$output "Run with the ""libssh2"" parameter to attempt to use."
+$       write sys$output " LIBSSH2 support is not enabled."
+$       write sys$output "Run with the ""libssh2"" parameter to attempt to use."
 $   else
-$	write sys$output " Untested LIBSSH2 support requested."
+$       write sys$output " Untested LIBSSH2 support requested."
 $   endif
 $endif
 $!
@@ -159,7 +159,7 @@ $then
 $!  If kerberos is installed: sys$share:gss$rtl.exe exists.
 $   if f$search("sys$shsare:gss$rtl.exe") .eqs. ""
 $   then
-$	nokerberos = 1
+$       nokerberos = 1
 $   endif
 $endif
 $!
@@ -170,13 +170,13 @@ $if f$trnlnm("GNV$LIBZSHR") .nes. ""
 $then
 $   if f$locate(",nozlib,", args_lower) .lt. args_len
 $   then
-$	nozlib = 1
+$       nozlib = 1
 $   endif
 $!   if .not. nozlib
 $!   then
-$!	write sys$output " GNV$LIBZSHR support is enabled."
+$!      write sys$output " GNV$LIBZSHR support is enabled."
 $!   else
-$!	write sys$output " GNV$LIBZSHR support is disabled by nozlib."
+$!      write sys$output " GNV$LIBZSHR support is disabled by nozlib."
 $!   endif
 $else
 $   nozlib = 1
@@ -197,36 +197,27 @@ $write cvh "#define __CONFIG_VMS_H__"
 $write cvh ""
 $write cvh "/* Define cpu-machine-OS */"
 $!
-$! Curl uses an OS macro to set the build environment.
+$! curl uses an OS macro to set the build environment.
 $!----------------------------------------------------
 $! Now the DCL builds usually say xxx-HP-VMS and configure scripts
 $! may put DEC or COMPAQ or HP for the middle part.
 $!
 $write cvh "#if defined(__alpha)"
-$write cvh "#define OS ""ALPHA-HP-VMS"""
+$write cvh "#define CURL_OS ""ALPHA-HP-VMS"""
 $write cvh "#elif defined(__vax)"
-$write cvh "#define OS ""VAX-HP-VMS"""
+$write cvh "#define CURL_OS ""VAX-HP-VMS"""
 $write cvh "#elif defined(__ia64)"
-$write cvh "#define OS ""IA64-HP-VMS""
+$write cvh "#define CURL_OS ""IA64-HP-VMS""
 $write cvh "#else"
-$write cvh "#define OS ""UNKNOWN-HP-VMS""
+$write cvh "#define CURL_OS ""UNKNOWN-HP-VMS""
 $write cvh "#endif"
 $write cvh ""
 $!
 $! We are now setting this on the GNV build, so also do this
 $! for compatibility.
-$write cvh "/* Location of default ca path */"
+$write cvh "/* Location of default CA path */"
 $write cvh "#define curl_ca_path ""gnv$curl_ca_path"""
 $!
-$! NTLM_WB_ENABLED requires fork() but configure does not know this
-$! We have to disable this in the configure command line.
-$! config_h.com finds that configure defaults to it being enabled so
-$! reports it.  So we need to turn it off here.
-$!
-$write cvh "#ifdef NTLM_WB_ENABLED"
-$write cvh "#undef NTLM_WB_ENABLED"
-$write cvh "#endif"
-$!
 $! The config_h.com finds a bunch of default disable commands in
 $! configure and will incorrectly disable these options.  The config_h.com
 $! is a generic procedure and it would break more things to try to fix it
@@ -262,24 +253,18 @@ $   write cvh "#undef CURL_DISABLE_LDAP"
 $   write cvh "#endif"
 $   if .not. nossl
 $   then
-$	write cvh "#ifdef CURL_DISABLE_LDAPS"
-$	write cvh "#undef CURL_DISABLE_LDAPS"
-$	write cvh "#endif"
+$       write cvh "#ifdef CURL_DISABLE_LDAPS"
+$       write cvh "#undef CURL_DISABLE_LDAPS"
+$       write cvh "#endif"
 $   endif
 $endif
 $write cvh "#ifdef CURL_DISABLE_LIBCURL_OPTION"
 $write cvh "#undef CURL_DISABLE_LIBCURL_OPTION"
 $write cvh "#endif"
 $write cvh "#ifndef __VAX"
-$write cvh "#ifdef CURL_DISABLE_NTLM"
-$write cvh "#undef CURL_DISABLE_NTLM"
-$write cvh "#endif"
 $write cvh "#else"
 $! NTLM needs long long or int64 support, missing from DECC C.
 $write cvh "#ifdef __DECC
-$write cvh "#ifndef CURL_DISABLE_NTLM"
-$write cvh "#define CURL_DISABLE_NTLM 1"
-$write cvh "#endif"
 $write cvh "#endif"
 $write cvh "#endif"
 $write cvh "#ifdef CURL_DISABLE_POP3"
@@ -324,9 +309,6 @@ $write cvh "#endif"
 $write cvh "#ifdef USE_GNUTLS"
 $write cvh "#undef USE_GNUTLS"
 $write cvh "#endif"
-$write cvh "#ifdef USE_LIBRTMP"
-$write cvh "#undef USE_LIBRTMP"
-$write cvh "#endif"
 $write cvh "#ifdef USE_MANUAL"
 $write cvh "#undef USE_MANUAL"
 $write cvh "#endif"
@@ -336,8 +318,8 @@ $write cvh "#endif"
 $write cvh "#ifdef USE_OPENLDAP"
 $write cvh "#undef USE_OPENLDAP"
 $write cvh "#endif"
-$write cvh "#ifdef USE_THREADS_POSIX"
-$write cvh "#undef USE_THREADS_POSIX"
+$write cvh "#ifdef USE_RESOLV_THREADED"
+$write cvh "#undef USE_RESOLV_THREADED"
 $write cvh "#endif"
 $write cvh "#ifdef USE_TLS_SRP"
 $write cvh "#undef USE_TLS_SRP"
@@ -346,11 +328,6 @@ $write cvh "#ifdef USE_UNIX_SOCKETS"
 $write cvh "#undef USE_UNIX_SOCKETS"
 $write cvh "#endif"
 $!
-$write cvh "#ifndef HAVE_OLD_GSSMIT"
-$write cvh "#define gss_nt_service_name GSS_C_NT_HOSTBASED_SERVICE"
-$write cvh "#endif"
-$!
-$!
 $! Note:
 $! The CURL_EXTERN_SYMBOL is used for platforms that need the compiler
 $! to know about universal symbols.  VMS does not need this support so
@@ -359,7 +336,7 @@ $!
 $!
 $! I can not figure out where the C compiler is finding the ALLOCA.H file
 $! in the text libraries, so CONFIG_H.COM can not find it either.
-$! Usually the header file name is the module name in the text library.
+$! Usually the header filename is the module name in the text library.
 $! It does not appear to hurt anything to not find header file, so we
 $! are not overriding it here.
 $!
@@ -394,7 +371,7 @@ $   endif
 $endif
 $!
 $!
-$! LibIDN not ported to VMS at this time.
+$! libidn not ported to VMS at this time.
 $! This is for international domain name support.
 $! Allow explicit experimentation.
 $if libidn
@@ -410,7 +387,7 @@ $   write cvh "#endif"
 $endif
 $!
 $!
-$! LibSSH2 not ported to VMS at this time.
+$! libssh2 not ported to VMS at this time.
 $! Allow explicit experimentation.
 $if libssh2
 $then
diff --git a/third-party/curl/packages/vms/generate_vax_transfer.com b/third-party/curl/projects/vms/generate_vax_transfer.com
similarity index 100%
rename from third-party/curl/packages/vms/generate_vax_transfer.com
rename to third-party/curl/projects/vms/generate_vax_transfer.com
diff --git a/third-party/curl/packages/vms/gnv_conftest.c_first b/third-party/curl/projects/vms/gnv_conftest.c_first
similarity index 97%
rename from third-party/curl/packages/vms/gnv_conftest.c_first
rename to third-party/curl/projects/vms/gnv_conftest.c_first
index 317b1abfc7..a40f763a19 100644
--- a/third-party/curl/packages/vms/gnv_conftest.c_first
+++ b/third-party/curl/projects/vms/gnv_conftest.c_first
@@ -35,7 +35,7 @@ char RAND_status(void) {return 0;}
 /* char RAND_screen(void) {return 0;} In headers, but not present */
 char CRYPTO_cleanup_all_ex_data(void) {return 0;}
 char SSL_get_shutdown(void) {return 0;}
-char ENGINE_load_builtin_engines (void) {return 0;}
+char ENGINE_load_builtin_engines(void) {return 0;}
 
 /* And these are to pass the test that uses headers. */
 /* Because the HP OpenSSL transfer vectors are currently in Upper case only */
diff --git a/third-party/curl/packages/vms/gnv_curl_configure.sh b/third-party/curl/projects/vms/gnv_curl_configure.sh
similarity index 85%
rename from third-party/curl/packages/vms/gnv_curl_configure.sh
rename to third-party/curl/projects/vms/gnv_curl_configure.sh
index 21558001ed..5f2038f87c 100644
--- a/third-party/curl/packages/vms/gnv_curl_configure.sh
+++ b/third-party/curl/projects/vms/gnv_curl_configure.sh
@@ -1,6 +1,6 @@
 # File: gnv_curl_configure.sh
 #
-# Set up and run the configure script for Curl so that it can find the
+# Set up and run the configure script for curl so that it can find the
 # proper options for VMS.
 #
 # Copyright (C) John Malmberg
@@ -38,7 +38,7 @@ export GNV_CC_QUALIFIERS=/STANDARD=RELAXED
 cd ../..
 #
 #
-./configure  --prefix=/usr --exec-prefix=/usr --disable-dependency-tracking \
- --disable-libtool-lock --with-gssapi --disable-ntlm-wb \
- --with-ca-path=gnv\$curl_ca_path
+./configure --prefix=/usr --exec-prefix=/usr --disable-dependency-tracking \
+  --disable-libtool-lock --with-gssapi --disable-ntlm-wb \
+  --with-ca-path=gnv\$curl_ca_path
 #
diff --git a/third-party/curl/packages/vms/gnv_libcurl_symbols.opt b/third-party/curl/projects/vms/gnv_libcurl_symbols.opt
similarity index 100%
rename from third-party/curl/packages/vms/gnv_libcurl_symbols.opt
rename to third-party/curl/projects/vms/gnv_libcurl_symbols.opt
diff --git a/third-party/curl/packages/vms/gnv_link_curl.com b/third-party/curl/projects/vms/gnv_link_curl.com
similarity index 95%
rename from third-party/curl/packages/vms/gnv_link_curl.com
rename to third-party/curl/projects/vms/gnv_link_curl.com
index 4959f1babe..330613b76d 100644
--- a/third-party/curl/packages/vms/gnv_link_curl.com
+++ b/third-party/curl/projects/vms/gnv_link_curl.com
@@ -70,20 +70,20 @@ $!
 $!
 $! Build the Message file.
 $!--------------------------
-$ if f$search("[.packages.vms]curlmsg.obj") .eqs. ""
+$ if f$search("[.projects.vms]curlmsg.obj") .eqs. ""
 $ then
-$   message [.packages.vms]curlmsg.msg/object=[.packages.vms]
+$   message [.projects.vms]curlmsg.msg/object=[.projects.vms]
 $ endif
 $ if f$search("gnv$curlmsg.exe") .eqs. ""
 $ then
-$   link/share=gnv$curlmsg.exe [.packages.vms]curlmsg.obj
+$   link/share=gnv$curlmsg.exe [.projects.vms]curlmsg.obj
 $ endif
 $!
 $!
 $! Need to build the common init module.
 $!-------------------------------------------
 $ cflags = "/list/show=(expan,includ)"
-$ init_obj = "[.packages.vms]curl_crtl_init.obj"
+$ init_obj = "[.projects.vms]curl_crtl_init.obj"
 $ if f$search(init_obj) .eqs. ""
 $ then
 $   cc'cflags' 'default_dir'curl_crtl_init.c/obj='init_obj'
@@ -96,7 +96,7 @@ $! Need to build the module to test the HP OpenSSL version
 $!--------------------------------------------------------
 $ if arch_name .nes. "VAX"
 $ then
-$   rpt_obj = "[.packages.vms]report_openssl_version.obj
+$   rpt_obj = "[.projects.vms]report_openssl_version.obj
 $   if f$search(rpt_obj) .eqs. ""
 $   then
 $       cc'cflags' 'default_dir'report_openssl_version.c/obj='rpt_obj'
@@ -109,12 +109,12 @@ $   report_openssl_version := $'default_dir'report_openssl_version.exe
 $ endif
 $!
 $!
-$ base_link_opt_file = "[.packages.vms.''arch_name']gnv_libcurl_linker.opt"
-$ share_link_opt_file = "[.packages.vms.''arch_name']gnv_ssl_libcurl_linker.opt"
+$ base_link_opt_file = "[.projects.vms.''arch_name']gnv_libcurl_linker.opt"
+$ share_link_opt_file = "[.projects.vms.''arch_name']gnv_ssl_libcurl_linker.opt"
 $ if f$search(base_link_opt_file) .eqs. ""
 $ then
-$   base_link_opt_file = "[.packages.vms]gnv_libcurl_linker.opt"
-$   share_link_opt_file = "[.packages.vms]gnv_ssl_libcurl_linker.opt"
+$   base_link_opt_file = "[.projects.vms]gnv_libcurl_linker.opt"
+$   share_link_opt_file = "[.projects.vms]gnv_ssl_libcurl_linker.opt"
 $   if f$search(base_link_opt_file) .eqs. ""
 $   then
 $       write sys$output "Can not find base library option file!"
@@ -123,7 +123,7 @@ $   endif
 $ endif
 $!
 $! Create the a new option file with special fixup for HP SSL
-$! For a shared image, we always want ZLIB and 32 bit HPSSL
+$! For a shared image, we always want ZLIB and 32-bit HPSSL
 $!
 $ if f$search("gnv$libzshr32") .eqs. ""
 $ then
@@ -259,7 +259,7 @@ This package is built on with the OpenSSL version listed below and requires
 the shared images from the HP OpenSSL product that is kitted with that
 version or a compatible later version.
 
-For Alpha and IA64 platforms, see the url below to register to get the
+For Alpha and IA64 platforms, see the URL below to register to get the
 download URL.  The kit will be HP 1.4-467 or later.
   https://h41379.www4.hpe.com/openvms/products/ssl/ssl.html
 
@@ -269,10 +269,10 @@ download URLs provided and put in CPQ-VAXVMS-SSL-V0101-B-1.PCSI-DCX_VAXEXE
 If your system can not be upgraded to a compatible version of OpenSSL, then
 you can extract the two shared images from the kit and place them in the
 [vms$common.gnv.lib]directory of the volume that you are installing GNV and
-or GNV compatible components like Curl.
+or GNV compatible components like curl.
 
 If GNV is installed, you must run the GNV startup procedure before these steps
-and before installing Curl.
+and before installing curl.
 
 
   1.  make sure that [vms$common.gnv.lib] exists by using the following
@@ -343,7 +343,7 @@ $ endif
 $!
 $! DCL build puts curllib in architecture directory
 $! GNV build uses the makefile.
-$ libfile = "[.packages.vms.''arch_name']curllib.olb"
+$ libfile = "[.projects.vms.''arch_name']curllib.olb"
 $ if f$search(libfile) .nes. ""
 $ then
 $   olb_file = libfile
@@ -387,8 +387,8 @@ $!
 $ if f$search("[.src]curl-tool_main.o") .nes. ""
 $ then
 $!  From src/makefile.inc:
-$!  # libcurl has sources that provide functions named curlx_* that aren't
-$!  # part of the official API, but we re-use the code here to avoid
+$!  # libcurl has sources that provide functions named curlx_* that are not
+$!  # part of the official API, but we reuse the code here to avoid
 $!  # duplication.
 $!
 $!
@@ -396,10 +396,11 @@ $   if f$search("[.src]curl.exe") .eqs. ""
 $   then
 $       define/user gnv$libcurl 'gnv_libcurl_share'
 $       link'ldebug'/exe=[.src]curl.exe/dsf=[.src]curl.dsf -
-           [.src]curl-tool_main.o, [.src]curl-tool_binmode.o, -
+           [.src]curl-tool_main.o, -
            [.src]curl-tool_bname.o, [.src]curl-tool_cb_dbg.o, -
            [.src]curl-tool_cb_hdr.o, [.src]curl-tool_cb_prg.o, -
            [.src]curl-tool_cb_rea.o, [.src]curl-tool_cb_see.o, -
+           [.src]curl-tool_cb_soc.o, -
            [.src]curl-tool_cb_wrt.o, [.src]curl-tool_cfgable.o, -
            [.src]curl-tool_convert.o, [.src]curl-tool_dirhie.o, -
            [.src]curl-tool_doswin.o, [.src]curl-tool_easysrc.o, -
@@ -411,11 +412,10 @@ $       link'ldebug'/exe=[.src]curl.exe/dsf=[.src]curl.dsf -
            [.src]curl-tool_msgs.o, [.src]curl-tool_operate.o, -
            [.src]curl-tool_operhlp.o, -
            [.src]curl-tool_paramhlp.o, [.src]curl-tool_parsecfg.o, -
-           [.src]curl-tool_setopt.o, [.src]curl-tool_sleep.o, -
+           [.src]curl-tool_setopt.o, -
            [.src]curl-tool_urlglob.o, [.src]curl-tool_util.o, -
            [.src]curl-tool_vms.o, [.src]curl-tool_writeenv.o, -
            [.src]curl-tool_writeout.o, [.src]curl-tool_xattr.o, -
-           [.src]curl-strtoofft.o, [.src]curl-strdup.o, [.src]curl-strcase.o, -
            [.src]curl-nonblock.o, gnv_packages_vms:curlmsg.obj,-
            sys$input:/opt
 gnv$libcurl/share
@@ -424,9 +424,9 @@ $   endif
 $ else
 $   curl_exe = "[.src]curl.exe"
 $   curl_dsf = "[.src]curl.dsf"
-$   curl_main = "[.packages.vms.''arch_name']tool_main.obj"
-$   curl_src = "[.packages.vms.''arch_name']curlsrc.olb"
-$   curl_lib = "[.packages.vms.''arch_name']curllib.olb"
+$   curl_main = "[.projects.vms.''arch_name']tool_main.obj"
+$   curl_src = "[.projects.vms.''arch_name']curlsrc.olb"
+$   curl_lib = "[.projects.vms.''arch_name']curllib.olb"
 $   strcase = "strcase"
 $   nonblock = "nonblock"
 $   warnless = "warnless"
diff --git a/third-party/curl/packages/vms/macro32_exactcase.patch b/third-party/curl/projects/vms/macro32_exactcase.patch
similarity index 100%
rename from third-party/curl/packages/vms/macro32_exactcase.patch
rename to third-party/curl/projects/vms/macro32_exactcase.patch
diff --git a/third-party/curl/packages/vms/make_gnv_curl_install.sh b/third-party/curl/projects/vms/make_gnv_curl_install.sh
similarity index 94%
rename from third-party/curl/packages/vms/make_gnv_curl_install.sh
rename to third-party/curl/projects/vms/make_gnv_curl_install.sh
index b85ef0ced2..623fcc3a6b 100644
--- a/third-party/curl/packages/vms/make_gnv_curl_install.sh
+++ b/third-party/curl/projects/vms/make_gnv_curl_install.sh
@@ -1,6 +1,6 @@
 # File: make_gnv_curl_install.sh
 #
-# Set up and run the make script for Curl.
+# Set up and run the make script for curl.
 #
 # This makes the library, the curl binary and attempts an install.
 # A search list should be set up for GNU (GNV$GNU).
@@ -37,7 +37,7 @@ export GNV_CC_MAIN_POSIX_EXIT=1
 make
 cd ../..
 # adjust the libcurl.pc file, GNV currently ignores the Lib: line.
-# but is noisy about it, so we just remove it.
+# but is noisy about it, so we remove it.
 sed -e 's/^Libs:/#Libs:/g' libcurl.pc > libcurl.pc_new
 rm libcurl.pc
 mv libcurl.pc_new libcurl.pc
diff --git a/third-party/curl/packages/vms/make_pcsi_curl_kit_name.com b/third-party/curl/projects/vms/make_pcsi_curl_kit_name.com
similarity index 98%
rename from third-party/curl/packages/vms/make_pcsi_curl_kit_name.com
rename to third-party/curl/projects/vms/make_pcsi_curl_kit_name.com
index 956f7c1677..c7c2b26ada 100644
--- a/third-party/curl/packages/vms/make_pcsi_curl_kit_name.com
+++ b/third-party/curl/projects/vms/make_pcsi_curl_kit_name.com
@@ -67,7 +67,7 @@ $ write sys$output "*****"
 $!
 $!
 $! Base is one of 'VMS', 'AXPVMS', 'I64VMS', 'VAXVMS' and indicates what
-$! binaries are in the kit.  A kit with just 'VMS' can be installed on all
+$! binaries are in the kit.  A kit with only 'VMS' can be installed on all
 $! architectures.
 $!
 $ base = "VMS"
diff --git a/third-party/curl/packages/vms/pcsi_gnv_curl_file_list.txt b/third-party/curl/projects/vms/pcsi_gnv_curl_file_list.txt
similarity index 98%
rename from third-party/curl/packages/vms/pcsi_gnv_curl_file_list.txt
rename to third-party/curl/projects/vms/pcsi_gnv_curl_file_list.txt
index 586f7e7675..9ae49d5977 100644
--- a/third-party/curl/packages/vms/pcsi_gnv_curl_file_list.txt
+++ b/third-party/curl/projects/vms/pcsi_gnv_curl_file_list.txt
@@ -1,7 +1,7 @@
 ! File: PCSI_GNV_CURL_FILE_LIST.TXT
 !
 ! File list for building a PCSI kit.
-! Very simple format so that the parsing logic can be simple.
+! Simple format so that the parsing logic can be simple.
 ! links first, directory second, and files third.
 !
 ! link -> file tells procedure to create/remove a link on install/uninstall
diff --git a/third-party/curl/packages/vms/pcsi_product_gnv_curl.com b/third-party/curl/projects/vms/pcsi_product_gnv_curl.com
similarity index 95%
rename from third-party/curl/packages/vms/pcsi_product_gnv_curl.com
rename to third-party/curl/projects/vms/pcsi_product_gnv_curl.com
index 83d8fa3b66..15ab32f317 100644
--- a/third-party/curl/packages/vms/pcsi_product_gnv_curl.com
+++ b/third-party/curl/projects/vms/pcsi_product_gnv_curl.com
@@ -1,6 +1,6 @@
 $! File: PCSI_PRODUCT_GNV_CURL.COM
 $!
-$! This command file packages up the product CURL into a sequential
+$! This command file packages up the product curl into a sequential
 $! format kit
 $!
 $! Copyright (C) John Malmberg
@@ -66,7 +66,7 @@ $ arch_name = f$edit(f$getsyi("arch_name"),"UPCASE")
 $ if f$search("[--.src]curl.exe") .eqs. ""
 $ then
 $   build_it = 1
-$   libfile = "[.packages.vms.''arch_name']curllib.olb"
+$   libfile = "[.projects.vms.''arch_name']curllib.olb"
 $   if f$search(libfile) .nes. ""
 $   then
 $       build_it = 0
@@ -85,8 +85,8 @@ $   endif
 $   @gnv_link_curl.com
 $ endif
 $!
-$! Make sure that the release note file name is up to date
-$!---------------------------------------------------------
+$! Make sure that the release note filename is up to date
+$!--------------------------------------------------------
 $ @BUILD_GNV_CURL_RELEASE_NOTES.COM
 $!
 $!
diff --git a/third-party/curl/packages/vms/readme b/third-party/curl/projects/vms/readme
similarity index 90%
rename from third-party/curl/packages/vms/readme
rename to third-party/curl/projects/vms/readme
index 0bb61663c1..9db0ee3873 100644
--- a/third-party/curl/packages/vms/readme
+++ b/third-party/curl/projects/vms/readme
@@ -7,7 +7,7 @@
 
 History:
 
- 9-MAR-2004, Created this readme. file.  Marty Kuhrt (MSK).
+09-MAR-2004, Created this readme. file.  Marty Kuhrt (MSK).
 15-MAR-2004, MSK, Updated to reflect the new files in this directory.
 14-FEB-2005, MSK, removed config-vms.h_with* file comments
 10-FEB-2010, SMS. General update.
@@ -19,9 +19,9 @@ curl_gnv_build_steps.txt and other useful information.
 
 Prerequisites:
 
-OpenVMS V7.0 or later (any platform)
-DECC V6.5 or later
-OpenSSL or hp SSL, if you want SSL support
+OpenVMS v7.0 or later (any platform)
+DECC v6.5 or later
+OpenSSL or HP SSL, if you want SSL support
 
 What is Here:
 
@@ -138,7 +138,7 @@ pcsi_product_gnv_curl.com
 readme.                 This file.
 
 report_openssl_version.c
-                        Program to check that the openssl version is new
+                        Program to check that the OpenSSL version is new
                         enough for building a shared libcurl image.
 
 setup_gnv_curl_build.com
@@ -161,7 +161,7 @@ and you must make sure that none of the build files are present before
 running a different type of build.  Use the "REALCLEAN" option for
 BUILD_VMS.COM and the "REALCLEAN" option for clean_gnv_curl.com.
 
-The (brute-force) DCL based builder is [.packages.vms]build_vms.com.
+The (brute-force) DCL based builder is [.projects.vms]build_vms.com.
 Comments in this procedure describe various optional parameters which
 enable or disable optional program features, or which control the build
 in other ways.  Product files (.EXE, .H, .LIS, .MAP, .OBJ, .OLB, ...)
@@ -173,7 +173,7 @@ the GNV tool kit, building a shared libcurl, and producing a PCSI kit for
 distribution.  The curl_gnv_build_steps.text is included in the release
 notes file of the PCSI kit.
 
-The building with 64 bit pointers does not currently work.
+The building with 64-bit pointers does not currently work.
 
 The build procedure will detect if HP OpenSSL, LDAP, and Kerberos are
 installed and default to building with them.
@@ -183,9 +183,9 @@ is installed from a PCSI kit and default to using it.
 
    Example build commands:
 
-      @ [.packages.vms]build_vms.com CLEAN
-      @ [.packages.vms]build_vms.com LARGE LDAP
-      submit /noprint [.packages.vms]build_vms.com /param = (LARGE, LDAP)
+      @ [.projects.vms]build_vms.com CLEAN
+      @ [.projects.vms]build_vms.com LARGE LDAP
+      submit /noprint [.projects.vms]build_vms.com /param = (LARGE, LDAP)
 
 The build_vms.com procedure does not build the shared image file or the PCSI
 kit.  If you have built a curl with ZLIB and HPSSL support as well as if
@@ -202,17 +202,17 @@ Other Notes:
 This release fixes known bugs #22, and #57 in the [curl.docs]known_bugs.
 file.
 
-The libcurl formdata.c module and Curl tools post form now have some
+The libcurl formdata.c module and curl tools post form now have some
 understanding of VMS file types.  Files will be posted in STREAM_LF format.
 
-The Curl tool now has some understanding of VMS file types and will upload the
+The curl tool now has some understanding of VMS file types and will upload the
 files in STREAM_LF format.
 
-When CURL is uploading a VARIABLE format VMS file, it is less efficient as in
+When curl is uploading a VARIABLE format VMS file, it is less efficient as in
 order to get the file size, it will first read the entire file once, and then
 read the file again for the actual upload.
 
-The Curl tool will now always download files into STREAM_LF format.  Even if a
+The curl tool will now always download files into STREAM_LF format.  Even if a
 file by that name with a different format already exists.  This is needed to
 allow interrupted downloads to be continued.
 
@@ -225,4 +225,4 @@ The test suites are not supported as of 7.11.0.
 The curlmsg.sdl and curlmsg.h files are generated from curlmsg.msg.
 This is not done automatically, since the .MSG file is a hand edit
 of the relevant stuff from the curl.h file.  If you want to do this
-yourself you'll need the SDL package from the freeware collection.
+yourself you need the SDL package from the freeware collection.
diff --git a/third-party/curl/projects/vms/report_openssl_version.c b/third-party/curl/projects/vms/report_openssl_version.c
new file mode 100644
index 0000000000..d2b0d367bc
--- /dev/null
+++ b/third-party/curl/projects/vms/report_openssl_version.c
@@ -0,0 +1,98 @@
+/* File: report_openssl_version.c
+ *
+ * This file dynamically loads the OpenSSL shared image to report the
+ * version string.
+ *
+ * It will optionally place that version string in a DCL symbol.
+ *
+ * Usage:  report_openssl_version <shared_image> [<dcl_symbol>]
+ *
+ * Copyright (C) John Malmberg
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * SPDX-License-Identifier: ISC
+ *
+ */
+
+#include <dlfcn.h>
+#include <openssl/opensslv.h>
+#include <openssl/crypto.h>
+
+#include <string.h>
+#include <descrip.h>
+#include <libclidef.h>
+#include <stsdef.h>
+#include <errno.h>
+
+unsigned long LIB$SET_SYMBOL(const struct dsc$descriptor_s *symbol,
+                             const struct dsc$descriptor_s *value,
+                             const unsigned long *table_type);
+
+int main(int argc, char **argv)
+{
+  void *libptr;
+  const char *(*ssl_version)(int t);
+  const char *version;
+
+  if(argc < 1) {
+    puts("report_openssl_version filename");
+    return 1;
+  }
+
+  libptr = dlopen(argv[1], 0);
+
+  ssl_version = (const char *(*)(int))dlsym(libptr, "SSLeay_version");
+  if(!ssl_version) {
+    ssl_version = (const char *(*)(int))dlsym(libptr, "ssleay_version");
+    if(!ssl_version) {
+      ssl_version = (const char *(*)(int))dlsym(libptr, "SSLEAY_VERSION");
+    }
+  }
+
+  dlclose(libptr);
+
+  if(!ssl_version) {
+    puts("Unable to lookup version of OpenSSL");
+    return 1;
+  }
+
+  version = ssl_version(SSLEAY_VERSION);
+
+  puts(version);
+
+  /* Was a symbol argument given? */
+  if(argc > 1) {
+    int status;
+    struct dsc$descriptor_s symbol_dsc;
+    struct dsc$descriptor_s value_dsc;
+    const unsigned long table_type = LIB$K_CLI_LOCAL_SYM;
+
+    symbol_dsc.dsc$a_pointer = argv[2];
+    symbol_dsc.dsc$w_length = strlen(argv[2]);
+    symbol_dsc.dsc$b_dtype = DSC$K_DTYPE_T;
+    symbol_dsc.dsc$b_class = DSC$K_CLASS_S;
+
+    value_dsc.dsc$a_pointer = (char *)version; /* Cast ok */
+    value_dsc.dsc$w_length = strlen(version);
+    value_dsc.dsc$b_dtype = DSC$K_DTYPE_T;
+    value_dsc.dsc$b_class = DSC$K_CLASS_S;
+
+    status = LIB$SET_SYMBOL(&symbol_dsc, &value_dsc, &table_type);
+    if(!$VMS_STATUS_SUCCESS(status)) {
+      return status;
+    }
+  }
+
+  return 0;
+}
diff --git a/third-party/curl/packages/vms/setup_gnv_curl_build.com b/third-party/curl/projects/vms/setup_gnv_curl_build.com
similarity index 93%
rename from third-party/curl/packages/vms/setup_gnv_curl_build.com
rename to third-party/curl/projects/vms/setup_gnv_curl_build.com
index 8404ec3c05..b7aa5ec379 100644
--- a/third-party/curl/packages/vms/setup_gnv_curl_build.com
+++ b/third-party/curl/projects/vms/setup_gnv_curl_build.com
@@ -1,6 +1,6 @@
 $! File: setup_gnv_curl_build.com
 $!
-$! Set up build environment for building Curl under GNV on VMS.
+$! Set up build environment for building curl under GNV on VMS.
 $!
 $! GNV needs some files moved into the other directories to help with
 $! the configure script and the build.
@@ -66,14 +66,14 @@ $! Set the compiler options for GNV CC wrapper to inherit.
 $ cc :== cc'clist''cnames'/nested_include_directory=none
 $ cxx :== cxx'clist''cnames'/nested_include_directory=none
 $ pointer_size = "32"
-$! Note 64 bit pointers requires all libraries to either have
-$! 64 bit pointers or have #pragma directives.
-$! Currently building curl on VMS with 64 bit pointers does not work.
+$! Note 64-bit pointers requires all libraries to either have
+$! 64-bit pointers or have #pragma directives.
+$! Currently building curl on VMS with 64-bit pointers does not work.
 $!
 $! A logical name to make it easier to find some of the hacks.
 $ define/job gnv_hacks 'base_dir'
 $!
-$! A logical name to find the [.packages.vms] directory where we started.
+$! A logical name to find the [.projects.vms] directory where we started.
 $ define/job gnv_packages_vms 'default_dir'
 $!
 $! Kerberos headers:
@@ -96,13 +96,13 @@ $ endif
 $!
 $! C compiler include path.
 $ define/job decc$system_include prj_root:[.include.curl],-
-    [-.packages.vms],-
+    [-.projects.vms],-
     ssl$include:,gnv$gnu:[usr.include],-
     gnv$gnu:[usr.include.libz],gnv$gnu:[include],-
     gnv$zlib_include:,-
     sys$sysroot:[kerberos.include]
 $!
-$! Set up a include list for the compiler to find all the header files
+$! Set up an include list for the compiler to find all the header files
 $! that they need.
 $!
 $ define/job decc$user_include src_root:[.include.curl]
@@ -256,20 +256,20 @@ $!
 $!
 $! Build the Message file.
 $!--------------------------
-$ if f$search("[.packages.vms]curlmsg.obj") .eqs. ""
+$ if f$search("[.projects.vms]curlmsg.obj") .eqs. ""
 $ then
-$   message [.packages.vms]curlmsg.msg/object=[.packages.vms]
+$   message [.projects.vms]curlmsg.msg/object=[.projects.vms]
 $ endif
 $ if f$search("gnv$curlmsg.exe") .eqs. ""
 $ then
-$   link/share=gnv$curlmsg.exe [.packages.vms]curlmsg.obj
+$   link/share=gnv$curlmsg.exe [.projects.vms]curlmsg.obj
 $ endif
 $!
 $!
 $!
 $! Need to build the common init module.
 $!-------------------------------------------
-$ init_obj = "[.packages.vms]curl_crtl_init.obj"
+$ init_obj = "[.projects.vms]curl_crtl_init.obj"
 $ if f$search(init_obj) .eqs. ""
 $ then
 $   cc'cflags' 'default_dir'curl_crtl_init.c/obj='init_obj'
diff --git a/third-party/curl/packages/vms/stage_curl_install.com b/third-party/curl/projects/vms/stage_curl_install.com
similarity index 99%
rename from third-party/curl/packages/vms/stage_curl_install.com
rename to third-party/curl/projects/vms/stage_curl_install.com
index 10ae17adcb..48f6514e5f 100644
--- a/third-party/curl/packages/vms/stage_curl_install.com
+++ b/third-party/curl/projects/vms/stage_curl_install.com
@@ -96,7 +96,7 @@ $   this_dir = f$element(i, ",", dest_dirs)
 $   i = i + 1
 $   if this_dir .eqs. "" then goto curl_dir_loop
 $   if this_dir .eqs. "," then goto curl_dir_loop_end
-$!  Just create the directories, do not delete them.
+$!  Create the directories, do not delete them.
 $!  --------------------------------------------------
 $   if remove_files .eq. 0
 $   then
diff --git a/third-party/curl/packages/vms/vms_eco_level.h b/third-party/curl/projects/vms/vms_eco_level.h
similarity index 100%
rename from third-party/curl/packages/vms/vms_eco_level.h
rename to third-party/curl/projects/vms/vms_eco_level.h
diff --git a/third-party/curl/projects/wolfssl_options.h b/third-party/curl/projects/wolfssl_options.h
deleted file mode 100644
index 3ef23fbcd4..0000000000
--- a/third-party/curl/projects/wolfssl_options.h
+++ /dev/null
@@ -1,308 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-/*
-By default wolfSSL has a very conservative configuration that can result in
-connections to servers failing due to certificate or algorithm problems.
-To remedy this issue for libcurl I've generated this options file that
-build-wolfssl will copy to the wolfSSL include directories and will result in
-maximum compatibility.
-
-These are the configure options that were used to build wolfSSL v5.1.1 in
-mingw and generate the options in this file:
-
-C_EXTRA_FLAGS="\
-  -Wno-attributes \
-  -Wno-unused-but-set-variable \
-  -DFP_MAX_BITS=16384 \
-  -DHAVE_SECRET_CALLBACK \
-  -DTFM_TIMING_RESISTANT \
-  -DUSE_WOLF_STRTOK \
-  -DWOLFSSL_DES_ECB \
-  -DWOLFSSL_STATIC_DH \
-  -DWOLFSSL_STATIC_RSA \
-  " \
-./configure --prefix=/usr/local \
-  --disable-jobserver \
-  --enable-aesgcm \
-  --enable-alpn \
-  --enable-altcertchains \
-  --enable-certgen \
-  --enable-des3 \
-  --enable-dh \
-  --enable-dsa \
-  --enable-ecc \
-  --enable-eccshamir \
-  --enable-fastmath \
-  --enable-opensslextra \
-  --enable-ripemd \
-  --enable-sessioncerts \
-  --enable-sha512 \
-  --enable-sni \
-  --enable-tlsv10 \
-  --enable-supportedcurves \
-  --enable-tls13 \
-  --enable-testcert \
-  > config.out 2>&1
-
-Two generated options HAVE_THREAD_LS and _POSIX_THREADS were removed since they
-are inapplicable for our Visual Studio build. Currently thread local storage is
-only used by the Fixed Point cache ECC which we're not enabling. However even
-if we later may decide to enable the cache it will fallback on mutexes when
-thread local storage is not available. wolfSSL is using __declspec(thread) to
-create the thread local storage and that could be a problem for LoadLibrary.
-
-Regarding the options that were added via C_EXTRA_FLAGS:
-
-FP_MAX_BITS=16384
-https://www.yassl.com/forums/topic423-cacertorgs-ca-cert-verify-failed-but-withdisablefastmath-it-works.html
-"Since root.crt uses a 4096-bit RSA key, you'll need to increase the fastmath
-buffer size.  You can do this using the define:
-FP_MAX_BITS and setting it to 8192."
-
-HAVE_SECRET_CALLBACK
-Build wolfSSL with wolfSSL_set_tls13_secret_cb which allows saving TLS 1.3
-secrets to SSLKEYLOGFILE.
-
-TFM_TIMING_RESISTANT
-https://wolfssl.com/wolfSSL/Docs-wolfssl-manual-2-building-wolfssl.html
-From section 2.4.5 Increasing Performance, USE_FAST_MATH:
-"Because the stack memory usage can be larger when using fastmath, we recommend
-defining TFM_TIMING_RESISTANT as well when using this option."
-
-USE_WOLF_STRTOK
-Build wolfSSL to always use its internal strtok instead of C runtime strtok.
-
-WOLFSSL_DES_ECB
-Build wolfSSL with wolfSSL_DES_ecb_encrypt which is needed by libcurl for NTLM.
-
-WOLFSSL_STATIC_DH:    Allow TLS_ECDH_ ciphers
-WOLFSSL_STATIC_RSA:   Allow TLS_RSA_ ciphers
-https://github.com/wolfSSL/wolfssl/blob/v3.6.6/README.md#note-1
-Static key cipher suites are deprecated and disabled by default since v3.6.6.
-*/
-
-/* wolfssl options.h
- * generated from configure options
- *
- * Copyright (C) 2006-2022 wolfSSL Inc.
- *
- * This file is part of wolfSSL. (formerly known as CyaSSL)
- *
- */
-
-#ifndef WOLFSSL_OPTIONS_H
-#define WOLFSSL_OPTIONS_H
-
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#undef  FP_MAX_BITS
-#define FP_MAX_BITS 16384
-
-#undef  HAVE_SECRET_CALLBACK
-#define HAVE_SECRET_CALLBACK
-
-#undef  TFM_TIMING_RESISTANT
-#define TFM_TIMING_RESISTANT
-
-#undef  USE_WOLF_STRTOK
-#define USE_WOLF_STRTOK
-
-#undef  WOLFSSL_DES_ECB
-#define WOLFSSL_DES_ECB
-
-#undef  WOLFSSL_STATIC_DH
-#define WOLFSSL_STATIC_DH
-
-#undef  WOLFSSL_STATIC_RSA
-#define WOLFSSL_STATIC_RSA
-
-#undef  TFM_TIMING_RESISTANT
-#define TFM_TIMING_RESISTANT
-
-#undef  ECC_TIMING_RESISTANT
-#define ECC_TIMING_RESISTANT
-
-#undef  WC_RSA_BLINDING
-#define WC_RSA_BLINDING
-
-#undef  WOLFSSL_USE_ALIGN
-#define WOLFSSL_USE_ALIGN
-
-#undef  WOLFSSL_RIPEMD
-#define WOLFSSL_RIPEMD
-
-#undef  WOLFSSL_SHA512
-#define WOLFSSL_SHA512
-
-#undef  WOLFSSL_SHA384
-#define WOLFSSL_SHA384
-
-#undef  SESSION_CERTS
-#define SESSION_CERTS
-
-#undef  HAVE_HKDF
-#define HAVE_HKDF
-
-#undef  HAVE_ECC
-#define HAVE_ECC
-
-#undef  TFM_ECC256
-#define TFM_ECC256
-
-#undef  ECC_SHAMIR
-#define ECC_SHAMIR
-
-#undef  WOLFSSL_ALLOW_TLSV10
-#define WOLFSSL_ALLOW_TLSV10
-
-#undef  WC_RSA_PSS
-#define WC_RSA_PSS
-
-#undef  NO_HC128
-#define NO_HC128
-
-#undef  NO_RABBIT
-#define NO_RABBIT
-
-#undef  HAVE_POLY1305
-#define HAVE_POLY1305
-
-#undef  HAVE_ONE_TIME_AUTH
-#define HAVE_ONE_TIME_AUTH
-
-#undef  HAVE_CHACHA
-#define HAVE_CHACHA
-
-#undef  HAVE_HASHDRBG
-#define HAVE_HASHDRBG
-
-#undef  HAVE_TLS_EXTENSIONS
-#define HAVE_TLS_EXTENSIONS
-
-#undef  HAVE_SNI
-#define HAVE_SNI
-
-#undef  HAVE_TLS_EXTENSIONS
-#define HAVE_TLS_EXTENSIONS
-
-#undef  HAVE_ALPN
-#define HAVE_ALPN
-
-#undef  HAVE_TLS_EXTENSIONS
-#define HAVE_TLS_EXTENSIONS
-
-#undef  HAVE_SUPPORTED_CURVES
-#define HAVE_SUPPORTED_CURVES
-
-#undef  HAVE_FFDHE_2048
-#define HAVE_FFDHE_2048
-
-#undef  HAVE_SUPPORTED_CURVES
-#define HAVE_SUPPORTED_CURVES
-
-#undef  WOLFSSL_TLS13
-#define WOLFSSL_TLS13
-
-#undef  HAVE_TLS_EXTENSIONS
-#define HAVE_TLS_EXTENSIONS
-
-#undef  HAVE_EXTENDED_MASTER
-#define HAVE_EXTENDED_MASTER
-
-#undef  WOLFSSL_ALT_CERT_CHAINS
-#define WOLFSSL_ALT_CERT_CHAINS
-
-#undef  WOLFSSL_TEST_CERT
-#define WOLFSSL_TEST_CERT
-
-#undef  NO_RC4
-#define NO_RC4
-
-#undef  HAVE_ENCRYPT_THEN_MAC
-#define HAVE_ENCRYPT_THEN_MAC
-
-#undef  NO_PSK
-#define NO_PSK
-
-#undef  NO_MD4
-#define NO_MD4
-
-#undef  WOLFSSL_ENCRYPTED_KEYS
-#define WOLFSSL_ENCRYPTED_KEYS
-
-#undef  USE_FAST_MATH
-#define USE_FAST_MATH
-
-#undef  WC_NO_ASYNC_THREADING
-#define WC_NO_ASYNC_THREADING
-
-#undef  HAVE_DH_DEFAULT_PARAMS
-#define HAVE_DH_DEFAULT_PARAMS
-
-#undef  WOLFSSL_CERT_GEN
-#define WOLFSSL_CERT_GEN
-
-#undef  OPENSSL_EXTRA
-#define OPENSSL_EXTRA
-
-#undef  WOLFSSL_ALWAYS_VERIFY_CB
-#define WOLFSSL_ALWAYS_VERIFY_CB
-
-#undef  WOLFSSL_VERIFY_CB_ALL_CERTS
-#define WOLFSSL_VERIFY_CB_ALL_CERTS
-
-#undef  WOLFSSL_EXTRA_ALERTS
-#define WOLFSSL_EXTRA_ALERTS
-
-#undef  HAVE_EXT_CACHE
-#define HAVE_EXT_CACHE
-
-#undef  WOLFSSL_FORCE_CACHE_ON_TICKET
-#define WOLFSSL_FORCE_CACHE_ON_TICKET
-
-#undef  WOLFSSL_AKID_NAME
-#define WOLFSSL_AKID_NAME
-
-#undef  HAVE_CTS
-#define HAVE_CTS
-
-#undef  GCM_TABLE_4BIT
-#define GCM_TABLE_4BIT
-
-#undef  HAVE_AESGCM
-#define HAVE_AESGCM
-
-#undef  HAVE_WC_INTROSPECTION
-#define HAVE_WC_INTROSPECTION
-
-
-#ifdef __cplusplus
-} /* end of extern "C" */
-#endif
-
-
-#endif /* WOLFSSL_OPTIONS_H */
diff --git a/third-party/curl/projects/wolfssl_override.props b/third-party/curl/projects/wolfssl_override.props
deleted file mode 100644
index fab60f3c9e..0000000000
--- a/third-party/curl/projects/wolfssl_override.props
+++ /dev/null
@@ -1,40 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-We use this file to override some properties of the wolfSSL project files.
-
-In build-wolfssl when we call msbuild to build wolfSSL we pass in this props
-file by using the CustomAfterMicrosoftCommonTargets property.
--->
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemDefinitionGroup>
-    <ClCompile>
-      <PreprocessorDefinitions>%(PreprocessorDefinitions);</PreprocessorDefinitions>
-      <!--
-      Our options file wolfssl_options.h is copied by build-wolfssl to
-      $(SolutionDir)\wolfssl\options.h. It includes all the options we need
-      to build wolfSSL for compatibility. See wolfssl_options.h for more info.
-      -->
-      <ForcedIncludeFiles>$(SolutionDir)\wolfssl\options.h;%(ForcedIncludeFiles);</ForcedIncludeFiles>
-      <!--
-      Do not use the Unicode character set since their mingw config doesn't.
-      Do not use their IDE\WIN\user_settings.h since we have wolfssl_options.h.
-      -->
-      <UndefinePreprocessorDefinitions>_UNICODE;UNICODE;WOLFSSL_USER_SETTINGS;CYASSL_USER_SETTINGS;%(UndefinePreprocessorDefinitions);</UndefinePreprocessorDefinitions>
-    </ClCompile>
-    <ResourceCompile>
-      <UndefinePreprocessorDefinitions>_UNICODE;UNICODE;%(UndefinePreprocessorDefinitions);</UndefinePreprocessorDefinitions>
-    </ResourceCompile>
-  </ItemDefinitionGroup>
-  <!--
-  The project GUID for wolfssl.vcxproj is 73973223-5EE8-41CA-8E88-1D60E89A237B.
-  Since we have are using certain options like fast math (TFM) in our options
-  file we must compile the corresponding units in wolfssl.vcxproj. If the user
-  disables such an option the unit can still be compiled it just won't be used.
-  -->
-  <ItemGroup Condition="'$(ProjectGuid)'=='{73973223-5EE8-41CA-8E88-1D60E89A237B}'">
-    <ClCompile Include="wolfcrypt\src\chacha.c" />
-    <ClCompile Include="wolfcrypt\src\chacha20_poly1305.c" />
-    <ClCompile Include="wolfcrypt\src\poly1305.c" />
-    <ClCompile Include="wolfcrypt\src\tfm.c" />
-  </ItemGroup>
-</Project>
diff --git a/third-party/curl/renovate.json b/third-party/curl/renovate.json
new file mode 100644
index 0000000000..86a85e41eb
--- /dev/null
+++ b/third-party/curl/renovate.json
@@ -0,0 +1,97 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:best-practices",
+    ":disableDependencyDashboard"
+  ],
+  "semanticCommitType": "ci",
+  "packageRules": [
+    {
+      "matchManagers": [
+        "github-actions"
+      ],
+      "commitMessagePrefix": "GHA: ",
+      "labels": [
+        "CI"
+      ],
+      "enabled": false
+    },
+    {
+      "matchUpdateTypes": [
+        "pin",
+        "pinDigest",
+        "digest"
+      ],
+      "commitMessagePrefix": "GHA: ",
+      "labels": [
+        "CI"
+      ]
+    },
+    {
+      "matchManagers": [
+        "custom.regex"
+      ],
+      "commitMessagePrefix": "GHA: ",
+      "labels": [
+        "CI"
+      ]
+    },
+    {
+      "matchDepNames": [
+        "debian"
+      ],
+      "matchFileNames": [
+        ".github/workflows/linux-old.yml"
+      ],
+      "enabled": false
+    },
+    {
+      "description": "Schedule package updates on the 10th of each month",
+      "matchPackageNames": [
+        "/codeql/i",
+        "/ruff/i"
+      ],
+      "groupName": "monthly updates by name",
+      "schedule": [
+        "* * 10 * *"
+      ]
+    },
+    {
+      "description": "Schedule package updates on the 10th of each month",
+      "matchSourceUrls": [
+        "**/awslabs/**"
+      ],
+      "groupName": "monthly updates by URL",
+      "schedule": [
+        "* * 10 * *"
+      ]
+    }
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^\\.circleci/config\\.yml/",
+        "/^\\.github/workflows/.*\\.yml$/"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?( extractVersion=(?<extractVersion>.+?))?( registryUrl=(?<registryUrl>.*?))?\\s.*?_VERSION:\\s*(?<currentValue>.*)\\s"
+      ],
+      "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver{{/if}}",
+      "extractVersionTemplate": "{{#if extractVersion}}{{{extractVersion}}}{{else}}^v?(?<version>.+)${{/if}}"
+    },
+    {
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^\\.github/workflows/linux\\.yml$/"
+      ],
+      "matchStrings": [
+        "OPENLDAP_VERSION: (?<currentValue>.*)\\s"
+      ],
+      "datasourceTemplate": "github-tags",
+      "depNameTemplate": "openldap/openldap",
+      "versioningTemplate": "semver",
+      "extractVersionTemplate": "^OPENLDAP_REL_ENG_(?<major>\\d+)_(?<minor>\\d+)_(?<patch>\\d+)$"
+    }
+  ]
+}
diff --git a/third-party/curl/scripts/.checksrc b/third-party/curl/scripts/.checksrc
new file mode 100644
index 0000000000..03e98fee89
--- /dev/null
+++ b/third-party/curl/scripts/.checksrc
@@ -0,0 +1,5 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+allowfunc printf
diff --git a/third-party/curl/scripts/CMakeLists.txt b/third-party/curl/scripts/CMakeLists.txt
new file mode 100644
index 0000000000..1dea27f63a
--- /dev/null
+++ b/third-party/curl/scripts/CMakeLists.txt
@@ -0,0 +1,80 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Viktor Szakats, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+if(BUILD_CURL_EXE)
+  option(CURL_COMPLETION_FISH "Install fish completions" OFF)
+  option(CURL_COMPLETION_ZSH "Install zsh completions" OFF)
+
+  if(CURL_COMPLETION_FISH OR
+     CURL_COMPLETION_ZSH)
+    if(Perl_FOUND)
+      if(CURL_COMPLETION_FISH)
+        set(_completion_fish "${CMAKE_CURRENT_BINARY_DIR}/curl.fish")
+        add_custom_command(OUTPUT "${_completion_fish}"
+          COMMAND "${PERL_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/completion.pl"
+            --opts-dir "${PROJECT_SOURCE_DIR}/docs/cmdline-opts" --shell fish > "${_completion_fish}"
+          DEPENDS "${CMAKE_CURRENT_SOURCE_DIR}/completion.pl"
+          VERBATIM
+        )
+        add_custom_target("curl-completion-fish" ALL DEPENDS "${_completion_fish}")
+      endif()
+
+      if(CURL_COMPLETION_ZSH)
+        set(_completion_zsh "${CMAKE_CURRENT_BINARY_DIR}/_curl")
+        add_custom_command(OUTPUT "${_completion_zsh}"
+          COMMAND "${PERL_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/completion.pl"
+            --opts-dir "${PROJECT_SOURCE_DIR}/docs/cmdline-opts" --shell zsh > "${_completion_zsh}"
+          DEPENDS "${CMAKE_CURRENT_SOURCE_DIR}/completion.pl"
+          VERBATIM
+        )
+        add_custom_target("curl-completion-zsh" ALL DEPENDS "${_completion_zsh}")
+      endif()
+
+      if(NOT CURL_DISABLE_INSTALL)
+        if(CURL_COMPLETION_FISH)
+          if(NOT CURL_COMPLETION_FISH_DIR AND NOT CMAKE_CROSSCOMPILING AND NOT DEFINED CMAKE_INSTALL_PREFIX)
+            find_package(PkgConfig QUIET)
+            pkg_get_variable(CURL_COMPLETION_FISH_DIR "fish" "completionsdir")
+          endif()
+          if(NOT CURL_COMPLETION_FISH_DIR AND CMAKE_INSTALL_DATAROOTDIR)
+            set(CURL_COMPLETION_FISH_DIR "${CMAKE_INSTALL_DATAROOTDIR}/fish/vendor_completions.d")
+          endif()
+          if(CURL_COMPLETION_FISH_DIR)
+            install(FILES "${_completion_fish}" DESTINATION "${CURL_COMPLETION_FISH_DIR}")
+          endif()
+        endif()
+        if(CURL_COMPLETION_ZSH)
+          if(NOT CURL_COMPLETION_ZSH_DIR AND CMAKE_INSTALL_DATAROOTDIR)
+            set(CURL_COMPLETION_ZSH_DIR "${CMAKE_INSTALL_DATAROOTDIR}/zsh/site-functions")
+          endif()
+          if(CURL_COMPLETION_ZSH_DIR)
+            install(FILES "${_completion_zsh}" DESTINATION "${CURL_COMPLETION_ZSH_DIR}")
+          endif()
+        endif()
+      endif()
+    else()
+      message(WARNING "Perl not found. Cannot generate completion scripts.")
+    endif()
+  endif()
+endif()
diff --git a/third-party/curl/scripts/Makefile.am b/third-party/curl/scripts/Makefile.am
index fcb78eabf5..7ffa98ed9b 100644
--- a/third-party/curl/scripts/Makefile.am
+++ b/third-party/curl/scripts/Makefile.am
@@ -22,42 +22,45 @@
 #
 ###########################################################################
 
-EXTRA_DIST = updatemanpages.pl coverage.sh completion.pl firefox-db2pem.sh \
- checksrc.pl mk-ca-bundle.pl
+EXTRA_DIST = coverage.sh completion.pl firefox-db2pem.sh checksrc.pl          \
+  checksrc-all.pl mk-ca-bundle.pl mk-unity.pl schemetable.c cd2nroff nroff2cd \
+  cdall cd2cd managen dmaketgz maketgz release-tools.sh verify-release        \
+  cmakelint.sh mdlinkcheck CMakeLists.txt perlcheck.sh pythonlint.sh          \
+  spacecheck.pl randdisable wcurl top-complexity extract-unit-protos          \
+  .checksrc badwords badwords-all badwords.txt top-length
 
-ZSH_FUNCTIONS_DIR = @ZSH_FUNCTIONS_DIR@
-FISH_FUNCTIONS_DIR = @FISH_FUNCTIONS_DIR@
-PERL = @PERL@
+dist_bin_SCRIPTS = wcurl
 
+if USE_ZSH_COMPLETION
 ZSH_COMPLETION_FUNCTION_FILENAME = _curl
+endif
+if USE_FISH_COMPLETION
 FISH_COMPLETION_FUNCTION_FILENAME = curl.fish
+endif
 
 CLEANFILES = $(ZSH_COMPLETION_FUNCTION_FILENAME) $(FISH_COMPLETION_FUNCTION_FILENAME)
 
 all-local: $(ZSH_COMPLETION_FUNCTION_FILENAME) $(FISH_COMPLETION_FUNCTION_FILENAME)
 
+if USE_ZSH_COMPLETION
 $(ZSH_COMPLETION_FUNCTION_FILENAME): completion.pl
-if CROSSCOMPILING
-	@echo "NOTICE: we can't generate zsh completion when cross-compiling!"
-else # if not cross-compiling:
-	@if ! test -x "$(PERL)"; then echo "No perl: can't install completion.pl"; exit 0; fi
-	$(PERL) $(srcdir)/completion.pl --curl $(top_builddir)/src/curl$(EXEEXT) --shell zsh > $@
+	@PERL@ $(srcdir)/completion.pl --opts-dir $(top_srcdir)/docs/cmdline-opts --shell zsh > $@
 endif
 
+if USE_FISH_COMPLETION
 $(FISH_COMPLETION_FUNCTION_FILENAME): completion.pl
-if CROSSCOMPILING
-	@echo "NOTICE: we can't generate fish completion when cross-compiling!"
-else # if not cross-compiling:
-	@if ! test -x "$(PERL)"; then echo "No perl: can't install completion.pl"; exit 0; fi
-	$(PERL) $(srcdir)/completion.pl --curl $(top_builddir)/src/curl$(EXEEXT) --shell fish > $@
+	@PERL@ $(srcdir)/completion.pl --opts-dir $(top_srcdir)/docs/cmdline-opts --shell fish > $@
 endif
 
 install-data-local:
-if CROSSCOMPILING
-	@echo "NOTICE: we can't install zsh completion when cross-compiling!"
-else # if not cross-compiling:
-	$(MKDIR_P) $(DESTDIR)$(ZSH_FUNCTIONS_DIR)
-	$(MKDIR_P) $(DESTDIR)$(FISH_FUNCTIONS_DIR)
-	$(INSTALL_DATA) $(ZSH_COMPLETION_FUNCTION_FILENAME) $(DESTDIR)$(ZSH_FUNCTIONS_DIR)/$(ZSH_COMPLETION_FUNCTION_FILENAME)
-	$(INSTALL_DATA) $(FISH_COMPLETION_FUNCTION_FILENAME) $(DESTDIR)$(FISH_FUNCTIONS_DIR)/$(FISH_COMPLETION_FUNCTION_FILENAME)
+if USE_ZSH_COMPLETION
+	$(MKDIR_P) $(DESTDIR)@ZSH_FUNCTIONS_DIR@
+	$(INSTALL_DATA) $(ZSH_COMPLETION_FUNCTION_FILENAME) $(DESTDIR)@ZSH_FUNCTIONS_DIR@/$(ZSH_COMPLETION_FUNCTION_FILENAME)
 endif
+if USE_FISH_COMPLETION
+	$(MKDIR_P) $(DESTDIR)@FISH_FUNCTIONS_DIR@
+	$(INSTALL_DATA) $(FISH_COMPLETION_FUNCTION_FILENAME) $(DESTDIR)@FISH_FUNCTIONS_DIR@/$(FISH_COMPLETION_FUNCTION_FILENAME)
+endif
+
+distclean:
+	rm -f $(CLEANFILES)
diff --git a/third-party/curl/scripts/badwords b/third-party/curl/scripts/badwords
new file mode 100644
index 0000000000..7d371b3bee
--- /dev/null
+++ b/third-party/curl/scripts/badwords
@@ -0,0 +1,336 @@
+#!/usr/bin/env perl
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+#
+# bad[:=]correct
+#
+# If separator is '=', the string is compared case sensitively.
+# If separator is ':', the check is done case insensitively.
+#
+# To add white listed uses of bad words that are removed before checking for
+# the bad ones:
+#
+# ---(accepted word)
+# ---:[path]:(accepted word)
+#
+
+use strict;
+use warnings;
+
+use File::Basename;
+
+#
+## States
+#
+# 0 - default, initial state
+# 1 - there was a slash
+# 2 - quoted string
+# 3 - // comment
+# 4 - /* comment
+# 5 - asterisk found within a /* comment
+# 6 - #include line
+# 7 - backslash in a string
+#
+## Flags
+#
+# 1 - include preprocessor line, ignore strings
+
+sub srcline {
+    my ($state, $flags, $l) = @_;
+    my $line = "";
+
+    if(($state == 0) && ($l =~ /^ *\# *include/)) {
+        # preprocessor include line
+        $flags |= 1;
+    }
+    else {
+        # not preprocessor
+        $flags &= ~1;
+    }
+
+    if($state == 3) {
+        # // ended on the prev line, go back to init
+        $state = 0;
+    }
+
+    my @c = split(//, $l);
+
+    # state machine this line
+    for my $c (@c) {
+        if($state == 1) {
+            # we had a slash
+            if($c eq "/") {
+                # // confirmed, the rest of the line is a comment
+                $line .= "//";
+                $state = 3;
+            }
+            elsif($c eq "*") {
+                # /* confirmed
+                $state = 4;
+                $line .= "/*";
+            }
+            else {
+                # back to normal
+                $line .= "  ";
+                $state = 0;
+            }
+        }
+        elsif($state == 2) {
+            # a string
+            if($c eq "\\") {
+                $line .= "\\";
+                $state = 7;
+            }
+            elsif($c eq "\"") {
+                # end of the string
+                $line .= "\"";
+                $state = 0;
+            }
+            else {
+                $line .= $c;
+            }
+        }
+        elsif($state == 3) {
+            # a // comment
+            $line .= $c;
+        }
+        elsif($state == 4) {
+            # a /* comment
+            if($c eq "*") {
+                # could be a comment close
+                $state = 5;
+            }
+            else {
+                $line .= $c;
+            }
+        }
+        elsif($state == 5) {
+            if($c eq "/") {
+                # a /* */ comment ended here */
+                $line .= "*/";
+                $state = 0;
+            }
+            else {
+                # the /* comment continues
+                $line .= "*$c";
+                $state = 4;
+            }
+        }
+        elsif($state == 7) {
+            # the prev was a backslash in a string
+            $line .= $c;
+            # switch back to normal string
+            $state = 2;
+        }
+        else {
+            if($c eq "/") {
+                $state = 1; # got a slash
+            }
+            elsif(($c eq "\"") && !($flags & 1)) {
+                # start of a string, not within a preprocessor line
+                $line .= "\"";
+                $state = 2;
+            }
+            elsif($c eq "\n") {
+                $line .= "\n";
+            }
+            else {
+                $line .= " ";
+            }
+        }
+    }
+    return $state, $flags, $line;
+}
+
+sub sourcecode {
+    my ($f) = @_;
+    my $state = 0;
+    my $flags = 0;
+    my @lines;
+    my $line;
+    open(F, "<$f");
+    while(<F>) {
+        my $l = $_;
+        ($state, $flags, $line) = srcline($state, $flags, $l);
+        push @lines, $line;
+    }
+    close(F);
+    return @lines;
+}
+
+my @whitelist = (
+    # ignore what looks like URLs
+    '(^|\W)((https|http|ftp):\/\/[a-z0-9\-._~%:\/?\#\[\]\@!\$&\'\(\)*+,;=]+)',
+    # remove bolded sections
+    '\*\*.*?\*\*',
+    # remove backticked texts
+    '\`.*?\`'
+    );
+my %alt;
+my %exactcase;
+
+my %wl;
+
+my @w;
+my @exact;
+my $file = shift @ARGV;
+open(CONFIG, "<$file") or die "Cannot open '$file': $!";
+while(<CONFIG>) {
+    chomp;
+    if($_ =~ /^#/) {
+        next;
+    }
+    if(/^---:([^:]*):(.*)/) {
+        # whitelist file + word
+        my $word = lc($2);
+        $wl{"$1:$word"} = 1;
+    }
+    elsif($_ =~ /^---(.+)/) {
+        # whitelist word
+        push @whitelist, $1;
+    }
+    elsif($_ =~ /^(.*)([:=])(.*)/) {
+        my ($bad, $sep, $better) = ($1, $2, $3);
+        if($sep eq "=") {
+            $alt{$bad} = $better;
+            push @exact, $bad;
+        }
+        else {
+            $alt{lc($bad)} = $better;
+            push @w, $bad;
+        }
+    }
+}
+close(CONFIG);
+
+# Build a single combined regex for case-insensitive words
+my $re_ci;
+if(@w) {
+    my $pat = join('|', map { quotemeta($_) } @w);
+    $re_ci = qr/\b($pat)\b/i;
+}
+
+# Build a single combined regex for case-sensitive (exact) words
+my $re_cs;
+if(@exact) {
+    my $pat = join('|', map { quotemeta($_) } @exact);
+    $re_cs = qr/\b($pat)\b/;
+}
+
+# Build a single combined regex for removing whitelisted content
+my $pat = join('|', map { $_ } @whitelist);
+my $re_wl = qr/($pat)/;
+
+my $errors = 0;
+
+sub highlight {
+    my ($p, $w, $in, $f, $l, $lookup) = @_;
+
+    my $c = length($p)+1;
+    my $ch;
+
+    my $dir = dirname($f);
+    $ch = $dir . "/" . ":" . lc($w);
+    if($wl{$ch}) {
+        # whitelisted dirname + word
+        return;
+    }
+    my $updir = dirname($dir);
+    if($dir ne $updir) {
+        $ch = $updir . "/" . ":" . lc($w);
+        if($wl{$ch}) {
+            # whitelisted upper dirname + word
+            return;
+        }
+    }
+    $ch = $f . ":" . lc($w);
+    if($wl{$ch}) {
+        # whitelisted filename + word
+        return;
+    }
+
+    print STDERR  "$f:$l:$c: error: found bad word \"$w\"\n";
+    printf STDERR " %4d | %s\n", $l, $in;
+    printf STDERR "      | %*s^%s\n", length($p), " ",
+        "~" x (length($w)-1);
+    printf STDERR " maybe use \"%s\" instead?\n", $alt{$lookup};
+    $errors++;
+}
+
+sub document {
+    my ($f) = @_;
+    my @lines;
+    open(F, "<$f");
+    while(<F>) {
+        push @lines, $_;
+    }
+    close(F);
+    return @lines;
+}
+
+sub file {
+    my ($f) = @_;
+    my $l = 0;
+
+    my $skip_indented = 0;
+    my $source_code = 0;
+    if($f =~ /\.[ch]$/) {
+        $source_code = 1;
+    }
+    else {
+        # markdown
+        $skip_indented = 1;
+    }
+
+    my @lines;
+    if($source_code) {
+        @lines = sourcecode($f);
+    }
+    else {
+        @lines = document($f);
+    }
+    for my $in (@lines) {
+        $l++;
+        chomp $in;
+        if($skip_indented && $in =~ /^    /) {
+            next;
+        }
+        # remove the link part
+        $in =~ s/(\[.*\])\(.*\)/$1/g;
+        # remove whitelisted patterns (pre-compiled)
+        if($re_wl) {
+            $in =~ s/${re_wl}//ig;
+        }
+        # case-insensitive bad words
+        if($re_ci) {
+            if($in =~ /^(.*)$re_ci/i) {
+                highlight($1, $2, $in, $f, $l, lc($2));
+            }
+        }
+        # case-sensitive (exact) bad words
+        if($re_cs) {
+            if($in =~ /^(.*)$re_cs/) {
+                highlight($1, $2, $in, $f, $l, $2);
+            }
+        }
+    }
+}
+
+my @filemasks = @ARGV;
+open(my $git_ls_files, '-|', 'git', 'ls-files', '--', ":!:$file", @filemasks) or die "Failed running git ls-files: $!";
+my @files;
+while(my $each = <$git_ls_files>) {
+    chomp $each;
+    push @files, $each;
+}
+close $git_ls_files;
+
+my $onum = scalar(@files);
+my $num;
+for my $e (@files) {
+    #printf STDERR "Complete: %d%%\r", $num++ * 100 / $onum;
+    file($e);
+}
+
+exit $errors;
diff --git a/third-party/curl/scripts/badwords-all b/third-party/curl/scripts/badwords-all
new file mode 100644
index 0000000000..99e1b52ff8
--- /dev/null
+++ b/third-party/curl/scripts/badwords-all
@@ -0,0 +1,14 @@
+#!/usr/bin/env perl
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+use strict;
+use warnings;
+
+use File::Basename;
+
+chdir dirname(__FILE__) . '/..';
+
+exit system('scripts/badwords', ('scripts/badwords.txt',
+    '**.md', 'projects/OS400/README.OS400', 'include', 'docs/examples')) >> 8;
diff --git a/third-party/curl/scripts/badwords.txt b/third-party/curl/scripts/badwords.txt
new file mode 100644
index 0000000000..2651a48598
--- /dev/null
+++ b/third-party/curl/scripts/badwords.txt
@@ -0,0 +1,135 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+#
+# whitelisted uses of bad words (case insensitive) can be done in two ways,
+# globally and per-file.
+#
+# ---[word]
+# ---:[file]:[word]
+#
+back-end:backend
+e-mail:email
+run-time:runtime
+set-up:setup
+tool chain:toolchain
+tool-chain:toolchain
+well known:well-known
+wild-card:wildcard
+wild card:wildcard
+threadsafe:thread-safe
+thread safe:thread-safe
+thread safety:thread-safety
+thread unsafe:thread-unsafe
+multi thread:multi-thread
+nul terminate:null-terminate
+null terminate:null-terminate
+zero terminate:null-terminate
+nul terminated:null-terminated
+null terminated:null-terminated
+NULL-terminated=null-terminated
+zero terminated:null-terminated
+zero-terminated:null-terminated
+nul terminator:null-terminator
+null terminator:null-terminator
+zero terminator:null-terminator
+work-around:workaround or work around
+work-arounds:workarounds or works around
+it's:it is
+aren't:are not
+can't:cannot
+could've:could have
+couldn't:could not
+didn't:did not
+doesn't:does not
+don't:do not
+haven't:have not
+i'd:I would
+i'll:I will
+i'm:I am
+i've:I have
+isn't:is not
+it'd:it would
+it'll:it will
+might've:might have
+needn't:need not
+should've:should have
+shouldn't:should not
+that's:that is
+there's:there is
+they'd:They would
+they'll:They will
+they're:They are
+they've:They have
+this'll:this will
+wasn't:was not
+we'd:we would
+we'll:we will
+we're:we are
+we've:we have
+weren't:were not
+won't:will not
+would've:would have
+wouldn't:would not
+you'd:you would
+you'll:you will
+you're:you are
+you've:you have
+a html:an html
+a http:an http
+a ftp:an ftp
+a IPv4:an IPv4
+a IPv6:an IPv6
+ url= URL
+internet=Internet
+isation:ization
+So=Rewrite it somehow?
+And=Rewrite it somehow?
+But=Rewrite it somehow?
+sub-directory:subdirectory
+web page:webpage
+host name:hostname
+host names:hostnames
+file name:filename
+file names:filenames
+fist:first
+user name:username
+user names:usernames
+pass phrase:passphrase
+will:rewrite to present tense
+7 bit:7-bit
+8 bit:8-bit
+16 bit:16-bit
+24 bit:24-bit
+32 bit:32-bit
+56 bit:56-bit
+63 bit:63-bit
+64 bit:64-bit
+128 bit:128-bit
+256 bit:256-bit
+8-bits:8 bits
+16-bits:16 bits
+32-bits:32 bits
+64-bits:64 bits
+initialise:initialize
+initialising:initializing
+very:rephrase using an alternative word
+just:rephrase using an alternative word
+simply:rephrase using an alternative word
+Curl=curl
+cURL=curl
+Libcurl=libcurl
+LibCurl=libcurl
+manpages:man pages
+manpage:man page
+favour:favor
+basically:rephrase?
+However,:rephrase?
+the the:the
+with with:with
+---WWW::Curl
+---NET::Curl
+---Curl Corporation
+---:lib/:will
+---:src/:will
+---:tests/data/:file name
diff --git a/third-party/curl/scripts/cd2cd b/third-party/curl/scripts/cd2cd
new file mode 100644
index 0000000000..ead664dfd6
--- /dev/null
+++ b/third-party/curl/scripts/cd2cd
@@ -0,0 +1,233 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+=begin comment
+
+This script updates a curldown file to current/better curldown.
+
+Example: cd2cd [--in-place] <file.md> > <file.md>
+
+--in-place: if used, it replaces the original file with the cleaned up
+            version. When this is used, cd2cd accepts multiple files to work
+            on and it ignores errors on single files.
+
+=end comment
+=cut
+
+use strict;
+use warnings;
+
+my $cd2cd = "0.1"; # to keep check
+my $dir;
+my $extension;
+my $inplace = 0;
+
+while(1) {
+    if(@ARGV && $ARGV[0] eq "--in-place") {
+        shift @ARGV;
+        $inplace = 1;
+    }
+    else {
+        last;
+    }
+}
+
+use POSIX qw(strftime);
+my @ts;
+if(defined($ENV{SOURCE_DATE_EPOCH})) {
+    @ts = localtime($ENV{SOURCE_DATE_EPOCH});
+} else {
+    @ts = localtime;
+}
+my $date = strftime "%B %d %Y", @ts;
+
+sub outseealso {
+    my (@sa) = @_;
+    my $comma = 0;
+    my @o;
+    push @o, ".SH SEE ALSO\n";
+    for my $s (sort @sa) {
+        push @o, sprintf "%s.BR $s", $comma ? ",\n" : "";
+        $comma = 1;
+    }
+    push @o, "\n";
+    return @o;
+}
+
+sub single {
+    my @head;
+    my @seealso;
+    my ($f) = @_;
+    my $title;
+    my $section;
+    my $source;
+    my $start = 0;
+    my $d;
+    my $line = 0;
+    my $salist = 0;
+    my $copyright;
+    my $spdx;
+    open(F, "<:crlf", $f) or
+        return 1;
+    while(<F>) {
+        $line++;
+        $d = $_;
+        if(!$start) {
+            if(/^---/) {
+                # header starts here
+                $start = 1;
+                push @head, $d;
+            }
+            next;
+        }
+        if(/^Title: *(.*)/i) {
+            $title = $1;
+        }
+        elsif(/^Section: *(.*)/i) {
+            $section = $1;
+        }
+        elsif(/^Source: *(.*)/i) {
+            $source = $1;
+        }
+        elsif(/^See-also: +(.*)/i) {
+            $salist = 0;
+            push @seealso, $1;
+        }
+        elsif(/^See-also: */i) {
+            if($seealso[0]) {
+                print STDERR "$f:$line:1:ERROR: bad See-Also, needs list\n";
+                return 2;
+            }
+            $salist = 1;
+        }
+        elsif(/^ +- (.*)/i) {
+            # the only list we support is the see-also
+            if($salist) {
+                push @seealso, $1;
+            }
+        }
+        # REUSE-IgnoreStart
+        elsif(/^C: (.*)/i) {
+            $copyright = $1;
+        }
+        elsif(/^SPDX-License-Identifier: (.*)/i) {
+            $spdx = $1;
+        }
+        # REUSE-IgnoreEnd
+        elsif(/^---/) {
+            # end of the header section
+            if(!$title) {
+                print STDERR "ERROR: no 'Title:' in $f\n";
+                return 1;
+            }
+            if(!$section) {
+                print STDERR "ERROR: no 'Section:' in $f\n";
+                return 2;
+            }
+            if(!$seealso[0]) {
+                print STDERR "$f:$line:1:ERROR: no 'See-also:' present\n";
+                return 2;
+            }
+            if(!$copyright) {
+                print STDERR "$f:$line:1:ERROR: no 'C:' field present\n";
+                return 2;
+            }
+            if(!$spdx) {
+                # REUSE-IgnoreStart
+                print STDERR "$f:$line:1:ERROR: no 'SPDX-License-Identifier:' field present\n";
+                # REUSE-IgnoreEnd
+                return 2;
+            }
+            last;
+        }
+        else {
+            chomp;
+            print STDERR "WARN: unrecognized line in $f, ignoring:\n:'$_';"
+        }
+    }
+
+    if(!$start) {
+        print STDERR "$f:$line:1:ERROR: no header present\n";
+        return 2;
+    }
+
+    my @desc;
+
+    push @desc, sprintf <<HEAD
+---
+c: Copyright (C) Daniel Stenberg, <daniel\@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: $title
+Section: $section
+Source: $source
+HEAD
+        ;
+    push @desc, "See-also:\n";
+    for my $s (sort @seealso) {
+        push @desc, "  - $s\n" if($s);
+    }
+    push @desc, "---\n";
+
+    my $blankline = 0;
+    while(<F>) {
+        $d = $_;
+        $line++;
+        if($d =~ /^[ \t]*\n/) {
+            $blankline++;
+        }
+        else {
+            $blankline = 0;
+        }
+        # *italics* for curl symbol links get the asterisks removed
+        $d =~ s/\*((lib|)curl[^ ]*\(3\))\*/$1/gi;
+
+        if(length($d) > 90) {
+            print STDERR "$f:$line:1:WARN: excessive line length\n";
+        }
+
+        push @desc, $d if($blankline < 2);
+    }
+    close(F);
+
+    if($inplace) {
+        open(O, ">$f") or return 1;
+        print O @desc;
+        close(O);
+    }
+    else {
+        print @desc;
+    }
+    return 0;
+}
+
+if($inplace) {
+    for my $a (@ARGV) {
+        # this ignores errors
+        single($a);
+    }
+}
+elsif(@ARGV) {
+    exit single($ARGV[0]);
+}
diff --git a/third-party/curl/scripts/cd2nroff b/third-party/curl/scripts/cd2nroff
new file mode 100644
index 0000000000..27717cfbe3
--- /dev/null
+++ b/third-party/curl/scripts/cd2nroff
@@ -0,0 +1,588 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+=begin comment
+
+Converts a curldown file to nroff (man page).
+
+=end comment
+=cut
+
+use strict;
+use warnings;
+
+my $cd2nroff = "0.1"; # to keep check
+my $dir;
+my $extension;
+my $keepfilename;
+
+while(@ARGV) {
+    if($ARGV[0] eq "-d") {
+        shift @ARGV;
+        $dir = shift @ARGV;
+    }
+    elsif($ARGV[0] eq "-e") {
+        shift @ARGV;
+        $extension = shift @ARGV;
+    }
+    elsif($ARGV[0] eq "-k") {
+        shift @ARGV;
+        $keepfilename = 1;
+    }
+    elsif($ARGV[0] eq "-h") {
+        print <<HELP
+Usage: cd2nroff [options] [file.md]
+
+-d <dir> Write the output to the filename from the meta-data in the
+         specified directory, instead of writing to stdout
+-e <ext> If -d is used, this option can provide an added "extension", arbitrary
+         text really, to append to the filename.
+-h       This help text,
+-v       Show version then exit
+HELP
+            ;
+        exit 0;
+    }
+    elsif($ARGV[0] eq "-v") {
+        print "cd2nroff version $cd2nroff\n";
+        exit 0;
+    }
+    else {
+        last;
+    }
+}
+
+use POSIX qw(strftime);
+my @ts;
+if(defined($ENV{SOURCE_DATE_EPOCH})) {
+    @ts = gmtime($ENV{SOURCE_DATE_EPOCH});
+} else {
+    @ts = localtime;
+}
+my $date = strftime "%Y-%m-%d", @ts;
+
+sub outseealso {
+    my (@sa) = @_;
+    my $comma = 0;
+    my @o;
+    push @o, ".SH SEE ALSO\n";
+    for my $s (sort @sa) {
+        push @o, sprintf "%s.BR $s", $comma ? ",\n" : "";
+        $comma = 1;
+    }
+    push @o, "\n";
+    return @o;
+}
+
+sub outprotocols {
+    my (@p) = @_;
+    my $comma = 0;
+    my @o;
+    my $tls = 0;
+    push @o, ".SH PROTOCOLS\n";
+
+    my @s = sort @p;
+    push @o, "This functionality affects ";
+    for my $e (sort @s) {
+        if($e eq "TLS") {
+            $tls = 1;
+        }
+        else {
+            push @o, sprintf "%s%s",
+                $comma ? (($e eq $s[-1]) ? " and " : ", "): "",
+                lc($e);
+            $comma = 1;
+        }
+    }
+    if($tls) {
+        push @o, sprintf
+            "%sall TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.",
+            $comma ? " and ": " ";
+    }
+    if($#s == 0) {
+        if($s[0] eq "All") {
+            push @o, " supported protocols";
+        }
+        else {
+            push @o, " only";
+        }
+    }
+    push @o, "\n";
+    return @o;
+}
+
+sub outtls {
+    my (@t) = @_;
+    my $comma = 0;
+    my @o;
+    if($t[0] eq "All") {
+        push @o, "\nAll TLS backends support this option.";
+    }
+    elsif($t[0] eq "none") {
+        push @o, "\nNo TLS backend supports this option.";
+    }
+    else {
+        push @o, "\nThis option works only with the following TLS backends:\n";
+        my @s = sort @t;
+        for my $e (@s) {
+            push @o, sprintf "%s$e",
+                $comma ? (($e eq $s[-1]) ? " and " : ", "): "";
+            $comma = 1;
+        }
+    }
+    push @o, "\n";
+    return @o;
+}
+
+my %knownprotos = (
+    'DICT' => 1,
+    'FILE' => 1,
+    'FTP' => 1,
+    'FTPS' => 1,
+    'GOPHER' => 1,
+    'GOPHERS' => 1,
+    'HTTP' => 1,
+    'HTTPS' => 1,
+    'IMAP' => 1,
+    'IMAPS' => 1,
+    'LDAP' => 1,
+    'LDAPS' => 1,
+    'MQTT' => 1,
+    'POP3' => 1,
+    'POP3S' => 1,
+    'RTSP' => 1,
+    'SCP' => 1,
+    'SFTP' => 1,
+    'SMB' => 1,
+    'SMBS' => 1,
+    'SMTP' => 1,
+    'SMTPS' => 1,
+    'TELNET' => 1,
+    'TFTP' => 1,
+    'WS' => 1,
+    'WSS' => 1,
+    'TLS' => 1,
+    'TCP' => 1,
+    'QUIC' => 1,
+    'All' => 1
+    );
+
+my %knowntls = (
+    'GnuTLS' => 1,
+    'mbedTLS' => 1,
+    'OpenSSL' => 1,
+    'Rustls' => 1,
+    'Schannel' => 1,
+    'wolfSSL' => 1,
+    'All' => 1,
+    'none' => 1,
+    );
+
+sub single {
+    my @seealso;
+    my @proto;
+    my @tls;
+    my $d;
+    my ($f) = @_;
+    my $copyright;
+    my $errors = 0;
+    my $fh;
+    my $line;
+    my $list;
+    my $tlslist;
+    my $section;
+    my $source;
+    my $addedin;
+    my $spdx;
+    my $start = 0;
+    my $title;
+
+    if(defined($f)) {
+        if(!open($fh, "<:crlf", $f)) {
+            print STDERR "cd2nroff failed to open '$f' for reading: $!\n";
+            return 1;
+        }
+    }
+    else {
+        $f = "STDIN";
+        $fh = \*STDIN;
+        binmode($fh, ":crlf");
+    }
+    while(<$fh>) {
+        $line++;
+        if(!$start) {
+            if(/^---/) {
+                # header starts here
+                $start = 1;
+            }
+            next;
+        }
+        if(/^Title: *(.*)/i) {
+            $title = $1;
+        }
+        elsif(/^Section: *(.*)/i) {
+            $section = $1;
+        }
+        elsif(/^Source: *(.*)/i) {
+            $source = $1;
+        }
+        elsif(/^See-also: +(.*)/i) {
+            $list = 1; # 1 for see-also
+            push @seealso, $1;
+        }
+        elsif(/^See-also: */i) {
+            if($seealso[0]) {
+                print STDERR "$f:$line:1:ERROR: bad See-Also, needs list\n";
+                return 2;
+            }
+            $list = 1; # 1 for see-also
+        }
+        elsif(/^Protocol:/i) {
+            $list = 2; # 2 for protocol
+        }
+        elsif(/^TLS-backend:/i) {
+            $list = 3; # 3 for TLS backend
+        }
+        elsif(/^Added-in: *(.*)/i) {
+            $addedin = $1;
+            if(($addedin !~ /^[0-9.]+[0-9]\z/) &&
+               ($addedin ne "n/a")) {
+                print STDERR "$f:$line:1:ERROR: invalid version number in Added-in line: $addedin\n";
+                return 2;
+            }
+        }
+        elsif(/^ +- (.*)/i) {
+            # the only lists we support are see-also and protocol
+            if($list == 1) {
+                push @seealso, $1;
+            }
+            elsif($list == 2) {
+                push @proto, $1;
+            }
+            elsif($list == 3) {
+                push @tls, $1;
+            }
+            else {
+                print STDERR "$f:$line:1:ERROR: list item without owner?\n";
+                return 2;
+            }
+        }
+        # REUSE-IgnoreStart
+        elsif(/^C: (.*)/i) {
+            $copyright = $1;
+        }
+        elsif(/^SPDX-License-Identifier: (.*)/i) {
+            $spdx = $1;
+        }
+        # REUSE-IgnoreEnd
+        elsif(/^---/) {
+            # end of the header section
+            if(!$title) {
+                print STDERR "$f:$line:1:ERROR: no 'Title:' in $f\n";
+                return 1;
+            }
+            if(!$section) {
+                print STDERR "$f:$line:1:ERROR: no 'Section:' in $f\n";
+                return 2;
+            }
+            if(!$source) {
+                print STDERR "$f:$line:1:ERROR: no 'Source:' in $f\n";
+                return 2;
+            }
+            if(($source eq "libcurl") && !$addedin) {
+                print STDERR "$f:$line:1:ERROR: no 'Added-in:' in $f\n";
+                return 2;
+            }
+            if(!$seealso[0]) {
+                print STDERR "$f:$line:1:ERROR: no 'See-also:' present\n";
+                return 2;
+            }
+            if(!$copyright) {
+                print STDERR "$f:$line:1:ERROR: no 'C:' field present\n";
+                return 2;
+            }
+            if(!$spdx) {
+                # REUSE-IgnoreStart
+                print STDERR "$f:$line:1:ERROR: no 'SPDX-License-Identifier:' field present\n";
+                # REUSE-IgnoreEnd
+                return 2;
+            }
+            if($section == 3) {
+                if(!$proto[0]) {
+                    printf STDERR "$f:$line:1:ERROR: missing Protocol:\n";
+                    exit 2;
+                }
+                my $tls = 0;
+                for my $p (@proto) {
+                    if($p eq "TLS") {
+                        $tls = 1;
+                    }
+                    if(!$knownprotos{$p}) {
+                        printf STDERR "$f:$line:1:ERROR: invalid protocol used: $p:\n";
+                        exit 2;
+                    }
+                }
+                # This is for TLS, require TLS-backend:
+                if($tls) {
+                    if(!$tls[0]) {
+                        printf STDERR "$f:$line:1:ERROR: missing TLS-backend:\n";
+                        exit 2;
+                    }
+                    for my $t (@tls) {
+                        if(!$knowntls{$t}) {
+                            printf STDERR "$f:$line:1:ERROR: invalid TLS backend: $t:\n";
+                            exit 2;
+                        }
+                    }
+                }
+            }
+            last;
+        }
+        else {
+            chomp;
+            print STDERR "$f:$line:1:ERROR: unrecognized header keyword: '$_'\n";
+            $errors++;
+        }
+    }
+
+    if(!$start) {
+        print STDERR "$f:$line:1:ERROR: no header present\n";
+        return 2;
+    }
+
+    my @desc;
+    my $quote = 0;
+    my $blankline = 0;
+    my $header = 0;
+
+    # cut off the leading path from the filename, if any
+    $f =~ s/^(.*[\\\/])//;
+
+    push @desc, ".\\\" generated by cd2nroff $cd2nroff from $f\n";
+    push @desc, ".TH $title $section \"$date\" $source\n";
+    while(<$fh>) {
+        $line++;
+
+        $d = $_;
+
+        if($quote) {
+            if($quote == 4) {
+                # remove the indentation
+                if($d =~ /^    (.*)/) {
+                    push @desc, "$1\n";
+                    next;
+                }
+                else {
+                    # end of quote
+                    $quote = 0;
+                    push @desc, ".fi\n";
+                    next;
+                }
+            }
+            if(/^~~~/) {
+                # end of quote
+                $quote = 0;
+                push @desc, ".fi\n";
+                next;
+            }
+            # convert single backslashes to doubles
+            $d =~ s/\\/\\\\/g;
+            # lines starting with a period needs it escaped
+            $d =~ s/^\./\\&./;
+            push @desc, $d;
+            next;
+        }
+
+        # remove single line HTML comments
+        $d =~ s/<!--.*?-->//g;
+
+        # **bold**
+        $d =~ s/\*\*(\S.*?)\*\*/\\fB$1\\fP/g;
+        # *italics*
+        $d =~ s/\*(\S.*?)\*/\\fI$1\\fP/g;
+
+        my $back = $d;
+
+        # remove all backticked pieces
+        $back =~ s/\`(.*?)\`//g;
+
+        if($back =~ /[^\\][\<\>]/) {
+            print STDERR "$f:$line:1:ERROR: un-escaped < or > used\n";
+            $errors++;
+        }
+        # convert backslash-'<' or '> to the second character
+        $d =~ s/\\([<>])/$1/g;
+
+        # mentions of curl symbols with man pages use italics by default
+        $d =~ s/((lib|)curl([^ ]*\(3\)))/\\fI$1\\fP/gi;
+
+        # backticked becomes italics
+        $d =~ s/\`(.*?)\`/\\fI$1\\fP/g;
+
+        if(/^## (.*)/) {
+            my $word = $1;
+            # if there are enclosing quotes, remove them first
+            $word =~ s/[\"\'\`](.*)[\"\'\`]\z/$1/;
+
+            # enclose in double quotes if there is a space present
+            if($word =~ / /) {
+                push @desc, ".IP \"$word\"\n";
+            }
+            else {
+                push @desc, ".IP $word\n";
+            }
+            $header = 1;
+        }
+        elsif(/^##/) {
+            # end of IP sequence
+            push @desc, ".PP\n";
+            $header = 1;
+        }
+        elsif(/^# (.*)/) {
+            my $word = $1;
+            # if there are enclosing quotes, remove them first
+            $word =~ s/[\"\'](.*)[\"\']\z/$1/;
+
+            if($word eq "PROTOCOLS") {
+                print STDERR "$f:$line:1:WARN: PROTOCOLS section in source file\n";
+            }
+            elsif($word eq "AVAILABILITY") {
+                print STDERR "$f:$line:1:WARN: AVAILABILITY section in source file\n";
+            }
+            elsif($word eq "%PROTOCOLS%") {
+                # insert the generated PROTOCOLS section
+                push @desc, outprotocols(@proto);
+
+                if($proto[0] eq "TLS") {
+                    push @desc, outtls(@tls);
+                }
+                $header = 1;
+                next;
+            }
+            elsif($word eq "%AVAILABILITY%") {
+                if($addedin ne "n/a") {
+                    # insert the generated AVAILABILITY section
+                    push @desc, ".SH AVAILABILITY\n";
+                    push @desc, "Added in curl $addedin\n";
+                }
+                $header = 1;
+                next;
+            }
+            push @desc, ".SH $word\n";
+            $header = 1;
+        }
+        elsif(/^~~~c/) {
+            # start of a code section, not indented
+            $quote = 1;
+            push @desc, "\n" if($blankline && !$header);
+            $header = 0;
+            push @desc, ".nf\n";
+        }
+        elsif(/^~~~/) {
+            # start of a quote section; not code, not indented
+            $quote = 1;
+            push @desc, "\n" if($blankline && !$header);
+            $header = 0;
+            push @desc, ".nf\n";
+        }
+        elsif(/^    (.*)/) {
+            # quoted, indented by 4 space
+            $quote = 4;
+            push @desc, "\n" if($blankline && !$header);
+            $header = 0;
+            push @desc, ".nf\n$1\n";
+        }
+        elsif(/^[ \t]*\n/) {
+            # count and ignore blank lines
+            $blankline++;
+        }
+        else {
+            # do not output newlines if this is the first content after a
+            # header
+            push @desc, "\n" if($blankline && !$header);
+            $blankline = 0;
+            $header = 0;
+
+            # quote minuses in the output
+            $d =~ s/([^\\])-/$1\\-/g;
+            # replace single quotes
+            $d =~ s/\'/\\(aq/g;
+            # handle double quotes first on the line
+            $d =~ s/^(\s*)\"/$1\\&\"/;
+
+            # lines starting with a period needs it escaped
+            $d =~ s/^\./\\&./;
+
+            if($d =~ /^(.*)  /) {
+                printf STDERR "$f:$line:%d:ERROR: 2 spaces detected\n",
+                    length($1);
+                $errors++;
+            }
+            if($d =~ /^[ \t]*\n/) {
+                # replaced away all contents
+                $blankline= 1;
+            }
+            else {
+                push @desc, $d;
+            }
+        }
+    }
+    if($fh != \*STDIN) {
+        close($fh);
+    }
+    push @desc, outseealso(@seealso);
+    if($dir) {
+        if($keepfilename) {
+            $title = $f;
+            $title =~ s/\.[^.]*$//;
+        }
+        my $outfile = "$dir/$title.$section";
+        if(defined($extension)) {
+            $outfile .= $extension;
+        }
+        if(!open(O, ">", $outfile)) {
+            print STDERR "Failed to open $outfile : $!\n";
+            return 1;
+        }
+        print O @desc;
+        close(O);
+    }
+    else {
+        print @desc;
+    }
+    return $errors;
+}
+
+if(@ARGV) {
+    for my $f (@ARGV) {
+        my $r = single($f);
+        if($r) {
+            exit $r;
+        }
+    }
+}
+else {
+    exit single();
+}
diff --git a/third-party/curl/scripts/cdall b/third-party/curl/scripts/cdall
new file mode 100644
index 0000000000..53e6e36929
--- /dev/null
+++ b/third-party/curl/scripts/cdall
@@ -0,0 +1,47 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+# provide all directory names to scan on the command-line
+
+use strict;
+use warnings;
+
+sub convert {
+    my ($dir) = @_;
+    opendir(my $dh, $dir) or die "could not open $dir";
+    my @cd = grep { /\.md\z/ && -f "$dir/$_" } readdir($dh);
+    closedir $dh;
+
+    for my $cd (@cd) {
+        my $nroff = $cd;
+        $nroff =~ s/\.md\z/.3/;
+        print "$dir/$cd = $dir/$nroff\n";
+        system('./scripts/cd2nroff', ('-d', $dir, "$dir/$cd"));
+    }
+}
+
+for my $d (sort @ARGV) {
+    convert($d);
+}
diff --git a/third-party/curl/scripts/checksrc-all.pl b/third-party/curl/scripts/checksrc-all.pl
new file mode 100644
index 0000000000..fd80c1b427
--- /dev/null
+++ b/third-party/curl/scripts/checksrc-all.pl
@@ -0,0 +1,48 @@
+#!/usr/bin/env perl
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+use strict;
+use warnings;
+
+use File::Basename;
+use File::Find;
+use Cwd 'abs_path';
+
+my @files;
+my $is_git = 0;
+if(system('git rev-parse --is-inside-work-tree >/dev/null 2>&1') == 0) {
+    open(O, '-|', 'git', 'ls-files', '*.[ch]') or die; push @files, <O>; close(O);
+    $is_git = 1;
+}
+else {
+    find(sub { if(/\.[ch]$/) { push(@files, $File::Find::name) } }, ('.'));
+}
+if(@ARGV) {
+    find(sub { if(/\.[ch]$/) { push(@files, $File::Find::name) } }, @ARGV);
+}
+
+@files = grep !/\/CMakeFiles\//, @files;
+@files = grep !/tests\/data\/data.+\.c/, @files;
+@files = map { dirname($_) } @files;
+my @dirs = sort { $a cmp $b } keys %{{ map { $_ => 1 } @files }};
+
+my $scripts_dir = dirname(abs_path($0));
+my $anyfailed = 0;
+
+for my $dir (@dirs) {
+    if($is_git) {
+        @files = ();
+        open(O, '-|', 'git', 'ls-files', ":(glob)$dir/*.[ch]") or die; push @files, <O>; close(O);
+        chomp(@files);
+    }
+    else {
+        @files = glob("$dir/*.[ch]");
+    }
+    if(@files && system("$scripts_dir/checksrc.pl", @files) != 0) {
+        $anyfailed = 1;
+    }
+}
+
+exit $anyfailed;
diff --git a/third-party/curl/scripts/checksrc.pl b/third-party/curl/scripts/checksrc.pl
index b08b4ffc8b..46d02ae3c8 100644
--- a/third-party/curl/scripts/checksrc.pl
+++ b/third-party/curl/scripts/checksrc.pl
@@ -35,11 +35,11 @@ my $errors = 0;
 my $serrors = 0;
 my $suppressed; # skipped problems
 my $file;
-my $dir=".";
-my $wlist="";
+my $dir = ".";
+my $wlist = "";
 my @alist;
 my $windows_os = $^O eq 'MSWin32' || $^O eq 'cygwin' || $^O eq 'msys';
-my $verbose;
+my $verbose = 0;
 my %skiplist;
 
 my %ignore;
@@ -47,91 +47,214 @@ my %ignore_set;
 my %ignore_used;
 my @ignore_line;
 
+my %banfunc = (
+    "_access" => 1,
+    "_fstati64" => 1,
+    "_lseeki64" => 1,
+    "_mbscat" => 1,
+    "_mbsncat" => 1,
+    "_open" => 1,
+    "_tcscat" => 1,
+    "_tcsdup" => 1,
+    "_tcsncat" => 1,
+    "_tcsncpy" => 1,
+    "_waccess" => 1,
+    "_wcscat" => 1,
+    "_wcsdup" => 1,
+    "_wcsncat" => 1,
+    "_wfopen" => 1,
+    "_wfreopen" => 1,
+    "_wopen" => 1,
+    "accept" => 1,
+    "accept4" => 1,
+    "access" => 1,
+    "aprintf" => 1,
+    "atoi" => 1,
+    "atol" => 1,
+    "calloc" => 1,
+    "close" => 1,
+    "CreateFile" => 1,
+    "CreateFileA" => 1,
+    "CreateFileW" => 1,
+    "fclose" => 1,
+    "fdopen" => 1,
+    "fopen" => 1,
+    "fprintf" => 1,
+    "free" => 1,
+    "freeaddrinfo" => 1,
+    "freopen" => 1,
+    "fstat" => 1,
+    "getaddrinfo" => 1,
+    "gets" => 1,
+    "gmtime" => 1,
+    "llseek" => 1,
+    "LoadLibrary" => 1,
+    "LoadLibraryA" => 1,
+    "LoadLibraryEx" => 1,
+    "LoadLibraryExA" => 1,
+    "LoadLibraryExW" => 1,
+    "LoadLibraryW" => 1,
+    "localtime" => 1,
+    "lseek" => 1,
+    "malloc" => 1,
+    "mbstowcs" => 1,
+    "MoveFileEx" => 1,
+    "MoveFileExA" => 1,
+    "MoveFileExW" => 1,
+    "msnprintf" => 1,
+    "mvsnprintf" => 1,
+    "open" => 1,
+    "printf" => 1,
+    "realloc" => 1,
+    "recv" => 1,
+    "rename" => 1,
+    "send" => 1,
+    "snprintf" => 1,
+    "socket" => 1,
+    "socketpair" => 1,
+    "sprintf" => 1,
+    "sscanf" => 1,
+    "stat" => 1,
+    "strcat" => 1,
+    "strcpy" => 1,
+    "strdup" => 1,
+    "strerror" => 1,
+    "strncat" => 1,
+    "strncpy" => 1,
+    "strtok_r" => 1,
+    "strtok" => 1,
+    "strtol" => 1,
+    "strtoul" => 1,
+    "vaprintf" => 1,
+    "vfprintf" => 1,
+    "vprintf" => 1,
+    "vsnprintf" => 1,
+    "vsprintf" => 1,
+    "wcscpy" => 1,
+    "wcsdup" => 1,
+    "wcsncpy" => 1,
+    "wcstombs" => 1,
+    "WSASocket" => 1,
+    "WSASocketA" => 1,
+    "WSASocketW" => 1,
+    );
+
 my %warnings_extended = (
     'COPYRIGHTYEAR'    => 'copyright year incorrect',
-    'STRERROR',        => 'strerror() detected',
+    'STDERR'           => 'stderr detected',
     );
 
 my %warnings = (
     'ASSIGNWITHINCONDITION' => 'assignment within conditional expression',
-    'ASTERISKNOSPACE'  => 'pointer declared without space before asterisk',
-    'ASTERISKSPACE'    => 'pointer declared with space after asterisk',
-    'BADCOMMAND'       => 'bad !checksrc! instruction',
-    'BANNEDFUNC'       => 'a banned function was used',
-    'BRACEELSE'        => '} else on the same line',
-    'BRACEPOS'         => 'wrong position for an open brace',
-    'BRACEWHILE'       => 'A single space between open brace and while',
-    'COMMANOSPACE'     => 'comma without following space',
-    'COMMENTNOSPACEEND' => 'no space before */',
-    'COMMENTNOSPACESTART' => 'no space following /*',
-    'COPYRIGHT'        => 'file missing a copyright statement',
-    'CPPCOMMENTS'      => '// comment detected',
-    'DOBRACE'          => 'A single space between do and open brace',
-    'EMPTYLINEBRACE'   => 'Empty line before the open brace',
-    'EQUALSNOSPACE'    => 'equals sign without following space',
-    'EQUALSNULL'       => 'if/while comparison with == NULL',
-    'EXCLAMATIONSPACE' => 'Whitespace after exclamation mark in expression',
-    'FOPENMODE'        => 'fopen needs a macro for the mode string',
-    'INCLUDEDUP',      => 'same file is included again',
-    'INDENTATION'      => 'wrong start column for code',
-    'LONGLINE'         => "Line longer than $max_column",
-    'SPACEBEFORELABEL' => 'labels not at the start of the line',
-    'MULTISPACE'       => 'multiple spaces used when not suitable',
-    'NOSPACEEQUALS'    => 'equals sign without preceding space',
-    'NOTEQUALSZERO',   => 'if/while comparison with != 0',
-    'ONELINECONDITION' => 'conditional block on the same line as the if()',
-    'OPENCOMMENT'      => 'file ended with a /* comment still "open"',
-    'PARENBRACE'       => '){ without sufficient space',
-    'RETURNNOSPACE'    => 'return without space',
-    'SEMINOSPACE'      => 'semicolon without following space',
-    'SIZEOFNOPAREN'    => 'use of sizeof without parentheses',
-    'SNPRINTF'         => 'use of snprintf',
-    'SPACEAFTERPAREN'  => 'space after open parenthesis',
-    'SPACEBEFORECLOSE' => 'space before a close parenthesis',
-    'SPACEBEFORECOMMA' => 'space before a comma',
-    'SPACEBEFOREPAREN' => 'space before an open parenthesis',
-    'SPACESEMICOLON'   => 'space before semicolon',
-    'SPACESWITCHCOLON' => 'space before colon of switch label',
-    'TABS'             => 'TAB characters not allowed',
-    'TRAILINGSPACE'    => 'Trailing whitespace on the line',
-    'TYPEDEFSTRUCT'    => 'typedefed struct',
-    'UNUSEDIGNORE'     => 'a warning ignore was not used',
+    'ASTERISKNOSPACE'       => 'pointer declared without space before asterisk',
+    'ASTERISKSPACE'         => 'pointer declared with space after asterisk',
+    'BADCOMMAND'            => 'bad !checksrc! instruction',
+    'BANNEDFUNC'            => 'a banned function was used',
+    'BANNEDPREPROC'         => 'a banned symbol was used on a preprocessor line',
+    'BRACEELSE'             => '} else on the same line',
+    'BRACEPOS'              => 'wrong position for an open brace',
+    'BRACEWHILE'            => 'A single space between open brace and while',
+    'CLOSEBRACE'            => 'close brace indent level vs line above is off',
+    'COMMANOSPACE'          => 'comma without following space',
+    'COMMENTNOSPACEEND'     => 'no space before */',
+    'COMMENTNOSPACESTART'   => 'no space following /*',
+    'COPYRIGHT'             => 'file missing a copyright statement',
+    'CPPCOMMENTS'           => '// comment detected',
+    'CPPSPACE'              => 'space before preprocessor hash',
+    'DOBRACE'               => 'A single space between do and open brace',
+    'EMPTYLINEBRACE'        => 'Empty line before the open brace',
+    'EQUALSNOSPACE'         => 'equals sign without following space',
+    'EQUALSNULL'            => 'if/while comparison with == NULL',
+    'EQUALSPACE'            => 'equals sign with too many spaces following',
+    'ERRNOVAR'              => 'use of bare errno define',
+    'EXCLAMATIONSPACE'      => 'Whitespace after exclamation mark in expression',
+    'FIXME'                 => 'FIXME or TODO comment',
+    'FOPENMODE'             => 'fopen needs a macro for the mode string',
+    'IFDEFSINGLE'           => 'use ifdef/ifndef for single macro checks',
+    'INCLUDEDUP'            => 'same file is included again',
+    'INDENTATION'           => 'wrong start column for code',
+    'LONGLINE'              => "Line longer than $max_column",
+    'MULTISPACE'            => 'multiple spaces used when not suitable',
+    'NOSPACEAND'            => 'missing space around Logical AND operator',
+    'NOSPACEC'              => 'missing space around ternary colon operator',
+    'NOSPACEEQUALS'         => 'equals sign without preceding space',
+    'NOSPACEPLUS'           => 'no space before plus sign',
+    'NOSPACEQ'              => 'missing space around ternary question mark operator',
+    'NOSPACETHAN'           => 'missing space around less or greater than',
+    'NOTEQUALSZERO'         => 'if/while comparison with != 0',
+    'ONELINECONDITION'      => 'conditional block on the same line as the if()',
+    'OPENCOMMENT'           => 'file ended with a /* comment still "open"',
+    'PARENBRACE'            => '){ without sufficient space',
+    'PLUSNOSPACE'           => 'no space after plus sign',
+    'RETURNNOSPACE'         => 'return without space',
+    'RETURNPAREN'           => 'return with paren',
+    'SEMINOSPACE'           => 'semicolon without following space',
+    'SIZEOFNOPAREN'         => 'use of sizeof without parentheses',
+    'SPACEAFTERPAREN'       => 'space after open parenthesis',
+    'SPACEBEFORECLOSE'      => 'space before a close parenthesis',
+    'SPACEBEFORECOMMA'      => 'space before a comma',
+    'SPACEBEFORELABEL'      => 'labels not at the start of the line',
+    'SPACEBEFOREPAREN'      => 'space before an open parenthesis',
+    'SPACESEMICOLON'        => 'space before semicolon',
+    'SPACESWITCHCOLON'      => 'space before colon of switch label',
+    'TABS'                  => 'TAB characters not allowed',
+    'TRAILINGSPACE'         => 'Trailing whitespace on the line',
+    'TYPEDEFSTRUCT'         => 'typedefed struct',
+    'UNUSEDIGNORE'          => 'a warning ignore was not used',
+    'USESAFEFREE'           => 'replace curlx_free() + NULL assignment with curlx_safefree()',
+    'VOIDEXCL'              => '(void)! is not something we like',
     );
 
 sub readskiplist {
     open(my $W, '<', "$dir/checksrc.skip") or return;
-    my @all=<$W>;
+    my @all = <$W>;
     for(@all) {
         $windows_os ? $_ =~ s/\r?\n$// : chomp;
-        $skiplist{$_}=1;
+        $skiplist{$_} = 1;
     }
     close($W);
 }
 
 # Reads the .checksrc in $dir for any extended warnings to enable locally.
 # Currently there is no support for disabling warnings from the standard set,
-# and since that's already handled via !checksrc! commands there is probably
+# and since that is already handled via !checksrc! commands there is probably
 # little use to add it.
 sub readlocalfile {
+    my ($file) = @_;
     my $i = 0;
+    my $rcfile;
 
-    open(my $rcfile, "<", "$dir/.checksrc") or return;
+    if(($dir eq ".") && $file =~ /\//) {
+        my $ldir;
+        if($file =~ /(.*)\//) {
+            $ldir = $1;
+            open($rcfile, "<", "$dir/$ldir/.checksrc") or return;
+        }
+    }
+    else {
+        open($rcfile, "<", "$dir/.checksrc") or return;
+    }
 
     while(<$rcfile>) {
+        $windows_os ? $_ =~ s/\r?\n$// : chomp;
         $i++;
 
         # Lines starting with '#' are considered comments
-        if (/^\s*(#.*)/) {
+        if(/^\s*(#.*)/) {
             next;
         }
-        elsif (/^\s*enable ([A-Z]+)$/) {
+        # Skip empty lines
+        elsif($_ eq '') {
+            next;
+        }
+        elsif(/^enable ([A-Z]+)$/) {
             if(!defined($warnings_extended{$1})) {
                 print STDERR "invalid warning specified in .checksrc: \"$1\"\n";
                 next;
             }
             $warnings{$1} = $warnings_extended{$1};
         }
-        elsif (/^\s*disable ([A-Z]+)$/) {
+        elsif(/^disable ([A-Z]+)$/) {
             if(!defined($warnings{$1})) {
                 print STDERR "invalid warning specified in .checksrc: \"$1\"\n";
                 next;
@@ -139,8 +262,14 @@ sub readlocalfile {
             # Accept-list
             push @alist, $1;
         }
+        elsif(/^banfunc ([^ ]*)/) {
+            $banfunc{$1} = $1;
+        }
+        elsif(/^allowfunc ([^ ]*)/) {
+            undef $banfunc{$1};
+        }
         else {
-            die "Invalid format in $dir/.checksrc on line $i\n";
+            die "Invalid format in $dir/.checksrc on line $i: $_\n";
         }
     }
     close($rcfile);
@@ -149,11 +278,11 @@ sub readlocalfile {
 sub checkwarn {
     my ($name, $num, $col, $file, $line, $msg, $error) = @_;
 
-    my $w=$error?"error":"warning";
-    my $nowarn=0;
+    my $w = $error ? "error" : "warning";
+    my $nowarn = 0;
 
     #if(!$warnings{$name}) {
-    #    print STDERR "Dev! there's no description for $name!\n";
+    #    print STDERR "Dev! there is no description for $name!\n";
     #}
 
     # checksrc.skip
@@ -173,20 +302,20 @@ sub checkwarn {
 
     if($nowarn) {
         $suppressed++;
-        if($w) {
-            $swarnings++;
+        if($error) {
+            $serrors++;
         }
         else {
-            $serrors++;
+            $swarnings++;
         }
         return;
     }
 
-    if($w) {
-        $warnings++;
+    if($error) {
+        $errors++;
     }
     else {
-        $errors++;
+        $warnings++;
     }
 
     $col++;
@@ -203,31 +332,47 @@ $file = shift @ARGV;
 
 while(defined $file) {
 
-    if($file =~ /-D(.*)/) {
+    if($file =~ /^-D(.*)/) {
         $dir = $1;
         $file = shift @ARGV;
         next;
     }
-    elsif($file =~ /-W(.*)/) {
+    elsif($file =~ /^-W(.*)/) {
         $wlist .= " $1 ";
         $file = shift @ARGV;
         next;
     }
-    elsif($file =~ /-A(.+)/) {
+    elsif($file =~ /^-b(.*)/) {
+        $banfunc{$1} = $1;
+        # print STDERR "ban use of \"$1\"\n";
+        $file = shift @ARGV;
+        next;
+    }
+    elsif($file =~ /^-a(.*)/) {
+        undef $banfunc{$1};
+        $file = shift @ARGV;
+        next;
+    }
+    elsif($file =~ /^-A(.+)/) {
         push @alist, $1;
         $file = shift @ARGV;
         next;
     }
-    elsif($file =~ /-i([1-9])/) {
+    elsif($file =~ /^-i([1-9])/) {
         $indent = $1 + 0;
         $file = shift @ARGV;
         next;
     }
-    elsif($file =~ /-m([0-9]+)/) {
+    elsif($file =~ /^-m([0-9]+)/) {
         $max_column = $1 + 0;
         $file = shift @ARGV;
         next;
     }
+    elsif($file =~ /^-v/) {
+        $verbose = 1;
+        $file = shift @ARGV;
+        next;
+    }
     elsif($file =~ /^(-h|--help)/) {
         undef $file;
         last;
@@ -240,11 +385,14 @@ if(!$file) {
     print "checksrc.pl [option] <file1> [file2] ...\n";
     print " Options:\n";
     print "  -A[rule]  Accept this violation, can be used multiple times\n";
-    print "  -D[DIR]   Directory to prepend file names\n";
+    print "  -a[func]  Allow use of this function\n";
+    print "  -b[func]  Ban use of this function\n";
+    print "  -D[DIR]   Directory to prepend filenames\n";
     print "  -h        Show help output\n";
     print "  -W[file]  Skip the given file - ignore all its flaws\n";
     print "  -i<n>     Indent spaces. Default: 2\n";
     print "  -m<n>     Maximum line length. Default: 79\n";
+    print "  -v        Verbose\n";
     print "\nDetects and warns for these problems:\n";
     my @allw = keys %warnings;
     push @allw, keys %warnings_extended;
@@ -257,16 +405,21 @@ if(!$file) {
         }
     }
     print " [*] = disabled by default\n";
+
+    print "\nDetects and bans use of these functions:\n";
+    for my $f (sort keys %banfunc) {
+        printf (" %-18s\n", $f);
+    }
     exit;
 }
 
 readskiplist();
-readlocalfile();
+readlocalfile($file);
 
 do {
-    if("$wlist" !~ / $file /) {
+    if($wlist !~ / $file /) {
         my $fullname = $file;
-        $fullname = "$dir/$file" if ($fullname !~ '^\.?\.?/');
+        $fullname = "$dir/$file" if($fullname !~ /^\.?\.?\//);
         scanfile($fullname);
     }
     $file = shift @ARGV;
@@ -279,8 +432,8 @@ sub accept_violations {
             print "'$r' is not a warning to accept!\n";
             exit;
         }
-        $ignore{$r}=999999;
-        $ignore_used{$r}=0;
+        $ignore{$r} = 999999;
+        $ignore_used{$r} = 0;
     }
 }
 
@@ -295,7 +448,7 @@ sub checksrc_endoffile {
     for(keys %ignore_set) {
         if($ignore_set{$_} && !$ignore_used{$_}) {
             checkwarn("UNUSEDIGNORE", $ignore_set{$_},
-                      length($_)+11, $file,
+                      length($_) + 11, $file,
                       $ignore_line[$ignore_set{$_}],
                       "Unused ignore: $_");
         }
@@ -311,9 +464,9 @@ sub enable_warn {
                   $line, length($what) + 11, $file, $l,
                   "No warning was inhibited!");
     }
-    $ignore_set{$what}=0;
-    $ignore_used{$what}=0;
-    $ignore{$what}=0;
+    $ignore_set{$what} = 0;
+    $ignore_used{$what} = 0;
+    $ignore{$what} = 0;
 }
 sub checksrc {
     my ($cmd, $line, $file, $l) = @_;
@@ -322,9 +475,9 @@ sub checksrc {
         $what =~ s: *\*/$::; # cut off end of C comment
         # print "ENABLE $enable WHAT $what\n";
         if($enable eq "disable") {
-            my ($warn, $scope)=($1, $2);
+            my ($warn, $scope) = ($1, $2);
             if($what =~ /([^ ]*) +(.*)/) {
-                ($warn, $scope)=($1, $2);
+                ($warn, $scope) = ($1, $2);
             }
             else {
                 $warn = $what;
@@ -332,7 +485,7 @@ sub checksrc {
             }
             # print "IGNORE $warn for SCOPE $scope\n";
             if($scope eq "all") {
-                $scope=999999;
+                $scope = 999999;
             }
 
             # Comparing for a literal zero rather than the scalar value zero
@@ -350,9 +503,9 @@ sub checksrc {
                           "$warn already disabled from line $ignore_set{$warn}");
             }
             else {
-                $ignore{$warn}=$scope;
-                $ignore_set{$warn}=$line;
-                $ignore_line[$line]=$l;
+                $ignore{$warn} = $scope;
+                $ignore_set{$warn} = $line;
+                $ignore_line[$line] = $l;
             }
         }
         elsif($enable eq "enable") {
@@ -376,15 +529,22 @@ sub scanfile {
     my ($file) = @_;
 
     my $line = 1;
-    my $prevl="";
-    my $prevpl="";
+    my $prevl = "";
+    my $prevpl = "";
     my $l = "";
     my $prep = 0;
     my $prevp = 0;
-    open(my $R, '<', $file) || die "failed to open $file";
+    my $prevfreeindent = "";
+    my $prevfreevar = "";
 
-    my $incomment=0;
-    my @copyright=();
+    if($verbose) {
+        printf "Checking file: $file\n";
+    }
+
+    open(my $R, '<', $file) or die "failed to open $file";
+
+    my $incomment = 0;
+    my @copyright = ();
     my %includes;
     checksrc_clear(); # for file based ignores
     accept_violations();
@@ -398,7 +558,14 @@ sub scanfile {
         # check for !checksrc! commands
         if($l =~ /\!checksrc\! (.*)/) {
             my $cmd = $1;
-            checksrc($cmd, $line, $file, $l)
+            checksrc($cmd, $line, $file, $l);
+        }
+
+        if($l =~ /^#line (\d+) \"([^\"]*)\"/) {
+            # a #line instruction
+            $file = $2;
+            $line = $1;
+            next;
         }
 
         # check for a copyright statement and save the years
@@ -406,10 +573,10 @@ sub scanfile {
             my $count = 0;
             while($l =~ /([\d]{4})/g) {
                 push @copyright, {
-                  year => $1,
-                  line => $line,
-                  col => index($l, $1),
-                  code => $l
+                    year => $1,
+                    line => $line,
+                    col => index($l, $1),
+                    code => $l
                 };
                 $count++;
             }
@@ -425,7 +592,7 @@ sub scanfile {
         }
 
         # detect long lines
-        if(length($l) > $max_column) {
+        if(length($l) > $max_column && $l !~ / https:\/\//) {
             checkwarn("LONGLINE", $line, length($l), $file, $l,
                       "Longer than $max_column columns");
         }
@@ -450,7 +617,13 @@ sub scanfile {
         if($l =~ /^(.*)\w\*\//) {
             checkwarn("COMMENTNOSPACEEND",
                       $line, length($1) + 1, $file, $l,
-                      "Missing space end comment end");
+                      "Missing space before comment end");
+        }
+
+        if($l =~ /(.*)(FIXME|TODO)/) {
+            checkwarn("FIXME",
+                      $line, length($1), $file, $l,
+                      "Avoid $2 comments. Add to documentation instead");
         }
         # ------------------------------------------------------------
         # Above this marker, the checks were done on lines *including*
@@ -477,7 +650,7 @@ sub scanfile {
             }
             else {
                 # still within a comment
-                $l="";
+                $l = "";
             }
         }
 
@@ -501,6 +674,11 @@ sub scanfile {
                       $line, length($1), $file, $l, "\/\/ comment");
         }
 
+        if($l =~ /^(\s*#\s*if\s+!?\s*defined\()[a-zA-Z0-9_]+\)$/) {
+            checkwarn("IFDEFSINGLE",
+                      $line, length($1), $file, $l, "use ifdef/ifndef for single macro checks");
+        }
+
         if($l =~ /^(\#\s*include\s+)([\">].*[>}"])/) {
             my ($pre, $path) = ($1, $2);
             if($includes{$path}) {
@@ -510,6 +688,11 @@ sub scanfile {
             $includes{$path} = $l;
         }
 
+        # detect leading space before the hash
+        if($l =~ /^([ \t]+)\#/) {
+            checkwarn("CPPSPACE",
+                      $line, 0, $file, $l, "space before preprocessor hash");
+        }
         # detect and strip preprocessor directives
         if($l =~ /^[ \t]*\#/) {
             # preprocessor line
@@ -520,7 +703,7 @@ sub scanfile {
         my $nostr = nostrings($l);
         # check spaces after for/if/while/function call
         if($nostr =~ /^(.*)(for|if|while|switch| ([a-zA-Z0-9_]+)) \((.)/) {
-            my ($leading, $word, $extra, $first)=($1,$2,$3,$4);
+            my ($leading, $word, $extra, $first) = ($1, $2, $3, $4);
             if($1 =~ / *\#/) {
                 # this is a #if, treat it differently
             }
@@ -572,7 +755,7 @@ sub scanfile {
             my $cond = $4;
             if($cond =~ / = /) {
                 checkwarn("ASSIGNWITHINCONDITION",
-                          $line, $pos+1, $file, $l,
+                          $line, $pos + 1, $file, $l,
                           "assignment within conditional expression");
             }
             my $temp = $cond;
@@ -601,6 +784,76 @@ sub scanfile {
                       "space after open parenthesis");
         }
 
+        # check spaces before Logical AND operator
+        if($nostr =~ /^(.*)\w&&/i) {
+            checkwarn("NOSPACEAND",
+                      $line, length($1)+1, $file, $l,
+                      "missing space before Logical AND");
+        }
+
+        # check spaces after Logical AND operator
+        if($nostr =~ /^(.*&&)\w/i) {
+            checkwarn("NOSPACEAND",
+                      $line, length($1), $file, $l,
+                      "missing space after Logical AND");
+        }
+
+        # check spaces before colon
+        if($nostr =~ /^(.*[^']\?[^'].*)(\w|\)|\]|')\:/i) {
+            my $m = $1;
+            my $e = $nostr;
+            $e =~ s/'(.)':'(.)'/$1:$2/g; # eliminate chars quotes that surround colon
+            $e =~ s/':'//g;              # ignore these
+            if($e =~ /^(.*[^']\?[^'].*)(\w|\)|\]|')\:/i) {
+                checkwarn("NOSPACEC",
+                          $line, length($m)+1, $file, $l,
+                          "missing space before colon");
+            }
+        }
+        # check spaces after colon
+        if($nostr =~ /^(.*[^'"]\?[^'"].*)\:(\w|\)|\]|')/i) {
+            my $m = $1;
+            my $e = $nostr;
+            $e =~ s/'(.)':'(.)'/$1:$2/g; # eliminate chars quotes that surround colon
+            $e =~ s/':'//g;              # ignore these
+            if($e =~ /^(.*[^'"]\?[^'"].*)\:(\w|\)|\]|')/i) {
+                checkwarn("NOSPACEC",
+                          $line, length($m)+1, $file, $l,
+                          "missing space after colon");
+            }
+        }
+
+        # check spaces before question mark
+        if($nostr =~ /^(.*)(\w|\)|\]|')\?/i) {
+            my $m = $1;
+            my $e = $nostr;
+            $e =~ s/'?'//g; # ignore these
+            if($e =~ /^(.*)(\w|\)|\]|')\?/i) {
+                checkwarn("NOSPACEQ",
+                          $line, length($m)+1, $file, $l,
+                          "missing space before question mark");
+            }
+        }
+        # check spaces after question mark
+        if($nostr =~ /^(.*)\?\w/i) {
+            checkwarn("NOSPACEQ",
+                      $line, length($1)+1, $file, $l,
+                      "missing space after question mark");
+        }
+
+        # check spaces before less or greater than
+        if($nostr =~ /^(.*)(\w|\)|\])[<>]/) {
+            checkwarn("NOSPACETHAN",
+                      $line, length($1)+1, $file, $l,
+                      "missing space before less or greater than");
+        }
+        # check spaces after less or greater than
+        if($nostr =~ /^(.*)[^-][<>](\w|\(|\[)/) {
+            checkwarn("NOSPACETHAN",
+                      $line, length($1)+1, $file, $l,
+                      "missing space after less or greater than");
+        }
+
         # check spaces before close parentheses, unless it was a space or a
         # close parenthesis!
         if($l =~ /(.*[^\) ]) \)/) {
@@ -617,7 +870,7 @@ sub scanfile {
         }
 
         # check for "return(" without space
-        if($l =~ /^(.*)return\(/) {
+        if($l =~ /^(.*\W)return\(/) {
             if($1 =~ / *\#/) {
                 # this is a #if, treat it differently
             }
@@ -627,6 +880,12 @@ sub scanfile {
             }
         }
 
+        # check for "return" with parentheses around a value/name
+        if($l =~ /^(.*\W)return \(\w*\);/) {
+            checkwarn("RETURNPAREN", $line, length($1)+7, $file, $l,
+                      "return with paren");
+        }
+
         # check for "sizeof" without parenthesis
         if(($l =~ /^(.*)sizeof *([ (])/) && ($2 ne "(")) {
             if($1 =~ / *\#/) {
@@ -640,15 +899,15 @@ sub scanfile {
 
         # check for comma without space
         if($l =~ /^(.*),[^ \n]/) {
-            my $pref=$1;
-            my $ign=0;
+            my $pref = $1;
+            my $ign = 0;
             if($pref =~ / *\#/) {
                 # this is a #if, treat it differently
-                $ign=1;
+                $ign = 1;
             }
             elsif($pref =~ /\/\*/) {
                 # this is a comment
-                $ign=1;
+                $ign = 1;
             }
             elsif($pref =~ /[\"\']/) {
                 $ign = 1;
@@ -670,6 +929,21 @@ sub scanfile {
             }
         }
 
+        # when the line starts with a brace
+        if($l =~ /^( *)\}/) {
+            my $tlen = length($1);
+            if($prevl =~ /^( *)(.)/) {
+                my $plen = length($1);
+                my $firstc = $2;
+                # skips the check if the previous line starts with a close
+                # brace since we see the occasional legit use of that oddity
+                if(($tlen + $indent) > $plen && ($firstc ne "}")) {
+                    checkwarn("CLOSEBRACE",
+                              $line, $plen, $file, $prevl,
+                              "Suspicious close brace indentation");
+                }
+            }
+        }
         # check for "} else"
         if($l =~ /^(.*)\} *else/) {
             checkwarn("BRACEELSE",
@@ -703,42 +977,60 @@ sub scanfile {
                       $line, length($1), $file, $ol, "no space before label");
         }
 
-        # scan for use of banned functions
-        if($l =~ /^(.*\W)
-                   (gmtime|localtime|
-                    gets|
-                    strtok|
-                    v?sprintf|
-                    (str|_mbs|_tcs|_wcs)n?cat|
-                    LoadLibrary(Ex)?(A|W)?)
-                   \s*\(
-                 /x) {
-            checkwarn("BANNEDFUNC",
-                      $line, length($1), $file, $ol,
-                      "use of $2 is banned");
+        if($prevfreevar ne "") {
+            if(rindex($l, "$prevfreeindent$prevfreevar = NULL;", 0) == 0) {
+                checkwarn("USESAFEFREE",
+                          $line, length($prevfreeindent), $file, $ol,
+                          "replace curlx_free() + NULL assignment with curlx_safefree()");
+            }
         }
-        if($warnings{"STRERROR"}) {
-            # scan for use of banned strerror. This is not a BANNEDFUNC to
+        if($l) {
+            if($l =~ /^( *)curlx_free\(([^)]+)\);/) {
+                $prevfreeindent = $1;
+                $prevfreevar = $2;
+            }
+            else {
+                $prevfreeindent = "";
+                $prevfreevar = "";
+            }
+        }
+
+        # scan for use of banned functions
+        my $bl = $l;
+      again:
+        if((($l =~ /^(.*?\W)(\w+)(\s*\()/x) && $banfunc{$2}) ||
+           (($l =~ /^(.*?\()(\w+)(\s*\()/x) && $banfunc{$2})) {
+            my $bad = $2;
+            my $prefix = $1;
+            my $suff = $3;
+            if($prefix !~ /(->|\.)$/) {
+                checkwarn("BANNEDFUNC",
+                          $line, length($prefix), $file, $ol,
+                          "use of $bad is banned");
+            }
+            my $search = quotemeta($prefix . $bad . $suff);
+            my $replace = $prefix . 'x' x (length($bad) + 1);
+            $l =~ s/$search/$replace/;
+            goto again;
+        }
+        $l = $bl; # restore to pre-bannedfunc content
+
+        if($warnings{"STDERR"}) {
+            # scan for use of banned stderr. This is not a BANNEDFUNC to
             # allow for individual enable/disable of this warning.
-            if($l =~ /^(.*\W)(strerror)\s*\(/x) {
+            if($l =~ /^([^\"-]*\W)(stderr)[^\"_]/x) {
                 if($1 !~ /^ *\#/) {
                     # skip preprocessor lines
-                    checkwarn("STRERROR",
+                    checkwarn("STDERR",
                               $line, length($1), $file, $ol,
-                              "use of $2 is banned");
+                              "use of $2 is banned (use tool_stderr instead)");
                 }
             }
         }
-        # scan for use of snprintf for curl-internals reasons
-        if($l =~ /^(.*\W)(v?snprintf)\s*\(/x) {
-            checkwarn("SNPRINTF",
-                      $line, length($1), $file, $ol,
-                      "use of $2 is banned");
-        }
 
         # scan for use of non-binary fopen without the macro
-        if($l =~ /^(.*\W)fopen\s*\([^,]*, *\"([^"]*)/) {
-            my $mode = $2;
+        if($l =~ /^(.*\W)(curlx_fopen|CURLX_FOPEN_LOW|curlx_freopen|CURLX_FREOPEN_LOW)\s*\([^,]*, *\"([^"]*)/) {
+            my $mode = $3;
             if($mode !~ /b/) {
                 checkwarn("FOPENMODE",
                           $line, length($1), $file, $ol,
@@ -747,7 +1039,7 @@ sub scanfile {
         }
 
         # check for open brace first on line but not first column only alert
-        # if previous line ended with a close paren and it wasn't a cpp line
+        # if previous line ended with a close paren and it was not a cpp line
         if(($prevl =~ /\)\z/) && ($l =~ /^( +)\{/) && !$prevp) {
             checkwarn("BRACEPOS",
                       $line, length($1), $file, $ol, "badly placed open brace");
@@ -766,13 +1058,12 @@ sub scanfile {
                     my $diff = $second - $first;
                     checkwarn("INDENTATION", $line, length($1), $file, $ol,
                               "not indented $indent steps (uses $diff)");
-
                 }
             }
         }
 
         # if the previous line starts with if/while/for AND ends with a closed
-        # parenthesis and there's an equal number of open and closed
+        # parenthesis and there is an equal number of open and closed
         # parentheses, check that this line is indented $indent more steps, if
         # not a cpp line
         elsif(!$prevp && ($prevl =~ /^( *)(if|while|for)(\(.*\))\z/)) {
@@ -835,6 +1126,12 @@ sub scanfile {
                       $line, length($1)+1, $file, $ol,
                       "no space before equals sign");
         }
+        # check for equals sign with more than one space after it
+        elsif($l =~ /(.*)[a-z0-9] \=  /i) {
+            checkwarn("EQUALSPACE",
+                      $line, length($1)+3, $file, $ol,
+                      "more than one space after equals sign");
+        }
 
         # check for plus signs without spaces next to it
         if($nostr =~ /(.*)[^+]\+[a-z0-9]/i) {
@@ -869,6 +1166,18 @@ sub scanfile {
                       "space after exclamation mark");
         }
 
+        if($nostr =~ /(.*)\(void\)\!/) {
+            checkwarn("VOIDEXCL",
+                      $line, length($1)+1, $file, $ol,
+                      "exclamation after (void) is weird");
+        }
+
+        if($nostr =~ /(.*)\b(EACCES|EADDRINUSE|EADDRNOTAVAIL|EAFNOSUPPORT|EBADF|ECONNREFUSED|ECONNRESET|EINPROGRESS|EINTR|EINVAL|EISCONN|EMSGSIZE|ENOMEM|ETIMEDOUT|EWOULDBLOCK)\b/) {
+            checkwarn("ERRNOVAR",
+                      $line, length($1), $file, $ol,
+                      "use of bare errno define $2, use SOCK$2");
+        }
+
         # check for more than one consecutive space before open brace or
         # question mark. Skip lines containing strings since they make it hard
         # due to artificially getting multiple spaces
@@ -879,6 +1188,18 @@ sub scanfile {
                       "multiple spaces");
         }
       preproc:
+        if($prep) {
+            # scan for use of banned symbols on a preprocessor line
+            if($l =~ /^(^|.*\W)
+                       (WIN32)
+                       (\W|$)
+                     /x) {
+                checkwarn("BANNEDPREPROC",
+                          $line, length($1), $file, $ol,
+                          "use of $2 is banned from preprocessor lines" .
+                          (($2 eq "WIN32") ? ", use _WIN32 instead" : ""));
+            }
+        }
         $line++;
         $prevp = $prep;
         $prevl = $ol if(!$prep);
@@ -889,7 +1210,7 @@ sub scanfile {
         checkwarn("COPYRIGHT", 1, 0, $file, "", "Missing copyright statement", 1);
     }
 
-    # COPYRIGHTYEAR is a extended warning so we must first see if it has been
+    # COPYRIGHTYEAR is an extended warning so we must first see if it has been
     # enabled in .checksrc
     if(defined($warnings{"COPYRIGHTYEAR"})) {
         # The check for updated copyrightyear is overly complicated in order to
@@ -899,25 +1220,25 @@ sub scanfile {
         # which are tracked in the Git repo and edited in the workdir, or
         # committed locally on the branch without being in upstream master.
         #
-        # The simple and naive test is to simply check for the current year,
+        # The simple and naive test is to check for the current year,
         # but updating the year even without an edit is against project policy
         # (and it would fail every file on January 1st).
         #
         # A rather more interesting, and correct, check would be to not test
         # only locally committed files but inspect all files wrt the year of
         # their last commit. Removing the `git rev-list origin/master..HEAD`
-        # condition below will enforce copyright year checks against the year
+        # condition below enforces copyright year checks against the year
         # the file was last committed (and thus edited to some degree).
         my $commityear = undef;
         @copyright = sort {$$b{year} cmp $$a{year}} @copyright;
 
         # if the file is modified, assume commit year this year
-        if(`git status -s -- "$file"` =~ /^ [MARCU]/) {
+        if(qx(git status -s -- "$file") =~ /^ [MARCU]/) {
             $commityear = (localtime(time))[5] + 1900;
         }
         else {
             # min-parents=1 to ignore wrong initial commit in truncated repos
-            my $grl = `git rev-list --max-count=1 --min-parents=1 --timestamp HEAD -- "$file"`;
+            my $grl = qx(git rev-list --max-count=1 --min-parents=1 --timestamp HEAD -- "$file");
             if($grl) {
                 chomp $grl;
                 $commityear = (localtime((split(/ /, $grl))[0]))[5] + 1900;
@@ -940,10 +1261,8 @@ sub scanfile {
     checksrc_endoffile($file);
 
     close($R);
-
 }
 
-
 if($errors || $warnings || $verbose) {
     printf "checksrc: %d errors and %d warnings\n", $errors, $warnings;
     if($suppressed) {
@@ -951,5 +1270,7 @@ if($errors || $warnings || $verbose) {
         $serrors,
         $swarnings;
     }
-    exit 5; # return failure
+    if($errors || $warnings) {
+        exit 5; # return failure
+    }
 }
diff --git a/third-party/curl/scripts/ciconfig.pl b/third-party/curl/scripts/ciconfig.pl
deleted file mode 100644
index 7c31f8e4a0..0000000000
--- a/third-party/curl/scripts/ciconfig.pl
+++ /dev/null
@@ -1,185 +0,0 @@
-#!/usr/bin/perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-# these options are enabled by default in the sense that they will attempt to
-# check for and use this feature without the configure flag
-my %defaulton = (
-    # --enable-
-    'shared' => 1,
-    'static' => 1,
-    'fast-install' => 1,
-    'silent-rules' => 1,
-    'optimize' => 1,
-    'http' => 1,
-    'ftp' => 1,
-    'file' => 1,
-    'ldap' => 1,
-    'ldaps' => 1,
-    'rtsp' => 1,
-    'proxy' => 1,
-    'dict' => 1,
-    'telnet' => 1,
-    'tftp' => 1,
-    'pop3' => 1,
-    'imap' => 1,
-    'smb' => 1,
-    'smtp' => 1,
-    'gopher' => 1,
-    'mqtt' => 1,
-    'manual' => 1,
-    'libcurl-option' => 1,
-    'libgcc' => 1,
-    'ipv6' => 1,
-    'openssl-auto-load-config' => 1,
-    'versioned-symbols' => 1,
-    'symbol-hiding' => 1,
-    'threaded-resolver' => 1,
-    'pthreads' => 1,
-    'verbose' => 1,
-    'crypto-auth' => 1,
-    'ntlm' => 1,
-    'ntlm-wb' => 1,
-    'tls-srp' => 1,
-    'unix-sockets' => 1,
-    'cookies' => 1,
-    'socketpair' => 1,
-    'http-auth' => 1,
-    'doh' => 1,
-    'mime' => 1,
-    'dateparse' => 1,
-    'netrc' => 1,
-    'progress-meter' => 1,
-    'dnsshuffle' => 1,
-    'get-easy-options' => 1,
-    'alt-svc' => 1,
-    'hsts' => 1,
-
-    # --with-
-    'aix-soname' => 1,
-    'pic' => 1,
-    'zlib' => 1,
-    'zstd' => 1,
-    'brotli' => 1,
-    'random' => 1,
-    'ca-bundle' => 1,
-    'ca-path' => 1,
-    'libssh2' => 1,
-    'nghttp2' => 1,
-    'librtmp' => 1,
-    'libidn2' => 1,
-    'sysroot' => 1,
-    'lber-lib' => 1,
-    'ldap-lib' => 1,
-
-    );
-
-
-sub configureopts {
-    my ($opts)=@_;
-    my %thisin;
-    my %thisout;
-
-    while($opts =~ s/--with-([^ =]*)//) {
-        $with{$1}++;
-        $used{$1}++;
-        $thisin{$1}++;
-    }
-    while($opts =~ s/--enable-([^ =]*)//) {
-        $with{$1}++;
-        $used{$1}++;
-        $thisin{$1}++;
-    }
-
-    while($opts =~ s/--without-([^ =]*)//) {
-        $without{$1}++;
-        $used{$1}++;
-        $thisout{$1}++;
-    }
-    while($opts =~ s/--disable-([^ =]*)//) {
-        $without{$1}++;
-        $used{$1}++;
-        $thisout{$1}++;
-    }
-    return join(" ", sort(keys %thisin), "/", sort(keys %thisout));
-}
-
-# run configure --help and check what available WITH/ENABLE options that exist
-sub configurehelp {
-    open(C, "./configure --help|");
-    while(<C>) {
-        if($_ =~ /^  --(with|enable)-([a-z0-9-]+)/) {
-            $avail{$2}++;
-        }
-    }
-    close(C);
-}
-
-sub scanjobs {
-
-    my $jobs;
-    open(CI, "./scripts/cijobs.pl|");
-    while(<CI>) {
-        if($_ =~ /^\#\#\#/) {
-            $jobs++;
-        }
-        if($_ =~ /^configure: (.*)/) {
-            my $c= configureopts($1);
-            #print "C: $c\n";
-        }
-    }
-    close(CI);
-}
-
-configurehelp();
-scanjobs();
-
-print "Used configure options (with / without)\n";
-for my $w (sort keys %used) {
-    printf "  %s: %d %d%s\n", $w, $with{$w}, $without{$w},
-        $defaulton{$w} ? " (auto)":"";
-}
-
-print "Never used configure options\n";
-for my $w (sort keys %avail) {
-    if(!$used{$w}) {
-        printf "  %s%s\n", $w,
-            $defaulton{$w} ? " (auto)":"";
-    }
-}
-
-print "Never ENABLED configure options that aren't on by default\n";
-for my $w (sort keys %avail) {
-    if(!$with{$w} && !$defaulton{$w}) {
-        printf "  %s\n", $w;
-    }
-}
-
-
-print "ENABLED configure options that aren't available\n";
-for my $w (sort keys %with) {
-    if(!$avail{$w}) {
-        printf "  %s\n", $w;
-    }
-}
diff --git a/third-party/curl/scripts/cijobs.pl b/third-party/curl/scripts/cijobs.pl
deleted file mode 100644
index a73b3f5bf5..0000000000
--- a/third-party/curl/scripts/cijobs.pl
+++ /dev/null
@@ -1,510 +0,0 @@
-#!/usr/bin/perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-my %filelevel= ('file' => 1,
-                'service' => 1);
-
-my $jobid = 1;
-
-sub submit {
-    my ($jref)=@_;
-    my %job = %$jref;
-
-    printf "\n##### job %u \n", $jobid++;
-    for my $k (sort keys %job) {
-        printf "%s: %s\n", $k, $job{$k} if($job{$k});
-        undef $$jref{$k} if(!$filelevel{$k});
-    }
-}
-
-sub githubactions {
-    my ($tag)=@_;
-    my @files= `git ls-tree -r --name-only $tag .github/workflows 2>/dev/null`;
-    my $c = 0;
-    foreach my $f (sort @files) {
-        my $j = 0;
-        my $m = -1;
-        my $done = 0;
-        chomp $f;
-        open(G, "git show $tag:$f 2>/dev/null|");
-        # start counting file jobs
-        undef %job;
-        $job{'file'} = $f;
-        $job{'service'} = "gha";
-        my @cc;
-        my $os;
-        my $topname;
-        my $line = 1;
-        while(<G>) {
-            $job{'line'} = $line;
-            if($_ =~ /^name: (.*)/) {
-                $topname=$1;
-            }
-            elsif($_ =~ /runs-on: (.*)/) {
-                my $r = $1;
-                #print "runs-on: $r\n";
-                if($r =~ /ubuntu/) {
-                    $os = "linux";
-                }
-                elsif($r =~ /macos/) {
-                    $os = "macos";
-                }
-                elsif($r =~ /windows/) {
-                    $os = "windows";
-                }
-
-                # commit previously counted jobs
-                $c += $j;
-                # non-matrix job
-                $j = 1;
-            }
-            elsif($_ =~ /^\s*matrix:/) {
-                # switch to matrix mode
-                $m = 0;
-                $j = 0;
-            }
-            elsif($_ =~ /^    - run: .* apt-get install (.*)/) {
-                $job{'install'} = $1;
-            }
-            elsif($m >= 0) {
-                if($_ =~ /^        - name: (.*)/) {
-                    # matrix job
-                    #print "name: $1\n";
-                    $job{'name'} = $1;
-                    $j += ($m?$m:1);
-                }
-                elsif($_ =~ /install: (.*)/) {
-                    $job{'install'} = $1;
-                }
-                elsif($_ =~ /( |curl-)configure: (.*)/) {
-                    $job{'configure'} = $2;
-                    $job{'os'}=$os;
-                    submit(\%job);
-                    $done++;
-                }
-                elsif($_ =~ /generate: (.*)/) {
-                    $job{'cmake'} = $1;
-                    if($m) {
-                        # matrix mode, multiple copies
-                        my %dupe = %job;
-                        for my $cc (@cc) {
-                            %job = %dupe;
-                            $job{'cc'} = $cc;
-                            $job{'os'}=$os;
-                            submit(\%job);
-                            $done++;
-                        }
-                    }
-                    else {
-                        $job{'os'}=$os;
-                        submit(\%job);
-                        $done++;
-                    }
-                }
-                elsif($_ =~ /- CC: (.*)/) {
-                    # matrix multiplier
-                    push @cc, $1;
-                    $m++;
-                }
-                elsif($_ =~ /^\s*steps:/) {
-                    # disable matrix mode
-                    $m = -1;
-                }
-            }
-            $line++;
-        }
-        close(G);
-        # commit final counted jobs
-        $c += $j;
-
-        if(!$done) {
-            $job{'name'} = $topname? $topname : '[unnamed]';
-            $job{'os'}=$os;
-            submit(\%job);
-            $done++;
-        }
-        # reset internal job counter
-        $j = 0;
-    }
-    #print "Jobs: $c\n";
-    return $c;
-}
-
-sub azurepipelines {
-    my ($tag)=@_;
-    open(G, "git show $tag:.azure-pipelines.yml 2>/dev/null|");
-    my $c = 0;
-    my $j = 0;
-    my $m = -1;
-    my $image;
-    my %job;
-    my $line = 1;
-    my $os;
-    $job{'file'} = ".azure-pipelines.yml";
-    $job{'service'} = "azure";
-    while(<G>) {
-        if($_ =~ /^      vmImage: (.*)/) {
-            my $i = $1;
-            if($i =~ /ubuntu/) {
-                $os = "linux";
-            }
-            elsif($i =~ /windows/) {
-                $os = "windows";
-            }
-        }
-        elsif($_ =~ /^- stage: (.*)/) {
-            my $topname = $1;
-            if($topname !~ /(windows|linux)/) {
-                $job{'name'} = $topname;
-                $job{'line'}=$line;
-                submit(\%job);
-            }
-        }
-        elsif($_ =~ /job:/) {
-            # commit previously counted jobs
-            $c += $j;
-            # initial value for non-matrix job
-            $j = 1;
-        }
-        elsif($_ =~ /matrix:/) {
-            # start of new matrix list(!)
-            $m = 0;
-            $j = 0;
-        }
-        elsif($m >= 0) {
-            if($_ =~ /^          name: (.*)/) {
-                # single matrix list entry job
-                $j++;
-                $job{'name'} = $1;
-            }
-            # azure matrix is a simple list,
-            # therefore no multiplier needed
-            elsif($_ =~ /steps:/) {
-                # disable matrix mode
-                $m = -1;
-            }
-            elsif($_ =~ /^          configure: (.*)/) {
-                $job{'configure'} = $1;
-                $job{'line'}=$line;
-                $job{'os'}=$os;
-                submit(\%job);
-            }
-        }
-        $line++;
-    }
-    close(G);
-    # commit final counted jobs
-    $c += $j;
-
-    return $c;
-}
-
-sub appveyor {
-    my ($tag)=@_;
-    open(G, "git show $tag:appveyor.yml 2>/dev/null|");
-    my $c = 0;
-    my %job;
-    my $line=0;
-    $job{'file'} = "appveyor.yml";
-    $job{'service'} = "appveyor";
-
-    while(<G>) {
-        $line++;
-        if($_ =~ /^(      - |install)/) {
-            if($job{'image'}) {
-                $job{'os'} = "windows";
-                submit(\%job);
-                $c++;
-            }
-        }
-        $job{'line'} = $line;
-        if($_ =~ /^        APPVEYOR_BUILD_WORKER_IMAGE: \"(.*)\"/) {
-            $job{'image'}= $1;
-        }
-        elsif($_ =~ /^        BUILD_SYSTEM: (.*)/) {
-            $job{'build'} = lc($1);
-        }
-        elsif($_ =~ /^        PRJ_GEN: \"(.*)\"/) {
-            $job{'compiler'} = $1;
-        }
-        elsif($_ =~ /^        PRJ_CFG: (.*)/) {
-            $job{'config'} = $1;
-        }
-        elsif($_ =~ /^        OPENSSL: (.*)/) {
-            $job{'openssl'} = $1 eq "ON" ? "true": "false";
-        }
-        elsif($_ =~ /^        SCHANNEL: (.*)/) {
-            $job{'schannel'} = $1 eq "ON" ? "true": "false";
-        }
-        elsif($_ =~ /^        ENABLE_UNICODE: (.*)/) {
-            $job{'unicode'} = $1 eq "ON" ? "true": "false";
-        }
-        elsif($_ =~ /^        HTTP_ONLY: (.*)/) {
-            $job{'http-only'} = $1 eq "ON" ? "true": "false";
-        }
-        elsif($_ =~ /^        TESTING: (.*)/) {
-            $job{'testing'} = $1 eq "ON" ? "true": "false";
-        }
-        elsif($_ =~ /^        SHARED: (.*)/) {
-            $job{'shared'} = $1 eq "ON" ? "true": "false";
-        }
-        elsif($_ =~ /^        TARGET: \"-A (.*)\"/) {
-            $job{'target'} = $1;
-        }
-    }
-    close(G);
-
-    return $c;
-}
-
-sub cirrus {
-    my ($tag)=@_;
-    open(G, "git show $tag:.cirrus.yml 2>/dev/null|");
-    my $c = 0;
-    my %job;
-    my $line=0;
-    my $name = 0;
-    my $os;
-    $job{'file'} = ".cirrus.yml";
-    $job{'service'} = "cirrus";
-    while(<G>) {
-        $line++;
-        if($_ =~ /^    ( |-) (name|image_family|image):/) {
-            $c++;
-        }
-        if($_ =~ /^    - name:/) {
-            if($name) {
-                $job{'os'} = $os;
-                $job{'line'} = $line;
-                submit(\%job);
-                $name = 0;
-            }
-        }
-        if($_ =~ /^    - name: (.*)/) {
-            $job{'name'} = $1;
-            $name = 1;
-        }
-        elsif($_ =~ /^        image_family: (.*)/) {
-            $os = "freebsd";
-        }
-        elsif($_ =~ /^windows_task:/) {
-            $os = "windows";
-        }
-        elsif($_ =~ /^        prepare: pacman -S --needed --noconfirm --noprogressbar (.*)/) {
-            $job{'install'} = $1;
-        }
-        elsif($_ =~ /^        configure: (.*)/) {
-            $job{'configure'} = $1;
-        }
-    }
-    close(G);
-    if($name) {
-        $job{'os'} = $os;
-        $job{'line'} = $line;
-        submit(\%job);
-    }
-    return $c;
-}
-
-sub circle {
-    my ($tag)=@_;
-    open(G, "git show $tag:.circleci/config.yml 2>/dev/null|");
-    my $c = 0;
-    my $wf = 0;
-    my %job;
-    my %cmd;
-    my %configure;
-    my %target;
-    my $line=0;
-    my $cmds;
-    my $jobs;
-    my $workflow;
-    $job{'file'} = ".circleci/config.yml";
-    $job{'service'} = "circleci";
-    while(<G>) {
-        $line++;
-        if($_ =~ /^commands:/) {
-            # we record configure lines in this state
-            $cmds = 1;
-        }
-        elsif($cmds) {
-            if($_ =~ /^  ([^ ]*):/) {
-                $cmdname = $1;
-            }
-            elsif($_ =~ /^            .*.\/configure (.*)/) {
-                $cmd{$cmdname}=$1;
-            }
-        }
-        if($_ =~ /^jobs:/) {
-            # we record which job runs with configure here
-            $jobs = 1;
-            $cmds = 0;
-        }
-        elsif($jobs) {
-            if($_ =~ /^  ([^ ]*):/) {
-                $jobname = $1;
-            }
-            elsif($_ =~ /^      - (configure.*)/) {
-                $configure{$jobname}=$1;
-            }
-            elsif($_ =~ /^    resource_class: arm.medium/) {
-                $target{$jobname}="arm";
-            }
-        }
-        if($_ =~ /^workflows:/) {
-            $wf = 1;
-            $cmds = 0;
-        }
-        elsif($wf) {
-            if($_ =~ /^  ([^ ]+):/) {
-                $workflow = $1;
-            }
-            elsif($_ =~ /^      - (.*)\n/) {
-                my $jb = $1;
-                my $cnfgure = $configure{$jb};
-                my $trgt = $target{$jb};
-                $job{'configure'} = $cmd{$cnfgure};
-                $job{'name' }=$workflow;
-                $job{'os'} = "linux";
-                $job{'line'} = $line;
-                $job{'target'} = $trgt if($trgt);
-                submit(\%job);
-            }
-            if($_ =~ / *jobs:/) {
-                $c++;
-            }
-        }
-    }
-    close(G);
-    return $c;
-}
-
-sub zuul {
-    my ($tag)=@_;
-    open(G, "git show $tag:zuul.d/jobs.yaml 2>/dev/null|");
-    my $c = 0;
-    my %job;
-    my $line=0;
-    my $type;
-    $job{'file'} = "zuul.d/jobs.yaml";
-    $job{'service'} = "zuul";
-    while(<G>) {
-        $line++;
-        #print "L: ($jobmode / $env) $_";
-        if($_ =~ /^- job:/) {
-            $jobmode = 1; # start a new
-            $type="configure";
-        }
-        if($jobmode) {
-            if($apt) {
-                if($_ =~ /^        - (.*)/) {
-                    my $value = $1;
-                    $job{'install'} .= "$value ";
-                }
-                else {
-                    $apt = 0; # end of curl_apt_packages
-                }
-            }
-            if($env) {
-                if($envcont) {
-                    if($_ =~ /^          (.*)/) {
-                        $job{$envcont} .= "$1 ";
-                    }
-                    else {
-                        $envcont = "";
-                    }
-                }
-                if($_ =~ /^        ([^:]+): (.*)/) {
-                    my ($var, $value) = ($1, $2);
-
-                    if($var eq "C") {
-                        $var = $type;
-                    }
-                    elsif($var eq "T") {
-                        $var = "tests";
-                        if($value eq "cmake") {
-                            # otherwise it remains configure
-                            $type = "cmake";
-                        }
-                    }
-                    elsif($var eq "CC") {
-                        $var = "compiler";
-                    }
-                    elsif($var eq "CHECKSRC") {
-                        $job{'checksrc'} = $value ? "true": "false";
-                        $var = "";
-                    }
-                    else {
-                        $var = "";
-                    }
-                    if($value eq ">-") {
-                        $envcont = $var;
-                    }
-                    elsif($var) {
-                        $job{$var} = $value;
-                    }
-                }
-                elsif($_ !~ /^        /) {
-                    # end of envs
-                    $env = 0;
-                }
-            }
-            if($_ =~ /^      curl_env:/) {
-                $env = 1; # start of envs
-            }
-            elsif($_ =~ /^      curl_apt_packages:/) {
-                $apt = 1; # start of apt packages
-            }
-            elsif($_ =~ /^    name: (.*)/) {
-                my $n = $1;
-                if($n eq "curl-base") {
-                    # not counted
-                    $jobmode = 0;
-                    next;
-                }
-                $job{'name'} = $n;
-            }
-            elsif($_ =~ /^\n\z/) {
-                # a job is complete
-                $job{'line'}=$line;
-                $job{'os'}="linux";
-                submit(\%job);
-                $jobmode = 0;
-                $c++;
-            }
-        }
-    }
-    close(G);
-    return $c;
-}
-
-my $tag = `git rev-parse --abbrev-ref HEAD 2>/dev/null` || "master";
-chomp $tag;
-githubactions($tag);
-azurepipelines($tag);
-appveyor($tag);
-zuul($tag);
-cirrus($tag);
-circle($tag);
diff --git a/third-party/curl/scripts/cmakelint.sh b/third-party/curl/scripts/cmakelint.sh
new file mode 100644
index 0000000000..3fe258346d
--- /dev/null
+++ b/third-party/curl/scripts/cmakelint.sh
@@ -0,0 +1,79 @@
+#!/bin/sh
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Dan Fandrich, <dan@coneharvesters.com>, Viktor Szakats, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+# https://cmake-format.readthedocs.io/en/latest/cmake-lint.html
+# https://cmake-format.readthedocs.io/en/latest/lint-usage.html
+# https://github.com/cheshirekow/cmake_format/blob/master/cmakelang/configuration.py
+
+# Run cmakelint on the curl source code. It checks all files given on the
+# command-line, or else all relevant files in git, or if not in a git
+# repository, all files starting in the tree rooted in the current directory.
+#
+# cmake-lint can be installed from PyPi with the command "python3 -m pip
+# install cmakelang".
+#
+# The xargs invocation is portable, but does not preserve spaces in filenames.
+# If such a file is ever added, then this can be portably fixed by switching to
+# "xargs -I{}" and appending {} to the end of the xargs arguments (which calls
+# cmakelint once per file) or by using the GNU extension "xargs -d'\n'".
+
+set -eu
+
+cd "$(dirname "$0")"/..
+
+{
+  if [ -n "${1:-}" ]; then
+    for A in "$@"; do printf '%s\n' "$A"; done
+  elif git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    git ls-files '**CMakeLists.txt' '*.cmake'
+  else
+    find . -type f \( -name 'CMakeLists.txt' -o -name '*.cmake' \)
+  fi
+} | sort | xargs \
+  cmake-lint \
+    --suppress-decorations \
+    --disable \
+    --line-width 132 \
+    --tab-size 2 \
+    --use-tabchars false \
+    --disabled-codes C0113 \
+    --function-pattern 'curl_[0-9a-z_]+' \
+    --macro-pattern '(curl_[0-9a-z_]+|check_include_file_concat_curl)' \
+    --global-var-pattern '[A-Z][0-9A-Z_]+' \
+    --internal-var-pattern '_[a-z][0-9a-z_]+' \
+    --local-var-pattern '_[a-z][0-9a-z_]+' \
+    --private-var-pattern '_[0-9a-z_]+' \
+    --public-var-pattern '([A-Z][0-9A-Z_]+|[A-Z][A-Za-z0-9]+_FOUND|[a-z]+_SOURCES|prefix|exec_prefix|includedir|libdir|ssize_t|_FILE_OFFSET_BITS)' \
+    --argument-var-pattern '_[a-z][0-9a-z_]+' \
+    --keyword-pattern '[A-Z][0-9A-Z_]+' \
+    --max-conditionals-custom-parser 2 \
+    --min-statement-spacing 1 \
+    --max-statement-spacing 2 \
+    --max-returns 6 \
+    --max-branches 20 \
+    --max-arguments 5 \
+    --max-localvars 15 \
+    --max-statements 95 \
+    --
diff --git a/third-party/curl/scripts/completion.pl b/third-party/curl/scripts/completion.pl
index 00c736898a..203f2acfb6 100644
--- a/third-party/curl/scripts/completion.pl
+++ b/third-party/curl/scripts/completion.pl
@@ -28,29 +28,31 @@ use warnings;
 use Getopt::Long();
 use Pod::Usage();
 
-my $curl = 'curl';
+my $opts_dir = '../docs/cmdline-opts';
 my $shell = 'zsh';
 my $help = 0;
 Getopt::Long::GetOptions(
-    'curl=s' => \$curl,
+    'opts-dir=s' => \$opts_dir,
     'shell=s' => \$shell,
     'help' => \$help,
 ) or Pod::Usage::pod2usage();
 Pod::Usage::pod2usage() if $help;
 
-my $regex = '\s+(?:(-[^\s]+),\s)?(--[^\s]+)\s*(\<.+?\>)?\s+(.*)';
-my @opts = parse_main_opts('--help all', $regex);
+my @opts = parse_main_opts($opts_dir);
 
-if ($shell eq 'fish') {
+if($shell eq 'fish') {
     print "# curl fish completion\n\n";
+    print "# Complete file paths after @\n";
+    print q(complete -c curl -n 'string match -qr "^@" -- (commandline -ct)' -k -xa "(printf '%s\n' -- @(__fish_complete_suffix --complete=(commandline -ct | string replace -r '^@' '') ''))");
+    print "\n\n";
     print qq{$_ \n} foreach (@opts);
-} elsif ($shell eq 'zsh') {
+} elsif($shell eq 'zsh') {
     my $opts_str;
 
     $opts_str .= qq{  $_ \\\n} foreach (@opts);
     chomp $opts_str;
 
-my $tmpl = <<"EOS";
+    my $tmpl = <<"EOS";
 #compdef curl
 
 # curl zsh completion
@@ -73,24 +75,44 @@ EOS
 }
 
 sub parse_main_opts {
-    my ($cmd, $regex) = @_;
+    my ($opts_dir) = @_;
 
-    my @list;
-    my @lines = call_curl($cmd);
+    my (@files, @list);
+    my ($dir_handle, $file_content);
 
-    foreach my $line (@lines) {
-        my ($short, $long, $arg, $desc) = ($line =~ /^$regex/) or next;
+    opendir($dir_handle, $opts_dir) or die "Unable to open dir: $opts_dir due to error: $!";
+    @files = readdir($dir_handle);
+    closedir($dir_handle) or die "Unable to close handle on dir: $opts_dir due to error: $!";
 
-        my $option = '';
+    # We want regular files that end with .md and do not start with an underscore
+    # Edge case: MANPAGE.md does not start with an underscore but also is not documentation for an option
+    @files = grep { $_ =~ /\.md$/i && !/^_/ && -f "$opts_dir/$_" && $_ ne "MANPAGE.md" } @files;
+
+    for my $file (@files) {
+        open(my $doc_handle, '<', "$opts_dir/$file") or die "Unable to open file: $file due to error: $!";
+        $file_content = join('', <$doc_handle>);
+        close($doc_handle) or die "Unable to close file: $file due to error: $!";
+
+        # Extract the curldown header section demarcated by ---
+        $file_content =~ /^---\s*\n(.*?)\n---\s*\n/s or die "Unable to parse file $file";
+
+        $file_content = $1;
+        my ($short, $long, $arg, $desc);
+
+        if($file_content =~ /^Short:\s+(.*)\s*$/im) {$short = "-$1";}
+        if($file_content =~ /^Long:\s+(.*)\s*$/im) {$long = "--$1";}
+        if($file_content =~ /^Arg:\s+(.*)\s*$/im) {$arg = $1;}
+        if($file_content =~ /^Help:\s+(.*)\s*$/im) {$desc = $1;}
 
         $arg =~ s/\:/\\\:/g if defined $arg;
-
         $desc =~ s/'/'\\''/g if defined $desc;
         $desc =~ s/\[/\\\[/g if defined $desc;
         $desc =~ s/\]/\\\]/g if defined $desc;
         $desc =~ s/\:/\\\:/g if defined $desc;
 
-        if ($shell eq 'fish') {
+        my $option = '';
+
+        if($shell eq 'fish') {
             $option .= "complete --command curl";
             $option .= " --short-option '" . strip_dash(trim($short)) . "'"
                 if defined $short;
@@ -98,39 +120,40 @@ sub parse_main_opts {
                 if defined $long;
             $option .= " --description '" . strip_dash(trim($desc)) . "'"
                 if defined $desc;
-        } elsif ($shell eq 'zsh') {
+        } elsif($shell eq 'zsh') {
             $option .= '{' . trim($short) . ',' if defined $short;
             $option .= trim($long)  if defined $long;
             $option .= '}' if defined $short;
             $option .= '\'[' . trim($desc) . ']\'' if defined $desc;
 
-            if (defined $arg) {
+            if(defined $arg) {
                 $option .= ":'$arg'";
-                if ($arg =~ /<file ?(name)?>|<path>/) {
+                if($arg =~ /<file ?(name)?>|<path>/) {
                     $option .= ':_files';
-                } elsif ($arg =~ /<dir>/) {
+                } elsif($arg =~ /<dir>/) {
                     $option .= ":'_path_files -/'";
-                } elsif ($arg =~ /<url>/i) {
+                } elsif($arg =~ /<url>/i) {
                     $option .= ':_urls';
-                } elsif ($long =~ /ftp/ && $arg =~ /<method>/) {
+                } elsif($long =~ /ftp/ && $arg =~ /<method>/) {
                     $option .= ":'(multicwd nocwd singlecwd)'";
-                } elsif ($arg =~ /<method>/) {
+                } elsif($arg =~ /<method>/) {
                     $option .= ":'(DELETE GET HEAD POST PUT)'";
                 }
             }
         }
 
-        push @list, $option;
+        push(@list, $option);
     }
 
-    # Sort longest first, because zsh won't complete an option listed
-    # after one that's a prefix of it.
+    # Sort longest first, because zsh does not complete an option listed
+    # after one that is a prefix of it. When length is equal, fall back
+    # to stringwise cmp.
     @list = sort {
         $a =~ /([^=]*)/; my $ma = $1;
         $b =~ /([^=]*)/; my $mb = $1;
 
-        length($mb) <=> length($ma)
-    } @list if $shell eq 'zsh';
+        length($mb) <=> length($ma) || $ma cmp $mb
+    } @list;
 
     return @list;
 }
@@ -138,17 +161,6 @@ sub parse_main_opts {
 sub trim { my $s = shift; $s =~ s/^\s+|\s+$//g; return $s };
 sub strip_dash { my $s = shift; $s =~ s/^-+//g; return $s };
 
-sub call_curl {
-    my ($cmd) = @_;
-    my $output = `"$curl" $cmd`;
-    if ($? == -1) {
-        die "Could not run curl: $!";
-    } elsif ((my $exit_code = $? >> 8) != 0) {
-        die "curl returned $exit_code with output:\n$output";
-    }
-    return split /\n/, $output;
-}
-
 __END__
 
 =head1 NAME
@@ -159,8 +171,8 @@ completion.pl - Generates tab-completion files for various shells
 
 completion.pl [options...]
 
-    --curl   path to curl executable
-    --shell  zsh/fish
-    --help   prints this help
+    --opts-dir path to cmdline-opts directory
+    --shell    zsh/fish
+    --help     prints this help
 
 =cut
diff --git a/third-party/curl/scripts/contributors.sh b/third-party/curl/scripts/contributors.sh
index 90ea5c94d7..a3a11d5243 100644
--- a/third-party/curl/scripts/contributors.sh
+++ b/third-party/curl/scripts/contributors.sh
@@ -29,21 +29,21 @@
 # RELEASE-NOTES.
 #
 
-start=$1
+set -eu
+
+start="${1:-}"
 
 if test "$start" = "-h"; then
-    echo "Usage: $0 <since this tag/hash> [--releasenotes]"
-    exit
+  echo "Usage: $0 <since this tag/hash> [--releasenotes]"
+  exit
 fi
 if test -z "$start"; then
-    start=`git tag --sort=taggerdate | grep "^curl-" | tail -1`;
-    echo "Since $start:"
+  start=$(git tag --sort=taggerdate | grep "^curl-" | tail -1)
+  echo "Since $start:"
 fi
 
 # We also include curl-www if possible. Override by setting CURLWWW
-if [ -z "$CURLWWW" ] ; then
-    CURLWWW=../curl-www
-fi
+CURLWWW="${CURLWWW:-../curl-www}"
 
 # filter out Author:, Commit: and *by: lines
 # cut off the email parts
@@ -55,47 +55,46 @@ fi
 # sort all unique names
 # awk them into RELEASE-NOTES format
 
-(
- (
-  git log --pretty=full --use-mailmap $start..HEAD
-  if [ -d "$CURLWWW" ]
-  then
-   git -C "$CURLWWW" log --pretty=full --use-mailmap $start..HEAD
-  fi
- ) | \
-grep -Eai '(^Author|^Commit|by):' | \
-cut -d: -f2- | \
-cut '-d(' -f1 | \
-cut '-d<' -f1 | \
-tr , '\012' | \
-sed 's/ at github/ on github/' | \
-sed 's/ and /\n/' | \
-sed -e 's/^ *//' -e 's/ $//g' -e 's/@users.noreply.github.com$/ on github/'
+{
+  {
+    git log --pretty=full --use-mailmap "$start..HEAD"
+    if [ -d "$CURLWWW" ]; then
+      git -C "$CURLWWW" log --pretty=full --use-mailmap "$start..HEAD"
+    fi
+  } | \
+  grep -Eai '(^Author|^Commit|^ +[a-z-]+-by|^ +Credits-to):' | \
+  cut -d: -f2- | \
+  cut '-d(' -f1 | \
+  cut '-d<' -f1 | \
+  tr , '\012' | \
+  sed 's/ at github/ on github/i' | \
+  sed 's/on github/on github/i' | \
+  sed 's/ and /\n/' | \
+  sed -e 's/^ *//' -e 's/ $//g' -e 's/@users.noreply.github.com$/ on github/i'
 
-grep -a "^  [^ \(]" RELEASE-NOTES| \
-sed 's/, */\n/g'| \
-sed 's/^ *//'
-
-)| \
+  grep -a "^  [^ \(]" RELEASE-NOTES| \
+  sed 's/, */\n/g'| \
+  sed 's/^ *//'
+} | \
 sed -f ./docs/THANKS-filter | \
 sort -fu | \
-awk '{
- if(length($0)) {
-   num++;
-   n = sprintf("%s%s%s,", n, length(n)?" ":"", $0);
-   #print n;
-   if(length(n) > 77) {
-     printf("  %s\n", p);
-     n=sprintf("%s,", $0);
-   }
-   p=n;
- }
+awk '
+{
+  if(length($0)) {
+    num++;
+    n = sprintf("%s%s%s,", n, length(n) ? " " : "", $0);
+    #print n;
+    if(length(n) > 77) {
+      printf("  %s\n", p);
+      n=sprintf("%s,", $0);
+    }
+    p=n;
+  }
 }
 
- END {
-   pp=substr(p,1,length(p)-1);
-   printf("  %s\n", pp);
-   printf("  (%d contributors)\n", num);
- }
-
+END {
+  pp = substr(p, 1, length(p) - 1);
+  printf("  %s\n", pp);
+  printf("  (%d contributors)\n", num);
+}
 '
diff --git a/third-party/curl/scripts/contrithanks.sh b/third-party/curl/scripts/contrithanks.sh
index b188422881..85f382b755 100644
--- a/third-party/curl/scripts/contrithanks.sh
+++ b/third-party/curl/scripts/contrithanks.sh
@@ -24,54 +24,82 @@
 ###########################################################################
 
 #
-# This script shows all mentioned contributors from <hash> until HEAD and
-# puts them at the end of the THANKS document on stdout
+# This script updates the docs/THANKS document.
 #
 
-start=$1
+set -u
+
+start="${1:-}"
 
 if test "$start" = "-h"; then
   echo "Usage: $0 <since this tag/hash>"
   exit
 fi
-if test -z "$start"; then
-  start=`git tag --sort=taggerdate | grep "^curl-" | tail -1`;
+if test "$start" = "stdout"; then
+  # output the names on stdout
+  use_stdout="yes"
+  start=""
+else
+  use_stdout="no"
+fi
+if test -z "$start"; then
+  start=$(git tag --sort=taggerdate | grep "^curl-" | tail -1)
 fi
-
 
 # We also include curl-www if possible. Override by setting CURLWWW
-if [ -z "$CURLWWW" ] ; then
-    CURLWWW=../curl-www
+CURLWWW="${CURLWWW:-../curl-www}"
+
+rand="./docs/THANKS.$$"
+
+# output the existing list of names with lowercase github
+tail -n +7 ./docs/THANKS | sed 's/ github/ github/i'  > $rand
+
+# get new names using git
+{
+  {
+    git log --use-mailmap "$start..HEAD"
+    if [ -d "$CURLWWW" ]; then
+      git -C "$CURLWWW" log --use-mailmap "$start..HEAD"
+    fi
+  } | \
+  grep -Eai '(^Author|^Commit|^ +[a-z-]+-by|^ +Credits-to):' | \
+  cut -d: -f2- | \
+  cut '-d(' -f1 | \
+  cut '-d<' -f1 | \
+  tr , '\012' | \
+  sed 's/ at github/ on github/i' | \
+  sed 's/ and /\n/' | \
+  sed -e 's/^ //' -e 's/ $//g' -e 's/@users.noreply.github.com$/ on github/i' | \
+  sed 's/ github/ github/i'
+
+  # grep out the list of names from RELEASE-NOTES
+  # split on ", "
+  # remove leading whitespace
+  grep -a "^  [^ (]" RELEASE-NOTES| \
+  sed 's/, */\n/g'| \
+  sed 's/^ *//'
+} | \
+LC_ALL=C sed -f ./docs/THANKS-filter | \
+sort -fu | \
+grep -aixvFf ./docs/THANKS >> $rand
+
+if test "$use_stdout" = "no"; then
+
+  # output header
+  cat <<EOF >./docs/THANKS
+ This project has been alive for many years. Countless people have provided
+ feedback that have improved curl. Here follows a list of people that have
+ contributed (a-z order).
+
+ If you have contributed but are missing here, please let us know!
+
+EOF
+  # append all the names, sorted case insensitively
+  grep -v "^ " $rand | sort -f $rand >> ./docs/THANKS
+else
+  # send all names on stdout
+  grep -v "^ " $rand | sort -f $rand
 fi
 
-cat ./docs/THANKS
-
-(
- (
-  git log --use-mailmap $start..HEAD
-  if [ -d "$CURLWWW" ]
-  then
-   git -C ../curl-www log --use-mailmap $start..HEAD
-  fi
- ) | \
-
-grep -Eai '(^Author|^Commit|by):' | \
-cut -d: -f2- | \
-cut '-d(' -f1 | \
-cut '-d<' -f1 | \
-tr , '\012' | \
-sed 's/ at github/ on github/' | \
-sed 's/ and /\n/' | \
-sed -e 's/^ //' -e 's/ $//g' -e 's/@users.noreply.github.com$/ on github/'
-
-# grep out the list of names from RELEASE-NOTES
-# split on ", "
-# remove leading whitespace
-grep -a "^  [^ (]" RELEASE-NOTES| \
-sed 's/, */\n/g'| \
-sed 's/^ *//'
-
-)| \
-sed -f ./docs/THANKS-filter | \
-sort -fu | \
-grep -aixvf ./docs/THANKS
+# get rid of the temp file
+rm $rand
diff --git a/third-party/curl/scripts/copyright.pl b/third-party/curl/scripts/copyright.pl
deleted file mode 100644
index c83b7ebbde..0000000000
--- a/third-party/curl/scripts/copyright.pl
+++ /dev/null
@@ -1,227 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-#
-# Invoke script in the root of the git checkout. Scans all files in git unless
-# given a specific single file.
-#
-# Usage: copyright.pl [file]
-#
-
-my %skips;
-
-# file names
-my %skiplist = (
-    # REUSE-specific file
-    ".reuse/dep5" => "<built-in>",
-
-    # License texts
-    "LICENSES/BSD-3-Clause.txt" => "<built-in>",
-    "LICENSES/BSD-4-Clause-UC.txt" => "<built-in>",
-    "LICENSES/ISC.txt" => "<built-in>",
-    "LICENSES/curl.txt" => "<built-in>",
-    "COPYING" => "<built-in>",
-
-    );
-
-sub scanfile {
-    my ($f) = @_;
-    my $line=1;
-    my $found = 0;
-    open(F, "<$f") || return -1;
-    while (<F>) {
-        chomp;
-        my $l = $_;
-        # check for a copyright statement and save the years
-        if($l =~ /.* ?copyright .* (\d\d\d\d|)/i) {
-            my $count = 0;
-            while($l =~ /([\d]{4})/g) {
-                push @copyright, {
-                  year => $1,
-                  line => $line,
-                  col => index($l, $1),
-                  code => $l
-                };
-                $count++;
-            }
-            if(!$count) {
-                # year-less
-                push @copyright, {
-                    year => -1,
-                    line => $line,
-                    col => index($l, $1),
-                    code => $l
-                };
-                $count++;
-            }
-            $found = $count;
-        }
-        if($l =~ /SPDX-License-Identifier:/) {
-            $spdx = 1;
-        }
-        # allow within the first 100 lines
-        if(++$line > 100) {
-            last;
-        }
-    }
-    close(F);
-    return $found;
-}
-
-sub checkfile {
-    my ($file, $skipped, $pattern) = @_;
-    $spdx = 0;
-    my $found = scanfile($file);
-
-    if($found < 1) {
-        if($skipped) {
-            # just move on
-            $skips{$pattern}++;
-            return 0;
-        }
-        if(!$found) {
-            print "$file:1: missing copyright range\n";
-            return 2;
-        }
-        # this means the file couldn't open - it might not exist, consider
-        # that fine
-        return 1;
-    }
-    if(!$spdx) {
-        if($skipped) {
-            # move on
-            $skips{$pattern}++;
-            return 0;
-        }
-        print "$file:1: missing SPDX-License-Identifier\n";
-        return 2;
-    }
-
-    if($skipped) {
-        print "$file:1: ignored superfluously by $pattern\n" if($verbose);
-        $superf{$pattern}++;
-    }
-
-    return 1;
-}
-
-sub dep5 {
-    my ($file) = @_;
-    my @files;
-    my $copy;
-    open(F, "<$file") || die "can't open $file";
-    my $line = 0;
-    while(<F>) {
-        $line++;
-        if(/^Files: (.*)/i) {
-            push @files, `git ls-files $1`;
-        }
-        elsif(/^Copyright: (.*)/i) {
-            $copy = $1;
-        }
-        elsif(/^License: (.*)/i) {
-            my $license = $1;
-            for my $f (@files) {
-                chomp $f;
-                if($f =~ /\.gitignore\z/) {
-                    # ignore .gitignore
-                }
-                else {
-                    if($skiplist{$f}) {
-                        print STDERR "$f already skipped at $skiplist{$f}\n";
-                    }
-                    $skiplist{$f} = "dep5:$line";
-                }
-            }
-            undef @files;
-        }
-    }
-    close(F);
-}
-
-dep5(".reuse/dep5");
-
-my $checkall = 0;
-my @all;
-my $verbose;
-if($ARGV[0] eq "-v") {
-    $verbose = 1;
-    shift @ARGV;
-}
-if($ARGV[0]) {
-    push @all, @ARGV;
-}
-else {
-    @all = `git ls-files`;
-    $checkall = 1;
-}
-
-for my $f (@all) {
-    chomp $f;
-    my $skipped = 0;
-    my $miss;
-    my $wro;
-    my $pattern;
-    if($skiplist{$f}) {
-        $pattern = $skip;
-        $skiplisted++;
-        $skipped = 1;
-        $skip{$f}++;
-    }
-
-    my $r = checkfile($f, $skipped, $pattern);
-    $mis=1 if($r == 2);
-    $wro=1 if(!$r);
-
-    if(!$skipped) {
-        $missing += $mis;
-        $wrong += $wro;
-    }
-}
-
-if($verbose) {
-    print STDERR "$missing files have no copyright\n" if($missing);
-    print STDERR "$wrong files have wrong copyright year\n" if ($wrong);
-    print STDERR "$skiplisted files are skipped\n" if ($skiplisted);
-
-    for my $s (@skiplist) {
-        if(!$skips{$s}) {
-            printf ("Never skipped pattern: %s\n", $s);
-        }
-        if($superf{$s}) {
-            printf ("%s was skipped superfluously %u times and legitimately %u times\n",
-                    $s, $superf{$s}, $skips{$s});
-        }
-    }
-}
-
-if($checkall) {
-    for(keys %skiplist) {
-        if(!$skip{$_}) {
-            printf STDERR "$_ is marked for SKIP but is missing!\n";
-        }
-    }
-}
-
-exit 1 if($missing || $wrong);
diff --git a/third-party/curl/scripts/coverage.sh b/third-party/curl/scripts/coverage.sh
index 0a7c7824ae..b5540568ff 100644
--- a/third-party/curl/scripts/coverage.sh
+++ b/third-party/curl/scripts/coverage.sh
@@ -23,6 +23,8 @@
 #
 ###########################################################################
 
+set -eu
+
 autoreconf -fi
 mkdir -p cvr
 cd cvr
diff --git a/third-party/curl/scripts/delta b/third-party/curl/scripts/delta
index a294f5a5a7..7a1793dbb3 100644
--- a/third-party/curl/scripts/delta
+++ b/third-party/curl/scripts/delta
@@ -30,97 +30,137 @@
 #
 # In the git clone root, invoke 'scripts/delta [release tag]'
 
-$start = $ARGV[0];
+use strict;
+use warnings;
+
+use POSIX;
+use IPC::Open3;
+use Time::Piece;
+
+sub cmd {
+    my @out;
+    my $as_string = shift if($_[0] eq '$');  # return as string (vs. list of lines)
+    my $hideerr = shift if($_[0] eq '2>');  # 2>/dev/null
+    my $pid = open3(my $in, my $out, $hideerr ? '>/dev/null' : '>&STDERR', @_);
+    close $in;
+    push @out, <$out>;
+    waitpid($pid, 0);
+    return $as_string ? join('', @out) : @out;
+}
+
+my $start = $ARGV[0] || '';
 
 if($start eq "-h") {
     print "Usage: summary [tag]\n";
     exit;
 }
 elsif($start eq "") {
-    $start = `git tag --sort=taggerdate | grep "^curl-" | tail -1`;
+    my @tags = cmd('git', 'tag', '--sort=taggerdate', '--no-column', '--list', 'curl-*');
+    $start = $tags[-1];  # latest tag
     chomp $start;
 }
 
-$commits = `git log --oneline $start.. | wc -l`;
-$committers = `git shortlog -s $start.. | wc -l`;
-$bcommitters = `git shortlog -s $start | wc -l`;
+my $commits = cmd('$', 'git', 'rev-list', '--count', "$start..");
+my $committers = cmd('git', 'shortlog', '-s', "$start..");
+my $bcommitters = cmd('git', 'shortlog', '-s', $start);
 
-$acommits = `git log --oneline | wc -l`;
-$acommitters = `git shortlog -s | wc -l`;
+my $acommits = cmd('$', 'git', 'rev-list', '--count', 'HEAD');
+my $acommitters = cmd('git', 'shortlog', '-s', 'HEAD');
 
 # delta from now compared to before
-$ncommitters = $acommitters - $bcommitters;
+my $ncommitters = $acommitters - $bcommitters;
 
 # number of contributors right now
-$acontribs = `./scripts/contrithanks.sh | grep -c '^[^ ]'`;
+my $acontribs = cmd('./scripts/contrithanks.sh', 'stdout');
 # number when the tag was set
-$bcontribs = `git show $start:docs/THANKS | grep -c '^[^ ]'`;
+my $bcontribs = cmd('$', 'git', 'grep', '-h', '-c', '^[^ ]', "$start:docs/THANKS");
 # delta
-$contribs = $acontribs - $bcontribs;
+my $contribs = $acontribs - $bcontribs;
 
 # number of setops:
 sub setopts {
-    my ($f)=@_;
-    open(H, "$f");
-    my $opts;
-    while(<H>) {
-        if(/^  CURLOPT(|DEPRECATED)\(/ && ($_ !~ /OBSOLETE/))  {
-            $opts++;
+    my $mode = shift;
+    my $opts = 0;
+    if(open(H, $mode, @_)) {
+        while(<H>) {
+            if(/^  CURLOPT(|DEPRECATED)\(/ && ($_ !~ /OBSOLETE/)) {
+                $opts++;
+            }
         }
+        close(H);
+    }
+    else {
+        die join(' ', @_) . ": $!\n";
     }
-    close(H);
     return $opts;
 }
-$asetopts = setopts("<include/curl/curl.h");
-$bsetopts = setopts("git show $start:include/curl/curl.h|");
-$nsetopts = $asetopts - $bsetopts;
+my $asetopts = setopts('<', 'include/curl/curl.h');
+my $bsetopts = setopts('-|', 'git', 'show', "$start:include/curl/curl.h");
+my $nsetopts = $asetopts - $bsetopts;
 
 # Number of command line options:
-$aoptions=`grep -c '{"....--' src/tool_listhelp.c`;
-$boptions=`git show $start:src/tool_listhelp.c 2>/dev/null | grep -c '{"....--'`;
-$noptions=$aoptions - $boptions;
+my $aoptions = cmd('$', '2>', 'git', 'grep', '-h', '-c', '{ *"....--', 'src/tool_listhelp.c');
+my $boptions = cmd('$', '2>', 'git', 'grep', '-h', '-c', '{ *"....--', "$start:src/tool_listhelp.c");
+my $noptions = $aoptions - $boptions;
 
 # current local branch
-$branch=`git rev-parse --abbrev-ref HEAD 2>/dev/null`;
+my $branch = cmd('$', '2>', 'git', 'rev-parse', '--abbrev-ref', 'HEAD');
 chomp $branch;
 # Number of files in git
-$afiles=`git ls-files | wc -l`;
-$deletes=`git diff-tree --diff-filter=A -r --summary origin/$branch $start 2>/dev/null | wc -l`;
-$creates=`git diff-tree --diff-filter=D -r --summary origin/$branch $start 2>/dev/null| wc -l`;
+my $afiles = cmd('git', 'ls-files');
+my $deletes = cmd('2>', 'git', 'diff-tree', '--diff-filter=A', '-r', '--summary', "origin/$branch", $start);
+my $creates = cmd('2>', 'git', 'diff-tree', '--diff-filter=D', '-r', '--summary', "origin/$branch", $start);
 
 # Time since that tag
-$tagged=`git for-each-ref --format="%(refname:short) | %(taggerdate:unix)" refs/tags/* | grep ^$start | cut "-d|" -f2`; # unix timestamp
-$taggednice=`git for-each-ref --format="%(refname:short) | %(creatordate)" refs/tags/* | grep ^$start | cut '-d|' -f2`; # human readable time
+sub tagstamp {
+    my $col = shift;
+    foreach my $line (@_) {
+        if(index($line, "$start ") == 0) {
+            my @cols = split(/\|/, $line);
+            return $cols[$col - 1];
+        }
+    }
+}
+my @tagged = cmd('git', 'for-each-ref', '--format=%(refname:short) | %(taggerdate:unix) | %(creatordate)', 'refs/tags/*');
+my $tagged = tagstamp(2, @tagged); # Unix timestamp
+my $taggednice = tagstamp(3, @tagged); # human readable time
 chomp $taggednice;
-$now=`date +%s`;
-$elapsed=$now - $tagged; # number of seconds since tag
-$total=$now - `date -d 19980320 +%s`;
+my $now = POSIX::strftime("%s", localtime());
+my $elapsed = $now - $tagged; # number of seconds since tag
+my $total = $now - Time::Piece->strptime('19980320', '%Y%m%d')->epoch;
+my $totalhttpget = $now - Time::Piece->strptime('19961111', '%Y%m%d')->epoch;
 
 # Number of public functions in libcurl
-$apublic=`git grep ^CURL_EXTERN -- include/curl | wc -l`;
-$bpublic=`git grep ^CURL_EXTERN $start -- include/curl | wc -l`;
-$public = $apublic - $bpublic;
+my $apublic = cmd('git', 'grep', '^CURL_EXTERN', '--', 'include/curl');
+my $bpublic = cmd('git', 'grep', '^CURL_EXTERN', $start, '--', 'include/curl');
+my $public = $apublic - $bpublic;
 
 # diffstat
-$diffstat=`git diff --stat $start.. | tail -1`;
+my ($fileschanged, $insertions, $deletions);
+my @diffstat = cmd('2>', 'git', 'diff', '--stat', "$start..");
+my $diffstat = $diffstat[-1];
 if($diffstat =~ /^ *(\d+) files changed, (\d+) insertions\(\+\), (\d+)/) {
-    ($fileschanged, $insertions, $deletions)=($1, $2, $3);
+    ($fileschanged, $insertions, $deletions) = ($1, $2, $3);
 }
 
 # Changes/bug-fixes currently logged
+my $numchanges = 0;
+my $numbugfixes = 0;
+my $numcontributors = 0;
 open(F, "<RELEASE-NOTES");
+my $mode = 0;
 while(<F>) {
     if($_ =~ /following changes:/) {
-        $mode=1;
+        $mode = 1;
     }
     elsif($_ =~ /following bugfixes:/) {
-        $mode=2;
+        $mode = 2;
     }
     elsif($_ =~ /known bugs:/) {
-        $mode=3;
+        $mode = 3;
     }
     elsif($_ =~ /like these:/) {
-        $mode=4;
+        $mode = 4;
     }
     if($_ =~ /^ o /) {
         if($mode == 1) {
@@ -140,9 +180,9 @@ close(F);
 # Produce the summary
 
 print "== Since $start $taggednice ==\n";
-printf "Elapsed time:                   %.1f days (total %d)\n",
-    $elapsed / 3600 / 24,
-    $total / 3600 / 24;
+my $days = $elapsed / 3600 / 24;
+printf "Elapsed time:                   %.1f days (total %d / %d)\n",
+    $days, $total / 3600 / 24, $totalhttpget / 3600 / 24;
 printf "Commits:                        %d (total %d)\n",
     $commits, $acommits;
 printf "Commit authors:                 %d, %d new (total %d)\n",
@@ -156,13 +196,14 @@ printf "New curl_easy_setopt() options: %d (total %d)\n",
 printf "New command line options:       %d (total %d)\n",
     $noptions, $aoptions;
 printf "Changes logged:                 %d\n", $numchanges;
-printf "Bugfixes logged:                %d\n", $numbugfixes;
+printf "Bugfixes logged:                %d (%.2f per day)\n",
+    $numbugfixes, $days ? $numbugfixes / $days : $numbugfixes;
 printf "Added files:                    %d (total %d)\n",
     $creates, $afiles;
 printf "Deleted files:                  %d (delta: %d)\n", $deletes,
     $creates - $deletes;
 print "Diffstat:$diffstat" if(!$fileschanged);
-printf "Files changed:                  %d (%.2f%%)\n", $fileschanged, $fileschanged*100/$afiles;
+printf "Files changed:                  %d (%.2f%%)\n", $fileschanged, $fileschanged * 100 / $afiles;
 printf "Lines inserted:                 %d\n", $insertions;
 printf "Lines deleted:                  %d (delta: %d)\n", $deletions,
     $insertions - $deletions;
diff --git a/third-party/curl/scripts/dmaketgz b/third-party/curl/scripts/dmaketgz
new file mode 100644
index 0000000000..fb7bfef2aa
--- /dev/null
+++ b/third-party/curl/scripts/dmaketgz
@@ -0,0 +1,55 @@
+#!/bin/sh
+# docker-maketgz
+#
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+set -eu
+
+version="${1:-}"
+
+if [ -z "$version" ]; then
+    echo "Specify a version number!"
+    exit
+fi
+
+timestamp="${2:-$(date -u +%s)}"
+
+if test -f Makefile; then
+    make distclean
+fi
+docker build \
+       --no-cache \
+       --build-arg SOURCE_DATE_EPOCH="$timestamp" \
+       --build-arg UID="$(id -u)" \
+       --build-arg GID="$(id -g)" \
+       -t curl/curl .
+
+docker run --rm -u "$(id -u):$(id -g)" \
+       -v "$(pwd):/usr/src" -w /usr/src curl/curl sh -c "
+  set -e
+  autoreconf -fi
+  ./configure --without-ssl --without-libpsl
+  make -sj8
+  ./scripts/maketgz $version"
diff --git a/third-party/curl/scripts/extract-unit-protos b/third-party/curl/scripts/extract-unit-protos
new file mode 100644
index 0000000000..79c6605794
--- /dev/null
+++ b/third-party/curl/scripts/extract-unit-protos
@@ -0,0 +1,151 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+my @proto;
+my %func;
+my %inc;
+my %test;
+my %from;
+my $error;
+
+sub scanfile {
+    my ($file) = @_;
+    open(F, "<$file") or die "$file failed";
+    my $unit = 0;
+    my $line = 0;
+    my $unitref = 0;
+    my $unittest = 0;
+    while(<F>) {
+        $line++;
+        my $full = $_;
+        if($_ =~ /\@unittest (\d+)/) {
+            $unittest = $1;
+            $unitref = $line; # store line number
+        }
+        if($_ =~ /^UNITTEST .*[* ]([a-z0-9_]+)\(/i) {
+            my $n = $1;
+            if($func{$n}) {
+                # already prototyped, this is now the function itself
+            }
+            else {
+                if($n =~ /^Curl_/) {
+                    print STDERR "$file:$line:1: warn: $n is Curl_ prefixed?\n";
+                    $error++;
+                }
+                if(($line - $unitref) > 10) {
+                    print STDERR "$file:$line:1: warn: Missing \@unittest reference?\n";
+                    $error++;
+                }
+                else {
+                    $test{$full} = $unittest;
+                    $from{$full} = "$file:$line";
+                }
+
+                $func{$n} = 1;
+                push @proto, $_;
+                $inc{$file} = 1;
+                $unit = 1;
+            }
+        }
+        if($unit) {
+            if($unit != 1) {
+                push @proto, $_;
+            }
+            if($_ =~ /\);/) {
+                # end of proto
+                $unit = 0;
+            }
+            else {
+                # proto continues
+                $unit++;
+            }
+        }
+    }
+    close(F);
+}
+
+foreach my $f (@ARGV) {
+    scanfile($f);
+}
+
+if($error) {
+    exit 1;
+}
+
+print <<HEAD
+#ifndef UNITTESTPROTOS_H
+#define UNITTESTPROTOS_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \\| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \\___|\\___/|_| \\_\\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel\@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ * Generated-by: extract-unit-protos
+ *
+ ***************************************************************************/
+HEAD
+    ;
+
+for my $f (sort keys %inc) {
+    # convert to suitable header file
+    $f =~ s/\.c/.h/; # .h extension
+
+    if(-f $f) {
+        print "#include \"$f\"\n";
+    }
+}
+
+for my $p (@proto) {
+    if($test{$p}) {
+        printf "\n/* for unit test %d from %s */\n",
+            $test{$p}, $from{$p};
+    }
+    print $p;
+}
+
+print <<FOOT
+#endif /* UNITTESTPROTOS_H */
+FOOT
+    ;
diff --git a/third-party/curl/scripts/firefox-db2pem.sh b/third-party/curl/scripts/firefox-db2pem.sh
index f78f415232..b763ef10a2 100644
--- a/third-party/curl/scripts/firefox-db2pem.sh
+++ b/third-party/curl/scripts/firefox-db2pem.sh
@@ -23,11 +23,21 @@
 # *
 # ***************************************************************************
 # This shell script creates a fresh ca-bundle.crt file for use with libcurl.
-# It extracts all ca certs it finds in the local Firefox database and converts
+# It extracts all CA certs it finds in the local Firefox database and converts
 # them all into PEM format.
 #
-db=$(ls -1d $HOME/.mozilla/firefox/*default*)
-out=$1
+# It uses the "certutil" command line tool from the NSS project to perform the
+# conversion. On Debian it comes in the "libnss3-tools" package.
+#
+
+set -eu
+
+if [ -d "$HOME/Library/Application Support"/Firefox/Profiles ]; then
+  db=$(ls -1d "$HOME/Library/Application Support"/Firefox/Profiles/*default*)
+else
+  db=$(ls -1d "$HOME"/.mozilla/firefox/*default*)
+fi
+out="${1:-}"
 
 if test -z "$out"; then
   out="ca-bundle.crt" # use a sensible default
@@ -35,7 +45,7 @@ fi
 
 currentdate=$(date)
 
-cat >$out <<EOF
+cat > "$out" <<EOF
 ##
 ## Bundle of CA Root Certificates
 ##
@@ -44,12 +54,11 @@ cat >$out <<EOF
 ##
 EOF
 
-
 certutil -L -h 'Builtin Object Token' -d "$db" | \
 grep ' *[CcGTPpu]*,[CcGTPpu]*,[CcGTPpu]* *$' | \
 sed -e 's/ *[CcGTPpu]*,[CcGTPpu]*,[CcGTPpu]* *$//' -e 's/\(.*\)/"\1"/' | \
 sort | \
-while read -r nickname; \
- do echo "$nickname" | sed -e "s/Builtin Object Token://g"; \
-eval certutil -d "$db" -L -n "$nickname" -a ; \
-done >> $out
+while read -r nickname; do
+  echo "$nickname" | sed 's/Builtin Object Token://g'
+  echo "$nickname" | xargs -I{} certutil -d "$db" -L -a -n {}
+done >> "$out"
diff --git a/third-party/curl/scripts/installcheck.sh b/third-party/curl/scripts/installcheck.sh
index 433420e03d..b13db2aa39 100644
--- a/third-party/curl/scripts/installcheck.sh
+++ b/third-party/curl/scripts/installcheck.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 #***************************************************************************
 #                                  _   _ ____  _
 #  Project                     ___| | | |  _ \| |
@@ -23,28 +23,30 @@
 #
 ###########################################################################
 
-PREFIX=$1
+set -eu
+
+PREFIX="${1:-}"
 
 # Run this script in the root of the git clone. Point out the install prefix
 # where 'make install' has already installed curl.
 
-if test -z "$1";  then
-    echo "scripts/installcheck.sh [PREFIX]"
-    exit
+if test -z "$PREFIX"; then
+  echo "scripts/installcheck.sh [PREFIX]"
+  exit
 fi
 
-diff -u <(find docs/libcurl/ -name "*.3" -printf "%f\n" | grep -v template| sort) <(find $PREFIX/share/man/ -name "*.3" -printf "%f\n" | sort)
+diff -u <(find docs/libcurl/ -name "*.3" -printf "%f\n" | grep -v template | sort) <(find "$PREFIX/share/man/" -name "*.3" -printf "%f\n" | sort)
 
 if test "$?" -ne "0"; then
-    echo "ERROR: installed libcurl docs mismatch"
-    exit 2
+  echo "ERROR: installed libcurl docs mismatch"
+  exit 2
 fi
 
-diff -u <(find include/ -name "*.h" -printf "%f\n" | sort) <(find $PREFIX/include/ -name "*.h" -printf "%f\n" | sort)
+diff -u <(find include/ -name "*.h" -printf "%f\n" | sort) <(find "$PREFIX/include/" -name "*.h" -printf "%f\n" | sort)
 
 if test "$?" -ne "0"; then
-    echo "ERROR: installed include files mismatch"
-    exit 1
+  echo "ERROR: installed include files mismatch"
+  exit 1
 fi
 
 echo "installcheck: installed libcurl docs and include files look good"
diff --git a/third-party/curl/scripts/log2changes.pl b/third-party/curl/scripts/log2changes.pl
deleted file mode 100644
index 3554183685..0000000000
--- a/third-party/curl/scripts/log2changes.pl
+++ /dev/null
@@ -1,103 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-# git log --pretty=fuller --no-color --date=short --decorate=full
-
-my @mname = ('Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun',
-             'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec' );
-
-sub nicedate {
-    my ($date)=$_;
-
-    if($date =~ /(\d\d\d\d)-(\d\d)-(\d\d)/) {
-        return sprintf("%d %s %4d", $3, $mname[$2-1], $1);
-    }
-    return $date;
-}
-
-sub printmsg {
-    my ($p, $msg)=@_;
-    while(length($msg) > 77) {
-        print $p.substr($msg, 0, 77, "")."\n";
-        $p="  ";
-    }
-    if($msg eq "") {
-        $p = "";
-    }
-    print "$p$msg\n";
-}
-
-print
-'                                  _   _ ____  _
-                              ___| | | |  _ \| |
-                             / __| | | | |_) | |
-                            | (__| |_| |  _ <| |___
-                             \___|\___/|_| \_\_____|
-
-                                  Changelog
-';
-
-my $tag;
-while(<STDIN>) {
-    my $l = $_;
-
-    if($l =~/^commit ([[:xdigit:]]*) ?(.*)/) {
-        $co = $1;
-        my $ref = $2;
-        if ($ref =~ /refs\/tags\/curl-([0-9_]*)/) {
-            $tag = $1;
-            $tag =~ tr/_/./;
-        }
-    }
-    elsif($l =~ /^Author: *(.*) +</) {
-        $c = $1;
-    }
-    elsif($l =~ /^CommitDate: (.*)/) {
-        $date = nicedate($1);
-    }
-    elsif($l =~ /^(    )(.*)/) {
-        my $pref = "  ";
-        if ($tag) {
-            # Version entries have a special format
-            print "\nVersion " . $tag." ($date)\n";
-            $oldc = "";
-            $tag = "";
-        }
-        if($co ne $oldco) {
-            if($c ne $oldc) {
-                print "\n$c ($date)\n\n";
-            }
-            else {
-                print "\n";
-            }
-            $pref = "- ";
-        }
-
-        $oldco = $co;
-        $oldc = $c;
-        $olddate = $date;
-        printmsg($pref, $2);
-    }
-}
diff --git a/third-party/curl/scripts/maketgz b/third-party/curl/scripts/maketgz
new file mode 100644
index 0000000000..e6bc53dcdc
--- /dev/null
+++ b/third-party/curl/scripts/maketgz
@@ -0,0 +1,246 @@
+#!/bin/sh
+# Script to build release-archives with. Note that this requires a checkout
+# from git and you should first run autoreconf -fi and build curl once.
+#
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+set -eu
+
+export LC_ALL=C
+export TZ=UTC
+
+version="${1:-}"
+cmd="${2:-}"
+
+if [ -z "$version" ]; then
+  echo "Specify a version number!"
+  exit
+fi
+
+echo "$cmd"
+
+only=""
+if [ "only" = "$cmd" ]; then
+  echo "Setup version number only!"
+  only=1
+fi
+
+commit=""
+if [ "commit" = "$cmd" ]; then
+  commit=1
+fi
+
+libversion="$version"
+
+# we make curl the same version as libcurl
+curlversion="$libversion"
+
+major=$(echo "$libversion" | cut -d. -f1 | sed -e "s/[^0-9]//g")
+minor=$(echo "$libversion" | cut -d. -f2 | sed -e "s/[^0-9]//g")
+patch=$(echo "$libversion" | cut -d. -f3 | cut -d- -f1 | sed -e "s/[^0-9]//g")
+
+if test -z "$patch"; then
+  echo "invalid version number? needs to be z.y.z"
+  exit
+fi
+
+#
+# As a precaution, remove all *.dist files that may be lying around, to reduce
+# the risk of old leftovers getting shipped.
+echo "removing all old *.dist files"
+find . -name "*.dist" -exec rm -- {} \;
+
+numeric="$(printf "%02x%02x%02x\n" "$major" "$minor" "$patch")"
+
+HEADER=include/curl/curlver.h
+CHEADER=src/tool_version.h
+
+if test -z "$only"; then
+  ext=".dist"
+  # when not setting up version numbers locally
+  for a in $HEADER $CHEADER; do
+    cp "$a" "$a$ext"
+  done
+  HEADER="$HEADER$ext"
+  CHEADER="$CHEADER$ext"
+fi
+
+# requires a date command that knows + for format and -d for date input
+timestamp=${SOURCE_DATE_EPOCH:-$(date +"%s")}
+datestamp=$(date -d "@$timestamp" +"%F")
+filestamp=$(date -d "@$timestamp" +"%Y%m%d%H%M.%S")
+
+# Replace version number in header file:
+sed -i \
+  -e "s/^#define LIBCURL_VERSION .*/#define LIBCURL_VERSION \"$libversion\"/g" \
+  -e "s/^#define LIBCURL_VERSION_NUM .*/#define LIBCURL_VERSION_NUM 0x$numeric/g" \
+  -e "s/^#define LIBCURL_VERSION_MAJOR .*/#define LIBCURL_VERSION_MAJOR $major/g" \
+  -e "s/^#define LIBCURL_VERSION_MINOR .*/#define LIBCURL_VERSION_MINOR $minor/g" \
+  -e "s/^#define LIBCURL_VERSION_PATCH .*/#define LIBCURL_VERSION_PATCH $patch/g" \
+  -e "s/^#define LIBCURL_TIMESTAMP .*/#define LIBCURL_TIMESTAMP \"$datestamp\"/g" \
+  "$HEADER"
+
+# Replace version number in header file:
+sed -i "s/#define CURL_VERSION .*/#define CURL_VERSION \"$curlversion\"/g" "$CHEADER"
+
+if test -n "$only"; then
+  # done!
+  exit
+fi
+
+echo "curl version $curlversion"
+echo "libcurl version $libversion"
+echo "libcurl numerical $numeric"
+echo "datestamp $datestamp"
+
+findprog() {
+  file="$1"
+  for part in $(echo "$PATH" | tr ':' ' '); do
+    path="$part/$file"
+    if [ -x "$path" ]; then
+      # there it is!
+      return 1
+    fi
+  done
+
+  # no such executable
+  return 0
+}
+
+############################################################################
+#
+# Enforce a rerun of configure (updates the VERSION)
+#
+
+echo "Re-running config.status"
+./config.status --recheck >/dev/null
+
+echo "Recreate the built-in manual (with correct version)"
+export CURL_MAKETGZ_VERSION="$version"
+rm -f docs/cmdline-opts/curl.txt
+make -C src
+
+############################################################################
+#
+# automake is needed to run to make a non-GNU Makefile.in if Makefile.am has
+# been modified.
+#
+
+if { findprog automake >/dev/null 2>/dev/null; } then
+  echo "- Could not find or run automake, I hope you know what you are doing!"
+else
+  echo "Runs automake --include-deps"
+  automake --include-deps Makefile >/dev/null
+fi
+
+if test -n "$commit"; then
+  echo "produce docs/tarball-commit.txt"
+  git rev-parse HEAD >docs/tarball-commit.txt.dist
+fi
+
+echo "produce RELEASE-TOOLS.md"
+./scripts/release-tools.sh "$timestamp" "$version" "$commit" > docs/RELEASE-TOOLS.md.dist
+
+############################################################################
+#
+# Now run make dist to generate a tar.gz archive
+#
+
+echo "make dist"
+targz="curl-$version.tar.gz"
+make -sj dist "VERSION=$version"
+res=$?
+
+if test "$res" != 0; then
+  echo "make dist failed"
+  exit 2
+fi
+
+retar() {
+  tempdir=$1
+  rm -rf "$tempdir"
+  mkdir "$tempdir"
+  cd "$tempdir"
+  gzip -dc "../$targz" | tar -xf -
+  find curl-* -depth -exec touch -c -t "$filestamp" -- '{}' +
+  tar --create --format=ustar --owner=0 --group=0 --numeric-owner --sort=name curl-* | gzip --best --no-name > out.tar.gz
+  mv out.tar.gz ../
+  cd ..
+  rm -rf "$tempdir"
+}
+
+retar ".tarbuild"
+echo "replace $targz with out.tar.gz"
+mv out.tar.gz "$targz"
+
+############################################################################
+#
+# Now make a bz2 archive from the tar.gz original
+#
+
+bzip2="curl-$version.tar.bz2"
+echo "Generating $bzip2"
+gzip -dc "$targz" | bzip2 --best > "$bzip2"
+
+############################################################################
+#
+# Now make an xz archive from the tar.gz original
+#
+
+xz="curl-$version.tar.xz"
+echo "Generating $xz"
+gzip -dc "$targz" | xz -6e - > "$xz"
+
+############################################################################
+#
+# Now make a zip archive from the tar.gz original
+#
+makezip() {
+  rm -rf "$tempdir"
+  mkdir "$tempdir"
+  cd "$tempdir"
+  gzip -dc "../$targz" | tar -xf -
+  find . | sort | zip -9 -X "$zip" -@ >/dev/null
+  mv "$zip" ../
+  cd ..
+  rm -rf "$tempdir"
+}
+
+zip="curl-$version.zip"
+echo "Generating $zip"
+tempdir=".builddir"
+makezip
+
+# Set deterministic timestamp
+touch -c -t "$filestamp" "$targz" "$bzip2" "$xz" "$zip"
+
+echo "------------------"
+echo "maketgz report:"
+echo ""
+ls -l "$targz" "$bzip2" "$xz" "$zip"
+sha256sum "$targz" "$bzip2" "$xz" "$zip"
+
+echo "Run this:"
+echo "gpg -b -a '$targz' && gpg -b -a '$bzip2' && gpg -b -a '$xz' && gpg -b -a '$zip'"
diff --git a/third-party/curl/scripts/managen b/third-party/curl/scripts/managen
new file mode 100644
index 0000000000..2bf1c3d75d
--- /dev/null
+++ b/third-party/curl/scripts/managen
@@ -0,0 +1,1383 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+=begin comment
+
+This script generates the man page.
+
+Example: managen <command> [files] > curl.1
+
+Dev notes:
+
+We open *input* files in :crlf translation (a no-op on many platforms) in
+case we have CRLF line endings in Windows but a perl that defaults to LF.
+Unfortunately it seems some perls like msysgit cannot handle a global input-only
+:crlf so it has to be specified on each file open for text input.
+
+=end comment
+=cut
+
+use strict;
+use warnings;
+
+my %optshort;
+my %optlong;
+my %helplong;
+my %arglong;
+my %redirlong;
+my %protolong;
+my %catlong;
+
+use POSIX qw(strftime);
+my @ts;
+if(defined($ENV{SOURCE_DATE_EPOCH})) {
+    @ts = gmtime($ENV{SOURCE_DATE_EPOCH});
+} else {
+    @ts = localtime;
+}
+my $date = strftime "%Y-%m-%d", @ts;
+my $year = strftime "%Y", @ts;
+my $version = "unknown";
+my $globals;
+my $error = 0;
+my $indent = 4;
+
+# get the long name version, return the man page string
+sub manpageify {
+    my ($k, $manpage) = @_;
+    my $trail = '';
+    # the matching pattern might include a trailing dot that cannot be part of
+    # the option name
+    if($k =~ s/\.$//) {
+        # cut off trailing dot
+        $trail = ".";
+    }
+    if($manpage) {
+        my $klong = $k;
+        # quote "bare" minuses in the long name
+        $klong =~ s/-/\\-/g;
+
+        # only long
+        return "\\fI\\-\\-$klong\\fP$trail";
+    }
+    return "--$k$trail";
+}
+
+my $colwidth = 79; # max number of columns
+
+sub prefixline {
+    my ($num) = @_;
+    print "\t" x ($num / 8);
+    print ' ' x ($num % 8);
+}
+
+sub justline {
+    my ($lvl, @line) = @_;
+    my $w = -1;
+    my $spaces = -1;
+    my $width = $colwidth - ($lvl * $indent);
+    for(@line) {
+        $w += length($_);
+        $w++;
+        $spaces++;
+    }
+    my $inject = $width - $w;
+    my $ratio = 0; # stay at zero if no spaces at all
+    if($spaces) {
+        $ratio = $inject / $spaces;
+    }
+    my $spare = 0;
+    prefixline($lvl * $indent);
+    my $prev;
+    for(@line) {
+        while($spare >= 0.90) {
+            print " ";
+            $spare--;
+        }
+        printf "%s%s", $prev ? " " : "", $_;
+        $prev = 1;
+        $spare += $ratio;
+    }
+    print "\n";
+}
+
+sub lastline {
+    my ($lvl, @line) = @_;
+    my $l = 0;
+    $line[0] =~ s/^( +)//;
+    $l = length($1) if($1);
+    prefixline($lvl * $indent + $l);
+    my $prev = 0;
+    for(@line) {
+        printf "%s%s", $prev ? " " : "", $_;
+        $prev = 1;
+    }
+    print "\n";
+}
+
+sub outputpara {
+    my ($lvl, $f) = @_;
+    $f =~ s/\n/ /g;
+
+    my $w = 0;
+    my @words = split(/  */, $f);
+    my $width = $colwidth - ($lvl * $indent);
+
+    my @line;
+    for my $e (@words) {
+        my $l = length($e);
+        my $spaces = scalar(@line);
+        if(($w + $l + $spaces) >= $width) {
+            justline($lvl, @line);
+            undef @line;
+            $w = 0;
+        }
+
+        push @line, $e;
+        $w += $l; # new width
+    }
+    if($w) {
+        lastline($lvl, @line);
+        print "\n";
+    }
+}
+
+sub printdesc {
+    my ($manpage, $baselvl, @desc) = @_;
+
+    if($manpage) {
+        for my $d (@desc) {
+            print $d;
+        }
+    }
+    else {
+        my $p = -1;
+        my $pnum;
+        my $para = '';
+        for my $l (@desc) {
+            my $lvl = 0;
+            my $lvlnum;
+            if($l !~ /^[\n\r]+/) {
+                # get the indent level off the string
+                $l =~ s/^\[([0-9q]*)\]//;
+                $lvl = $1;
+            }
+            if(($p =~ /q/) && ($lvl !~ /q/)) {
+                # the previous was quoted, this is not
+                print "\n";
+            }
+            if($lvl ne $p) {
+                $pnum = $p;
+                $pnum =~ s/q$//;
+                outputpara($baselvl + $pnum, $para);
+                $para = "";
+            }
+            if($lvl =~ /q/) {
+                # quoted, do not right-justify
+                chomp $l;
+                $lvlnum = $lvl;
+                $lvlnum =~ s/q$//;
+                lastline($baselvl + $lvlnum + 1, $l);
+                my $w = ($baselvl + $lvlnum + 1) * $indent + length($l);
+                if($w > $colwidth) {
+                    print STDERR "ERROR: $w columns is too long\n";
+                    print STDERR "$l\n";
+                    $error++;
+                }
+            }
+            else {
+                $para .= $l;
+            }
+
+            $p = $lvl;
+        }
+        $pnum = $p;
+        $pnum =~ s/q$//;
+        outputpara($baselvl + $pnum, $para);
+    }
+}
+
+sub seealso {
+    my($standalone, $data) = @_;
+    if($standalone) {
+        return sprintf
+            ".SH \"SEE ALSO\"\n$data\n";
+    }
+    else {
+        return "See also $data. ";
+    }
+}
+
+sub overrides {
+    my ($standalone, $data) = @_;
+    if($standalone) {
+        return ".SH \"OVERRIDES\"\n$data\n";
+    }
+    else {
+        return $data;
+    }
+}
+
+my %protexists = (
+    'DNS' => 1,
+    'FILE' => 1,
+    'FTP' => 1,
+    'FTPS' => 1,
+    'GSS/kerberos' => 1,
+    'HTTP' => 1,
+    'HTTPS' => 1,
+    'IMAP' => 1,
+    'IPFS' => 1,
+    'LDAP' => 1,
+    'MQTT' => 1,
+    'POP3' => 1,
+    'SCP' => 1,
+    'SFTP' => 1,
+    'SMTP' => 1,
+    'SSL' => 2, # deprecated
+    'TELNET' => 1,
+    'TFTP' => 1,
+    'TLS' => 1,
+    );
+
+sub protocols {
+    my ($f, $line, $manpage, $standalone, $data) = @_;
+    my @e = split(/ +/, $data);
+    for my $pr (@e) {
+        if(!$protexists{$pr}) {
+
+            print STDERR "$f:$line:1:ERROR: unrecognized protocol: $pr\n";
+            exit 2;
+        }
+    }
+    if($standalone) {
+        return ".SH \"PROTOCOLS\"\n$data\n";
+    }
+    else {
+        return "($data) " if($manpage);
+        return "[1]($data) " if(!$manpage);
+    }
+}
+
+sub too_old {
+    my ($version) = @_;
+    my $a = 999999;
+    if($version =~ /^(\d+)\.(\d+)\.(\d+)/) {
+        $a = $1 * 1000 + $2 * 10 + $3;
+    }
+    elsif($version =~ /^(\d+)\.(\d+)/) {
+        $a = $1 * 1000 + $2 * 10;
+    }
+    if($a < 7660) {
+        # we consider everything before 7.66.0 to be too old to mention
+        # specific changes for
+        return 1;
+    }
+    return 0;
+}
+
+sub added {
+    my ($standalone, $data) = @_;
+    if(too_old($data)) {
+        # do not mention ancient additions
+        return "";
+    }
+    if($standalone) {
+        return ".SH \"ADDED\"\nAdded in curl version $data\n";
+    }
+    else {
+        return "Added in $data. ";
+    }
+}
+
+sub render {
+    my ($manpage, $fh, $f, $line) = @_;
+    my @desc;
+    my $tablemode = 0;
+    my $header = 0;
+    # if $top is TRUE, it means a top-level page and not a command line option
+    my $top = ($line == 1);
+    my $quote = 0;
+    my $level = 0;
+    my $finalblank;
+    my $blankline = 0;
+    my $start = 0;
+
+    while(<$fh>) {
+        my $d = $_;
+        $line++;
+        $finalblank = ($d eq "\n");
+        if($d =~ /^\.(SH|BR|IP|B)/) {
+            print STDERR "$f:$line:1:ERROR: nroff instruction in input: \".$1\"\n";
+            return 4;
+        }
+        if(/^ *<!--/) {
+            # skip comments
+            next;
+        }
+        if((!$start) && ($_ =~ /^[\r\n]*\z/)) {
+            # skip leading blank lines
+            next;
+        }
+
+        $start = 1;
+
+        if(/^[ \t]*\n/) {
+            # count and ignore blank lines
+            $blankline++;
+            next;
+        }
+        elsif($d =~ /^    (.*)/) {
+            my $word = $1;
+            if(!$quote && $manpage) {
+                push @desc, "\n" if($blankline);
+                push @desc, ".nf\n";
+                $blankline = 0;
+            }
+            $quote = 1;
+            $d = "$word\n";
+        }
+        elsif($d =~ /^(```|~~~)/) {
+            if(!$quote) {
+                if($manpage) {
+                    push @desc, "\n" if($blankline);
+                    push @desc, ".nf\n";
+                    $blankline = 0;
+                }
+                $quote = 2;
+            }
+            else {
+                # end of quote
+                push @desc, ".fi\n" if($manpage);
+                $quote = 0;
+            }
+            next;
+        }
+        elsif($quote == 1) {
+            # end of quote
+            push @desc, ".fi\n" if($manpage);
+            $quote = 0;
+        }
+
+        if(/^# (.*)/) {
+            $header = 1;
+            if($top != 1) {
+                # ignored for command line options
+                $blankline++;
+                next;
+            }
+            push @desc, ".SH $1\n" if($manpage);
+            push @desc, "[0]$1\n" if(!$manpage);
+            next;
+        }
+        elsif(/^###/) {
+            print STDERR "$f:$line:1:ERROR: ### header is not supported\n";
+            exit 3;
+        }
+        elsif(/^## (.*)/) {
+            my $word = $1;
+            my $nontick = $word;
+            # if there are enclosing quotes, remove them first
+            $word =~ s/[\"\'](.*)[\"\']\z/$1/;
+
+            # remove backticks from headers
+            $word =~ s/\`//g;
+
+            # remove backticked sections
+            $nontick =~ s/\`[^\`]*\`//g;
+            if($nontick =~ /[^\\][\<\>]/) {
+                print STDERR "$f:$line:1:WARN: un-escaped < or > used: $nontick\n";
+            }
+
+            # if there is a space, it needs quotes for man page
+            if(($word =~ / /) && $manpage) {
+                $word = "\"$word\"";
+            }
+            $level = 1;
+            if($top == 1) {
+                push @desc, ".IP $word\n" if($manpage);
+                push @desc, "\n" if(!$manpage);
+                push @desc, "[1]$word\n" if(!$manpage);
+            }
+            else {
+                if(!$tablemode) {
+                    push @desc, ".RS\n" if($manpage);
+                    $tablemode = 1;
+                }
+                push @desc, ".IP $word\n" if($manpage);
+                push @desc, "\n" if(!$manpage);
+                push @desc, "[1]$word\n" if(!$manpage);
+            }
+            $header = 1;
+            next;
+        }
+        elsif(/^##/) {
+            if($top == 1) {
+                print STDERR "$f:$line:1:ERROR: ## empty header top-level mode\n";
+                exit 3;
+            }
+            if($tablemode) {
+                # end of table
+                push @desc, ".RE\n.IP\n" if($manpage);
+                push @desc, "\n" if(!$manpage);
+                $tablemode = 0;
+                $level = 0;
+            }
+            $header = 1;
+            next;
+        }
+        elsif(/^\.(IP|RS|RE)/) {
+            my ($cmd) = ($1);
+            print STDERR "$f:$line:1:ERROR: $cmd detected, use ##-style\n";
+            return 3;
+        }
+
+        $d =~ s/`%DATE`/$date/g;
+        $d =~ s/`%VERSION`/$version/g;
+        $d =~ s/`%GLOBALS`/$globals/g;
+
+        if(!$quote) {
+            if($d =~ /^(.*)  /) {
+                printf STDERR "$f:$line:%d:ERROR: 2 spaces detected\n",
+                    length($1);
+                return 3;
+            }
+            my $back = $d;
+
+            # remove all backticked pieces
+            $back =~ s/\`(.*?)\`//g;
+
+            if($back =~ /[^\\][\<\>]/) {
+                print STDERR "$f:$line:1:WARN: un-escaped < or > used: $back\n";
+                return 3;
+            }
+        }
+
+        # convert backticks to double quotes
+        $d =~ s/\`/\"/g;
+
+        if($d =~ /\(added in(.*)/i) {
+            if(length($1) < 2) {
+                print STDERR "$f:$line:1:ERROR: broken up added-in line:\n";
+                print STDERR "$f:$line:1:ERROR: $d";
+                return 3;
+            }
+        }
+      again:
+        if($d =~ /\(Added in ([0-9.]+)\)/i) {
+            my $ver = $1;
+            if(too_old($ver)) {
+                $d =~ s/ *\(Added in $ver\)//gi;
+                goto again;
+            }
+        }
+
+        # convert backslash-'<' or '> to the second character
+        $d =~ s/\\([><])/$1/g;
+        # convert single backslash to double-backslash
+        $d =~ s/\\/\\\\/g if($manpage);
+
+        if($manpage) {
+            if(!$quote && $d =~ /--/) {
+                $d =~ s/--([a-z0-9.-]+)/manpageify($1, 1)/ge;
+            }
+
+            # quote minuses in the output
+            $d =~ s/([^\\])-/$1\\-/g;
+            # replace single quotes
+            $d =~ s/\'/\\(aq/g;
+            # handle double quotes or periods first on the line
+            $d =~ s/^([\.\"])/\\&$1/;
+            # **bold**
+            $d =~ s/\*\*(\S.*?)\*\*/\\fB$1\\fP/g;
+            # *italics*
+            $d =~ s/\*(\S.*?)\*/\\fI$1\\fP/g;
+        }
+        else {
+            # **bold**
+            $d =~ s/\*\*(\S.*?)\*\*/$1/g;
+            # *italics*
+            $d =~ s/\*(\S.*?)\*/$1/g;
+        }
+        # trim trailing spaces
+        $d =~ s/[ \t]+\z//;
+        push @desc, "\n" if($blankline && !$header);
+        $blankline = 0;
+        push @desc, $d if($manpage);
+        my $qstr = $quote ? "q" : "";
+        push @desc, "[".(1 + $level)."$qstr]$d" if(!$manpage);
+        $header = 0;
+    }
+    if($finalblank) {
+        print STDERR "$f:$line:1:ERROR: trailing blank line\n";
+        exit 3;
+    }
+    if($quote) {
+        # do not leave the quote "hanging"
+        push @desc, ".fi\n" if($manpage);
+    }
+    if($tablemode) {
+        # end of table
+        push @desc, ".RE\n.IP\n" if($manpage);
+    }
+    return @desc;
+}
+
+sub maybespace {
+    my ($string) = @_;
+
+    if(($string =~ /(.* )(.*)/) &&
+       (length($2) <= 20)) {
+        return $1;
+    }
+    if(($string =~ /(.*:)(.*)/) &&
+       (length($2) <= 20)) {
+        return $1;
+    }
+    return $string;
+}
+
+sub single {
+    my ($dir, $manpage, $f, $standalone) = @_;
+    my $fh;
+    open($fh, "<:crlf", "$dir/$f") or
+        die "could not find $dir/$f";
+    my $short;
+    my $long;
+    my $tags;
+    my $added;
+    my $protocols;
+    my $arg;
+    my $mutexed;
+    my $requires;
+    my $category;
+    my @seealso;
+    my $copyright;
+    my $spdx;
+    my @examples; # there can be more than one
+    my $magic; # cmdline special option
+    my $line;
+    my $dline;
+    my $multi = "";
+    my $scope;
+    my $experimental;
+    my $start = 0;
+    my $list; # identifies the list, 1 example, 2 see-also
+    while(<$fh>) {
+        $line++;
+        if(/^ *<!--/) {
+            next;
+        }
+        if(!$start) {
+            if(/^---/) {
+                $start = 1;
+            }
+            next;
+        }
+        if(/^Short: *(.)/i) {
+            $short = $1;
+        }
+        elsif(/^Long: *(.*)/i) {
+            $long = $1;
+        }
+        elsif(/^Added: *(.*)/i) {
+            $added = $1;
+        }
+        elsif(/^Tags: *(.*)/i) {
+            $tags = $1;
+        }
+        elsif(/^Arg: *(.*)/i) {
+            $arg = $1;
+        }
+        elsif(/^Magic: *(.*)/i) {
+            $magic = $1;
+        }
+        elsif(/^Mutexed: *(.*)/i) {
+            $mutexed = $1;
+        }
+        elsif(/^Protocols: *(.*)/i) {
+            $protocols = $1;
+        }
+        elsif(/^See-also: +(.+)/i) {
+            if(@seealso) {
+                print STDERR "ERROR: duplicated See-also in $f\n";
+                return 1;
+            }
+            push @seealso, $1;
+        }
+        elsif(/^See-also:/i) {
+            $list = 2;
+        }
+        elsif(/^  *- (.*)/i && ($list == 2)) {
+            push @seealso, $1;
+        }
+        elsif(/^Requires: *(.*)/i) {
+            $requires = $1;
+        }
+        elsif(/^Category: *(.*)/i) {
+            $category = $1;
+        }
+        elsif(/^Example: +(.+)/i) {
+            push @examples, $1;
+        }
+        elsif(/^Example:/i) {
+            # '1' is the example list
+            $list = 1;
+        }
+        elsif(/^  *- (.*)/i && ($list == 1)) {
+            push @examples, $1;
+        }
+        elsif(/^Multi: *(.*)/i) {
+            $multi = $1;
+        }
+        elsif(/^Scope: *(.*)/i) {
+            $scope = $1;
+        }
+        elsif(/^Experimental: yes/i) {
+            $experimental = 1;
+        }
+        # REUSE-IgnoreStart
+        elsif(/^C: (.*)/i) {
+            $copyright = $1;
+        }
+        elsif(/^SPDX-License-Identifier: (.*)/i) {
+            $spdx = $1;
+        }
+        # REUSE-IgnoreEnd
+        elsif(/^Help: *(.*)/i) {
+            ;
+        }
+        elsif(/^---/) {
+            $start++;
+            if(!$long) {
+                print STDERR "ERROR: no 'Long:' in $f\n";
+                return 1;
+            }
+            if(!$category) {
+                print STDERR "ERROR: no 'Category:' in $f\n";
+                return 2;
+            }
+            if(!$examples[0]) {
+                print STDERR "$f:$line:1:ERROR: no 'Example:' present\n";
+                return 2;
+            }
+            if(!$added) {
+                print STDERR "$f:$line:1:ERROR: no 'Added:' version present\n";
+                return 2;
+            }
+            if(!$seealso[0]) {
+                print STDERR "$f:$line:1:ERROR: no 'See-also:' field present\n";
+                return 2;
+            }
+            if(!$copyright) {
+                print STDERR "$f:$line:1:ERROR: no 'C:' field present\n";
+                return 2;
+            }
+            if(!$spdx) {
+                # REUSE-IgnoreStart
+                print STDERR "$f:$line:1:ERROR: no 'SPDX-License-Identifier:' field present\n";
+                # REUSE-IgnoreEnd
+                return 2;
+            }
+            last;
+        }
+        else {
+            chomp;
+            print STDERR "$f:$line:1:WARN: unrecognized line in $f, ignoring: '$_';\n";
+        }
+    }
+
+    if($start < 2) {
+        print STDERR "$f:1:1:ERROR: no proper meta-data header\n";
+        return 2;
+    }
+
+    my @desc = render($manpage, $fh, $f, $line);
+    close($fh);
+    my $opt;
+
+    if(defined($short) && $long) {
+        $opt = "-$short, --$long";
+    }
+    elsif($short && !$long) {
+        $opt = "-$short";
+    }
+    elsif($long && !$short) {
+        $opt = "--$long";
+    }
+
+    if($arg) {
+        $opt .= " $arg";
+    }
+
+    # quote "bare" minuses in opt
+    $opt =~ s/-/\\-/g if($manpage);
+    if($standalone) {
+        print ".TH curl 1 \"30 Nov 2016\" \"curl 7.52.0\" \"curl manual\"\n";
+        print ".SH OPTION\n";
+        print "curl $opt\n";
+    }
+    elsif($manpage) {
+        print ".IP \"$opt\"\n";
+    }
+    else {
+        lastline(1, $opt);
+    }
+    my @leading;
+    if($protocols) {
+        push @leading, protocols($f, $line, $manpage, $standalone, $protocols);
+    }
+
+    if($standalone) {
+        print ".SH DESCRIPTION\n";
+    }
+
+    if($experimental) {
+        my $pref = $manpage ? "" : "[1]";
+        push @leading, "$pref**WARNING**: this option is experimental. Do not use in production.\n\n";
+    }
+
+    my $pre = $manpage ? "\n" : "[1]";
+
+    if($scope) {
+        if($category !~ /global/) {
+            print STDERR "$f:$line:1:ERROR: global scope option does not have global category\n";
+            return 2;
+        }
+        if($scope eq "global") {
+            push @desc, "\n" if(!$manpage);
+            push @desc,
+                sprintf("${pre}This option is global and does not need to be specified for each use of %s.\n",
+                        manpageify("next", $manpage));
+        }
+        else {
+            print STDERR "$f:$line:1:ERROR: unrecognized scope: '$scope'\n";
+            return 2;
+        }
+    }
+
+    my @extra;
+    if($multi eq "single") {
+        push @extra,
+            sprintf("${pre}If %s is provided several times, the last set ".
+                    "value is used.\n",
+                    manpageify($long, $manpage));
+    }
+    elsif($multi eq "append") {
+        push @extra,
+            sprintf("${pre}%s can be used several times in a command line.\n",
+                    manpageify($long, $manpage));
+    }
+    elsif($multi eq "boolean") {
+        my $rev = "no-$long";
+        # for options that start with "no-" the reverse is then without
+        # the no- prefix
+        if($long =~ /^no-/) {
+            $rev = $long;
+            $rev =~ s/^no-//;
+        }
+        my $dashes = $manpage ? "\\-\\-" : "--";
+        push @extra,
+            sprintf("${pre}Providing %s multiple times has no extra effect.\n".
+                    "Disable it again with $dashes$rev.\n",
+                    manpageify($long, $manpage));
+    }
+    elsif($multi eq "mutex") {
+        push @extra,
+            sprintf("${pre}Providing %s multiple times has no extra effect.\n",
+                    manpageify($long, $manpage));
+    }
+    elsif($multi eq "custom") {
+        ; # left for the text to describe
+    }
+    elsif($multi eq "per-URL") {
+        push @extra,
+            sprintf("${pre}%s is associated with a single URL. Use it once per URL ".
+                    "when you use several URLs in a command line.\n",
+                    manpageify($long, $manpage));
+    }
+    elsif($multi) {
+        print STDERR "$f:$line:1:ERROR: unrecognized Multi: '$multi'\n";
+        return 2;
+    }
+
+    printdesc($manpage, 2, (@leading, @desc, @extra));
+    undef @desc;
+
+    my @foot;
+
+    my $mstr;
+    my $and = 0;
+    my $num = scalar(@seealso);
+    if($num > 2) {
+        # use commas up to this point
+        $and = $num - 1;
+    }
+    my $i = 0;
+    for my $k (@seealso) {
+        if(!$helplong{$k}) {
+            print STDERR "$f:$line:1:WARN: see-also a non-existing option: $k\n";
+        }
+        my $l = manpageify($k, $manpage);
+        my $sep = " and";
+        if($and && ($i < $and)) {
+            $sep = ",";
+        }
+        $mstr .= sprintf "%s$l", $mstr ? "$sep " : "";
+        $i++;
+    }
+
+    if($requires) {
+        my $l = manpageify($long, $manpage);
+        push @foot, "For $l to work, it requires that the underlying libcurl".
+            " is built to support $requires.\n";
+    }
+    if($mutexed) {
+        my @m = split(/ /, $mutexed);
+        my $mstr;
+        my $num = scalar(@m);
+        my $count = 0;
+        for my $k (@m) {
+            if(!$helplong{$k}) {
+                print STDERR "WARN: $f mutexes a non-existing option: $k\n";
+            }
+            my $l = manpageify($k, $manpage);
+            my $sep = ", ";
+            if($count == ($num -1)) {
+                $sep = " and ";
+            }
+            $mstr .= sprintf "%s$l", $mstr ? $sep : "";
+            $count++;
+        }
+        push @foot, overrides($standalone,
+                              "This option is mutually exclusive with $mstr.\n");
+    }
+    if($examples[0]) {
+        my $s = "";
+        $s = "s" if($examples[1]);
+        foreach my $e (@examples) {
+            my $check = $e;
+            # verify the used options
+            for my $e (split(/ /, $check)) {
+                if($e =~ /^-([^- ])/) {
+                    my $opt = $1;
+                    if(!$optshort{$opt}) {
+                        print STDERR "$f:$line:1:ERROR: unknown option in ".
+                            "example: -$opt\n";
+                        return 2;
+                    }
+                }
+                elsif($e =~ /^--([^ =]*)/) {
+                    my $opt = $1;
+                    $opt =~ s/^expand-//g;
+                    if(!$helplong{$opt}) {
+                        print STDERR "$f:$line:1:ERROR: unknown option in ".
+                            "example: '--$opt'\n";
+                        return 2;
+                    }
+                }
+            }
+        }
+        if($manpage) {
+            print "\nExample$s:\n";
+            print ".nf\n";
+            foreach my $e (@examples) {
+                $e =~ s!\$URL!https://example.com!g;
+                # convert single backslashes to doubles
+                $e =~ s/\\/\\\\/g;
+                print "curl $e\n";
+            }
+            print ".fi\n";
+        }
+        else {
+            my @ex;
+            push @ex, "[0q]Example$s:\n";
+            #
+            # long ASCII examples are wrapped. Preferably at the last space
+            # before the margin. Or at a colon. Otherwise it cuts at the
+            # exact boundary.
+            #
+            foreach my $e (@examples) {
+                $e =~ s!\$URL!https://example.com!g;
+                my $maxwidth = 60; # plus the "    curl " 18 col prefix
+                if(length($e) > $maxwidth) {
+                    # a long example, shorten it
+                    my $p = substr($e, 0, $maxwidth);
+                    $p = maybespace($p);
+                    push @ex, "[0q] curl ".$p."\\";
+                    $e = substr($e, length($p));
+                    do {
+                        my $r = substr($e, 0, $maxwidth);
+                        if(length($e) > $maxwidth) {
+                            $r = maybespace($r);
+                        }
+                        my $slash = "";
+                        $e = substr($e, length($r));
+                        if(length($e) > 0) {
+                            $slash = "\\";
+                        }
+
+                        push @ex, "[0q]      $r$slash" if($r);
+                    } while(length($e));
+                }
+                else {
+                    push @ex, "[0q] curl $e\n";
+                }
+            }
+            printdesc($manpage, 2, @ex);
+        }
+    }
+    if($added) {
+        push @foot, added($standalone, $added);
+    }
+    push @foot, seealso($standalone, $mstr);
+
+    print "\n";
+    my $ft = join("", @foot);
+    if($manpage) {
+        $ft =~ s/ +\z//; # remove trailing space
+        print "$ft\n";
+    }
+    else {
+        printdesc($manpage, 2, "[1]$ft");
+    }
+    return 0;
+}
+
+sub getshortlong {
+    my ($dir, $f) = @_;
+    $f =~ s/^.*\///;
+    open(F, "<:crlf", "$dir/$f") or
+        die "could not find $dir/$f";
+    my $short;
+    my $long;
+    my $help;
+    my $arg;
+    my $protocols;
+    my $category;
+    my $start = 0;
+    my $line = 0;
+    while(<F>) {
+        $line++;
+        if(!$start) {
+            if(/^---/) {
+                $start = 1;
+            }
+            next;
+        }
+        if(/^Short: (.)/i) {
+            $short = $1;
+        }
+        elsif(/^Long: (.*)/i) {
+            $long = $1;
+        }
+        elsif(/^Help: (.*)/i) {
+            $help = $1;
+            my $len = length($help);
+            if($len >= 49) {
+                printf STDERR "$f:$line:1:WARN: oversized help text: %d characters\n",
+                    $len;
+            }
+        }
+        elsif(/^Arg: (.*)/i) {
+            $arg = $1;
+        }
+        elsif(/^Protocols: (.*)/i) {
+            $protocols = $1;
+        }
+        elsif(/^Category: (.*)/i) {
+            $category = $1;
+        }
+        elsif(/^---/) {
+            last;
+        }
+    }
+    close(F);
+    if($short) {
+        $optshort{$short} = $long;
+    }
+    if($long) {
+        $optlong{$long} = $short;
+        $helplong{$long} = $help;
+        $arglong{$long} = $arg;
+        $protolong{$long} = $protocols;
+        $catlong{$long} = $category;
+    }
+}
+
+sub indexoptions {
+    my ($dir, @files) = @_;
+    foreach my $file (@files) {
+        getshortlong($dir, $file);
+    }
+}
+
+sub header {
+    my ($dir, $manpage, $f) = @_;
+    my $fh;
+    open($fh, "<:crlf", "$dir/$f") or
+        die "could not find $dir/$f";
+    my @d = render($manpage, $fh, $f, 1);
+    close($fh);
+    printdesc($manpage, 0, @d);
+}
+
+sub sourcecategories {
+    my ($dir) = @_;
+    my %cats;
+    open(H, "<$dir/../../src/tool_help.h") or
+        die "cannot find the header file";
+    while(<H>) {
+        if(/^\#define CURLHELP_([A-Z0-9]*)/) {
+            $cats{lc($1)}++;
+        }
+    }
+    close(H);
+    return %cats;
+}
+
+sub listhelp {
+    my ($dir) = @_;
+    my %cats = sourcecategories($dir);
+
+    print <<HEAD
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \\| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \\___|\\___/|_| \\_\\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel\@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "tool_setup.h"
+
+#include "tool_help.h"
+
+/*
+ * DO NOT edit tool_listhelp.c manually.
+ * This source file is generated with the following command in an autotools
+ * build:
+ *
+ * "make listhelp"
+ */
+
+const struct helptxt helptext[] = {
+HEAD
+        ;
+    foreach my $f (sort keys %helplong) {
+        my $long = $f;
+        my $short = $optlong{$long};
+        my @categories = split ' ', $catlong{$long};
+        my $bitmask = ' ';
+        my $opt;
+
+        if(defined($short) && $long) {
+            $opt = "-$short, --$long";
+        }
+        elsif($long && !$short) {
+            $opt = "    --$long";
+        }
+        for my $i (0 .. $#categories) {
+            if(!$cats{ $categories[$i] }) {
+                printf STDERR "$f.md:ERROR: Unknown category '%s'\n",
+                    $categories[$i];
+                exit 3;
+            }
+
+            $bitmask .= 'CURLHELP_' . uc $categories[$i];
+            # If not last element, append |
+            if($i < $#categories) {
+                $bitmask .= ' | ';
+            }
+        }
+        $bitmask =~ s/(?=.{76}).{1,76}\|/$&\n   /g;
+        my $arg = $arglong{$long};
+        if($arg) {
+            $opt .= " $arg";
+        }
+        my $desc = $helplong{$f};
+        $desc =~ s/\"/\\\"/g; # escape double quotes
+
+        my $line = sprintf "  { \"%s\",\n    \"%s\",\n   %s },\n", $opt, $desc, $bitmask;
+
+        if(length($opt) > 78) {
+            print STDERR "WARN: the --$long name is too long\n";
+        }
+        elsif(length($desc) > 78) {
+            print STDERR "WARN: the --$long description is too long\n";
+        }
+        print $line;
+    }
+    print <<FOOT
+  { NULL, NULL, 0 }
+};
+FOOT
+        ;
+}
+
+sub listcats {
+    my %allcats;
+    foreach my $f (sort keys %helplong) {
+        my @categories = split ' ', $catlong{$f};
+        foreach (@categories) {
+            $allcats{$_} = undef;
+        }
+    }
+    my @categories;
+    foreach my $key (keys %allcats) {
+        push @categories, $key;
+    }
+    @categories = sort @categories;
+    for my $i (0..$#categories) {
+        printf("#define CURLHELP_%-10s (%s)\n",
+               uc($categories[$i]), "1 << ${i}");
+    }
+}
+
+sub listglobals {
+    my ($dir, @files) = @_;
+    my @globalopts;
+
+    # Find all global options and output them
+    foreach my $f (sort @files) {
+        open(F, "<:crlf", "$dir/$f") or
+            die "could not read $dir/$f";
+        my $long;
+        my $start = 0;
+        while(<F>) {
+            if(/^---/) {
+                if(!$start) {
+                    $start = 1;
+                    next;
+                }
+                else {
+                    last;
+                }
+            }
+            if(/^Long: *(.*)/i) {
+                $long = $1;
+            }
+            elsif(/^Scope: global/i) {
+                push @globalopts, $long;
+                last;
+            }
+        }
+        close(F);
+    }
+    for my $e (0 .. $#globalopts) {
+        $globals .= sprintf "%s--%s",  $e ? ($globalopts[$e + 1] ? ", " : " and ") : "",
+            $globalopts[$e],;
+    }
+}
+
+sub noext {
+    my $in = $_[0];
+    $in =~ s/\.md//;
+    return $in;
+}
+
+sub sortnames {
+    return noext($a) cmp noext($b);
+}
+
+sub mainpage {
+    my ($dir, $manpage, @files) = @_;
+    # $manpage is 1 for nroff, 0 for ASCII
+    my $ret;
+    my $fh;
+    open($fh, "<:crlf", "$dir/mainpage.idx") or
+        die "no $dir/mainpage.idx file";
+
+    print <<HEADER
+.\\" **************************************************************************
+.\\" *                                  _   _ ____  _
+.\\" *  Project                     ___| | | |  _ \\| |
+.\\" *                             / __| | | | |_) | |
+.\\" *                            | (__| |_| |  _ <| |___
+.\\" *                             \\___|\\___/|_| \\_\\_____|
+.\\" *
+.\\" * Copyright (C) Daniel Stenberg, <daniel\@haxx.se>, et al.
+.\\" *
+.\\" * This software is licensed as described in the file COPYING, which
+.\\" * you should have received as part of this distribution. The terms
+.\\" * are also available at https://curl.se/docs/copyright.html.
+.\\" *
+.\\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+.\\" * copies of the Software, and permit persons to whom the Software is
+.\\" * furnished to do so, under the terms of the COPYING file.
+.\\" *
+.\\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+.\\" * KIND, either express or implied.
+.\\" *
+.\\" * SPDX-License-Identifier: curl
+.\\" *
+.\\" **************************************************************************
+.\\"
+.\\" DO NOT EDIT. Generated by the curl project managen man page generator.
+.\\"
+.TH curl 1 "$date" "curl $version" "curl Manual"
+HEADER
+        if($manpage);
+
+    while(<$fh>) {
+        my $f = $_;
+        chomp $f;
+        if($f =~ /^#/) {
+            # standard comment
+            next;
+        }
+        if(/^%options/) {
+            # output docs for all options
+            foreach my $f (sort sortnames @files) {
+                $ret += single($dir, $manpage, $f, 0);
+            }
+        }
+        else {
+            # render the file
+            header($dir, $manpage, $f);
+        }
+    }
+    close($fh);
+    exit $ret if($ret);
+}
+
+sub showonly {
+    my ($dir, $f) = @_;
+    if(single($dir, 1, $f, 1)) {
+        print STDERR "$f: failed\n";
+    }
+}
+
+sub showprotocols {
+    my %prots;
+    foreach my $f (keys %optlong) {
+        my @p = split(/ /, $protolong{$f});
+        for my $p (@p) {
+            $prots{$p}++;
+        }
+    }
+    for(sort keys %prots) {
+        printf "$_ (%d options)\n", $prots{$_};
+    }
+}
+
+sub getargs {
+    my ($dir, $f, @s) = @_;
+    if($f eq "mainpage") {
+        listglobals($dir, @s);
+        mainpage($dir, 1, @s);
+        return;
+    }
+    elsif($f eq "ascii") {
+        listglobals($dir, @s);
+        mainpage($dir, 0, @s);
+        return;
+    }
+    elsif($f eq "listhelp") {
+        listhelp($dir);
+        return;
+    }
+    elsif($f eq "single") {
+        showonly($dir, $s[0]);
+        return;
+    }
+    elsif($f eq "protos") {
+        showprotocols();
+        return;
+    }
+    elsif($f eq "listcats") {
+        listcats();
+        return;
+    }
+
+    print "Usage: managen ".
+        "[-d dir] <mainpage/ascii/listhelp/single FILE/protos/listcats> [files]\n";
+}
+
+#------------------------------------------------------------------------
+
+my $dir = ".";
+my $include = "../../include";
+my $cmd = shift @ARGV || '';
+
+while(1) {
+    if($cmd eq "-d") {
+        # specifies source directory
+        $dir = shift @ARGV;
+        $cmd = shift @ARGV;
+    }
+    elsif($cmd eq "-I") {
+        # include path root
+        $include = shift @ARGV;
+        $cmd = shift @ARGV;
+    }
+    elsif($cmd eq "-c") {
+        # Column width
+        $colwidth = 0 + shift @ARGV;
+        $cmd = shift @ARGV;
+    }
+    else {
+        last;
+    }
+}
+
+my @files = @ARGV; # the rest are the files
+
+# can be overridden for releases
+if($ENV{'CURL_MAKETGZ_VERSION'}) {
+    $version = $ENV{'CURL_MAKETGZ_VERSION'};
+}
+else {
+    open(INC, "<$include/curl/curlver.h") or die "no $include/curl/curlver.h";
+    while(<INC>) {
+        if($_ =~ /^#define LIBCURL_VERSION \"([0-9.]*)/) {
+            $version = $1;
+            last;
+        }
+    }
+    close(INC);
+}
+
+# learn all existing options
+indexoptions($dir, @files);
+
+getargs($dir, $cmd, @files);
+
+exit $error;
diff --git a/third-party/curl/scripts/mdlinkcheck b/third-party/curl/scripts/mdlinkcheck
new file mode 100644
index 0000000000..180203c41e
--- /dev/null
+++ b/third-party/curl/scripts/mdlinkcheck
@@ -0,0 +1,254 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+my %whitelist = (
+    'https://curl.se' => 1,
+    'https://curl.se/' => 1,
+    'https://curl.se/bug/' => 1,
+    'https://curl.se/bug/view.cgi' => 1,
+    'https://curl.se/changes.html' => 1,
+    'https://curl.se/dev/advisory.html' => 1,
+    'https://curl.se/dev/builds.html' => 1,
+    'https://curl.se/dev/code-style.html' => 1,
+    'https://curl.se/dev/contribute.html' => 1,
+    'https://curl.se/dev/internals.html' => 1,
+    'https://curl.se/dev/secprocess.html' => 1,
+    'https://curl.se/dev/sourceactivity.html' => 1,
+    'https://curl.se/docs/' => 1,
+    'https://curl.se/docs/caextract.html' => 1,
+    'https://curl.se/docs/copyright.html' => 1,
+    'https://curl.se/docs/http-cookies.html' => 1,
+    'https://curl.se/docs/install.html' => 1,
+    'https://curl.se/docs/knownbugs.html' => 1,
+    'https://curl.se/docs/manpage.html' => 1,
+    'https://curl.se/docs/releases.html' => 1,
+    'https://curl.se/docs/security.html' => 1,
+    'https://curl.se/docs/ssl-ciphers.html' => 1,
+    'https://curl.se/docs/ssl-compared.html' => 1,
+    'https://curl.se/docs/sslcerts.html' => 1,
+    'https://curl.se/docs/thanks.html' => 1,
+    'https://curl.se/docs/todo.html' => 1,
+    'https://curl.se/docs/vulnerabilities.html' => 1,
+    'https://curl.se/download.html' => 1,
+    'https://curl.se/libcurl/' => 1,
+    'https://curl.se/libcurl/c/CURLOPT_SSL_CIPHER_LIST.html' => 1,
+    'https://curl.se/libcurl/c/CURLOPT_SSLVERSION.html' => 1,
+    'https://curl.se/libcurl/c/CURLOPT_TLS13_CIPHERS.html' => 1,
+    'https://curl.se/libcurl/c/libcurl.html' => 1,
+    'https://curl.se/libcurl/c/threadsafe.html' => 1,
+    'https://curl.se/logo/curl-logo.svg' => 1,
+    'https://curl.se/mail/' => 1,
+    'https://curl.se/mail/etiquette.html' => 1,
+    'https://curl.se/mail/list.cgi?list=curl-distros' => 1,
+    'https://curl.se/mail/list.cgi?list=curl-library' => 1,
+    'https://curl.se/rfc/cookie_spec.html' => 1,
+    'https://curl.se/rfc/rfc2255.txt' => 1,
+    'https://curl.se/sponsors.html' => 1,
+    'https://curl.se/support.html' => 1,
+    'https://curl.se/windows/' => 1,
+
+    'https://testclutch.curl.se/' => 1,
+
+    'https://github.com/curl/curl-fuzzer' => 1,
+    'https://github.com/curl/curl-www' => 1,
+    'https://github.com/curl/curl/wcurl' => 1,
+
+    );
+
+my %url;
+my %flink;
+
+my $dry;
+if(defined $ARGV[0] && $ARGV[0] eq "--dry-run") {
+    $dry = 1;
+    shift @ARGV;
+}
+
+# list all files to scan for links
+my @files = qx(git ls-files docs include lib scripts src);
+
+sub storelink {
+    my ($f, $line, $link) = @_;
+    my $o = $link;
+
+    if($link =~ /^\#/) {
+        # ignore local-only links
+        return;
+    }
+    # cut off any anchor
+    $link =~ s:\#.*\z::;
+
+    if($link =~ /^(https|http):/) {
+        if($whitelist{$link}) {
+            #print "-- whitelisted: $link\n";
+            $whitelist{$link}++;
+        }
+        # example.com is used as example
+        elsif($link =~ /^https:\/\/(.*)example.(com|org|net)/) {
+            #print "-- example: $link\n";
+        }
+        # so is using the .example TLD
+        elsif($link =~ /^https:\/\/(.*)\.example(\/|$|:)/) {
+            #print "-- .example: $link\n";
+        }
+        # so is using anything on localhost
+        elsif($link =~ /^http(s|):\/\/localhost/) {
+            #print "-- localhost: $link\n";
+        }
+        # ignore all links to curl's github repo
+        elsif($link =~ /^https:\/\/github.com\/curl\/curl(\/|$)/) {
+            #print "-- curl github repo: $link\n";
+        }
+        elsif($link =~ /^(https|http):\/\/[0-9.]+(\/|$)/) {
+            #print "-- IPv4 number: $link\n";
+        }
+        else {
+            #print "ADD '$link'\n";
+            $url{$link} .= "$f:$line ";
+        }
+        return;
+    }
+
+    # a file link
+    my $dir = $f;
+    $dir =~ s:([^/]*\z)::;
+
+    if($link =~ s/(^\/)//) {
+        # link starts with a slash, now removed
+        $dir = "";
+    }
+    else {
+        while($link =~ s:^\.\.\/::) {
+            $dir =~ s:([^/]*)\/\z::;
+        }
+    }
+
+    $flink{"./$dir$link"} .= "$f:$line ";
+}
+
+sub findlinks {
+    my ($f) = @_;
+    my $line = 1;
+    open(F, "<:crlf", $f) or
+        return;
+
+    # is it a markdown extension?
+    my $md = ($f =~ /\.md$/i);
+
+    while(<F>) {
+        chomp;
+        if($md && /\]\(([^)]*)/) {
+            my $link = $1;
+            #print "$f:$line $link\n";
+            storelink($f, $line, $link);
+        }
+        # ignore trailing: dot, double quote, single quote, asterisk, hash,
+        # comma, question mark, colon, closing parenthesis, backslash,
+        # closing angle bracket, whitespace, pipe, backtick, semicolon
+        elsif(/(https:\/\/[a-z0-9.\/:%_+@-]+[^."'*\#,?:\)> \t|`;\\])/i) {
+            #print "RAW '$_'\n";
+            storelink($f, $line, $1);
+        }
+        $line++;
+    }
+    close(F);
+}
+
+sub checkurl {
+    my ($url) = @_;
+
+    if($whitelist{$url}) {
+        #print STDERR "$url is whitelisted\n";
+        return 0;
+    }
+
+    $url =~ s/\+/%2B/g;
+    my @content;
+    if(open(my $fh, '-|', 'curl', '-ILfsm10', '--retry', '2', '--retry-delay', '5',
+                          '-A', 'Mozilla/curl.se link-probe', $url)) {
+        @content = <$fh>;
+        close $fh;
+    }
+    if(!$content[0]) {
+        print "FAIL: $url\n";
+        return 1; # fail
+    }
+    print "OK: $url\n";
+    return 0; # ok
+}
+
+for my $f (@files) {
+    chomp $f;
+    if($f !~ /\/mdlinkcheck$/) {
+        findlinks($f);
+    }
+}
+
+for my $u (sort keys %whitelist) {
+    if($whitelist{$u} == 1) {
+        printf STDERR "warning: unused whitelist entry: '$u'\n";
+    }
+}
+
+if($dry) {
+    for my $u (sort keys %url) {
+        print "$u\n";
+    }
+    exit;
+}
+
+my $error;
+my @errlist;
+for my $u (sort keys %url) {
+    my $r = checkurl($u);
+
+    if($r) {
+        for my $f (split(/ /, $url{$u})) {
+            push @errlist, sprintf "%s ERROR links to missing URL %s\n", $f, $u;
+            $error++;
+        }
+    }
+}
+
+for my $l (sort keys %flink) {
+    if(! -r $l) {
+        for my $f (split(/ /, $flink{$l})) {
+            push @errlist, sprintf "%s ERROR links to missing file %s\n", $f, $l;
+            $error++;
+        }
+    }
+}
+
+printf "Checked %d URLs\n", scalar(keys %url);
+if($error) {
+    print "$error URLs had problems:\n";
+    for(@errlist) {
+        print $_;
+    }
+}
+exit 1 if($error);
diff --git a/third-party/curl/scripts/mk-ca-bundle.pl b/third-party/curl/scripts/mk-ca-bundle.pl
index 83027a4893..c83f2ba5e3 100644
--- a/third-party/curl/scripts/mk-ca-bundle.pl
+++ b/third-party/curl/scripts/mk-ca-bundle.pl
@@ -43,21 +43,16 @@ use Text::Wrap;
 use Time::Local;
 my $MOD_SHA = "Digest::SHA";
 eval "require $MOD_SHA";
-if ($@) {
-  $MOD_SHA = "Digest::SHA::PurePerl";
-  eval "require $MOD_SHA";
+if($@) {
+    $MOD_SHA = "Digest::SHA::PurePerl";
+    eval "require $MOD_SHA";
 }
 eval "require LWP::UserAgent";
 
 my %urls = (
-  'nss' =>
-    'https://hg.mozilla.org/projects/nss/raw-file/default/lib/ckfw/builtins/certdata.txt',
-  'central' =>
-    'https://hg.mozilla.org/mozilla-central/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt',
-  'beta' =>
-    'https://hg.mozilla.org/releases/mozilla-beta/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt',
-  'release' =>
-    'https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt',
+    'autoland' => 'https://raw.githubusercontent.com/mozilla-firefox/firefox/refs/heads/autoland/security/nss/lib/ckfw/builtins/certdata.txt',
+    'beta'     => 'https://raw.githubusercontent.com/mozilla-firefox/firefox/refs/heads/beta/security/nss/lib/ckfw/builtins/certdata.txt',
+    'release'  => 'https://raw.githubusercontent.com/mozilla-firefox/firefox/refs/heads/release/security/nss/lib/ckfw/builtins/certdata.txt',
 );
 
 $opt_d = 'release';
@@ -65,7 +60,7 @@ $opt_d = 'release';
 # If the OpenSSL commandline is not in search path you can configure it here!
 my $openssl = 'openssl';
 
-my $version = '1.29';
+my $version = '1.33';
 
 $opt_w = 76; # default base64 encoded lines length
 
@@ -76,43 +71,41 @@ my $default_mozilla_trust_levels = "TRUSTED_DELEGATOR";
 $opt_p = $default_mozilla_trust_purposes . ":" . $default_mozilla_trust_levels;
 
 my @valid_mozilla_trust_purposes = (
-  "DIGITAL_SIGNATURE",
-  "NON_REPUDIATION",
-  "KEY_ENCIPHERMENT",
-  "DATA_ENCIPHERMENT",
-  "KEY_AGREEMENT",
-  "KEY_CERT_SIGN",
-  "CRL_SIGN",
-  "SERVER_AUTH",
-  "CLIENT_AUTH",
-  "CODE_SIGNING",
-  "EMAIL_PROTECTION",
-  "IPSEC_END_SYSTEM",
-  "IPSEC_TUNNEL",
-  "IPSEC_USER",
-  "TIME_STAMPING",
-  "STEP_UP_APPROVED"
+    "DIGITAL_SIGNATURE",
+    "NON_REPUDIATION",
+    "KEY_ENCIPHERMENT",
+    "DATA_ENCIPHERMENT",
+    "KEY_AGREEMENT",
+    "KEY_CERT_SIGN",
+    "CRL_SIGN",
+    "SERVER_AUTH",
+    "CLIENT_AUTH",
+    "CODE_SIGNING",
+    "EMAIL_PROTECTION",
+    "IPSEC_END_SYSTEM",
+    "IPSEC_TUNNEL",
+    "IPSEC_USER",
+    "TIME_STAMPING",
+    "STEP_UP_APPROVED"
 );
 
 my @valid_mozilla_trust_levels = (
-  "TRUSTED_DELEGATOR",    # CAs
-  "NOT_TRUSTED",          # Don't trust these certs.
-  "MUST_VERIFY_TRUST",    # This explicitly tells us that it ISN'T a CA but is
-                          # otherwise ok. In other words, this should tell the
-                          # app to ignore any other sources that claim this is
-                          # a CA.
-  "TRUSTED"               # This cert is trusted, but only for itself and not
-                          # for delegates (i.e. it is not a CA).
+    "TRUSTED_DELEGATOR",    # CAs
+    "NOT_TRUSTED",          # Do not trust these certs.
+    "MUST_VERIFY_TRUST",    # This explicitly tells us that it IS NOT a CA but is
+                            # otherwise ok. In other words, this should tell the
+                            # app to ignore any other sources that claim this is
+                            # a CA.
+    "TRUSTED"               # This cert is trusted, but only for itself and not
+                            # for delegates (i.e. it is not a CA).
 );
 
-my $default_signature_algorithms = $opt_s = "MD5";
+my $default_signature_algorithms = $opt_s = "SHA256";
 
 my @valid_signature_algorithms = (
-  "MD5",
-  "SHA1",
-  "SHA256",
-  "SHA384",
-  "SHA512"
+    "SHA256",
+    "SHA384",
+    "SHA512"
 );
 
 $0 =~ s@.*(/|\\)@@;
@@ -127,175 +120,176 @@ if(!defined($opt_d)) {
 # Use predefined URL or else custom URL specified on command line.
 my $url;
 if(defined($urls{$opt_d})) {
-  $url = $urls{$opt_d};
-  if(!$opt_k && $url !~ /^https:\/\//i) {
-    die "The URL for '$opt_d' is not HTTPS. Use -k to override (insecure).\n";
-  }
+    $url = $urls{$opt_d};
+    if(!$opt_k && $url !~ /^https:\/\//i) {
+        die "The URL for '$opt_d' is not HTTPS. Use -k to override (insecure).\n";
+    }
 }
 else {
   $url = $opt_d;
 }
 
-my $curl = `curl -V`;
-
-if ($opt_i) {
-  print ("=" x 78 . "\n");
-  print "Script Version                   : $version\n";
-  print "Perl Version                     : $]\n";
-  print "Operating System Name            : $^O\n";
-  print "Getopt::Std.pm Version           : ${Getopt::Std::VERSION}\n";
-  print "Encode::Encoding.pm Version      : ${Encode::Encoding::VERSION}\n";
-  print "MIME::Base64.pm Version          : ${MIME::Base64::VERSION}\n";
-  print "LWP::UserAgent.pm Version        : ${LWP::UserAgent::VERSION}\n" if($LWP::UserAgent::VERSION);
-  print "LWP.pm Version                   : ${LWP::VERSION}\n" if($LWP::VERSION);
-  print "Digest::SHA.pm Version           : ${Digest::SHA::VERSION}\n" if ($Digest::SHA::VERSION);
-  print "Digest::SHA::PurePerl.pm Version : ${Digest::SHA::PurePerl::VERSION}\n" if ($Digest::SHA::PurePerl::VERSION);
-  print ("=" x 78 . "\n");
+if($opt_i) {
+    print ("=" x 78 . "\n");
+    print "Script Version                   : $version\n";
+    print "Perl Version                     : $]\n";
+    print "Operating System Name            : $^O\n";
+    print "Getopt::Std.pm Version           : ${Getopt::Std::VERSION}\n";
+    print "Encode::Encoding.pm Version      : ${Encode::Encoding::VERSION}\n";
+    print "MIME::Base64.pm Version          : ${MIME::Base64::VERSION}\n";
+    print "LWP::UserAgent.pm Version        : ${LWP::UserAgent::VERSION}\n" if($LWP::UserAgent::VERSION);
+    print "LWP.pm Version                   : ${LWP::VERSION}\n" if($LWP::VERSION);
+    print "Digest::SHA.pm Version           : ${Digest::SHA::VERSION}\n" if($Digest::SHA::VERSION);
+    print "Digest::SHA::PurePerl.pm Version : ${Digest::SHA::PurePerl::VERSION}\n" if($Digest::SHA::PurePerl::VERSION);
+    print ("=" x 78 . "\n");
 }
 
 sub warning_message() {
-  if ( $opt_d =~ m/^risk$/i ) { # Long Form Warning and Exit
-    print "Warning: Use of this script may pose some risk:\n";
-    print "\n";
-    print "  1) If you use HTTP URLs they are subject to a man in the middle attack\n";
-    print "  2) Default to 'release', but more recent updates may be found in other trees\n";
-    print "  3) certdata.txt file format may change, lag time to update this script\n";
-    print "  4) Generally unwise to blindly trust CAs without manual review & verification\n";
-    print "  5) Mozilla apps use additional security checks aren't represented in certdata\n";
-    print "  6) Use of this script will make a security engineer grind his teeth and\n";
-    print "     swear at you.  ;)\n";
-    exit;
-  } else { # Short Form Warning
-    print "Warning: Use of this script may pose some risk, -d risk for more details.\n";
-  }
+    if($opt_d =~ m/^risk$/i) { # Long Form Warning and Exit
+        print "Warning: Use of this script may pose some risk:\n";
+        print "\n";
+        print "  1. If you use HTTP URLs they are subject to a man in the middle attack\n";
+        print "  2. Default to 'release', but more recent updates may be found in other trees\n";
+        print "  3. certdata.txt file format may change, lag time to update this script\n";
+        print "  4. Generally unwise to blindly trust CAs without manual review & verification\n";
+        print "  5. Mozilla apps use additional security checks are not represented in certdata\n";
+        print "  6. Use of this script makes a security engineer grind his teeth and\n";
+        print "     swear at you.  ;)\n";
+        exit;
+    } else { # Short Form Warning
+        print "Warning: Use of this script may pose some risk, -d risk for more details.\n";
+    }
 }
 
 sub HELP_MESSAGE() {
-  print "Usage:\t${0} [-b] [-d<certdata>] [-f] [-i] [-k] [-l] [-n] [-p<purposes:levels>] [-q] [-s<algorithms>] [-t] [-u] [-v] [-w<l>] [<outputfile>]\n";
-  print "\t-b\tbackup an existing version of ca-bundle.crt\n";
-  print "\t-d\tspecify Mozilla tree to pull certdata.txt or custom URL\n";
-  print "\t\t  Valid names are:\n";
-  print "\t\t    ", join( ", ", map { ( $_ =~ m/$opt_d/ ) ? "$_ (default)" : "$_" } sort keys %urls ), "\n";
-  print "\t-f\tforce rebuild even if certdata.txt is current\n";
-  print "\t-i\tprint version info about used modules\n";
-  print "\t-k\tallow URLs other than HTTPS, enable HTTP fallback (insecure)\n";
-  print "\t-l\tprint license info about certdata.txt\n";
-  print "\t-m\tinclude meta data in output\n";
-  print "\t-n\tno download of certdata.txt (to use existing)\n";
-  print wrap("\t","\t\t", "-p\tlist of Mozilla trust purposes and levels for certificates to include in output. Takes the form of a comma separated list of purposes, a colon, and a comma separated list of levels. (default: $default_mozilla_trust_purposes:$default_mozilla_trust_levels)"), "\n";
-  print "\t\t  Valid purposes are:\n";
-  print wrap("\t\t    ","\t\t    ", join( ", ", "ALL", @valid_mozilla_trust_purposes ) ), "\n";
-  print "\t\t  Valid levels are:\n";
-  print wrap("\t\t    ","\t\t    ", join( ", ", "ALL", @valid_mozilla_trust_levels ) ), "\n";
-  print "\t-q\tbe really quiet (no progress output at all)\n";
-  print wrap("\t","\t\t", "-s\tcomma separated list of certificate signatures/hashes to output in plain text mode. (default: $default_signature_algorithms)\n");
-  print "\t\t  Valid signature algorithms are:\n";
-  print wrap("\t\t    ","\t\t    ", join( ", ", "ALL", @valid_signature_algorithms ) ), "\n";
-  print "\t-t\tinclude plain text listing of certificates\n";
-  print "\t-u\tunlink (remove) certdata.txt after processing\n";
-  print "\t-v\tbe verbose and print out processed CAs\n";
-  print "\t-w <l>\twrap base64 output lines after <l> chars (default: ${opt_w})\n";
-  exit;
+    print "Usage:\t${0} [-b] [-d<certdata>] [-f] [-i] [-k] [-l] [-n] [-p<purposes:levels>] [-q] [-s<algorithms>] [-t] [-u] [-v] [-w<l>] [<outputfile>]\n";
+    print "\t-b\tbackup an existing version of ca-bundle.crt\n";
+    print "\t-d\tspecify Mozilla tree to pull certdata.txt or custom URL\n";
+    print "\t\t  Valid names are:\n";
+    print "\t\t    ", join(", ", map { ($_ =~ m/$opt_d/) ? "$_ (default)" : $_ } sort keys %urls), "\n";
+    print "\t-f\tforce rebuild even if certdata.txt is current\n";
+    print "\t-i\tprint version info about used modules\n";
+    print "\t-k\tallow URLs other than HTTPS, enable HTTP fallback (insecure)\n";
+    print "\t-l\tprint license info about certdata.txt\n";
+    print "\t-m\tinclude meta data in output\n";
+    print "\t-n\tno download of certdata.txt (to use existing)\n";
+    print wrap("\t","\t\t", "-p\tlist of Mozilla trust purposes and levels for certificates to include in output. " .
+          "Takes the form of a comma separated list of purposes, a colon, and a comma separated list of levels. " .
+          "(default: $default_mozilla_trust_purposes:$default_mozilla_trust_levels)"), "\n";
+    print "\t\t  Valid purposes are:\n";
+    print wrap("\t\t    ","\t\t    ", join(", ", "ALL", @valid_mozilla_trust_purposes)), "\n";
+    print "\t\t  Valid levels are:\n";
+    print wrap("\t\t    ","\t\t    ", join(", ", "ALL", @valid_mozilla_trust_levels)), "\n";
+    print "\t-q\tbe really quiet (no progress output at all)\n";
+    print wrap("\t","\t\t", "-s\tcomma separated list of certificate signatures/hashes to output in plain text mode. (default: $default_signature_algorithms)\n");
+    print "\t\t  Valid signature algorithms are:\n";
+    print wrap("\t\t    ","\t\t    ", join(", ", "ALL", @valid_signature_algorithms)), "\n";
+    print "\t-t\tinclude plain text listing of certificates\n";
+    print "\t-u\tunlink (remove) certdata.txt after processing\n";
+    print "\t-v\tbe verbose and print out processed CAs\n";
+    print "\t-w <l>\twrap base64 output lines after <l> chars (default: ${opt_w})\n";
+    exit;
 }
 
 sub VERSION_MESSAGE() {
-  print "${0} version ${version} running Perl ${]} on ${^O}\n";
+    print "${0} version ${version} running Perl ${]} on ${^O}\n";
 }
 
-warning_message() unless ($opt_q || $url =~ m/^(ht|f)tps:/i );
-HELP_MESSAGE() if ($opt_h);
+warning_message() unless ($opt_q || $url =~ m/^(ht|f)tps:/i);
+HELP_MESSAGE() if($opt_h);
 
 sub report($@) {
-  my $output = shift;
+    my $output = shift;
 
-  print STDERR $output . "\n" unless $opt_q;
+    print STDERR $output . "\n" unless $opt_q;
 }
 
 sub is_in_list($@) {
-  my $target = shift;
+    my $target = shift;
 
-  return defined(List::Util::first { $target eq $_ } @_);
+    return defined(List::Util::first { $target eq $_ } @_);
 }
 
 # Parses $param_string as a case insensitive comma separated list with optional
 # whitespace validates that only allowed parameters are supplied
 sub parse_csv_param($$@) {
-  my $description = shift;
-  my $param_string = shift;
-  my @valid_values = @_;
+    my $description = shift;
+    my $param_string = shift;
+    my @valid_values = @_;
 
-  my @values = map {
-    s/^\s+//;  # strip leading spaces
-    s/\s+$//;  # strip trailing spaces
-    uc $_      # return the modified string as upper case
-  } split( ',', $param_string );
+    my @values = map {
+        s/^\s+//;  # strip leading spaces
+        s/\s+$//;  # strip trailing spaces
+        uc $_      # return the modified string as upper case
+    } split(',', $param_string);
 
-  # Find all values which are not in the list of valid values or "ALL"
-  my @invalid = grep { !is_in_list($_,"ALL",@valid_values) } @values;
+    # Find all values which are not in the list of valid values or "ALL"
+    my @invalid = grep { !is_in_list($_,"ALL",@valid_values) } @values;
 
-  if ( scalar(@invalid) > 0 ) {
-    # Tell the user which parameters were invalid and print the standard help
-    # message which will exit
-    print "Error: Invalid ", $description, scalar(@invalid) == 1 ? ": " : "s: ", join( ", ", map { "\"$_\"" } @invalid ), "\n";
-    HELP_MESSAGE();
-  }
+    if(scalar(@invalid) > 0) {
+        # Tell the user which parameters were invalid and print the standard help
+        # message which also exits
+        print "Error: Invalid ", $description, scalar(@invalid) == 1 ? ": " : "s: ", join(", ", map { "\"$_\"" } @invalid), "\n";
+        HELP_MESSAGE();
+    }
 
-  @values = @valid_values if ( is_in_list("ALL",@values) );
+    @values = @valid_values if(is_in_list("ALL",@values));
 
-  return @values;
+    return @values;
 }
 
 sub sha256 {
-  my $result;
-  if ($Digest::SHA::VERSION || $Digest::SHA::PurePerl::VERSION) {
-    open(FILE, $_[0]) or die "Can't open '$_[0]': $!";
-    binmode(FILE);
-    $result = $MOD_SHA->new(256)->addfile(*FILE)->hexdigest;
-    close(FILE);
-  } else {
-    # Use OpenSSL command if Perl Digest::SHA modules not available
-    $result = `"$openssl" dgst -r -sha256 "$_[0]"`;
-    $result =~ s/^([0-9a-f]{64}) .+/$1/is;
-  }
-  return $result;
+    my $result;
+    if($Digest::SHA::VERSION || $Digest::SHA::PurePerl::VERSION) {
+        open(FILE, $_[0]) or die "Could not open '$_[0]': $!";
+        binmode(FILE);
+        $result = $MOD_SHA->new(256)->addfile(*FILE)->hexdigest;
+        close(FILE);
+    } else {
+        # Use OpenSSL command if Perl Digest::SHA modules not available
+        open(my $fh, '-|', $openssl, 'dgst', '-r', '-sha256', $_[0]) or die "Failed running openssl on '$_[0]': $!";
+        $result = <$fh>;  # read first line
+        close $fh;
+        $result =~ s/^([0-9a-f]{64}) .+/$1/is;
+    }
+    return $result;
 }
 
-
 sub oldhash {
-  my $hash = "";
-  open(C, "<$_[0]") || return 0;
-  while(<C>) {
-    chomp;
-    if($_ =~ /^\#\# SHA256: (.*)/) {
-      $hash = $1;
-      last;
+    my $hash = "";
+    open(C, "<$_[0]") or return 0;
+    while(<C>) {
+        chomp;
+        if($_ =~ /^\#\# SHA256: (.*)/) {
+            $hash = $1;
+            last;
+        }
     }
-  }
-  close(C);
-  return $hash;
+    close(C);
+    return $hash;
 }
 
-if ( $opt_p !~ m/:/ ) {
-  print "Error: Mozilla trust identifier list must include both purposes and levels\n";
-  HELP_MESSAGE();
+if($opt_p !~ m/:/) {
+    print "Error: Mozilla trust identifier list must include both purposes and levels\n";
+    HELP_MESSAGE();
 }
 
-(my $included_mozilla_trust_purposes_string, my $included_mozilla_trust_levels_string) = split( ':', $opt_p );
-my @included_mozilla_trust_purposes = parse_csv_param( "trust purpose", $included_mozilla_trust_purposes_string, @valid_mozilla_trust_purposes );
-my @included_mozilla_trust_levels = parse_csv_param( "trust level", $included_mozilla_trust_levels_string, @valid_mozilla_trust_levels );
+(my $included_mozilla_trust_purposes_string, my $included_mozilla_trust_levels_string) = split(':', $opt_p);
+my @included_mozilla_trust_purposes = parse_csv_param("trust purpose", $included_mozilla_trust_purposes_string, @valid_mozilla_trust_purposes);
+my @included_mozilla_trust_levels = parse_csv_param("trust level", $included_mozilla_trust_levels_string, @valid_mozilla_trust_levels);
 
-my @included_signature_algorithms = parse_csv_param( "signature algorithm", $opt_s, @valid_signature_algorithms );
+my @included_signature_algorithms = parse_csv_param("signature algorithm", $opt_s, @valid_signature_algorithms);
 
 sub should_output_cert(%) {
-  my %trust_purposes_by_level = @_;
+    my %trust_purposes_by_level = @_;
 
-  foreach my $level (@included_mozilla_trust_levels) {
-    # for each level we want to output, see if any of our desired purposes are
-    # included
-    return 1 if ( defined( List::Util::first { is_in_list( $_, @included_mozilla_trust_purposes ) } @{$trust_purposes_by_level{$level}} ) );
-  }
+    foreach my $level (@included_mozilla_trust_levels) {
+        # for each level we want to output, see if any of our desired purposes are
+        # included
+        return 1 if(defined(List::Util::first { is_in_list($_, @included_mozilla_trust_purposes) } @{$trust_purposes_by_level{$level}}));
+    }
 
-  return 0;
+    return 0;
 }
 
 my $crt = $ARGV[0] || 'ca-bundle.crt';
@@ -310,68 +304,76 @@ my $oldhash = oldhash($crt);
 report "SHA256 of old file: $oldhash";
 
 if(!$opt_n) {
-  report "Downloading $txt ...";
+    report "Using URL: $url";
+    report "Downloading $txt ...";
 
-  # If we have an HTTPS URL then use curl
-  if($url =~ /^https:\/\//i) {
-    if($curl) {
-      if($curl =~ /^Protocols:.* https( |$)/m) {
-        report "Get certdata with curl!";
-        my $proto = !$opt_k ? "--proto =https" : "";
-        my $quiet = $opt_q ? "-s" : "";
-        my @out = `curl -w %{response_code} $proto $quiet -o "$txt" "$url"`;
-        if(!$? && @out && $out[0] == 200) {
-          $fetched = 1;
-          report "Downloaded $txt";
+    # If we have an HTTPS URL then use curl
+    if($url =~ /^https:\/\//i) {
+        my $curl = qx(curl -V);
+        if($curl) {
+            if($curl =~ /^Protocols:.* https( |$)/m) {
+                report "Get certdata with curl!";
+                my @opts = ();
+                push @opts, '--proto', '=https' if !$opt_k;
+                push @opts, '-s' if $opt_q;
+                my $out = '';
+                if(open(my $fh, '-|', 'curl', '-Lw', '%{response_code}', (@opts), '-o', $txt, $url)) {
+                    $out = <$fh>;  # read first line
+                    chomp $out;
+                    close $fh;
+                }
+                if($out && $out == 200) {
+                    $fetched = 1;
+                    report "Downloaded $txt";
+                }
+                else {
+                    report "Failed downloading via HTTPS with curl";
+                    if(-e $txt && !unlink($txt)) {
+                        report "Failed to remove '$txt': $!";
+                    }
+                }
+            }
+            else {
+                report "curl lacks https support";
+            }
         }
         else {
-          report "Failed downloading via HTTPS with curl";
-          if(-e $txt && !unlink($txt)) {
-            report "Failed to remove '$txt': $!";
-          }
+            report "curl not found";
         }
-      }
-      else {
-        report "curl lacks https support";
-      }
     }
-    else {
-      report "curl not found";
-    }
-  }
 
-  # If nothing was fetched then use LWP
-  if(!$fetched) {
-    if($url =~ /^https:\/\//i) {
-      report "Falling back to HTTP";
-      $url =~ s/^https:\/\//http:\/\//i;
+    # If nothing was fetched then use LWP
+    if(!$fetched) {
+        if($url =~ /^https:\/\//i) {
+            report "Falling back to HTTP";
+            $url =~ s/^https:\/\//http:\/\//i;
+        }
+        if(!$opt_k) {
+            report "URLs other than HTTPS are disabled by default, to enable use -k";
+            exit 1;
+        }
+        report "Get certdata with LWP!";
+        if(!defined(${LWP::UserAgent::VERSION})) {
+            report "LWP is not available (LWP::UserAgent not found)";
+            exit 1;
+        }
+        my $ua = new LWP::UserAgent(agent => "$0/$version");
+        $ua->env_proxy();
+        $resp = $ua->mirror($url, $txt);
+        if($resp && $resp->code eq '304') {
+            report "Not modified";
+            exit 0 if -e $crt && !$opt_f;
+        }
+        else {
+            $fetched = 1;
+            report "Downloaded $txt";
+        }
+        if(!$resp || $resp->code !~ /^(?:200|304)$/) {
+            report "Unable to download latest data: "
+              . ($resp? $resp->code . ' - ' . $resp->message : "LWP failed");
+            exit 1 if -e $crt || ! -r $txt;
+        }
     }
-    if(!$opt_k) {
-      report "URLs other than HTTPS are disabled by default, to enable use -k";
-      exit 1;
-    }
-    report "Get certdata with LWP!";
-    if(!defined(${LWP::UserAgent::VERSION})) {
-      report "LWP is not available (LWP::UserAgent not found)";
-      exit 1;
-    }
-    my $ua  = new LWP::UserAgent(agent => "$0/$version");
-    $ua->env_proxy();
-    $resp = $ua->mirror($url, $txt);
-    if($resp && $resp->code eq '304') {
-      report "Not modified";
-      exit 0 if -e $crt && !$opt_f;
-    }
-    else {
-      $fetched = 1;
-      report "Downloaded $txt";
-    }
-    if(!$resp || $resp->code !~ /^(?:200|304)$/) {
-      report "Unable to download latest data: "
-        . ($resp? $resp->code . ' - ' . $resp->message : "LWP failed");
-      exit 1 if -e $crt || ! -r $txt;
-    }
-  }
 }
 
 my $filedate = $resp ? $resp->last_modified : (stat($txt))[9];
@@ -379,11 +381,11 @@ my $datesrc = "as of";
 if(!$filedate) {
     # mxr.mozilla.org gave us a time, hg.mozilla.org does not!
     $filedate = time();
-    $datesrc="downloaded on";
+    $datesrc = "downloaded on";
 }
 
 # get the hash from the download file
-my $newhash= sha256($txt);
+my $newhash = sha256($txt);
 
 if(!$opt_f && $oldhash eq $newhash) {
     report "Downloaded file identical to previous run\'s source file. Exiting";
@@ -398,10 +400,10 @@ report "SHA256 of new file: $newhash";
 my $currentdate = scalar gmtime($filedate);
 
 my $format = $opt_t ? "plain text and " : "";
-if( $stdout ) {
-    open(CRT, '> -') or die "Couldn't open STDOUT: $!\n";
+if($stdout) {
+    open(CRT, '> -') or die "Could not open STDOUT: $!\n";
 } else {
-    open(CRT,">$crt.~") or die "Couldn't open $crt.~: $!\n";
+    open(CRT,">$crt.~") or die "Could not open $crt.~: $!\n";
 }
 print CRT <<EOT;
 ##
@@ -409,6 +411,8 @@ print CRT <<EOT;
 ##
 ## Certificate data from Mozilla ${datesrc}: ${currentdate} GMT
 ##
+## Find updated versions here: https://curl.se/docs/caextract.html
+##
 ## This is a bundle of X.509 certificates of public Certificate Authorities
 ## (CA). These were automatically extracted from Mozilla's root certificates
 ## file (certdata.txt).  This file can be found in the mozilla source tree:
@@ -417,7 +421,7 @@ print CRT <<EOT;
 ## It contains the certificates in ${format}PEM format and therefore
 ## can be directly used with curl / libcurl / php_curl, or with
 ## an Apache+mod_ssl webserver for SSL client authentication.
-## Just configure this file as the SSLCACertificateFile.
+## Configure this file as the SSLCACertificateFile.
 ##
 ## Conversion done with mk-ca-bundle.pl version $version.
 ## SHA256: $newhash
@@ -425,7 +429,7 @@ print CRT <<EOT;
 
 EOT
 
-report "Processing  '$txt' ...";
+report "Processing '$txt' ...";
 my $caname;
 my $certnum = 0;
 my $skipnum = 0;
@@ -438,276 +442,235 @@ my @precert;
 my $cka_value;
 my $valid = 0;
 
-open(TXT,"$txt") or die "Couldn't open $txt: $!\n";
-while (<TXT>) {
-  if (/\*\*\*\*\* BEGIN LICENSE BLOCK \*\*\*\*\*/) {
-    print CRT;
-    print if ($opt_l);
-    while (<TXT>) {
-      print CRT;
-      print if ($opt_l);
-      last if (/\*\*\*\*\* END LICENSE BLOCK \*\*\*\*\*/);
-    }
-    next;
-  }
-  # The input file format consists of blocks of Mozilla objects.
-  # The blocks are separated by blank lines but may be related.
-  elsif(/^\s*$/) {
-    $main_block = 0;
-    $trust_block = 0;
-    next;
-  }
-  # Each certificate has a main block.
-  elsif(/^# Certificate "(.*)"/) {
-    (!$main_block && !$trust_block) or die "Unexpected certificate block";
-    $main_block = 1;
-    $main_block_name = $1;
-    # Reset all other certificate variables.
-    $trust_block = 0;
-    $trust_block_name = "";
-    $valid = 0;
-    $start_of_cert = 0;
-    $caname = "";
-    $cka_value = "";
-    undef @precert;
-    next;
-  }
-  # Each certificate's main block is followed by a trust block.
-  elsif(/^# Trust for (?:Certificate )?"(.*)"/) {
-    (!$main_block && !$trust_block) or die "Unexpected trust block";
-    $trust_block = 1;
-    $trust_block_name = $1;
-    if($main_block_name ne $trust_block_name) {
-      die "cert name \"$main_block_name\" != trust name \"$trust_block_name\"";
-    }
-    next;
-  }
-  # Ignore other blocks.
-  #
-  # There is a documentation comment block, a BEGINDATA block, and a bunch of
-  # blocks starting with "# Explicitly Distrust <certname>".
-  #
-  # The latter is for certificates that have already been removed and are not
-  # included. Not all explicitly distrusted certificates are ignored at this
-  # point, just those without an actual certificate.
-  elsif(!$main_block && !$trust_block) {
-    next;
-  }
-  elsif(/^#/) {
-    # The commented lines in a main block are plaintext metadata that describes
-    # the certificate. Issuer, Subject, Fingerprint, etc.
-    if($main_block) {
-      push @precert, $_ if not /^#$/;
-      if(/^# Not Valid After : (.*)/) {
-        my $stamp = $1;
-        use Time::Piece;
-        # Not Valid After : Thu Sep 30 14:01:15 2021
-        my $t = Time::Piece->strptime($stamp, "%a %b %d %H:%M:%S %Y");
-        my $delta = ($t->epoch - time()); # negative means no longer valid
-        if($delta < 0) {
-          $skipnum++;
-          report "Skipping: $main_block_name is not valid anymore" if ($opt_v);
-          $valid = 0;
+open(TXT, $txt) or die "Could not open $txt: $!\n";
+while(<TXT>) {
+    if(/\*\*\*\*\* BEGIN LICENSE BLOCK \*\*\*\*\*/) {
+        print CRT;
+        print if($opt_l);
+        while(<TXT>) {
+            print CRT;
+            print if($opt_l);
+            last if(/\*\*\*\*\* END LICENSE BLOCK \*\*\*\*\*/);
         }
-        else {
-          $valid = 1;
-        }
-      }
+        next;
     }
-    next;
-  }
-  elsif(!$valid) {
-    next;
-  }
-
-  chomp;
-
-  if($main_block) {
-    if(/^CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE/) {
-      !$start_of_cert or die "Duplicate CKO_CERTIFICATE object";
-      $start_of_cert = 1;
-      next;
-    }
-    elsif(!$start_of_cert) {
-      next;
-    }
-    elsif(/^CKA_LABEL UTF8 \"(.*)\"/) {
-      ($caname eq "") or die "Duplicate CKA_LABEL attribute";
-      $caname = $1;
-      if($caname ne $main_block_name) {
-        die "caname \"$caname\" != cert name \"$main_block_name\"";
-      }
-      next;
-    }
-    elsif(/^CKA_VALUE MULTILINE_OCTAL/) {
-      ($cka_value eq "") or die "Duplicate CKA_VALUE attribute";
-      while (<TXT>) {
-        last if (/^END/);
-        chomp;
-        my @octets = split(/\\/);
-        shift @octets;
-        for (@octets) {
-          $cka_value .= chr(oct);
-        }
-      }
-      next;
-    }
-    elsif (/^CKA_NSS_SERVER_DISTRUST_AFTER (CK_BBOOL CK_FALSE|MULTILINE_OCTAL)/) {
-      # Example:
-      # CKA_NSS_SERVER_DISTRUST_AFTER MULTILINE_OCTAL
-      # \062\060\060\066\061\067\060\060\060\060\060\060\132
-      # END
-      if($1 eq "MULTILINE_OCTAL") {
-        my @timestamp;
-        while (<TXT>) {
-          last if (/^END/);
-          chomp;
-          my @octets = split(/\\/);
-          shift @octets;
-          for (@octets) {
-            push @timestamp, chr(oct);
-          }
-        }
-        scalar(@timestamp) == 13 or die "Failed parsing timestamp";
-        # A trailing Z in the timestamp signifies UTC
-        if($timestamp[12] ne "Z") {
-          report "distrust date stamp is not using UTC";
-        }
-        # Example date: 200617000000Z
-        # Means 2020-06-17 00:00:00 UTC
-        my $distrustat =
-          timegm($timestamp[10] . $timestamp[11], # second
-                 $timestamp[8] . $timestamp[9],   # minute
-                 $timestamp[6] . $timestamp[7],   # hour
-                 $timestamp[4] . $timestamp[5],   # day
-                 ($timestamp[2] . $timestamp[3]) - 1, # month
-                 "20" . $timestamp[0] . $timestamp[1]); # year
-        if(time >= $distrustat) {
-          # not trusted anymore
-          $skipnum++;
-          report "Skipping: $main_block_name is not trusted anymore" if ($opt_v);
-          $valid = 0;
-        }
-        else {
-          # still trusted
-        }
-      }
-      next;
-    }
-    else {
-      next;
-    }
-  }
-
-  if(!$trust_block || !$start_of_cert || $caname eq "" || $cka_value eq "") {
-    die "Certificate extraction failed";
-  }
-
-  my %trust_purposes_by_level;
-
-  if(/^CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST/) {
-    # now scan the trust part to determine how we should trust this cert
-    while (<TXT>) {
-      if(/^\s*$/) {
+    # The input file format consists of blocks of Mozilla objects.
+    # The blocks are separated by blank lines but may be related.
+    elsif(/^\s*$/) {
+        $main_block = 0;
         $trust_block = 0;
-        last;
-      }
-      if (/^CKA_TRUST_([A-Z_]+)\s+CK_TRUST\s+CKT_NSS_([A-Z_]+)\s*$/) {
-        if ( !is_in_list($1,@valid_mozilla_trust_purposes) ) {
-          report "Warning: Unrecognized trust purpose for cert: $caname. Trust purpose: $1. Trust Level: $2";
-        } elsif ( !is_in_list($2,@valid_mozilla_trust_levels) ) {
-          report "Warning: Unrecognized trust level for cert: $caname. Trust purpose: $1. Trust Level: $2";
-        } else {
-          push @{$trust_purposes_by_level{$2}}, $1;
-        }
-      }
+        next;
     }
-
-    # Sanity check that an explicitly distrusted certificate only has trust
-    # purposes with a trust level of NOT_TRUSTED.
+    # Each certificate has a main block.
+    elsif(/^# Certificate "(.*)"/) {
+        (!$main_block && !$trust_block) or die "Unexpected certificate block";
+        $main_block = 1;
+        $main_block_name = $1;
+        # Reset all other certificate variables.
+        $trust_block = 0;
+        $trust_block_name = "";
+        $valid = 0;
+        $start_of_cert = 0;
+        $caname = "";
+        $cka_value = "";
+        undef @precert;
+        next;
+    }
+    # Each certificate's main block is followed by a trust block.
+    elsif(/^# Trust for (?:Certificate )?"(.*)"/) {
+        (!$main_block && !$trust_block) or die "Unexpected trust block";
+        $trust_block = 1;
+        $trust_block_name = $1;
+        if($main_block_name ne $trust_block_name) {
+            die "cert name \"$main_block_name\" != trust name \"$trust_block_name\"";
+        }
+        next;
+    }
+    # Ignore other blocks.
     #
-    # Certificate objects that are explicitly distrusted are in a certificate
-    # block that starts # Certificate "Explicitly Distrust(ed) <certname>",
-    # where "Explicitly Distrust(ed) " was prepended to the original cert name.
-    if($caname =~ /distrust/i ||
-       $main_block_name =~ /distrust/i ||
-       $trust_block_name =~ /distrust/i) {
-      my @levels = keys %trust_purposes_by_level;
-      if(scalar(@levels) != 1 || $levels[0] ne "NOT_TRUSTED") {
-        die "\"$caname\" must have all trust purposes at level NOT_TRUSTED.";
-      }
+    # There is a documentation comment block, a BEGINDATA block, and a bunch of
+    # blocks starting with "# Explicitly Distrust <certname>".
+    #
+    # The latter is for certificates that have already been removed and are not
+    # included. Not all explicitly distrusted certificates are ignored at this
+    # point, only those without an actual certificate.
+    elsif(!$main_block && !$trust_block) {
+        next;
+    }
+    elsif(/^#/) {
+        # The commented lines in a main block are plaintext metadata that describes
+        # the certificate. Issuer, Subject, Fingerprint, etc.
+        if($main_block) {
+            push @precert, $_ if not /^#$/;
+            if(/^# Not Valid After : (.*)/) {
+                my $stamp = $1;
+                use Time::Piece;
+                # Not Valid After : Thu Sep 30 14:01:15 2021
+                my $t = Time::Piece->strptime($stamp, "%a %b %d %H:%M:%S %Y");
+                my $delta = ($t->epoch - time()); # negative means no longer valid
+                if($delta < 0) {
+                    $skipnum++;
+                    report "Skipping: $main_block_name is not valid anymore" if($opt_v);
+                    $valid = 0;
+                }
+                else {
+                    $valid = 1;
+                }
+            }
+        }
+        next;
+    }
+    elsif(!$valid) {
+        next;
     }
 
-    if ( !should_output_cert(%trust_purposes_by_level) ) {
-      $skipnum ++;
-      report "Skipping: $caname lacks acceptable trust level" if ($opt_v);
-    } else {
-      my $encoded = MIME::Base64::encode_base64($cka_value, '');
-      $encoded =~ s/(.{1,${opt_w}})/$1\n/g;
-      my $pem = "-----BEGIN CERTIFICATE-----\n"
-              . $encoded
-              . "-----END CERTIFICATE-----\n";
-      print CRT "\n$caname\n";
-      my $maxStringLength = length(decode('UTF-8', $caname, Encode::FB_CROAK | Encode::LEAVE_SRC));
-      print CRT ("=" x $maxStringLength . "\n");
-      if ($opt_t) {
-        foreach my $key (sort keys %trust_purposes_by_level) {
-           my $string = $key . ": " . join(", ", @{$trust_purposes_by_level{$key}});
-           print CRT $string . "\n";
+    chomp;
+
+    if($main_block) {
+        if(/^CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE/) {
+            !$start_of_cert or die "Duplicate CKO_CERTIFICATE object";
+            $start_of_cert = 1;
+            next;
         }
-      }
-      if($opt_m) {
-        print CRT for @precert;
-      }
-      if (!$opt_t) {
-        print CRT $pem;
-      } else {
-        my $pipe = "";
-        foreach my $hash (@included_signature_algorithms) {
-          $pipe = "|$openssl x509 -" . $hash . " -fingerprint -noout -inform PEM";
-          if (!$stdout) {
-            $pipe .= " >> $crt.~";
-            close(CRT) or die "Couldn't close $crt.~: $!";
-          }
-          open(TMP, $pipe) or die "Couldn't open openssl pipe: $!";
-          print TMP $pem;
-          close(TMP) or die "Couldn't close openssl pipe: $!";
-          if (!$stdout) {
-            open(CRT, ">>$crt.~") or die "Couldn't open $crt.~: $!";
-          }
+        elsif(!$start_of_cert) {
+            next;
         }
-        $pipe = "|$openssl x509 -text -inform PEM";
-        if (!$stdout) {
-          $pipe .= " >> $crt.~";
-          close(CRT) or die "Couldn't close $crt.~: $!";
+        elsif(/^CKA_LABEL UTF8 \"(.*)\"/) {
+            ($caname eq "") or die "Duplicate CKA_LABEL attribute";
+            $caname = $1;
+            if($caname ne $main_block_name) {
+                die "caname \"$caname\" != cert name \"$main_block_name\"";
+            }
+            next;
         }
-        open(TMP, $pipe) or die "Couldn't open openssl pipe: $!";
-        print TMP $pem;
-        close(TMP) or die "Couldn't close openssl pipe: $!";
-        if (!$stdout) {
-          open(CRT, ">>$crt.~") or die "Couldn't open $crt.~: $!";
+        elsif(/^CKA_VALUE MULTILINE_OCTAL/) {
+            ($cka_value eq "") or die "Duplicate CKA_VALUE attribute";
+            while(<TXT>) {
+                last if(/^END/);
+                chomp;
+                my @octets = split(/\\/);
+                shift @octets;
+                for(@octets) {
+                    $cka_value .= chr(oct);
+                }
+            }
+            next;
+        }
+        else {
+            next;
+        }
+    }
+
+    if(!$trust_block || !$start_of_cert || $caname eq "" || $cka_value eq "") {
+        die "Certificate extraction failed";
+    }
+
+    my %trust_purposes_by_level;
+
+    if(/^CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST/) {
+        # now scan the trust part to determine how we should trust this cert
+        while(<TXT>) {
+            if(/^\s*$/) {
+                $trust_block = 0;
+                last;
+            }
+            if(/^CKA_TRUST_([A-Z_]+)\s+CK_TRUST\s+CKT_NSS_([A-Z_]+)\s*$/) {
+                if(!is_in_list($1,@valid_mozilla_trust_purposes)) {
+                    report "Warning: Unrecognized trust purpose for cert: $caname. Trust purpose: $1. Trust Level: $2";
+                } elsif(!is_in_list($2,@valid_mozilla_trust_levels)) {
+                    report "Warning: Unrecognized trust level for cert: $caname. Trust purpose: $1. Trust Level: $2";
+                } else {
+                    push @{$trust_purposes_by_level{$2}}, $1;
+                }
+            }
+        }
+
+        # Sanity check that an explicitly distrusted certificate only has trust
+        # purposes with a trust level of NOT_TRUSTED.
+        #
+        # Certificate objects that are explicitly distrusted are in a certificate
+        # block that starts # Certificate "Explicitly Distrust(ed) <certname>",
+        # where "Explicitly Distrust(ed) " was prepended to the original cert name.
+        if($caname =~ /distrust/i ||
+             $main_block_name =~ /distrust/i ||
+             $trust_block_name =~ /distrust/i) {
+            my @levels = keys %trust_purposes_by_level;
+            if(scalar(@levels) != 1 || $levels[0] ne "NOT_TRUSTED") {
+                die "\"$caname\" must have all trust purposes at level NOT_TRUSTED.";
+            }
+        }
+
+        if(!should_output_cert(%trust_purposes_by_level)) {
+            $skipnum ++;
+            report "Skipping: $caname lacks acceptable trust level" if($opt_v);
+        } else {
+            my $encoded = MIME::Base64::encode_base64($cka_value, '');
+            $encoded =~ s/(.{1,${opt_w}})/$1\n/g;
+            my $pem = "-----BEGIN CERTIFICATE-----\n"
+                    . $encoded
+                    . "-----END CERTIFICATE-----\n";
+            print CRT "\n$caname\n";
+            my $maxStringLength = length(decode('UTF-8', $caname, Encode::FB_CROAK | Encode::LEAVE_SRC));
+            print CRT ("=" x $maxStringLength . "\n");
+            if($opt_t) {
+                foreach my $key (sort keys %trust_purposes_by_level) {
+                    my $string = $key . ": " . join(", ", @{$trust_purposes_by_level{$key}});
+                    print CRT $string . "\n";
+                }
+            }
+            if($opt_m) {
+                print CRT for @precert;
+            }
+            if(!$opt_t) {
+                print CRT $pem;
+            } else {
+                my $pipe = "";
+                foreach my $hash (@included_signature_algorithms) {
+                    $pipe = "|$openssl x509 -" . $hash . " -fingerprint -noout -inform PEM";
+                    if(!$stdout) {
+                        $pipe .= " >> $crt.~";
+                        close(CRT) or die "Could not close $crt.~: $!";
+                    }
+                    open(TMP, $pipe) or die "Could not open openssl pipe: $!";
+                    print TMP $pem;
+                    close(TMP) or die "Could not close openssl pipe: $!";
+                    if(!$stdout) {
+                        open(CRT, ">>$crt.~") or die "Could not open $crt.~: $!";
+                    }
+                }
+                $pipe = "|$openssl x509 -text -inform PEM";
+                if(!$stdout) {
+                    $pipe .= " >> $crt.~";
+                    close(CRT) or die "Could not close $crt.~: $!";
+                }
+                open(TMP, $pipe) or die "Could not open openssl pipe: $!";
+                print TMP $pem;
+                close(TMP) or die "Could not close openssl pipe: $!";
+                if(!$stdout) {
+                    open(CRT, ">>$crt.~") or die "Could not open $crt.~: $!";
+                }
+            }
+            report "Processed: $caname" if($opt_v);
+            $certnum++;
         }
-      }
-      report "Processed: $caname" if ($opt_v);
-      $certnum ++;
     }
-  }
 }
-close(TXT) or die "Couldn't close $txt: $!\n";
-close(CRT) or die "Couldn't close $crt.~: $!\n";
-unless( $stdout ) {
-    if ($opt_b && -e $crt) {
+close(TXT) or die "Could not close $txt: $!\n";
+close(CRT) or die "Could not close $crt.~: $!\n";
+utime($filedate, $filedate, "$crt.~");
+unless($stdout) {
+    if($opt_b && -e $crt) {
         my $bk = 1;
-        while (-e "$crt.~${bk}~") {
+        while(-e "$crt.~${bk}~") {
             $bk++;
         }
         rename $crt, "$crt.~${bk}~" or die "Failed to create backup $crt.~$bk}~: $!\n";
-    } elsif( -e $crt ) {
-        unlink( $crt ) or die "Failed to remove $crt: $!\n";
+    } elsif(-e $crt) {
+        unlink($crt) or die "Failed to remove $crt: $!\n";
     }
     rename "$crt.~", $crt or die "Failed to rename $crt.~ to $crt: $!\n";
 }
 if($opt_u && -e $txt && !unlink($txt)) {
-  report "Failed to remove $txt: $!\n";
+    report "Failed to remove $txt: $!\n";
 }
 report "Done ($certnum CA certs processed, $skipnum skipped).";
diff --git a/third-party/curl/scripts/mk-unity.pl b/third-party/curl/scripts/mk-unity.pl
new file mode 100644
index 0000000000..41354c15d1
--- /dev/null
+++ b/third-party/curl/scripts/mk-unity.pl
@@ -0,0 +1,115 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Viktor Szakats
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+# Helper script for "unity"-like support in autotools and to bundle up tests
+# for both autotools and cmake. It generates the umbrella C source that
+# includes the individual source files and tests.
+
+use strict;
+use warnings;
+
+if(!@ARGV) {
+    die "Usage: $0 [--concat [-I<incdir>]] [--test <tests>] [--include <include-c-sources>]\n";
+}
+
+my @src;
+my %include;
+my $in_include = 0;
+my $any_test = 0;
+my $concat = 0;
+my @incpath;
+foreach my $src (@ARGV) {
+    if($src eq "--concat") {
+        $concat = 1;
+    }
+    elsif($src =~ "^-I") {
+        push @incpath, substr($src, 2);
+    }
+    elsif($src eq "--test") {
+        $in_include = 0;
+    }
+    elsif($src eq "--include") {
+        $in_include = 1;
+    }
+    elsif($in_include) {
+        $include{$src} = 1;
+        push @src, $src;
+    }
+    else {
+        push @src, $src;
+        $any_test = 1;
+    }
+}
+
+sub include($@) {
+    my $filename = shift;
+    if($concat && $filename =~ /([a-z0-9_]+)\.c$/) {
+        if(! -f $filename) {
+            foreach my $path (@incpath) {
+                my $fullfn = $path . "/" . $filename;
+                if(-f $fullfn) {
+                    $filename = $fullfn;
+                    last;
+                }
+            }
+        }
+        open(my $fh, '<', $filename) or die "Cannot open '$filename': $!";
+        my $content = do { local $/; <$fh> };
+        close $fh;
+        print "#line 1 \"$filename\"\n$content\n";
+    }
+    else {
+        print "#include \"$filename\"\n";
+    }
+}
+
+print "/* !checksrc! disable COPYRIGHT all */\n\n";
+if($any_test) {
+    if($concat) {
+        print "/* NOLINTBEGIN(readability-duplicate-include) */\n\n";
+    }
+    include("first.h");
+    print "\n";
+}
+
+my $tlist = "";
+
+foreach my $src (@src) {
+    if($src =~ /([a-z0-9_]+)\.c$/) {
+        my $name = $1;
+        include($src);
+        if(not exists $include{$src}) {  # register test entry function
+            $tlist .= "  {\"$name\", test_$name},\n";
+        }
+    }
+}
+
+if($any_test) {
+    print "\nconst struct entry_s s_entries[] = {\n$tlist  {NULL, NULL}\n};\n\n";
+    include("first.c");
+    if($concat) {
+        print "/* NOLINTEND(readability-duplicate-include) */\n";
+    }
+}
diff --git a/third-party/curl/scripts/nroff2cd b/third-party/curl/scripts/nroff2cd
new file mode 100644
index 0000000000..374b0cbdab
--- /dev/null
+++ b/third-party/curl/scripts/nroff2cd
@@ -0,0 +1,197 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+=begin comment
+
+This script converts an nroff file to curldown
+
+Example: cd2nroff [options] <file.md> > <file.3>
+
+Note: when converting .nf sections, this tool does not know if the
+section is code or regular quotes. It then assumes and uses ~~~c
+for code.
+
+=end comment
+=cut
+
+use strict;
+use warnings;
+
+my $nroff2cd = "0.1"; # to keep check
+
+sub single {
+    my ($f) = @_;
+    open(F, "<:crlf", $f) or
+        return 1;
+    my $line;
+    my $title;
+    my $section;
+    my $source;
+    my @seealso;
+    my @desc;
+    my $header; # non-zero when TH is passed
+    my $quote = 0; # quote state
+    while(<F>) {
+        $line++;
+        my $d = $_;
+        if($_ =~ /^.\\\"/) {
+            # a comment we can ignore
+            next;
+        }
+        if(!$header) {
+            if($d =~ /.so (.*)/) {
+                # this is basically an include, so do that
+                my $f = $1;
+                # remove leading directory
+                $f =~ s/(.*?\/)//;
+                close(F);
+                open(F, "<:crlf", $f) or return 1;
+            }
+            if($d =~ /^\.TH ([^ ]*) (\d) \"(.*?)\" ([^ \n]*)/) {
+                # header, this needs to be the first thing after leading comments
+                $title = $1;
+                $section = $2;
+                # date is $3
+                $source = $4;
+                # if there are enclosing quotes around source, remove them
+                $source =~ s/[\"\'](.*)[\"\']\z/$1/;
+                $header = 1;
+
+            print <<HEAD
+---
+c: Copyright (C) Daniel Stenberg, <daniel\@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: $title
+Section: $section
+Source: $source
+HEAD
+                ;
+            }
+            next;
+        }
+
+        if($quote) {
+            if($d =~ /^\.SH/) {
+                #end of quote without an .fi
+                $quote = 0;
+                push @desc, "~~~\n";
+            }
+            elsif($d =~ /^\.fi/) {
+                #end of quote
+                $quote = 0;
+                push @desc, "~~~\n";
+                next;
+            }
+            else {
+                # double-backslashes converted to single ones
+                $d =~ s/\\\\/\\/g;
+                push @desc, $d;
+                next;
+            }
+        }
+        if($d =~ /^\.SH (.*)/) {
+            my $word = $1;
+            # if there are enclosing quotes, remove them first
+            $word =~ s/[\"\'](.*)[\"\']\z/$1/;
+            if($word eq "SEE ALSO") {
+                # we slurp up this section
+                next;
+            }
+            push @desc, "\n# $word\n\n";
+        }
+        elsif($d =~ /^\.(RS|RE)/) {
+            # ignore these
+        }
+        elsif($d =~ /^\.IP (.*)/) {
+            my $word = $1;
+            # if there are enclosing quotes, remove them first
+            $word =~ s/[\"\'](.*)[\"\']\z/$1/;
+            push @desc, "\n## $word\n\n";
+        }
+        elsif($d =~ /^\.IP/) {
+            # .IP with no text we skip
+        }
+        elsif($d =~ /^\.BR (.*)/) {
+            # only used for SEE ALSO
+            my $word = $1;
+            # remove trailing comma
+            $word =~ s/,\z//;
+
+            for my $s (split(/,/, $word)) {
+                # remove all double quotes
+                $s =~ s/\"//g;
+                # tream leading whitespace
+                $s =~ s/^ +//g;
+                push @seealso, $s;
+            }
+        }
+        elsif($d =~ /^\.I (.*)/) {
+            push @desc, "*$1*\n";
+        }
+        elsif($d =~ /^\.B (.*)/) {
+            push @desc, "**$1**\n";
+        }
+        elsif($d =~ /^\.nf/) {
+            push @desc, "~~~c\n";
+            $quote = 1;
+        }
+        else {
+            # embolden
+            $d =~ s/\\fB(.*?)\\fP/**$1**/g;
+            # links to "curl.*()" are left bare since cd2nroff handles them
+            # specially
+            $d =~ s/\\fI(curl.*?\(3\))\\fP/$1/ig;
+            # emphasize
+            $d =~ s/\\fI(.*?)\\fP/*$1*/g;
+            # emphasize on a split line
+            $d =~ s/\\fI/*/g;
+            # bold on a split line
+            $d =~ s/\\fB/**/g;
+            # remove backslash amp
+            $d =~ s/\\&//g;
+            # remove backslashes
+            $d =~ s/\\//g;
+            # fix single quotes
+            $d =~ s/\(aq/'/g;
+            # fix double quotes
+            $d =~ s/\(dq/\"/g;
+            push @desc, $d;
+        }
+    }
+    close(F);
+
+    print "See-also:\n";
+    for my $s (sort @seealso) {
+        print "  - $s\n" if($s);
+    }
+    print "---\n";
+    print @desc;
+
+    return !$header;
+}
+
+if(@ARGV) {
+  exit single($ARGV[0]);
+}
diff --git a/third-party/curl/scripts/perlcheck.sh b/third-party/curl/scripts/perlcheck.sh
new file mode 100644
index 0000000000..28c5be2c16
--- /dev/null
+++ b/third-party/curl/scripts/perlcheck.sh
@@ -0,0 +1,48 @@
+#!/bin/sh
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Dan Fandrich, <dan@coneharvesters.com>, Viktor Szakats, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+# The xargs invocation is portable, but does not preserve spaces in filenames.
+# If such a file is ever added, then this can be portably fixed by switching to
+# "xargs -I{}" and appending {} to the end of the xargs arguments (which calls
+# cmakelint once per file) or by using the GNU extension "xargs -d'\n'".
+
+set -eu
+
+cd "$(dirname "$0")"/..
+
+procs=6
+command -v nproc >/dev/null && procs="$(nproc)"
+echo "parallel: ${procs}"
+
+{
+  if [ -n "${1:-}" ]; then
+    for A in "$@"; do printf '%s\n' "$A"; done
+  elif git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    git ls-files '*.pl' '*.pm'
+    git grep -l '^#!/usr/bin/env perl'
+  else
+    find . -type f \( -name '*.pl' -o -name '*.pm' \)
+  fi
+} | sort -u | xargs -n 1 -P "${procs}" perl -c -Itests --
diff --git a/third-party/curl/scripts/pythonlint.sh b/third-party/curl/scripts/pythonlint.sh
new file mode 100644
index 0000000000..a6d6aa2dd4
--- /dev/null
+++ b/third-party/curl/scripts/pythonlint.sh
@@ -0,0 +1,37 @@
+#!/bin/sh
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Dan Fandrich, <dan@coneharvesters.com>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+# Use ruff to perform a style analysis on all Python code in the supplied
+# locations, or all Python files found in the current directory tree by
+# default.
+
+set -eu
+
+ruff check --extend-select=B007,B016,C405,C416,COM818,D200,D213,D204,D401,\
+D415,FURB129,N818,PERF401,PERF403,PIE790,PIE808,PLW0127,Q004,RUF010,SIM101,\
+SIM117,SIM118,TRY400,TRY401,RET503,RET504,UP004,B018,B904,RSE102,RET505,I001 \
+"$@"
+# Checks that are in preview only, since --preview otherwise turns them all on
+ruff check --preview --select=E301,E302,E303,E304,E305,E306,E502 "$@"
diff --git a/third-party/curl/scripts/randdisable b/third-party/curl/scripts/randdisable
new file mode 100644
index 0000000000..f91a2ac3b2
--- /dev/null
+++ b/third-party/curl/scripts/randdisable
@@ -0,0 +1,83 @@
+#!/usr/bin/env perl
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+#
+# This script makes a "random" build using configure and verifies that it
+# builds curl correctly. It randomly adds a number of the available
+# --disable-* flags to configure. When it detects a problem the script stops,
+# otherwise it continues trying more combinations.
+#
+# 1. Figure out all existing configure --disable-* options
+# 2. Generate random command line using supported options + random TLS
+# 3. Run configure (exit if problem)
+# 4. run "make -sj10" to build (exit if problem)
+# 5. run curl -V (exit if problem)
+# 6. GOTO 2
+#
+# Tips:
+#
+# - edit the @tls array to include all TLS backends you can build with
+# - do a checkout in a ram-based file system
+#
+use strict;
+use warnings;
+
+use List::Util qw/shuffle/;
+
+my @disable;
+
+sub getoptions {
+    my @all = qx(./configure --help);
+    for my $o (@all) {
+        chomp $o;
+        if($o =~ /(--disable-[^ ]*)/) {
+            if($1 !~ /FEATURE/) {
+                push @disable, $1;
+            }
+        }
+    }
+}
+
+getoptions();
+
+# options to select a TLS
+my @tls = ("--with-openssl",
+           "--with-wolfssl=/home/daniel/build-wolfssl",
+           "--with-gnutls",
+           "--with-mbedtls");
+
+do {
+
+    # get a random number of disable options
+    my $num = rand(scalar(@disable) - 2) + 2;
+
+    my $c = 0;
+    my @arg;
+    for my $d (shuffle @disable) {
+        push @arg, $d;
+        if(++$c >= $num) {
+            last;
+        }
+    }
+
+    my @stls = shuffle @tls;
+    push @arg, @stls;
+
+    system('make', ('clean'));
+    if(system('./configure', @arg)) {
+        print STDERR "configure problem\n";
+        print STDERR "./configure " . join(' ', @arg) . "\n";
+        exit 1;
+    }
+    if(system('make', ('-sj10'))) {
+        print STDERR "Build problem\n";
+        print STDERR "./configure " . join(' ', @arg) . "\n";
+        exit 1;
+    }
+    if(system("./src/curl -V 2>/dev/null")) {
+        print STDERR "Running problem\n";
+        print STDERR "./configure " . join(' ', @arg) . "\n";
+        exit 1;
+    }
+} while(1);
diff --git a/third-party/curl/scripts/release-notes.pl b/third-party/curl/scripts/release-notes.pl
index 136b48f0ad..c26c5037e8 100644
--- a/third-party/curl/scripts/release-notes.pl
+++ b/third-party/curl/scripts/release-notes.pl
@@ -31,10 +31,10 @@
 #
 # $ ./scripts/release-notes.pl
 #
-# 2. Edit RELEASE-NOTES and remove all entries that don't belong.  Unused
-# references below will be cleaned up in the next step. Make sure to move
-# "changes" up to the changes section. All entries will by default be listed
-# under bug-fixes as this script can't know where to put them.
+# 2. Edit RELEASE-NOTES and remove all entries that do not belong.  Unused
+# references below are cleaned up in the next step. Make sure to move
+# "changes" up to the changes section. All entries are by default listed
+# under bug-fixes as this script cannot know where to put them.
 #
 # 3. Run the cleanup script and let it sort the entries and remove unused
 # references from lines you removed in step (2):
@@ -54,23 +54,39 @@
 #
 ################################################
 
-my $cleanup = ($ARGV[0] eq "cleanup");
-my @gitlog=`git log @^{/RELEASE-NOTES:.synced}..` if(!$cleanup);
-my @releasenotes=`cat RELEASE-NOTES`;
+use strict;
+use warnings;
+
+my $cleanup = (@ARGV && $ARGV[0] eq "cleanup");
+my @gitlog = qx(git log @^{/RELEASE-NOTES:.synced}..) if(!$cleanup);
+my @releasenotes = qx(cat RELEASE-NOTES);
 
 my @o; # the entire new RELEASE-NOTES
 my @refused; # [num] = [2 bits of use info]
 my @refs; # [number] = [URL]
+my %dupe;
 for my $l (@releasenotes) {
     if($l =~ /^ o .*\[(\d+)\]/) {
         # referenced, set bit 0
-        $refused[$1]=1;
+        $refused[$1] = 1;
+        my $m = $l;
+        chomp $m;
+        $m =~ s/^ o //;
+        $m =~ s/ \[\d+\]$//;
+        $dupe{$m} = 1; # mark this as present
     }
     elsif($l =~ /^ \[(\d+)\] = (.*)/) {
         # listed in a reference, set bit 1
         $refused[$1] |= 2;
         $refs[$1] = $2;
     }
+    # mention without reference
+    elsif($l =~ /^ o (.*)/) {
+        my $m = $l;
+        chomp $m;
+        $m =~ s/^ o //;
+        $dupe{$m} = 1; # mark this as present
+    }
 }
 
 # Return a new fresh reference number
@@ -91,7 +107,7 @@ sub getref {
 # 'https://elsewhere.example.com/discussion'
 
 sub extract {
-    my ($ref)=@_;
+    my ($ref) = @_;
     if($ref =~ /^(\#|)(\d+)/) {
         # return the plain number
         return $2;
@@ -107,6 +123,12 @@ sub extract {
     # false alarm, not a valid line
 }
 
+my @fixes;
+my @closes;
+my @bug;
+my @line;
+my %moreinfo;
+
 my $short;
 my $first;
 for my $l (@gitlog) {
@@ -137,7 +159,7 @@ for my $l (@gitlog) {
             my $ref = extract($2);
             push @fixes, $ref if($ref);
         }
-        elsif($line =~ /^Clo(s|)es(:|) *(.*)/i) {
+        elsif($line =~ /^Cl([os]+)es(:|) *(.*)/i) {
             my $ref = extract($3);
             push @closes, $ref if($ref);
         }
@@ -153,8 +175,13 @@ if($first) {
 
 # call at the end of a parsed commit
 sub onecommit {
-    my ($short)=@_;
-    my $ref;
+    my ($short) = @_;
+    my $ref = '';
+
+    if($dupe{$short}) {
+        # this git commit message was found in the file
+        return;
+    }
 
     if($bug[0]) {
         $ref = $bug[0];
@@ -172,7 +199,7 @@ sub onecommit {
     if($ref) {
         my $r = getref();
         $refs[$r] = $ref;
-        $moreinfo{$short}=$r;
+        $moreinfo{$short} = $r;
         $refused[$r] |= 1;
     }
 }
@@ -185,9 +212,16 @@ for my $l (@releasenotes) {
         push @o, $l;
         push @o, "\n";
         for my $f (@line) {
+            if($dupe{$f}) {
+                # this item is already listed
+                next;
+            }
+
             push @o, sprintf " o %s%s\n", $f,
                 $moreinfo{$f}? sprintf(" [%d]", $moreinfo{$f}): "";
-            $refused[$moreinfo{$f}]=3;
+            if($moreinfo{$f}) {
+                $refused[$moreinfo{$f}] = 3;
+            }
         }
         push @o, " --- new entries are listed above this ---";
         next;
diff --git a/third-party/curl/scripts/release-tools.sh b/third-party/curl/scripts/release-tools.sh
new file mode 100644
index 0000000000..fc5d87fb90
--- /dev/null
+++ b/third-party/curl/scripts/release-tools.sh
@@ -0,0 +1,79 @@
+#!/bin/sh
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+set -eu
+
+# this should ideally be passed in
+timestamp=${1:-unknown}
+version=${2:-unknown}
+tag=$(echo "curl-$version" | tr '.' '_')
+commit=${3}
+if [ -n "$commit" ] && [ -r "docs/tarball-commit.txt.dist" ]; then
+  # If commit is given, then the tag likely does not actually exist
+  tag="$(cat docs/tarball-commit.txt.dist)"
+fi
+
+cat <<MOO
+# Release tools used for curl $version
+
+The following tools and their Debian package version numbers were used to
+produce this release tarball.
+
+MOO
+
+if ! command -v dpkg >/dev/null; then
+  echo "Error: could not find dpkg" >&2
+  exit 1
+fi
+
+debian() {
+  echo "- $1: $(dpkg -l "$1" | grep ^ii | awk '{print $3}')"
+}
+debian autoconf
+debian automake
+debian libtool
+debian make
+debian perl
+debian git
+
+cat <<MOO
+
+# Reproduce the tarball
+
+- Clone the repo and checkout the tag/commit: $tag
+- Install the same set of tools + versions as listed above
+
+## Do a standard build
+
+- autoreconf -fi
+- ./configure [...]
+- make
+
+## Generate the tarball with the same timestamp
+
+- export SOURCE_DATE_EPOCH=$timestamp
+- ./scripts/maketgz [version]
+
+MOO
diff --git a/third-party/curl/scripts/schemetable.c b/third-party/curl/scripts/schemetable.c
new file mode 100644
index 0000000000..8127ecd2a1
--- /dev/null
+++ b/third-party/curl/scripts/schemetable.c
@@ -0,0 +1,186 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include <stdio.h>
+#include <curl/curl.h>
+
+/*
+ * Use this tool to generate an updated table for the Curl_getn_scheme_handler
+ * function in url.c.
+ */
+
+static const char *scheme[] = {
+  "dict",
+  "file",
+  "ftp",
+  "ftps",
+  "gopher",
+  "gophers",
+  "http",
+  "https",
+  "imap",
+  "imaps",
+  "ldap",
+  "ldaps",
+  "mqtt",
+  "mqtts",
+  "pop3",
+  "pop3s",
+  "rtsp",
+  "scp",
+  "sftp",
+  "smb",
+  "smbs",
+  "smtp",
+  "smtps",
+  "socks",
+  "socks4",
+  "socks4a",
+  "socks5",
+  "socks5h",
+  "telnet",
+  "tftp",
+  "ws",
+  "wss",
+  NULL,
+};
+
+unsigned int calc(const char *s, int add, int shift)
+{
+  const char *so = s;
+  unsigned int c = add;
+  while(*s) {
+    c <<= shift;
+    c += *s;
+    s++;
+  }
+  return c;
+}
+
+unsigned int num[100];
+unsigned int ix[100];
+
+static void showtable(int try, int init, int shift)
+{
+  int nulls = 0;
+  int i;
+  for(i = 0; scheme[i]; ++i)
+    num[i] = calc(scheme[i], init, shift);
+  for(i = 0; scheme[i]; ++i)
+    ix[i] = num[i] % try;
+  printf("/*\n"
+         "   unsigned int c = %d\n"
+         "   while(l) {\n"
+         "     c <<= %d;\n"
+         "     c += Curl_raw_tolower(*s);\n"
+         "     s++;\n"
+         "     l--;\n"
+         "   }\n"
+         "*/\n",
+         init, shift);
+
+  printf("  static const struct Curl_scheme * const all_schemes[%d] = {", try);
+
+  /* generate table */
+  for(i = 0; i < try; i++) {
+    int match = 0;
+    int j;
+    for(j = 0; scheme[j]; j++) {
+      if(ix[j] == i) {
+        printf("\n    &Curl_scheme_%s,", scheme[j]);
+        match = 1;
+        nulls = 0;
+        break;
+      }
+    }
+    if(!match)
+      printf(" NULL,");
+  }
+  printf("\n  };\n");
+}
+
+int main(void)
+{
+  int i;
+  int try;
+  int besttry = 9999;
+  int bestadd = 0;
+  int bestshift = 0;
+  int add;
+  int shift;
+  for(shift = 0; shift < 8; shift++) {
+    for(add = 0; add < 999; add++) {
+      for(i = 0; scheme[i]; ++i) {
+        unsigned int v = calc(scheme[i], add, shift);
+        int j;
+        int badcombo = 0;
+        for(j = 0; j < i; j++) {
+
+          if(num[j] == v) {
+#if 0
+            printf("NOPE: %u is a dupe (%s and %s)\n",
+                   v, scheme[i], scheme[j]);
+#endif
+            badcombo = 1;
+            break;
+          }
+        }
+        if(badcombo)
+          break;
+        num[i] = v;
+      }
+#if 0
+      for(i = 0; scheme[i].n; ++i) {
+        printf("%u - %s\n", num[i], scheme[i].n);
+      }
+#endif
+      /* try different remainders to find smallest possible table */
+      for(try = 28; try < 199; try++) {
+        int good = 1;
+        for(i = 0; scheme[i]; ++i) {
+          ix[i] = num[i] % try;
+        }
+        /* check for dupes */
+        for(i = 0; scheme[i] && good; ++i) {
+          int j;
+          for(j = 0; j < i; j++) {
+            if(ix[j] == ix[i]) {
+              good = 0;
+              break;
+            }
+          }
+        }
+        if(good) {
+          if(try < besttry) {
+            besttry = try;
+            bestadd = add;
+            bestshift = shift;
+          }
+          break;
+        }
+      }
+    }
+  }
+
+  showtable(besttry, bestadd, bestshift);
+}
diff --git a/third-party/curl/scripts/singleuse.pl b/third-party/curl/scripts/singleuse.pl
index 3ed171a3e7..fc6cc7f111 100644
--- a/third-party/curl/scripts/singleuse.pl
+++ b/third-party/curl/scripts/singleuse.pl
@@ -28,40 +28,36 @@
 #
 # Use it like this:
 #
-# $ ./scripts/singleuse.pl lib/.libs/libcurl.a
+# $ ./scripts/singleuse.pl [--unit] lib/.libs/libcurl.a
 #
-# Be aware that it might cause false positives due to various build options.
+# --unit : built to support unit tests
 #
 
-my $file = $ARGV[0];
+use strict;
+use warnings;
+
+my @unittests;
+if(@ARGV && $ARGV[0] eq "--unit") {
+    push @unittests, 'tests/unit';
+    shift @ARGV;
+}
+
+my $file = $ARGV[0] || '';
 
 my %wl = (
-    'Curl_none_cert_status_request' => 'multiple TLS backends',
-    'Curl_none_check_cxn' => 'multiple TLS backends',
-    'Curl_none_cleanup' => 'multiple TLS backends',
-    'Curl_none_close_all' => 'multiple TLS backends',
-    'Curl_none_data_pending' => 'multiple TLS backends',
-    'Curl_none_engines_list' => 'multiple TLS backends',
-    'Curl_none_init' => 'multiple TLS backends',
-    'Curl_none_md5sum' => 'multiple TLS backends',
-    'Curl_none_random' => 'multiple TLS backends',
-    'Curl_none_session_free' => 'multiple TLS backends',
-    'Curl_none_set_engine' => 'multiple TLS backends',
-    'Curl_none_set_engine_default' => 'multiple TLS backends',
-    'Curl_none_shutdown' => 'multiple TLS backends',
-    'Curl_multi_dump' => 'debug build only',
-    'Curl_parse_port' => 'UNITTEST',
-    'Curl_shuffle_addr' => 'UNITTEST',
-    'de_cleanup' => 'UNITTEST',
-    'doh_decode' => 'UNITTEST',
-    'doh_encode' => 'UNITTEST',
-    'Curl_auth_digest_get_pair' => 'by digest_sspi',
-    'curlx_uztoso' => 'cmdline tool use',
-    'curlx_uztoul' => 'by krb5_sspi',
-    'curlx_uitous' => 'by schannel',
-    'Curl_islower' => 'by curl_fnmatch',
-    'getaddressinfo' => 'UNITTEST',
-    );
+    'Curl_xfer_write_resp' => 'internal api',
+    'Curl_creader_def_init' => 'internal api',
+    'Curl_creader_def_close' => 'internal api',
+    'Curl_creader_def_read' => 'internal api',
+    'Curl_creader_def_total_length' => 'internal api',
+    'Curl_meta_reset' => 'internal api',
+    'Curl_thread_destroy' => 'internal api',
+    'Curl_trc_dns' => 'internal api',
+    'curlx_base64_decode' => 'internal api',
+    'curlx_base64_encode' => 'internal api',
+    'curlx_base64url_encode' => 'internal api',
+    'Curl_multi_clear_dirty' => 'internal api',
+);
 
 my %api = (
     'curl_easy_cleanup' => 'API',
@@ -75,6 +71,8 @@ my %api = (
     'curl_easy_reset' => 'API',
     'curl_easy_send' => 'API',
     'curl_easy_setopt' => 'API',
+    'curl_easy_ssls_export' => 'API',
+    'curl_easy_ssls_import' => 'API',
     'curl_easy_strerror' => 'API',
     'curl_easy_unescape' => 'API',
     'curl_easy_upkeep' => 'API',
@@ -92,6 +90,7 @@ my %api = (
     'curl_global_init' => 'API',
     'curl_global_init_mem' => 'API',
     'curl_global_sslset' => 'API',
+    'curl_global_trace' => 'API',
     'curl_maprintf' => 'API',
     'curl_mfprintf' => 'API',
     'curl_mime_addpart' => 'API',
@@ -113,8 +112,12 @@ my %api = (
     'curl_multi_assign' => 'API',
     'curl_multi_cleanup' => 'API',
     'curl_multi_fdset' => 'API',
+    'curl_multi_get_handles' => 'API',
+    'curl_multi_get_offt' => 'API',
     'curl_multi_info_read' => 'API',
     'curl_multi_init' => 'API',
+    'curl_multi_notify_disable' => 'API',
+    'curl_multi_notify_enable' => 'API',
     'curl_multi_perform' => 'API',
     'curl_multi_remove_handle' => 'API',
     'curl_multi_setopt' => 'API',
@@ -125,6 +128,7 @@ my %api = (
     'curl_multi_strerror' => 'API',
     'curl_multi_timeout' => 'API',
     'curl_multi_wait' => 'API',
+    'curl_multi_waitfds' => 'API',
     'curl_multi_wakeup' => 'API',
     'curl_mvaprintf' => 'API',
     'curl_mvfprintf' => 'API',
@@ -155,39 +159,59 @@ my %api = (
     'curl_ws_meta' => 'API',
     'curl_ws_recv' => 'API',
     'curl_ws_send' => 'API',
+    'curl_ws_start_frame' => 'API',
 
     # the following functions are provided globally in debug builds
     'curl_easy_perform_ev' => 'debug-build',
     );
 
-open(N, "nm $file|") ||
-    die;
+sub doublecheck {
+    my ($f, $used) = @_;
+    open(F, '-|', 'git', 'grep', '-Fwle', $f, '--', 'lib', @unittests, 'projects');
+    my @also;
+    while(<F>) {
+        my $e = $_;
+        chomp $e;
+        if($e =~ /\.[c]$/) {
+            if($e !~ /^lib\/${used}\.c/) {
+                push @also, $e;
+            }
+        }
+    }
+    close(F);
+    return @also;
+}
+
+open(N, '-|', 'nm', $file) or die;
 
 my %exist;
 my %uses;
-my $file;
-while (<N>) {
+while(<N>) {
     my $l = $_;
     chomp $l;
 
     if($l =~ /^([0-9a-z_-]+)\.o:/) {
         $file = $1;
     }
-    if($l =~ /^([0-9a-f]+) T (.*)/) {
-        my ($name)=($2);
+    # libcurl.a(unity_0_c.c.o):
+    elsif($l =~ /\(([0-9a-z_.-]+)\.o\):/) {  # Apple nm
+        $file = $1;
+    }
+    if($l =~ /^([0-9a-f]+) T _?(.*)/) {
+        my ($name) = ($2);
         #print "Define $name in $file\n";
         $file =~ s/^libcurl_la-//;
         $exist{$name} = $file;
     }
-    elsif($l =~ /^                 U (.*)/) {
-        my ($name)=($1);
+    elsif($l =~ /^                 U _?(.*)/) {
+        my ($name) = ($1);
         #print "Uses $name in $file\n";
         $uses{$name} .= "$file, ";
     }
 }
 close(N);
 
-my $err;
+my $err = 0;
 for(sort keys %exist) {
     #printf "%s is defined in %s, used by: %s\n", $_, $exist{$_}, $uses{$_};
     if(!$uses{$_}) {
@@ -206,8 +230,15 @@ for(sort keys %exist) {
             #print "$_ is WL\n";
         }
         else {
-            printf "%s is defined in %s, but not used outside\n", $_, $exist{$_};
-            $err++;
+            my $c = $_;
+            my @also = doublecheck($c, $exist{$c});
+            if(!scalar(@also)) {
+                printf "%s in %s\n", $c, $exist{$c};
+                $err++;
+            }
+            #    foreach my $a (@also) {
+            #        print "  $a\n";
+            #    }
         }
     }
     elsif($_ =~ /^curl_/) {
diff --git a/third-party/curl/scripts/spacecheck.pl b/third-party/curl/scripts/spacecheck.pl
new file mode 100644
index 0000000000..416408e56e
--- /dev/null
+++ b/third-party/curl/scripts/spacecheck.pl
@@ -0,0 +1,306 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Viktor Szakats
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+use File::Basename;
+
+my @tabs = (
+    '^m4/zz40-xc-ovr\.m4$',
+    'Makefile\.(am|example)$',
+    '\.sln$',
+    '^tests/data/data1706-stdout\.txt',
+    '^tests/data/test',
+);
+
+my @need_crlf = (
+    '\.(bat|sln)$',
+);
+
+my @double_empty_lines = (
+    '^RELEASE-NOTES$',
+    '^lib/.+\.(c|h)$',
+    '^projects/OS400/',
+    '^projects/vms/',
+    '^tests/data/test',
+    '\.(m4|py)$',
+);
+
+my @longline = (
+    '\.github/workflows/windows\.yml$',
+    '^renovate\.json$',
+    '^docs/DISTROS\.md$',
+    '^projects/Windows/tmpl/.+\.vcxproj$',
+    '^tests/certs/srp-verifier-',
+    '^tests/data/test',
+);
+
+my @non_ascii_allowed = (
+    '\xC3\xB6',  # UTF-8 for https://codepoints.net/U+00F6 LATIN SMALL LETTER O WITH DIAERESIS
+);
+
+my $non_ascii_allowed = join(', ', @non_ascii_allowed);
+
+my @non_ascii = (
+    '^\.github/scripts/pyspelling\.words$',
+    '^\.mailmap$',
+    '^RELEASE-NOTES$',
+    '^docs/BINDINGS\.md$',
+    '^docs/THANKS$',
+    '^docs/THANKS-filter$',
+);
+
+sub fn_match {
+    my ($filename, @masklist) = @_;
+
+    foreach my $mask (@masklist) {
+        if($filename =~ $mask) {
+            return 1;
+        }
+    }
+    return 0;
+}
+
+sub eol_detect {
+    my ($content) = @_;
+
+    my $cr = () = $content =~ /\r/g;
+    my $lf = () = $content =~ /\n/g;
+
+    if($cr > 0 && $lf == 0) {
+        return 'cr';
+    }
+    elsif($cr == 0 && $lf > 0) {
+        return 'lf';
+    }
+    elsif($cr == 0 && $lf == 0) {
+        return 'bin';
+    }
+    elsif($cr == $lf) {
+        return 'crlf';
+    }
+
+    return '';
+}
+
+my $max_repeat_space = 79;
+my $max_line_len = 192;
+my $max_path_len = 64;
+my $max_filename_len = 48;
+
+my $issues = 0;
+
+open(my $git_ls_files, '-|', 'git', 'ls-files') or die "Failed running git ls-files: $!";
+while(my $filename = <$git_ls_files>) {
+    chomp $filename;
+
+    my @err = ();
+
+    if(length($filename) > $max_path_len) {
+        push @err, sprintf('long (%d > %d) path', length($filename), $max_path_len);
+    }
+
+    my $bn = basename($filename);
+    if(length($bn) > $max_filename_len) {
+        push @err, sprintf('long (%d > %d) filename', length($bn), $max_filename_len);
+    }
+
+    if($filename !~ /^[A-Za-z0-9\/._-]+$/) {
+        push @err, sprintf("filename contains character(s) outside [A-Za-z0-9/._-]");
+    }
+
+    open(my $fh, '<', $filename) or die "Cannot open '$filename': $!";
+    my $content = do { local $/; <$fh> };
+    close $fh;
+
+    if(!fn_match($filename, @tabs) &&
+       $content =~ /\t/) {
+        push @err, 'content: has tab';
+    }
+
+    my $eol = eol_detect($content);
+
+    if($eol eq '') {
+        push @err, 'content: has mixed EOL types';
+    }
+
+    if($eol ne 'crlf' &&
+       fn_match($filename, @need_crlf)) {
+        push @err, 'content: must use CRLF EOL for this file type';
+    }
+
+    if($eol ne 'lf' && $content ne '' &&
+       !fn_match($filename, @need_crlf)) {
+        push @err, 'content: must use LF EOL for this file type';
+    }
+
+    if($content =~ /[ \t]\n/) {
+        my $line;
+        for my $l (split(/\n/, $content)) {
+            $line++;
+            if($l =~ /[ \t]$/) {
+                push @err, "line $line: trailing whitespace";
+            }
+        }
+    }
+
+    if($content ne '' &&
+       $content !~ /\n\z/) {
+        push @err, 'content: has no EOL at EOF';
+    }
+
+    if($content =~ /\n\n\z/ ||
+       $content =~ /\r\n\r\n\z/) {
+        push @err, 'content: has multiple EOL at EOF';
+    }
+
+    if((!fn_match($filename, @double_empty_lines) &&
+        ($content =~ /\n\n\n/ ||
+         $content =~ /\r\n\r\n\r\n/)) ||
+       $content =~ />\n\n\n+[<#]/) {
+        my $line = 0;
+        my $blank = 0;
+        for my $l (split(/\n/, $content)) {
+            chomp $l;
+            $line++;
+            if($l =~ /^$/) {
+                if($blank) {
+                    my $lineno = sprintf('duplicate empty line @ line %d', $line);
+                    push @err, $lineno;
+                }
+                $blank = 1;
+            }
+            else {
+                $blank = 0;
+            }
+        }
+    }
+
+    if($content =~ /\n\n\n\n/ ||
+       $content =~ /\r\n\r\n\r\n\r\n/) {
+        my $line = 0;
+        my $blank = 0;
+        for my $l (split(/\n/, $content)) {
+            chomp $l;
+            $line++;
+            if($l =~ /^$/) {
+                if($blank > 1) {
+                    my $lineno = sprintf('3 or more consecutive empty lines @ line %d', $line);
+                    push @err, $lineno;
+                }
+                $blank++;
+            }
+            else {
+                $blank = 0;
+            }
+        }
+    }
+
+    if(!fn_match($filename, @longline)) {
+        my $line = 0;
+        for my $l (split(/\n/, $content)) {
+            $line++;
+            if(length($l) > $max_line_len) {
+                push @err, sprintf('line %d: long (%d > %d) line', $line, length($l), $max_line_len);
+            }
+        }
+    }
+
+    my $line = 0;
+    for my $l (split(/\n/, $content)) {
+        $line++;
+        if($l =~ /( {$max_repeat_space,})/) {
+            push @err, sprintf('line %d: repeat spaces (%d >= %d)', $line, length($1), $max_repeat_space);
+        }
+    }
+
+    my $search = $content;
+    my $linepos = 0;
+    while($search =~ /[^ ] "\n *" [^ ]/) {
+        my $part = substr($search, 0, $+[0]);
+        $search = substr($search, $+[0]);
+        my $line = ($part =~ tr/\n//);
+        push @err, sprintf('line %d: double spaces in folded string', $linepos + $line);
+        $linepos += $line;
+    }
+
+    $search = $content;
+    $linepos = 0;
+    while($search =~ /\n\n *}\n/) {
+        my $part = substr($search, 0, $+[0] - 1);
+        $search = substr($search, $+[0]);
+        my $line = ($part =~ tr/\n//);
+        push @err, sprintf("line %d: '}' preceded by empty line", $linepos + $line);
+        $linepos += $line + 1;
+    }
+
+    $search = $content;
+    $linepos = 0;
+    while($search =~ /\n\{\n\n/) {
+        my $part = substr($search, 0, $+[0]);
+        $search = substr($search, $+[0]);
+        my $line = ($part =~ tr/\n//);
+        push @err, sprintf("line %d: top-level '{' followed by empty line", $linepos + $line);
+        $linepos += $line;
+    }
+
+    if($content =~ /([\x00-\x08\x0b\x0c\x0e-\x1f\x7f])/) {
+        push @err, 'content: has binary contents';
+    }
+
+    if($filename !~ /tests\/data/) {
+        # the tests have no allowed UTF bytes
+        $content =~ s/[$non_ascii_allowed]//g;
+    }
+
+    if(!fn_match($filename, @non_ascii) &&
+       ($content =~ /([\x80-\xff]+)/)) {
+        my $non = $1;
+        my $hex;
+        for my $e (split(//, $non)) {
+            $hex .= sprintf('%s%02x', $hex ? ' ': '', ord($e));
+        }
+        my $line;
+        for my $l (split(/\n/, $content)) {
+            $line++;
+            if($l =~ /([\x80-\xff]+)/) {
+                push @err, "line $line: has non-ASCII: '$non' ($hex)";
+            }
+        }
+    }
+
+    if(@err) {
+        $issues++;
+        foreach my $err (@err) {
+            print "$filename: $err\n";
+        }
+    }
+}
+close $git_ls_files;
+
+if($issues) {
+    exit 1;
+}
diff --git a/third-party/curl/scripts/top-complexity b/third-party/curl/scripts/top-complexity
new file mode 100644
index 0000000000..7ad84f29dd
--- /dev/null
+++ b/third-party/curl/scripts/top-complexity
@@ -0,0 +1,134 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+#######################################################################
+# Check for a command in the PATH of the test server.
+#
+sub checkcmd {
+    my ($cmd) = @_;
+    my @paths;
+    if($^O eq 'MSWin32' || $^O eq 'dos' || $^O eq 'os2') {
+        # PATH separator is different
+        @paths = (split(';', $ENV{'PATH'}));
+    }
+    else {
+        @paths = (split(':', $ENV{'PATH'}), "/usr/sbin", "/usr/local/sbin",
+                  "/sbin", "/usr/bin", "/usr/local/bin");
+    }
+    for(@paths) {
+        if(-x "$_/$cmd" && ! -d "$_/$cmd") {
+            # executable bit but not a directory!
+            return "$_/$cmd";
+        }
+    }
+    return "";
+}
+
+my $pmccabe = checkcmd("pmccabe");
+if(!$pmccabe) {
+    print "Make sure 'pmccabe' exists in your PATH\n";
+    exit 1;
+}
+if(! -r "lib/url.c" || ! -r "lib/urldata.h") {
+    print "Invoke this script in the curl source tree root\n";
+    exit 1;
+}
+
+my @files;
+open(my $git, "-|", "git", "ls-files", "*.c") or die "git ls-files failed: $!";
+while(<$git>) {
+    chomp $_;
+    my $file = $_;
+    # we cannot filter these with git so do it here
+    if($file =~ /^(lib|src)/) {
+        push @files, $file;
+    }
+}
+close($git);
+
+open(my $pmc, "-|", $pmccabe, @files) or die "pmccabe failed: $!";
+my @output = <$pmc>;
+close($pmc);
+
+# these functions can have these scores, but not higher
+my %whitelist = (
+
+    );
+
+# complexity above this level is treated as an error and contributes to the
+# script's exit code
+my $cutoff = 50;
+
+# show this many from the top
+my $top = $ARGV[0] ? $ARGV[0] : 25;
+
+my $error = 0;
+my %where;
+my %perm;
+my $allscore = 0;
+my $alllines = 0;
+# each line starts with the complexity score
+# 142     417     809     1677    1305    src/tool_getparam.c(1677): getparameter
+for my $l (@output) {
+    chomp $l;
+    if($l =~ /^(\d+)\t\d+\t\d+\t\d+\t(\d+)\t([^\(]+).*: ([^ ]*)/) {
+        my ($score, $len, $path, $func) = ($1, $2, $3, $4);
+
+        my $allow = 0;
+        if($whitelist{$func} &&
+           ($score <= $whitelist{$func})) {
+            $allow = 1;
+        }
+        $where{"$path:$func"} = $score;
+        $perm{"$path:$func"} = $allow;
+        if(($score > $cutoff) && !$allow) {
+            $error++;
+        }
+
+        $alllines += $len;
+        $allscore += ($len * $score);
+    }
+}
+
+my $showncutoff;
+for my $e (sort {$where{$b} <=> $where{$a}} keys %where) {
+    if(!$showncutoff &&
+       ($where{$e} <= $cutoff)) {
+        print "\n---- threshold: $cutoff ----\n\n";
+        $showncutoff = 1;
+    }
+    printf "%-5d %s%s\n", $where{$e}, $e,
+        $perm{$e} ? " [ALLOWED]" : "";
+    if(!--$top) {
+        last;
+    }
+}
+
+printf "\nAverage complexity: %.2f\n", $allscore / $alllines;
+
+exit $error;
diff --git a/third-party/curl/scripts/top-length b/third-party/curl/scripts/top-length
new file mode 100644
index 0000000000..7bed39b8db
--- /dev/null
+++ b/third-party/curl/scripts/top-length
@@ -0,0 +1,133 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+#######################################################################
+# Check for a command in the PATH of the test server.
+#
+sub checkcmd {
+    my ($cmd) = @_;
+    my @paths;
+    if($^O eq 'MSWin32' || $^O eq 'dos' || $^O eq 'os2') {
+        # PATH separator is different
+        @paths = (split(';', $ENV{'PATH'}));
+    }
+    else {
+        @paths = (split(':', $ENV{'PATH'}), "/usr/sbin", "/usr/local/sbin",
+                  "/sbin", "/usr/bin", "/usr/local/bin");
+    }
+    for(@paths) {
+        if(-x "$_/$cmd" && ! -d "$_/$cmd") {
+            # executable bit but not a directory!
+            return "$_/$cmd";
+        }
+    }
+    return "";
+}
+
+my $pmccabe = checkcmd("pmccabe");
+if(!$pmccabe) {
+    print "Make sure 'pmccabe' exists in your PATH\n";
+    exit 1;
+}
+if(! -r "lib/url.c" || ! -r "lib/urldata.h") {
+    print "Invoke this script in the curl source tree root\n";
+    exit 1;
+}
+
+my @files;
+open(my $git, "-|", "git", "ls-files", "*.c") or die "git ls-files failed: $!";
+while(<$git>) {
+    chomp $_;
+    my $file = $_;
+    # we cannot filter these with git so do it here
+    if($file =~ /^(lib|src)/) {
+        push @files, $file;
+    }
+}
+close($git);
+
+open(my $pmc, "-|", $pmccabe, @files) or die "pmccabe failed: $!";
+my @output = <$pmc>;
+close($pmc);
+
+# these functions can be this long, but not longer
+my %whitelist = (
+    );
+
+# function length above this level is treated as an error and contributes to
+# the script's exit code
+my $cutoff = 500;
+
+# show this many from the top
+my $top = $ARGV[0] ? $ARGV[0] : 25;
+
+my $error = 0;
+my %where;
+my %perm;
+my $funcs = 0;
+my $alllines = 0;
+# each line starts with the complexity score
+# 142     417     809     1677    1305    src/tool_getparam.c(1677): getparameter
+for my $l (@output) {
+    chomp $l;
+    if($l =~ /^(\d+)\t\d+\t\d+\t\d+\t(\d+)\t([^\(]+).*: ([^ ]*)/) {
+        my ($score, $length, $path, $func) = ($1, $2, $3, $4);
+
+        my $allow = 0;
+        if($whitelist{$func} &&
+           ($length <= $whitelist{$func})) {
+            $allow = 1;
+        }
+        $where{"$path:$func"} = $length;
+        $perm{"$path:$func"} = $allow;
+        if(($length > $cutoff) && !$allow) {
+            $error++;
+        }
+
+        $alllines += $length;
+        $funcs++;
+    }
+}
+
+my $showncutoff;
+for my $e (sort {$where{$b} <=> $where{$a}} keys %where) {
+    if(!$showncutoff &&
+       ($where{$e} <= $cutoff)) {
+        print "\n---- threshold: $cutoff ----\n\n";
+        $showncutoff = 1;
+    }
+    printf "%-5d %s%s\n", $where{$e}, $e,
+        $perm{$e} ? " [ALLOWED]" : "";
+    if(!--$top) {
+        last;
+    }
+}
+
+printf "\nAverage function length: %.2f lines\n", $alllines/$funcs;
+
+exit $error;
diff --git a/third-party/curl/scripts/updatemanpages.pl b/third-party/curl/scripts/updatemanpages.pl
deleted file mode 100644
index 58a8755e8b..0000000000
--- a/third-party/curl/scripts/updatemanpages.pl
+++ /dev/null
@@ -1,357 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-# Update man pages.
-
-use strict;
-use warnings;
-use Tie::File;
-
-# Data from the command line.
-
-my $curlver = $ARGV[0];
-my $curldate = $ARGV[1];
-
-# Directories and extensions.
-
-my @dirlist = ("docs/", "docs/libcurl/", "docs/libcurl/opts/", "tests/");
-my @extlist = (".1", ".3");
-my @excludelist = ("mk-ca-bundle.1", "template.3");
-
-# Subroutines
-
-sub printargs{
-  # Print arguments and exit.
-
-  print "usage: updatemanpages.pl <version> <date>\n";
-  exit;
-}
-
-sub getthline{
-  # Process file looking for .TH section.
-
-  my $filename = shift;
-  my $file_handle;
-  my $file_line;
-
-  # Open the file.
-
-  open($file_handle, $filename);
-
-  # Look for the .TH section, process it into an array,
-  # modify it and write to file.
-
-  tie(my @file_data, 'Tie::File', $filename);
-  foreach my $file_data_line(@file_data) {
-    if($file_data_line =~ /^.TH/) {
-      $file_line = $file_data_line;
-      last;
-    }
-  }
-
-  # Close the file.
-
-  close($file_handle);
-  return $file_line;
-}
-
-sub extractth{
-  # Extract .TH section as an array.
-
-  my $input = shift;
-
-  # Split the line into an array.
-
-  my @tharray;
-  my $inputsize = length($input);
-  my $inputcurrent = "";
-  my $quotemode = 0;
-
-  for(my $inputseek = 0; $inputseek < $inputsize; $inputseek++) {
-
-    if(substr($input, $inputseek, 1) eq " " && $quotemode eq 0) {
-      push(@tharray, $inputcurrent);
-      $inputcurrent = "";
-      next;
-    }
-
-    $inputcurrent = $inputcurrent . substr($input, $inputseek, 1);
-
-    if(substr($input, $inputseek, 1) eq "\"") {
-      if($quotemode eq 0) {
-        $quotemode = 1;
-      }
-      else {
-        $quotemode = 0;
-      }
-    }
-  }
-
-  if($inputcurrent ne "") {
-    push(@tharray, $inputcurrent);
-  }
-
-  return @tharray;
-}
-
-sub getdate{
-  # Get the date from the .TH section.
-
-  my $filename = shift;
-  my $thline;
-  my @tharray;
-  my $date = "";
-
-  $thline = getthline($filename);
-
-  # Return nothing if there is no .TH section found.
-
-  if(!$thline || $thline eq "") {
-    return "";
-  }
-
-  @tharray = extractth($thline);
-
-  # Remove the quotes at the start and end.
-
-  $date = substr($tharray[3], 1, -1);
-  return $date;
-}
-
-sub processth{
-  # Process .TH section.
-
-  my $input = shift;
-  my $date = shift;
-
-  # Split the line into an array.
-
-  my @tharray = extractth($input);
-
-  # Alter the date.
-
-  my $itemdate = "\"";
-  $itemdate .= $date;
-  $itemdate .= "\"";
-  $tharray[3] = $itemdate;
-
-  # Alter the item version.
-
-  my $itemver = $tharray[4];
-  my $itemname = "";
-
-  for(my $itemnameseek = 1;
-    $itemnameseek < length($itemver);
-    $itemnameseek++) {
-    if(substr($itemver, $itemnameseek, 1) eq " " ||
-      substr($itemver, $itemnameseek, 1) eq "\"") {
-      last;
-    }
-    $itemname .= substr($itemver, $itemnameseek, 1);
-  }
-
-  $itemver = "\"";
-  $itemver .= $itemname;
-  $itemver .= " ";
-  $itemver .= $curlver;
-  $itemver .= "\"";
-
-  $tharray[4] = $itemver;
-
-  my $thoutput = "";
-
-  foreach my $thvalue (@tharray) {
-    $thoutput .= $thvalue;
-    $thoutput .= " ";
-  }
-  $thoutput =~ s/\s+$//;
-  $thoutput .= "\n";
-
-  # Return updated string.
-
-  return $thoutput;
-}
-
-sub processfile{
-  # Process file looking for .TH section.
-
-  my $filename = shift;
-  my $date = shift;
-  my $file_handle;
-  my $file_dist_handle;
-  my $filename_dist;
-
-  # Open a handle for the original file and a second file handle
-  # for the dist file.
-
-  $filename_dist = $filename . ".dist";
-
-  open($file_handle, $filename);
-  open($file_dist_handle, ">" . $filename_dist);
-
-  # Look for the .TH section, process it into an array,
-  # modify it and write to file.
-
-  tie(my @file_data, 'Tie::File', $filename);
-  foreach my $file_data_line (@file_data) {
-    if($file_data_line =~ /^.TH/) {
-      my $file_dist_line = processth($file_data_line, $date);
-      print $file_dist_handle $file_dist_line . "\n";
-    }
-    else {
-      print $file_dist_handle $file_data_line . "\n";
-    }
-  }
-
-  # Close the file.
-
-  close($file_handle);
-  close($file_dist_handle);
-}
-
-# Check that $curlver is set, otherwise print arguments and exit.
-
-if(!$curlver) {
-  printargs();
-}
-
-# check to see that the git command works, it requires git 2.6 something
-my $gitcheck = `git log -1 --date="format:%B %d, %Y" $dirlist[0] 2>/dev/null`;
-if(length($gitcheck) < 1) {
-    print "git version too old or $dirlist[0] is a bad argument\n";
-    exit;
-}
-
-# Look in each directory.
-
-my $dir_handle;
-
-foreach my $dirname (@dirlist) {
-  foreach my $extname (@extlist) {
-    # Go through the directory looking for files ending with
-    # the current extension.
-
-    opendir($dir_handle, $dirname);
-    my @filelist = grep(/.$extname$/i, readdir($dir_handle));
-
-    foreach my $file (@filelist) {
-      # Skip if file is in exclude list.
-
-      if(grep(/^$file$/, @excludelist)) {
-        next;
-      }
-
-      # Load the file and get the date.
-
-      my $filedate;
-
-      # Check if dist version exists and load date from that
-      # file if it does.
-
-      if(-e ($dirname . $file . ".dist")) {
-        $filedate = getdate(($dirname . $file . ".dist"));
-      }
-      else {
-        $filedate = getdate(($dirname . $file));
-      }
-
-      # Skip if value is empty.
-
-      if(!$filedate || $filedate eq "") {
-        next;
-      }
-
-      # Check the man page in the git repository.
-
-      my $repodata = `LC_TIME=C git log -1 --date="format:%B %d, %Y" \\
-                       --since="$filedate" $dirname$file | grep ^Date:`;
-
-      # If there is output then update the man page
-      # with the new date/version.
-
-      # Process the file if there is output.
-
-      if($repodata) {
-        my $thisdate;
-        if(!$curldate) {
-          if($repodata =~ /^Date: +(.*)/) {
-            $thisdate = $1;
-          }
-          else {
-            print STDERR "Warning: " . ($dirname . $file) . ": found no " .
-                           "date\n";
-          }
-        }
-        else {
-          $thisdate = $curldate;
-        }
-        processfile(($dirname . $file), $thisdate);
-        print $dirname . $file . " page updated to $thisdate\n";
-      }
-    }
-    closedir($dir_handle);
-  }
-}
-
-__END__
-
-=pod
-
-=head1 updatemanpages.pl
-
-Updates the man pages with the version number and optional date. If the date
-isn't provided, the last modified date from git is used.
-
-=head2 USAGE
-
-updatemanpages.pl version [date]
-
-=head3 version
-
-Specifies version (required)
-
-=head3 date
-
-Specifies date (optional)
-
-=head2 SETTINGS
-
-=head3 @dirlist
-
-Specifies the list of directories to look for files in.
-
-=head3 @extlist
-
-Specifies the list of files with extensions to process.
-
-=head3 @excludelist
-
-Specifies the list of files to not process.
-
-=head2 NOTES
-
-This script is used during maketgz.
-
-=cut
diff --git a/third-party/curl/scripts/verify-release b/third-party/curl/scripts/verify-release
new file mode 100644
index 0000000000..fd7aa3ded6
--- /dev/null
+++ b/third-party/curl/scripts/verify-release
@@ -0,0 +1,121 @@
+#!/bin/sh
+
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+# This script remakes a provided curl release and verifies that the newly
+# built version is identical to the original file.
+#
+# Invoke in a clean directory with the release tarball file (stored in the
+# same directory) as an argument for basic verification.
+#
+# For full verification: run the script in an up-to-date curl git repository.
+#
+
+set -eu
+
+tarball="${1:-}"
+
+if [ -z "$tarball" ]; then
+  echo "Provide a curl release tarball name as argument"
+  exit
+fi
+
+i="$(find . -maxdepth 1 -type d -name 'curl-*' | wc -l)"
+
+if test "$i" -gt 1; then
+  echo "multiple curl-* entries found, disambiguate please"
+  exit
+fi
+
+# check if this is in a git clone directory
+
+if git log -1 include/curl/curl.h 2>/dev/null >/dev/null; then
+  echo "*** Detected a git checkout, do full verification"
+  withgit=1
+else
+  echo "*** Lacking a full git checkout, do the lesser verification"
+  withgit=0
+fi
+
+mkdir -p _tarballs
+rm -rf _tarballs/*
+
+# checksum the original tarball to compare with later
+sha256sum "$tarball" >_tarballs/checksum
+
+# extract version number from file name
+tarver=$(echo "$tarball" | sed 's/curl-\([0-9.]*\)\..*/\1/')
+
+# extract the version from the official header file
+curlver=$(tar xOf "$tarball" "curl-$tarver/include/curl/curlver.h" | grep '#define LIBCURL_VERSION ' | sed 's/[^0-9.]//g')
+
+if test "$tarver" != "$curlver"; then
+  echo "Tarball file version ($tarver) mismatches contents of tarball ($curlver)"
+  exit 1
+fi
+
+timestamp=$(tar xOf "$tarball" "curl-$tarver/docs/RELEASE-TOOLS.md" | grep 'SOURCE_DATE_EPOCH=' | sed 's/[^0-9.]//g')
+
+if test "$withgit" = 0; then
+  # without git
+
+  # extract the release contents
+  tar xf "$tarball"
+
+  # move away the original tarball
+  mv "$tarball" "_tarballs/orig-$tarball"
+
+  pwd=$(pwd)
+  cd "curl-$curlver"
+  ./configure --without-ssl --without-libpsl
+  ./scripts/dmaketgz "$curlver" "$timestamp"
+
+  for f in "curl-$curlver.tar.gz" "curl-$curlver.tar.bz2" "curl-$curlver.tar.xz" "curl-$curlver.zip"; do
+    mv "$f" ../_tarballs/
+  done
+  cd "$pwd"
+else
+  tag=$(tar xOf "$tarball" "curl-$tarver/docs/RELEASE-TOOLS.md" | grep 'tag/commit: curl-' | head -n 1 | sed 's/.*\(curl-[0-9_]*\).*/\1/')
+  echo "*** Use git tag $tag"
+
+  # move away the original tarball
+  mv "$tarball" "_tarballs/orig-$tarball"
+
+  prevtag=$(git symbolic-ref -q --short HEAD || git rev-parse HEAD)
+  git checkout -f "$tag"
+
+  ./scripts/dmaketgz "$curlver" "$timestamp"
+
+  # switch back to where it was
+  git checkout -f "$prevtag"
+
+  for f in "curl-$curlver.tar.gz" "curl-$curlver.tar.bz2" "curl-$curlver.tar.xz" "curl-$curlver.zip"; do
+    mv "$f" _tarballs/
+  done
+fi
+cd "_tarballs"
+
+# compare the new tarball against the original
+sha256sum -c checksum
diff --git a/third-party/curl/scripts/wcurl b/third-party/curl/scripts/wcurl
new file mode 100644
index 0000000000..a5c1f95e1c
--- /dev/null
+++ b/third-party/curl/scripts/wcurl
@@ -0,0 +1,352 @@
+#!/bin/sh
+
+# wcurl - a simple wrapper around curl to easily download files.
+#
+# Requires curl >= 7.46.0 (2015)
+#
+# Copyright (C) Samuel Henrique <samueloph@debian.org>, Sergio Durigan
+# Junior <sergiodj@debian.org> and many contributors, see the AUTHORS
+# file.
+#
+# Permission to use, copy, modify, and distribute this software for any purpose
+# with or without fee is hereby granted, provided that the above copyright
+# notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN
+# NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+# DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
+# OR OTHER DEALINGS IN THE SOFTWARE.
+#
+# Except as contained in this notice, the name of a copyright holder shall not be
+# used in advertising or otherwise to promote the sale, use or other dealings in
+# this Software without prior written authorization of the copyright holder.
+#
+# SPDX-License-Identifier: curl
+
+# Stop on errors and on usage of unset variables.
+set -eu
+
+VERSION="2026.01.05"
+
+PROGRAM_NAME="$(basename "$0")"
+readonly PROGRAM_NAME
+
+# Display the version.
+print_version()
+{
+    cat << _EOF_
+${VERSION}
+_EOF_
+}
+
+# Display the program usage.
+usage()
+{
+    cat << _EOF_
+${PROGRAM_NAME} -- a simple wrapper around curl to easily download files.
+
+Usage: ${PROGRAM_NAME} <URL>...
+       ${PROGRAM_NAME} [--curl-options <CURL_OPTIONS>]... [--no-decode-filename] [-o|-O|--output <PATH>] [--dry-run] [--] <URL>...
+       ${PROGRAM_NAME} [--curl-options=<CURL_OPTIONS>]... [--no-decode-filename] [--output=<PATH>] [--dry-run] [--] <URL>...
+       ${PROGRAM_NAME} -h|--help
+       ${PROGRAM_NAME} -V|--version
+
+Options:
+
+  --curl-options <CURL_OPTIONS>: Specify extra options to be passed when invoking curl. May be
+                                 specified more than once.
+
+  -o, -O, --output <PATH>: Use the provided output path instead of getting it from the URL. If
+                           multiple URLs are provided, resulting files share the same name with a
+                           number appended to the end (curl >= 7.83.0). If this option is provided
+                           multiple times, only the last value is considered.
+
+  --no-decode-filename: Do not percent-decode the output filename, even if the percent-encoding in
+                        the URL was done by wcurl, e.g.: The URL contained whitespace.
+
+  --dry-run: Do not actually execute curl, only print what would be invoked.
+
+  -V, --version: Print version information.
+
+  -h, --help: Print this usage message.
+
+  <CURL_OPTIONS>: Any option supported by curl can be set here. This is not used by wcurl; it is
+                 instead forwarded to the curl invocation.
+
+  <URL>: URL to be downloaded. Anything that is not a parameter is considered
+         an URL. Whitespace is percent-encoded and the URL is passed to curl, which
+         then performs the parsing. May be specified more than once.
+_EOF_
+}
+
+# Display an error message and bail out.
+error()
+{
+    printf "%s\n" "$*" >&2
+    exit 1
+}
+
+# Extra curl options provided by the user.
+# This is set per-URL for every URL provided.
+# Some options are global, but we are erroring on the side of needlessly setting
+# them multiple times instead of causing issues with parameters that needs to
+# be set per-URL.
+CURL_OPTIONS=""
+
+# The URLs to be downloaded.
+URLS=""
+
+# Variable used to be set to the percent-decoded filename parsed from the URL, unless
+# --output or --no-decode-filename are used.
+OUTPUT_PATH=""
+HAS_USER_SET_OUTPUT="false"
+
+# The parameters that are passed per-URL to curl.
+readonly PER_URL_PARAMETERS="\
+    --fail \
+    --globoff \
+    --location \
+    --proto-default https \
+    --remote-time \
+    --retry 5 "
+
+# Valid percent-encode codes that are considered unsafe to be decoded.
+# This is a list of space-separated percent-encoded uppercase
+# characters.
+# 2F = /
+# 5C = \
+# 3A = :
+readonly UNSAFE_PERCENT_ENCODE="%2F %5C %3A"
+
+# Whether to invoke curl or not.
+DRY_RUN="false"
+
+# Sanitize parameters.
+sanitize()
+{
+    if [ -z "${URLS}" ]; then
+        error "You must provide at least one URL to download."
+    fi
+
+    readonly CURL_OPTIONS URLS DRY_RUN HAS_USER_SET_OUTPUT
+}
+
+# Indicate via exit code whether the string given in the first parameter
+# consists solely of characters from the string given in the second parameter.
+# In other words, it returns 0 if the first parameter only contains characters
+# from the second parameter, e.g.: Are $1 characters a subset of $2 characters?
+is_subset_of()
+{
+    case "${1}" in
+        *[!${2}]* | '') return 1 ;;
+    esac
+}
+
+# Indicate via exit code whether the HTML code given in the first
+# parameter is safe to be decoded.
+is_safe_percent_encode()
+{
+    upper_str=$(printf "%s" "${1}" | tr "[:lower:]" "[:upper:]")
+    for unsafe in ${UNSAFE_PERCENT_ENCODE}; do
+        if [ "${unsafe}" = "${upper_str}" ]; then
+            return 1
+        fi
+    done
+
+    return 0
+}
+
+# Print the given string percent-decoded.
+percent_decode()
+{
+    # Encodings of control characters (00-1F) are passed through without decoding.
+    # Iterate on the input character-by-character, decoding it.
+    printf "%s\n" "${1}" | fold -w1 | while IFS= read -r decode_out; do
+        # If character is a "%", read the next character as decode_hex1.
+        if [ "${decode_out}" = % ] && IFS= read -r decode_hex1; then
+            decode_out="${decode_out}${decode_hex1}"
+            # If there is one more character, read it as decode_hex2.
+            if IFS= read -r decode_hex2; then
+                decode_out="${decode_out}${decode_hex2}"
+                # Skip decoding if this is a control character (00-1F).
+                # Skip decoding if DECODE_FILENAME is not "true".
+                if [ "${DECODE_FILENAME}" = "true" ] \
+                    && is_subset_of "${decode_hex1}" "23456789abcdefABCDEF" \
+                    && is_subset_of "${decode_hex2}" "0123456789abcdefABCDEF" \
+                    && is_safe_percent_encode "${decode_out}"; then
+                    # Use printf to decode it into octal and then decode it to the final format.
+                    decode_out="$(printf "%b" "\\$(printf %o "0x${decode_hex1}${decode_hex2}")")"
+                fi
+            fi
+        fi
+        printf %s "${decode_out}"
+    done
+}
+
+# Print the percent-decoded filename portion of the given URL.
+get_url_filename()
+{
+    # Remove protocol and query string if present.
+    hostname_and_path="$(printf %s "${1}" | sed -e 's,^[^/]*//,,' -e 's,?.*$,,')"
+    # If what remains contains a slash, there is a path; return it percent-decoded.
+    case "${hostname_and_path}" in
+        # sed to remove everything preceding the last '/', e.g.: "example/something" becomes "something"
+        # sed to also replace ':' with the percent_encoded %3A
+        */*) percent_decode "$(printf %s "${hostname_and_path}" | sed -e 's,^.*/,,' -e 's,:,%3A,g')" ;;
+    esac
+    # No slash means there was only a hostname and no path; return empty string.
+}
+
+# Execute curl with the list of URLs provided by the user.
+exec_curl()
+{
+    CMD="curl "
+
+    # Store version to check if it supports --no-clobber, --parallel and --parallel-max-host.
+    curl_version=$($CMD --version | cut -f2 -d' ' | head -n1)
+    curl_version_major=$(echo "$curl_version" | cut -f1 -d.)
+    curl_version_minor=$(echo "$curl_version" | cut -f2 -d.)
+
+    CURL_NO_CLOBBER=""
+    CURL_PARALLEL=""
+
+    if [ "${curl_version_major}" -ge 8 ]; then
+        CURL_NO_CLOBBER="--no-clobber"
+        CURL_PARALLEL="--parallel --parallel-max-host 5"
+
+        # --parallel-max-host is only supported since 8.16.0.
+        if [ "${curl_version_major}" -eq 8 ] && [ "${curl_version_minor}" -lt 16 ]; then
+            CURL_PARALLEL="--parallel"
+        fi
+    elif [ "${curl_version_major}" -eq 7 ]; then
+        # --no-clobber is only supported since 7.83.0.
+        if [ "${curl_version_minor}" -ge 83 ]; then
+            CURL_NO_CLOBBER="--no-clobber"
+        fi
+        # --parallel is only supported since 7.66.0.
+        if [ "${curl_version_minor}" -ge 66 ]; then
+            CURL_PARALLEL="--parallel"
+        fi
+    fi
+
+    # Detecting whether we need --parallel. It is easier to rely on
+    # the shell's argument parsing.
+    # shellcheck disable=SC2086
+    set -- $URLS
+
+    # If there are less than two URLs, do not set the parallel flag.
+    if [ "$#" -lt 2 ]; then
+        CURL_PARALLEL=""
+    fi
+
+    # Start assembling the command.
+    #
+    # We use 'set --' here (again) because (a) we do not have arrays on
+    # POSIX shell, and (b) we need better control over the way we
+    # split arguments.
+    #
+    # shellcheck disable=SC2086
+    set -- ${CMD} ${CURL_PARALLEL}
+
+    NEXT_PARAMETER=""
+    for url in ${URLS}; do
+        # If the user did not provide an output path, define one.
+        if [ "${HAS_USER_SET_OUTPUT}" = "false" ]; then
+            OUTPUT_PATH="$(get_url_filename "${url}")"
+            # If we could not get a path from the URL, use the default: index.html.
+            [ -z "${OUTPUT_PATH}" ] && OUTPUT_PATH=index.html
+        fi
+        # shellcheck disable=SC2086
+        set -- "$@" ${NEXT_PARAMETER} ${PER_URL_PARAMETERS} ${CURL_NO_CLOBBER} --output "${OUTPUT_PATH}" ${CURL_OPTIONS} "${url}"
+        NEXT_PARAMETER="--next"
+    done
+
+    if [ "${DRY_RUN}" = "false" ]; then
+        exec "$@"
+    else
+        printf "%s\n" "$@"
+    fi
+}
+
+# Default to decoding the output filename
+DECODE_FILENAME="true"
+
+# Use "${1-}" in order to avoid errors because of 'set -u'.
+while [ -n "${1-}" ]; do
+    case "${1}" in
+        --curl-options=*)
+            opt=$(printf "%s\n" "${1}" | sed 's/^--curl-options=//')
+            CURL_OPTIONS="${CURL_OPTIONS} ${opt}"
+            ;;
+
+        --curl-options)
+            shift
+            CURL_OPTIONS="${CURL_OPTIONS} ${1}"
+            ;;
+
+        --dry-run)
+            DRY_RUN="true"
+            ;;
+
+        --output=*)
+            opt=$(printf "%s\n" "${1}" | sed 's/^--output=//')
+            HAS_USER_SET_OUTPUT="true"
+            OUTPUT_PATH="${opt}"
+            ;;
+
+        -o | -O | --output)
+            shift
+            HAS_USER_SET_OUTPUT="true"
+            OUTPUT_PATH="${1}"
+            ;;
+
+        -o* | -O*)
+            opt=$(printf "%s\n" "${1}" | sed 's/^-[oO]//')
+            HAS_USER_SET_OUTPUT="true"
+            OUTPUT_PATH="${opt}"
+            ;;
+
+        --no-decode-filename)
+            DECODE_FILENAME="false"
+            ;;
+
+        -h | --help)
+            usage
+            exit 0
+            ;;
+
+        -V | --version)
+            print_version
+            exit 0
+            ;;
+
+        --)
+            # This is the start of the list of URLs.
+            shift
+            for url in "$@"; do
+                # Encode whitespace into %20, since wget supports those URLs.
+                newurl=$(printf "%s\n" "${url}" | sed 's/ /%20/g')
+                URLS="${URLS} ${newurl}"
+            done
+            break
+            ;;
+
+        -*)
+            error "Unknown option: '$1'."
+            ;;
+
+        *)
+            # This must be a URL.
+            # Encode whitespace into %20, since wget supports those URLs.
+            newurl=$(printf "%s\n" "${1}" | sed 's/ /%20/g')
+            URLS="${URLS} ${newurl}"
+            ;;
+    esac
+    shift
+done
+
+sanitize
+exec_curl
diff --git a/third-party/curl/src/.checksrc b/third-party/curl/src/.checksrc
new file mode 100644
index 0000000000..bc97c06028
--- /dev/null
+++ b/third-party/curl/src/.checksrc
@@ -0,0 +1,5 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+enable STDERR
diff --git a/third-party/curl/src/.gitignore b/third-party/curl/src/.gitignore
index c132010c4b..67410d9042 100644
--- a/third-party/curl/src/.gitignore
+++ b/third-party/curl/src/.gitignore
@@ -2,13 +2,9 @@
 #
 # SPDX-License-Identifier: curl
 
-*.a
-*.nlm
-*.res
-config-win32.h
 curl
-curl_config.h
-curl_config.h.in
-stamp-h2
+tool_ca_embed.c
 tool_hugehelp.c
-tool_version.h.dist
+curltool_unity.c
+libcurltool_unity.c
+curlinfo
diff --git a/third-party/curl/src/CMakeLists.txt b/third-party/curl/src/CMakeLists.txt
index 3a0452b327..1f76839009 100644
--- a/third-party/curl/src/CMakeLists.txt
+++ b/third-party/curl/src/CMakeLists.txt
@@ -21,104 +21,133 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-set(EXE_NAME curl)
 
-if(USE_MANUAL)
-  # Use the C locale to ensure that only ASCII characters appear in the
-  # embedded text. NROFF and MANOPT are set in the parent CMakeLists.txt
-  add_custom_command(
-    OUTPUT tool_hugehelp.c
-    COMMAND ${CMAKE_COMMAND} -E echo "#include \"tool_setup.h\"" > tool_hugehelp.c
-    COMMAND ${CMAKE_COMMAND} -E echo "#ifndef HAVE_LIBZ" >> tool_hugehelp.c
-    COMMAND env LC_ALL=C "${NROFF}" ${NROFF_MANOPT}
-            "${CURL_BINARY_DIR}/docs/curl.1" |
-            "${PERL_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/mkhelp.pl" >> tool_hugehelp.c
-    COMMAND ${CMAKE_COMMAND} -E echo "#else" >> tool_hugehelp.c
-    COMMAND env LC_ALL=C "${NROFF}" ${NROFF_MANOPT}
-            "${CURL_BINARY_DIR}/docs/curl.1" |
-            "${PERL_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/mkhelp.pl" -c >> tool_hugehelp.c
-    COMMAND ${CMAKE_COMMAND} -E echo "#endif /* HAVE_LIBZ */" >> tool_hugehelp.c
-    DEPENDS
-      generate-curl.1
-      "${CURL_BINARY_DIR}/docs/curl.1"
-      "${CMAKE_CURRENT_SOURCE_DIR}/mkhelp.pl"
-      "${CMAKE_CURRENT_SOURCE_DIR}/tool_hugehelp.h"
-    VERBATIM)
-else()
-  add_custom_command(
-    OUTPUT tool_hugehelp.c
-    COMMAND ${CMAKE_COMMAND} -E echo "#include \"tool_hugehelp.h\"" > tool_hugehelp.c
-    DEPENDS
-      "${CMAKE_CURRENT_SOURCE_DIR}/tool_hugehelp.h"
-    VERBATIM)
+set_property(DIRECTORY APPEND PROPERTY COMPILE_DEFINITIONS "${CURL_DEBUG_MACROS}")
 
+set(_curl_cfiles_gen "")
+set(_curl_hfiles_gen "")
+set(_curl_definitions "")
+
+if(ENABLE_CURL_MANUAL AND (Perl_FOUND OR EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/tool_hugehelp.c"))
+  if(Perl_FOUND)
+    add_custom_command(OUTPUT "tool_hugehelp.c"
+      COMMAND ${CMAKE_COMMAND} -E echo "#include \"tool_setup.h\"" > "tool_hugehelp.c"
+      COMMAND ${CMAKE_COMMAND} -E echo "/* !checksrc! disable COPYRIGHT all */" >> "tool_hugehelp.c"
+      COMMAND ${CMAKE_COMMAND} -E echo "/* !checksrc! disable INCLUDEDUP all */" >> "tool_hugehelp.c"
+      COMMAND ${CMAKE_COMMAND} -E echo "/* !checksrc! disable LONGLINE all */" >> "tool_hugehelp.c"
+      COMMAND ${CMAKE_COMMAND} -E echo "#ifndef HAVE_LIBZ" >> "tool_hugehelp.c"
+      COMMAND "${PERL_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/mkhelp.pl"    < "${CURL_ASCIIPAGE}" >> "tool_hugehelp.c"
+      COMMAND ${CMAKE_COMMAND} -E echo "#else" >> "tool_hugehelp.c"
+      COMMAND "${PERL_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/mkhelp.pl" -c < "${CURL_ASCIIPAGE}" >> "tool_hugehelp.c"
+      COMMAND ${CMAKE_COMMAND} -E echo "#endif /* HAVE_LIBZ */" >> "tool_hugehelp.c"
+      DEPENDS
+        generate-curl.1
+        "${CMAKE_CURRENT_SOURCE_DIR}/mkhelp.pl"
+        "${CMAKE_CURRENT_SOURCE_DIR}/tool_hugehelp.h"
+        "${CURL_ASCIIPAGE}"
+      VERBATIM)
+  else()
+    message(STATUS "Perl not found. Using the pre-built tool_hugehelp.c found in the source tree.")
+  endif()
+  list(APPEND _curl_cfiles_gen "tool_hugehelp.c")
+  list(APPEND _curl_hfiles_gen "tool_hugehelp.h")
+  list(APPEND _curl_definitions "USE_MANUAL")
 endif()
 
-transform_makefile_inc("Makefile.inc" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
-include(${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake)
-
-if(WIN32)
-  list(APPEND CURL_CFILES curl.rc)
+if(CURL_CA_EMBED_SET)
+  if(Perl_FOUND)
+    add_custom_command(OUTPUT "tool_ca_embed.c"
+      COMMAND "${PERL_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/mk-file-embed.pl" --var curl_ca_embed
+        < "${CURL_CA_EMBED}" > "tool_ca_embed.c"
+      DEPENDS
+        "${CMAKE_CURRENT_SOURCE_DIR}/mk-file-embed.pl"
+        "${CURL_CA_EMBED}"
+      VERBATIM)
+    list(APPEND _curl_cfiles_gen "tool_ca_embed.c")
+    list(APPEND _curl_definitions "CURL_CA_EMBED")
+  else()
+    message(WARNING "Perl not found. Cannot embed the CA bundle.")
+  endif()
+endif()
+
+# Get CURL_CFILES, CURL_HFILES, CURLX_CFILES, CURLX_HFILES, CURL_RCFILES variables
+curl_transform_makefile_inc("Makefile.inc" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
+include("${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
+
+source_group("curl source files" FILES ${CURL_CFILES} ${_curl_cfiles_gen})
+source_group("curl header files" FILES ${CURL_HFILES} ${_curl_hfiles_gen})
+source_group("curlx source files" FILES ${CURLX_CFILES})
+source_group("curlx header files" FILES ${CURLX_HFILES})
+
+set(_curlx_cfiles_lib ${CURLX_CFILES})
+set(_curlx_hfiles_lib ${CURLX_HFILES})
+if(LIB_SELECTED STREQUAL LIB_STATIC)
+  set(_curlx_cfiles_lib "")
+  set(_curlx_hfiles_lib "")
 endif()
 
-# CURL_CFILES, CURLX_CFILES, CURL_HFILES come from Makefile.inc
 if(BUILD_STATIC_CURL)
-  set(CURLX_CFILES ../lib/dynbuf.c ../lib/base64.c)
+  set(CURLX_CFILES "")
+  set(CURLX_HFILES "")
 endif()
 
-add_executable(
-  ${EXE_NAME}
-  ${CURL_CFILES} ${CURLX_CFILES} ${CURL_HFILES}
-  )
-
-add_executable(
-  ${PROJECT_NAME}::${EXE_NAME}
-  ALIAS ${EXE_NAME}
-  )
-
-add_library(
-  curltool # special libcurltool library just for unittests
-  STATIC
-  EXCLUDE_FROM_ALL
-  ${CURL_CFILES} ${CURLX_CFILES} ${CURL_HFILES}
+set_property(DIRECTORY APPEND PROPERTY INCLUDE_DIRECTORIES
+  "${PROJECT_BINARY_DIR}/lib"        # for "curl_config.h"
+  "${PROJECT_SOURCE_DIR}/lib"        # for "curl_setup.h", curlx
+  "${CMAKE_CURRENT_SOURCE_DIR}"      # for "tool_hugehelp.c"
 )
-target_compile_definitions(curltool PUBLIC UNITTESTS CURL_STATICLIB)
+
+# Build curl executable
+add_executable(${EXE_NAME} ${CURL_CFILES} ${CURL_HFILES} ${_curl_cfiles_gen} ${_curl_hfiles_gen} ${CURLX_CFILES} ${CURLX_HFILES})
+target_compile_definitions(${EXE_NAME} PRIVATE ${_curl_definitions})
+target_link_libraries(${EXE_NAME} ${LIB_SELECTED_FOR_EXE} ${CURL_LIBS})
+set_property(TARGET ${EXE_NAME} APPEND PROPERTY COMPILE_OPTIONS "${CURL_CFLAGS}")
+if(WIN32)
+  set_property(TARGET ${EXE_NAME} APPEND PROPERTY SOURCES ${CURL_RCFILES})
+endif()
+
+add_executable(${PROJECT_NAME}::${EXE_NAME} ALIAS ${EXE_NAME})
+
+add_executable(curlinfo EXCLUDE_FROM_ALL "curlinfo.c")
+target_link_libraries(curlinfo PRIVATE ${CURL_LIBS})
+set_target_properties(curlinfo PROPERTIES UNITY_BUILD OFF)
+
+# special libcurltool library for unittests
+add_library(curltool STATIC EXCLUDE_FROM_ALL ${CURL_CFILES} ${CURL_HFILES} ${_curlx_cfiles_lib} ${_curlx_hfiles_lib})
+target_compile_definitions(curltool PUBLIC "CURL_STATICLIB" "UNITTESTS")
+target_link_libraries(curltool PUBLIC ${CURL_LIBS})
+set_target_properties(curltool PROPERTIES UNITY_BUILD ON C_CLANG_TIDY "")
 
 if(CURL_HAS_LTO)
-  set_target_properties(${EXE_NAME} PROPERTIES
-    INTERPROCEDURAL_OPTIMIZATION_RELEASE TRUE
-    INTERPROCEDURAL_OPTIMIZATION_RELWITHDEBINFO TRUE)
+  set_target_properties(${EXE_NAME} PROPERTIES INTERPROCEDURAL_OPTIMIZATION TRUE)
+endif()
+if(CURL_CLANG_TIDY)
+  set_target_properties(${EXE_NAME} PROPERTIES UNITY_BUILD OFF)
+endif()
+if(CURL_ANALYZER_CFLAGS)
+  set_target_properties(${EXE_NAME} PROPERTIES UNITY_BUILD OFF)
+  set_property(TARGET ${EXE_NAME} APPEND PROPERTY COMPILE_OPTIONS ${CURL_ANALYZER_CFLAGS})
 endif()
 
 if(ENABLE_UNICODE AND MINGW)
-  target_link_libraries(${EXE_NAME} -municode)
+  set_property(TARGET ${EXE_NAME} APPEND PROPERTY LINK_OPTIONS "-municode")
 endif()
 
-source_group("curlX source files" FILES ${CURLX_CFILES})
-source_group("curl source files" FILES ${CURL_CFILES})
-source_group("curl header files" FILES ${CURL_HFILES})
-
-include_directories(
-  ${CURL_SOURCE_DIR}/lib        # To be able to reach "curl_setup_once.h"
-  ${CURL_BINARY_DIR}/lib        # To be able to reach "curl_config.h"
-  ${CURL_BINARY_DIR}/include    # To be able to reach "curl/curl.h"
-  # This is needed as tool_hugehelp.c is generated in the binary dir
-  ${CURL_SOURCE_DIR}/src        # To be able to reach "tool_hugehelp.h"
-  )
-
-#Build curl executable
-target_link_libraries(${EXE_NAME} ${LIB_SELECTED_FOR_EXE} ${CURL_LIBS})
+if(CURL_CODE_COVERAGE)
+  set_property(TARGET ${EXE_NAME} APPEND PROPERTY COMPILE_DEFINITIONS ${CURL_COVERAGE_MACROS})
+  set_property(TARGET ${EXE_NAME} APPEND PROPERTY COMPILE_OPTIONS ${CURL_COVERAGE_CFLAGS})
+  set_property(TARGET ${EXE_NAME} APPEND PROPERTY LINK_OPTIONS ${CURL_COVERAGE_LDFLAGS})
+endif()
 
 ################################################################################
 
-#SET_TARGET_PROPERTIES(${EXE_NAME} ARCHIVE_OUTPUT_DIRECTORY "blah blah blah")
-#SET_TARGET_PROPERTIES(${EXE_NAME} RUNTIME_OUTPUT_DIRECTORY "blah blah blah")
-#SET_TARGET_PROPERTIES(${EXE_NAME} LIBRARY_OUTPUT_DIRECTORY "blah blah blah")
+if(CURL_ENABLE_EXPORT_TARGET)
+  if(NOT CURL_DISABLE_INSTALL)
+    install(TARGETS ${EXE_NAME} EXPORT ${TARGETS_EXPORT_NAME} DESTINATION ${CMAKE_INSTALL_BINDIR})
+  endif()
 
-#INCLUDE(ModuleInstall OPTIONAL)
-
-install(TARGETS ${EXE_NAME} EXPORT ${TARGETS_EXPORT_NAME} DESTINATION ${CMAKE_INSTALL_BINDIR})
-export(TARGETS ${EXE_NAME}
-       FILE ${PROJECT_BINARY_DIR}/curl-target.cmake
-       NAMESPACE ${PROJECT_NAME}::
-)
+  export(TARGETS ${EXE_NAME}
+    FILE "${PROJECT_BINARY_DIR}/curl-target.cmake"
+    NAMESPACE ${PROJECT_NAME}::
+  )
+endif()
diff --git a/third-party/curl/src/Makefile.am b/third-party/curl/src/Makefile.am
index ed2df5ef57..69554ee490 100644
--- a/third-party/curl/src/Makefile.am
+++ b/third-party/curl/src/Makefile.am
@@ -26,6 +26,11 @@ AUTOMAKE_OPTIONS = foreign nostdinc
 # remove targets if the command fails
 .DELETE_ON_ERROR:
 
+# Get CURL_CFILES, CURL_HFILES, CURLX_CFILES, CURLX_HFILES, CURL_RCFILES variables
+include Makefile.inc
+
+EXTRA_DIST = CMakeLists.txt .checksrc mk-file-embed.pl mkhelp.pl $(CURL_RCFILES)
+
 # Specify our include paths here, and do it relative to $(top_srcdir) and
 # $(top_builddir), to ensure that these paths which belong to the library
 # being currently built and tested are searched before the library which
@@ -33,65 +38,88 @@ AUTOMAKE_OPTIONS = foreign nostdinc
 #
 # $(top_srcdir)/include is for libcurl's external include files
 # $(top_builddir)/lib is for libcurl's generated lib/curl_config.h file
-# $(top_builddir)/src is for curl's generated src/curl_config.h file
 # $(top_srcdir)/lib for libcurl's lib/curl_setup.h and other "borrowed" files
-# $(top_srcdir)/src is for curl's src/tool_setup.h and "curl-private" files
+# $(srcdir) for generated sources to find included sources
 
 AM_CPPFLAGS = -I$(top_srcdir)/include        \
               -I$(top_builddir)/lib          \
-              -I$(top_builddir)/src          \
               -I$(top_srcdir)/lib            \
-              -I$(top_srcdir)/src
+              -I$(srcdir)
 
 bin_PROGRAMS = curl
 
-SUBDIRS = ../docs
+curlinfo_SOURCES = curlinfo.c
+noinst_PROGRAMS = curlinfo
 
 if USE_CPPFLAG_CURL_STATICLIB
 AM_CPPFLAGS += -DCURL_STATICLIB
 endif
+if DEBUGBUILD
+AM_CPPFLAGS += -DDEBUGBUILD
+endif
 
-include Makefile.inc
+if USE_UNICODE
+UNICODEFLAG = -municode
+endif
 
-# CURL_FILES comes from Makefile.inc
-curl_SOURCES = $(CURL_FILES)
+curl_cfiles_gen =
+curl_hfiles_gen =
+CLEANFILES =
+
+if USE_CPPFLAG_CURL_STATICLIB
+curlx_csrc =
+curlx_hsrc =
+else
+# These are part of the libcurl static lib. Add them here when linking shared.
+curlx_csrc = $(CURLX_CFILES)
+curlx_hsrc = $(CURLX_HFILES)
+endif
+
+if USE_UNITY
+curltool_unity.c: $(top_srcdir)/scripts/mk-unity.pl $(CURL_CFILES) $(curl_cfiles_gen) $(curlx_csrc)
+	@PERL@ $(top_srcdir)/scripts/mk-unity.pl --include $(CURL_CFILES) $(curl_cfiles_gen) $(curlx_csrc) > curltool_unity.c
+
+nodist_curl_SOURCES = curltool_unity.c
+curl_SOURCES =
+CLEANFILES += curltool_unity.c
+else
+curl_SOURCES = $(CURL_CFILES) $(CURL_HFILES) $(curl_cfiles_gen) $(curl_hfiles_gen) $(curlx_csrc) $(curlx_hsrc)
+endif
 if HAVE_WINDRES
 curl_SOURCES += $(CURL_RCFILES)
 $(CURL_RCFILES): tool_version.h
 endif
 
+curl_LDFLAGS = $(CURL_LDFLAGS_BIN) $(UNICODEFLAG)
+
 # This might hold -Werror
 CFLAGS += @CURL_CFLAG_EXTRAS@
 
 # Prevent LIBS from being used for all link targets
 LIBS = $(BLANK_AT_MAKETIME)
 
-if USE_EXPLICIT_LIB_DEPS
-curl_LDADD = $(top_builddir)/lib/libcurl.la @LIBCURL_LIBS@
-else
-curl_LDADD = $(top_builddir)/lib/libcurl.la @SSL_LIBS@ @ZLIB_LIBS@ @CURL_NETWORK_AND_TIME_LIBS@
-endif
+curl_LDADD = $(top_builddir)/lib/libcurl.la @LIBCURL_PC_LIBS_PRIVATE@
 
 # if unit tests are enabled, build a static library to link them with
 if BUILD_UNITTESTS
 noinst_LTLIBRARIES = libcurltool.la
-libcurltool_la_CPPFLAGS = $(AM_CPPFLAGS) \
-                          -DCURL_STATICLIB -DUNITTESTS
+libcurltool_la_CPPFLAGS = $(AM_CPPFLAGS) -DCURL_STATICLIB -DUNITTESTS
 libcurltool_la_CFLAGS =
-libcurltool_la_LDFLAGS = -static $(LINKFLAGS)
-libcurltool_la_SOURCES = $(CURL_FILES)
+libcurltool_la_LDFLAGS = -static $(LIBCURL_PC_LIBS_PRIVATE)
+if USE_UNITY
+libcurltool_unity.c: $(top_srcdir)/scripts/mk-unity.pl $(CURL_CFILES) $(curlx_csrc)
+	@PERL@ $(top_srcdir)/scripts/mk-unity.pl --include $(CURL_CFILES) $(curlx_csrc) > libcurltool_unity.c
+
+nodist_libcurltool_la_SOURCES = libcurltool_unity.c
+libcurltool_la_SOURCES =
+CLEANFILES += libcurltool_unity.c
+else
+libcurltool_la_SOURCES = $(CURL_CFILES) $(CURL_HFILES) $(curlx_csrc) $(curlx_hsrc)
+endif
 endif
 
-CLEANFILES = tool_hugehelp.c
-# Use the C locale to ensure that only ASCII characters appear in the
-# embedded text.
-NROFF=env LC_ALL=C @NROFF@ @MANOPT@ 2>/dev/null # figured out by the configure script
-
-EXTRA_DIST = mkhelp.pl \
- Makefile.mk curl.rc Makefile.inc CMakeLists.txt
-
 # Use absolute directory to disable VPATH
-MANPAGE=$(abs_top_builddir)/docs/curl.1
+ASCIIPAGE=$(top_builddir)/docs/cmdline-opts/curl.txt
 MKHELP=$(top_srcdir)/src/mkhelp.pl
 HUGE=tool_hugehelp.c
 
@@ -100,63 +128,114 @@ HUGEIT_0 = @echo "  HUGE    " $@;
 HUGEIT_1 =
 HUGEIT_ = $(HUGEIT_0)
 
-CHECKSRC = $(CS_$(V))
-CS_0 = @echo "  RUN     " $@;
-CS_1 =
-CS_ = $(CS_0)
+curl_CPPFLAGS = $(AM_CPPFLAGS)
 
 if USE_MANUAL
 # Here are the stuff to create a built-in manual
+curl_CPPFLAGS += -DUSE_MANUAL
 
-$(MANPAGE):
+$(ASCIIPAGE):
 	cd $(top_builddir)/docs && $(MAKE)
 
+if PERL
 if HAVE_LIBZ
 # This generates the tool_hugehelp.c file in both uncompressed and
 # compressed formats.
-$(HUGE): $(MANPAGE) $(MKHELP)
-	$(HUGECMD) (echo '#include "tool_setup.h"' > $(HUGE);   \
-	echo '#ifndef HAVE_LIBZ' >> $(HUGE);                    \
-	$(NROFF) $(MANPAGE) | $(PERL) $(MKHELP) >> $(HUGE);     \
-	echo '#else' >> $(HUGE);                                \
-	$(NROFF) $(MANPAGE) | $(PERL) $(MKHELP) -c >> $(HUGE);  \
+$(HUGE): $(ASCIIPAGE) $(MKHELP)
+	$(HUGECMD)(                                                \
+	echo '/* !checksrc! disable COPYRIGHT all */' > $(HUGE);   \
+	echo '/* !checksrc! disable INCLUDEDUP all */' >> $(HUGE); \
+	echo '/* !checksrc! disable LONGLINE all */' >> $(HUGE);   \
+	echo '#include "tool_setup.h"' >> $(HUGE);                 \
+	echo '#ifndef HAVE_LIBZ' >> $(HUGE);                       \
+	@PERL@ $(MKHELP) < $(ASCIIPAGE) >> $(HUGE);                \
+	echo '#else' >> $(HUGE);                                   \
+	@PERL@ $(MKHELP) -c < $(ASCIIPAGE) >> $(HUGE);             \
 	echo '#endif /* HAVE_LIBZ */' >> $(HUGE) )
 else # HAVE_LIBZ
 # This generates the tool_hugehelp.c file uncompressed only
-$(HUGE): $(MANPAGE) $(MKHELP)
-	$(HUGECMD)(echo '#include "tool_setup.h"' > $(HUGE);    \
-	$(NROFF) $(MANPAGE) | $(PERL) $(MKHELP) >> $(HUGE) )
+$(HUGE): $(ASCIIPAGE) $(MKHELP)
+	$(HUGECMD)(                                                \
+	echo '/* !checksrc! disable COPYRIGHT all */' > $(HUGE);   \
+	echo '#include "tool_setup.h"' >> $(HUGE);                 \
+	@PERL@ $(MKHELP) < $(ASCIIPAGE) >> $(HUGE) )
+endif
+else # PERL
+$(HUGE):
+	$(HUGECMD)(                                                \
+	if test ! -f "$(srcdir)/$(HUGE)"; then                     \
+	  echo '/* !checksrc! disable COPYRIGHT all */' > $(HUGE); \
+	  echo '#include "tool_hugehelp.h"' >> $(HUGE);            \
+	  echo 'void hugehelp(void) {}' >> $(HUGE);                \
+	  echo 'void showhelp(const char *trigger, const char *arg, const char *endarg)' >> $(HUGE); \
+	  echo '{' >> $(HUGE);                                     \
+	  echo '  (void)trigger; (void)arg; (void)endarg;' >> $(HUGE); \
+	  echo '}' >> $(HUGE);                                     \
+	fi)
 endif
 
 else # USE_MANUAL
 # built-in manual has been disabled, make a blank file
 $(HUGE):
+	echo '/* !checksrc! disable COPYRIGHT all */' > $(HUGE);   \
 	echo '#include "tool_hugehelp.h"' >> $(HUGE)
 endif
 
-# ignore tool_hugehelp.c since it is generated source code and it plays
-# by slightly different rules!
-checksrc:
-	$(CHECKSRC)(@PERL@ $(top_srcdir)/scripts/checksrc.pl -D$(srcdir) \
-	-W$(srcdir)/tool_hugehelp.c $(srcdir)/*.[ch])
+curl_cfiles_gen += $(HUGE)
+curl_hfiles_gen += tool_hugehelp.h
+CLEANFILES += $(HUGE)
 
-if CURLDEBUG
+CA_EMBED_CSOURCE = tool_ca_embed.c
+curl_cfiles_gen += $(CA_EMBED_CSOURCE)
+CLEANFILES += $(CA_EMBED_CSOURCE)
+if CURL_CA_EMBED_SET
+curl_CPPFLAGS += -DCURL_CA_EMBED
+MK_FILE_EMBED = $(top_srcdir)/src/mk-file-embed.pl
+$(CA_EMBED_CSOURCE): $(MK_FILE_EMBED) $(CURL_CA_EMBED)
+	@PERL@ $(MK_FILE_EMBED) --var curl_ca_embed < $(CURL_CA_EMBED) > $(CA_EMBED_CSOURCE)
+else
+$(CA_EMBED_CSOURCE):
+	echo '/* !checksrc! disable COPYRIGHT all */' > $(CA_EMBED_CSOURCE)
+	echo 'extern const void *curl_ca_embed; const void *curl_ca_embed;' >> $(CA_EMBED_CSOURCE)
+endif
+
+CHECKSRC = $(CS_$(V))
+CS_0 = @echo "  RUN     " $@;
+CS_1 =
+CS_ = $(CS_0)
+
+# ignore generated C files since they play by slightly different rules!
+checksrc:
+	$(CHECKSRC)(@PERL@ $(top_srcdir)/scripts/checksrc.pl -D$(srcdir) $(CURL_CFILES) $(CURL_HFILES))
+
+if NOT_CURL_CI
+if DEBUGBUILD
 # for debug builds, we scan the sources on all regular make invokes
 all-local: checksrc
 endif
+endif
 
-# disable the tests that are mostly causing false positives
-TIDYFLAGS=-checks=-clang-analyzer-security.insecureAPI.strcpy,-clang-analyzer-optin.performance.Padding,-clang-analyzer-valist.Uninitialized,-clang-analyzer-core.NonNullParamChecker,-clang-analyzer-core.NullDereference
+_tidy_cflags =
+TIDYFLAGS =
+if CURL_WERROR
+TIDYFLAGS += '--warnings-as-errors=*'
+endif
+if CLANG
+_tidy_cflags += $(CFLAGS)
+endif
 
-TIDY:=clang-tidy
-
-tidy:
-	$(TIDY) $(CURL_CFILES) $(TIDYFLAGS) -- $(curl_CPPFLAGS) $(CPPFLAGS) -DHAVE_CONFIG_H
+tidy: $(HUGE) $(CA_EMBED_CSOURCE)
+	(_curl_cfiles=`echo ' $(CURL_CFILES)' | sed -e 's/ +/ /g' -e 's| | $(srcdir)/|g'`; \
+	@CLANG_TIDY@ --config-file=$(top_srcdir)/.clang-tidy.yml $(TIDYFLAGS) $(CURL_CLANG_TIDYFLAGS) $$_curl_cfiles $(curl_cfiles_gen) \
+	  -- $(curl_CPPFLAGS) $(CPPFLAGS) $(AM_CPPFLAGS) -DHAVE_CONFIG_H $(_tidy_cflags))
 
 listhelp:
-	(cd $(top_srcdir)/docs/cmdline-opts && ./gen.pl listhelp *.d) > tool_listhelp.c
+	(cd $(top_srcdir)/docs/cmdline-opts && make listhelp)
 
 if HAVE_WINDRES
 .rc.o:
-	$(RC) -I$(top_srcdir)/include -DCURL_EMBED_MANIFEST $(RCFLAGS) -i $< -o $@
+	$(RC) -I$(top_srcdir)/include $(RCFLAGS) -i $< -o $@
 endif
+
+dist-hook:
+	rm -f $(distdir)/$(CA_EMBED_CSOURCE)
diff --git a/third-party/curl/src/Makefile.inc b/third-party/curl/src/Makefile.inc
index edcea2f7ce..84c0a3a02d 100644
--- a/third-party/curl/src/Makefile.inc
+++ b/third-party/curl/src/Makefile.inc
@@ -21,46 +21,70 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# ./src/Makefile.inc
+# Shared between CMakeLists.txt and Makefile.am
+
 # Using the backslash as line continuation character might be problematic with
-# some make flavours. If we ever want to change this in a portable manner then
+# some make flavors. If we ever want to change this in a portable manner then
 # we should consider this idea :
 # CSRC1 = file1.c file2.c file3.c
 # CSRC2 = file4.c file5.c file6.c
 # CSOURCES = $(CSRC1) $(CSRC2)
 
-# libcurl has sources that provide functions named curlx_* that aren't part of
+# libcurl has sources that provide functions named curlx_* that are not part of
 # the official API, but we reuse the code here to avoid duplication.
 CURLX_CFILES = \
-  ../lib/base64.c \
-  ../lib/curl_multibyte.c \
-  ../lib/dynbuf.c \
-  ../lib/nonblock.c \
-  ../lib/strtoofft.c \
-  ../lib/timediff.c \
-  ../lib/version_win32.c \
-  ../lib/warnless.c
+  ../lib/curlx/base64.c \
+  ../lib/curlx/basename.c \
+  ../lib/curlx/dynbuf.c \
+  ../lib/curlx/fopen.c \
+  ../lib/curlx/multibyte.c \
+  ../lib/curlx/nonblock.c \
+  ../lib/curlx/strcopy.c \
+  ../lib/curlx/strdup.c \
+  ../lib/curlx/strerr.c \
+  ../lib/curlx/strparse.c \
+  ../lib/curlx/timediff.c \
+  ../lib/curlx/timeval.c \
+  ../lib/curlx/version_win32.c \
+  ../lib/curlx/wait.c \
+  ../lib/curlx/warnless.c \
+  ../lib/curlx/winapi.c
 
 CURLX_HFILES = \
   ../lib/curl_setup.h \
-  ../lib/strtoofft.h \
-  ../lib/timediff.h \
-  ../lib/nonblock.h \
-  ../lib/warnless.h \
-  ../lib/curl_ctype.h \
-  ../lib/curl_multibyte.h \
-  ../lib/version_win32.h \
-  ../lib/dynbuf.h
+  ../lib/curlx/base64.h \
+  ../lib/curlx/basename.h \
+  ../lib/curlx/dynbuf.h \
+  ../lib/curlx/fopen.h \
+  ../lib/curlx/multibyte.h \
+  ../lib/curlx/nonblock.h \
+  ../lib/curlx/strcopy.h \
+  ../lib/curlx/strdup.h \
+  ../lib/curlx/strerr.h \
+  ../lib/curlx/strparse.h \
+  ../lib/curlx/timediff.h \
+  ../lib/curlx/timeval.h \
+  ../lib/curlx/version_win32.h \
+  ../lib/curlx/wait.h \
+  ../lib/curlx/warnless.h \
+  ../lib/curlx/winapi.h
+
+TOOLX_CFILES = \
+  toolx/tool_time.c
+
+TOOLX_HFILES = \
+  toolx/tool_time.h
 
 CURL_CFILES = \
+  config2setopts.c \
   slist_wc.c \
-  tool_binmode.c \
-  tool_bname.c \
+  terminal.c \
   tool_cb_dbg.c \
   tool_cb_hdr.c \
   tool_cb_prg.c \
   tool_cb_rea.c \
   tool_cb_see.c \
+  tool_cb_soc.c \
   tool_cb_wrt.c \
   tool_cfgable.c \
   tool_dirhie.c \
@@ -73,7 +97,7 @@ CURL_CFILES = \
   tool_getpass.c \
   tool_help.c \
   tool_helpers.c \
-  tool_hugehelp.c \
+  tool_ipfs.c \
   tool_libinfo.c \
   tool_listhelp.c \
   tool_main.c \
@@ -83,27 +107,28 @@ CURL_CFILES = \
   tool_paramhlp.c \
   tool_parsecfg.c \
   tool_progress.c \
-  tool_stderr.c \
-  tool_strdup.c \
   tool_setopt.c \
-  tool_sleep.c \
+  tool_ssls.c \
+  tool_stderr.c \
   tool_urlglob.c \
   tool_util.c \
   tool_vms.c \
   tool_writeout.c \
   tool_writeout_json.c \
   tool_xattr.c \
-  var.c
+  var.c \
+  $(TOOLX_CFILES)
 
 CURL_HFILES = \
+  config2setopts.h \
   slist_wc.h \
-  tool_binmode.h \
-  tool_bname.h \
+  terminal.h \
   tool_cb_dbg.h \
   tool_cb_hdr.h \
   tool_cb_prg.h \
   tool_cb_rea.h \
   tool_cb_see.h \
+  tool_cb_soc.h \
   tool_cb_wrt.h \
   tool_cfgable.h \
   tool_dirhie.h \
@@ -116,7 +141,7 @@ CURL_HFILES = \
   tool_getpass.h \
   tool_help.h \
   tool_helpers.h \
-  tool_hugehelp.h \
+  tool_ipfs.h \
   tool_libinfo.h \
   tool_main.h \
   tool_msgs.h \
@@ -128,9 +153,8 @@ CURL_HFILES = \
   tool_sdecls.h \
   tool_setopt.h \
   tool_setup.h \
-  tool_sleep.h \
+  tool_ssls.h \
   tool_stderr.h \
-  tool_strdup.h \
   tool_urlglob.h \
   tool_util.h \
   tool_version.h \
@@ -138,9 +162,7 @@ CURL_HFILES = \
   tool_writeout.h \
   tool_writeout_json.h \
   tool_xattr.h \
-  var.h
+  var.h \
+  $(TOOLX_HFILES)
 
 CURL_RCFILES = curl.rc
-
-# curl_SOURCES is special and gets assigned in src/Makefile.am
-CURL_FILES = $(CURL_CFILES) $(CURLX_CFILES) $(CURL_HFILES)
diff --git a/third-party/curl/src/Makefile.mk b/third-party/curl/src/Makefile.mk
deleted file mode 100644
index 66882b3536..0000000000
--- a/third-party/curl/src/Makefile.mk
+++ /dev/null
@@ -1,111 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-#***************************************************************************
-
-# See usage in lib/Makefile.mk
-
-PROOT := ..
-
-### Common
-
-include $(PROOT)/lib/Makefile.mk
-
-### Local
-
-RCFLAGS  += -DCURL_EMBED_MANIFEST
-CPPFLAGS += -I$(PROOT)/lib
-LDFLAGS  += -L$(PROOT)/lib
-LIBS     := -lcurl $(LIBS)
-
-ifdef WIN32
-  ifneq ($(findstring -dyn,$(CFG)),)
-    DYN := 1
-  endif
-endif
-
-ifdef DYN
-  curl_DEPENDENCIES := $(PROOT)/lib/libcurl$(CURL_DLL_SUFFIX).dll
-  curl_DEPENDENCIES += $(PROOT)/lib/libcurl.dll.a
-else
-  curl_DEPENDENCIES := $(PROOT)/lib/libcurl.a
-  ifdef WIN32
-    CPPFLAGS += -DCURL_STATICLIB
-    LDFLAGS += -static
-  endif
-endif
-
-### Sources and targets
-
-# Provides CURL_CFILES, CURLX_CFILES, CURL_RCFILES
-include Makefile.inc
-
-TARGETS := curl$(BIN_EXT)
-
-CURL_CFILES += $(notdir $(CURLX_CFILES))
-
-curl_OBJECTS := $(patsubst %.c,$(OBJ_DIR)/%.o,$(strip $(CURL_CFILES)))
-ifdef WIN32
-curl_OBJECTS += $(patsubst %.rc,$(OBJ_DIR)/%.res,$(strip $(CURL_RCFILES)))
-endif
-ifdef MAP
-CURL_MAP := curl.map
-CURL_LDFLAGS_BIN += -Wl,-Map,$(CURL_MAP)
-TOVCLEAN := $(CURL_MAP)
-endif
-vpath %.c $(PROOT)/lib
-
-TOCLEAN := $(curl_OBJECTS)
-
-### Rules
-
-ifneq ($(wildcard tool_hugehelp.c.cvs),)
-PERL  ?= perl
-NROFF ?= groff
-
-TOCLEAN += tool_hugehelp.c
-
-ifneq ($(shell $(call WHICH, $(NROFF))),)
-$(PROOT)/docs/curl.1: $(wildcard $(PROOT)/docs/cmdline-opts/*.d)
-	cd $(PROOT)/docs/cmdline-opts && \
-	$(PERL) gen.pl mainpage $(notdir $^) > ../curl.1
-
-# Necessary for the generated tools_hugehelp.c
-CPPFLAGS += -DUSE_MANUAL
-
-ifdef ZLIB
-_MKHELPOPT += -c
-endif
-tool_hugehelp.c: $(PROOT)/docs/curl.1 mkhelp.pl
-	$(NROFF) -man -Tascii $(MANOPT) $< | \
-	$(PERL) mkhelp.pl $(_MKHELPOPT) $< > $@
-else
-tool_hugehelp.c:
-	@echo Creating $@
-	@$(call COPY, $@.cvs, $@)
-endif
-endif
-
-$(TARGETS): $(curl_OBJECTS) $(curl_DEPENDENCIES)
-	$(CC) $(LDFLAGS) $(CURL_LDFLAGS_BIN) -o $@ $(curl_OBJECTS) $(LIBS)
-
-all: $(OBJ_DIR) $(TARGETS)
diff --git a/third-party/curl/src/config2setopts.c b/third-party/curl/src/config2setopts.c
new file mode 100644
index 0000000000..8933668a2c
--- /dev/null
+++ b/third-party/curl/src/config2setopts.c
@@ -0,0 +1,1092 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "tool_setup.h"
+
+#include "tool_cfgable.h"
+#include "tool_setopt.h"
+#include "tool_findfile.h"
+#include "tool_formparse.h"
+#include "tool_msgs.h"
+#include "tool_libinfo.h"
+#include "tool_cb_soc.h"
+#include "tool_operate.h"
+#include "config2setopts.h"
+#include "tool_ipfs.h"
+#include "tool_cb_wrt.h"
+#include "tool_cb_rea.h"
+#include "tool_cb_see.h"
+#include "tool_cb_dbg.h"
+#include "tool_helpers.h"
+#include "tool_version.h"
+
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h> /* IPPROTO_IPV6 */
+#endif
+
+#define BUFFER_SIZE 102400L
+
+#ifdef IP_TOS
+static int get_address_family(curl_socket_t sockfd)
+{
+  struct sockaddr addr;
+  curl_socklen_t addrlen = sizeof(addr);
+  memset(&addr, 0, sizeof(addr));
+  if(getsockname(sockfd, &addr, &addrlen) == 0)
+    return addr.sa_family;
+  return AF_UNSPEC;
+}
+#endif
+
+#ifndef SOL_IP
+#define SOL_IP IPPROTO_IP
+#endif
+
+#if defined(IP_TOS) || defined(IPV6_TCLASS) || defined(SO_PRIORITY)
+static int sockopt_callback(void *clientp, curl_socket_t curlfd,
+                            curlsocktype purpose)
+{
+  struct OperationConfig *config = (struct OperationConfig *)clientp;
+  if(purpose != CURLSOCKTYPE_IPCXN)
+    return CURL_SOCKOPT_OK;
+  (void)config;
+  (void)curlfd;
+#if defined(IP_TOS) || defined(IPV6_TCLASS)
+  if(config->ip_tos > 0) {
+    int tos = (int)config->ip_tos;
+    int result = 0;
+    switch(get_address_family(curlfd)) {
+    case AF_INET:
+#ifdef IP_TOS
+      result = setsockopt(curlfd, SOL_IP, IP_TOS, (void *)&tos, sizeof(tos));
+#endif
+      break;
+#if defined(IPV6_TCLASS) && defined(AF_INET6)
+    case AF_INET6:
+      result = setsockopt(curlfd, IPPROTO_IPV6, IPV6_TCLASS,
+                          (void *)&tos, sizeof(tos));
+      break;
+#endif
+    }
+    if(result < 0) {
+      char buffer[STRERROR_LEN];
+      int error = errno;
+      warnf("Setting type of service to %d failed with errno %d: %s", tos,
+            error, curlx_strerror(error, buffer, sizeof(buffer)));
+    }
+  }
+#endif
+#ifdef SO_PRIORITY
+  if(config->vlan_priority > 0) {
+    int priority = (int)config->vlan_priority;
+    if(setsockopt(curlfd, SOL_SOCKET, SO_PRIORITY,
+                  (void *)&priority, sizeof(priority)) != 0) {
+      char buffer[STRERROR_LEN];
+      int error = errno;
+      warnf("VLAN priority %d failed with errno %d: %s", priority,
+            error, curlx_strerror(error, buffer, sizeof(buffer)));
+    }
+  }
+#endif
+  return CURL_SOCKOPT_OK;
+}
+#endif /* IP_TOD || IPV6_TCLASS || SO_PRIORITY */
+
+/* return current SSL backend name, chop off multissl */
+static char *ssl_backend(void)
+{
+  static char ssl_ver[80] = "no ssl";
+  static bool already = FALSE;
+  if(!already) { /* if there is no existing version */
+    const char *v = curl_version_info(CURLVERSION_NOW)->ssl_version;
+    if(v)
+      curl_msnprintf(ssl_ver, sizeof(ssl_ver),
+                     "%.*s", (int)strcspn(v, " "), v);
+    already = TRUE;
+  }
+  return ssl_ver;
+}
+
+/*
+ * Possibly rewrite the URL for IPFS and return the protocol token for the
+ * scheme used in the given URL.
+ */
+static CURLcode url_proto_and_rewrite(char **url,
+                                      struct OperationConfig *config,
+                                      const char **scheme)
+{
+  CURLcode result = CURLE_OK;
+  CURLU *uh = curl_url();
+  const char *proto = NULL;
+  *scheme = NULL;
+
+  DEBUGASSERT(url && *url);
+  if(uh) {
+    char *schemep = NULL;
+    CURLUcode uc =
+      curl_url_set(uh, CURLUPART_URL, *url,
+                   CURLU_GUESS_SCHEME | CURLU_NON_SUPPORT_SCHEME);
+    if(!uc) {
+      if(config->proto_default) {
+        /* when a default proto is requested, do not guess */
+        uc = curl_url_get(uh, CURLUPART_SCHEME, &schemep,
+                          CURLU_NO_GUESS_SCHEME);
+        if(uc == CURLUE_NO_SCHEME) {
+          /* use the default */
+          proto = proto_token(config->proto_default);
+          if(proto)
+            uc = CURLUE_OK;
+        }
+      }
+      else {
+        uc = curl_url_get(uh, CURLUPART_SCHEME, &schemep,
+                          CURLU_DEFAULT_SCHEME);
+      }
+      if(schemep)
+        proto = proto_token(schemep);
+#ifndef CURL_DISABLE_IPFS
+      if(!uc &&
+         (curl_strequal(schemep, proto_ipfs) ||
+          curl_strequal(schemep, proto_ipns))) {
+        result = ipfs_url_rewrite(uh, schemep, url, config);
+        /* short-circuit proto_token, we know it is ipfs or ipns */
+        if(curl_strequal(schemep, proto_ipfs))
+          proto = proto_ipfs;
+        else if(curl_strequal(schemep, proto_ipns))
+          proto = proto_ipns;
+        if(result)
+          config->synthetic_error = TRUE;
+      }
+#endif /* !CURL_DISABLE_IPFS */
+      if(uc == CURLUE_OUT_OF_MEMORY)
+        result = CURLE_OUT_OF_MEMORY;
+      curl_free(schemep);
+    }
+    else if(uc == CURLUE_OUT_OF_MEMORY)
+      result = CURLE_OUT_OF_MEMORY;
+    curl_url_cleanup(uh);
+  }
+  else
+    result = CURLE_OUT_OF_MEMORY;
+
+  *scheme = proto ? proto : "?"; /* Never match if not found. */
+  return result;
+}
+
+static CURLcode ssh_setopts(struct OperationConfig *config, CURL *curl,
+                            const char *use_proto)
+{
+  CURLcode result;
+
+  if(use_proto != proto_scp && use_proto != proto_sftp)
+    return CURLE_OK;
+
+  /* SSH and SSL private key uses same command-line option */
+  MY_SETOPT_STR(curl, CURLOPT_SSH_PRIVATE_KEYFILE, config->key);
+  MY_SETOPT_STR(curl, CURLOPT_SSH_PUBLIC_KEYFILE, config->pubkey);
+
+  /* SSH host key md5 checking allows us to fail if we are not talking to who
+     we think we should */
+  MY_SETOPT_STR(curl, CURLOPT_SSH_HOST_PUBLIC_KEY_MD5, config->hostpubmd5);
+
+  /* SSH host key sha256 checking allows us to fail if we are not talking to
+     who we think we should */
+  MY_SETOPT_STR(curl, CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256,
+                config->hostpubsha256);
+
+  if(config->ssh_compression)
+    my_setopt_long(curl, CURLOPT_SSH_COMPRESSION, 1);
+
+  if(!config->insecure_ok) {
+    char *known = config->knownhosts;
+    if(!known) {
+      char *found = findfile(".ssh/known_hosts", FALSE);
+      if(found) {
+        known = curlx_strdup(found);
+        curl_free(found);
+        if(!known)
+          return CURLE_OUT_OF_MEMORY;
+      }
+    }
+    if(known) {
+      result = my_setopt_str(curl, CURLOPT_SSH_KNOWNHOSTS, known);
+      if(result) {
+        config->knownhosts = NULL;
+        curlx_free(known);
+        return result;
+      }
+      /* store it in global to avoid repeated checks */
+      config->knownhosts = known;
+    }
+    else if(!config->hostpubmd5 && !config->hostpubsha256) {
+      errorf("Could not find a known_hosts file");
+      return CURLE_FAILED_INIT;
+    }
+    else
+      warnf("Could not find a known_hosts file");
+  }
+  return CURLE_OK; /* ignore if SHA256 did not work */
+}
+
+static long tlsversion(unsigned char mintls,
+                       unsigned char maxtls)
+{
+  long tlsver = 0;
+  if(!mintls) { /* minimum is at default */
+    /* minimum is set to default, which we want to be 1.2 */
+    if(maxtls && (maxtls < 3))
+      /* max is set lower than 1.2 and minimum is default, change minimum to
+         the same as max */
+      mintls = maxtls;
+  }
+  switch(mintls) {
+  case 1:
+    tlsver = CURL_SSLVERSION_TLSv1_0;
+    break;
+  case 2:
+    tlsver = CURL_SSLVERSION_TLSv1_1;
+    break;
+  case 0: /* let default minimum be 1.2 */
+  case 3:
+    tlsver = CURL_SSLVERSION_TLSv1_2;
+    break;
+  case 4:
+  default: /* in case */
+    tlsver = CURL_SSLVERSION_TLSv1_3;
+    break;
+  }
+  switch(maxtls) {
+  case 0: /* not set, leave it */
+    break;
+  case 1:
+    tlsver |= CURL_SSLVERSION_MAX_TLSv1_0;
+    break;
+  case 2:
+    tlsver |= CURL_SSLVERSION_MAX_TLSv1_1;
+    break;
+  case 3:
+    tlsver |= CURL_SSLVERSION_MAX_TLSv1_2;
+    break;
+  case 4:
+  default: /* in case */
+    tlsver |= CURL_SSLVERSION_MAX_TLSv1_3;
+    break;
+  }
+  return tlsver;
+}
+
+/* only called if libcurl supports TLS */
+static CURLcode ssl_ca_setopts(struct OperationConfig *config, CURL *curl)
+{
+  CURLcode result = CURLE_OK;
+
+  if(config->cacert)
+    MY_SETOPT_STR(curl, CURLOPT_CAINFO, config->cacert);
+  if(config->proxy_cacert)
+    MY_SETOPT_STR(curl, CURLOPT_PROXY_CAINFO, config->proxy_cacert);
+  if(config->capath)
+    MY_SETOPT_STR(curl, CURLOPT_CAPATH, config->capath);
+
+  /* For the time being if --proxy-capath is not set then we use the
+     --capath value for it, if any. See #1257 */
+  if(config->proxy_capath || config->capath) {
+    MY_SETOPT_STR(curl, CURLOPT_PROXY_CAPATH,
+                  (config->proxy_capath ? config->proxy_capath :
+                   config->capath));
+    if((result == CURLE_NOT_BUILT_IN) || (result == CURLE_UNKNOWN_OPTION)) {
+      warnf("ignoring %s, not supported by libcurl with %s",
+            "setting the CA path for the proxy",
+            ssl_backend());
+      result = CURLE_OK;
+    }
+  }
+  if(result)
+    return result;
+
+#ifdef CURL_CA_EMBED
+  if(!config->cacert && !config->capath) {
+    struct curl_blob blob;
+    blob.data = CURL_UNCONST(curl_ca_embed);
+    blob.len = strlen((const char *)curl_ca_embed);
+    blob.flags = CURL_BLOB_NOCOPY;
+    notef("Using embedded CA bundle (%zu bytes)", blob.len);
+    result = curl_easy_setopt(curl, CURLOPT_CAINFO_BLOB, &blob);
+    if((result == CURLE_NOT_BUILT_IN) || (result == CURLE_UNKNOWN_OPTION)) {
+      warnf("ignoring %s, not supported by libcurl with %s",
+            "embedded CA bundle", ssl_backend());
+      result = CURLE_OK;
+    }
+  }
+  if(!config->proxy_cacert && !config->proxy_capath) {
+    struct curl_blob blob;
+    blob.data = CURL_UNCONST(curl_ca_embed);
+    blob.len = strlen((const char *)curl_ca_embed);
+    blob.flags = CURL_BLOB_NOCOPY;
+    notef("Using embedded CA bundle, for proxies (%zu bytes)", blob.len);
+    result = curl_easy_setopt(curl, CURLOPT_PROXY_CAINFO_BLOB, &blob);
+    if((result == CURLE_NOT_BUILT_IN) || (result == CURLE_UNKNOWN_OPTION)) {
+      warnf("ignoring %s, not supported by libcurl with %s",
+            "embedded CA bundle", ssl_backend());
+      result = CURLE_OK;
+    }
+  }
+#endif
+  return result;
+}
+
+/* only called if libcurl supports TLS */
+static CURLcode ssl_setopts(struct OperationConfig *config, CURL *curl)
+{
+  CURLcode result = CURLE_OK;
+
+  if(config->crlfile)
+    MY_SETOPT_STR(curl, CURLOPT_CRLFILE, config->crlfile);
+  if(config->proxy_crlfile)
+    MY_SETOPT_STR(curl, CURLOPT_PROXY_CRLFILE, config->proxy_crlfile);
+  else if(config->crlfile)
+    /* CURLOPT_PROXY_CRLFILE default is crlfile */
+    MY_SETOPT_STR(curl, CURLOPT_PROXY_CRLFILE, config->crlfile);
+
+  if(config->pinnedpubkey) {
+    MY_SETOPT_STR(curl, CURLOPT_PINNEDPUBLICKEY, config->pinnedpubkey);
+    if(result)
+      warnf("ignoring %s, not supported by libcurl with %s",
+            "--pinnedpubkey", ssl_backend());
+  }
+  if(config->proxy_pinnedpubkey) {
+    MY_SETOPT_STR(curl, CURLOPT_PROXY_PINNEDPUBLICKEY,
+                  config->proxy_pinnedpubkey);
+    if(result)
+      warnf("ignoring %s, not supported by libcurl with %s",
+            "--proxy-pinnedpubkey", ssl_backend());
+  }
+
+  if(config->ssl_ec_curves)
+    MY_SETOPT_STR(curl, CURLOPT_SSL_EC_CURVES, config->ssl_ec_curves);
+
+  if(config->ssl_signature_algorithms)
+    MY_SETOPT_STR(curl, CURLOPT_SSL_SIGNATURE_ALGORITHMS,
+                  config->ssl_signature_algorithms);
+
+  if(config->writeout)
+    my_setopt_long(curl, CURLOPT_CERTINFO, 1);
+
+  MY_SETOPT_STR(curl, CURLOPT_SSLCERT, config->cert);
+  MY_SETOPT_STR(curl, CURLOPT_PROXY_SSLCERT, config->proxy_cert);
+  MY_SETOPT_STR(curl, CURLOPT_SSLCERTTYPE, config->cert_type);
+  MY_SETOPT_STR(curl, CURLOPT_PROXY_SSLCERTTYPE, config->proxy_cert_type);
+  MY_SETOPT_STR(curl, CURLOPT_SSLKEY, config->key);
+  MY_SETOPT_STR(curl, CURLOPT_PROXY_SSLKEY, config->proxy_key);
+  MY_SETOPT_STR(curl, CURLOPT_SSLKEYTYPE, config->key_type);
+  MY_SETOPT_STR(curl, CURLOPT_PROXY_SSLKEYTYPE, config->proxy_key_type);
+
+  /* libcurl default is strict verifyhost -> 1L, verifypeer -> 1L */
+  if(config->insecure_ok) {
+    my_setopt_long(curl, CURLOPT_SSL_VERIFYPEER, 0);
+    my_setopt_long(curl, CURLOPT_SSL_VERIFYHOST, 0);
+  }
+
+  if(config->doh_insecure_ok) {
+    my_setopt_long(curl, CURLOPT_DOH_SSL_VERIFYPEER, 0);
+    my_setopt_long(curl, CURLOPT_DOH_SSL_VERIFYHOST, 0);
+  }
+
+  if(config->proxy_insecure_ok) {
+    my_setopt_long(curl, CURLOPT_PROXY_SSL_VERIFYPEER, 0);
+    my_setopt_long(curl, CURLOPT_PROXY_SSL_VERIFYHOST, 0);
+  }
+
+  if(config->verifystatus)
+    my_setopt_long(curl, CURLOPT_SSL_VERIFYSTATUS, 1);
+
+  if(config->doh_verifystatus)
+    my_setopt_long(curl, CURLOPT_DOH_SSL_VERIFYSTATUS, 1);
+
+  my_setopt_SSLVERSION(curl, CURLOPT_SSLVERSION,
+                       tlsversion(config->ssl_version,
+                                  config->ssl_version_max));
+  if(config->proxy)
+    my_setopt_SSLVERSION(curl, CURLOPT_PROXY_SSLVERSION,
+                         config->proxy_ssl_version);
+
+  {
+    long mask =
+      (config->ssl_allow_beast ? CURLSSLOPT_ALLOW_BEAST : 0) |
+      (config->ssl_allow_earlydata ? CURLSSLOPT_EARLYDATA : 0) |
+      (config->ssl_no_revoke ? CURLSSLOPT_NO_REVOKE : 0) |
+      (config->ssl_revoke_best_effort ? CURLSSLOPT_REVOKE_BEST_EFFORT : 0) |
+      (config->native_ca_store ? CURLSSLOPT_NATIVE_CA : 0) |
+      (config->ssl_auto_client_cert ? CURLSSLOPT_AUTO_CLIENT_CERT : 0);
+
+    if(mask)
+      my_setopt_bitmask(curl, CURLOPT_SSL_OPTIONS, mask);
+  }
+
+  {
+    long mask =
+      (config->proxy_ssl_allow_beast ? CURLSSLOPT_ALLOW_BEAST : 0) |
+      (config->proxy_ssl_auto_client_cert ? CURLSSLOPT_AUTO_CLIENT_CERT : 0) |
+      (config->proxy_native_ca_store ? CURLSSLOPT_NATIVE_CA : 0);
+
+    if(mask)
+      my_setopt_bitmask(curl, CURLOPT_PROXY_SSL_OPTIONS, mask);
+  }
+
+  if(config->cipher_list) {
+    MY_SETOPT_STR(curl, CURLOPT_SSL_CIPHER_LIST, config->cipher_list);
+    if(result)
+      warnf("ignoring %s, not supported by libcurl with %s",
+            "--ciphers", ssl_backend());
+  }
+  if(config->proxy_cipher_list) {
+    MY_SETOPT_STR(curl, CURLOPT_PROXY_SSL_CIPHER_LIST,
+                  config->proxy_cipher_list);
+    if(result)
+      warnf("ignoring %s, not supported by libcurl with %s",
+            "--proxy-ciphers", ssl_backend());
+  }
+  if(config->cipher13_list) {
+    MY_SETOPT_STR(curl, CURLOPT_TLS13_CIPHERS, config->cipher13_list);
+    if(result)
+      warnf("ignoring %s, not supported by libcurl with %s",
+            "--tls13-ciphers", ssl_backend());
+  }
+  if(config->proxy_cipher13_list) {
+    MY_SETOPT_STR(curl, CURLOPT_PROXY_TLS13_CIPHERS,
+                  config->proxy_cipher13_list);
+    if(result)
+      warnf("ignoring %s, not supported by libcurl with %s",
+            "--proxy-tls13-ciphers", ssl_backend());
+  }
+
+  /* curl 7.16.0 */
+  if(config->disable_sessionid)
+    /* disable it */
+    my_setopt_long(curl, CURLOPT_SSL_SESSIONID_CACHE, 0);
+
+  if(feature_ech) {
+    /* only if enabled in libcurl */
+    if(config->ech) /* only if set (optional) */
+      MY_SETOPT_STR(curl, CURLOPT_ECH, config->ech);
+    if(config->ech_public) /* only if set (optional) */
+      MY_SETOPT_STR(curl, CURLOPT_ECH, config->ech_public);
+    if(config->ech_config) /* only if set (optional) */
+      MY_SETOPT_STR(curl, CURLOPT_ECH, config->ech_config);
+  }
+
+  if(config->engine)
+    MY_SETOPT_STR(curl, CURLOPT_SSLENGINE, config->engine);
+
+  if(config->ftp_ssl_reqd)
+    my_setopt_enum(curl, CURLOPT_USE_SSL, CURLUSESSL_ALL);
+
+  else if(config->ftp_ssl)
+    my_setopt_enum(curl, CURLOPT_USE_SSL, CURLUSESSL_TRY);
+
+  else if(config->ftp_ssl_control)
+    my_setopt_enum(curl, CURLOPT_USE_SSL, CURLUSESSL_CONTROL);
+
+  if(config->noalpn)
+    my_setopt_long(curl, CURLOPT_SSL_ENABLE_ALPN, 0);
+
+  return CURLE_OK;
+}
+
+static CURLcode cookie_setopts(struct OperationConfig *config, CURL *curl)
+{
+  CURLcode result = CURLE_OK;
+  if(config->cookies) {
+    struct dynbuf cookies;
+    struct curl_slist *cl;
+
+    /* The maximum size needs to match MAX_NAME in cookie.h */
+#define MAX_COOKIE_LINE 8200
+    curlx_dyn_init(&cookies, MAX_COOKIE_LINE);
+    for(cl = config->cookies; cl; cl = cl->next) {
+      if(cl == config->cookies)
+        result = curlx_dyn_add(&cookies, cl->data);
+      else
+        result = curlx_dyn_addf(&cookies, ";%s%s",
+                                ISBLANK(cl->data[0]) ? "" : " ", cl->data);
+      if(result) {
+        warnf("skipped provided cookie, the cookie header "
+              "would go over %d bytes", MAX_COOKIE_LINE);
+        return result;
+      }
+    }
+
+    result = my_setopt_str(curl, CURLOPT_COOKIE, curlx_dyn_ptr(&cookies));
+    curlx_dyn_free(&cookies);
+    if(result)
+      return result;
+  }
+
+  if(config->cookiefiles) {
+    struct curl_slist *cfl;
+
+    for(cfl = config->cookiefiles; cfl; cfl = cfl->next)
+      MY_SETOPT_STR(curl, CURLOPT_COOKIEFILE, cfl->data);
+  }
+
+  if(config->cookiejar)
+    MY_SETOPT_STR(curl, CURLOPT_COOKIEJAR, config->cookiejar);
+
+  my_setopt_long(curl, CURLOPT_COOKIESESSION, config->cookiesession);
+
+  return result;
+}
+
+/* only for HTTP transfers */
+static CURLcode http_setopts(struct OperationConfig *config, CURL *curl,
+                             const char *use_proto)
+{
+  CURLcode result = CURLE_OK;
+  long postRedir = 0;
+
+  if(use_proto != proto_http && use_proto != proto_https)
+    return CURLE_OK;
+
+  my_setopt_long(curl, CURLOPT_FOLLOWLOCATION, config->followlocation);
+  my_setopt_long(curl, CURLOPT_UNRESTRICTED_AUTH, config->unrestricted_auth);
+#ifndef CURL_DISABLE_AWS
+  MY_SETOPT_STR(curl, CURLOPT_AWS_SIGV4, config->aws_sigv4);
+#endif
+  my_setopt_long(curl, CURLOPT_AUTOREFERER, config->autoreferer);
+
+  if(config->proxyheaders) {
+    my_setopt_slist(curl, CURLOPT_PROXYHEADER, config->proxyheaders);
+  }
+
+  my_setopt_long(curl, CURLOPT_MAXREDIRS, config->maxredirs);
+
+  if(config->httpversion)
+    my_setopt_enum(curl, CURLOPT_HTTP_VERSION, config->httpversion);
+
+  if(config->post301)
+    postRedir |= CURL_REDIR_POST_301;
+  if(config->post302)
+    postRedir |= CURL_REDIR_POST_302;
+  if(config->post303)
+    postRedir |= CURL_REDIR_POST_303;
+  my_setopt_long(curl, CURLOPT_POSTREDIR, postRedir);
+
+  if(config->encoding)
+    MY_SETOPT_STR(curl, CURLOPT_ACCEPT_ENCODING, "");
+
+  if(config->tr_encoding)
+    my_setopt_long(curl, CURLOPT_TRANSFER_ENCODING, 1);
+
+  my_setopt_long(curl, CURLOPT_HTTP09_ALLOWED, config->http09_allowed);
+
+  if(config->altsvc)
+    MY_SETOPT_STR(curl, CURLOPT_ALTSVC, config->altsvc);
+
+  if(config->hsts)
+    MY_SETOPT_STR(curl, CURLOPT_HSTS, config->hsts);
+
+  if(config->expect100timeout_ms > 0)
+    my_setopt_long(curl, CURLOPT_EXPECT_100_TIMEOUT_MS,
+                   config->expect100timeout_ms);
+
+  if(!result)
+    result = cookie_setopts(config, curl);
+  if(result)
+    return result;
+  /* Enable header separation when using a proxy with HTTPS or proxytunnel
+   * to prevent --header content from leaking into CONNECT requests */
+  if((config->proxy || config->proxyheaders) &&
+     (use_proto == proto_https || config->proxytunnel))
+    my_setopt_long(curl, CURLOPT_HEADEROPT, CURLHEADER_SEPARATE);
+  return result;
+}
+
+static void tcp_setopts(struct OperationConfig *config, CURL *curl)
+{
+  if(!config->tcp_nodelay)
+    my_setopt_long(curl, CURLOPT_TCP_NODELAY, 0);
+
+  if(config->tcp_fastopen)
+    my_setopt_long(curl, CURLOPT_TCP_FASTOPEN, 1);
+
+  if(config->mptcp)
+    my_setopt_ptr(curl, CURLOPT_OPENSOCKETFUNCTION, tool_socket_open_mptcp_cb);
+
+  /* curl 7.17.1 */
+  if(!config->nokeepalive) {
+    my_setopt_long(curl, CURLOPT_TCP_KEEPALIVE, 1);
+    if(config->alivetime) {
+      my_setopt_long(curl, CURLOPT_TCP_KEEPIDLE, config->alivetime);
+      my_setopt_long(curl, CURLOPT_TCP_KEEPINTVL, config->alivetime);
+    }
+    if(config->alivecnt)
+      my_setopt_long(curl, CURLOPT_TCP_KEEPCNT, config->alivecnt);
+  }
+  else
+    my_setopt_long(curl, CURLOPT_TCP_KEEPALIVE, 0);
+}
+
+static CURLcode ftp_setopts(struct OperationConfig *config, CURL *curl,
+                            const char *use_proto)
+{
+  CURLcode result;
+
+  if(use_proto != proto_ftp && use_proto != proto_ftps)
+    return CURLE_OK;
+
+  MY_SETOPT_STR(curl, CURLOPT_FTPPORT, config->ftpport);
+
+  if(config->disable_epsv)
+    /* disable it */
+    my_setopt_long(curl, CURLOPT_FTP_USE_EPSV, 0);
+
+  if(config->disable_eprt)
+    /* disable it */
+    my_setopt_long(curl, CURLOPT_FTP_USE_EPRT, 0);
+
+  if(config->ftp_ssl_ccc)
+    my_setopt_enum(curl, CURLOPT_FTP_SSL_CCC, config->ftp_ssl_ccc_mode);
+
+  MY_SETOPT_STR(curl, CURLOPT_FTP_ACCOUNT, config->ftp_account);
+  my_setopt_long(curl, CURLOPT_FTP_SKIP_PASV_IP, config->ftp_skip_ip);
+  my_setopt_long(curl, CURLOPT_FTP_FILEMETHOD, config->ftp_filemethod);
+  MY_SETOPT_STR(curl, CURLOPT_FTP_ALTERNATIVE_TO_USER,
+                config->ftp_alternative_to_user);
+
+  if(config->ftp_pret)
+    my_setopt_long(curl, CURLOPT_FTP_USE_PRET, 1);
+
+  return result;
+}
+
+static void gen_trace_setopts(struct OperationConfig *config, CURL *curl)
+{
+  if(global->tracetype != TRACE_NONE) {
+    my_setopt_ptr(curl, CURLOPT_DEBUGFUNCTION, tool_debug_cb);
+    my_setopt_ptr(curl, CURLOPT_DEBUGDATA, config);
+    my_setopt_long(curl, CURLOPT_VERBOSE, 1L);
+  }
+}
+
+static void gen_cb_setopts(struct OperationConfig *config,
+                           struct per_transfer *per,
+                           CURL *curl)
+{
+  (void)config; /* when --libcurl is disabled */
+
+  /* where to store */
+  my_setopt_ptr(curl, CURLOPT_WRITEDATA, per);
+  my_setopt_ptr(curl, CURLOPT_INTERLEAVEDATA, per);
+
+  /* what call to write */
+  my_setopt_ptr(curl, CURLOPT_WRITEFUNCTION, tool_write_cb);
+
+  /* what to read */
+  my_setopt_ptr(curl, CURLOPT_READDATA, per);
+  my_setopt_ptr(curl, CURLOPT_READFUNCTION, tool_read_cb);
+
+  /* in 7.18.0, the CURLOPT_SEEKFUNCTION/DATA pair is taking over what
+     CURLOPT_IOCTLFUNCTION/DATA pair previously provided for seeking */
+  my_setopt_ptr(curl, CURLOPT_SEEKDATA, per);
+  my_setopt_ptr(curl, CURLOPT_SEEKFUNCTION, tool_seek_cb);
+
+  if((global->progressmode == CURL_PROGRESS_BAR) &&
+     !global->noprogress && !global->silent) {
+    /* we want the alternative style, then we have to implement it
+       ourselves! */
+    my_setopt_ptr(curl, CURLOPT_XFERINFOFUNCTION, tool_progress_cb);
+    my_setopt_ptr(curl, CURLOPT_XFERINFODATA, per);
+  }
+  else if(per->uploadfile && !strcmp(per->uploadfile, ".")) {
+    /* when reading from stdin in non-blocking mode, we use the progress
+       function to unpause a busy read */
+    my_setopt_long(curl, CURLOPT_NOPROGRESS, 0);
+    my_setopt_ptr(curl, CURLOPT_XFERINFOFUNCTION, tool_readbusy_cb);
+    my_setopt_ptr(curl, CURLOPT_XFERINFODATA, per);
+  }
+
+  my_setopt_ptr(curl, CURLOPT_HEADERFUNCTION, tool_header_cb);
+  my_setopt_ptr(curl, CURLOPT_HEADERDATA, per);
+}
+
+static CURLcode proxy_setopts(struct OperationConfig *config, CURL *curl)
+{
+  CURLcode result;
+  if(config->proxy) {
+    result = my_setopt_str(curl, CURLOPT_PROXY, config->proxy);
+    if(result) {
+      errorf("proxy support is disabled in this libcurl");
+      config->synthetic_error = TRUE;
+      return CURLE_NOT_BUILT_IN;
+    }
+  }
+
+  if(config->proxy)
+    my_setopt_enum(curl, CURLOPT_PROXYTYPE, config->proxyver);
+
+  MY_SETOPT_STR(curl, CURLOPT_PROXYUSERPWD, config->proxyuserpwd);
+  my_setopt_long(curl, CURLOPT_HTTPPROXYTUNNEL, config->proxytunnel);
+  if(config->preproxy)
+    MY_SETOPT_STR(curl, CURLOPT_PRE_PROXY, config->preproxy);
+
+  if(config->proxyanyauth)
+    my_setopt_bitmask(curl, CURLOPT_PROXYAUTH, CURLAUTH_ANY);
+  else if(config->proxynegotiate)
+    my_setopt_bitmask(curl, CURLOPT_PROXYAUTH, CURLAUTH_GSSNEGOTIATE);
+  else if(config->proxyntlm)
+    my_setopt_bitmask(curl, CURLOPT_PROXYAUTH, CURLAUTH_NTLM);
+  else if(config->proxydigest)
+    my_setopt_bitmask(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST);
+  else if(config->proxybasic)
+    my_setopt_bitmask(curl, CURLOPT_PROXYAUTH, CURLAUTH_BASIC);
+
+  MY_SETOPT_STR(curl, CURLOPT_NOPROXY, config->noproxy);
+  my_setopt_long(curl, CURLOPT_SUPPRESS_CONNECT_HEADERS,
+                 config->suppress_connect_headers);
+
+  if(config->proxy_service_name)
+    MY_SETOPT_STR(curl, CURLOPT_PROXY_SERVICE_NAME,
+                  config->proxy_service_name);
+
+  if(config->haproxy_protocol)
+    my_setopt_long(curl, CURLOPT_HAPROXYPROTOCOL, 1);
+
+  if(config->haproxy_clientip)
+    MY_SETOPT_STR(curl, CURLOPT_HAPROXY_CLIENT_IP, config->haproxy_clientip);
+
+  return result;
+}
+
+static CURLcode tls_srp_setopts(struct OperationConfig *config, CURL *curl)
+{
+  CURLcode result = CURLE_OK;
+  if(config->tls_username)
+    MY_SETOPT_STR(curl, CURLOPT_TLSAUTH_USERNAME, config->tls_username);
+  if(config->tls_password)
+    MY_SETOPT_STR(curl, CURLOPT_TLSAUTH_PASSWORD, config->tls_password);
+  if(config->tls_authtype)
+    MY_SETOPT_STR(curl, CURLOPT_TLSAUTH_TYPE, config->tls_authtype);
+  if(config->proxy_tls_username)
+    MY_SETOPT_STR(curl, CURLOPT_PROXY_TLSAUTH_USERNAME,
+                  config->proxy_tls_username);
+  if(config->proxy_tls_password)
+    MY_SETOPT_STR(curl, CURLOPT_PROXY_TLSAUTH_PASSWORD,
+                  config->proxy_tls_password);
+  if(config->proxy_tls_authtype)
+    MY_SETOPT_STR(curl, CURLOPT_PROXY_TLSAUTH_TYPE,
+                  config->proxy_tls_authtype);
+  return result;
+}
+
+static CURLcode setopt_post(struct OperationConfig *config, CURL *curl)
+{
+  CURLcode result = CURLE_OK;
+  switch(config->httpreq) {
+  case TOOL_HTTPREQ_SIMPLEPOST:
+    if(config->resume_from) {
+      errorf("cannot mix --continue-at with --data");
+      result = CURLE_FAILED_INIT;
+    }
+    else {
+      MY_SETOPT_STR(curl, CURLOPT_POSTFIELDS,
+                    curlx_dyn_ptr(&config->postdata));
+      my_setopt_offt(curl, CURLOPT_POSTFIELDSIZE_LARGE,
+                     curlx_dyn_len(&config->postdata));
+    }
+    break;
+  case TOOL_HTTPREQ_MIMEPOST:
+    /* free previous remainders */
+    curl_mime_free(config->mimepost);
+    config->mimepost = NULL;
+    if(config->resume_from) {
+      errorf("cannot mix --continue-at with --form");
+      result = CURLE_FAILED_INIT;
+    }
+    else {
+      result = tool2curlmime(curl, config->mimeroot, &config->mimepost);
+      if(!result)
+        result = my_setopt_mimepost(curl, CURLOPT_MIMEPOST, config->mimepost);
+    }
+    break;
+  default:
+    break;
+  }
+  return result;
+}
+
+static void buffersize(struct OperationConfig *config, CURL *curl)
+{
+#ifdef DEBUGBUILD
+  char *env = getenv("CURL_BUFFERSIZE");
+  if(env) {
+    curl_off_t num;
+    const char *p = env;
+    if(!curlx_str_number(&p, &num, LONG_MAX))
+      my_setopt_long(curl, CURLOPT_BUFFERSIZE, (long)num);
+    return;
+  }
+#endif
+  if(config->recvpersecond && (config->recvpersecond < BUFFER_SIZE))
+    /* use a smaller sized buffer for better sleeps */
+    my_setopt_long(curl, CURLOPT_BUFFERSIZE, (long)config->recvpersecond);
+  else
+    my_setopt_long(curl, CURLOPT_BUFFERSIZE, BUFFER_SIZE);
+}
+
+CURLcode config2setopts(struct OperationConfig *config,
+                        struct per_transfer *per,
+                        CURL *curl,
+                        CURLSH *share)
+{
+  const char *use_proto;
+  CURLcode result = url_proto_and_rewrite(&per->url, config, &use_proto);
+
+  /* Avoid having this setopt added to the --libcurl source output. */
+  if(!result)
+    result = curl_easy_setopt(curl, CURLOPT_SHARE, share);
+  if(result)
+    return result;
+
+  if(TRUE
+#ifdef DEBUGBUILD
+    && getenv("CURL_QUICK_EXIT")
+#endif
+    ) {
+    /* QUICK_EXIT allows for running threads to be detached and not
+     * joined. Preferably in non-debug runs. */
+    result = curl_easy_setopt(curl, CURLOPT_QUICK_EXIT, 1L);
+    if(result)
+      return result;
+  }
+
+  gen_trace_setopts(config, curl);
+
+  buffersize(config, curl);
+
+  MY_SETOPT_STR(curl, CURLOPT_URL, per->url);
+  my_setopt_long(curl, CURLOPT_NOPROGRESS,
+                 global->noprogress || global->silent);
+  /* call after the line above. It may override CURLOPT_NOPROGRESS */
+  gen_cb_setopts(config, per, curl);
+
+  my_setopt_long(curl, CURLOPT_NOBODY, config->no_body);
+  MY_SETOPT_STR(curl, CURLOPT_XOAUTH2_BEARER, config->oauth_bearer);
+  result = proxy_setopts(config, curl);
+  if(setopt_bad(result) || config->synthetic_error)
+    return result;
+
+  my_setopt_long(curl, CURLOPT_FAILONERROR, config->fail == FAIL_WO_BODY);
+  MY_SETOPT_STR(curl, CURLOPT_REQUEST_TARGET, config->request_target);
+  my_setopt_long(curl, CURLOPT_UPLOAD, !!per->uploadfile);
+  my_setopt_long(curl, CURLOPT_DIRLISTONLY, config->dirlistonly);
+  my_setopt_long(curl, CURLOPT_APPEND, config->ftp_append);
+
+  if(config->netrc_opt)
+    my_setopt_enum(curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
+  else if(config->netrc || config->netrc_file)
+    my_setopt_enum(curl, CURLOPT_NETRC, CURL_NETRC_REQUIRED);
+  else
+    my_setopt_enum(curl, CURLOPT_NETRC, CURL_NETRC_IGNORED);
+
+  MY_SETOPT_STR(curl, CURLOPT_NETRC_FILE, config->netrc_file);
+  my_setopt_long(curl, CURLOPT_TRANSFERTEXT, config->use_ascii);
+  MY_SETOPT_STR(curl, CURLOPT_LOGIN_OPTIONS, config->login_options);
+  MY_SETOPT_STR(curl, CURLOPT_USERPWD, config->userpwd);
+  MY_SETOPT_STR(curl, CURLOPT_RANGE, config->range);
+  my_setopt_ptr(curl, CURLOPT_ERRORBUFFER, per->errorbuffer);
+  my_setopt_long(curl, CURLOPT_TIMEOUT_MS, config->timeout_ms);
+
+  result = setopt_post(config, curl);
+  if(result)
+    return result;
+
+  if(config->mime_options)
+    my_setopt_long(curl, CURLOPT_MIME_OPTIONS, config->mime_options);
+
+  if(config->authtype)
+    my_setopt_bitmask(curl, CURLOPT_HTTPAUTH, config->authtype);
+
+  my_setopt_slist(curl, CURLOPT_HTTPHEADER, config->headers);
+
+  if(proto_http || proto_rtsp) {
+    MY_SETOPT_STR(curl, CURLOPT_REFERER, config->referer);
+    MY_SETOPT_STR(curl, CURLOPT_USERAGENT, config->useragent ?
+                  config->useragent : CURL_NAME "/" CURL_VERSION);
+  }
+
+  result = http_setopts(config, curl, use_proto);
+  if(!result)
+    result = ftp_setopts(config, curl, use_proto);
+  if(result)
+    return result;
+
+  my_setopt_long(curl, CURLOPT_LOW_SPEED_LIMIT, config->low_speed_limit);
+  my_setopt_long(curl, CURLOPT_LOW_SPEED_TIME, config->low_speed_time);
+  my_setopt_offt(curl, CURLOPT_MAX_SEND_SPEED_LARGE, config->sendpersecond);
+  my_setopt_offt(curl, CURLOPT_MAX_RECV_SPEED_LARGE, config->recvpersecond);
+
+  if(config->use_resume)
+    my_setopt_offt(curl, CURLOPT_RESUME_FROM_LARGE, config->resume_from);
+  else
+    my_setopt_offt(curl, CURLOPT_RESUME_FROM_LARGE, 0);
+
+  MY_SETOPT_STR(curl, CURLOPT_KEYPASSWD, config->key_passwd);
+  MY_SETOPT_STR(curl, CURLOPT_PROXY_KEYPASSWD, config->proxy_key_passwd);
+
+  result = ssh_setopts(config, curl, use_proto);
+  if(setopt_bad(result))
+    return result;
+
+  if(feature_ssl) {
+    result = ssl_ca_setopts(config, curl);
+    if(!result)
+      result = ssl_setopts(config, curl);
+    if(setopt_bad(result))
+      return result;
+#ifdef DEBUGBUILD
+    if(!per->urlnum) {
+      char *env = getenv("CURL_DBG_NO_USE_SSL_ON_FIRST");
+      if(env)
+        my_setopt_enum(curl, CURLOPT_USE_SSL, CURLUSESSL_NONE);
+    }
+#endif
+  }
+
+  if(config->path_as_is)
+    my_setopt_long(curl, CURLOPT_PATH_AS_IS, 1);
+
+  if(config->no_body || config->remote_time)
+    /* no body or use remote time */
+    my_setopt_long(curl, CURLOPT_FILETIME, 1);
+
+  my_setopt_long(curl, CURLOPT_CRLF, config->crlf);
+  my_setopt_slist(curl, CURLOPT_QUOTE, config->quote);
+  my_setopt_slist(curl, CURLOPT_POSTQUOTE, config->postquote);
+  my_setopt_slist(curl, CURLOPT_PREQUOTE, config->prequote);
+
+  my_setopt_enum(curl, CURLOPT_TIMECONDITION, config->timecond);
+  my_setopt_offt(curl, CURLOPT_TIMEVALUE_LARGE, config->condtime);
+  MY_SETOPT_STR(curl, CURLOPT_CUSTOMREQUEST, config->customrequest);
+  customrequest_helper(config->httpreq, config->customrequest);
+  my_setopt_ptr(curl, CURLOPT_STDERR, tool_stderr);
+  MY_SETOPT_STR(curl, CURLOPT_INTERFACE, config->iface);
+  progressbarinit(&per->progressbar, config);
+  MY_SETOPT_STR(curl, CURLOPT_DNS_SERVERS, config->dns_servers);
+  MY_SETOPT_STR(curl, CURLOPT_DNS_INTERFACE, config->dns_interface);
+  MY_SETOPT_STR(curl, CURLOPT_DNS_LOCAL_IP4, config->dns_ipv4_addr);
+  MY_SETOPT_STR(curl, CURLOPT_DNS_LOCAL_IP6, config->dns_ipv6_addr);
+  my_setopt_slist(curl, CURLOPT_TELNETOPTIONS, config->telnet_options);
+  my_setopt_long(curl, CURLOPT_CONNECTTIMEOUT_MS, config->connecttimeout_ms);
+  MY_SETOPT_STR(curl, CURLOPT_DOH_URL, config->doh_url);
+  my_setopt_long(curl, CURLOPT_FTP_CREATE_MISSING_DIRS,
+                 (config->ftp_create_dirs ?
+                  CURLFTP_CREATE_DIR_RETRY : CURLFTP_CREATE_DIR_NONE));
+  my_setopt_offt(curl, CURLOPT_MAXFILESIZE_LARGE, config->max_filesize);
+  my_setopt_long(curl, CURLOPT_IPRESOLVE, config->ip_version);
+  if(config->socks5_gssapi_nec)
+    my_setopt_long(curl, CURLOPT_SOCKS5_GSSAPI_NEC, 1);
+  if(config->socks5_auth)
+    my_setopt_bitmask(curl, CURLOPT_SOCKS5_AUTH, config->socks5_auth);
+  MY_SETOPT_STR(curl, CURLOPT_SERVICE_NAME, config->service_name);
+  my_setopt_long(curl, CURLOPT_IGNORE_CONTENT_LENGTH, config->ignorecl);
+
+  if(config->localport) {
+    my_setopt_long(curl, CURLOPT_LOCALPORT, config->localport);
+    my_setopt_long(curl, CURLOPT_LOCALPORTRANGE, config->localportrange);
+  }
+
+  if(config->raw) {
+    my_setopt_long(curl, CURLOPT_HTTP_CONTENT_DECODING, 0);
+    my_setopt_long(curl, CURLOPT_HTTP_TRANSFER_DECODING, 0);
+  }
+
+  tcp_setopts(config, curl);
+
+  if(config->tftp_blksize && proto_tftp)
+    my_setopt_long(curl, CURLOPT_TFTP_BLKSIZE, config->tftp_blksize);
+
+  MY_SETOPT_STR(curl, CURLOPT_MAIL_FROM, config->mail_from);
+  my_setopt_slist(curl, CURLOPT_MAIL_RCPT, config->mail_rcpt);
+  my_setopt_long(curl, CURLOPT_MAIL_RCPT_ALLOWFAILS,
+                 config->mail_rcpt_allowfails);
+  if(config->create_file_mode)
+    my_setopt_long(curl, CURLOPT_NEW_FILE_PERMS, config->create_file_mode);
+
+  if(config->proto_present)
+    MY_SETOPT_STR(curl, CURLOPT_PROTOCOLS_STR, config->proto_str);
+  if(config->proto_redir_present)
+    MY_SETOPT_STR(curl, CURLOPT_REDIR_PROTOCOLS_STR, config->proto_redir_str);
+
+  my_setopt_slist(curl, CURLOPT_RESOLVE, config->resolve);
+  my_setopt_slist(curl, CURLOPT_CONNECT_TO, config->connect_to);
+
+  if(feature_tls_srp) {
+    result = tls_srp_setopts(config, curl);
+    if(setopt_bad(result))
+      return result;
+  }
+
+  if(config->gssapi_delegation)
+    my_setopt_long(curl, CURLOPT_GSSAPI_DELEGATION, config->gssapi_delegation);
+
+  MY_SETOPT_STR(curl, CURLOPT_MAIL_AUTH, config->mail_auth);
+  MY_SETOPT_STR(curl, CURLOPT_SASL_AUTHZID, config->sasl_authzid);
+  my_setopt_long(curl, CURLOPT_SASL_IR, config->sasl_ir);
+
+  if(config->unix_socket_path) {
+    if(config->abstract_unix_socket)
+      MY_SETOPT_STR(curl, CURLOPT_ABSTRACT_UNIX_SOCKET,
+                    config->unix_socket_path);
+    else
+      MY_SETOPT_STR(curl, CURLOPT_UNIX_SOCKET_PATH,
+                    config->unix_socket_path);
+  }
+
+  MY_SETOPT_STR(curl, CURLOPT_DEFAULT_PROTOCOL, config->proto_default);
+  my_setopt_long(curl, CURLOPT_TFTP_NO_OPTIONS,
+                 config->tftp_no_options && proto_tftp);
+
+  if(config->happy_eyeballs_timeout_ms != CURL_HET_DEFAULT)
+    my_setopt_long(curl, CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS,
+                   config->happy_eyeballs_timeout_ms);
+
+  my_setopt_long(curl, CURLOPT_DISALLOW_USERNAME_IN_URL,
+                 config->disallow_username_in_url);
+
+  if(config->ip_tos > 0 || config->vlan_priority > 0) {
+#if defined(IP_TOS) || defined(IPV6_TCLASS) || defined(SO_PRIORITY)
+    my_setopt_ptr(curl, CURLOPT_SOCKOPTFUNCTION, sockopt_callback);
+    my_setopt_ptr(curl, CURLOPT_SOCKOPTDATA, config);
+#else
+    if(config->ip_tos > 0) {
+      errorf("Type of service is not supported in this build.");
+      result = CURLE_NOT_BUILT_IN;
+    }
+    if(config->vlan_priority > 0) {
+      errorf("VLAN priority is not supported in this build.");
+      result = CURLE_NOT_BUILT_IN;
+    }
+#endif
+  }
+  my_setopt_long(curl, CURLOPT_UPLOAD_FLAGS, config->upload_flags);
+  return result;
+}
diff --git a/third-party/curl/src/config2setopts.h b/third-party/curl/src/config2setopts.h
new file mode 100644
index 0000000000..3cf51b0d10
--- /dev/null
+++ b/third-party/curl/src/config2setopts.h
@@ -0,0 +1,32 @@
+#ifndef HEADER_CURL_CONFIG2SETOPTS_H
+#define HEADER_CURL_CONFIG2SETOPTS_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+CURLcode config2setopts(struct OperationConfig *config,
+                        struct per_transfer *per,
+                        CURL *curl,
+                        CURLSH *share);
+
+#endif /* HEADER_CURL_CONFIG2SETOPTS_H */
diff --git a/third-party/curl/src/curl.rc b/third-party/curl/src/curl.rc
index 11d5284296..3c5c8709d5 100644
--- a/third-party/curl/src/curl.rc
+++ b/third-party/curl/src/curl.rc
@@ -32,7 +32,7 @@ VS_VERSION_INFO VERSIONINFO
   FILEVERSION     RC_VERSION
   PRODUCTVERSION  RC_VERSION
   FILEFLAGSMASK   VS_FFI_FILEFLAGSMASK
-#if defined(DEBUGBUILD) || defined(_DEBUG)
+#if defined(DEBUGBUILD) || defined(UNITTESTS) || defined(_DEBUG)
   FILEFLAGS VS_FF_DEBUG
 #else
   FILEFLAGS 0L
@@ -53,7 +53,7 @@ BEGIN
       VALUE "OriginalFilename", "curl.exe\0"
       VALUE "ProductName",      "The curl executable\0"
       VALUE "ProductVersion",   CURL_VERSION "\0"
-      VALUE "LegalCopyright",   "\xa9 " CURL_COPYRIGHT "\0"  /* a9: Copyright symbol */
+      VALUE "LegalCopyright",   "Copyright (C) " CURL_COPYRIGHT "\0"
       VALUE "License",          "https://curl.se/docs/copyright.html\0"
     END
   END
@@ -63,51 +63,3 @@ BEGIN
     VALUE "Translation", 0x409, 1200
   END
 END
-
-/* Manifest */
-
-#if defined(CURL_EMBED_MANIFEST)
-
-/* String escaping rules:
-     https://msdn.microsoft.com/library/aa381050
-   Application Manifest doc, including the list of 'supportedOS Id's:
-     https://msdn.microsoft.com/library/aa374191 */
-
-#ifndef CREATEPROCESS_MANIFEST_RESOURCE_ID
-#define CREATEPROCESS_MANIFEST_RESOURCE_ID  1
-#endif
-#ifndef RT_MANIFEST
-#define RT_MANIFEST  24
-#endif
-
-#define _STR(macro)   _STR_(macro)
-#define _STR_(macro)  #macro
-
-CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST
-BEGIN
-  "<?xml version=""1.0"" encoding=""UTF-8"" standalone=""yes""?>"
-  "<assembly xmlns=""urn:schemas-microsoft-com:asm.v1"" manifestVersion=""1.0"">"
-    "<assemblyIdentity name=""The curl executable"" version="""
-      _STR(LIBCURL_VERSION_MAJOR) "."
-      _STR(LIBCURL_VERSION_MINOR) "."
-      _STR(LIBCURL_VERSION_PATCH) ".0"" type=""win32""/>"
-    "<compatibility xmlns=""urn:schemas-microsoft-com:compatibility.v1"">"
-      "<application>"
-        "<supportedOS Id=""{e2011457-1546-43c5-a5fe-008deee3d3f0}""/>"  /* Vista / Server 2008 */
-        "<supportedOS Id=""{35138b9a-5d96-4fbd-8e2d-a2440225f93a}""/>"  /* 7 / Server 2008 R2 */
-        "<supportedOS Id=""{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}""/>"  /* 8 / Server 2012 */
-        "<supportedOS Id=""{1f676c76-80e1-4239-95bb-83d0f6d0da78}""/>"  /* 8.1 / Server 2012 R2 */
-        "<supportedOS Id=""{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}""/>"  /* 10 / Server 2016 */
-      "</application>"
-    "</compatibility>"
-    "<trustInfo xmlns=""urn:schemas-microsoft-com:asm.v3"">"
-      "<security>"
-        "<requestedPrivileges>"
-          "<requestedExecutionLevel level=""asInvoker"" uiAccess=""false""/>"
-        "</requestedPrivileges>"
-      "</security>"
-    "</trustInfo>"
-  "</assembly>"
-END
-
-#endif
diff --git a/third-party/curl/src/curlinfo.c b/third-party/curl/src/curlinfo.c
new file mode 100644
index 0000000000..94a02e965f
--- /dev/null
+++ b/third-party/curl/src/curlinfo.c
@@ -0,0 +1,277 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/*
+ * The purpose of this tool is to figure out which, if any, features that are
+ * disabled which should otherwise exist and work. These are not visible in
+ * regular curl -V output.
+ *
+ * Disabled protocols are visible in curl_version_info() and are not included
+ * in this table.
+ */
+#include "curl_setup.h"
+
+#include "multihandle.h" /* for ENABLE_WAKEUP */
+#include "tool_xattr.h" /* for USE_XATTR */
+#include "curl_sha512_256.h" /* for CURL_HAVE_SHA512_256 */
+#include "asyn.h" /* for USE_RESOLV_ARES, USE_RESOLV_THREADED */
+#include "fake_addrinfo.h" /* for USE_FAKE_GETADDRINFO */
+
+#include <stdio.h>
+
+#ifdef USE_OPENSSL
+#include <openssl/opensslconf.h> /* for OPENSSL_NO_OCSP */
+#endif
+
+static const char *disabled[] = {
+  "bindlocal: "
+#ifdef CURL_DISABLE_BINDLOCAL
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+
+  "cookies: "
+#ifdef CURL_DISABLE_COOKIES
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+
+  "basic-auth: "
+#ifdef CURL_DISABLE_BASIC_AUTH
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "bearer-auth: "
+#ifdef CURL_DISABLE_BEARER_AUTH
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "digest: "
+#ifdef CURL_DISABLE_DIGEST_AUTH
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "negotiate-auth: "
+#ifdef CURL_DISABLE_NEGOTIATE_AUTH
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "aws: "
+#ifdef CURL_DISABLE_AWS
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "DoH: "
+#ifdef CURL_DISABLE_DOH
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "HTTP-auth: "
+#ifdef CURL_DISABLE_HTTP_AUTH
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "Mime: "
+#ifdef CURL_DISABLE_MIME
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+
+  "netrc: "
+#ifdef CURL_DISABLE_NETRC
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "parsedate: "
+#ifdef CURL_DISABLE_PARSEDATE
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "proxy: "
+#ifdef CURL_DISABLE_PROXY
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "shuffle-dns: "
+#ifdef CURL_DISABLE_SHUFFLE_DNS
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "resolv-threaded: "
+#ifndef USE_RESOLV_THREADED
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "typecheck: "
+#ifdef CURL_DISABLE_TYPECHECK
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "verbose-strings: "
+#ifdef CURL_DISABLE_VERBOSE_STRINGS
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "wakeup: "
+#ifndef ENABLE_WAKEUP
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "headers-api: "
+#ifdef CURL_DISABLE_HEADERS_API
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "xattr: "
+#ifndef USE_XATTR
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "form-api: "
+#ifdef CURL_DISABLE_FORM_API
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "large-time: "
+#if SIZEOF_TIME_T < 5
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "large-size: "
+#if SIZEOF_SIZE_T < 5
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "sha512-256: "
+#ifndef CURL_HAVE_SHA512_256
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+
+  "win32-ca-searchpath: "
+#if !defined(_WIN32) ||                                                 \
+  (defined(CURL_WINDOWS_UWP) ||                                         \
+   defined(CURL_DISABLE_CA_SEARCH) || defined(CURL_CA_SEARCH_SAFE))
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "win32-ca-search-safe: "
+#if !defined(_WIN32) || !defined(CURL_CA_SEARCH_SAFE)
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+
+  "--libcurl: "
+#ifdef CURL_DISABLE_LIBCURL_OPTION
+  "OFF"
+#else
+  "ON"
+#endif
+  ,
+  "override-dns: "
+#if defined(CURL_MEMDEBUG) &&                              \
+  (defined(USE_RESOLV_ARES) || defined(USE_FAKE_GETADDRINFO))
+  "ON"
+#else
+  "OFF"
+#endif
+  ,
+  "ssl-sessions: "
+#ifdef USE_SSLS_EXPORT
+  "ON"
+#else
+  "OFF"
+#endif
+  ,
+  "cert-status: "
+#if defined(USE_GNUTLS) || (defined(USE_OPENSSL) && !defined(OPENSSL_NO_OCSP))
+  "ON"
+#else
+  "OFF"
+#endif
+};
+
+int main(int argc, const char **argv)
+{
+  size_t i;
+
+  (void)argc;
+  (void)argv;
+
+  for(i = 0; i < CURL_ARRAYSIZE(disabled); i++)
+    puts(disabled[i]);
+
+  return 0;
+}
diff --git a/third-party/curl/src/mk-file-embed.pl b/third-party/curl/src/mk-file-embed.pl
new file mode 100644
index 0000000000..9f3a1b3976
--- /dev/null
+++ b/third-party/curl/src/mk-file-embed.pl
@@ -0,0 +1,63 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+my $varname = "var";
+if(@ARGV && $ARGV[0] eq "--var") {
+    shift;
+    $varname = shift @ARGV;
+}
+
+my $varname_upper = uc($varname);
+
+print <<HEAD
+/*
+ * NEVER EVER edit this manually, fix the mk-file-embed.pl script instead!
+ */
+/* !checksrc! disable COPYRIGHT all */
+#include "tool_setup.h"
+
+const unsigned char ${varname}[] = {
+HEAD
+    ;
+
+while(<STDIN>) {
+    my $line = $_;
+    foreach my $n (split //, $line) {
+        my $ord = ord($n);
+        printf("%s,", $ord);
+        if($ord == 10) {
+             printf("\n");
+        }
+    }
+}
+
+print <<ENDLINE
+0
+};
+ENDLINE
+    ;
diff --git a/third-party/curl/src/mkhelp.pl b/third-party/curl/src/mkhelp.pl
index 19a30e2c81..9c60d7a64b 100644
--- a/third-party/curl/src/mkhelp.pl
+++ b/third-party/curl/src/mkhelp.pl
@@ -23,73 +23,36 @@
 #
 ###########################################################################
 
-# Yeah, I know, probably 1000 other persons already wrote a script like
-# this, but I'll tell ya:
+use strict;
+use warnings;
 
-# THEY DON'T FIT ME :-)
-
-# Get readme file as parameter:
-
-if($ARGV[0] eq "-c") {
-    $c=1;
+my $c = 0;
+if(@ARGV && $ARGV[0] eq "-c") {
+    $c = 1;
     shift @ARGV;
 }
 
-push @out, "                                  _   _ ____  _\n";
-push @out, "  Project                     ___| | | |  _ \\| |\n";
-push @out, "                             / __| | | | |_) | |\n";
-push @out, "                            | (__| |_| |  _ <| |___\n";
-push @out, "                             \\___|\\___/|_| \\_\\_____|\n";
+my @out;
 
-my $olen=0;
-while (<STDIN>) {
+push @out, "          _   _ ____  _\n";
+push @out, "      ___| | | |  _ \\| |\n";
+push @out, "     / __| | | | |_) | |\n";
+push @out, "    | (__| |_| |  _ <| |___\n";
+push @out, "     \\___|\\___/|_| \\_\\_____|\n";
+
+while(<STDIN>) {
     my $line = $_;
-
-    # this should be removed:
-    $line =~ s/(.|_)//g;
-
-    # remove trailing CR from line. msysgit checks out files as line+CRLF
-    $line =~ s/\r$//;
-
-    $line =~ s/\x1b\x5b[0-9]+m//g; # escape sequence
-    if($line =~ /^([ \t]*\n|curl)/i) {
-        # cut off headers and empty lines
-        $wline++; # count number of cut off lines
-        next;
-    }
-
-    my $text = $line;
-    $text =~ s/^\s+//g; # cut off preceding...
-    $text =~ s/\s+$//g; # and trailing whitespaces
-
-    $tlen = length($text);
-
-    if($wline && ($olen == $tlen)) {
-        # if the previous line with contents was exactly as long as
-        # this line, then we ignore the newlines!
-
-        # We do this magic because a header may abort a paragraph at
-        # any line, but we don't want that to be noticed in the output
-        # here
-        $wline=0;
-    }
-    $olen = $tlen;
-
-    if($wline) {
-        # we only make one empty line max
-        $wline = 0;
-        push @out, "\n";
-    }
     push @out, $line;
 }
-push @out, "\n"; # just an extra newline
 
 print <<HEAD
 /*
  * NEVER EVER edit this manually, fix the mkhelp.pl script instead!
  */
-#ifdef USE_MANUAL
 #include "tool_hugehelp.h"
+#ifdef USE_MANUAL
+#include "tool_help.h"
+
 HEAD
     ;
 if($c) {
@@ -101,7 +64,7 @@ if($c) {
       IO::Compress::Gzip->import();
       1;
     };
-    print STDERR "Warning: compression requested but Gzip is not available\n" if (!$c)
+    print STDERR "Warning: compression requested but Gzip is not available\n" if(!$c)
 }
 
 if($c)
@@ -110,12 +73,11 @@ if($c)
     my $gzippedContent;
     IO::Compress::Gzip::gzip(
         \$content, \$gzippedContent, Level => 9, TextFlag => 1, Time=>0) or die "gzip failed:";
-    $gzip = length($content);
-    $gzipped = length($gzippedContent);
+    my $gzip = length($content);
+    my $gzipped = length($gzippedContent);
 
     print <<HEAD
 #include <zlib.h>
-#include "memdebug.h" /* keep this as LAST include */
 static const unsigned char hugehelpgz[] = {
   /* This mumbo-jumbo is the huge help text compressed with gzip.
      Thanks to this operation, the size of this data shrank from $gzip
@@ -124,13 +86,15 @@ static const unsigned char hugehelpgz[] = {
 HEAD
 ;
 
-    my $c=0;
-    print " ";
+    my $c = 0;
     for(split(//, $gzippedContent)) {
-        my $num=ord($_);
+        my $num = ord($_);
+        if(!($c % 12)) {
+            print " ";
+        }
         printf(" 0x%02x,", 0+$num);
         if(!(++$c % 12)) {
-            print "\n ";
+            print "\n";
         }
     }
     print "\n};\n";
@@ -139,51 +103,96 @@ HEAD
 #define BUF_SIZE 0x10000
 static voidpf zalloc_func(voidpf opaque, unsigned int items, unsigned int size)
 {
-  (void) opaque;
-  /* not a typo, keep it calloc() */
-  return (voidpf) calloc(items, size);
+  (void)opaque;
+  /* not a typo, keep it curlx_calloc() */
+  return curlx_calloc(items, size);
 }
 static void zfree_func(voidpf opaque, voidpf ptr)
 {
-  (void) opaque;
-  free(ptr);
+  (void)opaque;
+  curlx_free(ptr);
 }
+
+#define HEADERLEN 10
+
 /* Decompress and send to stdout a gzip-compressed buffer */
 void hugehelp(void)
 {
-  unsigned char* buf;
-  int status,headerlen;
+  unsigned char *buf;
+  int status;
   z_stream z;
 
   /* Make sure no gzip options are set */
-  if (hugehelpgz[3] & 0xfe)
+  if(hugehelpgz[3] & 0xfe)
     return;
 
-  headerlen = 10;
   memset(&z, 0, sizeof(z_stream));
   z.zalloc = (alloc_func)zalloc_func;
   z.zfree = (free_func)zfree_func;
-  z.avail_in = (unsigned int)(sizeof(hugehelpgz) - headerlen);
-  z.next_in = (unsigned char *)hugehelpgz + headerlen;
+  z.avail_in = (uInt)(sizeof(hugehelpgz) - HEADERLEN);
+  z.next_in = (z_const Bytef *)hugehelpgz + HEADERLEN;
 
-  if (inflateInit2(&z, -MAX_WBITS) != Z_OK)
+  if(inflateInit2(&z, -MAX_WBITS) != Z_OK)
     return;
 
-  buf = malloc(BUF_SIZE);
-  if (buf) {
+  buf = curlx_malloc(BUF_SIZE);
+  if(buf) {
     while(1) {
       z.avail_out = BUF_SIZE;
       z.next_out = buf;
       status = inflate(&z, Z_SYNC_FLUSH);
-      if (status == Z_OK || status == Z_STREAM_END) {
+      if(status == Z_OK || status == Z_STREAM_END) {
         fwrite(buf, BUF_SIZE - z.avail_out, 1, stdout);
-        if (status == Z_STREAM_END)
+        if(status == Z_STREAM_END)
           break;
       }
       else
-        break;    /* Error */
+        break;    /* error */
     }
-    free(buf);
+    curlx_free(buf);
+  }
+  inflateEnd(&z);
+}
+
+/* Show the help text for the 'arg' curl argument on stdout */
+void showhelp(const char *trigger, const char *arg, const char *endarg)
+{
+  unsigned char *buf;
+  int status;
+  z_stream z;
+  struct scan_ctx ctx;
+  inithelpscan(&ctx, trigger, arg, endarg);
+
+  /* Make sure no gzip options are set */
+  if(hugehelpgz[3] & 0xfe)
+    return;
+
+  memset(&z, 0, sizeof(z_stream));
+  z.zalloc = (alloc_func)zalloc_func;
+  z.zfree = (free_func)zfree_func;
+  z.avail_in = (uInt)(sizeof(hugehelpgz) - HEADERLEN);
+  z.next_in = (z_const Bytef *)hugehelpgz + HEADERLEN;
+
+  if(inflateInit2(&z, -MAX_WBITS) != Z_OK)
+    return;
+
+  buf = curlx_malloc(BUF_SIZE);
+  if(buf) {
+    while(1) {
+      z.avail_out = BUF_SIZE;
+      z.next_out = buf;
+      status = inflate(&z, Z_SYNC_FLUSH);
+      if(status == Z_OK || status == Z_STREAM_END) {
+        size_t len = BUF_SIZE - z.avail_out;
+        if(!helpscan(buf, len, &ctx))
+          break;
+        if(status == Z_STREAM_END)
+          break;
+      }
+      else
+        break;    /* error */
+    }
+    curlx_free(buf);
   }
   inflateEnd(&z);
 }
@@ -194,40 +203,59 @@ exit;
 }
 else {
     print <<HEAD
+static const char * const curlman[] = {
+HEAD
+        ;
+}
+
+my $blank;
+for my $n (@out) {
+    chomp $n;
+    $n =~ s/\\/\\\\/g;
+    $n =~ s/\"/\\\"/g;
+    $n =~ s/\t/\\t/g;
+
+    if(!$n) {
+        $blank++;
+    }
+    else {
+        $n =~ s/        /\\t/g;
+        printf("  \"%s%s\",\n", $blank ? "\\n" : "", $n);
+        $blank = 0;
+    }
+}
+
+print <<ENDLINE
+  NULL
+};
 void hugehelp(void)
 {
-   fputs(
-HEAD
-         ;
+  int i = 0;
+  while(curlman[i])
+    puts(curlman[i++]);
 }
 
-$outsize=0;
-for(@out) {
-    chop;
-
-    $new = $_;
-
-    $outsize += length($new)+1; # one for the newline
-
-    $new =~ s/\\/\\\\/g;
-    $new =~ s/\"/\\\"/g;
-
-    # gcc 2.96 claims ISO C89 only is required to support 509 letter strings
-    if($outsize > 500) {
-        # terminate and make another fputs() call here
-        print ", stdout);\n fputs(\n";
-        $outsize=length($new)+1;
-    }
-    printf("\"%s\\n\"\n", $new);
-
+/* Show the help text for the 'arg' curl argument on stdout */
+void showhelp(const char *trigger, const char *arg, const char *endarg)
+{
+  int i = 0;
+  struct scan_ctx ctx;
+  inithelpscan(&ctx, trigger, arg, endarg);
+  while(curlman[i]) {
+    size_t len = strlen(curlman[i]);
+    if(!helpscan((const unsigned char *)curlman[i], len, &ctx) ||
+       !helpscan((const unsigned char *)"\\n", 1, &ctx))
+      break;
+    i++;
+  }
 }
-
-print ", stdout) ;\n}\n";
+ENDLINE
+    ;
 
 foot();
 
 sub foot {
-  print <<FOOT
+    print <<FOOT
 #endif /* USE_MANUAL */
 FOOT
   ;
diff --git a/third-party/curl/src/slist_wc.c b/third-party/curl/src/slist_wc.c
index 7f1e8f19be..f34cbd4861 100644
--- a/third-party/curl/src/slist_wc.c
+++ b/third-party/curl/src/slist_wc.c
@@ -21,22 +21,17 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "tool_setup.h"
 
 #ifndef CURL_DISABLE_LIBCURL_OPTION
 
 #include "slist_wc.h"
 
-/* The last #include files should be: */
-#include "memdebug.h"
-
 /*
  * slist_wc_append() appends a string to the linked list. This function can be
  * used as an initialization function as well as an append function.
  */
-struct slist_wc *slist_wc_append(struct slist_wc *list,
-                                 const char *data)
+struct slist_wc *slist_wc_append(struct slist_wc *list, const char *data)
 {
   struct curl_slist *new_item = curl_slist_append(NULL, data);
 
@@ -44,7 +39,7 @@ struct slist_wc *slist_wc_append(struct slist_wc *list,
     return NULL;
 
   if(!list) {
-    list = malloc(sizeof(struct slist_wc));
+    list = curlx_malloc(sizeof(struct slist_wc));
 
     if(!list) {
       curl_slist_free_all(new_item);
@@ -68,7 +63,7 @@ void slist_wc_free_all(struct slist_wc *list)
     return;
 
   curl_slist_free_all(list->first);
-  free(list);
+  curlx_free(list);
 }
 
 #endif /* CURL_DISABLE_LIBCURL_OPTION */
diff --git a/third-party/curl/src/slist_wc.h b/third-party/curl/src/slist_wc.h
index dd7b8c10a7..694d80c4a8 100644
--- a/third-party/curl/src/slist_wc.h
+++ b/third-party/curl/src/slist_wc.h
@@ -23,8 +23,8 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "tool_setup.h"
+
 #ifndef CURL_DISABLE_LIBCURL_OPTION
 
 /* linked-list structure with last node cache for easysrc */
@@ -38,10 +38,10 @@ struct slist_wc {
  *
  * DESCRIPTION
  *
- * Appends a string to a linked list. If no list exists, it will be created
+ * Appends a string to a linked list. If no list exists, it is created
  * first. Returns the new list, after appending.
  */
-struct slist_wc *slist_wc_append(struct slist_wc *, const char *);
+struct slist_wc *slist_wc_append(struct slist_wc *list, const char *data);
 
 /*
  * NAME curl_slist_free_all()
@@ -50,7 +50,7 @@ struct slist_wc *slist_wc_append(struct slist_wc *, const char *);
  *
  * free a previously built curl_slist_wc.
  */
-void slist_wc_free_all(struct slist_wc *);
+void slist_wc_free_all(struct slist_wc *list);
 
 #endif /* CURL_DISABLE_LIBCURL_OPTION */
 
diff --git a/third-party/curl/src/terminal.c b/third-party/curl/src/terminal.c
new file mode 100644
index 0000000000..b25c0e6e80
--- /dev/null
+++ b/third-party/curl/src/terminal.c
@@ -0,0 +1,86 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "tool_setup.h"
+
+#ifdef HAVE_SYS_IOCTL_H
+#include <sys/ioctl.h>
+#endif
+
+#include "terminal.h"
+
+#ifdef HAVE_TERMIOS_H
+#  include <termios.h>
+#elif defined(HAVE_TERMIO_H)
+#  include <termio.h>
+#endif
+
+/*
+ * get_terminal_columns() returns the number of columns in the current
+ * terminal. It returns 79 on failure. Also, the number can be big.
+ */
+unsigned int get_terminal_columns(void)
+{
+  unsigned int width = 0;
+  char *colp = curl_getenv("COLUMNS");
+  if(colp) {
+    curl_off_t num;
+    const char *p = colp;
+    if(!curlx_str_number(&p, &num, 10000) && (num > 20))
+      width = (unsigned int)num;
+    curl_free(colp);
+  }
+
+  if(!width) {
+    int cols = 0;
+
+#ifdef TIOCGSIZE
+    struct ttysize ts;
+    if(!ioctl(STDIN_FILENO, TIOCGSIZE, &ts))
+      cols = ts.ts_cols;
+#elif defined(TIOCGWINSZ)
+    struct winsize ts;
+    if(!ioctl(STDIN_FILENO, TIOCGWINSZ, &ts))
+      cols = (int)ts.ws_col;
+#elif defined(_WIN32) && !defined(CURL_WINDOWS_UWP)
+    {
+      HANDLE stderr_hnd = GetStdHandle(STD_ERROR_HANDLE);
+      CONSOLE_SCREEN_BUFFER_INFO console_info;
+
+      if((stderr_hnd != INVALID_HANDLE_VALUE) &&
+         GetConsoleScreenBufferInfo(stderr_hnd, &console_info)) {
+        /*
+         * Do not use +1 to get the true screen-width since writing a
+         * character at the right edge causes a line wrap.
+         */
+        cols = (int)(console_info.srWindow.Right - console_info.srWindow.Left);
+      }
+    }
+#endif /* TIOCGSIZE */
+    if(cols >= 0 && cols < 10000)
+      width = (unsigned int)cols;
+  }
+  if(!width)
+    width = 79;
+  return width; /* 79 for unknown, might also be tiny or enormous */
+}
diff --git a/third-party/curl/src/terminal.h b/third-party/curl/src/terminal.h
new file mode 100644
index 0000000000..dbd4abe281
--- /dev/null
+++ b/third-party/curl/src/terminal.h
@@ -0,0 +1,30 @@
+#ifndef HEADER_CURL_TERMINAL_H
+#define HEADER_CURL_TERMINAL_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "tool_setup.h"
+
+unsigned int get_terminal_columns(void);
+
+#endif /* HEADER_CURL_TERMINAL_H */
diff --git a/third-party/curl/src/tool_binmode.c b/third-party/curl/src/tool_binmode.c
deleted file mode 100644
index e27ce9663c..0000000000
--- a/third-party/curl/src/tool_binmode.c
+++ /dev/null
@@ -1,53 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "tool_setup.h"
-
-#ifdef HAVE_SETMODE
-
-#ifdef HAVE_IO_H
-#  include <io.h>
-#endif
-
-#ifdef HAVE_FCNTL_H
-#  include <fcntl.h>
-#endif
-
-#include "tool_binmode.h"
-
-#include "memdebug.h" /* keep this as LAST include */
-
-void set_binmode(FILE *stream)
-{
-#ifdef O_BINARY
-#  ifdef __HIGHC__
-  _setmode(stream, O_BINARY);
-#  else
-  (void)setmode(fileno(stream), O_BINARY);
-#  endif
-#else
-  (void)stream;
-#endif
-}
-
-#endif /* HAVE_SETMODE */
diff --git a/third-party/curl/src/tool_binmode.h b/third-party/curl/src/tool_binmode.h
deleted file mode 100644
index bee837b000..0000000000
--- a/third-party/curl/src/tool_binmode.h
+++ /dev/null
@@ -1,38 +0,0 @@
-#ifndef HEADER_CURL_TOOL_BINMODE_H
-#define HEADER_CURL_TOOL_BINMODE_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "tool_setup.h"
-
-#ifdef HAVE_SETMODE
-
-void set_binmode(FILE *stream);
-
-#else
-
-#define set_binmode(x) Curl_nop_stmt
-
-#endif /* HAVE_SETMODE */
-
-#endif /* HEADER_CURL_TOOL_BINMODE_H */
diff --git a/third-party/curl/src/tool_bname.c b/third-party/curl/src/tool_bname.c
deleted file mode 100644
index 4ba1a3b8ee..0000000000
--- a/third-party/curl/src/tool_bname.c
+++ /dev/null
@@ -1,51 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "tool_setup.h"
-
-#include "tool_bname.h"
-
-#include "memdebug.h" /* keep this as LAST include */
-
-#ifndef HAVE_BASENAME
-
-char *tool_basename(char *path)
-{
-  char *s1;
-  char *s2;
-
-  s1 = strrchr(path, '/');
-  s2 = strrchr(path, '\\');
-
-  if(s1 && s2) {
-    path = (s1 > s2) ? s1 + 1 : s2 + 1;
-  }
-  else if(s1)
-    path = s1 + 1;
-  else if(s2)
-    path = s2 + 1;
-
-  return path;
-}
-
-#endif /* HAVE_BASENAME */
diff --git a/third-party/curl/src/tool_bname.h b/third-party/curl/src/tool_bname.h
deleted file mode 100644
index d091c2231a..0000000000
--- a/third-party/curl/src/tool_bname.h
+++ /dev/null
@@ -1,36 +0,0 @@
-#ifndef HEADER_CURL_TOOL_BNAME_H
-#define HEADER_CURL_TOOL_BNAME_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "tool_setup.h"
-
-#ifndef HAVE_BASENAME
-
-char *tool_basename(char *path);
-
-#define basename(x) tool_basename((x))
-
-#endif /* HAVE_BASENAME */
-
-#endif /* HEADER_CURL_TOOL_BNAME_H */
diff --git a/third-party/curl/src/tool_cb_dbg.c b/third-party/curl/src/tool_cb_dbg.c
index d53a43978d..cd046dcbad 100644
--- a/third-party/curl/src/tool_cb_dbg.c
+++ b/third-party/curl/src/tool_cb_dbg.c
@@ -23,45 +23,27 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
-
 #include "tool_cfgable.h"
 #include "tool_msgs.h"
 #include "tool_cb_dbg.h"
 #include "tool_util.h"
-
-#include "memdebug.h" /* keep this as LAST include */
-
-static void dump(const char *timebuf, const char *idsbuf, const char *text,
-                 FILE *stream, const unsigned char *ptr, size_t size,
-                 trace tracetype, curl_infotype infotype);
+#include "toolx/tool_time.h"
 
 /*
  * Return the formatted HH:MM:SS for the tv_sec given.
- * NOT thread safe.
  */
 static const char *hms_for_sec(time_t tv_sec)
 {
   static time_t cached_tv_sec;
   static char hms_buf[12];
-  static time_t epoch_offset;
-  static int known_epoch;
 
   if(tv_sec != cached_tv_sec) {
-    struct tm *now;
-    time_t secs;
-    /* recalculate */
-    if(!known_epoch) {
-      epoch_offset = time(NULL) - tv_sec;
-      known_epoch = 1;
-    }
-    secs = epoch_offset + tv_sec;
-    /* !checksrc! disable BANNEDFUNC 1 */
-    now = localtime(&secs);  /* not thread safe but we don't care */
-    msnprintf(hms_buf, sizeof(hms_buf), "%02d:%02d:%02d",
-              now->tm_hour, now->tm_min, now->tm_sec);
+    struct tm now;
+    CURLcode result = toolx_localtime(tv_sec, &now);
+    if(result)
+      memset(&now, 0, sizeof(now));
+    curl_msnprintf(hms_buf, sizeof(hms_buf), "%02d:%02d:%02d",
+                   now.tm_hour, now.tm_min, now.tm_sec);
     cached_tv_sec = tv_sec;
   }
   return hms_buf;
@@ -78,11 +60,65 @@ static void log_line_start(FILE *log, const char *timebuf,
     "* ", "< ", "> ", "{ ", "} ", "{ ", "} "
   };
   if((timebuf && *timebuf) || (idsbuf && *idsbuf))
-    fprintf(log, "%s%s%s", timebuf, idsbuf, s_infotype[type]);
+    curl_mfprintf(log, "%s%s%s", timebuf, idsbuf, s_infotype[type]);
   else
     fputs(s_infotype[type], log);
 }
 
+static void dump(const char *timebuf, const char *idsbuf, const char *text,
+                 FILE *stream, const unsigned char *ptr, size_t size,
+                 trace tracetype, curl_infotype infotype)
+{
+  size_t i;
+  size_t c;
+
+  unsigned int width = 0x10;
+
+  if(tracetype == TRACE_ASCII)
+    /* without the hex output, we can fit more on screen */
+    width = 0x40;
+
+  curl_mfprintf(stream, "%s%s%s, %zu bytes (0x%zx)\n", timebuf, idsbuf,
+                text, size, size);
+
+  for(i = 0; i < size; i += width) {
+
+    curl_mfprintf(stream, "%04zx: ", i);
+
+    if(tracetype == TRACE_BIN) {
+      /* hex not disabled, show it */
+      for(c = 0; c < width; c++)
+        if(i + c < size)
+          curl_mfprintf(stream, "%02x ", ptr[i + c]);
+        else
+          fputs("   ", stream);
+    }
+
+    for(c = 0; (c < width) && (i + c < size); c++) {
+      /* check for 0D0A; if found, skip past and start a new line of output */
+      if((tracetype == TRACE_ASCII) &&
+         (i + c + 1 < size) && (ptr[i + c] == 0x0D) &&
+         (ptr[i + c + 1] == 0x0A)) {
+        i += (c + 2 - width);
+        break;
+      }
+      (void)infotype;
+      curl_mfprintf(stream, "%c",
+                    ((ptr[i + c] >= 0x20) && (ptr[i + c] < 0x7F)) ?
+                    ptr[i + c] : UNPRINTABLE_CHAR);
+      /* check again for 0D0A, to avoid an extra \n if it is at width */
+      if((tracetype == TRACE_ASCII) &&
+         (i + c + 2 < size) && (ptr[i + c + 1] == 0x0D) &&
+         (ptr[i + c + 2] == 0x0A)) {
+        i += (c + 3 - width);
+        break;
+      }
+    }
+    fputc('\n', stream); /* newline */
+  }
+  fflush(stream);
+}
+
 #define TRC_IDS_FORMAT_IDS_1  "[%" CURL_FORMAT_CURL_OFF_T "-x] "
 #define TRC_IDS_FORMAT_IDS_2  "[%" CURL_FORMAT_CURL_OFF_T "-%" \
                                    CURL_FORMAT_CURL_OFF_T "] "
@@ -93,66 +129,65 @@ int tool_debug_cb(CURL *handle, curl_infotype type,
                   char *data, size_t size,
                   void *userdata)
 {
-  struct OperationConfig *operation = userdata;
-  struct GlobalConfig *config = operation->global;
-  FILE *output = stderr;
+  FILE *output = tool_stderr;
   const char *text;
   struct timeval tv;
   char timebuf[20];
-  /* largest signed 64bit is: 9,223,372,036,854,775,807
-   * max length in decimal: 1 + (6*3) = 19
+  /* largest signed 64-bit is: 9,223,372,036,854,775,807
+   * max length in decimal: 1 + (6 * 3) = 19
    * formatted via TRC_IDS_FORMAT_IDS_2 this becomes 2 + 19 + 1 + 19 + 2 = 43
    * negative xfer-id are not printed, negative conn-ids use TRC_IDS_FORMAT_1
    */
   char idsbuf[60];
   curl_off_t xfer_id, conn_id;
 
-  (void)handle; /* not used */
+  (void)handle;
+  (void)userdata;
 
-  if(config->tracetime) {
-    tv = tvnow();
-    msnprintf(timebuf, sizeof(timebuf), "%s.%06ld ",
-              hms_for_sec(tv.tv_sec), (long)tv.tv_usec);
+  if(global->tracetime) {
+    tv = tvrealnow();
+    curl_msnprintf(timebuf, sizeof(timebuf), "%s.%06ld ",
+                   hms_for_sec(tv.tv_sec), (long)tv.tv_usec);
   }
   else
     timebuf[0] = 0;
 
-  if(handle && config->traceids &&
+  if(handle && global->traceids &&
      !curl_easy_getinfo(handle, CURLINFO_XFER_ID, &xfer_id) && xfer_id >= 0) {
     if(!curl_easy_getinfo(handle, CURLINFO_CONN_ID, &conn_id) &&
-        conn_id >= 0) {
-      msnprintf(idsbuf, sizeof(idsbuf), TRC_IDS_FORMAT_IDS_2,
-                xfer_id, conn_id);
+       conn_id >= 0) {
+      curl_msnprintf(idsbuf, sizeof(idsbuf), TRC_IDS_FORMAT_IDS_2,
+                     xfer_id, conn_id);
     }
     else {
-      msnprintf(idsbuf, sizeof(idsbuf), TRC_IDS_FORMAT_IDS_1, xfer_id);
+      curl_msnprintf(idsbuf, sizeof(idsbuf), TRC_IDS_FORMAT_IDS_1, xfer_id);
     }
   }
   else
     idsbuf[0] = 0;
 
-  if(!config->trace_stream) {
+  if(!global->trace_stream) {
     /* open for append */
-    if(!strcmp("-", config->trace_dump))
-      config->trace_stream = stdout;
-    else if(!strcmp("%", config->trace_dump))
+    if(!strcmp("-", global->trace_dump))
+      global->trace_stream = stdout;
+    else if(!strcmp("%", global->trace_dump))
       /* Ok, this is somewhat hackish but we do it undocumented for now */
-      config->trace_stream = stderr;
+      global->trace_stream = tool_stderr;
     else {
-      config->trace_stream = fopen(config->trace_dump, FOPEN_WRITETEXT);
-      config->trace_fopened = TRUE;
+      global->trace_stream = curlx_fopen(global->trace_dump, FOPEN_WRITETEXT);
+      global->trace_fopened = TRUE;
     }
   }
 
-  if(config->trace_stream)
-    output = config->trace_stream;
+  if(global->trace_stream)
+    output = global->trace_stream;
 
   if(!output) {
-    warnf(config, "Failed to create/open output");
+    warnf("Failed to create/open output");
     return 0;
   }
 
-  if(config->tracetype == TRACE_PLAIN) {
+  if(global->tracetype == TRACE_PLAIN) {
     static bool newl = FALSE;
     static bool traced_data = FALSE;
 
@@ -175,7 +210,7 @@ int tool_debug_cb(CURL *handle, curl_infotype type,
           log_line_start(output, timebuf, idsbuf, type);
         (void)fwrite(data + st, i - st + 1, 1, output);
       }
-      newl = (size && (data[size - 1] != '\n')) ? TRUE : FALSE;
+      newl = (size && (data[size - 1] != '\n'));
       traced_data = FALSE;
       break;
     case CURLINFO_TEXT:
@@ -183,7 +218,7 @@ int tool_debug_cb(CURL *handle, curl_infotype type,
       if(!newl)
         log_line_start(output, timebuf, idsbuf, type);
       (void)fwrite(data, size, 1, output);
-      newl = (size && (data[size - 1] != '\n')) ? TRUE : FALSE;
+      newl = (size && (data[size - 1] != '\n'));
       traced_data = FALSE;
       break;
     case CURLINFO_DATA_OUT:
@@ -191,14 +226,14 @@ int tool_debug_cb(CURL *handle, curl_infotype type,
     case CURLINFO_SSL_DATA_IN:
     case CURLINFO_SSL_DATA_OUT:
       if(!traced_data) {
-        /* if the data is output to a tty and we're sending this debug trace
-           to stderr or stdout, we don't display the alert about the data not
-           being shown as the data _is_ shown then just not via this
-           function */
-        if(!config->isatty || ((output != stderr) && (output != stdout))) {
+        /* if the data is output to a tty and we are sending this debug trace
+           to stderr or stdout, we do not display the alert about the data not
+           being shown as the data _is_ shown then not via this function */
+        if(!global->isatty ||
+           ((output != tool_stderr) && (output != stdout))) {
           if(!newl)
             log_line_start(output, timebuf, idsbuf, type);
-          fprintf(output, "[%zu bytes data]\n", size);
+          curl_mfprintf(output, "[%zu bytes data]\n", size);
           newl = FALSE;
           traced_data = TRUE;
         }
@@ -215,8 +250,8 @@ int tool_debug_cb(CURL *handle, curl_infotype type,
 
   switch(type) {
   case CURLINFO_TEXT:
-    fprintf(output, "%s%s== Info: %.*s", timebuf, idsbuf, (int)size, data);
-    /* FALLTHROUGH */
+    curl_mfprintf(output, "%s%s* %.*s", timebuf, idsbuf, (int)size, data);
+    FALLTHROUGH();
   default: /* in case a new one is introduced to shock us */
     return 0;
 
@@ -240,60 +275,7 @@ int tool_debug_cb(CURL *handle, curl_infotype type,
     break;
   }
 
-  dump(timebuf, idsbuf, text, output, (unsigned char *) data, size,
-       config->tracetype, type);
+  dump(timebuf, idsbuf, text, output, (unsigned char *)data, size,
+       global->tracetype, type);
   return 0;
 }
-
-static void dump(const char *timebuf, const char *idsbuf, const char *text,
-                 FILE *stream, const unsigned char *ptr, size_t size,
-                 trace tracetype, curl_infotype infotype)
-{
-  size_t i;
-  size_t c;
-
-  unsigned int width = 0x10;
-
-  if(tracetype == TRACE_ASCII)
-    /* without the hex output, we can fit more on screen */
-    width = 0x40;
-
-  fprintf(stream, "%s%s%s, %zu bytes (0x%zx)\n", timebuf, idsbuf,
-          text, size, size);
-
-  for(i = 0; i < size; i += width) {
-
-    fprintf(stream, "%04zx: ", i);
-
-    if(tracetype == TRACE_BIN) {
-      /* hex not disabled, show it */
-      for(c = 0; c < width; c++)
-        if(i + c < size)
-          fprintf(stream, "%02x ", ptr[i + c]);
-        else
-          fputs("   ", stream);
-    }
-
-    for(c = 0; (c < width) && (i + c < size); c++) {
-      /* check for 0D0A; if found, skip past and start a new line of output */
-      if((tracetype == TRACE_ASCII) &&
-         (i + c + 1 < size) && (ptr[i + c] == 0x0D) &&
-         (ptr[i + c + 1] == 0x0A)) {
-        i += (c + 2 - width);
-        break;
-      }
-      (void)infotype;
-      fprintf(stream, "%c", ((ptr[i + c] >= 0x20) && (ptr[i + c] < 0x7F)) ?
-              ptr[i + c] : UNPRINTABLE_CHAR);
-      /* check again for 0D0A, to avoid an extra \n if it's at width */
-      if((tracetype == TRACE_ASCII) &&
-         (i + c + 2 < size) && (ptr[i + c + 1] == 0x0D) &&
-         (ptr[i + c + 2] == 0x0A)) {
-        i += (c + 3 - width);
-        break;
-      }
-    }
-    fputc('\n', stream); /* newline */
-  }
-  fflush(stream);
-}
diff --git a/third-party/curl/src/tool_cb_hdr.c b/third-party/curl/src/tool_cb_hdr.c
index df44f7aa73..9b3a33aefb 100644
--- a/third-party/curl/src/tool_cb_hdr.c
+++ b/third-party/curl/src/tool_cb_hdr.c
@@ -23,11 +23,9 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#include "strcase.h"
-
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
+#ifdef HAVE_UNISTD_H
+#include <unistd.h>
+#endif
 
 #include "tool_cfgable.h"
 #include "tool_doswin.h"
@@ -37,326 +35,48 @@
 #include "tool_operate.h"
 #include "tool_libinfo.h"
 
-#include "memdebug.h" /* keep this as LAST include */
-
-static char *parse_filename(const char *ptr, size_t len);
-
-#ifdef WIN32
-#define BOLD
-#define BOLDOFF
+#ifdef _WIN32
+#define BOLD    "\x1b[1m"
+#define BOLDOFF "\x1b[22m"
 #else
-#define BOLD "\x1b[1m"
+#define BOLD    "\x1b[1m"
 /* Switch off bold by setting "all attributes off" since the explicit
-   bold-off code (21) isn't supported everywhere - like in the mac
+   bold-off code (21) is not supported everywhere - like in the mac
    Terminal. */
 #define BOLDOFF "\x1b[0m"
 /* OSC 8 hyperlink escape sequence */
-#define LINK "\x1b]8;;"
-#define LINKST "\x1b\\"
+#define LINK    "\x1b]8;;"
+#define LINKST  "\x1b\\"
 #define LINKOFF LINK LINKST
 #endif
 
-#ifdef LINK
-static void write_linked_location(CURL *curl, const char *location,
-    size_t loclen, FILE *stream);
-#endif
-
-/*
-** callback for CURLOPT_HEADERFUNCTION
-*/
-
-size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
-{
-  struct per_transfer *per = userdata;
-  struct HdrCbData *hdrcbdata = &per->hdrcbdata;
-  struct OutStruct *outs = &per->outs;
-  struct OutStruct *heads = &per->heads;
-  struct OutStruct *etag_save = &per->etag_save;
-  const char *str = ptr;
-  const size_t cb = size * nmemb;
-  const char *end = (char *)ptr + cb;
-  const char *scheme = NULL;
-
-  if(!per->config)
-    return CURL_WRITEFUNC_ERROR;
-
-#ifdef DEBUGBUILD
-  if(size * nmemb > (size_t)CURL_MAX_HTTP_HEADER) {
-    warnf(per->config->global, "Header data exceeds single call write limit");
-    return CURL_WRITEFUNC_ERROR;
-  }
-#endif
-
-#ifdef WIN32
-  /* Discard incomplete UTF-8 sequence buffered from body */
-  if(outs->utf8seq[0])
-    memset(outs->utf8seq, 0, sizeof(outs->utf8seq));
-#endif
-
-  /*
-   * Write header data when curl option --dump-header (-D) is given.
-   */
-
-  if(per->config->headerfile && heads->stream) {
-    size_t rc = fwrite(ptr, size, nmemb, heads->stream);
-    if(rc != cb)
-      return rc;
-    /* flush the stream to send off what we got earlier */
-    (void)fflush(heads->stream);
-  }
-
-  /*
-   * Write etag to file when --etag-save option is given.
-   */
-  if(per->config->etag_save_file && etag_save->stream) {
-    /* match only header that start with etag (case insensitive) */
-    if(curl_strnequal(str, "etag:", 5)) {
-      const char *etag_h = &str[5];
-      const char *eot = end - 1;
-      if(*eot == '\n') {
-        while(ISBLANK(*etag_h) && (etag_h < eot))
-          etag_h++;
-        while(ISSPACE(*eot))
-          eot--;
-
-        if(eot >= etag_h) {
-          size_t etag_length = eot - etag_h + 1;
-          fwrite(etag_h, size, etag_length, etag_save->stream);
-          /* terminate with newline */
-          fputc('\n', etag_save->stream);
-          (void)fflush(etag_save->stream);
-        }
-      }
-    }
-  }
-
-  /*
-   * This callback sets the filename where output shall be written when
-   * curl options --remote-name (-O) and --remote-header-name (-J) have
-   * been simultaneously given and additionally server returns an HTTP
-   * Content-Disposition header specifying a filename property.
-   */
-
-  curl_easy_getinfo(per->curl, CURLINFO_SCHEME, &scheme);
-  scheme = proto_token(scheme);
-  if(hdrcbdata->honor_cd_filename &&
-     (cb > 20) && checkprefix("Content-disposition:", str) &&
-     (scheme == proto_http || scheme == proto_https)) {
-    const char *p = str + 20;
-
-    /* look for the 'filename=' parameter
-       (encoded filenames (*=) are not supported) */
-    for(;;) {
-      char *filename;
-      size_t len;
-
-      while(*p && (p < end) && !ISALPHA(*p))
-        p++;
-      if(p > end - 9)
-        break;
-
-      if(memcmp(p, "filename=", 9)) {
-        /* no match, find next parameter */
-        while((p < end) && (*p != ';'))
-          p++;
-        continue;
-      }
-      p += 9;
-
-      /* this expression below typecasts 'cb' only to avoid
-         warning: signed and unsigned type in conditional expression
-      */
-      len = (ssize_t)cb - (p - str);
-      filename = parse_filename(p, len);
-      if(filename) {
-        if(outs->stream) {
-          /* indication of problem, get out! */
-          free(filename);
-          return CURL_WRITEFUNC_ERROR;
-        }
-
-        outs->is_cd_filename = TRUE;
-        outs->s_isreg = TRUE;
-        outs->fopened = FALSE;
-        outs->filename = filename;
-        outs->alloc_filename = TRUE;
-        hdrcbdata->honor_cd_filename = FALSE; /* done now! */
-        if(!tool_create_output_file(outs, per->config))
-          return CURL_WRITEFUNC_ERROR;
-      }
-      break;
-    }
-    if(!outs->stream && !tool_create_output_file(outs, per->config))
-      return CURL_WRITEFUNC_ERROR;
-  }
-  if(hdrcbdata->config->writeout) {
-    char *value = memchr(ptr, ':', cb);
-    if(value) {
-      if(per->was_last_header_empty)
-        per->num_headers = 0;
-      per->was_last_header_empty = FALSE;
-      per->num_headers++;
-    }
-    else if(ptr[0] == '\r' || ptr[0] == '\n')
-      per->was_last_header_empty = TRUE;
-  }
-  if(hdrcbdata->config->show_headers &&
-    (scheme == proto_http || scheme == proto_https ||
-     scheme == proto_rtsp || scheme == proto_file)) {
-    /* bold headers only for selected protocols */
-    char *value = NULL;
-
-    if(!outs->stream && !tool_create_output_file(outs, per->config))
-      return CURL_WRITEFUNC_ERROR;
-
-    if(hdrcbdata->global->isatty && hdrcbdata->global->styled_output)
-      value = memchr(ptr, ':', cb);
-    if(value) {
-      size_t namelen = value - ptr;
-      fprintf(outs->stream, BOLD "%.*s" BOLDOFF ":", (int)namelen, ptr);
-#ifndef LINK
-      fwrite(&value[1], cb - namelen - 1, 1, outs->stream);
-#else
-      if(curl_strnequal("Location", ptr, namelen)) {
-        write_linked_location(per->curl, &value[1], cb - namelen - 1,
-            outs->stream);
-      }
-      else
-        fwrite(&value[1], cb - namelen - 1, 1, outs->stream);
-#endif
-    }
-    else
-      /* not "handled", just show it */
-      fwrite(ptr, cb, 1, outs->stream);
-  }
-  return cb;
-}
-
-/*
- * Copies a file name part and returns an ALLOCATED data buffer.
- */
-static char *parse_filename(const char *ptr, size_t len)
-{
-  char *copy;
-  char *p;
-  char *q;
-  char  stop = '\0';
-
-  /* simple implementation of strndup() */
-  copy = malloc(len + 1);
-  if(!copy)
-    return NULL;
-  memcpy(copy, ptr, len);
-  copy[len] = '\0';
-
-  p = copy;
-  if(*p == '\'' || *p == '"') {
-    /* store the starting quote */
-    stop = *p;
-    p++;
-  }
-  else
-    stop = ';';
-
-  /* scan for the end letter and stop there */
-  q = strchr(p, stop);
-  if(q)
-    *q = '\0';
-
-  /* if the filename contains a path, only use filename portion */
-  q = strrchr(p, '/');
-  if(q) {
-    p = q + 1;
-    if(!*p) {
-      Curl_safefree(copy);
-      return NULL;
-    }
-  }
-
-  /* If the filename contains a backslash, only use filename portion. The idea
-     is that even systems that don't handle backslashes as path separators
-     probably want the path removed for convenience. */
-  q = strrchr(p, '\\');
-  if(q) {
-    p = q + 1;
-    if(!*p) {
-      Curl_safefree(copy);
-      return NULL;
-    }
-  }
-
-  /* make sure the file name doesn't end in \r or \n */
-  q = strchr(p, '\r');
-  if(q)
-    *q = '\0';
-
-  q = strchr(p, '\n');
-  if(q)
-    *q = '\0';
-
-  if(copy != p)
-    memmove(copy, p, strlen(p) + 1);
-
-#if defined(MSDOS) || defined(WIN32)
-  {
-    char *sanitized;
-    SANITIZEcode sc = sanitize_file_name(&sanitized, copy, 0);
-    Curl_safefree(copy);
-    if(sc)
-      return NULL;
-    copy = sanitized;
-  }
-#endif /* MSDOS || WIN32 */
-
-  /* in case we built debug enabled, we allow an environment variable
-   * named CURL_TESTDIR to prefix the given file name to put it into a
-   * specific directory
-   */
-#ifdef DEBUGBUILD
-  {
-    char *tdir = curlx_getenv("CURL_TESTDIR");
-    if(tdir) {
-      char buffer[512]; /* suitably large */
-      msnprintf(buffer, sizeof(buffer), "%s/%s", tdir, copy);
-      Curl_safefree(copy);
-      copy = strdup(buffer); /* clone the buffer, we don't use the libcurl
-                                aprintf() or similar since we want to use the
-                                same memory code as the "real" parse_filename
-                                function */
-      curl_free(tdir);
-    }
-  }
-#endif
-
-  return copy;
-}
-
 #ifdef LINK
 /*
  * Treat the Location: header specially, by writing a special escape
  * sequence that adds a hyperlink to the displayed text. This makes
  * the absolute URL of the redirect clickable in supported terminals,
- * which couldn't happen otherwise for relative URLs. The Location:
+ * which could not happen otherwise for relative URLs. The Location:
  * header is supposed to always be absolute so this theoretically
- * shouldn't be needed but the real world returns plenty of relative
+ * should not be needed but the real world returns plenty of relative
  * URLs here.
  */
-static
-void write_linked_location(CURL *curl, const char *location, size_t loclen,
-                           FILE *stream) {
+static void write_linked_location(CURL *curl, const char *location,
+                                  size_t loclen, FILE *stream)
+{
   /* This would so simple if CURLINFO_REDIRECT_URL were available here */
   CURLU *u = NULL;
-  char *copyloc = NULL, *locurl = NULL, *scheme = NULL, *finalurl = NULL;
-  const char *loc = location;
+  char *copyloc = NULL, *scheme = NULL, *finalurl = NULL;
+  const char *loc = location, *locurl = NULL;
   size_t llen = loclen;
   int space_skipped = 0;
-  char *vver = getenv("VTE_VERSION");
+  const char *vver = getenv("VTE_VERSION");
 
   if(vver) {
-    long vvn = strtol(vver, NULL, 10);
-    /* Skip formatting for old versions of VTE <= 0.48.1 (Mar 2017) since some
-       of those versions have formatting bugs. (#10428) */
-    if(0 < vvn && vvn <= 4801)
+    curl_off_t num;
+    if(curlx_str_number(&vver, &num, CURL_OFF_T_MAX) ||
+       /* Skip formatting for old versions of VTE <= 0.48.1 (Mar 2017) since
+          some of those versions have formatting bugs. (#10428) */
+       (num <= 4801))
       goto locout;
   }
 
@@ -368,7 +88,7 @@ void write_linked_location(CURL *curl, const char *location, size_t loclen,
   }
 
   /* Strip the trailing end-of-line characters, normally "\r\n" */
-  while(llen && (loc[llen-1] == '\n' || loc[llen-1] == '\r'))
+  while(llen && (loc[llen - 1] == '\n' || loc[llen - 1] == '\r'))
     --llen;
 
   /* CURLU makes it easy to handle the relative URL case */
@@ -376,12 +96,10 @@ void write_linked_location(CURL *curl, const char *location, size_t loclen,
   if(!u)
     goto locout;
 
-  /* Create a NUL-terminated and whitespace-stripped copy of Location: */
-  copyloc = malloc(llen + 1);
+  /* Create a null-terminated and whitespace-stripped copy of Location: */
+  copyloc = curlx_memdup0(loc, llen);
   if(!copyloc)
     goto locout;
-  memcpy(copyloc, loc, llen);
-  copyloc[llen] = 0;
 
   /* The original URL to use as a base for a relative redirect URL */
   if(curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_URL, &locurl))
@@ -403,14 +121,14 @@ void write_linked_location(CURL *curl, const char *location, size_t loclen,
      !strcmp("https", scheme) ||
      !strcmp("ftp", scheme) ||
      !strcmp("ftps", scheme)) {
-    fprintf(stream, "%.*s" LINK "%s" LINKST "%.*s" LINKOFF,
-            space_skipped, location,
-            finalurl,
-            (int)loclen - space_skipped, loc);
+    curl_mfprintf(stream, "%.*s" LINK "%s" LINKST "%.*s" LINKOFF,
+                  space_skipped, location,
+                  finalurl,
+                  (int)loclen - space_skipped, loc);
     goto locdone;
   }
 
-  /* Not a "safe" URL: don't linkify it */
+  /* Not a "safe" URL: do not linkify it */
 
 locout:
   /* Write the normal output in case of error or unsafe */
@@ -421,7 +139,410 @@ locdone:
     curl_free(finalurl);
     curl_free(scheme);
     curl_url_cleanup(u);
-    free(copyloc);
+    curlx_free(copyloc);
   }
 }
+#endif /* LINK */
+
+/*
+ * Copies a filename part and returns an ALLOCATED data buffer.
+ */
+static char *parse_filename(const char *ptr, size_t len, char stop)
+{
+  char *copy;
+  char *p;
+  char *q;
+
+  copy = curlx_memdup0(ptr, len);
+  if(!copy)
+    return NULL;
+
+  p = copy;
+  if(stop) {
+    /* a Content-Disposition: header */
+    if(*p == '\'' || *p == '"') {
+      /* store the starting quote */
+      stop = *p;
+      p++;
+    }
+
+    /* scan for the end letter and stop there */
+    q = strchr(p, stop);
+    if(q)
+      *q = '\0';
+  }
+  else {
+    /* this is a Location: header, so we need to trim off any queries and
+       fragments present */
+    q = strchr(p, '?'); /* trim off query, if present */
+    if(q)
+      *q = '\0';
+    q = strchr(p, '#'); /* trim off fragment, if present */
+    if(q)
+      *q = '\0';
+  }
+
+  /* if the filename contains a path, only use filename portion */
+  q = strrchr(p, '/');
+  if(q) {
+    p = q + 1;
+    if(!*p) {
+      curlx_safefree(copy);
+      return NULL;
+    }
+  }
+
+  /* If the filename contains a backslash, only use filename portion. The idea
+     is that even systems that do not handle backslashes as path separators
+     probably want the path removed for convenience. */
+  q = strrchr(p, '\\');
+  if(q) {
+    p = q + 1;
+    if(!*p) {
+      curlx_safefree(copy);
+      return NULL;
+    }
+  }
+
+  /* make sure the filename does not end in \r or \n */
+  q = strchr(p, '\r');
+  if(q)
+    *q = '\0';
+
+  q = strchr(p, '\n');
+  if(q)
+    *q = '\0';
+
+  if(copy != p)
+    memmove(copy, p, strlen(p) + 1);
+
+#if defined(_WIN32) || defined(MSDOS)
+  {
+    char *sanitized;
+    SANITIZEcode sc = sanitize_file_name(&sanitized, copy, 0);
+    curlx_safefree(copy);
+    if(sc)
+      return NULL;
+    copy = sanitized;
+  }
+#endif /* _WIN32 || MSDOS */
+
+  return copy;
+}
+
+int tool_write_headers(struct HdrCbData *hdrcbdata, FILE *stream)
+{
+  struct curl_slist *h = hdrcbdata->headlist;
+  int rc = 1;
+  while(h) {
+    /* not "handled", show it */
+    size_t len = strlen(h->data);
+    if(len != fwrite(h->data, 1, len, stream))
+      goto fail;
+    h = h->next;
+  }
+  rc = 0; /* success */
+fail:
+  curl_slist_free_all(hdrcbdata->headlist);
+  hdrcbdata->headlist = NULL;
+  return rc;
+}
+
+/*
+ * Write etag to file when --etag-save option is given.
+ */
+static size_t save_etag(const char *etag_h, const char *endp,
+                        struct OutStruct *etag_save)
+{
+  const char *eot = endp - 1;
+  if(*eot == '\n') {
+    while(ISBLANK(*etag_h) && (etag_h < eot))
+      etag_h++;
+    while(ISSPACE(*eot))
+      eot--;
+
+    if(eot >= etag_h) {
+      size_t etag_length = eot - etag_h + 1;
+      curlx_struct_stat file;
+      int fd = fileno(etag_save->stream);
+
+      /* Truncate regular files to avoid stale etag content */
+      if((fd != -1) &&
+         !curlx_fstat(fd, &file) &&
+         (S_ISREG(file.st_mode) &&
+          toolx_ftruncate(fd, 0)))
+        return CURL_WRITEFUNC_ERROR;
+
+      fwrite(etag_h, 1, etag_length, etag_save->stream);
+      /* terminate with newline */
+      fputc('\n', etag_save->stream);
+      (void)fflush(etag_save->stream);
+    }
+  }
+  return 0; /* ok */
+}
+
+/*
+ * This function sets the filename where output shall be written when curl
+ * options --remote-name (-O) and --remote-header-name (-J) have been
+ * simultaneously given and additionally server returns an HTTP
+ * Content-Disposition header specifying a filename property.
+ */
+static size_t content_disposition(const char *str, const char *end,
+                                  size_t cb, struct per_transfer *per,
+                                  long response) /* response code */
+{
+  struct HdrCbData *hdrcbdata = &per->hdrcbdata;
+  struct OutStruct *outs = &per->outs;
+
+  if((cb > 9) && checkprefix("Location:", str) && (response/100 == 3)) {
+    /* Get the name off the location header as a temporary measure in case
+       there is no Content-Disposition */
+    const char *p = &str[9];
+    curlx_str_passblanks(&p);
+    if(p < end) { /* as a precaution */
+      char *filename = parse_filename(p, cb - (p - str), 0);
+      if(filename) {
+        if(outs->stream) {
+          /* indication of problem, get out! */
+          curlx_free(filename);
+          return CURL_WRITEFUNC_ERROR;
+        }
+        if(outs->alloc_filename)
+          curlx_safefree(outs->filename);
+
+        if(per->config->output_dir) {
+          char *f = curl_maprintf("%s/%s", per->config->output_dir,
+                                  filename);
+          curlx_free(filename);
+          if(!f)
+            return CURL_WRITEFUNC_ERROR;
+          outs->filename = curlx_strdup(f);
+          curl_free(f);
+          if(!outs->filename)
+            return CURL_WRITEFUNC_ERROR;
+        }
+        else
+          outs->filename = filename;
+        outs->alloc_filename = TRUE;
+        outs->is_cd_filename = TRUE; /* set to avoid clobbering existing files
+                                        by default */
+      }
+    }
+  }
+  else if((cb > 20) && checkprefix("Content-disposition:", str)) {
+    const char *p = str + 20;
+    /* look for the 'filename=' parameter (encoded filenames (*=) are not
+       supported) */
+    for(;;) {
+      char *filename;
+      size_t len;
+
+      while((p < end) && *p && !ISALPHA(*p))
+        p++;
+      if(p > end - 9)
+        break;
+
+      if(memcmp(p, "filename=", 9)) {
+        /* no match, find next parameter */
+        while((p < end) && *p && (*p != ';'))
+          p++;
+        if((p < end) && *p)
+          continue;
+        else
+          break;
+      }
+      p += 9;
+
+      curlx_str_passblanks(&p);
+      len = cb - (size_t)(p - str);
+      filename = parse_filename(p, len, ';');
+      if(filename) {
+        if(outs->stream) {
+          /* indication of problem, get out! */
+          curlx_free(filename);
+          return CURL_WRITEFUNC_ERROR;
+        }
+        if(outs->alloc_filename)
+          curlx_safefree(outs->filename);
+
+        if(per->config->output_dir) {
+          char *f = curl_maprintf("%s/%s", per->config->output_dir,
+                                  filename);
+          curlx_free(filename);
+          if(!f)
+            return CURL_WRITEFUNC_ERROR;
+          outs->filename = curlx_strdup(f);
+          curl_free(f);
+          if(!outs->filename)
+            return CURL_WRITEFUNC_ERROR;
+        }
+        else
+          outs->filename = filename;
+
+        outs->is_cd_filename = TRUE;
+        outs->regular_file = TRUE;
+        outs->fopened = FALSE;
+        outs->alloc_filename = TRUE;
+        hdrcbdata->honor_cd_filename = FALSE; /* done now! */
+        if(!tool_create_output_file(outs, per->config))
+          return CURL_WRITEFUNC_ERROR;
+        if(tool_write_headers(&per->hdrcbdata, outs->stream))
+          return CURL_WRITEFUNC_ERROR;
+      }
+      break;
+    }
+    if(!outs->stream && !tool_create_output_file(outs, per->config))
+      return CURL_WRITEFUNC_ERROR;
+    if(tool_write_headers(&per->hdrcbdata, outs->stream))
+      return CURL_WRITEFUNC_ERROR;
+  } /* content-disposition handling */
+
+  if(hdrcbdata->honor_cd_filename &&
+     hdrcbdata->config->show_headers) {
+    /* still awaiting the Content-Disposition header, store the header in
+       memory. Since it is not null-terminated, we need an extra dance. */
+    char *clone = curlx_memdup0(str, cb);
+    if(clone) {
+      struct curl_slist *old = hdrcbdata->headlist;
+      hdrcbdata->headlist = curl_slist_append(old, clone);
+      curlx_free(clone);
+      if(!hdrcbdata->headlist) {
+        curl_slist_free_all(old);
+        return CURL_WRITEFUNC_ERROR;
+      }
+    }
+    else {
+      curl_slist_free_all(hdrcbdata->headlist);
+      hdrcbdata->headlist = NULL;
+      return CURL_WRITEFUNC_ERROR;
+    }
+    return cb; /* done for now */
+  }
+
+  return 0; /* ok */
+}
+
+/*
+** callback for CURLOPT_HEADERFUNCTION
+*
+* 'size' is always 1
+*/
+size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
+{
+  struct per_transfer *per = userdata;
+  struct HdrCbData *hdrcbdata = &per->hdrcbdata;
+  struct OutStruct *outs = &per->outs;
+  struct OutStruct *heads = &per->heads;
+  struct OutStruct *etag_save = &per->etag_save;
+  const char *str = ptr;
+  const size_t cb = size * nmemb;
+  const char *end = ptr + cb;
+  const char *scheme = NULL;
+
+  if(!per->config)
+    return CURL_WRITEFUNC_ERROR;
+
+#ifdef DEBUGBUILD
+  if(size * nmemb > (size_t)CURL_MAX_HTTP_HEADER) {
+    warnf("Header data exceeds write limit");
+    return CURL_WRITEFUNC_ERROR;
+  }
 #endif
+
+#ifdef _WIN32
+  /* Discard incomplete UTF-8 sequence buffered from body */
+  if(outs->utf8seq[0])
+    memset(outs->utf8seq, 0, sizeof(outs->utf8seq));
+#endif
+
+  /*
+   * Write header data when curl option --dump-header (-D) is given.
+   */
+
+  if(per->config->headerfile && heads->stream) {
+    size_t rc = fwrite(ptr, size, nmemb, heads->stream);
+    if(rc != nmemb)
+      return rc;
+    /* flush the stream to send off what we got earlier */
+    if(fflush(heads->stream)) {
+      errorf("Failed writing headers to %s", per->config->headerfile);
+      return CURL_WRITEFUNC_ERROR;
+    }
+  }
+
+  curl_easy_getinfo(per->curl, CURLINFO_SCHEME, &scheme);
+  scheme = proto_token(scheme);
+  if((scheme == proto_http || scheme == proto_https)) {
+    long response = 0;
+    curl_easy_getinfo(per->curl, CURLINFO_RESPONSE_CODE, &response);
+
+    if((response / 100 != 2) && (response / 100 != 3))
+      /* only care about etag and content-disposition headers in 2xx and 3xx
+         responses */
+      ;
+    else if(per->config->etag_save_file && etag_save->stream &&
+            /* match only header that start with etag (case insensitive) */
+            checkprefix("etag:", str)) {
+      size_t rc = save_etag(&str[5], end, etag_save);
+      if(rc)
+        return rc;
+    }
+
+    /* Parse the content-disposition and location headers. When
+       honor_cd_filename is true, other headers may be stored until the
+       content-disposition header is reached, at which point the saved headers
+       can be written. That means the content_disposition() may return an rc
+       when it has saved a different header for writing later. */
+    else if(hdrcbdata->honor_cd_filename) {
+      size_t rc = content_disposition(str, end, cb, per, response);
+      if(rc)
+        return rc;
+    }
+  }
+  if(hdrcbdata->config->writeout) {
+    const char *value = memchr(ptr, ':', cb);
+    if(value) {
+      if(per->was_last_header_empty)
+        per->num_headers = 0;
+      per->was_last_header_empty = FALSE;
+      per->num_headers++;
+    }
+    else if(ptr[0] == '\r' || ptr[0] == '\n')
+      per->was_last_header_empty = TRUE;
+  }
+  if(hdrcbdata->config->show_headers && !outs->out_null &&
+     (scheme == proto_http || scheme == proto_https ||
+      scheme == proto_rtsp || scheme == proto_file)) {
+    /* bold headers only for selected protocols */
+    const char *value = NULL;
+
+    if(!outs->stream && !tool_create_output_file(outs, per->config))
+      return CURL_WRITEFUNC_ERROR;
+
+    if(global->isatty &&
+#ifdef _WIN32
+       tool_term_has_bold &&
+#endif
+       global->styled_output)
+      value = memchr(ptr, ':', cb);
+    if(value) {
+      size_t namelen = value - ptr;
+      curl_mfprintf(outs->stream, BOLD "%.*s" BOLDOFF ":", (int)namelen, ptr);
+#ifndef LINK
+      fwrite(&value[1], cb - namelen - 1, 1, outs->stream);
+#else
+      if(curl_strnequal("Location", ptr, namelen)) {
+        write_linked_location(per->curl, &value[1], cb - namelen - 1,
+                              outs->stream);
+      }
+      else
+        fwrite(&value[1], cb - namelen - 1, 1, outs->stream);
+#endif
+    }
+    else
+      /* not "handled", show it */
+      fwrite(ptr, cb, 1, outs->stream);
+  }
+  return cb;
+}
diff --git a/third-party/curl/src/tool_cb_hdr.h b/third-party/curl/src/tool_cb_hdr.h
index a855052d0d..37be591e70 100644
--- a/third-party/curl/src/tool_cb_hdr.h
+++ b/third-party/curl/src/tool_cb_hdr.h
@@ -41,14 +41,16 @@
  */
 
 struct HdrCbData {
-  struct GlobalConfig *global;
   struct OperationConfig *config;
   struct OutStruct *outs;
   struct OutStruct *heads;
   struct OutStruct *etag_save;
+  struct curl_slist *headlist;
   bool honor_cd_filename;
 };
 
+int tool_write_headers(struct HdrCbData *hdrcbdata, FILE *stream);
+
 /*
 ** callback for CURLOPT_HEADERFUNCTION
 */
diff --git a/third-party/curl/src/tool_cb_prg.c b/third-party/curl/src/tool_cb_prg.c
index 9c8ffb2b5a..1af621dbaa 100644
--- a/third-party/curl/src/tool_cb_prg.c
+++ b/third-party/curl/src/tool_cb_prg.c
@@ -23,35 +23,22 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#ifdef HAVE_SYS_IOCTL_H
-#include <sys/ioctl.h>
-#endif
-
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
-
 #include "tool_cfgable.h"
 #include "tool_cb_prg.h"
-#include "tool_util.h"
 #include "tool_operate.h"
+#include "terminal.h"
 
-#include "memdebug.h" /* keep this as LAST include */
-
-#ifdef HAVE_TERMIOS_H
-#  include <termios.h>
-#elif defined(HAVE_TERMIO_H)
-#  include <termio.h>
-#endif
+#define MAX_BARLENGTH 400
+#define MIN_BARLENGTH 20
 
 /* 200 values generated by this perl code:
 
    my $pi = 3.1415;
    foreach my $i (1 .. 200) {
-     printf "%d, ", sin($i/200 * 2 * $pi) * 500000 + 500000;
+     printf "%d, ", sin($i / 200 * 2 * $pi) * 500000 + 500000;
    }
 */
-static const unsigned int sinus[] = {
+static const int sinus[] = {
   515704, 531394, 547052, 562664, 578214, 593687, 609068, 624341, 639491,
   654504, 669364, 684057, 698568, 712883, 726989, 740870, 754513, 767906,
   781034, 793885, 806445, 818704, 830647, 842265, 853545, 864476, 875047,
@@ -66,32 +53,38 @@ static const unsigned int sinus[] = {
   500046, 484341, 468651, 452993, 437381, 421830, 406357, 390976, 375703,
   360552, 345539, 330679, 315985, 301474, 287158, 273052, 259170, 245525,
   232132, 219003, 206152, 193590, 181331, 169386, 157768, 146487, 135555,
-  124983, 114781, 104959, 95526, 86493, 77868, 69660, 61876, 54525, 47613,
-  41147, 35135, 29581, 24491, 19871, 15724, 12056, 8868, 6166, 3951, 2225,
-  990, 248, 0, 244, 982, 2212, 3933, 6144, 8842, 12025, 15690, 19832, 24448,
-  29534, 35084, 41092, 47554, 54462, 61809, 69589, 77794, 86415, 95445,
-  104873, 114692, 124891, 135460, 146389, 157667, 169282, 181224, 193480,
-  206039, 218888, 232015, 245406, 259048, 272928, 287032, 301346, 315856,
-  330548, 345407, 360419, 375568, 390841, 406221, 421693, 437243, 452854,
-  468513, 484202, 499907
+  124983, 114781, 104959, 95526,  86493,  77868,  69660,  61876,  54525,
+  47613,  41147,  35135,  29581,  24491,  19871,  15724,  12056,  8868,
+  6166,   3951,   2225,   990,    248,    0,      244,    982,    2212,
+  3933,   6144,   8842,   12025,  15690,  19832,  24448,  29534,  35084,
+  41092,  47554,  54462,  61809,  69589,  77794,  86415,  95445,  104873,
+  114692, 124891, 135460, 146389, 157667, 169282, 181224, 193480, 206039,
+  218888, 232015, 245406, 259048, 272928, 287032, 301346, 315856, 330548,
+  345407, 360419, 375568, 390841, 406221, 421693, 437243, 452854, 468513,
+  484202, 499907
 };
 
 static void fly(struct ProgressData *bar, bool moved)
 {
-  char buf[256];
+  char buf[MAX_BARLENGTH + 2];
   int pos;
   int check = bar->width - 2;
 
-  msnprintf(buf, sizeof(buf), "%*s\r", bar->width-1, " ");
-  memcpy(&buf[bar->bar], "-=O=-", 5);
+  /* bar->width is range checked when assigned */
+  DEBUGASSERT(bar->width <= MAX_BARLENGTH);
+  buf[0] = '\r';
+  memset(&buf[1], ' ', bar->width);
+  buf[bar->width + 1] = '\0';
 
-  pos = sinus[bar->tick%200] / (1000000 / check);
+  memcpy(&buf[bar->bar + 1], "-=O=-", 5);
+
+  pos = (sinus[bar->tick % 200] / (1000000 / check)) + 1;
   buf[pos] = '#';
-  pos = sinus[(bar->tick + 5)%200] / (1000000 / check);
+  pos = (sinus[(bar->tick + 5) % 200] / (1000000 / check)) + 1;
   buf[pos] = '#';
-  pos = sinus[(bar->tick + 10)%200] / (1000000 / check);
+  pos = (sinus[(bar->tick + 10) % 200] / (1000000 / check)) + 1;
   buf[pos] = '#';
-  pos = sinus[(bar->tick + 15)%200] / (1000000 / check);
+  pos = (sinus[(bar->tick + 15) % 200] / (1000000 / check)) + 1;
   buf[pos] = '#';
 
   fputs(buf, bar->out);
@@ -99,7 +92,7 @@ static void fly(struct ProgressData *bar, bool moved)
   if(bar->tick >= 200)
     bar->tick -= 200;
 
-  bar->bar += (moved?bar->barmove:0);
+  bar->bar += (moved ? bar->barmove : 0);
   if(bar->bar >= (bar->width - 6)) {
     bar->barmove = -1;
     bar->bar = bar->width - 6;
@@ -114,20 +107,22 @@ static void fly(struct ProgressData *bar, bool moved)
 ** callback for CURLOPT_XFERINFOFUNCTION
 */
 
-#define MAX_BARLENGTH 256
-
-#if (SIZEOF_CURL_OFF_T < 8)
-#error "too small curl_off_t"
-#else
-   /* assume SIZEOF_CURL_OFF_T == 8 */
-#  define CURL_OFF_T_MAX CURL_OFF_T_C(0x7FFFFFFFFFFFFFFF)
-#endif
+static void update_width(struct ProgressData *bar)
+{
+  int cols = get_terminal_columns();
+  if(cols > MAX_BARLENGTH)
+    bar->width = MAX_BARLENGTH;
+  else if(cols > MIN_BARLENGTH)
+    bar->width = cols;
+  else
+    bar->width = MIN_BARLENGTH;
+}
 
 int tool_progress_cb(void *clientp,
                      curl_off_t dltotal, curl_off_t dlnow,
                      curl_off_t ultotal, curl_off_t ulnow)
 {
-  struct timeval now = tvnow();
+  struct curltime now = curlx_now();
   struct per_transfer *per = clientp;
   struct OperationConfig *config = per->config;
   struct ProgressData *bar = &per->progressbar;
@@ -165,31 +160,33 @@ int tool_progress_cb(void *clientp,
     if(total) {
       /* we know the total data to get... */
       if(bar->prev == point)
-        /* progress didn't change since last invoke */
+        /* progress did not change since last invoke */
         return 0;
-      else if((tvdiff(now, bar->prevtime) < 100L) && point < total)
-        /* limit progress-bar updating to 10 Hz except when we're at 100% */
+      else if((curlx_timediff_ms(now, bar->prevtime) < 100L) && point < total)
+        /* limit progress-bar updating to 10 Hz except when we are at 100% */
         return 0;
     }
     else {
       /* total is unknown */
-      if(tvdiff(now, bar->prevtime) < 100L)
+      if(curlx_timediff_ms(now, bar->prevtime) < 100L)
         /* limit progress-bar updating to 10 Hz */
         return 0;
+      update_width(bar);
       fly(bar, point != bar->prev);
     }
   }
 
-  /* simply count invokes */
+  /* count invokes */
   bar->calls++;
 
+  update_width(bar);
   if((total > 0) && (point != bar->prev)) {
     char line[MAX_BARLENGTH + 1];
     char format[40];
     double frac;
     double percent;
     int barwidth;
-    int num;
+    size_t num;
     if(point > total)
       /* we have got more than the expected total! */
       total = point;
@@ -197,13 +194,20 @@ int tool_progress_cb(void *clientp,
     frac = (double)point / (double)total;
     percent = frac * 100.0;
     barwidth = bar->width - 7;
-    num = (int) (((double)barwidth) * frac);
+    num = (size_t)(((double)barwidth) * frac);
     if(num > MAX_BARLENGTH)
       num = MAX_BARLENGTH;
     memset(line, '#', num);
     line[num] = '\0';
-    msnprintf(format, sizeof(format), "\r%%-%ds %%5.1f%%%%", barwidth);
-    fprintf(bar->out, format, line, percent);
+    curl_msnprintf(format, sizeof(format), "\r%%-%ds %%5.1f%%%%", barwidth);
+#ifdef CURL_HAVE_DIAG
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wformat-nonliteral"
+#endif
+    curl_mfprintf(bar->out, format, line, percent);
+#ifdef CURL_HAVE_DIAG
+#pragma GCC diagnostic pop
+#endif
   }
   fflush(bar->out);
   bar->prev = point;
@@ -217,64 +221,18 @@ int tool_progress_cb(void *clientp,
   return 0;
 }
 
-void progressbarinit(struct ProgressData *bar,
-                     struct OperationConfig *config)
+void progressbarinit(struct ProgressData *bar, struct OperationConfig *config)
 {
-  char *colp;
   memset(bar, 0, sizeof(struct ProgressData));
 
   /* pass the resume from value through to the progress function so it can
-   * display progress towards total file not just the part that's left. */
+   * display progress towards total file not the part that is left. */
   if(config->use_resume)
     bar->initial_size = config->resume_from;
 
-  colp = curlx_getenv("COLUMNS");
-  if(colp) {
-    char *endptr;
-    long num = strtol(colp, &endptr, 10);
-    if((endptr != colp) && (endptr == colp + strlen(colp)) && (num > 20) &&
-       (num < 10000))
-      bar->width = (int)num;
-    curl_free(colp);
-  }
+  update_width(bar);
 
-  if(!bar->width) {
-    int cols = 0;
-
-#ifdef TIOCGSIZE
-    struct ttysize ts;
-    if(!ioctl(STDIN_FILENO, TIOCGSIZE, &ts))
-      cols = ts.ts_cols;
-#elif defined(TIOCGWINSZ)
-    struct winsize ts;
-    if(!ioctl(STDIN_FILENO, TIOCGWINSZ, &ts))
-      cols = ts.ws_col;
-#elif defined(WIN32)
-    {
-      HANDLE  stderr_hnd = GetStdHandle(STD_ERROR_HANDLE);
-      CONSOLE_SCREEN_BUFFER_INFO console_info;
-
-      if((stderr_hnd != INVALID_HANDLE_VALUE) &&
-         GetConsoleScreenBufferInfo(stderr_hnd, &console_info)) {
-        /*
-         * Do not use +1 to get the true screen-width since writing a
-         * character at the right edge will cause a line wrap.
-         */
-        cols = (int)
-          (console_info.srWindow.Right - console_info.srWindow.Left);
-      }
-    }
-#endif /* TIOCGSIZE */
-    if(cols > 20)
-      bar->width = cols;
-  }
-
-  if(!bar->width)
-    bar->width = 79;
-  else if(bar->width > MAX_BARLENGTH)
-    bar->width = MAX_BARLENGTH;
-
-  bar->out = stderr;
+  bar->out = tool_stderr;
   bar->tick = 150;
   bar->barmove = 1;
 }
diff --git a/third-party/curl/src/tool_cb_prg.h b/third-party/curl/src/tool_cb_prg.h
index 565ad565a9..9c2dda2d7e 100644
--- a/third-party/curl/src/tool_cb_prg.h
+++ b/third-party/curl/src/tool_cb_prg.h
@@ -29,19 +29,20 @@
 #define CURL_PROGRESS_BAR   1
 
 struct ProgressData {
-  int         calls;
-  curl_off_t  prev;
-  struct timeval prevtime;
-  int         width;
-  FILE       *out;  /* where to write everything to */
-  curl_off_t  initial_size;
+  int calls;
+  curl_off_t prev;
+  struct curltime prevtime;
+  int width;
+  FILE *out;  /* where to write everything to */
+  curl_off_t initial_size;
   unsigned int tick;
   int bar;
   int barmove;
 };
 
-void progressbarinit(struct ProgressData *bar,
-                     struct OperationConfig *config);
+struct OperationConfig;
+
+void progressbarinit(struct ProgressData *bar, struct OperationConfig *config);
 
 /*
 ** callback for CURLOPT_PROGRESSFUNCTION
diff --git a/third-party/curl/src/tool_cb_rea.c b/third-party/curl/src/tool_cb_rea.c
index d70a9b9091..b5bc53a46e 100644
--- a/third-party/curl/src/tool_cb_rea.c
+++ b/third-party/curl/src/tool_cb_rea.c
@@ -26,18 +26,46 @@
 #ifdef HAVE_SYS_SELECT_H
 #include <sys/select.h>
 #endif
-
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
+#ifdef HAVE_POLL_H
+#include <poll.h>
+#elif defined(HAVE_SYS_POLL_H)
+#include <sys/poll.h>
+#endif
 
 #include "tool_cfgable.h"
 #include "tool_cb_rea.h"
 #include "tool_operate.h"
-#include "tool_util.h"
 #include "tool_msgs.h"
 
-#include "memdebug.h" /* keep this as LAST include */
+#ifndef _WIN32
+/* Wait up to a number of milliseconds for socket activity. This function
+   waits on read activity on a file descriptor that is not a socket which
+   makes it not work with select() or poll() on Windows. */
+static void waitfd(int waitms, int fd)
+{
+#ifdef HAVE_POLL
+  struct pollfd set;
+
+  set.fd = fd;
+  set.events = POLLIN;
+  set.revents = 0;
+  poll(&set, 1, waitms);
+#else
+  fd_set bits;
+  struct timeval timeout;
+
+  if(fd < FD_SETSIZE) {
+    /* wait this long at the most */
+    timeout.tv_sec = waitms / 1000;
+    timeout.tv_usec = (int)((waitms % 1000) * 1000);
+
+    FD_ZERO(&bits);
+    FD_SET(fd, &bits);
+    select(fd + 1, &bits, NULL, NULL, &timeout);
+  }
+#endif
+}
+#endif
 
 /*
 ** callback for CURLOPT_READFUNCTION
@@ -56,47 +84,64 @@ size_t tool_read_cb(char *buffer, size_t sz, size_t nmemb, void *userdata)
   }
 
   if(config->timeout_ms) {
-    struct timeval now = tvnow();
-    long msdelta = tvdiff(now, per->start);
+    struct curltime now = curlx_now();
+    long msdelta = (long)curlx_timediff_ms(now, per->start);
 
     if(msdelta > config->timeout_ms)
-      /* timeout */
-      return 0;
-#ifndef WIN32
-    /* this logic waits on read activity on a file descriptor that is not a
-       socket which makes it not work with select() on Windows */
+      return 0; /* timeout */
+#ifndef _WIN32
     else {
-      fd_set bits;
-      struct timeval timeout;
-      long wait = config->timeout_ms - msdelta;
-
-      /* wait this long at the most */
-      timeout.tv_sec = wait/1000;
-      timeout.tv_usec = (int)((wait%1000)*1000);
-
-      FD_ZERO(&bits);
-      FD_SET(per->infd, &bits);
-      if(!select(per->infd + 1, &bits, NULL, NULL, &timeout))
-        return 0; /* timeout */
+      long w = config->timeout_ms - msdelta;
+      if(w > INT_MAX)
+        w = INT_MAX;
+      waitfd((int)w, per->infd);
     }
 #endif
   }
 
-  rc = read(per->infd, buffer, sz*nmemb);
-  if(rc < 0) {
-    if(errno == EAGAIN) {
-      errno = 0;
-      config->readbusy = TRUE;
-      return CURL_READFUNC_PAUSE;
+#ifdef _WIN32
+  /* If we are on Windows, and using `-T .`, then per->infd points to a socket
+   connected to stdin via a reader thread, and needs to be read with recv()
+   Make sure we are in non-blocking mode and infd is not regular stdin
+   On Linux per->infd should be stdin (0) and the block below should not
+   execute */
+  if(per->uploadfile && !strcmp(per->uploadfile, ".") && per->infd > 0) {
+#ifndef CURL_WINDOWS_UWP
+    rc = sread(per->infd, buffer, curlx_uztosi(sz * nmemb));
+    if(rc < 0) {
+      if(SOCK_EAGAIN(SOCKERRNO)) {
+        errno = 0;
+        config->readbusy = TRUE;
+        return CURL_READFUNC_PAUSE;
+      }
+
+      rc = 0;
     }
-    /* since size_t is unsigned we can't return negative values fine */
-    rc = 0;
+#else
+    warnf("per->infd != 0: FD == %d. "
+          "This behavior is only supported on desktop Windows", per->infd);
+#endif
   }
+  else
+#endif /* _WIN32 */
+  {
+    rc = read(per->infd, buffer, sz * nmemb);
+    if(rc < 0) {
+      if(errno == EAGAIN) {
+        errno = 0;
+        config->readbusy = TRUE;
+        return CURL_READFUNC_PAUSE;
+      }
+      /* since size_t is unsigned we cannot return negative values fine */
+      rc = 0;
+    }
+  }
+
   if((per->uploadfilesize != -1) &&
      (per->uploadedsofar + rc > per->uploadfilesize)) {
     /* do not allow uploading more than originally set out to do */
     curl_off_t delta = per->uploadedsofar + rc - per->uploadfilesize;
-    warnf(per->config->global, "File size larger in the end than when "
+    warnf("File size larger in the end than when "
           "started. Dropping at least %" CURL_FORMAT_CURL_OFF_T " bytes",
           delta);
     rc = (ssize_t)(per->uploadfilesize - per->uploadedsofar);
@@ -117,16 +162,27 @@ int tool_readbusy_cb(void *clientp,
 {
   struct per_transfer *per = clientp;
   struct OperationConfig *config = per->config;
+  static curl_off_t ulprev;
 
-  (void)dltotal;  /* unused */
-  (void)dlnow;  /* unused */
-  (void)ultotal;  /* unused */
-  (void)ulnow;  /* unused */
+  (void)dltotal;
+  (void)dlnow;
+  (void)ultotal;
+  (void)ulnow;
 
   if(config->readbusy) {
+    if(ulprev == ulnow) {
+#ifndef _WIN32
+      waitfd(1, per->infd);
+#else
+      curlx_wait_ms(1); /* sleep */
+#endif
+    }
+
     config->readbusy = FALSE;
     curl_easy_pause(per->curl, CURLPAUSE_CONT);
   }
 
-  return per->noprogress? 0 : CURL_PROGRESSFUNC_CONTINUE;
+  ulprev = ulnow;
+
+  return per->noprogress ? 0 : CURL_PROGRESSFUNC_CONTINUE;
 }
diff --git a/third-party/curl/src/tool_cb_see.c b/third-party/curl/src/tool_cb_see.c
index 8351473c82..bb33bd2289 100644
--- a/third-party/curl/src/tool_cb_see.c
+++ b/third-party/curl/src/tool_cb_see.c
@@ -23,23 +23,10 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
-
 #include "tool_cfgable.h"
 #include "tool_operate.h"
 #include "tool_cb_see.h"
 
-#include "memdebug.h" /* keep this as LAST include */
-
-/* OUR_MAX_SEEK_L has 'long' data type, OUR_MAX_SEEK_O has 'curl_off_t,
-   both represent the same value. Maximum offset used here when we lseek
-   using a 'long' data type offset */
-
-#define OUR_MAX_SEEK_L  2147483647L - 1L
-#define OUR_MAX_SEEK_O  CURL_OFF_T_C(0x7FFFFFFF) - CURL_OFF_T_C(0x1)
-
 /*
 ** callback for CURLOPT_SEEKFUNCTION
 **
@@ -51,30 +38,37 @@ int tool_seek_cb(void *userdata, curl_off_t offset, int whence)
 {
   struct per_transfer *per = userdata;
 
-#if(SIZEOF_CURL_OFF_T > SIZEOF_OFF_T) && !defined(USE_WIN32_LARGE_FILES)
+#if (SIZEOF_CURL_OFF_T > SIZEOF_OFF_T) && !defined(_WIN32)
+
+/* OUR_MAX_SEEK_L has 'long' data type, OUR_MAX_SEEK_O has 'curl_off_t,
+   both represent the same value. Maximum offset used here when we lseek
+   using a 'long' data type offset */
+
+#define OUR_MAX_SEEK_L (2147483647L - 1L)
+#define OUR_MAX_SEEK_O (0x7FFFFFFF - 0x1)
 
   /* The offset check following here is only interesting if curl_off_t is
-     larger than off_t and we are not using the WIN32 large file support
-     macros that provide the support to do 64bit seeks correctly */
+     larger than off_t and we are not using the Win32 large file support
+     macros that provide the support to do 64-bit seeks correctly */
 
   if(offset > OUR_MAX_SEEK_O) {
     /* Some precaution code to work around problems with different data sizes
-       to allow seeking >32bit even if off_t is 32bit. Should be very rare and
+       to allow seeking >32-bit even if off_t is 32-bit. Should be rare and
        is really valid on weirdo-systems. */
     curl_off_t left = offset;
 
     if(whence != SEEK_SET)
-      /* this code path doesn't support other types */
+      /* this code path does not support other types */
       return CURL_SEEKFUNC_FAIL;
 
-    if(LSEEK_ERROR == lseek(per->infd, 0, SEEK_SET))
-      /* couldn't rewind to beginning */
+    if(curl_lseek(per->infd, 0, SEEK_SET) == LSEEK_ERROR)
+      /* could not rewind to beginning */
       return CURL_SEEKFUNC_FAIL;
 
     while(left) {
       long step = (left > OUR_MAX_SEEK_O) ? OUR_MAX_SEEK_L : (long)left;
-      if(LSEEK_ERROR == lseek(per->infd, step, SEEK_CUR))
-        /* couldn't seek forwards the desired amount */
+      if(curl_lseek(per->infd, step, SEEK_CUR) == LSEEK_ERROR)
+        /* could not seek forwards the desired amount */
         return CURL_SEEKFUNC_FAIL;
       left -= step;
     }
@@ -82,55 +76,11 @@ int tool_seek_cb(void *userdata, curl_off_t offset, int whence)
   }
 #endif
 
-  if(LSEEK_ERROR == lseek(per->infd, offset, whence))
-    /* couldn't rewind, the reason is in errno but errno is just not portable
-       enough and we don't actually care that much why we failed. We'll let
+  if(curl_lseek(per->infd, offset, whence) == LSEEK_ERROR)
+    /* could not rewind, the reason is in errno but errno is not portable
+       enough and we do not actually care that much why we failed. We let
        libcurl know that it may try other means if it wants to. */
     return CURL_SEEKFUNC_CANTSEEK;
 
   return CURL_SEEKFUNC_OK;
 }
-
-#ifdef USE_TOOL_FTRUNCATE
-
-#ifdef __BORLANDC__
-/* 64-bit lseek-like function unavailable */
-#  define _lseeki64(hnd,ofs,whence) lseek(hnd,ofs,whence)
-#endif
-
-#ifdef __POCC__
-#  if(__POCC__ < 450)
-/* 64-bit lseek-like function unavailable */
-#    define _lseeki64(hnd,ofs,whence) _lseek(hnd,ofs,whence)
-#  else
-#    undef _lseeki64
-#    define _lseeki64(hnd,ofs,whence) _lseek64(hnd,ofs,whence)
-#  endif
-#endif
-
-#ifdef _WIN32_WCE
-/* 64-bit lseek-like function unavailable */
-#  undef _lseeki64
-#  define _lseeki64(hnd,ofs,whence) lseek(hnd,ofs,whence)
-#  undef _get_osfhandle
-#  define _get_osfhandle(fd) (fd)
-#endif
-
-/*
- * Truncate a file handle at a 64-bit position 'where'.
- */
-
-int tool_ftruncate64(int fd, curl_off_t where)
-{
-  intptr_t handle = _get_osfhandle(fd);
-
-  if(_lseeki64(fd, where, SEEK_SET) < 0)
-    return -1;
-
-  if(!SetEndOfFile((HANDLE)handle))
-    return -1;
-
-  return 0;
-}
-
-#endif /* USE_TOOL_FTRUNCATE */
diff --git a/third-party/curl/src/tool_cb_see.h b/third-party/curl/src/tool_cb_see.h
index 14bbc4264f..e473223526 100644
--- a/third-party/curl/src/tool_cb_see.h
+++ b/third-party/curl/src/tool_cb_see.h
@@ -25,22 +25,9 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#if defined(WIN32) && !defined(HAVE_FTRUNCATE)
-
-int tool_ftruncate64(int fd, curl_off_t where);
-
-#undef  ftruncate
-#define ftruncate(fd,where) tool_ftruncate64(fd,where)
-
-#define HAVE_FTRUNCATE 1
-#define USE_TOOL_FTRUNCATE 1
-
-#endif /* WIN32  && ! HAVE_FTRUNCATE */
-
 /*
 ** callback for CURLOPT_SEEKFUNCTION
 */
-
 int tool_seek_cb(void *userdata, curl_off_t offset, int whence);
 
 #endif /* HEADER_CURL_TOOL_CB_SEE_H */
diff --git a/third-party/curl/src/tool_cb_soc.c b/third-party/curl/src/tool_cb_soc.c
new file mode 100644
index 0000000000..0df0a1e6fb
--- /dev/null
+++ b/third-party/curl/src/tool_cb_soc.c
@@ -0,0 +1,58 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "tool_setup.h"
+
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h> /* IPPROTO_TCP */
+#endif
+
+#include "tool_cb_soc.h"
+
+/*
+** callback for CURLOPT_OPENSOCKETFUNCTION
+**
+** Notice that only Linux is supported for the moment.
+*/
+
+curl_socket_t tool_socket_open_mptcp_cb(void *clientp,
+                                        curlsocktype purpose,
+                                        struct curl_sockaddr *addr)
+{
+  int protocol = addr->protocol;
+
+  (void)clientp;
+  (void)purpose;
+
+  if(protocol == IPPROTO_TCP)
+#ifdef __linux__
+#  ifndef IPPROTO_MPTCP
+#  define IPPROTO_MPTCP 262
+#  endif
+    protocol = IPPROTO_MPTCP;
+#else
+    return CURL_SOCKET_BAD;
+#endif
+
+  return CURL_SOCKET(addr->family, addr->socktype, protocol);
+}
diff --git a/third-party/curl/src/tool_cb_soc.h b/third-party/curl/src/tool_cb_soc.h
new file mode 100644
index 0000000000..f02150aa82
--- /dev/null
+++ b/third-party/curl/src/tool_cb_soc.h
@@ -0,0 +1,36 @@
+#ifndef HEADER_CURL_TOOL_CB_SOC_H
+#define HEADER_CURL_TOOL_CB_SOC_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "tool_setup.h"
+
+/*
+** callback for CURLOPT_OPENSOCKETFUNCTION
+*/
+
+curl_socket_t tool_socket_open_mptcp_cb(void *clientp,
+                                        curlsocktype purpose,
+                                        struct curl_sockaddr *addr);
+
+#endif /* HEADER_CURL_TOOL_CB_SOC_H */
diff --git a/third-party/curl/src/tool_cb_wrt.c b/third-party/curl/src/tool_cb_wrt.c
index 2f8c6ac71e..133573a8b3 100644
--- a/third-party/curl/src/tool_cb_wrt.c
+++ b/third-party/curl/src/tool_cb_wrt.c
@@ -23,102 +23,67 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#ifdef HAVE_FCNTL_H
-/* for open() */
-#include <fcntl.h>
-#endif
-
-#include <sys/stat.h>
-
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
-
 #include "tool_cfgable.h"
 #include "tool_msgs.h"
 #include "tool_cb_wrt.h"
 #include "tool_operate.h"
 
-#include "memdebug.h" /* keep this as LAST include */
-
-#ifndef O_BINARY
-#define O_BINARY 0
-#endif
-#ifdef WIN32
-#define OPENMODE S_IREAD | S_IWRITE
+#ifdef _WIN32
+#define OPENMODE (_S_IREAD | _S_IWRITE)
 #else
-#define OPENMODE S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH
+#define OPENMODE (S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH)
 #endif
 
 /* create/open a local file for writing, return TRUE on success */
 bool tool_create_output_file(struct OutStruct *outs,
                              struct OperationConfig *config)
 {
-  struct GlobalConfig *global;
   FILE *file = NULL;
-  char *fname = outs->filename;
-  char *aname = NULL;
+  const char *fname = outs->filename;
   DEBUGASSERT(outs);
   DEBUGASSERT(config);
-  global = config->global;
-  if(!fname || !*fname) {
-    warnf(global, "Remote filename has no length");
-    return FALSE;
-  }
-
-  if(config->output_dir && outs->is_cd_filename) {
-    aname = aprintf("%s/%s", config->output_dir, fname);
-    if(!aname) {
-      errorf(global, "out of memory");
-      return FALSE;
-    }
-    fname = aname;
-  }
+  DEBUGASSERT(fname && *fname);
 
   if(config->file_clobber_mode == CLOBBER_ALWAYS ||
      (config->file_clobber_mode == CLOBBER_DEFAULT &&
       !outs->is_cd_filename)) {
     /* open file for writing */
-    file = fopen(fname, "wb");
+    file = curlx_fopen(fname, "wb");
   }
   else {
     int fd;
     do {
-      fd = open(fname, O_CREAT | O_WRONLY | O_EXCL | O_BINARY, OPENMODE);
-      /* Keep retrying in the hope that it isn't interrupted sometime */
+      fd = curlx_open(fname, O_CREAT | O_WRONLY | O_EXCL | CURL_O_BINARY,
+                      OPENMODE);
+      /* Keep retrying in the hope that it is not interrupted sometime */
+      /* !checksrc! disable ERRNOVAR 1 */
     } while(fd == -1 && errno == EINTR);
     if(config->file_clobber_mode == CLOBBER_NEVER && fd == -1) {
       int next_num = 1;
-      size_t len = strlen(fname);
-      size_t newlen = len + 13; /* nul + 1-11 digits + dot */
-      char *newname;
-      /* Guard against wraparound in new filename */
-      if(newlen < len) {
-        free(aname);
-        errorf(global, "overflow in filename generation");
-        return FALSE;
-      }
-      newname = malloc(newlen);
-      if(!newname) {
-        errorf(global, "out of memory");
-        free(aname);
-        return FALSE;
-      }
-      memcpy(newname, fname, len);
-      newname[len] = '.';
-      while(fd == -1 && /* haven't successfully opened a file */
+      struct dynbuf fbuffer;
+      char *newfile;
+      curlx_dyn_init(&fbuffer, 1025);
+      /* !checksrc! disable ERRNOVAR 1 */
+      while(fd == -1 && /* have not successfully opened a file */
             (errno == EEXIST || errno == EISDIR) &&
             /* because we keep having files that already exist */
-            next_num < 100 /* and we haven't reached the retry limit */ ) {
-        curlx_msnprintf(newname + len + 1, 12, "%d", next_num);
+            next_num < 100 /* and we have not reached the retry limit */) {
+        curlx_dyn_reset(&fbuffer);
+        if(curlx_dyn_addf(&fbuffer, "%s.%d", fname, next_num))
+          return FALSE;
         next_num++;
         do {
-          fd = open(newname, O_CREAT | O_WRONLY | O_EXCL | O_BINARY, OPENMODE);
-          /* Keep retrying in the hope that it isn't interrupted sometime */
+          fd = curlx_open(curlx_dyn_ptr(&fbuffer),
+                          O_CREAT | O_WRONLY | O_EXCL | CURL_O_BINARY,
+                          OPENMODE);
+          /* Keep retrying in the hope that it is not interrupted sometime */
         } while(fd == -1 && errno == EINTR);
       }
-      outs->filename = newname; /* remember the new one */
-      outs->alloc_filename = TRUE;
+      newfile = curlx_dyn_ptr(&fbuffer); /* remember the new one */
+      if(newfile) {
+        outs->filename = newfile;
+        outs->alloc_filename = TRUE;
+      }
     }
     /* An else statement to not overwrite existing files and not retry with
        new numbered names (which would cover
@@ -126,20 +91,19 @@ bool tool_create_output_file(struct OutStruct *outs,
        is not needed because we would have failed earlier, in the while loop
        and `fd` would now be -1 */
     if(fd != -1) {
-      file = fdopen(fd, "wb");
+      file = curlx_fdopen(fd, "wb");
       if(!file)
-        close(fd);
+        curlx_close(fd);
     }
   }
 
   if(!file) {
-    warnf(global, "Failed to open the file %s: %s", fname,
-          strerror(errno));
-    free(aname);
+    char errbuf[STRERROR_LEN];
+    warnf("Failed to open the file %s: %s", fname,
+          curlx_strerror(errno, errbuf, sizeof(errbuf)));
     return FALSE;
   }
-  free(aname);
-  outs->s_isreg = TRUE;
+  outs->regular_file = TRUE;
   outs->fopened = TRUE;
   outs->stream = file;
   outs->bytes = 0;
@@ -147,6 +111,131 @@ bool tool_create_output_file(struct OutStruct *outs,
   return TRUE;
 }
 
+#ifdef _WIN32
+static size_t win_console(intptr_t fhnd, struct OutStruct *outs,
+                          char *buffer, size_t bytes,
+                          size_t *retp)
+{
+  DWORD chars_written;
+  unsigned char *rbuf = (unsigned char *)buffer;
+  DWORD rlen = (DWORD)bytes;
+
+#define IS_TRAILING_BYTE(x) (0x80 <= (x) && (x) < 0xC0)
+
+  /* attempt to complete an incomplete UTF-8 sequence from previous call. the
+     sequence does not have to be well-formed. */
+  if(outs->utf8seq[0] && rlen) {
+    bool complete = FALSE;
+    /* two byte sequence (lead byte 110yyyyy) */
+    if(0xC0 <= outs->utf8seq[0] && outs->utf8seq[0] < 0xE0) {
+      outs->utf8seq[1] = *rbuf++;
+      --rlen;
+      complete = TRUE;
+    }
+    /* three byte sequence (lead byte 1110zzzz) */
+    else if(0xE0 <= outs->utf8seq[0] && outs->utf8seq[0] < 0xF0) {
+      if(!outs->utf8seq[1]) {
+        outs->utf8seq[1] = *rbuf++;
+        --rlen;
+      }
+      if(rlen && !outs->utf8seq[2]) {
+        outs->utf8seq[2] = *rbuf++;
+        --rlen;
+        complete = TRUE;
+      }
+    }
+    /* four byte sequence (lead byte 11110uuu) */
+    else if(0xF0 <= outs->utf8seq[0] && outs->utf8seq[0] < 0xF8) {
+      if(!outs->utf8seq[1]) {
+        outs->utf8seq[1] = *rbuf++;
+        --rlen;
+      }
+      if(rlen && !outs->utf8seq[2]) {
+        outs->utf8seq[2] = *rbuf++;
+        --rlen;
+      }
+      if(rlen && !outs->utf8seq[3]) {
+        outs->utf8seq[3] = *rbuf++;
+        --rlen;
+        complete = TRUE;
+      }
+    }
+
+    if(complete) {
+      WCHAR prefix[3] = { 0 }; /* UTF-16 (1-2 WCHARs) + NUL */
+
+      if(MultiByteToWideChar(CP_UTF8, 0, (LPCSTR)outs->utf8seq, -1,
+                             prefix, CURL_ARRAYSIZE(prefix))) {
+        DEBUGASSERT(prefix[2] == L'\0');
+        if(!WriteConsoleW((HANDLE)fhnd, prefix, prefix[1] ? 2 : 1,
+                          &chars_written, NULL)) {
+          return CURL_WRITEFUNC_ERROR;
+        }
+      }
+      /* else: UTF-8 input was not well formed and OS is pre-Vista which drops
+         invalid characters instead of writing U+FFFD to output. */
+      memset(outs->utf8seq, 0, sizeof(outs->utf8seq));
+    }
+  }
+
+  /* suppress an incomplete utf-8 sequence at end of rbuf */
+  if(!outs->utf8seq[0] && rlen && (rbuf[rlen - 1] & 0x80)) {
+    /* check for lead byte from a two, three or four byte sequence */
+    if(0xC0 <= rbuf[rlen - 1] && rbuf[rlen - 1] < 0xF8) {
+      outs->utf8seq[0] = rbuf[rlen - 1];
+      rlen -= 1;
+    }
+    else if(rlen >= 2 && IS_TRAILING_BYTE(rbuf[rlen - 1])) {
+      /* check for lead byte from a three or four byte sequence */
+      if(0xE0 <= rbuf[rlen - 2] && rbuf[rlen - 2] < 0xF8) {
+        outs->utf8seq[0] = rbuf[rlen - 2];
+        outs->utf8seq[1] = rbuf[rlen - 1];
+        rlen -= 2;
+      }
+      else if(rlen >= 3 && IS_TRAILING_BYTE(rbuf[rlen - 2])) {
+        /* check for lead byte from a four byte sequence */
+        if(0xF0 <= rbuf[rlen - 3] && rbuf[rlen - 3] < 0xF8) {
+          outs->utf8seq[0] = rbuf[rlen - 3];
+          outs->utf8seq[1] = rbuf[rlen - 2];
+          outs->utf8seq[2] = rbuf[rlen - 1];
+          rlen -= 3;
+        }
+      }
+    }
+  }
+
+  if(rlen) {
+    /* calculate buffer size for wide characters */
+    DWORD len = (DWORD)MultiByteToWideChar(CP_UTF8, 0, (LPCSTR)rbuf,
+                                           (int)rlen, NULL, 0);
+    if(!len)
+      return CURL_WRITEFUNC_ERROR;
+
+    /* grow the buffer if needed */
+    if(len > global->term.len) {
+      wchar_t *buf = curlx_realloc(global->term.buf, len * sizeof(wchar_t));
+      if(!buf)
+        return CURL_WRITEFUNC_ERROR;
+      global->term.len = len;
+      global->term.buf = buf;
+    }
+
+    len = (DWORD)MultiByteToWideChar(CP_UTF8, 0, (LPCSTR)rbuf, (int)rlen,
+                                     global->term.buf,
+                                     (int)len);
+    if(!len)
+      return CURL_WRITEFUNC_ERROR;
+
+    if(!WriteConsoleW((HANDLE) fhnd, global->term.buf,
+                      len, &chars_written, NULL))
+      return CURL_WRITEFUNC_ERROR;
+  }
+
+  *retp = bytes;
+  return 0;
+}
+#endif /* _WIN32 */
+
 /*
 ** callback for CURLOPT_WRITEFUNCTION
 */
@@ -158,15 +247,18 @@ size_t tool_write_cb(char *buffer, size_t sz, size_t nmemb, void *userdata)
   struct OutStruct *outs = &per->outs;
   struct OperationConfig *config = per->config;
   size_t bytes = sz * nmemb;
-  bool is_tty = config->global->isatty;
-#ifdef WIN32
+  bool is_tty = (bool)global->isatty;
+#ifdef _WIN32
   CONSOLE_SCREEN_BUFFER_INFO console_info;
   intptr_t fhnd;
 #endif
 
+  if(outs->out_null)
+    return bytes;
+
 #ifdef DEBUGBUILD
   {
-    char *tty = curlx_getenv("CURL_ISATTY");
+    char *tty = curl_getenv("CURL_ISATTY");
     if(tty) {
       is_tty = TRUE;
       curl_free(tty);
@@ -175,14 +267,13 @@ size_t tool_write_cb(char *buffer, size_t sz, size_t nmemb, void *userdata)
 
   if(config->show_headers) {
     if(bytes > (size_t)CURL_MAX_HTTP_HEADER) {
-      warnf(config->global, "Header data size exceeds single call write "
-            "limit");
+      warnf("Header data size exceeds write limit");
       return CURL_WRITEFUNC_ERROR;
     }
   }
   else {
     if(bytes > (size_t)CURL_MAX_WRITE_SIZE) {
-      warnf(config->global, "Data size exceeds single call write limit");
+      warnf("Data size exceeds write limit");
       return CURL_WRITEFUNC_ERROR;
     }
   }
@@ -194,7 +285,7 @@ size_t tool_write_cb(char *buffer, size_t sz, size_t nmemb, void *userdata)
       /* regular file */
       if(!*outs->filename)
         check_fails = TRUE;
-      if(!outs->s_isreg)
+      if(!outs->regular_file)
         check_fails = TRUE;
       if(outs->fopened && !outs->stream)
         check_fails = TRUE;
@@ -205,17 +296,17 @@ size_t tool_write_cb(char *buffer, size_t sz, size_t nmemb, void *userdata)
     }
     else {
       /* standard stream */
-      if(!outs->stream || outs->s_isreg || outs->fopened)
+      if(!outs->stream || outs->regular_file || outs->fopened)
         check_fails = TRUE;
       if(outs->alloc_filename || outs->is_cd_filename || outs->init)
         check_fails = TRUE;
     }
     if(check_fails) {
-      warnf(config->global, "Invalid output struct data for write callback");
+      warnf("Invalid output struct data for write callback");
       return CURL_WRITEFUNC_ERROR;
     }
   }
-#endif
+#endif /* DEBUGBUILD */
 
   if(!outs->stream && !tool_create_output_file(outs, per->config))
     return CURL_WRITEFUNC_ERROR;
@@ -223,7 +314,7 @@ size_t tool_write_cb(char *buffer, size_t sz, size_t nmemb, void *userdata)
   if(is_tty && (outs->bytes < 2000) && !config->terminal_binary_ok) {
     /* binary output to terminal? */
     if(memchr(buffer, 0, bytes)) {
-      warnf(config->global, "Binary output can mess up your terminal. "
+      warnf("Binary output can mess up your terminal. "
             "Use \"--output -\" to tell curl to output it to your terminal "
             "anyway, or consider \"--output <FILE>\" to save to a file.");
       config->synthetic_error = TRUE;
@@ -231,139 +322,24 @@ size_t tool_write_cb(char *buffer, size_t sz, size_t nmemb, void *userdata)
     }
   }
 
-#ifdef WIN32
+#ifdef _WIN32
   fhnd = _get_osfhandle(fileno(outs->stream));
-  /* if windows console then UTF-8 must be converted to UTF-16 */
+  /* if Windows console then UTF-8 must be converted to UTF-16 */
   if(isatty(fileno(outs->stream)) &&
      GetConsoleScreenBufferInfo((HANDLE)fhnd, &console_info)) {
-    wchar_t *wc_buf;
-    DWORD wc_len;
-    unsigned char *rbuf = (unsigned char *)buffer;
-    DWORD rlen = (DWORD)bytes;
-
-#define IS_TRAILING_BYTE(x) (0x80 <= (x) && (x) < 0xC0)
-
-    /* attempt to complete an incomplete UTF-8 sequence from previous call.
-       the sequence does not have to be well-formed. */
-    if(outs->utf8seq[0] && rlen) {
-      bool complete = false;
-      /* two byte sequence (lead byte 110yyyyy) */
-      if(0xC0 <= outs->utf8seq[0] && outs->utf8seq[0] < 0xE0) {
-        outs->utf8seq[1] = *rbuf++;
-        --rlen;
-        complete = true;
-      }
-      /* three byte sequence (lead byte 1110zzzz) */
-      else if(0xE0 <= outs->utf8seq[0] && outs->utf8seq[0] < 0xF0) {
-        if(!outs->utf8seq[1]) {
-          outs->utf8seq[1] = *rbuf++;
-          --rlen;
-        }
-        if(rlen && !outs->utf8seq[2]) {
-          outs->utf8seq[2] = *rbuf++;
-          --rlen;
-          complete = true;
-        }
-      }
-      /* four byte sequence (lead byte 11110uuu) */
-      else if(0xF0 <= outs->utf8seq[0] && outs->utf8seq[0] < 0xF8) {
-        if(!outs->utf8seq[1]) {
-          outs->utf8seq[1] = *rbuf++;
-          --rlen;
-        }
-        if(rlen && !outs->utf8seq[2]) {
-          outs->utf8seq[2] = *rbuf++;
-          --rlen;
-        }
-        if(rlen && !outs->utf8seq[3]) {
-          outs->utf8seq[3] = *rbuf++;
-          --rlen;
-          complete = true;
-        }
-      }
-
-      if(complete) {
-        WCHAR prefix[3] = {0};  /* UTF-16 (1-2 WCHARs) + NUL */
-
-        if(MultiByteToWideChar(CP_UTF8, 0, (LPCSTR)outs->utf8seq, -1,
-                               prefix, sizeof(prefix)/sizeof(prefix[0]))) {
-          DEBUGASSERT(prefix[3] == L'\0');
-          if(!WriteConsoleW(
-              (HANDLE) fhnd,
-              prefix,
-              prefix[1] ? 2 : 1,
-              NULL,
-              NULL)) {
-            return CURL_WRITEFUNC_ERROR;
-          }
-        }
-        /* else: UTF-8 input was not well formed and OS is pre-Vista which
-           drops invalid characters instead of writing U+FFFD to output.  */
-
-        memset(outs->utf8seq, 0, sizeof(outs->utf8seq));
-      }
-    }
-
-    /* suppress an incomplete utf-8 sequence at end of rbuf */
-    if(!outs->utf8seq[0] && rlen && (rbuf[rlen - 1] & 0x80)) {
-      /* check for lead byte from a two, three or four byte sequence */
-      if(0xC0 <= rbuf[rlen - 1] && rbuf[rlen - 1] < 0xF8) {
-        outs->utf8seq[0] = rbuf[rlen - 1];
-        rlen -= 1;
-      }
-      else if(rlen >= 2 && IS_TRAILING_BYTE(rbuf[rlen - 1])) {
-        /* check for lead byte from a three or four byte sequence */
-        if(0xE0 <= rbuf[rlen - 2] && rbuf[rlen - 2] < 0xF8) {
-          outs->utf8seq[0] = rbuf[rlen - 2];
-          outs->utf8seq[1] = rbuf[rlen - 1];
-          rlen -= 2;
-        }
-        else if(rlen >= 3 && IS_TRAILING_BYTE(rbuf[rlen - 2])) {
-          /* check for lead byte from a four byte sequence */
-          if(0xF0 <= rbuf[rlen - 3] && rbuf[rlen - 3] < 0xF8) {
-            outs->utf8seq[0] = rbuf[rlen - 3];
-            outs->utf8seq[1] = rbuf[rlen - 2];
-            outs->utf8seq[2] = rbuf[rlen - 1];
-            rlen -= 3;
-          }
-        }
-      }
-    }
-
-    if(rlen) {
-      /* calculate buffer size for wide characters */
-      wc_len = MultiByteToWideChar(CP_UTF8, 0, (LPCSTR)rbuf, rlen, NULL, 0);
-      if(!wc_len)
-        return CURL_WRITEFUNC_ERROR;
-
-      wc_buf = (wchar_t*) malloc(wc_len * sizeof(wchar_t));
-      if(!wc_buf)
-        return CURL_WRITEFUNC_ERROR;
-
-      wc_len = MultiByteToWideChar(CP_UTF8, 0, (LPCSTR)rbuf, rlen, wc_buf,
-                                   wc_len);
-      if(!wc_len) {
-        free(wc_buf);
-        return CURL_WRITEFUNC_ERROR;
-      }
-
-      if(!WriteConsoleW(
-          (HANDLE) fhnd,
-          wc_buf,
-          wc_len,
-          NULL,
-          NULL)) {
-        free(wc_buf);
-        return CURL_WRITEFUNC_ERROR;
-      }
-      free(wc_buf);
-    }
-
-    rc = bytes;
+    size_t retval = win_console(fhnd, outs, buffer, bytes, &rc);
+    if(retval)
+      return retval;
   }
   else
 #endif
+  {
+    if(per->hdrcbdata.headlist) {
+      if(tool_write_headers(&per->hdrcbdata, outs->stream))
+        return CURL_WRITEFUNC_ERROR;
+    }
     rc = fwrite(buffer, sz, nmemb, outs->stream);
+  }
 
   if(bytes == rc)
     /* we added this amount of data to the output */
@@ -376,7 +352,12 @@ size_t tool_write_cb(char *buffer, size_t sz, size_t nmemb, void *userdata)
 
   if(config->nobuffer) {
     /* output buffering disabled */
-    int res = fflush(outs->stream);
+    int res;
+    do {
+      res = fflush(outs->stream);
+      /* Keep retrying in the hope that it is not interrupted sometime */
+      /* !checksrc! disable ERRNOVAR 1 */
+    } while(res && errno == EINTR);
     if(res)
       return CURL_WRITEFUNC_ERROR;
   }
diff --git a/third-party/curl/src/tool_cfgable.c b/third-party/curl/src/tool_cfgable.c
index 04f0b05f44..3feb3e7824 100644
--- a/third-party/curl/src/tool_cfgable.c
+++ b/third-party/curl/src/tool_cfgable.c
@@ -23,17 +23,25 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
+#include <stddef.h>
+
 #include "tool_cfgable.h"
 #include "tool_formparse.h"
+#include "tool_libinfo.h"
+#include "tool_paramhlp.h"
 #include "tool_main.h"
+#include "tool_msgs.h"
 
-#include "memdebug.h" /* keep this as LAST include */
+static struct GlobalConfig globalconf;
+struct GlobalConfig *global;
 
-void config_init(struct OperationConfig *config)
+struct OperationConfig *config_alloc(void)
 {
-  memset(config, 0, sizeof(struct OperationConfig));
+  struct OperationConfig *config =
+    curlx_calloc(1, sizeof(struct OperationConfig));
+  if(!config)
+    return NULL;
 
-  config->postfieldsize = -1;
   config->use_httpget = FALSE;
   config->create_dirs = FALSE;
   config->maxredirs = DEFAULT_MAXREDIRS;
@@ -45,63 +53,66 @@ void config_init(struct OperationConfig *config)
   config->http09_allowed = FALSE;
   config->ftp_skip_ip = TRUE;
   config->file_clobber_mode = CLOBBER_DEFAULT;
+  config->upload_flags = CURLULFLAG_SEEN;
+  curlx_dyn_init(&config->postdata, MAX_FILE2MEMORY);
+  return config;
 }
 
 static void free_config_fields(struct OperationConfig *config)
 {
   struct getout *urlnode;
 
-  Curl_safefree(config->useragent);
-  Curl_safefree(config->altsvc);
-  Curl_safefree(config->hsts);
-  Curl_safefree(config->haproxy_clientip);
+  curlx_safefree(config->useragent);
+  curlx_safefree(config->altsvc);
+  curlx_safefree(config->hsts);
+  curlx_safefree(config->haproxy_clientip);
   curl_slist_free_all(config->cookies);
-  Curl_safefree(config->cookiejar);
+  curlx_safefree(config->cookiejar);
   curl_slist_free_all(config->cookiefiles);
 
-  Curl_safefree(config->postfields);
-  Curl_safefree(config->query);
-  Curl_safefree(config->referer);
+  curlx_dyn_free(&config->postdata);
+  curlx_safefree(config->query);
+  curlx_safefree(config->referer);
 
-  Curl_safefree(config->headerfile);
-  Curl_safefree(config->ftpport);
-  Curl_safefree(config->iface);
+  curlx_safefree(config->headerfile);
+  curlx_safefree(config->ftpport);
+  curlx_safefree(config->iface);
 
-  Curl_safefree(config->range);
+  curlx_safefree(config->range);
 
-  Curl_safefree(config->userpwd);
-  Curl_safefree(config->tls_username);
-  Curl_safefree(config->tls_password);
-  Curl_safefree(config->tls_authtype);
-  Curl_safefree(config->proxy_tls_username);
-  Curl_safefree(config->proxy_tls_password);
-  Curl_safefree(config->proxy_tls_authtype);
-  Curl_safefree(config->proxyuserpwd);
-  Curl_safefree(config->proxy);
+  curlx_safefree(config->userpwd);
+  curlx_safefree(config->tls_username);
+  curlx_safefree(config->tls_password);
+  curlx_safefree(config->tls_authtype);
+  curlx_safefree(config->proxy_tls_username);
+  curlx_safefree(config->proxy_tls_password);
+  curlx_safefree(config->proxy_tls_authtype);
+  curlx_safefree(config->proxyuserpwd);
+  curlx_safefree(config->proxy);
 
-  Curl_safefree(config->dns_ipv6_addr);
-  Curl_safefree(config->dns_ipv4_addr);
-  Curl_safefree(config->dns_interface);
-  Curl_safefree(config->dns_servers);
+  curlx_safefree(config->dns_ipv6_addr);
+  curlx_safefree(config->dns_ipv4_addr);
+  curlx_safefree(config->dns_interface);
+  curlx_safefree(config->dns_servers);
 
-  Curl_safefree(config->noproxy);
+  curlx_safefree(config->noproxy);
 
-  Curl_safefree(config->mail_from);
+  curlx_safefree(config->mail_from);
   curl_slist_free_all(config->mail_rcpt);
-  Curl_safefree(config->mail_auth);
+  curlx_safefree(config->mail_auth);
 
-  Curl_safefree(config->netrc_file);
-  Curl_safefree(config->output_dir);
-  Curl_safefree(config->proto_str);
-  Curl_safefree(config->proto_redir_str);
+  curlx_safefree(config->netrc_file);
+  curlx_safefree(config->output_dir);
+  curlx_safefree(config->proto_str);
+  curlx_safefree(config->proto_redir_str);
 
   urlnode = config->url_list;
   while(urlnode) {
     struct getout *next = urlnode->next;
-    Curl_safefree(urlnode->url);
-    Curl_safefree(urlnode->outfile);
-    Curl_safefree(urlnode->infile);
-    Curl_safefree(urlnode);
+    curlx_safefree(urlnode->url);
+    curlx_safefree(urlnode->outfile);
+    curlx_safefree(urlnode->infile);
+    curlx_safefree(urlnode);
     urlnode = next;
   }
   config->url_list = NULL;
@@ -109,43 +120,49 @@ static void free_config_fields(struct OperationConfig *config)
   config->url_get = NULL;
   config->url_out = NULL;
 
-  Curl_safefree(config->doh_url);
-  Curl_safefree(config->cipher_list);
-  Curl_safefree(config->proxy_cipher_list);
-  Curl_safefree(config->cert);
-  Curl_safefree(config->proxy_cert);
-  Curl_safefree(config->cert_type);
-  Curl_safefree(config->proxy_cert_type);
-  Curl_safefree(config->cacert);
-  Curl_safefree(config->login_options);
-  Curl_safefree(config->proxy_cacert);
-  Curl_safefree(config->capath);
-  Curl_safefree(config->proxy_capath);
-  Curl_safefree(config->crlfile);
-  Curl_safefree(config->pinnedpubkey);
-  Curl_safefree(config->proxy_pinnedpubkey);
-  Curl_safefree(config->proxy_crlfile);
-  Curl_safefree(config->key);
-  Curl_safefree(config->proxy_key);
-  Curl_safefree(config->key_type);
-  Curl_safefree(config->proxy_key_type);
-  Curl_safefree(config->key_passwd);
-  Curl_safefree(config->proxy_key_passwd);
-  Curl_safefree(config->pubkey);
-  Curl_safefree(config->hostpubmd5);
-  Curl_safefree(config->hostpubsha256);
-  Curl_safefree(config->engine);
-  Curl_safefree(config->etag_save_file);
-  Curl_safefree(config->etag_compare_file);
-  Curl_safefree(config->ssl_ec_curves);
-  Curl_safefree(config->request_target);
-  Curl_safefree(config->customrequest);
-  Curl_safefree(config->krblevel);
-  Curl_safefree(config->oauth_bearer);
-  Curl_safefree(config->sasl_authzid);
-  Curl_safefree(config->unix_socket_path);
-  Curl_safefree(config->writeout);
-  Curl_safefree(config->proto_default);
+#ifndef CURL_DISABLE_IPFS
+  curlx_safefree(config->ipfs_gateway);
+#endif
+  curlx_safefree(config->doh_url);
+  curlx_safefree(config->cipher_list);
+  curlx_safefree(config->proxy_cipher_list);
+  curlx_safefree(config->cipher13_list);
+  curlx_safefree(config->proxy_cipher13_list);
+  curlx_safefree(config->cert);
+  curlx_safefree(config->proxy_cert);
+  curlx_safefree(config->cert_type);
+  curlx_safefree(config->proxy_cert_type);
+  curlx_safefree(config->cacert);
+  curlx_safefree(config->login_options);
+  curlx_safefree(config->proxy_cacert);
+  curlx_safefree(config->capath);
+  curlx_safefree(config->proxy_capath);
+  curlx_safefree(config->crlfile);
+  curlx_safefree(config->pinnedpubkey);
+  curlx_safefree(config->proxy_pinnedpubkey);
+  curlx_safefree(config->proxy_crlfile);
+  curlx_safefree(config->key);
+  curlx_safefree(config->proxy_key);
+  curlx_safefree(config->key_type);
+  curlx_safefree(config->proxy_key_type);
+  curlx_safefree(config->key_passwd);
+  curlx_safefree(config->proxy_key_passwd);
+  curlx_safefree(config->pubkey);
+  curlx_safefree(config->hostpubmd5);
+  curlx_safefree(config->hostpubsha256);
+  curlx_safefree(config->engine);
+  curlx_safefree(config->etag_save_file);
+  curlx_safefree(config->etag_compare_file);
+  curlx_safefree(config->ssl_ec_curves);
+  curlx_safefree(config->ssl_signature_algorithms);
+  curlx_safefree(config->request_target);
+  curlx_safefree(config->customrequest);
+  curlx_safefree(config->krblevel);
+  curlx_safefree(config->oauth_bearer);
+  curlx_safefree(config->sasl_authzid);
+  curlx_safefree(config->unix_socket_path);
+  curlx_safefree(config->writeout);
+  curlx_safefree(config->proto_default);
 
   curl_slist_free_all(config->quote);
   curl_slist_free_all(config->postquote);
@@ -164,16 +181,16 @@ static void free_config_fields(struct OperationConfig *config)
   curl_slist_free_all(config->resolve);
   curl_slist_free_all(config->connect_to);
 
-  Curl_safefree(config->preproxy);
-  Curl_safefree(config->proxy_service_name);
-  Curl_safefree(config->service_name);
-
-  Curl_safefree(config->ftp_account);
-  Curl_safefree(config->ftp_alternative_to_user);
-
-  Curl_safefree(config->aws_sigv4);
-  Curl_safefree(config->proto_str);
-  Curl_safefree(config->proto_redir_str);
+  curlx_safefree(config->preproxy);
+  curlx_safefree(config->proxy_service_name);
+  curlx_safefree(config->service_name);
+  curlx_safefree(config->ftp_account);
+  curlx_safefree(config->ftp_alternative_to_user);
+  curlx_safefree(config->aws_sigv4);
+  curlx_safefree(config->ech);
+  curlx_safefree(config->ech_config);
+  curlx_safefree(config->ech_public);
+  curlx_safefree(config->knownhosts);
 }
 
 void config_free(struct OperationConfig *config)
@@ -185,8 +202,186 @@ void config_free(struct OperationConfig *config)
     struct OperationConfig *prev = last->prev;
 
     free_config_fields(last);
-    free(last);
+    curlx_free(last);
 
     last = prev;
   }
 }
+
+#ifdef CURL_DEBUG_GLOBAL_MEM
+
+#ifdef CURL_MEMDEBUG
+#error "curl_global_init_mem() testing does not work with memdebug debugging"
+#endif
+
+/*
+ * This is the custom memory functions handed to curl when we run special test
+ * round to verify them.
+ *
+ * The main point is to make sure that what is returned is different than what
+ * the regular memory functions return so that mixup does trigger problems.
+ *
+ * This test setup currently only works when building with a *shared* libcurl
+ * and not static, as in the latter case the tool and the library share some of
+ * the functions in incompatible ways.
+ */
+
+/*
+ * This code appends this extra chunk of memory in front of every allocation
+ * done by libcurl with the only purpose to cause trouble when using the wrong
+ * free function on memory.
+ */
+struct extramem {
+  size_t extra;
+  union {
+    curl_off_t o;
+    double d;
+    void *p;
+  } mem[1];
+};
+
+static void *custom_calloc(size_t wanted_nmemb, size_t wanted_size)
+{
+  struct extramem *m;
+  size_t sz = wanted_size * wanted_nmemb;
+  sz += sizeof(struct extramem);
+  m = curlx_calloc(1, sz);
+  if(m)
+    return m->mem;
+  return NULL;
+}
+
+static void *custom_malloc(size_t wanted_size)
+{
+  struct extramem *m;
+  size_t sz = wanted_size + sizeof(struct extramem);
+  m = curlx_malloc(sz);
+  if(m)
+    return m->mem;
+  return NULL;
+}
+
+static char *custom_strdup(const char *ptr)
+{
+  struct extramem *m;
+  size_t len = strlen(ptr);
+  size_t sz = len + sizeof(struct extramem);
+  m = curlx_malloc(sz);
+  if(m) {
+    char *p = (char *)m->mem;
+    /* since strcpy is banned, we do memcpy */
+    memcpy(p, ptr, len);
+    p[len] = 0;
+    return (char *)m->mem;
+  }
+  return NULL;
+}
+
+static void *custom_realloc(void *ptr, size_t size)
+{
+  struct extramem *m = NULL;
+  size_t sz = size + sizeof(struct extramem);
+  if(ptr)
+    /* if given a pointer, figure out the original */
+    ptr = (void *)((char *)ptr - offsetof(struct extramem, mem));
+  m = curlx_realloc(ptr, sz);
+  if(m)
+    return m->mem;
+  return NULL;
+}
+
+static void custom_free(void *ptr)
+{
+  struct extramem *m = NULL;
+  if(ptr) {
+    m = (void *)((char *)ptr - offsetof(struct extramem, mem));
+    curlx_free(m);
+  }
+}
+
+#endif
+
+/*
+ * This is the main global constructor for the app. Call this before
+ * _any_ libcurl usage. If this fails, *NO* libcurl functions may be
+ * used, or havoc may be the result.
+ */
+CURLcode globalconf_init(void)
+{
+  CURLcode result = CURLE_OK;
+  global = &globalconf;
+
+#ifdef __DJGPP__
+  /* stop stat() wasting time */
+  _djstat_flags |= _STAT_INODE | _STAT_EXEC_MAGIC | _STAT_DIRSIZE;
+#endif
+
+  /* Initialize the global config */
+  global->showerror = FALSE;          /* show errors when silent */
+  global->styled_output = TRUE;       /* enable detection */
+  global->parallel_max = PARALLEL_DEFAULT;
+
+  /* Allocate the initial operate config */
+  global->first = global->last = config_alloc();
+  if(global->first) {
+    /* Perform the libcurl initialization */
+#ifdef CURL_DEBUG_GLOBAL_MEM
+    result = curl_global_init_mem(CURL_GLOBAL_ALL, custom_malloc, custom_free,
+                                  custom_realloc, custom_strdup,
+                                  custom_calloc);
+#else
+    result = curl_global_init(CURL_GLOBAL_DEFAULT);
+#endif
+    if(!result) {
+      /* Get information about libcurl */
+      result = get_libcurl_info();
+
+      if(result) {
+        errorf("error retrieving curl library information");
+        curlx_free(global->first);
+      }
+    }
+    else {
+      errorf("error initializing curl library");
+      curlx_free(global->first);
+    }
+  }
+  else {
+    errorf("error initializing curl");
+    result = CURLE_FAILED_INIT;
+  }
+
+  return result;
+}
+
+static void free_globalconfig(void)
+{
+  curlx_safefree(global->trace_dump);
+
+  if(global->trace_fopened && global->trace_stream)
+    curlx_fclose(global->trace_stream);
+  global->trace_stream = NULL;
+
+  curlx_safefree(global->ssl_sessions);
+  curlx_safefree(global->libcurl);
+#ifdef _WIN32
+  curlx_free(global->term.buf);
+#endif
+}
+
+/*
+ * This is the main global destructor for the app. Call this after _all_
+ * libcurl usage is done.
+ */
+void globalconf_free(void)
+{
+  /* Cleanup the easy handle */
+  /* Main cleanup */
+  curl_global_cleanup();
+  free_globalconfig();
+
+  /* Free the OperationConfig structures */
+  config_free(global->last);
+  global->first = NULL;
+  global->last = NULL;
+}
diff --git a/third-party/curl/src/tool_cfgable.h b/third-party/curl/src/tool_cfgable.h
index ca7d1a78d4..0f8bc6fe08 100644
--- a/third-party/curl/src/tool_cfgable.h
+++ b/third-party/curl/src/tool_cfgable.h
@@ -24,67 +24,53 @@
  *
  ***************************************************************************/
 #include "tool_setup.h"
+
 #include "tool_sdecls.h"
 #include "tool_urlglob.h"
 #include "var.h"
 
-struct GlobalConfig;
+#define MAX_CONFIG_LINE_LENGTH (10 * 1024 * 1024)
+
+#define checkprefix(a, b) curl_strnequal(b, STRCONST(a))
+
+extern struct GlobalConfig *global;
 
 struct State {
   struct getout *urlnode;
-  struct URLGlob *inglob;
-  struct URLGlob *urls;
-  char *outfiles;
-  char *httpgetfields;
+  struct URLGlob inglob;
+  struct URLGlob urlglob;
   char *uploadfile;
-  curl_off_t infilenum; /* number of files to upload */
-  curl_off_t up;        /* upload file counter within a single upload glob */
-  curl_off_t urlnum;    /* how many iterations this single URL has with ranges
-                           etc */
-  curl_off_t li;
+  curl_off_t upnum;     /* number of files to upload */
+  curl_off_t upidx;     /* index for upload glob */
+  curl_off_t urlnum;    /* how many iterations this URL has with ranges etc */
+  curl_off_t urlidx;    /* index for globbed URLs */
 };
 
+#define FAIL_NONE      0
+#define FAIL_WITH_BODY 1
+#define FAIL_WO_BODY   2
+
 struct OperationConfig {
-  bool remote_time;
+  struct dynbuf postdata;
   char *useragent;
   struct curl_slist *cookies;  /* cookies to serialize into a single line */
   char *cookiejar;          /* write to this file */
   struct curl_slist *cookiefiles;  /* file(s) to load cookies from */
-  char *altsvc;             /* alt-svc cache file name */
-  char *hsts;               /* HSTS cache file name */
-  bool cookiesession;       /* new session? */
-  bool encoding;            /* Accept-Encoding please */
-  bool tr_encoding;         /* Transfer-Encoding please */
-  unsigned long authtype;   /* auth bitmask */
-  bool use_resume;
-  bool resume_from_current;
-  bool disable_epsv;
-  bool disable_eprt;
-  bool ftp_pret;
+  char *altsvc;             /* alt-svc cache filename */
+  char *hsts;               /* HSTS cache filename */
   char *proto_str;
-  bool proto_present;
   char *proto_redir_str;
-  bool proto_redir_present;
   char *proto_default;
   curl_off_t resume_from;
   char *postfields;
-  curl_off_t postfieldsize;
   char *referer;
   char *query;
-  long timeout_ms;
-  long connecttimeout_ms;
-  long maxredirs;
   curl_off_t max_filesize;
   char *output_dir;
   char *headerfile;
   char *ftpport;
   char *iface;
-  long localport;
-  long localportrange;
-  unsigned short porttouse;
   char *range;
-  long low_speed_limit;
-  long low_speed_time;
   char *dns_servers;   /* dot notation: 1.1.1.1;2.2.2.2 */
   char *dns_interface; /* interface name */
   char *dns_ipv4_addr; /* dot notation */
@@ -99,35 +85,22 @@ struct OperationConfig {
   char *proxy_tls_authtype;
   char *proxyuserpwd;
   char *proxy;
-  int proxyver;             /* set to CURLPROXY_HTTP* define */
   char *noproxy;
+  char *knownhosts;
   char *mail_from;
   struct curl_slist *mail_rcpt;
   char *mail_auth;
-  bool mail_rcpt_allowfails; /* --mail-rcpt-allowfails */
   char *sasl_authzid;       /* Authorization identity (identity to use) */
-  bool sasl_ir;             /* Enable/disable SASL initial response */
-  bool proxytunnel;
-  bool ftp_append;          /* APPE on ftp */
-  bool use_ascii;           /* select ascii or text transfer */
-  bool autoreferer;         /* automatically set referer */
-  bool failonerror;         /* fail on (HTTP) errors */
-  bool failwithbody;        /* fail on (HTTP) errors but still store body */
-  bool show_headers;        /* show headers to data output */
-  bool no_body;             /* don't get the body */
-  bool dirlistonly;         /* only get the FTP dir list */
-  bool followlocation;      /* follow http redirects */
-  bool unrestricted_auth;   /* Continue to send authentication (user+password)
-                               when following redirects, even when hostname
-                               changed */
-  bool netrc_opt;
-  bool netrc;
   char *netrc_file;
   struct getout *url_list;  /* point to the first node */
   struct getout *url_last;  /* point to the last/current node */
   struct getout *url_get;   /* point to the node to fill in URL */
   struct getout *url_out;   /* point to the node to fill in outfile */
   struct getout *url_ul;    /* point to the node to fill in upload */
+  size_t num_urls;          /* number of URLs added to the list */
+#ifndef CURL_DISABLE_IPFS
+  char *ipfs_gateway;
+#endif
   char *doh_url;
   char *cipher_list;
   char *proxy_cipher_list;
@@ -157,45 +130,16 @@ struct OperationConfig {
   char *engine;
   char *etag_save_file;
   char *etag_compare_file;
-  bool crlf;
   char *customrequest;
   char *ssl_ec_curves;
+  char *ssl_signature_algorithms;
   char *krblevel;
   char *request_target;
-  long httpversion;
-  bool http09_allowed;
-  bool nobuffer;
-  bool readbusy;            /* set when reading input returns EAGAIN */
-  bool globoff;
-  bool use_httpget;
-  bool insecure_ok;         /* set TRUE to allow insecure SSL connects */
-  bool doh_insecure_ok;     /* set TRUE to allow insecure SSL connects
-                               for DoH */
-  bool proxy_insecure_ok;   /* set TRUE to allow insecure SSL connects
-                               for proxy */
-  bool terminal_binary_ok;
-  bool verifystatus;
-  bool doh_verifystatus;
-  bool create_dirs;
-  bool ftp_create_dirs;
-  bool ftp_skip_ip;
-  bool proxynegotiate;
-  bool proxyntlm;
-  bool proxydigest;
-  bool proxybasic;
-  bool proxyanyauth;
-  bool jsoned; /* added json content-type */
   char *writeout;           /* %-styled format string to output */
+  char *httpgetfields;
   struct curl_slist *quote;
   struct curl_slist *postquote;
   struct curl_slist *prequote;
-  long ssl_version;
-  long ssl_version_max;
-  long proxy_ssl_version;
-  long ip_version;
-  long create_file_mode; /* CURLOPT_NEW_FILE_PERMS */
-  curl_TimeCond timecond;
-  curl_off_t condtime;
   struct curl_slist *headers;
   struct curl_slist *proxyheaders;
   struct tool_mime *mimeroot;
@@ -204,132 +148,221 @@ struct OperationConfig {
   struct curl_slist *telnet_options;
   struct curl_slist *resolve;
   struct curl_slist *connect_to;
-  HttpReq httpreq;
-
-  /* for bandwidth limiting features: */
-  curl_off_t sendpersecond; /* send to peer */
-  curl_off_t recvpersecond; /* receive from peer */
-
-  bool ftp_ssl;
-  bool ftp_ssl_reqd;
-  bool ftp_ssl_control;
-  bool ftp_ssl_ccc;
-  int ftp_ssl_ccc_mode;
   char *preproxy;
-  bool socks5_gssapi_nec;   /* The NEC reference server does not protect the
-                               encryption type exchange */
-  unsigned long socks5_auth;/* auth bitmask for socks5 proxies */
   char *proxy_service_name; /* set authentication service name for HTTP and
                                SOCKS5 proxies */
   char *service_name;       /* set authentication service name for DIGEST-MD5,
                                Kerberos 5 and SPNEGO */
-
-  bool tcp_nodelay;
-  bool tcp_fastopen;
-  long req_retry;           /* number of retries */
-  bool retry_all_errors;    /* retry on any error */
-  bool retry_connrefused;   /* set connection refused as a transient error */
-  long retry_delay;         /* delay between retries (in seconds) */
-  long retry_maxtime;       /* maximum time to keep retrying */
-
   char *ftp_account;        /* for ACCT */
   char *ftp_alternative_to_user;  /* send command if USER/PASS fails */
-  int ftp_filemethod;
-  long mime_options;        /* Mime option flags. */
-  long tftp_blksize;        /* TFTP BLKSIZE option */
-  bool tftp_no_options;     /* do not send TFTP options requests */
-  bool ignorecl;            /* --ignore-content-length */
-  bool disable_sessionid;
-
-  bool raw;
-  bool post301;
-  bool post302;
-  bool post303;
-  bool nokeepalive;         /* for keepalive needs */
-  long alivetime;
-  bool content_disposition; /* use Content-disposition filename */
-
-  int default_node_flags;   /* default flags to search for each 'node', which
-                               is basically each given URL to transfer */
-
-  bool xattr;               /* store metadata in extended attributes */
-  long gssapi_delegation;
-  bool ssl_allow_beast;     /* allow this SSL vulnerability */
-  bool proxy_ssl_allow_beast; /* allow this SSL vulnerability for proxy */
-  bool ssl_no_revoke;       /* disable SSL certificate revocation checks */
-  bool ssl_revoke_best_effort; /* ignore SSL revocation offline/missing
-                                  revocation list errors */
-
-  bool native_ca_store;        /* use the native OS CA store */
-  bool proxy_native_ca_store;  /* use the native OS CA store for proxy */
-  bool ssl_auto_client_cert;   /* automatically locate and use a client
-                                  certificate for authentication (Schannel) */
-  bool proxy_ssl_auto_client_cert; /* proxy version of ssl_auto_client_cert */
   char *oauth_bearer;             /* OAuth 2.0 bearer token */
-  bool noalpn;                    /* enable/disable TLS ALPN extension */
   char *unix_socket_path;         /* path to Unix domain socket */
-  bool abstract_unix_socket;      /* path to an abstract Unix domain socket */
-  bool falsestart;
-  bool path_as_is;
+  char *haproxy_clientip;         /* client IP for HAProxy protocol */
+  char *aws_sigv4;
+  char *ech;                      /* Config set by --ech keywords */
+  char *ech_config;               /* Config set by "--ech esl:" option */
+  char *ech_public;               /* Config set by "--ech pn:" option */
+  struct OperationConfig *prev;
+  struct OperationConfig *next;   /* Always last in the struct */
+  curl_off_t condtime;
+  /* for bandwidth limiting features: */
+  curl_off_t sendpersecond; /* send to peer */
+  curl_off_t recvpersecond; /* receive from peer */
+
+  long proxy_ssl_version;
+  long ip_version;
+  long create_file_mode; /* CURLOPT_NEW_FILE_PERMS */
+  long low_speed_limit;
+  long low_speed_time;
+  long ip_tos;         /* IP Type of Service */
+  long vlan_priority;  /* VLAN priority */
+  long localport;
+  long localportrange;
+  unsigned long authtype;   /* auth bitmask */
+  long timeout_ms;
+  long connecttimeout_ms;
+  long maxredirs;
+  long httpversion;
+  unsigned long socks5_auth;/* auth bitmask for socks5 proxies */
+  long req_retry;           /* number of retries */
+  uint32_t retry_delay_ms; /* delay between retries (in milliseconds), 0 means
+                              increase exponentially */
+  long retry_maxtime_ms;    /* maximum time to keep retrying */
+
+  unsigned long mime_options; /* Mime option flags. */
+  long tftp_blksize;        /* TFTP BLKSIZE option */
+  long alivetime;           /* keepalive-time */
+  long alivecnt;            /* keepalive-cnt */
+  long gssapi_delegation;
   long expect100timeout_ms;
-  bool suppress_connect_headers;  /* suppress proxy CONNECT response headers
-                                     from user callbacks */
-  bool synthetic_error;           /* if TRUE, this is tool-internal error */
-  bool ssh_compression;           /* enable/disable SSH compression */
   long happy_eyeballs_timeout_ms; /* happy eyeballs timeout in milliseconds.
                                      0 is valid. default: CURL_HET_DEFAULT. */
-  bool haproxy_protocol;          /* whether to send HAProxy protocol v1 */
-  char *haproxy_clientip;         /* client IP for HAProxy protocol */
-  bool disallow_username_in_url;  /* disallow usernames in URLs */
-  char *aws_sigv4;
+  unsigned long timecond;
+  long followlocation;      /* follow http redirects mode */
+  HttpReq httpreq;
+  long proxyver;             /* set to CURLPROXY_HTTP* define */
+  long ftp_ssl_ccc_mode;
+  long ftp_filemethod;
   enum {
     CLOBBER_DEFAULT, /* Provides compatibility with previous versions of curl,
                         by using the default behavior for -o, -O, and -J.
                         If those options would have overwritten files, like
                         -o and -O would, then overwrite them. In the case of
-                        -J, this will not overwrite any files. */
+                        -J, this does not overwrite any files. */
     CLOBBER_NEVER, /* If the file exists, always fail */
     CLOBBER_ALWAYS /* If the file exists, always overwrite it */
   } file_clobber_mode;
-  struct GlobalConfig *global;
-  struct OperationConfig *prev;
-  struct OperationConfig *next;   /* Always last in the struct */
-  struct State state;             /* for create_transfer() */
-  bool rm_partial;                /* on error, remove partially written output
+  unsigned char upload_flags; /* Bitmask for --upload-flags */
+  unsigned short porttouse;
+  unsigned char ssl_version;     /* 0 - 4, 0 being default */
+  unsigned char ssl_version_max; /* 0 - 4, 0 being default */
+  unsigned char fail;            /* NONE, with body, without body */
+  BIT(remote_name_all);   /* --remote-name-all */
+  BIT(remote_time);
+  BIT(cookiesession);       /* new session? */
+  BIT(encoding);            /* Accept-Encoding please */
+  BIT(tr_encoding);         /* Transfer-Encoding please */
+  BIT(use_resume);
+  BIT(resume_from_current);
+  BIT(disable_epsv);
+  BIT(disable_eprt);
+  BIT(ftp_pret);
+  BIT(proto_present);
+  BIT(proto_redir_present);
+  BIT(mail_rcpt_allowfails); /* --mail-rcpt-allowfails */
+  BIT(sasl_ir);             /* Enable/disable SASL initial response */
+  BIT(proxytunnel);
+  BIT(ftp_append);          /* APPE on ftp */
+  BIT(use_ascii);           /* select ASCII or text transfer */
+  BIT(autoreferer);         /* automatically set referer */
+  BIT(show_headers);        /* show headers to data output */
+  BIT(no_body);             /* do not get the body */
+  BIT(dirlistonly);         /* only get the FTP directory list */
+  BIT(unrestricted_auth);   /* Continue to send authentication (user+password)
+                               when following redirects, even when hostname
+                               changed */
+  BIT(netrc_opt);
+  BIT(netrc);
+  BIT(crlf);
+  BIT(http09_allowed);
+  BIT(nobuffer);
+  BIT(readbusy);            /* set when reading input returns EAGAIN */
+  BIT(globoff);
+  BIT(use_httpget);
+  BIT(insecure_ok);         /* set TRUE to allow insecure SSL connects */
+  BIT(doh_insecure_ok);     /* set TRUE to allow insecure SSL connects
+                               for DoH */
+  BIT(proxy_insecure_ok);   /* set TRUE to allow insecure SSL connects
+                               for proxy */
+  BIT(terminal_binary_ok);
+  BIT(verifystatus);
+  BIT(doh_verifystatus);
+  BIT(create_dirs);
+  BIT(ftp_create_dirs);
+  BIT(ftp_skip_ip);
+  BIT(proxynegotiate);
+  BIT(proxyntlm);
+  BIT(proxydigest);
+  BIT(proxybasic);
+  BIT(proxyanyauth);
+  BIT(jsoned); /* added json content-type */
+  BIT(ftp_ssl);
+  BIT(ftp_ssl_reqd);
+  BIT(ftp_ssl_control);
+  BIT(ftp_ssl_ccc);
+  BIT(socks5_gssapi_nec);   /* The NEC reference server does not protect the
+                               encryption type exchange */
+  BIT(tcp_nodelay);
+  BIT(tcp_fastopen);
+  BIT(retry_all_errors);    /* retry on any error */
+  BIT(retry_connrefused);   /* set connection refused as a transient error */
+  BIT(tftp_no_options);     /* do not send TFTP options requests */
+  BIT(ignorecl);            /* --ignore-content-length */
+  BIT(disable_sessionid);
+
+  BIT(raw);
+  BIT(post301);
+  BIT(post302);
+  BIT(post303);
+  BIT(nokeepalive);         /* for keepalive needs */
+  BIT(content_disposition); /* use Content-disposition filename */
+
+  BIT(xattr);               /* store metadata in extended attributes */
+  BIT(ssl_allow_beast);     /* allow this SSL vulnerability */
+  BIT(ssl_allow_earlydata); /* allow use of TLSv1.3 early data */
+  BIT(proxy_ssl_allow_beast); /* allow this SSL vulnerability for proxy */
+  BIT(ssl_no_revoke);       /* disable SSL certificate revocation checks */
+  BIT(ssl_revoke_best_effort); /* ignore SSL revocation offline/missing
+                                  revocation list errors */
+
+  BIT(native_ca_store);        /* use the native OS CA store */
+  BIT(proxy_native_ca_store);  /* use the native OS CA store for proxy */
+  BIT(ssl_auto_client_cert);   /* automatically locate and use a client
+                                  certificate for authentication (Schannel) */
+  BIT(proxy_ssl_auto_client_cert); /* proxy version of ssl_auto_client_cert */
+  BIT(noalpn);                    /* enable/disable TLS ALPN extension */
+  BIT(abstract_unix_socket);      /* path to an abstract Unix domain socket */
+  BIT(path_as_is);
+  BIT(suppress_connect_headers);  /* suppress proxy CONNECT response headers
+                                     from user callbacks */
+  BIT(synthetic_error);           /* if TRUE, this is tool-internal error */
+  BIT(ssh_compression);           /* enable/disable SSH compression */
+  BIT(haproxy_protocol);          /* whether to send HAProxy protocol v1 */
+  BIT(disallow_username_in_url);  /* disallow usernames in URLs */
+  BIT(mptcp);                     /* enable MPTCP support */
+  BIT(rm_partial);                /* on error, remove partially written output
                                      files */
+  BIT(skip_existing);
 };
 
+#ifdef _WIN32
+struct termout {
+  wchar_t *buf;
+  DWORD len;
+};
+#endif
+
 struct GlobalConfig {
-  bool showerror;                 /* show errors when silent */
-  bool silent;                    /* don't show messages, --silent given */
-  bool noprogress;                /* don't show progress bar */
-  bool isatty;                    /* Updated internally if output is a tty */
+  struct State state;             /* for create_transfer() */
   char *trace_dump;               /* file to dump the network trace to */
   FILE *trace_stream;
-  bool trace_fopened;
-  trace tracetype;
-  bool tracetime;                 /* include timestamp? */
-  bool traceids;                  /* include xfer-/conn-id? */
-  int progressmode;               /* CURL_PROGRESS_BAR / CURL_PROGRESS_STATS */
-  char *libcurl;                  /* Output libcurl code to this file name */
-  bool fail_early;                /* exit on first transfer error */
-  bool styled_output;             /* enable fancy output style detection */
-  long ms_per_transfer;           /* start next transfer after (at least) this
-                                     many milliseconds */
-#ifdef CURLDEBUG
-  bool test_event_based;
-#endif
-  bool parallel;
-  unsigned short parallel_max; /* MAX_PARALLEL is the maximum */
-  bool parallel_connect;
-  char *help_category;            /* The help category, if set */
-  struct var *variables;
+  char *libcurl;                  /* Output libcurl code to this filename */
+  char *ssl_sessions;             /* file to load/save SSL session tickets */
+  struct tool_var *variables;
   struct OperationConfig *first;
   struct OperationConfig *current;
-  struct OperationConfig *last;   /* Always last in the struct */
+  struct OperationConfig *last;
+#ifdef _WIN32
+  struct termout term;
+#endif
+  timediff_t ms_per_transfer;     /* start next transfer after (at least) this
+                                     many milliseconds */
+  trace tracetype;
+  int progressmode;               /* CURL_PROGRESS_BAR / CURL_PROGRESS_STATS */
+  unsigned short parallel_host; /* MAX_PARALLEL_HOST is the maximum */
+  unsigned short parallel_max; /* MAX_PARALLEL is the maximum */
+  unsigned char verbosity;        /* How verbose we should be */
+#ifdef DEBUGBUILD
+  BIT(test_duphandle);
+  BIT(test_event_based);
+#endif
+  BIT(parallel);
+  BIT(parallel_connect);
+  BIT(fail_early);                /* exit on first transfer error */
+  BIT(styled_output);             /* enable fancy output style detection */
+  BIT(trace_fopened);
+  BIT(tracetime);                 /* include timestamp? */
+  BIT(traceids);                  /* include xfer-/conn-id? */
+  BIT(showerror);                 /* show errors when silent */
+  BIT(silent);                    /* do not show messages, --silent given */
+  BIT(noprogress);                /* do not show progress bar */
+  BIT(isatty);                    /* Updated internally if output is a tty */
+  BIT(trace_set);                 /* --trace-config has been used */
 };
 
-void config_init(struct OperationConfig *config);
+struct OperationConfig *config_alloc(void);
 void config_free(struct OperationConfig *config);
+CURLcode globalconf_init(void);
+void globalconf_free(void);
 
 #endif /* HEADER_CURL_TOOL_CFGABLE_H */
diff --git a/third-party/curl/src/tool_dirhie.c b/third-party/curl/src/tool_dirhie.c
index c01c19cfb2..82377a718e 100644
--- a/third-party/curl/src/tool_dirhie.c
+++ b/third-party/curl/src/tool_dirhie.c
@@ -23,60 +23,69 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#include <sys/stat.h>
-
-#ifdef WIN32
-#  include <direct.h>
-#endif
-
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
-
 #include "tool_dirhie.h"
 #include "tool_msgs.h"
 
-#include "memdebug.h" /* keep this as LAST include */
-
-#if defined(WIN32) || (defined(MSDOS) && !defined(__DJGPP__))
-#  define mkdir(x,y) (mkdir)((x))
-#  ifndef F_OK
-#    define F_OK 0
-#  endif
+#ifdef UNITTESTS
+#  define toolx_mkdir(x, y) create_dir_hierarchy_trace_mkdir(x)
+#elif defined(_WIN32)
+#  include <direct.h>
+#  define toolx_mkdir(x, y) _mkdir(x)
+#elif defined(MSDOS) && !defined(__DJGPP__)
+#  define toolx_mkdir(x, y) mkdir(x)
+#else
+#  define toolx_mkdir mkdir
 #endif
 
-static void show_dir_errno(struct GlobalConfig *global, const char *name)
+#ifdef UNITTESTS
+static struct dynbuf mkdir_results;
+
+UNITTEST struct dynbuf *create_dir_hierarchy_trace_dynres(void)
+{
+  return &mkdir_results;
+}
+
+static int create_dir_hierarchy_trace_mkdir(const char *dir)
+{
+  return !dir ||
+    curlx_dyn_add(&mkdir_results, dir) ||
+    curlx_dyn_add(&mkdir_results, "|") ? -1 : 0;
+}
+#endif
+
+static void show_dir_errno(const char *name)
 {
   switch(errno) {
 #ifdef EACCES
+  /* !checksrc! disable ERRNOVAR 1 */
   case EACCES:
-    errorf(global, "You don't have permission to create %s", name);
+    errorf("You do not have permission to create %s", name);
     break;
 #endif
 #ifdef ENAMETOOLONG
   case ENAMETOOLONG:
-    errorf(global, "The directory name %s is too long", name);
+    errorf("The directory name %s is too long", name);
     break;
 #endif
 #ifdef EROFS
   case EROFS:
-    errorf(global, "%s resides on a read-only file system", name);
+    errorf("%s resides on a read-only file system", name);
     break;
 #endif
 #ifdef ENOSPC
   case ENOSPC:
-    errorf(global, "No space left on the file system that will "
+    errorf("No space left on the file system that would "
            "contain the directory %s", name);
     break;
 #endif
 #ifdef EDQUOT
   case EDQUOT:
-    errorf(global, "Cannot create directory %s because you "
+    errorf("Cannot create directory %s because you "
            "exceeded your quota", name);
     break;
 #endif
   default:
-    errorf(global, "Error creating directory %s", name);
+    errorf("Error creating directory %s", name);
     break;
   }
 }
@@ -84,84 +93,62 @@ static void show_dir_errno(struct GlobalConfig *global, const char *name)
 /*
  * Create the needed directory hierarchy recursively in order to save
  *  multi-GETs in file output, ie:
- *  curl "http://my.site/dir[1-5]/file[1-5].txt" -o "dir#1/file#2.txt"
+ *  curl "http://example.org/dir[1-5]/file[1-5].txt" -o "dir#1/file#2.txt"
  *  should create all the dir* automagically
  */
 
-#if defined(WIN32) || defined(__DJGPP__)
+#if defined(_WIN32) || defined(__DJGPP__)
 /* systems that may use either or when specifying a path */
 #define PATH_DELIMITERS "\\/"
 #else
 #define PATH_DELIMITERS DIR_CHAR
 #endif
 
-
-CURLcode create_dir_hierarchy(const char *outfile, struct GlobalConfig *global)
+CURLcode create_dir_hierarchy(const char *outfile)
 {
-  char *tempdir;
-  char *tempdir2;
-  char *outdup;
-  char *dirbuildup;
   CURLcode result = CURLE_OK;
-  size_t outlen;
+  size_t outlen = strlen(outfile);
+  struct dynbuf dirbuf;
 
-  outlen = strlen(outfile);
-  outdup = strdup(outfile);
-  if(!outdup)
-    return CURLE_OUT_OF_MEMORY;
+  curlx_dyn_init(&dirbuf, outlen + 1);
 
-  dirbuildup = malloc(outlen + 1);
-  if(!dirbuildup) {
-    Curl_safefree(outdup);
-    return CURLE_OUT_OF_MEMORY;
-  }
-  dirbuildup[0] = '\0';
+  while(*outfile) {
+    bool skip = FALSE;
+    size_t seplen = strspn(outfile, PATH_DELIMITERS);
+    size_t len = strcspn(&outfile[seplen], PATH_DELIMITERS);
 
-  /* Allow strtok() here since this isn't used threaded */
-  /* !checksrc! disable BANNEDFUNC 2 */
-  tempdir = strtok(outdup, PATH_DELIMITERS);
+    /* the last path component is the file and it ends with a null byte */
+    if(!outfile[len + seplen])
+      break;
 
-  while(tempdir) {
-    bool skip = false;
-    tempdir2 = strtok(NULL, PATH_DELIMITERS);
-    /* since strtok returns a token for the last word even
-       if not ending with DIR_CHAR, we need to prune it */
-    if(tempdir2) {
-      size_t dlen = strlen(dirbuildup);
-      if(dlen)
-        msnprintf(&dirbuildup[dlen], outlen - dlen, "%s%s", DIR_CHAR, tempdir);
-      else {
-        if(outdup == tempdir) {
-#if defined(MSDOS) || defined(WIN32)
-          /* Skip creating a drive's current directory.
-             It may seem as though that would harmlessly fail but it could be
-             a corner case if X: did not exist, since we would be creating it
-             erroneously.
-             eg if outfile is X:\foo\bar\filename then don't mkdir X:
-             This logic takes into account unsupported drives !:, 1:, etc. */
-          char *p = strchr(tempdir, ':');
-          if(p && !p[1])
-            skip = true;
-#endif
-          /* the output string doesn't start with a separator */
-          strcpy(dirbuildup, tempdir);
-        }
-        else
-          msnprintf(dirbuildup, outlen, "%s%s", DIR_CHAR, tempdir);
-      }
-      /* Create directory. Ignore access denied error to allow traversal. */
-      if(!skip && (-1 == mkdir(dirbuildup, (mode_t)0000750)) &&
-         (errno != EACCES) && (errno != EEXIST)) {
-        show_dir_errno(global, dirbuildup);
-        result = CURLE_WRITE_ERROR;
-        break; /* get out of loop */
-      }
+#if defined(_WIN32) || defined(MSDOS)
+    if(!curlx_dyn_len(&dirbuf)) {
+      /* Skip creating a standalone Windows/MS-DOS drive letter 'X:', e.g.
+         if outfile is X:\foo\bar\filename. Do create drive-relative
+         directories e.g. in outfile X:foo\bar\filename. This logic takes into
+         account unsupported drives !:, 1:, etc. */
+      if(len == 2 && (outfile[1] == ':'))
+        skip = TRUE;
     }
-    tempdir = tempdir2;
+#endif
+    /* insert the leading separators (possibly plural) plus the following
+       directory name */
+    result = curlx_dyn_addn(&dirbuf, outfile, seplen + len);
+    if(result)
+      return result;
+
+    /* Create directory. Ignore access denied error to allow traversal. */
+    /* !checksrc! disable ERRNOVAR 1 */
+    if(!skip && (toolx_mkdir(curlx_dyn_ptr(&dirbuf), (mode_t)0000750) == -1) &&
+       (errno != EACCES) && (errno != EEXIST)) {
+      show_dir_errno(curlx_dyn_ptr(&dirbuf));
+      result = CURLE_WRITE_ERROR;
+      break; /* get out of loop */
+    }
+    outfile += len + seplen;
   }
 
-  Curl_safefree(dirbuildup);
-  Curl_safefree(outdup);
+  curlx_dyn_free(&dirbuf);
 
   return result;
 }
diff --git a/third-party/curl/src/tool_dirhie.h b/third-party/curl/src/tool_dirhie.h
index 0ee407fe54..60b9470a57 100644
--- a/third-party/curl/src/tool_dirhie.h
+++ b/third-party/curl/src/tool_dirhie.h
@@ -24,9 +24,11 @@
  *
  ***************************************************************************/
 #include "tool_setup.h"
-#include "tool_cfgable.h"
 
-CURLcode create_dir_hierarchy(const char *outfile,
-                              struct GlobalConfig *global);
+#ifdef UNITTESTS
+UNITTEST struct dynbuf *create_dir_hierarchy_trace_dynres(void);
+#endif
+
+CURLcode create_dir_hierarchy(const char *outfile);
 
 #endif /* HEADER_CURL_TOOL_DIRHIE_H */
diff --git a/third-party/curl/src/tool_doswin.c b/third-party/curl/src/tool_doswin.c
index e9347d298b..f836af9506 100644
--- a/third-party/curl/src/tool_doswin.c
+++ b/third-party/curl/src/tool_doswin.c
@@ -23,244 +23,77 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#if defined(MSDOS) || defined(WIN32)
+#if defined(_WIN32) || defined(MSDOS)
 
-#if defined(HAVE_LIBGEN_H) && defined(HAVE_BASENAME)
-#  include <libgen.h>
-#endif
+#include "curlx/basename.h" /* for curlx_basename() */
+#include "curlx/version_win32.h" /* for curlx_verify_windows_version() */
 
-#ifdef WIN32
-#  include <stdlib.h>
+#ifdef _WIN32
 #  include <tlhelp32.h>
-#  include "tool_cfgable.h"
-#  include "tool_libinfo.h"
+#elif !defined(__DJGPP__) || (__DJGPP__ < 2)  /* DJGPP 2.0 has _use_lfn() */
+#  define CURL_USE_LFN(f) 0  /* long filenames never available */
+#elif defined(__DJGPP__)
+#  include <fcntl.h>         /* for _use_lfn(f) prototype */
+#  define CURL_USE_LFN(f) _use_lfn(f)
 #endif
 
-#include "tool_bname.h"
+#include "tool_cfgable.h"
 #include "tool_doswin.h"
+#include "tool_msgs.h"
 
-#include "curlx.h"
-#include "memdebug.h" /* keep this as LAST include */
-
-#ifdef WIN32
-#  undef  PATH_MAX
-#  define PATH_MAX MAX_PATH
-#endif
+#ifdef MSDOS
 
 #ifndef S_ISCHR
 #  ifdef S_IFCHR
 #    define S_ISCHR(m) (((m) & S_IFMT) == S_IFCHR)
 #  else
-#    define S_ISCHR(m) (0) /* cannot tell if file is a device */
+#    define S_ISCHR(m) 0 /* cannot tell if file is a device */
 #  endif
 #endif
 
-#ifdef WIN32
-#  define _use_lfn(f) (1)   /* long file names always available */
-#elif !defined(__DJGPP__) || (__DJGPP__ < 2)  /* DJGPP 2.0 has _use_lfn() */
-#  define _use_lfn(f) (0)  /* long file names never available */
-#elif defined(__DJGPP__)
-#  include <fcntl.h>                /* _use_lfn(f) prototype */
-#endif
-
-#ifndef UNITTESTS
-static SANITIZEcode truncate_dryrun(const char *path,
-                                    const size_t truncate_pos);
-#ifdef MSDOS
-static SANITIZEcode msdosify(char **const sanitized, const char *file_name,
-                             int flags);
-#endif
-static SANITIZEcode rename_if_reserved_dos_device_name(char **const sanitized,
-                                                       const char *file_name,
-                                                       int flags);
-#endif /* !UNITTESTS (static declarations used if no unit tests) */
-
+/* The functions msdosify, rename_if_dos_device_name and __crt0_glob_function
+ * were taken with modification from the DJGPP port of tar 1.12. They use
+ * algorithms originally from DJTAR.
+ */
 
+#ifdef __DJGPP__
 /*
-Sanitize a file or path name.
-
-All banned characters are replaced by underscores, for example:
-f?*foo => f__foo
-f:foo::$DATA => f_foo__$DATA
-f:\foo:bar => f__foo_bar
-f:\foo:bar => f:\foo:bar   (flag SANITIZE_ALLOW_PATH)
-
-This function was implemented according to the guidelines in 'Naming Files,
-Paths, and Namespaces' section 'Naming Conventions'.
-https://msdn.microsoft.com/en-us/library/windows/desktop/aa365247.aspx
-
-Flags
------
-SANITIZE_ALLOW_COLONS:     Allow colons.
-Without this flag colons are sanitized.
-
-SANITIZE_ALLOW_PATH:       Allow path separators and colons.
-Without this flag path separators and colons are sanitized.
-
-SANITIZE_ALLOW_RESERVED:   Allow reserved device names.
-Without this flag a reserved device name is renamed (COM1 => _COM1) unless it's
-in a UNC prefixed path.
-
-SANITIZE_ALLOW_TRUNCATE:   Allow truncating a long filename.
-Without this flag if the sanitized filename or path will be too long an error
-occurs. With this flag the filename --and not any other parts of the path-- may
-be truncated to at least a single character. A filename followed by an
-alternate data stream (ADS) cannot be truncated in any case.
-
-Success: (SANITIZE_ERR_OK) *sanitized points to a sanitized copy of file_name.
-Failure: (!= SANITIZE_ERR_OK) *sanitized is NULL.
-*/
-SANITIZEcode sanitize_file_name(char **const sanitized, const char *file_name,
-                                int flags)
+ * Disable program default argument globbing. We do it on our own.
+ */
+char **__crt0_glob_function(char *arg)
 {
-  char *p, *target;
-  size_t len;
-  SANITIZEcode sc;
-  size_t max_sanitized_len;
-
-  if(!sanitized)
-    return SANITIZE_ERR_BAD_ARGUMENT;
-
-  *sanitized = NULL;
-
-  if(!file_name)
-    return SANITIZE_ERR_BAD_ARGUMENT;
-
-  if((flags & SANITIZE_ALLOW_PATH)) {
-#ifndef MSDOS
-    if(file_name[0] == '\\' && file_name[1] == '\\')
-      /* UNC prefixed path \\ (eg \\?\C:\foo) */
-      max_sanitized_len = 32767-1;
-    else
-#endif
-      max_sanitized_len = PATH_MAX-1;
-  }
-  else
-    /* The maximum length of a filename.
-       FILENAME_MAX is often the same as PATH_MAX, in other words it is 260 and
-       does not discount the path information therefore we shouldn't use it. */
-    max_sanitized_len = (PATH_MAX-1 > 255) ? 255 : PATH_MAX-1;
-
-  len = strlen(file_name);
-  if(len > max_sanitized_len) {
-    if(!(flags & SANITIZE_ALLOW_TRUNCATE) ||
-       truncate_dryrun(file_name, max_sanitized_len))
-      return SANITIZE_ERR_INVALID_PATH;
-
-    len = max_sanitized_len;
-  }
-
-  target = malloc(len + 1);
-  if(!target)
-    return SANITIZE_ERR_OUT_OF_MEMORY;
-
-  strncpy(target, file_name, len);
-  target[len] = '\0';
-
-#ifndef MSDOS
-  if((flags & SANITIZE_ALLOW_PATH) && !strncmp(target, "\\\\?\\", 4))
-    /* Skip the literal path prefix \\?\ */
-    p = target + 4;
-  else
-#endif
-    p = target;
-
-  /* replace control characters and other banned characters */
-  for(; *p; ++p) {
-    const char *banned;
-
-    if((1 <= *p && *p <= 31) ||
-       (!(flags & (SANITIZE_ALLOW_COLONS|SANITIZE_ALLOW_PATH)) && *p == ':') ||
-       (!(flags & SANITIZE_ALLOW_PATH) && (*p == '/' || *p == '\\'))) {
-      *p = '_';
-      continue;
-    }
-
-    for(banned = "|<>\"?*"; *banned; ++banned) {
-      if(*p == *banned) {
-        *p = '_';
-        break;
-      }
-    }
-  }
-
-  /* remove trailing spaces and periods if not allowing paths */
-  if(!(flags & SANITIZE_ALLOW_PATH) && len) {
-    char *clip = NULL;
-
-    p = &target[len];
-    do {
-      --p;
-      if(*p != ' ' && *p != '.')
-        break;
-      clip = p;
-    } while(p != target);
-
-    if(clip) {
-      *clip = '\0';
-      len = clip - target;
-    }
-  }
-
-#ifdef MSDOS
-  sc = msdosify(&p, target, flags);
-  free(target);
-  if(sc)
-    return sc;
-  target = p;
-  len = strlen(target);
-
-  if(len > max_sanitized_len) {
-    free(target);
-    return SANITIZE_ERR_INVALID_PATH;
-  }
-#endif
-
-  if(!(flags & SANITIZE_ALLOW_RESERVED)) {
-    sc = rename_if_reserved_dos_device_name(&p, target, flags);
-    free(target);
-    if(sc)
-      return sc;
-    target = p;
-    len = strlen(target);
-
-    if(len > max_sanitized_len) {
-      free(target);
-      return SANITIZE_ERR_INVALID_PATH;
-    }
-  }
-
-  *sanitized = target;
-  return SANITIZE_ERR_OK;
+  (void)arg;
+  return (char **)0;
 }
-
+#endif
 
 /*
-Test if truncating a path to a file will leave at least a single character in
-the filename. Filenames suffixed by an alternate data stream can't be
-truncated. This performs a dry run, nothing is modified.
-
-Good truncate_pos 9:    C:\foo\bar  =>  C:\foo\ba
-Good truncate_pos 6:    C:\foo      =>  C:\foo
-Good truncate_pos 5:    C:\foo      =>  C:\fo
-Bad* truncate_pos 5:    C:foo       =>  C:foo
-Bad truncate_pos 5:     C:\foo:ads  =>  C:\fo
-Bad truncate_pos 9:     C:\foo:ads  =>  C:\foo:ad
-Bad truncate_pos 5:     C:\foo\bar  =>  C:\fo
-Bad truncate_pos 5:     C:\foo\     =>  C:\fo
-Bad truncate_pos 7:     C:\foo\     =>  C:\foo\
-Error truncate_pos 7:   C:\foo      =>  (pos out of range)
-Bad truncate_pos 1:     C:\foo\     =>  C
-
-* C:foo is ambiguous, C could end up being a drive or file therefore something
-  like C:superlongfilename can't be truncated.
-
-Returns
-SANITIZE_ERR_OK: Good -- 'path' can be truncated
-SANITIZE_ERR_INVALID_PATH: Bad -- 'path' cannot be truncated
-!= SANITIZE_ERR_OK && != SANITIZE_ERR_INVALID_PATH: Error
-*/
-SANITIZEcode truncate_dryrun(const char *path, const size_t truncate_pos)
+ * Test if truncating a path to a file leaves at least a single character
+ * in the filename. Filenames suffixed by an alternate data stream cannot be
+ * truncated. This performs a dry run, nothing is modified.
+ *
+ * Good truncate_pos 9:    C:\foo\bar  =>  C:\foo\ba
+ * Good truncate_pos 6:    C:\foo      =>  C:\foo
+ * Good truncate_pos 5:    C:\foo      =>  C:\fo
+ * Bad* truncate_pos 5:    C:foo       =>  C:foo
+ * Bad truncate_pos 5:     C:\foo:ads  =>  C:\fo
+ * Bad truncate_pos 9:     C:\foo:ads  =>  C:\foo:ad
+ * Bad truncate_pos 5:     C:\foo\bar  =>  C:\fo
+ * Bad truncate_pos 5:     C:\foo\     =>  C:\fo
+ * Bad truncate_pos 7:     C:\foo\     =>  C:\foo\
+ * Error truncate_pos 7:   C:\foo      =>  (pos out of range)
+ * Bad truncate_pos 1:     C:\foo\     =>  C
+ *
+ * * C:foo is ambiguous, C could end up being a drive or file therefore
+ *   something like C:superlongfilename cannot be truncated.
+ *
+ * Returns
+ * SANITIZE_ERR_OK: Good -- 'path' can be truncated
+ * SANITIZE_ERR_INVALID_PATH: Bad -- 'path' cannot be truncated
+ * != SANITIZE_ERR_OK && != SANITIZE_ERR_INVALID_PATH: Error
+ */
+static SANITIZEcode truncate_dryrun(const char *path,
+                                    const size_t truncate_pos)
 {
   size_t len;
 
@@ -278,7 +111,7 @@ SANITIZEcode truncate_dryrun(const char *path, const size_t truncate_pos)
   if(strpbrk(&path[truncate_pos - 1], "\\/:"))
     return SANITIZE_ERR_INVALID_PATH;
 
-  /* C:\foo can be truncated but C:\foo:ads can't */
+  /* C:\foo can be truncated but C:\foo:ads cannot */
   if(truncate_pos > 1) {
     const char *p = &path[truncate_pos - 1];
     do {
@@ -291,36 +124,31 @@ SANITIZEcode truncate_dryrun(const char *path, const size_t truncate_pos)
   return SANITIZE_ERR_OK;
 }
 
-/* The functions msdosify, rename_if_dos_device_name and __crt0_glob_function
- * were taken with modification from the DJGPP port of tar 1.12. They use
- * algorithms originally from DJTAR.
- */
-
 /*
-Extra sanitization MSDOS for file_name.
-
-This is a supporting function for sanitize_file_name.
-
-Warning: This is an MSDOS legacy function and was purposely written in a way
-that some path information may pass through. For example drive letter names
-(C:, D:, etc) are allowed to pass through. For sanitizing a filename use
-sanitize_file_name.
-
-Success: (SANITIZE_ERR_OK) *sanitized points to a sanitized copy of file_name.
-Failure: (!= SANITIZE_ERR_OK) *sanitized is NULL.
-*/
-#if defined(MSDOS) || defined(UNITTESTS)
-SANITIZEcode msdosify(char **const sanitized, const char *file_name,
-                      int flags)
+ * Extra sanitization MS-DOS for file_name.
+ *
+ * This is a supporting function for sanitize_file_name.
+ *
+ * Warning: This is an MS-DOS legacy function and was purposely written in
+ * a way that some path information may pass through. For example drive letter
+ * names (C:, D:, etc) are allowed to pass through. For sanitizing a filename
+ * use sanitize_file_name.
+ *
+ * Success: SANITIZE_ERR_OK *sanitized points to a sanitized copy of file_name.
+ * Failure: != SANITIZE_ERR_OK *sanitized is NULL.
+ */
+static SANITIZEcode msdosify(char ** const sanitized, const char *file_name,
+                             int flags)
 {
   char dos_name[PATH_MAX];
-  static const char illegal_chars_dos[] = ".+, ;=[]" /* illegal in DOS */
+  static const char illegal_chars_dos[] =
+    ".+, ;=[]"     /* illegal in DOS */
     "|<>/\\\":?*"; /* illegal in DOS & W95 */
   static const char *illegal_chars_w95 = &illegal_chars_dos[8];
   int idx, dot_idx;
   const char *s = file_name;
   char *d = dos_name;
-  const char *const dlimit = dos_name + sizeof(dos_name) - 1;
+  const char * const dlimit = dos_name + sizeof(dos_name) - 1;
   const char *illegal_aliens = illegal_chars_dos;
   size_t len = sizeof(illegal_chars_dos) - 1;
 
@@ -332,13 +160,11 @@ SANITIZEcode msdosify(char **const sanitized, const char *file_name,
   if(!file_name)
     return SANITIZE_ERR_BAD_ARGUMENT;
 
-  if(strlen(file_name) > PATH_MAX-1 &&
-     (!(flags & SANITIZE_ALLOW_TRUNCATE) ||
-      truncate_dryrun(file_name, PATH_MAX-1)))
+  if(strlen(file_name) > PATH_MAX - 1)
     return SANITIZE_ERR_INVALID_PATH;
 
   /* Support for Windows 9X VFAT systems, when available. */
-  if(_use_lfn(file_name)) {
+  if(CURL_USE_LFN(file_name)) {
     illegal_aliens = illegal_chars_w95;
     len -= (illegal_chars_w95 - illegal_chars_dos);
   }
@@ -346,27 +172,28 @@ SANITIZEcode msdosify(char **const sanitized, const char *file_name,
   /* Get past the drive letter, if any. */
   if(s[0] >= 'A' && s[0] <= 'z' && s[1] == ':') {
     *d++ = *s++;
-    *d = ((flags & (SANITIZE_ALLOW_COLONS|SANITIZE_ALLOW_PATH))) ? ':' : '_';
-    ++d, ++s;
+    *d = (flags & SANITIZE_ALLOW_PATH) ? ':' : '_';
+    ++d;
+    ++s;
   }
 
   for(idx = 0, dot_idx = -1; *s && d < dlimit; s++, d++) {
     if(memchr(illegal_aliens, *s, len)) {
 
-      if((flags & (SANITIZE_ALLOW_COLONS|SANITIZE_ALLOW_PATH)) && *s == ':')
+      if((flags & SANITIZE_ALLOW_PATH) && *s == ':')
         *d = ':';
       else if((flags & SANITIZE_ALLOW_PATH) && (*s == '/' || *s == '\\'))
         *d = *s;
-      /* Dots are special: DOS doesn't allow them as the leading character,
-         and a file name cannot have more than a single dot.  We leave the
+      /* Dots are special: DOS does not allow them as the leading character,
+         and a filename cannot have more than a single dot. We leave the
          first non-leading dot alone, unless it comes too close to the
          beginning of the name: we want sh.lex.c to become sh_lex.c, not
-         sh.lex-c.  */
+         sh.lex-c. */
       else if(*s == '.') {
         if((flags & SANITIZE_ALLOW_PATH) && idx == 0 &&
            (s[1] == '/' || s[1] == '\\' ||
             (s[1] == '.' && (s[2] == '/' || s[2] == '\\')))) {
-          /* Copy "./" and "../" verbatim.  */
+          /* Copy "./" and "../" verbatim. */
           *d++ = *s++;
           if(d == dlimit)
             break;
@@ -398,15 +225,15 @@ SANITIZEcode msdosify(char **const sanitized, const char *file_name,
           *d++ = 'x';
           if(d == dlimit)
             break;
-          *d   = 'x';
+          *d = 'x';
         }
         else {
-          /* libg++ etc.  */
+          /* libg++ etc. */
           if(dlimit - d < 4) {
             *d++ = 'x';
             if(d == dlimit)
               break;
-            *d   = 'x';
+            *d = 'x';
           }
           else {
             memcpy(d, "plus", 4);
@@ -434,78 +261,76 @@ SANITIZEcode msdosify(char **const sanitized, const char *file_name,
     /* dos_name is truncated, check that truncation requirements are met,
        specifically truncating a filename suffixed by an alternate data stream
        or truncating the entire filename is not allowed. */
-    if(!(flags & SANITIZE_ALLOW_TRUNCATE) || strpbrk(s, "\\/:") ||
-       truncate_dryrun(dos_name, d - dos_name))
+    if(strpbrk(s, "\\/:") || truncate_dryrun(dos_name, d - dos_name))
       return SANITIZE_ERR_INVALID_PATH;
   }
 
-  *sanitized = strdup(dos_name);
-  return (*sanitized ? SANITIZE_ERR_OK : SANITIZE_ERR_OUT_OF_MEMORY);
+  *sanitized = curlx_strdup(dos_name);
+  return *sanitized ? SANITIZE_ERR_OK : SANITIZE_ERR_OUT_OF_MEMORY;
 }
-#endif /* MSDOS || UNITTESTS */
+#endif /* MSDOS */
 
 /*
-Rename file_name if it's a reserved dos device name.
-
-This is a supporting function for sanitize_file_name.
-
-Warning: This is an MSDOS legacy function and was purposely written in a way
-that some path information may pass through. For example drive letter names
-(C:, D:, etc) are allowed to pass through. For sanitizing a filename use
-sanitize_file_name.
-
-Success: (SANITIZE_ERR_OK) *sanitized points to a sanitized copy of file_name.
-Failure: (!= SANITIZE_ERR_OK) *sanitized is NULL.
-*/
-SANITIZEcode rename_if_reserved_dos_device_name(char **const sanitized,
-                                                const char *file_name,
-                                                int flags)
+ * Rename file_name if it is a reserved dos device name.
+ *
+ * This is a supporting function for sanitize_file_name.
+ *
+ * Warning: This is an MS-DOS legacy function and was purposely written in
+ * a way that some path information may pass through. For example drive letter
+ * names (C:, D:, etc) are allowed to pass through. For sanitizing a filename
+ * use sanitize_file_name.
+ *
+ * Success: SANITIZE_ERR_OK *sanitized points to a sanitized copy of file_name.
+ * Failure: != SANITIZE_ERR_OK *sanitized is NULL.
+ */
+static SANITIZEcode rename_if_reserved_dos(char ** const sanitized,
+                                           const char *file_name,
+                                           int flags)
 {
-  /* We could have a file whose name is a device on MS-DOS.  Trying to
-   * retrieve such a file would fail at best and wedge us at worst.  We need
-   * to rename such files. */
-  char *p, *base;
-  char fname[PATH_MAX];
+  /* We could have a file whose name is a device on MS-DOS. Trying to
+     retrieve such a file would fail at best and wedge us at worst. We need
+     to rename such files. */
+  char *p, *base, *buffer;
 #ifdef MSDOS
-  struct_stat st_buf;
+  curlx_struct_stat st_buf;
 #endif
+  size_t len, bufsize;
 
-  if(!sanitized)
+  if(!sanitized || !file_name)
     return SANITIZE_ERR_BAD_ARGUMENT;
 
   *sanitized = NULL;
 
-  if(!file_name)
-    return SANITIZE_ERR_BAD_ARGUMENT;
-
-  /* Ignore UNC prefixed paths, they are allowed to contain a reserved name. */
+  /* Ignore "\\" prefixed paths, they are allowed to use reserved names. */
 #ifndef MSDOS
   if((flags & SANITIZE_ALLOW_PATH) &&
      file_name[0] == '\\' && file_name[1] == '\\') {
-    size_t len = strlen(file_name);
-    *sanitized = malloc(len + 1);
+    *sanitized = curlx_strdup(file_name);
     if(!*sanitized)
       return SANITIZE_ERR_OUT_OF_MEMORY;
-    strncpy(*sanitized, file_name, len + 1);
     return SANITIZE_ERR_OK;
   }
 #endif
 
-  if(strlen(file_name) > PATH_MAX-1 &&
-     (!(flags & SANITIZE_ALLOW_TRUNCATE) ||
-      truncate_dryrun(file_name, PATH_MAX-1)))
-    return SANITIZE_ERR_INVALID_PATH;
+  /* The buffer contains two extra bytes to allow for path expansion that
+     occurs if reserved name(s) need an underscore prepended. */
+  len = strlen(file_name);
+  bufsize = len + 2 + 1;
 
-  strncpy(fname, file_name, PATH_MAX-1);
-  fname[PATH_MAX-1] = '\0';
-  base = basename(fname);
+  buffer = curlx_malloc(bufsize);
+  if(!buffer)
+    return SANITIZE_ERR_OUT_OF_MEMORY;
+
+  memcpy(buffer, file_name, len + 1);
+
+  base = curlx_basename(buffer);
 
   /* Rename reserved device names that are known to be accessible without \\.\
      Examples: CON => _CON, CON.EXT => CON_EXT, CON:ADS => CON_ADS
-     https://support.microsoft.com/en-us/kb/74496
-     https://msdn.microsoft.com/en-us/library/windows/desktop/aa365247.aspx
-     */
-  for(p = fname; p; p = (p == fname && fname != base ? base : NULL)) {
+     https://web.archive.org/web/20160314141551/support.microsoft.com/en-us/kb/74496
+     https://learn.microsoft.com/windows/win32/fileio/naming-a-file
+   */
+  for(p = buffer; p; p = (p == buffer && buffer != base ? base : NULL)) {
     size_t p_len;
     int x = (curl_strnequal(p, "CON", 3) ||
              curl_strnequal(p, "PRN", 3) ||
@@ -529,7 +354,7 @@ SANITIZEcode rename_if_reserved_dos_device_name(char **const sanitized,
       continue;
     }
     else if(p[x] == ':') {
-      if(!(flags & (SANITIZE_ALLOW_COLONS|SANITIZE_ALLOW_PATH))) {
+      if(!(flags & SANITIZE_ALLOW_PATH)) {
         p[x] = '_';
         continue;
       }
@@ -542,122 +367,222 @@ SANITIZEcode rename_if_reserved_dos_device_name(char **const sanitized,
     p_len = strlen(p);
 
     /* Prepend a '_' */
-    if(strlen(fname) == PATH_MAX-1) {
-      --p_len;
-      if(!(flags & SANITIZE_ALLOW_TRUNCATE) || truncate_dryrun(p, p_len))
-        return SANITIZE_ERR_INVALID_PATH;
-      p[p_len] = '\0';
-    }
     memmove(p + 1, p, p_len + 1);
     p[0] = '_';
     ++p_len;
+    ++len;
 
-    /* if fname was just modified then the basename pointer must be updated */
-    if(p == fname)
-      base = basename(fname);
+    /* the basename pointer must be updated since the path has expanded */
+    if(p == buffer)
+      base = curlx_basename(buffer);
   }
 
   /* This is the legacy portion from rename_if_dos_device_name that checks for
-     reserved device names. It only works on MSDOS. On Windows XP the stat
+     reserved device names. It only works on MS-DOS. On Windows XP the stat
      check errors with EINVAL if the device name is reserved. On Windows
-     Vista/7/8 it sets mode S_IFREG (regular file or device). According to MSDN
-     stat doc the latter behavior is correct, but that doesn't help us identify
-     whether it's a reserved device name and not a regular file name. */
+     Vista/7/8 it sets mode S_IFREG (regular file or device). According to
+     MSDN stat doc the latter behavior is correct, but that does not help us
+     identify whether it is a reserved device name and not a regular
+     filename. */
 #ifdef MSDOS
-  if(base && ((stat(base, &st_buf)) == 0) && (S_ISCHR(st_buf.st_mode))) {
+  if(base && (curlx_stat(base, &st_buf) == 0) && S_ISCHR(st_buf.st_mode)) {
     /* Prepend a '_' */
     size_t blen = strlen(base);
     if(blen) {
-      if(strlen(fname) == PATH_MAX-1) {
-        --blen;
-        if(!(flags & SANITIZE_ALLOW_TRUNCATE) || truncate_dryrun(base, blen))
-          return SANITIZE_ERR_INVALID_PATH;
-        base[blen] = '\0';
+      if(len == bufsize - 1) {
+        curlx_free(buffer);
+        return SANITIZE_ERR_INVALID_PATH;
       }
       memmove(base + 1, base, blen + 1);
       base[0] = '_';
+      ++len;
     }
   }
 #endif
 
-  *sanitized = strdup(fname);
-  return (*sanitized ? SANITIZE_ERR_OK : SANITIZE_ERR_OUT_OF_MEMORY);
+  *sanitized = buffer;
+  return SANITIZE_ERR_OK;
 }
 
-#if defined(MSDOS) && (defined(__DJGPP__) || defined(__GO32__))
-
 /*
- * Disable program default argument globbing. We do it on our own.
+ * Sanitize a file or path name.
+ *
+ * All banned characters are replaced by underscores, for example:
+ * f?*foo => f__foo
+ * f:foo::$DATA => f_foo__$DATA
+ * f:\foo:bar => f__foo_bar
+ * f:\foo:bar => f:\foo:bar   (flag SANITIZE_ALLOW_PATH)
+ *
+ * This function was implemented according to the guidelines in 'Naming Files,
+ * Paths, and Namespaces' section 'Naming Conventions'.
+ * https://learn.microsoft.com/windows/win32/fileio/naming-a-file
+ *
+ * Flags
+ * -----
+ * SANITIZE_ALLOW_PATH:       Allow path separators and colons.
+ * Without this flag path separators and colons are sanitized.
+ *
+ * SANITIZE_ALLOW_RESERVED:   Allow reserved device names.
+ * Without this flag a reserved device name is renamed (COM1 => _COM1).
+ *
+ * To fully block reserved device names requires not passing either flag.
+ * Some less common path styles are allowed to use reserved device names.
+ * For example, a "\\" prefixed path may use reserved device names if paths
+ * are allowed.
+ *
+ * Success: SANITIZE_ERR_OK *sanitized points to a sanitized copy of file_name.
+ * Failure: != SANITIZE_ERR_OK *sanitized is NULL.
  */
-char **__crt0_glob_function(char *arg)
+SANITIZEcode sanitize_file_name(char ** const sanitized, const char *file_name,
+                                int flags)
 {
-  (void)arg;
-  return (char **)0;
+  char *p, *target;
+  size_t len;
+  SANITIZEcode sc;
+
+  if(!sanitized)
+    return SANITIZE_ERR_BAD_ARGUMENT;
+
+  *sanitized = NULL;
+
+  if(!file_name)
+    return SANITIZE_ERR_BAD_ARGUMENT;
+
+  len = strlen(file_name);
+
+  target = curlx_strdup(file_name);
+  if(!target)
+    return SANITIZE_ERR_OUT_OF_MEMORY;
+
+#ifndef MSDOS
+  if((flags & SANITIZE_ALLOW_PATH) && !strncmp(target, "\\\\?\\", 4))
+    /* Skip the literal-path prefix \\?\ */
+    p = target + 4;
+  else
+#endif
+    p = target;
+
+  /* replace control characters and other banned characters */
+  for(; *p; ++p) {
+    const char *banned;
+
+    if((1 <= *p && *p <= 31) ||
+       (!(flags & SANITIZE_ALLOW_PATH) && *p == ':') ||
+       (!(flags & SANITIZE_ALLOW_PATH) && (*p == '/' || *p == '\\'))) {
+      *p = '_';
+      continue;
+    }
+
+    for(banned = "|<>\"?*"; *banned; ++banned) {
+      if(*p == *banned) {
+        *p = '_';
+        break;
+      }
+    }
+  }
+
+  /* remove trailing spaces and periods if not allowing paths */
+  if(!(flags & SANITIZE_ALLOW_PATH) && len) {
+    char *clip = NULL;
+
+    p = &target[len];
+    do {
+      --p;
+      if(*p != ' ' && *p != '.')
+        break;
+      clip = p;
+    } while(p != target);
+
+    if(clip) {
+      *clip = '\0';
+    }
+  }
+
+#ifdef MSDOS
+  sc = msdosify(&p, target, flags);
+  curlx_free(target);
+  if(sc)
+    return sc;
+  target = p;
+#endif
+
+  if(!(flags & SANITIZE_ALLOW_RESERVED)) {
+    sc = rename_if_reserved_dos(&p, target, flags);
+    curlx_free(target);
+    if(sc)
+      return sc;
+    target = p;
+  }
+
+#ifdef DEBUGBUILD
+  if(getenv("CURL_FN_SANITIZE_BAD")) {
+    curlx_free(target);
+    return SANITIZE_ERR_INVALID_PATH;
+  }
+  if(getenv("CURL_FN_SANITIZE_OOM")) {
+    curlx_free(target);
+    return SANITIZE_ERR_OUT_OF_MEMORY;
+  }
+#endif
+
+  *sanitized = target;
+  return SANITIZE_ERR_OK;
 }
 
-#endif /* MSDOS && (__DJGPP__ || __GO32__) */
+#ifdef _WIN32
 
-#ifdef WIN32
-
-/*
+#if !defined(CURL_WINDOWS_UWP) && \
+  !defined(CURL_DISABLE_CA_SEARCH) && !defined(CURL_CA_SEARCH_SAFE)
+/* Search and set the CA cert file for Windows.
+ *
+ * Do not call this function if Schannel is the selected SSL backend. We allow
+ * setting CA location for Schannel only when explicitly specified by the user
+ * via CURLOPT_CAINFO / --cacert.
+ *
  * Function to find CACert bundle on a Win32 platform using SearchPath.
  * (SearchPath is already declared via inclusions done in setup header file)
- * (Use the ASCII version instead of the unicode one!)
+ * (Use the ASCII version instead of the Unicode one!)
  * The order of the directories it searches is:
  *  1. application's directory
  *  2. current working directory
- *  3. Windows System directory (e.g. C:\windows\system32)
- *  4. Windows Directory (e.g. C:\windows)
+ *  3. Windows System directory (e.g. C:\Windows\System32)
+ *  4. Windows Directory (e.g. C:\Windows)
  *  5. all directories along %PATH%
  *
- * For WinXP and later search order actually depends on registry value:
+ * For Windows XP and later search order actually depends on registry value:
  * HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeProcessSearchMode
  */
-
 CURLcode FindWin32CACert(struct OperationConfig *config,
-                         curl_sslbackend backend,
                          const TCHAR *bundle_file)
 {
   CURLcode result = CURLE_OK;
+  DWORD res_len;
+  TCHAR buf[MAX_PATH];
+  TCHAR *ptr = NULL;
 
-  /* Search and set cert file only if libcurl supports SSL.
-   *
-   * If Schannel is the selected SSL backend then these locations are
-   * ignored. We allow setting CA location for schannel only when explicitly
-   * specified by the user via CURLOPT_CAINFO / --cacert.
-   */
-  if(feature_ssl && backend != CURLSSLBACKEND_SCHANNEL) {
+  buf[0] = TEXT('\0');
 
-    DWORD res_len;
-    TCHAR buf[PATH_MAX];
-    TCHAR *ptr = NULL;
-
-    buf[0] = TEXT('\0');
-
-    res_len = SearchPath(NULL, bundle_file, NULL, PATH_MAX, buf, &ptr);
-    if(res_len > 0) {
-      char *mstr = curlx_convert_tchar_to_UTF8(buf);
-      Curl_safefree(config->cacert);
-      if(mstr)
-        config->cacert = strdup(mstr);
-      curlx_unicodefree(mstr);
-      if(!config->cacert)
-        result = CURLE_OUT_OF_MEMORY;
-    }
+  res_len = SearchPath(NULL, bundle_file, NULL, MAX_PATH, buf, &ptr);
+  if(res_len > 0) {
+    curlx_free(config->cacert);
+    config->cacert = curlx_convert_tchar_to_UTF8(buf);
+    if(!config->cacert)
+      result = CURLE_OUT_OF_MEMORY;
   }
 
   return result;
 }
-
+#endif
 
 /* Get a list of all loaded modules with full paths.
  * Returns slist on success or NULL on error.
  */
 struct curl_slist *GetLoadedModulePaths(void)
 {
-  HANDLE hnd = INVALID_HANDLE_VALUE;
-  MODULEENTRY32 mod = {0};
   struct curl_slist *slist = NULL;
+#ifndef CURL_WINDOWS_UWP
+  HANDLE hnd = INVALID_HANDLE_VALUE;
+  MODULEENTRY32 mod = { 0 };
 
   mod.dwSize = sizeof(MODULEENTRY32);
 
@@ -677,7 +602,7 @@ struct curl_slist *GetLoadedModulePaths(void)
 
 #ifdef UNICODE
     /* sizeof(mod.szExePath) is the max total bytes of wchars. the max total
-       bytes of multibyte chars won't be more than twice that. */
+       bytes of multibyte chars is not more than twice that. */
     char buffer[sizeof(mod.szExePath) * 2];
     if(!WideCharToMultiByte(CP_ACP, 0, mod.szExePath, -1,
                             buffer, sizeof(buffer), NULL, NULL))
@@ -700,9 +625,13 @@ error:
 cleanup:
   if(hnd != INVALID_HANDLE_VALUE)
     CloseHandle(hnd);
+#endif
   return slist;
 }
 
+bool tool_term_has_bold;
+
+#ifndef CURL_WINDOWS_UWP
 /* The terminal settings to restore on exit */
 static struct TerminalSettings {
   HANDLE hStdOut;
@@ -710,6 +639,7 @@ static struct TerminalSettings {
   LONG valid;
 } TerminalSettings;
 
+/* Offered by mingw-w64 v7+, MS SDK 10.0.10586.0/VS2015 Update 1+ */
 #ifndef ENABLE_VIRTUAL_TERMINAL_PROCESSING
 #define ENABLE_VIRTUAL_TERMINAL_PROCESSING 0x0004
 #endif
@@ -733,16 +663,23 @@ static BOOL WINAPI signal_handler(DWORD type)
 static void init_terminal(void)
 {
   TerminalSettings.hStdOut = GetStdHandle(STD_OUTPUT_HANDLE);
+
   /*
    * Enable VT (Virtual Terminal) output.
    * Note: VT mode flag can be set on any version of Windows, but VT
-   * processing only performed on Win10 >= Creators Update)
+   * processing only performed on Win10 >= version 1709 (OS build 16299)
+   * Creator's Update. Also, ANSI bold on/off supported since then.
    */
-  if((TerminalSettings.hStdOut != INVALID_HANDLE_VALUE) &&
-     GetConsoleMode(TerminalSettings.hStdOut,
-                    &TerminalSettings.dwOutputMode) &&
-     !(TerminalSettings.dwOutputMode &
-       ENABLE_VIRTUAL_TERMINAL_PROCESSING)) {
+  if(TerminalSettings.hStdOut == INVALID_HANDLE_VALUE ||
+     !GetConsoleMode(TerminalSettings.hStdOut,
+                     &TerminalSettings.dwOutputMode) ||
+     !curlx_verify_windows_version(10, 0, 16299, PLATFORM_WINNT,
+                                   VERSION_GREATER_THAN_EQUAL))
+    return;
+
+  if((TerminalSettings.dwOutputMode & ENABLE_VIRTUAL_TERMINAL_PROCESSING))
+    tool_term_has_bold = TRUE;
+  else {
     /* The signal handler is set before attempting to change the console mode
        because otherwise a signal would not be caught after the change but
        before the handler was installed. */
@@ -751,6 +688,7 @@ static void init_terminal(void)
       if(SetConsoleMode(TerminalSettings.hStdOut,
                         (TerminalSettings.dwOutputMode |
                          ENABLE_VIRTUAL_TERMINAL_PROCESSING))) {
+        tool_term_has_bold = TRUE;
         atexit(restore_terminal);
       }
       else {
@@ -761,26 +699,220 @@ static void init_terminal(void)
   }
 }
 
-LARGE_INTEGER tool_freq;
-bool tool_isVistaOrGreater;
+#ifdef USE_WINSOCK
+/* The following STDIN non - blocking read techniques are heavily inspired
+   by nmap and ncat (https://nmap.org/ncat/) */
+struct win_thread_data {
+  /* This is a copy of the true stdin file handle before any redirection. It is
+     read by the thread. */
+  HANDLE stdin_handle;
+  /* This is the listen socket for the thread. It is closed after the first
+     connection. */
+  curl_socket_t socket_l;
+};
+
+static DWORD WINAPI win_stdin_thread_func(void *thread_data)
+{
+  struct win_thread_data *tdata = (struct win_thread_data *)thread_data;
+  struct sockaddr_in clientAddr;
+  int clientAddrLen = sizeof(clientAddr);
+
+  curl_socket_t socket_w = CURL_ACCEPT(tdata->socket_l,
+                                       (struct sockaddr *)&clientAddr,
+                                       &clientAddrLen);
+
+  if(socket_w == CURL_SOCKET_BAD) {
+    errorf("accept error: %d", SOCKERRNO);
+    goto ThreadCleanup;
+  }
+
+  sclose(tdata->socket_l);
+  tdata->socket_l = CURL_SOCKET_BAD;
+  if(shutdown(socket_w, SHUT_RD)) {
+    errorf("shutdown error: %d", SOCKERRNO);
+    goto ThreadCleanup;
+  }
+  for(;;) {
+    DWORD n;
+    ssize_t nwritten;
+    char buffer[BUFSIZ];
+
+    if(!ReadFile(tdata->stdin_handle, buffer, sizeof(buffer), &n, NULL))
+      break;
+    if(n == 0)
+      break;
+    nwritten = swrite(socket_w, buffer, n);
+    if(nwritten == -1)
+      break;
+    if((DWORD)nwritten != n)
+      break;
+  }
+ThreadCleanup:
+  CloseHandle(tdata->stdin_handle);
+  tdata->stdin_handle = NULL;
+  if(tdata->socket_l != CURL_SOCKET_BAD) {
+    sclose(tdata->socket_l);
+    tdata->socket_l = CURL_SOCKET_BAD;
+  }
+  if(socket_w != CURL_SOCKET_BAD)
+    sclose(socket_w);
+
+  curlx_free(tdata);
+  return 0;
+}
+
+/* The background thread that reads and buffers the true stdin. */
+curl_socket_t win32_stdin_read_thread(void)
+{
+  int rc = 0;
+  struct win_thread_data *tdata = NULL;
+  static HANDLE stdin_thread = NULL;
+  static curl_socket_t socket_r = CURL_SOCKET_BAD;
+
+  if(socket_r != CURL_SOCKET_BAD) {
+    assert(stdin_thread);
+    return socket_r;
+  }
+  assert(!stdin_thread);
+
+  do {
+    curl_socklen_t socksize = 0;
+    struct sockaddr_in selfaddr;
+
+    /* Prepare handles for thread */
+    tdata = (struct win_thread_data *)
+      curlx_calloc(1, sizeof(struct win_thread_data));
+    if(!tdata) {
+      errorf("curlx_calloc() error");
+      break;
+    }
+    /* Create the listening socket for the thread. When it starts, it accepts
+     * our connection and begin writing STDIN data to the connection. */
+    tdata->socket_l = CURL_SOCKET(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+    if(tdata->socket_l == CURL_SOCKET_BAD) {
+      errorf("socket() error: %d", SOCKERRNO);
+      break;
+    }
+
+    socksize = sizeof(selfaddr);
+    memset(&selfaddr, 0, socksize);
+    selfaddr.sin_family = AF_INET;
+    selfaddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+    /* Bind to any available loopback port */
+    if(bind(tdata->socket_l, (const struct sockaddr *)&selfaddr, socksize)) {
+      errorf("bind error: %d", SOCKERRNO);
+      break;
+    }
+
+    /* Retrieve the assigned loopback port/address */
+    if(getsockname(tdata->socket_l, (struct sockaddr *)&selfaddr, &socksize)) {
+      errorf("getsockname error: %d", SOCKERRNO);
+      break;
+    }
+
+    if(listen(tdata->socket_l, 1)) {
+      errorf("listen error: %d", SOCKERRNO);
+      break;
+    }
+
+    /* Make a copy of the stdin handle to be used by win_stdin_thread_func */
+    if(!DuplicateHandle(GetCurrentProcess(), GetStdHandle(STD_INPUT_HANDLE),
+                        GetCurrentProcess(), &tdata->stdin_handle,
+                        0, FALSE, DUPLICATE_SAME_ACCESS)) {
+      errorf("DuplicateHandle error: 0x%08lx", GetLastError());
+      break;
+    }
+
+    /* Start up the thread. We do not bother keeping a reference to it
+       because it runs until program termination. From here on out all reads
+       from the stdin handle or file descriptor 0 is reading from the
+       socket that is fed by the thread. */
+    stdin_thread = CreateThread(NULL, 0, win_stdin_thread_func,
+                                tdata, 0, NULL);
+    if(!stdin_thread) {
+      errorf("CreateThread error: 0x%08lx", GetLastError());
+      break;
+    }
+    tdata = NULL; /* win_stdin_thread_func owns it now */
+
+    /* Connect to the thread and rearrange our own STDIN handles */
+    socket_r = CURL_SOCKET(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+    if(socket_r == CURL_SOCKET_BAD) {
+      errorf("socket error: %d", SOCKERRNO);
+      break;
+    }
+
+    /* Hard close the socket on closesocket() */
+    setsockopt(socket_r, SOL_SOCKET, SO_DONTLINGER, 0, 0);
+
+    if(connect(socket_r, (const struct sockaddr *)&selfaddr, socksize)) {
+      errorf("connect error: %d", SOCKERRNO);
+      break;
+    }
+
+    if(shutdown(socket_r, SHUT_WR)) {
+      errorf("shutdown error: %d", SOCKERRNO);
+      break;
+    }
+
+    /* Set the stdin handle to read from the socket. */
+    if(SetStdHandle(STD_INPUT_HANDLE, (HANDLE)socket_r) == 0) {
+      errorf("SetStdHandle error: 0x%08lx", GetLastError());
+      break;
+    }
+
+    rc = 1;
+  } while(0);
+
+  if(rc != 1) {
+    if(socket_r != CURL_SOCKET_BAD && tdata) {
+      if(GetStdHandle(STD_INPUT_HANDLE) == (HANDLE)socket_r &&
+         tdata->stdin_handle) {
+        /* restore STDIN */
+        SetStdHandle(STD_INPUT_HANDLE, tdata->stdin_handle);
+        tdata->stdin_handle = NULL;
+      }
+
+      sclose(socket_r);
+      socket_r = CURL_SOCKET_BAD;
+    }
+
+    if(stdin_thread) {
+      TerminateThread(stdin_thread, 1);
+      CloseHandle(stdin_thread);
+      stdin_thread = NULL;
+    }
+
+    if(tdata) {
+      if(tdata->stdin_handle)
+        CloseHandle(tdata->stdin_handle);
+      if(tdata->socket_l != CURL_SOCKET_BAD)
+        sclose(tdata->socket_l);
+
+      curlx_free(tdata);
+    }
+
+    return CURL_SOCKET_BAD;
+  }
+
+  assert(socket_r != CURL_SOCKET_BAD);
+  return socket_r;
+}
+#endif /* USE_WINSOCK */
+
+#endif /* !CURL_WINDOWS_UWP */
 
 CURLcode win32_init(void)
 {
-  /* curlx_verify_windows_version must be called during init at least once
-     because it has its own initialization routine. */
-  if(curlx_verify_windows_version(6, 0, 0, PLATFORM_WINNT,
-                                  VERSION_GREATER_THAN_EQUAL))
-    tool_isVistaOrGreater = true;
-  else
-    tool_isVistaOrGreater = false;
-
-  QueryPerformanceFrequency(&tool_freq);
-
+  curlx_verify_windows_init();
+  curlx_now_init();
+#ifndef CURL_WINDOWS_UWP
   init_terminal();
+#endif
 
   return CURLE_OK;
 }
 
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
-#endif /* MSDOS || WIN32 */
+#endif /* _WIN32 || MSDOS */
diff --git a/third-party/curl/src/tool_doswin.h b/third-party/curl/src/tool_doswin.h
index 669fdb6ed5..821a2dbb67 100644
--- a/third-party/curl/src/tool_doswin.h
+++ b/third-party/curl/src/tool_doswin.h
@@ -25,48 +25,34 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#if defined(MSDOS) || defined(WIN32)
+#if defined(_WIN32) || defined(MSDOS)
 
-#define SANITIZE_ALLOW_COLONS    (1<<0)  /* Allow colons */
-#define SANITIZE_ALLOW_PATH      (1<<1)  /* Allow path separators and colons */
-#define SANITIZE_ALLOW_RESERVED  (1<<2)  /* Allow reserved device names */
-#define SANITIZE_ALLOW_TRUNCATE  (1<<3)  /* Allow truncating a long filename */
+#define SANITIZE_ALLOW_PATH     (1 << 1) /* Allow path separators and colons */
+#define SANITIZE_ALLOW_RESERVED (1 << 2) /* Allow reserved device names */
 
-typedef enum {
-  SANITIZE_ERR_OK = 0,           /* 0 - OK */
-  SANITIZE_ERR_INVALID_PATH,     /* 1 - the path is invalid */
-  SANITIZE_ERR_BAD_ARGUMENT,     /* 2 - bad function parameter */
-  SANITIZE_ERR_OUT_OF_MEMORY,    /* 3 - out of memory */
-  SANITIZE_ERR_LAST /* never use! */
-} SANITIZEcode;
-
-SANITIZEcode sanitize_file_name(char **const sanitized, const char *file_name,
+SANITIZEcode sanitize_file_name(char ** const sanitized, const char *file_name,
                                 int flags);
-#ifdef UNITTESTS
-SANITIZEcode truncate_dryrun(const char *path, const size_t truncate_pos);
-SANITIZEcode msdosify(char **const sanitized, const char *file_name,
-                      int flags);
-SANITIZEcode rename_if_reserved_dos_device_name(char **const sanitized,
-                                                const char *file_name,
-                                                int flags);
-#endif /* UNITTESTS */
-
-#if defined(MSDOS) && (defined(__DJGPP__) || defined(__GO32__))
 
+#ifdef __DJGPP__
 char **__crt0_glob_function(char *arg);
+#endif
 
-#endif /* MSDOS && (__DJGPP__ || __GO32__) */
-
-#ifdef WIN32
+#ifdef _WIN32
 
+#if !defined(CURL_WINDOWS_UWP) && \
+  !defined(CURL_DISABLE_CA_SEARCH) && !defined(CURL_CA_SEARCH_SAFE)
 CURLcode FindWin32CACert(struct OperationConfig *config,
-                         curl_sslbackend backend,
                          const TCHAR *bundle_file);
+#endif
 struct curl_slist *GetLoadedModulePaths(void);
 CURLcode win32_init(void);
 
-#endif /* WIN32 */
+#ifndef CURL_WINDOWS_UWP
+curl_socket_t win32_stdin_read_thread(void);
+#endif
 
-#endif /* MSDOS || WIN32 */
+#endif /* _WIN32 */
+
+#endif /* _WIN32 || MSDOS */
 
 #endif /* HEADER_CURL_TOOL_DOSWIN_H */
diff --git a/third-party/curl/src/tool_easysrc.c b/third-party/curl/src/tool_easysrc.c
index 6ef2be721c..5b3c6cb45b 100644
--- a/third-party/curl/src/tool_easysrc.c
+++ b/third-party/curl/src/tool_easysrc.c
@@ -27,27 +27,21 @@
 
 #ifndef CURL_DISABLE_LIBCURL_OPTION
 
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
-
 #include "tool_cfgable.h"
 #include "tool_easysrc.h"
 #include "tool_msgs.h"
 
-#include "memdebug.h" /* keep this as LAST include */
-
 /* global variable definitions, for easy-interface source code generation */
 
-struct slist_wc *easysrc_decl = NULL; /* Variable declarations */
-struct slist_wc *easysrc_data = NULL; /* Build slists, forms etc. */
-struct slist_wc *easysrc_code = NULL; /* Setopt calls */
-struct slist_wc *easysrc_toohard = NULL; /* Unconvertible setopt */
-struct slist_wc *easysrc_clean = NULL;  /* Clean up allocated data */
-int easysrc_mime_count = 0;
-int easysrc_slist_count = 0;
+struct slist_wc *easysrc_decl; /* Variable declarations */
+struct slist_wc *easysrc_data; /* Build slists, forms etc. */
+struct slist_wc *easysrc_code; /* Setopt calls */
+struct slist_wc *easysrc_toohard; /* Unconvertible setopt */
+struct slist_wc *easysrc_clean;  /* Clean up allocated data */
+int easysrc_mime_count;
+int easysrc_slist_count;
 
-static const char *const srchead[]={
+static const char * const srchead[] = {
   "/********* Sample code generated by the curl command line tool **********",
   " * All curl_easy_setopt() options are documented at:",
   " * https://curl.se/libcurl/c/curl_easy_setopt.html",
@@ -56,23 +50,23 @@ static const char *const srchead[]={
   "",
   "int main(int argc, char *argv[])",
   "{",
-  "  CURLcode ret;",
-  "  CURL *hnd;",
+  "  CURLcode result;",
+  "  CURL *curl;",
   NULL
 };
 /* easysrc_decl declarations come here */
 /* easysrc_data initialization come here */
 /* easysrc_code statements come here */
-static const char *const srchard[]={
+static const char * const srchard[] = {
   "/* Here is a list of options the curl code used that cannot get generated",
   "   as source easily. You may choose to either not use them or implement",
   "   them yourself.",
   "",
   NULL
 };
-static const char *const srcend[]={
+static const char *const srcend[] = {
   "",
-  "  return (int)ret;",
+  "  return (int)result;",
   "}",
   "/**** End of sample code ****/",
   NULL
@@ -96,140 +90,142 @@ static void easysrc_free(void)
 /* Add a source line to the main code or remarks */
 CURLcode easysrc_add(struct slist_wc **plist, const char *line)
 {
-  CURLcode ret = CURLE_OK;
+  CURLcode result = CURLE_OK;
   struct slist_wc *list = slist_wc_append(*plist, line);
   if(!list) {
     easysrc_free();
-    ret = CURLE_OUT_OF_MEMORY;
+    result = CURLE_OUT_OF_MEMORY;
   }
   else
     *plist = list;
-  return ret;
+  return result;
 }
 
 CURLcode easysrc_addf(struct slist_wc **plist, const char *fmt, ...)
 {
-  CURLcode ret;
+  CURLcode result;
   char *bufp;
   va_list ap;
   va_start(ap, fmt);
-  bufp = curlx_mvaprintf(fmt, ap);
+  bufp = curl_mvaprintf(fmt, ap);
   va_end(ap);
   if(!bufp) {
-    ret = CURLE_OUT_OF_MEMORY;
+    result = CURLE_OUT_OF_MEMORY;
   }
   else {
-    ret = easysrc_add(plist, bufp);
+    result = easysrc_add(plist, bufp);
     curl_free(bufp);
   }
-  return ret;
+  return result;
 }
 
-#define CHKRET(v) do {CURLcode ret = (v); if(ret) return ret;} while(0)
-
 CURLcode easysrc_init(void)
 {
-  CHKRET(easysrc_add(&easysrc_code,
-                     "hnd = curl_easy_init();"));
-  return CURLE_OK;
+  return easysrc_add(&easysrc_code, "curl = curl_easy_init();");
 }
 
 CURLcode easysrc_perform(void)
 {
+  CURLcode result = CURLE_OK;
   /* Note any setopt calls which we could not convert */
   if(easysrc_toohard) {
     int i;
     struct curl_slist *ptr;
-    const char *c;
-    CHKRET(easysrc_add(&easysrc_code, ""));
+    result = easysrc_add(&easysrc_code, "");
     /* Preamble comment */
-    for(i = 0; ((c = srchard[i]) != NULL); i++)
-      CHKRET(easysrc_add(&easysrc_code, c));
+    for(i = 0; srchard[i] && !result; i++)
+      result = easysrc_add(&easysrc_code, srchard[i]);
     /* Each unconverted option */
-    if(easysrc_toohard) {
-      for(ptr = easysrc_toohard->first; ptr; ptr = ptr->next)
-        CHKRET(easysrc_add(&easysrc_code, ptr->data));
+    if(easysrc_toohard && !result) {
+      for(ptr = easysrc_toohard->first; ptr && !result; ptr = ptr->next)
+        result = easysrc_add(&easysrc_code, ptr->data);
     }
-    CHKRET(easysrc_add(&easysrc_code, ""));
-    CHKRET(easysrc_add(&easysrc_code, "*/"));
+    if(!result)
+      result = easysrc_add(&easysrc_code, "");
+    if(!result)
+      result = easysrc_add(&easysrc_code, "*/");
 
     slist_wc_free_all(easysrc_toohard);
     easysrc_toohard = NULL;
   }
 
-  CHKRET(easysrc_add(&easysrc_code, ""));
-  CHKRET(easysrc_add(&easysrc_code, "ret = curl_easy_perform(hnd);"));
-  CHKRET(easysrc_add(&easysrc_code, ""));
+  if(!result)
+    result = easysrc_add(&easysrc_code, "");
+  if(!result)
+    result = easysrc_add(&easysrc_code, "result = curl_easy_perform(curl);");
+  if(!result)
+    result = easysrc_add(&easysrc_code, "");
 
-  return CURLE_OK;
+  return result;
 }
 
 CURLcode easysrc_cleanup(void)
 {
-  CHKRET(easysrc_add(&easysrc_code, "curl_easy_cleanup(hnd);"));
-  CHKRET(easysrc_add(&easysrc_code, "hnd = NULL;"));
+  CURLcode result = easysrc_add(&easysrc_code, "curl_easy_cleanup(curl);");
+  if(!result)
+    result = easysrc_add(&easysrc_code, "curl = NULL;");
 
-  return CURLE_OK;
+  return result;
 }
 
-void dumpeasysrc(struct GlobalConfig *config)
+void dumpeasysrc(void)
 {
   struct curl_slist *ptr;
-  char *o = config->libcurl;
+  char *o = global->libcurl;
 
   FILE *out;
   bool fopened = FALSE;
   if(strcmp(o, "-")) {
-    out = fopen(o, FOPEN_WRITETEXT);
+    out = curlx_fopen(o, FOPEN_WRITETEXT);
     fopened = TRUE;
   }
   else
     out = stdout;
   if(!out)
-    warnf(config, "Failed to open %s to write libcurl code", o);
+    warnf("Failed to open %s to write libcurl code", o);
   else {
     int i;
     const char *c;
 
     for(i = 0; ((c = srchead[i]) != NULL); i++)
-      fprintf(out, "%s\n", c);
+      curl_mfprintf(out, "%s\n", c);
 
     /* Declare variables used for complex setopt values */
     if(easysrc_decl) {
       for(ptr = easysrc_decl->first; ptr; ptr = ptr->next)
-        fprintf(out, "  %s\n", ptr->data);
+        curl_mfprintf(out, "  %s\n", ptr->data);
     }
 
     /* Set up complex values for setopt calls */
     if(easysrc_data) {
-      fprintf(out, "\n");
+      curl_mfprintf(out, "\n");
 
       for(ptr = easysrc_data->first; ptr; ptr = ptr->next)
-        fprintf(out, "  %s\n", ptr->data);
+        curl_mfprintf(out, "  %s\n", ptr->data);
     }
 
-    fprintf(out, "\n");
+    curl_mfprintf(out, "\n");
     if(easysrc_code) {
       for(ptr = easysrc_code->first; ptr; ptr = ptr->next) {
         if(ptr->data[0]) {
-          fprintf(out, "  %s\n", ptr->data);
+          curl_mfprintf(out, "  %s\n", ptr->data);
         }
         else {
-          fprintf(out, "\n");
+          curl_mfprintf(out, "\n");
         }
       }
     }
 
     if(easysrc_clean) {
       for(ptr = easysrc_clean->first; ptr; ptr = ptr->next)
-        fprintf(out, "  %s\n", ptr->data);
+        curl_mfprintf(out, "  %s\n", ptr->data);
     }
 
     for(i = 0; ((c = srcend[i]) != NULL); i++)
-      fprintf(out, "%s\n", c);
+      curl_mfprintf(out, "%s\n", c);
 
     if(fopened)
-      fclose(out);
+      curlx_fclose(out);
   }
 
   easysrc_free();
diff --git a/third-party/curl/src/tool_easysrc.h b/third-party/curl/src/tool_easysrc.h
index 8c8d131501..f37ce4ba86 100644
--- a/third-party/curl/src/tool_easysrc.h
+++ b/third-party/curl/src/tool_easysrc.h
@@ -24,6 +24,7 @@
  *
  ***************************************************************************/
 #include "tool_setup.h"
+
 #ifndef CURL_DISABLE_LIBCURL_OPTION
 
 /* global variable declarations, for easy-interface source code generation */
@@ -38,13 +39,12 @@ extern int easysrc_mime_count;  /* Number of curl_mime variables */
 extern int easysrc_slist_count; /* Number of curl_slist variables */
 
 extern CURLcode easysrc_init(void);
-extern CURLcode easysrc_add(struct slist_wc **plist, const char *bupf);
+extern CURLcode easysrc_add(struct slist_wc **plist, const char *line);
 extern CURLcode easysrc_addf(struct slist_wc **plist,
-                             const char *fmt, ...);
+                             const char *fmt, ...) CURL_PRINTF(2, 3);
 extern CURLcode easysrc_perform(void);
 extern CURLcode easysrc_cleanup(void);
-
-void dumpeasysrc(struct GlobalConfig *config);
+void dumpeasysrc(void);
 
 #else /* CURL_DISABLE_LIBCURL_OPTION is defined */
 
diff --git a/third-party/curl/src/tool_filetime.c b/third-party/curl/src/tool_filetime.c
index 9c2e80429b..0b6cd7b38f 100644
--- a/third-party/curl/src/tool_filetime.c
+++ b/third-party/curl/src/tool_filetime.c
@@ -24,7 +24,6 @@
 #include "tool_filetime.h"
 #include "tool_cfgable.h"
 #include "tool_msgs.h"
-#include "curlx.h"
 
 #ifdef HAVE_UTIME_H
 #  include <utime.h>
@@ -33,124 +32,120 @@
 #endif
 
 /* Returns 0 on success, non-zero on file problems */
-int getfiletime(const char *filename, struct GlobalConfig *global,
-                curl_off_t *stamp)
+int getfiletime(const char *filename, curl_off_t *stamp)
 {
   int rc = 1;
 
-/* Windows stat() may attempt to adjust the unix GMT file time by a daylight
-   saving time offset and since it's GMT that is bad behavior. When we have
+/* Windows stat() may attempt to adjust the Unix GMT file time by a daylight
+   saving time offset and since it is GMT that is bad behavior. When we have
    access to a 64-bit type we can bypass stat and get the times directly. */
-#if defined(WIN32)
+#if defined(_WIN32) && !defined(CURL_WINDOWS_UWP)
   HANDLE hfile;
-  TCHAR *tchar_filename = curlx_convert_UTF8_to_tchar((char *)filename);
-
-  hfile = CreateFile(tchar_filename, FILE_READ_ATTRIBUTES,
-                      (FILE_SHARE_READ | FILE_SHARE_WRITE |
-                       FILE_SHARE_DELETE),
-                      NULL, OPEN_EXISTING, 0, NULL);
-  curlx_unicodefree(tchar_filename);
+  hfile = curlx_CreateFile(filename, FILE_READ_ATTRIBUTES,
+                           FILE_SHARE_READ | FILE_SHARE_WRITE |
+                           FILE_SHARE_DELETE, NULL, OPEN_EXISTING, 0, NULL);
   if(hfile != INVALID_HANDLE_VALUE) {
     FILETIME ft;
     if(GetFileTime(hfile, NULL, NULL, &ft)) {
-      curl_off_t converted = (curl_off_t)ft.dwLowDateTime
-        | ((curl_off_t)ft.dwHighDateTime) << 32;
+      curl_off_t converted = (curl_off_t)ft.dwLowDateTime |
+        ((curl_off_t)ft.dwHighDateTime) << 32;
 
-      if(converted < CURL_OFF_T_C(116444736000000000))
-        warnf(global, "Failed to get filetime: underflow");
+      if(converted < 116444736000000000)
+        warnf("Failed to get filetime: underflow");
       else {
-        *stamp = (converted - CURL_OFF_T_C(116444736000000000)) / 10000000;
+        *stamp = (converted - 116444736000000000) / 10000000;
         rc = 0;
       }
     }
     else {
-      warnf(global, "Failed to get filetime: "
-            "GetFileTime failed: GetLastError %u",
-            (unsigned int)GetLastError());
+      warnf("Failed to get filetime: GetFileTime failed: GetLastError 0x%08lx",
+            GetLastError());
     }
     CloseHandle(hfile);
   }
   else if(GetLastError() != ERROR_FILE_NOT_FOUND) {
-    warnf(global, "Failed to get filetime: "
-          "CreateFile failed: GetLastError %u",
-          (unsigned int)GetLastError());
+    warnf("Failed to get filetime: CreateFile failed: GetLastError 0x%08lx",
+          GetLastError());
   }
 #else
-  struct_stat statbuf;
-  if(-1 != stat(filename, &statbuf)) {
+  curlx_struct_stat statbuf;
+  if(curlx_stat(filename, &statbuf) != -1) {
     *stamp = (curl_off_t)statbuf.st_mtime;
     rc = 0;
   }
-  else
-    warnf(global, "Failed to get filetime: %s", strerror(errno));
+  else {
+    char errbuf[STRERROR_LEN];
+    warnf("Failed to get filetime: %s",
+          curlx_strerror(errno, errbuf, sizeof(errbuf)));
+  }
 #endif
   return rc;
 }
 
-#if defined(HAVE_UTIME) || defined(HAVE_UTIMES) || defined(WIN32)
-void setfiletime(curl_off_t filetime, const char *filename,
-                 struct GlobalConfig *global)
+#if defined(HAVE_UTIME) || defined(HAVE_UTIMES) || defined(_WIN32)
+void setfiletime(curl_off_t filetime, const char *filename)
 {
-  if(filetime >= 0) {
-/* Windows utime() may attempt to adjust the unix GMT file time by a daylight
-   saving time offset and since it's GMT that is bad behavior. When we have
+/* Windows utime() may attempt to adjust the Unix GMT file time by a daylight
+   saving time offset and since it is GMT that is bad behavior. When we have
    access to a 64-bit type we can bypass utime and set the times directly. */
-#if defined(WIN32)
-    HANDLE hfile;
-    TCHAR *tchar_filename = curlx_convert_UTF8_to_tchar((char *)filename);
+#if defined(_WIN32) && !defined(CURL_WINDOWS_UWP)
+  HANDLE hfile;
 
-    /* 910670515199 is the maximum unix filetime that can be used as a
-       Windows FILETIME without overflow: 30827-12-31T23:59:59. */
-    if(filetime > CURL_OFF_T_C(910670515199)) {
-      warnf(global, "Failed to set filetime %" CURL_FORMAT_CURL_OFF_T
-            " on outfile: overflow", filetime);
-      curlx_unicodefree(tchar_filename);
-      return;
-    }
+  /* 910670515199 is the maximum Unix filetime that can be used as a Windows
+     FILETIME without overflow: 30827-12-31T23:59:59. */
+  if(filetime > 910670515199) {
+    filetime = 910670515199;
+    warnf("Capping set filetime to max to avoid overflow");
+  }
+  else if(filetime < -6857222400) {
+    /* dates before 14 september 1752 (pre-Gregorian calendar) are not
+       accurate */
+    filetime = -6857222400;
+    warnf("Capping set filetime to minimum to avoid overflow");
+  }
 
-    hfile = CreateFile(tchar_filename, FILE_WRITE_ATTRIBUTES,
-                       (FILE_SHARE_READ | FILE_SHARE_WRITE |
-                        FILE_SHARE_DELETE),
-                       NULL, OPEN_EXISTING, 0, NULL);
-    curlx_unicodefree(tchar_filename);
-    if(hfile != INVALID_HANDLE_VALUE) {
-      curl_off_t converted = ((curl_off_t)filetime * 10000000) +
-        CURL_OFF_T_C(116444736000000000);
-      FILETIME ft;
-      ft.dwLowDateTime = (DWORD)(converted & 0xFFFFFFFF);
-      ft.dwHighDateTime = (DWORD)(converted >> 32);
-      if(!SetFileTime(hfile, NULL, &ft, &ft)) {
-        warnf(global, "Failed to set filetime %" CURL_FORMAT_CURL_OFF_T
-              " on outfile: SetFileTime failed: GetLastError %u",
-              filetime, (unsigned int)GetLastError());
-      }
-      CloseHandle(hfile);
-    }
-    else {
-      warnf(global, "Failed to set filetime %" CURL_FORMAT_CURL_OFF_T
-            " on outfile: CreateFile failed: GetLastError %u",
-            filetime, (unsigned int)GetLastError());
+  hfile = curlx_CreateFile(filename, FILE_WRITE_ATTRIBUTES,
+                           FILE_SHARE_READ | FILE_SHARE_WRITE |
+                           FILE_SHARE_DELETE, NULL, OPEN_EXISTING, 0, NULL);
+  if(hfile != INVALID_HANDLE_VALUE) {
+    curl_off_t converted = (filetime * 10000000) + 116444736000000000;
+    FILETIME ft;
+    ft.dwLowDateTime = (DWORD)(converted & 0xFFFFFFFF);
+    ft.dwHighDateTime = (DWORD)(converted >> 32);
+    if(!SetFileTime(hfile, NULL, &ft, &ft)) {
+      warnf("Failed to set filetime %" CURL_FORMAT_CURL_OFF_T
+            " on outfile: SetFileTime failed: GetLastError 0x%08lx",
+            filetime, GetLastError());
     }
+    CloseHandle(hfile);
+  }
+  else {
+    warnf("Failed to set filetime %" CURL_FORMAT_CURL_OFF_T
+          " on outfile: CreateFile failed: GetLastError 0x%08lx",
+          filetime, GetLastError());
+  }
 
 #elif defined(HAVE_UTIMES)
-    struct timeval times[2];
-    times[0].tv_sec = times[1].tv_sec = (time_t)filetime;
-    times[0].tv_usec = times[1].tv_usec = 0;
-    if(utimes(filename, times)) {
-      warnf(global, "Failed to set filetime %" CURL_FORMAT_CURL_OFF_T
-            " on '%s': %s", filetime, filename, strerror(errno));
-    }
+  struct timeval times[2];
+  times[0].tv_sec = times[1].tv_sec = (time_t)filetime;
+  times[0].tv_usec = times[1].tv_usec = 0;
+  if(utimes(filename, times)) {
+    char errbuf[STRERROR_LEN];
+    warnf("Failed to set filetime %" CURL_FORMAT_CURL_OFF_T
+          " on '%s': %s", filetime, filename,
+          curlx_strerror(errno, errbuf, sizeof(errbuf)));
+  }
 
 #elif defined(HAVE_UTIME)
-    struct utimbuf times;
-    times.actime = (time_t)filetime;
-    times.modtime = (time_t)filetime;
-    if(utime(filename, &times)) {
-      warnf(global, "Failed to set filetime %" CURL_FORMAT_CURL_OFF_T
-            " on '%s': %s", filetime, filename, strerror(errno));
-    }
-#endif
+  struct utimbuf times;
+  times.actime = (time_t)filetime;
+  times.modtime = (time_t)filetime;
+  if(utime(filename, &times)) {
+    char errbuf[STRERROR_LEN];
+    warnf("Failed to set filetime %" CURL_FORMAT_CURL_OFF_T
+          " on '%s': %s", filetime, filename,
+          curlx_strerror(errno, errbuf, sizeof(errbuf)));
   }
+#endif
 }
-#endif /* defined(HAVE_UTIME) || defined(HAVE_UTIMES) ||        \
-          defined(WIN32) */
+#endif /* HAVE_UTIME || HAVE_UTIMES || _WIN32 */
diff --git a/third-party/curl/src/tool_filetime.h b/third-party/curl/src/tool_filetime.h
index 908b2d72bf..d28242027e 100644
--- a/third-party/curl/src/tool_filetime.h
+++ b/third-party/curl/src/tool_filetime.h
@@ -25,18 +25,13 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-struct GlobalConfig;
+int getfiletime(const char *filename, curl_off_t *stamp);
 
-int getfiletime(const char *filename, struct GlobalConfig *global,
-                curl_off_t *stamp);
-
-#if defined(HAVE_UTIME) || defined(HAVE_UTIMES) ||      \
-  (defined(WIN32) && (SIZEOF_CURL_OFF_T >= 8))
-void setfiletime(curl_off_t filetime, const char *filename,
-                 struct GlobalConfig *global);
+#if defined(HAVE_UTIME) || defined(HAVE_UTIMES) || \
+  (defined(_WIN32) && (SIZEOF_CURL_OFF_T >= 8))
+void setfiletime(curl_off_t filetime, const char *filename);
 #else
-#define setfiletime(a,b,c) Curl_nop_stmt
-#endif /* defined(HAVE_UTIME) || defined(HAVE_UTIMES) ||        \
-          (defined(WIN32) && (SIZEOF_CURL_OFF_T >= 8)) */
+#define setfiletime(a, b) tool_nop_stmt
+#endif
 
 #endif /* HEADER_CURL_TOOL_FILETIME_H */
diff --git a/third-party/curl/src/tool_findfile.c b/third-party/curl/src/tool_findfile.c
index 201d8f0a81..146a273773 100644
--- a/third-party/curl/src/tool_findfile.c
+++ b/third-party/curl/src/tool_findfile.c
@@ -24,22 +24,17 @@
 #include "tool_setup.h"
 
 #ifdef HAVE_PWD_H
-#  undef __NO_NET_API /* required for building for AmigaOS */
-#  include <pwd.h>
+#ifdef __AMIGA__
+#undef __NO_NET_API /* required for AmigaOS to declare getpwuid() */
 #endif
-
-#ifdef HAVE_SYS_STAT_H
-#include <sys/stat.h>
+#include <pwd.h>
+#ifdef __AMIGA__
+#define __NO_NET_API
 #endif
-#ifdef HAVE_FCNTL_H
-#include <fcntl.h>
 #endif
 
-#include <curl/mprintf.h>
-
 #include "tool_findfile.h"
-
-#include "memdebug.h" /* keep this as LAST include */
+#include "tool_cfgable.h"
 
 struct finder {
   const char *env;
@@ -51,12 +46,12 @@ struct finder {
    in the findfile() function */
 static const struct finder conf_list[] = {
   { "CURL_HOME", NULL, FALSE },
-  { "XDG_CONFIG_HOME", NULL, FALSE }, /* index == 1, used in the code */
+  { "XDG_CONFIG_HOME", NULL, TRUE },
   { "HOME", NULL, FALSE },
-#ifdef WIN32
+#ifdef _WIN32
   { "USERPROFILE", NULL, FALSE },
   { "APPDATA", NULL, FALSE },
-  { "USERPROFILE", "\\Application Data", FALSE},
+  { "USERPROFILE", "\\Application Data", FALSE },
 #endif
   /* these are for .curlrc if XDG_CONFIG_HOME is not defined */
   { "CURL_HOME", "/.config", TRUE },
@@ -67,7 +62,7 @@ static const struct finder conf_list[] = {
 
 static char *checkhome(const char *home, const char *fname, bool dotscore)
 {
-  const char pref[2] = { '.', '_' };
+  static const char pref[2] = { '.', '_' };
   int i;
   for(i = 0; i < (dotscore ? 2 : 1); i++) {
     char *c;
@@ -76,10 +71,10 @@ static char *checkhome(const char *home, const char *fname, bool dotscore)
     else
       c = curl_maprintf("%s" DIR_CHAR "%s", home, fname);
     if(c) {
-      int fd = open(c, O_RDONLY);
+      int fd = curlx_open(c, O_RDONLY);
       if(fd >= 0) {
-        char *path = strdup(c);
-        close(fd);
+        char *path = curlx_strdup(c);
+        curlx_close(fd);
         curl_free(c);
         return path;
       }
@@ -90,19 +85,19 @@ static char *checkhome(const char *home, const char *fname, bool dotscore)
 }
 
 /*
- * findfile() - return the full path name of the file.
+ * findfile() - returns the full path name of the file. It must be freed with
+ * curl_free().
  *
  * If 'dotscore' is TRUE, then check for the file first with a leading dot
  * and then with a leading underscore.
  *
  * 1. Iterate over the environment variables in order, and if set, check for
  *    the given file to be accessed there, then it is a match.
- * 2. Non-windows: try getpwuid
+ * 2. Non-Windows: try getpwuid
  */
 char *findfile(const char *fname, int dotscore)
 {
   int i;
-  bool xdg = FALSE;
   DEBUGASSERT(fname && fname[0]);
   DEBUGASSERT((dotscore != 1) || (fname[0] == '.'));
 
@@ -114,8 +109,6 @@ char *findfile(const char *fname, int dotscore)
     if(home) {
       char *path;
       const char *filename = fname;
-      if(i == 1 /* XDG_CONFIG_HOME */)
-        xdg = TRUE;
       if(!home[0]) {
         curl_free(home);
         continue;
@@ -128,7 +121,7 @@ char *findfile(const char *fname, int dotscore)
         home = c;
       }
       if(conf_list[i].withoutdot) {
-        if(!dotscore || xdg) {
+        if(!dotscore) {
           /* this is not looking for .curlrc, or the XDG_CONFIG_HOME was
              defined so we skip the extended check */
           curl_free(home);
@@ -152,6 +145,6 @@ char *findfile(const char *fname, int dotscore)
         return checkhome(home, fname, FALSE);
     }
   }
-#endif /* PWD-stuff */
+#endif /* HAVE_GETPWUID && HAVE_GETEUID */
   return NULL;
 }
diff --git a/third-party/curl/src/tool_findfile.h b/third-party/curl/src/tool_findfile.h
index faafd71cb8..63d25195fc 100644
--- a/third-party/curl/src/tool_findfile.h
+++ b/third-party/curl/src/tool_findfile.h
@@ -25,7 +25,7 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#ifdef WIN32
+#ifdef _WIN32
 #define CURLRC_DOTSCORE 2 /* look for underscore-prefixed name too */
 #else
 #define CURLRC_DOTSCORE 1 /* regular .curlrc check */
diff --git a/third-party/curl/src/tool_formparse.c b/third-party/curl/src/tool_formparse.c
index fa38698d5e..7e6d625cb2 100644
--- a/third-party/curl/src/tool_formparse.c
+++ b/third-party/curl/src/tool_formparse.c
@@ -23,26 +23,17 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#include "strcase.h"
-
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
-
 #include "tool_cfgable.h"
 #include "tool_msgs.h"
-#include "tool_binmode.h"
-#include "tool_getparam.h"
 #include "tool_paramhlp.h"
 #include "tool_formparse.h"
-
-#include "memdebug.h" /* keep this as LAST include */
+#include "tool_parsecfg.h"
 
 /* tool_mime functions. */
 static struct tool_mime *tool_mime_new(struct tool_mime *parent,
                                        toolmimekind kind)
 {
-  struct tool_mime *m = (struct tool_mime *) calloc(1, sizeof(*m));
+  struct tool_mime *m = curlx_calloc(1, sizeof(*m));
 
   if(m) {
     m->kind = kind;
@@ -66,17 +57,42 @@ static struct tool_mime *tool_mime_new_data(struct tool_mime *parent,
   char *mime_data_copy;
   struct tool_mime *m = NULL;
 
-  mime_data_copy = strdup(mime_data);
+  mime_data_copy = curlx_strdup(mime_data);
   if(mime_data_copy) {
     m = tool_mime_new(parent, TOOLMIME_DATA);
     if(!m)
-      free(mime_data_copy);
+      curlx_free(mime_data_copy);
     else
       m->data = mime_data_copy;
   }
   return m;
 }
 
+/*
+** unsigned size_t to signed curl_off_t
+*/
+
+#define CURL_MASK_UCOFFT  ((unsigned CURL_TYPEOF_CURL_OFF_T)~0)
+#define CURL_MASK_SCOFFT  (CURL_MASK_UCOFFT >> 1)
+
+static curl_off_t uztoso(size_t uznum)
+{
+#ifdef __INTEL_COMPILER
+#  pragma warning(push)
+#  pragma warning(disable:810) /* conversion may lose significant bits */
+#elif defined(_MSC_VER)
+#  pragma warning(push)
+#  pragma warning(disable:4310) /* cast truncates constant value */
+#endif
+
+  DEBUGASSERT(uznum <= (size_t)CURL_MASK_SCOFFT);
+  return (curl_off_t)(uznum & (size_t)CURL_MASK_SCOFFT);
+
+#if defined(__INTEL_COMPILER) || defined(_MSC_VER)
+#  pragma warning(pop)
+#endif
+}
+
 static struct tool_mime *tool_mime_new_filedata(struct tool_mime *parent,
                                                 const char *filename,
                                                 bool isremotefile,
@@ -88,16 +104,16 @@ static struct tool_mime *tool_mime_new_filedata(struct tool_mime *parent,
   *errcode = CURLE_OUT_OF_MEMORY;
   if(strcmp(filename, "-")) {
     /* This is a normal file. */
-    char *filedup = strdup(filename);
+    char *filedup = curlx_strdup(filename);
     if(filedup) {
       m = tool_mime_new(parent, TOOLMIME_FILE);
       if(!m)
-        free(filedup);
+        curlx_free(filedup);
       else {
         m->data = filedup;
         if(!isremotefile)
           m->kind = TOOLMIME_FILEDATA;
-       *errcode = CURLE_OK;
+        *errcode = CURLE_OK;
       }
     }
   }
@@ -106,13 +122,13 @@ static struct tool_mime *tool_mime_new_filedata(struct tool_mime *parent,
     char *data = NULL;
     curl_off_t size;
     curl_off_t origin;
-    struct_stat sbuf;
+    curlx_struct_stat sbuf;
 
-    set_binmode(stdin);
+    CURL_BINMODE(stdin);
     origin = ftell(stdin);
     /* If stdin is a regular file, do not buffer data but read it
        when needed. */
-    if(fd >= 0 && origin >= 0 && !fstat(fd, &sbuf) &&
+    if(fd >= 0 && origin >= 0 && !curlx_fstat(fd, &sbuf) &&
 #ifdef __VMS
        sbuf.st_fab_rfm != FAB$C_VAR && sbuf.st_fab_rfm != FAB$C_VFC &&
 #endif
@@ -133,18 +149,18 @@ static struct tool_mime *tool_mime_new_filedata(struct tool_mime *parent,
       default:
         if(!stdinsize) {
           /* Zero-length data has been freed. Re-create it. */
-          data = strdup("");
+          data = curlx_strdup("");
           if(!data)
             return m;
         }
         break;
       }
-      size = curlx_uztoso(stdinsize);
+      size = uztoso(stdinsize);
       origin = 0;
     }
     m = tool_mime_new(parent, TOOLMIME_STDIN);
     if(!m)
-      Curl_safefree(data);
+      curlx_safefree(data);
     else {
       m->data = data;
       m->origin = origin;
@@ -165,30 +181,29 @@ void tool_mime_free(struct tool_mime *mime)
       tool_mime_free(mime->subparts);
     if(mime->prev)
       tool_mime_free(mime->prev);
-    Curl_safefree(mime->name);
-    Curl_safefree(mime->filename);
-    Curl_safefree(mime->type);
-    Curl_safefree(mime->encoder);
-    Curl_safefree(mime->data);
+    curlx_safefree(mime->name);
+    curlx_safefree(mime->filename);
+    curlx_safefree(mime->type);
+    curlx_safefree(mime->encoder);
+    curlx_safefree(mime->data);
     curl_slist_free_all(mime->headers);
-    free(mime);
+    curlx_free(mime);
   }
 }
 
-
 /* Mime part callbacks for stdin. */
-size_t tool_mime_stdin_read(char *buffer,
-                            size_t size, size_t nitems, void *arg)
+static size_t tool_mime_stdin_read(char *buffer,
+                                   size_t size, size_t nitems, void *arg)
 {
-  struct tool_mime *sip = (struct tool_mime *) arg;
+  struct tool_mime *sip = (struct tool_mime *)arg;
   curl_off_t bytesleft;
-  (void) size;  /* Always 1: ignored. */
+  (void)size;  /* Always 1: ignored. */
 
   if(sip->size >= 0) {
     if(sip->curpos >= sip->size)
       return 0;  /* At eof. */
     bytesleft = sip->size - sip->curpos;
-    if(curlx_uztoso(nitems) > bytesleft)
+    if(uztoso(nitems) > bytesleft)
       nitems = curlx_sotouz(bytesleft);
   }
   if(nitems) {
@@ -200,22 +215,21 @@ size_t tool_mime_stdin_read(char *buffer,
       /* Read from stdin. */
       nitems = fread(buffer, 1, nitems, stdin);
       if(ferror(stdin)) {
+        char errbuf[STRERROR_LEN];
         /* Show error only once. */
-        if(sip->config) {
-          warnf(sip->config, "stdin: %s", strerror(errno));
-          sip->config = NULL;
-        }
+        warnf("Failed to read from stdin: %s",
+              curlx_strerror(errno, errbuf, sizeof(errbuf)));
         return CURL_READFUNC_ABORT;
       }
     }
-    sip->curpos += curlx_uztoso(nitems);
+    sip->curpos += uztoso(nitems);
   }
   return nitems;
 }
 
-int tool_mime_stdin_seek(void *instream, curl_off_t offset, int whence)
+static int tool_mime_stdin_seek(void *instream, curl_off_t offset, int whence)
 {
-  struct tool_mime *sip = (struct tool_mime *) instream;
+  struct tool_mime *sip = (struct tool_mime *)instream;
 
   switch(whence) {
   case SEEK_CUR:
@@ -228,7 +242,7 @@ int tool_mime_stdin_seek(void *instream, curl_off_t offset, int whence)
   if(offset < 0)
     return CURL_SEEKFUNC_CANTSEEK;
   if(!sip->data) {
-    if(fseek(stdin, (long) (offset + sip->origin), SEEK_SET))
+    if(curlx_fseek(stdin, offset + sip->origin, SEEK_SET))
       return CURL_SEEKFUNC_CANTSEEK;
   }
   sip->curpos = offset;
@@ -237,97 +251,128 @@ int tool_mime_stdin_seek(void *instream, curl_off_t offset, int whence)
 
 /* Translate an internal mime tree into a libcurl mime tree. */
 
+#define MAX_FORMPARTS 100000 /* arbitrarily picked */
+
 static CURLcode tool2curlparts(CURL *curl, struct tool_mime *m,
                                curl_mime *mime)
 {
-  CURLcode ret = CURLE_OK;
-  curl_mimepart *part = NULL;
-  curl_mime *submime = NULL;
-  const char *filename = NULL;
+  CURLcode result = CURLE_OK;
+  struct tool_mime *curr;
+  struct tool_mime **nodes = NULL;
+  int count;
+  int i;
 
-  if(m) {
-    ret = tool2curlparts(curl, m->prev, mime);
-    if(!ret) {
-      part = curl_mime_addpart(mime);
-      if(!part)
-        ret = CURLE_OUT_OF_MEMORY;
-    }
-    if(!ret) {
-      filename = m->filename;
-      switch(m->kind) {
-      case TOOLMIME_PARTS:
-        ret = tool2curlmime(curl, m, &submime);
-        if(!ret) {
-          ret = curl_mime_subparts(part, submime);
-          if(ret)
-            curl_mime_free(submime);
-        }
-        break;
+  if(!m)
+    return CURLE_OK;
 
-      case TOOLMIME_DATA:
-        ret = curl_mime_data(part, m->data, CURL_ZERO_TERMINATED);
-        break;
-
-      case TOOLMIME_FILE:
-      case TOOLMIME_FILEDATA:
-        ret = curl_mime_filedata(part, m->data);
-        if(!ret && m->kind == TOOLMIME_FILEDATA && !filename)
-          ret = curl_mime_filename(part, NULL);
-        break;
-
-      case TOOLMIME_STDIN:
-        if(!filename)
-          filename = "-";
-        /* FALLTHROUGH */
-      case TOOLMIME_STDINDATA:
-        ret = curl_mime_data_cb(part, m->size,
-                                (curl_read_callback) tool_mime_stdin_read,
-                                (curl_seek_callback) tool_mime_stdin_seek,
-                                NULL, m);
-        break;
-
-      default:
-        /* Other cases not possible in this context. */
-        break;
-      }
-    }
-    if(!ret && filename)
-      ret = curl_mime_filename(part, filename);
-    if(!ret)
-      ret = curl_mime_type(part, m->type);
-    if(!ret)
-      ret = curl_mime_headers(part, m->headers, 0);
-    if(!ret)
-      ret = curl_mime_encoder(part, m->encoder);
-    if(!ret)
-      ret = curl_mime_name(part, m->name);
+  for(curr = m, count = 0; curr; curr = curr->prev) {
+    if(count > MAX_FORMPARTS)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    count++;
   }
-  return ret;
+
+  nodes = curlx_malloc(sizeof(struct tool_mime *) * count);
+  if(!nodes)
+    return CURLE_OUT_OF_MEMORY;
+
+  /* populate array from the end to the beginning */
+  curr = m;
+  for(i = count - 1; i >= 0; i--) {
+    nodes[i] = curr;
+    curr = curr->prev;
+  }
+
+  for(i = 0; i < count; i++) {
+    struct tool_mime *node = nodes[i];
+    curl_mimepart *part = NULL;
+    curl_mime *submime = NULL;
+    const char *filename = node->filename;
+
+    part = curl_mime_addpart(mime);
+    if(!part) {
+      result = CURLE_OUT_OF_MEMORY;
+      break;
+    }
+
+    switch(node->kind) {
+    case TOOLMIME_PARTS:
+      result = tool2curlmime(curl, node, &submime);
+      if(!result) {
+        result = curl_mime_subparts(part, submime);
+        if(result)
+          curl_mime_free(submime);
+      }
+      break;
+
+    case TOOLMIME_DATA:
+      result = curl_mime_data(part, node->data, CURL_ZERO_TERMINATED);
+      break;
+
+    case TOOLMIME_FILE:
+    case TOOLMIME_FILEDATA:
+      result = curl_mime_filedata(part, node->data);
+      if(!result && node->kind == TOOLMIME_FILEDATA && !filename)
+        result = curl_mime_filename(part, NULL);
+      break;
+
+    case TOOLMIME_STDIN:
+      if(!filename)
+        filename = "-";
+      FALLTHROUGH();
+    case TOOLMIME_STDINDATA:
+      result = curl_mime_data_cb(part, node->size,
+                                 tool_mime_stdin_read,
+                                 tool_mime_stdin_seek,
+                                 NULL, node);
+      break;
+
+    default:
+      /* Other cases not possible in this context. */
+      break;
+    }
+
+    /* Common part configuration */
+    if(!result && filename)
+      result = curl_mime_filename(part, filename);
+    if(!result)
+      result = curl_mime_type(part, node->type);
+    if(!result)
+      result = curl_mime_headers(part, node->headers, 0);
+    if(!result)
+      result = curl_mime_encoder(part, node->encoder);
+    if(!result)
+      result = curl_mime_name(part, node->name);
+
+    if(result)
+      break;
+  }
+
+  curlx_free(nodes);
+  return result;
 }
 
 CURLcode tool2curlmime(CURL *curl, struct tool_mime *m, curl_mime **mime)
 {
-  CURLcode ret = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   *mime = curl_mime_init(curl);
   if(!*mime)
-    ret = CURLE_OUT_OF_MEMORY;
+    result = CURLE_OUT_OF_MEMORY;
   else
-    ret = tool2curlparts(curl, m->subparts, *mime);
-  if(ret) {
+    result = tool2curlparts(curl, m->subparts, *mime);
+  if(result) {
     curl_mime_free(*mime);
     *mime = NULL;
   }
-  return ret;
+  return result;
 }
 
 /*
  * helper function to get a word from form param
- * after call get_parm_word, str either point to string end
+ * after call get_param_word, str either point to string end
  * or point to any of end chars.
  */
-static char *get_param_word(struct OperationConfig *config, char **str,
-                            char **end_pos, char endchar)
+static char *get_param_word(char **str, char **end_pos, char endchar)
 {
   char *ptr = *str;
   /* the first non-space char is here */
@@ -358,8 +403,7 @@ static char *get_param_word(struct OperationConfig *config, char **str,
             if(*ptr == '\\' && (ptr[1] == '\\' || ptr[1] == '"'))
               ++ptr;
             *ptr2++ = *ptr++;
-          }
-          while(ptr < *end_pos);
+          } while(ptr < *end_pos);
           *end_pos = ptr2;
         }
         ++ptr;
@@ -369,7 +413,7 @@ static char *get_param_word(struct OperationConfig *config, char **str,
           ++ptr;
         }
         if(trailing_data)
-          warnf(config->global, "Trailing data after quoted form parameter");
+          warnf("Trailing data after quoted form parameter");
         *str = ptr;
         return word_begin + 1;
       }
@@ -397,69 +441,229 @@ static int slist_append(struct curl_slist **plist, const char *data)
   return 0;
 }
 
-/* Read headers from a file and append to list. */
-static int read_field_headers(struct OperationConfig *config,
-                              const char *filename, FILE *fp,
-                              struct curl_slist **pheaders)
+#define HEADER_LINE_BUFFER_SIZE 8192
+
+/* Read headers from a file and append to list.
+   Return zero on success, non-zero on error. */
+static int read_field_headers(FILE *fp, struct curl_slist **pheaders)
 {
-  size_t hdrlen = 0;
-  size_t pos = 0;
-  bool incomment = FALSE;
-  int lineno = 1;
-  char hdrbuf[999] = ""; /* Max. header length + 1. */
+  struct dynbuf line;
+  bool error = FALSE;
+  int err = 0;
 
-  for(;;) {
-    int c = getc(fp);
-    if(c == EOF || (!pos && !ISSPACE(c))) {
-      /* Strip and flush the current header. */
-      while(hdrlen && ISSPACE(hdrbuf[hdrlen - 1]))
-        hdrlen--;
-      if(hdrlen) {
-        hdrbuf[hdrlen] = '\0';
-        if(slist_append(pheaders, hdrbuf)) {
-          errorf(config->global, "Out of memory for field headers");
-          return -1;
-        }
-        hdrlen = 0;
-      }
-    }
-
-    switch(c) {
-    case EOF:
-      if(ferror(fp)) {
-        errorf(config->global, "Header file %s read error: %s", filename,
-               strerror(errno));
-        return -1;
-      }
-      return 0;    /* Done. */
-    case '\r':
-      continue;    /* Ignore. */
-    case '\n':
-      pos = 0;
-      incomment = FALSE;
-      lineno++;
+  curlx_dyn_init(&line, HEADER_LINE_BUFFER_SIZE);
+  while(my_get_line(fp, &line, &error)) {
+    const char *ptr = curlx_dyn_ptr(&line);
+    size_t len = curlx_dyn_len(&line);
+    bool folded = FALSE;
+    if(ptr[0] == '#') /* comment */
       continue;
-    case '#':
-      if(!pos)
-        incomment = TRUE;
+    else if(ptr[0] == ' ') /* a continuation from the line before */
+      folded = TRUE;
+    /* trim off trailing CRLFs and whitespaces */
+    while(len && (ISNEWLINE(ptr[len - 1]) || ISBLANK(ptr[len - 1])))
+      len--;
+
+    if(!len)
+      continue;
+    curlx_dyn_setlen(&line, len); /* set the new length */
+
+    if(folded && *pheaders) {
+      /* append this new line onto the previous line */
+      struct dynbuf amend;
+      struct curl_slist *l = *pheaders;
+      curlx_dyn_init(&amend, HEADER_LINE_BUFFER_SIZE);
+      /* find the last node */
+      while(l && l->next)
+        l = l->next;
+      /* add both parts */
+      if(curlx_dyn_add(&amend, l->data) || curlx_dyn_addn(&amend, ptr, len)) {
+        err = -1;
+        break;
+      }
+      curl_free(l->data);
+      /* we use maprintf here to make it a libcurl alloc, to match the previous
+         curl_slist_append */
+      l->data = curl_maprintf("%s", curlx_dyn_ptr(&amend));
+      curlx_dyn_free(&amend);
+      if(!l->data)
+        err = -1;
+    }
+    else
+      err = slist_append(pheaders, ptr);
+
+    if(err) {
+      errorf("Out of memory for field headers");
+      err = -1;
       break;
     }
-
-    pos++;
-    if(!incomment) {
-      if(hdrlen == sizeof(hdrbuf) - 1) {
-        warnf(config->global, "File %s line %d: header too long (truncated)",
-              filename, lineno);
-        c = ' ';
-      }
-      if(hdrlen <= sizeof(hdrbuf) - 1)
-        hdrbuf[hdrlen++] = (char) c;
-    }
   }
-  /* NOTREACHED */
+  if(error && !err) {
+    errorf("Failed to read field headers");
+    err = -1;
+  }
+  curlx_dyn_free(&line);
+  return err;
 }
 
-static int get_param_part(struct OperationConfig *config, char endchar,
+static void param_type(char **ptr, char **ptype, char **endct, char *sep)
+{
+  char *p = *ptr;
+  size_t tlen;
+  for(p += sizeof("type=") - 1; ISBLANK(*p); p++)
+    ;
+  /* set type pointer */
+  *ptype = p;
+
+  /* find end of content-type */
+  tlen = strcspn(p, "()<>@,;:\\\"[]?=\r\n ");
+  p += tlen;
+  *endct = p;
+  *sep = *p;
+  *ptr = p;
+}
+
+static void param_filename(char **ptr, char **endct, char **pfilename,
+                           char endchar, char *sep)
+{
+  char *p = *ptr;
+  char *endpos;
+  char *tp;
+
+  if(*endct) {
+    **endct = '\0';
+    *endct = NULL;
+  }
+  for(p += sizeof("filename=") - 1; ISBLANK(*p); p++)
+    ;
+  tp = p;
+  *pfilename = get_param_word(&p, &endpos, endchar);
+  /* If not quoted, strip trailing spaces. */
+  if(*pfilename == tp)
+    while(endpos > *pfilename && ISBLANK(endpos[-1]))
+      endpos--;
+  *sep = *p;
+  *endpos = '\0';
+  *ptr = p;
+}
+
+static int param_headers(char **ptr, char **endct,
+                         struct curl_slist **pheaders, char endchar, char *sep)
+{
+  char *p = *ptr;
+  char *endpos;
+  char *tp;
+
+  if(*endct) {
+    **endct = '\0';
+    *endct = NULL;
+  }
+  p += sizeof("headers=") - 1;
+  if(*p == '@' || *p == '<') {
+    char *hdrfile;
+    FILE *fp;
+    /* Read headers from a file. */
+    do {
+      p++;
+    } while(ISBLANK(*p));
+    tp = p;
+    hdrfile = get_param_word(&p, &endpos, endchar);
+    /* If not quoted, strip trailing spaces. */
+    if(hdrfile == tp)
+      while(endpos > hdrfile && ISBLANK(endpos[-1]))
+        endpos--;
+    *sep = *p;
+    *endpos = '\0';
+    fp = curlx_fopen(hdrfile, FOPEN_READTEXT);
+    if(!fp) {
+      char errbuf[STRERROR_LEN];
+      warnf("Cannot read from %s: %s", hdrfile,
+            curlx_strerror(errno, errbuf, sizeof(errbuf)));
+    }
+    else {
+      int i = read_field_headers(fp, pheaders);
+
+      curlx_fclose(fp);
+      if(i) {
+        curl_slist_free_all(*pheaders);
+        return -1;
+      }
+    }
+  }
+  else {
+    char *hdr;
+
+    while(ISBLANK(*p))
+      p++;
+    tp = p;
+    hdr = get_param_word(&p, &endpos, endchar);
+    /* If not quoted, strip trailing spaces. */
+    if(hdr == tp)
+      while(endpos > hdr && ISBLANK(endpos[-1]))
+        endpos--;
+    *sep = *p;
+    *endpos = '\0';
+    if(slist_append(pheaders, hdr)) {
+      errorf("Out of memory for field header");
+      curl_slist_free_all(*pheaders);
+      return -1;
+    }
+  }
+  *ptr = p;
+  return 0;
+}
+
+static void param_encoder(char **ptr, char **endct, char **pencoder,
+                          char endchar, char *sep)
+{
+  char *p = *ptr;
+  char *endpos;
+  char *tp;
+
+  if(*endct) {
+    **endct = '\0';
+    *endct = NULL;
+  }
+  for(p += sizeof("encoder=") - 1; ISBLANK(*p); p++)
+    ;
+  tp = p;
+  *pencoder = get_param_word(&p, &endpos, endchar);
+  /* If not quoted, strip trailing spaces. */
+  if(*pencoder == tp)
+    while(endpos > *pencoder && ISBLANK(endpos[-1]))
+      endpos--;
+  *sep = *p;
+  *endpos = '\0';
+  *ptr = p;
+}
+
+/**
+ * Parses a single parameter part and its associated metadata from a string.
+ *
+ * This function extracts a primary data word and scans for optional
+ * semicolon-separated attributes including 'type=', 'filename=', 'headers=',
+ * and 'encoder='.
+ *
+ * Used for parsing command-line form arguments or multipart/form-data
+ * attributes.
+ *
+ * @param endchar   The character that signifies the end of the entire
+ *                  parameter block (e.g., ',' or '\0').
+ * @param str       Pointer to the current position in the input string.
+ *                  Updated to point at the delimiter or terminator that
+ *                  ended the parsed part.
+ * @param pdata     Pointer to a char * that receives the primary data word.
+ * @param ptype     [out] Optional. Receives the extracted 'type=' value.
+ * @param pfilename [out] Optional. Receives the extracted 'filename=' value.
+ * @param pencoder  [out] Optional. Receives the extracted 'encoder=' value.
+ * @param pheaders  [out] Optional. Receives a pointer to a curl_slist
+ *                  containing extracted 'headers='.
+ *
+ * @return The character that terminated the parsing (casted to int),
+ *         or -1 on memory or parsing error.
+ */
+
+static int get_param_part(char endchar,
                           char **str, char **pdata, char **ptype,
                           char **pfilename, char **pencoder,
                           struct curl_slist **pheaders)
@@ -471,8 +675,6 @@ static int get_param_part(struct OperationConfig *config, char endchar,
   char *endpos;
   char *tp;
   char sep;
-  char type_major[128] = "";
-  char type_minor[128] = "";
   char *endct = NULL;
   struct curl_slist *headers = NULL;
 
@@ -484,143 +686,45 @@ static int get_param_part(struct OperationConfig *config, char endchar,
     *pheaders = NULL;
   if(pencoder)
     *pencoder = NULL;
-  while(ISSPACE(*p))
+  while(ISBLANK(*p))
     p++;
   tp = p;
-  *pdata = get_param_word(config, &p, &endpos, endchar);
+  *pdata = get_param_word(&p, &endpos, endchar);
   /* If not quoted, strip trailing spaces. */
   if(*pdata == tp)
-    while(endpos > *pdata && ISSPACE(endpos[-1]))
+    while(endpos > *pdata && ISBLANK(endpos[-1]))
       endpos--;
   sep = *p;
   *endpos = '\0';
   while(sep == ';') {
-    while(p++ && ISSPACE(*p))
+    while(p++ && ISBLANK(*p))
       ;
 
-    if(!endct && checkprefix("type=", p)) {
-      for(p += 5; ISSPACE(*p); p++)
-        ;
-      /* set type pointer */
-      type = p;
-
-      /* verify that this is a fine type specifier */
-      if(2 != sscanf(type, "%127[^/ ]/%127[^;, \n]", type_major, type_minor)) {
-        warnf(config->global, "Illegally formatted content-type field");
-        curl_slist_free_all(headers);
-        return -1; /* illegal content-type syntax! */
-      }
-
-      /* now point beyond the content-type specifier */
-      p = type + strlen(type_major) + strlen(type_minor) + 1;
-      for(endct = p; *p && *p != ';' && *p != endchar; p++)
-        if(!ISSPACE(*p))
-          endct = p + 1;
-      sep = *p;
-    }
-    else if(checkprefix("filename=", p)) {
-      if(endct) {
-        *endct = '\0';
-        endct = NULL;
-      }
-      for(p += 9; ISSPACE(*p); p++)
-        ;
-      tp = p;
-      filename = get_param_word(config, &p, &endpos, endchar);
-      /* If not quoted, strip trailing spaces. */
-      if(filename == tp)
-        while(endpos > filename && ISSPACE(endpos[-1]))
-          endpos--;
-      sep = *p;
-      *endpos = '\0';
-    }
+    if(!endct && checkprefix("type=", p))
+      param_type(&p, &type, &endct, &sep);
+    else if(checkprefix("filename=", p))
+      param_filename(&p, &endct, &filename, endchar, &sep);
     else if(checkprefix("headers=", p)) {
-      if(endct) {
-        *endct = '\0';
-        endct = NULL;
-      }
-      p += 8;
-      if(*p == '@' || *p == '<') {
-        char *hdrfile;
-        FILE *fp;
-        /* Read headers from a file. */
-
-        do {
-          p++;
-        } while(ISSPACE(*p));
-        tp = p;
-        hdrfile = get_param_word(config, &p, &endpos, endchar);
-        /* If not quoted, strip trailing spaces. */
-        if(hdrfile == tp)
-          while(endpos > hdrfile && ISSPACE(endpos[-1]))
-            endpos--;
-        sep = *p;
-        *endpos = '\0';
-        fp = fopen(hdrfile, FOPEN_READTEXT);
-        if(!fp)
-          warnf(config->global, "Cannot read from %s: %s", hdrfile,
-                strerror(errno));
-        else {
-          int i = read_field_headers(config, hdrfile, fp, &headers);
-
-          fclose(fp);
-          if(i) {
-            curl_slist_free_all(headers);
-            return -1;
-          }
-        }
-      }
-      else {
-        char *hdr;
-
-        while(ISSPACE(*p))
-          p++;
-        tp = p;
-        hdr = get_param_word(config, &p, &endpos, endchar);
-        /* If not quoted, strip trailing spaces. */
-        if(hdr == tp)
-          while(endpos > hdr && ISSPACE(endpos[-1]))
-            endpos--;
-        sep = *p;
-        *endpos = '\0';
-        if(slist_append(&headers, hdr)) {
-          errorf(config->global, "Out of memory for field header");
-          curl_slist_free_all(headers);
-          return -1;
-        }
-      }
-    }
-    else if(checkprefix("encoder=", p)) {
-      if(endct) {
-        *endct = '\0';
-        endct = NULL;
-      }
-      for(p += 8; ISSPACE(*p); p++)
-        ;
-      tp = p;
-      encoder = get_param_word(config, &p, &endpos, endchar);
-      /* If not quoted, strip trailing spaces. */
-      if(encoder == tp)
-        while(endpos > encoder && ISSPACE(endpos[-1]))
-          endpos--;
-      sep = *p;
-      *endpos = '\0';
+      if(param_headers(&p, &endct, &headers, endchar, &sep))
+        return -1;
     }
+    else if(checkprefix("encoder=", p))
+      param_encoder(&p, &endct, &encoder, endchar, &sep);
     else if(endct) {
       /* This is part of content type. */
       for(endct = p; *p && *p != ';' && *p != endchar; p++)
-        if(!ISSPACE(*p))
+        if(!ISBLANK(*p))
           endct = p + 1;
       sep = *p;
     }
     else {
       /* unknown prefix, skip to next block */
-      char *unknown = get_param_word(config, &p, &endpos, endchar);
+      char *unknown = get_param_word(&p, &endpos, endchar);
 
       sep = *p;
       *endpos = '\0';
       if(*unknown)
-        warnf(config->global, "skip unknown form field: %s", unknown);
+        warnf("skip unknown form field: %s", unknown);
     }
   }
 
@@ -631,25 +735,22 @@ static int get_param_part(struct OperationConfig *config, char endchar,
   if(ptype)
     *ptype = type;
   else if(type)
-    warnf(config->global, "Field content type not allowed here: %s", type);
+    warnf("Field content type not allowed here: %s", type);
 
   if(pfilename)
     *pfilename = filename;
   else if(filename)
-    warnf(config->global,
-          "Field file name not allowed here: %s", filename);
+    warnf("Field filename not allowed here: %s", filename);
 
   if(pencoder)
     *pencoder = encoder;
   else if(encoder)
-    warnf(config->global,
-          "Field encoder not allowed here: %s", encoder);
+    warnf("Field encoder not allowed here: %s", encoder);
 
   if(pheaders)
     *pheaders = headers;
   else if(headers) {
-    warnf(config->global,
-          "Field headers not allowed here: %s", headers->data);
+    warnf("Field headers not allowed here: %s", headers->data);
     curl_slist_free_all(headers);
   }
 
@@ -657,7 +758,6 @@ static int get_param_part(struct OperationConfig *config, char endchar,
   return sep & 0xFF;
 }
 
-
 /***************************************************************************
  *
  * formparse()
@@ -691,37 +791,36 @@ static int get_param_part(struct OperationConfig *config, char endchar,
  * file and do like this:
  *
  * 'name=foo;headers=@headerfile' or why not
- * 'name=@filemame;headers=@headerfile'
+ * 'name=@filename;headers=@headerfile'
  *
- * To upload a file, but to fake the file name that will be included in the
+ * To upload a file, but to fake the filename that is included in the
  * formpost, do like this:
  *
  * 'name=@filename;filename=/dev/null' or quote the faked filename like:
  * 'name=@filename;filename="play, play, and play.txt"'
  *
  * If filename/path contains ',' or ';', it must be quoted by double-quotes,
- * else curl will fail to figure out the correct filename. if the filename
- * tobe quoted contains '"' or '\', '"' and '\' must be escaped by backslash.
+ * else curl fails to figure out the correct filename. if the filename to be
+ * quoted contains '"' or '\', '"' and '\' must be escaped by backslash.
  *
  ***************************************************************************/
 
-#define SET_TOOL_MIME_PTR(m, field)                                     \
-  do {                                                                  \
-    if(field) {                                                         \
-      (m)->field = strdup(field);                                       \
-      if(!(m)->field)                                                   \
-        goto fail;                                                      \
-    }                                                                   \
+#define SET_TOOL_MIME_PTR(m, field)     \
+  do {                                  \
+    if(field) {                         \
+      (m)->field = curlx_strdup(field); \
+      if(!(m)->field)                   \
+        goto fail;                      \
+    }                                   \
   } while(0)
 
-int formparse(struct OperationConfig *config,
-              const char *input,
+int formparse(const char *input,
               struct tool_mime **mimeroot,
               struct tool_mime **mimecurrent,
               bool literal_value)
 {
-  /* input MUST be a string in the format 'name=contents' and we'll
-     build a linked list with the info */
+  /* input MUST be a string in the format 'name=contents' and we build
+     a linked list with the info */
   char *name = NULL;
   char *contents = NULL;
   char *contp;
@@ -731,7 +830,7 @@ int formparse(struct OperationConfig *config,
   char *encoder = NULL;
   struct curl_slist *headers = NULL;
   struct tool_mime *part = NULL;
-  CURLcode res;
+  CURLcode result;
   int err = 1;
 
   /* Allocate the main mime structure if needed. */
@@ -743,7 +842,7 @@ int formparse(struct OperationConfig *config,
   }
 
   /* Make a copy we can overwrite. */
-  contents = strdup(input);
+  contents = curlx_strdup(input);
   if(!contents)
     goto fail;
 
@@ -757,8 +856,7 @@ int formparse(struct OperationConfig *config,
 
     if(*contp == '(' && !literal_value) {
       /* Starting a multipart. */
-      sep = get_param_part(config, '\0',
-                           &contp, &data, &type, NULL, NULL, &headers);
+      sep = get_param_part('\0', &contp, &data, &type, NULL, NULL, &headers);
       if(sep < 0)
         goto fail;
       part = tool_mime_new_parts(*mimecurrent);
@@ -772,14 +870,14 @@ int formparse(struct OperationConfig *config,
     else if(!name && !strcmp(contp, ")") && !literal_value) {
       /* Ending a multipart. */
       if(*mimecurrent == *mimeroot) {
-        warnf(config->global, "no multipart to terminate");
+        warnf("no multipart to terminate");
         goto fail;
       }
       *mimecurrent = (*mimecurrent)->parent;
     }
     else if('@' == contp[0] && !literal_value) {
 
-      /* we use the @-letter to indicate file name(s) */
+      /* we use the @-letter to indicate filename(s) */
 
       struct tool_mime *subparts = NULL;
 
@@ -787,7 +885,7 @@ int formparse(struct OperationConfig *config,
         /* since this was a file, it may have a content-type specifier
            at the end too, or a filename. Or both. */
         ++contp;
-        sep = get_param_part(config, ',', &contp,
+        sep = get_param_part(',', &contp,
                              &data, &type, &filename, &encoder, &headers);
         if(sep < 0) {
           goto fail;
@@ -806,69 +904,61 @@ int formparse(struct OperationConfig *config,
         }
 
         /* Store that file in a part. */
-        part = tool_mime_new_filedata(subparts, data, TRUE, &res);
+        part = tool_mime_new_filedata(subparts, data, TRUE, &result);
         if(!part)
           goto fail;
         part->headers = headers;
         headers = NULL;
-        part->config = config->global;
-        if(res == CURLE_READ_ERROR) {
-            /* An error occurred while reading stdin: if read has started,
-               issue the error now. Else, delay it until processed by
-               libcurl. */
+        if(result == CURLE_READ_ERROR) {
+          /* An error occurred while reading stdin: if read has started,
+             issue the error now. Else, delay it until processed by libcurl. */
           if(part->size > 0) {
-            warnf(config->global,
-                  "error while reading standard input");
+            warnf("error while reading standard input");
             goto fail;
           }
-          Curl_safefree(part->data);
-          part->data = NULL;
+          curlx_safefree(part->data);
           part->size = -1;
-          res = CURLE_OK;
+          result = CURLE_OK;
         }
         SET_TOOL_MIME_PTR(part, filename);
         SET_TOOL_MIME_PTR(part, type);
         SET_TOOL_MIME_PTR(part, encoder);
 
-        /* *contp could be '\0', so we just check with the delimiter */
-      } while(sep); /* loop if there's another file name */
+        /* *contp could be '\0', so we check with the delimiter */
+      } while(sep == ','); /* loop if there is another filename */
       part = (*mimecurrent)->subparts;  /* Set name on group. */
     }
     else {
       if(*contp == '<' && !literal_value) {
         ++contp;
-        sep = get_param_part(config, '\0', &contp,
+        sep = get_param_part('\0', &contp,
                              &data, &type, NULL, &encoder, &headers);
         if(sep < 0)
           goto fail;
 
-        part = tool_mime_new_filedata(*mimecurrent, data, FALSE,
-                                      &res);
+        part = tool_mime_new_filedata(*mimecurrent, data, FALSE, &result);
         if(!part)
           goto fail;
         part->headers = headers;
         headers = NULL;
-        part->config = config->global;
-        if(res == CURLE_READ_ERROR) {
-            /* An error occurred while reading stdin: if read has started,
-               issue the error now. Else, delay it until processed by
-               libcurl. */
+        if(result == CURLE_READ_ERROR) {
+          /* An error occurred while reading stdin: if read has started,
+             issue the error now. Else, delay it until processed by
+             libcurl. */
           if(part->size > 0) {
-            warnf(config->global,
-                  "error while reading standard input");
+            warnf("error while reading standard input");
             goto fail;
           }
-          Curl_safefree(part->data);
-          part->data = NULL;
+          curlx_safefree(part->data);
           part->size = -1;
-          res = CURLE_OK;
+          result = CURLE_OK;
         }
       }
       else {
         if(literal_value)
           data = contp;
         else {
-          sep = get_param_part(config, '\0', &contp,
+          sep = get_param_part('\0', &contp,
                                &data, &type, &filename, &encoder, &headers);
           if(sep < 0)
             goto fail;
@@ -886,9 +976,8 @@ int formparse(struct OperationConfig *config,
       SET_TOOL_MIME_PTR(part, encoder);
 
       if(sep) {
-        *contp = (char) sep;
-        warnf(config->global,
-              "garbage at end of field specification: %s", contp);
+        *contp = (char)sep;
+        warnf("garbage at end of field specification: %s", contp);
       }
     }
 
@@ -896,12 +985,12 @@ int formparse(struct OperationConfig *config,
     SET_TOOL_MIME_PTR(part, name);
   }
   else {
-    warnf(config->global, "Illegally formatted input field");
+    warnf("Illegally formatted input field");
     goto fail;
   }
   err = 0;
 fail:
-  Curl_safefree(contents);
+  curlx_safefree(contents);
   curl_slist_free_all(headers);
   return err;
 }
diff --git a/third-party/curl/src/tool_formparse.h b/third-party/curl/src/tool_formparse.h
index 35d5c952d5..9df5cb7b7a 100644
--- a/third-party/curl/src/tool_formparse.h
+++ b/third-party/curl/src/tool_formparse.h
@@ -55,15 +55,9 @@ struct tool_mime {
   curl_off_t origin;            /* Stdin read origin offset. */
   curl_off_t size;              /* Stdin data size. */
   curl_off_t curpos;            /* Stdin current read position. */
-  struct GlobalConfig *config;  /* For access from callback. */
 };
 
-size_t tool_mime_stdin_read(char *buffer,
-                            size_t size, size_t nitems, void *arg);
-int tool_mime_stdin_seek(void *instream, curl_off_t offset, int whence);
-
-int formparse(struct OperationConfig *config,
-              const char *input,
+int formparse(const char *input,
               struct tool_mime **mimeroot,
               struct tool_mime **mimecurrent,
               bool literal_value);
diff --git a/third-party/curl/src/tool_getparam.c b/third-party/curl/src/tool_getparam.c
index e4467628d5..35c01b1d92 100644
--- a/third-party/curl/src/tool_getparam.c
+++ b/third-party/curl/src/tool_getparam.c
@@ -23,13 +23,6 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#include "strcase.h"
-
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
-
-#include "tool_binmode.h"
 #include "tool_cfgable.h"
 #include "tool_cb_prg.h"
 #include "tool_filetime.h"
@@ -41,347 +34,365 @@
 #include "tool_paramhlp.h"
 #include "tool_parsecfg.h"
 #include "tool_main.h"
-#include "dynbuf.h"
 #include "tool_stderr.h"
+#include "tool_help.h"
 #include "var.h"
 
-#include "memdebug.h" /* keep this as LAST include */
+#define ALLOW_BLANK TRUE
+#define DENY_BLANK  FALSE
 
-#ifdef MSDOS
-#  define USE_WATT32
-#endif
+static ParameterError getstr(char **str, const char *val, bool allowblank)
+{
+  if(*str)
+    curlx_safefree(*str);
+  DEBUGASSERT(val);
+  if(!allowblank && !val[0])
+    return PARAM_BLANK_STRING;
 
-#define GetStr(str,val) do {                    \
-    if(*(str)) {                                \
-      free(*(str));                             \
-      *(str) = NULL;                            \
-    }                                           \
-    if((val)) {                                 \
-      *(str) = strdup((val));                   \
-      if(!(*(str))) {                           \
-        err = PARAM_NO_MEM;                     \
-        goto error;                             \
-      }                                         \
-    }                                           \
-  } while(0)
+  *str = curlx_strdup(val);
+  if(!*str)
+    return PARAM_NO_MEM;
 
-struct LongShort {
-  const char *letter; /* short name option */
-  const char *lname;  /* long name option */
-  enum {
-    ARG_NONE,   /* stand-alone but not a boolean */
-    ARG_BOOL,   /* accepts a --no-[name] prefix */
-    ARG_STRING, /* requires an argument */
-    ARG_FILENAME /* requires an argument, usually a file name */
-  } desc;
-};
+  return PARAM_OK;
+}
 
+static ParameterError getstrn(char **str, const char *val,
+                              size_t len, bool allowblank)
+{
+  if(*str)
+    curlx_safefree(*str);
+  DEBUGASSERT(val);
+  if(!allowblank && !val[0])
+    return PARAM_BLANK_STRING;
+
+  *str = curlx_memdup0(val, len);
+  if(!*str)
+    return PARAM_NO_MEM;
+
+  return PARAM_OK;
+}
+
+/* this array MUST be alphasorted based on the 'lname' */
 static const struct LongShort aliases[]= {
-  /* 'letter' strings with more than one character have *no* short option to
-     mention. */
-  {"*@", "url",                      ARG_STRING},
-  {"*4", "dns-ipv4-addr",            ARG_STRING},
-  {"*6", "dns-ipv6-addr",            ARG_STRING},
-  {"*a", "random-file",              ARG_FILENAME},
-  {"*b", "egd-file",                 ARG_STRING},
-  {"*B", "oauth2-bearer",            ARG_STRING},
-  {"*c", "connect-timeout",          ARG_STRING},
-  {"*C", "doh-url"        ,          ARG_STRING},
-  {"*d", "ciphers",                  ARG_STRING},
-  {"*D", "dns-interface",            ARG_STRING},
-  {"*e", "disable-epsv",             ARG_BOOL},
-  {"*f", "disallow-username-in-url", ARG_BOOL},
-  {"*E", "epsv",                     ARG_BOOL},
-         /* 'epsv' made like this to make --no-epsv and --epsv to work
-             although --disable-epsv is the documented option */
-  {"*F", "dns-servers",              ARG_STRING},
-  {"*g", "trace",                    ARG_FILENAME},
-  {"*G", "npn",                      ARG_BOOL},
-  {"*h", "trace-ascii",              ARG_FILENAME},
-  {"*H", "alpn",                     ARG_BOOL},
-  {"*i", "limit-rate",               ARG_STRING},
-  {"*I", "rate",                     ARG_STRING},
-  {"*j", "compressed",               ARG_BOOL},
-  {"*J", "tr-encoding",              ARG_BOOL},
-  {"*k", "digest",                   ARG_BOOL},
-  {"*l", "negotiate",                ARG_BOOL},
-  {"*m", "ntlm",                     ARG_BOOL},
-  {"*M", "ntlm-wb",                  ARG_BOOL},
-  {"*n", "basic",                    ARG_BOOL},
-  {"*o", "anyauth",                  ARG_BOOL},
-#ifdef USE_WATT32
-  {"*p", "wdebug",                   ARG_BOOL},
+  {"abstract-unix-socket",       ARG_FILE, ' ', C_ABSTRACT_UNIX_SOCKET},
+  {"alpn",                       ARG_BOOL|ARG_NO|ARG_TLS, ' ', C_ALPN},
+  {"alt-svc",                    ARG_STRG, ' ', C_ALT_SVC},
+  {"anyauth",                    ARG_NONE, ' ', C_ANYAUTH},
+  {"append",                     ARG_BOOL, 'a', C_APPEND},
+  {"aws-sigv4",                  ARG_STRG, ' ', C_AWS_SIGV4},
+  {"basic",                      ARG_BOOL, ' ', C_BASIC},
+  {"buffer",                     ARG_BOOL|ARG_NO, 'N', C_BUFFER},
+  {"ca-native",                  ARG_BOOL|ARG_TLS, ' ', C_CA_NATIVE},
+  {"cacert",                     ARG_FILE|ARG_TLS, ' ', C_CACERT},
+  {"capath",                     ARG_FILE|ARG_TLS, ' ', C_CAPATH},
+  {"cert",                       ARG_FILE|ARG_TLS|ARG_CLEAR, 'E', C_CERT},
+  {"cert-status",                ARG_BOOL|ARG_TLS, ' ', C_CERT_STATUS},
+  {"cert-type",                  ARG_STRG|ARG_TLS, ' ', C_CERT_TYPE},
+  {"ciphers",                    ARG_STRG|ARG_TLS, ' ', C_CIPHERS},
+  {"clobber",                    ARG_BOOL|ARG_NO, ' ', C_CLOBBER},
+  {"compressed",                 ARG_BOOL, ' ', C_COMPRESSED},
+  {"compressed-ssh",             ARG_BOOL, ' ', C_COMPRESSED_SSH},
+  {"config",                     ARG_FILE, 'K', C_CONFIG},
+  {"connect-timeout",            ARG_SECS, ' ', C_CONNECT_TIMEOUT},
+  {"connect-to",                 ARG_STRG, ' ', C_CONNECT_TO},
+  {"continue-at",                ARG_STRG, 'C', C_CONTINUE_AT},
+  {"cookie",                     ARG_STRG, 'b', C_COOKIE},
+  {"cookie-jar",                 ARG_STRG, 'c', C_COOKIE_JAR},
+  {"create-dirs",                ARG_BOOL, ' ', C_CREATE_DIRS},
+  {"create-file-mode",           ARG_STRG, ' ', C_CREATE_FILE_MODE},
+  {"crlf",                       ARG_BOOL, ' ', C_CRLF},
+  {"crlfile",                    ARG_FILE|ARG_TLS, ' ', C_CRLFILE},
+  {"curves",                     ARG_STRG|ARG_TLS, ' ', C_CURVES},
+  {"data",                       ARG_STRG, 'd', C_DATA},
+  {"data-ascii",                 ARG_STRG, ' ', C_DATA_ASCII},
+  {"data-binary",                ARG_STRG, ' ', C_DATA_BINARY},
+  {"data-raw",                   ARG_STRG, ' ', C_DATA_RAW},
+  {"data-urlencode",             ARG_STRG, ' ', C_DATA_URLENCODE},
+  {"delegation",                 ARG_STRG, ' ', C_DELEGATION},
+  {"digest",                     ARG_BOOL, ' ', C_DIGEST},
+  {"disable",                    ARG_BOOL, 'q', C_DISABLE},
+  {"disable-eprt",               ARG_BOOL, ' ', C_DISABLE_EPRT},
+  {"disable-epsv",               ARG_BOOL, ' ', C_DISABLE_EPSV},
+  {"disallow-username-in-url",   ARG_BOOL, ' ', C_DISALLOW_USERNAME_IN_URL},
+  {"dns-interface",              ARG_STRG, ' ', C_DNS_INTERFACE},
+  {"dns-ipv4-addr",              ARG_STRG, ' ', C_DNS_IPV4_ADDR},
+  {"dns-ipv6-addr",              ARG_STRG, ' ', C_DNS_IPV6_ADDR},
+  {"dns-servers",                ARG_STRG, ' ', C_DNS_SERVERS},
+  {"doh-cert-status",            ARG_BOOL|ARG_TLS, ' ', C_DOH_CERT_STATUS},
+  {"doh-insecure",               ARG_BOOL|ARG_TLS, ' ', C_DOH_INSECURE},
+  {"doh-url",                    ARG_STRG, ' ', C_DOH_URL},
+  {"dump-ca-embed",              ARG_NONE|ARG_TLS, ' ', C_DUMP_CA_EMBED},
+  {"dump-header",                ARG_FILE, 'D', C_DUMP_HEADER},
+  {"ech",                        ARG_STRG|ARG_TLS, ' ', C_ECH},
+  {"egd-file",                   ARG_STRG|ARG_DEPR, ' ', C_EGD_FILE},
+  {"engine",                     ARG_STRG|ARG_TLS, ' ', C_ENGINE},
+  {"eprt",                       ARG_BOOL, ' ', C_EPRT},
+  {"epsv",                       ARG_BOOL, ' ', C_EPSV},
+  {"etag-compare",               ARG_FILE, ' ', C_ETAG_COMPARE},
+  {"etag-save",                  ARG_FILE, ' ', C_ETAG_SAVE},
+  {"expect100-timeout",          ARG_SECS, ' ', C_EXPECT100_TIMEOUT},
+  {"fail",                       ARG_BOOL, 'f', C_FAIL},
+  {"fail-early",                 ARG_BOOL, ' ', C_FAIL_EARLY},
+  {"fail-with-body",             ARG_BOOL, ' ', C_FAIL_WITH_BODY},
+  {"false-start",                ARG_BOOL, ' ', C_FALSE_START},
+  {"follow",                     ARG_BOOL, ' ', C_FOLLOW},
+  {"form",                       ARG_STRG, 'F', C_FORM},
+  {"form-escape",                ARG_BOOL, ' ', C_FORM_ESCAPE},
+  {"form-string",                ARG_STRG, ' ', C_FORM_STRING},
+  {"ftp-account",                ARG_STRG, ' ', C_FTP_ACCOUNT},
+  {"ftp-alternative-to-user",    ARG_STRG, ' ', C_FTP_ALTERNATIVE_TO_USER},
+  {"ftp-create-dirs",            ARG_BOOL, ' ', C_FTP_CREATE_DIRS},
+  {"ftp-method",                 ARG_STRG, ' ', C_FTP_METHOD},
+  {"ftp-pasv",                   ARG_NONE, ' ', C_FTP_PASV},
+  {"ftp-port",                   ARG_STRG, 'P', C_FTP_PORT},
+  {"ftp-pret",                   ARG_BOOL, ' ', C_FTP_PRET},
+  {"ftp-skip-pasv-ip",           ARG_BOOL, ' ', C_FTP_SKIP_PASV_IP},
+  {"ftp-ssl",                    ARG_BOOL|ARG_TLS, ' ', C_FTP_SSL},
+  {"ftp-ssl-ccc",                ARG_BOOL|ARG_TLS, ' ', C_FTP_SSL_CCC},
+  {"ftp-ssl-ccc-mode",           ARG_STRG|ARG_TLS, ' ', C_FTP_SSL_CCC_MODE},
+  {"ftp-ssl-control",            ARG_BOOL|ARG_TLS, ' ', C_FTP_SSL_CONTROL},
+  {"ftp-ssl-reqd",               ARG_BOOL|ARG_TLS, ' ', C_FTP_SSL_REQD},
+  {"get",                        ARG_BOOL, 'G', C_GET},
+  {"globoff",                    ARG_BOOL, 'g', C_GLOBOFF},
+  {"happy-eyeballs-timeout-ms",  ARG_UNUM, ' ', C_HAPPY_EYEBALLS_TIMEOUT_MS},
+  {"haproxy-clientip",           ARG_STRG, ' ', C_HAPROXY_CLIENTIP},
+  {"haproxy-protocol",           ARG_BOOL, ' ', C_HAPROXY_PROTOCOL},
+  {"head",                       ARG_BOOL, 'I', C_HEAD},
+  {"header",                     ARG_STRG, 'H', C_HEADER},
+  {"help",                       ARG_STRG, 'h', C_HELP},
+  {"hostpubmd5",                 ARG_STRG, ' ', C_HOSTPUBMD5},
+  {"hostpubsha256",              ARG_STRG, ' ', C_HOSTPUBSHA256},
+  {"hsts",                       ARG_STRG|ARG_TLS, ' ', C_HSTS},
+  {"http0.9",                    ARG_BOOL, ' ', C_HTTP0_9},
+  {"http1.0",                    ARG_NONE, '0', C_HTTP1_0},
+  {"http1.1",                    ARG_NONE, ' ', C_HTTP1_1},
+  {"http2",                      ARG_NONE, ' ', C_HTTP2},
+  {"http2-prior-knowledge",      ARG_NONE, ' ', C_HTTP2_PRIOR_KNOWLEDGE},
+  {"http3",                      ARG_NONE|ARG_TLS, ' ', C_HTTP3},
+  {"http3-only",                 ARG_NONE|ARG_TLS, ' ', C_HTTP3_ONLY},
+  {"ignore-content-length",      ARG_BOOL, ' ', C_IGNORE_CONTENT_LENGTH},
+  {"include",                    ARG_BOOL, ' ', C_INCLUDE},
+  {"insecure",                   ARG_BOOL, 'k', C_INSECURE},
+  {"interface",                  ARG_STRG, ' ', C_INTERFACE},
+  {"ip-tos",                     ARG_STRG, ' ', C_IP_TOS},
+#ifndef CURL_DISABLE_IPFS
+  {"ipfs-gateway",               ARG_STRG, ' ', C_IPFS_GATEWAY},
 #endif
-  {"*q", "ftp-create-dirs",          ARG_BOOL},
-  {"*r", "create-dirs",              ARG_BOOL},
-  {"*R", "create-file-mode",         ARG_STRING},
-  {"*s", "max-redirs",               ARG_STRING},
-  {"*t", "proxy-ntlm",               ARG_BOOL},
-  {"*u", "crlf",                     ARG_BOOL},
-  {"*v", "stderr",                   ARG_FILENAME},
-  {"*V", "aws-sigv4",                ARG_STRING},
-  {"*w", "interface",                ARG_STRING},
-  {"*x", "krb",                      ARG_STRING},
-  {"*x", "krb4",                     ARG_STRING},
-         /* 'krb4' is the previous name */
-  {"*X", "haproxy-protocol",         ARG_BOOL},
-  {"*P", "haproxy-clientip",         ARG_STRING},
-  {"*y", "max-filesize",             ARG_STRING},
-  {"*z", "disable-eprt",             ARG_BOOL},
-  {"*Z", "eprt",                     ARG_BOOL},
-         /* 'eprt' made like this to make --no-eprt and --eprt to work
-             although --disable-eprt is the documented option */
-  {"*~", "xattr",                    ARG_BOOL},
-  {"$a", "ftp-ssl",                  ARG_BOOL},
-         /* 'ftp-ssl' deprecated name since 7.20.0 */
-  {"$a", "ssl",                      ARG_BOOL},
-         /* 'ssl' new option name in 7.20.0, previously this was ftp-ssl */
-  {"$b", "ftp-pasv",                 ARG_BOOL},
-  {"$c", "socks5",                   ARG_STRING},
-  {"$d", "tcp-nodelay",              ARG_BOOL},
-  {"$e", "proxy-digest",             ARG_BOOL},
-  {"$f", "proxy-basic",              ARG_BOOL},
-  {"$g", "retry",                    ARG_STRING},
-  {"$V", "retry-connrefused",        ARG_BOOL},
-  {"$h", "retry-delay",              ARG_STRING},
-  {"$i", "retry-max-time",           ARG_STRING},
-  {"$k", "proxy-negotiate",          ARG_BOOL},
-  {"$l", "form-escape",              ARG_BOOL},
-  {"$m", "ftp-account",              ARG_STRING},
-  {"$n", "proxy-anyauth",            ARG_BOOL},
-  {"$o", "trace-time",               ARG_BOOL},
-  {"$p", "ignore-content-length",    ARG_BOOL},
-  {"$q", "ftp-skip-pasv-ip",         ARG_BOOL},
-  {"$r", "ftp-method",               ARG_STRING},
-  {"$s", "local-port",               ARG_STRING},
-  {"$t", "socks4",                   ARG_STRING},
-  {"$T", "socks4a",                  ARG_STRING},
-  {"$u", "ftp-alternative-to-user",  ARG_STRING},
-  {"$v", "ftp-ssl-reqd",             ARG_BOOL},
-         /* 'ftp-ssl-reqd' deprecated name since 7.20.0 */
-  {"$v", "ssl-reqd",                 ARG_BOOL},
-         /* 'ssl-reqd' new in 7.20.0, previously this was ftp-ssl-reqd */
-  {"$w", "sessionid",                ARG_BOOL},
-         /* 'sessionid' listed as --no-sessionid in the help */
-  {"$x", "ftp-ssl-control",          ARG_BOOL},
-  {"$y", "ftp-ssl-ccc",              ARG_BOOL},
-  {"$j", "ftp-ssl-ccc-mode",         ARG_STRING},
-  {"$z", "libcurl",                  ARG_STRING},
-  {"$#", "raw",                      ARG_BOOL},
-  {"$0", "post301",                  ARG_BOOL},
-  {"$1", "keepalive",                ARG_BOOL},
-         /* 'keepalive' listed as --no-keepalive in the help */
-  {"$2", "socks5-hostname",          ARG_STRING},
-  {"$3", "keepalive-time",           ARG_STRING},
-  {"$4", "post302",                  ARG_BOOL},
-  {"$5", "noproxy",                  ARG_STRING},
-  {"$7", "socks5-gssapi-nec",        ARG_BOOL},
-  {"$8", "proxy1.0",                 ARG_STRING},
-  {"$9", "tftp-blksize",             ARG_STRING},
-  {"$A", "mail-from",                ARG_STRING},
-  {"$B", "mail-rcpt",                ARG_STRING},
-  {"$C", "ftp-pret",                 ARG_BOOL},
-  {"$D", "proto",                    ARG_STRING},
-  {"$E", "proto-redir",              ARG_STRING},
-  {"$F", "resolve",                  ARG_STRING},
-  {"$G", "delegation",               ARG_STRING},
-  {"$H", "mail-auth",                ARG_STRING},
-  {"$I", "post303",                  ARG_BOOL},
-  {"$J", "metalink",                 ARG_BOOL},
-  {"$6", "sasl-authzid",             ARG_STRING},
-  {"$K", "sasl-ir",                  ARG_BOOL },
-  {"$L", "test-event",               ARG_BOOL},
-  {"$M", "unix-socket",              ARG_FILENAME},
-  {"$N", "path-as-is",               ARG_BOOL},
-  {"$O", "socks5-gssapi-service",    ARG_STRING},
-         /* 'socks5-gssapi-service' merged with'proxy-service-name' and
-            deprecated since 7.49.0 */
-  {"$O", "proxy-service-name",       ARG_STRING},
-  {"$P", "service-name",             ARG_STRING},
-  {"$Q", "proto-default",            ARG_STRING},
-  {"$R", "expect100-timeout",        ARG_STRING},
-  {"$S", "tftp-no-options",          ARG_BOOL},
-  {"$U", "connect-to",               ARG_STRING},
-  {"$W", "abstract-unix-socket",     ARG_FILENAME},
-  {"$X", "tls-max",                  ARG_STRING},
-  {"$Y", "suppress-connect-headers", ARG_BOOL},
-  {"$Z", "compressed-ssh",           ARG_BOOL},
-  {"$~", "happy-eyeballs-timeout-ms", ARG_STRING},
-  {"$!", "retry-all-errors",         ARG_BOOL},
-  {"$%", "trace-ids",                ARG_BOOL},
-  {"$&", "trace-config",             ARG_STRING},
-  {"0",   "http1.0",                 ARG_NONE},
-  {"01",  "http1.1",                 ARG_NONE},
-  {"02",  "http2",                   ARG_NONE},
-  {"03",  "http2-prior-knowledge",   ARG_NONE},
-  {"04",  "http3",                   ARG_NONE},
-  {"05",  "http3-only",              ARG_NONE},
-  {"09",  "http0.9",                 ARG_BOOL},
-  {"0a",  "proxy-http2",             ARG_BOOL},
-  {"1",  "tlsv1",                    ARG_NONE},
-  {"10",  "tlsv1.0",                 ARG_NONE},
-  {"11",  "tlsv1.1",                 ARG_NONE},
-  {"12",  "tlsv1.2",                 ARG_NONE},
-  {"13",  "tlsv1.3",                 ARG_NONE},
-  {"1A", "tls13-ciphers",            ARG_STRING},
-  {"1B", "proxy-tls13-ciphers",      ARG_STRING},
-  {"2",  "sslv2",                    ARG_NONE},
-  {"3",  "sslv3",                    ARG_NONE},
-  {"4",  "ipv4",                     ARG_NONE},
-  {"6",  "ipv6",                     ARG_NONE},
-  {"a",  "append",                   ARG_BOOL},
-  {"A",  "user-agent",               ARG_STRING},
-  {"b",  "cookie",                   ARG_STRING},
-  {"ba", "alt-svc",                  ARG_STRING},
-  {"bb", "hsts",                     ARG_STRING},
-  {"B",  "use-ascii",                ARG_BOOL},
-  {"c",  "cookie-jar",               ARG_STRING},
-  {"C",  "continue-at",              ARG_STRING},
-  {"d",  "data",                     ARG_STRING},
-  {"dr", "data-raw",                 ARG_STRING},
-  {"da", "data-ascii",               ARG_STRING},
-  {"db", "data-binary",              ARG_STRING},
-  {"de", "data-urlencode",           ARG_STRING},
-  {"df", "json",                     ARG_STRING},
-  {"dg", "url-query",                ARG_STRING},
-  {"D",  "dump-header",              ARG_FILENAME},
-  {"e",  "referer",                  ARG_STRING},
-  {"E",  "cert",                     ARG_FILENAME},
-  {"Ea", "cacert",                   ARG_FILENAME},
-  {"Eb", "cert-type",                ARG_STRING},
-  {"Ec", "key",                      ARG_FILENAME},
-  {"Ed", "key-type",                 ARG_STRING},
-  {"Ee", "pass",                     ARG_STRING},
-  {"Ef", "engine",                   ARG_STRING},
-  {"EG", "ca-native",                ARG_BOOL},
-  {"EH", "proxy-ca-native",          ARG_BOOL},
-  {"Eg", "capath",                   ARG_FILENAME},
-  {"Eh", "pubkey",                   ARG_STRING},
-  {"Ei", "hostpubmd5",               ARG_STRING},
-  {"EF", "hostpubsha256",            ARG_STRING},
-  {"Ej", "crlfile",                  ARG_FILENAME},
-  {"Ek", "tlsuser",                  ARG_STRING},
-  {"El", "tlspassword",              ARG_STRING},
-  {"Em", "tlsauthtype",              ARG_STRING},
-  {"En", "ssl-allow-beast",          ARG_BOOL},
-  {"Eo", "ssl-auto-client-cert",     ARG_BOOL},
-  {"EO", "proxy-ssl-auto-client-cert", ARG_BOOL},
-  {"Ep", "pinnedpubkey",             ARG_STRING},
-  {"EP", "proxy-pinnedpubkey",       ARG_STRING},
-  {"Eq", "cert-status",              ARG_BOOL},
-  {"EQ", "doh-cert-status",          ARG_BOOL},
-  {"Er", "false-start",              ARG_BOOL},
-  {"Es", "ssl-no-revoke",            ARG_BOOL},
-  {"ES", "ssl-revoke-best-effort",   ARG_BOOL},
-  {"Et", "tcp-fastopen",             ARG_BOOL},
-  {"Eu", "proxy-tlsuser",            ARG_STRING},
-  {"Ev", "proxy-tlspassword",        ARG_STRING},
-  {"Ew", "proxy-tlsauthtype",        ARG_STRING},
-  {"Ex", "proxy-cert",               ARG_FILENAME},
-  {"Ey", "proxy-cert-type",          ARG_STRING},
-  {"Ez", "proxy-key",                ARG_FILENAME},
-  {"E0", "proxy-key-type",           ARG_STRING},
-  {"E1", "proxy-pass",               ARG_STRING},
-  {"E2", "proxy-ciphers",            ARG_STRING},
-  {"E3", "proxy-crlfile",            ARG_FILENAME},
-  {"E4", "proxy-ssl-allow-beast",    ARG_BOOL},
-  {"E5", "login-options",            ARG_STRING},
-  {"E6", "proxy-cacert",             ARG_FILENAME},
-  {"E7", "proxy-capath",             ARG_FILENAME},
-  {"E8", "proxy-insecure",           ARG_BOOL},
-  {"E9", "proxy-tlsv1",              ARG_NONE},
-  {"EA", "socks5-basic",             ARG_BOOL},
-  {"EB", "socks5-gssapi",            ARG_BOOL},
-  {"EC", "etag-save",                ARG_FILENAME},
-  {"ED", "etag-compare",             ARG_FILENAME},
-  {"EE", "curves",                   ARG_STRING},
-  {"f",  "fail",                     ARG_BOOL},
-  {"fa", "fail-early",               ARG_BOOL},
-  {"fb", "styled-output",            ARG_BOOL},
-  {"fc", "mail-rcpt-allowfails",     ARG_BOOL},
-  {"fd", "fail-with-body",           ARG_BOOL},
-  {"fe", "remove-on-error",          ARG_BOOL},
-  {"F",  "form",                     ARG_STRING},
-  {"Fs", "form-string",              ARG_STRING},
-  {"g",  "globoff",                  ARG_BOOL},
-  {"G",  "get",                      ARG_BOOL},
-  {"Ga", "request-target",           ARG_STRING},
-  {"h",  "help",                     ARG_BOOL},
-  {"H",  "header",                   ARG_STRING},
-  {"Hp", "proxy-header",             ARG_STRING},
-  {"i",  "include",                  ARG_BOOL},
-  {"I",  "head",                     ARG_BOOL},
-  {"j",  "junk-session-cookies",     ARG_BOOL},
-  {"J",  "remote-header-name",       ARG_BOOL},
-  {"k",  "insecure",                 ARG_BOOL},
-  {"kd", "doh-insecure",             ARG_BOOL},
-  {"K",  "config",                   ARG_FILENAME},
-  {"l",  "list-only",                ARG_BOOL},
-  {"L",  "location",                 ARG_BOOL},
-  {"Lt", "location-trusted",         ARG_BOOL},
-  {"m",  "max-time",                 ARG_STRING},
-  {"M",  "manual",                   ARG_BOOL},
-  {"n",  "netrc",                    ARG_BOOL},
-  {"no", "netrc-optional",           ARG_BOOL},
-  {"ne", "netrc-file",               ARG_FILENAME},
-  {"N",  "buffer",                   ARG_BOOL},
-         /* 'buffer' listed as --no-buffer in the help */
-  {"o",  "output",                   ARG_FILENAME},
-  {"O",  "remote-name",              ARG_BOOL},
-  {"Oa", "remote-name-all",          ARG_BOOL},
-  {"Ob", "output-dir",               ARG_STRING},
-  {"Oc", "clobber",                  ARG_BOOL},
-  {"p",  "proxytunnel",              ARG_BOOL},
-  {"P",  "ftp-port",                 ARG_STRING},
-  {"q",  "disable",                  ARG_BOOL},
-  {"Q",  "quote",                    ARG_STRING},
-  {"r",  "range",                    ARG_STRING},
-  {"R",  "remote-time",              ARG_BOOL},
-  {"s",  "silent",                   ARG_BOOL},
-  {"S",  "show-error",               ARG_BOOL},
-  {"t",  "telnet-option",            ARG_STRING},
-  {"T",  "upload-file",              ARG_FILENAME},
-  {"u",  "user",                     ARG_STRING},
-  {"U",  "proxy-user",               ARG_STRING},
-  {"v",  "verbose",                  ARG_BOOL},
-  {"V",  "version",                  ARG_BOOL},
-  {"w",  "write-out",                ARG_STRING},
-  {"x",  "proxy",                    ARG_STRING},
-  {"xa", "preproxy",                 ARG_STRING},
-  {"X",  "request",                  ARG_STRING},
-  {"Y",  "speed-limit",              ARG_STRING},
-  {"y",  "speed-time",               ARG_STRING},
-  {"z",  "time-cond",                ARG_STRING},
-  {"Z",  "parallel",                 ARG_BOOL},
-  {"Zb", "parallel-max",             ARG_STRING},
-  {"Zc", "parallel-immediate",       ARG_BOOL},
-  {"#",  "progress-bar",             ARG_BOOL},
-  {"#m", "progress-meter",           ARG_BOOL},
-  {":",  "next",                     ARG_NONE},
-  {":a", "variable",                 ARG_STRING},
+  {"ipv4",                       ARG_NONE, '4', C_IPV4},
+  {"ipv6",                       ARG_NONE, '6', C_IPV6},
+  {"json",                       ARG_STRG, ' ', C_JSON},
+  {"junk-session-cookies",       ARG_BOOL, 'j', C_JUNK_SESSION_COOKIES},
+  {"keepalive",                  ARG_BOOL|ARG_NO, ' ', C_KEEPALIVE},
+  {"keepalive-cnt",              ARG_UNUM, ' ', C_KEEPALIVE_CNT},
+  {"keepalive-time",             ARG_UNUM, ' ', C_KEEPALIVE_TIME},
+  {"key",                        ARG_FILE, ' ', C_KEY},
+  {"key-type",                   ARG_STRG|ARG_TLS, ' ', C_KEY_TYPE},
+  {"knownhosts",                 ARG_FILE, ' ', C_KNOWNHOSTS},
+  {"krb",                        ARG_STRG|ARG_DEPR, ' ', C_KRB},
+  {"krb4",                       ARG_STRG|ARG_DEPR, ' ', C_KRB4},
+  {"libcurl",                    ARG_STRG, ' ', C_LIBCURL},
+  {"limit-rate",                 ARG_STRG, ' ', C_LIMIT_RATE},
+  {"list-only",                  ARG_BOOL, 'l', C_LIST_ONLY},
+  {"local-port",                 ARG_STRG, ' ', C_LOCAL_PORT},
+  {"location",                   ARG_BOOL, 'L', C_LOCATION},
+  {"location-trusted",           ARG_BOOL, ' ', C_LOCATION_TRUSTED},
+  {"login-options",              ARG_STRG, ' ', C_LOGIN_OPTIONS},
+  {"mail-auth",                  ARG_STRG, ' ', C_MAIL_AUTH},
+  {"mail-from",                  ARG_STRG, ' ', C_MAIL_FROM},
+  {"mail-rcpt",                  ARG_STRG, ' ', C_MAIL_RCPT},
+  {"mail-rcpt-allowfails",       ARG_BOOL, ' ', C_MAIL_RCPT_ALLOWFAILS},
+  {"manual",                     ARG_BOOL, 'M', C_MANUAL},
+  {"max-filesize",               ARG_STRG, ' ', C_MAX_FILESIZE},
+  {"max-redirs",                 ARG_STRG, ' ', C_MAX_REDIRS},
+  {"max-time",                   ARG_SECS, 'm', C_MAX_TIME},
+  {"metalink",                   ARG_BOOL|ARG_DEPR, ' ', C_METALINK},
+  {"mptcp",                      ARG_BOOL, ' ', C_MPTCP},
+  {"negotiate",                  ARG_BOOL, ' ', C_NEGOTIATE},
+  {"netrc",                      ARG_BOOL, 'n', C_NETRC},
+  {"netrc-file",                 ARG_FILE, ' ', C_NETRC_FILE},
+  {"netrc-optional",             ARG_BOOL, ' ', C_NETRC_OPTIONAL},
+  {"next",                       ARG_NONE, ':', C_NEXT},
+  {"noproxy",                    ARG_STRG, ' ', C_NOPROXY},
+  {"npn",                        ARG_BOOL|ARG_DEPR, ' ', C_NPN},
+  {"ntlm",                       ARG_BOOL, ' ', C_NTLM},
+  {"ntlm-wb",                    ARG_BOOL|ARG_DEPR, ' ', C_NTLM_WB},
+  {"oauth2-bearer",              ARG_STRG|ARG_CLEAR, ' ', C_OAUTH2_BEARER},
+  {"out-null",                   ARG_BOOL, ' ', C_OUT_NULL},
+  {"output",                     ARG_FILE, 'o', C_OUTPUT},
+  {"output-dir",                 ARG_STRG, ' ', C_OUTPUT_DIR},
+  {"parallel",                   ARG_BOOL, 'Z', C_PARALLEL},
+  {"parallel-immediate",         ARG_BOOL, ' ', C_PARALLEL_IMMEDIATE},
+  {"parallel-max",               ARG_UNUM, ' ', C_PARALLEL_MAX},
+  {"parallel-max-host",          ARG_UNUM, ' ', C_PARALLEL_HOST},
+  {"pass",                       ARG_STRG|ARG_CLEAR, ' ', C_PASS},
+  {"path-as-is",                 ARG_BOOL, ' ', C_PATH_AS_IS},
+  {"pinnedpubkey",               ARG_STRG|ARG_TLS, ' ', C_PINNEDPUBKEY},
+  {"post301",                    ARG_BOOL, ' ', C_POST301},
+  {"post302",                    ARG_BOOL, ' ', C_POST302},
+  {"post303",                    ARG_BOOL, ' ', C_POST303},
+  {"preproxy",                   ARG_STRG, ' ', C_PREPROXY},
+  {"progress-bar",               ARG_BOOL, '#', C_PROGRESS_BAR},
+  {"progress-meter",             ARG_BOOL|ARG_NO, ' ', C_PROGRESS_METER},
+  {"proto",                      ARG_STRG, ' ', C_PROTO},
+  {"proto-default",              ARG_STRG, ' ', C_PROTO_DEFAULT},
+  {"proto-redir",                ARG_STRG, ' ', C_PROTO_REDIR},
+  {"proxy",                      ARG_STRG, 'x', C_PROXY},
+  {"proxy-anyauth",              ARG_BOOL, ' ', C_PROXY_ANYAUTH},
+  {"proxy-basic",                ARG_BOOL, ' ', C_PROXY_BASIC},
+  {"proxy-ca-native",            ARG_BOOL|ARG_TLS, ' ', C_PROXY_CA_NATIVE},
+  {"proxy-cacert",               ARG_FILE|ARG_TLS, ' ', C_PROXY_CACERT},
+  {"proxy-capath",               ARG_FILE|ARG_TLS, ' ', C_PROXY_CAPATH},
+  {"proxy-cert",                 ARG_FILE|ARG_TLS|ARG_CLEAR, ' ',
+   C_PROXY_CERT},
+  {"proxy-cert-type",            ARG_STRG|ARG_TLS, ' ', C_PROXY_CERT_TYPE},
+  {"proxy-ciphers",              ARG_STRG|ARG_TLS, ' ', C_PROXY_CIPHERS},
+  {"proxy-crlfile",              ARG_FILE|ARG_TLS, ' ', C_PROXY_CRLFILE},
+  {"proxy-digest",               ARG_BOOL, ' ', C_PROXY_DIGEST},
+  {"proxy-header",               ARG_STRG, ' ', C_PROXY_HEADER},
+  {"proxy-http2",                ARG_BOOL, ' ', C_PROXY_HTTP2},
+  {"proxy-http3",                ARG_BOOL, ' ', C_PROXY_HTTP3},
+  {"proxy-insecure",             ARG_BOOL, ' ', C_PROXY_INSECURE},
+  {"proxy-key",                  ARG_FILE|ARG_TLS, ' ', C_PROXY_KEY},
+  {"proxy-key-type",             ARG_STRG|ARG_TLS, ' ', C_PROXY_KEY_TYPE},
+  {"proxy-negotiate",            ARG_BOOL, ' ', C_PROXY_NEGOTIATE},
+  {"proxy-ntlm",                 ARG_BOOL, ' ', C_PROXY_NTLM},
+  {"proxy-pass",                 ARG_STRG|ARG_CLEAR, ' ', C_PROXY_PASS},
+  {"proxy-pinnedpubkey",         ARG_STRG|ARG_TLS, ' ', C_PROXY_PINNEDPUBKEY},
+  {"proxy-service-name",         ARG_STRG, ' ', C_PROXY_SERVICE_NAME},
+  {"proxy-ssl-allow-beast",      ARG_BOOL|ARG_TLS, ' ',
+   C_PROXY_SSL_ALLOW_BEAST},
+  {"proxy-ssl-auto-client-cert", ARG_BOOL|ARG_TLS, ' ',
+   C_PROXY_SSL_AUTO_CLIENT_CERT},
+  {"proxy-tls13-ciphers",        ARG_STRG|ARG_TLS, ' ', C_PROXY_TLS13_CIPHERS},
+  {"proxy-tlsauthtype",          ARG_STRG|ARG_TLS, ' ', C_PROXY_TLSAUTHTYPE},
+  {"proxy-tlspassword",  ARG_STRG|ARG_TLS|ARG_CLEAR, ' ', C_PROXY_TLSPASSWORD},
+  {"proxy-tlsuser",          ARG_STRG|ARG_TLS|ARG_CLEAR, ' ', C_PROXY_TLSUSER},
+  {"proxy-tlsv1",                ARG_NONE|ARG_TLS, ' ', C_PROXY_TLSV1},
+  {"proxy-user",                 ARG_STRG|ARG_CLEAR, 'U', C_PROXY_USER},
+  {"proxy1.0",                   ARG_STRG, ' ', C_PROXY1_0},
+  {"proxytunnel",                ARG_BOOL, 'p', C_PROXYTUNNEL},
+  {"pubkey",                     ARG_STRG, ' ', C_PUBKEY},
+  {"quote",                      ARG_STRG, 'Q', C_QUOTE},
+  {"random-file",                ARG_FILE|ARG_DEPR, ' ', C_RANDOM_FILE},
+  {"range",                      ARG_STRG, 'r', C_RANGE},
+  {"rate",                       ARG_STRG, ' ', C_RATE},
+  {"raw",                        ARG_BOOL, ' ', C_RAW},
+  {"referer",                    ARG_STRG, 'e', C_REFERER},
+  {"remote-header-name",         ARG_BOOL, 'J', C_REMOTE_HEADER_NAME},
+  {"remote-name",                ARG_BOOL, 'O', C_REMOTE_NAME},
+  {"remote-name-all",            ARG_BOOL, ' ', C_REMOTE_NAME_ALL},
+  {"remote-time",                ARG_BOOL, 'R', C_REMOTE_TIME},
+  {"remove-on-error",            ARG_BOOL, ' ', C_REMOVE_ON_ERROR},
+  {"request",                    ARG_STRG, 'X', C_REQUEST},
+  {"request-target",             ARG_STRG, ' ', C_REQUEST_TARGET},
+  {"resolve",                    ARG_STRG, ' ', C_RESOLVE},
+  {"retry",                      ARG_UNUM, ' ', C_RETRY},
+  {"retry-all-errors",           ARG_BOOL, ' ', C_RETRY_ALL_ERRORS},
+  {"retry-connrefused",          ARG_BOOL, ' ', C_RETRY_CONNREFUSED},
+  {"retry-delay",                ARG_SECS, ' ', C_RETRY_DELAY},
+  {"retry-max-time",             ARG_SECS, ' ', C_RETRY_MAX_TIME},
+  {"sasl-authzid",               ARG_STRG, ' ', C_SASL_AUTHZID},
+  {"sasl-ir",                    ARG_BOOL, ' ', C_SASL_IR},
+  {"service-name",               ARG_STRG, ' ', C_SERVICE_NAME},
+  {"sessionid",                  ARG_BOOL|ARG_NO, ' ', C_SESSIONID},
+  {"show-error",                 ARG_BOOL, 'S', C_SHOW_ERROR},
+  {"show-headers",               ARG_BOOL, 'i', C_SHOW_HEADERS},
+  {"sigalgs",                    ARG_STRG|ARG_TLS, ' ',
+   C_SIGNATURE_ALGORITHMS},
+  {"silent",                     ARG_BOOL, 's', C_SILENT},
+  {"skip-existing",              ARG_BOOL, ' ', C_SKIP_EXISTING},
+  {"socks4",                     ARG_STRG, ' ', C_SOCKS4},
+  {"socks4a",                    ARG_STRG, ' ', C_SOCKS4A},
+  {"socks5",                     ARG_STRG, ' ', C_SOCKS5},
+  {"socks5-basic",               ARG_BOOL, ' ', C_SOCKS5_BASIC},
+  {"socks5-gssapi",              ARG_BOOL, ' ', C_SOCKS5_GSSAPI},
+  {"socks5-gssapi-nec",          ARG_BOOL, ' ', C_SOCKS5_GSSAPI_NEC},
+  {"socks5-gssapi-service",      ARG_STRG, ' ', C_SOCKS5_GSSAPI_SERVICE},
+  {"socks5-hostname",            ARG_STRG, ' ', C_SOCKS5_HOSTNAME},
+  {"speed-limit",                ARG_UNUM, 'Y', C_SPEED_LIMIT},
+  {"speed-time",                 ARG_UNUM, 'y', C_SPEED_TIME},
+  {"ssl",                        ARG_BOOL|ARG_TLS, ' ', C_SSL},
+  {"ssl-allow-beast",            ARG_BOOL|ARG_TLS, ' ', C_SSL_ALLOW_BEAST},
+  {"ssl-auto-client-cert",       ARG_BOOL|ARG_TLS, ' ',
+   C_SSL_AUTO_CLIENT_CERT},
+  {"ssl-no-revoke",              ARG_BOOL|ARG_TLS, ' ', C_SSL_NO_REVOKE},
+  {"ssl-reqd",                   ARG_BOOL|ARG_TLS, ' ', C_SSL_REQD},
+  {"ssl-revoke-best-effort",     ARG_BOOL|ARG_TLS, ' ',
+   C_SSL_REVOKE_BEST_EFFORT},
+  {"ssl-sessions",               ARG_FILE|ARG_TLS, ' ', C_SSL_SESSIONS},
+  {"sslv2",                      ARG_NONE|ARG_DEPR, '2', C_SSLV2},
+  {"sslv3",                      ARG_NONE|ARG_DEPR, '3', C_SSLV3},
+  {"stderr",                     ARG_FILE, ' ', C_STDERR},
+  {"styled-output",              ARG_BOOL, ' ', C_STYLED_OUTPUT},
+  {"suppress-connect-headers",   ARG_BOOL, ' ', C_SUPPRESS_CONNECT_HEADERS},
+  {"tcp-fastopen",               ARG_BOOL, ' ', C_TCP_FASTOPEN},
+  {"tcp-nodelay",                ARG_BOOL, ' ', C_TCP_NODELAY},
+  {"telnet-option",              ARG_STRG, 't', C_TELNET_OPTION},
+#ifdef DEBUGBUILD
+  {"test-duphandle",             ARG_BOOL, ' ', C_TEST_DUPHANDLE},
+  {"test-event",                 ARG_BOOL, ' ', C_TEST_EVENT},
+#endif
+  {"tftp-blksize",               ARG_UNUM, ' ', C_TFTP_BLKSIZE},
+  {"tftp-no-options",            ARG_BOOL, ' ', C_TFTP_NO_OPTIONS},
+  {"time-cond",                  ARG_STRG, 'z', C_TIME_COND},
+  {"tls-earlydata",              ARG_BOOL|ARG_TLS, ' ', C_TLS_EARLYDATA},
+  {"tls-max",                    ARG_STRG|ARG_TLS, ' ', C_TLS_MAX},
+  {"tls13-ciphers",              ARG_STRG|ARG_TLS, ' ', C_TLS13_CIPHERS},
+  {"tlsauthtype",                ARG_STRG|ARG_TLS, ' ', C_TLSAUTHTYPE},
+  {"tlspassword",              ARG_STRG|ARG_TLS|ARG_CLEAR, ' ', C_TLSPASSWORD},
+  {"tlsuser",                    ARG_STRG|ARG_TLS|ARG_CLEAR, ' ', C_TLSUSER},
+  {"tlsv1",                      ARG_NONE|ARG_TLS, '1', C_TLSV1},
+  {"tlsv1.0",                    ARG_NONE|ARG_TLS, ' ', C_TLSV1_0},
+  {"tlsv1.1",                    ARG_NONE|ARG_TLS, ' ', C_TLSV1_1},
+  {"tlsv1.2",                    ARG_NONE|ARG_TLS, ' ', C_TLSV1_2},
+  {"tlsv1.3",                    ARG_NONE|ARG_TLS, ' ', C_TLSV1_3},
+  {"tr-encoding",                ARG_BOOL, ' ', C_TR_ENCODING},
+  {"trace",                      ARG_FILE, ' ', C_TRACE},
+  {"trace-ascii",                ARG_FILE, ' ', C_TRACE_ASCII},
+  {"trace-config",               ARG_STRG, ' ', C_TRACE_CONFIG},
+  {"trace-ids",                  ARG_BOOL, ' ', C_TRACE_IDS},
+  {"trace-time",                 ARG_BOOL, ' ', C_TRACE_TIME},
+  {"unix-socket",                ARG_FILE, ' ', C_UNIX_SOCKET},
+  {"upload-file",                ARG_FILE, 'T', C_UPLOAD_FILE},
+  {"upload-flags",               ARG_STRG, ' ', C_UPLOAD_FLAGS},
+  {"url",                        ARG_STRG, ' ', C_URL},
+  {"url-query",                  ARG_STRG, ' ', C_URL_QUERY},
+  {"use-ascii",                  ARG_BOOL, 'B', C_USE_ASCII},
+  {"user",                       ARG_STRG|ARG_CLEAR, 'u', C_USER},
+  {"user-agent",                 ARG_STRG, 'A', C_USER_AGENT},
+  {"variable",                   ARG_STRG, ' ', C_VARIABLE},
+  {"verbose",                    ARG_BOOL, 'v', C_VERBOSE},
+  {"version",                    ARG_BOOL, 'V', C_VERSION},
+  {"vlan-priority",              ARG_UNUM, ' ', C_VLAN_PRIORITY},
+#ifdef USE_WATT32
+  {"wdebug",                     ARG_BOOL, ' ', C_WDEBUG},
+#endif
+  {"write-out",                  ARG_STRG, 'w', C_WRITE_OUT},
+  {"xattr",                      ARG_BOOL, ' ', C_XATTR},
 };
 
 /* Split the argument of -E to 'certname' and 'passphrase' separated by colon.
  * We allow ':' and '\' to be escaped by '\' so that we can use certificate
- * nicknames containing ':'.  See <https://sourceforge.net/p/curl/bugs/1196/>
- * for details. */
-#ifndef UNITTESTS
-static
-#endif
-void parse_cert_parameter(const char *cert_parameter,
-                          char **certname,
-                          char **passphrase)
+ * nicknames containing ':'. See <https://sourceforge.net/p/curl/bugs/1196/>
+ * for details.
+ *
+ * Unit test 1394
+ */
+UNITTEST ParameterError parse_cert_parameter(const char *cert_parameter,
+                                             char **certname,
+                                             char **passphrase)
 {
   size_t param_length = strlen(cert_parameter);
   size_t span;
   const char *param_place = NULL;
   char *certname_place = NULL;
+  ParameterError err = PARAM_OK;
   *certname = NULL;
   *passphrase = NULL;
 
   /* most trivial assumption: cert_parameter is empty */
   if(param_length == 0)
-    return;
+    return PARAM_BLANK_STRING;
 
   /* next less trivial: cert_parameter starts 'pkcs11:' and thus
    * looks like a RFC7512 PKCS#11 URI which can be used as-is.
@@ -389,22 +400,26 @@ void parse_cert_parameter(const char *cert_parameter,
    * means no passphrase was given and no characters escaped */
   if(curl_strnequal(cert_parameter, "pkcs11:", 7) ||
      !strpbrk(cert_parameter, ":\\")) {
-    *certname = strdup(cert_parameter);
-    return;
+    *certname = curlx_strdup(cert_parameter);
+    if(!*certname)
+      return PARAM_NO_MEM;
+    return PARAM_OK;
   }
   /* deal with escaped chars; find unescaped colon if it exists */
-  certname_place = malloc(param_length + 1);
-  if(!certname_place)
-    return;
+  certname_place = curlx_malloc(param_length + 1);
+  if(!certname_place) {
+    err = PARAM_NO_MEM;
+    goto done;
+  }
 
   *certname = certname_place;
   param_place = cert_parameter;
   while(*param_place) {
     span = strcspn(param_place, ":\\");
-    strncpy(certname_place, param_place, span);
+    memcpy(certname_place, param_place, span);
     param_place += span;
     certname_place += span;
-    /* we just ate all the non-special chars. now we're on either a special
+    /* we ate all the non-special chars. now we are on either a special
      * char or the end of the string. */
     switch(*param_place) {
     case '\0':
@@ -412,34 +427,34 @@ void parse_cert_parameter(const char *cert_parameter,
     case '\\':
       param_place++;
       switch(*param_place) {
-        case '\0':
-          *certname_place++ = '\\';
-          break;
-        case '\\':
-          *certname_place++ = '\\';
-          param_place++;
-          break;
-        case ':':
-          *certname_place++ = ':';
-          param_place++;
-          break;
-        default:
-          *certname_place++ = '\\';
-          *certname_place++ = *param_place;
-          param_place++;
-          break;
+      case '\0':
+        *certname_place++ = '\\';
+        break;
+      case '\\':
+        *certname_place++ = '\\';
+        param_place++;
+        break;
+      case ':':
+        *certname_place++ = ':';
+        param_place++;
+        break;
+      default:
+        *certname_place++ = '\\';
+        *certname_place++ = *param_place;
+        param_place++;
+        break;
       }
       break;
     case ':':
-      /* Since we live in a world of weirdness and confusion, the win32
+      /* Since we live in a world of weirdness and confusion, the Windows
          dudes can use : when using drive letters and thus c:\file:password
          needs to work. In order not to break compatibility, we still use : as
-         separator, but we try to detect when it is used for a file name! On
-         windows. */
-#ifdef WIN32
+         separator, but we try to detect when it is used for a filename! On
+         Windows. */
+#ifdef _WIN32
       if((param_place == &cert_parameter[1]) &&
          (cert_parameter[2] == '\\' || cert_parameter[2] == '/') &&
-         (ISALPHA(cert_parameter[0])) ) {
+         ISALPHA(cert_parameter[0])) {
         /* colon in the second column, followed by a backslash, and the
            first character is an alphabetic letter:
 
@@ -450,16 +465,23 @@ void parse_cert_parameter(const char *cert_parameter,
       }
 #endif
       /* escaped colons and Windows drive letter colons were handled
-       * above; if we're still here, this is a separating colon */
+       * above; if we are still here, this is a separating colon */
       param_place++;
       if(*param_place) {
-        *passphrase = strdup(param_place);
+        *passphrase = curlx_strdup(param_place);
+        if(!*passphrase)
+          err = PARAM_NO_MEM;
       }
       goto done;
     }
   }
 done:
-  *certname_place = '\0';
+  if(err) {
+    curlx_safefree(*certname);
+  }
+  else
+    *certname_place = '\0';
+  return err;
 }
 
 /* Replace (in-place) '%20' by '+' according to RFC1866 */
@@ -476,7 +498,7 @@ static size_t replace_url_encoded_space_by_plus(char *url)
       url[new_index] = '+';
       orig_index += 3;
     }
-    else{
+    else {
       if(new_index != orig_index) {
         url[new_index] = url[orig_index];
       }
@@ -490,94 +512,139 @@ static size_t replace_url_encoded_space_by_plus(char *url)
   return new_index; /* new size */
 }
 
-static void
-GetFileAndPassword(char *nextarg, char **file, char **password)
+static ParameterError GetFileAndPassword(const char *nextarg, char **file,
+                                         char **password)
 {
   char *certname, *passphrase;
-  parse_cert_parameter(nextarg, &certname, &passphrase);
-  Curl_safefree(*file);
-  *file = certname;
-  if(passphrase) {
-    Curl_safefree(*password);
-    *password = passphrase;
+  ParameterError err;
+  /* nextarg is never NULL here */
+  err = parse_cert_parameter(nextarg, &certname, &passphrase);
+  if(!err) {
+    curlx_free(*file);
+    *file = certname;
+    if(passphrase) {
+      curlx_free(*password);
+      *password = passphrase;
+    }
   }
+  return err;
+}
+
+struct sizeunit {
+  char unit; /* single lowercase ASCII letter */
+  curl_off_t mul;
+  size_t mlen; /* number of digits in 'mul', when written in decimal */
+};
+
+static const struct sizeunit *getunit(char unit)
+{
+  static const struct sizeunit list[] = {
+    { 'p', (curl_off_t)1125899906842624, 16 }, /* Peta */
+    { 't', (curl_off_t)1099511627776,    13 }, /* Tera */
+    { 'g', 1073741824,                   10 }, /* Giga */
+    { 'm', 1048576,                       7 }, /* Mega */
+    { 'k', 1024,                          4 }, /* Kilo */
+  };
+
+  size_t i;
+  for(i = 0; i < CURL_ARRAYSIZE(list); i++)
+    if((unit | 0x20) == list[i].unit)
+      return &list[i];
+  return NULL;
 }
 
 /* Get a size parameter for '--limit-rate' or '--max-filesize'.
- * We support a 'G', 'M' or 'K' suffix too.
-  */
-static ParameterError GetSizeParameter(struct GlobalConfig *global,
-                                       const char *arg,
-                                       const char *which,
-                                       curl_off_t *value_out)
+   We support P, T, G, M and K (case insensitive) suffixes.
+
+   Unit test 1623
+ */
+UNITTEST ParameterError GetSizeParameter(const char *arg, curl_off_t *out)
 {
-  char *unit;
+  const char *unit = arg;
   curl_off_t value;
+  curl_off_t prec = 0;
+  size_t plen = 0;
+  curl_off_t add = 0;
+  curl_off_t mul = 1;
+  int rc;
 
-  if(curlx_strtoofft(arg, &unit, 10, &value)) {
-    warnf(global, "invalid number specified for %s", which);
-    return PARAM_BAD_USE;
+  rc = curlx_str_number(&unit, &value, CURL_OFF_T_MAX);
+  if(rc == STRE_OVERFLOW)
+    return PARAM_NUMBER_TOO_LARGE;
+  else if(rc)
+    return PARAM_BAD_NUMERIC;
+
+  if(!curlx_str_single(&unit, '.')) {
+    const char *s = unit;
+    if(curlx_str_number(&unit, &prec, CURL_OFF_T_MAX))
+      return PARAM_BAD_NUMERIC;
+    plen = unit - s;
   }
 
-  if(!*unit)
-    unit = (char *)"b";
-  else if(strlen(unit) > 1)
-    unit = (char *)"w"; /* unsupported */
-
-  switch(*unit) {
-  case 'G':
-  case 'g':
-    if(value > (CURL_OFF_T_MAX / (1024*1024*1024)))
-      return PARAM_NUMBER_TOO_LARGE;
-    value *= 1024*1024*1024;
-    break;
-  case 'M':
-  case 'm':
-    if(value > (CURL_OFF_T_MAX / (1024*1024)))
-      return PARAM_NUMBER_TOO_LARGE;
-    value *= 1024*1024;
-    break;
-  case 'K':
-  case 'k':
-    if(value > (CURL_OFF_T_MAX / 1024))
-      return PARAM_NUMBER_TOO_LARGE;
-    value *= 1024;
-    break;
-  case 'b':
-  case 'B':
-    /* for plain bytes, leave as-is */
-    break;
-  default:
-    warnf(global, "unsupported %s unit. Use G, M, K or B", which);
+  if(strlen(unit) > 1)
     return PARAM_BAD_USE;
+  else if(!*unit || ((*unit | 0x20) == 'b')) {
+    if(plen)
+      /* cannot handle partial bytes */
+      return PARAM_BAD_USE;
   }
-  *value_out = value;
+  else {
+    const struct sizeunit *su = getunit(*unit);
+    if(!su)
+      return PARAM_BAD_USE;
+    mul = su->mul;
+
+    if(prec) {
+      /* precision was provided */
+      curl_off_t frac = 1;
+
+      /* too many precision digits, trim them */
+      while(su->mlen <= plen) {
+        prec /= 10;
+        plen--;
+      }
+
+      while(plen--)
+        frac *= 10;
+
+      if((CURL_OFF_T_MAX / mul) > prec)
+        add = mul * prec / frac;
+      else
+        add = (mul / frac) * prec;
+    }
+  }
+  if(value > ((CURL_OFF_T_MAX - add) / mul))
+    return PARAM_NUMBER_TOO_LARGE;
+
+  *out = (value * mul) + add;
   return PARAM_OK;
 }
 
 #ifdef HAVE_WRITABLE_ARGV
-static void cleanarg(argv_item_t str)
+static void cleanarg(char *str)
 {
-  /* now that GetStr has copied the contents of nextarg, wipe the next
-   * argument out so that the username:password isn't displayed in the
+  /* now that getstr has copied the contents of nextarg, wipe the next
+   * argument out so that the username:password is not displayed in the
    * system process list */
   if(str) {
     size_t len = strlen(str);
-    memset(str, ' ', len);
+    memset(str, '*', len);
   }
 }
 #else
-#define cleanarg(x)
+#define cleanarg(x) tool_nop_stmt
 #endif
 
+/* the maximum size we allow the dynbuf generated string */
+#define MAX_DATAURLENCODE (500 * 1024 * 1024)
+
 /* --data-urlencode */
-static ParameterError data_urlencode(struct GlobalConfig *global,
-                                     char *nextarg,
+static ParameterError data_urlencode(const char *nextarg,
                                      char **postp,
                                      size_t *lenp)
 {
   /* [name]=[content], we encode the content part only
-   * [name]@[file name]
+   * [name]@[filename]
    *
    * Case 2: we first load the file using that name and then encode
    * the content.
@@ -596,21 +663,22 @@ static ParameterError data_urlencode(struct GlobalConfig *global,
     is_file = *p++; /* pass the separator */
   }
   else {
-    /* neither @ nor =, so no name and it isn't a file */
-    nlen = is_file = 0;
+    /* neither @ nor =, so no name and it is not a file */
+    nlen = 0;
+    is_file = 0;
     p = nextarg;
   }
   if('@' == is_file) {
     FILE *file;
-    /* a '@' letter, it means that a file name or - (stdin) follows */
+    /* a '@' letter, it means that a filename or - (stdin) follows */
     if(!strcmp("-", p)) {
       file = stdin;
-      set_binmode(stdin);
+      CURL_BINMODE(stdin);
     }
     else {
-      file = fopen(p, "rb");
+      file = curlx_fopen(p, "rb");
       if(!file) {
-        errorf(global, "Failed to open %s", p);
+        errorf("Failed to open %s", p);
         return PARAM_READ_ERROR;
       }
     }
@@ -618,47 +686,52 @@ static ParameterError data_urlencode(struct GlobalConfig *global,
     err = file2memory(&postdata, &size, file);
 
     if(file && (file != stdin))
-      fclose(file);
+      curlx_fclose(file);
     if(err)
       return err;
   }
   else {
-    GetStr(&postdata, p);
-    if(postdata)
-      size = strlen(postdata);
+    err = getstr(&postdata, p, ALLOW_BLANK);
+    if(err)
+      goto error;
+    size = strlen(postdata);
   }
 
   if(!postdata) {
     /* no data from the file, point to a zero byte string to make this
        get sent as a POST anyway */
-    postdata = strdup("");
+    postdata = curlx_strdup("");
     if(!postdata)
       return PARAM_NO_MEM;
     size = 0;
   }
   else {
     char *enc = curl_easy_escape(NULL, postdata, (int)size);
-    Curl_safefree(postdata); /* no matter if it worked or not */
+    curlx_safefree(postdata); /* no matter if it worked or not */
     if(enc) {
-      /* replace (in-place) '%20' by '+' according to RFC1866 */
-      size_t enclen = replace_url_encoded_space_by_plus(enc);
-      /* now make a string with the name from above and append the
-         encoded string */
-      size_t outlen = nlen + enclen + 2;
-      char *n = malloc(outlen);
-      if(!n) {
-        curl_free(enc);
-        return PARAM_NO_MEM;
-      }
+      char *n;
+      replace_url_encoded_space_by_plus(enc);
       if(nlen > 0) { /* only append '=' if we have a name */
-        msnprintf(n, outlen, "%.*s=%s", (int)nlen, nextarg, enc);
-        size = outlen-1;
+        struct dynbuf dyn;
+        curlx_dyn_init(&dyn, MAX_DATAURLENCODE);
+        if(curlx_dyn_addn(&dyn, nextarg, nlen) ||
+           curlx_dyn_addn(&dyn, "=", 1) ||
+           curlx_dyn_add(&dyn, enc)) {
+          curl_free(enc);
+          return PARAM_NO_MEM;
+        }
+        curl_free(enc);
+        n = curlx_dyn_ptr(&dyn);
+        size = curlx_dyn_len(&dyn);
       }
       else {
-        strcpy(n, enc);
-        size = outlen-2; /* since no '=' was inserted */
+        /* make sure we return "our memory" */
+        n = curlx_strdup(enc);
+        curl_free(enc);
+        if(!n)
+          return PARAM_NO_MEM;
+        size = strlen(n);
       }
-      curl_free(enc);
       postdata = n;
     }
     else
@@ -671,93 +744,1737 @@ error:
   return err;
 }
 
-static void sethttpver(struct GlobalConfig *global,
-                       struct OperationConfig *config,
-                       long httpversion)
+static void sethttpver(struct OperationConfig *config, long httpversion)
 {
   if(config->httpversion &&
      (config->httpversion != httpversion))
-    warnf(global, "Overrides previous HTTP version option");
+    warnf("Overrides previous HTTP version option");
 
   config->httpversion = httpversion;
 }
 
-static CURLcode set_trace_config(struct GlobalConfig *global,
-                                 const char *config)
+static CURLcode set_trace_config(const char *token)
 {
   CURLcode result = CURLE_OK;
-  char *token, *tmp, *name;
+  const char *next, *name;
   bool toggle;
 
-  tmp = strdup(config);
-  if(!tmp)
-    return CURLE_OUT_OF_MEMORY;
-
-  /* Allow strtok() here since this isn't used threaded */
-  /* !checksrc! disable BANNEDFUNC 2 */
-  token = strtok(tmp, ", ");
   while(token) {
+    size_t len;
+    next = strchr(token, ',');
+
+    if(next)
+      len = next - token;
+    else
+      len = strlen(token);
+
     switch(*token) {
-      case '-':
-        toggle = FALSE;
-        name = token + 1;
-        break;
-      case '+':
-        toggle = TRUE;
-        name = token + 1;
-        break;
-      default:
-        toggle = TRUE;
-        name = token;
-        break;
+    case '-':
+      toggle = FALSE;
+      name = token + 1;
+      len--;
+      break;
+    case '+':
+      toggle = TRUE;
+      name = token + 1;
+      len--;
+      break;
+    default:
+      toggle = TRUE;
+      name = token;
+      break;
     }
 
-    if(strcasecompare(name, "all")) {
+    if((len == 3) && curl_strnequal(name, "all", 3)) {
       global->traceids = toggle;
       global->tracetime = toggle;
-      result = curl_global_trace(token);
+      if(toggle)
+        result = curl_global_trace("all,-lib-ids");
+      else
+        result = curl_global_trace(token);
       if(result)
         goto out;
     }
-    else if(strcasecompare(name, "ids")) {
+    else if((len == 3) && curl_strnequal(name, "ids", 3)) {
       global->traceids = toggle;
     }
-    else if(strcasecompare(name, "time")) {
+    else if((len == 4) && curl_strnequal(name, "time", 4)) {
       global->tracetime = toggle;
     }
     else {
-      result = curl_global_trace(token);
+      char buffer[64];
+      curl_msnprintf(buffer, sizeof(buffer), "%c%.*s,-lib-ids",
+                     toggle ? '+' : '-', (int)len, name);
+      result = curl_global_trace(buffer);
       if(result)
         goto out;
     }
-    token = strtok(NULL, ", ");
+    if(next) {
+      next++;
+      if(*next == ' ')
+        next++;
+    }
+    token = next;
   }
 out:
-  free(tmp);
   return result;
 }
 
-ParameterError getparameter(const char *flag, /* f or -long-flag */
-                            char *nextarg,    /* NULL if unset */
-                            argv_item_t cleararg,
-                            bool *usedarg,    /* set to TRUE if the arg
-                                                 has been used */
-                            struct GlobalConfig *global,
-                            struct OperationConfig *config)
+static int findarg(const void *a, const void *b)
 {
-  char letter;
-  char subletter = '\0'; /* subletters can only occur on long options */
-  int rc;
-  const char *parse = NULL;
-  unsigned int j;
-  time_t now;
-  int hit = -1;
-  bool longopt = FALSE;
-  bool singleopt = FALSE; /* when true means '-o foo' used '-ofoo' */
+  const struct LongShort *aa = a;
+  const struct LongShort *bb = b;
+  return strcmp(aa->lname, bb->lname);
+}
+
+const struct LongShort *findshortopt(char letter)
+{
+  static const struct LongShort *singles[128 - ' ']; /* ASCII => pointer */
+  static bool singles_done = FALSE;
+  if((letter >= 127) || (letter <= ' '))
+    return NULL;
+
+  if(!singles_done) {
+    unsigned int j;
+    for(j = 0; j < CURL_ARRAYSIZE(aliases); j++) {
+      if(aliases[j].letter != ' ') {
+        unsigned char l = (unsigned char)aliases[j].letter;
+        singles[l - ' '] = &aliases[j];
+      }
+    }
+    singles_done = TRUE;
+  }
+  return singles[letter - ' '];
+}
+
+struct TOSEntry {
+  const char *name;
+  unsigned char value;
+};
+
+static const struct TOSEntry tos_entries[] = {
+  { "AF11", 0x28 },
+  { "AF12", 0x30 },
+  { "AF13", 0x38 },
+  { "AF21", 0x48 },
+  { "AF22", 0x50 },
+  { "AF23", 0x58 },
+  { "AF31", 0x68 },
+  { "AF32", 0x70 },
+  { "AF33", 0x78 },
+  { "AF41", 0x88 },
+  { "AF42", 0x90 },
+  { "AF43", 0x98 },
+  { "CE",   0x03 },
+  { "CS0",  0x00 },
+  { "CS1",  0x20 },
+  { "CS2",  0x40 },
+  { "CS3",  0x60 },
+  { "CS4",  0x80 },
+  { "CS5",  0xa0 },
+  { "CS6",  0xc0 },
+  { "CS7",  0xe0 },
+  { "ECT0", 0x02 },
+  { "ECT1", 0x01 },
+  { "EF",   0xb8 },
+  { "LE",   0x04 },
+  { "LOWCOST",     0x02 },
+  { "LOWDELAY",    0x10 },
+  { "MINCOST",     0x02 },
+  { "RELIABILITY", 0x04 },
+  { "THROUGHPUT",  0x08 },
+  { "VOICE-ADMIT", 0xb0 }
+};
+
+static int find_tos(const void *a, const void *b)
+{
+  const struct TOSEntry *aa = a;
+  const struct TOSEntry *bb = b;
+  return strcmp(aa->name, bb->name);
+}
+
+#define MAX_QUERY_LEN 100000 /* larger is not likely to ever work */
+static ParameterError url_query(const char *nextarg,
+                                struct OperationConfig *config)
+{
+  size_t size = 0;
   ParameterError err = PARAM_OK;
-  bool toggle = TRUE; /* how to switch boolean options, on or off. Controlled
-                         by using --OPTION or --no-OPTION */
-  bool nextalloc = FALSE; /* if nextarg is allocated */
+  char *query;
+  struct dynbuf dyn;
+  curlx_dyn_init(&dyn, MAX_QUERY_LEN);
+
+  if(*nextarg == '+') {
+    /* use without encoding */
+    query = curlx_strdup(&nextarg[1]);
+    if(!query)
+      err = PARAM_NO_MEM;
+  }
+  else
+    err = data_urlencode(nextarg, &query, &size);
+
+  if(!err) {
+    if(config->query) {
+      CURLcode result = curlx_dyn_addf(&dyn, "%s&%s", config->query, query);
+      curlx_free(query);
+      if(result)
+        err = PARAM_NO_MEM;
+      else {
+        curlx_free(config->query);
+        config->query = curlx_dyn_ptr(&dyn);
+      }
+    }
+    else
+      config->query = query;
+  }
+  return err;
+}
+
+static ParameterError set_data(cmdline_t cmd,
+                               const char *nextarg,
+                               struct OperationConfig *config)
+{
+  char *postdata = NULL;
+  FILE *file;
+  size_t size = 0;
+  ParameterError err = PARAM_OK;
+
+  if(cmd == C_DATA_URLENCODE) { /* --data-urlencode */
+    err = data_urlencode(nextarg, &postdata, &size);
+    if(err)
+      return err;
+  }
+  else if('@' == *nextarg && (cmd != C_DATA_RAW)) {
+    /* the data begins with a '@' letter, it means that a filename
+       or - (stdin) follows */
+    nextarg++; /* pass the @ */
+
+    if(!strcmp("-", nextarg)) {
+      file = stdin;
+      if(cmd == C_DATA_BINARY) /* forced data-binary */
+        CURL_BINMODE(stdin);
+    }
+    else {
+      file = curlx_fopen(nextarg, "rb");
+      if(!file) {
+        errorf("Failed to open %s", nextarg);
+        return PARAM_READ_ERROR;
+      }
+    }
+
+    if((cmd == C_DATA_BINARY) || /* --data-binary */
+       (cmd == C_JSON) /* --json */)
+      /* forced binary */
+      err = file2memory(&postdata, &size, file);
+    else {
+      err = file2string(&postdata, file);
+      if(postdata)
+        size = strlen(postdata);
+    }
+
+    if(file && (file != stdin))
+      curlx_fclose(file);
+    if(err)
+      return err;
+
+    if(!postdata) {
+      /* no data from the file, point to a zero byte string to make this
+         get sent as a POST anyway */
+      postdata = curlx_strdup("");
+      if(!postdata)
+        return PARAM_NO_MEM;
+    }
+  }
+  else {
+    err = getstr(&postdata, nextarg, ALLOW_BLANK);
+    if(err)
+      return err;
+    size = strlen(postdata);
+  }
+  if(cmd == C_JSON)
+    config->jsoned = TRUE;
+
+  if(curlx_dyn_len(&config->postdata)) {
+    /* skip separator append for --json */
+    if(!err && (cmd != C_JSON) &&
+       curlx_dyn_addn(&config->postdata, "&", 1))
+      err = PARAM_NO_MEM;
+  }
+
+  if(!err && curlx_dyn_addn(&config->postdata, postdata, size))
+    err = PARAM_NO_MEM;
+
+  curlx_safefree(postdata);
+
+  config->postfields = curlx_dyn_ptr(&config->postdata);
+  return err;
+}
+
+static ParameterError set_rate(const char *nextarg)
+{
+  /* --rate */
+  /* support a few different suffixes, extract the suffix first, then
+     get the number and convert to per hour.
+     /s == per second
+     /m == per minute
+     /h == per hour (default)
+     /d == per day (24 hours)
+   */
+  ParameterError err = PARAM_OK;
+  const char *p = nextarg;
+  curl_off_t denominator;
+  curl_off_t numerator = 60 * 60 * 1000; /* default per hour */
+
+  if(curlx_str_number(&p, &denominator, CURL_OFF_T_MAX))
+    return PARAM_BAD_NUMERIC;
+
+  if(denominator < 1)
+    return PARAM_BAD_USE;
+
+  if(!curlx_str_single(&p, '/')) {
+    curl_off_t numunits;
+
+    if(curlx_str_number(&p, &numunits, CURL_OFF_T_MAX))
+      numunits = 1;
+
+    switch(*p) {
+    case 's': /* per second */
+      numerator = 1000;
+      break;
+    case 'm': /* per minute */
+      numerator = 60 * 1000;
+      break;
+    case 'h': /* per hour */
+      break;
+    case 'd': /* per day */
+      numerator = 24 * 60 * 60 * 1000;
+      break;
+    default:
+      errorf("unsupported --rate unit");
+      err = PARAM_BAD_USE;
+      break;
+    }
+
+    if((CURL_OFF_T_MAX / numerator) < numunits) {
+      /* overflow, too large number */
+      errorf("too large --rate unit");
+      err = PARAM_NUMBER_TOO_LARGE;
+    }
+    else
+      /* this typecast is okay based on the check above */
+      numerator *= numunits;
+  }
+
+  if(err)
+    ;
+  else if(denominator > numerator)
+    err = PARAM_NUMBER_TOO_LARGE;
+  else
+    global->ms_per_transfer = numerator / denominator;
+
+  return err;
+}
+
+const struct LongShort *findlongopt(const char *opt)
+{
+  struct LongShort key;
+  key.lname = opt;
+
+  return bsearch(&key, aliases, CURL_ARRAYSIZE(aliases),
+                 sizeof(aliases[0]), findarg);
+}
+
+static ParameterError add_url(struct OperationConfig *config,
+                              const char *thisurl,
+                              bool remote_noglob)
+{
+  ParameterError err = PARAM_OK;
+  struct getout *url;
+
+  if(!config->url_get)
+    config->url_get = config->url_list;
+
+  if(config->url_get) {
+    /* there is a node here, if it already is filled-in continue to find
+       an "empty" node */
+    while(config->url_get && config->url_get->urlset)
+      config->url_get = config->url_get->next;
+  }
+
+  /* now there might or might not be an available node to fill in! */
+
+  if(config->url_get)
+    /* existing node */
+    url = config->url_get;
+  else
+    /* there was no free node, create one! */
+    config->url_get = url = new_getout(config);
+
+  if(!url)
+    return PARAM_NO_MEM;
+  else {
+    /* fill in the URL */
+    err = getstr(&url->url, thisurl, DENY_BLANK);
+    url->urlset = TRUE;
+    if(remote_noglob)
+      url->useremote = url->noglob = TRUE;
+    if(!err && (++config->num_urls > 1) &&
+       (config->etag_save_file || config->etag_compare_file)) {
+      errorf("The etag options only work on a single URL");
+      return PARAM_BAD_USE;
+    }
+  }
+  return err;
+}
+
+static ParameterError parse_url(struct OperationConfig *config,
+                                const char *nextarg)
+{
+  /* nextarg is never NULL here */
+  if(nextarg[0] == '@') {
+    /* read URLs from a file, treat all as -O */
+    struct dynbuf line;
+    ParameterError err = PARAM_OK;
+    bool error = FALSE;
+    bool fromstdin = !strcmp("-", &nextarg[1]);
+    FILE *f;
+
+    if(fromstdin)
+      f = stdin;
+    else
+      f = curlx_fopen(&nextarg[1], FOPEN_READTEXT);
+    if(f) {
+      curlx_dyn_init(&line, 8092);
+      while(my_get_line(f, &line, &error)) {
+        const char *ptr = curlx_dyn_ptr(&line);
+        err = add_url(config, ptr, TRUE);
+        if(err)
+          break;
+      }
+      if(!fromstdin)
+        curlx_fclose(f);
+      curlx_dyn_free(&line);
+      if(error || err)
+        return PARAM_READ_ERROR;
+      return PARAM_OK;
+    }
+    return PARAM_READ_ERROR; /* file not found */
+  }
+  return add_url(config, nextarg, FALSE);
+}
+
+static ParameterError parse_localport(struct OperationConfig *config,
+                                      const char *nextarg)
+{
+  const char *pp = NULL;
+  const char *p = nextarg;
+  char buffer[22];
+  size_t plen = 0;
+  while(ISDIGIT(*p))
+    p++;
+  plen = p - nextarg;
+  if(*p) {
+    pp = p;
+    /* check for ' - [end]' */
+    if(ISBLANK(*pp))
+      pp++;
+    if(*pp != '-')
+      return PARAM_BAD_USE;
+    pp++;
+    if(ISBLANK(*pp))
+      pp++;
+  }
+  curl_msnprintf(buffer, sizeof(buffer), "%.*s", (int)plen, nextarg);
+  if(str2unummax(&config->localport, buffer, 65535))
+    return PARAM_BAD_USE;
+  if(!pp)
+    config->localportrange = 1; /* default number of ports to try */
+  else {
+    if(str2unummax(&config->localportrange, pp, 65535))
+      return PARAM_BAD_USE;
+    config->localportrange -= (config->localport - 1);
+    if(config->localportrange < 1)
+      return PARAM_BAD_USE;
+  }
+  return PARAM_OK;
+}
+
+static ParameterError parse_continue_at(struct OperationConfig *config,
+                                        const char *nextarg)
+{
+  ParameterError err = PARAM_OK;
+  if(config->range) {
+    errorf("--continue-at is mutually exclusive with --range");
+    return PARAM_BAD_USE;
+  }
+  if(config->rm_partial) {
+    errorf("--continue-at is mutually exclusive with --remove-on-error");
+    return PARAM_BAD_USE;
+  }
+  if(config->file_clobber_mode == CLOBBER_NEVER) {
+    errorf("--continue-at is mutually exclusive with --no-clobber");
+    return PARAM_BAD_USE;
+  }
+  /* This makes us continue an ftp transfer at given position */
+  if(strcmp(nextarg, "-")) {
+    err = str2offset(&config->resume_from, nextarg);
+    config->resume_from_current = FALSE;
+  }
+  else {
+    config->resume_from_current = TRUE;
+    config->resume_from = 0;
+  }
+  config->use_resume = TRUE;
+  return err;
+}
+
+static ParameterError parse_ech(struct OperationConfig *config,
+                                const char *nextarg)
+{
+  ParameterError err = PARAM_OK;
+  if(!feature_ech)
+    err = PARAM_LIBCURL_DOESNT_SUPPORT;
+  else if(strlen(nextarg) > 4 && curl_strnequal("pn:", nextarg, 3)) {
+    /* a public_name */
+    err = getstr(&config->ech_public, nextarg, DENY_BLANK);
+  }
+  else if(strlen(nextarg) > 5 && curl_strnequal("ecl:", nextarg, 4)) {
+    /* an ECHConfigList */
+    if('@' != *(nextarg + 4)) {
+      err = getstr(&config->ech_config, nextarg, DENY_BLANK);
+    }
+    else {
+      /* Indirect case: @filename or @- for stdin */
+      char *tmpcfg = NULL;
+      FILE *file;
+
+      nextarg += 5;        /* skip over 'ecl:@' */
+      if(!strcmp("-", nextarg)) {
+        file = stdin;
+      }
+      else {
+        file = curlx_fopen(nextarg, FOPEN_READTEXT);
+      }
+      if(!file) {
+        warnf("Could not read file \"%s\" "
+              "specified for \"--ech ecl:\" option",
+              nextarg);
+        return PARAM_BAD_USE;
+      }
+      err = file2string(&tmpcfg, file);
+      if(file != stdin)
+        curlx_fclose(file);
+      if(err)
+        return err;
+      {
+        char *tmp = curl_maprintf("ecl:%s", tmpcfg);
+        curlx_free(tmpcfg);
+        if(!tmp)
+          return PARAM_NO_MEM;
+        config->ech_config = curlx_strdup(tmp);
+        curl_free(tmp);
+        if(!config->ech_config)
+          return PARAM_NO_MEM;
+      }
+    } /* file done */
+  }
+  else {
+    /* Simple case: a string, with a keyword */
+    err = getstr(&config->ech, nextarg, DENY_BLANK);
+  }
+  return err;
+}
+
+static ParameterError parse_header(struct OperationConfig *config,
+                                   cmdline_t cmd,
+                                   const char *nextarg)
+{
+  ParameterError err = PARAM_OK;
+
+  /* A custom header to append to a list */
+  if(nextarg[0] == '@') {
+    /* read many headers from a file or stdin */
+    bool use_stdin = !strcmp(&nextarg[1], "-");
+    FILE *file = use_stdin ? stdin : curlx_fopen(&nextarg[1], FOPEN_READTEXT);
+    if(!file) {
+      errorf("Failed to open %s", &nextarg[1]);
+      err = PARAM_READ_ERROR;
+    }
+    else {
+      struct dynbuf line;
+      bool error = FALSE;
+      curlx_dyn_init(&line, 1024 * 100);
+      while(my_get_line(file, &line, &error)) {
+        const char *ptr = curlx_dyn_ptr(&line);
+        err = add2list(cmd == C_PROXY_HEADER ? /* --proxy-header? */
+                       &config->proxyheaders :
+                       &config->headers, ptr);
+        if(err)
+          break;
+      }
+      if(error)
+        err = PARAM_READ_ERROR;
+      curlx_dyn_free(&line);
+      if(!use_stdin)
+        curlx_fclose(file);
+    }
+  }
+  else {
+    if(!strchr(nextarg, ':') && !strchr(nextarg, ';')) {
+      warnf("The provided %s header '%s' does not look like a header?",
+            (cmd == C_PROXY_HEADER) ? "proxy" : "HTTP", nextarg);
+    }
+    if(cmd == C_PROXY_HEADER) /* --proxy-header */
+      err = add2list(&config->proxyheaders, nextarg);
+    else
+      err = add2list(&config->headers, nextarg);
+  }
+  return err;
+}
+
+static ParameterError parse_output(struct OperationConfig *config,
+                                   const char *nextarg)
+{
+  ParameterError err = PARAM_OK;
+  struct getout *url;
+
+  /* output file */
+  if(!config->url_out)
+    config->url_out = config->url_list;
+  if(config->url_out) {
+    /* there is a node here, if it already is filled-in continue to find
+       an "empty" node */
+    while(config->url_out && config->url_out->outset)
+      config->url_out = config->url_out->next;
+  }
+
+  /* now there might or might not be an available node to fill in! */
+
+  if(config->url_out)
+    /* existing node */
+    url = config->url_out;
+  else {
+    /* there was no free node, create one! */
+    config->url_out = url = new_getout(config);
+  }
+
+  if(!url)
+    return PARAM_NO_MEM;
+
+  /* fill in the outfile */
+  if(nextarg)
+    err = getstr(&url->outfile, nextarg, DENY_BLANK);
+  else
+    url->outfile = NULL;
+  url->useremote = FALSE; /* switch off */
+  url->outset = TRUE;
+  url->out_null = !nextarg;
+  return err;
+}
+
+static ParameterError parse_remote_name(struct OperationConfig *config,
+                                        bool toggle)
+{
+  ParameterError err = PARAM_OK;
+  struct getout *url;
+
+  if(!toggle && !config->remote_name_all)
+    return err; /* nothing to do */
+
+  /* output file */
+  if(!config->url_out)
+    config->url_out = config->url_list;
+  if(config->url_out) {
+    /* there is a node here, if it already is filled-in continue to find
+       an "empty" node */
+    while(config->url_out && config->url_out->outset)
+      config->url_out = config->url_out->next;
+  }
+
+  /* now there might or might not be an available node to fill in! */
+
+  if(config->url_out)
+    /* existing node */
+    url = config->url_out;
+  else {
+    /* there was no free node, create one! */
+    config->url_out = url = new_getout(config);
+  }
+
+  if(!url)
+    return PARAM_NO_MEM;
+
+  url->outfile = NULL; /* leave it */
+  url->useremote = toggle;
+  url->outset = TRUE;
+  url->out_null = FALSE;
+  return PARAM_OK;
+}
+
+static ParameterError parse_quote(struct OperationConfig *config,
+                                  const char *nextarg)
+{
+  ParameterError err = PARAM_OK;
+
+  /* QUOTE command to send to FTP server */
+  switch(nextarg[0]) {
+  case '-':
+    /* prefixed with a dash makes it a POST TRANSFER one */
+    nextarg++;
+    err = add2list(&config->postquote, nextarg);
+    break;
+  case '+':
+    /* prefixed with a plus makes it an immediately-before-transfer one */
+    nextarg++;
+    err = add2list(&config->prequote, nextarg);
+    break;
+  default:
+    err = add2list(&config->quote, nextarg);
+    break;
+  }
+  return err;
+}
+
+static ParameterError parse_range(struct OperationConfig *config,
+                                  const char *nextarg)
+{
+  ParameterError err = PARAM_OK;
+  curl_off_t value;
+  const char *orig = nextarg;
+
+  if(config->use_resume) {
+    errorf("--continue-at is mutually exclusive with --range");
+    return PARAM_BAD_USE;
+  }
+  if(!curlx_str_number(&nextarg, &value, CURL_OFF_T_MAX) &&
+     curlx_str_single(&nextarg, '-')) {
+    /* Specifying a range WITHOUT A DASH does create an illegal HTTP range
+       (and does not actually be range by definition). The man page previously
+       claimed that to be a good way, why this code is added to work around
+       it. */
+    char buffer[32];
+    warnf("A specified range MUST include at least one dash (-). "
+          "Appending one for you");
+    curl_msnprintf(buffer, sizeof(buffer), "%" CURL_FORMAT_CURL_OFF_T "-",
+                   value);
+    curlx_free(config->range);
+    config->range = curlx_strdup(buffer);
+    if(!config->range)
+      err = PARAM_NO_MEM;
+  }
+  else {
+    /* byte range requested */
+    while(*nextarg) {
+      if(!ISDIGIT(*nextarg) && *nextarg != '-' && *nextarg != ',') {
+        warnf("Invalid character is found in given range. "
+              "A specified range MUST have only digits in "
+              "\'start\'-\'stop\'. The server's response to this "
+              "request is uncertain.");
+        break;
+      }
+      nextarg++;
+    }
+    err = getstr(&config->range, orig, DENY_BLANK);
+  }
+  return err;
+}
+
+static ParameterError parse_upload_file(struct OperationConfig *config,
+                                        const char *nextarg)
+{
+  ParameterError err = PARAM_OK;
+  struct getout *url;
+
+  /* we are uploading */
+  if(!config->url_ul)
+    config->url_ul = config->url_list;
+  if(config->url_ul) {
+    /* there is a node here, if it already is filled-in continue to find
+       an "empty" node */
+    while(config->url_ul && config->url_ul->uploadset)
+      config->url_ul = config->url_ul->next;
+  }
+
+  /* now there might or might not be an available node to fill in! */
+
+  if(config->url_ul)
+    /* existing node */
+    url = config->url_ul;
+  else
+    /* there was no free node, create one! */
+    config->url_ul = url = new_getout(config);
+
+  if(!url)
+    return PARAM_NO_MEM;
+
+  url->uploadset = TRUE; /* mark -T used */
+  if(!*nextarg)
+    url->noupload = TRUE;
+  else {
+    /* "-" equals stdin, but keep the string around for now */
+    err = getstr(&url->infile, nextarg, DENY_BLANK);
+  }
+  return err;
+}
+
+static size_t verbose_nopts;
+
+static ParameterError parse_verbose(bool toggle)
+{
+  ParameterError err = PARAM_OK;
+
+  /* This option is a super-boolean with side effect when applied
+   * more than once in the same argument flag, like `-vvv`. */
+  if(!toggle) {
+    global->verbosity = 0;
+    if(set_trace_config("-all"))
+      err = PARAM_NO_MEM;
+    global->tracetype = TRACE_NONE;
+    return err;
+  }
+  else if(!verbose_nopts) {
+    /* first `-v` in an argument resets to base verbosity */
+    global->verbosity = 0;
+    if(!global->trace_set && set_trace_config("-all"))
+      return PARAM_NO_MEM;
+  }
+  /* the '%' thing here causes the trace get sent to stderr */
+  switch(global->verbosity) {
+  case 0:
+    global->verbosity = 1;
+    curlx_free(global->trace_dump);
+    global->trace_dump = curlx_strdup("%");
+    if(!global->trace_dump)
+      err = PARAM_NO_MEM;
+    else {
+      if(global->tracetype && (global->tracetype != TRACE_PLAIN))
+        warnf("-v, --verbose overrides an earlier trace option");
+      global->tracetype = TRACE_PLAIN;
+    }
+    break;
+  case 1:
+    global->verbosity = 2;
+    if(set_trace_config("ids,time,protocol"))
+      err = PARAM_NO_MEM;
+    break;
+  case 2:
+    global->verbosity = 3;
+    global->tracetype = TRACE_ASCII;
+    if(set_trace_config("ssl,read,write"))
+      err = PARAM_NO_MEM;
+    break;
+  case 3:
+    global->verbosity = 4;
+    if(set_trace_config("network"))
+      err = PARAM_NO_MEM;
+    break;
+  default:
+    /* no effect for now */
+    break;
+  }
+  return err;
+}
+
+static ParameterError parse_writeout(struct OperationConfig *config,
+                                     const char *nextarg)
+{
+  ParameterError err = PARAM_OK;
+
+  /* get the output string */
+  if('@' == *nextarg) {
+    /* the data begins with a '@' letter, it means that a filename
+       or - (stdin) follows */
+    FILE *file;
+    const char *fname;
+    nextarg++; /* pass the @ */
+    if(!strcmp("-", nextarg)) {
+      fname = "<stdin>";
+      file = stdin;
+    }
+    else {
+      fname = nextarg;
+      file = curlx_fopen(fname, FOPEN_READTEXT);
+      if(!file) {
+        errorf("Failed to open %s", fname);
+        return PARAM_READ_ERROR;
+      }
+    }
+    curlx_safefree(config->writeout);
+    err = file2string(&config->writeout, file);
+    if(file && (file != stdin))
+      curlx_fclose(file);
+    if(err)
+      return err;
+    if(!config->writeout)
+      warnf("Failed to read %s", fname);
+  }
+  else
+    err = getstr(&config->writeout, nextarg, ALLOW_BLANK);
+
+  return err;
+}
+
+static ParameterError parse_time_cond(struct OperationConfig *config,
+                                      const char *nextarg)
+{
+  ParameterError err = PARAM_OK;
+
+  switch(*nextarg) {
+  case '+':
+    nextarg++;
+    FALLTHROUGH();
+  default:
+    /* If-Modified-Since: (section 14.28 in RFC2068) */
+    config->timecond = CURL_TIMECOND_IFMODSINCE;
+    break;
+  case '-':
+    /* If-Unmodified-Since: (section 14.24 in RFC2068) */
+    config->timecond = CURL_TIMECOND_IFUNMODSINCE;
+    nextarg++;
+    break;
+  case '=':
+    /* Last-Modified: (section 14.29 in RFC2068) */
+    config->timecond = CURL_TIMECOND_LASTMOD;
+    nextarg++;
+    break;
+  }
+  config->condtime = (curl_off_t)curl_getdate(nextarg, NULL);
+  if(config->condtime == -1) {
+    curl_off_t value;
+    /* now let's see if it is a filename to get the time from instead! */
+    int rc = getfiletime(nextarg, &value);
+    if(!rc)
+      /* pull the time out from the file */
+      config->condtime = value;
+    else {
+      /* failed, remove time condition */
+      config->timecond = CURL_TIMECOND_NONE;
+      warnf("Illegal date format for -z, --time-cond (and not "
+            "a filename). Disabling time condition. "
+            "See curl_getdate(3) for valid date syntax.");
+    }
+  }
+  return err;
+}
+
+struct flagmap {
+  const char *name;
+  size_t len;
+  unsigned char flag;
+};
+
+static const struct flagmap flag_table[] = {
+  { "answered", 8, CURLULFLAG_ANSWERED },
+  { "deleted",  7, CURLULFLAG_DELETED },
+  { "draft",    5, CURLULFLAG_DRAFT },
+  { "flagged",  7, CURLULFLAG_FLAGGED },
+  { "seen",     4, CURLULFLAG_SEEN },
+  { NULL,       0, 0 }
+};
+
+static ParameterError parse_upload_flags(struct OperationConfig *config,
+                                         const char *flag)
+{
+  ParameterError err = PARAM_OK;
+
+  while(flag) {
+    bool negate;
+    const struct flagmap *map;
+    size_t len;
+    const char *next = strchr(flag, ','); /* Find next comma or end */
+    if(next)
+      len = next - flag;
+    else
+      len = strlen(flag);
+
+    negate = (*flag == '-');
+    if(negate) {
+      flag++;
+      len--;
+    }
+
+    for(map = flag_table; map->name; map++) {
+      if((len == map->len) && !strncmp(flag, map->name, map->len)) {
+        if(negate)
+          config->upload_flags &= (unsigned char)~map->flag;
+        else
+          config->upload_flags |= map->flag;
+        break;
+      }
+    }
+
+    if(!map->name) {
+      err = PARAM_OPTION_UNKNOWN;
+      break;
+    }
+
+    if(next)
+      /* move over the comma */
+      next++;
+    flag = next;
+  }
+
+  return err;
+}
+
+/* if 'toggle' is TRUE, set the 'bits' in 'modify'.
+   if 'toggle' is FALSE, clear the 'bits' in 'modify'
+*/
+static void togglebit(bool toggle, unsigned long *modify, unsigned long bits)
+{
+  if(toggle)
+    *modify |= bits;
+  else
+    *modify &= ~bits;
+}
+
+/* opt_depr is the function that handles ARG_DEPR options */
+static void opt_depr(const struct LongShort *a)
+{
+  warnf("--%s is deprecated and has no function anymore", a->lname);
+}
+
+static ParameterError opt_sslver(struct OperationConfig *config,
+                                 unsigned char ver)
+{
+  if(config->ssl_version_max &&
+     (config->ssl_version_max < ver)) {
+    errorf("Minimum TLS version set higher than max");
+    return PARAM_BAD_USE;
+  }
+  config->ssl_version = ver;
+  return PARAM_OK;
+}
+
+/* opt_none is the function that handles ARG_NONE options */
+static ParameterError opt_none(struct OperationConfig *config,
+                               const struct LongShort *a)
+{
+  ParameterError err = PARAM_OK;
+  switch(a->cmd) {
+  case C_ANYAUTH: /* --anyauth */
+    config->authtype = CURLAUTH_ANY;
+    break;
+  case C_DUMP_CA_EMBED: /* --dump-ca-embed */
+    return PARAM_CA_EMBED_REQUESTED;
+  case C_FTP_PASV: /* --ftp-pasv */
+    curlx_safefree(config->ftpport);
+    break;
+
+  case C_HTTP1_0: /* --http1.0 */
+    /* HTTP version 1.0 */
+    sethttpver(config, CURL_HTTP_VERSION_1_0);
+    break;
+  case C_HTTP1_1: /* --http1.1 */
+    /* HTTP version 1.1 */
+    sethttpver(config, CURL_HTTP_VERSION_1_1);
+    break;
+  case C_HTTP2: /* --http2 */
+    /* HTTP version 2.0 */
+    if(!feature_http2)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    sethttpver(config, CURL_HTTP_VERSION_2_0);
+    break;
+  case C_HTTP2_PRIOR_KNOWLEDGE: /* --http2-prior-knowledge */
+    /* HTTP version 2.0 over clean TCP */
+    if(!feature_http2)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    sethttpver(config, CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE);
+    break;
+  case C_HTTP3: /* --http3: */
+    /* Try HTTP/3, allow fallback */
+    if(!feature_http3)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    else
+      sethttpver(config, CURL_HTTP_VERSION_3);
+    break;
+  case C_HTTP3_ONLY: /* --http3-only */
+    /* Try HTTP/3 without fallback */
+    if(!feature_http3)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    else
+      sethttpver(config, CURL_HTTP_VERSION_3ONLY);
+    break;
+  case C_TLSV1: /* --tlsv1 */
+    err = opt_sslver(config, 1);
+    break;
+  case C_TLSV1_0: /* --tlsv1.0 */
+    err = opt_sslver(config, 1);
+    break;
+  case C_TLSV1_1: /* --tlsv1.1 */
+    err = opt_sslver(config, 2);
+    break;
+  case C_TLSV1_2: /* --tlsv1.2 */
+    err = opt_sslver(config, 3);
+    break;
+  case C_TLSV1_3: /* --tlsv1.3 */
+    err = opt_sslver(config, 4);
+    break;
+  case C_IPV4: /* --ipv4 */
+    config->ip_version = CURL_IPRESOLVE_V4;
+    break;
+  case C_IPV6: /* --ipv6 */
+    config->ip_version = CURL_IPRESOLVE_V6;
+    break;
+  case C_NEXT: /* --next */
+    return PARAM_NEXT_OPERATION;
+  case C_PROXY_TLSV1: /* --proxy-tlsv1 */
+    /* TLS version 1 for proxy */
+    config->proxy_ssl_version = CURL_SSLVERSION_TLSv1;
+    break;
+  }
+  return err;
+}
+
+/* opt_bool is the function that handles boolean options */
+static ParameterError opt_bool(struct OperationConfig *config,
+                               const struct LongShort *a,
+                               bool toggle)
+{
+  switch(a->cmd) {
+  case C_ALPN: /* --alpn */
+    config->noalpn = !toggle;
+    break;
+  case C_DISABLE_EPSV: /* --disable-epsv */
+    config->disable_epsv = toggle;
+    break;
+  case C_DISALLOW_USERNAME_IN_URL: /* --disallow-username-in-url */
+    config->disallow_username_in_url = toggle;
+    break;
+  case C_EPSV: /* --epsv */
+    config->disable_epsv = !toggle;
+    break;
+  case C_COMPRESSED: /* --compressed */
+    if(toggle && !(feature_libz || feature_brotli || feature_zstd))
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    else
+      config->encoding = toggle;
+    break;
+  case C_TR_ENCODING: /* --tr-encoding */
+    config->tr_encoding = toggle;
+    break;
+  case C_DIGEST: /* --digest */
+    togglebit(toggle, &config->authtype, CURLAUTH_DIGEST);
+    break;
+  case C_FTP_CREATE_DIRS: /* --ftp-create-dirs */
+    config->ftp_create_dirs = toggle;
+    break;
+  case C_CREATE_DIRS: /* --create-dirs */
+    config->create_dirs = toggle;
+    break;
+  case C_PROXY_NTLM: /* --proxy-ntlm */
+    if(!feature_ntlm)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    else
+      config->proxyntlm = toggle;
+    break;
+  case C_CRLF: /* --crlf */
+    config->crlf = toggle;
+    break;
+  case C_HAPROXY_PROTOCOL: /* --haproxy-protocol */
+    config->haproxy_protocol = toggle;
+    break;
+  case C_NEGOTIATE: /* --negotiate */
+    if(!feature_spnego && toggle)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    togglebit(toggle, &config->authtype, CURLAUTH_NEGOTIATE);
+    break;
+  case C_NTLM: /* --ntlm */
+    if(!feature_ntlm && toggle)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    togglebit(toggle, &config->authtype, CURLAUTH_NTLM);
+    break;
+  case C_OUT_NULL: /* --out-null */
+    return parse_output(config, NULL);
+  case C_BASIC: /* --basic */
+    togglebit(toggle, &config->authtype, CURLAUTH_BASIC);
+    break;
+#ifdef USE_WATT32
+  case C_WDEBUG: /* --wdebug */
+    dbug_init();
+    break;
+#endif
+  case C_DISABLE_EPRT: /* --disable-eprt */
+    config->disable_eprt = toggle;
+    break;
+  case C_EPRT: /* --eprt */
+    config->disable_eprt = !toggle;
+    break;
+  case C_XATTR: /* --xattr */
+    config->xattr = toggle;
+    break;
+  case C_FTP_SSL: /* --ftp-ssl */
+  case C_SSL: /* --ssl */
+    config->ftp_ssl = toggle;
+    if(config->ftp_ssl)
+      warnf("--%s is an insecure option, consider --ssl-reqd instead",
+            a->lname);
+    if(toggle && config->ftp_ssl_control) {
+      config->ftp_ssl_control = FALSE;
+      warnf("--%s overrides --ftp-ssl-control", a->lname);
+    }
+    break;
+  case C_FTP_SSL_CCC: /* --ftp-ssl-ccc */
+    config->ftp_ssl_ccc = toggle;
+    if(!config->ftp_ssl_ccc_mode)
+      config->ftp_ssl_ccc_mode = CURLFTPSSL_CCC_PASSIVE;
+    break;
+  case C_TCP_NODELAY: /* --tcp-nodelay */
+    config->tcp_nodelay = toggle;
+    break;
+  case C_PROXY_DIGEST: /* --proxy-digest */
+    config->proxydigest = toggle;
+    break;
+  case C_PROXY_BASIC: /* --proxy-basic */
+    config->proxybasic = toggle;
+    break;
+  case C_RETRY_CONNREFUSED: /* --retry-connrefused */
+    config->retry_connrefused = toggle;
+    break;
+  case C_RETRY_ALL_ERRORS: /* --retry-all-errors */
+    config->retry_all_errors = toggle;
+    break;
+  case C_PROXY_NEGOTIATE: /* --proxy-negotiate */
+    if(!feature_spnego)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    else
+      config->proxynegotiate = toggle;
+    break;
+  case C_FORM_ESCAPE: /* --form-escape */
+    togglebit(toggle, &config->mime_options, CURLMIMEOPT_FORMESCAPE);
+    break;
+  case C_PROXY_ANYAUTH: /* --proxy-anyauth */
+    config->proxyanyauth = toggle;
+    break;
+  case C_TRACE_TIME: /* --trace-time */
+    global->tracetime = toggle;
+    break;
+  case C_IGNORE_CONTENT_LENGTH: /* --ignore-content-length */
+    config->ignorecl = toggle;
+    break;
+  case C_FTP_SKIP_PASV_IP: /* --ftp-skip-pasv-ip */
+    config->ftp_skip_ip = toggle;
+    break;
+  case C_FTP_SSL_REQD: /* --ftp-ssl-reqd */
+  case C_SSL_REQD: /* --ssl-reqd */
+    config->ftp_ssl_reqd = toggle;
+    break;
+  case C_SESSIONID: /* --sessionid */
+    config->disable_sessionid = !toggle;
+    break;
+  case C_FTP_SSL_CONTROL: /* --ftp-ssl-control */
+    config->ftp_ssl_control = toggle;
+    if(toggle && config->ftp_ssl) {
+      config->ftp_ssl = FALSE;
+      warnf("--%s overrides --ssl", a->lname);
+    }
+    break;
+  case C_RAW: /* --raw */
+    config->raw = toggle;
+    break;
+  case C_KEEPALIVE: /* --keepalive */
+    config->nokeepalive = !toggle;
+    break;
+  case C_POST301: /* --post301 */
+    config->post301 = toggle;
+    break;
+  case C_POST302: /* --post302 */
+    config->post302 = toggle;
+    break;
+  case C_POST303: /* --post303 */
+    config->post303 = toggle;
+    break;
+  case C_SOCKS5_GSSAPI_NEC: /* --socks5-gssapi-nec */
+    config->socks5_gssapi_nec = toggle;
+    break;
+  case C_FTP_PRET: /* --ftp-pret */
+    config->ftp_pret = toggle;
+    break;
+  case C_SASL_IR: /* --sasl-ir */
+    config->sasl_ir = toggle;
+    break;
+#ifdef DEBUGBUILD
+  case C_TEST_DUPHANDLE: /* --test-duphandle */
+    global->test_duphandle = toggle;
+    break;
+  case C_TEST_EVENT: /* --test-event */
+    global->test_event_based = toggle;
+    break;
+#endif
+  case C_PATH_AS_IS: /* --path-as-is */
+    config->path_as_is = toggle;
+    break;
+  case C_TFTP_NO_OPTIONS: /* --tftp-no-options */
+    config->tftp_no_options = toggle;
+    break;
+  case C_TLS_EARLYDATA: /* --tls-earlydata */
+    config->ssl_allow_earlydata = toggle;
+    break;
+  case C_SUPPRESS_CONNECT_HEADERS: /* --suppress-connect-headers */
+    config->suppress_connect_headers = toggle;
+    break;
+  case C_COMPRESSED_SSH: /* --compressed-ssh */
+    config->ssh_compression = toggle;
+    break;
+  case C_TRACE_IDS: /* --trace-ids */
+    global->traceids = toggle;
+    break;
+  case C_PROGRESS_METER: /* --progress-meter */
+    global->noprogress = !toggle;
+    break;
+  case C_PROGRESS_BAR: /* --progress-bar */
+    global->progressmode = toggle ? CURL_PROGRESS_BAR : CURL_PROGRESS_STATS;
+    break;
+  case C_HTTP0_9: /* --http0.9 */
+    config->http09_allowed = toggle;
+    break;
+  case C_PROXY_HTTP2: /* --proxy-http2 */
+    if(!feature_httpsproxy || !feature_http2)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+
+    config->proxyver = toggle ? CURLPROXY_HTTPS2 : CURLPROXY_HTTPS;
+    break;
+  case C_PROXY_HTTP3: /* --proxy-http3 */
+#ifndef USE_PROXY_HTTP3
+    if(toggle)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    config->proxyver = CURLPROXY_HTTPS;
+#else
+    if(!feature_httpsproxy || !feature_http3)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+
+    config->proxyver = toggle ? CURLPROXY_HTTPS3 : CURLPROXY_HTTPS;
+#endif
+    break;
+  case C_APPEND: /* --append */
+    config->ftp_append = toggle;
+    break;
+  case C_USE_ASCII: /* --use-ascii */
+    config->use_ascii = toggle;
+    break;
+  case C_CA_NATIVE: /* --ca-native */
+    config->native_ca_store = toggle;
+    break;
+  case C_PROXY_CA_NATIVE: /* --proxy-ca-native */
+    config->proxy_native_ca_store = toggle;
+    break;
+  case C_SSL_ALLOW_BEAST: /* --ssl-allow-beast */
+    config->ssl_allow_beast = toggle;
+    break;
+  case C_SSL_AUTO_CLIENT_CERT: /* --ssl-auto-client-cert */
+    config->ssl_auto_client_cert = toggle;
+    break;
+  case C_PROXY_SSL_AUTO_CLIENT_CERT: /* --proxy-ssl-auto-client-cert */
+    config->proxy_ssl_auto_client_cert = toggle;
+    break;
+  case C_CERT_STATUS: /* --cert-status */
+    config->verifystatus = toggle;
+    break;
+  case C_DOH_CERT_STATUS: /* --doh-cert-status */
+    config->doh_verifystatus = toggle;
+    break;
+  case C_FALSE_START: /* --false-start */
+    opt_depr(a);
+    break;
+  case C_SSL_NO_REVOKE: /* --ssl-no-revoke */
+    config->ssl_no_revoke = toggle;
+    break;
+  case C_SSL_REVOKE_BEST_EFFORT: /* --ssl-revoke-best-effort */
+    config->ssl_revoke_best_effort = toggle;
+    break;
+  case C_TCP_FASTOPEN: /* --tcp-fastopen */
+    config->tcp_fastopen = toggle;
+    break;
+  case C_PROXY_SSL_ALLOW_BEAST: /* --proxy-ssl-allow-beast */
+    config->proxy_ssl_allow_beast = toggle;
+    break;
+  case C_PROXY_INSECURE: /* --proxy-insecure */
+    config->proxy_insecure_ok = toggle;
+    break;
+  case C_SOCKS5_BASIC: /* --socks5-basic */
+    togglebit(toggle, &config->socks5_auth, CURLAUTH_BASIC);
+    break;
+  case C_SOCKS5_GSSAPI: /* --socks5-gssapi */
+    togglebit(toggle, &config->socks5_auth, CURLAUTH_GSSAPI);
+    break;
+  case C_FAIL_EARLY: /* --fail-early */
+    global->fail_early = toggle;
+    break;
+  case C_STYLED_OUTPUT: /* --styled-output */
+    global->styled_output = toggle;
+    break;
+  case C_MAIL_RCPT_ALLOWFAILS: /* --mail-rcpt-allowfails */
+    config->mail_rcpt_allowfails = toggle;
+    break;
+  case C_REMOVE_ON_ERROR: /* --remove-on-error */
+    if(config->use_resume && toggle) {
+      errorf("--continue-at is mutually exclusive with --remove-on-error");
+      return PARAM_BAD_USE;
+    }
+    config->rm_partial = toggle;
+    break;
+  case C_FAIL: /* --fail without body */
+    if(toggle && (config->fail == FAIL_WITH_BODY))
+      warnf("--fail deselects --fail-with-body here");
+    config->fail = toggle ? FAIL_WO_BODY : FAIL_NONE;
+    break;
+  case C_FAIL_WITH_BODY: /* --fail-with-body */
+    if(toggle && (config->fail == FAIL_WO_BODY))
+      warnf("--fail-with-body deselects --fail here");
+    config->fail = toggle ? FAIL_WITH_BODY : FAIL_NONE;
+    break;
+  case C_GLOBOFF: /* --globoff */
+    config->globoff = toggle;
+    break;
+  case C_GET: /* --get */
+    config->use_httpget = toggle;
+    break;
+  case C_INCLUDE: /* --include */
+  case C_SHOW_HEADERS: /* --show-headers */
+    config->show_headers = toggle;
+    break;
+  case C_JUNK_SESSION_COOKIES: /* --junk-session-cookies */
+    config->cookiesession = toggle;
+    break;
+  case C_HEAD: /* --head */
+    config->no_body = toggle;
+    config->show_headers = toggle;
+    if(SetHTTPrequest((config->no_body) ? TOOL_HTTPREQ_HEAD :
+                      TOOL_HTTPREQ_GET, &config->httpreq))
+      return PARAM_BAD_USE;
+    break;
+  case C_REMOTE_HEADER_NAME: /* --remote-header-name */
+    config->content_disposition = toggle;
+    break;
+  case C_INSECURE: /* --insecure */
+    config->insecure_ok = toggle;
+    break;
+  case C_DOH_INSECURE: /* --doh-insecure */
+    config->doh_insecure_ok = toggle;
+    break;
+  case C_LIST_ONLY: /* --list-only */
+    config->dirlistonly = toggle; /* only list names of the FTP directory */
+    break;
+  case C_MANUAL: /* --manual */
+    if(toggle)   /* --no-manual shows no manual... */
+      return PARAM_MANUAL_REQUESTED;
+    break;
+  case C_NETRC_OPTIONAL: /* --netrc-optional */
+    config->netrc_opt = toggle;
+    break;
+  case C_NETRC: /* --netrc */
+    config->netrc = toggle;
+    break;
+  case C_BUFFER: /* --buffer */
+    config->nobuffer = !toggle;
+    break;
+  case C_REMOTE_NAME_ALL: /* --remote-name-all */
+    config->remote_name_all = toggle;
+    break;
+  case C_CLOBBER: /* --clobber */
+    if(config->use_resume && !toggle) {
+      errorf("--continue-at is mutually exclusive with --no-clobber");
+      return PARAM_BAD_USE;
+    }
+    config->file_clobber_mode = toggle ? CLOBBER_ALWAYS : CLOBBER_NEVER;
+    break;
+  case C_REMOTE_NAME: /* --remote-name */
+    return parse_remote_name(config, toggle);
+  case C_PROXYTUNNEL: /* --proxytunnel */
+    config->proxytunnel = toggle;
+    break;
+  case C_DISABLE: /* --disable */
+    /* if used first, already taken care of, we do it like this so we do not
+       cause an error! */
+    break;
+  case C_REMOTE_TIME: /* --remote-time */
+    config->remote_time = toggle;
+    break;
+  case C_SILENT: /* --silent */
+    global->silent = toggle;
+    break;
+  case C_SKIP_EXISTING: /* --skip-existing */
+    config->skip_existing = toggle;
+    break;
+  case C_SHOW_ERROR: /* --show-error */
+    global->showerror = toggle;
+    break;
+  case C_VERBOSE: /* --verbose */
+    return parse_verbose(toggle);
+  case C_VERSION: /* --version */
+    if(toggle)    /* --no-version yields no output! */
+      return PARAM_VERSION_INFO_REQUESTED;
+    break;
+  case C_PARALLEL: /* --parallel */
+    global->parallel = toggle;
+    break;
+  case C_PARALLEL_IMMEDIATE:   /* --parallel-immediate */
+    global->parallel_connect = toggle;
+    break;
+  case C_MPTCP: /* --mptcp */
+    config->mptcp = toggle;
+    break;
+  case C_LOCATION_TRUSTED: /* --location-trusted */
+    config->unrestricted_auth = toggle;
+    FALLTHROUGH();
+  case C_LOCATION: /* --location */
+    if(config->followlocation == CURLFOLLOW_OBEYCODE)
+      warnf("--location overrides --follow");
+    config->followlocation = toggle ? CURLFOLLOW_ALL : 0;
+    break;
+  case C_FOLLOW: /* --follow */
+    if(config->followlocation == CURLFOLLOW_ALL)
+      warnf("--follow overrides --location");
+    config->followlocation = toggle ? CURLFOLLOW_OBEYCODE : 0;
+    break;
+  default:
+    return PARAM_OPTION_UNKNOWN;
+  }
+  return PARAM_OK;
+}
+
+static ParameterError existingfile(char **store,
+                                   const struct LongShort *a,
+                                   const char *filename)
+{
+  curlx_struct_stat info;
+  if(curlx_stat(filename, &info)) {
+    errorf("The file '%s' provided to --%s does not exist",
+           filename, a->lname);
+    return PARAM_BAD_USE;
+  }
+  return getstr(store, filename, DENY_BLANK);
+}
+
+/* opt_file handles file options */
+static ParameterError opt_file(struct OperationConfig *config,
+                               const struct LongShort *a,
+                               const char *nextarg,
+                               int max_recursive)
+{
+  ParameterError err = PARAM_OK;
+  if((nextarg[0] == '-') && nextarg[1]) {
+    /* if the filename looks like a command line option */
+    warnf("The filename argument '%s' looks like a flag.", nextarg);
+  }
+  switch(a->cmd) {
+  case C_ABSTRACT_UNIX_SOCKET: /* --abstract-unix-socket */
+    config->abstract_unix_socket = TRUE;
+    err = getstr(&config->unix_socket_path, nextarg, DENY_BLANK);
+    break;
+  case C_CACERT: /* --cacert */
+    err = existingfile(&config->cacert, a, nextarg);
+    break;
+  case C_CAPATH: /* --capath */
+    err = getstr(&config->capath, nextarg, DENY_BLANK);
+    break;
+  case C_CERT: /* --cert */
+    err = GetFileAndPassword(nextarg, &config->cert, &config->key_passwd);
+    break;
+  case C_CONFIG: /* --config */
+    if(--max_recursive < 0) {
+      errorf("Max config file recursion level reached (%d)",
+             CONFIG_MAX_LEVELS);
+      err = PARAM_BAD_USE;
+    }
+    else {
+      err = parseconfig(nextarg, max_recursive, NULL);
+    }
+    break;
+  case C_CRLFILE: /* --crlfile */
+    err = existingfile(&config->crlfile, a, nextarg);
+    break;
+  case C_DUMP_HEADER: /* --dump-header */
+    err = getstr(&config->headerfile, nextarg, DENY_BLANK);
+    break;
+  case C_ETAG_SAVE: /* --etag-save */
+    if(config->num_urls > 1) {
+      errorf("The etag options only work on a single URL");
+      err = PARAM_BAD_USE;
+    }
+    else
+      err = getstr(&config->etag_save_file, nextarg, DENY_BLANK);
+    break;
+  case C_ETAG_COMPARE: /* --etag-compare */
+    if(config->num_urls > 1) {
+      errorf("The etag options only work on a single URL");
+      err = PARAM_BAD_USE;
+    }
+    else
+      err = getstr(&config->etag_compare_file, nextarg, DENY_BLANK);
+    break;
+  case C_KEY: /* --key */
+    err = getstr(&config->key, nextarg, DENY_BLANK);
+    break;
+  case C_KNOWNHOSTS: /* --knownhosts */
+    err = existingfile(&config->knownhosts, a, nextarg);
+    break;
+  case C_NETRC_FILE: /* --netrc-file */
+    err = existingfile(&config->netrc_file, a, nextarg);
+    break;
+  case C_OUTPUT: /* --output */
+    err = parse_output(config, nextarg);
+    break;
+  case C_PROXY_CACERT: /* --proxy-cacert */
+    err = existingfile(&config->proxy_cacert, a, nextarg);
+    break;
+  case C_PROXY_CAPATH: /* --proxy-capath */
+    err = getstr(&config->proxy_capath, nextarg, DENY_BLANK);
+    break;
+  case C_PROXY_CERT: /* --proxy-cert */
+    err = GetFileAndPassword(nextarg, &config->proxy_cert,
+                             &config->proxy_key_passwd);
+    break;
+  case C_PROXY_CRLFILE: /* --proxy-crlfile */
+    err = existingfile(&config->proxy_crlfile, a, nextarg);
+    break;
+  case C_PROXY_KEY: /* --proxy-key */
+    err = getstr(&config->proxy_key, nextarg, ALLOW_BLANK);
+    break;
+  case C_SSL_SESSIONS: /* --ssl-sessions */
+    if(feature_ssls_export)
+      err = getstr(&global->ssl_sessions, nextarg, DENY_BLANK);
+    else
+      err = PARAM_LIBCURL_DOESNT_SUPPORT;
+    break;
+  case C_STDERR: /* --stderr */
+    tool_set_stderr_file(nextarg);
+    break;
+  case C_TRACE: /* --trace */
+    err = getstr(&global->trace_dump, nextarg, DENY_BLANK);
+    if(!err) {
+      if(global->tracetype && (global->tracetype != TRACE_BIN))
+        warnf("--trace overrides an earlier trace/verbose option");
+      global->tracetype = TRACE_BIN;
+    }
+    break;
+  case C_TRACE_ASCII: /* --trace-ascii */
+    err = getstr(&global->trace_dump, nextarg, DENY_BLANK);
+    if(!err) {
+      if(global->tracetype && (global->tracetype != TRACE_ASCII))
+        warnf("--trace-ascii overrides an earlier trace/verbose option");
+      global->tracetype = TRACE_ASCII;
+    }
+    break;
+  case C_UNIX_SOCKET: /* --unix-socket */
+    config->abstract_unix_socket = FALSE;
+    err = getstr(&config->unix_socket_path, nextarg, DENY_BLANK);
+    break;
+  case C_UPLOAD_FILE: /* --upload-file */
+    err = parse_upload_file(config, nextarg);
+    break;
+  }
+  return err;
+}
+
+/* options that accept unsigned numbers */
+static ParameterError opt_unum(struct OperationConfig *config,
+                               const struct LongShort *a,
+                               const char *nextarg)
+{
+  ParameterError err = PARAM_OK;
+  long val;
+  err = str2unum(&val, nextarg);
+  if(err)
+    return err;
+  switch(a->cmd) {
+  case C_VLAN_PRIORITY: /* --vlan-priority */
+    if(val > 7)
+      return PARAM_NUMBER_TOO_LARGE;
+    config->vlan_priority = val;
+    break;
+  case C_RETRY: /* --retry */
+    config->req_retry = val;
+    break;
+  case C_KEEPALIVE_TIME: /* --keepalive-time */
+    config->alivetime = val;
+    break;
+  case C_KEEPALIVE_CNT: /* --keepalive-cnt */
+    config->alivecnt = val;
+    break;
+  case C_TFTP_BLKSIZE: /* --tftp-blksize */
+    config->tftp_blksize = val;
+    break;
+  case C_HAPPY_EYEBALLS_TIMEOUT_MS: /* --happy-eyeballs-timeout-ms */
+    config->happy_eyeballs_timeout_ms = val;
+    /* 0 is a valid value for this timeout */
+    break;
+  case C_SPEED_TIME: /* --speed-time */
+    /* low speed time */
+    config->low_speed_time = val;
+    if(!config->low_speed_limit)
+      config->low_speed_limit = 1;
+    break;
+  case C_SPEED_LIMIT: /* --speed-limit */
+    /* low speed limit */
+    config->low_speed_limit = val;
+    if(!config->low_speed_time)
+      config->low_speed_time = 30;
+    break;
+  case C_PARALLEL_HOST: /* --parallel-max-host */
+    if(val > MAX_PARALLEL_HOST)
+      global->parallel_host = MAX_PARALLEL_HOST;
+    else if(val < 1)
+      global->parallel_host = PARALLEL_HOST_DEFAULT;
+    else
+      global->parallel_host = (unsigned short)val;
+    break;
+  case C_PARALLEL_MAX:  /* --parallel-max */
+    if(val > MAX_PARALLEL)
+      global->parallel_max = MAX_PARALLEL;
+    else if(val < 1)
+      global->parallel_max = PARALLEL_DEFAULT;
+    else
+      global->parallel_max = (unsigned short)val;
+    break;
+  default:
+    DEBUGASSERT(0);
+    return PARAM_OPTION_UNKNOWN;
+  }
+  return err;
+}
+
+/* handle options that accept seconds */
+static ParameterError opt_secs(struct OperationConfig *config,
+                               const struct LongShort *a,
+                               const char *nextarg)
+{
+  long val;
+  ParameterError err = secs2ms(&val, nextarg);
+  if(err)
+    return err;
+  switch(a->cmd) {
+  case C_CONNECT_TIMEOUT: /* --connect-timeout */
+    config->connecttimeout_ms = val;
+    break;
+  case C_RETRY_DELAY: /* --retry-delay */
+    if(val >= INT32_MAX)
+      val = INT32_MAX;
+    config->retry_delay_ms = (uint32_t)val;
+    break;
+  case C_RETRY_MAX_TIME: /* --retry-max-time */
+    config->retry_maxtime_ms = val;
+    break;
+  case C_EXPECT100_TIMEOUT: /* --expect100-timeout */
+    config->expect100timeout_ms = val;
+    break;
+  case C_MAX_TIME: /* --max-time */
+    /* specified max time */
+    config->timeout_ms = val;
+    break;
+  default:
+    DEBUGASSERT(0);
+    return PARAM_OPTION_UNKNOWN;
+  }
+  return err;
+}
+
+/* opt_string handles string options */
+static ParameterError opt_string(struct OperationConfig *config,
+                                 const struct LongShort *a,
+                                 const char *nextarg)
+{
+  ParameterError err = PARAM_OK;
+  curl_off_t value;
   static const char *redir_protos[] = {
     "http",
     "https",
@@ -765,21 +2482,494 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
     "ftps",
     NULL
   };
-#ifdef HAVE_WRITABLE_ARGV
-  argv_item_t clearthis = NULL;
-#else
-  (void)cleararg;
-#endif
+  if(!nextarg)
+    nextarg = "";
 
-  *usedarg = FALSE; /* default is that we don't use the arg */
+  switch(a->cmd) {
+  case C_DNS_IPV4_ADDR: /* --dns-ipv4-addr */
+    if(!curlinfo->ares_num) /* c-ares is needed for this */
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    /* addr in dot notation */
+    return getstr(&config->dns_ipv4_addr, nextarg, DENY_BLANK);
+
+  case C_DNS_IPV6_ADDR: /* --dns-ipv6-addr */
+    if(!curlinfo->ares_num) /* c-ares is needed for this */
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    /* addr in dot notation */
+    return getstr(&config->dns_ipv6_addr, nextarg, DENY_BLANK);
+
+  case C_OAUTH2_BEARER: /* --oauth2-bearer */
+    config->authtype |= CURLAUTH_BEARER;
+    return getstr(&config->oauth_bearer, nextarg, DENY_BLANK);
+
+  case C_DOH_URL: /* --doh-url */
+    err = getstr(&config->doh_url, nextarg, ALLOW_BLANK);
+    if(!err && config->doh_url && !config->doh_url[0])
+      /* if given a blank string, make it NULL again */
+      curlx_safefree(config->doh_url);
+    break;
+
+  case C_CIPHERS: /* -- ciphers */
+    err = getstr(&config->cipher_list, nextarg, DENY_BLANK);
+    break;
+
+  case C_DNS_INTERFACE: /* --dns-interface */
+    if(!curlinfo->ares_num) /* c-ares is needed for this */
+      err = PARAM_LIBCURL_DOESNT_SUPPORT;
+    else
+      /* interface name */
+      err = getstr(&config->dns_interface, nextarg, DENY_BLANK);
+    break;
+  case C_DNS_SERVERS: /* --dns-servers */
+    if(!curlinfo->ares_num) /* c-ares is needed for this */
+      err = PARAM_LIBCURL_DOESNT_SUPPORT;
+    else
+      /* IP addrs of DNS servers */
+      err = getstr(&config->dns_servers, nextarg, DENY_BLANK);
+    break;
+  case C_LIMIT_RATE: /* --limit-rate */
+    err = GetSizeParameter(nextarg, &value);
+    if(!err) {
+      config->recvpersecond = value;
+      config->sendpersecond = value;
+    }
+    break;
+  case C_RATE:
+    err = set_rate(nextarg);
+    break;
+  case C_CREATE_FILE_MODE: /* --create-file-mode */
+    err = oct2nummax(&config->create_file_mode, nextarg, 0777);
+    break;
+  case C_MAX_REDIRS: /* --max-redirs */
+    /* specified max no of redirects (http(s)), this accepts -1 as a
+       special condition */
+    err = str2num(&config->maxredirs, nextarg);
+    if(!err && (config->maxredirs < -1))
+      err = PARAM_BAD_NUMERIC;
+    break;
+#ifndef CURL_DISABLE_IPFS
+  case C_IPFS_GATEWAY: /* --ipfs-gateway */
+    err = getstr(&config->ipfs_gateway, nextarg, DENY_BLANK);
+    break;
+#endif
+  case C_AWS_SIGV4: /* --aws-sigv4 */
+    config->authtype |= CURLAUTH_AWS_SIGV4;
+    err = getstr(&config->aws_sigv4, nextarg, ALLOW_BLANK);
+    break;
+  case C_INTERFACE: /* --interface */
+    /* interface */
+    err = getstr(&config->iface, nextarg, DENY_BLANK);
+    break;
+  case C_HAPROXY_CLIENTIP: /* --haproxy-clientip */
+    err = getstr(&config->haproxy_clientip, nextarg, DENY_BLANK);
+    break;
+  case C_MAX_FILESIZE: /* --max-filesize */
+    err = GetSizeParameter(nextarg, &value);
+    if(!err)
+      config->max_filesize = value;
+    break;
+  case C_URL: /* --url */
+    err = parse_url(config, nextarg);
+    break;
+  case C_SOCKS5: /* --socks5 */
+    /*  socks5 proxy to use, and resolves the name locally and passes on the
+        resolved address */
+    err = getstr(&config->proxy, nextarg, DENY_BLANK);
+    config->proxyver = CURLPROXY_SOCKS5;
+    break;
+  case C_SOCKS4: /* --socks4 */
+    err = getstr(&config->proxy, nextarg, DENY_BLANK);
+    config->proxyver = CURLPROXY_SOCKS4;
+    break;
+  case C_SOCKS4A: /* --socks4a */
+    err = getstr(&config->proxy, nextarg, DENY_BLANK);
+    config->proxyver = CURLPROXY_SOCKS4A;
+    break;
+  case C_SOCKS5_HOSTNAME: /* --socks5-hostname */
+    err = getstr(&config->proxy, nextarg, DENY_BLANK);
+    config->proxyver = CURLPROXY_SOCKS5_HOSTNAME;
+    break;
+  case C_IP_TOS: { /* --ip-tos */
+    struct TOSEntry find;
+    const struct TOSEntry *entry;
+    find.name = nextarg;
+    entry = bsearch(&find, tos_entries,
+                    CURL_ARRAYSIZE(tos_entries),
+                    sizeof(*tos_entries), find_tos);
+    if(entry)
+      config->ip_tos = entry->value;
+    else /* numeric tos value */
+      err = str2unummax(&config->ip_tos, nextarg, 0xFF);
+    break;
+  }
+  case C_FTP_ACCOUNT: /* --ftp-account */
+    err = getstr(&config->ftp_account, nextarg, DENY_BLANK);
+    break;
+  case C_FTP_METHOD: /* --ftp-method */
+    config->ftp_filemethod = ftpfilemethod(nextarg);
+    break;
+  case C_LOCAL_PORT: /* --local-port */
+    err = parse_localport(config, nextarg);
+    break;
+  case C_FTP_ALTERNATIVE_TO_USER: /* --ftp-alternative-to-user */
+    err = getstr(&config->ftp_alternative_to_user, nextarg, DENY_BLANK);
+    break;
+  case C_LIBCURL: /* --libcurl */
+#ifdef CURL_DISABLE_LIBCURL_OPTION
+    warnf("--libcurl option was disabled at build-time");
+    err = PARAM_OPTION_UNKNOWN;
+#else
+    err = getstr(&global->libcurl, nextarg, DENY_BLANK);
+#endif
+    break;
+  case C_NOPROXY: /* --noproxy */
+    /* This specifies the noproxy list */
+    err = getstr(&config->noproxy, nextarg, ALLOW_BLANK);
+    break;
+  case C_PROXY1_0: /* --proxy1.0 */
+    /* http 1.0 proxy */
+    err = getstr(&config->proxy, nextarg, DENY_BLANK);
+    config->proxyver = CURLPROXY_HTTP_1_0;
+    break;
+  case C_MAIL_FROM: /* --mail-from */
+    err = getstr(&config->mail_from, nextarg, DENY_BLANK);
+    break;
+  case C_MAIL_RCPT: /* --mail-rcpt */
+    /* append receiver to a list */
+    err = add2list(&config->mail_rcpt, nextarg);
+    break;
+  case C_PROTO: /* --proto */
+    config->proto_present = TRUE;
+    err = proto2num(built_in_protos, &config->proto_str, nextarg);
+    break;
+  case C_PROTO_REDIR: /* --proto-redir */
+    config->proto_redir_present = TRUE;
+    if(proto2num(redir_protos, &config->proto_redir_str, nextarg))
+      err = PARAM_BAD_USE;
+    break;
+  case C_RESOLVE: /* --resolve */
+    err = add2list(&config->resolve, nextarg);
+    break;
+  case C_DELEGATION: /* --delegation */
+    config->gssapi_delegation = delegation(nextarg);
+    break;
+  case C_MAIL_AUTH: /* --mail-auth */
+    err = getstr(&config->mail_auth, nextarg, DENY_BLANK);
+    break;
+  case C_SASL_AUTHZID: /* --sasl-authzid */
+    err = getstr(&config->sasl_authzid, nextarg, DENY_BLANK);
+    break;
+  case C_PROXY_SERVICE_NAME: /* --proxy-service-name */
+    err = getstr(&config->proxy_service_name, nextarg, DENY_BLANK);
+    break;
+  case C_SERVICE_NAME: /* --service-name */
+    err = getstr(&config->service_name, nextarg, DENY_BLANK);
+    break;
+  case C_PROTO_DEFAULT: /* --proto-default */
+    err = getstr(&config->proto_default, nextarg, DENY_BLANK);
+    if(!err)
+      err = check_protocol(config->proto_default);
+    break;
+  case C_CONNECT_TO: /* --connect-to */
+    err = add2list(&config->connect_to, nextarg);
+    break;
+  case C_TLS_MAX: /* --tls-max */
+    err = str2tls_max(&config->ssl_version_max, nextarg);
+    if(!err && (config->ssl_version_max < config->ssl_version)) {
+      errorf("--tls-max set lower than minimum accepted version");
+      err = PARAM_BAD_USE;
+    }
+    break;
+  case C_TRACE_CONFIG: /* --trace-config */
+    global->trace_set = TRUE;
+    if(set_trace_config(nextarg))
+      err = PARAM_NO_MEM;
+    break;
+  case C_VARIABLE: /* --variable */
+    err = setvariable(nextarg);
+    break;
+  case C_TLS13_CIPHERS: /* --tls13-ciphers */
+    err = getstr(&config->cipher13_list, nextarg, DENY_BLANK);
+    break;
+  case C_PROXY_TLS13_CIPHERS: /* --proxy-tls13-ciphers */
+    err = getstr(&config->proxy_cipher13_list, nextarg, DENY_BLANK);
+    break;
+  case C_USER_AGENT: /* --user-agent */
+    err = getstr(&config->useragent, nextarg, ALLOW_BLANK);
+    break;
+  case C_ALT_SVC: /* --alt-svc */
+    if(!feature_altsvc)
+      err = PARAM_LIBCURL_DOESNT_SUPPORT;
+    else
+      err = getstr(&config->altsvc, nextarg, ALLOW_BLANK);
+    break;
+  case C_HSTS: /* --hsts */
+    if(!feature_hsts)
+      err = PARAM_LIBCURL_DOESNT_SUPPORT;
+    else
+      err = getstr(&config->hsts, nextarg, ALLOW_BLANK);
+    break;
+  case C_COOKIE: /* --cookie */
+    if(strchr(nextarg, '=')) {
+      /* A cookie string must have a =-letter */
+      err = add2list(&config->cookies, nextarg);
+      break;
+    }
+    else {
+      /* We have a cookie file to read from! */
+      err = add2list(&config->cookiefiles, nextarg);
+    }
+    break;
+  case C_COOKIE_JAR: /* --cookie-jar */
+    err = getstr(&config->cookiejar, nextarg, DENY_BLANK);
+    break;
+  case C_CONTINUE_AT: /* --continue-at */
+    err = parse_continue_at(config, nextarg);
+    break;
+  case C_DATA: /* --data */
+  case C_DATA_ASCII:  /* --data-ascii */
+  case C_DATA_BINARY:  /* --data-binary */
+  case C_DATA_URLENCODE:  /* --data-urlencode */
+  case C_JSON:  /* --json */
+  case C_DATA_RAW:  /* --data-raw */
+    err = set_data((cmdline_t)a->cmd, nextarg, config);
+    break;
+  case C_URL_QUERY:  /* --url-query */
+    err = url_query(nextarg, config);
+    break;
+  case C_REFERER: { /* --referer */
+    size_t len = strlen(nextarg);
+    /* does it end with ;auto ? */
+    if(len >= 5 && !strcmp(";auto", &nextarg[len - 5])) {
+      /* Automatic referer requested, this may be combined with a set initial
+         one */
+      config->autoreferer = TRUE;
+      len -= 5;
+    }
+    else
+      config->autoreferer = FALSE;
+
+    if(len)
+      err = getstrn(&config->referer, nextarg, len, ALLOW_BLANK);
+    else
+      curlx_safefree(config->referer);
+  }
+    break;
+  case C_CERT_TYPE: /* --cert-type */
+    err = getstr(&config->cert_type, nextarg, DENY_BLANK);
+    break;
+  case C_KEY_TYPE: /* --key-type */
+    err = getstr(&config->key_type, nextarg, DENY_BLANK);
+    break;
+  case C_PASS: /* --pass */
+    err = getstr(&config->key_passwd, nextarg, DENY_BLANK);
+    break;
+  case C_ENGINE: /* --engine */
+    err = getstr(&config->engine, nextarg, DENY_BLANK);
+    if(!err &&
+       config->engine && !strcmp(config->engine, "list")) {
+      err = PARAM_ENGINES_REQUESTED;
+    }
+    break;
+  case C_ECH: /* --ech */
+    err = parse_ech(config, nextarg);
+    break;
+  case C_PUBKEY: /* --pubkey */
+    err = getstr(&config->pubkey, nextarg, DENY_BLANK);
+    break;
+  case C_HOSTPUBMD5: /* --hostpubmd5 */
+    err = getstr(&config->hostpubmd5, nextarg, DENY_BLANK);
+    if(!err) {
+      if(!config->hostpubmd5 || strlen(config->hostpubmd5) != 32)
+        err = PARAM_BAD_USE;
+    }
+    break;
+  case C_HOSTPUBSHA256: /* --hostpubsha256 */
+    err = getstr(&config->hostpubsha256, nextarg, DENY_BLANK);
+    break;
+  case C_TLSUSER: /* --tlsuser */
+    if(!feature_tls_srp)
+      err = PARAM_LIBCURL_DOESNT_SUPPORT;
+    else
+      err = getstr(&config->tls_username, nextarg, DENY_BLANK);
+    break;
+  case C_TLSPASSWORD: /* --tlspassword */
+    if(!feature_tls_srp)
+      err = PARAM_LIBCURL_DOESNT_SUPPORT;
+    else
+      err = getstr(&config->tls_password, nextarg, ALLOW_BLANK);
+    break;
+  case C_TLSAUTHTYPE: /* --tlsauthtype */
+    if(!feature_tls_srp)
+      err = PARAM_LIBCURL_DOESNT_SUPPORT;
+    else {
+      err = getstr(&config->tls_authtype, nextarg, DENY_BLANK);
+      if(!err && config->tls_authtype && strcmp(config->tls_authtype, "SRP"))
+        err = PARAM_LIBCURL_DOESNT_SUPPORT; /* only support TLS-SRP */
+    }
+    break;
+  case C_PINNEDPUBKEY: /* --pinnedpubkey */
+    err = getstr(&config->pinnedpubkey, nextarg, DENY_BLANK);
+    break;
+  case C_PROXY_PINNEDPUBKEY: /* --proxy-pinnedpubkey */
+    err = getstr(&config->proxy_pinnedpubkey, nextarg, DENY_BLANK);
+    break;
+  case C_PROXY_TLSUSER: /* --proxy-tlsuser */
+    if(!feature_tls_srp)
+      err = PARAM_LIBCURL_DOESNT_SUPPORT;
+    else
+      err = getstr(&config->proxy_tls_username, nextarg, ALLOW_BLANK);
+    break;
+  case C_PROXY_TLSPASSWORD: /* --proxy-tlspassword */
+    if(!feature_tls_srp)
+      err = PARAM_LIBCURL_DOESNT_SUPPORT;
+    else
+      err = getstr(&config->proxy_tls_password, nextarg, DENY_BLANK);
+    break;
+  case C_PROXY_TLSAUTHTYPE: /* --proxy-tlsauthtype */
+    if(!feature_tls_srp)
+      err = PARAM_LIBCURL_DOESNT_SUPPORT;
+    else {
+      err = getstr(&config->proxy_tls_authtype, nextarg, DENY_BLANK);
+      if(!err && config->proxy_tls_authtype &&
+         strcmp(config->proxy_tls_authtype, "SRP"))
+        err = PARAM_LIBCURL_DOESNT_SUPPORT; /* only support TLS-SRP */
+    }
+    break;
+  case C_PROXY_CERT_TYPE: /* --proxy-cert-type */
+    err = getstr(&config->proxy_cert_type, nextarg, DENY_BLANK);
+    break;
+  case C_PROXY_KEY_TYPE: /* --proxy-key-type */
+    err = getstr(&config->proxy_key_type, nextarg, DENY_BLANK);
+    break;
+  case C_PROXY_PASS: /* --proxy-pass */
+    err = getstr(&config->proxy_key_passwd, nextarg, ALLOW_BLANK);
+    break;
+  case C_PROXY_CIPHERS: /* --proxy-ciphers */
+    err = getstr(&config->proxy_cipher_list, nextarg, DENY_BLANK);
+    break;
+  case C_LOGIN_OPTIONS: /* --login-options */
+    err = getstr(&config->login_options, nextarg, ALLOW_BLANK);
+    break;
+  case C_CURVES: /* --curves */
+    err = getstr(&config->ssl_ec_curves, nextarg, DENY_BLANK);
+    break;
+  case C_SIGNATURE_ALGORITHMS: /* --sigalgs */
+    err = getstr(&config->ssl_signature_algorithms, nextarg, DENY_BLANK);
+    break;
+  case C_FORM: /* --form */
+  case C_FORM_STRING: /* --form-string */
+    /* "form data" simulation, this is a little advanced so lets do our best
+       to sort this out slowly and carefully */
+    if(formparse(nextarg, &config->mimeroot, &config->mimecurrent,
+                 (a->cmd == C_FORM_STRING))) /* literal string */
+      err = PARAM_BAD_USE;
+    else if(SetHTTPrequest(TOOL_HTTPREQ_MIMEPOST, &config->httpreq))
+      err = PARAM_BAD_USE;
+    break;
+  case C_REQUEST_TARGET: /* --request-target */
+    err = getstr(&config->request_target, nextarg, DENY_BLANK);
+    break;
+  case C_HEADER: /* --header */
+  case C_PROXY_HEADER: /* --proxy-header */
+    err = parse_header(config, (cmdline_t)a->cmd, nextarg);
+    break;
+  case C_OUTPUT_DIR: /* --output-dir */
+    err = getstr(&config->output_dir, nextarg, DENY_BLANK);
+    break;
+  case C_FTP_PORT: /* --ftp-port */
+    /* This makes the FTP sessions use PORT instead of PASV */
+    /* use <eth0> or <192.168.10.10> style addresses. Anything except
+       this makes us try to get the "default" address.
+       NOTE: this is a changed behavior since the released 4.1!
+     */
+    err = getstr(&config->ftpport, nextarg, DENY_BLANK);
+    break;
+  case C_FTP_SSL_CCC_MODE: /* --ftp-ssl-ccc-mode */
+    config->ftp_ssl_ccc = TRUE;
+    config->ftp_ssl_ccc_mode = ftpcccmethod(nextarg);
+    break;
+  case C_QUOTE: /* --quote */
+    err = parse_quote(config, nextarg);
+    break;
+  case C_RANGE: /* --range */
+    err = parse_range(config, nextarg);
+    break;
+  case C_TELNET_OPTION: /* --telnet-option */
+    /* Telnet options */
+    err = add2list(&config->telnet_options, nextarg);
+    break;
+  case C_USER: /* --user */
+    /* user:password */
+    err = getstr(&config->userpwd, nextarg, ALLOW_BLANK);
+    break;
+  case C_PROXY_USER: /* --proxy-user */
+    /* Proxy user:password */
+    err = getstr(&config->proxyuserpwd, nextarg, ALLOW_BLANK);
+    break;
+  case C_WRITE_OUT: /* --write-out */
+    err = parse_writeout(config, nextarg);
+    break;
+  case C_PREPROXY: /* --preproxy */
+    err = getstr(&config->preproxy, nextarg, DENY_BLANK);
+    break;
+  case C_PROXY: /* --proxy */
+    /* --proxy */
+    err = getstr(&config->proxy, nextarg, ALLOW_BLANK);
+    if(config->proxyver != CURLPROXY_HTTPS2 &&
+                config->proxyver != CURLPROXY_HTTPS3)
+      config->proxyver = CURLPROXY_HTTP;
+    break;
+  case C_REQUEST: /* --request */
+    /* set custom request */
+    err = getstr(&config->customrequest, nextarg, DENY_BLANK);
+    break;
+  case C_TIME_COND: /* --time-cond */
+    err = parse_time_cond(config, nextarg);
+    break;
+  case C_UPLOAD_FLAGS: /* --upload-flags */
+    err = parse_upload_flags(config, nextarg);
+    break;
+  }
+  return err;
+}
+
+/* detect e2 80 80 - e2 80 ff */
+static bool has_leading_unicode(const unsigned char *arg)
+{
+  return (arg[0] == 0xe2) && (arg[1] == 0x80) && (arg[2] & 0x80);
+}
+
+/* the longest command line option, excluding the leading -- */
+#define MAX_OPTION_LEN 26
+
+ParameterError getparameter(const char *flag, /* f or -long-flag */
+                            const char *nextarg,    /* NULL if unset */
+                            bool *usedarg,    /* set to TRUE if the arg
+                                                 has been used */
+                            struct OperationConfig *config,
+                            int max_recursive)
+{
+  const char *parse = NULL;
+  bool longopt = FALSE;
+  bool singleopt = FALSE; /* when true means '-o foo' used '-ofoo' */
+  ParameterError err = PARAM_OK;
+  bool toggle = TRUE; /* how to switch boolean options, on or off. Controlled
+                         by using --OPTION or --no-OPTION */
+  bool nextalloc = FALSE; /* if nextarg is allocated */
+  bool consumearg = TRUE; /* the argument comes separate */
+  const struct LongShort *a = NULL;
+  verbose_nopts = 0; /* options processed in `flag`*/
+
+  *usedarg = FALSE; /* default is that we do not use the arg */
 
   if(('-' != flag[0]) || ('-' == flag[1])) {
     /* this should be a long name */
     const char *word = ('-' == flag[0]) ? flag + 2 : flag;
-    size_t fnam = strlen(word);
-    int numhits = 0;
     bool noflagged = FALSE;
     bool expand = FALSE;
+    const char *p;
+    struct Curl_str out;
 
     if(!strncmp(word, "no-", 3)) {
       /* disable this option but ignore the "no-" part when looking for it */
@@ -793,44 +2983,43 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
       expand = TRUE;
     }
 
-    for(j = 0; j < sizeof(aliases)/sizeof(aliases[0]); j++) {
-      if(curl_strnequal(aliases[j].lname, word, fnam)) {
-        longopt = TRUE;
-        numhits++;
-        if(curl_strequal(aliases[j].lname, word)) {
-          parse = aliases[j].letter;
-          hit = j;
-          numhits = 1; /* a single unique hit */
-          break;
-        }
-        parse = aliases[j].letter;
-        hit = j;
-      }
+    p = word;
+    /* is there an '=' ? */
+    if(!curlx_str_until(&p, &out, MAX_OPTION_LEN, '=') &&
+       !curlx_str_single(&p, '=')) {
+      /* there is an equal sign */
+      char tempword[MAX_OPTION_LEN + 1];
+      memcpy(tempword, curlx_str(&out), curlx_strlen(&out));
+      tempword[curlx_strlen(&out)] = 0;
+      a = findlongopt(tempword);
+      nextarg = p;
+      consumearg = FALSE; /* it is not separate */
     }
-    if(numhits > 1) {
-      /* this is at least the second match! */
-      err = PARAM_OPTION_AMBIGUOUS;
-      goto error;
+    else
+      a = findlongopt(word);
+
+    if(a) {
+      longopt = TRUE;
     }
-    else if(hit < 0) {
+    else {
       err = PARAM_OPTION_UNKNOWN;
       goto error;
     }
-    else if(noflagged && (aliases[hit].desc != ARG_BOOL)) {
-      /* --no- prefixed an option that isn't boolean! */
-      err = PARAM_NO_NOT_BOOLEAN;
+    if(noflagged && (ARGTYPE(a->desc) != ARG_BOOL)) {
+      /* --no- prefixed an option that is not boolean! */
+      err = PARAM_NO_PREFIX;
       goto error;
     }
-    else if(expand) {
-      struct curlx_dynbuf nbuf;
+    else if(expand && nextarg) {
+      struct dynbuf nbuf;
       bool replaced;
 
-      if(aliases[hit].desc != ARG_STRING) {
-        /* --expand on an option that isn't a string */
+      if(ARGTYPE(a->desc) < ARG_STRG) {
+        /* --expand on an option that does not take an argument */
         err = PARAM_EXPAND_ERROR;
         goto error;
       }
-      err = varexpand(global, nextarg, &nbuf, &replaced);
+      err = varexpand(nextarg, &nbuf, &replaced);
       if(err) {
         curlx_dyn_free(&nbuf);
         goto error;
@@ -843,1851 +3032,105 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
   }
   else {
     flag++; /* prefixed with one dash, pass it */
-    hit = -1;
     parse = flag;
   }
 
   do {
     /* we can loop here if we have multiple single-letters */
-
     if(!longopt) {
-      letter = (char)*parse;
-      subletter = '\0';
-    }
-    else {
-      letter = parse[0];
-      subletter = parse[1];
-    }
-
-    if(hit < 0) {
-      for(j = 0; j < sizeof(aliases)/sizeof(aliases[0]); j++) {
-        if(letter == aliases[j].letter[0]) {
-          hit = j;
-          break;
-        }
-      }
-      if(hit < 0) {
+      a = findshortopt(*parse);
+      if(!a) {
         err = PARAM_OPTION_UNKNOWN;
         break;
       }
+      toggle = !(a->desc & ARG_NO);
     }
-
-    if(aliases[hit].desc >= ARG_STRING) {
+    if((a->desc & ARG_TLS) && !feature_ssl) {
+      err = PARAM_LIBCURL_DOESNT_SUPPORT;
+      break;
+    }
+    else if(ARGTYPE(a->desc) >= ARG_STRG) {
       /* this option requires an extra parameter */
       if(!longopt && parse[1]) {
-        nextarg = (char *)&parse[1]; /* this is the actual extra parameter */
-        singleopt = TRUE;   /* don't loop anymore after this */
+        nextarg = &parse[1]; /* this is the actual extra parameter */
+        singleopt = TRUE;   /* do not loop anymore after this */
+      }
+      else if(a->cmd == C_HELP) {
+        /* --help is special */
+        tool_help((nextarg && *nextarg) ? nextarg : NULL);
+        err = PARAM_HELP_REQUESTED;
+        break;
       }
       else if(!nextarg) {
         err = PARAM_REQUIRES_PARAMETER;
         break;
       }
       else {
-#ifdef HAVE_WRITABLE_ARGV
-        clearthis = cleararg;
-#endif
-        *usedarg = TRUE; /* mark it as used */
+        *usedarg = consumearg; /* mark it as used */
+      }
+      if(a->desc & ARG_DEPR) {
+        opt_depr(a);
+        break;
       }
 
-      if((aliases[hit].desc == ARG_FILENAME) &&
-         (nextarg[0] == '-') && nextarg[1]) {
-        /* if the file name looks like a command line option */
-        warnf(global, "The file name argument '%s' looks like a flag.",
-              nextarg);
+      if(has_leading_unicode((const unsigned char *)nextarg)) {
+        warnf("The argument '%s' starts with a Unicode character. "
+              "Maybe ASCII was intended?", nextarg);
       }
-    }
-    else if((aliases[hit].desc == ARG_NONE) && !toggle) {
-      err = PARAM_NO_PREFIX;
-      break;
-    }
-
-    switch(letter) {
-    case '*': /* options without a short option */
-      switch(subletter) {
-      case '4': /* --dns-ipv4-addr */
-        if(!curlinfo->ares_num) { /* c-ares is needed for this */
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        /* addr in dot notation */
-        GetStr(&config->dns_ipv4_addr, nextarg);
+      switch(ARGTYPE(a->desc)) {
+      case ARG_FILE:
+        err = opt_file(config, a, nextarg, max_recursive);
         break;
-      case '6': /* --dns-ipv6-addr */
-        if(!curlinfo->ares_num) { /* c-ares is needed for this */
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        /* addr in dot notation */
-        GetStr(&config->dns_ipv6_addr, nextarg);
+      case ARG_STRG:
+        err = opt_string(config, a, nextarg);
         break;
-      case 'a': /* random-file */
+      case ARG_SECS:
+        err = opt_secs(config, a, nextarg);
         break;
-      case 'b': /* egd-file */
+      case ARG_UNUM:
+        err = opt_unum(config, a, nextarg);
         break;
-      case 'B': /* OAuth 2.0 bearer token */
-        GetStr(&config->oauth_bearer, nextarg);
-        cleanarg(clearthis);
-        config->authtype |= CURLAUTH_BEARER;
-        break;
-      case 'c': /* connect-timeout */
-        err = secs2ms(&config->connecttimeout_ms, nextarg);
-        break;
-      case 'C': /* doh-url */
-        GetStr(&config->doh_url, nextarg);
-        if(config->doh_url && !config->doh_url[0])
-          /* if given a blank string, we make it NULL again */
-          Curl_safefree(config->doh_url);
-        break;
-      case 'd': /* ciphers */
-        GetStr(&config->cipher_list, nextarg);
-        break;
-      case 'D': /* --dns-interface */
-        if(!curlinfo->ares_num) /* c-ares is needed for this */
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-        else
-          /* interface name */
-          GetStr(&config->dns_interface, nextarg);
-        break;
-      case 'e': /* --disable-epsv */
-        config->disable_epsv = toggle;
-        break;
-      case 'f': /* --disallow-username-in-url */
-        config->disallow_username_in_url = toggle;
-        break;
-      case 'E': /* --epsv */
-        config->disable_epsv = (!toggle)?TRUE:FALSE;
-        break;
-      case 'F': /* --dns-servers */
-        if(!curlinfo->ares_num) /* c-ares is needed for this */
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-        else
-          /* IP addrs of DNS servers */
-          GetStr(&config->dns_servers, nextarg);
-        break;
-      case 'g': /* --trace */
-        GetStr(&global->trace_dump, nextarg);
-        if(global->tracetype && (global->tracetype != TRACE_BIN))
-          warnf(global, "--trace overrides an earlier trace/verbose option");
-        global->tracetype = TRACE_BIN;
-        break;
-      case 'G': /* --npn */
-        warnf(global, "--npn is no longer supported");
-        break;
-      case 'h': /* --trace-ascii */
-        GetStr(&global->trace_dump, nextarg);
-        if(global->tracetype && (global->tracetype != TRACE_ASCII))
-          warnf(global,
-                "--trace-ascii overrides an earlier trace/verbose option");
-        global->tracetype = TRACE_ASCII;
-        break;
-      case 'H': /* --alpn */
-        config->noalpn = (!toggle)?TRUE:FALSE;
-        break;
-      case 'i': /* --limit-rate */
-      {
-        curl_off_t value;
-        err = GetSizeParameter(global, nextarg, "rate", &value);
-        if(err)
-          break;
-        config->recvpersecond = value;
-        config->sendpersecond = value;
-      }
-      break;
-      case 'I': /* --rate (request rate) */
-      {
-        /* support a few different suffixes, extract the suffix first, then
-           get the number and convert to per hour.
-           /s == per second
-           /m == per minute
-           /h == per hour (default)
-           /d == per day (24 hours)
-        */
-        char *div = strchr(nextarg, '/');
-        char number[26];
-        long denominator;
-        long numerator = 60*60*1000; /* default per hour */
-        size_t numlen = div ? (size_t)(div - nextarg) : strlen(nextarg);
-        if(numlen > sizeof(number)-1) {
-          err = PARAM_NUMBER_TOO_LARGE;
-          break;
-        }
-        strncpy(number, nextarg, numlen);
-        number[numlen] = 0;
-        err = str2unum(&denominator, number);
-        if(err)
-          break;
-
-        if(denominator < 1) {
-          err = PARAM_BAD_USE;
-          break;
-        }
-        if(div) {
-          char unit = div[1];
-          switch(unit) {
-          case 's': /* per second */
-            numerator = 1000;
-            break;
-          case 'm': /* per minute */
-            numerator = 60*1000;
-            break;
-          case 'h': /* per hour */
-            break;
-          case 'd': /* per day */
-            numerator = 24*60*60*1000;
-            break;
-          default:
-            errorf(global, "unsupported --rate unit");
-            err = PARAM_BAD_USE;
-            break;
-          }
-        }
-        global->ms_per_transfer = numerator/denominator;
-      }
-      break;
-
-      case 'j': /* --compressed */
-        if(toggle && !(feature_libz || feature_brotli || feature_zstd)) {
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        config->encoding = toggle;
-        break;
-
-      case 'J': /* --tr-encoding */
-        config->tr_encoding = toggle;
-        break;
-
-      case 'k': /* --digest */
-        if(toggle)
-          config->authtype |= CURLAUTH_DIGEST;
-        else
-          config->authtype &= ~CURLAUTH_DIGEST;
-        break;
-
-      case 'l': /* --negotiate */
-        if(!toggle)
-          config->authtype &= ~CURLAUTH_NEGOTIATE;
-        else if(feature_spnego)
-          config->authtype |= CURLAUTH_NEGOTIATE;
-        else {
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        break;
-
-      case 'm': /* --ntlm */
-        if(!toggle)
-          config->authtype &= ~CURLAUTH_NTLM;
-        else if(feature_ntlm)
-          config->authtype |= CURLAUTH_NTLM;
-        else {
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        break;
-
-      case 'M': /* --ntlm-wb */
-        if(!toggle)
-          config->authtype &= ~CURLAUTH_NTLM_WB;
-        else if(feature_ntlm_wb)
-          config->authtype |= CURLAUTH_NTLM_WB;
-        else {
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        break;
-
-      case 'n': /* --basic for completeness */
-        if(toggle)
-          config->authtype |= CURLAUTH_BASIC;
-        else
-          config->authtype &= ~CURLAUTH_BASIC;
-        break;
-
-      case 'o': /* --anyauth, let libcurl pick it */
-        if(toggle)
-          config->authtype = CURLAUTH_ANY;
-        /* --no-anyauth simply doesn't touch it */
-        break;
-
-#ifdef USE_WATT32
-      case 'p': /* --wdebug */
-        dbug_init();
-        break;
-#endif
-      case 'q': /* --ftp-create-dirs */
-        config->ftp_create_dirs = toggle;
-        break;
-
-      case 'r': /* --create-dirs */
-        config->create_dirs = toggle;
-        break;
-
-      case 'R': /* --create-file-mode */
-        err = oct2nummax(&config->create_file_mode, nextarg, 0777);
-        break;
-
-      case 's': /* --max-redirs */
-        /* specified max no of redirects (http(s)), this accepts -1 as a
-           special condition */
-        err = str2num(&config->maxredirs, nextarg);
-        if(err)
-          break;
-        if(config->maxredirs < -1)
-          err = PARAM_BAD_NUMERIC;
-        break;
-
-      case 't': /* --proxy-ntlm */
-        if(!feature_ntlm) {
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        config->proxyntlm = toggle;
-        break;
-
-      case 'u': /* --crlf */
-        /* LF -> CRLF conversion? */
-        config->crlf = toggle;
-        break;
-
-      case 'V': /* --aws-sigv4 */
-        config->authtype |= CURLAUTH_AWS_SIGV4;
-        GetStr(&config->aws_sigv4, nextarg);
-        break;
-
-      case 'v': /* --stderr */
-        tool_set_stderr_file(global, nextarg);
-        break;
-      case 'w': /* --interface */
-        /* interface */
-        GetStr(&config->iface, nextarg);
-        break;
-      case 'x': /* --krb */
-        /* kerberos level string */
-        if(!feature_spnego) {
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        GetStr(&config->krblevel, nextarg);
-        break;
-      case 'X': /* --haproxy-protocol */
-        config->haproxy_protocol = toggle;
-        break;
-      case 'P': /* --haproxy-clientip */
-        GetStr(&config->haproxy_clientip, nextarg);
-        break;
-      case 'y': /* --max-filesize */
-        {
-          curl_off_t value;
-          err =
-            GetSizeParameter(global, nextarg, "max-filesize", &value);
-          if(err)
-            break;
-          config->max_filesize = value;
-        }
-        break;
-      case 'z': /* --disable-eprt */
-        config->disable_eprt = toggle;
-        break;
-      case 'Z': /* --eprt */
-        config->disable_eprt = (!toggle)?TRUE:FALSE;
-        break;
-      case '~': /* --xattr */
-        config->xattr = toggle;
-        break;
-      case '@': /* the URL! */
-      {
-        struct getout *url;
-
-        if(!config->url_get)
-          config->url_get = config->url_list;
-
-        if(config->url_get) {
-          /* there's a node here, if it already is filled-in continue to find
-             an "empty" node */
-          while(config->url_get && (config->url_get->flags & GETOUT_URL))
-            config->url_get = config->url_get->next;
-        }
-
-        /* now there might or might not be an available node to fill in! */
-
-        if(config->url_get)
-          /* existing node */
-          url = config->url_get;
-        else
-          /* there was no free node, create one! */
-          config->url_get = url = new_getout(config);
-
-        if(!url) {
-          err = PARAM_NO_MEM;
-          break;
-        }
-
-        /* fill in the URL */
-        GetStr(&url->url, nextarg);
-        url->flags |= GETOUT_URL;
-      }
-      }
-      break;
-    case '$': /* more options without a short option */
-      switch(subletter) {
-      case 'a': /* --ssl */
-        if(toggle && !feature_ssl) {
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        config->ftp_ssl = toggle;
-        if(config->ftp_ssl)
-          warnf(global,
-                "--ssl is an insecure option, consider --ssl-reqd instead");
-        break;
-      case 'b': /* --ftp-pasv */
-        Curl_safefree(config->ftpport);
-        break;
-      case 'c': /* --socks5 specifies a socks5 proxy to use, and resolves
-                   the name locally and passes on the resolved address */
-        GetStr(&config->proxy, nextarg);
-        config->proxyver = CURLPROXY_SOCKS5;
-        break;
-      case 't': /* --socks4 specifies a socks4 proxy to use */
-        GetStr(&config->proxy, nextarg);
-        config->proxyver = CURLPROXY_SOCKS4;
-        break;
-      case 'T': /* --socks4a specifies a socks4a proxy to use */
-        GetStr(&config->proxy, nextarg);
-        config->proxyver = CURLPROXY_SOCKS4A;
-        break;
-      case '2': /* --socks5-hostname specifies a socks5 proxy and enables name
-                   resolving with the proxy */
-        GetStr(&config->proxy, nextarg);
-        config->proxyver = CURLPROXY_SOCKS5_HOSTNAME;
-        break;
-      case 'd': /* --tcp-nodelay option */
-        config->tcp_nodelay = toggle;
-        break;
-      case 'e': /* --proxy-digest */
-        config->proxydigest = toggle;
-        break;
-      case 'f': /* --proxy-basic */
-        config->proxybasic = toggle;
-        break;
-      case 'g': /* --retry */
-        err = str2unum(&config->req_retry, nextarg);
-        break;
-      case 'V': /* --retry-connrefused */
-        config->retry_connrefused = toggle;
-        break;
-      case 'h': /* --retry-delay */
-        err = str2unummax(&config->retry_delay, nextarg, LONG_MAX/1000);
-        break;
-      case 'i': /* --retry-max-time */
-        err = str2unummax(&config->retry_maxtime, nextarg, LONG_MAX/1000);
-        break;
-      case '!': /* --retry-all-errors */
-        config->retry_all_errors = toggle;
-        break;
-
-      case 'k': /* --proxy-negotiate */
-        if(!feature_spnego) {
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        config->proxynegotiate = toggle;
-        break;
-
-      case 'l': /* --form-escape */
-        config->mime_options &= ~CURLMIMEOPT_FORMESCAPE;
-        if(toggle)
-          config->mime_options |= CURLMIMEOPT_FORMESCAPE;
-        break;
-
-      case 'm': /* --ftp-account */
-        GetStr(&config->ftp_account, nextarg);
-        break;
-      case 'n': /* --proxy-anyauth */
-        config->proxyanyauth = toggle;
-        break;
-      case 'o': /* --trace-time */
-        global->tracetime = toggle;
-        break;
-      case 'p': /* --ignore-content-length */
-        config->ignorecl = toggle;
-        break;
-      case 'q': /* --ftp-skip-pasv-ip */
-        config->ftp_skip_ip = toggle;
-        break;
-      case 'r': /* --ftp-method (undocumented at this point) */
-        config->ftp_filemethod = ftpfilemethod(config, nextarg);
-        break;
-      case 's': { /* --local-port */
-        /* 16bit base 10 is 5 digits, but we allow 6 so that this catches
-           overflows, not just truncates */
-        char lrange[7]="";
-        char *p = nextarg;
-        while(ISDIGIT(*p))
-          p++;
-        if(*p) {
-          /* if there's anything more than a plain decimal number */
-          rc = sscanf(p, " - %6s", lrange);
-          *p = 0; /* null-terminate to make str2unum() work below */
-        }
-        else
-          rc = 0;
-
-        err = str2unum(&config->localport, nextarg);
-        if(err || (config->localport > 65535)) {
-          err = PARAM_BAD_USE;
-          break;
-        }
-        if(!rc)
-          config->localportrange = 1; /* default number of ports to try */
-        else {
-          err = str2unum(&config->localportrange, lrange);
-          if(err || (config->localportrange > 65535))
-            err = PARAM_BAD_USE;
-          else {
-            config->localportrange -= (config->localport-1);
-            if(config->localportrange < 1)
-              err = PARAM_BAD_USE;
-          }
-        }
-        break;
-      }
-      case 'u': /* --ftp-alternative-to-user */
-        GetStr(&config->ftp_alternative_to_user, nextarg);
-        break;
-      case 'v': /* --ssl-reqd */
-        if(toggle && !feature_ssl) {
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        config->ftp_ssl_reqd = toggle;
-        break;
-      case 'w': /* --no-sessionid */
-        config->disable_sessionid = (!toggle)?TRUE:FALSE;
-        break;
-      case 'x': /* --ftp-ssl-control */
-        if(toggle && !feature_ssl) {
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        config->ftp_ssl_control = toggle;
-        break;
-      case 'y': /* --ftp-ssl-ccc */
-        config->ftp_ssl_ccc = toggle;
-        if(!config->ftp_ssl_ccc_mode)
-          config->ftp_ssl_ccc_mode = CURLFTPSSL_CCC_PASSIVE;
-        break;
-      case 'j': /* --ftp-ssl-ccc-mode */
-        config->ftp_ssl_ccc = TRUE;
-        config->ftp_ssl_ccc_mode = ftpcccmethod(config, nextarg);
-        break;
-      case 'z': /* --libcurl */
-#ifdef CURL_DISABLE_LIBCURL_OPTION
-        warnf(global,
-              "--libcurl option was disabled at build-time");
-        err = PARAM_OPTION_UNKNOWN;
-        break;
-#else
-        GetStr(&global->libcurl, nextarg);
-        break;
-#endif
-      case '#': /* --raw */
-        config->raw = toggle;
-        break;
-      case '0': /* --post301 */
-        config->post301 = toggle;
-        break;
-      case '1': /* --no-keepalive */
-        config->nokeepalive = (!toggle)?TRUE:FALSE;
-        break;
-      case '3': /* --keepalive-time */
-        err = str2unum(&config->alivetime, nextarg);
-        break;
-      case '4': /* --post302 */
-        config->post302 = toggle;
-        break;
-      case 'I': /* --post303 */
-        config->post303 = toggle;
-        break;
-      case '5': /* --noproxy */
-        /* This specifies the noproxy list */
-        GetStr(&config->noproxy, nextarg);
-        break;
-       case '7': /* --socks5-gssapi-nec */
-        config->socks5_gssapi_nec = toggle;
-        break;
-      case '8': /* --proxy1.0 */
-        /* http 1.0 proxy */
-        GetStr(&config->proxy, nextarg);
-        config->proxyver = CURLPROXY_HTTP_1_0;
-        break;
-      case '9': /* --tftp-blksize */
-        err = str2unum(&config->tftp_blksize, nextarg);
-        break;
-      case 'A': /* --mail-from */
-        GetStr(&config->mail_from, nextarg);
-        break;
-      case 'B': /* --mail-rcpt */
-        /* append receiver to a list */
-        err = add2list(&config->mail_rcpt, nextarg);
-        break;
-      case 'C': /* --ftp-pret */
-        config->ftp_pret = toggle;
-        break;
-      case 'D': /* --proto */
-        config->proto_present = TRUE;
-        err = proto2num(config, built_in_protos, &config->proto_str, nextarg);
-        break;
-      case 'E': /* --proto-redir */
-        config->proto_redir_present = TRUE;
-        if(proto2num(config, redir_protos, &config->proto_redir_str,
-                     nextarg)) {
-          err = PARAM_BAD_USE;
-          break;
-        }
-        break;
-      case 'F': /* --resolve */
-        err = add2list(&config->resolve, nextarg);
-        break;
-      case 'G': /* --delegation LEVEL */
-        config->gssapi_delegation = delegation(config, nextarg);
-        break;
-      case 'H': /* --mail-auth */
-        GetStr(&config->mail_auth, nextarg);
-        break;
-      case 'J': /* --metalink */
-        errorf(global, "--metalink is disabled");
-        err = PARAM_BAD_USE;
-        break;
-      case '6': /* --sasl-authzid */
-        GetStr(&config->sasl_authzid, nextarg);
-        break;
-      case 'K': /* --sasl-ir */
-        config->sasl_ir = toggle;
-        break;
-      case 'L': /* --test-event */
-#ifdef CURLDEBUG
-        global->test_event_based = toggle;
-#else
-        warnf(global, "--test-event is ignored unless a debug build");
-#endif
-        break;
-      case 'M': /* --unix-socket */
-        config->abstract_unix_socket = FALSE;
-        GetStr(&config->unix_socket_path, nextarg);
-        break;
-      case 'N': /* --path-as-is */
-        config->path_as_is = toggle;
-        break;
-      case 'O': /* --proxy-service-name */
-        GetStr(&config->proxy_service_name, nextarg);
-        break;
-      case 'P': /* --service-name */
-        GetStr(&config->service_name, nextarg);
-        break;
-      case 'Q': /* --proto-default */
-        GetStr(&config->proto_default, nextarg);
-        err = check_protocol(config->proto_default);
-        break;
-      case 'R': /* --expect100-timeout */
-        err = secs2ms(&config->expect100timeout_ms, nextarg);
-        break;
-      case 'S': /* --tftp-no-options */
-        config->tftp_no_options = toggle;
-        break;
-      case 'U': /* --connect-to */
-        err = add2list(&config->connect_to, nextarg);
-        break;
-      case 'W': /* --abstract-unix-socket */
-        config->abstract_unix_socket = TRUE;
-        GetStr(&config->unix_socket_path, nextarg);
-        break;
-      case 'X': /* --tls-max */
-        err = str2tls_max(&config->ssl_version_max, nextarg);
-        break;
-      case 'Y': /* --suppress-connect-headers */
-        config->suppress_connect_headers = toggle;
-        break;
-      case 'Z': /* --compressed-ssh */
-        config->ssh_compression = toggle;
-        break;
-      case '~': /* --happy-eyeballs-timeout-ms */
-        err = str2unum(&config->happy_eyeballs_timeout_ms, nextarg);
-        /* 0 is a valid value for this timeout */
-        break;
-      case '%': /* --trace-ids */
-        global->traceids = toggle;
-        break;
-      case '&': /* --trace-config */
-        if(set_trace_config(global, nextarg)) {
-          err = PARAM_NO_MEM;
-        }
-        break;
-      }
-      break;
-    case '#':
-      switch(subletter) {
-      case 'm': /* --progress-meter */
-        global->noprogress = !toggle;
-        break;
-      default:  /* --progress-bar */
-        global->progressmode =
-          toggle ? CURL_PROGRESS_BAR : CURL_PROGRESS_STATS;
-        break;
-      }
-      break;
-    case ':':
-      switch(subletter) {
-      case 'a': /* --variable */
-        err = setvariable(global, nextarg);
-        break;
-      default:  /* --next */
-        err = PARAM_NEXT_OPERATION;
-        break;
-      }
-      break;
-    case '0': /* --http* options */
-      switch(subletter) {
-      case '\0':
-        /* HTTP version 1.0 */
-        sethttpver(global, config, CURL_HTTP_VERSION_1_0);
-        break;
-      case '1':
-        /* HTTP version 1.1 */
-        sethttpver(global, config, CURL_HTTP_VERSION_1_1);
-        break;
-      case '2':
-        /* HTTP version 2.0 */
-        if(!feature_http2)
-          return PARAM_LIBCURL_DOESNT_SUPPORT;
-        sethttpver(global, config, CURL_HTTP_VERSION_2_0);
-        break;
-      case '3': /* --http2-prior-knowledge */
-        /* HTTP version 2.0 over clean TCP */
-        if(!feature_http2)
-          return PARAM_LIBCURL_DOESNT_SUPPORT;
-        sethttpver(global, config, CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE);
-        break;
-      case '4': /* --http3 */
-        /* Try HTTP/3, allow fallback */
-        if(!feature_http3) {
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        sethttpver(global, config, CURL_HTTP_VERSION_3);
-        break;
-      case '5': /* --http3-only */
-        /* Try HTTP/3 without fallback */
-        if(!feature_http3) {
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        sethttpver(global, config, CURL_HTTP_VERSION_3ONLY);
-        break;
-      case '9':
-        /* Allow HTTP/0.9 responses! */
-        config->http09_allowed = toggle;
-        break;
-      case 'a':
-        /* --proxy-http2 */
-        if(!feature_httpsproxy || !feature_http2)
-          return PARAM_LIBCURL_DOESNT_SUPPORT;
-        config->proxyver = CURLPROXY_HTTPS2;
-        break;
-      }
-      break;
-    case '1': /* --tlsv1* options */
-      switch(subletter) {
-      case '\0':
-        /* TLS version 1.x */
-        config->ssl_version = CURL_SSLVERSION_TLSv1;
-        break;
-      case '0':
-        /* TLS version 1.0 */
-        config->ssl_version = CURL_SSLVERSION_TLSv1_0;
-        break;
-      case '1':
-        /* TLS version 1.1 */
-        config->ssl_version = CURL_SSLVERSION_TLSv1_1;
-        break;
-      case '2':
-        /* TLS version 1.2 */
-        config->ssl_version = CURL_SSLVERSION_TLSv1_2;
-        break;
-      case '3':
-        /* TLS version 1.3 */
-        config->ssl_version = CURL_SSLVERSION_TLSv1_3;
-        break;
-      case 'A': /* --tls13-ciphers */
-        GetStr(&config->cipher13_list, nextarg);
-        break;
-      case 'B': /* --proxy-tls13-ciphers */
-        GetStr(&config->proxy_cipher13_list, nextarg);
-        break;
-      }
-      break;
-    case '2':
-      /* SSL version 2 */
-      warnf(global, "Ignores instruction to use SSLv2");
-      break;
-    case '3':
-      /* SSL version 3 */
-      warnf(global, "Ignores instruction to use SSLv3");
-      break;
-    case '4':
-      /* IPv4 */
-      config->ip_version = CURL_IPRESOLVE_V4;
-      break;
-    case '6':
-      /* IPv6 */
-      config->ip_version = CURL_IPRESOLVE_V6;
-      break;
-    case 'a':
-      /* This makes the FTP sessions use APPE instead of STOR */
-      config->ftp_append = toggle;
-      break;
-    case 'A':
-      /* This specifies the User-Agent name */
-      GetStr(&config->useragent, nextarg);
-      break;
-    case 'b':
-      switch(subletter) {
-      case 'a': /* --alt-svc */
-        if(!feature_altsvc)
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-        else
-          GetStr(&config->altsvc, nextarg);
-        break;
-      case 'b': /* --hsts */
-        if(!feature_hsts)
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-        else
-          GetStr(&config->hsts, nextarg);
-        break;
-      default:  /* --cookie string coming up: */
-        if(nextarg[0] == '@') {
-          nextarg++;
-        }
-        else if(strchr(nextarg, '=')) {
-          /* A cookie string must have a =-letter */
-          err = add2list(&config->cookies, nextarg);
-          break;
-        }
-        /* We have a cookie file to read from! */
-        err = add2list(&config->cookiefiles, nextarg);
-      }
-      break;
-    case 'B':
-      /* use ASCII/text when transferring */
-      config->use_ascii = toggle;
-      break;
-    case 'c':
-      /* get the file name to dump all cookies in */
-      GetStr(&config->cookiejar, nextarg);
-      break;
-    case 'C':
-      /* This makes us continue an ftp transfer at given position */
-      if(strcmp(nextarg, "-")) {
-        err = str2offset(&config->resume_from, nextarg);
-        if(err)
-          break;
-        config->resume_from_current = FALSE;
-      }
-      else {
-        config->resume_from_current = TRUE;
-        config->resume_from = 0;
-      }
-      config->use_resume = TRUE;
-      break;
-    case 'd':
-      /* postfield data */
-    {
-      char *postdata = NULL;
-      FILE *file;
-      size_t size = 0;
-      bool raw_mode = (subletter == 'r');
-
-      if(subletter == 'g') { /* --url-query */
-#define MAX_QUERY_LEN 100000 /* larger is not likely to ever work */
-        char *query;
-        struct curlx_dynbuf dyn;
-        curlx_dyn_init(&dyn, MAX_QUERY_LEN);
-
-        if(*nextarg == '+') {
-          /* use without encoding */
-          query = strdup(&nextarg[1]);
-          if(!query) {
-            err = PARAM_NO_MEM;
-            break;
-          }
-        }
-        else {
-          err = data_urlencode(global, nextarg, &query, &size);
-          if(err)
-            break;
-        }
-
-        if(config->query) {
-          CURLcode result =
-            curlx_dyn_addf(&dyn, "%s&%s", config->query, query);
-          free(query);
-          if(result) {
-            err = PARAM_NO_MEM;
-            break;
-          }
-          free(config->query);
-          config->query = curlx_dyn_ptr(&dyn);
-        }
-        else
-          config->query = query;
-
-        break; /* this is not a POST argument at all */
-      }
-      else if(subletter == 'e') { /* --data-urlencode */
-        err = data_urlencode(global, nextarg, &postdata, &size);
-        if(err)
-          break;
-      }
-      else if('@' == *nextarg && !raw_mode) {
-        /* the data begins with a '@' letter, it means that a file name
-           or - (stdin) follows */
-        nextarg++; /* pass the @ */
-
-        if(!strcmp("-", nextarg)) {
-          file = stdin;
-          if(subletter == 'b') /* forced data-binary */
-            set_binmode(stdin);
-        }
-        else {
-          file = fopen(nextarg, "rb");
-          if(!file) {
-            errorf(global, "Failed to open %s", nextarg);
-            err = PARAM_READ_ERROR;
-            break;
-          }
-        }
-
-        if((subletter == 'b') || /* --data-binary */
-           (subletter == 'f') /* --json */)
-          /* forced binary */
-          err = file2memory(&postdata, &size, file);
-        else {
-          err = file2string(&postdata, file);
-          if(postdata)
-            size = strlen(postdata);
-        }
-
-        if(file && (file != stdin))
-          fclose(file);
-        if(err)
-          break;
-
-        if(!postdata) {
-          /* no data from the file, point to a zero byte string to make this
-             get sent as a POST anyway */
-          postdata = strdup("");
-          if(!postdata) {
-            err = PARAM_NO_MEM;
-            break;
-          }
-        }
-      }
-      else {
-        GetStr(&postdata, nextarg);
-        if(postdata)
-          size = strlen(postdata);
-      }
-      if(subletter == 'f')
-        config->jsoned = TRUE;
-
-      if(config->postfields) {
-        /* we already have a string, we append this one with a separating
-           &-letter */
-        char *oldpost = config->postfields;
-        curl_off_t oldlen = config->postfieldsize;
-        curl_off_t newlen = oldlen + curlx_uztoso(size) + 2;
-        config->postfields = malloc((size_t)newlen);
-        if(!config->postfields) {
-          Curl_safefree(oldpost);
-          Curl_safefree(postdata);
-          err = PARAM_NO_MEM;
-          break;
-        }
-        memcpy(config->postfields, oldpost, (size_t)oldlen);
-        if(subletter != 'f') {
-          /* skip this treatment for --json */
-          /* use byte value 0x26 for '&' to accommodate non-ASCII platforms */
-          config->postfields[oldlen] = '\x26';
-          memcpy(&config->postfields[oldlen + 1], postdata, size);
-          config->postfields[oldlen + 1 + size] = '\0';
-          config->postfieldsize += size + 1;
-        }
-        else {
-          memcpy(&config->postfields[oldlen], postdata, size);
-          config->postfields[oldlen + size] = '\0';
-          config->postfieldsize += size;
-        }
-        Curl_safefree(oldpost);
-        Curl_safefree(postdata);
-      }
-      else {
-        config->postfields = postdata;
-        config->postfieldsize = curlx_uztoso(size);
-      }
-    }
-    /*
-      We can't set the request type here, as this data might be used in
-      a simple GET if -G is used. Already or soon.
-
-      if(SetHTTPrequest(HTTPREQ_SIMPLEPOST, &config->httpreq)) {
-        Curl_safefree(postdata);
-        return PARAM_BAD_USE;
-      }
-    */
-    break;
-    case 'D':
-      /* dump-header to given file name */
-      GetStr(&config->headerfile, nextarg);
-      break;
-    case 'e':
-    {
-      char *ptr = strstr(nextarg, ";auto");
-      if(ptr) {
-        /* Automatic referer requested, this may be combined with a
-           set initial one */
-        config->autoreferer = TRUE;
-        *ptr = 0; /* null-terminate here */
-      }
-      else
-        config->autoreferer = FALSE;
-      ptr = *nextarg ? nextarg : NULL;
-      GetStr(&config->referer, ptr);
-    }
-    break;
-    case 'E':
-      switch(subletter) {
-      case '\0': /* certificate file */
-        cleanarg(clearthis);
-        GetFileAndPassword(nextarg, &config->cert, &config->key_passwd);
-        break;
-      case 'a': /* --cacert CA info PEM file */
-        GetStr(&config->cacert, nextarg);
-        break;
-      case 'G': /* --ca-native */
-        config->native_ca_store = toggle;
-        break;
-      case 'H': /* --proxy-ca-native */
-        config->proxy_native_ca_store = toggle;
-        break;
-      case 'b': /* cert file type */
-        GetStr(&config->cert_type, nextarg);
-        break;
-      case 'c': /* private key file */
-        GetStr(&config->key, nextarg);
-        break;
-      case 'd': /* private key file type */
-        GetStr(&config->key_type, nextarg);
-        break;
-      case 'e': /* private key passphrase */
-        GetStr(&config->key_passwd, nextarg);
-        cleanarg(clearthis);
-        break;
-      case 'f': /* crypto engine */
-        GetStr(&config->engine, nextarg);
-        if(config->engine && curl_strequal(config->engine, "list")) {
-          err = PARAM_ENGINES_REQUESTED;
-          break;
-        }
-        break;
-      case 'g': /* CA cert directory */
-        GetStr(&config->capath, nextarg);
-        break;
-      case 'h': /* --pubkey public key file */
-        GetStr(&config->pubkey, nextarg);
-        break;
-      case 'i': /* --hostpubmd5 md5 of the host public key */
-        GetStr(&config->hostpubmd5, nextarg);
-        if(!config->hostpubmd5 || strlen(config->hostpubmd5) != 32) {
-          err = PARAM_BAD_USE;
-          break;
-        }
-        break;
-      case 'F': /* --hostpubsha256 sha256 of the host public key */
-        GetStr(&config->hostpubsha256, nextarg);
-        break;
-      case 'j': /* CRL file */
-        GetStr(&config->crlfile, nextarg);
-        break;
-      case 'k': /* TLS username */
-        if(!feature_tls_srp) {
-          cleanarg(clearthis);
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        GetStr(&config->tls_username, nextarg);
-        cleanarg(clearthis);
-        break;
-      case 'l': /* TLS password */
-        if(!feature_tls_srp) {
-          cleanarg(clearthis);
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        GetStr(&config->tls_password, nextarg);
-        cleanarg(clearthis);
-        break;
-      case 'm': /* TLS authentication type */
-        if(!feature_tls_srp) {
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        GetStr(&config->tls_authtype, nextarg);
-        if(!curl_strequal(config->tls_authtype, "SRP")) {
-          err = PARAM_LIBCURL_DOESNT_SUPPORT; /* only support TLS-SRP */
-          break;
-        }
-        break;
-      case 'n': /* no empty SSL fragments, --ssl-allow-beast */
-        if(feature_ssl)
-          config->ssl_allow_beast = toggle;
-        break;
-
-      case 'o': /* --ssl-auto-client-cert */
-        if(feature_ssl)
-          config->ssl_auto_client_cert = toggle;
-        break;
-
-      case 'O': /* --proxy-ssl-auto-client-cert */
-        if(feature_ssl)
-          config->proxy_ssl_auto_client_cert = toggle;
-        break;
-
-      case 'p': /* Pinned public key DER file */
-        GetStr(&config->pinnedpubkey, nextarg);
-        break;
-
-      case 'P': /* proxy pinned public key */
-        GetStr(&config->proxy_pinnedpubkey, nextarg);
-        break;
-
-      case 'q': /* --cert-status */
-        config->verifystatus = TRUE;
-        break;
-
-      case 'Q': /* --doh-cert-status */
-        config->doh_verifystatus = TRUE;
-        break;
-
-      case 'r': /* --false-start */
-        config->falsestart = TRUE;
-        break;
-
-      case 's': /* --ssl-no-revoke */
-        if(feature_ssl)
-          config->ssl_no_revoke = TRUE;
-        break;
-
-      case 'S': /* --ssl-revoke-best-effort */
-        if(feature_ssl)
-          config->ssl_revoke_best_effort = TRUE;
-        break;
-
-      case 't': /* --tcp-fastopen */
-        config->tcp_fastopen = TRUE;
-        break;
-
-      case 'u': /* TLS username for proxy */
-        cleanarg(clearthis);
-        if(!feature_tls_srp) {
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        GetStr(&config->proxy_tls_username, nextarg);
-        break;
-
-      case 'v': /* TLS password for proxy */
-        cleanarg(clearthis);
-        if(!feature_tls_srp) {
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        GetStr(&config->proxy_tls_password, nextarg);
-        break;
-
-      case 'w': /* TLS authentication type for proxy */
-        if(!feature_tls_srp) {
-          err = PARAM_LIBCURL_DOESNT_SUPPORT;
-          break;
-        }
-        GetStr(&config->proxy_tls_authtype, nextarg);
-        if(!curl_strequal(config->proxy_tls_authtype, "SRP")) {
-          err = PARAM_LIBCURL_DOESNT_SUPPORT; /* only support TLS-SRP */
-          break;
-        }
-        break;
-
-      case 'x': /* certificate file for proxy */
-        cleanarg(clearthis);
-        GetFileAndPassword(nextarg, &config->proxy_cert,
-                           &config->proxy_key_passwd);
-        break;
-
-      case 'y': /* cert file type for proxy */
-        GetStr(&config->proxy_cert_type, nextarg);
-        break;
-
-      case 'z': /* private key file for proxy */
-        GetStr(&config->proxy_key, nextarg);
-        break;
-
-      case '0': /* private key file type for proxy */
-        GetStr(&config->proxy_key_type, nextarg);
-        break;
-
-      case '1': /* private key passphrase for proxy */
-        GetStr(&config->proxy_key_passwd, nextarg);
-        cleanarg(clearthis);
-        break;
-
-      case '2': /* ciphers for proxy */
-        GetStr(&config->proxy_cipher_list, nextarg);
-        break;
-
-      case '3': /* CRL file for proxy */
-        GetStr(&config->proxy_crlfile, nextarg);
-        break;
-
-      case '4': /* no empty SSL fragments for proxy */
-        if(feature_ssl)
-          config->proxy_ssl_allow_beast = toggle;
-        break;
-
-      case '5': /* --login-options */
-        GetStr(&config->login_options, nextarg);
-        break;
-
-      case '6': /* CA info PEM file for proxy */
-        GetStr(&config->proxy_cacert, nextarg);
-        break;
-
-      case '7': /* CA cert directory for proxy */
-        GetStr(&config->proxy_capath, nextarg);
-        break;
-
-      case '8': /* allow insecure SSL connects for proxy */
-        config->proxy_insecure_ok = toggle;
-        break;
-
-      case '9': /* --proxy-tlsv1 */
-        /* TLS version 1 for proxy */
-        config->proxy_ssl_version = CURL_SSLVERSION_TLSv1;
-        break;
-
-      case 'A':
-        /* --socks5-basic */
-        if(toggle)
-          config->socks5_auth |= CURLAUTH_BASIC;
-        else
-          config->socks5_auth &= ~CURLAUTH_BASIC;
-        break;
-
-      case 'B':
-        /* --socks5-gssapi */
-        if(toggle)
-          config->socks5_auth |= CURLAUTH_GSSAPI;
-        else
-          config->socks5_auth &= ~CURLAUTH_GSSAPI;
-        break;
-
-      case 'C':
-        GetStr(&config->etag_save_file, nextarg);
-        break;
-
-      case 'D':
-        GetStr(&config->etag_compare_file, nextarg);
-        break;
-
-      case 'E':
-        GetStr(&config->ssl_ec_curves, nextarg);
-        break;
-
-      default: /* unknown flag */
+      default:
+        DEBUGASSERT(0);
         err = PARAM_OPTION_UNKNOWN;
         break;
       }
-      break;
-    case 'f':
-      switch(subletter) {
-      case 'a': /* --fail-early */
-        global->fail_early = toggle;
-        break;
-      case 'b': /* --styled-output */
-        global->styled_output = toggle;
-        break;
-      case 'c': /* --mail-rcpt-allowfails */
-        config->mail_rcpt_allowfails = toggle;
-        break;
-      case 'd': /* --fail-with-body */
-        config->failwithbody = toggle;
-        break;
-      case 'e': /* --remove-on-error */
-        config->rm_partial = toggle;
-        break;
-       default: /* --fail (hard on errors)  */
-        config->failonerror = toggle;
-        break;
-      }
-      if(config->failonerror && config->failwithbody) {
-        errorf(config->global, "You must select either --fail or "
-               "--fail-with-body, not both.");
-        err = PARAM_BAD_USE;
-        break;
-      }
-      break;
-    case 'F':
-      /* "form data" simulation, this is a little advanced so lets do our best
-         to sort this out slowly and carefully */
-      if(formparse(config,
-                   nextarg,
-                   &config->mimeroot,
-                   &config->mimecurrent,
-                   (subletter == 's')?TRUE:FALSE)) { /* 's' is literal
-                                                        string */
-        err = PARAM_BAD_USE;
-        break;
-      }
-      if(SetHTTPrequest(config, HTTPREQ_MIMEPOST, &config->httpreq)) {
-        err = PARAM_BAD_USE;
-        break;
-      }
-      break;
-
-    case 'g': /* g disables URLglobbing */
-      config->globoff = toggle;
-      break;
-
-    case 'G': /* HTTP GET */
-      if(subletter == 'a') { /* --request-target */
-        GetStr(&config->request_target, nextarg);
-      }
-      else
-        config->use_httpget = toggle;
-      break;
-
-    case 'h': /* h for help */
-      if(toggle) {
-        if(nextarg) {
-          global->help_category = strdup(nextarg);
-          if(!global->help_category) {
-            err = PARAM_NO_MEM;
-            break;
-          }
-        }
-        err = PARAM_HELP_REQUESTED;
-        break;
-      }
-      /* we now actually support --no-help too! */
-      break;
-    case 'H':
-      /* A custom header to append to a list */
-      if(nextarg[0] == '@') {
-        /* read many headers from a file or stdin */
-        char *string;
-        size_t len;
-        bool use_stdin = !strcmp(&nextarg[1], "-");
-        FILE *file = use_stdin?stdin:fopen(&nextarg[1], FOPEN_READTEXT);
-        if(!file) {
-          errorf(global, "Failed to open %s", &nextarg[1]);
-          err = PARAM_READ_ERROR;
-          break;
-        }
-        else {
-          err = file2memory(&string, &len, file);
-          if(!err && string) {
-            /* Allow strtok() here since this isn't used threaded */
-            /* !checksrc! disable BANNEDFUNC 2 */
-            char *h = strtok(string, "\r\n");
-            while(h) {
-              if(subletter == 'p') /* --proxy-header */
-                err = add2list(&config->proxyheaders, h);
-              else
-                err = add2list(&config->headers, h);
-              if(err)
-                break;
-              h = strtok(NULL, "\r\n");
-            }
-            free(string);
-          }
-          if(!use_stdin)
-            fclose(file);
-          if(err)
-            break;
-        }
-      }
-      else {
-        if(subletter == 'p') /* --proxy-header */
-          err = add2list(&config->proxyheaders, nextarg);
-        else
-          err = add2list(&config->headers, nextarg);
-      }
-      break;
-    case 'i':
-      config->show_headers = toggle; /* show the headers as well in the
-                                        general output stream */
-      break;
-    case 'j':
-      config->cookiesession = toggle;
-      break;
-    case 'I': /* --head */
-      config->no_body = toggle;
-      config->show_headers = toggle;
-      if(SetHTTPrequest(config,
-                        (config->no_body)?HTTPREQ_HEAD:HTTPREQ_GET,
-                        &config->httpreq)) {
-        err = PARAM_BAD_USE;
-        break;
-      }
-      break;
-    case 'J': /* --remote-header-name */
-      config->content_disposition = toggle;
-      break;
-    case 'k': /* allow insecure SSL connects */
-      if(subletter == 'd') /* --doh-insecure */
-        config->doh_insecure_ok = toggle;
-      else
-        config->insecure_ok = toggle;
-      break;
-    case 'K': /* parse config file */
-      if(parseconfig(nextarg, global)) {
-        errorf(global, "cannot read config from '%s'", nextarg);
-        err = PARAM_READ_ERROR;
-        break;
-      }
-      break;
-    case 'l':
-      config->dirlistonly = toggle; /* only list the names of the FTP dir */
-      break;
-    case 'L':
-      config->followlocation = toggle; /* Follow Location: HTTP headers */
-      switch(subletter) {
-      case 't':
-        /* Continue to send authentication (user+password) when following
-         * locations, even when hostname changed */
-        config->unrestricted_auth = toggle;
-        break;
-      }
-      break;
-    case 'm':
-      /* specified max time */
-      err = secs2ms(&config->timeout_ms, nextarg);
-      break;
-    case 'M': /* M for manual, huge help */
-      if(toggle) { /* --no-manual shows no manual... */
-#ifndef USE_MANUAL
-        warnf(global,
-              "built-in manual was disabled at build-time");
-#endif
-        err = PARAM_MANUAL_REQUESTED;
-        break;
-      }
-      break;
-    case 'n':
-      switch(subletter) {
-      case 'o': /* use .netrc or URL */
-        config->netrc_opt = toggle;
-        break;
-      case 'e': /* netrc-file */
-        GetStr(&config->netrc_file, nextarg);
-        break;
-      default:
-        /* pick info from .netrc, if this is used for http, curl will
-           automatically enforce user+password with the request */
-        config->netrc = toggle;
-        break;
-      }
-      break;
-    case 'N':
-      /* disable the output I/O buffering. note that the option is called
-         --buffer but is mostly used in the negative form: --no-buffer */
-      config->nobuffer = longopt ? !toggle : TRUE;
-      break;
-    case 'O': /* --remote-name */
-      if(subletter == 'a') { /* --remote-name-all */
-        config->default_node_flags = toggle?GETOUT_USEREMOTE:0;
-        break;
-      }
-      else if(subletter == 'b') { /* --output-dir */
-        GetStr(&config->output_dir, nextarg);
-        break;
-      }
-      else if(subletter == 'c') { /* --clobber / --no-clobber */
-        config->file_clobber_mode = toggle ? CLOBBER_ALWAYS : CLOBBER_NEVER;
-        break;
-      }
-      /* FALLTHROUGH */
-    case 'o': /* --output */
-      /* output file */
-    {
-      struct getout *url;
-      if(!config->url_out)
-        config->url_out = config->url_list;
-      if(config->url_out) {
-        /* there's a node here, if it already is filled-in continue to find
-           an "empty" node */
-        while(config->url_out && (config->url_out->flags & GETOUT_OUTFILE))
-          config->url_out = config->url_out->next;
-      }
-
-      /* now there might or might not be an available node to fill in! */
-
-      if(config->url_out)
-        /* existing node */
-        url = config->url_out;
-      else {
-        if(!toggle && !config->default_node_flags)
-          break;
-        /* there was no free node, create one! */
-        config->url_out = url = new_getout(config);
-      }
-
-      if(!url) {
-        err = PARAM_NO_MEM;
-        break;
-      }
-
-      /* fill in the outfile */
-      if('o' == letter) {
-        if(!*nextarg) {
-          warnf(global, "output file name has no length");
-          err = PARAM_BAD_USE;
-          break;
-        }
-        GetStr(&url->outfile, nextarg);
-        url->flags &= ~GETOUT_USEREMOTE; /* switch off */
-      }
-      else {
-        url->outfile = NULL; /* leave it */
-        if(toggle)
-          url->flags |= GETOUT_USEREMOTE;  /* switch on */
-        else
-          url->flags &= ~GETOUT_USEREMOTE; /* switch off */
-      }
-      url->flags |= GETOUT_OUTFILE;
+      if(a->desc & ARG_CLEAR)
+        cleanarg(CURL_UNCONST(nextarg));
     }
-    break;
-    case 'P':
-      /* This makes the FTP sessions use PORT instead of PASV */
-      /* use <eth0> or <192.168.10.10> style addresses. Anything except
-         this will make us try to get the "default" address.
-         NOTE: this is a changed behavior since the released 4.1!
-      */
-      GetStr(&config->ftpport, nextarg);
-      break;
-    case 'p':
-      /* proxy tunnel for non-http protocols */
-      config->proxytunnel = toggle;
-      break;
-
-    case 'q': /* if used first, already taken care of, we do it like
-                 this so we don't cause an error! */
-      break;
-    case 'Q':
-      /* QUOTE command to send to FTP server */
-      switch(nextarg[0]) {
-      case '-':
-        /* prefixed with a dash makes it a POST TRANSFER one */
-        nextarg++;
-        err = add2list(&config->postquote, nextarg);
-        break;
-      case '+':
-        /* prefixed with a plus makes it a just-before-transfer one */
-        nextarg++;
-        err = add2list(&config->prequote, nextarg);
-        break;
-      default:
-        err = add2list(&config->quote, nextarg);
+    else {
+      if(a->desc & ARG_DEPR) {
+        opt_depr(a);
         break;
       }
-      break;
-    case 'r':
-      /* Specifying a range WITHOUT A DASH will create an illegal HTTP range
-         (and won't actually be range by definition). The man page previously
-         claimed that to be a good way, why this code is added to work-around
-         it. */
-      if(ISDIGIT(*nextarg) && !strchr(nextarg, '-')) {
-        char buffer[32];
-        curl_off_t off;
-        if(curlx_strtoofft(nextarg, NULL, 10, &off)) {
-          warnf(global, "unsupported range point");
-          err = PARAM_BAD_USE;
-          break;
-        }
-        warnf(global,
-              "A specified range MUST include at least one dash (-). "
-              "Appending one for you");
-        msnprintf(buffer, sizeof(buffer), "%" CURL_FORMAT_CURL_OFF_T "-", off);
-        Curl_safefree(config->range);
-        config->range = strdup(buffer);
-        if(!config->range) {
-          err = PARAM_NO_MEM;
-          break;
-        }
-      }
-      else {
-        /* byte range requested */
-        const char *tmp_range = nextarg;
-        while(*tmp_range != '\0') {
-          if(!ISDIGIT(*tmp_range) && *tmp_range != '-' && *tmp_range != ',') {
-            warnf(global, "Invalid character is found in given range. "
-                  "A specified range MUST have only digits in "
-                  "\'start\'-\'stop\'. The server's response to this "
-                  "request is uncertain.");
-            break;
-          }
-          tmp_range++;
-        }
-        GetStr(&config->range, nextarg);
-      }
-      break;
-    case 'R':
-      /* use remote file's time */
-      config->remote_time = toggle;
-      break;
-    case 's': /* --silent */
-      global->silent = toggle;
-      break;
-    case 'S': /* --show-error */
-      global->showerror = toggle;
-      break;
-    case 't':
-      /* Telnet options */
-      err = add2list(&config->telnet_options, nextarg);
-      break;
-    case 'T':
-      /* we are uploading */
-    {
-      struct getout *url;
-      if(!config->url_ul)
-        config->url_ul = config->url_list;
-      if(config->url_ul) {
-        /* there's a node here, if it already is filled-in continue to find
-           an "empty" node */
-        while(config->url_ul && (config->url_ul->flags & GETOUT_UPLOAD))
-          config->url_ul = config->url_ul->next;
-      }
-
-      /* now there might or might not be an available node to fill in! */
-
-      if(config->url_ul)
-        /* existing node */
-        url = config->url_ul;
+      /* ARG_NONE | ARG_BOOL */
+      if(ARGTYPE(a->desc) == ARG_BOOL)
+        err = opt_bool(config, a, toggle);
       else
-        /* there was no free node, create one! */
-        config->url_ul = url = new_getout(config);
-
-      if(!url) {
-        err = PARAM_NO_MEM;
-        break;
-      }
-
-      url->flags |= GETOUT_UPLOAD; /* mark -T used */
-      if(!*nextarg)
-        url->flags |= GETOUT_NOUPLOAD;
-      else {
-        /* "-" equals stdin, but keep the string around for now */
-        GetStr(&url->infile, nextarg);
-      }
+        err = opt_none(config, a);
     }
-    break;
-    case 'u':
-      /* user:password  */
-      GetStr(&config->userpwd, nextarg);
-      cleanarg(clearthis);
-      break;
-    case 'U':
-      /* Proxy user:password  */
-      GetStr(&config->proxyuserpwd, nextarg);
-      cleanarg(clearthis);
-      break;
-    case 'v':
-      if(toggle) {
-        /* the '%' thing here will cause the trace get sent to stderr */
-        Curl_safefree(global->trace_dump);
-        global->trace_dump = strdup("%");
-        if(!global->trace_dump) {
-          err = PARAM_NO_MEM;
-          break;
-        }
-        if(global->tracetype && (global->tracetype != TRACE_PLAIN))
-          warnf(global,
-                "-v, --verbose overrides an earlier trace/verbose option");
-        global->tracetype = TRACE_PLAIN;
-      }
-      else
-        /* verbose is disabled here */
-        global->tracetype = TRACE_NONE;
-      break;
-    case 'V':
-      if(toggle) {   /* --no-version yields no output! */
-        err = PARAM_VERSION_INFO_REQUESTED;
-        break;
-      }
-      break;
-
-    case 'w':
-      /* get the output string */
-      if('@' == *nextarg) {
-        /* the data begins with a '@' letter, it means that a file name
-           or - (stdin) follows */
-        FILE *file;
-        const char *fname;
-        nextarg++; /* pass the @ */
-        if(!strcmp("-", nextarg)) {
-          fname = "<stdin>";
-          file = stdin;
-        }
-        else {
-          fname = nextarg;
-          file = fopen(fname, FOPEN_READTEXT);
-          if(!file) {
-            errorf(global, "Failed to open %s", fname);
-            err = PARAM_READ_ERROR;
-            break;
-          }
-        }
-        Curl_safefree(config->writeout);
-        err = file2string(&config->writeout, file);
-        if(file && (file != stdin))
-          fclose(file);
-        if(err)
-          break;
-        if(!config->writeout)
-          warnf(global, "Failed to read %s", fname);
-      }
-      else
-        GetStr(&config->writeout, nextarg);
-      break;
-    case 'x':
-      switch(subletter) {
-      case 'a': /* --preproxy */
-        GetStr(&config->preproxy, nextarg);
-        break;
-      default:
-        /* --proxy */
-        GetStr(&config->proxy, nextarg);
-        if(config->proxyver != CURLPROXY_HTTPS2)
-          config->proxyver = CURLPROXY_HTTP;
-        break;
-      }
-      break;
-    case 'X':
-      /* set custom request */
-      GetStr(&config->customrequest, nextarg);
-      break;
-    case 'y':
-      /* low speed time */
-      err = str2unum(&config->low_speed_time, nextarg);
-      if(err)
-        break;
-      if(!config->low_speed_limit)
-        config->low_speed_limit = 1;
-      break;
-    case 'Y':
-      /* low speed limit */
-      err = str2unum(&config->low_speed_limit, nextarg);
-      if(err)
-        break;
-      if(!config->low_speed_time)
-        config->low_speed_time = 30;
-      break;
-    case 'Z':
-      switch(subletter) {
-      case '\0':  /* --parallel */
-        global->parallel = toggle;
-        break;
-      case 'b': {  /* --parallel-max */
-        long val;
-        err = str2unum(&val, nextarg);
-        if(err)
-          break;
-        if(val > MAX_PARALLEL)
-          global->parallel_max = MAX_PARALLEL;
-        else if(val < 1)
-          global->parallel_max = PARALLEL_DEFAULT;
-        else
-          global->parallel_max = (unsigned short)val;
-        break;
-      }
-      case 'c':   /* --parallel-immediate */
-        global->parallel_connect = toggle;
-        break;
-      }
-      break;
-    case 'z': /* time condition coming up */
-      switch(*nextarg) {
-      case '+':
-        nextarg++;
-        /* FALLTHROUGH */
-      default:
-        /* If-Modified-Since: (section 14.28 in RFC2068) */
-        config->timecond = CURL_TIMECOND_IFMODSINCE;
-        break;
-      case '-':
-        /* If-Unmodified-Since:  (section 14.24 in RFC2068) */
-        config->timecond = CURL_TIMECOND_IFUNMODSINCE;
-        nextarg++;
-        break;
-      case '=':
-        /* Last-Modified:  (section 14.29 in RFC2068) */
-        config->timecond = CURL_TIMECOND_LASTMOD;
-        nextarg++;
-        break;
-      }
-      now = time(NULL);
-      config->condtime = (curl_off_t)curl_getdate(nextarg, &now);
-      if(-1 == config->condtime) {
-        /* now let's see if it is a file name to get the time from instead! */
-        curl_off_t filetime;
-        rc = getfiletime(nextarg, global, &filetime);
-        if(!rc)
-          /* pull the time out from the file */
-          config->condtime = filetime;
-        else {
-          /* failed, remove time condition */
-          config->timecond = CURL_TIMECOND_NONE;
-          warnf(global,
-                "Illegal date format for -z, --time-cond (and not "
-                "a file name). Disabling time condition. "
-                "See curl_getdate(3) for valid date syntax.");
-        }
-      }
-      break;
-    default: /* unknown flag */
-      err = PARAM_OPTION_UNKNOWN;
-      break;
-    }
-    hit = -1;
 
+    ++verbose_nopts; /* processed one option from `flag` input, loop for
+                        more */
   } while(!longopt && !singleopt && *++parse && !*usedarg && !err);
 
 error:
   if(nextalloc)
-    free(nextarg);
+    curlx_free(CURL_UNCONST(nextarg));
   return err;
 }
 
-ParameterError parse_args(struct GlobalConfig *global, int argc,
-                          argv_item_t argv[])
+ParameterError parse_args(int argc, argv_item_t argv[])
 {
   int i;
   bool stillflags;
-  char *orig_opt = NULL;
-  ParameterError result = PARAM_OK;
+  const char *orig_opt = NULL;
+  ParameterError err = PARAM_OK;
   struct OperationConfig *config = global->first;
 
-  for(i = 1, stillflags = TRUE; i < argc && !result; i++) {
-    orig_opt = curlx_convert_tchar_to_UTF8(argv[i]);
+  stillflags = TRUE;
+  for(i = 1; i < argc && !err; i++) {
+    orig_opt = convert_tchar_to_UTF8(argv[i]);
     if(!orig_opt)
       return PARAM_NO_MEM;
 
@@ -2699,35 +3142,29 @@ ParameterError parse_args(struct GlobalConfig *global, int argc,
            following (URL) argument to start with -. */
         stillflags = FALSE;
       else {
-        char *nextarg = NULL;
+        const char *nextarg = NULL;
         if(i < (argc - 1)) {
-          nextarg = curlx_convert_tchar_to_UTF8(argv[i + 1]);
+          nextarg = convert_tchar_to_UTF8(argv[i + 1]);
           if(!nextarg) {
-            curlx_unicodefree(orig_opt);
+            unicodefree(CURL_UNCONST(orig_opt));
             return PARAM_NO_MEM;
           }
         }
 
-        result = getparameter(orig_opt, nextarg, argv[i + 1], &passarg,
-                              global, config);
+        err = getparameter(orig_opt, nextarg, &passarg, config,
+                           CONFIG_MAX_LEVELS);
 
-        curlx_unicodefree(nextarg);
+        unicodefree(CURL_UNCONST(nextarg));
         config = global->last;
-        if(result == PARAM_NEXT_OPERATION) {
-          /* Reset result as PARAM_NEXT_OPERATION is only used here and not
+        if(err == PARAM_NEXT_OPERATION) {
+          /* Reset err as PARAM_NEXT_OPERATION is only used here and not
              returned from this function */
-          result = PARAM_OK;
+          err = PARAM_OK;
 
           if(config->url_list && config->url_list->url) {
             /* Allocate the next config */
-            config->next = malloc(sizeof(struct OperationConfig));
+            config->next = config_alloc();
             if(config->next) {
-              /* Initialise the newly created config */
-              config_init(config->next);
-
-              /* Set the global config pointer */
-              config->next->global = global;
-
               /* Update the last config pointer */
               global->last = config->next;
 
@@ -2736,47 +3173,49 @@ ParameterError parse_args(struct GlobalConfig *global, int argc,
               config = config->next;
             }
             else
-              result = PARAM_NO_MEM;
+              err = PARAM_NO_MEM;
           }
           else {
-            errorf(global, "missing URL before --next");
-            result = PARAM_BAD_USE;
+            errorf("missing URL before --next");
+            err = PARAM_BAD_USE;
           }
         }
-        else if(!result && passarg)
-          i++; /* we're supposed to skip this */
+        else if(!err && passarg)
+          i++; /* we are supposed to skip this */
       }
     }
     else {
       bool used;
 
-      /* Just add the URL please */
-      result = getparameter("--url", orig_opt, argv[i], &used, global, config);
+      /* add the URL please */
+      err = getparameter("--url", orig_opt, &used, config, 0);
     }
 
-    if(!result)
-      curlx_unicodefree(orig_opt);
+    if(!err) {
+      unicodefree(CURL_UNCONST(orig_opt));
+      orig_opt = NULL;
+    }
   }
 
-  if(!result && config->content_disposition) {
-    if(config->show_headers)
-      result = PARAM_CONTDISP_SHOW_HEADER;
-    else if(config->resume_from_current)
-      result = PARAM_CONTDISP_RESUME_FROM;
+  if(!err && config->content_disposition) {
+    if(config->resume_from_current)
+      err = PARAM_CONTDISP_RESUME_FROM;
   }
 
-  if(result && result != PARAM_HELP_REQUESTED &&
-     result != PARAM_MANUAL_REQUESTED &&
-     result != PARAM_VERSION_INFO_REQUESTED &&
-     result != PARAM_ENGINES_REQUESTED) {
-    const char *reason = param2text(result);
+  if(err &&
+     err != PARAM_HELP_REQUESTED &&
+     err != PARAM_MANUAL_REQUESTED &&
+     err != PARAM_VERSION_INFO_REQUESTED &&
+     err != PARAM_ENGINES_REQUESTED &&
+     err != PARAM_CA_EMBED_REQUESTED) {
+    const char *reason = param2text(err);
 
     if(orig_opt && strcmp(":", orig_opt))
-      helpf(stderr, "option %s: %s", orig_opt, reason);
+      helpf("option %s: %s", orig_opt, reason);
     else
-      helpf(stderr, "%s", reason);
+      helpf("%s", reason);
   }
 
-  curlx_unicodefree(orig_opt);
-  return result;
+  unicodefree(CURL_UNCONST(orig_opt));
+  return err;
 }
diff --git a/third-party/curl/src/tool_getparam.h b/third-party/curl/src/tool_getparam.h
index a8a9d45975..32476d3776 100644
--- a/third-party/curl/src/tool_getparam.h
+++ b/third-party/curl/src/tool_getparam.h
@@ -25,16 +25,328 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
+/* one enum for every command line option. The name is the verbatim long
+   option name, but in uppercase with periods and minuses replaced with
+   underscores using a "C_" prefix. */
+typedef enum {
+  C_ABSTRACT_UNIX_SOCKET,
+  C_ALPN,
+  C_ALT_SVC,
+  C_ANYAUTH,
+  C_APPEND,
+  C_AWS_SIGV4,
+  C_BASIC,
+  C_BUFFER,
+  C_CA_NATIVE,
+  C_CACERT,
+  C_CAPATH,
+  C_CERT,
+  C_CERT_STATUS,
+  C_CERT_TYPE,
+  C_CIPHERS,
+  C_CLOBBER,
+  C_COMPRESSED,
+  C_COMPRESSED_SSH,
+  C_CONFIG,
+  C_CONNECT_TIMEOUT,
+  C_CONNECT_TO,
+  C_CONTINUE_AT,
+  C_COOKIE,
+  C_COOKIE_JAR,
+  C_CREATE_DIRS,
+  C_CREATE_FILE_MODE,
+  C_CRLF,
+  C_CRLFILE,
+  C_CURVES,
+  C_DATA,
+  C_DATA_ASCII,
+  C_DATA_BINARY,
+  C_DATA_RAW,
+  C_DATA_URLENCODE,
+  C_DELEGATION,
+  C_DIGEST,
+  C_DISABLE,
+  C_DISABLE_EPRT,
+  C_DISABLE_EPSV,
+  C_DISALLOW_USERNAME_IN_URL,
+  C_DNS_INTERFACE,
+  C_DNS_IPV4_ADDR,
+  C_DNS_IPV6_ADDR,
+  C_DNS_SERVERS,
+  C_DOH_CERT_STATUS,
+  C_DOH_INSECURE,
+  C_DOH_URL,
+  C_DUMP_CA_EMBED,
+  C_DUMP_HEADER,
+  C_ECH,
+  C_EGD_FILE,
+  C_ENGINE,
+  C_EPRT,
+  C_EPSV,
+  C_ETAG_COMPARE,
+  C_ETAG_SAVE,
+  C_EXPECT100_TIMEOUT,
+  C_FAIL,
+  C_FAIL_EARLY,
+  C_FAIL_WITH_BODY,
+  C_FALSE_START,
+  C_FOLLOW,
+  C_FORM,
+  C_FORM_ESCAPE,
+  C_FORM_STRING,
+  C_FTP_ACCOUNT,
+  C_FTP_ALTERNATIVE_TO_USER,
+  C_FTP_CREATE_DIRS,
+  C_FTP_METHOD,
+  C_FTP_PASV,
+  C_FTP_PORT,
+  C_FTP_PRET,
+  C_FTP_SKIP_PASV_IP,
+  C_FTP_SSL,
+  C_FTP_SSL_CCC,
+  C_FTP_SSL_CCC_MODE,
+  C_FTP_SSL_CONTROL,
+  C_FTP_SSL_REQD,
+  C_GET,
+  C_GLOBOFF,
+  C_HAPPY_EYEBALLS_TIMEOUT_MS,
+  C_HAPROXY_CLIENTIP,
+  C_HAPROXY_PROTOCOL,
+  C_HEAD,
+  C_HEADER,
+  C_HELP,
+  C_HOSTPUBMD5,
+  C_HOSTPUBSHA256,
+  C_HSTS,
+  C_HTTP0_9,
+  C_HTTP1_0,
+  C_HTTP1_1,
+  C_HTTP2,
+  C_HTTP2_PRIOR_KNOWLEDGE,
+  C_HTTP3,
+  C_HTTP3_ONLY,
+  C_IGNORE_CONTENT_LENGTH,
+  C_INCLUDE,
+  C_INSECURE,
+  C_INTERFACE,
+  C_IPFS_GATEWAY,
+  C_IPV4,
+  C_IPV6,
+  C_JSON,
+  C_JUNK_SESSION_COOKIES,
+  C_KEEPALIVE,
+  C_KEEPALIVE_CNT,
+  C_KEEPALIVE_TIME,
+  C_KEY,
+  C_KEY_TYPE,
+  C_KNOWNHOSTS,
+  C_KRB,
+  C_KRB4,
+  C_LIBCURL,
+  C_LIMIT_RATE,
+  C_LIST_ONLY,
+  C_LOCAL_PORT,
+  C_LOCATION,
+  C_LOCATION_TRUSTED,
+  C_LOGIN_OPTIONS,
+  C_MAIL_AUTH,
+  C_MAIL_FROM,
+  C_MAIL_RCPT,
+  C_MAIL_RCPT_ALLOWFAILS,
+  C_MANUAL,
+  C_MAX_FILESIZE,
+  C_MAX_REDIRS,
+  C_MAX_TIME,
+  C_METALINK,
+  C_MPTCP,
+  C_NEGOTIATE,
+  C_NETRC,
+  C_NETRC_FILE,
+  C_NETRC_OPTIONAL,
+  C_NEXT,
+  C_NOPROXY,
+  C_NPN,
+  C_NTLM,
+  C_NTLM_WB,
+  C_OAUTH2_BEARER,
+  C_OUT_NULL,
+  C_OUTPUT,
+  C_OUTPUT_DIR,
+  C_PARALLEL,
+  C_PARALLEL_HOST,
+  C_PARALLEL_IMMEDIATE,
+  C_PARALLEL_MAX,
+  C_PASS,
+  C_PATH_AS_IS,
+  C_PINNEDPUBKEY,
+  C_POST301,
+  C_POST302,
+  C_POST303,
+  C_PREPROXY,
+  C_PROGRESS_BAR,
+  C_PROGRESS_METER,
+  C_PROTO,
+  C_PROTO_DEFAULT,
+  C_PROTO_REDIR,
+  C_PROXY,
+  C_PROXY_ANYAUTH,
+  C_PROXY_BASIC,
+  C_PROXY_CA_NATIVE,
+  C_PROXY_CACERT,
+  C_PROXY_CAPATH,
+  C_PROXY_CERT,
+  C_PROXY_CERT_TYPE,
+  C_PROXY_CIPHERS,
+  C_PROXY_CRLFILE,
+  C_PROXY_DIGEST,
+  C_PROXY_HEADER,
+  C_PROXY_HTTP2,
+  C_PROXY_HTTP3,
+  C_PROXY_INSECURE,
+  C_PROXY_KEY,
+  C_PROXY_KEY_TYPE,
+  C_PROXY_NEGOTIATE,
+  C_PROXY_NTLM,
+  C_PROXY_PASS,
+  C_PROXY_PINNEDPUBKEY,
+  C_PROXY_SERVICE_NAME,
+  C_PROXY_SSL_ALLOW_BEAST,
+  C_PROXY_SSL_AUTO_CLIENT_CERT,
+  C_PROXY_TLS13_CIPHERS,
+  C_PROXY_TLSAUTHTYPE,
+  C_PROXY_TLSPASSWORD,
+  C_PROXY_TLSUSER,
+  C_PROXY_TLSV1,
+  C_PROXY_USER,
+  C_PROXY1_0,
+  C_PROXYTUNNEL,
+  C_PUBKEY,
+  C_QUOTE,
+  C_RANDOM_FILE,
+  C_RANGE,
+  C_RATE,
+  C_RAW,
+  C_REFERER,
+  C_REMOTE_HEADER_NAME,
+  C_REMOTE_NAME,
+  C_REMOTE_NAME_ALL,
+  C_REMOTE_TIME,
+  C_REMOVE_ON_ERROR,
+  C_REQUEST,
+  C_REQUEST_TARGET,
+  C_RESOLVE,
+  C_RETRY,
+  C_RETRY_ALL_ERRORS,
+  C_RETRY_CONNREFUSED,
+  C_RETRY_DELAY,
+  C_RETRY_MAX_TIME,
+  C_SASL_AUTHZID,
+  C_SASL_IR,
+  C_SERVICE_NAME,
+  C_SESSIONID,
+  C_SHOW_ERROR,
+  C_SHOW_HEADERS,
+  C_SILENT,
+  C_SIGNATURE_ALGORITHMS,
+  C_SKIP_EXISTING,
+  C_SOCKS4,
+  C_SOCKS4A,
+  C_SOCKS5,
+  C_SOCKS5_BASIC,
+  C_SOCKS5_GSSAPI,
+  C_SOCKS5_GSSAPI_NEC,
+  C_SOCKS5_GSSAPI_SERVICE,
+  C_SOCKS5_HOSTNAME,
+  C_SPEED_LIMIT,
+  C_SPEED_TIME,
+  C_SSL,
+  C_SSL_ALLOW_BEAST,
+  C_SSL_AUTO_CLIENT_CERT,
+  C_SSL_NO_REVOKE,
+  C_SSL_REQD,
+  C_SSL_REVOKE_BEST_EFFORT,
+  C_SSL_SESSIONS,
+  C_SSLV2,
+  C_SSLV3,
+  C_STDERR,
+  C_STYLED_OUTPUT,
+  C_SUPPRESS_CONNECT_HEADERS,
+  C_TCP_FASTOPEN,
+  C_TCP_NODELAY,
+  C_TELNET_OPTION,
+  C_TEST_DUPHANDLE,
+  C_TEST_EVENT,
+  C_TFTP_BLKSIZE,
+  C_TFTP_NO_OPTIONS,
+  C_TIME_COND,
+  C_TLS_EARLYDATA,
+  C_TLS_MAX,
+  C_TLS13_CIPHERS,
+  C_TLSAUTHTYPE,
+  C_TLSPASSWORD,
+  C_TLSUSER,
+  C_TLSV1,
+  C_TLSV1_0,
+  C_TLSV1_1,
+  C_TLSV1_2,
+  C_TLSV1_3,
+  C_TR_ENCODING,
+  C_TRACE,
+  C_TRACE_ASCII,
+  C_TRACE_CONFIG,
+  C_TRACE_IDS,
+  C_TRACE_TIME,
+  C_IP_TOS,
+  C_UNIX_SOCKET,
+  C_UPLOAD_FILE,
+  C_UPLOAD_FLAGS,
+  C_URL,
+  C_URL_QUERY,
+  C_USE_ASCII,
+  C_USER,
+  C_USER_AGENT,
+  C_VARIABLE,
+  C_VERBOSE,
+  C_VERSION,
+  C_VLAN_PRIORITY,
+  C_WDEBUG,
+  C_WRITE_OUT,
+  C_XATTR
+} cmdline_t;
+
+#define ARG_NONE 0 /* stand-alone but not a boolean */
+#define ARG_BOOL 1 /* accepts a --no-[name] prefix */
+#define ARG_STRG 2 /* requires an argument */
+#define ARG_FILE 3 /* requires an argument, usually a filename */
+#define ARG_SECS 4 /* requires a time in seconds */
+#define ARG_UNUM 5 /* requires a non-negative number */
+
+#define ARG_TYPEMASK 0x07
+#define ARGTYPE(x)   ((x) & ARG_TYPEMASK)
+
+#define ARG_DEPR  0x10 /* deprecated option */
+#define ARG_CLEAR 0x20 /* clear cmdline argument */
+#define ARG_TLS   0x40 /* requires TLS support */
+#define ARG_NO    0x80 /* set if the option is documented as --no-* */
+
+struct LongShort {
+  const char *lname;  /* long name option */
+  unsigned char desc; /* type, see ARG_* */
+  char letter;  /* short name option or ' ' */
+  unsigned short cmd;
+};
+
 typedef enum {
   PARAM_OK = 0,
-  PARAM_OPTION_AMBIGUOUS,
   PARAM_OPTION_UNKNOWN,
+  PARAM_CONFIG_OPTION_UNKNOWN,
   PARAM_REQUIRES_PARAMETER,
   PARAM_BAD_USE,
   PARAM_HELP_REQUESTED,
   PARAM_MANUAL_REQUESTED,
   PARAM_VERSION_INFO_REQUESTED,
   PARAM_ENGINES_REQUESTED,
+  PARAM_CA_EMBED_REQUESTED,
   PARAM_GOT_EXTRA_PARAMETER,
   PARAM_BAD_NUMERIC,
   PARAM_NEGATIVE_NUMERIC,
@@ -44,30 +356,46 @@ typedef enum {
   PARAM_NEXT_OPERATION,
   PARAM_NO_PREFIX,
   PARAM_NUMBER_TOO_LARGE,
-  PARAM_NO_NOT_BOOLEAN,
-  PARAM_CONTDISP_SHOW_HEADER, /* --include and --remote-header-name */
   PARAM_CONTDISP_RESUME_FROM, /* --continue-at and --remote-header-name */
   PARAM_READ_ERROR,
   PARAM_EXPAND_ERROR, /* --expand problem */
+  PARAM_BLANK_STRING,
+  PARAM_VAR_SYNTAX, /* --variable syntax error */
+  PARAM_RECURSION,
   PARAM_LAST
 } ParameterError;
 
-struct GlobalConfig;
 struct OperationConfig;
 
-ParameterError getparameter(const char *flag, char *nextarg,
-                            argv_item_t cleararg,
+const struct LongShort *findlongopt(const char *opt);
+const struct LongShort *findshortopt(char letter);
+
+ParameterError getparameter(const char *flag, const char *nextarg,
                             bool *usedarg,
-                            struct GlobalConfig *global,
-                            struct OperationConfig *operation);
+                            struct OperationConfig *config,
+                            int max_recursive);
 
 #ifdef UNITTESTS
-void parse_cert_parameter(const char *cert_parameter,
-                          char **certname,
-                          char **passphrase);
+UNITTEST ParameterError parse_cert_parameter(const char *cert_parameter,
+                                             char **certname,
+                                             char **passphrase);
+UNITTEST ParameterError GetSizeParameter(const char *arg, curl_off_t *out);
 #endif
 
-ParameterError parse_args(struct GlobalConfig *config, int argc,
-                          argv_item_t argv[]);
+ParameterError parse_args(int argc, argv_item_t argv[]);
+
+#if defined(UNICODE) && defined(_WIN32)
+
+#define convert_UTF8_to_tchar(ptr) curlx_convert_UTF8_to_wchar(ptr)
+#define convert_tchar_to_UTF8(ptr) curlx_convert_wchar_to_UTF8(ptr)
+#define unicodefree(ptr)           curlx_free(ptr)
+
+#else
+
+#define convert_UTF8_to_tchar(ptr) (const char *)(ptr)
+#define convert_tchar_to_UTF8(ptr) (const char *)(ptr)
+#define unicodefree(ptr)           do {} while(0)
+
+#endif
 
 #endif /* HEADER_CURL_TOOL_GETPARAM_H */
diff --git a/third-party/curl/src/tool_getpass.c b/third-party/curl/src/tool_getpass.c
index a4fb35108d..f0eeebcc41 100644
--- a/third-party/curl/src/tool_getpass.c
+++ b/third-party/curl/src/tool_getpass.c
@@ -30,10 +30,6 @@
 #ifndef HAVE_GETPASS_R
 /* this file is only for systems without getpass_r() */
 
-#ifdef HAVE_FCNTL_H
-#  include <fcntl.h>
-#endif
-
 #ifdef HAVE_TERMIOS_H
 #  include <termios.h>
 #elif defined(HAVE_TERMIO_H)
@@ -46,7 +42,7 @@
 #  include iodef
 #endif
 
-#ifdef WIN32
+#ifdef _WIN32
 #  include <conio.h>
 #endif
 
@@ -55,8 +51,6 @@
 #endif
 #include "tool_getpass.h"
 
-#include "memdebug.h" /* keep this as LAST include */
-
 #ifdef __VMS
 /* VMS implementation */
 char *getpass_r(const char *prompt, char *buffer, size_t buflen)
@@ -64,15 +58,12 @@ char *getpass_r(const char *prompt, char *buffer, size_t buflen)
   long sts;
   short chan;
 
-  /* MSK, 23-JAN-2004, iosbdef.h wasn't in VAX V7.2 or CC 6.4  */
-  /* distribution so I created this.  May revert back later to */
-  /* struct _iosb iosb;                                        */
-  struct _iosb
-     {
-     short int iosb$w_status; /* status     */
-     short int iosb$w_bcnt;   /* byte count */
-     int       unused;        /* unused     */
-     } iosb;
+  /* iosbdef.h was not in VAX v7.2 or CC 6.4 */
+  struct _isb {
+    short int iosb$w_status; /* status */
+    short int iosb$w_bcnt;   /* byte count */
+    int unused;              /* unused */
+  } iosb;
 
   $DESCRIPTOR(ttdesc, "TT");
 
@@ -94,35 +85,33 @@ char *getpass_r(const char *prompt, char *buffer, size_t buflen)
 #define DONE
 #endif /* __VMS */
 
-#if defined(WIN32)
-
+#ifdef _WIN32
 char *getpass_r(const char *prompt, char *buffer, size_t buflen)
 {
   size_t i;
-  fputs(prompt, stderr);
+  fputs(prompt, tool_stderr);
 
   for(i = 0; i < buflen; i++) {
-    buffer[i] = (char)getch();
+    buffer[i] = (char)_getch();
     if(buffer[i] == '\r' || buffer[i] == '\n') {
       buffer[i] = '\0';
       break;
     }
-    else
-      if(buffer[i] == '\b')
-        /* remove this letter and if this is not the first key, remove the
-           previous one as well */
-        i = i - (i >= 1 ? 2 : 1);
+    else if(buffer[i] == '\b')
+      /* remove this letter and if this is not the first key, remove the
+         previous one as well */
+      i = i - (i >= 1 ? 2 : 1);
   }
   /* since echo is disabled, print a newline */
-  fputs("\n", stderr);
-  /* if user didn't hit ENTER, terminate buffer */
+  fputs("\n", tool_stderr);
+  /* if user did not hit ENTER, terminate buffer */
   if(i == buflen)
-    buffer[buflen-1] = '\0';
+    buffer[buflen - 1] = '\0';
 
   return buffer; /* we always return success */
 }
 #define DONE
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
 #ifndef DONE /* not previously provided */
 
@@ -146,15 +135,15 @@ static bool ttyecho(bool enable, int fd)
 #ifdef HAVE_TERMIOS_H
     tcgetattr(fd, &withecho);
     noecho = withecho;
-    noecho.c_lflag &= ~ECHO;
+    noecho.c_lflag &= ~(tcflag_t)ECHO;
     tcsetattr(fd, TCSANOW, &noecho);
 #elif defined(HAVE_TERMIO_H)
     ioctl(fd, TCGETA, &withecho);
     noecho = withecho;
-    noecho.c_lflag &= ~ECHO;
+    noecho.c_lflag &= ~(tcflag_t)ECHO;
     ioctl(fd, TCSETA, &noecho);
 #else
-    /* neither HAVE_TERMIO_H nor HAVE_TERMIOS_H, we can't disable echo! */
+    /* neither HAVE_TERMIO_H nor HAVE_TERMIOS_H, we cannot disable echo! */
     (void)fd;
     return FALSE; /* not disabled */
 #endif
@@ -173,34 +162,34 @@ static bool ttyecho(bool enable, int fd)
 }
 
 char *getpass_r(const char *prompt, /* prompt to display */
-                char *password,     /* buffer to store password in */
+                char *buffer,       /* buffer to store password in */
                 size_t buflen)      /* size of buffer to store password in */
 {
   ssize_t nread;
   bool disabled;
-  int fd = open("/dev/tty", O_RDONLY);
-  if(-1 == fd)
-    fd = STDIN_FILENO; /* use stdin if the tty couldn't be used */
+  int fd = curlx_open("/dev/tty", O_RDONLY);
+  if(fd == -1)
+    fd = STDIN_FILENO; /* use stdin if the tty could not be used */
 
   disabled = ttyecho(FALSE, fd); /* disable terminal echo */
 
-  fputs(prompt, stderr);
-  nread = read(fd, password, buflen);
+  fputs(prompt, tool_stderr);
+  nread = read(fd, buffer, buflen);
   if(nread > 0)
-    password[--nread] = '\0'; /* null-terminate where enter is stored */
+    buffer[--nread] = '\0'; /* null-terminate where enter is stored */
   else
-    password[0] = '\0'; /* got nothing */
+    buffer[0] = '\0'; /* got nothing */
 
   if(disabled) {
     /* if echo actually was disabled, add a newline */
-    fputs("\n", stderr);
+    fputs("\n", tool_stderr);
     (void)ttyecho(TRUE, fd); /* enable echo */
   }
 
   if(STDIN_FILENO != fd)
-    close(fd);
+    curlx_close(fd);
 
-  return password; /* return pointer to buffer */
+  return buffer; /* return pointer to buffer */
 }
 
 #endif /* DONE */
diff --git a/third-party/curl/src/tool_getpass.h b/third-party/curl/src/tool_getpass.h
index b93585d94d..f04fefb4bc 100644
--- a/third-party/curl/src/tool_getpass.h
+++ b/third-party/curl/src/tool_getpass.h
@@ -26,11 +26,11 @@
 #include "tool_setup.h"
 
 #ifndef HAVE_GETPASS_R
-/* If there's a system-provided function named like this, we trust it is
+/* If there is a system-provided function named like this, we trust it is
    also found in one of the standard headers. */
 
 /*
- * Returning NULL will abort the continued operation!
+ * Returning NULL aborts the continued operation!
  */
 char *getpass_r(const char *prompt, char *buffer, size_t buflen);
 #endif
diff --git a/third-party/curl/src/tool_help.c b/third-party/curl/src/tool_help.c
index 729b78c366..c9d76d5d20 100644
--- a/third-party/curl/src/tool_help.c
+++ b/third-party/curl/src/tool_help.c
@@ -22,61 +22,52 @@
  *
  ***************************************************************************/
 #include "tool_setup.h"
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
 
 #include "tool_help.h"
 #include "tool_libinfo.h"
 #include "tool_util.h"
 #include "tool_version.h"
-
-#include "memdebug.h" /* keep this as LAST include */
-
-#ifdef MSDOS
-#  define USE_WATT32
-#endif
+#include "tool_hugehelp.h"
+#include "tool_getparam.h"
+#include "tool_cfgable.h"
+#include "terminal.h"
 
 struct category_descriptors {
   const char *opt;
   const char *desc;
-  curlhelp_t category;
+  unsigned int category;
 };
 
 static const struct category_descriptors categories[] = {
-  {"auth", "Different types of authentication methods", CURLHELP_AUTH},
-  {"connection", "Low level networking operations",
-   CURLHELP_CONNECTION},
-  {"curl", "The command line tool itself", CURLHELP_CURL},
-  {"dns", "General DNS options", CURLHELP_DNS},
-  {"file", "FILE protocol options", CURLHELP_FILE},
-  {"ftp", "FTP protocol options", CURLHELP_FTP},
-  {"http", "HTTP and HTTPS protocol options", CURLHELP_HTTP},
-  {"imap", "IMAP protocol options", CURLHELP_IMAP},
   /* important is left out because it is the default help page */
-  {"misc", "Options that don't fit into any other category", CURLHELP_MISC},
-  {"output", "Filesystem output", CURLHELP_OUTPUT},
-  {"pop3", "POP3 protocol options", CURLHELP_POP3},
-  {"post", "HTTP Post specific options", CURLHELP_POST},
-  {"proxy", "All options related to proxies", CURLHELP_PROXY},
-  {"scp", "SCP protocol options", CURLHELP_SCP},
-  {"sftp", "SFTP protocol options", CURLHELP_SFTP},
-  {"smtp", "SMTP protocol options", CURLHELP_SMTP},
-  {"ssh", "SSH protocol options", CURLHELP_SSH},
-  {"telnet", "TELNET protocol options", CURLHELP_TELNET},
-  {"tftp", "TFTP protocol options", CURLHELP_TFTP},
-  {"tls", "All TLS/SSL related options", CURLHELP_TLS},
-  {"upload", "All options for uploads",
-   CURLHELP_UPLOAD},
-  {"verbose", "Options related to any kind of command line output of curl",
-   CURLHELP_VERBOSE},
-  {NULL, NULL, CURLHELP_HIDDEN}
+  { "auth", "Authentication methods", CURLHELP_AUTH },
+  { "connection", "Manage connections", CURLHELP_CONNECTION },
+  { "curl", "The command line tool itself", CURLHELP_CURL },
+  { "deprecated", "Legacy", CURLHELP_DEPRECATED },
+  { "dns", "Names and resolving", CURLHELP_DNS },
+  { "file", "FILE protocol", CURLHELP_FILE },
+  { "ftp", "FTP protocol", CURLHELP_FTP },
+  { "global", "Global options", CURLHELP_GLOBAL },
+  { "http", "HTTP and HTTPS protocol", CURLHELP_HTTP },
+  { "imap", "IMAP protocol", CURLHELP_IMAP },
+  { "ldap", "LDAP protocol", CURLHELP_LDAP },
+  { "output", "File system output", CURLHELP_OUTPUT },
+  { "pop3", "POP3 protocol", CURLHELP_POP3 },
+  { "post", "HTTP POST specific", CURLHELP_POST },
+  { "proxy", "Options for proxies", CURLHELP_PROXY },
+  { "scp", "SCP protocol", CURLHELP_SCP },
+  { "sftp", "SFTP protocol", CURLHELP_SFTP },
+  { "smtp", "SMTP protocol", CURLHELP_SMTP },
+  { "ssh", "SSH protocol", CURLHELP_SSH },
+  { "telnet", "TELNET protocol", CURLHELP_TELNET },
+  { "tftp", "TFTP protocol", CURLHELP_TFTP },
+  { "timeout", "Timeouts and delays", CURLHELP_TIMEOUT },
+  { "tls", "TLS/SSL related", CURLHELP_TLS },
+  { "upload", "Upload, sending data", CURLHELP_UPLOAD },
+  { "verbose", "Tracing, logging etc", CURLHELP_VERBOSE }
 };
 
-extern const struct helptxt helptext[];
-
-
-static void print_category(curlhelp_t category)
+static void print_category(unsigned int category, unsigned int cols)
 {
   unsigned int i;
   size_t longopt = 5;
@@ -93,23 +84,35 @@ static void print_category(curlhelp_t category)
     if(len > longdesc)
       longdesc = len;
   }
-  if(longopt + longdesc > 80)
-    longopt = 80 - longdesc;
+
+  if(longdesc > cols)
+    longopt = 0; /* avoid wrap-around */
+  else if(longopt + longdesc > cols)
+    longopt = cols - longdesc;
 
   for(i = 0; helptext[i].opt; ++i)
     if(helptext[i].categories & category) {
-      printf(" %-*s %s\n", (int)longopt, helptext[i].opt, helptext[i].desc);
+      size_t opt = longopt;
+      size_t desclen = strlen(helptext[i].desc);
+      /* avoid wrap-around */
+      if(cols >= 2 && opt + desclen >= (cols - 2)) {
+        if(desclen < (cols - 2))
+          opt = (cols - 3) - desclen;
+        else
+          opt = 0;
+      }
+      curl_mprintf(" %-*s  %s\n", (int)opt, helptext[i].opt, helptext[i].desc);
     }
 }
 
 /* Prints category if found. If not, it returns 1 */
-static int get_category_content(const char *category)
+static int get_category_content(const char *category, unsigned int cols)
 {
   unsigned int i;
-  for(i = 0; categories[i].opt; ++i)
+  for(i = 0; i < CURL_ARRAYSIZE(categories); ++i)
     if(curl_strequal(categories[i].opt, category)) {
-      printf("%s: %s\n", categories[i].opt, categories[i].desc);
-      print_category(categories[i].category);
+      curl_mprintf("%s: %s\n", categories[i].opt, categories[i].desc);
+      print_category(categories[i].category, cols);
       return 0;
     }
   return 1;
@@ -119,41 +122,187 @@ static int get_category_content(const char *category)
 static void get_categories(void)
 {
   unsigned int i;
-  for(i = 0; categories[i].opt; ++i)
-    printf(" %-11s %s\n", categories[i].opt, categories[i].desc);
+  for(i = 0; i < CURL_ARRAYSIZE(categories); ++i)
+    curl_mprintf(" %-11s %s\n", categories[i].opt, categories[i].desc);
 }
 
-
-void tool_help(char *category)
+/* Prints all categories as a comma-separated list of given width */
+static void get_categories_list(unsigned int width)
 {
-  puts("Usage: curl [options...] <url>");
+  unsigned int i;
+  size_t col = 0;
+  for(i = 0; i < CURL_ARRAYSIZE(categories); ++i) {
+    size_t len = strlen(categories[i].opt);
+    if(i == CURL_ARRAYSIZE(categories) - 1) {
+      /* final category */
+      if(col + len + 1 < width)
+        curl_mprintf("%s.\n", categories[i].opt);
+      else
+        /* start a new line first */
+        curl_mprintf("\n%s.\n", categories[i].opt);
+    }
+    else if(col + len + 2 < width) {
+      curl_mprintf("%s, ", categories[i].opt);
+      col += len + 2;
+    }
+    else {
+      /* start a new line first */
+      curl_mprintf("\n%s, ", categories[i].opt);
+      col = len + 2;
+    }
+  }
+}
+
+#ifdef USE_MANUAL
+
+void inithelpscan(struct scan_ctx *ctx,
+                  const char *trigger,
+                  const char *arg,
+                  const char *endarg)
+{
+  ctx->trigger = trigger;
+  ctx->tlen = strlen(trigger);
+  ctx->arg = arg;
+  ctx->flen = strlen(arg);
+  ctx->endarg = endarg;
+  ctx->elen = strlen(endarg);
+  DEBUGASSERT((ctx->elen < sizeof(ctx->rbuf)) &&
+              (ctx->flen < sizeof(ctx->rbuf)) &&
+              (ctx->tlen < sizeof(ctx->rbuf)));
+  ctx->show = 0;
+  ctx->olen = 0;
+  memset(ctx->rbuf, 0, sizeof(ctx->rbuf));
+}
+
+bool helpscan(const unsigned char *buf, size_t len, struct scan_ctx *ctx)
+{
+  size_t i;
+  for(i = 0; i < len; i++) {
+    if(!ctx->show) {
+      /* wait for the trigger */
+      memmove(&ctx->rbuf[0], &ctx->rbuf[1], ctx->tlen - 1);
+      ctx->rbuf[ctx->tlen - 1] = buf[i];
+      if(!memcmp(ctx->rbuf, ctx->trigger, ctx->tlen))
+        ctx->show++;
+      continue;
+    }
+    /* past the trigger */
+    if(ctx->show == 1) {
+      memmove(&ctx->rbuf[0], &ctx->rbuf[1], ctx->flen - 1);
+      ctx->rbuf[ctx->flen - 1] = buf[i];
+      if(!memcmp(ctx->rbuf, ctx->arg, ctx->flen)) {
+        /* match, now output until endarg */
+        fputs(&ctx->arg[1], stdout);
+        ctx->show++;
+      }
+      continue;
+    }
+    /* show until the end */
+    memmove(&ctx->rbuf[0], &ctx->rbuf[1], ctx->elen - 1);
+    ctx->rbuf[ctx->elen - 1] = buf[i];
+    if(!memcmp(ctx->rbuf, ctx->endarg, ctx->elen))
+      return FALSE;
+
+    if(buf[i] == '\n') {
+      DEBUGASSERT(ctx->olen < sizeof(ctx->obuf));
+      if(ctx->olen == sizeof(ctx->obuf))
+        return FALSE; /* bail out */
+      ctx->obuf[ctx->olen++] = 0;
+      ctx->olen = 0;
+      puts(ctx->obuf);
+    }
+    else {
+      DEBUGASSERT(ctx->olen < sizeof(ctx->obuf));
+      if(ctx->olen == sizeof(ctx->obuf))
+        return FALSE; /* bail out */
+      ctx->obuf[ctx->olen++] = buf[i];
+    }
+  }
+  return TRUE;
+}
+
+#endif
+
+void tool_help(const char *category)
+{
+  unsigned int cols = get_terminal_columns();
   /* If no category was provided */
   if(!category) {
-    const char *category_note = "\nThis is not the full help, this "
-      "menu is stripped into categories.\nUse \"--help category\" to get "
-      "an overview of all categories.\nFor all options use the manual"
-      " or \"--help all\".";
-    print_category(CURLHELP_IMPORTANT);
+    const char *category_note =
+      "\nThis is not the full help; this "
+      "menu is split into categories.\nUse \"--help category\" to get "
+      "an overview of all categories, which are:";
+    const char *category_note2 =
+      "Use \"--help all\" to list all options"
+#ifdef USE_MANUAL
+      "\nUse \"--help [option]\" to view documentation for a given option"
+#endif
+      ;
+    puts("Usage: curl [options...] <url>");
+    print_category(CURLHELP_IMPORTANT, cols);
     puts(category_note);
+    get_categories_list(cols);
+    puts(category_note2);
   }
   /* Lets print everything if "all" was provided */
   else if(curl_strequal(category, "all"))
-    /* Print everything except hidden */
-    print_category(~(CURLHELP_HIDDEN));
+    /* Print everything */
+    print_category(CURLHELP_ALL, cols);
   /* Lets handle the string "category" differently to not print an errormsg */
   else if(curl_strequal(category, "category"))
     get_categories();
+  else if(category[0] == '-') {
+#ifdef USE_MANUAL
+    /* command line option help */
+    const struct LongShort *a = NULL;
+    if(category[1] == '-') {
+      const char *lookup = &category[2];
+      bool noflagged = FALSE;
+      if(!strncmp(lookup, "no-", 3)) {
+        lookup += 3;
+        noflagged = TRUE;
+      }
+      a = findlongopt(lookup);
+      if(a && noflagged && (ARGTYPE(a->desc) != ARG_BOOL))
+        /* a --no- prefix for a non-boolean is not specifying a proper
+           option */
+        a = NULL;
+    }
+    else if(!category[2])
+      a = findshortopt(category[1]);
+    if(!a) {
+      curl_mfprintf(tool_stderr, "Incorrect option name to show help for,"
+                    " see curl -h\n");
+    }
+    else {
+      char cmdbuf[80];
+      if(a->letter != ' ')
+        curl_msnprintf(cmdbuf, sizeof(cmdbuf), "\n    -%c, --", a->letter);
+      else if(a->desc & ARG_NO)
+        curl_msnprintf(cmdbuf, sizeof(cmdbuf), "\n    --no-%s", a->lname);
+      else
+        curl_msnprintf(cmdbuf, sizeof(cmdbuf), "\n    %s", category);
+      if(a->cmd == C_XATTR)
+        /* this is the last option, which then ends when FILES starts */
+        showhelp("\nALL OPTIONS\n", cmdbuf, "\nFILES");
+      else
+        showhelp("\nALL OPTIONS\n", cmdbuf, "\n    -");
+    }
+#else
+    curl_mfprintf(tool_stderr, "Cannot comply. "
+                  "This curl was built without built-in manual\n");
+#endif
+  }
   /* Otherwise print category and handle the case if the cat was not found */
-  else if(get_category_content(category)) {
-    puts("Invalid category provided, here is a list of all categories:\n");
+  else if(get_category_content(category, cols)) {
+    puts("Unknown category provided, here is a list of all categories:\n");
     get_categories();
   }
-  free(category);
 }
 
 static bool is_debug(void)
 {
-  const char *const *builtin;
+  const char * const *builtin;
   for(builtin = feature_names; *builtin; ++builtin)
     if(curl_strequal("debug", *builtin))
       return TRUE;
@@ -162,37 +311,80 @@ static bool is_debug(void)
 
 void tool_version_info(void)
 {
-  const char *const *builtin;
+  const char * const *builtin;
   if(is_debug())
-    fprintf(stderr, "WARNING: this libcurl is Debug-enabled, "
-            "do not use in production\n\n");
+    curl_mfprintf(tool_stderr, "WARNING: this libcurl is Debug-enabled, "
+                  "do not use in production\n\n");
 
-  printf(CURL_ID "%s\n", curl_version());
+  curl_mprintf(CURL_ID "%s\n", curl_version());
 #ifdef CURL_PATCHSTAMP
-  printf("Release-Date: %s, security patched: %s\n",
-         LIBCURL_TIMESTAMP, CURL_PATCHSTAMP);
+  curl_mprintf("Release-Date: %s, security patched: %s\n",
+               LIBCURL_TIMESTAMP, CURL_PATCHSTAMP);
 #else
-  printf("Release-Date: %s\n", LIBCURL_TIMESTAMP);
+  curl_mprintf("Release-Date: %s\n", LIBCURL_TIMESTAMP);
 #endif
   if(built_in_protos[0]) {
-    printf("Protocols:");
+#ifndef CURL_DISABLE_IPFS
+    const char *insert = NULL;
+    /* we have ipfs and ipns support if libcurl has http support */
     for(builtin = built_in_protos; *builtin; ++builtin) {
-      /* Special case: do not list rtmp?* protocols.
-         They may only appear together with "rtmp" */
-      if(!curl_strnequal(*builtin, "rtmp", 4) || !builtin[0][4])
-        printf(" %s", *builtin);
+      if(insert) {
+        /* update insertion so ipfs is printed in alphabetical order */
+        if(strcmp(*builtin, "ipfs") < 0)
+          insert = *builtin;
+        else
+          break;
+      }
+      else if(!strcmp(*builtin, "http")) {
+        insert = *builtin;
+      }
+    }
+#endif /* !CURL_DISABLE_IPFS */
+    curl_mprintf("Protocols:");
+    for(builtin = built_in_protos; *builtin; ++builtin) {
+      curl_mprintf(" %s", *builtin);
+#ifndef CURL_DISABLE_IPFS
+      if(insert && insert == *builtin) {
+        curl_mprintf(" ipfs ipns");
+        insert = NULL;
+      }
+#endif /* !CURL_DISABLE_IPFS */
     }
     puts(""); /* newline */
   }
   if(feature_names[0]) {
-    printf("Features:");
-    for(builtin = feature_names; *builtin; ++builtin)
-      printf(" %s", *builtin);
-    puts(""); /* newline */
+    const char **feat_ext;
+    size_t feat_ext_count = feature_count;
+#ifdef CURL_CA_EMBED
+    ++feat_ext_count;
+#endif
+#ifdef CURL_DEBUG_GLOBAL_MEM
+    ++feat_ext_count;
+#endif
+    feat_ext = curlx_malloc(sizeof(*feature_names) * (feat_ext_count + 1));
+    if(feat_ext) {
+      memcpy((void *)feat_ext, feature_names,
+             sizeof(*feature_names) * feature_count);
+      feat_ext_count = feature_count;
+#ifdef CURL_CA_EMBED
+      feat_ext[feat_ext_count++] = "CAcert";
+#endif
+#ifdef CURL_DEBUG_GLOBAL_MEM
+      feat_ext[feat_ext_count++] = "global-mem-debug";
+#endif
+      feat_ext[feat_ext_count] = NULL;
+      qsort((void *)feat_ext, feat_ext_count, sizeof(*feat_ext),
+            struplocompare4sort);
+      curl_mprintf("Features:");
+      for(builtin = feat_ext; *builtin; ++builtin)
+        curl_mprintf(" %s", *builtin);
+      puts(""); /* newline */
+      curlx_free((void *)feat_ext);
+    }
   }
   if(strcmp(CURL_VERSION, curlinfo->version)) {
-    printf("WARNING: curl and libcurl versions do not match. "
-           "Functionality may be affected.\n");
+    curl_mprintf("WARNING: curl and libcurl versions do not match. "
+                 "Functionality may be affected.\n");
   }
 }
 
@@ -207,7 +399,7 @@ void tool_list_engines(void)
   puts("Build-time engines:");
   if(engines) {
     for(; engines; engines = engines->next)
-      printf("  %s\n", engines->data);
+      curl_mprintf("  %s\n", engines->data);
   }
   else {
     puts("  <none>");
diff --git a/third-party/curl/src/tool_help.h b/third-party/curl/src/tool_help.h
index fe497ed34a..6a2ecdb062 100644
--- a/third-party/curl/src/tool_help.h
+++ b/third-party/curl/src/tool_help.h
@@ -25,49 +25,68 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-void tool_help(char *category);
+void tool_help(const char *category);
 void tool_list_engines(void);
 void tool_version_info(void);
-
-typedef unsigned int curlhelp_t;
+struct scan_ctx {
+  const char *trigger;
+  size_t tlen;
+  const char *arg;
+  size_t flen;
+  const char *endarg;
+  size_t elen;
+  size_t olen;
+  char rbuf[40];
+  char obuf[160];
+  unsigned char show; /* start as at 0.
+                         trigger match moves it to 1
+                         arg match moves it to 2
+                         endarg stops the search */
+};
+void inithelpscan(struct scan_ctx *ctx, const char *trigger,
+                  const char *arg, const char *endarg);
+bool helpscan(const unsigned char *buf, size_t len, struct scan_ctx *ctx);
 
 struct helptxt {
   const char *opt;
   const char *desc;
-  curlhelp_t categories;
+  unsigned int categories;
 };
 
 /*
- * The bitmask output is generated with the following command
- ------------------------------------------------------------
-  cd $srcroot/docs/cmdline-opts
-  ./gen.pl listcats *.d
+  The bitmask output is generated with the following command:
+  ------------------------------------------------------------
+  make -C docs/cmdline-opts listcats
  */
 
-#define CURLHELP_HIDDEN 1u << 0u
-#define CURLHELP_AUTH 1u << 1u
-#define CURLHELP_CONNECTION 1u << 2u
-#define CURLHELP_CURL 1u << 3u
-#define CURLHELP_DNS 1u << 4u
-#define CURLHELP_FILE 1u << 5u
-#define CURLHELP_FTP 1u << 6u
-#define CURLHELP_HTTP 1u << 7u
-#define CURLHELP_IMAP 1u << 8u
-#define CURLHELP_IMPORTANT 1u << 9u
-#define CURLHELP_MISC 1u << 10u
-#define CURLHELP_OUTPUT 1u << 11u
-#define CURLHELP_POP3 1u << 12u
-#define CURLHELP_POST 1u << 13u
-#define CURLHELP_PROXY 1u << 14u
-#define CURLHELP_SCP 1u << 15u
-#define CURLHELP_SFTP 1u << 16u
-#define CURLHELP_SMTP 1u << 17u
-#define CURLHELP_SSH 1u << 18u
-#define CURLHELP_TELNET 1u << 19u
-#define CURLHELP_TFTP 1u << 20u
-#define CURLHELP_TLS 1u << 21u
-#define CURLHELP_UPLOAD 1u << 22u
-#define CURLHELP_VERBOSE 1u << 23u
+#define CURLHELP_AUTH       (1 << 0)
+#define CURLHELP_CONNECTION (1 << 1)
+#define CURLHELP_CURL       (1 << 2)
+#define CURLHELP_DEPRECATED (1 << 3)
+#define CURLHELP_DNS        (1 << 4)
+#define CURLHELP_FILE       (1 << 5)
+#define CURLHELP_FTP        (1 << 6)
+#define CURLHELP_GLOBAL     (1 << 7)
+#define CURLHELP_HTTP       (1 << 8)
+#define CURLHELP_IMAP       (1 << 9)
+#define CURLHELP_IMPORTANT  (1 << 10)
+#define CURLHELP_LDAP       (1 << 11)
+#define CURLHELP_OUTPUT     (1 << 12)
+#define CURLHELP_POP3       (1 << 13)
+#define CURLHELP_POST       (1 << 14)
+#define CURLHELP_PROXY      (1 << 15)
+#define CURLHELP_SCP        (1 << 16)
+#define CURLHELP_SFTP       (1 << 17)
+#define CURLHELP_SMTP       (1 << 18)
+#define CURLHELP_SSH        (1 << 19)
+#define CURLHELP_TELNET     (1 << 20)
+#define CURLHELP_TFTP       (1 << 21)
+#define CURLHELP_TIMEOUT    (1 << 22)
+#define CURLHELP_TLS        (1 << 23)
+#define CURLHELP_UPLOAD     (1 << 24)
+#define CURLHELP_VERBOSE    (1 << 25)
+
+#define CURLHELP_ALL        0xfffffffU
 
 extern const struct helptxt helptext[];
 
diff --git a/third-party/curl/src/tool_helpers.c b/third-party/curl/src/tool_helpers.c
index 854bf777a0..a23c3a80e7 100644
--- a/third-party/curl/src/tool_helpers.c
+++ b/third-party/curl/src/tool_helpers.c
@@ -23,33 +23,24 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#include "strcase.h"
-
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
-
 #include "tool_cfgable.h"
 #include "tool_msgs.h"
 #include "tool_getparam.h"
 #include "tool_helpers.h"
 
-#include "memdebug.h" /* keep this as LAST include */
-
 /*
 ** Helper functions that are used from more than one source file.
 */
 
-const char *param2text(int res)
+const char *param2text(ParameterError error)
 {
-  ParameterError error = (ParameterError)res;
   switch(error) {
   case PARAM_GOT_EXTRA_PARAMETER:
     return "had unsupported trailing garbage";
   case PARAM_OPTION_UNKNOWN:
     return "is unknown";
-  case PARAM_OPTION_AMBIGUOUS:
-    return "is ambiguous";
+  case PARAM_CONFIG_OPTION_UNKNOWN:
+    return "found an unknown config option";
   case PARAM_REQUIRES_PARAMETER:
     return "requires parameter";
   case PARAM_BAD_USE:
@@ -59,34 +50,34 @@ const char *param2text(int res)
   case PARAM_NEGATIVE_NUMERIC:
     return "expected a positive numerical parameter";
   case PARAM_LIBCURL_DOESNT_SUPPORT:
-    return "the installed libcurl version doesn't support this";
+    return "the installed libcurl version does not support this";
   case PARAM_LIBCURL_UNSUPPORTED_PROTOCOL:
     return "a specified protocol is unsupported by libcurl";
   case PARAM_NO_MEM:
     return "out of memory";
   case PARAM_NO_PREFIX:
-    return "the given option can't be reversed with a --no- prefix";
+    return "the given option cannot be reversed with a --no- prefix";
   case PARAM_NUMBER_TOO_LARGE:
     return "too large number";
-  case PARAM_NO_NOT_BOOLEAN:
-    return "used '--no-' for option that isn't a boolean";
-  case PARAM_CONTDISP_SHOW_HEADER:
-    return "showing headers and --remote-header-name cannot be combined";
   case PARAM_CONTDISP_RESUME_FROM:
     return "--continue-at and --remote-header-name cannot be combined";
   case PARAM_READ_ERROR:
     return "error encountered when reading a file";
   case PARAM_EXPAND_ERROR:
     return "variable expansion failure";
+  case PARAM_BLANK_STRING:
+    return "blank argument where content is expected";
+  case PARAM_VAR_SYNTAX:
+    return "syntax error in --variable argument";
   default:
     return "unknown error";
   }
 }
 
-int SetHTTPrequest(struct OperationConfig *config, HttpReq req, HttpReq *store)
+int SetHTTPrequest(HttpReq req, HttpReq *store)
 {
   /* this mirrors the HttpReq enum in tool_sdecls.h */
-  const char *reqname[]= {
+  const char *reqname[] = {
     "", /* unspec */
     "GET (-G, --get)",
     "HEAD (-I, --head)",
@@ -95,23 +86,22 @@ int SetHTTPrequest(struct OperationConfig *config, HttpReq req, HttpReq *store)
     "PUT (-T, --upload-file)"
   };
 
-  if((*store == HTTPREQ_UNSPEC) ||
+  if((*store == TOOL_HTTPREQ_UNSPEC) ||
      (*store == req)) {
     *store = req;
     return 0;
   }
-  warnf(config->global, "You can only select one HTTP request method! "
+  warnf("You can only select one HTTP request method! "
         "You asked for both %s and %s.",
         reqname[req], reqname[*store]);
 
   return 1;
 }
 
-void customrequest_helper(struct OperationConfig *config, HttpReq req,
-                          char *method)
+void customrequest_helper(HttpReq req, const char *method)
 {
   /* this mirrors the HttpReq enum in tool_sdecls.h */
-  const char *dflt[]= {
+  const char *dflt[] = {
     "GET",
     "GET",
     "HEAD",
@@ -123,12 +113,11 @@ void customrequest_helper(struct OperationConfig *config, HttpReq req,
   if(!method)
     ;
   else if(curl_strequal(method, dflt[req])) {
-    notef(config->global, "Unnecessary use of -X or --request, %s is already "
+    notef("Unnecessary use of -X or --request, %s is already "
           "inferred.", dflt[req]);
   }
   else if(curl_strequal(method, "head")) {
-    warnf(config->global,
-          "Setting custom HTTP method to HEAD with -X/--request may not work "
+    warnf("Setting custom HTTP method to HEAD with -X/--request may not work "
           "the way you want. Consider using -I/--head instead.");
   }
 }
diff --git a/third-party/curl/src/tool_helpers.h b/third-party/curl/src/tool_helpers.h
index 2cfbad21a3..cbfa168523 100644
--- a/third-party/curl/src/tool_helpers.h
+++ b/third-party/curl/src/tool_helpers.h
@@ -25,12 +25,8 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-const char *param2text(int res);
-
-int SetHTTPrequest(struct OperationConfig *config, HttpReq req,
-                   HttpReq *store);
-
-void customrequest_helper(struct OperationConfig *config, HttpReq req,
-                          char *method);
+const char *param2text(ParameterError error);
+int SetHTTPrequest(HttpReq req, HttpReq *store);
+void customrequest_helper(HttpReq req, const char *method);
 
 #endif /* HEADER_CURL_TOOL_HELPERS_H */
diff --git a/third-party/curl/src/tool_hugehelp.c.cvs b/third-party/curl/src/tool_hugehelp.c.cvs
deleted file mode 100644
index 06b132fbcb..0000000000
--- a/third-party/curl/src/tool_hugehelp.c.cvs
+++ /dev/null
@@ -1,31 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "tool_setup.h"
-#include "tool_hugehelp.h"
-
-void hugehelp(void)
-{
-  puts("This is a silly replacement for the actual file.");
-}
diff --git a/third-party/curl/src/tool_hugehelp.h b/third-party/curl/src/tool_hugehelp.h
index ce9af0c545..89df96ce5f 100644
--- a/third-party/curl/src/tool_hugehelp.h
+++ b/third-party/curl/src/tool_hugehelp.h
@@ -26,10 +26,8 @@
 #include "tool_setup.h"
 
 #ifdef USE_MANUAL
+void showhelp(const char *trigger, const char *arg, const char *endarg);
 void hugehelp(void);
-#else
-/* do nothing if not there */
-#define hugehelp()
 #endif
 
 #endif /* HEADER_CURL_TOOL_HUGEHELP_H */
diff --git a/third-party/curl/src/tool_ipfs.c b/third-party/curl/src/tool_ipfs.c
new file mode 100644
index 0000000000..2abfcfd3db
--- /dev/null
+++ b/third-party/curl/src/tool_ipfs.c
@@ -0,0 +1,239 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "tool_setup.h"
+
+#ifndef CURL_DISABLE_IPFS
+
+#include "tool_cfgable.h"
+#include "tool_msgs.h"
+#include "tool_ipfs.h"
+
+/* input string ends in slash? */
+static bool has_trailing_slash(const char *input)
+{
+  size_t len = strlen(input);
+  return len && input[len - 1] == '/';
+}
+
+static char *ipfs_gateway(void)
+{
+  char *ipfs_path_c = NULL;
+  char *gateway_composed_c = NULL;
+  FILE *gfile = NULL;
+  char *gateway_env = getenv("IPFS_GATEWAY");
+
+  if(gateway_env)
+    return curlx_strdup(gateway_env);
+
+  /* Try to find the gateway in the IPFS data folder. */
+  ipfs_path_c = curl_getenv("IPFS_PATH");
+
+  if(!ipfs_path_c) {
+    char *home = getenv("HOME");
+    /* fallback to "~/.ipfs", as that is the default location. */
+    if(home && *home)
+      ipfs_path_c = curl_maprintf("%s/.ipfs/", home);
+    if(!ipfs_path_c)
+      goto fail;
+  }
+
+  gateway_composed_c =
+    curl_maprintf("%s%sgateway", ipfs_path_c,
+                  has_trailing_slash(ipfs_path_c) ? "" : "/");
+
+  if(!gateway_composed_c)
+    goto fail;
+
+  gfile = curlx_fopen(gateway_composed_c, FOPEN_READTEXT);
+  curl_free(gateway_composed_c);
+
+  if(gfile) {
+    int c;
+    struct dynbuf dyn;
+    char *gateway = NULL;
+    curlx_dyn_init(&dyn, MAX_GATEWAY_URL_LEN);
+
+    /* get the first line of the gateway file, ignore the rest */
+    while((c = getc(gfile)) != EOF && c != '\n' && c != '\r') {
+      char c_char = (char)c;
+      if(curlx_dyn_addn(&dyn, &c_char, 1))
+        goto fail;
+    }
+
+    if(curlx_dyn_len(&dyn))
+      gateway = curlx_dyn_ptr(&dyn);
+
+    curl_free(ipfs_path_c);
+    curlx_fclose(gfile);
+
+    return gateway;
+  }
+fail:
+  if(gfile)
+    curlx_fclose(gfile);
+  curl_free(ipfs_path_c);
+  return NULL;
+}
+
+/*
+ * Rewrite ipfs://<cid> and ipns://<cid> to an HTTP(S)
+ * URL that can be handled by an IPFS gateway.
+ */
+CURLcode ipfs_url_rewrite(CURLU *uh, const char *protocol, char **url,
+                          struct OperationConfig *config)
+{
+  CURLcode result = CURLE_URL_MALFORMAT;
+  CURLUcode getResult;
+  char *gateway = NULL;
+  char *gwhost = NULL;
+  char *gwpath = NULL;
+  char *gwquery = NULL;
+  char *gwscheme = NULL;
+  char *gwport = NULL;
+  char *inputpath = NULL;
+  char *cid = NULL;
+  char *pathbuffer = NULL;
+  char *cloneurl;
+  CURLU *gatewayurl = curl_url();
+
+  if(!gatewayurl) {
+    result = CURLE_FAILED_INIT;
+    goto clean;
+  }
+
+  getResult = curl_url_get(uh, CURLUPART_HOST, &cid, CURLU_URLDECODE);
+  if(getResult || !cid)
+    goto clean;
+
+  /* We might have a --ipfs-gateway argument. Check it first and use it. Error
+   * if we do have something but if it is an invalid URL.
+   */
+  if(config->ipfs_gateway) {
+    if(!curl_url_set(gatewayurl, CURLUPART_URL, config->ipfs_gateway,
+                     CURLU_GUESS_SCHEME)) {
+      gateway = curlx_strdup(config->ipfs_gateway);
+      if(!gateway) {
+        result = CURLE_URL_MALFORMAT;
+        goto clean;
+      }
+    }
+    else {
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+      goto clean;
+    }
+  }
+  else {
+    gateway = ipfs_gateway();
+    if(!gateway) {
+      result = CURLE_FILE_COULDNT_READ_FILE;
+      goto clean;
+    }
+
+    if(curl_url_set(gatewayurl, CURLUPART_URL, gateway, 0)) {
+      result = CURLE_URL_MALFORMAT;
+      goto clean;
+    }
+  }
+
+  /* check for unsupported gateway parts */
+  if(curl_url_get(gatewayurl, CURLUPART_QUERY, &gwquery, 0) !=
+     CURLUE_NO_QUERY) {
+    result = CURLE_URL_MALFORMAT;
+    goto clean;
+  }
+
+  /* get gateway parts */
+  if(curl_url_get(gatewayurl, CURLUPART_HOST, &gwhost, CURLU_URLDECODE) ||
+     curl_url_get(gatewayurl, CURLUPART_SCHEME, &gwscheme, CURLU_URLDECODE) ||
+     curl_url_get(gatewayurl, CURLUPART_PORT, &gwport,
+                  CURLU_URLDECODE | CURLU_DEFAULT_PORT) ||
+     curl_url_get(gatewayurl, CURLUPART_PATH, &gwpath, CURLU_URLDECODE))
+    goto clean;
+
+  /* get the path from user input */
+  if(curl_url_get(uh, CURLUPART_PATH, &inputpath, CURLU_URLDECODE))
+    goto clean;
+  /* inputpath might be NULL or a valid pointer now */
+
+  /* set gateway parts in input URL */
+  if(curl_url_set(uh, CURLUPART_SCHEME, gwscheme, CURLU_URLENCODE) ||
+     curl_url_set(uh, CURLUPART_HOST, gwhost, CURLU_URLENCODE) ||
+     curl_url_set(uh, CURLUPART_PORT, gwport, CURLU_URLENCODE))
+    goto clean;
+
+  /* if the input path is a slash, clear it */
+  if(inputpath && (inputpath[0] == '/') && !inputpath[1])
+    *inputpath = '\0';
+
+  pathbuffer = curl_maprintf("%s%s%s/%s%s", gwpath,
+                             has_trailing_slash(gwpath) ? "" : "/",
+                             protocol, cid,
+                             inputpath ? inputpath : "");
+  if(!pathbuffer ||
+     curl_url_set(uh, CURLUPART_PATH, pathbuffer, CURLU_URLENCODE))
+    goto clean;
+
+  /* Free whatever it has now, rewriting is next */
+  curlx_safefree(*url);
+
+  if(curl_url_get(uh, CURLUPART_URL, &cloneurl, CURLU_URLENCODE)) {
+    goto clean;
+  }
+  /* we need to strdup the URL so that we can call curlx_free() on it later */
+  *url = curlx_strdup(cloneurl);
+  curl_free(cloneurl);
+  if(!*url)
+    goto clean;
+
+  result = CURLE_OK;
+
+clean:
+  curlx_free(gateway);
+  curl_free(gwhost);
+  curl_free(gwpath);
+  curl_free(gwquery);
+  curl_free(inputpath);
+  curl_free(gwscheme);
+  curl_free(gwport);
+  curl_free(cid);
+  curl_free(pathbuffer);
+  curl_url_cleanup(gatewayurl);
+  {
+    switch(result) {
+    case CURLE_URL_MALFORMAT:
+      helpf("malformed target URL");
+      break;
+    case CURLE_FILE_COULDNT_READ_FILE:
+      helpf("IPFS automatic gateway detection failed");
+      break;
+    case CURLE_BAD_FUNCTION_ARGUMENT:
+      helpf("--ipfs-gateway was given a malformed URL");
+      break;
+    default:
+      break;
+    }
+  }
+  return result;
+}
+#endif /* !CURL_DISABLE_IPFS */
diff --git a/third-party/curl/src/tool_ipfs.h b/third-party/curl/src/tool_ipfs.h
new file mode 100644
index 0000000000..caa959b607
--- /dev/null
+++ b/third-party/curl/src/tool_ipfs.h
@@ -0,0 +1,34 @@
+#ifndef HEADER_CURL_TOOL_IPFS_H
+#define HEADER_CURL_TOOL_IPFS_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "tool_setup.h"
+
+#ifndef CURL_DISABLE_IPFS
+#define MAX_GATEWAY_URL_LEN 10000
+CURLcode ipfs_url_rewrite(CURLU *uh, const char *protocol, char **url,
+                          struct OperationConfig *config);
+#endif
+
+#endif /* HEADER_CURL_TOOL_IPFS_H */
diff --git a/third-party/curl/src/tool_libinfo.c b/third-party/curl/src/tool_libinfo.c
index a2d30fc520..9aee234280 100644
--- a/third-party/curl/src/tool_libinfo.c
+++ b/third-party/curl/src/tool_libinfo.c
@@ -23,17 +23,9 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#include "strcase.h"
-
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
-
 #include "tool_libinfo.h"
 
-#include "memdebug.h" /* keep this as LAST include */
-
-/* global variable definitions, for libcurl run-time info */
+/* global variable definitions, for libcurl runtime info */
 
 static const char *no_protos = NULL;
 
@@ -51,6 +43,10 @@ const char *proto_rtsp = NULL;
 const char *proto_scp = NULL;
 const char *proto_sftp = NULL;
 const char *proto_tftp = NULL;
+#ifndef CURL_DISABLE_IPFS
+const char *proto_ipfs = "ipfs";
+const char *proto_ipns = "ipns";
+#endif
 
 static struct proto_name_tokenp {
   const char   *proto_name;
@@ -65,7 +61,7 @@ static struct proto_name_tokenp {
   { "scp",      &proto_scp   },
   { "sftp",     &proto_sftp  },
   { "tftp",     &proto_tftp  },
-  {  NULL,      NULL         }
+  { NULL,       NULL         }
 };
 
 bool feature_altsvc = FALSE;
@@ -81,6 +77,8 @@ bool feature_spnego = FALSE;
 bool feature_ssl = FALSE;
 bool feature_tls_srp = FALSE;
 bool feature_zstd = FALSE;
+bool feature_ech = FALSE;
+bool feature_ssls_export = FALSE;
 
 static struct feature_name_presentp {
   const char   *feature_name;
@@ -88,56 +86,57 @@ static struct feature_name_presentp {
   int           feature_bitmask;
 } const maybe_feature[] = {
   /* Keep alphabetically sorted. */
-  {"alt-svc",        &feature_altsvc,     CURL_VERSION_ALTSVC},
-  {"AsynchDNS",      NULL,                CURL_VERSION_ASYNCHDNS},
-  {"brotli",         &feature_brotli,     CURL_VERSION_BROTLI},
-  {"CharConv",       NULL,                CURL_VERSION_CONV},
-  {"Debug",          NULL,                CURL_VERSION_DEBUG},
-  {"gsasl",          NULL,                CURL_VERSION_GSASL},
-  {"GSS-API",        NULL,                CURL_VERSION_GSSAPI},
-  {"HSTS",           &feature_hsts,       CURL_VERSION_HSTS},
-  {"HTTP2",          &feature_http2,      CURL_VERSION_HTTP2},
-  {"HTTP3",          &feature_http3,      CURL_VERSION_HTTP3},
-  {"HTTPS-proxy",    &feature_httpsproxy, CURL_VERSION_HTTPS_PROXY},
-  {"IDN",            NULL,                CURL_VERSION_IDN},
-  {"IPv6",           NULL,                CURL_VERSION_IPV6},
-  {"Kerberos",       NULL,                CURL_VERSION_KERBEROS5},
-  {"Largefile",      NULL,                CURL_VERSION_LARGEFILE},
-  {"libz",           &feature_libz,       CURL_VERSION_LIBZ},
-  {"MultiSSL",       NULL,                CURL_VERSION_MULTI_SSL},
-  {"NTLM",           &feature_ntlm,       CURL_VERSION_NTLM},
-  {"NTLM_WB",        &feature_ntlm_wb,    CURL_VERSION_NTLM_WB},
-  {"PSL",            NULL,                CURL_VERSION_PSL},
-  {"SPNEGO",         &feature_spnego,     CURL_VERSION_SPNEGO},
-  {"SSL",            &feature_ssl,        CURL_VERSION_SSL},
-  {"SSPI",           NULL,                CURL_VERSION_SSPI},
-  {"threadsafe",     NULL,                CURL_VERSION_THREADSAFE},
-  {"TLS-SRP",        &feature_tls_srp,    CURL_VERSION_TLSAUTH_SRP},
-  {"TrackMemory",    NULL,                CURL_VERSION_CURLDEBUG},
-  {"Unicode",        NULL,                CURL_VERSION_UNICODE},
-  {"UnixSockets",    NULL,                CURL_VERSION_UNIX_SOCKETS},
-  {"zstd",           &feature_zstd,       CURL_VERSION_ZSTD},
-  {NULL,             NULL,                0}
+  { "alt-svc",        &feature_altsvc,      CURL_VERSION_ALTSVC },
+  { "AsynchDNS",      NULL,                 CURL_VERSION_ASYNCHDNS },
+  { "brotli",         &feature_brotli,      CURL_VERSION_BROTLI },
+  { "CharConv",       NULL,                 CURL_VERSION_CONV },
+  { "Debug",          NULL,                 CURL_VERSION_DEBUG },
+  { "ECH",            &feature_ech,         0 },
+  { "gsasl",          NULL,                 CURL_VERSION_GSASL },
+  { "GSS-API",        NULL,                 CURL_VERSION_GSSAPI },
+  { "HSTS",           &feature_hsts,        CURL_VERSION_HSTS },
+  { "HTTP2",          &feature_http2,       CURL_VERSION_HTTP2 },
+  { "HTTP3",          &feature_http3,       CURL_VERSION_HTTP3 },
+  { "HTTPS-proxy",    &feature_httpsproxy,  CURL_VERSION_HTTPS_PROXY },
+  { "IDN",            NULL,                 CURL_VERSION_IDN },
+  { "IPv6",           NULL,                 CURL_VERSION_IPV6 },
+  { "Kerberos",       NULL,                 CURL_VERSION_KERBEROS5 },
+  { "Largefile",      NULL,                 CURL_VERSION_LARGEFILE },
+  { "libz",           &feature_libz,        CURL_VERSION_LIBZ },
+  { "MultiSSL",       NULL,                 CURL_VERSION_MULTI_SSL },
+  { "NTLM",           &feature_ntlm,        CURL_VERSION_NTLM },
+  { "NTLM_WB",        &feature_ntlm_wb,     CURL_VERSION_NTLM_WB },
+  { "PSL",            NULL,                 CURL_VERSION_PSL },
+  { "SPNEGO",         &feature_spnego,      CURL_VERSION_SPNEGO },
+  { "SSL",            &feature_ssl,         CURL_VERSION_SSL },
+  { "SSPI",           NULL,                 CURL_VERSION_SSPI },
+  { "SSLS-EXPORT",    &feature_ssls_export, 0 },
+  { "threadsafe",     NULL,                 CURL_VERSION_THREADSAFE },
+  { "TLS-SRP",        &feature_tls_srp,     CURL_VERSION_TLSAUTH_SRP },
+  { "Unicode",        NULL,                 CURL_VERSION_UNICODE },
+  { "UnixSockets",    NULL,                 CURL_VERSION_UNIX_SOCKETS },
+  { "zstd",           &feature_zstd,        CURL_VERSION_ZSTD },
+  { NULL,             NULL,                 0 }
 };
 
-static const char *fnames[sizeof(maybe_feature) / sizeof(maybe_feature[0])];
+static const char *fnames[CURL_ARRAYSIZE(maybe_feature)];
 const char * const *feature_names = fnames;
+size_t feature_count;
 
 /*
- * libcurl_info_init: retrieves run-time information about libcurl,
- * setting a global pointer 'curlinfo' to libcurl's run-time info
+ * libcurl_info_init: retrieves runtime information about libcurl,
+ * setting a global pointer 'curlinfo' to libcurl's runtime info
  * struct, count protocols and flag those we are interested in.
  * Global pointer feature_names is set to the feature names array. If
  * the latter is not returned by curl_version_info(), it is built from
  * the returned features bit mask.
  */
-
 CURLcode get_libcurl_info(void)
 {
   CURLcode result = CURLE_OK;
-  const char *const *builtin;
+  const char * const *builtin;
 
-  /* Pointer to libcurl's run-time version information */
+  /* Pointer to libcurl's runtime version information */
   curlinfo = curl_version_info(CURLVERSION_NOW);
   if(!curlinfo)
     return CURLE_FAILED_INIT;
@@ -180,6 +179,7 @@ CURLcode get_libcurl_info(void)
           *p->feature_presentp = TRUE;
         break;
       }
+    ++feature_count;
   }
 
   return CURLE_OK;
@@ -192,7 +192,6 @@ CURLcode get_libcurl_info(void)
  * a given protocol and thus allows comparing pointers rather than strings.
  * In addition, the returned pointer is not deallocated until the program ends.
  */
-
 const char *proto_token(const char *proto)
 {
   const char * const *builtin;
diff --git a/third-party/curl/src/tool_libinfo.h b/third-party/curl/src/tool_libinfo.h
index 4937e4f3aa..e8c3517a9b 100644
--- a/third-party/curl/src/tool_libinfo.h
+++ b/third-party/curl/src/tool_libinfo.h
@@ -25,8 +25,7 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-/* global variable declarations, for libcurl run-time info */
-
+/* global variable declarations, for libcurl runtime info */
 
 extern curl_version_info_data *curlinfo;
 
@@ -34,6 +33,7 @@ extern const char * const *built_in_protos;
 extern size_t proto_count;
 
 extern const char * const *feature_names;
+extern size_t feature_count;
 
 extern const char *proto_file;
 extern const char *proto_ftp;
@@ -44,6 +44,8 @@ extern const char *proto_rtsp;
 extern const char *proto_scp;
 extern const char *proto_sftp;
 extern const char *proto_tftp;
+extern const char *proto_ipfs;
+extern const char *proto_ipns;
 
 extern bool feature_altsvc;
 extern bool feature_brotli;
@@ -58,6 +60,8 @@ extern bool feature_spnego;
 extern bool feature_ssl;
 extern bool feature_tls_srp;
 extern bool feature_zstd;
+extern bool feature_ech;
+extern bool feature_ssls_export;
 
 CURLcode get_libcurl_info(void);
 const char *proto_token(const char *proto);
diff --git a/third-party/curl/src/tool_listhelp.c b/third-party/curl/src/tool_listhelp.c
index aec93bfda6..c0b0af792f 100644
--- a/third-party/curl/src/tool_listhelp.c
+++ b/third-party/curl/src/tool_listhelp.c
@@ -22,787 +22,846 @@
  *
  ***************************************************************************/
 #include "tool_setup.h"
+
 #include "tool_help.h"
 
 /*
  * DO NOT edit tool_listhelp.c manually.
- * This source file is generated with the following command:
-
-  cd $srcroot/docs/cmdline-opts
-  ./gen.pl listhelp *.d > $srcroot/src/tool_listhelp.c
+ * This source file is generated with the following command in an autotools
+ * build:
+ *
+ * "make listhelp"
  */
 
 const struct helptxt helptext[] = {
-  {"    --abstract-unix-socket <path>",
-   "Connect via abstract Unix domain socket",
-   CURLHELP_CONNECTION},
-  {"    --alt-svc <file name>",
-   "Enable alt-svc with this cache file",
-   CURLHELP_HTTP},
-  {"    --anyauth",
-   "Pick any authentication method",
-   CURLHELP_HTTP | CURLHELP_PROXY | CURLHELP_AUTH},
-  {"-a, --append",
-   "Append to target file when uploading",
-   CURLHELP_FTP | CURLHELP_SFTP},
-  {"    --aws-sigv4 <provider1[:provider2[:region[:service]]]>",
-   "Use AWS V4 signature authentication",
-   CURLHELP_AUTH | CURLHELP_HTTP},
-  {"    --basic",
-   "Use HTTP Basic Authentication",
-   CURLHELP_AUTH},
-  {"    --ca-native",
-   "Use CA certificates from the native OS",
-   CURLHELP_TLS},
-  {"    --cacert <file>",
-   "CA certificate to verify peer against",
-   CURLHELP_TLS},
-  {"    --capath <dir>",
-   "CA directory to verify peer against",
-   CURLHELP_TLS},
-  {"-E, --cert <certificate[:password]>",
-   "Client certificate file and password",
-   CURLHELP_TLS},
-  {"    --cert-status",
-   "Verify the status of the server cert via OCSP-staple",
-   CURLHELP_TLS},
-  {"    --cert-type <type>",
-   "Certificate type (DER/PEM/ENG/P12)",
-   CURLHELP_TLS},
-  {"    --ciphers <list of ciphers>",
-   "SSL ciphers to use",
-   CURLHELP_TLS},
-  {"    --compressed",
-   "Request compressed response",
-   CURLHELP_HTTP},
-  {"    --compressed-ssh",
-   "Enable SSH compression",
-   CURLHELP_SCP | CURLHELP_SSH},
-  {"-K, --config <file>",
-   "Read config from a file",
-   CURLHELP_CURL},
-  {"    --connect-timeout <fractional seconds>",
-   "Maximum time allowed for connection",
-   CURLHELP_CONNECTION},
-  {"    --connect-to <HOST1:PORT1:HOST2:PORT2>",
-   "Connect to host",
-   CURLHELP_CONNECTION},
-  {"-C, --continue-at <offset>",
-   "Resumed transfer offset",
-   CURLHELP_CONNECTION},
-  {"-b, --cookie <data|filename>",
-   "Send cookies from string/file",
-   CURLHELP_HTTP},
-  {"-c, --cookie-jar <filename>",
-   "Write cookies to <filename> after operation",
-   CURLHELP_HTTP},
-  {"    --create-dirs",
-   "Create necessary local directory hierarchy",
-   CURLHELP_CURL},
-  {"    --create-file-mode <mode>",
-   "File mode for created files",
-   CURLHELP_SFTP | CURLHELP_SCP | CURLHELP_FILE | CURLHELP_UPLOAD},
-  {"    --crlf",
-   "Convert LF to CRLF in upload",
-   CURLHELP_FTP | CURLHELP_SMTP},
-  {"    --crlfile <file>",
-   "Use this CRL list",
-   CURLHELP_TLS},
-  {"    --curves <algorithm list>",
-   "(EC) TLS key exchange algorithm(s) to request",
-   CURLHELP_TLS},
-  {"-d, --data <data>",
-   "HTTP POST data",
-   CURLHELP_IMPORTANT | CURLHELP_HTTP | CURLHELP_POST | CURLHELP_UPLOAD},
-  {"    --data-ascii <data>",
-   "HTTP POST ASCII data",
-   CURLHELP_HTTP | CURLHELP_POST | CURLHELP_UPLOAD},
-  {"    --data-binary <data>",
-   "HTTP POST binary data",
-   CURLHELP_HTTP | CURLHELP_POST | CURLHELP_UPLOAD},
-  {"    --data-raw <data>",
-   "HTTP POST data, '@' allowed",
-   CURLHELP_HTTP | CURLHELP_POST | CURLHELP_UPLOAD},
-  {"    --data-urlencode <data>",
-   "HTTP POST data URL encoded",
-   CURLHELP_HTTP | CURLHELP_POST | CURLHELP_UPLOAD},
-  {"    --delegation <LEVEL>",
-   "GSS-API delegation permission",
-   CURLHELP_AUTH},
-  {"    --digest",
-   "Use HTTP Digest Authentication",
-   CURLHELP_PROXY | CURLHELP_AUTH | CURLHELP_HTTP},
-  {"-q, --disable",
-   "Disable .curlrc",
-   CURLHELP_CURL},
-  {"    --disable-eprt",
-   "Inhibit using EPRT or LPRT",
-   CURLHELP_FTP},
-  {"    --disable-epsv",
-   "Inhibit using EPSV",
-   CURLHELP_FTP},
-  {"    --disallow-username-in-url",
-   "Disallow username in URL",
-   CURLHELP_CURL | CURLHELP_HTTP},
-  {"    --dns-interface <interface>",
-   "Interface to use for DNS requests",
-   CURLHELP_DNS},
-  {"    --dns-ipv4-addr <address>",
-   "IPv4 address to use for DNS requests",
-   CURLHELP_DNS},
-  {"    --dns-ipv6-addr <address>",
-   "IPv6 address to use for DNS requests",
-   CURLHELP_DNS},
-  {"    --dns-servers <addresses>",
-   "DNS server addrs to use",
-   CURLHELP_DNS},
-  {"    --doh-cert-status",
-   "Verify the status of the DoH server cert via OCSP-staple",
-   CURLHELP_DNS | CURLHELP_TLS},
-  {"    --doh-insecure",
-   "Allow insecure DoH server connections",
-   CURLHELP_DNS | CURLHELP_TLS},
-  {"    --doh-url <URL>",
-   "Resolve host names over DoH",
-   CURLHELP_DNS},
-  {"-D, --dump-header <filename>",
-   "Write the received headers to <filename>",
-   CURLHELP_HTTP | CURLHELP_FTP},
-  {"    --egd-file <file>",
-   "EGD socket path for random data",
-   CURLHELP_TLS},
-  {"    --engine <name>",
-   "Crypto engine to use",
-   CURLHELP_TLS},
-  {"    --etag-compare <file>",
-   "Pass an ETag from a file as a custom header",
-   CURLHELP_HTTP},
-  {"    --etag-save <file>",
-   "Parse ETag from a request and save it to a file",
-   CURLHELP_HTTP},
-  {"    --expect100-timeout <seconds>",
-   "How long to wait for 100-continue",
-   CURLHELP_HTTP},
-  {"-f, --fail",
-   "Fail fast with no output on HTTP errors",
-   CURLHELP_IMPORTANT | CURLHELP_HTTP},
-  {"    --fail-early",
-   "Fail on first transfer error, do not continue",
-   CURLHELP_CURL},
-  {"    --fail-with-body",
-   "Fail on HTTP errors but save the body",
-   CURLHELP_HTTP | CURLHELP_OUTPUT},
-  {"    --false-start",
-   "Enable TLS False Start",
-   CURLHELP_TLS},
-  {"-F, --form <name=content>",
-   "Specify multipart MIME data",
-   CURLHELP_HTTP | CURLHELP_UPLOAD},
-  {"    --form-escape",
-   "Escape multipart form field/file names using backslash",
-   CURLHELP_HTTP | CURLHELP_UPLOAD},
-  {"    --form-string <name=string>",
-   "Specify multipart MIME data",
-   CURLHELP_HTTP | CURLHELP_UPLOAD},
-  {"    --ftp-account <data>",
-   "Account data string",
-   CURLHELP_FTP | CURLHELP_AUTH},
-  {"    --ftp-alternative-to-user <command>",
-   "String to replace USER [name]",
-   CURLHELP_FTP},
-  {"    --ftp-create-dirs",
-   "Create the remote dirs if not present",
-   CURLHELP_FTP | CURLHELP_SFTP | CURLHELP_CURL},
-  {"    --ftp-method <method>",
-   "Control CWD usage",
-   CURLHELP_FTP},
-  {"    --ftp-pasv",
-   "Use PASV/EPSV instead of PORT",
-   CURLHELP_FTP},
-  {"-P, --ftp-port <address>",
-   "Use PORT instead of PASV",
-   CURLHELP_FTP},
-  {"    --ftp-pret",
-   "Send PRET before PASV",
-   CURLHELP_FTP},
-  {"    --ftp-skip-pasv-ip",
-   "Skip the IP address for PASV",
-   CURLHELP_FTP},
-  {"    --ftp-ssl-ccc",
-   "Send CCC after authenticating",
-   CURLHELP_FTP | CURLHELP_TLS},
-  {"    --ftp-ssl-ccc-mode <active/passive>",
-   "Set CCC mode",
-   CURLHELP_FTP | CURLHELP_TLS},
-  {"    --ftp-ssl-control",
-   "Require SSL/TLS for FTP login, clear for transfer",
-   CURLHELP_FTP | CURLHELP_TLS},
-  {"-G, --get",
-   "Put the post data in the URL and use GET",
-   CURLHELP_HTTP | CURLHELP_UPLOAD},
-  {"-g, --globoff",
-   "Disable URL sequences and ranges using {} and []",
-   CURLHELP_CURL},
-  {"    --happy-eyeballs-timeout-ms <milliseconds>",
-   "Time for IPv6 before trying IPv4",
-   CURLHELP_CONNECTION},
-  {"    --haproxy-clientip",
-   "Sets client IP in HAProxy PROXY protocol v1 header",
-   CURLHELP_HTTP | CURLHELP_PROXY},
-  {"    --haproxy-protocol",
-   "Send HAProxy PROXY protocol v1 header",
-   CURLHELP_HTTP | CURLHELP_PROXY},
-  {"-I, --head",
-   "Show document info only",
-   CURLHELP_HTTP | CURLHELP_FTP | CURLHELP_FILE},
-  {"-H, --header <header/@file>",
-   "Pass custom header(s) to server",
-   CURLHELP_HTTP | CURLHELP_IMAP | CURLHELP_SMTP},
-  {"-h, --help <category>",
-   "Get help for commands",
-   CURLHELP_IMPORTANT | CURLHELP_CURL},
-  {"    --hostpubmd5 <md5>",
-   "Acceptable MD5 hash of the host public key",
-   CURLHELP_SFTP | CURLHELP_SCP},
-  {"    --hostpubsha256 <sha256>",
-   "Acceptable SHA256 hash of the host public key",
-   CURLHELP_SFTP | CURLHELP_SCP},
-  {"    --hsts <file name>",
-   "Enable HSTS with this cache file",
-   CURLHELP_HTTP},
-  {"    --http0.9",
-   "Allow HTTP 0.9 responses",
-   CURLHELP_HTTP},
-  {"-0, --http1.0",
-   "Use HTTP 1.0",
-   CURLHELP_HTTP},
-  {"    --http1.1",
-   "Use HTTP 1.1",
-   CURLHELP_HTTP},
-  {"    --http2",
-   "Use HTTP/2",
-   CURLHELP_HTTP},
-  {"    --http2-prior-knowledge",
-   "Use HTTP 2 without HTTP/1.1 Upgrade",
-   CURLHELP_HTTP},
-  {"    --http3",
-   "Use HTTP v3",
-   CURLHELP_HTTP},
-  {"    --http3-only",
-   "Use HTTP v3 only",
-   CURLHELP_HTTP},
-  {"    --ignore-content-length",
-   "Ignore the size of the remote resource",
-   CURLHELP_HTTP | CURLHELP_FTP},
-  {"-i, --include",
-   "Include protocol response headers in the output",
-   CURLHELP_IMPORTANT | CURLHELP_VERBOSE},
-  {"-k, --insecure",
-   "Allow insecure server connections",
-   CURLHELP_TLS | CURLHELP_SFTP | CURLHELP_SCP},
-  {"    --interface <name>",
-   "Use network INTERFACE (or address)",
-   CURLHELP_CONNECTION},
-  {"-4, --ipv4",
-   "Resolve names to IPv4 addresses",
-   CURLHELP_CONNECTION | CURLHELP_DNS},
-  {"-6, --ipv6",
-   "Resolve names to IPv6 addresses",
-   CURLHELP_CONNECTION | CURLHELP_DNS},
-  {"    --json <data>",
-   "HTTP POST JSON",
-   CURLHELP_HTTP | CURLHELP_POST | CURLHELP_UPLOAD},
-  {"-j, --junk-session-cookies",
-   "Ignore session cookies read from file",
-   CURLHELP_HTTP},
-  {"    --keepalive-time <seconds>",
-   "Interval time for keepalive probes",
-   CURLHELP_CONNECTION},
-  {"    --key <key>",
-   "Private key file name",
-   CURLHELP_TLS | CURLHELP_SSH},
-  {"    --key-type <type>",
-   "Private key file type (DER/PEM/ENG)",
-   CURLHELP_TLS},
-  {"    --krb <level>",
-   "Enable Kerberos with security <level>",
-   CURLHELP_FTP},
-  {"    --libcurl <file>",
-   "Dump libcurl equivalent code of this command line",
-   CURLHELP_CURL},
-  {"    --limit-rate <speed>",
-   "Limit transfer speed to RATE",
-   CURLHELP_CONNECTION},
-  {"-l, --list-only",
-   "List only mode",
-   CURLHELP_FTP | CURLHELP_POP3},
-  {"    --local-port <num/range>",
-   "Force use of RANGE for local port numbers",
-   CURLHELP_CONNECTION},
-  {"-L, --location",
-   "Follow redirects",
-   CURLHELP_HTTP},
-  {"    --location-trusted",
-   "Like --location, and send auth to other hosts",
-   CURLHELP_HTTP | CURLHELP_AUTH},
-  {"    --login-options <options>",
-   "Server login options",
-   CURLHELP_IMAP | CURLHELP_POP3 | CURLHELP_SMTP | CURLHELP_AUTH},
-  {"    --mail-auth <address>",
-   "Originator address of the original email",
-   CURLHELP_SMTP},
-  {"    --mail-from <address>",
-   "Mail from this address",
-   CURLHELP_SMTP},
-  {"    --mail-rcpt <address>",
-   "Mail to this address",
-   CURLHELP_SMTP},
-  {"    --mail-rcpt-allowfails",
-   "Allow RCPT TO command to fail for some recipients",
-   CURLHELP_SMTP},
-  {"-M, --manual",
-   "Display the full manual",
-   CURLHELP_CURL},
-  {"    --max-filesize <bytes>",
-   "Maximum file size to download",
-   CURLHELP_CONNECTION},
-  {"    --max-redirs <num>",
-   "Maximum number of redirects allowed",
-   CURLHELP_HTTP},
-  {"-m, --max-time <fractional seconds>",
-   "Maximum time allowed for transfer",
-   CURLHELP_CONNECTION},
-  {"    --metalink",
-   "Process given URLs as metalink XML file",
-   CURLHELP_MISC},
-  {"    --negotiate",
-   "Use HTTP Negotiate (SPNEGO) authentication",
-   CURLHELP_AUTH | CURLHELP_HTTP},
-  {"-n, --netrc",
-   "Must read .netrc for user name and password",
-   CURLHELP_CURL},
-  {"    --netrc-file <filename>",
-   "Specify FILE for netrc",
-   CURLHELP_CURL},
-  {"    --netrc-optional",
-   "Use either .netrc or URL",
-   CURLHELP_CURL},
-  {"-:, --next",
-   "Make next URL use its separate set of options",
-   CURLHELP_CURL},
-  {"    --no-alpn",
-   "Disable the ALPN TLS extension",
-   CURLHELP_TLS | CURLHELP_HTTP},
-  {"-N, --no-buffer",
-   "Disable buffering of the output stream",
-   CURLHELP_CURL},
-  {"    --no-clobber",
-   "Do not overwrite files that already exist",
-   CURLHELP_CURL | CURLHELP_OUTPUT},
-  {"    --no-keepalive",
-   "Disable TCP keepalive on the connection",
-   CURLHELP_CONNECTION},
-  {"    --no-npn",
-   "Disable the NPN TLS extension",
-   CURLHELP_TLS | CURLHELP_HTTP},
-  {"    --no-progress-meter",
-   "Do not show the progress meter",
-   CURLHELP_VERBOSE},
-  {"    --no-sessionid",
-   "Disable SSL session-ID reusing",
-   CURLHELP_TLS},
-  {"    --noproxy <no-proxy-list>",
-   "List of hosts which do not use proxy",
-   CURLHELP_PROXY},
-  {"    --ntlm",
-   "Use HTTP NTLM authentication",
-   CURLHELP_AUTH | CURLHELP_HTTP},
-  {"    --ntlm-wb",
-   "Use HTTP NTLM authentication with winbind",
-   CURLHELP_AUTH | CURLHELP_HTTP},
-  {"    --oauth2-bearer <token>",
-   "OAuth 2 Bearer Token",
-   CURLHELP_AUTH},
-  {"-o, --output <file>",
-   "Write to file instead of stdout",
-   CURLHELP_IMPORTANT | CURLHELP_CURL},
-  {"    --output-dir <dir>",
-   "Directory to save files in",
-   CURLHELP_CURL},
-  {"-Z, --parallel",
-   "Perform transfers in parallel",
-   CURLHELP_CONNECTION | CURLHELP_CURL},
-  {"    --parallel-immediate",
-   "Do not wait for multiplexing (with --parallel)",
-   CURLHELP_CONNECTION | CURLHELP_CURL},
-  {"    --parallel-max <num>",
-   "Maximum concurrency for parallel transfers",
-   CURLHELP_CONNECTION | CURLHELP_CURL},
-  {"    --pass <phrase>",
-   "Pass phrase for the private key",
-   CURLHELP_SSH | CURLHELP_TLS | CURLHELP_AUTH},
-  {"    --path-as-is",
-   "Do not squash .. sequences in URL path",
-   CURLHELP_CURL},
-  {"    --pinnedpubkey <hashes>",
-   "FILE/HASHES Public key to verify peer against",
-   CURLHELP_TLS},
-  {"    --post301",
-   "Do not switch to GET after following a 301",
-   CURLHELP_HTTP | CURLHELP_POST},
-  {"    --post302",
-   "Do not switch to GET after following a 302",
-   CURLHELP_HTTP | CURLHELP_POST},
-  {"    --post303",
-   "Do not switch to GET after following a 303",
-   CURLHELP_HTTP | CURLHELP_POST},
-  {"    --preproxy [protocol://]host[:port]",
-   "Use this proxy first",
-   CURLHELP_PROXY},
-  {"-#, --progress-bar",
-   "Display transfer progress as a bar",
-   CURLHELP_VERBOSE},
-  {"    --proto <protocols>",
-   "Enable/disable PROTOCOLS",
-   CURLHELP_CONNECTION | CURLHELP_CURL},
-  {"    --proto-default <protocol>",
-   "Use PROTOCOL for any URL missing a scheme",
-   CURLHELP_CONNECTION | CURLHELP_CURL},
-  {"    --proto-redir <protocols>",
-   "Enable/disable PROTOCOLS on redirect",
-   CURLHELP_CONNECTION | CURLHELP_CURL},
-  {"-x, --proxy [protocol://]host[:port]",
-   "Use this proxy",
-   CURLHELP_PROXY},
-  {"    --proxy-anyauth",
-   "Pick any proxy authentication method",
-   CURLHELP_PROXY | CURLHELP_AUTH},
-  {"    --proxy-basic",
-   "Use Basic authentication on the proxy",
-   CURLHELP_PROXY | CURLHELP_AUTH},
-  {"    --proxy-ca-native",
-   "Use CA certificates from the native OS for proxy",
-   CURLHELP_TLS},
-  {"    --proxy-cacert <file>",
-   "CA certificate to verify peer against for proxy",
-   CURLHELP_PROXY | CURLHELP_TLS},
-  {"    --proxy-capath <dir>",
-   "CA directory to verify peer against for proxy",
-   CURLHELP_PROXY | CURLHELP_TLS},
-  {"    --proxy-cert <cert[:passwd]>",
-   "Set client certificate for proxy",
-   CURLHELP_PROXY | CURLHELP_TLS},
-  {"    --proxy-cert-type <type>",
-   "Client certificate type for HTTPS proxy",
-   CURLHELP_PROXY | CURLHELP_TLS},
-  {"    --proxy-ciphers <list>",
-   "SSL ciphers to use for proxy",
-   CURLHELP_PROXY | CURLHELP_TLS},
-  {"    --proxy-crlfile <file>",
-   "Set a CRL list for proxy",
-   CURLHELP_PROXY | CURLHELP_TLS},
-  {"    --proxy-digest",
-   "Use Digest authentication on the proxy",
-   CURLHELP_PROXY | CURLHELP_TLS},
-  {"    --proxy-header <header/@file>",
-   "Pass custom header(s) to proxy",
-   CURLHELP_PROXY},
-  {"    --proxy-http2",
-   "Use HTTP/2 with HTTPS proxy",
-   CURLHELP_HTTP | CURLHELP_PROXY},
-  {"    --proxy-insecure",
-   "Do HTTPS proxy connections without verifying the proxy",
-   CURLHELP_PROXY | CURLHELP_TLS},
-  {"    --proxy-key <key>",
-   "Private key for HTTPS proxy",
-   CURLHELP_PROXY | CURLHELP_TLS},
-  {"    --proxy-key-type <type>",
-   "Private key file type for proxy",
-   CURLHELP_PROXY | CURLHELP_TLS},
-  {"    --proxy-negotiate",
-   "Use HTTP Negotiate (SPNEGO) authentication on the proxy",
-   CURLHELP_PROXY | CURLHELP_AUTH},
-  {"    --proxy-ntlm",
-   "Use NTLM authentication on the proxy",
-   CURLHELP_PROXY | CURLHELP_AUTH},
-  {"    --proxy-pass <phrase>",
-   "Pass phrase for the private key for HTTPS proxy",
-   CURLHELP_PROXY | CURLHELP_TLS | CURLHELP_AUTH},
-  {"    --proxy-pinnedpubkey <hashes>",
-   "FILE/HASHES public key to verify proxy with",
-   CURLHELP_PROXY | CURLHELP_TLS},
-  {"    --proxy-service-name <name>",
-   "SPNEGO proxy service name",
-   CURLHELP_PROXY | CURLHELP_TLS},
-  {"    --proxy-ssl-allow-beast",
-   "Allow security flaw for interop for HTTPS proxy",
-   CURLHELP_PROXY | CURLHELP_TLS},
-  {"    --proxy-ssl-auto-client-cert",
-   "Use auto client certificate for proxy (Schannel)",
-   CURLHELP_PROXY | CURLHELP_TLS},
-  {"    --proxy-tls13-ciphers <ciphersuite list>",
-   "TLS 1.3 proxy cipher suites",
-   CURLHELP_PROXY | CURLHELP_TLS},
-  {"    --proxy-tlsauthtype <type>",
-   "TLS authentication type for HTTPS proxy",
-   CURLHELP_PROXY | CURLHELP_TLS | CURLHELP_AUTH},
-  {"    --proxy-tlspassword <string>",
-   "TLS password for HTTPS proxy",
-   CURLHELP_PROXY | CURLHELP_TLS | CURLHELP_AUTH},
-  {"    --proxy-tlsuser <name>",
-   "TLS username for HTTPS proxy",
-   CURLHELP_PROXY | CURLHELP_TLS | CURLHELP_AUTH},
-  {"    --proxy-tlsv1",
-   "Use TLSv1 for HTTPS proxy",
-   CURLHELP_PROXY | CURLHELP_TLS | CURLHELP_AUTH},
-  {"-U, --proxy-user <user:password>",
-   "Proxy user and password",
-   CURLHELP_PROXY | CURLHELP_AUTH},
-  {"    --proxy1.0 <host[:port]>",
-   "Use HTTP/1.0 proxy on given port",
-   CURLHELP_PROXY},
-  {"-p, --proxytunnel",
-   "Operate through an HTTP proxy tunnel (using CONNECT)",
-   CURLHELP_PROXY},
-  {"    --pubkey <key>",
-   "SSH Public key file name",
-   CURLHELP_SFTP | CURLHELP_SCP | CURLHELP_AUTH},
-  {"-Q, --quote <command>",
-   "Send command(s) to server before transfer",
-   CURLHELP_FTP | CURLHELP_SFTP},
-  {"    --random-file <file>",
-   "File for reading random data from",
-   CURLHELP_MISC},
-  {"-r, --range <range>",
-   "Retrieve only the bytes within RANGE",
-   CURLHELP_HTTP | CURLHELP_FTP | CURLHELP_SFTP | CURLHELP_FILE},
-  {"    --rate <max request rate>",
-   "Request rate for serial transfers",
-   CURLHELP_CONNECTION},
-  {"    --raw",
-   "Do HTTP \"raw\"; no transfer decoding",
-   CURLHELP_HTTP},
-  {"-e, --referer <URL>",
-   "Referrer URL",
-   CURLHELP_HTTP},
-  {"-J, --remote-header-name",
-   "Use the header-provided filename",
-   CURLHELP_OUTPUT},
-  {"-O, --remote-name",
-   "Write output to a file named as the remote file",
-   CURLHELP_IMPORTANT | CURLHELP_OUTPUT},
-  {"    --remote-name-all",
-   "Use the remote file name for all URLs",
-   CURLHELP_OUTPUT},
-  {"-R, --remote-time",
-   "Set the remote file's time on the local output",
-   CURLHELP_OUTPUT},
-  {"    --remove-on-error",
-   "Remove output file on errors",
-   CURLHELP_CURL},
-  {"-X, --request <method>",
-   "Specify request method to use",
-   CURLHELP_CONNECTION},
-  {"    --request-target <path>",
-   "Specify the target for this request",
-   CURLHELP_HTTP},
-  {"    --resolve <[+]host:port:addr[,addr]...>",
-   "Resolve the host+port to this address",
-   CURLHELP_CONNECTION | CURLHELP_DNS},
-  {"    --retry <num>",
-   "Retry request if transient problems occur",
-   CURLHELP_CURL},
-  {"    --retry-all-errors",
-   "Retry all errors (use with --retry)",
-   CURLHELP_CURL},
-  {"    --retry-connrefused",
-   "Retry on connection refused (use with --retry)",
-   CURLHELP_CURL},
-  {"    --retry-delay <seconds>",
-   "Wait time between retries",
-   CURLHELP_CURL},
-  {"    --retry-max-time <seconds>",
-   "Retry only within this period",
-   CURLHELP_CURL},
-  {"    --sasl-authzid <identity>",
-   "Identity for SASL PLAIN authentication",
-   CURLHELP_AUTH},
-  {"    --sasl-ir",
-   "Enable initial response in SASL authentication",
-   CURLHELP_AUTH},
-  {"    --service-name <name>",
-   "SPNEGO service name",
-   CURLHELP_MISC},
-  {"-S, --show-error",
-   "Show error even when -s is used",
-   CURLHELP_CURL},
-  {"-s, --silent",
-   "Silent mode",
-   CURLHELP_IMPORTANT | CURLHELP_VERBOSE},
-  {"    --socks4 <host[:port]>",
-   "SOCKS4 proxy on given host + port",
-   CURLHELP_PROXY},
-  {"    --socks4a <host[:port]>",
-   "SOCKS4a proxy on given host + port",
-   CURLHELP_PROXY},
-  {"    --socks5 <host[:port]>",
-   "SOCKS5 proxy on given host + port",
-   CURLHELP_PROXY},
-  {"    --socks5-basic",
-   "Enable username/password auth for SOCKS5 proxies",
-   CURLHELP_PROXY | CURLHELP_AUTH},
-  {"    --socks5-gssapi",
-   "Enable GSS-API auth for SOCKS5 proxies",
-   CURLHELP_PROXY | CURLHELP_AUTH},
-  {"    --socks5-gssapi-nec",
-   "Compatibility with NEC SOCKS5 server",
-   CURLHELP_PROXY | CURLHELP_AUTH},
-  {"    --socks5-gssapi-service <name>",
-   "SOCKS5 proxy service name for GSS-API",
-   CURLHELP_PROXY | CURLHELP_AUTH},
-  {"    --socks5-hostname <host[:port]>",
-   "SOCKS5 proxy, pass host name to proxy",
-   CURLHELP_PROXY},
-  {"-Y, --speed-limit <speed>",
-   "Stop transfers slower than this",
-   CURLHELP_CONNECTION},
-  {"-y, --speed-time <seconds>",
-   "Trigger 'speed-limit' abort after this time",
-   CURLHELP_CONNECTION},
-  {"    --ssl",
-   "Try SSL/TLS",
-   CURLHELP_TLS},
-  {"    --ssl-allow-beast",
-   "Allow security flaw to improve interop",
-   CURLHELP_TLS},
-  {"    --ssl-auto-client-cert",
-   "Use auto client certificate (Schannel)",
-   CURLHELP_TLS},
-  {"    --ssl-no-revoke",
-   "Disable cert revocation checks (Schannel)",
-   CURLHELP_TLS},
-  {"    --ssl-reqd",
-   "Require SSL/TLS",
-   CURLHELP_TLS},
-  {"    --ssl-revoke-best-effort",
-   "Ignore missing/offline cert CRL dist points (Schannel)",
-   CURLHELP_TLS},
-  {"-2, --sslv2",
-   "Use SSLv2",
-   CURLHELP_TLS},
-  {"-3, --sslv3",
-   "Use SSLv3",
-   CURLHELP_TLS},
-  {"    --stderr <file>",
-   "Where to redirect stderr",
-   CURLHELP_VERBOSE},
-  {"    --styled-output",
-   "Enable styled output for HTTP headers",
-   CURLHELP_VERBOSE},
-  {"    --suppress-connect-headers",
-   "Suppress proxy CONNECT response headers",
-   CURLHELP_PROXY},
-  {"    --tcp-fastopen",
-   "Use TCP Fast Open",
-   CURLHELP_CONNECTION},
-  {"    --tcp-nodelay",
-   "Use the TCP_NODELAY option",
-   CURLHELP_CONNECTION},
-  {"-t, --telnet-option <opt=val>",
-   "Set telnet option",
-   CURLHELP_TELNET},
-  {"    --tftp-blksize <value>",
-   "Set TFTP BLKSIZE option",
-   CURLHELP_TFTP},
-  {"    --tftp-no-options",
-   "Do not send any TFTP options",
-   CURLHELP_TFTP},
-  {"-z, --time-cond <time>",
-   "Transfer based on a time condition",
-   CURLHELP_HTTP | CURLHELP_FTP},
-  {"    --tls-max <VERSION>",
-   "Set maximum allowed TLS version",
-   CURLHELP_TLS},
-  {"    --tls13-ciphers <ciphersuite list>",
-   "TLS 1.3 cipher suites to use",
-   CURLHELP_TLS},
-  {"    --tlsauthtype <type>",
-   "TLS authentication type",
-   CURLHELP_TLS | CURLHELP_AUTH},
-  {"    --tlspassword <string>",
-   "TLS password",
-   CURLHELP_TLS | CURLHELP_AUTH},
-  {"    --tlsuser <name>",
-   "TLS user name",
-   CURLHELP_TLS | CURLHELP_AUTH},
-  {"-1, --tlsv1",
-   "Use TLSv1.0 or greater",
-   CURLHELP_TLS},
-  {"    --tlsv1.0",
-   "Use TLSv1.0 or greater",
-   CURLHELP_TLS},
-  {"    --tlsv1.1",
-   "Use TLSv1.1 or greater",
-   CURLHELP_TLS},
-  {"    --tlsv1.2",
-   "Use TLSv1.2 or greater",
-   CURLHELP_TLS},
-  {"    --tlsv1.3",
-   "Use TLSv1.3 or greater",
-   CURLHELP_TLS},
-  {"    --tr-encoding",
-   "Request compressed transfer encoding",
-   CURLHELP_HTTP},
-  {"    --trace <file>",
-   "Write a debug trace to FILE",
-   CURLHELP_VERBOSE},
-  {"    --trace-ascii <file>",
-   "Like --trace, but without hex output",
-   CURLHELP_VERBOSE},
-  {"    --trace-config",
-   "Configure which details to log in trace/verbose output",
-   CURLHELP_VERBOSE},
-  {"    --trace-ids",
-   "Add transfer and connection identifiers to trace/verbose output",
-   CURLHELP_VERBOSE},
-  {"    --trace-time",
-   "Add time stamps to trace/verbose output",
-   CURLHELP_VERBOSE},
-  {"    --unix-socket <path>",
-   "Connect through this Unix domain socket",
-   CURLHELP_CONNECTION},
-  {"-T, --upload-file <file>",
-   "Transfer local FILE to destination",
-   CURLHELP_IMPORTANT | CURLHELP_UPLOAD},
-  {"    --url <url>",
-   "URL to work with",
-   CURLHELP_CURL},
-  {"    --url-query <data>",
-   "Add a URL query part",
-   CURLHELP_HTTP | CURLHELP_POST | CURLHELP_UPLOAD},
-  {"-B, --use-ascii",
-   "Use ASCII/text transfer",
-   CURLHELP_MISC},
-  {"-u, --user <user:password>",
-   "Server user and password",
-   CURLHELP_IMPORTANT | CURLHELP_AUTH},
-  {"-A, --user-agent <name>",
-   "Send User-Agent <name> to server",
-   CURLHELP_IMPORTANT | CURLHELP_HTTP},
-  {"    --variable <name=text/@file>",
-   "Set variable",
-   CURLHELP_CURL},
-  {"-v, --verbose",
-   "Make the operation more talkative",
-   CURLHELP_IMPORTANT | CURLHELP_VERBOSE},
-  {"-V, --version",
-   "Show version number and quit",
-   CURLHELP_IMPORTANT | CURLHELP_CURL},
-  {"-w, --write-out <format>",
-   "Use output FORMAT after completion",
-   CURLHELP_VERBOSE},
-  {"    --xattr",
-   "Store metadata in extended file attributes",
-   CURLHELP_MISC},
-  { NULL, NULL, CURLHELP_HIDDEN }
+  { "    --abstract-unix-socket <path>",
+    "Connect via abstract Unix domain socket",
+    CURLHELP_CONNECTION },
+  { "    --alt-svc <filename>",
+    "Enable alt-svc with this cache file",
+    CURLHELP_HTTP },
+  { "    --anyauth",
+    "Pick any authentication method",
+    CURLHELP_HTTP | CURLHELP_PROXY | CURLHELP_AUTH },
+  { "-a, --append",
+    "Append to target file when uploading",
+    CURLHELP_FTP | CURLHELP_SFTP },
+  { "    --aws-sigv4 <provider1[:prvdr2[:reg[:srv]]]>",
+    "AWS V4 signature auth",
+    CURLHELP_AUTH | CURLHELP_HTTP },
+  { "    --basic",
+    "HTTP Basic Authentication",
+    CURLHELP_AUTH },
+  { "    --ca-native",
+    "Load CA certs from the OS",
+    CURLHELP_TLS },
+  { "    --cacert <file>",
+    "CA certificate to verify peer against",
+    CURLHELP_TLS },
+  { "    --capath <dir>",
+    "CA directory to verify peer against",
+    CURLHELP_TLS },
+  { "-E, --cert <certificate[:password]>",
+    "Client certificate file and password",
+    CURLHELP_TLS },
+  { "    --cert-status",
+    "Verify server cert status OCSP-staple",
+    CURLHELP_TLS },
+  { "    --cert-type <type>",
+    "Certificate type (DER/PEM/ENG/PROV/P12)",
+    CURLHELP_TLS },
+  { "    --ciphers <list>",
+    "TLS 1.2 (1.1, 1.0) ciphers to use",
+    CURLHELP_TLS },
+  { "    --compressed",
+    "Request compressed response",
+    CURLHELP_HTTP },
+  { "    --compressed-ssh",
+    "Enable SSH compression",
+    CURLHELP_SCP | CURLHELP_SSH },
+  { "-K, --config <file>",
+    "Read config from a file",
+    CURLHELP_CURL },
+  { "    --connect-timeout <seconds>",
+    "Maximum time allowed to connect",
+    CURLHELP_CONNECTION | CURLHELP_TIMEOUT },
+  { "    --connect-to <HOST1:PORT1:HOST2:PORT2>",
+    "Connect to host2 instead of host1",
+    CURLHELP_CONNECTION | CURLHELP_DNS },
+  { "-C, --continue-at <offset>",
+    "Resumed transfer offset",
+    CURLHELP_CONNECTION },
+  { "-b, --cookie <data|filename>",
+    "Send cookies from string/load from file",
+    CURLHELP_HTTP },
+  { "-c, --cookie-jar <filename>",
+    "Save cookies to <filename> after operation",
+    CURLHELP_HTTP },
+  { "    --create-dirs",
+    "Create necessary local directory hierarchy",
+    CURLHELP_OUTPUT },
+  { "    --create-file-mode <mode>",
+    "File mode for created files",
+    CURLHELP_SFTP | CURLHELP_SCP | CURLHELP_FILE | CURLHELP_UPLOAD },
+  { "    --crlf",
+    "Convert LF to CRLF in upload",
+    CURLHELP_FTP | CURLHELP_SMTP },
+  { "    --crlfile <file>",
+    "Certificate Revocation list",
+    CURLHELP_TLS },
+  { "    --curves <list>",
+    "(EC) TLS key exchange algorithms to request",
+    CURLHELP_TLS },
+  { "-d, --data <data>",
+    "HTTP POST data",
+    CURLHELP_IMPORTANT | CURLHELP_HTTP | CURLHELP_POST | CURLHELP_UPLOAD },
+  { "    --data-ascii <data>",
+    "HTTP POST ASCII data",
+    CURLHELP_HTTP | CURLHELP_POST | CURLHELP_UPLOAD },
+  { "    --data-binary <data>",
+    "HTTP POST binary data",
+    CURLHELP_HTTP | CURLHELP_POST | CURLHELP_UPLOAD },
+  { "    --data-raw <data>",
+    "HTTP POST data, '@' allowed",
+    CURLHELP_HTTP | CURLHELP_POST | CURLHELP_UPLOAD },
+  { "    --data-urlencode <data>",
+    "HTTP POST data URL encoded",
+    CURLHELP_HTTP | CURLHELP_POST | CURLHELP_UPLOAD },
+  { "    --delegation <LEVEL>",
+    "GSS-API delegation permission",
+    CURLHELP_AUTH },
+  { "    --digest",
+    "HTTP Digest Authentication",
+    CURLHELP_PROXY | CURLHELP_AUTH | CURLHELP_HTTP },
+  { "-q, --disable",
+    "Disable .curlrc",
+    CURLHELP_CURL },
+  { "    --disable-eprt",
+    "Inhibit using EPRT or LPRT",
+    CURLHELP_FTP },
+  { "    --disable-epsv",
+    "Inhibit using EPSV",
+    CURLHELP_FTP },
+  { "    --disallow-username-in-url",
+    "Disallow username in URL",
+    CURLHELP_CURL },
+  { "    --dns-interface <interface>",
+    "Interface to use for DNS requests",
+    CURLHELP_DNS },
+  { "    --dns-ipv4-addr <address>",
+    "IPv4 address to use for DNS requests",
+    CURLHELP_DNS },
+  { "    --dns-ipv6-addr <address>",
+    "IPv6 address to use for DNS requests",
+    CURLHELP_DNS },
+  { "    --dns-servers <addresses>",
+    "DNS server addrs to use",
+    CURLHELP_DNS },
+  { "    --doh-cert-status",
+    "Verify DoH server cert status OCSP-staple",
+    CURLHELP_DNS | CURLHELP_TLS },
+  { "    --doh-insecure",
+    "Allow insecure DoH server connections",
+    CURLHELP_DNS | CURLHELP_TLS },
+  { "    --doh-url <URL>",
+    "Resolve hostnames over DoH",
+    CURLHELP_DNS },
+  { "    --dump-ca-embed",
+    "Write the embedded CA bundle to standard output",
+    CURLHELP_HTTP | CURLHELP_PROXY | CURLHELP_TLS },
+  { "-D, --dump-header <filename>",
+    "Write the received headers to <filename>",
+    CURLHELP_HTTP | CURLHELP_FTP },
+  { "    --ech <config>",
+    "Configure ECH",
+    CURLHELP_TLS },
+  { "    --egd-file <file>",
+    "EGD socket path for random data",
+    CURLHELP_DEPRECATED },
+  { "    --engine <name>",
+    "Crypto engine to use",
+    CURLHELP_TLS },
+  { "    --etag-compare <file>",
+    "Load ETag from file",
+    CURLHELP_HTTP },
+  { "    --etag-save <file>",
+    "Parse incoming ETag and save to a file",
+    CURLHELP_HTTP },
+  { "    --expect100-timeout <seconds>",
+    "How long to wait for 100-continue",
+    CURLHELP_HTTP | CURLHELP_TIMEOUT },
+  { "-f, --fail",
+    "Fail fast with no output on HTTP errors",
+    CURLHELP_IMPORTANT | CURLHELP_HTTP },
+  { "    --fail-early",
+    "Fail on first transfer error",
+    CURLHELP_CURL | CURLHELP_GLOBAL },
+  { "    --fail-with-body",
+    "Fail on HTTP errors but save the body",
+    CURLHELP_HTTP | CURLHELP_OUTPUT },
+  { "    --false-start",
+    "Enable TLS False Start",
+    CURLHELP_DEPRECATED },
+  { "    --follow",
+    "Follow redirects per spec",
+    CURLHELP_HTTP },
+  { "-F, --form <name=content>",
+    "Specify multipart MIME data",
+    CURLHELP_HTTP | CURLHELP_UPLOAD | CURLHELP_POST | CURLHELP_IMAP |
+    CURLHELP_SMTP },
+  { "    --form-escape",
+    "Escape form fields using backslash",
+    CURLHELP_HTTP | CURLHELP_UPLOAD | CURLHELP_POST },
+  { "    --form-string <name=string>",
+    "Specify multipart MIME data",
+    CURLHELP_HTTP | CURLHELP_UPLOAD | CURLHELP_POST | CURLHELP_SMTP |
+    CURLHELP_IMAP },
+  { "    --ftp-account <data>",
+    "Account data string",
+    CURLHELP_FTP | CURLHELP_AUTH },
+  { "    --ftp-alternative-to-user <command>",
+    "String to replace USER [name]",
+    CURLHELP_FTP },
+  { "    --ftp-create-dirs",
+    "Create the remote dirs if not present",
+    CURLHELP_FTP | CURLHELP_SFTP },
+  { "    --ftp-method <method>",
+    "Control CWD usage",
+    CURLHELP_FTP },
+  { "    --ftp-pasv",
+    "Send PASV/EPSV instead of PORT",
+    CURLHELP_FTP },
+  { "-P, --ftp-port <address>",
+    "Send PORT instead of PASV",
+    CURLHELP_FTP },
+  { "    --ftp-pret",
+    "Send PRET before PASV",
+    CURLHELP_FTP },
+  { "    --ftp-skip-pasv-ip",
+    "Skip the IP address for PASV",
+    CURLHELP_FTP },
+  { "    --ftp-ssl-ccc",
+    "Send CCC after authenticating",
+    CURLHELP_FTP | CURLHELP_TLS },
+  { "    --ftp-ssl-ccc-mode <active/passive>",
+    "Set CCC mode",
+    CURLHELP_FTP | CURLHELP_TLS },
+  { "    --ftp-ssl-control",
+    "Require TLS for login, clear for transfer",
+    CURLHELP_FTP | CURLHELP_TLS },
+  { "-G, --get",
+    "Put the post data in the URL and use GET",
+    CURLHELP_HTTP },
+  { "-g, --globoff",
+    "Disable URL globbing with {} and []",
+    CURLHELP_CURL },
+  { "    --happy-eyeballs-timeout-ms <ms>",
+    "Time for IPv6 before IPv4",
+    CURLHELP_CONNECTION | CURLHELP_TIMEOUT },
+  { "    --haproxy-clientip <ip>",
+    "Set address in HAProxy PROXY",
+    CURLHELP_HTTP | CURLHELP_PROXY },
+  { "    --haproxy-protocol",
+    "Send HAProxy PROXY protocol v1 header",
+    CURLHELP_HTTP | CURLHELP_PROXY },
+  { "-I, --head",
+    "Show document info only",
+    CURLHELP_IMPORTANT | CURLHELP_HTTP | CURLHELP_FTP | CURLHELP_FILE },
+  { "-H, --header <header/@file>",
+    "Pass custom header(s) to server",
+    CURLHELP_IMPORTANT | CURLHELP_HTTP | CURLHELP_IMAP | CURLHELP_SMTP },
+  { "-h, --help <subject>",
+    "Get help for commands",
+    CURLHELP_IMPORTANT | CURLHELP_CURL },
+  { "    --hostpubmd5 <md5>",
+    "Acceptable MD5 hash of host public key",
+    CURLHELP_SFTP | CURLHELP_SCP | CURLHELP_SSH },
+  { "    --hostpubsha256 <sha256>",
+    "Acceptable SHA256 hash of host public key",
+    CURLHELP_SFTP | CURLHELP_SCP | CURLHELP_SSH },
+  { "    --hsts <filename>",
+    "Enable HSTS with this cache file",
+    CURLHELP_HTTP },
+  { "    --http0.9",
+    "Allow HTTP/0.9 responses",
+    CURLHELP_HTTP },
+  { "-0, --http1.0",
+    "Use HTTP/1.0",
+    CURLHELP_HTTP },
+  { "    --http1.1",
+    "Use HTTP/1.1",
+    CURLHELP_HTTP },
+  { "    --http2",
+    "Use HTTP/2",
+    CURLHELP_HTTP },
+  { "    --http2-prior-knowledge",
+    "Use HTTP/2 without HTTP/1.1 Upgrade",
+    CURLHELP_HTTP },
+  { "    --http3",
+    "Use HTTP/3",
+    CURLHELP_HTTP },
+  { "    --http3-only",
+    "Use HTTP/3 only",
+    CURLHELP_HTTP },
+  { "    --ignore-content-length",
+    "Ignore the size of the remote resource",
+    CURLHELP_HTTP | CURLHELP_FTP },
+  { "-k, --insecure",
+    "Allow insecure server connections",
+    CURLHELP_TLS | CURLHELP_SFTP | CURLHELP_SCP | CURLHELP_SSH },
+  { "    --interface <name>",
+    "Use network interface",
+    CURLHELP_CONNECTION },
+  { "    --ip-tos <string>",
+    "Set IP Type of Service or Traffic Class",
+    CURLHELP_CONNECTION },
+  { "    --ipfs-gateway <URL>",
+    "Gateway for IPFS",
+    CURLHELP_CURL },
+  { "-4, --ipv4",
+    "Resolve names to IPv4 addresses",
+    CURLHELP_CONNECTION | CURLHELP_DNS },
+  { "-6, --ipv6",
+    "Resolve names to IPv6 addresses",
+    CURLHELP_CONNECTION | CURLHELP_DNS },
+  { "    --json <data>",
+    "HTTP POST JSON",
+    CURLHELP_HTTP | CURLHELP_POST | CURLHELP_UPLOAD },
+  { "-j, --junk-session-cookies",
+    "Ignore session cookies read from file",
+    CURLHELP_HTTP },
+  { "    --keepalive-cnt <integer>",
+    "Maximum number of keepalive probes",
+    CURLHELP_CONNECTION },
+  { "    --keepalive-time <seconds>",
+    "Interval time for keepalive probes",
+    CURLHELP_CONNECTION | CURLHELP_TIMEOUT },
+  { "    --key <key>",
+    "Private key filename",
+    CURLHELP_TLS | CURLHELP_SSH },
+  { "    --key-type <type>",
+    "Private key file type (DER/PEM/ENG)",
+    CURLHELP_TLS },
+  { "    --knownhosts <file>",
+    "Specify knownhosts path",
+    CURLHELP_SSH },
+  { "    --krb <level>",
+    "Enable Kerberos with security <level>",
+    CURLHELP_DEPRECATED },
+  { "    --libcurl <file>",
+    "Generate libcurl code for this command line",
+    CURLHELP_CURL | CURLHELP_GLOBAL },
+  { "    --limit-rate <speed>",
+    "Limit transfer speed to RATE",
+    CURLHELP_CONNECTION },
+  { "-l, --list-only",
+    "List only mode",
+    CURLHELP_FTP | CURLHELP_POP3 | CURLHELP_SFTP | CURLHELP_FILE },
+  { "    --local-port <range>",
+    "Use a local port number within RANGE",
+    CURLHELP_CONNECTION },
+  { "-L, --location",
+    "Follow redirects",
+    CURLHELP_HTTP },
+  { "    --location-trusted",
+    "As --location, but send secrets to other hosts",
+    CURLHELP_HTTP | CURLHELP_AUTH },
+  { "    --login-options <options>",
+    "Server login options",
+    CURLHELP_IMAP | CURLHELP_POP3 | CURLHELP_SMTP | CURLHELP_AUTH |
+    CURLHELP_LDAP },
+  { "    --mail-auth <address>",
+    "Originator address of the original email",
+    CURLHELP_SMTP },
+  { "    --mail-from <address>",
+    "Mail from this address",
+    CURLHELP_SMTP },
+  { "    --mail-rcpt <address>",
+    "Mail to this address",
+    CURLHELP_SMTP },
+  { "    --mail-rcpt-allowfails",
+    "Allow RCPT TO command to fail",
+    CURLHELP_SMTP },
+  { "-M, --manual",
+    "Display the full manual",
+    CURLHELP_CURL },
+  { "    --max-filesize <bytes>",
+    "Maximum file size to download",
+    CURLHELP_CONNECTION },
+  { "    --max-redirs <num>",
+    "Maximum number of redirects allowed",
+    CURLHELP_HTTP },
+  { "-m, --max-time <seconds>",
+    "Maximum time allowed for transfer",
+    CURLHELP_CONNECTION | CURLHELP_TIMEOUT },
+  { "    --metalink",
+    "Process given URLs as metalink XML file",
+    CURLHELP_DEPRECATED },
+  { "    --mptcp",
+    "Enable Multipath TCP",
+    CURLHELP_CONNECTION },
+  { "    --negotiate",
+    "Use HTTP Negotiate (SPNEGO) authentication",
+    CURLHELP_AUTH | CURLHELP_HTTP },
+  { "-n, --netrc",
+    "Must read .netrc for username and password",
+    CURLHELP_AUTH },
+  { "    --netrc-file <filename>",
+    "Specify FILE for netrc",
+    CURLHELP_AUTH },
+  { "    --netrc-optional",
+    "Use either .netrc or URL",
+    CURLHELP_AUTH },
+  { "-:, --next",
+    "Make next URL use separate options",
+    CURLHELP_CURL },
+  { "    --no-alpn",
+    "Disable the ALPN TLS extension",
+    CURLHELP_TLS | CURLHELP_HTTP },
+  { "-N, --no-buffer",
+    "Disable buffering of the output stream",
+    CURLHELP_OUTPUT },
+  { "    --no-clobber",
+    "Do not overwrite files that already exist",
+    CURLHELP_OUTPUT },
+  { "    --no-keepalive",
+    "Disable TCP keepalive on the connection",
+    CURLHELP_CONNECTION },
+  { "    --no-npn",
+    "Disable the NPN TLS extension",
+    CURLHELP_DEPRECATED },
+  { "    --no-progress-meter",
+    "Do not show the progress meter",
+    CURLHELP_VERBOSE },
+  { "    --no-sessionid",
+    "Disable SSL session-ID reusing",
+    CURLHELP_TLS },
+  { "    --noproxy <no-proxy-list>",
+    "List of hosts which do not use proxy",
+    CURLHELP_PROXY },
+  { "    --ntlm",
+    "HTTP NTLM authentication",
+    CURLHELP_AUTH | CURLHELP_HTTP },
+  { "    --ntlm-wb",
+    "HTTP NTLM authentication with winbind",
+    CURLHELP_DEPRECATED },
+  { "    --oauth2-bearer <token>",
+    "OAuth 2 Bearer Token",
+    CURLHELP_AUTH | CURLHELP_IMAP | CURLHELP_POP3 | CURLHELP_SMTP |
+    CURLHELP_LDAP },
+  { "    --out-null",
+    "Discard response data into the void",
+    CURLHELP_OUTPUT },
+  { "-o, --output <file>",
+    "Write to file instead of stdout",
+    CURLHELP_IMPORTANT | CURLHELP_OUTPUT },
+  { "    --output-dir <dir>",
+    "Directory to save files in",
+    CURLHELP_OUTPUT },
+  { "-Z, --parallel",
+    "Perform transfers in parallel",
+    CURLHELP_CONNECTION | CURLHELP_CURL | CURLHELP_GLOBAL },
+  { "    --parallel-immediate",
+    "Do not wait for multiplexing",
+    CURLHELP_CONNECTION | CURLHELP_CURL | CURLHELP_GLOBAL },
+  { "    --parallel-max <num>",
+    "Maximum concurrency for parallel transfers",
+    CURLHELP_CONNECTION | CURLHELP_CURL | CURLHELP_GLOBAL },
+  { "    --parallel-max-host <num>",
+    "Maximum connections to a single host",
+    CURLHELP_CONNECTION | CURLHELP_CURL | CURLHELP_GLOBAL },
+  { "    --pass <phrase>",
+    "Passphrase for the private key",
+    CURLHELP_SSH | CURLHELP_TLS | CURLHELP_AUTH },
+  { "    --path-as-is",
+    "Do not squash .. sequences in URL path",
+    CURLHELP_CURL },
+  { "    --pinnedpubkey <hashes>",
+    "Public key to verify peer against",
+    CURLHELP_TLS },
+  { "    --post301",
+    "Do not switch to GET after a 301 redirect",
+    CURLHELP_HTTP | CURLHELP_POST },
+  { "    --post302",
+    "Do not switch to GET after a 302 redirect",
+    CURLHELP_HTTP | CURLHELP_POST },
+  { "    --post303",
+    "Do not switch to GET after a 303 redirect",
+    CURLHELP_HTTP | CURLHELP_POST },
+  { "    --preproxy <[protocol://]host[:port]>",
+    "Use this proxy first",
+    CURLHELP_PROXY },
+  { "-#, --progress-bar",
+    "Display transfer progress as a bar",
+    CURLHELP_VERBOSE | CURLHELP_GLOBAL },
+  { "    --proto <protocols>",
+    "Enable/disable PROTOCOLS",
+    CURLHELP_CONNECTION | CURLHELP_CURL },
+  { "    --proto-default <protocol>",
+    "Use PROTOCOL for any URL missing a scheme",
+    CURLHELP_CONNECTION | CURLHELP_CURL },
+  { "    --proto-redir <protocols>",
+    "Enable/disable PROTOCOLS on redirect",
+    CURLHELP_CONNECTION | CURLHELP_CURL },
+  { "-x, --proxy <[protocol://]host[:port]>",
+    "Use this proxy",
+    CURLHELP_PROXY },
+  { "    --proxy-anyauth",
+    "Pick any proxy authentication method",
+    CURLHELP_PROXY | CURLHELP_AUTH },
+  { "    --proxy-basic",
+    "Use Basic authentication on the proxy",
+    CURLHELP_PROXY | CURLHELP_AUTH },
+  { "    --proxy-ca-native",
+    "Load CA certs from the OS to verify proxy",
+    CURLHELP_TLS },
+  { "    --proxy-cacert <file>",
+    "CA certificates to verify proxy against",
+    CURLHELP_PROXY | CURLHELP_TLS },
+  { "    --proxy-capath <dir>",
+    "CA directory to verify proxy against",
+    CURLHELP_PROXY | CURLHELP_TLS },
+  { "    --proxy-cert <cert[:passwd]>",
+    "Set client certificate for proxy",
+    CURLHELP_PROXY | CURLHELP_TLS },
+  { "    --proxy-cert-type <type>",
+    "Client certificate type for HTTPS proxy",
+    CURLHELP_PROXY | CURLHELP_TLS },
+  { "    --proxy-ciphers <list>",
+    "TLS 1.2 (1.1, 1.0) ciphers to use for proxy",
+    CURLHELP_PROXY | CURLHELP_TLS },
+  { "    --proxy-crlfile <file>",
+    "Set a CRL list for proxy",
+    CURLHELP_PROXY | CURLHELP_TLS },
+  { "    --proxy-digest",
+    "Digest auth with the proxy",
+    CURLHELP_PROXY | CURLHELP_TLS },
+  { "    --proxy-header <header/@file>",
+    "Pass custom header(s) to proxy",
+    CURLHELP_PROXY },
+  { "    --proxy-http2",
+    "Use HTTP/2 with HTTPS proxy",
+    CURLHELP_HTTP | CURLHELP_PROXY },
+  { "    --proxy-http3",
+    "Use HTTP/3 with HTTPS proxy",
+    CURLHELP_HTTP | CURLHELP_PROXY },
+  { "    --proxy-insecure",
+    "Skip HTTPS proxy cert verification",
+    CURLHELP_PROXY | CURLHELP_TLS },
+  { "    --proxy-key <key>",
+    "Private key for HTTPS proxy",
+    CURLHELP_PROXY | CURLHELP_TLS },
+  { "    --proxy-key-type <type>",
+    "Private key file type for proxy",
+    CURLHELP_PROXY | CURLHELP_TLS },
+  { "    --proxy-negotiate",
+    "HTTP Negotiate (SPNEGO) auth with the proxy",
+    CURLHELP_PROXY | CURLHELP_AUTH },
+  { "    --proxy-ntlm",
+    "NTLM authentication with the proxy",
+    CURLHELP_PROXY | CURLHELP_AUTH },
+  { "    --proxy-pass <phrase>",
+    "Passphrase for private key for HTTPS proxy",
+    CURLHELP_PROXY | CURLHELP_TLS | CURLHELP_AUTH },
+  { "    --proxy-pinnedpubkey <hashes>",
+    "FILE/HASHES public key to verify proxy with",
+    CURLHELP_PROXY | CURLHELP_TLS },
+  { "    --proxy-service-name <name>",
+    "SPNEGO proxy service name",
+    CURLHELP_PROXY | CURLHELP_TLS },
+  { "    --proxy-ssl-allow-beast",
+    "Allow this security flaw for HTTPS proxy",
+    CURLHELP_PROXY | CURLHELP_TLS },
+  { "    --proxy-ssl-auto-client-cert",
+    "Auto client certificate for proxy",
+    CURLHELP_PROXY | CURLHELP_TLS },
+  { "    --proxy-tls13-ciphers <list>",
+    "TLS 1.3 proxy cipher suites",
+    CURLHELP_PROXY | CURLHELP_TLS },
+  { "    --proxy-tlsauthtype <type>",
+    "TLS authentication type for HTTPS proxy",
+    CURLHELP_PROXY | CURLHELP_TLS | CURLHELP_AUTH },
+  { "    --proxy-tlspassword <string>",
+    "TLS password for HTTPS proxy",
+    CURLHELP_PROXY | CURLHELP_TLS | CURLHELP_AUTH },
+  { "    --proxy-tlsuser <name>",
+    "TLS username for HTTPS proxy",
+    CURLHELP_PROXY | CURLHELP_TLS | CURLHELP_AUTH },
+  { "    --proxy-tlsv1",
+    "TLSv1 for HTTPS proxy",
+    CURLHELP_PROXY | CURLHELP_TLS | CURLHELP_AUTH },
+  { "-U, --proxy-user <user:password>",
+    "Proxy user and password",
+    CURLHELP_PROXY | CURLHELP_AUTH },
+  { "    --proxy1.0 <host[:port]>",
+    "Use HTTP/1.0 proxy on given port",
+    CURLHELP_PROXY },
+  { "-p, --proxytunnel",
+    "HTTP proxy tunnel (using CONNECT)",
+    CURLHELP_PROXY },
+  { "    --pubkey <key>",
+    "SSH Public key filename",
+    CURLHELP_SFTP | CURLHELP_SCP | CURLHELP_SSH | CURLHELP_AUTH },
+  { "-Q, --quote <command>",
+    "Send command(s) to server before transfer",
+    CURLHELP_FTP | CURLHELP_SFTP },
+  { "    --random-file <file>",
+    "File for reading random data from",
+    CURLHELP_DEPRECATED },
+  { "-r, --range <range>",
+    "Retrieve only the bytes within RANGE",
+    CURLHELP_HTTP | CURLHELP_FTP | CURLHELP_SFTP | CURLHELP_FILE },
+  { "    --rate <max request rate>",
+    "Request rate for serial transfers",
+    CURLHELP_CONNECTION | CURLHELP_GLOBAL },
+  { "    --raw",
+    "Do HTTP raw; no transfer decoding",
+    CURLHELP_HTTP },
+  { "-e, --referer <URL>",
+    "Referrer URL",
+    CURLHELP_HTTP },
+  { "-J, --remote-header-name",
+    "Use the header-provided filename",
+    CURLHELP_OUTPUT },
+  { "-O, --remote-name",
+    "Write output to file named as remote file",
+    CURLHELP_IMPORTANT | CURLHELP_OUTPUT },
+  { "    --remote-name-all",
+    "Use the remote filename for all URLs",
+    CURLHELP_OUTPUT },
+  { "-R, --remote-time",
+    "Set remote file's time on local output",
+    CURLHELP_OUTPUT },
+  { "    --remove-on-error",
+    "Remove output file on errors",
+    CURLHELP_OUTPUT },
+  { "-X, --request <method>",
+    "Specify request method to use",
+    CURLHELP_CONNECTION | CURLHELP_POP3 | CURLHELP_FTP | CURLHELP_IMAP |
+    CURLHELP_SMTP },
+  { "    --request-target <path>",
+    "Specify the target for this request",
+    CURLHELP_HTTP },
+  { "    --resolve <[+]host:port:addr[,addr]...>",
+    "Resolve host+port to address",
+    CURLHELP_CONNECTION | CURLHELP_DNS },
+  { "    --retry <num>",
+    "Retry request if transient problems occur",
+    CURLHELP_CURL },
+  { "    --retry-all-errors",
+    "Retry all errors (with --retry)",
+    CURLHELP_CURL },
+  { "    --retry-connrefused",
+    "Retry on connection refused (with --retry)",
+    CURLHELP_CURL },
+  { "    --retry-delay <seconds>",
+    "Wait time between retries",
+    CURLHELP_CURL | CURLHELP_TIMEOUT },
+  { "    --retry-max-time <seconds>",
+    "Retry only within this period",
+    CURLHELP_CURL | CURLHELP_TIMEOUT },
+  { "    --sasl-authzid <identity>",
+    "Identity for SASL PLAIN authentication",
+    CURLHELP_AUTH },
+  { "    --sasl-ir",
+    "Initial response in SASL authentication",
+    CURLHELP_AUTH },
+  { "    --service-name <name>",
+    "SPNEGO service name",
+    CURLHELP_AUTH },
+  { "-S, --show-error",
+    "Show error even when -s is used",
+    CURLHELP_CURL | CURLHELP_GLOBAL },
+  { "-i, --show-headers",
+    "Show response headers in output",
+    CURLHELP_IMPORTANT | CURLHELP_VERBOSE | CURLHELP_OUTPUT },
+  { "    --sigalgs <list>",
+    "TLS signature algorithms to use",
+    CURLHELP_TLS },
+  { "-s, --silent",
+    "Silent mode",
+    CURLHELP_IMPORTANT | CURLHELP_VERBOSE },
+  { "    --skip-existing",
+    "Skip download if local file already exists",
+    CURLHELP_CURL | CURLHELP_OUTPUT },
+  { "    --socks4 <host[:port]>",
+    "SOCKS4 proxy on given host + port",
+    CURLHELP_PROXY },
+  { "    --socks4a <host[:port]>",
+    "SOCKS4a proxy on given host + port",
+    CURLHELP_PROXY },
+  { "    --socks5 <host[:port]>",
+    "SOCKS5 proxy on given host + port",
+    CURLHELP_PROXY },
+  { "    --socks5-basic",
+    "Username/password auth for SOCKS5 proxies",
+    CURLHELP_PROXY | CURLHELP_AUTH },
+  { "    --socks5-gssapi",
+    "Enable GSS-API auth for SOCKS5 proxies",
+    CURLHELP_PROXY | CURLHELP_AUTH },
+  { "    --socks5-gssapi-nec",
+    "Compatibility with NEC SOCKS5 server",
+    CURLHELP_PROXY | CURLHELP_AUTH },
+  { "    --socks5-gssapi-service <name>",
+    "SOCKS5 proxy service name for GSS-API",
+    CURLHELP_PROXY | CURLHELP_AUTH },
+  { "    --socks5-hostname <host[:port]>",
+    "SOCKS5 proxy, pass hostname to proxy",
+    CURLHELP_PROXY },
+  { "-Y, --speed-limit <speed>",
+    "Stop transfers slower than this",
+    CURLHELP_CONNECTION },
+  { "-y, --speed-time <seconds>",
+    "Trigger 'speed-limit' abort after this time",
+    CURLHELP_CONNECTION | CURLHELP_TIMEOUT },
+  { "    --ssl",
+    "Try enabling TLS",
+    CURLHELP_TLS | CURLHELP_IMAP | CURLHELP_POP3 | CURLHELP_SMTP |
+    CURLHELP_LDAP },
+  { "    --ssl-allow-beast",
+    "Allow security flaw to improve interop",
+    CURLHELP_TLS },
+  { "    --ssl-auto-client-cert",
+    "Use auto client certificate (Schannel)",
+    CURLHELP_TLS },
+  { "    --ssl-no-revoke",
+    "Disable cert revocation checks (Schannel)",
+    CURLHELP_TLS },
+  { "    --ssl-reqd",
+    "Require SSL/TLS",
+    CURLHELP_TLS | CURLHELP_IMAP | CURLHELP_POP3 | CURLHELP_SMTP |
+    CURLHELP_LDAP },
+  { "    --ssl-revoke-best-effort",
+    "Ignore missing cert CRL dist points",
+    CURLHELP_TLS },
+  { "    --ssl-sessions <filename>",
+    "Load/save SSL session tickets from/to this file",
+    CURLHELP_TLS },
+  { "-2, --sslv2",
+    "SSLv2",
+    CURLHELP_DEPRECATED },
+  { "-3, --sslv3",
+    "SSLv3",
+    CURLHELP_DEPRECATED },
+  { "    --stderr <file>",
+    "Where to redirect stderr",
+    CURLHELP_VERBOSE | CURLHELP_GLOBAL },
+  { "    --styled-output",
+    "Enable styled output for HTTP headers",
+    CURLHELP_VERBOSE | CURLHELP_GLOBAL },
+  { "    --suppress-connect-headers",
+    "Suppress proxy CONNECT response headers",
+    CURLHELP_PROXY },
+  { "    --tcp-fastopen",
+    "Use TCP Fast Open",
+    CURLHELP_CONNECTION },
+  { "    --tcp-nodelay",
+    "Set TCP_NODELAY",
+    CURLHELP_CONNECTION },
+  { "-t, --telnet-option <opt=val>",
+    "Set telnet option",
+    CURLHELP_TELNET },
+  { "    --tftp-blksize <value>",
+    "Set TFTP BLKSIZE option",
+    CURLHELP_TFTP },
+  { "    --tftp-no-options",
+    "Do not send any TFTP options",
+    CURLHELP_TFTP },
+  { "-z, --time-cond <time>",
+    "Transfer based on a time condition",
+    CURLHELP_HTTP | CURLHELP_FTP },
+  { "    --tls-earlydata",
+    "Allow use of TLSv1.3 early data (0RTT)",
+    CURLHELP_TLS },
+  { "    --tls-max <VERSION>",
+    "Maximum allowed TLS version",
+    CURLHELP_TLS },
+  { "    --tls13-ciphers <list>",
+    "TLS 1.3 cipher suites to use",
+    CURLHELP_TLS },
+  { "    --tlsauthtype <type>",
+    "TLS authentication type",
+    CURLHELP_TLS | CURLHELP_AUTH },
+  { "    --tlspassword <string>",
+    "TLS password",
+    CURLHELP_TLS | CURLHELP_AUTH },
+  { "    --tlsuser <name>",
+    "TLS username",
+    CURLHELP_TLS | CURLHELP_AUTH },
+  { "-1, --tlsv1",
+    "TLSv1.0 or greater",
+    CURLHELP_TLS },
+  { "    --tlsv1.0",
+    "TLSv1.0 or greater",
+    CURLHELP_TLS },
+  { "    --tlsv1.1",
+    "TLSv1.1 or greater",
+    CURLHELP_TLS },
+  { "    --tlsv1.2",
+    "TLSv1.2 or greater",
+    CURLHELP_TLS },
+  { "    --tlsv1.3",
+    "TLSv1.3 or greater",
+    CURLHELP_TLS },
+  { "    --tr-encoding",
+    "Request compressed transfer encoding",
+    CURLHELP_HTTP },
+  { "    --trace <file>",
+    "Write a debug trace to FILE",
+    CURLHELP_VERBOSE | CURLHELP_GLOBAL },
+  { "    --trace-ascii <file>",
+    "Like --trace, but without hex output",
+    CURLHELP_VERBOSE | CURLHELP_GLOBAL },
+  { "    --trace-config <string>",
+    "Details to log in trace/verbose output",
+    CURLHELP_VERBOSE | CURLHELP_GLOBAL },
+  { "    --trace-ids",
+    "Transfer + connection ids in verbose output",
+    CURLHELP_VERBOSE | CURLHELP_GLOBAL },
+  { "    --trace-time",
+    "Add time stamps to trace/verbose output",
+    CURLHELP_VERBOSE | CURLHELP_GLOBAL },
+  { "    --unix-socket <path>",
+    "Connect through this Unix domain socket",
+    CURLHELP_CONNECTION },
+  { "-T, --upload-file <file>",
+    "Transfer local FILE to destination",
+    CURLHELP_IMPORTANT | CURLHELP_UPLOAD },
+  { "    --upload-flags <flags>",
+    "IMAP upload behavior",
+    CURLHELP_CURL | CURLHELP_OUTPUT },
+  { "    --url <url/file>",
+    "URL(s) to work with",
+    CURLHELP_CURL },
+  { "    --url-query <data>",
+    "Add a URL query part",
+    CURLHELP_HTTP | CURLHELP_POST | CURLHELP_UPLOAD },
+  { "-B, --use-ascii",
+    "Use ASCII/text transfer",
+    CURLHELP_FTP | CURLHELP_OUTPUT | CURLHELP_LDAP | CURLHELP_TFTP },
+  { "-u, --user <user:password>",
+    "Server user and password",
+    CURLHELP_IMPORTANT | CURLHELP_AUTH },
+  { "-A, --user-agent <name>",
+    "Send User-Agent <name> to server",
+    CURLHELP_IMPORTANT | CURLHELP_HTTP },
+  { "    --variable <[%]name=text/@file>",
+    "Set variable",
+    CURLHELP_CURL },
+  { "-v, --verbose",
+    "Make the operation more talkative",
+    CURLHELP_IMPORTANT | CURLHELP_VERBOSE | CURLHELP_GLOBAL },
+  { "-V, --version",
+    "Show version number and quit",
+    CURLHELP_IMPORTANT | CURLHELP_CURL },
+  { "    --vlan-priority <priority>",
+    "Set VLAN priority",
+    CURLHELP_CONNECTION },
+  { "-w, --write-out <format>",
+    "Output FORMAT after completion",
+    CURLHELP_VERBOSE },
+  { "    --xattr",
+    "Store metadata in extended file attributes",
+    CURLHELP_OUTPUT },
+  { NULL, NULL, 0 }
 };
diff --git a/third-party/curl/src/tool_main.c b/third-party/curl/src/tool_main.c
index 5c904e86c7..5ee8fc9ddd 100644
--- a/third-party/curl/src/tool_main.c
+++ b/third-party/curl/src/tool_main.c
@@ -23,40 +23,24 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#include <sys/stat.h>
-
-#ifdef WIN32
+#ifdef _WIN32
 #include <tchar.h>
 #endif
 
-#ifdef HAVE_SIGNAL_H
 #include <signal.h>
-#endif
 
 #ifdef HAVE_FCNTL_H
 #include <fcntl.h>
 #endif
 
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
-
 #include "tool_cfgable.h"
 #include "tool_doswin.h"
 #include "tool_msgs.h"
 #include "tool_operate.h"
 #include "tool_vms.h"
 #include "tool_main.h"
-#include "tool_libinfo.h"
 #include "tool_stderr.h"
 
-/*
- * This is low-level hard-hacking memory leak tracking and similar. Using
- * the library level code from this client-side is ugly, but we do this
- * anyway for convenience.
- */
-#include "memdebug.h" /* keep this as LAST include */
-
 #ifdef __VMS
 /*
  * vms_show is a global variable, used in main() as parameter for
@@ -67,6 +51,15 @@
 int vms_show = 0;
 #endif
 
+#ifdef __AMIGA__
+#ifdef __GNUC__
+#define CURL_USED __attribute__((used))
+#else
+#define CURL_USED
+#endif
+static const char CURL_USED min_stack[] = "$STACK:32768";
+#endif
+
 #ifdef __MINGW32__
 /*
  * There seems to be no way to escape "*" in command-line arguments with MinGW
@@ -83,9 +76,9 @@ int _CRT_glob = 0;
 #if defined(HAVE_PIPE) && defined(HAVE_FCNTL)
 /*
  * Ensure that file descriptors 0, 1 and 2 (stdin, stdout, stderr) are
- * open before starting to run.  Otherwise, the first three network
+ * open before starting to run. Otherwise, the first three network
  * sockets opened by curl could be used for input sources, downloaded data
- * or error logs as they will effectively be stdin, stdout and/or stderr.
+ * or error logs as they are effectively stdin, stdout and/or stderr.
  *
  * fcntl's F_GETFD instruction returns -1 if the file descriptor is closed,
  * otherwise it returns "the file descriptor flags (which typically can only
@@ -105,123 +98,43 @@ static int main_checkfds(void)
 #define main_checkfds() 0
 #endif
 
-#ifdef CURLDEBUG
+#ifdef CURL_MEMDEBUG
 static void memory_tracking_init(void)
 {
   char *env;
   /* if CURL_MEMDEBUG is set, this starts memory tracking message logging */
-  env = curlx_getenv("CURL_MEMDEBUG");
+  env = curl_getenv("CURL_MEMDEBUG");
   if(env) {
-    /* use the value as file name */
-    char fname[CURL_MT_LOGFNAME_BUFSIZE];
-    if(strlen(env) >= CURL_MT_LOGFNAME_BUFSIZE)
-      env[CURL_MT_LOGFNAME_BUFSIZE-1] = '\0';
-    strcpy(fname, env);
+    /* use the value as filename */
+    char fname[512];
+    curlx_strcopy(fname, sizeof(fname), env, strlen(env));
     curl_free(env);
     curl_dbg_memdebug(fname);
     /* this weird stuff here is to make curl_free() get called before
-       curl_dbg_memdebug() as otherwise memory tracking will log a free()
+       curl_dbg_memdebug() as otherwise memory tracking logs a curlx_free()
        without an alloc! */
   }
   /* if CURL_MEMLIMIT is set, this enables fail-on-alloc-number-N feature */
-  env = curlx_getenv("CURL_MEMLIMIT");
+  env = curl_getenv("CURL_MEMLIMIT");
   if(env) {
-    char *endptr;
-    long num = strtol(env, &endptr, 10);
-    if((endptr != env) && (endptr == env + strlen(env)) && (num > 0))
-      curl_dbg_memlimit(num);
+    curl_off_t num;
+    const char *p = env;
+    if(!curlx_str_number(&p, &num, LONG_MAX))
+      curl_dbg_memlimit((long)num);
     curl_free(env);
   }
 }
 #else
-#  define memory_tracking_init() Curl_nop_stmt
+#  define memory_tracking_init() tool_nop_stmt
 #endif
 
-/*
- * This is the main global constructor for the app. Call this before
- * _any_ libcurl usage. If this fails, *NO* libcurl functions may be
- * used, or havoc may be the result.
- */
-static CURLcode main_init(struct GlobalConfig *config)
-{
-  CURLcode result = CURLE_OK;
-
-#if defined(__DJGPP__) || defined(__GO32__)
-  /* stop stat() wasting time */
-  _djstat_flags |= _STAT_INODE | _STAT_EXEC_MAGIC | _STAT_DIRSIZE;
-#endif
-
-  /* Initialise the global config */
-  config->showerror = FALSE;          /* show errors when silent */
-  config->styled_output = TRUE;       /* enable detection */
-  config->parallel_max = PARALLEL_DEFAULT;
-
-  /* Allocate the initial operate config */
-  config->first = config->last = malloc(sizeof(struct OperationConfig));
-  if(config->first) {
-    /* Perform the libcurl initialization */
-    result = curl_global_init(CURL_GLOBAL_DEFAULT);
-    if(!result) {
-      /* Get information about libcurl */
-      result = get_libcurl_info();
-
-      if(!result) {
-        /* Initialise the config */
-        config_init(config->first);
-        config->first->global = config;
-      }
-      else {
-        errorf(config, "error retrieving curl library information");
-        free(config->first);
-      }
-    }
-    else {
-      errorf(config, "error initializing curl library");
-      free(config->first);
-    }
-  }
-  else {
-    errorf(config, "error initializing curl");
-    result = CURLE_FAILED_INIT;
-  }
-
-  return result;
-}
-
-static void free_globalconfig(struct GlobalConfig *config)
-{
-  Curl_safefree(config->trace_dump);
-
-  if(config->trace_fopened && config->trace_stream)
-    fclose(config->trace_stream);
-  config->trace_stream = NULL;
-
-  Curl_safefree(config->libcurl);
-}
-
-/*
- * This is the main global destructor for the app. Call this after
- * _all_ libcurl usage is done.
- */
-static void main_free(struct GlobalConfig *config)
-{
-  /* Cleanup the easy handle */
-  /* Main cleanup */
-  curl_global_cleanup();
-  free_globalconfig(config);
-
-  /* Free the config structures */
-  config_free(config->last);
-  config->first = NULL;
-  config->last = NULL;
-}
-
 /*
 ** curl tool main function.
 */
 #ifdef _UNICODE
-#if defined(__GNUC__)
-/* GCC doesn't know about wmain() */
+#ifdef CURL_HAVE_DIAG
+/* GCC does not know about wmain() */
+#pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Wmissing-prototypes"
 #pragma GCC diagnostic ignored "-Wmissing-declarations"
 #endif
@@ -231,35 +144,37 @@ int main(int argc, char *argv[])
 #endif
 {
   CURLcode result = CURLE_OK;
-  struct GlobalConfig global;
-  memset(&global, 0, sizeof(global));
 
   tool_init_stderr();
 
-#ifdef WIN32
+#ifdef _WIN32
   /* Undocumented diagnostic option to list the full paths of all loaded
      modules. This is purposely pre-init. */
   if(argc == 2 && !_tcscmp(argv[1], _T("--dump-module-paths"))) {
     struct curl_slist *item, *head = GetLoadedModulePaths();
     for(item = head; item; item = item->next)
-      printf("%s\n", item->data);
+      curl_mprintf("%s\n", item->data);
     curl_slist_free_all(head);
     return head ? 0 : 1;
   }
+
   /* win32_init must be called before other init routines. */
   result = win32_init();
   if(result) {
-    errorf(&global, "(%d) Windows-specific init failed", result);
-    return result;
+    errorf("(%d) Windows-specific init failed", (int)result);
+    return (int)result;
   }
 #endif
 
   if(main_checkfds()) {
-    errorf(&global, "out of file descriptors");
+    errorf("out of file descriptors");
     return CURLE_FAILED_INIT;
   }
 
 #if defined(HAVE_SIGNAL) && defined(SIGPIPE)
+#ifdef DEBUGBUILD
+  if(!curl_getenv("CURL_SIGPIPE_DEBUG"))
+#endif
   (void)signal(SIGPIPE, SIG_IGN);
 #endif
 
@@ -268,16 +183,16 @@ int main(int argc, char *argv[])
 
   /* Initialize the curl library - do not call any libcurl functions before
      this point */
-  result = main_init(&global);
+  result = globalconf_init();
   if(!result) {
     /* Start our curl operation */
-    result = operate(&global, argc, argv);
+    result = operate(argc, argv);
 
     /* Perform the main cleanup */
-    main_free(&global);
+    globalconf_free();
   }
 
-#ifdef WIN32
+#ifdef _WIN32
   /* Flush buffers of all streams opened in write or update mode */
   fflush(NULL);
 #endif
@@ -289,4 +204,10 @@ int main(int argc, char *argv[])
 #endif
 }
 
-#endif /* ndef UNITTESTS */
+#ifdef _UNICODE
+#ifdef CURL_HAVE_DIAG
+#pragma GCC diagnostic pop
+#endif
+#endif
+
+#endif /* !UNITTESTS */
diff --git a/third-party/curl/src/tool_main.h b/third-party/curl/src/tool_main.h
index cae520efbe..7578616320 100644
--- a/third-party/curl/src/tool_main.h
+++ b/third-party/curl/src/tool_main.h
@@ -30,19 +30,10 @@
 #define RETRY_SLEEP_DEFAULT 1000L   /* ms */
 #define RETRY_SLEEP_MAX     600000L /* ms == 10 minutes */
 
-#define MAX_PARALLEL 300 /* conservative */
+#define MAX_PARALLEL     65535
 #define PARALLEL_DEFAULT 50
 
-#ifndef STDIN_FILENO
-#  define STDIN_FILENO  fileno(stdin)
-#endif
-
-#ifndef STDOUT_FILENO
-#  define STDOUT_FILENO  fileno(stdout)
-#endif
-
-#ifndef STDERR_FILENO
-#  define STDERR_FILENO  fileno(stderr)
-#endif
+#define MAX_PARALLEL_HOST     65535
+#define PARALLEL_HOST_DEFAULT 0 /* means not used */
 
 #endif /* HEADER_CURL_TOOL_MAIN_H */
diff --git a/third-party/curl/src/tool_msgs.c b/third-party/curl/src/tool_msgs.c
index 9754870a39..2e1245503f 100644
--- a/third-party/curl/src/tool_msgs.c
+++ b/third-party/curl/src/tool_msgs.c
@@ -23,63 +23,52 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
-
 #include "tool_cfgable.h"
 #include "tool_msgs.h"
+#include "terminal.h"
 
-#include "memdebug.h" /* keep this as LAST include */
-
-#define WARN_PREFIX "Warning: "
-#define NOTE_PREFIX "Note: "
+#define WARN_PREFIX  "Warning: "
+#define NOTE_PREFIX  "Note: "
 #define ERROR_PREFIX "curl: "
 
-static void voutf(struct GlobalConfig *config,
-                  const char *prefix,
-                  const char *fmt,
-                  va_list ap)
+static void voutf(const char *prefix, const char *fmt, va_list ap)
+  CURL_PRINTF(2, 0);
+
+static void voutf(const char *prefix, const char *fmt, va_list ap)
 {
-  size_t width = (79 - strlen(prefix));
+  size_t len;
+  char *ptr;
+  char buffer[1024];
+  size_t termw = get_terminal_columns();
+  size_t prefw = strlen(prefix);
+  size_t width = termw > prefw ? termw - prefw : SIZE_MAX;
   DEBUGASSERT(!strchr(fmt, '\n'));
-  if(!config->silent) {
-    size_t len;
-    char *ptr;
-    char *print_buffer;
+  len = curl_mvsnprintf(buffer, sizeof(buffer), fmt, ap);
+  ptr = buffer;
+  while(len > 0) {
+    fputs(prefix, tool_stderr);
 
-    print_buffer = curlx_mvaprintf(fmt, ap);
-    if(!print_buffer)
-      return;
-    len = strlen(print_buffer);
+    if(len > width) {
+      size_t cut = width - 1;
 
-    ptr = print_buffer;
-    while(len > 0) {
-      fputs(prefix, stderr);
-
-      if(len > width) {
-        size_t cut = width-1;
-
-        while(!ISBLANK(ptr[cut]) && cut) {
-          cut--;
-        }
-        if(0 == cut)
-          /* not a single cutting position was found, just cut it at the
-             max text width then! */
-          cut = width-1;
-
-        (void)fwrite(ptr, cut + 1, 1, stderr);
-        fputs("\n", stderr);
-        ptr += cut + 1; /* skip the space too */
-        len -= cut + 1;
-      }
-      else {
-        fputs(ptr, stderr);
-        fputs("\n", stderr);
-        len = 0;
+      while(!ISBLANK(ptr[cut]) && cut) {
+        cut--;
       }
+      if(cut == 0)
+        /* not a single cutting position was found, cut it at the max text
+           width then! */
+        cut = width - 1;
+
+      (void)fwrite(ptr, cut + 1, 1, tool_stderr);
+      fputs("\n", tool_stderr);
+      ptr += cut + 1; /* skip the space too */
+      len -= cut + 1;
+    }
+    else {
+      fputs(ptr, tool_stderr);
+      fputs("\n", tool_stderr);
+      len = 0;
     }
-    curl_free(print_buffer);
   }
 }
 
@@ -87,59 +76,62 @@ static void voutf(struct GlobalConfig *config,
  * Emit 'note' formatted message on configured 'errors' stream, if verbose was
  * selected.
  */
-void notef(struct GlobalConfig *config, const char *fmt, ...)
+void notef(const char *fmt, ...)
 {
-  va_list ap;
-  va_start(ap, fmt);
-  if(config->tracetype)
-    voutf(config, NOTE_PREFIX, fmt, ap);
-  va_end(ap);
+  if(global && global->tracetype) {
+    va_list ap;
+    va_start(ap, fmt);
+    voutf(NOTE_PREFIX, fmt, ap);
+    va_end(ap);
+  }
 }
 
 /*
  * Emit warning formatted message on configured 'errors' stream unless
  * mute (--silent) was selected.
  */
-
-void warnf(struct GlobalConfig *config, const char *fmt, ...)
+void warnf(const char *fmt, ...)
 {
-  va_list ap;
-  va_start(ap, fmt);
-  voutf(config, WARN_PREFIX, fmt, ap);
-  va_end(ap);
+  if(!global || !global->silent) {
+    va_list ap;
+    va_start(ap, fmt);
+    voutf(WARN_PREFIX, fmt, ap);
+    va_end(ap);
+  }
 }
+
 /*
  * Emit help formatted message on given stream. This is for errors with or
  * related to command line arguments.
  */
-void helpf(FILE *errors, const char *fmt, ...)
+void helpf(const char *fmt, ...)
 {
   if(fmt) {
     va_list ap;
     va_start(ap, fmt);
     DEBUGASSERT(!strchr(fmt, '\n'));
-    fputs("curl: ", errors); /* prefix it */
-    vfprintf(errors, fmt, ap);
+    fputs("curl: ", tool_stderr); /* prefix it */
+    curl_mvfprintf(tool_stderr, fmt, ap);
     va_end(ap);
-    fputs("\n", errors); /* newline it */
+    fputs("\n", tool_stderr); /* newline it */
   }
-  fprintf(errors, "curl: try 'curl --help' "
+  curl_mfprintf(tool_stderr, "curl: try 'curl --help' "
 #ifdef USE_MANUAL
-          "or 'curl --manual' "
+                             "or 'curl --manual' "
 #endif
-          "for more information\n");
+                             "for more information\n");
 }
 
 /*
  * Emit error message on error stream if not muted. When errors are not tied
  * to command line arguments, use helpf() for such errors.
  */
-void errorf(struct GlobalConfig *config, const char *fmt, ...)
+void errorf(const char *fmt, ...)
 {
-  if(!config->silent || config->showerror) {
+  if(!global || !global->silent || global->showerror) {
     va_list ap;
     va_start(ap, fmt);
-    voutf(config, ERROR_PREFIX, fmt, ap);
+    voutf(ERROR_PREFIX, fmt, ap);
     va_end(ap);
   }
 }
diff --git a/third-party/curl/src/tool_msgs.h b/third-party/curl/src/tool_msgs.h
index 9458991c01..eb201929f6 100644
--- a/third-party/curl/src/tool_msgs.h
+++ b/third-party/curl/src/tool_msgs.h
@@ -24,11 +24,12 @@
  *
  ***************************************************************************/
 #include "tool_setup.h"
+
 #include "tool_cfgable.h"
 
-void warnf(struct GlobalConfig *config, const char *fmt, ...);
-void notef(struct GlobalConfig *config, const char *fmt, ...);
-void helpf(FILE *errors, const char *fmt, ...);
-void errorf(struct GlobalConfig *config, const char *fmt, ...);
+void warnf(const char *fmt, ...) CURL_PRINTF(1, 2);
+void notef(const char *fmt, ...) CURL_PRINTF(1, 2);
+void helpf(const char *fmt, ...) CURL_PRINTF(1, 2);
+void errorf(const char *fmt, ...) CURL_PRINTF(1, 2);
 
 #endif /* HEADER_CURL_TOOL_MSGS_H */
diff --git a/third-party/curl/src/tool_operate.c b/third-party/curl/src/tool_operate.c
index cd12e81f65..c9bb636827 100644
--- a/third-party/curl/src/tool_operate.c
+++ b/third-party/curl/src/tool_operate.c
@@ -23,9 +23,7 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#ifdef HAVE_FCNTL_H
-#  include <fcntl.h>
-#endif
+#include "curlx/nonblock.h" /* for curlx_nonblock() */
 
 #ifdef HAVE_LOCALE_H
 #  include <locale.h>
@@ -45,19 +43,18 @@
 #  include <proto/dos.h>
 #endif
 
-#include "strcase.h"
+#ifdef HAVE_NETINET_IN_H
+#  include <netinet/in.h>
+#endif
 
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
+#ifdef HAVE_UV_H
+/* this is for libuv-enabled debug builds only */
+#include <uv.h>
+#endif
 
-#include "tool_binmode.h"
 #include "tool_cfgable.h"
-#include "tool_cb_dbg.h"
 #include "tool_cb_hdr.h"
 #include "tool_cb_prg.h"
-#include "tool_cb_rea.h"
-#include "tool_cb_see.h"
 #include "tool_cb_wrt.h"
 #include "tool_dirhie.h"
 #include "tool_doswin.h"
@@ -65,7 +62,6 @@
 #include "tool_filetime.h"
 #include "tool_getparam.h"
 #include "tool_helpers.h"
-#include "tool_findfile.h"
 #include "tool_libinfo.h"
 #include "tool_main.h"
 #include "tool_msgs.h"
@@ -74,7 +70,7 @@
 #include "tool_paramhlp.h"
 #include "tool_parsecfg.h"
 #include "tool_setopt.h"
-#include "tool_sleep.h"
+#include "tool_ssls.h"
 #include "tool_urlglob.h"
 #include "tool_util.h"
 #include "tool_writeout.h"
@@ -83,36 +79,25 @@
 #include "tool_help.h"
 #include "tool_hugehelp.h"
 #include "tool_progress.h"
-#include "dynbuf.h"
+#include "tool_ipfs.h"
+#include "config2setopts.h"
+#include "var.h"
 
-#include "memdebug.h" /* keep this as LAST include */
-
-#ifdef CURLDEBUG
-/* libcurl's debug builds provide an extra function */
-CURLcode curl_easy_perform_ev(CURL *easy);
+#ifdef DEBUGBUILD
+/* libcurl's debug-only curl_easy_perform_ev() */
+CURL_EXTERN CURLcode curl_easy_perform_ev(CURL *easy);
 #endif
 
-#ifndef O_BINARY
-/* since O_BINARY as used in bitmasks, setting it to zero makes it usable in
-   source code but yet it doesn't ruin anything */
-#  define O_BINARY 0
-#endif
-
-#define CURL_CA_CERT_ERRORMSG                                               \
-  "More details here: https://curl.se/docs/sslcerts.html\n\n"          \
-  "curl failed to verify the legitimacy of the server and therefore "       \
-  "could not\nestablish a secure connection to it. To learn more about "    \
-  "this situation and\nhow to fix it, please visit the web page mentioned " \
+#define CURL_CA_CERT_ERRORMSG                                              \
+  "More details here: https://curl.se/docs/sslcerts.html\n\n"              \
+  "curl failed to verify the legitimacy of the server and therefore "      \
+  "could not\nestablish a secure connection to it. To learn more about "   \
+  "this situation and\nhow to fix it, please visit the webpage mentioned " \
   "above.\n"
 
-static CURLcode single_transfer(struct GlobalConfig *global,
-                                struct OperationConfig *config,
-                                CURLSH *share,
-                                bool capath_from_env,
-                                bool *added);
-static CURLcode create_transfer(struct GlobalConfig *global,
-                                CURLSH *share,
-                                bool *added);
+static CURLcode create_transfer(CURLSH *share,
+                                bool *added,
+                                bool *skipped);
 
 static bool is_fatal_error(CURLcode code)
 {
@@ -120,7 +105,6 @@ static bool is_fatal_error(CURLcode code)
   case CURLE_FAILED_INIT:
   case CURLE_OUT_OF_MEMORY:
   case CURLE_UNKNOWN_OPTION:
-  case CURLE_FUNCTION_NOT_FOUND:
   case CURLE_BAD_FUNCTION_ARGUMENT:
     /* critical error */
     return TRUE;
@@ -152,20 +136,20 @@ static bool is_pkcs11_uri(const char *string)
  * For fixed files, find out the size of the EOF block and adjust.
  *
  * For all others, have to read the entire file in, discarding the contents.
- * Most posted text files will be small, and binary files like zlib archives
+ * Most posted text files are small, and binary files like zlib archives
  * and CD/DVD images should be either a STREAM_LF format or a fixed format.
  *
  */
 static curl_off_t vms_realfilesize(const char *name,
-                                   const struct_stat *stat_buf)
+                                   const curlx_struct_stat *stat_buf)
 {
   char buffer[8192];
   curl_off_t count;
   int ret_stat;
-  FILE * file;
+  FILE *file;
 
   /* !checksrc! disable FOPENMODE 1 */
-  file = fopen(name, "r"); /* VMS */
+  file = curlx_fopen(name, "r"); /* VMS */
   if(!file) {
     return 0;
   }
@@ -176,7 +160,7 @@ static curl_off_t vms_realfilesize(const char *name,
     if(ret_stat)
       count += ret_stat;
   }
-  fclose(file);
+  curlx_fclose(file);
 
   return count;
 }
@@ -188,7 +172,7 @@ static curl_off_t vms_realfilesize(const char *name,
  *
  */
 static curl_off_t VmsSpecialSize(const char *name,
-                                 const struct_stat *stat_buf)
+                                 const curlx_struct_stat *stat_buf)
 {
   switch(stat_buf->st_fab_rfm) {
   case FAB$C_VAR:
@@ -201,18 +185,15 @@ static curl_off_t VmsSpecialSize(const char *name,
 }
 #endif /* __VMS */
 
-#define BUFFER_SIZE (100*1024)
-
 struct per_transfer *transfers; /* first node */
 static struct per_transfer *transfersl; /* last node */
-static curl_off_t all_pers;
 
 /* add_per_transfer creates a new 'per_transfer' node in the linked
    list of transfers */
 static CURLcode add_per_transfer(struct per_transfer **per)
 {
   struct per_transfer *p;
-  p = calloc(sizeof(struct per_transfer), 1);
+  p = curlx_calloc(1, sizeof(struct per_transfer));
   if(!p)
     return CURLE_OUT_OF_MEMORY;
   if(!transfers)
@@ -227,8 +208,6 @@ static CURLcode add_per_transfer(struct per_transfer **per)
     transfersl = p;
   }
   *per = p;
-  all_xfers++; /* count total number of transfers added */
-  all_pers++;
 
   return CURLE_OK;
 }
@@ -256,24 +235,26 @@ static struct per_transfer *del_per_transfer(struct per_transfer *per)
   else
     transfersl = p;
 
-  free(per);
-  all_pers--;
+  curlx_free(per->uploadfile);
+  curlx_free(per->outfile);
+  curlx_free(per->url);
+  curl_easy_cleanup(per->curl);
+  curlx_free(per);
 
   return n;
 }
 
-static CURLcode pre_transfer(struct GlobalConfig *global,
-                             struct per_transfer *per)
+static CURLcode pre_transfer(struct per_transfer *per)
 {
   curl_off_t uploadfilesize = -1;
-  struct_stat fileinfo;
+  curlx_struct_stat fileinfo;
   CURLcode result = CURLE_OK;
 
   if(per->uploadfile && !stdin_upload(per->uploadfile)) {
     /* VMS Note:
      *
-     * Reading binary from files can be a problem...  Only FIXED, VAR
-     * etc WITHOUT implied CC will work. Others need a \n appended to
+     * Reading binary from files can be a problem... Only FIXED, VAR
+     * etc WITHOUT implied CC do work. Others need a \n appended to
      * a line
      *
      * - Stat gives a size but this is UNRELIABLE in VMS. E.g.
@@ -287,28 +268,28 @@ static CURLcode pre_transfer(struct GlobalConfig *global,
 #ifdef __VMS
     /* Calculate the real upload size for VMS */
     per->infd = -1;
-    if(stat(per->uploadfile, &fileinfo) == 0) {
-      fileinfo.st_size = VmsSpecialSize(uploadfile, &fileinfo);
+    if(curlx_stat(per->uploadfile, &fileinfo) == 0) {
+      fileinfo.st_size = VmsSpecialSize(per->uploadfile, &fileinfo);
       switch(fileinfo.st_fab_rfm) {
       case FAB$C_VAR:
       case FAB$C_VFC:
       case FAB$C_STMCR:
-        per->infd = open(per->uploadfile, O_RDONLY | O_BINARY);
+        per->infd = curlx_open(per->uploadfile, O_RDONLY | CURL_O_BINARY);
         break;
       default:
-        per->infd = open(per->uploadfile, O_RDONLY | O_BINARY,
-                        "rfm=stmlf", "ctx=stm");
+        per->infd = curlx_open(per->uploadfile, O_RDONLY | CURL_O_BINARY,
+                               "rfm=stmlf", "ctx=stm");
       }
     }
     if(per->infd == -1)
 #else
-      per->infd = open(per->uploadfile, O_RDONLY | O_BINARY);
-    if((per->infd == -1) || fstat(per->infd, &fileinfo))
+      per->infd = curlx_open(per->uploadfile, O_RDONLY | CURL_O_BINARY);
+    if((per->infd == -1) || curlx_fstat(per->infd, &fileinfo))
 #endif
     {
-      helpf(stderr, "Can't open '%s'", per->uploadfile);
+      helpf("cannot open '%s'", per->uploadfile);
       if(per->infd != -1) {
-        close(per->infd);
+        curlx_close(per->infd);
         per->infd = STDIN_FILENO;
       }
       return CURLE_READ_ERROR;
@@ -322,89 +303,308 @@ static CURLcode pre_transfer(struct GlobalConfig *global,
 #ifdef DEBUGBUILD
     /* allow dedicated test cases to override */
     {
-      char *ev = getenv("CURL_UPLOAD_SIZE");
+      const char *ev = getenv("CURL_UPLOAD_SIZE");
       if(ev) {
-        int sz = atoi(ev);
-        uploadfilesize = (curl_off_t)sz;
+        curl_off_t sz;
+        curlx_str_number(&ev, &sz, CURL_OFF_T_MAX);
+        uploadfilesize = sz;
       }
     }
 #endif
 
-    if(uploadfilesize != -1) {
-      struct OperationConfig *config = per->config; /* for the macro below */
-#ifdef CURL_DISABLE_LIBCURL_OPTION
-      (void)config;
-      (void)global;
-#endif
-      my_setopt(per->curl, CURLOPT_INFILESIZE_LARGE, uploadfilesize);
-    }
+    if(uploadfilesize != -1)
+      my_setopt_offt(per->curl, CURLOPT_INFILESIZE_LARGE, uploadfilesize);
   }
   per->uploadfilesize = uploadfilesize;
-  per->start = tvnow();
+  per->start = curlx_now();
   return result;
 }
 
-#ifdef __AMIGA__
-static void AmigaSetComment(struct per_transfer *per,
-                            CURLcode result)
+void single_transfer_cleanup(void)
 {
-  struct OutStruct *outs = &per->outs;
-  if(!result && outs->s_isreg && outs->filename) {
-    /* Set the url (up to 80 chars) as comment for the file */
-    if(strlen(per->this_url) > 78)
-      per->this_url[79] = '\0';
-    SetComment(outs->filename, per->this_url);
-  }
-}
-#else
-#define AmigaSetComment(x,y) Curl_nop_stmt
-#endif
-
-/* When doing serial transfers, we use a single fixed error area */
-static char global_errorbuffer[CURL_ERROR_SIZE];
-
-void single_transfer_cleanup(struct OperationConfig *config)
-{
-  if(config) {
-    struct State *state = &config->state;
-    if(state->urls) {
-      /* Free list of remaining URLs */
-      glob_cleanup(state->urls);
-      state->urls = NULL;
-    }
-    Curl_safefree(state->outfiles);
-    Curl_safefree(state->httpgetfields);
-    Curl_safefree(state->uploadfile);
-    if(state->inglob) {
-      /* Free list of globbed upload files */
-      glob_cleanup(state->inglob);
-      state->inglob = NULL;
-    }
-  }
+  struct State *state = &global->state;
+  /* Free list of remaining URLs */
+  glob_cleanup(&state->urlglob);
+  curlx_safefree(state->uploadfile);
+  /* Free list of globbed upload files */
+  glob_cleanup(&state->inglob);
 }
 
-/*
- * Call this after a transfer has completed.
+/* Helper function for retrycheck.
+ *
+ * This function is a prerequisite check used to determine whether or not some
+ * already downloaded data (ie out->bytes written) can be safely resumed in a
+ * subsequent transfer. The conditions are somewhat pedantic to avoid any risk
+ * of data corruption.
+ *
+ * Specific HTTP limitations (scheme, method, response code, etc) are checked
+ * in retrycheck if this prerequisite check is met.
  */
-static CURLcode post_per_transfer(struct GlobalConfig *global,
-                                  struct per_transfer *per,
-                                  CURLcode result,
-                                  bool *retryp,
-                                  long *delay) /* milliseconds! */
+static bool is_outfile_auto_resumable(struct OperationConfig *config,
+                                      struct per_transfer *per,
+                                      CURLcode result)
 {
   struct OutStruct *outs = &per->outs;
+  return config->use_resume && config->resume_from_current &&
+    config->resume_from >= 0 && outs->init == config->resume_from &&
+    outs->bytes > 0 && outs->filename && outs->regular_file && outs->fopened &&
+    outs->stream && !ferror(outs->stream) &&
+    !config->customrequest && !per->uploadfile &&
+    (config->httpreq == TOOL_HTTPREQ_UNSPEC ||
+     config->httpreq == TOOL_HTTPREQ_GET) &&
+    /* CURLE_WRITE_ERROR could mean outs->bytes is not accurate */
+    result != CURLE_WRITE_ERROR && result != CURLE_RANGE_ERROR;
+}
+
+enum retryreason {
+  RETRY_NO,
+  RETRY_ALL_ERRORS,
+  RETRY_TIMEOUT,
+  RETRY_CONNREFUSED,
+  RETRY_HTTP,
+  RETRY_FTP
+};
+
+/* figure out how long to wait until retry */
+static uint32_t retry_sleep(struct OperationConfig *config,
+                            struct per_transfer *per,
+                            enum retryreason retry,
+                            bool *retryp)
+{
+  static const char * const m[] = {
+    "(retrying all errors)",
+    ": timeout",
+    ": connection refused",
+    ": HTTP error",
+    ": FTP error"
+  };
   CURL *curl = per->curl;
+  uint32_t sleeptime = 0;
+  if(RETRY_HTTP == retry) {
+    curl_off_t retry_after = 0;
+    curl_easy_getinfo(curl, CURLINFO_RETRY_AFTER, &retry_after);
+    if(retry_after) {
+      /* make sure it does not overflow */
+      if(retry_after > (curl_off_t)(UINT32_MAX / 1000))
+        sleeptime = UINT32_MAX;
+      else
+        sleeptime = (uint32_t)retry_after * 1000U; /* milliseconds */
+
+      /* if adding retry_after seconds to the process would exceed the
+         maximum time allowed for retrying, then exit the retries right
+         away */
+      if(config->retry_maxtime_ms) {
+        timediff_t ms = curlx_timediff_ms(curlx_now(), per->retrystart);
+
+        if((CURL_OFF_T_MAX - sleeptime < ms) ||
+           (ms + sleeptime > config->retry_maxtime_ms)) {
+          warnf("The Retry-After: time would "
+                "make this command line exceed the maximum allowed time "
+                "for retries.");
+          *retryp = FALSE;
+          return 0; /* no retry */
+        }
+      }
+    }
+  }
+  if(!sleeptime && !config->retry_delay_ms) {
+    if(!per->retry_sleep)
+      per->retry_sleep = RETRY_SLEEP_DEFAULT;
+    else
+      per->retry_sleep *= 2;
+    if(per->retry_sleep > RETRY_SLEEP_MAX)
+      per->retry_sleep = RETRY_SLEEP_MAX;
+  }
+  if(!sleeptime)
+    sleeptime = per->retry_sleep;
+
+  warnf("Problem %s. Retrying in %u%s%.*u second%s. "
+        "%ld retr%s left.",
+        m[retry - 1], sleeptime / 1000,
+        (sleeptime % 1000 ? "." : ""),
+        (sleeptime % 1000 ? 3 : 0),
+        sleeptime % 1000,
+        (sleeptime == 1000 ? "" : "s"),
+        per->retry_remaining,
+        (per->retry_remaining > 1 ? "ies" : "y"));
+
+  return sleeptime;
+}
+
+static CURLcode retrycheck(struct OperationConfig *config,
+                           struct per_transfer *per,
+                           CURLcode result,
+                           bool *retryp,
+                           uint32_t *delayms)
+{
+  CURL *curl = per->curl;
+  struct OutStruct *outs = &per->outs;
+  enum retryreason reason = RETRY_NO;
+  if((result == CURLE_OPERATION_TIMEDOUT) ||
+     (result == CURLE_COULDNT_RESOLVE_HOST) ||
+     (result == CURLE_COULDNT_RESOLVE_PROXY) ||
+     (result == CURLE_FTP_ACCEPT_TIMEOUT))
+    /* retry timeout always */
+    reason = RETRY_TIMEOUT;
+  else if(config->retry_connrefused &&
+          (result == CURLE_COULDNT_CONNECT)) {
+    long oserrno = 0;
+    curl_easy_getinfo(curl, CURLINFO_OS_ERRNO, &oserrno);
+    if(SOCKECONNREFUSED == oserrno)
+      reason = RETRY_CONNREFUSED;
+  }
+  else if((result == CURLE_OK) ||
+          (config->fail && (result == CURLE_HTTP_RETURNED_ERROR))) {
+    /* If it returned OK. _or_ failonerror was enabled and it
+       returned due to such an error, check for HTTP transient
+       errors to retry on. */
+    const char *scheme;
+    curl_easy_getinfo(curl, CURLINFO_SCHEME, &scheme);
+    scheme = proto_token(scheme);
+    if(scheme == proto_http || scheme == proto_https) {
+      /* This was HTTP(S) */
+      long response = 0;
+      curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &response);
+
+      switch(response) {
+      case 408: /* Request Timeout */
+      case 429: /* Too Many Requests (RFC6585) */
+      case 500: /* Internal Server Error */
+      case 502: /* Bad Gateway */
+      case 503: /* Service Unavailable */
+      case 504: /* Gateway Timeout */
+      case 522: /* Connection Timed Out (Cloudflare) */
+      case 524: /* Proxy Read Timeout (Cloudflare) */
+        reason = RETRY_HTTP;
+        /*
+         * At this point, we have already written data to the output
+         * file (or terminal). If we write to a file, we must rewind
+         * or close/re-open the file so that the next attempt starts
+         * over from the beginning.
+         *
+         * For the upload case, we might need to start over reading from a
+         * previous point if we have uploaded something when this was
+         * returned.
+         */
+        break;
+      }
+    }
+  } /* if CURLE_OK */
+  else if(result) {
+    const char *scheme;
+    long response = 0;
+
+    curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &response);
+    curl_easy_getinfo(curl, CURLINFO_SCHEME, &scheme);
+    scheme = proto_token(scheme);
+
+    if((scheme == proto_ftp || scheme == proto_ftps) && response / 100 == 4)
+      /*
+       * This is typically when the FTP server only allows a certain
+       * amount of users and we are not one of them. All 4xx codes
+       * are transient.
+       */
+      reason = RETRY_FTP;
+  }
+
+  if(result && !reason && config->retry_all_errors)
+    reason = RETRY_ALL_ERRORS;
+
+  if(reason) {
+    bool truncate = TRUE; /* truncate output file */
+
+    /* how long to wait until next attempt */
+    uint32_t sleeptime;
+
+    *retryp = TRUE;
+
+    sleeptime = retry_sleep(config, per, reason, retryp);
+    if(!*retryp)
+      /* no retry */
+      return CURLE_OK;
+    per->retry_remaining--;
+
+    /* Skip truncation of outfile if auto-resume is enabled for download and
+       the partially received data is good. Only for HTTP GET requests in
+       limited circumstances. */
+    if(is_outfile_auto_resumable(config, per, result)) {
+      long response = 0;
+      struct curl_header *header = NULL;
+      const char *method = NULL, *scheme = NULL;
+
+      curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_METHOD, &method);
+      curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &response);
+      curl_easy_getinfo(curl, CURLINFO_SCHEME, &scheme);
+      scheme = proto_token(scheme);
+
+      if((scheme == proto_http || scheme == proto_https) &&
+         method && !strcmp(method, "GET") &&
+         ((response == 206 && config->resume_from) ||
+          (response == 200 &&
+           !curl_easy_header(curl, "Accept-Ranges", 0,
+                             CURLH_HEADER, -1, &header) &&
+           !strcmp(header->value, "bytes")))) {
+
+        notef("Keeping %" CURL_FORMAT_CURL_OFF_T " bytes", outs->bytes);
+        if(fflush(outs->stream)) {
+          errorf("Failed to flush output file stream");
+          return CURLE_WRITE_ERROR;
+        }
+        if(outs->bytes >= CURL_OFF_T_MAX - outs->init) {
+          errorf("Exceeded maximum supported file size ("
+                 "%" CURL_FORMAT_CURL_OFF_T " + "
+                 "%" CURL_FORMAT_CURL_OFF_T ")",
+                 outs->init, outs->bytes);
+          return CURLE_WRITE_ERROR;
+        }
+        truncate = FALSE;
+        outs->init += outs->bytes;
+        outs->bytes = 0;
+        config->resume_from = outs->init;
+        curl_easy_setopt(curl, CURLOPT_RESUME_FROM_LARGE, config->resume_from);
+      }
+    }
+
+    if(truncate && outs->bytes && outs->filename && outs->stream) {
+      curlx_struct_stat fileinfo;
+
+      /* The output can be a named pipe or a character device etc that
+         cannot be truncated. Only truncate regular files. */
+      if(!curlx_fstat(fileno(outs->stream), &fileinfo) &&
+         S_ISREG(fileinfo.st_mode)) {
+        int rc;
+        /* We have written data to an output file, we truncate file */
+        fflush(outs->stream);
+        notef("Throwing away %" CURL_FORMAT_CURL_OFF_T " bytes", outs->bytes);
+
+        /* truncate file at the position where we started appending */
+        if(toolx_ftruncate(fileno(outs->stream), outs->init)) {
+          /* when truncate fails, we cannot append as then we
+             create something strange, bail out */
+          errorf("Failed to truncate file");
+          return CURLE_WRITE_ERROR;
+        }
+        /* now seek to the end of the file, the position where we
+           truncated the file in a large file-safe way */
+        rc = fseek(outs->stream, 0, SEEK_END);
+
+        if(rc) {
+          errorf("Failed seeking to end of file");
+          return CURLE_WRITE_ERROR;
+        }
+        outs->bytes = 0; /* clear for next round */
+      }
+    }
+    per->num_retries++;
+    *delayms = sleeptime;
+    result = CURLE_OK;
+  }
+  return result;
+}
+
+static CURLcode post_check_result(struct per_transfer *per, CURLcode result)
+{
   struct OperationConfig *config = per->config;
-  int rc;
-
-  if(!curl || !config)
-    return result;
-
-  *retryp = FALSE;
-  *delay = 0; /* for no retry, keep it zero */
-
-  if(per->infdopen)
-    close(per->infd);
 
 #ifdef __VMS
   if(is_vms_shell()) {
@@ -412,34 +612,51 @@ static CURLcode post_per_transfer(struct GlobalConfig *global,
     if(global->silent && !global->showerror)
       vms_show = VMSSTS_HIDE;
   }
-  else
 #endif
-    if(!config->synthetic_error && result &&
-       (!global->silent || global->showerror)) {
-      const char *msg = per->errorbuffer;
-      fprintf(stderr, "curl: (%d) %s\n", result,
-              (msg && msg[0]) ? msg : curl_easy_strerror(result));
-      if(result == CURLE_PEER_FAILED_VERIFICATION)
-        fputs(CURL_CA_CERT_ERRORMSG, stderr);
-    }
-    else if(config->failwithbody) {
-      /* if HTTP response >= 400, return error */
-      long code = 0;
-      curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &code);
-      if(code >= 400) {
-        if(!global->silent || global->showerror)
-          fprintf(stderr,
-                  "curl: (%d) The requested URL returned error: %ld\n",
-                  CURLE_HTTP_RETURNED_ERROR, code);
-        result = CURLE_HTTP_RETURNED_ERROR;
-      }
+  if(!config->synthetic_error && result &&
+     (!global->silent || global->showerror)) {
+    const char *msg = per->errorbuffer;
+    curl_mfprintf(tool_stderr, "curl: (%d) %s\n", (int)result,
+                  msg[0] ? msg : curl_easy_strerror(result));
+    if(result == CURLE_PEER_FAILED_VERIFICATION)
+      fputs(CURL_CA_CERT_ERRORMSG, tool_stderr);
+  }
+  else if(config->fail == FAIL_WITH_BODY) {
+    /* if HTTP response >= 400, return error */
+    long code = 0;
+    curl_easy_getinfo(per->curl, CURLINFO_RESPONSE_CODE, &code);
+    if(code >= 400) {
+      if(!global->silent || global->showerror)
+        curl_mfprintf(tool_stderr,
+                      "curl: (%d) The requested URL returned error: %ld\n",
+                      CURLE_HTTP_RETURNED_ERROR, code);
+      return CURLE_HTTP_RETURNED_ERROR;
     }
+  }
+  return result;
+}
+
+static CURLcode post_output_handling(struct per_transfer *per,
+                                     CURLcode result)
+{
+  struct OutStruct *outs = &per->outs;
+  struct OperationConfig *config = per->config;
+  CURL *curl = per->curl;
+  int rc;
+
+#ifdef _WIN32
+  /* Discard incomplete UTF-8 sequence buffered from body */
+  memset(outs->utf8seq, 0, sizeof(outs->utf8seq));
+#endif
+
   /* Set file extended attributes */
   if(!result && config->xattr && outs->fopened && outs->stream) {
-    rc = fwrite_xattr(curl, per->this_url, fileno(outs->stream));
-    if(rc)
-      warnf(config->global, "Error setting extended attributes on '%s': %s",
-            outs->filename, strerror(errno));
+    rc = fwrite_xattr(curl, per->url, fileno(outs->stream));
+    if(rc) {
+      char errbuf[STRERROR_LEN];
+      warnf("Error setting extended attributes on '%s': %s", outs->filename,
+            curlx_strerror(errno, errbuf, sizeof(errbuf)));
+    }
   }
 
   if(!result && !outs->stream && !outs->bytes) {
@@ -451,1782 +668,865 @@ static CURLcode post_per_transfer(struct GlobalConfig *global,
        data because of unmet condition */
     curl_easy_getinfo(curl, CURLINFO_CONDITION_UNMET, &cond_unmet);
     if(!cond_unmet && !tool_create_output_file(outs, config))
-      result = CURLE_WRITE_ERROR;
+      return CURLE_WRITE_ERROR;
   }
 
-  if(!outs->s_isreg && outs->stream) {
+  if(!outs->regular_file && outs->stream) {
     /* Dump standard stream buffered data */
     rc = fflush(outs->stream);
     if(!result && rc) {
       /* something went wrong in the writing process */
-      result = CURLE_WRITE_ERROR;
-      errorf(global, "Failed writing body");
+      errorf("Failed writing body");
+      return CURLE_WRITE_ERROR;
     }
   }
 
-#ifdef WIN32
-  /* Discard incomplete UTF-8 sequence buffered from body */
-  if(outs->utf8seq[0])
-    memset(outs->utf8seq, 0, sizeof(outs->utf8seq));
-#endif
+  return result;
+}
 
-  /* if retry-max-time is non-zero, make sure we haven't exceeded the
-     time */
-  if(per->retry_numretries &&
-     (!config->retry_maxtime ||
-      (tvdiff(tvnow(), per->retrystart) <
-       config->retry_maxtime*1000L)) ) {
-    enum {
-      RETRY_NO,
-      RETRY_ALL_ERRORS,
-      RETRY_TIMEOUT,
-      RETRY_CONNREFUSED,
-      RETRY_HTTP,
-      RETRY_FTP,
-      RETRY_LAST /* not used */
-    } retry = RETRY_NO;
-    long response = 0;
-    if((CURLE_OPERATION_TIMEDOUT == result) ||
-       (CURLE_COULDNT_RESOLVE_HOST == result) ||
-       (CURLE_COULDNT_RESOLVE_PROXY == result) ||
-       (CURLE_FTP_ACCEPT_TIMEOUT == result))
-      /* retry timeout always */
-      retry = RETRY_TIMEOUT;
-    else if(config->retry_connrefused &&
-            (CURLE_COULDNT_CONNECT == result)) {
-      long oserrno = 0;
-      curl_easy_getinfo(curl, CURLINFO_OS_ERRNO, &oserrno);
-      if(ECONNREFUSED == oserrno)
-        retry = RETRY_CONNREFUSED;
-    }
-    else if((CURLE_OK == result) ||
-            ((config->failonerror || config->failwithbody) &&
-             (CURLE_HTTP_RETURNED_ERROR == result))) {
-      /* If it returned OK. _or_ failonerror was enabled and it
-         returned due to such an error, check for HTTP transient
-         errors to retry on. */
-      const char *scheme;
-      curl_easy_getinfo(curl, CURLINFO_SCHEME, &scheme);
-      scheme = proto_token(scheme);
-      if(scheme == proto_http || scheme == proto_https) {
-        /* This was HTTP(S) */
-        curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &response);
-
-        switch(response) {
-        case 408: /* Request Timeout */
-        case 429: /* Too Many Requests (RFC6585) */
-        case 500: /* Internal Server Error */
-        case 502: /* Bad Gateway */
-        case 503: /* Service Unavailable */
-        case 504: /* Gateway Timeout */
-          retry = RETRY_HTTP;
-          /*
-           * At this point, we have already written data to the output
-           * file (or terminal). If we write to a file, we must rewind
-           * or close/re-open the file so that the next attempt starts
-           * over from the beginning.
-           *
-           * TODO: similar action for the upload case. We might need
-           * to start over reading from a previous point if we have
-           * uploaded something when this was returned.
-           */
-          break;
-        }
-      }
-    } /* if CURLE_OK */
-    else if(result) {
-      const char *scheme;
-
-      curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &response);
-      curl_easy_getinfo(curl, CURLINFO_SCHEME, &scheme);
-      scheme = proto_token(scheme);
-
-      if((scheme == proto_ftp || scheme == proto_ftps) && response / 100 == 4)
-        /*
-         * This is typically when the FTP server only allows a certain
-         * amount of users and we are not one of them.  All 4xx codes
-         * are transient.
-         */
-        retry = RETRY_FTP;
-    }
-
-    if(result && !retry && config->retry_all_errors)
-      retry = RETRY_ALL_ERRORS;
-
-    if(retry) {
-      long sleeptime = 0;
-      curl_off_t retry_after = 0;
-      static const char * const m[]={
-        NULL,
-        "(retrying all errors)",
-        ": timeout",
-        ": connection refused",
-        ": HTTP error",
-        ": FTP error"
-      };
-
-      sleeptime = per->retry_sleep;
-      if(RETRY_HTTP == retry) {
-        curl_easy_getinfo(curl, CURLINFO_RETRY_AFTER, &retry_after);
-        if(retry_after) {
-          /* store in a 'long', make sure it doesn't overflow */
-          if(retry_after > LONG_MAX/1000)
-            sleeptime = LONG_MAX;
-          else
-            sleeptime = (long)retry_after * 1000; /* milliseconds */
-
-          /* if adding retry_after seconds to the process would exceed the
-             maximum time allowed for retrying, then exit the retries right
-             away */
-          if(config->retry_maxtime) {
-            curl_off_t seconds = tvdiff(tvnow(), per->retrystart)/1000;
-
-            if((CURL_OFF_T_MAX - retry_after < seconds) ||
-               (seconds + retry_after > config->retry_maxtime)) {
-              warnf(config->global, "The Retry-After: time would "
-                    "make this command line exceed the maximum allowed time "
-                    "for retries.");
-              goto noretry;
-            }
-          }
-        }
-      }
-      warnf(config->global, "Problem %s. "
-            "Will retry in %ld seconds. "
-            "%ld retries left.",
-            m[retry], sleeptime/1000L, per->retry_numretries);
-
-      per->retry_numretries--;
-      if(!config->retry_delay) {
-        per->retry_sleep *= 2;
-        if(per->retry_sleep > RETRY_SLEEP_MAX)
-          per->retry_sleep = RETRY_SLEEP_MAX;
-      }
-      if(outs->bytes && outs->filename && outs->stream) {
-        /* We have written data to an output file, we truncate file
-         */
-        notef(config->global,
-              "Throwing away %"  CURL_FORMAT_CURL_OFF_T " bytes",
-              outs->bytes);
-        fflush(outs->stream);
-        /* truncate file at the position where we started appending */
-#ifdef HAVE_FTRUNCATE
-        if(ftruncate(fileno(outs->stream), outs->init)) {
-          /* when truncate fails, we can't just append as then we'll
-             create something strange, bail out */
-          errorf(config->global, "Failed to truncate file");
-          return CURLE_WRITE_ERROR;
-        }
-        /* now seek to the end of the file, the position where we
-           just truncated the file in a large file-safe way */
-        rc = fseek(outs->stream, 0, SEEK_END);
-#else
-        /* ftruncate is not available, so just reposition the file
-           to the location we would have truncated it. This won't
-           work properly with large files on 32-bit systems, but
-           most of those will have ftruncate. */
-        rc = fseek(outs->stream, (long)outs->init, SEEK_SET);
-#endif
-        if(rc) {
-          errorf(config->global, "Failed seeking to end of file");
-          return CURLE_WRITE_ERROR;
-        }
-        outs->bytes = 0; /* clear for next round */
-      }
-      *retryp = TRUE;
-      *delay = sleeptime;
-      return CURLE_OK;
-    }
-  } /* if retry_numretries */
-noretry:
-
-  if((global->progressmode == CURL_PROGRESS_BAR) &&
-     per->progressbar.calls)
-    /* if the custom progress bar has been displayed, we output a
-       newline here */
-    fputs("\n", per->progressbar.out);
+static CURLcode post_close_output(struct per_transfer *per,
+                                  CURLcode result)
+{
+  struct OutStruct *outs = &per->outs;
+  struct OperationConfig *config = per->config;
+  int rc;
 
   /* Close the outs file */
   if(outs->fopened && outs->stream) {
-    rc = fclose(outs->stream);
+    rc = curlx_fclose(outs->stream);
     if(!result && rc) {
       /* something went wrong in the writing process */
       result = CURLE_WRITE_ERROR;
-      errorf(config->global, "curl: (%d) Failed writing body", result);
+      errorf("curl: (%d) Failed writing body", (int)result);
     }
     if(result && config->rm_partial) {
-      notef(global, "Removing output file: %s", outs->filename);
-      unlink(outs->filename);
+      curlx_struct_stat st;
+      if(!curlx_stat(outs->filename, &st) && S_ISREG(st.st_mode)) {
+        if(!unlink(outs->filename))
+          notef("Removed output file: %s", outs->filename);
+        else
+          warnf("Failed removing: %s", outs->filename);
+      }
+      else
+        warnf("Skipping removal; not a regular file: %s", outs->filename);
     }
   }
 
-  AmigaSetComment(per, result);
-
   /* File time can only be set _after_ the file has been closed */
-  if(!result && config->remote_time && outs->s_isreg && outs->filename) {
+  if(!result && config->remote_time && outs->regular_file && outs->filename) {
     /* Ask libcurl if we got a remote file time */
     curl_off_t filetime = -1;
-    curl_easy_getinfo(curl, CURLINFO_FILETIME_T, &filetime);
-    setfiletime(filetime, outs->filename, global);
+    curl_easy_getinfo(per->curl, CURLINFO_FILETIME_T, &filetime);
+    if(filetime != -1)
+      setfiletime(filetime, outs->filename);
   }
+  return result;
+}
 
+/*
+ * Call this after a transfer has completed.
+ */
+static CURLcode post_per_transfer(struct per_transfer *per,
+                                  CURLcode result,
+                                  bool *retryp,
+                                  uint32_t *delay) /* milliseconds! */
+{
+  struct OutStruct *outs = &per->outs;
+  struct OperationConfig *config = per->config;
+
+  *retryp = FALSE;
+  *delay = 0; /* for no retry, keep it zero */
+
+  if(!per->curl || !config)
+    return result;
+
+#ifdef _WIN32
+  if(per->uploadfile) {
+    if(!strcmp(per->uploadfile, ".") && per->infd > 0) {
+#ifndef CURL_WINDOWS_UWP
+      sclose(per->infd);
+#else
+      warnf("Closing per->infd != 0: FD == %d. "
+            "This behavior is only supported on desktop Windows", per->infd);
+#endif
+    }
+  }
+  else
+#endif
+    if(per->infdopen)
+      curlx_close(per->infd);
+
+  if(!per->skip) {
+    result = post_check_result(per, result);
+    result = post_output_handling(per, result);
+
+    /* if retry-max-time is non-zero, make sure we have not exceeded the
+       time */
+    if(per->retry_remaining &&
+       (!config->retry_maxtime_ms ||
+        (curlx_timediff_ms(curlx_now(), per->retrystart) <
+         config->retry_maxtime_ms))) {
+      result = retrycheck(config, per, result, retryp, delay);
+      if(!result && *retryp)
+        return CURLE_OK; /* retry! */
+    }
+
+    if((global->progressmode == CURL_PROGRESS_BAR) &&
+       per->progressbar.calls)
+      /* if the custom progress bar has been displayed, we output a
+         newline here */
+      fputs("\n", per->progressbar.out);
+
+    result = post_close_output(per, result);
+  }
   /* Write the --write-out data before cleanup but after result is final */
   if(config->writeout)
     ourWriteOut(config, per, result);
 
   /* Close function-local opened file descriptors */
   if(per->heads.fopened && per->heads.stream)
-    fclose(per->heads.stream);
+    curlx_fclose(per->heads.stream);
 
   if(per->heads.alloc_filename)
-    Curl_safefree(per->heads.filename);
+    curlx_safefree(per->heads.filename);
 
   if(per->etag_save.fopened && per->etag_save.stream)
-    fclose(per->etag_save.stream);
+    curlx_fclose(per->etag_save.stream);
 
   if(per->etag_save.alloc_filename)
-    Curl_safefree(per->etag_save.filename);
+    curlx_safefree(per->etag_save.filename);
 
-  curl_easy_cleanup(per->curl);
   if(outs->alloc_filename)
-    free(outs->filename);
-  free(per->this_url);
-  free(per->outfile);
-  free(per->uploadfile);
-  if(global->parallel)
-    free(per->errorbuffer);
-
+    curlx_safefree(outs->filename);
+  curl_slist_free_all(per->hdrcbdata.headlist);
+  per->hdrcbdata.headlist = NULL;
   return result;
 }
 
-/*
- * Return the protocol token for the scheme used in the given URL
- */
-static const char *url_proto(char *url)
+static CURLcode set_cert_types(struct OperationConfig *config)
 {
-  CURLU *uh = curl_url();
-  const char *proto = NULL;
+  if(feature_ssl) {
+    /* Check if config->cert is a PKCS#11 URI and set the config->cert_type if
+     * necessary */
+    if(config->cert && !config->cert_type && is_pkcs11_uri(config->cert)) {
+      config->cert_type = curlx_strdup("ENG");
+      if(!config->cert_type)
+        return CURLE_OUT_OF_MEMORY;
+    }
 
-  if(uh) {
-    if(url) {
-      if(!curl_url_set(uh, CURLUPART_URL, url,
-                       CURLU_GUESS_SCHEME | CURLU_NON_SUPPORT_SCHEME)) {
-        char *schemep = NULL;
-        if(!curl_url_get(uh, CURLUPART_SCHEME, &schemep,
-                         CURLU_DEFAULT_SCHEME) &&
-           schemep) {
-          proto = proto_token(schemep);
-          curl_free(schemep);
+    /* Check if config->key is a PKCS#11 URI and set the config->key_type if
+     * necessary */
+    if(config->key && !config->key_type && is_pkcs11_uri(config->key)) {
+      config->key_type = curlx_strdup("ENG");
+      if(!config->key_type)
+        return CURLE_OUT_OF_MEMORY;
+    }
+
+    /* Check if config->proxy_cert is a PKCS#11 URI and set the
+     * config->proxy_type if necessary */
+    if(config->proxy_cert && !config->proxy_cert_type &&
+       is_pkcs11_uri(config->proxy_cert)) {
+      config->proxy_cert_type = curlx_strdup("ENG");
+      if(!config->proxy_cert_type)
+        return CURLE_OUT_OF_MEMORY;
+    }
+
+    /* Check if config->proxy_key is a PKCS#11 URI and set the
+     * config->proxy_key_type if necessary */
+    if(config->proxy_key && !config->proxy_key_type &&
+       is_pkcs11_uri(config->proxy_key)) {
+      config->proxy_key_type = curlx_strdup("ENG");
+      if(!config->proxy_key_type)
+        return CURLE_OUT_OF_MEMORY;
+    }
+  }
+  return CURLE_OK;
+}
+
+static CURLcode append2query(struct OperationConfig *config,
+                             struct per_transfer *per,
+                             const char *q)
+{
+  CURLcode result = CURLE_OK;
+  if(q) {
+    CURLU *uh = curl_url();
+    if(uh) {
+      CURLUcode uerr;
+      uerr = curl_url_set(uh, CURLUPART_URL, per->url, CURLU_GUESS_SCHEME);
+      if(uerr) {
+        result = urlerr_cvt(uerr);
+        errorf("(%d) Could not parse the URL, "
+               "failed to set query", (int)result);
+        config->synthetic_error = TRUE;
+      }
+      else {
+        char *updated = NULL;
+        uerr = curl_url_set(uh, CURLUPART_QUERY, q, CURLU_APPENDQUERY);
+        if(!uerr)
+          uerr = curl_url_get(uh, CURLUPART_URL, &updated,
+                              CURLU_NO_GUESS_SCHEME);
+        if(uerr)
+          result = urlerr_cvt(uerr);
+        else {
+          /* use our new URL instead! */
+          curlx_free(per->url); /* free previous URL */
+          /* make it allocated by tool memory */
+          per->url = curlx_strdup(updated);
+          curl_free(updated);
+          if(!per->url)
+            result = CURLE_OUT_OF_MEMORY;
         }
       }
+      curl_url_cleanup(uh);
     }
-    curl_url_cleanup(uh);
+    else
+      result = CURLE_OUT_OF_MEMORY;
   }
-  return proto? proto: "???";   /* Never match if not found. */
+  return result;
+}
+
+static CURLcode etag_compare(struct OperationConfig *config)
+{
+  CURLcode result = CURLE_OK;
+  char *etag_from_file = NULL;
+  char *header = NULL;
+  ParameterError pe;
+
+  /* open file for reading: */
+  FILE *file = curlx_fopen(config->etag_compare_file, FOPEN_READTEXT);
+  if(!file) {
+    char errbuf[STRERROR_LEN];
+    warnf("Failed to open %s: %s", config->etag_compare_file,
+          curlx_strerror(errno, errbuf, sizeof(errbuf)));
+  }
+
+  if((PARAM_OK == file2string(&etag_from_file, file)) &&
+     etag_from_file) {
+    char *h = curl_maprintf("If-None-Match: %s", etag_from_file);
+    curlx_safefree(etag_from_file);
+    if(h) {
+      /* move it to the right memory */
+      header = curlx_strdup(h);
+      curl_free(h);
+    }
+  }
+  else
+    header = curlx_strdup("If-None-Match: \"\"");
+
+  if(!header) {
+    if(file)
+      curlx_fclose(file);
+    errorf("Failed to allocate memory for custom etag header");
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  /* add Etag from file to list of custom headers */
+  pe = add2list(&config->headers, header);
+  curlx_free(header);
+
+  if(file)
+    curlx_fclose(file);
+  if(pe != PARAM_OK)
+    result = CURLE_OUT_OF_MEMORY;
+  return result;
+}
+
+static CURLcode etag_store(struct OperationConfig *config,
+                           struct OutStruct *etag_save,
+                           bool *skip)
+{
+  if(config->create_dirs) {
+    CURLcode result = create_dir_hierarchy(config->etag_save_file);
+    if(result)
+      return result;
+  }
+
+  /* open file for output: */
+  if(strcmp(config->etag_save_file, "-")) {
+    FILE *newfile = curlx_fopen(config->etag_save_file, "ab");
+    if(!newfile) {
+      warnf("Failed creating file for saving etags: \"%s\". "
+            "Skip this transfer", config->etag_save_file);
+      *skip = TRUE;
+      return CURLE_OK;
+    }
+    else {
+      etag_save->filename = config->etag_save_file;
+      etag_save->regular_file = TRUE;
+      etag_save->fopened = TRUE;
+      etag_save->stream = newfile;
+    }
+  }
+  else {
+    /* always use binary mode for protocol header output */
+    CURL_BINMODE(etag_save->stream);
+  }
+  return CURLE_OK;
+}
+
+static CURLcode setup_headerfile(struct OperationConfig *config,
+                                 struct per_transfer *per,
+                                 struct OutStruct *heads)
+{
+  if(config->headerfile) {
+    /* open file for output: */
+    if(!strcmp(config->headerfile, "%")) {
+      heads->stream = stderr;
+      /* use binary mode for protocol header output */
+      CURL_BINMODE(heads->stream);
+    }
+    else if(strcmp(config->headerfile, "-")) {
+      FILE *newfile;
+
+      /*
+       * Since every transfer has its own file handle for dumping
+       * the headers, we need to open it in append mode, since transfers
+       * might finish in any order.
+       * The first transfer clears the file.
+       *
+       * Consider placing the file handle inside the OperationConfig, so
+       * that it does not need to be opened/closed for every transfer.
+       */
+      if(config->create_dirs) {
+        CURLcode result = create_dir_hierarchy(config->headerfile);
+        /* create_dir_hierarchy shows error upon CURLE_WRITE_ERROR */
+        if(result)
+          return result;
+      }
+      if(!per->prev || per->prev->config != config) {
+        newfile = curlx_fopen(config->headerfile, "wb");
+        if(newfile)
+          curlx_fclose(newfile);
+      }
+      newfile = curlx_fopen(config->headerfile, "ab");
+
+      if(!newfile) {
+        errorf("Failed to open %s", config->headerfile);
+        return CURLE_WRITE_ERROR;
+      }
+      else {
+        heads->filename = config->headerfile;
+        heads->regular_file = TRUE;
+        heads->fopened = TRUE;
+        heads->stream = newfile;
+      }
+    }
+    else {
+      /* always use binary mode for protocol header output */
+      CURL_BINMODE(heads->stream);
+    }
+  }
+  return CURLE_OK;
+}
+
+/* figure out and populate per->outfile */
+static CURLcode setup_outfile(struct OperationConfig *config,
+                              struct per_transfer *per,
+                              struct getout *u,
+                              struct OutStruct *outs,
+                              bool *skipped)
+{
+  struct State *state = &global->state;
+
+  outs->out_null = u->out_null;
+  /* if --out-null or output to stdout, return */
+  if(outs->out_null ||
+     (!u->useremote && (!u->outfile || !strcmp("-", u->outfile)))) {
+    per->outfile = u->outfile;
+    u->outfile = NULL;
+    return CURLE_OK;
+  }
+
+  if(!u->outfile) {
+    SANITIZEcode sc;
+    /* extract the filename from the URL */
+    CURLcode result = get_url_file_name(&per->outfile, per->url, &sc);
+    if(sc) {
+      if(sc == SANITIZE_ERR_OUT_OF_MEMORY)
+        return CURLE_OUT_OF_MEMORY;
+      if(sc == SANITIZE_ERR_INVALID_PATH)
+        errorf("bad output filename");
+      return result;
+    }
+    else if(result) {
+      errorf("Failed to extract a filename from the URL to use for storage");
+      return result;
+    }
+  }
+  else if(glob_inuse(&state->urlglob) || glob_inuse(&state->inglob)) {
+    /* expand '#1' ... '#9' references from URL pattern and named references
+       from the upload file glob */
+    SANITIZEcode sc;
+    CURLcode result =
+      glob_match_url(&per->outfile, u->outfile, &state->urlglob,
+                     glob_inuse(&state->inglob) ? &state->inglob : NULL, &sc);
+
+    if(sc) {
+      if(sc == SANITIZE_ERR_OUT_OF_MEMORY)
+        return CURLE_OUT_OF_MEMORY;
+      if(sc == SANITIZE_ERR_INVALID_PATH)
+        warnf("bad output filename");
+      return result;
+    }
+    else if(result) {
+      /* bad globbing */
+      if(state->urlglob.error) {
+        glob_show_error(&state->urlglob, u->outfile, tool_stderr, result);
+        config->synthetic_error = TRUE;
+      }
+      else
+        warnf("bad output glob");
+      return result;
+    }
+    if(!*per->outfile) {
+      warnf("output glob produces empty string");
+      return CURLE_WRITE_ERROR;
+    }
+  }
+  else {
+    per->outfile = curlx_strdup(u->outfile);
+    if(!per->outfile)
+      return CURLE_OUT_OF_MEMORY;
+  }
+
+  DEBUGASSERT(per->outfile);
+
+  if(config->output_dir && *config->output_dir) {
+    char *d = curl_maprintf("%s/%s", config->output_dir, per->outfile);
+    curlx_safefree(per->outfile);
+    if(d) {
+      per->outfile = curlx_strdup(d); /* move to right memory */
+      curl_free(d);
+    }
+    if(!d || !per->outfile)
+      return CURLE_WRITE_ERROR;
+  }
+  /* Create the directory hierarchy, if not pre-existent to a multiple
+     file output call */
+
+  if(config->create_dirs) {
+    CURLcode result = create_dir_hierarchy(per->outfile);
+    /* create_dir_hierarchy shows error upon CURLE_WRITE_ERROR */
+    if(result)
+      return result;
+  }
+
+  if(config->skip_existing) {
+    curlx_struct_stat fileinfo;
+    if(!curlx_stat(per->outfile, &fileinfo)) {
+      /* file is present */
+      notef("skips transfer, \"%s\" exists locally", per->outfile);
+      per->skip = TRUE;
+      *skipped = TRUE;
+    }
+  }
+
+  if(config->resume_from_current) {
+    /* We are told to continue from where we are now. Get the size
+       of the file as it is now and open it for append instead */
+    curlx_struct_stat fileinfo;
+    /* VMS -- Danger, the filesize is only valid for stream files */
+    if(curlx_stat(per->outfile, &fileinfo) == 0)
+      /* set offset to current file size: */
+      config->resume_from = fileinfo.st_size;
+    else
+      /* let offset be 0 */
+      config->resume_from = 0;
+  }
+
+  if(config->resume_from) {
+#ifdef __VMS
+    /* open file for output, forcing VMS output format into stream
+       mode which is needed for stat() call above to always work. */
+    FILE *file = curlx_fopen(per->outfile, "ab",
+                             "ctx=stm", "rfm=stmlf", "rat=cr", "mrs=0");
+#else
+    /* open file for output: */
+    FILE *file = curlx_fopen(per->outfile, "ab");
+#endif
+    if(!file) {
+      errorf("cannot open '%s'", per->outfile);
+      return CURLE_WRITE_ERROR;
+    }
+    outs->fopened = TRUE;
+    outs->stream = file;
+    outs->init = config->resume_from;
+  }
+  else {
+    outs->stream = NULL; /* open when needed */
+  }
+  outs->filename = per->outfile;
+  outs->regular_file = TRUE;
+  return CURLE_OK;
+}
+
+static void check_stdin_upload(struct OperationConfig *config,
+                               struct per_transfer *per)
+{
+  /* count to see if there are more than one auth bit set
+     in the authtype field */
+  int authbits = 0;
+  int bitcheck = 0;
+  while(bitcheck < 32) {
+    if(config->authtype & (1UL << bitcheck++)) {
+      authbits++;
+      if(authbits > 1) {
+        /* more than one, we are done! */
+        break;
+      }
+    }
+  }
+
+  /*
+   * If the user has also selected --anyauth or --proxy-anyauth
+   * we should warn them.
+   */
+  if(config->proxyanyauth || (authbits > 1)) {
+    warnf("Using --anyauth or --proxy-anyauth with upload from stdin"
+          " involves a big risk of it not working. Use a temporary"
+          " file or a fixed auth type instead");
+  }
+
+  DEBUGASSERT(per->infdopen == FALSE);
+  DEBUGASSERT(per->infd == STDIN_FILENO);
+
+  CURL_BINMODE(stdin);
+  if(!strcmp(per->uploadfile, ".")) {
+#if defined(USE_WINSOCK) && !defined(CURL_WINDOWS_UWP)
+    /* non-blocking stdin behavior on Windows is challenging
+       Spawn a new thread that reads from stdin and write
+       out to a socket */
+    curl_socket_t f = win32_stdin_read_thread();
+
+    if(f == CURL_SOCKET_BAD)
+      warnf("win32_stdin_read_thread returned INVALID_SOCKET "
+            "falling back to blocking mode");
+    else if(f > INT_MAX) {
+      warnf("win32_stdin_read_thread returned identifier "
+            "larger than INT_MAX. This should not happen unless "
+            "the upper 32 bits of a Windows socket have started "
+            "being used for something... falling back to blocking "
+            "mode");
+      sclose(f);
+    }
+    else
+      per->infd = (int)f;
+#endif
+    if(curlx_nonblock((curl_socket_t)per->infd, TRUE) < 0) {
+      char errbuf[STRERROR_LEN];
+      warnf("fcntl failed on fd=%d: %s", per->infd,
+            curlx_strerror(errno, errbuf, sizeof(errbuf)));
+    }
+  }
+}
+
+static void setup_header_cb(struct OperationConfig *config,
+                            struct HdrCbData *hdrcbdata,
+                            struct getout *u,
+                            struct OutStruct *outs,
+                            struct OutStruct *heads,
+                            struct OutStruct *etag)
+{
+  hdrcbdata->honor_cd_filename = (config->content_disposition && u->useremote);
+  hdrcbdata->outs = outs;
+  hdrcbdata->heads = heads;
+  hdrcbdata->etag_save = etag;
+  hdrcbdata->config = config;
+}
+
+static CURLcode setup_input_file(struct OperationConfig *config,
+                                 struct State *state, struct getout *u,
+                                 FILE *err)
+{
+  CURLcode result = CURLE_OK;
+  if(u->infile) {
+    if(!config->globoff && !glob_inuse(&state->inglob))
+      result = glob_url(&state->inglob, u->infile, &state->upnum, err);
+    if(!result && !state->uploadfile) {
+      if(glob_inuse(&state->inglob))
+        result = glob_next_url(&state->uploadfile, &state->inglob);
+      else if(!state->upidx) {
+        /* copy the allocated string */
+        state->uploadfile = u->infile;
+        u->infile = NULL;
+      }
+    }
+  }
+  return result;
+}
+
+static CURLcode setup_url_pattern(struct OperationConfig *config,
+                                  struct State *state, struct getout *u,
+                                  FILE *err)
+{
+  CURLcode result = CURLE_OK;
+  if(!state->urlnum) {
+    if(!config->globoff && !u->noglob) {
+      /* Unless explicitly shut off, we expand '{...}' and '[...]'
+         expressions and return total number of URLs in pattern set */
+      result = glob_url(&state->urlglob, u->url, &state->urlnum, err);
+    }
+    else
+      state->urlnum = 1; /* without globbing, this is a single URL */
+  }
+  return result;
+}
+
+static CURLcode setup_etag_files(struct OperationConfig *config,
+                                 struct OutStruct *etag_save,
+                                 bool *break_loop)
+{
+  CURLcode result = CURLE_OK;
+  *break_loop = FALSE;
+
+  /* --etag-save */
+  memset(etag_save, 0, sizeof(*etag_save));
+  etag_save->stream = stdout;
+
+  /* --etag-compare */
+  if(config->etag_compare_file) {
+    result = etag_compare(config);
+    if(result)
+      return result;
+  }
+
+  if(config->etag_save_file) {
+    bool badetag = FALSE;
+    result = etag_store(config, etag_save, &badetag);
+    if(result || badetag) {
+      *break_loop = TRUE;
+      return result;
+    }
+  }
+  return result;
+}
+
+static CURLcode select_next_url(struct State *state,
+                                struct getout *u,
+                                char **url)
+{
+  CURLcode result = CURLE_OK;
+  if(glob_inuse(&state->urlglob))
+    result = glob_next_url(url, &state->urlglob);
+  else if(!state->urlidx) {
+    *url = curlx_strdup(u->url);
+    if(!*url)
+      result = CURLE_OUT_OF_MEMORY;
+  }
+  else
+    *url = NULL;
+  return result;
+}
+
+static CURLcode setup_transfer_upload(struct OperationConfig *config,
+                                      struct per_transfer *per)
+{
+  CURLcode result = CURLE_OK;
+  if(per->uploadfile) {
+    if(stdin_upload(per->uploadfile))
+      check_stdin_upload(config, per);
+    else {
+      /* We have specified a file to upload and it is not "-" */
+      result = add_file_name_to_url(per->curl, &per->url, per->uploadfile);
+      if(result)
+        return result;
+    }
+
+    if(config->resume_from_current)
+      config->resume_from = -1; /* -1 then forces get-it-yourself */
+  }
+  return result;
+}
+
+/* create a transfer */
+static CURLcode create_single(struct OperationConfig *config,
+                              CURLSH *share, struct State *state,
+                              bool *added, bool *skipped)
+{
+  const bool orig_isatty = (bool)global->isatty;
+  const bool orig_noprogress = (bool)global->noprogress;
+  CURLcode result = CURLE_OK;
+  while(state->urlnode) {
+    struct per_transfer *per = NULL;
+    struct OutStruct *outs;
+    struct OutStruct *heads;
+    struct OutStruct etag_first;
+    CURL *curl;
+    struct getout *u = state->urlnode;
+    FILE *err = (!global->silent || global->showerror) ? tool_stderr : NULL;
+    bool break_loop = FALSE;
+
+    if(!u->url) {
+      /* This node has no URL. End of the road. */
+      warnf("Got more output options than URLs");
+      break;
+    }
+
+    result = setup_input_file(config, state, u, err);
+    if(result)
+      return result;
+
+    if(state->upidx >= state->upnum) {
+      state->urlnum = 0;
+      curlx_safefree(state->uploadfile);
+      glob_cleanup(&state->inglob);
+      state->upidx = 0;
+      state->urlnode = u->next; /* next node */
+      state->upnum = 1;
+      continue;
+    }
+
+    result = setup_url_pattern(config, state, u, err);
+    if(result)
+      return result;
+
+    result = setup_etag_files(config, &etag_first, &break_loop);
+    if(result || break_loop)
+      return result;
+
+    curl = curl_easy_init();
+    if(curl)
+      result = add_per_transfer(&per);
+    else
+      result = CURLE_OUT_OF_MEMORY;
+    if(result) {
+      curl_easy_cleanup(curl);
+      if(etag_first.fopened)
+        curlx_fclose(etag_first.stream);
+      return result;
+    }
+    per->etag_save = etag_first; /* copy the whole struct */
+    if(state->uploadfile) {
+      per->uploadfile = curlx_strdup(state->uploadfile);
+      if(!per->uploadfile ||
+         SetHTTPrequest(TOOL_HTTPREQ_PUT, &config->httpreq)) {
+        curlx_safefree(per->uploadfile);
+        curl_easy_cleanup(curl);
+        return CURLE_FAILED_INIT;
+      }
+    }
+    per->config = config;
+    per->curl = curl;
+    per->urlnum = u->num;
+
+    /* default headers output stream is stdout */
+    heads = &per->heads;
+    heads->stream = stdout;
+
+    /* Single header file for all URLs */
+    result = setup_headerfile(config, per, heads);
+    if(result)
+      return result;
+    outs = &per->outs;
+
+    per->infdopen = FALSE;
+    per->infd = STDIN_FILENO;
+
+    /* default output stream is stdout */
+    outs->stream = stdout;
+
+    result = select_next_url(state, u, &per->url);
+    if(result)
+      return result;
+    if(!per->url)
+      break;
+
+    result = setup_outfile(config, per, u, outs, skipped);
+    if(result)
+      return result;
+
+    result = setup_transfer_upload(config, per);
+    if(result)
+      return result;
+
+    if(!outs->out_null && output_expected(per->url, per->uploadfile) &&
+       outs->stream && isatty(fileno(outs->stream)))
+      /* we send the output to a tty, therefore we switch off the progress
+         meter */
+      per->noprogress = global->noprogress = global->isatty = TRUE;
+    else {
+      /* progress meter is per download, so restore config values */
+      per->noprogress = global->noprogress = orig_noprogress;
+      global->isatty = orig_isatty;
+    }
+
+    result = append2query(config, per, config->httpgetfields);
+    if(result)
+      return result;
+
+    if((!per->outfile || !strcmp(per->outfile, "-")) &&
+       !config->use_ascii) {
+      /* We get the output to stdout and we have not got the ASCII/text flag,
+         then set stdout to be binary */
+      CURL_BINMODE(stdout);
+    }
+
+    /* explicitly passed to stdout means okaying binary gunk */
+    config->terminal_binary_ok = (per->outfile && !strcmp(per->outfile, "-"));
+
+    setup_header_cb(config, &per->hdrcbdata, u, outs, heads, &etag_first);
+
+    result = config2setopts(config, per, curl, share);
+    if(result)
+      return result;
+
+    /* initialize retry vars for loop below */
+    per->retry_sleep_default = config->retry_delay_ms;
+    per->retry_remaining = config->req_retry;
+    per->retry_sleep = per->retry_sleep_default; /* ms */
+    per->retrystart = curlx_now();
+
+    /* Here's looping around each globbed URL */
+    if(++state->urlidx >= state->urlnum) {
+      state->urlidx = state->urlnum = 0;
+      glob_cleanup(&state->urlglob);
+      state->upidx++;
+      curlx_safefree(state->uploadfile); /* clear it to get the next */
+    }
+    *added = TRUE;
+    break;
+  }
+  return result;
 }
 
 /* create the next (singular) transfer */
-static CURLcode single_transfer(struct GlobalConfig *global,
-                                struct OperationConfig *config,
-                                CURLSH *share,
-                                bool capath_from_env,
-                                bool *added)
+static CURLcode single_transfer(struct OperationConfig *config,
+                                CURLSH *share, bool *added, bool *skipped)
 {
   CURLcode result = CURLE_OK;
-  struct getout *urlnode;
-  bool orig_noprogress = global->noprogress;
-  bool orig_isatty = global->isatty;
-  struct State *state = &config->state;
-  char *httpgetfields = state->httpgetfields;
-  *added = FALSE; /* not yet */
+  struct State *state = &global->state;
+  char *httpgetfields = config->httpgetfields;
+
+  *skipped = *added = FALSE; /* not yet */
 
   if(config->postfields) {
     if(config->use_httpget) {
       if(!httpgetfields) {
         /* Use the postfields data for an HTTP get */
-        httpgetfields = state->httpgetfields = strdup(config->postfields);
-        Curl_safefree(config->postfields);
-        if(!httpgetfields) {
-          errorf(global, "out of memory");
-          result = CURLE_OUT_OF_MEMORY;
-        }
-        else if(SetHTTPrequest(config,
-                               (config->no_body?HTTPREQ_HEAD:HTTPREQ_GET),
-                               &config->httpreq)) {
-          result = CURLE_FAILED_INIT;
-        }
+        httpgetfields = config->httpgetfields = config->postfields;
+        config->postfields = NULL;
+        if(SetHTTPrequest((config->no_body ? TOOL_HTTPREQ_HEAD :
+                           TOOL_HTTPREQ_GET), &config->httpreq))
+          return CURLE_FAILED_INIT;
       }
     }
-    else {
-      if(SetHTTPrequest(config, HTTPREQ_SIMPLEPOST, &config->httpreq))
-        result = CURLE_FAILED_INIT;
-    }
-    if(result) {
-      single_transfer_cleanup(config);
-      return result;
-    }
+    else if(SetHTTPrequest(TOOL_HTTPREQ_SIMPLEPOST, &config->httpreq))
+      return CURLE_FAILED_INIT;
   }
+  if(!httpgetfields)
+    config->httpgetfields = config->query;
+
+  result = set_cert_types(config);
+  if(result)
+    return result;
+
   if(!state->urlnode) {
     /* first time caller, setup things */
     state->urlnode = config->url_list;
-    state->infilenum = 1;
+    state->upnum = 1;
   }
 
-  while(config->state.urlnode) {
-    static bool warn_more_options = FALSE;
-    char *infiles; /* might be a glob pattern */
-    struct URLGlob *inglob = state->inglob;
-    urlnode = config->state.urlnode;
-
-    /* urlnode->url is the full URL (it might be NULL) */
-
-    if(!urlnode->url) {
-      /* This node has no URL. Free node data without destroying the
-         node itself nor modifying next pointer and continue to next */
-      Curl_safefree(urlnode->outfile);
-      Curl_safefree(urlnode->infile);
-      urlnode->flags = 0;
-      config->state.urlnode = urlnode->next;
-      state->up = 0;
-      if(!warn_more_options) {
-        /* only show this once */
-        warnf(config->global, "Got more output options than URLs");
-        warn_more_options = TRUE;
-      }
-      continue; /* next URL please */
-    }
-
-    /* save outfile pattern before expansion */
-    if(urlnode->outfile && !state->outfiles) {
-      state->outfiles = strdup(urlnode->outfile);
-      if(!state->outfiles) {
-        errorf(global, "out of memory");
-        result = CURLE_OUT_OF_MEMORY;
-        break;
-      }
-    }
-
-    infiles = urlnode->infile;
-
-    if(!config->globoff && infiles && !inglob) {
-      /* Unless explicitly shut off */
-      result = glob_url(&inglob, infiles, &state->infilenum,
-                        (!global->silent || global->showerror)?
-                        stderr:NULL);
-      if(result)
-        break;
-      config->state.inglob = inglob;
-    }
-
-    {
-      curl_off_t urlnum;
-
-      if(!state->up && !infiles)
-        Curl_nop_stmt;
-      else {
-        if(!state->uploadfile) {
-          if(inglob) {
-            result = glob_next_url(&state->uploadfile, inglob);
-            if(result == CURLE_OUT_OF_MEMORY)
-              errorf(global, "out of memory");
-          }
-          else if(!state->up) {
-            state->uploadfile = strdup(infiles);
-            if(!state->uploadfile) {
-              errorf(global, "out of memory");
-              result = CURLE_OUT_OF_MEMORY;
-            }
-          }
-        }
-        if(result)
-          break;
-      }
-
-      if(!state->urlnum) {
-        if(!config->globoff) {
-          /* Unless explicitly shut off, we expand '{...}' and '[...]'
-             expressions and return total number of URLs in pattern set */
-          result = glob_url(&state->urls, urlnode->url, &state->urlnum,
-                            (!global->silent || global->showerror)?
-                            stderr:NULL);
-          if(result)
-            break;
-          urlnum = state->urlnum;
-        }
-        else
-          urlnum = 1; /* without globbing, this is a single URL */
-      }
-      else
-        urlnum = state->urlnum;
-
-      if(state->up < state->infilenum) {
-        struct per_transfer *per = NULL;
-        struct OutStruct *outs;
-        struct OutStruct *heads;
-        struct OutStruct *etag_save;
-        struct HdrCbData *hdrcbdata = NULL;
-        struct OutStruct etag_first;
-        const char *use_proto;
-        CURL *curl;
-
-        /* --etag-save */
-        memset(&etag_first, 0, sizeof(etag_first));
-        etag_save = &etag_first;
-        etag_save->stream = stdout;
-
-        /* --etag-compare */
-        if(config->etag_compare_file) {
-          char *etag_from_file = NULL;
-          char *header = NULL;
-          ParameterError pe;
-
-          /* open file for reading: */
-          FILE *file = fopen(config->etag_compare_file, FOPEN_READTEXT);
-          if(!file && !config->etag_save_file) {
-            errorf(global,
-                   "Failed to open %s", config->etag_compare_file);
-            result = CURLE_READ_ERROR;
-            break;
-          }
-
-          if((PARAM_OK == file2string(&etag_from_file, file)) &&
-             etag_from_file) {
-            header = aprintf("If-None-Match: %s", etag_from_file);
-            Curl_safefree(etag_from_file);
-          }
-          else
-            header = aprintf("If-None-Match: \"\"");
-
-          if(!header) {
-            if(file)
-              fclose(file);
-            errorf(global,
-                   "Failed to allocate memory for custom etag header");
-            result = CURLE_OUT_OF_MEMORY;
-            break;
-          }
-
-          /* add Etag from file to list of custom headers */
-          pe = add2list(&config->headers, header);
-          Curl_safefree(header);
-
-          if(file)
-            fclose(file);
-          if(pe != PARAM_OK) {
-            result = CURLE_OUT_OF_MEMORY;
-            break;
-          }
-        }
-
-        if(config->etag_save_file) {
-          /* open file for output: */
-          if(strcmp(config->etag_save_file, "-")) {
-            FILE *newfile = fopen(config->etag_save_file, "wb");
-            if(!newfile) {
-              warnf(global, "Failed creating file for saving etags: \"%s\". "
-                    "Skip this transfer", config->etag_save_file);
-              Curl_safefree(state->outfiles);
-              glob_cleanup(state->urls);
-              return CURLE_OK;
-            }
-            else {
-              etag_save->filename = config->etag_save_file;
-              etag_save->s_isreg = TRUE;
-              etag_save->fopened = TRUE;
-              etag_save->stream = newfile;
-            }
-          }
-          else {
-            /* always use binary mode for protocol header output */
-            set_binmode(etag_save->stream);
-          }
-        }
-
-        curl = curl_easy_init();
-        if(curl)
-          result = add_per_transfer(&per);
-        else
-          result = CURLE_OUT_OF_MEMORY;
-        if(result) {
-          curl_easy_cleanup(curl);
-          if(etag_save->fopened)
-            fclose(etag_save->stream);
-          break;
-        }
-        per->etag_save = etag_first; /* copy the whole struct */
-        if(state->uploadfile) {
-          per->uploadfile = strdup(state->uploadfile);
-          if(!per->uploadfile) {
-            curl_easy_cleanup(curl);
-            result = CURLE_OUT_OF_MEMORY;
-            break;
-          }
-          if(SetHTTPrequest(config, HTTPREQ_PUT, &config->httpreq)) {
-            Curl_safefree(per->uploadfile);
-            curl_easy_cleanup(curl);
-            result = CURLE_FAILED_INIT;
-            break;
-          }
-        }
-        *added = TRUE;
-        per->config = config;
-        per->curl = curl;
-        per->urlnum = urlnode->num;
-
-        /* default headers output stream is stdout */
-        heads = &per->heads;
-        heads->stream = stdout;
-
-        /* Single header file for all URLs */
-        if(config->headerfile) {
-          /* open file for output: */
-          if(strcmp(config->headerfile, "-")) {
-            FILE *newfile;
-
-            /*
-             * Since every transfer has its own file handle for dumping
-             * the headers, we need to open it in append mode, since transfers
-             * might finish in any order.
-             * The first transfer just clears the file.
-             * TODO: Consider placing the file handle inside the
-             * OperationConfig, so that it does not need to be opened/closed
-             * for every transfer.
-             */
-            if(!per->prev || per->prev->config != config) {
-              newfile = fopen(config->headerfile, "wb");
-              if(newfile)
-                fclose(newfile);
-            }
-            newfile = fopen(config->headerfile, "ab");
-
-            if(!newfile) {
-              errorf(global, "Failed to open %s", config->headerfile);
-              result = CURLE_WRITE_ERROR;
-              break;
-            }
-            else {
-              heads->filename = config->headerfile;
-              heads->s_isreg = TRUE;
-              heads->fopened = TRUE;
-              heads->stream = newfile;
-            }
-          }
-          else {
-            /* always use binary mode for protocol header output */
-            set_binmode(heads->stream);
-          }
-        }
-
-        hdrcbdata = &per->hdrcbdata;
-
-        outs = &per->outs;
-
-        per->outfile = NULL;
-        per->infdopen = FALSE;
-        per->infd = STDIN_FILENO;
-
-        /* default output stream is stdout */
-        outs->stream = stdout;
-
-        if(state->urls) {
-          result = glob_next_url(&per->this_url, state->urls);
-          if(result)
-            break;
-        }
-        else if(!state->li) {
-          per->this_url = strdup(urlnode->url);
-          if(!per->this_url) {
-            result = CURLE_OUT_OF_MEMORY;
-            break;
-          }
-        }
-        else
-          per->this_url = NULL;
-        if(!per->this_url)
-          break;
-
-        if(state->outfiles) {
-          per->outfile = strdup(state->outfiles);
-          if(!per->outfile) {
-            result = CURLE_OUT_OF_MEMORY;
-            break;
-          }
-        }
-
-        if(((urlnode->flags&GETOUT_USEREMOTE) ||
-            (per->outfile && strcmp("-", per->outfile)))) {
-
-          /*
-           * We have specified a file name to store the result in, or we have
-           * decided we want to use the remote file name.
-           */
-
-          if(!per->outfile) {
-            /* extract the file name from the URL */
-            result = get_url_file_name(&per->outfile, per->this_url);
-            if(result) {
-              errorf(global, "Failed to extract a sensible file name"
-                     " from the URL to use for storage");
-              break;
-            }
-            if(!*per->outfile && !config->content_disposition) {
-              errorf(global, "Remote file name has no length");
-              result = CURLE_WRITE_ERROR;
-              break;
-            }
-          }
-          else if(state->urls) {
-            /* fill '#1' ... '#9' terms from URL pattern */
-            char *storefile = per->outfile;
-            result = glob_match_url(&per->outfile, storefile, state->urls);
-            Curl_safefree(storefile);
-            if(result) {
-              /* bad globbing */
-              warnf(global, "bad output glob");
-              break;
-            }
-            if(!*per->outfile) {
-              warnf(global, "output glob produces empty string");
-              result = CURLE_WRITE_ERROR;
-              break;
-            }
-          }
-
-          if(config->output_dir && *config->output_dir) {
-            char *d = aprintf("%s/%s", config->output_dir, per->outfile);
-            if(!d) {
-              result = CURLE_WRITE_ERROR;
-              break;
-            }
-            free(per->outfile);
-            per->outfile = d;
-          }
-          /* Create the directory hierarchy, if not pre-existent to a multiple
-             file output call */
-
-          if(config->create_dirs) {
-            result = create_dir_hierarchy(per->outfile, global);
-            /* create_dir_hierarchy shows error upon CURLE_WRITE_ERROR */
-            if(result)
-              break;
-          }
-
-          if((urlnode->flags & GETOUT_USEREMOTE)
-             && config->content_disposition) {
-            /* Our header callback MIGHT set the filename */
-            DEBUGASSERT(!outs->filename);
-          }
-
-          if(config->resume_from_current) {
-            /* We're told to continue from where we are now. Get the size
-               of the file as it is now and open it for append instead */
-            struct_stat fileinfo;
-            /* VMS -- Danger, the filesize is only valid for stream files */
-            if(0 == stat(per->outfile, &fileinfo))
-              /* set offset to current file size: */
-              config->resume_from = fileinfo.st_size;
-            else
-              /* let offset be 0 */
-              config->resume_from = 0;
-          }
-
-          if(config->resume_from) {
-#ifdef __VMS
-            /* open file for output, forcing VMS output format into stream
-               mode which is needed for stat() call above to always work. */
-            FILE *file = fopen(outfile, "ab",
-                               "ctx=stm", "rfm=stmlf", "rat=cr", "mrs=0");
-#else
-            /* open file for output: */
-            FILE *file = fopen(per->outfile, "ab");
-#endif
-            if(!file) {
-              errorf(global, "Can't open '%s'", per->outfile);
-              result = CURLE_WRITE_ERROR;
-              break;
-            }
-            outs->fopened = TRUE;
-            outs->stream = file;
-            outs->init = config->resume_from;
-          }
-          else {
-            outs->stream = NULL; /* open when needed */
-          }
-          outs->filename = per->outfile;
-          outs->s_isreg = TRUE;
-        }
-
-        if(per->uploadfile && !stdin_upload(per->uploadfile)) {
-          /*
-           * We have specified a file to upload and it isn't "-".
-           */
-          result = add_file_name_to_url(per->curl, &per->this_url,
-                                        per->uploadfile);
-          if(result)
-            break;
-        }
-        else if(per->uploadfile && stdin_upload(per->uploadfile)) {
-          /* count to see if there are more than one auth bit set
-             in the authtype field */
-          int authbits = 0;
-          int bitcheck = 0;
-          while(bitcheck < 32) {
-            if(config->authtype & (1UL << bitcheck++)) {
-              authbits++;
-              if(authbits > 1) {
-                /* more than one, we're done! */
-                break;
-              }
-            }
-          }
-
-          /*
-           * If the user has also selected --anyauth or --proxy-anyauth
-           * we should warn them.
-           */
-          if(config->proxyanyauth || (authbits>1)) {
-            warnf(global,
-                  "Using --anyauth or --proxy-anyauth with upload from stdin"
-                  " involves a big risk of it not working. Use a temporary"
-                  " file or a fixed auth type instead");
-          }
-
-          DEBUGASSERT(per->infdopen == FALSE);
-          DEBUGASSERT(per->infd == STDIN_FILENO);
-
-          set_binmode(stdin);
-          if(!strcmp(per->uploadfile, ".")) {
-            if(curlx_nonblock((curl_socket_t)per->infd, TRUE) < 0)
-              warnf(global,
-                    "fcntl failed on fd=%d: %s", per->infd, strerror(errno));
-          }
-        }
-
-        if(per->uploadfile && config->resume_from_current)
-          config->resume_from = -1; /* -1 will then force get-it-yourself */
-
-        if(output_expected(per->this_url, per->uploadfile) && outs->stream &&
-           isatty(fileno(outs->stream)))
-          /* we send the output to a tty, therefore we switch off the progress
-             meter */
-          per->noprogress = global->noprogress = global->isatty = TRUE;
-        else {
-          /* progress meter is per download, so restore config
-             values */
-          per->noprogress = global->noprogress = orig_noprogress;
-          global->isatty = orig_isatty;
-        }
-
-        if(httpgetfields || config->query) {
-          char *q = httpgetfields ? httpgetfields : config->query;
-          CURLU *uh = curl_url();
-          if(uh) {
-            CURLUcode uerr;
-            uerr = curl_url_set(uh, CURLUPART_URL, per->this_url,
-                            CURLU_GUESS_SCHEME);
-            if(uerr) {
-              result = urlerr_cvt(uerr);
-              errorf(global, "(%d) Could not parse the URL, "
-                     "failed to set query", result);
-              config->synthetic_error = TRUE;
-            }
-            else {
-              char *updated = NULL;
-              uerr = curl_url_set(uh, CURLUPART_QUERY, q, CURLU_APPENDQUERY);
-              if(!uerr)
-                uerr = curl_url_get(uh, CURLUPART_URL, &updated,
-                                   CURLU_GUESS_SCHEME);
-              if(uerr)
-                result = urlerr_cvt(uerr);
-              else {
-                Curl_safefree(per->this_url); /* free previous URL */
-                per->this_url = updated; /* use our new URL instead! */
-              }
-            }
-            curl_url_cleanup(uh);
-            if(result)
-              break;
-          }
-        }
-
-        if((!per->outfile || !strcmp(per->outfile, "-")) &&
-           !config->use_ascii) {
-          /* We get the output to stdout and we have not got the ASCII/text
-             flag, then set stdout to be binary */
-          set_binmode(stdout);
-        }
-
-        /* explicitly passed to stdout means okaying binary gunk */
-        config->terminal_binary_ok =
-          (per->outfile && !strcmp(per->outfile, "-"));
-
-        /* Avoid having this setopt added to the --libcurl source output. */
-        result = curl_easy_setopt(curl, CURLOPT_SHARE, share);
-        if(result)
-          break;
-
-        use_proto = url_proto(per->this_url);
-
-        /* On most modern OSes, exiting works thoroughly,
-           we'll clean everything up via exit(), so don't bother with
-           slow cleanups. Crappy ones might need to skip this.
-           Note: avoid having this setopt added to the --libcurl source
-           output. */
-        result = curl_easy_setopt(curl, CURLOPT_QUICK_EXIT, 1L);
-        if(result)
-          break;
-
-        if(!config->tcp_nodelay)
-          my_setopt(curl, CURLOPT_TCP_NODELAY, 0L);
-
-        if(config->tcp_fastopen)
-          my_setopt(curl, CURLOPT_TCP_FASTOPEN, 1L);
-
-        /* where to store */
-        my_setopt(curl, CURLOPT_WRITEDATA, per);
-        my_setopt(curl, CURLOPT_INTERLEAVEDATA, per);
-
-        /* what call to write */
-        my_setopt(curl, CURLOPT_WRITEFUNCTION, tool_write_cb);
-
-        /* Note that if CURLOPT_READFUNCTION is fread (the default), then
-         * lib/telnet.c will Curl_poll() on the input file descriptor
-         * rather than calling the READFUNCTION at regular intervals.
-         * The circumstances in which it is preferable to enable this
-         * behavior, by omitting to set the READFUNCTION & READDATA options,
-         * have not been determined.
-         */
-        my_setopt(curl, CURLOPT_READDATA, per);
-        /* what call to read */
-        my_setopt(curl, CURLOPT_READFUNCTION, tool_read_cb);
-
-        /* in 7.18.0, the CURLOPT_SEEKFUNCTION/DATA pair is taking over what
-           CURLOPT_IOCTLFUNCTION/DATA pair previously provided for seeking */
-        my_setopt(curl, CURLOPT_SEEKDATA, per);
-        my_setopt(curl, CURLOPT_SEEKFUNCTION, tool_seek_cb);
-
-        {
-#ifdef CURLDEBUG
-          char *env = getenv("CURL_BUFFERSIZE");
-          if(env) {
-            long size = strtol(env, NULL, 10);
-            if(size)
-              my_setopt(curl, CURLOPT_BUFFERSIZE, size);
-          }
-          else
-#endif
-          if(config->recvpersecond &&
-             (config->recvpersecond < BUFFER_SIZE))
-            /* use a smaller sized buffer for better sleeps */
-            my_setopt(curl, CURLOPT_BUFFERSIZE, (long)config->recvpersecond);
-          else
-            my_setopt(curl, CURLOPT_BUFFERSIZE, (long)BUFFER_SIZE);
-        }
-
-        my_setopt_str(curl, CURLOPT_URL, per->this_url);
-        my_setopt(curl, CURLOPT_NOPROGRESS,
-                  global->noprogress || global->silent?1L:0L);
-        if(config->no_body)
-          my_setopt(curl, CURLOPT_NOBODY, 1L);
-
-        if(config->oauth_bearer)
-          my_setopt_str(curl, CURLOPT_XOAUTH2_BEARER, config->oauth_bearer);
-
-        my_setopt_str(curl, CURLOPT_PROXY, config->proxy);
-
-        if(config->proxy && result) {
-          errorf(global, "proxy support is disabled in this libcurl");
-          config->synthetic_error = TRUE;
-          result = CURLE_NOT_BUILT_IN;
-          break;
-        }
-
-        /* new in libcurl 7.5 */
-        if(config->proxy)
-          my_setopt_enum(curl, CURLOPT_PROXYTYPE, config->proxyver);
-
-        my_setopt_str(curl, CURLOPT_PROXYUSERPWD, config->proxyuserpwd);
-
-        /* new in libcurl 7.3 */
-        my_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, config->proxytunnel?1L:0L);
-
-        /* new in libcurl 7.52.0 */
-        if(config->preproxy)
-          my_setopt_str(curl, CURLOPT_PRE_PROXY, config->preproxy);
-
-        /* new in libcurl 7.10.6 */
-        if(config->proxyanyauth)
-          my_setopt_bitmask(curl, CURLOPT_PROXYAUTH,
-                            (long)CURLAUTH_ANY);
-        else if(config->proxynegotiate)
-          my_setopt_bitmask(curl, CURLOPT_PROXYAUTH,
-                            (long)CURLAUTH_GSSNEGOTIATE);
-        else if(config->proxyntlm)
-          my_setopt_bitmask(curl, CURLOPT_PROXYAUTH,
-                            (long)CURLAUTH_NTLM);
-        else if(config->proxydigest)
-          my_setopt_bitmask(curl, CURLOPT_PROXYAUTH,
-                            (long)CURLAUTH_DIGEST);
-        else if(config->proxybasic)
-          my_setopt_bitmask(curl, CURLOPT_PROXYAUTH,
-                            (long)CURLAUTH_BASIC);
-
-        /* new in libcurl 7.19.4 */
-        my_setopt_str(curl, CURLOPT_NOPROXY, config->noproxy);
-
-        my_setopt(curl, CURLOPT_SUPPRESS_CONNECT_HEADERS,
-                  config->suppress_connect_headers?1L:0L);
-
-        my_setopt(curl, CURLOPT_FAILONERROR, config->failonerror?1L:0L);
-        my_setopt(curl, CURLOPT_REQUEST_TARGET, config->request_target);
-        my_setopt(curl, CURLOPT_UPLOAD, per->uploadfile?1L:0L);
-        my_setopt(curl, CURLOPT_DIRLISTONLY, config->dirlistonly?1L:0L);
-        my_setopt(curl, CURLOPT_APPEND, config->ftp_append?1L:0L);
-
-        if(config->netrc_opt)
-          my_setopt_enum(curl, CURLOPT_NETRC, (long)CURL_NETRC_OPTIONAL);
-        else if(config->netrc || config->netrc_file)
-          my_setopt_enum(curl, CURLOPT_NETRC, (long)CURL_NETRC_REQUIRED);
-        else
-          my_setopt_enum(curl, CURLOPT_NETRC, (long)CURL_NETRC_IGNORED);
-
-        if(config->netrc_file)
-          my_setopt_str(curl, CURLOPT_NETRC_FILE, config->netrc_file);
-
-        my_setopt(curl, CURLOPT_TRANSFERTEXT, config->use_ascii?1L:0L);
-        if(config->login_options)
-          my_setopt_str(curl, CURLOPT_LOGIN_OPTIONS, config->login_options);
-        my_setopt_str(curl, CURLOPT_USERPWD, config->userpwd);
-        my_setopt_str(curl, CURLOPT_RANGE, config->range);
-        if(!global->parallel) {
-          per->errorbuffer = global_errorbuffer;
-          my_setopt(curl, CURLOPT_ERRORBUFFER, global_errorbuffer);
-        }
-        my_setopt(curl, CURLOPT_TIMEOUT_MS, config->timeout_ms);
-
-        switch(config->httpreq) {
-        case HTTPREQ_SIMPLEPOST:
-          if(config->resume_from) {
-            errorf(global, "cannot mix --continue-at with --data");
-            result = CURLE_FAILED_INIT;
-          }
-          else {
-            my_setopt_str(curl, CURLOPT_POSTFIELDS,
-                          config->postfields);
-            my_setopt(curl, CURLOPT_POSTFIELDSIZE_LARGE,
-                      config->postfieldsize);
-          }
-          break;
-        case HTTPREQ_MIMEPOST:
-          /* free previous remainders */
-          curl_mime_free(config->mimepost);
-          config->mimepost = NULL;
-          if(config->resume_from) {
-            errorf(global, "cannot mix --continue-at with --form");
-            result = CURLE_FAILED_INIT;
-          }
-          else {
-            result = tool2curlmime(curl, config->mimeroot, &config->mimepost);
-            if(!result)
-              my_setopt_mimepost(curl, CURLOPT_MIMEPOST, config->mimepost);
-          }
-          break;
-        default:
-          break;
-        }
-        if(result)
-          break;
-
-        /* new in libcurl 7.81.0 */
-        if(config->mime_options)
-          my_setopt(curl, CURLOPT_MIME_OPTIONS, config->mime_options);
-
-        /* new in libcurl 7.10.6 (default is Basic) */
-        if(config->authtype)
-          my_setopt_bitmask(curl, CURLOPT_HTTPAUTH, (long)config->authtype);
-
-        my_setopt_slist(curl, CURLOPT_HTTPHEADER, config->headers);
-
-        if(proto_http || proto_rtsp) {
-          my_setopt_str(curl, CURLOPT_REFERER, config->referer);
-          my_setopt_str(curl, CURLOPT_USERAGENT, config->useragent);
-        }
-
-        if(proto_http) {
-          long postRedir = 0;
-
-          my_setopt(curl, CURLOPT_FOLLOWLOCATION,
-                    config->followlocation?1L:0L);
-          my_setopt(curl, CURLOPT_UNRESTRICTED_AUTH,
-                    config->unrestricted_auth?1L:0L);
-          my_setopt_str(curl, CURLOPT_AWS_SIGV4, config->aws_sigv4);
-          my_setopt(curl, CURLOPT_AUTOREFERER, config->autoreferer?1L:0L);
-
-          /* new in libcurl 7.36.0 */
-          if(config->proxyheaders) {
-            my_setopt_slist(curl, CURLOPT_PROXYHEADER, config->proxyheaders);
-            my_setopt(curl, CURLOPT_HEADEROPT, (long)CURLHEADER_SEPARATE);
-          }
-
-          /* new in libcurl 7.5 */
-          my_setopt(curl, CURLOPT_MAXREDIRS, config->maxredirs);
-
-          if(config->httpversion)
-            my_setopt_enum(curl, CURLOPT_HTTP_VERSION, config->httpversion);
-          else if(feature_http2)
-            my_setopt_enum(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2TLS);
-
-          /* curl 7.19.1 (the 301 version existed in 7.18.2),
-             303 was added in 7.26.0 */
-          if(config->post301)
-            postRedir |= CURL_REDIR_POST_301;
-          if(config->post302)
-            postRedir |= CURL_REDIR_POST_302;
-          if(config->post303)
-            postRedir |= CURL_REDIR_POST_303;
-          my_setopt(curl, CURLOPT_POSTREDIR, postRedir);
-
-          /* new in libcurl 7.21.6 */
-          if(config->encoding)
-            my_setopt_str(curl, CURLOPT_ACCEPT_ENCODING, "");
-
-          /* new in libcurl 7.21.6 */
-          if(config->tr_encoding)
-            my_setopt(curl, CURLOPT_TRANSFER_ENCODING, 1L);
-          /* new in libcurl 7.64.0 */
-          my_setopt(curl, CURLOPT_HTTP09_ALLOWED,
-                    config->http09_allowed ? 1L : 0L);
-          if(result) {
-            errorf(global, "HTTP/0.9 is not supported in this build");
-            return result;
-          }
-
-        } /* (proto_http) */
-
-        if(proto_ftp)
-          my_setopt_str(curl, CURLOPT_FTPPORT, config->ftpport);
-        my_setopt(curl, CURLOPT_LOW_SPEED_LIMIT,
-                  config->low_speed_limit);
-        my_setopt(curl, CURLOPT_LOW_SPEED_TIME, config->low_speed_time);
-        my_setopt(curl, CURLOPT_MAX_SEND_SPEED_LARGE,
-                  config->sendpersecond);
-        my_setopt(curl, CURLOPT_MAX_RECV_SPEED_LARGE,
-                  config->recvpersecond);
-
-        if(config->use_resume)
-          my_setopt(curl, CURLOPT_RESUME_FROM_LARGE, config->resume_from);
-        else
-          my_setopt(curl, CURLOPT_RESUME_FROM_LARGE, CURL_OFF_T_C(0));
-
-        my_setopt_str(curl, CURLOPT_KEYPASSWD, config->key_passwd);
-        my_setopt_str(curl, CURLOPT_PROXY_KEYPASSWD, config->proxy_key_passwd);
-
-        if(use_proto == proto_scp || use_proto == proto_sftp) {
-
-          /* SSH and SSL private key uses same command-line option */
-          /* new in libcurl 7.16.1 */
-          my_setopt_str(curl, CURLOPT_SSH_PRIVATE_KEYFILE, config->key);
-          /* new in libcurl 7.16.1 */
-          my_setopt_str(curl, CURLOPT_SSH_PUBLIC_KEYFILE, config->pubkey);
-
-          /* new in libcurl 7.17.1: SSH host key md5 checking allows us
-             to fail if we are not talking to who we think we should */
-          my_setopt_str(curl, CURLOPT_SSH_HOST_PUBLIC_KEY_MD5,
-                        config->hostpubmd5);
-
-          /* new in libcurl 7.80.0: SSH host key sha256 checking allows us
-             to fail if we are not talking to who we think we should */
-          my_setopt_str(curl, CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256,
-              config->hostpubsha256);
-
-          /* new in libcurl 7.56.0 */
-          if(config->ssh_compression)
-            my_setopt(curl, CURLOPT_SSH_COMPRESSION, 1L);
-        }
-
-        if(config->cacert)
-          my_setopt_str(curl, CURLOPT_CAINFO, config->cacert);
-        if(config->proxy_cacert)
-          my_setopt_str(curl, CURLOPT_PROXY_CAINFO, config->proxy_cacert);
-
-        if(config->capath) {
-          result = res_setopt_str(curl, CURLOPT_CAPATH, config->capath);
-          if(result == CURLE_NOT_BUILT_IN) {
-            warnf(global, "ignoring %s, not supported by libcurl",
-                  capath_from_env?
-                  "SSL_CERT_DIR environment variable":"--capath");
-          }
-          else if(result)
-            break;
-        }
-        /* For the time being if --proxy-capath is not set then we use the
-           --capath value for it, if any. See #1257 */
-        if(config->proxy_capath || config->capath) {
-          result = res_setopt_str(curl, CURLOPT_PROXY_CAPATH,
-                                  (config->proxy_capath ?
-                                   config->proxy_capath :
-                                   config->capath));
-          if(result == CURLE_NOT_BUILT_IN) {
-            if(config->proxy_capath) {
-              warnf(global,
-                    "ignoring --proxy-capath, not supported by libcurl");
-            }
-          }
-          else if(result)
-            break;
-        }
-
-        if(config->crlfile)
-          my_setopt_str(curl, CURLOPT_CRLFILE, config->crlfile);
-        if(config->proxy_crlfile)
-          my_setopt_str(curl, CURLOPT_PROXY_CRLFILE, config->proxy_crlfile);
-        else if(config->crlfile) /* CURLOPT_PROXY_CRLFILE default is crlfile */
-          my_setopt_str(curl, CURLOPT_PROXY_CRLFILE, config->crlfile);
-
-        if(config->pinnedpubkey)
-          my_setopt_str(curl, CURLOPT_PINNEDPUBLICKEY, config->pinnedpubkey);
-
-        if(config->ssl_ec_curves)
-          my_setopt_str(curl, CURLOPT_SSL_EC_CURVES, config->ssl_ec_curves);
-
-        if(config->writeout)
-          my_setopt_str(curl, CURLOPT_CERTINFO, 1L);
-
-        if(feature_ssl) {
-          /* Check if config->cert is a PKCS#11 URI and set the
-           * config->cert_type if necessary */
-          if(config->cert) {
-            if(!config->cert_type) {
-              if(is_pkcs11_uri(config->cert)) {
-                config->cert_type = strdup("ENG");
-              }
-            }
-          }
-
-          /* Check if config->key is a PKCS#11 URI and set the
-           * config->key_type if necessary */
-          if(config->key) {
-            if(!config->key_type) {
-              if(is_pkcs11_uri(config->key)) {
-                config->key_type = strdup("ENG");
-              }
-            }
-          }
-
-          /* Check if config->proxy_cert is a PKCS#11 URI and set the
-           * config->proxy_type if necessary */
-          if(config->proxy_cert) {
-            if(!config->proxy_cert_type) {
-              if(is_pkcs11_uri(config->proxy_cert)) {
-                config->proxy_cert_type = strdup("ENG");
-              }
-            }
-          }
-
-          /* Check if config->proxy_key is a PKCS#11 URI and set the
-           * config->proxy_key_type if necessary */
-          if(config->proxy_key) {
-            if(!config->proxy_key_type) {
-              if(is_pkcs11_uri(config->proxy_key)) {
-                config->proxy_key_type = strdup("ENG");
-              }
-            }
-          }
-
-          /* In debug build of curl tool, using
-           *    --cert loadmem=<filename>:<password> --cert-type p12
-           *  must do the same thing as classic:
-           *    --cert <filename>:<password> --cert-type p12
-           *  but is designed to test blob */
-#if defined(CURLDEBUG) || defined(DEBUGBUILD)
-          if(config->cert && (strlen(config->cert) > 8) &&
-             (memcmp(config->cert, "loadmem=",8) == 0)) {
-            FILE *fInCert = fopen(config->cert + 8, "rb");
-            void *certdata = NULL;
-            long filesize = 0;
-            bool continue_reading = fInCert != NULL;
-            if(continue_reading)
-              continue_reading = fseek(fInCert, 0, SEEK_END) == 0;
-            if(continue_reading)
-              filesize = ftell(fInCert);
-            if(filesize < 0)
-              continue_reading = FALSE;
-            if(continue_reading)
-              continue_reading = fseek(fInCert, 0, SEEK_SET) == 0;
-            if(continue_reading)
-              certdata = malloc(((size_t)filesize) + 1);
-            if((!certdata) ||
-                ((int)fread(certdata, (size_t)filesize, 1, fInCert) != 1))
-              continue_reading = FALSE;
-            if(fInCert)
-              fclose(fInCert);
-            if((filesize > 0) && continue_reading) {
-              struct curl_blob structblob;
-              structblob.data = certdata;
-              structblob.len = (size_t)filesize;
-              structblob.flags = CURL_BLOB_COPY;
-              my_setopt_str(curl, CURLOPT_SSLCERT_BLOB, &structblob);
-              /* if test run well, we are sure we don't reuse
-               * original mem pointer */
-              memset(certdata, 0, (size_t)filesize);
-            }
-            free(certdata);
-          }
-          else
-#endif
-          my_setopt_str(curl, CURLOPT_SSLCERT, config->cert);
-          my_setopt_str(curl, CURLOPT_PROXY_SSLCERT, config->proxy_cert);
-          my_setopt_str(curl, CURLOPT_SSLCERTTYPE, config->cert_type);
-          my_setopt_str(curl, CURLOPT_PROXY_SSLCERTTYPE,
-                        config->proxy_cert_type);
-
-
-#if defined(CURLDEBUG) || defined(DEBUGBUILD)
-          if(config->key && (strlen(config->key) > 8) &&
-             (memcmp(config->key, "loadmem=",8) == 0)) {
-            FILE *fInCert = fopen(config->key + 8, "rb");
-            void *certdata = NULL;
-            long filesize = 0;
-            bool continue_reading = fInCert != NULL;
-            if(continue_reading)
-              continue_reading = fseek(fInCert, 0, SEEK_END) == 0;
-            if(continue_reading)
-              filesize = ftell(fInCert);
-            if(filesize < 0)
-              continue_reading = FALSE;
-            if(continue_reading)
-              continue_reading = fseek(fInCert, 0, SEEK_SET) == 0;
-            if(continue_reading)
-              certdata = malloc(((size_t)filesize) + 1);
-            if((!certdata) ||
-                ((int)fread(certdata, (size_t)filesize, 1, fInCert) != 1))
-              continue_reading = FALSE;
-            if(fInCert)
-              fclose(fInCert);
-            if((filesize > 0) && continue_reading) {
-              struct curl_blob structblob;
-              structblob.data = certdata;
-              structblob.len = (size_t)filesize;
-              structblob.flags = CURL_BLOB_COPY;
-              my_setopt_str(curl, CURLOPT_SSLKEY_BLOB, &structblob);
-              /* if test run well, we are sure we don't reuse
-               * original mem pointer */
-              memset(certdata, 0, (size_t)filesize);
-            }
-            free(certdata);
-          }
-          else
-#endif
-          my_setopt_str(curl, CURLOPT_SSLKEY, config->key);
-          my_setopt_str(curl, CURLOPT_PROXY_SSLKEY, config->proxy_key);
-          my_setopt_str(curl, CURLOPT_SSLKEYTYPE, config->key_type);
-          my_setopt_str(curl, CURLOPT_PROXY_SSLKEYTYPE,
-                        config->proxy_key_type);
-          if(config->insecure_ok) {
-            my_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
-            my_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
-          }
-          else {
-            my_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
-            /* libcurl default is strict verifyhost -> 2L   */
-            /* my_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L); */
-          }
-
-          if(config->doh_insecure_ok) {
-            my_setopt(curl, CURLOPT_DOH_SSL_VERIFYPEER, 0L);
-            my_setopt(curl, CURLOPT_DOH_SSL_VERIFYHOST, 0L);
-          }
-
-          if(config->proxy_insecure_ok) {
-            my_setopt(curl, CURLOPT_PROXY_SSL_VERIFYPEER, 0L);
-            my_setopt(curl, CURLOPT_PROXY_SSL_VERIFYHOST, 0L);
-          }
-          else {
-            my_setopt(curl, CURLOPT_PROXY_SSL_VERIFYPEER, 1L);
-          }
-
-          if(config->verifystatus)
-            my_setopt(curl, CURLOPT_SSL_VERIFYSTATUS, 1L);
-
-          if(config->doh_verifystatus)
-            my_setopt(curl, CURLOPT_DOH_SSL_VERIFYSTATUS, 1L);
-
-          if(config->falsestart)
-            my_setopt(curl, CURLOPT_SSL_FALSESTART, 1L);
-
-          my_setopt_enum(curl, CURLOPT_SSLVERSION,
-                         config->ssl_version | config->ssl_version_max);
-          if(config->proxy)
-            my_setopt_enum(curl, CURLOPT_PROXY_SSLVERSION,
-                           config->proxy_ssl_version);
-
-          {
-            long mask =
-              (config->ssl_allow_beast ?
-               CURLSSLOPT_ALLOW_BEAST : 0) |
-              (config->ssl_no_revoke ?
-               CURLSSLOPT_NO_REVOKE : 0) |
-              (config->ssl_revoke_best_effort ?
-               CURLSSLOPT_REVOKE_BEST_EFFORT : 0) |
-              (config->native_ca_store ?
-               CURLSSLOPT_NATIVE_CA : 0) |
-              (config->ssl_auto_client_cert ?
-               CURLSSLOPT_AUTO_CLIENT_CERT : 0);
-
-            if(mask)
-              my_setopt_bitmask(curl, CURLOPT_SSL_OPTIONS, mask);
-          }
-
-          {
-            long mask =
-              (config->proxy_ssl_allow_beast ?
-               CURLSSLOPT_ALLOW_BEAST : 0) |
-              (config->proxy_ssl_auto_client_cert ?
-               CURLSSLOPT_AUTO_CLIENT_CERT : 0) |
-              (config->proxy_native_ca_store ?
-               CURLSSLOPT_NATIVE_CA : 0);
-
-            if(mask)
-              my_setopt_bitmask(curl, CURLOPT_PROXY_SSL_OPTIONS, mask);
-          }
-        }
-
-        if(config->path_as_is)
-          my_setopt(curl, CURLOPT_PATH_AS_IS, 1L);
-
-        if((use_proto == proto_scp || use_proto == proto_sftp) &&
-           !config->insecure_ok) {
-          char *known = findfile(".ssh/known_hosts", FALSE);
-          if(known) {
-            /* new in curl 7.19.6 */
-            result = res_setopt_str(curl, CURLOPT_SSH_KNOWNHOSTS, known);
-            curl_free(known);
-            if(result == CURLE_UNKNOWN_OPTION)
-              /* libssh2 version older than 1.1.1 */
-              result = CURLE_OK;
-            if(result)
-              break;
-          }
-          else
-            warnf(global, "Couldn't find a known_hosts file");
-        }
-
-        if(config->no_body || config->remote_time) {
-          /* no body or use remote time */
-          my_setopt(curl, CURLOPT_FILETIME, 1L);
-        }
-
-        my_setopt(curl, CURLOPT_CRLF, config->crlf?1L:0L);
-        my_setopt_slist(curl, CURLOPT_QUOTE, config->quote);
-        my_setopt_slist(curl, CURLOPT_POSTQUOTE, config->postquote);
-        my_setopt_slist(curl, CURLOPT_PREQUOTE, config->prequote);
-
-        if(config->cookies) {
-          struct curlx_dynbuf cookies;
-          struct curl_slist *cl;
-
-          /* The maximum size needs to match MAX_NAME in cookie.h */
-#define MAX_COOKIE_LINE 8200
-          curlx_dyn_init(&cookies, MAX_COOKIE_LINE);
-          for(cl = config->cookies; cl; cl = cl->next) {
-            if(cl == config->cookies)
-              result = curlx_dyn_addf(&cookies, "%s", cl->data);
-            else
-              result = curlx_dyn_addf(&cookies, ";%s", cl->data);
-
-            if(result) {
-              warnf(global,
-                    "skipped provided cookie, the cookie header "
-                    "would go over %u bytes", MAX_COOKIE_LINE);
-              break;
-            }
-          }
-
-          my_setopt_str(curl, CURLOPT_COOKIE, curlx_dyn_ptr(&cookies));
-          curlx_dyn_free(&cookies);
-        }
-
-        if(config->cookiefiles) {
-          struct curl_slist *cfl;
-
-          for(cfl = config->cookiefiles; cfl; cfl = cfl->next)
-            my_setopt_str(curl, CURLOPT_COOKIEFILE, cfl->data);
-        }
-
-        /* new in libcurl 7.9 */
-        if(config->cookiejar)
-          my_setopt_str(curl, CURLOPT_COOKIEJAR, config->cookiejar);
-
-        /* new in libcurl 7.9.7 */
-        my_setopt(curl, CURLOPT_COOKIESESSION, config->cookiesession?1L:0L);
-
-        my_setopt_enum(curl, CURLOPT_TIMECONDITION, (long)config->timecond);
-        my_setopt(curl, CURLOPT_TIMEVALUE_LARGE, config->condtime);
-        my_setopt_str(curl, CURLOPT_CUSTOMREQUEST, config->customrequest);
-        customrequest_helper(config, config->httpreq, config->customrequest);
-        my_setopt(curl, CURLOPT_STDERR, stderr);
-
-        /* three new ones in libcurl 7.3: */
-        my_setopt_str(curl, CURLOPT_INTERFACE, config->iface);
-        my_setopt_str(curl, CURLOPT_KRBLEVEL, config->krblevel);
-        progressbarinit(&per->progressbar, config);
-
-        if((global->progressmode == CURL_PROGRESS_BAR) &&
-           !global->noprogress && !global->silent) {
-          /* we want the alternative style, then we have to implement it
-             ourselves! */
-          my_setopt(curl, CURLOPT_XFERINFOFUNCTION, tool_progress_cb);
-          my_setopt(curl, CURLOPT_XFERINFODATA, per);
-        }
-        else if(per->uploadfile && !strcmp(per->uploadfile, ".")) {
-          /* when reading from stdin in non-blocking mode, we use the progress
-             function to unpause a busy read */
-          my_setopt(curl, CURLOPT_NOPROGRESS, 0L);
-          my_setopt(curl, CURLOPT_XFERINFOFUNCTION, tool_readbusy_cb);
-          my_setopt(curl, CURLOPT_XFERINFODATA, per);
-        }
-
-        /* new in libcurl 7.24.0: */
-        if(config->dns_servers)
-          my_setopt_str(curl, CURLOPT_DNS_SERVERS, config->dns_servers);
-
-        /* new in libcurl 7.33.0: */
-        if(config->dns_interface)
-          my_setopt_str(curl, CURLOPT_DNS_INTERFACE, config->dns_interface);
-        if(config->dns_ipv4_addr)
-          my_setopt_str(curl, CURLOPT_DNS_LOCAL_IP4, config->dns_ipv4_addr);
-        if(config->dns_ipv6_addr)
-          my_setopt_str(curl, CURLOPT_DNS_LOCAL_IP6, config->dns_ipv6_addr);
-
-        /* new in libcurl 7.6.2: */
-        my_setopt_slist(curl, CURLOPT_TELNETOPTIONS, config->telnet_options);
-
-        /* new in libcurl 7.7: */
-        my_setopt(curl, CURLOPT_CONNECTTIMEOUT_MS, config->connecttimeout_ms);
-
-        if(config->doh_url)
-          my_setopt_str(curl, CURLOPT_DOH_URL, config->doh_url);
-
-        if(config->cipher_list)
-          my_setopt_str(curl, CURLOPT_SSL_CIPHER_LIST, config->cipher_list);
-
-        if(config->proxy_cipher_list)
-          my_setopt_str(curl, CURLOPT_PROXY_SSL_CIPHER_LIST,
-                        config->proxy_cipher_list);
-
-        if(config->cipher13_list)
-          my_setopt_str(curl, CURLOPT_TLS13_CIPHERS, config->cipher13_list);
-
-        if(config->proxy_cipher13_list)
-          my_setopt_str(curl, CURLOPT_PROXY_TLS13_CIPHERS,
-                        config->proxy_cipher13_list);
-
-        /* new in libcurl 7.9.2: */
-        if(config->disable_epsv)
-          /* disable it */
-          my_setopt(curl, CURLOPT_FTP_USE_EPSV, 0L);
-
-        /* new in libcurl 7.10.5 */
-        if(config->disable_eprt)
-          /* disable it */
-          my_setopt(curl, CURLOPT_FTP_USE_EPRT, 0L);
-
-        if(global->tracetype != TRACE_NONE) {
-          my_setopt(curl, CURLOPT_DEBUGFUNCTION, tool_debug_cb);
-          my_setopt(curl, CURLOPT_DEBUGDATA, config);
-          my_setopt(curl, CURLOPT_VERBOSE, 1L);
-        }
-
-        /* new in curl 7.9.3 */
-        if(config->engine) {
-          result = res_setopt_str(curl, CURLOPT_SSLENGINE, config->engine);
-          if(result)
-            break;
-        }
-
-        /* new in curl 7.10.7, extended in 7.19.4. Modified to use
-           CREATE_DIR_RETRY in 7.49.0 */
-        my_setopt(curl, CURLOPT_FTP_CREATE_MISSING_DIRS,
-                  (long)(config->ftp_create_dirs?
-                         CURLFTP_CREATE_DIR_RETRY:
-                         CURLFTP_CREATE_DIR_NONE));
-
-        /* new in curl 7.10.8 */
-        if(config->max_filesize)
-          my_setopt(curl, CURLOPT_MAXFILESIZE_LARGE,
-                    config->max_filesize);
-
-        my_setopt(curl, CURLOPT_IPRESOLVE, config->ip_version);
-
-        /* new in curl 7.15.5 */
-        if(config->ftp_ssl_reqd)
-          my_setopt_enum(curl, CURLOPT_USE_SSL, (long)CURLUSESSL_ALL);
-
-        /* new in curl 7.11.0 */
-        else if(config->ftp_ssl)
-          my_setopt_enum(curl, CURLOPT_USE_SSL, (long)CURLUSESSL_TRY);
-
-        /* new in curl 7.16.0 */
-        else if(config->ftp_ssl_control)
-          my_setopt_enum(curl, CURLOPT_USE_SSL, (long)CURLUSESSL_CONTROL);
-
-        /* new in curl 7.16.1 */
-        if(config->ftp_ssl_ccc)
-          my_setopt_enum(curl, CURLOPT_FTP_SSL_CCC,
-                         (long)config->ftp_ssl_ccc_mode);
-
-        /* new in curl 7.19.4 */
-        if(config->socks5_gssapi_nec)
-          my_setopt_str(curl, CURLOPT_SOCKS5_GSSAPI_NEC, 1L);
-
-        /* new in curl 7.55.0 */
-        if(config->socks5_auth)
-          my_setopt_bitmask(curl, CURLOPT_SOCKS5_AUTH,
-                            (long)config->socks5_auth);
-
-        /* new in curl 7.43.0 */
-        if(config->proxy_service_name)
-          my_setopt_str(curl, CURLOPT_PROXY_SERVICE_NAME,
-                        config->proxy_service_name);
-
-        /* new in curl 7.43.0 */
-        if(config->service_name)
-          my_setopt_str(curl, CURLOPT_SERVICE_NAME,
-                        config->service_name);
-
-        /* curl 7.13.0 */
-        my_setopt_str(curl, CURLOPT_FTP_ACCOUNT, config->ftp_account);
-        my_setopt(curl, CURLOPT_IGNORE_CONTENT_LENGTH, config->ignorecl?1L:0L);
-
-        /* curl 7.14.2 */
-        my_setopt(curl, CURLOPT_FTP_SKIP_PASV_IP, config->ftp_skip_ip?1L:0L);
-
-        /* curl 7.15.1 */
-        if(proto_ftp)
-          my_setopt(curl, CURLOPT_FTP_FILEMETHOD,
-                    (long)config->ftp_filemethod);
-
-        /* curl 7.15.2 */
-        if(config->localport) {
-          my_setopt(curl, CURLOPT_LOCALPORT, config->localport);
-          my_setopt_str(curl, CURLOPT_LOCALPORTRANGE, config->localportrange);
-        }
-
-        /* curl 7.15.5 */
-        my_setopt_str(curl, CURLOPT_FTP_ALTERNATIVE_TO_USER,
-                      config->ftp_alternative_to_user);
-
-        /* curl 7.16.0 */
-        if(config->disable_sessionid)
-          /* disable it */
-          my_setopt(curl, CURLOPT_SSL_SESSIONID_CACHE, 0L);
-
-        /* curl 7.16.2 */
-        if(config->raw) {
-          my_setopt(curl, CURLOPT_HTTP_CONTENT_DECODING, 0L);
-          my_setopt(curl, CURLOPT_HTTP_TRANSFER_DECODING, 0L);
-        }
-
-        /* curl 7.17.1 */
-        if(!config->nokeepalive) {
-          my_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
-          if(config->alivetime) {
-            my_setopt(curl, CURLOPT_TCP_KEEPIDLE, config->alivetime);
-            my_setopt(curl, CURLOPT_TCP_KEEPINTVL, config->alivetime);
-          }
-        }
-        else
-          my_setopt(curl, CURLOPT_TCP_KEEPALIVE, 0L);
-
-        /* curl 7.20.0 */
-        if(config->tftp_blksize && proto_tftp)
-          my_setopt(curl, CURLOPT_TFTP_BLKSIZE, config->tftp_blksize);
-
-        if(config->mail_from)
-          my_setopt_str(curl, CURLOPT_MAIL_FROM, config->mail_from);
-
-        if(config->mail_rcpt)
-          my_setopt_slist(curl, CURLOPT_MAIL_RCPT, config->mail_rcpt);
-
-        /* curl 7.69.x */
-        my_setopt(curl, CURLOPT_MAIL_RCPT_ALLOWFAILS,
-                  config->mail_rcpt_allowfails ? 1L : 0L);
-
-        /* curl 7.20.x */
-        if(config->ftp_pret)
-          my_setopt(curl, CURLOPT_FTP_USE_PRET, 1L);
-
-        if(config->create_file_mode)
-          my_setopt(curl, CURLOPT_NEW_FILE_PERMS, config->create_file_mode);
-
-        if(config->proto_present)
-          my_setopt_str(curl, CURLOPT_PROTOCOLS_STR, config->proto_str);
-        if(config->proto_redir_present)
-          my_setopt_str(curl, CURLOPT_REDIR_PROTOCOLS_STR,
-                        config->proto_redir_str);
-
-        if(config->content_disposition
-           && (urlnode->flags & GETOUT_USEREMOTE))
-          hdrcbdata->honor_cd_filename = TRUE;
-        else
-          hdrcbdata->honor_cd_filename = FALSE;
-
-        hdrcbdata->outs = outs;
-        hdrcbdata->heads = heads;
-        hdrcbdata->etag_save = etag_save;
-        hdrcbdata->global = global;
-        hdrcbdata->config = config;
-
-        my_setopt(curl, CURLOPT_HEADERFUNCTION, tool_header_cb);
-        my_setopt(curl, CURLOPT_HEADERDATA, per);
-
-        if(config->resolve)
-          /* new in 7.21.3 */
-          my_setopt_slist(curl, CURLOPT_RESOLVE, config->resolve);
-
-        if(config->connect_to)
-          /* new in 7.49.0 */
-          my_setopt_slist(curl, CURLOPT_CONNECT_TO, config->connect_to);
-
-        /* new in 7.21.4 */
-        if(feature_tls_srp) {
-          if(config->tls_username)
-            my_setopt_str(curl, CURLOPT_TLSAUTH_USERNAME,
-                          config->tls_username);
-          if(config->tls_password)
-            my_setopt_str(curl, CURLOPT_TLSAUTH_PASSWORD,
-                          config->tls_password);
-          if(config->tls_authtype)
-            my_setopt_str(curl, CURLOPT_TLSAUTH_TYPE,
-                          config->tls_authtype);
-          if(config->proxy_tls_username)
-            my_setopt_str(curl, CURLOPT_PROXY_TLSAUTH_USERNAME,
-                          config->proxy_tls_username);
-          if(config->proxy_tls_password)
-            my_setopt_str(curl, CURLOPT_PROXY_TLSAUTH_PASSWORD,
-                          config->proxy_tls_password);
-          if(config->proxy_tls_authtype)
-            my_setopt_str(curl, CURLOPT_PROXY_TLSAUTH_TYPE,
-                          config->proxy_tls_authtype);
-        }
-
-        /* new in 7.22.0 */
-        if(config->gssapi_delegation)
-          my_setopt_str(curl, CURLOPT_GSSAPI_DELEGATION,
-                        config->gssapi_delegation);
-
-        if(config->mail_auth)
-          my_setopt_str(curl, CURLOPT_MAIL_AUTH, config->mail_auth);
-
-        /* new in 7.66.0 */
-        if(config->sasl_authzid)
-          my_setopt_str(curl, CURLOPT_SASL_AUTHZID, config->sasl_authzid);
-
-        /* new in 7.31.0 */
-        if(config->sasl_ir)
-          my_setopt(curl, CURLOPT_SASL_IR, 1L);
-
-        if(config->noalpn) {
-          my_setopt(curl, CURLOPT_SSL_ENABLE_ALPN, 0L);
-        }
-
-        /* new in 7.40.0, abstract support added in 7.53.0 */
-        if(config->unix_socket_path) {
-          if(config->abstract_unix_socket) {
-            my_setopt_str(curl, CURLOPT_ABSTRACT_UNIX_SOCKET,
-                          config->unix_socket_path);
-          }
-          else {
-            my_setopt_str(curl, CURLOPT_UNIX_SOCKET_PATH,
-                          config->unix_socket_path);
-          }
-        }
-
-        /* new in 7.45.0 */
-        if(config->proto_default)
-          my_setopt_str(curl, CURLOPT_DEFAULT_PROTOCOL, config->proto_default);
-
-        /* new in 7.47.0 */
-        if(config->expect100timeout_ms > 0)
-          my_setopt_str(curl, CURLOPT_EXPECT_100_TIMEOUT_MS,
-                        config->expect100timeout_ms);
-
-        /* new in 7.48.0 */
-        if(config->tftp_no_options && proto_tftp)
-          my_setopt(curl, CURLOPT_TFTP_NO_OPTIONS, 1L);
-
-        /* new in 7.59.0 */
-        if(config->happy_eyeballs_timeout_ms != CURL_HET_DEFAULT)
-          my_setopt(curl, CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS,
-                    config->happy_eyeballs_timeout_ms);
-
-        /* new in 7.60.0 */
-        if(config->haproxy_protocol)
-          my_setopt(curl, CURLOPT_HAPROXYPROTOCOL, 1L);
-
-        /* new in 8.2.0 */
-        if(config->haproxy_clientip)
-          my_setopt_str(curl, CURLOPT_HAPROXY_CLIENT_IP,
-              config->haproxy_clientip);
-
-        if(config->disallow_username_in_url)
-          my_setopt(curl, CURLOPT_DISALLOW_USERNAME_IN_URL, 1L);
-
-        if(config->altsvc)
-          my_setopt_str(curl, CURLOPT_ALTSVC, config->altsvc);
-
-        if(config->hsts)
-          my_setopt_str(curl, CURLOPT_HSTS, config->hsts);
-
-        /* initialize retry vars for loop below */
-        per->retry_sleep_default = (config->retry_delay) ?
-          config->retry_delay*1000L : RETRY_SLEEP_DEFAULT; /* ms */
-        per->retry_numretries = config->req_retry;
-        per->retry_sleep = per->retry_sleep_default; /* ms */
-        per->retrystart = tvnow();
-
-        state->li++;
-        /* Here's looping around each globbed URL */
-        if(state->li >= urlnum) {
-          state->li = 0;
-          state->urlnum = 0; /* forced reglob of URLs */
-          glob_cleanup(state->urls);
-          state->urls = NULL;
-          state->up++;
-          Curl_safefree(state->uploadfile); /* clear it to get the next */
-        }
-      }
-      else {
-        /* Free this URL node data without destroying the
-           node itself nor modifying next pointer. */
-        Curl_safefree(urlnode->outfile);
-        Curl_safefree(urlnode->infile);
-        urlnode->flags = 0;
-        glob_cleanup(state->urls);
-        state->urls = NULL;
-        state->urlnum = 0;
-
-        Curl_safefree(state->outfiles);
-        Curl_safefree(state->uploadfile);
-        if(state->inglob) {
-          /* Free list of globbed upload files */
-          glob_cleanup(state->inglob);
-          state->inglob = NULL;
-        }
-        config->state.urlnode = urlnode->next;
-        state->up = 0;
-        continue;
-      }
-    }
-    break;
-  }
-  Curl_safefree(state->outfiles);
-
-  if(!*added || result) {
-    *added = FALSE;
-    single_transfer_cleanup(config);
-  }
-  return result;
+  return create_single(config, share, state, added, skipped);
 }
 
 static long all_added; /* number of easy handles currently added */
@@ -2236,29 +1536,35 @@ static long all_added; /* number of easy handles currently added */
  * to add even after this call returns. sets 'addedp' to TRUE if one or more
  * transfers were added.
  */
-static CURLcode add_parallel_transfers(struct GlobalConfig *global,
-                                       CURLM *multi,
-                                       CURLSH *share,
-                                       bool *morep,
-                                       bool *addedp)
+static CURLcode add_parallel_transfers(CURLM *multi, CURLSH *share,
+                                       bool *morep, bool *addedp)
 {
   struct per_transfer *per;
   CURLcode result = CURLE_OK;
   CURLMcode mcode;
   bool sleeping = FALSE;
-  char *errorbuf;
+  curl_off_t nxfers;
+
   *addedp = FALSE;
   *morep = FALSE;
-  if(all_pers < (global->parallel_max*2)) {
-    result = create_transfer(global, share, addedp);
-    if(result)
-      return result;
+  mcode = curl_multi_get_offt(multi, CURLMINFO_XFERS_CURRENT, &nxfers);
+  if(mcode) {
+    DEBUGASSERT(0);
+    return CURLE_UNKNOWN_OPTION;
+  }
+
+  if(nxfers < (curl_off_t)(global->parallel_max * 2)) {
+    bool skipped = FALSE;
+    do {
+      result = create_transfer(share, addedp, &skipped);
+      if(result)
+        return result;
+    } while(skipped);
   }
   for(per = transfers; per && (all_added < global->parallel_max);
       per = per->next) {
-    bool getadded = FALSE;
-    if(per->added)
-      /* already added */
+    if(per->added || per->skip)
+      /* already added or to be skipped */
       continue;
     if(per->startat && (time(NULL) < per->startat)) {
       /* this is still delaying */
@@ -2267,22 +1573,25 @@ static CURLcode add_parallel_transfers(struct GlobalConfig *global,
     }
     per->added = TRUE;
 
-    result = pre_transfer(global, per);
+    result = pre_transfer(per);
     if(result)
       return result;
 
-    errorbuf = malloc(CURL_ERROR_SIZE);
-    if(!errorbuf)
-      return CURLE_OUT_OF_MEMORY;
-
-    /* parallel connect means that we don't set PIPEWAIT since pipewait
-       will make libcurl prefer multiplexing */
+    /* parallel connect means that we do not set PIPEWAIT since pipewait
+       makes libcurl prefer multiplexing */
     (void)curl_easy_setopt(per->curl, CURLOPT_PIPEWAIT,
                            global->parallel_connect ? 0L : 1L);
     (void)curl_easy_setopt(per->curl, CURLOPT_PRIVATE, per);
+    /* curl does not use signals, switching this on saves some system calls */
+    (void)curl_easy_setopt(per->curl, CURLOPT_NOSIGNAL, 1L);
     (void)curl_easy_setopt(per->curl, CURLOPT_XFERINFOFUNCTION, xferinfo_cb);
     (void)curl_easy_setopt(per->curl, CURLOPT_XFERINFODATA, per);
     (void)curl_easy_setopt(per->curl, CURLOPT_NOPROGRESS, 0L);
+    (void)curl_easy_setopt(per->curl, CURLOPT_ERRORBUFFER, per->errorbuffer);
+#ifdef DEBUGBUILD
+    if(getenv("CURL_FORBID_REUSE"))
+      (void)curl_easy_setopt(per->curl, CURLOPT_FORBID_REUSE, 1L);
+#endif
 
     mcode = curl_multi_add_handle(multi, per->curl);
     if(mcode) {
@@ -2290,197 +1599,522 @@ static CURLcode add_parallel_transfers(struct GlobalConfig *global,
       result = CURLE_OUT_OF_MEMORY;
     }
 
-    if(!result)
-      result = create_transfer(global, share, &getadded);
-    if(result) {
-      free(errorbuf);
-      return result;
+    if(!result) {
+      bool getadded = FALSE;
+      bool skipped = FALSE;
+      do {
+        result = create_transfer(share, &getadded, &skipped);
+        if(result)
+          break;
+      } while(skipped);
     }
-    errorbuf[0] = 0;
-    (void)curl_easy_setopt(per->curl, CURLOPT_ERRORBUFFER, errorbuf);
-    per->errorbuffer = errorbuf;
+    if(result)
+      return result;
+
+    per->errorbuffer[0] = 0;
     per->added = TRUE;
     all_added++;
     *addedp = TRUE;
   }
-  *morep = (per || sleeping) ? TRUE : FALSE;
+  *morep = (per || sleeping);
   return CURLE_OK;
 }
 
-static CURLcode parallel_transfers(struct GlobalConfig *global,
-                                   CURLSH *share)
-{
+struct parastate {
   CURLM *multi;
-  CURLMcode mcode = CURLM_OK;
-  CURLcode result = CURLE_OK;
-  int still_running = 1;
-  struct timeval start = tvnow();
+  CURLSH *share;
+  CURLMcode mcode;
+  CURLcode result;
+  int still_running;
+  struct curltime start;
   bool more_transfers;
   bool added_transfers;
   /* wrapitup is set TRUE after a critical error occurs to end all transfers */
-  bool wrapitup = FALSE;
+  bool wrapitup;
   /* wrapitup_processed is set TRUE after the per transfer abort flag is set */
-  bool wrapitup_processed = FALSE;
-  time_t tick = time(NULL);
+  bool wrapitup_processed;
+  time_t tick;
+};
 
-  multi = curl_multi_init();
-  if(!multi)
-    return CURLE_OUT_OF_MEMORY;
+#if defined(DEBUGBUILD) && defined(USE_LIBUV)
 
-  result = add_parallel_transfers(global, multi, share,
-                                  &more_transfers, &added_transfers);
-  if(result) {
-    curl_multi_cleanup(multi);
-    return result;
+#define DEBUG_UV 0
+
+/* object to pass to the callbacks */
+struct datauv {
+  uv_timer_t timeout;
+  uv_loop_t *loop;
+  struct parastate *s;
+};
+
+struct contextuv {
+  uv_poll_t poll_handle;
+  curl_socket_t sockfd;
+  struct datauv *uv;
+};
+
+static void mnotify(CURLM *multi, unsigned int notification,
+                    CURL *easy, void *user_data);
+
+/* callback from libuv on socket activity */
+static void on_uv_socket(uv_poll_t *req, int status, int events)
+{
+  int flags = 0;
+  struct contextuv *c = (struct contextuv *)req->data;
+  (void)status;
+  if(events & UV_READABLE)
+    flags |= CURL_CSELECT_IN;
+  if(events & UV_WRITABLE)
+    flags |= CURL_CSELECT_OUT;
+
+  curl_multi_socket_action(c->uv->s->multi, c->sockfd, flags,
+                           &c->uv->s->still_running);
+  progress_meter(c->uv->s->multi, &c->uv->s->start, FALSE);
+}
+
+/* callback from libuv when timeout expires */
+static void on_uv_timeout(uv_timer_t *req)
+{
+  struct datauv *uv = (struct datauv *)req->data;
+#if DEBUG_UV
+  curl_mfprintf(tool_stderr, "parallel_event: on_uv_timeout\n");
+#endif
+  if(uv && uv->s) {
+    curl_multi_socket_action(uv->s->multi, CURL_SOCKET_TIMEOUT, 0,
+                             &uv->s->still_running);
+    progress_meter(uv->s->multi, &uv->s->start, FALSE);
+  }
+}
+
+/* callback from libcurl to update the timeout expiry */
+static int cb_timeout(CURLM *multi, long timeout_ms, void *userp)
+{
+  struct datauv *uv = userp;
+  (void)multi;
+#if DEBUG_UV
+  curl_mfprintf(tool_stderr, "parallel_event: cb_timeout=%ld\n", timeout_ms);
+#endif
+  if(timeout_ms < 0)
+    uv_timer_stop(&uv->timeout);
+  else {
+    if(timeout_ms == 0)
+      timeout_ms = 1; /* 0 means call curl_multi_socket_action asap but NOT
+                         within the callback itself */
+    uv_timer_start(&uv->timeout, on_uv_timeout, timeout_ms,
+                   0); /* do not repeat */
+  }
+  return 0;
+}
+
+static struct contextuv *create_context(curl_socket_t sockfd,
+                                        struct datauv *uv)
+{
+  struct contextuv *c = curlx_malloc(sizeof(*c));
+
+  c->sockfd = sockfd;
+  c->uv = uv;
+
+  uv_poll_init_socket(uv->loop, &c->poll_handle, sockfd);
+  c->poll_handle.data = c;
+
+  return c;
+}
+
+static void close_cb(uv_handle_t *handle)
+{
+  struct contextuv *c = (struct contextuv *)handle->data;
+  curlx_free(c);
+}
+
+static void destroy_context(struct contextuv *c)
+{
+  uv_close((uv_handle_t *)&c->poll_handle, close_cb);
+}
+
+/* callback from libcurl to update socket activity to wait for */
+static int cb_socket(CURL *easy, curl_socket_t s, int action,
+                     void *userp, void *socketp)
+{
+  struct contextuv *c;
+  int events = 0;
+  struct datauv *uv = userp;
+  (void)easy;
+
+#if DEBUG_UV
+  curl_mfprintf(tool_stderr, "parallel_event: cb_socket, "
+                "fd=%" FMT_SOCKET_T ", action=%x, p=%p\n", s, action, socketp);
+#endif
+  switch(action) {
+  case CURL_POLL_IN:
+  case CURL_POLL_OUT:
+  case CURL_POLL_INOUT:
+    c = socketp ? (struct contextuv *)socketp : create_context(s, uv);
+
+    curl_multi_assign(uv->s->multi, s, c);
+
+    if(action != CURL_POLL_IN)
+      events |= UV_WRITABLE;
+    if(action != CURL_POLL_OUT)
+      events |= UV_READABLE;
+
+    uv_poll_start(&c->poll_handle, events, on_uv_socket);
+    break;
+  case CURL_POLL_REMOVE:
+    if(socketp) {
+      c = (struct contextuv *)socketp;
+      uv_poll_stop(&c->poll_handle);
+      destroy_context(c);
+      curl_multi_assign(uv->s->multi, s, NULL);
+    }
+    break;
+  default:
+    abort();
   }
 
-  while(!mcode && (still_running || more_transfers)) {
-    /* If stopping prematurely (eg due to a --fail-early condition) then signal
-       that any transfers in the multi should abort (via progress callback). */
-    if(wrapitup) {
-      if(!still_running)
+  return 0;
+}
+
+static CURLcode parallel_event(struct parastate *s)
+{
+  CURLcode result = CURLE_OK;
+  struct datauv uv = { 0 };
+
+  s->result = CURLE_OK;
+  uv.s = s;
+  uv.loop = uv_default_loop();
+  uv_timer_init(uv.loop, &uv.timeout);
+  uv.timeout.data = &uv;
+
+  /* setup event callbacks */
+  curl_multi_setopt(s->multi, CURLMOPT_SOCKETFUNCTION, cb_socket);
+  curl_multi_setopt(s->multi, CURLMOPT_SOCKETDATA, &uv);
+  curl_multi_setopt(s->multi, CURLMOPT_TIMERFUNCTION, cb_timeout);
+  curl_multi_setopt(s->multi, CURLMOPT_TIMERDATA, &uv);
+  curl_multi_setopt(s->multi, CURLMOPT_MAX_HOST_CONNECTIONS, (long)
+                    global->parallel_host);
+
+  /* kickstart the thing */
+  curl_multi_socket_action(s->multi, CURL_SOCKET_TIMEOUT, 0,
+                           &s->still_running);
+
+  while(!s->mcode && (s->still_running || s->more_transfers)) {
+
+    if(!s->still_running && s->more_transfers) {
+      curl_off_t nxfers;
+      /* None are running, but there may be more ready to run. Try
+       * to add more when possible. */
+      s->result = add_parallel_transfers(s->multi, s->share,
+                                         &s->more_transfers,
+                                         &s->added_transfers);
+      if(s->result)
         break;
-      if(!wrapitup_processed) {
+      if(s->more_transfers) {
+        /* There are still more transfers, so not all were added. If we
+         * did not add *any*, it means there is nothing to do until time
+         * passes and a transfer becomes ready to add.
+         * Avoid busy looping by taking a small break. */
+        CURLMcode mcode = curl_multi_get_offt(
+          s->multi, CURLMINFO_XFERS_CURRENT, &nxfers);
+        if(!mcode && !nxfers) {
+          /* None have been added, must be waiting on a timeout */
+          curlx_wait_ms(500);
+        }
+      }
+    }
+#if DEBUG_UV
+    curl_mfprintf(tool_stderr, "parallel_event: uv_run(), "
+                  "mcode=%d, %d running, %d more\n",
+                  s->mcode, uv.s->still_running, s->more_transfers);
+#endif
+    uv_run(uv.loop, UV_RUN_DEFAULT);
+#if DEBUG_UV
+    curl_mfprintf(tool_stderr, "parallel_event: uv_run() returned\n");
+#endif
+
+    /* early exit called */
+    if(s->wrapitup) {
+      if(s->still_running && !s->wrapitup_processed) {
         struct per_transfer *per;
         for(per = transfers; per; per = per->next) {
           if(per->added)
             per->abort = TRUE;
         }
-        wrapitup_processed = TRUE;
+        s->wrapitup_processed = TRUE;
       }
-    }
-
-    mcode = curl_multi_poll(multi, NULL, 0, 1000, NULL);
-    if(!mcode)
-      mcode = curl_multi_perform(multi, &still_running);
-
-    progress_meter(global, &start, FALSE);
-
-    if(!mcode) {
-      int rc;
-      CURLMsg *msg;
-      bool checkmore = FALSE;
-      do {
-        msg = curl_multi_info_read(multi, &rc);
-        if(msg) {
-          bool retry;
-          long delay;
-          struct per_transfer *ended;
-          CURL *easy = msg->easy_handle;
-          CURLcode tres = msg->data.result;
-          curl_easy_getinfo(easy, CURLINFO_PRIVATE, (void *)&ended);
-          curl_multi_remove_handle(multi, easy);
-
-          if(ended->abort && (tres == CURLE_ABORTED_BY_CALLBACK) &&
-             ended->errorbuffer) {
-            msnprintf(ended->errorbuffer, CURL_ERROR_SIZE,
-                      "Transfer aborted due to critical error "
-                      "in another transfer");
-          }
-          tres = post_per_transfer(global, ended, tres, &retry, &delay);
-          progress_finalize(ended); /* before it goes away */
-          all_added--; /* one fewer added */
-          checkmore = TRUE;
-          if(retry) {
-            ended->added = FALSE; /* add it again */
-            /* we delay retries in full integer seconds only */
-            ended->startat = delay ? time(NULL) + delay/1000 : 0;
-          }
-          else {
-            /* result receives this transfer's error unless the transfer was
-               marked for abort due to a critical error in another transfer */
-            if(tres && (!ended->abort || !result))
-              result = tres;
-            if(is_fatal_error(result) || (result && global->fail_early))
-              wrapitup = TRUE;
-            (void)del_per_transfer(ended);
-          }
-        }
-      } while(msg);
-      if(wrapitup) {
-        if(still_running)
-          continue;
-        else
-          break;
-      }
-      if(!checkmore) {
-        time_t tock = time(NULL);
-        if(tick != tock) {
-          checkmore = TRUE;
-          tick = tock;
-        }
-      }
-      if(checkmore) {
-        /* one or more transfers completed, add more! */
-        CURLcode tres = add_parallel_transfers(global, multi, share,
-                                               &more_transfers,
-                                               &added_transfers);
-        if(tres)
-          result = tres;
-        if(added_transfers)
-          /* we added new ones, make sure the loop doesn't exit yet */
-          still_running = 1;
-      }
-      if(is_fatal_error(result) || (result && global->fail_early))
-        wrapitup = TRUE;
+      break;
     }
   }
 
-  (void)progress_meter(global, &start, TRUE);
+  result = s->result;
 
   /* Make sure to return some kind of error if there was a multi problem */
-  if(mcode) {
-    result = (mcode == CURLM_OUT_OF_MEMORY) ? CURLE_OUT_OF_MEMORY :
+  if(s->mcode) {
+    result = (s->mcode == CURLM_OUT_OF_MEMORY) ? CURLE_OUT_OF_MEMORY :
       /* The other multi errors should never happen, so return
          something suitably generic */
       CURLE_BAD_FUNCTION_ARGUMENT;
   }
 
-  curl_multi_cleanup(multi);
+  /* We need to cleanup the multi here, since the uv context lives on the
+   * stack and about to be gone. multi_cleanup can trigger events! */
+  curl_multi_cleanup(s->multi);
+
+#if DEBUG_UV
+  curl_mfprintf(tool_stderr, "DONE parallel_event -> %d, mcode=%d, "
+          "%d running, %d more\n",
+          result, s->mcode, uv.s->still_running, s->more_transfers);
+#endif
+  return result;
+}
+
+#endif
+
+static CURLcode check_finished(struct parastate *s)
+{
+  CURLcode result = CURLE_OK;
+  int rc;
+  CURLMsg *msg;
+  bool checkmore = FALSE;
+  do {
+    msg = curl_multi_info_read(s->multi, &rc);
+    if(msg) {
+      bool retry;
+      uint32_t delay;
+      struct per_transfer *ended;
+      CURL *easy = msg->easy_handle;
+      CURLcode tres = msg->data.result;
+      curl_easy_getinfo(easy, CURLINFO_PRIVATE, &ended);
+      curl_multi_remove_handle(s->multi, easy);
+
+      if(ended->abort && (tres == CURLE_ABORTED_BY_CALLBACK)) {
+        curl_msnprintf(ended->errorbuffer, CURL_ERROR_SIZE,
+                       "Transfer aborted due to critical error "
+                       "in another transfer");
+      }
+      tres = post_per_transfer(ended, tres, &retry, &delay);
+      progress_finalize(ended); /* before it goes away */
+      all_added--; /* one fewer added */
+      checkmore = TRUE;
+      if(retry) {
+        ended->added = FALSE; /* add it again */
+        /* we delay retries in full integer seconds only */
+        ended->startat = delay ? time(NULL) + (delay / 1000) : 0;
+      }
+      else {
+        /* result receives this transfer's error unless the transfer was
+           marked for abort due to a critical error in another transfer */
+        if(tres && (!ended->abort || !result))
+          result = tres;
+        if(is_fatal_error(result) || (result && global->fail_early))
+          s->wrapitup = TRUE;
+        (void)del_per_transfer(ended);
+      }
+    }
+  } while(msg);
+  if(!s->wrapitup) {
+    if(!checkmore) {
+      time_t tock = time(NULL);
+      if(s->tick != tock) {
+        checkmore = TRUE;
+        s->tick = tock;
+      }
+    }
+    if(checkmore) {
+      /* one or more transfers completed, add more! */
+      CURLcode tres = add_parallel_transfers(s->multi, s->share,
+                                             &s->more_transfers,
+                                             &s->added_transfers);
+      if(tres)
+        result = tres;
+      if(s->added_transfers)
+        /* we added new ones, make sure the loop does not exit yet */
+        s->still_running = 1;
+    }
+    if(is_fatal_error(result) || (result && global->fail_early))
+      s->wrapitup = TRUE;
+  }
+  return result;
+}
+
+static void mnotify(CURLM *multi, unsigned int notification,
+                    CURL *easy, void *user_data)
+{
+  struct parastate *s = user_data;
+  CURLcode result;
+
+  (void)multi;
+  (void)easy;
+
+  switch(notification) {
+  case CURLMNOTIFY_INFO_READ:
+    result = check_finished(s);
+    /* remember first failure */
+    if(result && !s->result)
+      s->result = result;
+    break;
+  default:
+    break;
+  }
+}
+
+static CURLcode parallel_transfers(CURLSH *share)
+{
+  CURLcode result;
+  struct parastate p;
+  struct parastate *s = &p;
+  s->share = share;
+  s->mcode = CURLM_OK;
+  s->result = CURLE_OK;
+  s->still_running = 1;
+  s->start = curlx_now();
+  s->wrapitup = FALSE;
+  s->wrapitup_processed = FALSE;
+  s->tick = time(NULL);
+  s->multi = curl_multi_init();
+  if(!s->multi)
+    return CURLE_OUT_OF_MEMORY;
+
+  if(TRUE
+#ifdef DEBUGBUILD
+    && getenv("CURL_QUICK_EXIT")
+#endif
+    ) {
+    /* QUICK_EXIT allows for running threads to be detached and not
+     * joined. Preferably in non-debug runs. */
+    (void)curl_multi_setopt(s->multi, CURLMOPT_QUICK_EXIT, 1L);
+  }
+  (void)curl_multi_setopt(s->multi, CURLMOPT_NOTIFYFUNCTION, mnotify);
+  (void)curl_multi_setopt(s->multi, CURLMOPT_NOTIFYDATA, s);
+  (void)curl_multi_setopt(s->multi, CURLMOPT_MAX_HOST_CONNECTIONS, (long)
+                          global->parallel_host);
+  (void)curl_multi_notify_enable(s->multi, CURLMNOTIFY_INFO_READ);
+
+  result = add_parallel_transfers(s->multi, s->share,
+                                  &s->more_transfers, &s->added_transfers);
+  if(result) {
+    curl_multi_cleanup(s->multi);
+    return result;
+  }
+
+#ifdef DEBUGBUILD
+  if(global->test_event_based)
+#ifdef USE_LIBUV
+    return parallel_event(s);
+#else
+    errorf("Testing --parallel event-based requires libuv");
+#endif
+  else
+#endif
+
+  if(all_added) {
+    while(!s->mcode && (s->still_running || s->more_transfers)) {
+      /* If stopping prematurely (eg due to a --fail-early condition) then
+         signal that any transfers in the multi should abort (via progress
+         callback). */
+      if(s->wrapitup) {
+        if(!s->still_running)
+          break;
+        if(!s->wrapitup_processed) {
+          struct per_transfer *per;
+          for(per = transfers; per; per = per->next) {
+            if(per->added)
+              per->abort = TRUE;
+          }
+          s->wrapitup_processed = TRUE;
+        }
+      }
+      else if(s->more_transfers) {
+        s->result = add_parallel_transfers(s->multi, s->share,
+                                           &s->more_transfers,
+                                           &s->added_transfers);
+        if(s->result)
+          break;
+      }
+
+      s->mcode = curl_multi_poll(s->multi, NULL, 0, 1000, NULL);
+      if(!s->mcode)
+        s->mcode = curl_multi_perform(s->multi, &s->still_running);
+
+      progress_meter(s->multi, &s->start, FALSE);
+    }
+
+    (void)progress_meter(s->multi, &s->start, TRUE);
+  }
+
+  /* Result is the first failed transfer - if there was one. */
+  result = s->result;
+
+  /* Make sure to return some kind of error if there was a multi problem */
+  if(s->mcode) {
+    result = (s->mcode == CURLM_OUT_OF_MEMORY) ? CURLE_OUT_OF_MEMORY :
+      /* The other multi errors should never happen, so return
+         something suitably generic */
+      CURLE_BAD_FUNCTION_ARGUMENT;
+  }
+
+  curl_multi_cleanup(s->multi);
 
   return result;
 }
 
-static CURLcode serial_transfers(struct GlobalConfig *global,
-                                 CURLSH *share)
+static CURLcode serial_transfers(CURLSH *share)
 {
   CURLcode returncode = CURLE_OK;
   CURLcode result = CURLE_OK;
   struct per_transfer *per;
   bool added = FALSE;
+  bool skipped = FALSE;
 
-  result = create_transfer(global, share, &added);
+  result = create_transfer(share, &added, &skipped);
   if(result)
     return result;
   if(!added) {
-    errorf(global, "no transfer performed");
+    errorf("no transfer performed");
     return CURLE_READ_ERROR;
   }
   for(per = transfers; per;) {
     bool retry;
-    long delay_ms;
+    uint32_t delay_ms;
     bool bailout = FALSE;
-    struct timeval start;
-    result = pre_transfer(global, per);
-    if(result)
-      break;
+    struct curltime start;
 
-    if(global->libcurl) {
-      result = easysrc_perform();
+    start = curlx_now();
+    if(!per->skip) {
+      result = pre_transfer(per);
       if(result)
         break;
-    }
-    start = tvnow();
-#ifdef CURLDEBUG
-    if(global->test_event_based)
-      result = curl_easy_perform_ev(per->curl);
-    else
-#endif
-      result = curl_easy_perform(per->curl);
 
-    returncode = post_per_transfer(global, per, result, &retry, &delay_ms);
+      if(global->libcurl) {
+        result = easysrc_perform();
+        if(result)
+          break;
+      }
+
+#ifdef DEBUGBUILD
+      if(getenv("CURL_FORBID_REUSE"))
+        (void)curl_easy_setopt(per->curl, CURLOPT_FORBID_REUSE, 1L);
+
+      if(global->test_duphandle) {
+        CURL *dup = curl_easy_duphandle(per->curl);
+        curl_easy_cleanup(per->curl);
+        per->curl = dup;
+        if(!dup) {
+          result = CURLE_OUT_OF_MEMORY;
+          break;
+        }
+        /* a duplicate needs the share re-added */
+        (void)curl_easy_setopt(per->curl, CURLOPT_SHARE, share);
+      }
+      if(global->test_event_based)
+        result = curl_easy_perform_ev(per->curl);
+      else
+#endif
+        result = curl_easy_perform(per->curl);
+    }
+
+    returncode = post_per_transfer(per, result, &retry, &delay_ms);
     if(retry) {
-      tool_go_sleep(delay_ms);
+      curlx_wait_ms(delay_ms);
       continue;
     }
 
@@ -2488,12 +2122,15 @@ static CURLcode serial_transfers(struct GlobalConfig *global,
     if(is_fatal_error(returncode) || (returncode && global->fail_early))
       bailout = TRUE;
     else {
-      /* setup the next one just before we delete this */
-      result = create_transfer(global, share, &added);
-      if(result) {
-        returncode = result;
-        bailout = TRUE;
-      }
+      do {
+        /* setup the next one before we delete this */
+        result = create_transfer(share, &added, &skipped);
+        if(result) {
+          returncode = result;
+          bailout = TRUE;
+          break;
+        }
+      } while(skipped);
     }
 
     per = del_per_transfer(per);
@@ -2504,12 +2141,13 @@ static CURLcode serial_transfers(struct GlobalConfig *global,
     if(per && global->ms_per_transfer) {
       /* how long time did the most recent transfer take in number of
          milliseconds */
-      long milli = tvdiff(tvnow(), start);
+      timediff_t milli = curlx_timediff_ms(curlx_now(), start);
       if(milli < global->ms_per_transfer) {
-        notef(global, "Transfer took %ld ms, waits %ldms as set by --rate",
-              milli, global->ms_per_transfer - milli);
+        notef("Transfer took %" CURL_FORMAT_CURL_OFF_T " ms, "
+              "waits %ldms as set by --rate",
+              milli, (long)(global->ms_per_transfer - milli));
         /* The transfer took less time than wanted. Wait a little. */
-        tool_go_sleep(global->ms_per_transfer - milli);
+        curlx_wait_ms((long)(global->ms_per_transfer - milli));
       }
     }
   }
@@ -2518,115 +2156,142 @@ static CURLcode serial_transfers(struct GlobalConfig *global,
     result = returncode;
 
   if(result)
-    single_transfer_cleanup(global->current);
+    single_transfer_cleanup();
 
   return result;
 }
 
-/* setup a transfer for the given config */
-static CURLcode transfer_per_config(struct GlobalConfig *global,
-                                    struct OperationConfig *config,
-                                    CURLSH *share,
-                                    bool *added)
+static CURLcode is_using_schannel(int *pusing)
 {
   CURLcode result = CURLE_OK;
-  bool capath_from_env;
-  *added = FALSE;
-
-  /* Check we have a url */
-  if(!config->url_list || !config->url_list->url) {
-    helpf(stderr, "(%d) no URL specified", CURLE_FAILED_INIT);
-    return CURLE_FAILED_INIT;
-  }
-
-  /* On WIN32 we can't set the path to curl-ca-bundle.crt
-   * at compile time. So we look here for the file in two ways:
-   * 1: look at the environment variable CURL_CA_BUNDLE for a path
-   * 2: if #1 isn't found, use the windows API function SearchPath()
-   *    to find it along the app's path (includes app's dir and CWD)
-   *
-   * We support the environment variable thing for non-Windows platforms
-   * too. Just for the sake of it.
-   */
-  capath_from_env = false;
-  if(!config->cacert &&
-     !config->capath &&
-     (!config->insecure_ok || (config->doh_url && !config->doh_insecure_ok))) {
+  static int using_schannel = -1; /* -1 = not checked
+                                     0 = nope
+                                     1 = yes */
+  if(using_schannel == -1) {
     CURL *curltls = curl_easy_init();
-    struct curl_tlssessioninfo *tls_backend_info = NULL;
+    /* The TLS backend remains, so keep the info */
+    const struct curl_tlssessioninfo *tls_backend_info = NULL;
 
-    /* With the addition of CAINFO support for Schannel, this search could find
-     * a certificate bundle that was previously ignored. To maintain backward
-     * compatibility, only perform this search if not using Schannel.
-     */
-    result = curl_easy_getinfo(curltls, CURLINFO_TLS_SSL_PTR,
-                               &tls_backend_info);
-    if(result) {
-      curl_easy_cleanup(curltls);
-      return result;
-    }
-
-    /* Set the CA cert locations specified in the environment. For Windows if
-     * no environment-specified filename is found then check for CA bundle
-     * default filename curl-ca-bundle.crt in the user's PATH.
-     *
-     * If Schannel is the selected SSL backend then these locations are
-     * ignored. We allow setting CA location for schannel only when explicitly
-     * specified by the user via CURLOPT_CAINFO / --cacert.
-     */
-    if(tls_backend_info->backend != CURLSSLBACKEND_SCHANNEL) {
-      char *env;
-      env = curlx_getenv("CURL_CA_BUNDLE");
-      if(env) {
-        config->cacert = strdup(env);
-        if(!config->cacert) {
-          curl_free(env);
-          curl_easy_cleanup(curltls);
-          errorf(global, "out of memory");
-          return CURLE_OUT_OF_MEMORY;
-        }
-      }
-      else {
-        env = curlx_getenv("SSL_CERT_DIR");
-        if(env) {
-          config->capath = strdup(env);
-          if(!config->capath) {
-            curl_free(env);
-            curl_easy_cleanup(curltls);
-            errorf(global, "out of memory");
-            return CURLE_OUT_OF_MEMORY;
-          }
-          curl_free(env);
-          capath_from_env = true;
-        }
-        env = curlx_getenv("SSL_CERT_FILE");
-        if(env) {
-          config->cacert = strdup(env);
-          if(!config->cacert) {
-            curl_free(env);
-            if(capath_from_env)
-              free(config->capath);
-            curl_easy_cleanup(curltls);
-            errorf(global, "out of memory");
-            return CURLE_OUT_OF_MEMORY;
-          }
-        }
-      }
-
-      if(env)
-        curl_free(env);
-#ifdef WIN32
-      else {
-        result = FindWin32CACert(config, tls_backend_info->backend,
-                                 TEXT("curl-ca-bundle.crt"));
-      }
-#endif
+    if(!curltls)
+      result = CURLE_OUT_OF_MEMORY;
+    else {
+      result = curl_easy_getinfo(curltls, CURLINFO_TLS_SSL_PTR,
+                                 &tls_backend_info);
+      if(!result)
+        using_schannel =
+          (tls_backend_info->backend == CURLSSLBACKEND_SCHANNEL);
     }
     curl_easy_cleanup(curltls);
+    if(result)
+      return result;
+  }
+  *pusing = using_schannel;
+  return result;
+}
+
+/* Set the CA cert locations specified in the environment. For Windows if no
+ * environment-specified filename is found then check for CA bundle default
+ * filename curl-ca-bundle.crt in the user's PATH.
+ *
+ * If the user has set a CA cert/path or disabled peer verification (including
+ * for DoH, so completely disabled) then these locations are ignored.
+ *
+ * If Schannel is the selected SSL backend then these locations are ignored.
+ * We allow setting CA location for Schannel only when explicitly specified by
+ * the user via CURLOPT_CAINFO / --cacert.
+ */
+static CURLcode cacertpaths(struct OperationConfig *config)
+{
+  char *env;
+  CURLcode result;
+  int using_schannel;
+
+  if(!feature_ssl || config->cacert || config->capath ||
+     (config->insecure_ok && (!config->doh_url || config->doh_insecure_ok)))
+    return CURLE_OK;
+
+  result = is_using_schannel(&using_schannel);
+  if(result || using_schannel)
+    return result;
+
+  env = curl_getenv("CURL_CA_BUNDLE");
+  if(env) {
+    config->cacert = curlx_strdup(env);
+    curl_free(env);
+    if(!config->cacert) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto fail;
+    }
+  }
+  else {
+    env = curl_getenv("SSL_CERT_DIR");
+    if(env) {
+      config->capath = curlx_strdup(env);
+      curl_free(env);
+      if(!config->capath) {
+        result = CURLE_OUT_OF_MEMORY;
+        goto fail;
+      }
+    }
+    env = curl_getenv("SSL_CERT_FILE");
+    if(env) {
+      config->cacert = curlx_strdup(env);
+      curl_free(env);
+      if(!config->cacert) {
+        result = CURLE_OUT_OF_MEMORY;
+        goto fail;
+      }
+    }
   }
 
-  if(!result)
-    result = single_transfer(global, config, share, capath_from_env, added);
+#ifdef _WIN32
+  if(!config->capath && !config->cacert) {
+#ifdef CURL_CA_SEARCH_SAFE
+    char *cacert = NULL;
+    FILE *cafile = tool_execpath("curl-ca-bundle.crt", &cacert);
+    if(cafile) {
+      curlx_fclose(cafile);
+      config->cacert = curlx_strdup(cacert);
+      if(!config->cacert) {
+        result = CURLE_OUT_OF_MEMORY;
+        goto fail;
+      }
+    }
+#elif !defined(CURL_WINDOWS_UWP) && !defined(CURL_DISABLE_CA_SEARCH)
+    result = FindWin32CACert(config, TEXT("curl-ca-bundle.crt"));
+    if(result)
+      goto fail;
+#endif
+  }
+#endif
+  return CURLE_OK;
+fail:
+  curlx_safefree(config->capath);
+  return result;
+}
+
+/* setup a transfer for the given config */
+static CURLcode transfer_per_config(struct OperationConfig *config,
+                                    CURLSH *share,
+                                    bool *added,
+                                    bool *skipped)
+{
+  CURLcode result;
+  *added = FALSE;
+
+  /* Check we have a URL */
+  if(!config->url_list || !config->url_list->url) {
+    helpf("(%d) no URL specified", CURLE_FAILED_INIT);
+    result = CURLE_FAILED_INIT;
+  }
+  else {
+    result = cacertpaths(config);
+    if(!result) {
+      result = single_transfer(config, share, added, skipped);
+      if(!*added || result)
+        single_transfer_cleanup();
+    }
+  }
 
   return result;
 }
@@ -2635,14 +2300,14 @@ static CURLcode transfer_per_config(struct GlobalConfig *global,
  * 'create_transfer' gets the details and sets up a new transfer if 'added'
  * returns TRUE.
  */
-static CURLcode create_transfer(struct GlobalConfig *global,
-                                CURLSH *share,
-                                bool *added)
+static CURLcode create_transfer(CURLSH *share,
+                                bool *added,
+                                bool *skipped)
 {
   CURLcode result = CURLE_OK;
   *added = FALSE;
   while(global->current) {
-    result = transfer_per_config(global, global->current, share, added);
+    result = transfer_per_config(global->current, share, added, skipped);
     if(!result && !*added) {
       /* when one set is drained, continue to next */
       global->current = global->current->next;
@@ -2653,30 +2318,29 @@ static CURLcode create_transfer(struct GlobalConfig *global,
   return result;
 }
 
-static CURLcode run_all_transfers(struct GlobalConfig *global,
-                                  CURLSH *share,
+static CURLcode run_all_transfers(CURLSH *share,
                                   CURLcode result)
 {
   /* Save the values of noprogress and isatty to restore them later on */
-  bool orig_noprogress = global->noprogress;
-  bool orig_isatty = global->isatty;
+  bool orig_noprogress = (bool)global->noprogress;
+  bool orig_isatty = (bool)global->isatty;
   struct per_transfer *per;
 
   /* Time to actually do the transfers */
   if(!result) {
     if(global->parallel)
-      result = parallel_transfers(global, share);
+      result = parallel_transfers(share);
     else
-      result = serial_transfers(global, share);
+      result = serial_transfers(share);
   }
 
   /* cleanup if there are any left */
   for(per = transfers; per;) {
     bool retry;
-    long delay;
-    CURLcode result2 = post_per_transfer(global, per, result, &retry, &delay);
+    uint32_t delay;
+    CURLcode result2 = post_per_transfer(per, result, &retry, &delay);
     if(!result)
-      /* don't overwrite the original error */
+      /* do not overwrite the original error */
       result = result2;
 
     /* Free list of given URLs */
@@ -2689,14 +2353,46 @@ static CURLcode run_all_transfers(struct GlobalConfig *global,
   global->noprogress = orig_noprogress;
   global->isatty = orig_isatty;
 
-
   return result;
 }
 
-CURLcode operate(struct GlobalConfig *global, int argc, argv_item_t argv[])
+static CURLcode share_setopt(CURLSH *share, int opt)
+{
+  CURLSHcode shres = curl_share_setopt(share, CURLSHOPT_SHARE, opt);
+  if(!shres || (shres == CURLSHE_NOT_BUILT_IN))
+    return CURLE_OK;
+  return CURLE_FAILED_INIT;
+}
+
+static CURLcode share_setup(CURLSH *share)
 {
   CURLcode result = CURLE_OK;
-  char *first_arg = argc > 1 ? curlx_convert_tchar_to_UTF8(argv[1]) : NULL;
+  int i;
+  static int options[7] = {
+    CURL_LOCK_DATA_COOKIE,
+    CURL_LOCK_DATA_DNS,
+    CURL_LOCK_DATA_SSL_SESSION,
+    CURL_LOCK_DATA_PSL,
+    CURL_LOCK_DATA_HSTS,
+    0, /* 5 might be set below */
+    0
+  };
+  /* Running parallel, use the multi connection cache */
+  if(!global->parallel)
+    options[5] = CURL_LOCK_DATA_CONNECT;
+  for(i = 0; !result && options[i]; i++)
+    result = share_setopt(share, options[i]);
+  return result;
+}
+
+CURLcode operate(int argc, argv_item_t argv[])
+{
+  CURLcode result = CURLE_OK;
+  const char *first_arg;
+  char *curlrc_path = NULL;
+  bool found_curlrc = FALSE;
+
+  first_arg = argc > 1 ? convert_tchar_to_UTF8(argv[1]) : NULL;
 
 #ifdef HAVE_SETLOCALE
   /* Override locale for number parsing (only) */
@@ -2707,46 +2403,62 @@ CURLcode operate(struct GlobalConfig *global, int argc, argv_item_t argv[])
   /* Parse .curlrc if necessary */
   if((argc == 1) ||
      (first_arg && strncmp(first_arg, "-q", 2) &&
-      !curl_strequal(first_arg, "--disable"))) {
-    parseconfig(NULL, global); /* ignore possible failure */
+      strcmp(first_arg, "--disable"))) {
+    if(!parseconfig(NULL, CONFIG_MAX_LEVELS, &curlrc_path))
+      found_curlrc = TRUE;
 
-    /* If we had no arguments then make sure a url was specified in .curlrc */
+    /* If we had no arguments then make sure a URL was specified in .curlrc */
     if((argc < 2) && (!global->first->url_list)) {
-      helpf(stderr, NULL);
+      helpf(NULL);
       result = CURLE_FAILED_INIT;
     }
   }
 
-  curlx_unicodefree(first_arg);
+  unicodefree(CURL_UNCONST(first_arg));
 
   if(!result) {
     /* Parse the command line arguments */
-    ParameterError res = parse_args(global, argc, argv);
-    if(res) {
+    ParameterError err = parse_args(argc, argv);
+    if(found_curlrc) {
+      /* After parse_args so notef knows the verbosity */
+      notef("Read config file from '%s'", curlrc_path);
+    }
+    if(err) {
       result = CURLE_OK;
 
       /* Check if we were asked for the help */
-      if(res == PARAM_HELP_REQUESTED)
-        tool_help(global->help_category);
+      if(err == PARAM_HELP_REQUESTED)
+        ; /* already done */
       /* Check if we were asked for the manual */
-      else if(res == PARAM_MANUAL_REQUESTED)
+      else if(err == PARAM_MANUAL_REQUESTED) {
+#ifdef USE_MANUAL
         hugehelp();
+#else
+        warnf("built-in manual was disabled at build-time");
+#endif
+      }
       /* Check if we were asked for the version information */
-      else if(res == PARAM_VERSION_INFO_REQUESTED)
+      else if(err == PARAM_VERSION_INFO_REQUESTED)
         tool_version_info();
       /* Check if we were asked to list the SSL engines */
-      else if(res == PARAM_ENGINES_REQUESTED)
+      else if(err == PARAM_ENGINES_REQUESTED)
         tool_list_engines();
-      else if(res == PARAM_LIBCURL_UNSUPPORTED_PROTOCOL)
+      /* Check if we were asked to dump the embedded CA bundle */
+      else if(err == PARAM_CA_EMBED_REQUESTED) {
+#ifdef CURL_CA_EMBED
+        curl_mprintf("%s", curl_ca_embed);
+#endif
+      }
+      else if(err == PARAM_LIBCURL_UNSUPPORTED_PROTOCOL)
         result = CURLE_UNSUPPORTED_PROTOCOL;
-      else if(res == PARAM_READ_ERROR)
+      else if(err == PARAM_READ_ERROR)
         result = CURLE_READ_ERROR;
       else
         result = CURLE_FAILED_INIT;
     }
     else {
       if(global->libcurl) {
-        /* Initialise the libcurl source output */
+        /* Initialize the libcurl source output */
         result = easysrc_init();
       }
 
@@ -2763,15 +2475,14 @@ CURLcode operate(struct GlobalConfig *global, int argc, argv_item_t argv[])
           result = CURLE_OUT_OF_MEMORY;
         }
 
-        if(!result) {
-          curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_COOKIE);
-          curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_DNS);
-          curl_share_setopt(share, CURLSHOPT_SHARE,
-                            CURL_LOCK_DATA_SSL_SESSION);
-          curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_CONNECT);
-          curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_PSL);
-          curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_HSTS);
+        if(!result)
+          result = share_setup(share);
 
+        if(!result && global->ssl_sessions && feature_ssls_export)
+          result = tool_ssls_load(global->first, share,
+                                  global->ssl_sessions);
+
+        if(!result) {
           /* Get the required arguments for each operation */
           do {
             result = get_args(operation, count++);
@@ -2779,28 +2490,37 @@ CURLcode operate(struct GlobalConfig *global, int argc, argv_item_t argv[])
             operation = operation->next;
           } while(!result && operation);
 
-          /* Set the current operation pointer */
-          global->current = global->first;
+          if(!result) {
+            /* Set the current operation pointer */
+            global->current = global->first;
 
-          /* now run! */
-          result = run_all_transfers(global, share, result);
+            /* now run! */
+            result = run_all_transfers(share, result);
 
-          curl_share_cleanup(share);
-          if(global->libcurl) {
-            /* Cleanup the libcurl source output */
-            easysrc_cleanup();
-
-            /* Dump the libcurl code if previously enabled */
-            dumpeasysrc(global);
+            if(global->ssl_sessions && feature_ssls_export) {
+              CURLcode r2 = tool_ssls_save(global->first, share,
+                                           global->ssl_sessions);
+              if(r2 && !result)
+                result = r2;
+            }
           }
         }
+
+        curl_share_cleanup(share);
+        if(global->libcurl) {
+          /* Cleanup the libcurl source output */
+          easysrc_cleanup();
+
+          /* Dump the libcurl code if previously enabled */
+          dumpeasysrc();
+        }
       }
       else
-        errorf(global, "out of memory");
+        errorf("out of memory");
     }
   }
-
-  varcleanup(global);
+  curlx_free(curlrc_path);
+  varcleanup();
 
   return result;
 }
diff --git a/third-party/curl/src/tool_operate.h b/third-party/curl/src/tool_operate.h
index 21a7f929d0..69b304dfc0 100644
--- a/third-party/curl/src/tool_operate.h
+++ b/third-party/curl/src/tool_operate.h
@@ -24,44 +24,38 @@
  *
  ***************************************************************************/
 #include "tool_setup.h"
+
 #include "tool_cb_hdr.h"
 #include "tool_cb_prg.h"
-#include "tool_sdecls.h"
+#include "tool_cfgable.h"
 
 struct per_transfer {
+  char errorbuffer[CURL_ERROR_SIZE];
   /* double linked */
   struct per_transfer *next;
   struct per_transfer *prev;
   struct OperationConfig *config; /* for this transfer */
-  struct curl_certinfo *certinfo;
+  const struct curl_certinfo *certinfo;
   CURL *curl;
-  long retry_numretries;
-  long retry_sleep_default;
-  long retry_sleep;
-  struct timeval start; /* start of this transfer */
-  struct timeval retrystart;
-  char *this_url;
-  unsigned int urlnum; /* the index of the given URL */
+  /* NULL or malloced */
+  char *uploadfile;
+  long retry_remaining;
+  long num_retries; /* counts the performed retries */
+  struct curltime start; /* start of this transfer */
+  struct curltime retrystart;
+  char *url;
+  curl_off_t urlnum; /* the index of the given URL */
   char *outfile;
-  bool infdopen; /* TRUE if infd needs closing */
   int infd;
-  bool noprogress;
   struct ProgressData progressbar;
   struct OutStruct outs;
   struct OutStruct heads;
   struct OutStruct etag_save;
   struct HdrCbData hdrcbdata;
   long num_headers;
-  bool was_last_header_empty;
-
-  bool added; /* set TRUE when added to the multi handle */
   time_t startat; /* when doing parallel transfers, this is a retry transfer
                      that has been set to sleep until this time before it
                      should get started (again) */
-  bool abort; /* when doing parallel transfers and this is TRUE then a critical
-                 error (eg --fail-early) has occurred in another transfer and
-                 this transfer will be aborted in the progress callback */
-
   /* for parallel progress bar */
   curl_off_t dltotal;
   curl_off_t dlnow;
@@ -69,17 +63,23 @@ struct per_transfer {
   curl_off_t ulnow;
   curl_off_t uploadfilesize; /* expected total amount */
   curl_off_t uploadedsofar; /* amount delivered from the callback */
-  bool dltotal_added; /* if the total has been added from this */
-  bool ultotal_added;
+  uint32_t retry_sleep_default;
+  uint32_t retry_sleep;
+  BIT(dltotal_added); /* if the total has been added from this */
+  BIT(ultotal_added);
+  BIT(infdopen); /* TRUE if infd needs closing */
+  BIT(noprogress);
+  BIT(was_last_header_empty);
 
-  /* NULL or malloced */
-  char *uploadfile;
-  char *errorbuffer; /* alloced and assigned while this is used for a
-                        transfer */
+  BIT(added); /* set TRUE when added to the multi handle */
+  BIT(abort); /* when doing parallel transfers and this is TRUE then a critical
+                 error (eg --fail-early) has occurred in another transfer and
+                 this transfer gets aborted in the progress callback */
+  BIT(skip);  /* considered already done */
 };
 
-CURLcode operate(struct GlobalConfig *config, int argc, argv_item_t argv[]);
-void single_transfer_cleanup(struct OperationConfig *config);
+CURLcode operate(int argc, argv_item_t argv[]);
+void single_transfer_cleanup(void);
 
 extern struct per_transfer *transfers; /* first node */
 
diff --git a/third-party/curl/src/tool_operhlp.c b/third-party/curl/src/tool_operhlp.c
index a964d796de..316393abb8 100644
--- a/third-party/curl/src/tool_operhlp.c
+++ b/third-party/curl/src/tool_operhlp.c
@@ -22,19 +22,12 @@
  *
  ***************************************************************************/
 #include "tool_setup.h"
+
 #include "tool_operate.h"
-
-#include "strcase.h"
-
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
-
 #include "tool_cfgable.h"
 #include "tool_doswin.h"
 #include "tool_operhlp.h"
-
-#include "memdebug.h" /* keep this as LAST include */
+#include "tool_msgs.h"
 
 void clean_getout(struct OperationConfig *config)
 {
@@ -44,15 +37,15 @@ void clean_getout(struct OperationConfig *config)
 
     while(node) {
       next = node->next;
-      Curl_safefree(node->url);
-      Curl_safefree(node->outfile);
-      Curl_safefree(node->infile);
-      Curl_safefree(node);
+      curlx_safefree(node->url);
+      curlx_safefree(node->outfile);
+      curlx_safefree(node->infile);
+      curlx_safefree(node);
       node = next;
     }
     config->url_list = NULL;
+    single_transfer_cleanup();
   }
-  single_transfer_cleanup(config);
 }
 
 bool output_expected(const char *url, const char *uploadfile)
@@ -60,15 +53,14 @@ bool output_expected(const char *url, const char *uploadfile)
   if(!uploadfile)
     return TRUE;  /* download */
   if(checkprefix("http://", url) || checkprefix("https://", url))
-    return TRUE;   /* HTTP(S) upload */
+    return TRUE;  /* HTTP(S) upload */
 
   return FALSE; /* non-HTTP upload, probably no output should be expected */
 }
 
 bool stdin_upload(const char *uploadfile)
 {
-  return (!strcmp(uploadfile, "-") ||
-          !strcmp(uploadfile, ".")) ? TRUE : FALSE;
+  return !strcmp(uploadfile, "-") || !strcmp(uploadfile, ".");
 }
 
 /* Convert a CURLUcode into a CURLcode */
@@ -86,45 +78,48 @@ CURLcode urlerr_cvt(CURLUcode ucode)
 }
 
 /*
- * Adds the file name to the URL if it doesn't already have one.
- * url will be freed before return if the returned pointer is different
+ * Adds the filename to the URL if it does not already have one.
+ * URL is freed before return if the returned pointer is different
  */
 CURLcode add_file_name_to_url(CURL *curl, char **inurlp, const char *filename)
 {
-  CURLcode result = CURLE_URL_MALFORMAT;
+  CURLcode result = CURLE_OUT_OF_MEMORY;
   CURLUcode uerr;
   CURLU *uh = curl_url();
   char *path = NULL;
   char *query = NULL;
   if(uh) {
-    char *ptr;
+    const char *ptr;
     uerr = curl_url_set(uh, CURLUPART_URL, *inurlp,
-                    CURLU_GUESS_SCHEME|CURLU_NON_SUPPORT_SCHEME);
+                        CURLU_GUESS_SCHEME | CURLU_NON_SUPPORT_SCHEME);
     if(uerr) {
       result = urlerr_cvt(uerr);
-      goto fail;
+      goto out;
     }
     uerr = curl_url_get(uh, CURLUPART_PATH, &path, 0);
     if(uerr) {
       result = urlerr_cvt(uerr);
-      goto fail;
+      goto out;
     }
     uerr = curl_url_get(uh, CURLUPART_QUERY, &query, 0);
+    if(uerr == CURLUE_OUT_OF_MEMORY) {
+      result = urlerr_cvt(uerr);
+      goto out;
+    }
     if(!uerr && query) {
       curl_free(query);
-      curl_free(path);
-      curl_url_cleanup(uh);
-      return CURLE_OK;
+      result = CURLE_OK;
+      goto out;
     }
     ptr = strrchr(path, '/');
     if(!ptr || !*++ptr) {
-      /* The URL path has no file name part, add the local file name. In order
+      /* The URL path has no filename part, add the local filename. In order
          to be able to do so, we have to create a new URL in another buffer.*/
 
       /* We only want the part of the local path that is on the right
          side of the rightmost slash and backslash. */
       const char *filep = strrchr(filename, '/');
-      char *file2 = strrchr(filep?filep:filename, '\\');
+      const char *file2 = strrchr(filep ? filep : filename, '\\');
       char *encfile;
 
       if(file2)
@@ -134,59 +129,66 @@ CURLcode add_file_name_to_url(CURL *curl, char **inurlp, const char *filename)
       else
         filep = filename;
 
-      /* URL encode the file name */
+      /* URL encode the filename */
       encfile = curl_easy_escape(curl, filep, 0 /* use strlen */);
       if(encfile) {
         char *newpath;
         char *newurl;
         if(ptr)
           /* there is a trailing slash on the path */
-          newpath = aprintf("%s%s", path, encfile);
+          newpath = curl_maprintf("%s%s", path, encfile);
         else
           /* there is no trailing slash on the path */
-          newpath = aprintf("%s/%s", path, encfile);
+          newpath = curl_maprintf("%s/%s", path, encfile);
 
         curl_free(encfile);
 
         if(!newpath)
-          goto fail;
+          goto out;
         uerr = curl_url_set(uh, CURLUPART_PATH, newpath, 0);
-        free(newpath);
+        curl_free(newpath);
         if(uerr) {
           result = urlerr_cvt(uerr);
-          goto fail;
+          goto out;
         }
         uerr = curl_url_get(uh, CURLUPART_URL, &newurl, CURLU_DEFAULT_SCHEME);
         if(uerr) {
           result = urlerr_cvt(uerr);
-          goto fail;
+          goto out;
         }
-        free(*inurlp);
-        *inurlp = newurl;
-        result = CURLE_OK;
+        curlx_free(*inurlp);
+        /* make it owned by tool memory */
+        *inurlp = curlx_strdup(newurl);
+        curl_free(newurl);
+        if(*inurlp)
+          result = CURLE_OK;
+        else
+          result = CURLE_OUT_OF_MEMORY;
       }
     }
     else
-      /* nothing to do */
-      result = CURLE_OK;
+      result = CURLE_OK;  /* nothing to do */
   }
-fail:
+out:
   curl_url_cleanup(uh);
   curl_free(path);
   return result;
 }
 
+#define DEFAULT_FILENAME "curl_response"
+
 /* Extracts the name portion of the URL.
  * Returns a pointer to a heap-allocated string or NULL if
  * no name part, at location indicated by first argument.
  */
-CURLcode get_url_file_name(char **filename, const char *url)
+CURLcode get_url_file_name(char **filename, const char *url, SANITIZEcode *sc)
 {
-  const char *pc, *pc2;
   CURLU *uh = curl_url();
   char *path = NULL;
   CURLUcode uerr;
 
+  *sc = SANITIZE_ERR_OK;
+
   if(!uh)
     return CURLE_OUT_OF_MEMORY;
 
@@ -195,57 +197,49 @@ CURLcode get_url_file_name(char **filename, const char *url)
   uerr = curl_url_set(uh, CURLUPART_URL, url, CURLU_GUESS_SCHEME);
   if(!uerr) {
     uerr = curl_url_get(uh, CURLUPART_PATH, &path, 0);
+    curl_url_cleanup(uh);
+    uh = NULL;
     if(!uerr) {
-      curl_url_cleanup(uh);
+      char *pc = NULL, *pc2 = NULL;
+      do {
+        pc = strrchr(path, '/');
+        pc2 = strrchr(pc ? pc + 1 : path, '\\');
+        if(pc2)
+          pc = pc2;
+        if(pc && !pc[1])
+          /* if the path ends with slash, try removing the trailing one
+             and get the last directory part */
+          *pc = 0;
+        else
+          break;
+      } while(1);
 
-      pc = strrchr(path, '/');
-      pc2 = strrchr(pc ? pc + 1 : path, '\\');
-      if(pc2)
-        pc = pc2;
-
-      if(pc)
+      if(pc) {
         /* duplicate the string beyond the slash */
-        pc++;
-      else
-        /* no slash => empty string */
-        pc = "";
+        *filename = curlx_strdup(pc + 1);
+      }
+      else {
+        /* no slash => empty string, use default */
+        *filename = curlx_strdup(DEFAULT_FILENAME);
+        if(*filename)
+          warnf("No remote filename, uses \"" DEFAULT_FILENAME "\"");
+      }
 
-      *filename = strdup(pc);
       curl_free(path);
       if(!*filename)
         return CURLE_OUT_OF_MEMORY;
 
-#if defined(MSDOS) || defined(WIN32)
+#if defined(_WIN32) || defined(MSDOS)
       {
         char *sanitized;
-        SANITIZEcode sc = sanitize_file_name(&sanitized, *filename, 0);
-        Curl_safefree(*filename);
-        if(sc) {
-          if(sc == SANITIZE_ERR_OUT_OF_MEMORY)
-            return CURLE_OUT_OF_MEMORY;
-          return CURLE_URL_MALFORMAT;
-        }
+        *sc = sanitize_file_name(&sanitized, *filename, 0);
+        curlx_safefree(*filename);
+        if(*sc)
+          return CURLE_BAD_FUNCTION_ARGUMENT;
         *filename = sanitized;
       }
-#endif /* MSDOS || WIN32 */
+#endif /* _WIN32 || MSDOS */
 
-      /* in case we built debug enabled, we allow an environment variable
-       * named CURL_TESTDIR to prefix the given file name to put it into a
-       * specific directory
-       */
-#ifdef DEBUGBUILD
-      {
-        char *tdir = curlx_getenv("CURL_TESTDIR");
-        if(tdir) {
-          char *alt = aprintf("%s/%s", tdir, *filename);
-          Curl_safefree(*filename);
-          *filename = alt;
-          curl_free(tdir);
-          if(!*filename)
-            return CURLE_OUT_OF_MEMORY;
-        }
-      }
-#endif
       return CURLE_OK;
     }
   }
diff --git a/third-party/curl/src/tool_operhlp.h b/third-party/curl/src/tool_operhlp.h
index 1d56fa0408..e8a27d9742 100644
--- a/third-party/curl/src/tool_operhlp.h
+++ b/third-party/curl/src/tool_operhlp.h
@@ -28,15 +28,10 @@
 struct OperationConfig;
 
 void clean_getout(struct OperationConfig *config);
-
 bool output_expected(const char *url, const char *uploadfile);
-
 bool stdin_upload(const char *uploadfile);
-
 CURLcode add_file_name_to_url(CURL *curl, char **inurlp, const char *filename);
-
-CURLcode get_url_file_name(char **filename, const char *url);
-
+CURLcode get_url_file_name(char **filename, const char *url, SANITIZEcode *sc);
 CURLcode urlerr_cvt(CURLUcode ucode);
 
 #endif /* HEADER_CURL_TOOL_OPERHLP_H */
diff --git a/third-party/curl/src/tool_paramhlp.c b/third-party/curl/src/tool_paramhlp.c
index d70e80db4b..18e2d1a625 100644
--- a/third-party/curl/src/tool_paramhlp.c
+++ b/third-party/curl/src/tool_paramhlp.c
@@ -23,12 +23,6 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#include "strcase.h"
-
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
-
 #include "tool_cfgable.h"
 #include "tool_getparam.h"
 #include "tool_getpass.h"
@@ -37,13 +31,10 @@
 #include "tool_libinfo.h"
 #include "tool_util.h"
 #include "tool_version.h"
-#include "dynbuf.h"
-
-#include "memdebug.h" /* keep this as LAST include */
 
 struct getout *new_getout(struct OperationConfig *config)
 {
-  struct getout *node = calloc(1, sizeof(struct getout));
+  struct getout *node = curlx_calloc(1, sizeof(struct getout));
   struct getout *last = config->url_last;
   if(node) {
     static int outnum = 0;
@@ -57,49 +48,101 @@ struct getout *new_getout(struct OperationConfig *config)
     /* move the last pointer */
     config->url_last = node;
 
-    node->flags = config->default_node_flags;
+    node->useremote = config->remote_name_all;
     node->num = outnum++;
   }
   return node;
 }
 
-#define MAX_FILE2STRING (256*1024*1024) /* big enough ? */
+#define ISCRLF(x) (((x) == '\r') || ((x) == '\n') || ((x) == '\0'))
+
+/* memcrlf() has two modes. Both operate on a given memory area with
+   a specified size.
+
+   countcrlf FALSE - return number of bytes from the start that DO NOT include
+   any CR or LF or NULL
+
+   countcrlf TRUE - return number of bytes from the start that are ONLY CR or
+   LF or NULL.
+
+*/
+static size_t memcrlf(char *orig,
+                      bool countcrlf, /* TRUE if we count CRLF, FALSE
+                                         if we count non-CRLF */
+                      size_t max)
+{
+  char *ptr;
+  size_t total = max;
+  for(ptr = orig; max; max--, ptr++) {
+    bool crlf = ISCRLF(*ptr);
+    if(countcrlf ^ crlf)
+      return ptr - orig;
+  }
+  return total; /* no delimiter found */
+}
+
+#define MAX_FILE2STRING MAX_FILE2MEMORY
 
 ParameterError file2string(char **bufp, FILE *file)
 {
-  struct curlx_dynbuf dyn;
-  DEBUGASSERT(MAX_FILE2STRING < INT_MAX); /* needs to fit in an int later */
+  struct dynbuf dyn;
   curlx_dyn_init(&dyn, MAX_FILE2STRING);
   if(file) {
-    char buffer[256];
+    do {
+      char buffer[4096];
+      char *ptr;
+      size_t nread = fread(buffer, 1, sizeof(buffer), file);
+      if(ferror(file)) {
+        curlx_dyn_free(&dyn);
+        *bufp = NULL;
+        return PARAM_READ_ERROR;
+      }
+      ptr = buffer;
+      while(nread) {
+        size_t nlen = memcrlf(ptr, FALSE, nread);
+        if(curlx_dyn_addn(&dyn, ptr, nlen))
+          return PARAM_NO_MEM;
+        nread -= nlen;
 
-    while(fgets(buffer, sizeof(buffer), file)) {
-      char *ptr = strchr(buffer, '\r');
-      if(ptr)
-        *ptr = '\0';
-      ptr = strchr(buffer, '\n');
-      if(ptr)
-        *ptr = '\0';
-      if(curlx_dyn_add(&dyn, buffer))
-        return PARAM_NO_MEM;
-    }
+        if(nread) {
+          ptr += nlen;
+          nlen = memcrlf(ptr, TRUE, nread);
+          ptr += nlen;
+          nread -= nlen;
+        }
+      }
+    } while(!feof(file));
   }
   *bufp = curlx_dyn_ptr(&dyn);
   return PARAM_OK;
 }
 
-#define MAX_FILE2MEMORY (1024*1024*1024) /* big enough ? */
-
-ParameterError file2memory(char **bufp, size_t *size, FILE *file)
+ParameterError file2memory_range(char **bufp, size_t *size, FILE *file,
+                                 curl_off_t starto, curl_off_t endo)
 {
   if(file) {
     size_t nread;
-    struct curlx_dynbuf dyn;
+    struct dynbuf dyn;
+    curl_off_t offset = 0;
+    curl_off_t throwaway = 0;
+
+    if(starto) {
+      if(file != stdin) {
+        if(curlx_fseek(file, starto, SEEK_SET))
+          return PARAM_READ_ERROR;
+        offset = starto;
+      }
+      else
+        /* we cannot seek stdin, read 'starto' bytes and throw them away */
+        throwaway = starto;
+    }
+
     /* The size needs to fit in an int later */
-    DEBUGASSERT(MAX_FILE2MEMORY < INT_MAX);
     curlx_dyn_init(&dyn, MAX_FILE2MEMORY);
     do {
       char buffer[4096];
+      size_t n_add;
+      char *ptr_add;
       nread = fread(buffer, 1, sizeof(buffer), file);
       if(ferror(file)) {
         curlx_dyn_free(&dyn);
@@ -107,9 +150,35 @@ ParameterError file2memory(char **bufp, size_t *size, FILE *file)
         *bufp = NULL;
         return PARAM_READ_ERROR;
       }
-      if(nread)
-        if(curlx_dyn_addn(&dyn, buffer, nread))
-          return PARAM_NO_MEM;
+      n_add = nread;
+      ptr_add = buffer;
+      if(nread) {
+        if(throwaway) {
+          if(throwaway >= (curl_off_t)nread) {
+            throwaway -= nread;
+            offset += nread;
+            n_add = 0; /* nothing to add */
+          }
+          else {
+            /* append the trailing piece */
+            n_add = (size_t)(nread - throwaway);
+            ptr_add = &buffer[throwaway];
+            offset += throwaway;
+            throwaway = 0;
+          }
+        }
+        if(n_add) {
+          if((curl_off_t)(n_add + offset) > endo)
+            n_add = (size_t)(endo - offset + 1);
+
+          if(curlx_dyn_addn(&dyn, ptr_add, n_add))
+            return PARAM_NO_MEM;
+
+          offset += n_add;
+          if(offset > endo)
+            break;
+        }
+      }
     } while(!feof(file));
     *size = curlx_dyn_len(&dyn);
     *bufp = curlx_dyn_ptr(&dyn);
@@ -121,6 +190,11 @@ ParameterError file2memory(char **bufp, size_t *size, FILE *file)
   return PARAM_OK;
 }
 
+ParameterError file2memory(char **bufp, size_t *size, FILE *file)
+{
+  return file2memory_range(bufp, size, file, 0, CURL_OFF_T_MAX);
+}
+
 /*
  * Parse the string and write the long in the given address. Return PARAM_OK
  * on success, otherwise a parameter specific error enum.
@@ -129,37 +203,39 @@ ParameterError file2memory(char **bufp, size_t *size, FILE *file)
  * getparameter a lot, we must check it for NULL before accessing the str
  * data.
  */
-static ParameterError getnum(long *val, const char *str, int base)
-{
-  if(str) {
-    char *endptr = NULL;
-    long num;
-    errno = 0;
-    num = strtol(str, &endptr, base);
-    if(errno == ERANGE)
-      return PARAM_NUMBER_TOO_LARGE;
-    if((endptr != str) && (*endptr == '\0')) {
-      *val = num;
-      return PARAM_OK;  /* Ok */
-    }
-  }
-  return PARAM_BAD_NUMERIC; /* badness */
-}
-
 ParameterError str2num(long *val, const char *str)
 {
-  return getnum(val, str, 10);
+  curl_off_t num;
+  bool is_neg = FALSE;
+  DEBUGASSERT(str);
+  if(!curlx_str_single(&str, '-'))
+    is_neg = TRUE;
+  if(curlx_str_number(&str, &num, LONG_MAX) ||
+     curlx_str_single(&str, '\0'))
+    return PARAM_BAD_NUMERIC; /* badness */
+
+  *val = (long)num;
+  if(is_neg)
+    *val = -*val;
+  return PARAM_OK; /* Ok */
 }
 
 ParameterError oct2nummax(long *val, const char *str, long max)
 {
-  ParameterError result = getnum(val, str, 8);
-  if(result != PARAM_OK)
-    return result;
-  else if(*val > max)
-    return PARAM_NUMBER_TOO_LARGE;
-  else if(*val < 0)
+  curl_off_t num;
+  int rc;
+  DEBUGASSERT(str);
+  rc = curlx_str_octal(&str, &num, max);
+  if(rc) {
+    if(STRE_OVERFLOW == rc)
+      return PARAM_NUMBER_TOO_LARGE;
+    return PARAM_BAD_NUMERIC;
+  }
+  if(curlx_str_single(&str, '\0'))
+    return PARAM_BAD_NUMERIC;
+  if(num < 0)
     return PARAM_NEGATIVE_NUMERIC;
+  *val = (long)num;
 
   return PARAM_OK;
 }
@@ -175,9 +251,9 @@ ParameterError oct2nummax(long *val, const char *str, long max)
 
 ParameterError str2unum(long *val, const char *str)
 {
-  ParameterError result = getnum(val, str, 10);
-  if(result != PARAM_OK)
-    return result;
+  ParameterError err = str2num(val, str);
+  if(err != PARAM_OK)
+    return err;
   if(*val < 0)
     return PARAM_NEGATIVE_NUMERIC;
 
@@ -196,49 +272,15 @@ ParameterError str2unum(long *val, const char *str)
 
 ParameterError str2unummax(long *val, const char *str, long max)
 {
-  ParameterError result = str2unum(val, str);
-  if(result != PARAM_OK)
-    return result;
+  ParameterError err = str2unum(val, str);
+  if(err != PARAM_OK)
+    return err;
   if(*val > max)
     return PARAM_NUMBER_TOO_LARGE;
 
   return PARAM_OK;
 }
 
-
-/*
- * Parse the string and write the double in the given address. Return PARAM_OK
- * on success, otherwise a parameter specific error enum.
- *
- * The 'max' argument is the maximum value allowed, as the numbers are often
- * multiplied when later used.
- *
- * Since this function gets called with the 'nextarg' pointer from within the
- * getparameter a lot, we must check it for NULL before accessing the str
- * data.
- */
-
-static ParameterError str2double(double *val, const char *str, double max)
-{
-  if(str) {
-    char *endptr;
-    double num;
-    errno = 0;
-    num = strtod(str, &endptr);
-    if(errno == ERANGE)
-      return PARAM_NUMBER_TOO_LARGE;
-    if(num > max) {
-      /* too large */
-      return PARAM_NUMBER_TOO_LARGE;
-    }
-    if((endptr != str) && (endptr == str + strlen(str))) {
-      *val = num;
-      return PARAM_OK;  /* Ok */
-    }
-  }
-  return PARAM_BAD_NUMERIC; /* badness */
-}
-
 /*
  * Parse the string as seconds with decimals, and write the number of
  * milliseconds that corresponds in the given address. Return PARAM_OK on
@@ -252,16 +294,39 @@ static ParameterError str2double(double *val, const char *str, double max)
  * data.
  */
 
-ParameterError secs2ms(long *valp, const char *str)
+ParameterError secs2ms(long *val, const char *str)
 {
-  double value;
-  ParameterError result = str2double(&value, str, (double)LONG_MAX/1000);
-  if(result != PARAM_OK)
-    return result;
-  if(value < 0)
-    return PARAM_NEGATIVE_NUMERIC;
+  curl_off_t secs;
+  long ms = 0;
+  const unsigned int digs[] = {
+    1,
+    10,
+    100,
+    1000,
+    10000,
+    100000,
+    1000000,
+    10000000,
+    100000000
+  };
+  if(!str || curlx_str_number(&str, &secs, LONG_MAX / 1000 - 1))
+    return PARAM_BAD_NUMERIC;
+  if(!curlx_str_single(&str, '.')) {
+    curl_off_t fracs;
+    const char *s = str;
+    size_t len;
+    if(curlx_str_number(&str, &fracs, CURL_OFF_T_MAX))
+      return PARAM_NUMBER_TOO_LARGE;
+    /* how many milliseconds are in fracs ? */
+    len = (str - s);
+    while((len > CURL_ARRAYSIZE(digs) || (fracs > LONG_MAX / 100))) {
+      fracs /= 10;
+      len--;
+    }
+    ms = ((long)fracs * 100) / digs[len - 1];
+  }
 
-  *valp = (long)(value*1000);
+  *val = ((long)secs * 1000) + ms;
   return PARAM_OK;
 }
 
@@ -275,7 +340,7 @@ static size_t protoset_index(const char * const *protoset, const char *proto)
 {
   const char * const *p = protoset;
 
-  DEBUGASSERT(proto == proto_token(proto));     /* Ensure it is tokenized. */
+  DEBUGASSERT(proto == proto_token(proto)); /* Ensure it is tokenized. */
 
   for(; *p; p++)
     if(proto == *p)
@@ -323,34 +388,23 @@ static void protoset_clear(const char **protoset, const char *proto)
  * data.
  */
 
-#define MAX_PROTOSTRING (64*11) /* Enough room for 64 10-chars proto names. */
+#define MAX_PROTOS 34
+#define MAX_PROTOSTRING (MAX_PROTOS * 11)  /* Room for MAX_PROTOS number of
+                                              10-chars proto names. */
 
-ParameterError proto2num(struct OperationConfig *config,
-                         const char * const *val, char **ostr, const char *str)
+ParameterError proto2num(const char * const *val, char **ostr, const char *str)
 {
-  char *buffer;
-  const char *sep = ",";
-  char *token;
-  const char **protoset;
-  struct curlx_dynbuf obuf;
+  struct dynbuf obuf;
   size_t proto;
-  CURLcode result;
+  CURLcode result = CURLE_OK;
+  const char *protoset[MAX_PROTOS + 1];
+
+  DEBUGASSERT(proto_count <= MAX_PROTOS);
+  if(proto_count > MAX_PROTOS) /* if case of surprises */
+    return PARAM_NO_MEM;
 
   curlx_dyn_init(&obuf, MAX_PROTOSTRING);
 
-  if(!str)
-    return PARAM_OPTION_AMBIGUOUS;
-
-  buffer = strdup(str); /* because strtok corrupts it */
-  if(!buffer)
-    return PARAM_NO_MEM;
-
-  protoset = malloc((proto_count + 1) * sizeof(*protoset));
-  if(!protoset) {
-    free(buffer);
-    return PARAM_NO_MEM;
-  }
-
   /* Preset protocol set with default values. */
   protoset[0] = NULL;
   for(; *val; val++) {
@@ -360,46 +414,57 @@ ParameterError proto2num(struct OperationConfig *config,
       protoset_set(protoset, p);
   }
 
-  /* Allow strtok() here since this isn't used threaded */
-  /* !checksrc! disable BANNEDFUNC 2 */
-  for(token = strtok(buffer, sep);
-      token;
-      token = strtok(NULL, sep)) {
+  while(*str) {
+    const char *next = strchr(str, ',');
+    size_t plen;
     enum e_action { allow, deny, set } action = allow;
 
-    /* Process token modifiers */
-    while(!ISALNUM(*token)) { /* may be NULL if token is all modifiers */
-      switch(*token++) {
-      case '=':
-        action = set;
-        break;
-      case '-':
-        action = deny;
-        break;
-      case '+':
-        action = allow;
-        break;
-      default: /* Includes case of terminating NULL */
-        free(buffer);
-        free((char *) protoset);
-        return PARAM_BAD_USE;
+    if(next) {
+      if(str == next) {
+        str++;
+        continue;
       }
+      plen = next - str - 1;
+    }
+    else
+      plen = strlen(str) - 1;
+
+    /* Process token modifiers */
+    switch(*str++) {
+    case '=':
+      action = set;
+      break;
+    case '-':
+      action = deny;
+      break;
+    case '+':
+      action = allow;
+      break;
+    default:
+      /* no modifier */
+      str--;
+      plen++;
+      break;
     }
 
-    if(curl_strequal(token, "all")) {
+    if((plen == 3) && curl_strnequal(str, "all", 3)) {
       switch(action) {
       case deny:
         protoset[0] = NULL;
         break;
       case allow:
       case set:
-        memcpy((char *) protoset,
-               built_in_protos, (proto_count + 1) * sizeof(*protoset));
+        memcpy((char *)protoset, built_in_protos,
+               (proto_count + 1) * sizeof(*protoset));
         break;
       }
     }
     else {
-      const char *p = proto_token(token);
+      char buffer[32];
+      const char *p;
+      curl_msnprintf(buffer, sizeof(buffer), "%.*s", (int)plen, str);
+
+      p = proto_token(buffer);
 
       if(p)
         switch(action) {
@@ -408,7 +473,7 @@ ParameterError proto2num(struct OperationConfig *config,
           break;
         case set:
           protoset[0] = NULL;
-          /* FALLTHROUGH */
+          FALLTHROUGH();
         case allow:
           protoset_set(protoset, p);
           break;
@@ -418,25 +483,31 @@ ParameterError proto2num(struct OperationConfig *config,
            if no protocols are allowed */
         if(action == set)
           protoset[0] = NULL;
-        warnf(config->global, "unrecognized protocol '%s'", token);
+        warnf("unrecognized protocol '%s'", buffer);
       }
     }
+    if(next)
+      str = next + 1;
+    else
+      break;
   }
-  free(buffer);
 
   /* We need the protocols in alphabetic order for CI tests requirements. */
-  qsort((char *) protoset, protoset_index(protoset, NULL), sizeof(*protoset),
+  qsort((char *)protoset, protoset_index(protoset, NULL), sizeof(*protoset),
         struplocompare4sort);
 
-  result = curlx_dyn_addn(&obuf, "", 0);
   for(proto = 0; protoset[proto] && !result; proto++)
-    result = curlx_dyn_addf(&obuf, "%s,", protoset[proto]);
-  free((char *) protoset);
-  curlx_dyn_setlen(&obuf, curlx_dyn_len(&obuf) - 1);
-  free(*ostr);
+    result = curlx_dyn_addf(&obuf, "%s%s", curlx_dyn_len(&obuf) ? "," : "",
+                            protoset[proto]);
+  if(result)
+    return PARAM_NO_MEM;
+  if(!curlx_dyn_len(&obuf)) {
+    curlx_dyn_free(&obuf);
+    return PARAM_BAD_USE;
+  }
+  curlx_free(*ostr);
   *ostr = curlx_dyn_ptr(&obuf);
-
-  return *ostr ? PARAM_OK : PARAM_NO_MEM;
+  return PARAM_OK;
 }
 
 /**
@@ -467,32 +538,13 @@ ParameterError check_protocol(const char *str)
  */
 ParameterError str2offset(curl_off_t *val, const char *str)
 {
-  char *endptr;
-  if(str[0] == '-')
-    /* offsets aren't negative, this indicates weird input */
-    return PARAM_NEGATIVE_NUMERIC;
-
-#if(SIZEOF_CURL_OFF_T > SIZEOF_LONG)
-  {
-    CURLofft offt = curlx_strtoofft(str, &endptr, 10, val);
-    if(CURL_OFFT_FLOW == offt)
-      return PARAM_NUMBER_TOO_LARGE;
-    else if(CURL_OFFT_INVAL == offt)
-      return PARAM_BAD_NUMERIC;
-  }
-#else
-  errno = 0;
-  *val = strtol(str, &endptr, 0);
-  if((*val == LONG_MIN || *val == LONG_MAX) && errno == ERANGE)
-    return PARAM_NUMBER_TOO_LARGE;
-#endif
-  if((endptr != str) && (endptr == str + strlen(str)))
-    return PARAM_OK;
-
-  return PARAM_BAD_NUMERIC;
+  if(curlx_str_number(&str, val, CURL_OFF_T_MAX) ||
+     curlx_str_single(&str, '\0'))
+    return PARAM_BAD_NUMERIC;
+  return PARAM_OK;
 }
 
-#define MAX_USERPWDLENGTH (100*1024)
+#define MAX_USERPWDLENGTH (100 * 1024)
 static CURLcode checkpasswd(const char *kind, /* for what purpose */
                             const size_t i,   /* operation index */
                             const bool last,  /* TRUE if last operation */
@@ -514,7 +566,7 @@ static CURLcode checkpasswd(const char *kind, /* for what purpose */
     /* no password present, prompt for one */
     char passwd[2048] = "";
     char prompt[256];
-    struct curlx_dynbuf dyn;
+    struct dynbuf dyn;
 
     curlx_dyn_init(&dyn, MAX_USERPWDLENGTH);
     if(osep)
@@ -522,13 +574,13 @@ static CURLcode checkpasswd(const char *kind, /* for what purpose */
 
     /* build a nice-looking prompt */
     if(!i && last)
-      curlx_msnprintf(prompt, sizeof(prompt),
-                      "Enter %s password for user '%s':",
-                      kind, *userpwd);
+      curl_msnprintf(prompt, sizeof(prompt),
+                     "Enter %s password for user '%s':",
+                     kind, *userpwd);
     else
-      curlx_msnprintf(prompt, sizeof(prompt),
-                      "Enter %s password for user '%s' on URL #%zu:",
-                      kind, *userpwd, i + 1);
+      curl_msnprintf(prompt, sizeof(prompt),
+                     "Enter %s password for user '%s' on URL #%zu:",
+                     kind, *userpwd, i + 1);
 
     /* get password */
     getpass_r(prompt, passwd, sizeof(passwd));
@@ -539,7 +591,7 @@ static CURLcode checkpasswd(const char *kind, /* for what purpose */
       return CURLE_OUT_OF_MEMORY;
 
     /* return the new string */
-    free(*userpwd);
+    curlx_free(*userpwd);
     *userpwd = curlx_dyn_ptr(&dyn);
   }
 
@@ -557,7 +609,7 @@ ParameterError add2list(struct curl_slist **list, const char *ptr)
   return PARAM_OK;
 }
 
-int ftpfilemethod(struct OperationConfig *config, const char *str)
+long ftpfilemethod(const char *str)
 {
   if(curl_strequal("singlecwd", str))
     return CURLFTPMETHOD_SINGLECWD;
@@ -566,26 +618,24 @@ int ftpfilemethod(struct OperationConfig *config, const char *str)
   if(curl_strequal("multicwd", str))
     return CURLFTPMETHOD_MULTICWD;
 
-  warnf(config->global, "unrecognized ftp file method '%s', using default",
-        str);
+  warnf("unrecognized ftp file method '%s', using default", str);
 
   return CURLFTPMETHOD_MULTICWD;
 }
 
-int ftpcccmethod(struct OperationConfig *config, const char *str)
+long ftpcccmethod(const char *str)
 {
   if(curl_strequal("passive", str))
     return CURLFTPSSL_CCC_PASSIVE;
   if(curl_strequal("active", str))
     return CURLFTPSSL_CCC_ACTIVE;
 
-  warnf(config->global, "unrecognized ftp CCC method '%s', using default",
-        str);
+  warnf("unrecognized ftp CCC method '%s', using default", str);
 
   return CURLFTPSSL_CCC_PASSIVE;
 }
 
-long delegation(struct OperationConfig *config, const char *str)
+long delegation(const char *str)
 {
   if(curl_strequal("none", str))
     return CURLGSSAPI_DELEGATION_NONE;
@@ -594,36 +644,26 @@ long delegation(struct OperationConfig *config, const char *str)
   if(curl_strequal("always", str))
     return CURLGSSAPI_DELEGATION_FLAG;
 
-  warnf(config->global, "unrecognized delegation method '%s', using none",
-        str);
+  warnf("unrecognized delegation method '%s', using none", str);
 
   return CURLGSSAPI_DELEGATION_NONE;
 }
 
-/*
- * my_useragent: returns allocated string with default user agent
- */
-static char *my_useragent(void)
-{
-  return strdup(CURL_NAME "/" CURL_VERSION);
-}
-
-#define isheadersep(x) ((((x)==':') || ((x)==';')))
+#define isheadersep(x) ((((x) == ':') || ((x) == ';')))
 
 /*
  * inlist() returns true if the given 'checkfor' header is present in the
  * header list.
  */
-static bool inlist(const struct curl_slist *head,
-                   const char *checkfor)
+static bool inlist(const struct curl_slist *head, const char *checkfor)
 {
   size_t thislen = strlen(checkfor);
   DEBUGASSERT(thislen);
-  DEBUGASSERT(checkfor[thislen-1] != ':');
+  DEBUGASSERT(checkfor[thislen - 1] != ':');
 
   for(; head; head = head->next) {
     if(curl_strnequal(head->data, checkfor, thislen) &&
-       isheadersep(head->data[thislen]) )
+       isheadersep(head->data[thislen]))
       return TRUE;
   }
 
@@ -647,57 +687,42 @@ CURLcode get_args(struct OperationConfig *config, const size_t i)
       return CURLE_OUT_OF_MEMORY;
   }
 
-  /* Check we have a password for the given host user */
-  if(config->userpwd && !config->oauth_bearer) {
+  /* Check if we have a password for the given host user */
+  if(config->userpwd && !config->oauth_bearer)
     result = checkpasswd("host", i, last, &config->userpwd);
-    if(result)
-      return result;
-  }
 
-  /* Check we have a password for the given proxy user */
-  if(config->proxyuserpwd) {
+  /* Check if we have a password for the given proxy user */
+  if(!result && config->proxyuserpwd)
     result = checkpasswd("proxy", i, last, &config->proxyuserpwd);
-    if(result)
-      return result;
-  }
-
-  /* Check we have a user agent */
-  if(!config->useragent) {
-    config->useragent = my_useragent();
-    if(!config->useragent) {
-      errorf(config->global, "out of memory");
-      result = CURLE_OUT_OF_MEMORY;
-    }
-  }
 
   return result;
 }
 
 /*
  * Parse the string and modify ssl_version in the val argument. Return PARAM_OK
- * on success, otherwise a parameter error enum. ONLY ACCEPTS POSITIVE NUMBERS!
+ * on success, otherwise a parameter error enum.
  *
  * Since this function gets called with the 'nextarg' pointer from within the
  * getparameter a lot, we must check it for NULL before accessing the str
  * data.
  */
 
-ParameterError str2tls_max(long *val, const char *str)
+ParameterError str2tls_max(unsigned char *val, const char *str)
 {
-   static struct s_tls_max {
+  static struct s_tls_max {
     const char *tls_max_str;
-    long tls_max;
+    unsigned char tls_max;
   } const tls_max_array[] = {
-    { "default", CURL_SSLVERSION_MAX_DEFAULT },
-    { "1.0",     CURL_SSLVERSION_MAX_TLSv1_0 },
-    { "1.1",     CURL_SSLVERSION_MAX_TLSv1_1 },
-    { "1.2",     CURL_SSLVERSION_MAX_TLSv1_2 },
-    { "1.3",     CURL_SSLVERSION_MAX_TLSv1_3 }
+    { "default", 0 }, /* lets the library decide */
+    { "1.0",     1 },
+    { "1.1",     2 },
+    { "1.2",     3 },
+    { "1.3",     4 }
   };
   size_t i = 0;
   if(!str)
     return PARAM_REQUIRES_PARAMETER;
-  for(i = 0; i < sizeof(tls_max_array)/sizeof(tls_max_array[0]); i++) {
+  for(i = 0; i < CURL_ARRAYSIZE(tls_max_array); i++) {
     if(!strcmp(str, tls_max_array[i].tls_max_str)) {
       *val = tls_max_array[i].tls_max;
       return PARAM_OK;
diff --git a/third-party/curl/src/tool_paramhlp.h b/third-party/curl/src/tool_paramhlp.h
index edb8781950..af40f10591 100644
--- a/third-party/curl/src/tool_paramhlp.h
+++ b/third-party/curl/src/tool_paramhlp.h
@@ -24,38 +24,36 @@
  *
  ***************************************************************************/
 #include "tool_setup.h"
-#include "tool_libinfo.h"
 
 struct getout *new_getout(struct OperationConfig *config);
 
 ParameterError file2string(char **bufp, FILE *file);
 
+#if SIZEOF_SIZE_T > 4
+#define MAX_FILE2MEMORY (16LL * 1024 * 1024 * 1024)
+#else
+#define MAX_FILE2MEMORY (INT_MAX)
+#endif
+
 ParameterError file2memory(char **bufp, size_t *size, FILE *file);
+ParameterError file2memory_range(char **bufp, size_t *size, FILE *file,
+                                 curl_off_t starto, curl_off_t endo);
 
 ParameterError str2num(long *val, const char *str);
 ParameterError str2unum(long *val, const char *str);
 ParameterError oct2nummax(long *val, const char *str, long max);
 ParameterError str2unummax(long *val, const char *str, long max);
 ParameterError secs2ms(long *val, const char *str);
-
-ParameterError proto2num(struct OperationConfig *config,
-                         const char * const *val, char **obuf,
+ParameterError proto2num(const char * const *val, char **ostr,
                          const char *str);
-
 ParameterError check_protocol(const char *str);
-
 ParameterError str2offset(curl_off_t *val, const char *str);
-
 CURLcode get_args(struct OperationConfig *config, const size_t i);
-
 ParameterError add2list(struct curl_slist **list, const char *ptr);
+long ftpfilemethod(const char *str);
+long ftpcccmethod(const char *str);
+long delegation(const char *str);
 
-int ftpfilemethod(struct OperationConfig *config, const char *str);
-
-int ftpcccmethod(struct OperationConfig *config, const char *str);
-
-long delegation(struct OperationConfig *config, const char *str);
-
-ParameterError str2tls_max(long *val, const char *str);
+ParameterError str2tls_max(unsigned char *val, const char *str);
 
 #endif /* HEADER_CURL_TOOL_PARAMHLP_H */
diff --git a/third-party/curl/src/tool_parsecfg.c b/third-party/curl/src/tool_parsecfg.c
index 0bc69646b0..e7d3a3f878 100644
--- a/third-party/curl/src/tool_parsecfg.c
+++ b/third-party/curl/src/tool_parsecfg.c
@@ -23,278 +23,28 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
-
 #include "tool_cfgable.h"
 #include "tool_getparam.h"
 #include "tool_helpers.h"
 #include "tool_findfile.h"
 #include "tool_msgs.h"
 #include "tool_parsecfg.h"
-#include "dynbuf.h"
-
-#include "memdebug.h" /* keep this as LAST include */
+#include "tool_util.h"
 
 /* only acknowledge colon or equals as separators if the option was not
    specified with an initial dash! */
-#define ISSEP(x,dash) (!dash && (((x) == '=') || ((x) == ':')))
-
-static const char *unslashquote(const char *line, char *param);
-
-#define MAX_CONFIG_LINE_LENGTH (10*1024*1024)
-static bool my_get_line(FILE *fp, struct curlx_dynbuf *, bool *error);
-
-#ifdef WIN32
-static FILE *execpath(const char *filename, char **pathp)
-{
-  static char filebuffer[512];
-  /* Get the filename of our executable. GetModuleFileName is already declared
-   * via inclusions done in setup header file.  We assume that we are using
-   * the ASCII version here.
-   */
-  unsigned long len = GetModuleFileNameA(0, filebuffer, sizeof(filebuffer));
-  if(len > 0 && len < sizeof(filebuffer)) {
-    /* We got a valid filename - get the directory part */
-    char *lastdirchar = strrchr(filebuffer, '\\');
-    if(lastdirchar) {
-      size_t remaining;
-      *lastdirchar = 0;
-      /* If we have enough space, build the RC filename */
-      remaining = sizeof(filebuffer) - strlen(filebuffer);
-      if(strlen(filename) < remaining - 1) {
-        FILE *f;
-        msnprintf(lastdirchar, remaining, "%s%s", DIR_CHAR, filename);
-        *pathp = filebuffer;
-        f = fopen(filebuffer, FOPEN_READTEXT);
-        return f;
-      }
-    }
-  }
-
-  return NULL;
-}
-#endif
-
-
-/* return 0 on everything-is-fine, and non-zero otherwise */
-int parseconfig(const char *filename, struct GlobalConfig *global)
-{
-  FILE *file = NULL;
-  bool usedarg = FALSE;
-  int rc = 0;
-  struct OperationConfig *operation = global->last;
-  char *pathalloc = NULL;
-
-  if(!filename) {
-    /* NULL means load .curlrc from homedir! */
-    char *curlrc = findfile(".curlrc", CURLRC_DOTSCORE);
-    if(curlrc) {
-      file = fopen(curlrc, FOPEN_READTEXT);
-      if(!file) {
-        free(curlrc);
-        return 1;
-      }
-      filename = pathalloc = curlrc;
-    }
-#ifdef WIN32 /* Windows */
-    else {
-      char *fullp;
-      /* check for .curlrc then _curlrc in the dir of the executable */
-      file = execpath(".curlrc", &fullp);
-      if(!file)
-        file = execpath("_curlrc", &fullp);
-      if(file)
-        /* this is the filename we read from */
-        filename = fullp;
-    }
-#endif
-  }
-  else {
-    if(strcmp(filename, "-"))
-      file = fopen(filename, FOPEN_READTEXT);
-    else
-      file = stdin;
-  }
-
-  if(file) {
-    char *line;
-    char *option;
-    char *param;
-    int lineno = 0;
-    bool dashed_option;
-    struct curlx_dynbuf buf;
-    bool fileerror;
-    curlx_dyn_init(&buf, MAX_CONFIG_LINE_LENGTH);
-    DEBUGASSERT(filename);
-
-    while(my_get_line(file, &buf, &fileerror)) {
-      int res;
-      bool alloced_param = FALSE;
-      lineno++;
-      line = curlx_dyn_ptr(&buf);
-      if(!line) {
-        rc = 1; /* out of memory */
-        break;
-      }
-
-      /* line with # in the first non-blank column is a comment! */
-      while(*line && ISSPACE(*line))
-        line++;
-
-      switch(*line) {
-      case '#':
-      case '/':
-      case '\r':
-      case '\n':
-      case '*':
-      case '\0':
-        curlx_dyn_reset(&buf);
-        continue;
-      }
-
-      /* the option keywords starts here */
-      option = line;
-
-      /* the option starts with a dash? */
-      dashed_option = option[0]=='-'?TRUE:FALSE;
-
-      while(*line && !ISSPACE(*line) && !ISSEP(*line, dashed_option))
-        line++;
-      /* ... and has ended here */
-
-      if(*line)
-        *line++ = '\0'; /* null-terminate, we have a local copy of the data */
-
-#ifdef DEBUG_CONFIG
-      fprintf(stderr, "GOT: %s\n", option);
-#endif
-
-      /* pass spaces and separator(s) */
-      while(*line && (ISSPACE(*line) || ISSEP(*line, dashed_option)))
-        line++;
-
-      /* the parameter starts here (unless quoted) */
-      if(*line == '\"') {
-        /* quoted parameter, do the quote dance */
-        line++;
-        param = malloc(strlen(line) + 1); /* parameter */
-        if(!param) {
-          /* out of memory */
-          rc = 1;
-          break;
-        }
-        alloced_param = TRUE;
-        (void)unslashquote(line, param);
-      }
-      else {
-        param = line; /* parameter starts here */
-        while(*line && !ISSPACE(*line))
-          line++;
-
-        if(*line) {
-          *line = '\0'; /* null-terminate */
-
-          /* to detect mistakes better, see if there's data following */
-          line++;
-          /* pass all spaces */
-          while(*line && ISSPACE(*line))
-            line++;
-
-          switch(*line) {
-          case '\0':
-          case '\r':
-          case '\n':
-          case '#': /* comment */
-            break;
-          default:
-            warnf(operation->global, "%s:%d: warning: '%s' uses unquoted "
-                  "whitespace in the line that may cause side-effects",
-                  filename, lineno, option);
-          }
-        }
-        if(!*param)
-          /* do this so getparameter can check for required parameters.
-             Otherwise it always thinks there's a parameter. */
-          param = NULL;
-      }
-
-#ifdef DEBUG_CONFIG
-      fprintf(stderr, "PARAM: \"%s\"\n",(param ? param : "(null)"));
-#endif
-      res = getparameter(option, param, NULL, &usedarg, global, operation);
-      operation = global->last;
-
-      if(!res && param && *param && !usedarg)
-        /* we passed in a parameter that wasn't used! */
-        res = PARAM_GOT_EXTRA_PARAMETER;
-
-      if(res == PARAM_NEXT_OPERATION) {
-        if(operation->url_list && operation->url_list->url) {
-          /* Allocate the next config */
-          operation->next = malloc(sizeof(struct OperationConfig));
-          if(operation->next) {
-            /* Initialise the newly created config */
-            config_init(operation->next);
-
-            /* Set the global config pointer */
-            operation->next->global = global;
-
-            /* Update the last operation pointer */
-            global->last = operation->next;
-
-            /* Move onto the new config */
-            operation->next->prev = operation;
-            operation = operation->next;
-          }
-          else
-            res = PARAM_NO_MEM;
-        }
-      }
-
-      if(res != PARAM_OK && res != PARAM_NEXT_OPERATION) {
-        /* the help request isn't really an error */
-        if(!strcmp(filename, "-")) {
-          filename = "<stdin>";
-        }
-        if(res != PARAM_HELP_REQUESTED &&
-           res != PARAM_MANUAL_REQUESTED &&
-           res != PARAM_VERSION_INFO_REQUESTED &&
-           res != PARAM_ENGINES_REQUESTED) {
-          const char *reason = param2text(res);
-          warnf(operation->global, "%s:%d: warning: '%s' %s",
-                filename, lineno, option, reason);
-        }
-      }
-
-      if(alloced_param)
-        Curl_safefree(param);
-
-      curlx_dyn_reset(&buf);
-    }
-    curlx_dyn_free(&buf);
-    if(file != stdin)
-      fclose(file);
-    if(fileerror)
-      rc = 1;
-  }
-  else
-    rc = 1; /* couldn't open the file */
-
-  free(pathalloc);
-  return rc;
-}
+#define ISSEP(x, dash) (!(dash) && (((x) == '=') || ((x) == ':')))
 
 /*
- * Copies the string from line to the buffer at param, unquoting
- * backslash-quoted characters and NUL-terminating the output string.
- * Stops at the first non-backslash-quoted double quote character or the
- * end of the input string. param must be at least as long as the input
- * string.  Returns the pointer after the last handled input character.
+ * Copies the string from line to the param dynbuf, unquoting backslash-quoted
+ * characters and null-terminating the output string. Stops at the first
+ * non-backslash-quoted double quote character or the end of the input string.
+ * param must be at least as long as the input string. Returns 0 on success.
  */
-static const char *unslashquote(const char *line, char *param)
+static int unslashquote(const char *line, struct dynbuf *param)
 {
+  curlx_dyn_reset(param);
+
   while(*line && (*line != '\"')) {
     if(*line == '\\') {
       char out;
@@ -303,7 +53,7 @@ static const char *unslashquote(const char *line, char *param)
       /* default is to output the letter after the backslash */
       switch(out = *line) {
       case '\0':
-        continue; /* this'll break out of the loop */
+        continue; /* this breaks out of the loop */
       case 't':
         out = '\t';
         break;
@@ -317,35 +67,334 @@ static const char *unslashquote(const char *line, char *param)
         out = '\v';
         break;
       }
-      *param++ = out;
+      if(curlx_dyn_addn(param, &out, 1))
+        return 1;
       line++;
     }
-    else
-      *param++ = *line++;
+    else if(curlx_dyn_addn(param, line++, 1))
+      return 1;
   }
-  *param = '\0'; /* always null-terminate */
-  return line;
+  return 0; /* ok */
 }
 
 /*
- * Reads a line from the given file, ensuring is NUL terminated.
+ * Open the config file. When filename is NULL, tries to find .curlrc in the
+ * home directory (and on Windows, in the executable directory). Updates
+ * *namep to the effective filename and *pathalloc to any allocated path
+ * that must be freed by the caller. Returns the opened FILE or NULL.
  */
-static bool my_get_line(FILE *fp, struct curlx_dynbuf *db,
-                        bool *error)
+static FILE *open_config_file(const char *filename,
+                              const char **namep,
+                              char **pathalloc)
 {
-  char buf[4096];
-  *error = FALSE;
-  do {
-    /* fgets() returns s on success, and NULL on error or when end of file
-       occurs while no characters have been read. */
-    if(!fgets(buf, sizeof(buf), fp))
-      /* only if there's data in the line, return TRUE */
-      return curlx_dyn_len(db) ? TRUE : FALSE;
-    if(curlx_dyn_add(db, buf)) {
-      *error = TRUE; /* error */
-      return FALSE; /* stop reading */
-    }
-  } while(!strchr(buf, '\n'));
+  FILE *file = NULL;
+  *pathalloc = NULL;
 
-  return TRUE; /* continue */
+  if(!filename) {
+    /* NULL means load .curlrc from homedir! */
+    char *curlrc = findfile(".curlrc", CURLRC_DOTSCORE);
+    if(curlrc) {
+      file = curlx_fopen(curlrc, FOPEN_READTEXT);
+      if(!file) {
+        curlx_free(curlrc);
+        return NULL;
+      }
+      *namep = *pathalloc = curlrc;
+    }
+#ifdef _WIN32
+    else {
+      char *fullp;
+      /* check for .curlrc then _curlrc in the directory of the executable */
+      file = tool_execpath(".curlrc", &fullp);
+      if(!file)
+        file = tool_execpath("_curlrc", &fullp);
+      if(file)
+        /* this is the filename we read from */
+        *namep = fullp;
+    }
+#endif
+  }
+  else {
+    if(strcmp(filename, "-"))
+      file = curlx_fopen(filename, FOPEN_READTEXT);
+    else {
+      file = stdin;
+      *namep = "<stdin>";
+    }
+  }
+  return file;
+}
+
+/*
+ * Extract the parameter value from a config line. The line pointer should
+ * be positioned after the option keyword has been null-terminated.
+ * Skips separators and whitespace, then handles quoted and unquoted
+ * parameter values. Sets *param_out to the parameter string; unquoted empty
+ * values set it to NULL, while quoted empty values become an empty string.
+ */
+static ParameterError extract_param(char *line,
+                                    bool dashed_option,
+                                    struct dynbuf *pbuf,
+                                    const char *filename,
+                                    int lineno,
+                                    const char *option,
+                                    char **param_out)
+{
+  /* pass spaces and separator(s) */
+  while(ISBLANK(*line) || ISSEP(*line, dashed_option))
+    line++;
+
+  /* the parameter starts here (unless quoted) */
+  if(*line == '\"') {
+    /* quoted parameter, do the quote dance */
+    int rc = unslashquote(++line, pbuf);
+    if(rc)
+      return PARAM_BAD_USE;
+    *param_out = curlx_dyn_len(pbuf) ? curlx_dyn_ptr(pbuf) : CURL_UNCONST("");
+  }
+  else {
+    if(*line == '\'') {
+      warnf("%s:%d Option '%s' uses argument with leading single quote. "
+            "It is probably a mistake. Consider double quotes.",
+            filename, lineno, option);
+    }
+    *param_out = line; /* parameter starts here */
+    while(*line && !ISSPACE(*line)) /* stop also on CRLF */
+      line++;
+
+    if(*line) {
+      *line = '\0'; /* null-terminate */
+
+      /* to detect mistakes better, see if there is data following */
+      line++;
+      /* pass all spaces */
+      while(ISBLANK(*line))
+        line++;
+
+      switch(*line) {
+      case '\0':
+      case '\r':
+      case '\n':
+      case '#': /* comment */
+        break;
+      default:
+        warnf("%s:%d Option '%s' uses argument with unquoted whitespace. "
+              "This may cause side-effects. Consider double quotes.",
+              filename, lineno, option);
+      }
+    }
+    if(!**param_out)
+      /* do this so getparameter can check for required parameters.
+         Otherwise it always thinks there is a parameter. */
+      *param_out = NULL;
+  }
+  return PARAM_OK;
+}
+
+/*
+ * Process the result from getparameter. Handles PARAM_NEXT_OPERATION
+ * by allocating a new config, and reports errors for other non-OK results.
+ * Updates *configp if a new operation config is allocated.
+ * Returns PARAM_OK if processing should continue, or an error code.
+ */
+static ParameterError process_config_result(ParameterError res,
+                                            struct OperationConfig **configp,
+                                            const char *param,
+                                            bool usedarg,
+                                            const char *filename,
+                                            int lineno,
+                                            const char *option)
+{
+  if(!res && param && *param && !usedarg)
+    /* we passed in a parameter that was not used! */
+    res = PARAM_GOT_EXTRA_PARAMETER;
+
+  if(res == PARAM_NEXT_OPERATION) {
+    struct OperationConfig *config = *configp;
+    if(config->url_list && config->url_list->url) {
+      /* Allocate the next config */
+      config->next = config_alloc();
+      if(config->next) {
+        /* Update the last operation pointer */
+        global->last = config->next;
+
+        /* Move onto the new config */
+        config->next->prev = config;
+        *configp = config->next;
+      }
+      else
+        res = PARAM_NO_MEM;
+    }
+  }
+
+  if(res != PARAM_OK && res != PARAM_NEXT_OPERATION) {
+    const char *display = filename;
+    /* the help request is not really an error */
+    if(!strcmp(filename, "-"))
+      display = "<stdin>";
+    if(res != PARAM_HELP_REQUESTED &&
+       res != PARAM_MANUAL_REQUESTED &&
+       res != PARAM_VERSION_INFO_REQUESTED &&
+       res != PARAM_ENGINES_REQUESTED &&
+       res != PARAM_CA_EMBED_REQUESTED) {
+      const char *reason = param2text(res);
+      errorf("%s:%d config file option '%s' %s",
+             display, lineno, option, reason);
+      if(res == PARAM_OPTION_UNKNOWN)
+        res = PARAM_CONFIG_OPTION_UNKNOWN;
+      return res;
+    }
+  }
+  return PARAM_OK;
+}
+
+ParameterError parseconfig(const char *filename, int max_recursive,
+                           char **resolved)
+{
+  FILE *file = NULL;
+  bool usedarg = FALSE;
+  ParameterError err = PARAM_OK;
+  struct OperationConfig *config = global->last;
+  char *pathalloc = NULL;
+
+  file = open_config_file(filename, &filename, &pathalloc);
+
+  if(file) {
+    char *line;
+    char *option;
+    char *param;
+    int lineno = 0;
+    bool dashed_option;
+    struct dynbuf buf;
+    struct dynbuf pbuf;
+    bool fileerror = FALSE;
+    curlx_dyn_init(&buf, MAX_CONFIG_LINE_LENGTH);
+    curlx_dyn_init(&pbuf, MAX_CONFIG_LINE_LENGTH);
+    DEBUGASSERT(filename);
+
+    while(!err && my_get_line(file, &buf, &fileerror)) {
+      ParameterError res;
+      lineno++;
+      line = curlx_dyn_ptr(&buf);
+      if(!line) {
+        err = PARAM_NO_MEM; /* out of memory */
+        break;
+      }
+
+      /* the option keywords starts here */
+      option = line;
+
+      /* the option starts with a dash? */
+      dashed_option = (option[0] == '-');
+
+      while(*line && !ISBLANK(*line) && !ISSEP(*line, dashed_option))
+        line++;
+      /* ... and has ended here */
+
+      if(*line)
+        *line++ = '\0'; /* null-terminate, we have a local copy */
+
+      /* if there is a parameter for this option, extract it */
+      err = extract_param(line, dashed_option, &pbuf, filename, lineno,
+                          option, &param);
+      if(err)
+        break;
+
+      res = getparameter(option, param, &usedarg, config, max_recursive);
+
+      config = global->last;
+
+      err = process_config_result(res, &config, param, usedarg, filename,
+                                  lineno, option);
+    }
+    curlx_dyn_free(&buf);
+    curlx_dyn_free(&pbuf);
+    if(file != stdin)
+      curlx_fclose(file);
+    /* Silence false positive about failing to close stdin.
+       NOLINTNEXTLINE(clang-analyzer-unix.Stream) */
+    if(fileerror)
+      err = PARAM_READ_ERROR;
+  }
+  else
+    err = PARAM_READ_ERROR; /* could not open the file */
+
+  if((err == PARAM_READ_ERROR) && filename)
+    errorf("cannot read config from '%s'", filename);
+
+  if(!err && resolved) {
+    *resolved = curlx_strdup(filename);
+    if(!*resolved)
+      err = PARAM_NO_MEM;
+  }
+  curlx_free(pathalloc);
+  return err;
+}
+
+static bool get_line(FILE *input, struct dynbuf *buf, bool *error)
+{
+  CURLcode result;
+  char buffer[128];
+  curlx_dyn_reset(buf);
+  while(1) {
+    const char *b = fgets(buffer, sizeof(buffer), input);
+
+    if(b) {
+      size_t rlen = strlen(b);
+
+      if(!rlen)
+        break;
+
+      result = curlx_dyn_addn(buf, b, rlen);
+      if(result) {
+        /* too long line or out of memory */
+        *error = TRUE;
+        return FALSE; /* error */
+      }
+
+      else if(b[rlen-1] == '\n') {
+        /* end of the line, drop the newline */
+        size_t len = curlx_dyn_len(buf);
+        if(len)
+          curlx_dyn_setlen(buf, len - 1);
+        return TRUE; /* all good */
+      }
+
+      else if(feof(input))
+        return TRUE; /* all good */
+    }
+    else if(curlx_dyn_len(buf))
+      return TRUE; /* all good */
+    else
+      break;
+  }
+  return FALSE;
+}
+
+/*
+ * Returns a line from the given file. Every line is null-terminated (no
+ * newline). Skips #-commented and space/tabs-only lines automatically.
+ */
+bool my_get_line(FILE *input, struct dynbuf *buf, bool *error)
+{
+  bool retcode;
+  do {
+    retcode = get_line(input, buf, error);
+    if(!*error && retcode) {
+      size_t len = curlx_dyn_len(buf);
+      if(len) {
+        const char *line = curlx_dyn_ptr(buf);
+        while(ISBLANK(*line))
+          line++;
+
+        /* a line with # in the first non-blank column is a comment! */
+        if((*line == '#') || !*line)
+          continue;
+      }
+      else
+        continue; /* avoid returning an empty line */
+    }
+    break;
+  } while(retcode);
+  return retcode;
 }
diff --git a/third-party/curl/src/tool_parsecfg.h b/third-party/curl/src/tool_parsecfg.h
index 75f9127ee7..860b9df38e 100644
--- a/third-party/curl/src/tool_parsecfg.h
+++ b/third-party/curl/src/tool_parsecfg.h
@@ -25,6 +25,10 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-int parseconfig(const char *filename, struct GlobalConfig *config);
+/* only allow this many levels of recursive --config use */
+#define CONFIG_MAX_LEVELS 5
+ParameterError parseconfig(const char *filename, int max_recursive,
+                           char **resolved);
+bool my_get_line(FILE *fp, struct dynbuf *db, bool *error);
 
 #endif /* HEADER_CURL_TOOL_PARSECFG_H */
diff --git a/third-party/curl/src/tool_progress.c b/third-party/curl/src/tool_progress.c
index 782ad3b790..2f15e8f6ae 100644
--- a/third-party/curl/src/tool_progress.c
+++ b/third-party/curl/src/tool_progress.c
@@ -22,61 +22,45 @@
  *
  ***************************************************************************/
 #include "tool_setup.h"
+
 #include "tool_operate.h"
 #include "tool_progress.h"
-#include "tool_util.h"
-
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
 
 /* The point of this function would be to return a string of the input data,
    but never longer than 5 columns (+ one zero byte).
-   Add suffix k, M, G when suitable... */
-static char *max5data(curl_off_t bytes, char *max5)
+   Add suffix k, M, G when suitable...
+
+   Unit test @1622
+*/
+UNITTEST char *max5data(curl_off_t bytes, char *max5, size_t mlen)
 {
-#define ONE_KILOBYTE  CURL_OFF_T_C(1024)
-#define ONE_MEGABYTE (CURL_OFF_T_C(1024) * ONE_KILOBYTE)
-#define ONE_GIGABYTE (CURL_OFF_T_C(1024) * ONE_MEGABYTE)
-#define ONE_TERABYTE (CURL_OFF_T_C(1024) * ONE_GIGABYTE)
-#define ONE_PETABYTE (CURL_OFF_T_C(1024) * ONE_TERABYTE)
+  /* a signed 64-bit value is 8192 petabytes maximum */
+  const char unit[] = { 'k', 'M', 'G', 'T', 'P', 'E', 0 };
+  int k = 0;
+  if(bytes < 100000) {
+    curl_msnprintf(max5, mlen, "%5" CURL_FORMAT_CURL_OFF_T, bytes);
+    return max5;
+  }
 
-  if(bytes < CURL_OFF_T_C(100000))
-    msnprintf(max5, 6, "%5" CURL_FORMAT_CURL_OFF_T, bytes);
-
-  else if(bytes < CURL_OFF_T_C(10000) * ONE_KILOBYTE)
-    msnprintf(max5, 6, "%4" CURL_FORMAT_CURL_OFF_T "k", bytes/ONE_KILOBYTE);
-
-  else if(bytes < CURL_OFF_T_C(100) * ONE_MEGABYTE)
-    /* 'XX.XM' is good as long as we're less than 100 megs */
-    msnprintf(max5, 6, "%2" CURL_FORMAT_CURL_OFF_T ".%0"
-              CURL_FORMAT_CURL_OFF_T "M", bytes/ONE_MEGABYTE,
-              (bytes%ONE_MEGABYTE) / (ONE_MEGABYTE/CURL_OFF_T_C(10)) );
-
-  else if(bytes < CURL_OFF_T_C(10000) * ONE_MEGABYTE)
-    /* 'XXXXM' is good until we're at 10000MB or above */
-    msnprintf(max5, 6, "%4" CURL_FORMAT_CURL_OFF_T "M", bytes/ONE_MEGABYTE);
-
-  else if(bytes < CURL_OFF_T_C(100) * ONE_GIGABYTE)
-    /* 10000 MB - 100 GB, we show it as XX.XG */
-    msnprintf(max5, 6, "%2" CURL_FORMAT_CURL_OFF_T ".%0"
-              CURL_FORMAT_CURL_OFF_T "G", bytes/ONE_GIGABYTE,
-              (bytes%ONE_GIGABYTE) / (ONE_GIGABYTE/CURL_OFF_T_C(10)) );
-
-  else if(bytes < CURL_OFF_T_C(10000) * ONE_GIGABYTE)
-    /* up to 10000GB, display without decimal: XXXXG */
-    msnprintf(max5, 6, "%4" CURL_FORMAT_CURL_OFF_T "G", bytes/ONE_GIGABYTE);
-
-  else if(bytes < CURL_OFF_T_C(10000) * ONE_TERABYTE)
-    /* up to 10000TB, display without decimal: XXXXT */
-    msnprintf(max5, 6, "%4" CURL_FORMAT_CURL_OFF_T "T", bytes/ONE_TERABYTE);
-
-  else
-    /* up to 10000PB, display without decimal: XXXXP */
-    msnprintf(max5, 6, "%4" CURL_FORMAT_CURL_OFF_T "P", bytes/ONE_PETABYTE);
-
-  /* 16384 petabytes (16 exabytes) is the maximum a 64 bit unsigned number can
-     hold, but our data type is signed so 8192PB will be the maximum. */
+  do {
+    curl_off_t nbytes = bytes / 1024;
+    if(nbytes < 100) {
+      /* display with a decimal */
+      curl_msnprintf(max5, mlen, "%2" CURL_FORMAT_CURL_OFF_T ".%"
+                     CURL_FORMAT_CURL_OFF_T "%c", bytes / 1024,
+                     (bytes % 1024) * 10 / 1024, unit[k]);
+      break;
+    }
+    else if(nbytes < 10000) {
+      /* no decimals */
+      curl_msnprintf(max5, mlen, "%4" CURL_FORMAT_CURL_OFF_T "%c", nbytes,
+                     unit[k]);
+      break;
+    }
+    bytes = nbytes;
+    k++;
+    DEBUGASSERT(unit[k]);
+  } while(unit[k]);
   return max5;
 }
 
@@ -104,32 +88,42 @@ int xferinfo_cb(void *clientp,
   return 0;
 }
 
-/* Provide a string that is 2 + 1 + 2 + 1 + 2 = 8 letters long (plus the zero
-   byte) */
-static void time2str(char *r, curl_off_t seconds)
+/* Provide a time string that is 8 letters long (plus the zero byte)
+
+   Unit test @1622
+ */
+UNITTEST void timebuf(char *r, size_t rlen, curl_off_t seconds)
 {
   curl_off_t h;
   if(seconds <= 0) {
-    strcpy(r, "--:--:--");
+    curlx_strcopy(r, rlen, "        ", 8);
     return;
   }
-  h = seconds / CURL_OFF_T_C(3600);
-  if(h <= CURL_OFF_T_C(99)) {
-    curl_off_t m = (seconds - (h*CURL_OFF_T_C(3600))) / CURL_OFF_T_C(60);
-    curl_off_t s = (seconds - (h*CURL_OFF_T_C(3600))) - (m*CURL_OFF_T_C(60));
-    msnprintf(r, 9, "%2" CURL_FORMAT_CURL_OFF_T ":%02" CURL_FORMAT_CURL_OFF_T
-              ":%02" CURL_FORMAT_CURL_OFF_T, h, m, s);
+  h = seconds / 3600;
+  if(h <= 99) {
+    curl_off_t m = (seconds - (h * 3600)) / 60;
+    curl_off_t s = (seconds - (h * 3600)) - (m * 60);
+    curl_msnprintf(r, rlen, "%02" FMT_OFF_T ":%02" FMT_OFF_T ":"
+                   "%02" FMT_OFF_T, h, m, s);
   }
   else {
-    /* this equals to more than 99 hours, switch to a more suitable output
-       format to fit within the limits. */
-    curl_off_t d = seconds / CURL_OFF_T_C(86400);
-    h = (seconds - (d*CURL_OFF_T_C(86400))) / CURL_OFF_T_C(3600);
-    if(d <= CURL_OFF_T_C(999))
-      msnprintf(r, 9, "%3" CURL_FORMAT_CURL_OFF_T
-                "d %02" CURL_FORMAT_CURL_OFF_T "h", d, h);
-    else
-      msnprintf(r, 9, "%7" CURL_FORMAT_CURL_OFF_T "d", d);
+    curl_off_t d = seconds / 86400;
+    h = (seconds - (d * 86400)) / 3600;
+    if(d <= 999)
+      curl_msnprintf(r, rlen, "%3" FMT_OFF_T "d %02" FMT_OFF_T "h", d, h);
+    else { /* more than 999 days */
+      curl_off_t m = d / 30;
+      if(m <= 999) {
+        curl_msnprintf(r, rlen, "%3" FMT_OFF_T "m %02" FMT_OFF_T "d", m, d%30);
+      }
+      else { /* more than 999 months */
+        curl_off_t y = d / 365;
+        if(y <= 99999)
+          curl_msnprintf(r, rlen, "%7" FMT_OFF_T "y", y);
+        else
+          curlx_strcopy(r, rlen, " >99999y", 8);
+      }
+    }
   }
 }
 
@@ -138,93 +132,100 @@ static curl_off_t all_ultotal = 0;
 static curl_off_t all_dlalready = 0;
 static curl_off_t all_ulalready = 0;
 
-curl_off_t all_xfers = 0;   /* current total */
-
 struct speedcount {
   curl_off_t dl;
   curl_off_t ul;
-  struct timeval stamp;
+  struct curltime stamp;
 };
 #define SPEEDCNT 10
 static unsigned int speedindex;
 static bool indexwrapped;
 static struct speedcount speedstore[SPEEDCNT];
 
+static void add_offt(curl_off_t *val, curl_off_t add)
+{
+  if(CURL_OFF_T_MAX - *val < add)
+    /* maxed out! */
+    *val = CURL_OFF_T_MAX;
+  else
+    *val += add;
+}
+
 /*
   |DL% UL%  Dled  Uled  Xfers  Live Total     Current  Left    Speed
   |  6 --   9.9G     0     2     2   0:00:40  0:00:02  0:00:37 4087M
 */
-bool progress_meter(struct GlobalConfig *global,
-                    struct timeval *start,
-                    bool final)
+bool progress_meter(CURLM *multi, struct curltime *start, bool final)
 {
-  static struct timeval stamp;
+  static struct curltime stamp;
   static bool header = FALSE;
-  struct timeval now;
-  long diff;
+  struct curltime now;
+  timediff_t diff;
 
   if(global->noprogress || global->silent)
     return FALSE;
 
-  now = tvnow();
-  diff = tvdiff(now, stamp);
+  now = curlx_now();
+  diff = curlx_timediff_ms(now, stamp);
 
   if(!header) {
     header = TRUE;
     fputs("DL% UL%  Dled  Uled  Xfers  Live "
           "Total     Current  Left    Speed\n",
-          stderr);
+          tool_stderr);
   }
   if(final || (diff > 500)) {
-    char time_left[10];
-    char time_total[10];
-    char time_spent[10];
+    char time_left[9];
+    char time_total[9];
+    char time_spent[9];
     char buffer[3][6];
-    curl_off_t spent = tvdiff(now, *start)/1000;
-    char dlpercen[4]="--";
-    char ulpercen[4]="--";
+    curl_off_t spent = curlx_timediff_ms(now, *start) / 1000;
+    char dlpercen[4] = "--";
+    char ulpercen[4] = "--";
     struct per_transfer *per;
     curl_off_t all_dlnow = 0;
     curl_off_t all_ulnow = 0;
+    curl_off_t xfers_added = 0;
+    curl_off_t xfers_running = 0;
     bool dlknown = TRUE;
     bool ulknown = TRUE;
-    curl_off_t all_running = 0; /* in progress */
     curl_off_t speed = 0;
     unsigned int i;
     stamp = now;
 
     /* first add the amounts of the already completed transfers */
-    all_dlnow += all_dlalready;
-    all_ulnow += all_ulalready;
+    add_offt(&all_dlnow, all_dlalready);
+    add_offt(&all_ulnow, all_ulalready);
 
     for(per = transfers; per; per = per->next) {
-      all_dlnow += per->dlnow;
-      all_ulnow += per->ulnow;
+      add_offt(&all_dlnow, per->dlnow);
+      add_offt(&all_ulnow, per->ulnow);
       if(!per->dltotal)
         dlknown = FALSE;
       else if(!per->dltotal_added) {
         /* only add this amount once */
-        all_dltotal += per->dltotal;
+        add_offt(&all_dltotal, per->dltotal);
         per->dltotal_added = TRUE;
       }
       if(!per->ultotal)
         ulknown = FALSE;
       else if(!per->ultotal_added) {
         /* only add this amount once */
-        all_ultotal += per->ultotal;
+        add_offt(&all_ultotal, per->ultotal);
         per->ultotal_added = TRUE;
       }
-      if(per->added)
-        all_running++;
     }
     if(dlknown && all_dltotal)
-      /* TODO: handle integer overflow */
-      msnprintf(dlpercen, sizeof(dlpercen), "%3" CURL_FORMAT_CURL_OFF_T,
-                all_dlnow * 100 / all_dltotal);
+      curl_msnprintf(dlpercen, sizeof(dlpercen), "%3" CURL_FORMAT_CURL_OFF_T,
+                     all_dlnow < (CURL_OFF_T_MAX / 100) ?
+                     (all_dlnow * 100 / all_dltotal) :
+                     (all_dlnow / (all_dltotal / 100)));
+
     if(ulknown && all_ultotal)
-      /* TODO: handle integer overflow */
-      msnprintf(ulpercen, sizeof(ulpercen), "%3" CURL_FORMAT_CURL_OFF_T,
-                all_ulnow * 100 / all_ultotal);
+      curl_msnprintf(ulpercen, sizeof(ulpercen), "%3" CURL_FORMAT_CURL_OFF_T,
+                     all_ulnow < (CURL_OFF_T_MAX / 100) ?
+                     (all_ulnow * 100 / all_ultotal) :
+                     (all_ulnow / (all_ultotal / 100)));
 
     /* get the transfer speed, the higher of the two */
 
@@ -238,68 +239,69 @@ bool progress_meter(struct GlobalConfig *global,
     }
 
     {
-      long deltams;
+      timediff_t deltams;
       curl_off_t dl;
       curl_off_t ul;
       curl_off_t dls;
       curl_off_t uls;
       if(indexwrapped) {
         /* 'speedindex' is the oldest stored data */
-        deltams = tvdiff(now, speedstore[speedindex].stamp);
+        deltams = curlx_timediff_ms(now, speedstore[speedindex].stamp);
         dl = all_dlnow - speedstore[speedindex].dl;
         ul = all_ulnow - speedstore[speedindex].ul;
       }
       else {
         /* since the beginning */
-        deltams = tvdiff(now, *start);
+        deltams = curlx_timediff_ms(now, *start);
         dl = all_dlnow;
         ul = all_ulnow;
       }
       if(!deltams) /* no division by zero please */
         deltams++;
-      dls = (curl_off_t)((double)dl / ((double)deltams/1000.0));
-      uls = (curl_off_t)((double)ul / ((double)deltams/1000.0));
+      dls = (curl_off_t)((double)dl / ((double)deltams / 1000.0));
+      uls = (curl_off_t)((double)ul / ((double)deltams / 1000.0));
       speed = dls > uls ? dls : uls;
     }
 
-
     if(dlknown && speed) {
       curl_off_t est = all_dltotal / speed;
       curl_off_t left = (all_dltotal - all_dlnow) / speed;
-      time2str(time_left, left);
-      time2str(time_total, est);
+      timebuf(time_left, sizeof(time_left), left);
+      timebuf(time_total, sizeof(time_total), est);
     }
     else {
-      time2str(time_left, 0);
-      time2str(time_total, 0);
+      timebuf(time_left, sizeof(time_left), 0);
+      timebuf(time_total, sizeof(time_total), 0);
     }
-    time2str(time_spent, spent);
+    timebuf(time_spent, sizeof(time_spent), spent);
 
-    fprintf(stderr,
-            "\r"
-            "%-3s " /* percent downloaded */
-            "%-3s " /* percent uploaded */
-            "%s " /* Dled */
-            "%s " /* Uled */
-            "%5" CURL_FORMAT_CURL_OFF_T " " /* Xfers */
-            "%5" CURL_FORMAT_CURL_OFF_T " " /* Live */
-            " %s "  /* Total time */
-            "%s "  /* Current time */
-            "%s "  /* Time left */
-            "%s "  /* Speed */
-            "%5s" /* final newline */,
+    (void)curl_multi_get_offt(multi, CURLMINFO_XFERS_ADDED, &xfers_added);
+    (void)curl_multi_get_offt(multi, CURLMINFO_XFERS_RUNNING, &xfers_running);
+    curl_mfprintf(tool_stderr,
+                  "\r"
+                  "%-3s " /* percent downloaded */
+                  "%-3s " /* percent uploaded */
+                  "%s " /* Dled */
+                  "%s " /* Uled */
+                  "%5" CURL_FORMAT_CURL_OFF_T " " /* Xfers */
+                  "%5" CURL_FORMAT_CURL_OFF_T " " /* Live */
+                  " %s "  /* Total time */
+                  "%s "  /* Current time */
+                  "%s "  /* Time left */
+                  "%s "  /* Speed */
+                  "%5s" /* final newline */,
 
-            dlpercen,  /* 3 letters */
-            ulpercen,  /* 3 letters */
-            max5data(all_dlnow, buffer[0]),
-            max5data(all_ulnow, buffer[1]),
-            all_xfers,
-            all_running,
-            time_total,
-            time_spent,
-            time_left,
-            max5data(speed, buffer[2]), /* speed */
-            final ? "\n" :"");
+                  dlpercen,  /* 3 letters */
+                  ulpercen,  /* 3 letters */
+                  max5data(all_dlnow, buffer[0], sizeof(buffer[0])),
+                  max5data(all_ulnow, buffer[1], sizeof(buffer[1])),
+                  xfers_added,
+                  xfers_running,
+                  time_total,
+                  time_spent,
+                  time_left,
+                  max5data(speed, buffer[2], sizeof(buffer[2])), /* speed */
+                  final ? "\n" : "");
     return TRUE;
   }
   return FALSE;
@@ -308,14 +310,14 @@ bool progress_meter(struct GlobalConfig *global,
 void progress_finalize(struct per_transfer *per)
 {
   /* get the numbers before this transfer goes away */
-  all_dlalready += per->dlnow;
-  all_ulalready += per->ulnow;
+  add_offt(&all_dlalready, per->dlnow);
+  add_offt(&all_ulalready, per->ulnow);
   if(!per->dltotal_added) {
-    all_dltotal += per->dltotal;
+    add_offt(&all_dltotal, per->dltotal);
     per->dltotal_added = TRUE;
   }
   if(!per->ultotal_added) {
-    all_ultotal += per->ultotal;
+    add_offt(&all_ultotal, per->ultotal);
     per->ultotal_added = TRUE;
   }
 }
diff --git a/third-party/curl/src/tool_progress.h b/third-party/curl/src/tool_progress.h
index 4c869a0ac3..e07b5fd8d1 100644
--- a/third-party/curl/src/tool_progress.h
+++ b/third-party/curl/src/tool_progress.h
@@ -31,11 +31,15 @@ int xferinfo_cb(void *clientp,
                 curl_off_t ultotal,
                 curl_off_t ulnow);
 
-bool progress_meter(struct GlobalConfig *global,
-                    struct timeval *start,
+bool progress_meter(CURLM *multi,
+                    struct curltime *start,
                     bool final);
+struct per_transfer;
 void progress_finalize(struct per_transfer *per);
 
-extern curl_off_t all_xfers;   /* total number */
+#ifdef UNITTESTS
+UNITTEST char *max5data(curl_off_t bytes, char *max5, size_t mlen);
+UNITTEST void timebuf(char *r, size_t rlen, curl_off_t seconds);
+#endif
 
 #endif /* HEADER_CURL_TOOL_PROGRESS_H */
diff --git a/third-party/curl/src/tool_sdecls.h b/third-party/curl/src/tool_sdecls.h
index 7b2eb23381..c70dbd34ec 100644
--- a/third-party/curl/src/tool_sdecls.h
+++ b/third-party/curl/src/tool_sdecls.h
@@ -29,19 +29,20 @@
  * OutStruct variables keep track of information relative to curl's
  * output writing, which may take place to a standard stream or a file.
  *
- * 'filename' member is either a pointer to a file name string or NULL
+ * 'filename' member is either a pointer to a filename string or NULL
  * when dealing with a standard stream.
  *
  * 'alloc_filename' member is TRUE when string pointed by 'filename' has been
  * dynamically allocated and 'belongs' to this OutStruct, otherwise FALSE.
  *
  * 'is_cd_filename' member is TRUE when string pointed by 'filename' has been
- * set using a server-specified Content-Disposition filename, otherwise FALSE.
+ * set using a server-specified Content-Disposition or Location filename,
+ * otherwise FALSE.
  *
- * 's_isreg' member is TRUE when output goes to a regular file, this also
+ * 'regular_file' member is TRUE when output goes to a regular file, this also
  * implies that output is 'seekable' and 'appendable' and also that member
- * 'filename' points to file name's string. For any standard stream member
- * 's_isreg' will be FALSE.
+ * 'filename' points to filename's string. For any standard stream member
+ * 'regular_file' is FALSE.
  *
  * 'fopened' member is TRUE when output goes to a regular file and it
  * has been fopen'ed, requiring it to be closed later on. In any other
@@ -61,19 +62,19 @@
  * 'utf8seq' member holds an incomplete UTF-8 sequence destined for the console
  * until it can be completed (1-4 bytes) + NUL.
  */
-
 struct OutStruct {
   char *filename;
-  bool alloc_filename;
-  bool is_cd_filename;
-  bool s_isreg;
-  bool fopened;
   FILE *stream;
   curl_off_t bytes;
   curl_off_t init;
-#ifdef WIN32
+#ifdef _WIN32
   unsigned char utf8seq[5];
 #endif
+  BIT(alloc_filename);
+  BIT(is_cd_filename);
+  BIT(regular_file);
+  BIT(fopened);
+  BIT(out_null);
 };
 
 /*
@@ -81,26 +82,25 @@ struct OutStruct {
  * as well as information relative to where URL contents should
  * be stored or which file should be uploaded.
  */
-
 struct getout {
   struct getout *next;      /* next one */
   char          *url;       /* the URL we deal with */
   char          *outfile;   /* where to store the output */
   char          *infile;    /* file to upload, if GETOUT_UPLOAD is set */
-  int            flags;     /* options - composed of GETOUT_* bits */
-  int            num;       /* which URL number in an invocation */
-};
+  curl_off_t    num;        /* which URL number in an invocation */
 
-#define GETOUT_OUTFILE    (1<<0)  /* set when outfile is deemed done */
-#define GETOUT_URL        (1<<1)  /* set when URL is deemed done */
-#define GETOUT_USEREMOTE  (1<<2)  /* use remote file name locally */
-#define GETOUT_UPLOAD     (1<<3)  /* if set, -T has been used */
-#define GETOUT_NOUPLOAD   (1<<4)  /* if set, -T "" has been used */
+  BIT(outset);    /* when outfile is set */
+  BIT(urlset);    /* when URL is set */
+  BIT(uploadset); /* when -T is set */
+  BIT(useremote); /* use remote filename locally */
+  BIT(noupload);  /* if set, -T "" has been used */
+  BIT(noglob);    /* disable globbing for this URL */
+  BIT(out_null);  /* discard output for this URL */
+};
 
 /*
  * 'trace' enumeration represents curl's output look'n feel possibilities.
  */
-
 typedef enum {
   TRACE_NONE,  /* no trace/verbose output at all */
   TRACE_BIN,   /* tcpdump inspired look */
@@ -108,26 +108,24 @@ typedef enum {
   TRACE_PLAIN  /* -v/--verbose type */
 } trace;
 
-
 /*
  * 'HttpReq' enumeration represents HTTP request types.
  */
-
 typedef enum {
-  HTTPREQ_UNSPEC,  /* first in list */
-  HTTPREQ_GET,
-  HTTPREQ_HEAD,
-  HTTPREQ_MIMEPOST,
-  HTTPREQ_SIMPLEPOST,
-  HTTPREQ_PUT
+  TOOL_HTTPREQ_UNSPEC,  /* first in list */
+  TOOL_HTTPREQ_GET,
+  TOOL_HTTPREQ_HEAD,
+  TOOL_HTTPREQ_MIMEPOST,
+  TOOL_HTTPREQ_SIMPLEPOST,
+  TOOL_HTTPREQ_PUT
 } HttpReq;
 
-
-/*
- * Complete struct declarations which have OperationConfig struct members,
- * just in case this header is directly included in some source file.
- */
-
-#include "tool_cfgable.h"
+typedef enum {
+  SANITIZE_ERR_OK = 0,           /* 0 - OK */
+  SANITIZE_ERR_INVALID_PATH,     /* 1 - the path is invalid */
+  SANITIZE_ERR_BAD_ARGUMENT,     /* 2 - bad function parameter */
+  SANITIZE_ERR_OUT_OF_MEMORY,    /* 3 - out of memory */
+  SANITIZE_ERR_LAST /* never use! */
+} SANITIZEcode;
 
 #endif /* HEADER_CURL_TOOL_SDECLS_H */
diff --git a/third-party/curl/src/tool_setopt.c b/third-party/curl/src/tool_setopt.c
index 905f3eb3e7..2174571ad4 100644
--- a/third-party/curl/src/tool_setopt.c
+++ b/third-party/curl/src/tool_setopt.c
@@ -23,28 +23,23 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#ifndef CURL_DISABLE_LIBCURL_OPTION
-
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
-
 #include "tool_cfgable.h"
 #include "tool_easysrc.h"
+#include "tool_formparse.h"
 #include "tool_setopt.h"
-#include "tool_msgs.h"
-#include "dynbuf.h"
 
-#include "memdebug.h" /* keep this as LAST include */
+#ifndef CURL_DISABLE_LIBCURL_OPTION
+
+#include "tool_msgs.h"
 
 /* Lookup tables for converting setopt values back to symbols */
 /* For enums, values may be in any order. */
 /* For bit masks, put combinations first, then single bits, */
 /* and finally any "NONE" value. */
 
-#define NV(e) {#e, e}
-#define NV1(e, v) {#e, (v)}
-#define NVEND {NULL, 0}         /* sentinel to mark end of list */
+#define NV(e)     { #e, e }
+#define NV1(e, v) { #e, (v) }
+#define NVEND     { NULL, 0 }         /* sentinel to mark end of list */
 
 const struct NameValue setopt_nv_CURLPROXY[] = {
   NV(CURLPROXY_HTTP),
@@ -78,7 +73,6 @@ const struct NameValueUnsigned setopt_nv_CURLAUTH[] = {
   NV(CURLAUTH_GSSNEGOTIATE),
   NV(CURLAUTH_NTLM),
   NV(CURLAUTH_DIGEST_IE),
-  NV(CURLAUTH_NTLM_WB),
   NV(CURLAUTH_ONLY),
   NV(CURLAUTH_NONE),
   NVEND,
@@ -107,6 +101,16 @@ const struct NameValue setopt_nv_CURL_SSLVERSION[] = {
   NVEND,
 };
 
+const struct NameValue setopt_nv_CURL_SSLVERSION_MAX[] = {
+  { "", CURL_SSLVERSION_MAX_NONE },
+  NV(CURL_SSLVERSION_MAX_DEFAULT),
+  NV(CURL_SSLVERSION_MAX_TLSv1_0),
+  NV(CURL_SSLVERSION_MAX_TLSv1_1),
+  NV(CURL_SSLVERSION_MAX_TLSv1_2),
+  NV(CURL_SSLVERSION_MAX_TLSv1_3),
+  NVEND,
+};
+
 const struct NameValue setopt_nv_CURL_TIMECOND[] = {
   NV(CURL_TIMECOND_IFMODSINCE),
   NV(CURL_TIMECOND_IFUNMODSINCE),
@@ -147,6 +151,14 @@ const struct NameValue setopt_nv_CURL_NETRC[] = {
   NVEND,
 };
 
+const struct NameValue setopt_nv_CURLOPT_FOLLOWLOCATION[] = {
+  NV(0L),
+  NV(CURLFOLLOW_ALL),
+  NV(CURLFOLLOW_OBEYCODE),
+  NV(CURLFOLLOW_FIRSTONLY),
+  NVEND,
+};
+
 /* These options have non-zero default values. */
 static const struct NameValue setopt_nv_CURLNONZERODEFAULTS[] = {
   NV1(CURLOPT_SSL_VERIFYPEER, 1),
@@ -157,61 +169,22 @@ static const struct NameValue setopt_nv_CURLNONZERODEFAULTS[] = {
   NV1(CURLOPT_PROXY_SSL_VERIFYPEER, 1),
   NV1(CURLOPT_PROXY_SSL_VERIFYHOST, 1),
   NV1(CURLOPT_SOCKS5_AUTH, 1),
+  NV1(CURLOPT_UPLOAD_FLAGS, CURLULFLAG_SEEN),
   NVEND
 };
 
-/* Format and add code; jump to nomem on malloc error */
-#define ADD(args) do { \
-  ret = easysrc_add args; \
-  if(ret) \
-    goto nomem; \
-} while(0)
-#define ADDF(args) do { \
-  ret = easysrc_addf args; \
-  if(ret) \
-    goto nomem; \
-} while(0)
-#define NULL_CHECK(p) do { \
-  if(!p) { \
-    ret = CURLE_OUT_OF_MEMORY; \
-    goto nomem; \
-  } \
-} while(0)
-
-#define DECL0(s) ADD((&easysrc_decl, s))
-#define DECL1(f,a) ADDF((&easysrc_decl, f,a))
-
-#define DATA0(s) ADD((&easysrc_data, s))
-#define DATA1(f,a) ADDF((&easysrc_data, f,a))
-#define DATA2(f,a,b) ADDF((&easysrc_data, f,a,b))
-#define DATA3(f,a,b,c) ADDF((&easysrc_data, f,a,b,c))
-
-#define CODE0(s) ADD((&easysrc_code, s))
-#define CODE1(f,a) ADDF((&easysrc_code, f,a))
-#define CODE2(f,a,b) ADDF((&easysrc_code, f,a,b))
-#define CODE3(f,a,b,c) ADDF((&easysrc_code, f,a,b,c))
-
-#define CLEAN0(s) ADD((&easysrc_clean, s))
-#define CLEAN1(f,a) ADDF((&easysrc_clean, f,a))
-
-#define REM0(s) ADD((&easysrc_toohard, s))
-#define REM1(f,a) ADDF((&easysrc_toohard, f,a))
-#define REM3(f,a,b,c) ADDF((&easysrc_toohard, f,a,b,c))
-
-/* Escape string to C string syntax.  Return NULL if out of memory.
- * Is this correct for those wacky EBCDIC guys? */
-
+/* Escape string to C string syntax. Return NULL if out of memory. */
 #define MAX_STRING_LENGTH_OUTPUT 2000
-#define ZERO_TERMINATED -1
+#define ZERO_TERMINATED          (-1)
 
 static char *c_escape(const char *str, curl_off_t len)
 {
   const char *s;
   unsigned int cutoff = 0;
   CURLcode result;
-  struct curlx_dynbuf escaped;
+  struct dynbuf escaped;
 
-  curlx_dyn_init(&escaped, 4 * MAX_STRING_LENGTH_OUTPUT + 3);
+  curlx_dyn_init(&escaped, (4 * MAX_STRING_LENGTH_OUTPUT) + 3);
 
   if(len == ZERO_TERMINATED)
     len = strlen(str);
@@ -238,17 +211,13 @@ static char *c_escape(const char *str, curl_off_t len)
 
     if(!result) {
       if(p && *p)
-        result = curlx_dyn_addn(&escaped, to + 2 * (p - from), 2);
+        result = curlx_dyn_addn(&escaped, to + (2 * (p - from)), 2);
       else {
-        const char *format = "\\x%02x";
-
-        if(len > 1 && ISXDIGIT(s[1])) {
-          /* Octal escape to avoid >2 digit hex. */
-          format = "\\%03o";
-        }
-
-        result = curlx_dyn_addf(&escaped, format,
-                                (unsigned int) *(unsigned char *) s);
+        result = curlx_dyn_addf(&escaped,
+                                /* Octal escape to avoid >2 digit hex. */
+                                (len > 1 && ISXDIGIT(s[1])) ?
+                                "\\%03o" : "\\x%02x",
+                                (unsigned int)*(const unsigned char *)s);
       }
     }
   }
@@ -257,24 +226,25 @@ static char *c_escape(const char *str, curl_off_t len)
     result = curlx_dyn_addn(&escaped, str, s - str);
 
   if(!result)
-    (void) !curlx_dyn_addn(&escaped, "...", cutoff);
+    result = curlx_dyn_addn(&escaped, "...", cutoff);
 
+  if(result)
+    return NULL;
   return curlx_dyn_ptr(&escaped);
 }
 
 /* setopt wrapper for enum types */
-CURLcode tool_setopt_enum(CURL *curl, struct GlobalConfig *config,
-                          const char *name, CURLoption tag,
+CURLcode tool_setopt_enum(CURL *curl, const char *name, CURLoption tag,
                           const struct NameValue *nvlist, long lval)
 {
-  CURLcode ret = CURLE_OK;
+  CURLcode result = CURLE_OK;
   bool skip = FALSE;
 
-  ret = curl_easy_setopt(curl, tag, lval);
+  result = curl_easy_setopt(curl, tag, lval);
   if(!lval)
     skip = TRUE;
 
-  if(config->libcurl && !skip && !ret) {
+  if(global->libcurl && !skip && !result) {
     /* we only use this for real if --libcurl was used */
     const struct NameValue *nv = NULL;
     for(nv = nvlist; nv->name; nv++) {
@@ -285,432 +255,473 @@ CURLcode tool_setopt_enum(CURL *curl, struct GlobalConfig *config,
       /* If no definition was found, output an explicit value.
        * This could happen if new values are defined and used
        * but the NameValue list is not updated. */
-      CODE2("curl_easy_setopt(hnd, %s, %ldL);", name, lval);
+      result = easysrc_addf(&easysrc_code, "curl_easy_setopt(curl, %s, %ldL);",
+                            name, lval);
+    }
+    else
+      result =
+        easysrc_addf(&easysrc_code, "curl_easy_setopt(curl, %s, (long)%s);",
+                     name, nv->name);
+  }
+
+#ifdef DEBUGBUILD
+  if(result)
+    warnf("option %s returned error (%d)", name, (int)result);
+#endif
+  return result;
+}
+
+/* setopt wrapper for CURLOPT_SSLVERSION */
+CURLcode tool_setopt_SSLVERSION(CURL *curl, const char *name, CURLoption tag,
+                                long lval)
+{
+  CURLcode result = CURLE_OK;
+  bool skip = FALSE;
+
+  result = curl_easy_setopt(curl, tag, lval);
+  if(!lval)
+    skip = TRUE;
+
+  if(global->libcurl && !skip && !result) {
+    /* we only use this for real if --libcurl was used */
+    const struct NameValue *nv = NULL;
+    const struct NameValue *nv2 = NULL;
+    for(nv = setopt_nv_CURL_SSLVERSION; nv->name; nv++) {
+      if(nv->value == (lval & 0xffff))
+        break; /* found it */
+    }
+    for(nv2 = setopt_nv_CURL_SSLVERSION_MAX; nv2->name; nv2++) {
+      if(nv2->value == (lval & ~0xffff))
+        break; /* found it */
+    }
+    if(!nv->name) {
+      /* If no definition was found, output an explicit value.
+       * This could happen if new values are defined and used
+       * but the NameValue list is not updated. */
+      result = easysrc_addf(&easysrc_code, "curl_easy_setopt(curl, %s, %ldL);",
+                            name, lval);
     }
     else {
-      CODE2("curl_easy_setopt(hnd, %s, (long)%s);", name, nv->name);
+      if(nv2->name && *nv2->name)
+        /* if max is set */
+        result = easysrc_addf(&easysrc_code,
+                              "curl_easy_setopt(curl, %s, (long)(%s | %s));",
+                              name, nv->name, nv2->name);
+      else
+        /* without a max */
+        result = easysrc_addf(&easysrc_code,
+                              "curl_easy_setopt(curl, %s, (long)%s);",
+                              name, nv->name);
     }
   }
 
 #ifdef DEBUGBUILD
-  if(ret)
-    warnf(config, "option %s returned error (%d)", name, (int)ret);
+  if(result)
+    warnf("option %s returned error (%d)", name, (int)result);
 #endif
-nomem:
-  return ret;
-}
-
-/* setopt wrapper for flags */
-CURLcode tool_setopt_flags(CURL *curl, struct GlobalConfig *config,
-                           const char *name, CURLoption tag,
-                           const struct NameValue *nvlist, long lval)
-{
-  CURLcode ret = CURLE_OK;
-  bool skip = FALSE;
-
-  ret = curl_easy_setopt(curl, tag, lval);
-  if(!lval)
-    skip = TRUE;
-
-  if(config->libcurl && !skip && !ret) {
-    /* we only use this for real if --libcurl was used */
-    char preamble[80];          /* should accommodate any symbol name */
-    long rest = lval;           /* bits not handled yet */
-    const struct NameValue *nv = NULL;
-    msnprintf(preamble, sizeof(preamble),
-              "curl_easy_setopt(hnd, %s, ", name);
-    for(nv = nvlist; nv->name; nv++) {
-      if((nv->value & ~ rest) == 0) {
-        /* all value flags contained in rest */
-        rest &= ~ nv->value;    /* remove bits handled here */
-        CODE3("%s(long)%s%s",
-              preamble, nv->name, rest ? " |" : ");");
-        if(!rest)
-          break;                /* handled them all */
-        /* replace with all spaces for continuation line */
-        msnprintf(preamble, sizeof(preamble), "%*s", (int)strlen(preamble),
-                  "");
-      }
-    }
-    /* If any bits have no definition, output an explicit value.
-     * This could happen if new bits are defined and used
-     * but the NameValue list is not updated. */
-    if(rest)
-      CODE2("%s%ldL);", preamble, rest);
-  }
-
-nomem:
-  return ret;
+  return result;
 }
 
 /* setopt wrapper for bitmasks */
-CURLcode tool_setopt_bitmask(CURL *curl, struct GlobalConfig *config,
-                             const char *name, CURLoption tag,
+CURLcode tool_setopt_bitmask(CURL *curl, const char *name, CURLoption tag,
                              const struct NameValueUnsigned *nvlist,
                              long lval)
 {
-  CURLcode ret = CURLE_OK;
   bool skip = FALSE;
-
-  ret = curl_easy_setopt(curl, tag, lval);
+  CURLcode result = curl_easy_setopt(curl, tag, lval);
   if(!lval)
     skip = TRUE;
 
-  if(config->libcurl && !skip && !ret) {
+  if(global->libcurl && !skip && !result) {
     /* we only use this for real if --libcurl was used */
     char preamble[80];
     unsigned long rest = (unsigned long)lval;
     const struct NameValueUnsigned *nv = NULL;
-    msnprintf(preamble, sizeof(preamble),
-              "curl_easy_setopt(hnd, %s, ", name);
+    curl_msnprintf(preamble, sizeof(preamble),
+                   "curl_easy_setopt(curl, %s, ", name);
     for(nv = nvlist; nv->name; nv++) {
-      if((nv->value & ~ rest) == 0) {
+      if((nv->value & ~rest) == 0) {
         /* all value flags contained in rest */
-        rest &= ~ nv->value;    /* remove bits handled here */
-        CODE3("%s(long)%s%s",
-              preamble, nv->name, rest ? " |" : ");");
-        if(!rest)
+        rest &= ~nv->value;    /* remove bits handled here */
+        result = easysrc_addf(&easysrc_code, "%s(long)%s%s",
+                              preamble, nv->name, rest ? " |" : ");");
+        if(!rest || result)
           break;                /* handled them all */
         /* replace with all spaces for continuation line */
-        msnprintf(preamble, sizeof(preamble), "%*s", (int)strlen(preamble),
-                  "");
+        curl_msnprintf(preamble, sizeof(preamble), "%*s",
+                       (int)strlen(preamble), "");
       }
     }
     /* If any bits have no definition, output an explicit value.
      * This could happen if new bits are defined and used
      * but the NameValue list is not updated. */
-    if(rest)
-      CODE2("%s%luUL);", preamble, rest);
+    if(rest && !result)
+      result = easysrc_addf(&easysrc_code, "%s%luUL);", preamble, rest);
   }
 
-nomem:
-  return ret;
+  return result;
 }
 
 /* Generate code for a struct curl_slist. */
 static CURLcode libcurl_generate_slist(struct curl_slist *slist, int *slistno)
 {
-  CURLcode ret = CURLE_OK;
-  char *escaped = NULL;
+  CURLcode result = CURLE_OK;
 
   /* May need several slist variables, so invent name */
   *slistno = ++easysrc_slist_count;
 
-  DECL1("struct curl_slist *slist%d;", *slistno);
-  DATA1("slist%d = NULL;", *slistno);
-  CLEAN1("curl_slist_free_all(slist%d);", *slistno);
-  CLEAN1("slist%d = NULL;", *slistno);
-  for(; slist; slist = slist->next) {
-    Curl_safefree(escaped);
-    escaped = c_escape(slist->data, ZERO_TERMINATED);
+  result = easysrc_addf(&easysrc_decl, "struct curl_slist *slist%d;",
+                        *slistno);
+  if(!result)
+    result = easysrc_addf(&easysrc_data, "slist%d = NULL;", *slistno);
+  if(!result)
+    result = easysrc_addf(&easysrc_clean, "curl_slist_free_all(slist%d);",
+                          *slistno);
+  if(!result)
+    result = easysrc_addf(&easysrc_clean, "slist%d = NULL;", *slistno);
+  if(result)
+    return result;
+  for(; slist && !result; slist = slist->next) {
+    char *escaped = c_escape(slist->data, ZERO_TERMINATED);
     if(!escaped)
       return CURLE_OUT_OF_MEMORY;
-    DATA3("slist%d = curl_slist_append(slist%d, \"%s\");",
-                                       *slistno, *slistno, escaped);
+    result = easysrc_addf(&easysrc_data,
+                          "slist%d = curl_slist_append(slist%d, \"%s\");",
+                          *slistno, *slistno, escaped);
+    curlx_free(escaped);
   }
 
-nomem:
-  Curl_safefree(escaped);
-  return ret;
+  return result;
 }
 
 static CURLcode libcurl_generate_mime(CURL *curl,
-                                      struct GlobalConfig *config,
+                                      struct OperationConfig *config,
                                       struct tool_mime *toolmime,
                                       int *mimeno);     /* Forward. */
 
 /* Wrapper to generate source code for a mime part. */
 static CURLcode libcurl_generate_mime_part(CURL *curl,
-                                           struct GlobalConfig *config,
+                                           struct OperationConfig *config,
                                            struct tool_mime *part,
                                            int mimeno)
 {
-  CURLcode ret = CURLE_OK;
+  CURLcode result = CURLE_OK;
   int submimeno = 0;
-  char *escaped = NULL;
   const char *data = NULL;
   const char *filename = part->filename;
+  char *escaped;
 
   /* Parts are linked in reverse order. */
-  if(part->prev) {
-    ret = libcurl_generate_mime_part(curl, config, part->prev, mimeno);
-    if(ret)
-      return ret;
-  }
+  if(part->prev)
+    result = libcurl_generate_mime_part(curl, config, part->prev, mimeno);
 
   /* Create the part. */
-  CODE2("part%d = curl_mime_addpart(mime%d);", mimeno, mimeno);
+  if(!result)
+    result = easysrc_addf(&easysrc_code, "part%d = curl_mime_addpart(mime%d);",
+                          mimeno, mimeno);
+  if(result)
+    return result;
 
   switch(part->kind) {
   case TOOLMIME_PARTS:
-    ret = libcurl_generate_mime(curl, config, part, &submimeno);
-    if(!ret) {
-      CODE2("curl_mime_subparts(part%d, mime%d);", mimeno, submimeno);
-      CODE1("mime%d = NULL;", submimeno);   /* Avoid freeing in CLEAN. */
+    result = libcurl_generate_mime(curl, config, part, &submimeno);
+    if(!result) {
+      result =
+        easysrc_addf(&easysrc_code, "curl_mime_subparts(part%d, mime%d);",
+                     mimeno, submimeno);
+      if(!result)
+        /* Avoid freeing in CLEAN. */
+        result = easysrc_addf(&easysrc_code, "mime%d = NULL;", submimeno);
     }
     break;
 
   case TOOLMIME_DATA:
     data = part->data;
-    if(!ret) {
-      Curl_safefree(escaped);
+    if(!result) {
       escaped = c_escape(data, ZERO_TERMINATED);
-      NULL_CHECK(escaped);
-      CODE2("curl_mime_data(part%d, \"%s\", CURL_ZERO_TERMINATED);",
-                            mimeno, escaped);
+      if(!escaped)
+        return CURLE_OUT_OF_MEMORY;
+      result =
+        easysrc_addf(&easysrc_code,
+                     "curl_mime_data(part%d, \"%s\", CURL_ZERO_TERMINATED);",
+                     mimeno, escaped);
+      curlx_free(escaped);
     }
     break;
 
   case TOOLMIME_FILE:
   case TOOLMIME_FILEDATA:
     escaped = c_escape(part->data, ZERO_TERMINATED);
-    NULL_CHECK(escaped);
-    CODE2("curl_mime_filedata(part%d, \"%s\");", mimeno, escaped);
-    if(part->kind == TOOLMIME_FILEDATA && !filename) {
-      CODE1("curl_mime_filename(part%d, NULL);", mimeno);
+    if(!escaped)
+      return CURLE_OUT_OF_MEMORY;
+    result =
+      easysrc_addf(&easysrc_code,
+                   "curl_mime_filedata(part%d, \"%s\");", mimeno, escaped);
+    if(part->kind == TOOLMIME_FILEDATA && !filename && !result) {
+      result = easysrc_addf(&easysrc_code,
+                            "curl_mime_filename(part%d, NULL);", mimeno);
     }
+    curlx_free(escaped);
     break;
 
   case TOOLMIME_STDIN:
     if(!filename)
       filename = "-";
-    /* FALLTHROUGH */
+    FALLTHROUGH();
   case TOOLMIME_STDINDATA:
     /* Can only be reading stdin in the current context. */
-    CODE1("curl_mime_data_cb(part%d, -1, (curl_read_callback) fread, \\",
-          mimeno);
-    CODE0("                  (curl_seek_callback) fseek, NULL, stdin);");
+    result = easysrc_addf(&easysrc_code, "curl_mime_data_cb(part%d, -1, "
+                          "(curl_read_callback)fread, \\", mimeno);
+    if(!result)
+      result = easysrc_addf(&easysrc_code, "                  "
+                            "(curl_seek_callback)fseek, NULL, stdin);");
     break;
   default:
     /* Other cases not possible in this context. */
     break;
   }
 
-  if(!ret && part->encoder) {
-    Curl_safefree(escaped);
+  if(!result && part->encoder) {
     escaped = c_escape(part->encoder, ZERO_TERMINATED);
-    NULL_CHECK(escaped);
-    CODE2("curl_mime_encoder(part%d, \"%s\");", mimeno, escaped);
+    if(!escaped)
+      return CURLE_OUT_OF_MEMORY;
+    result = easysrc_addf(&easysrc_code, "curl_mime_encoder(part%d, \"%s\");",
+                          mimeno, escaped);
+    curlx_free(escaped);
   }
 
-  if(!ret && filename) {
-    Curl_safefree(escaped);
+  if(!result && filename) {
     escaped = c_escape(filename, ZERO_TERMINATED);
-    NULL_CHECK(escaped);
-    CODE2("curl_mime_filename(part%d, \"%s\");", mimeno, escaped);
+    if(!escaped)
+      return CURLE_OUT_OF_MEMORY;
+    result = easysrc_addf(&easysrc_code, "curl_mime_filename(part%d, \"%s\");",
+                          mimeno, escaped);
+    curlx_free(escaped);
   }
 
-  if(!ret && part->name) {
-    Curl_safefree(escaped);
+  if(!result && part->name) {
     escaped = c_escape(part->name, ZERO_TERMINATED);
-    NULL_CHECK(escaped);
-    CODE2("curl_mime_name(part%d, \"%s\");", mimeno, escaped);
+    if(!escaped)
+      return CURLE_OUT_OF_MEMORY;
+    result = easysrc_addf(&easysrc_code, "curl_mime_name(part%d, \"%s\");",
+                          mimeno, escaped);
+    curlx_free(escaped);
   }
 
-  if(!ret && part->type) {
-    Curl_safefree(escaped);
+  if(!result && part->type) {
     escaped = c_escape(part->type, ZERO_TERMINATED);
-    NULL_CHECK(escaped);
-    CODE2("curl_mime_type(part%d, \"%s\");", mimeno, escaped);
+    if(!escaped)
+      return CURLE_OUT_OF_MEMORY;
+    result = easysrc_addf(&easysrc_code, "curl_mime_type(part%d, \"%s\");",
+                          mimeno, escaped);
+    curlx_free(escaped);
   }
 
-  if(!ret && part->headers) {
+  if(!result && part->headers) {
     int slistno;
 
-    ret = libcurl_generate_slist(part->headers, &slistno);
-    if(!ret) {
-      CODE2("curl_mime_headers(part%d, slist%d, 1);", mimeno, slistno);
-      CODE1("slist%d = NULL;", slistno); /* Prevent CLEANing. */
+    result = libcurl_generate_slist(part->headers, &slistno);
+    if(!result) {
+      result = easysrc_addf(&easysrc_code,
+                            "curl_mime_headers(part%d, slist%d, 1);",
+                            mimeno, slistno);
+      if(!result)
+        result = easysrc_addf(&easysrc_code, "slist%d = NULL;", slistno);
     }
   }
 
-nomem:
-  Curl_safefree(escaped);
-  return ret;
+  return result;
 }
 
 /* Wrapper to generate source code for a mime structure. */
 static CURLcode libcurl_generate_mime(CURL *curl,
-                                      struct GlobalConfig *config,
+                                      struct OperationConfig *config,
                                       struct tool_mime *toolmime,
                                       int *mimeno)
 {
-  CURLcode ret = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   /* May need several mime variables, so invent name. */
   *mimeno = ++easysrc_mime_count;
-  DECL1("curl_mime *mime%d;", *mimeno);
-  DATA1("mime%d = NULL;", *mimeno);
-  CODE1("mime%d = curl_mime_init(hnd);", *mimeno);
-  CLEAN1("curl_mime_free(mime%d);", *mimeno);
-  CLEAN1("mime%d = NULL;", *mimeno);
+  result = easysrc_addf(&easysrc_decl, "curl_mime *mime%d;", *mimeno);
+  if(!result)
+    result = easysrc_addf(&easysrc_data, "mime%d = NULL;", *mimeno);
+  if(!result)
+    result = easysrc_addf(&easysrc_code, "mime%d = curl_mime_init(curl);",
+                          *mimeno);
+  if(!result)
+    result = easysrc_addf(&easysrc_clean, "curl_mime_free(mime%d);", *mimeno);
+  if(!result)
+    result = easysrc_addf(&easysrc_clean, "mime%d = NULL;", *mimeno);
 
-  if(toolmime->subparts) {
-    DECL1("curl_mimepart *part%d;", *mimeno);
-    ret = libcurl_generate_mime_part(curl, config,
-                                     toolmime->subparts, *mimeno);
+  if(toolmime->subparts && !result) {
+    result = easysrc_addf(&easysrc_decl, "curl_mimepart *part%d;", *mimeno);
+    if(!result)
+      result = libcurl_generate_mime_part(curl, config,
+                                          toolmime->subparts, *mimeno);
   }
 
-nomem:
-  return ret;
+  return result;
 }
 
 /* setopt wrapper for CURLOPT_MIMEPOST */
-CURLcode tool_setopt_mimepost(CURL *curl, struct GlobalConfig *config,
+CURLcode tool_setopt_mimepost(CURL *curl, struct OperationConfig *config,
                               const char *name, CURLoption tag,
                               curl_mime *mimepost)
 {
-  CURLcode ret = curl_easy_setopt(curl, tag, mimepost);
+  CURLcode result = curl_easy_setopt(curl, tag, mimepost);
   int mimeno = 0;
 
-  if(!ret && config->libcurl) {
-    ret = libcurl_generate_mime(curl, config,
-                                config->current->mimeroot, &mimeno);
+  if(!result && global->libcurl) {
+    result = libcurl_generate_mime(curl, config, config->mimeroot, &mimeno);
 
-    if(!ret)
-      CODE2("curl_easy_setopt(hnd, %s, mime%d);", name, mimeno);
+    if(!result)
+      result =
+        easysrc_addf(&easysrc_code, "curl_easy_setopt(curl, %s, mime%d);",
+                     name, mimeno);
   }
 
-nomem:
-  return ret;
+  return result;
 }
 
 /* setopt wrapper for curl_slist options */
-CURLcode tool_setopt_slist(CURL *curl, struct GlobalConfig *config,
-                           const char *name, CURLoption tag,
+CURLcode tool_setopt_slist(CURL *curl, const char *name, CURLoption tag,
                            struct curl_slist *list)
 {
-  CURLcode ret = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
-  ret = curl_easy_setopt(curl, tag, list);
+  result = curl_easy_setopt(curl, tag, list);
 
-  if(config->libcurl && list && !ret) {
+  if(global->libcurl && list && !result) {
     int i;
 
-    ret = libcurl_generate_slist(list, &i);
-    if(!ret)
-      CODE2("curl_easy_setopt(hnd, %s, slist%d);", name, i);
+    result = libcurl_generate_slist(list, &i);
+    if(!result)
+      result =
+        easysrc_addf(&easysrc_code, "curl_easy_setopt(curl, %s, slist%d);",
+                     name, i);
   }
 
-nomem:
-  return ret;
+  return result;
 }
 
-/* generic setopt wrapper for all other options.
- * Some type information is encoded in the tag value. */
-CURLcode tool_setopt(CURL *curl, bool str, struct GlobalConfig *global,
-                     struct OperationConfig *config,
-                     const char *name, CURLoption tag, ...)
+/* options that set long */
+CURLcode tool_setopt_long(CURL *curl, const char *name, CURLoption tag,
+                          long lval)
 {
+  long defval = 0L;
+  const struct NameValue *nv = NULL;
+  CURLcode result = CURLE_OK;
+  DEBUGASSERT(tag < CURLOPTTYPE_OBJECTPOINT);
+
+  for(nv = setopt_nv_CURLNONZERODEFAULTS; nv->name; nv++) {
+    if(!strcmp(name, nv->name)) {
+      defval = nv->value;
+      break; /* found it */
+    }
+  }
+
+  result = curl_easy_setopt(curl, tag, lval);
+  if((lval != defval) && global->libcurl && !result) {
+    /* we only use this for real if --libcurl was used */
+    result = easysrc_addf(&easysrc_code, "curl_easy_setopt(curl, %s, %ldL);",
+                          name, lval);
+  }
+  return result;
+}
+
+/* options that set curl_off_t */
+CURLcode tool_setopt_offt(CURL *curl, const char *name, CURLoption tag,
+                          curl_off_t lval)
+{
+  CURLcode result = CURLE_OK;
+  DEBUGASSERT((tag >= CURLOPTTYPE_OFF_T) && (tag < CURLOPTTYPE_BLOB));
+
+  result = curl_easy_setopt(curl, tag, lval);
+  if(global->libcurl && !result && lval) {
+    /* we only use this for real if --libcurl was used */
+    result =
+      easysrc_addf(&easysrc_code, "curl_easy_setopt(curl, %s, (curl_off_t)%"
+                   CURL_FORMAT_CURL_OFF_T ");", name, lval);
+  }
+
+  return result;
+}
+
+/* setopt wrapper for setting object and function pointers */
+CURLcode tool_setopt_ptr(CURL *curl, const char *name, CURLoption tag, ...)
+{
+  void *pval;
   va_list arg;
-  char buf[256];
-  const char *value = NULL;
-  bool remark = FALSE;
-  bool skip = FALSE;
-  bool escape = FALSE;
-  char *escaped = NULL;
-  CURLcode ret = CURLE_OK;
+  CURLcode result;
+
+  DEBUGASSERT(tag >= CURLOPTTYPE_OBJECTPOINT);
+  DEBUGASSERT((tag < CURLOPTTYPE_OFF_T) || (tag >= CURLOPTTYPE_BLOB));
+  /* we never set _BLOB options in the curl tool */
+  DEBUGASSERT(tag < CURLOPTTYPE_BLOB);
 
   va_start(arg, tag);
+  /* argument is an object or function pointer */
+  pval = va_arg(arg, void *);
 
-  if(tag < CURLOPTTYPE_OBJECTPOINT) {
-    /* Value is expected to be a long */
-    long lval = va_arg(arg, long);
-    long defval = 0L;
-    const struct NameValue *nv = NULL;
-    for(nv = setopt_nv_CURLNONZERODEFAULTS; nv->name; nv++) {
-      if(!strcmp(name, nv->name)) {
-        defval = nv->value;
-        break; /* found it */
-      }
-    }
-
-    msnprintf(buf, sizeof(buf), "%ldL", lval);
-    value = buf;
-    ret = curl_easy_setopt(curl, tag, lval);
-    if(lval == defval)
-      skip = TRUE;
-  }
-  else if(tag < CURLOPTTYPE_OFF_T) {
-    /* Value is some sort of object pointer */
-    void *pval = va_arg(arg, void *);
-
-    /* function pointers are never printable */
-    if(tag >= CURLOPTTYPE_FUNCTIONPOINT) {
-      if(pval) {
-        value = "function pointer";
-        remark = TRUE;
-      }
-      else
-        skip = TRUE;
-    }
-
-    else if(pval && str) {
-      value = (char *)pval;
-      escape = TRUE;
-    }
-    else if(pval) {
-      value = "object pointer";
-      remark = TRUE;
-    }
-    else
-      skip = TRUE;
-
-    ret = curl_easy_setopt(curl, tag, pval);
-
-  }
-  else if(tag < CURLOPTTYPE_BLOB) {
-    /* Value is expected to be curl_off_t */
-    curl_off_t oval = va_arg(arg, curl_off_t);
-    msnprintf(buf, sizeof(buf),
-              "(curl_off_t)%" CURL_FORMAT_CURL_OFF_T, oval);
-    value = buf;
-    ret = curl_easy_setopt(curl, tag, oval);
-
-    if(!oval)
-      skip = TRUE;
-  }
-  else {
-    /* Value is a blob */
-    void *pblob = va_arg(arg, void *);
-
-    /* blobs are never printable */
-    if(pblob) {
-      value = "blob pointer";
-      remark = TRUE;
-    }
-    else
-      skip = TRUE;
-
-    ret = curl_easy_setopt(curl, tag, pblob);
+  result = curl_easy_setopt(curl, tag, pval);
+  if(global->libcurl && pval && !result) {
+    /* we only use this if --libcurl was used */
+    const char *remark = (tag >= CURLOPTTYPE_FUNCTIONPOINT) ?
+      "function" : "object";
+    result = easysrc_addf(&easysrc_toohard,
+                          "%s was set to a%s %s pointer", name,
+                          (*remark == 'o' ? "n" : ""), remark);
   }
 
   va_end(arg);
-
-  if(global->libcurl && !skip && !ret) {
-    /* we only use this for real if --libcurl was used */
-
-    if(remark)
-      REM3("%s was set to a%s %s", name, (*value == 'o' ? "n" : ""), value);
-    else {
-      if(escape) {
-        curl_off_t len = ZERO_TERMINATED;
-        if(tag == CURLOPT_POSTFIELDS)
-          len = config->postfieldsize;
-        escaped = c_escape(value, len);
-        NULL_CHECK(escaped);
-        CODE2("curl_easy_setopt(hnd, %s, \"%s\");", name, escaped);
-      }
-      else
-        CODE2("curl_easy_setopt(hnd, %s, %s);", name, value);
-    }
-  }
-
-nomem:
-  Curl_safefree(escaped);
-  return ret;
+  return result;
 }
 
-#else /* CURL_DISABLE_LIBCURL_OPTION */
+/* setopt wrapper for setting strings */
+CURLcode tool_setopt_str(CURL *curl, struct OperationConfig *config,
+                         const char *name, CURLoption tag, ...)
+{
+  char *str;
+  va_list arg;
+  CURLcode result;
+  DEBUGASSERT(tag >= CURLOPTTYPE_OBJECTPOINT);
+  DEBUGASSERT((tag < CURLOPTTYPE_OFF_T) || (tag >= CURLOPTTYPE_BLOB));
+  DEBUGASSERT(tag < CURLOPTTYPE_BLOB);
+  DEBUGASSERT(tag < CURLOPTTYPE_FUNCTIONPOINT);
+
+  va_start(arg, tag);
+  /* argument is a string */
+  str = va_arg(arg, char *);
+
+  result = curl_easy_setopt(curl, tag, str);
+  if(global->libcurl && str && !result) {
+    /* we only use this if --libcurl was used */
+    curl_off_t len = ZERO_TERMINATED;
+    char *escaped;
+    if(tag == CURLOPT_POSTFIELDS)
+      len = curlx_dyn_len(&config->postdata);
+    escaped = c_escape(str, len);
+    if(escaped) {
+      result = easysrc_addf(&easysrc_code,
+                            "curl_easy_setopt(curl, %s, \"%s\");",
+                            name, escaped);
+      curlx_free(escaped);
+    }
+    else
+      result = CURLE_OUT_OF_MEMORY;
+  }
+
+  va_end(arg);
+  return result;
+}
 
 #endif /* CURL_DISABLE_LIBCURL_OPTION */
+
+/* return TRUE if the error code is "lethal" */
+bool setopt_bad(CURLcode result)
+{
+  return result &&
+         (result != CURLE_NOT_BUILT_IN) &&
+         (result != CURLE_UNKNOWN_OPTION);
+}
diff --git a/third-party/curl/src/tool_setopt.h b/third-party/curl/src/tool_setopt.h
index 4396c00916..ee4d2a6cd1 100644
--- a/third-party/curl/src/tool_setopt.h
+++ b/third-party/curl/src/tool_setopt.h
@@ -25,15 +25,12 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#include "tool_formparse.h"
-
 /*
  * Macros used in operate()
  */
 
-#define SETOPT_CHECK(v,opt) do {              \
-    result = (v);                             \
-  } while(0)
+/* return TRUE if the error code is "lethal" */
+bool setopt_bad(CURLcode result);
 
 #ifndef CURL_DISABLE_LIBCURL_OPTION
 
@@ -52,104 +49,100 @@ extern const struct NameValue setopt_nv_CURLPROXY[];
 extern const struct NameValue setopt_nv_CURL_SOCKS_PROXY[];
 extern const struct NameValue setopt_nv_CURL_HTTP_VERSION[];
 extern const struct NameValue setopt_nv_CURL_SSLVERSION[];
+extern const struct NameValue setopt_nv_CURL_SSLVERSION_MAX[];
 extern const struct NameValue setopt_nv_CURL_TIMECOND[];
 extern const struct NameValue setopt_nv_CURLFTPSSL_CCC[];
 extern const struct NameValue setopt_nv_CURLUSESSL[];
 extern const struct NameValueUnsigned setopt_nv_CURLSSLOPT[];
 extern const struct NameValue setopt_nv_CURL_NETRC[];
+extern const struct NameValue setopt_nv_CURLOPT_FOLLOWLOCATION[];
 extern const struct NameValueUnsigned setopt_nv_CURLAUTH[];
 extern const struct NameValueUnsigned setopt_nv_CURLHSTS[];
 
 /* Map options to NameValue sets */
-#define setopt_nv_CURLOPT_HSTS_CTRL setopt_nv_CURLHSTS
-#define setopt_nv_CURLOPT_HTTP_VERSION setopt_nv_CURL_HTTP_VERSION
-#define setopt_nv_CURLOPT_HTTPAUTH setopt_nv_CURLAUTH
-#define setopt_nv_CURLOPT_SSLVERSION setopt_nv_CURL_SSLVERSION
-#define setopt_nv_CURLOPT_PROXY_SSLVERSION setopt_nv_CURL_SSLVERSION
-#define setopt_nv_CURLOPT_TIMECONDITION setopt_nv_CURL_TIMECOND
-#define setopt_nv_CURLOPT_FTP_SSL_CCC setopt_nv_CURLFTPSSL_CCC
-#define setopt_nv_CURLOPT_USE_SSL setopt_nv_CURLUSESSL
-#define setopt_nv_CURLOPT_SSL_OPTIONS setopt_nv_CURLSSLOPT
+#define setopt_nv_CURLOPT_HSTS_CTRL         setopt_nv_CURLHSTS
+#define setopt_nv_CURLOPT_HTTP_VERSION      setopt_nv_CURL_HTTP_VERSION
+#define setopt_nv_CURLOPT_HTTPAUTH          setopt_nv_CURLAUTH
+#define setopt_nv_CURLOPT_SSLVERSION        setopt_nv_CURL_SSLVERSION
+#define setopt_nv_CURLOPT_PROXY_SSLVERSION  setopt_nv_CURL_SSLVERSION
+#define setopt_nv_CURLOPT_TIMECONDITION     setopt_nv_CURL_TIMECOND
+#define setopt_nv_CURLOPT_FTP_SSL_CCC       setopt_nv_CURLFTPSSL_CCC
+#define setopt_nv_CURLOPT_USE_SSL           setopt_nv_CURLUSESSL
+#define setopt_nv_CURLOPT_SSL_OPTIONS       setopt_nv_CURLSSLOPT
 #define setopt_nv_CURLOPT_PROXY_SSL_OPTIONS setopt_nv_CURLSSLOPT
-#define setopt_nv_CURLOPT_NETRC setopt_nv_CURL_NETRC
-#define setopt_nv_CURLOPT_PROXYTYPE setopt_nv_CURLPROXY
-#define setopt_nv_CURLOPT_PROXYAUTH setopt_nv_CURLAUTH
-#define setopt_nv_CURLOPT_SOCKS5_AUTH setopt_nv_CURLAUTH
+#define setopt_nv_CURLOPT_NETRC             setopt_nv_CURL_NETRC
+#define setopt_nv_CURLOPT_PROXYTYPE         setopt_nv_CURLPROXY
+#define setopt_nv_CURLOPT_PROXYAUTH         setopt_nv_CURLAUTH
+#define setopt_nv_CURLOPT_SOCKS5_AUTH       setopt_nv_CURLAUTH
 
 /* Intercept setopt calls for --libcurl */
 
-CURLcode tool_setopt_enum(CURL *curl, struct GlobalConfig *config,
-                          const char *name, CURLoption tag,
-                          const struct NameValue *nv, long lval);
-CURLcode tool_setopt_flags(CURL *curl, struct GlobalConfig *config,
+CURLcode tool_setopt_enum(CURL *curl, const char *name, CURLoption tag,
+                          const struct NameValue *nvlist, long lval);
+CURLcode tool_setopt_SSLVERSION(CURL *curl, const char *name, CURLoption tag,
+                                long lval);
+CURLcode tool_setopt_flags(CURL *curl, struct OperationConfig *config,
                            const char *name, CURLoption tag,
                            const struct NameValue *nv, long lval);
-CURLcode tool_setopt_bitmask(CURL *curl, struct GlobalConfig *config,
+CURLcode tool_setopt_bitmask(CURL *curl,
                              const char *name, CURLoption tag,
-                             const struct NameValueUnsigned *nv, long lval);
-CURLcode tool_setopt_mimepost(CURL *curl, struct GlobalConfig *config,
+                             const struct NameValueUnsigned *nvlist,
+                             long lval);
+CURLcode tool_setopt_mimepost(CURL *curl, struct OperationConfig *config,
                               const char *name, CURLoption tag,
                               curl_mime *mimepost);
-CURLcode tool_setopt_slist(CURL *curl, struct GlobalConfig *config,
-                           const char *name, CURLoption tag,
+CURLcode tool_setopt_slist(CURL *curl, const char *name, CURLoption tag,
                            struct curl_slist *list);
-CURLcode tool_setopt(CURL *curl, bool str, struct GlobalConfig *global,
-                     struct OperationConfig *config,
-                     const char *name, CURLoption tag, ...);
+CURLcode tool_setopt_long(CURL *curl, const char *name, CURLoption tag,
+                          long lval);
+CURLcode tool_setopt_offt(CURL *curl, const char *name, CURLoption tag,
+                          curl_off_t lval);
+CURLcode tool_setopt_str(CURL *curl, struct OperationConfig *config,
+                         const char *name, CURLoption tag,
+                         ...) WARN_UNUSED_RESULT;
+CURLcode tool_setopt_ptr(CURL *curl, const char *name, CURLoption tag, ...);
 
-#define my_setopt(x,y,z) \
-  SETOPT_CHECK(tool_setopt(x, FALSE, global, config, #y, y, z), y)
+#define my_setopt_long(x, y, z)       tool_setopt_long(x, #y, y, z)
+#define my_setopt_offt(x, y, z)       tool_setopt_offt(x, #y, y, z)
+#define my_setopt_ptr(x, y, z)        tool_setopt_ptr(x, #y, y, z)
+#define my_setopt_str(x, y, z)        tool_setopt_str(x, config, #y, y, z)
+#define my_setopt_mimepost(x, y, z)   tool_setopt_mimepost(x, config, #y, y, z)
+#define my_setopt_slist(x, y, z)      tool_setopt_slist(x, #y, y, z)
+#define my_setopt_SSLVERSION(x, y, z) tool_setopt_SSLVERSION(x, #y, y, z)
+#define my_setopt_enum(x, y, z)       \
+  tool_setopt_enum(x, #y, y, setopt_nv_ ## y, z)
+#define my_setopt_bitmask(x, y, z)    \
+  tool_setopt_bitmask(x, #y, y, setopt_nv_ ## y, z)
 
-#define my_setopt_str(x,y,z) \
-  SETOPT_CHECK(tool_setopt(x, TRUE, global, config, #y, y, z), y)
-
-#define my_setopt_enum(x,y,z) \
-  SETOPT_CHECK(tool_setopt_enum(x, global, #y, y, setopt_nv_ ## y, z), y)
-
-#define my_setopt_flags(x,y,z) \
-  SETOPT_CHECK(tool_setopt_flags(x, global, #y, y, setopt_nv_ ## y, z), y)
-
-#define my_setopt_bitmask(x,y,z) \
-  SETOPT_CHECK(tool_setopt_bitmask(x, global, #y, y, setopt_nv_ ## y, z), y)
-
-#define my_setopt_mimepost(x,y,z) \
-  SETOPT_CHECK(tool_setopt_mimepost(x, global, #y, y, z), y)
-
-#define my_setopt_slist(x,y,z) \
-  SETOPT_CHECK(tool_setopt_slist(x, global, #y, y, z), y)
-
-#define res_setopt(x,y,z) tool_setopt(x, FALSE, global, config, #y, y, z)
-
-#define res_setopt_str(x,y,z) tool_setopt(x, TRUE, global, config, #y, y, z)
+/* assumes a 'result' variable to use. If the return code is benign it is left
+   in 'result' after this call, otherwise the function returns the error */
+#define MY_SETOPT_STR(x, y, z)                     \
+  do {                                             \
+    result = tool_setopt_str(x, config, #y, y, z); \
+    if(setopt_bad(result))                         \
+      return result;                               \
+  } while(0)
 
 #else /* CURL_DISABLE_LIBCURL_OPTION */
 
 /* No --libcurl, so pass options directly to library */
 
-#define my_setopt(x,y,z) \
-  SETOPT_CHECK(curl_easy_setopt(x, y, z), y)
+#define my_setopt_long(x, y, z)       curl_easy_setopt(x, y, (long)(z))
+#define my_setopt_offt(x, y, z)       curl_easy_setopt(x, y, (curl_off_t)(z))
+#define my_setopt_ptr(x, y, z)        curl_easy_setopt(x, y, z)
+#define my_setopt_str(x, y, z)        curl_easy_setopt(x, y, z)
+#define my_setopt_mimepost(x, y, z)   curl_easy_setopt(x, y, z)
+#define my_setopt_slist(x, y, z)      curl_easy_setopt(x, y, z)
+#define my_setopt_SSLVERSION(x, y, z) curl_easy_setopt(x, y, z)
+#define my_setopt_enum(x, y, z)       curl_easy_setopt(x, y, z)
+#define my_setopt_bitmask(x, y, z)    curl_easy_setopt(x, y, (long)(z))
 
-#define my_setopt_str(x,y,z) \
-  SETOPT_CHECK(curl_easy_setopt(x, y, z), y)
-
-#define my_setopt_enum(x,y,z) \
-  SETOPT_CHECK(curl_easy_setopt(x, y, z), y)
-
-#define my_setopt_flags(x,y,z) \
-  SETOPT_CHECK(curl_easy_setopt(x, y, z), y)
-
-#define my_setopt_bitmask(x,y,z) \
-  SETOPT_CHECK(curl_easy_setopt(x, y, z), y)
-
-#define my_setopt_mimepost(x,y,z) \
-  SETOPT_CHECK(curl_easy_setopt(x, y, z), y)
-
-#define my_setopt_slist(x,y,z) \
-  SETOPT_CHECK(curl_easy_setopt(x, y, z), y)
-
-#define res_setopt(x,y,z) curl_easy_setopt(x,y,z)
-
-#define res_setopt_str(x,y,z) curl_easy_setopt(x,y,z)
+#define MY_SETOPT_STR(x, y, z)          \
+  do {                                  \
+    result = curl_easy_setopt(x, y, z); \
+    if(setopt_bad(result))              \
+      return result;                    \
+  } while(0)
 
 #endif /* CURL_DISABLE_LIBCURL_OPTION */
 
diff --git a/third-party/curl/src/tool_setup.h b/third-party/curl/src/tool_setup.h
index 1a723f88ba..7e77c114f1 100644
--- a/third-party/curl/src/tool_setup.h
+++ b/third-party/curl/src/tool_setup.h
@@ -24,14 +24,16 @@
  *
  ***************************************************************************/
 
+#ifndef CURL_NO_OLDIES
 #define CURL_NO_OLDIES
+#endif
 
 /*
  * curl_setup.h may define preprocessor macros such as _FILE_OFFSET_BITS and
  * _LARGE_FILES in order to support files larger than 2 GB. On platforms
  * where this happens it is mandatory that these macros are defined before
  * any system header file is included, otherwise file handling function
- * prototypes will be misdeclared and curl tool may not build properly;
+ * prototypes are misdeclared and curl tool may not build properly;
  * therefore we must include curl_setup.h before curl.h when building curl.
  */
 
@@ -39,44 +41,75 @@
 
 extern FILE *tool_stderr;
 
-#if !defined(CURL_DO_NOT_OVERRIDE_STDERR) && !defined(UNITTESTS)
-#ifdef stderr
-#undef stderr
-#endif
-#define stderr tool_stderr
-#endif
-
 /*
  * curl tool certainly uses libcurl's external interface.
  */
 
-#include <curl/curl.h> /* external interface */
+#include "curlx/base64.h" /* for curlx_base64* */
+#include "curlx/dynbuf.h" /* for curlx_dyn_*() */
+#include "curlx/fopen.h" /* for curlx_f*() */
+#include "curlx/multibyte.h" /* for curlx_convert_*() */
+#include "curlx/strcopy.h" /* for curlx_strcopy() */
+#include "curlx/strdup.h" /* for curlx_memdup*() */
+#include "curlx/strerr.h" /* for curlx_strerror() */
+#include "curlx/strparse.h" /* for curlx_str_* parsing functions */
+#include "curlx/timediff.h" /* for timediff_t type and related functions */
+#include "curlx/timeval.h" /* for curlx_now type and related functions */
+#include "curlx/wait.h" /* for curlx_wait_ms() */
 
 /*
  * Platform specific stuff.
  */
 
 #ifdef macintosh
-#  define main(x,y) curl_main(x,y)
+#  define main(x, y) curl_main(x, y)
 #endif
 
-#ifndef OS
-#  define OS "unknown"
+#ifndef CURL_OS
+#define CURL_OS "unknown"
 #endif
 
-#ifndef UNPRINTABLE_CHAR
-   /* define what to use for unprintable characters */
-#  define UNPRINTABLE_CHAR '.'
+/* define what to use for unprintable characters */
+#define UNPRINTABLE_CHAR '.'
+
+#ifndef tool_nop_stmt
+#define tool_nop_stmt do {} while(0)
 #endif
 
-#ifndef HAVE_STRDUP
-#  include "tool_strdup.h"
+#ifdef _WIN32
+#  define CURL_STRICMP(p1, p2)  _stricmp(p1, p2)
+#elif defined(HAVE_STRCASECMP)
+#  ifdef HAVE_STRINGS_H
+#  include <strings.h>
+#  endif
+#  define CURL_STRICMP(p1, p2)  strcasecmp(p1, p2)
+#elif defined(HAVE_STRCMPI)
+#  define CURL_STRICMP(p1, p2)  strcmpi(p1, p2)
+#elif defined(HAVE_STRICMP)
+#  define CURL_STRICMP(p1, p2)  stricmp(p1, p2)
+#else
+#  define CURL_STRICMP(p1, p2)  strcmp(p1, p2)
 #endif
 
-#if defined(WIN32) && !defined(MSDOS)
-/* set in win32_init() */
-extern LARGE_INTEGER tool_freq;
-extern bool tool_isVistaOrGreater;
+#ifdef _WIN32
+/* set in init_terminal() */
+extern bool tool_term_has_bold;
+#endif
+
+#if defined(_WIN32) && !defined(__MINGW32__)
+int toolx_ftruncate_win32(int fd, curl_off_t where);
+#define toolx_ftruncate toolx_ftruncate_win32
+#elif defined(__DJGPP__)
+int toolx_ftruncate_djgpp(int fd, curl_off_t where);
+#define toolx_ftruncate toolx_ftruncate_djgpp
+#elif defined(__AMIGA__)
+#define toolx_ftruncate(f, o) ftruncate(f, (off_t)(o))
+#else
+#define toolx_ftruncate ftruncate
+#endif
+
+#ifdef CURL_CA_EMBED
+extern const unsigned char curl_ca_embed[];
 #endif
 
 #endif /* HEADER_CURL_TOOL_SETUP_H */
diff --git a/third-party/curl/src/tool_sleep.c b/third-party/curl/src/tool_sleep.c
deleted file mode 100644
index 08d6f90288..0000000000
--- a/third-party/curl/src/tool_sleep.c
+++ /dev/null
@@ -1,61 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "tool_setup.h"
-
-#ifdef HAVE_SYS_SELECT_H
-#  include <sys/select.h>
-#elif defined(HAVE_UNISTD_H)
-#  include <unistd.h>
-#endif
-
-#ifdef HAVE_POLL_H
-#  include <poll.h>
-#elif defined(HAVE_SYS_POLL_H)
-#  include <sys/poll.h>
-#endif
-
-#ifdef MSDOS
-#  include <dos.h>
-#endif
-
-#include "tool_sleep.h"
-
-#include "memdebug.h" /* keep this as LAST include */
-
-void tool_go_sleep(long ms)
-{
-#if defined(MSDOS)
-  delay(ms);
-#elif defined(WIN32)
-  Sleep(ms);
-#elif defined(HAVE_POLL_FINE)
-  (void)poll((void *)0, 0, (int)ms);
-#else
-  struct timeval timeout;
-  timeout.tv_sec = ms / 1000L;
-  ms = ms % 1000L;
-  timeout.tv_usec = (int)ms * 1000;
-  select(0, NULL,  NULL, NULL, &timeout);
-#endif
-}
diff --git a/third-party/curl/src/tool_sleep.h b/third-party/curl/src/tool_sleep.h
deleted file mode 100644
index de1d7e256b..0000000000
--- a/third-party/curl/src/tool_sleep.h
+++ /dev/null
@@ -1,30 +0,0 @@
-#ifndef HEADER_CURL_TOOL_SLEEP_H
-#define HEADER_CURL_TOOL_SLEEP_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "tool_setup.h"
-
-void tool_go_sleep(long ms);
-
-#endif /* HEADER_CURL_TOOL_SLEEP_H */
diff --git a/third-party/curl/src/tool_ssls.c b/third-party/curl/src/tool_ssls.c
new file mode 100644
index 0000000000..e9c486435d
--- /dev/null
+++ b/third-party/curl/src/tool_ssls.c
@@ -0,0 +1,213 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "tool_setup.h"
+
+#include "tool_cfgable.h"
+#include "tool_cb_dbg.h"
+#include "tool_msgs.h"
+#include "tool_setopt.h"
+#include "tool_ssls.h"
+#include "tool_parsecfg.h"
+
+/* The maximum line length for an encoded session ticket */
+#define MAX_SSLS_LINE (64 * 1024)
+
+static CURLcode tool_ssls_easy(struct OperationConfig *config,
+                               CURLSH *share, CURL **peasy)
+{
+  CURLcode result = CURLE_OK;
+
+  *peasy = curl_easy_init();
+  if(!*peasy)
+    return CURLE_OUT_OF_MEMORY;
+
+  result = curl_easy_setopt(*peasy, CURLOPT_SHARE, share);
+  if(!result && (global->tracetype != TRACE_NONE)) {
+    result = my_setopt_ptr(*peasy, CURLOPT_DEBUGFUNCTION, tool_debug_cb);
+    if(!result)
+      result = my_setopt_ptr(*peasy, CURLOPT_DEBUGDATA, config);
+    my_setopt_long(*peasy, CURLOPT_VERBOSE, 1L);
+  }
+  return result;
+}
+
+CURLcode tool_ssls_load(struct OperationConfig *config,
+                        CURLSH *share, const char *filename)
+{
+  FILE *fp;
+  CURL *easy = NULL;
+  struct dynbuf buf;
+  unsigned char *shmac = NULL, *sdata = NULL;
+  char *c, *line, *end;
+  size_t shmac_len, sdata_len;
+  CURLcode result = CURLE_OK;
+  int i, imported;
+  bool error = FALSE;
+
+  curlx_dyn_init(&buf, MAX_SSLS_LINE);
+  fp = curlx_fopen(filename, FOPEN_READTEXT);
+  if(!fp) { /* ok if it does not exist */
+    notef("SSL session file does not exist (yet?): %s", filename);
+    goto out;
+  }
+
+  result = tool_ssls_easy(config, share, &easy);
+  if(result)
+    goto out;
+
+  i = imported = 0;
+  while(my_get_line(fp, &buf, &error)) {
+    ++i;
+    curlx_safefree(shmac);
+    curlx_safefree(sdata);
+    line = curlx_dyn_ptr(&buf);
+
+    c = memchr(line, ':', strlen(line));
+    if(!c) {
+      warnf("unrecognized line %d in SSL session file %s", i, filename);
+      continue;
+    }
+    *c = '\0';
+    result = curlx_base64_decode(line, &shmac, &shmac_len);
+    if(result) {
+      warnf("invalid shmax base64 encoding in line %d", i);
+      continue;
+    }
+    line = c + 1;
+    end = line + strlen(line) - 1;
+    while((end > line) && (*end == '\n' || *end == '\r' || ISBLANK(*line))) {
+      *end = '\0';
+      --end;
+    }
+    result = curlx_base64_decode(line, &sdata, &sdata_len);
+    if(result) {
+      warnf("invalid sdata base64 encoding in line %d: %s", i, line);
+      continue;
+    }
+
+    result = curl_easy_ssls_import(easy, NULL, shmac, shmac_len, sdata,
+                                   sdata_len);
+    if(result) {
+      warnf("import of session from line %d rejected(%d)", i, (int)result);
+      continue;
+    }
+    ++imported;
+  }
+  if(error)
+    result = CURLE_FAILED_INIT;
+  else
+    result = CURLE_OK;
+
+out:
+  if(easy)
+    curl_easy_cleanup(easy);
+  if(fp)
+    curlx_fclose(fp);
+  curlx_dyn_free(&buf);
+  curlx_free(shmac);
+  curlx_free(sdata);
+  return result;
+}
+
+struct tool_ssls_ctx {
+  FILE *fp;
+  int exported;
+};
+
+static CURLcode tool_ssls_exp(CURL *easy, void *userptr,
+                              const char *session_key,
+                              const unsigned char *shmac, size_t shmac_len,
+                              const unsigned char *sdata, size_t sdata_len,
+                              curl_off_t valid_until, int ietf_tls_id,
+                              const char *alpn, size_t earlydata_max)
+{
+  struct tool_ssls_ctx *ctx = userptr;
+  char *enc = NULL;
+  size_t enc_len;
+  CURLcode result;
+
+  (void)easy;
+  (void)valid_until;
+  (void)ietf_tls_id;
+  (void)alpn;
+  (void)earlydata_max;
+  if(!ctx->exported)
+    fputs("# Your SSL session cache. https://curl.se/docs/ssl-sessions.html\n"
+          "# This file was generated by libcurl! Edit at your own risk.\n",
+          ctx->fp);
+
+  result = curlx_base64_encode(shmac, shmac_len, &enc, &enc_len);
+  if(result)
+    goto out;
+  result = CURLE_WRITE_ERROR;
+  if(enc_len != fwrite(enc, 1, enc_len, ctx->fp))
+    goto out;
+  if(EOF == fputc(':', ctx->fp))
+    goto out;
+  curlx_safefree(enc);
+  result = curlx_base64_encode(sdata, sdata_len, &enc, &enc_len);
+  if(result)
+    goto out;
+  result = CURLE_WRITE_ERROR;
+  if(enc_len != fwrite(enc, 1, enc_len, ctx->fp))
+    goto out;
+  if(EOF == fputc('\n', ctx->fp))
+    goto out;
+  result = CURLE_OK;
+  ctx->exported++;
+out:
+  if(result)
+    warnf("Warning: error saving SSL session for '%s': %d", session_key,
+          (int)result);
+  curlx_free(enc);
+  return result;
+}
+
+CURLcode tool_ssls_save(struct OperationConfig *config,
+                        CURLSH *share, const char *filename)
+{
+  struct tool_ssls_ctx ctx;
+  CURL *easy = NULL;
+  CURLcode result = CURLE_OK;
+
+  ctx.exported = 0;
+  ctx.fp = curlx_fopen(filename, FOPEN_WRITETEXT);
+  if(!ctx.fp) {
+    warnf("Warning: Failed to create SSL session file %s", filename);
+    goto out;
+  }
+
+  result = tool_ssls_easy(config, share, &easy);
+  if(result)
+    goto out;
+
+  result = curl_easy_ssls_export(easy, tool_ssls_exp, &ctx);
+
+out:
+  if(easy)
+    curl_easy_cleanup(easy);
+  if(ctx.fp)
+    curlx_fclose(ctx.fp);
+  return result;
+}
diff --git a/third-party/curl/src/tool_ssls.h b/third-party/curl/src/tool_ssls.h
new file mode 100644
index 0000000000..42d10d2c62
--- /dev/null
+++ b/third-party/curl/src/tool_ssls.h
@@ -0,0 +1,33 @@
+#ifndef HEADER_CURL_TOOL_SSLS_H
+#define HEADER_CURL_TOOL_SSLS_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "tool_setup.h"
+
+CURLcode tool_ssls_load(struct OperationConfig *config,
+                        CURLSH *share, const char *filename);
+CURLcode tool_ssls_save(struct OperationConfig *config,
+                        CURLSH *share, const char *filename);
+
+#endif /* HEADER_CURL_TOOL_SSLS_H */
diff --git a/third-party/curl/src/tool_stderr.c b/third-party/curl/src/tool_stderr.c
index 23643df7cf..b4dbdd670d 100644
--- a/third-party/curl/src/tool_stderr.c
+++ b/third-party/curl/src/tool_stderr.c
@@ -21,25 +21,20 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
-/* In this file, stdio.h's stderr macro is not overridden. */
-#define CURL_DO_NOT_OVERRIDE_STDERR
-
 #include "tool_setup.h"
+
 #include "tool_stderr.h"
 #include "tool_msgs.h"
 
-#include "memdebug.h" /* keep this as LAST include */
-
-/* In other tool files stderr is defined as tool_stderr by tool_setup.h */
 FILE *tool_stderr;
 
 void tool_init_stderr(void)
 {
+  /* !checksrc! disable STDERR 1 */
   tool_stderr = stderr;
 }
 
-void tool_set_stderr_file(struct GlobalConfig *global, char *filename)
+void tool_set_stderr_file(const char *filename)
 {
   FILE *fp;
 
@@ -52,21 +47,23 @@ void tool_set_stderr_file(struct GlobalConfig *global, char *filename)
   }
 
   /* precheck that filename is accessible to lessen the chance that the
-     subsequent freopen will fail. */
-  fp = fopen(filename, FOPEN_WRITETEXT);
+     subsequent freopen fails. */
+  fp = curlx_fopen(filename, FOPEN_WRITETEXT);
   if(!fp) {
-    warnf(global, "Warning: Failed to open %s", filename);
+    warnf("Warning: Failed to open %s", filename);
     return;
   }
-  fclose(fp);
+  curlx_fclose(fp);
 
   /* freopen the actual stderr (stdio.h stderr) instead of tool_stderr since
      the latter may be set to stdout. */
-  fp = freopen(filename, FOPEN_WRITETEXT, stderr);
+  /* !checksrc! disable STDERR 1 */
+  fp = curlx_freopen(filename, FOPEN_WRITETEXT, stderr);
   if(!fp) {
     /* stderr may have been closed by freopen. there is nothing to be done. */
     DEBUGASSERT(0);
     return;
   }
+  /* !checksrc! disable STDERR 1 */
   tool_stderr = stderr;
 }
diff --git a/third-party/curl/src/tool_stderr.h b/third-party/curl/src/tool_stderr.h
index c887275fc8..47fc7ca1ca 100644
--- a/third-party/curl/src/tool_stderr.h
+++ b/third-party/curl/src/tool_stderr.h
@@ -24,9 +24,10 @@
  *
  ***************************************************************************/
 #include "tool_setup.h"
+
 #include "tool_cfgable.h"
 
 void tool_init_stderr(void);
-void tool_set_stderr_file(struct GlobalConfig *global, char *filename);
+void tool_set_stderr_file(const char *filename);
 
 #endif /* HEADER_CURL_TOOL_STDERR_H */
diff --git a/third-party/curl/src/tool_strdup.c b/third-party/curl/src/tool_strdup.c
deleted file mode 100644
index a5725d6d40..0000000000
--- a/third-party/curl/src/tool_strdup.c
+++ /dev/null
@@ -1,44 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "tool_strdup.h"
-
-#ifndef HAVE_STRDUP
-char *strdup(const char *str)
-{
-  size_t len;
-  char *newstr;
-
-  if(!str)
-    return (char *)NULL;
-
-  len = strlen(str) + 1;
-
-  newstr = malloc(len);
-  if(!newstr)
-    return (char *)NULL;
-
-  memcpy(newstr, str, len);
-  return newstr;
-}
-#endif
diff --git a/third-party/curl/src/tool_strdup.h b/third-party/curl/src/tool_strdup.h
deleted file mode 100644
index 9b21618962..0000000000
--- a/third-party/curl/src/tool_strdup.h
+++ /dev/null
@@ -1,32 +0,0 @@
-#ifndef HEADER_TOOL_STRDUP_H
-#define HEADER_TOOL_STRDUP_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "tool_setup.h"
-
-#ifndef HAVE_STRDUP
-extern char *strdup(const char *str);
-#endif
-
-#endif /* HEADER_TOOL_STRDUP_H */
diff --git a/third-party/curl/src/tool_urlglob.c b/third-party/curl/src/tool_urlglob.c
index 4aa2e95bde..92bf9c43a5 100644
--- a/third-party/curl/src/tool_urlglob.c
+++ b/third-party/curl/src/tool_urlglob.c
@@ -23,40 +23,40 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
 #include "tool_cfgable.h"
 #include "tool_doswin.h"
 #include "tool_urlglob.h"
 #include "tool_vms.h"
-#include "dynbuf.h"
 
-#include "memdebug.h" /* keep this as LAST include */
-
-#define GLOBERROR(string, column, code) \
-  glob->error = string, glob->pos = column, code
+static CURLcode globerror(struct URLGlob *glob, const char *err,
+                          size_t pos, CURLcode error)
+{
+  glob->error = err;
+  glob->pos = pos;
+  return error;
+}
 
 static CURLcode glob_fixed(struct URLGlob *glob, char *fixed, size_t len)
 {
-  struct URLPattern *pat = &glob->pattern[glob->size];
-  pat->type = UPTSet;
-  pat->content.Set.size = 1;
-  pat->content.Set.ptr_s = 0;
+  struct URLPattern *pat = &glob->pattern[glob->pnum];
+  pat->type = GLOB_SET;
   pat->globindex = -1;
+  pat->c.set.size = 0;
+  pat->c.set.idx = 0;
+  pat->c.set.elem = curlx_malloc(sizeof(char *));
 
-  pat->content.Set.elements = malloc(sizeof(char *));
+  if(!pat->c.set.elem)
+    return globerror(glob, NULL, 0, CURLE_OUT_OF_MEMORY);
 
-  if(!pat->content.Set.elements)
-    return GLOBERROR("out of memory", 0, CURLE_OUT_OF_MEMORY);
-
-  pat->content.Set.elements[0] = malloc(len + 1);
-  if(!pat->content.Set.elements[0])
-    return GLOBERROR("out of memory", 0, CURLE_OUT_OF_MEMORY);
-
-  memcpy(pat->content.Set.elements[0], fixed, len);
-  pat->content.Set.elements[0][len] = 0;
+  pat->c.set.elem[0] = curlx_memdup0(fixed, len);
+  if(!pat->c.set.elem[0]) {
+    curlx_safefree(pat->c.set.elem);
+    return globerror(glob, NULL, 0, CURLE_OUT_OF_MEMORY);
+  }
 
+  pat->c.set.palloc = 1;
+  pat->c.set.size = 1;
+  pat->name = NULL; /* unnamed */
   return CURLE_OK;
 }
 
@@ -66,154 +66,207 @@ static CURLcode glob_fixed(struct URLGlob *glob, char *fixed, size_t len)
  */
 static int multiply(curl_off_t *amount, curl_off_t with)
 {
-  curl_off_t sum = *amount * with;
-  if(!with) {
-    *amount = 0;
-    return 0;
+  curl_off_t sum;
+  DEBUGASSERT(*amount >= 0);
+  DEBUGASSERT(with >= 0);
+  if((with <= 0) || (*amount <= 0)) {
+    sum = 0;
+  }
+  else {
+#if (defined(__GNUC__) && \
+  ((__GNUC__ > 5) || ((__GNUC__ == 5) && (__GNUC_MINOR__ >= 1)))) || \
+  (defined(__clang__) && __clang_major__ >= 8)
+    if(__builtin_mul_overflow(*amount, with, &sum))
+      return 1;
+#else
+    sum = *amount * with;
+    if(sum / with != *amount)
+      return 1; /* did not fit, bail out */
+#endif
   }
-  if(sum/with != *amount)
-    return 1; /* didn't fit, bail out */
   *amount = sum;
   return 0;
 }
 
-static CURLcode glob_set(struct URLGlob *glob, char **patternp,
+static CURLcode glob_set(struct URLGlob *glob, const char **patternp,
                          size_t *posp, curl_off_t *amount,
-                         int globindex)
+                         int globindex, const struct Curl_str *name)
 {
   /* processes a set expression with the point behind the opening '{'
      ','-separated elements are collected until the next closing '}'
-  */
+   */
   struct URLPattern *pat;
   bool done = FALSE;
-  char *buf = glob->glob_buffer;
-  char *pattern = *patternp;
-  char *opattern = pattern;
-  size_t opos = *posp-1;
-
-  pat = &glob->pattern[glob->size];
-  /* patterns 0,1,2,... correspond to size=1,3,5,... */
-  pat->type = UPTSet;
-  pat->content.Set.size = 0;
-  pat->content.Set.ptr_s = 0;
-  pat->content.Set.elements = NULL;
-  pat->globindex = globindex;
+  const char *pattern = *patternp;
+  const char *opattern = pattern;
+  CURLcode result = CURLE_OK;
+  size_t size = 0;
+  char **elem = NULL;
+  size_t palloc = 0; /* start with this */
+  DEBUGASSERT(name);
 
   while(!done) {
     switch(*pattern) {
     case '\0':                  /* URL ended while set was still open */
-      return GLOBERROR("unmatched brace", opos, CURLE_URL_MALFORMAT);
+      result = globerror(glob, "unmatched brace", *posp, CURLE_URL_MALFORMAT);
+      goto error;
 
     case '{':
     case '[':                   /* no nested expressions at this time */
-      return GLOBERROR("nested brace", *posp, CURLE_URL_MALFORMAT);
+      result = globerror(glob, "nested brace", *posp, CURLE_URL_MALFORMAT);
+      goto error;
 
     case '}':                           /* set element completed */
-      if(opattern == pattern)
-        return GLOBERROR("empty string within braces", *posp,
-                         CURLE_URL_MALFORMAT);
+      if(opattern == pattern) {
+        result = globerror(glob, "empty string within braces", *posp,
+                           CURLE_URL_MALFORMAT);
+        goto error;
+      }
 
-      /* add 1 to size since it'll be incremented below */
-      if(multiply(amount, pat->content.Set.size + 1))
-        return GLOBERROR("range overflow", 0, CURLE_URL_MALFORMAT);
-
-      /* FALLTHROUGH */
+      /* add 1 to size since it is to be incremented below */
+      if(multiply(amount, size + 1)) {
+        result = globerror(glob, "range overflow", 0, CURLE_URL_MALFORMAT);
+        goto error;
+      }
+      done = TRUE;
+      FALLTHROUGH();
     case ',':
-
-      *buf = '\0';
-      if(pat->content.Set.elements) {
-        char **new_arr = realloc(pat->content.Set.elements,
-                                 (size_t)(pat->content.Set.size + 1) *
-                                 sizeof(char *));
-        if(!new_arr)
-          return GLOBERROR("out of memory", 0, CURLE_OUT_OF_MEMORY);
-
-        pat->content.Set.elements = new_arr;
-      }
-      else
-        pat->content.Set.elements = malloc(sizeof(char *));
-
-      if(!pat->content.Set.elements)
-        return GLOBERROR("out of memory", 0, CURLE_OUT_OF_MEMORY);
-
-      pat->content.Set.elements[pat->content.Set.size] =
-        strdup(glob->glob_buffer);
-      if(!pat->content.Set.elements[pat->content.Set.size])
-        return GLOBERROR("out of memory", 0, CURLE_OUT_OF_MEMORY);
-      ++pat->content.Set.size;
-
-      if(*pattern == '}') {
-        pattern++; /* pass the closing brace */
-        done = TRUE;
-        continue;
+      if(size >= 100000) {
+        result = globerror(glob, "range overflow", 0, CURLE_URL_MALFORMAT);
+        goto error;
       }
 
-      buf = glob->glob_buffer;
+      if(!palloc) {
+        palloc = 5; /* a reasonable default */
+        elem = curlx_malloc(palloc * sizeof(char *));
+      }
+      else if(size >= palloc) {
+        char **arr = curlx_realloc(elem, palloc * 2 * sizeof(char *));
+        if(!arr) {
+          result = globerror(glob, NULL, 0, CURLE_OUT_OF_MEMORY);
+          goto error;
+        }
+        elem = arr;
+        palloc *= 2;
+      }
+
+      if(!elem) {
+        result = globerror(glob, NULL, 0, CURLE_OUT_OF_MEMORY);
+        goto error;
+      }
+
+      elem[size] = curlx_strdup(curlx_dyn_ptr(&glob->buf) ?
+                                curlx_dyn_ptr(&glob->buf) : "");
+      if(!elem[size]) {
+        result = globerror(glob, NULL, 0, CURLE_OUT_OF_MEMORY);
+        goto error;
+      }
+      ++size;
+      curlx_dyn_reset(&glob->buf);
+
       ++pattern;
-      ++(*posp);
+      if(!done)
+        ++(*posp);
       break;
 
     case ']':                           /* illegal closing bracket */
-      return GLOBERROR("unexpected close bracket", *posp, CURLE_URL_MALFORMAT);
+      result = globerror(glob, "unexpected close bracket", *posp,
+                         CURLE_URL_MALFORMAT);
+      goto error;
 
     case '\\':                          /* escaped character, skip '\' */
       if(pattern[1]) {
         ++pattern;
         ++(*posp);
       }
-      /* FALLTHROUGH */
+      FALLTHROUGH();
     default:
-      *buf++ = *pattern++;              /* copy character to set element */
+      /* copy character to set element */
+      if(curlx_dyn_addn(&glob->buf, pattern++, 1)) {
+        result = CURLE_OUT_OF_MEMORY;
+        goto error;
+      }
       ++(*posp);
     }
   }
 
   *patternp = pattern; /* return with the new position */
+
+  pat = &glob->pattern[glob->pnum];
+  pat->type = GLOB_SET;
+  pat->globindex = globindex;
+  pat->c.set.elem = elem;
+  pat->c.set.size = size;
+  pat->c.set.idx = 0;
+  pat->c.set.palloc = palloc;
+  if(curlx_strlen(name)) {
+    pat->name = curlx_memdup0(curlx_str(name), curlx_strlen(name));
+    if(!pat->name) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto error;
+    }
+  }
+  else
+    pat->name = NULL; /* no name */
+
   return CURLE_OK;
+error:
+  {
+    size_t i;
+    for(i = 0; i < size; i++)
+      curlx_safefree(elem[i]);
+  }
+  curlx_free(elem);
+  return result;
 }
 
-static CURLcode glob_range(struct URLGlob *glob, char **patternp,
+static CURLcode glob_range(struct URLGlob *glob, const char **patternp,
                            size_t *posp, curl_off_t *amount,
-                           int globindex)
+                           int globindex, const struct Curl_str *name)
 {
   /* processes a range expression with the point behind the opening '['
      - char range: e.g. "a-z]", "B-Q]"
      - num range: e.g. "0-9]", "17-2000]"
      - num range with leading zeros: e.g. "001-999]"
      expression is checked for well-formedness and collected until the next ']'
-  */
+   */
   struct URLPattern *pat;
-  int rc;
-  char *pattern = *patternp;
-  char *c;
+  const char *pattern = *patternp;
+  const char *c;
 
-  pat = &glob->pattern[glob->size];
+  DEBUGASSERT(name);
+  pat = &glob->pattern[glob->pnum];
   pat->globindex = globindex;
+  pat->name = NULL; /* no name (so far) */
 
   if(ISALPHA(*pattern)) {
     /* character range detected */
-    char min_c;
-    char max_c;
-    char end_c;
-    unsigned long step = 1;
+    bool pmatch = FALSE;
+    char min_c = 0;
+    char max_c = 0;
+    char end_c = 0;
+    unsigned char step = 1;
 
-    pat->type = UPTCharRange;
+    pat->type = GLOB_ASCII;
 
-    rc = sscanf(pattern, "%c-%c%c", &min_c, &max_c, &end_c);
+    if((pattern[1] == '-') && pattern[2] && pattern[3]) {
+      min_c = pattern[0];
+      max_c = pattern[2];
+      end_c = pattern[3];
+      pmatch = TRUE;
 
-    if(rc == 3) {
       if(end_c == ':') {
-        char *endp;
-        errno = 0;
-        step = strtoul(&pattern[4], &endp, 10);
-        if(errno || &pattern[4] == endp || *endp != ']')
+        curl_off_t num;
+        const char *p = &pattern[4];
+        if(curlx_str_number(&p, &num, 256) || curlx_str_single(&p, ']'))
           step = 0;
         else
-          pattern = endp + 1;
+          step = (unsigned char)num;
+        pattern = p;
       }
       else if(end_c != ']')
         /* then this is wrong */
-        rc = 0;
+        pmatch = FALSE;
       else
         /* end_c == ']' */
         pattern += 4;
@@ -221,111 +274,96 @@ static CURLcode glob_range(struct URLGlob *glob, char **patternp,
 
     *posp += (pattern - *patternp);
 
-    if(rc != 3 || !step || step > (unsigned)INT_MAX ||
+    if(!pmatch || !step ||
        (min_c == max_c && step != 1) ||
        (min_c != max_c && (min_c > max_c || step > (unsigned)(max_c - min_c) ||
                            (max_c - min_c) > ('z' - 'a'))))
       /* the pattern is not well-formed */
-      return GLOBERROR("bad range", *posp, CURLE_URL_MALFORMAT);
+      return globerror(glob, "bad range", *posp, CURLE_URL_MALFORMAT);
 
     /* if there was a ":[num]" thing, use that as step or else use 1 */
-    pat->content.CharRange.step = (int)step;
-    pat->content.CharRange.ptr_c = pat->content.CharRange.min_c = min_c;
-    pat->content.CharRange.max_c = max_c;
+    pat->c.ascii.step = step;
+    pat->c.ascii.letter = pat->c.ascii.min = (unsigned char)min_c;
+    pat->c.ascii.max = (unsigned char)max_c;
 
-    if(multiply(amount, ((pat->content.CharRange.max_c -
-                          pat->content.CharRange.min_c) /
-                         pat->content.CharRange.step + 1)))
-      return GLOBERROR("range overflow", *posp, CURLE_URL_MALFORMAT);
+    if(multiply(amount, (((pat->c.ascii.max - pat->c.ascii.min) /
+                         pat->c.ascii.step) + 1)))
+      return globerror(glob, "range overflow", *posp, CURLE_URL_MALFORMAT);
   }
   else if(ISDIGIT(*pattern)) {
     /* numeric range detected */
-    unsigned long min_n;
-    unsigned long max_n = 0;
-    unsigned long step_n = 0;
-    char *endp;
+    curl_off_t min_n = 0;
+    curl_off_t max_n = 0;
+    curl_off_t step_n = 0;
+    curl_off_t num;
 
-    pat->type = UPTNumRange;
-    pat->content.NumRange.padlength = 0;
+    pat->type = GLOB_NUM;
+    pat->c.num.npad = 0;
 
     if(*pattern == '0') {
       /* leading zero specified, count them! */
       c = pattern;
       while(ISDIGIT(*c)) {
         c++;
-        ++pat->content.NumRange.padlength; /* padding length is set for all
-                                              instances of this pattern */
+        ++pat->c.num.npad; /* padding length is set for all instances of this
+                              pattern */
       }
     }
 
-    errno = 0;
-    min_n = strtoul(pattern, &endp, 10);
-    if(errno || (endp == pattern))
-      endp = NULL;
-    else {
-      if(*endp != '-')
-        endp = NULL;
-      else {
-        pattern = endp + 1;
-        while(*pattern && ISBLANK(*pattern))
-          pattern++;
-        if(!ISDIGIT(*pattern)) {
-          endp = NULL;
-          goto fail;
+    if(!curlx_str_number(&pattern, &num, CURL_OFF_T_MAX)) {
+      min_n = num;
+      if(!curlx_str_single(&pattern, '-')) {
+        curlx_str_passblanks(&pattern);
+        if(!curlx_str_number(&pattern, &num, CURL_OFF_T_MAX)) {
+          max_n = num;
+          if(!curlx_str_single(&pattern, ']'))
+            step_n = 1;
+          else if(!curlx_str_single(&pattern, ':') &&
+                  !curlx_str_number(&pattern, &num, CURL_OFF_T_MAX) &&
+                  !curlx_str_single(&pattern, ']')) {
+            step_n = num;
+          }
+          /* else bad syntax */
         }
-        errno = 0;
-        max_n = strtoul(pattern, &endp, 10);
-        if(errno)
-          /* overflow */
-          endp = NULL;
-        else if(*endp == ':') {
-          pattern = endp + 1;
-          errno = 0;
-          step_n = strtoul(pattern, &endp, 10);
-          if(errno)
-            /* over/underflow situation */
-            endp = NULL;
-        }
-        else
-          step_n = 1;
-        if(endp && (*endp == ']')) {
-          pattern = endp + 1;
-        }
-        else
-          endp = NULL;
       }
     }
 
-fail:
     *posp += (pattern - *patternp);
 
-    if(!endp || !step_n ||
+    if(!step_n ||
        (min_n == max_n && step_n != 1) ||
        (min_n != max_n && (min_n > max_n || step_n > (max_n - min_n))))
       /* the pattern is not well-formed */
-      return GLOBERROR("bad range", *posp, CURLE_URL_MALFORMAT);
+      return globerror(glob, "bad range", *posp, CURLE_URL_MALFORMAT);
 
-    /* typecasting to ints are fine here since we make sure above that we
-       are within 31 bits */
-    pat->content.NumRange.ptr_n = pat->content.NumRange.min_n = min_n;
-    pat->content.NumRange.max_n = max_n;
-    pat->content.NumRange.step = step_n;
+    if((CURL_OFF_T_MAX - step_n) < max_n)
+      return globerror(glob, "range end/step overflow", *posp,
+                       CURLE_URL_MALFORMAT);
 
-    if(multiply(amount, ((pat->content.NumRange.max_n -
-                          pat->content.NumRange.min_n) /
-                         pat->content.NumRange.step + 1)))
-      return GLOBERROR("range overflow", *posp, CURLE_URL_MALFORMAT);
+    pat->c.num.idx = pat->c.num.min = min_n;
+    pat->c.num.max = max_n;
+    pat->c.num.step = step_n;
+
+    if(multiply(amount, (((pat->c.num.max - pat->c.num.min) /
+                         pat->c.num.step) + 1)))
+      return globerror(glob, "range overflow", *posp, CURLE_URL_MALFORMAT);
   }
   else
-    return GLOBERROR("bad range specification", *posp, CURLE_URL_MALFORMAT);
+    return globerror(glob, "bad range specification", *posp,
+                     CURLE_URL_MALFORMAT);
 
+  if(curlx_strlen(name)) {
+    pat->name = curlx_memdup0(curlx_str(name), curlx_strlen(name));
+    if(!pat->name)
+      return CURLE_OUT_OF_MEMORY;
+  }
   *patternp = pattern;
   return CURLE_OK;
 }
 
 #define MAX_IP6LEN 128
 
-static bool peek_ipv6(const char *str, size_t *skip)
+static CURLcode peek_ipv6(const char *str, size_t *skip, bool *ipv6p)
 {
   /*
    * Scan for a potential IPv6 literal.
@@ -334,198 +372,258 @@ static bool peek_ipv6(const char *str, size_t *skip)
    */
   char hostname[MAX_IP6LEN];
   CURLU *u;
-  char *endbr = strchr(str, ']');
+  const char *endbr = strchr(str, ']');
   size_t hlen;
   CURLUcode rc;
+  CURLcode result = CURLE_OK;
+  *ipv6p = FALSE; /* default to nope */
+  *skip = 0;
   if(!endbr)
-    return FALSE;
+    return CURLE_OK;
 
   hlen = endbr - str + 1;
   if(hlen >= MAX_IP6LEN)
-    return FALSE;
+    return CURLE_OK;
 
   u = curl_url();
   if(!u)
-    return FALSE;
+    return CURLE_OUT_OF_MEMORY;
 
   memcpy(hostname, str, hlen);
   hostname[hlen] = 0;
 
   /* ask to "guess scheme" as then it works without an https:// prefix */
   rc = curl_url_set(u, CURLUPART_URL, hostname, CURLU_GUESS_SCHEME);
-
   curl_url_cleanup(u);
-  if(!rc)
+  if(rc == CURLUE_OUT_OF_MEMORY)
+    return CURLE_OUT_OF_MEMORY;
+  if(!rc) {
     *skip = hlen;
-  return rc ? FALSE : TRUE;
+    *ipv6p = TRUE;
+  }
+  return result;
 }
 
-static CURLcode glob_parse(struct URLGlob *glob, char *pattern,
+static CURLcode add_glob(struct URLGlob *glob, size_t pos)
+{
+  DEBUGASSERT(glob->pattern[glob->pnum].type);
+
+  if(++glob->pnum >= glob->palloc) {
+    struct URLPattern *np = NULL;
+    glob->palloc *= 2;
+    if(glob->pnum < 255) { /* avoid ridiculous amounts */
+      np = curlx_realloc(glob->pattern,
+                         glob->palloc * sizeof(struct URLPattern));
+      if(!np)
+        return globerror(glob, NULL, pos, CURLE_OUT_OF_MEMORY);
+    }
+    else
+      return globerror(glob, "too many {} sets", pos, CURLE_URL_MALFORMAT);
+    glob->pattern = np;
+  }
+  return CURLE_OK;
+}
+
+/* returns the named glob pattern (case sensitively) if it exists, otherwise
+   NULL
+*/
+static struct URLPattern *glob_find_name(struct URLGlob *glob,
+                                         struct Curl_str *name)
+{
+  size_t i;
+  /* find the correct glob entry */
+  for(i = 0; i < glob->pnum; i++) {
+    if(glob->pattern[i].name &&
+       curlx_str_cmp(name, glob->pattern[i].name))
+      return &glob->pattern[i];
+  }
+  return NULL; /* no match */
+}
+
+#define MAX_GLOBNAME_LEN 64
+
+static CURLcode glob_parse(struct URLGlob *glob, const char *pattern,
                            size_t pos, curl_off_t *amount)
 {
   /* processes a literal string component of a URL
      special characters '{' and '[' branch to set/range processing functions
    */
-  CURLcode res = CURLE_OK;
+  const char *ipattern = pattern; /* start position */
+  CURLcode result = CURLE_OK;
   int globindex = 0; /* count "actual" globs */
 
   *amount = 1;
 
-  while(*pattern && !res) {
-    char *buf = glob->glob_buffer;
-    size_t sublen = 0;
+  while(*pattern && !result) {
     while(*pattern && *pattern != '{') {
       if(*pattern == '[') {
         /* skip over IPv6 literals and [] */
         size_t skip = 0;
-        if(!peek_ipv6(pattern, &skip) && (pattern[1] == ']'))
+        bool ipv6;
+        result = peek_ipv6(pattern, &skip, &ipv6);
+        if(result)
+          return result;
+        if(!ipv6 && (pattern[1] == ']'))
           skip = 2;
         if(skip) {
-          memcpy(buf, pattern, skip);
-          buf += skip;
+          if(curlx_dyn_addn(&glob->buf, pattern, skip))
+            return CURLE_OUT_OF_MEMORY;
           pattern += skip;
-          sublen += skip;
           continue;
         }
         break;
       }
       if(*pattern == '}' || *pattern == ']')
-        return GLOBERROR("unmatched close brace/bracket", pos,
+        return globerror(glob, "unmatched close brace/bracket", pos,
                          CURLE_URL_MALFORMAT);
 
       /* only allow \ to escape known "special letters" */
       if(*pattern == '\\' &&
-         (*(pattern + 1) == '{' || *(pattern + 1) == '[' ||
-          *(pattern + 1) == '}' || *(pattern + 1) == ']') ) {
+         (pattern[1] == '{' || pattern[1] == '[' ||
+          pattern[1] == '}' || pattern[1] == ']')) {
 
         /* escape character, skip '\' */
         ++pattern;
         ++pos;
       }
-      *buf++ = *pattern++; /* copy character to literal */
+      /* copy character to literal */
+      if(curlx_dyn_addn(&glob->buf, pattern++, 1))
+        return CURLE_OUT_OF_MEMORY;
       ++pos;
-      sublen++;
     }
-    if(sublen) {
+    if(curlx_dyn_len(&glob->buf)) {
       /* we got a literal string, add it as a single-item list */
-      *buf = '\0';
-      res = glob_fixed(glob, glob->glob_buffer, sublen);
+      result = glob_fixed(glob, curlx_dyn_ptr(&glob->buf),
+                          curlx_dyn_len(&glob->buf));
+      if(!result)
+        result = add_glob(glob, pos);
+      curlx_dyn_reset(&glob->buf);
     }
     else {
-      switch(*pattern) {
-      case '\0': /* done  */
+      struct Curl_str name;
+      if(!*pattern) /* done */
         break;
-
-      case '{':
-        /* process set pattern */
+      else if((*pattern == '{') || (*pattern == '[')) {
+        bool set = (*pattern == '{');
+        const char *start;
         pattern++;
         pos++;
-        res = glob_set(glob, &pattern, &pos, amount, globindex++);
-        break;
+        start = pattern;
+        /* fetch the name, if provided */
+        if(curlx_str_single(&pattern, '<') ||
+           curlx_str_until(&pattern, &name, MAX_GLOBNAME_LEN, '>') ||
+           curlx_str_single(&pattern, '>')) {
+          /* Not a proper name. This is not reporting errors on syntax errors
+             on purpose: it means that if there is an existing use case that
+             uses what looks like a broken named-glob syntax (now introduced)
+             we let that function like before. */
+          curlx_str_init(&name);
+          pattern = start; /* reset any partial patch */
+        }
+        else {
+          /* check that the name is not already used */
+          struct URLPattern *p = glob_find_name(glob, &name);
+          if(p)
+            return globerror(glob, "Duplicate glob name", pattern - ipattern,
+                             CURLE_URL_MALFORMAT);
+          pos += (pattern - start);
+        }
+        if(set)
+          result = glob_set(glob, &pattern, &pos, amount, globindex++, &name);
+        else
+          result = glob_range(glob, &pattern, &pos, amount, globindex++,
+                              &name);
 
-      case '[':
-        /* process range pattern */
-        pattern++;
-        pos++;
-        res = glob_range(glob, &pattern, &pos, amount, globindex++);
-        break;
+        if(!result)
+          result = add_glob(glob, pos);
       }
     }
-
-    if(++glob->size >= GLOB_PATTERN_NUM)
-      return GLOBERROR("too many globs", pos, CURLE_URL_MALFORMAT);
   }
-  return res;
+  return result;
 }
 
-CURLcode glob_url(struct URLGlob **glob, char *url, curl_off_t *urlnum,
+bool glob_inuse(struct URLGlob *glob)
+{
+  return glob->palloc ? TRUE : FALSE;
+}
+
+/* a glob error has been confirmed, this outputs details about it to the set
+   error stream */
+void glob_show_error(struct URLGlob *glob, const char *url, FILE *error,
+                     CURLcode result)
+{
+  char text[512];
+  const char *t;
+  if(glob->pos) {
+    curl_msnprintf(text, sizeof(text), "%s in position %zu:\n%s\n%*s^",
+                   glob->error,
+                   glob->pos, url, (int)glob->pos - 1, " ");
+    t = text;
+  }
+  else
+    t = glob->error;
+
+  /* send error description to the error-stream */
+  curl_mfprintf(error, "curl: (%d) %s\n", (int)result, t);
+}
+
+CURLcode glob_url(struct URLGlob *glob, const char *url, curl_off_t *urlnum,
                   FILE *error)
 {
   /*
-   * We can deal with any-size, just make a buffer with the same length
-   * as the specified URL!
+   * We can deal with any-size, make a buffer with the same length as the
+   * specified URL!
    */
-  struct URLGlob *glob_expand;
   curl_off_t amount = 0;
-  char *glob_buffer;
-  CURLcode res;
+  CURLcode result;
 
-  *glob = NULL;
-
-  glob_buffer = malloc(strlen(url) + 1);
-  if(!glob_buffer)
+  memset(glob, 0, sizeof(struct URLGlob));
+  curlx_dyn_init(&glob->buf, MAX_CONFIG_LINE_LENGTH);
+  glob->pattern = curlx_malloc(2 * sizeof(struct URLPattern));
+  if(!glob->pattern)
     return CURLE_OUT_OF_MEMORY;
-  glob_buffer[0] = 0;
+  glob->palloc = 2;
 
-  glob_expand = calloc(1, sizeof(struct URLGlob));
-  if(!glob_expand) {
-    Curl_safefree(glob_buffer);
-    return CURLE_OUT_OF_MEMORY;
-  }
-  glob_expand->urllen = strlen(url);
-  glob_expand->glob_buffer = glob_buffer;
-
-  res = glob_parse(glob_expand, url, 1, &amount);
-  if(!res)
-    *urlnum = amount;
-  else {
-    if(error && glob_expand->error) {
-      char text[512];
-      const char *t;
-      if(glob_expand->pos) {
-        msnprintf(text, sizeof(text), "%s in URL position %zu:\n%s\n%*s^",
-                  glob_expand->error,
-                  glob_expand->pos, url, (int)glob_expand->pos - 1, " ");
-        t = text;
-      }
-      else
-        t = glob_expand->error;
-
-      /* send error description to the error-stream */
-      fprintf(error, "curl: (%d) %s\n", res, t);
-    }
-    /* it failed, we cleanup */
-    glob_cleanup(glob_expand);
+  result = glob_parse(glob, url, 1, &amount);
+  if(result) {
+    if(error && glob->error)
+      glob_show_error(glob, url, error, result);
     *urlnum = 1;
-    return res;
+    return result;
   }
-
-  *glob = glob_expand;
+  *urlnum = amount;
   return CURLE_OK;
 }
 
 void glob_cleanup(struct URLGlob *glob)
 {
   size_t i;
-  curl_off_t elem;
 
-  if(!glob)
-    return;
-
-  for(i = 0; i < glob->size; i++) {
-    if((glob->pattern[i].type == UPTSet) &&
-       (glob->pattern[i].content.Set.elements)) {
-      for(elem = glob->pattern[i].content.Set.size - 1;
-          elem >= 0;
-          --elem) {
-        Curl_safefree(glob->pattern[i].content.Set.elements[elem]);
+  if(glob->pattern) {
+    for(i = 0; i < glob->pnum; i++) {
+      DEBUGASSERT(glob->pattern[i].type);
+      if((glob->pattern[i].type == GLOB_SET) &&
+         (glob->pattern[i].c.set.elem)) {
+        curl_off_t elem;
+        for(elem = 0; elem < glob->pattern[i].c.set.size; elem++)
+          curlx_safefree(glob->pattern[i].c.set.elem[elem]);
+        curlx_safefree(glob->pattern[i].c.set.elem);
       }
-      Curl_safefree(glob->pattern[i].content.Set.elements);
+      curlx_safefree(glob->pattern[i].name);
     }
+    curlx_safefree(glob->pattern);
+    glob->palloc = 0;
+    curlx_dyn_free(&glob->buf);
   }
-  Curl_safefree(glob->glob_buffer);
-  Curl_safefree(glob);
 }
 
 CURLcode glob_next_url(char **globbed, struct URLGlob *glob)
 {
   struct URLPattern *pat;
   size_t i;
-  size_t len;
-  size_t buflen = glob->urllen + 1;
-  char *buf = glob->glob_buffer;
 
   *globbed = NULL;
+  curlx_dyn_reset(&glob->buf);
 
   if(!glob->beenhere)
     glob->beenhere = 1;
@@ -534,35 +632,32 @@ CURLcode glob_next_url(char **globbed, struct URLGlob *glob)
 
     /* implement a counter over the index ranges of all patterns, starting
        with the rightmost pattern */
-    for(i = 0; carry && (i < glob->size); i++) {
+    for(i = 0; carry && (i < glob->pnum); i++) {
       carry = FALSE;
-      pat = &glob->pattern[glob->size - 1 - i];
+      pat = &glob->pattern[glob->pnum - 1 - i];
       switch(pat->type) {
-      case UPTSet:
-        if((pat->content.Set.elements) &&
-           (++pat->content.Set.ptr_s == pat->content.Set.size)) {
-          pat->content.Set.ptr_s = 0;
+      case GLOB_SET:
+        if((pat->c.set.elem) && (++pat->c.set.idx == pat->c.set.size)) {
+          pat->c.set.idx = 0;
           carry = TRUE;
         }
         break;
-      case UPTCharRange:
-        pat->content.CharRange.ptr_c =
-          (char)(pat->content.CharRange.step +
-                 (int)((unsigned char)pat->content.CharRange.ptr_c));
-        if(pat->content.CharRange.ptr_c > pat->content.CharRange.max_c) {
-          pat->content.CharRange.ptr_c = pat->content.CharRange.min_c;
+      case GLOB_ASCII:
+        pat->c.ascii.letter += pat->c.ascii.step;
+        if(pat->c.ascii.letter > pat->c.ascii.max) {
+          pat->c.ascii.letter = pat->c.ascii.min;
           carry = TRUE;
         }
         break;
-      case UPTNumRange:
-        pat->content.NumRange.ptr_n += pat->content.NumRange.step;
-        if(pat->content.NumRange.ptr_n > pat->content.NumRange.max_n) {
-          pat->content.NumRange.ptr_n = pat->content.NumRange.min_n;
+      case GLOB_NUM:
+        pat->c.num.idx += pat->c.num.step;
+        if(pat->c.num.idx > pat->c.num.max) {
+          pat->c.num.idx = pat->c.num.min;
           carry = TRUE;
         }
         break;
       default:
-        printf("internal error: invalid pattern type (%d)\n", (int)pat->type);
+        DEBUGASSERT(0);
         return CURLE_FAILED_INIT;
       }
     }
@@ -571,141 +666,141 @@ CURLcode glob_next_url(char **globbed, struct URLGlob *glob)
     }
   }
 
-  for(i = 0; i < glob->size; ++i) {
+  for(i = 0; i < glob->pnum; ++i) {
     pat = &glob->pattern[i];
     switch(pat->type) {
-    case UPTSet:
-      if(pat->content.Set.elements) {
-        msnprintf(buf, buflen, "%s",
-                  pat->content.Set.elements[pat->content.Set.ptr_s]);
-        len = strlen(buf);
-        buf += len;
-        buflen -= len;
+    case GLOB_SET:
+      if(pat->c.set.elem) {
+        if(curlx_dyn_add(&glob->buf, pat->c.set.elem[pat->c.set.idx]))
+          return CURLE_OUT_OF_MEMORY;
       }
       break;
-    case UPTCharRange:
-      if(buflen) {
-        *buf++ = pat->content.CharRange.ptr_c;
-        *buf = '\0';
-        buflen--;
-      }
+    case GLOB_ASCII: {
+      char letter = (char)pat->c.ascii.letter;
+      if(curlx_dyn_addn(&glob->buf, &letter, 1))
+        return CURLE_OUT_OF_MEMORY;
       break;
-    case UPTNumRange:
-      msnprintf(buf, buflen, "%0*" CURL_FORMAT_CURL_OFF_T,
-                pat->content.NumRange.padlength,
-                pat->content.NumRange.ptr_n);
-      len = strlen(buf);
-      buf += len;
-      buflen -= len;
+    }
+    case GLOB_NUM:
+      if(curlx_dyn_addf(&glob->buf, "%0*" CURL_FORMAT_CURL_OFF_T,
+                        pat->c.num.npad, pat->c.num.idx))
+        return CURLE_OUT_OF_MEMORY;
       break;
     default:
-      printf("internal error: invalid pattern type (%d)\n", (int)pat->type);
+      DEBUGASSERT(0);
       return CURLE_FAILED_INIT;
     }
   }
 
-  *globbed = strdup(glob->glob_buffer);
+  *globbed =
+    curlx_strdup(curlx_dyn_ptr(&glob->buf) ? curlx_dyn_ptr(&glob->buf) : "");
   if(!*globbed)
     return CURLE_OUT_OF_MEMORY;
 
   return CURLE_OK;
 }
 
-#define MAX_OUTPUT_GLOB_LENGTH (10*1024)
+#define MAX_OUTPUT_GLOB_LENGTH (1024 * 1024)
 
-CURLcode glob_match_url(char **result, char *filename, struct URLGlob *glob)
+CURLcode glob_match_url(char **output, const char *filename,
+                        struct URLGlob *glob, struct URLGlob *glob2,
+                        SANITIZEcode *sc)
 {
-  char numbuf[18];
-  char *appendthis = (char *)"";
-  size_t appendlen = 0;
-  struct curlx_dynbuf dyn;
+  struct dynbuf dyn;
+  const char *ifilename = filename;
+  *output = NULL;
+  *sc = SANITIZE_ERR_OK;
 
-  *result = NULL;
-
-  /* We cannot use the glob_buffer for storage since the filename may be
-   * longer than the URL we use.
-   */
   curlx_dyn_init(&dyn, MAX_OUTPUT_GLOB_LENGTH);
 
   while(*filename) {
-    if(*filename == '#' && ISDIGIT(filename[1])) {
-      char *ptr = filename;
-      unsigned long num = strtoul(&filename[1], &filename, 10);
-      struct URLPattern *pat = NULL;
-
-      if(num && (num < glob->size)) {
-        unsigned long i;
+    CURLcode result = CURLE_OK;
+    struct URLPattern *pat = NULL;
+    if(glob_inuse(glob) && *filename == '#' && ISDIGIT(filename[1])) {
+      /* a numbered glob reference */
+      const char *ptr = filename++;
+      curl_off_t num;
+      if(!curlx_str_number(&filename, &num, glob->pnum) && num) {
+        size_t i;
         num--; /* make it zero based */
         /* find the correct glob entry */
-        for(i = 0; i<glob->size; i++) {
+        for(i = 0; i < glob->pnum; i++) {
           if(glob->pattern[i].globindex == (int)num) {
             pat = &glob->pattern[i];
             break;
           }
         }
       }
-
-      if(pat) {
-        switch(pat->type) {
-        case UPTSet:
-          if(pat->content.Set.elements) {
-            appendthis = pat->content.Set.elements[pat->content.Set.ptr_s];
-            appendlen =
-              strlen(pat->content.Set.elements[pat->content.Set.ptr_s]);
-          }
-          break;
-        case UPTCharRange:
-          numbuf[0] = pat->content.CharRange.ptr_c;
-          numbuf[1] = 0;
-          appendthis = numbuf;
-          appendlen = 1;
-          break;
-        case UPTNumRange:
-          msnprintf(numbuf, sizeof(numbuf), "%0*" CURL_FORMAT_CURL_OFF_T,
-                    pat->content.NumRange.padlength,
-                    pat->content.NumRange.ptr_n);
-          appendthis = numbuf;
-          appendlen = strlen(numbuf);
-          break;
-        default:
-          fprintf(stderr, "internal error: invalid pattern type (%d)\n",
-                  (int)pat->type);
+      if(!pat)
+        filename = ptr;
+    }
+    else if(*filename == '#' && (filename[1] == '<')) {
+      /* a named glob reference */
+      struct Curl_str name;
+      const char *ptr = filename;
+      filename += 2; /* pass both leading bytes */
+      if(!curlx_str_until(&filename, &name, MAX_GLOBNAME_LEN, '>') &&
+         !curlx_str_single(&filename, '>')) {
+        /* find the correct glob entry */
+        if(glob_inuse(glob))
+          pat = glob_find_name(glob, &name);
+        if(!pat && glob2 && glob_inuse(glob2))
+          /* scan the second glob list if there is one */
+          pat = glob_find_name(glob2, &name);
+        if(!pat) {
+          /* when the name is given correctly, it needs to be an existing glob
+             name, which makes this an error */
           curlx_dyn_free(&dyn);
-          return CURLE_FAILED_INIT;
+          return globerror(glob, "no glob exists with this name",
+                           filename - ifilename, CURLE_BAD_FUNCTION_ARGUMENT);
         }
       }
-      else {
-        /* #[num] out of range, use the #[num] in the output */
+      if(!pat)
         filename = ptr;
-        appendthis = filename++;
-        appendlen = 1;
+    }
+    if(pat) {
+      switch(pat->type) {
+      case GLOB_SET:
+        if(pat->c.set.elem)
+          result = curlx_dyn_add(&dyn, pat->c.set.elem[pat->c.set.idx]);
+        break;
+      case GLOB_ASCII: {
+        char letter = (char)pat->c.ascii.letter;
+        result = curlx_dyn_addn(&dyn, &letter, 1);
+        break;
+      }
+      case GLOB_NUM:
+        result = curlx_dyn_addf(&dyn, "%0*" CURL_FORMAT_CURL_OFF_T,
+                                pat->c.num.npad, pat->c.num.idx);
+        break;
+      default:
+        DEBUGASSERT(0);
+        curlx_dyn_free(&dyn);
+        return CURLE_FAILED_INIT;
       }
     }
-    else {
-      appendthis = filename++;
-      appendlen = 1;
-    }
-    if(curlx_dyn_addn(&dyn, appendthis, appendlen))
-      return CURLE_OUT_OF_MEMORY;
+    else
+      result = curlx_dyn_addn(&dyn, filename++, 1);
+    if(result)
+      return result;
   }
 
   if(curlx_dyn_addn(&dyn, "", 0))
     return CURLE_OUT_OF_MEMORY;
 
-#if defined(MSDOS) || defined(WIN32)
+#if defined(_WIN32) || defined(MSDOS)
   {
     char *sanitized;
-    SANITIZEcode sc = sanitize_file_name(&sanitized, curlx_dyn_ptr(&dyn),
-                                         (SANITIZE_ALLOW_PATH |
-                                          SANITIZE_ALLOW_RESERVED));
+    *sc = sanitize_file_name(&sanitized, curlx_dyn_ptr(&dyn),
+                             SANITIZE_ALLOW_PATH | SANITIZE_ALLOW_RESERVED);
     curlx_dyn_free(&dyn);
-    if(sc)
-      return CURLE_URL_MALFORMAT;
-    *result = sanitized;
+    if(*sc)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    *output = sanitized;
     return CURLE_OK;
   }
 #else
-  *result = curlx_dyn_ptr(&dyn);
+  *output = curlx_dyn_ptr(&dyn);
   return CURLE_OK;
-#endif /* MSDOS || WIN32 */
+#endif /* _WIN32 || MSDOS */
 }
diff --git a/third-party/curl/src/tool_urlglob.h b/third-party/curl/src/tool_urlglob.h
index c38f9d92eb..e891258aa4 100644
--- a/third-party/curl/src/tool_urlglob.h
+++ b/third-party/curl/src/tool_urlglob.h
@@ -26,53 +26,62 @@
 #include "tool_setup.h"
 
 typedef enum {
-  UPTSet = 1,
-  UPTCharRange,
-  UPTNumRange
-} URLPatternType;
+  GLOB_SET = 1,
+  GLOB_ASCII,
+  GLOB_NUM
+} globtype;
 
 struct URLPattern {
-  URLPatternType type;
+  globtype type;
+  char *name;    /* if not NULL */
   int globindex; /* the number of this particular glob or -1 if not used
                     within {} or [] */
   union {
     struct {
-      char **elements;
+      char **elem;
       curl_off_t size;
-      int ptr_s;
-    } Set;
+      curl_off_t idx;
+      size_t palloc; /* elem entries allocated */
+    } set;
     struct {
-      char min_c;
-      char max_c;
-      char ptr_c;
-      int step;
-    } CharRange;
+      int min;
+      int max;
+      int letter;
+      unsigned char step;
+    } ascii;
     struct {
-      curl_off_t min_n;
-      curl_off_t max_n;
-      int padlength;
-      curl_off_t ptr_n;
+      curl_off_t min;
+      curl_off_t max;
+      curl_off_t idx;
       curl_off_t step;
-    } NumRange;
-  } content;
+      int npad;
+    } num;
+  } c;
 };
 
 /* the total number of globs supported */
-#define GLOB_PATTERN_NUM 100
+#define GLOB_PATTERN_NUM 30
 
 struct URLGlob {
-  struct URLPattern pattern[GLOB_PATTERN_NUM];
-  size_t size;
-  size_t urllen;
-  char *glob_buffer;
+  struct dynbuf buf;
+  struct URLPattern *pattern;
+  size_t palloc; /* number of pattern entries allocated */
+  size_t pnum; /* number of patterns used */
   char beenhere;
   const char *error; /* error message */
   size_t pos;        /* column position of error or 0 */
 };
 
-CURLcode glob_url(struct URLGlob**, char *, curl_off_t *, FILE *);
-CURLcode glob_next_url(char **, struct URLGlob *);
-CURLcode glob_match_url(char **, char *, struct URLGlob *);
+void glob_show_error(struct URLGlob *glob, const char *url, FILE *error,
+                     CURLcode result);
+
+CURLcode glob_url(struct URLGlob *glob, const char *url, curl_off_t *urlnum,
+                  FILE *error);
+CURLcode glob_next_url(char **globbed, struct URLGlob *glob);
+CURLcode glob_match_url(char **output, const char *filename,
+                        struct URLGlob *glob, struct URLGlob *glob2,
+                        SANITIZEcode *sc);
 void glob_cleanup(struct URLGlob *glob);
+bool glob_inuse(struct URLGlob *glob);
 
 #endif /* HEADER_CURL_TOOL_URLGLOB_H */
diff --git a/third-party/curl/src/tool_util.c b/third-party/curl/src/tool_util.c
index 7a1c03b20b..5a8a3bc4db 100644
--- a/third-party/curl/src/tool_util.c
+++ b/third-party/curl/src/tool_util.c
@@ -23,139 +23,116 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#if defined(HAVE_STRCASECMP) && defined(HAVE_STRINGS_H)
-#include <strings.h>
-#endif
-
 #include "tool_util.h"
 
-#include "memdebug.h" /* keep this as LAST include */
+#ifdef _WIN32
 
-#if defined(WIN32) && !defined(MSDOS)
-
-/* In case of bug fix this function has a counterpart in timeval.c */
-struct timeval tvnow(void)
+struct timeval tvrealnow(void)
 {
+  /* UNIX EPOCH (1970-01-01) in FILETIME (1601-01-01) as 64-bit value */
+  static const uint64_t EPOCH = UINT64_C(116444736000000000);
+  SYSTEMTIME systime;
+  FILETIME ftime; /* 100ns since 1601-01-01, as double 32-bit value */
+  uint64_t time; /* 100ns since 1601-01-01, as 64-bit value */
   struct timeval now;
-  if(tool_isVistaOrGreater) { /* QPC timer might have issues pre-Vista */
-    LARGE_INTEGER count;
-    QueryPerformanceCounter(&count);
-    now.tv_sec = (long)(count.QuadPart / tool_freq.QuadPart);
-    now.tv_usec = (long)((count.QuadPart % tool_freq.QuadPart) * 1000000 /
-                         tool_freq.QuadPart);
-  }
-  else {
-    /* Disable /analyze warning that GetTickCount64 is preferred  */
-#if defined(_MSC_VER)
-#pragma warning(push)
-#pragma warning(disable:28159)
-#endif
-    DWORD milliseconds = GetTickCount();
-#if defined(_MSC_VER)
-#pragma warning(pop)
-#endif
 
-    now.tv_sec = (long)(milliseconds / 1000);
-    now.tv_usec = (long)((milliseconds % 1000) * 1000);
-  }
+  GetSystemTime(&systime);
+  SystemTimeToFileTime(&systime, &ftime);
+  time = ((uint64_t)ftime.dwLowDateTime);
+  time += ((uint64_t)ftime.dwHighDateTime) << 32;
+
+  now.tv_sec  = (long)((time - EPOCH) / 10000000L); /* unit is 100ns */
+  now.tv_usec = (long)(systime.wMilliseconds * 1000);
   return now;
 }
 
-#elif defined(HAVE_CLOCK_GETTIME_MONOTONIC)
+#else
 
-struct timeval tvnow(void)
+struct timeval tvrealnow(void)
 {
-  /*
-  ** clock_gettime() is granted to be increased monotonically when the
-  ** monotonic clock is queried. Time starting point is unspecified, it
-  ** could be the system start-up time, the Epoch, or something else,
-  ** in any case the time starting point does not change once that the
-  ** system has started up.
-  */
   struct timeval now;
-  struct timespec tsnow;
-  if(0 == clock_gettime(CLOCK_MONOTONIC, &tsnow)) {
-    now.tv_sec = tsnow.tv_sec;
-    now.tv_usec = (int)(tsnow.tv_nsec / 1000);
-  }
-  /*
-  ** Even when the configure process has truly detected monotonic clock
-  ** availability, it might happen that it is not actually available at
-  ** run-time. When this occurs simply fallback to other time source.
-  */
 #ifdef HAVE_GETTIMEOFDAY
-  else
-    (void)gettimeofday(&now, NULL);
-#else
-  else {
-    now.tv_sec = time(NULL);
-    now.tv_usec = 0;
-  }
-#endif
-  return now;
-}
-
-#elif defined(HAVE_GETTIMEOFDAY)
-
-struct timeval tvnow(void)
-{
-  /*
-  ** gettimeofday() is not granted to be increased monotonically, due to
-  ** clock drifting and external source time synchronization it can jump
-  ** forward or backward in time.
-  */
-  struct timeval now;
   (void)gettimeofday(&now, NULL);
-  return now;
-}
-
 #else
-
-struct timeval tvnow(void)
-{
-  /*
-  ** time() returns the value of time in seconds since the Epoch.
-  */
-  struct timeval now;
   now.tv_sec = time(NULL);
   now.tv_usec = 0;
+#endif
   return now;
 }
 
 #endif
 
-/*
- * Make sure that the first argument is the more recent time, as otherwise
- * we'll get a weird negative time-diff back...
- *
- * Returns: the time difference in number of milliseconds.
- */
-long tvdiff(struct timeval newer, struct timeval older)
-{
-  return (long)(newer.tv_sec-older.tv_sec)*1000+
-    (long)(newer.tv_usec-older.tv_usec)/1000;
-}
-
 /* Case insensitive compare. Accept NULL pointers. */
 int struplocompare(const char *p1, const char *p2)
 {
   if(!p1)
-    return p2? -1: 0;
+    return p2 ? -1 : 0;
   if(!p2)
     return 1;
-#ifdef HAVE_STRCASECMP
-  return strcasecmp(p1, p2);
-#elif defined(HAVE_STRCMPI)
-  return strcmpi(p1, p2);
-#elif defined(HAVE_STRICMP)
-  return stricmp(p1, p2);
-#else
-  return strcmp(p1, p2);
-#endif
+  return CURL_STRICMP(p1, p2);
 }
 
 /* Indirect version to use as qsort callback. */
 int struplocompare4sort(const void *p1, const void *p2)
 {
-  return struplocompare(* (char * const *) p1, * (char * const *) p2);
+  return struplocompare(*(char * const *)p1, *(char * const *)p2);
 }
+
+#if defined(_WIN32) && !defined(__MINGW32__)
+/*
+ * Truncate a file handle at a 64-bit position 'where'.
+ */
+int toolx_ftruncate_win32(int fd, curl_off_t where)
+{
+  intptr_t handle = _get_osfhandle(fd);
+
+  if(curl_lseek(fd, where, SEEK_SET) == LSEEK_ERROR)
+    return -1;
+
+  if(!SetEndOfFile((HANDLE)handle))
+    return -1;
+
+  return 0;
+}
+#elif defined(__DJGPP__)
+/*
+ * Only supports 'off_t' (signed 32-bit) as file size.
+ */
+int toolx_ftruncate_djgpp(int fd, curl_off_t where)
+{
+  if(where > INT_MAX)
+    return -1;
+
+  return ftruncate(fd, (off_t)where);
+}
+#endif
+
+#ifdef _WIN32
+FILE *tool_execpath(const char *filename, char **pathp)
+{
+  static char filebuffer[512];
+  unsigned long len;
+  /* Get the filename of our executable. GetModuleFileName is already declared
+   * via inclusions done in setup header file. We assume that we are using
+   * the ASCII version here.
+   */
+  len = GetModuleFileNameA(0, filebuffer, sizeof(filebuffer));
+  if(len > 0 && len < sizeof(filebuffer)) {
+    /* We got a valid filename - get the directory part */
+    char *lastdirchar = strrchr(filebuffer, DIR_CHAR[0]);
+    if(lastdirchar) {
+      size_t remaining;
+      *lastdirchar = 0;
+      /* If we have enough space, build the RC filename */
+      remaining = sizeof(filebuffer) - strlen(filebuffer);
+      if(strlen(filename) < remaining - 1) {
+        curl_msnprintf(lastdirchar, remaining, "%s%s", DIR_CHAR, filename);
+        *pathp = filebuffer;
+        return curlx_fopen(filebuffer, FOPEN_READTEXT);
+      }
+    }
+  }
+
+  return NULL;
+}
+#endif
diff --git a/third-party/curl/src/tool_util.h b/third-party/curl/src/tool_util.h
index d68867265c..12206ce980 100644
--- a/third-party/curl/src/tool_util.h
+++ b/third-party/curl/src/tool_util.h
@@ -25,18 +25,17 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-struct timeval tvnow(void);
-
-/*
- * Make sure that the first argument (t1) is the more recent time and t2 is
- * the older time, as otherwise you get a weird negative time-diff back...
- *
- * Returns: the time difference in number of milliseconds.
+/**
+ * Return timeval of the REALTIME clock.
  */
-long tvdiff(struct timeval t1, struct timeval t2);
+struct timeval tvrealnow(void);
 
 /* Case insensitive comparison support. */
 int struplocompare(const char *p1, const char *p2);
 int struplocompare4sort(const void *p1, const void *p2);
 
+#ifdef _WIN32
+FILE *tool_execpath(const char *filename, char **pathp);
+#endif
+
 #endif /* HEADER_CURL_TOOL_UTIL_H */
diff --git a/third-party/curl/src/tool_version.h b/third-party/curl/src/tool_version.h
index 7ca5061814..5db625c317 100644
--- a/third-party/curl/src/tool_version.h
+++ b/third-party/curl/src/tool_version.h
@@ -25,12 +25,12 @@
  ***************************************************************************/
 #include <curl/curlver.h>
 
-#define CURL_NAME "curl"
-#define CURL_COPYRIGHT LIBCURL_COPYRIGHT
-#define CURL_VERSION LIBCURL_VERSION
+#define CURL_NAME          "curl"
+#define CURL_COPYRIGHT     LIBCURL_COPYRIGHT
+#define CURL_VERSION       LIBCURL_VERSION
 #define CURL_VERSION_MAJOR LIBCURL_VERSION_MAJOR
 #define CURL_VERSION_MINOR LIBCURL_VERSION_MINOR
 #define CURL_VERSION_PATCH LIBCURL_VERSION_PATCH
-#define CURL_ID CURL_NAME " " CURL_VERSION " (" OS ") "
+#define CURL_ID            CURL_NAME " " CURL_VERSION " (" CURL_OS ") "
 
 #endif /* HEADER_CURL_TOOL_VERSION_H */
diff --git a/third-party/curl/src/tool_vms.c b/third-party/curl/src/tool_vms.c
index 9402574201..ced0efe2ed 100644
--- a/third-party/curl/src/tool_vms.c
+++ b/third-party/curl/src/tool_vms.c
@@ -26,18 +26,13 @@
 #ifdef __VMS
 
 #if defined(__DECC) && !defined(__VAX) && \
-    defined(__CRTL_VER) && (__CRTL_VER >= 70301000)
+  defined(__CRTL_VER) && (__CRTL_VER >= 70301000)
 #include <unixlib.h>
 #endif
 
-#define ENABLE_CURLX_PRINTF
-#include "curlx.h"
-
 #include "curlmsg_vms.h"
 #include "tool_vms.h"
 
-#include "memdebug.h" /* keep this as LAST include */
-
 void decc$__posix_exit(int __status);
 void decc$exit(int __status);
 
@@ -64,7 +59,7 @@ int is_vms_shell(void)
   }
 
   /* Have to make sure some one did not set shell to DCL */
-  if(strcmp(shell, "DCL") == 0) {
+  if(!strcmp(shell, "DCL")) {
     vms_shell = 1;
     return 1;
   }
@@ -74,7 +69,7 @@ int is_vms_shell(void)
 }
 
 /*
- * VMS has two exit() routines.  When running under a Unix style shell, then
+ * VMS has two exit() routines. When running under a Unix style shell, then
  * Unix style and the __posix_exit() routine is used.
  *
  * When running under the DCL shell, then the VMS encoded codes and decc$exit()
@@ -85,7 +80,7 @@ int is_vms_shell(void)
  * feature macro settings, and one of the exit routines is hidden at compile
  * time.
  *
- * Since we want Curl to work properly under the VMS DCL shell and Unix
+ * Since we want curl to work properly under the VMS DCL shell and Unix
  * shells under VMS, this routine should compile correctly regardless of
  * the settings.
  */
@@ -94,7 +89,7 @@ void vms_special_exit(int code, int vms_show)
 {
   int vms_code;
 
-  /* The Posix exit mode is only available after VMS 7.0 */
+  /* The POSIX exit mode is only available after VMS 7.0 */
 #if __CRTL_VER >= 70000000
   if(is_vms_shell() == 0) {
     decc$__posix_exit(code);
@@ -102,7 +97,7 @@ void vms_special_exit(int code, int vms_show)
 #endif
 
   if(code > CURL_LAST) {   /* If CURL_LAST exceeded then */
-    vms_code = CURL_LAST;  /* curlmsg.h is out of sync.  */
+    vms_code = CURL_LAST;  /* curlmsg.h is out of sync. */
   }
   else {
     vms_code = vms_cond[code] | vms_show;
@@ -111,7 +106,7 @@ void vms_special_exit(int code, int vms_show)
 }
 
 #if defined(__DECC) && !defined(__VAX) && \
-    defined(__CRTL_VER) && (__CRTL_VER >= 70301000)
+  defined(__CRTL_VER) && (__CRTL_VER >= 70301000)
 
 /*
  * 2004-09-19 SMS.
@@ -133,9 +128,9 @@ struct decc_feat_t {
 static const struct decc_feat_t decc_feat_array[] = {
   /* Preserve command-line case with SET PROCESS/PARSE_STYLE=EXTENDED */
   { "DECC$ARGV_PARSE_STYLE", 1 },
-  /* Preserve case for file names on ODS5 disks. */
+  /* Preserve case for filenames on ODS5 disks. */
   { "DECC$EFS_CASE_PRESERVE", 1 },
-  /* Enable multiple dots (and most characters) in ODS5 file names,
+  /* Enable multiple dots (and most characters) in ODS5 filenames,
      while preserving VMS-ness of ";version". */
   { "DECC$EFS_CHARSET", 1 },
   /* List terminator. */
@@ -159,20 +154,20 @@ static void decc_init(void)
   decc_init_done = 1;
 
   /* Loop through all items in the decc_feat_array[]. */
-  for(i = 0; decc_feat_array[i].name != NULL; i++) {
+  for(i = 0; decc_feat_array[i].name; i++) {
 
     /* Get the feature index. */
     feat_index = decc$feature_get_index(decc_feat_array[i].name);
 
     if(feat_index >= 0) {
-      /* Valid item.  Collect its properties. */
+      /* Valid item. Collect its properties. */
       feat_value = decc$feature_get_value(feat_index, 1);
       feat_value_min = decc$feature_get_value(feat_index, 2);
       feat_value_max = decc$feature_get_value(feat_index, 3);
 
       if((decc_feat_array[i].value >= feat_value_min) &&
          (decc_feat_array[i].value <= feat_value_max)) {
-        /* Valid value.  Set it if necessary. */
+        /* Valid value. Set it if necessary. */
         if(feat_value != decc_feat_array[i].value) {
           sts = decc$feature_set_value(feat_index, 1,
                                        decc_feat_array[i].value);
@@ -180,16 +175,15 @@ static void decc_init(void)
       }
       else {
         /* Invalid DECC feature value. */
-        printf(" INVALID DECC FEATURE VALUE, %d: %d <= %s <= %d.\n",
-               feat_value,
-               feat_value_min, decc_feat_array[i].name, feat_value_max);
+        curl_mprintf(" INVALID DECC FEATURE VALUE, %d: %d <= %s <= %d.\n",
+                     feat_value,
+                     feat_value_min, decc_feat_array[i].name, feat_value_max);
       }
     }
     else {
       /* Invalid DECC feature name. */
-      printf(" UNKNOWN DECC FEATURE: %s.\n", decc_feat_array[i].name);
+      curl_mprintf(" UNKNOWN DECC FEATURE: %s.\n", decc_feat_array[i].name);
     }
-
   }
 }
 
@@ -198,19 +192,19 @@ static void decc_init(void)
 #pragma nostandard
 
 /* Establish the LIB$INITIALIZE PSECTs, with proper alignment and
-   other attributes.  Note that "nopic" is significant only on VAX. */
+   other attributes. Note that "nopic" is significant only on VAX. */
 #pragma extern_model save
 #pragma extern_model strict_refdef "LIB$INITIALIZ" 2, nopic, nowrt
-const int spare[8] = {0};
+const int spare[8] = { 0 };
 #pragma extern_model strict_refdef "LIB$INITIALIZE" 2, nopic, nowrt
-void (*const x_decc_init)() = decc_init;
+void (* const x_decc_init)() = decc_init;
 #pragma extern_model restore
 
 /* Fake reference to ensure loading the LIB$INITIALIZE PSECT. */
 #pragma extern_model save
 int LIB$INITIALIZE(void);
 #pragma extern_model strict_refdef
-int dmy_lib$initialize = (int) LIB$INITIALIZE;
+int dmy_lib$initialize = (int)LIB$INITIALIZE;
 #pragma extern_model restore
 
 #pragma standard
diff --git a/third-party/curl/src/tool_vms.h b/third-party/curl/src/tool_vms.h
index cc2d31d053..b459a25ee8 100644
--- a/third-party/curl/src/tool_vms.h
+++ b/third-party/curl/src/tool_vms.h
@@ -38,10 +38,14 @@ int is_vms_shell(void);
 void vms_special_exit(int code, int vms_show);
 
 #undef exit
-#define exit(__code) vms_special_exit((__code), (0))
+#define exit(__code) vms_special_exit(__code, 0)
 
-#define  VMS_STS(c,f,e,s) (((c&0xF)<<28)|((f&0xFFF)<<16)|((e&0x1FFF)<3)|(s&7))
-#define  VMSSTS_HIDE  VMS_STS(1,0,0,0)
+#define VMS_STS(c, f, e, s) \
+  ((((c) & 0xF)   << 28) |  \
+   (((f) & 0xFFF) << 16) |  \
+   (((e) & 0x1FFF) < 3) |   \
+    ((s) & 7))
+#define VMSSTS_HIDE VMS_STS(1, 0, 0, 0)
 
 #endif /* __VMS */
 
diff --git a/third-party/curl/src/tool_writeout.c b/third-party/curl/src/tool_writeout.c
index 0fc955d5b4..ac8d5434b8 100644
--- a/third-party/curl/src/tool_writeout.c
+++ b/third-party/curl/src/tool_writeout.c
@@ -22,31 +22,10 @@
  *
  ***************************************************************************/
 #include "tool_setup.h"
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
+
 #include "tool_cfgable.h"
 #include "tool_writeout.h"
 #include "tool_writeout_json.h"
-#include "dynbuf.h"
-
-#include "memdebug.h" /* keep this as LAST include */
-
-static int writeTime(FILE *stream, const struct writeoutvar *wovar,
-                     struct per_transfer *per, CURLcode per_result,
-                     bool use_json);
-
-static int writeString(FILE *stream, const struct writeoutvar *wovar,
-                       struct per_transfer *per, CURLcode per_result,
-                       bool use_json);
-
-static int writeLong(FILE *stream, const struct writeoutvar *wovar,
-                     struct per_transfer *per, CURLcode per_result,
-                     bool use_json);
-
-static int writeOffset(FILE *stream, const struct writeoutvar *wovar,
-                       struct per_transfer *per, CURLcode per_result,
-                       bool use_json);
 
 struct httpmap {
   const char *str;
@@ -54,107 +33,19 @@ struct httpmap {
 };
 
 static const struct httpmap http_version[] = {
-  { "0",   CURL_HTTP_VERSION_NONE},
-  { "1",   CURL_HTTP_VERSION_1_0},
-  { "1.1", CURL_HTTP_VERSION_1_1},
-  { "2",   CURL_HTTP_VERSION_2},
-  { "3",   CURL_HTTP_VERSION_3},
-  { NULL, 0} /* end of list */
-};
-
-/* The designated write function should be the same as the CURLINFO return type
-   with exceptions special cased in the respective function. For example,
-   http_version uses CURLINFO_HTTP_VERSION which returns the version as a long,
-   however it is output as a string and therefore is handled in writeString.
-
-   Yes: "http_version": "1.1"
-   No:  "http_version": 1.1
-
-   Variable names should be in alphabetical order.
-   */
-static const struct writeoutvar variables[] = {
-  {"certs", VAR_CERT, CURLINFO_NONE, writeString},
-  {"content_type", VAR_CONTENT_TYPE, CURLINFO_CONTENT_TYPE, writeString},
-  {"conn_id", VAR_CONN_ID, CURLINFO_CONN_ID, writeOffset},
-  {"errormsg", VAR_ERRORMSG, CURLINFO_NONE, writeString},
-  {"exitcode", VAR_EXITCODE, CURLINFO_NONE, writeLong},
-  {"filename_effective", VAR_EFFECTIVE_FILENAME, CURLINFO_NONE, writeString},
-  {"ftp_entry_path", VAR_FTP_ENTRY_PATH, CURLINFO_FTP_ENTRY_PATH, writeString},
-  {"header_json", VAR_HEADER_JSON, CURLINFO_NONE, NULL},
-  {"http_code", VAR_HTTP_CODE, CURLINFO_RESPONSE_CODE, writeLong},
-  {"http_connect", VAR_HTTP_CODE_PROXY, CURLINFO_HTTP_CONNECTCODE, writeLong},
-  {"http_version", VAR_HTTP_VERSION, CURLINFO_HTTP_VERSION, writeString},
-  {"json", VAR_JSON, CURLINFO_NONE, NULL},
-  {"local_ip", VAR_LOCAL_IP, CURLINFO_LOCAL_IP, writeString},
-  {"local_port", VAR_LOCAL_PORT, CURLINFO_LOCAL_PORT, writeLong},
-  {"method", VAR_EFFECTIVE_METHOD, CURLINFO_EFFECTIVE_METHOD, writeString},
-  {"num_certs", VAR_NUM_CERTS, CURLINFO_NONE, writeLong},
-  {"num_connects", VAR_NUM_CONNECTS, CURLINFO_NUM_CONNECTS, writeLong},
-  {"num_headers", VAR_NUM_HEADERS, CURLINFO_NONE, writeLong},
-  {"num_redirects", VAR_REDIRECT_COUNT, CURLINFO_REDIRECT_COUNT, writeLong},
-  {"onerror", VAR_ONERROR, CURLINFO_NONE, NULL},
-  {"proxy_ssl_verify_result", VAR_PROXY_SSL_VERIFY_RESULT,
-   CURLINFO_PROXY_SSL_VERIFYRESULT, writeLong},
-  {"redirect_url", VAR_REDIRECT_URL, CURLINFO_REDIRECT_URL, writeString},
-  {"referer", VAR_REFERER, CURLINFO_REFERER, writeString},
-  {"remote_ip", VAR_PRIMARY_IP, CURLINFO_PRIMARY_IP, writeString},
-  {"remote_port", VAR_PRIMARY_PORT, CURLINFO_PRIMARY_PORT, writeLong},
-  {"response_code", VAR_HTTP_CODE, CURLINFO_RESPONSE_CODE, writeLong},
-  {"scheme", VAR_SCHEME, CURLINFO_SCHEME, writeString},
-  {"size_download", VAR_SIZE_DOWNLOAD, CURLINFO_SIZE_DOWNLOAD_T, writeOffset},
-  {"size_header", VAR_HEADER_SIZE, CURLINFO_HEADER_SIZE, writeLong},
-  {"size_request", VAR_REQUEST_SIZE, CURLINFO_REQUEST_SIZE, writeLong},
-  {"size_upload", VAR_SIZE_UPLOAD, CURLINFO_SIZE_UPLOAD_T, writeOffset},
-  {"speed_download", VAR_SPEED_DOWNLOAD, CURLINFO_SPEED_DOWNLOAD_T,
-   writeOffset},
-  {"speed_upload", VAR_SPEED_UPLOAD, CURLINFO_SPEED_UPLOAD_T, writeOffset},
-  {"ssl_verify_result", VAR_SSL_VERIFY_RESULT, CURLINFO_SSL_VERIFYRESULT,
-   writeLong},
-  {"stderr", VAR_STDERR, CURLINFO_NONE, NULL},
-  {"stdout", VAR_STDOUT, CURLINFO_NONE, NULL},
-  {"time_appconnect", VAR_APPCONNECT_TIME, CURLINFO_APPCONNECT_TIME_T,
-   writeTime},
-  {"time_connect", VAR_CONNECT_TIME, CURLINFO_CONNECT_TIME_T, writeTime},
-  {"time_namelookup", VAR_NAMELOOKUP_TIME, CURLINFO_NAMELOOKUP_TIME_T,
-   writeTime},
-  {"time_pretransfer", VAR_PRETRANSFER_TIME, CURLINFO_PRETRANSFER_TIME_T,
-   writeTime},
-  {"time_redirect", VAR_REDIRECT_TIME, CURLINFO_REDIRECT_TIME_T, writeTime},
-  {"time_starttransfer", VAR_STARTTRANSFER_TIME, CURLINFO_STARTTRANSFER_TIME_T,
-   writeTime},
-  {"time_total", VAR_TOTAL_TIME, CURLINFO_TOTAL_TIME_T, writeTime},
-  {"url", VAR_INPUT_URL, CURLINFO_NONE, writeString},
-  {"url.scheme", VAR_INPUT_URLSCHEME, CURLINFO_NONE, writeString},
-  {"url.user", VAR_INPUT_URLUSER, CURLINFO_NONE, writeString},
-  {"url.password", VAR_INPUT_URLPASSWORD, CURLINFO_NONE, writeString},
-  {"url.options", VAR_INPUT_URLOPTIONS, CURLINFO_NONE, writeString},
-  {"url.host", VAR_INPUT_URLHOST, CURLINFO_NONE, writeString},
-  {"url.port", VAR_INPUT_URLPORT, CURLINFO_NONE, writeString},
-  {"url.path", VAR_INPUT_URLPATH, CURLINFO_NONE, writeString},
-  {"url.query", VAR_INPUT_URLQUERY, CURLINFO_NONE, writeString},
-  {"url.fragment", VAR_INPUT_URLFRAGMENT, CURLINFO_NONE, writeString},
-  {"url.zoneid", VAR_INPUT_URLZONEID, CURLINFO_NONE, writeString},
-  {"urle.scheme", VAR_INPUT_URLESCHEME, CURLINFO_NONE, writeString},
-  {"urle.user", VAR_INPUT_URLEUSER, CURLINFO_NONE, writeString},
-  {"urle.password", VAR_INPUT_URLEPASSWORD, CURLINFO_NONE, writeString},
-  {"urle.options", VAR_INPUT_URLEOPTIONS, CURLINFO_NONE, writeString},
-  {"urle.host", VAR_INPUT_URLEHOST, CURLINFO_NONE, writeString},
-  {"urle.port", VAR_INPUT_URLEPORT, CURLINFO_NONE, writeString},
-  {"urle.path", VAR_INPUT_URLEPATH, CURLINFO_NONE, writeString},
-  {"urle.query", VAR_INPUT_URLEQUERY, CURLINFO_NONE, writeString},
-  {"urle.fragment", VAR_INPUT_URLEFRAGMENT, CURLINFO_NONE, writeString},
-  {"urle.zoneid", VAR_INPUT_URLEZONEID, CURLINFO_NONE, writeString},
-  {"url_effective", VAR_EFFECTIVE_URL, CURLINFO_EFFECTIVE_URL, writeString},
-  {"urlnum", VAR_URLNUM, CURLINFO_NONE, writeLong},
-  {"xfer_id", VAR_EASY_ID, CURLINFO_XFER_ID, writeOffset},
-  {NULL, VAR_NONE, CURLINFO_NONE, NULL}
+  { "0",   CURL_HTTP_VERSION_NONE },
+  { "1",   CURL_HTTP_VERSION_1_0 },
+  { "1.1", CURL_HTTP_VERSION_1_1 },
+  { "2",   CURL_HTTP_VERSION_2 },
+  { "3",   CURL_HTTP_VERSION_3 },
+  { NULL, 0 } /* end of list */
 };
 
 static int writeTime(FILE *stream, const struct writeoutvar *wovar,
                      struct per_transfer *per, CURLcode per_result,
                      bool use_json)
 {
-  bool valid = false;
+  bool valid = FALSE;
   curl_off_t us = 0;
 
   (void)per;
@@ -163,7 +54,7 @@ static int writeTime(FILE *stream, const struct writeoutvar *wovar,
 
   if(wovar->ci) {
     if(!curl_easy_getinfo(per->curl, wovar->ci, &us))
-      valid = true;
+      valid = TRUE;
   }
   else {
     DEBUGASSERT(0);
@@ -174,14 +65,14 @@ static int writeTime(FILE *stream, const struct writeoutvar *wovar,
     us %= 1000000;
 
     if(use_json)
-      fprintf(stream, "\"%s\":", wovar->name);
+      curl_mfprintf(stream, "\"%s\":", wovar->name);
 
-    fprintf(stream, "%" CURL_FORMAT_CURL_OFF_TU
-            ".%06" CURL_FORMAT_CURL_OFF_TU, secs, us);
+    curl_mfprintf(stream, "%" CURL_FORMAT_CURL_OFF_T
+                  ".%06" CURL_FORMAT_CURL_OFF_T, secs, us);
   }
   else {
     if(use_json)
-      fprintf(stream, "\"%s\":null", wovar->name);
+      curl_mfprintf(stream, "\"%s\":null", wovar->name);
   }
 
   return 1; /* return 1 if anything was written */
@@ -195,14 +86,14 @@ static int urlpart(struct per_transfer *per, writeoutid vid,
   if(uh) {
     CURLUPart cpart = CURLUPART_HOST;
     char *part = NULL;
-    const char *url = NULL;
+    char *url = NULL;
 
-    if(vid >= VAR_INPUT_URLEHOST) {
+    if(vid >= VAR_INPUT_URLESCHEME) {
       if(curl_easy_getinfo(per->curl, CURLINFO_EFFECTIVE_URL, &url))
         rc = 5;
     }
     else
-      url = per->this_url;
+      url = per->url;
 
     if(!rc) {
       switch(vid) {
@@ -253,7 +144,7 @@ static int urlpart(struct per_transfer *per, writeoutid vid,
       }
     }
     if(!rc && curl_url_set(uh, CURLUPART_URL, url,
-                           CURLU_GUESS_SCHEME|CURLU_NON_SUPPORT_SCHEME))
+                           CURLU_GUESS_SCHEME | CURLU_NON_SUPPORT_SCHEME))
       rc = 2;
 
     if(!rc && curl_url_get(uh, cpart, &part, CURLU_DEFAULT_PORT))
@@ -268,15 +159,25 @@ static int urlpart(struct per_transfer *per, writeoutid vid,
   return rc;
 }
 
+static void certinfo(struct per_transfer *per)
+{
+  if(!per->certinfo) {
+    const struct curl_certinfo *certinfo;
+    CURLcode result = curl_easy_getinfo(per->curl, CURLINFO_CERTINFO,
+                                        &certinfo);
+    per->certinfo = (!result && certinfo) ? certinfo : NULL;
+  }
+}
+
 static int writeString(FILE *stream, const struct writeoutvar *wovar,
                        struct per_transfer *per, CURLcode per_result,
                        bool use_json)
 {
-  bool valid = false;
+  bool valid = FALSE;
   const char *strinfo = NULL;
   const char *freestr = NULL;
   struct dynbuf buf;
-  curlx_dyn_init(&buf, 256*1024);
+  curlx_dyn_init(&buf, 256 * 1024);
 
   DEBUGASSERT(wovar->writefunc == writeString);
 
@@ -288,7 +189,7 @@ static int writeString(FILE *stream, const struct writeoutvar *wovar,
         while(m->str) {
           if(m->num == version) {
             strinfo = m->str;
-            valid = true;
+            valid = TRUE;
             break;
           }
           m++;
@@ -297,12 +198,13 @@ static int writeString(FILE *stream, const struct writeoutvar *wovar,
     }
     else {
       if(!curl_easy_getinfo(per->curl, wovar->ci, &strinfo) && strinfo)
-        valid = true;
+        valid = TRUE;
     }
   }
   else {
     switch(wovar->id) {
     case VAR_CERT:
+      certinfo(per);
       if(per->certinfo) {
         int i;
         bool error = FALSE;
@@ -326,7 +228,7 @@ static int writeString(FILE *stream, const struct writeoutvar *wovar,
             len = curlx_dyn_len(&buf);
             if(len) {
               char *ptr = curlx_dyn_ptr(&buf);
-              if(ptr[len -1] != '\n') {
+              if(ptr[len - 1] != '\n') {
                 /* add a newline to make things look better */
                 if(curlx_dyn_addn(&buf, "\n", 1)) {
                   error = TRUE;
@@ -341,7 +243,7 @@ static int writeString(FILE *stream, const struct writeoutvar *wovar,
           if(!strinfo)
             /* maybe not a TLS protocol */
             strinfo = "";
-          valid = true;
+          valid = TRUE;
         }
       }
       else
@@ -349,21 +251,21 @@ static int writeString(FILE *stream, const struct writeoutvar *wovar,
       break;
     case VAR_ERRORMSG:
       if(per_result) {
-        strinfo = (per->errorbuffer && per->errorbuffer[0]) ?
-          per->errorbuffer : curl_easy_strerror(per_result);
-        valid = true;
+        strinfo = (per->errorbuffer[0]) ? per->errorbuffer :
+          curl_easy_strerror(per_result);
+        valid = TRUE;
       }
       break;
     case VAR_EFFECTIVE_FILENAME:
       if(per->outs.filename) {
         strinfo = per->outs.filename;
-        valid = true;
+        valid = TRUE;
       }
       break;
     case VAR_INPUT_URL:
-      if(per->this_url) {
-        strinfo = per->this_url;
-        valid = true;
+      if(per->url) {
+        strinfo = per->url;
+        valid = TRUE;
       }
       break;
     case VAR_INPUT_URLSCHEME:
@@ -386,10 +288,10 @@ static int writeString(FILE *stream, const struct writeoutvar *wovar,
     case VAR_INPUT_URLEQUERY:
     case VAR_INPUT_URLEFRAGMENT:
     case VAR_INPUT_URLEZONEID:
-      if(per->this_url) {
+      if(per->url) {
         if(!urlpart(per, wovar->id, &strinfo)) {
           freestr = strinfo;
-          valid = true;
+          valid = TRUE;
         }
       }
       break;
@@ -399,10 +301,10 @@ static int writeString(FILE *stream, const struct writeoutvar *wovar,
     }
   }
 
-  if(valid) {
-    DEBUGASSERT(strinfo);
+  DEBUGASSERT(!valid || strinfo);
+  if(valid && strinfo) {
     if(use_json) {
-      fprintf(stream, "\"%s\":", wovar->name);
+      curl_mfprintf(stream, "\"%s\":", wovar->name);
       jsonWriteString(stream, strinfo, FALSE);
     }
     else
@@ -410,9 +312,9 @@ static int writeString(FILE *stream, const struct writeoutvar *wovar,
   }
   else {
     if(use_json)
-      fprintf(stream, "\"%s\":null", wovar->name);
+      curl_mfprintf(stream, "\"%s\":null", wovar->name);
   }
-  curl_free((char *)freestr);
+  curl_free((char *)CURL_UNCONST(freestr));
 
   curlx_dyn_free(&buf);
   return 1; /* return 1 if anything was written */
@@ -422,34 +324,33 @@ static int writeLong(FILE *stream, const struct writeoutvar *wovar,
                      struct per_transfer *per, CURLcode per_result,
                      bool use_json)
 {
-  bool valid = false;
+  bool valid = FALSE;
   long longinfo = 0;
 
   DEBUGASSERT(wovar->writefunc == writeLong);
 
   if(wovar->ci) {
     if(!curl_easy_getinfo(per->curl, wovar->ci, &longinfo))
-      valid = true;
+      valid = TRUE;
   }
   else {
     switch(wovar->id) {
+    case VAR_NUM_RETRY:
+      longinfo = per->num_retries;
+      valid = TRUE;
+      break;
     case VAR_NUM_CERTS:
+      certinfo(per);
       longinfo = per->certinfo ? per->certinfo->num_of_certs : 0;
-      valid = true;
+      valid = TRUE;
       break;
     case VAR_NUM_HEADERS:
       longinfo = per->num_headers;
-      valid = true;
+      valid = TRUE;
       break;
     case VAR_EXITCODE:
-      longinfo = per_result;
-      valid = true;
-      break;
-    case VAR_URLNUM:
-      if(per->urlnum <= INT_MAX) {
-        longinfo = (long)per->urlnum;
-        valid = true;
-      }
+      longinfo = (long)per_result;
+      valid = TRUE;
       break;
     default:
       DEBUGASSERT(0);
@@ -459,17 +360,17 @@ static int writeLong(FILE *stream, const struct writeoutvar *wovar,
 
   if(valid) {
     if(use_json)
-      fprintf(stream, "\"%s\":%ld", wovar->name, longinfo);
+      curl_mfprintf(stream, "\"%s\":%ld", wovar->name, longinfo);
     else {
       if(wovar->id == VAR_HTTP_CODE || wovar->id == VAR_HTTP_CODE_PROXY)
-        fprintf(stream, "%03ld", longinfo);
+        curl_mfprintf(stream, "%03ld", longinfo);
       else
-        fprintf(stream, "%ld", longinfo);
+        curl_mfprintf(stream, "%ld", longinfo);
     }
   }
   else {
     if(use_json)
-      fprintf(stream, "\"%s\":null", wovar->name);
+      curl_mfprintf(stream, "\"%s\":null", wovar->name);
   }
 
   return 1; /* return 1 if anything was written */
@@ -479,7 +380,7 @@ static int writeOffset(FILE *stream, const struct writeoutvar *wovar,
                        struct per_transfer *per, CURLcode per_result,
                        bool use_json)
 {
-  bool valid = false;
+  bool valid = FALSE;
   curl_off_t offinfo = 0;
 
   (void)per;
@@ -488,26 +389,352 @@ static int writeOffset(FILE *stream, const struct writeoutvar *wovar,
 
   if(wovar->ci) {
     if(!curl_easy_getinfo(per->curl, wovar->ci, &offinfo))
-      valid = true;
+      valid = TRUE;
   }
   else {
-    DEBUGASSERT(0);
+    switch(wovar->id) {
+    case VAR_URLNUM:
+      if(per->urlnum <= INT_MAX) {
+        offinfo = per->urlnum;
+        valid = TRUE;
+      }
+      break;
+    default:
+      DEBUGASSERT(0);
+    }
   }
 
   if(valid) {
     if(use_json)
-      fprintf(stream, "\"%s\":", wovar->name);
+      curl_mfprintf(stream, "\"%s\":", wovar->name);
 
-    fprintf(stream, "%" CURL_FORMAT_CURL_OFF_T, offinfo);
+    curl_mfprintf(stream, "%" CURL_FORMAT_CURL_OFF_T, offinfo);
   }
   else {
     if(use_json)
-      fprintf(stream, "\"%s\":null", wovar->name);
+      curl_mfprintf(stream, "\"%s\":null", wovar->name);
   }
 
   return 1; /* return 1 if anything was written */
 }
 
+/* The designated write function should be the same as the CURLINFO return type
+   with exceptions special cased in the respective function. For example,
+   http_version uses CURLINFO_HTTP_VERSION which returns the version as a long,
+   however it is output as a string and therefore is handled in writeString.
+
+   Yes: "http_version": "1.1"
+   No:  "http_version": 1.1
+
+   Variable names MUST be in alphabetical order.
+   */
+static const struct writeoutvar variables[] = {
+  { "certs", VAR_CERT, CURLINFO_NONE, writeString },
+  { "conn_id", VAR_CONN_ID, CURLINFO_CONN_ID, writeOffset },
+  { "content_type", VAR_CONTENT_TYPE, CURLINFO_CONTENT_TYPE, writeString },
+  { "errormsg", VAR_ERRORMSG, CURLINFO_NONE, writeString },
+  { "exitcode", VAR_EXITCODE, CURLINFO_NONE, writeLong },
+  { "filename_effective", VAR_EFFECTIVE_FILENAME, CURLINFO_NONE, writeString },
+  { "ftp_entry_path", VAR_FTP_ENTRY_PATH, CURLINFO_FTP_ENTRY_PATH,
+    writeString },
+  { "header_json", VAR_HEADER_JSON, CURLINFO_NONE, NULL },
+  { "http_code", VAR_HTTP_CODE, CURLINFO_RESPONSE_CODE, writeLong },
+  { "http_connect", VAR_HTTP_CODE_PROXY, CURLINFO_HTTP_CONNECTCODE,
+    writeLong },
+  { "http_version", VAR_HTTP_VERSION, CURLINFO_HTTP_VERSION, writeString },
+  { "json", VAR_JSON, CURLINFO_NONE, NULL },
+  { "local_ip", VAR_LOCAL_IP, CURLINFO_LOCAL_IP, writeString },
+  { "local_port", VAR_LOCAL_PORT, CURLINFO_LOCAL_PORT, writeLong },
+  { "method", VAR_EFFECTIVE_METHOD, CURLINFO_EFFECTIVE_METHOD, writeString },
+  { "num_certs", VAR_NUM_CERTS, CURLINFO_NONE, writeLong },
+  { "num_connects", VAR_NUM_CONNECTS, CURLINFO_NUM_CONNECTS, writeLong },
+  { "num_headers", VAR_NUM_HEADERS, CURLINFO_NONE, writeLong },
+  { "num_redirects", VAR_REDIRECT_COUNT, CURLINFO_REDIRECT_COUNT, writeLong },
+  { "num_retries", VAR_NUM_RETRY, CURLINFO_NONE, writeLong },
+  { "onerror", VAR_ONERROR, CURLINFO_NONE, NULL },
+  { "proxy_ssl_verify_result", VAR_PROXY_SSL_VERIFY_RESULT,
+    CURLINFO_PROXY_SSL_VERIFYRESULT, writeLong },
+  { "proxy_used", VAR_PROXY_USED, CURLINFO_USED_PROXY, writeLong },
+  { "redirect_url", VAR_REDIRECT_URL, CURLINFO_REDIRECT_URL, writeString },
+  { "referer", VAR_REFERER, CURLINFO_REFERER, writeString },
+  { "remote_ip", VAR_PRIMARY_IP, CURLINFO_PRIMARY_IP, writeString },
+  { "remote_port", VAR_PRIMARY_PORT, CURLINFO_PRIMARY_PORT, writeLong },
+  { "response_code", VAR_HTTP_CODE, CURLINFO_RESPONSE_CODE, writeLong },
+  { "scheme", VAR_SCHEME, CURLINFO_SCHEME, writeString },
+  { "size_delivered", VAR_SIZE_DELIVERED, CURLINFO_SIZE_DELIVERED,
+    writeOffset },
+  { "size_download", VAR_SIZE_DOWNLOAD, CURLINFO_SIZE_DOWNLOAD_T,
+    writeOffset },
+  { "size_header", VAR_HEADER_SIZE, CURLINFO_HEADER_SIZE, writeLong },
+  { "size_request", VAR_REQUEST_SIZE, CURLINFO_REQUEST_SIZE, writeLong },
+  { "size_upload", VAR_SIZE_UPLOAD, CURLINFO_SIZE_UPLOAD_T, writeOffset },
+  { "speed_download", VAR_SPEED_DOWNLOAD, CURLINFO_SPEED_DOWNLOAD_T,
+    writeOffset },
+  { "speed_upload", VAR_SPEED_UPLOAD, CURLINFO_SPEED_UPLOAD_T, writeOffset },
+  { "ssl_verify_result", VAR_SSL_VERIFY_RESULT, CURLINFO_SSL_VERIFYRESULT,
+    writeLong },
+  { "stderr", VAR_STDERR, CURLINFO_NONE, NULL },
+  { "stdout", VAR_STDOUT, CURLINFO_NONE, NULL },
+  { "time_appconnect", VAR_APPCONNECT_TIME, CURLINFO_APPCONNECT_TIME_T,
+    writeTime },
+  { "time_connect", VAR_CONNECT_TIME, CURLINFO_CONNECT_TIME_T, writeTime },
+  { "time_namelookup", VAR_NAMELOOKUP_TIME, CURLINFO_NAMELOOKUP_TIME_T,
+    writeTime },
+  { "time_posttransfer", VAR_POSTTRANSFER_TIME, CURLINFO_POSTTRANSFER_TIME_T,
+    writeTime },
+  { "time_pretransfer", VAR_PRETRANSFER_TIME, CURLINFO_PRETRANSFER_TIME_T,
+    writeTime },
+  { "time_queue", VAR_QUEUE_TIME, CURLINFO_QUEUE_TIME_T, writeTime },
+  { "time_redirect", VAR_REDIRECT_TIME, CURLINFO_REDIRECT_TIME_T, writeTime },
+  { "time_starttransfer", VAR_STARTTRANSFER_TIME,
+    CURLINFO_STARTTRANSFER_TIME_T, writeTime },
+  { "time_total", VAR_TOTAL_TIME, CURLINFO_TOTAL_TIME_T, writeTime },
+  { "tls_earlydata", VAR_TLS_EARLYDATA_SENT, CURLINFO_EARLYDATA_SENT_T,
+    writeOffset },
+  { "url", VAR_INPUT_URL, CURLINFO_NONE, writeString },
+  { "url.fragment", VAR_INPUT_URLFRAGMENT, CURLINFO_NONE, writeString },
+  { "url.host", VAR_INPUT_URLHOST, CURLINFO_NONE, writeString },
+  { "url.options", VAR_INPUT_URLOPTIONS, CURLINFO_NONE, writeString },
+  { "url.password", VAR_INPUT_URLPASSWORD, CURLINFO_NONE, writeString },
+  { "url.path", VAR_INPUT_URLPATH, CURLINFO_NONE, writeString },
+  { "url.port", VAR_INPUT_URLPORT, CURLINFO_NONE, writeString },
+  { "url.query", VAR_INPUT_URLQUERY, CURLINFO_NONE, writeString },
+  { "url.scheme", VAR_INPUT_URLSCHEME, CURLINFO_NONE, writeString },
+  { "url.user", VAR_INPUT_URLUSER, CURLINFO_NONE, writeString },
+  { "url.zoneid", VAR_INPUT_URLZONEID, CURLINFO_NONE, writeString },
+  { "url_effective", VAR_EFFECTIVE_URL, CURLINFO_EFFECTIVE_URL, writeString },
+  { "urle.fragment", VAR_INPUT_URLEFRAGMENT, CURLINFO_NONE, writeString },
+  { "urle.host", VAR_INPUT_URLEHOST, CURLINFO_NONE, writeString },
+  { "urle.options", VAR_INPUT_URLEOPTIONS, CURLINFO_NONE, writeString },
+  { "urle.password", VAR_INPUT_URLEPASSWORD, CURLINFO_NONE, writeString },
+  { "urle.path", VAR_INPUT_URLEPATH, CURLINFO_NONE, writeString },
+  { "urle.port", VAR_INPUT_URLEPORT, CURLINFO_NONE, writeString },
+  { "urle.query", VAR_INPUT_URLEQUERY, CURLINFO_NONE, writeString },
+  { "urle.scheme", VAR_INPUT_URLESCHEME, CURLINFO_NONE, writeString },
+  { "urle.user", VAR_INPUT_URLEUSER, CURLINFO_NONE, writeString },
+  { "urle.zoneid", VAR_INPUT_URLEZONEID, CURLINFO_NONE, writeString },
+  { "urlnum", VAR_URLNUM, CURLINFO_NONE, writeOffset },
+  { "xfer_id", VAR_EASY_ID, CURLINFO_XFER_ID, writeOffset }
+};
+
+#define MAX_WRITEOUT_NAME_LENGTH 24
+
+/* return the position after %time{} */
+static const char *outtime(const char *ptr, /* %time{ ... */
+                           FILE *stream)
+{
+  const char *end;
+  ptr += 6;
+  end = strchr(ptr, '}');
+  if(end) {
+    struct dynbuf format;
+    char output[256]; /* max output time length */
+#ifdef HAVE_GETTIMEOFDAY
+    struct timeval cnow;
+#else
+    struct curltime cnow;
+#endif
+    time_t secs;
+    unsigned int usecs;
+    size_t i;
+    size_t vlen;
+    CURLcode result = CURLE_OK;
+
+#ifdef HAVE_GETTIMEOFDAY
+    gettimeofday(&cnow, NULL);
+#else
+    cnow.tv_sec = time(NULL);
+    cnow.tv_usec = 0;
+#endif
+    secs = cnow.tv_sec;
+    usecs = (unsigned int)cnow.tv_usec;
+#ifdef DEBUGBUILD
+    {
+      const char *timestr = getenv("CURL_TIME");
+      if(timestr) {
+        curl_off_t val;
+        curlx_str_number(&timestr, &val, TIME_T_MAX);
+        secs = (time_t)val;
+        usecs = (unsigned int)(val % 1000000);
+      }
+    }
+#endif
+    vlen = end - ptr;
+    curlx_dyn_init(&format, 1024);
+
+    /* Insert:
+       - sub-seconds for %f
+       - epoch seconds for %s; strftime %s uses mktime() and assumes
+         local time, which breaks UTC output on non-UTC hosts
+       - +0000 for %z because it is otherwise not portable
+       - UTC for %Z because it is otherwise not portable
+       - Keep '%%' as-is so that strftime() makes a single % out of them
+    */
+    for(i = 0; !result && i < vlen; i++) {
+      if((i < vlen - 1) && ptr[i] == '%') {
+        switch(ptr[i + 1]) {
+        case 'f':
+          result = curlx_dyn_addf(&format, "%06u", usecs);
+          break;
+        case 's': {
+          /* time_t might be either 32 or 64 bits big */
+          curl_off_t tsecs = secs;
+          result = curlx_dyn_addf(&format, "%" CURL_FORMAT_CURL_OFF_T, tsecs);
+          break;
+        }
+        case 'Z':
+          result = curlx_dyn_addn(&format, "UTC", 3);
+          break;
+        case 'z':
+          result = curlx_dyn_addn(&format, "+0000", 5);
+          break;
+        case '%':
+          result = curlx_dyn_addn(&format, "%%", 2);
+          break;
+        default:
+          result = curlx_dyn_addn(&format, &ptr[i], 1);
+          continue;
+        }
+        i++;
+      }
+      else
+        result = curlx_dyn_addn(&format, &ptr[i], 1);
+    }
+    if(!result) {
+      struct tm utc;
+      result = curlx_gmtime(secs, &utc);
+#ifdef CURL_HAVE_DIAG /* includes llvm/clang, but not affected as of v22.1.0 */
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wformat-nonliteral"
+#endif
+      if(curlx_dyn_len(&format) && !result &&
+         strftime(output, sizeof(output), curlx_dyn_ptr(&format), &utc))
+        fputs(output, stream);
+#ifdef CURL_HAVE_DIAG
+#pragma GCC diagnostic pop
+#endif
+      curlx_dyn_free(&format);
+    }
+    ptr = end + 1;
+  }
+  else
+    fputs("%time{", stream);
+  return ptr;
+}
+
+static void separator(const char *sep, size_t seplen, FILE *stream)
+{
+  while(seplen) {
+    if(*sep == '\\') {
+      switch(sep[1]) {
+      case 'r':
+        fputc('\r', stream);
+        break;
+      case 'n':
+        fputc('\n', stream);
+        break;
+      case 't':
+        fputc('\t', stream);
+        break;
+      case '}':
+        fputc('}', stream);
+        break;
+      case '\0':
+        break;
+      default:
+        /* unknown, output this */
+        fputc(sep[0], stream);
+        fputc(sep[1], stream);
+        break;
+      }
+      sep += 2;
+      seplen -= 2;
+    }
+    else {
+      fputc(*sep, stream);
+      sep++;
+      seplen--;
+    }
+  }
+}
+
+static void output_header(struct per_transfer *per,
+                          FILE *stream,
+                          const char **pptr)
+{
+  const char *ptr = *pptr;
+  const char *end;
+  end = strchr(ptr, '}');
+  do {
+    if(!end || (end[-1] != '\\'))
+      break;
+    end = strchr(&end[1], '}');
+  } while(end);
+  if(end) {
+    char hname[256]; /* holds the longest header field name */
+    struct curl_header *header;
+    const char *instr;
+    const char *sep = NULL;
+    size_t seplen = 0;
+    size_t vlen = end - ptr;
+    instr = memchr(ptr, ':', vlen);
+    if(instr) {
+      /* instructions follow */
+      if(!strncmp(&instr[1], "all:", 4)) {
+        sep = &instr[5];
+        seplen = end - sep;
+        vlen -= (seplen + 5);
+      }
+    }
+    if(vlen < sizeof(hname)) {
+      memcpy(hname, ptr, vlen);
+      hname[vlen] = 0;
+      if(sep) {
+        /* get headers from all requests */
+        int reqno = 0;
+        size_t indno = 0;
+        bool output = FALSE;
+        do {
+          if(CURLHE_OK == curl_easy_header(per->curl, hname, indno,
+                                           CURLH_HEADER, reqno,
+                                           &header)) {
+            if(output)
+              /* output separator */
+              separator(sep, seplen, stream);
+            fputs(header->value, stream);
+            output = TRUE;
+          }
+          else
+            break;
+          if((header->index + 1) < header->amount)
+            indno++;
+          else {
+            ++reqno;
+            indno = 0;
+          }
+        } while(1);
+      }
+      else {
+        if(CURLHE_OK == curl_easy_header(per->curl, hname, 0,
+                                         CURLH_HEADER, -1, &header))
+          fputs(header->value, stream);
+      }
+    }
+    ptr = end + 1;
+  }
+  else
+    fputs("%header{", stream);
+  *pptr = ptr;
+}
+
+static int matchvar(const void *m1, const void *m2)
+{
+  const struct writeoutvar *v1 = m1;
+  const struct writeoutvar *v2 = m2;
+
+  return strcmp(v1->name, v2->name);
+}
+
 void ourWriteOut(struct OperationConfig *config, struct per_transfer *per,
                  CURLcode per_result)
 {
@@ -515,16 +742,13 @@ void ourWriteOut(struct OperationConfig *config, struct per_transfer *per,
   const char *writeinfo = config->writeout;
   const char *ptr = writeinfo;
   bool done = FALSE;
-  struct curl_certinfo *certinfo;
-  CURLcode res = curl_easy_getinfo(per->curl, CURLINFO_CERTINFO, &certinfo);
   bool fclose_stream = FALSE;
+  struct dynbuf name;
 
   if(!writeinfo)
     return;
 
-  if(!res && certinfo)
-    per->certinfo = certinfo;
-
+  curlx_dyn_init(&name, MAX_WRITEOUT_NAME_LENGTH);
   while(ptr && *ptr && !done) {
     if('%' == *ptr && ptr[1]) {
       if('%' == ptr[1]) {
@@ -534,11 +758,11 @@ void ourWriteOut(struct OperationConfig *config, struct per_transfer *per,
       }
       else {
         /* this is meant as a variable to output */
-        char *end;
+        const char *end;
         size_t vlen;
         if('{' == ptr[1]) {
-          int i;
-          bool match = FALSE;
+          const struct writeoutvar *wv = NULL;
+          struct writeoutvar find = { 0 };
           end = strchr(ptr, '}');
           ptr += 2; /* pass the % and the { */
           if(!end) {
@@ -546,66 +770,61 @@ void ourWriteOut(struct OperationConfig *config, struct per_transfer *per,
             continue;
           }
           vlen = end - ptr;
-          for(i = 0; variables[i].name; i++) {
-            if((strlen(variables[i].name) == vlen) &&
-               curl_strnequal(ptr, variables[i].name, vlen)) {
-              match = TRUE;
-              switch(variables[i].id) {
-              case VAR_ONERROR:
-                if(per_result == CURLE_OK)
-                  /* this isn't error so skip the rest */
-                  done = TRUE;
-                break;
-              case VAR_STDOUT:
-                if(fclose_stream)
-                  fclose(stream);
-                fclose_stream = FALSE;
-                stream = stdout;
-                break;
-              case VAR_STDERR:
-                if(fclose_stream)
-                  fclose(stream);
-                fclose_stream = FALSE;
-                stream = stderr;
-                break;
-              case VAR_JSON:
-                ourWriteOutJSON(stream, variables, per, per_result);
-                break;
-              case VAR_HEADER_JSON:
-                headerJSON(stream, per);
-                break;
-              default:
-                (void)variables[i].writefunc(stream, &variables[i],
-                                             per, per_result, false);
-                break;
-              }
+
+          curlx_dyn_reset(&name);
+          if(!curlx_dyn_addn(&name, ptr, vlen)) {
+            find.name = curlx_dyn_ptr(&name);
+            wv = bsearch(&find,
+                         variables, CURL_ARRAYSIZE(variables),
+                         sizeof(variables[0]), matchvar);
+          }
+          else
+            break;
+          if(wv) {
+            switch(wv->id) {
+            case VAR_ONERROR:
+              if(per_result == CURLE_OK)
+                /* this is not error so skip the rest */
+                done = TRUE;
+              break;
+            case VAR_STDOUT:
+              if(fclose_stream)
+                curlx_fclose(stream);
+              fclose_stream = FALSE;
+              stream = stdout;
+              break;
+            case VAR_STDERR:
+              if(fclose_stream)
+                curlx_fclose(stream);
+              fclose_stream = FALSE;
+              stream = tool_stderr;
+              break;
+            case VAR_JSON:
+              ourWriteOutJSON(stream, variables,
+                              CURL_ARRAYSIZE(variables),
+                              per, per_result);
+              break;
+            case VAR_HEADER_JSON:
+              headerJSON(stream, per);
+              break;
+            default:
+              (void)wv->writefunc(stream, wv, per, per_result, FALSE);
               break;
             }
           }
-          if(!match) {
-            fprintf(stderr, "curl: unknown --write-out variable: '%.*s'\n",
-                    (int)vlen, ptr);
+          else {
+            curl_mfprintf(tool_stderr,
+                          "curl: unknown --write-out variable: '%.*s'\n",
+                          (int)vlen, ptr);
           }
           ptr = end + 1; /* pass the end */
         }
         else if(!strncmp("header{", &ptr[1], 7)) {
           ptr += 8;
-          end = strchr(ptr, '}');
-          if(end) {
-            char hname[256]; /* holds the longest header field name */
-            struct curl_header *header;
-            vlen = end - ptr;
-            if(vlen < sizeof(hname)) {
-              memcpy(hname, ptr, vlen);
-              hname[vlen] = 0;
-              if(CURLHE_OK == curl_easy_header(per->curl, hname, 0,
-                                               CURLH_HEADER, -1, &header))
-                fputs(header->value, stream);
-            }
-            ptr = end + 1;
-          }
-          else
-            fputs("%header{", stream);
+          output_header(per, stream, &ptr);
+        }
+        else if(!strncmp("time{", &ptr[1], 5)) {
+          ptr = outtime(ptr, stream);
         }
         else if(!strncmp("output{", &ptr[1], 7)) {
           bool append = FALSE;
@@ -616,18 +835,18 @@ void ourWriteOut(struct OperationConfig *config, struct per_transfer *per,
           }
           end = strchr(ptr, '}');
           if(end) {
-            char fname[512]; /* holds the longest file name */
+            char fname[512]; /* holds the longest filename */
             size_t flen = end - ptr;
             if(flen < sizeof(fname)) {
               FILE *stream2;
               memcpy(fname, ptr, flen);
               fname[flen] = 0;
-              stream2 = fopen(fname, append? FOPEN_APPENDTEXT :
-                              FOPEN_WRITETEXT);
+              stream2 = curlx_fopen(fname, append ? FOPEN_APPENDTEXT :
+                                    FOPEN_WRITETEXT);
               if(stream2) {
                 /* only change if the open worked */
                 if(fclose_stream)
-                  fclose(stream);
+                  curlx_fclose(stream);
                 stream = stream2;
                 fclose_stream = TRUE;
               }
@@ -638,7 +857,7 @@ void ourWriteOut(struct OperationConfig *config, struct per_transfer *per,
             fputs("%output{", stream);
         }
         else {
-          /* illegal syntax, then just output the characters that are used */
+          /* illegal syntax, then output the characters that are used */
           fputc('%', stream);
           fputc(ptr[1], stream);
           ptr += 2;
@@ -657,7 +876,7 @@ void ourWriteOut(struct OperationConfig *config, struct per_transfer *per,
         fputc('\t', stream);
         break;
       default:
-        /* unknown, just output this */
+        /* unknown, output this */
         fputc(*ptr, stream);
         fputc(ptr[1], stream);
         break;
@@ -670,5 +889,6 @@ void ourWriteOut(struct OperationConfig *config, struct per_transfer *per,
     }
   }
   if(fclose_stream)
-    fclose(stream);
+    curlx_fclose(stream);
+  curlx_dyn_free(&name);
 }
diff --git a/third-party/curl/src/tool_writeout.h b/third-party/curl/src/tool_writeout.h
index 4e690a65c9..7bc54aeb4d 100644
--- a/third-party/curl/src/tool_writeout.h
+++ b/third-party/curl/src/tool_writeout.h
@@ -24,6 +24,7 @@
  *
  ***************************************************************************/
 #include "tool_setup.h"
+
 #include "tool_operate.h"
 
 typedef enum {
@@ -56,8 +57,8 @@ typedef enum {
   VAR_INPUT_URLQUERY,
   VAR_INPUT_URLFRAGMENT,
   VAR_INPUT_URLZONEID,
-  /* the same ones again for url *effective* */
-  VAR_INPUT_URLESCHEME,
+  /* the same ones again for URL *effective* */
+  VAR_INPUT_URLESCHEME, /* keep this the first URLE* variable */
   VAR_INPUT_URLEUSER,
   VAR_INPUT_URLEPASSWORD,
   VAR_INPUT_URLEOPTIONS,
@@ -74,17 +75,22 @@ typedef enum {
   VAR_NUM_CERTS,
   VAR_NUM_CONNECTS,
   VAR_NUM_HEADERS,
+  VAR_NUM_RETRY,
   VAR_ONERROR,
   VAR_PRETRANSFER_TIME,
+  VAR_POSTTRANSFER_TIME,
   VAR_PRIMARY_IP,
   VAR_PRIMARY_PORT,
   VAR_PROXY_SSL_VERIFY_RESULT,
+  VAR_PROXY_USED,
+  VAR_QUEUE_TIME,
   VAR_REDIRECT_COUNT,
   VAR_REDIRECT_TIME,
   VAR_REDIRECT_URL,
   VAR_REFERER,
   VAR_REQUEST_SIZE,
   VAR_SCHEME,
+  VAR_SIZE_DELIVERED,
   VAR_SIZE_DOWNLOAD,
   VAR_SIZE_UPLOAD,
   VAR_SPEED_DOWNLOAD,
@@ -93,6 +99,7 @@ typedef enum {
   VAR_STARTTRANSFER_TIME,
   VAR_STDERR,
   VAR_STDOUT,
+  VAR_TLS_EARLYDATA_SENT,
   VAR_TOTAL_TIME,
   VAR_URLNUM,
   VAR_NUM_OF_VARS /* must be the last */
diff --git a/third-party/curl/src/tool_writeout_json.c b/third-party/curl/src/tool_writeout_json.c
index 7bc74a2697..7ea18860a5 100644
--- a/third-party/curl/src/tool_writeout_json.c
+++ b/third-party/curl/src/tool_writeout_json.c
@@ -23,10 +23,6 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#define ENABLE_CURLX_PRINTF
-
-/* use our own printf() functions */
-#include "curlx.h"
 #include "tool_cfgable.h"
 #include "tool_writeout_json.h"
 #include "tool_writeout.h"
@@ -38,11 +34,10 @@
 
    Return 0 on success, non-zero on error.
 */
-int jsonquoted(const char *in, size_t len,
-               struct curlx_dynbuf *out, bool lowercase)
+int jsonquoted(const char *in, size_t len, struct dynbuf *out, bool lowercase)
 {
-  const char *i = in;
-  const char *in_end = &in[len];
+  const unsigned char *i = (const unsigned char *)in;
+  const unsigned char *in_end = &i[len];
   CURLcode result = CURLE_OK;
 
   for(; (i < in_end) && !result; i++) {
@@ -72,9 +67,9 @@ int jsonquoted(const char *in, size_t len,
       if(*i < 32)
         result = curlx_dyn_addf(out, "\\u%04x", *i);
       else {
-        char o = *i;
+        char o = (char)*i;
         if(lowercase && (o >= 'A' && o <= 'Z'))
-          /* do not use tolower() since that's locale specific */
+          /* do not use tolower() since that is locale specific */
           o |= ('a' - 'A');
         result = curlx_dyn_addn(out, &o, 1);
       }
@@ -88,7 +83,7 @@ int jsonquoted(const char *in, size_t len,
 
 void jsonWriteString(FILE *stream, const char *in, bool lowercase)
 {
-  struct curlx_dynbuf out;
+  struct dynbuf out;
   curlx_dyn_init(&out, MAX_JSON_STRING);
 
   if(!jsonquoted(in, strlen(in), &out, lowercase)) {
@@ -101,30 +96,26 @@ void jsonWriteString(FILE *stream, const char *in, bool lowercase)
 }
 
 void ourWriteOutJSON(FILE *stream, const struct writeoutvar mappings[],
+                     size_t nentries,
                      struct per_transfer *per, CURLcode per_result)
 {
-  int i;
+  size_t i;
 
   fputs("{", stream);
 
-  for(i = 0; mappings[i].name != NULL; i++) {
+  for(i = 0; i < nentries; i++) {
     if(mappings[i].writefunc &&
-       mappings[i].writefunc(stream, &mappings[i], per, per_result, true))
+       mappings[i].writefunc(stream, &mappings[i], per, per_result, TRUE))
       fputs(",", stream);
   }
 
   /* The variables are sorted in alphabetical order but as a special case
      curl_version (which is not actually a --write-out variable) is last. */
-  fprintf(stream, "\"curl_version\":");
+  curl_mfprintf(stream, "\"curl_version\":");
   jsonWriteString(stream, curl_version(), FALSE);
-  fprintf(stream, "}");
+  curl_mfprintf(stream, "}");
 }
 
-#ifdef _MSC_VER
-/* warning C4706: assignment within conditional expression */
-#pragma warning(disable:4706)
-#endif
-
 void headerJSON(FILE *stream, struct per_transfer *per)
 {
   struct curl_header *header;
@@ -132,7 +123,7 @@ void headerJSON(FILE *stream, struct per_transfer *per)
 
   fputc('{', stream);
   while((header = curl_easy_nextheader(per->curl, CURLH_HEADER, -1,
-                                       prev))) {
+                                       prev)) != NULL) {
     if(header->amount > 1) {
       if(!header->index) {
         /* act on the 0-index entry and pull the others in, then output in a
@@ -151,8 +142,7 @@ void headerJSON(FILE *stream, struct per_transfer *per)
           if(++i >= a)
             break;
           fputc(',', stream);
-          if(curl_easy_header(per->curl, name, i, CURLH_HEADER,
-                              -1, &header))
+          if(curl_easy_header(per->curl, name, i, CURLH_HEADER, -1, &header))
             break;
         } while(1);
         fputc(']', stream);
diff --git a/third-party/curl/src/tool_writeout_json.h b/third-party/curl/src/tool_writeout_json.h
index 49a28194ff..7318367c17 100644
--- a/third-party/curl/src/tool_writeout_json.h
+++ b/third-party/curl/src/tool_writeout_json.h
@@ -24,12 +24,13 @@
  *
  ***************************************************************************/
 #include "tool_setup.h"
+
 #include "tool_writeout.h"
 
-int jsonquoted(const char *in, size_t len,
-               struct curlx_dynbuf *out, bool lowercase);
+int jsonquoted(const char *in, size_t len, struct dynbuf *out, bool lowercase);
 
 void ourWriteOutJSON(FILE *stream, const struct writeoutvar mappings[],
+                     size_t nentries,
                      struct per_transfer *per, CURLcode per_result);
 void headerJSON(FILE *stream, struct per_transfer *per);
 void jsonWriteString(FILE *stream, const char *in, bool lowercase);
diff --git a/third-party/curl/src/tool_xattr.c b/third-party/curl/src/tool_xattr.c
index 968cf2f72d..cdf8296307 100644
--- a/third-party/curl/src/tool_xattr.c
+++ b/third-party/curl/src/tool_xattr.c
@@ -22,9 +22,8 @@
  *
  ***************************************************************************/
 #include "tool_setup.h"
-#include "tool_xattr.h"
 
-#include "memdebug.h" /* keep this as LAST include */
+#include "tool_xattr.h"
 
 #ifdef USE_XATTR
 
@@ -43,19 +42,14 @@ static const struct xattr_mapping {
 
 /* returns a new URL that needs to be freed */
 /* @unittest: 1621 */
-#ifdef UNITTESTS
-char *stripcredentials(const char *url);
-#else
-static
-#endif
-char *stripcredentials(const char *url)
+UNITTEST char *stripcredentials(const char *url)
 {
   CURLU *u;
   CURLUcode uc;
   char *nurl;
   u = curl_url();
   if(u) {
-    uc = curl_url_set(u, CURLUPART_URL, url, 0);
+    uc = curl_url_set(u, CURLUPART_URL, url, CURLU_GUESS_SCHEME);
     if(uc)
       goto error;
 
@@ -88,9 +82,9 @@ static int xattr(int fd,
   if(value) {
 #ifdef DEBUGBUILD
     if(getenv("CURL_FAKE_XATTR")) {
-      printf("%s => %s\n", attr, value);
+      curl_mprintf("%s => %s\n", attr, value);
+      return 0;
     }
-    return 0;
 #endif
 #ifdef HAVE_FSETXATTR_6
     err = fsetxattr(fd, attr, value, strlen(value), 0, 0);
@@ -114,7 +108,7 @@ static int xattr(int fd,
 int fwrite_xattr(CURL *curl, const char *url, int fd)
 {
   int i = 0;
-  int err = 0;
+  int err = xattr(fd, "user.creator", "curl");
 
   /* loop through all xattr-curlinfo pairs and abort on a set error */
   while(!err && mappings[i].attr) {
diff --git a/third-party/curl/src/tool_xattr.h b/third-party/curl/src/tool_xattr.h
index 2ffffd275f..6720ccb2bd 100644
--- a/third-party/curl/src/tool_xattr.h
+++ b/third-party/curl/src/tool_xattr.h
@@ -29,7 +29,7 @@
 #  include <sys/xattr.h> /* header from libc, not from libattr */
 #  define USE_XATTR
 #elif (defined(__FreeBSD_version) && (__FreeBSD_version > 500000)) || \
-      defined(__MidnightBSD_version)
+  defined(__MidnightBSD_version)
 #  include <sys/types.h>
 #  include <sys/extattr.h>
 #  define USE_XATTR
@@ -38,8 +38,12 @@
 #ifdef USE_XATTR
 int fwrite_xattr(CURL *curl, const char *url, int fd);
 
+#ifdef UNITTESTS
+UNITTEST char *stripcredentials(const char *url);
+#endif
+
 #else
-#define fwrite_xattr(a,b,c) 0
+#define fwrite_xattr(a, b, c) 0
 #endif
 
 #endif /* HEADER_CURL_TOOL_XATTR_H */
diff --git a/third-party/curl/src/toolx/tool_time.c b/third-party/curl/src/toolx/tool_time.c
new file mode 100644
index 0000000000..12eaea9fe4
--- /dev/null
+++ b/third-party/curl/src/toolx/tool_time.c
@@ -0,0 +1,61 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "toolx/tool_time.h"
+
+#if defined(__MINGW32__) && (__MINGW64_VERSION_MAJOR <= 3)
+#include <sec_api/time_s.h>  /* for _localtime32_s(), _localtime64_s() */
+#ifdef _USE_32BIT_TIME_T
+#define localtime_s _localtime32_s
+#else
+#define localtime_s _localtime64_s
+#endif
+#endif
+
+/*
+ * toolx_localtime() is a localtime() replacement for portability. Do not use
+ * the localtime_s(), localtime_r() or localtime() functions anywhere else but
+ * here.
+ */
+CURLcode toolx_localtime(time_t intime, struct tm *store)
+{
+#ifdef _WIN32
+  if(localtime_s(store, &intime)) /* thread-safe */
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+#elif defined(HAVE_LOCALTIME_R)
+  const struct tm *tm;
+  tm = localtime_r(&intime, store); /* thread-safe */
+  if(!tm)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+#else
+  const struct tm *tm;
+  /* !checksrc! disable BANNEDFUNC 1 */
+  tm = localtime(&intime); /* not thread-safe */
+  if(tm)
+    *store = *tm; /* copy the pointed struct to the local copy */
+  else
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+#endif
+
+  return CURLE_OK;
+}
diff --git a/third-party/curl/src/toolx/tool_time.h b/third-party/curl/src/toolx/tool_time.h
new file mode 100644
index 0000000000..1544f675f7
--- /dev/null
+++ b/third-party/curl/src/toolx/tool_time.h
@@ -0,0 +1,30 @@
+#ifndef HEADER_TOOLX_TOOL_TIME_H
+#define HEADER_TOOLX_TOOL_TIME_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+CURLcode toolx_localtime(time_t intime, struct tm *store);
+
+#endif /* HEADER_TOOLX_TOOL_TIME_H */
diff --git a/third-party/curl/src/var.c b/third-party/curl/src/var.c
index f8f42f6665..8f9dbbb5b0 100644
--- a/third-party/curl/src/var.c
+++ b/third-party/curl/src/var.c
@@ -23,57 +23,33 @@
  ***************************************************************************/
 #include "tool_setup.h"
 
-#define ENABLE_CURLX_PRINTF
-/* use our own printf() functions */
-#include "curlx.h"
-
 #include "tool_cfgable.h"
 #include "tool_getparam.h"
-#include "tool_helpers.h"
-#include "tool_findfile.h"
 #include "tool_msgs.h"
-#include "tool_parsecfg.h"
-#include "dynbuf.h"
-#include "curl_base64.h"
 #include "tool_paramhlp.h"
 #include "tool_writeout_json.h"
 #include "var.h"
 
-#include "memdebug.h" /* keep this as LAST include */
-
 #define MAX_EXPAND_CONTENT 10000000
-
-static char *Memdup(const char *data, size_t len)
-{
-  char *p = malloc(len + 1);
-  if(!p)
-    return NULL;
-  if(len)
-    memcpy(p, data, len);
-  p[len] = 0;
-  return p;
-}
+#define MAX_VAR_LEN        128 /* max length of a name */
 
 /* free everything */
-void varcleanup(struct GlobalConfig *global)
+void varcleanup(void)
 {
-  struct var *list = global->variables;
+  struct tool_var *list = global->variables;
   while(list) {
-    struct var *t = list;
+    struct tool_var *t = list;
     list = list->next;
-    free((char *)t->content);
-    free((char *)t->name);
-    free(t);
+    curlx_free(CURL_UNCONST(t->content));
+    curlx_free(t);
   }
 }
 
-static const struct var *varcontent(struct GlobalConfig *global,
-                                    const char *name, size_t nlen)
+static const struct tool_var *varcontent(const char *name, size_t nlen)
 {
-  struct var *list = global->variables;
+  struct tool_var *list = global->variables;
   while(list) {
-    if((strlen(list->name) == nlen) &&
-       !strncmp(name, list->name, nlen)) {
+    if((strlen(list->name) == nlen) && !strncmp(name, list->name, nlen)) {
       return list;
     }
     list = list->next;
@@ -82,26 +58,27 @@ static const struct var *varcontent(struct GlobalConfig *global,
 }
 
 #define ENDOFFUNC(x) (((x) == '}') || ((x) == ':'))
-#define FUNCMATCH(ptr,name,len)                         \
-  (!strncmp(ptr, name, len) && ENDOFFUNC(ptr[len]))
+#define FUNCMATCH(ptr, name, len)                   \
+  (!strncmp(ptr, name, len) && ENDOFFUNC((ptr)[len]))
 
-#define FUNC_TRIM "trim"
-#define FUNC_TRIM_LEN (sizeof(FUNC_TRIM) - 1)
-#define FUNC_JSON "json"
-#define FUNC_JSON_LEN (sizeof(FUNC_JSON) - 1)
-#define FUNC_URL "url"
-#define FUNC_URL_LEN (sizeof(FUNC_URL) - 1)
-#define FUNC_B64 "b64"
-#define FUNC_B64_LEN (sizeof(FUNC_B64) - 1)
+#define FUNC_TRIM      "trim"
+#define FUNC_TRIM_LEN  (sizeof(FUNC_TRIM) - 1)
+#define FUNC_JSON      "json"
+#define FUNC_JSON_LEN  (sizeof(FUNC_JSON) - 1)
+#define FUNC_URL       "url"
+#define FUNC_URL_LEN   (sizeof(FUNC_URL) - 1)
+#define FUNC_B64       "b64"
+#define FUNC_B64_LEN   (sizeof(FUNC_B64) - 1)
+#define FUNC_64DEC     "64dec" /* base64 decode */
+#define FUNC_64DEC_LEN (sizeof(FUNC_64DEC) - 1)
 
-static ParameterError varfunc(struct GlobalConfig *global,
-                              char *c, /* content */
+static ParameterError varfunc(char *c, /* content */
                               size_t clen, /* content length */
-                              char *f, /* functions */
+                              const char *f, /* functions */
                               size_t flen, /* function string length */
-                              struct curlx_dynbuf *out)
+                              struct dynbuf *out)
 {
-  bool alloc = FALSE;
+  char *allocptr = NULL;
   ParameterError err = PARAM_OK;
   const char *finput = f;
 
@@ -110,7 +87,7 @@ static ParameterError varfunc(struct GlobalConfig *global,
     if(*f == '}')
       /* end of functions */
       break;
-    /* On entry, this is known to be a colon already.  In subsequent laps, it
+    /* On entry, this is known to be a colon already. In subsequent laps, it
        is also known to be a colon since that is part of the FUNCMATCH()
        checks */
     f++;
@@ -119,11 +96,11 @@ static ParameterError varfunc(struct GlobalConfig *global,
       f += FUNC_TRIM_LEN;
       if(clen) {
         /* skip leading white space, including CRLF */
-        while(*c && ISSPACE(*c)) {
+        while(ISSPACE(*c)) {
           c++;
           len--;
         }
-        while(len && ISSPACE(c[len-1]))
+        while(len && ISSPACE(c[len - 1]))
           len--;
       }
       /* put it in the output */
@@ -167,7 +144,7 @@ static ParameterError varfunc(struct GlobalConfig *global,
       if(clen) {
         char *enc;
         size_t elen;
-        CURLcode result = curlx_base64_encode(c, clen, &enc, &elen);
+        CURLcode result = curlx_base64_encode((uint8_t *)c, clen, &enc, &elen);
         if(result) {
           err = PARAM_NO_MEM;
           break;
@@ -176,48 +153,67 @@ static ParameterError varfunc(struct GlobalConfig *global,
         /* put it in the output */
         if(curlx_dyn_addn(out, enc, elen))
           err = PARAM_NO_MEM;
-        curl_free(enc);
+        curlx_free(enc);
+        if(err)
+          break;
+      }
+    }
+    else if(FUNCMATCH(f, FUNC_64DEC, FUNC_64DEC_LEN)) {
+      f += FUNC_64DEC_LEN;
+      curlx_dyn_reset(out);
+      if(clen) {
+        unsigned char *enc;
+        size_t elen;
+        CURLcode result = curlx_base64_decode(c, &enc, &elen);
+        /* put it in the output */
+        if(result) {
+          if(curlx_dyn_add(out, "[64dec-fail]"))
+            err = PARAM_NO_MEM;
+        }
+        else {
+          if(curlx_dyn_addn(out, enc, elen))
+            err = PARAM_NO_MEM;
+          curlx_free(enc);
+        }
         if(err)
           break;
       }
     }
     else {
       /* unsupported function */
-      errorf(global, "unknown variable function in '%.*s'",
-             (int)flen, finput);
+      errorf("unknown variable function in '%.*s'", (int)flen, finput);
       err = PARAM_EXPAND_ERROR;
       break;
     }
-    if(alloc)
-      free(c);
+    if(allocptr)
+      curlx_free(allocptr);
 
     clen = curlx_dyn_len(out);
-    c = Memdup(curlx_dyn_ptr(out), clen);
+    allocptr = c = curlx_memdup0(curlx_dyn_ptr(out), clen);
     if(!c) {
       err = PARAM_NO_MEM;
       break;
     }
-    alloc = TRUE;
   }
-  if(alloc)
-    free(c);
+  if(allocptr)
+    curlx_free(allocptr);
   if(err)
     curlx_dyn_free(out);
   return err;
 }
 
-ParameterError varexpand(struct GlobalConfig *global,
-                         const char *line, struct curlx_dynbuf *out,
-                         bool *replaced)
+ParameterError varexpand(const char *line, struct dynbuf *out, bool *replaced)
 {
   CURLcode result;
-  char *envp;
+  const char *envp;
   bool added = FALSE;
   const char *input = line;
   *replaced = FALSE;
   curlx_dyn_init(out, MAX_EXPAND_CONTENT);
   do {
     envp = strstr(line, "{{");
+    if(!envp)
+      break;
     if((envp > line) && envp[-1] == '\\') {
       /* preceding backslash, we want this verbatim */
 
@@ -232,17 +228,17 @@ ParameterError varexpand(struct GlobalConfig *global,
         return PARAM_NO_MEM;
       line = &envp[2];
     }
-    else if(envp) {
-      char name[128];
+    else {
+      char name[MAX_VAR_LEN];
       size_t nlen;
       size_t i;
-      char *funcp;
-      char *clp = strstr(envp, "}}");
+      const char *funcp;
+      const char *clp = strstr(envp, "}}");
       size_t prefix;
 
       if(!clp) {
         /* uneven braces */
-        warnf(global, "missing close '}}' in '%s'", input);
+        warnf("missing close '}}' in '%s'", input);
         break;
       }
 
@@ -256,7 +252,7 @@ ParameterError varexpand(struct GlobalConfig *global,
       else
         nlen = clp - envp;
       if(!nlen || (nlen >= sizeof(name))) {
-        warnf(global, "bad variable name length '%s'", input);
+        warnf("bad variable name length '%s'", input);
         /* insert the text as-is since this is not an env variable */
         result = curlx_dyn_addn(out, line, clp - line + prefix);
         if(result)
@@ -273,23 +269,22 @@ ParameterError varexpand(struct GlobalConfig *global,
         name[nlen] = 0;
 
         /* verify that the name looks sensible */
-        for(i = 0; (i < nlen) &&
-              (ISALNUM(name[i]) || (name[i] == '_')); i++);
+        for(i = 0; (i < nlen) && (ISALNUM(name[i]) || (name[i] == '_')); i++)
+          ;
         if(i != nlen) {
-          warnf(global, "bad variable name: %s", name);
+          warnf("bad variable name: %s", name);
           /* insert the text as-is since this is not an env variable */
-          result = curlx_dyn_addn(out, envp - prefix,
-                                  clp - envp + prefix + 2);
+          result = curlx_dyn_addn(out, envp - prefix, clp - envp + prefix + 2);
           if(result)
             return PARAM_NO_MEM;
         }
         else {
           char *value;
           size_t vlen = 0;
-          struct curlx_dynbuf buf;
-          const struct var *v = varcontent(global, name, nlen);
+          struct dynbuf buf;
+          const struct tool_var *v = varcontent(name, nlen);
           if(v) {
-            value = (char *)v->content;
+            value = (char *)CURL_UNCONST(v->content);
             vlen = v->clen;
           }
           else
@@ -299,8 +294,7 @@ ParameterError varexpand(struct GlobalConfig *global,
           if(funcp) {
             /* apply the list of functions on the value */
             size_t flen = clp - funcp;
-            ParameterError err = varfunc(global, value, vlen, funcp, flen,
-                                         &buf);
+            ParameterError err = varfunc(value, vlen, funcp, flen, &buf);
             if(err)
               return err;
             value = curlx_dyn_ptr(&buf);
@@ -310,9 +304,9 @@ ParameterError varexpand(struct GlobalConfig *global,
           if(value && vlen > 0) {
             /* A variable might contain null bytes. Such bytes cannot be shown
                using normal means, this is an error. */
-            char *nb = memchr(value, '\0', vlen);
+            const char *nb = memchr(value, '\0', vlen);
             if(nb) {
-              errorf(global, "variable contains null byte");
+              errorf("variable contains null byte");
               return PARAM_EXPAND_ERROR;
             }
           }
@@ -322,13 +316,12 @@ ParameterError varexpand(struct GlobalConfig *global,
           if(result)
             return PARAM_NO_MEM;
 
-          added = true;
+          added = TRUE;
         }
       }
       line = &clp[2];
     }
-
-  } while(envp);
+  } while(1);
   if(added && *line) {
     /* add the "suffix" as well */
     result = curlx_dyn_add(out, line);
@@ -342,47 +335,41 @@ ParameterError varexpand(struct GlobalConfig *global,
 }
 
 /*
- * Created in a way that is not revealing how variables is actually stored so
+ * Created in a way that is not revealing how variables are actually stored so
  * that we can improve this if we want better performance when managing many
  * at a later point.
  */
-static ParameterError addvariable(struct GlobalConfig *global,
-                                  const char *name,
+static ParameterError addvariable(const char *name,
                                   size_t nlen,
                                   const char *content,
                                   size_t clen,
                                   bool contalloc)
 {
-  struct var *p;
-  const struct var *check = varcontent(global, name, nlen);
+  struct tool_var *p;
+  const struct tool_var *check = varcontent(name, nlen);
+  DEBUGASSERT(nlen);
   if(check)
-    notef(global, "Overwriting variable '%s'", check->name);
+    notef("Overwriting variable '%s'", check->name);
 
-  p = calloc(sizeof(struct var), 1);
-  if(!p)
-    return PARAM_NO_MEM;
+  p = curlx_calloc(1, sizeof(struct tool_var) + nlen);
+  if(p) {
+    memcpy(p->name, name, nlen);
+    /* the null-termination byte is already present from above */
 
-  p->name = Memdup(name, nlen);
-  if(!p->name)
-    goto err;
+    p->content = contalloc ? content : curlx_memdup0(content, clen);
+    if(p->content) {
+      p->clen = clen;
 
-  p->content = contalloc ? content: Memdup(content, clen);
-  if(!p->content)
-    goto err;
-  p->clen = clen;
-
-  p->next = global->variables;
-  global->variables = p;
-  return PARAM_OK;
-err:
-  free((char *)p->content);
-  free((char *)p->name);
-  free(p);
+      p->next = global->variables;
+      global->variables = p;
+      return PARAM_OK;
+    }
+    curlx_free(p);
+  }
   return PARAM_NO_MEM;
 }
 
-ParameterError setvariable(struct GlobalConfig *global,
-                           const char *input)
+ParameterError setvariable(const char *input)
 {
   const char *name;
   size_t nlen;
@@ -393,6 +380,9 @@ ParameterError setvariable(struct GlobalConfig *global,
   ParameterError err = PARAM_OK;
   bool import = FALSE;
   char *ge = NULL;
+  char buf[MAX_VAR_LEN];
+  curl_off_t startoffset = 0;
+  curl_off_t endoffset = CURL_OFF_T_MAX;
 
   if(*input == '%') {
     import = TRUE;
@@ -402,15 +392,23 @@ ParameterError setvariable(struct GlobalConfig *global,
   while(*line && (ISALNUM(*line) || (*line == '_')))
     line++;
   nlen = line - name;
-  if(!nlen || (nlen > 128)) {
-    warnf(global, "Bad variable name length (%zd), skipping", nlen);
+  if(!nlen || (nlen >= MAX_VAR_LEN)) {
+    warnf("Bad variable name length (%zu), skipping", nlen);
     return PARAM_OK;
   }
   if(import) {
-    ge = curl_getenv(name);
+    /* this does not use curl_getenv() because we want "" support for blank
+       content */
+    if(*line) {
+      /* if there is a default action, we need to copy the name */
+      memcpy(buf, name, nlen);
+      buf[nlen] = 0;
+      name = buf;
+    }
+    ge = getenv(name);
     if(!*line && !ge) {
       /* no assign, no variable, fail */
-      errorf(global, "Variable '%s' import fail, not set", name);
+      errorf("Variable '%s' import fail, not set", name);
       return PARAM_EXPAND_ERROR;
     }
     else if(ge) {
@@ -419,6 +417,20 @@ ParameterError setvariable(struct GlobalConfig *global,
       clen = strlen(ge);
     }
   }
+  if(*line == '[' && ISDIGIT(line[1])) {
+    /* is there a byte range specified? [num-num] */
+    line++;
+    if(curlx_str_number(&line, &startoffset, CURL_OFF_T_MAX) ||
+       curlx_str_single(&line, '-'))
+      return PARAM_VAR_SYNTAX;
+    if(curlx_str_single(&line, ']')) {
+      if(curlx_str_number(&line, &endoffset, CURL_OFF_T_MAX) ||
+         curlx_str_single(&line, ']'))
+        return PARAM_VAR_SYNTAX;
+    }
+    if(startoffset > endoffset)
+      return PARAM_VAR_SYNTAX;
+  }
   if(content)
     ;
   else if(*line == '@') {
@@ -426,39 +438,55 @@ ParameterError setvariable(struct GlobalConfig *global,
     FILE *file;
     bool use_stdin;
     line++;
+
     use_stdin = !strcmp(line, "-");
     if(use_stdin)
       file = stdin;
     else {
-      file = fopen(line, "rb");
+      file = curlx_fopen(line, "rb");
       if(!file) {
-        errorf(global, "Failed to open %s", line);
-        return PARAM_READ_ERROR;
+        char errbuf[STRERROR_LEN];
+        errorf("Failed to open %s: %s", line,
+               curlx_strerror(errno, errbuf, sizeof(errbuf)));
+        err = PARAM_READ_ERROR;
       }
     }
-    err = file2memory(&content, &clen, file);
-    /* in case of out of memory, this should fail the entire operation */
-    contalloc = TRUE;
-    if(!use_stdin)
-      fclose(file);
+    if(!err) {
+      err = file2memory_range(&content, &clen, file, startoffset, endoffset);
+      /* in case of out of memory, this should fail the entire operation */
+      if(clen)
+        contalloc = TRUE;
+    }
+    if(!use_stdin && file)
+      curlx_fclose(file);
     if(err)
       return err;
   }
   else if(*line == '=') {
     line++;
-    /* this is the exact content */
-    content = (char *)line;
     clen = strlen(line);
+    /* this is the exact content */
+    content = (char *)CURL_UNCONST(line);
+    if(startoffset || (endoffset != CURL_OFF_T_MAX)) {
+      if(startoffset >= (curl_off_t)clen)
+        clen = 0;
+      else {
+        /* make the end offset no larger than the last byte */
+        if(endoffset >= (curl_off_t)clen)
+          endoffset = clen - 1;
+        clen = (size_t)(endoffset - startoffset) + 1;
+        content += startoffset;
+      }
+    }
   }
   else {
-    warnf(global, "Bad --variable syntax, skipping: %s", input);
+    warnf("Bad --variable syntax, skipping: %s", input);
     return PARAM_OK;
   }
-  err = addvariable(global, name, nlen, content, clen, contalloc);
+  err = addvariable(name, nlen, content, clen, contalloc);
   if(err) {
     if(contalloc)
-      free(content);
+      curlx_free(content);
   }
-  curl_free(ge);
   return err;
 }
diff --git a/third-party/curl/src/var.h b/third-party/curl/src/var.h
index 4a71943a3c..bb191ce09e 100644
--- a/third-party/curl/src/var.h
+++ b/third-party/curl/src/var.h
@@ -23,25 +23,19 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
 #include "tool_getparam.h"
-#include "dynbuf.h"
 
-struct var {
-  struct var *next;
-  const char *name;
+struct tool_var {
+  struct tool_var *next;
   const char *content;
   size_t clen; /* content length */
+  char name[1]; /* allocated as part of the struct */
 };
 
-struct GlobalConfig;
-
-ParameterError setvariable(struct GlobalConfig *global, const char *input);
-ParameterError varexpand(struct GlobalConfig *global,
-                         const char *line, struct curlx_dynbuf *out,
-                         bool *replaced);
+ParameterError setvariable(const char *input);
+ParameterError varexpand(const char *line, struct dynbuf *out, bool *replaced);
 
 /* free everything */
-void varcleanup(struct GlobalConfig *global);
+void varcleanup(void);
 
 #endif /* HEADER_CURL_VAR_H */
diff --git a/third-party/curl/tests/.gitignore b/third-party/curl/tests/.gitignore
index eae0490de7..ef4dea5280 100644
--- a/third-party/curl/tests/.gitignore
+++ b/third-party/curl/tests/.gitignore
@@ -3,7 +3,6 @@
 # SPDX-License-Identifier: curl
 
 *pid
-*.1.dist
 configurehelp.pm
 curl_client_key
 curl_client_key.pub
@@ -18,11 +17,7 @@ curl_ssh_config
 curl_sshd_config
 ftps_stunnel.conf
 https_stunnel.conf
-log
 log*
-runtests.html
-runtests.pdf
-testcurl.html
-testcurl.pdf
 *.port
 config
+second-hsts.txt
diff --git a/third-party/curl/tests/CI.md b/third-party/curl/tests/CI.md
deleted file mode 100644
index 0d3d1108ef..0000000000
--- a/third-party/curl/tests/CI.md
+++ /dev/null
@@ -1,117 +0,0 @@
-<!--
-Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-
-SPDX-License-Identifier: curl
--->
-
-# Continuous Integration for curl
-
-Curl runs in many different environments, so every change is run against a large
-number of test suites.
-
-Every pull request is verified for each of the following:
-
- - ... it still builds, warning-free, on Linux and macOS, with both
-   clang and gcc
- - ... it still builds fine on Windows with several MSVC versions
- - ... it still builds with cmake on Linux, with gcc and clang
- - ... it follows rudimentary code style rules
- - ... the test suite still runs 100% fine
- - ... the release tarball (the "dist") still works
- - ... it builds fine in-tree as well as out-of-tree
- - ... code coverage does not shrink drastically
- - ... different TLS backends still compile and pass tests
-
-If the pull-request fails one of these tests, it will show up as a red X and
-you are expected to fix the problem. If you do not understand when the issue is
-or have other problems to fix the complaint, just ask and other project
-members will likely be able to help out.
-
-Consider the following table while looking at pull request failures:
-
- | CI platform as shown in PR          | State  | What to look at next       |
- | ----------------------------------- | ------ | -------------------------- |
- | CI / codeql                         | stable | quality check results      |
- | CI / fuzzing                        | stable | fuzzing results            |
- | CI / macos ...                      | stable | all errors and failures    |
- | Code scanning results / CodeQL      | stable | quality check results      |
- | FreeBSD FreeBSD: ...                | stable | all errors and failures    |
- | LGTM analysis: Python               | stable | new findings               |
- | LGTM analysis:  C/C++               | stable | new findings               |
- | buildbot/curl_winssl_ ...           | stable | all errors and failures    |
- | AppVeyor                            | flaky  | all errors and failures    |
- | curl.curl (linux ...)               | stable | all errors and failures    |
- | curl.curl (windows ...)             | flaky  | repetitive errors/failures |
- | CodeQL                              | stable | new findings               |
-
-Sometimes the tests fail due to a dependency service temporarily being offline
-or otherwise unavailable, for example package downloads. In this case you can
-just try to update your pull requests to rerun the tests later as described
-below.
-
-## CI servers
-
-Here are the different CI environments that are currently in use, and how they
-are configured:
-
-### GitHub Actions
-
-GitHub Actions runs the following tests:
-
-- Mac OS tests with a variety of different compilation options
-- Fuzz tests ([see the curl-fuzzer repo for more
-  info](https://github.com/curl/curl-fuzzer)).
-- Curl compiled using the Rust TLS backend with Hyper
-- CodeQL static analysis
-
-These are each configured in different files in `.github/workflows`.
-
-### Azure
-
-The following tests are run in Microsoft Azure CI environment:
-
-- Ubuntu tests with a variety of different compilation options.
-- Windows tests with a variety of different compilation options.
-
-These are all configured in `.azure-pipelines.yml`.
-
-As of November 2021 `@bagder` and `@mback2k` are the only people with
-administrator access to the Azure CI environment. Additional admins/group
-members can be added on request.
-
-### AppVeyor
-
-AppVeyor runs a variety of different Windows builds, with different compilation
-options.
-
-As of November 2021 `@bagder`, `@mback2k`, `@jay`, `@vszakats`, `@dfandrich`
-and `@danielgustafsson` have administrator access to the AppVeyor CI
-environment.  Additional admins/group members can be added on request.
-
-The tests are configured in `appveyor.yml`.
-
-### Zuul
-
-Not used anymore.
-
-### Circle CI
-
-Circle CI runs a basic Linux test suite on Ubuntu for both x86 and ARM
-processors. This is configured in `.circleci/config.yml`.
-
-You can [view the full list of CI jobs on Circle CI's
-website](https://app.circleci.com/pipelines/github/curl/curl).
-
-`@bagder` has access to edit the "Project Settings" on that page. Additional
-admins/group members can be added on request.
-
-### Cirrus CI
-
-Cirrus CI runs a basic test suite on FreeBSD and Windows. This is configured in
-`.cirrus.yml`.
-
-You can [view the full list of CI jobs on Cirrus CI's
-website](https://cirrus-ci.com/github/curl/curl).
-
-`@bagder` has access to edit the "Project Settings" on that page. Additional
-admins/group members can be added on request.
diff --git a/third-party/curl/tests/CMakeLists.txt b/third-party/curl/tests/CMakeLists.txt
index 20bb533671..6de7f96d0a 100644
--- a/third-party/curl/tests/CMakeLists.txt
+++ b/third-party/curl/tests/CMakeLists.txt
@@ -21,35 +21,132 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-set(CMAKE_UNITY_BUILD OFF)
+find_program(TEST_NGHTTPX "nghttpx")
+if(NOT TEST_NGHTTPX)
+  set(TEST_NGHTTPX "")
+endif()
+mark_as_advanced(TEST_NGHTTPX)
+# Consumed variables: TEST_NGHTTPX
+configure_file("config.in" "${CMAKE_CURRENT_BINARY_DIR}/config" @ONLY)
+
+add_custom_target(tt)
+if(BUILD_CURL_EXE)
+  add_dependencies(tt "curlinfo")
+endif()
+if(CURL_BUILD_EVERYTHING)
+  set_target_properties(tt PROPERTIES EXCLUDE_FROM_ALL FALSE)
+endif()
+
+if(CURL_CLANG_TIDY)
+  add_custom_target(tests-clang-tidy)
+  add_dependencies(tt tests-clang-tidy)
+endif()
+if(CURL_ANALYZER_CFLAGS)
+  set_property(DIRECTORY APPEND PROPERTY COMPILE_OPTIONS ${CURL_ANALYZER_CFLAGS})
+endif()
 
 add_custom_target(testdeps)
-add_subdirectory(data)
-add_subdirectory(libtest)
-add_subdirectory(server)
-add_subdirectory(unit)
+add_dependencies(testdeps "tt")
 
-function(add_runtests targetname test_flags)
-  # Use a special '$TFLAGS' placeholder as last argument which will be
-  # replaced by the contents of the environment variable in runtests.pl.
+add_subdirectory(http)
+add_subdirectory(server)
+add_subdirectory(libtest)
+add_subdirectory(tunit)
+add_subdirectory(unit)
+add_subdirectory(certs)
+
+# Add a runtests target with customized flags
+function(curl_add_runtests _targetname _test_flags)
+  if(NOT BUILD_LIBCURL_DOCS)
+    string(APPEND _test_flags " !documentation")
+  endif()
+  set(_depends "")
+  # Skip walking through dependent targets before running tests in CI.
+  # This avoids: GNU Make doing a slow re-evaluation of all targets and
+  # skipping them, MSBuild doing a re-evaluation, and actually rebuilding them.
+  if(NOT _targetname STREQUAL "test-ci")
+    if(BUILD_CURL_EXE)
+      list(APPEND _depends "${EXE_NAME}")
+    endif()
+    list(APPEND _depends "testdeps")
+  endif()
+  set(_setenvs "")
+  if(CMAKE_CONFIGURATION_TYPES)
+    list(APPEND _setenvs "CURL_DIRSUFFIX=$<CONFIG>")
+  endif()
+  if(WIN32 AND NOT CMAKE_HOST_WIN32)
+    list(APPEND _setenvs "CURL_TEST_EXE_EXT_SRV=${CMAKE_EXECUTABLE_SUFFIX}")  # .exe
+    list(APPEND _setenvs "CURL_TEST_EXE_EXT_TOOL=${CMAKE_EXECUTABLE_SUFFIX}")  # .exe
+    list(APPEND _setenvs "CURL_TEST_EXE_RUNNER=wine")
+  endif()
+  if(_setenvs)
+    set(_setenvs "${CMAKE_COMMAND}" -E env ${_setenvs})
+  endif()
+  # Use a special '$TFLAGS' placeholder as last argument which is replaced
+  # by the contents of the environment variable in runtests.pl.
   # This is a workaround for CMake's limitation where commands executed by
   # 'make' or 'ninja' cannot portably reference environment variables.
-  string(REPLACE " " ";" test_flags_list "${test_flags}")
-  add_custom_target(${targetname}
+  string(REPLACE " " ";" _test_flags_list "${_test_flags}")
+  add_custom_target(${_targetname}
     COMMAND
+      ${_setenvs}
       "${PERL_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/runtests.pl"
-      ${test_flags_list}
-      "\$TFLAGS"
-    DEPENDS testdeps
+        ${_test_flags_list}
+        "\$TFLAGS"
+    DEPENDS "${_depends}"
     VERBATIM USES_TERMINAL
   )
 endfunction()
 
-add_runtests(test-quiet     "-a -s")
-add_runtests(test-am        "-a -am")
-add_runtests(test-full      "-a -p -r")
-# !flaky means that it'll skip all tests using the flaky keyword
-add_runtests(test-nonflaky  "-a -p !flaky")
-add_runtests(test-ci        "-a -p !flaky -r -rm")
-add_runtests(test-torture   "-a -t")
-add_runtests(test-event     "-a -e")
+# Add a pytests target with customized flags
+function(curl_add_pytests _targetname _test_flags)
+  set(_depends "")
+  if(NOT _targetname STREQUAL "pytest-ci")
+    if(BUILD_CURL_EXE)
+      list(APPEND _depends "${EXE_NAME}" "curlinfo")
+    endif()
+    list(APPEND _depends "libtests")
+    list(APPEND _depends "build-certs")
+  endif()
+  string(REPLACE " " ";" _test_flags_list "${_test_flags}")
+  add_custom_target(${_targetname}
+    COMMAND pytest ${_test_flags_list} "${CMAKE_CURRENT_SOURCE_DIR}/http${_CURL_PYTEST}"
+    DEPENDS "${_depends}"
+    VERBATIM USES_TERMINAL
+  )
+endfunction()
+
+# Create configurehelp.pm, used by tests needing to run the C preprocessor.
+if(MSVC OR CMAKE_C_COMPILER_ID STREQUAL "GNU" OR CMAKE_C_COMPILER_ID MATCHES "Clang")
+  set(CURL_CPP "\"${CMAKE_C_COMPILER}\" -E")
+  if(APPLE AND CMAKE_OSX_SYSROOT)
+    string(APPEND CURL_CPP " -isysroot ${CMAKE_OSX_SYSROOT}")
+  endif()
+  string(APPEND CURL_CPP " ${CMAKE_C_FLAGS}")
+  # Add header directories, like autotools builds do.
+  get_property(_include_dirs TARGET ${LIB_SELECTED} PROPERTY INCLUDE_DIRECTORIES)
+  foreach(_include_dir IN LISTS _include_dirs)
+    string(APPEND CURL_CPP " -I${_include_dir}")
+  endforeach()
+else()
+  set(CURL_CPP "cpp")
+endif()
+# Generate version script for the linker, for versioned symbols.
+# Consumed variable:
+#   CURL_CPP
+configure_file(
+  "${CMAKE_CURRENT_SOURCE_DIR}/configurehelp.pm.in"
+  "${CMAKE_CURRENT_BINARY_DIR}/configurehelp.pm" @ONLY)
+
+curl_add_runtests(tests          "-a")  # Avoid 'test', which is a reserved target name in CMake
+curl_add_runtests(test-quiet     "-a -s")
+curl_add_runtests(test-am        "-a -am")
+curl_add_runtests(test-full      "-a -p -r")
+# ~flaky means that it ignores results of tests using the flaky keyword
+curl_add_runtests(test-nonflaky  "-a -p ~flaky ~timing-dependent")
+curl_add_runtests(test-ci        "-a -p ~flaky ~timing-dependent -r --retry=5 -j20 --buildinfo")
+curl_add_runtests(test-torture   "-a -t -j20")
+curl_add_runtests(test-event     "-a -e")
+
+curl_add_pytests(curl-pytest      "-n auto")
+curl_add_pytests(curl-pytest-ci   "-n auto -v")
diff --git a/third-party/curl/tests/FILEFORMAT.md b/third-party/curl/tests/FILEFORMAT.md
deleted file mode 100644
index 57bfb4f5bb..0000000000
--- a/third-party/curl/tests/FILEFORMAT.md
+++ /dev/null
@@ -1,659 +0,0 @@
-<!--
-Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-
-SPDX-License-Identifier: curl
--->
-
-# curl test suite file format
-
-The curl test suite's file format is simple and extendable, closely resembling
-XML. All data for a single test case resides in a single ASCII file. Labels
-mark the beginning and the end of all sections, and each label must be written
-in its own line. Comments are either XML-style (enclosed with `<!--` and
-`-->`) or shell script style (beginning with `#`) and must appear on their own
-lines and not alongside actual test data. Most test data files are
-syntactically valid XML, although a few files are not (lack of support for
-character entities and the preservation of CR/LF characters at the end of
-lines are the biggest differences).
-
-Each test case source exists as a file matching the format
-`tests/data/testNUM`, where `NUM` is the unique test number, and must begin
-with a `testcase` tag, which encompasses the remainder of the file.
-
-# Preprocessing
-
-When a test is to be executed, the source file is first preprocessed and
-variables are substituted by their respective contents and the output
-version of the test file is stored as `%LOGDIR/testNUM`. That version is what
-will be read and used by the test servers.
-
-## Base64 Encoding
-
-In the preprocess stage, a special instruction can be used to have runtests.pl
-base64 encode a certain section and insert in the generated output file. This
-is in particular good for test cases where the test tool is expected to pass
-in base64 encoded content that might use dynamic information that is unique
-for this particular test invocation, like the server port number.
-
-To insert a base64 encoded string into the output, use this syntax:
-
-    %b64[ data to encode ]b64%
-
-The data to encode can then use any of the existing variables mentioned below,
-or even percent-encoded individual bytes. As an example, insert the HTTP
-server's port number (in ASCII) followed by a space and the hexadecimal byte
-9a:
-
-    %b64[%HTTPPORT %9a]b64%
-
-## Hexadecimal decoding
-
-In the preprocess stage, a special instruction can be used to have runtests.pl
-generate a sequence of binary bytes.
-
-To insert a sequence of bytes from a hex encoded string, use this syntax:
-
-    %hex[ %XX-encoded data to decode ]hex%
-
-For example, to insert the binary octets 0, 1 and 255 into the test file:
-
-    %hex[ %00%01%FF ]hex%
-
-## Repeat content
-
-In the preprocess stage, a special instruction can be used to have runtests.pl
-generate a repetitive sequence of bytes.
-
-To insert a sequence of repeat bytes, use this syntax to make the `<string>`
-get repeated `<number>` of times. The number has to be 1 or larger and the
-string may contain `%HH` hexadecimal codes:
-
-    %repeat[<number> x <string>]%
-
-For example, to insert the word hello 100 times:
-
-    %repeat[100 x hello]%
-
-## Conditional lines
-
-Lines in the test file can be made to appear conditionally on a specific
-feature (see the "features" section below) being set or not set. If the
-specific feature is present, the following lines will be output, otherwise it
-outputs nothing, until a following else or `endif` clause. Like this:
-
-    %if brotli
-    Accept-Encoding
-    %endif
-
-It can also check for the inverse condition, so if the feature is *not* set by
-the use of an exclamation mark:
-
-    %if !brotli
-    Accept-Encoding: not-brotli
-    %endif
-
-You can also make an "else" clause to get output for the opposite condition,
-like:
-
-    %if brotli
-    Accept-Encoding: brotli
-    %else
-    Accept-Encoding: nothing
-    %endif
-
-Nested conditions are supported.
-
-# Variables
-
-When the test is preprocessed, a range of "variables" in the test file will be
-replaced by their content at that time.
-
-Available substitute variables include:
-
-- `%CLIENT6IP` - IPv6 address of the client running curl
-- `%CLIENTIP` - IPv4 address of the client running curl
-- `%CURL` - Path to the curl executable
-- `%FILE_PWD` - Current directory, on Windows prefixed with a slash
-- `%FTP6PORT` - IPv6 port number of the FTP server
-- `%FTPPORT` - Port number of the FTP server
-- `%FTPSPORT` - Port number of the FTPS server
-- `%FTPTIME2` - Timeout in seconds that should be just sufficient to receive a
-  response from the test FTP server
-- `%FTPTIME3` - Even longer than `%FTPTIME2`
-- `%GOPHER6PORT` - IPv6 port number of the Gopher server
-- `%GOPHERPORT` - Port number of the Gopher server
-- `%GOPHERSPORT` - Port number of the Gophers server
-- `%HOST6IP` - IPv6 address of the host running this test
-- `%HOSTIP` - IPv4 address of the host running this test
-- `%HTTP6PORT` - IPv6 port number of the HTTP server
-- `%HTTPPORT` - Port number of the HTTP server
-- `%HTTP2PORT` - Port number of the HTTP/2 server
-- `%HTTPSPORT` - Port number of the HTTPS server
-- `%HTTPSPROXYPORT` - Port number of the HTTPS-proxy
-- `%HTTPTLS6PORT` - IPv6 port number of the HTTP TLS server
-- `%HTTPTLSPORT` - Port number of the HTTP TLS server
-- `%HTTPUNIXPATH` - Path to the Unix socket of the HTTP server
-- `%SOCKSUNIXPATH` - Path to the Unix socket of the SOCKS server
-- `%IMAP6PORT` - IPv6 port number of the IMAP server
-- `%IMAPPORT` - Port number of the IMAP server
-- `%LOGDIR` - Log directory relative to %PWD
-- `%MQTTPORT` - Port number of the MQTT server
-- `%TELNETPORT` - Port number of the telnet server
-- `%NOLISTENPORT` - Port number where no service is listening
-- `%POP36PORT` - IPv6 port number of the POP3 server
-- `%POP3PORT` - Port number of the POP3 server
-- `%POSIX_PWD` - Current directory somewhat mingw friendly
-- `%PROXYPORT` - Port number of the HTTP proxy
-- `%PWD` - Current directory
-- `%RTSP6PORT` - IPv6 port number of the RTSP server
-- `%RTSPPORT` - Port number of the RTSP server
-- `%SMBPORT` - Port number of the SMB server
-- `%SMBSPORT` - Port number of the SMBS server
-- `%SMTP6PORT` - IPv6 port number of the SMTP server
-- `%SMTPPORT` - Port number of the SMTP server
-- `%SOCKSPORT` - Port number of the SOCKS4/5 server
-- `%SRCDIR` - Full path to the source dir
-- `%SSHPORT` - Port number of the SCP/SFTP server
-- `%SSHSRVMD5` - MD5 of SSH server's public key
-- `%SSHSRVSHA256` - SHA256 of SSH server's public key
-- `%SSH_PWD` - Current directory friendly for the SSH server
-- `%TESTNUMBER` - Number of the test case
-- `%TFTP6PORT` - IPv6 port number of the TFTP server
-- `%TFTPPORT` - Port number of the TFTP server
-- `%USER` - Login ID of the user running the test
-- `%VERSION` - the full version number of the tested curl
-
-# `<testcase>`
-
-Each test is always specified entirely within the `testcase` tag. Each test
-case is split up in four main sections: `info`, `reply`, `client` and
-`verify`.
-
-- **info** provides information about the test case
-
-- **reply** is used for the server to know what to send as a reply for the
-requests curl sends
-
-- **client** defines how the client should behave
-
-- **verify** defines how to verify that the data stored after a command has
-been run ended up correct
-
-Each main section has a number of available subsections that can be specified,
-that will be checked/used if specified.
-
-## `<info>`
-
-### `<keywords>`
-A newline-separated list of keywords describing what this test case uses and
-tests. Try to use already used keywords. These keywords will be used for
-statistical/informational purposes and for choosing or skipping classes of
-tests. Keywords must begin with an alphabetic character, `-`, `[` or `{` and
-may actually consist of multiple words separated by spaces which are treated
-together as a single identifier.
-
-When using curl built with Hyper, the keywords must include `HTTP` or `HTTPS`
-for 'hyper mode' to kick in and make line ending checks work for tests.
-
-When running a unit test and the keywords include `unittest`, the `<tool>`
-section can be left empty to use the standard unit test tool name `unitN` where
-`N` is the test number.
-
-## `<reply>`
-
-### `<data [nocheck="yes"] [sendzero="yes"] [base64="yes"] [hex="yes"] [nonewline="yes"] [crlf="yes"]>`
-
-data to be sent to the client on its request and later verified that it
-arrived safely. Set `nocheck="yes"` to prevent the test script from verifying
-the arrival of this data.
-
-If the data contains `swsclose` anywhere within the start and end tag, and
-this is an HTTP test, then the connection will be closed by the server after
-this response is sent. If not, the connection will be kept persistent.
-
-If the data contains `swsbounce` anywhere within the start and end tag, the
-HTTP server will detect if this is a second request using the same test and
-part number and will then increase the part number with one. This is useful
-for auth tests and similar.
-
-`sendzero=yes` means that the (FTP) server will "send" the data even if the
-size is zero bytes. Used to verify curl's behavior on zero bytes transfers.
-
-`base64=yes` means that the data provided in the test-file is a chunk of data
-encoded with base64. It is the only way a test case can contain binary
-data. (This attribute can in fact be used on any section, but it doesn't make
-much sense for other sections than "data").
-
-`hex=yes` means that the data is a sequence of hex pairs. It will get decoded
-and used as "raw" data.
-
-`nonewline=yes` means that the last byte (the trailing newline character)
-should be cut off from the data before sending or comparing it.
-
-`crlf=yes` forces *header* newlines to become CRLF even if not written so in
-the source file. Note that this makes runtests.pl parse and "guess" what is a
-header and what is not in order to apply the CRLF line endings appropriately.
-
-For FTP file listings, the `<data>` section will be used *only* if you make
-sure that there has been a CWD done first to a directory named `test-[NUM]`
-where `NUM` is the test case number. Otherwise the ftp server can't know from
-which test file to load the list content.
-
-### `<dataNUM [crlf="yes"]>`
-
-Send back this contents instead of the `<data>` one. The `NUM` is set by:
-
- - The test number in the request line is >10000 and this is the remainder
-   of [test case number]%10000.
- - The request was HTTP and included digest details, which adds 1000 to `NUM`
- - If an HTTP request is NTLM type-1, it adds 1001 to `NUM`
- - If an HTTP request is NTLM type-3, it adds 1002 to `NUM`
- - If an HTTP request is Basic and `NUM` is already >=1000, it adds 1 to `NUM`
- - If an HTTP request is Negotiate, `NUM` gets incremented by one for each
-   request with Negotiate authorization header on the same test case.
-
-Dynamically changing `NUM` in this way allows the test harness to be used to
-test authentication negotiation where several different requests must be sent
-to complete a transfer. The response to each request is found in its own data
-section. Validating the entire negotiation sequence can be done by specifying
-a `datacheck` section.
-
-### `<connect>`
-The connect section is used instead of the 'data' for all CONNECT
-requests. The remainder of the rules for the data section then apply but with
-a connect prefix.
-
-### `<socks>`
-Address type and address details as logged by the SOCKS proxy.
-
-### `<datacheck [mode="text"] [nonewline="yes"] [crlf="yes"]>`
-if the data is sent but this is what should be checked afterwards. If
-`nonewline=yes` is set, runtests will cut off the trailing newline from the
-data before comparing with the one actually received by the client.
-
-Use the `mode="text"` attribute if the output is in text mode on platforms
-that have a text/binary difference.
-
-### `<datacheckNUM [nonewline="yes"] [mode="text"] [crlf="yes"]>`
-The contents of numbered `datacheck` sections are appended to the non-numbered
-one.
-
-### `<size>`
-number to return on a ftp SIZE command (set to -1 to make this command fail)
-
-### `<mdtm>`
-what to send back if the client sends a (FTP) `MDTM` command, set to -1 to
-have it return that the file doesn't exist
-
-### `<postcmd>`
-special purpose server-command to control its behavior *after* the
-reply is sent
-For HTTP/HTTPS, these are supported:
-
-`wait [secs]` - Pause for the given time
-
-### `<servercmd>`
-Special-commands for the server.
-
-The first line of this file will always be set to `Testnum [number]` by the
-test script, to allow servers to read that to know what test the client is
-about to issue.
-
-#### For FTP/SMTP/POP/IMAP
-
-- `REPLY [command] [return value] [response string]` - Changes how the server
-  responds to the [command]. [response string] is evaluated as a perl string,
-  so it can contain embedded \r\n, for example. There's a special [command]
-  named "welcome" (without quotes) which is the string sent immediately on
-  connect as a welcome.
-- `REPLYLF` (like above but sends the response terminated with LF-only and not
-   CRLF)
-- `COUNT [command] [num]` - Do the `REPLY` change for `[command]` only `[num]`
-  times and then go back to the built-in approach
-- `DELAY [command] [secs]` - Delay responding to this command for the given
-  time
-- `RETRWEIRDO` - Enable the "weirdo" RETR case when multiple response lines
-   appear at once when a file is transferred
-- `RETRNOSIZE` - Make sure the RETR response doesn't contain the size of the
-  file
-- `RETRSIZE [size]` - Force RETR response to contain the specified size
-- `NOSAVE` - Don't actually save what is received
-- `SLOWDOWN` - Send FTP responses with 0.01 sec delay between each byte
-- `PASVBADIP` - makes PASV send back an illegal IP in its 227 response
-- `CAPA [capabilities]` - Enables support for and specifies a list of space
-   separated capabilities to return to the client for the IMAP `CAPABILITY`,
-   POP3 `CAPA` and SMTP `EHLO` commands
-- `AUTH [mechanisms]` - Enables support for SASL authentication and specifies
-   a list of space separated mechanisms for IMAP, POP3 and SMTP
-- `STOR [msg]` respond with this instead of default after `STOR`
-
-#### For HTTP/HTTPS
-
-- `auth_required` if this is set and a POST/PUT is made without auth, the
-  server will NOT wait for the full request body to get sent
-- `delay: [msecs]` - delay this amount after connection
-- `idle` - do nothing after receiving the request, just "sit idle"
-- `stream` - continuously send data to the client, never-ending
-- `writedelay: [msecs]` delay this amount between reply packets
-- `skip: [num]` - instructs the server to ignore reading this many bytes from
-  a PUT or POST request
-- `rtp: part [num] channel [num] size [num]` - stream a fake RTP packet for
-  the given part on a chosen channel with the given payload size
-- `connection-monitor` - When used, this will log `[DISCONNECT]` to the
-  `server.input` log when the connection is disconnected.
-- `upgrade` - when an HTTP upgrade header is found, the server will upgrade to
-  http2
-- `swsclose` - instruct server to close connection after response
-- `no-expect` - don't read the request body if Expect: is present
-
-#### For TFTP
-`writedelay: [secs]` delay this amount between reply packets (each packet
-  being 512 bytes payload)
-
-## `<client>`
-
-### `<server>`
-What server(s) this test case requires/uses. Available servers:
-
-- `dict`
-- `file`
-- `ftp`
-- `ftp-ipv6`
-- `ftps`
-- `gopher`
-- `gopher-ipv6`
-- `gophers`
-- `http`
-- `http/2`
-- `http-ipv6`
-- `http-proxy`
-- `https`
-- `https-proxy`
-- `httptls+srp`
-- `httptls+srp-ipv6`
-- `http-unix`
-- `imap`
-- `mqtt`
-- `none`
-- `pop3`
-- `rtsp`
-- `rtsp-ipv6`
-- `scp`
-- `sftp`
-- `smb`
-- `smtp`
-- `socks4`
-- `socks5`
-- `socks5unix`
-- `telnet`
-- `tftp`
-
-Give only one per line. This subsection is mandatory (use `none` if no servers
-are required). Servers that require a special server certificate can have the
-PEM certificate file name (found in the `certs` directory) appended to the
-server name separated by a space.
-
-### `<features>`
-A list of features that MUST be present in the client/library for this test to
-be able to run. If a required feature is not present then the test will be
-SKIPPED.
-
-Alternatively a feature can be prefixed with an exclamation mark to indicate a
-feature is NOT required. If the feature is present then the test will be
-SKIPPED.
-
-Features testable here are:
-
-- `alt-svc`
-- `bearssl`
-- `brotli`
-- `c-ares`
-- `CharConv`
-- `cookies`
-- `crypto`
-- `debug`
-- `DoH`
-- `getrlimit`
-- `GnuTLS`
-- `GSS-API`
-- `h2c`
-- `headers-api`
-- `HSTS`
-- `HTTP-auth`
-- `http/2`
-- `http/3`
-- `https-proxy`
-- `hyper`
-- `idn`
-- `ipv6`
-- `Kerberos`
-- `large_file`
-- `large-time` (time_t is larger than 32 bit)
-- `ld_preload`
-- `libssh2`
-- `libssh`
-- `oldlibssh` (versions before 0.9.4)
-- `libz`
-- `manual`
-- `mbedtls`
-- `Mime`
-- `netrc`
-- `nghttpx`
-- `nghttpx-h3`
-- `NTLM`
-- `NTLM_WB`
-- `OpenSSL`
-- `parsedate`
-- `proxy`
-- `PSL`
-- `rustls`
-- `Schannel`
-- `sectransp`
-- `shuffle-dns`
-- `socks`
-- `SPNEGO`
-- `SSL`
-- `SSLpinning`
-- `SSPI`
-- `threaded-resolver`
-- `TLS-SRP`
-- `TrackMemory`
-- `typecheck`
-- `threadsafe`
-- `Unicode`
-- `unittest`
-- `unix-sockets`
-- `verbose-strings`
-- `wakeup`
-- `win32`
-- `wolfssh`
-- `wolfssl`
-- `xattr`
-- `zstd`
-
-as well as each protocol that curl supports. A protocol only needs to be
-specified if it is different from the server (useful when the server is
-`none`).
-
-### `<killserver>`
-Using the same syntax as in `<server>` but when mentioned here these servers
-are explicitly KILLED when this test case is completed. Only use this if there
-is no other alternatives. Using this of course requires subsequent tests to
-restart servers.
-
-### `<precheck>`
-A command line that if set gets run by the test script before the test. If an
-output is displayed by the command or if the return code is non-zero, the test
-will be skipped and the (single-line) output will be displayed as reason for
-not running the test.
-
-### `<postcheck>`
-A command line that if set gets run by the test script after the test. If
-the command exists with a non-zero status code, the test will be considered
-to have failed.
-
-### `<tool>`
-Name of tool to invoke instead of "curl". This tool must be built and exist
-either in the `libtest/` directory (if the tool name starts with `lib`) or in
-the `unit/` directory (if the tool name starts with `unit`).
-
-### `<name>`
-Brief test case description, shown when the test runs.
-
-### `<setenv>`
-    variable1=contents1
-    variable2=contents2
-
-Set the given environment variables to the specified value before the actual
-command is run. They are cleared again after the command has been run.
-
-### `<command [option="no-output/no-include/force-output/binary-trace"] [timeout="secs"][delay="secs"][type="perl/shell"]>`
-Command line to run.
-
-Note that the URL that gets passed to the server actually controls what data
-that is returned. The last slash in the URL must be followed by a number. That
-number (N) will be used by the test-server to load test case N and return the
-data that is defined within the `<reply><data></data></reply>` section.
-
-If there's no test number found above, the HTTP test server will use the
-number following the last dot in the given hostname (made so that a CONNECT
-can still pass on test number) so that "foo.bar.123" gets treated as test case
-123. Alternatively, if an IPv6 address is provided to CONNECT, the last
-hexadecimal group in the address will be used as the test number! For example
-the address "[1234::ff]" would be treated as test case 255.
-
-Set `type="perl"` to write the test case as a perl script. It implies that
-there's no memory debugging and valgrind gets shut off for this test.
-
-Set `type="shell"` to write the test case as a shell script. It implies that
-there's no memory debugging and valgrind gets shut off for this test.
-
-Set `option="no-output"` to prevent the test script to slap on the `--output`
-argument that directs the output to a file. The `--output` is also not added
-if the verify/stdout section is used.
-
-Set `option="force-output"` to make use of `--output` even when the test is
-otherwise written to verify stdout.
-
-Set `option="no-include"` to prevent the test script to slap on the
-`--include` argument.
-
-Set `option="binary-trace"` to use `--trace` instead of `--trace-ascii` for
-tracing. Suitable for binary-oriented protocols such as MQTT.
-
-Set `timeout="secs"` to override default server logs advisor read lock
-timeout. This timeout is used by the test harness, once that the command has
-completed execution, to wait for the test server to write out server side log
-files and remove the lock that advised not to read them. The "secs" parameter
-is the not negative integer number of seconds for the timeout. This `timeout`
-attribute is documented for completeness sake, but is deep test harness stuff
-and only needed for singular and specific test cases. Avoid using it.
-
-Set `delay="secs"` to introduce a time delay once that the command has
-completed execution and before the `<postcheck>` section runs. The "secs"
-parameter is the not negative integer number of seconds for the delay. This
-'delay' attribute is intended for specific test cases, and normally not
-needed.
-
-### `<file name="%LOGDIR/filename" [nonewline="yes"]>`
-This creates the named file with this content before the test case is run,
-which is useful if the test case needs a file to act on.
-
-If `nonewline="yes"` is used, the created file will have the final newline
-stripped off.
-
-### `<stdin [nonewline="yes"]>`
-Pass this given data on stdin to the tool.
-
-If `nonewline` is set, we will cut off the trailing newline of this given data
-before comparing with the one actually received by the client
-
-## `<verify>`
-### `<errorcode>`
-numerical error code curl is supposed to return. Specify a list of accepted
-error codes by separating multiple numbers with comma. See test 237 for an
-example.
-
-### `<strip>`
-One regex per line that is removed from the protocol dumps before the
-comparison is made. This is useful to remove dependencies on dynamically
-changing protocol data such as port numbers or user-agent strings.
-
-### `<strippart>`
-One perl op per line that operates on the protocol dump. This is pretty
-advanced. Example: `s/^EPRT .*/EPRT stripped/`.
-
-### `<protocol [nonewline="yes"][crlf="yes"]>`
-
-the protocol dump curl should transmit, if `nonewline` is set, we will cut off
-the trailing newline of this given data before comparing with the one actually
-sent by the client The `<strip>` and `<strippart>` rules are applied before
-comparisons are made.
-
-`crlf=yes` forces the newlines to become CRLF even if not written so in the
-test.
-
-### `<proxy [nonewline="yes"][crlf="yes"]>`
-
-The protocol dump curl should transmit to an HTTP proxy (when the http-proxy
-server is used), if `nonewline` is set, we will cut off the trailing newline
-of this given data before comparing with the one actually sent by the client
-The `<strip>` and `<strippart>` rules are applied before comparisons are made.
-
-### `<stderr [mode="text"] [nonewline="yes"]>`
-This verifies that this data was passed to stderr.
-
-Use the mode="text" attribute if the output is in text mode on platforms that
-have a text/binary difference.
-
-If `nonewline` is set, we will cut off the trailing newline of this given data
-before comparing with the one actually received by the client
-
-### `<stdout [mode="text"] [nonewline="yes"] [crlf="yes"] [loadfile="filename"]>`
-This verifies that this data was passed to stdout.
-
-Use the mode="text" attribute if the output is in text mode on platforms that
-have a text/binary difference.
-
-If `nonewline` is set, we will cut off the trailing newline of this given data
-before comparing with the one actually received by the client
-
-`crlf=yes` forces the newlines to become CRLF even if not written so in the
-test.
-
-`loadfile="filename"` makes loading the data from an external file.
-
-### `<file name="%LOGDIR/filename" [mode="text"]>`
-The file's contents must be identical to this after the test is complete. Use
-the mode="text" attribute if the output is in text mode on platforms that have
-a text/binary difference.
-
-### `<file1>`
-1 to 4 can be appended to 'file' to compare more files.
-
-### `<file2>`
-
-### `<file3>`
-
-### `<file4>`
-
-### `<stripfile>`
-One perl op per line that operates on the output file or stdout before being
-compared with what is stored in the test file. This is pretty
-advanced. Example: "s/^EPRT .*/EPRT stripped/"
-
-### `<stripfile1>`
-1 to 4 can be appended to `stripfile` to strip the corresponding `<fileN>`
-content
-
-### `<stripfile2>`
-
-### `<stripfile3>`
-
-### `<stripfile4>`
-
-### `<upload>`
-the contents of the upload data curl should have sent
-
-### `<valgrind>`
-disable - disables the valgrind log check for this test
diff --git a/third-party/curl/tests/Makefile.am b/third-party/curl/tests/Makefile.am
index 55d551f1a6..a77c6259eb 100644
--- a/third-party/curl/tests/Makefile.am
+++ b/third-party/curl/tests/Makefile.am
@@ -22,31 +22,77 @@
 #
 ###########################################################################
 
-HTMLPAGES = testcurl.html runtests.html
-PDFPAGES = testcurl.pdf runtests.pdf
-MANDISTPAGES = runtests.1.dist testcurl.1.dist
+# scripts used in test cases
+TESTSCRIPTS = \
+  test1119.pl \
+  test1135.pl \
+  test1139.pl \
+  test1140.pl \
+  test1165.pl \
+  test1167.pl \
+  test1173.pl \
+  test1175.pl \
+  test1177.pl \
+  test1222.pl \
+  test1275.pl \
+  test1276.pl \
+  test1477.pl \
+  test1486.pl \
+  test1488.pl \
+  test1544.pl \
+  test1707.pl \
+  test745.pl  \
+  test971.pl
 
-EXTRA_DIST = appveyor.pm azure.pm badsymbols.pl check-deprecated.pl CMakeLists.txt \
- devtest.pl dictserver.py directories.pm disable-scan.pl error-codes.pl extern-scan.pl FILEFORMAT.md \
- processhelp.pm ftpserver.pl getpart.pm globalconfig.pm http-server.pl http2-server.pl \
- http3-server.pl manpage-scan.pl manpage-syntax.pl markdown-uppercase.pl mem-include-scan.pl \
- memanalyze.pl negtelnetserver.py nroff-scan.pl option-check.pl options-scan.pl \
- pathhelp.pm README.md rtspserver.pl runner.pm runtests.1 runtests.pl secureserver.pl \
- serverhelp.pm servers.pm smbserver.py sshhelp.pm sshserver.pl stunnel.pem symbol-scan.pl \
- testcurl.1 testcurl.pl testutil.pm tftpserver.pl util.py valgrind.pm \
- valgrind.supp version-scan.pl check-translatable-options.pl
+EXTRA_DIST =         \
+  CMakeLists.txt     \
+  allversions.pm     \
+  appveyor.pm        \
+  azure.pm           \
+  devtest.pl         \
+  dictserver.py      \
+  directories.pm     \
+  ech_combos.py      \
+  ech_tests.sh       \
+  ftpserver.pl       \
+  getpart.pm         \
+  globalconfig.pm    \
+  http-server.pl     \
+  http2-server.pl    \
+  http3-server.pl    \
+  memanalyze.pl      \
+  memanalyzer.pm     \
+  negtelnetserver.py \
+  nghttpx.conf       \
+  pathhelp.pm        \
+  processhelp.pm     \
+  requirements.txt   \
+  rtspserver.pl      \
+  runner.pm          \
+  runtests.pl        \
+  secureserver.pl    \
+  serverhelp.pm      \
+  servers.pm         \
+  smbserver.py       \
+  sshhelp.pm         \
+  sshserver.pl       \
+  testcurl.pl        \
+  testutil.pm        \
+  tftpserver.pl      \
+  util.py            \
+  valgrind.pm        \
+  valgrind.supp      \
+  $(TESTSCRIPTS)
 
-DISTCLEANFILES = configurehelp.pm
-
-# we have two variables here to make sure DIST_SUBDIRS won't get 'unit'
+# we have two variables here to make sure DIST_SUBDIRS does not get 'unit'
 # added twice as then targets such as 'distclean' misbehave and try to
 # do things twice in that subdir at times (and thus fails).
 if BUILD_UNITTESTS
-BUILD_UNIT = unit
+BUILD_UNIT = unit tunit
 DIST_UNIT =
 else
 BUILD_UNIT =
-DIST_UNIT = unit
+DIST_UNIT = unit tunit
 endif
 
 SUBDIRS = certs data server libtest http $(BUILD_UNIT)
@@ -54,33 +100,49 @@ DIST_SUBDIRS = $(SUBDIRS) $(DIST_UNIT)
 
 PERLFLAGS = -I$(srcdir)
 
-CLEANFILES = .http.pid .https.pid .ftp.pid .ftps.pid $(MANDISTPAGES)
-
-MAN2HTML= roffit $< >$@
+CLEANFILES = .http.pid .https.pid .ftp.pid .ftps.pid
 
 curl:
 	@cd $(top_builddir) && $(MAKE)
 
+TEST_COMMON =
+
 if CROSSCOMPILING
-TEST = @echo "NOTICE: we can't run the tests when cross-compiling!"
+TEST = @echo "NOTICE: we cannot run the tests when cross-compiling!"
+PYTEST = $(TEST)
 else # if not cross-compiling:
-TEST = srcdir=$(srcdir) $(PERL) $(PERLFLAGS) $(srcdir)/runtests.pl
+
+if BUILD_DOCS
+else
+TEST_COMMON += !documentation
+endif
+
+TEST = srcdir=$(srcdir) @PERL@ $(PERLFLAGS) $(srcdir)/runtests.pl $(TEST_COMMON)
 TEST_Q = -a -s
 TEST_AM = -a -am
 TEST_F = -a -p -r
-TEST_T = -a -t
+TEST_T = -a -t -j20
 TEST_E = -a -e
 
-# !flaky means that it'll skip all tests using the flaky keyword
-TEST_NF = -a -p !flaky
+# ~<keyword> means that it runs all tests matching the keyword, but ignores
+# their results (since these ones are likely to fail for no good reason)
+TEST_NF = -a -p ~flaky ~timing-dependent
 
-# special CI target derived from nonflaky with CI-specific flags
-TEST_CI = $(TEST_NF) -rm
+# special target for CI use
+TEST_CI = $(TEST_NF) -r --retry=5 -j20 --buildinfo
+
+PYTEST = pytest
 endif
 
 # make sure that PERL is pointing to an executable
 perlcheck:
-	@if ! test -x "$(PERL)"; then echo "No perl!"; exit 2; fi
+	@if ! test -x "@PERL@"; then echo "No perl!"; exit 2; fi
+
+build-certs: perlcheck
+	(cd certs && $(MAKE))
+
+# alias for 'test' to match CMake, where 'test' is a reserved target
+tests: test
 
 test: perlcheck all
 	$(TEST) $(TFLAGS)
@@ -106,23 +168,18 @@ torture-test: perlcheck all
 event-test: perlcheck all
 	$(TEST) $(TEST_E) $(TFLAGS)
 
-.1.html:
-	$(MAN2HTML)
+default-pytest: ci-pytest
 
-.1.pdf:
-	@(foo=`echo $@ | sed -e 's/\.[0-9]$$//g'`; \
-	groff -Tps -man $< >$$foo.ps; \
-	ps2pdf $$foo.ps $@; \
-	rm $$foo.ps; \
-	echo "converted $< to $@")
+ci-pytest: all
+	srcdir=$(srcdir) $(PYTEST) -n auto -v $(srcdir)/http
 
 checksrc:
 	(cd libtest && $(MAKE) checksrc)
 	(cd unit && $(MAKE) checksrc)
+	(cd tunit && $(MAKE) checksrc)
 	(cd server && $(MAKE) checksrc)
-	(cd http && $(MAKE) checksrc)
 
-if CURLDEBUG
-# for debug builds, we scan the sources on all regular make invokes
-all-local: checksrc
-endif
+all-local: $(MANFILES) build-certs
+
+distclean:
+	rm -f $(MANFILES)
diff --git a/third-party/curl/tests/README.md b/third-party/curl/tests/README.md
deleted file mode 100644
index 65af2a0bd9..0000000000
--- a/third-party/curl/tests/README.md
+++ /dev/null
@@ -1,269 +0,0 @@
-<!--
-Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-
-SPDX-License-Identifier: curl
--->
-
-# The curl Test Suite
-
-# Running
-
-## Requires to run
-
-  - perl (and a unix-style shell)
-  - python (and a unix-style shell, for SMB and TELNET tests)
-  - python-impacket (for SMB tests)
-  - diff (when a test fails, a diff is shown)
-  - stunnel (for HTTPS and FTPS tests)
-  - OpenSSH or SunSSH (for SCP, SFTP and SOCKS4/5 tests)
-  - nghttpx (for HTTP/2 and HTTP/3 tests)
-  - nroff (for --manual tests)
-  - An available `en_US.UTF-8` locale
-
-### Installation of python-impacket
-
-  The Python-based test servers support both recent Python 2 and 3.
-  You can figure out your default Python interpreter with python -V
-
-  Please install python-impacket in the correct Python environment.
-  You can use pip or your OS' package manager to install 'impacket'.
-
-  On Debian/Ubuntu the package names are:
-
-  -  Python 2: 'python-impacket'
-  -  Python 3: 'python3-impacket'
-
-  On FreeBSD the package names are:
-
-  -  Python 2: 'py27-impacket'
-  -  Python 3: 'py37-impacket'
-
-  On any system where pip is available:
-
-  -  Python 2: 'pip2 install impacket'
-  -  Python 3: 'pip3 install impacket'
-
-  You may also need to manually install the Python package 'six'
-  as that may be a missing requirement for impacket on Python 3.
-
-### Port numbers used by test servers
-
-  All test servers run on "random" port numbers. All tests should be written
-  to use suitable variables instead of fixed port numbers so that test cases
-  continue to work independent on what port numbers the test servers actually
-  use.
-
-  See [`FILEFORMAT`](FILEFORMAT.md) for the port number variables.
-
-### Test servers
-
-  The test suite runs stand-alone servers on random ports to which it makes
-  requests. For SSL tests, it runs stunnel to handle encryption to the regular
-  servers. For SSH, it runs a standard OpenSSH server. For SOCKS4/5 tests SSH
-  is used to perform the SOCKS functionality and requires a SSH client and
-  server.
-
-  The listen port numbers for the test servers are picked randomly to allow
-  users to run multiple test cases concurrently and to not collide with other
-  existing services that might listen to ports on the machine.
-
-  The HTTP server supports listening on a Unix domain socket, the default
-  location is 'http.sock'.
-
-  For HTTP/2 and HTTP/3 testing an installed `nghttpx` is used. HTTP/3
-  tests check if nghttpx supports the protocol. To override the nghttpx
-  used, set the environment variable `NGHTTPX`. The default can also be
-  changed by specifying `--with-test-nghttpx=<path>` as argument to `configure`.
-
-### Run
-
-  `./configure && make && make test`. This builds the test suite support code
-  and invokes the 'runtests.pl' perl script to run all the tests. Edit the top
-  variables of that script in case you have some specific needs, or run the
-  script manually (after the support code has been built).
-
-  The script breaks on the first test that doesn't do OK. Use `-a` to prevent
-  the script from aborting on the first error. Run the script with `-v` for
-  more verbose output. Use `-d` to run the test servers with debug output
-  enabled as well. Specifying `-k` keeps all the log files generated by the
-  test intact.
-
-  Use `-s` for shorter output, or pass test numbers to run specific tests only
-  (like `./runtests.pl 3 4` to test 3 and 4 only). It also supports test case
-  ranges with 'to', as in `./runtests.pl 3 to 9` which runs the seven tests
-  from 3 to 9. Any test numbers starting with ! are disabled, as are any test
-  numbers found in the files `data/DISABLED` or `data/DISABLED.local` (one per
-  line). The latter is meant for local temporary disables and will be ignored
-  by git.
-
-  Test cases mentioned in `DISABLED` can still be run if `-f` is provided.
-
-  When `-s` is not present, each successful test will display on one line the
-  test number and description and on the next line a set of flags, the test
-  result, current test sequence, total number of tests to be run and an
-  estimated amount of time to complete the test run. The flags consist of
-  these letters describing what is checked in this test:
-
-    s stdout
-    d data
-    u upload
-    p protocol
-    o output
-    e exit code
-    m memory
-    v valgrind
-
-### Shell startup scripts
-
-  Tests which use the ssh test server, SCP/SFTP/SOCKS tests, might be badly
-  influenced by the output of system wide or user specific shell startup
-  scripts, .bashrc, .profile, /etc/csh.cshrc, .login, /etc/bashrc, etc. which
-  output text messages or escape sequences on user login. When these shell
-  startup messages or escape sequences are output they might corrupt the
-  expected stream of data which flows to the sftp-server or from the ssh
-  client which can result in bad test behavior or even prevent the test server
-  from running.
-
-  If the test suite ssh or sftp server fails to start up and logs the message
-  'Received message too long' then you are certainly suffering the unwanted
-  output of a shell startup script. Locate, cleanup or adjust the shell
-  script.
-
-### Memory test
-
-  The test script will check that all allocated memory is freed properly IF
-  curl has been built with the `CURLDEBUG` define set. The script will
-  automatically detect if that is the case, and it will use the
-  `memanalyze.pl` script to analyze the memory debugging output.
-
-  Also, if you run tests on a machine where valgrind is found, the script will
-  use valgrind to run the test with (unless you use `-n`) to further verify
-  correctness.
-
-  The `runtests.pl` `-t` option enables torture testing mode. It runs each
-  test many times and makes each different memory allocation fail on each
-  successive run. This tests the out of memory error handling code to ensure
-  that memory leaks do not occur even in those situations. It can help to
-  compile curl with `CPPFLAGS=-DMEMDEBUG_LOG_SYNC` when using this option, to
-  ensure that the memory log file is properly written even if curl crashes.
-
-### Debug
-
-  If a test case fails, you can conveniently get the script to invoke the
-  debugger (gdb) for you with the server running and the same command line
-  parameters that failed. Just invoke `runtests.pl <test number> -g` and then
-  just type 'run' in the debugger to perform the command through the debugger.
-
-### Logs
-
-  All logs are generated in the log/ subdirectory (it is emptied first in the
-  runtests.pl script). They remain in there after a test run.
-
-### Log Verbosity
-
-  A curl build with `--enable-debug` offers more verbose output in the logs.
-  This applies not only for test cases, but also when running it standalone
-  with `curl -v`. While a curl debug built is
-  ***not suitable for production***, it is often helpful in tracking down
-  problems.
-
-  Sometimes, one needs detailed logging of operations, but does not want
-  to drown in output. The newly introduced *connection filters* allows one to
-  dynamically increase log verbosity for a particular *filter type*. Example:
-
-    CURL_DEBUG=ssl curl -v https://curl.se
-
-  will make the `ssl` connection filter log more details. One may do that for
-  every filter type and also use a combination of names, separated by `,` or
-  space.
-
-    CURL_DEBUG=ssl,http/2 curl -v https://curl.se
-
-   The order of filter type names is not relevant. Names used here are
-   case insensitive. Note that these names are implementation internals and
-   subject to change.
-
-   Some, likely stable names are `tcp`, `ssl`, `http/2`. For a current list,
-   one may search the sources for `struct Curl_cftype` definitions and find
-   the names there. Also, some filters are only available with certain build
-   options, of course.
-
-### Test input files
-
-  All test cases are put in the `data/` subdirectory. Each test is stored in
-  the file named according to the test number.
-
-  See [`FILEFORMAT`](FILEFORMAT.md) for a description of the test case file
-  format.
-
-### Code coverage
-
-  gcc provides a tool that can determine the code coverage figures for the
-  test suite. To use it, configure curl with `CFLAGS='-fprofile-arcs
-  -ftest-coverage -g -O0'`. Make sure you run the normal and torture tests to
-  get more full coverage, i.e. do:
-
-    make test
-    make test-torture
-
-  The graphical tool `ggcov` can be used to browse the source and create
-  coverage reports on \*nix hosts:
-
-    ggcov -r lib src
-
-  The text mode tool `gcov` may also be used, but it doesn't handle object
-  files in more than one directory correctly.
-
-### Remote testing
-
-  The runtests.pl script provides some hooks to allow curl to be tested on a
-  machine where perl can not be run. The test framework in this case runs on
-  a workstation where perl is available, while curl itself is run on a remote
-  system using ssh or some other remote execution method. See the comments at
-  the beginning of runtests.pl for details.
-
-## Test case numbering
-
-  Test cases used to be numbered by category ranges, but the ranges filled
-  up. Subsets of tests can now be selected by passing keywords to the
-  runtests.pl script via the make `TFLAGS` variable.
-
-  New tests are added by finding a free number in `tests/data/Makefile.inc`.
-
-## Write tests
-
-  Here's a quick description on writing test cases. We basically have three
-  kinds of tests: the ones that test the curl tool, the ones that build small
-  applications and test libcurl directly and the unit tests that test
-  individual (possibly internal) functions.
-
-### test data
-
-  Each test has a master file that controls all the test data. What to read,
-  what the protocol exchange should look like, what exit code to expect and
-  what command line arguments to use etc.
-
-  These files are `tests/data/test[num]` where `[num]` is just a unique
-  identifier described above, and the XML-like file format of them is
-  described in the separate [`FILEFORMAT`](FILEFORMAT.md) document.
-
-### curl tests
-
-  A test case that runs the curl tool and verifies that it gets the correct
-  data, it sends the correct data, it uses the correct protocol primitives
-  etc.
-
-### libcurl tests
-
-  The libcurl tests are identical to the curl ones, except that they use a
-  specific and dedicated custom-built program to run instead of "curl". This
-  tool is built from source code placed in `tests/libtest` and if you want to
-  make a new libcurl test that is where you add your code.
-
-### unit tests
-
-  Unit tests are placed in `tests/unit`. There's a tests/unit/README
-  describing the specific set of checks and macros that may be used when
-  writing tests that verify behaviors of specific individual functions.
-
-  The unit tests depend on curl being built with debug enabled.
diff --git a/third-party/curl/tests/allversions.pm b/third-party/curl/tests/allversions.pm
new file mode 100644
index 0000000000..0dba43e0fe
--- /dev/null
+++ b/third-party/curl/tests/allversions.pm
@@ -0,0 +1,53 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+# populate the %pastversion hash table with the version number as key and
+# release date as value
+
+use strict;
+use warnings;
+
+our %pastversion;
+
+sub allversions {
+    my ($file) = @_;
+    open(A, "<$file") or
+        die "cannot open the versions file $file\n";
+    my $before = 1;
+    my $relcount;
+    while(<A>) {
+        if(/^## Past releases/) {
+            $before = 0;
+        }
+        elsif(!$before &&
+              /^- ([0-9.]+): (.*)/) {
+            $pastversion{$1} = $2;
+            $relcount++;
+        }
+    }
+    close(A);
+    die "too few releases ($relcount) found in $file" if($relcount < 100);
+}
+
+1;
diff --git a/third-party/curl/tests/appveyor.pm b/third-party/curl/tests/appveyor.pm
index 2a6a5d58c0..b3f8df9b31 100644
--- a/third-party/curl/tests/appveyor.pm
+++ b/third-party/curl/tests/appveyor.pm
@@ -32,13 +32,12 @@ BEGIN {
     use base qw(Exporter);
 
     our @EXPORT = qw(
-      appveyor_check_environment
-      appveyor_create_test_result
-      appveyor_update_test_result
+        appveyor_check_environment
+        appveyor_create_test_result
+        appveyor_update_test_result
     );
 }
 
-
 my %APPVEYOR_TEST_NAMES;  # JSON and shell-quoted test names by test number
 
 sub appveyor_check_environment {
@@ -49,12 +48,12 @@ sub appveyor_check_environment {
 }
 
 sub appveyor_create_test_result {
-    my ($curl, $testnum, $testname)=@_;
+    my ($curl, $testnum, $testname) = @_;
     $testname =~ s/\\/\\\\/g;
     $testname =~ s/\"/\\\"/g;
     $testname =~ s/\'/'"'"'/g;
-    my $appveyor_baseurl="$ENV{'APPVEYOR_API_URL'}";
-    my $appveyor_result=`$curl --silent --noproxy '*' \\
+    my $appveyor_baseurl = $ENV{'APPVEYOR_API_URL'};
+    my $appveyor_result = qx($curl --silent --noproxy '*' \\
     --header 'Content-Type: application/json' \\
     --data '
         {
@@ -64,14 +63,14 @@ sub appveyor_create_test_result {
             "outcome": "Running"
         }
     ' \\
-    '$appveyor_baseurl/api/tests'`;
-    print "AppVeyor API result: $appveyor_result\n" if ($appveyor_result);
-    $APPVEYOR_TEST_NAMES{$testnum}=$testname;
+    '$appveyor_baseurl/api/tests');
+    print "AppVeyor API result: $appveyor_result\n" if($appveyor_result);
+    $APPVEYOR_TEST_NAMES{$testnum} = $testname;
 }
 
 sub appveyor_update_test_result {
-    my ($curl, $testnum, $error, $start, $stop)=@_;
-    my $testname=$APPVEYOR_TEST_NAMES{$testnum};
+    my ($curl, $testnum, $error, $start, $stop) = @_;
+    my $testname = $APPVEYOR_TEST_NAMES{$testnum};
     if(!defined $testname) {
         return;
     }
@@ -97,8 +96,8 @@ sub appveyor_update_test_result {
         $appveyor_outcome = 'Failed';
         $appveyor_category = 'Error';
     }
-    my $appveyor_baseurl="$ENV{'APPVEYOR_API_URL'}";
-    my $appveyor_result=`$curl --silent --noproxy '*' --request PUT \\
+    my $appveyor_baseurl = $ENV{'APPVEYOR_API_URL'};
+    my $appveyor_result = qx($curl --silent --noproxy '*' --request PUT \\
     --header 'Content-Type: application/json' \\
     --data '
         {
@@ -110,10 +109,10 @@ sub appveyor_update_test_result {
             "ErrorMessage": "Test $testnum $appveyor_outcome"
         }
     ' \\
-    '$appveyor_baseurl/api/tests'`;
-    print "AppVeyor API result: $appveyor_result\n" if ($appveyor_result);
+    '$appveyor_baseurl/api/tests');
+    print "AppVeyor API result: $appveyor_result\n" if($appveyor_result);
     if($appveyor_category eq 'Error') {
-        $appveyor_result=`$curl --silent --noproxy '*' \\
+        $appveyor_result = qx($curl --silent --noproxy '*' \\
         --header 'Content-Type: application/json' \\
         --data '
             {
@@ -122,8 +121,8 @@ sub appveyor_update_test_result {
                 "details": "Test $testnum $appveyor_outcome"
             }
         ' \\
-        '$appveyor_baseurl/api/build/messages'`;
-        print "AppVeyor API result: $appveyor_result\n" if ($appveyor_result);
+        '$appveyor_baseurl/api/build/messages');
+        print "AppVeyor API result: $appveyor_result\n" if($appveyor_result);
     }
 }
 
diff --git a/third-party/curl/tests/azure.pm b/third-party/curl/tests/azure.pm
index 2810f48e17..e449a07fd4 100644
--- a/third-party/curl/tests/azure.pm
+++ b/third-party/curl/tests/azure.pm
@@ -53,9 +53,9 @@ sub azure_check_environment {
 }
 
 sub azure_create_test_run {
-    my ($curl)=@_;
-    my $azure_baseurl="$ENV{'SYSTEM_TEAMFOUNDATIONCOLLECTIONURI'}$ENV{'SYSTEM_TEAMPROJECTID'}";
-    my $azure_run=`$curl --silent --noproxy "*" \\
+    my ($curl) = @_;
+    my $azure_baseurl = "$ENV{'SYSTEM_TEAMFOUNDATIONCOLLECTIONURI'}$ENV{'SYSTEM_TEAMPROJECTID'}";
+    my $azure_run = qx($curl --silent --noproxy "*" \\
     --header "Authorization: Bearer $ENV{'AZURE_ACCESS_TOKEN'}" \\
     --header "Content-Type: application/json" \\
     --data "
@@ -65,7 +65,7 @@ sub azure_create_test_run {
             'build': {'id': '$ENV{'BUILD_BUILDID'}'}
         }
     " \\
-    "$azure_baseurl/_apis/test/runs?api-version=5.1"`;
+    "$azure_baseurl/_apis/test/runs?api-version=5.1");
     if($azure_run =~ /"id":(\d+)/) {
         return $1;
     }
@@ -73,13 +73,13 @@ sub azure_create_test_run {
 }
 
 sub azure_create_test_result {
-    my ($curl, $azure_run_id, $testnum, $testname)=@_;
+    my ($curl, $azure_run_id, $testnum, $testname) = @_;
     $testname =~ s/\\/\\\\/g;
     $testname =~ s/\"/\\\"/g;
     $testname =~ s/\'/'"'"'/g;
-    my $title_testnum=sprintf("%04d", $testnum);
-    my $azure_baseurl="$ENV{'SYSTEM_TEAMFOUNDATIONCOLLECTIONURI'}$ENV{'SYSTEM_TEAMPROJECTID'}";
-    my $azure_result=`$curl --silent --noproxy '*' \\
+    my $title_testnum = sprintf("%04d", $testnum);
+    my $azure_baseurl = "$ENV{'SYSTEM_TEAMFOUNDATIONCOLLECTIONURI'}$ENV{'SYSTEM_TEAMPROJECTID'}";
+    my $azure_result = qx($curl --silent --noproxy '*' \\
     --header "Authorization: Bearer $ENV{'AZURE_ACCESS_TOKEN'}" \\
     --header 'Content-Type: application/json' \\
     --data '
@@ -94,7 +94,7 @@ sub azure_create_test_result {
             }
         ]
     ' \\
-    '$azure_baseurl/_apis/test/runs/$azure_run_id/results?api-version=5.1'`;
+    '$azure_baseurl/_apis/test/runs/$azure_run_id/results?api-version=5.1');
     if($azure_result =~ /\[\{"id":(\d+)/) {
         return $1;
     }
@@ -102,7 +102,7 @@ sub azure_create_test_result {
 }
 
 sub azure_update_test_result {
-    my ($curl, $azure_run_id, $azure_result_id, $testnum, $error, $start, $stop)=@_;
+    my ($curl, $azure_run_id, $azure_result_id, $testnum, $error, $start, $stop) = @_;
     if(!defined $stop) {
         $stop = $start;
     }
@@ -122,8 +122,8 @@ sub azure_update_test_result {
     else {
         $azure_outcome = 'Failed';
     }
-    my $azure_baseurl="$ENV{'SYSTEM_TEAMFOUNDATIONCOLLECTIONURI'}$ENV{'SYSTEM_TEAMPROJECTID'}";
-    my $azure_result=`$curl --silent --noproxy '*' --request PATCH \\
+    my $azure_baseurl = "$ENV{'SYSTEM_TEAMFOUNDATIONCOLLECTIONURI'}$ENV{'SYSTEM_TEAMPROJECTID'}";
+    my $azure_result = qx($curl --silent --noproxy '*' --request PATCH \\
     --header "Authorization: Bearer $ENV{'AZURE_ACCESS_TOKEN'}" \\
     --header "Content-Type: application/json" \\
     --data '
@@ -137,7 +137,7 @@ sub azure_update_test_result {
             }
         ]
     ' \\
-    '$azure_baseurl/_apis/test/runs/$azure_run_id/results?api-version=5.1'`;
+    '$azure_baseurl/_apis/test/runs/$azure_run_id/results?api-version=5.1');
     if($azure_result =~ /\[\{"id":(\d+)/) {
         return $1;
     }
@@ -145,9 +145,9 @@ sub azure_update_test_result {
 }
 
 sub azure_update_test_run {
-    my ($curl, $azure_run_id)=@_;
-    my $azure_baseurl="$ENV{'SYSTEM_TEAMFOUNDATIONCOLLECTIONURI'}$ENV{'SYSTEM_TEAMPROJECTID'}";
-    my $azure_run=`$curl --silent --noproxy '*' --request PATCH \\
+    my ($curl, $azure_run_id) = @_;
+    my $azure_baseurl = "$ENV{'SYSTEM_TEAMFOUNDATIONCOLLECTIONURI'}$ENV{'SYSTEM_TEAMPROJECTID'}";
+    my $azure_run = qx($curl --silent --noproxy '*' --request PATCH \\
     --header "Authorization: Bearer $ENV{'AZURE_ACCESS_TOKEN'}" \\
     --header 'Content-Type: application/json' \\
     --data '
@@ -155,7 +155,7 @@ sub azure_update_test_run {
             "state": "Completed"
         }
     ' \\
-    '$azure_baseurl/_apis/test/runs/$azure_run_id?api-version=5.1'`;
+    '$azure_baseurl/_apis/test/runs/$azure_run_id?api-version=5.1');
     if($azure_run =~ /"id":(\d+)/) {
         return $1;
     }
diff --git a/third-party/curl/tests/badsymbols.pl b/third-party/curl/tests/badsymbols.pl
deleted file mode 100644
index a3a39d420f..0000000000
--- a/third-party/curl/tests/badsymbols.pl
+++ /dev/null
@@ -1,158 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-#
-# This script grew out of help from Przemyslaw Iskra and Balint Szilakszi
-# a late evening in the #curl IRC channel.
-#
-
-use strict;
-use warnings;
-use vars qw($Cpreprocessor);
-
-#
-# configurehelp perl module is generated by configure script
-#
-my $rc = eval {
-    require configurehelp;
-    configurehelp->import(qw(
-        $Cpreprocessor
-    ));
-    1;
-};
-# Set default values if configure has not generated a configurehelp.pm file.
-# This is the case with cmake.
-if (!$rc) {
-    $Cpreprocessor = 'cpp';
-}
-
-my $verbose=0;
-
-# verbose mode when -v is the first argument
-if($ARGV[0] eq "-v") {
-    $verbose=1;
-    shift;
-}
-
-# we may get the dir root pointed out
-my $root=$ARGV[0] || ".";
-
-# need an include directory when building out-of-tree
-my $i = ($ARGV[1]) ? "-I$ARGV[1] " : '';
-
-my $incdir = "$root/include/curl";
-
-my $summary=0;
-my $misses=0;
-
-my @syms;
-my %doc;
-my %rem;
-
-sub scanenums {
-    my ($file)=@_;
-    my $skipit = 0;
-
-    open H_IN, "-|", "$Cpreprocessor -DCURL_DISABLE_DEPRECATION $i$file" ||
-        die "Cannot preprocess $file";
-    while ( <H_IN> ) {
-        my ($line, $linenum) = ($_, $.);
-        if( /^#(line|) (\d+) \"(.*)\"/) {
-            # if the included file isn't in our incdir, then we skip this section
-            # until next #line
-            #
-            if($3 !~ /^$incdir/) {
-                $skipit = 1;
-                next;
-            }
-            # parse this!
-            $skipit = 0;
-            next;
-        }
-        if($skipit) {
-            next;
-        }
-        if (/^#/) {
-            next;
-        }
-        if ( /enum\s+(\S+\s+)?{/ .. /}/ ) {
-            s/^\s+//;
-            chomp;
-            s/[,\s].*//;
-            if(($_ !~ /\}(;|)/) &&
-               ($_ ne "typedef") &&
-               ($_ ne "enum") &&
-               ($_ ne "=") &&
-               ($_ !~ /^[ \t]*$/)) {
-                if($verbose) {
-                    print "Source: $Cpreprocessor $i$file\n";
-                    print "Symbol: $_\n";
-                    print "Line #$linenum: $line\n\n";
-                }
-                push @syms, $_;
-            }
-        }
-    }
-    close H_IN || die "Error preprocessing $file";
-}
-
-sub scanheader {
-    my ($f)=@_;
-    scanenums($f);
-    open H, "<$f";
-    while(<H>) {
-        my ($line, $linenum) = ($_, $.);
-        if (/^#define +([^ \n]*)/) {
-            if($verbose) {
-                print "Source: $f\n";
-                print "Symbol: $1\n";
-                print "Line #$linenum: $line\n\n";
-            }
-            push @syms, $1;
-        }
-    }
-    close H;
-}
-
-
-opendir(my $dh, $incdir) || die "Can't opendir $incdir: $!";
-my @hfiles = grep { /\.h$/ } readdir($dh);
-closedir $dh;
-
-for(@hfiles) {
-    scanheader("$incdir/$_");
-}
-
-my $errors = 0;
-for my $s (@syms) {
-    if($s !~ /^(lib|)curl/i) {
-        print "Bad symbols in public header files:\n" if(!$errors);
-        $errors++;
-        print "  $s\n";
-    }
-}
-if($errors) {
-    exit 1;
-}
-printf "%d fine symbols found\n", scalar(@syms);
diff --git a/third-party/curl/tests/certs/.gitignore b/third-party/curl/tests/certs/.gitignore
index f549fdf14f..98adccef08 100644
--- a/third-party/curl/tests/certs/.gitignore
+++ b/third-party/curl/tests/certs/.gitignore
@@ -1,10 +1,14 @@
 # Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
 #
 # SPDX-License-Identifier: curl
-EdelCurlRoot-*-ca.cacert
-EdelCurlRoot-ca.cnt
-EdelCurlRoot-ca.cnt.old
-EdelCurlRoot-ca.db
-EdelCurlRoot-ca.db.attr
-EdelCurlRoot-ca.db.attr.old
-EdelCurlRoot-ca.db.old
+test-*.crl
+test-*.crt
+test-*.csr
+test-*.der
+test-*.key*
+test-*.pem
+test-ca.cacert
+test-ca.cnt*
+test-ca.db*
+test-ca.raw*
+test-ca.srl
diff --git a/third-party/curl/tests/certs/CMakeLists.txt b/third-party/curl/tests/certs/CMakeLists.txt
new file mode 100644
index 0000000000..ebe6fbcfa7
--- /dev/null
+++ b/third-party/curl/tests/certs/CMakeLists.txt
@@ -0,0 +1,50 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Get CERTCONFIG_CA, CERTCONFIGS, GENERATEDCERTS, SRPFILES variables
+curl_transform_makefile_inc("Makefile.inc" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
+include("${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
+
+add_custom_command(OUTPUT ${GENERATEDCERTS}
+  COMMAND "${PERL_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/genserv.pl" "test" ${CERTCONFIGS}
+  DEPENDS "${CMAKE_CURRENT_SOURCE_DIR}/genserv.pl" ${CERTCONFIG_CA} ${CERTCONFIGS}
+  VERBATIM
+)
+add_custom_target(build-certs DEPENDS ${GENERATEDCERTS})
+
+option(_CURL_SKIP_BUILD_CERTS "Skip building certs with testdeps" OFF)  # Internal option to increase perf for build tests
+mark_as_advanced(_CURL_SKIP_BUILD_CERTS)
+if(NOT _CURL_SKIP_BUILD_CERTS)
+  add_dependencies(testdeps build-certs)
+endif()
+
+add_custom_target(clean-certs
+  COMMAND ${CMAKE_COMMAND} -E remove ${GENERATEDCERTS}
+    "test-*.csr"
+    "test-*.der"
+    "test-*.keyenc"
+    "test-ca.cnt*"
+    "test-ca.db*"
+    "test-ca.raw*"
+    "test-ca.srl"
+)
diff --git a/third-party/curl/tests/certs/EdelCurlRoot-ca.cacert b/third-party/curl/tests/certs/EdelCurlRoot-ca.cacert
deleted file mode 100644
index 4e191f5e60..0000000000
--- a/third-party/curl/tests/certs/EdelCurlRoot-ca.cacert
+++ /dev/null
@@ -1,95 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 16717980969522 (0xf3475512a32)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = Northern Nowhere Trust Anchor
-        Validity
-            Not Before: Dec 23 12:21:36 2022 GMT
-            Not After : May 28 12:21:36 2039 GMT
-        Subject:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = Northern Nowhere Trust Anchor
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:a1:d8:60:15:d1:5b:09:3b:d1:4e:79:40:0a:03:
-                    81:07:60:ba:6b:03:f4:87:4e:1e:e9:77:b1:ea:83:
-                    66:56:c4:6c:19:5e:cf:64:23:44:03:f5:d0:27:e1:
-                    1d:a5:05:dd:a5:f2:c1:9a:28:e2:31:66:a2:7b:e0:
-                    3b:bb:f3:b4:06:b4:43:97:7b:80:3c:96:1b:ed:85:
-                    7c:8b:2e:0f:62:b9:53:69:3d:2b:19:af:16:d3:e2:
-                    a9:d3:2d:f2:ec:b1:31:76:2d:d9:78:67:91:ce:16:
-                    52:e3:68:34:f1:bc:f0:5e:99:bf:28:cf:91:88:31:
-                    a6:48:cc:fb:84:a1:87:85:8b:08:18:eb:39:e9:34:
-                    ee:1b:3a:a3:bd:2a:77:63:50:c8:88:6b:f1:d3:c4:
-                    b7:25:db:7f:eb:b9:84:73:a8:86:8a:69:7d:40:5a:
-                    c3:24:81:10:8d:97:ae:ce:45:eb:5d:fb:14:31:5b:
-                    a1:c2:d1:aa:2f:44:a0:42:28:38:16:c7:42:1e:dd:
-                    db:0f:a9:d9:70:25:cc:da:be:e9:8c:8c:84:48:a3:
-                    ab:af:20:7a:7e:b3:09:a9:05:0d:ce:f8:9b:c2:77:
-                    e8:82:f8:6a:56:21:db:92:a7:0a:3c:f1:0c:a0:d4:
-                    9c:8c:c0:62:2b:62:bc:5e:c4:ba:5e:3a:fc:1a:05:
-                    49:ef
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-            X509v3 Subject Key Identifier: 
-                87:CB:B1:33:2E:C1:67:7E:71:E3:E5:2B:4C:4D:A4:B3:6E:D2:5B:A9
-            X509v3 Authority Key Identifier: 
-                87:CB:B1:33:2E:C1:67:7E:71:E3:E5:2B:4C:4D:A4:B3:6E:D2:5B:A9
-            Authority Information Access: 
-                CA Issuers - URI:http://test.curl.se/ca/EdelCurlRoot.cer
-            X509v3 CRL Distribution Points: 
-                Full Name:
-                  URI:http://test.curl.se/ca/EdelCurlRoot.crl
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        86:19:bd:3d:12:4f:6b:8c:8e:1b:72:db:8f:9b:67:68:96:f8:
-        f4:ad:d9:a0:b5:48:0e:19:f6:34:09:92:a5:b8:ab:70:c6:6b:
-        44:be:f7:fd:a4:75:ad:16:c4:ad:54:aa:c4:36:e6:86:87:84:
-        0d:d9:1f:ea:b5:95:3a:69:60:02:2f:5c:a2:a3:1d:c9:28:f6:
-        78:22:cd:e3:1d:47:37:a0:a0:a4:8a:3b:da:50:a9:12:e0:e4:
-        e7:1f:b6:bc:7e:e8:b6:a1:b7:99:9f:98:2c:c1:70:db:32:ea:
-        82:45:ff:71:ea:36:34:65:bd:ad:cd:c5:2b:a2:a1:6b:2e:a3:
-        30:b2:95:ea:77:a9:17:cf:bf:e4:df:4f:ef:6d:72:d0:a1:95:
-        c6:ef:e5:b8:70:0f:d2:82:b3:a7:54:4b:f7:2d:b9:2f:dc:37:
-        ff:f7:4d:26:b4:4b:6a:46:a3:f9:2c:ad:58:8c:96:e8:e6:a4:
-        aa:d0:c1:2d:35:db:b5:2f:ac:34:40:e3:7f:da:f7:34:f8:a2:
-        fd:6f:61:46:69:f0:24:20:32:f3:ad:e2:72:27:1a:58:a3:aa:
-        77:4e:fa:06:5e:34:40:d3:50:39:66:29:f6:a6:f5:40:3a:af:
-        97:23:19:cf:58:27:c9:8f:c4:b3:58:9e:87:78:2f:a7:24:9e:
-        3e:5d:d1:52
------BEGIN CERTIFICATE-----
-MIIENDCCAxygAwIBAgIGDzR1USoyMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNVBAYT
-Ak5OMTEwLwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNo
-IENsb3VkMSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjAe
-Fw0yMjEyMjMxMjIxMzZaFw0zOTA1MjgxMjIxMzZaMGgxCzAJBgNVBAYTAk5OMTEw
-LwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNoIENsb3Vk
-MSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjCCASIwDQYJ
-KoZIhvcNAQEBBQADggEPADCCAQoCggEBAKHYYBXRWwk70U55QAoDgQdgumsD9IdO
-Hul3seqDZlbEbBlez2QjRAP10CfhHaUF3aXywZoo4jFmonvgO7vztAa0Q5d7gDyW
-G+2FfIsuD2K5U2k9KxmvFtPiqdMt8uyxMXYt2Xhnkc4WUuNoNPG88F6ZvyjPkYgx
-pkjM+4Shh4WLCBjrOek07hs6o70qd2NQyIhr8dPEtyXbf+u5hHOohoppfUBawySB
-EI2Xrs5F6137FDFbocLRqi9EoEIoOBbHQh7d2w+p2XAlzNq+6YyMhEijq68gen6z
-CakFDc74m8J36IL4alYh25KnCjzxDKDUnIzAYitivF7Eul46/BoFSe8CAwEAAaOB
-4zCB4DAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU
-h8uxMy7BZ35x4+UrTE2ks27SW6kwHwYDVR0jBBgwFoAUh8uxMy7BZ35x4+UrTE2k
-s27SW6kwQwYIKwYBBQUHAQEENzA1MDMGCCsGAQUFBzAChidodHRwOi8vdGVzdC5j
-dXJsLnNlL2NhL0VkZWxDdXJsUm9vdC5jZXIwOAYDVR0fBDEwLzAtoCugKYYnaHR0
-cDovL3Rlc3QuY3VybC5zZS9jYS9FZGVsQ3VybFJvb3QuY3JsMA0GCSqGSIb3DQEB
-CwUAA4IBAQCGGb09Ek9rjI4bctuPm2dolvj0rdmgtUgOGfY0CZKluKtwxmtEvvf9
-pHWtFsStVKrENuaGh4QN2R/qtZU6aWACL1yiox3JKPZ4Is3jHUc3oKCkijvaUKkS
-4OTnH7a8fui2obeZn5gswXDbMuqCRf9x6jY0Zb2tzcUroqFrLqMwspXqd6kXz7/k
-30/vbXLQoZXG7+W4cA/SgrOnVEv3Lbkv3Df/900mtEtqRqP5LK1YjJbo5qSq0MEt
-Ndu1L6w0QON/2vc0+KL9b2FGafAkIDLzreJyJxpYo6p3TvoGXjRA01A5Zin2pvVA
-Oq+XIxnPWCfJj8SzWJ6HeC+nJJ4+XdFS
------END CERTIFICATE-----
diff --git a/third-party/curl/tests/certs/EdelCurlRoot-ca.cnf b/third-party/curl/tests/certs/EdelCurlRoot-ca.cnf
deleted file mode 100644
index b8c630b5de..0000000000
--- a/third-party/curl/tests/certs/EdelCurlRoot-ca.cnf
+++ /dev/null
@@ -1,11 +0,0 @@
-[ ca ]
-default_ca = EdelCurlRoot
-
-[ EdelCurlRoot ]
-database = EdelCurlRoot-ca.db
-certificate = EdelCurlRoot-ca.crt
-private_key = EdelCurlRoot-ca.key
-crlnumber = EdelCurlRoot-ca.cnt
-default_md = sha256
-default_days = 365
-default_crl_days = 30
diff --git a/third-party/curl/tests/certs/EdelCurlRoot-ca.crt b/third-party/curl/tests/certs/EdelCurlRoot-ca.crt
deleted file mode 100644
index 4e191f5e60..0000000000
--- a/third-party/curl/tests/certs/EdelCurlRoot-ca.crt
+++ /dev/null
@@ -1,95 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 16717980969522 (0xf3475512a32)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = Northern Nowhere Trust Anchor
-        Validity
-            Not Before: Dec 23 12:21:36 2022 GMT
-            Not After : May 28 12:21:36 2039 GMT
-        Subject:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = Northern Nowhere Trust Anchor
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:a1:d8:60:15:d1:5b:09:3b:d1:4e:79:40:0a:03:
-                    81:07:60:ba:6b:03:f4:87:4e:1e:e9:77:b1:ea:83:
-                    66:56:c4:6c:19:5e:cf:64:23:44:03:f5:d0:27:e1:
-                    1d:a5:05:dd:a5:f2:c1:9a:28:e2:31:66:a2:7b:e0:
-                    3b:bb:f3:b4:06:b4:43:97:7b:80:3c:96:1b:ed:85:
-                    7c:8b:2e:0f:62:b9:53:69:3d:2b:19:af:16:d3:e2:
-                    a9:d3:2d:f2:ec:b1:31:76:2d:d9:78:67:91:ce:16:
-                    52:e3:68:34:f1:bc:f0:5e:99:bf:28:cf:91:88:31:
-                    a6:48:cc:fb:84:a1:87:85:8b:08:18:eb:39:e9:34:
-                    ee:1b:3a:a3:bd:2a:77:63:50:c8:88:6b:f1:d3:c4:
-                    b7:25:db:7f:eb:b9:84:73:a8:86:8a:69:7d:40:5a:
-                    c3:24:81:10:8d:97:ae:ce:45:eb:5d:fb:14:31:5b:
-                    a1:c2:d1:aa:2f:44:a0:42:28:38:16:c7:42:1e:dd:
-                    db:0f:a9:d9:70:25:cc:da:be:e9:8c:8c:84:48:a3:
-                    ab:af:20:7a:7e:b3:09:a9:05:0d:ce:f8:9b:c2:77:
-                    e8:82:f8:6a:56:21:db:92:a7:0a:3c:f1:0c:a0:d4:
-                    9c:8c:c0:62:2b:62:bc:5e:c4:ba:5e:3a:fc:1a:05:
-                    49:ef
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-            X509v3 Subject Key Identifier: 
-                87:CB:B1:33:2E:C1:67:7E:71:E3:E5:2B:4C:4D:A4:B3:6E:D2:5B:A9
-            X509v3 Authority Key Identifier: 
-                87:CB:B1:33:2E:C1:67:7E:71:E3:E5:2B:4C:4D:A4:B3:6E:D2:5B:A9
-            Authority Information Access: 
-                CA Issuers - URI:http://test.curl.se/ca/EdelCurlRoot.cer
-            X509v3 CRL Distribution Points: 
-                Full Name:
-                  URI:http://test.curl.se/ca/EdelCurlRoot.crl
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        86:19:bd:3d:12:4f:6b:8c:8e:1b:72:db:8f:9b:67:68:96:f8:
-        f4:ad:d9:a0:b5:48:0e:19:f6:34:09:92:a5:b8:ab:70:c6:6b:
-        44:be:f7:fd:a4:75:ad:16:c4:ad:54:aa:c4:36:e6:86:87:84:
-        0d:d9:1f:ea:b5:95:3a:69:60:02:2f:5c:a2:a3:1d:c9:28:f6:
-        78:22:cd:e3:1d:47:37:a0:a0:a4:8a:3b:da:50:a9:12:e0:e4:
-        e7:1f:b6:bc:7e:e8:b6:a1:b7:99:9f:98:2c:c1:70:db:32:ea:
-        82:45:ff:71:ea:36:34:65:bd:ad:cd:c5:2b:a2:a1:6b:2e:a3:
-        30:b2:95:ea:77:a9:17:cf:bf:e4:df:4f:ef:6d:72:d0:a1:95:
-        c6:ef:e5:b8:70:0f:d2:82:b3:a7:54:4b:f7:2d:b9:2f:dc:37:
-        ff:f7:4d:26:b4:4b:6a:46:a3:f9:2c:ad:58:8c:96:e8:e6:a4:
-        aa:d0:c1:2d:35:db:b5:2f:ac:34:40:e3:7f:da:f7:34:f8:a2:
-        fd:6f:61:46:69:f0:24:20:32:f3:ad:e2:72:27:1a:58:a3:aa:
-        77:4e:fa:06:5e:34:40:d3:50:39:66:29:f6:a6:f5:40:3a:af:
-        97:23:19:cf:58:27:c9:8f:c4:b3:58:9e:87:78:2f:a7:24:9e:
-        3e:5d:d1:52
------BEGIN CERTIFICATE-----
-MIIENDCCAxygAwIBAgIGDzR1USoyMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNVBAYT
-Ak5OMTEwLwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNo
-IENsb3VkMSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjAe
-Fw0yMjEyMjMxMjIxMzZaFw0zOTA1MjgxMjIxMzZaMGgxCzAJBgNVBAYTAk5OMTEw
-LwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNoIENsb3Vk
-MSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjCCASIwDQYJ
-KoZIhvcNAQEBBQADggEPADCCAQoCggEBAKHYYBXRWwk70U55QAoDgQdgumsD9IdO
-Hul3seqDZlbEbBlez2QjRAP10CfhHaUF3aXywZoo4jFmonvgO7vztAa0Q5d7gDyW
-G+2FfIsuD2K5U2k9KxmvFtPiqdMt8uyxMXYt2Xhnkc4WUuNoNPG88F6ZvyjPkYgx
-pkjM+4Shh4WLCBjrOek07hs6o70qd2NQyIhr8dPEtyXbf+u5hHOohoppfUBawySB
-EI2Xrs5F6137FDFbocLRqi9EoEIoOBbHQh7d2w+p2XAlzNq+6YyMhEijq68gen6z
-CakFDc74m8J36IL4alYh25KnCjzxDKDUnIzAYitivF7Eul46/BoFSe8CAwEAAaOB
-4zCB4DAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU
-h8uxMy7BZ35x4+UrTE2ks27SW6kwHwYDVR0jBBgwFoAUh8uxMy7BZ35x4+UrTE2k
-s27SW6kwQwYIKwYBBQUHAQEENzA1MDMGCCsGAQUFBzAChidodHRwOi8vdGVzdC5j
-dXJsLnNlL2NhL0VkZWxDdXJsUm9vdC5jZXIwOAYDVR0fBDEwLzAtoCugKYYnaHR0
-cDovL3Rlc3QuY3VybC5zZS9jYS9FZGVsQ3VybFJvb3QuY3JsMA0GCSqGSIb3DQEB
-CwUAA4IBAQCGGb09Ek9rjI4bctuPm2dolvj0rdmgtUgOGfY0CZKluKtwxmtEvvf9
-pHWtFsStVKrENuaGh4QN2R/qtZU6aWACL1yiox3JKPZ4Is3jHUc3oKCkijvaUKkS
-4OTnH7a8fui2obeZn5gswXDbMuqCRf9x6jY0Zb2tzcUroqFrLqMwspXqd6kXz7/k
-30/vbXLQoZXG7+W4cA/SgrOnVEv3Lbkv3Df/900mtEtqRqP5LK1YjJbo5qSq0MEt
-Ndu1L6w0QON/2vc0+KL9b2FGafAkIDLzreJyJxpYo6p3TvoGXjRA01A5Zin2pvVA
-Oq+XIxnPWCfJj8SzWJ6HeC+nJJ4+XdFS
------END CERTIFICATE-----
diff --git a/third-party/curl/tests/certs/EdelCurlRoot-ca.csr b/third-party/curl/tests/certs/EdelCurlRoot-ca.csr
deleted file mode 100644
index 2eeb6f055f..0000000000
--- a/third-party/curl/tests/certs/EdelCurlRoot-ca.csr
+++ /dev/null
@@ -1,17 +0,0 @@
------BEGIN CERTIFICATE REQUEST-----
-MIICrTCCAZUCAQAwaDELMAkGA1UEBhMCTk4xMTAvBgNVBAoMKEVkZWwgQ3VybCBB
-cmN0aWMgSWxsdWRpdW0gUmVzZWFyY2ggQ2xvdWQxJjAkBgNVBAMMHU5vcnRoZXJu
-IE5vd2hlcmUgVHJ1c3QgQW5jaG9yMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAodhgFdFbCTvRTnlACgOBB2C6awP0h04e6Xex6oNmVsRsGV7PZCNEA/XQ
-J+EdpQXdpfLBmijiMWaie+A7u/O0BrRDl3uAPJYb7YV8iy4PYrlTaT0rGa8W0+Kp
-0y3y7LExdi3ZeGeRzhZS42g08bzwXpm/KM+RiDGmSMz7hKGHhYsIGOs56TTuGzqj
-vSp3Y1DIiGvx08S3Jdt/67mEc6iGiml9QFrDJIEQjZeuzkXrXfsUMVuhwtGqL0Sg
-Qig4FsdCHt3bD6nZcCXM2r7pjIyESKOrryB6frMJqQUNzvibwnfogvhqViHbkqcK
-PPEMoNScjMBiK2K8XsS6Xjr8GgVJ7wIDAQABoAAwDQYJKoZIhvcNAQELBQADggEB
-AGRzOAmRFC2HX9tV94v7PxAPLY8LC5IsCdk2E07gQ76kWU8B0qd3Okx970O6d9Iw
-jy27At8CIFmCwdiNpOfLv1uqtbBgitxRX6FfciN5Lu0D1wxICc2gX7tDgqLhrT8E
-fp8q7/F//UPT04l5B6b+2h210Rkzjs/EmjQt2cFGjQpGSy8nb1ey3/W91NAej7Aq
-Hrp3/64hC+0QZMpgYQpYx65LYOST+U8lnDbrlcRUQqkUmGidwbYqGQMv+Tk5TKjL
-zMOjuu/I6stoGSJGJvhrfToZazG0u9tT+sXQdbi3emXVP1tMVpkhOYvKaaCno9QR
-RREL1l6yq15NUoT030u7pvs=
------END CERTIFICATE REQUEST-----
diff --git a/third-party/curl/tests/certs/EdelCurlRoot-ca.der b/third-party/curl/tests/certs/EdelCurlRoot-ca.der
deleted file mode 100644
index 9a4e2ef89c3a94a533bfd0991cc09fafd6885dc4..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1080
zcmXqLVlgpjVwPFJ%*4pV#Kvz@8mMJtz{|#|)#lOmotKf3o0Y*J!;ss6lZ`o)g-w{r
z&(F}%Kp({6;?ZzTNzGAkE-lJYa4bqL$xK%8%*iQD$t=xP2udwZO)N^zP;k!4FHJF2
zGf)9(Vdjzb%P%U)NG-}!@XId;(y0m|MWw|h3XXZn8Tmy9a^k#3MutX4#z1UnY!)TX
zYiwy?YGeWB($OVNj7rGCz{twL+{DPwV9><K#ni;e$guE6g6PF)PV0+)l@46YjqC}#
zvYEfM`^mj5-}tIIE$m2+WZd}_Wf$hJ7t|lhE@i#D^wYsv8jlRq7F9p6-u-zC+ZN~P
z)eSb&q~EsIbnEda?F`Pe)s|c@cKOlD%etT5Y&0y>y;+ey@tj!D;|!CJdp^X?+^=zd
zVu#@}k2Akp7Phx`b4a|ld};Dd+G_D$t@7l66CK$fFCW>idb|Gh&X(d8ZC#nQ4pE0y
z8U=c%uRG`ZI`+4SVf4a77gy=KEO64W5IgQ9clS2`%9{nMXKw9#+0)bFv3T`*g{r#E
zoGV#*&;6KvsQg9KkE}4o+mn`a*?i<#aAi)<fh6suJ#j~N#aaE4V)cB_#LURRxVZ7L
zLE{4heqh|n3NtePXJIv922uumAOU`m01Gf(u^GsM_<Ss4EF$fvHyZ05Os^|^{8Zb=
zcgg0wOVKM0<U!KPED{D{4cHYpvvFv%F|x9<GcvN68<-jx!}tbFZR!~%B?VUc`X#Bw
zC3?xgw5V5{s-K*w4@#S$q#2Z-4-`)=GOz&IBF_R$y#~4qv=?X+sk0~tIUNAA127#h
zGPFtVwH5Nu?&*^*y4^oJJ!9IBFKcfu*y_P2`OSoL($XEP3yx*G?EC(AN$Fa#BWpue
z9Wi^>*51N<Q~uS~saBZ@O!_g47R#R0_*S8G_OYzH`GN&Yx~y*ntQ30i<hlH|J#{a(
zE!;kH{tTUi1-Fe}HM#yTd}U^mx_9l_quPrWX6r3B*fjN3`AYHg`=8wRf1g`)Vd2zc
z@1O1{;J?(gd3lKUcio-(cg+8P_f^~Co#nRpr_S1lo@p<hEm?Kppswldt@>+B93I!-
z`fl=L(ck<;x6BVJ3PzvTJ}Od|idej=-0v4#oQcEb0LwJZZ_B<qSgoI~EO|ac{bc`<
S%@On3EA*GE%(IKV7z6;3Z=Z4i

diff --git a/third-party/curl/tests/certs/EdelCurlRoot-ca.key b/third-party/curl/tests/certs/EdelCurlRoot-ca.key
deleted file mode 100644
index 624ab3f549..0000000000
--- a/third-party/curl/tests/certs/EdelCurlRoot-ca.key
+++ /dev/null
@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCh2GAV0VsJO9FO
-eUAKA4EHYLprA/SHTh7pd7Hqg2ZWxGwZXs9kI0QD9dAn4R2lBd2l8sGaKOIxZqJ7
-4Du787QGtEOXe4A8lhvthXyLLg9iuVNpPSsZrxbT4qnTLfLssTF2Ldl4Z5HOFlLj
-aDTxvPBemb8oz5GIMaZIzPuEoYeFiwgY6znpNO4bOqO9KndjUMiIa/HTxLcl23/r
-uYRzqIaKaX1AWsMkgRCNl67ORetd+xQxW6HC0aovRKBCKDgWx0Ie3dsPqdlwJcza
-vumMjIRIo6uvIHp+swmpBQ3O+JvCd+iC+GpWIduSpwo88Qyg1JyMwGIrYrxexLpe
-OvwaBUnvAgMBAAECggEADFrjQucfhv3tBYuWCu2njPOiZ4b+xNF+5J3BlECBsIAA
-LJOjS2axy4eZY2H5DF79Q6zbgLQ8SD8oikJc7QU2qgha3JaN/JINAb3d+xYCEKxL
-JM6JmsVV/cjg5AEu+UixmO75Ggr2A4CKxVdwK0AcLWyZPjlSR85aflY/oSlfmh8a
-txULdID0fH+/tIVQE/xlS9M8xfHxqQQyoBsWkwPPcxhgPRgPpTxo/a12iZk2z+lV
-F/1TZxyb0MWRktVgHQwhmXSnEguosspjk6fqDXwM14WJLQA1XdFdblI3aiHmlc5h
-qanreSsaUgYsV1WvVxh1qfoljm6pUzoYvOChdz62SQKBgQDiavOlubV+kgFU4he+
-LzdaZJUlq6JO4dbbcgE4lZBnoJp2Ga5V1OvBnBcrdtiHO46V2Durq66YHa/tZfTN
-6RlA6GyPVLb6qlwbCYUnpSfuwIVJx7Zty7FrnOn9oRlwLpQQMG4AOsS3E+JY1vQZ
-9+8htuT9OprjY2Mx6wLm2EuZ3QKBgQC2/aZll+nRMerAsZLsTm1idkvxztvDPyoQ
-yQwGlDy79OvezjzXEAczGk/XDSRnGIptZQacxw5z/Lw8IHaaTp7GPFBrD7Lr84dc
-QopdLqqeQJ2n7WGjmJ3gLJCp7NHHP+xDkipc2Xq+nFGlS+PxVzB0hOq3wQdPV54e
-h+x9CNDkOwKBgA3TfiFmn8Ck5dPrIowIkhbBAaKVQooSnG42HgD4kSLi2cvQcabo
-I6VlBL0wurQ3XNOlqq8nArhjR7T1fud8DoC6MLbn82yHLqyv/iOXoEKiGwGQYoF9
-6M2rfVZxmf4RuhTrACyfahfL7QyDw9A6Ja4nXwBfrcmo7gvEUB8MokE5AoGBAKbY
-sZ5SG/wE4oGdp1PU0oGDUQ2CSfhFIGq7lT5ubM4HrASz0N9amuXqaL+xGO7zfkvu
-YFAUY0Y4O70q8FkTtEsVdVGYt8/RdSsW9KevxBuU2OrjUzJiFhjvKVv2NPPSge6+
-V+fe177yMrNfdc94axLimky/MJYUUnSOBH+gyS4/AoGBALJt7WqFnb3iazOgVUDd
-ZGOJUuBnlgS6MK/YxP+8csq+MPnGVVGruXx72hzWe3bJ8QM16QvHUPC9RNgnclXB
-Ekx45SNSG1g//rxHwCJAgcTlnhiTZQ21Fn3V2EckjOa/Z4udk/7PxFRto1beNznK
-nW2eB0xvsK+qq5yc3TQClWgc
------END PRIVATE KEY-----
diff --git a/third-party/curl/tests/certs/EdelCurlRoot-ca.prm b/third-party/curl/tests/certs/EdelCurlRoot-ca.prm
deleted file mode 100644
index c8e248b3e8..0000000000
--- a/third-party/curl/tests/certs/EdelCurlRoot-ca.prm
+++ /dev/null
@@ -1,30 +0,0 @@
-extensions = x509v3
-[ req ]
-default_bits                    = 2048
-distinguished_name              = req_DN
-default_md			= sha256
-string_mask			= utf8only
-[ req_DN ]
-countryName                     = "Country Name"
-countryName_value            = NN
-organizationName              = "Organization Name"
-organizationName_value     = Edel Curl Arctic Illudium Research Cloud
-commonName                      = "Common Name"
-commonName_value              = Northern Nowhere Trust Anchor
-[ x509v3 ]
-basicConstraints = critical,CA:true
-keyUsage        = critical,keyCertSign,cRLSign
-subjectKeyIdentifier = hash
-authorityKeyIdentifier  = keyid:always
-authorityInfoAccess     = @issuer_info
-crlDistributionPoints   = @crl_info
-
-[ crl_ext ]
-authorityKeyIdentifier  = keyid:always
-authorityInfoAccess     = @issuer_info
-
-[ issuer_info ]
-caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
-
-[ crl_info ]
-URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
\ No newline at end of file
diff --git a/third-party/curl/tests/certs/Makefile.am b/third-party/curl/tests/certs/Makefile.am
index e21cdd5c44..078b4490b6 100644
--- a/third-party/curl/tests/certs/Makefile.am
+++ b/third-party/curl/tests/certs/Makefile.am
@@ -23,115 +23,29 @@
 ###########################################################################
 AUTOMAKE_OPTIONS = foreign
 
-SUBDIRS = scripts
+# Get CERTCONFIG_CA, CERTCONFIGS, GENERATEDCERTS, SRPFILES variables
+include Makefile.inc
 
-CERTCONFIGS = \
-  EdelCurlRoot-ca.prm \
-  EdelCurlRoot-ca.cnf \
-  Server-localhost-sv.prm \
-  Server-localhost.nn-sv.prm \
-  Server-localhost0h-sv.prm \
-  Server-localhost-firstSAN-sv.prm \
-  Server-localhost-lastSAN-sv.prm \
-  stunnel-sv.prm
+EXTRA_DIST = $(CERTCONFIG_CA) $(CERTCONFIGS) $(SRPFILES) CMakeLists.txt \
+  genserv.pl
 
-GENERATEDCERTS = \
-  EdelCurlRoot-ca.cacert \
-  EdelCurlRoot-ca.crt \
-  EdelCurlRoot-ca.csr \
-  EdelCurlRoot-ca.der \
-  EdelCurlRoot-ca.key \
-  Server-localhost-sv.crl \
-  Server-localhost-sv.crt \
-  Server-localhost-sv.csr \
-  Server-localhost-sv.der \
-  Server-localhost-sv.dhp \
-  Server-localhost-sv.key \
-  Server-localhost-sv.pem \
-  Server-localhost-sv.pub.der \
-  Server-localhost-sv.pub.pem \
-  Server-localhost.nn-sv.crl \
-  Server-localhost.nn-sv.crt \
-  Server-localhost.nn-sv.csr \
-  Server-localhost.nn-sv.der \
-  Server-localhost.nn-sv.dhp \
-  Server-localhost.nn-sv.key \
-  Server-localhost.nn-sv.pem \
-  Server-localhost.nn-sv.pub.der \
-  Server-localhost.nn-sv.pub.pem \
-  Server-localhost0h-sv.crl \
-  Server-localhost0h-sv.crt \
-  Server-localhost0h-sv.csr \
-  Server-localhost0h-sv.der \
-  Server-localhost0h-sv.dhp \
-  Server-localhost0h-sv.key \
-  Server-localhost0h-sv.pem \
-  Server-localhost0h-sv.pub.der \
-  Server-localhost0h-sv.pub.pem \
-  Server-localhost-firstSAN-sv.crl \
-  Server-localhost-firstSAN-sv.crt \
-  Server-localhost-firstSAN-sv.csr \
-  Server-localhost-firstSAN-sv.der \
-  Server-localhost-firstSAN-sv.dhp \
-  Server-localhost-firstSAN-sv.key \
-  Server-localhost-firstSAN-sv.pem \
-  Server-localhost-firstSAN-sv.pub.der \
-  Server-localhost-firstSAN-sv.pub.pem \
-  Server-localhost-lastSAN-sv.crl \
-  Server-localhost-lastSAN-sv.crt \
-  Server-localhost-lastSAN-sv.csr \
-  Server-localhost-lastSAN-sv.der \
-  Server-localhost-lastSAN-sv.dhp \
-  Server-localhost-lastSAN-sv.key \
-  Server-localhost-lastSAN-sv.pem \
-  Server-localhost-lastSAN-sv.pub.der \
-  Server-localhost-lastSAN-sv.pub.pem \
-  stunnel-sv.crl \
-  stunnel-sv.crt \
-  stunnel-sv.csr \
-  stunnel-sv.der \
-  stunnel-sv.dhp \
-  stunnel-sv.key \
-  stunnel-sv.pem \
-  stunnel-sv.der \
-  stunnel-sv.pub.pem
+DISTCLEANFILES = $(GENERATEDCERTS)
 
-SRPFILES = \
-  srp-verifier-conf \
-  srp-verifier-db
-
-EXTRA_DIST = $(CERTCONFIGS) $(GENERATEDCERTS) $(SRPFILES)
+all-am: test-ca.cacert
 
 # Rebuild the certificates
 
-clean-certs:
-	cd $(srcdir); rm -f $(GENERATEDCERTS)
+# Generate all certs in a single shot, but declare only a single target file
+# to support GNU Make <4.3 without the "grouped explicit targets" feature.
+test-ca.cacert: $(CERTCONFIG_CA) $(CERTCONFIGS) genserv.pl
+	@PERL@ $(srcdir)/genserv.pl test $(CERTCONFIGS)
 
-build-certs: $(srcdir)/EdelCurlRoot-ca.cacert $(srcdir)/Server-localhost-sv.pem \
-	$(srcdir)/Server-localhost.nn-sv.pem $(srcdir)/Server-localhost0h-sv.pem \
-	$(srcdir)/Server-localhost-firstSAN-sv.pem $(srcdir)/Server-localhost-lastSAN-sv.pem \
-	$(srcdir)/stunnel-sv.pem ../stunnel.pem
-
-$(srcdir)/EdelCurlRoot-ca.cacert:
-	cd $(srcdir); scripts/genroot.sh EdelCurlRoot
-
-$(srcdir)/Server-localhost-sv.pem: $(srcdir)/EdelCurlRoot-ca.cacert
-	cd $(srcdir); scripts/genserv.sh Server-localhost EdelCurlRoot
-
-$(srcdir)/Server-localhost.nn-sv.pem: $(srcdir)/EdelCurlRoot-ca.cacert
-	cd $(srcdir); scripts/genserv.sh Server-localhost.nn EdelCurlRoot
-
-$(srcdir)/Server-localhost0h-sv.pem: $(srcdir)/EdelCurlRoot-ca.cacert
-	cd $(srcdir); scripts/genserv.sh Server-localhost0h EdelCurlRoot
-
-$(srcdir)/Server-localhost-firstSAN-sv.pem: $(srcdir)/EdelCurlRoot-ca.cacert
-	cd $(srcdir); scripts/genserv.sh Server-localhost-firstSAN EdelCurlRoot
-
-$(srcdir)/Server-localhost-lastSAN-sv.pem: $(srcdir)/EdelCurlRoot-ca.cacert
-	cd $(srcdir); scripts/genserv.sh Server-localhost-lastSAN EdelCurlRoot
-
-$(srcdir)/stunnel-sv.pem: $(srcdir)/EdelCurlRoot-ca.cacert
-	cd $(srcdir); scripts/genserv.sh stunnel EdelCurlRoot
-
-../stunnel.pem: $(srcdir)/stunnel-sv.pem
-	cp $< $@
+clean-local:
+	rm -f $(GENERATEDCERTS) \
+	  test-*.csr \
+	  test-*.der \
+	  test-*.keyenc \
+	  test-ca.cnt* \
+	  test-ca.db* \
+	  test-ca.raw* \
+	  test-ca.srl
diff --git a/third-party/curl/tests/certs/Makefile.inc b/third-party/curl/tests/certs/Makefile.inc
new file mode 100644
index 0000000000..06516a09d5
--- /dev/null
+++ b/third-party/curl/tests/certs/Makefile.inc
@@ -0,0 +1,88 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Shared between CMakeLists.txt and Makefile.am
+
+CERTCONFIG_CA = \
+  test-ca.cnf \
+  test-ca.prm
+
+CERTCONFIGS = \
+  test-client-cert.prm \
+  test-client-eku-only.prm \
+  test-localhost.prm \
+  test-localhost.nn.prm \
+  test-localhost0h.prm \
+  test-localhost-san-first.prm \
+  test-localhost-san-last.prm
+
+GENERATEDCERTS = \
+  test-ca.cacert \
+  test-ca.crt \
+  test-ca.key \
+  test-client-cert.crl \
+  test-client-cert.crt \
+  test-client-cert.key \
+  test-client-cert.pem \
+  test-client-cert.pub.der \
+  test-client-cert.pub.pem \
+  test-client-eku-only.crl \
+  test-client-eku-only.crt \
+  test-client-eku-only.key \
+  test-client-eku-only.pem \
+  test-client-eku-only.pub.der \
+  test-client-eku-only.pub.pem \
+  test-localhost-san-first.crl \
+  test-localhost-san-first.crt \
+  test-localhost-san-first.key \
+  test-localhost-san-first.pem \
+  test-localhost-san-first.pub.der \
+  test-localhost-san-first.pub.pem \
+  test-localhost-san-last.crl \
+  test-localhost-san-last.crt \
+  test-localhost-san-last.key \
+  test-localhost-san-last.pem \
+  test-localhost-san-last.pub.der \
+  test-localhost-san-last.pub.pem \
+  test-localhost.crl \
+  test-localhost.crt \
+  test-localhost.key \
+  test-localhost.nn.crl \
+  test-localhost.nn.crt \
+  test-localhost.nn.key \
+  test-localhost.nn.pem \
+  test-localhost.nn.pub.der \
+  test-localhost.nn.pub.pem \
+  test-localhost.pem \
+  test-localhost.pub.der \
+  test-localhost.pub.pem \
+  test-localhost0h.crl \
+  test-localhost0h.crt \
+  test-localhost0h.key \
+  test-localhost0h.pem \
+  test-localhost0h.pub.der \
+  test-localhost0h.pub.pem
+
+SRPFILES = \
+  srp-verifier-conf \
+  srp-verifier-db
diff --git a/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.crl b/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.crl
deleted file mode 100644
index 1944a4a035..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.crl
+++ /dev/null
@@ -1,14 +0,0 @@
------BEGIN X509 CRL-----
-MIICKDCCARACAQEwDQYJKoZIhvcNAQELBQAwaDELMAkGA1UEBhMCTk4xMTAvBgNV
-BAoMKEVkZWwgQ3VybCBBcmN0aWMgSWxsdWRpdW0gUmVzZWFyY2ggQ2xvdWQxJjAk
-BgNVBAMMHU5vcnRoZXJuIE5vd2hlcmUgVHJ1c3QgQW5jaG9yFw0yMjEyMjMxMjIx
-MzhaFw0yMzAxMjIxMjIxMzhaMGQwFwIGDzR1USo8Fw0yMjEyMjMxMjIxMzZaMBcC
-Bg80dVFRYRcNMjIxMjIzMTIyMTM3WjAXAgYPNHVRUXUXDTIyMTIyMzEyMjEzN1ow
-FwIGDzR1UVGJFw0yMjEyMjMxMjIxMzhaoA4wDDAKBgNVHRQEAwIBATANBgkqhkiG
-9w0BAQsFAAOCAQEANTZwNcoHukPV2Wf9ykTUELJtpH3OCzinsOBm/h0LRWp06NAm
-0YJcStMclU7syd6izwPZPI9HT5tPQKHaxJDa8rZH4XRE8bSIAHQacj+22mcLV1EB
-5TdRRRHA6UvhebO8f6cf32SQIJ821LDW1FeFj3VvJqRfM6P9E0BNiCGvxJCFAE4K
-+/uN5v/x12kKDl3+7wqh1q36qM99QRbNbWh+3ndxG5Gm8Zl2MWLstMLVDI0SjipZ
-mnMpQ0py5IdiStCY8iYiTk48QUqQ9Jki+bmjNwG05HQUVdUiwwtJhlYhyTpNIBE8
-MB+39cFiwpJ7YbFC8Quhppg/isJ2ZaBmTg7zpA==
------END X509 CRL-----
diff --git a/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.crt b/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.crt
deleted file mode 100644
index 6eadce2caa..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.crt
+++ /dev/null
@@ -1,100 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 16717980979593 (0xf3475515189)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = Northern Nowhere Trust Anchor
-        Validity
-            Not Before: Dec 23 12:21:38 2022 GMT
-            Not After : Mar 11 12:21:38 2031 GMT
-        Subject:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = localhost.nn
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:aa:14:6e:3d:82:1c:28:cd:8f:80:af:50:ed:17:
-                    97:6d:e6:a8:61:3e:ac:a8:ac:13:ce:99:eb:29:2c:
-                    49:73:f9:12:40:35:c4:79:84:0d:9e:b0:28:c4:9f:
-                    64:e3:c1:6d:2d:71:11:5d:4b:14:61:20:4b:18:a1:
-                    cb:21:6d:9e:78:1b:11:d2:83:1c:89:75:d5:77:3d:
-                    ca:c8:83:17:74:5c:44:b2:1f:ac:f3:8b:c5:6a:34:
-                    7a:86:ab:08:f5:3d:79:72:ab:36:48:23:de:2b:ba:
-                    4c:e0:ef:18:91:64:97:c6:09:92:ed:26:d2:a7:0d:
-                    a2:21:1f:34:06:c7:99:17:b2:50:96:b6:0f:9b:ed:
-                    45:ff:be:81:47:29:e5:f3:49:db:21:65:44:de:8d:
-                    2b:12:07:12:0d:59:cc:bb:4d:1a:33:c0:7a:7e:e5:
-                    5b:06:50:62:b2:7f:8f:5c:6d:91:cb:6a:5c:e3:e4:
-                    ae:b9:ab:0d:36:ef:0a:d5:6d:07:5b:25:58:20:0d:
-                    d2:4b:25:0f:e8:11:f5:ce:19:b1:29:c6:d3:49:d7:
-                    f2:4a:78:52:d2:c5:fc:4f:11:63:f1:4e:77:ae:0a:
-                    87:65:45:49:b6:ac:21:1b:c8:94:c1:0c:e7:13:e6:
-                    be:f3:ff:a2:bd:68:4c:c6:34:04:2b:fc:ff:c3:e8:
-                    23:57
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Alternative Name: 
-                DNS:localhost, DNS:localhost1, DNS:localhost2
-            X509v3 Key Usage: 
-                Digital Signature, Key Encipherment, Key Agreement
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication
-            X509v3 Subject Key Identifier: 
-                DB:7A:18:5E:83:AC:D3:48:C9:00:99:3C:EB:BF:A6:21:F0:39:80:CC
-            X509v3 Authority Key Identifier: 
-                87:CB:B1:33:2E:C1:67:7E:71:E3:E5:2B:4C:4D:A4:B3:6E:D2:5B:A9
-            X509v3 Basic Constraints: 
-                CA:FALSE
-            Authority Information Access: 
-                CA Issuers - URI:http://test.curl.se/ca/EdelCurlRoot.cer
-            X509v3 CRL Distribution Points: 
-                Full Name:
-                  URI:http://test.curl.se/ca/EdelCurlRoot.crl
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        75:0d:9b:eb:8a:df:ca:a7:7c:9d:9e:6a:eb:30:10:24:12:1b:
-        81:f6:cd:b0:a0:f8:de:10:f1:6e:b8:57:3a:3a:b0:a4:8c:1d:
-        c1:8f:95:22:e3:1f:8b:3a:21:89:e5:96:08:3d:83:33:37:66:
-        48:03:f7:98:dd:2f:6d:09:7a:82:26:c1:eb:16:b9:5e:5b:f5:
-        67:4c:a0:e7:93:e7:2e:d4:53:b8:77:5f:5e:6a:3a:d9:06:19:
-        ca:85:ca:7c:09:61:0d:08:8b:6a:b3:e2:03:8c:ea:b1:55:b2:
-        30:9b:aa:66:0e:6e:d7:0a:0a:22:ca:6d:8d:d8:53:a8:bc:df:
-        13:29:d3:b6:1e:9f:3e:a1:8d:f3:8c:48:bf:71:e9:4e:f4:76:
-        ed:77:97:3f:59:27:ca:bb:5b:7c:58:23:82:e7:b5:2d:39:02:
-        9f:52:07:2f:7b:17:6d:c8:af:90:f5:ed:81:99:a9:cf:80:fb:
-        eb:ba:9c:bc:9a:df:c5:04:78:2c:73:73:bf:95:23:cf:fb:c9:
-        3e:fa:5b:ee:02:39:8e:09:78:ca:89:08:fd:83:77:37:72:01:
-        6c:dd:fb:eb:70:20:df:87:28:b3:0f:a0:c5:b3:70:fb:5d:38:
-        72:23:46:7f:f5:d8:fc:b6:67:72:82:e5:ce:29:f5:b5:34:db:
-        a3:d5:fe:20
------BEGIN CERTIFICATE-----
-MIIEXzCCA0egAwIBAgIGDzR1UVGJMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNVBAYT
-Ak5OMTEwLwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNo
-IENsb3VkMSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjAe
-Fw0yMjEyMjMxMjIxMzhaFw0zMTAzMTExMjIxMzhaMFcxCzAJBgNVBAYTAk5OMTEw
-LwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNoIENsb3Vk
-MRUwEwYDVQQDDAxsb2NhbGhvc3Qubm4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
-ggEKAoIBAQCqFG49ghwozY+Ar1DtF5dt5qhhPqyorBPOmespLElz+RJANcR5hA2e
-sCjEn2TjwW0tcRFdSxRhIEsYocshbZ54GxHSgxyJddV3PcrIgxd0XESyH6zzi8Vq
-NHqGqwj1PXlyqzZII94rukzg7xiRZJfGCZLtJtKnDaIhHzQGx5kXslCWtg+b7UX/
-voFHKeXzSdshZUTejSsSBxINWcy7TRozwHp+5VsGUGKyf49cbZHLalzj5K65qw02
-7wrVbQdbJVggDdJLJQ/oEfXOGbEpxtNJ1/JKeFLSxfxPEWPxTneuCodlRUm2rCEb
-yJTBDOcT5r7z/6K9aEzGNAQr/P/D6CNXAgMBAAGjggEeMIIBGjAsBgNVHREEJTAj
-gglsb2NhbGhvc3SCCmxvY2FsaG9zdDGCCmxvY2FsaG9zdDIwCwYDVR0PBAQDAgOo
-MBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1UdDgQWBBTbehheg6zTSMkAmTzrv6Yh
-8DmAzDAfBgNVHSMEGDAWgBSHy7EzLsFnfnHj5StMTaSzbtJbqTAJBgNVHRMEAjAA
-MEMGCCsGAQUFBwEBBDcwNTAzBggrBgEFBQcwAoYnaHR0cDovL3Rlc3QuY3VybC5z
-ZS9jYS9FZGVsQ3VybFJvb3QuY2VyMDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly90
-ZXN0LmN1cmwuc2UvY2EvRWRlbEN1cmxSb290LmNybDANBgkqhkiG9w0BAQsFAAOC
-AQEAdQ2b64rfyqd8nZ5q6zAQJBIbgfbNsKD43hDxbrhXOjqwpIwdwY+VIuMfizoh
-ieWWCD2DMzdmSAP3mN0vbQl6gibB6xa5Xlv1Z0yg55PnLtRTuHdfXmo62QYZyoXK
-fAlhDQiLarPiA4zqsVWyMJuqZg5u1woKIsptjdhTqLzfEynTth6fPqGN84xIv3Hp
-TvR27XeXP1knyrtbfFgjgue1LTkCn1IHL3sXbcivkPXtgZmpz4D767qcvJrfxQR4
-LHNzv5Ujz/vJPvpb7gI5jgl4yokI/YN3N3IBbN3763Ag34cosw+gxbNw+104ciNG
-f/XY/LZncoLlzin1tTTbo9X+IA==
------END CERTIFICATE-----
diff --git a/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.csr b/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.csr
deleted file mode 100644
index 031639c5ae..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.csr
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN CERTIFICATE REQUEST-----
-MIICnDCCAYQCAQAwVzELMAkGA1UEBhMCTk4xMTAvBgNVBAoMKEVkZWwgQ3VybCBB
-cmN0aWMgSWxsdWRpdW0gUmVzZWFyY2ggQ2xvdWQxFTATBgNVBAMMDGxvY2FsaG9z
-dC5ubjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKoUbj2CHCjNj4Cv
-UO0Xl23mqGE+rKisE86Z6yksSXP5EkA1xHmEDZ6wKMSfZOPBbS1xEV1LFGEgSxih
-yyFtnngbEdKDHIl11Xc9ysiDF3RcRLIfrPOLxWo0eoarCPU9eXKrNkgj3iu6TODv
-GJFkl8YJku0m0qcNoiEfNAbHmReyUJa2D5vtRf++gUcp5fNJ2yFlRN6NKxIHEg1Z
-zLtNGjPAen7lWwZQYrJ/j1xtkctqXOPkrrmrDTbvCtVtB1slWCAN0kslD+gR9c4Z
-sSnG00nX8kp4UtLF/E8RY/FOd64Kh2VFSbasIRvIlMEM5xPmvvP/or1oTMY0BCv8
-/8PoI1cCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQBRfTSEtMHj/52TYk5kUHlY
-gTBoePcTVfRCBRfqlGGDAokBrvXq/dFU+5Z/CyulXWnqPji+qw6GDG8KPX0oA6wj
-4Yi2z0Dy4BYaRO4PWTGPZ6zsSXAtv0CVtf995O8Ko8axhYQhjDb54G8oMOr5XOHz
-GV4LolrlsgxNM0m/KJ2FPVnnfN78qbRO8DpqjFwDOS+ZCIHh+59X34Jyi1HCse+Y
-XJ4/YIV5Aw5rGabRproxESwV01Eq4HsXEKP9TtdNDFMkrObWisb7g2M40i4QTR9/
-BNCt3d5vcnAxi2rf+CEvHQDGROZ0tTOZ20HowBA4ahMbYsfC9U+pFkq08auaoe6n
------END CERTIFICATE REQUEST-----
diff --git a/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.der b/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.der
deleted file mode 100644
index 2c17c0f935029468de10b222b2959c2409757cc9..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1123
zcmXqLVu?3sVs>A^%*4pV#Kvz@8W`AVz{|#|)#lOmotKf3o0Y*J!;ss6lZ`o)g-w{r
z&(F}%Kp({6;?ZzTNzGAkE-lJYa4bqL$xK%8%*iQD$t=xP2udwZO)N^zP;k!4FHJF2
zGf)9(Vdjzb%P%U)NG-}!@XId;(y0m|MWw|h3XXZn8Tmy9a^k#3MutX4#z1UnY!M~S
zYiwv>Y-kAO8iZ5q5>W$Th)Z~K@{<#DGV+T{^z!lyni!Rkea*<qz}&>h&j1wXVrpV!
zWLPDVXWJyBakjr<eZX7s>ABBVB-*W6u}1jZ%-5Pap2a_f988Z?w(!o|pmAh=%HxB%
zx`l$V-Xe(#-VzH>E9TCtkQThuEYn$fwcPg9iDvPV7?(}*Yd&`$%`&NKTg~y+wz6oo
znTPT{?Oi?(-b+kOnSP9O(p$Al%Xt?m%A2qqpDDg6VA?kR*>7F{?`w3|eEQk*wqmNw
zy<Tl0b|K!#GrN7Ij1N@RJ&k4yNZM52ACo)rbXLscC+l{u<~4iIbv2hgS~Ws}_ma0N
z{|mvd=Oj039=q&${gYQk(50h)`~{Og`jxNaYEO0b+_pwh`oxrjJkN!n?fd+H(cTQ7
zV<s%xfBqkSp&ZV{%*epFxQS5?7$Q;zI=~>56=YF0P;TOc2V)Z#oN0)}HZtG_spe;4
zVP;}p0S<jxRTdrtE;bHrHbz!fc4kHcS&#}o7BLo)+f@>A&1)`uoMf13^Lqa>#SfMZ
zXAI;)(#k9n24W2&?WZ>y>m5w5D}4M^+sAjw=DbVME5V6VR+xp!fWg2SW-KEki@AZR
zfiaA4z|^LmQBqQ1rLSL-3XJq*V6xRKPSsCN)CVPFP$~|}&j*U978zK8ER<&fCUgVc
z1=<TViPTw?gPewdIR}`A7#T`=XTR>ce`<Nn+<95A4Fpt#q#M7T-LT-tJ%NvTJHoB3
zHZ19pJ=i~0>9Ksbm15`9X&koA#^z}r%-?6+)z9UuYEnD+T5M-r^w)Hs1<xlx*SiwD
zqdYz?%jzbZ<f+zEHJpjO9Nk%)A2Ij5+8DaYVD_pszP#&PTuP^Mdv64<*mGZ4^YS*i
z`F0C?Klga-FMR3urR;6_bo)s4Q@f*UB9xn+Z`HMAnjgfjUoD<{V*P}#ZyRT>Jm2v9
z^{zR4X5Bx^QlV2^ynm|l`QIn)enr1yvh3rmIMvDVx4GQBh%x8x@7Dzi_uDl#^Dj8M
hx!`xKMUk>w{ns0Rwxt&}Jw2!Sb*stk#aI6+007D%nC<`o

diff --git a/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.dhp b/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.dhp
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.key b/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.key
deleted file mode 100644
index 0b6bbaa905..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.key
+++ /dev/null
@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCqFG49ghwozY+A
-r1DtF5dt5qhhPqyorBPOmespLElz+RJANcR5hA2esCjEn2TjwW0tcRFdSxRhIEsY
-ocshbZ54GxHSgxyJddV3PcrIgxd0XESyH6zzi8VqNHqGqwj1PXlyqzZII94rukzg
-7xiRZJfGCZLtJtKnDaIhHzQGx5kXslCWtg+b7UX/voFHKeXzSdshZUTejSsSBxIN
-Wcy7TRozwHp+5VsGUGKyf49cbZHLalzj5K65qw027wrVbQdbJVggDdJLJQ/oEfXO
-GbEpxtNJ1/JKeFLSxfxPEWPxTneuCodlRUm2rCEbyJTBDOcT5r7z/6K9aEzGNAQr
-/P/D6CNXAgMBAAECggEABTfYrgT/xHXbOkOmuvieLp5ODH7joPLldvX3+FpqxxSL
-EhdB7qNaaVYftYLrkaVNvKS/3BDBfk+nwr+Qmy4X8wH5m0sdpSqWfDDLAPAss53y
-zi8ZLcBJ6v3TMa5AQolfBPPFzrfzAA8GNao3IuSLoK5BqMFMmhjr+8kGS8CrGn0c
-PaMd+zNUaCo0ml7dsO+14qjeLSSzKaYl7mOHeEq02B3UDa5twvkyVQiCHV7CThF0
-0oxJ+DOFzBefPB8pIurh6X0WwaDumEQVnEaaaOWEa1IayscTSrkLcNwkZC55/23M
-k9qaR/qGnfUSpu34NTlyy7ifbJOeHp+rZDEFKgBoWQKBgQDalQKzRAjpXn9sSBQS
-aTvP293zxP5ueJnv0TmViUfadDDPZ/VX6W0n7mGuOmNKaWnjM1rvMGpqo6e65eir
-obuUe7GfJAqexUK6VDFOIzFSBqWpquyjjHWa6C4zgL+BVDGItIhQI/6wYsQ0HgLV
-R/n3nqCcYAc/a131GDGdfshbwwKBgQDHMePvhNBZo3p1vUG5l3HiTQRmeDmhlOmT
-qU5XRBPDnh5Hdkq3G34QVwaLEDapyQOnbrylVlE0a+uaB+llzw4GrFOVcRi0K8M5
-wcwI8sSgfoOyv6WKH5780I9T1EiNBDmS5XFr+dkI16+GO1LJdI5JuMoio+0WBKHk
-m3He1rik3QKBgQC1ds/vE6RyWclfk9dWEZdeUSJKpli0Tds+hWxRAM9uRNfg2GWO
-vnOomvbtNfwIYstNm+z6di9iqMsvFn+7PWIFO0uS2tEWTp2/IvZr8DuZ5XrTCNu8
-S3e3StpQV6qlK8iTvY0NO1TOCrDos6GWf1K+iCq+p9pchD5Uo+lM31xnEQKBgHSL
-+0pkEiewX/FNp4v4UTjQSTfPNiEVaMjtsZmbiljVRfAYBUU3f739vSVWejVDGLE5
-OIUgiOi8ECCSanwX9qPu5gS1JHgedt5vRnsh1+vzugi22xuCvto7CPFKbpybkTgi
-qQc9K0BiOh+2zAx09t+pkBNOiGRul26TiL+SMHy9AoGABbo9jk6Je4fcLmB9YtHT
-O8L+e2S88r/KuXGrqECD5c/FZL33oTrP9pzvL4Be2W8489DM2UMMD4w0uiUIq/Iu
-5Hp/Lsj8ha2OHoU2TbFaNFoS3fvaOz9zQ0GySjpMngZOKIoYtR9R4ZNI/hlmhAqq
-usJ3GDPcvFSsedJr8gP52QU=
------END PRIVATE KEY-----
diff --git a/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.pem b/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.pem
deleted file mode 100644
index 3751e7b601..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.pem
+++ /dev/null
@@ -1,167 +0,0 @@
-extensions = x509v3
-[ x509v3 ]
-subjectAltName = DNS:localhost,DNS:localhost1,DNS:localhost2
-keyUsage	= keyEncipherment,digitalSignature,keyAgreement
-extendedKeyUsage = serverAuth
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid
-basicConstraints = CA:false
-authorityInfoAccess     = @issuer_info
-crlDistributionPoints   = @crl_info
-
-[ crl_ext ]
-authorityKeyIdentifier  = keyid:always
-authorityInfoAccess     = @issuer_info
-
-[ issuer_info ]
-caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
-
-[ crl_info ]
-URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
-
-[ req ]
-default_bits                    = 1024
-distinguished_name              = req_DN
-default_md			= sha256
-string_mask			= utf8only
-
-[ req_DN ]
-countryName                     = "Country Name is Northern Nowhere"
-countryName_value            = NN
-organizationName              = "Organization Name"
-organizationName_value     = Edel Curl Arctic Illudium Research Cloud
-commonName                      = "Common Name"
-commonName_value              = localhost.nn
-
-[something]
-# The key
-# the certificate
-# some dhparam
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCqFG49ghwozY+A
-r1DtF5dt5qhhPqyorBPOmespLElz+RJANcR5hA2esCjEn2TjwW0tcRFdSxRhIEsY
-ocshbZ54GxHSgxyJddV3PcrIgxd0XESyH6zzi8VqNHqGqwj1PXlyqzZII94rukzg
-7xiRZJfGCZLtJtKnDaIhHzQGx5kXslCWtg+b7UX/voFHKeXzSdshZUTejSsSBxIN
-Wcy7TRozwHp+5VsGUGKyf49cbZHLalzj5K65qw027wrVbQdbJVggDdJLJQ/oEfXO
-GbEpxtNJ1/JKeFLSxfxPEWPxTneuCodlRUm2rCEbyJTBDOcT5r7z/6K9aEzGNAQr
-/P/D6CNXAgMBAAECggEABTfYrgT/xHXbOkOmuvieLp5ODH7joPLldvX3+FpqxxSL
-EhdB7qNaaVYftYLrkaVNvKS/3BDBfk+nwr+Qmy4X8wH5m0sdpSqWfDDLAPAss53y
-zi8ZLcBJ6v3TMa5AQolfBPPFzrfzAA8GNao3IuSLoK5BqMFMmhjr+8kGS8CrGn0c
-PaMd+zNUaCo0ml7dsO+14qjeLSSzKaYl7mOHeEq02B3UDa5twvkyVQiCHV7CThF0
-0oxJ+DOFzBefPB8pIurh6X0WwaDumEQVnEaaaOWEa1IayscTSrkLcNwkZC55/23M
-k9qaR/qGnfUSpu34NTlyy7ifbJOeHp+rZDEFKgBoWQKBgQDalQKzRAjpXn9sSBQS
-aTvP293zxP5ueJnv0TmViUfadDDPZ/VX6W0n7mGuOmNKaWnjM1rvMGpqo6e65eir
-obuUe7GfJAqexUK6VDFOIzFSBqWpquyjjHWa6C4zgL+BVDGItIhQI/6wYsQ0HgLV
-R/n3nqCcYAc/a131GDGdfshbwwKBgQDHMePvhNBZo3p1vUG5l3HiTQRmeDmhlOmT
-qU5XRBPDnh5Hdkq3G34QVwaLEDapyQOnbrylVlE0a+uaB+llzw4GrFOVcRi0K8M5
-wcwI8sSgfoOyv6WKH5780I9T1EiNBDmS5XFr+dkI16+GO1LJdI5JuMoio+0WBKHk
-m3He1rik3QKBgQC1ds/vE6RyWclfk9dWEZdeUSJKpli0Tds+hWxRAM9uRNfg2GWO
-vnOomvbtNfwIYstNm+z6di9iqMsvFn+7PWIFO0uS2tEWTp2/IvZr8DuZ5XrTCNu8
-S3e3StpQV6qlK8iTvY0NO1TOCrDos6GWf1K+iCq+p9pchD5Uo+lM31xnEQKBgHSL
-+0pkEiewX/FNp4v4UTjQSTfPNiEVaMjtsZmbiljVRfAYBUU3f739vSVWejVDGLE5
-OIUgiOi8ECCSanwX9qPu5gS1JHgedt5vRnsh1+vzugi22xuCvto7CPFKbpybkTgi
-qQc9K0BiOh+2zAx09t+pkBNOiGRul26TiL+SMHy9AoGABbo9jk6Je4fcLmB9YtHT
-O8L+e2S88r/KuXGrqECD5c/FZL33oTrP9pzvL4Be2W8489DM2UMMD4w0uiUIq/Iu
-5Hp/Lsj8ha2OHoU2TbFaNFoS3fvaOz9zQ0GySjpMngZOKIoYtR9R4ZNI/hlmhAqq
-usJ3GDPcvFSsedJr8gP52QU=
------END PRIVATE KEY-----
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 16717980979593 (0xf3475515189)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = Northern Nowhere Trust Anchor
-        Validity
-            Not Before: Dec 23 12:21:38 2022 GMT
-            Not After : Mar 11 12:21:38 2031 GMT
-        Subject:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = localhost.nn
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:aa:14:6e:3d:82:1c:28:cd:8f:80:af:50:ed:17:
-                    97:6d:e6:a8:61:3e:ac:a8:ac:13:ce:99:eb:29:2c:
-                    49:73:f9:12:40:35:c4:79:84:0d:9e:b0:28:c4:9f:
-                    64:e3:c1:6d:2d:71:11:5d:4b:14:61:20:4b:18:a1:
-                    cb:21:6d:9e:78:1b:11:d2:83:1c:89:75:d5:77:3d:
-                    ca:c8:83:17:74:5c:44:b2:1f:ac:f3:8b:c5:6a:34:
-                    7a:86:ab:08:f5:3d:79:72:ab:36:48:23:de:2b:ba:
-                    4c:e0:ef:18:91:64:97:c6:09:92:ed:26:d2:a7:0d:
-                    a2:21:1f:34:06:c7:99:17:b2:50:96:b6:0f:9b:ed:
-                    45:ff:be:81:47:29:e5:f3:49:db:21:65:44:de:8d:
-                    2b:12:07:12:0d:59:cc:bb:4d:1a:33:c0:7a:7e:e5:
-                    5b:06:50:62:b2:7f:8f:5c:6d:91:cb:6a:5c:e3:e4:
-                    ae:b9:ab:0d:36:ef:0a:d5:6d:07:5b:25:58:20:0d:
-                    d2:4b:25:0f:e8:11:f5:ce:19:b1:29:c6:d3:49:d7:
-                    f2:4a:78:52:d2:c5:fc:4f:11:63:f1:4e:77:ae:0a:
-                    87:65:45:49:b6:ac:21:1b:c8:94:c1:0c:e7:13:e6:
-                    be:f3:ff:a2:bd:68:4c:c6:34:04:2b:fc:ff:c3:e8:
-                    23:57
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Alternative Name: 
-                DNS:localhost, DNS:localhost1, DNS:localhost2
-            X509v3 Key Usage: 
-                Digital Signature, Key Encipherment, Key Agreement
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication
-            X509v3 Subject Key Identifier: 
-                DB:7A:18:5E:83:AC:D3:48:C9:00:99:3C:EB:BF:A6:21:F0:39:80:CC
-            X509v3 Authority Key Identifier: 
-                87:CB:B1:33:2E:C1:67:7E:71:E3:E5:2B:4C:4D:A4:B3:6E:D2:5B:A9
-            X509v3 Basic Constraints: 
-                CA:FALSE
-            Authority Information Access: 
-                CA Issuers - URI:http://test.curl.se/ca/EdelCurlRoot.cer
-            X509v3 CRL Distribution Points: 
-                Full Name:
-                  URI:http://test.curl.se/ca/EdelCurlRoot.crl
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        75:0d:9b:eb:8a:df:ca:a7:7c:9d:9e:6a:eb:30:10:24:12:1b:
-        81:f6:cd:b0:a0:f8:de:10:f1:6e:b8:57:3a:3a:b0:a4:8c:1d:
-        c1:8f:95:22:e3:1f:8b:3a:21:89:e5:96:08:3d:83:33:37:66:
-        48:03:f7:98:dd:2f:6d:09:7a:82:26:c1:eb:16:b9:5e:5b:f5:
-        67:4c:a0:e7:93:e7:2e:d4:53:b8:77:5f:5e:6a:3a:d9:06:19:
-        ca:85:ca:7c:09:61:0d:08:8b:6a:b3:e2:03:8c:ea:b1:55:b2:
-        30:9b:aa:66:0e:6e:d7:0a:0a:22:ca:6d:8d:d8:53:a8:bc:df:
-        13:29:d3:b6:1e:9f:3e:a1:8d:f3:8c:48:bf:71:e9:4e:f4:76:
-        ed:77:97:3f:59:27:ca:bb:5b:7c:58:23:82:e7:b5:2d:39:02:
-        9f:52:07:2f:7b:17:6d:c8:af:90:f5:ed:81:99:a9:cf:80:fb:
-        eb:ba:9c:bc:9a:df:c5:04:78:2c:73:73:bf:95:23:cf:fb:c9:
-        3e:fa:5b:ee:02:39:8e:09:78:ca:89:08:fd:83:77:37:72:01:
-        6c:dd:fb:eb:70:20:df:87:28:b3:0f:a0:c5:b3:70:fb:5d:38:
-        72:23:46:7f:f5:d8:fc:b6:67:72:82:e5:ce:29:f5:b5:34:db:
-        a3:d5:fe:20
------BEGIN CERTIFICATE-----
-MIIEXzCCA0egAwIBAgIGDzR1UVGJMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNVBAYT
-Ak5OMTEwLwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNo
-IENsb3VkMSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjAe
-Fw0yMjEyMjMxMjIxMzhaFw0zMTAzMTExMjIxMzhaMFcxCzAJBgNVBAYTAk5OMTEw
-LwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNoIENsb3Vk
-MRUwEwYDVQQDDAxsb2NhbGhvc3Qubm4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
-ggEKAoIBAQCqFG49ghwozY+Ar1DtF5dt5qhhPqyorBPOmespLElz+RJANcR5hA2e
-sCjEn2TjwW0tcRFdSxRhIEsYocshbZ54GxHSgxyJddV3PcrIgxd0XESyH6zzi8Vq
-NHqGqwj1PXlyqzZII94rukzg7xiRZJfGCZLtJtKnDaIhHzQGx5kXslCWtg+b7UX/
-voFHKeXzSdshZUTejSsSBxINWcy7TRozwHp+5VsGUGKyf49cbZHLalzj5K65qw02
-7wrVbQdbJVggDdJLJQ/oEfXOGbEpxtNJ1/JKeFLSxfxPEWPxTneuCodlRUm2rCEb
-yJTBDOcT5r7z/6K9aEzGNAQr/P/D6CNXAgMBAAGjggEeMIIBGjAsBgNVHREEJTAj
-gglsb2NhbGhvc3SCCmxvY2FsaG9zdDGCCmxvY2FsaG9zdDIwCwYDVR0PBAQDAgOo
-MBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1UdDgQWBBTbehheg6zTSMkAmTzrv6Yh
-8DmAzDAfBgNVHSMEGDAWgBSHy7EzLsFnfnHj5StMTaSzbtJbqTAJBgNVHRMEAjAA
-MEMGCCsGAQUFBwEBBDcwNTAzBggrBgEFBQcwAoYnaHR0cDovL3Rlc3QuY3VybC5z
-ZS9jYS9FZGVsQ3VybFJvb3QuY2VyMDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly90
-ZXN0LmN1cmwuc2UvY2EvRWRlbEN1cmxSb290LmNybDANBgkqhkiG9w0BAQsFAAOC
-AQEAdQ2b64rfyqd8nZ5q6zAQJBIbgfbNsKD43hDxbrhXOjqwpIwdwY+VIuMfizoh
-ieWWCD2DMzdmSAP3mN0vbQl6gibB6xa5Xlv1Z0yg55PnLtRTuHdfXmo62QYZyoXK
-fAlhDQiLarPiA4zqsVWyMJuqZg5u1woKIsptjdhTqLzfEynTth6fPqGN84xIv3Hp
-TvR27XeXP1knyrtbfFgjgue1LTkCn1IHL3sXbcivkPXtgZmpz4D767qcvJrfxQR4
-LHNzv5Ujz/vJPvpb7gI5jgl4yokI/YN3N3IBbN3763Ag34cosw+gxbNw+104ciNG
-f/XY/LZncoLlzin1tTTbo9X+IA==
------END CERTIFICATE-----
diff --git a/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.prm b/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.prm
deleted file mode 100644
index 911f4ce540..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.prm
+++ /dev/null
@@ -1,39 +0,0 @@
-extensions = x509v3
-[ x509v3 ]
-subjectAltName = DNS:localhost,DNS:localhost1,DNS:localhost2
-keyUsage	= keyEncipherment,digitalSignature,keyAgreement
-extendedKeyUsage = serverAuth
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid
-basicConstraints = CA:false
-authorityInfoAccess     = @issuer_info
-crlDistributionPoints   = @crl_info
-
-[ crl_ext ]
-authorityKeyIdentifier  = keyid:always
-authorityInfoAccess     = @issuer_info
-
-[ issuer_info ]
-caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
-
-[ crl_info ]
-URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
-
-[ req ]
-default_bits                    = 1024
-distinguished_name              = req_DN
-default_md			= sha256
-string_mask			= utf8only
-
-[ req_DN ]
-countryName                     = "Country Name is Northern Nowhere"
-countryName_value            = NN
-organizationName              = "Organization Name"
-organizationName_value     = Edel Curl Arctic Illudium Research Cloud
-commonName                      = "Common Name"
-commonName_value              = localhost.nn
-
-[something]
-# The key
-# the certificate
-# some dhparam
diff --git a/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.pub.der b/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.pub.der
deleted file mode 100644
index 0bb787737c3360757dd15b887d086175d2b94fe8..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 294
zcmV+>0ondAf&n5h4F(A+hDe6@4FLfG1potr0S^E$f&mHwf&l>lsuXTLf*dH#kASaG
z?H8AA=BQyltf;IL&Y9~eEJ<_u5<oS?d4vs~uqeczWaGhYEpZWDOB7)sOBkWcA#I*`
z8xhij9Eo++cRk9;gBNsMM6w^O^NYo5G<t@s2=zUAa;r8-Bi<{zOyKVrkz|*~36kw5
z(x(lgAs;jb$C($hP?ok2o9#vazJW(6<?~6~A!S6~jVlrd5)E0*yG<H1z<Pe=TLw^K
zvVV_UZIR1rT;t@fxvLE}?+Vpz2U{grAPv$>B@gHk_0AcwDaO-D*YZkuQqslzPZ4AB
sPIs;fhh;@cwyYr=$dthh=M(0>^Z%l~XiUa51S|ai!{{Sd0s{d60h#W8d;kCd

diff --git a/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.pub.pem b/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.pub.pem
deleted file mode 100644
index 4bc6c6936e..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.pub.pem
+++ /dev/null
@@ -1,9 +0,0 @@
------BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqhRuPYIcKM2PgK9Q7ReX
-beaoYT6sqKwTzpnrKSxJc/kSQDXEeYQNnrAoxJ9k48FtLXERXUsUYSBLGKHLIW2e
-eBsR0oMciXXVdz3KyIMXdFxEsh+s84vFajR6hqsI9T15cqs2SCPeK7pM4O8YkWSX
-xgmS7SbSpw2iIR80BseZF7JQlrYPm+1F/76BRynl80nbIWVE3o0rEgcSDVnMu00a
-M8B6fuVbBlBisn+PXG2Ry2pc4+SuuasNNu8K1W0HWyVYIA3SSyUP6BH1zhmxKcbT
-SdfySnhS0sX8TxFj8U53rgqHZUVJtqwhG8iUwQznE+a+8/+ivWhMxjQEK/z/w+gj
-VwIDAQAB
------END PUBLIC KEY-----
diff --git a/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.pubkey-pinned b/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.pubkey-pinned
deleted file mode 100644
index 892077d8ee..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-firstSAN-sv.pubkey-pinned
+++ /dev/null
@@ -1 +0,0 @@
-+V1rGPoCoOLZjthRz6LwtLV9Z/6Gds5LH3j8KUrCIwc=
diff --git a/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.crl b/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.crl
deleted file mode 100644
index e47a90cfd4..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.crl
+++ /dev/null
@@ -1,15 +0,0 @@
------BEGIN X509 CRL-----
-MIICQTCCASkCAQEwDQYJKoZIhvcNAQELBQAwaDELMAkGA1UEBhMCTk4xMTAvBgNV
-BAoMKEVkZWwgQ3VybCBBcmN0aWMgSWxsdWRpdW0gUmVzZWFyY2ggQ2xvdWQxJjAk
-BgNVBAMMHU5vcnRoZXJuIE5vd2hlcmUgVHJ1c3QgQW5jaG9yFw0yMjEyMjMxMjIx
-MzhaFw0yMzAxMjIxMjIxMzhaMH0wFwIGDzR1USo8Fw0yMjEyMjMxMjIxMzZaMBcC
-Bg80dVFRYRcNMjIxMjIzMTIyMTM3WjAXAgYPNHVRUXUXDTIyMTIyMzEyMjEzN1ow
-FwIGDzR1UVGJFw0yMjEyMjMxMjIxMzhaMBcCBg80dVF4rhcNMjIxMjIzMTIyMTM4
-WqAOMAwwCgYDVR0UBAMCAQEwDQYJKoZIhvcNAQELBQADggEBADZeuue7woDyqDdc
-DCxuNE94pNl78cTedT+V9svX0gbMExAI0WRovb9FudimX+CRofFTwZ4RSDF7AdHw
-PqbVSMjZtGTlQrKrMAZ5kBMs9ZI1tWGpGVJNxv4hKMt2VITLPJ22CP8j3yZahNpw
-/kgJQx+7aIRKTC1n6UEAsOsLyDsrFDvdXU2euU0NIx6KudeRUagdgyOntwrLaeeW
-+g18IZTewQWefx4iA6eW6y3E9CM0n3d4n7VAxLb95TysLAUoxOeVxtUSa+wm8jWt
-gjm/2UkFxX79dDhDMc5LsL9mBDL3dasunhcUCtI5CTL1aX2Fg2YkztsyQiO0lNx/
-meUHDNM=
------END X509 CRL-----
diff --git a/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.crt b/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.crt
deleted file mode 100644
index ec37cf15aa..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.crt
+++ /dev/null
@@ -1,100 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 16717980989614 (0xf34755178ae)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = Northern Nowhere Trust Anchor
-        Validity
-            Not Before: Dec 23 12:21:38 2022 GMT
-            Not After : Mar 11 12:21:38 2031 GMT
-        Subject:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = localhost.nn
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:c8:84:fe:69:64:33:c3:dc:b5:74:8a:c7:b2:bb:
-                    d9:69:e2:a9:95:6d:5f:b7:25:e6:82:00:2b:f5:53:
-                    21:e7:28:ae:66:b6:38:fd:15:b1:91:88:52:31:29:
-                    bb:73:e2:e0:99:62:95:44:35:51:d7:54:c8:d2:6d:
-                    25:3c:f0:2e:03:1b:a8:a1:25:e1:83:9a:5c:bd:65:
-                    57:93:44:7e:a3:cc:dd:ac:59:69:60:01:e0:80:b9:
-                    d0:c4:70:63:cf:17:a0:c6:13:0f:21:3b:c8:c1:46:
-                    4e:18:fd:6a:36:76:24:4a:57:d8:73:2f:13:42:a0:
-                    2e:90:1f:bf:84:9d:81:e7:bd:f8:75:53:f3:fa:52:
-                    e1:f0:aa:f6:23:d7:0d:61:17:0c:e5:9a:ab:e2:d5:
-                    e8:c3:c9:6b:2a:a6:da:f9:cb:f6:4d:1d:40:53:7e:
-                    68:2f:51:9f:d3:17:95:34:21:32:0d:47:d6:a9:4d:
-                    28:bb:e0:50:13:2f:5b:76:a1:90:5a:51:48:2f:ce:
-                    db:d9:da:2e:d1:3a:0f:fb:80:61:24:0b:0b:79:b2:
-                    45:cd:1d:2d:66:ee:4a:96:5d:08:b7:c4:80:95:2d:
-                    4e:8e:ac:0e:15:fa:2c:06:0c:49:74:49:81:77:17:
-                    a5:b2:01:de:aa:88:2b:9a:66:13:bb:06:b4:89:fb:
-                    e4:91
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Alternative Name: 
-                DNS:localhost1, DNS:localhost2, DNS:localhost
-            X509v3 Key Usage: 
-                Digital Signature, Key Encipherment, Key Agreement
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication
-            X509v3 Subject Key Identifier: 
-                B3:77:93:C4:CA:9A:B3:62:CF:51:0D:17:1D:8E:87:F6:C2:3E:17:75
-            X509v3 Authority Key Identifier: 
-                87:CB:B1:33:2E:C1:67:7E:71:E3:E5:2B:4C:4D:A4:B3:6E:D2:5B:A9
-            X509v3 Basic Constraints: 
-                CA:FALSE
-            Authority Information Access: 
-                CA Issuers - URI:http://test.curl.se/ca/EdelCurlRoot.cer
-            X509v3 CRL Distribution Points: 
-                Full Name:
-                  URI:http://test.curl.se/ca/EdelCurlRoot.crl
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        10:22:60:56:f6:14:b7:03:18:c4:01:ba:06:c7:65:49:98:d7:
-        64:64:d4:2a:2b:19:16:d1:0e:e9:b0:04:86:01:fb:ae:37:e4:
-        c9:19:37:d5:02:27:63:da:6f:de:a2:d0:23:36:7f:2f:3e:55:
-        d2:b5:ef:23:5d:f7:ac:71:3f:95:77:bc:74:d3:1e:51:d9:7d:
-        7e:0d:8e:03:f3:82:95:3e:88:dd:3c:ed:3a:aa:b4:e1:85:fb:
-        d8:ea:3f:6a:7d:34:b7:b3:df:b1:fe:2b:ec:af:e0:1c:9c:ec:
-        43:63:80:17:3a:32:ca:13:35:2d:c7:3d:3e:ac:aa:55:d6:1a:
-        6d:3f:f0:ff:23:4f:e0:88:a1:42:d9:91:1c:a5:6b:87:14:1b:
-        0b:4d:24:a8:33:36:7a:21:f7:e2:86:9c:65:36:f3:7c:0c:4d:
-        be:f1:98:45:c3:27:e4:11:4a:7d:8a:e3:70:ae:fb:ac:9f:a6:
-        f4:0d:dc:a7:83:39:50:c3:1e:1a:95:68:0d:b0:56:8f:64:d2:
-        db:a1:a7:97:d1:2c:ea:7a:f9:9b:2f:5f:4d:ed:7c:f9:df:74:
-        1a:81:73:79:f8:00:2a:78:18:23:72:7a:4b:66:6b:61:da:95:
-        29:85:7c:4d:42:76:2e:43:70:6d:ac:0c:dc:98:d5:47:da:e1:
-        54:0c:71:bf
------BEGIN CERTIFICATE-----
-MIIEXzCCA0egAwIBAgIGDzR1UXiuMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNVBAYT
-Ak5OMTEwLwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNo
-IENsb3VkMSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjAe
-Fw0yMjEyMjMxMjIxMzhaFw0zMTAzMTExMjIxMzhaMFcxCzAJBgNVBAYTAk5OMTEw
-LwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNoIENsb3Vk
-MRUwEwYDVQQDDAxsb2NhbGhvc3Qubm4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
-ggEKAoIBAQDIhP5pZDPD3LV0iseyu9lp4qmVbV+3JeaCACv1UyHnKK5mtjj9FbGR
-iFIxKbtz4uCZYpVENVHXVMjSbSU88C4DG6ihJeGDmly9ZVeTRH6jzN2sWWlgAeCA
-udDEcGPPF6DGEw8hO8jBRk4Y/Wo2diRKV9hzLxNCoC6QH7+EnYHnvfh1U/P6UuHw
-qvYj1w1hFwzlmqvi1ejDyWsqptr5y/ZNHUBTfmgvUZ/TF5U0ITINR9apTSi74FAT
-L1t2oZBaUUgvztvZ2i7ROg/7gGEkCwt5skXNHS1m7kqWXQi3xICVLU6OrA4V+iwG
-DEl0SYF3F6WyAd6qiCuaZhO7BrSJ++SRAgMBAAGjggEeMIIBGjAsBgNVHREEJTAj
-ggpsb2NhbGhvc3Qxggpsb2NhbGhvc3Qygglsb2NhbGhvc3QwCwYDVR0PBAQDAgOo
-MBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1UdDgQWBBSzd5PEypqzYs9RDRcdjof2
-wj4XdTAfBgNVHSMEGDAWgBSHy7EzLsFnfnHj5StMTaSzbtJbqTAJBgNVHRMEAjAA
-MEMGCCsGAQUFBwEBBDcwNTAzBggrBgEFBQcwAoYnaHR0cDovL3Rlc3QuY3VybC5z
-ZS9jYS9FZGVsQ3VybFJvb3QuY2VyMDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly90
-ZXN0LmN1cmwuc2UvY2EvRWRlbEN1cmxSb290LmNybDANBgkqhkiG9w0BAQsFAAOC
-AQEAECJgVvYUtwMYxAG6BsdlSZjXZGTUKisZFtEO6bAEhgH7rjfkyRk31QInY9pv
-3qLQIzZ/Lz5V0rXvI133rHE/lXe8dNMeUdl9fg2OA/OClT6I3TztOqq04YX72Oo/
-an00t7Pfsf4r7K/gHJzsQ2OAFzoyyhM1Lcc9PqyqVdYabT/w/yNP4IihQtmRHKVr
-hxQbC00kqDM2eiH34oacZTbzfAxNvvGYRcMn5BFKfYrjcK77rJ+m9A3cp4M5UMMe
-GpVoDbBWj2TS26Gnl9Es6nr5my9fTe18+d90GoFzefgAKngYI3J6S2ZrYdqVKYV8
-TUJ2LkNwbawM3JjVR9rhVAxxvw==
------END CERTIFICATE-----
diff --git a/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.csr b/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.csr
deleted file mode 100644
index ec930784d9..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.csr
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN CERTIFICATE REQUEST-----
-MIICnDCCAYQCAQAwVzELMAkGA1UEBhMCTk4xMTAvBgNVBAoMKEVkZWwgQ3VybCBB
-cmN0aWMgSWxsdWRpdW0gUmVzZWFyY2ggQ2xvdWQxFTATBgNVBAMMDGxvY2FsaG9z
-dC5ubjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMiE/mlkM8PctXSK
-x7K72WniqZVtX7cl5oIAK/VTIecorma2OP0VsZGIUjEpu3Pi4JlilUQ1UddUyNJt
-JTzwLgMbqKEl4YOaXL1lV5NEfqPM3axZaWAB4IC50MRwY88XoMYTDyE7yMFGThj9
-ajZ2JEpX2HMvE0KgLpAfv4Sdgee9+HVT8/pS4fCq9iPXDWEXDOWaq+LV6MPJayqm
-2vnL9k0dQFN+aC9Rn9MXlTQhMg1H1qlNKLvgUBMvW3ahkFpRSC/O29naLtE6D/uA
-YSQLC3myRc0dLWbuSpZdCLfEgJUtTo6sDhX6LAYMSXRJgXcXpbIB3qqIK5pmE7sG
-tIn75JECAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQCeDxLX9uy0Fv7yaY/gqL/G
-x+TFx7xoKOJwqu3NqrGiTfs6SeXvmxIj5oOE2gBi9cjc184TUa/zHSW+iYug2RVO
-f18zO3sOUXeFLN10f1OEgkOEm6k9I4MuWhEJuCY0FePAl6i71b4iy2O6n0CxLNKB
-D+IM8MBOjx18Ev+BETXmf2R6zyQaVY+VP541XRtcCwcMU9IV92CilhfHjPJy3g4V
-7mQIcvgdpQMuQLsBvMY+yFRUwRpWiPjOOot5q6bQKgA5pcRU7UtraqLzT7gG9cF2
-SDN2y9A05EWYZB7/hlg+URdJKjrCLn20i5BR52VVepLDWUOCBafkdCOp1O6JTRK2
------END CERTIFICATE REQUEST-----
diff --git a/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.der b/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.der
deleted file mode 100644
index c4706a58e71c3f07ef8fbf4c09cf14f587e5381b..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1123
zcmXqLVu?3sVs>A^%*4pV#Kvz@8d$N;fR~L^tIebBJ1-+6H!Fidh9S2BCmVAp3!5;L
zpP!+jfj)@C#iQYxlA5F7Tw0W);8>Jgl9{aFnUhnRl3ALo5R_V+npl*aq2Qd8Uz%d5
zW}pJn!ptM<mtRzpky@0e;Fn(xq*E0_ib{)16dd!CGxCcJ<ivT6j0}y8jDgtD*dj`t
z*Vxd&*w7HlH3+BJC87qx5SQ@e<R>TQWaJl@=;h@ZG%+e6`<juJfw_s1p8+V&#ni;e
z$Z(?NUuKH&;X7MPx{hz!eKYgX%Bi{W+f|=6F=&4cR(!6pE^V8|U(t;dJAw=~cNaf;
zFf(bYi)rBXkQ0}3Rc$`#F-xylsQR#ZR?Obi@X0Q9i_hF$6PcO7_@H6ug(C&Y=fxKs
z6XsX6K5@{^PvUQuS(%Dg_>E$HVW$Op6Xf@|%x!$W_eW{)=U+h&Kdkzue4RH@oagDR
z)sL>eID9f&YuT-zr@#5iIt15c=m*ZfEI!pl(TLam+Dc!I-46nU^`pxcPKXNh&_8$k
z<}JO8R{Xyk5>>dlD>u2GmDNpq=QS;sWBZYYsk(lBYxqQe>9Fy5mUuRni!a^8cyCpQ
z_N+AF-E3Pre?OVX#LURRxVVW?4j3X*20FkXloe!AHBfHif(N4^65FVW6E1GR4N}d|
z!otkNyaF8hvZ^dR23%|$+H8!htnAE;2C^U(d@N!tBAd%6A2~H^bJF=hUUAvJ_HT#m
z#7hn2LDI@B5(Z)oBJHO)8tWZQuPc1~RNKdQ$>zLE(JR4;Q&yOT$$-JY8D=aaBa69#
zsev(!Z@|>1o>5X#V5P5Lk_wFUWMHz@D^Ar<PSgh_V^As%%FhRirxqDlfGm_}0VZ?<
z-38hUG>Oz%l!KgxfH?=4h8P(HloG<eiEL+<IKsG#?Rcu^jO!^WSG2Sx#V+!_+`!Vt
z_<NoClarF>SDDn4Z{^=xbV1pyUf(YC($@FNvESDe+D|RtQ*v1@@MditZy)pLrm1!v
zcWvHUt=jUi_4kce_F1(i+c)3e_)q)I`Uf&|-Z&>Wh+7$*5;oO6Zfmz@Rp>RTT>B6I
zmHi)dEOfd#QD$j&yNEQmugVHzvns{!kJ{#>ntiU}@!j`vhU;PVCxTwJU5^Xa{a!PF
z*%#hB%bP6&4$DbR&EVY-)}M0e_QK`UFY3Ii`Z-%a-uG?I&-*1(jm4Ee7_=%Rl#8mo
h)3Ot9P1S6z@pUTGb1ukT!*gfGRrgyDLwE}J0|2W|mahN+

diff --git a/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.dhp b/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.dhp
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.key b/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.key
deleted file mode 100644
index 7a5d854fb1..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.key
+++ /dev/null
@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDIhP5pZDPD3LV0
-iseyu9lp4qmVbV+3JeaCACv1UyHnKK5mtjj9FbGRiFIxKbtz4uCZYpVENVHXVMjS
-bSU88C4DG6ihJeGDmly9ZVeTRH6jzN2sWWlgAeCAudDEcGPPF6DGEw8hO8jBRk4Y
-/Wo2diRKV9hzLxNCoC6QH7+EnYHnvfh1U/P6UuHwqvYj1w1hFwzlmqvi1ejDyWsq
-ptr5y/ZNHUBTfmgvUZ/TF5U0ITINR9apTSi74FATL1t2oZBaUUgvztvZ2i7ROg/7
-gGEkCwt5skXNHS1m7kqWXQi3xICVLU6OrA4V+iwGDEl0SYF3F6WyAd6qiCuaZhO7
-BrSJ++SRAgMBAAECggEAApUDLABsPI6EGqj/1dDJRa2zcSxm92DfpUG9zytVIYN6
-rXFqw0g10LyF5xf/uogLzDCCtg25YlG3QqMWVUDNguDmt2kutycJddnkemMUfg+m
-X3CzpJbEQ+bApgrsH2+micPB5d5odnlX35wByQuVP4zT3sssJGc+JOvNEkwvRE3o
-0x+B7qnW5YWDA9X67Sb9Kgcg9xExC7lbUqQoDetpa6x36LVx2OCqmomIKf8CQqHr
-FOOTKNkTs6mal3jxxxwvLmj7Bkz+InSIRK0VE9d5G2VWliwcRMVjB9c5oh/P6Le3
-/jCyi18omkMgQK0Hm6CJBjsT+PdJu09hbo1TXD8cbQKBgQD8CwQNzHSolSUoKMpd
-SfsAIB5gjILns7xAAtemkHEn15ga6p7510wtvkWAzOqBtt3RrTqb/AoWKUkHwfRd
-AYFE1RrGVUA0Yohuf4eJFjAXuEQXNKx2uuHIpwEf0UpfiyAFLzDyUmTjMHLw15ZP
-OrhIHJBRfWiU9nWIScNZC4/A7QKBgQDLquZxndjls3h/LotU62CcjZSqU59Wbhfs
-VoGDgvj5jxxdcy4u7BntYYBKsaIL7k/Q6vyrNWnQoUgazhIqJ3RJ2p3OzaCLjKY8
-7+vf8F1bSZL+VbHTJZfuPKKShGlIfZ0ixjuP0vEUh+xblEwsmgNN4XOc/M/mVyid
-qek2xFPRtQKBgA8SXZCxrDw0hv9KyScg+Gh+gzKE1IMkhVpSkTC9rHaUdt0NMKqC
-DGUj3qYgGtnc5JDYSgvv226N03cqSwGQyHkkQTChAnDff4cUCzfQYtnYRAIbPUDw
-VfYYvoF3k3n5KNYGh2fGM5A+YnEygyODwGdXhe3JkQpvXoHi31Kg1VzVAoGBAKGa
-JCmopq50PjskElg6P7lYucqAeaCZ0I+tgCx6otVZ0ZbwyodevZ/WSnZ6BetTl69c
-lUnAIwrwvgbO1ijuj13+glLSY/32hv05Hb7duSWy9liqZGP2o1vcbt61A9kKGsG5
-6w7OwI2a4Fc2D08gkVideB/rlYbeR5L6e9sB4sQ1AoGAcLMiz2/cF40/pMhqq/C/
-SyFDa1OAquW00PujVrTbgIHY+2HdjaIlzwNVFWIY/K7LCJtLvK6mVCVbo1n7/Agp
-qYZZzPEUwJ84ZY1ZNxC0Z89dBFmJeFvyNSan9zGujye7Kx8QctCvn5DzjoWtA52k
-MvALyxOMqzvGI5bC4r1o3Hw=
------END PRIVATE KEY-----
diff --git a/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.pem b/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.pem
deleted file mode 100644
index b1cbd4b6b2..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.pem
+++ /dev/null
@@ -1,166 +0,0 @@
-extensions = x509v3
-[ x509v3 ]
-subjectAltName = DNS:localhost1,DNS:localhost2,DNS:localhost
-keyUsage	= keyEncipherment,digitalSignature,keyAgreement
-extendedKeyUsage = serverAuth
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid
-basicConstraints = CA:false
-authorityInfoAccess     = @issuer_info
-crlDistributionPoints   = @crl_info
-
-[ crl_ext ]
-authorityKeyIdentifier  = keyid:always
-authorityInfoAccess     = @issuer_info
-
-[ issuer_info ]
-caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
-
-[ crl_info ]
-URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
-
-[ req ]
-default_bits                    = 1024
-distinguished_name              = req_DN
-default_md			= sha256
-string_mask			= utf8only
-[ req_DN ]
-countryName                     = "Country Name is Northern Nowhere"
-countryName_value            = NN
-organizationName              = "Organization Name"
-organizationName_value     = Edel Curl Arctic Illudium Research Cloud
-commonName                      = "Common Name"
-commonName_value              = localhost.nn
-
-[something]
-# The key
-# the certificate
-# some dhparam
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDIhP5pZDPD3LV0
-iseyu9lp4qmVbV+3JeaCACv1UyHnKK5mtjj9FbGRiFIxKbtz4uCZYpVENVHXVMjS
-bSU88C4DG6ihJeGDmly9ZVeTRH6jzN2sWWlgAeCAudDEcGPPF6DGEw8hO8jBRk4Y
-/Wo2diRKV9hzLxNCoC6QH7+EnYHnvfh1U/P6UuHwqvYj1w1hFwzlmqvi1ejDyWsq
-ptr5y/ZNHUBTfmgvUZ/TF5U0ITINR9apTSi74FATL1t2oZBaUUgvztvZ2i7ROg/7
-gGEkCwt5skXNHS1m7kqWXQi3xICVLU6OrA4V+iwGDEl0SYF3F6WyAd6qiCuaZhO7
-BrSJ++SRAgMBAAECggEAApUDLABsPI6EGqj/1dDJRa2zcSxm92DfpUG9zytVIYN6
-rXFqw0g10LyF5xf/uogLzDCCtg25YlG3QqMWVUDNguDmt2kutycJddnkemMUfg+m
-X3CzpJbEQ+bApgrsH2+micPB5d5odnlX35wByQuVP4zT3sssJGc+JOvNEkwvRE3o
-0x+B7qnW5YWDA9X67Sb9Kgcg9xExC7lbUqQoDetpa6x36LVx2OCqmomIKf8CQqHr
-FOOTKNkTs6mal3jxxxwvLmj7Bkz+InSIRK0VE9d5G2VWliwcRMVjB9c5oh/P6Le3
-/jCyi18omkMgQK0Hm6CJBjsT+PdJu09hbo1TXD8cbQKBgQD8CwQNzHSolSUoKMpd
-SfsAIB5gjILns7xAAtemkHEn15ga6p7510wtvkWAzOqBtt3RrTqb/AoWKUkHwfRd
-AYFE1RrGVUA0Yohuf4eJFjAXuEQXNKx2uuHIpwEf0UpfiyAFLzDyUmTjMHLw15ZP
-OrhIHJBRfWiU9nWIScNZC4/A7QKBgQDLquZxndjls3h/LotU62CcjZSqU59Wbhfs
-VoGDgvj5jxxdcy4u7BntYYBKsaIL7k/Q6vyrNWnQoUgazhIqJ3RJ2p3OzaCLjKY8
-7+vf8F1bSZL+VbHTJZfuPKKShGlIfZ0ixjuP0vEUh+xblEwsmgNN4XOc/M/mVyid
-qek2xFPRtQKBgA8SXZCxrDw0hv9KyScg+Gh+gzKE1IMkhVpSkTC9rHaUdt0NMKqC
-DGUj3qYgGtnc5JDYSgvv226N03cqSwGQyHkkQTChAnDff4cUCzfQYtnYRAIbPUDw
-VfYYvoF3k3n5KNYGh2fGM5A+YnEygyODwGdXhe3JkQpvXoHi31Kg1VzVAoGBAKGa
-JCmopq50PjskElg6P7lYucqAeaCZ0I+tgCx6otVZ0ZbwyodevZ/WSnZ6BetTl69c
-lUnAIwrwvgbO1ijuj13+glLSY/32hv05Hb7duSWy9liqZGP2o1vcbt61A9kKGsG5
-6w7OwI2a4Fc2D08gkVideB/rlYbeR5L6e9sB4sQ1AoGAcLMiz2/cF40/pMhqq/C/
-SyFDa1OAquW00PujVrTbgIHY+2HdjaIlzwNVFWIY/K7LCJtLvK6mVCVbo1n7/Agp
-qYZZzPEUwJ84ZY1ZNxC0Z89dBFmJeFvyNSan9zGujye7Kx8QctCvn5DzjoWtA52k
-MvALyxOMqzvGI5bC4r1o3Hw=
------END PRIVATE KEY-----
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 16717980989614 (0xf34755178ae)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = Northern Nowhere Trust Anchor
-        Validity
-            Not Before: Dec 23 12:21:38 2022 GMT
-            Not After : Mar 11 12:21:38 2031 GMT
-        Subject:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = localhost.nn
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:c8:84:fe:69:64:33:c3:dc:b5:74:8a:c7:b2:bb:
-                    d9:69:e2:a9:95:6d:5f:b7:25:e6:82:00:2b:f5:53:
-                    21:e7:28:ae:66:b6:38:fd:15:b1:91:88:52:31:29:
-                    bb:73:e2:e0:99:62:95:44:35:51:d7:54:c8:d2:6d:
-                    25:3c:f0:2e:03:1b:a8:a1:25:e1:83:9a:5c:bd:65:
-                    57:93:44:7e:a3:cc:dd:ac:59:69:60:01:e0:80:b9:
-                    d0:c4:70:63:cf:17:a0:c6:13:0f:21:3b:c8:c1:46:
-                    4e:18:fd:6a:36:76:24:4a:57:d8:73:2f:13:42:a0:
-                    2e:90:1f:bf:84:9d:81:e7:bd:f8:75:53:f3:fa:52:
-                    e1:f0:aa:f6:23:d7:0d:61:17:0c:e5:9a:ab:e2:d5:
-                    e8:c3:c9:6b:2a:a6:da:f9:cb:f6:4d:1d:40:53:7e:
-                    68:2f:51:9f:d3:17:95:34:21:32:0d:47:d6:a9:4d:
-                    28:bb:e0:50:13:2f:5b:76:a1:90:5a:51:48:2f:ce:
-                    db:d9:da:2e:d1:3a:0f:fb:80:61:24:0b:0b:79:b2:
-                    45:cd:1d:2d:66:ee:4a:96:5d:08:b7:c4:80:95:2d:
-                    4e:8e:ac:0e:15:fa:2c:06:0c:49:74:49:81:77:17:
-                    a5:b2:01:de:aa:88:2b:9a:66:13:bb:06:b4:89:fb:
-                    e4:91
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Alternative Name: 
-                DNS:localhost1, DNS:localhost2, DNS:localhost
-            X509v3 Key Usage: 
-                Digital Signature, Key Encipherment, Key Agreement
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication
-            X509v3 Subject Key Identifier: 
-                B3:77:93:C4:CA:9A:B3:62:CF:51:0D:17:1D:8E:87:F6:C2:3E:17:75
-            X509v3 Authority Key Identifier: 
-                87:CB:B1:33:2E:C1:67:7E:71:E3:E5:2B:4C:4D:A4:B3:6E:D2:5B:A9
-            X509v3 Basic Constraints: 
-                CA:FALSE
-            Authority Information Access: 
-                CA Issuers - URI:http://test.curl.se/ca/EdelCurlRoot.cer
-            X509v3 CRL Distribution Points: 
-                Full Name:
-                  URI:http://test.curl.se/ca/EdelCurlRoot.crl
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        10:22:60:56:f6:14:b7:03:18:c4:01:ba:06:c7:65:49:98:d7:
-        64:64:d4:2a:2b:19:16:d1:0e:e9:b0:04:86:01:fb:ae:37:e4:
-        c9:19:37:d5:02:27:63:da:6f:de:a2:d0:23:36:7f:2f:3e:55:
-        d2:b5:ef:23:5d:f7:ac:71:3f:95:77:bc:74:d3:1e:51:d9:7d:
-        7e:0d:8e:03:f3:82:95:3e:88:dd:3c:ed:3a:aa:b4:e1:85:fb:
-        d8:ea:3f:6a:7d:34:b7:b3:df:b1:fe:2b:ec:af:e0:1c:9c:ec:
-        43:63:80:17:3a:32:ca:13:35:2d:c7:3d:3e:ac:aa:55:d6:1a:
-        6d:3f:f0:ff:23:4f:e0:88:a1:42:d9:91:1c:a5:6b:87:14:1b:
-        0b:4d:24:a8:33:36:7a:21:f7:e2:86:9c:65:36:f3:7c:0c:4d:
-        be:f1:98:45:c3:27:e4:11:4a:7d:8a:e3:70:ae:fb:ac:9f:a6:
-        f4:0d:dc:a7:83:39:50:c3:1e:1a:95:68:0d:b0:56:8f:64:d2:
-        db:a1:a7:97:d1:2c:ea:7a:f9:9b:2f:5f:4d:ed:7c:f9:df:74:
-        1a:81:73:79:f8:00:2a:78:18:23:72:7a:4b:66:6b:61:da:95:
-        29:85:7c:4d:42:76:2e:43:70:6d:ac:0c:dc:98:d5:47:da:e1:
-        54:0c:71:bf
------BEGIN CERTIFICATE-----
-MIIEXzCCA0egAwIBAgIGDzR1UXiuMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNVBAYT
-Ak5OMTEwLwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNo
-IENsb3VkMSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjAe
-Fw0yMjEyMjMxMjIxMzhaFw0zMTAzMTExMjIxMzhaMFcxCzAJBgNVBAYTAk5OMTEw
-LwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNoIENsb3Vk
-MRUwEwYDVQQDDAxsb2NhbGhvc3Qubm4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
-ggEKAoIBAQDIhP5pZDPD3LV0iseyu9lp4qmVbV+3JeaCACv1UyHnKK5mtjj9FbGR
-iFIxKbtz4uCZYpVENVHXVMjSbSU88C4DG6ihJeGDmly9ZVeTRH6jzN2sWWlgAeCA
-udDEcGPPF6DGEw8hO8jBRk4Y/Wo2diRKV9hzLxNCoC6QH7+EnYHnvfh1U/P6UuHw
-qvYj1w1hFwzlmqvi1ejDyWsqptr5y/ZNHUBTfmgvUZ/TF5U0ITINR9apTSi74FAT
-L1t2oZBaUUgvztvZ2i7ROg/7gGEkCwt5skXNHS1m7kqWXQi3xICVLU6OrA4V+iwG
-DEl0SYF3F6WyAd6qiCuaZhO7BrSJ++SRAgMBAAGjggEeMIIBGjAsBgNVHREEJTAj
-ggpsb2NhbGhvc3Qxggpsb2NhbGhvc3Qygglsb2NhbGhvc3QwCwYDVR0PBAQDAgOo
-MBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1UdDgQWBBSzd5PEypqzYs9RDRcdjof2
-wj4XdTAfBgNVHSMEGDAWgBSHy7EzLsFnfnHj5StMTaSzbtJbqTAJBgNVHRMEAjAA
-MEMGCCsGAQUFBwEBBDcwNTAzBggrBgEFBQcwAoYnaHR0cDovL3Rlc3QuY3VybC5z
-ZS9jYS9FZGVsQ3VybFJvb3QuY2VyMDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly90
-ZXN0LmN1cmwuc2UvY2EvRWRlbEN1cmxSb290LmNybDANBgkqhkiG9w0BAQsFAAOC
-AQEAECJgVvYUtwMYxAG6BsdlSZjXZGTUKisZFtEO6bAEhgH7rjfkyRk31QInY9pv
-3qLQIzZ/Lz5V0rXvI133rHE/lXe8dNMeUdl9fg2OA/OClT6I3TztOqq04YX72Oo/
-an00t7Pfsf4r7K/gHJzsQ2OAFzoyyhM1Lcc9PqyqVdYabT/w/yNP4IihQtmRHKVr
-hxQbC00kqDM2eiH34oacZTbzfAxNvvGYRcMn5BFKfYrjcK77rJ+m9A3cp4M5UMMe
-GpVoDbBWj2TS26Gnl9Es6nr5my9fTe18+d90GoFzefgAKngYI3J6S2ZrYdqVKYV8
-TUJ2LkNwbawM3JjVR9rhVAxxvw==
------END CERTIFICATE-----
diff --git a/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.prm b/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.prm
deleted file mode 100644
index c5e72f4542..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.prm
+++ /dev/null
@@ -1,38 +0,0 @@
-extensions = x509v3
-[ x509v3 ]
-subjectAltName = DNS:localhost1,DNS:localhost2,DNS:localhost
-keyUsage	= keyEncipherment,digitalSignature,keyAgreement
-extendedKeyUsage = serverAuth
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid
-basicConstraints = CA:false
-authorityInfoAccess     = @issuer_info
-crlDistributionPoints   = @crl_info
-
-[ crl_ext ]
-authorityKeyIdentifier  = keyid:always
-authorityInfoAccess     = @issuer_info
-
-[ issuer_info ]
-caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
-
-[ crl_info ]
-URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
-
-[ req ]
-default_bits                    = 1024
-distinguished_name              = req_DN
-default_md			= sha256
-string_mask			= utf8only
-[ req_DN ]
-countryName                     = "Country Name is Northern Nowhere"
-countryName_value            = NN
-organizationName              = "Organization Name"
-organizationName_value     = Edel Curl Arctic Illudium Research Cloud
-commonName                      = "Common Name"
-commonName_value              = localhost.nn
-
-[something]
-# The key
-# the certificate
-# some dhparam
diff --git a/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.pub.der b/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.pub.der
deleted file mode 100644
index fc61b6de96f3685d667ea2cbb1a399024d16cf78..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 294
zcmV+>0ondAf&n5h4F(A+hDe6@4FLfG1potr0S^E$f&mHwf&l>l$b|lBWHZCuwRDQd
zvb))7;;EHwU$-UZf&eS^Qz7Rlu4cA4{S~p1h*B{ryK~~;nPQbhHBr}8$kJ^kJn$|9
z8>pcr;e(o7y=7OEM1G^p-K<$@U;*HOxzNOLW6u|$#uE=AJIKLCP8j`aHg+URSJ-ne
z6GEUakRQK<oq^}Q_;pkB`cmQWs`ew-4Ph4y<(jMF)#$^?YbvJN`OEfA9Y9llXfIKp
z(-)OAAu<g|)~QV>yWmh0FI#q@kXlhlFV5T9+Ah&L5Bq>&Bnu09vPI1uEoSaYmR$(9
s#DJA8PL8Y&75Xd&3`ulJfp-_BvH{+zh%1_A6T1eqiTmV{0s{d60j`gN&j0`b

diff --git a/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.pub.pem b/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.pub.pem
deleted file mode 100644
index 3644fd9a94..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.pub.pem
+++ /dev/null
@@ -1,9 +0,0 @@
------BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyIT+aWQzw9y1dIrHsrvZ
-aeKplW1ftyXmggAr9VMh5yiuZrY4/RWxkYhSMSm7c+LgmWKVRDVR11TI0m0lPPAu
-AxuooSXhg5pcvWVXk0R+o8zdrFlpYAHggLnQxHBjzxegxhMPITvIwUZOGP1qNnYk
-SlfYcy8TQqAukB+/hJ2B5734dVPz+lLh8Kr2I9cNYRcM5Zqr4tXow8lrKqba+cv2
-TR1AU35oL1Gf0xeVNCEyDUfWqU0ou+BQEy9bdqGQWlFIL87b2dou0ToP+4BhJAsL
-ebJFzR0tZu5Kll0It8SAlS1OjqwOFfosBgxJdEmBdxelsgHeqogrmmYTuwa0ifvk
-kQIDAQAB
------END PUBLIC KEY-----
diff --git a/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.pubkey-pinned b/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.pubkey-pinned
deleted file mode 100644
index bcb4d42535..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-lastSAN-sv.pubkey-pinned
+++ /dev/null
@@ -1 +0,0 @@
-1iO+QG+cArKLLyo3az2OBu0lM1t8v5bLLI3pNXoJJQ0=
diff --git a/third-party/curl/tests/certs/Server-localhost-sv.crl b/third-party/curl/tests/certs/Server-localhost-sv.crl
deleted file mode 100644
index d10b90c4c8..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-sv.crl
+++ /dev/null
@@ -1,12 +0,0 @@
------BEGIN X509 CRL-----
-MIIB3DCBxQIBATANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJOTjExMC8GA1UE
-CgwoRWRlbCBDdXJsIEFyY3RpYyBJbGx1ZGl1bSBSZXNlYXJjaCBDbG91ZDEmMCQG
-A1UEAwwdTm9ydGhlcm4gTm93aGVyZSBUcnVzdCBBbmNob3IXDTIyMTIyMzEyMjEz
-NloXDTIzMDEyMjEyMjEzNlowGTAXAgYPNHVRKjwXDTIyMTIyMzEyMjEzNlqgDjAM
-MAoGA1UdFAQDAgEBMA0GCSqGSIb3DQEBCwUAA4IBAQBU6nAPnIyD/G6eK21pfHeh
-myCoBy+B9b8R1Ed1Y3YDoWS6KFXAoPJxWmy0gdo0sbhzVvC4iSb1iZzWjki/rAVL
-lkYdJr+r/D5y7A80+Kngf18j77oLvtRkNiVT4Kac1kHg7h9oznO42T+DI90PPd33
-puX+J/aH9V51NUyZcQWQjY7ZiOMbMUnCjozwhidVPL65pK/ggrTFy08WorHpx4Ew
-i1oT5qD478+/4alUxs+EFJMvVTBPrKbpBYq2fr1n1L1/XdRGLi4U3M9B4jsXdmXd
-JyHPVlMNNBPTM8S95vNko4Q94UuZrCQv0TlPJtQI1B0KDDWCJxuyA/3+hYRFglBe
------END X509 CRL-----
diff --git a/third-party/curl/tests/certs/Server-localhost-sv.crt b/third-party/curl/tests/certs/Server-localhost-sv.crt
deleted file mode 100644
index 06355e3e6a..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-sv.crt
+++ /dev/null
@@ -1,99 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 16717980969532 (0xf3475512a3c)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = Northern Nowhere Trust Anchor
-        Validity
-            Not Before: Dec 23 12:21:36 2022 GMT
-            Not After : Mar 11 12:21:36 2031 GMT
-        Subject:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = localhost
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:c6:b8:04:3d:d6:fa:31:a0:d7:f7:e9:88:4b:5a:
-                    5e:6f:6f:db:f4:c9:4b:7e:6c:2a:cf:34:7b:2a:ba:
-                    1a:71:ad:7f:78:6c:f7:1e:ca:07:d0:29:03:49:e4:
-                    63:86:4c:f6:67:3f:bd:32:69:cb:b8:15:e7:0e:cf:
-                    28:3d:9e:96:91:8e:4f:73:a9:27:77:4c:26:61:cd:
-                    d6:e7:4e:3c:64:c3:13:ba:8e:ec:03:0f:bc:d4:83:
-                    b3:94:f2:be:d0:18:30:c5:52:49:cb:9a:60:cf:f3:
-                    b9:ca:2f:63:9d:34:ee:87:3a:58:e7:a1:99:dd:dc:
-                    56:87:e1:a0:d7:6b:37:ae:bb:13:db:7d:fa:2a:3d:
-                    9c:39:79:f6:01:a6:e3:3a:e7:18:14:cb:c7:57:b9:
-                    83:d1:ba:b8:2c:5a:c4:97:2f:ee:8d:68:48:37:f8:
-                    17:db:32:b9:ea:25:4f:28:57:01:39:13:dc:c0:f7:
-                    d0:cc:65:f9:2b:b8:4c:a1:5b:11:ce:44:e2:28:b9:
-                    63:62:fd:08:fa:b6:cd:49:d5:b9:fe:9e:68:9c:9a:
-                    b5:1a:3e:cc:bf:0e:74:db:52:3f:25:30:cd:7d:02:
-                    41:c7:c9:8a:58:12:35:25:21:95:c4:6b:c3:f5:79:
-                    c2:00:cb:ef:7f:d7:9f:89:c9:ff:c0:b9:72:59:4c:
-                    33:47
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Alternative Name: 
-                DNS:localhost
-            X509v3 Key Usage: 
-                Digital Signature, Key Encipherment, Key Agreement
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication
-            X509v3 Subject Key Identifier: 
-                4A:F1:79:1B:13:71:A4:0F:F9:06:CC:B6:2C:CD:24:46:DF:E6:08:2D
-            X509v3 Authority Key Identifier: 
-                87:CB:B1:33:2E:C1:67:7E:71:E3:E5:2B:4C:4D:A4:B3:6E:D2:5B:A9
-            X509v3 Basic Constraints: 
-                CA:FALSE
-            Authority Information Access: 
-                CA Issuers - URI:http://test.curl.se/ca/EdelCurlRoot.cer
-            X509v3 CRL Distribution Points: 
-                Full Name:
-                  URI:http://test.curl.se/ca/EdelCurlRoot.crl
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        67:ef:ad:8f:fa:ee:f1:fd:33:67:62:06:5f:09:55:7c:cf:82:
-        1a:e8:fc:f5:97:ba:63:bd:d0:a0:8b:85:2c:fc:f0:34:4a:97:
-        b2:18:d7:63:34:63:f4:1f:50:c7:0e:13:d9:bc:3b:73:3d:41:
-        93:16:b3:30:95:88:cd:75:c8:8c:58:4b:ab:96:e6:78:68:15:
-        0f:84:e7:8e:17:94:1a:b3:f3:12:ab:26:fd:fa:73:31:33:36:
-        85:83:2d:e3:3a:f2:a6:29:c6:37:30:3d:17:d2:39:31:d1:56:
-        1b:8d:df:fb:07:ad:81:0b:91:e5:bd:7b:37:a0:a0:5a:2c:33:
-        2b:8d:69:8b:d7:c1:45:61:85:ef:32:45:dd:00:a2:81:98:44:
-        0d:eb:01:95:fc:ac:0f:b5:34:a4:5f:35:5c:68:63:50:5a:69:
-        56:f3:99:c4:67:70:89:13:30:c0:64:ff:f1:a6:77:68:69:63:
-        9e:6f:f8:3c:6f:cd:af:7f:de:0d:87:55:ae:39:b3:b2:f5:4f:
-        47:79:1f:32:ee:ae:8f:32:dc:88:30:cd:38:6c:4b:28:55:c3:
-        7d:74:6b:de:d0:49:c9:05:ea:62:71:a6:f8:1e:76:da:3c:a7:
-        17:cd:1a:92:a3:c4:e8:85:d1:ad:34:0c:71:37:3f:6c:d3:7f:
-        9a:d6:ca:de
------BEGIN CERTIFICATE-----
-MIIERDCCAyygAwIBAgIGDzR1USo8MA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNVBAYT
-Ak5OMTEwLwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNo
-IENsb3VkMSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjAe
-Fw0yMjEyMjMxMjIxMzZaFw0zMTAzMTExMjIxMzZaMFQxCzAJBgNVBAYTAk5OMTEw
-LwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNoIENsb3Vk
-MRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQDGuAQ91voxoNf36YhLWl5vb9v0yUt+bCrPNHsquhpxrX94bPceygfQKQNJ
-5GOGTPZnP70yacu4FecOzyg9npaRjk9zqSd3TCZhzdbnTjxkwxO6juwDD7zUg7OU
-8r7QGDDFUknLmmDP87nKL2OdNO6HOljnoZnd3FaH4aDXazeuuxPbffoqPZw5efYB
-puM65xgUy8dXuYPRurgsWsSXL+6NaEg3+BfbMrnqJU8oVwE5E9zA99DMZfkruEyh
-WxHOROIouWNi/Qj6ts1J1bn+nmicmrUaPsy/DnTbUj8lMM19AkHHyYpYEjUlIZXE
-a8P1ecIAy+9/15+Jyf/AuXJZTDNHAgMBAAGjggEGMIIBAjAUBgNVHREEDTALggls
-b2NhbGhvc3QwCwYDVR0PBAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1Ud
-DgQWBBRK8XkbE3GkD/kGzLYszSRG3+YILTAfBgNVHSMEGDAWgBSHy7EzLsFnfnHj
-5StMTaSzbtJbqTAJBgNVHRMEAjAAMEMGCCsGAQUFBwEBBDcwNTAzBggrBgEFBQcw
-AoYnaHR0cDovL3Rlc3QuY3VybC5zZS9jYS9FZGVsQ3VybFJvb3QuY2VyMDgGA1Ud
-HwQxMC8wLaAroCmGJ2h0dHA6Ly90ZXN0LmN1cmwuc2UvY2EvRWRlbEN1cmxSb290
-LmNybDANBgkqhkiG9w0BAQsFAAOCAQEAZ++tj/ru8f0zZ2IGXwlVfM+CGuj89Ze6
-Y73QoIuFLPzwNEqXshjXYzRj9B9Qxw4T2bw7cz1BkxazMJWIzXXIjFhLq5bmeGgV
-D4TnjheUGrPzEqsm/fpzMTM2hYMt4zrypinGNzA9F9I5MdFWG43f+wetgQuR5b17
-N6CgWiwzK41pi9fBRWGF7zJF3QCigZhEDesBlfysD7U0pF81XGhjUFppVvOZxGdw
-iRMwwGT/8aZ3aGljnm/4PG/Nr3/eDYdVrjmzsvVPR3kfMu6ujzLciDDNOGxLKFXD
-fXRr3tBJyQXqYnGm+B522jynF80akqPE6IXRrTQMcTc/bNN/mtbK3g==
------END CERTIFICATE-----
diff --git a/third-party/curl/tests/certs/Server-localhost-sv.csr b/third-party/curl/tests/certs/Server-localhost-sv.csr
deleted file mode 100644
index aa3dc8ccc2..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-sv.csr
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN CERTIFICATE REQUEST-----
-MIICmTCCAYECAQAwVDELMAkGA1UEBhMCTk4xMTAvBgNVBAoMKEVkZWwgQ3VybCBB
-cmN0aWMgSWxsdWRpdW0gUmVzZWFyY2ggQ2xvdWQxEjAQBgNVBAMMCWxvY2FsaG9z
-dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMa4BD3W+jGg1/fpiEta
-Xm9v2/TJS35sKs80eyq6GnGtf3hs9x7KB9ApA0nkY4ZM9mc/vTJpy7gV5w7PKD2e
-lpGOT3OpJ3dMJmHN1udOPGTDE7qO7AMPvNSDs5TyvtAYMMVSScuaYM/zucovY500
-7oc6WOehmd3cVofhoNdrN667E9t9+io9nDl59gGm4zrnGBTLx1e5g9G6uCxaxJcv
-7o1oSDf4F9syueolTyhXATkT3MD30Mxl+Su4TKFbEc5E4ii5Y2L9CPq2zUnVuf6e
-aJyatRo+zL8OdNtSPyUwzX0CQcfJilgSNSUhlcRrw/V5wgDL73/Xn4nJ/8C5cllM
-M0cCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQBtz8OLB7+70UnIZ1s3VNIoYetH
-yqnBkNQusZrWmv4kHrIUP4K8zq0HCTGTWdxOAp23aU+yZyceu75aD8WosZoT0Q71
-zTLMMjo+ZRkeWuTo+xyLYoSdlkmyQN9xaj0owQ6UycL07aainnf2+n/ybaMFtUYB
-g1LVOwSvtyLQTxByZZ7mJvl+fczSN+E4AuNA8feECXh3oZ/MmWKFGIhkJ36Q4DYD
-PZ9J2RAV11KeHXLAKjnxsetQRiEdlvKetRknMCptgjVO23qIV62EbyL5mKrlz9Kx
-lTzM788YjSx+u2PTWJi4gduTcsirVel3yFJyHjvSEhMPTPuSDfD1fXSvp22G
------END CERTIFICATE REQUEST-----
diff --git a/third-party/curl/tests/certs/Server-localhost-sv.der b/third-party/curl/tests/certs/Server-localhost-sv.der
deleted file mode 100644
index 2e56bd991499df11888576f7734525c3fb5f7e8d..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1096
zcmXqLVsSBOV%Ax}%*4pV#Kvz@8mMJsz{|#|)#lOmotKf3o0Y*J!;ss6lZ`o)g-w{r
z&(F}%Kp({6;?ZzTNzGAkE-lJYa4bqL$xK%8%*iQD$t=xP2udwZO)N^zP;k!4FHJF2
zGf)9(Vdjzb%P%U)NG-}!@XId;(y0m|MWw|h3XXZn8Tmy9a^k#3MutX4#z1UnY!)TX
zYiwv>Y-kAO8iY{n5+MTth)Xzg@{<#DGV+T{44N2~kiE>v%D~*j$j<;2=VEGNWMnwD
zgT?mRFT(}bzrXD8j*83Azy0N;cU_Lwd6R0bT~dW>>nn1;%bjAspvmm{B)QG!Te|&T
zqs-GgM4$7W*RY*8ZDOB)@k;e_AGO4@*Pi>?q#PFB)%S*(f6tZX%~L+@yC7k3G|2Px
ztc3HQcb?Kuo@?^1-74bw!kKsPgtb3ha6Q|6-EQIAwZF7%=U7&LV_f#w>bZo->Eq!$
zn=kI#p%Zmvy8gS~3=i`k;<t@<zEbtq2xqhuzH{LFg)^x?wRiX|j21lS@<?N6a?)Rp
zU)#=lUfua`UdEhRTczyI?B^@F9b~U+aJH7o@%YKE2q9Bd#i>WK4}YyZ#Bln3{q^~s
zC;uPVSrqAG?9Rl@$iTR`iIEK$B1{G%!0?k5WZ^a7ZbAw}ZjdNH3kx$7^9loD5J#1T
z$AF8CLz|6}m6e^D(Lfd?$j2haBI5P2Qd+oh3I9*FGuw2|s<_>M#-VE<50X}9kuVTz
z5NSWX(OB<bdR^h;r`kTgOE%|Sie3p$fwICZOa=@F&M;#c8ClE?Obv`-d;_L7^^B5|
z0xNy}lGNf7y<}k8)GJQaPfpYarBzT;4a(04il-JCSb!{)X91>W1KkDM3p9z;S(JmE
zR)E<9m{u4W(%-M`|Ml+UU*q&7ws_9an)6LkFaCU;zAJg}g$3QMI)6Txcun6VaXr~2
z`HOtOaX#Ujd#sCX9Vd%zHkjIRw)8|#g!k%c&nhxR`CFd%iBFN*{8?zV+TUNrz&y~}
ztozvN(=yFt<_5Onmn;o0hDrC{|INO(k$d9Pz18Lm7DVY7Yxib$Uq9%Y*!tec^)ADr
z#u+ZWuNkNQS;N28WJ$bfOh$4*RA$)cnMcwKI)x1mr2PN5tUMz#d0zexoBXru>+kWl
zhpw~Syy>gId!@Y5yLJ6WcRCEtTI6_ZgdVOf$-Z~N^Cau5q{3xC<jQW@EEhj3HEHpY
V7p)i9n(!2w+vi-apLOljJpgAcm5KlW

diff --git a/third-party/curl/tests/certs/Server-localhost-sv.dhp b/third-party/curl/tests/certs/Server-localhost-sv.dhp
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/third-party/curl/tests/certs/Server-localhost-sv.key b/third-party/curl/tests/certs/Server-localhost-sv.key
deleted file mode 100644
index a2c95eea91..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-sv.key
+++ /dev/null
@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDGuAQ91voxoNf3
-6YhLWl5vb9v0yUt+bCrPNHsquhpxrX94bPceygfQKQNJ5GOGTPZnP70yacu4FecO
-zyg9npaRjk9zqSd3TCZhzdbnTjxkwxO6juwDD7zUg7OU8r7QGDDFUknLmmDP87nK
-L2OdNO6HOljnoZnd3FaH4aDXazeuuxPbffoqPZw5efYBpuM65xgUy8dXuYPRurgs
-WsSXL+6NaEg3+BfbMrnqJU8oVwE5E9zA99DMZfkruEyhWxHOROIouWNi/Qj6ts1J
-1bn+nmicmrUaPsy/DnTbUj8lMM19AkHHyYpYEjUlIZXEa8P1ecIAy+9/15+Jyf/A
-uXJZTDNHAgMBAAECggEAH48J3WhOw6LvqYeFBbKMXNY+8FknjCRRiCaliNuVZ4hO
-PinP9SvQodZhl1KWG7YNS8hrm54BpHKWB1wO3/pXnzYimBO9GM0XK2EtR/68yKPS
-dkZMZRASxQ1Fb9o9Q38T/8JZxeP2jBAA6YMtJsJJP2Cczex0Ky/a7il/CbcVWMJF
-VCqHEWCBge59xZifsKiAiK/Yw5W6uyi9OZ9a2D7bzJh0sojPIY90d7EhW4u/QCzk
-aXn78RbgxDkQyz5AQrIQzEMcOYr+AxiVT5S1v15FoaoWlm1IrNpEmf63PvwRKPZM
-ZW1cqR8onTQBndzAdwn9qHjtuRvhoHMe5RWs4rzDAQKBgQDTq2NGbkNdK14oSu7/
-t+z4Z3nGhHmY9pI1jF5/s3ialO/7YD4ul5MXaJt6dbklkPqsN0vmhPeeavAy6tsG
-iU4SdTuptKg5aZMZnDa9zu9lM4raJpDf9AuncffjVFqy9EDII5Wi1UIRDTD8D1gp
-LBYuFUTpo7R+JD3yqLXvbOw8UQKBgQDwVkgTqbAwbx35sKhpFo0VOAj3GVZkC6zt
-nFS03MmHPjge69u3B3I6oavYtwROq+6S9rj3MLuj4DhVbO5Yxi+XqY5wXhFUPPSp
-1ejXF8aAwWtZEeMTTsaN8jl3nfzdNul8G5mVfpY/VmZMhuAXclsAR9ke/x+FcmrQ
-Furd0lxIFwKBgQDSXVobzEf817YLW3WuBbBorAY1ysFCyYND3s6oIcjx8KWU8fC6
-w3+3WwpyqX8pm63V7Frtriaede9k2050b498/rAeGGK8NHWylTM+buQzcwdDieKg
-AN54Ouc/Mj217tRXVC5KF6JCahbN274lpSAiCpdjkIQ4fXJnsU6ntlwOEQKBgQDr
-rCAHsAkGpZ+mPlYWnreADC+2ZtExT8WmRvtFU5AHH7sWj0An7ZRU7D5AR89gefZ7
-hJaCRvZpTzDOi//5a3Y16V200Hl7uj5M4GbvrO/JSGHEuOaMA15uyQ0TQAg6wGMa
-gVIMp1IcD9RGzKeoNkoIL2w4mgJF8JnPLfnnxSUaxwKBgQCXP6btCbX7fryeIfUB
-PC1TOtyNvNWeoPJNT9eeNHxPC5VW2AC78XKxbHsVec16KJsOgj4Elc3h8/+X0wAU
-7Zo9CD7M2i1Tm5sKh90yBsZsU6jBWOBorLQnatDKVPXHLblVAEgK0qTJTAW8hLDn
-myYsFbt36qBXf1dVvo+5yhCxAw==
------END PRIVATE KEY-----
diff --git a/third-party/curl/tests/certs/Server-localhost-sv.pem b/third-party/curl/tests/certs/Server-localhost-sv.pem
deleted file mode 100644
index 583831f8f9..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-sv.pem
+++ /dev/null
@@ -1,165 +0,0 @@
-extensions = x509v3
-[ x509v3 ]
-subjectAltName = DNS:localhost
-keyUsage	= keyEncipherment,digitalSignature,keyAgreement
-extendedKeyUsage = serverAuth
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid
-basicConstraints = CA:false
-authorityInfoAccess     = @issuer_info
-crlDistributionPoints   = @crl_info
-
-[ crl_ext ]
-authorityKeyIdentifier  = keyid:always
-authorityInfoAccess     = @issuer_info
-
-[ issuer_info ]
-caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
-
-[ crl_info ]
-URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
-
-[ req ]
-default_bits                    = 1024
-distinguished_name              = req_DN
-default_md			= sha256
-string_mask			= utf8only
-[ req_DN ]
-countryName                     = "Country Name is Northern Nowhere"
-countryName_value            = NN
-organizationName              = "Organization Name"
-organizationName_value     = Edel Curl Arctic Illudium Research Cloud
-commonName                      = "Common Name"
-commonName_value              = localhost 
-
-[something]
-# The key
-# the certificate
-# some dhparam
------BEGIN PRIVATE KEY-----
-MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDGuAQ91voxoNf3
-6YhLWl5vb9v0yUt+bCrPNHsquhpxrX94bPceygfQKQNJ5GOGTPZnP70yacu4FecO
-zyg9npaRjk9zqSd3TCZhzdbnTjxkwxO6juwDD7zUg7OU8r7QGDDFUknLmmDP87nK
-L2OdNO6HOljnoZnd3FaH4aDXazeuuxPbffoqPZw5efYBpuM65xgUy8dXuYPRurgs
-WsSXL+6NaEg3+BfbMrnqJU8oVwE5E9zA99DMZfkruEyhWxHOROIouWNi/Qj6ts1J
-1bn+nmicmrUaPsy/DnTbUj8lMM19AkHHyYpYEjUlIZXEa8P1ecIAy+9/15+Jyf/A
-uXJZTDNHAgMBAAECggEAH48J3WhOw6LvqYeFBbKMXNY+8FknjCRRiCaliNuVZ4hO
-PinP9SvQodZhl1KWG7YNS8hrm54BpHKWB1wO3/pXnzYimBO9GM0XK2EtR/68yKPS
-dkZMZRASxQ1Fb9o9Q38T/8JZxeP2jBAA6YMtJsJJP2Cczex0Ky/a7il/CbcVWMJF
-VCqHEWCBge59xZifsKiAiK/Yw5W6uyi9OZ9a2D7bzJh0sojPIY90d7EhW4u/QCzk
-aXn78RbgxDkQyz5AQrIQzEMcOYr+AxiVT5S1v15FoaoWlm1IrNpEmf63PvwRKPZM
-ZW1cqR8onTQBndzAdwn9qHjtuRvhoHMe5RWs4rzDAQKBgQDTq2NGbkNdK14oSu7/
-t+z4Z3nGhHmY9pI1jF5/s3ialO/7YD4ul5MXaJt6dbklkPqsN0vmhPeeavAy6tsG
-iU4SdTuptKg5aZMZnDa9zu9lM4raJpDf9AuncffjVFqy9EDII5Wi1UIRDTD8D1gp
-LBYuFUTpo7R+JD3yqLXvbOw8UQKBgQDwVkgTqbAwbx35sKhpFo0VOAj3GVZkC6zt
-nFS03MmHPjge69u3B3I6oavYtwROq+6S9rj3MLuj4DhVbO5Yxi+XqY5wXhFUPPSp
-1ejXF8aAwWtZEeMTTsaN8jl3nfzdNul8G5mVfpY/VmZMhuAXclsAR9ke/x+FcmrQ
-Furd0lxIFwKBgQDSXVobzEf817YLW3WuBbBorAY1ysFCyYND3s6oIcjx8KWU8fC6
-w3+3WwpyqX8pm63V7Frtriaede9k2050b498/rAeGGK8NHWylTM+buQzcwdDieKg
-AN54Ouc/Mj217tRXVC5KF6JCahbN274lpSAiCpdjkIQ4fXJnsU6ntlwOEQKBgQDr
-rCAHsAkGpZ+mPlYWnreADC+2ZtExT8WmRvtFU5AHH7sWj0An7ZRU7D5AR89gefZ7
-hJaCRvZpTzDOi//5a3Y16V200Hl7uj5M4GbvrO/JSGHEuOaMA15uyQ0TQAg6wGMa
-gVIMp1IcD9RGzKeoNkoIL2w4mgJF8JnPLfnnxSUaxwKBgQCXP6btCbX7fryeIfUB
-PC1TOtyNvNWeoPJNT9eeNHxPC5VW2AC78XKxbHsVec16KJsOgj4Elc3h8/+X0wAU
-7Zo9CD7M2i1Tm5sKh90yBsZsU6jBWOBorLQnatDKVPXHLblVAEgK0qTJTAW8hLDn
-myYsFbt36qBXf1dVvo+5yhCxAw==
------END PRIVATE KEY-----
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 16717980969532 (0xf3475512a3c)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = Northern Nowhere Trust Anchor
-        Validity
-            Not Before: Dec 23 12:21:36 2022 GMT
-            Not After : Mar 11 12:21:36 2031 GMT
-        Subject:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = localhost
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:c6:b8:04:3d:d6:fa:31:a0:d7:f7:e9:88:4b:5a:
-                    5e:6f:6f:db:f4:c9:4b:7e:6c:2a:cf:34:7b:2a:ba:
-                    1a:71:ad:7f:78:6c:f7:1e:ca:07:d0:29:03:49:e4:
-                    63:86:4c:f6:67:3f:bd:32:69:cb:b8:15:e7:0e:cf:
-                    28:3d:9e:96:91:8e:4f:73:a9:27:77:4c:26:61:cd:
-                    d6:e7:4e:3c:64:c3:13:ba:8e:ec:03:0f:bc:d4:83:
-                    b3:94:f2:be:d0:18:30:c5:52:49:cb:9a:60:cf:f3:
-                    b9:ca:2f:63:9d:34:ee:87:3a:58:e7:a1:99:dd:dc:
-                    56:87:e1:a0:d7:6b:37:ae:bb:13:db:7d:fa:2a:3d:
-                    9c:39:79:f6:01:a6:e3:3a:e7:18:14:cb:c7:57:b9:
-                    83:d1:ba:b8:2c:5a:c4:97:2f:ee:8d:68:48:37:f8:
-                    17:db:32:b9:ea:25:4f:28:57:01:39:13:dc:c0:f7:
-                    d0:cc:65:f9:2b:b8:4c:a1:5b:11:ce:44:e2:28:b9:
-                    63:62:fd:08:fa:b6:cd:49:d5:b9:fe:9e:68:9c:9a:
-                    b5:1a:3e:cc:bf:0e:74:db:52:3f:25:30:cd:7d:02:
-                    41:c7:c9:8a:58:12:35:25:21:95:c4:6b:c3:f5:79:
-                    c2:00:cb:ef:7f:d7:9f:89:c9:ff:c0:b9:72:59:4c:
-                    33:47
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Alternative Name: 
-                DNS:localhost
-            X509v3 Key Usage: 
-                Digital Signature, Key Encipherment, Key Agreement
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication
-            X509v3 Subject Key Identifier: 
-                4A:F1:79:1B:13:71:A4:0F:F9:06:CC:B6:2C:CD:24:46:DF:E6:08:2D
-            X509v3 Authority Key Identifier: 
-                87:CB:B1:33:2E:C1:67:7E:71:E3:E5:2B:4C:4D:A4:B3:6E:D2:5B:A9
-            X509v3 Basic Constraints: 
-                CA:FALSE
-            Authority Information Access: 
-                CA Issuers - URI:http://test.curl.se/ca/EdelCurlRoot.cer
-            X509v3 CRL Distribution Points: 
-                Full Name:
-                  URI:http://test.curl.se/ca/EdelCurlRoot.crl
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        67:ef:ad:8f:fa:ee:f1:fd:33:67:62:06:5f:09:55:7c:cf:82:
-        1a:e8:fc:f5:97:ba:63:bd:d0:a0:8b:85:2c:fc:f0:34:4a:97:
-        b2:18:d7:63:34:63:f4:1f:50:c7:0e:13:d9:bc:3b:73:3d:41:
-        93:16:b3:30:95:88:cd:75:c8:8c:58:4b:ab:96:e6:78:68:15:
-        0f:84:e7:8e:17:94:1a:b3:f3:12:ab:26:fd:fa:73:31:33:36:
-        85:83:2d:e3:3a:f2:a6:29:c6:37:30:3d:17:d2:39:31:d1:56:
-        1b:8d:df:fb:07:ad:81:0b:91:e5:bd:7b:37:a0:a0:5a:2c:33:
-        2b:8d:69:8b:d7:c1:45:61:85:ef:32:45:dd:00:a2:81:98:44:
-        0d:eb:01:95:fc:ac:0f:b5:34:a4:5f:35:5c:68:63:50:5a:69:
-        56:f3:99:c4:67:70:89:13:30:c0:64:ff:f1:a6:77:68:69:63:
-        9e:6f:f8:3c:6f:cd:af:7f:de:0d:87:55:ae:39:b3:b2:f5:4f:
-        47:79:1f:32:ee:ae:8f:32:dc:88:30:cd:38:6c:4b:28:55:c3:
-        7d:74:6b:de:d0:49:c9:05:ea:62:71:a6:f8:1e:76:da:3c:a7:
-        17:cd:1a:92:a3:c4:e8:85:d1:ad:34:0c:71:37:3f:6c:d3:7f:
-        9a:d6:ca:de
------BEGIN CERTIFICATE-----
-MIIERDCCAyygAwIBAgIGDzR1USo8MA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNVBAYT
-Ak5OMTEwLwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNo
-IENsb3VkMSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjAe
-Fw0yMjEyMjMxMjIxMzZaFw0zMTAzMTExMjIxMzZaMFQxCzAJBgNVBAYTAk5OMTEw
-LwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNoIENsb3Vk
-MRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQDGuAQ91voxoNf36YhLWl5vb9v0yUt+bCrPNHsquhpxrX94bPceygfQKQNJ
-5GOGTPZnP70yacu4FecOzyg9npaRjk9zqSd3TCZhzdbnTjxkwxO6juwDD7zUg7OU
-8r7QGDDFUknLmmDP87nKL2OdNO6HOljnoZnd3FaH4aDXazeuuxPbffoqPZw5efYB
-puM65xgUy8dXuYPRurgsWsSXL+6NaEg3+BfbMrnqJU8oVwE5E9zA99DMZfkruEyh
-WxHOROIouWNi/Qj6ts1J1bn+nmicmrUaPsy/DnTbUj8lMM19AkHHyYpYEjUlIZXE
-a8P1ecIAy+9/15+Jyf/AuXJZTDNHAgMBAAGjggEGMIIBAjAUBgNVHREEDTALggls
-b2NhbGhvc3QwCwYDVR0PBAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1Ud
-DgQWBBRK8XkbE3GkD/kGzLYszSRG3+YILTAfBgNVHSMEGDAWgBSHy7EzLsFnfnHj
-5StMTaSzbtJbqTAJBgNVHRMEAjAAMEMGCCsGAQUFBwEBBDcwNTAzBggrBgEFBQcw
-AoYnaHR0cDovL3Rlc3QuY3VybC5zZS9jYS9FZGVsQ3VybFJvb3QuY2VyMDgGA1Ud
-HwQxMC8wLaAroCmGJ2h0dHA6Ly90ZXN0LmN1cmwuc2UvY2EvRWRlbEN1cmxSb290
-LmNybDANBgkqhkiG9w0BAQsFAAOCAQEAZ++tj/ru8f0zZ2IGXwlVfM+CGuj89Ze6
-Y73QoIuFLPzwNEqXshjXYzRj9B9Qxw4T2bw7cz1BkxazMJWIzXXIjFhLq5bmeGgV
-D4TnjheUGrPzEqsm/fpzMTM2hYMt4zrypinGNzA9F9I5MdFWG43f+wetgQuR5b17
-N6CgWiwzK41pi9fBRWGF7zJF3QCigZhEDesBlfysD7U0pF81XGhjUFppVvOZxGdw
-iRMwwGT/8aZ3aGljnm/4PG/Nr3/eDYdVrjmzsvVPR3kfMu6ujzLciDDNOGxLKFXD
-fXRr3tBJyQXqYnGm+B522jynF80akqPE6IXRrTQMcTc/bNN/mtbK3g==
------END CERTIFICATE-----
diff --git a/third-party/curl/tests/certs/Server-localhost-sv.prm b/third-party/curl/tests/certs/Server-localhost-sv.prm
deleted file mode 100644
index f58710406a..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-sv.prm
+++ /dev/null
@@ -1,38 +0,0 @@
-extensions = x509v3
-[ x509v3 ]
-subjectAltName = DNS:localhost
-keyUsage	= keyEncipherment,digitalSignature,keyAgreement
-extendedKeyUsage = serverAuth
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid
-basicConstraints = CA:false
-authorityInfoAccess     = @issuer_info
-crlDistributionPoints   = @crl_info
-
-[ crl_ext ]
-authorityKeyIdentifier  = keyid:always
-authorityInfoAccess     = @issuer_info
-
-[ issuer_info ]
-caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
-
-[ crl_info ]
-URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
-
-[ req ]
-default_bits                    = 1024
-distinguished_name              = req_DN
-default_md			= sha256
-string_mask			= utf8only
-[ req_DN ]
-countryName                     = "Country Name is Northern Nowhere"
-countryName_value            = NN
-organizationName              = "Organization Name"
-organizationName_value     = Edel Curl Arctic Illudium Research Cloud
-commonName                      = "Common Name"
-commonName_value              = localhost 
-
-[something]
-# The key
-# the certificate
-# some dhparam
diff --git a/third-party/curl/tests/certs/Server-localhost-sv.pub.der b/third-party/curl/tests/certs/Server-localhost-sv.pub.der
deleted file mode 100644
index 000c72163e027da8a50eb39d1439d89a43149649..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 294
zcmV+>0ondAf&n5h4F(A+hDe6@4FLfG1potr0S^E$f&mHwf&l>l#<&DM*7`A^*Z1j&
zOIluUZ`<_AOMYxB&op}~x*Bn<e|T*79?A#MDFaF5V}?xjXFt6%Y0J13=MK*(J)V}4
zj!$!`CwELHVa?X(PCR786S|J<0}s5^gR_+KzR(yj#ZpPjnqbfKxymnNoiy%;I#}nS
zncdu0hvA^tYd5aD6We|IDm|PzdG-OO<2vUU6wAj~xr5QVxGY-4moM&(Xh=8s7uzzq
z>LpJoR{=Q_+`#wH%w_p2xJ;p25za*7D7j-|{RsND%}Ld{{+?)@nzb4}%)btF+fqLz
sFwK1eLC498SQ0fQA(g~y!}WQ>0L$-x*Pn^W|G>F&SxhrW0s{d60ZOupsQ>@~

diff --git a/third-party/curl/tests/certs/Server-localhost-sv.pub.pem b/third-party/curl/tests/certs/Server-localhost-sv.pub.pem
deleted file mode 100644
index 24fe144547..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-sv.pub.pem
+++ /dev/null
@@ -1,9 +0,0 @@
------BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxrgEPdb6MaDX9+mIS1pe
-b2/b9MlLfmwqzzR7Kroaca1/eGz3HsoH0CkDSeRjhkz2Zz+9MmnLuBXnDs8oPZ6W
-kY5Pc6knd0wmYc3W5048ZMMTuo7sAw+81IOzlPK+0BgwxVJJy5pgz/O5yi9jnTTu
-hzpY56GZ3dxWh+Gg12s3rrsT2336Kj2cOXn2AabjOucYFMvHV7mD0bq4LFrEly/u
-jWhIN/gX2zK56iVPKFcBORPcwPfQzGX5K7hMoVsRzkTiKLljYv0I+rbNSdW5/p5o
-nJq1Gj7Mvw5021I/JTDNfQJBx8mKWBI1JSGVxGvD9XnCAMvvf9eficn/wLlyWUwz
-RwIDAQAB
------END PUBLIC KEY-----
diff --git a/third-party/curl/tests/certs/Server-localhost-sv.pubkey-pinned b/third-party/curl/tests/certs/Server-localhost-sv.pubkey-pinned
deleted file mode 100644
index 96a362a6c5..0000000000
--- a/third-party/curl/tests/certs/Server-localhost-sv.pubkey-pinned
+++ /dev/null
@@ -1 +0,0 @@
-AAUDLk4c98xcFUDvA9i/MnA9HuO03IPi15r+Cx9OXnc=
diff --git a/third-party/curl/tests/certs/Server-localhost.nn-sv.crl b/third-party/curl/tests/certs/Server-localhost.nn-sv.crl
deleted file mode 100644
index a944c33754..0000000000
--- a/third-party/curl/tests/certs/Server-localhost.nn-sv.crl
+++ /dev/null
@@ -1,13 +0,0 @@
------BEGIN X509 CRL-----
-MIIB9TCB3gIBATANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJOTjExMC8GA1UE
-CgwoRWRlbCBDdXJsIEFyY3RpYyBJbGx1ZGl1bSBSZXNlYXJjaCBDbG91ZDEmMCQG
-A1UEAwwdTm9ydGhlcm4gTm93aGVyZSBUcnVzdCBBbmNob3IXDTIyMTIyMzEyMjEz
-N1oXDTIzMDEyMjEyMjEzN1owMjAXAgYPNHVRKjwXDTIyMTIyMzEyMjEzNlowFwIG
-DzR1UVFhFw0yMjEyMjMxMjIxMzdaoA4wDDAKBgNVHRQEAwIBATANBgkqhkiG9w0B
-AQsFAAOCAQEAii+pMstYDtBKHc84kkIEwV+zwGAAJo+jf/AHnqbagpoPKn61ci74
-74Q8BlrYTOksAJhVA/DwFnB8rwGHtGpnDvXtjpVMpvrQSGwi6D6FdjwUkq1aTQrF
-AZEHps1FCWYrOprz3YF49xQAKuq6yX+UxJXdUOqXZPgbtdGZBHNAdVK3Hu45C25e
-7U1CWKOHRMLyGJ4ynzysf3cUiSqHZG1A+WB6BeSz6guOVyb8I8/VZ+e3whcxAa5+
-YORoKFRS24bO/c9/XBsSC3E6i3kuPg/UVdI726DQwOXBYwtrkESzMsMMgeEXrNFm
-j3IyctWm2G/i/WkCNrt3bfTKV4th8tHdlA==
------END X509 CRL-----
diff --git a/third-party/curl/tests/certs/Server-localhost.nn-sv.crt b/third-party/curl/tests/certs/Server-localhost.nn-sv.crt
deleted file mode 100644
index 7738e5ba6c..0000000000
--- a/third-party/curl/tests/certs/Server-localhost.nn-sv.crt
+++ /dev/null
@@ -1,99 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 16717980979553 (0xf3475515161)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = Northern Nowhere Trust Anchor
-        Validity
-            Not Before: Dec 23 12:21:37 2022 GMT
-            Not After : Mar 11 12:21:37 2031 GMT
-        Subject:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = localhost.nn
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:a3:9a:e4:0f:e0:bd:93:a9:5a:a7:5e:ad:85:5e:
-                    d6:e0:98:b4:e9:22:e0:62:90:c3:d9:57:37:16:5d:
-                    57:3d:68:ca:e2:cf:2f:46:67:1a:0c:af:0e:89:86:
-                    01:06:df:d6:c9:80:15:0a:43:85:40:3f:da:ee:ee:
-                    78:09:7c:90:e4:89:63:92:40:0b:22:1c:e2:d3:16:
-                    a9:93:62:e4:04:7a:b0:ab:25:3a:74:02:44:ea:f1:
-                    31:89:94:29:74:a0:e2:bb:ae:e7:0f:f1:38:6a:87:
-                    1e:dd:5b:e6:a4:cc:97:ac:d3:01:9a:71:27:a3:22:
-                    6d:d8:4a:c7:49:5c:16:ae:61:a7:06:3a:90:b4:df:
-                    71:af:a5:fd:51:46:75:cd:78:e0:0c:52:99:41:4f:
-                    56:29:a6:a2:a3:dd:d9:7e:29:3e:68:a5:af:c0:34:
-                    b5:73:52:12:04:90:07:1b:f5:8b:a3:71:56:c5:95:
-                    4e:62:18:d4:ec:e9:4e:90:1b:91:25:bb:32:15:db:
-                    15:38:59:14:c9:c5:c6:0a:08:aa:2d:f5:67:aa:2f:
-                    eb:97:74:8a:8b:3e:5f:09:27:b0:bf:b3:a3:85:e9:
-                    7a:f5:39:dc:1d:c7:f4:34:73:d8:f2:ed:b0:c9:1d:
-                    2a:85:ee:e2:fb:51:09:5e:ff:bf:bc:79:c3:6d:30:
-                    89:b9
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Alternative Name: 
-                DNS:localhost.nn
-            X509v3 Key Usage: 
-                Digital Signature, Key Encipherment, Key Agreement
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication
-            X509v3 Subject Key Identifier: 
-                85:A2:1D:76:BD:C6:8B:D6:D2:2D:05:77:24:EC:78:7B:70:71:77:C1
-            X509v3 Authority Key Identifier: 
-                87:CB:B1:33:2E:C1:67:7E:71:E3:E5:2B:4C:4D:A4:B3:6E:D2:5B:A9
-            X509v3 Basic Constraints: 
-                CA:FALSE
-            Authority Information Access: 
-                CA Issuers - URI:http://test.curl.se/ca/EdelCurlRoot.cer
-            X509v3 CRL Distribution Points: 
-                Full Name:
-                  URI:http://test.curl.se/ca/EdelCurlRoot.crl
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        66:8f:f5:ea:6a:5d:58:b6:50:b0:5b:7b:1f:c1:54:d9:a3:bb:
-        36:1b:eb:19:4a:0e:1c:26:43:32:84:de:cb:c9:eb:08:9a:ee:
-        9d:d5:a6:62:3e:70:de:61:89:a9:d0:11:20:2a:a6:5c:19:ab:
-        91:71:78:f6:5f:ab:e6:03:94:b3:94:42:7b:42:c6:37:f0:4c:
-        b7:49:5d:90:c5:e3:24:2c:a0:ce:fe:be:71:11:3e:e6:0b:13:
-        85:8d:36:e6:db:82:8b:fd:51:a3:3d:42:4c:0d:fd:cf:0b:d8:
-        37:ab:f2:e5:53:15:3f:01:d7:a9:78:d5:99:fe:33:88:d7:c6:
-        31:dd:bf:b1:d2:e6:31:17:6e:28:91:19:26:36:d7:bc:98:04:
-        4c:30:cb:58:ec:b3:c9:1d:22:bf:28:bc:17:6d:2d:5d:36:c3:
-        e5:12:80:5d:02:4c:61:48:95:a8:77:96:49:e2:17:87:fd:3b:
-        cc:55:15:0d:b8:13:5e:31:97:05:78:78:7b:0d:8e:3d:ac:25:
-        99:81:61:77:c4:a4:a2:25:f1:70:34:17:40:f7:cb:f3:fd:da:
-        ad:bd:6d:f1:dc:85:0f:dd:4d:21:9e:19:6a:97:b3:43:44:71:
-        db:74:3f:bf:8a:8d:06:54:48:fd:9e:88:e8:5d:d2:be:ee:b4:
-        69:1b:63:11
------BEGIN CERTIFICATE-----
-MIIESjCCAzKgAwIBAgIGDzR1UVFhMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNVBAYT
-Ak5OMTEwLwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNo
-IENsb3VkMSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjAe
-Fw0yMjEyMjMxMjIxMzdaFw0zMTAzMTExMjIxMzdaMFcxCzAJBgNVBAYTAk5OMTEw
-LwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNoIENsb3Vk
-MRUwEwYDVQQDDAxsb2NhbGhvc3Qubm4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
-ggEKAoIBAQCjmuQP4L2TqVqnXq2FXtbgmLTpIuBikMPZVzcWXVc9aMrizy9GZxoM
-rw6JhgEG39bJgBUKQ4VAP9ru7ngJfJDkiWOSQAsiHOLTFqmTYuQEerCrJTp0AkTq
-8TGJlCl0oOK7rucP8Thqhx7dW+akzJes0wGacSejIm3YSsdJXBauYacGOpC033Gv
-pf1RRnXNeOAMUplBT1YppqKj3dl+KT5opa/ANLVzUhIEkAcb9YujcVbFlU5iGNTs
-6U6QG5EluzIV2xU4WRTJxcYKCKot9WeqL+uXdIqLPl8JJ7C/s6OF6Xr1Odwdx/Q0
-c9jy7bDJHSqF7uL7UQle/7+8ecNtMIm5AgMBAAGjggEJMIIBBTAXBgNVHREEEDAO
-ggxsb2NhbGhvc3Qubm4wCwYDVR0PBAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUFBwMB
-MB0GA1UdDgQWBBSFoh12vcaL1tItBXck7Hh7cHF3wTAfBgNVHSMEGDAWgBSHy7Ez
-LsFnfnHj5StMTaSzbtJbqTAJBgNVHRMEAjAAMEMGCCsGAQUFBwEBBDcwNTAzBggr
-BgEFBQcwAoYnaHR0cDovL3Rlc3QuY3VybC5zZS9jYS9FZGVsQ3VybFJvb3QuY2Vy
-MDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly90ZXN0LmN1cmwuc2UvY2EvRWRlbEN1
-cmxSb290LmNybDANBgkqhkiG9w0BAQsFAAOCAQEAZo/16mpdWLZQsFt7H8FU2aO7
-NhvrGUoOHCZDMoTey8nrCJrundWmYj5w3mGJqdARICqmXBmrkXF49l+r5gOUs5RC
-e0LGN/BMt0ldkMXjJCygzv6+cRE+5gsThY025tuCi/1Roz1CTA39zwvYN6vy5VMV
-PwHXqXjVmf4ziNfGMd2/sdLmMRduKJEZJjbXvJgETDDLWOyzyR0ivyi8F20tXTbD
-5RKAXQJMYUiVqHeWSeIXh/07zFUVDbgTXjGXBXh4ew2OPawlmYFhd8SkoiXxcDQX
-QPfL8/3arb1t8dyFD91NIZ4ZapezQ0Rx23Q/v4qNBlRI/Z6I6F3Svu60aRtjEQ==
------END CERTIFICATE-----
diff --git a/third-party/curl/tests/certs/Server-localhost.nn-sv.csr b/third-party/curl/tests/certs/Server-localhost.nn-sv.csr
deleted file mode 100644
index af0d1c485f..0000000000
--- a/third-party/curl/tests/certs/Server-localhost.nn-sv.csr
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN CERTIFICATE REQUEST-----
-MIICnDCCAYQCAQAwVzELMAkGA1UEBhMCTk4xMTAvBgNVBAoMKEVkZWwgQ3VybCBB
-cmN0aWMgSWxsdWRpdW0gUmVzZWFyY2ggQ2xvdWQxFTATBgNVBAMMDGxvY2FsaG9z
-dC5ubjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKOa5A/gvZOpWqde
-rYVe1uCYtOki4GKQw9lXNxZdVz1oyuLPL0ZnGgyvDomGAQbf1smAFQpDhUA/2u7u
-eAl8kOSJY5JACyIc4tMWqZNi5AR6sKslOnQCROrxMYmUKXSg4ruu5w/xOGqHHt1b
-5qTMl6zTAZpxJ6MibdhKx0lcFq5hpwY6kLTfca+l/VFGdc144AxSmUFPVimmoqPd
-2X4pPmilr8A0tXNSEgSQBxv1i6NxVsWVTmIY1OzpTpAbkSW7MhXbFThZFMnFxgoI
-qi31Z6ov65d0ios+XwknsL+zo4XpevU53B3H9DRz2PLtsMkdKoXu4vtRCV7/v7x5
-w20wibkCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQArdsmGDGMvCUZ4dOwsUDdP
-C0RCBrgwRM7jQf1f4u2avePF/sl0RYhNLYhGUT2KUqLNs5+j7wKErthD32lWSPpa
-orPnibZkEKaO7ZVFUtcN7EOmluXFXsapKilYPDCEeSsHwM5Aaofl8Mkb5e5H+idf
-Vea2DuEKFQfumczzaD9JK9tPzsVbJ6FwiPeI46XpH7vrf1DZmauDp83GfAXc1Mrm
-dd8QdoGhdNjTi7H+36l1jY+7xnZ+s1vwqxIt4BCf6p6iBy4GHApFaD7bP6dizEUq
-weTUXHllb2bgz4cHHvV5n3NXzC6oE9sVw0nLdnfPFiZpGn8VnUW1ZvE3pGcWkAzC
------END CERTIFICATE REQUEST-----
diff --git a/third-party/curl/tests/certs/Server-localhost.nn-sv.der b/third-party/curl/tests/certs/Server-localhost.nn-sv.der
deleted file mode 100644
index 10b7e35584c3ee67f8ce186cabd957c269212b61..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1102
zcmXqLV(~I)Vm4a9%*4pV#Kvz@8W@;pz{|#|)#lOmotKf3o0Y*J!;ss6lZ`o)g-w{r
z&(F}%Kp({6;?ZzTNzGAkE-lJYa4bqL$xK%8%*iQD$t=xP2udwZO)N^zP;k!4FHJF2
zGf)9(Vdjzb%P%U)NG-}!@XId;(y0m|MWw|h3XXZn8Tmy9a^k#3MutX4#z1UnY#t@f
zYiwv>Y-kAO8iZ5q5>W$Th)Z~K@{<#DGV+T{^z!lyni!Rkea*<qz}&>h&j1wXVrpV!
zWLP}w3IBt=lUGJ9k6YUsckRK9EiaWGBuzMcGu&J(HrzJj)T8tIZs}4y>-jp{7}@S$
zJJ}%0<=pCEf9u`53eK7dPdbw)IdCh<Ji08la&poWmZ}Y_Rjo>xTwZ-N?3|)mvf$C~
zb<g=fT4c4$-Hm>><jnLnml<ajsxMZ`z2SA-Ge&G(;&L{t30v+Lu3!2$(5>`r#RHz8
znU4Npn#&d~zI(Gy(=KD_`U56gi-Uw%Ca_C??Ot3Mc66#=lEjraFa0J+PgLD)Bzjxa
zB2wh!(PLa3t8~AnuhM@#y`-z#E}m0;!~V^STVGavwY(#H{EJEPjZbekoRrmSefQ{h
zAZOhF{d+18=NfeGWMXDyU|ih9$O#M)Rs(Th5XuU&2pI4+p#~#2NP?e*g_((Y1vsE(
zRatlpxY#(f*%(<_*_jy)WI-zUSj1RFS{KQd?LF3g?UF8QxyqZ0>Vm@Zg9h>-X=N4(
z1F;5?_R|}U^$w=j6+V8d?c=*-bKa%smEd$JE6l=Vz+m7EGnSE&#oWNuz!=6iU}{s(
zC@Cqh($_CZ1;%eOFoo(Br|Kss>Vr}&D8UBh=L5x4iwrD47Rs{#)3kx^0__EwMCvTc
zK~65fOae?Uj0|c0UteX#Mr;e%5M3>QFy!Xq-Dc9SCB67$)SQi4?wvmQnq$_xxmTAZ
z*%jPN>|A+4P(f>1jO6Nxg%#i8S3hH(vU!SAwbL>44?f#HV<#MatfI5v+`oN=f_Bfi
zg<E^gp51Qh{u{X1*2#zW?|JSU=BqzF4HmU$yuPyH>db$}9oLT;-rc|P(lbNxJdKHx
zYG&8>%wX{`I34k3^GR8y{Th43b9H0Q4nGxYh-LCg^q9J$e46JY@%F#gXF^4JcL>KB
zPG_yCsOIgnU86d)F|qu}l0~W?3rxfvzMua5_tx6IxgYPe^56AUoF|zzeY3Mm;q4Op
Y{aw9mAs&C{b-akZwC~-POzC7n0I8soDF6Tf

diff --git a/third-party/curl/tests/certs/Server-localhost.nn-sv.dhp b/third-party/curl/tests/certs/Server-localhost.nn-sv.dhp
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/third-party/curl/tests/certs/Server-localhost.nn-sv.key b/third-party/curl/tests/certs/Server-localhost.nn-sv.key
deleted file mode 100644
index 3e4af202ed..0000000000
--- a/third-party/curl/tests/certs/Server-localhost.nn-sv.key
+++ /dev/null
@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCjmuQP4L2TqVqn
-Xq2FXtbgmLTpIuBikMPZVzcWXVc9aMrizy9GZxoMrw6JhgEG39bJgBUKQ4VAP9ru
-7ngJfJDkiWOSQAsiHOLTFqmTYuQEerCrJTp0AkTq8TGJlCl0oOK7rucP8Thqhx7d
-W+akzJes0wGacSejIm3YSsdJXBauYacGOpC033Gvpf1RRnXNeOAMUplBT1YppqKj
-3dl+KT5opa/ANLVzUhIEkAcb9YujcVbFlU5iGNTs6U6QG5EluzIV2xU4WRTJxcYK
-CKot9WeqL+uXdIqLPl8JJ7C/s6OF6Xr1Odwdx/Q0c9jy7bDJHSqF7uL7UQle/7+8
-ecNtMIm5AgMBAAECggEATTaCwAOfNRtOT4NdfX5fByzK5OSy5ZHQ/LgupX1z+OWG
-KzkA5McwAiB0Se9WeLoXko3CYE+xibsZRn6BZGjHsTQuLA3Rs03StzEQ4yBe4MZO
-rtcpGSsg/4jJilbEoeh0WYOYRWvg5lXS+UGwPsLYKpaDQTJ6NIHBOb1BBJxTkASA
-ti7+uGn5DvRlOgFICBpNzRl83akeV8oLOJAqMZAlGI54jZa+cHkGfkJp+JyMbtjA
-zML+oen1BYGHP++uM8fg4bn9bpixpg784qiJJsjzjQVofpZc1CaTJ32hzBCvEYrw
-kQS5zhFsEP6fn278VWijFd2QOnxoyergumVOvBbNCQKBgQC+hB56kNGVuPcfSekW
-xa5BytDlfAiAvo34N5VhHHNbe/RDtJ2w5z2ZqKg2AL0efWPb4kCMaiXZf9my0Kjm
-iRv4LQA/hj1M7W33ubg93LZ9gnVdZSzuslR6CgXoIkmP4GZPF6n7+HxKStmeqBiE
-TMc80OVE1ogXbPGcKOjxHvglawKBgQDb1tECQ9TFQtVveys69ycFSjQAFt569mQT
-PBnVLtJ8RT3JX5rTKHLmYSl7kNylIzqO43+R8HZLGj09euRjTcKpatNkg7l74/PM
-YUDQki8voWfXchpbN9pbRVhuw9TBNUvMiL9pEdoBl85MyDhydD/gC9809ljZyo+y
-q8RCrP4yawKBgBXI+cs+IBkky21SgErQU/rF/Fkhc791CrrlcDlojXBanjXXw2hl
-KNAXTxTNxNJluDN+ja8AvE9ApV4jKg0ihIY+bxbUfNH9HGQFYqIASQXVEyKY3Sh2
-T96cosxGj27aVBibNh7P7TZ5lKTlx9fpB6dWo8DZXzp+hKo8q1ZXGjz9AoGAdNuy
-zKZr8tO9Cv6JE1YPqvMvwyBk8S4KMmNPRBAYmTBhUKr+bOJieW4KlAGEGFAqr4vk
-4xnUd8Wh6g1qXBMYt9/uMM8IiP+6N9k2j+g1JveAcHjZ48VD0CKDiJWWgYGoIjhK
-rzprDU+5vPztbIG49oq5Ark0r8jKK+q8b8jvcrMCgYB/eTv2L5ReL99Hvrtm5oVE
-BkkLS4dr8hnA7QJyo84yy8yq1w5KzOiMpnnK7v6N9NkGMn7Ia8HMqFyGuqaINzlY
-NdYt+qoxLXdIDzKTSS91GAwfF25iyptx2DsdY2j2Smhp4put1/QygAbvlwXZy+kG
-T8c+FOuI1h2Bg0bSSoTfIQ==
------END PRIVATE KEY-----
diff --git a/third-party/curl/tests/certs/Server-localhost.nn-sv.pem b/third-party/curl/tests/certs/Server-localhost.nn-sv.pem
deleted file mode 100644
index 29dc52ce03..0000000000
--- a/third-party/curl/tests/certs/Server-localhost.nn-sv.pem
+++ /dev/null
@@ -1,165 +0,0 @@
-extensions = x509v3
-[ x509v3 ]
-subjectAltName = DNS:localhost.nn
-keyUsage	= keyEncipherment,digitalSignature,keyAgreement
-extendedKeyUsage = serverAuth
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid
-basicConstraints = CA:false
-authorityInfoAccess     = @issuer_info
-crlDistributionPoints   = @crl_info
-
-[ crl_ext ]
-authorityKeyIdentifier  = keyid:always
-authorityInfoAccess     = @issuer_info
-
-[ issuer_info ]
-caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
-
-[ crl_info ]
-URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
-
-[ req ]
-default_bits                    = 1024
-distinguished_name              = req_DN
-default_md			= sha256
-string_mask			= utf8only
-[ req_DN ]
-countryName                     = "Country Name is Northern Nowhere"
-countryName_value            = NN
-organizationName              = "Organization Name"
-organizationName_value     = Edel Curl Arctic Illudium Research Cloud
-commonName                      = "Common Name"
-commonName_value              = localhost.nn 
-
-[something]
-# The key
-# the certificate
-# some dhparam
------BEGIN PRIVATE KEY-----
-MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCjmuQP4L2TqVqn
-Xq2FXtbgmLTpIuBikMPZVzcWXVc9aMrizy9GZxoMrw6JhgEG39bJgBUKQ4VAP9ru
-7ngJfJDkiWOSQAsiHOLTFqmTYuQEerCrJTp0AkTq8TGJlCl0oOK7rucP8Thqhx7d
-W+akzJes0wGacSejIm3YSsdJXBauYacGOpC033Gvpf1RRnXNeOAMUplBT1YppqKj
-3dl+KT5opa/ANLVzUhIEkAcb9YujcVbFlU5iGNTs6U6QG5EluzIV2xU4WRTJxcYK
-CKot9WeqL+uXdIqLPl8JJ7C/s6OF6Xr1Odwdx/Q0c9jy7bDJHSqF7uL7UQle/7+8
-ecNtMIm5AgMBAAECggEATTaCwAOfNRtOT4NdfX5fByzK5OSy5ZHQ/LgupX1z+OWG
-KzkA5McwAiB0Se9WeLoXko3CYE+xibsZRn6BZGjHsTQuLA3Rs03StzEQ4yBe4MZO
-rtcpGSsg/4jJilbEoeh0WYOYRWvg5lXS+UGwPsLYKpaDQTJ6NIHBOb1BBJxTkASA
-ti7+uGn5DvRlOgFICBpNzRl83akeV8oLOJAqMZAlGI54jZa+cHkGfkJp+JyMbtjA
-zML+oen1BYGHP++uM8fg4bn9bpixpg784qiJJsjzjQVofpZc1CaTJ32hzBCvEYrw
-kQS5zhFsEP6fn278VWijFd2QOnxoyergumVOvBbNCQKBgQC+hB56kNGVuPcfSekW
-xa5BytDlfAiAvo34N5VhHHNbe/RDtJ2w5z2ZqKg2AL0efWPb4kCMaiXZf9my0Kjm
-iRv4LQA/hj1M7W33ubg93LZ9gnVdZSzuslR6CgXoIkmP4GZPF6n7+HxKStmeqBiE
-TMc80OVE1ogXbPGcKOjxHvglawKBgQDb1tECQ9TFQtVveys69ycFSjQAFt569mQT
-PBnVLtJ8RT3JX5rTKHLmYSl7kNylIzqO43+R8HZLGj09euRjTcKpatNkg7l74/PM
-YUDQki8voWfXchpbN9pbRVhuw9TBNUvMiL9pEdoBl85MyDhydD/gC9809ljZyo+y
-q8RCrP4yawKBgBXI+cs+IBkky21SgErQU/rF/Fkhc791CrrlcDlojXBanjXXw2hl
-KNAXTxTNxNJluDN+ja8AvE9ApV4jKg0ihIY+bxbUfNH9HGQFYqIASQXVEyKY3Sh2
-T96cosxGj27aVBibNh7P7TZ5lKTlx9fpB6dWo8DZXzp+hKo8q1ZXGjz9AoGAdNuy
-zKZr8tO9Cv6JE1YPqvMvwyBk8S4KMmNPRBAYmTBhUKr+bOJieW4KlAGEGFAqr4vk
-4xnUd8Wh6g1qXBMYt9/uMM8IiP+6N9k2j+g1JveAcHjZ48VD0CKDiJWWgYGoIjhK
-rzprDU+5vPztbIG49oq5Ark0r8jKK+q8b8jvcrMCgYB/eTv2L5ReL99Hvrtm5oVE
-BkkLS4dr8hnA7QJyo84yy8yq1w5KzOiMpnnK7v6N9NkGMn7Ia8HMqFyGuqaINzlY
-NdYt+qoxLXdIDzKTSS91GAwfF25iyptx2DsdY2j2Smhp4put1/QygAbvlwXZy+kG
-T8c+FOuI1h2Bg0bSSoTfIQ==
------END PRIVATE KEY-----
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 16717980979553 (0xf3475515161)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = Northern Nowhere Trust Anchor
-        Validity
-            Not Before: Dec 23 12:21:37 2022 GMT
-            Not After : Mar 11 12:21:37 2031 GMT
-        Subject:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = localhost.nn
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:a3:9a:e4:0f:e0:bd:93:a9:5a:a7:5e:ad:85:5e:
-                    d6:e0:98:b4:e9:22:e0:62:90:c3:d9:57:37:16:5d:
-                    57:3d:68:ca:e2:cf:2f:46:67:1a:0c:af:0e:89:86:
-                    01:06:df:d6:c9:80:15:0a:43:85:40:3f:da:ee:ee:
-                    78:09:7c:90:e4:89:63:92:40:0b:22:1c:e2:d3:16:
-                    a9:93:62:e4:04:7a:b0:ab:25:3a:74:02:44:ea:f1:
-                    31:89:94:29:74:a0:e2:bb:ae:e7:0f:f1:38:6a:87:
-                    1e:dd:5b:e6:a4:cc:97:ac:d3:01:9a:71:27:a3:22:
-                    6d:d8:4a:c7:49:5c:16:ae:61:a7:06:3a:90:b4:df:
-                    71:af:a5:fd:51:46:75:cd:78:e0:0c:52:99:41:4f:
-                    56:29:a6:a2:a3:dd:d9:7e:29:3e:68:a5:af:c0:34:
-                    b5:73:52:12:04:90:07:1b:f5:8b:a3:71:56:c5:95:
-                    4e:62:18:d4:ec:e9:4e:90:1b:91:25:bb:32:15:db:
-                    15:38:59:14:c9:c5:c6:0a:08:aa:2d:f5:67:aa:2f:
-                    eb:97:74:8a:8b:3e:5f:09:27:b0:bf:b3:a3:85:e9:
-                    7a:f5:39:dc:1d:c7:f4:34:73:d8:f2:ed:b0:c9:1d:
-                    2a:85:ee:e2:fb:51:09:5e:ff:bf:bc:79:c3:6d:30:
-                    89:b9
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Alternative Name: 
-                DNS:localhost.nn
-            X509v3 Key Usage: 
-                Digital Signature, Key Encipherment, Key Agreement
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication
-            X509v3 Subject Key Identifier: 
-                85:A2:1D:76:BD:C6:8B:D6:D2:2D:05:77:24:EC:78:7B:70:71:77:C1
-            X509v3 Authority Key Identifier: 
-                87:CB:B1:33:2E:C1:67:7E:71:E3:E5:2B:4C:4D:A4:B3:6E:D2:5B:A9
-            X509v3 Basic Constraints: 
-                CA:FALSE
-            Authority Information Access: 
-                CA Issuers - URI:http://test.curl.se/ca/EdelCurlRoot.cer
-            X509v3 CRL Distribution Points: 
-                Full Name:
-                  URI:http://test.curl.se/ca/EdelCurlRoot.crl
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        66:8f:f5:ea:6a:5d:58:b6:50:b0:5b:7b:1f:c1:54:d9:a3:bb:
-        36:1b:eb:19:4a:0e:1c:26:43:32:84:de:cb:c9:eb:08:9a:ee:
-        9d:d5:a6:62:3e:70:de:61:89:a9:d0:11:20:2a:a6:5c:19:ab:
-        91:71:78:f6:5f:ab:e6:03:94:b3:94:42:7b:42:c6:37:f0:4c:
-        b7:49:5d:90:c5:e3:24:2c:a0:ce:fe:be:71:11:3e:e6:0b:13:
-        85:8d:36:e6:db:82:8b:fd:51:a3:3d:42:4c:0d:fd:cf:0b:d8:
-        37:ab:f2:e5:53:15:3f:01:d7:a9:78:d5:99:fe:33:88:d7:c6:
-        31:dd:bf:b1:d2:e6:31:17:6e:28:91:19:26:36:d7:bc:98:04:
-        4c:30:cb:58:ec:b3:c9:1d:22:bf:28:bc:17:6d:2d:5d:36:c3:
-        e5:12:80:5d:02:4c:61:48:95:a8:77:96:49:e2:17:87:fd:3b:
-        cc:55:15:0d:b8:13:5e:31:97:05:78:78:7b:0d:8e:3d:ac:25:
-        99:81:61:77:c4:a4:a2:25:f1:70:34:17:40:f7:cb:f3:fd:da:
-        ad:bd:6d:f1:dc:85:0f:dd:4d:21:9e:19:6a:97:b3:43:44:71:
-        db:74:3f:bf:8a:8d:06:54:48:fd:9e:88:e8:5d:d2:be:ee:b4:
-        69:1b:63:11
------BEGIN CERTIFICATE-----
-MIIESjCCAzKgAwIBAgIGDzR1UVFhMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNVBAYT
-Ak5OMTEwLwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNo
-IENsb3VkMSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjAe
-Fw0yMjEyMjMxMjIxMzdaFw0zMTAzMTExMjIxMzdaMFcxCzAJBgNVBAYTAk5OMTEw
-LwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNoIENsb3Vk
-MRUwEwYDVQQDDAxsb2NhbGhvc3Qubm4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
-ggEKAoIBAQCjmuQP4L2TqVqnXq2FXtbgmLTpIuBikMPZVzcWXVc9aMrizy9GZxoM
-rw6JhgEG39bJgBUKQ4VAP9ru7ngJfJDkiWOSQAsiHOLTFqmTYuQEerCrJTp0AkTq
-8TGJlCl0oOK7rucP8Thqhx7dW+akzJes0wGacSejIm3YSsdJXBauYacGOpC033Gv
-pf1RRnXNeOAMUplBT1YppqKj3dl+KT5opa/ANLVzUhIEkAcb9YujcVbFlU5iGNTs
-6U6QG5EluzIV2xU4WRTJxcYKCKot9WeqL+uXdIqLPl8JJ7C/s6OF6Xr1Odwdx/Q0
-c9jy7bDJHSqF7uL7UQle/7+8ecNtMIm5AgMBAAGjggEJMIIBBTAXBgNVHREEEDAO
-ggxsb2NhbGhvc3Qubm4wCwYDVR0PBAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUFBwMB
-MB0GA1UdDgQWBBSFoh12vcaL1tItBXck7Hh7cHF3wTAfBgNVHSMEGDAWgBSHy7Ez
-LsFnfnHj5StMTaSzbtJbqTAJBgNVHRMEAjAAMEMGCCsGAQUFBwEBBDcwNTAzBggr
-BgEFBQcwAoYnaHR0cDovL3Rlc3QuY3VybC5zZS9jYS9FZGVsQ3VybFJvb3QuY2Vy
-MDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly90ZXN0LmN1cmwuc2UvY2EvRWRlbEN1
-cmxSb290LmNybDANBgkqhkiG9w0BAQsFAAOCAQEAZo/16mpdWLZQsFt7H8FU2aO7
-NhvrGUoOHCZDMoTey8nrCJrundWmYj5w3mGJqdARICqmXBmrkXF49l+r5gOUs5RC
-e0LGN/BMt0ldkMXjJCygzv6+cRE+5gsThY025tuCi/1Roz1CTA39zwvYN6vy5VMV
-PwHXqXjVmf4ziNfGMd2/sdLmMRduKJEZJjbXvJgETDDLWOyzyR0ivyi8F20tXTbD
-5RKAXQJMYUiVqHeWSeIXh/07zFUVDbgTXjGXBXh4ew2OPawlmYFhd8SkoiXxcDQX
-QPfL8/3arb1t8dyFD91NIZ4ZapezQ0Rx23Q/v4qNBlRI/Z6I6F3Svu60aRtjEQ==
------END CERTIFICATE-----
diff --git a/third-party/curl/tests/certs/Server-localhost.nn-sv.prm b/third-party/curl/tests/certs/Server-localhost.nn-sv.prm
deleted file mode 100644
index 5e93bf8b7e..0000000000
--- a/third-party/curl/tests/certs/Server-localhost.nn-sv.prm
+++ /dev/null
@@ -1,38 +0,0 @@
-extensions = x509v3
-[ x509v3 ]
-subjectAltName = DNS:localhost.nn
-keyUsage	= keyEncipherment,digitalSignature,keyAgreement
-extendedKeyUsage = serverAuth
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid
-basicConstraints = CA:false
-authorityInfoAccess     = @issuer_info
-crlDistributionPoints   = @crl_info
-
-[ crl_ext ]
-authorityKeyIdentifier  = keyid:always
-authorityInfoAccess     = @issuer_info
-
-[ issuer_info ]
-caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
-
-[ crl_info ]
-URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
-
-[ req ]
-default_bits                    = 1024
-distinguished_name              = req_DN
-default_md			= sha256
-string_mask			= utf8only
-[ req_DN ]
-countryName                     = "Country Name is Northern Nowhere"
-countryName_value            = NN
-organizationName              = "Organization Name"
-organizationName_value     = Edel Curl Arctic Illudium Research Cloud
-commonName                      = "Common Name"
-commonName_value              = localhost.nn 
-
-[something]
-# The key
-# the certificate
-# some dhparam
diff --git a/third-party/curl/tests/certs/Server-localhost.nn-sv.pub.der b/third-party/curl/tests/certs/Server-localhost.nn-sv.pub.der
deleted file mode 100644
index af9bcfa4709780ee72c8abc1aeef8935ca3850e5..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 294
zcmV+>0ondAf&n5h4F(A+hDe6@4FLfG1potr0S^E$f&mHwf&l>lqnhLo;JuTnTBlyE
zg<jU+n6&94;9`)&*;h9fT~|G5%Hq#2MrRrfuMUZZ0S4dJ$$%9KLxn&;+V1Xn34D;`
ziDQyL3nCoi(-x_dV&nvRu&X6HbOJ=`@iB>%DRiLXyRPRC@i=OS9^G5!q|BGB(*c@s
zC!->5*h<GqTo$fjrv^HZwBK>BrTtMxb<KF-3{sgvPgW_WqNCl}eknd^rLVv=wR2Ju
z1ds<C^^2o%R>hT0Vi?ry=}wRvktMq_726d!Sro~|#tI0kE%j%rFYA|dii<v92`8|>
sv!jLSdi6Qn9mn)EbJ+6ju*n@Nh3?|}Q3+oEzr1<FZ7_+s0s{d60UY*)!2kdN

diff --git a/third-party/curl/tests/certs/Server-localhost.nn-sv.pub.pem b/third-party/curl/tests/certs/Server-localhost.nn-sv.pub.pem
deleted file mode 100644
index 85636ddd57..0000000000
--- a/third-party/curl/tests/certs/Server-localhost.nn-sv.pub.pem
+++ /dev/null
@@ -1,9 +0,0 @@
------BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo5rkD+C9k6lap16thV7W
-4Ji06SLgYpDD2Vc3Fl1XPWjK4s8vRmcaDK8OiYYBBt/WyYAVCkOFQD/a7u54CXyQ
-5IljkkALIhzi0xapk2LkBHqwqyU6dAJE6vExiZQpdKDiu67nD/E4aoce3VvmpMyX
-rNMBmnEnoyJt2ErHSVwWrmGnBjqQtN9xr6X9UUZ1zXjgDFKZQU9WKaaio93Zfik+
-aKWvwDS1c1ISBJAHG/WLo3FWxZVOYhjU7OlOkBuRJbsyFdsVOFkUycXGCgiqLfVn
-qi/rl3SKiz5fCSewv7Ojhel69TncHcf0NHPY8u2wyR0qhe7i+1EJXv+/vHnDbTCJ
-uQIDAQAB
------END PUBLIC KEY-----
diff --git a/third-party/curl/tests/certs/Server-localhost.nn-sv.pubkey-pinned b/third-party/curl/tests/certs/Server-localhost.nn-sv.pubkey-pinned
deleted file mode 100644
index ce49b28579..0000000000
--- a/third-party/curl/tests/certs/Server-localhost.nn-sv.pubkey-pinned
+++ /dev/null
@@ -1 +0,0 @@
-YRy84GLJxpJBGddJjhnqze5DJhkOUWytnCEqS0u0mTA=
diff --git a/third-party/curl/tests/certs/Server-localhost0h-sv.crl b/third-party/curl/tests/certs/Server-localhost0h-sv.crl
deleted file mode 100644
index f1d4401498..0000000000
--- a/third-party/curl/tests/certs/Server-localhost0h-sv.crl
+++ /dev/null
@@ -1,14 +0,0 @@
------BEGIN X509 CRL-----
-MIICDjCB9wIBATANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJOTjExMC8GA1UE
-CgwoRWRlbCBDdXJsIEFyY3RpYyBJbGx1ZGl1bSBSZXNlYXJjaCBDbG91ZDEmMCQG
-A1UEAwwdTm9ydGhlcm4gTm93aGVyZSBUcnVzdCBBbmNob3IXDTIyMTIyMzEyMjEz
-N1oXDTIzMDEyMjEyMjEzN1owSzAXAgYPNHVRKjwXDTIyMTIyMzEyMjEzNlowFwIG
-DzR1UVFhFw0yMjEyMjMxMjIxMzdaMBcCBg80dVFRdRcNMjIxMjIzMTIyMTM3WqAO
-MAwwCgYDVR0UBAMCAQEwDQYJKoZIhvcNAQELBQADggEBAEYPECPj+TzlRKUcYBwN
-SWqSBzua1dBket0sNYYnm2Jvst27guK10XwGcD4Jei7VDdTXfxLiXMQahWO/SIUE
-ZGrFhU6vdq7rSk179acREDYFgYDNxgSKgyU4SjzTJ+VantWs+ky0lsyiu2Sh8B4G
-bDmG4mEPXPykHufpbmkUCLqFd89JiuhNTripOUzJfAWLDPPYf4gn2ktenz/hFwJA
-o5CSWsn13iO+9NRVJ/5ErIuoLEdGzRVoCfDNKAJ2XE0ZhRPclmRHThaoxRnBeQFg
-AVGB+xLd3BSZQuOw3pxn4smGXg/9BW3qEba5W24P4WA4ldw2j4q8WviOygvUVBQ7
-pCw=
------END X509 CRL-----
diff --git a/third-party/curl/tests/certs/Server-localhost0h-sv.crt b/third-party/curl/tests/certs/Server-localhost0h-sv.crt
deleted file mode 100644
index e9892d0430..0000000000
--- a/third-party/curl/tests/certs/Server-localhost0h-sv.crt
+++ /dev/null
@@ -1,99 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 16717980979573 (0xf3475515175)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = Northern Nowhere Trust Anchor
-        Validity
-            Not Before: Dec 23 12:21:37 2022 GMT
-            Not After : Mar 11 12:21:37 2031 GMT
-        Subject:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = localhost
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:df:29:93:58:82:1d:a2:b8:07:2a:b2:8f:93:0e:
-                    df:15:49:72:06:93:19:4a:2d:c5:bd:56:92:5a:da:
-                    f4:d3:9a:01:1c:ee:47:57:0e:9e:d8:d7:0d:c4:ce:
-                    4b:a2:f0:fc:07:ec:91:e9:95:08:f4:e9:5d:f2:49:
-                    f3:0b:98:f0:d8:c7:d4:67:2f:fb:f2:94:3b:14:c8:
-                    06:da:39:70:8a:f9:4b:70:a8:74:6b:3f:5b:d1:a4:
-                    1c:ea:bd:f1:9e:c1:e2:e7:98:88:4f:e9:4b:b6:c8:
-                    d6:9e:01:f3:b7:c9:ee:cd:e2:d7:96:68:14:d7:44:
-                    c6:11:13:9f:6c:06:4e:57:98:53:c8:40:de:9d:44:
-                    1f:6a:f4:01:b0:56:47:5e:3b:b5:3c:29:9b:96:f3:
-                    9a:5a:78:d1:11:51:25:0e:43:82:4a:d3:df:54:5a:
-                    46:00:de:b0:a2:2e:65:54:44:40:9c:64:d3:e8:3f:
-                    e8:ac:e3:0c:fb:36:0a:c5:79:37:a9:a2:ef:06:14:
-                    43:ac:9e:20:de:30:d2:ea:79:7d:ef:f2:0c:93:70:
-                    8d:bb:14:ff:4c:56:41:e4:2a:de:92:0a:ce:65:2c:
-                    d3:fb:29:0f:4f:f9:16:d7:62:54:4e:4c:a8:05:34:
-                    5d:e6:20:e3:89:bc:7b:1f:df:21:57:66:a9:20:ce:
-                    e6:b3
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Alternative Name: 
-                0
..localhost.h
-            X509v3 Key Usage: 
-                Digital Signature, Key Encipherment, Key Agreement
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication
-            X509v3 Subject Key Identifier: 
-                6B:56:00:F3:01:BC:16:8B:EB:CF:75:A1:89:DB:26:B1:C4:ED:71:64
-            X509v3 Authority Key Identifier: 
-                87:CB:B1:33:2E:C1:67:7E:71:E3:E5:2B:4C:4D:A4:B3:6E:D2:5B:A9
-            X509v3 Basic Constraints: 
-                CA:FALSE
-            Authority Information Access: 
-                CA Issuers - URI:http://test.curl.se/ca/EdelCurlRoot.cer
-            X509v3 CRL Distribution Points: 
-                Full Name:
-                  URI:http://test.curl.se/ca/EdelCurlRoot.crl
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        5a:b2:83:c0:94:ce:25:aa:a0:f4:b6:71:fb:16:b4:e0:10:3c:
-        9c:a0:db:2a:fc:b7:f8:97:64:cc:19:92:56:63:a9:e6:50:d6:
-        6d:79:b6:a3:62:23:d2:48:21:37:46:46:3e:9d:cd:1f:55:18:
-        77:fd:7f:35:ea:d8:68:9c:1c:2f:c8:23:43:a2:cd:77:3c:5c:
-        21:94:93:80:84:d0:6a:8a:5b:ae:11:be:79:3e:80:17:32:9e:
-        73:0b:dd:0d:f5:f6:4f:3f:1b:a3:eb:aa:21:06:a7:ef:c7:bf:
-        e5:87:67:2c:38:a3:c1:d4:f2:b4:ce:72:9d:2e:f8:b9:91:cb:
-        83:1a:c9:be:74:bb:ac:78:5c:d9:3e:fd:1f:9d:ac:19:5e:b3:
-        00:66:38:71:7e:06:2e:fe:1a:c0:ad:f7:82:1d:85:6d:3d:3c:
-        9d:62:66:cd:1e:6d:f1:67:7a:05:4a:58:6e:7a:a7:1f:2f:7c:
-        5f:c0:2c:19:df:de:c6:2d:13:c6:3b:ea:6d:98:d0:55:98:4c:
-        00:a7:e2:2f:7d:86:24:49:2d:86:c3:75:d0:71:41:16:8c:7b:
-        49:25:eb:d2:cd:9b:08:b4:5f:6e:aa:4a:2d:6c:5b:89:67:7f:
-        3f:0c:43:43:bd:83:f7:ef:1e:ee:e7:6a:e7:3a:c1:c7:aa:1d:
-        5b:34:1b:d1
------BEGIN CERTIFICATE-----
-MIIERjCCAy6gAwIBAgIGDzR1UVF1MA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNVBAYT
-Ak5OMTEwLwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNo
-IENsb3VkMSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjAe
-Fw0yMjEyMjMxMjIxMzdaFw0zMTAzMTExMjIxMzdaMFQxCzAJBgNVBAYTAk5OMTEw
-LwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNoIENsb3Vk
-MRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQDfKZNYgh2iuAcqso+TDt8VSXIGkxlKLcW9VpJa2vTTmgEc7kdXDp7Y1w3E
-zkui8PwH7JHplQj06V3ySfMLmPDYx9RnL/vylDsUyAbaOXCK+UtwqHRrP1vRpBzq
-vfGeweLnmIhP6Uu2yNaeAfO3ye7N4teWaBTXRMYRE59sBk5XmFPIQN6dRB9q9AGw
-VkdeO7U8KZuW85paeNERUSUOQ4JK099UWkYA3rCiLmVURECcZNPoP+is4wz7NgrF
-eTepou8GFEOsniDeMNLqeX3v8gyTcI27FP9MVkHkKt6SCs5lLNP7KQ9P+RbXYlRO
-TKgFNF3mIOOJvHsf3yFXZqkgzuazAgMBAAGjggEIMIIBBDAWBgNVHREEDzANggts
-b2NhbGhvc3QAaDALBgNVHQ8EBAMCA6gwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYD
-VR0OBBYEFGtWAPMBvBaL6891oYnbJrHE7XFkMB8GA1UdIwQYMBaAFIfLsTMuwWd+
-cePlK0xNpLNu0lupMAkGA1UdEwQCMAAwQwYIKwYBBQUHAQEENzA1MDMGCCsGAQUF
-BzAChidodHRwOi8vdGVzdC5jdXJsLnNlL2NhL0VkZWxDdXJsUm9vdC5jZXIwOAYD
-VR0fBDEwLzAtoCugKYYnaHR0cDovL3Rlc3QuY3VybC5zZS9jYS9FZGVsQ3VybFJv
-b3QuY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQBasoPAlM4lqqD0tnH7FrTgEDycoNsq
-/Lf4l2TMGZJWY6nmUNZtebajYiPSSCE3RkY+nc0fVRh3/X816thonBwvyCNDos13
-PFwhlJOAhNBqiluuEb55PoAXMp5zC90N9fZPPxuj66ohBqfvx7/lh2csOKPB1PK0
-znKdLvi5kcuDGsm+dLuseFzZPv0fnawZXrMAZjhxfgYu/hrArfeCHYVtPTydYmbN
-Hm3xZ3oFSlhueqcfL3xfwCwZ397GLRPGO+ptmNBVmEwAp+IvfYYkSS2Gw3XQcUEW
-jHtJJevSzZsItF9uqkotbFuJZ38/DENDvYP37x7u52rnOsHHqh1bNBvR
------END CERTIFICATE-----
diff --git a/third-party/curl/tests/certs/Server-localhost0h-sv.csr b/third-party/curl/tests/certs/Server-localhost0h-sv.csr
deleted file mode 100644
index d2a021e58c..0000000000
--- a/third-party/curl/tests/certs/Server-localhost0h-sv.csr
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN CERTIFICATE REQUEST-----
-MIICmTCCAYECAQAwVDELMAkGA1UEBhMCTk4xMTAvBgNVBAoMKEVkZWwgQ3VybCBB
-cmN0aWMgSWxsdWRpdW0gUmVzZWFyY2ggQ2xvdWQxEjAQBgNVBAMMCWxvY2FsaG9z
-dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN8pk1iCHaK4Byqyj5MO
-3xVJcgaTGUotxb1Wklra9NOaARzuR1cOntjXDcTOS6Lw/AfskemVCPTpXfJJ8wuY
-8NjH1Gcv+/KUOxTIBto5cIr5S3CodGs/W9GkHOq98Z7B4ueYiE/pS7bI1p4B87fJ
-7s3i15ZoFNdExhETn2wGTleYU8hA3p1EH2r0AbBWR147tTwpm5bzmlp40RFRJQ5D
-gkrT31RaRgDesKIuZVREQJxk0+g/6KzjDPs2CsV5N6mi7wYUQ6yeIN4w0up5fe/y
-DJNwjbsU/0xWQeQq3pIKzmUs0/spD0/5FtdiVE5MqAU0XeYg44m8ex/fIVdmqSDO
-5rMCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQAMIFsOpe5YFYwa7F2qr1CoBYhR
-XNOEK5Yc6pY4ND+/1hbsSkT285Ar7yIA4+fFwYa4F4DkpzfZ0DLwHPqQE85pQf2M
-YyjwMIU97xwNKLHrrObpgVJ+hs8cDj0zYJVGnIWiK1556I5lotupuzzig7Fyo0XY
-OSbg+NxaXMHil4eLWIs8CapWAU4gHcZnDpkYL86aWfeFAYixB/FkcAzZJR+fOSif
-KYTc0kKR34nDpJVN1pck03tCvRY48SRliHnNpAP/Enf57BLSJvA15f64Iz3hthxL
-47xJsj2zs+CkHvfYnaLhDpTlOxr73uK4dhWcyynufvjElO2G+MOMcFRduWU6
------END CERTIFICATE REQUEST-----
diff --git a/third-party/curl/tests/certs/Server-localhost0h-sv.der b/third-party/curl/tests/certs/Server-localhost0h-sv.der
deleted file mode 100644
index cdadd76bb4393a20e698f1974fdd96299818cd37..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1098
zcmXqLVsSHQV%A&0%*4pV#Kvz@8W>n=z{|#|)#lOmotKf3o0Y*J!;ss6lZ`o)g-w{r
z&(F}%Kp({6;?ZzTNzGAkE-lJYa4bqL$xK%8%*iQD$t=xP2udwZO)N^zP;k!4FHJF2
zGf)9(Vdjzb%P%U)NG-}!@XId;(y0m|MWw|h3XXZn8Tmy9a^k#3MutX4#z1UnY#t@f
zYiwv>Y-kAO8iY{n5+MTth)Xzg@{<#DGV+T{44N2~kiE>v%D~*j$j<;2=VEGNWMsIn
zIXR+9cF_)Ytxf%t`R<E)7O_p1^wK@LH*8YWtuL2nG0MDi59gbA<2vt=bKZ+S{9%7H
z@#R#GFE3+1d4A@e@!`htE9v^bKTWX~Il*?zvY_jycfpF1Z2RboOJrW{{W$O7qvta^
z{9k%+J8^9u<LB)s-<^GQeOiXdb(dp;!t-<3{K97hpK!Q0*F`?-3*&|`_c-gVHkz}i
zeV!FnaZxZ(mCw1!>+=1OC^v?C8y4xMhPXJ)NxA&O{>7TdJipDjj#iqlT=bqz#Cgp;
zg?k2<URBn<|HL!7pm(>(f1fbNCtCL=ah*%mx%^v`-~XrB^`sC#pB1bovCkA9ckZc{
zzpogcwo>8Tv&~G*j0}v6n;1EOA;MxH1`I!0K^A@k-X?B%7&2rSaD&A8Sy-5vm{%AG
zgE*=zJO*5B9NKJ*tgP(Jj0UnGK|U5S7Ln{QhR=+9#JXRfFJ0JqTW#Z!w}mMN@*rtt
z76}8f29fsD8;$i2rq>ldeyZ)`yJU0TrRbI5G$<>~!eqc;;0!aCk&(sRz|_DP#y4PU
zQ_m<VDX`MlFG(#f(MtxVPQBt({p3V_P-+Dw)}Z`+pm=JLfd$Ayc@|)LHqc$5y+D&l
zokcmwsRfupfT@L%A!<|efhp%yS1tImt?;+lmIneha~9mz`m_DV^prD_lfsf$J`1>(
zTe)p<lJX@FMRPYdySZoOLnX@p)|<Y%kugU`|AeyhqO;{TF^W?rH?&;H>WW?`xUbT#
zLELCwG51~GuiyObr5C?mrO3AY{qg-z+tYO{79YIwY0J5yxq3f#PCVT#b#h<H?ll!L
zH|_q)&s`%Kx0xZ$qOgul@1N9xwcnd$TXSt~<|d_`mCOB@Ud8Gakyo``UcV;(fR5z-
zd&hKzk6FLUopB*_h7ZH?NBXsGDxSJ+hf6OMI*RpFd#b*^bapn!miW9?Ub;Eao$2-V
bJkHL0o4>!8d-pu+xz)krt7M~1q%Q&hHfEE7

diff --git a/third-party/curl/tests/certs/Server-localhost0h-sv.dhp b/third-party/curl/tests/certs/Server-localhost0h-sv.dhp
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/third-party/curl/tests/certs/Server-localhost0h-sv.key b/third-party/curl/tests/certs/Server-localhost0h-sv.key
deleted file mode 100644
index 0e0533ec37..0000000000
--- a/third-party/curl/tests/certs/Server-localhost0h-sv.key
+++ /dev/null
@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDfKZNYgh2iuAcq
-so+TDt8VSXIGkxlKLcW9VpJa2vTTmgEc7kdXDp7Y1w3Ezkui8PwH7JHplQj06V3y
-SfMLmPDYx9RnL/vylDsUyAbaOXCK+UtwqHRrP1vRpBzqvfGeweLnmIhP6Uu2yNae
-AfO3ye7N4teWaBTXRMYRE59sBk5XmFPIQN6dRB9q9AGwVkdeO7U8KZuW85paeNER
-USUOQ4JK099UWkYA3rCiLmVURECcZNPoP+is4wz7NgrFeTepou8GFEOsniDeMNLq
-eX3v8gyTcI27FP9MVkHkKt6SCs5lLNP7KQ9P+RbXYlROTKgFNF3mIOOJvHsf3yFX
-ZqkgzuazAgMBAAECggEAa31sIpKx0aHQmeleLJhaLbetu6r44HkBqPxdDHQwvweM
-B7JiHHXHX2zejfBMEFUBIJP7iEYoBUeu37hs4CYvxEskbPt44NQzTQQ4AL7wDZCc
-nMwXH11qTaU95HfPPQfo0mLvLYaS2J0Oexc3nEwgwXzFGQZTG4ld2fXYsUCsVZX8
-PoHbkKWEHveQEFDmGezguc2UG3DrXaZv5gbMhVik048zX3P5cn0ic9TK9yEFZDXS
-8Qiq/SHTHEnkZV5J8s12pcDyQdi1cN96MVZ1/feeg1Pc06q7PN7xvkmZHCQ1tOdl
-b7STXNPrJ0P7OwbeB0Q3xNwqI25wicN1oaBvdR/PAQKBgQD4gN6+sR74FNC4q99T
-fuFqwJ36W8GG0jc9joJTbITXGSdArQHm838Mippp0P3MrUTLqXI0nhjH8ePjF83R
-KRWGoUvSc2Xe7LjzzEmg9CmtB+QD97Qir0468izqnlP1Ef16kbbIMLsoVgIht6YY
-klUYs7x3AtDBvHV7EKlP63kUgQKBgQDl5QDW+KZRvQU/G7tWsOZ6iQ3Ed8Zt4uRk
-EshPeCoz0S0ks8pzpa+YaAAUKsHvgiL7oLMFquuVHn7TctYBoe2/bwdj0/IW/1pP
-oDJqRJIbamjYj6qKG7Ihx0yx+z7f7vbKCgC5ifzy0Xl60E9fRIf3/dVopU+3qtwG
-qOphkrNRMwKBgQCrEixFIjGrnsjBGLC5DhOoJcmbXCcx5O1aVwyo2X/pg8td3rv8
-fYvs2k3KorDVgkJl4dRZHKz6mC7FWtG5N4s2DzvfOMncWSJJ00ysnOlD0LbLdG5x
-ojU8pxL8wNoTT7sr8bvevI1bCzqUc5TIPZSPWMxZMXr8o/xMKAAmoHfOAQKBgDBH
-VlTO5Qa3XlmxdjcvcUd8bsK6sJY1FueZNi3SO3KkVAmoJDUDL4wfEx0pGY810ijr
-x4zCJzUqsVGwhRbUrbwNEg053lZMC+g66Tt96P0O7LPF//d+93q2gvnBnKOkaHln
-fl14iAFqUkujYXfNSYyf5uhSBxq4K/rOEGKrTzMXAoGBAL3Hz3s5Gvy44SMV0UHl
-18gEqR0y9mXfgON9Rk0yE+fFYFRnFf4iHIxhodXPIGeu1CpqtXjEcG8JXVXniaao
-qNGbVs2QoBUVW81sHG9h/ulHCAwjFvZhFYgDiRQPcVd3lNJM4gigjRyw/nRnQH+2
-MVCJe5htDEMM58h8LepU4T8M
------END PRIVATE KEY-----
diff --git a/third-party/curl/tests/certs/Server-localhost0h-sv.pem b/third-party/curl/tests/certs/Server-localhost0h-sv.pem
deleted file mode 100644
index 72f326dfba..0000000000
--- a/third-party/curl/tests/certs/Server-localhost0h-sv.pem
+++ /dev/null
@@ -1,166 +0,0 @@
-extensions = x509v3
-[ x509v3 ]
-#subjectAltName = DNS:localhost\0h
-subjectAltName = DER:30:0d:82:0b:6c:6f:63:61:6c:68:6f:73:74:00:68
-keyUsage	= keyEncipherment,digitalSignature,keyAgreement
-extendedKeyUsage = serverAuth
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid
-basicConstraints = CA:false
-authorityInfoAccess     = @issuer_info
-crlDistributionPoints   = @crl_info
-
-[ crl_ext ]
-authorityKeyIdentifier  = keyid:always
-authorityInfoAccess     = @issuer_info
-
-[ issuer_info ]
-caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
-
-[ crl_info ]
-URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
-
-[ req ]
-default_bits                    = 1024
-distinguished_name              = req_DN
-default_md			= sha256
-string_mask			= utf8only
-[ req_DN ]
-countryName                     = "Country Name is Northern Nowhere"
-countryName_value            = NN
-organizationName              = "Organization Name"
-organizationName_value     = Edel Curl Arctic Illudium Research Cloud
-commonName                      = "Common Name"
-commonName_value              = localhost 
-
-[something]
-# The key
-# the certificate
-# some dhparam
------BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDfKZNYgh2iuAcq
-so+TDt8VSXIGkxlKLcW9VpJa2vTTmgEc7kdXDp7Y1w3Ezkui8PwH7JHplQj06V3y
-SfMLmPDYx9RnL/vylDsUyAbaOXCK+UtwqHRrP1vRpBzqvfGeweLnmIhP6Uu2yNae
-AfO3ye7N4teWaBTXRMYRE59sBk5XmFPIQN6dRB9q9AGwVkdeO7U8KZuW85paeNER
-USUOQ4JK099UWkYA3rCiLmVURECcZNPoP+is4wz7NgrFeTepou8GFEOsniDeMNLq
-eX3v8gyTcI27FP9MVkHkKt6SCs5lLNP7KQ9P+RbXYlROTKgFNF3mIOOJvHsf3yFX
-ZqkgzuazAgMBAAECggEAa31sIpKx0aHQmeleLJhaLbetu6r44HkBqPxdDHQwvweM
-B7JiHHXHX2zejfBMEFUBIJP7iEYoBUeu37hs4CYvxEskbPt44NQzTQQ4AL7wDZCc
-nMwXH11qTaU95HfPPQfo0mLvLYaS2J0Oexc3nEwgwXzFGQZTG4ld2fXYsUCsVZX8
-PoHbkKWEHveQEFDmGezguc2UG3DrXaZv5gbMhVik048zX3P5cn0ic9TK9yEFZDXS
-8Qiq/SHTHEnkZV5J8s12pcDyQdi1cN96MVZ1/feeg1Pc06q7PN7xvkmZHCQ1tOdl
-b7STXNPrJ0P7OwbeB0Q3xNwqI25wicN1oaBvdR/PAQKBgQD4gN6+sR74FNC4q99T
-fuFqwJ36W8GG0jc9joJTbITXGSdArQHm838Mippp0P3MrUTLqXI0nhjH8ePjF83R
-KRWGoUvSc2Xe7LjzzEmg9CmtB+QD97Qir0468izqnlP1Ef16kbbIMLsoVgIht6YY
-klUYs7x3AtDBvHV7EKlP63kUgQKBgQDl5QDW+KZRvQU/G7tWsOZ6iQ3Ed8Zt4uRk
-EshPeCoz0S0ks8pzpa+YaAAUKsHvgiL7oLMFquuVHn7TctYBoe2/bwdj0/IW/1pP
-oDJqRJIbamjYj6qKG7Ihx0yx+z7f7vbKCgC5ifzy0Xl60E9fRIf3/dVopU+3qtwG
-qOphkrNRMwKBgQCrEixFIjGrnsjBGLC5DhOoJcmbXCcx5O1aVwyo2X/pg8td3rv8
-fYvs2k3KorDVgkJl4dRZHKz6mC7FWtG5N4s2DzvfOMncWSJJ00ysnOlD0LbLdG5x
-ojU8pxL8wNoTT7sr8bvevI1bCzqUc5TIPZSPWMxZMXr8o/xMKAAmoHfOAQKBgDBH
-VlTO5Qa3XlmxdjcvcUd8bsK6sJY1FueZNi3SO3KkVAmoJDUDL4wfEx0pGY810ijr
-x4zCJzUqsVGwhRbUrbwNEg053lZMC+g66Tt96P0O7LPF//d+93q2gvnBnKOkaHln
-fl14iAFqUkujYXfNSYyf5uhSBxq4K/rOEGKrTzMXAoGBAL3Hz3s5Gvy44SMV0UHl
-18gEqR0y9mXfgON9Rk0yE+fFYFRnFf4iHIxhodXPIGeu1CpqtXjEcG8JXVXniaao
-qNGbVs2QoBUVW81sHG9h/ulHCAwjFvZhFYgDiRQPcVd3lNJM4gigjRyw/nRnQH+2
-MVCJe5htDEMM58h8LepU4T8M
------END PRIVATE KEY-----
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 16717980979573 (0xf3475515175)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = Northern Nowhere Trust Anchor
-        Validity
-            Not Before: Dec 23 12:21:37 2022 GMT
-            Not After : Mar 11 12:21:37 2031 GMT
-        Subject:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = localhost
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:df:29:93:58:82:1d:a2:b8:07:2a:b2:8f:93:0e:
-                    df:15:49:72:06:93:19:4a:2d:c5:bd:56:92:5a:da:
-                    f4:d3:9a:01:1c:ee:47:57:0e:9e:d8:d7:0d:c4:ce:
-                    4b:a2:f0:fc:07:ec:91:e9:95:08:f4:e9:5d:f2:49:
-                    f3:0b:98:f0:d8:c7:d4:67:2f:fb:f2:94:3b:14:c8:
-                    06:da:39:70:8a:f9:4b:70:a8:74:6b:3f:5b:d1:a4:
-                    1c:ea:bd:f1:9e:c1:e2:e7:98:88:4f:e9:4b:b6:c8:
-                    d6:9e:01:f3:b7:c9:ee:cd:e2:d7:96:68:14:d7:44:
-                    c6:11:13:9f:6c:06:4e:57:98:53:c8:40:de:9d:44:
-                    1f:6a:f4:01:b0:56:47:5e:3b:b5:3c:29:9b:96:f3:
-                    9a:5a:78:d1:11:51:25:0e:43:82:4a:d3:df:54:5a:
-                    46:00:de:b0:a2:2e:65:54:44:40:9c:64:d3:e8:3f:
-                    e8:ac:e3:0c:fb:36:0a:c5:79:37:a9:a2:ef:06:14:
-                    43:ac:9e:20:de:30:d2:ea:79:7d:ef:f2:0c:93:70:
-                    8d:bb:14:ff:4c:56:41:e4:2a:de:92:0a:ce:65:2c:
-                    d3:fb:29:0f:4f:f9:16:d7:62:54:4e:4c:a8:05:34:
-                    5d:e6:20:e3:89:bc:7b:1f:df:21:57:66:a9:20:ce:
-                    e6:b3
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Alternative Name: 
-                0
..localhost.h
-            X509v3 Key Usage: 
-                Digital Signature, Key Encipherment, Key Agreement
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication
-            X509v3 Subject Key Identifier: 
-                6B:56:00:F3:01:BC:16:8B:EB:CF:75:A1:89:DB:26:B1:C4:ED:71:64
-            X509v3 Authority Key Identifier: 
-                87:CB:B1:33:2E:C1:67:7E:71:E3:E5:2B:4C:4D:A4:B3:6E:D2:5B:A9
-            X509v3 Basic Constraints: 
-                CA:FALSE
-            Authority Information Access: 
-                CA Issuers - URI:http://test.curl.se/ca/EdelCurlRoot.cer
-            X509v3 CRL Distribution Points: 
-                Full Name:
-                  URI:http://test.curl.se/ca/EdelCurlRoot.crl
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        5a:b2:83:c0:94:ce:25:aa:a0:f4:b6:71:fb:16:b4:e0:10:3c:
-        9c:a0:db:2a:fc:b7:f8:97:64:cc:19:92:56:63:a9:e6:50:d6:
-        6d:79:b6:a3:62:23:d2:48:21:37:46:46:3e:9d:cd:1f:55:18:
-        77:fd:7f:35:ea:d8:68:9c:1c:2f:c8:23:43:a2:cd:77:3c:5c:
-        21:94:93:80:84:d0:6a:8a:5b:ae:11:be:79:3e:80:17:32:9e:
-        73:0b:dd:0d:f5:f6:4f:3f:1b:a3:eb:aa:21:06:a7:ef:c7:bf:
-        e5:87:67:2c:38:a3:c1:d4:f2:b4:ce:72:9d:2e:f8:b9:91:cb:
-        83:1a:c9:be:74:bb:ac:78:5c:d9:3e:fd:1f:9d:ac:19:5e:b3:
-        00:66:38:71:7e:06:2e:fe:1a:c0:ad:f7:82:1d:85:6d:3d:3c:
-        9d:62:66:cd:1e:6d:f1:67:7a:05:4a:58:6e:7a:a7:1f:2f:7c:
-        5f:c0:2c:19:df:de:c6:2d:13:c6:3b:ea:6d:98:d0:55:98:4c:
-        00:a7:e2:2f:7d:86:24:49:2d:86:c3:75:d0:71:41:16:8c:7b:
-        49:25:eb:d2:cd:9b:08:b4:5f:6e:aa:4a:2d:6c:5b:89:67:7f:
-        3f:0c:43:43:bd:83:f7:ef:1e:ee:e7:6a:e7:3a:c1:c7:aa:1d:
-        5b:34:1b:d1
------BEGIN CERTIFICATE-----
-MIIERjCCAy6gAwIBAgIGDzR1UVF1MA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNVBAYT
-Ak5OMTEwLwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNo
-IENsb3VkMSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjAe
-Fw0yMjEyMjMxMjIxMzdaFw0zMTAzMTExMjIxMzdaMFQxCzAJBgNVBAYTAk5OMTEw
-LwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNoIENsb3Vk
-MRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQDfKZNYgh2iuAcqso+TDt8VSXIGkxlKLcW9VpJa2vTTmgEc7kdXDp7Y1w3E
-zkui8PwH7JHplQj06V3ySfMLmPDYx9RnL/vylDsUyAbaOXCK+UtwqHRrP1vRpBzq
-vfGeweLnmIhP6Uu2yNaeAfO3ye7N4teWaBTXRMYRE59sBk5XmFPIQN6dRB9q9AGw
-VkdeO7U8KZuW85paeNERUSUOQ4JK099UWkYA3rCiLmVURECcZNPoP+is4wz7NgrF
-eTepou8GFEOsniDeMNLqeX3v8gyTcI27FP9MVkHkKt6SCs5lLNP7KQ9P+RbXYlRO
-TKgFNF3mIOOJvHsf3yFXZqkgzuazAgMBAAGjggEIMIIBBDAWBgNVHREEDzANggts
-b2NhbGhvc3QAaDALBgNVHQ8EBAMCA6gwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYD
-VR0OBBYEFGtWAPMBvBaL6891oYnbJrHE7XFkMB8GA1UdIwQYMBaAFIfLsTMuwWd+
-cePlK0xNpLNu0lupMAkGA1UdEwQCMAAwQwYIKwYBBQUHAQEENzA1MDMGCCsGAQUF
-BzAChidodHRwOi8vdGVzdC5jdXJsLnNlL2NhL0VkZWxDdXJsUm9vdC5jZXIwOAYD
-VR0fBDEwLzAtoCugKYYnaHR0cDovL3Rlc3QuY3VybC5zZS9jYS9FZGVsQ3VybFJv
-b3QuY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQBasoPAlM4lqqD0tnH7FrTgEDycoNsq
-/Lf4l2TMGZJWY6nmUNZtebajYiPSSCE3RkY+nc0fVRh3/X816thonBwvyCNDos13
-PFwhlJOAhNBqiluuEb55PoAXMp5zC90N9fZPPxuj66ohBqfvx7/lh2csOKPB1PK0
-znKdLvi5kcuDGsm+dLuseFzZPv0fnawZXrMAZjhxfgYu/hrArfeCHYVtPTydYmbN
-Hm3xZ3oFSlhueqcfL3xfwCwZ397GLRPGO+ptmNBVmEwAp+IvfYYkSS2Gw3XQcUEW
-jHtJJevSzZsItF9uqkotbFuJZ38/DENDvYP37x7u52rnOsHHqh1bNBvR
------END CERTIFICATE-----
diff --git a/third-party/curl/tests/certs/Server-localhost0h-sv.prm b/third-party/curl/tests/certs/Server-localhost0h-sv.prm
deleted file mode 100644
index 439aefb9e7..0000000000
--- a/third-party/curl/tests/certs/Server-localhost0h-sv.prm
+++ /dev/null
@@ -1,39 +0,0 @@
-extensions = x509v3
-[ x509v3 ]
-#subjectAltName = DNS:localhost\0h
-subjectAltName = DER:30:0d:82:0b:6c:6f:63:61:6c:68:6f:73:74:00:68
-keyUsage	= keyEncipherment,digitalSignature,keyAgreement
-extendedKeyUsage = serverAuth
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid
-basicConstraints = CA:false
-authorityInfoAccess     = @issuer_info
-crlDistributionPoints   = @crl_info
-
-[ crl_ext ]
-authorityKeyIdentifier  = keyid:always
-authorityInfoAccess     = @issuer_info
-
-[ issuer_info ]
-caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
-
-[ crl_info ]
-URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
-
-[ req ]
-default_bits                    = 1024
-distinguished_name              = req_DN
-default_md			= sha256
-string_mask			= utf8only
-[ req_DN ]
-countryName                     = "Country Name is Northern Nowhere"
-countryName_value            = NN
-organizationName              = "Organization Name"
-organizationName_value     = Edel Curl Arctic Illudium Research Cloud
-commonName                      = "Common Name"
-commonName_value              = localhost 
-
-[something]
-# The key
-# the certificate
-# some dhparam
diff --git a/third-party/curl/tests/certs/Server-localhost0h-sv.pub.der b/third-party/curl/tests/certs/Server-localhost0h-sv.pub.der
deleted file mode 100644
index 5c0e00d056456f317df7a06096adbb5061307092..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 294
zcmV+>0ondAf&n5h4F(A+hDe6@4FLfG1potr0S^E$f&mHwf&l>l-zk$=f*qo`2P(3U
zlMde%Npc308A>h1y;hQ1+Vs<!0UYi}R}P-o*A2wZOQP`n2kepQl?e3dUGhou3z+cO
z$JA#p`|^}K6vzhJIdF>kOK_-kYd>4jq#WwK@t(or=a`63=}WfA)}8_Lx5@6!;@6gF
z6xT$?5fh(m22NL)Q^-KxokSmM^Z~F|M_xO%JSm%&^O{<C(GgK44nu-U)8ABDMgZQh
zqAq1rL_nNm)963wtm6#(HVVagH>slU1{6cAo*>>Z(&~AA@A3?jaE-eZ|4ddv<SO2h
s3eIIL)B7n8Px%(tVpL8{s0B1#<{;yVyn7$tAy;OpAkOBq0s{d60T7&r{Qv*}

diff --git a/third-party/curl/tests/certs/Server-localhost0h-sv.pub.pem b/third-party/curl/tests/certs/Server-localhost0h-sv.pub.pem
deleted file mode 100644
index b8a1ee9e2c..0000000000
--- a/third-party/curl/tests/certs/Server-localhost0h-sv.pub.pem
+++ /dev/null
@@ -1,9 +0,0 @@
------BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3ymTWIIdorgHKrKPkw7f
-FUlyBpMZSi3FvVaSWtr005oBHO5HVw6e2NcNxM5LovD8B+yR6ZUI9Old8knzC5jw
-2MfUZy/78pQ7FMgG2jlwivlLcKh0az9b0aQc6r3xnsHi55iIT+lLtsjWngHzt8nu
-zeLXlmgU10TGEROfbAZOV5hTyEDenUQfavQBsFZHXju1PCmblvOaWnjREVElDkOC
-StPfVFpGAN6woi5lVERAnGTT6D/orOMM+zYKxXk3qaLvBhRDrJ4g3jDS6nl97/IM
-k3CNuxT/TFZB5CrekgrOZSzT+ykPT/kW12JUTkyoBTRd5iDjibx7H98hV2apIM7m
-swIDAQAB
------END PUBLIC KEY-----
diff --git a/third-party/curl/tests/certs/Server-localhost0h-sv.pubkey-pinned b/third-party/curl/tests/certs/Server-localhost0h-sv.pubkey-pinned
deleted file mode 100644
index 0347fc0f5e..0000000000
--- a/third-party/curl/tests/certs/Server-localhost0h-sv.pubkey-pinned
+++ /dev/null
@@ -1 +0,0 @@
-uWdzTJv+PXoad5XzSPC85Nm6FcqVkGl+8tTRW5KCLbA=
diff --git a/third-party/curl/tests/certs/genserv.pl b/third-party/curl/tests/certs/genserv.pl
new file mode 100644
index 0000000000..6e8ceec315
--- /dev/null
+++ b/third-party/curl/tests/certs/genserv.pl
@@ -0,0 +1,146 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) EdelWeb for EdelKey and OpenEvidence
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+use File::Basename;
+use File::Spec;
+use IPC::Open3;
+use Symbol 'gensym';
+
+sub opensslfail {
+    die "Missing or broken 'openssl' tool. openssl 1.0.2+ is required. ".
+        "Without it, this script cannot generate the necessary certificates ".
+        "the curl test suite needs for all its TLS related tests.";
+}
+
+my $OPENSSL = 'openssl';
+if(-f '/usr/local/ssl/bin/openssl') {
+    $OPENSSL = '/usr/local/ssl/bin/openssl';
+}
+
+my $SRCDIR = dirname(__FILE__);
+my $fh;
+
+my $KEYSIZE = 'prime256v1';
+my $DURATION;
+my $PREFIX;
+
+sub redir {
+    my $outfn = shift if($_[0] =~ /^>/);
+    my $hideerr = shift if($_[0] =~ /^2>/);
+    open(my $outfd, $outfn) or die if($outfn);
+    my $pid = open3(my $in, my $out, my $err = gensym, @_);
+    if(!$hideerr) { while(<$err>) { print STDERR $_; }; }
+    if($outfn) { while(<$out>) { print $outfd $_; }; close($outfd); }
+    else { while(<$out>) { print $_; }; }
+    waitpid($pid, 0);
+}
+
+my $CAPREFIX = shift @ARGV;
+if(!$CAPREFIX) {
+    print "Usage: genserv.pl <caprefix> [<prefix> ...]\n";
+    exit 1;
+} elsif(! -f "$CAPREFIX-ca.cacert" ||
+        ! -f "$CAPREFIX-ca.key") {
+
+    if($OPENSSL eq basename($OPENSSL)) {  # has no directory component
+        # find openssl in PATH
+        my $found = 0;
+        foreach(File::Spec->path()) {
+            my $file = File::Spec->catfile($_, $OPENSSL);
+            if(-f $file) {
+                $OPENSSL = $file;
+                $found = 1;
+                last;
+            }
+        }
+        if(!$found) {
+            opensslfail();
+        }
+    }
+
+    print "$OPENSSL\n";
+    system($OPENSSL, ('version'));
+
+    $PREFIX = $CAPREFIX;
+    $DURATION = 6000;
+
+    if(system($OPENSSL, ('genpkey', '-algorithm', 'EC', '-pkeyopt', "ec_paramgen_curve:$KEYSIZE", '-pkeyopt', 'ec_param_enc:named_curve',
+        '-out', "$PREFIX-ca.key", '-pass', 'pass:secret')) != 0) {
+        opensslfail();
+    }
+    redir('2>', $OPENSSL, ('req', '-config', "$SRCDIR/$PREFIX-ca.prm", '-new', '-key', "$PREFIX-ca.key", '-out', "$PREFIX-ca.csr", '-passin', 'pass:secret'));
+    system($OPENSSL, ('x509', '-sha256', '-extfile', "$SRCDIR/$PREFIX-ca.prm", '-days', $DURATION,
+        '-req', '-signkey', "$PREFIX-ca.key", '-in', "$PREFIX-ca.csr", '-out', "$PREFIX-ca.raw-cacert"));
+    redir(">$PREFIX-ca.cacert", $OPENSSL, ('x509', '-in', "$PREFIX-ca.raw-cacert", '-text', '-nameopt', 'multiline'));
+    system($OPENSSL, ('x509', '-in', "$PREFIX-ca.cacert", '-outform', 'der', '-out', "$PREFIX-ca.der"));
+    redir(">$PREFIX-ca.crt", $OPENSSL, ('x509', '-in', "$PREFIX-ca.cacert", '-text', '-nameopt', 'multiline'));
+
+    print "CA root generated: $PREFIX $DURATION days $KEYSIZE\n";
+}
+
+$DURATION = 300;
+
+open($fh, '>>', "$CAPREFIX-ca.db") and close($fh);  # for revoke server cert
+
+while(@ARGV) {
+    $PREFIX = shift @ARGV;
+    $PREFIX =~ s/\.prm$//;
+
+    # pseudo-secrets
+    system($OPENSSL, ('genpkey', '-algorithm', 'EC', '-pkeyopt', "ec_paramgen_curve:$KEYSIZE", '-pkeyopt', 'ec_param_enc:named_curve',
+        '-out', "$PREFIX.keyenc", '-pass', 'pass:secret'));
+    redir('2>', $OPENSSL, ('req', '-config', "$SRCDIR/$PREFIX.prm", '-new', '-key', "$PREFIX.keyenc", '-out', "$PREFIX.csr", '-passin', 'pass:secret'));
+    system($OPENSSL, ('pkey', '-in', "$PREFIX.keyenc", '-out', "$PREFIX.key", '-passin', 'pass:secret'));
+
+    system($OPENSSL, ('pkey', '-in', "$PREFIX.key", '-pubout', '-outform', 'DER', '-out', "$PREFIX.pub.der"));
+    system($OPENSSL, ('pkey', '-in', "$PREFIX.key", '-pubout', '-outform', 'PEM', '-out', "$PREFIX.pub.pem"));
+    redir(">$PREFIX.crt", '2>', $OPENSSL, ('x509', '-sha256', '-extfile', "$SRCDIR/$PREFIX.prm", '-days', $DURATION,
+        '-req', '-CA', "$CAPREFIX-ca.cacert", '-CAkey', "$CAPREFIX-ca.key", '-CAcreateserial', '-in', "$PREFIX.csr"));
+
+    # revoke server cert
+    if(open($fh, '>', "$CAPREFIX-ca.cnt")) {
+        print $fh '01';
+        close($fh);
+    }
+    redir('2>', $OPENSSL, ('ca', '-config', "$SRCDIR/$CAPREFIX-ca.cnf", '-revoke', "$PREFIX.crt"));
+
+    # issue CRL
+    redir('2>', $OPENSSL, ('ca', '-config', "$SRCDIR/$CAPREFIX-ca.cnf", '-gencrl', '-out', "$PREFIX.crl"));
+    system($OPENSSL, ('x509', '-in', "$PREFIX.crt", '-outform', 'der', '-out', "$PREFIX.der"));
+
+    # concatenate all together now
+    open($fh, '>', "$PREFIX.pem") and close($fh);
+    chmod 0600, "$PREFIX.pem";
+    if(open($fh, '>>', "$PREFIX.pem")) {
+        my $fi;
+        print $fh do { local $/; open $fi, '<', $_ and <$fi> } for("$SRCDIR/$PREFIX.prm", "$PREFIX.key", "$PREFIX.crt");
+        close($fh);
+    }
+
+    print "Certificate generated: CA=$CAPREFIX ${DURATION}days $KEYSIZE $PREFIX\n";
+}
diff --git a/third-party/curl/tests/certs/scripts/Makefile.am b/third-party/curl/tests/certs/scripts/Makefile.am
deleted file mode 100644
index 82b5f277eb..0000000000
--- a/third-party/curl/tests/certs/scripts/Makefile.am
+++ /dev/null
@@ -1,30 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-AUTOMAKE_OPTIONS = foreign
-
-SCRIPTFILES = \
-  genroot.sh \
-  genserv.sh
-
-EXTRA_DIST = $(SCRIPTFILES)
diff --git a/third-party/curl/tests/certs/scripts/genroot.sh b/third-party/curl/tests/certs/scripts/genroot.sh
deleted file mode 100644
index 17fd30887c..0000000000
--- a/third-party/curl/tests/certs/scripts/genroot.sh
+++ /dev/null
@@ -1,89 +0,0 @@
-#!/bin/bash
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) EdelWeb for EdelKey and OpenEvidence
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-OPENSSL=openssl
-if [ -f /usr/local/ssl/bin/openssl ] ; then
-OPENSSL=/usr/local/ssl/bin/openssl
-fi
-
-USAGE="echo Usage is genroot.sh \<name\>"
-
-HOME=`pwd`
-cd $HOME
-
-KEYSIZE=2048
-DURATION=6000
-# The -sha256 option was introduced in OpenSSL 1.0.1
-DIGESTALGO=-sha256
-
-PREFIX=$1
-if [ ".$PREFIX" = . ] ; then
-   echo No configuration prefix
-   NOTOK=1
-else
-   if [ ! -f $PREFIX-ca.prm ] ; then
-      echo No configuration file $PREFIX-ca.prm
-      NOTOK=1
-   fi
-fi
-
-if [ ".$NOTOK" != . ] ; then
-   echo "Sorry, I can't do that for you."
-   $USAGE
-   exit
-fi
-
-GETSERIAL="\$t = time ;\$d =  \$t . substr(\$t+$$ ,-4,4)-1;print \$d"
-SERIAL=`/usr/bin/env perl -e "$GETSERIAL"`
-
-# exit on first fail
-set -e
-
-echo SERIAL=$SERIAL PREFIX=$PREFIX DURATION=$DURATION KEYSIZE=$KEYSIZE
-
-echo "openssl genrsa -out $PREFIX-ca.key -passout XXX $KEYSIZE"
-openssl genrsa -out $PREFIX-ca.key -passout pass:secret $KEYSIZE
-
-echo "openssl req -config $PREFIX-ca.prm -new -key $PREFIX-ca.key -out $PREFIX-ca.csr"
-$OPENSSL req -config $PREFIX-ca.prm -new -key $PREFIX-ca.key -out $PREFIX-ca.csr -passin pass:secret
-
-echo "openssl x509 -set_serial $SERIAL -extfile $PREFIX-ca.prm -days $DURATION -req -signkey $PREFIX-ca.key -in $PREFIX-ca.csr -out $PREFIX-$SERIAL.ca-cacert $DIGESTALGO "
-
-$OPENSSL x509  -set_serial $SERIAL -extfile $PREFIX-ca.prm -days $DURATION -req -signkey $PREFIX-ca.key -in $PREFIX-ca.csr -out $PREFIX-$SERIAL-ca.cacert $DIGESTALGO
-
-echo "openssl x509 -text -in $PREFIX-$SERIAL-ca.cacert -nameopt multiline > $PREFIX-ca.cacert "
-$OPENSSL x509 -text -in $PREFIX-$SERIAL-ca.cacert -nameopt multiline > $PREFIX-ca.cacert
-
-echo "openssl x509 -in $PREFIX-ca.cacert -outform der -out $PREFIX-ca.der "
-$OPENSSL x509 -in $PREFIX-ca.cacert -outform der -out $PREFIX-ca.der
-
-echo "openssl x509 -in $PREFIX-ca.cacert -text -nameopt multiline > $PREFIX-ca.crt "
-
-$OPENSSL x509 -in $PREFIX-ca.cacert -text -nameopt multiline > $PREFIX-ca.crt
-
-echo "openssl x509 -noout -text -in $PREFIX-ca.cacert -nameopt multiline"
-$OPENSSL x509 -noout -text -in $PREFIX-ca.cacert -nameopt multiline
-
-#$OPENSSL rsa -in ../keys/$PREFIX-ca.key -text -noout -pubout
diff --git a/third-party/curl/tests/certs/scripts/genserv.sh b/third-party/curl/tests/certs/scripts/genserv.sh
deleted file mode 100644
index 7e0b4429cb..0000000000
--- a/third-party/curl/tests/certs/scripts/genserv.sh
+++ /dev/null
@@ -1,143 +0,0 @@
-#!/bin/bash
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) EdelWeb for EdelKey and OpenEvidence
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-OPENSSL=openssl
-if [ -f /usr/local/ssl/bin/openssl ] ; then
-   OPENSSL=/usr/local/ssl/bin/openssl
-fi
-
-USAGE="echo Usage is genserv.sh <prefix> <caprefix>"
-
-# exit on first fail
-set -e
-
-HOME=`pwd`
-cd $HOME
-
-KEYSIZE=2048
-DURATION=3000
-# The -sha256 option was introduced in OpenSSL 1.0.1
-DIGESTALGO=-sha256
-
-REQ=YES
-P12=NO
-DHP=NO
-
-PREFIX=$1
-if [ ".$PREFIX" = . ] ; then
-   echo No configuration prefix
-   NOTOK=1
-else
-   if [ ! -f $PREFIX-sv.prm ] ; then
-      echo No configuration file $PREFIX-sv.prm
-      NOTOK=1
-   fi
-fi
-
-CAPREFIX=$2
-if [ ".$CAPREFIX" = . ] ; then
-   echo No CA prefix
-   NOTOK=1
-else
-   if [ ! -f $CAPREFIX-ca.cacert ] ; then
-      echo No CA certificate file $CAPREFIX-ca.caert
-      NOTOK=1
-   fi
-   if [ ! -f $CAPREFIX-ca.key ] ; then
-      echo No $CAPREFIX key
-      NOTOK=1
-   fi
-fi
-
-if [ ".$NOTOK" != . ] ; then
-   echo "Sorry, I can't do that for you."
-   $USAGE
-   exit
-fi
-
-if [ ".$SERIAL" = . ] ; then
-   GETSERIAL="\$t = time ;\$d =  \$t . substr(\$t+$$ ,-4,4)-1;print \$d"
-   SERIAL=`/usr/bin/env perl -e "$GETSERIAL"`
-fi
-
-echo SERIAL=$SERIAL PREFIX=$PREFIX CAPREFIX=$CAPREFIX DURATION=$DURATION KEYSIZE=$KEYSIZE
-
-if [ "$DHP." = YES. ] ; then
-   echo "openssl dhparam -2 -out $PREFIX-sv.dhp $KEYSIZE"
-   $OPENSSL dhparam -2 -out $PREFIX-sv.dhp $KEYSIZE
-fi
-
-if [ "$REQ." = YES. ] ; then
-   echo "openssl req -config $PREFIX-sv.prm -newkey rsa:$KEYSIZE -keyout $PREFIX-sv.key -out $PREFIX-sv.csr -passout XXX"
-   $OPENSSL req -config $PREFIX-sv.prm -newkey rsa:$KEYSIZE -keyout $PREFIX-sv.key -out $PREFIX-sv.csr -passout pass:secret
-fi
-
-echo "openssl rsa -in $PREFIX-sv.key -out $PREFIX-sv.key"
-$OPENSSL rsa -in $PREFIX-sv.key -out $PREFIX-sv.key -passin pass:secret
-echo pseudo secrets generated
-
-echo "openssl rsa -in $PREFIX-sv.key -pubout -outform DER -out $PREFIX-sv.pub.der"
-$OPENSSL rsa -in $PREFIX-sv.key -pubout -outform DER -out $PREFIX-sv.pub.der
-
-echo "openssl rsa -in $PREFIX-sv.key -pubout -outform PEM -out $PREFIX-sv.pub.pem"
-$OPENSSL rsa -in $PREFIX-sv.key -pubout -outform PEM -out $PREFIX-sv.pub.pem
-
-echo "openssl x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION  -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -text -nameopt multiline $DIGESTALGO > $PREFIX-sv.crt "
-
-$OPENSSL x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION  -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -text -nameopt multiline $DIGESTALGO > $PREFIX-sv.crt
-
-if [ "$P12." = YES. ] ; then
-
-   echo "$OPENSSL pkcs12 -export -des3 -out $PREFIX-sv.p12 -caname $CAPREFIX -name $PREFIX -inkey $PREFIX-sv.key -in $PREFIX-sv.crt -certfile $CAPREFIX-ca.crt "
-
-   $OPENSSL pkcs12 -export -des3 -out $PREFIX-sv.p12 -caname $CAPREFIX -name $PREFIX -inkey $PREFIX-sv.key -in $PREFIX-sv.crt -certfile $CAPREFIX-ca.crt
-fi
-
-echo "openssl x509 -noout -text -hash -in $PREFIX-sv.selfcert -nameopt multiline"
-$OPENSSL x509 -noout -text -hash -in $PREFIX-sv.crt -nameopt multiline
-
-# revoke server cert
-touch $CAPREFIX-ca.db
-echo 01 > $CAPREFIX-ca.cnt
-echo "openssl ca -config $CAPREFIX-ca.cnf -revoke $PREFIX-sv.crt"
-$OPENSSL ca -config $CAPREFIX-ca.cnf -revoke $PREFIX-sv.crt
-
-# issue CRL
-echo "openssl ca -config $CAPREFIX-ca.cnf -gencrl -out $PREFIX-sv.crl"
-$OPENSSL ca -config $CAPREFIX-ca.cnf -gencrl -out $PREFIX-sv.crl
-
-echo "openssl x509 -in $PREFIX-sv.crt -outform der -out $PREFIX-sv.der "
-$OPENSSL x509 -in $PREFIX-sv.crt -outform der -out $PREFIX-sv.der
-
-# all together now
-touch $PREFIX-sv.dhp
-cat $PREFIX-sv.prm $PREFIX-sv.key  $PREFIX-sv.crt $PREFIX-sv.dhp >$PREFIX-sv.pem
-chmod o-r $PREFIX-sv.prm
-
-$OPENSSL x509 -in $PREFIX-sv.pem -pubkey -noout | \
-$OPENSSL pkey -pubin -outform der | $OPENSSL dgst -sha256 -binary | \
-$OPENSSL enc -base64 >$PREFIX-sv.pubkey-pinned
-
-echo "$PREFIX-sv.pem done"
diff --git a/third-party/curl/tests/certs/stunnel-sv.crl b/third-party/curl/tests/certs/stunnel-sv.crl
deleted file mode 100644
index 494ce73587..0000000000
--- a/third-party/curl/tests/certs/stunnel-sv.crl
+++ /dev/null
@@ -1,15 +0,0 @@
------BEGIN X509 CRL-----
-MIICWzCCAUMCAQEwDQYJKoZIhvcNAQELBQAwaDELMAkGA1UEBhMCTk4xMTAvBgNV
-BAoMKEVkZWwgQ3VybCBBcmN0aWMgSWxsdWRpdW0gUmVzZWFyY2ggQ2xvdWQxJjAk
-BgNVBAMMHU5vcnRoZXJuIE5vd2hlcmUgVHJ1c3QgQW5jaG9yFw0yMjEyMjMxMjIx
-MzlaFw0yMzAxMjIxMjIxMzlaMIGWMBcCBg80dVEqPBcNMjIxMjIzMTIyMTM2WjAX
-AgYPNHVRUWEXDTIyMTIyMzEyMjEzN1owFwIGDzR1UVF1Fw0yMjEyMjMxMjIxMzda
-MBcCBg80dVFRiRcNMjIxMjIzMTIyMTM4WjAXAgYPNHVReK4XDTIyMTIyMzEyMjEz
-OFowFwIGDzR1UZ/TFw0yMjEyMjMxMjIxMzlaoA4wDDAKBgNVHRQEAwIBATANBgkq
-hkiG9w0BAQsFAAOCAQEAMcVpjkRfr71+8t8qMGDR7jNycVDsEw8H+t4wXq44EkVu
-Z3uB7IPa5KQJ4HNZ5U/5yfWrLQ14YsOHEPIWaDyXG+MYKa82t/VGSzkWdiPE/onz
-Y3PBkclURacEZ5NHWTDGJXGttO7cHPPN4FsKxAsS7EWPRSCCKBGIxY3L+4QcziZV
-G9zsrzn0B7NI11E9+VGm0HbhSxXUthayPvHeUmjpeJ+711R22ANNTV2jAMqFn2ZP
-i6PNenZXC3xt1cZd4/T6343TT5jd0QB1JUiSFGYWZw3sSga6d57Mf5WTOCAfJsWL
-X1Wds0WsQ/XbsGySCLXPWfOaxrfhk3FJHSwIDjKoAg==
------END X509 CRL-----
diff --git a/third-party/curl/tests/certs/stunnel-sv.crt b/third-party/curl/tests/certs/stunnel-sv.crt
deleted file mode 100644
index 82285808cb..0000000000
--- a/third-party/curl/tests/certs/stunnel-sv.crt
+++ /dev/null
@@ -1,99 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 16717980999635 (0xf3475519fd3)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = Northern Nowhere Trust Anchor
-        Validity
-            Not Before: Dec 23 12:21:39 2022 GMT
-            Not After : Mar 11 12:21:39 2031 GMT
-        Subject:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = localhost
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:ab:0a:b0:03:d0:76:fe:5e:ce:15:de:61:d5:e3:
-                    91:6f:7c:d6:bb:ca:26:8e:78:be:26:35:d1:a6:59:
-                    f1:d5:3c:55:3e:09:2c:ec:a0:d4:af:0e:3c:5a:a2:
-                    b5:b0:78:51:95:62:80:80:71:c8:4e:9f:59:59:93:
-                    40:12:b2:a9:ce:b2:cd:17:8b:9f:27:f3:e3:cf:23:
-                    78:06:d2:06:23:5f:9b:20:ec:42:77:66:ad:a4:5e:
-                    82:b4:4d:94:72:ea:13:64:72:fc:cb:83:2c:d7:a1:
-                    8b:f5:2e:4c:d3:c1:88:b2:c8:98:19:5f:ef:98:fc:
-                    62:80:b3:67:cc:1f:23:fc:5f:38:cd:82:6e:2d:96:
-                    d9:35:93:fe:29:a2:69:65:c0:df:45:ab:3f:ac:17:
-                    18:00:80:4a:b7:c9:ba:b8:5f:29:bb:c4:ac:16:97:
-                    cc:57:34:10:c9:36:65:6c:3e:d8:89:45:c8:a5:42:
-                    84:7c:5e:cd:1a:e8:f1:3e:55:b3:21:0f:d0:36:13:
-                    f2:c4:2f:b9:73:41:fa:87:aa:dc:44:d6:64:96:e4:
-                    5a:50:f9:4a:9f:e0:a2:e7:69:f4:ad:5a:cf:3a:20:
-                    e5:a7:09:e2:cf:e8:19:a1:00:ae:a8:bb:22:02:34:
-                    5c:b3:cf:b5:24:4c:76:bf:ad:e9:f1:b8:d3:86:ba:
-                    7d:93
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Alternative Name: 
-                DNS:localhost
-            X509v3 Key Usage: 
-                Digital Signature, Key Encipherment, Key Agreement
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication
-            X509v3 Subject Key Identifier: 
-                9C:97:B0:3D:B3:50:B1:F6:D4:71:E2:EB:CB:80:EA:93:7C:98:CC:72
-            X509v3 Authority Key Identifier: 
-                87:CB:B1:33:2E:C1:67:7E:71:E3:E5:2B:4C:4D:A4:B3:6E:D2:5B:A9
-            X509v3 Basic Constraints: 
-                CA:FALSE
-            Authority Information Access: 
-                CA Issuers - URI:http://test.curl.se/ca/EdelCurlRoot.cer
-            X509v3 CRL Distribution Points: 
-                Full Name:
-                  URI:http://test.curl.se/ca/EdelCurlRoot.crl
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        0b:8a:ed:6a:87:fa:71:15:88:25:58:85:1b:4a:09:bf:43:00:
-        35:93:78:0d:72:14:30:51:e2:93:83:a1:da:1b:2f:a9:31:ae:
-        b7:c7:4c:72:c2:5e:32:24:f1:96:93:70:d5:3f:b5:85:80:13:
-        75:32:cf:0e:f8:5d:c4:a2:29:84:43:2c:75:81:26:12:6a:a0:
-        cb:7b:57:c1:92:78:85:08:fa:64:50:c2:7b:83:02:4d:79:13:
-        bc:61:64:4d:b8:6b:d5:f1:84:6b:12:5c:69:90:ad:40:47:c0:
-        ed:dd:ea:8a:66:7e:87:85:19:aa:89:d3:3c:08:72:08:a1:4d:
-        63:60:5b:9b:17:9e:00:12:a1:00:52:ca:78:01:88:18:c7:ed:
-        5b:c7:e4:d9:eb:bd:3f:af:92:53:3f:fe:58:57:0d:fc:f4:7b:
-        7b:a2:4f:e9:b9:5c:b5:a4:52:50:b4:56:5a:44:8e:d9:d0:ed:
-        de:8f:7e:ac:1c:58:76:5b:a8:79:c9:95:ab:85:1d:db:4c:13:
-        82:4a:a5:41:1b:29:f5:d3:96:df:80:d1:1e:00:7d:ba:35:94:
-        57:81:e1:08:2a:81:6b:1c:30:50:37:01:1a:0e:26:4f:6b:ed:
-        c9:50:17:37:2b:33:3f:68:fe:c6:f0:21:8c:e7:b2:79:55:f2:
-        42:bd:2f:b0
------BEGIN CERTIFICATE-----
-MIIERDCCAyygAwIBAgIGDzR1UZ/TMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNVBAYT
-Ak5OMTEwLwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNo
-IENsb3VkMSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjAe
-Fw0yMjEyMjMxMjIxMzlaFw0zMTAzMTExMjIxMzlaMFQxCzAJBgNVBAYTAk5OMTEw
-LwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNoIENsb3Vk
-MRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQCrCrAD0Hb+Xs4V3mHV45FvfNa7yiaOeL4mNdGmWfHVPFU+CSzsoNSvDjxa
-orWweFGVYoCAcchOn1lZk0ASsqnOss0Xi58n8+PPI3gG0gYjX5sg7EJ3Zq2kXoK0
-TZRy6hNkcvzLgyzXoYv1LkzTwYiyyJgZX++Y/GKAs2fMHyP8XzjNgm4tltk1k/4p
-omllwN9Fqz+sFxgAgEq3ybq4Xym7xKwWl8xXNBDJNmVsPtiJRcilQoR8Xs0a6PE+
-VbMhD9A2E/LEL7lzQfqHqtxE1mSW5FpQ+Uqf4KLnafStWs86IOWnCeLP6BmhAK6o
-uyICNFyzz7UkTHa/renxuNOGun2TAgMBAAGjggEGMIIBAjAUBgNVHREEDTALggls
-b2NhbGhvc3QwCwYDVR0PBAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1Ud
-DgQWBBScl7A9s1Cx9tRx4uvLgOqTfJjMcjAfBgNVHSMEGDAWgBSHy7EzLsFnfnHj
-5StMTaSzbtJbqTAJBgNVHRMEAjAAMEMGCCsGAQUFBwEBBDcwNTAzBggrBgEFBQcw
-AoYnaHR0cDovL3Rlc3QuY3VybC5zZS9jYS9FZGVsQ3VybFJvb3QuY2VyMDgGA1Ud
-HwQxMC8wLaAroCmGJ2h0dHA6Ly90ZXN0LmN1cmwuc2UvY2EvRWRlbEN1cmxSb290
-LmNybDANBgkqhkiG9w0BAQsFAAOCAQEAC4rtaof6cRWIJViFG0oJv0MANZN4DXIU
-MFHik4Oh2hsvqTGut8dMcsJeMiTxlpNw1T+1hYATdTLPDvhdxKIphEMsdYEmEmqg
-y3tXwZJ4hQj6ZFDCe4MCTXkTvGFkTbhr1fGEaxJcaZCtQEfA7d3qimZ+h4UZqonT
-PAhyCKFNY2BbmxeeABKhAFLKeAGIGMftW8fk2eu9P6+SUz/+WFcN/PR7e6JP6blc
-taRSULRWWkSO2dDt3o9+rBxYdluoecmVq4Ud20wTgkqlQRsp9dOW34DRHgB9ujWU
-V4HhCCqBaxwwUDcBGg4mT2vtyVAXNyszP2j+xvAhjOeyeVXyQr0vsA==
------END CERTIFICATE-----
diff --git a/third-party/curl/tests/certs/stunnel-sv.csr b/third-party/curl/tests/certs/stunnel-sv.csr
deleted file mode 100644
index 739cd68eb3..0000000000
--- a/third-party/curl/tests/certs/stunnel-sv.csr
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN CERTIFICATE REQUEST-----
-MIICmTCCAYECAQAwVDELMAkGA1UEBhMCTk4xMTAvBgNVBAoMKEVkZWwgQ3VybCBB
-cmN0aWMgSWxsdWRpdW0gUmVzZWFyY2ggQ2xvdWQxEjAQBgNVBAMMCWxvY2FsaG9z
-dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKsKsAPQdv5ezhXeYdXj
-kW981rvKJo54viY10aZZ8dU8VT4JLOyg1K8OPFqitbB4UZVigIBxyE6fWVmTQBKy
-qc6yzReLnyfz488jeAbSBiNfmyDsQndmraRegrRNlHLqE2Ry/MuDLNehi/UuTNPB
-iLLImBlf75j8YoCzZ8wfI/xfOM2Cbi2W2TWT/imiaWXA30WrP6wXGACASrfJurhf
-KbvErBaXzFc0EMk2ZWw+2IlFyKVChHxezRro8T5VsyEP0DYT8sQvuXNB+oeq3ETW
-ZJbkWlD5Sp/goudp9K1azzog5acJ4s/oGaEArqi7IgI0XLPPtSRMdr+t6fG404a6
-fZMCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQAauiYRPParSazzDjwG98G8YzZk
-1V/Q3rOzPN5a4veBMVO0kTxrTLImX/+BU6Bj6YgbpUGzIUqbkEunCQ5vtbFTrooD
-uT2tZtENXrj6i1fR3BArnLiP1Pg+PO1ONvTuY+384v2CIeE7AP6V0wZw5W9OJSkP
-eM8RU5OJn5zJkxhmUdREg5d3VuIE67ABcbCsxqMAhJuPw6mFgN6ffZl06nZ2cR5k
-TeOmze7EL8UCNByTtwqBdgryPQu3UEsBq0GxQJcBzcmB3vfClLhnTLic4sRHGdTO
-Ql+6CFqNnP5+bEMWqExPmWsdogFtwJsiQvr2nk/i2ogKAoRs+T0siTcF1+RM
------END CERTIFICATE REQUEST-----
diff --git a/third-party/curl/tests/certs/stunnel-sv.der b/third-party/curl/tests/certs/stunnel-sv.der
deleted file mode 100644
index 9c015f8fc648a096eb3c61d6ffc3a068e6873c6c..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1096
zcmXqLVsSBOV%Ax}%*4pV#Kvz@8aV&50WTY;R+~rLcV0$DZdL|^3`1@MPB!LH7B*of
zKR-i51AP#Oi$}vXB{fIExwI%p!Lca0Br{pTGbg7sC9^bFAt<#tHL)l;L%}&Gzcj^A
z%|HdDg_%dzFTbcHBef_`!7slYNT(`<6qOd2C^+UNXXF<d$cghB85tTG83VDQv1ODv
zud$(lv7sT9YY;-QON0yrATHs|$xlwq$;dA*F=%2`LiREvD+6;ABR>OBoQtW6k&$6F
z*9PVbW&h&NiQY@R`gme~&9&X9)cPv+shM6}7Wwh2O{g8G&YJ~S*7Mm!E!w)FB5-O_
zLqp*Szxk1olO2RMtvt8sta$f)_0NybD_5{xVpEQvt?<UFJZ<fgxTY<>Q;J>*rxg7;
z-K=wcVfR-(pUVe3Hl3Iu8UKF9pQMJ(>1X7X|HNCIZOYS~cGGn7Kg~s%sR!=6uC`wz
zF2T^?wf*F-9r2pGkE{`!ekR;R;G|h<j@^w;*Aq*fT596XO1=1K7rI%I|ALwDrz841
ziyeQpue#%MEoIu1sDPhd^B*jFp7~{M)Ojm~r^`7Xoqr*@kYU}5-AYU*F`LhCRq-j?
zzxL(F9hcj7)lOz&W@KPo+{DNR3=t*+5n%Yq3bODTa5o`^AvZ{rpM`~)iFt*AFo>hd
z!ehY2#-Yu|$jZvj%xEAB669kMV-cA%eS_`hfQ{d-6h3-=y5ZI2ni*$`4CF!5$}AEF
zVhtkgr#Bkw9Zat)eEd|~$9Ku*yi3t5!6{Hyn1#uJ!N3`2EF&X}xq+#HF^q4()TW+M
zQc_^0uV0c{T%wl@Oq+Vesrt!@`k=H5N~%Hm`9Sg1A_EJMh4L)G)NG);Kzo5EkvfZV
zkkbk<djQi4BLjEW+pP9qg`yp*5v|f*oco;_Oea_H7Ks=HKAPOT@RqdxO2c*AkNXrI
ziZfFAIBjylRr{^24Z@{H=lOob9$BQ>;;d8Js3w%P;B<BP!ATXZ9KTWm4plcZ`Bn<=
zNlfwGk$v@JOSVu<=7hBl?g!r9ebtp#*WN0*s`Ii9M-j(D-{geo+2ZpUgcdRcovL8$
zkU0J}`uLNZulL%opA>BWFCv`x&zI`zMgA{$#%x^@6tE>M%BAn-g}3+m>(<Cbltr(o
zJUMlBtL$wb;U=%8j?$W6FHgJQa8Zt-c9-dt@WzK6T8-H<1_9=bQhaLu*>6t<h?{F0
W+h_bc_Cc}d`KHRyPfmOFHvj<8(~^q-

diff --git a/third-party/curl/tests/certs/stunnel-sv.dhp b/third-party/curl/tests/certs/stunnel-sv.dhp
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/third-party/curl/tests/certs/stunnel-sv.key b/third-party/curl/tests/certs/stunnel-sv.key
deleted file mode 100644
index 84c86c2ee0..0000000000
--- a/third-party/curl/tests/certs/stunnel-sv.key
+++ /dev/null
@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCrCrAD0Hb+Xs4V
-3mHV45FvfNa7yiaOeL4mNdGmWfHVPFU+CSzsoNSvDjxaorWweFGVYoCAcchOn1lZ
-k0ASsqnOss0Xi58n8+PPI3gG0gYjX5sg7EJ3Zq2kXoK0TZRy6hNkcvzLgyzXoYv1
-LkzTwYiyyJgZX++Y/GKAs2fMHyP8XzjNgm4tltk1k/4pomllwN9Fqz+sFxgAgEq3
-ybq4Xym7xKwWl8xXNBDJNmVsPtiJRcilQoR8Xs0a6PE+VbMhD9A2E/LEL7lzQfqH
-qtxE1mSW5FpQ+Uqf4KLnafStWs86IOWnCeLP6BmhAK6ouyICNFyzz7UkTHa/renx
-uNOGun2TAgMBAAECggEAH0BsKb5Ax7h90jwYRzL141d9isFkaxq/r46c2FbN24bT
-EmstxKycP8ILoAnjxbMuQOvHC/D+RvNRqY7Aocn4Qdakp50wvuWOpc3Ww/RC/9qb
-pxfUCyn9Jy/HlPcp3RdM5MknzG2S13Fid7F2gyh0+CmztMs1JZBT1S0ylXbJJfbY
-1pdlHcf9oEbYo36vGd9rtJHAFzsFfwua0idl76XYuOnR3bpOkHl1B5cJ8jpOliPv
-VTmzn0cIgAmk7IByHHqGQ0u30PFiElI9kEbkKWoxAM1hq1pFU58jQhvp0ZkjVENL
-bSFB2B4DbyosxPlbUgvJCN4B7nclqzYqBdrrk6/ZLQKBgQC1lDrPSGIGXLwvkZYS
-xc0wtaCC7u6m7zV8rzh5HGcEoVvtmya/VyoZR8KGIpSor8COIkZqFtan6C77C3MH
-wClbu2Kn3FkGb76D5U2Xwl38zepzjn8Z5qXc3bZfccrsDY1gXPicgsmcKUY9xV5/
-T0RjESDKB+xxkJpCjia6klm2NQKBgQDxJNuqB6frDYKaj7mW/rvyHqkeT94J6eDY
-BcMZVKeHRNWcBMOvJDChVmpsCjJPOWHhHOlAE755NxWn8wpgyiUcac3BiysMgvTT
-pyH8UVWaP/DWYOfpuhtcLPkIjKnPijOvshpyWBxfXNIejiovoT6E3IXKOxr5g5yq
-U/9a5+I9pwKBgDyJG4YpkoyedBrDxa2ihkL7+nRMZgH/c+yKmiA+aNXxWa2AcU2P
-KLje5KpFcxw948s/AAy0aoH19Vu6uHHYDbHIah6eZouvy2s7kj/LC/yRRd2anyMq
-cxeMTxXI4ScLaZu7wyKis8Y9OG61k0iMS7dfaXgRZjGCTPttWtoOmpwVAoGAd2k+
-EXuLDl15UBpd18S6wxGlw2nfVN9oxPBNhUyjTNusP38oe6EbJ7mIJ4oBEbQjoPrV
-EjL0vkelxK4YdIeFSwWlqvLEVYS/wdNgg/auwhxpoW8JSHctNz7Z7v7g0/Hm2FkE
-uZyiKCLptdHGWCGruNUOt27/U5F10e6YY6ayJL8CgYEAoE/ddHIlrKFzcZ0cu47R
-ky4D4x32ceC2au4eGPLMDItPjceXe8I6zgB5P8/U5U3PRw5oWabpAf5lAcRwa12c
-23xgy9O5QNlyps/rAdnVjwxqGwEd5E2LrZ2+JDflPRGunx2VO5v9CxXvsxu9F3Rj
-tREtebHe2H7u5jNsIQArnRI=
------END PRIVATE KEY-----
diff --git a/third-party/curl/tests/certs/stunnel-sv.pem b/third-party/curl/tests/certs/stunnel-sv.pem
deleted file mode 100644
index b7dd1e879f..0000000000
--- a/third-party/curl/tests/certs/stunnel-sv.pem
+++ /dev/null
@@ -1,165 +0,0 @@
-extensions = x509v3
-[ x509v3 ]
-subjectAltName = DNS:localhost
-keyUsage	= keyEncipherment,digitalSignature,keyAgreement
-extendedKeyUsage = serverAuth
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid
-basicConstraints = CA:false
-authorityInfoAccess     = @issuer_info
-crlDistributionPoints   = @crl_info
-
-[ crl_ext ]
-authorityKeyIdentifier  = keyid:always
-authorityInfoAccess     = @issuer_info
-
-[ issuer_info ]
-caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
-
-[ crl_info ]
-URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
-
-[ req ]
-default_bits                    = 12048
-distinguished_name              = req_DN
-default_md			= sha256
-string_mask			= utf8only
-[ req_DN ]
-countryName                     = "Country Name is Northern Nowhere"
-countryName_value            = NN
-organizationName              = "Organization Name"
-organizationName_value     = Edel Curl Arctic Illudium Research Cloud
-commonName                      = "Common Name"
-commonName_value              = localhost
-
-[something]
-# The key
-# the certificate
-# some dhparam
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCrCrAD0Hb+Xs4V
-3mHV45FvfNa7yiaOeL4mNdGmWfHVPFU+CSzsoNSvDjxaorWweFGVYoCAcchOn1lZ
-k0ASsqnOss0Xi58n8+PPI3gG0gYjX5sg7EJ3Zq2kXoK0TZRy6hNkcvzLgyzXoYv1
-LkzTwYiyyJgZX++Y/GKAs2fMHyP8XzjNgm4tltk1k/4pomllwN9Fqz+sFxgAgEq3
-ybq4Xym7xKwWl8xXNBDJNmVsPtiJRcilQoR8Xs0a6PE+VbMhD9A2E/LEL7lzQfqH
-qtxE1mSW5FpQ+Uqf4KLnafStWs86IOWnCeLP6BmhAK6ouyICNFyzz7UkTHa/renx
-uNOGun2TAgMBAAECggEAH0BsKb5Ax7h90jwYRzL141d9isFkaxq/r46c2FbN24bT
-EmstxKycP8ILoAnjxbMuQOvHC/D+RvNRqY7Aocn4Qdakp50wvuWOpc3Ww/RC/9qb
-pxfUCyn9Jy/HlPcp3RdM5MknzG2S13Fid7F2gyh0+CmztMs1JZBT1S0ylXbJJfbY
-1pdlHcf9oEbYo36vGd9rtJHAFzsFfwua0idl76XYuOnR3bpOkHl1B5cJ8jpOliPv
-VTmzn0cIgAmk7IByHHqGQ0u30PFiElI9kEbkKWoxAM1hq1pFU58jQhvp0ZkjVENL
-bSFB2B4DbyosxPlbUgvJCN4B7nclqzYqBdrrk6/ZLQKBgQC1lDrPSGIGXLwvkZYS
-xc0wtaCC7u6m7zV8rzh5HGcEoVvtmya/VyoZR8KGIpSor8COIkZqFtan6C77C3MH
-wClbu2Kn3FkGb76D5U2Xwl38zepzjn8Z5qXc3bZfccrsDY1gXPicgsmcKUY9xV5/
-T0RjESDKB+xxkJpCjia6klm2NQKBgQDxJNuqB6frDYKaj7mW/rvyHqkeT94J6eDY
-BcMZVKeHRNWcBMOvJDChVmpsCjJPOWHhHOlAE755NxWn8wpgyiUcac3BiysMgvTT
-pyH8UVWaP/DWYOfpuhtcLPkIjKnPijOvshpyWBxfXNIejiovoT6E3IXKOxr5g5yq
-U/9a5+I9pwKBgDyJG4YpkoyedBrDxa2ihkL7+nRMZgH/c+yKmiA+aNXxWa2AcU2P
-KLje5KpFcxw948s/AAy0aoH19Vu6uHHYDbHIah6eZouvy2s7kj/LC/yRRd2anyMq
-cxeMTxXI4ScLaZu7wyKis8Y9OG61k0iMS7dfaXgRZjGCTPttWtoOmpwVAoGAd2k+
-EXuLDl15UBpd18S6wxGlw2nfVN9oxPBNhUyjTNusP38oe6EbJ7mIJ4oBEbQjoPrV
-EjL0vkelxK4YdIeFSwWlqvLEVYS/wdNgg/auwhxpoW8JSHctNz7Z7v7g0/Hm2FkE
-uZyiKCLptdHGWCGruNUOt27/U5F10e6YY6ayJL8CgYEAoE/ddHIlrKFzcZ0cu47R
-ky4D4x32ceC2au4eGPLMDItPjceXe8I6zgB5P8/U5U3PRw5oWabpAf5lAcRwa12c
-23xgy9O5QNlyps/rAdnVjwxqGwEd5E2LrZ2+JDflPRGunx2VO5v9CxXvsxu9F3Rj
-tREtebHe2H7u5jNsIQArnRI=
------END PRIVATE KEY-----
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 16717980999635 (0xf3475519fd3)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = Northern Nowhere Trust Anchor
-        Validity
-            Not Before: Dec 23 12:21:39 2022 GMT
-            Not After : Mar 11 12:21:39 2031 GMT
-        Subject:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = localhost
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:ab:0a:b0:03:d0:76:fe:5e:ce:15:de:61:d5:e3:
-                    91:6f:7c:d6:bb:ca:26:8e:78:be:26:35:d1:a6:59:
-                    f1:d5:3c:55:3e:09:2c:ec:a0:d4:af:0e:3c:5a:a2:
-                    b5:b0:78:51:95:62:80:80:71:c8:4e:9f:59:59:93:
-                    40:12:b2:a9:ce:b2:cd:17:8b:9f:27:f3:e3:cf:23:
-                    78:06:d2:06:23:5f:9b:20:ec:42:77:66:ad:a4:5e:
-                    82:b4:4d:94:72:ea:13:64:72:fc:cb:83:2c:d7:a1:
-                    8b:f5:2e:4c:d3:c1:88:b2:c8:98:19:5f:ef:98:fc:
-                    62:80:b3:67:cc:1f:23:fc:5f:38:cd:82:6e:2d:96:
-                    d9:35:93:fe:29:a2:69:65:c0:df:45:ab:3f:ac:17:
-                    18:00:80:4a:b7:c9:ba:b8:5f:29:bb:c4:ac:16:97:
-                    cc:57:34:10:c9:36:65:6c:3e:d8:89:45:c8:a5:42:
-                    84:7c:5e:cd:1a:e8:f1:3e:55:b3:21:0f:d0:36:13:
-                    f2:c4:2f:b9:73:41:fa:87:aa:dc:44:d6:64:96:e4:
-                    5a:50:f9:4a:9f:e0:a2:e7:69:f4:ad:5a:cf:3a:20:
-                    e5:a7:09:e2:cf:e8:19:a1:00:ae:a8:bb:22:02:34:
-                    5c:b3:cf:b5:24:4c:76:bf:ad:e9:f1:b8:d3:86:ba:
-                    7d:93
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Alternative Name: 
-                DNS:localhost
-            X509v3 Key Usage: 
-                Digital Signature, Key Encipherment, Key Agreement
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication
-            X509v3 Subject Key Identifier: 
-                9C:97:B0:3D:B3:50:B1:F6:D4:71:E2:EB:CB:80:EA:93:7C:98:CC:72
-            X509v3 Authority Key Identifier: 
-                87:CB:B1:33:2E:C1:67:7E:71:E3:E5:2B:4C:4D:A4:B3:6E:D2:5B:A9
-            X509v3 Basic Constraints: 
-                CA:FALSE
-            Authority Information Access: 
-                CA Issuers - URI:http://test.curl.se/ca/EdelCurlRoot.cer
-            X509v3 CRL Distribution Points: 
-                Full Name:
-                  URI:http://test.curl.se/ca/EdelCurlRoot.crl
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        0b:8a:ed:6a:87:fa:71:15:88:25:58:85:1b:4a:09:bf:43:00:
-        35:93:78:0d:72:14:30:51:e2:93:83:a1:da:1b:2f:a9:31:ae:
-        b7:c7:4c:72:c2:5e:32:24:f1:96:93:70:d5:3f:b5:85:80:13:
-        75:32:cf:0e:f8:5d:c4:a2:29:84:43:2c:75:81:26:12:6a:a0:
-        cb:7b:57:c1:92:78:85:08:fa:64:50:c2:7b:83:02:4d:79:13:
-        bc:61:64:4d:b8:6b:d5:f1:84:6b:12:5c:69:90:ad:40:47:c0:
-        ed:dd:ea:8a:66:7e:87:85:19:aa:89:d3:3c:08:72:08:a1:4d:
-        63:60:5b:9b:17:9e:00:12:a1:00:52:ca:78:01:88:18:c7:ed:
-        5b:c7:e4:d9:eb:bd:3f:af:92:53:3f:fe:58:57:0d:fc:f4:7b:
-        7b:a2:4f:e9:b9:5c:b5:a4:52:50:b4:56:5a:44:8e:d9:d0:ed:
-        de:8f:7e:ac:1c:58:76:5b:a8:79:c9:95:ab:85:1d:db:4c:13:
-        82:4a:a5:41:1b:29:f5:d3:96:df:80:d1:1e:00:7d:ba:35:94:
-        57:81:e1:08:2a:81:6b:1c:30:50:37:01:1a:0e:26:4f:6b:ed:
-        c9:50:17:37:2b:33:3f:68:fe:c6:f0:21:8c:e7:b2:79:55:f2:
-        42:bd:2f:b0
------BEGIN CERTIFICATE-----
-MIIERDCCAyygAwIBAgIGDzR1UZ/TMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNVBAYT
-Ak5OMTEwLwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNo
-IENsb3VkMSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjAe
-Fw0yMjEyMjMxMjIxMzlaFw0zMTAzMTExMjIxMzlaMFQxCzAJBgNVBAYTAk5OMTEw
-LwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNoIENsb3Vk
-MRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQCrCrAD0Hb+Xs4V3mHV45FvfNa7yiaOeL4mNdGmWfHVPFU+CSzsoNSvDjxa
-orWweFGVYoCAcchOn1lZk0ASsqnOss0Xi58n8+PPI3gG0gYjX5sg7EJ3Zq2kXoK0
-TZRy6hNkcvzLgyzXoYv1LkzTwYiyyJgZX++Y/GKAs2fMHyP8XzjNgm4tltk1k/4p
-omllwN9Fqz+sFxgAgEq3ybq4Xym7xKwWl8xXNBDJNmVsPtiJRcilQoR8Xs0a6PE+
-VbMhD9A2E/LEL7lzQfqHqtxE1mSW5FpQ+Uqf4KLnafStWs86IOWnCeLP6BmhAK6o
-uyICNFyzz7UkTHa/renxuNOGun2TAgMBAAGjggEGMIIBAjAUBgNVHREEDTALggls
-b2NhbGhvc3QwCwYDVR0PBAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1Ud
-DgQWBBScl7A9s1Cx9tRx4uvLgOqTfJjMcjAfBgNVHSMEGDAWgBSHy7EzLsFnfnHj
-5StMTaSzbtJbqTAJBgNVHRMEAjAAMEMGCCsGAQUFBwEBBDcwNTAzBggrBgEFBQcw
-AoYnaHR0cDovL3Rlc3QuY3VybC5zZS9jYS9FZGVsQ3VybFJvb3QuY2VyMDgGA1Ud
-HwQxMC8wLaAroCmGJ2h0dHA6Ly90ZXN0LmN1cmwuc2UvY2EvRWRlbEN1cmxSb290
-LmNybDANBgkqhkiG9w0BAQsFAAOCAQEAC4rtaof6cRWIJViFG0oJv0MANZN4DXIU
-MFHik4Oh2hsvqTGut8dMcsJeMiTxlpNw1T+1hYATdTLPDvhdxKIphEMsdYEmEmqg
-y3tXwZJ4hQj6ZFDCe4MCTXkTvGFkTbhr1fGEaxJcaZCtQEfA7d3qimZ+h4UZqonT
-PAhyCKFNY2BbmxeeABKhAFLKeAGIGMftW8fk2eu9P6+SUz/+WFcN/PR7e6JP6blc
-taRSULRWWkSO2dDt3o9+rBxYdluoecmVq4Ud20wTgkqlQRsp9dOW34DRHgB9ujWU
-V4HhCCqBaxwwUDcBGg4mT2vtyVAXNyszP2j+xvAhjOeyeVXyQr0vsA==
------END CERTIFICATE-----
diff --git a/third-party/curl/tests/certs/stunnel-sv.prm b/third-party/curl/tests/certs/stunnel-sv.prm
deleted file mode 100644
index 3803da3756..0000000000
--- a/third-party/curl/tests/certs/stunnel-sv.prm
+++ /dev/null
@@ -1,38 +0,0 @@
-extensions = x509v3
-[ x509v3 ]
-subjectAltName = DNS:localhost
-keyUsage	= keyEncipherment,digitalSignature,keyAgreement
-extendedKeyUsage = serverAuth
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid
-basicConstraints = CA:false
-authorityInfoAccess     = @issuer_info
-crlDistributionPoints   = @crl_info
-
-[ crl_ext ]
-authorityKeyIdentifier  = keyid:always
-authorityInfoAccess     = @issuer_info
-
-[ issuer_info ]
-caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
-
-[ crl_info ]
-URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
-
-[ req ]
-default_bits                    = 12048
-distinguished_name              = req_DN
-default_md			= sha256
-string_mask			= utf8only
-[ req_DN ]
-countryName                     = "Country Name is Northern Nowhere"
-countryName_value            = NN
-organizationName              = "Organization Name"
-organizationName_value     = Edel Curl Arctic Illudium Research Cloud
-commonName                      = "Common Name"
-commonName_value              = localhost
-
-[something]
-# The key
-# the certificate
-# some dhparam
diff --git a/third-party/curl/tests/certs/stunnel-sv.pub.der b/third-party/curl/tests/certs/stunnel-sv.pub.der
deleted file mode 100644
index 434e87937535de8efa1f8f448d1e28f7e54826d4..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 294
zcmV+>0ondAf&n5h4F(A+hDe6@4FLfG1potr0S^E$f&mHwf&l>ls|v6K(02Y_&K2Ha
z)#H(GeAc_lCXRT%CN<HfS@G38RXzzU?4Z=I4m?_-wXk?mm12N^amY@eSy_`n60)hz
zvdtHZpC|L<&m(vS(gq`6n;`5$cV?}mUV^kulyd45WODq=gDlsfi}fx{)4_<c$e0;l
z@0k2zfU{@JA0zx<IL(4?Etc6elm029X=T9QMXNuo7Z?D5O1H_nxL+x|#H<#V%vUrJ
z$u?zdKG=yx$fZJrd|u5O=<z;Pvmp=AHWTv1FS&C;`iH9AMAl@M<XTYqN}u4O=V|n<
sTF*Kl<);ba&*&MU0IsOJA_6pAv(L38Om@Gm>G8PJhPr)|0s{d60rby{Jpcdz

diff --git a/third-party/curl/tests/certs/stunnel-sv.pub.pem b/third-party/curl/tests/certs/stunnel-sv.pub.pem
deleted file mode 100644
index 5458d6573b..0000000000
--- a/third-party/curl/tests/certs/stunnel-sv.pub.pem
+++ /dev/null
@@ -1,9 +0,0 @@
------BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqwqwA9B2/l7OFd5h1eOR
-b3zWu8omjni+JjXRplnx1TxVPgks7KDUrw48WqK1sHhRlWKAgHHITp9ZWZNAErKp
-zrLNF4ufJ/PjzyN4BtIGI1+bIOxCd2atpF6CtE2UcuoTZHL8y4Ms16GL9S5M08GI
-ssiYGV/vmPxigLNnzB8j/F84zYJuLZbZNZP+KaJpZcDfRas/rBcYAIBKt8m6uF8p
-u8SsFpfMVzQQyTZlbD7YiUXIpUKEfF7NGujxPlWzIQ/QNhPyxC+5c0H6h6rcRNZk
-luRaUPlKn+Ci52n0rVrPOiDlpwniz+gZoQCuqLsiAjRcs8+1JEx2v63p8bjThrp9
-kwIDAQAB
------END PUBLIC KEY-----
diff --git a/third-party/curl/tests/certs/stunnel-sv.pubkey-pinned b/third-party/curl/tests/certs/stunnel-sv.pubkey-pinned
deleted file mode 100644
index 4829e494aa..0000000000
--- a/third-party/curl/tests/certs/stunnel-sv.pubkey-pinned
+++ /dev/null
@@ -1 +0,0 @@
-LpY019g4f7/9H+Q+AwdGYQsvwIj2JzM6m1jlyyJK1ro=
diff --git a/third-party/curl/tests/certs/test-ca.cnf b/third-party/curl/tests/certs/test-ca.cnf
new file mode 100644
index 0000000000..72209d68ca
--- /dev/null
+++ b/third-party/curl/tests/certs/test-ca.cnf
@@ -0,0 +1,11 @@
+[ ca ]
+default_ca = test
+
+[ test ]
+database = test-ca.db
+certificate = test-ca.crt
+private_key = test-ca.key
+crlnumber = test-ca.cnt
+default_md = sha256
+default_days = 365
+default_crl_days = 30
diff --git a/third-party/curl/tests/certs/test-ca.prm b/third-party/curl/tests/certs/test-ca.prm
new file mode 100644
index 0000000000..c86c4e40cc
--- /dev/null
+++ b/third-party/curl/tests/certs/test-ca.prm
@@ -0,0 +1,32 @@
+extensions = x509v3
+
+[ x509v3 ]
+basicConstraints        = critical,CA:true
+keyUsage                = critical,keyCertSign,cRLSign
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid:always
+authorityInfoAccess     = @issuer_info
+crlDistributionPoints   = @crl_info
+
+[ crl_ext ]
+authorityKeyIdentifier  = keyid:always
+authorityInfoAccess     = @issuer_info
+
+[ issuer_info ]
+caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
+
+[ crl_info ]
+URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
+
+[ req ]
+distinguished_name      = req_DN
+default_md              = sha256
+string_mask             = utf8only
+
+[ req_DN ]
+countryName             = "Country Name"
+countryName_value       = NN
+organizationName        = "Organization Name"
+organizationName_value  = Edel curl Arctic Illudium Research Cloud
+commonName              = "Common Name"
+commonName_value        = Northern Nowhere Trust Anchor
diff --git a/third-party/curl/tests/certs/test-client-cert.prm b/third-party/curl/tests/certs/test-client-cert.prm
new file mode 100644
index 0000000000..99962e21c1
--- /dev/null
+++ b/third-party/curl/tests/certs/test-client-cert.prm
@@ -0,0 +1,34 @@
+extensions = x509v3
+
+[ x509v3 ]
+subjectAltName          = DNS:localhost
+keyUsage                = keyEncipherment,digitalSignature,keyAgreement
+extendedKeyUsage        = serverAuth,clientAuth
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid
+basicConstraints        = CA:false
+authorityInfoAccess     = @issuer_info
+crlDistributionPoints   = @crl_info
+
+[ crl_ext ]
+authorityKeyIdentifier  = keyid:always
+authorityInfoAccess     = @issuer_info
+
+[ issuer_info ]
+caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
+
+[ crl_info ]
+URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
+
+[ req ]
+distinguished_name      = req_DN
+default_md              = sha256
+string_mask             = utf8only
+
+[ req_DN ]
+countryName             = "Country Name is Northern Nowhere"
+countryName_value       = NN
+organizationName        = "Organization Name"
+organizationName_value  = Edel curl Arctic Illudium Research Cloud
+commonName              = "Common Name"
+commonName_value        = localhost
diff --git a/third-party/curl/tests/certs/test-client-eku-only.prm b/third-party/curl/tests/certs/test-client-eku-only.prm
new file mode 100644
index 0000000000..2ada8f9e7e
--- /dev/null
+++ b/third-party/curl/tests/certs/test-client-eku-only.prm
@@ -0,0 +1,34 @@
+extensions = x509v3
+
+[ x509v3 ]
+subjectAltName          = DNS:localhost
+keyUsage                = keyEncipherment,digitalSignature,keyAgreement
+extendedKeyUsage        = clientAuth
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid
+basicConstraints        = CA:false
+authorityInfoAccess     = @issuer_info
+crlDistributionPoints   = @crl_info
+
+[ crl_ext ]
+authorityKeyIdentifier  = keyid:always
+authorityInfoAccess     = @issuer_info
+
+[ issuer_info ]
+caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
+
+[ crl_info ]
+URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
+
+[ req ]
+distinguished_name      = req_DN
+default_md              = sha256
+string_mask             = utf8only
+
+[ req_DN ]
+countryName             = "Country Name is Northern Nowhere"
+countryName_value       = NN
+organizationName        = "Organization Name"
+organizationName_value  = Edel curl Arctic Illudium Research Cloud
+commonName              = "Common Name"
+commonName_value        = localhost
diff --git a/third-party/curl/tests/certs/test-localhost-san-first.prm b/third-party/curl/tests/certs/test-localhost-san-first.prm
new file mode 100644
index 0000000000..d354eda819
--- /dev/null
+++ b/third-party/curl/tests/certs/test-localhost-san-first.prm
@@ -0,0 +1,34 @@
+extensions = x509v3
+
+[ x509v3 ]
+subjectAltName          = DNS:localhost,DNS:localhost1,DNS:localhost2
+keyUsage                = keyEncipherment,digitalSignature,keyAgreement
+extendedKeyUsage        = serverAuth
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid
+basicConstraints        = CA:false
+authorityInfoAccess     = @issuer_info
+crlDistributionPoints   = @crl_info
+
+[ crl_ext ]
+authorityKeyIdentifier  = keyid:always
+authorityInfoAccess     = @issuer_info
+
+[ issuer_info ]
+caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
+
+[ crl_info ]
+URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
+
+[ req ]
+distinguished_name      = req_DN
+default_md              = sha256
+string_mask             = utf8only
+
+[ req_DN ]
+countryName             = "Country Name is Northern Nowhere"
+countryName_value       = NN
+organizationName        = "Organization Name"
+organizationName_value  = Edel curl Arctic Illudium Research Cloud
+commonName              = "Common Name"
+commonName_value        = localhost.nn
diff --git a/third-party/curl/tests/certs/test-localhost-san-last.prm b/third-party/curl/tests/certs/test-localhost-san-last.prm
new file mode 100644
index 0000000000..e8c87a19b0
--- /dev/null
+++ b/third-party/curl/tests/certs/test-localhost-san-last.prm
@@ -0,0 +1,34 @@
+extensions = x509v3
+
+[ x509v3 ]
+subjectAltName          = DNS:localhost1,DNS:localhost2,DNS:localhost
+keyUsage                = keyEncipherment,digitalSignature,keyAgreement
+extendedKeyUsage        = serverAuth
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid
+basicConstraints        = CA:false
+authorityInfoAccess     = @issuer_info
+crlDistributionPoints   = @crl_info
+
+[ crl_ext ]
+authorityKeyIdentifier  = keyid:always
+authorityInfoAccess     = @issuer_info
+
+[ issuer_info ]
+caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
+
+[ crl_info ]
+URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
+
+[ req ]
+distinguished_name      = req_DN
+default_md              = sha256
+string_mask             = utf8only
+
+[ req_DN ]
+countryName             = "Country Name is Northern Nowhere"
+countryName_value       = NN
+organizationName        = "Organization Name"
+organizationName_value  = Edel curl Arctic Illudium Research Cloud
+commonName              = "Common Name"
+commonName_value        = localhost.nn
diff --git a/third-party/curl/tests/certs/test-localhost.nn.prm b/third-party/curl/tests/certs/test-localhost.nn.prm
new file mode 100644
index 0000000000..aa3f3650bd
--- /dev/null
+++ b/third-party/curl/tests/certs/test-localhost.nn.prm
@@ -0,0 +1,34 @@
+extensions = x509v3
+
+[ x509v3 ]
+subjectAltName          = DNS:localhost.nn
+keyUsage                = keyEncipherment,digitalSignature,keyAgreement
+extendedKeyUsage        = serverAuth
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid
+basicConstraints        = CA:false
+authorityInfoAccess     = @issuer_info
+crlDistributionPoints   = @crl_info
+
+[ crl_ext ]
+authorityKeyIdentifier  = keyid:always
+authorityInfoAccess     = @issuer_info
+
+[ issuer_info ]
+caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
+
+[ crl_info ]
+URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
+
+[ req ]
+distinguished_name      = req_DN
+default_md              = sha256
+string_mask             = utf8only
+
+[ req_DN ]
+countryName             = "Country Name is Northern Nowhere"
+countryName_value       = NN
+organizationName        = "Organization Name"
+organizationName_value  = Edel curl Arctic Illudium Research Cloud
+commonName              = "Common Name"
+commonName_value        = localhost.nn
diff --git a/third-party/curl/tests/certs/test-localhost.prm b/third-party/curl/tests/certs/test-localhost.prm
new file mode 100644
index 0000000000..1d574a6b6c
--- /dev/null
+++ b/third-party/curl/tests/certs/test-localhost.prm
@@ -0,0 +1,34 @@
+extensions = x509v3
+
+[ x509v3 ]
+subjectAltName          = DNS:localhost
+keyUsage                = keyEncipherment,digitalSignature,keyAgreement
+extendedKeyUsage        = serverAuth
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid
+basicConstraints        = CA:false
+authorityInfoAccess     = @issuer_info
+crlDistributionPoints   = @crl_info
+
+[ crl_ext ]
+authorityKeyIdentifier  = keyid:always
+authorityInfoAccess     = @issuer_info
+
+[ issuer_info ]
+caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
+
+[ crl_info ]
+URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
+
+[ req ]
+distinguished_name      = req_DN
+default_md              = sha256
+string_mask             = utf8only
+
+[ req_DN ]
+countryName             = "Country Name is Northern Nowhere"
+countryName_value       = NN
+organizationName        = "Organization Name"
+organizationName_value  = Edel curl Arctic Illudium Research Cloud
+commonName              = "Common Name"
+commonName_value        = localhost
diff --git a/third-party/curl/tests/certs/test-localhost0h.prm b/third-party/curl/tests/certs/test-localhost0h.prm
new file mode 100644
index 0000000000..2b6b059377
--- /dev/null
+++ b/third-party/curl/tests/certs/test-localhost0h.prm
@@ -0,0 +1,35 @@
+extensions = x509v3
+
+[ x509v3 ]
+#subjectAltName         = DNS:localhost\0h
+subjectAltName          = DER:30:0d:82:0b:6c:6f:63:61:6c:68:6f:73:74:00:68
+keyUsage                = keyEncipherment,digitalSignature,keyAgreement
+extendedKeyUsage        = serverAuth
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid
+basicConstraints        = CA:false
+authorityInfoAccess     = @issuer_info
+crlDistributionPoints   = @crl_info
+
+[ crl_ext ]
+authorityKeyIdentifier  = keyid:always
+authorityInfoAccess     = @issuer_info
+
+[ issuer_info ]
+caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
+
+[ crl_info ]
+URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
+
+[ req ]
+distinguished_name      = req_DN
+default_md              = sha256
+string_mask             = utf8only
+
+[ req_DN ]
+countryName             = "Country Name is Northern Nowhere"
+countryName_value       = NN
+organizationName        = "Organization Name"
+organizationName_value  = Edel curl Arctic Illudium Research Cloud
+commonName              = "Common Name"
+commonName_value        = localhost
diff --git a/third-party/curl/tests/check-deprecated.pl b/third-party/curl/tests/check-deprecated.pl
deleted file mode 100644
index b26aea8725..0000000000
--- a/third-party/curl/tests/check-deprecated.pl
+++ /dev/null
@@ -1,329 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-#
-###########################################################################
-#
-# Check that the deprecated statuses of functions and enum values in header
-# files, man pages and symbols-in-versions are in sync.
-
-use strict;
-use warnings;
-
-use File::Basename;
-
-my $root=$ARGV[0] || ".";
-my $incdir = "$root/include/curl";
-my $docdir = "$root/docs";
-my $libdocdir = "$docdir/libcurl";
-my $errcode = 0;
-
-# Symbol-indexed hashes.
-# Values are:
-#     X       Not deprecated
-#     ?       Deprecated in unknown version
-#     x.yy.z  Deprecated in version x.yy.z
-my %syminver;       # Symbols-in-versions deprecations.
-my %hdr;            # Public header files deprecations.
-my %funcman;        # Function man pages deprecations.
-my %optman;         # Option man pages deprecations.
-
-
-# Scan header file for public function and enum values. Flag them with
-# the version they are deprecated in, if some.
-sub scan_header {
-    my ($f)=@_;
-    my $line = "";
-    my $incomment = 0;
-    my $inenum = 0;
-
-    open(my $h, "<", "$f");
-    while(<$h>) {
-      s/^\s*(.*?)\s*$/$1/;      # Trim.
-      # Remove multi-line comment trail.
-      if($incomment) {
-        if($_ !~ /.*?\*\/\s*(.*)$/) {
-          next;
-        }
-        $_ = $1;
-        $incomment = 0;
-      }
-      if($line ne "") {
-        # Unfold line.
-        $_ = "$line $1";
-        $line = "";
-      }
-      # Remove comments.
-      while($_ =~ /^(.*?)\/\*.*?\*\/(.*)$/) {
-        $_ = "$1 $2";
-      }
-      if($_ =~ /^(.*)\/\*/) {
-        $_ = "$1 ";
-        $incomment = 1;
-      }
-      s/^\s*(.*?)\s*$/$1/;      # Trim again.
-      # Ignore preprocessor directives and blank lines.
-      if($_ =~ /^(?:#|$)/) {
-        next;
-      }
-      # Handle lines that may be continued as if they were folded.
-      if($_ !~ /[;,{}]$/) {
-        # Folded line.
-        $line = $_;
-        next;
-      }
-      if($_ =~ /CURLOPTDEPRECATED\(/) {
-        # Handle deprecated CURLOPT_* option.
-        if($_ !~ /CURLOPTDEPRECATED\(\s*(\S+)\s*,(?:.*?,){2}\s*(.*?)\s*,.*"\)/) {
-          # Folded line.
-          $line = $_;
-          next;
-        }
-        $hdr{$1} = $2;
-      }
-      elsif($_ =~ /CURLOPT\(/) {
-        # Handle non-deprecated CURLOPT_* option.
-        if($_ !~ /CURLOPT\(\s*(\S+)\s*(?:,.*?){2}\)/) {
-          # Folded line.
-          $line = $_;
-          next;
-        }
-        $hdr{$1} = "X";
-      }
-      else {
-        my $version = "X";
-
-        # Get other kind of deprecation from this line.
-        if($_ =~ /CURL_DEPRECATED\(/) {
-          if($_ !~ /^(.*)CURL_DEPRECATED\(\s*(\S+?)\s*,.*?"\)(.*)$/) {
-            # Folded line.
-            $line = $_;
-            next;
-          }
-         $version = $2;
-         $_ = "$1 $3";
-        }
-        if($_ =~ /^CURL_EXTERN\s+.*\s+(\S+?)\s*\(/) {
-          # Flag public function.
-          $hdr{$1} = $version;
-        }
-        elsif($inenum && $_ =~ /(\w+)\s*[,=}]/) {
-          # Flag enum value.
-          $hdr{$1} = $version;
-        }
-      }
-      # Remember if we are in an enum definition.
-      $inenum |= ($_ =~ /\benum\b/);
-      if($_ =~ /}/) {
-        $inenum = 0;
-      }
-    }
-    close $h;
-}
-
-# Scan function man page for options.
-# Each option has to be declared as ".IP <option>" where <option> starts with
-# the prefix. Flag each option with its deprecation version, if some.
-sub scan_man_for_opts {
-    my ($f, $prefix)=@_;
-    my $opt = "";
-    my $line = "";
-
-    open(my $m, "<", "$f");
-    while(<$m>) {
-      if($_ =~ /^\./) {
-        # roff directive found: end current option paragraph.
-        my $o = $opt;
-        $opt = "";
-        if($_ =~ /^\.IP\s+((?:$prefix)_\w+)/) {
-          # A new option has been found.
-          $opt = $1;
-        }
-        $_ = $line;     # Get full paragraph.
-        $line = "";
-        s/\\f.//g;      # Remove font formatting.
-        s/\s+/ /g;      # One line with single space only.
-        if($o) {
-          $funcman{$o} = "X";
-          # Check if paragraph is mentioning deprecation.
-          while($_ =~ /(?:deprecated|obsoleted?)\b\s*(?:in\b|since\b)?\s*(?:version\b|curl\b|libcurl\b)?\s*(\d[0-9.]*\d)?\b\s*(.*)$/i) {
-            $funcman{$o} = $1 || "?";
-            $_ = $2;
-          }
-        }
-      }
-      else {
-        # Text line: accumulate.
-        $line .= $_;
-      }
-    }
-    close $m;
-}
-
-# Scan man page for deprecation in DESCRIPTION and/or AVAILABILITY sections.
-sub scan_man_page {
-    my ($path, $sym, $table)=@_;
-    my $version = "X";
-
-    if(open(my $fh, "<", "$path")) {
-      my $section = "";
-      my $line = "";
-
-      while(<$fh>) {
-        if($_ =~ /\.so\s+man3\/(.*\.3\b)/) {
-          # Handle man page inclusion.
-          scan_man_page(dirname($path) . "/$1", $sym, $table);
-          $version = exists($$table{$sym})? $$table{$sym}: $version;
-        }
-        elsif($_ =~ /^\./) {
-          # Line is a roff directive.
-          if($_ =~ /^\.SH\b\s*(\w*)/) {
-            # Section starts. End previous one.
-            my $sh = $section;
-
-            $section = $1;
-            $_ = $line;     # Previous section text.
-            $line = "";
-            s/\\f.//g;
-            s/\s+/ /g;
-            s/\\f.//g;      # Remove font formatting.
-            s/\s+/ /g;      # One line with single space only.
-            if($sh =~ /DESCRIPTION|AVAILABILITY/) {
-              while($_ =~ /(?:deprecated|obsoleted?)\b\s*(?:in\b|since\b)?\s*(?:version\b|curl\b|libcurl\b)?\s*(\d[0-9.]*\d)?\b\s*(.*)$/i) {
-                # Flag deprecation status.
-                if($version ne "X" && $version ne "?") {
-                  if($1 && $1 ne $version) {
-                    print "error: $sym man page lists unmatching deprecation versions $version and $1\n";
-                    $errcode++;
-                  }
-                }
-                else {
-                  $version = $1 || "?";
-                }
-                $_ = $2;
-              }
-            }
-          }
-        }
-        else {
-          # Text line: accumulate.
-          $line .= $_;
-        }
-      }
-      close $fh;
-      $$table{$sym} = $version;
-    }
-}
-
-
-# Read symbols-in-versions.
-open(my $fh, "<", "$libdocdir/symbols-in-versions") ||
-  die "$libdocdir/symbols-in-versions";
-while(<$fh>) {
-  if($_ =~ /^((?:CURL|LIBCURL)\S+)\s+\S+\s*(\S*)\s*(\S*)$/) {
-    if($3 eq "") {
-      $syminver{$1} = "X";
-      if($2 ne "" && $2 ne ".") {
-        $syminver{$1} = $2;
-      }
-    }
-  }
-}
-close($fh);
-
-# Get header file names,
-opendir(my $dh, $incdir) || die "Can't opendir $incdir";
-my @hfiles = grep { /\.h$/ } readdir($dh);
-closedir $dh;
-
-# Get functions and enum symbols from header files.
-for(@hfiles) {
-  scan_header("$incdir/$_");
-}
-
-# Get function statuses from man pages.
-foreach my $sym (keys %hdr) {
-  if($sym =~/^(?:curl|curlx)_\w/) {
-    scan_man_page("$libdocdir/$sym.3", $sym, \%funcman);
-  }
-}
-
-# Get options from function man pages.
-scan_man_for_opts("$libdocdir/curl_easy_setopt.3", "CURLOPT");
-scan_man_for_opts("$libdocdir/curl_easy_getinfo.3", "CURLINFO");
-
-# Get deprecation status from option man pages.
-foreach my $sym (keys %syminver) {
-  if($sym =~ /^(?:CURLOPT|CURLINFO)_\w+$/) {
-    scan_man_page("$libdocdir/opts/$sym.3", $sym, \%optman);
-  }
-}
-
-# Print results.
-my %keys = (%syminver, %funcman, %optman, %hdr);
-my $leader = <<HEADER
-Legend:
-<empty> Not listed
-X       Not deprecated
-?       Deprecated in unknown version
-x.yy.z  Deprecated in version x.yy.z
-
-Symbol                                 symbols-in  func man  opt man   .h
-                                       -versions
-HEADER
-        ;
-foreach my $sym (sort {$a cmp $b} keys %keys) {
-  if($sym =~ /^(?:CURLOPT|CURLINFO|curl|curlx)_\w/) {
-    my $s = exists($syminver{$sym})? $syminver{$sym}: " ";
-    my $f = exists($funcman{$sym})? $funcman{$sym}: " ";
-    my $o = exists($optman{$sym})? $optman{$sym}: " ";
-    my $h = exists($hdr{$sym})? $hdr{$sym}: " ";
-    my $r = " ";
-
-    # There are deprecated symbols in symbols-in-versions that are aliases
-    # and thus not listed anywhere else. Ignore them.
-    "$f$o$h" =~ /[X ]{3}/ && next;
-
-    # Check for inconsistencies between deprecations from the different sources.
-    foreach my $k ($s, $f, $o, $h) {
-      $r = $r eq " "? $k: $r;
-      if($k ne " " && $r ne $k) {
-        if($r eq "?") {
-          $r = $k ne "X"? $k: "!";
-        }
-        elsif($r eq "X" || $k ne "?") {
-          $r = "!";
-        }
-      }
-    }
-
-    if($r eq "!") {
-      print $leader;
-      $leader = "";
-      printf("%-38s %-11s %-9s %-9s %s\n", $sym, $s, $f, $o, $h);
-      $errcode++;
-    }
-  }
-}
-
-exit $errcode;
diff --git a/third-party/curl/tests/check-translatable-options.pl b/third-party/curl/tests/check-translatable-options.pl
deleted file mode 100644
index 64d036d272..0000000000
--- a/third-party/curl/tests/check-translatable-options.pl
+++ /dev/null
@@ -1,147 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-#
-###########################################################################
-#
-# Check the OS/400 translating wrapper properly handles all translatable
-# string options.
-
-use strict;
-use warnings;
-
-my $root=$ARGV[0] || ".";
-my $incdir = "$root/include/curl";
-my $os400dir = "$root/packages/OS400";
-my $errcount = 0;
-
-# Scan header file for string option definitions.
-sub scan_header {
-    my ($f)=@_;
-    my $line = "";
-    my $incomment = 0;
-    my @stringopts;
-
-    open(my $h, "<", "$f");
-    while(<$h>) {
-      s/^\s*(.*?)\s*$/$1/;      # Trim.
-      # Remove multi-line comment trail.
-      if($incomment) {
-        if($_ !~ /.*?\*\/\s*(.*)$/) {
-          next;
-        }
-        $_ = $1;
-        $incomment = 0;
-      }
-      if($line ne "") {
-        # Unfold line.
-        $_ = "$line $1";
-        $line = "";
-      }
-      if($_ =~ /^(.*)\\$/) {
-        $line = "$1 ";
-        next;
-      }
-      # Remove comments.
-      while($_ =~ /^(.*?)\/\*.*?\*\/(.*)$/) {
-        $_ = "$1 $2";
-      }
-      if($_ =~ /^(.*)\/\*/) {
-        $_ = "$1 ";
-        $incomment = 1;
-      }
-      s/^\s*(.*?)\s*$/$1/;      # Trim again.
-      # Ignore preprocessor directives and blank lines.
-      if($_ =~ /^(?:#|$)/) {
-        next;
-      }
-      # Handle lines that may be continued as if they were folded.
-      if($_ !~ /[;,{}]$/ || $_ =~ /[^)],$/) {
-        # Folded line.
-        $line = $_;
-        next;
-      }
-      # Keep string options only.
-      if($_ =~ /CURLOPT(?:DEPRECATED)?\s*\(\s*([^, \t]+)\s*,\s*CURLOPTTYPE_STRINGPOINT/) {
-        push(@stringopts, $1);
-      }
-    }
-    close $h;
-    return @stringopts;
-}
-
-# Scan packages/OS400/ccsidcurl.c for translatable string option cases.
-sub scan_wrapper_for_strings {
-    my ($f)=@_;
-    my $inarmor = 0;
-    my @stringopts;
-
-    open(my $h, "<", "$f");
-    while(<$h>) {
-      if($_ =~ /(BEGIN|END) TRANSLATABLE STRING OPTIONS/) {
-        $inarmor = $1 eq "BEGIN";
-      }
-      elsif($inarmor && $_ =~ /case\s+([^:]+):/) {
-        push(@stringopts, $1);
-      }
-    }
-    close $h;
-    return @stringopts;
-}
-
-# Get translatable string options from header file.
-my @stringdefs = scan_header("$incdir/curl.h");
-
-# Get translated string options.
-my @stringrefs = scan_wrapper_for_strings("$os400dir/ccsidcurl.c");
-
-# Lists should be equal: check differences.
-my %diff;
-@diff{@stringdefs} = 0..$#stringdefs;
-delete @diff{@stringrefs};
-
-foreach(keys %diff) {
-  print "$_ is not translated\n";
-  delete $diff{$_};
-  $errcount++;
-}
-
-@diff{@stringrefs} = 0..$#stringrefs;
-delete @diff{@stringdefs};
-
-foreach(keys %diff) {
-  print "translated option $_ does not exist\n";
-  $errcount++;
-}
-
-# Check translated string option cases are sorted alphanumerically.
-foreach(my $i = 1; $i < $#stringrefs; $i++) {
-  if($stringrefs[$i] lt $stringrefs[$i - 1]) {
-    print("Translated string options are not sorted (" . $stringrefs[$i - 1] .
-          "/" . $stringrefs[$i] . ")\n");
-    $errcount++;
-    last;
-  }
-}
-
-exit !!$errcount;
diff --git a/third-party/curl/tests/cmake/CMakeLists.txt b/third-party/curl/tests/cmake/CMakeLists.txt
new file mode 100644
index 0000000000..0b1e581bb0
--- /dev/null
+++ b/third-party/curl/tests/cmake/CMakeLists.txt
@@ -0,0 +1,138 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+cmake_minimum_required(VERSION 3.18 FATAL_ERROR)
+message(STATUS "Using CMake version ${CMAKE_VERSION}")
+
+option(TEST_CPP "Test C++" OFF)
+
+if(TEST_CPP)
+  project(test-CPP-consumer CXX)
+  set(_source "test.cpp")
+else()
+  project(test-C-consumer C)
+  set(_source "test.c")
+endif()
+
+option(TEST_INTEGRATION_MODE "Integration mode" "find_package")
+
+message(STATUS "TEST_INTEGRATION_MODE: ${TEST_INTEGRATION_MODE}")
+
+if(TEST_INTEGRATION_MODE STREQUAL "find_package")
+  find_package(CURL REQUIRED CONFIG)
+  find_package(CURL REQUIRED CONFIG)  # Double-inclusion test
+  foreach(_result_var IN ITEMS
+      CURL_FOUND
+      CURL_SUPPORTS_HTTPS
+      CURL_SUPPORTS_Largefile
+      CURL_VERSION
+      CURL_VERSION_STRING
+  )
+    if(NOT ${_result_var})
+      message(FATAL_ERROR "'${_result_var}' variable expected, but not set by the CURL package.")
+    endif()
+  endforeach()
+  # Show variables set by find_package()
+  get_cmake_property(_vars VARIABLES)
+  foreach(_var IN ITEMS ${_vars})
+    string(TOUPPER "${_var}" _var_upper)
+    if(_var_upper MATCHES "CURL")
+      get_property(_var_type CACHE ${_var} PROPERTY TYPE)
+      if(_var_type)
+        set(_var_type ":${_var_type}")
+      endif()
+      message("find_package() sets: ${_var}${_var_type} = '${${_var}}'")
+    endif()
+  endforeach()
+elseif(TEST_INTEGRATION_MODE STREQUAL "add_subdirectory")
+  set(BUILD_SHARED_LIBS ON CACHE BOOL "")
+  set(BUILD_STATIC_LIBS ON CACHE BOOL "")
+  add_subdirectory(curl)
+elseif(TEST_INTEGRATION_MODE STREQUAL "FetchContent")
+  include(FetchContent)
+  option(FROM_GIT_REPO "Git URL" "https://github.com/curl/curl.git")
+  option(FROM_GIT_TAG "Git tag" "master")
+  FetchContent_Declare(curl
+    GIT_REPOSITORY "${FROM_GIT_REPO}"
+    GIT_TAG "${FROM_GIT_TAG}"
+    GIT_SHALLOW)
+  set(BUILD_SHARED_LIBS ON CACHE BOOL "")
+  set(BUILD_STATIC_LIBS ON CACHE BOOL "")
+  FetchContent_MakeAvailable(curl)
+elseif(TEST_INTEGRATION_MODE STREQUAL "ExternalProject")
+  include(ExternalProject)
+  set(_curl_install_dir "${CMAKE_BINARY_DIR}/curl-external-install")
+  set(_curl_static_lib "${_curl_install_dir}/lib/${CMAKE_STATIC_LIBRARY_PREFIX}curl${CMAKE_STATIC_LIBRARY_SUFFIX}")
+  string(REPLACE " " ";" CURL_TEST_OPTS "${CURL_TEST_OPTS}")
+  if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.24)
+    set(_download_extract_timestamp "DOWNLOAD_EXTRACT_TIMESTAMP" "ON")
+  endif()
+  ExternalProject_Add(curl-external
+    URL "${FROM_ARCHIVE}" URL_HASH "SHA256=${FROM_HASH}"
+    ${_download_extract_timestamp}
+    PREFIX "${CMAKE_BINARY_DIR}/curl-external"
+    CMAKE_ARGS "-DCMAKE_INSTALL_PREFIX=${_curl_install_dir}" -DBUILD_SHARED_LIBS=OFF -DCURL_USE_LIBPSL=OFF
+      -DCURL_USE_CMAKECONFIG=OFF -DCURL_USE_PKGCONFIG=OFF
+      -DCURL_ENABLE_SSL=OFF -DCURL_ENABLE_SSL=OFF -DCURL_DISABLE_LDAP=ON -DCURL_USE_LIBSSH2=OFF -DUSE_NGHTTP2=OFF
+      -DCURL_BROTLI=OFF -DCURL_ZLIB=OFF -DCURL_ZSTD=OFF -DUSE_LIBIDN2=OFF -DENABLE_IPV6=OFF
+      ${CURL_TEST_OPTS}
+    BUILD_BYPRODUCTS "${_curl_static_lib}")
+
+  add_executable(test-consumer-static-fetch "${_source}")
+  add_dependencies(test-consumer-static-fetch curl-external)
+  if(WIN32)
+    target_compile_definitions(test-consumer-static-fetch PRIVATE "CURL_STATICLIB")
+    list(APPEND _curl_static_lib "ws2_32" "bcrypt")
+  endif()
+  target_include_directories(test-consumer-static-fetch PRIVATE "${_curl_install_dir}/include")
+  target_link_libraries(test-consumer-static-fetch PRIVATE "${_curl_static_lib}")
+endif()
+
+if(TEST_INTEGRATION_MODE STREQUAL "find_package" OR
+   TEST_INTEGRATION_MODE STREQUAL "add_subdirectory" OR
+   TEST_INTEGRATION_MODE STREQUAL "FetchContent")
+
+  add_executable(test-consumer-static-ns "${_source}")
+  target_link_libraries(test-consumer-static-ns PRIVATE "CURL::libcurl_static")
+
+  add_executable(test-consumer-shared-ns "${_source}")
+  target_link_libraries(test-consumer-shared-ns PRIVATE "CURL::libcurl_shared")
+
+  # Alias for either shared or static library
+  add_executable(test-consumer-selected-ns "${_source}")
+  target_link_libraries(test-consumer-selected-ns PRIVATE "CURL::libcurl")
+endif()
+
+if(TEST_INTEGRATION_MODE STREQUAL "add_subdirectory" OR
+   TEST_INTEGRATION_MODE STREQUAL "FetchContent")
+
+  add_executable(test-consumer-static-bare "${_source}")
+  target_link_libraries(test-consumer-static-bare PRIVATE "libcurl_static")
+
+  add_executable(test-consumer-shared-bare "${_source}")
+  target_link_libraries(test-consumer-shared-bare PRIVATE "libcurl_shared")
+
+  add_executable(test-consumer-selected-bare "${_source}")
+  target_link_libraries(test-consumer-selected-bare PRIVATE "libcurl")
+endif()
diff --git a/third-party/curl/tests/cmake/test.c b/third-party/curl/tests/cmake/test.c
new file mode 100644
index 0000000000..75c6bf913e
--- /dev/null
+++ b/third-party/curl/tests/cmake/test.c
@@ -0,0 +1,35 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include <curl/curl.h>
+#include <stdio.h>
+
+int main(int argc, const char **argv)
+{
+  (void)argc;
+  puts("libcurl C test:");
+  puts(argv[0]);
+  puts(curl_version());
+  puts("---");
+  return 0;
+}
diff --git a/third-party/curl/tests/cmake/test.cpp b/third-party/curl/tests/cmake/test.cpp
new file mode 100644
index 0000000000..f5fd4ecc2a
--- /dev/null
+++ b/third-party/curl/tests/cmake/test.cpp
@@ -0,0 +1,47 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include <curl/curl.h>
+#include <iostream>
+
+class CurlClass {
+public:
+  void curl_multi_setopt(void *a, int b, long c) {
+    (void)a;
+    (void)b;
+    (void)c;
+    std::cout << curl_version() << std::endl;
+  }
+};
+
+int main(int argc, const char **argv)
+{
+  (void)argc;
+  std::cout << "libcurl C++ test:" << std::endl;
+  std::cout << argv[0] << std::endl;
+  CurlClass mycurl;
+  mycurl.curl_multi_setopt(nullptr, 0, 0);
+  ::curl_easy_setopt(nullptr, CURLOPT_URL, "https://example.com/");
+  std::cout << "---" << std::endl;
+  return 0;
+}
diff --git a/third-party/curl/tests/cmake/test.sh b/third-party/curl/tests/cmake/test.sh
new file mode 100644
index 0000000000..bcc1bd37dc
--- /dev/null
+++ b/third-party/curl/tests/cmake/test.sh
@@ -0,0 +1,94 @@
+#!/bin/sh -x
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+# shellcheck disable=SC2086
+
+set -eu
+
+cd "$(dirname "$0")"
+
+mode="${1:-all}"; shift
+
+cmake_consumer="${TEST_CMAKE_CONSUMER:-cmake}"
+cmake_provider="${TEST_CMAKE_PROVIDER:-${cmake_consumer}}"
+
+gen="${TEST_CMAKE_GENERATOR:-Ninja}"
+
+cmake_opts='-DBUILD_CURL_EXE=OFF -DBUILD_LIBCURL_DOCS=OFF -DBUILD_MISC_DOCS=OFF -DENABLE_CURL_MANUAL=OFF'
+
+src='../..'
+
+runresults() {
+  set +x
+  for bin in "$1"/test-consumer*; do
+    file "${bin}" || true
+    ${TEST_CMAKE_EXE_RUNNER:-} "${bin}" || true
+  done
+  set -x
+}
+
+if [ "${mode}" = 'all' ] || [ "${mode}" = 'ExternalProject' ]; then
+  (cd "${src}"; git archive --format=tar HEAD) | gzip > source.tar.gz
+  src="${PWD}/source.tar.gz"
+  sha="$(sha256sum "${src}" | grep -a -i -o -w -E '[0-9a-f]{64}')"
+  bldc='bld-externalproject'
+  rm -rf "${bldc}"
+  "${cmake_consumer}" -B "${bldc}" -G "${gen}" ${TEST_CMAKE_FLAGS:-} -DCURL_TEST_OPTS="${cmake_opts} -DCMAKE_UNITY_BUILD=ON $*" \
+    -DTEST_INTEGRATION_MODE=ExternalProject \
+    -DFROM_ARCHIVE="${src}" -DFROM_HASH="${sha}"
+  "${cmake_consumer}" --build "${bldc}" --verbose
+  runresults "${bldc}"
+fi
+
+if [ "${mode}" = 'all' ] || [ "${mode}" = 'FetchContent' ]; then
+  src="${PWD}/${src}"
+  bldc='bld-fetchcontent'
+  rm -rf "${bldc}"
+  "${cmake_consumer}" -B "${bldc}" -G "${gen}" ${cmake_opts} -DCMAKE_UNITY_BUILD=ON ${TEST_CMAKE_FLAGS:-} "$@" \
+    -DTEST_INTEGRATION_MODE=FetchContent \
+    -DFROM_GIT_REPO="${src}" \
+    -DFROM_GIT_TAG="$(git rev-parse HEAD)"
+  "${cmake_consumer}" --build "${bldc}" --verbose
+  PATH="${bldc}/_deps/curl-build/lib:${PATH}"
+  runresults "${bldc}"
+fi
+
+if [ "${mode}" = 'all' ] || [ "${mode}" = 'add_subdirectory' ]; then
+  rm -rf curl
+  if ! ln -s "${src}" curl; then
+    rm -rf curl; mkdir curl; (cd "${src}"; git archive --format=tar HEAD) | tar -x --directory=curl  # for MSYS2/Cygwin
+  fi
+  bldc='bld-add_subdirectory'
+  rm -rf "${bldc}"
+  "${cmake_consumer}" -B "${bldc}" -G "${gen}" ${cmake_opts} -DCMAKE_UNITY_BUILD=ON ${TEST_CMAKE_FLAGS:-} "$@" \
+    -DTEST_INTEGRATION_MODE=add_subdirectory
+  "${cmake_consumer}" --build "${bldc}" --verbose
+  PATH="${bldc}/curl/lib:${PATH}"
+  runresults "${bldc}"
+fi
+
+if [ "${mode}" = 'all' ] || [ "${mode}" = 'find_package' ]; then
+  src="${PWD}/${src}"
+  bldp='bld-curl'
+  prefix="${PWD}/${bldp}/_pkg"
+  rm -rf "${bldp}"
+  "${cmake_provider}" -B "${bldp}" -S "${src}" -G "${gen}" ${cmake_opts} -DCMAKE_UNITY_BUILD=ON ${TEST_CMAKE_FLAGS:-} ${TEST_CMAKE_FLAGS_PROVIDER:-} "$@" \
+    -DBUILD_SHARED_LIBS=ON \
+    -DBUILD_STATIC_LIBS=ON \
+    -DCMAKE_INSTALL_PREFIX="${prefix}"
+  "${cmake_provider}" --build "${bldp}" --verbose
+  "${cmake_provider}" --install "${bldp}"
+  echo '::group::libcurl.pc'; cat "${prefix}"/lib/pkgconfig/*.pc || true; echo '::endgroup::'
+  echo '::group::curl-config.cmake'; cat "${prefix}"/lib/cmake/CURL/CURL* || true; echo '::endgroup::'
+  echo '::group::curl-config'; cat "${prefix}"/bin/curl-config || true; echo '::endgroup::'
+  bldc='bld-find_package'
+  rm -rf "${bldc}"
+  "${cmake_consumer}" -B "${bldc}" -G "${gen}" ${TEST_CMAKE_FLAGS:-} ${TEST_CMAKE_FLAGS_CONSUMER:-} \
+    -DTEST_INTEGRATION_MODE=find_package \
+    -DCMAKE_PREFIX_PATH="${prefix}/lib/cmake/CURL"
+  "${cmake_consumer}" --build "${bldc}" --verbose
+  PATH="${prefix}/bin:${PATH}"
+  runresults "${bldc}"
+fi
diff --git a/third-party/curl/tests/configurehelp.pm.in b/third-party/curl/tests/configurehelp.pm.in
new file mode 100644
index 0000000000..626df2c511
--- /dev/null
+++ b/third-party/curl/tests/configurehelp.pm.in
@@ -0,0 +1,45 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+package configurehelp;
+
+use strict;
+use warnings;
+use Exporter;
+
+use vars qw(
+    @ISA
+    @EXPORT_OK
+    $Cpreprocessor
+    );
+
+@ISA = qw(Exporter);
+
+@EXPORT_OK = qw(
+    $Cpreprocessor
+    );
+
+$Cpreprocessor = '@CURL_CPP@';
+
+1;
diff --git a/third-party/curl/tests/conftest.py b/third-party/curl/tests/conftest.py
deleted file mode 100644
index 713a174231..0000000000
--- a/third-party/curl/tests/conftest.py
+++ /dev/null
@@ -1,60 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) 2008 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-#
-import sys, os
-
-sys.path.append(os.path.join(os.path.dirname(__file__), 'http'))
-
-import pytest
-from testenv import Env
-
-def pytest_report_header(config, startdir):
-    # Env inits its base properties only once, we can report them here
-    env = Env()
-    report = [
-        f'Testing curl {env.curl_version()}',
-        f'  httpd: {env.httpd_version()}, http:{env.http_port} https:{env.https_port}',
-        f'  httpd-proxy: {env.httpd_version()}, http:{env.proxy_port} https:{env.proxys_port}'
-    ]
-    if env.have_h3():
-        report.extend([
-            f'  nghttpx: {env.nghttpx_version()}, h3:{env.https_port}'
-        ])
-    if env.has_caddy():
-        report.extend([
-            f'  Caddy: {env.caddy_version()}, http:{env.caddy_http_port} https:{env.caddy_https_port}'
-        ])
-    return '\n'.join(report)
-
-
-def pytest_addoption(parser):
-    parser.addoption("--repeat", action="store", type=int, default=1,
-                     help='Number of times to repeat each test')
-
-
-def pytest_generate_tests(metafunc):
-    if "repeat" in metafunc.fixturenames:
-        count = int(metafunc.config.getoption("repeat"))
-        metafunc.fixturenames.append('tmp_ct')
-        metafunc.parametrize('repeat', range(count))
diff --git a/third-party/curl/tests/convsrctest.pl b/third-party/curl/tests/convsrctest.pl
deleted file mode 100644
index cdb252aeb0..0000000000
--- a/third-party/curl/tests/convsrctest.pl
+++ /dev/null
@@ -1,263 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-#***************************************************************************
-
-#=======================================================================
-# Read a test definition which exercises curl's --libcurl option.
-# Generate either compilable source code for a new test tool,
-# or a new test definition which runs the tool and expects the
-# same output.
-# This should verify that the --libcurl code really does perform
-# the same actions as the original curl invocation.
-#-----------------------------------------------------------------------
-# The output of curl's --libcurl option differs in several ways from
-# the code needed to integrate with the test tool environment:
-# - #include "test.h"
-# - no call of curl_global_init & curl_global_cleanup
-# - main() function vs. test() function
-# - no checking of curl_easy_setopt calls vs. test_setopt wrapper
-# - handling of stdout
-# - variable names ret & hnd vs. res & curl
-# - URL as literal string vs. passed as argument
-#=======================================================================
-use strict;
-use warnings;
-
-use getpart qw(
-    getpart
-    loadtest
-    fulltest
-    );
-
-# Boilerplate code for test tool
-my $head =
-'#include "test.h"
-#include "memdebug.h"
-
-int test(char *URL)
-{
-  CURLcode res;
-  CURL *curl;
-';
-# Other declarations from --libcurl come here
-# e.g. curl_slist
-my $init =
-'
-  if (curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
-    return TEST_ERR_MAJOR_BAD;
-  }
-
-  if ((curl = curl_easy_init()) == NULL) {
-    fprintf(stderr, "curl_easy_init() failed\n");
-    curl_global_cleanup();
-    return TEST_ERR_MAJOR_BAD;
-  }
-';
-# Option setting, perform and cleanup come here
-my $exit =
-'  curl_global_cleanup();
-
-  return (int)res;
-}
-';
-
-my $myname = leaf($0);
-sub usage {die "Usage: $myname -c|-test=num testfile\n";}
-
-sub main {
-    @ARGV == 2
-        or usage;
-    my($opt,$testfile) = @ARGV;
-
-    if(loadtest($testfile)) {
-        die "$myname: $testfile doesn't look like a test case\n";
-    }
-
-    my $comment = sprintf("DO NOT EDIT - generated from %s by %s",
-                          leaf($testfile), $myname);
-    if($opt eq '-c') {
-        generate_c($comment);
-    }
-    elsif(my($num) = $opt =~ /^-test=(\d+)$/) {
-        generate_test($comment, $num);
-    }
-    else {
-        usage;
-    }
-}
-
-sub generate_c {
-    my($comment) = @_;
-    # Fetch the generated code, which is the output file checked by
-    # the old test.
-    my @libcurl = getpart("verify", "file")
-        or die "$myname: no <verify><file> section found\n";
-
-    # Mangle the code into a suitable form for a test tool.
-    # We want to extract the important parts (declarations,
-    # URL, setopt calls, cleanup code) from the --libcurl
-    # boilerplate and insert them into a new boilerplate.
-    my(@decl,@code);
-    # First URL passed in as argument, others as global
-    my @urlvars = ('URL', 'libtest_arg2', 'libtest_arg3');
-    my($seen_main,$seen_setopt,$seen_return);
-    foreach (@libcurl) {
-        # Check state changes first (even though it
-        # duplicates some matches) so that the other tests
-        # are in a logical order).
-        if(/^int main/) {
-            $seen_main = 1;
-        }
-        if($seen_main and /curl_easy_setopt/) {
-            # Don't match 'curl_easy_setopt' in comment!
-            $seen_setopt = 1;
-        }
-        if(/^\s*return/) {
-            $seen_return = 1;
-        }
-
-        # Now filter the code according to purpose
-        if(! $seen_main) {
-            next;
-        }
-        elsif(! $seen_setopt) {
-            if(/^\s*(int main|\{|CURLcode |CURL |hnd = curl_easy_init)/) {
-                # Initialization handled by boilerplate
-                next;
-            }
-            else {
-                push @decl, $_;
-            }
-        }
-        elsif(! $seen_return) {
-            if(/CURLOPT_URL/) {
-                # URL is passed in as argument or by global
-                my $var = shift @urlvars;
-                s/\"[^\"]*\"/$var/;
-            }
-            s/\bhnd\b/curl/;
-            # Convert to macro wrapper
-            s/curl_easy_setopt/test_setopt/;
-            if(/curl_easy_perform/) {
-                s/\bret\b/res/;
-                push @code, $_;
-                push @code, "test_cleanup:\n";
-            }
-            else {
-                push @code, $_;
-            }
-        }
-    }
-
-    print("/* $comment */\n",
-           $head,
-           @decl,
-           $init,
-           @code,
-           $exit);
-}
-
-# Read the original test data file and transform it
-# - add a "DO NOT EDIT comment"
-# - replace CURLOPT_URL string with URL variable
-# - remove <verify><file> section (was the --libcurl output)
-# - insert a <client><tool> section with our new C program name
-# - replace <client><command> section with the URL
-sub generate_test {
-    my($comment,$newnumber) = @_;
-    my @libcurl = getpart("verify", "file")
-        or die "$myname: no <verify><file> section found\n";
-    # Scan the --libcurl code to find the URL used.
-    my $url;
-    foreach (@libcurl) {
-        if(my($u) = /CURLOPT_URL, \"([^\"]*)\"/) {
-            $url = $u;
-        }
-    }
-    die "$myname: CURLOPT_URL not found\n"
-        unless defined $url;
-
-    # Traverse the pseudo-XML transforming as required
-    my @new;
-    my(@path,$path,$skip);
-    foreach (fulltest()) {
-        if(my($end) = /\s*<(\/?)testcase>/) {
-            push @new, $_;
-            push @new, "# $comment\n"
-                unless $end;
-        }
-        elsif(my($tag) = /^\s*<(\w+)/) {
-            push @path, $tag;
-            $path = join '/', @path;
-            if($path eq 'verify/file') {
-                $skip = 1;
-            }
-            push @new, $_
-                unless $skip;
-            if($path eq 'client') {
-                push @new, ("<tool>\n",
-                            "lib$newnumber\n",
-                            "</tool>\n");
-            }
-            elsif($path eq 'client/command') {
-                push @new, sh_quote($url)."\n";
-            }
-        }
-        elsif(my($etag) = /^\s*<\/(\w+)/) {
-            my $tag = pop @path;
-            die "$myname: mismatched </$etag>\n"
-                unless $tag eq $etag;
-            push @new, $_
-                unless $skip;
-            $skip --
-                if $path eq 'verify/file';
-            $path = join '/', @path;
-        }
-        else {
-            if($path eq 'client/command') {
-                # Replaced above
-            }
-            else {
-                push @new, $_
-                    unless $skip;
-            }
-        }
-    }
-    print @new;
-}
-
-sub leaf {
-    # Works for POSIX filenames
-    (my $path = shift) =~ s!.*/!!;
-    return $path;
-}
-
-sub sh_quote {
-    my $word = shift;
-    $word =~ s/[\$\"\'\\]/\\$&/g;
-    return '"' . $word . '"';
-}
-
-main;
diff --git a/third-party/curl/tests/data/.gitattributes b/third-party/curl/tests/data/.gitattributes
deleted file mode 100644
index bb1b928306..0000000000
--- a/third-party/curl/tests/data/.gitattributes
+++ /dev/null
@@ -1,5 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-test* -crlf
diff --git a/third-party/curl/tests/data/CMakeLists.txt b/third-party/curl/tests/data/CMakeLists.txt
deleted file mode 100644
index ed0b88f189..0000000000
--- a/third-party/curl/tests/data/CMakeLists.txt
+++ /dev/null
@@ -1,26 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Loads 'TESTCASES' from for the 'make show' target in runtests.pl
-transform_makefile_inc("Makefile.inc" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
-include("${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
diff --git a/third-party/curl/tests/data/DISABLED b/third-party/curl/tests/data/DISABLED
index b077c67a0f..60dca3ca6a 100644
--- a/third-party/curl/tests/data/DISABLED
+++ b/third-party/curl/tests/data/DISABLED
@@ -23,12 +23,12 @@
 ###########################################################################
 #
 # This file can be used to specify test cases that should not run when all
-# test cases are run by runtests.pl. Just add the plain test case numbers, one
+# test cases are run by runtests.pl. Add the plain test case numbers, one
 # per line.
 # Lines starting with '#' letters are treated as comments.
 #
 # Uses SRP to "a server not supporting it" but modern stunnel versions
-# will silently accept it and remain happy
+# silently accept it and remain happy
 323
 #
 594
@@ -39,76 +39,31 @@
 # of running runtests.pl as a child of itself sharing
 # some of the directories.
 1182
-# test 1184 causes flakiness in CI builds, mostly visible on macOS
+# test 1184 causes flakiness in CI builds
 1184
 1209
 1211
-# fnmatch differences are just too common to make testing them sensible
+# fnmatch differences are too common to make testing them sensible
 1307
 1316
-# test 1510 causes problems on the CI on github
-# example: https://travis-ci.org/curl/curl/builds/81633600
-1510
 1512
-# test 1801 causes problems on Mac OS X and github
+# test 1801 causes problems in CI builds
 # https://github.com/curl/curl/issues/380
 1801
-# test 2086 causes issues on Windows only
-2086
 #
-#
-# Tests that are disabled here for Hyper are SUPPOSED to work but
-# still need adjustments in tests or code. Tests that cannot be
-# fixed for hyper should be adjusted for it in the test file.
-#
-# hyper support remains EXPERIMENTAL as long as there's a test number
-# listed below
-#
-# Several tests fail due to hyper's lack of trailers support: 266, 1417, 1540,
-# 1591, 1943. See https://github.com/hyperium/hyper/issues/2699 for details.
-%if hyper
-266
-579
-587
-# 1021 re-added here due to flakiness
-1021
-1117
-1417
-1533
-1540
-1591
-1943
-2301
-2302
-2305
-%endif
 2043
-# The CRL test (313) doesn't work with rustls because rustls doesn't support
-# CRLs.
-# Tests that rely on connecting to an IP address over TLS don't work because
-# rustls doesn't support IP address certificates yet. That's the 400 series of
-# tests listed here, plus 1112 and 1272
-%if rustls
-313
-400
-401
-403
-404
-406
-407
-408
-409
-987
-988
-989
-1112
-1272
+%if WinIDN
+165
 %endif
-# The CRL test doesn't work with wolfSSL
-%if wolfssl
-313
+# Windows non-Unicode builds fail to receive Unicode text via the command-line
+%if win32
+%if !Unicode
+%if libidn2
+165
+1560
+%endif
+1448
+2046
+2047
 %endif
-# The CRL test doesn't work with BearSSL
-%if bearssl
-313
 %endif
diff --git a/third-party/curl/tests/data/Makefile.am b/third-party/curl/tests/data/Makefile.am
index 68148c1f93..9fb1720f7c 100644
--- a/third-party/curl/tests/data/Makefile.am
+++ b/third-party/curl/tests/data/Makefile.am
@@ -21,11 +21,280 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-iall:
+all:
 install:
 test:
 
-# TESTCASES are taken from Makefile.inc
-include Makefile.inc
+# this list is in numerical order
+TESTCASES = test1 test2 test3 test4 test5 test6 test7 test8 test9       \
+test10 test11 test12 test13 test14 test15 test16 test17 test18 test19   \
+test20 test21 test22 test23 test24 test25 test26 test27 test28 test29   \
+test30 test31 test32 test33 test34 test35 test36 test37 test38 test39   \
+test40 test41 test42 test43 test44 test45 test46 test47 test48 test49   \
+test50 test51 test52 test53 test54 test55 test56 test57 test58 test59   \
+test60 test61 test62 test63 test64 test65 test66 test67 test68 test69   \
+test70 test71 test72 test73 test74 test75 test76 test77 test78 test79   \
+test80 test81 test82 test83 test84 test85 test86 test87 test88 test89   \
+test90 test91 test92 test93 test94 test95 test96 test97 test98 test99   \
+test100 test101 test102 test103 test104 test105 test106 test107 test108 \
+test109 test110 test111 test112 test113 test114 test115 test116 test117 \
+test118 test119 test120 test121 test122 test123 test124 test125 test126 \
+test127 test128 test129 test130 test131 test132 test133 test134 test135 \
+test136 test137 test138 test139 test140 test141 test142 test143 test144 \
+test145 test146 test147 test148 test149 test150 test151 test152 test153 \
+test154 test155 test156 test157 test158 test159 test160 test161 test162 \
+test163 test164 test165 test166 test167 test168 test169 test170 test171 \
+test172 test173 test174 test175 test176 test177 test178 test179 test180 \
+test181 test182 test183 test184 test185 test186 test187 test188 test189 \
+test190 test191 test192 test193 test194 test195 test196 test197 test198 \
+test199 test200 test201 test202 test203 test204 test205 test206 test207 \
+test208 test209 test210 test211 test212 test213 test214 test215 test216 \
+test217 test218 test219 test220 test221 test222 test223 test224 test225 \
+test226 test227 test228 test229 test230 test231 test232 test233 test234 \
+test235 test236 test237 test238 test239 test240 test241 test242 test243 \
+test244 test245 test246 test247 test248 test249 test250 test251 test252 \
+test253 test254 test255 test256 test257 test258 test259 test260 test261 \
+test262 test263 test264 test265 test266 test267 test268 test269 test270 \
+test271 test272 test273 test274 test275 test276 test277 test278 test279 \
+test280 test281 test282 test283 test284 test285 test286 test287 test288 \
+test289 test290 test291 test292 test293 test294 test295 test296 test297 \
+test298 test299 test300 test301 test302 test303 test304 test305 test306 \
+test307 test308 test309 test310 test311 test312 test313 test314 test315 \
+test316 test317 test318 test319 test320 test321 test322 test323 test324 \
+test325 test326 test327 test328 test329 test330 test331 test332 test333 \
+test334 test335 test336 test337 test338 test339 test340 test341 test342 \
+test343 test344 test345 test346 test347 test348 test349 test350 test351 \
+test352 test353 test354 test355 test356 test357 test358 test359 test360 \
+test361 test362 test363 test364 test365 test366 test367 test368 test369 \
+test370 test371 test372 test373 test374 test375 test376 test378 test379 \
+test380 test381 test383 test384 test385 test386 test387 test388 test389 \
+test390 test391 test392 test393 test394 test395 test396 test397 test398 \
+test399 test400 test401 test402 test403 test404 test405 test406 test407 \
+test408         test410 test411 test412 test413 test414 test415 test416 \
+test417 test418 test419 test420 test421 test422 test423 test424 test425 \
+test426 test427 test428 test429 test430 test431 test432 test433 test434 \
+test435 test436 test437 test438 test439 test440 test441 test442 test443 \
+test444 test445 test446 test447 test448 test449 test450 test451 test452 \
+test453 test454 test455 test456 test457 test458 test459 test460 test461 \
+test462 test463 test467 test468 test469 test470 test471 test472 test473 \
+test474 test475 test476 test477 test478 test479 test480 test481 test482 \
+test483 test484 test485 test486 test487 test488 test489 test490 test491 \
+test492 test493 test494 test495 test496 test497 test498 test499 test500 \
+test501 test502 test503 test504 test505 test506 test507 test508 test509 \
+test510 test511 test512 test513 test514 test515 test516 test517 test518 \
+test519 test520 test521 test522 test523 test524 test525 test526 test527 \
+test528 test529 test530 test531 test532 test533 test534 test535 test536 \
+test537 test538 test539 test540 test541 test542 test543 test544 test545 \
+test546 test547 test548 test549 test550 test551 test552 test553 test554 \
+test555 test556 test557 test558 test559 test560 test561 test562 test563 \
+test564 test565 test566 test567 test568 test569 test570 test571 test572 \
+test573 test574 test575 test576 test577 test578 test579 test580 test581 \
+test582 test583 test584 test585 test586 test587 test588 test589 test590 \
+test591 test592 test593 test594 test595 test596 test597 test598 test599 \
+test600 test601 test602 test603 test604 test605 test606 test607 test608 \
+test609 test610 test611 test612 test613 test614 test615 test616 test617 \
+test618 test619 test620 test621 test622 test623 test624 test625 test626 \
+test627 test628 test629 test630 test631 test632 test633 test634 test635 \
+test636 test637 test638 test639 test640 test641 test642 test643 test644 \
+test645 test646 test647 test648 test649 test650 test651 test652 test653 \
+test654 test655 test656 test658 test659 test660 test661 test662 test663 \
+test664 test665 test666 test667 test668 test669 test670 test671 test672 \
+test673 test674 test675 test676 test677 test678 test679 test680 test681 \
+test682 test683 test684 test685 test686 test687 test688 test689 test690 \
+test691 test692 test693 test694 test695 test696 test697 test698 test699 \
+test700 test701 test702 test703 test704 test705 test706 test707 test708 \
+test709 test710 test711 test712 test713 test714 test715 test716 test717 \
+test718 test719 test720 test721 test722 test723 test724 test725 test726 \
+test727 test728 test729 test730 test731 test732 test733 test734 test735 \
+test736 test737 test738 test739 test740 test741 test742 test743 test744 \
+test745 test746 test747 test748 test749 test750 test751 test752 test753 \
+test754 test755 test756 test757 test758 test759 test760 test761 test762 \
+test763 test764 test765 test766 test767 test768 test769 test770 test771 \
+test772 test773 test774 test775 test776 test777 test778 test779 test780 \
+test781 test782 test783 test784 test785 test786 test787 test788 test789 \
+test790 test791 test792 test793 test794 test795 test796 test797 test798 \
+test799 test800 test801 test802 test803 test804 test805 test806 test807 \
+test808 test809 test810 test811 test812 test813 test814 test815 test816 \
+test817 test818 test819 test820 test821 test822 test823 test824 test825 \
+test826 test827 test828 test829 test830 test831 test832 test833 test834 \
+test835 test836 test837 test838 test839 test840 test841 test842 test843 \
+test844 test845 test846 test847 test848 test849 test850 test851 test852 \
+test853 test854 test855 test856 test857 test858 test859 test860 test861 \
+test862 test863 test864 test865 test866 test867 test868 test869 test870 \
+test871 test872 test873 test874 test875 test876 test877 test878 test879 \
+test880 test881 test882 test883 test884 test885 test886 test887 test888 \
+test889 test890 test891 test892 test893 test894 test895 test896 test897 \
+test898 test899 test900 test901 test902 test903 test904 test905 test906 \
+test907 test908 test909 test910 test911 test912 test913 test914 test915 \
+test916 test917 test918 test919 test920 test921 test922 test923 test924 \
+test925 test926 test927 test928 test929 test930 test931 test932 test933 \
+test934 test935 test936 test937 test938 test939 test940 test941 test942 \
+test943 test944 test945 test946 test947 test948 test949 test950 test951 \
+test952 test953 test954 test955 test956 test957 test958 test959 test960 \
+test961 test962 test963 test964 test965 test966 test967 test968 test969 \
+test970 test971 test972 test973 test974 test975 test976 test977 test978 \
+test979 test980 test981 test982 test983 test984 test985 test986 test987 \
+test988 test989 test990 test991 test992 test993 test994 test995 test996 \
+test997 test998 test999 test1000 test1001 test1002 test1003 test1004    \
+test1005 test1006 test1007 test1008 test1009 test1010 test1011 test1012 \
+test1013 test1014 test1015 test1016 test1017 test1018 test1019 test1020 \
+test1021 test1022 test1023 test1024 test1025 test1026 test1027 test1028 \
+test1029 test1030 test1031 test1032 test1033 test1034 test1035 test1036 \
+test1037 test1038 test1039 test1040 test1041 test1042 test1043 test1044 \
+test1045 test1046 test1047 test1048 test1049 test1050 test1051 test1052 \
+test1053 test1054 test1055 test1056 test1057 test1058 test1059 test1060 \
+test1061 test1062 test1063 test1064 test1065 test1066 test1067 test1068 \
+test1069 test1070 test1071 test1072 test1073 test1074 test1075 test1076 \
+test1077 test1078 test1079 test1080 test1081 test1082 test1083 test1084 \
+test1085 test1086 test1087 test1088 test1089 test1090 test1091 test1092 \
+test1093 test1094 test1095 test1096 test1097 test1098 test1099 test1100 \
+test1101 test1102 test1103 test1104 test1105 test1106 test1107 test1108 \
+test1109 test1110 test1111 test1112 test1113 test1114 test1115 test1116 \
+test1117 test1118 test1119 test1120 test1121 test1122 test1123 test1124 \
+test1125 test1126 test1127 test1128 test1129 test1130 test1131 test1132 \
+test1133 test1134 test1135 test1136 test1137 test1138 test1139 test1140 \
+test1141 test1142 test1143 test1144 test1145 test1146 test1147 test1148 \
+test1149 test1150 test1151 test1152 test1153 test1154 test1155 test1156 \
+test1157 test1158 test1159 test1160 test1161 test1162 test1163 test1164 \
+test1165 test1166 test1167 test1168 test1169 test1170 test1171 test1172 \
+test1173 test1174 test1175 test1176 test1177 test1178 test1179 test1180 \
+test1181 test1182 test1183 test1184 test1185 test1186 test1187 test1188 \
+test1189 test1190 test1191 test1192 test1193 test1194 test1195 test1196 \
+test1197 test1198 test1199 test1200 test1201 test1202 test1203 test1204 \
+test1205 test1206 test1207 test1208 test1209 test1210 test1211 test1212 \
+test1213 test1214 test1215 test1216 test1217 test1218 test1219 test1220 \
+test1221 test1222 test1223 test1224 test1225 test1226 test1227 test1228 \
+test1229 test1230 test1231 test1232 test1233 test1234 test1235 test1236 \
+test1237 test1238 test1239 test1240 test1241 test1242 test1243 test1244 \
+test1245 test1246 test1247 test1248 test1249 test1250 test1251 test1252 \
+test1253 test1254 test1255 test1256 test1257 test1258 test1259 test1260 \
+test1261 test1262 test1263 test1264 test1265 test1266 test1267 test1268 \
+test1269 test1270 test1271 test1272 test1273 test1274 test1275 test1276 \
+test1277 test1278 test1279 test1280 test1281 test1282 test1283 test1284 \
+test1285 test1286 test1287 test1288 test1289 test1290 test1291 test1292 \
+test1293 test1294 test1295 test1296 test1297 test1298 test1299 test1300 \
+test1301 test1302 test1303 test1304 test1305 test1306 test1307 test1308 \
+test1309 test1310 test1311 test1312 test1313 test1314 test1315 test1316 \
+test1317 test1318 test1319 test1320 test1321 test1322 test1323 test1324 \
+test1325 test1326 test1327 test1328 test1329 test1330 test1331 test1332 \
+test1333 test1334 test1335 test1336 test1337 test1338 test1339 test1340 \
+test1341 test1342 test1343 test1344 test1345 test1346 test1347 test1348 \
+test1349 test1350 test1351 test1352 test1353 test1354 test1355 test1356 \
+test1357 test1358 test1359 test1360 test1361 test1362 test1363 test1364 \
+test1365 test1366 test1367 test1368 test1369 test1370 test1371 test1372 \
+test1373 test1374 test1375 test1376 test1377 test1378 test1379 test1380 \
+test1381 test1382 test1383 test1384 test1385 test1386 test1387 test1388 \
+test1389 test1390 test1391 test1392 test1393 test1394 test1395 test1396 \
+test1397 test1398 test1399 test1400 test1401 test1402 test1403 test1404 \
+test1405 test1406 test1407 test1408 test1409 test1410 test1411 test1412 \
+test1413 test1414 test1415 test1416 test1417 test1418 test1419 test1420 \
+test1421 test1422 test1423 test1424 test1425 test1426 test1427 test1428 \
+test1429 test1430 test1431 test1432 test1433 test1434 test1435 test1436 \
+test1437 test1438 test1439 test1440 test1441 test1442 test1443 test1444 \
+test1445 test1446 test1447 test1448 test1449 test1450 test1451 test1452 \
+test1453 test1454 test1455 test1456 test1457 test1458 test1459 test1460 \
+test1461 test1462 test1463 test1464 test1465 test1466 test1467 test1468 \
+test1469 test1470 test1471 test1472 test1473 test1474 test1475 test1476 \
+test1477 test1478 test1479 test1480 test1481 test1482 test1483 test1484 \
+test1485 test1486 test1487 test1488 test1489 test1490 test1491 test1492 \
+test1493 test1494 test1495 test1496 test1497 test1498 test1499 test1500 \
+test1501 test1502 test1503 test1504 test1505 test1506 test1507 test1508 \
+test1509 test1510 test1511 test1512 test1513 test1514 test1515 test1516 \
+test1517 test1518 test1519 test1520 test1521 test1522 test1523 test1524 \
+test1525 test1526 test1527 test1528 test1529 test1530 test1531 test1532 \
+test1533 test1534 test1535 test1536 test1537 test1538 test1539 test1540 \
+test1541 test1542 test1543 test1544 test1545 test1546 test1547 test1548 \
+test1549 test1550 test1551 test1552 test1553 test1554 test1555 test1556 \
+test1557 test1558 test1559 test1560 test1561 test1562 test1563 test1564 \
+test1565 test1566 test1567 test1568 test1569 test1570 test1571 test1572 \
+test1573 test1574 test1575 test1576 test1577 test1578 test1579 test1580 \
+test1581 test1582 test1583 test1584 test1585 test1586 test1587 test1588 \
+test1589 test1590 test1591 test1592 test1593 test1594 test1595 test1596 \
+test1597 test1598 test1599 test1600 test1601 test1602 test1603 test1604 \
+test1605 test1606 test1607 test1608          test1610 test1611 test1612 \
+test1613 test1614 test1615 test1616 test1617 test1618 test1619 test1620 \
+test1621 test1622 test1623 test1624 test1625 test1626 test1627 test1628 \
+test1629 test1630 test1631 test1632 test1633 test1634 test1635 test1636 \
+test1637 test1638 test1639 test1640 test1641 test1642 test1643 test1644 \
+test1645 test1646 test1647 test1648 test1649 test1650 test1651 test1652 \
+test1653 test1654 test1655 test1656 test1657 test1658 test1659 test1660 \
+test1661 test1662 test1663 test1664 test1665 test1666 test1667 test1668 \
+test1669 test1670 test1671 test1672 test1673 test1674 test1675 test1676 \
+test1677                   test1680 test1681 test1682 test1683 test1684 \
+test1685 test1686 \
+\
+test1700 test1701 test1702 test1703 test1704 test1705 test1706 test1707 \
+test1708 test1709 test1710 test1711 test1712 test1713 test1714 test1715 \
+test1720 test1721 test1722 test1723 test1724 test1725 \
+\
+test1800 test1801 test1802 test1847 test1848 test1849 test1850 test1851 \
+\
+test1900 test1901 test1902 test1903 test1904 test1905 test1906 test1907 \
+test1908 test1909 test1910 test1911 test1912 test1913 test1914 test1915 \
+test1916 test1917 test1918 test1919 test1920 test1921 test1922 \
+\
+test1933 test1934 test1935 test1936 test1937 test1938 test1939 test1940 \
+test1941 test1942 test1943 test1944 test1945 test1946 test1947 test1948 \
+test1955 test1956 test1957 test1958 test1959 test1960 test1964 test1965 \
+test1966 test1967                   test1970 test1971 test1972 test1973 \
+test1974 test1975 test1976 test1977 test1978 test1979 test1980 test1981 \
+test1982 test1983 test1984 \
+\
+test2000 test2001 test2002 test2003 test2004 test2005 test2006 test2007 \
+test2008 test2009 test2010 test2011 test2012 test2013 test2014 test2015 \
+\
+                                                               test2023 \
+test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \
+test2032 test2033 test2034 test2035 test2036 test2037 test2038 test2039 \
+test2040 test2041 test2042 test2043 test2044 test2045 test2046 test2047 \
+test2048 test2049 test2050 test2051 test2052 test2053 test2054 test2055 \
+test2056 test2057 test2058 test2059 test2060 test2061 test2062 test2063 \
+test2064 test2065 test2066 test2067 test2068 test2069 test2070 test2071 \
+test2072 test2073 test2074 test2075 test2076 test2077 test2078 test2079 \
+test2080 test2081 test2082 test2083 test2084 test2085 test2086 test2087 \
+test2088 test2089 test2090 test2091 test2092 \
+test2100 test2101 test2102 test2103 test2104 test2105 test2106 test2107 \
+test2108 \
+\
+test2200 test2201 test2202 test2203 test2204 test2205 test2206 test2207 \
+test2208 \
+\
+test2300 test2301 test2302 test2303 test2304 test2306 test2307 test2308 \
+test2309 test2310 test2311 \
+\
+test2400 test2401 test2402 test2403 test2404 test2405 test2406 test2407 \
+test2408 test2409 test2410 test2411 test2412 test2413 \
+\
+test2500 test2501 test2502 test2503 test2504 test2505 test2506 \
+\
+test2600 test2601 test2602 test2603 test2604 test2605 \
+\
+test2700 test2701 test2702 test2703 test2704 test2705 test2706 test2707 \
+test2708 test2709 test2710 test2711 test2712 test2713 test2714 test2715 \
+test2716 test2717 test2718 test2719 test2720 test2721 test2722 test2723 \
+\
+test3000 test3001 test3002 test3003 test3004 test3005 test3006 test3007 \
+test3008 test3009 test3010 test3011 test3012 test3013 test3014 test3015 \
+test3016 test3017 test3018 test3019 test3020 test3021 test3022 test3023 \
+test3024 test3025 test3026 test3027 test3028 test3029 test3030 test3031 \
+test3032 test3033 test3034 test3035 test3036 \
+\
+test3100 test3101 test3102 test3103 test3104 test3105 test3106 \
+\
+test3200 test3201 test3202 test3203 test3204 test3205 test3206 test3207 \
+test3208 test3209 test3210 test3211 test3212 test3213 test3214 test3215 \
+test3216 test3217 test3218 test3219 test3220 test3221 test3222 \
+\
+test3300 test3301 test3302 test3303 test3304 test3305 \
+\
+test3400 \
+test3401 \
+\
+test4000 test4001
 
-EXTRA_DIST = $(TESTCASES) DISABLED CMakeLists.txt
+EXTRA_DIST = $(TESTCASES) DISABLED data-xml1 data320.html \
+data1461.txt data1463.txt  \
+data1400.c data1401.c data1402.c data1403.c data1404.c data1405.c data1406.c \
+data1407.c data1420.c data1465.c data1481.c \
+data1705-1.md data1705-2.md data1705-3.md data1705-4.md data1705-stdout.1 \
+data1706-1.md data1706-2.md data1706-3.md data1706-4.md data1706-stdout.txt
diff --git a/third-party/curl/tests/data/Makefile.inc b/third-party/curl/tests/data/Makefile.inc
deleted file mode 100644
index 2ec4936ec1..0000000000
--- a/third-party/curl/tests/data/Makefile.inc
+++ /dev/null
@@ -1,261 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-# this list is in numerical order
-TESTCASES = test1 test2 test3 test4 test5 test6 test7 test8 test9       \
-test10 test11 test12 test13 test14 test15 test16 test17 test18 test19   \
-test20 test21 test22 test23 test24 test25 test26 test27 test28 test29   \
-test30 test31 test32 test33 test34 test35 test36 test37 test38 test39   \
-test40 test41 test42 test43 test44 test45 test46 test47 test48 test49   \
-test50 test51 test52 test53 test54 test55 test56 test57 test58 test59   \
-test60 test61 test62 test63 test64 test65 test66 test67 test68 test69   \
-test70 test71 test72 test73 test74 test75 test76 test77 test78 test79   \
-test80 test81 test82 test83 test84 test85 test86 test87 test88 test89   \
-test90 test91 test92 test93 test94 test95 test96 test97 test98 test99   \
-test100 test101 test102 test103 test104 test105 test106 test107 test108 \
-test109 test110 test111 test112 test113 test114 test115 test116 test117 \
-test118 test119 test120 test121 test122 test123 test124 test125 test126 \
-test127 test128 test129 test130 test131 test132 test133 test134 test135 \
-test136 test137 test138 test139 test140 test141 test142 test143 test144 \
-test145 test146 test147 test148 test149 test150 test151 test152 test153 \
-test154 test155 test156 test157 test158 test159 test160 test161 test162 \
-test163 test164 test165 test166 test167 test168 test169 test170 test171 \
-test172 test173 test174 test175 test176 test177 test178 test179 test180 \
-test181 test182 test183 test184 test185 test186 test187 test188 test189 \
-test190 test191 test192 test193 test194 test195 test196 test197 test198 \
-test199 test200 test201 test202 test203 test204 test205 test206 test207 \
-test208 test209 test210 test211 test212 test213 test214 test215 test216 \
-test217 test218 test219 test220 test221 test222 test223 test224 test225 \
-test226 test227 test228 test229 test230 test231 test232 test233 test234 \
-test235 test236 test237 test238 test239 test240 test241 test242 test243 \
-test244 test245 test246 test247 test248 test249 test250 test251 test252 \
-test253 test254 test255 test256 test257 test258 test259 test260 test261 \
-test262 test263 test264 test265 test266 test267 test269 test270 \
-test271 test272 test273 test274 test275 test276 test277 test278 test279 \
-test280 test281 test282 test283 test284 test285 test286 test287 test288 \
-test289 test290 test291 test292 test293 test294 test295 test296 test297 \
-test298 test299 test300 test301 test302 test303 test304 test305 test306 \
-test307 test308 test309 test310 test311 test312 test313 test314 test315 \
-test316 test317 test318 test319 test320 test321 test322 test323 test324 \
-test325 test326 test327 test328 test329 test330 test331 test332 test333 \
-test334 test335 test336 test337 test338 test339 test340 test341 test342 \
-test343 test344 test345 test346 test347 test348 test349 test350 test351 \
-test352 test353 test354 test355 test356 test357 test358 test359 test360 \
-test361 test362 test363 test364 test365 test366 test367 test368 test369 \
-test370 test371 test372 test373 test374 test375 test376 test378 test379 \
-test380 test381 test383 test384 test385 test386 test387 test388 test389 \
-test390 test391 test392 test393 test394 test395 test396 test397 test398 \
-test399 test400 test401 test402 test403 test404 test405 test406 test407 \
-test408 test409 test410 test411 test412 test413 test414 test415 test416 \
-test417 test418 test419 test420 test421 test422 test423 test424 test425 \
-test426 test427 test428 test429 test430 test431 test432 test433 test434 \
-test435 test436 test437 test438 test439 \
-\
-test440 test441 test442 test443 test444 test445 test446 test447 test448 \
-test449 test450 test451 test452 test453 test454 test455 test456 \
-\
-test490 test491 test492 test493 test494 test495 test496 test497 \
-\
-test500 test501 test502 test503 test504 test505 test506 test507 test508 \
-test509 test510 test511 test512 test513 test514 test515 test516 test517 \
-test518 test519 test520 test521 test522 test523 test524 test525 test526 \
-test527 test528 test529 test530 test531 test532 test533 test534 test535 \
-        test537 test538 test539 test540 test541 test542 test543 test544 \
-test545 test546 test547 test548 test549 test550 test551 test552 test553 \
-test554 test555 test556 test557 test558 test559 test560 test561 test562 \
-test563 test564 test565 test566 test567 test568 test569 test570 test571 \
-test572 test573 test574 test575 test576 test577 test578 test579 test580 \
-test581 test582 test583 test584 test585 test586 test587 test588 test589 \
-test590 test591 test592 test593 test594 test595 test596 test597 test598 \
-test599 test600 test601 test602 test603 test604 test605 test606 test607 \
-test608 test609 test610 test611 test612 test613 test614 test615 test616 \
-test617 test618 test619 test620 test621 test622 test623 test624 test625 \
-test626 test627 test628 test629 test630 test631 test632 test633 test634 \
-test635 test636 test637 test638 test639 test640 test641 test642 test643 \
-test644 test645 test646 test647 test648 test649 test650 test651 test652 \
-test653 test654 test655 test656 test658 test659 test660 test661 test662 \
-test663 test664 test665 test666 test667 test668 test669 test670 test671 \
-test672 test673 test674 test675 test676 test677 test678 test679 test680 \
-test681 test682 test683 test684 test685 test686 test687 test688 \
-\
-test700 test701 test702 test703 test704 test705 test706 test707 test708 \
-test709 test710 test711 test712 test713 test714 test715 test716 test717 \
-test718 test719 test720 test721 \
-\
-test799 test800 test801 test802 test803 test804 test805 test806 test807 \
-test808 test809 test810 test811 test812 test813 test814 test815 test816 \
-test817 test818 test819 test820 test821 test822 test823 test824 test825 \
-test826 test827 test828 test829 test830 test831 test832 test833 test834 \
-test835 test836 test837 test838 test839 test840 test841 test842 test843 \
-test844 test845 test846 test847 test848 test849 test850 test851 test852 \
-test853 test854 test855 test856 test857 test858 test859 test860 test861 \
-test862 test863 test864 test865 test866 test867 test868 test869 test870 \
-test871 test872 test873 test874 test875 test876 test877 test878 test879 \
-test880 test881 test882 test883 test884 test885 test886 test887 test888 \
-test889 test890 test891 test892 test893 test894 test895 test896 test897 \
-test898 test899 test900 test901 test902 test903 test904 test905 test906 \
-test907 test908 test909 test910 test911 test912 test913 test914 test915 \
-test916 test917 test918 test919 test920 test921 test922 test923 test924 \
-test925 test926 test927 test928 test929 test930 test931 test932 test933 \
-test934 test935 test936 test937 test938 test939 test940 test941 test942 \
-test943 test944 test945 test946 test947 test948 test949 test950 test951 \
-test952 test953 test954 test955 test956 test957 test958 test959 test960 \
-test961 test962 test963 test964 test965 test966 test967 test968 test969 \
-test970 test971 test972 test973 test974 test975 test976 test977 test978 \
-test979 test980 test981 test982 test983 test984 test985 test986 test987 \
-test988 test989 test990 test991 \
-\
-test1000 test1001 test1002 test1003 test1004 test1005 test1006 test1007 \
-test1008 test1009 test1010 test1011 test1012 test1013 test1014 test1015 \
-test1016 test1017 test1018 test1019 test1020 test1021 test1022 test1023 \
-test1024 test1025 test1026 test1027 test1028 test1029 test1030 test1031 \
-test1032 test1033 test1034 test1035 test1036 test1037 test1038 test1039 \
-test1040 test1041 test1042 test1043 test1044 test1045 test1046 test1047 \
-test1048 test1049 test1050 test1051 test1052 test1053 test1054 test1055 \
-test1056 test1057 test1058 test1059 test1060 test1061 test1062 test1063 \
-test1064 test1065 test1066 test1067 test1068 test1069 test1070 test1071 \
-test1072 test1073 test1074 test1075 test1076 test1077 test1078 test1079 \
-test1080 test1081 test1082 test1083 test1084 test1085 test1086 test1087 \
-test1088 test1089 test1090 test1091 test1092 test1093 test1094 test1095 \
-test1096 test1097 test1098 test1099 test1100 test1101 test1102 test1103 \
-test1104 test1105 test1106 test1107 test1108 test1109 test1110 test1111 \
-test1112 test1113 test1114 test1115 test1116 test1117 test1118 test1119 \
-test1120 test1121 test1122 test1123 test1124 test1125 test1126 test1127 \
-test1128 test1129 test1130 test1131 test1132 test1133 test1134 test1135 \
-test1136 test1137 test1138 test1139 test1140 test1141 test1142 test1143 \
-test1144 test1145 test1146 test1147 test1148 test1149 test1150 test1151 \
-test1152 test1153 test1154 test1155 test1156 test1157 test1158 test1159 \
-test1160 test1161 test1162 test1163 test1164 test1165 test1166 test1167 \
-test1168 test1169 test1170 test1171 test1172 test1173 test1174 test1175 \
-test1176 test1177 test1178 test1179 test1180 test1181 test1182 test1183 \
-test1184 test1185 test1186 test1187 test1188 test1189 test1190 test1190 \
-test1191 test1192 test1193 test1194 test1195 test1196 test1197 test1198 \
-test1199 test1200 test1201 test1202 test1203 test1204 test1205 test1206 \
-test1207 test1208 test1209 test1210 test1211 test1212 test1213 test1214 \
-test1215 test1216 test1217 test1218 test1219 test1220 test1221 test1222 \
-test1223 test1224 test1225 test1226 test1227 test1228 test1229 test1230 \
-test1231 test1232 test1233 test1234 test1235 test1236 test1237 test1238 \
-test1239 test1240 test1241 test1242 test1243 test1244 test1245 test1246 \
-test1247 test1248 test1249 test1250 test1251 test1252 test1253 test1254 \
-test1255 test1256 test1257 test1258 test1259 test1260 test1261 test1262 \
-test1263 test1264 test1265 test1266 test1267 test1268 test1269 test1270 \
-test1271 test1272 test1273 test1274 test1275 test1276 test1277 test1278 \
-test1279 test1280 test1281 test1282 test1283 test1284 test1285 test1286 \
-test1287 test1288 test1289 test1290 test1291 test1292 test1293 test1294 \
-test1295 test1296 test1297 test1298 test1299 test1300 test1301 test1302 \
-test1303 test1304 test1305 test1306 test1307 test1308 test1309 test1310 \
-test1311 test1312 test1313 test1314 test1315 test1316 test1317 test1318 \
-test1319 test1320 test1321 test1322 test1323 test1324 test1325 test1326 \
-test1327 test1328 test1329 test1330 test1331 test1332 test1333 test1334 \
-test1335 test1336 test1337 test1338 test1339 test1340 test1341 test1342 \
-test1343 test1344 test1345 test1346 test1347 test1348 test1349 test1350 \
-test1351 test1352 test1353 test1354 test1355 test1356 test1357 test1358 \
-test1359 test1360 test1361 test1362 test1363 test1364 test1365 test1366 \
-test1367 test1368 test1369 test1370 test1371 test1372 test1373 test1374 \
-test1375 test1376 test1377 test1378 test1379 test1380 test1381 test1382 \
-test1383 test1384 test1385 test1386 test1387 test1388 test1389 test1390 \
-test1391 test1392 test1393 test1394 test1395 test1396 test1397 test1398 \
-test1399 test1400 test1401 test1402 test1403 test1404 test1405 test1406 \
-test1407 test1408 test1409 test1410 test1411 test1412 test1413 test1414 \
-test1415 test1416 test1417 test1418 test1419 test1420 test1421 test1422 \
-test1423 test1424 test1425 test1426 test1427 test1428 test1429 test1430 \
-test1431 test1432 test1433 test1434 test1435 test1436 test1437 test1438 \
-test1439 test1440 test1441 test1442 test1443 test1444 test1445 test1446 \
-test1447 test1448 test1449 test1450 test1451 test1452 test1453 test1454 \
-test1455 test1456 test1457 test1458 test1459 test1460 test1461 test1462 \
-test1463 test1464 test1465 test1466 test1467 test1468 test1469 test1470 \
-test1471 test1472 test1473 test1474 \
-\
-test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1507 \
-test1508 test1509 test1510 test1511 test1512 test1513 test1514 test1515 \
-test1516 test1517 test1518 test1519 test1520 test1521 test1522 test1523 \
-test1524 test1525 test1526 test1527 test1528 test1529 test1530 test1531 \
-test1532 test1533 test1534 test1535 test1536 test1537 test1538 test1539 \
-test1540          test1542 test1543 test1544 \
-\
-test1550 test1551 test1552 test1553 test1554 test1555 test1556 test1557 \
-test1558 test1559 test1560 test1561 test1562 test1563 test1564 test1565 \
-test1566 test1567 test1568 test1569 test1570 \
-\
-test1590 test1591 test1592 test1593 test1594 test1595 test1596 test1597 \
-\
-test1600 test1601 test1602 test1603 test1604 test1605 test1606 test1607 \
-test1608 test1609 test1610 test1611 test1612 test1613 test1614 \
-\
-test1620 test1621 \
-\
-test1630 test1631 test1632 test1633 test1634 test1635 \
-\
-test1650 test1651 test1652 test1653 test1654 test1655 \
-test1660 test1661 test1662 \
-\
-test1670 test1671 \
-\
-test1680 test1681 test1682 test1683 \
-\
-test1700 test1701 test1702 test1703 \
-\
-test1800 test1801 \
-\
-                           test1903 test1904 test1905 test1906 test1907 \
-test1908 test1909 test1910 test1911 test1912 test1913 test1914 test1915 \
-test1916 test1917 test1918 test1919 \
-\
-test1933 test1934 test1935 test1936 test1937 test1938 test1939 test1940 \
-test1941 test1942 test1943 test1944 test1945 test1946 test1947 test1948 \
-test1955 test1956 test1957 test1958 test1959 test1960 test1964 \
-test1970 test1971 test1972 test1973 test1974 test1975 \
-\
-test2000 test2001 test2002 test2003 test2004 \
-\
-                                                               test2023 \
-test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \
-test2032 test2033 test2034 test2035 test2036 test2037 test2038 test2039 \
-test2040 test2041 test2042 test2043 test2044 test2045 test2046 test2047 \
-test2048 test2049 test2050 test2051 test2052 test2053 test2054 test2055 \
-test2056 test2057 test2058 test2059 test2060 test2061 test2062 test2063 \
-test2064 test2065 test2066 test2067 test2068 test2069 test2070 test2071 \
-test2072 test2073 test2074 test2075 test2076 test2077 test2078 test2079 \
-test2080 test2081 test2082 test2083 test2084 test2085 test2086 test2087 \
-\
-test2100 \
-\
-test2200 test2201 test2202 test2203 test2204 test2205 \
-\
-test2300 test2301 test2302 test2303 test2304 test2305 test2306 \
-\
-test2400 test2401 test2402 test2403 test2404 \
-\
-test2500 test2501 test2502 test2503 \
-\
-test2600 test2601 test2602 test2603 \
-\
-test3000 test3001 test3002 test3003 test3004 test3005 test3006 test3007 \
-test3008 test3009 test3010 test3011 test3012 test3013 test3014 test3015 \
-test3016 test3017 test3018 test3019 test3020 test3021 test3022 test3023 \
-test3024 test3025 test3026 test3027 test3028 test3029 test3030 \
-\
-test3100 test3101 test3102 \
-test3200 \
-test3201 test3202
diff --git a/third-party/curl/tests/data/data-xml1 b/third-party/curl/tests/data/data-xml1
new file mode 100644
index 0000000000..76d8a4afd4
--- /dev/null
+++ b/third-party/curl/tests/data/data-xml1
@@ -0,0 +1,112 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE project-listing SYSTEM "http://freshmeat.net/backend/fm-projects-0.4.dtd">
+<project-listing>
+  <project>
+    <project_id>1612</project_id>
+    <date_added>1998-08-21 04:01:29</date_added>
+    <date_updated>2004-10-18 02:22:23</date_updated>
+    <projectname_short>curl</projectname_short>
+    <projectname_full>curl and libcurl</projectname_full>
+    <desc_short>Command line tool and library for client-side URL transfers.</desc_short>
+    <desc_full>curl and libcurl is a tool for transferring files%CR
+using URL syntax. It supports HTTP, HTTPS, FTP,%CR
+FTPS, DICT, TELNET, LDAP, FILE, and GOPHER, as%CR
+well as HTTP-post, HTTP-put, cookies, FTP upload,%CR
+resumed transfers, passwords, portnumbers, SSL%CR
+certificates, Kerberos, and proxies. It is powered%CR
+by libcurl, the client-side URL transfer library.%CR
+There are bindings to libcurl for over 20%CR
+languages and environments.%CR
+</desc_full>
+    <vitality_score>5784.57</vitality_score>
+    <vitality_percent>3.16</vitality_percent>
+    <vitality_rank>169</vitality_rank>
+    <popularity_score>6594.54</popularity_score>
+    <popularity_percent>13.81</popularity_percent>
+    <popularity_rank>105</popularity_rank>
+    <rating>8.50</rating>
+    <rating_count>21</rating_count>
+    <rating_rank>183</rating_rank>
+    <subscriptions>323</subscriptions>
+    <branch_name>Default</branch_name>
+    <url_project_page>http://freshmeat.net/projects/curl/</url_project_page>
+    <url_homepage>http://freshmeat.net/redir/curl/1612/url_homepage/</url_homepage>
+    <url_tgz>http://freshmeat.net/redir/curl/1612/url_tgz/</url_tgz>
+    <url_bz2>http://freshmeat.net/redir/curl/1612/url_bz2/</url_bz2>
+    <url_zip>http://freshmeat.net/redir/curl/1612/url_zip/</url_zip>
+    <url_changelog>http://freshmeat.net/redir/curl/1612/url_changelog/</url_changelog>
+    <url_rpm>http://freshmeat.net/redir/curl/1612/url_rpm/</url_rpm>
+    <url_deb>http://freshmeat.net/redir/curl/1612/url_deb/</url_deb>
+    <url_osx>http://freshmeat.net/redir/curl/1612/url_osx/</url_osx>
+    <url_bsdport>http://freshmeat.net/redir/curl/1612/url_bsdport/</url_bsdport>
+    <url_purchase></url_purchase>
+    <url_cvs>http://freshmeat.net/redir/curl/1612/url_cvs/</url_cvs>
+    <url_list>http://freshmeat.net/redir/curl/1612/url_list/</url_list>
+    <url_mirror>http://freshmeat.net/redir/curl/1612/url_mirror/</url_mirror>
+    <url_demo></url_demo>
+    <license>MIT/X Consortium License</license>
+    <latest_release>
+      <latest_release_version>7.12.2</latest_release_version>
+      <latest_release_id>176085</latest_release_id>
+      <latest_release_date>2004-10-18 02:22:23</latest_release_date>
+    </latest_release>
+    <screenshot_thumb></screenshot_thumb>
+    <authors>
+      <author>
+        <author_name>Daniel Stenberg</author_name>
+        <author_url>http://freshmeat.net/~bagder/</author_url>
+        <author_role>Owner</author_role>
+      </author>
+    </authors>
+    <descriminators>
+      <trove_id>12</trove_id>
+      <trove_id>226</trove_id>
+      <trove_id>3</trove_id>
+      <trove_id>2</trove_id>
+      <trove_id>188</trove_id>
+      <trove_id>216</trove_id>
+      <trove_id>200</trove_id>
+      <trove_id>220</trove_id>
+      <trove_id>164</trove_id>
+      <trove_id>90</trove_id>
+      <trove_id>89</trove_id>
+      <trove_id>809</trove_id>
+      <trove_id>150</trove_id>
+      <trove_id>224</trove_id>
+      <trove_id>900</trove_id>
+      <trove_id>839</trove_id>
+    </descriminators>
+    <dependencies>
+      <dependency type="recommended">
+        <dependency_release_id>0</dependency_release_id>
+        <dependency_branch_id>7464</dependency_branch_id>
+        <dependency_project_id>7464</dependency_project_id>
+        <dependency_project_title>OpenSSL (Default)</dependency_project_title>
+      </dependency>
+      <dependency type="optional">
+        <dependency_release_id>0</dependency_release_id>
+        <dependency_branch_id>0</dependency_branch_id>
+        <dependency_project_id>7443</dependency_project_id>
+        <dependency_project_title>OpenLDAP</dependency_project_title>
+      </dependency>
+      <dependency type="optional">
+        <dependency_release_id>0</dependency_release_id>
+        <dependency_branch_id>0</dependency_branch_id>
+        <dependency_project_id>12351</dependency_project_id>
+        <dependency_project_title>zlib</dependency_project_title>
+      </dependency>
+      <dependency type="optional">
+        <dependency_release_id>0</dependency_release_id>
+        <dependency_branch_id>0</dependency_branch_id>
+        <dependency_project_id>32047</dependency_project_id>
+        <dependency_project_title>Heimdal</dependency_project_title>
+      </dependency>
+      <dependency type="optional">
+        <dependency_release_id>0</dependency_release_id>
+        <dependency_branch_id>0</dependency_branch_id>
+        <dependency_project_id>44532</dependency_project_id>
+        <dependency_project_title>c-ares</dependency_project_title>
+      </dependency>
+    </dependencies>
+  </project>
+</project-listing>
diff --git a/third-party/curl/tests/data/data1400.c b/third-party/curl/tests/data/data1400.c
new file mode 100644
index 0000000000..c42b51577e
--- /dev/null
+++ b/third-party/curl/tests/data/data1400.c
@@ -0,0 +1,46 @@
+/********* Sample code generated by the curl command line tool **********
+ * All curl_easy_setopt() options are documented at:
+ * https://curl.se/libcurl/c/curl_easy_setopt.html
+ ************************************************************************/
+#include <curl/curl.h>
+
+int main(int argc, char *argv[])
+{
+  CURLcode result;
+  CURL *curl;
+
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "curl/%VERSION");
+  curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 50L);
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+
+  /* Here is a list of options the curl code used that cannot get generated
+     as source easily. You may choose to either not use them or implement
+     them yourself.
+
+  CURLOPT_DEBUGFUNCTION was set to a function pointer
+  CURLOPT_DEBUGDATA was set to an object pointer
+  CURLOPT_WRITEDATA was set to an object pointer
+  CURLOPT_WRITEFUNCTION was set to a function pointer
+  CURLOPT_READDATA was set to an object pointer
+  CURLOPT_READFUNCTION was set to a function pointer
+  CURLOPT_SEEKDATA was set to an object pointer
+  CURLOPT_SEEKFUNCTION was set to a function pointer
+  CURLOPT_HEADERFUNCTION was set to a function pointer
+  CURLOPT_HEADERDATA was set to an object pointer
+  CURLOPT_ERRORBUFFER was set to an object pointer
+  CURLOPT_STDERR was set to an object pointer
+
+  */
+
+  result = curl_easy_perform(curl);
+
+  curl_easy_cleanup(curl);
+  curl = NULL;
+
+  return (int)result;
+}
+/**** End of sample code ****/
diff --git a/third-party/curl/tests/data/data1401.c b/third-party/curl/tests/data/data1401.c
new file mode 100644
index 0000000000..1a87aa0164
--- /dev/null
+++ b/third-party/curl/tests/data/data1401.c
@@ -0,0 +1,58 @@
+/********* Sample code generated by the curl command line tool **********
+ * All curl_easy_setopt() options are documented at:
+ * https://curl.se/libcurl/c/curl_easy_setopt.html
+ ************************************************************************/
+#include <curl/curl.h>
+
+int main(int argc, char *argv[])
+{
+  CURLcode result;
+  CURL *curl;
+  struct curl_slist *slist1;
+
+  slist1 = NULL;
+  slist1 = curl_slist_append(slist1, "X-Files: Mulder");
+  slist1 = curl_slist_append(slist1, "X-Men: cyclops, iceman");
+
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
+  curl_easy_setopt(curl, CURLOPT_USERPWD, "fake:user");
+  curl_easy_setopt(curl, CURLOPT_HTTPAUTH, (long)CURLAUTH_BASIC);
+  curl_easy_setopt(curl, CURLOPT_HTTPHEADER, slist1);
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "MyUA");
+  curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 50L);
+  curl_easy_setopt(curl, CURLOPT_COOKIE, "chocolate=chip");
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+  curl_easy_setopt(curl, CURLOPT_PROTOCOLS_STR, "file,ftp,http");
+
+  /* Here is a list of options the curl code used that cannot get generated
+     as source easily. You may choose to either not use them or implement
+     them yourself.
+
+  CURLOPT_DEBUGFUNCTION was set to a function pointer
+  CURLOPT_DEBUGDATA was set to an object pointer
+  CURLOPT_WRITEDATA was set to an object pointer
+  CURLOPT_WRITEFUNCTION was set to a function pointer
+  CURLOPT_READDATA was set to an object pointer
+  CURLOPT_READFUNCTION was set to a function pointer
+  CURLOPT_SEEKDATA was set to an object pointer
+  CURLOPT_SEEKFUNCTION was set to a function pointer
+  CURLOPT_HEADERFUNCTION was set to a function pointer
+  CURLOPT_HEADERDATA was set to an object pointer
+  CURLOPT_ERRORBUFFER was set to an object pointer
+  CURLOPT_STDERR was set to an object pointer
+
+  */
+
+  result = curl_easy_perform(curl);
+
+  curl_easy_cleanup(curl);
+  curl = NULL;
+  curl_slist_free_all(slist1);
+  slist1 = NULL;
+
+  return (int)result;
+}
+/**** End of sample code ****/
diff --git a/third-party/curl/tests/data/data1402.c b/third-party/curl/tests/data/data1402.c
new file mode 100644
index 0000000000..682345485d
--- /dev/null
+++ b/third-party/curl/tests/data/data1402.c
@@ -0,0 +1,48 @@
+/********* Sample code generated by the curl command line tool **********
+ * All curl_easy_setopt() options are documented at:
+ * https://curl.se/libcurl/c/curl_easy_setopt.html
+ ************************************************************************/
+#include <curl/curl.h>
+
+int main(int argc, char *argv[])
+{
+  CURLcode result;
+  CURL *curl;
+
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
+  curl_easy_setopt(curl, CURLOPT_POSTFIELDS, "foo=bar&baz=quux");
+  curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE_LARGE, (curl_off_t)16);
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "curl/%VERSION");
+  curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 50L);
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+
+  /* Here is a list of options the curl code used that cannot get generated
+     as source easily. You may choose to either not use them or implement
+     them yourself.
+
+  CURLOPT_DEBUGFUNCTION was set to a function pointer
+  CURLOPT_DEBUGDATA was set to an object pointer
+  CURLOPT_WRITEDATA was set to an object pointer
+  CURLOPT_WRITEFUNCTION was set to a function pointer
+  CURLOPT_READDATA was set to an object pointer
+  CURLOPT_READFUNCTION was set to a function pointer
+  CURLOPT_SEEKDATA was set to an object pointer
+  CURLOPT_SEEKFUNCTION was set to a function pointer
+  CURLOPT_HEADERFUNCTION was set to a function pointer
+  CURLOPT_HEADERDATA was set to an object pointer
+  CURLOPT_ERRORBUFFER was set to an object pointer
+  CURLOPT_STDERR was set to an object pointer
+
+  */
+
+  result = curl_easy_perform(curl);
+
+  curl_easy_cleanup(curl);
+  curl = NULL;
+
+  return (int)result;
+}
+/**** End of sample code ****/
diff --git a/third-party/curl/tests/data/data1403.c b/third-party/curl/tests/data/data1403.c
new file mode 100644
index 0000000000..6d1522be0f
--- /dev/null
+++ b/third-party/curl/tests/data/data1403.c
@@ -0,0 +1,46 @@
+/********* Sample code generated by the curl command line tool **********
+ * All curl_easy_setopt() options are documented at:
+ * https://curl.se/libcurl/c/curl_easy_setopt.html
+ ************************************************************************/
+#include <curl/curl.h>
+
+int main(int argc, char *argv[])
+{
+  CURLcode result;
+  CURL *curl;
+
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER\?foo=bar&baz=quux");
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "curl/%VERSION");
+  curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 50L);
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+
+  /* Here is a list of options the curl code used that cannot get generated
+     as source easily. You may choose to either not use them or implement
+     them yourself.
+
+  CURLOPT_DEBUGFUNCTION was set to a function pointer
+  CURLOPT_DEBUGDATA was set to an object pointer
+  CURLOPT_WRITEDATA was set to an object pointer
+  CURLOPT_WRITEFUNCTION was set to a function pointer
+  CURLOPT_READDATA was set to an object pointer
+  CURLOPT_READFUNCTION was set to a function pointer
+  CURLOPT_SEEKDATA was set to an object pointer
+  CURLOPT_SEEKFUNCTION was set to a function pointer
+  CURLOPT_HEADERFUNCTION was set to a function pointer
+  CURLOPT_HEADERDATA was set to an object pointer
+  CURLOPT_ERRORBUFFER was set to an object pointer
+  CURLOPT_STDERR was set to an object pointer
+
+  */
+
+  result = curl_easy_perform(curl);
+
+  curl_easy_cleanup(curl);
+  curl = NULL;
+
+  return (int)result;
+}
+/**** End of sample code ****/
diff --git a/third-party/curl/tests/data/data1404.c b/third-party/curl/tests/data/data1404.c
new file mode 100644
index 0000000000..df9364d104
--- /dev/null
+++ b/third-party/curl/tests/data/data1404.c
@@ -0,0 +1,83 @@
+/********* Sample code generated by the curl command line tool **********
+ * All curl_easy_setopt() options are documented at:
+ * https://curl.se/libcurl/c/curl_easy_setopt.html
+ ************************************************************************/
+#include <curl/curl.h>
+
+int main(int argc, char *argv[])
+{
+  CURLcode result;
+  CURL *curl;
+  curl_mime *mime1;
+  curl_mimepart *part1;
+  curl_mime *mime2;
+  curl_mimepart *part2;
+  struct curl_slist *slist1;
+
+  mime1 = NULL;
+  mime2 = NULL;
+  slist1 = NULL;
+  slist1 = curl_slist_append(slist1, "X-testheader-1: header 1");
+  slist1 = curl_slist_append(slist1, "X-testheader-2: header 2");
+
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
+  mime1 = curl_mime_init(curl);
+  part1 = curl_mime_addpart(mime1);
+  curl_mime_data(part1, "value", CURL_ZERO_TERMINATED);
+  curl_mime_name(part1, "name");
+  part1 = curl_mime_addpart(mime1);
+  mime2 = curl_mime_init(curl);
+  part2 = curl_mime_addpart(mime2);
+  curl_mime_filedata(part2, "%LOGDIR/test%TESTNUMBER.txt");
+  part2 = curl_mime_addpart(mime2);
+  curl_mime_filedata(part2, "%LOGDIR/test%TESTNUMBER.txt");
+  curl_mime_encoder(part2, "8bit");
+  curl_mime_type(part2, "magic/content");
+  part2 = curl_mime_addpart(mime2);
+  curl_mime_filedata(part2, "%LOGDIR/test%TESTNUMBER.txt");
+  curl_mime_headers(part2, slist1, 1);
+  slist1 = NULL;
+  curl_mime_subparts(part1, mime2);
+  mime2 = NULL;
+  curl_mime_name(part1, "file");
+  curl_easy_setopt(curl, CURLOPT_MIMEPOST, mime1);
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "curl/%VERSION");
+  curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 50L);
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+
+  /* Here is a list of options the curl code used that cannot get generated
+     as source easily. You may choose to either not use them or implement
+     them yourself.
+
+  CURLOPT_DEBUGFUNCTION was set to a function pointer
+  CURLOPT_DEBUGDATA was set to an object pointer
+  CURLOPT_WRITEDATA was set to an object pointer
+  CURLOPT_WRITEFUNCTION was set to a function pointer
+  CURLOPT_READDATA was set to an object pointer
+  CURLOPT_READFUNCTION was set to a function pointer
+  CURLOPT_SEEKDATA was set to an object pointer
+  CURLOPT_SEEKFUNCTION was set to a function pointer
+  CURLOPT_HEADERFUNCTION was set to a function pointer
+  CURLOPT_HEADERDATA was set to an object pointer
+  CURLOPT_ERRORBUFFER was set to an object pointer
+  CURLOPT_STDERR was set to an object pointer
+
+  */
+
+  result = curl_easy_perform(curl);
+
+  curl_easy_cleanup(curl);
+  curl = NULL;
+  curl_mime_free(mime1);
+  mime1 = NULL;
+  curl_mime_free(mime2);
+  mime2 = NULL;
+  curl_slist_free_all(slist1);
+  slist1 = NULL;
+
+  return (int)result;
+}
+/**** End of sample code ****/
diff --git a/third-party/curl/tests/data/data1405.c b/third-party/curl/tests/data/data1405.c
new file mode 100644
index 0000000000..ec7a4a39c9
--- /dev/null
+++ b/third-party/curl/tests/data/data1405.c
@@ -0,0 +1,66 @@
+/********* Sample code generated by the curl command line tool **********
+ * All curl_easy_setopt() options are documented at:
+ * https://curl.se/libcurl/c/curl_easy_setopt.html
+ ************************************************************************/
+#include <curl/curl.h>
+
+int main(int argc, char *argv[])
+{
+  CURLcode result;
+  CURL *curl;
+  struct curl_slist *slist1;
+  struct curl_slist *slist2;
+  struct curl_slist *slist3;
+
+  slist1 = NULL;
+  slist1 = curl_slist_append(slist1, "NOOP 1");
+  slist1 = curl_slist_append(slist1, "*FAIL");
+  slist2 = NULL;
+  slist2 = curl_slist_append(slist2, "NOOP 3");
+  slist3 = NULL;
+  slist3 = curl_slist_append(slist3, "NOOP 2");
+  slist3 = curl_slist_append(slist3, "*FAIL HARD");
+
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "ftp://%HOSTIP:%FTPPORT/%TESTNUMBER");
+  curl_easy_setopt(curl, CURLOPT_FTP_SKIP_PASV_IP, 1L);
+  curl_easy_setopt(curl, CURLOPT_QUOTE, slist1);
+  curl_easy_setopt(curl, CURLOPT_POSTQUOTE, slist2);
+  curl_easy_setopt(curl, CURLOPT_PREQUOTE, slist3);
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+
+  /* Here is a list of options the curl code used that cannot get generated
+     as source easily. You may choose to either not use them or implement
+     them yourself.
+
+  CURLOPT_DEBUGFUNCTION was set to a function pointer
+  CURLOPT_DEBUGDATA was set to an object pointer
+  CURLOPT_WRITEDATA was set to an object pointer
+  CURLOPT_WRITEFUNCTION was set to a function pointer
+  CURLOPT_READDATA was set to an object pointer
+  CURLOPT_READFUNCTION was set to a function pointer
+  CURLOPT_SEEKDATA was set to an object pointer
+  CURLOPT_SEEKFUNCTION was set to a function pointer
+  CURLOPT_HEADERFUNCTION was set to a function pointer
+  CURLOPT_HEADERDATA was set to an object pointer
+  CURLOPT_ERRORBUFFER was set to an object pointer
+  CURLOPT_STDERR was set to an object pointer
+
+  */
+
+  result = curl_easy_perform(curl);
+
+  curl_easy_cleanup(curl);
+  curl = NULL;
+  curl_slist_free_all(slist1);
+  slist1 = NULL;
+  curl_slist_free_all(slist2);
+  slist2 = NULL;
+  curl_slist_free_all(slist3);
+  slist3 = NULL;
+
+  return (int)result;
+}
+/**** End of sample code ****/
diff --git a/third-party/curl/tests/data/data1406.c b/third-party/curl/tests/data/data1406.c
new file mode 100644
index 0000000000..30aff8d588
--- /dev/null
+++ b/third-party/curl/tests/data/data1406.c
@@ -0,0 +1,56 @@
+/********* Sample code generated by the curl command line tool **********
+ * All curl_easy_setopt() options are documented at:
+ * https://curl.se/libcurl/c/curl_easy_setopt.html
+ ************************************************************************/
+#include <curl/curl.h>
+
+int main(int argc, char *argv[])
+{
+  CURLcode result;
+  CURL *curl;
+  struct curl_slist *slist1;
+
+  slist1 = NULL;
+  slist1 = curl_slist_append(slist1, "recipient.one@example.com");
+  slist1 = curl_slist_append(slist1, "recipient.two@example.com");
+
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER");
+  curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "curl/%VERSION");
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+  curl_easy_setopt(curl, CURLOPT_MAIL_FROM, "sender@example.com");
+  curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, slist1);
+  curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, (curl_off_t)38);
+
+  /* Here is a list of options the curl code used that cannot get generated
+     as source easily. You may choose to either not use them or implement
+     them yourself.
+
+  CURLOPT_DEBUGFUNCTION was set to a function pointer
+  CURLOPT_DEBUGDATA was set to an object pointer
+  CURLOPT_WRITEDATA was set to an object pointer
+  CURLOPT_WRITEFUNCTION was set to a function pointer
+  CURLOPT_READDATA was set to an object pointer
+  CURLOPT_READFUNCTION was set to a function pointer
+  CURLOPT_SEEKDATA was set to an object pointer
+  CURLOPT_SEEKFUNCTION was set to a function pointer
+  CURLOPT_HEADERFUNCTION was set to a function pointer
+  CURLOPT_HEADERDATA was set to an object pointer
+  CURLOPT_ERRORBUFFER was set to an object pointer
+  CURLOPT_STDERR was set to an object pointer
+
+  */
+
+  result = curl_easy_perform(curl);
+
+  curl_easy_cleanup(curl);
+  curl = NULL;
+  curl_slist_free_all(slist1);
+  slist1 = NULL;
+
+  return (int)result;
+}
+/**** End of sample code ****/
diff --git a/third-party/curl/tests/data/data1407.c b/third-party/curl/tests/data/data1407.c
new file mode 100644
index 0000000000..4f34db3655
--- /dev/null
+++ b/third-party/curl/tests/data/data1407.c
@@ -0,0 +1,46 @@
+/********* Sample code generated by the curl command line tool **********
+ * All curl_easy_setopt() options are documented at:
+ * https://curl.se/libcurl/c/curl_easy_setopt.html
+ ************************************************************************/
+#include <curl/curl.h>
+
+int main(int argc, char *argv[])
+{
+  CURLcode result;
+  CURL *curl;
+
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "pop3://%HOSTIP:%POP3PORT/%TESTNUMBER");
+  curl_easy_setopt(curl, CURLOPT_DIRLISTONLY, 1L);
+  curl_easy_setopt(curl, CURLOPT_USERPWD, "user:secret");
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+
+  /* Here is a list of options the curl code used that cannot get generated
+     as source easily. You may choose to either not use them or implement
+     them yourself.
+
+  CURLOPT_DEBUGFUNCTION was set to a function pointer
+  CURLOPT_DEBUGDATA was set to an object pointer
+  CURLOPT_WRITEDATA was set to an object pointer
+  CURLOPT_WRITEFUNCTION was set to a function pointer
+  CURLOPT_READDATA was set to an object pointer
+  CURLOPT_READFUNCTION was set to a function pointer
+  CURLOPT_SEEKDATA was set to an object pointer
+  CURLOPT_SEEKFUNCTION was set to a function pointer
+  CURLOPT_HEADERFUNCTION was set to a function pointer
+  CURLOPT_HEADERDATA was set to an object pointer
+  CURLOPT_ERRORBUFFER was set to an object pointer
+  CURLOPT_STDERR was set to an object pointer
+
+  */
+
+  result = curl_easy_perform(curl);
+
+  curl_easy_cleanup(curl);
+  curl = NULL;
+
+  return (int)result;
+}
+/**** End of sample code ****/
diff --git a/third-party/curl/tests/data/data1420.c b/third-party/curl/tests/data/data1420.c
new file mode 100644
index 0000000000..5e70aafd6e
--- /dev/null
+++ b/third-party/curl/tests/data/data1420.c
@@ -0,0 +1,46 @@
+/********* Sample code generated by the curl command line tool **********
+ * All curl_easy_setopt() options are documented at:
+ * https://curl.se/libcurl/c/curl_easy_setopt.html
+ ************************************************************************/
+#include <curl/curl.h>
+
+int main(int argc, char *argv[])
+{
+  CURLcode result;
+  CURL *curl;
+
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1");
+  curl_easy_setopt(curl, CURLOPT_USERPWD, "user:secret");
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "curl/%VERSION");
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+
+  /* Here is a list of options the curl code used that cannot get generated
+     as source easily. You may choose to either not use them or implement
+     them yourself.
+
+  CURLOPT_DEBUGFUNCTION was set to a function pointer
+  CURLOPT_DEBUGDATA was set to an object pointer
+  CURLOPT_WRITEDATA was set to an object pointer
+  CURLOPT_WRITEFUNCTION was set to a function pointer
+  CURLOPT_READDATA was set to an object pointer
+  CURLOPT_READFUNCTION was set to a function pointer
+  CURLOPT_SEEKDATA was set to an object pointer
+  CURLOPT_SEEKFUNCTION was set to a function pointer
+  CURLOPT_HEADERFUNCTION was set to a function pointer
+  CURLOPT_HEADERDATA was set to an object pointer
+  CURLOPT_ERRORBUFFER was set to an object pointer
+  CURLOPT_STDERR was set to an object pointer
+
+  */
+
+  result = curl_easy_perform(curl);
+
+  curl_easy_cleanup(curl);
+  curl = NULL;
+
+  return (int)result;
+}
+/**** End of sample code ****/
diff --git a/third-party/curl/tests/data/data1461.txt b/third-party/curl/tests/data/data1461.txt
new file mode 100644
index 0000000000..286be7c344
--- /dev/null
+++ b/third-party/curl/tests/data/data1461.txt
@@ -0,0 +1,23 @@
+Usage: curl [options...] <url>
+ -d, --data <data>            HTTP POST data
+ -f, --fail                   Fail fast with no output on HTTP errors
+ -I, --head                   Show document info only
+ -H, --header <header/@file>  Pass custom header(s) to server
+ -h, --help <subject>         Get help for commands
+ -o, --output <file>          Write to file instead of stdout
+ -O, --remote-name            Write output to file named as remote file
+ -i, --show-headers           Show response headers in output
+ -s, --silent                 Silent mode
+ -T, --upload-file <file>     Transfer local FILE to destination
+ -u, --user <user:password>   Server user and password
+ -A, --user-agent <name>      Send User-Agent <name> to server
+ -v, --verbose                Make the operation more talkative
+ -V, --version                Show version number and quit
+
+This is not the full help; this menu is split into categories.
+Use "--help category" to get an overview of all categories, which are:
+auth, connection, curl, deprecated, dns, file, ftp, global, http, imap, ldap,%SP
+output, pop3, post, proxy, scp, sftp, smtp, ssh, telnet, tftp, timeout, tls,%SP
+upload, verbose.
+Use "--help all" to list all options
+Use "--help [option]" to view documentation for a given option
diff --git a/third-party/curl/tests/data/data1463.txt b/third-party/curl/tests/data/data1463.txt
new file mode 100644
index 0000000000..830377fc0d
--- /dev/null
+++ b/third-party/curl/tests/data/data1463.txt
@@ -0,0 +1,5 @@
+file: FILE protocol
+     --create-file-mode <mode>  File mode for created files
+ -I, --head                     Show document info only
+ -l, --list-only                List only mode
+ -r, --range <range>            Retrieve only the bytes within RANGE
diff --git a/third-party/curl/tests/data/data1465.c b/third-party/curl/tests/data/data1465.c
new file mode 100644
index 0000000000..dea3b61988
--- /dev/null
+++ b/third-party/curl/tests/data/data1465.c
@@ -0,0 +1,48 @@
+/********* Sample code generated by the curl command line tool **********
+ * All curl_easy_setopt() options are documented at:
+ * https://curl.se/libcurl/c/curl_easy_setopt.html
+ ************************************************************************/
+#include <curl/curl.h>
+
+int main(int argc, char *argv[])
+{
+  CURLcode result;
+  CURL *curl;
+
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
+  curl_easy_setopt(curl, CURLOPT_POSTFIELDS, "ab\201cd\000e\\\"\?\r\n\t\001fghi\x1ajklm\xfd");
+  curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE_LARGE, (curl_off_t)24);
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "curl/%VERSION");
+  curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 50L);
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+
+  /* Here is a list of options the curl code used that cannot get generated
+     as source easily. You may choose to either not use them or implement
+     them yourself.
+
+  CURLOPT_DEBUGFUNCTION was set to a function pointer
+  CURLOPT_DEBUGDATA was set to an object pointer
+  CURLOPT_WRITEDATA was set to an object pointer
+  CURLOPT_WRITEFUNCTION was set to a function pointer
+  CURLOPT_READDATA was set to an object pointer
+  CURLOPT_READFUNCTION was set to a function pointer
+  CURLOPT_SEEKDATA was set to an object pointer
+  CURLOPT_SEEKFUNCTION was set to a function pointer
+  CURLOPT_HEADERFUNCTION was set to a function pointer
+  CURLOPT_HEADERDATA was set to an object pointer
+  CURLOPT_ERRORBUFFER was set to an object pointer
+  CURLOPT_STDERR was set to an object pointer
+
+  */
+
+  result = curl_easy_perform(curl);
+
+  curl_easy_cleanup(curl);
+  curl = NULL;
+
+  return (int)result;
+}
+/**** End of sample code ****/
diff --git a/third-party/curl/tests/data/data1481.c b/third-party/curl/tests/data/data1481.c
new file mode 100644
index 0000000000..e7d468e698
--- /dev/null
+++ b/third-party/curl/tests/data/data1481.c
@@ -0,0 +1,49 @@
+/********* Sample code generated by the curl command line tool **********
+ * All curl_easy_setopt() options are documented at:
+ * https://curl.se/libcurl/c/curl_easy_setopt.html
+ ************************************************************************/
+#include <curl/curl.h>
+
+int main(int argc, char *argv[])
+{
+  CURLcode result;
+  CURL *curl;
+
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "http://moo/");
+  curl_easy_setopt(curl, CURLOPT_PROXY, "http://%HOSTIP:%HTTPPORT");
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "curl/%VERSION");
+  curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 50L);
+  curl_easy_setopt(curl, CURLOPT_SSLVERSION, (long)(CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_TLSv1_3));
+  curl_easy_setopt(curl, CURLOPT_PROXY_SSLVERSION, (long)CURL_SSLVERSION_TLSv1);
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+
+  /* Here is a list of options the curl code used that cannot get generated
+     as source easily. You may choose to either not use them or implement
+     them yourself.
+
+  CURLOPT_DEBUGFUNCTION was set to a function pointer
+  CURLOPT_DEBUGDATA was set to an object pointer
+  CURLOPT_WRITEDATA was set to an object pointer
+  CURLOPT_WRITEFUNCTION was set to a function pointer
+  CURLOPT_READDATA was set to an object pointer
+  CURLOPT_READFUNCTION was set to a function pointer
+  CURLOPT_SEEKDATA was set to an object pointer
+  CURLOPT_SEEKFUNCTION was set to a function pointer
+  CURLOPT_HEADERFUNCTION was set to a function pointer
+  CURLOPT_HEADERDATA was set to an object pointer
+  CURLOPT_ERRORBUFFER was set to an object pointer
+  CURLOPT_STDERR was set to an object pointer
+
+  */
+
+  result = curl_easy_perform(curl);
+
+  curl_easy_cleanup(curl);
+  curl = NULL;
+
+  return (int)result;
+}
+/**** End of sample code ****/
diff --git a/third-party/curl/tests/data/data1705-1.md b/third-party/curl/tests/data/data1705-1.md
new file mode 100644
index 0000000000..3e06c1b38f
--- /dev/null
+++ b/third-party/curl/tests/data/data1705-1.md
@@ -0,0 +1,11 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# DESCRIPTION
+
+**curl** is a tool for transferring data from or to a server using URLs. It
+supports these protocols: DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS,
+IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, RTMP, RTMPS, RTSP, SCP, SFTP,
+SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS.
+
+curl is powered by libcurl for all transfer-related features. See
+*libcurl(3)* for details.
diff --git a/third-party/curl/tests/data/data1705-2.md b/third-party/curl/tests/data/data1705-2.md
new file mode 100644
index 0000000000..812862a952
--- /dev/null
+++ b/third-party/curl/tests/data/data1705-2.md
@@ -0,0 +1,40 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Short: v
+Long: fakeitreal
+Mutexed: trace trace-ascii
+Help: Make the operation more talkative
+Category: important verbose global
+Added: 4.0
+Multi: boolean
+Scope: global
+See-also:
+  - include
+  - silent
+  - trace
+  - trace-ascii
+Example:
+  - --fakeitreal $URL
+---
+
+# `--verbose`
+
+Makes curl verbose during the operation. Useful for debugging and seeing
+what's going on under the hood. A line starting with \> means header data sent
+by curl, \< means header data received by curl that is hidden in normal cases,
+and a line starting with * means additional info provided by curl.
+
+If you only want HTTP headers in the output, --include or --dump-header might
+be more suitable options.
+
+If you think this option still does not give you enough details, consider using
+--trace or --trace-ascii instead.
+
+Note that verbose output of curl activities and network traffic might contain
+sensitive data, including usernames, credentials or secret data content. Be
+aware and be careful when sharing trace logs with others.
+
+End with a quote
+
+    hello
diff --git a/third-party/curl/tests/data/data1705-3.md b/third-party/curl/tests/data/data1705-3.md
new file mode 100644
index 0000000000..5041962d40
--- /dev/null
+++ b/third-party/curl/tests/data/data1705-3.md
@@ -0,0 +1,48 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proto
+Arg: <protocols>
+Help: Enable/disable PROTOCOLS
+Added: 7.20.2
+Category: connection curl
+Multi: single
+See-also:
+  - fakeitreal
+  - proto-default
+Example:
+  - --proto =http,https,sftp $URL
+---
+
+# `--proto`
+
+Limit what protocols to allow for transfers. Protocols are evaluated left to
+right, are comma separated, and are each a protocol name or 'all', optionally
+prefixed by zero or more modifiers. Available modifiers are:
+
+## +
+Permit this protocol in addition to protocols already permitted (this is
+the default if no modifier is used).
+
+## -
+Deny this protocol, removing it from the list of protocols already permitted.
+
+## =
+Permit only this protocol (ignoring the list already permitted), though
+subject to later modification by subsequent entries in the comma separated
+list.
+
+##
+
+For example: --proto -ftps uses the default protocols, but disables ftps
+
+--proto -all,https,+http only enables http and https
+
+--proto =http,https also only enables http and https
+
+Unknown and disabled protocols produce a warning. This allows scripts to
+safely rely on being able to disable potentially dangerous protocols, without
+relying upon support for that protocol being built into curl to avoid an error.
+
+This option can be used multiple times, in which case the effect is the same
+as concatenating the protocols into one instance of the option.
diff --git a/third-party/curl/tests/data/data1705-4.md b/third-party/curl/tests/data/data1705-4.md
new file mode 100644
index 0000000000..297b56c4b6
--- /dev/null
+++ b/third-party/curl/tests/data/data1705-4.md
@@ -0,0 +1,22 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# PROXY PROTOCOL PREFIXES
+The proxy string may be specified with a protocol:// prefix to specify
+alternative proxy protocols. (Added in 7.21.7)
+
+If no protocol is specified in the proxy string or if the string does not
+match a supported one, the proxy is treated as an HTTP proxy.
+
+The supported proxy protocol prefixes are as follows:
+## http://
+Makes it use it as an HTTP proxy. The default if no scheme prefix is used.
+## https://
+Makes it treated as an **HTTPS** proxy.
+## socks4://
+Makes it the equivalent of --socks4
+## socks4a://
+Makes it the equivalent of --socks4a
+## socks5://
+Makes it the equivalent of --socks5
+## socks5h://
+Makes it the equivalent of --socks5-hostname
diff --git a/third-party/curl/tests/data/data1705-stdout.1 b/third-party/curl/tests/data/data1705-stdout.1
new file mode 100644
index 0000000000..f4439a21f1
--- /dev/null
+++ b/third-party/curl/tests/data/data1705-stdout.1
@@ -0,0 +1,126 @@
+.\" **************************************************************************
+.\" *                                  _   _ ____  _
+.\" *  Project                     ___| | | |  _ \| |
+.\" *                             / __| | | | |_) | |
+.\" *                            | (__| |_| |  _ <| |___
+.\" *                             \___|\___/|_| \_\_____|
+.\" *
+.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+.\" *
+.\" * This software is licensed as described in the file COPYING, which
+.\" * you should have received as part of this distribution. The terms
+.\" * are also available at https://curl.se/docs/copyright.html.
+.\" *
+.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+.\" * copies of the Software, and permit persons to whom the Software is
+.\" * furnished to do so, under the terms of the COPYING file.
+.\" *
+.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+.\" * KIND, either express or implied.
+.\" *
+.\" * SPDX-License-Identifier: curl
+.\" *
+.\" **************************************************************************
+.\"
+.\" DO NOT EDIT. Generated by the curl project managen man page generator.
+.\"
+.TH curl 1 "%DATE" "curl %VERNUM" "curl Manual"
+.SH DESCRIPTION
+\fBcurl\fP is a tool for transferring data from or to a server using URLs. It
+supports these protocols: DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS,
+IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, RTMP, RTMPS, RTSP, SCP, SFTP,
+SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS.
+
+curl is powered by libcurl for all transfer\-related features. See
+\fIlibcurl(3)\fP for details.
+.IP "\-v, \-\-fakeitreal"
+Makes curl verbose during the operation. Useful for debugging and seeing
+what\(aqs going on under the hood. A line starting with > means header data sent
+by curl, < means header data received by curl that is hidden in normal cases,
+and a line starting with * means additional info provided by curl.
+
+If you only want HTTP headers in the output, \fI\-\-include\fP or \fI\-\-dump\-header\fP might
+be more suitable options.
+
+If you think this option still does not give you enough details, consider using
+\fI\-\-trace\fP or \fI\-\-trace\-ascii\fP instead.
+
+Note that verbose output of curl activities and network traffic might contain
+sensitive data, including usernames, credentials or secret data content. Be
+aware and be careful when sharing trace logs with others.
+
+End with a quote
+
+.nf
+hello
+.fi
+
+This option is global and does not need to be specified for each use of \fI\-\-next\fP.
+
+Providing \fI\-\-fakeitreal\fP multiple times has no extra effect.
+Disable it again with \-\-no-fakeitreal.
+
+Example:
+.nf
+curl --fakeitreal https://example.com
+.fi
+
+This option is mutually exclusive with \fI\-\-trace\fP and \fI\-\-trace\-ascii\fP.
+See also \fI\-\-include\fP, \fI\-\-silent\fP, \fI\-\-trace\fP and \fI\-\-trace\-ascii\fP.
+.IP "\-\-proto <protocols>"
+Limit what protocols to allow for transfers. Protocols are evaluated left to
+right, are comma separated, and are each a protocol name or \(aqall\(aq, optionally
+prefixed by zero or more modifiers. Available modifiers are:
+.RS
+.IP +
+Permit this protocol in addition to protocols already permitted (this is
+the default if no modifier is used).
+.IP -
+Deny this protocol, removing it from the list of protocols already permitted.
+.IP =
+Permit only this protocol (ignoring the list already permitted), though
+subject to later modification by subsequent entries in the comma separated
+list.
+.RE
+.IP
+For example: \fI\-\-proto\fP \-ftps uses the default protocols, but disables ftps
+
+\fI\-\-proto\fP \-all,https,+http only enables http and https
+
+\fI\-\-proto\fP =http,https also only enables http and https
+
+Unknown and disabled protocols produce a warning. This allows scripts to
+safely rely on being able to disable potentially dangerous protocols, without
+relying upon support for that protocol being built into curl to avoid an error.
+
+This option can be used multiple times, in which case the effect is the same
+as concatenating the protocols into one instance of the option.
+
+If \fI\-\-proto\fP is provided several times, the last set value is used.
+
+Example:
+.nf
+curl --proto =http,https,sftp https://example.com
+.fi
+
+See also \fI\-\-fakeitreal\fP and \fI\-\-proto\-default\fP.
+.SH PROXY PROTOCOL PREFIXES
+The proxy string may be specified with a protocol:// prefix to specify
+alternative proxy protocols.
+
+If no protocol is specified in the proxy string or if the string does not
+match a supported one, the proxy is treated as an HTTP proxy.
+
+The supported proxy protocol prefixes are as follows:
+.IP http://
+Makes it use it as an HTTP proxy. The default if no scheme prefix is used.
+.IP https://
+Makes it treated as an \fBHTTPS\fP proxy.
+.IP socks4://
+Makes it the equivalent of \fI\-\-socks4\fP
+.IP socks4a://
+Makes it the equivalent of \fI\-\-socks4a\fP
+.IP socks5://
+Makes it the equivalent of \fI\-\-socks5\fP
+.IP socks5h://
+Makes it the equivalent of \fI\-\-socks5\-hostname\fP
diff --git a/third-party/curl/tests/data/data1706-1.md b/third-party/curl/tests/data/data1706-1.md
new file mode 100644
index 0000000000..3e06c1b38f
--- /dev/null
+++ b/third-party/curl/tests/data/data1706-1.md
@@ -0,0 +1,11 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# DESCRIPTION
+
+**curl** is a tool for transferring data from or to a server using URLs. It
+supports these protocols: DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS,
+IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, RTMP, RTMPS, RTSP, SCP, SFTP,
+SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS.
+
+curl is powered by libcurl for all transfer-related features. See
+*libcurl(3)* for details.
diff --git a/third-party/curl/tests/data/data1706-2.md b/third-party/curl/tests/data/data1706-2.md
new file mode 100644
index 0000000000..6665c5b21c
--- /dev/null
+++ b/third-party/curl/tests/data/data1706-2.md
@@ -0,0 +1,36 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Short: v
+Long: fakeitreal
+Mutexed: trace trace-ascii
+Help: Make the operation more talkative
+Category: important verbose global
+Added: 4.0
+Multi: boolean
+Scope: global
+See-also:
+  - include
+  - silent
+  - trace
+  - trace-ascii
+Example:
+  - --fakeitreal $URL
+---
+
+# `--verbose`
+
+Makes curl verbose during the operation. Useful for debugging and seeing
+what's going on under the hood. A line starting with \> means header data sent
+by curl, \< means header data received by curl that is hidden in normal cases,
+and a line starting with * means additional info provided by curl.
+
+If you only want HTTP headers in the output, --include or --dump-header might
+be more suitable options.
+
+If you think this option still does not give you enough details, consider using
+--trace or --trace-ascii instead.
+
+Note that verbose output of curl activities and network traffic might contain
+sensitive data, including usernames, credentials or secret data content. Be
+aware and be careful when sharing trace logs with others.
diff --git a/third-party/curl/tests/data/data1706-3.md b/third-party/curl/tests/data/data1706-3.md
new file mode 100644
index 0000000000..5041962d40
--- /dev/null
+++ b/third-party/curl/tests/data/data1706-3.md
@@ -0,0 +1,48 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proto
+Arg: <protocols>
+Help: Enable/disable PROTOCOLS
+Added: 7.20.2
+Category: connection curl
+Multi: single
+See-also:
+  - fakeitreal
+  - proto-default
+Example:
+  - --proto =http,https,sftp $URL
+---
+
+# `--proto`
+
+Limit what protocols to allow for transfers. Protocols are evaluated left to
+right, are comma separated, and are each a protocol name or 'all', optionally
+prefixed by zero or more modifiers. Available modifiers are:
+
+## +
+Permit this protocol in addition to protocols already permitted (this is
+the default if no modifier is used).
+
+## -
+Deny this protocol, removing it from the list of protocols already permitted.
+
+## =
+Permit only this protocol (ignoring the list already permitted), though
+subject to later modification by subsequent entries in the comma separated
+list.
+
+##
+
+For example: --proto -ftps uses the default protocols, but disables ftps
+
+--proto -all,https,+http only enables http and https
+
+--proto =http,https also only enables http and https
+
+Unknown and disabled protocols produce a warning. This allows scripts to
+safely rely on being able to disable potentially dangerous protocols, without
+relying upon support for that protocol being built into curl to avoid an error.
+
+This option can be used multiple times, in which case the effect is the same
+as concatenating the protocols into one instance of the option.
diff --git a/third-party/curl/tests/data/data1706-4.md b/third-party/curl/tests/data/data1706-4.md
new file mode 100644
index 0000000000..297b56c4b6
--- /dev/null
+++ b/third-party/curl/tests/data/data1706-4.md
@@ -0,0 +1,22 @@
+<!-- Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. -->
+<!-- SPDX-License-Identifier: curl -->
+# PROXY PROTOCOL PREFIXES
+The proxy string may be specified with a protocol:// prefix to specify
+alternative proxy protocols. (Added in 7.21.7)
+
+If no protocol is specified in the proxy string or if the string does not
+match a supported one, the proxy is treated as an HTTP proxy.
+
+The supported proxy protocol prefixes are as follows:
+## http://
+Makes it use it as an HTTP proxy. The default if no scheme prefix is used.
+## https://
+Makes it treated as an **HTTPS** proxy.
+## socks4://
+Makes it the equivalent of --socks4
+## socks4a://
+Makes it the equivalent of --socks4a
+## socks5://
+Makes it the equivalent of --socks5
+## socks5h://
+Makes it the equivalent of --socks5-hostname
diff --git a/third-party/curl/tests/data/data1706-stdout.txt b/third-party/curl/tests/data/data1706-stdout.txt
new file mode 100644
index 0000000000..b352864a8d
--- /dev/null
+++ b/third-party/curl/tests/data/data1706-stdout.txt
@@ -0,0 +1,116 @@
+DESCRIPTION
+
+    curl is a tool  for transferring data  from or to a  server using URLs.  It
+    supports these protocols:  DICT, FILE,  FTP, FTPS,  GOPHER, GOPHERS,  HTTP,
+    HTTPS, IMAP,  IMAPS, LDAP,  LDAPS, MQTT,  POP3, POP3S,  RTMP, RTMPS,  RTSP,
+    SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS.
+
+    curl  is  powered  by  libcurl  for  all  transfer-related  features.   See
+    libcurl(3) for details.
+
+    -v, --fakeitreal
+	    Makes curl verbose during the  operation. Useful for debugging  and
+	    seeing what's  going on  under the  hood. A  line  starting with  >
+	    means header data  sent by curl,  < means  header data received  by
+	    curl that is  hidden in normal  cases, and a  line starting with  *
+	    means additional info provided by curl.
+
+	    If  you  only  want  HTTP  headers  in  the  output,  --include  or
+	    --dump-header might be more suitable options.
+
+	    If you think this  option still does  not give you enough  details,
+	    consider using --trace or --trace-ascii instead.
+
+	    Note that verbose  output of  curl activities  and network  traffic
+	    might contain sensitive data,  including usernames, credentials  or
+	    secret data content.  Be aware  and be careful  when sharing  trace
+	    logs with others.
+
+	    This option is global  and does not need  to be specified for  each
+	    use of --next. Providing --fakeitreal  multiple times has no  extra
+	    effect. Disable it again with --no-fakeitreal.
+
+	    Example:
+	     curl --fakeitreal https://example.com
+
+	    This option is mutually  exclusive with --trace and  --trace-ascii.
+	    See also --include, --silent, --trace and --trace-ascii.
+
+    --proto <protocols>
+	    Limit  what  protocols  to  allow  for  transfers.  Protocols   are
+	    evaluated left  to  right, are  comma  separated, and  are  each  a
+	    protocol name  or  'all',  optionally  prefixed  by  zero  or  more
+	    modifiers. Available modifiers are:
+
+	    +
+
+		Permit  this  protocol   in  addition   to  protocols   already
+		permitted (this is the default if no modifier is used).
+
+	    -
+
+		Deny this  protocol, removing  it from  the list  of  protocols
+		already permitted.
+
+	    =
+
+		Permit  only   this  protocol   (ignoring  the   list   already
+		permitted), though subject to later modification by  subsequent
+		entries in the comma separated list.
+
+	    For  example:  --proto  -ftps  uses  the  default  protocols,   but
+	    disables ftps
+
+	    --proto -all,https,+http only enables http and https
+
+	    --proto =http,https also only enables http and https
+
+	    Unknown and  disabled  protocols  produce a  warning.  This  allows
+	    scripts to  safely  rely  on  being  able  to  disable  potentially
+	    dangerous  protocols,  without  relying   upon  support  for   that
+	    protocol being built into curl to avoid an error.
+
+	    This option can be  used multiple times,  in which case the  effect
+	    is the same  as concatenating  the protocols into  one instance  of
+	    the option.  If --proto  is provided  several times,  the last  set
+	    value is used.
+
+	    Example:
+	     curl --proto =http,https,sftp https://example.com
+
+	    See also --fakeitreal and --proto-default.
+
+PROXY PROTOCOL PREFIXES
+
+    The proxy  string may be  specified with  a protocol://  prefix to  specify
+    alternative proxy protocols.
+
+    If no protocol is specified in the  proxy string or if the string does  not
+    match a supported one, the proxy is treated as an HTTP proxy.
+
+    The supported proxy protocol prefixes are as follows:
+
+    http://
+
+	Makes it use it as  an HTTP proxy. The  default if no scheme prefix  is
+	used.
+
+    https://
+
+	Makes it treated as an HTTPS proxy.
+
+    socks4://
+
+	Makes it the equivalent of --socks4
+
+    socks4a://
+
+	Makes it the equivalent of --socks4a
+
+    socks5://
+
+	Makes it the equivalent of --socks5
+
+    socks5h://
+
+	Makes it the equivalent of --socks5-hostname
diff --git a/third-party/curl/tests/data/data320.html b/third-party/curl/tests/data/data320.html
new file mode 100644
index 0000000000..307bb87c47
--- /dev/null
+++ b/third-party/curl/tests/data/data320.html
@@ -0,0 +1,19 @@
+<HTML><BODY>
+<CENTER><H1>This is <a href="http://www.gnu.org/software/gnutls">GnuTLS</a></H1></CENTER>
+
+<p>Session ID: <i>003030000100000001000000000000000030330001000000B062410001000000</i></p>
+<h5>If your browser supports session resuming, then you should see the same session ID, when you press the <b>reload</b> button.</h5>
+<p>Connected as user 'jsmith'.</p>
+<P>
+<TABLE border=1><TR><TD>Protocol version:</TD><TD>TLS1.2</TD></TR>
+<TR><TD>Key Exchange:</TD><TD>SRP</TD></TR>
+<TR><TD>Compression</TD><TD>NULL</TD></TR>
+<TR><TD>Cipher</TD><TD>AES-NNN-CBC</TD></TR>
+<TR><TD>MAC</TD><TD>SHA1</TD></TR>
+<TR><TD>Ciphersuite</TD><TD>SRP_SHA_AES_NNN_CBC_SHA1</TD></TR></p></TABLE>
+<hr><P>Your HTTP header was:<PRE>Host: localhost:9011%CR
+User-Agent: curl-test-suite%CR
+Accept: */*%CR
+%CR
+</PRE></P>
+</BODY></HTML>
diff --git a/third-party/curl/tests/data/test1 b/third-party/curl/tests/data/test1
index 700bed8993..a6935ab56a 100644
--- a/third-party/curl/tests/data/test1
+++ b/third-party/curl/tests/data/test1
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes">
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -17,7 +17,7 @@ Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
 ETag: "21025-dc7-39462498"
 Accept-Ranges: bytes
 Content-Length: 6
-Connection: close
+Connection: something-close, close-something, close
 Content-Type: text/html
 Funny-head: yesyes
 
@@ -25,29 +25,31 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol crlf="yes">
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
+<limits>
+Allocations: 135
+Maximum allocated: 136000
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test10 b/third-party/curl/tests/data/test10
index be10db2d01..1ebe86d83d 100644
--- a/third-party/curl/tests/data/test10
+++ b/third-party/curl/tests/data/test10
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -22,10 +23,10 @@ blablabla
 <server>
 http
 </server>
- <name>
+<name>
 simple HTTP PUT from file
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -T %LOGDIR/test%TESTNUMBER.txt
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
@@ -43,7 +44,7 @@ the
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /we/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test100 b/third-party/curl/tests/data/test100
index fbeea397b2..a32a981af1 100644
--- a/third-party/curl/tests/data/test100
+++ b/third-party/curl/tests/data/test100
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,11 +7,8 @@ PASV
 LIST
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
 <data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
@@ -26,24 +24,22 @@ dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP dir list PASV
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/test-%TESTNUMBER/
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1000 b/third-party/curl/tests/data/test1000
index 6fc54b6e55..4d5441b9fa 100644
--- a/third-party/curl/tests/data/test1000
+++ b/third-party/curl/tests/data/test1000
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,31 +8,28 @@ LIST
 NOBODY
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <datacheck>
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP dir list PASV with -I
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER/ -I
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1001 b/third-party/curl/tests/data/test1001
index f291de75f7..c1f839670f 100644
--- a/third-party/curl/tests/data/test1001
+++ b/third-party/curl/tests/data/test1001
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -13,20 +14,20 @@ CUSTOMREQUEST
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 100 Continue
 Server: Microsoft-IIS/5.0
 Date: Sun, 03 Apr 2005 14:57:45 GMT
 X-Powered-By: ASP.NET
 
-HTTP/1.1 401 authentication please swsbounce
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144"
 Content-Type: text/html; charset=iso-8859-1
 Content-Length: 0
 
 </data>
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 A OK
 Server: Microsoft-IIS/6.0
 Content-Type: text/html; charset=iso-8859-1
@@ -35,13 +36,13 @@ Content-Length: 3
 ok
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 100 Continue
 Server: Microsoft-IIS/5.0
 Date: Sun, 03 Apr 2005 14:57:45 GMT
 X-Powered-By: ASP.NET
 
-HTTP/1.1 401 authentication please swsbounce
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144"
 Content-Type: text/html; charset=iso-8859-1
@@ -59,7 +60,6 @@ ok
 
 # Client-side
 <client>
-#
 <server>
 http
 </server>
@@ -67,11 +67,12 @@ http
 !SSPI
 crypto
 proxy
+digest
 </features>
- <name>
+<name>
 HTTP POST --digest with PUT and resumed upload and modified method
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u auser:apasswd --digest -T %LOGDIR/%TESTNUMBER -x  http://%HOSTIP:%HTTPPORT -C 2 -X GET
 </command>
 <file name="%LOGDIR/%TESTNUMBER">
@@ -81,7 +82,7 @@ test
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Content-Range: bytes 2-4/5
diff --git a/third-party/curl/tests/data/test1002 b/third-party/curl/tests/data/test1002
index 8e14f78e44..eb53aac58c 100644
--- a/third-party/curl/tests/data/test1002
+++ b/third-party/curl/tests/data/test1002
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,20 +13,20 @@ CUSTOMREQUEST
 </info>
 
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 100 Continue
 Server: Microsoft-IIS/5.0
 Date: Sun, 03 Apr 2005 14:57:45 GMT
 X-Powered-By: ASP.NET
 
-HTTP/1.1 401 authentication please swsbounce
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144"
 Content-Type: text/html; charset=iso-8859-1
 Content-Length: 0
 
 </data>
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 A OK
 Server: Microsoft-IIS/6.0
 Content-Type: text/html; charset=iso-8859-1
@@ -34,13 +35,13 @@ Content-Length: 3
 ok
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 100 Continue
 Server: Microsoft-IIS/5.0
 Date: Sun, 03 Apr 2005 14:57:45 GMT
 X-Powered-By: ASP.NET
 
-HTTP/1.1 401 authentication please swsbounce
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144"
 Content-Type: text/html; charset=iso-8859-1
@@ -58,7 +59,6 @@ ok
 
 # Client-side
 <client>
-#
 <server>
 http
 </server>
@@ -66,11 +66,12 @@ http
 !SSPI
 crypto
 proxy
+digest
 </features>
- <name>
+<name>
 HTTP PUT with Digest auth, resumed upload and modified method, twice
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER.upload1 -T %LOGDIR/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER.upload2 -T %LOGDIR/%TESTNUMBER -u auser:apasswd --digest -x  http://%HOSTIP:%HTTPPORT -C 2 -X GET
 </command>
 <file name="%LOGDIR/%TESTNUMBER">
@@ -80,7 +81,7 @@ test
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/%TESTNUMBER.upload1 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Content-Range: bytes 2-4/5
diff --git a/third-party/curl/tests/data/test1003 b/third-party/curl/tests/data/test1003
index 5a905914d0..0077ff89ab 100644
--- a/third-party/curl/tests/data/test1003
+++ b/third-party/curl/tests/data/test1003
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -14,7 +15,7 @@ mooo
 # a ~17000 bytes response string to CWD to make sure the ftp parser deals
 # with it nicely
 <servercmd>
-REPLY CWD 250 CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB
+REPLY CWD 250 C%repeat[16998 x A]%B
 </servercmd>
 </reply>
 
@@ -23,17 +24,17 @@ REPLY CWD 250 CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP with excessively large server command response line
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1004 b/third-party/curl/tests/data/test1004
index 6010eb8f60..c71f3d06f0 100644
--- a/third-party/curl/tests/data/test1004
+++ b/third-party/curl/tests/data/test1004
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP proxy
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -26,7 +26,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -35,26 +34,22 @@ proxy
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with empty proxy
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --proxy ""
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1005 b/third-party/curl/tests/data/test1005
index 3a37bd235b..f1ae118d5d 100644
--- a/third-party/curl/tests/data/test1005
+++ b/third-party/curl/tests/data/test1005
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -14,7 +15,7 @@ mooo
 # a long set of response strings to CWD to make sure the ftp parser deals
 # with it nicely
 <servercmd>
-REPLY CWD 250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250 Finally, here is the response
+REPLY CWD %repeat[226 x 250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n]%250 Finally, here is the response
 </servercmd>
 </reply>
 
@@ -23,17 +24,17 @@ REPLY CWD 250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP with excessively large number of server command response lines
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1006 b/third-party/curl/tests/data/test1006
index 1ba0d3141f..c4fd51f919 100644
--- a/third-party/curl/tests/data/test1006
+++ b/third-party/curl/tests/data/test1006
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -15,7 +16,7 @@ mooo
 # with it nicely. The length hits a boundary condition that may make curl
 # hang.
 <servercmd>
-REPLY CWD 250-AAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250 Finally, here is the response
+REPLY CWD 250-AAAAAAAAAAAAAAAAAAAAAAAAA\r\n%repeat[218 x 250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n]%250 Finally, here is the response
 </servercmd>
 </reply>
 
@@ -24,17 +25,17 @@ REPLY CWD 250-AAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 <server>
 ftp
 </server>
- <name>
-FTP with excessively large number of server command response lines (boundary condition)
- </name>
- <command>
+<name>
+FTP with large number of command response lines (boundary condition)
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1007 b/third-party/curl/tests/data/test1007
index e9f11c8b99..2706c049a5 100644
--- a/third-party/curl/tests/data/test1007
+++ b/third-party/curl/tests/data/test1007
@@ -1,22 +1,24 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 TFTP
 TFTP WRQ
-FAILURE
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 tftp
 </server>
- <name>
+<features>
+verbose-strings
+</features>
+<name>
 TFTP send with invalid permission on server
- </name>
- <command>
+</name>
+<command>
 -T %LOGDIR/test%TESTNUMBER.txt tftp://%HOSTIP:%TFTPPORT//invalid-file -sS
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
@@ -24,7 +26,6 @@ This data will not be sent
 </file>
 </client>
 
-#
 # Verify pseudo protocol after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test1008 b/third-party/curl/tests/data/test1008
index 6f2d592490..7381bd3f04 100644
--- a/third-party/curl/tests/data/test1008
+++ b/third-party/curl/tests/data/test1008
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -18,7 +19,7 @@ connection-monitor
 </servercmd>
 
 # this is returned first since we get no proxy-auth
-<connect1001>
+<connect1001 crlf="yes">
 HTTP/1.1 407 Authorization Required to proxy me my dear
 Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
 Transfer-Encoding: chunked
@@ -26,14 +27,14 @@ Transfer-Encoding: chunked
 20
 And you should ignore this data.
 FA0
-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+%repeat[4000 x X]%
 0
 
 </connect1001>
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<connect1002>
+<connect1002 crlf="headers">
 HTTP/1.1 200 Things are fine in proxy land
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -54,21 +55,21 @@ daniel
 
 # then this is returned when we get proxy-auth
 <data1000>
-HTTP/1.1 200 OK swsbounce
+HTTP/1.1 200 OK swsbounce%CR
 Server: no
-
+%CR
 Nice proxy auth sir!
 </data1000>
 
 <datacheck>
-HTTP/1.1 407 Authorization Required to proxy me my dear
-Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
-Transfer-Encoding: chunked
-
-HTTP/1.1 200 Things are fine in proxy land
-Server: Microsoft-IIS/5.0
-Content-Type: text/html; charset=iso-8859-1
-
+HTTP/1.1 407 Authorization Required to proxy me my dear%CR
+Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==%CR
+Transfer-Encoding: chunked%CR
+%CR
+HTTP/1.1 200 Things are fine in proxy land%CR
+Server: Microsoft-IIS/5.0%CR
+Content-Type: text/html; charset=iso-8859-1%CR
+%CR
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 7
@@ -101,10 +102,10 @@ http://test.remote.example.com.%TESTNUMBER:%HTTPPORT/path/%TESTNUMBER0002 --prox
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 CONNECT test.remote.example.com.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: test.remote.example.com.%TESTNUMBER:%HTTPPORT
-Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Proxy-Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
diff --git a/third-party/curl/tests/data/test1009 b/third-party/curl/tests/data/test1009
index 041d88198d..d6499bc65e 100644
--- a/third-party/curl/tests/data/test1009
+++ b/third-party/curl/tests/data/test1009
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ TFTP RRQ
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -18,21 +18,19 @@ returned
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 tftp
 </server>
- <name>
+<name>
 TFTP retrieve with --local-port
- </name>
- <command>
+</name>
+<command>
 tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER --local-port 44444-45444
 </command>
 </client>
 
-#
 # Verify pseudo protocol after the test has been "shot"
 <verify>
 <strip>
diff --git a/third-party/curl/tests/data/test101 b/third-party/curl/tests/data/test101
index 1914924707..406c73eb14 100644
--- a/third-party/curl/tests/data/test101
+++ b/third-party/curl/tests/data/test101
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,9 +9,7 @@ LIST
 </info>
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -22,7 +21,7 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
 # Client-side
@@ -30,10 +29,10 @@ dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP dir list, PORT with specified IP
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/ -P %CLIENTIP
 </command>
 </client>
@@ -45,7 +44,7 @@ ftp://%HOSTIP:%FTPPORT/ -P %CLIENTIP
 ^PORT \d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3}
 ^EPRT \|1\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|\d{1,5}\|
 </strip>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1010 b/third-party/curl/tests/data/test1010
index 4e2286e10d..ebde71b8aa 100644
--- a/third-party/curl/tests/data/test1010
+++ b/third-party/curl/tests/data/test1010
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,10 @@ PASV
 LIST
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -19,31 +18,29 @@ drwxr-xr-x   2 98       98           512 May  2  1996 .NeXT
 -r--r--r--   1 0        1             35 Jul 16  1996 README
 lrwxrwxrwx   1 0        1              7 Dec  9  1999 bin -> usr/bin
 dr-xr-xr-x   2 0        1            512 Oct  1  1997 dev
-drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
+drwxrwxrwx   2 98       98           512 May 29 16:04 downthis.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP dir list nocwd
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT//list/this/path/%TESTNUMBER/ ftp://%HOSTIP:%FTPPORT//list/this/path/%TESTNUMBER/ --ftp-method nocwd
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1011 b/third-party/curl/tests/data/test1011
index 99f239cd21..9b465fe65d 100644
--- a/third-party/curl/tests/data/test1011
+++ b/third-party/curl/tests/data/test1011
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,16 @@ HTTP POST
 followlocation
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 301 OK
-Location: moo.html&testcase=/%TESTNUMBER0002
+Location: moo.html%AMPtestcase=/%TESTNUMBER0002
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 0
 
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Location: this should be ignored
 Date: Tue, 09 Nov 2010 14:49:00 GMT
@@ -24,9 +24,9 @@ Connection: close
 
 body
 </data2>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 301 OK
-Location: moo.html&testcase=/%TESTNUMBER0002
+Location: moo.html%AMPtestcase=/%TESTNUMBER0002
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 0
 
@@ -39,24 +39,22 @@ body
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP POST with 301 redirect
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/blah/%TESTNUMBER -L -d "moo"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 POST /blah/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -64,7 +62,7 @@ Accept: */*
 Content-Length: 3
 Content-Type: application/x-www-form-urlencoded
 
-mooGET /blah/moo.html&testcase=/%TESTNUMBER0002 HTTP/1.1
+mooGET /blah/moo.html%AMPtestcase=/%TESTNUMBER0002 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test1012 b/third-party/curl/tests/data/test1012
index 21a7586244..5f14d14f5f 100644
--- a/third-party/curl/tests/data/test1012
+++ b/third-party/curl/tests/data/test1012
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,16 @@ HTTP POST
 followlocation
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 301 OK swsclose
-Location: moo.html&testcase=/%TESTNUMBER0002
+Location: moo.html%AMPtestcase=/%TESTNUMBER0002
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
 
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Location: this should be ignored
 Date: Tue, 09 Nov 2010 14:49:00 GMT
@@ -24,9 +24,9 @@ Connection: close
 
 body
 </data2>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 301 OK swsclose
-Location: moo.html&testcase=/%TESTNUMBER0002
+Location: moo.html%AMPtestcase=/%TESTNUMBER0002
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
 
@@ -39,24 +39,22 @@ body
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP POST with 301 redirect and --post301
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/blah/%TESTNUMBER -L -d "moo" --post301
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /blah/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -64,7 +62,7 @@ Accept: */*
 Content-Length: 3
 Content-Type: application/x-www-form-urlencoded
 
-mooPOST /blah/moo.html&testcase=/%TESTNUMBER0002 HTTP/1.1
+mooPOST /blah/moo.html%AMPtestcase=/%TESTNUMBER0002 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test1013 b/third-party/curl/tests/data/test1013
index 70c6455e30..871a571ba8 100644
--- a/third-party/curl/tests/data/test1013
+++ b/third-party/curl/tests/data/test1013
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,31 +6,25 @@ curl-config
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
- <name>
+<name>
 Compare curl --version with curl-config --protocols
- </name>
- <command>
+</name>
+<command>
 --version
 </command>
-<postcheck>
-%SRCDIR/libtest/test%TESTNUMBER.pl ../curl-config %LOGDIR/stdout%TESTNUMBER protocols
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
+<postcheck>
+%PERL %SRCDIR/libtest/test%TESTNUMBER.pl ../curl-config %LOGDIR/stdout%TESTNUMBER protocols
+</postcheck>
 <errorcode>
 0
 </errorcode>
diff --git a/third-party/curl/tests/data/test1014 b/third-party/curl/tests/data/test1014
index 8dc3f0421e..db6ee71e3f 100644
--- a/third-party/curl/tests/data/test1014
+++ b/third-party/curl/tests/data/test1014
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,31 +6,25 @@ curl-config
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
- <name>
+<name>
 Compare curl --version with curl-config --features
- </name>
- <command>
+</name>
+<command>
 --version
 </command>
-<postcheck>
-%SRCDIR/libtest/test1013.pl ../curl-config %LOGDIR/stdout%TESTNUMBER features
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
+<postcheck>
+%PERL %SRCDIR/libtest/test1013.pl ../curl-config %LOGDIR/stdout%TESTNUMBER features > %LOGDIR/result%TESTNUMBER
+</postcheck>
 <errorcode>
 0
 </errorcode>
diff --git a/third-party/curl/tests/data/test1015 b/third-party/curl/tests/data/test1015
index 573624d1a9..88efe9401b 100644
--- a/third-party/curl/tests/data/test1015
+++ b/third-party/curl/tests/data/test1015
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ HTTP POST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 I am cool swsclose
 Server: Cool server/10.0
 Content-Length: 0
@@ -18,27 +18,29 @@ Content-Length: 0
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 --data-urlencode
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER --data-urlencode "my name is moo[]" --data-urlencode "y e s=s_i_r" --data-urlencode "v_alue@%LOGDIR/%TESTNUMBER.txt" --data-urlencode @%LOGDIR/%TESTNUMBER.txt
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+--data-urlencode "my name is moo[]"
+--data-urlencode "y e s=s_i_r"
+--data-urlencode "v_alue@%LOGDIR/%TESTNUMBER.txt"
+--data-urlencode @%LOGDIR/%TESTNUMBER.txt
 </command>
 <file name="%LOGDIR/%TESTNUMBER.txt">
-content to _?!#$'|<>
+content to _?!#$'|%LT%GT
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -46,7 +48,7 @@ Accept: */*
 Content-Length: 119
 Content-Type: application/x-www-form-urlencoded
 
-my+name+is+moo%5B%5D&y e s=s_i_r&v_alue=content+to+_%3F%21%23%24%27%7C%3C%3E%0A&content+to+_%3F%21%23%24%27%7C%3C%3E%0A
+my+name+is+moo%5B%5D%AMPy e s=s_i_r%AMPv_alue=content+to+_%3F%21%23%24%27%7C%3C%3E%0A%AMPcontent+to+_%3F%21%23%24%27%7C%3C%3E%0A
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1016 b/third-party/curl/tests/data/test1016
index d37e585e05..347c330677 100644
--- a/third-party/curl/tests/data/test1016
+++ b/third-party/curl/tests/data/test1016
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,21 +8,16 @@ Range
 </info>
 
 <reply>
-<data>
-</data>
 </reply>
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 file
 </features>
- <name>
+<name>
 X-Y range on a file:// URL to stdout
- </name>
+</name>
 <command option="no-include">
 -r 1-4 file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt
 </command>
diff --git a/third-party/curl/tests/data/test1017 b/third-party/curl/tests/data/test1017
index bda9c2d49f..c379e1fc91 100644
--- a/third-party/curl/tests/data/test1017
+++ b/third-party/curl/tests/data/test1017
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,21 +9,16 @@ Range
 
 # Server-side
 <reply>
-<data>
-</data>
 </reply>
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 file
 </features>
- <name>
+<name>
 0-Y range on a file:// URL to stdout
- </name>
+</name>
 <command option="no-include">
 -r 0-3 file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt
 </command>
diff --git a/third-party/curl/tests/data/test1018 b/third-party/curl/tests/data/test1018
index 2d0d1574e0..0bbf2a9d78 100644
--- a/third-party/curl/tests/data/test1018
+++ b/third-party/curl/tests/data/test1018
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,21 +8,16 @@ Range
 </info>
 
 <reply>
-<data>
-</data>
 </reply>
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 file
 </features>
- <name>
+<name>
 X-X range on a file:// URL to stdout
- </name>
+</name>
 <command option="no-include">
 -r 4-4 file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt
 </command>
diff --git a/third-party/curl/tests/data/test1019 b/third-party/curl/tests/data/test1019
index ecf74fe9e6..5cc312215e 100644
--- a/third-party/curl/tests/data/test1019
+++ b/third-party/curl/tests/data/test1019
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,21 +9,16 @@ Range
 
 # Server-side
 <reply>
-<data>
-</data>
 </reply>
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 file
 </features>
- <name>
+<name>
 X- range on a file:// URL to stdout
- </name>
+</name>
 <command option="no-include">
 -r 7- file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt
 </command>
diff --git a/third-party/curl/tests/data/test102 b/third-party/curl/tests/data/test102
index ee81bded8f..df87c4bf32 100644
--- a/third-party/curl/tests/data/test102
+++ b/third-party/curl/tests/data/test102
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -26,10 +27,10 @@ REPLY EPSV 500 no such command
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP RETR PASV
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 
@@ -37,7 +38,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1020 b/third-party/curl/tests/data/test1020
index 2a92908d5f..a4f37e0f40 100644
--- a/third-party/curl/tests/data/test1020
+++ b/third-party/curl/tests/data/test1020
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,21 +9,16 @@ Range
 
 # Server-side
 <reply>
-<data>
-</data>
 </reply>
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 file
 </features>
- <name>
+<name>
 -Y range on a file:// URL to stdout
- </name>
+</name>
 <command option="no-include">
 -r -9 file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt
 </command>
diff --git a/third-party/curl/tests/data/test1021 b/third-party/curl/tests/data/test1021
index d9223b1cd1..cdc3495ec9 100644
--- a/third-party/curl/tests/data/test1021
+++ b/third-party/curl/tests/data/test1021
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -13,7 +14,7 @@ NTLM
 # Server-side
 <reply>
 
-<connect>
+<connect crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me my dear swsclose
 Proxy-Authenticate: NTLM
 Content-Length: 16
@@ -23,7 +24,7 @@ data to discard
 </connect>
 
 # this is returned first since we get no proxy-auth
-<connect1001>
+<connect1001 crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me my dear
 Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
 Content-Length: 28
@@ -33,7 +34,7 @@ Content-Length: 28
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<connect1002>
+<connect1002 crlf="headers">
 HTTP/1.1 200 Things are fine in proxy land
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -54,26 +55,26 @@ daniel
 
 # then this is returned when we get proxy-auth
 <data1000>
-HTTP/1.1 200 OK swsbounce
+HTTP/1.1 200 OK swsbounce%CR
 Server: no
-
+%CR
 Nice proxy auth sir!
 </data1000>
 
 <datacheck>
-HTTP/1.1 407 Authorization Required to proxy me my dear swsclose
-Proxy-Authenticate: NTLM
-Content-Length: 16
-Connection: close
-
-HTTP/1.1 407 Authorization Required to proxy me my dear
-Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
-Content-Length: 28
-
-HTTP/1.1 200 Things are fine in proxy land
-Server: Microsoft-IIS/5.0
-Content-Type: text/html; charset=iso-8859-1
-
+HTTP/1.1 407 Authorization Required to proxy me my dear swsclose%CR
+Proxy-Authenticate: NTLM%CR
+Content-Length: 16%CR
+Connection: close%CR
+%CR
+HTTP/1.1 407 Authorization Required to proxy me my dear%CR
+Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==%CR
+Content-Length: 28%CR
+%CR
+HTTP/1.1 200 Things are fine in proxy land%CR
+Server: Microsoft-IIS/5.0%CR
+Content-Type: text/html; charset=iso-8859-1%CR
+%CR
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 7
@@ -106,7 +107,7 @@ http://test.remote.example.com.%TESTNUMBER:%HTTPPORT/path/%TESTNUMBER0002 --prox
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 CONNECT test.remote.example.com.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: test.remote.example.com.%TESTNUMBER:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -114,7 +115,7 @@ Proxy-Connection: Keep-Alive
 
 CONNECT test.remote.example.com.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: test.remote.example.com.%TESTNUMBER:%HTTPPORT
-Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Proxy-Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
diff --git a/third-party/curl/tests/data/test1022 b/third-party/curl/tests/data/test1022
index 2288e9b99a..434b5f4b52 100644
--- a/third-party/curl/tests/data/test1022
+++ b/third-party/curl/tests/data/test1022
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,31 +6,25 @@ curl-config
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
- <name>
+<name>
 Compare curl --version with curl-config --version
- </name>
- <command>
+</name>
+<command>
 --version
 </command>
-<postcheck>
-%SRCDIR/libtest/test%TESTNUMBER.pl ../curl-config %LOGDIR/stdout%TESTNUMBER version
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
+<postcheck>
+%PERL %SRCDIR/libtest/test%TESTNUMBER.pl ../curl-config %LOGDIR/stdout%TESTNUMBER version
+</postcheck>
 <errorcode>
 0
 </errorcode>
diff --git a/third-party/curl/tests/data/test1023 b/third-party/curl/tests/data/test1023
index 27a144db55..0092f2b1cd 100644
--- a/third-party/curl/tests/data/test1023
+++ b/third-party/curl/tests/data/test1023
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,31 +6,25 @@ curl-config
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
- <name>
+<name>
 Compare curl --version with curl-config --vernum
- </name>
- <command>
+</name>
+<command>
 --version
 </command>
-<postcheck>
-%SRCDIR/libtest/test1022.pl ../curl-config %LOGDIR/stdout%TESTNUMBER vernum
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
+<postcheck>
+%PERL %SRCDIR/libtest/test1022.pl ../curl-config %LOGDIR/stdout%TESTNUMBER vernum
+</postcheck>
 <errorcode>
 0
 </errorcode>
diff --git a/third-party/curl/tests/data/test1024 b/third-party/curl/tests/data/test1024
index 80accbacb5..0db833ed25 100644
--- a/third-party/curl/tests/data/test1024
+++ b/third-party/curl/tests/data/test1024
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ cookies
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 301 This is a weirdo text message
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,7 +22,7 @@ Content-Length: 69
 This server reply is for testing a Location: following with cookies
 
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 301 This is a weirdo text message
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -32,7 +33,7 @@ Content-Length: 69
 This server reply is for testing a Location: following with cookies
 
 </data2>
-<data3>
+<data3 crlf="headers">
 HTTP/1.1 200 Followed here fine
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -41,7 +42,7 @@ Content-Length: 52
 If this is received, the location following worked
 
 </data3>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 301 This is a weirdo text message
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -71,10 +72,10 @@ If this is received, the location following worked
 <server>
 http
 </server>
- <name>
+<name>
 HTTP Location: following with cookies
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -L -c %LOGDIR/jar%TESTNUMBER
 </command>
 <features>
@@ -84,7 +85,7 @@ cookies
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1025 b/third-party/curl/tests/data/test1025
index baf3d7856a..bcd7195888 100644
--- a/third-party/curl/tests/data/test1025
+++ b/third-party/curl/tests/data/test1025
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ cookies
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 301 This is a weirdo text message
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,7 +22,7 @@ Content-Length: 69
 This server reply is for testing a Location: following with cookies
 
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 301 This is a weirdo text message
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -32,7 +33,7 @@ Content-Length: 69
 This server reply is for testing a Location: following with cookies
 
 </data2>
-<data3>
+<data3 crlf="headers">
 HTTP/1.1 200 Followed here fine
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -41,7 +42,7 @@ Content-Length: 52
 If this is received, the location following worked
 
 </data3>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 301 This is a weirdo text message
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -71,10 +72,10 @@ If this is received, the location following worked
 <server>
 http
 </server>
- <name>
+<name>
 HTTP Location: following with command-line and server cookies
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -L -c %LOGDIR/jar%TESTNUMBER -b forcedcookie=yes
 </command>
 <features>
@@ -84,7 +85,7 @@ cookies
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1026 b/third-party/curl/tests/data/test1026
index f836e9875a..96234a011d 100644
--- a/third-party/curl/tests/data/test1026
+++ b/third-party/curl/tests/data/test1026
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,36 +6,30 @@
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 manual
 </features>
-<server>
-none
-</server>
- <name>
+<name>
 curl --manual
- </name>
- <command>
+</name>
+<command>
 --manual
 </command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
 # Search for these two sentinel lines in the manual output; if they are found,
 # then chances are good the entire manual is there.
 <postcheck>
-perl -e 'open(IN,$ARGV[0]); my $lines=grep(/(curl\s*-\s*transfer\sa\s*URL)|(CONTRIBUTORS)/, <IN>); exit ($lines != 2); # Let this file pass an XML syntax check: </IN>' %LOGDIR/stdout%TESTNUMBER
+%PERL -e 'open(IN,$ARGV[0]); my $lines=grep(/(curl\s*-\s*transfer\sa\s*URL)|(AUTHORS)/, <IN>); exit ($lines != 2); # Let this file pass an XML syntax check: </IN>' %LOGDIR/stdout%TESTNUMBER
 </postcheck>
-</client>
-
-#
-# Verify data after the test has been "shot"
-<verify>
 <errorcode>
 0
 </errorcode>
diff --git a/third-party/curl/tests/data/test1027 b/third-party/curl/tests/data/test1027
index 6ce71b0cc7..e98b6800d0 100644
--- a/third-party/curl/tests/data/test1027
+++ b/third-party/curl/tests/data/test1027
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,35 +6,29 @@
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
- <name>
+<name>
 curl --help
- </name>
- <command>
+</name>
+<command>
 --help
 </command>
-# Search for these two sentinel lines in the help output; if they are found,
-# then chances are good the entire help is there.
-<postcheck>
-perl -e 'open(IN,$ARGV[0]); my $lines=grep(/(Usage: curl )|(--version\s*Show version)/, <IN>); exit ($lines != 2); # Let this file pass an XML syntax check: </IN>' %LOGDIR/stdout%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 0
 </errorcode>
+# Search for these two sentinel lines in the help output; if they are found,
+# then chances are good the entire help is there.
+<postcheck>
+%PERL -e 'open(IN,$ARGV[0]); my $lines=grep(/(Usage: curl )|(--version\s*Show version)/, <IN>); exit ($lines != 2); # Let this file pass an XML syntax check: </IN>' %LOGDIR/stdout%TESTNUMBER
+</postcheck>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1028 b/third-party/curl/tests/data/test1028
index 64128b7b89..ab216bce1b 100644
--- a/third-party/curl/tests/data/test1028
+++ b/third-party/curl/tests/data/test1028
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,10 +11,9 @@ FILE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 302 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -34,25 +34,23 @@ works
 </data2>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 ftp
 </server>
- <name>
+<name>
 HTTP Location: redirect to FTP URL
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001 -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 GET /%TESTNUMBER0001 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -67,7 +65,7 @@ SIZE %TESTNUMBER0002
 RETR %TESTNUMBER0002
 QUIT
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 302 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
diff --git a/third-party/curl/tests/data/test1029 b/third-party/curl/tests/data/test1029
index bfbd3bdaab..8394a91d9c 100644
--- a/third-party/curl/tests/data/test1029
+++ b/third-party/curl/tests/data/test1029
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ followlocation
 
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 301 This is a weirdo text message swsclose
 Location: data/%TESTNUMBER0002.txt?coolsite=yes
 Content-Length: 62
@@ -26,9 +27,9 @@ This server reply is for testing a simple Location: following
 <server>
 http
 </server>
- <name>
+<name>
 HTTP Location: and 'redirect_url' check
- </name>
+</name>
 <command>
 http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER -w '%{redirect_url} %{url} %{exitcode} %{errormsg}\n'
 </command>
@@ -36,21 +37,21 @@ http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER -w '%{redirect_url} %{url} %{ex
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/our/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 301 This is a weirdo text message swsclose
 Location: data/%TESTNUMBER0002.txt?coolsite=yes
 Content-Length: 62
 Connection: close
 
 This server reply is for testing a simple Location: following
-http://%HOSTIP:%HTTPPORT/we/want/our/data/%TESTNUMBER0002.txt?coolsite=yes http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER 0 
+http://%HOSTIP:%HTTPPORT/we/want/our/data/%TESTNUMBER0002.txt?coolsite=yes http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER 0%SP
 </stdout>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test103 b/third-party/curl/tests/data/test103
index 5fa6d35dff..ac86122cfd 100644
--- a/third-party/curl/tests/data/test103
+++ b/third-party/curl/tests/data/test103
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,10 +24,10 @@ works
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP RETR PORT with CWD
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER -P -
 </command>
 </client>
@@ -38,7 +39,7 @@ ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER -P -
 ^PORT \d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3}
 ^EPRT \|1\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|\d{1,5}\|
 </strip>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1030 b/third-party/curl/tests/data/test1030
index 49bfc06ca1..cb35a0f085 100644
--- a/third-party/curl/tests/data/test1030
+++ b/third-party/curl/tests/data/test1030
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ HTTP Digest auth
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -24,7 +25,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 OK
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -34,7 +35,7 @@ Connection: close
 This IS the real page!
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -62,11 +63,12 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
-HTTP PUT with --anyauth authorization (picking Digest)
- </name>
- <command>
+<name>
+HTTP PUT with --anyauth, picking Digest. Persistent connection.
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -T %LOGDIR/put%TESTNUMBER -u testuser:testpass --anyauth
 </command>
 <file name="%LOGDIR/put%TESTNUMBER">
@@ -79,7 +81,7 @@ four is the number of lines
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1031 b/third-party/curl/tests/data/test1031
index 1bf842beab..3dfb07293e 100644
--- a/third-party/curl/tests/data/test1031
+++ b/third-party/curl/tests/data/test1031
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -49,17 +50,17 @@ If this is received, the location following worked
 <server>
 http
 </server>
- <name>
+<name>
 HTTP Location: following to a query string
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/this/%TESTNUMBER -L
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/this/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1032 b/third-party/curl/tests/data/test1032
index f306e7a210..a45dfcefdf 100644
--- a/third-party/curl/tests/data/test1032
+++ b/third-party/curl/tests/data/test1032
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ Range
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -25,24 +25,22 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP HEAD with --range
- </name>
- <command>
+</name>
+<command>
 --range 1-3 --head http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 HEAD /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Range: bytes=1-3
diff --git a/third-party/curl/tests/data/test1033 b/third-party/curl/tests/data/test1033
index 87d71f723e..7275b014d4 100644
--- a/third-party/curl/tests/data/test1033
+++ b/third-party/curl/tests/data/test1033
@@ -1,5 +1,5 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
-#
 # This case with an unexpected 1xx response used to cause a "hang" before the fix
 # got 7.19.0
 <info>
@@ -9,7 +9,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -30,24 +29,22 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with 102 response!
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1034 b/third-party/curl/tests/data/test1034
index ec41651a21..be48039b54 100644
--- a/third-party/curl/tests/data/test1034
+++ b/third-party/curl/tests/data/test1034
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,49 +6,39 @@ HTTP
 HTTP GET
 HTTP proxy
 IDN
-FAILURE
 config file
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
-idn
+IDN
 http
 proxy
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
-HTTP over proxy with malformatted IDN host name
- </name>
+<name>
+HTTP over proxy with malformatted IDN hostname
+</name>
 
-# This host name contains an invalid UTF-8 byte sequence that can't be
+# This hostname contains an invalid UTF-8 byte sequence that cannot be
 # converted into an IDN name
 <stdin>
-url = "http://invalid-utf8-â�.local/page/%TESTNUMBER"
+url = "http://invalid-utf8-%hex[%e2%90]hex%.local/page/%TESTNUMBER"
 </stdin>
- <command>
+<command>
 -K - -x %HOSTIP:%NOLISTENPORT
 </command>
 </client>
 
-#
 <verify>
 <errorcode>
 3
diff --git a/third-party/curl/tests/data/test1035 b/third-party/curl/tests/data/test1035
index 73d8aefed5..9139a41aa3 100644
--- a/third-party/curl/tests/data/test1035
+++ b/third-party/curl/tests/data/test1035
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,42 +6,32 @@ HTTP
 HTTP GET
 HTTP proxy
 IDN
-FAILURE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
-idn
+IDN
 http
 proxy
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
-HTTP over proxy with too long IDN host name
- </name>
- <command>
-http://too-long-IDN-name-cürl-rüles-la-la-la-dee-da-flooby-nooby.local/page/%TESTNUMBER -x %HOSTIP:%NOLISTENPORT
+<name>
+HTTP over proxy with too long IDN hostname
+</name>
+<command>
+http://too-long-IDN-name-c%hex[%c3%bc]hex%rl-r%hex[%c3%bc]hex%le%hex[%c3%9f]hex%-la-la-la-dee-da-flooby-nooby.local/page/%TESTNUMBER -x %HOSTIP:%NOLISTENPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test1036 b/third-party/curl/tests/data/test1036
index f811ec7e22..0c450d377a 100644
--- a/third-party/curl/tests/data/test1036
+++ b/third-party/curl/tests/data/test1036
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,10 +28,10 @@ REPLY EPSV 500 no such command
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download resume from end of file
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -C -
 </command>
 <file name="%LOGDIR/curl%TESTNUMBER.out">
@@ -40,7 +41,7 @@ This is the start!!
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1037 b/third-party/curl/tests/data/test1037
index f02eb88263..060a3d004c 100644
--- a/third-party/curl/tests/data/test1037
+++ b/third-party/curl/tests/data/test1037
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,10 +28,10 @@ REPLY EPSV 500 no such command
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download resume from end of empty file
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -C -
 </command>
 <file name="%LOGDIR/curl%TESTNUMBER.out">
@@ -39,7 +40,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -C -
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1038 b/third-party/curl/tests/data/test1038
index 4a0e093e24..fe1e4ca94a 100644
--- a/third-party/curl/tests/data/test1038
+++ b/third-party/curl/tests/data/test1038
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -19,14 +20,14 @@ Resume
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP PASV upload resume from end of file
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T %LOGDIR/upload%TESTNUMBER -C -
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
-this is the *****cr@p******** that we're gonna upload
+this is the *****cr@p******** that we are gonna upload
 
 worx?
 </file>
@@ -34,7 +35,7 @@ worx?
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -45,7 +46,7 @@ APPE %TESTNUMBER
 QUIT
 </protocol>
 <upload>
-cr@p******** that we're gonna upload
+cr@p******** that we are gonna upload
 
 worx?
 </upload>
diff --git a/third-party/curl/tests/data/test1039 b/third-party/curl/tests/data/test1039
index 23f34326c9..923996aa26 100644
--- a/third-party/curl/tests/data/test1039
+++ b/third-party/curl/tests/data/test1039
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -19,14 +20,14 @@ Resume
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP PASV upload resume from end of empty file
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T %LOGDIR/upload%TESTNUMBER -C -
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
-this is the *****cr@p******** that we're gonna upload
+this is the *****cr@p******** that we are gonna upload
 
 worx?
 </file>
@@ -34,7 +35,7 @@ worx?
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -45,7 +46,7 @@ STOR %TESTNUMBER
 QUIT
 </protocol>
 <upload>
-this is the *****cr@p******** that we're gonna upload
+this is the *****cr@p******** that we are gonna upload
 
 worx?
 </upload>
diff --git a/third-party/curl/tests/data/test104 b/third-party/curl/tests/data/test104
index 4bcf557613..fb15ee3965 100644
--- a/third-party/curl/tests/data/test104
+++ b/third-party/curl/tests/data/test104
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -17,17 +18,17 @@ NOBODY
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP --head to get file size only
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER --head
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1040 b/third-party/curl/tests/data/test1040
index 5604cee3f6..d031cffae7 100644
--- a/third-party/curl/tests/data/test1040
+++ b/third-party/curl/tests/data/test1040
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Similar to test92
 <info>
@@ -10,7 +11,7 @@ Resume
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 416 Invalid range
 Connection: close
 Content-Length: 0
@@ -30,10 +31,10 @@ Content-Length: 0
 012345678
 012345678
 012345678
-HTTP/1.1 416 Invalid range
-Connection: close
-Content-Length: 0
-
+HTTP/1.1 416 Invalid range%CR
+Connection: close%CR
+Content-Length: 0%CR
+%CR
 </datacheck>
 
 </reply>
@@ -43,10 +44,10 @@ Content-Length: 0
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with resume from end of entirely-downloaded file
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -C -
 </command>
 <file name="%LOGDIR/curl%TESTNUMBER.out">
@@ -65,7 +66,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -C -
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Range: bytes=100-
diff --git a/third-party/curl/tests/data/test1041 b/third-party/curl/tests/data/test1041
index 4e0583106c..4133ac7a80 100644
--- a/third-party/curl/tests/data/test1041
+++ b/third-party/curl/tests/data/test1041
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Similar to test33
 <info>
@@ -11,7 +12,7 @@ Content-Range
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -28,9 +29,9 @@ Content-Type: text/html
 <server>
 http
 </server>
- <name>
+<name>
 HTTP PUT with resume from end of already-uploaded file
- </name>
+</name>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 012345678
 012345678
@@ -43,16 +44,16 @@ HTTP PUT with resume from end of already-uploaded file
 012345678
 012345678
 </file>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -T%LOGDIR/test%TESTNUMBER.txt -C -
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-# curl doesn't do a HEAD request on the remote file so it has no idea whether
+# curl does not do a HEAD request on the remote file so it has no idea whether
 # it can skip part of the file or not.  Instead, it sends the entire file.
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Content-Range: bytes 0-99/100
diff --git a/third-party/curl/tests/data/test1042 b/third-party/curl/tests/data/test1042
index 39bd4c78d9..22b1acc03e 100644
--- a/third-party/curl/tests/data/test1042
+++ b/third-party/curl/tests/data/test1042
@@ -1,17 +1,17 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
 Resume
-FAILURE
 </keywords>
 </info>
 
 # Server-side
 <reply>
 # Some servers (e.g. Apache 1.2) respond this way to an invalid byte range
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Connection: close
 Content-Length: 100
@@ -42,11 +42,11 @@ Content-Type: text/plain
 012345678
 012345678
 012345678
-HTTP/1.1 200 OK
-Connection: close
-Content-Length: 100
-Content-Type: text/plain
-
+HTTP/1.1 200 OK%CR
+Connection: close%CR
+Content-Length: 100%CR
+Content-Type: text/plain%CR
+%CR
 </datacheck>
 </reply>
 
@@ -55,10 +55,10 @@ Content-Type: text/plain
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET beyond end of entirely-downloaded file, no server resume
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -C 200
 </command>
 <file name="%LOGDIR/curl%TESTNUMBER.out">
@@ -80,7 +80,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -C 200
 <errorcode>
 33
 </errorcode>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Range: bytes=200-
diff --git a/third-party/curl/tests/data/test1043 b/third-party/curl/tests/data/test1043
index 6099e877c0..474479e5f5 100644
--- a/third-party/curl/tests/data/test1043
+++ b/third-party/curl/tests/data/test1043
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ Resume
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 206 Partial Content
 Date: Mon, 13 Nov 2007 13:41:09 GMT
 Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
@@ -32,13 +33,13 @@ Content-Range: bytes 40-99/100
 012345678
 012345678
 012345678
-HTTP/1.1 206 Partial Content
-Date: Mon, 13 Nov 2007 13:41:09 GMT
-Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
-Accept-Ranges: bytes
-Content-Length: 60
-Content-Range: bytes 40-99/100
-
+HTTP/1.1 206 Partial Content%CR
+Date: Mon, 13 Nov 2007 13:41:09 GMT%CR
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT%CR
+Accept-Ranges: bytes%CR
+Content-Length: 60%CR
+Content-Range: bytes 40-99/100%CR
+%CR
 012345678
 012345678
 012345678
@@ -54,10 +55,10 @@ Content-Range: bytes 40-99/100
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with resume from end of file
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -C -
 </command>
 <file name="%LOGDIR/curl%TESTNUMBER.out">
@@ -70,7 +71,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -C -
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Range: bytes=40-
diff --git a/third-party/curl/tests/data/test1044 b/third-party/curl/tests/data/test1044
index b0569a95c5..0da6473de5 100644
--- a/third-party/curl/tests/data/test1044
+++ b/third-party/curl/tests/data/test1044
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Similar to test141
 <info>
@@ -23,22 +24,22 @@ Largefile
 # Client-side
 <client>
 <features>
-large_file
+Largefile
 </features>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download large file info with -I
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/blalbla/%TESTNUMBER -I
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -49,7 +50,7 @@ SIZE %TESTNUMBER
 REST 0
 QUIT
 </protocol>
-<stdout>
+<stdout crlf="headers">
 Last-Modified: Sat, 26 Jul 2008 10:26:59 GMT
 Content-Length: 9999999999
 Accept-ranges: bytes
diff --git a/third-party/curl/tests/data/test1045 b/third-party/curl/tests/data/test1045
index 83f79128e6..5aa89dd20a 100644
--- a/third-party/curl/tests/data/test1045
+++ b/third-party/curl/tests/data/test1045
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Mon, 28 Jul 2008 14:49:00 GMT
 Server: test-server/fake
@@ -22,24 +22,22 @@ Content-Type: text/plain
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with numeric localhost --interface
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --interface %CLIENTIP
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1046 b/third-party/curl/tests/data/test1046
index 18209ea98c..dbb0f8b8b4 100644
--- a/third-party/curl/tests/data/test1046
+++ b/third-party/curl/tests/data/test1046
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ IPv6
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Mon, 28 Jul 2008 14:49:00 GMT
 Server: test-server/fake
@@ -23,31 +23,25 @@ Content-Type: text/plain
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-ipv6
+IPv6
 </features>
 <server>
 http-ipv6
 </server>
- <name>
+<name>
 HTTP-IPv6 GET with numeric localhost --interface
- </name>
- <command>
--g "http://%HOST6IP:%HTTP6PORT/%TESTNUMBER" --interface ::1
+</name>
+<command>
+-g "http://%HOST6IP:%HTTP6PORT/%TESTNUMBER" --interface %CLIENT6IP-NB
 </command>
-# --interface doesn't accept an address surrounded by [] so %CLIENT6IP is out
-<precheck>
-perl -e "print 'Test requires default test client host address' if ( '%CLIENT6IP' ne '[::1]' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOST6IP:%HTTP6PORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1047 b/third-party/curl/tests/data/test1047
index 13f299284d..35621d8b4c 100644
--- a/third-party/curl/tests/data/test1047
+++ b/third-party/curl/tests/data/test1047
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,12 +9,9 @@ LIST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -25,27 +23,25 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP dir list PASV with localhost --interface
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/ --interface %CLIENTIP
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1048 b/third-party/curl/tests/data/test1048
index 0cdb896150..09332b9a4f 100644
--- a/third-party/curl/tests/data/test1048
+++ b/third-party/curl/tests/data/test1048
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,12 +11,9 @@ LIST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -27,34 +25,28 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-ipv6
+IPv6
 </features>
 <server>
 ftp-ipv6
 </server>
- <name>
+<name>
 FTP-IPv6 dir list PASV with localhost --interface
- </name>
- <command>
--g "ftp://%HOST6IP:%FTP6PORT/" --interface ::1
+</name>
+<command>
+-g "ftp://%HOST6IP:%FTP6PORT/" --interface %CLIENT6IP-NB
 </command>
-# --interface doesn't accept an address surrounded by [] so %CLIENT6IP is out
-<precheck>
-perl -e "print 'Test requires default test client host address' if ( '%CLIENT6IP' ne '[::1]' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1049 b/third-party/curl/tests/data/test1049
index 165ba1ea79..1eb2e1c80e 100644
--- a/third-party/curl/tests/data/test1049
+++ b/third-party/curl/tests/data/test1049
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ TFTP RRQ
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -18,21 +18,19 @@ returned
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 tftp
 </server>
- <name>
+<name>
 TFTP retrieve with localhost --interface
- </name>
- <command>
+</name>
+<command>
 tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER --interface %CLIENTIP
 </command>
 </client>
 
-#
 # Verify pseudo protocol after the test has been "shot"
 <verify>
 <strip>
diff --git a/third-party/curl/tests/data/test105 b/third-party/curl/tests/data/test105
index 66747afdb2..b12cd1c3c5 100644
--- a/third-party/curl/tests/data/test105
+++ b/third-party/curl/tests/data/test105
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,17 +28,17 @@ REPLY EPSV 500 no such command
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP user+password in URL and ASCII transfer
- </name>
- <command>
+</name>
+<command>
 ftp://userdude:passfellow@%HOSTIP:%FTPPORT/%TESTNUMBER --use-ascii
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER userdude
 PASS passfellow
 PWD
diff --git a/third-party/curl/tests/data/test1050 b/third-party/curl/tests/data/test1050
index 1d187f8125..f64e91b270 100644
--- a/third-party/curl/tests/data/test1050
+++ b/third-party/curl/tests/data/test1050
@@ -1,7 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Similar to test 253
 <info>
 <keywords>
+FTP
 FTP-ipv6
 IPv6
 EPRT
@@ -10,9 +12,7 @@ EPRT
 
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -24,36 +24,32 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
 # Client-side
 <client>
 <features>
-ipv6
+IPv6
 </features>
 <server>
 ftp-ipv6
 </server>
- <name>
+<name>
 FTP-IPv6 dir list, EPRT with specified IP
- </name>
- <command>
--g "ftp://%HOST6IP:%FTP6PORT/" -P ::1
+</name>
+<command>
+-g "ftp://%HOST6IP:%FTP6PORT/" -P %CLIENT6IP-NB
 </command>
-# --interface doesn't accept an address surrounded by [] so %CLIENT6IP is out
-<precheck>
-perl -e "print 'Test requires default test client host address' if ( '%CLIENT6IP' ne '[::1]' );"
-</precheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
 # Strip all valid kinds of EPRT that curl can send
 <strippart>
-s/^(EPRT \|2\|::1\|)(.*)/$1/
+s/^(EPRT \|2\|::1\|)(\S*)/$1/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1051 b/third-party/curl/tests/data/test1051
index b4c1a4554b..70302b9676 100644
--- a/third-party/curl/tests/data/test1051
+++ b/third-party/curl/tests/data/test1051
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ followlocation
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 301 Redirect swsclose
 Date: Thu, 29 Jul 2008 14:49:00 GMT
 Server: test-server/fake
@@ -18,7 +19,7 @@ Content-Length: 0
 Connection: close
 
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 100 Continue
 
 HTTP/1.1 200 Followed here fine swsclose
@@ -28,7 +29,7 @@ Content-Length: 51
 
 If this is received, the location following worked
 </data2>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 301 Redirect swsclose
 Date: Thu, 29 Jul 2008 14:49:00 GMT
 Server: test-server/fake
@@ -52,10 +53,10 @@ If this is received, the location following worked
 <server>
 http
 </server>
- <name>
+<name>
 HTTP PUT with Location: following
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -L -T %LOGDIR/test%TESTNUMBER.txt
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
@@ -79,7 +80,7 @@ the
 # including the full request-body before it responds. So in this test the
 # server says 301 and 100 _after_ the entire PUT body has been sent.
 
-<protocol>
+<protocol crlf="headers">
 PUT /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1052 b/third-party/curl/tests/data/test1052
index 3ca5805d98..36ac720c42 100644
--- a/third-party/curl/tests/data/test1052
+++ b/third-party/curl/tests/data/test1052
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ followlocation
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.0 301 Redirect swsclose
 Date: Thu, 29 Jul 2008 14:49:00 GMT
 Server: test-server/fake
@@ -18,7 +19,7 @@ Content-Length: 0
 Connection: close
 
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.0 200 Followed here fine swsclose
 Date: Thu, 29 Jul 2008 14:49:00 GMT
 Server: test-server/fake
@@ -26,7 +27,7 @@ Content-Length: 51
 
 If this is received, the location following worked
 </data2>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.0 301 Redirect swsclose
 Date: Thu, 29 Jul 2008 14:49:00 GMT
 Server: test-server/fake
@@ -48,10 +49,10 @@ If this is received, the location following worked
 <server>
 http
 </server>
- <name>
+<name>
 HTTP 1.0 PUT with Location: following
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -0 -L -T %LOGDIR/test%TESTNUMBER.txt
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
@@ -74,7 +75,7 @@ the
 # the test HTTP server is blocking until it has read the entire request,
 # including the full request-body before it responds. So in this test the
 # server says 301 and 200 _after_ the entire PUT body has been sent.
-<protocol>
+<protocol crlf="headers">
 PUT /want/%TESTNUMBER HTTP/1.0
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1053 b/third-party/curl/tests/data/test1053
index 1d8713b4fa..f66402dd47 100644
--- a/third-party/curl/tests/data/test1053
+++ b/third-party/curl/tests/data/test1053
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Based on test 9
 <info>
@@ -11,7 +12,7 @@ followlocation
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 307 Redirect swsclose
 Date: Thu, 29 Jul 2008 14:49:00 GMT
 Server: test-server/fake
@@ -20,7 +21,7 @@ Content-Length: 0
 Connection: close
 
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -30,7 +31,7 @@ Connection: close
 blablabla
 
 </data2>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 307 Redirect swsclose
 Date: Thu, 29 Jul 2008 14:49:00 GMT
 Server: test-server/fake
@@ -57,10 +58,10 @@ Mime
 <server>
 http
 </server>
- <name>
+<name>
 HTTP RFC1867-type formposting from file with Location: following
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -L -F name=daniel -F tool=curl -F file=@%LOGDIR/test%TESTNUMBER.txt
 </command>
 # We create this file before the command is invoked!
@@ -77,54 +78,54 @@ bar
 ^(Content-Type: multipart/form-data;|------------).*
 </strip>
 <protocol>
-POST /we/want/%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Content-Length: 410
-Content-Type: multipart/form-data; boundary=----------------------------9ef8d6205763
-
-------------------------------9ef8d6205763
-Content-Disposition: form-data; name="name"
-
-daniel
-------------------------------9ef8d6205763
-Content-Disposition: form-data; name="tool"
-
-curl
-------------------------------9ef8d6205763
-Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER.txt"
-Content-Type: text/plain
-
+POST /we/want/%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Content-Length: 434%CR
+Content-Type: multipart/form-data; boundary=----------------------------9ef8d6205763%CR
+%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: form-data; name="name"%CR
+%CR
+daniel%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: form-data; name="tool"%CR
+%CR
+curl%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER.txt"%CR
+Content-Type: text/plain%CR
+%CR
 foo-
 This is a moo-
 bar
-
-------------------------------9ef8d6205763--
-POST /we/want/data/%TESTNUMBER0002.txt?coolsite=yes HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Content-Length: 410
-Content-Type: multipart/form-data; boundary=----------------------------9ef8d6205763
-
-------------------------------9ef8d6205763
-Content-Disposition: form-data; name="name"
-
-daniel
-------------------------------9ef8d6205763
-Content-Disposition: form-data; name="tool"
-
-curl
-------------------------------9ef8d6205763
-Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER.txt"
-Content-Type: text/plain
-
+%CR
+------------------------------9ef8d6205763--%CR
+POST /we/want/data/%TESTNUMBER0002.txt?coolsite=yes HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Content-Length: 434%CR
+Content-Type: multipart/form-data; boundary=----------------------------9ef8d6205763%CR
+%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: form-data; name="name"%CR
+%CR
+daniel%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: form-data; name="tool"%CR
+%CR
+curl%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER.txt"%CR
+Content-Type: text/plain%CR
+%CR
 foo-
 This is a moo-
 bar
-
-------------------------------9ef8d6205763--
+%CR
+------------------------------9ef8d6205763--%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1054 b/third-party/curl/tests/data/test1054
index ac84da3dd2..5622478c68 100644
--- a/third-party/curl/tests/data/test1054
+++ b/third-party/curl/tests/data/test1054
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,24 +8,23 @@ followlocation
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 301 OK swsclose
 Location: moo/testcase/%TESTNUMBER0002
 Date: Thu, 31 Jul 2008 14:49:00 GMT
 Connection: close
 
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Thu, 31 Jul 2008 14:49:00 GMT
 Connection: close
 
 body
 </data2>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 301 OK swsclose
 Location: moo/testcase/%TESTNUMBER0002
 Date: Thu, 31 Jul 2008 14:49:00 GMT
@@ -38,27 +38,25 @@ body
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP POST from file with 301 redirect and --post301
- </name>
+</name>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 field=data
 </file>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/blah/%TESTNUMBER -L -d @%LOGDIR/test%TESTNUMBER.txt --post301
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /blah/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1055 b/third-party/curl/tests/data/test1055
index b1500c0f9a..3d62a06eb9 100644
--- a/third-party/curl/tests/data/test1055
+++ b/third-party/curl/tests/data/test1055
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,10 +11,9 @@ STOR
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 307 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -25,17 +25,16 @@ Connection: close
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 ftp
 </server>
- <name>
+<name>
 HTTP PUT Location: redirect to FTP URL
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -L -T %LOGDIR/test%TESTNUMBER.txt
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
@@ -51,16 +50,15 @@ the
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <protocol>
-PUT /%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Content-Length: 78
-
+PUT /%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Content-Length: 78%CR
+%CR
 Weird
      file
          to
@@ -70,13 +68,13 @@ for
 the
    PUT
       feature
-USER anonymous
-PASS ftp@example.com
-PWD
-EPSV
-TYPE I
-STOR %TESTNUMBER
-QUIT
+USER anonymous%CR
+PASS ftp@example.com%CR
+PWD%CR
+EPSV%CR
+TYPE I%CR
+STOR %TESTNUMBER%CR
+QUIT%CR
 </protocol>
 <upload>
 Weird
diff --git a/third-party/curl/tests/data/test1056 b/third-party/curl/tests/data/test1056
index 6ca14bcefb..5659a1e72a 100644
--- a/third-party/curl/tests/data/test1056
+++ b/third-party/curl/tests/data/test1056
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,24 +9,23 @@ IPv6
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 302 OK swsclose
 Location: http://[::1%259999]:%HTTP6PORT/moo/%TESTNUMBER0002
 Date: Thu, 31 Jul 2008 14:49:00 GMT
 Connection: close
 
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Thu, 31 Jul 2008 14:49:00 GMT
 Connection: close
 
 body
 </data2>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 302 OK swsclose
 Location: http://[::1%259999]:%HTTP6PORT/moo/%TESTNUMBER0002
 Date: Thu, 31 Jul 2008 14:49:00 GMT
@@ -39,28 +39,32 @@ body
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
+# This test relies on the IPv6 scope field being ignored when connecting to
+# ipv6-localhost (i.e. [::1%259999] is treated as [::1]). Maybe this is a bit
+# dodgy, but it happens on all our test platforms but Windows so skip this
+# test there. Not supported on the Windows kernel, this includes MSYS2/Cygwin.
 <features>
-ipv6
+IPv6
+!cygwin
+!win32
 </features>
 <server>
 http
 http-ipv6
 </server>
- <name>
+<name>
 HTTP follow redirect from IPv4 to IPv6 with scope
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/are/all/twits/%TESTNUMBER -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/are/all/twits/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1057 b/third-party/curl/tests/data/test1057
index 54806592dc..18efd0b41f 100644
--- a/third-party/curl/tests/data/test1057
+++ b/third-party/curl/tests/data/test1057
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -26,17 +27,17 @@ Range
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP retrieve a byte-range relative to end of file
- </name>
- <command>
+</name>
+<command>
 -r -12 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1058 b/third-party/curl/tests/data/test1058
index 811b149bab..a3832a1f3f 100644
--- a/third-party/curl/tests/data/test1058
+++ b/third-party/curl/tests/data/test1058
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ Content-Range
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 206 Partial Content
 Date: Thu, 31 Jul 2008 13:41:09 GMT
 Accept-Ranges: bytes
@@ -29,17 +30,17 @@ in the request
 <server>
 http
 </server>
- <name>
+<name>
 HTTP range relative to end of file
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -r -101
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Range: bytes=-101
diff --git a/third-party/curl/tests/data/test1059 b/third-party/curl/tests/data/test1059
index 919521a160..1cb2ff836a 100644
--- a/third-party/curl/tests/data/test1059
+++ b/third-party/curl/tests/data/test1059
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,14 +6,12 @@ HTTP
 HTTP CONNECT
 proxytunnel
 FTP
-FAILURE
 </keywords>
 
 </info>
-#
 # Server-side
 <reply>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 501 Method not implemented swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
@@ -21,7 +20,6 @@ Content-Length: 0
 </connect>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -31,22 +29,21 @@ proxy
 <server>
 http
 </server>
- <name>
+<name>
 HTTP CONNECT with proxytunnel to unsupported FTP URL
- </name>
- <command>
+</name>
+<command>
 ftp://test-number:%TESTNUMBER/wanted/page -p -x %HOSTIP:%HTTPPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-# The server doesn't implement CONNECT for ftp, so this must be a failure test
+# The server does not implement CONNECT for ftp, so this must be a failure test
 <errorcode>
-56
+7
 </errorcode>
-<protocol>
+<protocol crlf="headers">
 CONNECT test-number:%TESTNUMBER HTTP/1.1
 Host: test-number:%TESTNUMBER
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test106 b/third-party/curl/tests/data/test106
index c3209754ac..c11f017633 100644
--- a/third-party/curl/tests/data/test106
+++ b/third-party/curl/tests/data/test106
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -25,17 +26,17 @@ works
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP GET with type=A style ASCII URL using %20 codes
- </name>
- <command>
+</name>
+<command>
 "ftp://%HOSTIP:%FTPPORT//path%20with%20%20spaces//and%20things2/%TESTNUMBER;type=A"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1060 b/third-party/curl/tests/data/test1060
index 9f8ab8392a..a5f3b66afc 100644
--- a/third-party/curl/tests/data/test1060
+++ b/third-party/curl/tests/data/test1060
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -14,812 +15,13 @@ HTTP proxy Digest auth
 <reply>
 
 # this is returned first since we get no proxy-auth
-<connect>
+<connect crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me my dear
 Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
-Content-Length: 40000
+Content-Length: 35701
 X-tra-long-header: %repeat[16080 x a]%
 
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+%repeat[700 x And you should ignore this data. aaaaaaaaaaaaaaaa %0a]%
 </connect>
 
 # this is returned when we get a GET!
@@ -836,20 +38,20 @@ daniel
 
 # then this is returned when we get proxy-auth
 <connect1000>
-HTTP/1.1 200 OK swsbounce
+HTTP/1.1 200 OK%CR
 Server: no
-
+%CR
 </connect1000>
 
 <datacheck>
-HTTP/1.1 407 Authorization Required to proxy me my dear
-Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
-Content-Length: 40000
-X-tra-long-header: %repeat[16080 x a]%
-
-HTTP/1.1 200 OK swsbounce
+HTTP/1.1 407 Authorization Required to proxy me my dear%CR
+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"%CR
+Content-Length: 35701%CR
+X-tra-long-header: %repeat[16080 x a]%%CR
+%CR
+HTTP/1.1 200 OK%CR
 Server: no
-
+%CR
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 7
@@ -870,18 +72,19 @@ http
 !SSPI
 crypto
 proxy
+digest
 </features>
- <name>
+<name>
 HTTP proxy CONNECT auth Digest, large headers and data
- </name>
- <command>
+</name>
+<command>
 http://test.remote.haxx.se.%TESTNUMBER:8990/path/%TESTNUMBER0002 --proxy http://%HOSTIP:%HTTPPORT --proxy-user silly:person --proxy-digest --proxytunnel
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 CONNECT test.remote.haxx.se.%TESTNUMBER:8990 HTTP/1.1
 Host: test.remote.haxx.se.%TESTNUMBER:8990
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1061 b/third-party/curl/tests/data/test1061
index c321b7c5ce..2fd969dd07 100644
--- a/third-party/curl/tests/data/test1061
+++ b/third-party/curl/tests/data/test1061
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -16,815 +17,16 @@ HTTP proxy Digest auth
 
 # this is returned first since we get no proxy-auth
 <connect>
-HTTP/1.1 407 Authorization Required to proxy me my dear
-Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
-Transfer-Encoding: chunked
-X-tra-long-header: %repeat[16080 x a]%
-
-9c40
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-And you should ignore this data. aaaaaaaaaaaaaaaa
-end of 1 KB aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-
-0
-
+HTTP/1.1 407 Authorization Required to proxy me my dear%CR
+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"%CR
+Transfer-Encoding: chunked%CR
+X-tra-long-header: %repeat[16080 x a]%%CR
+%CR
+9c41%CR
+%repeat[800 x And you should ignore this data. aaaaaaaaaaaaaaa %0a]%
+%CR
+0%CR
+%CR
 </connect>
 
 # this is returned when we get a GET!
@@ -841,20 +43,20 @@ daniel
 
 # then this is returned when we get proxy-auth
 <connect1000>
-HTTP/1.1 200 OK swsbounce
+HTTP/1.1 200 OK%CR
 Server: no
-
+%CR
 </connect1000>
 
 <datacheck>
-HTTP/1.1 407 Authorization Required to proxy me my dear
-Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
-Transfer-Encoding: chunked
-X-tra-long-header: %repeat[16080 x a]%
-
-HTTP/1.1 200 OK swsbounce
+HTTP/1.1 407 Authorization Required to proxy me my dear%CR
+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"%CR
+Transfer-Encoding: chunked%CR
+X-tra-long-header: %repeat[16080 x a]%%CR
+%CR
+HTTP/1.1 200 OK%CR
 Server: no
-
+%CR
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 7
@@ -875,18 +77,19 @@ http
 !SSPI
 crypto
 proxy
+digest
 </features>
- <name>
+<name>
 HTTP proxy CONNECT auth Digest, large headers and chunked data
- </name>
- <command>
+</name>
+<command>
 http://test.remote.haxx.se.%TESTNUMBER:8990/path/%TESTNUMBER0002 --proxy http://%HOSTIP:%HTTPPORT --proxy-user silly:person --proxy-digest --proxytunnel
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 CONNECT test.remote.haxx.se.%TESTNUMBER:8990 HTTP/1.1
 Host: test.remote.haxx.se.%TESTNUMBER:8990
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1062 b/third-party/curl/tests/data/test1062
index 775a93f22b..b95818d2bf 100644
--- a/third-party/curl/tests/data/test1062
+++ b/third-party/curl/tests/data/test1062
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -15,7 +16,7 @@ mooo
 # a long set of response strings to CWD to make sure the ftp parser deals
 # with it nicely
 <servercmd>
-REPLY CWD 250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n250-A Exactly fill curl's buffer\r\n250 Finally, here is the response, boundary condition
+REPLY CWD %repeat[218 x 250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n]%250-A Exactly fill curl's buffer\r\n250 Finally, here is the response, boundary condition
 </servercmd>
 </reply>
 
@@ -24,17 +25,17 @@ REPLY CWD 250-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP with excessively long server command response lines, boundary condition
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1063 b/third-party/curl/tests/data/test1063
index 8f263c8131..1ac6411492 100644
--- a/third-party/curl/tests/data/test1063
+++ b/third-party/curl/tests/data/test1063
@@ -1,33 +1,28 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FILE
 Range
-FAILURE
 </keywords>
 </info>
 
 # Server-side
 <reply>
-<data>
-</data>
 </reply>
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 file
-large_file
+Largefile
 </features>
- <name>
+<name>
 Invalid large X- range on a file://
- </name>
-# This range value is 2**32+7, which will be truncated to the valid value 7
+</name>
+# This range value is 2**32 + 7, which is truncated to the valid value 7
 # if the large file support is not working correctly
- <command>
+<command>
 -r 4294967303- file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
diff --git a/third-party/curl/tests/data/test1064 b/third-party/curl/tests/data/test1064
index 020a39757d..c5a24a0b7a 100644
--- a/third-party/curl/tests/data/test1064
+++ b/third-party/curl/tests/data/test1064
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,7 @@ HTTP PUT
 </info>
 
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 A OK
 Server: curl test
 Content-Type: text/html; charset=iso-8859-1
@@ -15,7 +16,7 @@ Content-Length: 3
 
 ok
 </data>
-<data2 nocheck="yes">
+<data2 crlf="headers" nocheck="yes">
 HTTP/1.1 200 A OK
 Server: curl test
 Content-Type: text/html; charset=iso-8859-1
@@ -27,14 +28,13 @@ still ok
 
 # Client-side
 <client>
-#
 <server>
 http
 </server>
- <name>
+<name>
 HTTP PUT twice
- </name>
- <command>
+</name>
+<command>
 -H "Expect:" -T %LOGDIR/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER.upload1 -T %LOGDIR/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER0002.upload2
 </command>
 <file name="%LOGDIR/%TESTNUMBER">
@@ -44,7 +44,7 @@ test
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER.upload1 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -60,7 +60,7 @@ Content-Length: 5
 
 test
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 200 A OK
 Server: curl test
 Content-Type: text/html; charset=iso-8859-1
diff --git a/third-party/curl/tests/data/test1065 b/third-party/curl/tests/data/test1065
index 76c354846c..5b8b332065 100644
--- a/third-party/curl/tests/data/test1065
+++ b/third-party/curl/tests/data/test1065
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP GET
 </info>
 
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 A OK
 Server: curl test
 Content-Type: text/html; charset=iso-8859-1
@@ -16,7 +17,7 @@ Content-Length: 3
 
 ok
 </data>
-<data2 nocheck="yes">
+<data2 crlf="headers" nocheck="yes">
 HTTP/1.1 200 A OK
 Server: curl test
 Content-Type: text/html; charset=iso-8859-1
@@ -28,14 +29,13 @@ still ok
 
 # Client-side
 <client>
-#
 <server>
 http
 </server>
- <name>
+<name>
 HTTP PUT with one file but two URLs
- </name>
- <command>
+</name>
+<command>
 -H "Expect:" -T %LOGDIR/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER.upload1 http://%HOSTIP:%HTTPPORT/%TESTNUMBER0002.url2
 </command>
 <file name="%LOGDIR/%TESTNUMBER">
@@ -45,7 +45,7 @@ test
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER.upload1 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -59,7 +59,7 @@ User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 200 A OK
 Server: curl test
 Content-Type: text/html; charset=iso-8859-1
diff --git a/third-party/curl/tests/data/test1066 b/third-party/curl/tests/data/test1066
index 876a0815fa..1bb5a118b0 100644
--- a/third-party/curl/tests/data/test1066
+++ b/third-party/curl/tests/data/test1066
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP GET
 
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Server: thebest/1.0
 Content-Type: text/plain
@@ -16,7 +17,7 @@ Content-Length: 6
 
 first
 </data>
-<data1 nocheck="yes">
+<data1 crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Server: thebest/1.0
 Content-Type: text/plain
@@ -31,17 +32,17 @@ second
 <server>
 http
 </server>
- <name>
+<name>
 HTTP --dump-header - with two URLs
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER0001 --dump-header -
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -54,27 +55,27 @@ Accept: */*
 
 </protocol>
 <stdout>
-HTTP/1.1 200 OK
-HTTP/1.1 200 OK
-Server: thebest/1.0
-Server: thebest/1.0
-Content-Type: text/plain
-Content-Type: text/plain
-Content-Length: 6
-Content-Length: 6
-
-
+HTTP/1.1 200 OK%CR
+HTTP/1.1 200 OK%CR
+Server: thebest/1.0%CR
+Server: thebest/1.0%CR
+Content-Type: text/plain%CR
+Content-Type: text/plain%CR
+Content-Length: 6%CR
+Content-Length: 6%CR
+%CR
+%CR
 first
-HTTP/1.1 200 OK
-HTTP/1.1 200 OK
-Server: thebest/1.0
-Server: thebest/1.0
-Content-Type: text/plain
-Content-Type: text/plain
-Content-Length: 7
-Content-Length: 7
-
-
+HTTP/1.1 200 OK%CR
+HTTP/1.1 200 OK%CR
+Server: thebest/1.0%CR
+Server: thebest/1.0%CR
+Content-Type: text/plain%CR
+Content-Type: text/plain%CR
+Content-Length: 7%CR
+Content-Length: 7%CR
+%CR
+%CR
 second
 </stdout>
 </verify>
diff --git a/third-party/curl/tests/data/test1067 b/third-party/curl/tests/data/test1067
index e6f6bdda43..fbc5b42cb8 100644
--- a/third-party/curl/tests/data/test1067
+++ b/third-party/curl/tests/data/test1067
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -49,17 +50,17 @@ If this is received, the location following worked
 <server>
 http
 </server>
- <name>
+<name>
 HTTP Location: following with auto-referer
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER --silent --location --referer "firstone.html;auto" --write-out "%{stderr}|%{referer}|"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1068 b/third-party/curl/tests/data/test1068
index 64f4a93af0..e52624b9c4 100644
--- a/third-party/curl/tests/data/test1068
+++ b/third-party/curl/tests/data/test1068
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Similar to test 60
 <info>
@@ -10,7 +11,7 @@ chunked Transfer-Encoding
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.0 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -28,7 +29,7 @@ http
 <name>
 HTTP PUT from stdin
 </name>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/bzz/%TESTNUMBER -T -
 </command>
 <stdin>
@@ -39,18 +40,18 @@ more than one byte
 # Verify data after the test has been "shot"
 <verify>
 <protocol>
-PUT /bzz/%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Transfer-Encoding: chunked
-Expect: 100-continue
-
-13
+PUT /bzz/%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Transfer-Encoding: chunked%CR
+Expect: 100-continue%CR
+%CR
+13%CR
 more than one byte
-
-0
-
+%CR
+0%CR
+%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1069 b/third-party/curl/tests/data/test1069
index 2eb6659221..cddce01336 100644
--- a/third-party/curl/tests/data/test1069
+++ b/third-party/curl/tests/data/test1069
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -19,11 +20,11 @@ http
 <name>
 HTTP 1.0 PUT from stdin with no content length
 </name>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/bzz/%TESTNUMBER -T - -0
 </command>
 <stdin>
-this data can't be sent
+this data cannot be sent
 </stdin>
 </client>
 
diff --git a/third-party/curl/tests/data/test107 b/third-party/curl/tests/data/test107
index a8d0c4d81c..4cb8007b7f 100644
--- a/third-party/curl/tests/data/test107
+++ b/third-party/curl/tests/data/test107
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,9 +13,9 @@ STOR
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP PASV upload file
- </name>
+</name>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 data
     to
@@ -23,7 +24,7 @@ that FTP
 works
   so does it?
 </file>
- <command>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T %LOGDIR/test%TESTNUMBER.txt
 </command>
 </client>
@@ -38,7 +39,7 @@ that FTP
 works
   so does it?
 </upload>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1070 b/third-party/curl/tests/data/test1070
index 2d185c4a6f..6cb67967c2 100644
--- a/third-party/curl/tests/data/test1070
+++ b/third-party/curl/tests/data/test1070
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,9 @@ HTTP
 HTTP POST
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 403 Go away and swsclose
 Server: test-server/fake
 Content-Type: text/html
@@ -22,17 +22,16 @@ skip: 2300
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP POST with server closing connection before (all) data is received
- </name>
- <command>
- -d @%LOGDIR/input%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER -H "Expect: 100-continue"
+</name>
+<command>
+-d @%LOGDIR/input%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER -H "Expect: 100-continue"
 </command>
 <file name="%LOGDIR/input%TESTNUMBER">
 This creates the named file with this content before the test case is run,
@@ -41,14 +40,13 @@ rather large (larger than your typical TCP packet) so that not all of it can nor
 will be sent in one go as that is kind of the point of this test!
 
 Here's 2000 x 'O':
-OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO
+%repeat[2000 x O]%
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -57,7 +55,7 @@ Expect: 100-continue
 Content-Length: 2313
 Content-Type: application/x-www-form-urlencoded
 
-This creates 
+This creates%SP
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1071 b/third-party/curl/tests/data/test1071
index 99018b01e4..8e37701e8e 100644
--- a/third-party/curl/tests/data/test1071
+++ b/third-party/curl/tests/data/test1071
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Authorization is used to force curl to realize that the server is
 # speaking HTTP 1.0. The request must be resent with the correct
@@ -14,7 +15,7 @@ HTTP/1.0
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.0 401 Authorization Required swsclose
 Server: testcurl
 WWW-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -29,7 +30,7 @@ Try again on this HTTP 1.0 server!
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.0 200 OK swsclose
 Server: testcurl
 Content-Type: text/plain
@@ -39,7 +40,7 @@ Connection: close
 This IS the real page!
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.0 401 Authorization Required swsclose
 Server: testcurl
 WWW-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -68,11 +69,12 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
+<name>
 Downgraded HTTP PUT to HTTP 1.0 with authorization
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -T %LOGDIR/put%TESTNUMBER -u testuser:testpass --anyauth
 </command>
 <file name="%LOGDIR/put%TESTNUMBER">
@@ -85,7 +87,7 @@ four is the number of lines
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1072 b/third-party/curl/tests/data/test1072
index 289ea02e46..0544d67934 100644
--- a/third-party/curl/tests/data/test1072
+++ b/third-party/curl/tests/data/test1072
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Authorization is used to force curl to realize that the server is
 # speaking HTTP 1.0. The request is impossible to satisfy with HTTP 1.0
@@ -15,7 +16,7 @@ chunked Transfer-Encoding
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.0 401 Authorization Required swsclose
 Server: testcurl
 WWW-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -36,10 +37,10 @@ http
 <features>
 crypto
 </features>
- <name>
+<name>
 HTTP chunked PUT to HTTP 1.0 server with authorization
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -T - -u testuser:testpass --anyauth
 </command>
 <stdin>
@@ -56,25 +57,21 @@ which is impossible in HTTP/1.0
 25
 </errorcode>
 <protocol>
-PUT /%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Transfer-Encoding: chunked
-Expect: 100-continue
-
-%if hyper
-7A
-%else
-7a
-%endif
+PUT /%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Transfer-Encoding: chunked%CR
+Expect: 100-continue%CR
+%CR
+7a%CR
 This is data we upload with PUT
 it comes from stdin so MUST be sent
 with chunked encoding
 which is impossible in HTTP/1.0
-
-0
-
+%CR
+0%CR
+%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1073 b/third-party/curl/tests/data/test1073
index 6d02d13d63..ffb206327a 100644
--- a/third-party/curl/tests/data/test1073
+++ b/third-party/curl/tests/data/test1073
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Redirection is used to force curl to realize that the server is
 # speaking HTTP 1.0. The request is impossible to satisfy with HTTP 1.0
@@ -14,7 +15,7 @@ chunked Transfer-Encoding
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.0 301 Redirect swsclose
 Server: testcurl
 Content-Type: text/plain
@@ -30,10 +31,10 @@ Connection: close
 <server>
 http
 </server>
- <name>
+<name>
 HTTP chunked PUT to HTTP 1.0 server with redirect
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -T - -L
 </command>
 <stdin>
@@ -50,25 +51,21 @@ which is impossible in HTTP/1.0
 25
 </errorcode>
 <protocol>
-PUT /%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Transfer-Encoding: chunked
-Expect: 100-continue
-
-%if hyper
-7A
-%else
-7a
-%endif
+PUT /%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Transfer-Encoding: chunked%CR
+Expect: 100-continue%CR
+%CR
+7a%CR
 This is data we upload with PUT
 it comes from stdin so MUST be sent
 with chunked encoding
 which is impossible in HTTP/1.0
-
-0
-
+%CR
+0%CR
+%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1074 b/third-party/curl/tests/data/test1074
index 2432ca18bc..ee8c437f4c 100644
--- a/third-party/curl/tests/data/test1074
+++ b/third-party/curl/tests/data/test1074
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ DELAY
 
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.0 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 9
@@ -18,7 +19,7 @@ Connection: Keep-Alive
 
 surprise
 </data>
-<data1>
+<data1 crlf="headers">
 HTTP/1.0 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
@@ -36,17 +37,17 @@ wait 1
 <server>
 http
 </server>
- <name>
+<name>
 HTTP downgrade to HTTP/1.0 on second request
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER http://%HOSTIP:%HTTPPORT/wantmore/%TESTNUMBER0001
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.0 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 9
@@ -60,7 +61,7 @@ Connection: close
 surprise2
 </stdout>
 
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1075 b/third-party/curl/tests/data/test1075
index b87f60b1c5..6f2a21bba1 100644
--- a/third-party/curl/tests/data/test1075
+++ b/third-party/curl/tests/data/test1075
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,8 +13,8 @@ HTTP Basic auth
 <reply>
 # The test server provides no way to respond differently to a subsequent
 # Basic authenticated request (we really want to respond with 200 for
-# the second), so just respond with 401 for both and let curl deal with it.
-<data>
+# the second), so respond with 401 for both and let curl deal with it.
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required
 Server: testcurl
 WWW-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -23,7 +24,7 @@ Content-Type: text/plain
 Content-Length: 0
 
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required
 Server: testcurl
 WWW-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -48,10 +49,10 @@ Content-Length: 0
 <server>
 http
 </server>
- <name>
+<name>
 HTTP PUT with --anyauth authorization (picking Basic)
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -T %LOGDIR/put%TESTNUMBER -u testuser:testpass --anyauth
 </command>
 <file name="%LOGDIR/put%TESTNUMBER">
@@ -64,7 +65,7 @@ four is the number of lines
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -77,7 +78,7 @@ line three
 four is the number of lines
 PUT /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6dGVzdHBhc3M=
+Authorization: Basic %b64[testuser:testpass]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Content-Length: 85
diff --git a/third-party/curl/tests/data/test1076 b/third-party/curl/tests/data/test1076
index d01e178c69..cde0fac9e4 100644
--- a/third-party/curl/tests/data/test1076
+++ b/third-party/curl/tests/data/test1076
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,11 @@ HTTP POST
 followlocation
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
 HTTP/1.1 302 OK swsclose
-Location: moo.html&testcase=/%TESTNUMBER0002
+Location: moo.html%AMPtestcase=/%TESTNUMBER0002
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
 
@@ -26,7 +26,7 @@ body
 </data2>
 <datacheck>
 HTTP/1.1 302 OK swsclose
-Location: moo.html&testcase=/%TESTNUMBER0002
+Location: moo.html%AMPtestcase=/%TESTNUMBER0002
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
 
@@ -39,24 +39,22 @@ body
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP POST with 302 redirect and --post302
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/blah/%TESTNUMBER -L -d "moo" --post302
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /blah/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -64,7 +62,7 @@ Accept: */*
 Content-Length: 3
 Content-Type: application/x-www-form-urlencoded
 
-mooPOST /blah/moo.html&testcase=/%TESTNUMBER0002 HTTP/1.1
+mooPOST /blah/moo.html%AMPtestcase=/%TESTNUMBER0002 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test1077 b/third-party/curl/tests/data/test1077
index d89570f57e..243b37af67 100644
--- a/third-party/curl/tests/data/test1077
+++ b/third-party/curl/tests/data/test1077
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,10 +10,9 @@ HTTP proxy
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.0 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -23,7 +23,7 @@ Proxy-Connection: Keep-Alive
 
 contents
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.0 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -36,7 +36,6 @@ contents
 </data2>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -46,18 +45,17 @@ http
 ftp
 proxy
 </features>
- <name>
+<name>
 FTP over HTTP proxy with downgrade to HTTP 1.0
- </name>
- <command>
+</name>
+<command>
 -x %HOSTIP:%HTTPPORT ftp://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER ftp://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER0002
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET ftp://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1078 b/third-party/curl/tests/data/test1078
index c4f082c776..bd2ec246d3 100644
--- a/third-party/curl/tests/data/test1078
+++ b/third-party/curl/tests/data/test1078
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,16 +11,15 @@ proxytunnel
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 Server: test tunnel 2000
 
 </connect>
 
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.0 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -32,17 +32,16 @@ contents
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 http-proxy
 </server>
- <name>
+<name>
 HTTP 1.0 CONNECT with proxytunnel and downgrade GET to HTTP/1.0
- </name>
- <command>
+</name>
+<command>
 --proxy1.0 %HOSTIP:%PROXYPORT -p http://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER http://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER
 </command>
 <features>
@@ -50,17 +49,16 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 CONNECT %HOSTIP:%HTTPPORT HTTP/1.0
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
 </proxy>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -72,7 +70,7 @@ User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 Server: test tunnel 2000
 
diff --git a/third-party/curl/tests/data/test1079 b/third-party/curl/tests/data/test1079
index dd7f0d8a1a..5a4b9f2bab 100644
--- a/third-party/curl/tests/data/test1079
+++ b/third-party/curl/tests/data/test1079
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ HTTP Digest auth
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145"
@@ -25,7 +26,7 @@ This is not the real page
 <data1000>
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145"
@@ -44,11 +45,12 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP retry after closed connection and empty response
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --digest
 </command>
 </client>
@@ -58,7 +60,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --digest
 <errorcode>
 52
 </errorcode>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test108 b/third-party/curl/tests/data/test108
index 6bed372541..db50f86e67 100644
--- a/third-party/curl/tests/data/test108
+++ b/third-party/curl/tests/data/test108
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -17,10 +18,10 @@ STOR
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP PORT upload with CWD
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/CWD/STOR/RETR/%TESTNUMBER -T %LOGDIR/upload%TESTNUMBER -P -
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
@@ -36,7 +37,7 @@ Moooooooooooo
 ^PORT \d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3}
 ^EPRT \|1\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|\d{1,5}\|
 </strip>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1080 b/third-party/curl/tests/data/test1080
index 14ff135110..d2d7599322 100644
--- a/third-party/curl/tests/data/test1080
+++ b/third-party/curl/tests/data/test1080
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ followlocation
 
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 301 This is a weirdo text message swsclose
 Location: data/%TESTNUMBER0002.txt?coolsite=yes
 Content-Length: 62
@@ -26,17 +27,17 @@ This server reply is for testing a simple Location: following
 <server>
 http
 </server>
- <name>
+<name>
 HTTP Location: on two URLs 'redirect_url' check
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER -w '%{redirect_url}\n'
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/our/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -48,7 +49,7 @@ User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 301 This is a weirdo text message swsclose
 Location: data/%TESTNUMBER0002.txt?coolsite=yes
 Content-Length: 62
diff --git a/third-party/curl/tests/data/test1081 b/third-party/curl/tests/data/test1081
index 5c060bf828..5d1a3c7a9e 100644
--- a/third-party/curl/tests/data/test1081
+++ b/third-party/curl/tests/data/test1081
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ followlocation
 
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 301 This is a weirdo text message swsclose
 Location: data/%TESTNUMBER0099.txt?coolsite=yes
 Content-Length: 62
@@ -19,7 +20,7 @@ Connection: close
 
 This server reply is for testing a simple Location: following
 </data>
-<data2 nocheck="yes">
+<data2 crlf="headers" nocheck="yes">
 HTTP/1.1 200 Followed here fine swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -34,17 +35,17 @@ This second URL does not have a location
 <server>
 http
 </server>
- <name>
+<name>
 HTTP no Location: on second URL 'redirect_url' check
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER0002 -w '%{redirect_url}\n'
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/our/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -56,7 +57,7 @@ User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 301 This is a weirdo text message swsclose
 Location: data/%TESTNUMBER0099.txt?coolsite=yes
 Content-Length: 62
diff --git a/third-party/curl/tests/data/test1082 b/third-party/curl/tests/data/test1082
index ad3f0e5d94..269ea1ba04 100644
--- a/third-party/curl/tests/data/test1082
+++ b/third-party/curl/tests/data/test1082
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Mon, 28 Jul 2008 14:49:00 GMT
 Server: test-server/fake
@@ -22,27 +22,25 @@ Content-Type: text/plain
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with localhost --interface
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -4 --interface 127.0.0.1
 </command>
 <precheck>
-perl -e "print 'Test requires default test client host address' if ( '%CLIENTIP' ne '127.0.0.1' );"
+%PERL -e "print 'Test requires default test client host address' if('%CLIENTIP' ne '127.0.0.1');"
 </precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1083 b/third-party/curl/tests/data/test1083
index 7dd6f02e90..e470194bbe 100644
--- a/third-party/curl/tests/data/test1083
+++ b/third-party/curl/tests/data/test1083
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ IPv6
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Mon, 28 Jul 2008 14:49:00 GMT
 Server: test-server/fake
@@ -23,30 +23,28 @@ Content-Type: text/plain
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-ipv6
+IPv6
 </features>
 <server>
 http-ipv6
 </server>
- <name>
+<name>
 HTTP-IPv6 GET with ip6-localhost --interface
- </name>
- <command>
+</name>
+<command>
 -g "http://%HOST6IP:%HTTP6PORT/%TESTNUMBER" --interface ip6-localhost
 </command>
 <precheck>
-perl -e "if ('%CLIENT6IP' ne '[::1]') {print 'Test requires default test client host address';} else {exec './server/resolve --ipv6 ip6-localhost'; print 'Cannot run precheck resolve';}"
+%PERL -e "if('%CLIENT6IP' ne '[::1]') {print 'Test requires default test client host address';} else {exec '%RESOLVE --ipv6 ip6-localhost'; print 'Cannot run precheck resolve';}"
 </precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOST6IP:%HTTP6PORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1084 b/third-party/curl/tests/data/test1084
index 7a6292b88a..66335111f8 100644
--- a/third-party/curl/tests/data/test1084
+++ b/third-party/curl/tests/data/test1084
@@ -1,37 +1,31 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
 --interface
-FAILURE
 non-existing host
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 http
 </features>
-<server>
-none
-</server>
- <name>
+<name>
 HTTP GET with invalid --interface
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%NOLISTENPORT/%TESTNUMBER --interface non-existing-host.haxx.se.
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test1085 b/third-party/curl/tests/data/test1085
index 582fdb085f..2b692ffee3 100644
--- a/third-party/curl/tests/data/test1085
+++ b/third-party/curl/tests/data/test1085
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,40 +6,33 @@ HTTP
 HTTP GET
 --interface
 IPv6
-FAILURE
 non-existing host
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 http
-ipv6
+IPv6
 </features>
-<server>
-none
-</server>
- <name>
+<name>
 HTTP-IPv6 GET with invalid --interface
- </name>
- <command>
+</name>
+<command>
 -g "http://%HOST6IP:%NOLISTENPORT/%TESTNUMBER" --interface non-existing-host.haxx.se.
 </command>
 # Ensure the IPv6 stack is operational before running this test (other tests
 # use the startup of the IPv6 test server as a substitute check for this).
 <precheck>
-./server/resolve --ipv6 ::1
+%RESOLVE --ipv6 ::1
 </precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test1086 b/third-party/curl/tests/data/test1086
index 42a4cc341b..440aadfa0e 100644
--- a/third-party/curl/tests/data/test1086
+++ b/third-party/curl/tests/data/test1086
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,74 +6,24 @@ FTP
 EPSV
 RETR
 timeout
-FAILURE
-SLOWDOWN
+SLOWDOWNDATA
 flaky
+timing-dependent
 </keywords>
 </info>
 
 # Server-side
 <reply>
-# Overload some standard FTP responses to make them shorter and faster
-# to avoid wasting time waiting for the data phase to start
 <servercmd>
-SLOWDOWN
+SLOWDOWNDATA
+REPLY welcome 220 Hey
 REPLY USER 331 OK
 REPLY PASS 230 OK
 REPLY PWD 257 "/"
 REPLY TYPE 200 OK
 </servercmd>
 <data nocheck="yes">
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
+%repeat[50 x Long chunk of data that couldn't possibly be sent in the time allotted.%0a]%
 </data>
 </reply>
 
@@ -84,11 +35,11 @@ ftp
 <killserver>
 ftp
 </killserver>
- <name>
+<name>
 FTP download with strict timeout and slow data transfer
- </name>
- <command timeout="1">
-ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -m 7
+</name>
+<command>
+ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -m 5
 </command>
 </client>
 
@@ -98,7 +49,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -m 7
 <errorcode>
 28
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1087 b/third-party/curl/tests/data/test1087
index 9d412362e5..a3c3205877 100644
--- a/third-party/curl/tests/data/test1087
+++ b/third-party/curl/tests/data/test1087
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,17 +11,16 @@ followlocation
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data1000 nocheck="yes">
+<data1000 crlf="headers" nocheck="yes">
 HTTP/1.1 401 Authorization Required
 WWW-Authenticate: Basic
 Content-Type: text/plain
 Content-Length: 0
 
 </data1000>
-<data1001 nocheck="yes">
+<data1001 crlf="headers" nocheck="yes">
 HTTP/1.1 302 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -31,7 +31,7 @@ Content-Length: 0
 Connection: close
 
 </data1001>
-<data1002 nocheck="yes">
+<data1002 crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -42,7 +42,7 @@ Content-Length: 9
 contents
 </data1002>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required
 WWW-Authenticate: Basic
 Content-Type: text/plain
@@ -68,16 +68,15 @@ contents
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP, proxy with --anyauth and Location: to new host
- </name>
- <command>
+</name>
+<command>
 http://first.host.it.is/we/want/that/page/%TESTNUMBER1000 -x %HOSTIP:%HTTPPORT --user iam:myself --location --anyauth
 </command>
 <features>
@@ -85,10 +84,9 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://first.host.it.is/we/want/that/page/%TESTNUMBER1000 HTTP/1.1
 Host: first.host.it.is
 User-Agent: curl/%VERSION
@@ -97,7 +95,7 @@ Proxy-Connection: Keep-Alive
 
 GET http://first.host.it.is/we/want/that/page/%TESTNUMBER1000 HTTP/1.1
 Host: first.host.it.is
-Authorization: Basic aWFtOm15c2VsZg==
+Authorization: Basic %b64[iam:myself]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test1088 b/third-party/curl/tests/data/test1088
index 6edf686955..36d8e2496f 100644
--- a/third-party/curl/tests/data/test1088
+++ b/third-party/curl/tests/data/test1088
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,17 +12,16 @@ followlocation
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data1000 nocheck="yes">
+<data1000 crlf="headers" nocheck="yes">
 HTTP/1.1 401 Authorization Required
 WWW-Authenticate: Basic
 Content-Type: text/plain
 Content-Length: 0
 
 </data1000>
-<data1001 nocheck="yes">
+<data1001 crlf="headers" nocheck="yes">
 HTTP/1.1 302 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -32,7 +32,7 @@ Content-Length: 0
 Connection: close
 
 </data1001>
-<data1003 nocheck="yes">
+<data1003 crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -43,7 +43,7 @@ Content-Length: 9
 contents
 </data1003>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required
 WWW-Authenticate: Basic
 Content-Type: text/plain
@@ -69,16 +69,15 @@ contents
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP, proxy with --anyauth and Location: to new host using location-trusted
- </name>
- <command>
+</name>
+<command>
 http://first.host.it.is/we/want/that/page/%TESTNUMBER1000 -x %HOSTIP:%HTTPPORT --user iam:myself --location-trusted --anyauth
 </command>
 <features>
@@ -86,10 +85,9 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://first.host.it.is/we/want/that/page/%TESTNUMBER1000 HTTP/1.1
 Host: first.host.it.is
 User-Agent: curl/%VERSION
@@ -98,14 +96,14 @@ Proxy-Connection: Keep-Alive
 
 GET http://first.host.it.is/we/want/that/page/%TESTNUMBER1000 HTTP/1.1
 Host: first.host.it.is
-Authorization: Basic aWFtOm15c2VsZg==
+Authorization: Basic %b64[iam:myself]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
 
 GET http://goto.second.host.now/%TESTNUMBER1002 HTTP/1.1
 Host: goto.second.host.now
-Authorization: Basic aWFtOm15c2VsZg==
+Authorization: Basic %b64[iam:myself]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test1089 b/third-party/curl/tests/data/test1089
index f750b20134..18712ec086 100644
--- a/third-party/curl/tests/data/test1089
+++ b/third-party/curl/tests/data/test1089
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ followlocation
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 302 OK swsbounce swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 8
@@ -21,7 +21,7 @@ Location: ./%TESTNUMBER0001
 
 monster
 </data>
-<data1 nocheck="yes">
+<data1 crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 15
@@ -33,24 +33,22 @@ bigger monster
 
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET --write-out with redirected fetch
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w "%{num_connects}\n%{num_redirects}\n%{size_download}\n%{url_effective}\n%{content_type}\n%{response_code}\n" -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -63,7 +61,7 @@ Accept: */*
 
 </protocol>
 
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 302 OK swsbounce swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 8
diff --git a/third-party/curl/tests/data/test109 b/third-party/curl/tests/data/test109
index 0d0b164add..780ec2ba24 100644
--- a/third-party/curl/tests/data/test109
+++ b/third-party/curl/tests/data/test109
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -17,10 +18,10 @@ APPE
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP PASV upload append
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T %LOGDIR/upload%TESTNUMBER --append
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
@@ -31,7 +32,7 @@ Moooooooooooo
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1090 b/third-party/curl/tests/data/test1090
index 2ce4a1471f..b598c4472a 100644
--- a/third-party/curl/tests/data/test1090
+++ b/third-party/curl/tests/data/test1090
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,10 +10,9 @@ chunked Transfer-Encoding
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 302 OK swsbounce swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 8
@@ -22,7 +22,7 @@ Location: ./%TESTNUMBER0001
 
 monster
 </data>
-<data1 nocheck="yes">
+<data1 crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Transfer-Encoding: chunked
@@ -30,7 +30,7 @@ Connection: close
 Content-Type: text/plain; charset=us-ascii
 
 0007
-bigger 
+bigger%SP
 0008
 monster
 
@@ -40,24 +40,22 @@ monster
 
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET --write-out with redirected fetch and chunked reply
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w "%{num_connects}\n%{num_redirects}\n%{size_download}\n%{url_effective}\n%{content_type}\n%{response_code}\n" -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -70,7 +68,7 @@ Accept: */*
 
 </protocol>
 
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 302 OK swsbounce swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 8
diff --git a/third-party/curl/tests/data/test1091 b/third-party/curl/tests/data/test1091
index de63953041..948ba57640 100644
--- a/third-party/curl/tests/data/test1091
+++ b/third-party/curl/tests/data/test1091
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # based on test 143
 <info>
@@ -20,17 +21,17 @@ bla bla bla
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP URL with type=i
- </name>
- <command>
+</name>
+<command>
 "ftp://%HOSTIP:%FTPPORT/%2ftmp/moo/%TESTNUMBER;type=i" --use-ascii
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1092 b/third-party/curl/tests/data/test1092
index f1f49b0593..f6671f05ad 100644
--- a/third-party/curl/tests/data/test1092
+++ b/third-party/curl/tests/data/test1092
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ HTTP proxy
 type=
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -22,7 +22,6 @@ contents
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -32,18 +31,17 @@ http
 ftp
 proxy
 </features>
- <name>
+<name>
 FTP with type=i over HTTP proxy
- </name>
- <command>
+</name>
+<command>
 "ftp://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER;type=i" --use-ascii -x %HOSTIP:%HTTPPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET ftp://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER;type=i HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1093 b/third-party/curl/tests/data/test1093
index 3d903412e2..1af9981b9b 100644
--- a/third-party/curl/tests/data/test1093
+++ b/third-party/curl/tests/data/test1093
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ mode=
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -18,21 +18,19 @@ returned
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 tftp
 </server>
- <name>
-TFTP retrieve with mode=i
- </name>
- <command>
-"tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER;mode=i" --use-ascii
+<name>
+TFTP retrieve with mode=octet
+</name>
+<command>
+"tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER;mode=octet" --use-ascii
 </command>
 </client>
 
-#
 # Verify pseudo protocol after the test has been "shot"
 <verify>
 <strip>
diff --git a/third-party/curl/tests/data/test1094 b/third-party/curl/tests/data/test1094
index a902f53a20..56b2a0e9c2 100644
--- a/third-party/curl/tests/data/test1094
+++ b/third-party/curl/tests/data/test1094
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ mode=
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -16,7 +16,7 @@ data
 returned
  to client
 </data>
-<datacheck>
+<datacheck crlf="yes">
 a chunk of
 data
 returned
@@ -24,21 +24,19 @@ returned
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 tftp
 </server>
- <name>
+<name>
 TFTP retrieve with mode=netascii
- </name>
- <command>
+</name>
+<command>
 "tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER;mode=netascii"
 </command>
 </client>
 
-#
 # Verify pseudo protocol after the test has been "shot"
 <verify>
 <strip>
diff --git a/third-party/curl/tests/data/test1095 b/third-party/curl/tests/data/test1095
index 43550f57c9..1d8a0eb99a 100644
--- a/third-party/curl/tests/data/test1095
+++ b/third-party/curl/tests/data/test1095
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP Digest auth
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="test \"this\" realm!!", nonce="1053604145"
@@ -20,7 +21,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -29,7 +30,7 @@ Content-Length: 23
 This IS the real page!
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="test \"this\" realm!!", nonce="1053604145"
@@ -54,18 +55,19 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP with Digest and realm with quoted quotes
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --digest
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1096 b/third-party/curl/tests/data/test1096
index e2da941c19..971aef1cb1 100644
--- a/third-party/curl/tests/data/test1096
+++ b/third-party/curl/tests/data/test1096
@@ -1,10 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
 PASV
 RETR
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -20,10 +20,10 @@ REPLY SIZE 500 command not understood
 <server>
 ftp
 </server>
- <name>
+<name>
 Two FTP downloads, with failed RETR but reused control connection
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/dir/%TESTNUMBER ftp://%HOSTIP:%FTPPORT/dir/%TESTNUMBER
 </command>
 </client>
@@ -33,7 +33,7 @@ ftp://%HOSTIP:%FTPPORT/dir/%TESTNUMBER ftp://%HOSTIP:%FTPPORT/dir/%TESTNUMBER
 <errorcode>
 78
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1097 b/third-party/curl/tests/data/test1097
index 07c63600e1..2bc1669e83 100644
--- a/third-party/curl/tests/data/test1097
+++ b/third-party/curl/tests/data/test1097
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ HTTP proxy NTLM auth
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 We are fine and cool
 Server: Apache/1.3.27 (Dorw1n) PHP/44.1.2
 Content-Length: 27
@@ -20,13 +21,13 @@ This is all fine and dandy
 </data>
 
 # This is the CONNECT response
-<connect1001>
+<connect1001 crlf="headers">
 HTTP/1.1 200 We are fine and cool
 Server: Apache/1.3.27 (Dorw1n) PHP/44.1.2
 
 </connect1001>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 We are fine and cool
 Server: Apache/1.3.27 (Dorw1n) PHP/44.1.2
 
@@ -49,20 +50,20 @@ SSL
 !SSPI
 proxy
 </features>
- <name>
+<name>
 HTTP POST using CONNECT with --proxy-ntlm but no auth is required
- </name>
- <command>
+</name>
+<command>
 http://test.a.galaxy.far.far.away.%TESTNUMBER:%HTTPPORT/%TESTNUMBER --proxy http://%HOSTIP:%HTTPPORT --proxy-user foo:bar --proxy-ntlm -d "dummy=value" -p
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 CONNECT test.a.galaxy.far.far.away.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: test.a.galaxy.far.far.away.%TESTNUMBER:%HTTPPORT
-Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Proxy-Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
diff --git a/third-party/curl/tests/data/test1098 b/third-party/curl/tests/data/test1098
index b31cf9574f..c5e46b4c3e 100644
--- a/third-party/curl/tests/data/test1098
+++ b/third-party/curl/tests/data/test1098
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ CURLOPT_PROXY
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
@@ -20,7 +20,6 @@ hello
 
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -31,19 +30,18 @@ http
 ftp
 proxy
 </features>
- <name>
+<name>
 FTP RETR twice over proxy confirming persistent connection
- </name>
+</name>
 
- <command>
+<command>
 ftp://ftp-site/moo/%TESTNUMBER ftp://ftp-site/moo/%TESTNUMBER --proxy http://%HOSTIP:%HTTPPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET ftp://ftp-site/moo/%TESTNUMBER HTTP/1.1
 Host: ftp-site:21
 User-Agent: curl/%VERSION
@@ -57,7 +55,7 @@ Accept: */*
 Proxy-Connection: Keep-Alive
 
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
diff --git a/third-party/curl/tests/data/test1099 b/third-party/curl/tests/data/test1099
index 34cd99129d..a38038713f 100644
--- a/third-party/curl/tests/data/test1099
+++ b/third-party/curl/tests/data/test1099
@@ -1,9 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 TFTP
 TFTP RRQ
-FAILURE
 </keywords>
 </info>
 
@@ -13,21 +13,19 @@ data for %TESTNUMBER
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 tftp
 </server>
- <name>
+<name>
 TFTP get first a non-existing file then an existing
- </name>
- <command>
+</name>
+<command>
 tftp://%HOSTIP:%TFTPPORT/an/invalid-file tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify pseudo protocol after the test has been "shot"
 <verify>
 <strip>
diff --git a/third-party/curl/tests/data/test11 b/third-party/curl/tests/data/test11
index c5ac58bc37..d8a07fad3a 100644
--- a/third-party/curl/tests/data/test11
+++ b/third-party/curl/tests/data/test11
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -49,17 +50,17 @@ If this is received, the location following worked
 <server>
 http
 </server>
- <name>
+<name>
 simple HTTP Location: following
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -L
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test110 b/third-party/curl/tests/data/test110
index 59c56f1f91..eac9d192a8 100644
--- a/third-party/curl/tests/data/test110
+++ b/third-party/curl/tests/data/test110
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -26,17 +27,17 @@ REPLY EPSV 500 no such command
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download resume with set limit
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -C 20
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1100 b/third-party/curl/tests/data/test1100
index b93d168ca0..7ca8a908f1 100644
--- a/third-party/curl/tests/data/test1100
+++ b/third-party/curl/tests/data/test1100
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,14 +10,14 @@ HTTP NTLM auth
 # Server-side
 <reply>
 
-<data>
+<data crlf="headers">
 HTTP/1.1 200 Thanks for this! swsclose
 Content-Length: 25
 
 This is the final page !
 </data>
 
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 401 Now gimme that second request of crap
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -28,7 +29,7 @@ This is not the real page either!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 302 Thanks for this, but we want to redir you!
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -38,7 +39,7 @@ Content-Length: 34
 This is not the real page either!
 </data1002>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Now gimme that second request of crap
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -65,33 +66,25 @@ This is the final page !
 NTLM
 SSL
 !SSPI
-debug
+Debug
 </features>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP POST with NTLM authorization and following a 302 redirect
- </name>
- <setenv>
-# we force our own host name, in order to make the test machine independent
-CURL_GETHOSTNAME=curlhost
-# we try to use the LD_PRELOAD hack, if not a debug build
-LD_PRELOAD=%PWD/libtest/.libs/libhostname.so
- </setenv>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --ntlm -L -d "stuff to send away"
 </command>
-<precheck>
-chkhostname curlhost
-</precheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
+<protocol crlf="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Content-Length: 0
@@ -99,7 +92,7 @@ Content-Type: application/x-www-form-urlencoded
 
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAIAAgAeAAAAAAAAAAAAAAAhoIBAFpkQwKRCZFMhjj0tw47wEjKHRHlvzfxQamFcheMuv8v+xeqphEO5V41xRd7R9deOXRlc3R1c2VyY3VybGhvc3Q=
+Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAALAAsAeAAAAAAAAAAAAAAAhoIBAFpkQwKRCZFMhjj0tw47wEjKHRHlvzfxQamFcheMuv8v+xeqphEO5V41xRd7R9deOXRlc3R1c2VyV09SS1NUQVRJT04=
 User-Agent: curl/%VERSION
 Accept: */*
 Content-Length: 18
@@ -110,5 +103,6 @@ Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
+</protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1101 b/third-party/curl/tests/data/test1101
index 53d3ea135d..5a2229e309 100644
--- a/third-party/curl/tests/data/test1101
+++ b/third-party/curl/tests/data/test1101
@@ -1,15 +1,18 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
 HTTP Basic auth
+HTTP proxy
+http_proxy
 NO_PROXY
 </keywords>
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -25,25 +28,25 @@ boo
 <server>
 http
 </server>
- <name>
-NO_PROXY test, with user name in URL
- </name>
+<name>
+NO_PROXY test, with username in URL
+</name>
 
 <setenv>
 no_proxy=%HOSTIP
 http_proxy=http://non-existing-host.haxx.se:3128/
 </setenv>
- <command>
+<command>
 http://user:secret@%HOSTIP:%HTTPPORT/gimme/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /gimme/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dXNlcjpzZWNyZXQ=
+Authorization: Basic %b64[user:secret]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test1102 b/third-party/curl/tests/data/test1102
index 24d85b82e3..ca001c5311 100644
--- a/third-party/curl/tests/data/test1102
+++ b/third-party/curl/tests/data/test1102
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -24,17 +25,17 @@ REPLY SITE 250 Name format set to 1
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP OS/400 server name format check
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1103 b/third-party/curl/tests/data/test1103
index 3fc7461b1b..4ad4c45416 100644
--- a/third-party/curl/tests/data/test1103
+++ b/third-party/curl/tests/data/test1103
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,17 +24,17 @@ REPLY SYST 215  unknown-OS runs this server
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP non-OS/400 server
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1104 b/third-party/curl/tests/data/test1104
index 9a9193c4be..b0a2756fc5 100644
--- a/third-party/curl/tests/data/test1104
+++ b/third-party/curl/tests/data/test1104
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -55,10 +56,10 @@ If this is received, the location following worked
 <server>
 http
 </server>
- <name>
+<name>
 HTTP cookie expiry date at Jan 1 00:00:00 GMT 1970
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -L -x %HOSTIP:%HTTPPORT -c %LOGDIR/cookies%TESTNUMBER.jar
 </command>
 <features>
@@ -69,7 +70,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1105 b/third-party/curl/tests/data/test1105
index 961c12ab3f..45251d3e7c 100644
--- a/third-party/curl/tests/data/test1105
+++ b/third-party/curl/tests/data/test1105
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ cookiejar
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -19,9 +20,9 @@ Funny-head: yesyes swsclose
 Set-Cookie: foobar=name;
 Set-Cookie: mismatch=this; domain=127.0.0.1; path="/silly/";
 Set-Cookie: partmatch=present; domain=.0.0.1; path=/;
-Set-Cookie: foo	bar=barfoo
-Set-Cookie: bar	foo=
-Set-Cookie: bar=foo	bar
+Set-Cookie: foo%TABbar=barfoo
+Set-Cookie: bar%TABfoo=
+Set-Cookie: bar=foo%TABbar
 
 </data>
 </reply>
@@ -31,39 +32,37 @@ Set-Cookie: bar=foo	bar
 <server>
 http
 </server>
- <name>
-HTTP with cookie parser and header recording
- </name>
- <command>
-"http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER?parm1=this*that/other/thing&parm2=foobar/%TESTNUMBER" -c %LOGDIR/cookie%TESTNUMBER.txt -d "userid=myname&password=mypassword"
+<name>
+HTTP POST with cookies
+</name>
+<command>
+"http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER?parm1=this*that/other/thing%AMPparm2=foobar/%TESTNUMBER" -c %LOGDIR/cookie%TESTNUMBER.txt -d "userid=myname%AMPpassword=mypassword"
 </command>
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 <features>
 cookies
+local-http
 </features>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
-POST /we/want/%TESTNUMBER?parm1=this*that/other/thing&parm2=foobar/%TESTNUMBER HTTP/1.1
+<protocol crlf="yes" nonewline="yes">
+POST /we/want/%TESTNUMBER?parm1=this*that/other/thing%AMPparm2=foobar/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 Content-Length: 33
 Content-Type: application/x-www-form-urlencoded
 
-userid=myname&password=mypassword
+userid=myname%AMPpassword=mypassword
 </protocol>
 <file name="%LOGDIR/cookie%TESTNUMBER.txt" mode="text">
 # Netscape HTTP Cookie File
 # https://curl.se/docs/http-cookies.html
 # This file was generated by libcurl! Edit at your own risk.
 
-127.0.0.1	FALSE	"/silly/"	FALSE	0	mismatch	this
-127.0.0.1	FALSE	/we/want/	FALSE	0	foobar	name
+127.0.0.1	FALSE	/silly	FALSE	0	mismatch	this
+127.0.0.1	FALSE	/we/want	FALSE	0	foobar	name
 </file>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1106 b/third-party/curl/tests/data/test1106
index c55687ad68..43af2003c4 100644
--- a/third-party/curl/tests/data/test1106
+++ b/third-party/curl/tests/data/test1106
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ HTTP proxy
 
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -29,14 +30,14 @@ proxy
 <server>
 http
 </server>
- <name>
+<name>
 FTP URL and with ftp_proxy environment variable set
- </name>
+</name>
 
 <setenv>
 ftp_proxy=http://%HOSTIP:%HTTPPORT/
 </setenv>
- <command>
+<command>
 ftp://%HOSTIP:23456/%TESTNUMBER
 </command>
 
@@ -44,7 +45,7 @@ ftp://%HOSTIP:23456/%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET ftp://%HOSTIP:23456/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:23456
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1107 b/third-party/curl/tests/data/test1107
index fbb6a6a468..b67bc5a554 100644
--- a/third-party/curl/tests/data/test1107
+++ b/third-party/curl/tests/data/test1107
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,10 +28,10 @@ REPLY PRET 200 fine
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP RETR PASV with PRET
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --ftp-pret
 </command>
 
@@ -38,7 +39,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --ftp-pret
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1108 b/third-party/curl/tests/data/test1108
index 5200ef7600..b7615ea6dc 100644
--- a/third-party/curl/tests/data/test1108
+++ b/third-party/curl/tests/data/test1108
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -20,10 +21,10 @@ REPLY PRET 550 unknown command
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP RETR PASV with PRET not supported
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --ftp-pret
 </command>
 
@@ -31,13 +32,13 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --ftp-pret
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
 PRET RETR %TESTNUMBER
 </protocol>
-# we expect that the server doesn't understand PRET
+# we expect that the server does not understand PRET
 <errorcode>
 84
 </errorcode>
diff --git a/third-party/curl/tests/data/test1109 b/third-party/curl/tests/data/test1109
index e3fe6b359a..658ea3323a 100644
--- a/third-party/curl/tests/data/test1109
+++ b/third-party/curl/tests/data/test1109
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Test that the fragment is not send as part of the path.
 <info>
@@ -22,18 +23,17 @@ hello
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with URL that contains fragment after the path
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER#test
 </command>
 </client>
 
-
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test111 b/third-party/curl/tests/data/test111
index 0cdcbf6c0c..10fbfa91cf 100644
--- a/third-party/curl/tests/data/test111
+++ b/third-party/curl/tests/data/test111
@@ -1,10 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
 EPSV
 Resume
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -19,10 +19,10 @@ FAILURE
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download resume beyond file size
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -C 2000
 </command>
 </client>
@@ -32,7 +32,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -C 2000
 <errorcode>
 36
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1110 b/third-party/curl/tests/data/test1110
index c9ac741fcb..f7a55aa549 100644
--- a/third-party/curl/tests/data/test1110
+++ b/third-party/curl/tests/data/test1110
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Test that the fragment is not send as part of the path
 # when it contains a query.
@@ -23,18 +24,17 @@ hello
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with URL that contains a fragment after the query part
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER?q=foobar#fragment
 </command>
 </client>
 
-
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER?q=foobar HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1111 b/third-party/curl/tests/data/test1111
index 4faf5ad4c5..6f3bdae158 100644
--- a/third-party/curl/tests/data/test1111
+++ b/third-party/curl/tests/data/test1111
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Test that no fragment is not send as part of the path
 # when the URI contains 2 '#' (does not follow RFC 2396)
@@ -23,18 +24,17 @@ hello
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with URL whose fragment contains a # (which is illegal)
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER?q=foobar#fragment#fragment2
 </command>
 </client>
 
-
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER?q=foobar HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1112 b/third-party/curl/tests/data/test1112
index f75db0094d..45ce8e0740 100644
--- a/third-party/curl/tests/data/test1112
+++ b/third-party/curl/tests/data/test1112
@@ -1,77 +1,29 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
+# This is the ftps equivalent of test1086
 <info>
 <keywords>
 FTPS
 EPSV
 RETR
 timeout
-FAILURE
-SLOWDOWN
+SLOWDOWNDATA
+timing-dependent
 </keywords>
 </info>
 
 # Server-side
 <reply>
-# Overload some standard FTP responses to make them shorter and faster
-# to avoid wasting time waiting for the data phase to start
 <servercmd>
-SLOWDOWN
+SLOWDOWNDATA
+REPLY welcome 220 Hey
 REPLY USER 331 OK
 REPLY PASS 230 OK
 REPLY PWD 257 "/"
 REPLY TYPE 200 OK
 </servercmd>
 <data nocheck="yes">
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
-Long chunk of data that couldn't possibly be sent in the time allotted.
+%repeat[50 x Long chunk of data that couldn't possibly be sent in the time allotted.%0a]%
 </data>
 </reply>
 
@@ -86,11 +38,11 @@ ftps
 <killserver>
 ftps
 </killserver>
- <name>
+<name>
 FTPS download with strict timeout and slow data transfer
- </name>
- <command timeout="1">
--k --ftp-ssl-control ftps://%HOSTIP:%FTPSPORT/%TESTNUMBER -m 16
+</name>
+<command>
+--insecure --ftp-ssl-control ftps://%HOSTIP:%FTPSPORT/%TESTNUMBER -m 5
 </command>
 </client>
 
@@ -100,7 +52,7 @@ FTPS download with strict timeout and slow data transfer
 <errorcode>
 28
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PBSZ 0
diff --git a/third-party/curl/tests/data/test1113 b/third-party/curl/tests/data/test1113
index bc47505c31..7486952f6e 100644
--- a/third-party/curl/tests/data/test1113
+++ b/third-party/curl/tests/data/test1113
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ flaky
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -40,7 +40,7 @@ FTP wildcard download - changed fnmatch, 2x perform (DOS LIST response)
 0
 </errorcode>
 # THERE SHOULD NOT BE "SIZE"! and one "USER/PASS"
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -62,9 +62,6 @@ EPSV
 RETR file.txt
 EPSV
 RETR someothertext.txt
-CWD /
-CWD fully_simulated
-CWD DOS
 EPSV
 TYPE A
 LIST
diff --git a/third-party/curl/tests/data/test1114 b/third-party/curl/tests/data/test1114
index 573eda4d2f..5391e0c48d 100644
--- a/third-party/curl/tests/data/test1114
+++ b/third-party/curl/tests/data/test1114
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -21,10 +22,10 @@ ftp
 <tool>
 lib576
 </tool>
- <name>
-FTP wildcard download - skip/parser_correctness/CURLOPT_FNMATCH_FUNCTION (DOS)
- </name>
- <command>
+<name>
+FTP wildcard download - skip/correctness/FNMATCH_FUNCTION (DOS)
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/fully_simulated/DOS/*
 </command>
 </client>
diff --git a/third-party/curl/tests/data/test1115 b/third-party/curl/tests/data/test1115
index 7ad5bca9fb..880fa6f808 100644
--- a/third-party/curl/tests/data/test1115
+++ b/third-party/curl/tests/data/test1115
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP 1xx response code
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 104 Experiment
 Server: Microsoft-IIS/5.0
 Date: Sun, 03 Apr 2005 14:57:45 GMT
@@ -25,21 +26,20 @@ Content-Length: 0
 
 # Client-side
 <client>
-#
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with unexpected 1xx response
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1116 b/third-party/curl/tests/data/test1116
index 94a672f0bf..0c328d48f2 100644
--- a/third-party/curl/tests/data/test1116
+++ b/third-party/curl/tests/data/test1116
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ chunked Transfer-Encoding
 DELAY
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 funky chunky!
 Server: fakeit/0.9 fakeitbad/1.0
 Transfer-Encoding: chunked
@@ -24,63 +24,55 @@ bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
 cccccccccccccccccccccccccccccccc
 
 0
-%if !hyper
 chunky-trailer: header data
 another-header: yes
-%endif
 
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 funky chunky!
 Server: fakeit/0.9 fakeitbad/1.0
 Transfer-Encoding: chunked
 Connection: mooo
 
 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbcccccccccccccccccccccccccccccccc
-%if !hyper
 chunky-trailer: header data
 another-header: yes
-%endif
 </datacheck>
 <servercmd>
 writedelay: 10
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with chunked trailer without Trailer:
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -D %LOGDIR/heads%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<file name="%LOGDIR/heads%TESTNUMBER">
+<file name="%LOGDIR/heads%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 funky chunky!
 Server: fakeit/0.9 fakeitbad/1.0
 Transfer-Encoding: chunked
 Connection: mooo
 
-%if !hyper
 chunky-trailer: header data
 another-header: yes
-%endif
 </file>
 </verify>
 
diff --git a/third-party/curl/tests/data/test1117 b/third-party/curl/tests/data/test1117
index 475b10f58e..07bb7cc43c 100644
--- a/third-party/curl/tests/data/test1117
+++ b/third-party/curl/tests/data/test1117
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ DELAY
 
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 416 Requested Range Not Satisfiable
 Date: Tue, 09 Sep 2010 14:49:00 GMT
 Accept-Ranges: bytes
@@ -20,7 +21,7 @@ This is a long error message that is large enough that the test server is
 guaranteed to split it into two packets.
 </data>
 
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 206 Partial Content
 Date: Tue, 09 Sep 2010 14:49:01 GMT
 Accept-Ranges: bytes
@@ -32,7 +33,7 @@ partial body
 </data1>
 
 <servercmd>
-writedelay: 1000
+writedelay: 100
 </servercmd>
 </reply>
 
@@ -41,17 +42,17 @@ writedelay: 1000
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with invalid range then another URL
- </name>
- <command>
+</name>
+<command>
 -r 10-22 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER http://%HOSTIP:%HTTPPORT/wantmore/%TESTNUMBER0001
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 416 Requested Range Not Satisfiable
 Date: Tue, 09 Sep 2010 14:49:00 GMT
 Accept-Ranges: bytes
@@ -69,7 +70,7 @@ Content-Type: text/plain
 partial body
 </stdout>
 
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Range: bytes=10-22
diff --git a/third-party/curl/tests/data/test1118 b/third-party/curl/tests/data/test1118
index dd563856e5..dcee5d23cb 100644
--- a/third-party/curl/tests/data/test1118
+++ b/third-party/curl/tests/data/test1118
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -25,24 +25,22 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 URL without slash and @-letter in query
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT?email=name@example.com/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /?email=name@example.com/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1119 b/third-party/curl/tests/data/test1119
index 2f1b54c23c..0e1d4683f8 100644
--- a/third-party/curl/tests/data/test1119
+++ b/third-party/curl/tests/data/test1119
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,19 +7,14 @@ symbols-in-versions
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
-
- <name>
+<name>
 Verify that symbols-in-versions and headers are in sync
- </name>
+</name>
 
 <command type="perl">
-%SRCDIR/symbol-scan.pl %SRCDIR/.. ../include/curl
+%SRCDIR/test1119.pl %SRCDIR/.. ../include/curl
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test112 b/third-party/curl/tests/data/test112
index bd294c56d7..5637206bbf 100644
--- a/third-party/curl/tests/data/test112
+++ b/third-party/curl/tests/data/test112
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -16,14 +17,14 @@ Resume
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP PASV upload resume
- </name>
- <command>
-ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T %LOGDIR/upload%TESTNUMBER -C 40
+</name>
+<command>
+ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T %LOGDIR/upload%TESTNUMBER -C 41
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
-this is the *****crap******** that we're gonna upload
+this is the *****crap******** that we are gonna upload
 
 worx?
 </file>
@@ -31,7 +32,7 @@ worx?
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1120 b/third-party/curl/tests/data/test1120
index cd87f1a3d4..e5c223aa06 100644
--- a/third-party/curl/tests/data/test1120
+++ b/third-party/curl/tests/data/test1120
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ PORT
 RETR
 421
 timeout
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -21,10 +21,10 @@ REPLY CWD 421 Timeout!
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP with 421 timeout response
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER
 </command>
 </client>
@@ -32,7 +32,7 @@ ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER
 # Verify data after the test has been "shot"
 <verify>
 # Strip all valid kinds of PORT and EPRT that curl can send
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1121 b/third-party/curl/tests/data/test1121
index e18ef17ced..97f8b233cb 100644
--- a/third-party/curl/tests/data/test1121
+++ b/third-party/curl/tests/data/test1121
@@ -1,13 +1,13 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.0 200 OK
 Server: test-server/fake
 Content-Type: text/html
@@ -17,24 +17,22 @@ blaha
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP multiple provided Host: headers
- </name>
- <command>
+</name>
+<command>
 -H "Host: host1" -H "Host: host2" -H "Host: host3" http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: host1
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1122 b/third-party/curl/tests/data/test1122
index 9814c20e8a..b145bf8e3d 100644
--- a/third-party/curl/tests/data/test1122
+++ b/third-party/curl/tests/data/test1122
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,20 +8,24 @@ compressed
 Transfer-Encoding
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LIHN3c2Nsb3NlDQpEYXRlOiBNb24sIDI5IE5vdiAyMDA0IDIxOjU2OjUz
-IEdNVA0KU2VydmVyOiBBcGFjaGUvMS4zLjMxIChEZWJpYW4gR05VL0xpbnV4KSBtb2RfZ3ppcC8x
-LjMuMjYuMWEgUEhQLzQuMy45LTEgbW9kX3NzbC8yLjguMjAgT3BlblNTTC8wLjkuN2QgbW9kX3Bl
-cmwvMS4yOQ0KVmFyeTogQWNjZXB0LUVuY29kaW5nDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsg
-Y2hhcnNldD1JU08tODg1OS0xDQpUcmFuc2Zlci1FbmNvZGluZzogZ3ppcA0KQ29udGVudC1MZW5n
-dGg6IDQ0DQoNCh+LCAh5nqtBAANsYWxhbGEAy8nMS1Uw5FLIAdFGXAoQhjEXAAoCcWAYAAAA
+<data crlf="headers" nonewline="yes">
+HTTP/1.1 200 OK swsclose
+Date: Mon, 29 Nov 2004 21:56:53 GMT
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
+Vary: Accept-Encoding
+Content-Type: text/html; charset=ISO-8859-1
+Transfer-Encoding: gzip
+Content-Length: 44
+
+%hex[%1f%8b%08%08%79%9e%ab%41%00%03%6c%61%6c%61%6c%61%00%cb%c9%cc%4b%55%30%e4%52%c8%01%d1%46%5c]hex%
+%hex[%10%86%31%17%00]hex%
+%hex[%02%71%60%18%00%00%00]hex%
 </data>
 
 # This ignore Content-Length
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Mon, 29 Nov 2004 21:56:53 GMT
 Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
@@ -36,7 +41,6 @@ line 1
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -45,24 +49,23 @@ libz
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET gzip transfer-encoded content
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --tr-encoding
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Connection: TE
 TE: gzip
+Connection: TE
 
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test1123 b/third-party/curl/tests/data/test1123
index 146314fd84..236cb8e12c 100644
--- a/third-party/curl/tests/data/test1123
+++ b/third-party/curl/tests/data/test1123
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,165 +8,38 @@ compressed
 Transfer-Encoding
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBNb24sIDI5IE5vdiAyMDA0IDIxOjU2OjUzIEdNVA0KU2Vy
-dmVyOiBBcGFjaGUvMS4zLjMxIChEZWJpYW4gR05VL0xpbnV4KSBtb2RfZ3ppcC8xLjMuMjYuMWEg
-UEhQLzQuMy45LTEgbW9kX3NzbC8yLjguMjAgT3BlblNTTC8wLjkuN2QgbW9kX3BlcmwvMS4yOQ0K
-VmFyeTogQWNjZXB0LUVuY29kaW5nDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1J
-U08tODg1OS0xDQpUcmFuc2Zlci1FbmNvZGluZzogZGVmbGF0ZSwgY2h1bmtlZA0KDQo1MTkNCnic
-3FjbbuM2EH03kH9g/dQCtm62EzlwtChy2QTNNsHaBbpPBi3RNhtJFEjKuTz02zuUKImxHK93g74E
-SGJy5pzD4QxJk5l8ekpitCFcUJaedV3L6SKShiyi6eqsezO96/v+aNx3u5+CzuSXi7vz2bf7S5Rx
-9g8JZT+mQgIQTb9NZ5dfUHctZXZq20tOxDohWFopkfYChw8kjexl0tc80XesoRXJqAuiW1pBB6HK
-ptpNb06jwD12vYltGEpEhCWZ4ygigBiP/b7j9z0XOcNTxz31xhPb8BuEPFMfUeA5zrDvOn3XR453
-6sHPQFMqxKs4UpyQuVgzLoMw53EdjmFv45d5HBdwhNMIxXTRphYQHR4RoZY6Z0lSUlKCJGO1AMf8
-GS0ZR2FMSSr7gkYE/fX1FkmOU7GEilowi0bIUN4ZDKIC4XIEpVqpcFXfJY2JOOrkQnXUGOI5lfjJ
-QjcSiTzLQF+g69nsvlf8nfbQFbSPOldF++LmfNZDs8vbPy/h8/bid4Bd3dxe9orhP9/dX19+hTYM
-8EhiiKmU6mdMyJ5u5tAKGXugRBTaKM9ihiMYApZanpComXUPZViIR8Yj1YTI0jxZFPbp9PaoExIu
-6ZKGUFcw/UE4+JgoQ4FqPMEIxbQgGxl7JJxER53Fc5WkHpJr8mbGq7JYR53ZGqgIw++CpmozCUht
-nWqVYAabDnnOUSfG6SrHKyKKGEi6oZylCQwgQEeX0FgbGypxTOXzXISMk2B04g+t0cnE3rJvgTPC
-Q5AMBpZ7bGAr8xYa5vMAe21sIAuTXtcsy2PMm7GOR2OIYQjLedvTIlQDugPLd18RXodiOMpgnNEr
-tBEOx8W54VsjZ2LrjumZhywHXc+tvNrwClMO4g9qjDGAyBci5DSTcESKYKBOh9emEgalT8P1XO3l
-4IIscR7LiW0aSxjUf14dYBmUPdh5aFYnpa3Wiz2xW6xGbM0S8rYQLGDKSxV1eNomQ+vWAo2mXL0c
-LgdgraRojcjixTtcBMBaRNEakReaHS4CYC2iaI1IuIY9RmK2OlyqpmjBRqKR5VlyuCCAtZSiNSIR
-WRwuAmAtomiNCBNPh4sAWIsomlEvEanz8gdqVhKqumm6scxzDmkTJNDrt+oahdmIHyjJRlTF2AhD
-RN0cDldRaC1TEBudhHLO+OFKJV5rabJZ14QFVa2gWXpiCoccpODLzcz+G53D6QEpo3mCbkvHxK4Q
-Gq++p+Sck5jUmWuZ5/r+FpxYrmfBBekN9xtsda86OXb8UYtYXbDaHHUv2n1x2gUs52LvmswEzlEC
-E14zOZdr+KqGnLVMJRLnEm4yog6p7Ffd2qBPYJxSEqOpJCl8w68mtulsUaBKu+v+7wKvIqKKbCBb
-dM5iEtw9poTXuMJURWqboVa9agmrL3hOE5piac5OcrghFLWBgtadltfzjve5B3u5+5yu7+/lunvH
-haWxP+q9bvd4uM893kv2x3u9zl63O/pO3N8JbH9kg9bY5f1uu/ywJjJ4MsFDDK6jtU5tfEbyOSNn
-XU5CeB0om3pJ1YuywZkb2VFD7XLsJOp7C7hPhqoYO107mcbjrEXdfri9xZVUqg0Fdrizo1/1beq3
-nVoltt5pDeLtvLHi3obj/y9pzk9nbDh4Z8bU++rjJ8r1BiP3HZl6gafYx8/SwHOGJ+/I0jWhSYTj
-j5+o4XA08N6RqLAPT33xM3kyLPqsr/8rFHT+AwAA//+CMxGjYwAAAAD//wMA3TiO0Q0KMA0KDQo=
+<data>
+HTTP/1.1 200 OK%CR
+Date: Mon, 29 Nov 2004 21:56:53 GMT%CR
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29%CR
+Vary: Accept-Encoding%CR
+Content-Type: text/html; charset=ISO-8859-1%CR
+Transfer-Encoding: deflate, chunked%CR
+%CR
+519%CR
+%hex[%78%9c%dc%58%db%6e%e3%36%10%7d%37%90%7f%60%fd%d4%02%b6%6e%b6%13%39%70%b4%28%72%d9%04%cd%36%c1%da%05%ba%4f%06%2d%d1%36%1b%49%14%48%ca%b9%3c%f4%db%3b%94%28%89%b1%1c%af%77%83%be%04%48%62%72%e6%9c%c3%e1%0c%49%93%99%7c%7a%4a%62%b4%21%5c%50%96%9e%75%5d%cb%e9%22%92%86%2c%a2%e9%ea%ac%7b%33%bd%eb%fb%fe%68%dc%77%bb%9f%82%ce%e4%97%8b%bb%f3%d9%b7%fb%4b%94%71%f6%0f%09%65%3f%a6%42%02%10%4d%bf%4d%67%97%5f%50%77%2d%65%76%6a%db%4b%4e%c4%3a%21%58%5a%29%91%f6%02%87%0f%24%8d%ec%65%d2%d7%3c%d1%77%ac%a1%15%c9%a8%0b%a2%5b%5a%41%07%a1%ca%a6%da%4d%6f%4e%a3%c0%3d%76%bd%89%6d%18%4a%44%84%25%99%e3%28%22%80%18%8f%fd%be%e3%f7%3d%17%39%c3%53%c7%3d%f5%c6%13%db%f0%1b%84%3c%53%1f%51%e0%39%ce%b0%ef%3a%7d%d7%47%8e%77%ea%c1%cf%40%53%2a%c4%ab%38%52%9c%90%b9%58%33%2e%83%30%e7%71%1d%8e%61%6f%e3%97%79%1c%17%70%84%d3%08%c5%74%d1%a6%16%10%1d%1e%11%a1%96%3a%67%49%52%52%52%82%24%63%b5%00%c7%fc%19%2d%19%47%61%4c%49%2a%fb%82%46%04%fd%f5%f5%16%49%8e%53%b1%84%8a%5a%30%8b%46%c8%50%de%19%0c%a2%02%e1%72%04%a5%5a%a9%70%55%df%25%8d%89%38%ea%e4%42%75%d4%18%e2%39%95%f8%c9%42%37%12%89%3c%cb%40%5f%a0%eb%d9%ec%be%57%fc%9d%f6%d0%15%b4%8f%3a%57%45%fb%e2%e6%7c%d6%43%b3%cb%db%3f%2f%e1%f3%f6%e2%77%80%5d%dd%dc%5e%f6%8a%e1%3f%df%dd%5f%5f%7e%85%36%0c%f0%48%62%88%a9%94%ea%67%4c%c8%9e%6e%e6%d0]hex%
+%hex[%19%7b%a0%44%14%da%28%cf%62%86%23%18%02%96%5a%9e%90%a8%99%75%0f%65%58%88%47%c6%23%d5%84%c8%d2%3c%59%14%f6%e9%f4%f6%a8%13%12%2e%e9%92%86%50%57%30%fd%41%38%f8%98%28%43%81%6a%3c%c1%08%c5%b4%20%1b%19%7b%24%9c%44%47%9d%c5%73%95%a4%1e%92%6b%f2%66%c6%ab%b2%58%47%9d%d9%1a%a8%08%c3%ef%82%a6%6a%33%09%48%6d%9d%6a%95%60%06%9b%0e%79%ce%51%27%c6%e9%2a%c7%2b%22%8a%18%48%ba%a1%9c%a5%09%0c%20%40%47%97%d0%58%1b%1b%2a%71%4c%e5%f3%5c%84%8c%93%60%74%e2%0f%ad%d1%c9%c4%de%b2%6f%81%33%c2%43%90%0c%06%96%7b%6c%60%2b%f3%16%1a%e6%f3%00%7b%6d%6c%20%0b%93%5e%d7%2c%cb%63%cc%9b%b1%8e%47%63%88%61%08%cb%79%db%d3%22%54%03%ba%03%cb%77%5f%11%5e%87%62%38%ca%60%9c%d1%2b%b4%11%0e%c7%c5%b9%e1%5b%23%67%62%eb%8e%e9%99%87%2c%07%5d%cf%ad%bc%da%f0]hex%
+%hex[%53%0e%e2%0f%6a%8c%31%80%c8%17%22%e4%34%93%70%44%8a%60%a0%4e%87%d7%a6%12%06%a5%4f%c3%f5%5c%ed%e5%e0%82%2c%71%1e%cb%89%6d%1a%4b%18%d4%7f%5e%1d%60%19%94%3d%d8%79%68%56%27%a5%ad%d6%8b%3d%b1%5b%ac%46%6c%cd%12%f2%b6%10%2c%60%ca%4b%15%75%78%da%26%43%eb%d6%02%8d%a6%5c%bd%1c%2e%07%60%ad%a4%68%8d%c8%e2%c5%3b%5c%04%c0%5a%44%d1%1a%91%17%9a%1d%2e%02%60%2d%a2%68%8d%48%b8%86%3d%46%62%b6%3a%5c%aa%a6%68%c1%46%a2%91%e5%59%72%b8%20%80%b5%94%a2%35%22%11%59%1c%2e%02%60%2d%a2%68%8d%08%13%4f%87%8b%00%58%8b%28%9a%51%2f%11%a9%f3%f2%07%6a%56%12%aa%ba%69%ba%b1%cc%73%0e%69%13%24%d0%eb%b7%ea%1a%85%d9%88%1f%28%c9%46%54%c5%d8%08%43%44%dd%1c%0e%57%51%68%2d%53%10%1b%9d%84%72%ce%f8%e1%4a%25%5e%6b%69%b2%59%d7%84%05%55%ad%a0%59%7a%62]hex%
+%hex[%87%1c%a4%e0%cb%cd%cc%fe%1b%9d%c3%e9%01%29%a3%79%82%6e%4b%c7%c4%ae%10%1a%af%be%a7%e4%9c%93%98%d4%99%6b%99%e7%fa%fe%16%9c%58%ae%67%c1%05%e9%0d%f7%1b%6c%75%af%3a%39%76%fc%51%8b%58%5d%b0%da%1c%75%2f%da%7d%71%da%05%2c%e7%62%ef%9a%cc%04%ce%51%02%13%5e%33%39%97%6b%f8%aa%86%9c%b5%4c%25%12%e7%12%6e%32%a2%0e%a9%ec%57%dd%da%a0%4f%60%9c%52%12%a3%a9%24%29%7c%c3%af%26%b6%e9%6c%51%a0%4a%bb%eb%fe%ef%02%af%22%a2%8a%6c%20%5b%74%ce%62%12%dc%3d%a6%84%d7%b8%c2%54%45%6a%9b%a1%56%bd%6a%09%ab%2f%78%4e%13%9a%62%69%ce%4e%72%b8%21%14%b5%81%82%d6%9d%96%d7%f3%8e%f7%b9%07%7b%b9%fb%9c%ae%ef%ef%e5%ba%7b%c7%85%a5%b1%3f%ea%bd%6e%f7%78%b8%cf%3d%de%4b%f6%c7%7b%bd%ce%5e%b7%3b%fa%4e%dc%df%09%6c%7f%64%83%d6%d8%e5%fd%6e%bb%fc%b0%26%32%78%32%c1%43%0c%ae%a3%b5%4e%6d%7c%46%f2%39%23%67%5d%4e%42%78%1d%28%9b%7a%49%d5%8b%b2%c1%99%1b%d9%51%43%ed%72%ec%24%ea%7b%0b%b8%4f%86%aa%18%3b%5d%3b%99%c6%e3%ac%45%dd%7e%b8%bd%c5%95%54%aa%0d%05%76%b8%b3%a3%5f%f5%6d%ea%b7%9d%5a%25%b6%de%69%0d%e2%ed%bc%b1%e2%de%86%e3%ff%2f%69%ce%4f%67%6c%38%78%67%c6%d4%fb%ea%e3%27%ca%f5%06%23%f7%1d%99%7a%81%a7%d8%c7%cf%d2%c0%73%86%27%ef%c8%d2%35%a1%49%84%e3%8f%9f%a8%e1%70%34%f0%de%91%a8%b0%0f%4f%7d%f1%33%79%32%2c%fa%ac%af%ff%2b%14%74%fe%03%00%00%ff%ff%82%33%11%a3%63%00%00%00%00%ff%ff%03%00%dd%38%8e%d1%0d]hex%
+0%CR
+%CR
 </data>
 
 <datacheck>
-HTTP/1.1 200 OK
-Date: Mon, 29 Nov 2004 21:56:53 GMT
-Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
-Vary: Accept-Encoding
-Content-Type: text/html; charset=ISO-8859-1
-Transfer-Encoding: deflate, chunked
-
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE project-listing SYSTEM "http://freshmeat.net/backend/fm-projects-0.4.dtd">
-<project-listing>
-  <project>
-    <project_id>1612</project_id>
-    <date_added>1998-08-21 04:01:29</date_added>
-    <date_updated>2004-10-18 02:22:23</date_updated>
-    <projectname_short>curl</projectname_short>
-    <projectname_full>curl and libcurl</projectname_full>
-    <desc_short>Command line tool and library for client-side URL transfers.</desc_short>
-    <desc_full>curl and libcurl is a tool for transferring files
-using URL syntax. It supports HTTP, HTTPS, FTP,
-FTPS, DICT, TELNET, LDAP, FILE, and GOPHER, as
-well as HTTP-post, HTTP-put, cookies, FTP upload,
-resumed transfers, passwords, portnumbers, SSL
-certificates, Kerberos, and proxies. It is powered
-by libcurl, the client-side URL transfer library.
-There are bindings to libcurl for over 20
-languages and environments.
-</desc_full>
-    <vitality_score>5784.57</vitality_score>
-    <vitality_percent>3.16</vitality_percent>
-    <vitality_rank>169</vitality_rank>
-    <popularity_score>6594.54</popularity_score>
-    <popularity_percent>13.81</popularity_percent>
-    <popularity_rank>105</popularity_rank>
-    <rating>8.50</rating>
-    <rating_count>21</rating_count>
-    <rating_rank>183</rating_rank>
-    <subscriptions>323</subscriptions>
-    <branch_name>Default</branch_name>
-    <url_project_page>http://freshmeat.net/projects/curl/</url_project_page>
-    <url_homepage>http://freshmeat.net/redir/curl/1612/url_homepage/</url_homepage>
-    <url_tgz>http://freshmeat.net/redir/curl/1612/url_tgz/</url_tgz>
-    <url_bz2>http://freshmeat.net/redir/curl/1612/url_bz2/</url_bz2>
-    <url_zip>http://freshmeat.net/redir/curl/1612/url_zip/</url_zip>
-    <url_changelog>http://freshmeat.net/redir/curl/1612/url_changelog/</url_changelog>
-    <url_rpm>http://freshmeat.net/redir/curl/1612/url_rpm/</url_rpm>
-    <url_deb>http://freshmeat.net/redir/curl/1612/url_deb/</url_deb>
-    <url_osx>http://freshmeat.net/redir/curl/1612/url_osx/</url_osx>
-    <url_bsdport>http://freshmeat.net/redir/curl/1612/url_bsdport/</url_bsdport>
-    <url_purchase></url_purchase>
-    <url_cvs>http://freshmeat.net/redir/curl/1612/url_cvs/</url_cvs>
-    <url_list>http://freshmeat.net/redir/curl/1612/url_list/</url_list>
-    <url_mirror>http://freshmeat.net/redir/curl/1612/url_mirror/</url_mirror>
-    <url_demo></url_demo>
-    <license>MIT/X Consortium License</license>
-    <latest_release>
-      <latest_release_version>7.12.2</latest_release_version>
-      <latest_release_id>176085</latest_release_id>
-      <latest_release_date>2004-10-18 02:22:23</latest_release_date>
-    </latest_release>
-    <screenshot_thumb></screenshot_thumb>
-    <authors>
-      <author>
-        <author_name>Daniel Stenberg</author_name>
-        <author_url>http://freshmeat.net/~bagder/</author_url>
-        <author_role>Owner</author_role>
-      </author>
-    </authors>
-    <descriminators>
-      <trove_id>12</trove_id>
-      <trove_id>226</trove_id>
-      <trove_id>3</trove_id>
-      <trove_id>2</trove_id>
-      <trove_id>188</trove_id>
-      <trove_id>216</trove_id>
-      <trove_id>200</trove_id>
-      <trove_id>220</trove_id>
-      <trove_id>164</trove_id>
-      <trove_id>90</trove_id>
-      <trove_id>89</trove_id>
-      <trove_id>809</trove_id>
-      <trove_id>150</trove_id>
-      <trove_id>224</trove_id>
-      <trove_id>900</trove_id>
-      <trove_id>839</trove_id>
-    </descriminators>
-    <dependencies>
-      <dependency type="recommended">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>7464</dependency_branch_id>
-        <dependency_project_id>7464</dependency_project_id>
-        <dependency_project_title>OpenSSL (Default)</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>7443</dependency_project_id>
-        <dependency_project_title>OpenLDAP</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>12351</dependency_project_id>
-        <dependency_project_title>zlib</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>32047</dependency_project_id>
-        <dependency_project_title>Heimdal</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>44532</dependency_project_id>
-        <dependency_project_title>c-ares</dependency_project_title>
-      </dependency>
-    </dependencies>
-  </project>
-</project-listing>
+HTTP/1.1 200 OK%CR
+Date: Mon, 29 Nov 2004 21:56:53 GMT%CR
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29%CR
+Vary: Accept-Encoding%CR
+Content-Type: text/html; charset=ISO-8859-1%CR
+Transfer-Encoding: deflate, chunked%CR
+%CR
+%includetext %SRCDIR/data/data-xml1%
 </datacheck>
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -174,24 +48,23 @@ libz
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET deflate transfer-encoded content
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --tr-encoding
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Connection: TE
 TE: gzip
+Connection: TE
 
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test1124 b/third-party/curl/tests/data/test1124
index 94fa562a28..278c8c354b 100644
--- a/third-party/curl/tests/data/test1124
+++ b/third-party/curl/tests/data/test1124
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,18 +9,25 @@ Transfer-Encoding
 chunked Transfer-Encoding
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBNb24sIDI5IE5vdiAyMDI0IDIxOjU2OjUzIEdNVA0KU2Vy
-dmVyOiBTb21ldGhpbmctVEUtZnJpZW5kbHkvMC4xDQpWYXJ5OiBBY2NlcHQtRW5jb2RpbmcNCkNv
-bnRlbnQtVHlwZTogdGV4dC9odG1sOyBjaGFyc2V0PUlTTy04ODU5LTENClRyYW5zZmVyLUVuY29k
-aW5nOiBnemlwLCBjaHVua2VkDQoNCjE0DQofiwgIeZ6rQQADbGFsYWxhAMvJzA0KMTgNCktVMORS
-yAHRRlwKEIYxFwAKAnFgGAAAAA0KMA0KDQo=
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Mon, 29 Nov 2024 21:56:53 GMT
+Server: Something-TE-friendly/0.1
+Vary: Accept-Encoding
+Content-Type: text/html; charset=ISO-8859-1
+Transfer-Encoding: gzip, chunked
+
+2c
+%hex[%1f%8b%08%08%79%9e%ab%41%00%03%6c%61%6c%61%6c%61%00%cb%c9%cc%4b%55%30%e4%52%c8%01%d1%46%5c]hex%
+%hex[%10%86%31%17%00]hex%
+%hex[%02%71%60%18%00%00%00]hex%
+0
+
 </data>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Mon, 29 Nov 2024 21:56:53 GMT
 Server: Something-TE-friendly/0.1
@@ -34,7 +42,6 @@ line 1
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -43,24 +50,23 @@ libz
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET gzip+chunked transfer-encoded content
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --tr-encoding
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Connection: TE
 TE: gzip
+Connection: TE
 
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test1125 b/third-party/curl/tests/data/test1125
index 147d222de7..66533d69a9 100644
--- a/third-party/curl/tests/data/test1125
+++ b/third-party/curl/tests/data/test1125
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,19 +8,25 @@ compressed
 Transfer-Encoding
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBNb24sIDI5IE5vdiAyMDA0IDIxOjU2OjUzIEdNVA0KU2Vy
-dmVyOiBBcGFjaGUvMS4zLjMxIChEZWJpYW4gR05VL0xpbnV4KSBtb2RfZ3ppcC8xLjMuMjYuMWEg
-UEhQLzQuMy45LTEgbW9kX3NzbC8yLjguMjAgT3BlblNTTC8wLjkuN2QgbW9kX3BlcmwvMS4yOQ0K
-VmFyeTogQWNjZXB0LUVuY29kaW5nDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1J
-U08tODg1OS0xDQpUcmFuc2Zlci1FbmNvZGluZzogZ3ppcCwgY2h1bmtlZA0KDQoyYw0KH4sICHme
-q0EAA2xhbGFsYQDLycxLVTDkUsgB0UZcChCGMRcACgJxYBgAAAANCjANCg0K
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Mon, 29 Nov 2004 21:56:53 GMT
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
+Vary: Accept-Encoding
+Content-Type: text/html; charset=ISO-8859-1
+Transfer-Encoding: gzip, chunked
+
+2c
+%hex[%1f%8b%08%08%79%9e%ab%41%00%03%6c%61%6c%61%6c%61%00%cb%c9%cc%4b%55%30%e4%52%c8%01%d1%46%5c]hex%
+%hex[%10%86%31%17%00]hex%
+%hex[%02%71%60%18%00%00%00]hex%
+0
+
 </data>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Mon, 29 Nov 2004 21:56:53 GMT
 Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
@@ -34,7 +41,6 @@ line 1
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -43,24 +49,23 @@ libz
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET transfer-encoding with custom Connection:
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --tr-encoding -H "Connection: close"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Connection: close, TE
 TE: gzip
+Connection: close, TE
 
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test1126 b/third-party/curl/tests/data/test1126
index f03988080c..d6cdb05ddb 100644
--- a/third-party/curl/tests/data/test1126
+++ b/third-party/curl/tests/data/test1126
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 If-Modified-Since
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -21,24 +21,22 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP 200 If-Modified-Since with newer document
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -z "dec 12 12:00:00 1999 GMT"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1127 b/third-party/curl/tests/data/test1127
index a98eb741d4..92f3b89a10 100644
--- a/third-party/curl/tests/data/test1127
+++ b/third-party/curl/tests/data/test1127
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 If-Modified-Since
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -30,24 +30,22 @@ Content-Type: text/html
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP 200 If-Modified-Since with older document
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -z "dec 12 12:00:00 1999 GMT"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1128 b/third-party/curl/tests/data/test1128
index 718ec2c383..e8c2fe0a3c 100644
--- a/third-party/curl/tests/data/test1128
+++ b/third-party/curl/tests/data/test1128
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 If-Modified-Since
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -31,24 +31,22 @@ Content-Type: text/html
 </data1>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP 200 If-Modified-Since with old+new documents
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001 -z "dec 12 12:00:00 1999 GMT"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1129 b/third-party/curl/tests/data/test1129
index 043a7071d7..a065a8ef8c 100644
--- a/third-party/curl/tests/data/test1129
+++ b/third-party/curl/tests/data/test1129
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ Expect: 100-continue
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -37,7 +37,6 @@ skip: 1053700
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 # 1053700 x 'x'
@@ -47,15 +46,14 @@ skip: 1053700
 <server>
 http
 </server>
- <name>
+<name>
 HTTP POST expect 100-continue with a 404
- </name>
- <command option="no-output">
--d @%LOGDIR/file%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001
+</name>
+<command option="no-output">
+-d @%LOGDIR/file%TESTNUMBER --expect100-timeout 99 http://%HOSTIP:%HTTPPORT/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <stdout>
@@ -74,7 +72,7 @@ Content-Type: text/html
 
 -foo-
 </stdout>
-<protocol>
+<protocol crlf="headers">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -92,5 +90,8 @@ Content-Type: application/x-www-form-urlencoded
 Expect: 100-continue
 
 </protocol>
+<limits>
+Maximum allocated: 3200000
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test113 b/third-party/curl/tests/data/test113
index b784e63add..68637a12b8 100644
--- a/third-party/curl/tests/data/test113
+++ b/third-party/curl/tests/data/test113
@@ -1,8 +1,8 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -17,10 +17,10 @@ REPLY USER 314 bluah you fewl!
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download, failed login: USER not valid
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
@@ -30,7 +30,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 <errorcode>
 67
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test1130 b/third-party/curl/tests/data/test1130
index 3f85b4ef93..abbfc499a1 100644
--- a/third-party/curl/tests/data/test1130
+++ b/third-party/curl/tests/data/test1130
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ Expect: 100-continue
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -30,14 +30,14 @@ Content-Type: text/html
 -foo-
 </data1>
 
-# we use skip to make the test server never read the full payload off
-# the socket and instead return the response at once
+# We use skip to make the test server never read the full payload off
+# the socket and instead return the response at once. In actuality, the
+# long --expect100-timeout means that it never gets a chance to read this.
 <servercmd>
 skip: 100
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 # 100 x 'x'
@@ -47,15 +47,14 @@ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 <server>
 http
 </server>
- <name>
+<name>
 HTTP POST forced expect 100-continue with a 404
- </name>
- <command option="no-output">
--d @%LOGDIR/file%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001 -H "Expect: 100-continue"
+</name>
+<command option="no-output">
+-d @%LOGDIR/file%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001 -H "Expect: 100-continue" --expect100-timeout 99
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <stdout>
@@ -74,7 +73,7 @@ Content-Type: text/html
 
 -foo-
 </stdout>
-<protocol>
+<protocol crlf="headers">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1131 b/third-party/curl/tests/data/test1131
index 52bf05f72e..855121d278 100644
--- a/third-party/curl/tests/data/test1131
+++ b/third-party/curl/tests/data/test1131
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ Expect: 100-continue
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -30,14 +30,14 @@ Content-Type: text/html
 FAILURE2
 </data1>
 
-# we use skip to make the test server never read the full payload off
-# the socket and instead return the response at once
+# We use skip to make the test server never read the full payload off
+# the socket and instead return the response at once. In actuality, the
+# long --expect100-timeout means that it never gets a chance to read this.
 <servercmd>
 skip: 100
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 # 100 x 'x'
@@ -47,15 +47,14 @@ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 <server>
 http
 </server>
- <name>
+<name>
 HTTP PUT expect 100-continue with a 400
- </name>
- <command option="no-output">
--H "Expect: 100-continue" -T %LOGDIR/file%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER -T %LOGDIR/file%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001
+</name>
+<command option="no-output">
+-H "Expect: 100-continue" -T %LOGDIR/file%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER -T %LOGDIR/file%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001 --expect100-timeout 99
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <stdout>
@@ -74,7 +73,7 @@ Content-Type: text/html
 
 FAILURE2
 </stdout>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1132 b/third-party/curl/tests/data/test1132
index 8aa643224d..5ef2a371ca 100644
--- a/third-party/curl/tests/data/test1132
+++ b/third-party/curl/tests/data/test1132
@@ -1,25 +1,56 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
-source analysis
-memory-includes
+MQTT
+MQTT CONNACK
 </keywords>
 </info>
 
-#
+# Server-side
+<reply>
+<data nocheck="yes">
+hello
+</data>
+
+# Remaining Length must be 2 in a CONNACK
+<servercmd>
+remlen-CONNACK 3
+</servercmd>
+</reply>
+
 # Client-side
 <client>
+<features>
+mqtt
+</features>
 <server>
-none
+mqtt
 </server>
-
- <name>
-Verify memory #include files in libcurl's C source files
- </name>
-
-<command type="perl">
-%SRCDIR/mem-include-scan.pl %SRCDIR/../lib
+<name>
+MQTT CONNACK with bad Remaining Length
+</name>
+<command option="binary-trace">
+mqtt://%HOSTIP:%MQTTPORT/%TESTNUMBER
 </command>
 </client>
 
+# Verify data after the test has been "shot"
+<verify>
+# These are hexadecimal protocol dumps from the client
+# Strip out the random part of the client id from the CONNECT message
+# before comparison
+<strippart>
+s/^(.* 00044d5154540402003c000c6375726c).*/$1/
+</strippart>
+<protocol>
+client CONNECT 18 00044d5154540402003c000c6375726c
+server CONNACK 3 20030000
+</protocol>
+
+# 8 == CURLE_WEIRD_SERVER_REPLY
+<errorcode>
+8
+</errorcode>
+</verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1133 b/third-party/curl/tests/data/test1133
index 4c6aba7331..bb25c01666 100644
--- a/third-party/curl/tests/data/test1133
+++ b/third-party/curl/tests/data/test1133
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,7 @@ HTTP FORMPOST
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -25,11 +26,16 @@ Mime
 <server>
 http
 </server>
- <name>
+<name>
 HTTP RFC1867-type formposting with filename/data contains ',', ';', '"'
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -F "file=@\"%LOGDIR/test%TESTNUMBER,and;.txt\";type=mo/foo;filename=\"faker,and;.txt\"" -F 'file2=@"%LOGDIR/test%TESTNUMBER,and;.txt"' -F 'file3=@"%LOGDIR/test%TESTNUMBER,and;.txt";type=m/f,"%LOGDIR/test%TESTNUMBER,and;.txt"' -F a="{\"field1\":\"value1\",\"field2\":\"value2\"}" -F 'b=" \\value1;type=\"whatever\" "; type=text/foo; charset=utf-8 ; filename=param_b'
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER
+-F "file=@\"%LOGDIR/test%TESTNUMBER,and;.txt\";type=mo/foo;filename=\"faker,and;.txt\""
+-F 'file2=@"%LOGDIR/test%TESTNUMBER,and;.txt"'
+-F 'file3=@"%LOGDIR/test%TESTNUMBER,and;.txt";type=m/f,"%LOGDIR/test%TESTNUMBER,and;.txt"'
+-F a="{\"field1\":\"value1\",\"field2\":\"value2\"}"
+-F 'b=" \\value1;type=\"whatever\" "; type=text/foo; charset=utf-8 ; filename=param_b'
 </command>
 # We create this file before the command is invoked!
 <file name="%LOGDIR/test%TESTNUMBER,and;.txt">
@@ -46,60 +52,60 @@ foo
 ^(Content-Type: multipart/form-data;|Content-Type: multipart/mixed; boundary=|-------).*
 </strip>
 <protocol>
-POST /we/want/%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Content-Length: 1264
-Content-Type: multipart/form-data; boundary=----------------------------24e78000bd32
-
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="file"; filename="faker,and;.txt"
-Content-Type: mo/foo
-
+POST /we/want/%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Content-Length: 1324%CR
+Content-Type: multipart/form-data; boundary=----------------------------24e78000bd32%CR
+%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="file"; filename="faker,and;.txt"%CR
+Content-Type: mo/foo%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="file2"; filename="test%TESTNUMBER,and;.txt"
-Content-Type: text/plain
-
+%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="file2"; filename="test%TESTNUMBER,and;.txt"%CR
+Content-Type: text/plain%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="file3"
-Content-Type: multipart/mixed; boundary=----------------------------7f0e85a48b0b
-
-Content-Disposition: attachment; filename="test%TESTNUMBER,and;.txt"
-Content-Type: m/f
-
+%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="file3"%CR
+Content-Type: multipart/mixed; boundary=----------------------------7f0e85a48b0b%CR
+%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER,and;.txt"%CR
+Content-Type: m/f%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-Content-Disposition: attachment; filename="test%TESTNUMBER,and;.txt"
-Content-Type: text/plain
-
+%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER,and;.txt"%CR
+Content-Type: text/plain%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-
-Content-Disposition: form-data; name="a"
-
-{"field1":"value1","field2":"value2"}
-Content-Disposition: form-data; name="b"; filename="param_b"
-Content-Type: text/foo; charset=utf-8
-
- \value1;type="whatever" 
-------------------------------24e78000bd32--
+%CR
+%CR
+Content-Disposition: form-data; name="a"%CR
+%CR
+{"field1":"value1","field2":"value2"}%CR
+Content-Disposition: form-data; name="b"; filename="param_b"%CR
+Content-Type: text/foo; charset=utf-8%CR
+%CR
+ \value1;type="whatever" %CR
+------------------------------24e78000bd32--%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1134 b/third-party/curl/tests/data/test1134
index f3fbdfb260..72fcdbacad 100644
--- a/third-party/curl/tests/data/test1134
+++ b/third-party/curl/tests/data/test1134
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP HEAD
 -G
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <servercmd>
@@ -28,33 +28,31 @@ contents2
 </data1>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP connection reuse with different credentials
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u user1:password1 --next http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001 -u 2user:password2
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dXNlcjE6cGFzc3dvcmQx
+Authorization: Basic %b64[user1:password1]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
 GET /%TESTNUMBER0001 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic MnVzZXI6cGFzc3dvcmQy
+Authorization: Basic %b64[2user:password2]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test1135 b/third-party/curl/tests/data/test1135
index 0f055e9bc1..7bfa2f149e 100644
--- a/third-party/curl/tests/data/test1135
+++ b/third-party/curl/tests/data/test1135
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,23 +7,17 @@ CURL_EXTERN
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
-
 # The VMS and OS/400 builds extract the CURL_EXTERN protos and use in
 # the build. We break binary compatibility by changing order. Only add
 # new entries last or bump the SONAME.
-#
- <name>
+<name>
 Verify CURL_EXTERN order
- </name>
+</name>
 
 <command type="perl">
-%SRCDIR/extern-scan.pl %SRCDIR/..
+%SRCDIR/test1135.pl %SRCDIR/..
 </command>
 </client>
 
@@ -67,6 +62,8 @@ curl_version_info
 curl_easy_strerror
 curl_share_strerror
 curl_easy_pause
+curl_easy_ssls_import
+curl_easy_ssls_export
 curl_easy_init
 curl_easy_setopt
 curl_easy_perform
@@ -106,8 +103,13 @@ curl_multi_socket_all
 curl_multi_timeout
 curl_multi_setopt
 curl_multi_assign
+curl_multi_get_handles
+curl_multi_get_offt
 curl_pushheader_bynum
 curl_pushheader_byname
+curl_multi_waitfds
+curl_multi_notify_disable
+curl_multi_notify_enable
 curl_easy_option_by_name
 curl_easy_option_by_id
 curl_easy_option_next
@@ -119,6 +121,7 @@ curl_url_set
 curl_url_strerror
 curl_ws_recv
 curl_ws_send
+curl_ws_start_frame
 curl_ws_meta
 </stdout>
 </verify>
diff --git a/third-party/curl/tests/data/test1136 b/third-party/curl/tests/data/test1136
index a82079248c..6d9cde3b4c 100644
--- a/third-party/curl/tests/data/test1136
+++ b/third-party/curl/tests/data/test1136
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -34,6 +35,7 @@ boo
 <features>
 PSL
 proxy
+cookies
 </features>
 <server>
 http
diff --git a/third-party/curl/tests/data/test1137 b/third-party/curl/tests/data/test1137
index eabc4777e9..73bbfaab13 100644
--- a/third-party/curl/tests/data/test1137
+++ b/third-party/curl/tests/data/test1137
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,10 +28,10 @@ REPLY EPSV 500 no such command
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP RETR --ignore-content-length
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --ignore-content-length
 </command>
 
@@ -38,7 +39,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --ignore-content-length
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1138 b/third-party/curl/tests/data/test1138
index 1797c6b3b5..1d8987c1ed 100644
--- a/third-party/curl/tests/data/test1138
+++ b/third-party/curl/tests/data/test1138
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,16 @@ HTTP GET
 followlocation
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 302 OK swsclose
-Location: ../moo.html/?name=آغاز-سم-زدایی-از-بازار-پول&testcase=/%TESTNUMBER0002
+Location: ../moo.html/?name=%hex[%d8%a2%d8%ba%d8%a7%d8%b2%2d%d8%b3%d9%85%2d%d8%b2%d8%af%d8%a7%db%8c%db%8c%2d%d8%a7%d8%b2%2d%d8%a8%d8%a7%d8%b2%d8%a7%d8%b1%2d%d9%be%d9%88%d9%84]hex%%AMPtestcase=/%TESTNUMBER0002
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
 
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Location: this should be ignored
 Date: Tue, 09 Nov 2010 14:49:00 GMT
@@ -24,9 +24,9 @@ Connection: close
 
 body
 </data2>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 302 OK swsclose
-Location: ../moo.html/?name=آغاز-سم-زدایی-از-بازار-پول&testcase=/%TESTNUMBER0002
+Location: ../moo.html/?name=%hex[%d8%a2%d8%ba%d8%a7%d8%b2%2d%d8%b3%d9%85%2d%d8%b2%d8%af%d8%a7%db%8c%db%8c%2d%d8%a7%d8%b2%2d%d8%a8%d8%a7%d8%b2%d8%a7%d8%b1%2d%d9%be%d9%88%d9%84]hex%%AMPtestcase=/%TESTNUMBER0002
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
 
@@ -39,30 +39,28 @@ body
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP redirect with UTF-8 characters
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/are/all/twits/%TESTNUMBER -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/are/all/twits/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
-GET /we/are/all/moo.html/?name=%d8%a2%d8%ba%d8%a7%d8%b2-%d8%b3%d9%85-%d8%b2%d8%af%d8%a7%db%8c%db%8c-%d8%a7%d8%b2-%d8%a8%d8%a7%d8%b2%d8%a7%d8%b1-%d9%be%d9%88%d9%84&testcase=/%TESTNUMBER0002 HTTP/1.1
+GET /we/are/all/moo.html/?name=%D8%A2%D8%BA%D8%A7%D8%B2-%D8%B3%D9%85-%D8%B2%D8%AF%D8%A7%DB%8C%DB%8C-%D8%A7%D8%B2-%D8%A8%D8%A7%D8%B2%D8%A7%D8%B1-%D9%BE%D9%88%D9%84%AMPtestcase=/%TESTNUMBER0002 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test1139 b/third-party/curl/tests/data/test1139
index b5267b012d..443229fd7f 100644
--- a/third-party/curl/tests/data/test1139
+++ b/third-party/curl/tests/data/test1139
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,19 +9,14 @@ documentation
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
-
 <name>
 Verify that all libcurl options have man pages
 </name>
 
 <command type="perl">
-%SRCDIR/manpage-scan.pl %SRCDIR/.. %PWD/..
+%SRCDIR/test1139.pl %SRCDIR/.. %PWD/..
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test114 b/third-party/curl/tests/data/test114
index b31ac9d7a5..6972e6a835 100644
--- a/third-party/curl/tests/data/test114
+++ b/third-party/curl/tests/data/test114
@@ -1,8 +1,8 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -17,10 +17,10 @@ REPLY PASS 314 bluah you f00l!
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download, failed login: PASS not valid
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
@@ -30,7 +30,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 <errorcode>
 67
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 </protocol>
diff --git a/third-party/curl/tests/data/test1140 b/third-party/curl/tests/data/test1140
index f083eec391..04dad79353 100644
--- a/third-party/curl/tests/data/test1140
+++ b/third-party/curl/tests/data/test1140
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,19 +8,14 @@ documentation
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
-
- <name>
+<name>
 Verify the nroff of man pages
- </name>
+</name>
 
 <command type="perl">
-%SRCDIR/nroff-scan.pl %SRCDIR/../docs/ %SRCDIR/../docs/libcurl/*.3 %SRCDIR/../docs/libcurl/opts/*.3 %SRCDIR/../docs/*.1
+%SRCDIR/test1140.pl %PWD/../docs/ %PWD/../docs/libcurl/*.3 %PWD/../docs/libcurl/opts/*.3 %PWD/../docs/*.1 %PWD/../docs/cmdline-opts/*.1
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test1141 b/third-party/curl/tests/data/test1141
index 7af6ed4b63..f48eedfda0 100644
--- a/third-party/curl/tests/data/test1141
+++ b/third-party/curl/tests/data/test1141
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -41,10 +42,10 @@ hej
 <server>
 http
 </server>
- <name>
+<name>
 HTTP redirect to http:/// (three slashes!)
- </name>
- <command>
+</name>
+<command>
 %HOSTIP:%HTTPPORT/want/%TESTNUMBER -L -x http://%HOSTIP:%HTTPPORT
 </command>
 <features>
@@ -54,7 +55,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1142 b/third-party/curl/tests/data/test1142
index cb754331b8..ecf4d31a17 100644
--- a/third-party/curl/tests/data/test1142
+++ b/third-party/curl/tests/data/test1142
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -36,10 +37,10 @@ Location: http:////foo.example.com/want/%TESTNUMBER0001
 <server>
 http
 </server>
- <name>
+<name>
 HTTP redirect to http://// (four slashes!)
- </name>
- <command>
+</name>
+<command>
 %HOSTIP:%HTTPPORT/want/%TESTNUMBER -L -x http://%HOSTIP:%HTTPPORT
 </command>
 <features>
@@ -49,7 +50,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1143 b/third-party/curl/tests/data/test1143
index b2c9dff84c..4da5f51c90 100644
--- a/third-party/curl/tests/data/test1143
+++ b/third-party/curl/tests/data/test1143
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -22,10 +23,10 @@ hej
 <server>
 http
 </server>
- <name>
+<name>
 HTTP URL with http:/ (one slash!)
- </name>
- <command>
+</name>
+<command>
 http:/%HOSTIP:%HTTPPORT/want/%TESTNUMBER
 </command>
 <setenv>
@@ -37,7 +38,7 @@ MSYS2_ARG_CONV_EXCL=http:/
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1144 b/third-party/curl/tests/data/test1144
index da13f6697d..4446e63212 100644
--- a/third-party/curl/tests/data/test1144
+++ b/third-party/curl/tests/data/test1144
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,11 +8,10 @@ HTTP/0.9
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
-No headers at all, just data swsclose
+No headers at all, only data swsclose
 
 Let's get
 
@@ -37,28 +37,22 @@ verify
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
-# hyper doesn't support HTTP/0.9
-<features>
-!hyper
-</features>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP HEAD, receive no headers only body
- </name>
- <command>
+</name>
+<command>
 -I http://%HOSTIP:%HTTPPORT/%TESTNUMBER --http0.9
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 HEAD /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1145 b/third-party/curl/tests/data/test1145
index 570197ee97..73a817c00b 100644
--- a/third-party/curl/tests/data/test1145
+++ b/third-party/curl/tests/data/test1145
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -18,6 +19,8 @@ file:// bad host
 </name>
 # This command should not succeed since we only accept
 # file:/// file://localhost/ file://127.0.0.1/
+# Pass %PWD instead of %FILE_PWD to trigger the expected
+# error code with native Windows curl.
 <command>
 file://bad-host%PWD/%LOGDIR/test%TESTNUMBER.txt
 </command>
diff --git a/third-party/curl/tests/data/test1146 b/third-party/curl/tests/data/test1146
index 55245bc523..275cada0b9 100644
--- a/third-party/curl/tests/data/test1146
+++ b/third-party/curl/tests/data/test1146
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
diff --git a/third-party/curl/tests/data/test1147 b/third-party/curl/tests/data/test1147
index f75df8b429..010690a346 100644
--- a/third-party/curl/tests/data/test1147
+++ b/third-party/curl/tests/data/test1147
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -26,42 +26,36 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 Get -H headers from a file
- </name>
+</name>
 <file name="%LOGDIR/heads%TESTNUMBER.txt">
 One: 1
 Two: 2
 no-colon
 
-%if !hyper
  And A Funny One : wohoo
-%endif
 User-Agent:
 </file>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -H @%LOGDIR/heads%TESTNUMBER.txt
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
 One: 1
 Two: 2
-%if !hyper
  And A Funny One : wohoo
-%endif
 
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test1148 b/third-party/curl/tests/data/test1148
index a0957c0ee2..acd8c266f4 100644
--- a/third-party/curl/tests/data/test1148
+++ b/third-party/curl/tests/data/test1148
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ progressbar
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -25,27 +25,21 @@ zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 progress-bar
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -# --stderr %LOGDIR/stderrlog%TESTNUMBER
 </command>
-<setenv>
-LC_ALL=
-LC_NUMERIC=en_US.UTF-8
-</setenv>
 </client>
 
-#
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1149 b/third-party/curl/tests/data/test1149
index 10dd45ca90..18db9e70ea 100644
--- a/third-party/curl/tests/data/test1149
+++ b/third-party/curl/tests/data/test1149
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # based on test1010
 <info>
@@ -7,12 +8,9 @@ PASV
 LIST
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -24,27 +22,25 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP dir list multicwd then again nocwd
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/list/this/path/%TESTNUMBER/ --ftp-method multicwd --next ftp://%HOSTIP:%FTPPORT/list/this/path/%TESTNUMBER/ --ftp-method nocwd
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test115 b/third-party/curl/tests/data/test115
index fec40b112c..5fe1a74a61 100644
--- a/third-party/curl/tests/data/test115
+++ b/third-party/curl/tests/data/test115
@@ -1,9 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
 PASV
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -19,10 +19,10 @@ REPLY EPSV 314 bluah you f00l!
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download, failed PASV
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
@@ -32,7 +32,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 <errorcode>
 13
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1150 b/third-party/curl/tests/data/test1150
index 3d58cbb375..b9066763f0 100644
--- a/third-party/curl/tests/data/test1150
+++ b/third-party/curl/tests/data/test1150
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -26,10 +27,10 @@ daniel
 <server>
 http
 </server>
- <name>
+<name>
 HTTP proxy with URLs using different ports
- </name>
- <command>
+</name>
+<command>
 --proxy http://%HOSTIP:%HTTPPORT http://test.remote.example.com.%TESTNUMBER:150/path http://test.remote.example.com.%TESTNUMBER:1234/path/
 </command>
 <features>
@@ -39,7 +40,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://test.remote.example.com.%TESTNUMBER:150/path HTTP/1.1
 Host: test.remote.example.com.%TESTNUMBER:150
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1151 b/third-party/curl/tests/data/test1151
index 6ab44296d8..3d70d67038 100644
--- a/third-party/curl/tests/data/test1151
+++ b/third-party/curl/tests/data/test1151
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -22,10 +23,10 @@ Server: test-server/fake
 Content-Type: text/html
 Funny-head: yesyes swsclose
 Set-Cookie: foobar=name; domain=127.0.0.1; path=/;
-Set-Cookie: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB; domain=127.0.0.1; path=/;
-Set-Cookie: CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB; domain=127.0.0.1; path=/;
-Set-Cookie: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD=E; domain=127.0.0.1; path=/;
-Set-Cookie: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF=E; domain=127.0.0.1; path=/;
+Set-Cookie: %repeat[3000 x A]%=%repeat[1096 x B]%; domain=127.0.0.1; path=/;
+Set-Cookie: %repeat[3000 x C]%=%repeat[1097 x B]%; domain=127.0.0.1; path=/;
+Set-Cookie: %repeat[4096 x D]%=E; domain=127.0.0.1; path=/;
+Set-Cookie: %repeat[4094 x F]%=E; domain=127.0.0.1; path=/;
 
 </data>
 </reply>
@@ -35,10 +36,10 @@ Set-Cookie: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with too long cookies
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -c %LOGDIR/cookies%TESTNUMBER.txt
 </command>
 <features>
@@ -48,7 +49,7 @@ cookies
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -60,8 +61,8 @@ Accept: */*
 # https://curl.se/docs/http-cookies.html
 # This file was generated by libcurl! Edit at your own risk.
 
-127.0.0.1	FALSE	/	FALSE	0	FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF	E
-127.0.0.1	FALSE	/	FALSE	0	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
+127.0.0.1	FALSE	/	FALSE	0	%repeat[4094 x F]%	E
+127.0.0.1	FALSE	/	FALSE	0	%repeat[3000 x A]%	%repeat[1096 x B]%
 127.0.0.1	FALSE	/	FALSE	0	foobar	name
 </file>
 </verify>
diff --git a/third-party/curl/tests/data/test1152 b/third-party/curl/tests/data/test1152
index af4e7cf4f2..dfbde558d0 100644
--- a/third-party/curl/tests/data/test1152
+++ b/third-party/curl/tests/data/test1152
@@ -1,61 +1,39 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
-PASV
-LIST
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <servercmd>
-REPLY PWD 257 "just one
+REPLY PWD 257 "Only one
 </servercmd>
-
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<data mode="text">
-total 20
-drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
-drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
-drwxr-xr-x   2 98       98           512 May  2  1996 curl-releases
--r--r--r--   1 0        1             35 Jul 16  1996 README
-lrwxrwxrwx   1 0        1              7 Dec  9  1999 bin -> usr/bin
-dr-xr-xr-x   2 0        1            512 Oct  1  1997 dev
-drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
-dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
-drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
-dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
-FTP with uneven quote in PWD response
- </name>
- <command>
+<name>
+FTP with unclosed quote in PWD response
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/test-%TESTNUMBER/
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<errorcode>
+8
+</errorcode>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
-CWD test-%TESTNUMBER
-EPSV
-TYPE A
-LIST
-QUIT
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1153 b/third-party/curl/tests/data/test1153
index c92c9956a0..9e78f0e28e 100644
--- a/third-party/curl/tests/data/test1153
+++ b/third-party/curl/tests/data/test1153
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,15 +7,12 @@ PASV
 LIST
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <servercmd>
 REPLY PWD 257 "/""hello"""
 </servercmd>
 
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
 <data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
@@ -30,24 +28,22 @@ dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP with quoted double quotes
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/test-%TESTNUMBER/
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1154 b/third-party/curl/tests/data/test1154
index 6c01bcc398..dcfb7adc25 100644
--- a/third-party/curl/tests/data/test1154
+++ b/third-party/curl/tests/data/test1154
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -23,33 +23,31 @@ Long: %repeat[102400 x A]%
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with 100K (too long) response header
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-# 27 == CURLE_OUT_OF_MEMORY
+# 100 == CURLE_TOO_LARGE
 <errorcode>
-27
+100
 </errorcode>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1155 b/third-party/curl/tests/data/test1155
index fa14c5279b..ddba09e725 100644
--- a/third-party/curl/tests/data/test1155
+++ b/third-party/curl/tests/data/test1155
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ cookies
 # Server-side
 <reply>
 
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 0
@@ -24,10 +25,10 @@ Set-Cookie: domain=value;path=/
 <server>
 http
 </server>
- <name>
+<name>
 HTTP cookie with parameter word as name
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -c %LOGDIR/cookies%TESTNUMBER.txt
 </command>
 <features>
@@ -37,7 +38,7 @@ cookies
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1156 b/third-party/curl/tests/data/test1156
index 027961beab..803feea9b9 100644
--- a/third-party/curl/tests/data/test1156
+++ b/third-party/curl/tests/data/test1156
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ Range
 
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Content-Type: text/html
 Content-Length: 5
@@ -19,7 +20,7 @@ Content-Length: 5
 body
 </data>
 
-<data1 nocheck="yes">
+<data1 crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Content-Type: text/html
 Content-Length: 5
@@ -28,7 +29,7 @@ Content-Range: bytes 3/7
 body
 </data1>
 
-<data2 nocheck="yes">
+<data2 crlf="headers" nocheck="yes">
 HTTP/1.1 416 Requested Range Not Satisfiable
 Content-Type: text/html
 Content-Length: 5
@@ -36,7 +37,7 @@ Content-Length: 5
 body
 </data2>
 
-<data3 nocheck="yes">
+<data3 crlf="headers" nocheck="yes">
 HTTP/1.1 416 Requested Range Not Satisfiable
 Content-Type: text/html
 Content-Length: 5
@@ -54,10 +55,10 @@ http
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 HTTP resume/range fail range-error content-range combinations
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER
 </command>
 </client>
@@ -67,5 +68,8 @@ http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER
 <stdout>
 0
 </stdout>
+<limits>
+Allocations: 1300
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1157 b/third-party/curl/tests/data/test1157
index d0d3c5a1ff..9592956f7d 100644
--- a/third-party/curl/tests/data/test1157
+++ b/third-party/curl/tests/data/test1157
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -26,26 +26,24 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 Get -H headers from empty file
- </name>
+</name>
 <file name="%LOGDIR/heads%TESTNUMBER.txt">
 </file>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -H @%LOGDIR/heads%TESTNUMBER.txt
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1158 b/third-party/curl/tests/data/test1158
index 41dc24ddca..3212574fa1 100644
--- a/third-party/curl/tests/data/test1158
+++ b/third-party/curl/tests/data/test1158
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,7 @@ HTTP FORMPOST
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,6 +22,7 @@ blablabla
 <client>
 <features>
 Mime
+!win32
 </features>
 <server>
 http
@@ -29,13 +31,13 @@ http
 HTTP RFC1867-type formposting with filename containing '"'
 </name>
 <command>
-http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -F "file=@\"%LOGDIR/test%TESTNUMBER\\\".txt\";type=mo/foo;filename=\"test%TESTNUMBER\\\".txt\"" -F 'file2=@"%LOGDIR/test%TESTNUMBER\".txt"' -F 'file3=@"%LOGDIR/test%TESTNUMBER\".txt";type=m/f,"%LOGDIR/test%TESTNUMBER\".txt"'
+http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER
+-F "file=@\"%LOGDIR/test%TESTNUMBER\\\".txt\";type=mo/foo;filename=\"test%TESTNUMBER\\\".txt\""
+-F 'file2=@"%LOGDIR/test%TESTNUMBER\".txt"'
+-F 'file3=@"%LOGDIR/test%TESTNUMBER\".txt";type=m/f,"%LOGDIR/test%TESTNUMBER\".txt"'
 </command>
-<precheck>
-perl -e "print 'Test requires a system supporting double quotes in file names' if ($^O eq 'msys');"
-</precheck>
 # We create this file before the command is invoked!
-<file name=%LOGDIR/test%TESTNUMBER".txt>
+<file name='%LOGDIR/test%TESTNUMBER".txt'>
 foo bar
 This is a bar foo
 bar
@@ -49,53 +51,53 @@ foo
 ^(Content-Type: multipart/form-data;|Content-Type: multipart/mixed; boundary=|-------).*
 </strip>
 <protocol>
-POST /we/want/%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Content-Length: 958
-Content-Type: multipart/form-data; boundary=----------------------------24e78000bd32
-
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER%22.txt"
-Content-Type: mo/foo
-
+POST /we/want/%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Content-Length: 1006%CR
+Content-Type: multipart/form-data; boundary=----------------------------24e78000bd32%CR
+%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER%22.txt"%CR
+Content-Type: mo/foo%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="file2"; filename="test%TESTNUMBER%22.txt"
-Content-Type: text/plain
-
+%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="file2"; filename="test%TESTNUMBER%22.txt"%CR
+Content-Type: text/plain%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="file3"
-Content-Type: multipart/mixed; boundary=----------------------------7f0e85a48b0b
-
-Content-Disposition: attachment; filename="test%TESTNUMBER%22.txt"
-Content-Type: m/f
-
+%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="file3"%CR
+Content-Type: multipart/mixed; boundary=----------------------------7f0e85a48b0b%CR
+%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER%22.txt"%CR
+Content-Type: m/f%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-Content-Disposition: attachment; filename="test%TESTNUMBER%22.txt"
-Content-Type: text/plain
-
+%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER%22.txt"%CR
+Content-Type: text/plain%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-
-------------------------------24e78000bd32--
+%CR
+%CR
+------------------------------24e78000bd32--%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1159 b/third-party/curl/tests/data/test1159
index ce8077fd50..160f782214 100644
--- a/third-party/curl/tests/data/test1159
+++ b/third-party/curl/tests/data/test1159
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ followlocation
 
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 301 This is a weirdo text message swsclose
 Location: ht3p://localhost/
 Content-Length: 62
@@ -26,9 +27,9 @@ This server reply is for testing a simple Location: following
 <server>
 http
 </server>
- <name>
+<name>
 HTTP Location: and 'redirect_url' with non-supported scheme
- </name>
+</name>
 <command>
 http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER -w '%{redirect_url}\n'
 </command>
@@ -36,14 +37,14 @@ http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER -w '%{redirect_url}\n'
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/our/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 301 This is a weirdo text message swsclose
 Location: ht3p://localhost/
 Content-Length: 62
diff --git a/third-party/curl/tests/data/test116 b/third-party/curl/tests/data/test116
index 46ebfd2e4b..3ce674e401 100644
--- a/third-party/curl/tests/data/test116
+++ b/third-party/curl/tests/data/test116
@@ -1,10 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
 EPRT
 PORT
-FAILURE
 EPRT refused
 </keywords>
 </info>
@@ -23,12 +23,12 @@ ftp
 </server>
 # EPRT is only sent when IPv6 is enabled
 <features>
-ipv6
+IPv6
 </features>
- <name>
+<name>
 FTP download, failed PORT
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -P 1.2.3.4
 </command>
 </client>
@@ -43,7 +43,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -P 1.2.3.4
 s/^(PORT \d{1,3},\d{1,3},\d{1,3},\d{1,3},)\d{1,3},\d{1,3}/$1/
 s/^(EPRT \|1\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|)\d{1,5}\|/$1/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1160 b/third-party/curl/tests/data/test1160
index e5030264d4..7db8c3decb 100644
--- a/third-party/curl/tests/data/test1160
+++ b/third-party/curl/tests/data/test1160
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,11 +11,11 @@ cookies
 # Server-side
 <reply>
 
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 0
-Set-Cookie: ____________ÿ=         ;                                                                                                                     ÿ                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz†……€zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzúzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzó �–zzzzzzzzzzzz~zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz¶zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
+Set-Cookie: %repeat[4000 x n]%=%repeat[4096 x v]%
 
 </data>
 </reply>
@@ -25,10 +25,10 @@ Set-Cookie: ____________
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with long funny format cookie
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -c %LOGDIR/cookies%TESTNUMBER.txt
 </command>
 <features>
@@ -38,7 +38,7 @@ cookies
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1161 b/third-party/curl/tests/data/test1161
index e35a5988ed..3d84e5bad4 100644
--- a/third-party/curl/tests/data/test1161
+++ b/third-party/curl/tests/data/test1161
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ cookies
 # Server-side
 <reply>
 
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 0
@@ -24,10 +25,10 @@ Set-Cookie: ckyPersistent=permanent;path=;path=/
 <server>
 http
 </server>
- <name>
+<name>
 HTTP cookie with path set twice
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -c %LOGDIR/cookies%TESTNUMBER.txt
 </command>
 <features>
@@ -37,7 +38,7 @@ cookies
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1162 b/third-party/curl/tests/data/test1162
index e4b841316d..fa0ab76825 100644
--- a/third-party/curl/tests/data/test1162
+++ b/third-party/curl/tests/data/test1162
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ flaky
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -37,7 +37,7 @@ MSYS2_ARG_CONV_EXCL=ftp://
 </setenv>
 </client>
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1163 b/third-party/curl/tests/data/test1163
index 3266fa8e1a..1c60bbdbfd 100644
--- a/third-party/curl/tests/data/test1163
+++ b/third-party/curl/tests/data/test1163
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ flaky
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -33,7 +33,7 @@ FTP wildcard with pattern ending with an open-bracket
 </command>
 </client>
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1164 b/third-party/curl/tests/data/test1164
index 1fb947a99e..7d239d3aea 100644
--- a/third-party/curl/tests/data/test1164
+++ b/third-party/curl/tests/data/test1164
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,41 +7,29 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-# perl -e 'print "swsclose" . "\0" x 200;' | base64
-# 'swsclose' is there to force server to close after send
-<data nocheck="yes" base64="yes">
-c3dzY2xvc2UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
+<data nocheck="yes" nonewline="yes">
+swsclose%repeat[200 x %00]%
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# hyper doesn't support HTTP/0.9
-<features>
-!hyper
-</features>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP/0.9 GET and all zeroes
- </name>
- <command option="force-output">
+</name>
+<command option="force-output">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w '%{size_download}\n' --http0.9
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1165 b/third-party/curl/tests/data/test1165
index 24c1c3eb13..349e73deaf 100644
--- a/third-party/curl/tests/data/test1165
+++ b/third-party/curl/tests/data/test1165
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,19 +7,14 @@ CURL_DISABLE
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
-
- <name>
+<name>
 Verify configure.ac and source code CURL_DISABLE_-sync
- </name>
+</name>
 
 <command type="perl">
-%SRCDIR/disable-scan.pl %SRCDIR/..
+%SRCDIR/test1165.pl %SRCDIR/..
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test1166 b/third-party/curl/tests/data/test1166
index 95453023ed..8e141378d0 100644
--- a/third-party/curl/tests/data/test1166
+++ b/third-party/curl/tests/data/test1166
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ cookies
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -26,17 +27,17 @@ This server reply is for testing a Location: following with cookies
 <server>
 http
 </server>
- <name>
+<name>
 HTTP response with cookies but not receiving!
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1167 b/third-party/curl/tests/data/test1167
index 9eebe1c4e8..ecac642e21 100644
--- a/third-party/curl/tests/data/test1167
+++ b/third-party/curl/tests/data/test1167
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,19 +6,14 @@ source analysis
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
-
- <name>
+<name>
 Verify curl prefix of public symbols in header files
- </name>
+</name>
 
 <command type="perl">
-%SRCDIR/badsymbols.pl %SRCDIR/..
+%SRCDIR/test1167.pl %SRCDIR/..
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test1168 b/third-party/curl/tests/data/test1168
index 2e56ff0470..bc1eeb71ff 100644
--- a/third-party/curl/tests/data/test1168
+++ b/third-party/curl/tests/data/test1168
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -49,26 +50,26 @@ If this is received, the location following worked
 <server>
 http
 </server>
- <name>
+<name>
 HTTP redirect with credentials using # in user and password
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -L -u "catmai#d:#DZaRJYrixKE*gFY"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic Y2F0bWFpI2Q6I0RaYVJKWXJpeEtFKmdGWQ==
+Authorization: Basic %b64[catmai#d:#DZaRJYrixKE*gFY]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
 GET /data/%TESTNUMBER0002.txt HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic Y2F0bWFpI2Q6I0RaYVJKWXJpeEtFKmdGWQ==
+Authorization: Basic %b64[catmai#d:#DZaRJYrixKE*gFY]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test1169 b/third-party/curl/tests/data/test1169
index bba5d131e5..316f6fc4ad 100644
--- a/third-party/curl/tests/data/test1169
+++ b/third-party/curl/tests/data/test1169
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,12 +6,8 @@ runtests.pl
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <name>
 Verify that runtests.pl accepts an -L option
 </name>
diff --git a/third-party/curl/tests/data/test117 b/third-party/curl/tests/data/test117
index 014223a3ec..6fdbb33a58 100644
--- a/third-party/curl/tests/data/test117
+++ b/third-party/curl/tests/data/test117
@@ -1,8 +1,8 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -18,10 +18,10 @@ REPLY TYPE 314 bluah you f00l!
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download, failed TYPE
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
@@ -31,7 +31,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 <errorcode>
 17
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1170 b/third-party/curl/tests/data/test1170
index 1da2019f6f..8ceacbb3e6 100644
--- a/third-party/curl/tests/data/test1170
+++ b/third-party/curl/tests/data/test1170
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,19 +8,25 @@ compressed
 Transfer-Encoding
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBNb24sIDI5IE5vdiAyMDA0IDIxOjU2OjUzIEdNVA0KU2Vy
-dmVyOiBBcGFjaGUvMS4zLjMxIChEZWJpYW4gR05VL0xpbnV4KSBtb2RfZ3ppcC8xLjMuMjYuMWEg
-UEhQLzQuMy45LTEgbW9kX3NzbC8yLjguMjAgT3BlblNTTC8wLjkuN2QgbW9kX3BlcmwvMS4yOQ0K
-VmFyeTogQWNjZXB0LUVuY29kaW5nDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1J
-U08tODg1OS0xDQpUcmFuc2Zlci1FbmNvZGluZzogZ3ppcCwgY2h1bmtlZA0KDQoyYw0KH4sICHme
-q0EAA2xhbGFsYQDLycxLVTDkUsgB0UZcChCGMRcACgJxYBgAAAANCjANCg0K
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Mon, 29 Nov 2004 21:56:53 GMT
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
+Vary: Accept-Encoding
+Content-Type: text/html; charset=ISO-8859-1
+Transfer-Encoding: gzip, chunked
+
+2c
+%hex[%1f%8b%08%08%79%9e%ab%41%00%03%6c%61%6c%61%6c%61%00%cb%c9%cc%4b%55%30%e4%52%c8%01%d1%46%5c]hex%
+%hex[%10%86%31%17%00]hex%
+%hex[%02%71%60%18%00%00%00]hex%
+0
+
 </data>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Mon, 29 Nov 2004 21:56:53 GMT
 Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
@@ -34,7 +41,6 @@ line 1
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -43,24 +49,23 @@ libz
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET transfer-encoding with removed Connection:
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --tr-encoding -H "Connection:"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Connection: TE
 TE: gzip
+Connection: TE
 
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test1171 b/third-party/curl/tests/data/test1171
index aaf235029d..77f894eed0 100644
--- a/third-party/curl/tests/data/test1171
+++ b/third-party/curl/tests/data/test1171
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,19 +8,25 @@ compressed
 Transfer-Encoding
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBNb24sIDI5IE5vdiAyMDA0IDIxOjU2OjUzIEdNVA0KU2Vy
-dmVyOiBBcGFjaGUvMS4zLjMxIChEZWJpYW4gR05VL0xpbnV4KSBtb2RfZ3ppcC8xLjMuMjYuMWEg
-UEhQLzQuMy45LTEgbW9kX3NzbC8yLjguMjAgT3BlblNTTC8wLjkuN2QgbW9kX3BlcmwvMS4yOQ0K
-VmFyeTogQWNjZXB0LUVuY29kaW5nDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1J
-U08tODg1OS0xDQpUcmFuc2Zlci1FbmNvZGluZzogZ3ppcCwgY2h1bmtlZA0KDQoyYw0KH4sICHme
-q0EAA2xhbGFsYQDLycxLVTDkUsgB0UZcChCGMRcACgJxYBgAAAANCjANCg0K
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Mon, 29 Nov 2004 21:56:53 GMT
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
+Vary: Accept-Encoding
+Content-Type: text/html; charset=ISO-8859-1
+Transfer-Encoding: gzip, chunked
+
+2c
+%hex[%1f%8b%08%08%79%9e%ab%41%00%03%6c%61%6c%61%6c%61%00%cb%c9%cc%4b%55%30%e4%52%c8%01%d1%46%5c]hex%
+%hex[%10%86%31%17%00]hex%
+%hex[%02%71%60%18%00%00%00]hex%
+0
+
 </data>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Mon, 29 Nov 2004 21:56:53 GMT
 Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
@@ -34,7 +41,6 @@ line 1
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -43,24 +49,23 @@ libz
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET transfer-encoding with blanked Connection:
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --tr-encoding -H "Connection;"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Connection: TE
 TE: gzip
+Connection: TE
 
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test1172 b/third-party/curl/tests/data/test1172
index c154293a29..1986c0a55c 100644
--- a/third-party/curl/tests/data/test1172
+++ b/third-party/curl/tests/data/test1172
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP/0.9
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -16,24 +16,22 @@ HTTP/0.9
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP/0.9 GET response denied
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --no-http0.9
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1173 b/third-party/curl/tests/data/test1173
index f52afa6bbc..b4d36ac561 100644
--- a/third-party/curl/tests/data/test1173
+++ b/third-party/curl/tests/data/test1173
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,19 +8,14 @@ documentation
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
-
- <name>
+<name>
 Man page syntax checks
- </name>
+</name>
 
 <command type="perl">
-%SRCDIR/manpage-syntax.pl %SRCDIR/../docs/libcurl/symbols-in-versions %SRCDIR/../docs/*.1  %SRCDIR/../docs/libcurl/*.3 %SRCDIR/../docs/libcurl/opts/*.3
+%SRCDIR/test1173.pl %SRCDIR/../docs/libcurl/symbols-in-versions %PWD/../docs/*.1  %PWD/../docs/cmdline-opts/*.1 %PWD/../docs/libcurl/*.3 %PWD/../docs/libcurl/opts/*.3
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test1174 b/third-party/curl/tests/data/test1174
index 194c32fdbb..b4df99e9f7 100644
--- a/third-party/curl/tests/data/test1174
+++ b/third-party/curl/tests/data/test1174
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP/0.9
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -16,24 +16,22 @@ HTTP/0.9
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP/0.9 GET response denied by default
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1175 b/third-party/curl/tests/data/test1175
index 61f0689154..b9d1c0977a 100644
--- a/third-party/curl/tests/data/test1175
+++ b/third-party/curl/tests/data/test1175
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,19 +7,14 @@ symbols-in-versions
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
-
- <name>
+<name>
 Verify that symbols-in-versions and libcurl-errors.3 are in sync
- </name>
+</name>
 
 <command type="perl">
-%SRCDIR/error-codes.pl %SRCDIR
+%SRCDIR/test1175.pl %SRCDIR/..
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test1176 b/third-party/curl/tests/data/test1176
index 7d5754d630..66561c72b4 100644
--- a/third-party/curl/tests/data/test1176
+++ b/third-party/curl/tests/data/test1176
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,9 @@ globbing
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -24,31 +24,29 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 --output using #0
- </name>
- <command option="no-output">
+</name>
+<command option="no-output">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -o '%LOGDIR/base-#0'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<file name="%LOGDIR/base-#0">
+<file name="%LOGDIR/base-#0" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
diff --git a/third-party/curl/tests/data/test1177 b/third-party/curl/tests/data/test1177
index 29ddf3f877..ae340e8bf5 100644
--- a/third-party/curl/tests/data/test1177
+++ b/third-party/curl/tests/data/test1177
@@ -1,24 +1,21 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 source analysis
 CURL_VERSION
+documentation
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
-
- <name>
+<name>
 Verify that feature names and CURL_VERSION_* in lib and docs are in sync
- </name>
+</name>
 
 <command type="perl">
-%SRCDIR/version-scan.pl %SRCDIR/../docs/libcurl/curl_version_info.3 %SRCDIR/../include/curl/curl.h %SRCDIR/../lib/version.c
+%SRCDIR/test1177.pl %PWD/../docs/libcurl/curl_version_info.3 %SRCDIR/../include/curl/curl.h %SRCDIR/../lib/version.c
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test1178 b/third-party/curl/tests/data/test1178
index d3b6b61915..643f67fb3f 100644
--- a/third-party/curl/tests/data/test1178
+++ b/third-party/curl/tests/data/test1178
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 HTTP proxy
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -19,31 +19,29 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP proxy auth with credentials longer than 256 bytes
- </name>
+</name>
 # 400 x 'A' : 600 x 'B' ...
- <command>
-http://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER -x http://%HOSTIP:%HTTPPORT -U AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
+<command>
+http://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER -x http://%HOSTIP:%HTTPPORT -U %repeat[400 x A]%:%repeat[600 x B]%
 </command>
 <features>
 proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Proxy-Authorization: Basic QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQTpCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkI=
+Proxy-Authorization: Basic %b64[AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test1179 b/third-party/curl/tests/data/test1179
index 8dca8ab883..c44f3b5eed 100644
--- a/third-party/curl/tests/data/test1179
+++ b/third-party/curl/tests/data/test1179
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,12 @@ wrong option
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 # make this test require manual as the error message is different without it
 <features>
 manual
@@ -29,7 +25,6 @@ error when using unknown command line option
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test118 b/third-party/curl/tests/data/test118
index 750d91ebbb..67c17065d5 100644
--- a/third-party/curl/tests/data/test118
+++ b/third-party/curl/tests/data/test118
@@ -1,10 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
 PASV
 RETR
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -21,10 +21,10 @@ REPLY SIZE 500 command not understood
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download, failed RETR
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
@@ -34,7 +34,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 <errorcode>
 19
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1180 b/third-party/curl/tests/data/test1180
index ca28886cdc..33794ccf22 100644
--- a/third-party/curl/tests/data/test1180
+++ b/third-party/curl/tests/data/test1180
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,16 +28,16 @@ http
 <features>
 proxy
 </features>
- <name>
+<name>
 HTTP GET request with proxy and -H "Proxy-Connection: keep-alive"
- </name>
- <command>
+</name>
+<command>
 --proxy http://%HOSTIP:%HTTPPORT -H "Proxy-Connection: Keep-Alive" http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1181 b/third-party/curl/tests/data/test1181
index 5afb43d175..a6ace1623e 100644
--- a/third-party/curl/tests/data/test1181
+++ b/third-party/curl/tests/data/test1181
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP proxy
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Server: Blafasel/5.0
 Date: Sat, 16 Jan 2021 14:48:30 GMT
@@ -27,16 +28,16 @@ http
 <features>
 proxy
 </features>
- <name>
-HTTP GET request with proxy and --proxy-header "Proxy-Connection: Keep-Alive"
- </name>
- <command>
+<name>
+HTTP GET request with proxy and "Proxy-Connection: Keep-Alive"
+</name>
+<command>
 --proxy http://%HOSTIP:%HTTPPORT --proxy-header "Proxy-Connection: Keep-Alive" http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1182 b/third-party/curl/tests/data/test1182
index d1b8fb07b4..d18319d3a3 100644
--- a/third-party/curl/tests/data/test1182
+++ b/third-party/curl/tests/data/test1182
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,12 +6,8 @@ runtests.pl
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <name>
 Verify that runtests.pl accepts an exclude file with the -E option
 </name>
@@ -21,16 +18,15 @@ Verify that runtests.pl accepts an exclude file with the -E option
 <precheck>
 mkdir %LOGDIR/data ; mkdir %LOGDIR/log; cp %SRCDIR/data/test1 %LOGDIR/data; echo 'test:1:Test should not run for unit test %TESTNUMBER' > %LOGDIR/test%TESTNUMBER-exclude-file
 </precheck>
-<postcheck>
-grep -q "Test should not run for unit test %TESTNUMBER" %LOGDIR/stdout%TESTNUMBER
-</postcheck>
-
 </client>
 
 <verify>
 <errorcode>
 1
 </errorcode>
+<postcheck>
+grep -q "Test should not run for unit test %TESTNUMBER" %LOGDIR/stdout%TESTNUMBER
+</postcheck>
 </verify>
 
 </testcase>
diff --git a/third-party/curl/tests/data/test1183 b/third-party/curl/tests/data/test1183
index 0223c1fe37..7b4aca8f99 100644
--- a/third-party/curl/tests/data/test1183
+++ b/third-party/curl/tests/data/test1183
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP GET
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Server: Blafasel/5.0
 Date: Sat, 16 Jan 2021 14:48:30 GMT
@@ -27,17 +28,17 @@ http
 <features>
 proxy
 </features>
- <name>
+<name>
 %TESTNUMBER used instead of actual test number
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify that the %TESTNUMBER has been resolved to %TESTNUMBER
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1184 b/third-party/curl/tests/data/test1184
index 8db9665aaa..3c0213fcde 100644
--- a/third-party/curl/tests/data/test1184
+++ b/third-party/curl/tests/data/test1184
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,16 +9,15 @@ proxytunnel
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 Server: test tunnel 2000
 
 </connect>
 
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 302 OK
 Location: http://%HOSTIP.%TESTNUMBER:%HTTPPORT/we/want/that/page/%TESTNUMBER0002
 Date: Tue, 09 Nov 2010 14:49:00 GMT
@@ -30,7 +30,7 @@ Connection: close
 contents
 </data>
 
-<data2 nocheck="yes">
+<data2 crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Content-Length: 7
 
@@ -38,17 +38,16 @@ second
 </data2>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 http-proxy
 </server>
- <name>
+<name>
 HTTP 1.1 CONNECT with redirect and set -H user-agent
- </name>
- <command>
+</name>
+<command>
 -x %HOSTIP:%PROXYPORT -p http://%HOSTIP.%TESTNUMBER:%HTTPPORT/we/want/that/page/%TESTNUMBER -L -H "User-Agent: %TESTNUMBER-agent"
 </command>
 <features>
@@ -56,10 +55,9 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 CONNECT %HOSTIP.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: %HOSTIP.%TESTNUMBER:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -71,7 +69,7 @@ User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
 </proxy>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP.%TESTNUMBER:%HTTPPORT
 Accept: */*
@@ -83,7 +81,7 @@ Accept: */*
 User-Agent: %TESTNUMBER-agent
 
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 Server: test tunnel 2000
 
diff --git a/third-party/curl/tests/data/test1185 b/third-party/curl/tests/data/test1185
index 94c3be10c6..f804c7ba04 100644
--- a/third-party/curl/tests/data/test1185
+++ b/third-party/curl/tests/data/test1185
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,25 +6,21 @@ checksrc
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <name>
 checksrc
 </name>
 
 <command type="perl">
-%SRCDIR/../scripts/checksrc.pl %LOGDIR/code%TESTNUMBER.c
+%SRCDIR/../scripts/checksrc.pl -bmagicbad -balsobad %LOGDIR/code%TESTNUMBER.c
 </command>
 <file name="%LOGDIR/code%TESTNUMBER.c">
 /* test source code
  * Violate each rule at least once.
  **/
 int hello; /*------------------------------------------------------------------*/
-int	tab;
+int%TABtab;
 int trailing_space;
 int a = func ();
 int b = func( b);
@@ -46,11 +43,11 @@ if(a == 2){ /* followed by comment */
   ;
 }
 
-func() ;
+func_return() ;
 
 a = sprintf(buffer, "%s", moo);
 
-FILE *f = fopen("filename", "r");
+FILE *f = curlx_fopen("filename", "r");
 
 void startfunc(int a, int b) {
   func();
@@ -68,28 +65,48 @@ void startfunc(int a, int b) {
  int foo = bar;
  int foo = bar;foo++;
  for(;;)  {
+    moo();
+  moo();
  }
 
  int a = sizeof int;
- int a = snprintf(buffer, sizeof(buffer), "%d", 99);
+ int a = magicbad(buffer, alsobad(buffer), "%d", 99);
+ int moo = hej?wrong:a>b;
+ int moo2 = wrong2:(a)>(b);
 
  if(a) b++;
 
- // CPP comment?
+ if(sprintf(buffer, "%s", moo)) {}
+ *buffer_len = (ssize_t)alsobad((char *)buffer, NULL, 16);
 
- /* comment doesn't end
+# if defined(SINGLE_MACRO)
+ #if  ! defined(__macro_10)
+#elif !defined(TESTMACRO)
+#endif
+#endif
+#endif
+
+ // CPP comment ?
+
+ int d = impl->magicbad(1); /* member function always allowed */
+ int e = impl.magicbad(); /* member function always allowed */
+
+ curlx_free(ptr);  /* two line
+                      comment */
+ ptr = NULL;  /* comment more */
+
+ /* comment does not end
 
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <stdout>
 ./%LOGDIR/code1185.c:4:82: warning: Longer than 79 columns (LONGLINE)
  int hello; /*------------------------------------------------------------------*/
 ./%LOGDIR/code1185.c:5:4: error: Contains TAB character (TABS)
- int	tab;
+ int%TABtab;
     ^
 ./%LOGDIR/code1185.c:7:13: warning:  func with space (SPACEBEFOREPAREN)
  int a = func ();
@@ -116,16 +133,16 @@ void startfunc(int a, int b) {
  } else {
  ^
 ./%LOGDIR/code1185.c:24:11: warning: missing space after close paren (PARENBRACE)
- if(a == 2){  
+ if(a == 2){%SP%SP
            ^
-./%LOGDIR/code1185.c:28:7: warning: no space before semicolon (SPACESEMICOLON)
- func() ;
-       ^
+./%LOGDIR/code1185.c:28:14: warning: no space before semicolon (SPACESEMICOLON)
+ func_return() ;
+              ^
 ./%LOGDIR/code1185.c:30:5: warning: use of sprintf is banned (BANNEDFUNC)
  a = sprintf(buffer, "%s", moo);
      ^
 ./%LOGDIR/code1185.c:32:11: warning: use of non-binary fopen without FOPEN_* macro: r (FOPENMODE)
- FILE *f = fopen("filename", "r");
+ FILE *f = curlx_fopen("filename", "r");
            ^
 ./%LOGDIR/code1185.c:34:30: warning: wrongly placed open brace (BRACEPOS)
  void startfunc(int a, int b) {
@@ -154,28 +171,76 @@ void startfunc(int a, int b) {
 ./%LOGDIR/code1185.c:49:10: warning: multiple spaces (MULTISPACE)
   for(;;)  {
           ^
-./%LOGDIR/code1185.c:50:2: warning: not indented 2 steps (uses 0) (INDENTATION)
-  }
-  ^
-./%LOGDIR/code1185.c:52:16: warning: sizeof without parenthesis (SIZEOFNOPAREN)
+./%LOGDIR/code1185.c:50:5: warning: not indented 2 steps (uses 3) (INDENTATION)
+     moo();
+     ^
+./%LOGDIR/code1185.c:52:3: warning: Suspicious close brace indentation (CLOSEBRACE)
+   moo();
+   ^
+./%LOGDIR/code1185.c:54:16: warning: sizeof without parenthesis (SIZEOFNOPAREN)
   int a = sizeof int;
                 ^
-./%LOGDIR/code1185.c:53:10: warning: use of snprintf is banned (SNPRINTF)
-  int a = snprintf(buffer, sizeof(buffer), "%d", 99);
+./%LOGDIR/code1185.c:55:10: warning: use of magicbad is banned (BANNEDFUNC)
+  int a = magicbad(buffer, alsobad(buffer), "%d", 99);
           ^
-./%LOGDIR/code1185.c:55:7: warning: conditional block on the same line (ONELINECONDITION)
+./%LOGDIR/code1185.c:55:27: warning: use of alsobad is banned (BANNEDFUNC)
+  int a = magicbad(buffer, alsobad(buffer), "%d", 99);
+                           ^
+./%LOGDIR/code1185.c:56:21: warning: missing space before colon (NOSPACEC)
+  int moo = hej?wrong:a>b;
+                     ^
+./%LOGDIR/code1185.c:56:22: warning: missing space after colon (NOSPACEC)
+  int moo = hej?wrong:a>b;
+                      ^
+./%LOGDIR/code1185.c:56:15: warning: missing space before question mark (NOSPACEQ)
+  int moo = hej?wrong:a>b;
+               ^
+./%LOGDIR/code1185.c:56:16: warning: missing space after question mark (NOSPACEQ)
+  int moo = hej?wrong:a>b;
+                ^
+./%LOGDIR/code1185.c:56:23: warning: missing space before less or greater than (NOSPACETHAN)
+  int moo = hej?wrong:a>b;
+                       ^
+./%LOGDIR/code1185.c:56:23: warning: missing space after less or greater than (NOSPACETHAN)
+  int moo = hej?wrong:a>b;
+                       ^
+./%LOGDIR/code1185.c:57:23: warning: missing space before less or greater than (NOSPACETHAN)
+  int moo2 = wrong2:(a)>(b);
+                       ^
+./%LOGDIR/code1185.c:57:23: warning: missing space after less or greater than (NOSPACETHAN)
+  int moo2 = wrong2:(a)>(b);
+                       ^
+./%LOGDIR/code1185.c:59:7: warning: conditional block on the same line (ONELINECONDITION)
   if(a) b++;
        ^
-./%LOGDIR/code1185.c:57:2: warning: // comment (CPPCOMMENTS)
-  // CPP comment?
+./%LOGDIR/code1185.c:61:5: warning: use of sprintf is banned (BANNEDFUNC)
+  if(sprintf(buffer, "%s", moo)) {}
+     ^
+./%LOGDIR/code1185.c:62:25: warning: use of alsobad is banned (BANNEDFUNC)
+  *buffer_len = (ssize_t)alsobad((char *)buffer, NULL, 16);
+                         ^
+./%LOGDIR/code1185.c:64:14: warning: use ifdef/ifndef for single macro checks (IFDEFSINGLE)
+ # if defined(SINGLE_MACRO)
+              ^
+./%LOGDIR/code1185.c:65:17: warning: use ifdef/ifndef for single macro checks (IFDEFSINGLE)
+  #if  ! defined(__macro_10)
+                 ^
+./%LOGDIR/code1185.c:65:1: warning: space before preprocessor hash (CPPSPACE)
+  #if  ! defined(__macro_10)
+ ^
+./%LOGDIR/code1185.c:71:2: warning: // comment (CPPCOMMENTS)
+  // CPP comment ?
+  ^
+./%LOGDIR/code1185.c:78:2: warning: replace curlx_free() + NULL assignment with curlx_safefree() (USESAFEFREE)
+  ptr = NULL;  /* comment more */
   ^
 ./%LOGDIR/code1185.c:1:1: error: Missing copyright statement (COPYRIGHT)
- 
+%SP
  ^
 ./%LOGDIR/code1185.c:1:1: error: Missing closing comment (OPENCOMMENT)
- 
+%SP
  ^
-checksrc: 0 errors and 30 warnings
+checksrc: 3 errors and 43 warnings
 </stdout>
 <errorcode>
 5
diff --git a/third-party/curl/tests/data/test1186 b/third-party/curl/tests/data/test1186
index 3e0f91a463..e66f4dc2fd 100644
--- a/third-party/curl/tests/data/test1186
+++ b/third-party/curl/tests/data/test1186
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,7 @@ HTTP FORMPOST
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,6 +22,7 @@ blablabla
 <client>
 <features>
 Mime
+!win32
 </features>
 <server>
 http
@@ -29,13 +31,13 @@ http
 Multipart formposting with backslash-escaping filename containing '"'
 </name>
 <command>
-http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER --form-escape -F "file=@\"%LOGDIR/test%TESTNUMBER\\\".txt\";type=mo/foo;filename=\"test%TESTNUMBER\\\".txt\"" -F 'file2=@"%LOGDIR/test%TESTNUMBER\".txt"' -F 'file3=@"%LOGDIR/test%TESTNUMBER\".txt";type=m/f,"%LOGDIR/test%TESTNUMBER\".txt"'
+http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER --form-escape
+-F "file=@\"%LOGDIR/test%TESTNUMBER\\\".txt\";type=mo/foo;filename=\"test%TESTNUMBER\\\".txt\""
+-F 'file2=@"%LOGDIR/test%TESTNUMBER\".txt"'
+-F 'file3=@"%LOGDIR/test%TESTNUMBER\".txt";type=m/f,"%LOGDIR/test%TESTNUMBER\".txt"'
 </command>
-<precheck>
-perl -e "print 'Test requires a system supporting double quotes in file names' if ($^O eq 'msys');"
-</precheck>
 # We create this file before the command is invoked!
-<file name=%LOGDIR/test%TESTNUMBER".txt>
+<file name='%LOGDIR/test%TESTNUMBER".txt'>
 foo bar
 This is a bar foo
 bar
@@ -49,53 +51,53 @@ foo
 ^(Content-Type: multipart/form-data;|Content-Type: multipart/mixed; boundary=|-------).*
 </strip>
 <protocol>
-POST /we/want/%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Content-Length: 954
-Content-Type: multipart/form-data; boundary=----------------------------24e78000bd32
-
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER\".txt"
-Content-Type: mo/foo
-
+POST /we/want/%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Content-Length: 1002%CR
+Content-Type: multipart/form-data; boundary=----------------------------24e78000bd32%CR
+%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER\".txt"%CR
+Content-Type: mo/foo%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="file2"; filename="test%TESTNUMBER\".txt"
-Content-Type: text/plain
-
+%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="file2"; filename="test%TESTNUMBER\".txt"%CR
+Content-Type: text/plain%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="file3"
-Content-Type: multipart/mixed; boundary=----------------------------7f0e85a48b0b
-
-Content-Disposition: attachment; filename="test%TESTNUMBER\".txt"
-Content-Type: m/f
-
+%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="file3"%CR
+Content-Type: multipart/mixed; boundary=----------------------------7f0e85a48b0b%CR
+%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER\".txt"%CR
+Content-Type: m/f%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-Content-Disposition: attachment; filename="test%TESTNUMBER\".txt"
-Content-Type: text/plain
-
+%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER\".txt"%CR
+Content-Type: text/plain%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-
-------------------------------24e78000bd32--
+%CR
+%CR
+------------------------------24e78000bd32--%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1187 b/third-party/curl/tests/data/test1187
index 24c3da7399..a900379dbf 100644
--- a/third-party/curl/tests/data/test1187
+++ b/third-party/curl/tests/data/test1187
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,10 @@ MULTIPART
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -20,35 +19,34 @@ Mime
 <server>
 smtp
 </server>
- <name>
-SMTP multipart with file name escaping
- </name>
-<stdin>
+<name>
+SMTP multipart with filename escaping
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
- <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -F  "=This is the mail text" -F '=File content;filename="strange\file\"name"'
+<command>
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -F "=This is the mail text" -F '=File content;filename="strange\file\"name"'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 Content-Type: multipart/mixed; boundary=----------------------------
 Mime-Version: 1.0
 
diff --git a/third-party/curl/tests/data/test1188 b/third-party/curl/tests/data/test1188
index c8ac1745b4..f4d83ad358 100644
--- a/third-party/curl/tests/data/test1188
+++ b/third-party/curl/tests/data/test1188
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ HTTP GET
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 404 Not Found
 Content-Length: 0
 Connection: close
@@ -22,9 +23,9 @@ Connection: close
 <server>
 http
 </server>
- <name>
+<name>
 --write-out with %{onerror} and %{urlnum} to stderr
- </name>
+</name>
 <command>
 -f -s -w '%{onerror}%{stderr}%{urlnum} says %{exitcode} %{errormsg}\n' http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER
 </command>
@@ -32,7 +33,7 @@ http
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/our/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1189 b/third-party/curl/tests/data/test1189
index b3496c171f..880617de64 100644
--- a/third-party/curl/tests/data/test1189
+++ b/third-party/curl/tests/data/test1189
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,7 @@ HTTP FORMPOST
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -25,11 +26,19 @@ Mime
 <server>
 http
 </server>
- <name>
+<name>
 Multipart formposting with backslash-escaping of name= and filename=
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER --form-escape -F name=daniel -F tool=curl --form-string "str1=@literal" --form-string "str2=<verbatim;type=xxx/yyy" -F "file=@%LOGDIR/test%TESTNUMBER.txt;type=moo/foobar;filename=fakerfile" -F file2=@%LOGDIR/test%TESTNUMBER.txt -F "file3=@\"%LOGDIR/test%TESTNUMBER.txt\";type=mo/foo;filename=\"f\\\\\\\\ak\\\\\\er,\\\\an\\d;.t\\\"xt\"" -F 'file4=@"%LOGDIR/test%TESTNUMBER.txt"; filename="A\\AA\"\"\\\"ZZZ"'
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER --form-escape
+-F name=daniel
+-F tool=curl
+--form-string "str1=@literal"
+--form-string "str2=%LTverbatim;type=xxx/yyy"
+-F "file=@%LOGDIR/test%TESTNUMBER.txt;type=moo/foobar;filename=fakerfile"
+-F file2=@%LOGDIR/test%TESTNUMBER.txt
+-F "file3=@\"%LOGDIR/test%TESTNUMBER.txt\";type=mo/foo;filename=\"f\\\\\\\\ak\\\\\\er,\\\\an\\d;.t\\\"xt\""
+-F 'file4=@"%LOGDIR/test%TESTNUMBER.txt"; filename="A\\AA\"\"\\\"ZZZ"'
 </command>
 # We create this file before the command is invoked!
 <file name="%LOGDIR/test%TESTNUMBER.txt">
@@ -46,66 +55,66 @@ foo
 ^(Content-Type: multipart/form-data;|-------).*
 </strip>
 <protocol>
-POST /we/want/%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Content-Length: 1186
-Content-Type: multipart/form-data; boundary=----------------------------24e78000bd32
-
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="name"
-
-daniel
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="tool"
-
-curl
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="str1"
-
-@literal
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="str2"
-
-<verbatim;type=xxx/yyy
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="file"; filename="fakerfile"
-Content-Type: moo/foobar
-
+POST /we/want/%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Content-Length: 1240%CR
+Content-Type: multipart/form-data; boundary=----------------------------24e78000bd32%CR
+%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="name"%CR
+%CR
+daniel%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="tool"%CR
+%CR
+curl%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="str1"%CR
+%CR
+@literal%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="str2"%CR
+%CR
+%LTverbatim;type=xxx/yyy%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="file"; filename="fakerfile"%CR
+Content-Type: moo/foobar%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="file2"; filename="test%TESTNUMBER.txt"
-Content-Type: text/plain
-
+%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="file2"; filename="test%TESTNUMBER.txt"%CR
+Content-Type: text/plain%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="file3"; filename="f\\\\ak\\\\er,\\an\\d;.t\"xt"
-Content-Type: mo/foo
-
+%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="file3"; filename="f\\\\ak\\\\er,\\an\\d;.t\"xt"%CR
+Content-Type: mo/foo%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="file4"; filename="A\\AA\"\"\\\"ZZZ"
-Content-Type: text/plain
-
+%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="file4"; filename="A\\AA\"\"\\\"ZZZ"%CR
+Content-Type: text/plain%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-------------------------------24e78000bd32--
+%CR
+------------------------------24e78000bd32--%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test119 b/third-party/curl/tests/data/test119
index cd9960a36b..5f9140ff2c 100644
--- a/third-party/curl/tests/data/test119
+++ b/third-party/curl/tests/data/test119
@@ -1,10 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
 PORT
 RETR
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -20,10 +20,10 @@ REPLY SIZE 500 command not understood
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download, failed RETR with PORT
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -P -
 </command>
 </client>
@@ -38,7 +38,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -P -
 ^PORT \d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3}
 ^EPRT \|1\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|\d{1,5}\|
 </strip>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1190 b/third-party/curl/tests/data/test1190
index f866352eaf..e5ab3dc65b 100644
--- a/third-party/curl/tests/data/test1190
+++ b/third-party/curl/tests/data/test1190
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,18 +7,13 @@ MQTT SUBSCRIBE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
 hello
 </data>
-<datacheck hex="yes">
-00 04 31 31 39 30   68 65 6c 6c 6f 5b 4c 46 5d 0a
-</datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -34,11 +30,9 @@ mqtt://%HOSTIP:%MQTTPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # These are hexadecimal protocol dumps from the client
-#
 # Strip out the random part of the client id from the CONNECT message
 # before comparison
 <strippart>
diff --git a/third-party/curl/tests/data/test1191 b/third-party/curl/tests/data/test1191
index 69cf33fbd1..f1d6b61a6c 100644
--- a/third-party/curl/tests/data/test1191
+++ b/third-party/curl/tests/data/test1191
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,14 +7,12 @@ MQTT PUBLISH
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -30,11 +29,9 @@ mqtt://%HOSTIP:%MQTTPORT/%TESTNUMBER -d something
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # These are hexadecimal protocol dumps from the client
-#
 # Strip out the random part of the client id from the CONNECT message
 # before comparison
 <strippart>
diff --git a/third-party/curl/tests/data/test1192 b/third-party/curl/tests/data/test1192
index 47036ab83e..0865040b49 100644
--- a/third-party/curl/tests/data/test1192
+++ b/third-party/curl/tests/data/test1192
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,18 +7,13 @@ MQTT SUBSCRIBE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
 hello
 </data>
-<datacheck hex="yes">
-00 04 31 31 39 30   68 65 6c 6c 6f 5b 4c 46 5d 0a
-</datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -30,15 +26,13 @@ mqtt
 MQTT SUBSCRIBE 2k topic
 </name>
 <command option="binary-trace">
-mqtt://%HOSTIP:%MQTTPORT/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/%TESTNUMBER
+mqtt://%HOSTIP:%MQTTPORT/%repeat[2048 x A]%/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # These are hexadecimal protocol dumps from the client
-#
 # Strip out the random part of the client id from the CONNECT message
 # before comparison
 <strippart>
@@ -47,9 +41,9 @@ s/^(.* 00044d5154540402003c000c6375726c).*/$1/
 <protocol>
 client CONNECT 18 00044d5154540402003c000c6375726c
 server CONNACK 2 20020000
-client SUBSCRIBE 80a 0001080541414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141412f3131393200
+client SUBSCRIBE 80a 000108054%repeat[2047 x 14]%12f3131393200
 server SUBACK 3 9003000100
-server PUBLISH 80d 308d10080541414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141412f3131393268656c6c6f0a
+server PUBLISH 80d 308d1008054%repeat[2047 x 14]%12f3131393268656c6c6f0a
 server DISCONNECT 0 e000
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test1193 b/third-party/curl/tests/data/test1193
index 531efa2597..a7f67b8b29 100644
--- a/third-party/curl/tests/data/test1193
+++ b/third-party/curl/tests/data/test1193
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,14 +7,12 @@ MQTT PUBLISH
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -29,34 +28,13 @@ MQTT PUBLISH 2k payload
 mqtt://%HOSTIP:%MQTTPORT/%TESTNUMBER -d @%LOGDIR/payload%TESTNUMBER
 </command>
 <file name="%LOGDIR/payload%TESTNUMBER">
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
-123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+%repeat[20 x 123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789%0a]%
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # These are hexadecimal protocol dumps from the client
-#
 # Strip out the random part of the client id from the CONNECT message
 # before comparison
 <strippart>
diff --git a/third-party/curl/tests/data/test1194 b/third-party/curl/tests/data/test1194
index cabf6beb0f..36ccfd0f82 100644
--- a/third-party/curl/tests/data/test1194
+++ b/third-party/curl/tests/data/test1194
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,21 +7,16 @@ MQTT SUBSCRIBE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
 hello
 </data>
-<datacheck hex="yes">
-00 04 31 31 39 30   68 65 6c 6c 6f 5b 4c 46 5d 0a
-</datacheck>
 <servercmd>
 PUBLISH-before-SUBACK TRUE
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -30,18 +26,16 @@ mqtt
 mqtt
 </server>
 <name>
-MQTT SUBSCRIBE with PUBLISH befoire SUBACK
+MQTT SUBSCRIBE with PUBLISH before SUBACK
 </name>
 <command option="binary-trace">
 mqtt://%HOSTIP:%MQTTPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # These are hexadecimal protocol dumps from the client
-#
 # Strip out the random part of the client id from the CONNECT message
 # before comparison
 <strippart>
diff --git a/third-party/curl/tests/data/test1195 b/third-party/curl/tests/data/test1195
index 803bdd980d..c80e1b7be2 100644
--- a/third-party/curl/tests/data/test1195
+++ b/third-party/curl/tests/data/test1195
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,22 +7,17 @@ MQTT SUBSCRIBE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
 hello
 </data>
-<datacheck hex="yes">
-00 04 31 31 39 30   68 65 6c 6c 6f 5b 4c 46 5d 0a
-</datacheck>
 <servercmd>
 PUBLISH-before-SUBACK TRUE
 short-PUBLISH TRUE
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -38,11 +34,9 @@ mqtt://%HOSTIP:%MQTTPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # These are hexadecimal protocol dumps from the client
-#
 # Strip out the random part of the client id from the CONNECT message
 # before comparison
 <strippart>
diff --git a/third-party/curl/tests/data/test1196 b/third-party/curl/tests/data/test1196
index 9290144128..118c52a336 100644
--- a/third-party/curl/tests/data/test1196
+++ b/third-party/curl/tests/data/test1196
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,15 +7,11 @@ MQTT SUBSCRIBE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
 hello
 </data>
-<datacheck hex="yes">
-00 04 31 31 39 30   68 65 6c 6c 6f 5b 4c 46 5d 0a
-</datacheck>
 
 # error 1 - "Connection Refused, unacceptable protocol version"
 <servercmd>
@@ -22,7 +19,6 @@ error-CONNACK 1
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -32,18 +28,16 @@ mqtt
 mqtt
 </server>
 <name>
-MQTT with error in CONNACK
+MQTT with "unaccaptable protocol version" CONNACK
 </name>
 <command option="binary-trace">
 mqtt://%HOSTIP:%MQTTPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # These are hexadecimal protocol dumps from the client
-#
 # Strip out the random part of the client id from the CONNECT message
 # before comparison
 <strippart>
diff --git a/third-party/curl/tests/data/test1197 b/third-party/curl/tests/data/test1197
index 48ebe30ee9..61e0df48e4 100644
--- a/third-party/curl/tests/data/test1197
+++ b/third-party/curl/tests/data/test1197
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ followlocation
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 302 OK swsbounce swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 8
@@ -21,7 +21,7 @@ Location: ./%TESTNUMBER0001
 
 monster
 </data>
-<data1 nocheck="yes">
+<data1 crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 15
@@ -33,24 +33,22 @@ bigger monster
 
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP POST redirected to GET and --write-out method
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w "%{method}\n" -L -d "twinkle twinkle little star"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -65,7 +63,7 @@ Accept: */*
 
 </protocol>
 
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 302 OK swsbounce swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 8
diff --git a/third-party/curl/tests/data/test1198 b/third-party/curl/tests/data/test1198
index a81e4bb815..0190938e96 100644
--- a/third-party/curl/tests/data/test1198
+++ b/third-party/curl/tests/data/test1198
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,18 +7,13 @@ MQTT SUBSCRIBE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
 hello
 </data>
-<datacheck hex="yes">
-00 04 31 31 39 30   68 65 6c 6c 6f 5b 4c 46 5d 0a
-</datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -34,11 +30,9 @@ mqtt://%HOSTIP:%MQTTPORT/%20 -d ""
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # These are hexadecimal protocol dumps from the client
-#
 # Strip out the random part of the client id from the CONNECT message
 # before comparison
 <strippart>
diff --git a/third-party/curl/tests/data/test1199 b/third-party/curl/tests/data/test1199
index d710e70135..dbdd92ed01 100644
--- a/third-party/curl/tests/data/test1199
+++ b/third-party/curl/tests/data/test1199
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,18 +7,13 @@ MQTT SUBSCRIBE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
 hello
 </data>
-<datacheck hex="yes">
-00 04 31 31 39 30   68 65 6c 6c 6f 5b 4c 46 5d 0a
-</datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -34,11 +30,9 @@ mqtt://%HOSTIP:%MQTTPORT -d ""
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # These are hexadecimal protocol dumps from the client
-#
 # Strip out the random part of the client id from the CONNECT message
 # before comparison
 <strippart>
diff --git a/third-party/curl/tests/data/test12 b/third-party/curl/tests/data/test12
index 49c300d444..f5ea2622b5 100644
--- a/third-party/curl/tests/data/test12
+++ b/third-party/curl/tests/data/test12
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ Content-Range
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 206 Partial Content
 Date: Mon, 13 Nov 2000 13:41:09 GMT
 Server: Apache/1.3.11 (Unix) PHP/3.0.14
@@ -32,17 +33,17 @@ in the request
 <server>
 http
 </server>
- <name>
+<name>
 HTTP range support
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -r 100-200
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Range: bytes=100-200
diff --git a/third-party/curl/tests/data/test120 b/third-party/curl/tests/data/test120
index 7896c53bbd..67383d7830 100644
--- a/third-party/curl/tests/data/test120
+++ b/third-party/curl/tests/data/test120
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,17 +28,17 @@ REPLY EPSV 314 bluah you f00l!
 <server>
 ftp
 </server>
- <name>
+<name>
 ftp download with post-quote delete operation
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -Q "-DELE file"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1200 b/third-party/curl/tests/data/test1200
index 18d556d1ee..e856b94525 100644
--- a/third-party/curl/tests/data/test1200
+++ b/third-party/curl/tests/data/test1200
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ INDEX
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 iMenu results		error.host	1
 0Selector 	/bar	bar.foo.invalid	70
 .
@@ -21,18 +21,17 @@ iMenu results		error.host	1
 <server>
 gopher
 </server>
- <name>
+<name>
 Gopher index
- </name>
- <command>
+</name>
+<command>
 gopher://%HOSTIP:%GOPHERPORT/1/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 /%TESTNUMBER
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test1201 b/third-party/curl/tests/data/test1201
index 274807c5af..4a49bc9c39 100644
--- a/third-party/curl/tests/data/test1201
+++ b/third-party/curl/tests/data/test1201
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ SELECTOR
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 iMenu results		error.host	1
 0Selector /selector/SELECTOR	/bar	bar.foo.invalid	70
 .
@@ -21,19 +21,18 @@ iMenu results		error.host	1
 <server>
 gopher
 </server>
- <name>
+<name>
 Gopher selector
- </name>
- <command>
-gopher://%HOSTIP:%GOPHERPORT/1/selector/SELECTOR/%TESTNUMBER?
+</name>
+<command>
+gopher://%HOSTIP:%GOPHERPORT/1/selector/SELECTOR/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-/selector/SELECTOR/%TESTNUMBER?
+<protocol crlf="yes">
+/selector/SELECTOR/%TESTNUMBER
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1202 b/third-party/curl/tests/data/test1202
index d19fb6794d..c0cf11de44 100644
--- a/third-party/curl/tests/data/test1202
+++ b/third-party/curl/tests/data/test1202
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ QUERY
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 iSearch results		error.host	1
 0Query query succeeded	/foo	foo.bar.invalid	70
 0Selector /the/search/engine	/bar	bar.foo.invalid	70
@@ -22,18 +22,17 @@ iSearch results		error.host	1
 <server>
 gopher
 </server>
- <name>
+<name>
 Gopher query
- </name>
- <command>
+</name>
+<command>
 "gopher://%HOSTIP:%GOPHERPORT/7/the/search/engine%09query%20succeeded/%TESTNUMBER"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 /the/search/engine	query succeeded/%TESTNUMBER
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test1203 b/third-party/curl/tests/data/test1203
index 73c6495b01..0f41103358 100644
--- a/third-party/curl/tests/data/test1203
+++ b/third-party/curl/tests/data/test1203
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ INDEX
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 iMenu results		error.host	1
 0Selector 	/bar	bar.foo.invalid	70
 .
@@ -20,23 +20,22 @@ iMenu results		error.host	1
 # Client-side
 <client>
 <features>
-ipv6
+IPv6
 </features>
 <server>
 gopher-ipv6
 </server>
- <name>
+<name>
 Gopher IPv6 index
- </name>
- <command>
+</name>
+<command>
 -g gopher://%HOST6IP:%GOPHER6PORT/1/moo/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 /moo/%TESTNUMBER
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test1204 b/third-party/curl/tests/data/test1204
index ccec4cfe71..392ecf2b3d 100644
--- a/third-party/curl/tests/data/test1204
+++ b/third-party/curl/tests/data/test1204
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ HTTP Basic auth
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsbounce
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: X-MobileMe-AuthToken realm="Newcastle", Basic realm="fun fun  fun"
@@ -20,7 +21,7 @@ This is not the real page
 </data>
 
 # This is supposed to be returned when the server gets the second request
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 200 OK
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -29,7 +30,7 @@ Content-Length: 23
 This IS the real page!
 </data1>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsbounce
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: X-MobileMe-AuthToken realm="Newcastle", Basic realm="fun fun  fun"
@@ -51,17 +52,17 @@ This IS the real page!
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with WWW-Authenticate and multiple auths in a single line
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --anyauth
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -69,7 +70,7 @@ Accept: */*
 
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6dGVzdHBhc3M=
+Authorization: Basic %b64[testuser:testpass]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test1205 b/third-party/curl/tests/data/test1205
index 261267bc5b..32448d45f0 100644
--- a/third-party/curl/tests/data/test1205
+++ b/third-party/curl/tests/data/test1205
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -14,30 +14,28 @@ HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
 Connection: close
-Funny-head: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAendofthem
+Funny-head: %repeat[18000 x A]%endofthem
 
 -foo-
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with 18K HTTP header
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1206 b/third-party/curl/tests/data/test1206
index 6dcd2a2313..d3cb55fd6d 100644
--- a/third-party/curl/tests/data/test1206
+++ b/third-party/curl/tests/data/test1206
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -22,10 +23,10 @@ NODATACONN425
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP PORT and 425 on download
- </name>
- <command>
+</name>
+<command>
 --max-time %FTPTIME2 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -P -
 </command>
 
@@ -34,9 +35,9 @@ FTP PORT and 425 on download
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^EPRT \|1\|(.*)/EPRT \|1\|/
+s/^EPRT \|1\|(\S*)/EPRT \|1\|/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -46,6 +47,7 @@ SIZE %TESTNUMBER
 RETR %TESTNUMBER
 QUIT
 </protocol>
+10 is CURLE_FTP_ACCEPT_FAILED
 <errorcode>
 10
 </errorcode>
diff --git a/third-party/curl/tests/data/test1207 b/third-party/curl/tests/data/test1207
index 79d2e388af..70565bd7f1 100644
--- a/third-party/curl/tests/data/test1207
+++ b/third-party/curl/tests/data/test1207
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -22,10 +23,10 @@ NODATACONN421
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP PORT and 421 on download
- </name>
- <command>
+</name>
+<command>
 --max-time %FTPTIME2 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -P -
 </command>
 
@@ -34,9 +35,9 @@ FTP PORT and 421 on download
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^EPRT \|1\|(.*)/EPRT \|1\|/
+s/^EPRT \|1\|(\S*)/EPRT \|1\|/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1208 b/third-party/curl/tests/data/test1208
index 04c8816cce..8ae1e3acbe 100644
--- a/third-party/curl/tests/data/test1208
+++ b/third-party/curl/tests/data/test1208
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,9 +6,9 @@ FTP
 PORT
 RETR
 NODATACONN150
-flaky
 timeout
-FAILURE
+flaky
+timing-dependent
 </keywords>
 </info>
 # Server-side
@@ -25,10 +26,10 @@ NODATACONN150
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP PORT download, no data conn and no transient negative reply
- </name>
- <command>
+</name>
+<command>
 --max-time %FTPTIME2 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -P -
 </command>
 
@@ -37,14 +38,14 @@ FTP PORT download, no data conn and no transient negative reply
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^EPRT \|1\|(.*)/EPRT \|1\|/
+s/^EPRT \|1\|(\S*)/EPRT \|1\|/
 </strippart>
 
-# This test doesn't send a QUIT because the main state machine in multi.c
+# This test does not send a QUIT because the main state machine in multi.c
 # triggers the timeout and sets the CURLE_OPERATION_TIMEDOUT error (28) for
 # which the FTP disconnect code generically has to assume could mean the
 # control the connection and thus it cannot send any command.
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -53,6 +54,7 @@ TYPE I
 SIZE %TESTNUMBER
 RETR %TESTNUMBER
 </protocol>
+# 28 is CURLE_OPERATION_TIMEDOUT
 <errorcode>
 28
 </errorcode>
diff --git a/third-party/curl/tests/data/test1209 b/third-party/curl/tests/data/test1209
index 4975b10904..449e8f5fa9 100644
--- a/third-party/curl/tests/data/test1209
+++ b/third-party/curl/tests/data/test1209
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ PORT
 RETR
 NODATACONN
 timeout
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -24,10 +24,10 @@ NODATACONN
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP PORT download, no data conn and no positive preliminary reply
- </name>
- <command>
+</name>
+<command>
 --max-time %FTPTIME2 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -P -
 </command>
 
@@ -36,15 +36,15 @@ FTP PORT download, no data conn and no positive preliminary reply
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^EPRT \|1\|(.*)/EPRT \|1\|/
+s/^EPRT \|1\|(\S*)/EPRT \|1\|/
 </strippart>
 
-# The protocol part does not include QUIT simply because the error is
+# The protocol part does not include QUIT because the error is
 # CURLE_OPERATION_TIMEDOUT (28) which is a generic timeout error without
 # specifically saying for which connection it concerns, and for timeouts libcurl
 # marks the control channel as "invalid". As this test case times out for the
 # data connection it could still use the control channel.
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test121 b/third-party/curl/tests/data/test121
index e0491195b7..167fcc3501 100644
--- a/third-party/curl/tests/data/test121
+++ b/third-party/curl/tests/data/test121
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -25,17 +26,17 @@ works
 <server>
 ftp
 </server>
- <name>
+<name>
 ftp download with post- and pre-transfer delete operations
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -Q "-DELE after_transfer" -Q "DELE before_transfer"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1210 b/third-party/curl/tests/data/test1210
index e86970d255..cde8b8d8a7 100644
--- a/third-party/curl/tests/data/test1210
+++ b/third-party/curl/tests/data/test1210
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
 <data nocheck="yes">
 HTTP/1.1 200 OK
@@ -21,32 +21,22 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -J without Content-Disposition
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER?junk -J -O
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER?junk -J -O --output-dir %LOGDIR
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER?junk HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1211 b/third-party/curl/tests/data/test1211
index 7ff6d8cc1a..eb267d9dcb 100644
--- a/third-party/curl/tests/data/test1211
+++ b/third-party/curl/tests/data/test1211
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ PORT
 RETR
 NODATACONN425
 timeout
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -24,10 +24,10 @@ NODATACONN425
 <server>
 ftp
 </server>
- <name>
-FTP PORT and 425 on download
- </name>
- <command>
+<name>
+FTP PORT and 425 on download and timeout
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -P -
 </command>
 
@@ -36,10 +36,10 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -P -
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^EPRT \|1\|(.*)/EPRT \|1\|/
+s/^EPRT \|1\|(\S*)/EPRT \|1\|/
 </strippart>
 
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1212 b/third-party/curl/tests/data/test1212
index 88ab97331d..23d27c06ee 100644
--- a/third-party/curl/tests/data/test1212
+++ b/third-party/curl/tests/data/test1212
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -29,9 +30,9 @@ proxy
 <server>
 http
 </server>
- <name>
+<name>
 noproxy setting together with socks proxy
- </name>
+</name>
 
 <command>
 http://user:secret@%HOSTIP:%HTTPPORT/ulion/%TESTNUMBER --socks5 non-existing-host.haxx.se:1080 --noproxy %HOSTIP --max-time 5
@@ -40,10 +41,10 @@ http://user:secret@%HOSTIP:%HTTPPORT/ulion/%TESTNUMBER --socks5 non-existing-hos
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /ulion/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dXNlcjpzZWNyZXQ=
+Authorization: Basic %b64[user:secret]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test1213 b/third-party/curl/tests/data/test1213
index cfa47d3bc7..7cc8d6d498 100644
--- a/third-party/curl/tests/data/test1213
+++ b/third-party/curl/tests/data/test1213
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ HTTP proxy
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -26,13 +27,13 @@ the content goes here
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with proxy and host-only URL
- </name>
+</name>
 # the thing here is that this sloppy form is accepted and we convert it
 # for normal server use, and we need to make sure it gets converted to
 # RFC style even for proxies
- <command>
+<command>
 -x %HOSTIP:%HTTPPORT we.want.that.site.com.%TESTNUMBER
 </command>
 <features>
@@ -42,7 +43,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://we.want.that.site.com.%TESTNUMBER/ HTTP/1.1
 Host: we.want.that.site.com.%TESTNUMBER
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1214 b/third-party/curl/tests/data/test1214
index fea91b3fbd..2b4a86309e 100644
--- a/third-party/curl/tests/data/test1214
+++ b/third-party/curl/tests/data/test1214
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ HTTP proxy
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -26,13 +27,13 @@ the content goes here
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with proxy and URL with ? and no slash separator
- </name>
+</name>
 # the thing here is that this sloppy form is accepted and we convert it
 # for normal server use, and we need to make sure it gets converted to
 # RFC style even for proxies
- <command>
+<command>
 -x %HOSTIP:%HTTPPORT http://we.want.that.site.com.%TESTNUMBER?moo=foo
 </command>
 <features>
@@ -42,7 +43,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://we.want.that.site.com.%TESTNUMBER/?moo=foo HTTP/1.1
 Host: we.want.that.site.com.%TESTNUMBER
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1215 b/third-party/curl/tests/data/test1215
index f5dff5c99b..f52dc9ca8f 100644
--- a/third-party/curl/tests/data/test1215
+++ b/third-party/curl/tests/data/test1215
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 # This test is a copy of test 67, modified to use an HTTP proxy.
@@ -76,10 +77,10 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --ntlm --proxy http://
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test1216 b/third-party/curl/tests/data/test1216
index 82de9c69ac..6805025298 100644
--- a/third-party/curl/tests/data/test1216
+++ b/third-party/curl/tests/data/test1216
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ cookies
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Server: Microsoft-IIS/4.0
 Date: Tue, 25 Sep 2001 19:37:44 GMT
@@ -27,10 +28,10 @@ This server says moo
 <server>
 http
 </server>
- <name>
-HTTP cookie domains tailmatching the host name
- </name>
- <command>
+<name>
+HTTP cookie domains tailmatching the hostname
+</name>
+<command>
 http://example.fake/c/%TESTNUMBER http://bexample.fake/c/%TESTNUMBER -b %LOGDIR/injar%TESTNUMBER -x %HOSTIP:%HTTPPORT
 </command>
 <file name="%LOGDIR/injar%TESTNUMBER">
@@ -47,7 +48,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://example.fake/c/%TESTNUMBER HTTP/1.1
 Host: example.fake
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1217 b/third-party/curl/tests/data/test1217
index a0aba12886..f3c83742d4 100644
--- a/third-party/curl/tests/data/test1217
+++ b/third-party/curl/tests/data/test1217
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -22,10 +23,10 @@ REPLY PWD 257 there is rubbish all over "/this/is/the/path"
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP with rubbish before name in 257-response
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/get/file/%TESTNUMBER ftp://%HOSTIP:%FTPPORT/get/file/again/%TESTNUMBER --ftp-method singlecwd
 </command>
 </client>
@@ -37,7 +38,7 @@ ftp://%HOSTIP:%FTPPORT/get/file/%TESTNUMBER ftp://%HOSTIP:%FTPPORT/get/file/agai
 ^PORT \d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3}
 ^EPRT \|1\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|\d{1,5}\|
 </strip>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1218 b/third-party/curl/tests/data/test1218
index 86dfebfb87..e5eb84ec28 100644
--- a/third-party/curl/tests/data/test1218
+++ b/third-party/curl/tests/data/test1218
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,10 @@ cookies
 </keywords>
 </info>
 
-# This test is very similar to 1216, only that it sets the cookies from the
+# This test is similar to 1216, only that it sets the cookies from the
 # first site instead of reading from a file
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 25 Sep 2001 19:37:44 GMT
 Set-Cookie: bug=fixed; domain=.example.fake;
@@ -26,10 +27,10 @@ This server says moo
 <server>
 http
 </server>
- <name>
+<name>
 HTTP cookies and domains with same prefix
- </name>
- <command>
+</name>
+<command>
 http://example.fake/c/%TESTNUMBER http://example.fake/c/%TESTNUMBER http://bexample.fake/c/%TESTNUMBER -b nonexisting -x %HOSTIP:%HTTPPORT
 </command>
 <features>
@@ -40,7 +41,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://example.fake/c/%TESTNUMBER HTTP/1.1
 Host: example.fake
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1219 b/third-party/curl/tests/data/test1219
index 376058e5e2..ed82015927 100644
--- a/third-party/curl/tests/data/test1219
+++ b/third-party/curl/tests/data/test1219
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -26,10 +27,10 @@ REPLY welcome 230 welcome without password
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP with no user+password required (230 response)
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 
@@ -37,7 +38,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 PWD
 EPSV
 TYPE I
diff --git a/third-party/curl/tests/data/test122 b/third-party/curl/tests/data/test122
index e8e310f946..334a5a3409 100644
--- a/third-party/curl/tests/data/test122
+++ b/third-party/curl/tests/data/test122
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -21,17 +22,17 @@ REPLY EPSV 500 no such command
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download resume with whole file already downloaded
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -C 5
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1220 b/third-party/curl/tests/data/test1220
index d7e2ff9424..99d4fc3a36 100644
--- a/third-party/curl/tests/data/test1220
+++ b/third-party/curl/tests/data/test1220
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -17,9 +18,9 @@ URL
 <server>
 file
 </server>
- <name>
+<name>
 file:// URLs with query string
- </name>
+</name>
 <command option="no-include">
 file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt?a_query=foobar#afragment
 </command>
diff --git a/third-party/curl/tests/data/test1221 b/third-party/curl/tests/data/test1221
index 43f5107a61..5ff7add995 100644
--- a/third-party/curl/tests/data/test1221
+++ b/third-party/curl/tests/data/test1221
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ HTTP POST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 I am cool swsclose
 Server: Cool server/10.0
 Content-Length: 0
@@ -19,28 +19,32 @@ Content-Length: 0
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 --url-query with --data-urlencode
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER --url-query "my name is moo[]" --url-query "yes=s i r" --url-query "v_alue@%LOGDIR/%TESTNUMBER.txt" --url-query @%LOGDIR/%TESTNUMBER.txt --url-query "+%3d%3d" --data-urlencode "start=once upon the time"
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+--url-query "my name is moo[]"
+--url-query "yes=s i r"
+--url-query "v_alue@%LOGDIR/%TESTNUMBER.txt"
+--url-query @%LOGDIR/%TESTNUMBER.txt
+--url-query "+%3d%3d"
+--data-urlencode "start=once upon the time"
 </command>
 <file name="%LOGDIR/%TESTNUMBER.txt">
-content to _?!#$'|<>
+content to _?!#$'|%LT%GT
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
-POST /%TESTNUMBER?my+name+is+moo%5b%5d&yes=s+i+r&v_alue=content+to+_%3f%21%23%24%27%7c%3c%3e%0a&content+to+_%3f%21%23%24%27%7c%3c%3e%0a&%3d%3d HTTP/1.1
+<protocol crlf="yes" nonewline="yes">
+POST /%TESTNUMBER?my+name+is+moo%5B%5D%AMPyes=s+i+r%AMPv_alue=content+to+_%3F%21%23%24%27%7C%3C%3E%0A%AMPcontent+to+_%3F%21%23%24%27%7C%3C%3E%0A%AMP%3D%3D HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test1222 b/third-party/curl/tests/data/test1222
index e65b514ea2..1ea082569f 100644
--- a/third-party/curl/tests/data/test1222
+++ b/third-party/curl/tests/data/test1222
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,19 +6,14 @@ source analysis
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
-
- <name>
+<name>
 Verify deprecation statuses and versions
- </name>
+</name>
 
 <command type="perl">
-%SRCDIR/check-deprecated.pl %SRCDIR/..
+%SRCDIR/test1222.pl %SRCDIR/.. %PWD/..
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test1223 b/third-party/curl/tests/data/test1223
index d5a6f5d813..f58c3ea79d 100644
--- a/third-party/curl/tests/data/test1223
+++ b/third-party/curl/tests/data/test1223
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # disable data check since it gets sent to stdout and is verified there
 <reply>
 <data nocheck="yes">
@@ -20,24 +20,22 @@ hej
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET -w remote_ip and -w remote_port
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w 'IP %{remote_ip} and PORT %{remote_port}\n'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1224 b/third-party/curl/tests/data/test1224
index 5ae26769df..6e978a8a1b 100644
--- a/third-party/curl/tests/data/test1224
+++ b/third-party/curl/tests/data/test1224
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,10 +24,10 @@ works
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP fetch a file from the root directory
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT//%TESTNUMBER
 </command>
 
@@ -34,7 +35,7 @@ ftp://%HOSTIP:%FTPPORT//%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1225 b/third-party/curl/tests/data/test1225
index 4229a6c4d5..35befb8aff 100644
--- a/third-party/curl/tests/data/test1225
+++ b/third-party/curl/tests/data/test1225
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,10 +24,10 @@ works
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP fetch two files using absolute paths
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT//foo/%TESTNUMBER ftp://%HOSTIP:%FTPPORT//foo/bar/%TESTNUMBER
 </command>
 
@@ -34,7 +35,7 @@ ftp://%HOSTIP:%FTPPORT//foo/%TESTNUMBER ftp://%HOSTIP:%FTPPORT//foo/bar/%TESTNUM
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1226 b/third-party/curl/tests/data/test1226
index fe6d5f5e3c..fa13915362 100644
--- a/third-party/curl/tests/data/test1226
+++ b/third-party/curl/tests/data/test1226
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,10 +24,10 @@ works
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP fetch a file from the root directory with singlecwd
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT//%TESTNUMBER --ftp-method singlecwd
 </command>
 
@@ -34,7 +35,7 @@ ftp://%HOSTIP:%FTPPORT//%TESTNUMBER --ftp-method singlecwd
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1227 b/third-party/curl/tests/data/test1227
index a50c3fd3bc..c308e176b1 100644
--- a/third-party/curl/tests/data/test1227
+++ b/third-party/curl/tests/data/test1227
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,10 +24,10 @@ works
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP fetch a file from the root directory with nocwd
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT//%TESTNUMBER --ftp-method nocwd
 </command>
 
@@ -34,7 +35,7 @@ ftp://%HOSTIP:%FTPPORT//%TESTNUMBER --ftp-method nocwd
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1228 b/third-party/curl/tests/data/test1228
index e718dbdca5..8e8a4155b6 100644
--- a/third-party/curl/tests/data/test1228
+++ b/third-party/curl/tests/data/test1228
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -25,10 +26,10 @@ This server says cookie path test
 <server>
 http
 </server>
- <name>
+<name>
 HTTP cookie path match
- </name>
- <command>
+</name>
+<command>
 http://example.fake/hoge/%TESTNUMBER http://example.fake/hogege/ -b nonexisting -x %HOSTIP:%HTTPPORT
 </command>
 <features>
@@ -39,7 +40,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://example.fake/hoge/%TESTNUMBER HTTP/1.1
 Host: example.fake
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1229 b/third-party/curl/tests/data/test1229
index 3171fd0135..5c0fe6d232 100644
--- a/third-party/curl/tests/data/test1229
+++ b/third-party/curl/tests/data/test1229
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP Digest auth
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145"
@@ -20,7 +21,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -29,7 +30,7 @@ Content-Length: 23
 This IS the real page!
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145"
@@ -54,18 +55,19 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
-HTTP with Digest authorization with user name needing escape
- </name>
- <command>
+<name>
+HTTP with Digest authorization with username needing escape
+</name>
+<command>
 http://%5cuser%22:password@%HOSTIP:%HTTPPORT/%TESTNUMBER --digest
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test123 b/third-party/curl/tests/data/test123
index b8e31c6b65..d2c9384b9c 100644
--- a/third-party/curl/tests/data/test123
+++ b/third-party/curl/tests/data/test123
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -15,10 +16,10 @@ Resume
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP upload resume with whole file already downloaded
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T %LOGDIR/upload%TESTNUMBER -C 51
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
@@ -28,7 +29,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T %LOGDIR/upload%TESTNUMBER -C 51
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1230 b/third-party/curl/tests/data/test1230
index fe8136ee2d..726ba28601 100644
--- a/third-party/curl/tests/data/test1230
+++ b/third-party/curl/tests/data/test1230
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,11 +9,10 @@ IPv6
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 9
@@ -20,13 +20,13 @@ Content-Length: 9
 mooooooo
 </data>
 
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 welcome dear
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 
 </connect>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 welcome dear
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 
@@ -38,11 +38,10 @@ mooooooo
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-ipv6
+IPv6
 proxy
 </features>
 <server>
@@ -50,19 +49,18 @@ http-proxy
 http-ipv6
 http
 </server>
- <name>
+<name>
 HTTP CONNECT to IPv6 numerical address
- </name>
+</name>
 # 0x4ce == %TESTNUMBER, the test number
- <command>
+<command>
 http://[1234:1234:1234::4ce]:%HTTPPORT/wanted/page/%TESTNUMBER -p -x %HOSTIP:%HTTPPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 CONNECT [1234:1234:1234::4ce]:%HTTPPORT HTTP/1.1
 Host: [1234:1234:1234::4ce]:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1231 b/third-party/curl/tests/data/test1231
index 8e1ae916d6..5855d69a46 100644
--- a/third-party/curl/tests/data/test1231
+++ b/third-party/curl/tests/data/test1231
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ dotdot removal
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -27,24 +27,22 @@ Connection: close
 </data1>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP URL with dotdot removal from path
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/../../hej/but/who/../%TESTNUMBER?stupid=me/../%TESTNUMBER#soo/../%TESTNUMBER http://%HOSTIP:%HTTPPORT/../../hej/but/who/../%TESTNUMBER0001#/../%TESTNUMBER0001
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /hej/but/%TESTNUMBER?stupid=me/../%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1232 b/third-party/curl/tests/data/test1232
index 7a694417d9..c2cf4aa48f 100644
--- a/third-party/curl/tests/data/test1232
+++ b/third-party/curl/tests/data/test1232
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 # This test is a copy of test 1231, modified to use an HTTP proxy.
@@ -9,7 +10,6 @@ dotdot removal
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -29,16 +29,15 @@ Connection: close
 </data1>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP URL with dotdot removal from path using an HTTP proxy
- </name>
- <command>
+</name>
+<command>
 --proxy http://%HOSTIP:%HTTPPORT http://test.remote.haxx.se.%TESTNUMBER:8990/../../hej/but/who/../%TESTNUMBER?stupid=me/../%TESTNUMBER#soo/../%TESTNUMBER http://test.remote.haxx.se.%TESTNUMBER:8990/../../hej/but/who/../%TESTNUMBER0001#/../%TESTNUMBER0001
 </command>
 <features>
@@ -46,10 +45,9 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://test.remote.haxx.se.%TESTNUMBER:8990/hej/but/%TESTNUMBER?stupid=me/../%TESTNUMBER HTTP/1.1
 Host: test.remote.haxx.se.%TESTNUMBER:8990
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1233 b/third-party/curl/tests/data/test1233
index 17beb00672..934c4b7836 100644
--- a/third-party/curl/tests/data/test1233
+++ b/third-party/curl/tests/data/test1233
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,8 +10,8 @@ connect to non-listen
 # Server-side
 <reply>
 <servercmd>
-# Assuming there's nothing listening on port 1
-REPLY EPSV 229 Entering Passiv Mode (|||1|)
+# Assuming there is nothing listening on port 1
+REPLY EPSV 229 Entering Passive Mode (|||1|)
 </servercmd>
 <data>
 here are some bytes
@@ -22,17 +23,17 @@ here are some bytes
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP failing to connect to EPSV port, switching to PASV
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1234 b/third-party/curl/tests/data/test1234
index c20b3b4a3b..bb3cde5974 100644
--- a/third-party/curl/tests/data/test1234
+++ b/third-party/curl/tests/data/test1234
@@ -1,9 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 globbing
 {} list
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -12,13 +12,10 @@ FAILURE
 
 # Client-side
 <client>
-<server>
-none
-</server>
- <name>
+<name>
 abusing {}-globbing
- </name>
- <command>
+</name>
+<command>
 "%HOSTIP:%NOLISTENPORT/%TESTNUMBER[0-1]{" "%HOSTIP:%NOLISTENPORT/{}{}{}{"
 </command>
 </client>
diff --git a/third-party/curl/tests/data/test1235 b/third-party/curl/tests/data/test1235
index a1086fc483..fc3fd5fe70 100644
--- a/third-party/curl/tests/data/test1235
+++ b/third-party/curl/tests/data/test1235
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,14 +10,14 @@ globbing
 </info>
 # Server-side
 <reply>
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 200 OK
 Funny-head: yesyes
 Content-Length: 15
 
 the number one
 </data1>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK
 Funny-head: yesyes
 Content-Length: 16
@@ -30,17 +31,17 @@ two is nice too
 <server>
 http
 </server>
- <name>
+<name>
 multiple requests using {}{} in the URL
- </name>
- <command>
+</name>
+<command>
 "%HOSTIP:%HTTPPORT/{%TESTNUMBER,%TESTNUMBER}{0001,0002}"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0001 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -62,7 +63,7 @@ User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 200 OK
 Funny-head: yesyes
 Content-Length: 15
diff --git a/third-party/curl/tests/data/test1236 b/third-party/curl/tests/data/test1236
index 7408a7bae0..2b7318516d 100644
--- a/third-party/curl/tests/data/test1236
+++ b/third-party/curl/tests/data/test1236
@@ -1,8 +1,8 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 globbing
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -11,14 +11,11 @@ FAILURE
 
 # Client-side
 <client>
-<server>
-none
-</server>
- <name>
+<name>
 [] globbing overflowing the range counter
- </name>
+</name>
 # 2^62 == 4611686018427387904
- <command>
+<command>
 "%HOSTIP:%NOLISTENPORT/1234[0-1]{" "%HOSTIP:%NOLISTENPORT/[1-4611686018427387904][1-4611686018427387904]"
 </command>
 </client>
diff --git a/third-party/curl/tests/data/test1237 b/third-party/curl/tests/data/test1237
index 2ccfb53e50..8391d29f19 100644
--- a/third-party/curl/tests/data/test1237
+++ b/third-party/curl/tests/data/test1237
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,20 +24,20 @@ Content-Type: text/html
 <server>
 http
 </server>
- <name>
-URL with 1000+ letter user name + password
- </name>
- <command>
-"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB@%HOSTIP:%HTTPPORT/%TESTNUMBER"
+<name>
+URL with 1000+ letter username + password
+</name>
+<command>
+"%repeat[1000 x A]%:%repeat[1002 x B]%@%HOSTIP:%HTTPPORT/%TESTNUMBER"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQTpCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkI=
+Authorization: Basic %b64[AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test1238 b/third-party/curl/tests/data/test1238
index 3e36fbfcca..bb9b5d2b2b 100644
--- a/third-party/curl/tests/data/test1238
+++ b/third-party/curl/tests/data/test1238
@@ -1,27 +1,25 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 TFTP
 TFTP RRQ
 timeout
-FAILURE
 DELAY
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 writedelay: 2000
 </servercmd>
-# ~1200 bytes (so that they don't fit in two 512 byte chunks)
+# ~1200 bytes (so that they do not fit in two 512-byte chunks)
 <data nocheck="yes">
 012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -35,16 +33,15 @@ tftp
 <killserver>
 tftp
 </killserver>
- <name>
+<name>
 slow TFTP retrieve cancel due to -Y and -y
- </name>
+</name>
 # if less than 1000 bytes/sec within 2 seconds, abort!
- <command>
+<command>
 tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER -Y1000 -y2
 </command>
 </client>
 
-#
 # Verify pseudo protocol after the test has been "shot"
 <verify>
 <strip>
diff --git a/third-party/curl/tests/data/test1239 b/third-party/curl/tests/data/test1239
index 6def4aaee6..af8b369540 100644
--- a/third-party/curl/tests/data/test1239
+++ b/third-party/curl/tests/data/test1239
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 -z
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -24,24 +24,22 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with -z + -w response_code and simulated 304
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -z "-dec 12 12:00:00 1999 GMT" -w '%{response_code}'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test124 b/third-party/curl/tests/data/test124
index e5830dec27..6fe620f767 100644
--- a/third-party/curl/tests/data/test124
+++ b/third-party/curl/tests/data/test124
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -22,17 +23,17 @@ REPLY EPSV 314 bluah you f00l!
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download, failed PWD
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1240 b/third-party/curl/tests/data/test1240
index 73091990e4..3fc342d2ac 100644
--- a/third-party/curl/tests/data/test1240
+++ b/third-party/curl/tests/data/test1240
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -21,17 +22,17 @@ Connection: close
 <server>
 http
 </server>
- <name>
+<name>
 glob [0-1] with stuff after range (7.33.0 regression)
- </name>
- <command>
+</name>
+<command>
 "%HOSTIP:%HTTPPORT/0[0-1]/%TESTNUMBER"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /00/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1241 b/third-party/curl/tests/data/test1241
index 98dfaf51c3..d4f370e1c0 100644
--- a/third-party/curl/tests/data/test1241
+++ b/third-party/curl/tests/data/test1241
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 # verify that dotdot removal can be disabled!
@@ -8,7 +9,6 @@ HTTP proxy
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -28,16 +28,15 @@ Connection: close
 </data1>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP _without_ dotdot removal
- </name>
- <command>
+</name>
+<command>
 --path-as-is --proxy http://%HOSTIP:%HTTPPORT http://test.remote.haxx.se.%TESTNUMBER:8990/../../hej/but/who/../%TESTNUMBER?stupid=me/../%TESTNUMBER#soo/../%TESTNUMBER http://test.remote.haxx.se.%TESTNUMBER:8990/../../hej/but/who/../%TESTNUMBER0001#/../%TESTNUMBER0001
 </command>
 <features>
@@ -45,10 +44,9 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://test.remote.haxx.se.%TESTNUMBER:8990/../../hej/but/who/../%TESTNUMBER?stupid=me/../%TESTNUMBER HTTP/1.1
 Host: test.remote.haxx.se.%TESTNUMBER:8990
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1242 b/third-party/curl/tests/data/test1242
index 61938a0417..1b23e4cb2e 100644
--- a/third-party/curl/tests/data/test1242
+++ b/third-party/curl/tests/data/test1242
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ TFTP RRQ
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -17,21 +17,19 @@ returned
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 tftp
 </server>
- <name>
+<name>
 TFTP retrieve without TFTP options requests
- </name>
- <command>
+</name>
+<command>
 tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER --tftp-no-options
 </command>
 </client>
 
-#
 # Verify pseudo protocol after the test has been "shot"
 <verify>
 <protocol>
diff --git a/third-party/curl/tests/data/test1243 b/third-party/curl/tests/data/test1243
index 7f71631917..a65ea3c2b0 100644
--- a/third-party/curl/tests/data/test1243
+++ b/third-party/curl/tests/data/test1243
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,16 +7,15 @@ TFTP WRQ
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 tftp
 </server>
- <name>
+<name>
 TFTP send without TFTP options requests
- </name>
- <command>
+</name>
+<command>
 -T %LOGDIR/test%TESTNUMBER.txt tftp://%HOSTIP:%TFTPPORT// --tftp-no-options
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
@@ -26,7 +26,6 @@ sent
 </file>
 </client>
 
-#
 # Verify pseudo protocol after the test has been "shot"
 <verify>
 <upload>
diff --git a/third-party/curl/tests/data/test1244 b/third-party/curl/tests/data/test1244
index 3a6f7773b0..d056f61c44 100644
--- a/third-party/curl/tests/data/test1244
+++ b/third-party/curl/tests/data/test1244
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 HTTP proxy
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -25,7 +25,6 @@ wrong
 </data1>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -43,14 +42,13 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -x %HOSTIP:%HTTPPORT --next http://%HOSTIP:
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # the second request meant to fail
 <errorcode>
 56
 </errorcode>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1245 b/third-party/curl/tests/data/test1245
index 248a54149a..5dc1e1b9f9 100644
--- a/third-party/curl/tests/data/test1245
+++ b/third-party/curl/tests/data/test1245
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,10 +11,9 @@ followlocation
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 301 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -24,7 +24,6 @@ Connection: close
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -39,10 +38,9 @@ ftp
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1246 b/third-party/curl/tests/data/test1246
index a208ad9cd5..12a7680961 100644
--- a/third-party/curl/tests/data/test1246
+++ b/third-party/curl/tests/data/test1246
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 # verify URL with hostname ending in pound sign
@@ -8,7 +9,6 @@ HTTP proxy
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -28,16 +28,15 @@ Connection: close
 </data1>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
-URL with '#' at end of host name instead of '/'
- </name>
- <command>
+<name>
+URL with '#' at end of hostname instead of '/'
+</name>
+<command>
 --proxy http://%HOSTIP:%HTTPPORT http://test.remote.haxx.se.%TESTNUMBER:%HTTPPORT#@127.0.0.1/tricked.html no-scheme-url.com.%TESTNUMBER:%HTTPPORT#@127.127.127.127/again.html
 </command>
 <features>
@@ -45,10 +44,9 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://test.remote.haxx.se.%TESTNUMBER:%HTTPPORT/ HTTP/1.1
 Host: test.remote.haxx.se.%TESTNUMBER:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1247 b/third-party/curl/tests/data/test1247
index 02c695cd6d..f6d5f5cd13 100644
--- a/third-party/curl/tests/data/test1247
+++ b/third-party/curl/tests/data/test1247
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,28 +7,25 @@ HTTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 --fail-early
- </name>
- <command>
+</name>
+<command>
 --fail-early h1234://%HOSTIP:%HTTPPORT/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # Protocol "h1234" not supported or disabled in libcurl
diff --git a/third-party/curl/tests/data/test1248 b/third-party/curl/tests/data/test1248
index 68218655aa..e54729130b 100644
--- a/third-party/curl/tests/data/test1248
+++ b/third-party/curl/tests/data/test1248
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -29,7 +30,7 @@ proxy
 http
 </server>
 <name>
-Access a non-proxied host with using the combination of --proxy option and --noproxy option
+Non-proxied host plus --proxy option and --noproxy option
 </name>
 <command>
 http://user:secret@%HOSTIP:%HTTPPORT/%TESTNUMBER --proxy http://dummy:%NOLISTENPORT/ --noproxy %HOSTIP --max-time 5
@@ -38,10 +39,10 @@ http://user:secret@%HOSTIP:%HTTPPORT/%TESTNUMBER --proxy http://dummy:%NOLISTENP
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dXNlcjpzZWNyZXQ=
+Authorization: Basic %b64[user:secret]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test1249 b/third-party/curl/tests/data/test1249
index 1e3bc0f5d8..5a779605bf 100644
--- a/third-party/curl/tests/data/test1249
+++ b/third-party/curl/tests/data/test1249
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -29,7 +30,7 @@ proxy
 http
 </server>
 <name>
-Access a non-proxied host with using the combination of --proxy option and NO_PROXY env var
+Non-proxied plus --proxy option and NO_PROXY env var
 </name>
 <setenv>
 NO_PROXY=%HOSTIP
@@ -41,10 +42,10 @@ http://user:secret@%HOSTIP:%HTTPPORT/%TESTNUMBER --proxy http://dummy:%NOLISTENP
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dXNlcjpzZWNyZXQ=
+Authorization: Basic %b64[user:secret]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test125 b/third-party/curl/tests/data/test125
index 80294f9027..1f28daaf0f 100644
--- a/third-party/curl/tests/data/test125
+++ b/third-party/curl/tests/data/test125
@@ -1,8 +1,8 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -17,10 +17,10 @@ REPLY CWD 314 bluah you f00l!
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download, failed CWD
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/to/file/%TESTNUMBER
 </command>
 </client>
@@ -30,7 +30,7 @@ ftp://%HOSTIP:%FTPPORT/path/to/file/%TESTNUMBER
 <errorcode>
 9
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1250 b/third-party/curl/tests/data/test1250
index ed833b3750..b7a260996a 100644
--- a/third-party/curl/tests/data/test1250
+++ b/third-party/curl/tests/data/test1250
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,7 +28,7 @@ foo
 http
 </server>
 <name>
-Access a non-proxied host with using the combination of http_proxy env var and --noproxy option
+Non-proxied host plus http_proxy env var and --noproxy option
 </name>
 <setenv>
 http_proxy=http://dummy:%PROXYPORT/
@@ -39,10 +40,10 @@ http://user:secret@%HOSTIP:%HTTPPORT/%TESTNUMBER --noproxy %HOSTIP --max-time 5
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dXNlcjpzZWNyZXQ=
+Authorization: Basic %b64[user:secret]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test1251 b/third-party/curl/tests/data/test1251
index e332da85a1..175e2fba06 100644
--- a/third-party/curl/tests/data/test1251
+++ b/third-party/curl/tests/data/test1251
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,7 +28,7 @@ foo
 http
 </server>
 <name>
-Access a non-proxied host with using the combination of http_proxy env var and NO_PROXY env var
+Non-proxied host plus http_proxy env var and NO_PROXY env var
 </name>
 <setenv>
 http_proxy=http://dummy:%PROXYPORT/
@@ -40,10 +41,10 @@ http://user:secret@%HOSTIP:%HTTPPORT/%TESTNUMBER --max-time 5
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dXNlcjpzZWNyZXQ=
+Authorization: Basic %b64[user:secret]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test1252 b/third-party/curl/tests/data/test1252
index 590125add0..4c1a5e6364 100644
--- a/third-party/curl/tests/data/test1252
+++ b/third-party/curl/tests/data/test1252
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -30,7 +31,7 @@ proxy
 http
 </server>
 <name>
-Under condition using --proxy, override NO_PROXY by --nproxy and access target URL directly
+--proxy, override NO_PROXY by --noproxy and access target URL directly
 </name>
 <setenv>
 NO_PROXY=example.com
@@ -42,7 +43,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --proxy http://%HOSTIP:%HTTPPORT --noproxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1253 b/third-party/curl/tests/data/test1253
index 373215ba75..621ecf9401 100644
--- a/third-party/curl/tests/data/test1253
+++ b/third-party/curl/tests/data/test1253
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,7 +28,7 @@ foo
 http
 </server>
 <name>
-Under condition using --proxy, override NO_PROXY by --nproxy and access target URL through proxy
+--proxy, override NO_PROXY by --noproxy and access target URL through proxy
 </name>
 <setenv>
 NO_PROXY=example.com
@@ -42,7 +43,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://somewhere.example.com/%TESTNUMBER HTTP/1.1
 Host: somewhere.example.com
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1254 b/third-party/curl/tests/data/test1254
index 77cef49cc3..56852143d1 100644
--- a/third-party/curl/tests/data/test1254
+++ b/third-party/curl/tests/data/test1254
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,7 +28,7 @@ foo
 http
 </server>
 <name>
-Under condition using --proxy, override NO_PROXY by --nproxy and access target URL through proxy
+override NO_PROXY by --noproxy and access target URL through proxy
 </name>
 <setenv>
 NO_PROXY=example.com
@@ -42,7 +43,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://somewhere.example.com/%TESTNUMBER HTTP/1.1
 Host: somewhere.example.com
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1255 b/third-party/curl/tests/data/test1255
index 29d1fd6081..57780f110d 100644
--- a/third-party/curl/tests/data/test1255
+++ b/third-party/curl/tests/data/test1255
@@ -1,8 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP proxy
+http_proxy
 NO_PROXY
 noproxy
 </keywords>
@@ -27,7 +29,7 @@ foo
 http
 </server>
 <name>
-Under condition using http_proxy, override NO_PROXY by --nproxy and access target URL directly
+http_proxy, override NO_PROXY by --noproxy and access target URL directly
 </name>
 <setenv>
 http_proxy=http://%HOSTIP:%HTTPPORT
@@ -40,7 +42,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --noproxy %HOSTIP
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1256 b/third-party/curl/tests/data/test1256
index 244e8d7075..7db26428ec 100644
--- a/third-party/curl/tests/data/test1256
+++ b/third-party/curl/tests/data/test1256
@@ -1,8 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP proxy
+http_proxy
 NO_PROXY
 noproxy
 </keywords>
@@ -27,7 +29,7 @@ foo
 http
 </server>
 <name>
-Under condition using http_proxy, override NO_PROXY by --nproxy and access target URL through proxy
+http_proxy, override NO_PROXY by --noproxy host
 </name>
 <setenv>
 http_proxy=http://%HOSTIP:%HTTPPORT
@@ -43,7 +45,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://somewhere.example.com/%TESTNUMBER HTTP/1.1
 Host: somewhere.example.com
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1257 b/third-party/curl/tests/data/test1257
index 8d2727fd9f..fc6f56e33c 100644
--- a/third-party/curl/tests/data/test1257
+++ b/third-party/curl/tests/data/test1257
@@ -1,8 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP proxy
+http_proxy
 NO_PROXY
 noproxy
 </keywords>
@@ -27,7 +29,7 @@ foo
 http
 </server>
 <name>
-Under condition using http_proxy, override NO_PROXY by --nproxy and access target URL through proxy
+http_proxy, override NO_PROXY by --noproxy ""
 </name>
 <setenv>
 http_proxy=http://%HOSTIP:%HTTPPORT
@@ -43,7 +45,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://somewhere.example.com/%TESTNUMBER HTTP/1.1
 Host: somewhere.example.com
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1258 b/third-party/curl/tests/data/test1258
index b99a26bf34..e36e21f6c3 100644
--- a/third-party/curl/tests/data/test1258
+++ b/third-party/curl/tests/data/test1258
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ httponly
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.0 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Type: text/html
@@ -26,10 +27,10 @@ boo
 <server>
 http
 </server>
- <name>
+<name>
 HTTP, use cookies with localhost
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER http://%HOSTIP:%HTTPPORT/we/want?hoge=fuga -b non-existing -H "Host: localhost"
 </command>
 <features>
@@ -39,7 +40,7 @@ cookies
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/%TESTNUMBER HTTP/1.1
 Host: localhost
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1259 b/third-party/curl/tests/data/test1259
index a5f5e03a36..a74630aa8f 100644
--- a/third-party/curl/tests/data/test1259
+++ b/third-party/curl/tests/data/test1259
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP GET
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.0 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Type: text/html
@@ -23,20 +24,20 @@ boo
 <server>
 http
 </server>
- <name>
+<name>
 HTTP URL with semicolon in password
- </name>
- <command>
+</name>
+<command>
 "http://user:pass;word@%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dXNlcjpwYXNzO3dvcmQ=
+Authorization: Basic %b64[user:pass]b64%O3dvcmQ=
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test126 b/third-party/curl/tests/data/test126
index a56fe80e31..071d2f9052 100644
--- a/third-party/curl/tests/data/test126
+++ b/third-party/curl/tests/data/test126
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -22,17 +23,17 @@ RETRWEIRDO
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download with multiple replies at once in RETR
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/blalbla/lululul/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1260 b/third-party/curl/tests/data/test1260
index cff79e2988..7f3f4ee82a 100644
--- a/third-party/curl/tests/data/test1260
+++ b/third-party/curl/tests/data/test1260
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,16 +13,13 @@ HTTP GET
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 http
 </features>
- <name>
+<name>
 HTTP URL with rubbish after port number
- </name>
- <command>
+</name>
+<command>
 -g "http://[%HOSTIP]:%NOLISTENPORT:80/we/want/%TESTNUMBER" "http://%HOSTIP:%NOLISTENPORT:80/we/want/%TESTNUMBER" "http://user@example.com:80@localhost"
 </command>
 </client>
diff --git a/third-party/curl/tests/data/test1261 b/third-party/curl/tests/data/test1261
index 85172b6cb0..3479f1e78e 100644
--- a/third-party/curl/tests/data/test1261
+++ b/third-party/curl/tests/data/test1261
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ followlocation
 
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 301 This is a weirdo text message swsclose
 Location: data/10290002.txt?coolsite=yes
 Content-Length: 62
@@ -26,17 +27,17 @@ This server reply is for testing a simple Location: following
 <server>
 http
 </server>
- <name>
+<name>
 'redirect_url' with --location and --max-redirs
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER -w '%{redirect_url}\n' --location --max-redirs 0
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/our/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -47,7 +48,7 @@ Accept: */*
 <errorcode>
 47
 </errorcode>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 301 This is a weirdo text message swsclose
 Location: data/10290002.txt?coolsite=yes
 Content-Length: 62
diff --git a/third-party/curl/tests/data/test1262 b/third-party/curl/tests/data/test1262
index 79f96d4e4a..dd11d23051 100644
--- a/third-party/curl/tests/data/test1262
+++ b/third-party/curl/tests/data/test1262
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # similar to test 139 but with a reversed time condition
 <info>
@@ -19,16 +20,16 @@ RETR
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP request and denied to download an older file with -z
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/blalbla/%TESTNUMBER -z "-1 jan 2001"
 </command>
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1263 b/third-party/curl/tests/data/test1263
index ef42f20e02..4129e13e71 100644
--- a/third-party/curl/tests/data/test1263
+++ b/third-party/curl/tests/data/test1263
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # similar to test 1260
 <info>
@@ -13,16 +14,13 @@ HTTP GET
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 http
 </features>
- <name>
+<name>
 HTTP URL with rubbish after IPv6 bracket
- </name>
- <command>
+</name>
+<command>
 -g "http://[%HOSTIP]test:%NOLISTENPORT/we/want/%TESTNUMBER" "http://[%HOSTIP][%HOSTIP]:%NOLISTENPORT/we/want/%TESTNUMBER" "http://user@[::1]@localhost"
 </command>
 </client>
diff --git a/third-party/curl/tests/data/test1264 b/third-party/curl/tests/data/test1264
index 54fb6ffa30..210a7fe4ef 100644
--- a/third-party/curl/tests/data/test1264
+++ b/third-party/curl/tests/data/test1264
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,16 +13,13 @@ HTTP GET
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 http
 </features>
- <name>
-HTTP URL with space in host name
- </name>
- <command>
+<name>
+HTTP URL with space in hostname
+</name>
+<command>
 -g "http://127.0.0.1 www.example.com/we/want/%TESTNUMBER"
 </command>
 </client>
diff --git a/third-party/curl/tests/data/test1265 b/third-party/curl/tests/data/test1265
index 873b369cde..e7b027a81f 100644
--- a/third-party/curl/tests/data/test1265
+++ b/third-party/curl/tests/data/test1265
@@ -1,10 +1,13 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP proxy
+http_proxy
 NO_PROXY
 noproxy
+IPv6
 </keywords>
 </info>
 
@@ -23,6 +26,10 @@ foo
 
 # Client-side
 <client>
+<features>
+http
+IPv6
+</features>
 <server>
 http-ipv6
 </server>
@@ -40,7 +47,7 @@ http://%HOST6IP:%HTTP6PORT/%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOST6IP:%HTTP6PORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1266 b/third-party/curl/tests/data/test1266
index fc91edbaca..a324e14cb7 100644
--- a/third-party/curl/tests/data/test1266
+++ b/third-party/curl/tests/data/test1266
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ HTTP/0.9
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -16,28 +16,22 @@ swsclose
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
-# hyper doesn't grok HTTP/0.9
-<features>
-!hyper
-</features>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with a single-byte HTTP/0.9 response
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --http0.9
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1267 b/third-party/curl/tests/data/test1267
index e74fe83753..8dbfac9207 100644
--- a/third-party/curl/tests/data/test1267
+++ b/third-party/curl/tests/data/test1267
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ HTTP/0.9
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -16,28 +16,22 @@ swsclose
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
-# hyper doesn't grok HTTP/0.9
-<features>
-!hyper
-</features>
 <server>
 http
 </server>
- <name>
-HTTP GET with a invalid HTTP/1 response line start
- </name>
- <command>
+<name>
+HTTP GET with an invalid HTTP/1 response line start
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --http0.9
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1268 b/third-party/curl/tests/data/test1268
index 257b4726ed..ab1b5d6fdd 100644
--- a/third-party/curl/tests/data/test1268
+++ b/third-party/curl/tests/data/test1268
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,32 +6,27 @@ warning
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
-unix-sockets
+UnixSockets
 </features>
- <name>
-file name argument looks like a flag
- </name>
- <command>
---stderr %LOGDIR/moo%TESTNUMBER --unix-socket -k hej://moo
+<name>
+filename argument looks like a flag
+</name>
+<command>
+--stderr %LOGDIR/moo%TESTNUMBER --unix-socket -q hej://moo
 </command>
 </client>
 
 <verify>
 <file name="%LOGDIR/moo%TESTNUMBER" mode="text">
-Warning: The file name argument '-k' looks like a flag.
-curl: (1) Protocol "hej" not supported or disabled in libcurl
+Warning: The filename argument '-q' looks like a flag.
+curl: (1) Protocol "hej" not supported
 </file>
 
 # we expect an error since we provide a weird URL
diff --git a/third-party/curl/tests/data/test1269 b/third-party/curl/tests/data/test1269
index f68cf9c09b..2dab1f4210 100644
--- a/third-party/curl/tests/data/test1269
+++ b/third-party/curl/tests/data/test1269
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,26 +6,20 @@
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
- <name>
+<name>
 too large --retry-delay value
- </name>
- <command>
+</name>
+<command>
 --retry 3 --retry-delay 9223372036854776 http://%HOSTIP:%NOLISTENPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test127 b/third-party/curl/tests/data/test127
index b1661e5aff..b34158c278 100644
--- a/third-party/curl/tests/data/test127
+++ b/third-party/curl/tests/data/test127
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -19,17 +20,17 @@ moooooooo
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP --disable-epsv
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/to/file/%TESTNUMBER --disable-epsv
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1270 b/third-party/curl/tests/data/test1270
index df18b38ff5..edde9aa9fa 100644
--- a/third-party/curl/tests/data/test1270
+++ b/third-party/curl/tests/data/test1270
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ followlocation
 
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 302 Captive Portal
 Server: ohlala/2000
 Date: Tue, 17 Dec 2019 13:08:30 GMT
@@ -31,17 +32,17 @@ Connection: close
 <server>
 http
 </server>
- <name>
+<name>
 Basic 'redirect_url'
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER -w '%{redirect_url}\n' -s
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/our/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -49,7 +50,7 @@ Accept: */*
 
 </protocol>
 
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 302 Captive Portal
 Server: ohlala/2000
 Date: Tue, 17 Dec 2019 13:08:30 GMT
diff --git a/third-party/curl/tests/data/test1271 b/third-party/curl/tests/data/test1271
index 5206d972f0..eba841ebfe 100644
--- a/third-party/curl/tests/data/test1271
+++ b/third-party/curl/tests/data/test1271
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ HTTP GET
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 This is a weirdo text message swsclose
 Content-Length: 4
 Connection: close
@@ -23,10 +24,10 @@ Moo
 <server>
 http
 </server>
- <name>
+<name>
 --write-out from file with empty file
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER -w @%LOGDIR/blank%TESTNUMBER
 </command>
 <file name="%LOGDIR/blank%TESTNUMBER">
@@ -35,7 +36,7 @@ http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER -w @%LOGDIR/blank%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/our/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1272 b/third-party/curl/tests/data/test1272
index 1dc57c151c..a8ecfc63b2 100644
--- a/third-party/curl/tests/data/test1272
+++ b/third-party/curl/tests/data/test1272
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ INDEX
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -25,18 +25,17 @@ gophers
 <killserver>
 gophers
 </killserver>
- <name>
+<name>
 Gophers index
- </name>
- <command>
--k gophers://%HOSTIP:%GOPHERSPORT/1/%TESTNUMBER
+</name>
+<command>
+--insecure gophers://%HOSTIP:%GOPHERSPORT/1/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 /%TESTNUMBER
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test1273 b/third-party/curl/tests/data/test1273
index c77ad80bdf..1b0c8d1bd7 100644
--- a/third-party/curl/tests/data/test1273
+++ b/third-party/curl/tests/data/test1273
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # also verified by 1156 in libcurl API terms
 
@@ -11,7 +12,7 @@ Resume
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 416 Invalid range
 Connection: close
 Content-Length: 0
@@ -31,10 +32,10 @@ Content-Length: 0
 012345678
 012345678
 012345678
-HTTP/1.1 416 Invalid range
-Connection: close
-Content-Length: 0
-
+HTTP/1.1 416 Invalid range%CR
+Connection: close%CR
+Content-Length: 0%CR
+%CR
 </datacheck>
 
 </reply>
@@ -47,10 +48,10 @@ http
 <killserver>
 http
 </killserver>
- <name>
+<name>
 -f and resume transfer of an entirely-downloaded file
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -C - -f
 </command>
 <file name="%LOGDIR/curl%TESTNUMBER.out">
@@ -69,7 +70,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -C - -f
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Range: bytes=100-
diff --git a/third-party/curl/tests/data/test1274 b/third-party/curl/tests/data/test1274
index 97580a8813..0cac3b0519 100644
--- a/third-party/curl/tests/data/test1274
+++ b/third-party/curl/tests/data/test1274
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,68 +8,58 @@ header line folding
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
-HTTP/1.1 200 OK
-Date: Tue, 09 Nov 2010 14:49:00 GMT
-Server: test-server/
- fake
- folded
-Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
-ETag: "21025-dc7-39462498"
-Content-Length: 6
-Connection:                                              
-   close
-
+HTTP/1.1 200 OK%CR
+Date: Tue, 09 Nov 2010 14:49:00 GMT%CR
+Server: test-server/%CR
+ fake%CR
+ folded%CR
+Tabs: tab-instead/%TAB%CR
+%TABonly%CR
+%TAB mixed%CR
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT%CR
+ETag: "21025-dc7-39462498"%CR
+Content-Length: 6%CR
+Connection:                                              %CR
+   close%CR
+%CR
 -foo-
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP header line folding
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -D %LOGDIR/out%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<file name="%LOGDIR/out%TESTNUMBER">
+<file name="%LOGDIR/out%TESTNUMBER" crlf="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
-%if hyper
 Server: test-server/ fake folded
-%else
-Server: test-server/
- fake
- folded
-%endif
+Tabs: tab-instead/ only mixed
 Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
 ETag: "21025-dc7-39462498"
 Content-Length: 6
-%if hyper
 Connection: close
-%else
-Connection:                                              
-   close
-%endif
 
 </file>
 </verify>
diff --git a/third-party/curl/tests/data/test1275 b/third-party/curl/tests/data/test1275
index d1cb223b8b..341a14cfcd 100644
--- a/third-party/curl/tests/data/test1275
+++ b/third-party/curl/tests/data/test1275
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,19 +7,14 @@ markdown
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
-
 <name>
 Verify capital letters after period in markdown files
 </name>
 
 <command type="perl">
-%SRCDIR/markdown-uppercase.pl %SRCDIR/..
+%SRCDIR/test1275.pl %SRCDIR/..
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test1276 b/third-party/curl/tests/data/test1276
index 2526cdf948..f43166015a 100644
--- a/third-party/curl/tests/data/test1276
+++ b/third-party/curl/tests/data/test1276
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,19 +7,14 @@ documentation
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
-
- <name>
+<name>
 Verify lib/optiontable.pl
- </name>
+</name>
 
 <command type="perl">
-%SRCDIR/option-check.pl %SRCDIR/..
+%SRCDIR/test1276.pl %SRCDIR/..
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test1277 b/third-party/curl/tests/data/test1277
index df74020384..9703bb1b27 100644
--- a/third-party/curl/tests/data/test1277
+++ b/third-party/curl/tests/data/test1277
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,168 +9,41 @@ Transfer-Encoding
 Content-Encoding
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBNb24sIDI5IE5vdiAyMDA0IDIxOjU2OjUzIEdNVA0KU2Vy
-dmVyOiBBcGFjaGUvMS4zLjMxIChEZWJpYW4gR05VL0xpbnV4KSBtb2RfZ3ppcC8xLjMuMjYuMWEg
-UEhQLzQuMy45LTEgbW9kX3NzbC8yLjguMjAgT3BlblNTTC8wLjkuN2QgbW9kX3BlcmwvMS4yOQ0K
-VmFyeTogQWNjZXB0LUVuY29kaW5nDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1J
-U08tODg1OS0xDQpUcmFuc2Zlci1FbmNvZGluZzogZ3ppcCwgY2h1bmtlZA0KQ29udGVudC1FbmNv
-ZGluZzogZGVmbGF0ZQ0KDQo1MjINCh+LCAAHgbBjAv8BCwX0+nja3VjbbuM2EH03kH9g/dQCtm62
-EzlwtChy2QTNNsHaBbpPBi3RNhtJFEjKuTz02zuUKImxHK93g74ESGJy5pzD4QxJk5l8ekpitCFc
-UJaedV3L6SKShiyi6eqsezO96/v+aNx3u5+CzuSXi7vz2bf7S5Rx9g8JZT+mQgIQTb9NZ5dfUHct
-ZXZq20tOxDohWFopkfYChw8kjexl0tc80XesoRXJqAuiW1pBB6HKptpNb06jwD12vYltGEpEhCWZ
-4ygigBiP/b7j9z0XOcNTxz31xhPb8BuEPFMfUeA5zrDvOn3XR4536sHPQFMqxKs4UpyQuVgzLoMw
-53EdjmFv45d5HBdwhNMIxXTRphYQHR4RoZY6Z0lSUlKCJGO1AMf8GS0ZR2FMSSr7gkYE/fX1FkmO
-U7GEilowi0bIUN4ZDKIC4XIEpVqpcFXfJY2JOOrkQnXUGOI5lfjJQjcSiTzLQF+g69nsvlf8nfbQ
-FbSPOldF++LmfNZDs8vbPy/h8/bid4Bd3dxe9orhP9/dX19+hTYM8EhiiKmU6mdMyJ5u5tAKGXug
-RBTaKM9ihiMYApZanpComXUPZViIR8Yj1YTI0jxZFPbp9PaoExIu6ZKGUFcw/UE4+JgoQ4FqPMEI
-xbQgGxl7JJxER53Fc5WkHpJr8mbGq7JYR53ZGqgIw++CpmozCUhtnWqVYAabDnnOUSfG6SrHKyKK
-GEi6oZylCQwgQEeX0FgbGypxTOXzXISMk2B04g+t0cnE3rJvgTPCQ5AMBpZ7bGAr8xYa5vMAe21s
-IAuTXtcsy2PMm7GOR2OIYQjLedvTIlQDugPLd18RXodiOMpgnNErtBEOx8W54VsjZ2LrjumZhywH
-Xc+tvNrwClMO4g9qjDGAyBci5DSTcESKYKBOh9emEgalT8P1XO3l4IIscR7LiW0aSxjUf14dYBmU
-Pdh5aFYnpa3Wiz2xW6xGbM0S8rYQLGDKSxV1eNomQ+vWAo2mXL0cLgdgraRojcjixTtcBMBaRNEa
-kReaHS4CYC2iaI1IuIY9RmK2OlyqpmjBRqKR5VlyuCCAtZSiNSIRWRwuAmAtomiNCBNPh4sAWIso
-mlEvEanz8gdqVhKqumm6scxzDmkTJNDrt+oahdmIHyjJRlTF2AhDRN0cDldRaC1TEBudhHLO+OFK
-JV5rabJZ14QFVa2gWXpiCoccpODLzcz+G53D6QEpo3mCbkvHxK4QGq++p+Sck5jUmWuZ5/r+FpxY
-rmfBBekN9xtsda86OXb8UYtYXbDaHHUv2n1x2gUs52LvmswEzlECE14zOZdr+KqGnLVMJRLnEm4y
-og6p7Ffd2qBPYJxSEqOpJCl8w68mtulsUaBKu+v+7wKvIqKKbCBbdM5iEtw9poTXuMJURWqboVY9
-YVzJOE1oiqU5O8nhhlDUBgpad1pezzve5x7s5e5zur6/l+vuHReWxv6o97rd4+E+93gv2R/v9Tp7
-3e7oO3F/J7D9kQ1aY5f3u+3yw5rI4MkEDzG4jtY6tfEZyeeMnHU5CeF1oGzqJVUvygZnbmRHDbXL
-sZOo7y3gPhmqYux07WQaj7MWdfvh9hZXUqk2FNjhzo5+1bep33Zqldh6pzWIt/PGinsbjv+/pDk/
-nbHh4J0ZU++rj58o1xuM3Hdk6gWeYh8/SwPPGZ68I0vXhCYRjj9+oobD0cB7R6LCPjz1xc/kybDo
-s77+r1DQqZvNf8f+A904jtHT7+gYCwUAAA0KMA0KDQo=
+<data>
+HTTP/1.1 200 OK%CR
+Date: Mon, 29 Nov 2004 21:56:53 GMT%CR
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29%CR
+Vary: Accept-Encoding%CR
+Content-Type: text/html; charset=ISO-8859-1%CR
+Transfer-Encoding: gzip, chunked%CR
+Content-Encoding: deflate%CR
+%CR
+522%CR
+%hex[%1f%8b%08%00%07%81%b0%63%02%ff%01%0b%05%f4%fa%78%da%dd%58%db%6e%e3%36%10%7d%37%90%7f%60%fd%d4%02%b6%6e%b6%13%39%70%b4%28%72%d9%04%cd%36%c1%da%05%ba%4f%06%2d%d1%36%1b%49%14%48%ca%b9%3c%f4%db%3b%94%28%89%b1%1c%af%77%83%be%04%48%62%72%e6%9c%c3%e1%0c%49%93%99%7c%7a%4a%62%b4%21%5c%50%96%9e%75%5d%cb%e9%22%92%86%2c%a2%e9%ea%ac%7b%33%bd%eb%fb%fe%68%dc%77%bb%9f%82%ce%e4%97%8b%bb%f3%d9%b7%fb%4b%94%71%f6%0f%09%65%3f%a6%42%02%10%4d%bf%4d%67%97%5f%50%77%2d%65%76%6a%db%4b%4e%c4%3a%21%58%5a%29%91%f6%02%87%0f%24%8d%ec%65%d2%d7%3c%d1%77%ac%a1%15%c9%a8%0b%a2%5b%5a%41%07%a1%ca%a6%da%4d%6f%4e%a3%c0%3d%76%bd%89%6d%18%4a%44%84%25%99%e3%28%22%80%18%8f%fd%be%e3%f7%3d%17%39%c3%53%c7%3d%f5%c6%13%db%f0%1b%84%3c%53%1f%51%e0%39%ce%b0%ef%3a%7d%d7%47%8e%77%ea%c1%cf%40%53%2a%c4%ab%38%52%9c%90%b9%58%33%2e%83%30%e7%71%1d%8e%61%6f%e3%97%79%1c%17%70%84%d3%08%c5%74%d1%a6%16%10%1d%1e%11%a1%96%3a%67%49%52%52%52%82%24%63%b5%00%c7%fc%19%2d%19%47%61%4c%49%2a%fb%82%46%04%fd%f5%f5%16%49%8e%53%b1%84%8a%5a%30%8b%46%c8%50%de%19%0c%a2%02%e1%72%04%a5%5a%a9%70%55%df%25%8d%89%38%ea%e4%42%75%d4%18%e2%39%95%f8%c9%42%37%12%89%3c%cb%40%5f%a0%eb%d9%ec%be%57%fc%9d%f6%d0%15%b4%8f%3a%57%45%fb%e2%e6%7c%d6%43%b3%cb%db%3f%2f%e1%f3%f6%e2%77%80%5d%dd%dc%5e%f6%8a%e1%3f%df%dd%5f%5f%7e%85%36%0c%f0%48%62%88%a9%94%ea%67%4c%c8%9e%6e%e6%d0]hex%
+%hex[%19%7b%a0%44%14%da%28%cf%62%86%23%18%02%96%5a%9e%90%a8%99%75%0f%65%58%88%47%c6%23%d5%84%c8%d2%3c%59%14%f6%e9%f4%f6%a8%13%12%2e%e9%92%86%50%57%30%fd%41%38%f8%98%28%43%81%6a%3c%c1%08%c5%b4%20%1b%19%7b%24%9c%44%47%9d%c5%73%95%a4%1e%92%6b%f2%66%c6%ab%b2%58%47%9d%d9%1a%a8%08%c3%ef%82%a6%6a%33%09%48%6d%9d%6a%95%60%06%9b%0e%79%ce%51%27%c6%e9%2a%c7%2b%22%8a%18%48%ba%a1%9c%a5%09%0c%20%40%47%97%d0%58%1b%1b%2a%71%4c%e5%f3%5c%84%8c%93%60%74%e2%0f%ad%d1%c9%c4%de%b2%6f%81%33%c2%43%90%0c%06%96%7b%6c%60%2b%f3%16%1a%e6%f3%00%7b%6d%6c%20%0b%93%5e%d7%2c%cb%63%cc%9b%b1%8e%47%63%88%61%08%cb%79%db%d3%22%54%03%ba%03%cb%77%5f%11%5e%87%62%38%ca%60%9c%d1%2b%b4%11%0e%c7%c5%b9%e1%5b%23%67%62%eb%8e%e9%99%87%2c%07%5d%cf%ad%bc%da%f0]hex%
+%hex[%53%0e%e2%0f%6a%8c%31%80%c8%17%22%e4%34%93%70%44%8a%60%a0%4e%87%d7%a6%12%06%a5%4f%c3%f5%5c%ed%e5%e0%82%2c%71%1e%cb%89%6d%1a%4b%18%d4%7f%5e%1d%60%19%94%3d%d8%79%68%56%27%a5%ad%d6%8b%3d%b1%5b%ac%46%6c%cd%12%f2%b6%10%2c%60%ca%4b%15%75%78%da%26%43%eb%d6%02%8d%a6%5c%bd%1c%2e%07%60%ad%a4%68%8d%c8%e2%c5%3b%5c%04%c0%5a%44%d1%1a%91%17%9a%1d%2e%02%60%2d%a2%68%8d%48%b8%86%3d%46%62%b6%3a%5c%aa%a6%68%c1%46%a2%91%e5%59%72%b8%20%80%b5%94%a2%35%22%11%59%1c%2e%02%60%2d%a2%68%8d%08%13%4f%87%8b%00%58%8b%28%9a%51%2f%11%a9%f3%f2%07%6a%56%12%aa%ba%69%ba%b1%cc%73%0e%69%13%24%d0%eb%b7%ea%1a%85%d9%88%1f%28%c9%46%54%c5%d8%08%43%44%dd%1c%0e%57%51%68%2d%53%10%1b%9d%84%72%ce%f8%e1%4a%25%5e%6b%69%b2%59%d7%84%05%55%ad%a0%59%7a%62]hex%
+%hex[%87%1c%a4%e0%cb%cd%cc%fe%1b%9d%c3%e9%01%29%a3%79%82%6e%4b%c7%c4%ae%10%1a%af%be%a7%e4%9c%93%98%d4%99%6b%99%e7%fa%fe%16%9c%58%ae%67%c1%05%e9%0d%f7%1b%6c%75%af%3a%39%76%fc%51%8b%58%5d%b0%da%1c%75%2f%da%7d%71%da%05%2c%e7%62%ef%9a%cc%04%ce%51%02%13%5e%33%39%97%6b%f8%aa%86%9c%b5%4c%25%12%e7%12%6e%32%a2%0e%a9%ec%57%dd%da%a0%4f%60%9c%52%12%a3%a9%24%29%7c%c3%af%26%b6%e9%6c%51%a0%4a%bb%eb%fe%ef%02%af%22%a2%8a%6c%20%5b%74%ce%62%12%dc%3d%a6%84%d7%b8%c2%54%45%6a%9b%a1%56%3d%61%5c%c9%38%4d%68%8a%a5%39%3b%c9%e1%86%50%d4%06]hex%
+%hex[%5a%77%5a%5e%cf%3b%de%e7%1e%ec%e5%ee%73%ba%be%bf%97%eb%ee%1d%17%96%c6%fe%a8%f7%ba%dd%e3%e1%3e%f7%78%2f%d9%1f%ef%f5%3a%7b%dd%ee%e8%3b%71%7f%27%b0%fd%91%0d%5a%63%97%f7%bb%ed%f2%c3%9a%c8%e0%c9%04%0f%31%b8%8e%d6%3a%b5%f1%19%c9%e7%8c%9c%75%39%09%e1%75%a0%6c%ea%25%55%2f%ca%06%67%6e%64%47%0d%b5%cb%b1%93%a8%ef%2d%e0%3e%19%aa%62%ec%74%ed%64%1a%8f%b3%16%75%fb%e1%f6%16%57%52%a9%36%14%d8%e1%ce%8e%7e%d5%b7%a9%df%76%6a%95%d8%7a%a7%35%88%b7%f3%c6%8a%7b%1b%8e%ff%bf%a4%39%3f%9d%b1%e1%e0%9d%19%53%ef%ab%8f%9f%28%d7%1b%8c%dc%77%64%ea%05%9e%62%1f%3f%4b%03%cf%19%9e%bc%23%4b%d7%84%26%11%8e%3f%7e%a2%86%c3%d1%c0%7b%47%a2%c2%3e%3c%f5%c5%cf%e4%c9%b0%e8%b3%be%fe%af%50%d0%a9%9b%cd%7f%c7%fe%03%dd%38%8e%d1%d3%ef%e8%18%0b%05%00%00%0d]hex%
+0%CR
+%CR
 </data>
 
-
 <datacheck>
-HTTP/1.1 200 OK
-Date: Mon, 29 Nov 2004 21:56:53 GMT
-Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
-Vary: Accept-Encoding
-Content-Type: text/html; charset=ISO-8859-1
-Transfer-Encoding: gzip, chunked
-Content-Encoding: deflate
-
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE project-listing SYSTEM "http://freshmeat.net/backend/fm-projects-0.4.dtd">
-<project-listing>
-  <project>
-    <project_id>1612</project_id>
-    <date_added>1998-08-21 04:01:29</date_added>
-    <date_updated>2004-10-18 02:22:23</date_updated>
-    <projectname_short>curl</projectname_short>
-    <projectname_full>curl and libcurl</projectname_full>
-    <desc_short>Command line tool and library for client-side URL transfers.</desc_short>
-    <desc_full>curl and libcurl is a tool for transferring files
-using URL syntax. It supports HTTP, HTTPS, FTP,
-FTPS, DICT, TELNET, LDAP, FILE, and GOPHER, as
-well as HTTP-post, HTTP-put, cookies, FTP upload,
-resumed transfers, passwords, portnumbers, SSL
-certificates, Kerberos, and proxies. It is powered
-by libcurl, the client-side URL transfer library.
-There are bindings to libcurl for over 20
-languages and environments.
-</desc_full>
-    <vitality_score>5784.57</vitality_score>
-    <vitality_percent>3.16</vitality_percent>
-    <vitality_rank>169</vitality_rank>
-    <popularity_score>6594.54</popularity_score>
-    <popularity_percent>13.81</popularity_percent>
-    <popularity_rank>105</popularity_rank>
-    <rating>8.50</rating>
-    <rating_count>21</rating_count>
-    <rating_rank>183</rating_rank>
-    <subscriptions>323</subscriptions>
-    <branch_name>Default</branch_name>
-    <url_project_page>http://freshmeat.net/projects/curl/</url_project_page>
-    <url_homepage>http://freshmeat.net/redir/curl/1612/url_homepage/</url_homepage>
-    <url_tgz>http://freshmeat.net/redir/curl/1612/url_tgz/</url_tgz>
-    <url_bz2>http://freshmeat.net/redir/curl/1612/url_bz2/</url_bz2>
-    <url_zip>http://freshmeat.net/redir/curl/1612/url_zip/</url_zip>
-    <url_changelog>http://freshmeat.net/redir/curl/1612/url_changelog/</url_changelog>
-    <url_rpm>http://freshmeat.net/redir/curl/1612/url_rpm/</url_rpm>
-    <url_deb>http://freshmeat.net/redir/curl/1612/url_deb/</url_deb>
-    <url_osx>http://freshmeat.net/redir/curl/1612/url_osx/</url_osx>
-    <url_bsdport>http://freshmeat.net/redir/curl/1612/url_bsdport/</url_bsdport>
-    <url_purchase></url_purchase>
-    <url_cvs>http://freshmeat.net/redir/curl/1612/url_cvs/</url_cvs>
-    <url_list>http://freshmeat.net/redir/curl/1612/url_list/</url_list>
-    <url_mirror>http://freshmeat.net/redir/curl/1612/url_mirror/</url_mirror>
-    <url_demo></url_demo>
-    <license>MIT/X Consortium License</license>
-    <latest_release>
-      <latest_release_version>7.12.2</latest_release_version>
-      <latest_release_id>176085</latest_release_id>
-      <latest_release_date>2004-10-18 02:22:23</latest_release_date>
-    </latest_release>
-    <screenshot_thumb></screenshot_thumb>
-    <authors>
-      <author>
-        <author_name>Daniel Stenberg</author_name>
-        <author_url>http://freshmeat.net/~bagder/</author_url>
-        <author_role>Owner</author_role>
-      </author>
-    </authors>
-    <descriminators>
-      <trove_id>12</trove_id>
-      <trove_id>226</trove_id>
-      <trove_id>3</trove_id>
-      <trove_id>2</trove_id>
-      <trove_id>188</trove_id>
-      <trove_id>216</trove_id>
-      <trove_id>200</trove_id>
-      <trove_id>220</trove_id>
-      <trove_id>164</trove_id>
-      <trove_id>90</trove_id>
-      <trove_id>89</trove_id>
-      <trove_id>809</trove_id>
-      <trove_id>150</trove_id>
-      <trove_id>224</trove_id>
-      <trove_id>900</trove_id>
-      <trove_id>839</trove_id>
-    </descriminators>
-    <dependencies>
-      <dependency type="recommended">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>7464</dependency_branch_id>
-        <dependency_project_id>7464</dependency_project_id>
-        <dependency_project_title>OpenSSL (Default)</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>7443</dependency_project_id>
-        <dependency_project_title>OpenLDAP</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>12351</dependency_project_id>
-        <dependency_project_title>zlib</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>32047</dependency_project_id>
-        <dependency_project_title>Heimdal</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>44532</dependency_project_id>
-        <dependency_project_title>c-ares</dependency_project_title>
-      </dependency>
-    </dependencies>
-  </project>
-</project-listing>
+HTTP/1.1 200 OK%CR
+Date: Mon, 29 Nov 2004 21:56:53 GMT%CR
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29%CR
+Vary: Accept-Encoding%CR
+Content-Type: text/html; charset=ISO-8859-1%CR
+Transfer-Encoding: gzip, chunked%CR
+Content-Encoding: deflate%CR
+%CR
+%includetext %SRCDIR/data/data-xml1%
 </datacheck>
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -178,28 +52,27 @@ libz
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with both content and transfer encoding
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --tr-encoding --compressed
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
 s/^Accept-Encoding: [a-zA-Z, ]*/Accept-Encoding: xxx/
 </strippart>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Connection: TE
 TE: gzip
 Accept-Encoding: xxx
+Connection: TE
 
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test1278 b/third-party/curl/tests/data/test1278
index 9516446374..7a7a8700bb 100644
--- a/third-party/curl/tests/data/test1278
+++ b/third-party/curl/tests/data/test1278
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,9 @@
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes" nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -24,7 +24,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -38,7 +37,6 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --no-progress-meter -o %LOGDIR/out%TESTNUMB
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <stderr mode="text">
diff --git a/third-party/curl/tests/data/test1279 b/third-party/curl/tests/data/test1279
index b0521052e4..156b844258 100644
--- a/third-party/curl/tests/data/test1279
+++ b/third-party/curl/tests/data/test1279
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,24 +8,19 @@ libcurl.def
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
-
- <name>
+<name>
 Verify libcurl.def against CURL_EXTERN declarations
- </name>
+</name>
 
 <command type="perl">
-%SRCDIR/extern-scan.pl --heading=EXPORTS --sort %SRCDIR/..
+%SRCDIR/test1135.pl --heading=EXPORTS --sort %SRCDIR/..
 </command>
 </client>
 
 <verify>
-<stdout loadfile="%SRCDIR/../libcurl.def">
+<stdout loadfile="%SRCDIR/../lib/libcurl.def">
 </stdout>
 </verify>
 
diff --git a/third-party/curl/tests/data/test128 b/third-party/curl/tests/data/test128
index f73038e04e..44dfeadfb8 100644
--- a/third-party/curl/tests/data/test128
+++ b/third-party/curl/tests/data/test128
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -16,15 +17,15 @@ STOR
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP upload with --crlf
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T %LOGDIR/upload%TESTNUMBER --crlf
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
 file
-with unix newlines
+with Unix newlines
 meant to be
 converted
 with
@@ -35,7 +36,7 @@ the
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -44,9 +45,9 @@ TYPE I
 STOR %TESTNUMBER
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 file
-with unix newlines
+with Unix newlines
 meant to be
 converted
 with
diff --git a/third-party/curl/tests/data/test1280 b/third-party/curl/tests/data/test1280
index b2987ab38e..e1deb9d39a 100644
--- a/third-party/curl/tests/data/test1280
+++ b/third-party/curl/tests/data/test1280
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,9 @@ globbing
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
@@ -23,17 +23,17 @@ bytes
 <server>
 http
 </server>
- <name>
+<name>
 simple [a-d] globbing
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/[a-d]/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /a/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1281 b/third-party/curl/tests/data/test1281
index f6781d4604..165533f436 100644
--- a/third-party/curl/tests/data/test1281
+++ b/third-party/curl/tests/data/test1281
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,25 +6,19 @@ URL
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
-</data>
 </reply>
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 http
 </features>
- <name>
+<name>
 reject non-numerical port number in URL
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:alpha/beta/%TESTNUMBER
 </command>
 </client>
diff --git a/third-party/curl/tests/data/test1282 b/third-party/curl/tests/data/test1282
index cf9ea85ed3..774f54cffa 100644
--- a/third-party/curl/tests/data/test1282
+++ b/third-party/curl/tests/data/test1282
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ RETR
 # Server-side
 <reply>
 <servercmd>
-REPLY PASS 633 XXXXXXXX\x00\x00XXXXXXXX
+REPLY PASS 633 XXXXXXXXXXXXXXXX
 </servercmd>
 </reply>
 
@@ -18,13 +19,10 @@ REPLY PASS 633 XXXXXXXX\x00\x00XXXXXXXX
 <server>
 ftp
 </server>
-<features>
-GSS-API
-</features>
- <name>
-FTP with 633 response before gss initialized
- </name>
- <command>
+<name>
+FTP with 633 response to auth
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 
@@ -32,7 +30,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 </protocol>
diff --git a/third-party/curl/tests/data/test1283 b/third-party/curl/tests/data/test1283
index 692246bc40..5f6c1911f8 100644
--- a/third-party/curl/tests/data/test1283
+++ b/third-party/curl/tests/data/test1283
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ globbing
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
@@ -36,14 +36,14 @@ http://%HOSTIP:%HTTPPORT/[a-a][1-1][b-b:1][2-2:1]/%TESTNUMBER -o "%LOGDIR/outfil
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /a1b2/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<file name="%LOGDIR/outfile%TESTNUMBER_a1b2.dump">
+<file name="%LOGDIR/outfile%TESTNUMBER_a1b2.dump" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
diff --git a/third-party/curl/tests/data/test1284 b/third-party/curl/tests/data/test1284
index 7bd94d237a..e0e5b00ee5 100644
--- a/third-party/curl/tests/data/test1284
+++ b/third-party/curl/tests/data/test1284
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,15 +10,15 @@ HTTP Digest auth
 
 # Server-side
 <reply>
-<data>
-HTTP/1.1 401 authentication please swsbounce
+<data crlf="headers">
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144"
 Content-Type: text/html; charset=iso-8859-1
 Content-Length: 0
 
 </data>
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 A OK
 Server: Microsoft-IIS/6.0
 Content-Type: text/html; charset=iso-8859-1
@@ -26,8 +27,8 @@ Content-Length: 3
 ok
 </data1000>
 
-<datacheck>
-HTTP/1.1 401 authentication please swsbounce
+<datacheck crlf="headers">
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144"
 Content-Type: text/html; charset=iso-8859-1
@@ -45,13 +46,13 @@ ok
 
 # Client-side
 <client>
-#
 <server>
 http
 </server>
 <features>
 !SSPI
 crypto
+digest
 </features>
 <name>
 HTTP POST --digest with user-specified Content-Length header
@@ -66,7 +67,7 @@ HTTP POST --digest with user-specified Content-Length header
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1285 b/third-party/curl/tests/data/test1285
index 8c7040daee..4635213772 100644
--- a/third-party/curl/tests/data/test1285
+++ b/third-party/curl/tests/data/test1285
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,15 +10,15 @@ HTTP Digest auth
 
 # Server-side
 <reply>
-<data>
-HTTP/1.1 401 authentication please swsbounce
+<data crlf="headers">
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144"
 Content-Type: text/html; charset=iso-8859-1
 Content-Length: 0
 
 </data>
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 A OK
 Server: Microsoft-IIS/6.0
 Content-Type: text/html; charset=iso-8859-1
@@ -26,8 +27,8 @@ Content-Length: 3
 ok
 </data1000>
 
-<datacheck>
-HTTP/1.1 401 authentication please swsbounce
+<datacheck crlf="headers">
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144"
 Content-Type: text/html; charset=iso-8859-1
@@ -45,13 +46,13 @@ ok
 
 # Client-side
 <client>
-#
 <server>
 http
 </server>
 <features>
 !SSPI
 crypto
+digest
 </features>
 <name>
 HTTP PUT --digest with user-specified Content-Length header
@@ -72,7 +73,7 @@ four is the number of lines
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1286 b/third-party/curl/tests/data/test1286
index 44053f3f30..551b9aac99 100644
--- a/third-party/curl/tests/data/test1286
+++ b/third-party/curl/tests/data/test1286
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,15 +11,15 @@ followlocation
 
 # Server-side
 <reply>
-<data>
-HTTP/1.1 401 authentication please swsbounce
+<data crlf="headers">
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144", qop="auth"
 Content-Type: text/html; charset=iso-8859-1
 Content-Length: 0
 
 </data>
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 302 Thanks for this, but we want to redir you!
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -26,7 +27,7 @@ Location: /%TESTNUMBER0001
 Content-Length: 0
 
 </data1000>
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 404 Not Found
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -34,8 +35,8 @@ Content-Length: 0
 
 </data1001>
 
-<datacheck>
-HTTP/1.1 401 authentication please swsbounce
+<datacheck crlf="headers">
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144", qop="auth"
 Content-Type: text/html; charset=iso-8859-1
@@ -58,12 +59,12 @@ Content-Length: 0
 
 # Client-side
 <client>
-#
 <server>
 http
 </server>
 <features>
 crypto
+digest
 </features>
 <name>
 HTTP GET --digest increasing nonce-count
@@ -88,7 +89,7 @@ HTTP GET --digest increasing nonce-count
 <strippart>
 if(s/^(Authorization: Digest )([^\r\n]+)(\r?\n)$//) { $_ = $1 . join(', ', map { s/^(cnonce=)"[a-zA-Z0-9+\/=]+"$/$1REMOVED/; s/^(response=)"[a-f0-9]{32}"$/$1REMOVED/; s/^qop="auth"$/qop=auth/; $_ } sort split(/, */, $2)) . $3; }
 </strippart>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1287 b/third-party/curl/tests/data/test1287
index 46df14c2be..df86d9cf92 100644
--- a/third-party/curl/tests/data/test1287
+++ b/third-party/curl/tests/data/test1287
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ proxytunnel
 verbose logs
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -24,14 +24,14 @@ contents
 
 # The purpose of this test is to make sure curl ignores headers
 # Content-Length and Transfer-Encoding in a successful CONNECT 2xx reply.
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 Content-Length: 123
 Transfer-Encoding: chunked
 
 </connect>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 Content-Length: 123
 Transfer-Encoding: chunked
@@ -47,7 +47,6 @@ contents
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -62,20 +61,20 @@ HTTP over proxy-tunnel ignore TE and CL in CONNECT 2xx responses
 </command>
 <features>
 proxy
+verbose-strings
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 CONNECT test.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: test.%TESTNUMBER:%HTTPPORT
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
 </proxy>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: test.%TESTNUMBER:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -83,10 +82,8 @@ Accept: */*
 
 </protocol>
 <file name="%LOGDIR/stderr%TESTNUMBER" mode="text">
-%if !hyper
 * Ignoring Content-Length in CONNECT 200 response
 * Ignoring Transfer-Encoding in CONNECT 200 response
-%endif
 </file>
 <stripfile>
 s/^.*(?=\* Ignoring (?:Content-Length|Transfer-Encoding) )// or $_ = ''
diff --git a/third-party/curl/tests/data/test1288 b/third-party/curl/tests/data/test1288
index 5cb72fa777..83036d906b 100644
--- a/third-party/curl/tests/data/test1288
+++ b/third-party/curl/tests/data/test1288
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,16 +10,15 @@ proxytunnel
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 Server: test tunnel 2000
 
 </connect>
 
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -31,7 +31,6 @@ contents
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -49,17 +48,16 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 CONNECT %HOSTIP:%HTTPPORT HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
 </proxy>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -73,22 +71,22 @@ Accept: */*
 # Must not suppress in --verbose and --trace
 # Must not suppress in statistics (eg received header byte total)
 <stdout>
-HTTP/1.1 200 OK
-HTTP/1.1 200 OK
-Date: Tue, 09 Nov 2010 14:49:00 GMT
-Date: Tue, 09 Nov 2010 14:49:00 GMT
-Server: test-server/fake
-Server: test-server/fake
-Content-Type: text/html
-Content-Type: text/html
-Funny-head: yesyes
-Funny-head: yesyes
-Content-Length: 9
-Content-Length: 9
-Connection: keep-alive
-Connection: keep-alive
-
-
+HTTP/1.1 200 OK%CR
+HTTP/1.1 200 OK%CR
+Date: Tue, 09 Nov 2010 14:49:00 GMT%CR
+Date: Tue, 09 Nov 2010 14:49:00 GMT%CR
+Server: test-server/fake%CR
+Server: test-server/fake%CR
+Content-Type: text/html%CR
+Content-Type: text/html%CR
+Funny-head: yesyes%CR
+Funny-head: yesyes%CR
+Content-Length: 9%CR
+Content-Length: 9%CR
+Connection: keep-alive%CR
+Connection: keep-alive%CR
+%CR
+%CR
 contents
 
 CONNECT CODE: 200
diff --git a/third-party/curl/tests/data/test1289 b/third-party/curl/tests/data/test1289
index 14a41458ab..9bede4c2e2 100644
--- a/third-party/curl/tests/data/test1289
+++ b/third-party/curl/tests/data/test1289
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ globbing
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
@@ -18,7 +18,7 @@ globbing
 http
 </server>
 <name>
-globbing with overflow and bad syntxx
+globbing with overflow and bad syntax
 </name>
 <command>
 http://ur%20[0-60000000000000000000
diff --git a/third-party/curl/tests/data/test129 b/third-party/curl/tests/data/test129
index d8b2fe2872..b8ddabcb7c 100644
--- a/third-party/curl/tests/data/test129
+++ b/third-party/curl/tests/data/test129
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -25,24 +25,22 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP/1.2 is rejected
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1290 b/third-party/curl/tests/data/test1290
index c0f57545c8..4c4090c61b 100644
--- a/third-party/curl/tests/data/test1290
+++ b/third-party/curl/tests/data/test1290
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ globbing
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -35,7 +35,7 @@ Verify URL globbing ignores []
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/[]/page/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1291 b/third-party/curl/tests/data/test1291
index ea9a0c6ab4..f9057ac919 100644
--- a/third-party/curl/tests/data/test1291
+++ b/third-party/curl/tests/data/test1291
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # This test case is primarily meant to verify that parsing and adding the 100K
 # files is a swift operation.
@@ -8,18 +9,12 @@ HTTP PUT
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
-</data>
 </reply>
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <name>
 Attempt to upload 1000 files but fail immediately
 </name>
@@ -31,7 +26,7 @@ XXXXXXXx
 </file>
 # generate the config file
 <precheck>
-perl -e 'for(1 .. 1000) { printf("upload-file=%LOGDIR/upload-this\nurl=htttttp://non-existing-host.haxx.se/upload/%TESTNUMBER\n", $_);}' > %LOGDIR/cmd%TESTNUMBER;
+%PERL -e 'for(1 .. 1000) { printf("upload-file=%LOGDIR/upload-this\nurl=htttttp://non-existing-host.haxx.se/upload/%TESTNUMBER\n", $_);}' > %LOGDIR/cmd%TESTNUMBER;
 </precheck>
 </client>
 
@@ -40,5 +35,8 @@ perl -e 'for(1 .. 1000) { printf("upload-file=%LOGDIR/upload-this\nurl=htttttp:/
 <errorcode>
 1
 </errorcode>
+<limits>
+Allocations: 3100
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1292 b/third-party/curl/tests/data/test1292
index 6ff6a4b6c2..24fe1390f1 100644
--- a/third-party/curl/tests/data/test1292
+++ b/third-party/curl/tests/data/test1292
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP added headers
 HTTP replaced headers
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -20,24 +20,22 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 Replaced internal headers with a blank one
- </name>
- <command>
- -H "Host;" -H "Accept;" http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</name>
+<command>
+-H "Host;" -H "Accept;" http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 GET /%TESTNUMBER HTTP/1.1
 Host:
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1293 b/third-party/curl/tests/data/test1293
index 1a9f31e39d..c23ce0af0c 100644
--- a/third-party/curl/tests/data/test1293
+++ b/third-party/curl/tests/data/test1293
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -26,7 +26,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -35,27 +34,26 @@ Mime
 <server>
 http
 </server>
- <name>
+<name>
 Multipart formpost to two URLs, the first failing
- </name>
- <command>
+</name>
+<command>
 http://0 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -F=
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Content-Length: 126
+Content-Length: 138
 Content-Type: multipart/form-data; boundary=----------------------------
 
 ------------------------------
diff --git a/third-party/curl/tests/data/test1294 b/third-party/curl/tests/data/test1294
index c6714fe9a3..88aaba2003 100644
--- a/third-party/curl/tests/data/test1294
+++ b/third-party/curl/tests/data/test1294
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -25,13 +25,10 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# hyper doesn't support the added crazy header
 <features>
-debug
-!hyper
+Debug
 </features>
 <server>
 http
@@ -46,19 +43,19 @@ HTTP GET with split initial request send
 CURL_SMALLREQSEND=128
 </setenv>
 <command>
-http://%HOSTIP:%HTTPPORT/012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679/%TESTNUMBER -H "Among other public buildings in a certain town, which for many reasons it will be prudent to refrain from mentioning, and to which I will assign no fictitious name, there is one anciently common to most towns, great or small to wit, a workhouse; and in this workhouse was born; on a day and date which I need not trouble myself to repeat, inasmuch as it can be of no possible consequence to the reader, in this stage of the business at all events; the item of mortality whose name is prefixed to the head of this chapter: 511"
+http://%HOSTIP:%HTTPPORT/%repeat[30 x 012345679]%/%TESTNUMBER
+-H "Among other public buildings in a certain town, which for many reasons it will be prudent to refrain from mentioning, and to which I will assign no fictitious name, there is one anciently common to most towns, great or small to ___, a workhouse; and in this workhouse was born; on a day and date which I need not trouble myself to repeat, inasmuch as it can be of no possible consequence to the reader, in this stage of the business at all events; the item of mortality whose name is prefixed to the head of this chapter: 511"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-GET /012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679/%TESTNUMBER HTTP/1.1
+<protocol crlf="yes">
+GET /%repeat[30 x 012345679]%/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Among other public buildings in a certain town, which for many reasons it will be prudent to refrain from mentioning, and to which I will assign no fictitious name, there is one anciently common to most towns, great or small to wit, a workhouse; and in this workhouse was born; on a day and date which I need not trouble myself to repeat, inasmuch as it can be of no possible consequence to the reader, in this stage of the business at all events; the item of mortality whose name is prefixed to the head of this chapter: 511
+Among other public buildings in a certain town, which for many reasons it will be prudent to refrain from mentioning, and to which I will assign no fictitious name, there is one anciently common to most towns, great or small to ___, a workhouse; and in this workhouse was born; on a day and date which I need not trouble myself to repeat, inasmuch as it can be of no possible consequence to the reader, in this stage of the business at all events; the item of mortality whose name is prefixed to the head of this chapter: 511
 
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test1295 b/third-party/curl/tests/data/test1295
index 91d52b08ac..f08730606c 100644
--- a/third-party/curl/tests/data/test1295
+++ b/third-party/curl/tests/data/test1295
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP POST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -25,11 +25,10 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-debug
+Debug
 </features>
 <server>
 http
@@ -39,24 +38,24 @@ HTTP POST with split initial request send
 </name>
 <setenv>
 # The Hound of the Baskervilles
-#
 # make the first send cut off after this amount of data
 CURL_SMALLREQSEND=100
 </setenv>
 <command>
-http://%HOSTIP:%HTTPPORT/012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679/%TESTNUMBER -H "012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679: 300" -d "Mr. Sherlock Holmes, who was usually very late in the mornings, save upon those not infrequent occasions when he was up all night, was seated at the breakfast table." -w '%{size_upload}\n'
+http://%HOSTIP:%HTTPPORT/%repeat[30 x 012345679]%/%TESTNUMBER -H "%repeat[30 x 012345679]%: 300"
+-d "Mr. Sherlock Holmes, who was usually very late in the mornings, save upon those not infrequent occasions when he was up all night, was seated at the breakfast table."
+-w '%{size_upload}\n'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
-POST /012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679/%TESTNUMBER HTTP/1.1
+<protocol crlf="yes" nonewline="yes">
+POST /%repeat[30 x 012345679]%/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679: 300
+%repeat[30 x 012345679]%: 300
 Content-Length: 165
 Content-Type: application/x-www-form-urlencoded
 
diff --git a/third-party/curl/tests/data/test1296 b/third-party/curl/tests/data/test1296
index 364687a98d..66a044ac3f 100644
--- a/third-party/curl/tests/data/test1296
+++ b/third-party/curl/tests/data/test1296
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -41,14 +42,13 @@ http://user%0aname:password@%HOSTIP:%HTTPPORT/%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dXNlcgpuYW1lOnBhc3N3b3Jk
+Authorization: Basic %b64[user%0aname:password]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
 </verify>
 </testcase>
-
diff --git a/third-party/curl/tests/data/test1297 b/third-party/curl/tests/data/test1297
index 5b61b10396..0de9226a01 100644
--- a/third-party/curl/tests/data/test1297
+++ b/third-party/curl/tests/data/test1297
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,10 +10,9 @@ proxytunnel
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 Server: test tunnel 2000
 
@@ -22,7 +22,6 @@ Server: test tunnel 2000
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -40,17 +39,16 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 CONNECT %HOSTIP:%HTTPPORT HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
 </proxy>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1298 b/third-party/curl/tests/data/test1298
index 12cf1d1e48..eb62028fed 100644
--- a/third-party/curl/tests/data/test1298
+++ b/third-party/curl/tests/data/test1298
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -25,24 +25,22 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET special path with --request-target
- </name>
- <command>
+</name>
+<command>
 --request-target "XXX" "http://%HOSTIP:%HTTPPORT/" -H "Testno: %TESTNUMBER"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET XXX HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1299 b/third-party/curl/tests/data/test1299
index 6373cefa7b..6dff05d652 100644
--- a/third-party/curl/tests/data/test1299
+++ b/third-party/curl/tests/data/test1299
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -24,24 +24,22 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 Send "OPTIONS *" with --request-target
- </name>
- <command>
+</name>
+<command>
 --request-target '*' -X OPTIONS http://%HOSTIP:%HTTPPORT/ -H "Testno: %TESTNUMBER"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 OPTIONS * HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test13 b/third-party/curl/tests/data/test13
index b461cfbbf6..faa62f6a12 100644
--- a/third-party/curl/tests/data/test13
+++ b/third-party/curl/tests/data/test13
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,7 @@ HTTP custom request
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 Read you
 Content-Length: 29
 Deleted: suppose we got a header like this! ;-)
@@ -21,17 +22,17 @@ blabla custom request result
 <server>
 http
 </server>
- <name>
+<name>
 HTTP custom request 'DELETE'
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -X DELETE
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 DELETE /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test130 b/third-party/curl/tests/data/test130
index c66e437ac7..95a2ec997e 100644
--- a/third-party/curl/tests/data/test130
+++ b/third-party/curl/tests/data/test130
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,12 +8,10 @@ LIST
 netrc
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -24,19 +23,18 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP (optional .netrc; no user/pass) dir list PASV
- </name>
- <command>
+</name>
+<command>
 --netrc-optional --netrc-file %LOGDIR/netrc%TESTNUMBER ftp://%HOSTIP:%FTPPORT/
 </command>
 <file name="%LOGDIR/netrc%TESTNUMBER" >
@@ -48,10 +46,9 @@ default login userdef password passwddef
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER user1
 PASS passwd1
 PWD
diff --git a/third-party/curl/tests/data/test1300 b/third-party/curl/tests/data/test1300
index 1183412130..b352c33319 100644
--- a/third-party/curl/tests/data/test1300
+++ b/third-party/curl/tests/data/test1300
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,13 @@ llist
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 llist unit tests
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1301 b/third-party/curl/tests/data/test1301
index 08b43a8ecc..ea8e47c5dc 100644
--- a/third-party/curl/tests/data/test1301
+++ b/third-party/curl/tests/data/test1301
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,17 +6,13 @@ curl_strequal
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 curl_strequal tests
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1302 b/third-party/curl/tests/data/test1302
index 9e9039cac6..b5abae578a 100644
--- a/third-party/curl/tests/data/test1302
+++ b/third-party/curl/tests/data/test1302
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,13 @@ base64
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 base64 encode/decode unit tests
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1303 b/third-party/curl/tests/data/test1303
index bb23352df1..cfe8c1d5e1 100644
--- a/third-party/curl/tests/data/test1303
+++ b/third-party/curl/tests/data/test1303
@@ -1,22 +1,19 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 unittest
-Curl_timeleft
+Curl_timeleft_ms
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
-Curl_timeleft unit tests
- </name>
+<name>
+Curl_timeleft_ms unit tests
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1304 b/third-party/curl/tests/data/test1304
index a7de1d52fe..35f2a546c9 100644
--- a/third-party/curl/tests/data/test1304
+++ b/third-party/curl/tests/data/test1304
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,19 +7,15 @@ netrc
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 netrc
 </features>
- <name>
+<name>
 netrc parsing unit tests
- </name>
+</name>
 <command>
 %LOGDIR/netrc%TESTNUMBER
 </command>
diff --git a/third-party/curl/tests/data/test1305 b/third-party/curl/tests/data/test1305
index 7d14aa8491..e6b5ad6811 100644
--- a/third-party/curl/tests/data/test1305
+++ b/third-party/curl/tests/data/test1305
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <!-- This replaces test 558 -->
 <info>
@@ -7,18 +8,14 @@ hash
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 internal hash create/destroy testing
- </name>
+</name>
 <command>
 %TESTNUMBER
 </command>
diff --git a/third-party/curl/tests/data/test1306 b/third-party/curl/tests/data/test1306
index 7ed450324d..1ac9a5c16e 100644
--- a/third-party/curl/tests/data/test1306
+++ b/third-party/curl/tests/data/test1306
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <!-- This replaces test 559 -->
 <info>
@@ -7,24 +8,17 @@ hash
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 internal hash create/add/destroy testing
- </name>
+</name>
 <tool>
 unit1305
 </tool>
-<command>
-%TESTNUMBER
-</command>
 </client>
 
 </testcase>
diff --git a/third-party/curl/tests/data/test1307 b/third-party/curl/tests/data/test1307
index f0e96bfa01..8e26091afa 100644
--- a/third-party/curl/tests/data/test1307
+++ b/third-party/curl/tests/data/test1307
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <!-- This replaces test 577 -->
 <info>
@@ -7,18 +8,14 @@ wildcardmatch
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 ftp
 </features>
- <name>
+<name>
 internal Curl_fnmatch() testing
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1308 b/third-party/curl/tests/data/test1308
index bc799883fa..adb471ae82 100644
--- a/third-party/curl/tests/data/test1308
+++ b/third-party/curl/tests/data/test1308
@@ -1,27 +1,25 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
-unittest
 curl_formadd
 curl_formget
 FORM
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <features>
-unittest
 http
 form-api
 </features>
-<server>
-none
-</server>
- <name>
-formpost unit tests
- </name>
+<name>
+formpost tests
+</name>
+<tool>
+lib%TESTNUMBER
+</tool>
 <command>
 %LOGDIR/test-%TESTNUMBER
 </command>
diff --git a/third-party/curl/tests/data/test1309 b/third-party/curl/tests/data/test1309
index 7005d5f13c..7e6af38227 100644
--- a/third-party/curl/tests/data/test1309
+++ b/third-party/curl/tests/data/test1309
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,18 +7,14 @@ splay
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 splay unit tests
- </name>
+</name>
 </client>
 
 <verify>
diff --git a/third-party/curl/tests/data/test131 b/third-party/curl/tests/data/test131
index 1bb8524cae..75f7d40989 100644
--- a/third-party/curl/tests/data/test131
+++ b/third-party/curl/tests/data/test131
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,13 +8,9 @@ LIST
 netrc
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-#
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -25,19 +22,18 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP (optional .netrc; user/no pass) dir list PASV
- </name>
- <command>
+</name>
+<command>
 --netrc-optional --netrc-file %LOGDIR/netrc%TESTNUMBER ftp://user2@%HOSTIP:%FTPPORT/
 </command>
 <file name="%LOGDIR/netrc%TESTNUMBER" >
@@ -47,10 +43,9 @@ machine %HOSTIP login user2 password passwd2
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER user2
 PASS passwd2
 PWD
diff --git a/third-party/curl/tests/data/test1310 b/third-party/curl/tests/data/test1310
index 9015318207..c6546053e5 100644
--- a/third-party/curl/tests/data/test1310
+++ b/third-party/curl/tests/data/test1310
@@ -1,124 +1,61 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
-HTTP NTLM auth
+-J
+--show-headers
 </keywords>
 </info>
-# Server-side
+
 <reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 6
+Connection: close
+Content-Disposition: inline; filename="name%TESTNUMBER"
+Content-Type: text/html
 
-<!-- no <data> in this test since we have NTLM from the start
-
-This is supposed to be returned when the server gets a first
-Authorization: NTLM line passed-in from the client -->
-
-<data1001>
-HTTP/1.1 401 Now gimme that second request of crap
-Server: Microsoft-IIS/5.0
-Content-Type: text/html; charset=iso-8859-1
-Content-Length: 34
-WWW-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAAAGgoEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
-
-This is not the real page either!
-</data1001>
-
-# This is supposed to be returned when the server gets the second
-# Authorization: NTLM line passed-in from the client
-<data1002>
-HTTP/1.1 200 Things are fine in server land swsclose
-Server: Microsoft-IIS/5.0
-Content-Type: text/html; charset=iso-8859-1
-Content-Length: 32
-
-Finally, this is the real page!
-</data1002>
-
-<datacheck>
-HTTP/1.1 401 Now gimme that second request of crap
-Server: Microsoft-IIS/5.0
-Content-Type: text/html; charset=iso-8859-1
-Content-Length: 34
-WWW-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAAAGgoEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
-
-HTTP/1.1 200 Things are fine in server land swsclose
-Server: Microsoft-IIS/5.0
-Content-Type: text/html; charset=iso-8859-1
-Content-Length: 32
-
-Finally, this is the real page!
-</datacheck>
-
+12345
+</data>
 </reply>
 
 # Client-side
 <client>
-<features>
-NTLM_WB
-debug
-</features>
 <server>
 http
 </server>
- <name>
-HTTP with NTLM delegation to winbind helper
- </name>
- <setenv>
-# we force our own host name, in order to make the test machine independent
-CURL_GETHOSTNAME=curlhost
-# we try to use the LD_PRELOAD hack, if not a debug build
-LD_PRELOAD=%PWD/libtest/.libs/libhostname.so
-# set path to fake_auth instead of real ntlm_auth to generate NTLM type1 and type 3 messages
-CURL_NTLM_WB_FILE=%PWD/server/fake_ntlm
-# set source directory so fake_ntlm can find the test files
-CURL_NTLM_AUTH_SRCDIR=%SRCDIR
-# set source directory so fake_ntlm can find the test and log files
-CURL_NTLM_LOGDIR=%LOGDIR
-# set the test number
-CURL_NTLM_AUTH_TESTNUM=%TESTNUMBER
- </setenv>
- <command>
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:anypasswd --ntlm-wb
+<name>
+HTTP GET with -J + --show-headers
+</name>
+<command option="no-output,no-include">
+http://%HOSTIP:%HTTPPORT/junk -J -O --show-headers --output-dir %LOGDIR
 </command>
-<precheck>
-chkhostname curlhost
-</precheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-GET /%TESTNUMBER HTTP/1.1
+<protocol crlf="headers">
+GET /junk HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAAAAAAAAAwAAAA
-User-Agent: curl/%VERSION
-Accept: */*
-
-GET /%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAE8AAAAYABgAZwAAAAAAAABAAAAACAAIAEAAAAAHAAcASAAAAAAAAAAAAAAAggEAAHRlc3R1c2VyVU5LTk9XTlpkQwKRCZFMhjj0tw47wEjKHRHlvzfxQamFcheMuv8v+xeqphEO5V41xRd7R9deOQ==
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
+<file name="%LOGDIR/name%TESTNUMBER">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 6
+Connection: close
+Content-Disposition: inline; filename="name%TESTNUMBER"
+Content-Type: text/html
+
+12345
+</file>
+
 </verify>
-# Input and output (type 1 message) for fake_ntlm
-<ntlm_auth_type1>
-<input>
-YR
-</input>
-<output>
-YR TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAAAAAAAAAwAAAA
-</output>
-</ntlm_auth_type1>
-# Input and output (type 3 message) for fake_ntlm
-<ntlm_auth_type3>
-<input>
-TT TlRMTVNTUAACAAAAAgACADAAAAAGgoEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
-</input>
-<output>
-KK TlRMTVNTUAADAAAAGAAYAE8AAAAYABgAZwAAAAAAAABAAAAACAAIAEAAAAAHAAcASAAAAAAAAAAAAAAAggEAAHRlc3R1c2VyVU5LTk9XTlpkQwKRCZFMhjj0tw47wEjKHRHlvzfxQamFcheMuv8v+xeqphEO5V41xRd7R9deOQ==
-</output>
-</ntlm_auth_type3>
 </testcase>
diff --git a/third-party/curl/tests/data/test1311 b/third-party/curl/tests/data/test1311
index 6d8f4ebbd4..5accbbfa7a 100644
--- a/third-party/curl/tests/data/test1311
+++ b/third-party/curl/tests/data/test1311
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
 <data nocheck="yes">
 HTTP/1.1 200 OK
@@ -22,32 +22,22 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -J output in
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -J and Content-Disposition
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -O
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -O --output-dir %LOGDIR
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1312 b/third-party/curl/tests/data/test1312
index 0e5a1159d8..0d3b64e8d0 100644
--- a/third-party/curl/tests/data/test1312
+++ b/third-party/curl/tests/data/test1312
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
 <data nocheck="yes">
 HTTP/1.1 200 OK
@@ -22,32 +22,22 @@ Content-Disposition: inline; filename="name%TESTNUMBER;weird"
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -J output in
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -J, Content-Disposition and ; in filename
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-%HOSTIP:%HTTPPORT/%TESTNUMBER -J -O
+%HOSTIP:%HTTPPORT/%TESTNUMBER -J -O --output-dir %LOGDIR
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1313 b/third-party/curl/tests/data/test1313
index ef248c137e..1cb028efc5 100644
--- a/third-party/curl/tests/data/test1313
+++ b/third-party/curl/tests/data/test1313
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
 <data nocheck="yes">
 HTTP/1.1 200 OK
@@ -22,32 +22,22 @@ Content-Disposition: inline; filename='name%TESTNUMBER
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -J output in
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -J, Content-Disposition, uneven quotes
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -O
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -O --output-dir %LOGDIR
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1314 b/third-party/curl/tests/data/test1314
index 8218ab7414..b6c231f79d 100644
--- a/third-party/curl/tests/data/test1314
+++ b/third-party/curl/tests/data/test1314
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -50,10 +51,10 @@ moo
 <server>
 http
 </server>
- <name>
+<name>
 HTTP Location: following a // prefixed url
- </name>
- <command>
+</name>
+<command>
 http://firstplace.example.com/want/%TESTNUMBER -L -x http://%HOSTIP:%HTTPPORT
 </command>
 <features>
@@ -63,7 +64,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://firstplace.example.com/want/%TESTNUMBER HTTP/1.1
 Host: firstplace.example.com
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1315 b/third-party/curl/tests/data/test1315
index 1fa2033085..49788684e9 100644
--- a/third-party/curl/tests/data/test1315
+++ b/third-party/curl/tests/data/test1315
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Based on tests 186 and 1053
 <info>
@@ -28,10 +29,10 @@ Mime
 <server>
 http
 </server>
- <name>
+<name>
 HTTP RFC1867-type formposting - -F with three files, one with explicit type
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -F name=value -F 'file=@%LOGDIR/test%TESTNUMBER.txt,%LOGDIR/test%TESTNUMBER.txt;type=magic/content,%LOGDIR/test%TESTNUMBER.txt'
 </command>
 # We create this file before the command is invoked!
@@ -46,41 +47,41 @@ dummy data
 -----+\w+
 </strip>
 <protocol>
-POST /we/want/%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Content-Length: 797
-Content-Type: multipart/form-data; boundary=----------------------------9ef8d6205763
-
-------------------------------9ef8d6205763
-Content-Disposition: form-data; name="name"
-
-value
-------------------------------9ef8d6205763
-Content-Disposition: form-data; name="file"
-Content-Type: multipart/mixed; boundary=----------------------------aaaaaaaaaaaa
-
-Content-Disposition: attachment; filename="test%TESTNUMBER.txt"
-Content-Type: text/plain
-
+POST /we/want/%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Content-Length: 845%CR
+Content-Type: multipart/form-data; boundary=----------------------------9ef8d6205763%CR
+%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: form-data; name="name"%CR
+%CR
+value%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: form-data; name="file"%CR
+Content-Type: multipart/mixed; boundary=----------------------------aaaaaaaaaaaa%CR
+%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER.txt"%CR
+Content-Type: text/plain%CR
+%CR
 dummy data
-
-------------------------------9ef8d6205763
-Content-Disposition: attachment; filename="test%TESTNUMBER.txt"
-Content-Type: magic/content
-
+%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER.txt"%CR
+Content-Type: magic/content%CR
+%CR
 dummy data
-
-------------------------------9ef8d6205763
-Content-Disposition: attachment; filename="test%TESTNUMBER.txt"
-Content-Type: text/plain
-
+%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER.txt"%CR
+Content-Type: text/plain%CR
+%CR
 dummy data
-
-------------------------------aaaaaaaaaaaa--
-
-------------------------------9ef8d6205763--
+%CR
+------------------------------aaaaaaaaaaaa--%CR
+%CR
+------------------------------9ef8d6205763--%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1316 b/third-party/curl/tests/data/test1316
index a7aae01b59..ea072f7a58 100644
--- a/third-party/curl/tests/data/test1316
+++ b/third-party/curl/tests/data/test1316
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,25 +10,16 @@ HTTP CONNECT
 HTTP proxy
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 Magic: sure you can FTP me
 
 </connect>
 
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
-HTTP/1.1 200 Mighty fine indeed
-Magic: sure you can FTP me
-
-HTTP/1.1 200 Mighty fine indeed
-Magic: sure you can FTP me
-
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -39,10 +31,9 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 
@@ -57,18 +48,17 @@ http-proxy
 <features>
 http
 </features>
- <name>
+<name>
 FTP LIST tunneled through HTTP proxy
- </name>
- <command>
+</name>
+<command>
 ftp://ftp.%TESTNUMBER:%FTPPORT/ -p -x %HOSTIP:%PROXYPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1317 b/third-party/curl/tests/data/test1317
index e466513d15..1f85cbd0ce 100644
--- a/third-party/curl/tests/data/test1317
+++ b/third-party/curl/tests/data/test1317
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -26,7 +26,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -40,10 +39,9 @@ HTTP with --resolve
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: example.com:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1318 b/third-party/curl/tests/data/test1318
index 68a8dfe8ba..06a39a58d6 100644
--- a/third-party/curl/tests/data/test1318
+++ b/third-party/curl/tests/data/test1318
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -26,24 +26,22 @@ Content-Length: 0
 </data1>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
-HTTP with --resolve and same host name using different cases
- </name>
- <command>
+<name>
+HTTP with --resolve and same hostname using different cases
+</name>
+<command>
 --resolve MiXeDcAsE.cOm:%HTTPPORT:%HOSTIP http://MiXeDcAsE.cOm:%HTTPPORT/%TESTNUMBER http://mixedcase.com:%HTTPPORT/%TESTNUMBER0001
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: MiXeDcAsE.cOm:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1319 b/third-party/curl/tests/data/test1319
index 3907262670..5a79b0a73c 100644
--- a/third-party/curl/tests/data/test1319
+++ b/third-party/curl/tests/data/test1319
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,11 +9,10 @@ HTTP CONNECT
 HTTP proxy
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 pop3: sure hit me
 
@@ -27,7 +27,7 @@ To: fake@nowhere
 body
 
 --
-  yours sincerely
+  yours sincerely%CR
 </data>
 
 <datacheck>
@@ -37,11 +37,10 @@ To: fake@nowhere
 body
 
 --
-  yours sincerely
+  yours sincerely%CR
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -52,25 +51,24 @@ http-proxy
 http
 proxy
 </features>
- <name>
+<name>
 POP3 fetch tunneled through HTTP proxy
- </name>
- <command>
+</name>
+<command>
 pop3://pop.%TESTNUMBER:%POP3PORT/%TESTNUMBER -p -x %HOSTIP:%PROXYPORT -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 USER user
 PASS secret
 RETR %TESTNUMBER
 QUIT
 </protocol>
-<proxy>
+<proxy crlf="headers">
 CONNECT pop.%TESTNUMBER:%POP3PORT HTTP/1.1
 Host: pop.%TESTNUMBER:%POP3PORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test132 b/third-party/curl/tests/data/test132
index b3d7ad155d..634cfda3cd 100644
--- a/third-party/curl/tests/data/test132
+++ b/third-party/curl/tests/data/test132
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,12 +8,9 @@ LIST
 netrc
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -24,19 +22,18 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP (optional .netrc; user/passwd supplied) dir list PASV
- </name>
- <command>
+</name>
+<command>
 --netrc-optional --netrc-file %LOGDIR/netrc%TESTNUMBER ftp://mary:mark@%HOSTIP:%FTPPORT/
 </command>
 <file name="%LOGDIR/netrc%TESTNUMBER" >
@@ -46,10 +43,9 @@ machine %HOSTIP login user2 password passwd2
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER mary
 PASS mark
 PWD
diff --git a/third-party/curl/tests/data/test1320 b/third-party/curl/tests/data/test1320
index 2f93a00d2f..6d489e31e7 100644
--- a/third-party/curl/tests/data/test1320
+++ b/third-party/curl/tests/data/test1320
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,17 +9,15 @@ HTTP proxy
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 smtp: sure hit me
 
 </connect>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -29,38 +28,37 @@ http-proxy
 http
 proxy
 </features>
- <name>
+<name>
 SMTP send tunneled through HTTP proxy
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
- <command>
+<command>
 smtp://smtp.%TESTNUMBER:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -T - -p -x %HOSTIP:%PROXYPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
 body
 .
 </upload>
-<proxy>
+<proxy crlf="headers">
 CONNECT smtp.%TESTNUMBER:%SMTPPORT HTTP/1.1
 Host: smtp.%TESTNUMBER:%SMTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1321 b/third-party/curl/tests/data/test1321
index eba7ad5485..808b90cbef 100644
--- a/third-party/curl/tests/data/test1321
+++ b/third-party/curl/tests/data/test1321
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,15 +10,14 @@ HTTP proxy
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 imap: sure hit me
 
 </connect>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -26,7 +26,7 @@ body
 --
   yours sincerely
 </data>
-<datacheck>
+<datacheck crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -37,7 +37,6 @@ body
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -48,25 +47,24 @@ http-proxy
 http
 proxy
 </features>
- <name>
+<name>
 IMAP FETCH tunneled through HTTP proxy
- </name>
- <command>
+</name>
+<command>
 'imap://imap.%TESTNUMBER:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user:secret -p -x %HOSTIP:%PROXYPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 SELECT %TESTNUMBER
 A004 FETCH 1 BODY[]
 A005 LOGOUT
 </protocol>
-<proxy>
+<proxy crlf="headers">
 CONNECT imap.%TESTNUMBER:%IMAPPORT HTTP/1.1
 Host: imap.%TESTNUMBER:%IMAPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1322 b/third-party/curl/tests/data/test1322
index aae4eb83b5..e66ce30090 100644
--- a/third-party/curl/tests/data/test1322
+++ b/third-party/curl/tests/data/test1322
@@ -1,14 +1,14 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
 --resolve
-trailing dot
+trailing-dot
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -27,7 +27,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -41,10 +40,9 @@ HTTP with --resolve and hostname with trailing dot
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: example.com.:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1323 b/third-party/curl/tests/data/test1323
index 66bac61ff7..ea82e878c0 100644
--- a/third-party/curl/tests/data/test1323
+++ b/third-party/curl/tests/data/test1323
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,12 @@ curlx_tvdiff
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
@@ -25,7 +21,6 @@ curlx_tvdiff
 </name>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 </verify>
diff --git a/third-party/curl/tests/data/test1324 b/third-party/curl/tests/data/test1324
index 32a5e11111..3391d72a72 100644
--- a/third-party/curl/tests/data/test1324
+++ b/third-party/curl/tests/data/test1324
@@ -1,13 +1,14 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
+IPv6
 --resolve
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -26,9 +27,12 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
+<features>
+http
+IPv6
+</features>
 <server>
 http-ipv6
 </server>
@@ -40,10 +44,9 @@ HTTP with --resolve and [ipv6address]
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: example.com:%HTTP6PORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1325 b/third-party/curl/tests/data/test1325
index 3d4b62ac23..df3fead5df 100644
--- a/third-party/curl/tests/data/test1325
+++ b/third-party/curl/tests/data/test1325
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # https://greenbytes.de/tech/webdav/draft-reschke-http-status-308-latest.html
 <info>
@@ -8,17 +9,16 @@ HTTP GET
 followlocation
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 308 OK swsclose
 Location: %TESTNUMBER0002
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
 
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Location: this should be ignored
 Date: Tue, 09 Nov 2010 14:49:00 GMT
@@ -26,7 +26,7 @@ Connection: close
 
 body
 </data2>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 308 OK swsclose
 Location: %TESTNUMBER0002
 Date: Tue, 09 Nov 2010 14:49:00 GMT
@@ -41,24 +41,22 @@ body
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP 308-redirect with POST
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/%TESTNUMBER -L -d "moo"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /we/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1326 b/third-party/curl/tests/data/test1326
index 3a1f1a7024..69b0ec9c00 100644
--- a/third-party/curl/tests/data/test1326
+++ b/third-party/curl/tests/data/test1326
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ UPLOAD
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -16,7 +16,6 @@ moo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -25,22 +24,21 @@ http
 <features>
 telnet
 </features>
- <name>
+<name>
 TELNET to HTTP server
- </name>
-<stdin>
+</name>
+<stdin crlf="headers">
 GET /we/want/%TESTNUMBER HTTP/1.0
 
 </stdin>
- <command>
+<command>
 telnet://%HOSTIP:%HTTPPORT --upload-file -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/%TESTNUMBER HTTP/1.0
 
 </protocol>
diff --git a/third-party/curl/tests/data/test1327 b/third-party/curl/tests/data/test1327
index e289903603..a29f6733a0 100644
--- a/third-party/curl/tests/data/test1327
+++ b/third-party/curl/tests/data/test1327
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,10 @@ UPLOAD
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -20,26 +19,25 @@ http
 <features>
 telnet
 </features>
- <name>
+<name>
 TELNET check of upload with stdout redirected
- </name>
-<stdin>
+</name>
+<stdin crlf="headers">
 GET /ignore/for/%TESTNUMBER HTTP/1.0
 
 </stdin>
-<file name="%LOGDIR/%TESTNUMBER.txt">
+<file name="%LOGDIR/%TESTNUMBER.txt" crlf="headers">
 GET /we/want/%TESTNUMBER HTTP/1.0
 
 </file>
- <command option="no-output">
+<command option="no-output">
 telnet://%HOSTIP:%HTTPPORT -T %LOGDIR/%TESTNUMBER.txt
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/%TESTNUMBER HTTP/1.0
 
 </protocol>
diff --git a/third-party/curl/tests/data/test1328 b/third-party/curl/tests/data/test1328
index bac0590ba3..e1d3da6edb 100644
--- a/third-party/curl/tests/data/test1328
+++ b/third-party/curl/tests/data/test1328
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -15,7 +16,7 @@ Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
 Funny-head: yesyes
 
--noo-
+-nooo-
 </data>
 <data1>
 HTTP/1.1 200 OK
@@ -37,24 +38,22 @@ Funny-head: yesyes
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET a globbed range with -f
- </name>
- <command>
+</name>
+<command>
 -f 'http://%HOSTIP:%HTTPPORT/[%TESTNUMBER0000-%TESTNUMBER0001]' -o %LOGDIR/#1
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0000 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1329 b/third-party/curl/tests/data/test1329
index 0ca5b5aae3..962a35fa79 100644
--- a/third-party/curl/tests/data/test1329
+++ b/third-party/curl/tests/data/test1329
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,16 +6,15 @@ HTTP proxy
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 /-prefixed proxy name
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER -x "/server"
 </command>
 <features>
@@ -22,7 +22,6 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 5 == CURLE_COULDNT_RESOLVE_PROXY
diff --git a/third-party/curl/tests/data/test133 b/third-party/curl/tests/data/test133
index 3a3899a9dc..e13cce882c 100644
--- a/third-party/curl/tests/data/test133
+++ b/third-party/curl/tests/data/test133
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,12 +8,9 @@ LIST
 netrc
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -24,19 +22,18 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP compulsory .netrc; ignore passwd in URL
- </name>
- <command>
+</name>
+<command>
 -n --netrc-file %LOGDIR/netrc%TESTNUMBER ftp://mary:mark@%HOSTIP:%FTPPORT/
 </command>
 <file name="%LOGDIR/netrc%TESTNUMBER" >
@@ -46,10 +43,9 @@ machine %HOSTIP login mary password drfrank
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER mary
 PASS drfrank
 PWD
diff --git a/third-party/curl/tests/data/test1330 b/third-party/curl/tests/data/test1330
index 0dd8f7d267..76426c4de0 100644
--- a/third-party/curl/tests/data/test1330
+++ b/third-party/curl/tests/data/test1330
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,16 +7,12 @@ TrackMemory
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 TrackMemory
@@ -23,12 +20,8 @@ TrackMemory
 <name>
 unit tests memory tracking operational
 </name>
-<command>
-nothing
-</command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <file name="%LOGDIR/memdump">
@@ -39,7 +32,7 @@ MEM unit%TESTNUMBER.c: free()
 s/ =.*//
 s/\(.*\)/()/
 s/:\d+/:/
-s:^(MEM )(.*/)(.*):$1$3:
+s:^(MEM )(.*[/\\])(.*):$1$3:
 s/\r\n/\n/
 s/^MEM getenv.c: realloc\(\)[\n]$//
 s/^MEM getenv.c: free\(\)[\n]$//
diff --git a/third-party/curl/tests/data/test1331 b/third-party/curl/tests/data/test1331
index cfe31d8a4f..e7122caa27 100644
--- a/third-party/curl/tests/data/test1331
+++ b/third-party/curl/tests/data/test1331
@@ -1,8 +1,7 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Test case inspired by this question on stackoverflow:
-#
 # https://stackoverflow.com/questions/10017165/use-libcurl-with-bluecoat-cookie-proxy
-#
 <info>
 <keywords>
 HTTP
@@ -14,7 +13,7 @@ cookies
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 407 Me not know you swsbounce
 Date: Tue, 25 Sep 2001 19:37:44 GMT
 Content-Type: text/html
@@ -26,7 +25,7 @@ Proxy-Authenticate: Basic realm="moo on you"
 This server reply is for testing a simple cookie test case...
 </data>
 
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 200 Fine!
 Content-Type: text/html
 Content-Length: 6
@@ -34,7 +33,7 @@ Content-Length: 6
 hello
 </data1>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 407 Me not know you swsbounce
 Date: Tue, 25 Sep 2001 19:37:44 GMT
 Content-Type: text/html
@@ -49,8 +48,6 @@ Content-Length: 6
 
 hello
 </datacheck>
-
-
 </reply>
 
 # Client-side
@@ -58,10 +55,10 @@ hello
 <server>
 http
 </server>
- <name>
+<name>
 HTTP --proxy-anyauth and 407 with cookies
- </name>
- <command>
+</name>
+<command>
 -U myname:mypassword -x %HOSTIP:%HTTPPORT http://z.x.com/%TESTNUMBER --proxy-anyauth -c %LOGDIR/dump%TESTNUMBER
 </command>
 <features>
@@ -72,7 +69,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://z.x.com/%TESTNUMBER HTTP/1.1
 Host: z.x.com
 User-Agent: curl/%VERSION
@@ -81,7 +78,7 @@ Proxy-Connection: Keep-Alive
 
 GET http://z.x.com/%TESTNUMBER HTTP/1.1
 Host: z.x.com
-Proxy-Authorization: Basic bXluYW1lOm15cGFzc3dvcmQ=
+Proxy-Authorization: Basic %b64[myname:mypassword]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test1332 b/third-party/curl/tests/data/test1332
index b3ff82ddf5..f6f9084565 100644
--- a/third-party/curl/tests/data/test1332
+++ b/third-party/curl/tests/data/test1332
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # test case cloned from 1076 and then 302 was replaced with 303
 <info>
@@ -7,12 +8,11 @@ HTTP POST
 followlocation
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
 HTTP/1.1 303 OK swsclose
-Location: moo.html&testcase=/%TESTNUMBER0002
+Location: moo.html%AMPtestcase=/%TESTNUMBER0002
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
 
@@ -27,7 +27,7 @@ body
 </data2>
 <datacheck>
 HTTP/1.1 303 OK swsclose
-Location: moo.html&testcase=/%TESTNUMBER0002
+Location: moo.html%AMPtestcase=/%TESTNUMBER0002
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
 
@@ -40,24 +40,22 @@ body
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP POST with 303 redirect and --post303
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/blah/%TESTNUMBER -L -d "moo" --post303
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /blah/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -65,7 +63,7 @@ Accept: */*
 Content-Length: 3
 Content-Type: application/x-www-form-urlencoded
 
-mooPOST /blah/moo.html&testcase=/%TESTNUMBER0002 HTTP/1.1
+mooPOST /blah/moo.html%AMPtestcase=/%TESTNUMBER0002 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test1333 b/third-party/curl/tests/data/test1333
index 2d01292174..7e4729fb5b 100644
--- a/third-party/curl/tests/data/test1333
+++ b/third-party/curl/tests/data/test1333
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ chunked Transfer-Encoding
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -21,24 +21,22 @@ Connection: close
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP POST zero length, chunked-encoded
- </name>
- <command>
--d "" --header "Transfer-Encoding: chunked" http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</name>
+<command>
+-d "" --header="Transfer-Encoding: chunked" http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1334 b/third-party/curl/tests/data/test1334
index 0f22d2be52..1f48b3c1e6 100644
--- a/third-party/curl/tests/data/test1334
+++ b/third-party/curl/tests/data/test1334
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -20,32 +20,22 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -O without Content-Disposition, -D file
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -O -D %LOGDIR/heads%TESTNUMBER
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -O -D %LOGDIR/heads%TESTNUMBER --output-dir %LOGDIR
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -57,7 +47,7 @@ Accept: */*
 12345
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
diff --git a/third-party/curl/tests/data/test1335 b/third-party/curl/tests/data/test1335
index 8c2930d609..2c307a47e1 100644
--- a/third-party/curl/tests/data/test1335
+++ b/third-party/curl/tests/data/test1335
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -20,32 +20,22 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -O without Content-Disposition, -D stdout
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -O -D -
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -O -D - --output-dir="%LOGDIR"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -57,7 +47,7 @@ Accept: */*
 12345
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
diff --git a/third-party/curl/tests/data/test1336 b/third-party/curl/tests/data/test1336
index 27dbc3f1da..1ceed4b172 100644
--- a/third-party/curl/tests/data/test1336
+++ b/third-party/curl/tests/data/test1336
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,35 +21,22 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -O and Content-Disposition, -D file
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -O -D %LOGDIR/heads%TESTNUMBER
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -O -D %LOGDIR/heads%TESTNUMBER --output-dir %LOGDIR
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -61,7 +48,7 @@ Accept: */*
 12345
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -74,6 +61,8 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 
 <file3 name="%LOGDIR/stdout%TESTNUMBER">
 </file3>
-
+<notexists>
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1337 b/third-party/curl/tests/data/test1337
index 508a635fd5..b3133cf50e 100644
--- a/third-party/curl/tests/data/test1337
+++ b/third-party/curl/tests/data/test1337
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,35 +21,22 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -O and Content-Disposition, -D stdout
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -O -D -
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -O -D - --output-dir %LOGDIR
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -61,7 +48,7 @@ Accept: */*
 12345
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -71,6 +58,8 @@ Content-Type: text/html
 Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 
 </file2>
-
+<notexists>>
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1338 b/third-party/curl/tests/data/test1338
index 6274688899..db89b7a464 100644
--- a/third-party/curl/tests/data/test1338
+++ b/third-party/curl/tests/data/test1338
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,9 +8,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,32 +21,22 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O and -J output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -O -J without Content-Disposition, -D file
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -O -D %LOGDIR/heads%TESTNUMBER
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -O -D %LOGDIR/heads%TESTNUMBER --output-dir %LOGDIR
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -58,7 +48,7 @@ Accept: */*
 12345
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
diff --git a/third-party/curl/tests/data/test1339 b/third-party/curl/tests/data/test1339
index cac14a13b6..6336e3fe03 100644
--- a/third-party/curl/tests/data/test1339
+++ b/third-party/curl/tests/data/test1339
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,9 +8,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,32 +21,22 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O and -J output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -O -J without Content-Disposition, -D stdout
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -O -D -
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -O -D - --output-dir %LOGDIR
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -58,7 +48,7 @@ Accept: */*
 12345
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
diff --git a/third-party/curl/tests/data/test134 b/third-party/curl/tests/data/test134
index 9efc4e704e..8ad2f1b71f 100644
--- a/third-party/curl/tests/data/test134
+++ b/third-party/curl/tests/data/test134
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,12 +8,9 @@ LIST
 netrc
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -24,10 +22,9 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -48,10 +45,9 @@ machine %HOSTIP login user2 password passwd2
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER romulus
 PASS rhemus
 PWD
diff --git a/third-party/curl/tests/data/test1340 b/third-party/curl/tests/data/test1340
index a18128d29f..1b824dda00 100644
--- a/third-party/curl/tests/data/test1340
+++ b/third-party/curl/tests/data/test1340
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,9 +8,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -22,32 +22,22 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O and -J output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -O -J and Content-Disposition, -D file
 </name>
-<setenv>
-CURL_TESTDIR=%PWD/%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -O -D %LOGDIR/heads%TESTNUMBER -w "curl saved to filename %{filename_effective}\n"
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -O -D %LOGDIR/heads%TESTNUMBER -w "curl saved to filename %{filename_effective}\n" --output-dir %LOGDIR
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -59,7 +49,7 @@ Accept: */*
 12345
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -71,7 +61,7 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 </file2>
 
 <file3 name="%LOGDIR/stdout%TESTNUMBER" mode="text">
-curl saved to filename %PWD/%LOGDIR/name%TESTNUMBER
+curl saved to filename %LOGDIR/name%TESTNUMBER
 </file3>
 
 </verify>
diff --git a/third-party/curl/tests/data/test1341 b/third-party/curl/tests/data/test1341
index 6e11f6cc15..a0a5f731e1 100644
--- a/third-party/curl/tests/data/test1341
+++ b/third-party/curl/tests/data/test1341
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,9 +8,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -22,32 +22,22 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O and -J output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -O -J and Content-Disposition, -D stdout
 </name>
-<setenv>
-CURL_TESTDIR=%PWD/%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -O -D - -w "curl saved to filename %{filename_effective}\n"
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -O -D - -w "curl saved to filename %{filename_effective}\n" --output-dir %LOGDIR
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -59,7 +49,7 @@ Accept: */*
 12345
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -68,7 +58,7 @@ Connection: close
 Content-Type: text/html
 Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 
-curl saved to filename %PWD/%LOGDIR/name%TESTNUMBER
+curl saved to filename %LOGDIR/name%TESTNUMBER
 </file2>
 
 </verify>
diff --git a/third-party/curl/tests/data/test1342 b/third-party/curl/tests/data/test1342
index c21965ad3b..9419acddaa 100644
--- a/third-party/curl/tests/data/test1342
+++ b/third-party/curl/tests/data/test1342
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -20,32 +20,22 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -O -i without Content-Disposition, -D file
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -i -O -D %LOGDIR/heads%TESTNUMBER
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -i -O -D %LOGDIR/heads%TESTNUMBER --output-dir %LOGDIR
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -53,7 +43,7 @@ Accept: */*
 
 </protocol>
 
-<file1 name="%LOGDIR/%TESTNUMBER">
+<file1 name="%LOGDIR/%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -64,7 +54,7 @@ Content-Type: text/html
 12345
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
diff --git a/third-party/curl/tests/data/test1343 b/third-party/curl/tests/data/test1343
index a426ed1abc..64a3b704ec 100644
--- a/third-party/curl/tests/data/test1343
+++ b/third-party/curl/tests/data/test1343
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -20,32 +20,22 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -O -i without Content-Disposition, -D stdout
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -i -O -D -
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -i -O -D - --output-dir %LOGDIR
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -53,7 +43,7 @@ Accept: */*
 
 </protocol>
 
-<file1 name="%LOGDIR/%TESTNUMBER">
+<file1 name="%LOGDIR/%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -64,7 +54,7 @@ Content-Type: text/html
 12345
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
diff --git a/third-party/curl/tests/data/test1344 b/third-party/curl/tests/data/test1344
index 3639c51b7d..57fefa71f4 100644
--- a/third-party/curl/tests/data/test1344
+++ b/third-party/curl/tests/data/test1344
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,35 +21,22 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -O -i and Content-Disposition, -D file
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -i -O -D %LOGDIR/heads%TESTNUMBER
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -i -O -D %LOGDIR/heads%TESTNUMBER --output-dir %LOGDIR
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -57,7 +44,7 @@ Accept: */*
 
 </protocol>
 
-<file1 name="%LOGDIR/%TESTNUMBER">
+<file1 name="%LOGDIR/%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -69,7 +56,7 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 12345
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -82,6 +69,8 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 
 <file3 name="%LOGDIR/stdout%TESTNUMBER">
 </file3>
-
+<notexists>
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1345 b/third-party/curl/tests/data/test1345
index a4ca21c9a3..cbd193ed2c 100644
--- a/third-party/curl/tests/data/test1345
+++ b/third-party/curl/tests/data/test1345
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,35 +21,22 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -O -i and Content-Disposition, -D stdout
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -i -O -D -
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -i -O -D - --output-dir %LOGDIR
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -57,7 +44,7 @@ Accept: */*
 
 </protocol>
 
-<file1 name="%LOGDIR/%TESTNUMBER">
+<file1 name="%LOGDIR/%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -69,7 +56,7 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 12345
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -79,6 +66,8 @@ Content-Type: text/html
 Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 
 </file2>
-
+<notexists>
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1346 b/third-party/curl/tests/data/test1346
index 34f04169f2..4d4cf8023a 100644
--- a/third-party/curl/tests/data/test1346
+++ b/third-party/curl/tests/data/test1346
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -20,32 +20,22 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -O -i without Content-Disposition, without -D
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -i -O
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -i -O --output-dir %LOGDIR
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -53,7 +43,7 @@ Accept: */*
 
 </protocol>
 
-<file1 name="%LOGDIR/%TESTNUMBER">
+<file1 name="%LOGDIR/%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
diff --git a/third-party/curl/tests/data/test1347 b/third-party/curl/tests/data/test1347
index 3276dc4aab..758bf7318f 100644
--- a/third-party/curl/tests/data/test1347
+++ b/third-party/curl/tests/data/test1347
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,35 +21,22 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -O -i and Content-Disposition, without -D
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -i -O
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -i -O --output-dir %LOGDIR
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -57,7 +44,7 @@ Accept: */*
 
 </protocol>
 
-<file1 name="%LOGDIR/%TESTNUMBER">
+<file1 name="%LOGDIR/%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -71,6 +58,9 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 
 <file2 name="%LOGDIR/stdout%TESTNUMBER">
 </file2>
+<notexists>
+%LOGDIR/name%TESTNUMBER
+</notexists>
 
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1348 b/third-party/curl/tests/data/test1348
index cc31308834..7fb7d6fb96 100644
--- a/third-party/curl/tests/data/test1348
+++ b/third-party/curl/tests/data/test1348
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -16,28 +17,20 @@ mooo
 
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 ftp
 </server>
 <name>
 FTP download, file without Content-Disposition inside, using -O
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O
+ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O --output-dir %LOGDIR
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1349 b/third-party/curl/tests/data/test1349
index 4339fd3427..ae19f87a7c 100644
--- a/third-party/curl/tests/data/test1349
+++ b/third-party/curl/tests/data/test1349
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -16,28 +17,20 @@ mooo
 
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 ftp
 </server>
 <name>
 FTP download, file without C-D inside, using -O -D file
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -D %LOGDIR/heads%TESTNUMBER
+ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -D %LOGDIR/heads%TESTNUMBER --output-dir %LOGDIR
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -54,13 +47,13 @@ fooo
 mooo
 </file1>
 
-# The final "221 bye bye baby" response to QUIT will not be recorded
-# since that is not considered part of this particular transfer!
-<file2 name="%LOGDIR/heads%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+# The final "221 bye bye baby" response to QUIT is not recorded
+# since that is not considered part of this particular transfer.
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
diff --git a/third-party/curl/tests/data/test135 b/third-party/curl/tests/data/test135
index 96ff3c9121..7593fa7574 100644
--- a/third-party/curl/tests/data/test135
+++ b/third-party/curl/tests/data/test135
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -28,17 +29,17 @@ Range
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP retrieve a byte-range
- </name>
- <command>
+</name>
+<command>
 -r 4-16 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1350 b/third-party/curl/tests/data/test1350
index 5ef833bfd5..8335bda811 100644
--- a/third-party/curl/tests/data/test1350
+++ b/third-party/curl/tests/data/test1350
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -16,28 +17,20 @@ mooo
 
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 ftp
 </server>
 <name>
 FTP download, file without C-D inside, using -O -D stdout
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -D -
+ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -D - --output-dir %LOGDIR
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -54,13 +47,13 @@ fooo
 mooo
 </file1>
 
-# The final "221 bye bye baby" response to QUIT will not be recorded
-# since that is not considered part of this particular transfer!
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+# The final "221 bye bye baby" response to QUIT is not recorded
+# since that is not considered part of this particular transfer.
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
diff --git a/third-party/curl/tests/data/test1351 b/third-party/curl/tests/data/test1351
index da0635e757..525b23fdb0 100644
--- a/third-party/curl/tests/data/test1351
+++ b/third-party/curl/tests/data/test1351
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -17,28 +18,20 @@ mooo
 
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 ftp
 </server>
 <name>
 FTP download, file without C-D inside, using -O -J -D file
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -J -D %LOGDIR/heads%TESTNUMBER
+ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -J -D %LOGDIR/heads%TESTNUMBER --output-dir %LOGDIR
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -55,13 +48,13 @@ fooo
 mooo
 </file1>
 
-# The final "221 bye bye baby" response to QUIT will not be recorded
-# since that is not considered part of this particular transfer!
-<file2 name="%LOGDIR/heads%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+# The final "221 bye bye baby" response to QUIT is not recorded
+# since that is not considered part of this particular transfer.
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
diff --git a/third-party/curl/tests/data/test1352 b/third-party/curl/tests/data/test1352
index e7a7370d81..725e63fee3 100644
--- a/third-party/curl/tests/data/test1352
+++ b/third-party/curl/tests/data/test1352
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -17,28 +18,20 @@ mooo
 
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 ftp
 </server>
 <name>
 FTP download, file without C-D inside, using -O -J -D stdout
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -J -D -
+ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -J -D - --output-dir %LOGDIR
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -55,13 +48,13 @@ fooo
 mooo
 </file1>
 
-# The final "221 bye bye baby" response to QUIT will not be recorded
-# since that is not considered part of this particular transfer!
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+# The final "221 bye bye baby" response to QUIT is not recorded
+# since that is not considered part of this particular transfer.
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
diff --git a/third-party/curl/tests/data/test1353 b/third-party/curl/tests/data/test1353
index 9bbe150a5a..ee05e78120 100644
--- a/third-party/curl/tests/data/test1353
+++ b/third-party/curl/tests/data/test1353
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -16,28 +17,20 @@ mooo
 
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 ftp
 </server>
 <name>
 FTP download, file without C-D inside, using -O -i -D file
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -i -D %LOGDIR/heads%TESTNUMBER
+ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -i -D %LOGDIR/heads%TESTNUMBER --output-dir %LOGDIR
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -54,13 +47,13 @@ fooo
 mooo
 </file1>
 
-# The final "221 bye bye baby" response to QUIT will not be recorded
-# since that is not considered part of this particular transfer!
-<file2 name="%LOGDIR/heads%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+# The final "221 bye bye baby" response to QUIT is not recorded
+# since that is not considered part of this particular transfer.
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
diff --git a/third-party/curl/tests/data/test1354 b/third-party/curl/tests/data/test1354
index 9e7a097791..44a32bc41f 100644
--- a/third-party/curl/tests/data/test1354
+++ b/third-party/curl/tests/data/test1354
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -16,28 +17,20 @@ mooo
 
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 ftp
 </server>
 <name>
 FTP download, file without C-D inside, using -O -i -D stdout
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -i -D -
+ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -i -D - --output-dir %LOGDIR
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -54,11 +47,11 @@ fooo
 mooo
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
diff --git a/third-party/curl/tests/data/test1355 b/third-party/curl/tests/data/test1355
index f185d9c38f..0970fdc158 100644
--- a/third-party/curl/tests/data/test1355
+++ b/third-party/curl/tests/data/test1355
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -16,28 +17,20 @@ mooo
 
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 ftp
 </server>
 <name>
 FTP download, file without C-D inside, using -O -i, without -D
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -i
+ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -i --output-dir %LOGDIR
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1356 b/third-party/curl/tests/data/test1356
index ecc2cc2753..d92f3cf860 100644
--- a/third-party/curl/tests/data/test1356
+++ b/third-party/curl/tests/data/test1356
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ RETR
 # Server-side
 <reply>
 # file%TESTNUMBER contents...
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -24,31 +25,20 @@ MOOOO
 
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 ftp
 </server>
 <name>
 FTP download, file with Content-Disposition inside, using -O
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O
+ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O --output-dir %LOGDIR
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -60,7 +50,7 @@ RETR file%TESTNUMBER
 QUIT
 </protocol>
 
-<file1 name="%LOGDIR/file%TESTNUMBER">
+<file1 name="%LOGDIR/file%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -74,6 +64,8 @@ MOOOO
 
 <file2 name="%LOGDIR/stdout%TESTNUMBER">
 </file2>
-
+<notexists>
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1357 b/third-party/curl/tests/data/test1357
index 15ed235842..08177da5f3 100644
--- a/third-party/curl/tests/data/test1357
+++ b/third-party/curl/tests/data/test1357
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -24,31 +25,20 @@ MOOOO
 
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 ftp
 </server>
 <name>
 FTP download, file with C-D inside, using -O -D file
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -D %LOGDIR/heads%TESTNUMBER
+ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -D %LOGDIR/heads%TESTNUMBER --output-dir %LOGDIR
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -72,11 +62,11 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 MOOOO
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
@@ -94,6 +84,8 @@ s/^(229 Entering Passive Mode \().*(\).*)/${1}stripped${2}/
 
 <file3 name="%LOGDIR/stdout%TESTNUMBER">
 </file3>
-
+<notexists>
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1358 b/third-party/curl/tests/data/test1358
index b53be504bf..f2c69dc9b3 100644
--- a/third-party/curl/tests/data/test1358
+++ b/third-party/curl/tests/data/test1358
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -24,31 +25,20 @@ MOOOO
 
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 ftp
 </server>
 <name>
 FTP download, file with C-D inside, using -O -D stdout
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -D -
+ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -D - --output-dir %LOGDIR
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -72,11 +62,11 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 MOOOO
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
@@ -92,5 +82,8 @@ MOOOO
 s/^(229 Entering Passive Mode \().*(\).*)/${1}stripped${2}/
 </stripfile2>
 
+<notexists>
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1359 b/third-party/curl/tests/data/test1359
index 4d5b27d0f3..c6f745f6c7 100644
--- a/third-party/curl/tests/data/test1359
+++ b/third-party/curl/tests/data/test1359
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -25,31 +26,20 @@ MOOOO
 
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 ftp
 </server>
 <name>
 FTP download, file with C-D inside, using -O -J -D file
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -J -D %LOGDIR/heads%TESTNUMBER
+ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -J -D %LOGDIR/heads%TESTNUMBER --output-dir %LOGDIR
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -73,11 +63,11 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 MOOOO
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
@@ -96,5 +86,8 @@ s/^(229 Entering Passive Mode \().*(\).*)/${1}stripped${2}/
 <file3 name="%LOGDIR/stdout%TESTNUMBER">
 </file3>
 
+<notexists>
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test136 b/third-party/curl/tests/data/test136
index dc0abe7e47..06e79330ed 100644
--- a/third-party/curl/tests/data/test136
+++ b/third-party/curl/tests/data/test136
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -18,19 +19,19 @@ RETR
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP with user and no password
- </name>
- <command>
+</name>
+<command>
 -u user: ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER user
-PASS 
+PASS%SP
 PWD
 EPSV
 TYPE I
diff --git a/third-party/curl/tests/data/test1360 b/third-party/curl/tests/data/test1360
index be91414ea5..eedbde7b48 100644
--- a/third-party/curl/tests/data/test1360
+++ b/third-party/curl/tests/data/test1360
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -25,31 +26,20 @@ MOOOO
 
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 ftp
 </server>
 <name>
 FTP download, file with C-D inside, using -O -J -D stdout
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -J -D -
+ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -J -D - --output-dir %LOGDIR
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -73,11 +63,11 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 MOOOO
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
@@ -93,5 +83,8 @@ MOOOO
 s/^(229 Entering Passive Mode \().*(\).*)/${1}stripped${2}/
 </stripfile2>
 
+<notexists>
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1361 b/third-party/curl/tests/data/test1361
index 7e4d18eaae..cb8e93f192 100644
--- a/third-party/curl/tests/data/test1361
+++ b/third-party/curl/tests/data/test1361
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -24,31 +25,20 @@ MOOOO
 
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 ftp
 </server>
 <name>
 FTP download, file with C-D inside, using -O -i -D file
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -i -D %LOGDIR/heads%TESTNUMBER
+ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -i -D %LOGDIR/heads%TESTNUMBER --output-dir %LOGDIR
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -72,11 +62,11 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 MOOOO
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
@@ -95,5 +85,8 @@ s/^(229 Entering Passive Mode \().*(\).*)/${1}stripped${2}/
 <file3 name="%LOGDIR/stdout%TESTNUMBER">
 </file3>
 
+<notexists>
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1362 b/third-party/curl/tests/data/test1362
index ad49b7be45..ac46386581 100644
--- a/third-party/curl/tests/data/test1362
+++ b/third-party/curl/tests/data/test1362
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -24,31 +25,20 @@ MOOOO
 
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 ftp
 </server>
 <name>
 FTP download, file with C-D inside, using -O -i -D stdout
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -i -D -
+ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -i -D - --output-dir %LOGDIR
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -72,11 +62,11 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 MOOOO
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
@@ -92,5 +82,8 @@ MOOOO
 s/^(229 Entering Passive Mode \().*(\).*)/${1}stripped${2}/
 </stripfile2>
 
+<notexists>
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1363 b/third-party/curl/tests/data/test1363
index af2d67bbe3..e9f7bcb2a5 100644
--- a/third-party/curl/tests/data/test1363
+++ b/third-party/curl/tests/data/test1363
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ RETR
 # Server-side
 <reply>
 # file%TESTNUMBER contents...
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -24,31 +25,20 @@ MOOOO
 
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O output in, using the CURL_TESTDIR variable
-<features>
-debug
-</features>
 <server>
 ftp
 </server>
 <name>
 FTP download, file with C-D inside, using -O -i, without -D
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -i
+ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -O -i --output-dir %LOGDIR
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -60,7 +50,7 @@ RETR file%TESTNUMBER
 QUIT
 </protocol>
 
-<file1 name="%LOGDIR/file%TESTNUMBER">
+<file1 name="%LOGDIR/file%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -75,5 +65,8 @@ MOOOO
 <file2 name="%LOGDIR/stdout%TESTNUMBER">
 </file2>
 
+<notexists>
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1364 b/third-party/curl/tests/data/test1364
index e2a8740dae..1ad220d8e6 100644
--- a/third-party/curl/tests/data/test1364
+++ b/third-party/curl/tests/data/test1364
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -20,7 +20,6 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -32,15 +31,11 @@ HTTP GET -o fname without Content-Disposition, -D file
 <command option="no-output,no-include">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -o %LOGDIR/outfile%TESTNUMBER -D %LOGDIR/heads%TESTNUMBER
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -52,7 +47,7 @@ Accept: */*
 12345
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -65,5 +60,8 @@ Content-Type: text/html
 <file3 name="%LOGDIR/stdout%TESTNUMBER">
 </file3>
 
+<notexists>
+%LOGDIR/%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1365 b/third-party/curl/tests/data/test1365
index 9a6c197988..92618f5fe6 100644
--- a/third-party/curl/tests/data/test1365
+++ b/third-party/curl/tests/data/test1365
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -20,7 +20,6 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -32,15 +31,11 @@ HTTP GET -o fname without Content-Disposition, -D stdout
 <command option="no-output,no-include">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -o %LOGDIR/outfile%TESTNUMBER -D -
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -52,7 +47,7 @@ Accept: */*
 12345
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -62,5 +57,8 @@ Content-Type: text/html
 
 </file2>
 
+<notexists>
+%LOGDIR/%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1366 b/third-party/curl/tests/data/test1366
index d46d9c47bb..577acc2aeb 100644
--- a/third-party/curl/tests/data/test1366
+++ b/third-party/curl/tests/data/test1366
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,7 +21,6 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -33,15 +32,11 @@ HTTP GET -o fname and Content-Disposition, -D file
 <command option="no-output,no-include">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -o %LOGDIR/outfile%TESTNUMBER -D %LOGDIR/heads%TESTNUMBER
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/%TESTNUMBER %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -53,7 +48,7 @@ Accept: */*
 12345
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -67,5 +62,9 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 <file3 name="%LOGDIR/stdout%TESTNUMBER">
 </file3>
 
+<notexists>
+%LOGDIR/%TESTNUMBER
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1367 b/third-party/curl/tests/data/test1367
index f7a73f7b05..f93b7fd4e8 100644
--- a/third-party/curl/tests/data/test1367
+++ b/third-party/curl/tests/data/test1367
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,7 +21,6 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -33,15 +32,11 @@ HTTP GET -o fname and Content-Disposition, -D stdout
 <command option="no-output,no-include">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -o %LOGDIR/outfile%TESTNUMBER -D -
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/%TESTNUMBER %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -53,7 +48,7 @@ Accept: */*
 12345
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -64,5 +59,9 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 
 </file2>
 
+<notexists>
+%LOGDIR/%TESTNUMBER
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1368 b/third-party/curl/tests/data/test1368
index 06b6425e3c..627a2d4f74 100644
--- a/third-party/curl/tests/data/test1368
+++ b/third-party/curl/tests/data/test1368
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,9 +8,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,7 +21,6 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -33,15 +32,11 @@ HTTP GET -o fname -J without Content-Disposition, -D file
 <command option="no-output,no-include">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -o %LOGDIR/outfile%TESTNUMBER -D %LOGDIR/heads%TESTNUMBER
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -53,7 +48,7 @@ Accept: */*
 12345
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -66,5 +61,8 @@ Content-Type: text/html
 <file3 name="%LOGDIR/stdout%TESTNUMBER">
 </file3>
 
+<notexists>
+%LOGDIR/%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1369 b/third-party/curl/tests/data/test1369
index 38771be412..921fc47e1d 100644
--- a/third-party/curl/tests/data/test1369
+++ b/third-party/curl/tests/data/test1369
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,9 +8,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,7 +21,6 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -33,15 +32,11 @@ HTTP GET -o fname -J without Content-Disposition, -D stdout
 <command option="no-output,no-include">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -o %LOGDIR/outfile%TESTNUMBER -D -
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -53,7 +48,7 @@ Accept: */*
 12345
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -63,5 +58,8 @@ Content-Type: text/html
 
 </file2>
 
+<notexists>
+%LOGDIR/%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test137 b/third-party/curl/tests/data/test137
index dba8d5a896..db6cc0e1ef 100644
--- a/third-party/curl/tests/data/test137
+++ b/third-party/curl/tests/data/test137
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -21,17 +22,17 @@ RETRNOSIZE
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download without size in RETR string
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/blalbla/lululul/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1370 b/third-party/curl/tests/data/test1370
index 6b2d4c5406..783f2bd994 100644
--- a/third-party/curl/tests/data/test1370
+++ b/third-party/curl/tests/data/test1370
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,9 +8,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -22,7 +22,6 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -34,15 +33,11 @@ HTTP GET -o fname -J and Content-Disposition, -D file
 <command option="no-output,no-include">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -o %LOGDIR/outfile%TESTNUMBER -D %LOGDIR/heads%TESTNUMBER
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/%TESTNUMBER %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -54,7 +49,7 @@ Accept: */*
 12345
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -68,5 +63,9 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 <file3 name="%LOGDIR/stdout%TESTNUMBER">
 </file3>
 
+<notexists>
+%LOGDIR/%TESTNUMBER
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1371 b/third-party/curl/tests/data/test1371
index 5f6dfa8730..9574773668 100644
--- a/third-party/curl/tests/data/test1371
+++ b/third-party/curl/tests/data/test1371
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,9 +8,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -22,7 +22,6 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -34,15 +33,11 @@ HTTP GET -o fname -J and Content-Disposition, -D stdout
 <command option="no-output,no-include">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -o %LOGDIR/outfile%TESTNUMBER -D -
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/%TESTNUMBER %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -54,7 +49,7 @@ Accept: */*
 12345
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -65,5 +60,9 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 
 </file2>
 
+<notexists>
+%LOGDIR/%TESTNUMBER
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1372 b/third-party/curl/tests/data/test1372
index 8ef7b324a0..282a5a3b8f 100644
--- a/third-party/curl/tests/data/test1372
+++ b/third-party/curl/tests/data/test1372
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -20,7 +20,6 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -32,15 +31,11 @@ HTTP GET -o fname -i without Content-Disposition, -D file
 <command option="no-output,no-include">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -i -o %LOGDIR/outfile%TESTNUMBER -D %LOGDIR/heads%TESTNUMBER
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -48,7 +43,7 @@ Accept: */*
 
 </protocol>
 
-<file1 name="%LOGDIR/outfile%TESTNUMBER">
+<file1 name="%LOGDIR/outfile%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -59,7 +54,7 @@ Content-Type: text/html
 12345
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -72,5 +67,8 @@ Content-Type: text/html
 <file3 name="%LOGDIR/stdout%TESTNUMBER">
 </file3>
 
+<notexists>
+%LOGDIR/%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1373 b/third-party/curl/tests/data/test1373
index b900f51584..50ef633718 100644
--- a/third-party/curl/tests/data/test1373
+++ b/third-party/curl/tests/data/test1373
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -20,7 +20,6 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -32,15 +31,11 @@ HTTP GET -o fname -i without Content-Disposition, -D stdout
 <command option="no-output,no-include">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -i -o %LOGDIR/outfile%TESTNUMBER -D -
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -48,7 +43,7 @@ Accept: */*
 
 </protocol>
 
-<file1 name="%LOGDIR/outfile%TESTNUMBER">
+<file1 name="%LOGDIR/outfile%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -59,7 +54,7 @@ Content-Type: text/html
 12345
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -69,5 +64,8 @@ Content-Type: text/html
 
 </file2>
 
+<notexists>
+%LOGDIR/%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1374 b/third-party/curl/tests/data/test1374
index dec09282f9..fc683ba359 100644
--- a/third-party/curl/tests/data/test1374
+++ b/third-party/curl/tests/data/test1374
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,7 +21,6 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -33,15 +32,11 @@ HTTP GET -o fname -i and Content-Disposition, -D file
 <command option="no-output,no-include">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -i -o %LOGDIR/outfile%TESTNUMBER -D %LOGDIR/heads%TESTNUMBER
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/%TESTNUMBER %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -49,7 +44,7 @@ Accept: */*
 
 </protocol>
 
-<file1 name="%LOGDIR/outfile%TESTNUMBER">
+<file1 name="%LOGDIR/outfile%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -61,7 +56,7 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 12345
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -75,5 +70,9 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 <file3 name="%LOGDIR/stdout%TESTNUMBER">
 </file3>
 
+<notexists>
+%LOGDIR/%TESTNUMBER
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1375 b/third-party/curl/tests/data/test1375
index 2048e05863..954fb71ce9 100644
--- a/third-party/curl/tests/data/test1375
+++ b/third-party/curl/tests/data/test1375
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,7 +21,6 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -33,15 +32,11 @@ HTTP GET -o fname -i and Content-Disposition, -D stdout
 <command option="no-output,no-include">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -i -o %LOGDIR/outfile%TESTNUMBER -D -
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/%TESTNUMBER %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -49,7 +44,7 @@ Accept: */*
 
 </protocol>
 
-<file1 name="%LOGDIR/outfile%TESTNUMBER">
+<file1 name="%LOGDIR/outfile%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -61,7 +56,7 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 12345
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -72,5 +67,9 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 
 </file2>
 
+<notexists>
+%LOGDIR/%TESTNUMBER
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1376 b/third-party/curl/tests/data/test1376
index ea6764ca3b..517a3d5480 100644
--- a/third-party/curl/tests/data/test1376
+++ b/third-party/curl/tests/data/test1376
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -20,7 +20,6 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -32,15 +31,11 @@ HTTP GET -o fname -i without Content-Disposition, without -D
 <command option="no-output,no-include">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -i -o %LOGDIR/outfile%TESTNUMBER
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -48,7 +43,7 @@ Accept: */*
 
 </protocol>
 
-<file1 name="%LOGDIR/outfile%TESTNUMBER">
+<file1 name="%LOGDIR/outfile%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -62,5 +57,8 @@ Content-Type: text/html
 <file2 name="%LOGDIR/stdout%TESTNUMBER">
 </file2>
 
+<notexists>
+%LOGDIR/%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1377 b/third-party/curl/tests/data/test1377
index 19cd2a2e01..615092eebe 100644
--- a/third-party/curl/tests/data/test1377
+++ b/third-party/curl/tests/data/test1377
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,9 +7,8 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,7 +21,6 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -33,15 +32,11 @@ HTTP GET -o fname -i and Content-Disposition, without -D
 <command option="no-output,no-include">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -i -o %LOGDIR/outfile%TESTNUMBER
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/%TESTNUMBER %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -49,7 +44,7 @@ Accept: */*
 
 </protocol>
 
-<file1 name="%LOGDIR/outfile%TESTNUMBER">
+<file1 name="%LOGDIR/outfile%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -63,6 +58,10 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 
 <file2 name="%LOGDIR/stdout%TESTNUMBER">
 </file2>
+<notexists>
+%LOGDIR/%TESTNUMBER
+%LOGDIR/name%TESTNUMBER
+</notexists>
 
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1378 b/third-party/curl/tests/data/test1378
index aa87cb4d75..e98c883065 100644
--- a/third-party/curl/tests/data/test1378
+++ b/third-party/curl/tests/data/test1378
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -25,14 +26,11 @@ FTP DL, file without Content-Disposition inside, using -o fname
 <command option="no-output,no-include">
 ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -o %LOGDIR/download%TESTNUMBER
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/file%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -51,6 +49,9 @@ mooo
 
 <file2 name="%LOGDIR/stdout%TESTNUMBER">
 </file2>
+<notexists>
+%LOGDIR/file%TESTNUMBER
+</notexists>
 
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1379 b/third-party/curl/tests/data/test1379
index ab101a3797..5989c97c29 100644
--- a/third-party/curl/tests/data/test1379
+++ b/third-party/curl/tests/data/test1379
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -25,14 +26,11 @@ FTP DL, file without C-D inside, using -o fname -D file
 <command option="no-output,no-include">
 ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -o %LOGDIR/download%TESTNUMBER -D %LOGDIR/heads%TESTNUMBER
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/file%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -49,11 +47,11 @@ fooo
 mooo
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
@@ -72,5 +70,8 @@ s/^(229 Entering Passive Mode \().*(\).*)/${1}stripped${2}/
 <file3 name="%LOGDIR/stdout%TESTNUMBER">
 </file3>
 
+<notexists>
+%LOGDIR/file%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test138 b/third-party/curl/tests/data/test138
index e4e0691365..428f1f5b6c 100644
--- a/third-party/curl/tests/data/test138
+++ b/third-party/curl/tests/data/test138
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -24,17 +25,17 @@ REPLY SIZE 500 command not understood
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download without size in RETR string and no SIZE command
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/blalbla/lululul/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1380 b/third-party/curl/tests/data/test1380
index 038a48d985..ad05b0edaf 100644
--- a/third-party/curl/tests/data/test1380
+++ b/third-party/curl/tests/data/test1380
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -25,14 +26,11 @@ FTP DL, file without C-D inside, using -o fname -D stdout
 <command option="no-output,no-include">
 ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -o %LOGDIR/download%TESTNUMBER -D -
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/file%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -49,11 +47,11 @@ fooo
 mooo
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
@@ -69,5 +67,8 @@ mooo
 s/^(229 Entering Passive Mode \().*(\).*)/${1}stripped${2}/
 </stripfile2>
 
+<notexists>
+%LOGDIR/file%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1381 b/third-party/curl/tests/data/test1381
index aa29537c62..5ff9322a28 100644
--- a/third-party/curl/tests/data/test1381
+++ b/third-party/curl/tests/data/test1381
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -26,14 +27,11 @@ FTP DL, file without C-D inside, using -o fname -J -D file
 <command option="no-output,no-include">
 ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -o %LOGDIR/download%TESTNUMBER -J -D %LOGDIR/heads%TESTNUMBER
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/file%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -50,11 +48,11 @@ fooo
 mooo
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
@@ -73,5 +71,8 @@ s/^(229 Entering Passive Mode \().*(\).*)/${1}stripped${2}/
 <file3 name="%LOGDIR/stdout%TESTNUMBER">
 </file3>
 
+<notexists>
+%LOGDIR/file%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1382 b/third-party/curl/tests/data/test1382
index 6feed42c1b..c49f3d9827 100644
--- a/third-party/curl/tests/data/test1382
+++ b/third-party/curl/tests/data/test1382
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -26,14 +27,11 @@ FTP DL, file without C-D inside, using -o fname -J -D stdout
 <command option="no-output,no-include">
 ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -o %LOGDIR/download%TESTNUMBER -J -D -
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/file%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -50,11 +48,11 @@ fooo
 mooo
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
@@ -70,5 +68,8 @@ mooo
 s/^(229 Entering Passive Mode \().*(\).*)/${1}stripped${2}/
 </stripfile2>
 
+<notexists>
+%LOGDIR/file%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1383 b/third-party/curl/tests/data/test1383
index 2e3114d4e9..001b8de6dd 100644
--- a/third-party/curl/tests/data/test1383
+++ b/third-party/curl/tests/data/test1383
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -25,14 +26,11 @@ FTP DL, file without C-D inside, using -o fname -i -D file
 <command option="no-output,no-include">
 ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -o %LOGDIR/download%TESTNUMBER -i -D %LOGDIR/heads%TESTNUMBER
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/file%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -49,11 +47,11 @@ fooo
 mooo
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
@@ -72,5 +70,8 @@ s/^(229 Entering Passive Mode \().*(\).*)/${1}stripped${2}/
 <file3 name="%LOGDIR/stdout%TESTNUMBER">
 </file3>
 
+<notexists>
+%LOGDIR/file%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1384 b/third-party/curl/tests/data/test1384
index c892b4994e..e8523f17d5 100644
--- a/third-party/curl/tests/data/test1384
+++ b/third-party/curl/tests/data/test1384
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -25,14 +26,11 @@ FTP DL, file without C-D inside, using -o fname -i -D stdout
 <command option="no-output,no-include">
 ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -o %LOGDIR/download%TESTNUMBER -i -D -
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/file%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -49,11 +47,11 @@ fooo
 mooo
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
@@ -69,5 +67,8 @@ mooo
 s/^(229 Entering Passive Mode \().*(\).*)/${1}stripped${2}/
 </stripfile2>
 
+<notexists>
+%LOGDIR/file%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1385 b/third-party/curl/tests/data/test1385
index f755c52c13..e830882c33 100644
--- a/third-party/curl/tests/data/test1385
+++ b/third-party/curl/tests/data/test1385
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -25,14 +26,11 @@ FTP DL, file without C-D inside, using -o fname -i, without -D
 <command option="no-output,no-include">
 ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -o %LOGDIR/download%TESTNUMBER -i
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/file%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -52,5 +50,8 @@ mooo
 <file2 name="%LOGDIR/stdout%TESTNUMBER">
 </file2>
 
+<notexists>
+%LOGDIR/file%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1386 b/third-party/curl/tests/data/test1386
index d0810739a4..ab02e14a9a 100644
--- a/third-party/curl/tests/data/test1386
+++ b/third-party/curl/tests/data/test1386
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ RETR
 # Server-side
 <reply>
 # file%TESTNUMBER contents...
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -33,14 +34,11 @@ FTP DL, file with Content-Disposition inside, using -o fname
 <command option="no-output,no-include">
 ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -o %LOGDIR/download%TESTNUMBER
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/file%TESTNUMBER %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -52,7 +50,7 @@ RETR file%TESTNUMBER
 QUIT
 </protocol>
 
-<file1 name="%LOGDIR/download%TESTNUMBER">
+<file1 name="%LOGDIR/download%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -67,5 +65,9 @@ MOOOO
 <file2 name="%LOGDIR/stdout%TESTNUMBER">
 </file2>
 
+<notexists>
+%LOGDIR/file%TESTNUMBER
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1387 b/third-party/curl/tests/data/test1387
index 5fb66d1ada..1e79dc4d6a 100644
--- a/third-party/curl/tests/data/test1387
+++ b/third-party/curl/tests/data/test1387
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ RETR
 # Server-side
 <reply>
 # file%TESTNUMBER contents...
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -33,14 +34,11 @@ FTP DL, file with C-D inside, using -o fname -D file
 <command option="no-output,no-include">
 ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -o %LOGDIR/download%TESTNUMBER -D %LOGDIR/heads%TESTNUMBER
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/file%TESTNUMBER %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -52,7 +50,7 @@ RETR file%TESTNUMBER
 QUIT
 </protocol>
 
-<file1 name="%LOGDIR/download%TESTNUMBER">
+<file1 name="%LOGDIR/download%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -64,11 +62,11 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 MOOOO
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
@@ -87,5 +85,9 @@ s/^(229 Entering Passive Mode \().*(\).*)/${1}stripped${2}/
 <file3 name="%LOGDIR/stdout%TESTNUMBER">
 </file3>
 
+<notexists>
+%LOGDIR/file%TESTNUMBER
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1388 b/third-party/curl/tests/data/test1388
index aafcf81b51..73cec7b053 100644
--- a/third-party/curl/tests/data/test1388
+++ b/third-party/curl/tests/data/test1388
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ RETR
 # Server-side
 <reply>
 # file%TESTNUMBER contents...
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -33,14 +34,11 @@ FTP DL, file with C-D inside, using -o fname -D stdout
 <command option="no-output,no-include">
 ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -o %LOGDIR/download%TESTNUMBER -D -
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/file%TESTNUMBER %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -52,7 +50,7 @@ RETR file%TESTNUMBER
 QUIT
 </protocol>
 
-<file1 name="%LOGDIR/download%TESTNUMBER">
+<file1 name="%LOGDIR/download%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -64,11 +62,11 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 MOOOO
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
@@ -83,6 +81,10 @@ MOOOO
 <stripfile2>
 s/^(229 Entering Passive Mode \().*(\).*)/${1}stripped${2}/
 </stripfile2>
+<notexists>
+%LOGDIR/file%TESTNUMBER
+%LOGDIR/name%TESTNUMBER
+</notexists>
 
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1389 b/third-party/curl/tests/data/test1389
index a501af9517..5a3b32e0c2 100644
--- a/third-party/curl/tests/data/test1389
+++ b/third-party/curl/tests/data/test1389
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ RETR
 # Server-side
 <reply>
 # file%TESTNUMBER contents...
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -34,14 +35,11 @@ FTP DL, file with C-D inside, using -o fname -J -D file
 <command option="no-output,no-include">
 ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -o %LOGDIR/download%TESTNUMBER -J -D %LOGDIR/heads%TESTNUMBER
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/file%TESTNUMBER %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -53,7 +51,7 @@ RETR file%TESTNUMBER
 QUIT
 </protocol>
 
-<file1 name="%LOGDIR/download%TESTNUMBER">
+<file1 name="%LOGDIR/download%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -65,11 +63,11 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 MOOOO
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
@@ -82,11 +80,15 @@ MOOOO
 226 File transfer complete
 </file2>
 <stripfile2>
-s/^(229 Entering Passive Mode \().*(\).*)/${1}stripped${2}/
+s/^(229 Entering Passive Mode \().*(\)\S*)/${1}stripped${2}/
 </stripfile2>
 
 <file3 name="%LOGDIR/stdout%TESTNUMBER">
 </file3>
+<notexists>
+%LOGDIR/file%TESTNUMBER
+%LOGDIR/name%TESTNUMBER
+</notexists>
 
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test139 b/third-party/curl/tests/data/test139
index 473b49e15e..14e2d0d794 100644
--- a/third-party/curl/tests/data/test139
+++ b/third-party/curl/tests/data/test139
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -21,17 +22,17 @@ this is file contents
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download a newer file with -z
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/blalbla/%TESTNUMBER -z "1 jan 1989"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1390 b/third-party/curl/tests/data/test1390
index 4d84c2d7a1..1d237f6661 100644
--- a/third-party/curl/tests/data/test1390
+++ b/third-party/curl/tests/data/test1390
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ RETR
 # Server-side
 <reply>
 # file%TESTNUMBER contents...
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -34,14 +35,11 @@ FTP DL, file with C-D inside, using -o fname -J -D stdout
 <command option="no-output,no-include">
 ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -o %LOGDIR/download%TESTNUMBER -J -D -
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/file%TESTNUMBER %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -53,7 +51,7 @@ RETR file%TESTNUMBER
 QUIT
 </protocol>
 
-<file1 name="%LOGDIR/download%TESTNUMBER">
+<file1 name="%LOGDIR/download%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -65,11 +63,11 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 MOOOO
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
@@ -85,5 +83,9 @@ MOOOO
 s/^(229 Entering Passive Mode \().*(\).*)/${1}stripped${2}/
 </stripfile2>
 
+<notexists>
+%LOGDIR/file%TESTNUMBER
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1391 b/third-party/curl/tests/data/test1391
index 4be579cb5c..7362bee8c9 100644
--- a/third-party/curl/tests/data/test1391
+++ b/third-party/curl/tests/data/test1391
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ RETR
 # Server-side
 <reply>
 # file%TESTNUMBER contents...
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -33,14 +34,11 @@ FTP DL, file with C-D inside, using -o fname -i -D file
 <command option="no-output,no-include">
 ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -o %LOGDIR/download%TESTNUMBER -i -D %LOGDIR/heads%TESTNUMBER
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/file%TESTNUMBER %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -52,7 +50,7 @@ RETR file%TESTNUMBER
 QUIT
 </protocol>
 
-<file1 name="%LOGDIR/download%TESTNUMBER">
+<file1 name="%LOGDIR/download%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -64,11 +62,11 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 MOOOO
 </file1>
 
-<file2 name="%LOGDIR/heads%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+<file2 name="%LOGDIR/heads%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
@@ -87,5 +85,9 @@ s/^(229 Entering Passive Mode \().*(\).*)/${1}stripped${2}/
 <file3 name="%LOGDIR/stdout%TESTNUMBER">
 </file3>
 
+<notexists>
+%LOGDIR/file%TESTNUMBER
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1392 b/third-party/curl/tests/data/test1392
index 3801eb760c..06a3128027 100644
--- a/third-party/curl/tests/data/test1392
+++ b/third-party/curl/tests/data/test1392
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ RETR
 # Server-side
 <reply>
 # file%TESTNUMBER contents...
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -33,14 +34,11 @@ FTP DL, file with C-D inside, using -o fname -i -D stdout
 <command option="no-output,no-include">
 ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -o %LOGDIR/download%TESTNUMBER -i -D -
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/file%TESTNUMBER %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -52,7 +50,7 @@ RETR file%TESTNUMBER
 QUIT
 </protocol>
 
-<file1 name="%LOGDIR/download%TESTNUMBER">
+<file1 name="%LOGDIR/download%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -64,11 +62,11 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
 MOOOO
 </file1>
 
-<file2 name="%LOGDIR/stdout%TESTNUMBER">
-220-        _   _ ____  _     
-220-    ___| | | |  _ \| |    
-220-   / __| | | | |_) | |    
-220-  | (__| |_| |  _ {| |___ 
+<file2 name="%LOGDIR/stdout%TESTNUMBER" crlf="yes">
+220-        _   _ ____  _
+220-    ___| | | |  _ \| |
+220-   / __| | | | |_) | |
+220-  | (__| |_| |  _ {| |___
 220    \___|\___/|_| \_\_____|
 331 We are happy you popped in!
 230 Welcome you silly person
@@ -84,5 +82,9 @@ MOOOO
 s/^(229 Entering Passive Mode \().*(\).*)/${1}stripped${2}/
 </stripfile2>
 
+<notexists>
+%LOGDIR/file%TESTNUMBER
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1393 b/third-party/curl/tests/data/test1393
index d75daab2b6..c7f33d3c33 100644
--- a/third-party/curl/tests/data/test1393
+++ b/third-party/curl/tests/data/test1393
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ RETR
 # Server-side
 <reply>
 # file%TESTNUMBER contents...
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -33,14 +34,11 @@ FTP DL, file with C-D inside, using -o fname -i, without -D
 <command option="no-output,no-include">
 ftp://%HOSTIP:%FTPPORT/path/file%TESTNUMBER -o %LOGDIR/download%TESTNUMBER -i
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/file%TESTNUMBER %LOGDIR/name%TESTNUMBER
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -52,7 +50,7 @@ RETR file%TESTNUMBER
 QUIT
 </protocol>
 
-<file1 name="%LOGDIR/download%TESTNUMBER">
+<file1 name="%LOGDIR/download%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -67,5 +65,9 @@ MOOOO
 <file2 name="%LOGDIR/stdout%TESTNUMBER">
 </file2>
 
+<notexists>
+%LOGDIR/file%TESTNUMBER
+%LOGDIR/name%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1394 b/third-party/curl/tests/data/test1394
index d3ffb2d33f..500512c0ea 100644
--- a/third-party/curl/tests/data/test1394
+++ b/third-party/curl/tests/data/test1394
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,18 +6,17 @@ unittest
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 unit test for parse_cert_parameter()
- </name>
+</name>
+<tool>
+tool%TESTNUMBER
+</tool>
 </client>
 
 <verify>
diff --git a/third-party/curl/tests/data/test1395 b/third-party/curl/tests/data/test1395
index 409e0d631b..374c8eb2b6 100644
--- a/third-party/curl/tests/data/test1395
+++ b/third-party/curl/tests/data/test1395
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,17 +6,13 @@ unittest
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 Curl_dedotdotify
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1396 b/third-party/curl/tests/data/test1396
index d8b432d8b1..3e45556336 100644
--- a/third-party/curl/tests/data/test1396
+++ b/third-party/curl/tests/data/test1396
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,18 +8,14 @@ curl_easy_unescape
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 curl_easy_escape and curl_easy_unescape
- </name>
+</name>
 </client>
 
 </testcase>
diff --git a/third-party/curl/tests/data/test1397 b/third-party/curl/tests/data/test1397
index f31b2c2a3f..266a628a7e 100644
--- a/third-party/curl/tests/data/test1397
+++ b/third-party/curl/tests/data/test1397
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,8 @@ Curl_cert_hostcheck
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
diff --git a/third-party/curl/tests/data/test1398 b/third-party/curl/tests/data/test1398
index 436cac82d4..025c955562 100644
--- a/third-party/curl/tests/data/test1398
+++ b/third-party/curl/tests/data/test1398
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,18 +7,14 @@ curl_msnprintf
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 curl_msnprintf unit tests
- </name>
+</name>
 </client>
 
 </testcase>
diff --git a/third-party/curl/tests/data/test1399 b/third-party/curl/tests/data/test1399
index 6d6ec7a5b0..4bd566a605 100644
--- a/third-party/curl/tests/data/test1399
+++ b/third-party/curl/tests/data/test1399
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,13 @@ Curl_pgrsTime
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 Curl_pgrsTime unit tests
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test14 b/third-party/curl/tests/data/test14
index 1840b36b04..ae17c0c826 100644
--- a/third-party/curl/tests/data/test14
+++ b/third-party/curl/tests/data/test14
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -20,17 +21,17 @@ Connection: close
 <server>
 http
 </server>
- <name>
+<name>
 HTTP HEAD with Connection: close
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -i --head
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 HEAD /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test140 b/third-party/curl/tests/data/test140
index 0642b67fce..6c8c9ec39d 100644
--- a/third-party/curl/tests/data/test140
+++ b/third-party/curl/tests/data/test140
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -20,17 +21,17 @@ FTP
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download file with -z, expected to not transfer
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/blalbla/%TESTNUMBER -z "1 jan 2004"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1400 b/third-party/curl/tests/data/test1400
index a70a3a92ca..d3279a9e7c 100644
--- a/third-party/curl/tests/data/test1400
+++ b/third-party/curl/tests/data/test1400
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -21,23 +22,26 @@ Connection: close
 
 # Client-side
 <client>
+<features>
+--libcurl
+</features>
 <server>
 http
 </server>
- <name>
+<name>
 --libcurl for simple HTTP GET
- </name>
+</name>
 <setenv>
-SSL_CERT_FILE=
+SSL_CERT_FILE
 </setenv>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER --libcurl %LOGDIR/test%TESTNUMBER.c
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -45,66 +49,19 @@ Accept: */*
 
 </protocol>
 <stripfile>
-s/(USERAGENT, \")[^\"]+/${1}stripped/
 # CURLOPT_SSL_VERIFYPEER, SSH_KNOWNHOSTS and HTTP_VERSION vary with
 # CURLOPT_INTERLEAVEDATA requires RTSP protocol
-# configurations - just ignore them
+# configurations - ignore them
 $_ = '' if /CURLOPT_SSL_VERIFYPEER/
 $_ = '' if /CURLOPT_SSH_KNOWNHOSTS/
 $_ = '' if /CURLOPT_HTTP_VERSION/
+$_ = '' if /CURLOPT_SSLVERSION/
 $_ = '' if /CURLOPT_HTTP09_ALLOWED/
 $_ = '' if /CURLOPT_INTERLEAVEDATA/
+$_ = '' if /CURLOPT_TIMEOUT_MS/
 </stripfile>
 <file name="%LOGDIR/test%TESTNUMBER.c" mode="text">
-/********* Sample code generated by the curl command line tool **********
- * All curl_easy_setopt() options are documented at:
- * https://curl.se/libcurl/c/curl_easy_setopt.html
- ************************************************************************/
-#include <curl/curl.h>
-
-int main(int argc, char *argv[])
-{
-  CURLcode ret;
-  CURL *hnd;
-
-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
-  curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
-  curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-%if ftp
-  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
-%endif
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
-
-  /* Here is a list of options the curl code used that cannot get generated
-     as source easily. You may choose to either not use them or implement
-     them yourself.
-
-  CURLOPT_WRITEDATA was set to an object pointer
-  CURLOPT_WRITEFUNCTION was set to a function pointer
-  CURLOPT_READDATA was set to an object pointer
-  CURLOPT_READFUNCTION was set to a function pointer
-  CURLOPT_SEEKDATA was set to an object pointer
-  CURLOPT_SEEKFUNCTION was set to a function pointer
-  CURLOPT_ERRORBUFFER was set to an object pointer
-  CURLOPT_STDERR was set to an object pointer
-  CURLOPT_DEBUGFUNCTION was set to a function pointer
-  CURLOPT_DEBUGDATA was set to an object pointer
-  CURLOPT_HEADERFUNCTION was set to a function pointer
-  CURLOPT_HEADERDATA was set to an object pointer
-
-  */
-
-  ret = curl_easy_perform(hnd);
-
-  curl_easy_cleanup(hnd);
-  hnd = NULL;
-
-  return (int)ret;
-}
-/**** End of sample code ****/
+%includetext %SRCDIR/data/data%TESTNUMBER.c%
 </file>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1401 b/third-party/curl/tests/data/test1401
index 3229c0c4fd..74d1748339 100644
--- a/third-party/curl/tests/data/test1401
+++ b/third-party/curl/tests/data/test1401
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -28,28 +29,30 @@ Connection: close
 <server>
 http
 </server>
- <name>
+<name>
 --libcurl for GET with various options
- </name>
+</name>
 <features>
 http
 ftp
 file
+cookies
+--libcurl
 </features>
 <setenv>
-SSL_CERT_FILE=
+SSL_CERT_FILE
 </setenv>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER --libcurl %LOGDIR/test%TESTNUMBER.c --basic -u fake:user -H "X-Files: Mulder" -H "X-Men: cyclops, iceman" -A MyUA -b chocolate=chip --proto "=http,ftp,file"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic ZmFrZTp1c2Vy
+Authorization: Basic %b64[fake:user]b64%
 User-Agent: MyUA
 Accept: */*
 Cookie: chocolate=chip
@@ -59,74 +62,16 @@ X-Men: cyclops, iceman
 </protocol>
 <stripfile>
 # CURLOPT_SSL_VERIFYPEER, SSH_KNOWNHOSTS and HTTP_VERSION vary with
-# configurations - just ignore them
+# configurations - ignore them
 $_ = '' if /CURLOPT_SSL_VERIFYPEER/
 $_ = '' if /CURLOPT_SSH_KNOWNHOSTS/
 $_ = '' if /CURLOPT_HTTP_VERSION/
 $_ = '' if /CURLOPT_INTERLEAVEDATA/
+$_ = '' if /CURLOPT_SSLVERSION/
+$_ = '' if /CURLOPT_TIMEOUT_MS/
 </stripfile>
 <file name="%LOGDIR/test%TESTNUMBER.c" mode="text">
-/********* Sample code generated by the curl command line tool **********
- * All curl_easy_setopt() options are documented at:
- * https://curl.se/libcurl/c/curl_easy_setopt.html
- ************************************************************************/
-#include <curl/curl.h>
-
-int main(int argc, char *argv[])
-{
-  CURLcode ret;
-  CURL *hnd;
-  struct curl_slist *slist1;
-
-  slist1 = NULL;
-  slist1 = curl_slist_append(slist1, "X-Files: Mulder");
-  slist1 = curl_slist_append(slist1, "X-Men: cyclops, iceman");
-
-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
-  curl_easy_setopt(hnd, CURLOPT_USERPWD, "fake:user");
-  curl_easy_setopt(hnd, CURLOPT_HTTPAUTH, (long)CURLAUTH_BASIC);
-  curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, slist1);
-  curl_easy_setopt(hnd, CURLOPT_USERAGENT, "MyUA");
-  curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
-  curl_easy_setopt(hnd, CURLOPT_COOKIE, "chocolate=chip");
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-%if ftp
-  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
-%endif
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_PROTOCOLS_STR, "file,ftp,http");
-
-  /* Here is a list of options the curl code used that cannot get generated
-     as source easily. You may choose to either not use them or implement
-     them yourself.
-
-  CURLOPT_WRITEDATA was set to an object pointer
-  CURLOPT_WRITEFUNCTION was set to a function pointer
-  CURLOPT_READDATA was set to an object pointer
-  CURLOPT_READFUNCTION was set to a function pointer
-  CURLOPT_SEEKDATA was set to an object pointer
-  CURLOPT_SEEKFUNCTION was set to a function pointer
-  CURLOPT_ERRORBUFFER was set to an object pointer
-  CURLOPT_STDERR was set to an object pointer
-  CURLOPT_DEBUGFUNCTION was set to a function pointer
-  CURLOPT_DEBUGDATA was set to an object pointer
-  CURLOPT_HEADERFUNCTION was set to a function pointer
-  CURLOPT_HEADERDATA was set to an object pointer
-
-  */
-
-  ret = curl_easy_perform(hnd);
-
-  curl_easy_cleanup(hnd);
-  hnd = NULL;
-  curl_slist_free_all(slist1);
-  slist1 = NULL;
-
-  return (int)ret;
-}
-/**** End of sample code ****/
+%includetext %SRCDIR/data/data%TESTNUMBER.c%
 </file>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1402 b/third-party/curl/tests/data/test1402
index d998abfb48..6dd608458a 100644
--- a/third-party/curl/tests/data/test1402
+++ b/third-party/curl/tests/data/test1402
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -22,23 +23,26 @@ Connection: close
 
 # Client-side
 <client>
+<features>
+--libcurl
+</features>
 <server>
 http
 </server>
- <name>
+<name>
 --libcurl for simple POST
- </name>
+</name>
 <setenv>
-SSL_CERT_FILE=
+SSL_CERT_FILE
 </setenv>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER --libcurl %LOGDIR/test%TESTNUMBER.c -d "foo=bar" -d "baz=quux"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /we/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -46,70 +50,20 @@ Accept: */*
 Content-Length: 16
 Content-Type: application/x-www-form-urlencoded
 
-foo=bar&baz=quux
+foo=bar%AMPbaz=quux
 </protocol>
 <stripfile>
-# curl's default user-agent varies with version, libraries etc.
-s/(USERAGENT, \")[^\"]+/${1}stripped/
 # CURLOPT_SSL_VERIFYPEER, SSH_KNOWNHOSTS and HTTP_VERSION vary with
-# configurations - just ignore them
+# configurations - ignore them
 $_ = '' if /CURLOPT_SSL_VERIFYPEER/
 $_ = '' if /CURLOPT_SSH_KNOWNHOSTS/
 $_ = '' if /CURLOPT_HTTP_VERSION/
 $_ = '' if /CURLOPT_INTERLEAVEDATA/
+$_ = '' if /CURLOPT_SSLVERSION/
+$_ = '' if /CURLOPT_TIMEOUT_MS/
 </stripfile>
 <file name="%LOGDIR/test%TESTNUMBER.c" mode="text">
-/********* Sample code generated by the curl command line tool **********
- * All curl_easy_setopt() options are documented at:
- * https://curl.se/libcurl/c/curl_easy_setopt.html
- ************************************************************************/
-#include <curl/curl.h>
-
-int main(int argc, char *argv[])
-{
-  CURLcode ret;
-  CURL *hnd;
-
-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
-  curl_easy_setopt(hnd, CURLOPT_POSTFIELDS, "foo=bar&baz=quux");
-  curl_easy_setopt(hnd, CURLOPT_POSTFIELDSIZE_LARGE, (curl_off_t)16);
-  curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
-  curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-%if ftp
-  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
-%endif
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
-
-  /* Here is a list of options the curl code used that cannot get generated
-     as source easily. You may choose to either not use them or implement
-     them yourself.
-
-  CURLOPT_WRITEDATA was set to an object pointer
-  CURLOPT_WRITEFUNCTION was set to a function pointer
-  CURLOPT_READDATA was set to an object pointer
-  CURLOPT_READFUNCTION was set to a function pointer
-  CURLOPT_SEEKDATA was set to an object pointer
-  CURLOPT_SEEKFUNCTION was set to a function pointer
-  CURLOPT_ERRORBUFFER was set to an object pointer
-  CURLOPT_STDERR was set to an object pointer
-  CURLOPT_DEBUGFUNCTION was set to a function pointer
-  CURLOPT_DEBUGDATA was set to an object pointer
-  CURLOPT_HEADERFUNCTION was set to a function pointer
-  CURLOPT_HEADERDATA was set to an object pointer
-
-  */
-
-  ret = curl_easy_perform(hnd);
-
-  curl_easy_cleanup(hnd);
-  hnd = NULL;
-
-  return (int)ret;
-}
-/**** End of sample code ****/
+%includetext %SRCDIR/data/data%TESTNUMBER.c%
 </file>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1403 b/third-party/curl/tests/data/test1403
index 21c13e4fb1..14383314d4 100644
--- a/third-party/curl/tests/data/test1403
+++ b/third-party/curl/tests/data/test1403
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -22,89 +23,44 @@ Connection: close
 
 # Client-side
 <client>
+<features>
+--libcurl
+</features>
 <server>
 http
 </server>
- <name>
+<name>
 --libcurl for GET with query
- </name>
+</name>
 <setenv>
-SSL_CERT_FILE=
+SSL_CERT_FILE
 </setenv>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER --libcurl %LOGDIR/test%TESTNUMBER.c -G -d "foo=bar" -d "baz=quux"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-GET /we/want/%TESTNUMBER?foo=bar&baz=quux HTTP/1.1
+<protocol crlf="headers">
+GET /we/want/%TESTNUMBER?foo=bar%AMPbaz=quux HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
 <stripfile>
-# curl's default user-agent varies with version, libraries etc.
-s/(USERAGENT, \")[^\"]+/${1}stripped/
 # CURLOPT_SSL_VERIFYPEER, SSH_KNOWNHOSTS and HTTP_VERSION vary with
-# configurations - just ignore them
+# configurations - ignore them
 $_ = '' if /CURLOPT_SSL_VERIFYPEER/
 $_ = '' if /CURLOPT_SSH_KNOWNHOSTS/
 $_ = '' if /CURLOPT_HTTP_VERSION/
 $_ = '' if /CURLOPT_INTERLEAVEDATA/
+$_ = '' if /CURLOPT_SSLVERSION/
+$_ = '' if /CURLOPT_TIMEOUT_MS/
 </stripfile>
 <file name="%LOGDIR/test%TESTNUMBER.c" mode="text">
-/********* Sample code generated by the curl command line tool **********
- * All curl_easy_setopt() options are documented at:
- * https://curl.se/libcurl/c/curl_easy_setopt.html
- ************************************************************************/
-#include <curl/curl.h>
-
-int main(int argc, char *argv[])
-{
-  CURLcode ret;
-  CURL *hnd;
-
-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER\?foo=bar&baz=quux");
-  curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
-  curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-%if ftp
-  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
-%endif
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
-
-  /* Here is a list of options the curl code used that cannot get generated
-     as source easily. You may choose to either not use them or implement
-     them yourself.
-
-  CURLOPT_WRITEDATA was set to an object pointer
-  CURLOPT_WRITEFUNCTION was set to a function pointer
-  CURLOPT_READDATA was set to an object pointer
-  CURLOPT_READFUNCTION was set to a function pointer
-  CURLOPT_SEEKDATA was set to an object pointer
-  CURLOPT_SEEKFUNCTION was set to a function pointer
-  CURLOPT_ERRORBUFFER was set to an object pointer
-  CURLOPT_STDERR was set to an object pointer
-  CURLOPT_DEBUGFUNCTION was set to a function pointer
-  CURLOPT_DEBUGDATA was set to an object pointer
-  CURLOPT_HEADERFUNCTION was set to a function pointer
-  CURLOPT_HEADERDATA was set to an object pointer
-
-  */
-
-  ret = curl_easy_perform(hnd);
-
-  curl_easy_cleanup(hnd);
-  hnd = NULL;
-
-  return (int)ret;
-}
-/**** End of sample code ****/
+%includetext %SRCDIR/data/data%TESTNUMBER.c%
 </file>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1404 b/third-party/curl/tests/data/test1404
index d686254ff4..d1a1d5217c 100644
--- a/third-party/curl/tests/data/test1404
+++ b/third-party/curl/tests/data/test1404
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Based on test 1315
 <info>
@@ -25,18 +26,22 @@ Connection: close
 <client>
 <features>
 Mime
+--libcurl
 </features>
 <server>
 http
 </server>
- <name>
---libcurl for HTTP RFC1867-type formposting - -F with 3 files, one with explicit type & encoder
- </name>
+<name>
+--libcurl plus -F with 3 files, one with explicit type and encoder
+</name>
 <setenv>
-SSL_CERT_FILE=
+SSL_CERT_FILE
 </setenv>
- <command>
-http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -F name=value -F 'file=@%LOGDIR/test%TESTNUMBER.txt,%LOGDIR/test%TESTNUMBER.txt;type=magic/content;encoder=8bit,%LOGDIR/test%TESTNUMBER.txt;headers=X-testheader-1: header 1;headers=X-testheader-2: header 2' --libcurl %LOGDIR/test%TESTNUMBER.c
+<command>
+http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER
+-F name=value
+-F 'file=@%LOGDIR/test%TESTNUMBER.txt,%LOGDIR/test%TESTNUMBER.txt;type=magic/content;encoder=8bit,%LOGDIR/test%TESTNUMBER.txt;headers=X-testheader-1: header 1;headers=X-testheader-2: header 2'
+--libcurl %LOGDIR/test%TESTNUMBER.c
 </command>
 # We create this file before the command is invoked!
 <file name="%LOGDIR/test%TESTNUMBER.txt">
@@ -50,144 +55,59 @@ dummy data
 -----+\w+
 </strip>
 <protocol>
-POST /we/want/%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Content-Length: 882
-Content-Type: multipart/form-data; boundary=----------------------------9ef8d6205763
-
-------------------------------9ef8d6205763
-Content-Disposition: form-data; name="name"
-
-value
-------------------------------9ef8d6205763
-Content-Disposition: form-data; name="file"
-Content-Type: multipart/mixed; boundary=----------------------------aaaaaaaaaaaa
-
-Content-Disposition: attachment; filename="test%TESTNUMBER.txt"
-Content-Type: text/plain
-
+POST /we/want/%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Content-Length: 930%CR
+Content-Type: multipart/form-data; boundary=----------------------------9ef8d6205763%CR
+%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: form-data; name="name"%CR
+%CR
+value%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: form-data; name="file"%CR
+Content-Type: multipart/mixed; boundary=----------------------------aaaaaaaaaaaa%CR
+%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER.txt"%CR
+Content-Type: text/plain%CR
+%CR
 dummy data
-
-------------------------------9ef8d6205763
-Content-Disposition: attachment; filename="test%TESTNUMBER.txt"
-Content-Type: magic/content
-Content-Transfer-Encoding: 8bit
-
+%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER.txt"%CR
+Content-Type: magic/content%CR
+Content-Transfer-Encoding: 8bit%CR
+%CR
 dummy data
-
-------------------------------9ef8d6205763
-Content-Disposition: attachment; filename="test%TESTNUMBER.txt"
-Content-Type: text/plain
-X-testheader-1: header 1
-X-testheader-2: header 2
-
+%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER.txt"%CR
+Content-Type: text/plain%CR
+X-testheader-1: header 1%CR
+X-testheader-2: header 2%CR
+%CR
 dummy data
-
-------------------------------aaaaaaaaaaaa--
-
-------------------------------9ef8d6205763--
+%CR
+------------------------------aaaaaaaaaaaa--%CR
+%CR
+------------------------------9ef8d6205763--%CR
 </protocol>
 <stripfile>
-# curl's default user-agent varies with version, libraries etc.
-s/(USERAGENT, \")[^\"]+/${1}stripped/
 # CURLOPT_SSL_VERIFYPEER, SSH_KNOWNHOSTS and HTTP_VERSION vary with
-# configurations - just ignore them
+# configurations - ignore them
 $_ = '' if /CURLOPT_SSL_VERIFYPEER/
 $_ = '' if /CURLOPT_SSH_KNOWNHOSTS/
 $_ = '' if /CURLOPT_HTTP_VERSION/
 $_ = '' if /CURLOPT_INTERLEAVEDATA/
+$_ = '' if /CURLOPT_SSLVERSION/
+$_ = '' if /CURLOPT_TIMEOUT_MS/
 # CURL_DOES_CONVERSION generates an extra comment.
 $_ = '' if /\/\* "value" \*\//
 </stripfile>
 <file name="%LOGDIR/test%TESTNUMBER.c" mode="text">
-/********* Sample code generated by the curl command line tool **********
- * All curl_easy_setopt() options are documented at:
- * https://curl.se/libcurl/c/curl_easy_setopt.html
- ************************************************************************/
-#include <curl/curl.h>
-
-int main(int argc, char *argv[])
-{
-  CURLcode ret;
-  CURL *hnd;
-  curl_mime *mime1;
-  curl_mimepart *part1;
-  curl_mime *mime2;
-  curl_mimepart *part2;
-  struct curl_slist *slist1;
-
-  mime1 = NULL;
-  mime2 = NULL;
-  slist1 = NULL;
-  slist1 = curl_slist_append(slist1, "X-testheader-1: header 1");
-  slist1 = curl_slist_append(slist1, "X-testheader-2: header 2");
-
-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
-  mime1 = curl_mime_init(hnd);
-  part1 = curl_mime_addpart(mime1);
-  curl_mime_data(part1, "value", CURL_ZERO_TERMINATED);
-  curl_mime_name(part1, "name");
-  part1 = curl_mime_addpart(mime1);
-  mime2 = curl_mime_init(hnd);
-  part2 = curl_mime_addpart(mime2);
-  curl_mime_filedata(part2, "%LOGDIR/test%TESTNUMBER.txt");
-  part2 = curl_mime_addpart(mime2);
-  curl_mime_filedata(part2, "%LOGDIR/test%TESTNUMBER.txt");
-  curl_mime_encoder(part2, "8bit");
-  curl_mime_type(part2, "magic/content");
-  part2 = curl_mime_addpart(mime2);
-  curl_mime_filedata(part2, "%LOGDIR/test%TESTNUMBER.txt");
-  curl_mime_headers(part2, slist1, 1);
-  slist1 = NULL;
-  curl_mime_subparts(part1, mime2);
-  mime2 = NULL;
-  curl_mime_name(part1, "file");
-  curl_easy_setopt(hnd, CURLOPT_MIMEPOST, mime1);
-  curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
-  curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-%if ftp
-  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
-%endif
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
-
-  /* Here is a list of options the curl code used that cannot get generated
-     as source easily. You may choose to either not use them or implement
-     them yourself.
-
-  CURLOPT_WRITEDATA was set to an object pointer
-  CURLOPT_WRITEFUNCTION was set to a function pointer
-  CURLOPT_READDATA was set to an object pointer
-  CURLOPT_READFUNCTION was set to a function pointer
-  CURLOPT_SEEKDATA was set to an object pointer
-  CURLOPT_SEEKFUNCTION was set to a function pointer
-  CURLOPT_ERRORBUFFER was set to an object pointer
-  CURLOPT_STDERR was set to an object pointer
-  CURLOPT_DEBUGFUNCTION was set to a function pointer
-  CURLOPT_DEBUGDATA was set to an object pointer
-  CURLOPT_HEADERFUNCTION was set to a function pointer
-  CURLOPT_HEADERDATA was set to an object pointer
-
-  */
-
-  ret = curl_easy_perform(hnd);
-
-  curl_easy_cleanup(hnd);
-  hnd = NULL;
-  curl_mime_free(mime1);
-  mime1 = NULL;
-  curl_mime_free(mime2);
-  mime2 = NULL;
-  curl_slist_free_all(slist1);
-  slist1 = NULL;
-
-  return (int)ret;
-}
-/**** End of sample code ****/
+%includetext %SRCDIR/data/data%TESTNUMBER.c%
 </file>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1405 b/third-party/curl/tests/data/test1405
index 03bd8e9cf2..611dbf720f 100644
--- a/third-party/curl/tests/data/test1405
+++ b/third-party/curl/tests/data/test1405
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Derived from test227
 <info>
@@ -26,23 +27,26 @@ REPLY FAIL 500 this might not be a failure!
 
 # Client-side
 <client>
+<features>
+--libcurl
+</features>
 <server>
 ftp
 </server>
- <name>
+<name>
 --libcurl for FTP with quote ops
- </name>
+</name>
 <setenv>
-SSL_CERT_FILE=
+SSL_CERT_FILE
 </setenv>
- <command>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -Q "NOOP 1" -Q "+NOOP 2" -Q "-NOOP 3" -Q "*FAIL" -Q "+*FAIL HARD" --libcurl %LOGDIR/test%TESTNUMBER.c
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -58,87 +62,24 @@ RETR %TESTNUMBER
 NOOP 3
 QUIT
 </protocol>
-<file name="%LOGDIR/test%TESTNUMBER.c" mode="text">
-/********* Sample code generated by the curl command line tool **********
- * All curl_easy_setopt() options are documented at:
- * https://curl.se/libcurl/c/curl_easy_setopt.html
- ************************************************************************/
-#include <curl/curl.h>
-
-int main(int argc, char *argv[])
-{
-  CURLcode ret;
-  CURL *hnd;
-  struct curl_slist *slist1;
-  struct curl_slist *slist2;
-  struct curl_slist *slist3;
-
-  slist1 = NULL;
-  slist1 = curl_slist_append(slist1, "NOOP 1");
-  slist1 = curl_slist_append(slist1, "*FAIL");
-  slist2 = NULL;
-  slist2 = curl_slist_append(slist2, "NOOP 3");
-  slist3 = NULL;
-  slist3 = curl_slist_append(slist3, "NOOP 2");
-  slist3 = curl_slist_append(slist3, "*FAIL HARD");
-
-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "ftp://%HOSTIP:%FTPPORT/%TESTNUMBER");
-  curl_easy_setopt(hnd, CURLOPT_QUOTE, slist1);
-  curl_easy_setopt(hnd, CURLOPT_POSTQUOTE, slist2);
-  curl_easy_setopt(hnd, CURLOPT_PREQUOTE, slist3);
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
-
-  /* Here is a list of options the curl code used that cannot get generated
-     as source easily. You may choose to either not use them or implement
-     them yourself.
-
-  CURLOPT_WRITEDATA was set to an object pointer
-  CURLOPT_WRITEFUNCTION was set to a function pointer
-  CURLOPT_READDATA was set to an object pointer
-  CURLOPT_READFUNCTION was set to a function pointer
-  CURLOPT_SEEKDATA was set to an object pointer
-  CURLOPT_SEEKFUNCTION was set to a function pointer
-  CURLOPT_ERRORBUFFER was set to an object pointer
-  CURLOPT_STDERR was set to an object pointer
-  CURLOPT_DEBUGFUNCTION was set to a function pointer
-  CURLOPT_DEBUGDATA was set to an object pointer
-  CURLOPT_HEADERFUNCTION was set to a function pointer
-  CURLOPT_HEADERDATA was set to an object pointer
-
-  */
-
-  ret = curl_easy_perform(hnd);
-
-  curl_easy_cleanup(hnd);
-  hnd = NULL;
-  curl_slist_free_all(slist1);
-  slist1 = NULL;
-  curl_slist_free_all(slist2);
-  slist2 = NULL;
-  curl_slist_free_all(slist3);
-  slist3 = NULL;
-
-  return (int)ret;
-}
-/**** End of sample code ****/
-</file>
 <stripfile>
 # CURLOPT_USERAGENT and CURLOPT_MAXREDIRS requires HTTP protocol
 # CURLOPT_INTERLEAVEDATA requires RTSP (HTTP) protocol
-# support, IOW depends on configuration - just ignore these.
+# support, IOW depends on configuration - ignore these.
 $_ = '' if /CURLOPT_USERAGENT/
 $_ = '' if /CURLOPT_MAXREDIRS/
 # CURLOPT_SSL_VERIFYPEER, SSH_KNOWNHOSTS and HTTP_VERSION vary with
-# configurations - just ignore them
+# configurations - ignore them
 $_ = '' if /CURLOPT_SSL_VERIFYPEER/
 $_ = '' if /CURLOPT_SSH_KNOWNHOSTS/
 $_ = '' if /CURLOPT_HTTP_VERSION/
 $_ = '' if /CURLOPT_HTTP09_ALLOWED/
 $_ = '' if /CURLOPT_INTERLEAVEDATA/
+$_ = '' if /CURLOPT_SSLVERSION/
+$_ = '' if /CURLOPT_TIMEOUT_MS/
 </stripfile>
+<file name="%LOGDIR/test%TESTNUMBER.c" mode="text">
+%includetext %SRCDIR/data/data%TESTNUMBER.c%
+</file>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1406 b/third-party/curl/tests/data/test1406
index db592fb0a8..d7c4adcfa9 100644
--- a/third-party/curl/tests/data/test1406
+++ b/third-party/curl/tests/data/test1406
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Based on test900
 # N.B. --libcurl output not sufficient to deal with uploaded files.
@@ -8,7 +9,6 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -16,115 +16,64 @@ CAPA SIZE
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 --libcurl for SMTP
- </name>
+</name>
 <setenv>
-SSL_CERT_FILE=
+SSL_CERT_FILE
 </setenv>
-<file name="%LOGDIR/test%TESTNUMBER.eml">
+<file name="%LOGDIR/test%TESTNUMBER.eml" crlf="yes">
 From: different
 To: another
 
 body
 </file>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient.one@example.com --mail-rcpt recipient.two@example.com --mail-from sender@example.com -T %LOGDIR/test%TESTNUMBER.eml --libcurl %LOGDIR/test%TESTNUMBER.c
 </command>
+# Need ftp so the FTP options are written in the --libcurl template
+<features>
+ftp
+--libcurl
+</features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com> SIZE=38
-RCPT TO:<recipient.one@example.com>
-RCPT TO:<recipient.two@example.com>
+MAIL FROM:%LTsender@example.com%GT SIZE=38
+RCPT TO:%LTrecipient.one@example.com%GT
+RCPT TO:%LTrecipient.two@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
 body
 .
 </upload>
-<file name="%LOGDIR/test%TESTNUMBER.c" mode="text">
-/********* Sample code generated by the curl command line tool **********
- * All curl_easy_setopt() options are documented at:
- * https://curl.se/libcurl/c/curl_easy_setopt.html
- ************************************************************************/
-#include <curl/curl.h>
-
-int main(int argc, char *argv[])
-{
-  CURLcode ret;
-  CURL *hnd;
-  struct curl_slist *slist1;
-
-  slist1 = NULL;
-  slist1 = curl_slist_append(slist1, "recipient.one@example.com");
-  slist1 = curl_slist_append(slist1, "recipient.two@example.com");
-
-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER");
-  curl_easy_setopt(hnd, CURLOPT_UPLOAD, 1L);
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_MAIL_FROM, "sender@example.com");
-  curl_easy_setopt(hnd, CURLOPT_MAIL_RCPT, slist1);
-  curl_easy_setopt(hnd, CURLOPT_INFILESIZE_LARGE, (curl_off_t)38);
-
-  /* Here is a list of options the curl code used that cannot get generated
-     as source easily. You may choose to either not use them or implement
-     them yourself.
-
-  CURLOPT_WRITEDATA was set to an object pointer
-  CURLOPT_WRITEFUNCTION was set to a function pointer
-  CURLOPT_READDATA was set to an object pointer
-  CURLOPT_READFUNCTION was set to a function pointer
-  CURLOPT_SEEKDATA was set to an object pointer
-  CURLOPT_SEEKFUNCTION was set to a function pointer
-  CURLOPT_ERRORBUFFER was set to an object pointer
-  CURLOPT_STDERR was set to an object pointer
-  CURLOPT_DEBUGFUNCTION was set to a function pointer
-  CURLOPT_DEBUGDATA was set to an object pointer
-  CURLOPT_HEADERFUNCTION was set to a function pointer
-  CURLOPT_HEADERDATA was set to an object pointer
-
-  */
-
-  ret = curl_easy_perform(hnd);
-
-  curl_easy_cleanup(hnd);
-  hnd = NULL;
-  curl_slist_free_all(slist1);
-  slist1 = NULL;
-
-  return (int)ret;
-}
-/**** End of sample code ****/
-</file>
 <stripfile>
-# These options vary with configurations - just ignore them
+# These options vary with configurations - ignore them
 # CURLOPT_INTERLEAVEDATA requires RTSP (HTTP) protocol
-$_ = '' if /CURLOPT_USERAGENT/
 $_ = '' if /CURLOPT_MAXREDIRS/
 $_ = '' if /CURLOPT_SSL_VERIFYPEER/
 $_ = '' if /CURLOPT_SSH_KNOWNHOSTS/
 $_ = '' if /CURLOPT_HTTP_VERSION/
 $_ = '' if /CURLOPT_HTTP09_ALLOWED/
 $_ = '' if /CURLOPT_INTERLEAVEDATA/
+$_ = '' if /CURLOPT_SSLVERSION/
+$_ = '' if /CURLOPT_TIMEOUT_MS/
 </stripfile>
+<file name="%LOGDIR/test%TESTNUMBER.c" mode="text">
+%includetext %SRCDIR/data/data%TESTNUMBER.c%
+</file>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1407 b/third-party/curl/tests/data/test1407
index a240aee960..599eb1d3e4 100644
--- a/third-party/curl/tests/data/test1407
+++ b/third-party/curl/tests/data/test1407
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Based on test851
 <info>
@@ -9,7 +10,6 @@ LIST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -17,84 +17,39 @@ REPLY LIST +OK %TESTNUMBER 100\r\n.
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 --libcurl for POP3 LIST one message
- </name>
+</name>
 <setenv>
-SSL_CERT_FILE=
+SSL_CERT_FILE
 </setenv>
 <command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -l -u user:secret --libcurl %LOGDIR/test%TESTNUMBER.c
 </command>
+# Need ftp so the FTP options are written in the --libcurl template
+<features>
+ftp
+--libcurl
+</features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 USER user
 PASS secret
 LIST %TESTNUMBER
 QUIT
 </protocol>
-<file name="%LOGDIR/test%TESTNUMBER.c" mode="text">
-/********* Sample code generated by the curl command line tool **********
- * All curl_easy_setopt() options are documented at:
- * https://curl.se/libcurl/c/curl_easy_setopt.html
- ************************************************************************/
-#include <curl/curl.h>
-
-int main(int argc, char *argv[])
-{
-  CURLcode ret;
-  CURL *hnd;
-
-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "pop3://%HOSTIP:%POP3PORT/%TESTNUMBER");
-  curl_easy_setopt(hnd, CURLOPT_DIRLISTONLY, 1L);
-  curl_easy_setopt(hnd, CURLOPT_USERPWD, "user:secret");
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
-
-  /* Here is a list of options the curl code used that cannot get generated
-     as source easily. You may choose to either not use them or implement
-     them yourself.
-
-  CURLOPT_WRITEDATA was set to an object pointer
-  CURLOPT_WRITEFUNCTION was set to a function pointer
-  CURLOPT_READDATA was set to an object pointer
-  CURLOPT_READFUNCTION was set to a function pointer
-  CURLOPT_SEEKDATA was set to an object pointer
-  CURLOPT_SEEKFUNCTION was set to a function pointer
-  CURLOPT_ERRORBUFFER was set to an object pointer
-  CURLOPT_STDERR was set to an object pointer
-  CURLOPT_DEBUGFUNCTION was set to a function pointer
-  CURLOPT_DEBUGDATA was set to an object pointer
-  CURLOPT_HEADERFUNCTION was set to a function pointer
-  CURLOPT_HEADERDATA was set to an object pointer
-
-  */
-
-  ret = curl_easy_perform(hnd);
-
-  curl_easy_cleanup(hnd);
-  hnd = NULL;
-
-  return (int)ret;
-}
-/**** End of sample code ****/
-</file>
 <stripfile>
-# These options vary with configurations - just ignore them
+# These options vary with configurations - ignore them
+# CURLOPT_USERAGENT and CURLOPT_MAXREDIRS requires HTTP protocol
 # CURLOPT_INTERLEAVEDATA requires RTSP (HTTP) protocol
 $_ = '' if /CURLOPT_USERAGENT/
 $_ = '' if /CURLOPT_MAXREDIRS/
@@ -103,6 +58,11 @@ $_ = '' if /CURLOPT_SSH_KNOWNHOSTS/
 $_ = '' if /CURLOPT_HTTP_VERSION/
 $_ = '' if /CURLOPT_HTTP09_ALLOWED/
 $_ = '' if /CURLOPT_INTERLEAVEDATA/
+$_ = '' if /CURLOPT_SSLVERSION/
+$_ = '' if /CURLOPT_TIMEOUT_MS/
 </stripfile>
+<file name="%LOGDIR/test%TESTNUMBER.c" mode="text">
+%includetext %SRCDIR/data/data%TESTNUMBER.c%
+</file>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1408 b/third-party/curl/tests/data/test1408
index b06e06d018..0a70df1504 100644
--- a/third-party/curl/tests/data/test1408
+++ b/third-party/curl/tests/data/test1408
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ cookies
 cookiejar
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data1>
@@ -31,32 +31,28 @@ Set-Cookie: time=2
 
 -foo-
 </data2>
-
-
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 cookies
-ipv6
+IPv6
 </features>
 <server>
 http-ipv6
 </server>
- <name>
+<name>
 HTTP receive cookies over IPV6
- </name>
- <command>
+</name>
+<command>
 -c %LOGDIR/jar%TESTNUMBER -g http://%HOST6IP:%HTTP6PORT/path/%TESTNUMBER0001 http://%HOST6IP:%HTTP6PORT/path/%TESTNUMBER0002
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /path/%TESTNUMBER0001 HTTP/1.1
 Host: %HOST6IP:%HTTP6PORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1409 b/third-party/curl/tests/data/test1409
index 120bf3cf39..50d00e44d7 100644
--- a/third-party/curl/tests/data/test1409
+++ b/third-party/curl/tests/data/test1409
@@ -1,27 +1,21 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 cmdline
-FAILURE
 </keywords>
 </info>
 
-
-#
 # Client-side
 <client>
-<server>
-none
-</server>
- <name>
+<name>
 Pass in string to -C
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%NOLISTENPORT/%TESTNUMBER -C wrong
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test141 b/third-party/curl/tests/data/test141
index 1eaed2425c..42af784079 100644
--- a/third-party/curl/tests/data/test141
+++ b/third-party/curl/tests/data/test141
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -22,17 +23,17 @@ NOBODY
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download info with -I
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/blalbla/%TESTNUMBER -I
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -43,7 +44,7 @@ SIZE %TESTNUMBER
 REST 0
 QUIT
 </protocol>
-<stdout>
+<stdout crlf="headers">
 Last-Modified: Wed, 09 Apr 2003 10:26:59 GMT
 Content-Length: 42
 Accept-ranges: bytes
diff --git a/third-party/curl/tests/data/test1410 b/third-party/curl/tests/data/test1410
index 65e52d4065..e5d8660e78 100644
--- a/third-party/curl/tests/data/test1410
+++ b/third-party/curl/tests/data/test1410
@@ -1,27 +1,21 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 cmdline
-FAILURE
 </keywords>
 </info>
 
-
-#
 # Client-side
 <client>
-<server>
-none
-</server>
- <name>
+<name>
 Pass in negative number to --max-time
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%NOLISTENPORT/%TESTNUMBER --max-time -4
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test1411 b/third-party/curl/tests/data/test1411
index 7e2d0df4f7..e4b6b1d2f2 100644
--- a/third-party/curl/tests/data/test1411
+++ b/third-party/curl/tests/data/test1411
@@ -1,8 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
-PUT
+HTTP PUT
 </keywords>
 </info>
 
@@ -23,19 +24,17 @@ Funny-head: yesyes
 </data>
 </reply>
 
-
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 
-# make sure there's no Expect: 100-continue when there's no file to send!
- <name>
+# make sure there is no Expect: 100-continue when there is no file to send!
+<name>
 HTTP with zero size file PUT
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -T %LOGDIR/empty%TESTNUMBER
 </command>
 # create an empty file
@@ -43,10 +42,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -T %LOGDIR/empty%TESTNUMBER
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1412 b/third-party/curl/tests/data/test1412
index 35800b8cdf..ba9165d9f3 100644
--- a/third-party/curl/tests/data/test1412
+++ b/third-party/curl/tests/data/test1412
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -13,7 +14,7 @@ HTTP Digest auth
 <servercmd>
 auth_required
 </servercmd>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -25,8 +26,8 @@ Connection: close
 This is not the real page
 </data>
 
-# The second URL will get this response
-<data1>
+# The second URL gets this response
+<data1 crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -40,7 +41,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -51,7 +52,7 @@ This IS the real page!
 </data1000>
 
 # This is the second request
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -61,7 +62,7 @@ Connection: close
 This IS the second real page!
 </data1001>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -89,18 +90,19 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP GET with --anyauth with two URLs (picking Digest)
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --anyauth http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1413 b/third-party/curl/tests/data/test1413
index 4174bec3cd..9ef08c67e3 100644
--- a/third-party/curl/tests/data/test1413
+++ b/third-party/curl/tests/data/test1413
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,16 @@ HTTP GET
 followlocation
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 302 OK swsclose
 Location: moo.html/%TESTNUMBER0002#fragmentpart
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
 
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Location: this should be ignored
 Date: Tue, 09 Nov 2010 14:49:00 GMT
@@ -24,7 +24,7 @@ Connection: close
 
 body
 </data2>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 302 OK swsclose
 Location: moo.html/%TESTNUMBER0002#fragmentpart
 Date: Tue, 09 Nov 2010 14:49:00 GMT
@@ -39,24 +39,22 @@ body
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP redirect with fragment in new URL
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/this/%TESTNUMBER -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /this/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1414 b/third-party/curl/tests/data/test1414
index 33115eae48..ffd301319a 100644
--- a/third-party/curl/tests/data/test1414
+++ b/third-party/curl/tests/data/test1414
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -28,10 +29,10 @@ REPLY EPRT 502 no such command
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP PORT without SIZE or EPRT support
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -P -
 </command>
 </client>
@@ -39,10 +40,10 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -P -
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^(EPRT \|1\|)(.*)/$1/
-s/^(PORT)(.*)/$1/
+s/^(EPRT \|1\|)(\S*)/$1/
+s/^(PORT) *(\S*)/$1/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1415 b/third-party/curl/tests/data/test1415
index f81e97fe8a..ea037d768d 100644
--- a/third-party/curl/tests/data/test1415
+++ b/third-party/curl/tests/data/test1415
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -64,7 +65,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://example.com/we/want/%TESTNUMBER HTTP/1.1
 Host: example.com
 User-Agent: curl/%VERSION
@@ -78,15 +79,9 @@ Proxy-Connection: Keep-Alive
 # https://curl.se/docs/http-cookies.html
 # This file was generated by libcurl! Edit at your own risk.
 
-%if large-time
-.example.com	TRUE	/	FALSE	17545593600	test7value	test7
-.example.com	TRUE	/	FALSE	17545593600	test4value	test4
-.example.com	TRUE	/	FALSE	17545593600	test2value	test2
-%else
-.example.com	TRUE	/	FALSE	2145830400	test7value	test7
-.example.com	TRUE	/	FALSE	2145830400	test4value	test4
-.example.com	TRUE	/	FALSE	2145830400	test2value	test2
-%endif
+.example.com	TRUE	/	FALSE	%days[400]	test7value	test7
+.example.com	TRUE	/	FALSE	%days[400]	test4value	test4
+.example.com	TRUE	/	FALSE	%days[400]	test2value	test2
 .example.com	TRUE	/	FALSE	0	test1value	test1
 </file>
 </verify>
diff --git a/third-party/curl/tests/data/test1416 b/third-party/curl/tests/data/test1416
index 669c9ff022..eb3873aac0 100644
--- a/third-party/curl/tests/data/test1416
+++ b/third-party/curl/tests/data/test1416
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 chunked Transfer-Encoding
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -15,36 +15,34 @@ Server: fakeit/0.9 fakeitbad/1.0
 Transfer-Encoding: chunked
 Connection: mooo
 
-12345678123456789
-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-30
-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
-21;heresatest=moooo
+12345678123456789%CR
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%CR
+30%CR
+bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%CR
+21;heresatest=moooo%CR
 cccccccccccccccccccccccccccccccc
-
-0
-
+%CR
+0%CR
+%CR
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with chunked Transfer-Encoding overflowed chunked size
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1417 b/third-party/curl/tests/data/test1417
index 89fd6b18fb..f52c5637cf 100644
--- a/third-party/curl/tests/data/test1417
+++ b/third-party/curl/tests/data/test1417
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,16 +7,15 @@ HTTP GET
 chunked Transfer-Encoding
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
-HTTP/1.1 200 funky chunky!
-Server: fakeit/0.9 fakeitbad/1.0
-Transfer-Encoding: chunked
-Trailer: chunky-trailer
-Connection: mooo
-
+HTTP/1.1 200 funky chunky!%CR
+Server: fakeit/0.9 fakeitbad/1.0%CR
+Transfer-Encoding: chunked%CR
+Trailer: chunky-trailer%CR
+Connection: mooo%CR
+%CR
 40
 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
 30
@@ -28,42 +28,40 @@ chunky-trailer: header data
 
 </data>
 <datacheck>
-HTTP/1.1 200 funky chunky!
-Server: fakeit/0.9 fakeitbad/1.0
-Transfer-Encoding: chunked
-Trailer: chunky-trailer
-Connection: mooo
-
+HTTP/1.1 200 funky chunky!%CR
+Server: fakeit/0.9 fakeitbad/1.0%CR
+Transfer-Encoding: chunked%CR
+Trailer: chunky-trailer%CR
+Connection: mooo%CR
+%CR
 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbcccccccccccccccccccccccccccccccc
-chunky-trailer: header data
+chunky-trailer: header data%CR
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with chunked encoding and chunked trailer without CRs
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -D %LOGDIR/heads%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<file name="%LOGDIR/heads%TESTNUMBER">
+<file name="%LOGDIR/heads%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 funky chunky!
 Server: fakeit/0.9 fakeitbad/1.0
 Transfer-Encoding: chunked
diff --git a/third-party/curl/tests/data/test1418 b/third-party/curl/tests/data/test1418
index 14492a6b9a..a3c6b8c249 100644
--- a/third-party/curl/tests/data/test1418
+++ b/third-party/curl/tests/data/test1418
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -13,7 +14,7 @@ connection reuse
 connection-monitor
 </servercmd>
 
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authentication please!
 Content-Length: 20
 WWW-Authenticate: Digest realm="loonie", nonce="314156592"
@@ -22,7 +23,7 @@ WWW-Authenticate: Basic
 Please auth with me
 </data>
 
-<data3>
+<data3 crlf="headers">
 HTTP/1.1 401 Authentication please!
 Content-Length: 20
 WWW-Authenticate: Digest realm="loonie", nonce="314156592"
@@ -33,7 +34,7 @@ Please auth with me
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 Things are fine in server land
 Server: Microsoft-IIS/5.0
 Content-Length: 4
@@ -41,7 +42,7 @@ Content-Length: 4
 moo
 </data1000>
 
-<data1003>
+<data1003 crlf="headers">
 HTTP/1.1 200 OK
 Server: Another one/1.0
 Content-Length: 4
@@ -50,7 +51,7 @@ boo
 </data1003>
 
 # This is the first reply after the redirection
-<data1011>
+<data1011 crlf="headers">
 HTTP/1.1 200 OK
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -59,7 +60,7 @@ Content-Length: 34
 This is not the real page either!
 </data1011>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authentication please!
 Content-Length: 20
 WWW-Authenticate: Digest realm="loonie", nonce="314156592"
@@ -82,18 +83,19 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP with --anyauth and connection reuse
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --anyauth http://%HOSTIP:%HTTPPORT/%TESTNUMBER0003
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1419 b/third-party/curl/tests/data/test1419
index f3b4c9baba..70d3b594a2 100644
--- a/third-party/curl/tests/data/test1419
+++ b/third-party/curl/tests/data/test1419
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -13,14 +14,14 @@ connection reuse
 connection-monitor
 </servercmd>
 
-<data>
+<data crlf="headers">
 HTTP/1.1 200 fine!
 Content-Length: 20
 
 Feel free to get it
 </data>
 
-<data3>
+<data3 crlf="headers">
 HTTP/1.1 200 OK
 Server: Another one/1.0
 Content-Length: 4
@@ -28,7 +29,7 @@ Content-Length: 4
 boo
 </data3>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 fine!
 Content-Length: 20
 
@@ -41,17 +42,17 @@ Feel free to get it
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with --anyauth (but no auth!) and connection reuse
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --anyauth http://%HOSTIP:%HTTPPORT/%TESTNUMBER0003
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test142 b/third-party/curl/tests/data/test142
index ebca8bd5ff..a7b85b1b5f 100644
--- a/third-party/curl/tests/data/test142
+++ b/third-party/curl/tests/data/test142
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -16,17 +17,17 @@ many parts there are
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP URL with 150 dir levels
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/part1/part2/part3/part4/part5/part6/part7/part8/part9/part10/part11/part12/part13/part14/part15/part16/part17/part18/part19/part20/part21/part22/part23/part24/part25/part26/part27/part28/part29/part30/part31/part32/part33/part34/part35/part36/part37/part38/part39/part40/part41/part42/part43/part44/part45/part46/part47/part48/part49/part50/part51/part52/part53/part54/part55/part56/part57/part58/part59/part60/part61/part62/part63/part64/part65/part66/part67/part68/part69/part70/part71/part72/part73/part74/part75/part76/part77/part78/part79/part80/part81/part82/part83/part84/part85/part86/part87/part88/part89/part90/part91/part92/part93/part94/part95/part96/part97/part98/part99/part100/part101/part102/part103/part104/part105/part106/part107/part108/part109/part110/part111/part112/part113/part114/part115/part116/part117/part118/part119/part120/part121/part122/part123/part124/part125/part126/part127/part128/part129/part130/part131/part132/part133/part134/part135/part136/part137/part138/part139/part140/part141/part142/part143/part144/part145/part146/part147/part148/part149/part150/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -186,5 +187,9 @@ SIZE %TESTNUMBER
 RETR %TESTNUMBER
 QUIT
 </protocol>
+<limits>
+Allocations: 180
+Maximum allocated: 150000
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1420 b/third-party/curl/tests/data/test1420
index 98fa254c2e..cdf51cd0cf 100644
--- a/third-party/curl/tests/data/test1420
+++ b/third-party/curl/tests/data/test1420
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Based on test800
 <info>
@@ -9,10 +10,9 @@ FETCH
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -23,90 +23,49 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 --libcurl for IMAP FETCH message
- </name>
+</name>
 <setenv>
-SSL_CERT_FILE=
+SSL_CERT_FILE
 </setenv>
 <command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user:secret --libcurl %LOGDIR/test%TESTNUMBER.c
 </command>
+# Need ftp so the FTP options are written in the --libcurl template
+<features>
+ftp
+--libcurl
+</features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 SELECT %TESTNUMBER
 A004 FETCH 1 BODY[]
 A005 LOGOUT
 </protocol>
-<file name="%LOGDIR/test%TESTNUMBER.c" mode="text">
-/********* Sample code generated by the curl command line tool **********
- * All curl_easy_setopt() options are documented at:
- * https://curl.se/libcurl/c/curl_easy_setopt.html
- ************************************************************************/
-#include <curl/curl.h>
-
-int main(int argc, char *argv[])
-{
-  CURLcode ret;
-  CURL *hnd;
-
-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1");
-  curl_easy_setopt(hnd, CURLOPT_USERPWD, "user:secret");
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
-
-  /* Here is a list of options the curl code used that cannot get generated
-     as source easily. You may choose to either not use them or implement
-     them yourself.
-
-  CURLOPT_WRITEDATA was set to an object pointer
-  CURLOPT_WRITEFUNCTION was set to a function pointer
-  CURLOPT_READDATA was set to an object pointer
-  CURLOPT_READFUNCTION was set to a function pointer
-  CURLOPT_SEEKDATA was set to an object pointer
-  CURLOPT_SEEKFUNCTION was set to a function pointer
-  CURLOPT_ERRORBUFFER was set to an object pointer
-  CURLOPT_STDERR was set to an object pointer
-  CURLOPT_DEBUGFUNCTION was set to a function pointer
-  CURLOPT_DEBUGDATA was set to an object pointer
-  CURLOPT_HEADERFUNCTION was set to a function pointer
-  CURLOPT_HEADERDATA was set to an object pointer
-
-  */
-
-  ret = curl_easy_perform(hnd);
-
-  curl_easy_cleanup(hnd);
-  hnd = NULL;
-
-  return (int)ret;
-}
-/**** End of sample code ****/
-</file>
 <stripfile>
-# These options vary with configurations - just ignore them
+# These options vary with configurations - ignore them
 # CURLOPT_INTERLEAVEDATA requires RTSP (HTTP) protocol
-$_ = '' if /CURLOPT_USERAGENT/
 $_ = '' if /CURLOPT_MAXREDIRS/
 $_ = '' if /CURLOPT_SSL_VERIFYPEER/
 $_ = '' if /CURLOPT_SSH_KNOWNHOSTS/
 $_ = '' if /CURLOPT_HTTP_VERSION/
 $_ = '' if /CURLOPT_INTERLEAVEDATA/
+$_ = '' if /CURLOPT_SSLVERSION/
+$_ = '' if /CURLOPT_TIMEOUT_MS/
 </stripfile>
+<file name="%LOGDIR/test%TESTNUMBER.c" mode="text">
+%includetext %SRCDIR/data/data%TESTNUMBER.c%
+</file>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1421 b/third-party/curl/tests/data/test1421
index ff75baca8a..85e88e0f09 100644
--- a/third-party/curl/tests/data/test1421
+++ b/third-party/curl/tests/data/test1421
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP proxy
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -23,16 +23,15 @@ connection-monitor
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
-Re-using HTTP proxy connection for two different host names
- </name>
- <command>
+<name>
+Reusing HTTP proxy connection for two different hostnames
+</name>
+<command>
 --proxy http://%HOSTIP:%HTTPPORT http://test.remote.haxx.se.%TESTNUMBER:8990/ http://different.remote.haxx.se.%TESTNUMBER:8990
 </command>
 <features>
@@ -40,7 +39,6 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <stdout>
@@ -55,7 +53,7 @@ Content-Length: 6
 
 -foo-
 </stdout>
-<protocol>
+<protocol crlf="headers">
 GET http://test.remote.haxx.se.%TESTNUMBER:8990/ HTTP/1.1
 Host: test.remote.haxx.se.%TESTNUMBER:8990
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1422 b/third-party/curl/tests/data/test1422
index 72cee0fdc9..b7f856c13e 100644
--- a/third-party/curl/tests/data/test1422
+++ b/third-party/curl/tests/data/test1422
@@ -1,15 +1,16 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
+FILE
 HTTP GET
 -J
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,13 +22,9 @@ Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=str//nge
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -O and -J output in, using the CURL_TESTDIR variable
 <features>
-debug
 file
 </features>
 <server>
@@ -36,18 +33,14 @@ http
 <name>
 HTTP GET with -O -J and Content-Disposition (empty file)
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -O file://%PWD/%LOGDIR/name%TESTNUMBER
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -O file://%FILE_PWD/%LOGDIR/name%TESTNUMBER --output-dir %LOGDIR
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1423 b/third-party/curl/tests/data/test1423
index 49ae4bdf7e..b42d369d7c 100644
--- a/third-party/curl/tests/data/test1423
+++ b/third-party/curl/tests/data/test1423
@@ -1,14 +1,15 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
+FILE
 HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -19,7 +20,6 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -30,17 +30,13 @@ file
 HTTP GET -o fname without Content-Disposition (empty file)
 </name>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -o %LOGDIR/outfile%TESTNUMBER file://%PWD/%LOGDIR/outfile%TESTNUMBER
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -o %LOGDIR/outfile%TESTNUMBER file://%FILE_PWD/%LOGDIR/outfile%TESTNUMBER
 </command>
-<postcheck>
-perl %SRCDIR/libtest/notexists.pl %LOGDIR/%TESTNUMBER
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -51,5 +47,8 @@ Accept: */*
 <file1 name="%LOGDIR/outfile%TESTNUMBER">
 </file1>
 
+<notexists>
+%LOGDIR/%TESTNUMBER
+</notexists>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1424 b/third-party/curl/tests/data/test1424
index eca6478bb2..147511716a 100644
--- a/third-party/curl/tests/data/test1424
+++ b/third-party/curl/tests/data/test1424
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ If-Modified-Since
 -z
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -37,7 +37,6 @@ Funny-head: yesyes
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -54,10 +53,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -z "dec 12 11:00:00 1999 GMT" -o %LOGDIR/ou
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1425 b/third-party/curl/tests/data/test1425
index 2bd6d84379aab247fb674921723e47f8488924fc..915ea58870b8b7051d715d42acbf5e896c54437e 100644
GIT binary patch
delta 222
zcmX@kJAq5f#=asqN1-gWs5mn}&sND$&p=5bH7_|oB{MJGRw*=C*D=`H(^JXbj%$LS
zP)cG+qC#GNaz<)$wyjcSYO&H}f7V|rsu`&j(W(Xpu|QhY(8$<?%SIoh)Q$_tC`v8J
zskGyooXYIY=rVaDvn`N(&ulVTg++tIMn5kxHx(!u#^N@49*Z5nLUK_~nypesYGMk|
zMM{(Jut-aAdE^(DSShG__y>o023V<jgoFeH_y>hd7G#y;<#J3;PAvdRYw2roZMJ5$
NWn>0AaB>x!F965hLJj}`

delta 662
zcmX|9%Wl&^6eTGeMvBA|mCdNA0=l5KDG{xb2sch#H?f_E?IadbWqSrYwliZnZc=-b
z1v^$$miPwtd;$ypf$w0&ig8=9m@D0L&YU@#d%uETjoTybNs68L3OSi``{nQM5ih(w
z0j=ZzU<ZH~aFo)`5@7_LHFTXdZk|9)JX#?cg+9(;7GUTuiIe8Az$t}Gat~3I!;G0_
z7%`tDr3p^s{0%hHr57=(x=nD(c<9kI-C-|dG-y?M9-e9+<am7m3H1W(MfY6?O#2hl
z?7qJlhCN>m#jVmi9d@HhfMm0&^e4PM-TJB&`Nry0P$Xrm8ltZn<EAD>O;r;83CEk=
zSc^Sk$G{7zk7TPryDneY^Gm^=D;s;&PwjD{F6J6HH2IA!$17)MMf&pGL^E@(NWDVo
zCA_;7bLO~ZeXfVSEzs}cAk7k!z9sjGUI`2_*QR{5D7;K9B2EhxPB;9)c&3H+{G1zF
zmw~%NyVxtJzaTMZ&(*<LIK2ie*EQ<$sy%y0knA@V$-E=nl@%g6-ncCLLb%y@!ae?=
zH}U*DW>J|@zzv0fb7$KDm=NpQB~j+cR$xoi$1|&_PS>ZRYAD4sO{8r${_6WXcWaQu
zd9?!N_u8O_%0IO>t3v&x2Fp+NR{*w-iL=5T0LyRne)+rpp?tmfe7^xM=sG)thZp+P
sP)28m7ltt!=@X+-e%#xC+5n>G;e-i}j*l9k@#FJeyH+PJ%b$<cf6B4fOaK4?

diff --git a/third-party/curl/tests/data/test1426 b/third-party/curl/tests/data/test1426
index 9ed994a56afc1e0e033f9d796f0ed219c7e8e875..02669a06a0b84041b40b5016cc685e1ec49596d8 100644
GIT binary patch
delta 228
zcmeC+y~C+xV_%V*qfnMwRGgWgXRBnWXP~5znwOlPl9`uos}vfn>lp0p>8WII$2Gx^
zCnd2YQ6VosIU_YWdvOvgql#)qYDKiFfk7;gRy8y-HsP|-2Pv}S0y2tH3vw#$xF)AE
zdo#LB-pFhVB;PZeOjco0<FL`sOUz9LN`|lmPF~Jpr=^fwl#^zwl#!a40(6U#9hbXn
zh=RUqh-+|&U#PE>YmkCRNJxObp`PJnMplW*Qmj(ET#m`fsRbog3R?PFT$^23<rsNU
K+%q|uO%(ur&OufH

delta 687
zcmX|9F>ljA6ecN4Ps-i_p;J*AifC+8B8u7wCw7dR*l8TwNxUHY?yzG!wsmom+Dldj
z7G!<|BN79DhK;|##KgI+816~$``&%;(|hmN;iuM@Q~i(<H~xU#+^xPJ{M|p|g;(d`
zvi%?J0`Lsp&~&@R1VeWXJ$Fqy=a3{Qt&u#1KFMJo5a=xvmlm)jG=<CL9!hZmb0(G(
z%ycrEW`xGY88qn<MU1L{CxkK{qLk7-K{=zrWo_u8)zxu9*2geOQ9w|1pLM}>U|3fF
z&Fv_ZeJvDss(dl(M@E1ZtD_DK-kI)vO^SSTbs?ydy3<V2*UU*rm!gg)iN3+{RzKEb
zlsGX!Vd`VWF7dw4m(KiJaOUdPSq-Q&$+X2>=SCL4b(DDJ&g^Ks>{)nbtyM`bRXO9m
zrC2b<9m|VxDDS}d&JNaXF&o&*AQ{&Mrda4xK3bG0*UE^~LzNqw{%|tWLucOOM)q~!
zt?)iZW$G`Im~-aZa3Wl60Q0rMeO_~BuM@2J9aXaK2ybPFSc$hD^S%&nw@A3hAL=bK
z@5Rh26AHMI5OCgXHv~pvZ@eVRUBwO@DfP+BF6-C#Q&BV3@<<ocE4Kc6{N1}V$l{_t
zf$Cdh*ud4F#ubY~^SlA8kIm-*UbYi=MY;f1Uz?Nack|toE>L6>wogoXYU-BOlMVRZ
zG;iAc8Q-e3gQFKMV66##DYC`qZz0;yxP4;F##9~aEg&L9G6tWvPg|h%<MYAOM&nWS
H^YO_)05jee

diff --git a/third-party/curl/tests/data/test1427 b/third-party/curl/tests/data/test1427
index adce46a84c..4232d9bc7d 100644
--- a/third-party/curl/tests/data/test1427
+++ b/third-party/curl/tests/data/test1427
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,21 +6,16 @@ integer overflow
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
- <name>
+<name>
 too large -m timeout value
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%NOLISTENPORT/%TESTNUMBER -m 184467440737095510
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test1428 b/third-party/curl/tests/data/test1428
index 0617dc0091..858d2cd9f1 100644
--- a/third-party/curl/tests/data/test1428
+++ b/third-party/curl/tests/data/test1428
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ HTTP Basic auth
 proxytunnel
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -21,13 +21,13 @@ Content-Length: 9
 
 contents
 </data>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 
 </connect>
 <datacheck>
-HTTP/1.1 200 Mighty fine indeed
-
+HTTP/1.1 200 Mighty fine indeed%CR
+%CR
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -39,17 +39,16 @@ contents
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 http-proxy
 </server>
- <name>
+<name>
 HTTP over proxy-tunnel with --proxy-header and --header
- </name>
- <command>
+</name>
+<command>
 http://test.%TESTNUMBER:%HTTPPORT/we/want/that/page/%TESTNUMBER -p -x %HOSTIP:%PROXYPORT --user 'iam:my:;self' --header "header-type: server" --proxy-header "header-type: proxy"
 </command>
 <features>
@@ -57,10 +56,9 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 CONNECT test.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: test.%TESTNUMBER:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -68,10 +66,10 @@ Proxy-Connection: Keep-Alive
 header-type: proxy
 
 </proxy>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: test.%TESTNUMBER:%HTTPPORT
-Authorization: Basic aWFtOm15OjtzZWxm
+Authorization: Basic %b64[iam:my:;self]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 header-type: server
diff --git a/third-party/curl/tests/data/test1429 b/third-party/curl/tests/data/test1429
index 710c108a7b..b3fd906b96 100644
--- a/third-party/curl/tests/data/test1429
+++ b/third-party/curl/tests/data/test1429
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP/0.9
 </info>
 
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 999 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -24,7 +25,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -33,16 +33,15 @@ http
 
 <name>
 HTTP GET with 999 response code
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --write-out '%{response_code}'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<stdout nonewline="yes">
+<stdout crlf="headers" nonewline="yes">
 HTTP/1.1 999 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -57,7 +56,7 @@ Funny-head: yesyes
 -foo-
 999
 </stdout>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test143 b/third-party/curl/tests/data/test143
index 8e440d5400..fda25dc0ec 100644
--- a/third-party/curl/tests/data/test143
+++ b/third-party/curl/tests/data/test143
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -18,17 +19,17 @@ bla bla bla
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP URL with type=a
- </name>
- <command>
+</name>
+<command>
 "ftp://%HOSTIP:%FTPPORT/%2ftmp/moo/%TESTNUMBER;type=a"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1430 b/third-party/curl/tests/data/test1430
index 5a521a3cbe..2d1bbc795f 100644
--- a/third-party/curl/tests/data/test1430
+++ b/third-party/curl/tests/data/test1430
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,24 +24,22 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with negative response code
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1431 b/third-party/curl/tests/data/test1431
index 27e5c4f09d..1bd466d02c 100644
--- a/third-party/curl/tests/data/test1431
+++ b/third-party/curl/tests/data/test1431
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,24 +24,22 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with single-digit response code
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1432 b/third-party/curl/tests/data/test1432
index 824e9e5aa6..dfa6741560 100644
--- a/third-party/curl/tests/data/test1432
+++ b/third-party/curl/tests/data/test1432
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,7 +24,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -32,16 +32,15 @@ http
 
 <name>
 HTTP GET with 100-digit response code and survive
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1433 b/third-party/curl/tests/data/test1433
index 064782a886..9fc98a5519 100644
--- a/third-party/curl/tests/data/test1433
+++ b/third-party/curl/tests/data/test1433
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,7 +24,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -32,16 +32,15 @@ http
 
 <name>
 HTTP GET with 100-digit subversion number in response
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1434 b/third-party/curl/tests/data/test1434
index 6cf2a98f73..f1e3066127 100644
--- a/third-party/curl/tests/data/test1434
+++ b/third-party/curl/tests/data/test1434
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,11 +12,11 @@ Resume
 <reply>
 # Some servers (e.g. Apache 1.2) respond this way to an invalid byte range
 <data>
-HTTP/1.1 200 OK
-Connection: close
-Content-Length: 100
-Content-Type: text/plain
-
+HTTP/1.1 200 OK%CR
+Connection: close%CR
+Content-Length: 100%CR
+Content-Type: text/plain%CR
+%CR
 012345678
 012345678
 012345678
@@ -41,11 +42,11 @@ Content-Type: text/plain
 012345678
 012345678
 012345678
-HTTP/1.1 200 OK
-Connection: close
-Content-Length: 100
-Content-Type: text/plain
-
+HTTP/1.1 200 OK%CR
+Connection: close%CR
+Content-Length: 100%CR
+Content-Type: text/plain%CR
+%CR
 </datacheck>
 </reply>
 
@@ -54,10 +55,10 @@ Content-Type: text/plain
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET resume at exactly the existing file size is fine
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -C 100
 </command>
 <file name="%LOGDIR/curl%TESTNUMBER.out">
@@ -76,7 +77,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -C 100
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Range: bytes=100-
diff --git a/third-party/curl/tests/data/test1435 b/third-party/curl/tests/data/test1435
index 449b0b640f..dbc2d62bbd 100644
--- a/third-party/curl/tests/data/test1435
+++ b/third-party/curl/tests/data/test1435
@@ -1,9 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
-unix sockets
+UnixSockets
 </keywords>
 </info>
 
@@ -19,21 +20,21 @@ Based on test300
 
 <client>
 <features>
-unix-sockets
+UnixSockets
 </features>
 <server>
 http-unix
 </server>
- <name>
+<name>
 simple HTTP GET over Unix socket
- </name>
- <command>
+</name>
+<command>
 --unix-socket %HTTPUNIXPATH http://server-interpreted.example.com/%TESTNUMBER
 </command>
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: server-interpreted.example.com
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1436 b/third-party/curl/tests/data/test1436
index c59bb50947..961176fd10 100644
--- a/third-party/curl/tests/data/test1436
+++ b/third-party/curl/tests/data/test1436
@@ -1,9 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
-unix sockets
+UnixSockets
 </keywords>
 </info>
 
@@ -33,21 +34,21 @@ Third
 
 <client>
 <features>
-unix-sockets
+UnixSockets
 </features>
 <server>
 http-unix
 </server>
- <name>
+<name>
 HTTP requests with multiple connections over Unix socket
- </name>
- <command>
+</name>
+<command>
 --unix-socket %HTTPUNIXPATH http://one.example.com/%TESTNUMBER0001 http://two.example.com/%TESTNUMBER0002 http://one.example.com/%TESTNUMBER0003
 </command>
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0001 HTTP/1.1
 Host: one.example.com
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1437 b/third-party/curl/tests/data/test1437
index e1b89851a3..6d38a6ecfd 100644
--- a/third-party/curl/tests/data/test1437
+++ b/third-party/curl/tests/data/test1437
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP Digest auth
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", algorithm=MD5, algorithm=MD5, nonce=1, nonce=2
@@ -20,7 +21,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -29,7 +30,7 @@ Content-Length: 23
 This IS the real page!
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", algorithm=MD5, algorithm=MD5, nonce=1, nonce=2
@@ -54,18 +55,19 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP with duplicated WWW-Authenticate parameters
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --digest
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1438 b/third-party/curl/tests/data/test1438
index 64bcc98df1..5c48c21de4 100644
--- a/third-party/curl/tests/data/test1438
+++ b/third-party/curl/tests/data/test1438
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -44,9 +45,9 @@ Connection: close
 Content-Type: text/plain
 
 testdata
-HTTP
+http
 </stdout>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1439 b/third-party/curl/tests/data/test1439
index df984ee34e..1e3e6fcaa5 100644
--- a/third-party/curl/tests/data/test1439
+++ b/third-party/curl/tests/data/test1439
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -45,7 +46,7 @@ Content-Type: text/plain
 testdata
 1.1
 </stdout>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test144 b/third-party/curl/tests/data/test144
index bcfc3ba882..626e19246b 100644
--- a/third-party/curl/tests/data/test144
+++ b/third-party/curl/tests/data/test144
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -21,10 +22,10 @@ REPLY NLST 450 No files found
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP NLST dir list without contents, using PORT
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/ -P - -l
 </command>
 </client>
@@ -36,7 +37,7 @@ ftp://%HOSTIP:%FTPPORT/ -P - -l
 ^PORT \d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3}
 ^EPRT \|1\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|\d{1,5}\|
 </strip>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1440 b/third-party/curl/tests/data/test1440
index dbdfc73619..aeaca86f60 100644
--- a/third-party/curl/tests/data/test1440
+++ b/third-party/curl/tests/data/test1440
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -19,7 +20,7 @@ file
 Check --write-out with trailing %{
 </name>
 <command>
-file://localhost/%PWD/%LOGDIR/non-existent-file.txt --write-out '%{'
+file://localhost/%FILE_PWD/%LOGDIR/non-existent-file.txt --write-out '%{'
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test1441 b/third-party/curl/tests/data/test1441
index 2ff6be036a..7a91338c6d 100644
--- a/third-party/curl/tests/data/test1441
+++ b/third-party/curl/tests/data/test1441
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -19,7 +20,7 @@ file
 Check --write-out with trailing %
 </name>
 <command>
-file://localhost/%PWD/%LOGDIR/non-existent-file.txt --write-out '%'
+file://localhost/%FILE_PWD/%LOGDIR/non-existent-file.txt --write-out '%'
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test1442 b/third-party/curl/tests/data/test1442
index 02ecea67f6..022f5f6578 100644
--- a/third-party/curl/tests/data/test1442
+++ b/third-party/curl/tests/data/test1442
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -19,7 +20,7 @@ file
 Check --write-out with trailing \
 </name>
 <command>
-file://localhost/%PWD/%LOGDIR/non-existent-file.txt --write-out '\'
+file://localhost/%FILE_PWD/%LOGDIR/non-existent-file.txt --write-out='\'
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test1443 b/third-party/curl/tests/data/test1443
index a90fd43507..e959d7b147 100644
--- a/third-party/curl/tests/data/test1443
+++ b/third-party/curl/tests/data/test1443
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
 <data nocheck="yes">
 HTTP/1.1 200 OK
@@ -22,37 +22,24 @@ Connection: close
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# This relies on the debug feature to allow us to set a directory
-# in which to store the -O output
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -O and --remote-time
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -O --remote-time
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -O --remote-time --output-dir %LOGDIR
 </command>
 # Verify the mtime of the file. The mtime is specifically chosen to be an even
-# number so that it can be represented exactly on a FAT filesystem.
-<postcheck>
-perl -e 'exit((stat("%LOGDIR/%TESTNUMBER"))[9] != 960898200)'
-</postcheck>
+# number so that it can be represented exactly on a FAT file system.
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -62,5 +49,8 @@ Accept: */*
 <file name="%LOGDIR/%TESTNUMBER">
 12345
 </file>
+<postcheck>
+%PERL -e 'exit((stat("%LOGDIR/%TESTNUMBER"))[9] != 960898200)'
+</postcheck>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1444 b/third-party/curl/tests/data/test1444
index a10609c8dc..cca5eefbc7 100644
--- a/third-party/curl/tests/data/test1444
+++ b/third-party/curl/tests/data/test1444
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -22,22 +23,17 @@ file data
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP with --remote-time
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --remote-time
 </command>
-# Verify the mtime of the file. The mtime is specifically chosen to be an even
-# number so that it can be represented exactly on a FAT filesystem.
-<postcheck>
-perl -e 'exit((stat("%LOGDIR/curl%TESTNUMBER.out"))[9] != 1234567890)'
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -48,5 +44,10 @@ SIZE %TESTNUMBER
 RETR %TESTNUMBER
 QUIT
 </protocol>
+# Verify the mtime of the file. The mtime is specifically chosen to be an even
+# number so that it can be represented exactly on a FAT file system.
+<postcheck>
+%PERL -e 'exit((stat("%LOGDIR/curl%TESTNUMBER.out"))[9] != 1234567890)'
+</postcheck>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1445 b/third-party/curl/tests/data/test1445
index 7fb1d1df6c..b33352fbb4 100644
--- a/third-party/curl/tests/data/test1445
+++ b/third-party/curl/tests/data/test1445
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -15,21 +16,20 @@ FILE
 file
 </server>
 <precheck>
-perl %SRCDIR/libtest/test613.pl prepare %PWD/%LOGDIR/test%TESTNUMBER.dir
+%PERL %SRCDIR/libtest/test613.pl prepare %PWD/%LOGDIR/test%TESTNUMBER.dir
 </precheck>
- <name>
+<name>
 file:// with --remote-time
- </name>
- <command>
+</name>
+<command>
 file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.dir/plainfile.txt --remote-time
 </command>
-<postcheck>
-perl %SRCDIR/libtest/test613.pl postprocess %PWD/%LOGDIR/test%TESTNUMBER.dir && \
-perl -e 'exit((stat("%LOGDIR/curl%TESTNUMBER.out"))[9] != 946728000)'
-</postcheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
+<postcheck>
+%PERL %SRCDIR/libtest/test613.pl postprocess %PWD/%LOGDIR/test%TESTNUMBER.dir %LOGDIR/curl%TESTNUMBER.out 946728000
+</postcheck>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1446 b/third-party/curl/tests/data/test1446
index 5e11f11b07..bf487ff197 100644
--- a/third-party/curl/tests/data/test1446
+++ b/third-party/curl/tests/data/test1446
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,37 +7,30 @@ SFTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
 <precheck>
-perl %SRCDIR/libtest/test613.pl prepare %PWD/%LOGDIR/test%TESTNUMBER.dir
+%PERL %SRCDIR/libtest/test613.pl prepare %PWD/%LOGDIR/test%TESTNUMBER.dir
 </precheck>
- <name>
+<name>
 SFTP with --remote-time
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/test%TESTNUMBER.dir/rofile.txt --insecure --remote-time
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/test%TESTNUMBER.dir/rofile.txt --insecure --remote-time
 </command>
-<postcheck>
-perl %SRCDIR/libtest/test613.pl postprocess %PWD/%LOGDIR/test%TESTNUMBER.dir && \
-perl -e 'exit((stat("%LOGDIR/curl%TESTNUMBER.out"))[9] != 978264000)'
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
+<postcheck>
+%PERL %SRCDIR/libtest/test613.pl postprocess %PWD/%LOGDIR/test%TESTNUMBER.dir %LOGDIR/curl%TESTNUMBER.out 978264000
+</postcheck>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1447 b/third-party/curl/tests/data/test1447
index 2a22e558bd..ea68ef9230 100644
--- a/third-party/curl/tests/data/test1447
+++ b/third-party/curl/tests/data/test1447
@@ -1,37 +1,31 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP proxy
-FAILURE
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 http
 proxy
 </features>
- <name>
+<name>
 Provide illegal proxy name
- </name>
- <command>
+</name>
+<command>
 --proxy "http://a:b@/x" http://%HOSTIP:%NOLISTENPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-# Couldn't resolve proxy name
+# Could not resolve proxy name
 <errorcode>
 5
 </errorcode>
diff --git a/third-party/curl/tests/data/test1448 b/third-party/curl/tests/data/test1448
index a38823de8b..a660913a6c 100644
--- a/third-party/curl/tests/data/test1448
+++ b/third-party/curl/tests/data/test1448
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ followlocation
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -18,7 +18,7 @@ HTTP/1.1 302 OK swsbounce
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 9
 Content-Type: text/plain
-Location: http://åäö.se:%HTTPPORT/%TESTNUMBER0001
+Location: http://%hex[%c3%a5%c3%a4%c3%b6]hex%.se:%HTTPPORT/%TESTNUMBER0001
 
 redirect
 </data>
@@ -32,35 +32,30 @@ OK
 </data1>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 <features>
-idn
+IDN
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=en_US.UTF-8
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
-Redirect following to UTF-8 IDN host name
- </name>
+<name>
+Redirect following to UTF-8 IDN hostname
+</name>
 
- <command>
-http://åäö.se:%HTTPPORT/%TESTNUMBER --resolve xn--4cab6c.se:%HTTPPORT:%HOSTIP -L --connect-to %HOSTIP:%HTTPPORT:%HOSTIP:%HTTPPORT
+<command>
+http://%hex[%c3%a5%c3%a4%c3%b6]hex%.se:%HTTPPORT/%TESTNUMBER --resolve xn--4cab6c.se:%HTTPPORT:%HOSTIP -L --connect-to %HOSTIP:%HTTPPORT:%HOSTIP:%HTTPPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: xn--4cab6c.se:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -78,7 +73,7 @@ HTTP/1.1 302 OK swsbounce
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 9
 Content-Type: text/plain
-Location: http://åäö.se:%HTTPPORT/%TESTNUMBER0001
+Location: http://%hex[%c3%a5%c3%a4%c3%b6]hex%.se:%HTTPPORT/%TESTNUMBER0001
 
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
diff --git a/third-party/curl/tests/data/test1449 b/third-party/curl/tests/data/test1449
index f57ffc7b8e..a0b28e9c0f 100644
--- a/third-party/curl/tests/data/test1449
+++ b/third-party/curl/tests/data/test1449
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # initially based on test110
 <info>
@@ -17,17 +18,17 @@ Resume
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download range with integer overflow
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -r 36893488147419103232-
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test145 b/third-party/curl/tests/data/test145
index 6fc3298833..1011aa16a6 100644
--- a/third-party/curl/tests/data/test145
+++ b/third-party/curl/tests/data/test145
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -20,10 +21,10 @@ REPLY NLST 550 Have a taste on this!
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP NLST dir list with weird reply code, using PORT
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/ -P - -l
 </command>
 </client>
@@ -38,7 +39,7 @@ ftp://%HOSTIP:%FTPPORT/ -P - -l
 ^PORT \d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3}
 ^EPRT \|1\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|\d{1,5}\|
 </strip>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1450 b/third-party/curl/tests/data/test1450
index ca3ac8849a..e09ce09a79 100644
--- a/third-party/curl/tests/data/test1450
+++ b/third-party/curl/tests/data/test1450
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,12 +6,10 @@ DICT
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -19,15 +18,14 @@ dict
 <features>
 dict
 </features>
- <name>
+<name>
 Basic DICT lookup
- </name>
- <command>
+</name>
+<command>
 dict://%HOSTIP:%DICTPORT/d:basic
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 </verify>
diff --git a/third-party/curl/tests/data/test1451 b/third-party/curl/tests/data/test1451
index 9fdd68a614..d0fdf56f72 100644
--- a/third-party/curl/tests/data/test1451
+++ b/third-party/curl/tests/data/test1451
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ SMB
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -13,7 +13,6 @@ Basic SMB test complete
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -28,12 +27,8 @@ Basic SMB request
 <command>
 -u 'curltest:curltest' smb://%HOSTIP:%SMBPORT/TESTS/%TESTNUMBER
 </command>
-<precheck>
-python3 -c "__import__('pkgutil').find_loader('impacket') or (__import__('sys').stdout.write('Test only works if Python package impacket is installed\n'), __import__('sys').exit(1))"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <stdout>
diff --git a/third-party/curl/tests/data/test1452 b/third-party/curl/tests/data/test1452
index d1b7fa9cdd..37c7f00f2e 100644
--- a/third-party/curl/tests/data/test1452
+++ b/third-party/curl/tests/data/test1452
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,14 +7,12 @@ UPLOAD
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -22,18 +21,17 @@ telnet
 <features>
 telnet
 </features>
- <name>
+<name>
 Basic TELNET negotiation
- </name>
+</name>
 <stdin>
 test%TESTNUMBER
 </stdin>
- <command>
+<command>
 telnet://%HOSTIP:%TELNETPORT --upload-file -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <stdout nonewline="yes">
diff --git a/third-party/curl/tests/data/test1453 b/third-party/curl/tests/data/test1453
index 76b5acda4f..5d2166332c 100644
--- a/third-party/curl/tests/data/test1453
+++ b/third-party/curl/tests/data/test1453
@@ -1,36 +1,30 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 Too long tftp filename
-FAILURE
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 tftp
 </features>
- <name>
+<name>
 Too long tftp filename
- </name>
- <command>
-tftp://%HOSTIP:%NOLISTENPORT/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaz
+</name>
+<command>
+tftp://%HOSTIP:%NOLISTENPORT/%repeat[503 x a]%z
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-# TFTP file name too long
+# TFTP filename too long
 <errorcode>
 71
 </errorcode>
diff --git a/third-party/curl/tests/data/test1454 b/third-party/curl/tests/data/test1454
index 36e28e49ab..b79ae77d20 100644
--- a/third-party/curl/tests/data/test1454
+++ b/third-party/curl/tests/data/test1454
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,29 +6,26 @@
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-!ipv6
+!IPv6
 </features>
 <server>
 http
 </server>
- <name>
+<name>
 --connect-to with IPv6 address w/o IPv6 support!
- </name>
+</name>
 <command>
 --connect-to localhost:80:[::1]:80 localhost
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 4 == CURLE_NOT_BUILT_IN
diff --git a/third-party/curl/tests/data/test1455 b/third-party/curl/tests/data/test1455
index f6e615fa7a..700d1d5367 100644
--- a/third-party/curl/tests/data/test1455
+++ b/third-party/curl/tests/data/test1455
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ haproxy
 </keywords>
 </info>
 
-#
 # Server-side
 <reply name="%TESTNUMBER">
 <data nocheck="yes">
@@ -27,7 +27,6 @@ Funny-head: barkbark
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -44,13 +43,12 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
 s/^PROXY TCP4 %CLIENTIP %HOSTIP (\d*) %HTTPPORT/proxy-line/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 proxy-line
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
diff --git a/third-party/curl/tests/data/test1456 b/third-party/curl/tests/data/test1456
index fcb02be6bc..acc1407557 100644
--- a/third-party/curl/tests/data/test1456
+++ b/third-party/curl/tests/data/test1456
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ haproxy
 IPv6
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -23,23 +23,22 @@ Connection: close
 Content-Type: text/html
 Funny-head: yesyes
 
-These data aren't actually sent to the client
+These data are not actually sent to the client
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-ipv6
+IPv6
 </features>
 <server>
 http-ipv6
 </server>
- <name>
+<name>
 HTTP-IPv6 GET with PROXY protocol
- </name>
- <command>
+</name>
+<command>
 -g "http://%HOST6IP:%HTTP6PORT/%TESTNUMBER" --haproxy-protocol
 </command>
 <features>
@@ -47,7 +46,6 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # Strip off the (random) local port number. This test used to use a fixed
@@ -55,7 +53,7 @@ proxy
 <strippart>
 s/PROXY TCP6 ::1 ::1 (\d+) (\d+)/PROXY TCP6 ::1 ::1 $2/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 PROXY TCP6 ::1 ::1 %HTTP6PORT
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOST6IP:%HTTP6PORT
diff --git a/third-party/curl/tests/data/test1457 b/third-party/curl/tests/data/test1457
index 24267b1f41..b7f1efc7b9 100644
--- a/third-party/curl/tests/data/test1457
+++ b/third-party/curl/tests/data/test1457
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -49,7 +50,7 @@ line1line3
 <stderr nonewline="yes">
 line2
 </stderr>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1458 b/third-party/curl/tests/data/test1458
index 16f8c54c6a..494b215d77 100644
--- a/third-party/curl/tests/data/test1458
+++ b/third-party/curl/tests/data/test1458
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -26,7 +26,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -40,10 +39,9 @@ HTTP with wildcard --resolve
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: example.com:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1459 b/third-party/curl/tests/data/test1459
index 2a69a60330..ee7e3e5ffe 100644
--- a/third-party/curl/tests/data/test1459
+++ b/third-party/curl/tests/data/test1459
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,43 +7,33 @@ known_hosts
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
-<precheck>
-mkdir -p %PWD/%LOGDIR/test%TESTNUMBER.dir/.ssh
-</precheck>
 <features>
 sftp
-!oldlibssh
+!badlibssh
 </features>
- <name>
+<name>
 SFTP with corrupted known_hosts
- </name>
- <command>
--u : sftp://%HOSTIP:%SSHPORT/ -l
+</name>
+<command>
+-u : sftp://%HOSTIP:%SSHPORT/ -l --knownhosts %LOGDIR/known%TESTNUMBER
 </command>
-<file name="%LOGDIR/test%TESTNUMBER.dir/.ssh/known_hosts">
-|1|qy29Y1x/+/F39AzdG5515YSSw+c=|iB2WX5jrU3ZTWc+ZfGau7HHEvBc= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAynDN8cDJ3xNzRjTNNGciSHSxpubxhZ6YnkLdp1TkrGW8n\
+<file name="%LOGDIR/known%TESTNUMBER">
+|1|qy29Y1x/+/F39AzdG5515YSSw+c=|iB2WX5jrU3ZTWc+ZfGau7HHEvBc= %SSHKEYALGO AAAAB3NzaC1yc2EAAAABIwAAAIEAynDN8cDJ3xNzRjTNNGciSHSxpubxhZ6YnkLdp1TkrGW8n\
 R93Ey5VtBeBblYTRlFXBWJgKFcTKBRJ/O4qBZwbUgt10AHj31i6h8NehfT19tR8wG/YCmj3KtYLHmwdzmW1edEL9G2NdX2KiKYv7/zuly3QvmP0QA0NhWkAz0KdWNM=
 </file>
-<setenv>
-CURL_HOME=%PWD/%LOGDIR/test%TESTNUMBER.dir
-</setenv>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-# old libssh installs return the wrong thing
+# badlibssh configurations return the wrong thing: 67 CURLE_LOGIN_DENIED,
+# instead of 60 CURLE_PEER_FAILED_VERIFICATION.
 <errorcode>
 60
 </errorcode>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
-
diff --git a/third-party/curl/tests/data/test146 b/third-party/curl/tests/data/test146
index 7dc64db441..87a69c6cc7 100644
--- a/third-party/curl/tests/data/test146
+++ b/third-party/curl/tests/data/test146
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -19,10 +20,10 @@ this is file contents
 <server>
 ftp
 </server>
- <name>
+<name>
 persistent FTP with different paths
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/first/dir/here/%TESTNUMBER ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
@@ -34,7 +35,7 @@ ftp://%HOSTIP:%FTPPORT/first/dir/here/%TESTNUMBER ftp://%HOSTIP:%FTPPORT/%TESTNU
 ^PORT \d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3}
 ^EPRT \|1\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|\d{1,5}\|
 </strip>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1460 b/third-party/curl/tests/data/test1460
index c3180ff923..26382cf8c3 100644
--- a/third-party/curl/tests/data/test1460
+++ b/third-party/curl/tests/data/test1460
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,49 +8,39 @@ HTTP GET
 </keywords>
 </info>
 
-#
 <reply>
 <data nocheck="yes">
 HTTP/1.1 200 swsclose
-  12345
-fooo
-54 3 2 1
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
 Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
+Content-Length: 4
 
+hej
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# this relies on the debug feature to allow us to set directory to store the
-# -J output in
-<features>
-debug
-</features>
 <server>
 http
 </server>
 <name>
 HTTP GET with -Ji and Content-Disposition with existing file
 </name>
-<setenv>
-CURL_TESTDIR=%LOGDIR
-</setenv>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -Ji -O
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -Ji -O --output-dir %LOGDIR
 </command>
 <file name="%LOGDIR/name%TESTNUMBER">
 initial content
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-# Warning: --include and --remote-header-name cannot be combined.
+# Warning: Failed to open the file log/name1460: File exists
 <errorcode>
-2
+23
 </errorcode>
 <file name="%LOGDIR/name%TESTNUMBER">
 initial content
diff --git a/third-party/curl/tests/data/test1461 b/third-party/curl/tests/data/test1461
index 65797a405a..57bba58c9f 100644
--- a/third-party/curl/tests/data/test1461
+++ b/third-party/curl/tests/data/test1461
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,49 +6,30 @@
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
- <name>
+<features>
+manual
+</features>
+<name>
 curl important --help
- </name>
- <command>
+</name>
+<command>
 --help
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 0
 </errorcode>
 <stdout mode="text">
-Usage: curl [options...] <url>
- -d, --data <data>          HTTP POST data
- -f, --fail                 Fail fast with no output on HTTP errors
- -h, --help <category>      Get help for commands
- -i, --include              Include protocol response headers in the output
- -o, --output <file>        Write to file instead of stdout
- -O, --remote-name          Write output to a file named as the remote file
- -s, --silent               Silent mode
- -T, --upload-file <file>   Transfer local FILE to destination
- -u, --user <user:password> Server user and password
- -A, --user-agent <name>    Send User-Agent <name> to server
- -v, --verbose              Make the operation more talkative
- -V, --version              Show version number and quit
-
-This is not the full help, this menu is stripped into categories.
-Use "--help category" to get an overview of all categories.
-For all options use the manual or "--help all".
+%includetext %SRCDIR/data/data%TESTNUMBER.txt%
 </stdout>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1462 b/third-party/curl/tests/data/test1462
index ce99029465..9e68c6b447 100644
--- a/third-party/curl/tests/data/test1462
+++ b/third-party/curl/tests/data/test1462
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,57 +6,53 @@
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
- <name>
+<name>
 curl invalid category --help
- </name>
- <command>
+</name>
+<command>
 --help sdfafdsfadsfsd
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 0
 </errorcode>
 <stdout mode="text">
-Usage: curl [options...] <url>
-Invalid category provided, here is a list of all categories:
+Unknown category provided, here is a list of all categories:
 
- auth        Different types of authentication methods
- connection  Low level networking operations
+ auth        Authentication methods
+ connection  Manage connections
  curl        The command line tool itself
- dns         General DNS options
- file        FILE protocol options
- ftp         FTP protocol options
- http        HTTP and HTTPS protocol options
- imap        IMAP protocol options
- misc        Options that don't fit into any other category
- output      Filesystem output
- pop3        POP3 protocol options
- post        HTTP Post specific options
- proxy       All options related to proxies
- scp         SCP protocol options
- sftp        SFTP protocol options
- smtp        SMTP protocol options
- ssh         SSH protocol options
- telnet      TELNET protocol options
- tftp        TFTP protocol options
- tls         All TLS/SSL related options
- upload      All options for uploads
- verbose     Options related to any kind of command line output of curl
+ deprecated  Legacy
+ dns         Names and resolving
+ file        FILE protocol
+ ftp         FTP protocol
+ global      Global options
+ http        HTTP and HTTPS protocol
+ imap        IMAP protocol
+ ldap        LDAP protocol
+ output      File system output
+ pop3        POP3 protocol
+ post        HTTP POST specific
+ proxy       Options for proxies
+ scp         SCP protocol
+ sftp        SFTP protocol
+ smtp        SMTP protocol
+ ssh         SSH protocol
+ telnet      TELNET protocol
+ tftp        TFTP protocol
+ timeout     Timeouts and delays
+ tls         TLS/SSL related
+ upload      Upload, sending data
+ verbose     Tracing, logging etc
 </stdout>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1463 b/third-party/curl/tests/data/test1463
index 3904324c7e..3a6752f64a 100644
--- a/third-party/curl/tests/data/test1463
+++ b/third-party/curl/tests/data/test1463
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,40 +7,30 @@ FILE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 file
 </features>
- <name>
+<name>
 curl file category --help
- </name>
- <command>
+</name>
+<command>
 --help file
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 0
 </errorcode>
 <stdout mode="text">
-Usage: curl [options...] <url>
-file: FILE protocol options
-     --create-file-mode <mode> File mode for created files
- -I, --head                    Show document info only
- -r, --range <range>           Retrieve only the bytes within RANGE
+%includetext %SRCDIR/data/data%TESTNUMBER.txt%
 </stdout>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1464 b/third-party/curl/tests/data/test1464
index 44a7adcf0b..5feb5ade95 100644
--- a/third-party/curl/tests/data/test1464
+++ b/third-party/curl/tests/data/test1464
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,40 +7,30 @@ FILE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 file
 </features>
- <name>
+<name>
 curl file category --help with lower/upper mix
- </name>
- <command>
+</name>
+<command>
 --help fIlE
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 0
 </errorcode>
 <stdout mode="text">
-Usage: curl [options...] <url>
-file: FILE protocol options
-     --create-file-mode <mode> File mode for created files
- -I, --head                    Show document info only
- -r, --range <range>           Retrieve only the bytes within RANGE
+%includetext %SRCDIR/data/data1463.txt%
 </stdout>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1465 b/third-party/curl/tests/data/test1465
index f06d242255..d8d6115b1f 100644
--- a/third-party/curl/tests/data/test1465
+++ b/third-party/curl/tests/data/test1465
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -25,24 +26,27 @@ Connection: close
 <server>
 http
 </server>
- <name>
+<name>
 --libcurl for POST with binary content
- </name>
+</name>
 <setenv>
-SSL_CERT_FILE=
+SSL_CERT_FILE
 </setenv>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER --libcurl %LOGDIR/test%TESTNUMBER.c --data-binary @%LOGDIR/%TESTNUMBER-upload
 </command>
 # "ab\x81""cd\0e\\\"?\r\n\t\x01""fghi%x1Ajklm%xFD"
 <file name="%LOGDIR/%TESTNUMBER-upload" nonewline="yes">
 %hex[ab%81cd%00e\"?%0D%0A%09%01fghi%1Ajklm%FD]hex%
 </file>
+<features>
+--libcurl
+</features>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /we/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -53,66 +57,17 @@ Content-Type: application/x-www-form-urlencoded
 %hex[ab%81cd%00e\"?%0D%0A%09%01fghi%1Ajklm%FD]hex%
 </protocol>
 <stripfile>
-
 # CURLOPT_SSL_VERIFYPEER, SSH_KNOWNHOSTS and HTTP_VERSION vary with
-# configurations - just ignore them
+# configurations - ignore them
 $_ = '' if /CURLOPT_SSL_VERIFYPEER/
 $_ = '' if /CURLOPT_SSH_KNOWNHOSTS/
 $_ = '' if /CURLOPT_HTTP_VERSION/
 $_ = '' if /CURLOPT_INTERLEAVEDATA/
+$_ = '' if /CURLOPT_SSLVERSION/
+$_ = '' if /CURLOPT_TIMEOUT_MS/
 </stripfile>
 <file name="%LOGDIR/test%TESTNUMBER.c" mode="text">
-/********* Sample code generated by the curl command line tool **********
- * All curl_easy_setopt() options are documented at:
- * https://curl.se/libcurl/c/curl_easy_setopt.html
- ************************************************************************/
-#include <curl/curl.h>
-
-int main(int argc, char *argv[])
-{
-  CURLcode ret;
-  CURL *hnd;
-
-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
-  curl_easy_setopt(hnd, CURLOPT_POSTFIELDS, "ab\201cd\000e\\\"\?\r\n\t\001fghi\x1ajklm\xfd");
-  curl_easy_setopt(hnd, CURLOPT_POSTFIELDSIZE_LARGE, (curl_off_t)24);
-  curl_easy_setopt(hnd, CURLOPT_USERAGENT, "curl/%VERSION");
-  curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-%if ftp
-  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
-%endif
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
-
-  /* Here is a list of options the curl code used that cannot get generated
-     as source easily. You may choose to either not use them or implement
-     them yourself.
-
-  CURLOPT_WRITEDATA was set to an object pointer
-  CURLOPT_WRITEFUNCTION was set to a function pointer
-  CURLOPT_READDATA was set to an object pointer
-  CURLOPT_READFUNCTION was set to a function pointer
-  CURLOPT_SEEKDATA was set to an object pointer
-  CURLOPT_SEEKFUNCTION was set to a function pointer
-  CURLOPT_ERRORBUFFER was set to an object pointer
-  CURLOPT_STDERR was set to an object pointer
-  CURLOPT_DEBUGFUNCTION was set to a function pointer
-  CURLOPT_DEBUGDATA was set to an object pointer
-  CURLOPT_HEADERFUNCTION was set to a function pointer
-  CURLOPT_HEADERDATA was set to an object pointer
-
-  */
-
-  ret = curl_easy_perform(hnd);
-
-  curl_easy_cleanup(hnd);
-  hnd = NULL;
-
-  return (int)ret;
-}
-/**** End of sample code ****/
+%includetext %SRCDIR/data/data%TESTNUMBER.c%
 </file>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1466 b/third-party/curl/tests/data/test1466
index 8b0b587e13..ca19f48cfa 100644
--- a/third-party/curl/tests/data/test1466
+++ b/third-party/curl/tests/data/test1466
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -16,7 +17,6 @@ Connection: close
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -25,16 +25,15 @@ http
 
 <name>
 HTTP GET with 3-digit response and only digits in reason
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1467 b/third-party/curl/tests/data/test1467
index c002d57cf6..b2c2144e42 100644
--- a/third-party/curl/tests/data/test1467
+++ b/third-party/curl/tests/data/test1467
@@ -1,14 +1,14 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
 SOCKS5
-unix sockets
+UnixSockets
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -27,29 +27,29 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
+# --socks5 cannot accept Windows absolute paths
 <features>
 proxy
-unix-sockets
+UnixSockets
+!win32
 </features>
 <server>
 http
 socks5unix
 </server>
- <name>
-HTTP GET via SOCKS5 proxy via unix sockets
- </name>
- <command>
+<name>
+HTTP GET via SOCKS5 proxy via Unix sockets
+</name>
+<command>
 --socks5 localhost%SOCKSUNIXPATH http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1468 b/third-party/curl/tests/data/test1468
index 9a2bf3e085..35448e4511 100644
--- a/third-party/curl/tests/data/test1468
+++ b/third-party/curl/tests/data/test1468
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,11 +6,10 @@ HTTP
 HTTP GET
 SOCKS5
 SOCKS5h
-unix sockets
+UnixSockets
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -28,29 +28,29 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
+# --socks5h cannot accept Windows absolute paths
 <features>
 proxy
-unix-sockets
+UnixSockets
+!win32
 </features>
 <server>
 http
 socks5unix
 </server>
- <name>
-HTTP GET with host name using SOCKS5h via unix sockets
- </name>
- <command>
+<name>
+HTTP GET with hostname using SOCKS5h via Unix sockets
+</name>
+<command>
 http://this.is.a.host.name:%HTTPPORT/%TESTNUMBER --proxy socks5h://localhost%SOCKSUNIXPATH
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: this.is.a.host.name:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1469 b/third-party/curl/tests/data/test1469
index f2b3882cb2..3b742c1b2c 100644
--- a/third-party/curl/tests/data/test1469
+++ b/third-party/curl/tests/data/test1469
@@ -1,21 +1,18 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
 URL
-FAILURE
 </keywords>
 </info>
 
 # Client-side
 <client>
-<server>
-none
-</server>
- <name>
+<name>
 Space in FTP upload URL
- </name>
- <command>
+</name>
+<command>
 "ftp://%HOSTIP:%NOLISTENPORT/%TESTNUMBER%/with space/" -T %LOGDIR/irrelevant-file
 </command>
 </client>
diff --git a/third-party/curl/tests/data/test147 b/third-party/curl/tests/data/test147
index 2cefbb144c..7ec5cac733 100644
--- a/third-party/curl/tests/data/test147
+++ b/third-party/curl/tests/data/test147
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -21,10 +22,10 @@ COUNT CWD 1
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP with --ftp-create-dirs (failing CWD)
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/first/dir/here/%TESTNUMBER --ftp-create-dirs
 </command>
 </client>
@@ -36,7 +37,7 @@ ftp://%HOSTIP:%FTPPORT/first/dir/here/%TESTNUMBER --ftp-create-dirs
 ^PORT \d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3}
 ^EPRT \|1\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|\d{1,5}\|
 </strip>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1470 b/third-party/curl/tests/data/test1470
index 7c462e5707..549f45eaf8 100644
--- a/third-party/curl/tests/data/test1470
+++ b/third-party/curl/tests/data/test1470
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,11 +7,10 @@ HTTP
 HTTP GET
 SOCKS5
 SOCKS5h
-unix sockets
+UnixSockets
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -29,29 +29,29 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
+# --proxy cannot accept Windows absolute paths
 <features>
 proxy
-unix-sockets
+UnixSockets
+!win32
 </features>
 <server>
 https
 socks5unix
 </server>
- <name>
-HTTPS GET with host name using SOCKS5h via unix sockets
- </name>
- <command>
-https://this.is.a.host.name:%HTTPSPORT/%TESTNUMBER -k --proxy socks5h://localhost%SOCKSUNIXPATH
+<name>
+HTTPS GET with hostname using SOCKS5h via Unix sockets
+</name>
+<command>
+https://this.is.a.host.name:%HTTPSPORT/%TESTNUMBER --insecure --proxy socks5h://localhost%SOCKSUNIXPATH
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: this.is.a.host.name:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1471 b/third-party/curl/tests/data/test1471
index e8e41430dd..70c454b0a4 100644
--- a/third-party/curl/tests/data/test1471
+++ b/third-party/curl/tests/data/test1471
@@ -1,22 +1,17 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 Onion
 Tor
-FAILURE
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 http
 </features>
@@ -28,10 +23,9 @@ red.onion
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-# Couldn't resolve host name
+# Could not resolve hostname
 <errorcode>
 6
 </errorcode>
diff --git a/third-party/curl/tests/data/test1472 b/third-party/curl/tests/data/test1472
index 07f0620c93..b9e2d6dd67 100644
--- a/third-party/curl/tests/data/test1472
+++ b/third-party/curl/tests/data/test1472
@@ -1,22 +1,17 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 Onion
 Tor
-FAILURE
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 http
 </features>
@@ -28,10 +23,9 @@ tasty.onion.
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-# Couldn't resolve host name
+# Could not resolve hostname
 <errorcode>
 6
 </errorcode>
diff --git a/third-party/curl/tests/data/test1473 b/third-party/curl/tests/data/test1473
index ff9d01d081..9eedaed591 100644
--- a/third-party/curl/tests/data/test1473
+++ b/third-party/curl/tests/data/test1473
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ header line folding
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
  Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/
@@ -22,35 +22,27 @@ Content-Length: 6
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 first HTTP header starts with white space
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-%if hyper
-# curl: (1) Hyper: [6] invalid HTTP header parsed
-<errorcode>
-1
-</errorcode>
-%endif
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1474 b/third-party/curl/tests/data/test1474
index 3e5b9a91c0..f810701c83 100644
--- a/third-party/curl/tests/data/test1474
+++ b/third-party/curl/tests/data/test1474
@@ -1,111 +1,35 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
-# This test is quite timing dependent and tricky to set up. The time line of
-# test operations looks like this:
-#
-# 1. curl sends a PUT request with Expect: 100-continue and waits only 1 msec
-#    for a 100 response.
-# 2. The HTTP server accepts the connection but waits 500 msec before acting
-#    on the request.
-# 3. curl doesn't receive the expected 100 response before its timeout expires,
-#    so it starts sending the body. It is throttled by a --limit-rate, so it
-#    sends the first 64 KiB then stops for 1000 msec due to this
-#    throttling.
-# 4. The server sends its 417 response while curl is throttled.
-# 5. curl responds to this 417 response by closing the connection (because it
-#    has a half-completed response outstanding) and starting a new one. This
-#    new request does not have an Expect: header so it is sent without delay.
-#    It's still throttled, however, so it takes about 16 seconds to finish
-#    sending.
-# 6. The server receives the response and this time acks it with 200.
-#
-# Because of the timing sensitivity (scheduling delays of 500 msec can cause
-# the test to fail), this test is marked flaky to avoid it being run in the CI
-# builds which are often run on overloaded servers.
-# Increasing the --limit-rate would decrease the test time, but at the cost of
-# becoming even more sensitive to delays (going from 500 msec to 250 msec or
-# less of accepted delay before failure).
 <info>
 <keywords>
 HTTP
-HTTP PUT
-Expect
-flaky
+HTTP GET
+--proto
 </keywords>
 </info>
+
 # Server-side
 <reply>
-# 417 means the server didn't like the Expect header
-<data>
-HTTP/1.1 417 BAD swsbounce
-Date: Tue, 09 Nov 2010 14:49:00 GMT
-Server: test-server/fake
-Content-Length: 0
-
-</data>
-<data1>
-HTTP/1.1 200 OK
-Date: Tue, 09 Nov 2010 14:49:00 GMT
-Server: test-server/fake
-Content-Length: 10
-
-blablabla
-</data1>
-<datacheck>
-HTTP/1.1 417 BAD swsbounce
-Date: Tue, 09 Nov 2010 14:49:00 GMT
-Server: test-server/fake
-Content-Length: 0
-
-HTTP/1.1 200 OK
-Date: Tue, 09 Nov 2010 14:49:00 GMT
-Server: test-server/fake
-Content-Length: 10
-
-blablabla
-</datacheck>
-<servercmd>
-no-expect
-delay: 500
-connection-monitor
-</servercmd>
 </reply>
 
 # Client-side
 <client>
-<server>
+<features>
 http
-</server>
- <name>
-HTTP PUT with Expect: 100-continue and 417 response during upload
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -T %LOGDIR/test%TESTNUMBER.txt --limit-rate 64K --expect100-timeout 0.001
+</features>
+<name>
+--proto -all disables all protocols
+</name>
+<command>
+--proto -all http://%HOSTIP:%NOLISTENPORT/%TESTNUMBER
 </command>
-# Must be large enough to trigger curl's automatic 100-continue behaviour
-<file name="%LOGDIR/test%TESTNUMBER.txt">
-%repeat[132 x S]%%repeat[16462 x xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx%0a]%
-</file>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-PUT /we/want/%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Content-Length: 1053701
-Expect: 100-continue
-
-%repeat[132 x S]%%repeat[1021 x xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx%0a]%%repeat[60 x x]%[DISCONNECT]
-PUT /we/want/%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Content-Length: 1053701
-
-%repeat[132 x S]%%repeat[16462 x xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx%0a]%
-[DISCONNECT]
-</protocol>
+# 2 failed init, the --proto argument is not accepted
+<errorcode>
+2
+</errorcode>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1475 b/third-party/curl/tests/data/test1475
new file mode 100644
index 0000000000..ab89e2df14
--- /dev/null
+++ b/third-party/curl/tests/data/test1475
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+# also verified by 1156 in libcurl API terms
+
+<info>
+<keywords>
+HTTP
+HTTP GET
+Resume
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+HTTP/1.1 416 Invalid range%CR
+Connection: close%CR
+Content-Length: 0%CR
+Content-Range: */100%CR
+%CR
+</data>
+
+# The file data that exists at the start of the test must be included in
+# the verification.
+<datacheck>
+012345678
+012345678
+012345678
+012345678
+012345678
+012345678
+012345678
+012345678
+012345678
+012345678
+HTTP/1.1 416 Invalid range%CR
+Connection: close%CR
+Content-Length: 0%CR
+Content-Range: */100%CR
+%CR
+</datacheck>
+
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<killserver>
+http
+</killserver>
+<name>
+-f and 416 with Content-Range: */size
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -C - -f
+</command>
+<file name="%LOGDIR/curl%TESTNUMBER.out">
+012345678
+012345678
+012345678
+012345678
+012345678
+012345678
+012345678
+012345678
+012345678
+012345678
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Range: bytes=100-
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1476 b/third-party/curl/tests/data/test1476
new file mode 100644
index 0000000000..93fc52458d
--- /dev/null
+++ b/third-party/curl/tests/data/test1476
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+cookies
+</keywords>
+</info>
+
+# Server-side
+<reply>
+
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 0
+Set-Cookie: super=oops; domain=co.UK; path=/
+Set-Cookie: fine=yesyes; domain=CURL.CO.UK; path=/
+
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+PSL violating cookie with mixed case domain and cookie domain property
+</name>
+<command>
+-x http://%HOSTIP:%HTTPPORT/%TESTNUMBER http://curl.co.UK -c %LOGDIR/cookies%TESTNUMBER.txt
+</command>
+<features>
+proxy
+PSL
+cookies
+</features>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://curl.co.UK/ HTTP/1.1
+Host: curl.co.UK
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+<file name="%LOGDIR/cookies%TESTNUMBER.txt" mode="text">
+# Netscape HTTP Cookie File
+# https://curl.se/docs/http-cookies.html
+# This file was generated by libcurl! Edit at your own risk.
+
+.CURL.CO.UK	TRUE	/	FALSE	0	fine	yesyes
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1477 b/third-party/curl/tests/data/test1477
new file mode 100644
index 0000000000..a223bb0543
--- /dev/null
+++ b/third-party/curl/tests/data/test1477
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+documentation
+</keywords>
+</info>
+
+# Client-side
+<client>
+<name>
+Verify that error codes in headers and libcurl-errors.3 are in sync
+</name>
+
+<command type="perl">
+%SRCDIR/test1477.pl %SRCDIR/.. %PWD/..
+</command>
+</client>
+
+<verify>
+<stdout>
+Result
+</stdout>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1478 b/third-party/curl/tests/data/test1478
new file mode 100644
index 0000000000..bf468f0b27
--- /dev/null
+++ b/third-party/curl/tests/data/test1478
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+source analysis
+documentation
+--help
+</keywords>
+</info>
+
+# Client-side
+<client>
+<name>
+src/tool_listhelp.c is in sync with docs/cmdline-opts
+</name>
+
+<command type="perl">
+%SRCDIR/../scripts/managen -d %SRCDIR/../docs/cmdline-opts -I %SRCDIR/../include listhelp %SRCDIR/../docs/cmdline-opts/*.md
+</command>
+</client>
+
+<verify>
+<stdout mode="text">
+%include %SRCDIR/../src/tool_listhelp.c%
+</stdout>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1479 b/third-party/curl/tests/data/test1479
new file mode 100644
index 0000000000..95dc3d11bc
--- /dev/null
+++ b/third-party/curl/tests/data/test1479
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP/0.9
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 5
+
+Data
+</data>
+<data2 crlf="yes">
+Data
+Data
+Data
+</data2>
+<datacheck>
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP/1.1 response followed by an HTTP/0.9 response over the same connection
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER0002
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER0002 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+# weird_server_reply
+<errorcode>
+8
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test148 b/third-party/curl/tests/data/test148
index a8920e2fd4..9a489eddc0 100644
--- a/third-party/curl/tests/data/test148
+++ b/third-party/curl/tests/data/test148
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -18,10 +19,10 @@ REPLY MKD 550 We will have no such thing
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP with --ftp-create-dirs (failing MKD)
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/attempt/to/get/this/%TESTNUMBER --ftp-create-dirs
 </command>
 </client>
@@ -36,7 +37,7 @@ ftp://%HOSTIP:%FTPPORT/attempt/to/get/this/%TESTNUMBER --ftp-create-dirs
 <errorcode>
 9
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1480 b/third-party/curl/tests/data/test1480
new file mode 100644
index 0000000000..298542f538
--- /dev/null
+++ b/third-party/curl/tests/data/test1480
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 100 Continue
+Foo: Bar
+
+Data
+Data
+Data
+</data>
+<datacheck>
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP Continue response without final response
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+
+# weird_server_reply
+<errorcode>
+8
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1481 b/third-party/curl/tests/data/test1481
new file mode 100644
index 0000000000..8a0d310785
--- /dev/null
+++ b/third-party/curl/tests/data/test1481
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+--libcurl
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 OK
+Date: Thu, 29 Jul 2008 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 0
+Connection: close
+
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+proxy
+SSL
+--libcurl
+</features>
+<name>
+--libcurl with TLS version options
+</name>
+<setenv>
+SSL_CERT_FILE
+</setenv>
+<command>
+http://moo/ --libcurl %LOGDIR/test%TESTNUMBER.c --tls-max 1.3 --proxy-tlsv1 -x http://%HOSTIP:%HTTPPORT
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://moo/ HTTP/1.1
+Host: moo
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+<stripfile>
+# CURLOPT_SSL_VERIFYPEER, SSH_KNOWNHOSTS and HTTP_VERSION vary with
+# CURLOPT_INTERLEAVEDATA requires RTSP protocol
+# configurations - ignore them
+$_ = '' if /CURLOPT_SSL_VERIFYPEER/
+$_ = '' if /CURLOPT_SSH_KNOWNHOSTS/
+$_ = '' if /CURLOPT_HTTP_VERSION/
+$_ = '' if /CURLOPT_HTTP09_ALLOWED/
+$_ = '' if /CURLOPT_INTERLEAVEDATA/
+$_ = '' if /CURLOPT_TIMEOUT_MS/
+</stripfile>
+<file name="%LOGDIR/test%TESTNUMBER.c" mode="text">
+%includetext %SRCDIR/data/data%TESTNUMBER.c%
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1482 b/third-party/curl/tests/data/test1482
new file mode 100644
index 0000000000..ca53de9729
--- /dev/null
+++ b/third-party/curl/tests/data/test1482
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+chunked Transfer-Encoding
+DELAY
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 funky chunky!%CR
+Server: fakeit/0.9 fakeitbad/1.0%CR
+Transfer-Encoding: chunked, chunked%CR
+Connection: mooo%CR
+%CR
+40%CR
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%CR
+30%CR
+bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%CR
+21;heresatest=moooo%CR
+cccccccccccccccccccccccccccccccc
+%CR
+0%CR
+chunky-trailer: header data%CR
+another-header: yes%CR
+%CR
+</data>
+<datacheck>
+HTTP/1.1 200 funky chunky!%CR
+Server: fakeit/0.9 fakeitbad/1.0%CR
+Transfer-Encoding: chunked, chunked%CR
+Connection: mooo%CR
+%CR
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbcccccccccccccccccccccccccccccccc
+chunky-trailer: header data%CR
+another-header: yes%CR
+</datacheck>
+<servercmd>
+writedelay: 10
+</servercmd>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP GET with double chunked in TE header
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -D %LOGDIR/heads%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/heads%TESTNUMBER" crlf="headers">
+HTTP/1.1 200 funky chunky!
+Server: fakeit/0.9 fakeitbad/1.0
+Transfer-Encoding: chunked, chunked
+Connection: mooo
+
+chunky-trailer: header data
+another-header: yes
+</file>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1483 b/third-party/curl/tests/data/test1483
new file mode 100644
index 0000000000..c7373b2a46
--- /dev/null
+++ b/third-party/curl/tests/data/test1483
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+chunked Transfer-Encoding
+DELAY
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 funky chunky!%CR
+Server: fakeit/0.9 fakeitbad/1.0%CR
+Transfer-Encoding: chunked%CR
+Transfer-Encoding: chunked%CR
+Connection: mooo%CR
+%CR
+40%CR
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%CR
+30%CR
+bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%CR
+21;heresatest=moooo%CR
+cccccccccccccccccccccccccccccccc
+%CR
+0%CR
+chunky-trailer: header data%CR
+another-header: yes%CR
+%CR
+</data>
+<datacheck>
+HTTP/1.1 200 funky chunky!%CR
+Server: fakeit/0.9 fakeitbad/1.0%CR
+Transfer-Encoding: chunked%CR
+Transfer-Encoding: chunked%CR
+Connection: mooo%CR
+%CR
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbcccccccccccccccccccccccccccccccc
+chunky-trailer: header data%CR
+another-header: yes%CR
+</datacheck>
+<servercmd>
+writedelay: 10
+</servercmd>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP GET with two Transfer-Encoding: chunked headers
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -D %LOGDIR/heads%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/heads%TESTNUMBER" crlf="headers">
+HTTP/1.1 200 funky chunky!
+Server: fakeit/0.9 fakeitbad/1.0
+Transfer-Encoding: chunked
+Transfer-Encoding: chunked
+Connection: mooo
+
+chunky-trailer: header data
+another-header: yes
+</file>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1484 b/third-party/curl/tests/data/test1484
new file mode 100644
index 0000000000..839ff57711
--- /dev/null
+++ b/third-party/curl/tests/data/test1484
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP HEAD
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Transfer-Encoding: chunked
+
+HEAD response with content
+</data>
+# make sure no data is written
+<datacheck crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Transfer-Encoding: chunked
+
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP HEAD with response body to ignore
+</name>
+<command>
+-I http://%HOSTIP:%HTTPPORT/%TESTNUMBER --http1.1
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+HEAD /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1485 b/third-party/curl/tests/data/test1485
new file mode 100644
index 0000000000..55f9a968f6
--- /dev/null
+++ b/third-party/curl/tests/data/test1485
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Server: Someone
+Content-Length: 7
+
+123456
+</data>
+<datacheck crlf="headers">
+HTTP/1.1 200 OK
+Server: Someone
+Content-Length: 7
+
+123456
+</datacheck>
+</reply>
+# Client-side
+<client>
+<server>
+http
+</server>
+<tool>
+lib%TESTNUMBER
+</tool>
+<name>
+get curlinfo on last header in callback
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1486 b/third-party/curl/tests/data/test1486
new file mode 100644
index 0000000000..430a37a1ee
--- /dev/null
+++ b/third-party/curl/tests/data/test1486
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+source analysis
+docs
+--write-out
+</keywords>
+</info>
+
+# Client-side
+<client>
+<name>
+Verify that write-out.md and tool_writeout.c are in sync
+</name>
+
+<command type="perl">
+%SRCDIR/test1486.pl %SRCDIR
+</command>
+</client>
+
+<verify>
+<stdout>
+OK
+</stdout>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1487 b/third-party/curl/tests/data/test1487
new file mode 100644
index 0000000000..2a11be48d8
--- /dev/null
+++ b/third-party/curl/tests/data/test1487
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+-J
+</keywords>
+</info>
+
+<reply>
+<data nocheck="yes">
+HTTP/1.1 301 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
+
+12345
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP GET with -J and Content-Disposition on 301
+</name>
+<command option="no-output,no-include">
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -O --output-dir %LOGDIR
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/name%TESTNUMBER">
+12345
+</file>
+
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1488 b/third-party/curl/tests/data/test1488
new file mode 100644
index 0000000000..bbf2f2a180
--- /dev/null
+++ b/third-party/curl/tests/data/test1488
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+documentation
+symbols-in-versions
+manpages
+</keywords>
+</info>
+
+# Client-side
+<client>
+<name>
+symbols-in-versions and man pages agree on added-in versions
+</name>
+
+<command type="perl">
+%SRCDIR/test1488.pl %SRCDIR/.. ../include/curl %SRCDIR/../docs/VERSIONS.md
+</command>
+</client>
+
+<verify>
+<stdout>
+OK
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1489 b/third-party/curl/tests/data/test1489
new file mode 100644
index 0000000000..4e0acd4528
--- /dev/null
+++ b/third-party/curl/tests/data/test1489
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+-D sent to stderr
+</name>
+<command option="no-include">
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -D % -s
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<stderr crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test149 b/third-party/curl/tests/data/test149
index 180f31f768..240f2f6e1f 100644
--- a/third-party/curl/tests/data/test149
+++ b/third-party/curl/tests/data/test149
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -14,10 +15,10 @@ FTP
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP with multiple uploads
- </name>
- <command>
+</name>
+<command>
 -T %LOGDIR/upload%TESTNUMBER ftp://%HOSTIP:%FTPPORT/dir1/%TESTNUMBER -T %LOGDIR/upload%TESTNUMBER ftp://%HOSTIP:%FTPPORT/dir2/%TESTNUMBER
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
@@ -32,7 +33,7 @@ send away this contents
 ^PORT \d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3}
 ^EPRT \|1\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|\d{1,5}\|
 </strip>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1490 b/third-party/curl/tests/data/test1490
new file mode 100644
index 0000000000..2815e80699
--- /dev/null
+++ b/third-party/curl/tests/data/test1490
@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+FILE
+</keywords>
+</info>
+
+# no Server-side
+
+# Client-side
+<client>
+<server>
+file
+</server>
+<name>
+"upload" with file:// overwriting existing
+</name>
+<command option="no-include">
+file://localhost%FILE_PWD/%LOGDIR/result%TESTNUMBER.txt -T %LOGDIR/upload%TESTNUMBER.txt
+</command>
+<file name="%LOGDIR/upload%TESTNUMBER.txt">
+data
+in
+file
+to
+write
+</file>
+<file2 name="%LOGDIR/result%TESTNUMBER.txt">
+already existing
+</file2>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<file name="%LOGDIR/result%TESTNUMBER.txt">
+data
+in
+file
+to
+write
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1491 b/third-party/curl/tests/data/test1491
new file mode 100644
index 0000000000..ca45aa82e9
--- /dev/null
+++ b/third-party/curl/tests/data/test1491
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+FILE
+</keywords>
+</info>
+
+<reply>
+</reply>
+
+# Client-side
+<client>
+<server>
+file
+</server>
+<name>
+file:// do not overwrite self with --skip-existing
+</name>
+<command option="no-output">
+file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt -o %LOGDIR/test%TESTNUMBER.txt --skip-existing
+</command>
+<file name="%LOGDIR/test%TESTNUMBER.txt">
+foo
+   bar
+bar
+   foo
+moo
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<stderr mode="text">
+Note: skips transfer, "%LOGDIR/test%TESTNUMBER.txt" exists locally
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1492 b/third-party/curl/tests/data/test1492
new file mode 100644
index 0000000000..e4cd426def
--- /dev/null
+++ b/third-party/curl/tests/data/test1492
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+-J
+--show-headers
+</keywords>
+</info>
+
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 6
+Connection: close
+Content-Jisposition: inline; filename="name%TESTNUMBER"
+Content-Type: text/html
+
+12345
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP GET with -J + --show-headers but no Content-Disposition:
+</name>
+<command option="no-output,no-include">
+http://%HOSTIP:%HTTPPORT/junk%TESTNUMBER -J -O --show-headers --output-dir %LOGDIR
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /junk%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/junk%TESTNUMBER">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 6
+Connection: close
+Content-Jisposition: inline; filename="name%TESTNUMBER"
+Content-Type: text/html
+
+12345
+</file>
+
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1493 b/third-party/curl/tests/data/test1493
new file mode 100644
index 0000000000..d2583d053f
--- /dev/null
+++ b/third-party/curl/tests/data/test1493
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+chunked Transfer-Encoding
+DELAY
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 funky chunky!%CR
+Server: fakeit/0.9 fakeitbad/1.0%CR
+Transfer-Encoding: identity, chunked%CR
+Connection: mooo%CR
+%CR
+40%CR
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%CR
+30%CR
+bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%CR
+21;heresatest=moooo%CR
+cccccccccccccccccccccccccccccccc
+%CR
+0%CR
+chunky-trailer: header data%CR
+another-header: yes%CR
+%CR
+</data>
+<datacheck>
+HTTP/1.1 200 funky chunky!%CR
+Server: fakeit/0.9 fakeitbad/1.0%CR
+Transfer-Encoding: identity, chunked%CR
+Connection: mooo%CR
+%CR
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbcccccccccccccccccccccccccccccccc
+chunky-trailer: header data%CR
+another-header: yes%CR
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP GET with identity + chunked in TE header
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -D %LOGDIR/heads%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/heads%TESTNUMBER" crlf="headers">
+HTTP/1.1 200 funky chunky!
+Server: fakeit/0.9 fakeitbad/1.0
+Transfer-Encoding: identity, chunked
+Connection: mooo
+
+chunky-trailer: header data
+another-header: yes
+</file>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1494 b/third-party/curl/tests/data/test1494
new file mode 100644
index 0000000000..cd661eb380
--- /dev/null
+++ b/third-party/curl/tests/data/test1494
@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+chunked Transfer-Encoding
+DELAY
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 funky chunky!
+Server: fakeit/0.9 fakeitbad/1.0
+Transfer-Encoding: identity, identity
+Content-Length: 19
+
+stuff server sends
+</data>
+
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP GET with identity twice in TE header
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -D %LOGDIR/heads%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1495 b/third-party/curl/tests/data/test1495
new file mode 100644
index 0000000000..ddcc5715fe
--- /dev/null
+++ b/third-party/curl/tests/data/test1495
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+chunked Transfer-Encoding
+DELAY
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 funky chunky!
+Server: fakeit/0.9 fakeitbad/1.0
+Transfer-Encoding: chunked, identity
+Content-Length: 19
+
+stuff server sends
+</data>
+
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP GET with chunked + identity in TE header
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -D %LOGDIR/heads%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<errorcode>
+61
+</errorcode>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1496 b/third-party/curl/tests/data/test1496
new file mode 100644
index 0000000000..70cfd0f9e5
--- /dev/null
+++ b/third-party/curl/tests/data/test1496
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+chunked Transfer-Encoding
+DELAY
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 funky chunky!
+Server: fakeit/0.9 fakeitbad/1.0
+Transfer-Encoding: gzip, chunked
+Content-Length: 19
+
+stuff server sends
+</data>
+
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP GET with gzip + chunked transfer-encoding without being asked
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -D %LOGDIR/heads%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<errorcode>
+61
+</errorcode>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1497 b/third-party/curl/tests/data/test1497
new file mode 100644
index 0000000000..19f198a9e6
--- /dev/null
+++ b/third-party/curl/tests/data/test1497
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+retry
+</keywords>
+</info>
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 503 BAD swsbounce
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 21
+
+server not available
+</data>
+<data1 nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 3
+Connection: close
+
+ok
+</data1>
+
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP GET --retry on 503 error with output to /dev/null
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --retry 3 -o /dev/null
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1498 b/third-party/curl/tests/data/test1498
new file mode 100644
index 0000000000..67c3f8409d
--- /dev/null
+++ b/third-party/curl/tests/data/test1498
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+# Similar to test 60 and 1068
+<info>
+<keywords>
+HTTP
+HTTP PUT
+chunked Transfer-Encoding
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.0 200 OK swsclose
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+
+blablabla
+
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+!win32
+</features>
+<name>
+HTTP PUT from stdin using period
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/bzz/%TESTNUMBER -T .
+</command>
+<stdin>
+%repeat[2000 x hej]%
+</stdin>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol>
+PUT /bzz/%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Transfer-Encoding: chunked%CR
+Expect: 100-continue%CR
+%CR
+1771%CR
+%repeat[2000 x hej]%
+%CR
+0%CR
+%CR
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1499 b/third-party/curl/tests/data/test1499
new file mode 100644
index 0000000000..843165f048
--- /dev/null
+++ b/third-party/curl/tests/data/test1499
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+chunked Transfer-Encoding
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 funky chunky!%CR
+Server: fakeit/0.9 fakeitbad/1.0%CR
+Transfer-Encoding: chunked%CR
+Trailer: chunky-trailer%CR
+Connection: mooo%CR
+%CR
+40%CR
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%CR
+30%CR
+bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%CR
+21;heresatest=moooo%CR
+cccccccccccccccccccccccccccccccc
+%CR
+0%CR
+chunky-trailer: header data%CR
+%CR
+</data>
+<datacheck>
+HTTP/1.1 200 funky chunky!%CR
+Server: fakeit/0.9 fakeitbad/1.0%CR
+Transfer-Encoding: chunked%CR
+Trailer: chunky-trailer%CR
+Connection: mooo%CR
+%CR
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbcccccccccccccccccccccccccccccccc
+chunky-trailer: header data%CR
+</datacheck>
+<servercmd>
+writedelay: 10
+</servercmd>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP chunked encoding and chunked trailer, twice
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER -D %LOGDIR/heads%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test15 b/third-party/curl/tests/data/test15
index a78213c6d1..548b119fae 100644
--- a/third-party/curl/tests/data/test15
+++ b/third-party/curl/tests/data/test15
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP GET
 </info>
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Fake: yes
 Fake: yes
@@ -24,17 +25,17 @@ Repeated nonsense-headers
 <server>
 http
 </server>
- <name>
+<name>
 --write-out test
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER --write-out "%{url_effective} %{http_code} %{size_download}\n"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 200 OK
 Fake: yes
 Fake: yes
@@ -44,7 +45,7 @@ Content-Length: 26
 Repeated nonsense-headers
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER 200 26
 </stdout>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test150 b/third-party/curl/tests/data/test150
index fa1322d0da..0a7f26ee52 100644
--- a/third-party/curl/tests/data/test150
+++ b/third-party/curl/tests/data/test150
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -16,7 +17,7 @@ NTLM
 This is supposed to be returned when the server gets a first
 Authorization: NTLM line passed-in from the client -->
 
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 401 Now gimme that second request of crap
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -28,7 +29,7 @@ This is not the real page either!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 200 Things are fine in server land swsclose
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -37,7 +38,7 @@ Content-Length: 32
 Finally, this is the real page!
 </data1002>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Now gimme that second request of crap
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -74,10 +75,10 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --ntlm --fail
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test1500 b/third-party/curl/tests/data/test1500
index 85f20e3a03..6f5bfa034f 100644
--- a/third-party/curl/tests/data/test1500
+++ b/third-party/curl/tests/data/test1500
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ multi
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 all good!
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -34,10 +35,10 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 curl_multi_wait
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
diff --git a/third-party/curl/tests/data/test1501 b/third-party/curl/tests/data/test1501
index 5ba71c1f16..2c6bd8f1f9 100644
--- a/third-party/curl/tests/data/test1501
+++ b/third-party/curl/tests/data/test1501
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -30,10 +31,10 @@ lib%TESTNUMBER
 <killserver>
 ftp
 </killserver>
- <name>
+<name>
 FTP with multi interface and slow LIST response
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER/
 </command>
 </client>
@@ -42,7 +43,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER/
 <errorcode>
 0
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1502 b/third-party/curl/tests/data/test1502
index e95682c493..f1004ba06c 100644
--- a/third-party/curl/tests/data/test1502
+++ b/third-party/curl/tests/data/test1502
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ CURLOPT_RESOLVE
 </info>
 
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -25,7 +26,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -34,18 +34,17 @@ http
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 HTTP multi with CURLOPT_RESOLVE, cleanup sequence UA
- </name>
- <command>
+</name>
+<command>
 http://google.com:%HTTPPORT/%TESTNUMBER %HTTPPORT %HOSTIP
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: google.com:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1503 b/third-party/curl/tests/data/test1503
index 010d578b08..758e12d930 100644
--- a/third-party/curl/tests/data/test1503
+++ b/third-party/curl/tests/data/test1503
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ CURLOPT_RESOLVE
 </info>
 
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -25,27 +26,25 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 <tool>
-lib%TESTNUMBER
+lib1502
 </tool>
- <name>
+<name>
 HTTP multi with CURLOPT_RESOLVE, cleanup sequence PA
- </name>
- <command>
+</name>
+<command>
 http://google.com:%HTTPPORT/%TESTNUMBER %HTTPPORT %HOSTIP
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: google.com:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1504 b/third-party/curl/tests/data/test1504
index 71c8ec8929..35a624db65 100644
--- a/third-party/curl/tests/data/test1504
+++ b/third-party/curl/tests/data/test1504
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ CURLOPT_RESOLVE
 </info>
 
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -25,27 +26,25 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 <tool>
-lib%TESTNUMBER
+lib1502
 </tool>
- <name>
+<name>
 HTTP multi with CURLOPT_RESOLVE, cleanup sequence UB
- </name>
- <command>
+</name>
+<command>
 http://google.com:%HTTPPORT/%TESTNUMBER %HTTPPORT %HOSTIP
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: google.com:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1505 b/third-party/curl/tests/data/test1505
index 2f32cb4fd3..7925f185bb 100644
--- a/third-party/curl/tests/data/test1505
+++ b/third-party/curl/tests/data/test1505
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ CURLOPT_RESOLVE
 </info>
 
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -25,27 +26,25 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 <tool>
-lib%TESTNUMBER
+lib1502
 </tool>
- <name>
+<name>
 HTTP multi with CURLOPT_RESOLVE, cleanup sequence PB
- </name>
- <command>
+</name>
+<command>
 http://google.com:%HTTPPORT/%TESTNUMBER %HTTPPORT %HOSTIP
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: google.com:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1506 b/third-party/curl/tests/data/test1506
index a274c530a8..7801fead66 100644
--- a/third-party/curl/tests/data/test1506
+++ b/third-party/curl/tests/data/test1506
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ verbose logs
 
 # Server-side
 <reply>
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -17,7 +18,7 @@ Content-Length: 47
 
 file contents should appear once for each file
 </data1>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -25,7 +26,7 @@ Content-Length: 47
 
 file contents should appear once for each file
 </data2>
-<data3>
+<data3 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -33,7 +34,7 @@ Content-Length: 47
 
 file contents should appear once for each file
 </data3>
-<data4>
+<data4 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -48,20 +49,23 @@ file contents should appear once for each file
 <server>
 http
 </server>
+<features>
+verbose-strings
+</features>
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 HTTP GET connection cache limit (CURLMOPT_MAXCONNECTS)
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/path/%TESTNUMBER %HOSTIP %HTTPPORT
+</name>
+<command>
+- %HOSTIP %HTTPPORT
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /path/%TESTNUMBER0001 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
@@ -83,14 +87,13 @@ Accept: */*
 ^Host:.*
 </strip>
 <file name="%LOGDIR/stderr%TESTNUMBER" mode="text">
-* Connection #0 to host server1.example.com left intact
-* Connection #1 to host server2.example.com left intact
-* Connection #2 to host server3.example.com left intact
-* Closing connection
-* Connection #3 to host server4.example.com left intact
+* Connection #0 to host server1.example.com:%HTTPPORT left intact
+* Connection #1 to host server2.example.com:%HTTPPORT left intact
+* Connection #2 to host server3.example.com:%HTTPPORT left intact
+* Connection #3 to host server4.example.com:%HTTPPORT left intact
 </file>
 <stripfile>
-$_ = '' if (($_ !~ /left intact/) && ($_ !~ /Closing connection/))
+$_ = '' if(($_ !~ /left intact/) and ($_ !~ /Closing connection/))
 </stripfile>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1507 b/third-party/curl/tests/data/test1507
index bc5bc967c8..807793d27a 100644
--- a/third-party/curl/tests/data/test1507
+++ b/third-party/curl/tests/data/test1507
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,10 @@ multi
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -22,27 +21,26 @@ lib%TESTNUMBER
 </tool>
 
 # based on bug report #1184
- <name>
+<name>
 SMTP with multi interface and CURLE_ABORTED_BY_CALLBACK
- </name>
+</name>
 <stdin>
 From: different
 To: another
 
 body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<%TESTNUMBER-realuser@example.com>
-RCPT TO:<%TESTNUMBER-recipient@example.com>
+MAIL FROM:%LT%TESTNUMBER-realuser@example.com%GT
+RCPT TO:%LT%TESTNUMBER-recipient@example.com%GT
 DATA
 </protocol>
 <upload>
diff --git a/third-party/curl/tests/data/test1508 b/third-party/curl/tests/data/test1508
index 78ff18fb3d..72f6dee075 100644
--- a/third-party/curl/tests/data/test1508
+++ b/third-party/curl/tests/data/test1508
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,18 +9,12 @@ multi
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 Close a multi handle without using it
- </name>
- <command>
-http://%HOSTIP:%NOLISTENPORT/path/%TESTNUMBER
-</command>
+</name>
 </client>
 
 # Verify data after the test has been "shot"
diff --git a/third-party/curl/tests/data/test1509 b/third-party/curl/tests/data/test1509
index c0f8a11c0f..7e57cd0fad 100644
--- a/third-party/curl/tests/data/test1509
+++ b/third-party/curl/tests/data/test1509
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -14,13 +15,13 @@ proxytunnel
 <servercmd>
 connection-monitor
 </servercmd>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 Server: the beast that eats naughty clients
 
 </connect>
 
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -28,7 +29,7 @@ Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
 ETag: "21025-dc7-39462498"
 
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 Server: the beast that eats naughty clients
 
@@ -56,10 +57,10 @@ lib%TESTNUMBER
 <features>
 proxy
 </features>
- <name>
-simple multi http:// through proxytunnel with authentication info
- </name>
- <command>
+<name>
+http:// through proxytunnel
+</name>
+<command>
 http://the.old.moo.%TESTNUMBER:%HTTPPORT/%TESTNUMBER %HOSTIP:%PROXYPORT
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
@@ -73,14 +74,14 @@ moo
 
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 CONNECT the.old.moo.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: the.old.moo.%TESTNUMBER:%HTTPPORT
 Proxy-Connection: Keep-Alive
 
 [DISCONNECT]
 </proxy>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: the.old.moo.%TESTNUMBER:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test151 b/third-party/curl/tests/data/test151
index f432058e6c..77dbe359a2 100644
--- a/third-party/curl/tests/data/test151
+++ b/third-party/curl/tests/data/test151
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -13,8 +14,8 @@ HTTP/1.0 401 BAD BOY
 Server: swsclose
 Content-Type: text/html
 
-This contains a response code >= 400, so curl shouldn't display this.  Even
-though it's a response code that triggers authentication, we're not using
+This contains a response code >= 400, so curl should not display this.  Even
+though it is a response code that triggers authentication, we are not using
 authentication so we should still fail.
 </data>
 </reply>
@@ -24,17 +25,17 @@ authentication so we should still fail.
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with an error code that might trick authentication
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1510 b/third-party/curl/tests/data/test1510
index 1455b9b433..90771e6979 100644
--- a/third-party/curl/tests/data/test1510
+++ b/third-party/curl/tests/data/test1510
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ flaky
 
 # Server-side
 <reply>
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -17,7 +18,7 @@ Content-Length: 47
 
 file contents should appear once for each file
 </data1>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -25,7 +26,7 @@ Content-Length: 47
 
 file contents should appear once for each file
 </data2>
-<data3>
+<data3 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -33,7 +34,7 @@ Content-Length: 47
 
 file contents should appear once for each file
 </data3>
-<data4>
+<data4 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -51,17 +52,17 @@ http
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 HTTP GET connection cache limit (CURLOPT_MAXCONNECTS)
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/path/%TESTNUMBER %HOSTIP %HTTPPORT
+</name>
+<command>
+- %HOSTIP %HTTPPORT
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /path/%TESTNUMBER0001 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
@@ -83,14 +84,13 @@ Accept: */*
 ^Host:.*
 </strip>
 <file name="%LOGDIR/stderr%TESTNUMBER" mode="text">
-* Connection #0 to host server1.example.com left intact
-* Connection #1 to host server2.example.com left intact
-* Connection #2 to host server3.example.com left intact
-* Closing connection 0
-* Connection #3 to host server4.example.com left intact
+* Connection #0 to host server1.example.com:%HTTPPORT left intact
+* Connection #1 to host server2.example.com:%HTTPPORT left intact
+* Connection #2 to host server3.example.com:%HTTPPORT left intact
+* Connection #3 to host server4.example.com:%HTTPPORT left intact
 </file>
 <stripfile>
-$_ = '' if (($_ !~ /left intact/) && ($_ !~ /Closing connection/))
+$_ = '' if(($_ !~ /left intact/) and ($_ !~ /Closing connection/))
 </stripfile>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1511 b/third-party/curl/tests/data/test1511
index 416e411022..ad41ffaaf2 100644
--- a/third-party/curl/tests/data/test1511
+++ b/third-party/curl/tests/data/test1511
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ CURLOPT_TIMECONDITION
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fakem
@@ -20,7 +21,7 @@ Connection: close
 Hello World
 </data>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fakem
@@ -62,10 +63,10 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </client>
 
 # Verify data after the test has been "shot"
-# TEST_ERR_SUCCESS is errorcode 120
+# TEST_ERR_SUCCESS is errorcode 41
 <verify>
 <errorcode>
-120
+41
 </errorcode>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1512 b/third-party/curl/tests/data/test1512
index cc857c4b5b..d62d5c1717 100644
--- a/third-party/curl/tests/data/test1512
+++ b/third-party/curl/tests/data/test1512
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ GLOBAL DNS CACHE
 
 # Server-side
 <reply>
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -16,7 +17,7 @@ Content-Length: 47
 
 file contents should appear once for each file
 </data1>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -24,7 +25,7 @@ Content-Length: 47
 
 file contents should appear once for each file
 </data2>
-<data3>
+<data3 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -32,7 +33,7 @@ Content-Length: 47
 
 file contents should appear once for each file
 </data3>
-<data4>
+<data4 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -50,17 +51,17 @@ http
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 GLOBAL CACHE test over two easy performs
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/path/%TESTNUMBER %HOSTIP %HTTPPORT
+</name>
+<command>
+- %HOSTIP %HTTPPORT
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /path/%TESTNUMBER0001 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
@@ -74,7 +75,7 @@ Accept: */*
 ^Host:.*
 </strip>
 <stripfile>
-$_ = '' if (($_ !~ /left intact/) && ($_ !~ /Closing connection/))
+$_ = '' if(($_ !~ /left intact/) and ($_ !~ /Closing connection/))
 </stripfile>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1513 b/third-party/curl/tests/data/test1513
index 19ed90e947..b84183846d 100644
--- a/third-party/curl/tests/data/test1513
+++ b/third-party/curl/tests/data/test1513
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ DELAY
 
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 204 PARTIAL
 X-Comment: partial response to keep the client waiting
 </data>
@@ -25,20 +26,18 @@ http
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 return failure immediately from progress callback
- </name>
+</name>
 
-# this server/host won't be used for real
- <command>
+# this server/host is not used for real
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-</protocol>
 # 42 == CURLE_ABORTED_BY_CALLBACK
 <errorcode>
 42
diff --git a/third-party/curl/tests/data/test1514 b/third-party/curl/tests/data/test1514
index 94580134a7..0cc1900104 100644
--- a/third-party/curl/tests/data/test1514
+++ b/third-party/curl/tests/data/test1514
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ chunked Transfer-Encoding
 
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Sun, 19 Jan 2014 18:50:58 GMT
 Server: test-server/fake swsclose
@@ -39,7 +40,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 <verify>
 # Content-Length header is not present
 # Transfer-Encoding header is added automatically
-<protocol>
+<protocol crlf="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1515 b/third-party/curl/tests/data/test1515
index c75671ad02..2ad5ac0797 100644
--- a/third-party/curl/tests/data/test1515
+++ b/third-party/curl/tests/data/test1515
@@ -1,16 +1,16 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 
 <info>
 <keywords>
 HTTP
 multi
-FAILURE
 resolve
 </keywords>
 </info>
 
 <reply>
-# Close the connection after the first request. Second request will happen after
+# Close the connection after the first request. Second request happens after
 # the DNS cache timeout elapses and must succeed exactly like the first one.
 <data1>
 HTTP/1.1 200 OK
diff --git a/third-party/curl/tests/data/test1516 b/third-party/curl/tests/data/test1516
index 79f0275f03..02f2c6d84f 100644
--- a/third-party/curl/tests/data/test1516
+++ b/third-party/curl/tests/data/test1516
@@ -1,17 +1,17 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 
 <info>
 <keywords>
 HTTP
 multi
-FAILURE
 resolve
 </keywords>
 </info>
 
 <reply>
-# Close the connection after the first request but don't tell the client to do
-# so! When starting the second request it'll detect a dead connection and must
+# Close the connection after the first request but do not tell the client to do
+# so! When starting the second request it detects a dead connection and must
 # not clean the DNS entries added manually.
 <data1>
 HTTP/1.1 200 OK
@@ -45,7 +45,7 @@ lib1515
 caching of manual libcurl DNS entries after dead connection
 </name>
 <command>
-/path/%TESTNUMBER %HOSTIP %HTTPPORT
+path/%TESTNUMBER %HOSTIP %HTTPPORT
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test1517 b/third-party/curl/tests/data/test1517
index 0a69c47d56..6b53c3955d 100644
--- a/third-party/curl/tests/data/test1517
+++ b/third-party/curl/tests/data/test1517
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,13 +9,11 @@ slow callback
 early response
 </keywords>
 </info>
-#
 # This test checks to make sure curl can call recv() without failing after a
 # send() fails on the same socket (#657). Most OSes should support this
 # natively. On Windows there were reported problems and a workaround via
 # define USE_RECV_BEFORE_SEND_WORKAROUND was added.
 # This proved problematic in other cases and was removed again.
-#
 # Server-side
 <reply>
 # Force server reply right after request headers, not waiting for request body
@@ -36,6 +35,11 @@ This is a virtual description of server virtual error.
 
 # Client-side
 <client>
+# Windows TCP does not deliver response data but reports CONNABORTED
+<features>
+!cygwin
+!win32
+</features>
 <server>
 http
 </server>
@@ -43,27 +47,20 @@ http
 <tool>
 lib%TESTNUMBER
 </tool>
-# precheck is a command line to run before the test, to see if we can execute
-# the test or not
-<precheck>
-./libtest/lib%TESTNUMBER check
-</precheck>
-
- <name>
+<name>
 HTTP POST, server responds before completed send
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
 s/^(this is what we post to the silly web server)(\r)?\n//
 </strippart>
-<protocol>
+<protocol crlf="headers">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1518 b/third-party/curl/tests/data/test1518
index 9b3f6be605..096765e870 100644
--- a/third-party/curl/tests/data/test1518
+++ b/third-party/curl/tests/data/test1518
@@ -1,12 +1,11 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 </keywords>
 </info>
-#
 # This reproduces issue #3340
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -32,24 +31,21 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 Extract Location: with broken URL
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
 
 </strippart>
-<protocol>
-</protocol>
 <stdout>
-res 0
+result 0
 status 302
 redirects 0
 effectiveurl http://%HOSTIP:%HTTPPORT/%TESTNUMBER
diff --git a/third-party/curl/tests/data/test1519 b/third-party/curl/tests/data/test1519
index 2eadb17060..7dd2252850 100644
--- a/third-party/curl/tests/data/test1519
+++ b/third-party/curl/tests/data/test1519
@@ -1,12 +1,11 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 </keywords>
 </info>
-#
 # This reproduces issue #3340
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -32,24 +31,21 @@ http
 lib1518
 </tool>
 
- <name>
+<name>
 Extract Location: with broken absolute URL
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
 
 </strippart>
-<protocol>
-</protocol>
 <stdout>
-res 0
+result 0
 status 302
 redirects 0
 effectiveurl http://%HOSTIP:%HTTPPORT/%TESTNUMBER
diff --git a/third-party/curl/tests/data/test152 b/third-party/curl/tests/data/test152
index 349ec1c6ac..454beb83ac 100644
--- a/third-party/curl/tests/data/test152
+++ b/third-party/curl/tests/data/test152
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -14,8 +15,8 @@ HTTP/1.0 401 BAD BOY
 Server: swsclose
 Content-Type: text/html
 
-This contains a response code >= 400, so curl shouldn't display this.  Even
-though it's a response code that triggers authentication, we're not using
+This contains a response code >= 400, so curl should not display this.  Even
+though it is a response code that triggers authentication, we are not using
 authentication so we should still fail.
 </data>
 </reply>
@@ -25,17 +26,17 @@ authentication so we should still fail.
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with an error code that might trick authentication and --fail
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --fail
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1520 b/third-party/curl/tests/data/test1520
index 641c300db6..c26c08866f 100644
--- a/third-party/curl/tests/data/test1520
+++ b/third-party/curl/tests/data/test1520
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Based off test 901 after bug report #1456
 <info>
@@ -6,7 +7,6 @@ SMTP
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
@@ -16,10 +16,10 @@ smtp
 lib%TESTNUMBER
 </tool>
 
- <name>
-SMTP with CRLF-dot-CRLF in data
- </name>
-<stdin>
+<name>
+SMTP with CRLF-dot-CRLF in upload payload
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
@@ -31,22 +31,21 @@ To: another
 
 body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
diff --git a/third-party/curl/tests/data/test1521 b/third-party/curl/tests/data/test1521
index f086243e43..e86125b2e7 100644
--- a/third-party/curl/tests/data/test1521
+++ b/third-party/curl/tests/data/test1521
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,26 +6,21 @@ curl_easy_setopt
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <tool>
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 Test all curl_easy_setopt and curl_easy_getinfo options
- </name>
- <command>
-unused
-</command>
+</name>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
+<stdout>
+ok
+</stdout>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1522 b/third-party/curl/tests/data/test1522
index 07dfb8209d..581ecf6dc9 100644
--- a/third-party/curl/tests/data/test1522
+++ b/third-party/curl/tests/data/test1522
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -22,7 +23,6 @@ Funny-head: yesyes
 -foo-
 </data>
 </reply>
-#
 # Client-side
 <client>
 <server>
@@ -41,7 +41,6 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <stdout>
diff --git a/third-party/curl/tests/data/test1523 b/third-party/curl/tests/data/test1523
index 7cc94ba47a..6fb4c6b7d0 100644
--- a/third-party/curl/tests/data/test1523
+++ b/third-party/curl/tests/data/test1523
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -21,7 +22,6 @@ AA
 writedelay: 1000
 </servercmd>
 </reply>
-#
 # Client-side
 <client>
 <server>
@@ -43,7 +43,6 @@ http
 </killserver>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 </verify>
diff --git a/third-party/curl/tests/data/test1524 b/third-party/curl/tests/data/test1524
index c90981e50f..19ff4aa56f 100644
--- a/third-party/curl/tests/data/test1524
+++ b/third-party/curl/tests/data/test1524
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,11 @@ HTTP PUT
 followlocation
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
 HTTP/1.1 303 OK swsclose
-Location: moo.html&testcase=/%TESTNUMBER0002
+Location: moo.html%AMPtestcase=/%TESTNUMBER0002
 Connection: close
 
 </data>
@@ -24,7 +24,7 @@ body
 </data2>
 <datacheck>
 HTTP/1.1 303 OK swsclose
-Location: moo.html&testcase=/%TESTNUMBER0002
+Location: moo.html%AMPtestcase=/%TESTNUMBER0002
 Connection: close
 
 HTTP/1.1 200 OK swsclose
@@ -35,16 +35,15 @@ body
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP PUT with 303 redirect
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/blah/%TESTNUMBER -L -T %LOGDIR/upload%TESTNUMBER.txt
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER.txt">
@@ -52,10 +51,9 @@ moo
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="headers" nonewline="yes">
 PUT /blah/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -63,7 +61,7 @@ Accept: */*
 Content-Length: 4
 
 moo
-GET /blah/moo.html&testcase=/%TESTNUMBER0002 HTTP/1.1
+GET /blah/moo.html%AMPtestcase=/%TESTNUMBER0002 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test1525 b/third-party/curl/tests/data/test1525
index 7f79e0c9aa..c090feb5d3 100644
--- a/third-party/curl/tests/data/test1525
+++ b/third-party/curl/tests/data/test1525
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,7 +13,7 @@ CURLOPT_PROXYHEADER
 
 # Server-side
 <reply>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 OK
 
 </connect>
@@ -25,8 +26,8 @@ ETag: "21025-dc7-39462498"
 
 </data>
 <datacheck>
-HTTP/1.1 200 OK
-
+HTTP/1.1 200 OK%CR
+%CR
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -45,11 +46,11 @@ http-proxy
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 CURLOPT_PROXYHEADER is ignored CURLHEADER_UNIFIED
- </name>
- <command>
- http://the.old.moo.%TESTNUMBER:%HTTPPORT/%TESTNUMBER %HOSTIP:%PROXYPORT
+</name>
+<command>
+http://the.old.moo.%TESTNUMBER:%HTTPPORT/%TESTNUMBER %HOSTIP:%PROXYPORT
 </command>
 <features>
 proxy
@@ -58,14 +59,14 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 CONNECT the.old.moo.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: the.old.moo.%TESTNUMBER:%HTTPPORT
 Proxy-Connection: Keep-Alive
 User-Agent: Http Agent
 
 </proxy>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER HTTP/1.1
 Host: the.old.moo.%TESTNUMBER:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1526 b/third-party/curl/tests/data/test1526
index e018b5100b..6c78989fa3 100644
--- a/third-party/curl/tests/data/test1526
+++ b/third-party/curl/tests/data/test1526
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,12 +13,12 @@ CURLOPT_PROXYHEADER
 
 # Server-side
 <reply>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 OK
 Server: present
 
 </connect>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -25,7 +26,7 @@ Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
 ETag: "21025-dc7-39462498"
 
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Server: present
 
@@ -47,11 +48,11 @@ http-proxy
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 CURLOPT_PROXYHEADER: separate host/proxy headers
- </name>
- <command>
- http://the.old.moo.%TESTNUMBER:%HTTPPORT/%TESTNUMBER %HOSTIP:%PROXYPORT
+</name>
+<command>
+http://the.old.moo.%TESTNUMBER:%HTTPPORT/%TESTNUMBER %HOSTIP:%PROXYPORT
 </command>
 <features>
 proxy
@@ -60,14 +61,14 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 CONNECT the.old.moo.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: the.old.moo.%TESTNUMBER:%HTTPPORT
 Proxy-Connection: Keep-Alive
 User-Agent: Proxy Agent
 
 </proxy>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER HTTP/1.1
 Host: the.old.moo.%TESTNUMBER:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1527 b/third-party/curl/tests/data/test1527
index c72c721889..731aea2ac9 100644
--- a/third-party/curl/tests/data/test1527
+++ b/third-party/curl/tests/data/test1527
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,12 +12,12 @@ proxytunnel
 
 # Server-side
 <reply>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 OK
 We-are: good
 
 </connect>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -24,7 +25,7 @@ Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
 ETag: "21025-dc7-39462498"
 
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 We-are: good
 
@@ -46,11 +47,11 @@ http-proxy
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
-Check same headers are generated with CURLOPT_HEADEROPT == CURLHEADER_UNIFIED
- </name>
- <command>
- http://the.old.moo.%TESTNUMBER:%HTTPPORT/%TESTNUMBER %HOSTIP:%PROXYPORT
+<name>
+Same headers with CURLOPT_HEADEROPT == CURLHEADER_UNIFIED
+</name>
+<command>
+http://the.old.moo.%TESTNUMBER:%HTTPPORT/%TESTNUMBER %HOSTIP:%PROXYPORT
 </command>
 <features>
 proxy
@@ -59,7 +60,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 CONNECT the.old.moo.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: the.old.moo.%TESTNUMBER:%HTTPPORT
 Proxy-Connection: Keep-Alive
@@ -67,7 +68,7 @@ User-Agent: Http Agent
 Expect: 100-continue
 
 </proxy>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER HTTP/1.1
 Host: the.old.moo.%TESTNUMBER:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1528 b/third-party/curl/tests/data/test1528
index 602749b7b2..a2994988bd 100644
--- a/third-party/curl/tests/data/test1528
+++ b/third-party/curl/tests/data/test1528
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,12 +12,12 @@ proxytunnel
 
 # Server-side
 <reply>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 OK
 We-are: good
 
 </connect>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -37,11 +38,11 @@ http-proxy
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 Separately specified proxy/server headers sent in a proxy GET
- </name>
- <command>
- http://the.old.moo:%HTTPPORT/%TESTNUMBER %HOSTIP:%PROXYPORT
+</name>
+<command>
+http://the.old.moo:%HTTPPORT/%TESTNUMBER %HOSTIP:%PROXYPORT
 </command>
 <features>
 proxy
@@ -50,7 +51,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 GET http://the.old.moo:%HTTPPORT/%TESTNUMBER HTTP/1.1
 Host: the.old.moo:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1529 b/third-party/curl/tests/data/test1529
index aa9c5910d3..f31f70fb44 100644
--- a/third-party/curl/tests/data/test1529
+++ b/third-party/curl/tests/data/test1529
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ HTTP proxy
 
 # Server-side
 <reply>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 OK
 We-are: good
 
@@ -25,11 +26,11 @@ http-proxy
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 HTTP request-injection in URL sent over proxy
- </name>
- <command>
- "http://the.old.moo:%HTTPPORT/%TESTNUMBER" %HOSTIP:%PROXYPORT
+</name>
+<command>
+"http://the.old.moo:%HTTPPORT/%TESTNUMBER" %HOSTIP:%PROXYPORT
 </command>
 <features>
 proxy
diff --git a/third-party/curl/tests/data/test153 b/third-party/curl/tests/data/test153
index 7ef9d712c1..e2b8ebf3fb 100644
--- a/third-party/curl/tests/data/test153
+++ b/third-party/curl/tests/data/test153
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ HTTP Digest auth
 # Server-side
 <reply>
 # First reply back and ask for Digest auth
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145"
@@ -21,7 +22,7 @@ This is not the real page
 </data1>
 
 # second reply back
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145"
@@ -33,7 +34,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 200 OK
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -42,11 +43,10 @@ Content-Length: 23
 This IS the real page!
 </data1001>
 
-#
 # This is the second request, and this sends back a response saying that
 # the request contained stale data. We want an update. Set swsbounce to
 # bounce on to data1003 on the second request.
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 401 Authorization re-negotiation please swsbounce
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", algorithm=MD5, nonce="999999", stale=true, qop="auth"
@@ -56,9 +56,9 @@ Content-Length: 26
 This is not the real page
 </data1002>
 
-# The second request to the 1002 section will bounce this one back instead
+# The second request to the 1002 section bounces this one back instead
 # thanks to the swsbounce keyword up there
-<data1003>
+<data1003 crlf="headers">
 HTTP/1.1 200 OK
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -76,11 +76,12 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP with Digest authorization with stale=true
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001 -u testuser:testpass --digest http://%HOSTIP:%HTTPPORT/%TESTNUMBER0002
 </command>
 </client>
@@ -90,7 +91,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001 -u testuser:testpass --digest http://%H
 <strip>
 ^Authorization.*cnonce
 </strip>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0001 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -115,12 +116,12 @@ Accept: */*
 
 GET /%TESTNUMBER0002 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Digest username="testuser", realm="testrealm", nonce="999999", uri="/%TESTNUMBER0002", cnonce="MTA4MzIy", nc="00000001", qop="auth", response="25291c357671604a16c0242f56721c07", algorithm=MD5
+Authorization: Digest username="testuser", realm="testrealm", nonce="999999", uri="/%TESTNUMBER0002", cnonce="MTA4MzIr", nc="00000001", qop="auth", response="25291c357671604a16c0242f56721c07", algorithm=MD5
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145"
diff --git a/third-party/curl/tests/data/test1530 b/third-party/curl/tests/data/test1530
index 0fbd21cf07..dba6bce5c5 100644
--- a/third-party/curl/tests/data/test1530
+++ b/third-party/curl/tests/data/test1530
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,18 +7,15 @@ CURLOPT_OPENSOCKETFUNCTION
 </info>
 
 <client>
-<server>
-none
-</server>
 <features>
 http
 </features>
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 CURLOPT_OPENSOCKETFUNCTION returns bad socket
- </name>
+</name>
 </client>
 
 # it should be detected and an error should be reported
diff --git a/third-party/curl/tests/data/test1531 b/third-party/curl/tests/data/test1531
index e590af08ba33e1a4a9661dc24580d1043af5dfd4..d85ccf49b70fcb666d45c578e18201031129e6da 100644
GIT binary patch
delta 158
zcmdnX@`FXo#=asqN1-gWs5mn}&sND$&p=5bH7_|oB{MJGRw*=C*D=`H(^JXbj%&h#
zi3{B(zL?0BT$Gb$t5lg<tTefTQOAtSBfq%BN<r1bKRCoQz)IC4BqSifKPZIDF*!N4
z04SrSuf^q@pI4HaSEB2anwMUZVWnU(`5vQz1Q(ZTMruX0s!?iUQnIRnK}BU%EKopo
IvJ{gt01pB(R{#J2

delta 102
zcmeytvX^C|)&fR_iKpBc6($QXPMo}kQQL}_%Ok(I#7aTc!#_C0Gr&sKBP1jsz&|L2
zm&-9ZIkf;NrKPXM%jKM(SCX1nqU)2ImtK-#rC`B3nU~3chnI_&OD{1gnW3VxYH}!(
FG5{(m9RUCU

diff --git a/third-party/curl/tests/data/test1532 b/third-party/curl/tests/data/test1532
index d6856a9896..b11938bec1 100644
--- a/third-party/curl/tests/data/test1532
+++ b/third-party/curl/tests/data/test1532
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.0 200 OK swsclose
 Content-Length: 0
 
@@ -33,10 +33,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1533 b/third-party/curl/tests/data/test1533
index e81b53d9e3..759c237bd4 100644
--- a/third-party/curl/tests/data/test1533
+++ b/third-party/curl/tests/data/test1533
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,7 +13,7 @@ CURLOPT_KEEP_SENDING_ON_ERROR
 <servercmd>
 auth_required
 </servercmd>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 401 Authorization Required
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -38,12 +39,12 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </client>
 
 # Verify data after the test has been "shot"
-# TEST_ERR_SUCCESS is errorcode 120
+# TEST_ERR_SUCCESS is errorcode 41
 <verify>
 <errorcode>
-120
+41
 </errorcode>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1534 b/third-party/curl/tests/data/test1534
index c37219fdc3..4e534a1ee8 100644
--- a/third-party/curl/tests/data/test1534
+++ b/third-party/curl/tests/data/test1534
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ CURLINFO_FILETIME
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.0 200 OK swsclose
 Last-Modified: Thu, 01 Jan 1970 00:00:30 GMT
 Content-Length: 0
@@ -35,10 +35,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1535 b/third-party/curl/tests/data/test1535
index 5b080e8ccb..b5805d8915 100644
--- a/third-party/curl/tests/data/test1535
+++ b/third-party/curl/tests/data/test1535
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -34,10 +34,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1536 b/third-party/curl/tests/data/test1536
index 8093feb77d..c76e7593a7 100644
--- a/third-party/curl/tests/data/test1536
+++ b/third-party/curl/tests/data/test1536
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -34,10 +34,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1537 b/third-party/curl/tests/data/test1537
index c999e9a6bf..1c48d36613 100644
--- a/third-party/curl/tests/data/test1537
+++ b/third-party/curl/tests/data/test1537
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,16 +6,12 @@ URL escape
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <tool>
 lib%TESTNUMBER
 </tool>
@@ -22,12 +19,8 @@ lib%TESTNUMBER
 <name>
 libcurl URL escape/unescape tests
 </name>
-<command>
-nothing
-</command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <stdout>
diff --git a/third-party/curl/tests/data/test1538 b/third-party/curl/tests/data/test1538
index 59cd1628ea..51580576ee 100644
--- a/third-party/curl/tests/data/test1538
+++ b/third-party/curl/tests/data/test1538
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,16 +7,15 @@ verbose logs
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
 # Client-side
 <client>
-<server>
-none
-</server>
+<features>
+verbose-strings
+</features>
 <tool>
 lib%TESTNUMBER
 </tool>
@@ -23,12 +23,8 @@ lib%TESTNUMBER
 <name>
 libcurl strerror API call tests
 </name>
-<command>
-nothing
-</command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <stdout>
@@ -37,9 +33,9 @@ e1: Unsupported protocol
 e2: Failed initialization
 e3: URL using bad/illegal format or missing URL
 e4: A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision.
-e5: Couldn't resolve proxy name
-e6: Couldn't resolve host name
-e7: Couldn't connect to server
+e5: Could not resolve proxy name
+e6: Could not resolve hostname
+e7: Could not connect to server
 e8: Weird server reply
 e9: Access denied to remote resource
 e10: FTP: The server failed to connect to data port
@@ -47,11 +43,11 @@ e11: FTP: unknown PASS reply
 e12: FTP: Accepting server connect has timed out
 e13: FTP: unknown PASV reply
 e14: FTP: unknown 227 response format
-e15: FTP: can't figure out the host in the PASV response
+e15: FTP: cannot figure out the host in the PASV response
 e16: Error in the HTTP2 framing layer
-e17: FTP: couldn't set file type
+e17: FTP: could not set file type
 e18: Transferred a partial file
-e19: FTP: couldn't retrieve (RETR failed) the specified file
+e19: FTP: could not retrieve (RETR failed) the specified file
 e20: Unknown error
 e21: Quote command returned error
 e22: HTTP response code said error
@@ -66,14 +62,14 @@ e30: FTP: command PORT failed
 e31: FTP: command REST failed
 e32: Unknown error
 e33: Requested range was not delivered by the server
-e34: Internal problem setting up the POST
+e34: Unknown error
 e35: SSL connect error
-e36: Couldn't resume download
-e37: Couldn't read a file:// file
+e36: Could not resume download
+e37: Could not read a file:// file
 e38: LDAP: cannot bind
 e39: LDAP: search failed
 e40: Unknown error
-e41: A required function in the library was not found
+e41: Unknown error
 e42: Operation was aborted by an application callback
 e43: A libcurl function was given a bad argument
 e44: Unknown error
@@ -91,14 +87,14 @@ e55: Failed sending data to the peer
 e56: Failure when receiving data from the peer
 e57: Unknown error
 e58: Problem with the local SSL certificate
-e59: Couldn't use specified SSL cipher
+e59: Could not use specified SSL cipher
 e60: SSL peer certificate or SSH remote key was not OK
 e61: Unrecognized or bad HTTP Content or Transfer-Encoding
 e62: Unknown error
 e63: Maximum file size exceeded
 e64: Requested SSL level failed
 e65: Send failed since rewinding of the data stream failed
-e66: Failed to initialise SSL crypto engine
+e66: Failed to initialize SSL crypto engine
 e67: Login denied
 e68: TFTP: File Not Found
 e69: TFTP: Access Violation
@@ -132,7 +128,9 @@ e96: QUIC connection error
 e97: proxy handshake error
 e98: SSL Client Certificate required
 e99: Unrecoverable error in select/poll
-e100: Unknown error
+e100: A value or data field grew larger than allowed
+e101: ECH attempted but failed
+e102: Unknown error
 m-1: Please call curl_multi_perform() soon
 m0: No error
 m1: Invalid multi handle
@@ -186,7 +184,8 @@ u27: Bad scheme
 u28: Unsupported number of slashes following scheme
 u29: Bad user
 u30: libcurl lacks IDN support
-u31: CURLUcode unknown
+u31: A value or data field is larger than allowed
+u32: CURLUcode unknown
 </stdout>
 </verify>
 
diff --git a/third-party/curl/tests/data/test1539 b/third-party/curl/tests/data/test1539
index 0b63700590..4a5b8e6d00 100644
--- a/third-party/curl/tests/data/test1539
+++ b/third-party/curl/tests/data/test1539
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ chunked Transfer-Encoding
 
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Sun, 19 Jan 2014 18:50:58 GMT
 Server: test-server/fake swsclose
@@ -24,7 +25,7 @@ Connection: close
 http
 </server>
 <tool>
-lib%TESTNUMBER
+lib1514
 </tool>
 <name>
 HTTP 1.0 POST with read callback and unknown data size
diff --git a/third-party/curl/tests/data/test154 b/third-party/curl/tests/data/test154
index b6cdbe5137..95ca6cf640 100644
--- a/third-party/curl/tests/data/test154
+++ b/third-party/curl/tests/data/test154
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ HTTP Digest auth
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -24,7 +25,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -34,7 +35,7 @@ Connection: close
 This IS the real page!
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -62,11 +63,12 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP PUT with --anyauth authorization (picking Digest)
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -T %LOGDIR/put%TESTNUMBER -u testuser:testpass --anyauth
 </command>
 <file name="%LOGDIR/put%TESTNUMBER">
@@ -79,7 +81,7 @@ four is the number of lines
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1540 b/third-party/curl/tests/data/test1540
index 86ed0db22c..b9b05f3a46 100644
--- a/third-party/curl/tests/data/test1540
+++ b/third-party/curl/tests/data/test1540
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -13,27 +14,27 @@ DELAY
 # Server-side
 <reply>
 <data>
-HTTP/1.1 200 OK swsclose
-Transfer-Encoding: chunked
-Trailer: MyCoolTrailerHeader
-
-4
-data
-5
+HTTP/1.1 200 OK swsclose%CR
+Transfer-Encoding: chunked%CR
+Trailer: MyCoolTrailerHeader%CR
+%CR
+4%CR
+data%CR
+5%CR
 d474
-
-0
-MyCoolTrailerHeader: amazingtrailer
-
+%CR
+0%CR
+MyCoolTrailerHeader: amazingtrailer%CR
+%CR
 </data>
 <datacheck>
-HTTP/1.1 200 OK swsclose
-Transfer-Encoding: chunked
-Trailer: MyCoolTrailerHeader
-
-Got 4 bytes but pausing!
+HTTP/1.1 200 OK swsclose%CR
+Transfer-Encoding: chunked%CR
+Trailer: MyCoolTrailerHeader%CR
+%CR
+Got bytes but pausing!
 datad474
-MyCoolTrailerHeader: amazingtrailer
+MyCoolTrailerHeader: amazingtrailer%CR
 </datacheck>
 <servercmd>
 writedelay: 10
@@ -47,17 +48,17 @@ http
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 chunked with trailers and pausing the receive
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1541 b/third-party/curl/tests/data/test1541
new file mode 100644
index 0000000000..2f030cc904
--- /dev/null
+++ b/third-party/curl/tests/data/test1541
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+chunked Transfer-Encoding
+Trailer:
+DELAY
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 OK swsclose%CR
+Transfer-Encoding: chunked%CR
+%CR
+4%CR
+data%CR
+5%CR
+d474
+%CR
+0%CR
+%CR
+</data>
+<datacheck>
+CURLINFO_CONNECT_TIME_T on 1st header is OK
+CURLINFO_PRETRANSFER_TIME_T on 1st header is OK
+CURLINFO_STARTTRANSFER_TIME_T on 1st header is OK
+CURLINFO_TOTAL_TIME_T on 1st header is OK
+CURLINFO_APPCONNECT_TIME_T on 1st header is OK
+CURLINFO_SPEED_DOWNLOAD_T on 1st header is OK
+HTTP/1.1 200 OK swsclose%CR
+Transfer-Encoding: chunked%CR
+%CR
+datad474
+CURLINFO_CONNECT_TIME_T on done is OK
+CURLINFO_PRETRANSFER_TIME_T on done is OK
+CURLINFO_POSTTRANSFER_TIME_T on done is OK
+CURLINFO_STARTTRANSFER_TIME_T on done is OK
+CURLINFO_APPCONNECT_TIME_T on done is OK
+CURLINFO_SPEED_DOWNLOAD_T on done is OK
+CURLINFO_TOTAL_TIME_T on done is OK
+</datacheck>
+<servercmd>
+writedelay: 10
+</servercmd>
+</reply>
+# Client-side
+<client>
+<server>
+http
+</server>
+<tool>
+lib%TESTNUMBER
+</tool>
+<name>
+CURLINFO timer check
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1542 b/third-party/curl/tests/data/test1542
index 6a35b44a92..2738fbb440 100644
--- a/third-party/curl/tests/data/test1542
+++ b/third-party/curl/tests/data/test1542
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,8 +12,9 @@ verbose logs
 
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
+Connection: close-not
 Content-Length: 0
 
 </data>
@@ -23,20 +25,23 @@ Content-Length: 0
 <server>
 http
 </server>
+<features>
+verbose-strings
+</features>
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 connection reuse with CURLOPT_MAXLIFETIME_CONN
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
@@ -55,14 +60,14 @@ Accept: */*
 
 </protocol>
 <file name="%LOGDIR/stderr%TESTNUMBER" mode="text">
-== Info: Connection #0 to host %HOSTIP left intact
-== Info: Connection #0 to host %HOSTIP left intact
-== Info: Connection #0 to host %HOSTIP left intact
-== Info: Closing connection
-== Info: Connection #1 to host %HOSTIP left intact
+== Info: Connection #0 to host %HOSTIP:%HTTPPORT left intact
+== Info: Connection #0 to host %HOSTIP:%HTTPPORT left intact
+== Info: Connection #0 to host %HOSTIP:%HTTPPORT left intact
+== Info: shutting down connection #0
+== Info: Connection #1 to host %HOSTIP:%HTTPPORT left intact
 </file>
 <stripfile>
-$_ = '' if (($_ !~ /left intact/) && ($_ !~ /Closing connection/))
+$_ = '' if(($_ !~ /left intact/) and ($_ !~ /(closing|shutting down) connection #\d+/))
 </stripfile>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1543 b/third-party/curl/tests/data/test1543
index fccd43b94e..2433447c6a 100644
--- a/third-party/curl/tests/data/test1543
+++ b/third-party/curl/tests/data/test1543
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,9 +6,7 @@ HTTP
 CURLOPT_CURLU
 </keywords>
 </info>
-#
 # Similar to 1518 but using CURLOPT_CURLU
-#
 # Server-side
 <reply>
 <data2 nocheck="yes">
@@ -38,7 +37,7 @@ http
 </server>
 # tool is what to use instead of 'curl'
 <tool>
-lib%TESTNUMBER
+lib1518
 </tool>
 
 <name>
@@ -49,10 +48,9 @@ CURLOPT_CURLU, URL with space and CURLINFO_EFFECTIVE_URL
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%20/with/%20space/%20/file HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
@@ -63,7 +61,7 @@ Accept: */*
 
 </protocol>
 <stdout>
-res 0
+result 0
 status 200
 redirects 1
 effectiveurl http://%HOSTIP:%HTTPPORT/%20/with/%20space/%TESTNUMBER0002
diff --git a/third-party/curl/tests/data/test1544 b/third-party/curl/tests/data/test1544
index 861c4fbfcc..6fb739981d 100644
--- a/third-party/curl/tests/data/test1544
+++ b/third-party/curl/tests/data/test1544
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,19 +6,14 @@ source analysis
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
-
- <name>
+<name>
 Verify all string options are translated by OS/400 wrapper
- </name>
+</name>
 
 <command type="perl">
-%SRCDIR/check-translatable-options.pl %SRCDIR/..
+%SRCDIR/test1544.pl %SRCDIR/..
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test1545 b/third-party/curl/tests/data/test1545
new file mode 100644
index 0000000000..9007daf2be
--- /dev/null
+++ b/third-party/curl/tests/data/test1545
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<features>
+form-api
+</features>
+<server>
+http
+</server>
+# tool is what to use instead of 'curl'
+<tool>
+lib%TESTNUMBER
+</tool>
+
+<name>
+use curl_formadd() data twice with unreadable file
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1546 b/third-party/curl/tests/data/test1546
new file mode 100644
index 0000000000..56b0a5d118
--- /dev/null
+++ b/third-party/curl/tests/data/test1546
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+Transfer-Encoding
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Mon, 29 Nov 2004 21:56:53 GMT
+Server: Apache
+Transfer-Encoding: chunked, gzip
+
+0
+
+</data>
+
+<datacheck crlf="headers">
+HTTP/1.1 200 OK
+Date: Mon, 29 Nov 2004 21:56:53 GMT
+Server: Apache
+</datacheck>
+
+</reply>
+
+# Client-side
+<client>
+<features>
+libz
+</features>
+<server>
+http
+</server>
+<name>
+HTTP transfer-encoding wrong order
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --tr-encoding
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+TE: gzip
+Connection: TE
+
+</protocol>
+<errorcode>
+61
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1547 b/third-party/curl/tests/data/test1547
new file mode 100644
index 0000000000..e384d2e0a8
--- /dev/null
+++ b/third-party/curl/tests/data/test1547
@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+# Based on test100 and test101
+<info>
+<keywords>
+FTP
+PASV
+LIST
+</keywords>
+</info>
+# Server-side
+<reply>
+<data mode="text">
+total 20
+drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
+drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
+drwxr-xr-x   2 98       98           512 May  2  1996 curl-releases
+-r--r--r--   1 0        1             35 Jul 16  1996 README
+lrwxrwxrwx   1 0        1              7 Dec  9  1999 bin -> usr/bin
+dr-xr-xr-x   2 0        1            512 Oct  1  1997 dev
+drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
+dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
+drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
+dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+ftp
+</server>
+<name>
+FTP dir list PASV overriding PORT
+</name>
+<command>
+ftp://%HOSTIP:%FTPPORT/test-%TESTNUMBER/ -P %CLIENTIP --ftp-pasv
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+USER anonymous
+PASS ftp@example.com
+PWD
+CWD test-%TESTNUMBER
+EPSV
+TYPE A
+LIST
+QUIT
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1548 b/third-party/curl/tests/data/test1548
new file mode 100644
index 0000000000..fbc80cb190
--- /dev/null
+++ b/third-party/curl/tests/data/test1548
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+TELNET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+telnet
+</features>
+<name>
+TELNET read stdin without upload file
+</name>
+<stdin>
+GET /we/want/%TESTNUMBER HTTP/1.0
+
+</stdin>
+<command>
+-m 1 telnet://%HOSTIP:%HTTPPORT
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+28
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1549 b/third-party/curl/tests/data/test1549
new file mode 100644
index 0000000000..7aaa2d9835
--- /dev/null
+++ b/third-party/curl/tests/data/test1549
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+cookies
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Content-Type: text/plain
+Set-Cookie: c1=123; Path=/; Expires=Thu, 12 Feb 2000 00:00:00 GMT
+Set-Cookie: c2=456; Path=/; Expires=Thu, 12 Feb 2000 00:00:00 GMT;
+
+hello
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+http
+cookies
+</features>
+<name>
+Receive expired cookies and CURLINFO_COOKIELIST
+</name>
+<tool>
+lib%TESTNUMBER
+</tool>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+</protocol>
+<stderr mode="text">
+URL: http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+0 cookies
+Test ended with result 0
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test155 b/third-party/curl/tests/data/test155
index fedf384a10..46ecb17f01 100644
--- a/third-party/curl/tests/data/test155
+++ b/third-party/curl/tests/data/test155
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ NTLM
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 NTLM Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -24,7 +25,7 @@ moo
 
 # This is supposed to be returned when the server gets a first
 # Authorization: NTLM line passed-in from the client
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 401 Type-1 received, send back type-2
 Server: Microsoft-IIS/5.0
 Content-Length: 34
@@ -36,7 +37,7 @@ This is not the real page either!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 200 Type-3 Received and all Things are fine swsclose
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -45,7 +46,7 @@ Content-Length: 32
 Finally, this is the real page!
 </data1002>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 NTLM Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -96,7 +97,7 @@ four is the number of lines
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -109,7 +110,7 @@ line three
 four is the number of lines
 PUT /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Content-Length: 0
diff --git a/third-party/curl/tests/data/test1550 b/third-party/curl/tests/data/test1550
index bfb80a1cab..67fe2fafaf 100644
--- a/third-party/curl/tests/data/test1550
+++ b/third-party/curl/tests/data/test1550
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,19 +12,13 @@ multi
 
 # Client-side
 <client>
-<server>
-none
-</server>
 # tool is what to use instead of 'curl'
 <tool>
 lib%TESTNUMBER
 </tool>
 
- <name>
-verify setting pipeling blocklisting options
- </name>
- <command>
-http://%HOSTIP:%NOLISTENPORT/%TESTNUMBER
-</command>
+<name>
+verify setting pipelining blocklisting options
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1551 b/third-party/curl/tests/data/test1551
index 77e0915b8c..0f32968472 100644
--- a/third-party/curl/tests/data/test1551
+++ b/third-party/curl/tests/data/test1551
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -38,16 +39,16 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 re-run redirected transfer without setting URL again
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1552 b/third-party/curl/tests/data/test1552
index 050f96f542..3b1a57f86f 100644
--- a/third-party/curl/tests/data/test1552
+++ b/third-party/curl/tests/data/test1552
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ FETCH
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -25,28 +25,24 @@ body
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP multi transfer error without curl_multi_remove_handle
- </name>
+</name>
 # tool is what to use instead of 'curl'
 <tool>
 lib%TESTNUMBER
 </tool>
- <command>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-</protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1553 b/third-party/curl/tests/data/test1553
index b38c68c991..84f3830852 100644
--- a/third-party/curl/tests/data/test1553
+++ b/third-party/curl/tests/data/test1553
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ FETCH
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -25,7 +25,6 @@ body
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -34,24 +33,21 @@ Mime
 <server>
 imap
 </server>
- <name>
-IMAP cleanup before a connection was created
- </name>
+<name>
+IMAP cleanup with non-existing hostname
+</name>
 # tool is what to use instead of 'curl'
 <tool>
 lib%TESTNUMBER
 </tool>
 
-# this MUST use a host name that doesn't resolve
+# this MUST use a hostname that does not resolve
 <command>
 imap://non-existing-host.haxx.se:%IMAPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-</protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1554 b/third-party/curl/tests/data/test1554
index c16195c17f..fa071b09b2 100644
--- a/third-party/curl/tests/data/test1554
+++ b/third-party/curl/tests/data/test1554
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -19,67 +20,55 @@ Content-Length: 29
 run 1: foobar and so on fun!
 </data>
 <datacheck>
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
+-] Mutex lock SHARE
+[- Mutex unlock SHARE
+-] Mutex lock CONNECT
+[- Mutex unlock CONNECT
+-] Mutex lock CONNECT
+[- Mutex unlock CONNECT
+-] Mutex lock CONNECT
+[- Mutex unlock CONNECT
+-] Mutex lock CONNECT
+[- Mutex unlock CONNECT
 run 1: foobar and so on fun!
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
+-] Mutex lock CONNECT
+[- Mutex unlock CONNECT
+-] Mutex lock CONNECT
+[- Mutex unlock CONNECT
+-] Mutex lock SHARE
+[- Mutex unlock SHARE
+-] Mutex lock SHARE
+[- Mutex unlock SHARE
+-] Mutex lock CONNECT
+[- Mutex unlock CONNECT
+-] Mutex lock CONNECT
+[- Mutex unlock CONNECT
+-] Mutex lock CONNECT
+[- Mutex unlock CONNECT
 run 1: foobar and so on fun!
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
+-] Mutex lock CONNECT
+[- Mutex unlock CONNECT
+-] Mutex lock CONNECT
+[- Mutex unlock CONNECT
+-] Mutex lock SHARE
+[- Mutex unlock SHARE
+-] Mutex lock SHARE
+[- Mutex unlock SHARE
+-] Mutex lock CONNECT
+[- Mutex unlock CONNECT
+-] Mutex lock CONNECT
+[- Mutex unlock CONNECT
+-] Mutex lock CONNECT
+[- Mutex unlock CONNECT
 run 1: foobar and so on fun!
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
--> Mutex lock
-<- Mutex unlock
+-] Mutex lock CONNECT
+[- Mutex unlock CONNECT
+-] Mutex lock CONNECT
+[- Mutex unlock CONNECT
+-] Mutex lock SHARE
+[- Mutex unlock SHARE
+-] Mutex lock SHARE
+[- Mutex unlock SHARE
 </datacheck>
 </reply>
 
diff --git a/third-party/curl/tests/data/test1555 b/third-party/curl/tests/data/test1555
index 30f7a3dc50..1212531686 100644
--- a/third-party/curl/tests/data/test1555
+++ b/third-party/curl/tests/data/test1555
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ DELAY
 
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 204 PARTIAL
 X-Comment: partial response to keep the client waiting
 </data>
@@ -25,20 +26,18 @@ http
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 verify api is protected against calls from callbacks
- </name>
+</name>
 
-# this server/host won't be used for real
- <command>
+# this server/host is not used for real
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-</protocol>
 # 42 == CURLE_ABORTED_BY_CALLBACK
 <errorcode>
 42
diff --git a/third-party/curl/tests/data/test1556 b/third-party/curl/tests/data/test1556
index c3aa993874..30a9c4007e 100644
--- a/third-party/curl/tests/data/test1556
+++ b/third-party/curl/tests/data/test1556
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -26,7 +26,6 @@ Long: %repeat[100001 x A]%
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -35,18 +34,17 @@ http
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 send long HTTP headers to header callback
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1557 b/third-party/curl/tests/data/test1557
index 031809f4e1..a96647690c 100644
--- a/third-party/curl/tests/data/test1557
+++ b/third-party/curl/tests/data/test1557
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,22 +11,18 @@ crash
 </reply>
 
 <client>
-<server>
-none
-</server>
 <tool>
 lib%TESTNUMBER
 </tool>
 
 <name>
-Removing easy handle that's in the pending connections list doesn't leave behind a dangling entry
+Remove easy handle in pending connections does not leave dangling entry
 </name>
 <command>
-nothing
+hostname.invalid
 </command>
 </client>
 
-#
 # Verify that the test runs to completion without crashing
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test1558 b/third-party/curl/tests/data/test1558
index 46332d198c..9070a6dd71 100644
--- a/third-party/curl/tests/data/test1558
+++ b/third-party/curl/tests/data/test1558
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,9 +11,6 @@ CURLINFO_PROTOCOL
 </reply>
 
 <client>
-<server>
-none
-</server>
 <features>
 file
 </features>
@@ -31,7 +29,6 @@ hello
 </file>
 </client>
 
-#
 # Verify that the test runs to completion without crashing
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test1559 b/third-party/curl/tests/data/test1559
index c307f6447e..884c490a4c 100644
--- a/third-party/curl/tests/data/test1559
+++ b/third-party/curl/tests/data/test1559
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,13 +11,11 @@ verbose logs
 </reply>
 
 <client>
-<server>
-none
-</server>
 
 # require HTTP so that CURLOPT_POSTFIELDS works as assumed
 <features>
 http
+verbose-strings
 </features>
 <tool>
 lib%TESTNUMBER
@@ -27,7 +26,6 @@ Set excessive URL lengths
 </name>
 </client>
 
-#
 # Verify that the test runs to completion without crashing
 <verify>
 <errorcode>
@@ -40,6 +38,9 @@ CURLUPART_URL 10000000 bytes URL == 3 (Malformed input to a URL function)
 CURLUPART_SCHEME 10000000 bytes scheme == 3 (Malformed input to a URL function)
 CURLUPART_USER 10000000 bytes user == 3 (Malformed input to a URL function)
 </stdout>
+<limits>
+Maximum allocated: 10010000
+</limits>
 </verify>
 
 </testcase>
diff --git a/third-party/curl/tests/data/test156 b/third-party/curl/tests/data/test156
index 30706e5a8d..057fa6b71c 100644
--- a/third-party/curl/tests/data/test156
+++ b/third-party/curl/tests/data/test156
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ HTTP PUT
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 No Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -24,10 +25,10 @@ PUT received fine. Thank you very much
 <server>
 http
 </server>
- <name>
+<name>
 HTTP PUT with --anyauth (when the server requires none)
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -T %LOGDIR/put%TESTNUMBER -u testuser:testpass --anyauth
 </command>
 <file name="%LOGDIR/put%TESTNUMBER">
@@ -40,7 +41,7 @@ four is the number of lines
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1560 b/third-party/curl/tests/data/test1560
index 5ed0adde89..bd72d35d29 100644
--- a/third-party/curl/tests/data/test1560
+++ b/third-party/curl/tests/data/test1560
@@ -1,19 +1,17 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 unittest
-URLAPI
+urlapi
+url
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <setenv>
-LANG=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
 <features>
 file
@@ -26,9 +24,9 @@ ldap
 dict
 ftp
 </features>
- <name>
+<name>
 URL API
- </name>
+</name>
 <tool>
 lib%TESTNUMBER
 </tool>
@@ -38,5 +36,8 @@ lib%TESTNUMBER
 <stdout>
 success
 </stdout>
+<limits>
+Allocations: 3350
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1561 b/third-party/curl/tests/data/test1561
index b6e3c5a735..6945d5d045 100644
--- a/third-party/curl/tests/data/test1561
+++ b/third-party/curl/tests/data/test1561
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -69,14 +70,14 @@ https
 https
 </killserver>
 <name>
-Cookies set over HTTP can't override secure ones
+Cookies set over HTTP cannot override secure ones
 </name>
 <command>
--k https://%HOSTIP:%HTTPSPORT/%TESTNUMBER0001 -L -c %LOGDIR/jar%TESTNUMBER.txt -H "Host: www.example.com"  http://%HOSTIP:%HTTPPORT/%TESTNUMBER0002 -L -c %LOGDIR/jar%TESTNUMBER.txt -H "Host: www.example.com"
+--insecure https://%HOSTIP:%HTTPSPORT/%TESTNUMBER0001 -L -c %LOGDIR/jar%TESTNUMBER.txt -H "Host: www.example.com"  http://%HOSTIP:%HTTPPORT/%TESTNUMBER0002 -L -c %LOGDIR/jar%TESTNUMBER.txt -H "Host: www.example.com"
 </command>
 </client>
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0001 HTTP/1.1
 Host: www.example.com
 User-Agent: curl/%VERSION
@@ -98,7 +99,7 @@ Accept: */*
 www.example.com	FALSE	/	TRUE	0	__Host-SID	12346
 .example.com	TRUE	/	TRUE	0	supersupersuper	secret
 .example.com	TRUE	/	TRUE	0	__SecURE-SID	12346
-.example.com	TRUE	/%TESTNUMBER/login/	TRUE	0	supersuper	secret
+.example.com	TRUE	/%TESTNUMBER/login	TRUE	0	supersuper	secret
 .example.com	TRUE	/1561	TRUE	0	super	secret
 </file>
 
diff --git a/third-party/curl/tests/data/test1562 b/third-party/curl/tests/data/test1562
index 5229a87dad..dc01828c25 100644
--- a/third-party/curl/tests/data/test1562
+++ b/third-party/curl/tests/data/test1562
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -44,11 +45,11 @@ https
 Expire secure cookies over HTTPS
 </name>
 <command>
--k https://%HOSTIP:%HTTPSPORT/%TESTNUMBER0001 -H "Host: www.example.com" https://%HOSTIP:%HTTPSPORT/%TESTNUMBER0002 -b "non-existing" https://%HOSTIP:%HTTPSPORT/%TESTNUMBER0001
+--insecure https://%HOSTIP:%HTTPSPORT/%TESTNUMBER0001 -H "Host: www.example.com" https://%HOSTIP:%HTTPSPORT/%TESTNUMBER0002 -b "non-existing" https://%HOSTIP:%HTTPSPORT/%TESTNUMBER0001
 </command>
 </client>
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0001 HTTP/1.1
 Host: www.example.com
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1563 b/third-party/curl/tests/data/test1563
index 2e95208634..e3e584547c 100644
--- a/third-party/curl/tests/data/test1563
+++ b/third-party/curl/tests/data/test1563
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -36,7 +37,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001 -L -H "Host: www.example.com"
 <errorcode>
 1
 </errorcode>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0001 HTTP/1.1
 Host: www.example.com
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1564 b/third-party/curl/tests/data/test1564
index 59cef7157b..6d9bd745d2 100644
--- a/third-party/curl/tests/data/test1564
+++ b/third-party/curl/tests/data/test1564
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -15,17 +16,12 @@ wakeup
 <features>
 wakeup
 </features>
-<server>
-none
-</server>
 <tool>
 lib%TESTNUMBER
 </tool>
 <name>
 wakeup before poll with no easy handles
 </name>
-<command>
-</command>
 </client>
 
 # Verify data after the test has been "shot"
diff --git a/third-party/curl/tests/data/test1565 b/third-party/curl/tests/data/test1565
index 15374bf7e6..78fe7f1f80 100644
--- a/third-party/curl/tests/data/test1565
+++ b/third-party/curl/tests/data/test1565
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -34,7 +35,7 @@ lib%TESTNUMBER
 wakeup from another thread
 </name>
 <command>
-http://%HOSTIP:%HTTPPORT/1
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test1566 b/third-party/curl/tests/data/test1566
index df513c782f..4f5388301d 100644
--- a/third-party/curl/tests/data/test1566
+++ b/third-party/curl/tests/data/test1566
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -22,14 +22,13 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 <name>
---etag-compare that gets a 304 back shouldn't overwrite the file
+--etag-compare that gets a 304 back should not overwrite the file
 </name>
 <command option="no-output,no-include">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -o %LOGDIR/output%TESTNUMBER --etag-compare %LOGDIR/etag%TESTNUMBER
@@ -43,10 +42,9 @@ downloaded already
 
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1567 b/third-party/curl/tests/data/test1567
index a6d3267a41..86198e3246 100644
--- a/third-party/curl/tests/data/test1567
+++ b/third-party/curl/tests/data/test1567
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -39,16 +40,16 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 re-run redirected transfer without setting CURLU URL again
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1568 b/third-party/curl/tests/data/test1568
index 369de1d991..b9b5ddc177 100644
--- a/third-party/curl/tests/data/test1568
+++ b/third-party/curl/tests/data/test1568
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # based on test 64
 
@@ -10,7 +11,7 @@ HTTP Digest auth
 </info>
 
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145"
@@ -22,7 +23,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -31,7 +32,7 @@ Content-Length: 23
 This IS the real page!
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145"
@@ -56,6 +57,7 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
 <name>
 HTTP with Digest authorization on custom CURLOPT_PORT
@@ -70,7 +72,7 @@ http://%HOSTIP/%TESTNUMBER %HTTPPORT
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: lib%TESTNUMBER
diff --git a/third-party/curl/tests/data/test1569 b/third-party/curl/tests/data/test1569
index b230dfae5a..faa6968e38 100644
--- a/third-party/curl/tests/data/test1569
+++ b/third-party/curl/tests/data/test1569
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -26,9 +27,9 @@ REPLY EPSV 500 no such command
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP first type=A then regular URL
- </name>
+</name>
 <tool>
 lib%TESTNUMBER
 </tool>
@@ -40,7 +41,7 @@ lib%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test157 b/third-party/curl/tests/data/test157
index 6406080e2d..fe9c9bdd92 100644
--- a/third-party/curl/tests/data/test157
+++ b/third-party/curl/tests/data/test157
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,13 +10,13 @@ HTTP GET
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 No Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
 Connection: close
 
-GET received and served just fine. Thank you very much
+GET received and served fine. Thank you very much
 </data>
 </reply>
 
@@ -24,17 +25,17 @@ GET received and served just fine. Thank you very much
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with --anyauth (when the server requires none)
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --anyauth
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1570 b/third-party/curl/tests/data/test1570
index 4287b3b845..38b297842b 100644
--- a/third-party/curl/tests/data/test1570
+++ b/third-party/curl/tests/data/test1570
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -26,9 +27,9 @@ REPLY EPSV 500 no such command
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP first type=D then regular URL
- </name>
+</name>
 <tool>
 lib1569
 </tool>
@@ -40,7 +41,7 @@ lib1569
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1571 b/third-party/curl/tests/data/test1571
new file mode 100644
index 0000000000..61b9029b1a
--- /dev/null
+++ b/third-party/curl/tests/data/test1571
@@ -0,0 +1,92 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+CURLFOLLOW_OBEYCODE
+CURLOPT_FOLLOWLOCATION
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 302 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+<data1 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</data1>
+<datacheck crlf="headers">
+HTTP/1.1 302 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+http
+</features>
+<tool>
+lib%TESTNUMBER
+</tool>
+
+<name>
+CURLFOLLOW_OBEYCODE with custom POST method, 302 => GET
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+IGLOO /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 3
+Content-Type: application/x-www-form-urlencoded
+
+mooGET /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1572 b/third-party/curl/tests/data/test1572
new file mode 100644
index 0000000000..e63bf49b07
--- /dev/null
+++ b/third-party/curl/tests/data/test1572
@@ -0,0 +1,94 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+CURLFOLLOW_OBEYCODE
+CURLOPT_FOLLOWLOCATION
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 308 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+<data1 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</data1>
+<datacheck crlf="headers">
+HTTP/1.1 308 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+http
+</features>
+<tool>
+lib1571
+</tool>
+
+<name>
+CURLFOLLOW_OBEYCODE with custom POST method, 308 => custom
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+IGLOO /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 3
+Content-Type: application/x-www-form-urlencoded
+
+mooIGLOO /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 3
+Content-Type: application/x-www-form-urlencoded
+
+moo
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1573 b/third-party/curl/tests/data/test1573
new file mode 100644
index 0000000000..14a6ca9560
--- /dev/null
+++ b/third-party/curl/tests/data/test1573
@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+CURLFOLLOW_OBEYCODE
+CURLOPT_FOLLOWLOCATION
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 302 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+<data1 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</data1>
+<datacheck crlf="headers">
+HTTP/1.1 302 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+http
+</features>
+<tool>
+lib1571
+</tool>
+
+<name>
+CURLFOLLOW_OBEYCODE with custom GET method, 301 => custom
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+IGLOO /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+IGLOO /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1574 b/third-party/curl/tests/data/test1574
new file mode 100644
index 0000000000..d0f65be9bf
--- /dev/null
+++ b/third-party/curl/tests/data/test1574
@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+CURLFOLLOW_FIRSTONLY
+CURLOPT_FOLLOWLOCATION
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 302 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+<data1 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</data1>
+<datacheck crlf="headers">
+HTTP/1.1 302 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+http
+</features>
+<tool>
+lib1571
+</tool>
+
+<name>
+CURLFOLLOW_FIRSTONLY with custom GET method, 301 => GET
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+IGLOO /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+GET /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1575 b/third-party/curl/tests/data/test1575
new file mode 100644
index 0000000000..dc2d86e09f
--- /dev/null
+++ b/third-party/curl/tests/data/test1575
@@ -0,0 +1,94 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+CURLFOLLOW_FIRSTONLY
+CURLOPT_FOLLOWLOCATION
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 308 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+<data1 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</data1>
+<datacheck crlf="headers">
+HTTP/1.1 308 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+http
+</features>
+<tool>
+lib1571
+</tool>
+
+<name>
+CURLFOLLOW_FIRSTONLY with custom POST method, 308 => POST
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+IGLOO /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 3
+Content-Type: application/x-www-form-urlencoded
+
+mooPOST /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 3
+Content-Type: application/x-www-form-urlencoded
+
+moo
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1576 b/third-party/curl/tests/data/test1576
new file mode 100644
index 0000000000..c6b395d58f
--- /dev/null
+++ b/third-party/curl/tests/data/test1576
@@ -0,0 +1,92 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+CURLFOLLOW_OBEYCODE
+CURLOPT_FOLLOWLOCATION
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 302 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+<data1 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</data1>
+<datacheck crlf="headers">
+HTTP/1.1 302 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+http
+</features>
+<tool>
+lib%TESTNUMBER
+</tool>
+
+<name>
+CURLFOLLOW_OBEYCODE with custom PUT method, 302 => custom
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+CURL /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 45
+
+request indicates that the client, which madeCURL /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 45
+
+request indicates that the client, which made
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1577 b/third-party/curl/tests/data/test1577
new file mode 100644
index 0000000000..ca47483fc6
--- /dev/null
+++ b/third-party/curl/tests/data/test1577
@@ -0,0 +1,92 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+CURLFOLLOW_OBEYCODE
+CURLOPT_FOLLOWLOCATION
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 308 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+<data1 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</data1>
+<datacheck crlf="headers">
+HTTP/1.1 308 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+http
+</features>
+<tool>
+lib1576
+</tool>
+
+<name>
+CURLFOLLOW_OBEYCODE with custom PUT method, 308 => custom
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER %TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+CURL /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 45
+
+request indicates that the client, which madeCURL /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 45
+
+request indicates that the client, which made
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1578 b/third-party/curl/tests/data/test1578
new file mode 100644
index 0000000000..2a48d50fd4
--- /dev/null
+++ b/third-party/curl/tests/data/test1578
@@ -0,0 +1,92 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+CURLFOLLOW_FIRSTONLY
+CURLOPT_FOLLOWLOCATION
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 302 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+<data1 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</data1>
+<datacheck crlf="headers">
+HTTP/1.1 302 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+http
+</features>
+<tool>
+lib1576
+</tool>
+
+<name>
+CURLFOLLOW_FIRSTONLY with custom PUT method, 302 => PUT
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+CURL /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 45
+
+request indicates that the client, which madePUT /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 45
+
+request indicates that the client, which made
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1579 b/third-party/curl/tests/data/test1579
new file mode 100644
index 0000000000..29ffc76229
--- /dev/null
+++ b/third-party/curl/tests/data/test1579
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+CURLFOLLOW_OBEYCODE
+CURLOPT_FOLLOWLOCATION
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 303 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+<data1 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</data1>
+<datacheck crlf="headers">
+HTTP/1.1 303 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+http
+</features>
+<tool>
+lib1576
+</tool>
+
+<name>
+CURLFOLLOW_OBEYCODE with custom PUT method, 303 => GET
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER %TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+CURL /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 45
+
+request indicates that the client, which madeGET /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test158 b/third-party/curl/tests/data/test158
index db7ad2aaab..a6b1b94ea2 100644
--- a/third-party/curl/tests/data/test158
+++ b/third-party/curl/tests/data/test158
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP POST
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 100 Continue swsclose
 Silly-header: yeeeees
 
@@ -23,10 +24,10 @@ Mime
 <server>
 http
 </server>
- <name>
+<name>
 HTTP multipart formpost with only a 100 reply
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -F name=daniel
 </command>
 </client>
@@ -37,12 +38,12 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -F name=daniel
 ^Content-Type: multipart/form-data.*
 ^-----------------------.*
 </strip>
-<protocol>
+<protocol crlf="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Content-Length: 145
+Content-Length: 157
 Content-Type: multipart/form-data; boundary=----------------------------4f12fcdaa3bc
 
 ------------------------------4f12fcdaa3bc
diff --git a/third-party/curl/tests/data/test1580 b/third-party/curl/tests/data/test1580
new file mode 100644
index 0000000000..4dc10a1f9e
--- /dev/null
+++ b/third-party/curl/tests/data/test1580
@@ -0,0 +1,92 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+CURLFOLLOW_FIRSTONLY
+CURLOPT_FOLLOWLOCATION
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 308 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+<data1 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</data1>
+<datacheck crlf="headers">
+HTTP/1.1 308 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+http
+</features>
+<tool>
+lib1576
+</tool>
+
+<name>
+CURLFOLLOW_FIRSTONLY with custom PUT method, 308 => PUT
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER 1578
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+CURL /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 45
+
+request indicates that the client, which madePUT /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 45
+
+request indicates that the client, which made
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1581 b/third-party/curl/tests/data/test1581
new file mode 100644
index 0000000000..458d8c9a5c
--- /dev/null
+++ b/third-party/curl/tests/data/test1581
@@ -0,0 +1,94 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+CURLFOLLOW_OBEYCODE
+CURLOPT_FOLLOWLOCATION
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 301 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+<data1 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</data1>
+<datacheck crlf="headers">
+HTTP/1.1 301 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+http
+</features>
+<tool>
+lib1571
+</tool>
+
+<name>
+CURLFOLLOW_OBEYCODE with custom POST301 method, 301 => custom
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+IGLOO /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 3
+Content-Type: application/x-www-form-urlencoded
+
+mooIGLOO /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 3
+Content-Type: application/x-www-form-urlencoded
+
+moo
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1582 b/third-party/curl/tests/data/test1582
new file mode 100644
index 0000000000..6c5e55d229
--- /dev/null
+++ b/third-party/curl/tests/data/test1582
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTPS
+GSS-API
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 401 OK
+Date: Tue, 09 Nov 2030 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 7
+WWW-Authenticate: Negotiate
+
+nomnom
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+SSL
+GSS-API
+OpenSSL
+</features>
+<server>
+http
+https
+</server>
+<name>
+Negotiate over HTTPS with channel binding
+</name>
+<tool>
+lib%TESTNUMBER
+</tool>
+<command>
+https://%HOSTIP:%HTTPSPORT/
+</command>
+</client>
+
+<verify>
+<protocol crlf="headers">
+GET / HTTP/1.1
+Host: %HOSTIP:%HTTPSPORT
+Accept: */*
+
+</protocol>
+
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1583 b/third-party/curl/tests/data/test1583
new file mode 100644
index 0000000000..bde1b0c4bf
--- /dev/null
+++ b/third-party/curl/tests/data/test1583
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+SFTP
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<server>
+sftp
+</server>
+<precheck>
+%PERL %SRCDIR/libtest/test613.pl prepare %PWD/%LOGDIR/test%TESTNUMBER.dir
+</precheck>
+<name>
+SFTP dir and empty file
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: --insecure sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/test%TESTNUMBER.dir/ --next
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: --insecure sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/test%TESTNUMBER.dir/emptyfile.txt
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+0
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1584 b/third-party/curl/tests/data/test1584
new file mode 100644
index 0000000000..b208495155
--- /dev/null
+++ b/third-party/curl/tests/data/test1584
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<!-- Based on test 1311 -->
+<info>
+<keywords>
+HTTP
+HTTP GET
+-J
+</keywords>
+</info>
+
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Content-Disposition: filename=log/server/name%TESTNUMBER
+
+12345
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP GET with -J and Content-Disposition including path
+</name>
+<command option="no-output,no-include">
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -O --output-dir %LOGDIR
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/name%TESTNUMBER">
+12345
+</file>
+
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1585 b/third-party/curl/tests/data/test1585
new file mode 100644
index 0000000000..61a903566d
--- /dev/null
+++ b/third-party/curl/tests/data/test1585
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<!-- Based on test 1584 -->
+<info>
+<keywords>
+HTTP
+HTTP GET
+-J
+</keywords>
+</info>
+
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Content-Disposition: filename=log\server\name%TESTNUMBER
+
+12345
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP GET with -J and Content-Disposition including DOS path
+</name>
+<command option="no-output,no-include">
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -O --output-dir %LOGDIR
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/name%TESTNUMBER">
+12345
+</file>
+
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1586 b/third-party/curl/tests/data/test1586
new file mode 100644
index 0000000000..2ce247147e
--- /dev/null
+++ b/third-party/curl/tests/data/test1586
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTPS proxy
+HSTS
+trailing-dot
+</keywords>
+</info>
+
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Strict-Transport-Security: max-age=604800
+
+-foo-
+</data>
+<data2 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Strict-Transport-Security: max-age=6048000
+
+-baa-
+</data2>
+</reply>
+
+<client>
+<server>
+http
+https-proxy
+</server>
+<features>
+HSTS
+proxy
+http
+</features>
+<setenv>
+</setenv>
+
+<name>
+HSTS via https: proxy ignored for http: URLs
+</name>
+<command>
+-x https://%HOSTIP:%HTTPSPROXYPORT --proxy-insecure --hsts %LOGDIR/hsts%TESTNUMBER http://this.hsts.example./%TESTNUMBER http://another.example.com/%TESTNUMBER0002
+</command>
+</client>
+
+<verify>
+<proxy crlf="headers">
+GET http://this.hsts.example./%TESTNUMBER HTTP/1.1
+Host: this.hsts.example.
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://another.example.com/%TESTNUMBER0002 HTTP/1.1
+Host: another.example.com
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</proxy>
+
+# The saved HSTS file must be empty as the HSTS headers were not secured
+<file name="%LOGDIR/hsts%TESTNUMBER" mode="text">
+# Your HSTS cache. https://curl.se/docs/hsts.html
+# This file was generated by libcurl! Edit at your own risk.
+</file>
+
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1587 b/third-party/curl/tests/data/test1587
new file mode 100644
index 0000000000..8806527935
--- /dev/null
+++ b/third-party/curl/tests/data/test1587
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTPS
+CURLINFO_TLS_SESSION
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 401 OK
+Date: Tue, 09 Nov 2030 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 7
+WWW-Authenticate: curl2000
+
+nomnom
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+SSL
+OpenSSL
+</features>
+<server>
+http
+https
+</server>
+<name>
+CURLINFO_TLS_SESSION and CURLINFO_TLS_SSL_PTR with OpenSSL
+</name>
+<tool>
+lib%TESTNUMBER
+</tool>
+<command>
+https://%HOSTIP:%HTTPSPORT/
+</command>
+</client>
+
+<verify>
+<stdout mode="text">
+CURLINFO_TLS_SESSION: OK
+CURLINFO_TLS_SSL_PTR: OK
+</stdout>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1588 b/third-party/curl/tests/data/test1588
new file mode 100644
index 0000000000..30ec8ca912
--- /dev/null
+++ b/third-party/curl/tests/data/test1588
@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+HTTP proxy
+HTTP proxy Digest auth
+multi
+</keywords>
+</info>
+
+# Server-side
+<reply>
+
+# this is returned first since we get no proxy-auth
+<data crlf="headers">
+HTTP/1.1 407 Authorization Required to proxy me my dear
+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
+Content-Length: 33
+
+And you should ignore this data.
+</data>
+
+# then this is returned when we get proxy-auth
+<data1000 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 21
+Server: no
+
+Nice proxy auth sir!
+</data1000>
+
+<datacheck crlf="headers">
+HTTP/1.1 407 Authorization Required to proxy me my dear
+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
+Content-Length: 33
+
+HTTP/1.1 200 OK
+Content-Length: 21
+Server: no
+
+Nice proxy auth sir!
+HTTP/1.1 407 Authorization Required to proxy me my dear
+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
+Content-Length: 33
+
+HTTP/1.1 200 OK
+Content-Length: 21
+Server: no
+
+Nice proxy auth sir!
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+# tool is what to use instead of 'curl'
+<tool>
+lib%TESTNUMBER
+</tool>
+<features>
+!SSPI
+crypto
+proxy
+digest
+</features>
+<name>
+HTTP proxy auth Digest, then change proxy and do it again
+</name>
+<command>
+http://test.remote.example.com/path/%TESTNUMBER %HOSTIP %HTTPPORT silly:person custom.set.host.name
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
+Host: test.remote.example.com
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
+Host: test.remote.example.com
+Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/%TESTNUMBER", response="d0b2f000c7e3fca24452b5810713404a"
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
+Host: test.remote.example.com
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
+Host: test.remote.example.com
+Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/%TESTNUMBER", response="d0b2f000c7e3fca24452b5810713404a"
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1589 b/third-party/curl/tests/data/test1589
new file mode 100644
index 0000000000..527edb54ca
--- /dev/null
+++ b/third-party/curl/tests/data/test1589
@@ -0,0 +1,108 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP proxy
+HTTP proxy Digest auth
+</keywords>
+</info>
+
+# Server-side
+<reply>
+
+# this is returned first since we get no proxy-auth
+<data crlf="headers">
+HTTP/1.1 407 Authorization Required to proxy me my dear
+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
+Content-Length: 33
+
+And you should ignore this data.
+</data>
+
+# then this is returned when we get proxy-auth
+<data1000 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 21
+Server: no
+
+Nice proxy auth sir!
+</data1000>
+
+<datacheck crlf="headers">
+HTTP/1.1 407 Authorization Required to proxy me my dear
+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
+Content-Length: 33
+
+HTTP/1.1 200 OK
+Content-Length: 21
+Server: no
+
+Nice proxy auth sir!
+HTTP/1.1 407 Authorization Required to proxy me my dear
+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
+Content-Length: 33
+
+HTTP/1.1 200 OK
+Content-Length: 21
+Server: no
+
+Nice proxy auth sir!
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+http-proxy
+</server>
+# tool is what to use instead of 'curl'
+<tool>
+lib%TESTNUMBER
+</tool>
+<features>
+!SSPI
+crypto
+proxy
+digest
+</features>
+<name>
+HTTP proxy auth Digest, then change proxy port and do it again
+</name>
+<command>
+http://test.remote.example.com/path/%TESTNUMBER %HOSTIP %HTTPPORT %PROXYPORT silly:person
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
+Host: test.remote.example.com
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
+Host: test.remote.example.com
+Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/%TESTNUMBER", response="9a547f8fa81cff330c68095603f3819e"
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+<proxy crlf="headers">
+GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
+Host: test.remote.example.com
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
+Host: test.remote.example.com
+Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/%TESTNUMBER", response="9a547f8fa81cff330c68095603f3819e"
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</proxy>
+
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test159 b/third-party/curl/tests/data/test159
index bd77e711d3..950ebdb7f2 100644
--- a/third-party/curl/tests/data/test159
+++ b/third-party/curl/tests/data/test159
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -15,7 +16,7 @@ HTTP NTLM auth
 This is supposed to be returned when the server gets a first
 Authorization: NTLM line passed-in from the client -->
 
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 401 Now gimme that second request of crap
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -26,7 +27,7 @@ Connection: close
 This is not the real page either!
 </data1001>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Now gimme that second request of crap
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -45,34 +46,25 @@ This is not the real page either!
 NTLM
 SSL
 !SSPI
-debug
+Debug
 </features>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with NTLM authorization when talking HTTP/1.0 (known to fail)
- </name>
- <setenv>
-# we force our own host name, in order to make the test machine independent
-CURL_GETHOSTNAME=curlhost
-# we try to use the LD_PRELOAD hack, if not a debug build
-LD_PRELOAD=%PWD/libtest/.libs/libhostname.so
- </setenv>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --ntlm -0
 </command>
-<precheck>
-chkhostname curlhost
-</precheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.0
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test1590 b/third-party/curl/tests/data/test1590
index 1d12485a88..dd660eb30f 100644
--- a/third-party/curl/tests/data/test1590
+++ b/third-party/curl/tests/data/test1590
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ FETCH
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -25,7 +25,6 @@ body
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -34,24 +33,21 @@ Mime
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP cleanup before a connection was created
- </name>
+</name>
 # tool is what to use instead of 'curl'
 <tool>
 lib1553
 </tool>
 
-# it is important this uses a host name that resolves successfully
+# it is important this uses a hostname that resolves successfully
 <command>
 imap://localhost:%IMAPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-</protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1591 b/third-party/curl/tests/data/test1591
index 2bee0adf64..a6f72c3ac1 100644
--- a/third-party/curl/tests/data/test1591
+++ b/third-party/curl/tests/data/test1591
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -40,7 +41,7 @@ more than one byte
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 PUT /bzz/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
@@ -48,11 +49,7 @@ Transfer-Encoding: chunked
 Trailer: my-super-awesome-trailer, my-other-awesome-trailer
 Expect: 100-continue
 
-%if hyper
-E
-%else
 e
-%endif
 Hello Cloud!
 
 0
diff --git a/third-party/curl/tests/data/test1592 b/third-party/curl/tests/data/test1592
index 8de07341ef..36e7fc8ab1 100644
--- a/third-party/curl/tests/data/test1592
+++ b/third-party/curl/tests/data/test1592
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,31 +7,26 @@ multi
 resolve
 speedcheck
 flaky
+timing-dependent
 </keywords>
 </info>
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
-HTTP request, remove handle while resolving, don't block
- </name>
+<name>
+HTTP request, remove handle while resolving, do not block
+</name>
 
- <command>
+<command>
 http://a-site-never-accessed.example.org/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 <errorcode>
 0
 </errorcode>
diff --git a/third-party/curl/tests/data/test1593 b/third-party/curl/tests/data/test1593
index 3ff12836ce..ef4b21f2d1 100644
--- a/third-party/curl/tests/data/test1593
+++ b/third-party/curl/tests/data/test1593
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -36,7 +37,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 
 <verify>
 # Note here the lack of If-Modified-Since
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1594 b/third-party/curl/tests/data/test1594
index 98718e93cb..8c8b51c56c 100644
--- a/third-party/curl/tests/data/test1594
+++ b/third-party/curl/tests/data/test1594
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -36,7 +37,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1595 b/third-party/curl/tests/data/test1595
index 44047ef4d8..996a0cd409 100644
--- a/third-party/curl/tests/data/test1595
+++ b/third-party/curl/tests/data/test1595
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -35,7 +36,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1596 b/third-party/curl/tests/data/test1596
index 9ef9df442c..202b5e40f5 100644
--- a/third-party/curl/tests/data/test1596
+++ b/third-party/curl/tests/data/test1596
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -13,9 +14,9 @@ If-Modified-Since
 <reply>
 <data nocheck="yes">
 HTTP/1.1 429 Too Many Requests
-Date: Thu, 11 Jul 2019 02:26:59 GMT
+Date: Wed, 31 Dec 2138 02:26:59 GMT
 Server: test-server/swsclose
-Retry-After: Thu, 11 Jul 2024 02:26:59 GMT
+Retry-After: Wed, 31 Dec 2138 02:26:59 GMT
 
 </data>
 </reply>
@@ -28,7 +29,7 @@ http
 HTTP Retry-After header parsing using a date
 </name>
 <tool>
-lib%TESTNUMBER
+lib1594
 </tool>
 <command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
@@ -36,14 +37,15 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
 
 </protocol>
+# Retry-After time is limited to 6 hours (21600 seconds)
 <stdout>
-Retry-After 172066
+Retry-After 21600
 </stdout>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1597 b/third-party/curl/tests/data/test1597
index 047bf7bd80..7f18cf41b7 100644
--- a/third-party/curl/tests/data/test1597
+++ b/third-party/curl/tests/data/test1597
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,18 +11,12 @@ CURLOPT_PROTOCOLS_STR
 </reply>
 # Client-side
 <client>
-<server>
-none
-</server>
 <name>
 CURLOPT_PROTOCOLS_STR
 </name>
 <tool>
 lib%TESTNUMBER
 </tool>
-<command>
--
-</command>
 </client>
 
 <verify>
diff --git a/third-party/curl/tests/data/test1598 b/third-party/curl/tests/data/test1598
new file mode 100644
index 0000000000..b241677ed6
--- /dev/null
+++ b/third-party/curl/tests/data/test1598
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP POST
+CURLOPT_HTTPTRAILER_FUNCTION
+CURLOPT_HTTPTRAILER_DATA
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.0 200 OK swsclose
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+</data>
+</reply>
+# Client-side
+<client>
+<features>
+http
+</features>
+<server>
+http
+</server>
+<name>
+HTTP POST with trailers at the end
+</name>
+<tool>
+lib%TESTNUMBER
+</tool>
+<command>
+http://%HOSTIP:%HTTPPORT/bzz/%TESTNUMBER
+</command>
+<stdin>
+more than one byte
+</stdin>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+POST /bzz/%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Trailer: my-super-awesome-trailer, my-other-awesome-trailer
+Transfer-Encoding: chunked
+Content-Type: application/x-www-form-urlencoded
+
+11
+xxx=yyy%AMPaaa=bbbbb
+0
+my-super-awesome-trailer: trail1
+my-other-awesome-trailer: trail2
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1599 b/third-party/curl/tests/data/test1599
new file mode 100644
index 0000000000..054a1b68de
--- /dev/null
+++ b/third-party/curl/tests/data/test1599
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+FTP
+netrc
+</keywords>
+</info>
+
+# Test based on GitHub issue 17659
+# Server-side
+<reply>
+<data>
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+ftp
+</server>
+<name>
+FTP with netrc using no user but control code in password
+</name>
+<command>
+ftp://%HOSTIP:%FTPPORT/%TESTNUMBER %LOGDIR/netrc%TESTNUMBER
+</command>
+<tool>
+lib%TESTNUMBER
+</tool>
+<file name="%LOGDIR/netrc%TESTNUMBER" nonewline="yes">
+default   passwor?dlogin anonymou\ ' password login anonymous       passwor?d.'macdef
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+0
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test16 b/third-party/curl/tests/data/test16
index 9d6f1f1199..821cea6716 100644
--- a/third-party/curl/tests/data/test16
+++ b/third-party/curl/tests/data/test16
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ HTTP proxy Basic auth
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -27,11 +28,11 @@ the content goes here
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with proxy authorization
- </name>
- <command>
- -U fake@user:loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooong -x %HOSTIP:%HTTPPORT http://we.want.that.site.com/%TESTNUMBER
+</name>
+<command>
+-U fake@user:loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooong -x %HOSTIP:%HTTPPORT http://we.want.that.site.com/%TESTNUMBER
 </command>
 <features>
 proxy
@@ -40,10 +41,10 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://we.want.that.site.com/%TESTNUMBER HTTP/1.1
 Host: we.want.that.site.com
-Proxy-Authorization: Basic ZmFrZUB1c2VyOmxvb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29uZw==
+Proxy-Authorization: Basic %b64[fake@user:loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooong]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test160 b/third-party/curl/tests/data/test160
index 0dce89c37f..eedace8709 100644
--- a/third-party/curl/tests/data/test160
+++ b/third-party/curl/tests/data/test160
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,14 +10,14 @@ DELAY
 
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 9
 
 surprise
 </data>
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
@@ -34,17 +35,17 @@ wait 1
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with delayed close, conn reuse, connection reset and retry
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER http://%HOSTIP:%HTTPPORT/wantmore/%TESTNUMBER0001
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 9
@@ -57,7 +58,7 @@ Connection: close
 surprise2
 </stdout>
 
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1600 b/third-party/curl/tests/data/test1600
index 33413d7c39..4cc4c871b6 100644
--- a/third-party/curl/tests/data/test1600
+++ b/third-party/curl/tests/data/test1600
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,18 +7,14 @@ NTLM
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 NTLM
 </features>
- <name>
+<name>
 NTLM unit tests
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1601 b/third-party/curl/tests/data/test1601
index 2065fdd1d8..04a9ce8242 100644
--- a/third-party/curl/tests/data/test1601
+++ b/third-party/curl/tests/data/test1601
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,13 @@ MD5
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 MD5 unit tests
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1602 b/third-party/curl/tests/data/test1602
index 56e243ff8a..820c1b8f2e 100644
--- a/third-party/curl/tests/data/test1602
+++ b/third-party/curl/tests/data/test1602
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,13 @@ hash
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 Internal hash create/add/destroy testing, exercising clean functions
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1603 b/third-party/curl/tests/data/test1603
index 406d197eeb..8149ba763e 100644
--- a/third-party/curl/tests/data/test1603
+++ b/third-party/curl/tests/data/test1603
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,13 @@ hash
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 Internal hash add, retrieval, deletion testing
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1604 b/third-party/curl/tests/data/test1604
index 39daf9ddc5..79bcd0818a 100644
--- a/third-party/curl/tests/data/test1604
+++ b/third-party/curl/tests/data/test1604
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,17 +6,16 @@ unittest
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
-Test WIN32/MSDOS filename sanitization
- </name>
+<name>
+Test Windows/MS-DOS filename sanitization
+</name>
+<tool>
+tool%TESTNUMBER
+</tool>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1605 b/third-party/curl/tests/data/test1605
index a123b01a1d..81431adb73 100644
--- a/third-party/curl/tests/data/test1605
+++ b/third-party/curl/tests/data/test1605
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,17 +6,13 @@ unittest
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 Test negative data lengths as input to libcurl functions
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1606 b/third-party/curl/tests/data/test1606
index 83e9844270..b100b28ec2 100644
--- a/third-party/curl/tests/data/test1606
+++ b/third-party/curl/tests/data/test1606
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,13 @@ speedcheck
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 verify speedcheck
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1607 b/third-party/curl/tests/data/test1607
index 6d28d6eb49..5153174a3a 100644
--- a/third-party/curl/tests/data/test1607
+++ b/third-party/curl/tests/data/test1607
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,13 @@ CURLOPT_RESOLVE
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 CURLOPT_RESOLVE parsing
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1608 b/third-party/curl/tests/data/test1608
index d037508b84..af2ea8de82 100644
--- a/third-party/curl/tests/data/test1608
+++ b/third-party/curl/tests/data/test1608
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,18 +7,14 @@ curlopt_dns_shuffle_addresses
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 shuffle-dns
 </features>
- <name>
+<name>
 verify DNS shuffling
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1609 b/third-party/curl/tests/data/test1609
deleted file mode 100644
index 6d28d6eb49..0000000000
--- a/third-party/curl/tests/data/test1609
+++ /dev/null
@@ -1,22 +0,0 @@
-<testcase>
-<info>
-<keywords>
-unittest
-CURLOPT_RESOLVE
-</keywords>
-</info>
-
-#
-# Client-side
-<client>
-<server>
-none
-</server>
-<features>
-unittest
-</features>
- <name>
-CURLOPT_RESOLVE parsing
- </name>
-</client>
-</testcase>
diff --git a/third-party/curl/tests/data/test161 b/third-party/curl/tests/data/test161
index a8036617ba..23db19005e 100644
--- a/third-party/curl/tests/data/test161
+++ b/third-party/curl/tests/data/test161
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -21,20 +22,19 @@ PASV
 <server>
 ftp
 </server>
- <name>
-FTP RETR PASV
- </name>
- <command>
+<name>
+FTP RETR partial file
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
 
-
 # Verify data after the test has been "shot"
 <verify>
-# This doesn't send QUIT because of known bug:
+# This does not send QUIT because of known bug:
 # "7.8 Premature transfer end but healthy control channel"
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1610 b/third-party/curl/tests/data/test1610
index fff973371d..2624fa71f2 100644
--- a/third-party/curl/tests/data/test1610
+++ b/third-party/curl/tests/data/test1610
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,13 @@ SHA256
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 SHA256 unit tests
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1611 b/third-party/curl/tests/data/test1611
index 008aea7ec4..755c19d0b3 100644
--- a/third-party/curl/tests/data/test1611
+++ b/third-party/curl/tests/data/test1611
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,13 @@ MD4
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 MD4 unit tests
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1612 b/third-party/curl/tests/data/test1612
index 3e92b67912..cc007a41ed 100644
--- a/third-party/curl/tests/data/test1612
+++ b/third-party/curl/tests/data/test1612
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,13 @@ HMAC
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 HMAC unit tests
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1613 b/third-party/curl/tests/data/test1613
index f63dfe3380..399914e87a 100644
--- a/third-party/curl/tests/data/test1613
+++ b/third-party/curl/tests/data/test1613
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ HTTP proxy
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Sat, 29 Feb 2020 16:10:44 GMT
 Server: Blafasel/1.1
@@ -22,7 +22,6 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -40,7 +39,7 @@ proxy
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="yes">
 OPTIONS * HTTP/1.1
 Host: www.example.org
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1614 b/third-party/curl/tests/data/test1614
index 73bdbb4e00..d1894043f8 100644
--- a/third-party/curl/tests/data/test1614
+++ b/third-party/curl/tests/data/test1614
@@ -1,23 +1,21 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 unittest
+noproxy
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 proxy
 </features>
- <name>
+<name>
 noproxy and cidr comparisons
- </name>
+</name>
 </client>
 <errorcode>
 0
diff --git a/third-party/curl/tests/data/test1615 b/third-party/curl/tests/data/test1615
new file mode 100644
index 0000000000..db8d2b9452
--- /dev/null
+++ b/third-party/curl/tests/data/test1615
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+SHA-512/256
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+sha512-256
+</features>
+<name>
+SHA-512/256 unit tests
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test1616 b/third-party/curl/tests/data/test1616
new file mode 100644
index 0000000000..dc4ebc13f9
--- /dev/null
+++ b/third-party/curl/tests/data/test1616
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+uint_hash
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+Internal uint_hash create/add/destroy testing, exercising clean functions
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test1617 b/third-party/curl/tests/data/test1617
new file mode 100644
index 0000000000..247d4ed20e
--- /dev/null
+++ b/third-party/curl/tests/data/test1617
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+compressed
+Transfer-Encoding
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Mon, 29 Nov 2004 21:56:53 GMT
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
+Vary: Accept-Encoding
+Content-Type: text/html; charset=ISO-8859-1
+Transfer-Encoding: gzip, chunked
+
+2c
+%hex[%1f%8b%08%08%79%9e%ab%41%00%03%6c%61%6c%61%6c%61%00%cb%c9%cc%4b%55%30%e4%52%c8%01%d1%46%5c]hex%
+%hex[%10%86%31%17%00]hex%
+%hex[%02%71%60%18%00%00%00]hex%
+0
+
+</data>
+
+<datacheck crlf="headers">
+HTTP/1.1 200 OK
+Date: Mon, 29 Nov 2004 21:56:53 GMT
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
+Vary: Accept-Encoding
+Content-Type: text/html; charset=ISO-8859-1
+Transfer-Encoding: gzip, chunked
+
+line 1
+ line 2
+  line 3
+</datacheck>
+
+</reply>
+
+# Client-side
+<client>
+<features>
+libz
+</features>
+<server>
+http
+</server>
+<name>
+HTTP GET transfer-encoding with two user Connection: headers
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --tr-encoding -H "Connection: this" -H "Connection: that"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+TE: gzip
+Connection: this, TE
+Connection: that
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1618 b/third-party/curl/tests/data/test1618
new file mode 100644
index 0000000000..4e2f46f5ad
--- /dev/null
+++ b/third-party/curl/tests/data/test1618
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+compressed
+brotli
+</keywords>
+</info>
+
+<reply>
+
+<data crlf="headers" nonewline="yes">
+HTTP/1.1 200 OK
+Date: Mon, 29 Nov 2004 21:56:53 GMT
+Vary: Accept-Encoding
+Content-Encoding: br
+Content-Length: 14
+
+%hex[%81%fa%7f%0c%fc%13%00%f1%58%20%90%7b%18%00]hex%
+</data>
+
+<datacheck crlf="headers">
+HTTP/1.1 200 OK
+Date: Mon, 29 Nov 2004 21:56:53 GMT
+Vary: Accept-Encoding
+Content-Encoding: br
+Content-Length: 14
+
+</datacheck>
+
+</reply>
+
+# Client-side
+<client>
+<features>
+brotli
+</features>
+<server>
+http
+</server>
+<name>
+HTTP GET brotli compression bomb
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --compressed --max-filesize=1000
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<strippart>
+s/^Accept-Encoding: [a-zA-Z, ]*/Accept-Encoding: xxx/
+</strippart>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Accept-Encoding: xxx
+
+</protocol>
+<errorcode>
+63
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1619 b/third-party/curl/tests/data/test1619
new file mode 100644
index 0000000000..5268228cf0
--- /dev/null
+++ b/third-party/curl/tests/data/test1619
@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+<reply>
+<data nocheck="yes" crlf="headers">
+HTTP/1.1 200 OK
+ETag: W/"heyheyhey"
+Content-Length: 4
+
+yes
+</data>
+</reply>
+
+<client>
+<server>
+http
+</server>
+<name>
+--etag-save to stdout
+</name>
+<command >
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -O --output-dir %LOGDIR --etag-save -
+</command>
+</client>
+
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<stdout>
+W/"heyheyhey"
+</stdout>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test162 b/third-party/curl/tests/data/test162
index 5dd06eadd7..d03df40bb4 100644
--- a/third-party/curl/tests/data/test162
+++ b/third-party/curl/tests/data/test162
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ HTTP
 HTTP GET
 HTTP proxy
 HTTP proxy NTLM auth
-FAILURE
 </keywords>
 </info>
 
@@ -17,9 +17,9 @@ Proxy-Authenticate: Basic realm="Squid proxy-caching web server"
 Server: swsclose
 Content-Type: text/html
 
-Even though it's the response code that triggers authentication, we're
-using NTLM and the server isn't, so we should fail.  We know the server
-isn't because there's no Proxy-Authorization: NTLM header
+Even though it is the response code that triggers authentication, we are
+using NTLM and the server is not, so we should fail.  We know the server
+is not because there is no Proxy-Authorization: NTLM header
 </data1001>
 </reply>
 
@@ -34,20 +34,20 @@ proxy
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET asking for --proxy-ntlm when some other authentication is required
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --proxy http://%HOSTIP:%HTTPPORT --proxy-user foo:bar --proxy-ntlm --fail
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Proxy-Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test1620 b/third-party/curl/tests/data/test1620
index 038bbcc1b4..5eb6818674 100644
--- a/third-party/curl/tests/data/test1620
+++ b/third-party/curl/tests/data/test1620
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,13 @@ URL
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 unit tests for url.c
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1621 b/third-party/curl/tests/data/test1621
index 62c81052ff..19f9edb5a9 100644
--- a/third-party/curl/tests/data/test1621
+++ b/third-party/curl/tests/data/test1621
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,18 +7,16 @@ stripcredentials
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
-https
 </features>
- <name>
+<name>
 unit tests for stripcredentials from URL
- </name>
+</name>
+<tool>
+tool%TESTNUMBER
+</tool>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1622 b/third-party/curl/tests/data/test1622
new file mode 100644
index 0000000000..59895a60c6
--- /dev/null
+++ b/third-party/curl/tests/data/test1622
@@ -0,0 +1,160 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+tool-progress
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+tool time and size progress output
+</name>
+<tool>
+tool%TESTNUMBER
+</tool>
+</client>
+
+<verify>
+<stdout>
+timebuf
+                   0 - %SP%SP%SP%SP%SP%SP%SP%SP
+                   1 - 00:00:01
+                   3 - 00:00:03
+                   7 - 00:00:07
+                  15 - 00:00:15
+                  31 - 00:00:31
+                  63 - 00:01:03
+                 127 - 00:02:07
+                 255 - 00:04:15
+                 511 - 00:08:31
+                1023 - 00:17:03
+                2047 - 00:34:07
+                4095 - 01:08:15
+                8191 - 02:16:31
+               16383 - 04:33:03
+               32767 - 09:06:07
+               65535 - 18:12:15
+              131071 - 36:24:31
+              262143 - 72:49:03
+              524287 -   6d 01h
+             1048575 -  12d 03h
+             2097151 -  24d 06h
+             4194303 -  48d 13h
+             8388607 -  97d 02h
+            16777215 - 194d 04h
+            33554431 - 388d 08h
+            67108863 - 776d 17h
+           134217727 -  51m 23d
+           268435455 - 103m 16d
+           536870911 - 207m 03d
+          1073741823 - 414m 07d
+          2147483647 - 828m 15d
+          4294967295 -     136y
+          8589934591 -     272y
+         17179869183 -     544y
+         34359738367 -    1089y
+         68719476735 -    2179y
+        137438953471 -    4358y
+        274877906943 -    8716y
+        549755813887 -   17432y
+       1099511627775 -   34865y
+       2199023255551 -   69730y
+       4398046511103 -  >99999y
+       8796093022207 -  >99999y
+      17592186044415 -  >99999y
+      35184372088831 -  >99999y
+      70368744177663 -  >99999y
+     140737488355327 -  >99999y
+     281474976710655 -  >99999y
+     562949953421311 -  >99999y
+    1125899906842623 -  >99999y
+    2251799813685247 -  >99999y
+    4503599627370495 -  >99999y
+    9007199254740991 -  >99999y
+   18014398509481983 -  >99999y
+   36028797018963967 -  >99999y
+   72057594037927935 -  >99999y
+  144115188075855871 -  >99999y
+  288230376151711743 -  >99999y
+  576460752303423487 -  >99999y
+ 1152921504606846975 -  >99999y
+ 2305843009213693951 -  >99999y
+ 4611686018427387903 -  >99999y
+max5data
+                   0 -     0
+                   1 -     1
+                   3 -     3
+                   7 -     7
+                  15 -    15
+                  31 -    31
+                  63 -    63
+                 127 -   127
+                 255 -   255
+                 511 -   511
+                1023 -  1023
+                2047 -  2047
+                4095 -  4095
+                8191 -  8191
+               16383 - 16383
+               32767 - 32767
+               65535 - 65535
+              131071 -  127k
+              262143 -  255k
+              524287 -  511k
+             1048575 - 1023k
+             2097151 - 2047k
+             4194303 - 4095k
+             8388607 - 8191k
+            16777215 - 15.9M
+            33554431 - 31.9M
+            67108863 - 63.9M
+           134217727 -  127M
+           268435455 -  255M
+           536870911 -  511M
+          1073741823 - 1023M
+          2147483647 - 2047M
+          4294967295 - 4095M
+          8589934591 - 8191M
+         17179869183 - 15.9G
+         34359738367 - 31.9G
+         68719476735 - 63.9G
+        137438953471 -  127G
+        274877906943 -  255G
+        549755813887 -  511G
+       1099511627775 - 1023G
+       2199023255551 - 2047G
+       4398046511103 - 4095G
+       8796093022207 - 8191G
+      17592186044415 - 15.9T
+      35184372088831 - 31.9T
+      70368744177663 - 63.9T
+     140737488355327 -  127T
+     281474976710655 -  255T
+     562949953421311 -  511T
+    1125899906842623 - 1023T
+    2251799813685247 - 2047T
+    4503599627370495 - 4095T
+    9007199254740991 - 8191T
+   18014398509481983 - 15.9P
+   36028797018963967 - 31.9P
+   72057594037927935 - 63.9P
+  144115188075855871 -  127P
+  288230376151711743 -  255P
+  576460752303423487 -  511P
+ 1152921504606846975 - 1023P
+ 2305843009213693951 - 2047P
+ 4611686018427387903 - 4095P
+              131072 -  128k
+            12645826 - 12.0M
+          1073741824 - 1024M
+         12938588979 - 12.0G
+    1099445657078333 -  999T
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1623 b/third-party/curl/tests/data/test1623
new file mode 100644
index 0000000000..000c08a2ef
--- /dev/null
+++ b/third-party/curl/tests/data/test1623
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+tool-sizeparser
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+the size parser for --limit-rate
+</name>
+<tool>
+tool%TESTNUMBER
+</tool>
+</client>
+
+<verify>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1624 b/third-party/curl/tests/data/test1624
new file mode 100644
index 0000000000..c0a3684801
--- /dev/null
+++ b/third-party/curl/tests/data/test1624
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--url-query
+--next
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+URL + --url-query with --next and another URL without --url-query
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --url-query token=secret --next http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER?token=secret HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1625 b/third-party/curl/tests/data/test1625
new file mode 100644
index 0000000000..58d661c385
--- /dev/null
+++ b/third-party/curl/tests/data/test1625
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+Curl_compareheader
+</keywords>
+</info>
+
+<client>
+<features>
+unittest
+http
+</features>
+<name>
+Curl_compareheader unit test
+</name>
+</client>
+
+<verify>
+<stdout mode="text">
+31 invokes
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1626 b/third-party/curl/tests/data/test1626
new file mode 100644
index 0000000000..e56236dbd4
--- /dev/null
+++ b/third-party/curl/tests/data/test1626
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+Curl_copy_header_value
+</keywords>
+</info>
+
+<client>
+<features>
+unittest
+http
+</features>
+<name>
+Curl_copy_header_value unit test
+</name>
+</client>
+
+<verify>
+<stdout mode="text">
+28 invokes
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1627 b/third-party/curl/tests/data/test1627
new file mode 100644
index 0000000000..807352612d
--- /dev/null
+++ b/third-party/curl/tests/data/test1627
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+Curl_get_scheme
+</keywords>
+</info>
+
+<client>
+<features>
+unittest
+</features>
+<name>
+Curl_get_scheme unit test
+</name>
+</client>
+
+<verify>
+<stdout mode="text">
+199 invokes
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1628 b/third-party/curl/tests/data/test1628
new file mode 100644
index 0000000000..f4f1da5d8d
--- /dev/null
+++ b/third-party/curl/tests/data/test1628
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP PUT
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+HTTP/1.0 200 OK swsclose
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+
+blablabla
+
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+proxy
+</features>
+<server>
+http
+</server>
+<name>
+HTTP PUT from file with weird letters over an HTTP proxy
+</name>
+<command>
+-x http://%HOSTIP:%HTTPPORT http://ssss/ -T %LOGDIR/%TESTNUMBERte[]st.txt
+</command>
+<file name="%LOGDIR/%TESTNUMBERte[]st.txt">
+a few bytes
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+PUT http://ssss/%TESTNUMBERte%5B%5Dst.txt HTTP/1.1
+Host: ssss
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+Content-Length: 12
+
+a few bytes
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1629 b/third-party/curl/tests/data/test1629
new file mode 100644
index 0000000000..f5e1dcbee4
--- /dev/null
+++ b/third-party/curl/tests/data/test1629
@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+--resolve
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Set-Cookie: something=1; Domain=co.uk.; Path=/
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+PSL
+cookies
+</features>
+<server>
+http
+</server>
+<name>
+cookies with trailing dot after PSL domain
+</name>
+<command>
+http://foo.co.uk.:%HTTPPORT/ http://bar.co.uk.:%HTTPPORT/ -b "" --resolve foo.co.uk.:%HTTPPORT:%HOSTIP --resolve bar.co.uk.:%HTTPPORT:%HOSTIP
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET / HTTP/1.1
+Host: foo.co.uk.:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET / HTTP/1.1
+Host: bar.co.uk.:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test163 b/third-party/curl/tests/data/test163
index fdaaff9bdb..0f2e7dc5c0 100644
--- a/third-party/curl/tests/data/test163
+++ b/third-party/curl/tests/data/test163
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -26,11 +27,11 @@ Mime
 <server>
 http
 </server>
- <name>
+<name>
 HTTP multipart formpost with contents from a file
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -F "name=<%LOGDIR/field%TESTNUMBER" -F tool=curl
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -F "name=%LT%LOGDIR/field%TESTNUMBER" -F tool=curl
 </command>
 # We create this file before the command is invoked!
 <file name="%LOGDIR/field%TESTNUMBER">
@@ -41,7 +42,7 @@ file
 
 newlinens?
 yes please
-        
+        %CR
 [tab][CR] too
 </file>
 </client>
@@ -52,16 +53,16 @@ yes please
 ^(Content-Type: multipart/form-data;|------------).*
 </strip>
 <protocol>
-POST /we/want/%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Content-Length: 304
-Content-Type: multipart/form-data; boundary=----------------------------c2d1767eb6ac
-
-------------------------------c2d1767eb6ac
-Content-Disposition: form-data; name="name"
-
+POST /we/want/%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Content-Length: 322%CR
+Content-Type: multipart/form-data; boundary=----------------------------c2d1767eb6ac%CR
+%CR
+------------------------------c2d1767eb6ac%CR
+Content-Disposition: form-data; name="name"%CR
+%CR
 contents
 from
 a
@@ -69,14 +70,14 @@ file
 
 newlinens?
 yes please
-        
+        %CR
 [tab][CR] too
-
-------------------------------c2d1767eb6ac
-Content-Disposition: form-data; name="tool"
-
-curl
-------------------------------c2d1767eb6ac--
+%CR
+------------------------------c2d1767eb6ac%CR
+Content-Disposition: form-data; name="tool"%CR
+%CR
+curl%CR
+------------------------------c2d1767eb6ac--%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1630 b/third-party/curl/tests/data/test1630
index 321f53d0b7..24ec4cc954 100644
--- a/third-party/curl/tests/data/test1630
+++ b/third-party/curl/tests/data/test1630
@@ -1,16 +1,17 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
-HTTPS-proxy
-HTTPS-proxy Basic auth
+HTTPS proxy
+HTTPS proxy Basic auth
 </keywords>
 </info>
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -28,11 +29,11 @@ the content goes here
 http
 https-proxy
 </server>
- <name>
+<name>
 HTTPS-proxy with Basic auth to HTTP without auth
- </name>
- <command>
- -U fake@user:loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooong -x https://%HOSTIP:%HTTPSPROXYPORT http://we.want.that.site.com/%TESTNUMBER --proxy-insecure
+</name>
+<command>
+-U fake@user:loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooong -x https://%HOSTIP:%HTTPSPROXYPORT http://we.want.that.site.com/%TESTNUMBER --proxy-insecure
 </command>
 <features>
 proxy
@@ -41,10 +42,10 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 GET http://we.want.that.site.com/%TESTNUMBER HTTP/1.1
 Host: we.want.that.site.com
-Proxy-Authorization: Basic ZmFrZUB1c2VyOmxvb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29uZw==
+Proxy-Authorization: Basic %b64[fake@user:loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooong]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test1631 b/third-party/curl/tests/data/test1631
index 7008a445f5..f0018516d5 100644
--- a/third-party/curl/tests/data/test1631
+++ b/third-party/curl/tests/data/test1631
@@ -1,8 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
-HTTPS-proxy
+HTTPS proxy
+flaky
 </keywords>
 </info>
 
@@ -10,7 +12,7 @@ HTTPS-proxy
 <reply>
 
 # This is the HTTPS proxy response
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -28,7 +30,7 @@ Hull.  He got a good estate by merchandise,and leaving off his trade, lived
 afterwards at York, from whence he had married my mother, whoserelations were
 named Robinson, a very good family in that country, and from whom I was
 calledRobinson Kreutznaer; but, by the usual corruption of words in England,
-we are now called—nay wecall ourselves and write our name—Crusoe; and so my
+we are now called-nay wecall ourselves and write our name-Crusoe; and so my
 companions always called me.
 </data>
 </reply>
@@ -39,10 +41,10 @@ companions always called me.
 ftp
 https-proxy
 </server>
- <name>
+<name>
 FTP through HTTPS-proxy
- </name>
- <command>
+</name>
+<command>
 -p -x https://%HOSTIP:%HTTPSPROXYPORT ftp://ftp.site.thru.https.proxy:%FTPPORT/%TESTNUMBER --proxy-insecure
 </command>
 <features>
@@ -54,25 +56,24 @@ proxy
 # Verify data after the test has been "shot"
 <verify>
 
-# The second CONNECT will be made to the dynamic port number the FTP server
-# opens for us, so we can't compare with a known pre-existing number!
+# The second CONNECT is made to the dynamic port number the FTP server
+# opens for us, so we cannot compare with a known pre-existing number.
 <strippart>
 s/((https.proxy):(\d+))/$2:12345/
-s/^(User-Agent: curl).*/$1/
 </strippart>
-<proxy>
+<proxy crlf="headers">
 CONNECT ftp.site.thru.https.proxy:12345 HTTP/1.1
 Host: ftp.site.thru.https.proxy:12345
-User-Agent: curl
+User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
 CONNECT ftp.site.thru.https.proxy:12345 HTTP/1.1
 Host: ftp.site.thru.https.proxy:12345
-User-Agent: curl
+User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
 </proxy>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1632 b/third-party/curl/tests/data/test1632
index 44e702729a..eda70d0d98 100644
--- a/third-party/curl/tests/data/test1632
+++ b/third-party/curl/tests/data/test1632
@@ -1,8 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
-HTTPS-proxy
+HTTPS proxy
+flaky
 </keywords>
 </info>
 
@@ -10,7 +12,7 @@ HTTPS-proxy
 <reply>
 
 # This is the HTTPS proxy response
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -28,7 +30,7 @@ Hull.  He got a good estate by merchandise,and leaving off his trade, lived
 afterwards at York, from whence he had married my mother, whoserelations were
 named Robinson, a very good family in that country, and from whom I was
 calledRobinson Kreutznaer; but, by the usual corruption of words in England,
-we are now called—nay wecall ourselves and write our name—Crusoe; and so my
+we are now called-nay wecall ourselves and write our name-Crusoe; and so my
 companions always called me.
 </data>
 
@@ -48,10 +50,10 @@ mother knew what became of me.
 ftp
 https-proxy
 </server>
- <name>
+<name>
 FTP through HTTPS-proxy, with connection reuse
- </name>
- <command>
+</name>
+<command>
 -p -x https://%HOSTIP:%HTTPSPROXYPORT ftp://ftp.site.thru.https.proxy:%FTPPORT/%TESTNUMBER --proxy-insecure ftp://ftp.site.thru.https.proxy:%FTPPORT/%TESTNUMBER0002
 </command>
 <features>
@@ -63,31 +65,30 @@ proxy
 # Verify data after the test has been "shot"
 <verify>
 
-# The second and third CONNECT will be made to the dynamic port number the FTP
-# server opens for us, so we can't compare with known pre-existing numbers!
+# The second and third CONNECTs are made to the dynamic port number the FTP
+# server opens for us, so we cannot compare with known pre-existing numbers.
 
 <strippart>
 s/((https.proxy):(\d+))/$2:12345/
-s/^(User-Agent: curl).*/$1/
 </strippart>
-<proxy>
+<proxy crlf="headers">
 CONNECT ftp.site.thru.https.proxy:12345 HTTP/1.1
 Host: ftp.site.thru.https.proxy:12345
-User-Agent: curl
+User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
 CONNECT ftp.site.thru.https.proxy:12345 HTTP/1.1
 Host: ftp.site.thru.https.proxy:12345
-User-Agent: curl
+User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
 CONNECT ftp.site.thru.https.proxy:12345 HTTP/1.1
 Host: ftp.site.thru.https.proxy:12345
-User-Agent: curl
+User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
 </proxy>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1633 b/third-party/curl/tests/data/test1633
index 1e02958981..ec1e256d3e 100644
--- a/third-party/curl/tests/data/test1633
+++ b/third-party/curl/tests/data/test1633
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ RETRY-AFTER
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -52,7 +52,6 @@ Connection: close
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -66,10 +65,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -d moo --retry 1 -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1634 b/third-party/curl/tests/data/test1634
index 87b74d0c06..18d19d96a2 100644
--- a/third-party/curl/tests/data/test1634
+++ b/third-party/curl/tests/data/test1634
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ RETRY-AFTER
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -38,7 +38,6 @@ hey
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -48,14 +47,13 @@ http
 --retry with a 429 response and Retry-After: and --fail
 </name>
 <command>
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER --retry 1  --fail
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --retry 1 --fail
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1635 b/third-party/curl/tests/data/test1635
index c94f802132..738465e122 100644
--- a/third-party/curl/tests/data/test1635
+++ b/third-party/curl/tests/data/test1635
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ RETRY-AFTER
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -27,7 +27,6 @@ hey
 
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -37,14 +36,13 @@ http
 --retry with a 429 response and Retry-After: and --fail-with-body
 </name>
 <command option="no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER --retry 1  --fail-with-body
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --retry 1 --fail-with-body
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1636 b/third-party/curl/tests/data/test1636
new file mode 100644
index 0000000000..eeec5a6510
--- /dev/null
+++ b/third-party/curl/tests/data/test1636
@@ -0,0 +1,161 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+time2str
+max6out
+</keywords>
+</info>
+
+<client>
+<features>
+unittest
+</features>
+
+<name>
+time2str and max6out
+</name>
+<command>
+%LOGDIR/%TESTNUMBER
+</command>
+</client>
+<verify>
+<stdout mode="text">
+time2str
+                   0 - %SP%SP%SP%SP%SP%SP%SP
+                   1 -   00:01
+                   3 -   00:03
+                   7 -   00:07
+                  15 -   00:15
+                  31 -   00:31
+                  63 -   01:03
+                 127 -   02:07
+                 255 -   04:15
+                 511 -   08:31
+                1023 -   17:03
+                2047 -   34:07
+                4095 - 1:08:15
+                8191 - 2:16:31
+               16383 - 4:33:03
+               32767 - 9:06:07
+               65535 - 18h 12m
+              131071 - 36h 24m
+              262143 - 72h 49m
+              524287 -  6d 01h
+             1048575 - 12d 03h
+             2097151 - 24d 06h
+             4194303 - 48d 13h
+             8388607 - 97d 02h
+            16777215 -    194d
+            33554431 -    388d
+            67108863 -    776d
+           134217727 -     51m
+           268435455 -    103m
+           536870911 -    207m
+          1073741823 -    414m
+          2147483647 -    828m
+          4294967295 -    136y
+          8589934591 -    272y
+         17179869183 -    544y
+         34359738367 -   1089y
+         68719476735 -   2179y
+        137438953471 -   4358y
+        274877906943 -   8716y
+        549755813887 -  17432y
+       1099511627775 -  34865y
+       2199023255551 -  69730y
+       4398046511103 - >99999y
+       8796093022207 - >99999y
+      17592186044415 - >99999y
+      35184372088831 - >99999y
+      70368744177663 - >99999y
+     140737488355327 - >99999y
+     281474976710655 - >99999y
+     562949953421311 - >99999y
+    1125899906842623 - >99999y
+    2251799813685247 - >99999y
+    4503599627370495 - >99999y
+    9007199254740991 - >99999y
+   18014398509481983 - >99999y
+   36028797018963967 - >99999y
+   72057594037927935 - >99999y
+  144115188075855871 - >99999y
+  288230376151711743 - >99999y
+  576460752303423487 - >99999y
+ 1152921504606846975 - >99999y
+ 2305843009213693951 - >99999y
+ 4611686018427387903 - >99999y
+max6out
+                   0 -      0
+                   1 -      1
+                   3 -      3
+                   7 -      7
+                  15 -     15
+                  31 -     31
+                  63 -     63
+                 127 -    127
+                 255 -    255
+                 511 -    511
+                1023 -   1023
+                2047 -   2047
+                4095 -   4095
+                8191 -   8191
+               16383 -  16383
+               32767 -  32767
+               65535 -  65535
+              131071 - 127.9k
+              262143 - 255.9k
+              524287 - 511.9k
+             1048575 -  0.99M
+             2097151 -  1.99M
+             4194303 -  3.99M
+             8388607 -  7.99M
+            16777215 - 15.99M
+            33554431 - 31.99M
+            67108863 - 63.99M
+           134217727 - 127.9M
+           268435455 - 255.9M
+           536870911 - 511.9M
+          1073741823 -  0.99G
+          2147483647 -  1.99G
+          4294967295 -  3.99G
+          8589934591 -  7.99G
+         17179869183 - 15.99G
+         34359738367 - 31.99G
+         68719476735 - 63.99G
+        137438953471 - 127.9G
+        274877906943 - 255.9G
+        549755813887 - 511.9G
+       1099511627775 -  0.99T
+       2199023255551 -  1.99T
+       4398046511103 -  3.99T
+       8796093022207 -  7.99T
+      17592186044415 - 15.99T
+      35184372088831 - 31.99T
+      70368744177663 - 63.99T
+     140737488355327 - 127.9T
+     281474976710655 - 255.9T
+     562949953421311 - 511.9T
+    1125899906842623 -  0.99P
+    2251799813685247 -  1.99P
+    4503599627370495 -  3.99P
+    9007199254740991 -  7.99P
+   18014398509481983 - 15.99P
+   36028797018963967 - 31.99P
+   72057594037927935 - 63.99P
+  144115188075855871 - 127.9P
+  288230376151711743 - 255.9P
+  576460752303423487 - 511.9P
+ 1152921504606846975 -  0.99E
+ 2305843009213693951 -  1.99E
+ 4611686018427387903 -  3.99E
+              131072 - 128.0k
+            12645826 - 12.05M
+          1073741824 -  1.00G
+         12938588979 - 12.04G
+    1099445657078333 - 999.9T
+</stdout>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1637 b/third-party/curl/tests/data/test1637
new file mode 100644
index 0000000000..1a76481a43
--- /dev/null
+++ b/third-party/curl/tests/data/test1637
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--retry
+--fail
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 502 Not OK
+Content-Length: 6
+Content-Type: text/html
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP 502 with --fail and --retry 2
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --fail --retry 2 --retry-delay 0.1
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<errorcode>
+22
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1638 b/third-party/curl/tests/data/test1638
new file mode 100644
index 0000000000..043111ec35
--- /dev/null
+++ b/third-party/curl/tests/data/test1638
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP proxy
+HSTS
+</keywords>
+</info>
+
+<reply>
+
+# we use this as response to a CONNECT
+<connect crlf="headers" nocheck="yes">
+HTTP/1.1 200 not OK at all
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Connection: close
+Funny-head: yesyes
+
+</connect>
+
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 not OK at all
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 6
+Connection: close
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+<client>
+<server>
+http
+</server>
+<features>
+HSTS
+proxy
+https
+large-time
+</features>
+
+<file name="%LOGDIR/hsts%TESTNUMBER">
+# comment in input file
+foo.example. "20391001 04:47:41"
+.foo.example. "20291001 04:47:41"
+</file>
+
+<name>
+HSTS duplicate domains where the update adds subdomains
+</name>
+<command>
+-x http://%HOSTIP:%HTTPPORT http://this.hsts.example/%TESTNUMBER --hsts %LOGDIR/hsts%TESTNUMBER
+</command>
+<disable>
+test-duphandle
+</disable>
+</client>
+
+<verify>
+<protocol crlf="headers">
+GET http://this.hsts.example/%TESTNUMBER HTTP/1.1
+Host: this.hsts.example
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+<file name="%LOGDIR/hsts%TESTNUMBER" mode="text">
+# Your HSTS cache. https://curl.se/docs/hsts.html
+# This file was generated by libcurl! Edit at your own risk.
+.foo.example "20391001 04:47:41"
+</file>
+
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1639 b/third-party/curl/tests/data/test1639
new file mode 100644
index 0000000000..d171c3dc23
--- /dev/null
+++ b/third-party/curl/tests/data/test1639
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+-O with URL without path using many trailing slashes
+</name>
+<command option="no-output">
+http://%HOSTIP:%HTTPPORT///////////////// -O --output-dir %LOGDIR
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET ///////////////// HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/curl_response" crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test164 b/third-party/curl/tests/data/test164
index 68879435b8..f4e949e5b3 100644
--- a/third-party/curl/tests/data/test164
+++ b/third-party/curl/tests/data/test164
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,30 +13,30 @@ HTTP GET
 # to avoid XML escaping problems).
 <reply>
 <data>
-HTTP/1.1 206 Partial Content swsclose
-Date: Sat, 24 Apr 2004 09:24:49 GMT
-Server: Apache/1.3.29 (Unix) mod_throttle/3.1.2 PHP/4.3.4 mod_fastcgi/2.4.0
-Last-Modified: Tue, 23 Mar 2004 08:23:14 GMT
-ETag: "53814a-ec5-405ff3f2"
-Accept-Ranges: bytes
-Content-Length: 187
-Content-Type: multipart/byteranges; boundary=408a326132c
-
---408a326132c
-Content-type: text/html
-Content-range: bytes 0-10/3781
-
+HTTP/1.1 206 Partial Content swsclose%CR
+Date: Sat, 24 Apr 2004 09:24:49 GMT%CR
+Server: Apache/1.3.29 (Unix) mod_throttle/3.1.2 PHP/4.3.4 mod_fastcgi/2.4.0%CR
+Last-Modified: Tue, 23 Mar 2004 08:23:14 GMT%CR
+ETag: "53814a-ec5-405ff3f2"%CR
+Accept-Ranges: bytes%CR
+Content-Length: 187%CR
+Content-Type: multipart/byteranges; boundary=408a326132c%CR
+%CR
+--408a326132c%CR
+Content-type: text/html%CR
+Content-range: bytes 0-10/3781%CR
+%CR
 {html}
 {hea
-
---408a326132c
-Content-type: text/html
-Content-range: bytes 12-15/3781
-
+%CR
+--408a326132c%CR
+Content-type: text/html%CR
+Content-range: bytes 12-15/3781%CR
+%CR
 }
 {t
-
---408a326132c--
+%CR
+--408a326132c--%CR
 </data>
 </reply>
 
@@ -44,17 +45,17 @@ Content-range: bytes 12-15/3781
 <server>
 http
 </server>
- <name>
+<name>
 HTTP range with multiple ranges
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -r 0-10,12-15
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Range: bytes=0-10,12-15
diff --git a/third-party/curl/tests/data/test1640 b/third-party/curl/tests/data/test1640
new file mode 100644
index 0000000000..816ca83979
--- /dev/null
+++ b/third-party/curl/tests/data/test1640
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+MQTT
+MQTT SUBSCRIBE
+MQTTS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+hello
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+mqtts
+</features>
+<server>
+mqtts
+</server>
+<name>
+MQTTS SUBSCRIBE
+</name>
+<command option="binary-trace">
+mqtts://%HOSTIP:%MQTTSPORT/topic --insecure
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+# These are hexadecimal protocol dumps from the client
+# Strip out the random part of the client id from the CONNECT message
+# before comparison
+<strippart>
+s/^(.* 00044d5154540402003c000c6375726c).*/$1/
+</strippart>
+<protocol>
+client CONNECT 18 00044d5154540402003c000c6375726c
+server CONNACK 2 20020000
+client SUBSCRIBE a 00010005746f70696300
+server SUBACK 3 9003000100
+server PUBLISH d 300d0005746f70696368656c6c6f0a
+server DISCONNECT 0 e000
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1641 b/third-party/curl/tests/data/test1641
new file mode 100644
index 0000000000..a71a59b056
--- /dev/null
+++ b/third-party/curl/tests/data/test1641
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+-J
+</keywords>
+</info>
+
+<reply>
+<data nocheck="yes">
+HTTP/1.1 301 OK
+Location: %TESTNUMBER0002
+
+</data>
+<data2 nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
+
+12345
+</data2>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP GET with -J, a redirect and Content-Disposition in the second response
+</name>
+<command option="no-output,no-include">
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -L -O --output-dir %LOGDIR
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER0002 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/name%TESTNUMBER">
+12345
+</file>
+
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1642 b/third-party/curl/tests/data/test1642
new file mode 100644
index 0000000000..81f0ae8fc6
--- /dev/null
+++ b/third-party/curl/tests/data/test1642
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+-J
+</keywords>
+</info>
+
+<reply>
+<data nocheck="yes">
+HTTP/1.1 301 OK
+Location: go/here/%TESTNUMBER0002
+
+</data>
+<data2 nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+12345
+</data2>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP GET with -J, redirect, no Content-Disposition use the Location: name
+</name>
+<command option="no-output,no-include">
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -L -O --output-dir %LOGDIR
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /go/here/%TESTNUMBER0002 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/%TESTNUMBER0002">
+12345
+</file>
+
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1643 b/third-party/curl/tests/data/test1643
new file mode 100644
index 0000000000..17c368344e
--- /dev/null
+++ b/third-party/curl/tests/data/test1643
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+-J
+</keywords>
+</info>
+
+<reply>
+<data nocheck="yes">
+HTTP/1.1 301 OK
+Location: go/here/%TESTNUMBER0002#first
+
+</data>
+<data2 nocheck="yes">
+HTTP/1.1 301 OK
+Location: too/%TESTNUMBER0003?fooo#second/%TESTNUMBER0003
+
+</data2>
+<data3 nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+12345
+</data3>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP -J, two redirects, use the last Location: name
+</name>
+<command option="no-output,no-include">
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -L -O --output-dir %LOGDIR
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /go/here/%TESTNUMBER0002 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /go/here/too/%TESTNUMBER0003?fooo HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/%TESTNUMBER0003">
+12345
+</file>
+
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1644 b/third-party/curl/tests/data/test1644
new file mode 100644
index 0000000000..14cd7cec7f
--- /dev/null
+++ b/third-party/curl/tests/data/test1644
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+-O with URL with path but using many trailing slashes
+</name>
+<command option="no-output">
+http://%HOSTIP:%HTTPPORT///foo////////////// -O --output-dir %LOGDIR
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET ///foo////////////// HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/foo" crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1645 b/third-party/curl/tests/data/test1645
new file mode 100644
index 0000000000..70666ef34c
--- /dev/null
+++ b/third-party/curl/tests/data/test1645
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+cookies
+cookiejar
+--resolve
+</keywords>
+</info>
+# Server-side
+
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 4
+Content-Type: text/html
+Funny-head: yesyes
+Set-Cookie: name=value; domain=test.curl; path=/we/want
+
+boo
+</data>
+<data2 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 4
+Content-Type: text/html
+Funny-head: yesyes
+Set-Cookie: name=value; domain=test.curl; path=/WE/WANT
+
+boo
+</data2>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+cookies for paths using different case
+</name>
+<command>
+http://test.curl:%HTTPPORT/we/want/ http://test.curl:%HTTPPORT/WE/WANT/%TESTNUMBER0002 -c %LOGDIR/jar%TESTNUMBER.txt --resolve test.curl:%HTTPPORT:%HOSTIP
+</command>
+<features>
+cookies
+</features>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /we/want/ HTTP/1.1
+Host: test.curl:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /WE/WANT/%TESTNUMBER0002 HTTP/1.1
+Host: test.curl:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/jar%TESTNUMBER.txt" mode="text">
+# Netscape HTTP Cookie File
+# https://curl.se/docs/http-cookies.html
+# This file was generated by libcurl! Edit at your own risk.
+
+.test.curl	TRUE	/WE/WANT	FALSE	0	name	value
+.test.curl	TRUE	/we/want	FALSE	0	name	value
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1646 b/third-party/curl/tests/data/test1646
new file mode 100644
index 0000000000..6a292ebd26
--- /dev/null
+++ b/third-party/curl/tests/data/test1646
@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+netrc
+--resolve
+</keywords>
+</info>
+
+<reply>
+<data>
+HTTP/1.1 200 OK
+Content-Length: 6
+
+12345
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+netrc parsing without user match but user in URL
+</name>
+<command>
+--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER http://alice@example.com:%HTTPPORT/%TESTNUMBER --resolve example.com:%HTTPPORT:%HOSTIP
+</command>
+<file name="%LOGDIR/netrc%TESTNUMBER" >
+machine example.com login bob password sekret
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: example.com:%HTTPPORT
+Authorization: Basic %b64[alice:]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1647 b/third-party/curl/tests/data/test1647
new file mode 100644
index 0000000000..a87487fa9f
--- /dev/null
+++ b/third-party/curl/tests/data/test1647
@@ -0,0 +1,103 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+HTTP proxy
+HTTP proxy Digest auth
+multi
+</keywords>
+</info>
+
+# Server-side
+<reply>
+
+# this is returned first since we get no proxy-auth
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 407 Authorization Required to proxy me my dear
+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
+Content-Length: 33
+
+And you should ignore this data.
+</data>
+
+# then this is returned when we get proxy-auth
+<data1000 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 21
+Server: no
+
+Nice proxy auth sir!
+</data1000>
+
+<connect crlf="headers">
+HTTP/1.1 401 OK
+Content-Length: 21
+Server: no
+
+Denied access. Leave
+</connect>
+
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+https-proxy
+https
+</server>
+# tool is what to use instead of 'curl'
+<tool>
+lib%TESTNUMBER
+</tool>
+<features>
+!SSPI
+crypto
+proxy
+digest
+Debug
+</features>
+<setenv>
+http_proxy=%HOSTIP:%HTTPPORT
+https_proxy=https://%HOSTIP:%HTTPSPROXYPORT
+CURL_ENTROPY=99376
+</setenv>
+<name>
+HTTP proxy auth Digest, then change proxy with env var and do it again
+</name>
+<command>
+http://test.remote.example.com/path/%TESTNUMBER https://another.example.com:%HTTPSPORT/ daniel:monkey123 another:bump456
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
+Host: test.remote.example.com
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
+Host: test.remote.example.com
+Proxy-Authorization: Digest username="daniel", realm="weirdorealm", nonce="12345", uri="/path/%TESTNUMBER", response="7a1672891aff03248887b1a6674b8096"
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+
+<proxy crlf="headers">
+CONNECT another.example.com:%HTTPSPORT HTTP/1.1
+Host: another.example.com:%HTTPSPORT
+Proxy-Connection: Keep-Alive
+
+</proxy>
+
+# CONNECT fails
+<errorcode>
+7
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1648 b/third-party/curl/tests/data/test1648
new file mode 100644
index 0000000000..623f3c9a81
--- /dev/null
+++ b/third-party/curl/tests/data/test1648
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+HTTP proxy
+HTTP proxy auth
+</keywords>
+</info>
+
+# Server-side
+<reply>
+
+# this is returned first since we get no proxy-auth
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 407 Authorization Required to proxy me my dear
+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
+Content-Length: 33
+
+And you should ignore this data.
+</data>
+
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+# tool is what to use instead of 'curl'
+<tool>
+lib%TESTNUMBER
+</tool>
+<features>
+proxy
+</features>
+<name>
+HTTP proxy with auth, change proxy, clear auth
+</name>
+<command>
+%HOSTIP %HTTPPORT
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://example.com/ HTTP/1.1
+Host: example.com
+Proxy-Authorization: Basic %b64[victim:secret]b64%
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://example.com/ HTTP/1.1
+Host: example.com
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1649 b/third-party/curl/tests/data/test1649
new file mode 100644
index 0000000000..d2fd7799bd
--- /dev/null
+++ b/third-party/curl/tests/data/test1649
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+Referer
+</keywords>
+</info>
+
+# Server-side
+<reply>
+
+# this is returned first since we get no proxy-auth
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Content-Length: 6
+
+hello
+</data>
+
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+
+<tool>
+lib%TESTNUMBER
+</tool>
+<name>
+Set referer first then NULL it
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET / HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Referer: https://secret.example.com/
+
+GET / HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+</protocol>
+
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test165 b/third-party/curl/tests/data/test165
index b9b149df0d..5df4823052 100644
--- a/third-party/curl/tests/data/test165
+++ b/third-party/curl/tests/data/test165
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ IDN
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -21,35 +21,30 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 <features>
-idn
+IDN
 proxy
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=en_US.UTF-8
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
-HTTP over proxy with IDN host name
- </name>
- <command>
-http://www.åäö.se/page/%TESTNUMBER -x %HOSTIP:%HTTPPORT http://www.große.de/page/%TESTNUMBER
+<name>
+HTTP over proxy with IDN hostname
+</name>
+<command>
+http://www.%hex[%c3%a5%c3%a4%c3%b6]hex%.se/page/%TESTNUMBER -x %HOSTIP:%HTTPPORT http://www.gro%hex[%c3%9f]hex%e.de/page/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://www.xn--4cab6c.se/page/%TESTNUMBER HTTP/1.1
 Host: www.xn--4cab6c.se
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1650 b/third-party/curl/tests/data/test1650
index 6248b9814d..854ca4d633 100644
--- a/third-party/curl/tests/data/test1650
+++ b/third-party/curl/tests/data/test1650
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,18 +7,14 @@ DOH
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 DoH
 </features>
- <name>
-DOH
- </name>
+<name>
+DoH parsing
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1651 b/third-party/curl/tests/data/test1651
index d29974bf20..f6322bd00f 100644
--- a/third-party/curl/tests/data/test1651
+++ b/third-party/curl/tests/data/test1651
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,20 @@ x509
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 x509 parsing
- </name>
+</name>
+
+<verify>
+<limits>
+Allocations: 14000
+</limits>
+</verify>
+
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1652 b/third-party/curl/tests/data/test1652
index 678d195178..36829d7228 100644
--- a/third-party/curl/tests/data/test1652
+++ b/third-party/curl/tests/data/test1652
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,11 +8,9 @@ infof
 </info>
 
 <client>
-<server>
-none
-</server>
 <features>
 unittest
+verbose-strings
 </features>
 <name>
 infof
diff --git a/third-party/curl/tests/data/test1653 b/third-party/curl/tests/data/test1653
index fff7f6e56c..955e047ff9 100644
--- a/third-party/curl/tests/data/test1653
+++ b/third-party/curl/tests/data/test1653
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,9 +8,6 @@ urlapi
 </info>
 
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
diff --git a/third-party/curl/tests/data/test1654 b/third-party/curl/tests/data/test1654
index 3bd6f65c01..28614606bb 100644
--- a/third-party/curl/tests/data/test1654
+++ b/third-party/curl/tests/data/test1654
@@ -1,16 +1,13 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 unittest
-alt-svc
-altsvc
+Alt-Svc
 </keywords>
 </info>
 
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 alt-svc
@@ -27,13 +24,14 @@ alt-svc
 %LOGDIR/%TESTNUMBER
 </command>
 <file name="%LOGDIR/%TESTNUMBER" mode="text">
-h2 example.com 443 h3 shiny.example.com 8443 "20191231 00:00:00" 0 1
+h2 example.com 443 h3 shiny.example.com 8443 "20191231 00:00:00" 0 0
+h2 expired.com 443 h3 shiny.example.com 8443 "20190122 00:00:00" 0 0
 # a comment
-h2 foo.example.com 443 h3 shiny.example.com 8443 "20291231 23:30:00" 0 1
-  h1 example.com 443 h3 shiny.example.com 8443 "20121231 00:00:01" 0 1
-	h3 example.com 443 h3 shiny.example.com 8443 "20131231 00:00:00" 0 1
+h2 foo.example.com 443 h3 shiny.example.com 8443 "20291231 23:30:00" 0 0
+  h1 example.com 443 h3 shiny.example.com 8443 "20221231 00:00:01" 0 0
+%TABh3 example.com 443 h3 shiny.example.com 8443 "20231231 00:00:00" 0 0
     # also a comment
-bad example.com 443 h3 shiny.example.com 8443 "20191231 00:00:00" 0 1
+bad example.com 443 h3 shiny.example.com 8443 "20191231 00:00:00" 0 0
 rubbish
 </file>
 </client>
@@ -41,16 +39,18 @@ rubbish
 <file name="%LOGDIR/%TESTNUMBER-out" mode="text">
 # Your alt-svc cache. https://curl.se/docs/alt-svc.html
 # This file was generated by libcurl! Edit at your own risk.
-h2 example.com 443 h3 shiny.example.com 8443 "20191231 00:00:00" 0 1
-h2 foo.example.com 443 h3 shiny.example.com 8443 "20291231 23:30:00" 0 1
-h1 example.com 443 h3 shiny.example.com 8443 "20121231 00:00:01" 0 1
-h3 example.com 443 h3 shiny.example.com 8443 "20131231 00:00:00" 0 1
+h2 example.com 443 h3 shiny.example.com 8443 "20191231 00:00:00" 0 0
+h2 foo.example.com 443 h3 shiny.example.com 8443 "20291231 23:30:00" 0 0
+h1 example.com 443 h3 shiny.example.com 8443 "20221231 00:00:01" 0 0
+h3 example.com 443 h3 shiny.example.com 8443 "20231231 00:00:00" 0 0
 h1 example.org 8080 h2 example.com 8080 "20190125 22:34:21" 0 0
 h1 2.example.org 8080 h3 2.example.org 8080 "20190125 22:34:21" 0 0
 h1 3.example.org 8080 h2 example.com 8080 "20190125 22:34:21" 0 0
 h1 3.example.org 8080 h3 yesyes.com 8080 "20190125 22:34:21" 0 0
 h2 example.org 80 h2 example.com 443 "20190124 22:36:21" 0 0
 h2 example.net 80 h2 example.net 443 "20190124 22:37:21" 0 0
+h2 test.se 443 h2 test2.se 443 "20190124 22:37:21" 0 0
+h2 test.se 443 h2 test3.se 443 "20190124 22:36:21" 0 0
 </file>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1655 b/third-party/curl/tests/data/test1655
index e161fb6621..fbcd774eb2 100644
--- a/third-party/curl/tests/data/test1655
+++ b/third-party/curl/tests/data/test1655
@@ -1,23 +1,20 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 unittest
-doh
+DOH
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 DoH
 </features>
- <name>
-unit test for doh_encode
- </name>
+<name>
+unit test for doh_req_encode
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1656 b/third-party/curl/tests/data/test1656
new file mode 100644
index 0000000000..007d744144
--- /dev/null
+++ b/third-party/curl/tests/data/test1656
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+GTime2str
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+GTime2str unit tests
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test1657 b/third-party/curl/tests/data/test1657
new file mode 100644
index 0000000000..40164230fe
--- /dev/null
+++ b/third-party/curl/tests/data/test1657
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+getASN1Element
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+getASN1Element unit tests
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test1658 b/third-party/curl/tests/data/test1658
new file mode 100644
index 0000000000..56ec510bc0
--- /dev/null
+++ b/third-party/curl/tests/data/test1658
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+doh
+httpsrr
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+DoH
+</features>
+<name>
+unit test for doh_resp_decode_httpsrr
+</name>
+</client>
+<verify>
+<stderr mode="text">
+URL: -
+Test ended with result 0
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1659 b/third-party/curl/tests/data/test1659
new file mode 100644
index 0000000000..4215a80f97
--- /dev/null
+++ b/third-party/curl/tests/data/test1659
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+--connect-to
+FILE
+</keywords>
+</info>
+
+<client>
+<features>
+file
+</features>
+<name>
+--connect-to when using file:// URL
+</name>
+<command>
+file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt --connect-to localhost:8080:localhost:8080
+</command>
+<file name="%LOGDIR/test%TESTNUMBER.txt">
+1234567890
+</file>
+</client>
+
+<verify>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test166 b/third-party/curl/tests/data/test166
index fa69f00bee..45a41e3e9a 100644
--- a/third-party/curl/tests/data/test166
+++ b/third-party/curl/tests/data/test166
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -26,10 +27,10 @@ Mime
 <server>
 http
 </server>
- <name>
+<name>
 HTTP formpost a file with spaces in name
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -F "name=@%LOGDIR/fie ld %TESTNUMBER"
 </command>
 # We create this file before the command is invoked!
@@ -44,20 +45,20 @@ data inside the file
 ^(Content-Type: multipart/form-data;|------------).*
 </strip>
 <protocol>
-POST /we/want/%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Content-Length: 223
-Content-Type: multipart/form-data; boundary=----------------------------b0b3d6d23991
-
-------------------------------b0b3d6d23991
-Content-Disposition: form-data; name="name"; filename="fie ld %TESTNUMBER"
-Content-Type: application/octet-stream
-
+POST /we/want/%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Content-Length: 235%CR
+Content-Type: multipart/form-data; boundary=----------------------------b0b3d6d23991%CR
+%CR
+------------------------------b0b3d6d23991%CR
+Content-Disposition: form-data; name="name"; filename="fie ld %TESTNUMBER"%CR
+Content-Type: application/octet-stream%CR
+%CR
 data inside the file
-
-------------------------------b0b3d6d23991--
+%CR
+------------------------------b0b3d6d23991--%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1660 b/third-party/curl/tests/data/test1660
index f86126d19c..20d363e9ae 100644
--- a/third-party/curl/tests/data/test1660
+++ b/third-party/curl/tests/data/test1660
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,9 +8,6 @@ HSTS
 </info>
 
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 HSTS
@@ -52,7 +50,7 @@ this.example [this.example]: 1548400797
 Input 12: error 43
 Input 13: error 43
 Input 14: error 43
-3.example.com [example.com]: 1569905261 includeSubDomains
+3.example.com [3.example.com]: 1569905261 includeSubDomains
 3.example.com [example.com]: 1569905261 includeSubDomains
 foo.example.com [example.com]: 1569905261 includeSubDomains
 'foo.xample.com' is not HSTS
diff --git a/third-party/curl/tests/data/test1661 b/third-party/curl/tests/data/test1661
index 0e02d78d03..ecf50fe704 100644
--- a/third-party/curl/tests/data/test1661
+++ b/third-party/curl/tests/data/test1661
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,13 @@ bufref
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 bufref unit tests
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test1662 b/third-party/curl/tests/data/test1662
index b2fbcce8be..fce2e81610 100644
--- a/third-party/curl/tests/data/test1662
+++ b/third-party/curl/tests/data/test1662
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP POST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -33,12 +33,11 @@ Funny-head: nono
 </data2>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 Mime
-debug
+Debug
 </features>
 <server>
 http
@@ -54,7 +53,6 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 
diff --git a/third-party/curl/tests/data/test1663 b/third-party/curl/tests/data/test1663
new file mode 100644
index 0000000000..3d5331d8fe
--- /dev/null
+++ b/third-party/curl/tests/data/test1663
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+interface
+bind
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+unit tests for interface option parsing
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test1664 b/third-party/curl/tests/data/test1664
new file mode 100644
index 0000000000..ccb0579be7
--- /dev/null
+++ b/third-party/curl/tests/data/test1664
@@ -0,0 +1,242 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+strparse
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+large-size
+</features>
+<name>
+unit tests for strparse.c string parsing functions
+</name>
+</client>
+
+<verify>
+<stdout>
+curlx_str_word
+0: ("word") 0, "word" [4], line 4
+1: ("word ") 0, "word" [4], line 4
+2: (" word ") 2, "" [0], line 0
+3: ("wo rd") 0, "wo" [2], line 2
+4: ("word(") 0, "word(" [5], line 5
+5: ("wor(d") 0, "wor(d" [5], line 5
+6: ("perfect") 0, "perfect" [7], line 7
+7: ("") 2, "" [0], line 0
+8: ("longerth") 1, "" [0], line 0
+curlx_str_until
+0: ("word") 0, "wor" [3], line 3
+1: ("word ") 0, "wor" [3], line 3
+2: (" word ") 0, " wor" [4], line 4
+3: ("wo rd") 0, "wo r" [4], line 4
+4: ("word(") 0, "wor" [3], line 3
+5: ("wor(d") 0, "wor(" [4], line 4
+6: ("perfect") 0, "perfect" [7], line 7
+7: ("") 2, "" [0], line 0
+8: ("longerth") 1, "" [0], line 0
+curlx_str_quotedword
+0: (""word"") 0, "word" [4], line 6
+1: (""word") 4, "" [0], line 0
+2: ("word"") 3, "" [0], line 0
+3: (""word""") 0, "word" [4], line 6
+4: (""word" ") 0, "word" [4], line 6
+5: (" "word"") 3, "" [0], line 0
+6: (""perfect"") 0, "perfect" [7], line 9
+7: (""p r e t"") 0, "p r e t" [7], line 9
+8: (""perfec\"") 1, "" [0], line 0
+9: (""trail\""") 0, "trail\"" [7], line 9
+10: (""trail2\""") 1, "" [0], line 0
+11: (""trail33\""") 1, "" [0], line 0
+12: (""0\\\\\\"") 0, "0\\\\\\" [7], line 9
+13: (""1\\\\\\\"") 1, "" [0], line 0
+14: ("""") 0, "" [0], line 2
+15: ("") 3, "" [0], line 0
+16: (""longerth"") 1, "" [0], line 0
+curlx_str_single
+0: ("a") 0, line 1
+1: ("aa") 0, line 1
+2: ("A") 5, line 0
+3: ("b") 5, line 0
+4: ("\") 5, line 0
+5: (" ") 5, line 0
+6: ("") 5, line 0
+curlx_str_singlespace
+0: ("a") 5, line 0
+1: ("aa") 5, line 0
+2: ("A") 5, line 0
+3: ("b") 5, line 0
+4: ("\") 5, line 0
+5: (" ") 0, line 1
+6: ("%TAB") 5, line 0
+7: ("
+") 5, line 0
+8: ("") 5, line 0
+curlx_str_single
+0: ("a") 0, line 1
+1: ("aa") 0, line 1
+2: ("A") 5, line 0
+3: ("b") 5, line 0
+4: ("\") 5, line 0
+5: (" ") 5, line 0
+6: ("") 5, line 0
+curlx_str_number
+0: ("1") 0, [1] line 1
+1: ("10000") 7, [0] line 0
+2: ("1234") 0, [1234] line 4
+3: ("1235") 0, [1235] line 4
+4: ("1236") 7, [0] line 0
+5: ("01234") 0, [1234] line 5
+6: ("00000000000000000000000000001234") 0, [1234] line 32
+7: ("0123 345") 0, [123] line 4
+8: ("0123O345") 0, [123] line 4
+9: ("-12") 8, [0] line 0
+10: (" 123") 8, [0] line 0
+11: ("") 8, [0] line 0
+curlx_str_number varying max
+0: ("00") max 8 == 0, [0]
+1: ("1") max 8 == 0, [1]
+2: ("1") max 1 == 0, [1]
+3: ("2") max 1 == 7, [0]
+4: ("2") max 2 == 0, [2]
+5: ("5") max 6 == 0, [5]
+6: ("000000000000000000000006") max 6 == 0, [6]
+7: ("7") max 6 == 7, [0]
+8: ("8") max 6 == 7, [0]
+9: ("9") max 8 == 7, [0]
+10: ("10") max 10 == 0, [10]
+11: ("11") max 10 == 7, [0]
+12: ("12") max 10 == 7, [0]
+curlx_str_hex varying max
+0: ("00") max 8 == 0, [0]
+1: ("1") max 8 == 0, [1]
+2: ("1") max 1 == 0, [1]
+3: ("2") max 1 == 7, [0]
+4: ("2") max 2 == 0, [2]
+5: ("5") max 6 == 0, [5]
+6: ("000000000000000000000006") max 6 == 0, [6]
+7: ("7") max 6 == 7, [0]
+8: ("8") max 6 == 7, [0]
+9: ("9") max 8 == 7, [0]
+10: ("a") max 14 == 0, [10]
+11: ("b") max 14 == 0, [11]
+12: ("c") max 14 == 0, [12]
+13: ("d") max 14 == 0, [13]
+14: ("e") max 14 == 0, [14]
+15: ("f") max 14 == 7, [0]
+16: ("f") max 15 == 0, [15]
+17: ("10") max 16 == 0, [16]
+18: ("11") max 16 == 7, [0]
+19: ("12") max 16 == 7, [0]
+curlx_str_octal varying max
+0: ("00") max 4 == 0, [0]
+1: ("1") max 4 == 0, [1]
+2: ("1") max 4 == 0, [1]
+3: ("2") max 4 == 0, [2]
+4: ("3") max 4 == 0, [3]
+5: ("4") max 4 == 0, [4]
+6: ("5") max 4 == 7, [0]
+7: ("000000000000000000000006") max 6 == 0, [6]
+8: ("7") max 7 == 0, [7]
+9: ("10") max 8 == 0, [8]
+10: ("11") max 8 == 7, [0]
+11: ("11") max 9 == 0, [9]
+12: ("12") max 9 == 7, [0]
+13: ("13") max 9 == 7, [0]
+14: ("8") max 10 == 8, [0]
+curlx_str_number / max
+0: ("9223372036854775807") 0, [9223372036854775807] line 19
+1: ("9223372036854775808") 7, [0] line 0
+2: ("18446744073709551615") 7, [0] line 0
+3: ("18446744073709551616") 7, [0] line 0
+4: ("18446744073709551617") 7, [0] line 0
+5: ("0123456799a") 0, [123456799] line 10
+6: ("0123456789") 0, [123456789] line 10
+7: ("123498760b") 0, [123498760] line 9
+8: ("1234987607611298232") 0, [1234987607611298232] line 19
+9: ("1111111111111111111") 0, [1111111111111111111] line 19
+10: ("2222222222222222222") 0, [2222222222222222222] line 19
+11: ("00000000000000000000000000000009223372036854775807") 0, [9223372036854775807] line 50
+12: ("3333333333333333333") 0, [3333333333333333333] line 19
+13: ("4444444444444444444") 0, [4444444444444444444] line 19
+14: ("5555555555555555555") 0, [5555555555555555555] line 19
+15: ("6666666666666666666") 0, [6666666666666666666] line 19
+16: ("7777777777777777777") 0, [7777777777777777777] line 19
+17: ("8888888888888888888") 0, [8888888888888888888] line 19
+18: ("999999999999999999") 0, [999999999999999999] line 18
+curlx_str_newline
+0: (%61) 6, line 0
+1: (%61) 6, line 0
+2: (%41) 6, line 0
+3: (%62) 6, line 0
+4: (%5c) 6, line 0
+5: (%20) 6, line 0
+6: (%0a) 0, line 1
+7: (%0d) 0, line 1
+8: (%0d) 0, line 1
+9: (%0c) 6, line 0
+10: (%00) 6, line 0
+curlx_str_hex
+0: ("1") 0, [1] line 1
+1: ("1000") 0, [4096] line 4
+2: ("1234") 0, [4660] line 4
+3: ("1235") 0, [4661] line 4
+4: ("1236") 7, [0] line 0
+5: ("01234") 0, [4660] line 5
+6: ("00000000000000000000000000001234") 0, [4660] line 32
+7: ("0123 345") 0, [291] line 4
+8: ("0123O345") 0, [291] line 4
+9: ("-12") 8, [0] line 0
+10: (" 123") 8, [0] line 0
+11: ("") 8, [0] line 0
+curlx_str_octal
+0: ("1") 0, [1] line 1
+1: ("1000") 0, [512] line 4
+2: ("1234") 0, [668] line 4
+3: ("1235") 0, [669] line 4
+4: ("1236") 7, [0] line 0
+5: ("01234") 0, [668] line 5
+6: ("00000000000000000000000000001234") 0, [668] line 32
+7: ("0123 345") 0, [83] line 4
+8: ("0123O345") 0, [83] line 4
+9: ("-12") 8, [0] line 0
+10: (" 123") 8, [0] line 0
+11: ("") 8, [0] line 0
+curlx_str_octal / max
+0: ("777777777777777777777") 0, [9223372036854775807] line 21
+1: ("1000000000000000000000") 7, [0] line 0
+2: ("111111111111111111111") 0, [1317624576693539401] line 21
+3: ("222222222222222222222") 0, [2635249153387078802] line 21
+4: ("333333333333333333333") 0, [3952873730080618203] line 21
+5: ("444444444444444444444") 0, [5270498306774157604] line 21
+6: ("555555555555555555555") 0, [6588122883467697005] line 21
+7: ("666666666666666666666") 0, [7905747460161236406] line 21
+curlx_str_hex / max
+0: ("7FFFFFFFFFFFFFFF") 0, [9223372036854775807] line 16
+1: ("8000000000000000") 7, [0] line 0
+2: ("1111111111111111") 0, [1229782938247303441] line 16
+3: ("2222222222222222") 0, [2459565876494606882] line 16
+4: ("3333333333333333") 0, [3689348814741910323] line 16
+5: ("4444444444444444") 0, [4919131752989213764] line 16
+6: ("5555555555555555") 0, [6148914691236517205] line 16
+7: ("6666666666666666") 0, [7378697629483820646] line 16
+8: ("7777777777777777") 0, [8608480567731124087] line 16
+9: ("888888888888888") 0, [614891469123651720] line 15
+10: ("999999999999999") 0, [691752902764108185] line 15
+11: ("aaaaaaaaAAAAAAA") 0, [768614336404564650] line 15
+12: ("bbbbbbbbBBBBBBB") 0, [845475770045021115] line 15
+13: ("BBBBBBBBbbbbbbb") 0, [845475770045021115] line 15
+14: ("ccccccccCCCCCCC") 0, [922337203685477580] line 15
+15: ("ddddddddDDDDDDD") 0, [999198637325934045] line 15
+16: ("eeeeeeeeEEEEEEE") 0, [1076060070966390510] line 15
+17: ("ffffffffFFFFFFF") 0, [1152921504606846975] line 15
+18: ("abcdef") 0, [11259375] line 6
+19: ("ABCDEF") 0, [11259375] line 6
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1665 b/third-party/curl/tests/data/test1665
new file mode 100644
index 0000000000..ccb016a5e7
--- /dev/null
+++ b/third-party/curl/tests/data/test1665
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: swsclose
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP with only headers and no final CRLF separator
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<errorcode>
+18
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1666 b/third-party/curl/tests/data/test1666
new file mode 100644
index 0000000000..e9c57860c5
--- /dev/null
+++ b/third-party/curl/tests/data/test1666
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+encodeOID
+x509asn1
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+encodeOID unit tests
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test1667 b/third-party/curl/tests/data/test1667
new file mode 100644
index 0000000000..76a1daa5a9
--- /dev/null
+++ b/third-party/curl/tests/data/test1667
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+ASN1tostr
+x509asn1
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+ASN1tostr unit tests
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test1668 b/third-party/curl/tests/data/test1668
new file mode 100644
index 0000000000..59d7108498
--- /dev/null
+++ b/third-party/curl/tests/data/test1668
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+FTP
+ftp_213_date
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+ftp
+</features>
+<name>
+ftp_213_date unit tests
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test1669 b/third-party/curl/tests/data/test1669
new file mode 100644
index 0000000000..204b45b506
--- /dev/null
+++ b/third-party/curl/tests/data/test1669
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+Alt-Svc
+</keywords>
+</info>
+
+<client>
+<features>
+unittest
+alt-svc
+</features>
+
+# This date is exactly "20190124 22:34:21" UTC
+<setenv>
+CURL_TIME=1548369261
+</setenv>
+<name>
+alt-svc load cache with >5000 entries
+</name>
+<command>
+%LOGDIR/%TESTNUMBER
+</command>
+<file name="%LOGDIR/%TESTNUMBER" mode="text">
+%repeat[5010 x h2 example.com 443 h3 shiny.example.com 8443 "20191231 00:00:00" 0 0%0a]%
+</file>
+</client>
+
+<verify>
+<limits>
+Allocations: 5100
+Maximum allocated: 600000
+</limits>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test167 b/third-party/curl/tests/data/test167
index f723b61cd8..70846b17ef 100644
--- a/third-party/curl/tests/data/test167
+++ b/third-party/curl/tests/data/test167
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,13 +12,13 @@ HTTP Digest auth
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 WWW-Authenticate: Digest realm="weirdorealm", nonce="12345"
 
 </data>
 
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Server: no
 Content-Length: 15
@@ -25,7 +26,7 @@ Content-Length: 15
 Nice auth sir!
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 WWW-Authenticate: Digest realm="weirdorealm", nonce="12345"
 
@@ -46,29 +47,30 @@ http
 !SSPI
 crypto
 proxy
+digest
 </features>
- <name>
+<name>
 HTTP with proxy-requiring-Basic to site-requiring-Digest
- </name>
- <command>
-http://data.from.server.requiring.digest.hohoho.com/%TESTNUMBER --proxy http://%HOSTIP:%HTTPPORT --proxy-user foo:bar --digest --user digest:alot
+</name>
+<command>
+http://data.from.server.requiring.digest.hohoho.com/%TESTNUMBER --proxy http://%HOSTIP:%HTTPPORT --proxy-user foo:bar --digest --user digest:a-lot
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://data.from.server.requiring.digest.hohoho.com/%TESTNUMBER HTTP/1.1
 Host: data.from.server.requiring.digest.hohoho.com
-Proxy-Authorization: Basic Zm9vOmJhcg==
+Proxy-Authorization: Basic %b64[foo:bar]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
 
 GET http://data.from.server.requiring.digest.hohoho.com/%TESTNUMBER HTTP/1.1
 Host: data.from.server.requiring.digest.hohoho.com
-Proxy-Authorization: Basic Zm9vOmJhcg==
-Authorization: Digest username="digest", realm="weirdorealm", nonce="12345", uri="/%TESTNUMBER", response="13c7c02a252cbe1c46d8669898a3be26"
+Proxy-Authorization: Basic %b64[foo:bar]b64%
+Authorization: Digest username="digest", realm="weirdorealm", nonce="12345", uri="/%TESTNUMBER", response="304c55b19dbcb9c7e7a3354abd11ba1b"
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test1670 b/third-party/curl/tests/data/test1670
index dde0c6cee3..e2b5037a58 100644
--- a/third-party/curl/tests/data/test1670
+++ b/third-party/curl/tests/data/test1670
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -27,7 +27,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -44,10 +43,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w '%header{etag} %header{nope} %header{DAT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1671 b/third-party/curl/tests/data/test1671
index df3ab460eb..dacdfeaa50 100644
--- a/third-party/curl/tests/data/test1671
+++ b/third-party/curl/tests/data/test1671
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -30,7 +30,6 @@ Connection: close
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -47,10 +46,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w '%{header_json}\n' -o %LOGDIR/%TESTNUMBE
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1672 b/third-party/curl/tests/data/test1672
new file mode 100644
index 0000000000..faf684b778
--- /dev/null
+++ b/third-party/curl/tests/data/test1672
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+netrc
+macdef
+</keywords>
+</info>
+
+<reply>
+<data>
+HTTP/1.1 200 OK
+Content-Length: 6
+Content-Type: text/html
+Funny-head: yesyes
+
+12345
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+netrc parser skips macdef even with broken quote
+</name>
+<command>
+--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<file name="%LOGDIR/netrc%TESTNUMBER" >
+
+macdef testmacro
+	bin
+	cd "broken quote
+	put password.bin
+	quit
+
+machine %HOSTIP login user1 password passwd1
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Authorization: Basic %b64[user1:passwd1]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1673 b/third-party/curl/tests/data/test1673
new file mode 100644
index 0000000000..46b26e1ef5
--- /dev/null
+++ b/third-party/curl/tests/data/test1673
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+upload
+--retry
+</keywords>
+</info>
+
+<client>
+<name>
+HTTP retry upload with missing upload file
+</name>
+<command>
+http://%HOSTIP:%NOLISTENPORT/%TESTNUMBER --retry 5 --retry-all-errors --upload-file AAAAAAAAAAA
+</command>
+</client>
+
+<verify>
+<errorcode>
+26
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1674 b/third-party/curl/tests/data/test1674
new file mode 100644
index 0000000000..79dc501b15
--- /dev/null
+++ b/third-party/curl/tests/data/test1674
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+HSTS
+</keywords>
+</info>
+
+<client>
+<features>
+unittest
+HSTS
+</features>
+
+# This date is exactly "20190124 22:34:21" UTC
+<setenv>
+CURL_TIME=1548369261
+</setenv>
+<name>
+HSTS load more than 10k entries from file
+</name>
+
+# test 1674 renders the input file itself, then reads it
+<command>
+%LOGDIR/hsts%TESTNUMBER
+</command>
+</client>
+
+<verify>
+<stdout>
+OK
+</stdout>
+<limits>
+Allocations: 11000
+</limits>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1675 b/third-party/curl/tests/data/test1675
new file mode 100644
index 0000000000..e8ee8b8e1c
--- /dev/null
+++ b/third-party/curl/tests/data/test1675
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+urlapi
+</keywords>
+</info>
+
+<client>
+<features>
+unittest
+</features>
+<name>
+URL API unit tests
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test1676 b/third-party/curl/tests/data/test1676
new file mode 100644
index 0000000000..7f4907fea3
--- /dev/null
+++ b/third-party/curl/tests/data/test1676
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+x509
+DH
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+x509 DH public key parameter extraction
+</name>
+
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test1677 b/third-party/curl/tests/data/test1677
new file mode 100644
index 0000000000..dbf5ca17a7
--- /dev/null
+++ b/third-party/curl/tests/data/test1677
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP POST
+chunked Transfer-Encoding
+Content-Length
+</keywords>
+</info>
+
+# Regression test for bug where curl stops reading chunked response
+# when both Content-Length: 0 and Transfer-Encoding: chunked headers
+# are present. Per RFC 7230 Section 3.3.3, Transfer-Encoding should
+# take precedence and Content-Length should be ignored.
+# The writedelay simulates the timing issue where chunks arrive in
+# separate packets.
+
+# Server-side
+<reply>
+<servercmd>
+writedelay: 500
+</servercmd>
+<data nocheck="yes" crlf="headers">
+HTTP/1.1 200 OK
+content-type: text/json
+connection: keep-alive
+content-length: 0
+transfer-encoding: chunked
+
+1a
+random data in first chunk
+1d
+ another data in second chunk
+15
+ third and last chunk
+0
+
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP POST response with both Transfer-Encoding chunked and Content-Length 0
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -d "testdata"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol nonewline="yes" crlf="headers">
+POST /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 8
+Content-Type: application/x-www-form-urlencoded
+
+testdata
+</protocol>
+<stdout nonewline="yes" crlf="headers">
+HTTP/1.1 200 OK
+content-type: text/json
+connection: keep-alive
+content-length: 0
+transfer-encoding: chunked
+
+random data in first chunk another data in second chunk third and last chunk
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test168 b/third-party/curl/tests/data/test168
index 9664b52a5e..006516d633 100644
--- a/third-party/curl/tests/data/test168
+++ b/third-party/curl/tests/data/test168
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -13,7 +14,7 @@ HTTP Digest auth
 <reply>
 
 # this is returned first since we get no proxy-auth
-<data>
+<data crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me my dear swsclose
 Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
 
@@ -21,14 +22,14 @@ And you should ignore this data.
 </data>
 
 # then this is returned since we get no server-auth
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 401 Authorization to the remote host as well swsbounce swsclose
 WWW-Authenticate: Digest realm="realmweirdo", nonce="123456"
 
 you should ignore this data too
 </data1000>
 
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Server: no
 Content-Length: 15
@@ -36,7 +37,7 @@ Content-Length: 15
 Nice auth sir!
 </data1001>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me my dear swsclose
 Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
 
@@ -60,18 +61,19 @@ http
 !SSPI
 crypto
 proxy
+digest
 </features>
- <name>
+<name>
 HTTP with proxy-requiring-Digest to site-requiring-Digest
- </name>
- <command>
-http://data.from.server.requiring.digest.hohoho.com/%TESTNUMBER --proxy http://%HOSTIP:%HTTPPORT --proxy-user foo:bar --proxy-digest --digest --user digest:alot
+</name>
+<command>
+http://data.from.server.requiring.digest.hohoho.com/%TESTNUMBER --proxy http://%HOSTIP:%HTTPPORT --proxy-user foo:bar --proxy-digest --digest --user digest:a-lot
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://data.from.server.requiring.digest.hohoho.com/%TESTNUMBER HTTP/1.1
 Host: data.from.server.requiring.digest.hohoho.com
 User-Agent: curl/%VERSION
@@ -88,7 +90,7 @@ Proxy-Connection: Keep-Alive
 GET http://data.from.server.requiring.digest.hohoho.com/%TESTNUMBER HTTP/1.1
 Host: data.from.server.requiring.digest.hohoho.com
 Proxy-Authorization: Digest username="foo", realm="weirdorealm", nonce="12345", uri="/%TESTNUMBER", response="fb8608e00ad9239a3dedb14bc8575976"
-Authorization: Digest username="digest", realm="realmweirdo", nonce="123456", uri="/%TESTNUMBER", response="ca87f2d768a231e2d637a55698d5c416"
+Authorization: Digest username="digest", realm="realmweirdo", nonce="123456", uri="/%TESTNUMBER", response="bfecb43898f3db12543650d45493313b"
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test1680 b/third-party/curl/tests/data/test1680
index 4775a411b0..8e497c9c5f 100644
--- a/third-party/curl/tests/data/test1680
+++ b/third-party/curl/tests/data/test1680
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -20,7 +20,6 @@ foo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <name>
@@ -40,7 +39,6 @@ to be overwritten
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <file name="%LOGDIR/exist%TESTNUMBER">
diff --git a/third-party/curl/tests/data/test1681 b/third-party/curl/tests/data/test1681
index 16c0d8c505..2d1071aeea 100644
--- a/third-party/curl/tests/data/test1681
+++ b/third-party/curl/tests/data/test1681
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -20,7 +20,6 @@ foo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <name>
@@ -40,7 +39,6 @@ to stay the same
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <file name="%LOGDIR/exist%TESTNUMBER">
diff --git a/third-party/curl/tests/data/test1682 b/third-party/curl/tests/data/test1682
index b5462ab05b..32297e6406 100644
--- a/third-party/curl/tests/data/test1682
+++ b/third-party/curl/tests/data/test1682
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -20,7 +20,6 @@ foo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <name>
@@ -40,7 +39,6 @@ to stay the same
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <file name="%LOGDIR/exist%TESTNUMBER">
diff --git a/third-party/curl/tests/data/test1683 b/third-party/curl/tests/data/test1683
index 178b4054dc..5a01be74dc 100644
--- a/third-party/curl/tests/data/test1683
+++ b/third-party/curl/tests/data/test1683
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -20,7 +20,6 @@ foo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <name>
@@ -39,16 +38,10 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -o %LOGDIR/exist%TESTNUMBER --no-clobber
 to stay the same
 </file>
 <precheck>
-perl -e 'for my $i ((1..100)) { my $filename = "%LOGDIR/exist%TESTNUMBER.$i"; open(FH, ">", $filename) or die $!; print FH "to stay the same" ; close(FH) }'
-# python3 -c 'for i in range(1, 101): open("%LOGDIR/exist%TESTNUMBER.{}".format(i), mode="w").write("to stay the same")'
+%PERL -e 'for my $i ((1..100)) { my $filename = "%LOGDIR/exist%TESTNUMBER.$i"; open(FH, "%GT", $filename) or die $!; print FH "to stay the same" ; close(FH) }'
 </precheck>
-<postcheck>
-perl -e 'for my $i ((1..100)) { my $filename = "%LOGDIR/exist%TESTNUMBER.$i"; open(FH, "<", $filename) or die $!; (<FH> eq "to stay the same" and <FH> eq "") or die "incorrect $filename" ; close(FH) }'
-# python3 -c 'for i in range(1, 101): assert open("%LOGDIR/exist%TESTNUMBER.{}".format(i), mode="r").read(17) == "to stay the same"'
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
@@ -57,5 +50,8 @@ perl -e 'for my $i ((1..100)) { my $filename = "%LOGDIR/exist%TESTNUMBER.$i"; op
 <file name="%LOGDIR/exist%TESTNUMBER">
 to stay the same
 </file>
+<postcheck>
+%PERL -e 'for my $i ((1..100)) { my $filename = "%LOGDIR/exist%TESTNUMBER.$i"; open(FH, "%LT", $filename) or die $!; (%LTFH%GT eq "to stay the same" and %LTFH%GT eq "") or die "incorrect $filename" ; close(FH) }'
+</postcheck>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1684 b/third-party/curl/tests/data/test1684
new file mode 100644
index 0000000000..3de6c4d611
--- /dev/null
+++ b/third-party/curl/tests/data/test1684
@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+FTP
+MDTM
+</keywords>
+</info>
+
+<reply>
+<data>
+a joke
+</data>
+<mdtm>
+213 2003040a102659
+</mdtm>
+</reply>
+
+# Client-side
+<client>
+<server>
+ftp
+</server>
+<name>
+FTP with malformed MDTM response
+</name>
+<command>
+ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -z "apr 1 2025 08:00:00"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+USER anonymous
+PASS ftp@example.com
+PWD
+MDTM %TESTNUMBER
+EPSV
+TYPE I
+SIZE %TESTNUMBER
+RETR %TESTNUMBER
+QUIT
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1685 b/third-party/curl/tests/data/test1685
new file mode 100644
index 0000000000..b98dc20643
--- /dev/null
+++ b/third-party/curl/tests/data/test1685
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+cookies
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.0 200 OK swsclose
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Type: text/html
+Set-Cookie: name=content; path=/we%TABwant
+Set-Cookie: accept=this; path=/only/this
+
+boo
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP, reject cookie with tab in path
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/ -c %LOGDIR/jar%TESTNUMBER.txt
+</command>
+
+<features>
+cookies
+</features>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET / HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/jar%TESTNUMBER.txt" mode="text">
+# Netscape HTTP Cookie File
+# https://curl.se/docs/http-cookies.html
+# This file was generated by libcurl! Edit at your own risk.
+
+127.0.0.1%TABFALSE%TAB/only/this%TABFALSE%TAB0%TABaccept%TABthis
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1686 b/third-party/curl/tests/data/test1686
new file mode 100644
index 0000000000..2d419ad608
--- /dev/null
+++ b/third-party/curl/tests/data/test1686
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+Digest
+</keywords>
+</info>
+
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 401 Authorization Required
+Server: Apache/1.3.27 (Darwin) PHP/4.1.2
+WWW-Authenticate: Digest realm="my-backyard", nonce="314156295"
+Content-Length: 26
+
+This is not the real page
+</data>
+
+# This is supposed to be returned when the server gets a
+# Authorization: Digest line passed-in from the client
+<data1000 crlf="headers">
+HTTP/1.1 200 OK
+Server: Apache/1.3.27 (Darwin) PHP/4.1.2
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 23
+
+This IS the real page!
+</data1000>
+
+</reply>
+
+<client>
+<features>
+!SSPI
+crypto
+digest
+</features>
+<server>
+http
+</server>
+<name>
+HTTP Digest to different origins and switching credentials
+</name>
+<tool>
+lib%TESTNUMBER
+</tool>
+<command>
+%HOSTIP %HTTPPORT
+</command>
+</client>
+
+<verify>
+<protocol crlf="headers">
+GET /api HTTP/1.1
+Host: first.test:%HTTPPORT
+Accept: */*
+
+GET /api HTTP/1.1
+Host: first.test:%HTTPPORT
+Authorization: Digest username="alice", realm="my-backyard", nonce="314156295", uri="/api", response="4ecc00e567c37a9d537727890c2e5b32"
+Accept: */*
+
+GET /hook HTTP/1.1
+Host: second.test:%HTTPPORT
+Accept: */*
+
+GET /hook HTTP/1.1
+Host: second.test:%HTTPPORT
+Authorization: Digest username="alice", realm="my-backyard", nonce="314156295", uri="/hook", response="d3a7738fb6a23f5543fb8dacc0f0f253"
+Accept: */*
+
+GET /hook HTTP/1.1
+Host: second.test:%HTTPPORT
+Accept: */*
+
+GET /hook HTTP/1.1
+Host: second.test:%HTTPPORT
+Authorization: Digest username="bob", realm="my-backyard", nonce="314156295", uri="/hook", response="777e68eddb77294d9cbd6134973cbbab"
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test169 b/third-party/curl/tests/data/test169
index 621209b545..3ef6ad709d 100644
--- a/third-party/curl/tests/data/test169
+++ b/third-party/curl/tests/data/test169
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -14,7 +15,7 @@ NTLM
 <reply>
 
 # this is returned first since we get no proxy-auth
-<data>
+<data crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me my dear swsclose
 Proxy-Authenticate: NTLM
 
@@ -22,14 +23,14 @@ And you should ignore this data.
 </data>
 
 # then this is returned since we get no server-auth
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 Authorizated fine
 Content-Length: 27
 
 Welcome to the end station
 </data1000>
 
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 407 NTLM type-1 received sending back type-2
 Server: Microsoft-IIS/5.0
 Content-Length: 34
@@ -41,7 +42,7 @@ This is not the real page either!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 401 You now need to authenticate with the host
 Server: Microsoft-IIS/5.0
 WWW-Authenticate: Digest realm="r e a l m", nonce="abcdef"
@@ -51,7 +52,7 @@ Content-Type: text/html; charset=iso-8859-1
 We have not authenticated with the server yet
 </data1002>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 407 NTLM type-1 received sending back type-2
 Server: Microsoft-IIS/5.0
 Content-Length: 34
@@ -81,21 +82,22 @@ NTLM
 SSL
 !SSPI
 proxy
+digest
 </features>
 <name>
 HTTP with proxy-requiring-NTLM to site-requiring-Digest
 </name>
 <command>
-http://data.from.server.requiring.digest.hohoho.com/%TESTNUMBER --proxy http://%HOSTIP:%HTTPPORT --proxy-user testuser:testpass --proxy-ntlm --digest --user digest:alot
+http://data.from.server.requiring.digest.hohoho.com/%TESTNUMBER --proxy http://%HOSTIP:%HTTPPORT --proxy-user testuser:testpass --proxy-ntlm --digest --user digest:a-lot
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://data.from.server.requiring.digest.hohoho.com/%TESTNUMBER HTTP/1.1
 Host: data.from.server.requiring.digest.hohoho.com
-Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Proxy-Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
@@ -109,7 +111,7 @@ Proxy-Connection: Keep-Alive
 
 GET http://data.from.server.requiring.digest.hohoho.com/%TESTNUMBER HTTP/1.1
 Host: data.from.server.requiring.digest.hohoho.com
-Authorization: Digest username="digest", realm="r e a l m", nonce="abcdef", uri="/%TESTNUMBER", response="95d48591985a03c4b49cb962aa7bd3e6"
+Authorization: Digest username="digest", realm="r e a l m", nonce="abcdef", uri="/%TESTNUMBER", response="89b737a4b6eefde285c093c92e9bd6ea"
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test17 b/third-party/curl/tests/data/test17
index e3a81827c7..8a77b7e7ee 100644
--- a/third-party/curl/tests/data/test17
+++ b/third-party/curl/tests/data/test17
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -22,31 +23,28 @@ This is the proof it works
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with config file on stdin
- </name>
- <stdin>
-#
+</name>
+<stdin>
 # Use a silly request without '--':
 request MOOO
-#
 # Set the user-agent using a short-option:
 -A "agent007 license to drill\t"
-#
 # long option *with* '--':
 --max-time 180
- </stdin>
- <command>
+</stdin>
+<command>
 -K - %HOSTIP:%HTTPPORT/that.site.com/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 MOOO /that.site.com/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-User-Agent: agent007 license to drill	
+User-Agent: agent007 license to drill%TAB
 Accept: */*
 
 </protocol>
diff --git a/third-party/curl/tests/data/test170 b/third-party/curl/tests/data/test170
index 8f82af18fe..b0ede05412 100644
--- a/third-party/curl/tests/data/test170
+++ b/third-party/curl/tests/data/test170
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -24,20 +25,20 @@ SSL
 !SSPI
 proxy
 </features>
- <name>
+<name>
 HTTP POST with --proxy-ntlm and no SSL with no response
- </name>
- <command>
+</name>
+<command>
 http://a.galaxy.far.far.away/%TESTNUMBER --proxy http://%HOSTIP:%HTTPPORT --proxy-user foo:bar --proxy-ntlm -F "dummy=value"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 POST http://a.galaxy.far.far.away/%TESTNUMBER HTTP/1.1
 Host: a.galaxy.far.far.away
-Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Proxy-Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test1700 b/third-party/curl/tests/data/test1700
index e171ebc02a..a7271079ff 100644
--- a/third-party/curl/tests/data/test1700
+++ b/third-party/curl/tests/data/test1700
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ HTTP/2
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -24,7 +24,7 @@ Funny-head: yesyes
 
 -foo-
 </data>
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
@@ -35,32 +35,29 @@ Content-Type: text/html
 </data1>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 h2c
 </features>
 <server>
-http
 http/2
 </server>
- <name>
+<name>
 HTTP/2 GET with Upgrade:
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTP2PORT/%TESTNUMBER --http2 http://%HOSTIP:%HTTP2PORT/%TESTNUMBER0001
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strip>
 ^X-Forwarded-Proto:.*
 ^Via:.*
 </strip>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTP2PORT
 User-Agent: curl/%VERSION
@@ -72,12 +69,12 @@ User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 101 Switching Protocols
 Connection: Upgrade
 Upgrade: h2c
 
-HTTP/2 200 
+HTTP/2 200%SP
 date: Tue, 09 Nov 2010 14:49:00 GMT
 last-modified: Tue, 13 Jun 2000 12:10:00 GMT
 etag: "21025-dc7-39462498"
@@ -88,7 +85,7 @@ funny-head: yesyes
 via: 1.1 nghttpx
 
 -foo-
-HTTP/2 200 
+HTTP/2 200%SP
 date: Tue, 09 Nov 2010 14:49:00 GMT
 content-length: 6
 content-type: text/html
diff --git a/third-party/curl/tests/data/test1701 b/third-party/curl/tests/data/test1701
index f4677ea704..50e782bed0 100644
--- a/third-party/curl/tests/data/test1701
+++ b/third-party/curl/tests/data/test1701
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ HTTP/2
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -26,32 +26,29 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 h2c
 </features>
 <server>
-http
 http/2
 </server>
- <name>
+<name>
 HTTP/2 POST with Upgrade:
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTP2PORT/%TESTNUMBER --http2 -d "datatosend"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strip>
 ^X-Forwarded-Proto:.*
 ^Via:.*
 </strip>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTP2PORT
 User-Agent: curl/%VERSION
@@ -61,12 +58,12 @@ Content-Type: application/x-www-form-urlencoded
 
 datatosend
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 101 Switching Protocols
 Connection: Upgrade
 Upgrade: h2c
 
-HTTP/2 200 
+HTTP/2 200%SP
 date: Tue, 09 Nov 2010 14:49:00 GMT
 last-modified: Tue, 13 Jun 2000 12:10:00 GMT
 etag: "21025-dc7-39462498"
diff --git a/third-party/curl/tests/data/test1702 b/third-party/curl/tests/data/test1702
index eb3430b064..26aa286cbf 100644
--- a/third-party/curl/tests/data/test1702
+++ b/third-party/curl/tests/data/test1702
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ HTTP/2
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -25,44 +25,41 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 h2c
 </features>
 <server>
-http
 http/2
 </server>
- <name>
+<name>
 HTTP/2 HEAD with Upgrade:
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTP2PORT/%TESTNUMBER --http2 --head
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strip>
 ^X-Forwarded-Proto:.*
 ^Via:.*
 </strip>
-<protocol>
+<protocol crlf="headers">
 HEAD /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTP2PORT
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 101 Switching Protocols
 Connection: Upgrade
 Upgrade: h2c
 
-HTTP/2 200 
+HTTP/2 200%SP
 date: Tue, 09 Nov 2010 14:49:00 GMT
 last-modified: Tue, 13 Jun 2000 12:10:00 GMT
 etag: "21025-dc7-39462498"
diff --git a/third-party/curl/tests/data/test1703 b/third-party/curl/tests/data/test1703
index bdc6476323..2ac77dde0b 100644
--- a/third-party/curl/tests/data/test1703
+++ b/third-party/curl/tests/data/test1703
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -30,7 +31,7 @@ basic file:// file with UTF-8 characters
 <command option="no-include">
 file://localhost%FILE_PWD/%LOGDIR/%E3%83%86%E3%82%B9%E3%83%88%TESTNUMBER.txt
 </command>
-<file name="%LOGDIR/テスト%TESTNUMBER.txt">
+<file name="%LOGDIR/%hex[%E3%83%86%E3%82%B9%E3%83%88]hex%%TESTNUMBER.txt">
 foo
    bar
 bar
diff --git a/third-party/curl/tests/data/test1704 b/third-party/curl/tests/data/test1704
new file mode 100644
index 0000000000..c98a66979c
--- /dev/null
+++ b/third-party/curl/tests/data/test1704
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+HTTP/2
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/2 101 OK
+
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-maa-
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+h2c
+</features>
+<server>
+http
+</server>
+<name>
+HTTP/1 doing HTTP/2 Upgrade: getting an HTTP/2 101 response
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --http2
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<strip>
+^X-Forwarded-Proto:.*
+^Via:.*
+</strip>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Upgrade: h2c
+HTTP2-Settings: AAMAAABkAAQAAQAAAAIAAAAA
+Connection: Upgrade, HTTP2-Settings
+
+</protocol>
+
+# CURLE_WEIRD_SERVER_REPLY (8)
+<errorcode>
+8
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1705 b/third-party/curl/tests/data/test1705
new file mode 100644
index 0000000000..511c40e68d
--- /dev/null
+++ b/third-party/curl/tests/data/test1705
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+script
+documentation
+managen
+</keywords>
+</info>
+
+# Client-side
+<client>
+
+<name>
+managen makes man page
+</name>
+
+<file name="%LOGDIR/mainpage.idx">
+_header.md
+%options
+_footer.md
+</file>
+
+<file1 name="%LOGDIR/_header.md">
+%includetext %SRCDIR/data/data%TESTNUMBER-1.md%
+</file1>
+<file2 name="%LOGDIR/option1.md">
+%includetext %SRCDIR/data/data%TESTNUMBER-2.md%
+</file2>
+<file3 name="%LOGDIR/option2.md">
+%includetext %SRCDIR/data/data%TESTNUMBER-3.md%
+</file3>
+<file4 name="%LOGDIR/_footer.md">
+%includetext %SRCDIR/data/data%TESTNUMBER-4.md%
+</file4>
+
+<command type="perl">
+%SRCDIR/../scripts/managen -d %LOGDIR -I %SRCDIR/../include mainpage option1.md option2.md
+</command>
+</client>
+
+<verify>
+<stderr>
+option1.md:19:1:WARN: see-also a non-existing option: include
+option1.md:19:1:WARN: see-also a non-existing option: silent
+option1.md:19:1:WARN: see-also a non-existing option: trace
+option1.md:19:1:WARN: see-also a non-existing option: trace-ascii
+WARN: option1.md mutexes a non-existing option: trace
+WARN: option1.md mutexes a non-existing option: trace-ascii
+option2.md:15:1:WARN: see-also a non-existing option: proto-default
+</stderr>
+<stdout>
+%includetext %SRCDIR/data/data%TESTNUMBER-stdout.1%
+</stdout>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1706 b/third-party/curl/tests/data/test1706
new file mode 100644
index 0000000000..ea8fb7a2b6
--- /dev/null
+++ b/third-party/curl/tests/data/test1706
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+script
+documentation
+managen
+</keywords>
+</info>
+
+# Client-side
+<client>
+
+<name>
+managen makes ASCII page
+</name>
+
+<file name="%LOGDIR/mainpage.idx">
+_header.md
+%options
+_footer.md
+</file>
+
+<file1 name="%LOGDIR/_header.md">
+%includetext %SRCDIR/data/data%TESTNUMBER-1.md%
+</file1>
+<file2 name="%LOGDIR/option1.md">
+%includetext %SRCDIR/data/data%TESTNUMBER-2.md%
+</file2>
+<file3 name="%LOGDIR/option2.md">
+%includetext %SRCDIR/data/data%TESTNUMBER-3.md%
+</file3>
+<file4 name="%LOGDIR/_footer.md">
+%includetext %SRCDIR/data/data%TESTNUMBER-4.md%
+</file4>
+
+<command type="perl">
+%SRCDIR/../scripts/managen -I %SRCDIR/../include -d %LOGDIR ascii option1.md option2.md
+</command>
+</client>
+
+<verify>
+<stderr>
+option1.md:19:1:WARN: see-also a non-existing option: include
+option1.md:19:1:WARN: see-also a non-existing option: silent
+option1.md:19:1:WARN: see-also a non-existing option: trace
+option1.md:19:1:WARN: see-also a non-existing option: trace-ascii
+WARN: option1.md mutexes a non-existing option: trace
+WARN: option1.md mutexes a non-existing option: trace-ascii
+option2.md:15:1:WARN: see-also a non-existing option: proto-default
+</stderr>
+<stdout>
+%includetext %SRCDIR/data/data%TESTNUMBER-stdout.txt%
+
+</stdout>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1707 b/third-party/curl/tests/data/test1707
new file mode 100644
index 0000000000..9515640d71
--- /dev/null
+++ b/third-party/curl/tests/data/test1707
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+curl
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+manual
+</features>
+
+<name>
+Verify curl -h --insecure
+</name>
+
+<command type="perl">
+%SRCDIR/test1707.pl %CURL --insecure ../docs/cmdline-opts/curl.txt
+</command>
+</client>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1708 b/third-party/curl/tests/data/test1708
new file mode 100644
index 0000000000..f2a1906386
--- /dev/null
+++ b/third-party/curl/tests/data/test1708
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+curl
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+manual
+</features>
+
+<name>
+Verify curl -h -F
+</name>
+
+<command type="perl">
+%SRCDIR/test1707.pl %CURL -F ../docs/cmdline-opts/curl.txt
+</command>
+</client>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1709 b/third-party/curl/tests/data/test1709
new file mode 100644
index 0000000000..0ca4363543
--- /dev/null
+++ b/third-party/curl/tests/data/test1709
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+curl
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+manual
+</features>
+
+<name>
+Verify curl -h with bad option name
+</name>
+
+<command>
+-h --badone
+</command>
+</client>
+
+<verify>
+<stderr mode="text">
+Incorrect option name to show help for, see curl -h
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test171 b/third-party/curl/tests/data/test171
index 8314823d00..21db9884ae 100644
--- a/third-party/curl/tests/data/test171
+++ b/third-party/curl/tests/data/test171
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ cookies
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 25 Sep 2001 19:37:44 GMT
 Content-Type: text/html
@@ -27,10 +28,10 @@ This server reply is for testing a simple cookie test case...
 <server>
 http
 </server>
- <name>
+<name>
 HTTP, get cookie with dot prefixed full domain
- </name>
- <command>
+</name>
+<command>
 -c %LOGDIR/jar%TESTNUMBER -x %HOSTIP:%HTTPPORT http://z.x.com/%TESTNUMBER
 </command>
 <features>
@@ -41,7 +42,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://z.x.com/%TESTNUMBER HTTP/1.1
 Host: z.x.com
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1710 b/third-party/curl/tests/data/test1710
new file mode 100644
index 0000000000..b87b580efe
--- /dev/null
+++ b/third-party/curl/tests/data/test1710
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+curl
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+manual
+</features>
+
+<name>
+Verify curl -h --no-clobber
+</name>
+
+<command type="perl">
+%SRCDIR/test1707.pl %CURL --no-clobber ../docs/cmdline-opts/curl.txt
+</command>
+</client>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1711 b/third-party/curl/tests/data/test1711
new file mode 100644
index 0000000000..63ee79a3eb
--- /dev/null
+++ b/third-party/curl/tests/data/test1711
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+SMTP
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<server>
+smtp
+</server>
+<name>
+Send >64K over SMTP
+</name>
+<file name="%LOGDIR/email%TESTNUMBER" crlf="yes">
+From: different
+To: another
+
+%repeat[5000 x test in body... ]%
+</file>
+<command>
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -T %LOGDIR/email%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+EHLO %TESTNUMBER
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
+DATA
+QUIT
+</protocol>
+<upload crlf="yes">
+From: different
+To: another
+
+%repeat[5000 x test in body... ]%
+.
+</upload>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1712 b/third-party/curl/tests/data/test1712
new file mode 100644
index 0000000000..5cdc642d09
--- /dev/null
+++ b/third-party/curl/tests/data/test1712
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--config
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+config file with argument using single quotes
+</name>
+<file name="%LOGDIR/config">
+data = 'arg-with-quote'
+</file>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --config %LOGDIR/config --silent
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+POST /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 16
+Content-Type: application/x-www-form-urlencoded
+
+'arg-with-quote'
+</protocol>
+<stderr mode="warn">
+Warning: %LOGDIR/config:1 Option 'data' uses argument with leading single quote.%SP
+It is probably a mistake. Consider double quotes.
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1713 b/third-party/curl/tests/data/test1713
new file mode 100644
index 0000000000..9727ff615f
--- /dev/null
+++ b/third-party/curl/tests/data/test1713
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+Alt-Svc
+cookies
+HSTS
+netrc
+</keywords>
+</info>
+
+# Client-side
+<client>
+<name>
+Filenames pointing to directory failing gracefully
+</name>
+<command>
+http://invalid.invalid/%TESTNUMBER --alt-svc %LOGDIR --cookie %LOGDIR --hsts %LOGDIR --netrc-file %LOGDIR
+</command>
+<features>
+alt-svc
+cookies
+HSTS
+netrc
+</features>
+</client>
+
+<verify>
+# 26 = CURLE_READ_ERROR
+<errorcode>
+26
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1714 b/third-party/curl/tests/data/test1714
new file mode 100644
index 0000000000..66eb8820ae
--- /dev/null
+++ b/third-party/curl/tests/data/test1714
@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+TELNET
+</keywords>
+</info>
+
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.0 200 OK swsclose
+Content-Length: 330000
+Connection: close
+
+%repeat[10000 x boring data to send to the client]%
+</data>
+</reply>
+
+<client>
+<server>
+http
+</server>
+<features>
+telnet
+!win32
+</features>
+<name>
+TELNET download with --max-filesize
+</name>
+<stdin crlf="headers">
+GET /this/for/%TESTNUMBER HTTP/1.0
+
+</stdin>
+
+<command option="no-output">
+telnet://%HOSTIP:%HTTPPORT --max-filesize 99995
+</command>
+</client>
+
+<verify>
+<protocol crlf="headers">
+GET /this/for/%TESTNUMBER HTTP/1.0
+
+</protocol>
+<stdout crlf="headers" nonewline="yes">
+HTTP/1.0 200 OK swsclose
+Content-Length: 330000
+Connection: close
+
+%repeat[3028 x boring data to send to the client]%
+</stdout>
+<errorcode>
+63
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1715 b/third-party/curl/tests/data/test1715
new file mode 100644
index 0000000000..df50322a58
--- /dev/null
+++ b/third-party/curl/tests/data/test1715
@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+HTTP CONNECT
+HTTP proxy
+proxytunnel
+</keywords>
+</info>
+
+<reply>
+
+<connect crlf="headers">
+HTTP/1.1 407 Proxy Authentication Required
+Proxy-Authenticate: Special realm="none", nonce="abc123"
+Content-Length: 13
+Transfer-Encoding: chunked
+Magic-special: true
+
+some content
+</connect>
+</reply>
+
+<client>
+<server>
+http
+</server>
+<features>
+proxy
+</features>
+<name>
+HTTP CONNECT with proxy returning Content-Length and chunked
+</name>
+<command>
+http://test.example --proxy http://%HOSTIP:%HTTPPORT --proxytunnel -sS
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+CONNECT test.example:80 HTTP/1.1
+Host: test.example:80
+User-Agent: curl/%VERSION
+Proxy-Connection: Keep-Alive
+
+</protocol>
+<errorcode>
+56
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test172 b/third-party/curl/tests/data/test172
index cd924ea6c0..293faf0656 100644
--- a/third-party/curl/tests/data/test172
+++ b/third-party/curl/tests/data/test172
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ cookies
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Content-Length: 4
 Connection: close
@@ -23,10 +24,10 @@ boo
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with cookies file and custom added cookie
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -b %LOGDIR/jar%TESTNUMBER.txt -b "tool=curl; name=fool"
 </command>
 <file name="%LOGDIR/jar%TESTNUMBER.txt">
@@ -45,7 +46,7 @@ cookies
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1720 b/third-party/curl/tests/data/test1720
new file mode 100644
index 0000000000..22edb19baf
--- /dev/null
+++ b/third-party/curl/tests/data/test1720
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+create_dir_hierarchy()
+</name>
+<tool>
+tool%TESTNUMBER
+</tool>
+</client>
+
+<verify>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1721 b/third-party/curl/tests/data/test1721
new file mode 100644
index 0000000000..1b0e7a88f7
--- /dev/null
+++ b/third-party/curl/tests/data/test1721
@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Content-Type: text/html
+
+-foo-
+</data>
+</reply>
+
+<client>
+<server>
+http
+</server>
+<name>
+Keep question mark for empty query
+</name>
+<command>
+"http://%HOSTIP:%HTTPPORT/hello?" -w '%output{%LOGDIR/out%TESTNUMBER}%{url_effective}'
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<file nonewline="yes" name="%LOGDIR/out%TESTNUMBER">
+http://%HOSTIP:%HTTPPORT/hello?
+</file>
+<protocol crlf="headers">
+GET /hello? HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1722 b/third-party/curl/tests/data/test1722
new file mode 100644
index 0000000000..e51f26f4b4
--- /dev/null
+++ b/third-party/curl/tests/data/test1722
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+chunked Transfer-Encoding
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 funky chunky!
+Server: fakeit/0.9 fakeitbad/1.0
+Transfer-Encoding: chunked, another
+Connection: mooo
+
+40%CR
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%CR
+30%CR
+bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%CR
+21;heresatest=moooo%CR
+cccccccccccccccccccccccccccccccc
+%CR
+0%CR
+%CR
+</data>
+<datacheck>
+HTTP/1.1 200 funky chunky!
+Server: fakeit/0.9 fakeitbad/1.0
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP with chunked Transfer-Encoding not listed last
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<errorcode>
+61
+</errorcode>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1723 b/third-party/curl/tests/data/test1723
new file mode 100644
index 0000000000..ad93c30168
--- /dev/null
+++ b/third-party/curl/tests/data/test1723
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+chunked Transfer-Encoding
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 funky chunky!
+Server: fakeit/0.9 fakeitbad/1.0
+Transfer-Encoding: chunked, chunked, another
+Connection: mooo
+
+40%CR
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%CR
+30%CR
+bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%CR
+21;heresatest=moooo%CR
+cccccccccccccccccccccccccccccccc
+%CR
+0%CR
+%CR
+</data>
+<datacheck>
+HTTP/1.1 200 funky chunky!
+Server: fakeit/0.9 fakeitbad/1.0
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP with two chunked Transfer-Encoding not listed last
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<errorcode>
+61
+</errorcode>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1724 b/third-party/curl/tests/data/test1724
new file mode 100644
index 0000000000..3cd328e39c
--- /dev/null
+++ b/third-party/curl/tests/data/test1724
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPFS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 21
+Connection: close
+Content-Type: text/plain
+Funny-head: yesyes
+
+Hello curl from IPFS
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+</features>
+<server>
+http
+</server>
+<name>
+IPFS with --proto-default HTTP
+</name>
+<command>
+--ipfs-gateway http://%HOSTIP:%HTTPPORT ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u --proto-default http
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /ipfs/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1725 b/third-party/curl/tests/data/test1725
new file mode 100644
index 0000000000..2a882c791d
--- /dev/null
+++ b/third-party/curl/tests/data/test1725
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+SCP
+server key check
+</keywords>
+</info>
+
+# Client-side
+<client>
+<server>
+scp
+</server>
+<name>
+SCP incorrect host key with --proto-default SCP
+</name>
+<command>
+--hostpubmd5 00000000000000000000000000000000 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: %HOSTIP:%SSHPORT%SCP_PWD/%LOGDIR/irrelevant-file --insecure --proto-default SCP
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+60
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test173 b/third-party/curl/tests/data/test173
index fbf279145b..ab2504ed9a 100644
--- a/third-party/curl/tests/data/test173
+++ b/third-party/curl/tests/data/test173
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,11 +28,11 @@ Mime
 <server>
 http
 </server>
- <name>
+<name>
 HTTP RFC1867-formpost a file from stdin with "faked" filename
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -F field1=contents1 -F "fileupload=@-;filename=/dev/null;type=text/x-null;format=x-curl"
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -F field1=contents1 -F "fileupload=@-;filename=%DEV_NULL;type=text/x-null;format=x-curl"
 </command>
 
 <stdin>
@@ -52,21 +53,21 @@ line8
 ^(Content-Type: multipart/form-data;|------------).*
 </strip>
 <protocol>
-POST /we/want/%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Content-Length: 360
-Content-Type: multipart/form-data; boundary=----------------------------5dbea401cd8c
-
-------------------------------5dbea401cd8c
-Content-Disposition: form-data; name="field1"
-
-contents1
-------------------------------5dbea401cd8c
-Content-Disposition: form-data; name="fileupload"; filename="/dev/null"
-Content-Type: text/x-null;format=x-curl
-
+POST /we/want/%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Content-Length: 378%CR
+Content-Type: multipart/form-data; boundary=----------------------------5dbea401cd8c%CR
+%CR
+------------------------------5dbea401cd8c%CR
+Content-Disposition: form-data; name="field1"%CR
+%CR
+contents1%CR
+------------------------------5dbea401cd8c%CR
+Content-Disposition: form-data; name="fileupload"; filename="%DEV_NULL"%CR
+Content-Type: text/x-null;format=x-curl%CR
+%CR
 line1
 line2
 line3
@@ -75,8 +76,8 @@ line5
 line6
 line7
 line8
-
-------------------------------5dbea401cd8c--
+%CR
+------------------------------5dbea401cd8c--%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test174 b/third-party/curl/tests/data/test174
index fad9b81039..dde061d04d 100644
--- a/third-party/curl/tests/data/test174
+++ b/third-party/curl/tests/data/test174
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,8 +9,8 @@ HTTP POST
 
 # Server-side
 <reply>
-<data>
-HTTP/1.1 200 beng swsclose
+<data crlf="headers">
+HTTP/1.1 200 foobar swsclose
 Server: Microsoft-IIS/6.0
 Authentication-Info: Passport1.4 tname=MSPAuth,tname=MSPProf,tname=MSPConsent,tname=MSPSecAuth
 Content-Type: text/html; charset=iso-8859-1
@@ -21,21 +22,20 @@ This is not the real page
 
 # Client-side
 <client>
-#
 <server>
 http
 </server>
- <name>
+<name>
 HTTP POST --anyauth to server not requiring any auth at all
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --anyauth -d "junkelijunk"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test175 b/third-party/curl/tests/data/test175
index ab3333c7ba..58c95c5570 100644
--- a/third-party/curl/tests/data/test175
+++ b/third-party/curl/tests/data/test175
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,8 +10,8 @@ HTTP Digest auth
 
 # Server-side
 <reply>
-<data>
-HTTP/1.1 200 beng swsclose swsbounce
+<data crlf="headers">
+HTTP/1.1 200 foobar swsclose swsbounce
 Server: Microsoft-IIS/6.0
 Authentication-Info: Passport1.4 tname=MSPAuth,tname=MSPProf,tname=MSPConsent,tname=MSPSecAuth
 Content-Type: text/html; charset=iso-8859-1
@@ -18,7 +19,7 @@ Content-Type: text/html; charset=iso-8859-1
 This is not the real page
 </data>
 
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 200 moo swsclose
 Server: Microsoft-IIS/6.0
 Content-Type: text/html; charset=iso-8859-1
@@ -27,8 +28,8 @@ Content-Length: 16
 content for you
 </data1>
 
-<datacheck>
-HTTP/1.1 200 beng swsclose swsbounce
+<datacheck crlf="headers">
+HTTP/1.1 200 foobar swsclose swsbounce
 Server: Microsoft-IIS/6.0
 Authentication-Info: Passport1.4 tname=MSPAuth,tname=MSPProf,tname=MSPConsent,tname=MSPSecAuth
 Content-Type: text/html; charset=iso-8859-1
@@ -45,24 +46,24 @@ content for you
 
 # Client-side
 <client>
-#
 <server>
 http
 </server>
 <features>
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP POST --digest to server not requiring any auth at all
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u auser:apasswd --digest -d "junkelijunk"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test176 b/third-party/curl/tests/data/test176
index 4d00d2dfbd..8a38cfee05 100644
--- a/third-party/curl/tests/data/test176
+++ b/third-party/curl/tests/data/test176
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,8 +11,8 @@ HTTP NTLM auth
 # Server-side
 <reply>
 # the first request has NTLM type-1 included, and then the 1001 is returned
-<data1001>
-HTTP/1.1 200 beng swsclose swsbounce
+<data1001 crlf="headers">
+HTTP/1.1 200 foobar swsclose
 Server: Microsoft-IIS/6.0
 Authentication-Info: Passport1.4 tname=MSPAuth,tname=MSPProf,tname=MSPConsent,tname=MSPSecAuth
 Content-Type: text/html; charset=iso-8859-1
@@ -19,7 +20,7 @@ Content-Type: text/html; charset=iso-8859-1
 </data1001>
 
 # the second request should be auth-less and then this is returned.
-<data>
+<data crlf="headers">
 HTTP/1.1 200 moo swsclose
 Server: Microsoft-IIS/6.0
 Content-Type: text/html; charset=iso-8859-1
@@ -28,8 +29,8 @@ Content-Length: 16
 content for you
 </data>
 
-<datacheck>
-HTTP/1.1 200 beng swsclose swsbounce
+<datacheck crlf="headers">
+HTTP/1.1 200 foobar swsclose
 Server: Microsoft-IIS/6.0
 Authentication-Info: Passport1.4 tname=MSPAuth,tname=MSPProf,tname=MSPConsent,tname=MSPSecAuth
 Content-Type: text/html; charset=iso-8859-1
@@ -54,20 +55,20 @@ SSL
 <server>
 http
 </server>
- <name>
+<name>
 HTTP POST --ntlm to server not requiring any auth at all
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u auser:apasswd --ntlm -d "junkelijunk"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Content-Length: 0
diff --git a/third-party/curl/tests/data/test177 b/third-party/curl/tests/data/test177
index 139a9a9887..b1fcf3620c 100644
--- a/third-party/curl/tests/data/test177
+++ b/third-party/curl/tests/data/test177
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ followlocation
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 302 *MOVED* swsclose swsbounce
 Server: Microsoft-IIS/6.0
 Location: /mooooo/%TESTNUMBER
@@ -21,24 +22,24 @@ Content-Type: text/html; charset=iso-8859-1
 
 # Client-side
 <client>
-#
 <server>
 http
 </server>
 <features>
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP POST --digest to server doing a 302-location response
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u auser:apasswd --digest -d "junkelijunk"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test178 b/third-party/curl/tests/data/test178
index 94c0710d82..16093b9216 100644
--- a/third-party/curl/tests/data/test178
+++ b/third-party/curl/tests/data/test178
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -19,47 +19,36 @@ Funny-head: yesyes
 moooooooooooo
 </data>
 <datacheck>
-%if hyper
-%else
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
-%endif
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP response with negative Content-Length
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-
-# Hyper curl returns unsupported protocol
-# built-in curl returns weird_server_reply
+# weird_server_reply
 <errorcode>
-%if hyper
-1
-%else
 8
-%endif
 </errorcode>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test179 b/third-party/curl/tests/data/test179
index 4ab48ad158..0fdb322eb0 100644
--- a/third-party/curl/tests/data/test179
+++ b/third-party/curl/tests/data/test179
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,10 +28,10 @@ This server says moo
 <server>
 http
 </server>
- <name>
+<name>
 HTTP using proxy and cookies with path checks
- </name>
- <command>
+</name>
+<command>
 http://supertrooper.fake/c/%TESTNUMBER -b %LOGDIR/injar%TESTNUMBER -x %HOSTIP:%HTTPPORT
 </command>
 <file name="%LOGDIR/injar%TESTNUMBER">
@@ -46,7 +47,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://supertrooper.fake/c/%TESTNUMBER HTTP/1.1
 Host: supertrooper.fake
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test18 b/third-party/curl/tests/data/test18
index 7795928b0d..2bedb6f909 100644
--- a/third-party/curl/tests/data/test18
+++ b/third-party/curl/tests/data/test18
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,21 +10,21 @@ globbing
 </info>
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Funny-head: yesyes
 Content-Length: 4
 
 moo
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK
 Funny-head: yesyes
 Content-Length: 4
 
 foo
 </data2>
-<data3>
+<data3 crlf="headers">
 HTTP/1.1 200 OK
 Funny-head: yesyes
 Content-Length: 4
@@ -37,17 +38,17 @@ hoo
 <server>
 http
 </server>
- <name>
+<name>
 multiple requests using {} in URL
- </name>
- <command>
+</name>
+<command>
 "%HOSTIP:%HTTPPORT/{%TESTNUMBER,%TESTNUMBER0002,%TESTNUMBER0003}"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -64,7 +65,7 @@ User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 200 OK
 Funny-head: yesyes
 Content-Length: 4
diff --git a/third-party/curl/tests/data/test180 b/third-party/curl/tests/data/test180
index 1da12bc168..407d622442 100644
--- a/third-party/curl/tests/data/test180
+++ b/third-party/curl/tests/data/test180
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,10 +24,10 @@ blablabla
 <server>
 http
 </server>
- <name>
+<name>
 HTTP 1.0 PUT
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -T %LOGDIR/test%TESTNUMBER.txt --http1.0
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
@@ -44,7 +45,7 @@ the
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /we/want/%TESTNUMBER HTTP/1.0
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1800 b/third-party/curl/tests/data/test1800
index 1fe3ae8ad0..55f2d0638a 100644
--- a/third-party/curl/tests/data/test1800
+++ b/third-party/curl/tests/data/test1800
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -32,24 +33,24 @@ http
 <features>
 http/2
 </features>
- <name>
+<name>
 HTTP/2 upgrade refused
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --http2
 </command>
 
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Connection: Upgrade, HTTP2-Settings
 Upgrade: %H2CVER
-HTTP2-Settings: AAMAAABkAAQAoAAAAAIAAAAA
+HTTP2-Settings: AAMAAABkAAQAAQAAAAIAAAAA
+Connection: Upgrade, HTTP2-Settings
 
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test1801 b/third-party/curl/tests/data/test1801
index 8ccce242c5..3251afc348 100644
--- a/third-party/curl/tests/data/test1801
+++ b/third-party/curl/tests/data/test1801
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -39,17 +40,17 @@ http
 <features>
 http/2
 </features>
- <name>
+<name>
 HTTP/2 upgrade with lying server
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --http2
 </command>
 
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1802 b/third-party/curl/tests/data/test1802
new file mode 100644
index 0000000000..7b1c7ee253
--- /dev/null
+++ b/third-party/curl/tests/data/test1802
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP CONNECT
+</keywords>
+</info>
+
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-foo-
+</data>
+<connect crlf="headers">
+HTTP/1.1 200 fine
+Connection: close
+Content-Length: 0
+
+</connect>
+</reply>
+
+# Client-side
+<client>
+<features>
+ftp
+proxy
+</features>
+<server>
+http
+</server>
+<name>
+HTTP CONNECT with custom headers for proxy and server
+</name>
+<command>
+http://hello/wanted/page -p -x %HOSTIP:%HTTPPORT --header "User-Agent: myapp/1.0" --proxy-header "User-Agent: Benjamin/2" --proxy-header "Host: todeloo" --header "Host: foo"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+
+<protocol crlf="headers">
+CONNECT hello:80 HTTP/1.1
+Proxy-Connection: Keep-Alive
+User-Agent: Benjamin/2
+Host: todeloo
+
+GET /wanted/page HTTP/1.1
+Host: foo
+Accept: */*
+User-Agent: myapp/1.0
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test181 b/third-party/curl/tests/data/test181
index 4f196df393..3887e5b865 100644
--- a/third-party/curl/tests/data/test181
+++ b/third-party/curl/tests/data/test181
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,10 +24,10 @@ blablabla
 <server>
 http
 </server>
- <name>
+<name>
 HTTP 1.0 POST
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER --data-binary @%LOGDIR/test%TESTNUMBER.txt --http1.0
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
@@ -44,7 +45,7 @@ the
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 POST /we/want/%TESTNUMBER HTTP/1.0
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test182 b/third-party/curl/tests/data/test182
index 9641d129b9..8f02347cf0 100644
--- a/third-party/curl/tests/data/test182
+++ b/third-party/curl/tests/data/test182
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -29,7 +30,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test183 b/third-party/curl/tests/data/test183
index 882cac74ae..a9ad836ad6 100644
--- a/third-party/curl/tests/data/test183
+++ b/third-party/curl/tests/data/test183
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ persistent connection
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 4
@@ -24,10 +25,10 @@ moo
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET two URLs over a single proxy with persistent connection
- </name>
- <command>
+</name>
+<command>
 http://deathstar.another.galaxy/%TESTNUMBER http://a.galaxy.far.far.away/%TESTNUMBER --proxy http://%HOSTIP:%HTTPPORT
 </command>
 <features>
@@ -37,7 +38,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://deathstar.another.galaxy/%TESTNUMBER HTTP/1.1
 Host: deathstar.another.galaxy
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test184 b/third-party/curl/tests/data/test184
index 4f0ad7c29f..5f1456d067 100644
--- a/third-party/curl/tests/data/test184
+++ b/third-party/curl/tests/data/test184
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ followlocation
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 301 OK swsbounce
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 4
@@ -18,14 +19,14 @@ Location: http://yet.another.host/%TESTNUMBER
 
 moo
 </data>
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 4
 
 moo
 </data1>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 301 OK swsbounce
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 4
@@ -44,10 +45,10 @@ moo
 <server>
 http
 </server>
- <name>
+<name>
 HTTP replace Host: when following Location: to new host
- </name>
- <command>
+</name>
+<command>
 http://deathstar.another.galaxy/%TESTNUMBER -L -H "Host: another.visitor.stay.a.while.stay.foreeeeeever" --proxy http://%HOSTIP:%HTTPPORT
 </command>
 <features>
@@ -57,7 +58,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://deathstar.another.galaxy/%TESTNUMBER HTTP/1.1
 Host: another.visitor.stay.a.while.stay.foreeeeeever
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1847 b/third-party/curl/tests/data/test1847
new file mode 100644
index 0000000000..7ccc2d4025
--- /dev/null
+++ b/third-party/curl/tests/data/test1847
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IMAP
+Clear Text
+FETCH
+CUSTOMREQUEST
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="yes">
+From: me@somewhere
+To: fake@nowhere
+
+body
+
+--
+  yours sincerely
+</data>
+<datacheck crlf="yes">
+* FETCH FETCH (1 BODY[] {71}
+From: me@somewhere
+To: fake@nowhere
+
+body
+
+--
+  yours sincerely
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+imap
+</server>
+<name>
+IMAP FETCH message with custom request
+</name>
+<command>
+'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER' --request 'UID FETCH 1 BODY[]' -u '"user:sec"ret{'
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+A001 CAPABILITY
+A002 LOGIN "\"user" "sec\"ret{"
+A003 SELECT %TESTNUMBER
+A004 UID FETCH 1 BODY[]
+A005 LOGOUT
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1848 b/third-party/curl/tests/data/test1848
new file mode 100644
index 0000000000..60a31a3db8
--- /dev/null
+++ b/third-party/curl/tests/data/test1848
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IMAP
+Clear Text
+FETCH
+CUSTOMREQUEST
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="yes">
+From: me@somewhere
+To: fake@nowhere
+
+body
+
+--
+  yours sincerely
+</data>
+# listing goes to debug output, so data output is empty
+<datacheck crlf="yes">
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+imap
+</server>
+<name>
+IMAP FETCH message with custom request to get list of email.
+</name>
+<command>
+'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER' --request 'UID FETCH 1:* (FLAGS INTERNALDATE RFC822.SIZE BODY.PEEK[HEADER.FIELDS (Message-Id DATE FROM SUBJECT TO SENDER REPLY-TO CC BCC)])' -u '"user:sec"ret{'
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+A001 CAPABILITY
+A002 LOGIN "\"user" "sec\"ret{"
+A003 SELECT %TESTNUMBER
+A004 UID FETCH 1:* (FLAGS INTERNALDATE RFC822.SIZE BODY.PEEK[HEADER.FIELDS (Message-Id DATE FROM SUBJECT TO SENDER REPLY-TO CC BCC)])
+A005 LOGOUT
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1849 b/third-party/curl/tests/data/test1849
new file mode 100644
index 0000000000..84d92a31d4
--- /dev/null
+++ b/third-party/curl/tests/data/test1849
@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP CONNECT
+HTTP proxy
+</keywords>
+</info>
+
+# Server-side
+<reply>
+
+# this is returned first since we get no proxy-auth
+<connect crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+
+</connect>
+
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 7
+Content-Type: text/html
+Funny-head: yesyes
+
+first!
+</data>
+
+<data2 crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 7
+Content-Type: text/html
+Funny-head: yesyes
+
+daniel
+</data2>
+
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+https
+http-proxy
+</server>
+<features>
+proxy
+</features>
+<name>
+HTTPS reuse a proxy with different credentials
+</name>
+<command>
+https://example.com:%HTTPSPORT/path/%TESTNUMBER --proxy http://user1:pwd1@%HOSTIP:%PROXYPORT --insecure --next https://example.com:%HTTPSPORT/path/%TESTNUMBER0002 --proxy http://user2:pwd2@%HOSTIP:%PROXYPORT --insecure
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<proxy crlf="headers">
+CONNECT example.com:%HTTPSPORT HTTP/1.1
+Host: example.com:%HTTPSPORT
+Proxy-Authorization: Basic %b64[user1:pwd1]b64%
+User-Agent: curl/%VERSION
+Proxy-Connection: Keep-Alive
+
+CONNECT example.com:%HTTPSPORT HTTP/1.1
+Host: example.com:%HTTPSPORT
+Proxy-Authorization: Basic %b64[user2:pwd2]b64%
+User-Agent: curl/%VERSION
+Proxy-Connection: Keep-Alive
+
+</proxy>
+<protocol crlf="headers">
+GET /path/%TESTNUMBER HTTP/1.1
+Host: example.com:%HTTPSPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /path/%TESTNUMBER0002 HTTP/1.1
+Host: example.com:%HTTPSPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test185 b/third-party/curl/tests/data/test185
index e8ee975998..77e0ef1118 100644
--- a/third-party/curl/tests/data/test185
+++ b/third-party/curl/tests/data/test185
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ followlocation
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 301 OK swsbounce
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 4
@@ -18,14 +19,14 @@ Location: go/west/%TESTNUMBER
 
 moo
 </data>
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 4
 
 moo
 </data1>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 301 OK swsbounce
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 4
@@ -44,10 +45,10 @@ moo
 <server>
 http
 </server>
- <name>
+<name>
 HTTP replace Host: when following Location: on the same host
- </name>
- <command>
+</name>
+<command>
 http://deathstar.another.galaxy/%TESTNUMBER -L -H "Host: another.visitor.stay.a.while.stay.foreeeeeever" --proxy http://%HOSTIP:%HTTPPORT
 </command>
 <features>
@@ -57,7 +58,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://deathstar.another.galaxy/%TESTNUMBER HTTP/1.1
 Host: another.visitor.stay.a.while.stay.foreeeeeever
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1850 b/third-party/curl/tests/data/test1850
new file mode 100644
index 0000000000..6a3e4d409b
--- /dev/null
+++ b/third-party/curl/tests/data/test1850
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+SMB
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+Basic SMB test complete
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+smb
+</server>
+<features>
+smb
+</features>
+<name>
+Two SMB requests in the same command line
+</name>
+<command>
+-u 'curltest:curltest' smb://%HOSTIP:%SMBPORT/TESTS/%TESTNUMBER smb://%HOSTIP:%SMBPORT/TESTS/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<stdout>
+Basic SMB test complete
+Basic SMB test complete
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1851 b/third-party/curl/tests/data/test1851
new file mode 100644
index 0000000000..dd2e05be89
--- /dev/null
+++ b/third-party/curl/tests/data/test1851
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPFS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes" crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 21
+Connection: close
+Content-Type: text/plain
+Funny-head: yesyes
+
+Hello curl from IPFS
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+proxy
+</features>
+<server>
+http
+</server>
+<name>
+IPFS gateway using default port number
+</name>
+<command>
+--ipfs-gateway http://somewhere.anywhere "ipfs://r4nd0m" -x http://%HOSTIP:%HTTPPORT
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://somewhere.anywhere/ipfs/r4nd0m HTTP/1.1
+Host: somewhere.anywhere
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test186 b/third-party/curl/tests/data/test186
index abbe32088f..52f8a7ea52 100644
--- a/third-party/curl/tests/data/test186
+++ b/third-party/curl/tests/data/test186
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,11 +28,11 @@ Mime
 <server>
 http
 </server>
- <name>
+<name>
 HTTP RFC1867-type formposting with types on text fields
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -F "name=daniel;type=moo/foo" -F "html= <body>hello</body>;type=text/html;charset=verymoo"
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -F "name=daniel;type=moo/foo-.4" -F "html= <body>hello</body>;type=text/html;charset=verymoo"
 </command>
 # We create this file before the command is invoked!
 </client>
@@ -41,17 +42,17 @@ http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -F "name=daniel;type=moo/foo" -F "h
 <strip>
 ^(Content-Type: multipart/form-data;|------------).*
 </strip>
-<protocol>
+<protocol crlf="yes">
 POST /we/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Content-Length: 320
+Content-Length: 341
 Content-Type: multipart/form-data; boundary=----------------------------212d9006ceb5
 
 ------------------------------212d9006ceb5
 Content-Disposition: form-data; name="name"
-Content-Type: moo/foo
+Content-Type: moo/foo-.4
 
 daniel
 ------------------------------212d9006ceb5
diff --git a/third-party/curl/tests/data/test187 b/third-party/curl/tests/data/test187
index e3ac82d02b..40ef0d9f06 100644
--- a/third-party/curl/tests/data/test187
+++ b/third-party/curl/tests/data/test187
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -50,17 +51,17 @@ If this is received, the location following worked
 <server>
 http
 </server>
- <name>
-HTTP redirect with bad host name separation and slash in parameters
- </name>
- <command>
+<name>
+HTTP redirect with bad hostname separation and slash in parameters
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT?oh=what-weird=test/%TESTNUMBER -L
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /?oh=what-weird=test/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test188 b/third-party/curl/tests/data/test188
index 6785f250e7..982f4dae0c 100644
--- a/third-party/curl/tests/data/test188
+++ b/third-party/curl/tests/data/test188
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -19,7 +20,7 @@ Content-Length: 3
 OK
 </data>
 <data1>
-HTTP/1.1 200 OK 
+HTTP/1.1 200 OK%SP
 Connection: close
 Content-Length: 15
 Content-Range: bytes 50-
@@ -32,7 +33,7 @@ HTTP/1.1 301 OK swsbounce
 Location: /%TESTNUMBER
 Content-Length: 3
 
-HTTP/1.1 200 OK 
+HTTP/1.1 200 OK%SP
 Connection: close
 Content-Length: 15
 Content-Range: bytes 50-
@@ -47,17 +48,17 @@ Actual content
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with resume and redirect
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -C 50 -L
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Range: bytes=50-
diff --git a/third-party/curl/tests/data/test189 b/third-party/curl/tests/data/test189
index f590d7dfd9..d558187a8a 100644
--- a/third-party/curl/tests/data/test189
+++ b/third-party/curl/tests/data/test189
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -16,7 +17,7 @@ Content-Length: 3
 OK
 </data>
 <data1>
-HTTP/1.1 200 OK 
+HTTP/1.1 200 OK%SP
 Connection: close
 Content-Length: 15
 
@@ -28,7 +29,7 @@ HTTP/1.1 301 OK swsbounce
 Location: /%TESTNUMBER
 Content-Length: 3
 
-HTTP/1.1 200 OK 
+HTTP/1.1 200 OK%SP
 Connection: close
 Content-Length: 15
 
@@ -41,17 +42,17 @@ Content-Length: 15
 <server>
 http
 </server>
- <name>
-HTTP GET with resume and redirect (to a page that doesn't resume)
- </name>
- <command>
+<name>
+HTTP GET with resume and redirect (to a page that does not resume)
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -C 50 -L
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Range: bytes=50-
diff --git a/third-party/curl/tests/data/test19 b/third-party/curl/tests/data/test19
index f053baf08b..814163859c 100644
--- a/third-party/curl/tests/data/test19
+++ b/third-party/curl/tests/data/test19
@@ -1,30 +1,25 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 connect to non-listen
-FAILURE
 </keywords>
 </info>
 # Server-side
 <reply>
-<data>
-</data>
 </reply>
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 http
 </features>
- <name>
+<name>
 attempt connect to non-listening socket
- </name>
- <command>
-%HOSTIP:%NOLISTENPORT
+</name>
+<command>
+--trace-config all %HOSTIP:%NOLISTENPORT
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test190 b/third-party/curl/tests/data/test190
index a4b5ff19c0..f59f871d6a 100644
--- a/third-party/curl/tests/data/test190
+++ b/third-party/curl/tests/data/test190
@@ -1,9 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
 timeout
-FAILURE
 DELAY
 </keywords>
 </info>
@@ -23,11 +23,11 @@ ftp
 <killserver>
 ftp
 </killserver>
- <name>
+<name>
 FTP download with strict timeout and slow CWD
- </name>
- <command timeout="1">
-ftp://%HOSTIP:%FTPPORT/path/to/file/%TESTNUMBER -m %FTPTIME2
+</name>
+<command>
+ftp://%HOSTIP:%FTPPORT/path/to/file/%TESTNUMBER -m 10
 </command>
 </client>
 
@@ -37,7 +37,7 @@ ftp://%HOSTIP:%FTPPORT/path/to/file/%TESTNUMBER -m %FTPTIME2
 <errorcode>
 28
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test1900 b/third-party/curl/tests/data/test1900
new file mode 100644
index 0000000000..08eb8f304d
--- /dev/null
+++ b/third-party/curl/tests/data/test1900
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HSTS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<features>
+HSTS
+http
+</features>
+
+<name>
+HSTS curl_easy_duphandle
+</name>
+<tool>
+lib%TESTNUMBER
+</tool>
+
+<command>
+http://%HOSTIP:%NOLISTENPORT/not-there/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1901 b/third-party/curl/tests/data/test1901
new file mode 100644
index 0000000000..e1e356dd8e
--- /dev/null
+++ b/third-party/curl/tests/data/test1901
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP POST
+CURLOPT_READFUNCTION
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Content-Length: 6
+Content-Type: text/html
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+
+<name>
+Chunked HTTP POST from callback with CURLOPT_POSTFIELDSIZE set
+</name>
+<tool>
+lib%TESTNUMBER
+</tool>
+
+<command>
+http://%HOSTIP:%HTTPPORT/boom
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+POST /boom HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Transfer-Encoding: chunked
+Content-Type: application/x-www-form-urlencoded
+
+3
+one
+3
+two
+5
+three
+4
+four
+0
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1902 b/third-party/curl/tests/data/test1902
new file mode 100644
index 0000000000..a794fd4e58
--- /dev/null
+++ b/third-party/curl/tests/data/test1902
@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+cookies
+</keywords>
+</info>
+
+# Client-side
+<client>
+
+<name>
+set COOKIEFILE and COOKIEJAR but make no transfer
+</name>
+<features>
+cookies
+</features>
+<tool>
+lib%TESTNUMBER
+</tool>
+
+<command>
+%LOGDIR/cookie%TESTNUMBER
+</command>
+<file name="%LOGDIR/cookie%TESTNUMBER">
+# Netscape HTTP Cookie File
+# https://curl.se/docs/http-cookies.html
+# This file was generated by libcurl! Edit at your own risk.
+
+example.com	FALSE	/	FALSE	0	has_js	1
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<file name="%LOGDIR/cookie%TESTNUMBER">
+# Netscape HTTP Cookie File
+# https://curl.se/docs/http-cookies.html
+# This file was generated by libcurl! Edit at your own risk.
+
+example.com	FALSE	/	FALSE	0	has_js	1
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1903 b/third-party/curl/tests/data/test1903
index ff5a0f29dd..7881977421 100644
--- a/third-party/curl/tests/data/test1903
+++ b/third-party/curl/tests/data/test1903
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ CURLOPT_COOKIEFILE
 
 # Server-side
 <reply>
-<data nocheck="yes" crlf="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -26,15 +27,18 @@ Set-Cookie: secondcookie=present;
 <server>
 http
 </server>
- <name>
+<name>
 CURLOPT_COOKIEFILE then reset then set again
- </name>
+</name>
 <tool>
 lib%TESTNUMBER
 </tool>
 <command>
-http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER %LOGDIR/cookies%TESTNUMBER
+http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER %LOGDIR/cookies%TESTNUMBER %LOGDIR/cookiesout%TESTNUMBER
 </command>
+<features>
+cookies
+</features>
 <file name="%LOGDIR/cookies%TESTNUMBER" mode="text">
 # Netscape HTTP Cookie File
 # https://curl.se/docs/http-cookies.html
@@ -47,5 +51,13 @@ http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER %LOGDIR/cookies%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
+<file name="%LOGDIR/cookiesout%TESTNUMBER" mode="text">
+# Netscape HTTP Cookie File
+# https://curl.se/docs/http-cookies.html
+# This file was generated by libcurl! Edit at your own risk.
+
+%HOSTIP	FALSE	/we/want	FALSE	0	foobar	name
+%HOSTIP	FALSE	/we/want	FALSE	0	secondcookie	present
+</file>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1904 b/third-party/curl/tests/data/test1904
index 6a8a3ad4f3..1eff1c38f7 100644
--- a/third-party/curl/tests/data/test1904
+++ b/third-party/curl/tests/data/test1904
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,6 @@ proxytunnel
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -22,13 +22,13 @@ Content-Length: 9
 
 contents
 </data>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 204 Sure go ahead
 
 </connect>
 <datacheck>
-HTTP/1.1 204 Sure go ahead
-
+HTTP/1.1 204 Sure go ahead%CR
+%CR
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -40,17 +40,16 @@ contents
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 http-proxy
 </server>
- <name>
+<name>
 HTTP CONNECT with 204 response
- </name>
- <command>
+</name>
+<command>
 http://test.%TESTNUMBER:%HTTPPORT/we/want/that/page/%TESTNUMBER -p --proxy %HOSTIP:%PROXYPORT
 </command>
 <features>
@@ -58,17 +57,16 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 CONNECT test.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: test.%TESTNUMBER:%HTTPPORT
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
 </proxy>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: test.%TESTNUMBER:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1905 b/third-party/curl/tests/data/test1905
index 7b7c80dc6b..c47ccee00b 100644
--- a/third-party/curl/tests/data/test1905
+++ b/third-party/curl/tests/data/test1905
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -26,9 +27,9 @@ Set-Cookie: secondcookie=present;
 <server>
 http
 </server>
- <name>
+<name>
 CURLOPT_COOKIELIST set to "FLUSH" of a shared cookie object
- </name>
+</name>
 <tool>
 lib%TESTNUMBER
 </tool>
@@ -42,7 +43,7 @@ cookies
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
@@ -53,8 +54,8 @@ Accept: */*
 # https://curl.se/docs/http-cookies.html
 # This file was generated by libcurl! Edit at your own risk.
 
-%HOSTIP	FALSE	/we/want/	FALSE	0	secondcookie	present
-%HOSTIP	FALSE	/we/want/	FALSE	0	foobar	name
+%HOSTIP	FALSE	/we/want	FALSE	0	secondcookie	present
+%HOSTIP	FALSE	/we/want	FALSE	0	foobar	name
 </file>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1906 b/third-party/curl/tests/data/test1906
index 33170d88c4..cd2bfd93d7 100644
--- a/third-party/curl/tests/data/test1906
+++ b/third-party/curl/tests/data/test1906
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,9 +24,9 @@ Funny-head: yesyes swsclose
 <server>
 http
 </server>
- <name>
+<name>
 CURLOPT_CURLU and CURLOPT_PORT
- </name>
+</name>
 <tool>
 lib%TESTNUMBER
 </tool>
@@ -39,7 +40,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1907 b/third-party/curl/tests/data/test1907
index 5f84f81709..aa6fb205ab 100644
--- a/third-party/curl/tests/data/test1907
+++ b/third-party/curl/tests/data/test1907
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,9 +24,9 @@ Content-Length: 0
 <server>
 http
 </server>
- <name>
+<name>
 CURLINFO_EFFECTIVE_URL with non-scheme URL
- </name>
+</name>
 <tool>
 lib%TESTNUMBER
 </tool>
@@ -37,7 +38,7 @@ lib%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1908 b/third-party/curl/tests/data/test1908
index e9256de7b6..bd564ae200 100644
--- a/third-party/curl/tests/data/test1908
+++ b/third-party/curl/tests/data/test1908
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -34,16 +35,16 @@ alt-svc: h2="second.example:443"; ma=315360000;
 http
 </server>
 
-# require debug so that alt-svc can work over plain old HTTP
+# require Debug so that alt-svc can work over plain old HTTP
 <features>
 alt-svc
-debug
+Debug
 </features>
 <name>
 alt-svc cache save after resetting the handle
 </name>
 <setenv>
-# make debug-curl accept Alt-Svc over plain HTTP
+# make Debug-curl accept Alt-Svc over plain HTTP
 CURL_ALTSVC_HTTP="yeah"
 </setenv>
 <tool>
@@ -57,7 +58,7 @@ lib%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1909 b/third-party/curl/tests/data/test1909
index 163a20062b..2efe90a74a 100644
--- a/third-party/curl/tests/data/test1909
+++ b/third-party/curl/tests/data/test1909
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ retry
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -26,24 +26,22 @@ data
 </data1>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET --retry-all-errors to overcome partial transfer
- </name>
- <command option="no-output,no-include">
+</name>
+<command option="no-output,no-include">
 --retry 1 --retry-all-errors -o %LOGDIR/outfile%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test191 b/third-party/curl/tests/data/test191
index 5ced5a592c..d254e2202c 100644
--- a/third-party/curl/tests/data/test191
+++ b/third-party/curl/tests/data/test191
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -17,17 +18,17 @@ data in file
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP URL with ?-letters in username and password
- </name>
- <command>
+</name>
+<command>
 "ftp://use%3fr:pass%3fword@%HOSTIP:%FTPPORT/%TESTNUMBER"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER use?r
 PASS pass?word
 PWD
diff --git a/third-party/curl/tests/data/test1910 b/third-party/curl/tests/data/test1910
index 1cef9fa81d..afd40bac1d 100644
--- a/third-party/curl/tests/data/test1910
+++ b/third-party/curl/tests/data/test1910
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -49,15 +50,15 @@ lib%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dXNlcgpuYW1lOnBhc3MKd29yZA==
+Authorization: Basic %b64[user%0aname:pass%0aword]b64%
 Accept: */*
 
 GET /%TESTNUMBER0002 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dXNlcgpuYW1lOnBhc3MKd29yZA==
+Authorization: Basic %b64[user%0aname:pass%0aword]b64%
 Accept: */*
 
 </protocol>
diff --git a/third-party/curl/tests/data/test1911 b/third-party/curl/tests/data/test1911
index 07e87a64c8..8ba5c1ab3f 100644
--- a/third-party/curl/tests/data/test1911
+++ b/third-party/curl/tests/data/test1911
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,9 +12,6 @@ curl_easy_option
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <name>
 verify that curl_easy_setopt() rejects too long string inputs
 </name>
diff --git a/third-party/curl/tests/data/test1912 b/third-party/curl/tests/data/test1912
index 85dca0d6b6..86775e1ee3 100644
--- a/third-party/curl/tests/data/test1912
+++ b/third-party/curl/tests/data/test1912
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,9 +13,6 @@ typecheck
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <name>
 Cross validate that gcc-typecheck macros match the option types.
 </name>
diff --git a/third-party/curl/tests/data/test1913 b/third-party/curl/tests/data/test1913
index b9ac2cbdfe..c3624de8a5 100644
--- a/third-party/curl/tests/data/test1913
+++ b/third-party/curl/tests/data/test1913
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -19,7 +20,7 @@ REPLY SIZE 550 no such file
 ftp
 </server>
 
-# require debug so that alt-svc can work over plain old HTTP
+# require Debug so that alt-svc can work over plain old HTTP
 <name>
 FTP with NOBODY set, getting a missing file
 </name>
diff --git a/third-party/curl/tests/data/test1914 b/third-party/curl/tests/data/test1914
index 1aa3e48c01..92dc657dc3 100644
--- a/third-party/curl/tests/data/test1914
+++ b/third-party/curl/tests/data/test1914
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -20,7 +21,7 @@ REPLY MDTM 550 no such file
 ftp
 </server>
 
-# require debug so that alt-svc can work over plain old HTTP
+# require Debug so that alt-svc can work over plain old HTTP
 <name>
 FTP with NOBODY and FILETIME set, getting a missing file
 </name>
diff --git a/third-party/curl/tests/data/test1915 b/third-party/curl/tests/data/test1915
index 0af5421145..8f9089b294 100644
--- a/third-party/curl/tests/data/test1915
+++ b/third-party/curl/tests/data/test1915
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -17,11 +18,7 @@ CURLOPT_HSTSREADFUNCTION
 HSTS
 http
 </features>
-<server>
-none
-</server>
 
-# require debug so that alt-svc can work over plain old HTTP
 <name>
 HSTS read/write callbacks
 </name>
@@ -36,7 +33,7 @@ http://%HOSTIP:%NOLISTENPORT/not-there/%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-# 7 CURLE_COULDNT_CONNECT (expected since there's nothing listening there)
+# 7 CURLE_COULDNT_CONNECT (expected since there is nothing listening there)
 # 42 CURLE_ABORTED_BY_CALLBACK
 <errorcode>
 42
@@ -45,13 +42,13 @@ http://%HOSTIP:%NOLISTENPORT/not-there/%TESTNUMBER
 %if large-time
 [0/4] 1.example.com 25250320 01:02:03
 [1/4] 2.example.com 25250320 03:02:01
-[2/4] 3.example.com 25250319 01:02:03
+[2/4] .3.example.com 25250319 01:02:03
 %else
 [0/4] 1.example.com 20370320 01:02:03
 [1/4] 2.example.com 20370320 03:02:01
-[2/4] 3.example.com 20370319 01:02:03
+[2/4] .3.example.com 20370319 01:02:03
 %endif
-[3/4] 4.example.com unlimited
+[3/4] .4.example.com unlimited
 First request returned 7
 Second request returned 42
 </stdout>
diff --git a/third-party/curl/tests/data/test1916 b/third-party/curl/tests/data/test1916
index afde1cc026..0a56251d24 100644
--- a/third-party/curl/tests/data/test1916
+++ b/third-party/curl/tests/data/test1916
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,18 +7,13 @@ MQTT PUBLISH
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
 hello
 </data>
-<datacheck hex="yes">
-00 04 31 31 39 30   68 65 6c 6c 6f 5b 4c 46 5d 0a
-</datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -37,11 +33,9 @@ lib%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # These are hexadecimal protocol dumps from the client
-#
 # Strip out the random part of the client id from the CONNECT message
 # before comparison
 <strippart>
diff --git a/third-party/curl/tests/data/test1917 b/third-party/curl/tests/data/test1917
index a2cb981b72..d1a79d2d9b 100644
--- a/third-party/curl/tests/data/test1917
+++ b/third-party/curl/tests/data/test1917
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,22 +7,17 @@ MQTT PUBLISH
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
 hello
 </data>
-<datacheck hex="yes">
-00 04 31 31 39 30   68 65 6c 6c 6f 5b 4c 46 5d 0a
-</datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 
-# require HTTP too as otherwise CURLOPT_POST doesn't exist
+# require HTTP too as otherwise CURLOPT_POST does not exist
 <features>
 mqtt
 http
@@ -33,18 +29,16 @@ mqtt
 MQTT PUBLISH with CURLOPT_POST set (no payload)
 </name>
 <tool>
-lib%TESTNUMBER
+lib1916
 </tool>
 <command option="binary-trace">
 "mqtt://%HOSTIP:%MQTTPORT/%20"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # These are hexadecimal protocol dumps from the client
-#
 # Strip out the random part of the client id from the CONNECT message
 # before comparison
 <strippart>
diff --git a/third-party/curl/tests/data/test1918 b/third-party/curl/tests/data/test1918
index e9fe441402..fda8908224 100644
--- a/third-party/curl/tests/data/test1918
+++ b/third-party/curl/tests/data/test1918
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -13,9 +14,6 @@ curl_easy_option_by_id
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <name>
 curl_easy_option_by_name() and curl_easy_option_by_id()
 </name>
diff --git a/third-party/curl/tests/data/test1919 b/third-party/curl/tests/data/test1919
index 06b357c30f..c18962e730 100644
--- a/third-party/curl/tests/data/test1919
+++ b/third-party/curl/tests/data/test1919
@@ -1,7 +1,8 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
-conn-reuse
+connection reuse
 </keywords>
 </info>
 
@@ -35,7 +36,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Authorization: Bearer c4e448d652a961fda0ab64f882c8c161d5985f805d45d80c9ddca1
diff --git a/third-party/curl/tests/data/test192 b/third-party/curl/tests/data/test192
index ab14feedd0..c62f4bad6f 100644
--- a/third-party/curl/tests/data/test192
+++ b/third-party/curl/tests/data/test192
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -19,24 +19,22 @@ monster
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET -w num_connects with one simple connect
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w "%{num_connects}\n"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1920 b/third-party/curl/tests/data/test1920
new file mode 100644
index 0000000000..3471025b41
--- /dev/null
+++ b/third-party/curl/tests/data/test1920
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+cookies
+</keywords>
+</info>
+
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Set-Cookie: cookiename=cookiecontent;
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+
+<name>
+load cookies, perform then reset before cleanup
+</name>
+<server>
+http
+</server>
+<features>
+cookies
+</features>
+<tool>
+lib%TESTNUMBER
+</tool>
+
+<command>
+http://%HOSTIP:%HTTPPORT/ %LOGDIR/cookie%TESTNUMBER
+</command>
+<file name="%LOGDIR/cookie%TESTNUMBER">
+# Netscape HTTP Cookie File
+# https://curl.se/docs/http-cookies.html
+# This file was generated by libcurl! Edit at your own risk.
+
+example.com	FALSE	/	FALSE	0	has_js	1
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<file name="%LOGDIR/cookie%TESTNUMBER" mode="text">
+# Netscape HTTP Cookie File
+# https://curl.se/docs/http-cookies.html
+# This file was generated by libcurl! Edit at your own risk.
+
+%HOSTIP	FALSE	/	FALSE	0	cookiename	cookiecontent
+example.com	FALSE	/	FALSE	0	has_js	1
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1921 b/third-party/curl/tests/data/test1921
new file mode 100644
index 0000000000..15a3fe1ae7
--- /dev/null
+++ b/third-party/curl/tests/data/test1921
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+urlapi
+</keywords>
+</info>
+
+# Client-side
+<client>
+
+<name>
+Set a URL without scheme, then redirect with default scheme
+</name>
+<tool>
+lib%TESTNUMBER
+</tool>
+
+<command>
+-
+</command>
+</client>
+
+<verify>
+<stdout mode="text">
+URL: https://example.com/newpath
+</stdout>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test1922 b/third-party/curl/tests/data/test1922
new file mode 100644
index 0000000000..9c35ccff6f
--- /dev/null
+++ b/third-party/curl/tests/data/test1922
@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP proxy
+HSTS
+curl_easy_duphandle
+</keywords>
+</info>
+
+<reply>
+<!-- Response to the original handle's direct HTTP request.
+     Strict-Transport-Security header populates the live HSTS cache. -->
+<data nocheck="yes" crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Type: text/plain
+Content-Length: 5
+Strict-Transport-Security: max-age=31536000
+
+Hello
+</data>
+
+<!-- Response to the dup handle's proxy CONNECT attempt.
+     The CONNECT to port 443 proves the copied
+     HSTS cache upgraded the dup's HTTP URL to HTTPS. -->
+<connect crlf="headers">
+HTTP/1.1 403 Forbidden
+Content-Length: 0
+Connection: close
+
+</connect>
+</reply>
+
+<client>
+<features>
+HSTS
+https
+Debug
+proxy
+</features>
+<server>
+http
+http-proxy
+</server>
+<setenv>
+CURL_HSTS_HTTP=yes
+</setenv>
+<name>
+curl_easy_duphandle copies HSTS cache, auto upgrading HTTP to HTTPS.
+</name>
+<tool>
+lib%TESTNUMBER
+</tool>
+<command>
+- %HOSTIP %HTTPPORT %PROXYPORT
+</command>
+</client>
+
+<verify>
+# First request: original handle GETs from the http server; the response
+# carries Strict-Transport-Security, populating the live HSTS cache that
+# the dup inherits.
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: hsts.example.com:%HTTPPORT
+Accept: */*
+
+</protocol>
+# Second request: dup handle upgraded HTTP to HTTPS by copied HSTS cache,
+# proxy receives CONNECT to port 443 proving the upgrade happened
+<proxy crlf="headers">
+CONNECT hsts.example.com:443 HTTP/1.1
+Host: hsts.example.com:443
+Proxy-Connection: Keep-Alive
+
+</proxy>
+<stdout>
+First request: HSTS cache populated
+Dup effective URL: https://hsts.example.com/%TESTNUMBER
+</stdout>
+# CURLE_COULDNT_CONNECT (7) is intentional: The proxy rejects the CONNECT
+# to port 443, collapsing the tunnel. All that is being validated is the
+# CONNECT to port 443 itself.
+<errorcode>
+7
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test193 b/third-party/curl/tests/data/test193
index 2b41200d80..6a7e78b920 100644
--- a/third-party/curl/tests/data/test193
+++ b/third-party/curl/tests/data/test193
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ followlocation
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -31,24 +31,22 @@ monster
 
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET -w num_connects with redirected fetch (2 connects)
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w "%{num_connects}\n" -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1933 b/third-party/curl/tests/data/test1933
index ce2562bcae..cda12d19a1 100644
--- a/third-party/curl/tests/data/test1933
+++ b/third-party/curl/tests/data/test1933
@@ -1,8 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 CURLOPT_AWS_SIGV4
+aws-sigv4
 </keywords>
 </info>
 
@@ -32,11 +34,12 @@ Content-Length: 0
 <server>
 http
 </server>
-# this relies on the debug feature which allow to set the time
+# this relies on the Debug feature which allows tests to set the time
 <features>
 SSL
-debug
+Debug
 crypto
+aws
 </features>
 
 <name>
@@ -54,11 +57,10 @@ http://xxx:yyy@127.0.0.1:9000/%TESTNUMBER/testapi/test 127.0.0.1:9000:%HOSTIP:%H
 # Verify data after the test has been "shot"
 <verify>
 <strip>
-^User-Agent:.*
 ^Content-Type:.*
 ^Accept:.*
 </strip>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER/testapi/test HTTP/1.1
 Host: 127.0.0.1:9000
 Authorization: XXX4-HMAC-SHA256 Credential=xxx/19700101/0/127/xxx4_request, SignedHeaders=content-type;host;x-xxx-date, Signature=3d8e00a02e437211a596143dcd590fcc805b731365c68f7f48951ea6eda39c4f
diff --git a/third-party/curl/tests/data/test1934 b/third-party/curl/tests/data/test1934
index 921ae30158..9c52a0d0bd 100644
--- a/third-party/curl/tests/data/test1934
+++ b/third-party/curl/tests/data/test1934
@@ -1,8 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 CURLOPT_AWS_SIGV4
+aws-sigv4
 </keywords>
 </info>
 
@@ -32,11 +34,12 @@ Content-Length: 0
 <server>
 http
 </server>
-# this relies on the debug feature which allow to set the time
+# this relies on the Debug feature which allows tests to set the time
 <features>
 SSL
-debug
+Debug
 crypto
+aws
 </features>
 
 <name>
@@ -54,11 +57,10 @@ http://127.0.0.1:9000/%TESTNUMBER/testapi/test 127.0.0.1:9000:%HOSTIP:%HTTPPORT
 # Verify data after the test has been "shot"
 <verify>
 <strip>
-^User-Agent:.*
 ^Content-Type:.*
 ^Accept:.*
 </strip>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER/testapi/test HTTP/1.1
 Host: 127.0.0.1:9000
 Authorization: XXX4-HMAC-SHA256 Credential=xxx/19700101/0/127/xxx4_request, SignedHeaders=content-type;host;x-yyy-date, Signature=cf8dc9a4af903a1a9bb1385d8e2366d780afb501e266436598438395e502d58c
diff --git a/third-party/curl/tests/data/test1935 b/third-party/curl/tests/data/test1935
index 9721aa3333..f92c7e8ea2 100644
--- a/third-party/curl/tests/data/test1935
+++ b/third-party/curl/tests/data/test1935
@@ -1,8 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 CURLOPT_AWS_SIGV4
+aws-sigv4
 </keywords>
 </info>
 
@@ -32,11 +34,12 @@ Content-Length: 0
 <server>
 http
 </server>
-# this relies on the debug feature which allow to set the time
+# this relies on the Debug feature which allows tests to set the time
 <features>
 SSL
-debug
+Debug
 crypto
+aws
 </features>
 
 <name>
@@ -54,11 +57,10 @@ http://127.0.0.1:9000/%TESTNUMBER/testapi/test 127.0.0.1:9000:%HOSTIP:%HTTPPORT
 # Verify data after the test has been "shot"
 <verify>
 <strip>
-^User-Agent:.*
 ^Content-Type:.*
 ^Accept:.*
 </strip>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER/testapi/test HTTP/1.1
 Host: 127.0.0.1:9000
 Authorization: XXX4-HMAC-SHA256 Credential=xxx/19700101/rrr/127/xxx4_request, SignedHeaders=content-type;host;x-yyy-date, Signature=a0b11b97b54689428d4188b788ed32865d607822d85d3e91cf06141f479dac0b
diff --git a/third-party/curl/tests/data/test1936 b/third-party/curl/tests/data/test1936
index 840c9dee45..e43eb0be69 100644
--- a/third-party/curl/tests/data/test1936
+++ b/third-party/curl/tests/data/test1936
@@ -1,8 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 CURLOPT_AWS_SIGV4
+aws-sigv4
 </keywords>
 </info>
 
@@ -32,11 +34,12 @@ Content-Length: 0
 <server>
 http
 </server>
-# this relies on the debug feature which allow to set the time
+# this relies on the Debug feature which allows tests to set the time
 <features>
 SSL
-debug
+Debug
 crypto
+aws
 </features>
 
 <name>
@@ -54,11 +57,10 @@ http://127.0.0.1:9000/%TESTNUMBER/testapi/test 127.0.0.1:9000:%HOSTIP:%HTTPPORT
 # Verify data after the test has been "shot"
 <verify>
 <strip>
-^User-Agent:.*
 ^Content-Type:.*
 ^Accept:.*
 </strip>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER/testapi/test HTTP/1.1
 Host: 127.0.0.1:9000
 Authorization: XXX4-HMAC-SHA256 Credential=xxx/19700101/rrr/sss/xxx4_request, SignedHeaders=content-type;host;x-yyy-date, Signature=026b713d76b0789bd224c5e41322f74eed088f8a22fd15183ca68376c575c5b0
diff --git a/third-party/curl/tests/data/test1937 b/third-party/curl/tests/data/test1937
index cf5e1a60b0..2043053e59 100644
--- a/third-party/curl/tests/data/test1937
+++ b/third-party/curl/tests/data/test1937
@@ -1,9 +1,11 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP POST
 CURLOPT_AWS_SIGV4
+aws-sigv4
 </keywords>
 </info>
 
@@ -33,11 +35,12 @@ Content-Length: 0
 <server>
 http
 </server>
-# this relies on the debug feature which allow to set the time
+# this relies on the Debug feature which allows tests to set the time
 <features>
 SSL
-debug
+Debug
 crypto
+aws
 </features>
 
 <name>
@@ -55,11 +58,10 @@ http://127.0.0.1:9000/%TESTNUMBER/testapi/test 127.0.0.1:9000:%HOSTIP:%HTTPPORT
 # Verify data after the test has been "shot"
 <verify>
 <strip>
-^User-Agent:.*
 ^Content-Type:.*
 ^Accept:.*
 </strip>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER/testapi/test HTTP/1.1
 Host: 127.0.0.1:9000
 Authorization: PROVIDER14-HMAC-SHA256 Credential=keyId/19700101/region/service/provider14_request, SignedHeaders=content-type;host;x-provider2-date, Signature=4928ccf97a9e71fe27f91db5a3b3c943b6080d25e6f4df8593d4c38e7d1e849b
diff --git a/third-party/curl/tests/data/test1938 b/third-party/curl/tests/data/test1938
index 565a54ffe68f95202e8748f6c5863f2bf2f79c32..a2ea20fc9662e374b9d63f1ffb56615c28037644 100644
GIT binary patch
delta 183
zcmbQk^^i-;#=asqN1-gWs5mn}&sND$&p=5bH7_|oB{MJGRw*=C*D=`H(^JXbj%$J)
zM`C%gZgFOM*+!c!jEpXmKQc<N7b}#c7MB!H=44V3a7j%nP3KB3sw^nU=K`wTY|13U
zI5~n@k1x3>C(TwVBQ-GvXpz$7R%Xk|`<X>2UuAwUc^iweCYN)5UP)?RiLOs-UV2G}
hm4YP~mug08MRY-aafzydflFdZVl0raI{7DyG5}fwJZ1m@

delta 152
zcmaFJHHT}WmfgmpO^lK$sY#{j3Tdf{C8b5F3gsD@$r%cXIXU^|lU<k;c)+q;$wid~
zCHb36m_!(PLyJ?3bRE-E^GdArv?jMP8%#dRY$49e<&j@pVx?ecWUglbgoaj@1_lPa
ylZ99wF!E0R#G<Ug%jKM(R|3?g>yw(7UXo#@V9CqH%T)l>#^91zk~rCpRT%*Md@l9?

diff --git a/third-party/curl/tests/data/test1939 b/third-party/curl/tests/data/test1939
index 19dc74d2b8..d94a9f7c5c 100644
--- a/third-party/curl/tests/data/test1939
+++ b/third-party/curl/tests/data/test1939
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
diff --git a/third-party/curl/tests/data/test194 b/third-party/curl/tests/data/test194
index 3cc02c6ba5..2127bce7cb 100644
--- a/third-party/curl/tests/data/test194
+++ b/third-party/curl/tests/data/test194
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ Resume
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 416 Requested Range Not Satisfiable swsclose
 Date: Fri, 24 Oct 2003 21:33:12 GMT
 Server: Apache/1.3.19 (Unix) (Red-Hat/Linux) mod_ssl/2.8.1 OpenSSL/0.9.6 PHP/4.3.1
@@ -25,7 +26,7 @@ Connection: close
 bad
 </data>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 416 Requested Range Not Satisfiable swsclose
 Date: Fri, 24 Oct 2003 21:33:12 GMT
 Server: Apache/1.3.19 (Unix) (Red-Hat/Linux) mod_ssl/2.8.1 OpenSSL/0.9.6 PHP/4.3.1
@@ -46,17 +47,17 @@ Connection: close
 <server>
 http
 </server>
- <name>
+<name>
 HTTP resume transfer with the whole file already downloaded and --fail
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -C 87 --fail
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Range: bytes=87-
@@ -64,9 +65,8 @@ User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-# CURLE_HTTP_RETURNED_ERROR
 <errorcode>
-22
+0
 </errorcode>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1940 b/third-party/curl/tests/data/test1940
index 7f621b428d..e8f7d44e95 100644
--- a/third-party/curl/tests/data/test1940
+++ b/third-party/curl/tests/data/test1940
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,15 +11,20 @@ curl_easy_header
 <data nocheck="yes">
 HTTP/1.1 200 OK
 Date: Thu, 09 Nov 2010 14:49:00 GMT
-Server:       test with trailing space     
+Server:       test with trailing space%repeat[5 x  ]%
 Content-Type: text/html
 Fold: is
- folding a     
+ folding a%repeat[5 x  ]%
    line
 Content-Length: 0
+Test:%TAB
+%TAB%SP
+%TABword
 Set-Cookie: onecookie=data;
 Set-Cookie: secondcookie=2data;
 Set-Cookie: cookie3=data3;
+Blank:
+Blank2:%CR
 Location: /%TESTNUMBER0002
 
 </data>
@@ -57,6 +63,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 - Set-Cookie == secondcookie=2data; (1/3)
 - Set-Cookie == cookie3=data3; (2/3)
  Fold == is folding a line
+ Blank ==%SP
+ Blank2 ==%SP
+ Test == word
 </stdout>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1941 b/third-party/curl/tests/data/test1941
index 5075435f9c..4532403bc9 100644
--- a/third-party/curl/tests/data/test1941
+++ b/third-party/curl/tests/data/test1941
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,8 +12,9 @@ CONNECT
 <data nocheck="yes">
 HTTP/1.1 200 OK
 Date: Thu, 09 Nov 2010 14:49:00 GMT
-Server:       test with trailing space     
-Content-Type: text/html
+Server:       test with trailing space%repeat[5 x  ]%
+Content-Type:
+%SPtext/html
 Content-Length: 0
 Set-Cookie: onecookie=data;
 Set-Cookie: secondcookie=2data;
@@ -20,9 +22,11 @@ Set-Cookie: cookie3=data3;
 Location: /%TESTNUMBER0002
 
 </data>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 Sure go ahead
-Server: from the connect
+Server: from%SP
+%SPthe%TAB
+%TAB%TABconnect
 Silly-thing: yes yes
 
 </connect>
@@ -54,7 +58,7 @@ http://hello:%HTTPPORT/%TESTNUMBER %HOSTIP:%PROXYPORT
 
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 CONNECT hello:%HTTPPORT HTTP/1.1
 Host: hello:%HTTPPORT
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test1942 b/third-party/curl/tests/data/test1942
index 9079800990..2dd1968ef6 100644
--- a/third-party/curl/tests/data/test1942
+++ b/third-party/curl/tests/data/test1942
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -15,7 +16,7 @@ Server: maybe different
 
 HTTP/1.1 200 OK
 Date: Thu, 09 Nov 2010 14:49:00 GMT
-Server:       test with trailing space     
+Server:       test with trailing space%repeat[5 x  ]%
 Content-Type: text/html
 Content-Length: 0
 Set-Cookie: onecookie=data;
diff --git a/third-party/curl/tests/data/test1943 b/third-party/curl/tests/data/test1943
index 7e639f0d47..8cae4eb01f 100644
--- a/third-party/curl/tests/data/test1943
+++ b/third-party/curl/tests/data/test1943
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,23 +10,23 @@ CONNECT
 # Server-side
 <reply>
 <data nocheck="yes">
-HTTP/1.1 200 funky chunky!
-Server: fakeit/0.9 fakeitbad/1.0
+HTTP/1.1 200 funky chunky!%CR
+Server: fakeit/0.9 fakeitbad/1.0%CR
 Date: Thu, 09 Nov 2010 14:49:00 GMT
-Transfer-Encoding: chunked
-Trailer: server
-Connection: mooo
-
-40
-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-30
-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
-21;heresatest=moooo
+Transfer-Encoding: chunked%CR
+Trailer: server%CR
+Connection: mooo%CR
+%CR
+40%CR
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%CR
+30%CR
+bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%CR
+21;heresatest=moooo%CR
 cccccccccccccccccccccccccccccccc
-
-0
-Server: sent-as-trailer
-
+%CR
+0%CR
+Server: sent-as-trailer%CR
+%CR
 </data>
 </reply>
 
diff --git a/third-party/curl/tests/data/test1944 b/third-party/curl/tests/data/test1944
index ad0920d4ae..1b0dd469c1 100644
--- a/third-party/curl/tests/data/test1944
+++ b/third-party/curl/tests/data/test1944
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ curl_easy_header
 <data nocheck="yes">
 HTTP/1.1 302 OK
 Date: Thu, 01 Nov 2001 14:49:00 GMT
-Server:       test with trailing space     
+Server:       test with trailing space%repeat[5 x  ]%
 Content-Type: text/html
 Content-Length: 0
 Set-Cookie: onecookie=data;
diff --git a/third-party/curl/tests/data/test1945 b/third-party/curl/tests/data/test1945
index f200703bcb..f085007c6b 100644
--- a/third-party/curl/tests/data/test1945
+++ b/third-party/curl/tests/data/test1945
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ CONNECT
 <data nocheck="yes">
 HTTP/1.1 200 OK
 Date: Thu, 09 Nov 2010 14:49:00 GMT
-Server:       test with trailing space     
+Server:       test with trailing space%repeat[5 x  ]%
 Content-Type: text/html
 Content-Length: 0
 Set-Cookie: onecookie=data;
@@ -20,7 +21,7 @@ Set-Cookie: cookie3=data3;
 Location: /%TESTNUMBER0002
 
 </data>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 Sure go ahead
 Server: from the connect
 Silly-thing: yes yes
@@ -54,7 +55,7 @@ http://hello:%HTTPPORT/%TESTNUMBER %HOSTIP:%PROXYPORT
 
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 CONNECT hello:%HTTPPORT HTTP/1.1
 Host: hello:%HTTPPORT
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test1946 b/third-party/curl/tests/data/test1946
index 220df012b8..571fbc7fc3 100644
--- a/third-party/curl/tests/data/test1946
+++ b/third-party/curl/tests/data/test1946
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ curl_easy_header
 <data nocheck="yes">
 HTTP/1.1 302 OK
 Date: Thu, 01 Nov 2001 14:49:00 GMT
-Server:       test with trailing space     
+Server:       test with trailing space%repeat[5 x  ]%
 Content-Type: text/html
 Content-Length: 0
 Set-Cookie: onecookie=data;
@@ -44,7 +45,7 @@ http
 curl_easy_header with redirect but get headers from first request
 </name>
 <tool>
-lib%TESTNUMBER
+lib1940
 </tool>
 
 <command>
diff --git a/third-party/curl/tests/data/test1947 b/third-party/curl/tests/data/test1947
index f159e4d51c..9519809c58 100644
--- a/third-party/curl/tests/data/test1947
+++ b/third-party/curl/tests/data/test1947
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ curl_easy_nextheader
 <data nocheck="yes">
 HTTP/1.1 302 OK
 Date: Thu, 01 Nov 2001 14:49:00 GMT
-Server:       test with trailing space     
+Server:       test with trailing space%repeat[5 x  ]%
 Content-Type: text/html
 Content-Length: 0
 Set-Cookie: onecookie=data;
diff --git a/third-party/curl/tests/data/test1948 b/third-party/curl/tests/data/test1948
index f984477bd6..ac926c0057 100644
--- a/third-party/curl/tests/data/test1948
+++ b/third-party/curl/tests/data/test1948
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ HTTP PUT
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Thu, 01 Nov 2001 14:49:00 GMT
 Content-Type: text/html
@@ -17,7 +18,7 @@ Content-Length: 6
 
 hello
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Thu, 01 Nov 2001 14:49:00 GMT
 Content-Type: text/html
@@ -53,14 +54,14 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
 Content-Length: 22
 
 This is test PUT data
-POST /1948 HTTP/1.1
+POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
 Content-Length: 22
diff --git a/third-party/curl/tests/data/test195 b/third-party/curl/tests/data/test195
index ad076b87da..235486e4d3 100644
--- a/third-party/curl/tests/data/test195
+++ b/third-party/curl/tests/data/test195
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -17,10 +18,10 @@ REPLY PASS 530 temporarily not available
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP response 530 after PASS, temporarily not allowed access
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
@@ -30,7 +31,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 <errorcode>
 67
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 </protocol>
diff --git a/third-party/curl/tests/data/test1955 b/third-party/curl/tests/data/test1955
index d532b006d7..82349c2539 100644
--- a/third-party/curl/tests/data/test1955
+++ b/third-party/curl/tests/data/test1955
@@ -1,8 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 CURLOPT_AWS_SIGV4
+aws-sigv4
 </keywords>
 </info>
 
@@ -32,15 +34,13 @@ Content-Length: 0
 <server>
 http
 </server>
-# this relies on the debug feature which allow to set the time
+# this relies on the Debug feature which allows tests to set the time
 <features>
 SSL
-debug
+Debug
 crypto
+aws
 </features>
-<setenv>
-CURL_FORCEHOST=1
-</setenv>
 
 <name>
 HTTP AWS_SIGV4 without X-Xxx-Content-Sha256
@@ -57,18 +57,17 @@ http://exam.ple.com:9000/aws_sigv4/testapi/test exam.ple.com:9000:%HOSTIP:%HTTPP
 # Verify data after the test has been "shot"
 <verify>
 <strip>
-^User-Agent:.*
 ^Content-Type:.*
 ^Accept:.*
 </strip>
-<protocol>
+<protocol crlf="yes">
 GET /aws_sigv4/testapi/test HTTP/1.1
 Host: exam.ple.com:9000
 Authorization: XXX4-HMAC-SHA256 Credential=xxx/19700101/ple/exam/xxx4_request, SignedHeaders=content-type;host;tesmixcase;test2;test3;test_space;x-xxx-date, Signature=dd39202e9fb7b836ebf2abb83b114cae11ff3b6a169f0c64b290a774a873db9d
 X-Xxx-Date: 19700101T000000Z
 test3: 1234
 test2:
-test_space: t	s  m	   end    
+test_space: t%TABs  m%TAB   end%repeat[4 x  ]%
 tesMixCase: MixCase
 
 </protocol>
diff --git a/third-party/curl/tests/data/test1956 b/third-party/curl/tests/data/test1956
index f7515bb5b4..f3ad8b859a 100644
--- a/third-party/curl/tests/data/test1956
+++ b/third-party/curl/tests/data/test1956
@@ -1,8 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 CURLOPT_AWS_SIGV4
+aws-sigv4
 </keywords>
 </info>
 
@@ -32,15 +34,13 @@ Content-Length: 0
 <server>
 http
 </server>
-# this relies on the debug feature which allow to set the time
+# this relies on the Debug feature which allows tests to set the time
 <features>
 SSL
-debug
+Debug
 crypto
+aws
 </features>
-<setenv>
-CURL_FORCEHOST=1
-</setenv>
 
 <name>
 HTTP AWS_SIGV4 with X-Xxx-Content-Sha256 of empty payload
@@ -57,11 +57,10 @@ http://exam.ple.com:9000/aws_sigv4/testapi/test exam.ple.com:9000:%HOSTIP:%HTTPP
 # Verify data after the test has been "shot"
 <verify>
 <strip>
-^User-Agent:.*
 ^Content-Type:.*
 ^Accept:.*
 </strip>
-<protocol>
+<protocol crlf="headers">
 GET /aws_sigv4/testapi/test HTTP/1.1
 Host: exam.ple.com:9000
 Authorization: XXX4-HMAC-SHA256 Credential=xxx/19700101/ple/exam/xxx4_request, SignedHeaders=content-type;host;x-xxx-content-sha256;x-xxx-date, Signature=dfe78c8846a9b7d65d1eb4c1d6ea7bc886650d03f3568088cb8d5b4c3778287f
diff --git a/third-party/curl/tests/data/test1957 b/third-party/curl/tests/data/test1957
index aa2bf96bf3..77b48b2388 100644
--- a/third-party/curl/tests/data/test1957
+++ b/third-party/curl/tests/data/test1957
@@ -1,8 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 CURLOPT_AWS_SIGV4
+aws-sigv4
 </keywords>
 </info>
 
@@ -32,15 +34,13 @@ Content-Length: 0
 <server>
 http
 </server>
-# this relies on the debug feature which allow to set the time
+# this relies on the Debug feature which allows tests to set the time
 <features>
 SSL
-debug
+Debug
 crypto
+aws
 </features>
-<setenv>
-CURL_FORCEHOST=1
-</setenv>
 
 <name>
 HTTP AWS_SIGV4 with X-Xxx-Content-Sha256 of arbitrary payload
@@ -57,11 +57,10 @@ http://exam.ple.com:9000/aws_sigv4/testapi/test exam.ple.com:9000:%HOSTIP:%HTTPP
 # Verify data after the test has been "shot"
 <verify>
 <strip>
-^User-Agent:.*
 ^Content-Type:.*
 ^Accept:.*
 </strip>
-<protocol>
+<protocol crlf="headers">
 GET /aws_sigv4/testapi/test HTTP/1.1
 Host: exam.ple.com:9000
 Authorization: XXX4-HMAC-SHA256 Credential=xxx/19700101/ple/exam/xxx4_request, SignedHeaders=content-type;host;x-xxx-content-sha256;x-xxx-date, Signature=25b4cac711ea8f65010c485d3778885f5f3870d0b8ff0b3ab58a8d7eeab991ff
diff --git a/third-party/curl/tests/data/test1958 b/third-party/curl/tests/data/test1958
index a7a3a35c6c..672adfec1f 100644
--- a/third-party/curl/tests/data/test1958
+++ b/third-party/curl/tests/data/test1958
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -32,18 +33,16 @@ Content-Length: 0
 <server>
 http
 </server>
-# this relies on the debug feature which allow to set the time
+# this relies on the Debug feature which allows tests to set the time
 <features>
 SSL
-debug
+Debug
 crypto
+aws
 </features>
-<setenv>
-CURL_FORCEHOST=1
-</setenv>
 
 <name>
-HTTP AWS_SIGV4 with X-Xxx-Content-Sha256 of arbitrary payload with whitespace
+HTTP AWS_SIGV4 with X-Xxx-Content-Sha256 with whitespace
 </name>
 <tool>
 lib%TESTNUMBER
@@ -57,16 +56,15 @@ http://exam.ple.com:9000/aws_sigv4/testapi/test exam.ple.com:9000:%HOSTIP:%HTTPP
 # Verify data after the test has been "shot"
 <verify>
 <strip>
-^User-Agent:.*
 ^Content-Type:.*
 ^Accept:.*
 </strip>
-<protocol>
+<protocol crlf="headers">
 GET /aws_sigv4/testapi/test HTTP/1.1
 Host: exam.ple.com:9000
 Authorization: XXX4-HMAC-SHA256 Credential=xxx/19700101/ple/exam/xxx4_request, SignedHeaders=content-type;host;x-xxx-content-sha256;x-xxx-date, Signature=25b4cac711ea8f65010c485d3778885f5f3870d0b8ff0b3ab58a8d7eeab991ff
 X-Xxx-Date: 19700101T000000Z
-X-Xxx-Content-Sha256: 	arbitrary 
+X-Xxx-Content-Sha256: %TABarbitrary%SP
 
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test1959 b/third-party/curl/tests/data/test1959
index 164dbe052e..27a778c305 100644
--- a/third-party/curl/tests/data/test1959
+++ b/third-party/curl/tests/data/test1959
@@ -1,8 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 CURLOPT_AWS_SIGV4
+aws-sigv4
 </keywords>
 </info>
 
@@ -32,15 +34,13 @@ Content-Length: 0
 <server>
 http
 </server>
-# this relies on the debug feature which allow to set the time
+# this relies on the Debug feature which allows tests to set the time
 <features>
 SSL
-debug
+Debug
 crypto
+aws
 </features>
-<setenv>
-CURL_FORCEHOST=1
-</setenv>
 
 <name>
 HTTP AWS_SIGV4 with long value for X-Xxx-Content-Sha256
@@ -57,11 +57,10 @@ http://exam.ple.com:9000/aws_sigv4/testapi/test exam.ple.com:9000:%HOSTIP:%HTTPP
 # Verify data after the test has been "shot"
 <verify>
 <strip>
-^User-Agent:.*
 ^Content-Type:.*
 ^Accept:.*
 </strip>
-<protocol>
+<protocol crlf="headers">
 GET /aws_sigv4/testapi/test HTTP/1.1
 Host: exam.ple.com:9000
 Authorization: XXX4-HMAC-SHA256 Credential=xxx/19700101/ple/exam/xxx4_request, SignedHeaders=content-type;host;x-xxx-content-sha256;x-xxx-date, Signature=7b343a4aa55d73ffc05005d84480bc705a3367373ed8cae1a1c0fbd2b3aa0483
diff --git a/third-party/curl/tests/data/test196 b/third-party/curl/tests/data/test196
index 8bed1b4629..a30f012246 100644
--- a/third-party/curl/tests/data/test196
+++ b/third-party/curl/tests/data/test196
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -18,11 +19,11 @@ REPLY PASS 430 temporarily not available
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP transient error, retry request once
- </name>
- <command>
-ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --retry 1
+</name>
+<command>
+ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --retry 1 -w '%{num_retries}\n'
 </command>
 </client>
 
@@ -32,11 +33,14 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --retry 1
 <errorcode>
 67
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 USER anonymous
 PASS ftp@example.com
 </protocol>
+<stdout>
+1
+</stdout>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1960 b/third-party/curl/tests/data/test1960
index 1ab180c525..d8d8fd6671 100644
--- a/third-party/curl/tests/data/test1960
+++ b/third-party/curl/tests/data/test1960
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ CURL_SOCKOPT_ALREADY_CONNECTED
 
 # Server-side
 <reply>
-<data crlf="yes">
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Thu, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -22,7 +23,7 @@ Content-Length: 0
 # Client-side
 <client>
 <precheck>
-./libtest/lib%TESTNUMBER check
+%LIBTESTS lib%TESTNUMBER check
 </precheck>
 <server>
 http
@@ -42,7 +43,7 @@ http://%HOSTIP:%HTTPPORT/file %HOSTIP %HTTPPORT
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol crlf="yes">
+<protocol crlf="headers">
 GET /file HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test1964 b/third-party/curl/tests/data/test1964
index 76d6065556..fc636308fb 100644
--- a/third-party/curl/tests/data/test1964
+++ b/third-party/curl/tests/data/test1964
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -32,14 +33,15 @@ Content-Length: 0
 <server>
 http
 </server>
-# this relies on the debug feature which allow to set the time
+# this relies on the Debug feature which allows tests to set the time
 <features>
 SSL
 crypto
+aws
 </features>
 
 <name>
-HTTP AWS_SIGV4 with one provider and auth cred via URL, but X-Xxx-Date header set manually
+HTTP AWS_SIGV4 with X-Xxx-Date header set manually
 </name>
 <tool>
 lib%TESTNUMBER
@@ -53,11 +55,10 @@ http://xxx:yyy@127.0.0.1:9000/%TESTNUMBER/testapi/test 127.0.0.1:9000:%HOSTIP:%H
 # Verify data after the test has been "shot"
 <verify>
 <strip>
-^User-Agent:.*
 ^Content-Type:.*
 ^Accept:.*
 </strip>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER/testapi/test HTTP/1.1
 Host: 127.0.0.1:9000
 Authorization: XXX4-HMAC-SHA256 Credential=xxx/19700101/0/127/xxx4_request, SignedHeaders=content-type;host;x-xxx-date, Signature=35da102c1df68f2ef85ade08ecc212fa663a66e3a973146f6578a5c5426e9669
diff --git a/third-party/curl/tests/data/test1965 b/third-party/curl/tests/data/test1965
new file mode 100644
index 0000000000..195ce9c5cf
--- /dev/null
+++ b/third-party/curl/tests/data/test1965
@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+urlapi
+curl_url_set
+</keywords>
+</info>
+
+<client>
+<name>
+curl_url_set() different schemes
+</name>
+<tool>
+lib%TESTNUMBER
+</tool>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<stdout mode="text">
+bad! REJECTED
+bad{ REJECTED
+bad/ REJECTED
+bad\ REJECTED
+a! REJECTED
+a+123 ACCEPTED
+http-2 ACCEPTED
+http.1 ACCEPTED
+a+-.123 ACCEPTED
+http-+++2 ACCEPTED
+http.1-- ACCEPTED
++a123 REJECTED
+-http2 REJECTED
+.http1 REJECTED
+ABC2 ACCEPTED
+2CBA REJECTED
+ REJECTED
+a ACCEPTED
+aaaaaaaaaabbbbbbbbbbccccccccccdddddddddd ACCEPTED
+aaaaaaaaaabbbbbbbbbbccccccccccdddddddddde REJECTED
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1966 b/third-party/curl/tests/data/test1966
new file mode 100644
index 0000000000..914a1166e9
--- /dev/null
+++ b/third-party/curl/tests/data/test1966
@@ -0,0 +1,118 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+HTTP Digest auth
+--resolve
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 401 Authorization Required
+Server: Apache/1.3.27 (Darwin) PHP/4.1.2
+WWW-Authenticate: Basic realm="foothis"
+WWW-Authenticate: Digest realm="testrealm", nonce="1053604199"
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 26
+
+This is not the real page
+</data>
+
+# Post-redirect
+<data2 crlf="headers">
+HTTP/1.1 200 OK
+Server: Apache/1.3.27 (Darwin) PHP/4.1.2
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 23
+
+This IS the real page!
+</data2>
+
+# This is supposed to be returned when the server gets a
+# Authorization: Digest line passed-in from the client
+<data1000 crlf="headers">
+HTTP/1.1 301 Redirect
+Server: Apache/1.3.27 (Darwin) PHP/4.1.2
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 3
+Location: http://host.corp.com:%HTTPPORT/%TESTNUMBER0002
+
+go
+</data1000>
+
+<datacheck crlf="headers">
+HTTP/1.1 401 Authorization Required
+Server: Apache/1.3.27 (Darwin) PHP/4.1.2
+WWW-Authenticate: Basic realm="foothis"
+WWW-Authenticate: Digest realm="testrealm", nonce="1053604199"
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 26
+
+HTTP/1.1 301 Redirect
+Server: Apache/1.3.27 (Darwin) PHP/4.1.2
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 3
+Location: http://host.corp.com:%HTTPPORT/%TESTNUMBER0002
+
+HTTP/1.1 200 OK
+Server: Apache/1.3.27 (Darwin) PHP/4.1.2
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 23
+
+This IS the real page!
+</datacheck>
+
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+!SSPI
+crypto
+digest
+</features>
+<name>
+netrc with digest and redirect to other origin
+</name>
+<command>
+--resolve host.evil.com:%HTTPPORT:%HOSTIP --resolve host.corp.com:%HTTPPORT:%HOSTIP --netrc-file %LOGDIR/netrc%TESTNUMBER --digest -L http://host.evil.com:%HTTPPORT/%TESTNUMBER --max-redirs 2
+</command>
+<file name="%LOGDIR/netrc%TESTNUMBER">
+machine host.evil.com
+  login evil_user
+  password evil_pass
+
+machine host.corp.com
+  login corporate_admin
+  password S3cretP@ssw0rd!
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: host.evil.com:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER HTTP/1.1
+Host: host.evil.com:%HTTPPORT
+Authorization: Digest username="evil_user", realm="testrealm", nonce="1053604199", uri="/%TESTNUMBER", response="4ccc7695a6a926b01dcba93a34d2d737"
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER0002 HTTP/1.1
+Host: host.corp.com:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1967 b/third-party/curl/tests/data/test1967
new file mode 100644
index 0000000000..c012a70ba6
--- /dev/null
+++ b/third-party/curl/tests/data/test1967
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+urlapi
+</keywords>
+</info>
+
+<client>
+
+<name>
+curl_url_set() a URL without guessing a scheme
+</name>
+<tool>
+lib%TESTNUMBER
+</tool>
+
+<command>
+http://%HOSTIP:%NOLISTENPORT/not-there/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<stdout mode="text">
+URL http://a.b/x
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test197 b/third-party/curl/tests/data/test197
index 92ccb8b6ce..91da68ad21 100644
--- a/third-party/curl/tests/data/test197
+++ b/third-party/curl/tests/data/test197
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 retry
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -27,24 +27,22 @@ ok
 
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET --retry on 503 error with output to stdout
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --retry 1000
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1970 b/third-party/curl/tests/data/test1970
index e8891f99e3..8dae28c753 100644
--- a/third-party/curl/tests/data/test1970
+++ b/third-party/curl/tests/data/test1970
@@ -1,8 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 CURLOPT_AWS_SIGV4
+aws-sigv4
 </keywords>
 </info>
 
@@ -32,15 +34,13 @@ Content-Length: 0
 <server>
 http
 </server>
-# this relies on the debug feature which allow to set the time
+# this relies on the Debug feature which allows tests to set the time
 <features>
 SSL
-debug
+Debug
 crypto
+aws
 </features>
-<setenv>
-CURL_FORCEHOST=1
-</setenv>
 
 <name>
 HTTP AWS_SIGV4 for AWS S3: UPLOAD with INFILESIZE=0
@@ -57,11 +57,10 @@ http://exam.ple.com:9000/aws_sigv4/testapi/test exam.ple.com:9000:%HOSTIP:%HTTPP
 # Verify data after the test has been "shot"
 <verify>
 <strip>
-^User-Agent:.*
 ^Content-Type:.*
 ^Accept:.*
 </strip>
-<protocol>
+<protocol crlf="headers">
 PUT /aws_sigv4/testapi/test HTTP/1.1
 Host: exam.ple.com:9000
 Authorization: AWS4-HMAC-SHA256 Credential=xxx/19700101/us-east-1/s3/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=a028756f42a859122e9609c1f90cae4b272d6b03bf60d9fd354138176dfa2260
diff --git a/third-party/curl/tests/data/test1971 b/third-party/curl/tests/data/test1971
index 22133c6c5b..c303018c72 100644
--- a/third-party/curl/tests/data/test1971
+++ b/third-party/curl/tests/data/test1971
@@ -1,8 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 CURLOPT_AWS_SIGV4
+aws-sigv4
 </keywords>
 </info>
 
@@ -25,15 +27,13 @@ Content-Length: 0
 <server>
 http
 </server>
-# this relies on the debug feature which allow to set the time
+# this relies on the Debug feature which allows tests to set the time
 <features>
 SSL
-debug
+Debug
 crypto
+aws
 </features>
-<setenv>
-CURL_FORCEHOST=1
-</setenv>
 
 <name>
 HTTP AWS_SIGV4 for AWS S3: UPLOAD with unknown INFILESIZE
@@ -50,11 +50,10 @@ http://exam.ple.com:9000/aws_sigv4/testapi/test exam.ple.com:9000:%HOSTIP:%HTTPP
 # Verify data after the test has been "shot"
 <verify>
 <strip>
-^User-Agent:.*
 ^Content-Type:.*
 ^Accept:.*
 </strip>
-<protocol>
+<protocol crlf="yes">
 PUT /aws_sigv4/testapi/test HTTP/1.1
 Host: exam.ple.com:9000
 Authorization: AWS4-HMAC-SHA256 Credential=xxx/19700101/us-east-1/s3/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=4a6e9b4af0542ffb83744c6852f8e1bfec14f2a67e6f6f037b39f172f79d62af
diff --git a/third-party/curl/tests/data/test1972 b/third-party/curl/tests/data/test1972
index 8b739330b3..d128dccf45 100644
--- a/third-party/curl/tests/data/test1972
+++ b/third-party/curl/tests/data/test1972
@@ -1,8 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 CURLOPT_AWS_SIGV4
+aws-sigv4
 </keywords>
 </info>
 
@@ -32,14 +34,15 @@ Content-Length: 0
 <server>
 http
 </server>
-# this relies on the debug feature which allow to set the time
+# this relies on the Debug feature which allows tests to set the time
 <features>
 SSL
-debug
+Debug
 crypto
+aws
 </features>
 <setenv>
-CURL_FORCEHOST=1
+CURL_ENTROPY=12345678
 </setenv>
 
 <name>
@@ -57,23 +60,22 @@ http://exam.ple.com:9000/aws_sigv4/testapi/test exam.ple.com:9000:%HOSTIP:%HTTPP
 # Verify data after the test has been "shot"
 <verify>
 <strip>
-^User-Agent:.*
 ^Content-Type:.*
 ^Accept:.*
 </strip>
-<protocol>
+<protocol crlf="yes">
 POST /aws_sigv4/testapi/test HTTP/1.1
 Host: exam.ple.com:9000
 Authorization: AWS4-HMAC-SHA256 Credential=xxx/19700101/us-east-1/s3/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=eaee0f1c5984ad5d81c8bc7805f28c7b83b35322de654b2ace18cb8cf6d5a9cb
 X-Amz-Date: 19700101T000000Z
 x-amz-content-sha256: UNSIGNED-PAYLOAD
-Content-Length: 142
+Content-Length: 154
 
---------------------------3433323135333231
+--------------------------qrstuvwxyz0123456789AB
 Content-Disposition: attachment; name="foo"
 
 bar
---------------------------3433323135333231--
+--------------------------qrstuvwxyz0123456789AB--
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test1973 b/third-party/curl/tests/data/test1973
index 7773727890..c2527df686 100644
--- a/third-party/curl/tests/data/test1973
+++ b/third-party/curl/tests/data/test1973
@@ -1,8 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 CURLOPT_AWS_SIGV4
+aws-sigv4
 </keywords>
 </info>
 
@@ -32,15 +34,13 @@ Content-Length: 0
 <server>
 http
 </server>
-# this relies on the debug feature which allow to set the time
+# this relies on the Debug feature which allows tests to set the time
 <features>
 SSL
-debug
+Debug
 crypto
+aws
 </features>
-<setenv>
-CURL_FORCEHOST=1
-</setenv>
 
 <name>
 HTTP AWS_SIGV4 for AWS S3: POSTFIELDS
@@ -57,11 +57,10 @@ http://exam.ple.com:9000/aws_sigv4/testapi/test exam.ple.com:9000:%HOSTIP:%HTTPP
 # Verify data after the test has been "shot"
 <verify>
 <strip>
-^User-Agent:.*
 ^Content-Type:.*
 ^Accept:.*
 </strip>
-<protocol>
+<protocol crlf="headers">
 POST /aws_sigv4/testapi/test HTTP/1.1
 Host: exam.ple.com:9000
 Authorization: AWS4-HMAC-SHA256 Credential=xxx/19700101/us-east-1/s3/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=7eb34202214384872221b99a9c671b7517891ac6af56b0aff24ec51adf62b10a
diff --git a/third-party/curl/tests/data/test1974 b/third-party/curl/tests/data/test1974
index a8a3449190..20a10a8705 100644
--- a/third-party/curl/tests/data/test1974
+++ b/third-party/curl/tests/data/test1974
@@ -1,8 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 CURLOPT_AWS_SIGV4
+aws-sigv4
 </keywords>
 </info>
 
@@ -32,15 +34,13 @@ Content-Length: 0
 <server>
 http
 </server>
-# this relies on the debug feature which allow to set the time
+# this relies on the Debug feature which allows tests to set the time
 <features>
 SSL
-debug
+Debug
 crypto
+aws
 </features>
-<setenv>
-CURL_FORCEHOST=1
-</setenv>
 
 <name>
 HTTP AWS_SIGV4 for AWS S3: GET
@@ -57,11 +57,10 @@ http://exam.ple.com:9000/aws_sigv4/testapi/test exam.ple.com:9000:%HOSTIP:%HTTPP
 # Verify data after the test has been "shot"
 <verify>
 <strip>
-^User-Agent:.*
 ^Content-Type:.*
 ^Accept:.*
 </strip>
-<protocol>
+<protocol crlf="headers">
 GET /aws_sigv4/testapi/test HTTP/1.1
 Host: exam.ple.com:9000
 Authorization: AWS4-HMAC-SHA256 Credential=xxx/19700101/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=e6270423932feafe9b00ca5d60c9ed566be649f9ca9676144288273945153021
diff --git a/third-party/curl/tests/data/test1975 b/third-party/curl/tests/data/test1975
index c584eb6319..e5d6272eda 100644
--- a/third-party/curl/tests/data/test1975
+++ b/third-party/curl/tests/data/test1975
@@ -1,8 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 CURLOPT_AWS_SIGV4
+aws-sigv4
 </keywords>
 </info>
 
@@ -25,15 +27,13 @@ Content-Length: 0
 <server>
 http
 </server>
-# this relies on the debug feature which allow to set the time
+# this relies on the Debug feature which allows tests to set the time
 <features>
 SSL
-debug
+Debug
 crypto
+aws
 </features>
-<setenv>
-CURL_FORCEHOST=1
-</setenv>
 
 <name>
 HTTP AWS_SIGV4 for AWS S3: UPLOAD with given x-amz-content-sha256
@@ -50,11 +50,10 @@ http://exam.ple.com:9000/aws_sigv4/testapi/test exam.ple.com:9000:%HOSTIP:%HTTPP
 # Verify data after the test has been "shot"
 <verify>
 <strip>
-^User-Agent:.*
 ^Content-Type:.*
 ^Accept:.*
 </strip>
-<protocol>
+<protocol crlf="yes">
 PUT /aws_sigv4/testapi/test HTTP/1.1
 Host: exam.ple.com:9000
 Authorization: AWS4-HMAC-SHA256 Credential=xxx/19700101/us-east-1/s3/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=a028756f42a859122e9609c1f90cae4b272d6b03bf60d9fd354138176dfa2260
diff --git a/third-party/curl/tests/data/test1976 b/third-party/curl/tests/data/test1976
new file mode 100644
index 0000000000..3a09cc2ca3
--- /dev/null
+++ b/third-party/curl/tests/data/test1976
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+CURLOPT_AWS_SIGV4
+aws-sigv4
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 0
+
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+SSL
+Debug
+crypto
+aws
+</features>
+<name>
+HTTP AWS_SIGV4 canonical request header sorting test
+</name>
+<command>
+-X PUT -H "X-Amz-Meta-Test-Two: test2" -H "x-amz-meta-test: test" --aws-sigv4 "aws:amz:us-east-1:s3" -u "xxx:yyy" http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<strip>
+^Content-Length:.*
+^Accept:.*
+</strip>
+<strippart>
+# Strip the actual signature. We only care about header order in this test
+s/Signature=[a-f0-9]{64}/Signature=stripped/
+</strippart>
+<protocol crlf="headers">
+PUT /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Authorization: AWS4-HMAC-SHA256 Credential=xxx/19700101/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-meta-test;x-amz-meta-test-two, Signature=stripped
+X-Amz-Date: 19700101T000000Z
+x-amz-content-sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
+User-Agent: curl/%VERSION
+X-Amz-Meta-Test-Two: test2
+x-amz-meta-test: test
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1977 b/third-party/curl/tests/data/test1977
new file mode 100644
index 0000000000..bcd6ed31d4
--- /dev/null
+++ b/third-party/curl/tests/data/test1977
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+CURLOPT_CURLU
+CURLINFO_EFFECTIVE_URL
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Type: text/html
+Funny-head: yesyes swsclose
+
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+CURLOPT_CURLU and CURLINFO_EFFECTIVE_URL
+</name>
+<tool>
+lib%TESTNUMBER
+</tool>
+
+# The test does three transfers to check how CURLINFO_EFFECTIVE_URL is reported
+# when CURLOPT_CURLU changes between transfers. (Bug #15984)
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<stdout>
+effective URL: http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+effective URL: http://%HOSTIP:%HTTPPORT/%TESTNUMBER?foo
+effective URL: http://%HOSTIP:%HTTPPORT/%TESTNUMBER?foo%AMPbar
+</stdout>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+GET /%TESTNUMBER?foo HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+GET /%TESTNUMBER?foo%AMPbar HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1978 b/third-party/curl/tests/data/test1978
new file mode 100644
index 0000000000..b2a4285b96
--- /dev/null
+++ b/third-party/curl/tests/data/test1978
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+CURLOPT_AWS_SIGV4
+aws-sigv4
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 0
+
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+SSL
+Debug
+crypto
+aws
+</features>
+<name>
+HTTP AWS_SIGV4 canonical request duplicate header test
+</name>
+<tool>
+lib%TESTNUMBER
+</tool>
+<command>
+http://xxx:yyy@127.0.0.1:9000/%TESTNUMBER/testapi/test 127.0.0.1:9000:%HOSTIP:%HTTPPORT
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<strip>
+^Content-Length:.*
+^Accept:.*
+</strip>
+<protocol crlf="yes">
+PUT /%TESTNUMBER/testapi/test HTTP/1.1
+Host: 127.0.0.1:9000
+Authorization: AWS4-HMAC-SHA256 Credential=xxx/19700101/us-east-1/s3/aws4_request, SignedHeaders=curr-header-no-colon;duplicate-header;header-no-value;header-some-no-value;host;next-header-no-colon;some-other-header;x-amz-content-sha256;x-amz-date;x-amz-meta-blah;x-amz-meta-test;x-amz-meta-test2, Signature=b1e2ac88fd1307f0b9031140c3c99cc20d6263f3fe64b132dc433c95fe2c6316
+X-Amz-Date: 19700101T000000Z
+x-amz-content-sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
+x-amz-meta-test: test2
+some-other-header: value
+x-amz-meta-test: test1
+duplicate-header: duplicate
+x-amz-meta-test: test3
+X-amz-meta-test2: test2
+x-amz-meta-blah: blah
+x-Amz-meta-test2: test1
+x-amz-Meta-test2: test3
+curr-header-no-colon: value
+next-header-no-colon: value
+duplicate-header: duplicate
+header-no-value:
+header-no-value:
+header-some-no-value:
+header-some-no-value: value
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1979 b/third-party/curl/tests/data/test1979
new file mode 100644
index 0000000000..f489f58996
--- /dev/null
+++ b/third-party/curl/tests/data/test1979
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+canon_string
+aws-sigv4
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+sigv4 canon_string unit tests
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test198 b/third-party/curl/tests/data/test198
index e13be4cbec..84c74f3b11 100644
--- a/third-party/curl/tests/data/test198
+++ b/third-party/curl/tests/data/test198
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 retry
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -36,24 +36,22 @@ ok
 
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET --retry on 503 error with output to file
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --retry 1000
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test1980 b/third-party/curl/tests/data/test1980
new file mode 100644
index 0000000000..eab9cd662c
--- /dev/null
+++ b/third-party/curl/tests/data/test1980
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+canon_query
+aws-sigv4
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+sigv4 canon_query unit tests
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test1981 b/third-party/curl/tests/data/test1981
new file mode 100644
index 0000000000..e1fb24bf35
--- /dev/null
+++ b/third-party/curl/tests/data/test1981
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+%time output with --write-out
+</name>
+<features>
+Debug
+</features>
+<setenv>
+CURL_TIME=1754037103
+LC_TIME=C
+</setenv>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --write-out='Time: %time{%d/%b/%Y %H:%M:%S.%f %z %Z%%s %s}\n' -s -o %LOGDIR/dump
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<stdout mode="text">
+Time: 01/Aug/2025 08:31:43.037103 +0000 UTC%s 1754037103
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1982 b/third-party/curl/tests/data/test1982
new file mode 100644
index 0000000000..8b6e38bf60
--- /dev/null
+++ b/third-party/curl/tests/data/test1982
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IMAP
+Clear Text
+FETCH
+connection reuse
+options
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<servercmd>
+REPLY "LOGIN user.one secret" A002 OK LOGIN completed
+</servercmd>
+<data crlf="yes">
+From: me@somewhere
+To: fake@nowhere
+
+body
+
+--
+  yours sincerely
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+imap
+</server>
+<name>
+IMAP two requests, change options for the second
+</name>
+<command>
+'imap://user.one:secret@%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' 'imap://user.one:secret;AUTH=XOAUTH2@%HOSTIP:%IMAPPORT/%TESTNUMBER/;UID=2'
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+A001 CAPABILITY
+A002 LOGIN user.one secret
+A003 SELECT %TESTNUMBER
+A004 FETCH 1 BODY[]
+A005 UID FETCH 2 BODY[]
+A006 LOGOUT
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1983 b/third-party/curl/tests/data/test1983
new file mode 100644
index 0000000000..66e0de4e09
--- /dev/null
+++ b/third-party/curl/tests/data/test1983
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+
+<info>
+<keywords>
+HTTP
+HTTP DELETE
+followlocation
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+HTTP/1.1 303 OK swsclose
+Location: moo.html%AMPtestcase=/%TESTNUMBER0002
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Connection: close
+
+</data>
+<data2>
+HTTP/1.1 200 OK swsclose
+Location: this should be ignored
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Connection: close
+
+body
+</data2>
+<datacheck>
+HTTP/1.1 303 OK swsclose
+Location: moo.html%AMPtestcase=/%TESTNUMBER0002
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Connection: close
+
+HTTP/1.1 200 OK swsclose
+Location: this should be ignored
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Connection: close
+
+body
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP DELETE with --follow and 303 redirect
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/blah/%TESTNUMBER --follow -X DELETE
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+DELETE /blah/%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /blah/moo.html%AMPtestcase=/%TESTNUMBER0002 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test1984 b/third-party/curl/tests/data/test1984
new file mode 100644
index 0000000000..1513eb64f5
--- /dev/null
+++ b/third-party/curl/tests/data/test1984
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+
+<info>
+<keywords>
+HTTP
+HTTP PUT
+followlocation
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+HTTP/1.1 303 OK swsclose
+Location: moo.html%AMPtestcase=/%TESTNUMBER0002
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Connection: close
+
+</data>
+<data2>
+HTTP/1.1 200 OK swsclose
+Location: this should be ignored
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Connection: close
+
+body
+</data2>
+<datacheck>
+HTTP/1.1 303 OK swsclose
+Location: moo.html%AMPtestcase=/%TESTNUMBER0002
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Connection: close
+
+HTTP/1.1 200 OK swsclose
+Location: this should be ignored
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Connection: close
+
+body
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP PUT with 303 redirect and --follow
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/blah/%TESTNUMBER --follow -T %LOGDIR/upload
+</command>
+<file name="%LOGDIR/upload">
+Except for responses to a HEAD request, the representation of a 303 response ought to contain a short hypertext note with a hyperlink to the same URI reference provided in the Location header field.
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+PUT /blah/%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 199
+
+Except for responses to a HEAD request, the representation of a 303 response ought to contain a short hypertext note with a hyperlink to the same URI reference provided in the Location header field.
+GET /blah/moo.html%AMPtestcase=/%TESTNUMBER0002 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test199 b/third-party/curl/tests/data/test199
index 94f37dc9b5..150c2e77a8 100644
--- a/third-party/curl/tests/data/test199
+++ b/third-party/curl/tests/data/test199
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 globbing
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -25,30 +25,28 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with -d, -G and {}
- </name>
- <command>
--d "foo=moo&moo=poo" "http://%HOSTIP:%HTTPPORT/{%TESTNUMBER,%TESTNUMBER}" -G
+</name>
+<command>
+-d "foo=moo%AMPmoo=poo" "http://%HOSTIP:%HTTPPORT/{%TESTNUMBER,%TESTNUMBER}" -G
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-GET /%TESTNUMBER?foo=moo&moo=poo HTTP/1.1
+<protocol crlf="headers">
+GET /%TESTNUMBER?foo=moo%AMPmoo=poo HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
-GET /%TESTNUMBER?foo=moo&moo=poo HTTP/1.1
+GET /%TESTNUMBER?foo=moo%AMPmoo=poo HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test2 b/third-party/curl/tests/data/test2
index b8abd99999..c29b2646d4 100644
--- a/third-party/curl/tests/data/test2
+++ b/third-party/curl/tests/data/test2
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,11 +7,10 @@ HTTP GET
 HTTP Basic auth
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
-HTTP/1.1 200 OK
+<data crlf="headers">
+HTTP/1.1 200
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
 Content-Type: text/html
@@ -19,27 +19,25 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with user and password
- </name>
- <command>
- -u fake:user http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</name>
+<command>
+-u fake:user http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic ZmFrZTp1c2Vy
+Authorization: Basic %b64[fake:user]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test20 b/third-party/curl/tests/data/test20
index 910cb54c20..5dfe22dcd7 100644
--- a/third-party/curl/tests/data/test20
+++ b/third-party/curl/tests/data/test20
@@ -1,30 +1,25 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
-FAILURE
 non-existing host
 </keywords>
 </info>
 
 # Server-side
 <reply>
-<data>
-</data>
 </reply>
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 http
 </features>
- <name>
-attempt connect to non-existing host name
- </name>
- <command>
+<name>
+attempt connect to non-existing hostname
+</name>
+<command>
 --ipv4 non-existing-host.haxx.se.
 </command>
 </client>
diff --git a/third-party/curl/tests/data/test200 b/third-party/curl/tests/data/test200
index 7ce2cbcfea..fbc0380dfd 100644
--- a/third-party/curl/tests/data/test200
+++ b/third-party/curl/tests/data/test200
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -20,9 +21,9 @@ moo
 <server>
 file
 </server>
- <name>
+<name>
 basic file:// file
- </name>
+</name>
 <command option="no-include">
 file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt
 </command>
diff --git a/third-party/curl/tests/data/test2000 b/third-party/curl/tests/data/test2000
index 8b55aade1e..6e299b6446 100644
--- a/third-party/curl/tests/data/test2000
+++ b/third-party/curl/tests/data/test2000
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ multiprotocol
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -21,16 +21,15 @@ works
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 file
 </server>
- <name>
+<name>
 FTP RETR followed by FILE
- </name>
+</name>
 <command option="no-include">
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt
 </command>
@@ -43,10 +42,9 @@ moo
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test2001 b/third-party/curl/tests/data/test2001
index 8723d448d8..2905e11218 100644
--- a/third-party/curl/tests/data/test2001
+++ b/third-party/curl/tests/data/test2001
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,10 +11,9 @@ multiprotocol
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data1 nocheck="yes">
+<data1 crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -37,7 +37,6 @@ works
 </data2>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -45,9 +44,9 @@ http
 ftp
 file
 </server>
- <name>
+<name>
 HTTP GET followed by FTP RETR followed by FILE
- </name>
+</name>
 <command option="no-include">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER0002 file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt
 </command>
@@ -60,10 +59,9 @@ moo
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 GET /%TESTNUMBER0001 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2002 b/third-party/curl/tests/data/test2002
index aec7c2574f..31d9890963 100644
--- a/third-party/curl/tests/data/test2002
+++ b/third-party/curl/tests/data/test2002
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,10 +13,9 @@ multiprotocol
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data1 nocheck="yes">
+<data1 crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -45,7 +45,6 @@ returned
 </data3>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -54,9 +53,9 @@ ftp
 file
 tftp
 </server>
- <name>
+<name>
 HTTP GET followed by FTP RETR followed by FILE followed by TFTP RRQ
- </name>
+</name>
 <command option="no-include">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER0002 file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER0003
 </command>
@@ -69,31 +68,30 @@ moo
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strip>
 ^timeout = [5-6]$
 </strip>
 <protocol>
-GET /%TESTNUMBER0001 HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-
-USER anonymous
-PASS ftp@example.com
-PWD
-EPSV
-TYPE I
-SIZE %TESTNUMBER0002
-RETR %TESTNUMBER0002
+GET /%TESTNUMBER0001 HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+%CR
+USER anonymous%CR
+PASS ftp@example.com%CR
+PWD%CR
+EPSV%CR
+TYPE I%CR
+SIZE %TESTNUMBER0002%CR
+RETR %TESTNUMBER0002%CR
 opcode = 1
 mode = octet
 tsize = 0
 blksize = 512
 filename = /%TESTNUMBER0003
-QUIT
+QUIT%CR
 </protocol>
 <stdout>
 -foo-
diff --git a/third-party/curl/tests/data/test2003 b/third-party/curl/tests/data/test2003
index e88ba579fb..c422fc2cfe 100644
--- a/third-party/curl/tests/data/test2003
+++ b/third-party/curl/tests/data/test2003
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,10 +13,9 @@ multiprotocol
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data1 nocheck="yes">
+<data1 crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -45,7 +45,6 @@ returned
 </data3>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -54,11 +53,18 @@ ftp
 file
 tftp
 </server>
- <name>
-HTTP GET followed by FTP RETR followed by FILE followed by TFTP RRQ then again in reverse order
- </name>
+<name>
+HTTP GET, FTP RETR, FILE, TFTP RRQ then again in rev order
+</name>
 <command option="no-include">
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER0002 file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER0003 tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER0003 file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt ftp://%HOSTIP:%FTPPORT/%TESTNUMBER0002 http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001
+ftp://%HOSTIP:%FTPPORT/%TESTNUMBER0002
+file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt
+tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER0003
+tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER0003
+file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt
+ftp://%HOSTIP:%FTPPORT/%TESTNUMBER0002
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 foo
@@ -69,25 +75,24 @@ moo
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strip>
 ^timeout = [5-6]$
 </strip>
 <protocol>
-GET /%TESTNUMBER0001 HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-
-USER anonymous
-PASS ftp@example.com
-PWD
-EPSV
-TYPE I
-SIZE %TESTNUMBER0002
-RETR %TESTNUMBER0002
+GET /%TESTNUMBER0001 HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+%CR
+USER anonymous%CR
+PASS ftp@example.com%CR
+PWD%CR
+EPSV%CR
+TYPE I%CR
+SIZE %TESTNUMBER0002%CR
+RETR %TESTNUMBER0002%CR
 opcode = 1
 mode = octet
 tsize = 0
@@ -98,15 +103,15 @@ mode = octet
 tsize = 0
 blksize = 512
 filename = /%TESTNUMBER0003
-EPSV
-SIZE %TESTNUMBER0002
-RETR %TESTNUMBER0002
-GET /%TESTNUMBER0001 HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-
-QUIT
+EPSV%CR
+SIZE %TESTNUMBER0002%CR
+RETR %TESTNUMBER0002%CR
+GET /%TESTNUMBER0001 HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+%CR
+QUIT%CR
 </protocol>
 <stdout>
 -foo-
diff --git a/third-party/curl/tests/data/test2004 b/third-party/curl/tests/data/test2004
index 80463569c6..2306a3ed23 100644
--- a/third-party/curl/tests/data/test2004
+++ b/third-party/curl/tests/data/test2004
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ multiprotocol
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -19,18 +19,24 @@ for tftp test
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 tftp
 sftp
 </server>
- <name>
-TFTP RRQ followed by SFTP retrieval followed by FILE followed by SCP retrieval then again in reverse order
- </name>
+<name>
+TFTP RRQ, SFTP, FILE, SCP retrieval then in rev order
+</name>
 <command option="no-include">
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/test%TESTNUMBER.txt file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt scp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/test%TESTNUMBER.txt file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/test%TESTNUMBER.txt tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER --insecure
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER:
+tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER
+sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/test%TESTNUMBER.txt
+file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt
+scp://%HOSTIP:%SSHPORT%SCP_PWD/%LOGDIR/test%TESTNUMBER.txt
+file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt
+sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/test%TESTNUMBER.txt
+tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER --insecure
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 This is test data
@@ -38,7 +44,6 @@ for several protocols
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strip>
@@ -72,8 +77,5 @@ for several protocols
 Test data file
 for tftp test
 </stdout>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test2005 b/third-party/curl/tests/data/test2005
new file mode 100644
index 0000000000..3fa08d718c
--- /dev/null
+++ b/third-party/curl/tests/data/test2005
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+netrc
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 OK
+Date: Fri, 05 Aug 2022 10:09:00 GMT
+Server: test-server/fake
+Content-Type: text/plain
+Content-Length: 6
+Connection: close
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+netrc match with password only in file, no username. machine follows
+</name>
+<command>
+--netrc-optional --netrc-file %LOGDIR/netrc%TESTNUMBER http://%HOSTIP:%HTTPPORT/
+</command>
+<file name="%LOGDIR/netrc%TESTNUMBER" >
+machine %HOSTIP
+password 5up3r53cr37
+
+machine example.com
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET / HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Authorization: Basic %b64[:5up3r53cr37]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2006 b/third-party/curl/tests/data/test2006
new file mode 100644
index 0000000000..200d30a7ce
--- /dev/null
+++ b/third-party/curl/tests/data/test2006
@@ -0,0 +1,98 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+netrc
+HTTP
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 301 Follow this you fool
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Location: http://b.com/%TESTNUMBER0002
+
+-foo-
+</data>
+
+<data2 crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 7
+Connection: close
+
+target
+</data2>
+
+<datacheck crlf="headers">
+HTTP/1.1 301 Follow this you fool
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Location: http://b.com/%TESTNUMBER0002
+
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 7
+Connection: close
+
+target
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+proxy
+</features>
+<name>
+.netrc default with redirect plus oauth2-bearer
+</name>
+<command>
+--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER --oauth2-bearer SECRET_TOKEN -L -x http://%HOSTIP:%HTTPPORT/ http://a.com/
+</command>
+<file name="%LOGDIR/netrc%TESTNUMBER" >
+default login testuser password testpass
+</file>
+</client>
+
+<verify>
+<protocol crlf="headers">
+GET http://a.com/ HTTP/1.1
+Host: a.com
+Authorization: Bearer SECRET_TOKEN
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://b.com/%TESTNUMBER0002 HTTP/1.1
+Host: b.com
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2007 b/third-party/curl/tests/data/test2007
new file mode 100644
index 0000000000..db82ec3105
--- /dev/null
+++ b/third-party/curl/tests/data/test2007
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+SFTP
+--quote
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<server>
+sftp
+</server>
+<name>
+SFTP quote rmdir command with trailing junk
+</name>
+<command>
+--hostpubmd5 %SSHSRVMD5 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt -Q "mkdir /tmp/test trailing_garbage"
+</command>
+</client>
+
+<verify>
+<errorcode>
+21
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2008 b/third-party/curl/tests/data/test2008
new file mode 100644
index 0000000000..9d1b141833
--- /dev/null
+++ b/third-party/curl/tests/data/test2008
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+-G
+--proto-default
+--resolve
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+proxy
+</features>
+<server>
+http
+</server>
+<name>
+-G with --proto-default=http and scheme-less URL starting with "ftp"
+</name>
+<command>
+ftp.test --proto-default=http --resolve ftp.test:80:%HOSTIP -G -d hello -x http://%HOSTIP:%HTTPPORT/
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://ftp.test/?hello HTTP/1.1
+Host: ftp.test
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2009 b/third-party/curl/tests/data/test2009
new file mode 100644
index 0000000000..d2fd79e0d6
--- /dev/null
+++ b/third-party/curl/tests/data/test2009
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP proxy
+http_proxy
+</keywords>
+</info>
+# Server-side
+<reply>
+<connect>
+HTTP/1.1 407 Denied
+
+</connect>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 301 redirect
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 4
+Content-Type: text/html
+Location: https://another.example/%TESTNUMBER0002
+
+boo
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+proxy
+</features>
+<server>
+http
+https
+</server>
+<name>
+proxy credentials via env variables, redirect from http to https
+</name>
+
+<setenv>
+http_proxy=http://user:secret@%HOSTIP:%HTTPPORT
+https_proxy=https://%HOSTIP:%HTTPSPORT/
+</setenv>
+<command>
+http://somewhere.example/ --follow --proxy-insecure
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://somewhere.example/ HTTP/1.1
+Host: somewhere.example
+Proxy-Authorization: Basic %b64[user:secret]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+CONNECT another.example:443 HTTP/1.1
+Host: another.example:443
+User-Agent: curl/%VERSION
+Proxy-Connection: Keep-Alive
+
+</protocol>
+<errorcode>
+7
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test201 b/third-party/curl/tests/data/test201
index b68abb8c00..ac1593c8e2 100644
--- a/third-party/curl/tests/data/test201
+++ b/third-party/curl/tests/data/test201
@@ -1,8 +1,8 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FILE
-FAILURE
 </keywords>
 </info>
 
@@ -17,11 +17,11 @@ FAILURE
 <server>
 file
 </server>
- <name>
+<name>
 missing file:// file
- </name>
- <command>
-file://localhost/%PWD/%LOGDIR/non-existent-file.txt
+</name>
+<command>
+file://localhost/%FILE_PWD/%LOGDIR/non-existent-file.txt
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test2010 b/third-party/curl/tests/data/test2010
new file mode 100644
index 0000000000..443ae9d2f9
--- /dev/null
+++ b/third-party/curl/tests/data/test2010
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP proxy
+http_proxy
+</keywords>
+</info>
+# Server-side
+<reply>
+<connect>
+HTTP/1.1 407 Denied
+
+</connect>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 301 redirect
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 4
+Content-Type: text/html
+Location: https://another.example/%TESTNUMBER0002
+
+boo
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+proxy
+</features>
+<server>
+http
+https
+</server>
+<name>
+proxy credentials via options for two proxies, redirect from http to https
+</name>
+
+<setenv>
+http_proxy=http://%HOSTIP:%HTTPPORT
+https_proxy=https://%HOSTIP:%HTTPSPORT/
+</setenv>
+<command>
+--proxy-user batman:robin http://somewhere.example/ --follow --proxy-insecure
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://somewhere.example/ HTTP/1.1
+Host: somewhere.example
+Proxy-Authorization: Basic %b64[batman:robin]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+CONNECT another.example:443 HTTP/1.1
+Host: another.example:443
+Proxy-Authorization: Basic %b64[batman:robin]b64%
+User-Agent: curl/%VERSION
+Proxy-Connection: Keep-Alive
+
+</protocol>
+<errorcode>
+7
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2011 b/third-party/curl/tests/data/test2011
new file mode 100644
index 0000000000..dd4e534248
--- /dev/null
+++ b/third-party/curl/tests/data/test2011
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP proxy
+http_proxy
+</keywords>
+</info>
+# Server-side
+<reply>
+<connect>
+HTTP/1.1 407 Denied
+
+</connect>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 301 redirect
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 4
+Content-Type: text/html
+Location: https://another.example/%TESTNUMBER0002
+
+boo
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+proxy
+</features>
+<server>
+http
+https
+</server>
+<name>
+proxy creds via env, cross-scheme redirect, --location-trusted
+</name>
+
+<setenv>
+http_proxy=http://user:secret@%HOSTIP:%HTTPPORT
+https_proxy=https://%HOSTIP:%HTTPSPORT/
+</setenv>
+<command>
+http://somewhere.example/ --location-trusted --proxy-insecure
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://somewhere.example/ HTTP/1.1
+Host: somewhere.example
+Proxy-Authorization: Basic %b64[user:secret]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+CONNECT another.example:443 HTTP/1.1
+Host: another.example:443
+User-Agent: curl/%VERSION
+Proxy-Connection: Keep-Alive
+
+</protocol>
+<errorcode>
+7
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2012 b/third-party/curl/tests/data/test2012
new file mode 100644
index 0000000000..836db03b18
--- /dev/null
+++ b/third-party/curl/tests/data/test2012
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP PUT
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-foo-
+</data>
+<data2 crlf="headers" nocheck="yes">
+HTTP/1.1 200 the second one
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+again
+</data2>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+load URLs from a file, upload with a glob
+</name>
+<command option="no-output">
+-T '%LOGDIR/upload{1,2}' --url @%LOGDIR/urls --silent --output=%LOGDIR/first-out --output=%LOGDIR/second-out
+</command>
+
+<file name="%LOGDIR/upload1">
+first!
+</file>
+
+<file2 name="%LOGDIR/upload2">
+second
+</file2>
+
+<file3 name="%LOGDIR/urls">
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER0002
+</file3>
+
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+PUT /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 7
+
+first!
+PUT /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 7
+
+second
+GET /%TESTNUMBER0002 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<stdout>
+%EMPTY
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2013 b/third-party/curl/tests/data/test2013
new file mode 100644
index 0000000000..2cc36e50ba
--- /dev/null
+++ b/third-party/curl/tests/data/test2013
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP PUT
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-foo-
+</data>
+<data2 crlf="headers" nocheck="yes">
+HTTP/1.1 200 the second one
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+again
+</data2>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+upload with a glob
+</name>
+<command option="no-output">
+-T '%LOGDIR/upload{1,2}' http://%HOSTIP:%HTTPPORT/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER0002 --silent --output=%LOGDIR/first-out --output=%LOGDIR/second-out
+</command>
+
+<file name="%LOGDIR/upload1">
+first!
+</file>
+
+<file2 name="%LOGDIR/upload2">
+second
+</file2>
+
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+PUT /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 7
+
+first!
+PUT /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 7
+
+second
+GET /%TESTNUMBER0002 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<stdout>
+%EMPTY
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2014 b/third-party/curl/tests/data/test2014
new file mode 100644
index 0000000000..a7fb078db6
--- /dev/null
+++ b/third-party/curl/tests/data/test2014
@@ -0,0 +1,97 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP PUT
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK swsbounce
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Accept-Ranges: bytes
+Content-Length: 6
+Content-Type: text/html
+
+-foo-
+</data>
+<data1 crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 20
+Content-Type: text/html
+
+the second response
+</data1>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+upload with glob, output name based on upload glob
+</name>
+<command option="no-output">
+-T '%LOGDIR/upload{%LThej%GT1,2}' http://%HOSTIP:%HTTPPORT/%TESTNUMBER --silent '--output=%LOGDIR/out-#%LThej%GT'
+</command>
+
+<file name="%LOGDIR/upload1">
+first!
+</file>
+
+<file2 name="%LOGDIR/upload2">
+second
+</file2>
+
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+PUT /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 7
+
+first!
+PUT /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 7
+
+second
+</protocol>
+<stdout>
+%EMPTY
+</stdout>
+
+<file name="%LOGDIR/out-1" crlf="headers">
+HTTP/1.1 200 OK swsbounce
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Accept-Ranges: bytes
+Content-Length: 6
+Content-Type: text/html
+
+-foo-
+</file>
+
+<file2 name="%LOGDIR/out-2" crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 20
+Content-Type: text/html
+
+the second response
+</file2>
+
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2015 b/third-party/curl/tests/data/test2015
new file mode 100644
index 0000000000..d0479c5b7b
--- /dev/null
+++ b/third-party/curl/tests/data/test2015
@@ -0,0 +1,92 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP proxy
+followlocation
+cookies
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+HTTP/1.1 302 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Location: http://goto.second.host.now/%TESTNUMBER0002
+Content-Length: 8
+Connection: close
+
+contents
+</data>
+<data2>
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Content-Length: 9
+
+contents
+</data2>
+
+<datacheck>
+HTTP/1.1 302 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Location: http://goto.second.host.now/%TESTNUMBER0002
+Content-Length: 8
+Connection: close
+
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Content-Length: 9
+
+contents
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP with cookie with with -b and redirect to new host
+</name>
+<command>
+http://first.host.it.is/we/want/that/page/%TESTNUMBER -x %HOSTIP:%HTTPPORT -b "test=yes" --location
+</command>
+<features>
+cookies
+proxy
+</features>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://first.host.it.is/we/want/that/page/%TESTNUMBER HTTP/1.1
+Host: first.host.it.is
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+Cookie: test=yes
+
+GET http://goto.second.host.now/%TESTNUMBER0002 HTTP/1.1
+Host: goto.second.host.now
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test202 b/third-party/curl/tests/data/test202
index f2fb078f21..45112e8282 100644
--- a/third-party/curl/tests/data/test202
+++ b/third-party/curl/tests/data/test202
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -16,9 +17,9 @@ FILE
 <server>
 file
 </server>
- <name>
+<name>
 two file:// URLs to stdout
- </name>
+</name>
 <command option="no-include">
 file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt FILE://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt
 </command>
diff --git a/third-party/curl/tests/data/test2023 b/third-party/curl/tests/data/test2023
index ae42b3401d..a57aaeed8c 100644
--- a/third-party/curl/tests/data/test2023
+++ b/third-party/curl/tests/data/test2023
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ HTTP Basic auth
 <reply>
 
 <!-- First request has Basic auth, wrong password -->
-<data100>
+<data100 crlf="headers">
 HTTP/1.1 401 Sorry wrong password
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -21,7 +22,7 @@ This is a bad password page!
 </data100>
 
 <!-- Second request has Basic auth, right password -->
-<data200>
+<data200 crlf="headers">
 HTTP/1.1 200 Things are fine in server land
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -31,7 +32,7 @@ Finally, this is the real page!
 </data200>
 
 <!-- Third request has Basic auth, wrong password -->
-<data300>
+<data300 crlf="headers">
 HTTP/1.1 401 Sorry wrong password (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -42,7 +43,7 @@ This is a bad password page!
 </data300>
 
 <!-- Fourth request has Basic auth, wrong password -->
-<data400>
+<data400 crlf="headers">
 HTTP/1.1 401 Sorry wrong password (3)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -53,7 +54,7 @@ This is a bad password page!
 </data400>
 
 <!-- Fifth request has Basic auth, right password -->
-<data500>
+<data500 crlf="headers">
 HTTP/1.1 200 Things are fine in server land (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -62,7 +63,7 @@ Content-Length: 32
 Finally, this is the real page!
 </data500>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Sorry wrong password
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -106,52 +107,43 @@ Finally, this is the real page!
 http
 </server>
 <tool>
-libauthretry
+lib2023
 </tool>
 
- <name>
+<name>
 HTTP authorization retry (Basic)
- </name>
- <setenv>
-# we force our own host name, in order to make the test machine independent
-CURL_GETHOSTNAME=curlhost
-# we try to use the LD_PRELOAD hack, if not a debug build
-LD_PRELOAD=%PWD/libtest/.libs/libhostname.so
- </setenv>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER basic basic
 </command>
-<precheck>
-chkhostname curlhost
-</precheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0100 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6d3JvbmdwYXNz
+Authorization: Basic %b64[testuser:wrongpass]b64%
 Accept: */*
 
 GET /%TESTNUMBER0200 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6dGVzdHBhc3M=
+Authorization: Basic %b64[testuser:testpass]b64%
 Accept: */*
 
 GET /%TESTNUMBER0300 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6d3JvbmdwYXNz
+Authorization: Basic %b64[testuser:wrongpass]b64%
 Accept: */*
 
 GET /%TESTNUMBER0400 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6d3JvbmdwYXNz
+Authorization: Basic %b64[testuser:wrongpass]b64%
 Accept: */*
 
 GET /%TESTNUMBER0500 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6dGVzdHBhc3M=
+Authorization: Basic %b64[testuser:testpass]b64%
 Accept: */*
 
 </protocol>
diff --git a/third-party/curl/tests/data/test2024 b/third-party/curl/tests/data/test2024
index c8bdc0423e..af60388ba7 100644
--- a/third-party/curl/tests/data/test2024
+++ b/third-party/curl/tests/data/test2024
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,10 +12,10 @@ HTTP Digest auth
 <reply>
 
 <!-- Alternate the order that Basic and Digest headers appear in responses to
-ensure that the order doesn't matter. -->
+ensure that the order does not matter. -->
 
 <!-- First request has Basic auth, wrong password -->
-<data100>
+<data100 crlf="headers">
 HTTP/1.1 401 Sorry wrong password
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -26,7 +27,7 @@ This is a bad password page!
 </data100>
 
 <!-- Second request has Digest auth, right password -->
-<data1200>
+<data1200 crlf="headers">
 HTTP/1.1 200 Things are fine in server land
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -36,7 +37,7 @@ Finally, this is the real page!
 </data1200>
 
 <!-- Third request has Basic auth, wrong password -->
-<data300>
+<data300 crlf="headers">
 HTTP/1.1 401 Sorry wrong password (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -48,7 +49,7 @@ This is a bad password page!
 </data300>
 
 <!-- Fourth request has Digest auth, wrong password -->
-<data1400>
+<data1400 crlf="headers">
 HTTP/1.1 401 Sorry wrong password (3)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -60,7 +61,7 @@ This is a bad password page!
 </data1400>
 
 <!-- Fifth request has Digest auth, right password -->
-<data1500>
+<data1500 crlf="headers">
 HTTP/1.1 200 Things are fine in server land (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -69,7 +70,7 @@ Content-Length: 32
 Finally, this is the real page!
 </data1500>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Sorry wrong password
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -118,34 +119,26 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
 <tool>
-libauthretry
+lib2023
 </tool>
 
- <name>
+<name>
 HTTP authorization retry (Basic switching to Digest)
- </name>
- <setenv>
-# we force our own host name, in order to make the test machine independent
-CURL_GETHOSTNAME=curlhost
-# we try to use the LD_PRELOAD hack, if not a debug build
-LD_PRELOAD=%PWD/libtest/.libs/libhostname.so
- </setenv>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER basic digest
 </command>
-<precheck>
-chkhostname curlhost
-</precheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0100 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6d3JvbmdwYXNz
+Authorization: Basic %b64[testuser:wrongpass]b64%
 Accept: */*
 
 GET /%TESTNUMBER0200 HTTP/1.1
@@ -155,7 +148,7 @@ Accept: */*
 
 GET /%TESTNUMBER0300 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6d3JvbmdwYXNz
+Authorization: Basic %b64[testuser:wrongpass]b64%
 Accept: */*
 
 GET /%TESTNUMBER0400 HTTP/1.1
diff --git a/third-party/curl/tests/data/test2025 b/third-party/curl/tests/data/test2025
index 1f8bdec1f2..3d1db3f4e5 100644
--- a/third-party/curl/tests/data/test2025
+++ b/third-party/curl/tests/data/test2025
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,10 +13,10 @@ NTLM
 <reply>
 
 <!-- Alternate the order that Basic and NTLM headers appear in responses to
-ensure that the order doesn't matter. -->
+ensure that the order does not matter. -->
 
 <!-- First request has Basic auth, wrong password -->
-<data100>
+<data100 crlf="headers">
 HTTP/1.1 401 Sorry wrong password
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -27,7 +28,7 @@ This is a bad password page!
 </data100>
 
 <!-- Second request has NTLM auth, right password -->
-<data200>
+<data200 crlf="headers">
 HTTP/1.1 401 Need Basic or NTLM auth
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -38,7 +39,7 @@ WWW-Authenticate: NTLM
 This is not the real page!
 </data200>
 
-<data1201>
+<data1201 crlf="headers">
 HTTP/1.1 401 NTLM intermediate
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -48,7 +49,7 @@ WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADAAAACGgAEAq6U1NAWaJCIAAAAAAAAAAAAAA
 This is still not the real page!
 </data1201>
 
-<data1202>
+<data1202 crlf="headers">
 HTTP/1.1 200 Things are fine in server land
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -58,7 +59,7 @@ Finally, this is the real page!
 </data1202>
 
 <!-- Third request has Basic auth, wrong password -->
-<data300>
+<data300 crlf="headers">
 HTTP/1.1 401 Sorry wrong password (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -70,7 +71,7 @@ This is a bad password page!
 </data300>
 
 <!-- Fourth request has NTLM auth, wrong password -->
-<data400>
+<data400 crlf="headers">
 HTTP/1.1 401 Need Basic or NTLM auth (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -81,7 +82,7 @@ WWW-Authenticate: NTLM
 This is not the real page!
 </data400>
 
-<data1401>
+<data1401 crlf="headers">
 HTTP/1.1 401 NTLM intermediate (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -91,7 +92,7 @@ WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADAAAACGgAEAq6U1NAWaJCIAAAAAAAAAAAAAA
 This is still not the real page!
 </data1401>
 
-<data1402>
+<data1402 crlf="headers">
 HTTP/1.1 401 Sorry wrong password (3)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -103,7 +104,7 @@ This is a bad password page!
 </data1402>
 
 <!-- Fifth request has NTLM auth, right password -->
-<data500>
+<data500 crlf="headers">
 HTTP/1.1 401 Need Basic or NTLM auth (3)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -114,7 +115,7 @@ WWW-Authenticate: NTLM
 This is not the real page!
 </data500>
 
-<data1501>
+<data1501 crlf="headers">
 HTTP/1.1 401 NTLM intermediate (3)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -124,7 +125,7 @@ WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADAAAACGgAEAq6U1NAWaJCIAAAAAAAAAAAAAA
 This is still not the real page!
 </data1501>
 
-<data1502>
+<data1502 crlf="headers">
 HTTP/1.1 200 Things are fine in server land (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -133,7 +134,7 @@ Content-Length: 32
 Finally, this is the real page!
 </data1502>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Sorry wrong password
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -203,7 +204,7 @@ SSL
 http
 </server>
 <tool>
-libauthretry
+lib2023
 </tool>
 
 <name>
@@ -216,15 +217,15 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER basic ntlm
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0100 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6d3JvbmdwYXNz
+Authorization: Basic %b64[testuser:wrongpass]b64%
 Accept: */*
 
 GET /%TESTNUMBER0200 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 
 GET /%TESTNUMBER0200 HTTP/1.1
@@ -234,12 +235,12 @@ Accept: */*
 
 GET /%TESTNUMBER0300 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6d3JvbmdwYXNz
+Authorization: Basic %b64[testuser:wrongpass]b64%
 Accept: */*
 
 GET /%TESTNUMBER0400 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 
 GET /%TESTNUMBER0400 HTTP/1.1
@@ -249,7 +250,7 @@ Accept: */*
 
 GET /%TESTNUMBER0500 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 
 GET /%TESTNUMBER0500 HTTP/1.1
diff --git a/third-party/curl/tests/data/test2026 b/third-party/curl/tests/data/test2026
index e1304561bf..9fc1c6bb96 100644
--- a/third-party/curl/tests/data/test2026
+++ b/third-party/curl/tests/data/test2026
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,10 +12,10 @@ HTTP Digest auth
 <reply>
 
 <!-- Alternate the order that Basic and Digest headers appear in responses to
-ensure that the order doesn't matter. -->
+ensure that the order does not matter. -->
 
 <!-- First request has Digest auth, wrong password -->
-<data100>
+<data100 crlf="headers">
 HTTP/1.1 401 Need Basic or Digest auth
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -25,7 +26,7 @@ WWW-Authenticate: Basic realm="testrealm"
 This is not the real page!
 </data100>
 
-<data1100>
+<data1100 crlf="headers">
 HTTP/1.1 401 Sorry wrong password
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -37,7 +38,7 @@ This is a bad password page!
 </data1100>
 
 <!-- Second request has Basic auth, right password -->
-<data200>
+<data200 crlf="headers">
 HTTP/1.1 200 Things are fine in server land
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -47,7 +48,7 @@ Finally, this is the real page!
 </data200>
 
 <!-- Third request has Digest auth, wrong password -->
-<data300>
+<data300 crlf="headers">
 HTTP/1.1 401 Need Basic or Digest auth (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -58,7 +59,7 @@ WWW-Authenticate: Basic realm="testrealm"
 This is not the real page!
 </data300>
 
-<data1300>
+<data1300 crlf="headers">
 HTTP/1.1 401 Sorry wrong password (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -70,7 +71,7 @@ This is a bad password page!
 </data1300>
 
 <!-- Fourth request has Basic auth, wrong password -->
-<data400>
+<data400 crlf="headers">
 HTTP/1.1 401 Sorry wrong password (3)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -82,7 +83,7 @@ This is a bad password page!
 </data400>
 
 <!-- Fifth request has Basic auth, right password -->
-<data500>
+<data500 crlf="headers">
 HTTP/1.1 200 Things are fine in server land (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -91,7 +92,7 @@ Content-Length: 32
 Finally, this is the real page!
 </data500>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Need Basic or Digest auth
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -154,31 +155,23 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
 <tool>
-libauthretry
+lib2023
 </tool>
 
- <name>
+<name>
 HTTP authorization retry (Digest switching to Basic)
- </name>
- <setenv>
-# we force our own host name, in order to make the test machine independent
-CURL_GETHOSTNAME=curlhost
-# we try to use the LD_PRELOAD hack, if not a debug build
-LD_PRELOAD=%PWD/libtest/.libs/libhostname.so
- </setenv>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER digest basic
 </command>
-<precheck>
-chkhostname curlhost
-</precheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0100 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
@@ -190,7 +183,7 @@ Accept: */*
 
 GET /%TESTNUMBER0200 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6dGVzdHBhc3M=
+Authorization: Basic %b64[testuser:testpass]b64%
 Accept: */*
 
 GET /%TESTNUMBER0300 HTTP/1.1
@@ -204,12 +197,12 @@ Accept: */*
 
 GET /%TESTNUMBER0400 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6d3JvbmdwYXNz
+Authorization: Basic %b64[testuser:wrongpass]b64%
 Accept: */*
 
 GET /%TESTNUMBER0500 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6dGVzdHBhc3M=
+Authorization: Basic %b64[testuser:testpass]b64%
 Accept: */*
 
 </protocol>
diff --git a/third-party/curl/tests/data/test2027 b/third-party/curl/tests/data/test2027
index fcfc0564f2..dfcefa302a 100644
--- a/third-party/curl/tests/data/test2027
+++ b/third-party/curl/tests/data/test2027
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,17 +12,17 @@ HTTP Digest auth
 
 <!--
 
- Explanation for the duplicate 400 requests:
+Explanation for the duplicate 400 requests:
 
- libcurl doesn't detect that a given Digest password is wrong already on the
- first 401 response (as the data400 gives). libcurl will instead consider the
- new response just as a duplicate and it sends another and detects the auth
- problem on the second 401 response!
+libcurl does not detect that a given Digest password is wrong already on the
+first 401 response (as the data400 gives). libcurl will instead consider the
+new response as a duplicate and it sends another and detects the auth
+problem on the second 401 response!
 
 -->
 
 <!-- First request has Digest auth, wrong password -->
-<data100>
+<data100 crlf="headers">
 HTTP/1.1 401 Need Digest auth
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -31,7 +32,7 @@ WWW-Authenticate: Digest realm="testrealm", nonce="1"
 This is not the real page!
 </data100>
 
-<data1100>
+<data1100 crlf="headers">
 HTTP/1.1 401 Sorry wrong password
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -42,7 +43,7 @@ This is a bad password page!
 </data1100>
 
 <!-- Second request has Digest auth, right password -->
-<data200>
+<data200 crlf="headers">
 HTTP/1.1 401 Need Digest auth (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -52,7 +53,7 @@ WWW-Authenticate: Digest realm="testrealm", nonce="3"
 This is not the real page!
 </data200>
 
-<data1200>
+<data1200 crlf="headers">
 HTTP/1.1 200 Things are fine in server land
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -62,7 +63,7 @@ Finally, this is the real page!
 </data1200>
 
 <!-- Third request has Digest auth, wrong password -->
-<data300>
+<data300 crlf="headers">
 HTTP/1.1 401 Need Digest auth (3)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -72,7 +73,7 @@ WWW-Authenticate: Digest realm="testrealm", nonce="4"
 This is not the real page!
 </data300>
 
-<data1300>
+<data1300 crlf="headers">
 HTTP/1.1 401 Sorry wrong password (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -83,7 +84,7 @@ This is a bad password page!
 </data1300>
 
 <!-- Fourth request has Digest auth, wrong password -->
-<data400>
+<data400 crlf="headers">
 HTTP/1.1 401 Need Digest auth (4)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -93,7 +94,7 @@ WWW-Authenticate: Digest realm="testrealm", nonce="6"
 This is not the real page!
 </data400>
 
-<data1400>
+<data1400 crlf="headers">
 HTTP/1.1 401 Sorry wrong password (3)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -104,7 +105,7 @@ This is a bad password page!
 </data1400>
 
 <!-- Fifth request has Digest auth, right password -->
-<data1500>
+<data1500 crlf="headers">
 HTTP/1.1 200 Things are fine in server land (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -113,7 +114,7 @@ Content-Length: 32
 Finally, this is the real page!
 </data1500>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Need Digest auth
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -177,31 +178,23 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
 <tool>
-libauthretry
+lib2023
 </tool>
 
- <name>
+<name>
 HTTP authorization retry (Digest)
- </name>
- <setenv>
-# we force our own host name, in order to make the test machine independent
-CURL_GETHOSTNAME=curlhost
-# we try to use the LD_PRELOAD hack, if not a debug build
-LD_PRELOAD=%PWD/libtest/.libs/libhostname.so
- </setenv>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER digest digest
 </command>
-<precheck>
-chkhostname curlhost
-</precheck>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0100 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test2028 b/third-party/curl/tests/data/test2028
index 20e3de4c98..f61d2a642c 100644
--- a/third-party/curl/tests/data/test2028
+++ b/third-party/curl/tests/data/test2028
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,10 +13,10 @@ NTLM
 <reply>
 
 <!-- Alternate the order that Digest and NTLM headers appear in responses to
-ensure that the order doesn't matter. -->
+ensure that the order does not matter. -->
 
 <!-- First request has Digest auth, wrong password -->
-<data100>
+<data100 crlf="headers">
 HTTP/1.1 401 Need Digest or NTLM auth
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -26,7 +27,7 @@ WWW-Authenticate: Digest realm="testrealm", nonce="1"
 This is not the real page!
 </data100>
 
-<data1100>
+<data1100 crlf="headers">
 HTTP/1.1 401 Sorry wrong password
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -38,7 +39,7 @@ This is a bad password page!
 </data1100>
 
 <!-- Second request has NTLM auth, right password -->
-<data200>
+<data200 crlf="headers">
 HTTP/1.1 401 Need Digest or NTLM auth (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -49,7 +50,7 @@ WWW-Authenticate: Digest realm="testrealm", nonce="3"
 This is not the real page!
 </data200>
 
-<data1201>
+<data1201 crlf="headers">
 HTTP/1.1 401 NTLM intermediate
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -59,7 +60,7 @@ WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADAAAACGgAEAq6U1NAWaJCIAAAAAAAAAAAAAA
 This is still not the real page!
 </data1201>
 
-<data1202>
+<data1202 crlf="headers">
 HTTP/1.1 200 Things are fine in server land
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -69,7 +70,7 @@ Finally, this is the real page!
 </data1202>
 
 <!-- Third request has Digest auth, wrong password -->
-<data300>
+<data300 crlf="headers">
 HTTP/1.1 401 Need Digest or NTLM auth (3)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -80,7 +81,7 @@ WWW-Authenticate: NTLM
 This is not the real page!
 </data300>
 
-<data1300>
+<data1300 crlf="headers">
 HTTP/1.1 401 Sorry wrong password (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -92,7 +93,7 @@ This is a bad password page!
 </data1300>
 
 <!-- Fourth request has NTLM auth, wrong password -->
-<data400>
+<data400 crlf="headers">
 HTTP/1.1 401 Need Digest or NTLM auth (4)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -103,7 +104,7 @@ WWW-Authenticate: NTLM
 This is not the real page!
 </data400>
 
-<data1401>
+<data1401 crlf="headers">
 HTTP/1.1 401 NTLM intermediate (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -113,7 +114,7 @@ WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADAAAACGgAEAq6U1NAWaJCIAAAAAAAAAAAAAA
 This is still not the real page!
 </data1401>
 
-<data1402>
+<data1402 crlf="headers">
 HTTP/1.1 401 Sorry wrong password (3)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -125,7 +126,7 @@ This is a bad password page!
 </data1402>
 
 <!-- Fifth request has NTLM auth, right password -->
-<data500>
+<data500 crlf="headers">
 HTTP/1.1 401 Need Digest or NTLM auth (5)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -136,7 +137,7 @@ WWW-Authenticate: NTLM
 This is not the real page!
 </data500>
 
-<data1501>
+<data1501 crlf="headers">
 HTTP/1.1 401 NTLM intermediate (3)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -146,7 +147,7 @@ WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADAAAACGgAEAq6U1NAWaJCIAAAAAAAAAAAAAA
 This is still not the real page!
 </data1501>
 
-<data1502>
+<data1502 crlf="headers">
 HTTP/1.1 200 Things are fine in server land (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -155,7 +156,7 @@ Content-Length: 32
 Finally, this is the real page!
 </data1502>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Need Digest or NTLM auth
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -234,12 +235,13 @@ Finally, this is the real page!
 NTLM
 SSL
 !SSPI
+digest
 </features>
 <server>
 http
 </server>
 <tool>
-libauthretry
+lib2023
 </tool>
 
 <name>
@@ -252,7 +254,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER digest ntlm
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0100 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
@@ -264,7 +266,7 @@ Accept: */*
 
 GET /%TESTNUMBER0200 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 
 GET /%TESTNUMBER0200 HTTP/1.1
@@ -283,7 +285,7 @@ Accept: */*
 
 GET /%TESTNUMBER0400 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 
 GET /%TESTNUMBER0400 HTTP/1.1
@@ -293,7 +295,7 @@ Accept: */*
 
 GET /%TESTNUMBER0500 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 
 GET /%TESTNUMBER0500 HTTP/1.1
diff --git a/third-party/curl/tests/data/test2029 b/third-party/curl/tests/data/test2029
index a98be6ca9c..361aa7cb6b 100644
--- a/third-party/curl/tests/data/test2029
+++ b/third-party/curl/tests/data/test2029
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,10 +13,10 @@ NTLM
 <reply>
 
 <!-- Alternate the order that Basic and NTLM headers appear in responses to
-ensure that the order doesn't matter. -->
+ensure that the order does not matter. -->
 
 <!-- First request has NTLM auth, wrong password -->
-<data100>
+<data100 crlf="headers">
 HTTP/1.1 401 Need Basic or NTLM auth
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -26,7 +27,7 @@ WWW-Authenticate: Basic realm="testrealm"
 This is not the real page!
 </data100>
 
-<data1101>
+<data1101 crlf="headers">
 HTTP/1.1 401 NTLM intermediate
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -36,7 +37,7 @@ WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADAAAACGgAEAq6U1NAWaJCIAAAAAAAAAAAAAA
 This is still not the real page!
 </data1101>
 
-<data1102>
+<data1102 crlf="headers">
 HTTP/1.1 401 Sorry wrong password
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -48,7 +49,7 @@ This is a bad password page!
 </data1102>
 
 <!-- Second request has Basic auth, right password -->
-<data200>
+<data200 crlf="headers">
 HTTP/1.1 200 Things are fine in server land
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -58,7 +59,7 @@ Finally, this is the real page!
 </data200>
 
 <!-- Third request has NTLM auth, wrong password -->
-<data300>
+<data300 crlf="headers">
 HTTP/1.1 401 Need Basic or NTLM auth (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -69,7 +70,7 @@ WWW-Authenticate: Basic realm="testrealm"
 This is not the real page!
 </data300>
 
-<data1301>
+<data1301 crlf="headers">
 HTTP/1.1 401 NTLM intermediate (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -79,7 +80,7 @@ WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADAAAACGgAEAq6U1NAWaJCIAAAAAAAAAAAAAA
 This is still not the real page!
 </data1301>
 
-<data1302>
+<data1302 crlf="headers">
 HTTP/1.1 401 Sorry wrong password (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -91,7 +92,7 @@ This is a bad password page!
 </data1302>
 
 <!-- Fourth request has Basic auth, wrong password -->
-<data400>
+<data400 crlf="headers">
 HTTP/1.1 401 Sorry wrong password (3)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -103,7 +104,7 @@ This is a bad password page!
 </data400>
 
 <!-- Fifth request has Basic auth, right password -->
-<data500>
+<data500 crlf="headers">
 HTTP/1.1 200 Things are fine in server land (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -112,7 +113,7 @@ Content-Length: 32
 Finally, this is the real page!
 </data500>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 NTLM intermediate
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -176,7 +177,7 @@ SSL
 http
 </server>
 <tool>
-libauthretry
+lib2023
 </tool>
 
 <name>
@@ -189,10 +190,10 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER ntlm basic
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0100 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 
 GET /%TESTNUMBER0100 HTTP/1.1
@@ -202,12 +203,12 @@ Accept: */*
 
 GET /%TESTNUMBER0200 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6dGVzdHBhc3M=
+Authorization: Basic %b64[testuser:testpass]b64%
 Accept: */*
 
 GET /%TESTNUMBER0300 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 
 GET /%TESTNUMBER0300 HTTP/1.1
@@ -217,12 +218,12 @@ Accept: */*
 
 GET /%TESTNUMBER0400 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6d3JvbmdwYXNz
+Authorization: Basic %b64[testuser:wrongpass]b64%
 Accept: */*
 
 GET /%TESTNUMBER0500 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6dGVzdHBhc3M=
+Authorization: Basic %b64[testuser:testpass]b64%
 Accept: */*
 
 </protocol>
diff --git a/third-party/curl/tests/data/test203 b/third-party/curl/tests/data/test203
index 496a414825..9dfa5007bf 100644
--- a/third-party/curl/tests/data/test203
+++ b/third-party/curl/tests/data/test203
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -21,9 +22,9 @@ moo
 <server>
 file
 </server>
- <name>
+<name>
 file:/path URL with a single slash
- </name>
+</name>
 <setenv>
 # Needed for MSYS2 to not convert
 MSYS2_ARG_CONV_EXCL=file:
diff --git a/third-party/curl/tests/data/test2030 b/third-party/curl/tests/data/test2030
index a6db50c061..5027fd45da 100644
--- a/third-party/curl/tests/data/test2030
+++ b/third-party/curl/tests/data/test2030
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,22 +13,21 @@ NTLM
 <reply>
 
 <!-- Alternate the order that Digest and NTLM headers appear in responses to
-ensure that the order doesn't matter. -->
+ensure that the order does not matter. -->
 
 <!--
 
- Explanation for the duplicate 400 requests:
+Explanation for the duplicate 400 requests:
 
- libcurl doesn't detect that a given Digest password is wrong already on the
- first 401 response (as the data400 gives). libcurl will instead consider the
- new response just as a duplicate and it sends another and detects the auth
- problem on the second 401 response!
+libcurl does not detect that a given Digest password is wrong already on the
+first 401 response (as the data400 gives). libcurl will instead consider the
+new response as a duplicate and it sends another and detects the auth
+problem on the second 401 response!
 
 -->
 
-
 <!-- First request has NTLM auth, wrong password -->
-<data100>
+<data100 crlf="headers">
 HTTP/1.1 401 Need Digest or NTLM auth
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -38,7 +38,7 @@ WWW-Authenticate: Digest realm="testrealm", nonce="1"
 This is not the real page!
 </data100>
 
-<data1101>
+<data1101 crlf="headers">
 HTTP/1.1 401 NTLM intermediate
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -48,7 +48,7 @@ WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADAAAACGgAEAq6U1NAWaJCIAAAAAAAAAAAAAA
 This is still not the real page!
 </data1101>
 
-<data1102>
+<data1102 crlf="headers">
 HTTP/1.1 401 Sorry wrong password
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -60,7 +60,7 @@ This is a bad password page!
 </data1102>
 
 <!-- Second request has Digest auth, right password -->
-<data200>
+<data200 crlf="headers">
 HTTP/1.1 401 Need Digest or NTLM auth (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -71,7 +71,7 @@ WWW-Authenticate: Digest realm="testrealm", nonce="3"
 This is not the real page!
 </data200>
 
-<data1200>
+<data1200 crlf="headers">
 HTTP/1.1 200 Things are fine in server land
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -81,7 +81,7 @@ Finally, this is the real page!
 </data1200>
 
 <!-- Third request has NTLM auth, wrong password -->
-<data300>
+<data300 crlf="headers">
 HTTP/1.1 401 Need Digest or NTLM auth (3)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -92,7 +92,7 @@ WWW-Authenticate: NTLM
 This is not the real page!
 </data300>
 
-<data1301>
+<data1301 crlf="headers">
 HTTP/1.1 401 NTLM intermediate (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -102,7 +102,7 @@ WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADAAAACGgAEAq6U1NAWaJCIAAAAAAAAAAAAAA
 This is still not the real page!
 </data1301>
 
-<data1302>
+<data1302 crlf="headers">
 HTTP/1.1 401 Sorry wrong password (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -114,7 +114,7 @@ This is a bad password page!
 </data1302>
 
 <!-- Fourth request has Digest auth, wrong password -->
-<data400>
+<data400 crlf="headers">
 HTTP/1.1 401 Need Digest or NTLM auth (4)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -125,7 +125,7 @@ WWW-Authenticate: NTLM
 This is not the real page!
 </data400>
 
-<data1400>
+<data1400 crlf="headers">
 HTTP/1.1 401 Sorry wrong password (3)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -137,7 +137,7 @@ This is a bad password page!
 </data1400>
 
 <!-- Fifth request has Digest auth, right password -->
-<data500>
+<data500 crlf="headers">
 HTTP/1.1 401 Need Digest or NTLM auth (5)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -148,7 +148,7 @@ WWW-Authenticate: NTLM
 This is not the real page!
 </data500>
 
-<data1500>
+<data1500 crlf="headers">
 HTTP/1.1 200 Things are fine in server land (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -157,7 +157,7 @@ Content-Length: 32
 Finally, this is the real page!
 </data1500>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 NTLM intermediate
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -223,12 +223,13 @@ Finally, this is the real page!
 NTLM
 SSL
 !SSPI
+digest
 </features>
 <server>
 http
 </server>
 <tool>
-libauthretry
+lib2023
 </tool>
 
 <name>
@@ -241,10 +242,10 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER ntlm digest
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0100 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 
 GET /%TESTNUMBER0100 HTTP/1.1
@@ -259,7 +260,7 @@ Accept: */*
 
 GET /%TESTNUMBER0300 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 
 GET /%TESTNUMBER0300 HTTP/1.1
diff --git a/third-party/curl/tests/data/test2031 b/third-party/curl/tests/data/test2031
index 93450c81f2..09e1f7734d 100644
--- a/third-party/curl/tests/data/test2031
+++ b/third-party/curl/tests/data/test2031
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ NTLM
 <reply>
 
 <!-- First request has NTLM auth, wrong password -->
-<data100>
+<data100 crlf="headers">
 HTTP/1.1 401 Need NTLM auth
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -21,7 +22,7 @@ WWW-Authenticate: NTLM
 This is not the real page!
 </data100>
 
-<data1101>
+<data1101 crlf="headers">
 HTTP/1.1 401 NTLM intermediate
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -31,7 +32,7 @@ WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADAAAACGgAEAq6U1NAWaJCIAAAAAAAAAAAAAA
 This is still not the real page!
 </data1101>
 
-<data1102>
+<data1102 crlf="headers">
 HTTP/1.1 401 Sorry wrong password
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -42,7 +43,7 @@ This is a bad password page!
 </data1102>
 
 <!-- Second request has NTLM auth, right password -->
-<data200>
+<data200 crlf="headers">
 HTTP/1.1 401 Need NTLM auth (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -52,7 +53,7 @@ WWW-Authenticate: NTLM
 This is not the real page!
 </data200>
 
-<data1201>
+<data1201 crlf="headers">
 HTTP/1.1 401 NTLM intermediate (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -62,7 +63,7 @@ WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADAAAACGgAEAq6U1NAWaJCIAAAAAAAAAAAAAA
 This is still not the real page!
 </data1201>
 
-<data1202>
+<data1202 crlf="headers">
 HTTP/1.1 200 Things are fine in server land
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -72,7 +73,7 @@ Finally, this is the real page!
 </data1202>
 
 <!-- Third request has NTLM auth, wrong password -->
-<data300>
+<data300 crlf="headers">
 HTTP/1.1 401 Need NTLM auth (3)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -82,7 +83,7 @@ WWW-Authenticate: NTLM
 This is not the real page!
 </data300>
 
-<data1301>
+<data1301 crlf="headers">
 HTTP/1.1 401 NTLM intermediate (3)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -92,7 +93,7 @@ WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADAAAACGgAEAq6U1NAWaJCIAAAAAAAAAAAAAA
 This is still not the real page!
 </data1301>
 
-<data1302>
+<data1302 crlf="headers">
 HTTP/1.1 401 Sorry wrong password (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -103,7 +104,7 @@ This is a bad password page!
 </data1302>
 
 <!-- Fourth request has NTLM auth, wrong password -->
-<data400>
+<data400 crlf="headers">
 HTTP/1.1 401 Need NTLM auth (4)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -113,7 +114,7 @@ WWW-Authenticate: NTLM
 This is not the real page!
 </data400>
 
-<data1401>
+<data1401 crlf="headers">
 HTTP/1.1 401 NTLM intermediate (4)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -123,7 +124,7 @@ WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADAAAACGgAEAq6U1NAWaJCIAAAAAAAAAAAAAA
 This is still not the real page!
 </data1401>
 
-<data1402>
+<data1402 crlf="headers">
 HTTP/1.1 401 Sorry wrong password (3)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -134,7 +135,7 @@ This is a bad password page!
 </data1402>
 
 <!-- Fifth request has NTLM auth, right password -->
-<data500>
+<data500 crlf="headers">
 HTTP/1.1 401 Need NTLM auth (5)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -144,7 +145,7 @@ WWW-Authenticate: NTLM
 This is not the real page!
 </data500>
 
-<data1501>
+<data1501 crlf="headers">
 HTTP/1.1 401 NTLM intermediate (5)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -154,7 +155,7 @@ WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADAAAACGgAEAq6U1NAWaJCIAAAAAAAAAAAAAA
 This is still not the real page!
 </data1501>
 
-<data1502>
+<data1502 crlf="headers">
 HTTP/1.1 200 Things are fine in server land (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -163,7 +164,7 @@ Content-Length: 32
 Finally, this is the real page!
 </data1502>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 NTLM intermediate
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -242,7 +243,7 @@ SSL
 http
 </server>
 <tool>
-libauthretry
+lib2023
 </tool>
 
 <name>
@@ -255,10 +256,10 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER ntlm ntlm
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0100 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 
 GET /%TESTNUMBER0100 HTTP/1.1
@@ -268,7 +269,7 @@ Accept: */*
 
 GET /%TESTNUMBER0200 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 
 GET /%TESTNUMBER0200 HTTP/1.1
@@ -278,7 +279,7 @@ Accept: */*
 
 GET /%TESTNUMBER0300 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 
 GET /%TESTNUMBER0300 HTTP/1.1
@@ -288,7 +289,7 @@ Accept: */*
 
 GET /%TESTNUMBER0400 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 
 GET /%TESTNUMBER0400 HTTP/1.1
@@ -298,7 +299,7 @@ Accept: */*
 
 GET /%TESTNUMBER0500 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 
 GET /%TESTNUMBER0500 HTTP/1.1
diff --git a/third-party/curl/tests/data/test2032 b/third-party/curl/tests/data/test2032
index 838c613786..2bddcb5fc0 100644
--- a/third-party/curl/tests/data/test2032
+++ b/third-party/curl/tests/data/test2032
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,15 +6,16 @@ HTTP
 HTTP GET
 HTTP Basic auth
 HTTP NTLM auth
-flaky
 NTLM
+flaky
+timing-dependent
 </keywords>
 </info>
 # Server-side
 <reply>
 
 <!-- Basic auth -->
-<data100>
+<data100 crlf="headers">
 HTTP/1.1 401 Need Basic or NTLM auth
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -25,7 +27,7 @@ This is a bad password page!
 </data100>
 
 <!-- NTLM auth -->
-<data200>
+<data200 crlf="headers">
 HTTP/1.1 401 Need Basic or NTLM auth (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -36,7 +38,7 @@ WWW-Authenticate: Basic realm="testrealm"
 This is not the real page!
 </data200>
 
-<data1201>
+<data1201 crlf="headers">
 HTTP/1.1 401 NTLM intermediate (2)
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -46,7 +48,7 @@ WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADAAAACGgAEAq6U1NAWaJCIAAAAAAAAAAAAAA
 This is still not the real page!
 </data1201>
 
-<data1202>
+<data1202 crlf="headers">
 HTTP/1.1 200 Things are fine in server land
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -74,7 +76,7 @@ SSL
 http
 </server>
 <tool>
-libntlmconnect
+lib2032
 </tool>
 
 <name>
@@ -87,20 +89,20 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0100 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6dGVzdHBhc3M=
+Authorization: Basic %b64[testuser:testpass]b64%
 Accept: */*
 
 GET /%TESTNUMBER0100 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6dGVzdHBhc3M=
+Authorization: Basic %b64[testuser:testpass]b64%
 Accept: */*
 
 GET /%TESTNUMBER0200 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 
 GET /%TESTNUMBER0200 HTTP/1.1
diff --git a/third-party/curl/tests/data/test2033 b/third-party/curl/tests/data/test2033
index b2ad38942d..f437f379d3 100644
--- a/third-party/curl/tests/data/test2033
+++ b/third-party/curl/tests/data/test2033
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ PEM certificate
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -20,37 +20,32 @@ MooMoo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 SSL
 SSLpinning
 Schannel
+local-http
 </features>
 <server>
-https Server-localhost-sv.pem
+https test-localhost.pem
 </server>
- <name>
+<name>
 simple HTTPS GET with DER public key pinning (Schannel variant)
- </name>
- <setenv>
-# This test is pointless if we're not using the schannel backend
+</name>
+<setenv>
+# This test is pointless if we are not using the Schannel backend
 CURL_SSL_BACKEND=schannel
- </setenv>
- <command>
---cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --pinnedpubkey %SRCDIR/certs/Server-localhost-sv.pub.der --ssl-revoke-best-effort https://localhost:%HTTPSPORT/%TESTNUMBER
+</setenv>
+<command>
+-4 --cacert %CERTDIR/certs/test-ca.crt --pinnedpubkey %CERTDIR/certs/test-localhost.pub.der --ssl-revoke-best-effort https://localhost:%HTTPSPORT/%TESTNUMBER
 </command>
-# Ensure that we're running on localhost because we're checking the host name
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: localhost:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2034 b/third-party/curl/tests/data/test2034
index d062d8b706..aee2ac1eb3 100644
--- a/third-party/curl/tests/data/test2034
+++ b/third-party/curl/tests/data/test2034
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ PEM certificate
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -20,33 +20,28 @@ MooMoo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 SSL
 SSLpinning
 !Schannel
+local-http
 </features>
 <server>
-https Server-localhost-sv.pem
+https test-localhost.pem
 </server>
- <name>
+<name>
 simple HTTPS GET with DER public key pinning
- </name>
- <command>
---cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --pinnedpubkey %SRCDIR/certs/Server-localhost-sv.pub.der https://localhost:%HTTPSPORT/%TESTNUMBER
+</name>
+<command>
+-4 --cacert %CERTDIR/certs/test-ca.crt --pinnedpubkey %CERTDIR/certs/test-localhost.pub.der https://localhost:%HTTPSPORT/%TESTNUMBER
 </command>
-# Ensure that we're running on localhost because we're checking the host name
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: localhost:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2035 b/third-party/curl/tests/data/test2035
index 8380022aae..55d2a8e842 100644
--- a/third-party/curl/tests/data/test2035
+++ b/third-party/curl/tests/data/test2035
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,34 +8,28 @@ PEM certificate
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 SSL
 SSLpinning
+local-http
 </features>
 <server>
-https Server-localhost-sv.pem
+https test-localhost.pem
 </server>
- <name>
+<name>
 HTTPS wrong DER pinnedpubkey but right CN
- </name>
- <command>
---cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --pinnedpubkey %SRCDIR/certs/Server-localhost-sv.der https://localhost:%HTTPSPORT/%TESTNUMBER
+</name>
+<command>
+-4 --cacert %CERTDIR/certs/test-ca.crt --pinnedpubkey %CERTDIR/certs/test-localhost.der https://localhost:%HTTPSPORT/%TESTNUMBER
 </command>
-# Ensure that we're running on localhost because we're checking the host name
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test2036 b/third-party/curl/tests/data/test2036
index f022d1444d..b017a71abc 100644
--- a/third-party/curl/tests/data/test2036
+++ b/third-party/curl/tests/data/test2036
@@ -1,36 +1,26 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
-FAILURE
+--proto-default
 </keywords>
 </info>
-#
-# Server-side
-<reply>
-</reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
-<features>
-http
-</features>
- <name>
-HTTP, -O with no slash at all in the URL
- </name>
- <command option="no-output">
-%HOSTIP:%NOLISTENPORT -O
+<name>
+Attempt to set a default protocol with :// suffix
+</name>
+<command>
+--proto-default https://
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
+# CURLE_UNSUPPORTED_PROTOCOL is error code 1
 <errorcode>
-23
+1
 </errorcode>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test2037 b/third-party/curl/tests/data/test2037
index bd8e68de91..ddab6fcb89 100644
--- a/third-party/curl/tests/data/test2037
+++ b/third-party/curl/tests/data/test2037
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ PEM certificate
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -20,33 +20,28 @@ MooMoo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 SSL
 SSLpinning
 !Schannel
+local-http
 </features>
 <server>
-https Server-localhost-sv.pem
+https test-localhost.pem
 </server>
- <name>
+<name>
 simple HTTPS GET with PEM public key pinning
- </name>
- <command>
---cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --pinnedpubkey %SRCDIR/certs/Server-localhost-sv.pub.pem https://localhost:%HTTPSPORT/%TESTNUMBER
+</name>
+<command>
+-4 --cacert %CERTDIR/certs/test-ca.crt --pinnedpubkey %CERTDIR/certs/test-localhost.pub.pem https://localhost:%HTTPSPORT/%TESTNUMBER
 </command>
-# Ensure that we're running on localhost because we're checking the host name
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: localhost:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2038 b/third-party/curl/tests/data/test2038
index d9bf7c6434..d1964e8803 100644
--- a/third-party/curl/tests/data/test2038
+++ b/third-party/curl/tests/data/test2038
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,34 +8,28 @@ PEM certificate
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 SSL
 SSLpinning
+local-http
 </features>
 <server>
-https Server-localhost-sv.pem
+https test-localhost.pem
 </server>
- <name>
+<name>
 HTTPS wrong PEM pinnedpubkey but right CN
- </name>
- <command>
---cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --pinnedpubkey %SRCDIR/certs/Server-localhost-sv.pem https://localhost:%HTTPSPORT/%TESTNUMBER
+</name>
+<command>
+-4 --cacert %CERTDIR/certs/test-ca.crt --pinnedpubkey %CERTDIR/certs/test-localhost.pem https://localhost:%HTTPSPORT/%TESTNUMBER
 </command>
-# Ensure that we're running on localhost because we're checking the host name
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test2039 b/third-party/curl/tests/data/test2039
index bc434199ed..bd9558a4bd 100644
--- a/third-party/curl/tests/data/test2039
+++ b/third-party/curl/tests/data/test2039
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,12 +8,9 @@ LIST
 netrc
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -24,19 +22,18 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP (optional .netrc with 'default' override; no user/pass) dir list PASV
- </name>
- <command>
+</name>
+<command>
 --netrc-optional --netrc-file %LOGDIR/netrc%TESTNUMBER ftp://%HOSTIP:%FTPPORT/
 </command>
 <file name="%LOGDIR/netrc%TESTNUMBER" >
@@ -47,10 +44,9 @@ machine %HOSTIP login user2 password passwd2
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER userdef
 PASS passwddef
 PWD
diff --git a/third-party/curl/tests/data/test204 b/third-party/curl/tests/data/test204
index 63d17cd57d..657ab76051 100644
--- a/third-party/curl/tests/data/test204
+++ b/third-party/curl/tests/data/test204
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,9 +13,9 @@ FILE
 <server>
 file
 </server>
- <name>
+<name>
 "upload" with file://
- </name>
+</name>
 <command option="no-include">
 file://localhost%FILE_PWD/%LOGDIR/result%TESTNUMBER.txt -T %LOGDIR/upload%TESTNUMBER.txt
 </command>
diff --git a/third-party/curl/tests/data/test2040 b/third-party/curl/tests/data/test2040
index 130333bcc2..5859f2ed10 100644
--- a/third-party/curl/tests/data/test2040
+++ b/third-party/curl/tests/data/test2040
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -47,10 +48,10 @@ HTTP Basic authorization, then without authorization
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0100 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dGVzdHVzZXI6dGVzdHBhc3M=
+Authorization: Basic %b64[testuser:testpass]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test2041 b/third-party/curl/tests/data/test2041
index 42dca779e3..f7fb7ec3b1 100644
--- a/third-party/curl/tests/data/test2041
+++ b/third-party/curl/tests/data/test2041
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ PEM certificate
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -20,33 +20,28 @@ MooMoo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 SSL
 SSLpinning
 !Schannel
+local-http
 </features>
 <server>
-https Server-localhost-sv.pem
+https test-localhost.pem
 </server>
- <name>
+<name>
 simple HTTPS GET with base64-sha256 public key pinning
- </name>
- <command>
---cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --pinnedpubkey sha256//AAUDLk4c98xcFUDvA9i/MnA9HuO03IPi15r+Cx9OXnc= https://localhost:%HTTPSPORT/%TESTNUMBER
+</name>
+<command>
+-4 --cacert %CERTDIR/certs/test-ca.crt --pinnedpubkey sha256//%sha256b64file[%CERTDIR/certs/test-localhost.pub.der]sha256b64file% https://localhost:%HTTPSPORT/%TESTNUMBER
 </command>
-# Ensure that we're running on localhost because we're checking the host name
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: localhost:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2042 b/third-party/curl/tests/data/test2042
index b6b9bcc5ae..4429fb3e1e 100644
--- a/third-party/curl/tests/data/test2042
+++ b/third-party/curl/tests/data/test2042
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,34 +8,28 @@ PEM certificate
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 SSL
 SSLpinning
+local-http
 </features>
 <server>
-https Server-localhost-sv.pem
+https test-localhost.pem
 </server>
- <name>
+<name>
 HTTPS wrong base64-sha256 pinnedpubkey but right CN
- </name>
- <command>
---cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --pinnedpubkey sha256//bSIggTf+ikMG0CtmDlpMVBd7yi7H1md4URogRPqerso= https://localhost:%HTTPSPORT/%TESTNUMBER
+</name>
+<command>
+-4 --cacert %CERTDIR/certs/test-ca.crt --pinnedpubkey sha256//bSIggTf+ikMG0CtmDlpMVBd7yi7H1md4URogRPqerso= https://localhost:%HTTPSPORT/%TESTNUMBER
 </command>
-# Ensure that we're running on localhost because we're checking the host name
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test2043 b/third-party/curl/tests/data/test2043
index 754a9b92ea..03f5b03f96 100644
--- a/third-party/curl/tests/data/test2043
+++ b/third-party/curl/tests/data/test2043
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,24 +7,19 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <features>
 Schannel
 </features>
-<server>
-none
-</server>
- <name>
+<name>
 Disable certificate revocation checks
- </name>
- <command>
+</name>
+<command>
 --ssl-no-revoke -I https://revoked.badssl.com/
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test2044 b/third-party/curl/tests/data/test2044
index 33e81a8d9a..3e3199f280 100644
--- a/third-party/curl/tests/data/test2044
+++ b/third-party/curl/tests/data/test2044
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,15 +6,8 @@
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<features>
-none
-</features>
-<server>
-none
-</server>
 <name>
 Attempt to set a default protocol that does not exist
 </name>
@@ -22,7 +16,6 @@ Attempt to set a default protocol that does not exist
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # CURLE_UNSUPPORTED_PROTOCOL is error code 1
diff --git a/third-party/curl/tests/data/test2045 b/third-party/curl/tests/data/test2045
index 15647d3e71..dd814abb6c 100644
--- a/third-party/curl/tests/data/test2045
+++ b/third-party/curl/tests/data/test2045
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,32 +7,24 @@ FTP
 </keywords>
 </info>
 
-
-#
 # Server-side
 <reply>
-<!--
-The purpose of this test is to make sure the --proto-default option works
-properly. We specify a default protocol of FTP and if the option works properly
-curl will use the FTP protocol. If the option is broken however curl will use
-the HTTP protocol.
-In the broken scenario curl would use HTTP to talk to our FTP server. We handle
-that by replying with something that both protocols can understand. Our FTP
-server allows a custom welcome message, so we use that feature to make an HTTP
-reply that contains an FTP reply (think polyglot). In the case of FTP we expect
-curl will return CURLE_WEIRD_SERVER_REPLY so we test for that return code.
--->
+# The purpose of this test is to make sure the --proto-default option works
+# properly. We specify a default protocol of FTP and if the option works properly
+# curl uses the FTP protocol. If the option is broken however curl uses
+# the HTTP protocol.
+# In the broken scenario curl would use HTTP to talk to our FTP server. We handle
+# that by replying with something that both protocols can understand. Our FTP
+# server allows a custom welcome message, so we use that feature to make an HTTP
+# reply that contains an FTP reply (think polyglot). In the case of FTP we expect
+# curl to return CURLE_WEIRD_SERVER_REPLY so we test for that return code.
 <servercmd>
 REPLY welcome HTTP/1.1 200 OK\r\nContent-Length: 21\r\n\r\n500 Weird FTP Reply
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
-<features>
-none
-</features>
 <server>
 ftp
 </server>
@@ -43,7 +36,6 @@ Set the default protocol to ftp for a schemeless URL
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # CURLE_WEIRD_SERVER_REPLY is error code 8
diff --git a/third-party/curl/tests/data/test2046 b/third-party/curl/tests/data/test2046
index 8fe2fc269b..76692aeb90 100644
--- a/third-party/curl/tests/data/test2046
+++ b/third-party/curl/tests/data/test2046
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ followlocation
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -32,35 +32,30 @@ OK
 </data1>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 <features>
-idn
+IDN
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=en_US.UTF-8
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
-Connection reuse with IDN host name
- </name>
+<name>
+Connection reuse with IDN hostname
+</name>
 
- <command>
-http://åäö.se:%HTTPPORT/%TESTNUMBER --resolve xn--4cab6c.se:%HTTPPORT:%HOSTIP -w "%{num_connects}\n%{num_redirects}\n%{size_download}\n%{url_effective}\n%{content_type}\n%{response_code}\n" -L
+<command>
+http://%hex[%c3%a5%c3%a4%c3%b6]hex%.se:%HTTPPORT/%TESTNUMBER --resolve xn--4cab6c.se:%HTTPPORT:%HOSTIP -w "%{num_connects}\n%{num_redirects}\n%{size_download}\n%{url_effective}\n%{content_type}\n%{response_code}\n" -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: xn--4cab6c.se:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -89,7 +84,7 @@ OK
 1
 1
 3
-http://åäö.se:%HTTPPORT/%TESTNUMBER0001
+http://%hex[%c3%a5%c3%a4%c3%b6]hex%.se:%HTTPPORT/%TESTNUMBER0001
 text/plain; charset=us-ascii
 200
 </stdout>
diff --git a/third-party/curl/tests/data/test2047 b/third-party/curl/tests/data/test2047
index 09ce715e7f..ba05a6426b 100644
--- a/third-party/curl/tests/data/test2047
+++ b/third-party/curl/tests/data/test2047
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ followlocation
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -32,36 +32,31 @@ OK
 </data1>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 <features>
-idn
+IDN
 proxy
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=en_US.UTF-8
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
-Connection reuse with IDN host name over HTTP proxy
- </name>
+<name>
+Connection reuse with IDN hostname over HTTP proxy
+</name>
 
- <command>
-http://åäö.se/%TESTNUMBER -x %HOSTIP:%HTTPPORT -w "%{num_connects}\n%{num_redirects}\n%{size_download}\n%{url_effective}\n%{content_type}\n%{response_code}\n" -L
+<command>
+http://%hex[%c3%a5%c3%a4%c3%b6]hex%.se/%TESTNUMBER -x %HOSTIP:%HTTPPORT -w "%{num_connects}\n%{num_redirects}\n%{size_download}\n%{url_effective}\n%{content_type}\n%{response_code}\n" -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://xn--4cab6c.se/%TESTNUMBER HTTP/1.1
 Host: xn--4cab6c.se
 User-Agent: curl/%VERSION
@@ -92,7 +87,7 @@ OK
 1
 1
 3
-http://åäö.se/%TESTNUMBER0001
+http://%hex[%c3%a5%c3%a4%c3%b6]hex%.se/%TESTNUMBER0001
 text/plain; charset=us-ascii
 200
 </stdout>
diff --git a/third-party/curl/tests/data/test2048 b/third-party/curl/tests/data/test2048
index f14c8fbe82..1c05823b4c 100644
--- a/third-party/curl/tests/data/test2048
+++ b/third-party/curl/tests/data/test2048
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,12 +8,10 @@ PEM certificate
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -20,17 +19,16 @@ SSL
 SSLpinning
 </features>
 <server>
-https Server-localhost-sv.pem
+https test-localhost.pem
 </server>
 <name>
 pinnedpubkey no-match must fail even when insecure
 </name>
 <command>
---insecure --cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --pinnedpubkey %SRCDIR/certs/Server-localhost.nn-sv.pub.der https://localhost:%HTTPSPORT/%TESTNUMBER
+-4 --insecure --cacert %CERTDIR/certs/test-ca.crt --pinnedpubkey %CERTDIR/certs/test-localhost.nn.pub.der https://localhost:%HTTPSPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test2049 b/third-party/curl/tests/data/test2049
index 02d5d181df..ea7f19e3a4 100644
--- a/third-party/curl/tests/data/test2049
+++ b/third-party/curl/tests/data/test2049
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ CURLOPT_CONNECT_TO
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -20,25 +20,26 @@ OK
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 Connect to specific host
- </name>
+</name>
 
- <command>
-http://www1.example.com:8081/%TESTNUMBER --connect-to ::%HOSTIP:%HTTPPORT --next http://www2.example.com:8082/%TESTNUMBER --connect-to :8082:%HOSTIP:%HTTPPORT --next http://www3.example.com:8083/%TESTNUMBER --connect-to www3.example.com::%HOSTIP:%HTTPPORT --next http://www4.example.com:8084/%TESTNUMBER --connect-to www4.example.com:8084:%HOSTIP:%HTTPPORT
+<command>
+http://www1.example.com:8081/%TESTNUMBER --connect-to ::%HOSTIP:%HTTPPORT --next
+http://www2.example.com:8082/%TESTNUMBER --connect-to :8082:%HOSTIP:%HTTPPORT --next
+http://www3.example.com:8083/%TESTNUMBER --connect-to www3.example.com::%HOSTIP:%HTTPPORT --next
+http://www4.example.com:8084/%TESTNUMBER --connect-to www4.example.com:8084:%HOSTIP:%HTTPPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: www1.example.com:8081
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test205 b/third-party/curl/tests/data/test205
index e2165ccd10..3324d7d64f 100644
--- a/third-party/curl/tests/data/test205
+++ b/third-party/curl/tests/data/test205
@@ -1,8 +1,8 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FILE
-FAILURE
 </keywords>
 </info>
 
@@ -13,11 +13,11 @@ FAILURE
 <server>
 file
 </server>
- <name>
-"upload" with file://
- </name>
+<name>
+"upload" nonexisting with file://
+</name>
 <command option="no-include">
-file://localhost/%PWD/%LOGDIR/nonexisting/result%TESTNUMBER.txt -T %LOGDIR/upload%TESTNUMBER.txt
+file://localhost/%FILE_PWD/%LOGDIR/nonexisting/result%TESTNUMBER.txt -T %LOGDIR/upload%TESTNUMBER.txt
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER.txt">
 data
diff --git a/third-party/curl/tests/data/test2050 b/third-party/curl/tests/data/test2050
index 46b6143e0c..3c2a9b40f5 100644
--- a/third-party/curl/tests/data/test2050
+++ b/third-party/curl/tests/data/test2050
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ CURLOPT_CONNECT_TO
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <connect>
@@ -39,36 +39,41 @@ OK
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 http-proxy
 </server>
- <name>
-Connect to specific host via HTTP proxy (switch to tunnel mode automatically)
- </name>
+<name>
+--connect-to via HTTP proxy (tunnel mode automatically)
+</name>
 
- <command>
-http://www.example.com.%TESTNUMBER/%TESTNUMBER --connect-to ::connect.example.com.%TESTNUMBER:%HTTPPORT -x %HOSTIP:%PROXYPORT
+<command>
+http://www.example.com.%TESTNUMBER/%TESTNUMBER --connect-to ::connect.example.com.%TESTNUMBER:%HTTPPORT -x %HOSTIP:%PROXYPORT --next
+http://www.example.com.%TESTNUMBER:%HTTPPORT/%TESTNUMBER --connect-to ::www.example.com.%TESTNUMBER:%HTTPPORT -x %HOSTIP:%PROXYPORT
 </command>
 <features>
 proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="yes">
 CONNECT connect.example.com.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: connect.example.com.%TESTNUMBER:%HTTPPORT
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
+GET http://www.example.com.%TESTNUMBER:%HTTPPORT/%TESTNUMBER HTTP/1.1
+Host: www.example.com.%TESTNUMBER:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
 </proxy>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: www.example.com.%TESTNUMBER
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2051 b/third-party/curl/tests/data/test2051
index f89076cdbc..c3d0920688 100644
--- a/third-party/curl/tests/data/test2051
+++ b/third-party/curl/tests/data/test2051
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ CURLOPT_CONNECT_TO
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -20,25 +20,25 @@ OK
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
-Connect to specific host: Re-use existing connections if possible
- </name>
+<name>
+Connect to specific host: Reuse existing connections if possible
+</name>
 
- <command>
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w "%{num_connects}\n" --next --connect-to ::%HOSTIP:%HTTPPORT http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w "%{num_connects}\n" --next http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w "%{num_connects}\n"
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w "%{num_connects}\n" --next --connect-to ::%HOSTIP:%HTTPPORT
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w "%{num_connects}\n" --next
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w "%{num_connects}\n"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2052 b/third-party/curl/tests/data/test2052
index 8d2bfd8243..85d3d0988d 100644
--- a/third-party/curl/tests/data/test2052
+++ b/third-party/curl/tests/data/test2052
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ CURLOPT_CONNECT_TO
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -21,25 +21,27 @@ OK
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
-Connect to specific host: Do not mix connections with and without a "connect to host"
- </name>
+<name>
+--connect-to: do not mix connections with and without a "connect to host"
+</name>
 
- <command>
-http://www.example.com:%HTTPPORT/%TESTNUMBER --resolve www.example.com:%HTTPPORT:%HOSTIP -w "%{num_connects}\n" --next --resolve -www.example.com:%HTTPPORT --connect-to ::%HOSTIP:%HTTPPORT http://www.example.com:%HTTPPORT/%TESTNUMBER -w "%{num_connects}\n"
+<command>
+http://www.example.com:%HTTPPORT/%TESTNUMBER
+--resolve www.example.com:%HTTPPORT:%HOSTIP -w "%{num_connects}\n"
+--next
+--resolve -www.example.com:%HTTPPORT --connect-to ::%HOSTIP:%HTTPPORT
+http://www.example.com:%HTTPPORT/%TESTNUMBER -w "%{num_connects}\n"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: www.example.com:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2053 b/third-party/curl/tests/data/test2053
index 68d5420d6b..8e53cd741f 100644
--- a/third-party/curl/tests/data/test2053
+++ b/third-party/curl/tests/data/test2053
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ CURLOPT_CONNECT_TO
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -20,32 +20,31 @@ OK
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 Connect to specific host with IP addresses
- </name>
+</name>
 
- <command>
-http://10.0.0.1:8081/%TESTNUMBER --connect-to 10.0.0.1:8081:%HOSTIP:%HTTPPORT --next http://[fc00::1]:8082/%TESTNUMBER --connect-to [fc00::1]:8082:%HOSTIP:%HTTPPORT
+<command>
+http://10.0.0.1:8081/%TESTNUMBER  --connect-to 10.0.0.1:8081:%HOSTIP:%HTTPPORT --next
+http://[fc00::1]:8081/%TESTNUMBER --connect-to [fc00::1]:8081:%HOSTIP:%HTTPPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: 10.0.0.1:8081
 User-Agent: curl/%VERSION
 Accept: */*
 
 GET /%TESTNUMBER HTTP/1.1
-Host: [fc00::1]:8082
+Host: [fc00::1]:8081
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test2054 b/third-party/curl/tests/data/test2054
index 5f7d1ffa28..83f203586d 100644
--- a/third-party/curl/tests/data/test2054
+++ b/third-party/curl/tests/data/test2054
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ CURLOPT_CONNECT_TO
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -20,25 +20,37 @@ OK
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 Connect to specific host: use the first "connect-to" string that matches
- </name>
+</name>
 
- <command>
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER --connect-to foo::bar: --connect-to :123::456 --next http://www.example.com:%HTTPPORT/%TESTNUMBER --connect-to www.example.com::%HOSTIP: --connect-to www.example.com::foo: --next http://%HOSTIP:8083/%TESTNUMBER --connect-to :8083::%HTTPPORT --connect-to :8083::123 --next http://www.example.com:8084/%TESTNUMBER --connect-to www.example.com:8084:%HOSTIP:%HTTPPORT --connect-to www.example.com:8084:foo:123
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+--connect-to foo::bar:
+--connect-to :123::456
+--next
+http://www.example.com:%HTTPPORT/%TESTNUMBER
+--connect-to www.example.com::%HOSTIP:
+--connect-to www.example.com::foo:
+--next
+http://%HOSTIP:8083/%TESTNUMBER
+--connect-to :8083::%HTTPPORT
+--connect-to :8083::123
+--next
+http://www.example.com:8084/%TESTNUMBER
+--connect-to www.example.com:8084:%HOSTIP:%HTTPPORT
+--connect-to www.example.com:8084:foo:123
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2055 b/third-party/curl/tests/data/test2055
index 85a438e535..6a7a8d34ac 100644
--- a/third-party/curl/tests/data/test2055
+++ b/third-party/curl/tests/data/test2055
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,6 @@ SOCKS5
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <connect>
@@ -40,7 +40,6 @@ OK
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -48,28 +47,34 @@ http
 http-proxy
 socks5
 </server>
- <name>
-Connect to specific host via SOCKS proxy and HTTP proxy (switch to tunnel mode automatically)
- </name>
+<name>
+--connect-to via SOCKS proxy and HTTP proxy (tunnel mode automatically)
+</name>
 <features>
 proxy
 </features>
- <command>
-http://www.example.com.%TESTNUMBER/%TESTNUMBER --connect-to ::connect.example.com.%TESTNUMBER:%HTTPPORT -x %HOSTIP:%PROXYPORT --preproxy socks5://%HOSTIP:%SOCKSPORT
+<command>
+http://www.example.com.%TESTNUMBER/%TESTNUMBER --connect-to ::connect.example.com.%TESTNUMBER:%HTTPPORT -x %HOSTIP:%PROXYPORT --preproxy socks5://%HOSTIP:%SOCKSPORT --next
+http://www.example.com.%TESTNUMBER:%HTTPPORT/%TESTNUMBER --connect-to ::www.example.com.%TESTNUMBER:%HTTPPORT -x %HOSTIP:%PROXYPORT --preproxy socks5://%HOSTIP:%SOCKSPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="yes">
 CONNECT connect.example.com.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: connect.example.com.%TESTNUMBER:%HTTPPORT
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
+GET http://www.example.com.%TESTNUMBER:%HTTPPORT/%TESTNUMBER HTTP/1.1
+Host: www.example.com.%TESTNUMBER:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
 </proxy>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: www.example.com.%TESTNUMBER
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2056 b/third-party/curl/tests/data/test2056
index 6f190ca529..bf842b5dcd 100644
--- a/third-party/curl/tests/data/test2056
+++ b/third-party/curl/tests/data/test2056
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -39,11 +40,9 @@ HTTP Negotiate authentication (stub krb5)
 </name>
 <features>
 GSS-API
-ld_preload
-!debug
+Debug
 </features>
 <setenv>
-LD_PRELOAD=%PWD/libtest/.libs/libstubgss.so
 CURL_STUB_GSS_CREDS="KRB5_Alice"
 </setenv>
 <command>
@@ -53,10 +52,10 @@ CURL_STUB_GSS_CREDS="KRB5_Alice"
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Negotiate IktSQjVfQWxpY2UiOkhUVFBAMTI3LjAuMC4xOjE6QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQQ==
+Authorization: Negotiate %b64["KRB5_Alice":HTTP@127.0.0.1:1:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test2057 b/third-party/curl/tests/data/test2057
index 700139a5d9..18ce33d947 100644
--- a/third-party/curl/tests/data/test2057
+++ b/third-party/curl/tests/data/test2057
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -51,15 +52,13 @@ Nice auth sir!
 http
 </server>
 <name>
-HTTP Negotiate authentication (stub ntlm)
+HTTP Negotiate authentication (stub NTLM)
 </name>
 <features>
 GSS-API
-ld_preload
-!debug
+Debug
 </features>
 <setenv>
-LD_PRELOAD=%PWD/libtest/.libs/libstubgss.so
 CURL_STUB_GSS_CREDS="NTLM_Alice"
 </setenv>
 <command>
@@ -69,16 +68,16 @@ CURL_STUB_GSS_CREDS="NTLM_Alice"
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Negotiate Ik5UTE1fQWxpY2UiOkhUVFBAMTI3LjAuMC4xOjI6QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQQ==
+Authorization: Negotiate %b64["NTLM_Alice":HTTP@127.0.0.1:2:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Negotiate Ik5UTE1fQWxpY2UiOkhUVFBAMTI3LjAuMC4xOjM6QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQQ==
+Authorization: Negotiate %b64["NTLM_Alice":HTTP@127.0.0.1:3:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test2058 b/third-party/curl/tests/data/test2058
index 606e1c5113..29c5c6456b 100644
--- a/third-party/curl/tests/data/test2058
+++ b/third-party/curl/tests/data/test2058
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -13,20 +14,20 @@ CUSTOMREQUEST
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 100 Continue
 Server: Microsoft-IIS/5.0
 Date: Sun, 03 Apr 2005 14:57:45 GMT
 X-Powered-By: ASP.NET
 
-HTTP/1.1 401 authentication please swsbounce
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", algorithm="SHA-256", nonce="1053604144"
 Content-Type: text/html; charset=iso-8859-1
 Content-Length: 0
 
 </data>
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 A OK
 Server: Microsoft-IIS/6.0
 Content-Type: text/html; charset=iso-8859-1
@@ -35,13 +36,13 @@ Content-Length: 3
 ok
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 100 Continue
 Server: Microsoft-IIS/5.0
 Date: Sun, 03 Apr 2005 14:57:45 GMT
 X-Powered-By: ASP.NET
 
-HTTP/1.1 401 authentication please swsbounce
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", algorithm="SHA-256", nonce="1053604144"
 Content-Type: text/html; charset=iso-8859-1
@@ -59,7 +60,6 @@ ok
 
 # Client-side
 <client>
-#
 <server>
 http
 </server>
@@ -67,11 +67,12 @@ http
 !SSPI
 crypto
 proxy
+digest
 </features>
- <name>
-HTTP POST --digest with PUT, resumed upload, modified method and SHA-256
- </name>
- <command>
+<name>
+HTTP Digest with PUT, resumed upload, modified method and SHA-256
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u auser:apasswd --digest -T %LOGDIR/%TESTNUMBER -x  http://%HOSTIP:%HTTPPORT -C 2 -X GET
 </command>
 <file name="%LOGDIR/%TESTNUMBER">
@@ -81,7 +82,7 @@ test
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Content-Range: bytes 2-4/5
diff --git a/third-party/curl/tests/data/test2059 b/third-party/curl/tests/data/test2059
index ff60a2b476..4726c0a1e6 100644
--- a/third-party/curl/tests/data/test2059
+++ b/third-party/curl/tests/data/test2059
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -13,20 +14,20 @@ CUSTOMREQUEST
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 100 Continue
 Server: Microsoft-IIS/5.0
 Date: Sun, 03 Apr 2005 14:57:45 GMT
 X-Powered-By: ASP.NET
 
-HTTP/1.1 401 authentication please swsbounce
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", algorithm="SHA-256", nonce="1053604144", userhash=true
 Content-Type: text/html; charset=iso-8859-1
 Content-Length: 0
 
 </data>
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 A OK
 Server: Microsoft-IIS/6.0
 Content-Type: text/html; charset=iso-8859-1
@@ -35,13 +36,13 @@ Content-Length: 3
 ok
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 100 Continue
 Server: Microsoft-IIS/5.0
 Date: Sun, 03 Apr 2005 14:57:45 GMT
 X-Powered-By: ASP.NET
 
-HTTP/1.1 401 authentication please swsbounce
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", algorithm="SHA-256", nonce="1053604144", userhash=true
 Content-Type: text/html; charset=iso-8859-1
@@ -59,7 +60,6 @@ ok
 
 # Client-side
 <client>
-#
 <server>
 http
 </server>
@@ -67,11 +67,12 @@ http
 !SSPI
 crypto
 proxy
+digest
 </features>
- <name>
-HTTP POST --digest with PUT, resumed upload, modified method, SHA-256 and userhash=true
- </name>
- <command>
+<name>
+HTTP Digest with PUT, resumed upload, modified method, SHA-256 and userhash
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u auser:apasswd --digest -T %LOGDIR/%TESTNUMBER -x  http://%HOSTIP:%HTTPPORT -C 2 -X GET
 </command>
 <file name="%LOGDIR/%TESTNUMBER">
@@ -81,7 +82,7 @@ test
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Content-Range: bytes 2-4/5
diff --git a/third-party/curl/tests/data/test206 b/third-party/curl/tests/data/test206
index ab0e7e1984..f151904d80 100644
--- a/third-party/curl/tests/data/test206
+++ b/third-party/curl/tests/data/test206
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -17,9 +18,8 @@ connection-monitor
 auth_required
 </servercmd>
 
-
 # this is returned first since we get no proxy-auth
-<connect>
+<connect crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me my dear
 Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
 Content-Length: 33
@@ -41,19 +41,19 @@ daniel
 
 # then this is returned when we get proxy-auth
 <connect1000>
-HTTP/1.1 200 OK swsbounce
+HTTP/1.1 200 OK%CR
 Server: no
-
+%CR
 </connect1000>
 
 <datacheck>
-HTTP/1.1 407 Authorization Required to proxy me my dear
-Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
-Content-Length: 33
-
-HTTP/1.1 200 OK swsbounce
+HTTP/1.1 407 Authorization Required to proxy me my dear%CR
+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"%CR
+Content-Length: 33%CR
+%CR
+HTTP/1.1 200 OK%CR
 Server: no
-
+%CR
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 7
@@ -74,18 +74,19 @@ http
 !SSPI
 crypto
 proxy
+digest
 </features>
- <name>
+<name>
 HTTP proxy CONNECT auth Digest
- </name>
- <command>
-http://test.remote.haxx.se.%TESTNUMBER:8990/path/%TESTNUMBER0002 --proxy http://%HOSTIP:%HTTPPORT --proxy-user silly:person --proxy-digest --proxytunnel
+</name>
+<command>
+http://test.remote.haxx.se.%TESTNUMBER:8990/path/%TESTNUMBER0002 --proxy=http://%HOSTIP:%HTTPPORT --proxy-user=silly:person --proxy-digest --proxytunnel
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 CONNECT test.remote.haxx.se.%TESTNUMBER:8990 HTTP/1.1
 Host: test.remote.haxx.se.%TESTNUMBER:8990
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2060 b/third-party/curl/tests/data/test2060
index 2005288c03..a623cd354b 100644
--- a/third-party/curl/tests/data/test2060
+++ b/third-party/curl/tests/data/test2060
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -13,20 +14,20 @@ CUSTOMREQUEST
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 100 Continue
 Server: Microsoft-IIS/5.0
 Date: Sun, 03 Apr 2005 14:57:45 GMT
 X-Powered-By: ASP.NET
 
-HTTP/1.1 401 authentication please swsbounce
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", algorithm="SHA-512-256", nonce="1053604144"
 Content-Type: text/html; charset=iso-8859-1
 Content-Length: 0
 
 </data>
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 A OK
 Server: Microsoft-IIS/6.0
 Content-Type: text/html; charset=iso-8859-1
@@ -35,13 +36,13 @@ Content-Length: 3
 ok
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 100 Continue
 Server: Microsoft-IIS/5.0
 Date: Sun, 03 Apr 2005 14:57:45 GMT
 X-Powered-By: ASP.NET
 
-HTTP/1.1 401 authentication please swsbounce
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", algorithm="SHA-512-256", nonce="1053604144"
 Content-Type: text/html; charset=iso-8859-1
@@ -59,7 +60,6 @@ ok
 
 # Client-side
 <client>
-#
 <server>
 http
 </server>
@@ -67,11 +67,12 @@ http
 !SSPI
 crypto
 proxy
+sha512-256
 </features>
- <name>
-HTTP POST --digest with PUT, resumed upload, modified method, SHA-512-256 and userhash=false
- </name>
- <command>
+<name>
+HTTP Digest with PUT, resumed upload, SHA-512-256, userhash
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u auser:apasswd --digest -T %LOGDIR/%TESTNUMBER -x  http://%HOSTIP:%HTTPPORT -C 2 -X GET
 </command>
 <file name="%LOGDIR/%TESTNUMBER">
@@ -81,7 +82,7 @@ test
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Content-Range: bytes 2-4/5
@@ -92,7 +93,7 @@ Content-Length: 0
 
 GET http://%HOSTIP:%HTTPPORT/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Digest username="auser", realm="testrealm", nonce="1053604144", uri="/%TESTNUMBER", response="3ce1e25ffa611bdbe90e2ab367b9602fa223db9f6de76ac667f0d6157e2178a6", algorithm=SHA-512-256
+Authorization: Digest username="auser", realm="testrealm", nonce="1053604144", uri="/%TESTNUMBER", response="691867f4a06c79fd0a175c1857e3df7015f6fff3ce8676497d2f1f805b5a8eca", algorithm=SHA-512-256
 Content-Range: bytes 2-4/5
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test2061 b/third-party/curl/tests/data/test2061
index ec58394e12..50ae2f8ee7 100644
--- a/third-party/curl/tests/data/test2061
+++ b/third-party/curl/tests/data/test2061
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP Digest auth
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145", algorithm="SHA-256"
@@ -20,7 +21,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -29,7 +30,7 @@ Content-Length: 23
 This IS the real page!
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145", algorithm="SHA-256"
@@ -54,18 +55,19 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP with RFC7616 SHA256 Digest authorization
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --digest
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2062 b/third-party/curl/tests/data/test2062
index aef33b8428..3d51ccc24d 100644
--- a/third-party/curl/tests/data/test2062
+++ b/third-party/curl/tests/data/test2062
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP Digest auth
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145", algorithm="SHA-512-256"
@@ -20,7 +21,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -29,7 +30,7 @@ Content-Length: 23
 This IS the real page!
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145", algorithm="SHA-512-256"
@@ -54,18 +55,19 @@ http
 <features>
 !SSPI
 crypto
+sha512-256
 </features>
- <name>
+<name>
 HTTP with RFC7616 SHA-512-256 Digest authorization and userhash=false
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --digest
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -73,7 +75,7 @@ Accept: */*
 
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Digest username="testuser", realm="testrealm", nonce="1053604145", uri="/%TESTNUMBER", response="2af735ec3508f4dff99248ffbbe9de9002bfd7cc770cfa2b026cb334042a54e3", algorithm=SHA-512-256
+Authorization: Digest username="testuser", realm="testrealm", nonce="1053604145", uri="/%TESTNUMBER", response="9d3256ee6526ec40dd48743bb48e51ee9baba587c78f15c3a86166242150af98", algorithm=SHA-512-256
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test2063 b/third-party/curl/tests/data/test2063
index 62a515ffe8..4ccf4d4410 100644
--- a/third-party/curl/tests/data/test2063
+++ b/third-party/curl/tests/data/test2063
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP Digest auth
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145", algorithm="SHA-256", userhash=true
@@ -20,7 +21,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -29,7 +30,7 @@ Content-Length: 23
 This IS the real page!
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145", algorithm="SHA-256", userhash=true
@@ -54,18 +55,19 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP with RFC7616 SHA-256 Digest authorization and userhash=true
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --digest
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2064 b/third-party/curl/tests/data/test2064
index 50070eb389..d3897535c6 100644
--- a/third-party/curl/tests/data/test2064
+++ b/third-party/curl/tests/data/test2064
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP Digest auth
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 HTTP/1.1 401 Authorization Required
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="2053604145", algorithm="SHA-256"
@@ -20,7 +21,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="yes">
 HTTP/1.1 401 Still a bad password you moron
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -29,7 +30,7 @@ Content-Length: 34
 This is not the real page either
 </data1000>
 
-<datacheck>
+<datacheck crlf="yes">
 HTTP/1.1 401 Authorization Required
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="2053604145", algorithm="SHA-256"
@@ -54,18 +55,19 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP with RFC7616 Digest authorization with bad password and SHA256
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:test2pass --digest
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2065 b/third-party/curl/tests/data/test2065
index 6034d21190..e0d0be1f24 100644
--- a/third-party/curl/tests/data/test2065
+++ b/third-party/curl/tests/data/test2065
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP Digest auth
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="2053604145", algorithm="SHA-512-256"
@@ -20,7 +21,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="yes">
 HTTP/1.1 401 Still a bad password you moron
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -29,7 +30,7 @@ Content-Length: 34
 This is not the real page either
 </data1000>
 
-<datacheck>
+<datacheck crlf="yes">
 HTTP/1.1 401 Authorization Required
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="2053604145", algorithm="SHA-512-256"
@@ -54,18 +55,19 @@ http
 <features>
 !SSPI
 crypto
+sha512-256
 </features>
- <name>
-HTTP with RFC7616 Digest authorization with bad password, SHA-512-256 and userhash=false
- </name>
- <command>
+<name>
+HTTP with RFC7616 Digest, bad password, SHA-512-256 and userhash
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:test2pass --digest
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -73,7 +75,7 @@ Accept: */*
 
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Digest username="testuser", realm="testrealm", nonce="2053604145", uri="/%TESTNUMBER", response="5a5f20b0e601aeddc6f96422c2332d49ff431c49ab143b5f836ef76e9ac78f5e", algorithm=SHA-512-256
+Authorization: Digest username="testuser", realm="testrealm", nonce="2053604145", uri="/%TESTNUMBER", response="0373a49d7d352ff54884faaf762fc6c89281b4112ad8fcbbe1d1ee52dcf7a802", algorithm=SHA-512-256
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test2066 b/third-party/curl/tests/data/test2066
index 18d8e1dab0..38ff6bebb2 100644
--- a/third-party/curl/tests/data/test2066
+++ b/third-party/curl/tests/data/test2066
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP Digest auth
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="2053604145", algorithm="SHA-256", userhash=true
@@ -20,7 +21,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="yes">
 HTTP/1.1 401 Still a bad password you moron
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -29,7 +30,7 @@ Content-Length: 34
 This is not the real page either
 </data1000>
 
-<datacheck>
+<datacheck crlf="yes">
 HTTP/1.1 401 Authorization Required
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="2053604145", algorithm="SHA-256", userhash=true
@@ -54,18 +55,19 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
-HTTP with RFC7616 Digest authorization with bad password, SHA-256 and userhash=true
- </name>
- <command>
+<name>
+HTTP with RFC7616 Digest, bad password, SHA-256 and userhash
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:test2pass --digest
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2067 b/third-party/curl/tests/data/test2067
index cbff7b74ed..b6de16d0bd 100644
--- a/third-party/curl/tests/data/test2067
+++ b/third-party/curl/tests/data/test2067
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,15 +10,15 @@ HTTP Digest auth
 
 # Server-side
 <reply>
-<data>
-HTTP/1.1 401 authentication please swsbounce
+<data crlf="headers">
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144", algorithm="SHA-256"
 Content-Type: text/html; charset=iso-8859-1
 Content-Length: 0
 
 </data>
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 A OK
 Server: Microsoft-IIS/6.0
 Content-Type: text/html; charset=iso-8859-1
@@ -26,8 +27,8 @@ Content-Length: 3
 ok
 </data1000>
 
-<datacheck>
-HTTP/1.1 401 authentication please swsbounce
+<datacheck crlf="headers">
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144", algorithm="SHA-256"
 Content-Type: text/html; charset=iso-8859-1
@@ -45,13 +46,13 @@ ok
 
 # Client-side
 <client>
-#
 <server>
 http
 </server>
 <features>
 !SSPI
 crypto
+digest
 </features>
 <name>
 HTTP POST --digest with SHA256 and user-specified Content-Length header
@@ -66,7 +67,7 @@ HTTP POST --digest with SHA256 and user-specified Content-Length header
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2068 b/third-party/curl/tests/data/test2068
index 4ca394afb9..0dc686b669 100644
--- a/third-party/curl/tests/data/test2068
+++ b/third-party/curl/tests/data/test2068
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,15 +10,15 @@ HTTP Digest auth
 
 # Server-side
 <reply>
-<data>
-HTTP/1.1 401 authentication please swsbounce
+<data crlf="headers">
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144", algorithm="SHA-512-256"
 Content-Type: text/html; charset=iso-8859-1
 Content-Length: 0
 
 </data>
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 A OK
 Server: Microsoft-IIS/6.0
 Content-Type: text/html; charset=iso-8859-1
@@ -26,8 +27,8 @@ Content-Length: 3
 ok
 </data1000>
 
-<datacheck>
-HTTP/1.1 401 authentication please swsbounce
+<datacheck crlf="headers">
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144", algorithm="SHA-512-256"
 Content-Type: text/html; charset=iso-8859-1
@@ -45,16 +46,16 @@ ok
 
 # Client-side
 <client>
-#
 <server>
 http
 </server>
 <features>
 !SSPI
 crypto
+sha512-256
 </features>
 <name>
-HTTP POST --digest with SHA-512-256, userhash=false and user-specified Content-Length header
+HTTP POST Digest with SHA-512-256, userhash and set Content-Length
 </name>
 # This test is to ensure 'Content-Length: 0' is sent while negotiating auth
 # even when there is a user-specified Content-Length header.
@@ -66,7 +67,7 @@ HTTP POST --digest with SHA-512-256, userhash=false and user-specified Content-L
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -76,7 +77,7 @@ Content-Type: application/x-www-form-urlencoded
 
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Digest username="auser", realm="testrealm", nonce="1053604144", uri="/%TESTNUMBER", response="4bc9c97a72f1856bcec9b0e1518c6b7ee28773f91357d56840bdc30bd89ca68f", algorithm=SHA-512-256
+Authorization: Digest username="auser", realm="testrealm", nonce="1053604144", uri="/%TESTNUMBER", response="0ba2f7ec8045446588eea82bb0c3812aedb05f4eac8883ea65040a52e9c5629e", algorithm=SHA-512-256
 User-Agent: curl/%VERSION
 Accept: */*
 Content-Length: 11
diff --git a/third-party/curl/tests/data/test2069 b/third-party/curl/tests/data/test2069
index 82c7ec3bcb..b8032d349b 100644
--- a/third-party/curl/tests/data/test2069
+++ b/third-party/curl/tests/data/test2069
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,15 +10,15 @@ HTTP Digest auth
 
 # Server-side
 <reply>
-<data>
-HTTP/1.1 401 authentication please swsbounce
+<data crlf="headers">
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144", algorithm="SHA-256", userhash=true
 Content-Type: text/html; charset=iso-8859-1
 Content-Length: 0
 
 </data>
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 A OK
 Server: Microsoft-IIS/6.0
 Content-Type: text/html; charset=iso-8859-1
@@ -26,8 +27,8 @@ Content-Length: 3
 ok
 </data1000>
 
-<datacheck>
-HTTP/1.1 401 authentication please swsbounce
+<datacheck crlf="headers">
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144", algorithm="SHA-256", userhash=true
 Content-Type: text/html; charset=iso-8859-1
@@ -45,16 +46,16 @@ ok
 
 # Client-side
 <client>
-#
 <server>
 http
 </server>
 <features>
 !SSPI
 crypto
+digest
 </features>
 <name>
-HTTP POST --digest with SHA-256, userhash=true and user-specified Content-Length header
+HTTP POST Digest with SHA-256, userhash and set Content-Length header
 </name>
 # This test is to ensure 'Content-Length: 0' is sent while negotiating auth
 # even when there is a user-specified Content-Length header.
@@ -66,7 +67,7 @@ HTTP POST --digest with SHA-256, userhash=true and user-specified Content-Length
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test207 b/third-party/curl/tests/data/test207
index fcb78181c1..8ac782f067 100644
--- a/third-party/curl/tests/data/test207
+++ b/third-party/curl/tests/data/test207
@@ -1,14 +1,13 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
 CURLE_PARTIAL_FILE
-FAILURE
 chunked Transfer-Encoding
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -17,9 +16,9 @@ Server: fakeit/0.9 fakeitbad/1.0
 Transfer-Encoding: chunked
 Connection: mooo
 
-41
+41%CR
 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-
+%CR
 </data>
 <datacheck>
 HTTP/1.1 200 funky chunky! swsclose
@@ -31,24 +30,22 @@ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with chunked Transfer-Encoding closed prematurely
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -58,13 +55,8 @@ Accept: */*
 
 # curl: (18) transfer closed with outstanding read data remaining
 # 18 == CURLE_PARTIAL_FILE
-# 56 == CURLE_RECV_ERROR
 <errorcode>
-%if hyper
-56
-%else
 18
-%endif
 </errorcode>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test2070 b/third-party/curl/tests/data/test2070
index 21f5f20585..4c7b3028de 100644
--- a/third-party/curl/tests/data/test2070
+++ b/third-party/curl/tests/data/test2070
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ PEM certificate
 </keywords>
 </info>type
 
-#
 # Server-side
 <reply>
 <data>
@@ -20,36 +20,31 @@ MooMoo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 SSL
 Schannel
+local-http
 </features>
 <server>
-https Server-localhost-sv.pem
+https test-localhost.pem
 </server>
- <name>
+<name>
 Ignore certificate revocation "best effort" strategy
- </name>
-  <setenv>
-# This test is pointless if we're not using the schannel backend
+</name>
+<setenv>
+# This test is pointless if we are not using the Schannel backend
 CURL_SSL_BACKEND=schannel
- </setenv>
- <command>
---cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --ssl-revoke-best-effort https://localhost:%HTTPSPORT/%TESTNUMBER
+</setenv>
+<command>
+-4 --cacert %CERTDIR/certs/test-ca.crt --ssl-revoke-best-effort https://localhost:%HTTPSPORT/%TESTNUMBER
 </command>
-# Ensure that we're running on localhost because we're checking the host name
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: localhost:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2071 b/third-party/curl/tests/data/test2071
index 45ee91737d..09bc3e6a3d 100644
--- a/third-party/curl/tests/data/test2071
+++ b/third-party/curl/tests/data/test2071
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -20,9 +21,9 @@ moo
 <server>
 file
 </server>
- <name>
+<name>
 basic file:// file with "127.0.0.1" hostname
- </name>
+</name>
 <command option="no-include">
 file://127.0.0.1%FILE_PWD/%LOGDIR/test2070.txt
 </command>
diff --git a/third-party/curl/tests/data/test2072 b/third-party/curl/tests/data/test2072
index 50cb4b60a6..c7731a83e3 100644
--- a/third-party/curl/tests/data/test2072
+++ b/third-party/curl/tests/data/test2072
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -21,13 +22,13 @@ moo
 file
 </server>
 <name>
-file:// with unix path resolution behavior for the case of extra slashes
+file:// with Unix path resolution behavior for the case of extra slashes
 </name>
 <command option="no-include">
-file:////%PWD/%LOGDIR/test%TESTNUMBER.txt
+file:////%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt
 </command>
 <precheck>
-perl -e "print 'Test requires a unix system' if ( $^O eq 'MSWin32' || $^O eq 'cygwin' || $^O eq 'dos' || $^O eq 'msys');"
+%PERL -e "print 'Test requires a Unix system' if($^O eq 'MSWin32' || $^O eq 'cygwin' || $^O eq 'dos' || $^O eq 'msys');"
 </precheck>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 foo
diff --git a/third-party/curl/tests/data/test2073 b/third-party/curl/tests/data/test2073
index 18a2c41511..efc6136804 100644
--- a/third-party/curl/tests/data/test2073
+++ b/third-party/curl/tests/data/test2073
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ HTTP
 HTTP FORMPOST
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -24,7 +24,6 @@ contents2
 </data1>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -33,26 +32,25 @@ Mime
 <server>
 http
 </server>
- <name>
+<name>
 HTTP form posts with handle reset
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -F 'name=a;filename=a.pdf' --next http://%HOSTIP:%HTTPPORT/%TESTNUMBER -F 'name=b;filename=b.jpg'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strip>
 ^(Content-Type: multipart/form-data;|------------).*
 </strip>
-<protocol>
+<protocol crlf="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Content-Length: 189
+Content-Length: 201
 
 Content-Disposition: form-data; name="name"; filename="a.pdf"
 Content-Type: application/pdf
@@ -62,7 +60,7 @@ POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Content-Length: 184
+Content-Length: 196
 
 Content-Disposition: form-data; name="name"; filename="b.jpg"
 Content-Type: image/jpeg
diff --git a/third-party/curl/tests/data/test2074 b/third-party/curl/tests/data/test2074
index 091cd2941c..0967031906 100644
--- a/third-party/curl/tests/data/test2074
+++ b/third-party/curl/tests/data/test2074
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ AUTH OAUTHBEARER
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -26,24 +26,22 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
-HTTP GET
- </name>
- <command>
+<name>
+HTTP with oauth2-bearer
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --oauth2-bearer mF_9.B5f-4.1JqM
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Authorization: Bearer mF_9.B5f-4.1JqM
diff --git a/third-party/curl/tests/data/test2075 b/third-party/curl/tests/data/test2075
index 88db7ae29c..20e09b1888 100644
--- a/third-party/curl/tests/data/test2075
+++ b/third-party/curl/tests/data/test2075
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,15 +7,11 @@ HTTP
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <features>
 http
 </features>
-<server>
-none
-</server>
 <name>
 Verify usernames are not allowed in url
 </name>
@@ -23,7 +20,6 @@ Verify usernames are not allowed in url
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # CURLE_LOGIN_DENIED is code 67
diff --git a/third-party/curl/tests/data/test2076 b/third-party/curl/tests/data/test2076
index 29dcc9440a..049e2911fa 100644
--- a/third-party/curl/tests/data/test2076
+++ b/third-party/curl/tests/data/test2076
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP Digest auth
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 WWW-Authenticate: Digest realm="testrealm", nonce="1"
 Content-Length: 26
@@ -18,14 +19,14 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Content-Length: 23
 
 This IS the real page!
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 WWW-Authenticate: Digest realm="testrealm", nonce="1"
 Content-Length: 26
@@ -46,6 +47,7 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
 <name>
 HTTP with digest auth and URI contains query
@@ -57,7 +59,7 @@ HTTP with digest auth and URI contains query
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER?query HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2077 b/third-party/curl/tests/data/test2077
index 606e538358..f978b7745e 100644
--- a/third-party/curl/tests/data/test2077
+++ b/third-party/curl/tests/data/test2077
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ GSS-API
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Content-Length: 23
 
diff --git a/third-party/curl/tests/data/test2078 b/third-party/curl/tests/data/test2078
index d29f249b85..6b468c2d15 100644
--- a/third-party/curl/tests/data/test2078
+++ b/third-party/curl/tests/data/test2078
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ GSS-API
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Content-Length: 23
 
@@ -38,7 +39,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --negotiate --data name=value
 <errorcode>
 0
 </errorcode>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2079 b/third-party/curl/tests/data/test2079
index edbd75945a..d8b6556784 100644
--- a/third-party/curl/tests/data/test2079
+++ b/third-party/curl/tests/data/test2079
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ PEM certificate
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -20,37 +20,32 @@ MooMoo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 SSL
 SSLpinning
 Schannel
+local-http
 </features>
 <server>
-https Server-localhost-sv.pem
+https test-localhost.pem
 </server>
- <name>
+<name>
 simple HTTPS GET with PEM public key pinning (Schannel variant)
- </name>
- <setenv>
-# This test is pointless if we're not using the schannel backend
+</name>
+<setenv>
+# This test is pointless if we are not using the Schannel backend
 CURL_SSL_BACKEND=schannel
- </setenv>
- <command>
---cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --pinnedpubkey %SRCDIR/certs/Server-localhost-sv.pub.pem --ssl-revoke-best-effort https://localhost:%HTTPSPORT/%TESTNUMBER
+</setenv>
+<command>
+-4 --cacert %CERTDIR/certs/test-ca.crt --pinnedpubkey %CERTDIR/certs/test-localhost.pub.pem --ssl-revoke-best-effort https://localhost:%HTTPSPORT/%TESTNUMBER
 </command>
-# Ensure that we're running on localhost because we're checking the host name
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: localhost:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test208 b/third-party/curl/tests/data/test208
index 74622526c9..827e3ea6c9 100644
--- a/third-party/curl/tests/data/test208
+++ b/third-party/curl/tests/data/test208
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -29,10 +30,10 @@ http
 ftp
 proxy
 </features>
- <name>
-HTTP PUT to a FTP URL with username+password - over HTTP proxy
- </name>
- <command>
+<name>
+HTTP PUT to an FTP URL with username+password - over HTTP proxy
+</name>
+<command>
 -x http://%HOSTIP:%HTTPPORT ftp://daniel:mysecret@host.com/we/want/%TESTNUMBER -T %LOGDIR/test%TESTNUMBER.txt
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
@@ -51,14 +52,14 @@ the
 # Verify data after the test has been "shot"
 <verify>
 <protocol>
-PUT ftp://daniel:mysecret@host.com/we/want/%TESTNUMBER HTTP/1.1
-Host: host.com:21
-Authorization: Basic ZGFuaWVsOm15c2VjcmV0
-User-Agent: curl/%VERSION
-Accept: */*
-Proxy-Connection: Keep-Alive
-Content-Length: 78
-
+PUT ftp://daniel:mysecret@host.com/we/want/%TESTNUMBER HTTP/1.1%CR
+Host: host.com:21%CR
+Authorization: Basic %b64[daniel:mysecret]b64%%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Proxy-Connection: Keep-Alive%CR
+Content-Length: 78%CR
+%CR
 Weird
      file
          to
diff --git a/third-party/curl/tests/data/test2080 b/third-party/curl/tests/data/test2080
index 8b92c4f13a58f7302b936c65422433253918b38d..6153c5717dac2d95bccef68df37a9c9aed2af83f 100644
GIT binary patch
delta 205
zcmX@Tkg<(L%f`MUH%Fl?wWv5VKhIXlP|rX~AvG^KKP59S-Bu|ySl2Pw+0#?W-i~X6
zrmU`Ra(-S~W;&ORes*eQd45q!u^o_|nU|Jt$2HMjX=1YY#K~G5Hu`yqxv4;r<2h=o
zMX3d;i6zlS20)-tq2Lm$3e=I7nFEx!(NE6FOwB8?<C<(4U~5rYoSLGLUr+*ch(czb
qLP<ud0>nB6kaC60Vuh0Ye1)9+JfQulMMe2VKvx1yF`B$QKm`CxR6@1@

literal 20683
zcmeI)!Ee(r6vuJS{wp3G6Q{`sZph>SD`=tvsoOYl$r7ivaO}zPHubLuCtWu#+^E!P
z-(DJ5&+qs0x%ZiDhuqYIt(0-0i{<N=-Q3624wd?RwwS9XhR&^&(NDh{y)9Ko>PRkZ
zy0htIaIIA)*&DwpJ@muFRPo6>8}dU%GaX9FFx{(Eh@o86yQ7#;_hp)GtaQ#>xp#Rj
zv84Eo_!w3aZ?cO)iP76)F-`3II<%EK`6|bY?_W;OmU`Rb_;P-6`R(fb<9s=Fd#`nC
ze^z%o+<ISvA8(o|Yi#&o_RkixO1(Peg8%{uAb<b@2q17+0_TS{4$~lj00IagfB*sr
zAb`NW1+MoUKz{@fKmY**5I_I{1Q0*~0R#|0009IL*t>w;djbInAb<b@2q1s}0tg`R
zj0Eac`TyB7nwL=#KmY**5I_I{1Q0*~frArxb8r(e5CRAwfWS)@c>R)Jo_9w80R;Y+
z!0)moZ(NNxuJzk(@0<4e{jkY(8)@rYOWkFgB(JTE3k79e4{~j7klC<~d8SNR-dAd?
zvM+F~xmqs74bs=Xi>bG*3{hNu>%G{NVv=~9m6;x!*p}dTCHk+U(Ytm=KkYC40~~gf
ALI3~&

diff --git a/third-party/curl/tests/data/test2081 b/third-party/curl/tests/data/test2081
index 2409a6d2bb..b469b38aef 100644
--- a/third-party/curl/tests/data/test2081
+++ b/third-party/curl/tests/data/test2081
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ followlocation
 
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 301 This is a weirdo text message swsclose
 Location: data/%TESTNUMBER0002.txt?coolsite=yes
 Content-Length: 62
@@ -19,7 +20,7 @@ Connection: close
 
 This server reply is for testing a simple Location: following
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 This is another weirdo text message swsclose
 Connection: close
 
@@ -32,32 +33,32 @@ Thanks for following.
 <server>
 http
 </server>
- <name>
+<name>
 Automatic referrer credential and anchor stripping check
- </name>
- <command>
+</name>
+<command>
 http://user:pass@%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER#anchor --location --referer ';auto' --write-out '%{referer}\n'
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/our/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dXNlcjpwYXNz
+Authorization: Basic %b64[user:pass]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
 GET /we/want/our/data/%TESTNUMBER0002.txt?coolsite=yes HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dXNlcjpwYXNz
+Authorization: Basic %b64[user:pass]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Referer: http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER
 
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 301 This is a weirdo text message swsclose
 Location: data/%TESTNUMBER0002.txt?coolsite=yes
 Content-Length: 62
diff --git a/third-party/curl/tests/data/test2082 b/third-party/curl/tests/data/test2082
index 4c37772d5e..cf0a28428b 100644
--- a/third-party/curl/tests/data/test2082
+++ b/third-party/curl/tests/data/test2082
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,7 +28,7 @@ http
 Pre-request callback for HTTP
 </name>
 <tool>
-libprereq
+lib2082
 </tool>
 
 <command>
diff --git a/third-party/curl/tests/data/test2083 b/third-party/curl/tests/data/test2083
index 9256151a86..2bd93f1ac7 100644
--- a/third-party/curl/tests/data/test2083
+++ b/third-party/curl/tests/data/test2083
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -21,7 +22,7 @@ ftp
 Pre-request callback for FTP
 </name>
 <tool>
-libprereq
+lib2082
 </tool>
 
 <command>
diff --git a/third-party/curl/tests/data/test2084 b/third-party/curl/tests/data/test2084
index ced7086c4b..4ac5fbee75 100644
--- a/third-party/curl/tests/data/test2084
+++ b/third-party/curl/tests/data/test2084
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,7 +28,7 @@ http
 Pre-request callback for HTTP with callback terminating transfer
 </name>
 <tool>
-libprereq
+lib2082
 </tool>
 
 <command>
diff --git a/third-party/curl/tests/data/test2085 b/third-party/curl/tests/data/test2085
index 665a756c0e..5f26b50cfa 100644
--- a/third-party/curl/tests/data/test2085
+++ b/third-party/curl/tests/data/test2085
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -35,7 +36,7 @@ http
 Pre-request callback for HTTP with location following
 </name>
 <tool>
-libprereq
+lib2082
 </tool>
 
 <command>
diff --git a/third-party/curl/tests/data/test2086 b/third-party/curl/tests/data/test2086
index ce60aa831f..5336ddaba6 100644
--- a/third-party/curl/tests/data/test2086
+++ b/third-party/curl/tests/data/test2086
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -20,6 +21,10 @@ Content-Length: 0
 
 # Client-side
 <client>
+<features>
+http
+IPv6
+</features>
 <server>
 http-ipv6
 </server>
@@ -28,12 +33,16 @@ http-ipv6
 Pre-request callback for HTTP IPv6
 </name>
 <tool>
-libprereq
+lib2082
 </tool>
 
 <command>
 %HOST6IP:%HTTP6PORT/%TESTNUMBER#ipv6
 </command>
+<setenv>
+# Needed for MSYS2 to not treat the URL as a path list
+MSYS2_ARG_CONV_EXCL=*
+</setenv>
 </client>
 
 # Verify data after the test has been "shot"
diff --git a/third-party/curl/tests/data/test2087 b/third-party/curl/tests/data/test2087
index c2e8640ebe..c3a5901d17 100644
--- a/third-party/curl/tests/data/test2087
+++ b/third-party/curl/tests/data/test2087
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ PEM certificate
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -20,37 +20,32 @@ MooMoo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 SSL
 SSLpinning
 Schannel
+local-http
 </features>
 <server>
-https Server-localhost-sv.pem
+https test-localhost.pem
 </server>
- <name>
+<name>
 simple HTTPS GET with base64-sha256 public key pinning (Schannel variant)
- </name>
- <setenv>
-# This test is pointless if we're not using the schannel backend
+</name>
+<setenv>
+# This test is pointless if we are not using the Schannel backend
 CURL_SSL_BACKEND=schannel
- </setenv>
- <command>
---cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --pinnedpubkey sha256//AAUDLk4c98xcFUDvA9i/MnA9HuO03IPi15r+Cx9OXnc= --ssl-revoke-best-effort https://localhost:%HTTPSPORT/%TESTNUMBER
+</setenv>
+<command>
+-4 --cacert %CERTDIR/certs/test-ca.crt --pinnedpubkey sha256//%sha256b64file[%CERTDIR/certs/test-localhost.pub.der]sha256b64file% --ssl-revoke-best-effort https://localhost:%HTTPSPORT/%TESTNUMBER
 </command>
-# Ensure that we're running on localhost because we're checking the host name
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: localhost:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2088 b/third-party/curl/tests/data/test2088
new file mode 100644
index 0000000000..3990add55c
--- /dev/null
+++ b/third-party/curl/tests/data/test2088
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTPS
+HTTP GET
+Client Auth
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 7
+
+MooMoo
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+SSL
+!Schannel
+local-http
+</features>
+<server>
+https-mtls
+</server>
+<name>
+HTTPS GET with client authentication (mtls)
+</name>
+<command>
+--cacert %CERTDIR/certs/test-ca.crt --cert %CERTDIR/certs/test-client-eku-only.crt --key %CERTDIR/certs/test-client-eku-only.key https://localhost:%HTTPS-MTLSPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: localhost:%HTTPS-MTLSPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2089 b/third-party/curl/tests/data/test2089
new file mode 100644
index 0000000000..13d1da3f17
--- /dev/null
+++ b/third-party/curl/tests/data/test2089
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTPS
+HTTP GET
+Client Auth
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 7
+
+MooMoo
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+SSL
+!Schannel
+local-http
+</features>
+<server>
+https-mtls
+</server>
+<name>
+HTTPS GET with client authentication (mtls) and --insecure
+</name>
+<command>
+--insecure --cert %CERTDIR/certs/test-client-cert.crt --key %CERTDIR/certs/test-client-cert.key https://localhost:%HTTPS-MTLSPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: localhost:%HTTPS-MTLSPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test209 b/third-party/curl/tests/data/test209
index 84d85272e5..7258dd9260 100644
--- a/third-party/curl/tests/data/test209
+++ b/third-party/curl/tests/data/test209
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -14,7 +15,7 @@ NTLM
 <reply>
 
 # this is returned first since we get no proxy-auth
-<connect1001>
+<connect1001 crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me my dear
 Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
 Content-Length: 33
@@ -24,7 +25,7 @@ And you should ignore this data.
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<connect1002>
+<connect1002 crlf="headers">
 HTTP/1.1 200 Things are fine in proxy land
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -45,21 +46,21 @@ daniel
 
 # then this is returned when we get proxy-auth
 <data1000>
-HTTP/1.1 200 OK swsbounce
+HTTP/1.1 200 OK swsbounce%CR
 Server: no
-
+%CR
 Nice proxy auth sir!
 </data1000>
 
 <datacheck>
-HTTP/1.1 407 Authorization Required to proxy me my dear
-Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
-Content-Length: 33
-
-HTTP/1.1 200 Things are fine in proxy land
-Server: Microsoft-IIS/5.0
-Content-Type: text/html; charset=iso-8859-1
-
+HTTP/1.1 407 Authorization Required to proxy me my dear%CR
+Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==%CR
+Content-Length: 33%CR
+%CR
+HTTP/1.1 200 Things are fine in proxy land%CR
+Server: Microsoft-IIS/5.0%CR
+Content-Type: text/html; charset=iso-8859-1%CR
+%CR
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 7
@@ -92,10 +93,10 @@ http://test.remote.example.com.%TESTNUMBER:%HTTPPORT/path/%TESTNUMBER0002 --prox
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 CONNECT test.remote.example.com.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: test.remote.example.com.%TESTNUMBER:%HTTPPORT
-Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Proxy-Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
diff --git a/third-party/curl/tests/data/test2090 b/third-party/curl/tests/data/test2090
new file mode 100644
index 0000000000..aa2589a35a
--- /dev/null
+++ b/third-party/curl/tests/data/test2090
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTPS
+TLS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 7
+
+MooMoo
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+SSL
+!Schannel
+!mbedtls
+</features>
+<setenv>
+SSLKEYLOGFILE=%LOGDIR/%TESTNUMBER.log.ssl
+</setenv>
+<server>
+https
+</server>
+<name>
+HTTPS request with SSLKEYLOGFILE set
+</name>
+<command>
+--cacert %CERTDIR/certs/test-ca.crt --tls-max 1.2 https://localhost:%HTTPSPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: localhost:%HTTPSPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/%TESTNUMBER.log.ssl" mode="text">
+CLIENT_RANDOM %repeat[32 x 9A]% %repeat[48 x BC]%
+</file>
+<stripfile>
+s/^CLIENT_RANDOM [0-9a-fA-F]{64} [0-9a-fA-F]{96}/CLIENT_RANDOM %repeat[32 x 9A]% %repeat[48 x BC]%/g
+</stripfile>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2091 b/third-party/curl/tests/data/test2091
new file mode 100644
index 0000000000..33ef0b24ff
--- /dev/null
+++ b/third-party/curl/tests/data/test2091
@@ -0,0 +1,98 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+HTTP Digest auth
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data1 crlf="headers">
+HTTP/1.1 401 Authorization Required swsclose
+Server: Apache/1.3.27 (Darwin) PHP/4.1.2
+WWW-Authenticate: Digest realm="OWS Realm", nonce="1053604145"
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 26
+
+This is not the real page
+</data1>
+
+<data1001 crlf="headers">
+HTTP/1.1 200 OK
+Server: Apache/1.3.27 (Darwin) PHP/4.1.2
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 23
+
+This IS the real page!
+</data1001>
+
+<data3 crlf="headers">
+HTTP/1.1 401 Authorization Required swsclose
+Server: Apache/1.3.27 (Darwin) PHP/4.1.2
+WWW-Authenticate: Digest realm="My \"Cool\" Realm", nonce="1053604146"
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 26
+
+This is not the real page
+</data3>
+
+<data1003 crlf="headers">
+HTTP/1.1 200 OK
+Server: Apache/1.3.27 (Darwin) PHP/4.1.2
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 23
+
+This IS the real page!
+</data1003>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+!SSPI
+crypto
+digest
+</features>
+<name>
+HTTP Digest auth with OWS and escaped quotes
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001 -u testuser:testpass --digest --next
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER0003 -u testuser:testpass --digest
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Authorization: Digest username="testuser", realm="OWS Realm", nonce="1053604145", uri="/%TESTNUMBER0001", response="b6c8f707f7781c272e79489771185713"
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER0003 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER0003 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Authorization: Digest username="testuser", realm="My \"Cool\" Realm", nonce="1053604146", uri="/%TESTNUMBER0003", response="f10c1586b83b6e5927fef54748f88d36"
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2092 b/third-party/curl/tests/data/test2092
new file mode 100644
index 0000000000..6cbf8563fb
--- /dev/null
+++ b/third-party/curl/tests/data/test2092
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+globbing
+</keywords>
+</info>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+glob range that ends with 9223372036854775807
+</name>
+<command>
+"%HOSTIP:%HTTPPORT/[0-1][9223372036854775806-9223372036854775807]/%TESTNUMBER"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+3
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test21 b/third-party/curl/tests/data/test21
index 5c099cf34e..8f3da43b81 100644
--- a/third-party/curl/tests/data/test21
+++ b/third-party/curl/tests/data/test21
@@ -1,7 +1,7 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
-FAILURE
 multiple HTTP requests
 </keywords>
 </info>
@@ -19,10 +19,10 @@ Mime
 <server>
 http
 </server>
- <name>
+<name>
 use curl with multiple request methods
- </name>
- <command>
+</name>
+<command>
 -I -d FOOO -F moo=moo localhost
 </command>
 </client>
diff --git a/third-party/curl/tests/data/test210 b/third-party/curl/tests/data/test210
index c4a091181e..57116cf0b6 100644
--- a/third-party/curl/tests/data/test210
+++ b/third-party/curl/tests/data/test210
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -19,9 +20,9 @@ data blobb
 <server>
 ftp
 </server>
- <name>
+<name>
 Get two FTP files from the same remote dir: no second CWD
- </name>
+</name>
 <command option="no-include">
 ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER
 </command>
@@ -33,7 +34,7 @@ data blobb
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test2100 b/third-party/curl/tests/data/test2100
index c23a025659..8793c57865 100644
--- a/third-party/curl/tests/data/test2100
+++ b/third-party/curl/tests/data/test2100
@@ -1,13 +1,14 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
 DOH
+httpsrr
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 
@@ -36,30 +37,28 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 
-# requires debug so that it can use the DoH server without https
+# requires Debug so that it can use the DoH server without https
 # requires IPv6 so that we can assume and compare both DoH requests
 
 <features>
-debug
+Debug
 DoH
-ipv6
+IPv6
 </features>
- <name>
-HTTP GET using DoH
- </name>
- <command>
+<name>
+HTTP GET using DoH (with HTTPS RR)
+</name>
+<command>
 http://foo.example.com:%HTTPPORT/%TESTNUMBER --doh-url http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 
@@ -69,7 +68,32 @@ http://foo.example.com:%HTTPPORT/%TESTNUMBER --doh-url http://%HOSTIP:%HTTPPORT/
 <strippart>
 s/com\x00\x00(\x1c|\x01)/com-00-00!/g;
 </strippart>
-<protocol>
+<protocol crlf="yes">
+%if HTTPSRR
+POST /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Type: application/dns-message
+Content-Length: 33
+
+%hex[%00%00%01%00%00%01%00%00%00%00%00%00%03foo%07example%03com-00-00!%00%01]hex%POST /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Type: application/dns-message
+Content-Length: 33
+
+%hex[%00%00%01%00%00%01%00%00%00%00%00%00%03foo%07example%03com-00-00!%00%01]hex%POST /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Type: application/dns-message
+Content-Length: 47
+
+%hex[%00%00%01%00%00%01%00%00%00%00%00%00%06_%HTTPPORT%06_https%03foo%07example%03com%00%00A%00%01]hex%GET /%TESTNUMBER HTTP/1.1
+Host: foo.example.com:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+%else
 POST /%TESTNUMBER0001 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
@@ -87,6 +111,7 @@ Host: foo.example.com:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
+%endif
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test2101 b/third-party/curl/tests/data/test2101
new file mode 100644
index 0000000000..420f40e07b
--- /dev/null
+++ b/third-party/curl/tests/data/test2101
@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+DOH
+</keywords>
+</info>
+
+# Server-side
+<reply>
+
+<servercmd>
+idle
+</servercmd>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+
+# requires Debug so that it can use the DoH server without https
+
+<features>
+Debug
+DoH
+</features>
+<name>
+DoH without response
+</name>
+<command>
+http://neverreached.example.com/ --doh-url http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001 -m 1
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+
+# curl: (28) Resolving timed out
+# curl: (6) Could not resolve hostname
+<errorcode>
+28,6
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2102 b/third-party/curl/tests/data/test2102
new file mode 100644
index 0000000000..9ab683d377
--- /dev/null
+++ b/third-party/curl/tests/data/test2102
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+<dns>
+A: %HOSTIP
+AAAA: %HOST6IP
+</dns>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+dns
+</server>
+<features>
+override-dns
+</features>
+<name>
+HTTP GET with hostname
+</name>
+<setenv>
+CURL_DNS_SERVER=127.0.0.1:%DNSPORT
+</setenv>
+<command>
+http://examplehost.example:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: examplehost.example:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2103 b/third-party/curl/tests/data/test2103
new file mode 100644
index 0000000000..6f04cfe972
--- /dev/null
+++ b/third-party/curl/tests/data/test2103
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+DNS fail
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<dns>
+A: none
+AAAA: none
+</dns>
+</reply>
+
+# Client-side
+<client>
+<server>
+dns
+</server>
+<features>
+override-dns
+</features>
+<name>
+HTTP GET with bad hostname
+</name>
+<setenv>
+CURL_DNS_SERVER=127.0.0.1:%DNSPORT
+</setenv>
+<command>
+http://examplehost.example/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+# curl: (6) Could not resolve host: examplehost.example
+<errorcode>
+6
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2104 b/third-party/curl/tests/data/test2104
new file mode 100644
index 0000000000..bd468efeeb
--- /dev/null
+++ b/third-party/curl/tests/data/test2104
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+DNS cache
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<dns>
+</dns>
+</reply>
+
+# Client-side
+<client>
+<server>
+dns
+</server>
+<features>
+override-dns
+</features>
+<name>
+Get three URLs with bad hostname - cache
+</name>
+<setenv>
+CURL_DNS_SERVER=127.0.0.1:%DNSPORT
+</setenv>
+<command>
+http://examplehost.invalid/%TESTNUMBER http://examplehost.invalid/%TESTNUMBER http://examplehost.invalid/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+# curl: (6) Could not resolve host: examplehost.invalid
+<errorcode>
+6
+</errorcode>
+
+# Ignore HTTPS requests here
+<dns host="examplehost.invalid QTYPE A">
+QNAME examplehost.invalid QTYPE A
+QNAME examplehost.invalid QTYPE AAAA
+</dns>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2105 b/third-party/curl/tests/data/test2105
new file mode 100644
index 0000000000..8bd26caff1
--- /dev/null
+++ b/third-party/curl/tests/data/test2105
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/%CRfake
+Content-Length: 6
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP with spurious CR in received header
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<errorcode>
+8
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2106 b/third-party/curl/tests/data/test2106
new file mode 100644
index 0000000000..40d2dc8b62
--- /dev/null
+++ b/third-party/curl/tests/data/test2106
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+chunked Transfer-Encoding
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK%CR
+Server: test%CR
+Transfer-Encoding: chunked%CR
+Trailer: chunky-trailer%CR
+%CR
+6%CR
+-foo-%CR
+0%CR
+chunky-trailer: he%hex[%00]hex%llo%CR
+%CR
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP chunked response with a nul byte in the trailer
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<errorcode>
+8
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2107 b/third-party/curl/tests/data/test2107
new file mode 100644
index 0000000000..8c44044109
--- /dev/null
+++ b/third-party/curl/tests/data/test2107
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP CONNECT
+HTTP proxy
+proxytunnel
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Content-Length: 0
+
+</data>
+<connect nocheck="yes">
+HTTP/1.1 200 OK%CR
+X-Evil: he%hex[%00]hex%llo%CR
+%CR
+</connect>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+http-proxy
+</server>
+<features>
+proxy
+</features>
+<name>
+HTTP CONNECT response with a nul byte in a header
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -p -x http://%HOSTIP:%PROXYPORT
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+8
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2108 b/third-party/curl/tests/data/test2108
new file mode 100644
index 0000000000..481d09357e
--- /dev/null
+++ b/third-party/curl/tests/data/test2108
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+FTP
+</keywords>
+</info>
+# Server-side
+<reply>
+<servercmd>
+REPLY PASS 230 logged\x00 in
+</servercmd>
+</reply>
+
+# Client-side
+<client>
+<server>
+ftp
+</server>
+<name>
+FTP rejects a nul byte in a server response line
+</name>
+<command>
+ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
+</command>
+
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+USER anonymous
+PASS ftp@example.com
+</protocol>
+
+# 8 == CURLE_WEIRD_SERVER_REPLY
+<errorcode>
+8
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test211 b/third-party/curl/tests/data/test211
index e3be4dd16f..6669614bc6 100644
--- a/third-party/curl/tests/data/test211
+++ b/third-party/curl/tests/data/test211
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -20,10 +21,10 @@ REPLY EPSV 500 no such command
 <server>
 ftp
 </server>
- <name>
+<name>
 Get two FTP files with no remote EPSV support
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER
 </command>
 <stdout>
@@ -34,7 +35,7 @@ data blobb
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test212 b/third-party/curl/tests/data/test212
index 387ade1aef..b78b5f58c6 100644
--- a/third-party/curl/tests/data/test212
+++ b/third-party/curl/tests/data/test212
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,12 +24,12 @@ ftp
 </server>
 # EPRT is only sent when IPv6 is enabled
 <features>
-ipv6
+IPv6
 </features>
- <name>
+<name>
 Get two FTP files with no remote EPRT support
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER -P -
 </command>
 <stdout>
@@ -44,18 +45,18 @@ data blobb
 s/^(EPRT \|1\|)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|\d{1,5}\|/$1/
 s/^(PORT )\d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3}/$1/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
 CWD a
 CWD path
 EPRT |1|
-PORT 
+PORT%SP
 TYPE I
 SIZE %TESTNUMBER
 RETR %TESTNUMBER
-PORT 
+PORT%SP
 SIZE %TESTNUMBER
 RETR %TESTNUMBER
 QUIT
diff --git a/third-party/curl/tests/data/test213 b/third-party/curl/tests/data/test213
index 85a369573d..cca30c8bfb 100644
--- a/third-party/curl/tests/data/test213
+++ b/third-party/curl/tests/data/test213
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -14,7 +15,7 @@ NTLM
 <reply>
 
 # this is returned first since we get no proxy-auth
-<connect1001>
+<connect1001 crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me my dear
 Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
 Content-Length: 33
@@ -24,7 +25,7 @@ And you should ignore this data.
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<connect1002>
+<connect1002 crlf="headers">
 HTTP/1.1 200 Things are fine in proxy land
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -45,21 +46,21 @@ daniel
 
 # then this is returned when we get proxy-auth
 <data1000>
-HTTP/1.1 200 OK swsbounce
+HTTP/1.1 200 OK swsbounce%CR
 Server: no
-
+%CR
 Nice proxy auth sir!
 </data1000>
 
 <datacheck>
-HTTP/1.1 407 Authorization Required to proxy me my dear
-Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
-Content-Length: 33
-
-HTTP/1.1 200 Things are fine in proxy land
-Server: Microsoft-IIS/5.0
-Content-Type: text/html; charset=iso-8859-1
-
+HTTP/1.1 407 Authorization Required to proxy me my dear%CR
+Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==%CR
+Content-Length: 33%CR
+%CR
+HTTP/1.1 200 Things are fine in proxy land%CR
+Server: Microsoft-IIS/5.0%CR
+Content-Type: text/html; charset=iso-8859-1%CR
+%CR
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 7
@@ -92,10 +93,10 @@ http://test.remote.example.com.%TESTNUMBER:%HTTPPORT/path/%TESTNUMBER0002 --prox
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 CONNECT test.remote.example.com.%TESTNUMBER:%HTTPPORT HTTP/1.0
 Host: test.remote.example.com.%TESTNUMBER:%HTTPPORT
-Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Proxy-Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
diff --git a/third-party/curl/tests/data/test214 b/third-party/curl/tests/data/test214
index 65c04f72e5..eda200df34 100644
--- a/third-party/curl/tests/data/test214
+++ b/third-party/curl/tests/data/test214
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ HTTP
 HTTP GET
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -19,15 +19,14 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP URL with escaped { and }
- </name>
+</name>
 <command>
 "http://%HOSTIP:%HTTPPORT/\{\}\/%TESTNUMBER"
 </command>
@@ -37,10 +36,9 @@ MSYS2_ARG_CONV_EXCL=http://
 </setenv>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /{}\/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test215 b/third-party/curl/tests/data/test215
index a71d5a76b7..90d64b7710 100644
--- a/third-party/curl/tests/data/test215
+++ b/third-party/curl/tests/data/test215
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,9 +8,7 @@ FTP
 
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -21,7 +20,7 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 
 </reply>
 
@@ -30,17 +29,17 @@ dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
 <server>
 ftp
 </server>
- <name>
+<name>
 Get two FTP dir listings from the same remote dir: no second CWD
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER/ ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER/
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test216 b/third-party/curl/tests/data/test216
index fa05d1f4ea..4590d43baa 100644
--- a/third-party/curl/tests/data/test216
+++ b/third-party/curl/tests/data/test216
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -14,10 +15,10 @@ FTP
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP upload two files to the same dir
- </name>
- <command>
+</name>
+<command>
 -T %LOGDIR/upload.%TESTNUMBER ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER/ -T %LOGDIR/upload.%TESTNUMBER ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER/%2e%2eanotherup.%TESTNUMBER
 </command>
 <file name="%LOGDIR/upload.%TESTNUMBER">
@@ -27,7 +28,7 @@ upload this file twice
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test217 b/third-party/curl/tests/data/test217
index 3e49d47639..a393700a05 100644
--- a/third-party/curl/tests/data/test217
+++ b/third-party/curl/tests/data/test217
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -15,7 +16,7 @@ followlocation
 <reply>
 
 # this is returned first since we get no proxy-auth
-<connect nocheck="yes">
+<connect crlf="headers" nocheck="yes">
 HTTP/1.1 405 Method Not Allowed swsclose
 
 And you should ignore this data.
@@ -28,10 +29,10 @@ And you should ignore this data.
 <server>
 http
 </server>
- <name>
+<name>
 HTTP proxy CONNECT to proxy returning 405
- </name>
- <command>
+</name>
+<command>
 http://test.remote.example.com.%TESTNUMBER:%HTTPPORT/path/%TESTNUMBER0002 --proxy http://%HOSTIP:%HTTPPORT --proxytunnel -w "%{http_code} %{http_connect}\n"
 </command>
 <features>
@@ -41,18 +42,18 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 CONNECT test.remote.example.com.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: test.remote.example.com.%TESTNUMBER:%HTTPPORT
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
 </protocol>
-# CURLE_RECV_ERROR
+# CURLE_COULDNT_CONNECT
 <errorcode>
-56
+7
 </errorcode>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 405 Method Not Allowed swsclose
 
 000 405
diff --git a/third-party/curl/tests/data/test218 b/third-party/curl/tests/data/test218
index 6913d96abc..14fc604830 100644
--- a/third-party/curl/tests/data/test218
+++ b/third-party/curl/tests/data/test218
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ HTTP PUT
 chunked Transfer-Encoding
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.0 200 OK
 Server: test-server/fake
 Content-Type: text/html
@@ -19,42 +19,36 @@ blaha
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP PUT from a file but enforce chunked transfer-encoding
- </name>
- <command>
- -T %LOGDIR/file%TESTNUMBER -H "Transfer-Encoding: chunked" http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</name>
+<command>
+-T %LOGDIR/file%TESTNUMBER -H "Transfer-Encoding: chunked" http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 <file name="%LOGDIR/file%TESTNUMBER">
-just some tiny teeny contents
+some tiny teeny test contents
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <protocol>
-PUT /%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Transfer-Encoding: chunked
-
-%if hyper
-1E
-%else
-1e
-%endif
-just some tiny teeny contents
-
-0
-
+PUT /%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Transfer-Encoding: chunked%CR
+%CR
+1e%CR
+some tiny teeny test contents
+%CR
+0%CR
+%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test219 b/third-party/curl/tests/data/test219
index 74a8551dae..960ba8dd9b 100644
--- a/third-party/curl/tests/data/test219
+++ b/third-party/curl/tests/data/test219
@@ -1,34 +1,30 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 proxy
+unsupported scheme
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 http
 proxy
 </features>
- <name>
+<name>
 try using proxy with unsupported scheme
- </name>
- <command>
+</name>
+<command>
 -x foo://%HOSTIP:%NOLISTENPORT/%TESTNUMBER http://%HOSTIP:%NOLISTENPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test22 b/third-party/curl/tests/data/test22
index 5690abad99..f9c1b90e78 100644
--- a/third-party/curl/tests/data/test22
+++ b/third-party/curl/tests/data/test22
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,7 @@ long URL
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Funny-head: yesyes
 Content-Length: 27
@@ -21,18 +22,18 @@ This is the proof it works
 <server>
 http
 </server>
- <name>
+<name>
 get HTTP with URL > 10000 bytes
- </name>
- <command>
-%HOSTIP:%HTTPPORT/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/%TESTNUMBER
+</name>
+<command>
+%HOSTIP:%HTTPPORT/%repeat[11000 x a]%/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-GET /aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/%TESTNUMBER HTTP/1.1
+<protocol crlf="yes">
+GET /%repeat[11000 x a]%/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test220 b/third-party/curl/tests/data/test220
index 1cc032823c..0fc6d7c803 100644
--- a/third-party/curl/tests/data/test220
+++ b/third-party/curl/tests/data/test220
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,19 +7,22 @@ HTTP GET
 compressed
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBNb24sIDI5IE5vdiAyMDA0IDIxOjU2OjUzIEdNVA0KU2Vy
-dmVyOiBBcGFjaGUvMS4zLjMxIChEZWJpYW4gR05VL0xpbnV4KSBtb2RfZ3ppcC8xLjMuMjYuMWEg
-UEhQLzQuMy45LTEgbW9kX3NzbC8yLjguMjAgT3BlblNTTC8wLjkuN2QgbW9kX3BlcmwvMS4yOQ0K
-VmFyeTogQWNjZXB0LUVuY29kaW5nDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1J
-U08tODg1OS0xDQpDb250ZW50LUVuY29kaW5nOiBHWklQDQpDb250ZW50LUxlbmd0aDogNDQNCg0K
-H4sICHmeq0EAA2xhbGFsYQDLycxLVTDkUsgB0UZcChCGMRcACgJxYBgAAAA=
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Mon, 29 Nov 2004 21:56:53 GMT
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
+Vary: Accept-Encoding
+Content-Type: text/html; charset=ISO-8859-1
+Content-Encoding: GZIP
+Content-Length: 44
+
+%hex[%1f%8b%08%08%79%9e%ab%41%00%03%6c%61%6c%61%6c%61%00%cb%c9%cc%4b%55%30%e4%52%c8%01%d1%46%5c%0a%10%86%31%17%00]hex%
+%hex[%02%71%60%18%00%00%00]hex%
 </data>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Mon, 29 Nov 2004 21:56:53 GMT
 Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
@@ -34,7 +38,6 @@ line 1
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -43,21 +46,20 @@ libz
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET gzip compressed content
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER --compressed
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --compressed -s -w '%{stderr}%{size_delivered}\n'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
 s/^Accept-Encoding: [a-zA-Z, ]*/Accept-Encoding: xxx/
 </strippart>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -65,5 +67,8 @@ Accept: */*
 Accept-Encoding: xxx
 
 </protocol>
+<stderr mode="text">
+24
+</stderr>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test2200 b/third-party/curl/tests/data/test2200
index 64d655009c..bc1652eb2e 100644
--- a/third-party/curl/tests/data/test2200
+++ b/third-party/curl/tests/data/test2200
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,15 +7,11 @@ MQTT SUBSCRIBE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
 hello
 </data>
-<datacheck hex="yes">
-00 04 31 31 39 30   68 65 6c 6c 6f 5b 4c 46 5d 0a
-</datacheck>
 
 # error 5 - "Connection Refused, not authorized. Wrong data supplied"
 <servercmd>
@@ -22,7 +19,6 @@ error-CONNACK 5
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -32,18 +28,16 @@ mqtt
 mqtt
 </server>
 <name>
-MQTT SUBSCRIBE with user and password
+MQTT SUBSCRIBE with user and password, not authorized
 </name>
 <command option="binary-trace">
 mqtt://%HOSTIP:%MQTTPORT/%TESTNUMBER -u fakeuser:fakepasswd
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # These are hexadecimal protocol dumps from the client
-#
 # Strip out the random part of the client id from the CONNECT message
 # before comparison
 <strippart>
diff --git a/third-party/curl/tests/data/test2201 b/third-party/curl/tests/data/test2201
index 7c804e8013..07877274e2 100644
--- a/third-party/curl/tests/data/test2201
+++ b/third-party/curl/tests/data/test2201
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,14 +7,12 @@ MQTT PUBLISH
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -30,11 +29,9 @@ mqtt://%HOSTIP:%MQTTPORT/%TESTNUMBER -d something -u testuser:testpasswd
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # These are hexadecimal protocol dumps from the client
-#
 # Strip out the random part of the client id from the CONNECT message
 # before comparison
 <strippart>
diff --git a/third-party/curl/tests/data/test2202 b/third-party/curl/tests/data/test2202
index 9bb0379936..b809923fca 100644
--- a/third-party/curl/tests/data/test2202
+++ b/third-party/curl/tests/data/test2202
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ MQTT PUBLISH
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -18,7 +18,6 @@ error-CONNACK 5
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -35,11 +34,9 @@ mqtt://%HOSTIP:%MQTTPORT/%TESTNUMBER -d something -u fakeuser:fakepasswd
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # These are hexadecimal protocol dumps from the client
-#
 # Strip out the random part of the client id from the CONNECT message
 # before comparison
 <strippart>
@@ -50,7 +47,6 @@ client CONNECT 2e 00044d51545404c2003c000c6375726c
 server CONNACK 2 20020005
 </protocol>
 
-
 # 8 is CURLE_WEIRD_SERVER_REPLY
 <errorcode>
 8
diff --git a/third-party/curl/tests/data/test2203 b/third-party/curl/tests/data/test2203
index b47ca4d0e6..9dcfedadaf 100644
--- a/third-party/curl/tests/data/test2203
+++ b/third-party/curl/tests/data/test2203
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,15 +7,11 @@ MQTT SUBSCRIBE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
 hello
 </data>
-<datacheck hex="yes">
-00 04 31 31 39 30   68 65 6c 6c 6f 5b 4c 46 5d 0a
-</datacheck>
 
 # error 5 - "Connection Refused, not authorized. No user or password supplied"
 <servercmd>
@@ -22,7 +19,6 @@ error-CONNACK 5
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -32,18 +28,16 @@ mqtt
 mqtt
 </server>
 <name>
-MQTT with error in CONNACK
+MQTT with "no user or password" CONNACK
 </name>
 <command option="binary-trace">
 mqtt://%HOSTIP:%MQTTPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # These are hexadecimal protocol dumps from the client
-#
 # Strip out the random part of the client id from the CONNECT message
 # before comparison
 <strippart>
diff --git a/third-party/curl/tests/data/test2204 b/third-party/curl/tests/data/test2204
index fb03dd37ae..fc1e480db1 100644
--- a/third-party/curl/tests/data/test2204
+++ b/third-party/curl/tests/data/test2204
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,18 +7,13 @@ MQTT SUBSCRIBE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
 hello
 </data>
-<datacheck hex="yes">
-00 04 31 31 39 30   68 65 6c 6c 6f 5b 4c 46 5d 0a
-</datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -34,11 +30,9 @@ mqtt://%HOSTIP:%MQTTPORT/%TESTNUMBER -u testuser:testpasswd
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # These are hexadecimal protocol dumps from the client
-#
 # Strip out the random part of the client id from the CONNECT message
 # before comparison
 <strippart>
diff --git a/third-party/curl/tests/data/test2205 b/third-party/curl/tests/data/test2205
index da6f1ddafa..a0ce7d6fb5 100644
--- a/third-party/curl/tests/data/test2205
+++ b/third-party/curl/tests/data/test2205
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,14 +7,12 @@ MQTT SUBSCRIBE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -23,7 +22,7 @@ mqtt
 mqtt
 </server>
 <name>
-MQTT with very long user name
+MQTT with 64 KiB long username
 </name>
 <file name="%LOGDIR/input%TESTNUMBER">
 user = %repeat[65536 x a]%:fakepasswd
@@ -33,16 +32,8 @@ mqtt://%HOSTIP:%MQTTPORT/%TESTNUMBER -K %LOGDIR/input%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-# These are hexadecimal protocol dumps from the client
-#
-# Strip out the random part of the client id from the CONNECT message
-# before comparison
-<strippart>
-s/^(.* 00044d51545404c2003c000c6375726c).*/$1/
-</strippart>
 # 8 is CURLE_WEIRD_SERVER_REPLY
 <errorcode>
 8
diff --git a/third-party/curl/tests/data/test2206 b/third-party/curl/tests/data/test2206
new file mode 100644
index 0000000000..5021c190f7
--- /dev/null
+++ b/third-party/curl/tests/data/test2206
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+MQTT
+MQTT SUBSCRIBE
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+hello
+</data>
+
+# Send a PINGRESP (0xD0) with remaining_length=2 in place of the
+# expected CONNACK. MQTT 3.1.1 s. 3.13.1 requires PINGRESP to have
+# remaining_length == 0. curl must reject this with
+# CURLE_WEIRD_SERVER_REPLY rather than dispatching to the CONNACK
+# handler.
+<servercmd>
+PINGRESP-as-CONNACK TRUE
+</servercmd>
+</reply>
+
+# Client-side
+<client>
+<features>
+mqtt
+</features>
+<server>
+mqtt
+</server>
+<name>
+MQTT reject PINGRESP with nonzero remaining_length in place of CONNACK
+</name>
+<command option="binary-trace">
+mqtt://%HOSTIP:%MQTTPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+# Strip out the random part of the client id from the CONNECT message
+# before comparison
+<strippart>
+s/^(.* 00044d5154540402003c000c6375726c).*/$1/
+</strippart>
+<protocol>
+client CONNECT 18 00044d5154540402003c000c6375726c
+server PINGRESP-as-CONNACK 2 d0020000
+</protocol>
+
+# 8 is CURLE_WEIRD_SERVER_REPLY
+<errorcode>
+8
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2207 b/third-party/curl/tests/data/test2207
new file mode 100644
index 0000000000..61b423059e
--- /dev/null
+++ b/third-party/curl/tests/data/test2207
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+MQTT
+MQTT SUBSCRIBE
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+hello
+</data>
+
+# Send a DISCONNECT with remaining_length=2 after the PUBLISH.
+# MQTT 3.1.1 s. 3.14.1 requires DISCONNECT to have remaining_length == 0.
+# curl must reject this with CURLE_WEIRD_SERVER_REPLY.
+<servercmd>
+DISCONNECT-malformed TRUE
+</servercmd>
+</reply>
+
+# Client-side
+<client>
+<features>
+mqtt
+</features>
+<server>
+mqtt
+</server>
+<name>
+MQTT reject DISCONNECT with nonzero remaining_length
+</name>
+<command option="binary-trace">
+mqtt://%HOSTIP:%MQTTPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<strippart>
+s/^(.* 00044d5154540402003c000c6375726c).*/$1/
+</strippart>
+<protocol>
+client CONNECT 18 00044d5154540402003c000c6375726c
+server CONNACK 2 20020000
+client SUBSCRIBE 9 000100043232303700
+server SUBACK 3 9003000100
+server PUBLISH c 300c00043232303768656c6c6f0a
+server DISCONNECT-malformed 2 e0020000
+</protocol>
+
+# 8 is CURLE_WEIRD_SERVER_REPLY
+<errorcode>
+8
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2208 b/third-party/curl/tests/data/test2208
new file mode 100644
index 0000000000..354d1a2a7e
--- /dev/null
+++ b/third-party/curl/tests/data/test2208
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP proxy
+--location
+HTTP Basic auth
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+HTTP/1.1 301 redirect
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 0
+Connection: close
+Content-Type: text/html
+Location: http://@firsthost.com:9999/a/path/%TESTNUMBER0002
+
+</data>
+<data2>
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 4
+Connection: close
+Content-Type: text/html
+
+hey
+</data2>
+
+<datacheck>
+HTTP/1.1 301 redirect
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 0
+Connection: close
+Content-Type: text/html
+Location: http://@firsthost.com:9999/a/path/%TESTNUMBER0002
+
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 4
+Connection: close
+Content-Type: text/html
+
+hey
+</datacheck>
+
+</reply>
+
+# Client-side
+<client>
+<features>
+proxy
+</features>
+<server>
+http
+</server>
+<name>
+HTTP auth on redirect with empty URL userinfo
+</name>
+<command>
+-x http://%HOSTIP:%HTTPPORT http://firsthost.com -L -u joe:secret
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://firsthost.com/ HTTP/1.1
+Host: firsthost.com
+Authorization: Basic %b64[joe:secret]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://firsthost.com:9999/a/path/%TESTNUMBER0002 HTTP/1.1
+Host: firsthost.com:9999
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test221 b/third-party/curl/tests/data/test221
index 3191334985..03f6d05055 100644
--- a/third-party/curl/tests/data/test221
+++ b/third-party/curl/tests/data/test221
@@ -1,27 +1,30 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
 compressed
-FAILURE
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBNb24sIDI5IE5vdiAyMDA0IDIxOjU2OjUzIEdNVA0KU2Vy
-dmVyOiBBcGFjaGUvMS4zLjMxIChEZWJpYW4gR05VL0xpbnV4KSBtb2RfZ3ppcC8xLjMuMjYuMWEg
-UEhQLzQuMy45LTEgbW9kX3NzbC8yLjguMjAgT3BlblNTTC8wLjkuN2QgbW9kX3BlcmwvMS4yOQ0K
-VmFyeTogQWNjZXB0LUVuY29kaW5nDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1J
-U08tODg1OS0xDQpDb250ZW50LUVuY29kaW5nOiBnemlwDQpDb250ZW50LUxlbmd0aDogNDENCg0K
-CHmeq0EAA2xhbGFsYQDLycxLVTDkUsgB0UZcChCGMRcACgJxYBgAAAA=
+<data crlf="headers" nonewline="yes">
+HTTP/1.1 200 OK
+Date: Mon, 29 Nov 2004 21:56:53 GMT
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
+Vary: Accept-Encoding
+Content-Type: text/html; charset=ISO-8859-1
+Content-Encoding: gzip
+Content-Length: 41
+
+%hex[%08%79%9e%ab%41%00%03%6c%61%6c%61%6c%61%00%cb%c9%cc%4b%55%30%e4%52%c8%01%d1%46%5c%0a%10%86%31%17%00]hex%
+%hex[%02%71%60%18%00%00%00]hex%
 </data>
 
 # I removed the first three bytes of the gzip compressed contents
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Mon, 29 Nov 2004 21:56:53 GMT
 Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
@@ -34,7 +37,6 @@ Content-Length: 41
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -43,21 +45,20 @@ libz
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET gzip compressed content with broken gzip header
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --compressed
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
 s/^Accept-Encoding: [a-zA-Z, ]*/Accept-Encoding: xxx/
 </strippart>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test222 b/third-party/curl/tests/data/test222
index 246cf959b0..a1dbad6d97 100644
--- a/third-party/curl/tests/data/test222
+++ b/third-party/curl/tests/data/test222
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,41 +7,9 @@ HTTP GET
 compressed
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBNb24sIDI5IE5vdiAyMDA0IDIxOjU2OjUzIEdNVA0KU2Vy
-dmVyOiBBcGFjaGUvMS4zLjMxIChEZWJpYW4gR05VL0xpbnV4KSBtb2RfZ3ppcC8xLjMuMjYuMWEg
-UEhQLzQuMy45LTEgbW9kX3NzbC8yLjguMjAgT3BlblNTTC8wLjkuN2QgbW9kX3BlcmwvMS4yOQ0K
-VmFyeTogQWNjZXB0LUVuY29kaW5nDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1J
-U08tODg1OS0xDQpDb250ZW50LUVuY29kaW5nOiBkZWZsYXRlDQpDb250ZW50LUxlbmd0aDogMTMw
-NQ0KDQp4nNxY227jNhB9N5B/YP3UArZuthM5cLQoctkEzTbB2gW6TwYt0TYbSRRIyrk89Ns7lCiJ
-sRyvd4O+BEhicuacw+EMSZOZfHpKYrQhXFCWnnVdy+kikoYsounqrHszvev7/mjcd7ufgs7kl4u7
-89m3+0uUcfYPCWU/pkICEE2/TWeXX1B3LWV2attLTsQ6IVhaKZH2AocPJI3sZdLXPNF3rKEVyagL
-oltaQQehyqbaTW9Oo8A9dr2JbRhKRIQlmeMoIoAYj/2+4/c9FznDU8c99cYT2/AbhDxTH1HgOc6w
-7zp910eOd+rBz0BTKsSrOFKckLlYMy6DMOdxHY5hb+OXeRwXcITTCMV00aYWEB0eEaGWOmdJUlJS
-giRjtQDH/BktGUdhTEkq+4JGBP319RZJjlOxhIpaMItGyFDeGQyiAuFyBKVaqXBV3yWNiTjq5EJ1
-1BjiOZX4yUI3Eok8y0BfoOvZ7L5X/J320BW0jzpXRfvi5nzWQ7PL2z8v4fP24neAXd3cXvaK4T/f
-3V9ffoU2DPBIYoiplOpnTMiebubQChl7oEQU2ijPYoYjGAKWWp6QqJl1D2VYiEfGI9WEyNI8WRT2
-6fT2qBMSLumShlBXMP1BOPiYKEOBajzBCMW0IBsZeyScREedxXOVpB6Sa/JmxquyWEed2RqoCMPv
-gqZqMwlIbZ1qlWAGmw55zlEnxukqxysiihhIuqGcpQkMIEBHl9BYGxsqcUzl81yEjJNgdOIPrdHJ
-xN6yb4EzwkOQDAaWe2xgK/MWGubzAHttbCALk17XLMtjzJuxjkdjiGEIy3nb0yJUA7oDy3dfEV6H
-YjjKYJzRK7QRDsfFueFbI2di647pmYcsB13Prbza8ApTDuIPaowxgMgXIuQ0k3BEimCgTofXphIG
-pU/D9Vzt5eCCLHEey4ltGksY1H9eHWAZlD3YeWhWJ6Wt1os9sVusRmzNEvK2ECxgyksVdXjaJkPr
-1gKNply9HC4HYK2kaI3I4sU7XATAWkTRGpEXmh0uAmAtomiNSLiGPUZitjpcqqZowUaikeVZcrgg
-gLWUojUiEVkcLgJgLaJojQgTT4eLAFiLKJpRLxGp8/IHalYSqrppurHMcw5pEyTQ67fqGoXZiB8o
-yUZUxdgIQ0TdHA5XUWgtUxAbnYRyzvjhSiVea2myWdeEBVWtoFl6YgqHHKTgy83M/hudw+kBKaN5
-gm5Lx8SuEBqvvqfknJOY1Jlrmef6/hacWK5nwQXpDfcbbHWvOjl2/FGLWF2w2hx1L9p9cdoFLOdi
-75rMBM5RAhNeMzmXa/iqhpy1TCUS5xJuMqIOqexX3dqgT2CcUhKjqSQpfMOvJrbpbFGgSrvr/u8C
-ryKiimwgW3TOYhLcPaaE17jCVEVqm6FWvWoJqy94ThOaYmnOTnK4IRS1gYLWnZbX8473uQd7ufuc
-ru/v5bp7x4WlsT/qvW73eLjPPd5L9sd7vc5etzv6TtzfCWx/ZIPW2OX9brv8sCYyeDLBQwyuo7VO
-bXxG8jkjZ11OQngdKJt6SdWLssGZG9lRQ+1y7CTqewu4T4aqGDtdO5nG46xF3X64vcWVVKoNBXa4
-s6Nf9W3qt51aJbbeaQ3i7byx4t6G4/8vac5PZ2w4eGfG1Pvq4yfK9QYj9x2ZeoGn2MfP0sBzhifv
-yNI1oUmE44+fqOFwNPDekaiwD0998TN5Miz6rK//KxR0/gMAAP//gjMRo2MAAAAA//8DAN04jtE=
-</data>
-
-<datacheck>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Mon, 29 Nov 2004 21:56:53 GMT
 Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
@@ -49,123 +18,26 @@ Content-Type: text/html; charset=ISO-8859-1
 Content-Encoding: deflate
 Content-Length: 1305
 
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE project-listing SYSTEM "http://freshmeat.net/backend/fm-projects-0.4.dtd">
-<project-listing>
-  <project>
-    <project_id>1612</project_id>
-    <date_added>1998-08-21 04:01:29</date_added>
-    <date_updated>2004-10-18 02:22:23</date_updated>
-    <projectname_short>curl</projectname_short>
-    <projectname_full>curl and libcurl</projectname_full>
-    <desc_short>Command line tool and library for client-side URL transfers.</desc_short>
-    <desc_full>curl and libcurl is a tool for transferring files
-using URL syntax. It supports HTTP, HTTPS, FTP,
-FTPS, DICT, TELNET, LDAP, FILE, and GOPHER, as
-well as HTTP-post, HTTP-put, cookies, FTP upload,
-resumed transfers, passwords, portnumbers, SSL
-certificates, Kerberos, and proxies. It is powered
-by libcurl, the client-side URL transfer library.
-There are bindings to libcurl for over 20
-languages and environments.
-</desc_full>
-    <vitality_score>5784.57</vitality_score>
-    <vitality_percent>3.16</vitality_percent>
-    <vitality_rank>169</vitality_rank>
-    <popularity_score>6594.54</popularity_score>
-    <popularity_percent>13.81</popularity_percent>
-    <popularity_rank>105</popularity_rank>
-    <rating>8.50</rating>
-    <rating_count>21</rating_count>
-    <rating_rank>183</rating_rank>
-    <subscriptions>323</subscriptions>
-    <branch_name>Default</branch_name>
-    <url_project_page>http://freshmeat.net/projects/curl/</url_project_page>
-    <url_homepage>http://freshmeat.net/redir/curl/1612/url_homepage/</url_homepage>
-    <url_tgz>http://freshmeat.net/redir/curl/1612/url_tgz/</url_tgz>
-    <url_bz2>http://freshmeat.net/redir/curl/1612/url_bz2/</url_bz2>
-    <url_zip>http://freshmeat.net/redir/curl/1612/url_zip/</url_zip>
-    <url_changelog>http://freshmeat.net/redir/curl/1612/url_changelog/</url_changelog>
-    <url_rpm>http://freshmeat.net/redir/curl/1612/url_rpm/</url_rpm>
-    <url_deb>http://freshmeat.net/redir/curl/1612/url_deb/</url_deb>
-    <url_osx>http://freshmeat.net/redir/curl/1612/url_osx/</url_osx>
-    <url_bsdport>http://freshmeat.net/redir/curl/1612/url_bsdport/</url_bsdport>
-    <url_purchase></url_purchase>
-    <url_cvs>http://freshmeat.net/redir/curl/1612/url_cvs/</url_cvs>
-    <url_list>http://freshmeat.net/redir/curl/1612/url_list/</url_list>
-    <url_mirror>http://freshmeat.net/redir/curl/1612/url_mirror/</url_mirror>
-    <url_demo></url_demo>
-    <license>MIT/X Consortium License</license>
-    <latest_release>
-      <latest_release_version>7.12.2</latest_release_version>
-      <latest_release_id>176085</latest_release_id>
-      <latest_release_date>2004-10-18 02:22:23</latest_release_date>
-    </latest_release>
-    <screenshot_thumb></screenshot_thumb>
-    <authors>
-      <author>
-        <author_name>Daniel Stenberg</author_name>
-        <author_url>http://freshmeat.net/~bagder/</author_url>
-        <author_role>Owner</author_role>
-      </author>
-    </authors>
-    <descriminators>
-      <trove_id>12</trove_id>
-      <trove_id>226</trove_id>
-      <trove_id>3</trove_id>
-      <trove_id>2</trove_id>
-      <trove_id>188</trove_id>
-      <trove_id>216</trove_id>
-      <trove_id>200</trove_id>
-      <trove_id>220</trove_id>
-      <trove_id>164</trove_id>
-      <trove_id>90</trove_id>
-      <trove_id>89</trove_id>
-      <trove_id>809</trove_id>
-      <trove_id>150</trove_id>
-      <trove_id>224</trove_id>
-      <trove_id>900</trove_id>
-      <trove_id>839</trove_id>
-    </descriminators>
-    <dependencies>
-      <dependency type="recommended">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>7464</dependency_branch_id>
-        <dependency_project_id>7464</dependency_project_id>
-        <dependency_project_title>OpenSSL (Default)</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>7443</dependency_project_id>
-        <dependency_project_title>OpenLDAP</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>12351</dependency_project_id>
-        <dependency_project_title>zlib</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>32047</dependency_project_id>
-        <dependency_project_title>Heimdal</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>44532</dependency_project_id>
-        <dependency_project_title>c-ares</dependency_project_title>
-      </dependency>
-    </dependencies>
-  </project>
-</project-listing>
+%hex[%78%9c%dc%58%db%6e%e3%36%10%7d%37%90%7f%60%fd%d4%02%b6%6e%b6%13%39%70%b4%28%72%d9%04%cd%36%c1%da%05%ba%4f%06%2d%d1%36%1b%49%14%48%ca%b9%3c%f4%db%3b%94%28%89%b1%1c%af%77%83%be%04%48%62%72%e6%9c%c3%e1%0c%49%93%99%7c%7a%4a%62%b4%21%5c%50%96%9e%75%5d%cb%e9%22%92%86%2c%a2%e9%ea%ac%7b%33%bd%eb%fb%fe%68%dc%77%bb%9f%82%ce%e4%97%8b%bb%f3%d9%b7%fb%4b%94%71%f6%0f%09%65%3f%a6%42%02%10%4d%bf%4d%67%97%5f%50%77%2d%65%76%6a%db%4b%4e%c4%3a%21%58%5a%29%91%f6%02%87%0f%24%8d%ec%65%d2%d7%3c%d1%77%ac%a1%15%c9%a8%0b%a2%5b%5a%41%07%a1%ca%a6%da%4d%6f%4e%a3%c0%3d%76%bd%89%6d%18%4a%44%84%25%99%e3%28%22%80%18%8f%fd%be%e3%f7%3d%17%39%c3%53%c7%3d%f5%c6%13%db%f0%1b%84%3c%53%1f%51%e0%39%ce%b0%ef%3a%7d%d7%47%8e%77%ea%c1%cf%40%53%2a%c4%ab%38%52%9c%90%b9%58%33%2e%83%30%e7%71%1d%8e%61%6f%e3%97%79%1c%17%70%84%d3%08%c5%74%d1%a6%16%10%1d%1e%11%a1%96%3a%67%49%52%52%52%82%24%63%b5%00%c7%fc%19%2d%19%47%61%4c%49%2a%fb%82%46%04%fd%f5%f5%16%49%8e%53%b1%84%8a%5a%30%8b%46%c8%50%de%19%0c%a2%02%e1%72%04%a5%5a%a9%70%55%df%25%8d%89%38%ea%e4%42%75%d4%18%e2%39%95%f8%c9%42%37%12%89%3c%cb%40%5f%a0%eb%d9%ec%be%57%fc%9d%f6%d0%15%b4%8f%3a%57%45%fb%e2%e6%7c%d6%43%b3%cb%db%3f%2f%e1%f3%f6%e2%77%80%5d%dd%dc%5e%f6%8a%e1%3f%df%dd%5f%5f%7e%85%36%0c%f0%48%62%88%a9%94%ea%67%4c%c8%9e%6e%e6%d0]hex%
+%hex[%19%7b%a0%44%14%da%28%cf%62%86%23%18%02%96%5a%9e%90%a8%99%75%0f%65%58%88%47%c6%23%d5%84%c8%d2%3c%59%14%f6%e9%f4%f6%a8%13%12%2e%e9%92%86%50%57%30%fd%41%38%f8%98%28%43%81%6a%3c%c1%08%c5%b4%20%1b%19%7b%24%9c%44%47%9d%c5%73%95%a4%1e%92%6b%f2%66%c6%ab%b2%58%47%9d%d9%1a%a8%08%c3%ef%82%a6%6a%33%09%48%6d%9d%6a%95%60%06%9b%0e%79%ce%51%27%c6%e9%2a%c7%2b%22%8a%18%48%ba%a1%9c%a5%09%0c%20%40%47%97%d0%58%1b%1b%2a%71%4c%e5%f3%5c%84%8c%93%60%74%e2%0f%ad%d1%c9%c4%de%b2%6f%81%33%c2%43%90%0c%06%96%7b%6c%60%2b%f3%16%1a%e6%f3%00%7b%6d%6c%20%0b%93%5e%d7%2c%cb%63%cc%9b%b1%8e%47%63%88%61%08%cb%79%db%d3%22%54%03%ba%03%cb%77%5f%11%5e%87%62%38%ca%60%9c%d1%2b%b4%11%0e%c7%c5%b9%e1%5b%23%67%62%eb%8e%e9%99%87%2c%07%5d%cf%ad%bc%da%f0]hex%
+%hex[%53%0e%e2%0f%6a%8c%31%80%c8%17%22%e4%34%93%70%44%8a%60%a0%4e%87%d7%a6%12%06%a5%4f%c3%f5%5c%ed%e5%e0%82%2c%71%1e%cb%89%6d%1a%4b%18%d4%7f%5e%1d%60%19%94%3d%d8%79%68%56%27%a5%ad%d6%8b%3d%b1%5b%ac%46%6c%cd%12%f2%b6%10%2c%60%ca%4b%15%75%78%da%26%43%eb%d6%02%8d%a6%5c%bd%1c%2e%07%60%ad%a4%68%8d%c8%e2%c5%3b%5c%04%c0%5a%44%d1%1a%91%17%9a%1d%2e%02%60%2d%a2%68%8d%48%b8%86%3d%46%62%b6%3a%5c%aa%a6%68%c1%46%a2%91%e5%59%72%b8%20%80%b5%94%a2%35%22%11%59%1c%2e%02%60%2d%a2%68%8d%08%13%4f%87%8b%00%58%8b%28%9a%51%2f%11%a9%f3%f2%07%6a%56%12%aa%ba%69%ba%b1%cc%73%0e%69%13%24%d0%eb%b7%ea%1a%85%d9%88%1f%28%c9%46%54%c5%d8%08%43%44%dd%1c%0e%57%51%68%2d%53%10%1b%9d%84%72%ce%f8%e1%4a%25%5e%6b%69%b2%59%d7%84%05%55%ad%a0%59%7a%62]hex%
+%hex[%87%1c%a4%e0%cb%cd%cc%fe%1b%9d%c3%e9%01%29%a3%79%82%6e%4b%c7%c4%ae%10%1a%af%be%a7%e4%9c%93%98%d4%99%6b%99%e7%fa%fe%16%9c%58%ae%67%c1%05%e9%0d%f7%1b%6c%75%af%3a%39%76%fc%51%8b%58%5d%b0%da%1c%75%2f%da%7d%71%da%05%2c%e7%62%ef%9a%cc%04%ce%51%02%13%5e%33%39%97%6b%f8%aa%86%9c%b5%4c%25%12%e7%12%6e%32%a2%0e%a9%ec%57%dd%da%a0%4f%60%9c%52%12%a3%a9%24%29%7c%c3%af%26%b6%e9%6c%51%a0%4a%bb%eb%fe%ef%02%af%22%a2%8a%6c%20%5b%74%ce%62%12%dc%3d%a6%84%d7%b8%c2%54%45%6a%9b%a1%56%bd%6a%09%ab%2f%78%4e%13%9a%62%69%ce%4e%72%b8%21%14%b5%81%82%d6%9d%96%d7%f3%8e%f7%b9%07%7b%b9%fb%9c%ae%ef%ef%e5%ba%7b%c7%85%a5%b1%3f%ea%bd%6e%f7%78%b8%cf%3d%de%4b%f6%c7%7b%bd%ce%5e%b7%3b%fa%4e%dc%df%09%6c%7f%64%83%d6%d8%e5%fd%6e%bb%fc%b0%26%32%78%32%c1%43%0c%ae%a3%b5%4e%6d%7c%46%f2%39%23%67%5d%4e%42%78%1d%28%9b%7a%49%d5%8b%b2%c1%99%1b%d9%51%43%ed%72%ec%24%ea%7b%0b%b8%4f%86%aa%18%3b%5d%3b%99%c6%e3%ac%45%dd%7e%b8%bd%c5%95%54%aa%0d%05%76%b8%b3%a3%5f%f5%6d%ea%b7%9d%5a%25%b6%de%69%0d%e2%ed%bc%b1%e2%de%86%e3%ff%2f%69%ce%4f%67%6c%38%78%67%c6%d4%fb%ea%e3%27%ca%f5%06%23%f7%1d%99%7a%81%a7%d8%c7%cf%d2%c0%73%86%27%ef%c8%d2%35%a1%49%84%e3%8f%9f%a8%e1%70%34%f0%de%91%a8%b0%0f%4f%7d%f1%33%79%32%2c%fa%ac%af%ff%2b%14%74%fe%03%00%00%ff%ff%82%33%11%a3%63%00%00%00%00%ff%ff%03%00%dd%38%8e%d1]hex%
+</data>
+
+<datacheck>
+HTTP/1.1 200 OK%CR
+Date: Mon, 29 Nov 2004 21:56:53 GMT%CR
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29%CR
+Vary: Accept-Encoding%CR
+Content-Type: text/html; charset=ISO-8859-1%CR
+Content-Encoding: deflate%CR
+Content-Length: 1305%CR
+%CR
+%includetext %SRCDIR/data/data-xml1%
 </datacheck>
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -174,21 +46,20 @@ libz
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET deflate compressed content
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --compressed
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
 s/^Accept-Encoding: [a-zA-Z, ]*/Accept-Encoding: xxx/
 </strippart>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test223 b/third-party/curl/tests/data/test223
index 1e3f8c35a9..660c85da12 100644
--- a/third-party/curl/tests/data/test223
+++ b/third-party/curl/tests/data/test223
@@ -1,48 +1,29 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
 compressed
-FAILURE
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# this deflate chunk has three bytes removed from the beginning
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBNb24sIDI5IE5vdiAyMDA0IDIxOjU2OjUzIEdNVA0KU2Vy
-dmVyOiBBcGFjaGUvMS4zLjMxIChEZWJpYW4gR05VL0xpbnV4KSBtb2RfZ3ppcC8xLjMuMjYuMWEg
-UEhQLzQuMy45LTEgbW9kX3NzbC8yLjguMjAgT3BlblNTTC8wLjkuN2QgbW9kX3BlcmwvMS4yOQ0K
-VmFyeTogQWNjZXB0LUVuY29kaW5nDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1J
-U08tODg1OS0xDQpDb250ZW50LUVuY29kaW5nOiBkZWZsYXRlDQpDb250ZW50LUxlbmd0aDogMTMw
-NQ0KDQpY227jNhB9N5B/YP3UArZuthM5cLQoctkEzTbB2gW6TwYt0TYbSRRIyrk89Ns7lCiJsRyv
-d4O+BEhicuacw+EMSZOZfHpKYrQhXFCWnnVdy+kikoYsounqrHszvev7/mjcd7ufgs7kl4u789m3
-+0uUcfYPCWU/pkICEE2/TWeXX1B3LWV2attLTsQ6IVhaKZH2AocPJI3sZdLXPNF3rKEVyagLolta
-QQehyqbaTW9Oo8A9dr2JbRhKRIQlmeMoIoAYj/2+4/c9FznDU8c99cYT2/AbhDxTH1HgOc6w7zp9
-10eOd+rBz0BTKsSrOFKckLlYMy6DMOdxHY5hb+OXeRwXcITTCMV00aYWEB0eEaGWOmdJUlJSgiRj
-tQDH/BktGUdhTEkq+4JGBP319RZJjlOxhIpaMItGyFDeGQyiAuFyBKVaqXBV3yWNiTjq5EJ11Bji
-OZX4yUI3Eok8y0BfoOvZ7L5X/J320BW0jzpXRfvi5nzWQ7PL2z8v4fP24neAXd3cXvaK4T/f3V9f
-foU2DPBIYoiplOpnTMiebubQChl7oEQU2ijPYoYjGAKWWp6QqJl1D2VYiEfGI9WEyNI8WRT26fT2
-qBMSLumShlBXMP1BOPiYKEOBajzBCMW0IBsZeyScREedxXOVpB6Sa/JmxquyWEed2RqoCMPvgqZq
-MwlIbZ1qlWAGmw55zlEnxukqxysiihhIuqGcpQkMIEBHl9BYGxsqcUzl81yEjJNgdOIPrdHJxN6y
-b4EzwkOQDAaWe2xgK/MWGubzAHttbCALk17XLMtjzJuxjkdjiGEIy3nb0yJUA7oDy3dfEV6HYjjK
-YJzRK7QRDsfFueFbI2di647pmYcsB13Prbza8ApTDuIPaowxgMgXIuQ0k3BEimCgTofXphIGpU/D
-9Vzt5eCCLHEey4ltGksY1H9eHWAZlD3YeWhWJ6Wt1os9sVusRmzNEvK2ECxgyksVdXjaJkPr1gKN
-ply9HC4HYK2kaI3I4sU7XATAWkTRGpEXmh0uAmAtomiNSLiGPUZitjpcqqZowUaikeVZcrgggLWU
-ojUiEVkcLgJgLaJojQgTT4eLAFiLKJpRLxGp8/IHalYSqrppurHMcw5pEyTQ67fqGoXZiB8oyUZU
-xdgIQ0TdHA5XUWgtUxAbnYRyzvjhSiVea2myWdeEBVWtoFl6YgqHHKTgy83M/hudw+kBKaN5gm5L
-x8SuEBqvvqfknJOY1Jlrmef6/hacWK5nwQXpDfcbbHWvOjl2/FGLWF2w2hx1L9p9cdoFLOdi75rM
-BM5RAhNeMzmXa/iqhpy1TCUS5xJuMqIOqexX3dqgT2CcUhKjqSQpfMOvJrbpbFGgSrvr/u8CryKi
-imwgW3TOYhLcPaaE17jCVEVqm6FWvWoJqy94ThOaYmnOTnK4IRS1gYLWnZbX8473uQd7ufucru/v
-5bp7x4WlsT/qvW73eLjPPd5L9sd7vc5etzv6TtzfCWx/ZIPW2OX9brv8sCYyeDLBQwyuo7VObXxG
-8jkjZ11OQngdKJt6SdWLssGZG9lRQ+1y7CTqewu4T4aqGDtdO5nG46xF3X64vcWVVKoNBXa4s6Nf
-9W3qt51aJbbeaQ3i7byx4t6G4/8vac5PZ2w4eGfG1Pvq4yfK9QYj9x2ZeoGn2MfP0sBzhifvyNI1
-oUmE44+fqOFwNPDekaiwD0998TN5Miz6rK//KxR0/gMAAP//gjMRo2MAAAAA//8DAN04jtE=
+# this deflate chunk has three bytes removed from the beginning and is cut
+# short
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Mon, 29 Nov 2004 21:56:53 GMT
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
+Vary: Accept-Encoding
+Content-Type: text/html; charset=ISO-8859-1
+Content-Encoding: deflate
+Content-Length: 1305
+
+%hex[%58%db%6e%e3%36%10%7d%37%90%7f%60%fd%d4%02%b6%6e%b6%13%39%70%b4%28%72%d9%04%cd%36%c1%da%05%ba%4f%06%2d%d1%36%1b%49%14%48%ca%b9%3c%f4%db%3b%94%28%89%b1%1c%af%77%83%be%04%48%62%72%e6%9c%c3%e1%0c%49%93%99%7c%7a%4a%62%b4%21%5c%50%96%9e%75%5d%cb%e9%22%92%86%2c%a2%e9%ea%ac%7b%33%bd%eb%fb%fe%68%dc%77%bb%9f%82%ce%e4%97%8b%bb%f3%d9%b7%fb%4b%94%71%f6%0f%09%65%3f%a6%42%02%10%4d%bf%4d%67%97%5f%50%77%2d%65%76%6a%db%4b%4e%c4%3a%21%58%5a%29%91%f6%02%87%0f%24%8d%ec%65%d2%d7%3c%d1%77%ac%a1%15%c9%a8%0b%a2%5b%5a%41%07%a1%ca%a6%da%4d%6f%4e%a3%c0%3d%76%bd%89%6d%18%4a%44%84%25%99%e3%28%22%80%18%8f%fd%be%e3%f7%3d%17%39%c3%53%c7%3d%f5%c6%13%db%f0%1b%84%3c%53%1f%51%e0%39%ce%b0%ef%3a%7d%d7%47%8e%77%ea%c1%cf%40%53%2a%c4%ab%38%52%9c%90%b9%58%33%2e%83%30%e7%71%1d%8e%61%6f%e3%97%79%1c%17%70%84%d3%08%c5%74%d1%a6%16%10%1d%1e%11%a1%96%3a%67%49%52%52%52%82%24%63%b5%00%c7%fc%19%2d%19%47%61%4c%49%2a%fb%82%46%04%fd%f5%f5%16%49%8e%53%b1%84%8a%5a%30%8b%46%c8%50%de%19%0c%a2%02%e1%72%04%a5%5a%a9%70%55%df%25%8d%89%38%ea%e4%42%75%d4%18%e2%39%95%f8%c9%42%37%12%89%3c%cb%40%5f%a0%eb%d9%ec%be%57%fc%9d%f6%d0%15%b4%8f%3a%57%45%fb%e2%e6%7c%d6%43%b3%cb%db%3f%2f%e1%f3%f6%e2%77%80%5d%dd%dc%5e%f6%8a%e1%3f%df%dd%5f%5f%7e%85%36%0c%f0%48%62%88%a9%94%ea%67%4c%c8%9e%6e%e6%d0]hex%
 </data>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Mon, 29 Nov 2004 21:56:53 GMT
 Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
@@ -55,7 +36,6 @@ Content-Length: 1305
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -64,21 +44,20 @@ libz
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET deflate compressed content with broken deflate header
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --compressed
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
 s/^Accept-Encoding: [a-zA-Z, ]*/Accept-Encoding: xxx/
 </strippart>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test224 b/third-party/curl/tests/data/test224
index f006862286..e9e867e388 100644
--- a/third-party/curl/tests/data/test224
+++ b/third-party/curl/tests/data/test224
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,57 +7,21 @@ HTTP GET
 compressed
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBNb24sIDI5IE5vdiAyMDA0IDIxOjU2OjUzIEdNVA0KU2Vy
-dmVyOiBBcGFjaGUvMS4zLjMxIChEZWJpYW4gR05VL0xpbnV4KSBtb2RfZ3ppcC8xLjMuMjYuMWEg
-UEhQLzQuMy45LTEgbW9kX3NzbC8yLjguMjAgT3BlblNTTC8wLjkuN2QgbW9kX3BlcmwvMS4yOQ0K
-VmFyeTogQWNjZXB0LUVuY29kaW5nDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1J
-U08tODg1OS0xDQpDb250ZW50LUVuY29kaW5nOiBnemlwDQpDb250ZW50LUxlbmd0aDogMjE4Ng0K
-DQofiwgcv7yrQQIDMAB0aGlzIGlzIGFuIGV4dHJhIGZpZWxkIHRoYXQgbXVzdCBiZSByZW1vdmVk
-X19fX19sb25nLWZpbGVuYW1lLXh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4
-eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4AHRoaXMgaXMgYSBj
-b21tZW50IHRoYXQgbXVzdCBiZSBza2lwcGVkACvNS87PLShKLS5OTVFIr8osUEhJLElUKM8syVDI
-yc9Lh4hlpCampBZxAQC4UJ7LLQAAAA==
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Mon, 29 Nov 2004 21:56:53 GMT
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
+Vary: Accept-Encoding
+Content-Type: text/html; charset=ISO-8859-1
+Content-Encoding: gzip
+Content-Length: 2186
+
+%hex[%1f%8b%08%1c%bf%bc%ab%41%02%03%30%00%74%68%69%73%20%69%73%20%61%6e%20%65%78%74%72%61%20%66%69%65%6c%64%20%74%68%61%74%20%6d%75%73%74%20%62%65%20%72%65%6d%6f%76%65%64%5f%5f%5f%5f%5f%6c%6f%6e%67%2d%66%69%6c%65%6e%61%6d%65%2dxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx%00%74%68%69%73%20%69%73%20%61%20%63%6f%6d%6d%65%6e%74%20%74%68%61%74%20%6d%75%73%74%20%62%65%20%73%6b%69%70%70%65%64%00%2b%cd%4b%ce%cf%2d%28%4a%2d%2e%4e%4d%51%48%af%ca%2c%50%48%49%2c%49%54%28%cf%2c%c9%50%c8%c9%cf%4b%87%88%65%a4%26%a6%a4%16%71%01%00%b8%50%9e%cb%2d%00%00%00]hex%
 </data>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Mon, 29 Nov 2004 21:56:53 GMT
 Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
@@ -70,7 +35,6 @@ uncompressed gzip data with long gzip header
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -79,21 +43,20 @@ libz
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET gzip compressed content with huge comment and extra field
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --compressed
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
 s/^Accept-Encoding: [a-zA-Z, ]*/Accept-Encoding: xxx/
 </strippart>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test225 b/third-party/curl/tests/data/test225
index 5c8efd9d93..403bd2fec2 100644
--- a/third-party/curl/tests/data/test225
+++ b/third-party/curl/tests/data/test225
@@ -1,8 +1,8 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
-FAILURE
 </keywords>
 </info>
 # Client-side
@@ -10,10 +10,10 @@ FAILURE
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP %0a-code in URL's name part
- </name>
- <command>
+</name>
+<command>
 ftp://bad%0auser:passwd@%HOSTIP:%FTPPORT/%TESTNUMBER%0a
 </command>
 </client>
diff --git a/third-party/curl/tests/data/test226 b/third-party/curl/tests/data/test226
index 9395457664..dbf6d1af38 100644
--- a/third-party/curl/tests/data/test226
+++ b/third-party/curl/tests/data/test226
@@ -1,8 +1,8 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
-FAILURE
 </keywords>
 </info>
 
@@ -11,10 +11,10 @@ FAILURE
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP %0d-code in URL's CWD part
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER%0d
 </command>
 </client>
diff --git a/third-party/curl/tests/data/test227 b/third-party/curl/tests/data/test227
index 82935ce06b..4b0e682fad 100644
--- a/third-party/curl/tests/data/test227
+++ b/third-party/curl/tests/data/test227
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,17 +28,17 @@ REPLY FAIL 500 this might not be a failure!
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP with quote ops
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -Q "NOOP 1" -Q "+NOOP 2" -Q "-NOOP 3" -Q "*FAIL" -Q "+*FAIL HARD"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test228 b/third-party/curl/tests/data/test228
index d30c2a4a87..446d6de39e 100644
--- a/third-party/curl/tests/data/test228
+++ b/third-party/curl/tests/data/test228
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -26,18 +27,17 @@ REPLY ACCT 230 thank you
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP RETR with ACCT
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --ftp-account "one count"
 </command>
 </client>
 
-
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 ACCT one count
diff --git a/third-party/curl/tests/data/test229 b/third-party/curl/tests/data/test229
index 5f06320bab..bd911db9ee 100644
--- a/third-party/curl/tests/data/test229
+++ b/third-party/curl/tests/data/test229
@@ -1,9 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
 ACCT
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -19,17 +19,17 @@ REPLY ACCT 532 bluah!
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP RETR with bad ACCT
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --ftp-account "one count"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 ACCT one count
diff --git a/third-party/curl/tests/data/test23 b/third-party/curl/tests/data/test23
index 46872e82ea..8126025b90 100644
--- a/third-party/curl/tests/data/test23
+++ b/third-party/curl/tests/data/test23
@@ -1,8 +1,8 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
-unsupported protocol
-FAILURE
+unsupported scheme
 </keywords>
 </info>
 # Server-side
@@ -16,10 +16,10 @@ FAILURE
 <server>
 http
 </server>
- <name>
+<name>
 unsupported protocol:// URL
- </name>
- <command>
+</name>
+<command>
 htfp://%HOSTIP:%HTTPPORT/none.htfml
 </command>
 </client>
diff --git a/third-party/curl/tests/data/test230 b/third-party/curl/tests/data/test230
index 40334c5fa7..d212eae682 100644
--- a/third-party/curl/tests/data/test230
+++ b/third-party/curl/tests/data/test230
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,42 +7,9 @@ HTTP GET
 compressed
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBNb24sIDI5IE5vdiAyMDA0IDIxOjU2OjUzIEdNVA0KU2Vy
-dmVyOiBBcGFjaGUvMS4zLjMxIChEZWJpYW4gR05VL0xpbnV4KSBtb2RfZ3ppcC8xLjMuMjYuMWEg
-UEhQLzQuMy45LTEgbW9kX3NzbC8yLjguMjAgT3BlblNTTC8wLjkuN2QgbW9kX3BlcmwvMS4yOQ0K
-VmFyeTogQWNjZXB0LUVuY29kaW5nDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1J
-U08tODg1OS0xDQpDb250ZW50LUVuY29kaW5nOiBkZWZsYXRlLCBpZGVudGl0eSwgZ3ppcA0KQ29u
-dGVudC1MZW5ndGg6IDEzMjgNCg0KH4sIAPpl+lkAAwEZBeb6eJzcWNtu4zYQfTeQf2D91AK2brYT
-OXC0KHLZBM02wdoFuk8GLdE2G0kUSMq5PPTbO5QoibEcr3eDvgRIYnLmnMPhDEmTmXx6SmK0IVxQ
-lp51XcvpIpKGLKLp6qx7M73r+/5o3He7n4LO5JeLu/PZt/tLlHH2DwllP6ZCAhBNv01nl19Qdy1l
-dmrbS07EOiFYWimR9gKHDySN7GXS1zzRd6yhFcmoC6JbWkEHocqm2k1vTqPAPXa9iW0YSkSEJZnj
-KCKAGI/9vuP3PRc5w1PHPfXGE9vwG4Q8Ux9R4DnOsO86fddHjnfqwc9AUyrEqzhSnJC5WDMugzDn
-cR2OYW/jl3kcF3CE0wjFdNGmFhAdHhGhljpnSVJSUoIkY7UAx/wZLRlHYUxJKvuCRgT99fUWSY5T
-sYSKWjCLRshQ3hkMogLhcgSlWqlwVd8ljYk46uRCddQY4jmV+MlCNxKJPMtAX6Dr2ey+V/yd9tAV
-tI86V0X74uZ81kOzy9s/L+Hz9uJ3gF3d3F72iuE/391fX36FNgzwSGKIqZTqZ0zInm7m0AoZe6BE
-FNooz2KGIxgCllqekKiZdQ9lWIhHxiPVhMjSPFkU9un09qgTEi7pkoZQVzD9QTj4mChDgWo8wQjF
-tCAbGXsknERHncVzlaQekmvyZsarslhHndkaqAjD74KmajMJSG2dapVgBpsOec5RJ8bpKscrIooY
-SLqhnKUJDCBAR5fQWBsbKnFM5fNchIyTYHTiD63RycTesm+BM8JDkAwGlntsYCvzFhrm8wB7bWwg
-C5Ne1yzLY8ybsY5HY4hhCMt529MiVAO6A8t3XxFeh2I4ymCc0Su0EQ7HxbnhWyNnYuuO6ZmHLAdd
-z6282vAKUw7iD2qMMYDIFyLkNJNwRIpgoE6H16YSBqVPw/Vc7eXggixxHsuJbRpLGNR/Xh1gGZQ9
-2HloVielrdaLPbFbrEZszRLythAsYMpLFXV42iZD69YCjaZcvRwuB2CtpGiNyOLFO1wEwFpE0RqR
-F5odLgJgLaJojUi4hj1GYrY6XKqmaMFGopHlWXK4IIC1lKI1IhFZHC4CYC2iaI0IE0+HiwBYiyia
-US8RqfPyB2pWEqq6abqxzHMOaRMk0Ou36hqF2YgfKMlGVMXYCENE3RwOV1FoLVMQG52Ecs744Uol
-XmtpslnXhAVVraBZemIKhxyk4MvNzP4bncPpASmjeYJuS8fErhAar76n5JyTmNSZa5nn+v4WnFiu
-Z8EF6Q33G2x1rzo5dvxRi1hdsNocdS/afXHaBSznYu+azATOUQITXjM5l2v4qoactUwlEucSbjKi
-DqnsV93aoE9gnFISo6kkKXzDrya26WxRoEq76/7vAq8ioopsIFt0zmIS3D2mhNe4wlRFapuhVr1q
-CasveE4TmmJpzk5yuCEUtYGC1p2W1/OO97kHe7n7nK7v7+W6e8eFpbE/6r1u93i4zz3eS/bHe73O
-Xrc7+k7c3wlsf2SD1tjl/W67/LAmMngywUMMrqO1Tm18RvI5I2ddTkJ4HSibeknVi7LBmRvZUUPt
-cuwk6nsLuE+Gqhg7XTuZxuOsRd1+uL3FlVSqDQV2uLOjX/Vt6redWiW23mkN4u28seLehuP/L2nO
-T2dsOHhnxtT76uMnyvUGI/cdmXqBp9jHz9LAc4Yn78jSNaFJhOOPn6jhcDTw3pGosA9PffEzeTIs
-+qyv/ysUdP4DAAD//4IzEaNjAAAAAP//AwDdOI7RbCh2MRkFAAA=
-</data>
-
-<datacheck>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Mon, 29 Nov 2004 21:56:53 GMT
 Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
@@ -50,123 +18,26 @@ Content-Type: text/html; charset=ISO-8859-1
 Content-Encoding: deflate, identity, gzip
 Content-Length: 1328
 
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE project-listing SYSTEM "http://freshmeat.net/backend/fm-projects-0.4.dtd">
-<project-listing>
-  <project>
-    <project_id>1612</project_id>
-    <date_added>1998-08-21 04:01:29</date_added>
-    <date_updated>2004-10-18 02:22:23</date_updated>
-    <projectname_short>curl</projectname_short>
-    <projectname_full>curl and libcurl</projectname_full>
-    <desc_short>Command line tool and library for client-side URL transfers.</desc_short>
-    <desc_full>curl and libcurl is a tool for transferring files
-using URL syntax. It supports HTTP, HTTPS, FTP,
-FTPS, DICT, TELNET, LDAP, FILE, and GOPHER, as
-well as HTTP-post, HTTP-put, cookies, FTP upload,
-resumed transfers, passwords, portnumbers, SSL
-certificates, Kerberos, and proxies. It is powered
-by libcurl, the client-side URL transfer library.
-There are bindings to libcurl for over 20
-languages and environments.
-</desc_full>
-    <vitality_score>5784.57</vitality_score>
-    <vitality_percent>3.16</vitality_percent>
-    <vitality_rank>169</vitality_rank>
-    <popularity_score>6594.54</popularity_score>
-    <popularity_percent>13.81</popularity_percent>
-    <popularity_rank>105</popularity_rank>
-    <rating>8.50</rating>
-    <rating_count>21</rating_count>
-    <rating_rank>183</rating_rank>
-    <subscriptions>323</subscriptions>
-    <branch_name>Default</branch_name>
-    <url_project_page>http://freshmeat.net/projects/curl/</url_project_page>
-    <url_homepage>http://freshmeat.net/redir/curl/1612/url_homepage/</url_homepage>
-    <url_tgz>http://freshmeat.net/redir/curl/1612/url_tgz/</url_tgz>
-    <url_bz2>http://freshmeat.net/redir/curl/1612/url_bz2/</url_bz2>
-    <url_zip>http://freshmeat.net/redir/curl/1612/url_zip/</url_zip>
-    <url_changelog>http://freshmeat.net/redir/curl/1612/url_changelog/</url_changelog>
-    <url_rpm>http://freshmeat.net/redir/curl/1612/url_rpm/</url_rpm>
-    <url_deb>http://freshmeat.net/redir/curl/1612/url_deb/</url_deb>
-    <url_osx>http://freshmeat.net/redir/curl/1612/url_osx/</url_osx>
-    <url_bsdport>http://freshmeat.net/redir/curl/1612/url_bsdport/</url_bsdport>
-    <url_purchase></url_purchase>
-    <url_cvs>http://freshmeat.net/redir/curl/1612/url_cvs/</url_cvs>
-    <url_list>http://freshmeat.net/redir/curl/1612/url_list/</url_list>
-    <url_mirror>http://freshmeat.net/redir/curl/1612/url_mirror/</url_mirror>
-    <url_demo></url_demo>
-    <license>MIT/X Consortium License</license>
-    <latest_release>
-      <latest_release_version>7.12.2</latest_release_version>
-      <latest_release_id>176085</latest_release_id>
-      <latest_release_date>2004-10-18 02:22:23</latest_release_date>
-    </latest_release>
-    <screenshot_thumb></screenshot_thumb>
-    <authors>
-      <author>
-        <author_name>Daniel Stenberg</author_name>
-        <author_url>http://freshmeat.net/~bagder/</author_url>
-        <author_role>Owner</author_role>
-      </author>
-    </authors>
-    <descriminators>
-      <trove_id>12</trove_id>
-      <trove_id>226</trove_id>
-      <trove_id>3</trove_id>
-      <trove_id>2</trove_id>
-      <trove_id>188</trove_id>
-      <trove_id>216</trove_id>
-      <trove_id>200</trove_id>
-      <trove_id>220</trove_id>
-      <trove_id>164</trove_id>
-      <trove_id>90</trove_id>
-      <trove_id>89</trove_id>
-      <trove_id>809</trove_id>
-      <trove_id>150</trove_id>
-      <trove_id>224</trove_id>
-      <trove_id>900</trove_id>
-      <trove_id>839</trove_id>
-    </descriminators>
-    <dependencies>
-      <dependency type="recommended">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>7464</dependency_branch_id>
-        <dependency_project_id>7464</dependency_project_id>
-        <dependency_project_title>OpenSSL (Default)</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>7443</dependency_project_id>
-        <dependency_project_title>OpenLDAP</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>12351</dependency_project_id>
-        <dependency_project_title>zlib</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>32047</dependency_project_id>
-        <dependency_project_title>Heimdal</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>44532</dependency_project_id>
-        <dependency_project_title>c-ares</dependency_project_title>
-      </dependency>
-    </dependencies>
-  </project>
-</project-listing>
+%hex[%1f%8b%08%00%fa%65%fa%59%00%03%01%19%05%e6%fa%78%9c%dc%58%db%6e%e3%36%10%7d%37%90%7f%60%fd%d4%02%b6%6e%b6%13%39%70%b4%28%72%d9%04%cd%36%c1%da%05%ba%4f%06%2d%d1%36%1b%49%14%48%ca%b9%3c%f4%db%3b%94%28%89%b1%1c%af%77%83%be%04%48%62%72%e6%9c%c3%e1%0c%49%93%99%7c%7a%4a%62%b4%21%5c%50%96%9e%75%5d%cb%e9%22%92%86%2c%a2%e9%ea%ac%7b%33%bd%eb%fb%fe%68%dc%77%bb%9f%82%ce%e4%97%8b%bb%f3%d9%b7%fb%4b%94%71%f6%0f%09%65%3f%a6%42%02%10%4d%bf%4d%67%97%5f%50%77%2d%65%76%6a%db%4b%4e%c4%3a%21%58%5a%29%91%f6%02%87%0f%24%8d%ec%65%d2%d7%3c%d1%77%ac%a1%15%c9%a8%0b%a2%5b%5a%41%07%a1%ca%a6%da%4d%6f%4e%a3%c0%3d%76%bd%89%6d%18%4a%44%84%25%99%e3%28%22%80%18%8f%fd%be%e3%f7%3d%17%39%c3%53%c7%3d%f5%c6%13%db%f0%1b%84%3c%53%1f%51%e0%39%ce%b0%ef%3a%7d%d7%47%8e%77%ea%c1%cf%40%53%2a%c4%ab%38%52%9c%90%b9%58%33%2e%83%30%e7%71%1d%8e%61%6f%e3%97%79%1c%17%70%84%d3%08%c5%74%d1%a6%16%10%1d%1e%11%a1%96%3a%67%49%52%52%52%82%24%63%b5%00%c7%fc%19%2d%19%47%61%4c%49%2a%fb%82%46%04%fd%f5%f5%16%49%8e%53%b1%84%8a%5a%30%8b%46%c8%50%de%19%0c%a2%02%e1%72%04%a5%5a%a9%70%55%df%25%8d%89%38%ea%e4%42%75%d4%18%e2%39%95%f8%c9%42%37%12%89%3c%cb%40%5f%a0%eb%d9%ec%be%57%fc%9d%f6%d0%15%b4%8f%3a%57%45%fb%e2%e6%7c%d6%43%b3%cb%db%3f%2f%e1%f3%f6%e2%77%80%5d%dd%dc%5e%f6%8a%e1%3f%df%dd%5f%5f%7e%85%36%0c%f0%48%62%88%a9%94%ea%67%4c%c8%9e%6e%e6%d0]hex%
+%hex[%19%7b%a0%44%14%da%28%cf%62%86%23%18%02%96%5a%9e%90%a8%99%75%0f%65%58%88%47%c6%23%d5%84%c8%d2%3c%59%14%f6%e9%f4%f6%a8%13%12%2e%e9%92%86%50%57%30%fd%41%38%f8%98%28%43%81%6a%3c%c1%08%c5%b4%20%1b%19%7b%24%9c%44%47%9d%c5%73%95%a4%1e%92%6b%f2%66%c6%ab%b2%58%47%9d%d9%1a%a8%08%c3%ef%82%a6%6a%33%09%48%6d%9d%6a%95%60%06%9b%0e%79%ce%51%27%c6%e9%2a%c7%2b%22%8a%18%48%ba%a1%9c%a5%09%0c%20%40%47%97%d0%58%1b%1b%2a%71%4c%e5%f3%5c%84%8c%93%60%74%e2%0f%ad%d1%c9%c4%de%b2%6f%81%33%c2%43%90%0c%06%96%7b%6c%60%2b%f3%16%1a%e6%f3%00%7b%6d%6c%20%0b%93%5e%d7%2c%cb%63%cc%9b%b1%8e%47%63%88%61%08%cb%79%db%d3%22%54%03%ba%03%cb%77%5f%11%5e%87%62%38%ca%60%9c%d1%2b%b4%11%0e%c7%c5%b9%e1%5b%23%67%62%eb%8e%e9%99%87%2c%07%5d%cf%ad%bc%da%f0]hex%
+%hex[%53%0e%e2%0f%6a%8c%31%80%c8%17%22%e4%34%93%70%44%8a%60%a0%4e%87%d7%a6%12%06%a5%4f%c3%f5%5c%ed%e5%e0%82%2c%71%1e%cb%89%6d%1a%4b%18%d4%7f%5e%1d%60%19%94%3d%d8%79%68%56%27%a5%ad%d6%8b%3d%b1%5b%ac%46%6c%cd%12%f2%b6%10%2c%60%ca%4b%15%75%78%da%26%43%eb%d6%02%8d%a6%5c%bd%1c%2e%07%60%ad%a4%68%8d%c8%e2%c5%3b%5c%04%c0%5a%44%d1%1a%91%17%9a%1d%2e%02%60%2d%a2%68%8d%48%b8%86%3d%46%62%b6%3a%5c%aa%a6%68%c1%46%a2%91%e5%59%72%b8%20%80%b5%94%a2%35%22%11%59%1c%2e%02%60%2d%a2%68%8d%08%13%4f%87%8b%00%58%8b%28%9a%51%2f%11%a9%f3%f2%07%6a%56%12%aa%ba%69%ba%b1%cc%73%0e%69%13%24%d0%eb%b7%ea%1a%85%d9%88%1f%28%c9%46%54%c5%d8%08%43%44%dd%1c%0e%57%51%68%2d%53%10%1b%9d%84%72%ce%f8%e1%4a%25%5e%6b%69%b2%59%d7%84%05%55%ad%a0%59%7a%62]hex%
+%hex[%87%1c%a4%e0%cb%cd%cc%fe%1b%9d%c3%e9%01%29%a3%79%82%6e%4b%c7%c4%ae%10%1a%af%be%a7%e4%9c%93%98%d4%99%6b%99%e7%fa%fe%16%9c%58%ae%67%c1%05%e9%0d%f7%1b%6c%75%af%3a%39%76%fc%51%8b%58%5d%b0%da%1c%75%2f%da%7d%71%da%05%2c%e7%62%ef%9a%cc%04%ce%51%02%13%5e%33%39%97%6b%f8%aa%86%9c%b5%4c%25%12%e7%12%6e%32%a2%0e%a9%ec%57%dd%da%a0%4f%60%9c%52%12%a3%a9%24%29%7c%c3%af%26%b6%e9%6c%51%a0%4a%bb%eb%fe%ef%02%af%22%a2%8a%6c%20%5b%74%ce%62%12%dc%3d%a6%84%d7%b8%c2%54%45%6a%9b%a1%56%bd%6a%09%ab%2f%78%4e%13%9a%62%69%ce%4e%72%b8%21%14%b5%81%82%d6%9d%96%d7%f3%8e%f7%b9%07%7b%b9%fb%9c%ae%ef%ef%e5%ba%7b%c7%85%a5%b1%3f%ea%bd%6e%f7%78%b8%cf%3d%de%4b%f6%c7%7b%bd%ce%5e%b7%3b%fa%4e%dc%df%09%6c%7f%64%83%d6%d8%e5%fd%6e%bb%fc%b0%26%32%78%32%c1%43%0c%ae%a3%b5%4e%6d%7c%46%f2%39%23%67%5d%4e%42%78%1d%28%9b%7a%49%d5%8b%b2%c1%99%1b%d9%51%43%ed%72%ec%24%ea%7b%0b%b8%4f%86%aa%18%3b%5d%3b%99%c6%e3%ac%45%dd%7e%b8%bd%c5%95%54%aa%0d%05%76%b8%b3%a3%5f%f5%6d%ea%b7%9d%5a%25%b6%de%69%0d%e2%ed%bc%b1%e2%de%86%e3%ff%2f%69%ce%4f%67%6c%38%78%67%c6%d4%fb%ea%e3%27%ca%f5%06%23%f7%1d%99%7a%81%a7%d8%c7%cf%d2%c0%73%86%27%ef%c8%d2%35%a1%49%84%e3%8f%9f%a8%e1%70%34%f0%de%91%a8%b0%0f%4f%7d%f1%33%79%32%2c%fa%ac%af%ff%2b%14%74%fe%03%00%00%ff%ff%82%33%11%a3%63%00%00%00%00%ff%ff%03%00%dd%38%8e%d1%6c%28%76%31%19%05%00%00]hex%
+</data>
+
+<datacheck>
+HTTP/1.1 200 OK%CR
+Date: Mon, 29 Nov 2004 21:56:53 GMT%CR
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29%CR
+Vary: Accept-Encoding%CR
+Content-Type: text/html; charset=ISO-8859-1%CR
+Content-Encoding: deflate, identity, gzip%CR
+Content-Length: 1328%CR
+%CR
+%includetext %SRCDIR/data/data-xml1%
 </datacheck>
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -175,21 +46,20 @@ libz
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET multiply compressed content
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --compressed
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
 s/^Accept-Encoding: [a-zA-Z, ]*/Accept-Encoding: xxx/
 </strippart>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2300 b/third-party/curl/tests/data/test2300
index 1e3eb8a393..c568e84bb9 100644
--- a/third-party/curl/tests/data/test2300
+++ b/third-party/curl/tests/data/test2300
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,9 @@ WebSockets
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 101 Switching to WebSockets swsclose
 Server: test-server/fake
 Upgrade: websocket
@@ -22,37 +22,38 @@ upgrade
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
-# for the forced CURL_ENTROPY
+# require Debug for the forced CURL_ENTROPY
 <features>
-debug
+Debug
 ws
 </features>
+<setenv>
+CURL_ENTROPY=12345678
+</setenv>
 <server>
 http
 </server>
- <name>
+<name>
 WebSockets upgrade only
- </name>
- <command>
-ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</name>
+<command>
+-T . ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nocheck="yes">
+<protocol crlf="headers" nocheck="yes">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 Upgrade: websocket
-Connection: Upgrade
 Sec-WebSocket-Version: 13
 Sec-WebSocket-Key: NDMyMTUzMjE2MzIxNzMyMQ==
+Connection: Upgrade
 
 </protocol>
 <errorcode>
diff --git a/third-party/curl/tests/data/test2301 b/third-party/curl/tests/data/test2301
index 9ada44da0f..4767063105 100644
--- a/third-party/curl/tests/data/test2301
+++ b/third-party/curl/tests/data/test2301
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,9 @@ WebSockets
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes" nonewline="yes">
+<data crlf="headers" nocheck="yes" nonewline="yes">
 HTTP/1.1 101 Switching to WebSockets
 Server: test-server/fake
 Upgrade: websocket
@@ -24,14 +24,16 @@ upgrade
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
-# require debug for the forced CURL_ENTROPY
+# require Debug for the forced CURL_ENTROPY
 <features>
-debug
+Debug
 ws
 </features>
+<setenv>
+CURL_ENTROPY=12345678
+</setenv>
 <server>
 http
 </server>
@@ -46,18 +48,17 @@ ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nocheck="yes" nonewline="yes">
+<protocol crlf="yes" nonewline="yes" nocheck="yes">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: webbie-sox/3
 Accept: */*
 Upgrade: websocket
-Connection: Upgrade
 Sec-WebSocket-Version: 13
 Sec-WebSocket-Key: NDMyMTUzMjE2MzIxNzMyMQ==
+Connection: Upgrade
 
 %hex[%8a%00]hex%
 </protocol>
diff --git a/third-party/curl/tests/data/test2302 b/third-party/curl/tests/data/test2302
index cb8ae0f73f..396ba16a7e 100644
--- a/third-party/curl/tests/data/test2302
+++ b/third-party/curl/tests/data/test2302
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,9 @@ WebSockets
 </keywords>
 </info>
 
-#
-# Sends a PING + a 5 byte hello TEXT
+# Sends a PING + a 5-byte hello TEXT
 <reply>
-<data nocheck="yes" nonewline="yes">
+<data crlf="headers" nocheck="yes" nonewline="yes">
 HTTP/1.1 101 Switching to WebSockets
 Server: test-server/fake
 Upgrade: websocket
@@ -24,14 +24,16 @@ upgrade
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
-# require debug for the forced CURL_ENTROPY
+# require Debug for the forced CURL_ENTROPY
 <features>
-debug
+Debug
 ws
 </features>
+<setenv>
+CURL_ENTROPY=12345678
+</setenv>
 <server>
 http
 </server>
@@ -46,25 +48,26 @@ ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
-# PONG with no data and the 32 bit mask
-#
+# PONG with no data and the 32-bit mask
 <verify>
-<protocol nocheck="yes" nonewline="yes">
+<protocol crlf="yes" nonewline="yes" nocheck="yes">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: webbie-sox/3
 Accept: */*
 Upgrade: websocket
-Connection: Upgrade
 Sec-WebSocket-Version: 13
 Sec-WebSocket-Key: NDMyMTUzMjE2MzIxNzMyMQ==
+Connection: Upgrade
 
 %hex[%8a%808321]hex%
 </protocol>
 <stdout mode="text">
-68 65 6c 6c 6f 
+68 65 6c 6c 6f%SP
 RECFLAGS: 1
 </stdout>
+<limits>
+Maximum allocated: 1300000
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test2303 b/third-party/curl/tests/data/test2303
index 2eb5084a9e..884123dfba 100644
--- a/third-party/curl/tests/data/test2303
+++ b/third-party/curl/tests/data/test2303
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,9 +6,8 @@ WebSockets
 </keywords>
 </info>
 
-#
 <reply>
-<data nocheck="yes" nonewline="yes">
+<data crlf="headers" nocheck="yes" nonewline="yes">
 HTTP/1.1 200 Oblivious
 Server: test-server/fake
 Something: else
@@ -17,14 +17,16 @@ hello
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# require debug for the forced CURL_ENTROPY
+# require Debug for the forced CURL_ENTROPY
 <features>
-debug
+Debug
 ws
 </features>
+<setenv>
+CURL_ENTROPY=12345678
+</setenv>
 <server>
 http
 </server>
@@ -40,20 +42,23 @@ ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: webbie-sox/3
 Accept: */*
 Upgrade: websocket
-Connection: Upgrade
 Sec-WebSocket-Version: 13
 Sec-WebSocket-Key: NDMyMTUzMjE2MzIxNzMyMQ==
+Connection: Upgrade
 
 </protocol>
 # 22 == CURLE_HTTP_RETURNED_ERROR
 <errorcode>
 22
 </errorcode>
+<limits>
+Maximum allocated: 1300000
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test2304 b/third-party/curl/tests/data/test2304
index 0f20af7dcd..aab6dc822b 100644
--- a/third-party/curl/tests/data/test2304
+++ b/third-party/curl/tests/data/test2304
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,8 +6,7 @@ WebSockets
 </keywords>
 </info>
 
-#
-# Sends a PING + a 5 byte hello TEXT
+# Close connection during websocket upgrade
 <reply>
 <data nocheck="yes" nonewline="yes">
 HTTP/1.1 101 Switching to WebSockets swsclose
@@ -16,7 +16,6 @@ Connection: Upgrade
 Something: else
 Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
 
-%hex[%89%00%81%05hello]hex%
 </data>
 # allow upgrade
 <servercmd>
@@ -24,14 +23,16 @@ upgrade
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
-# require debug for the forced CURL_ENTROPY
+# require Debug for the forced CURL_ENTROPY
 <features>
-debug
+Debug
 ws
 </features>
+<setenv>
+CURL_ENTROPY=12345678
+</setenv>
 <server>
 http
 </server>
@@ -46,24 +47,22 @@ ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
-# PONG with no data and the 32 bit mask
-#
+# PONG with no data and the 32-bit mask
 <verify>
-<protocol nocheck="yes" crlf="yes">
+<protocol crlf="headers" nocheck="yes">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-User-Agent: websocket/2304
+User-Agent: websocket/%TESTNUMBER
 Accept: */*
 Upgrade: websocket
-Connection: Upgrade
 Sec-WebSocket-Version: 13
 Sec-WebSocket-Key: NDMyMTUzMjE2MzIxNzMyMQ==
+Connection: Upgrade
 
 </protocol>
 
 # This test used to check that "connection closed" was output, but
-# that is flaky since the outgoing PING just before might fail already
+# that is flaky since the outgoing PING before might fail already
 # and then the test exists before the output gets to be written
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test2305 b/third-party/curl/tests/data/test2305
deleted file mode 100644
index de71b07d28..0000000000
--- a/third-party/curl/tests/data/test2305
+++ /dev/null
@@ -1,59 +0,0 @@
-<testcase>
-<info>
-<keywords>
-WebSockets
-</keywords>
-</info>
-
-#
-# Sends three 4097 bytes TEXT frames, as one single message
-<reply>
-<data nocheck="yes">
-HTTP/1.1 101 Switching to WebSockets
-Server: test-server/fake
-Upgrade: websocket
-Connection: Upgrade
-Something: else
-Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
-
-%hex[%01%7e%10%01]hex%%repeat[256 x helothisisdaniel]%
-%hex[%01%7e%10%01]hex%%repeat[256 x helothisisdaniel]%
-%hex[%81%7e%10%01]hex%%repeat[256 x helothisisdaniel]%
-</data>
-# allow upgrade
-<servercmd>
-upgrade
-</servercmd>
-</reply>
-
-#
-# Client-side
-<client>
-# require debug for the forced CURL_ENTROPY
-<features>
-debug
-ws
-</features>
-<server>
-http
-</server>
-<name>
-WebSocket curl_ws_recv() loop reading three larger frames
-</name>
-<tool>
-lib%TESTNUMBER
-</tool>
-<command>
-ws://%HOSTIP:%HTTPPORT/%TESTNUMBER %LOGDIR/save%TESTNUMBER
-</command>
-</client>
-
-#
-<verify>
-<file name="%LOGDIR/save%TESTNUMBER">
-%repeat[256 x helothisisdaniel]%
-%repeat[256 x helothisisdaniel]%
-%repeat[256 x helothisisdaniel]%
-</file>
-</verify>
-</testcase>
diff --git a/third-party/curl/tests/data/test2306 b/third-party/curl/tests/data/test2306
index 22a4db1ae8..eec01e9710 100644
--- a/third-party/curl/tests/data/test2306
+++ b/third-party/curl/tests/data/test2306
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,11 +6,10 @@ HTTP
 HTTP GET
 </keywords>
 </info>
-#
 # This reproduces the #11101 issue, when the second response comes back
 # with the first header being "folded"
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -24,7 +24,7 @@ Funny-head: yesyes
 </data>
 <data2 nocheck="yes">
 HTTP/1.1 200 OK swsclose
-	Access-Control-Allow-Origin: *
+%TABAccess-Control-Allow-Origin: *
 Connection: Keep-Alive
 Content-Type: text/html; charset=utf-8
 Date: Wed, 10 May 2023 14:58:08 GMT
@@ -43,18 +43,17 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 HTTP GET reused handle with first header folded
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER0002
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test2307 b/third-party/curl/tests/data/test2307
new file mode 100644
index 0000000000..a0f7be57f5
--- /dev/null
+++ b/third-party/curl/tests/data/test2307
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+FTP
+EPSV
+RETR
+Range
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+0123456789abcdef
+0123456789abcdef
+0123456789abcdef
+0123456789abcdef
+</data>
+<datacheck nonewline="yes">
+0123456789abcdef
+0123456789abcdef
+0123456789abcdef
+012345678
+</datacheck>
+<size>
+64
+</size>
+</reply>
+
+# Client-side
+<client>
+<server>
+ftp
+</server>
+<name>
+FTP retrieve a byte-range with end larger than file
+</name>
+<command>
+-r 4-1000 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+USER anonymous
+PASS ftp@example.com
+PWD
+EPSV
+TYPE I
+SIZE %TESTNUMBER
+REST 4
+RETR %TESTNUMBER
+ABOR
+QUIT
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2308 b/third-party/curl/tests/data/test2308
new file mode 100644
index 0000000000..a3770ca5a8
--- /dev/null
+++ b/third-party/curl/tests/data/test2308
@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+# This reproduces the #13669 issue
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+# tool to run
+<tool>
+lib%TESTNUMBER
+</tool>
+
+<name>
+verify return code when write callback returns error
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+</protocol>
+<stdout mode="text">
+Returned 23, should be 23.
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2309 b/third-party/curl/tests/data/test2309
new file mode 100644
index 0000000000..1549787b0d
--- /dev/null
+++ b/third-party/curl/tests/data/test2309
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+netrc
+HTTP
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+proxy
+</features>
+
+# Reproducing issue 15496
+<name>
+HTTP with .netrc using duped easy handle
+</name>
+<tool>
+lib%TESTNUMBER
+</tool>
+<command>
+http://github.com %LOGDIR/netrc%TESTNUMBER http://%HOSTIP:%HTTPPORT/
+</command>
+<file name="%LOGDIR/netrc%TESTNUMBER" >
+
+machine github.com
+
+login daniel
+password $y$j9T$WUVjiVvDbRAWafDLs6cab1$01NX.oaZKf5lw8MR2Nk9Yaxv4CqbE0IaDF.GpGxPul1
+</file>
+</client>
+
+<verify>
+<protocol crlf="headers">
+GET http://github.com/ HTTP/1.1
+Host: github.com
+Authorization: Basic %b64[daniel:$y$j9T$WUVjiVvDbRAWafDLs6cab1$01NX.oaZKf5lw8MR2Nk9Yaxv4CqbE0IaDF.GpGxPul1]b64%
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test231 b/third-party/curl/tests/data/test231
index 64bafa1763..9832de5cb0 100644
--- a/third-party/curl/tests/data/test231
+++ b/third-party/curl/tests/data/test231
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -19,9 +20,9 @@ C01234567
 <server>
 file
 </server>
- <name>
+<name>
 file:// with resume
- </name>
+</name>
 <command option="no-include">
 file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt -C 10
 </command>
diff --git a/third-party/curl/tests/data/test2310 b/third-party/curl/tests/data/test2310
new file mode 100644
index 0000000000..0446c374a0
--- /dev/null
+++ b/third-party/curl/tests/data/test2310
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+variables
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: something-close, close-something, close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+variable decode and trim
+</name>
+<command>
+--variable 'VAR=IA==' --expand-url 'http://%HOSTIP:%HTTPPORT/{{VAR:64dec:trim}}'
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET / HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2311 b/third-party/curl/tests/data/test2311
new file mode 100644
index 0000000000..91032b81d2
--- /dev/null
+++ b/third-party/curl/tests/data/test2311
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+HTTP proxy
+cookies
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Server: test-server/fake
+Content-Length: 21
+
+This server says moo
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+Cookie from file: control octet rejected, prefixes matched case sensitively
+</name>
+<command>
+http://example.fake/%TESTNUMBER -b %LOGDIR/injar%TESTNUMBER -x %HOSTIP:%HTTPPORT
+</command>
+<file name="%LOGDIR/injar%TESTNUMBER">
+example.fake	FALSE	/	FALSE	0	clean	good
+example.fake	FALSE	/	FALSE	0	bad	%hex[ba%07d]hex%
+example.fake	FALSE	/	FALSE	0	__secure-x	yes
+example.fake	FALSE	/	FALSE	0	__Secure-y	no
+</file>
+<features>
+cookies
+proxy
+</features>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://example.fake/%TESTNUMBER HTTP/1.1
+Host: example.fake
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+Cookie: __secure-x=yes; clean=good
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test232 b/third-party/curl/tests/data/test232
index 795342698c..913cfa380a 100644
--- a/third-party/curl/tests/data/test232
+++ b/third-party/curl/tests/data/test232
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,41 +7,9 @@ HTTP GET
 compressed
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBNb24sIDI5IE5vdiAyMDA0IDIxOjU2OjUzIEdNVA0KU2Vy
-dmVyOiBBcGFjaGUvMS4zLjMxIChEZWJpYW4gR05VL0xpbnV4KSBtb2RfZ3ppcC8xLjMuMjYuMWEg
-UEhQLzQuMy45LTEgbW9kX3NzbC8yLjguMjAgT3BlblNTTC8wLjkuN2QgbW9kX3BlcmwvMS4yOQ0K
-VmFyeTogQWNjZXB0LUVuY29kaW5nDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1J
-U08tODg1OS0xDQpDb250ZW50LUVuY29kaW5nOiBkZWZsYXRlDQpDb250ZW50LUxlbmd0aDogMTI4
-Nw0KDQrdWNtu4zYQfTeQf2D91AK2brYTOXC0KHLZBM02wdoFuk8GLdE2G0kUSMq5PPTbO5QoibEc
-r3eDvgRIYnLmnMPhDEmTmXx6SmK0IVxQlp51XcvpIpKGLKLp6qx7M73r+/5o3He7n4LO5JeLu/PZ
-t/tLlHH2DwllP6ZCAhBNv01nl19Qdy1ldmrbS07EOiFYWimR9gKHDySN7GXS1zzRd6yhFcmoC6Jb
-WkEHocqm2k1vTqPAPXa9iW0YSkSEJZnjKCKAGI/9vuP3PRc5w1PHPfXGE9vwG4Q8Ux9R4DnOsO86
-fddHjnfqwc9AUyrEqzhSnJC5WDMugzDncR2OYW/jl3kcF3CE0wjFdNGmFhAdHhGhljpnSVJSUoIk
-Y7UAx/wZLRlHYUxJKvuCRgT99fUWSY5TsYSKWjCLRshQ3hkMogLhcgSlWqlwVd8ljYk46uRCddQY
-4jmV+MlCNxKJPMtAX6Dr2ey+V/yd9tAVtI86V0X74uZ81kOzy9s/L+Hz9uJ3gF3d3F72iuE/391f
-X36FNgzwSGKIqZTqZ0zInm7m0AoZe6BEFNooz2KGIxgCllqekKiZdQ9lWIhHxiPVhMjSPFkU9un0
-9qgTEi7pkoZQVzD9QTj4mChDgWo8wQjFtCAbGXsknERHncVzlaQekmvyZsarslhHndkaqAjD74Km
-ajMJSG2dapVgBpsOec5RJ8bpKscrIooYSLqhnKUJDCBAR5fQWBsbKnFM5fNchIyTYHTiD63RycTe
-sm+BM8JDkAwGlntsYCvzFhrm8wB7bWwgC5Ne1yzLY8ybsY5HY4hhCMt529MiVAO6A8t3XxFeh2I4
-ymCc0Su0EQ7HxbnhWyNnYuuO6ZmHLAddz6282vAKUw7iD2qMMYDIFyLkNJNwRIpgoE6H16YSBqVP
-w/Vc7eXggixxHsuJbRpLGNR/Xh1gGZQ92HloVielrdaLPbFbrEZszRLythAsYMpLFXV42iZD69YC
-jaZcvRwuB2CtpGiNyOLFO1wEwFpE0RqRF5odLgJgLaJojUi4hj1GYrY6XKqmaMFGopHlWXK4IIC1
-lKI1IhFZHC4CYC2iaI0IE0+HiwBYiyiaUS8RqfPyB2pWEqq6abqxzHMOaRMk0Ou36hqF2YgfKMlG
-VMXYCENE3RwOV1FoLVMQG52Ecs744UolXmtpslnXhAVVraBZemIKhxyk4MvNzP4bncPpASmjeYJu
-S8fErhAar76n5JyTmNSZa5nn+v4WnFiuZ8EF6Q33G2x1rzo5dvxRi1hdsNocdS/afXHaBSznYu+a
-zATOUQITXjM5l2v4qoactUwlEucSbjKiDqnsV93aoE9gnFISo6kkKXzDrya26WxRoEq76/7vAq8i
-oopsIFt0zmIS3D2mhNe4wlRFapuhVr1qCasveE4TmmJpzk5yuCEUtYGC1p2W1/OO97kHe7n7nK7v
-7+W6e8eFpbE/6r1u93i4zz3eS/bHe73OXrc7+k7c3wlsf2SD1tjl/W67/LAmMngywUMMrqO1Tm18
-RvI5I2ddTkJ4HSibeknVi7LBmRvZUUPtcuwk6nsLuE+Gqhg7XTuZxuOsRd1+uL3FlVSqDQV2uLOj
-X/Vt6redWiW23mkN4u28seLehuP/L2nOT2dsOHhnxtT76uMnyvUGI/cdmXqBp9jHz9LAc4Yn78jS
-NaFJhOOPn6jhcDTw3pGosA9PffEzeTIs+qyv/ysUdOpm89+x/wA=
-</data>
-
-<datacheck>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Mon, 29 Nov 2004 21:56:53 GMT
 Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
@@ -49,123 +18,26 @@ Content-Type: text/html; charset=ISO-8859-1
 Content-Encoding: deflate
 Content-Length: 1287
 
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE project-listing SYSTEM "http://freshmeat.net/backend/fm-projects-0.4.dtd">
-<project-listing>
-  <project>
-    <project_id>1612</project_id>
-    <date_added>1998-08-21 04:01:29</date_added>
-    <date_updated>2004-10-18 02:22:23</date_updated>
-    <projectname_short>curl</projectname_short>
-    <projectname_full>curl and libcurl</projectname_full>
-    <desc_short>Command line tool and library for client-side URL transfers.</desc_short>
-    <desc_full>curl and libcurl is a tool for transferring files
-using URL syntax. It supports HTTP, HTTPS, FTP,
-FTPS, DICT, TELNET, LDAP, FILE, and GOPHER, as
-well as HTTP-post, HTTP-put, cookies, FTP upload,
-resumed transfers, passwords, portnumbers, SSL
-certificates, Kerberos, and proxies. It is powered
-by libcurl, the client-side URL transfer library.
-There are bindings to libcurl for over 20
-languages and environments.
-</desc_full>
-    <vitality_score>5784.57</vitality_score>
-    <vitality_percent>3.16</vitality_percent>
-    <vitality_rank>169</vitality_rank>
-    <popularity_score>6594.54</popularity_score>
-    <popularity_percent>13.81</popularity_percent>
-    <popularity_rank>105</popularity_rank>
-    <rating>8.50</rating>
-    <rating_count>21</rating_count>
-    <rating_rank>183</rating_rank>
-    <subscriptions>323</subscriptions>
-    <branch_name>Default</branch_name>
-    <url_project_page>http://freshmeat.net/projects/curl/</url_project_page>
-    <url_homepage>http://freshmeat.net/redir/curl/1612/url_homepage/</url_homepage>
-    <url_tgz>http://freshmeat.net/redir/curl/1612/url_tgz/</url_tgz>
-    <url_bz2>http://freshmeat.net/redir/curl/1612/url_bz2/</url_bz2>
-    <url_zip>http://freshmeat.net/redir/curl/1612/url_zip/</url_zip>
-    <url_changelog>http://freshmeat.net/redir/curl/1612/url_changelog/</url_changelog>
-    <url_rpm>http://freshmeat.net/redir/curl/1612/url_rpm/</url_rpm>
-    <url_deb>http://freshmeat.net/redir/curl/1612/url_deb/</url_deb>
-    <url_osx>http://freshmeat.net/redir/curl/1612/url_osx/</url_osx>
-    <url_bsdport>http://freshmeat.net/redir/curl/1612/url_bsdport/</url_bsdport>
-    <url_purchase></url_purchase>
-    <url_cvs>http://freshmeat.net/redir/curl/1612/url_cvs/</url_cvs>
-    <url_list>http://freshmeat.net/redir/curl/1612/url_list/</url_list>
-    <url_mirror>http://freshmeat.net/redir/curl/1612/url_mirror/</url_mirror>
-    <url_demo></url_demo>
-    <license>MIT/X Consortium License</license>
-    <latest_release>
-      <latest_release_version>7.12.2</latest_release_version>
-      <latest_release_id>176085</latest_release_id>
-      <latest_release_date>2004-10-18 02:22:23</latest_release_date>
-    </latest_release>
-    <screenshot_thumb></screenshot_thumb>
-    <authors>
-      <author>
-        <author_name>Daniel Stenberg</author_name>
-        <author_url>http://freshmeat.net/~bagder/</author_url>
-        <author_role>Owner</author_role>
-      </author>
-    </authors>
-    <descriminators>
-      <trove_id>12</trove_id>
-      <trove_id>226</trove_id>
-      <trove_id>3</trove_id>
-      <trove_id>2</trove_id>
-      <trove_id>188</trove_id>
-      <trove_id>216</trove_id>
-      <trove_id>200</trove_id>
-      <trove_id>220</trove_id>
-      <trove_id>164</trove_id>
-      <trove_id>90</trove_id>
-      <trove_id>89</trove_id>
-      <trove_id>809</trove_id>
-      <trove_id>150</trove_id>
-      <trove_id>224</trove_id>
-      <trove_id>900</trove_id>
-      <trove_id>839</trove_id>
-    </descriminators>
-    <dependencies>
-      <dependency type="recommended">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>7464</dependency_branch_id>
-        <dependency_project_id>7464</dependency_project_id>
-        <dependency_project_title>OpenSSL (Default)</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>7443</dependency_project_id>
-        <dependency_project_title>OpenLDAP</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>12351</dependency_project_id>
-        <dependency_project_title>zlib</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>32047</dependency_project_id>
-        <dependency_project_title>Heimdal</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>44532</dependency_project_id>
-        <dependency_project_title>c-ares</dependency_project_title>
-      </dependency>
-    </dependencies>
-  </project>
-</project-listing>
+%hex[%dd%58%db%6e%e3%36%10%7d%37%90%7f%60%fd%d4%02%b6%6e%b6%13%39%70%b4%28%72%d9%04%cd%36%c1%da%05%ba%4f%06%2d%d1%36%1b%49%14%48%ca%b9%3c%f4%db%3b%94%28%89%b1%1c%af%77%83%be%04%48%62%72%e6%9c%c3%e1%0c%49%93%99%7c%7a%4a%62%b4%21%5c%50%96%9e%75%5d%cb%e9%22%92%86%2c%a2%e9%ea%ac%7b%33%bd%eb%fb%fe%68%dc%77%bb%9f%82%ce%e4%97%8b%bb%f3%d9%b7%fb%4b%94%71%f6%0f%09%65%3f%a6%42%02%10%4d%bf%4d%67%97%5f%50%77%2d%65%76%6a%db%4b%4e%c4%3a%21%58%5a%29%91%f6%02%87%0f%24%8d%ec%65%d2%d7%3c%d1%77%ac%a1%15%c9%a8%0b%a2%5b%5a%41%07%a1%ca%a6%da%4d%6f%4e%a3%c0%3d%76%bd%89%6d%18%4a%44%84%25%99%e3%28%22%80%18%8f%fd%be%e3%f7%3d%17%39%c3%53%c7%3d%f5%c6%13%db%f0%1b%84%3c%53%1f%51%e0%39%ce%b0%ef%3a%7d%d7%47%8e%77%ea%c1%cf%40%53%2a%c4%ab%38%52%9c%90%b9%58%33%2e%83%30%e7%71%1d%8e%61%6f%e3%97%79%1c%17%70%84%d3%08%c5%74%d1%a6%16%10%1d%1e%11%a1%96%3a%67%49%52%52%52%82%24%63%b5%00%c7%fc%19%2d%19%47%61%4c%49%2a%fb%82%46%04%fd%f5%f5%16%49%8e%53%b1%84%8a%5a%30%8b%46%c8%50%de%19%0c%a2%02%e1%72%04%a5%5a%a9%70%55%df%25%8d%89%38%ea%e4%42%75%d4%18%e2%39%95%f8%c9%42%37%12%89%3c%cb%40%5f%a0%eb%d9%ec%be%57%fc%9d%f6%d0%15%b4%8f%3a%57%45%fb%e2%e6%7c%d6%43%b3%cb%db%3f%2f%e1%f3%f6%e2%77%80%5d%dd%dc%5e%f6%8a%e1%3f%df%dd%5f%5f%7e%85%36%0c%f0%48%62%88%a9%94%ea%67%4c%c8%9e%6e%e6%d0]hex%
+%hex[%19%7b%a0%44%14%da%28%cf%62%86%23%18%02%96%5a%9e%90%a8%99%75%0f%65%58%88%47%c6%23%d5%84%c8%d2%3c%59%14%f6%e9%f4%f6%a8%13%12%2e%e9%92%86%50%57%30%fd%41%38%f8%98%28%43%81%6a%3c%c1%08%c5%b4%20%1b%19%7b%24%9c%44%47%9d%c5%73%95%a4%1e%92%6b%f2%66%c6%ab%b2%58%47%9d%d9%1a%a8%08%c3%ef%82%a6%6a%33%09%48%6d%9d%6a%95%60%06%9b%0e%79%ce%51%27%c6%e9%2a%c7%2b%22%8a%18%48%ba%a1%9c%a5%09%0c%20%40%47%97%d0%58%1b%1b%2a%71%4c%e5%f3%5c%84%8c%93%60%74%e2%0f%ad%d1%c9%c4%de%b2%6f%81%33%c2%43%90%0c%06%96%7b%6c%60%2b%f3%16%1a%e6%f3%00%7b%6d%6c%20%0b%93%5e%d7%2c%cb%63%cc%9b%b1%8e%47%63%88%61%08%cb%79%db%d3%22%54%03%ba%03%cb%77%5f%11%5e%87%62%38%ca%60%9c%d1%2b%b4%11%0e%c7%c5%b9%e1%5b%23%67%62%eb%8e%e9%99%87%2c%07%5d%cf%ad%bc%da%f0]hex%
+%hex[%53%0e%e2%0f%6a%8c%31%80%c8%17%22%e4%34%93%70%44%8a%60%a0%4e%87%d7%a6%12%06%a5%4f%c3%f5%5c%ed%e5%e0%82%2c%71%1e%cb%89%6d%1a%4b%18%d4%7f%5e%1d%60%19%94%3d%d8%79%68%56%27%a5%ad%d6%8b%3d%b1%5b%ac%46%6c%cd%12%f2%b6%10%2c%60%ca%4b%15%75%78%da%26%43%eb%d6%02%8d%a6%5c%bd%1c%2e%07%60%ad%a4%68%8d%c8%e2%c5%3b%5c%04%c0%5a%44%d1%1a%91%17%9a%1d%2e%02%60%2d%a2%68%8d%48%b8%86%3d%46%62%b6%3a%5c%aa%a6%68%c1%46%a2%91%e5%59%72%b8%20%80%b5%94%a2%35%22%11%59%1c%2e%02%60%2d%a2%68%8d%08%13%4f%87%8b%00%58%8b%28%9a%51%2f%11%a9%f3%f2%07%6a%56%12%aa%ba%69%ba%b1%cc%73%0e%69%13%24%d0%eb%b7%ea%1a%85%d9%88%1f%28%c9%46%54%c5%d8%08%43%44%dd%1c%0e%57%51%68%2d%53%10%1b%9d%84%72%ce%f8%e1%4a%25%5e%6b%69%b2%59%d7%84%05%55%ad%a0%59%7a%62]hex%
+%hex[%87%1c%a4%e0%cb%cd%cc%fe%1b%9d%c3%e9%01%29%a3%79%82%6e%4b%c7%c4%ae%10%1a%af%be%a7%e4%9c%93%98%d4%99%6b%99%e7%fa%fe%16%9c%58%ae%67%c1%05%e9%0d%f7%1b%6c%75%af%3a%39%76%fc%51%8b%58%5d%b0%da%1c%75%2f%da%7d%71%da%05%2c%e7%62%ef%9a%cc%04%ce%51%02%13%5e%33%39%97%6b%f8%aa%86%9c%b5%4c%25%12%e7%12%6e%32%a2%0e%a9%ec%57%dd%da%a0%4f%60%9c%52%12%a3%a9%24%29%7c%c3%af%26%b6%e9%6c%51%a0%4a%bb%eb%fe%ef%02%af%22%a2%8a%6c%20%5b%74%ce%62%12%dc%3d%a6%84%d7%b8%c2%54%45%6a%9b%a1%56%bd%6a%09%ab%2f%78%4e%13%9a%62%69%ce%4e%72%b8%21%14%b5%81%82%d6%9d%96%d7%f3%8e%f7%b9%07%7b%b9%fb%9c%ae%ef%ef%e5%ba%7b%c7%85%a5%b1%3f%ea%bd%6e%f7%78%b8%cf%3d%de%4b%f6%c7%7b%bd%ce%5e%b7%3b%fa%4e%dc%df%09%6c%7f%64%83%d6%d8%e5%fd%6e%bb%fc%b0%26%32%78%32%c1%43%0c%ae%a3%b5%4e%6d%7c%46%f2%39%23%67%5d%4e%42%78%1d%28%9b%7a%49%d5%8b%b2%c1%99%1b%d9%51%43%ed%72%ec%24%ea%7b%0b%b8%4f%86%aa%18%3b%5d%3b%99%c6%e3%ac%45%dd%7e%b8%bd%c5%95%54%aa%0d%05%76%b8%b3%a3%5f%f5%6d%ea%b7%9d%5a%25%b6%de%69%0d%e2%ed%bc%b1%e2%de%86%e3%ff%2f%69%ce%4f%67%6c%38%78%67%c6%d4%fb%ea%e3%27%ca%f5%06%23%f7%1d%99%7a%81%a7%d8%c7%cf%d2%c0%73%86%27%ef%c8%d2%35%a1%49%84%e3%8f%9f%a8%e1%70%34%f0%de%91%a8%b0%0f%4f%7d%f1%33%79%32%2c%fa%ac%af%ff%2b%14%74%ea%66%f3%df%b1%ff%00]hex%
+</data>
+
+<datacheck>
+HTTP/1.1 200 OK%CR
+Date: Mon, 29 Nov 2004 21:56:53 GMT%CR
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29%CR
+Vary: Accept-Encoding%CR
+Content-Type: text/html; charset=ISO-8859-1%CR
+Content-Encoding: deflate%CR
+Content-Length: 1287%CR
+%CR
+%includetext %SRCDIR/data/data-xml1%
 </datacheck>
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -174,21 +46,20 @@ libz
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET deflate raw-compressed content
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --compressed
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
 s/^Accept-Encoding: [a-zA-Z, ]*/Accept-Encoding: xxx/
 </strippart>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test233 b/third-party/curl/tests/data/test233
index 0f028f147e..97e6215e95 100644
--- a/third-party/curl/tests/data/test233
+++ b/third-party/curl/tests/data/test233
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ HTTP proxy Basic auth
 followlocation
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -55,16 +55,15 @@ contents
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP, proxy, site+proxy auth and Location: to new host
- </name>
- <command>
+</name>
+<command>
 http://first.host.it.is/we/want/that/page/%TESTNUMBER -x %HOSTIP:%HTTPPORT --user iam:myself --proxy-user testing:this --location
 </command>
 <features>
@@ -72,21 +71,20 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://first.host.it.is/we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: first.host.it.is
-Proxy-Authorization: Basic dGVzdGluZzp0aGlz
-Authorization: Basic aWFtOm15c2VsZg==
+Proxy-Authorization: Basic %b64[testing:this]b64%
+Authorization: Basic %b64[iam:myself]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
 
 GET http://goto.second.host.now/%TESTNUMBER0002 HTTP/1.1
 Host: goto.second.host.now
-Proxy-Authorization: Basic dGVzdGluZzp0aGlz
+Proxy-Authorization: Basic %b64[testing:this]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test234 b/third-party/curl/tests/data/test234
index 98c8437b07..0672a25bde 100644
--- a/third-party/curl/tests/data/test234
+++ b/third-party/curl/tests/data/test234
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ followlocation
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -57,16 +57,15 @@ contents
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
-HTTP, proxy, site+proxy auth and Location: to new host using location-trusted
- </name>
- <command>
+<name>
+HTTP, proxy, site+proxy auth and Location: to new host location-trusted
+</name>
+<command>
 http://first.host.it.is/we/want/that/page/%TESTNUMBER -x %HOSTIP:%HTTPPORT --user iam:myself --proxy-user testing:this --location-trusted
 </command>
 <features>
@@ -74,22 +73,21 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://first.host.it.is/we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: first.host.it.is
-Proxy-Authorization: Basic dGVzdGluZzp0aGlz
-Authorization: Basic aWFtOm15c2VsZg==
+Proxy-Authorization: Basic %b64[testing:this]b64%
+Authorization: Basic %b64[iam:myself]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
 
 GET http://goto.second.host.now/%TESTNUMBER0002 HTTP/1.1
 Host: goto.second.host.now
-Proxy-Authorization: Basic dGVzdGluZzp0aGlz
-Authorization: Basic aWFtOm15c2VsZg==
+Proxy-Authorization: Basic %b64[testing:this]b64%
+Authorization: Basic %b64[iam:myself]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test235 b/third-party/curl/tests/data/test235
index 893458ba8b..ad094b4568 100644
--- a/third-party/curl/tests/data/test235
+++ b/third-party/curl/tests/data/test235
@@ -1,7 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
+STOR
 </keywords>
 </info>
 
@@ -17,14 +19,14 @@ REPLY SIZE 500 command not understood
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP resumed upload but no file present remotely
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T %LOGDIR/upload%TESTNUMBER -C -
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
-this is the *****crap******** that we're gonna upload
+this is the *****crap******** that we are gonna upload
 
 worx?
 </file>
@@ -32,7 +34,7 @@ worx?
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -43,7 +45,7 @@ STOR %TESTNUMBER
 QUIT
 </protocol>
 <upload>
-this is the *****crap******** that we're gonna upload
+this is the *****crap******** that we are gonna upload
 
 worx?
 </upload>
diff --git a/third-party/curl/tests/data/test236 b/third-party/curl/tests/data/test236
index e9f0f36b4b..a62cdfca9b 100644
--- a/third-party/curl/tests/data/test236
+++ b/third-party/curl/tests/data/test236
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -20,10 +21,10 @@ REPLY SIZE 500 command not understood
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP resume upload but denied access to remote file
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T %LOGDIR/file%TESTNUMBER.txt -C -
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
@@ -34,7 +35,7 @@ Test data
 # Verify data after the test has been "shot"
 <verify>
 
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test237 b/third-party/curl/tests/data/test237
index 15274d4c9c..62c8b6b215 100644
--- a/third-party/curl/tests/data/test237
+++ b/third-party/curl/tests/data/test237
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ FTP
 # Server-side
 <reply>
 <servercmd>
-REPLY PASV 227 Entering Passiv Mode (1216,256,2,127,127,127)
+REPLY PASV 227 Entering Passive Mode (1216,256,2,127,127,127)
 </servercmd>
 </reply>
 
@@ -17,10 +18,10 @@ REPLY PASV 227 Entering Passiv Mode (1216,256,2,127,127,127)
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP getting bad host in 227-response to PASV
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --disable-epsv
 </command>
 </client>
@@ -34,7 +35,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --disable-epsv
 <errorcode>
 14
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test238 b/third-party/curl/tests/data/test238
index ac720b0885..79d645674a 100644
--- a/third-party/curl/tests/data/test238
+++ b/third-party/curl/tests/data/test238
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ FTP
 # Server-side
 <reply>
 <servercmd>
-REPLY EPSV 229 Entering Passiv Mode (|||1000000|)
+REPLY EPSV 229 Entering Passive Mode (|||1000000|)
 </servercmd>
 </reply>
 
@@ -17,10 +18,10 @@ REPLY EPSV 229 Entering Passiv Mode (|||1000000|)
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP getting bad port in response to EPSV
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
@@ -31,7 +32,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 <errorcode>
 13
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test239 b/third-party/curl/tests/data/test239
index 6ba4ba5218..40af1ae96f 100644
--- a/third-party/curl/tests/data/test239
+++ b/third-party/curl/tests/data/test239
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -13,7 +14,7 @@ NTLM
 <reply>
 
 # this is returned first since we get no proxy-auth
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me my dear
 Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
 Content-Length: 34
@@ -23,7 +24,7 @@ Hey you, authenticate or go away!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 200 Things are fine in proxy land swsclose
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -32,7 +33,7 @@ Content-Length: 42
 Contents of that page you requested, sir.
 </data1002>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me my dear
 Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
 Content-Length: 34
@@ -67,10 +68,10 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --proxy http://%HOSTIP:%HTTPPORT --proxy-us
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST http://%HOSTIP:%HTTPPORT/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Proxy-Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test24 b/third-party/curl/tests/data/test24
index 8adc5bb6b7..f41f80a24d 100644
--- a/third-party/curl/tests/data/test24
+++ b/third-party/curl/tests/data/test24
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,7 +13,7 @@ HTTP GET
 HTTP/1.0 404 BAD BOY
 Content-Type: text/html
 
-This silly page doesn't reaaaaaly exist so you should not get it.
+This silly page does not reaaaaaly exist so you should not get it.
 </data>
 </reply>
 
@@ -21,17 +22,17 @@ This silly page doesn't reaaaaaly exist so you should not get it.
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET fail silently on HTTP error return
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --fail --silent --show-error
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test240 b/third-party/curl/tests/data/test240
index e03436e334..3937e4c925 100644
--- a/third-party/curl/tests/data/test240
+++ b/third-party/curl/tests/data/test240
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 IPv6
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -25,27 +25,25 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-ipv6
+IPv6
 </features>
 <server>
 http-ipv6
 </server>
- <name>
+<name>
 HTTP-IPv6 GET
- </name>
- <command>
+</name>
+<command>
 -g "http://%HOST6IP:%HTTP6PORT/%TESTNUMBER"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOST6IP:%HTTP6PORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2400 b/third-party/curl/tests/data/test2400
index 4f3297d82d..63dc42afa9 100644
--- a/third-party/curl/tests/data/test2400
+++ b/third-party/curl/tests/data/test2400
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ HTTPS
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
@@ -23,34 +23,32 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-debug
-h2c
+Debug
+http/2
 SSL
 </features>
 <server>
 http
 http/2
 </server>
- <name>
-HTTP/2 GET
- </name>
+<name>
+HTTP/2 GET over HTTPS
+</name>
 <setenv>
 </setenv>
- <command>
--k --http2 "https://%HOSTIP:%HTTP2TLSPORT/%TESTNUMBER"
+<command>
+--insecure --http2 "https://%HOSTIP:%HTTP2TLSPORT/%TESTNUMBER"
 </command>
 
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<stdout crlf="yes">
-HTTP/2 200 
+<stdout crlf="headers">
+HTTP/2 200%SP
 date: Tue, 09 Nov 2010 14:49:00 GMT
 content-length: 6
 content-type: text/html
diff --git a/third-party/curl/tests/data/test2401 b/third-party/curl/tests/data/test2401
index 48414a1369..3b56905636 100644
--- a/third-party/curl/tests/data/test2401
+++ b/third-party/curl/tests/data/test2401
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ HTTPS
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 201 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
@@ -21,34 +21,31 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-debug
-h2c
+Debug
+http/2
 SSL
 </features>
 <server>
-http
 http/2
 </server>
- <name>
-HTTP/2 GET
- </name>
+<name>
+HTTP/2 POST over HTTPS
+</name>
 <setenv>
 </setenv>
- <command>
--k --http2 "https://%HOSTIP:%HTTP2TLSPORT/%TESTNUMBER" -d "moo"
+<command>
+--insecure --http2 "https://%HOSTIP:%HTTP2TLSPORT/%TESTNUMBER" -d "moo"
 </command>
 
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<stdout>
-HTTP/2 201 
+<stdout crlf="headers">
+HTTP/2 201%SP
 date: Tue, 09 Nov 2010 14:49:00 GMT
 content-length: 0
 funny-head: yesyes
@@ -56,8 +53,8 @@ server: nghttpx
 via: 1.1 nghttpx
 
 </stdout>
-<protocol nonewline="yes">
-POST /2401 HTTP/1.1
+<protocol crlf="yes" nonewline="yes">
+POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTP2TLSPORT
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test2402 b/third-party/curl/tests/data/test2402
index 961683282b..269bc4b100 100644
--- a/third-party/curl/tests/data/test2402
+++ b/third-party/curl/tests/data/test2402
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ verbose logs
 
 # Server-side
 <reply>
-<data1 crlf="yes">
+<data1 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: server.example.com
@@ -18,7 +19,7 @@ Content-Length: 47
 
 file contents should appear once for each file
 </data1>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: server.example.com
@@ -26,7 +27,7 @@ Content-Length: 47
 
 file contents should appear once for each file
 </data2>
-<data3>
+<data3 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: server.example.com
@@ -34,7 +35,7 @@ Content-Length: 47
 
 file contents should appear once for each file
 </data3>
-<data4>
+<data4 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: server.example.com
@@ -47,27 +48,27 @@ file contents should appear once for each file
 # Client-side
 <client>
 <features>
-h2c
+http/2
 SSL
+verbose-strings
 </features>
 <server>
-http
 http/2
 </server>
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
-HTTP GET multiple over HTTP/2
- </name>
- <command>
-https://%HOSTIP:%HTTP2TLSPORT/path/%TESTNUMBER %HOSTIP %HTTP2TLSPORT
+<name>
+HTTP GET multiple files over HTTP/2 using HTTPS
+</name>
+<command>
+- %HOSTIP %HTTP2TLSPORT
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol crlf="yes">
+<protocol crlf="headers">
 GET /path/%TESTNUMBER0001 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
@@ -97,13 +98,13 @@ Via: 2 nghttpx
 ^Host:.*
 </strip>
 <file name="%LOGDIR/stderr%TESTNUMBER" mode="text">
-* Connection #0 to host localhost left intact
-* Connection #0 to host localhost left intact
-* Connection #0 to host localhost left intact
-* Connection #0 to host localhost left intact
+* Connection #0 to host localhost:%HTTP2TLSPORT left intact
+* Connection #0 to host localhost:%HTTP2TLSPORT left intact
+* Connection #0 to host localhost:%HTTP2TLSPORT left intact
+* Connection #0 to host localhost:%HTTP2TLSPORT left intact
 </file>
 <stripfile>
-$_ = '' if (($_ !~ /left intact/) && ($_ !~ /Closing connection/))
+$_ = '' if(($_ !~ /left intact/) and ($_ !~ /Closing connection/))
 </stripfile>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test2403 b/third-party/curl/tests/data/test2403
index 11aa74b59b..2b75aa924f 100644
--- a/third-party/curl/tests/data/test2403
+++ b/third-party/curl/tests/data/test2403
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,10 +11,9 @@ HTTPS
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes" crlf="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
@@ -25,34 +25,31 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-h2c
+http/2
 SSL
 headers-api
 </features>
 <server>
-http
 http/2
 </server>
- <name>
-HTTP/2 GET
- </name>
+<name>
+HTTP/2 GET using %{header_json}
+</name>
 <setenv>
 </setenv>
- <command>
--k --http2 -w '%{header_json}\n' "https://%HOSTIP:%HTTP2TLSPORT/%TESTNUMBER"
+<command>
+--insecure --http2 -w '%{header_json}\n' "https://%HOSTIP:%HTTP2TLSPORT/%TESTNUMBER"
 </command>
 
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<stdout crlf="yes">
-HTTP/2 200 
+<stdout crlf="headers">
+HTTP/2 200%SP
 date: Tue, 09 Nov 2010 14:49:00 GMT
 content-length: 6
 content-type: text/html
diff --git a/third-party/curl/tests/data/test2404 b/third-party/curl/tests/data/test2404
index ecb637c340..101290cf75 100644
--- a/third-party/curl/tests/data/test2404
+++ b/third-party/curl/tests/data/test2404
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ verbose logs
 
 # Server-side
 <reply>
-<data1 crlf="yes">
+<data1 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: server.example.com
@@ -18,7 +19,7 @@ Content-Length: 47
 
 file contents should appear once for each file
 </data1>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: server.example.com
@@ -26,7 +27,7 @@ Content-Length: 47
 
 file contents should appear once for each file
 </data2>
-<data3>
+<data3 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: server.example.com
@@ -34,7 +35,7 @@ Content-Length: 47
 
 file contents should appear once for each file
 </data3>
-<data4>
+<data4 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: server.example.com
@@ -47,27 +48,27 @@ file contents should appear once for each file
 # Client-side
 <client>
 <features>
-h2c
+http/2
 SSL
+verbose-strings
 </features>
 <server>
-http
 http/2
 </server>
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 HTTP/2 using STREAM_WEIGHTs
- </name>
- <command>
-https://%HOSTIP:%HTTP2TLSPORT/path/%TESTNUMBER %HOSTIP %HTTP2TLSPORT
+</name>
+<command>
+- %HOSTIP %HTTP2TLSPORT
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol crlf="yes">
+<protocol crlf="headers">
 GET /path/%TESTNUMBER0001 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
@@ -97,13 +98,13 @@ Via: 2 nghttpx
 ^Host:.*
 </strip>
 <file name="%LOGDIR/stderr%TESTNUMBER" mode="text">
-* Connection #0 to host localhost left intact
-* Connection #0 to host localhost left intact
-* Connection #0 to host localhost left intact
-* Connection #0 to host localhost left intact
+* Connection #0 to host localhost:%HTTP2TLSPORT left intact
+* Connection #0 to host localhost:%HTTP2TLSPORT left intact
+* Connection #0 to host localhost:%HTTP2TLSPORT left intact
+* Connection #0 to host localhost:%HTTP2TLSPORT left intact
 </file>
 <stripfile>
-$_ = '' if (($_ !~ /left intact/) && ($_ !~ /Closing connection/))
+$_ = '' if(($_ !~ /left intact/) and ($_ !~ /Closing connection/))
 </stripfile>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test2405 b/third-party/curl/tests/data/test2405
new file mode 100644
index 0000000000..0d64ec458a
--- /dev/null
+++ b/third-party/curl/tests/data/test2405
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+multi
+HTTP
+flaky
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6007
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+%repeat[1000 x foobar]%
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+wakeup
+</features>
+<server>
+http
+</server>
+<tool>
+lib%TESTNUMBER
+</tool>
+<name>
+checking curl_multi_waitfds functionality
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2406 b/third-party/curl/tests/data/test2406
new file mode 100644
index 0000000000..fb0ec61cbc
--- /dev/null
+++ b/third-party/curl/tests/data/test2406
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+HTTP/2
+HTTPS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 404 nope
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+Debug
+http/2
+SSL
+</features>
+<server>
+http/2
+</server>
+<name>
+HTTP/2 over HTTPS with -f
+</name>
+<setenv>
+</setenv>
+<command>
+--insecure --http2 -f "https://%HOSTIP:%HTTP2TLSPORT/%TESTNUMBER"
+</command>
+
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<stdout crlf="headers">
+HTTP/2 404%SP
+date: Tue, 09 Nov 2010 14:49:00 GMT
+content-length: 6
+content-type: text/html
+funny-head: yesyes
+server: nghttpx
+via: 1.1 nghttpx
+
+</stdout>
+<errorcode>
+22
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2407 b/third-party/curl/tests/data/test2407
new file mode 100644
index 0000000000..33555a8502
--- /dev/null
+++ b/third-party/curl/tests/data/test2407
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+multi
+HTTP
+HTTP/2
+flaky
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6007
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+%repeat[1000 x foobar]%
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+http/2
+</features>
+<server>
+http/2
+</server>
+<tool>
+lib2405
+</tool>
+<name>
+checking curl_multi_waitfds functionality (HTTP/2)
+</name>
+<command>
+http://%HOSTIP:%HTTP2PORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2408 b/third-party/curl/tests/data/test2408
new file mode 100644
index 0000000000..edc83d48a4
--- /dev/null
+++ b/third-party/curl/tests/data/test2408
@@ -0,0 +1,92 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+globbing
+{} list
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Funny-head: yesyes
+Content-Length: 4
+
+moo
+</data>
+<data2 crlf="headers">
+HTTP/1.1 200 OK
+Funny-head: yesyes
+Content-Length: 4
+
+foo
+</data2>
+<data3 crlf="headers">
+HTTP/1.1 200 OK
+Funny-head: yesyes
+Content-Length: 4
+
+hoo
+</data3>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+multiple requests using named {} globs in URL
+</name>
+<command option="no-output">
+"%HOSTIP:%HTTPPORT/{%LTtest%GT%TESTNUMBER,%TESTNUMBER0002,%TESTNUMBER0003}" -o "%LOGDIR/dump-#%LTtest%GT"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER0002 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER0003 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+
+<file name="%LOGDIR/dump-%TESTNUMBER" crlf="headers">
+HTTP/1.1 200 OK
+Funny-head: yesyes
+Content-Length: 4
+
+moo
+</file>
+<file2 name="%LOGDIR/dump-%TESTNUMBER0002" crlf="headers">
+HTTP/1.1 200 OK
+Funny-head: yesyes
+Content-Length: 4
+
+foo
+</file2>
+<file3 name="%LOGDIR/dump-%TESTNUMBER0003" crlf="headers">
+HTTP/1.1 200 OK
+Funny-head: yesyes
+Content-Length: 4
+
+hoo
+</file3>
+
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2409 b/third-party/curl/tests/data/test2409
new file mode 100644
index 0000000000..4c9e9c57a1
--- /dev/null
+++ b/third-party/curl/tests/data/test2409
@@ -0,0 +1,92 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+globbing
+{} list
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 swsbounce
+Funny-head: yesyes
+Content-Length: 4
+
+moo
+</data>
+<data1 crlf="headers">
+HTTP/1.1 200 swsbounce
+Funny-head: yesyes
+Content-Length: 4
+
+foo
+</data1>
+<data2 crlf="headers">
+HTTP/1.1 200 OK
+Funny-head: yesyes
+Content-Length: 4
+
+hoo
+</data2>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+multiple requests using named [] globs in URL
+</name>
+<command option="no-output">
+"%HOSTIP:%HTTPPORT/hello[%LTtest%GT7-9]" -o "%LOGDIR/dump-#%LTtest%GT"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /hello7 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /hello8 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /hello9 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+
+<file name="%LOGDIR/dump-7" crlf="headers">
+HTTP/1.1 200 swsbounce
+Funny-head: yesyes
+Content-Length: 4
+
+moo
+</file>
+<file2 name="%LOGDIR/dump-8" crlf="headers">
+HTTP/1.1 200 swsbounce
+Funny-head: yesyes
+Content-Length: 4
+
+foo
+</file2>
+<file3 name="%LOGDIR/dump-9" crlf="headers">
+HTTP/1.1 200 OK
+Funny-head: yesyes
+Content-Length: 4
+
+hoo
+</file3>
+
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test241 b/third-party/curl/tests/data/test241
index 4dc69e6b1b..5f40e5a55f 100644
--- a/third-party/curl/tests/data/test241
+++ b/third-party/curl/tests/data/test241
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ IPv6
 IPv6-hostname
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -20,30 +20,28 @@ hello
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-ipv6
+IPv6
 </features>
 <server>
 http-ipv6
 </server>
- <name>
+<name>
 HTTP-IPv6 GET (using ip6-localhost)
- </name>
- <command>
+</name>
+<command>
 -g "http://ip6-localhost:%HTTP6PORT/%TESTNUMBER"
 </command>
 <precheck>
-./server/resolve --ipv6 ip6-localhost
+%RESOLVE --ipv6 ip6-localhost
 </precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: ip6-localhost:%HTTP6PORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2410 b/third-party/curl/tests/data/test2410
new file mode 100644
index 0000000000..ce83263e53
--- /dev/null
+++ b/third-party/curl/tests/data/test2410
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+globbing
+{} list
+</keywords>
+</info>
+# Server-side
+
+# Client-side
+<client>
+<name>
+duplicate named glob
+</name>
+<command option="no-output">
+"https://dummy.example/{%LTtest%GTA,B}{%LTtest%GTC,D}" -o "%LOGDIR/dump"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<stderr mode="text">
+curl: (3) Duplicate glob name in position 40:
+https://dummy.example/{%LTtest%GTA,B}{%LTtest%GTC,D}
+                                       ^
+</stderr>
+<errorcode>
+3
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2411 b/third-party/curl/tests/data/test2411
new file mode 100644
index 0000000000..5f45ac6ad8
--- /dev/null
+++ b/third-party/curl/tests/data/test2411
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+globbing
+{} list
+</keywords>
+</info>
+# Server-side
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+reference a named glob not set
+</name>
+<command option="no-output">
+"%HOSTIP:%HTTPPORT/{%LTtest%GTA,B}{%LTmoo%GTC,D}" -o "somewhere/#%LTfoo%GT"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<stderr mode="text">
+curl: (43) no glob exists with this name in position 16:
+somewhere/#%LTfoo%GT
+               ^
+</stderr>
+<errorcode>
+43
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2412 b/third-party/curl/tests/data/test2412
new file mode 100644
index 0000000000..e0320e2ce4
--- /dev/null
+++ b/third-party/curl/tests/data/test2412
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+multi
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6007
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+%repeat[1000 x foobar]%
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+wakeup
+</features>
+<server>
+http
+</server>
+<tool>
+lib%TESTNUMBER
+</tool>
+<name>
+checking curl_multi_fdset on nothing to do
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2413 b/third-party/curl/tests/data/test2413
new file mode 100644
index 0000000000..0b0e8a08aa
--- /dev/null
+++ b/third-party/curl/tests/data/test2413
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+Curl_peer
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+Curl_peer unit tests
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test242 b/third-party/curl/tests/data/test242
index 635aae44df..0f1730570f 100644
--- a/third-party/curl/tests/data/test242
+++ b/third-party/curl/tests/data/test242
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ IPv6
 HTTP Basic auth
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -20,30 +20,28 @@ hello
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-ipv6
+IPv6
 </features>
 <server>
 http-ipv6
 </server>
- <name>
+<name>
 HTTP-IPv6 GET with username+password in URL
- </name>
- <command>
+</name>
+<command>
 -g "http://foobar:barfoo@%HOST6IP:%HTTP6PORT/%TESTNUMBER"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOST6IP:%HTTP6PORT
-Authorization: Basic Zm9vYmFyOmJhcmZvbw==
+Authorization: Basic %b64[foobar:barfoo]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test243 b/third-party/curl/tests/data/test243
index a5e563b3d6..d15bb0ff81 100644
--- a/third-party/curl/tests/data/test243
+++ b/third-party/curl/tests/data/test243
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -13,7 +14,7 @@ NTLM
 # Server-side
 <reply>
 
-<data>
+<data crlf="headers">
 HTTP/1.1 407 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Proxy-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -26,7 +27,7 @@ This is not the real page
 </data>
 
 # this is returned first since we get no proxy-auth
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me my dear
 Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
 Content-Length: 34
@@ -36,7 +37,7 @@ Hey you, authenticate or go away!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 200 Things are fine in proxy land swsclose
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -45,7 +46,7 @@ Content-Length: 42
 Contents of that page you requested, sir.
 </data1002>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 407 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Proxy-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -88,7 +89,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --proxy http://%HOSTIP:%HTTPPORT --proxy-us
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST http://%HOSTIP:%HTTPPORT/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -99,7 +100,7 @@ Content-Type: application/x-www-form-urlencoded
 
 postitPOST http://%HOSTIP:%HTTPPORT/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Proxy-Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test244 b/third-party/curl/tests/data/test244
index 2f58e234a8..e02d7bbbd0 100644
--- a/third-party/curl/tests/data/test244
+++ b/third-party/curl/tests/data/test244
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ CWD
 nocwd
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data mode="text">
@@ -31,17 +31,17 @@ dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP dir listing with nocwd and URL encoded path
- </name>
- <command>
+</name>
+<command>
 --ftp-method nocwd ftp://%HOSTIP:%FTPPORT/fir%23t/th%69rd/%TESTNUMBER/
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test245 b/third-party/curl/tests/data/test245
index 606066b983..b5eedd4c85 100644
--- a/third-party/curl/tests/data/test245
+++ b/third-party/curl/tests/data/test245
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,15 +10,15 @@ HTTP Digest auth
 
 # Server-side
 <reply>
-<data>
-HTTP/1.1 401 authentication please swsbounce
+<data crlf="headers">
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144"
 Content-Type: text/html; charset=iso-8859-1
 Content-Length: 0
 
 </data>
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 A OK
 Server: Microsoft-IIS/6.0
 Content-Type: text/html; charset=iso-8859-1
@@ -26,8 +27,8 @@ Content-Length: 3
 ok
 </data1000>
 
-<datacheck>
-HTTP/1.1 401 authentication please swsbounce
+<datacheck crlf="headers">
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144"
 Content-Type: text/html; charset=iso-8859-1
@@ -45,25 +46,25 @@ ok
 
 # Client-side
 <client>
-#
 <server>
 http
 </server>
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP POST --digest
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u auser:apasswd --digest -d "junkelijunk"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test246 b/third-party/curl/tests/data/test246
index e918d264d7..bf3c4a0091 100644
--- a/third-party/curl/tests/data/test246
+++ b/third-party/curl/tests/data/test246
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,20 +10,20 @@ HTTP Digest auth
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 100 Continue
 Server: Microsoft-IIS/5.0
 Date: Sun, 03 Apr 2005 14:57:45 GMT
 X-Powered-By: ASP.NET
 
-HTTP/1.1 401 authentication please swsbounce
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144"
 Content-Type: text/html; charset=iso-8859-1
 Content-Length: 0
 
 </data>
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 A OK
 Server: Microsoft-IIS/6.0
 Content-Type: text/html; charset=iso-8859-1
@@ -31,13 +32,13 @@ Content-Length: 3
 ok
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 100 Continue
 Server: Microsoft-IIS/5.0
 Date: Sun, 03 Apr 2005 14:57:45 GMT
 X-Powered-By: ASP.NET
 
-HTTP/1.1 401 authentication please swsbounce
+HTTP/1.1 401 authentication please
 Server: Microsoft-IIS/6.0
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604144"
 Content-Type: text/html; charset=iso-8859-1
@@ -55,25 +56,25 @@ ok
 
 # Client-side
 <client>
-#
 <server>
 http
 </server>
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP POST --digest with server doing a 100 before 401 response
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u auser:apasswd --digest -d "junkelijunk"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test247 b/third-party/curl/tests/data/test247
index 9bb77d376e..089dd6c9d8 100644
--- a/third-party/curl/tests/data/test247
+++ b/third-party/curl/tests/data/test247
@@ -1,7 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
+MDTM
 </keywords>
 </info>
 
@@ -16,9 +18,9 @@ FTP
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP upload time condition evaluates TRUE => skip upload
- </name>
+</name>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 data
     to
@@ -27,16 +29,14 @@ that FTP
 works
   so does it?
 </file>
- <command>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T %LOGDIR/test%TESTNUMBER.txt -z "apr 1 2005 08:00:00"
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<upload>
-</upload>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test248 b/third-party/curl/tests/data/test248
index 796354cf9e..c728d36859 100644
--- a/third-party/curl/tests/data/test248
+++ b/third-party/curl/tests/data/test248
@@ -1,7 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
+STOR
+MDTM
 </keywords>
 </info>
 
@@ -16,9 +19,9 @@ FTP
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP upload time condition evaluates FALSE => upload anyway
- </name>
+</name>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 data
     to
@@ -27,7 +30,7 @@ that FTP
 works
   so does it?
 </file>
- <command>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T %LOGDIR/test%TESTNUMBER.txt -z "apr 1 2005 08:00:00"
 </command>
 </client>
@@ -42,7 +45,7 @@ that FTP
 works
   so does it?
 </upload>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test249 b/third-party/curl/tests/data/test249
index 107afb74db..fbc517b35e 100644
--- a/third-party/curl/tests/data/test249
+++ b/third-party/curl/tests/data/test249
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 -z
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -23,24 +23,22 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP 304 response with "illegal" Content-Length: header
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -z "dec 12 12:00:00 1999 GMT"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test25 b/third-party/curl/tests/data/test25
index 76b12d44a7..52ba1bdb4a 100644
--- a/third-party/curl/tests/data/test25
+++ b/third-party/curl/tests/data/test25
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -63,17 +64,17 @@ Connection: close
 <server>
 http
 </server>
- <name>
+<name>
 looping HTTP Location: following with --max-redirs
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -L --max-redirs 5
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test250 b/third-party/curl/tests/data/test250
index 16a13b90ad..fad9deeacb 100644
--- a/third-party/curl/tests/data/test250
+++ b/third-party/curl/tests/data/test250
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,11 @@ SLOWDOWN
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 # When doing LIST, we get the default list output hard-coded in the test
 # FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -23,30 +23,28 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 <servercmd>
 SLOWDOWN
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP dir list PASV with slow response
- </name>
- <command>
+</name>
+<command option="binary-trace">
 ftp://%HOSTIP:%FTPPORT/
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test2500 b/third-party/curl/tests/data/test2500
index 0290a32399..2abed30416 100644
--- a/third-party/curl/tests/data/test2500
+++ b/third-party/curl/tests/data/test2500
@@ -1,16 +1,17 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
 HTTP/3
+--resolve
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes" crlf="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
@@ -25,7 +26,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -33,33 +33,31 @@ http/3
 nghttpx-h3
 </features>
 <server>
-http
 http/3
 </server>
- <name>
+<name>
 HTTP/3 GET:
- </name>
- <command>
---cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --http3 --resolve localhost:%HTTP3PORT:%HOSTIP https://localhost:%HTTP3PORT/%TESTNUMBER
+</name>
+<command>
+--cacert %CERTDIR/certs/test-ca.crt --http3 --resolve localhost:%HTTP3PORT:%HOSTIP https://localhost:%HTTP3PORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strip>
 ^X-Forwarded-Proto:.*
 ^Via:.*
 </strip>
-<protocol crlf="yes">
+<protocol crlf="headers">
 GET https://localhost:%HTTP3PORT/%TESTNUMBER HTTP/1.1
 Host: localhost:%HTTP3PORT
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<stdout crlf="yes">
-HTTP/3 200 
+<stdout crlf="headers">
+HTTP/3 200%SP
 date: Tue, 09 Nov 2010 14:49:00 GMT
 last-modified: Tue, 13 Jun 2000 12:10:00 GMT
 etag: "21025-dc7-39462498"
@@ -74,5 +72,9 @@ via: 1.1 nghttpx
 <stripfile>
 s/^server: nghttpx.*\r?\n//
 </stripfile>
+<limits>
+Allocations: 170
+Maximum allocated: 1800000
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test2501 b/third-party/curl/tests/data/test2501
index efe0cf465c..e1ab697c9b 100644
--- a/third-party/curl/tests/data/test2501
+++ b/third-party/curl/tests/data/test2501
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ HTTPS
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 201 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
@@ -21,41 +21,38 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-debug
+Debug
 http
 http/3
 </features>
 <server>
-http
 http/3
 </server>
- <name>
+<name>
 HTTP/3 POST
- </name>
+</name>
 <setenv>
 </setenv>
- <command>
--k --http3 "https://%HOSTIP:%HTTP3PORT/%TESTNUMBER" -d "moo"
+<command>
+--insecure --http3 "https://%HOSTIP:%HTTP3PORT/%TESTNUMBER" -d "moo"
 </command>
 
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<stdout>
-HTTP/3 201 
+<stdout crlf="headers">
+HTTP/3 201%SP
 date: Tue, 09 Nov 2010 14:49:00 GMT
 content-length: 0
 funny-head: yesyes
 via: 1.1 nghttpx
 
 </stdout>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST https://%HOSTIP:%HTTP3PORT/2501 HTTP/1.1
 Host: %HOSTIP:%HTTP3PORT
 User-Agent: curl/%VERSION
@@ -66,5 +63,8 @@ Via: 3 nghttpx
 
 moo
 </protocol>
+<limits>
+Maximum allocated: 1900000
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test2502 b/third-party/curl/tests/data/test2502
index 18b43db883..ad55c553f9 100644
--- a/third-party/curl/tests/data/test2502
+++ b/third-party/curl/tests/data/test2502
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ verbose logs
 
 # Server-side
 <reply>
-<data1 crlf="yes">
+<data1 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: server.example.com
@@ -18,7 +19,7 @@ Content-Length: 47
 
 file contents should appear once for each file
 </data1>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: server.example.com
@@ -26,7 +27,7 @@ Content-Length: 47
 
 file contents should appear once for each file
 </data2>
-<data3>
+<data3 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: server.example.com
@@ -34,7 +35,7 @@ Content-Length: 47
 
 file contents should appear once for each file
 </data3>
-<data4>
+<data4 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: server.example.com
@@ -48,25 +49,25 @@ file contents should appear once for each file
 <client>
 <features>
 http/3
+verbose-strings
 </features>
 <server>
-http
 http/3
 </server>
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 HTTP GET multiple over HTTP/3
- </name>
- <command>
-https://%HOSTIP:%HTTP3PORT/path/%TESTNUMBER %HOSTIP %HTTP3PORT
+</name>
+<command>
+- %HOSTIP %HTTP3PORT %CERTDIR/certs/test-ca.cacert
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol crlf="yes">
+<protocol crlf="headers">
 GET https://localhost:%HTTP3PORT/path/%TESTNUMBER0001 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
@@ -92,13 +93,16 @@ Via: 3 nghttpx
 ^Host:.*
 </strip>
 <file name="%LOGDIR/stderr%TESTNUMBER" mode="text">
-* Connection #0 to host localhost left intact
-* Connection #0 to host localhost left intact
-* Connection #0 to host localhost left intact
-* Connection #0 to host localhost left intact
+== Info: Connection #0 to host localhost:%HTTP3PORT left intact
+== Info: Connection #0 to host localhost:%HTTP3PORT left intact
+== Info: Connection #0 to host localhost:%HTTP3PORT left intact
+== Info: Connection #0 to host localhost:%HTTP3PORT left intact
 </file>
 <stripfile>
-$_ = '' if (($_ !~ /left intact/) && ($_ !~ /Closing connection/))
+$_ = '' if(($_ !~ /left intact/) and ($_ !~ /Closing connection/))
 </stripfile>
+<limits>
+Maximum allocated: 1800000
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test2503 b/third-party/curl/tests/data/test2503
index 550eb8a22e..934798d336 100644
--- a/third-party/curl/tests/data/test2503
+++ b/third-party/curl/tests/data/test2503
@@ -1,18 +1,19 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP/3
 HTTPS
+--resolve
 -w
 %header
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes" crlf="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
@@ -24,7 +25,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -33,25 +33,23 @@ nghttpx-h3
 headers-api
 </features>
 <server>
-http
 http/3
 </server>
- <name>
+<name>
 HTTP/3 header-api
- </name>
+</name>
 <setenv>
 </setenv>
- <command>
--w '%{header_json}\n' --http3-only --cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --resolve localhost:%HTTP3PORT:%HOSTIP https://localhost:%HTTP3PORT/%TESTNUMBER
+<command>
+-w '%{header_json}\n' --http3-only --cacert %CERTDIR/certs/test-ca.crt --resolve localhost:%HTTP3PORT:%HOSTIP https://localhost:%HTTP3PORT/%TESTNUMBER
 </command>
 
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<stdout crlf="yes">
-HTTP/3 200 
+<stdout crlf="headers">
+HTTP/3 200%SP
 date: Tue, 09 Nov 2010 14:49:00 GMT
 content-length: 6
 content-type: text/html
@@ -66,5 +64,8 @@ via: 1.1 nghttpx
 "via":["1.1 nghttpx"]
 }
 </stdout>
+<limits>
+Maximum allocated: 1800000
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test2504 b/third-party/curl/tests/data/test2504
new file mode 100644
index 0000000000..7bb4a81ed7
--- /dev/null
+++ b/third-party/curl/tests/data/test2504
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+cookies
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: server.example.com
+Content-Length: 47
+Set-Cookie: sid=SECRET123; Path=/
+
+file contents should appear once for each file
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<tool>
+lib%TESTNUMBER
+</tool>
+<name>
+custom Host with cookie, handle reuse, no custom Host:
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT
+</command>
+<features>
+cookies
+</features>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET / HTTP/1.1
+Host: victim.internal
+Accept: */*
+
+GET / HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2505 b/third-party/curl/tests/data/test2505
new file mode 100644
index 0000000000..8fac590b37
--- /dev/null
+++ b/third-party/curl/tests/data/test2505
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+referer
+autoreferer
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 301 redirect
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: server.example.com
+Content-Length: 47
+Location: %TESTNUMBER0002
+
+file contents should appear once for each file
+</data>
+
+<data2 crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: server.example.com
+Content-Length: 47
+
+file contents should appear once for each file
+</data2>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<tool>
+lib%TESTNUMBER
+</tool>
+<name>
+verify CURLOPT_AUTOREFERER switched off
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET / HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+GET /%TESTNUMBER0002 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Referer: http://%HOSTIP:%HTTPPORT/
+
+GET / HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2506 b/third-party/curl/tests/data/test2506
new file mode 100644
index 0000000000..9c65002496
--- /dev/null
+++ b/third-party/curl/tests/data/test2506
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+cookies
+</keywords>
+</info>
+
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 301 redirect
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 3
+Location: http://numbertwo.example/%TESTNUMBER0002
+
+ok
+</data>
+<data2 crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 4
+
+yes
+</data2>
+</reply>
+
+<client>
+<server>
+http
+</server>
+<features>
+proxy
+</features>
+<tool>
+lib%TESTNUMBER
+</tool>
+<name>
+netrc with redirect using proxy
+</name>
+<file name="%LOGDIR/netrc2506">
+machine site.example login batman password robin
+</file>
+<command>
+http://%HOSTIP:%HTTPPORT http://site.example/ %LOGDIR/netrc2506
+</command>
+</client>
+
+<verify>
+<protocol crlf="headers">
+GET http://site.example/ HTTP/1.1
+Host: site.example
+Authorization: Basic %b64[batman:robin]b64%
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://numbertwo.example/25060002 HTTP/1.1
+Host: numbertwo.example
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test251 b/third-party/curl/tests/data/test251
index 52302d92eb..34ef99c941 100644
--- a/third-party/curl/tests/data/test251
+++ b/third-party/curl/tests/data/test251
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,9 +9,7 @@ SLOWDOWN
 
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -22,7 +21,7 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 <servercmd>
 SLOWDOWN
 </servercmd>
@@ -33,10 +32,10 @@ SLOWDOWN
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP dir list, PORT with specified IP and slow response
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/ -P %CLIENTIP
 </command>
 </client>
@@ -48,7 +47,7 @@ ftp://%HOSTIP:%FTPPORT/ -P %CLIENTIP
 ^PORT \d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3}
 ^EPRT \|1\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|\d{1,5}\|
 </strip>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test252 b/third-party/curl/tests/data/test252
index 92f046c443..384c671c0f 100644
--- a/third-party/curl/tests/data/test252
+++ b/third-party/curl/tests/data/test252
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,12 +8,9 @@ IPv6
 EPSV
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -24,30 +22,28 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-ipv6
+IPv6
 </features>
 <server>
 ftp-ipv6
 </server>
- <name>
+<name>
 FTP IPv6 dir list PASV
- </name>
- <command>
+</name>
+<command>
 -g "ftp://%HOST6IP:%FTP6PORT/"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test253 b/third-party/curl/tests/data/test253
index 8333061021..191b33c820 100644
--- a/third-party/curl/tests/data/test253
+++ b/third-party/curl/tests/data/test253
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,12 +8,9 @@ IPv6
 EPRT
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -21,36 +19,34 @@ drwxr-xr-x   2 98       98           512 May  2  1996 .NeXT
 lrwxrwxrwx   1 0        1              7 Dec  9  1999 bin -> usr/bin
 dr-xr-xr-x   2 0        1            512 Oct  1  1997 dev
 drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
-dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
+dr-xr-xr-x   2 0        1            512 Nov 30  1995 moo
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-ipv6
+IPv6
 </features>
 <server>
 ftp-ipv6
 </server>
- <name>
+<name>
 FTP IPv6 dir list with EPRT
- </name>
- <command>
+</name>
+<command>
 -g "ftp://%HOST6IP:%FTP6PORT/" -P -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^(EPRT \|2\|::1\|)(.*)/$1/
+s/^(EPRT \|2\|::1\|)(\S*)/$1/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test254 b/third-party/curl/tests/data/test254
index 2653e1ac04..0e39f5d3cb 100644
--- a/third-party/curl/tests/data/test254
+++ b/third-party/curl/tests/data/test254
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,12 +9,9 @@ EPSV
 --disable-epsv
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -25,30 +23,28 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-ipv6
+IPv6
 </features>
 <server>
 ftp-ipv6
 </server>
- <name>
+<name>
 FTP IPv6 dir list PASV and --disable-epsv
- </name>
- <command>
+</name>
+<command>
 -g "ftp://%HOST6IP:%FTP6PORT/" --disable-epsv
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test255 b/third-party/curl/tests/data/test255
index a09c1822a4..30e3d7d74f 100644
--- a/third-party/curl/tests/data/test255
+++ b/third-party/curl/tests/data/test255
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,12 +9,9 @@ EPRT
 --disable-eprt
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -25,33 +23,31 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-ipv6
+IPv6
 </features>
 <server>
 ftp-ipv6
 </server>
- <name>
+<name>
 FTP IPv6 dir list with EPRT and --disable-eprt
- </name>
- <command>
+</name>
+<command>
 -g "ftp://%HOST6IP:%FTP6PORT/" -P - --disable-eprt
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^(EPRT \|2\|::1\|)(.*)/$1/
+s/^(EPRT \|2\|::1\|)(\S*)/$1/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test256 b/third-party/curl/tests/data/test256
index e3d0c9171b..cc4d7e209d 100644
--- a/third-party/curl/tests/data/test256
+++ b/third-party/curl/tests/data/test256
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ HTTP
 HTTP GET
 HTTP proxy
 Resume
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -25,10 +25,10 @@ todelooooo lalalala yada yada, we know nothing about ranges ;-)
 <server>
 http
 </server>
- <name>
+<name>
 HTTP resume request over proxy with auth without server supporting it
- </name>
- <command option="no-output">
+</name>
+<command option="no-output">
 -x http://%HOSTIP:%HTTPPORT http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -C - --no-include -o %LOGDIR/fewl%TESTNUMBER.txt -U daniel:stenberg
 </command>
 <file name="%LOGDIR/fewl%TESTNUMBER.txt">
@@ -45,10 +45,10 @@ proxy
 <errorcode>
 33
 </errorcode>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Proxy-Authorization: Basic ZGFuaWVsOnN0ZW5iZXJn
+Proxy-Authorization: Basic %b64[daniel:stenberg]b64%
 Range: bytes=78-
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test257 b/third-party/curl/tests/data/test257
index dbf2aa4334..7d5760b96a 100644
--- a/third-party/curl/tests/data/test257
+++ b/third-party/curl/tests/data/test257
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -67,10 +68,10 @@ If this is received, the location following worked
 <server>
 http
 </server>
- <name>
+<name>
 HTTP Location: following with --netrc-optional
- </name>
- <command>
+</name>
+<command>
 http://supersite.com/want/%TESTNUMBER -L -x http://%HOSTIP:%HTTPPORT --netrc-optional --netrc-file %LOGDIR/netrc%TESTNUMBER
 </command>
 <features>
@@ -85,17 +86,17 @@ machine anotherone.com login user2 password passwd2
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://supersite.com/want/%TESTNUMBER HTTP/1.1
 Host: supersite.com
-Authorization: Basic dXNlcjE6cGFzc3dkMQ==
+Authorization: Basic %b64[user1:passwd1]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
 
 GET http://anotherone.com/%TESTNUMBER0002 HTTP/1.1
 Host: anotherone.com
-Authorization: Basic dXNlcjI6cGFzc3dkMg==
+Authorization: Basic %b64[user2:passwd2]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test258 b/third-party/curl/tests/data/test258
index b9e098e6e8..25a2a8f596 100644
--- a/third-party/curl/tests/data/test258
+++ b/third-party/curl/tests/data/test258
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,7 +13,7 @@ HTTP proxy Digest auth
 </info>
 # Server-side
 <reply>
-# The stupid test server doesn't response anything at all until the full
+# The stupid test server does not response anything at all until the full
 # request has been sent, and then of course the full POST has already been
 # sent!
 <data>
@@ -24,7 +25,7 @@ Proxy-Connection: close
 Content-Length: 0
 
 </data>
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 A OK
 Server: Microsoft-IIS/6.0
 Content-Type: text/html; charset=iso-8859-1
@@ -40,11 +41,11 @@ Proxy-Authenticate: Digest realm="many secrets", nonce="911"
 Proxy-Connection: close
 Content-Length: 0
 
-HTTP/1.1 200 A OK
-Server: Microsoft-IIS/6.0
-Content-Type: text/html; charset=iso-8859-1
-Content-Length: 3
-
+HTTP/1.1 200 A OK%CR
+Server: Microsoft-IIS/6.0%CR
+Content-Type: text/html; charset=iso-8859-1%CR
+Content-Length: 3%CR
+%CR
 ok
 </datacheck>
 
@@ -60,11 +61,12 @@ Mime
 !SSPI
 crypto
 proxy
+digest
 </features>
- <name>
+<name>
 HTTP POST multipart without Expect: header using proxy anyauth (Digest)
- </name>
- <command>
+</name>
+<command>
 -x http://%HOSTIP:%HTTPPORT http://remotehost:54321/we/want/%TESTNUMBER -F name=daniel -F tool=curl -F file=@%LOGDIR/test%TESTNUMBER.txt -H "Expect:" -U uuuser:pppassword --proxy-anyauth
 </command>
 # We create this file before the command is invoked!
@@ -81,57 +83,57 @@ bar
 ^(Content-Type: multipart/form-data;|------).*
 </strip>
 <protocol>
-POST http://remotehost:54321/we/want/%TESTNUMBER HTTP/1.1
-Host: remotehost:54321
-User-Agent: curl/%VERSION
-Accept: */*
-Proxy-Connection: Keep-Alive
-Content-Length: 409
-Content-Type: multipart/form-data; boundary=----------------------------7c633d5c27ce
-
-------------------------------7c633d5c27ce
-Content-Disposition: form-data; name="name"
-
-daniel
-------------------------------7c633d5c27ce
-Content-Disposition: form-data; name="tool"
-
-curl
-------------------------------7c633d5c27ce
-Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER.txt"
-Content-Type: text/plain
-
+POST http://remotehost:54321/we/want/%TESTNUMBER HTTP/1.1%CR
+Host: remotehost:54321%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Proxy-Connection: Keep-Alive%CR
+Content-Length: 433%CR
+Content-Type: multipart/form-data; boundary=----------------------------7c633d5c27ce%CR
+%CR
+------------------------------7c633d5c27ce%CR
+Content-Disposition: form-data; name="name"%CR
+%CR
+daniel%CR
+------------------------------7c633d5c27ce%CR
+Content-Disposition: form-data; name="tool"%CR
+%CR
+curl%CR
+------------------------------7c633d5c27ce%CR
+Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER.txt"%CR
+Content-Type: text/plain%CR
+%CR
 foo-
 This is a moo-
 bar
-
-------------------------------7c633d5c27ce--
-POST http://remotehost:54321/we/want/%TESTNUMBER HTTP/1.1
-Host: remotehost:54321
-Proxy-Authorization: Digest username="uuuser", realm="many secrets", nonce="911", uri="/we/want/%TESTNUMBER", response="2501654ca391f0b5c8c12a1da77e34cd"
-User-Agent: curl/%VERSION
-Accept: */*
-Proxy-Connection: Keep-Alive
-Content-Length: 409
-Content-Type: multipart/form-data; boundary=----------------------------7c633d5c27ce
-
-------------------------------7c633d5c27ce
-Content-Disposition: form-data; name="name"
-
-daniel
-------------------------------7c633d5c27ce
-Content-Disposition: form-data; name="tool"
-
-curl
-------------------------------7c633d5c27ce
-Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER.txt"
-Content-Type: text/plain
-
+%CR
+------------------------------7c633d5c27ce--%CR
+POST http://remotehost:54321/we/want/%TESTNUMBER HTTP/1.1%CR
+Host: remotehost:54321%CR
+Proxy-Authorization: Digest username="uuuser", realm="many secrets", nonce="911", uri="/we/want/%TESTNUMBER", response="2501654ca391f0b5c8c12a1da77e34cd"%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Proxy-Connection: Keep-Alive%CR
+Content-Length: 433%CR
+Content-Type: multipart/form-data; boundary=----------------------------7c633d5c27ce%CR
+%CR
+------------------------------7c633d5c27ce%CR
+Content-Disposition: form-data; name="name"%CR
+%CR
+daniel%CR
+------------------------------7c633d5c27ce%CR
+Content-Disposition: form-data; name="tool"%CR
+%CR
+curl%CR
+------------------------------7c633d5c27ce%CR
+Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER.txt"%CR
+Content-Type: text/plain%CR
+%CR
 foo-
 This is a moo-
 bar
-
-------------------------------7c633d5c27ce--
+%CR
+------------------------------7c633d5c27ce--%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test259 b/third-party/curl/tests/data/test259
index 3d76152066..2a9f36632f 100644
--- a/third-party/curl/tests/data/test259
+++ b/third-party/curl/tests/data/test259
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ HTTP proxy Digest auth
 </info>
 # Server-side
 <reply>
-# The stupid test server doesn't response anything at all until the full
+# The stupid test server does not response anything at all until the full
 # request has been sent, and then of course the full POST has already been
 # sent!
 <data>
@@ -21,7 +22,7 @@ Proxy-Authenticate: Digest realm="many secrets", nonce="911"
 Content-Length: 0
 
 </data>
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 A OK
 Server: Microsoft-IIS/6.0
 Content-Type: text/html; charset=iso-8859-1
@@ -36,11 +37,11 @@ Server: test-server/fake
 Proxy-Authenticate: Digest realm="many secrets", nonce="911"
 Content-Length: 0
 
-HTTP/1.1 200 A OK
-Server: Microsoft-IIS/6.0
-Content-Type: text/html; charset=iso-8859-1
-Content-Length: 3
-
+HTTP/1.1 200 A OK%CR
+Server: Microsoft-IIS/6.0%CR
+Content-Type: text/html; charset=iso-8859-1%CR
+Content-Length: 3%CR
+%CR
 ok
 </datacheck>
 
@@ -56,11 +57,12 @@ Mime
 !SSPI
 crypto
 proxy
+digest
 </features>
- <name>
+<name>
 HTTP POST multipart with Expect: header using proxy anyauth (Digest)
- </name>
- <command>
+</name>
+<command>
 -x http://%HOSTIP:%HTTPPORT http://remotehost:54321/we/want/%TESTNUMBER -F name=daniel -F tool=curl -F file=@%LOGDIR/test%TESTNUMBER.txt -U uuuser:pppassword --proxy-anyauth -H "Expect: 100-continue"
 </command>
 # We create this file before the command is invoked!
@@ -77,59 +79,59 @@ bar
 ^(Content-Type: multipart/form-data;|------).*
 </strip>
 <protocol>
-POST http://remotehost:54321/we/want/%TESTNUMBER HTTP/1.1
-Host: remotehost:54321
-User-Agent: curl/%VERSION
-Accept: */*
-Proxy-Connection: Keep-Alive
-Expect: 100-continue
-Content-Length: 409
-Content-Type: multipart/form-data; boundary=----------------------------7c633d5c27ce
-
-------------------------------7c633d5c27ce
-Content-Disposition: form-data; name="name"
-
-daniel
-------------------------------7c633d5c27ce
-Content-Disposition: form-data; name="tool"
-
-curl
-------------------------------7c633d5c27ce
-Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER.txt"
-Content-Type: text/plain
-
+POST http://remotehost:54321/we/want/%TESTNUMBER HTTP/1.1%CR
+Host: remotehost:54321%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Proxy-Connection: Keep-Alive%CR
+Expect: 100-continue%CR
+Content-Length: 433%CR
+Content-Type: multipart/form-data; boundary=----------------------------7c633d5c27ce%CR
+%CR
+------------------------------7c633d5c27ce%CR
+Content-Disposition: form-data; name="name"%CR
+%CR
+daniel%CR
+------------------------------7c633d5c27ce%CR
+Content-Disposition: form-data; name="tool"%CR
+%CR
+curl%CR
+------------------------------7c633d5c27ce%CR
+Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER.txt"%CR
+Content-Type: text/plain%CR
+%CR
 foo-
 This is a moo-
 bar
-
-------------------------------7c633d5c27ce--
-POST http://remotehost:54321/we/want/%TESTNUMBER HTTP/1.1
-Host: remotehost:54321
-Proxy-Authorization: Digest username="uuuser", realm="many secrets", nonce="911", uri="/we/want/%TESTNUMBER", response="b479994d13e60f3aa192a67c5892ddc5"
-User-Agent: curl/%VERSION
-Accept: */*
-Proxy-Connection: Keep-Alive
-Expect: 100-continue
-Content-Length: 409
-Content-Type: multipart/form-data; boundary=----------------------------7c633d5c27ce
-
-------------------------------7c633d5c27ce
-Content-Disposition: form-data; name="name"
-
-daniel
-------------------------------7c633d5c27ce
-Content-Disposition: form-data; name="tool"
-
-curl
-------------------------------7c633d5c27ce
-Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER.txt"
-Content-Type: text/plain
-
+%CR
+------------------------------7c633d5c27ce--%CR
+POST http://remotehost:54321/we/want/%TESTNUMBER HTTP/1.1%CR
+Host: remotehost:54321%CR
+Proxy-Authorization: Digest username="uuuser", realm="many secrets", nonce="911", uri="/we/want/%TESTNUMBER", response="b479994d13e60f3aa192a67c5892ddc5"%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Proxy-Connection: Keep-Alive%CR
+Expect: 100-continue%CR
+Content-Length: 433%CR
+Content-Type: multipart/form-data; boundary=----------------------------7c633d5c27ce%CR
+%CR
+------------------------------7c633d5c27ce%CR
+Content-Disposition: form-data; name="name"%CR
+%CR
+daniel%CR
+------------------------------7c633d5c27ce%CR
+Content-Disposition: form-data; name="tool"%CR
+%CR
+curl%CR
+------------------------------7c633d5c27ce%CR
+Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER.txt"%CR
+Content-Type: text/plain%CR
+%CR
 foo-
 This is a moo-
 bar
-
-------------------------------7c633d5c27ce--
+%CR
+------------------------------7c633d5c27ce--%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test26 b/third-party/curl/tests/data/test26
index d85ab470dc..dd7181752e 100644
--- a/third-party/curl/tests/data/test26
+++ b/third-party/curl/tests/data/test26
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -21,17 +22,17 @@ Connection: close
 <server>
 http
 </server>
- <name>
+<name>
 specify more -o than URLs
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -o - -o -
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test260 b/third-party/curl/tests/data/test260
index 6459a5c3e1..3bcf9ecea2 100644
--- a/third-party/curl/tests/data/test260
+++ b/third-party/curl/tests/data/test260
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -25,24 +25,22 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
-HTTP GET URL without slash but with questionmark
- </name>
- <command>
+<name>
+HTTP GET URL without slash but with question mark
+</name>
+<command>
 "http://%HOSTIP:%HTTPPORT?%TESTNUMBER"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /?%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test2600 b/third-party/curl/tests/data/test2600
index d6d07256d7..660e475a82 100644
--- a/third-party/curl/tests/data/test2600
+++ b/third-party/curl/tests/data/test2600
@@ -1,24 +1,23 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 unittest
 cfilter
+timing-dependent
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
-debug
+Debug
 http
+!win32
 </features>
- <name>
+<name>
 connection filter connect/destroy unit tests
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test2601 b/third-party/curl/tests/data/test2601
index 1ca0b9c830..89b8114ff9 100644
--- a/third-party/curl/tests/data/test2601
+++ b/third-party/curl/tests/data/test2601
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,18 @@ bufq
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 bufq unit tests
- </name>
+</name>
 </client>
+<verify>
+<limits>
+Allocations: 6300
+</limits>
+</verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test2602 b/third-party/curl/tests/data/test2602
index e811f29c27..363189b1ec 100644
--- a/third-party/curl/tests/data/test2602
+++ b/third-party/curl/tests/data/test2602
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,13 @@ dynhds
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 dynhds unit tests
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test2603 b/third-party/curl/tests/data/test2603
index dfb3735ee2..dbb3d736fe 100644
--- a/third-party/curl/tests/data/test2603
+++ b/third-party/curl/tests/data/test2603
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,13 @@ http1
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 http1 parser unit tests
- </name>
+</name>
 </client>
 </testcase>
diff --git a/third-party/curl/tests/data/test2604 b/third-party/curl/tests/data/test2604
new file mode 100644
index 0000000000..ae997312df
--- /dev/null
+++ b/third-party/curl/tests/data/test2604
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+sftp
+</features>
+<name>
+Curl_get_pathname unit test
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test2605 b/third-party/curl/tests/data/test2605
new file mode 100644
index 0000000000..377d584b4e
--- /dev/null
+++ b/third-party/curl/tests/data/test2605
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+sftp
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+sftp
+</features>
+<name>
+Curl_ssh_range unit test
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test261 b/third-party/curl/tests/data/test261
index 4be510aed2..31e3c9e5b3 100644
--- a/third-party/curl/tests/data/test261
+++ b/third-party/curl/tests/data/test261
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ EPSV
 RETR
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -17,24 +17,22 @@ REPLY TYPE 226 Kind of on the positive side!
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP RETR with 226 response code to TYPE
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test262 b/third-party/curl/tests/data/test262
index d119d667232e016cfaadbc4c5b41b763408bf272..3cd7e04d206f4385837b80bb4e296bbe935e3ce0 100644
GIT binary patch
delta 389
zcmY*V%SyvQ6osUS9dPdhWEdKRN}7kYkC3FcB{ikhlqOw?i!d3RVmecjDD7WV@)LfH
zxNzm?I9a$TT)3BWx%WK2sy|0{v$tI*@SUXDict$`4HZE`F^g7oX`zKL_x<5`jCwZM
z-+c@&t|`MY!LJtDkqp_u4T71XH8iNJD)c5&Otw#wsy_2B6;+{ja)>m9v%(eRDR6>t
zX+WfFs(vd+xGmpwn=QTB?Vy7LFl00*G?%A@F7w!ctrDRG=UlA;al$fEd<&;C7`;)t
zlVcJ_2ISIs0T7cUVZc<PFb{3Ohm>rRoehdhQ7t^NeQYW;ToVrL#ZmDq+5?Ew<i$ee
z8=eUFckcvHkpjmL9v2S-XAb`j1D9pF0VUV-gYnFeN_^(cgJM!SzXE-X$%e1%O1<RW
Xq%3EcB{ncgnzEF~%UL_cXQlQB-<orF

delta 762
zcmY*XOK#dg7zQd;>PQ@*sVZ4Cs8S???P3xvg5nwjZU6^kZ1B$ZOl-{HLD)RZhBF{8
z(q+{%bk!Sl*G(_bRfnWfT4^5oX8!+sjOP2xZ?6s)w};^E-gRPBt=tq+6c?C?cmeWe
zPpAQgEqyeSueaS$@q3}PQI%R(k`~HjtYdBZaRjYVtTrV<RfIL1N@=gDY}BU0YT-c8
z9_wM>l%%^6Z>9jw&6GB=_PEb>$9?QYHuk3b+I(Uqn6maJr;8D{w%d5_Smx|mLD{Lw
zf^#1gsEekO0xeWF|4Qhl9@snLtD(B>HC3)_>0v)*cbYNadnY@xD#^1}IN{9=l)2%=
z5+ZxttM1kICjr2=xuX`EE-$dQB~Tk%?9L(UG>PB$rMm%NTe)*Hgl)WbL*h^P?b_o<
zl(D~dBOSZZATc|5V;jUjkyW5vBe2cIl(Y>kVTFbqv8~oAlRzJU&YmRu3u2e8ZR~Ey
z4XBr)lQ<0k>W-JJ99(*W9mBXUbC(>$vn-?CWe%Uuvzfz>*L3+^+Gl`bIKIdfc#h?T
z67;T0A8M5<U#VReGC=Y?v`9+26Zt3>88=N(oB=Y45)>t+E{gml5Si-ZQG~o?N+OZ*
zFp1G~m60xx$Ruc+l!IiBGoZDKqO=qs2a3!E{WNrB00<Dqgl729JH<=1z$p#&?)W9k
zW|`y9>=j_@<;a<%24IfwbFJencYFMrdvlft9TF!ZQ|xF%L%kP^r|9>ZZsd=@a%Xb>
zZyc&xzQ}_-C0{H_LOg;SppKSHvh)a~ti|aA6HwPnz=0ydF#^|gkKpv-c=_V|4~DDo
AN&o-=

diff --git a/third-party/curl/tests/data/test263 b/third-party/curl/tests/data/test263
index ae79840b44..18a779b18c 100644
--- a/third-party/curl/tests/data/test263
+++ b/third-party/curl/tests/data/test263
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ IPv6
 HTTP proxy
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -20,28 +20,26 @@ hello
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-ipv6
+IPv6
 proxy
 </features>
 <server>
 http-ipv6
 </server>
- <name>
+<name>
 HTTP-IPv6 GET with proxy specified using IPv6-numerical address
- </name>
- <command>
+</name>
+<command>
 -g -x "http://%HOST6IP:%HTTP6PORT" http://veryveryremotesite.com/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://veryveryremotesite.com/%TESTNUMBER HTTP/1.1
 Host: veryveryremotesite.com
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test264 b/third-party/curl/tests/data/test264
index 9094f00606..19d1990da1 100644
--- a/third-party/curl/tests/data/test264
+++ b/third-party/curl/tests/data/test264
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ HTTP proxy Basic auth
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Type: text/html
@@ -24,10 +25,10 @@ the content would go here
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with proxy string including http:// and user+password
- </name>
- <command>
+</name>
+<command>
 http://we.want.that.site.com/%TESTNUMBER -x http://f%61ke:user@%HOSTIP:%HTTPPORT
 </command>
 <features>
@@ -37,10 +38,10 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://we.want.that.site.com/%TESTNUMBER HTTP/1.1
 Host: we.want.that.site.com
-Proxy-Authorization: Basic ZmFrZTp1c2Vy
+Proxy-Authorization: Basic %b64[fake:user]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test265 b/third-party/curl/tests/data/test265
index c9a1e657a1..fc7780ce1d 100644
--- a/third-party/curl/tests/data/test265
+++ b/third-party/curl/tests/data/test265
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -14,19 +15,19 @@ NTLM
 <reply>
 
 # this is returned first since we get no proxy-auth
-<connect1001>
+<connect1001 crlf="headers">
 HTTP/1.0 407 Authorization Required to proxy me my dear
 Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
 Connection: Keep-Alive
 Content-Length: 1033
 
 And you should ignore this data.
-QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ
+%repeat[999 x Q]%
 </connect1001>
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<connect1002>
+<connect1002 crlf="headers">
 HTTP/1.1 200 Things are fine in proxy land
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -47,22 +48,22 @@ daniel
 
 # then this is returned when we get proxy-auth
 <data1000>
-HTTP/1.1 200 OK swsbounce
+HTTP/1.1 200 OK swsbounce%CR
 Server: no
-
+%CR
 Nice proxy auth sir!
 </data1000>
 
 <datacheck>
-HTTP/1.0 407 Authorization Required to proxy me my dear
-Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
-Connection: Keep-Alive
-Content-Length: 1033
-
-HTTP/1.1 200 Things are fine in proxy land
-Server: Microsoft-IIS/5.0
-Content-Type: text/html; charset=iso-8859-1
-
+HTTP/1.0 407 Authorization Required to proxy me my dear%CR
+Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==%CR
+Connection: Keep-Alive%CR
+Content-Length: 1033%CR
+%CR
+HTTP/1.1 200 Things are fine in proxy land%CR
+Server: Microsoft-IIS/5.0%CR
+Content-Type: text/html; charset=iso-8859-1%CR
+%CR
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 7
@@ -95,10 +96,10 @@ http://test.remote.example.com.%TESTNUMBER:%HTTPPORT/path/%TESTNUMBER0002 --prox
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 CONNECT test.remote.example.com.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: test.remote.example.com.%TESTNUMBER:%HTTPPORT
-Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Proxy-Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
diff --git a/third-party/curl/tests/data/test266 b/third-party/curl/tests/data/test266
index 7ed957b7c4..302a67d8a1 100644
--- a/third-party/curl/tests/data/test266
+++ b/third-party/curl/tests/data/test266
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,67 +8,64 @@ chunked Transfer-Encoding
 DELAY
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
-HTTP/1.1 200 funky chunky!
-Server: fakeit/0.9 fakeitbad/1.0
-Transfer-Encoding: chunked
-Trailer: chunky-trailer
-Connection: mooo
-
-40
-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-30
-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
-21;heresatest=moooo
+HTTP/1.1 200 funky chunky!%CR
+Server: fakeit/0.9 fakeitbad/1.0%CR
+Transfer-Encoding: chunked%CR
+Trailer: chunky-trailer%CR
+Connection: mooo%CR
+%CR
+40%CR
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%CR
+30%CR
+bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%CR
+21;heresatest=moooo%CR
 cccccccccccccccccccccccccccccccc
-
-0
-chunky-trailer: header data
-
+%CR
+0%CR
+chunky-trailer: header data%CR
+%CR
 </data>
 <datacheck>
-HTTP/1.1 200 funky chunky!
-Server: fakeit/0.9 fakeitbad/1.0
-Transfer-Encoding: chunked
-Trailer: chunky-trailer
-Connection: mooo
-
+HTTP/1.1 200 funky chunky!%CR
+Server: fakeit/0.9 fakeitbad/1.0%CR
+Transfer-Encoding: chunked%CR
+Trailer: chunky-trailer%CR
+Connection: mooo%CR
+%CR
 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbcccccccccccccccccccccccccccccccc
-chunky-trailer: header data
+chunky-trailer: header data%CR
 </datacheck>
 <servercmd>
 writedelay: 10
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with chunked Transfer-Encoding and chunked trailer
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -D %LOGDIR/heads%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<file name="%LOGDIR/heads%TESTNUMBER">
+<file name="%LOGDIR/heads%TESTNUMBER" crlf="headers">
 HTTP/1.1 200 funky chunky!
 Server: fakeit/0.9 fakeitbad/1.0
 Transfer-Encoding: chunked
diff --git a/third-party/curl/tests/data/test267 b/third-party/curl/tests/data/test267
index bff006d994..65aca89c44 100644
--- a/third-party/curl/tests/data/test267
+++ b/third-party/curl/tests/data/test267
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -15,7 +16,7 @@ NTLM
 This is supposed to be returned when the server gets a first
 Authorization: NTLM line passed-in from the client -->
 
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 401 Now gimme that second request of crap
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -27,7 +28,7 @@ This is not the real page either!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 200 Things are fine in server land swsclose
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -36,7 +37,7 @@ Content-Length: 32
 Finally, this is the real page!
 </data1002>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Now gimme that second request of crap
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -73,10 +74,10 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --ntlm -d "data" -H "H
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Header1: yes
diff --git a/third-party/curl/tests/data/test268 b/third-party/curl/tests/data/test268
new file mode 100644
index 0000000000..8c2330e887
--- /dev/null
+++ b/third-party/curl/tests/data/test268
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+variables
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+JSON encoding of Unicode string
+</name>
+<file name="%LOGDIR/junk" nonewline="yes">
+%hex[%e2%80%9c]hex%
+</file>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --variable hello@%LOGDIR/junk --expand-data {{hello:json}}
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+POST /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 3
+Content-Type: application/x-www-form-urlencoded
+
+%hex[%e2%80%9c]hex%
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test269 b/third-party/curl/tests/data/test269
index fee9d61b6b..79553c3437 100644
--- a/third-party/curl/tests/data/test269
+++ b/third-party/curl/tests/data/test269
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -23,27 +23,22 @@ muahahaha
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-<features>
-!hyper
-</features>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP --ignore-content-length
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --ignore-content-length
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test27 b/third-party/curl/tests/data/test27
index d9b81e3e01..585c6dbb54 100644
--- a/third-party/curl/tests/data/test27
+++ b/third-party/curl/tests/data/test27
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,10 +24,10 @@ Content-Length: 8
 <server>
 http
 </server>
- <name>
+<name>
 Get same cookie page several times
- </name>
- <command>
+</name>
+<command>
 "http://%HOSTIP:%HTTPPORT/want/{%TESTNUMBER,%TESTNUMBER,%TESTNUMBER}" -b none
 </command>
 <features>
@@ -36,7 +37,7 @@ cookies
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test270 b/third-party/curl/tests/data/test270
index 7774640445..213624da76 100644
--- a/third-party/curl/tests/data/test270
+++ b/third-party/curl/tests/data/test270
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -26,17 +27,17 @@ PASVBADIP
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP RETR PASV --ftp-skip-pasv-ip
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --ftp-skip-pasv-ip --disable-epsv
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test2700 b/third-party/curl/tests/data/test2700
new file mode 100644
index 0000000000..99399dd6c9
--- /dev/null
+++ b/third-party/curl/tests/data/test2700
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Frame types
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   A TEXT/BINARY/PING/PONG/CLOSE message with payload
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%81%03txt]hex%%hex[%82%03bin]hex%%hex[%89%04ping]hex%%hex[%8a%04pong]hex%%hex[%88%07%03%e8close]hex%
+</data>
+</reply>
+
+<verify>
+
+# Exact echo of reply data with additional masking
+<protocol nonewline="yes">
+%hex[%81%83%00%00%00%00txt]hex%%hex[%82%83%00%00%00%00bin]hex%%hex[%89%84%00%00%00%00ping]hex%%hex[%8a%84%00%00%00%00pong]hex%%hex[%88%87%00%00%00%00%03%e8close]hex%
+</protocol>
+
+# PING is handled by lib and never given to application
+<stdout>
+txt fin [3] txt
+bin fin [3] bin
+ping [4] ping
+pong [4] pong
+close [7] %hex[%03%e8]hex%close
+</stdout>
+
+# CURLE_OK
+<errorcode>
+0
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2701 b/third-party/curl/tests/data/test2701
new file mode 100644
index 0000000000..c413c7ab91
--- /dev/null
+++ b/third-party/curl/tests/data/test2701
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Invalid opcode 0x3
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   An empty frame with the reserved opcode 0x3
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%83%00]hex%
+</data>
+</reply>
+
+<verify>
+
+# No frames
+<protocol nonewline="yes">
+
+</protocol>
+
+# No frames
+<stdout nonewline="yes">
+
+</stdout>
+
+# CURLE_RECV_ERROR
+<errorcode>
+56
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2702 b/third-party/curl/tests/data/test2702
new file mode 100644
index 0000000000..989d1dfa77
--- /dev/null
+++ b/third-party/curl/tests/data/test2702
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Invalid opcode 0xB
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   An empty frame with the reserved opcode 0xB
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%8b%00]hex%
+</data>
+</reply>
+
+<verify>
+
+# No frames
+<protocol nonewline="yes">
+
+</protocol>
+
+# No frames
+<stdout nonewline="yes">
+
+</stdout>
+
+# CURLE_RECV_ERROR
+<errorcode>
+56
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2703 b/third-party/curl/tests/data/test2703
new file mode 100644
index 0000000000..f39d91ecb4
--- /dev/null
+++ b/third-party/curl/tests/data/test2703
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Invalid reserved bit RSV1
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   An empty frame with the RSV1 bit set
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%C1%00]hex%
+</data>
+</reply>
+
+<verify>
+
+# No frames
+<protocol nonewline="yes">
+
+</protocol>
+
+# No frames
+<stdout nonewline="yes">
+
+</stdout>
+
+# CURLE_RECV_ERROR
+<errorcode>
+56
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2704 b/third-party/curl/tests/data/test2704
new file mode 100644
index 0000000000..f29699f4e0
--- /dev/null
+++ b/third-party/curl/tests/data/test2704
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Invalid reserved bit RSV2
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   An empty frame with the RSV2 bit set
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%A1%00]hex%
+</data>
+</reply>
+
+<verify>
+
+# No frames
+<protocol nonewline="yes">
+
+</protocol>
+
+# No frames
+<stdout nonewline="yes">
+
+</stdout>
+
+# CURLE_RECV_ERROR
+<errorcode>
+56
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2705 b/third-party/curl/tests/data/test2705
new file mode 100644
index 0000000000..f0cb843460
--- /dev/null
+++ b/third-party/curl/tests/data/test2705
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Invalid reserved bit RSV3
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   An empty frame with the RSV3 bit set
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%91%00]hex%
+</data>
+</reply>
+
+<verify>
+
+# No frames
+<protocol nonewline="yes">
+
+</protocol>
+
+# No frames
+<stdout nonewline="yes">
+
+</stdout>
+
+# CURLE_RECV_ERROR
+<errorcode>
+56
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2706 b/third-party/curl/tests/data/test2706
new file mode 100644
index 0000000000..38c196f27e
--- /dev/null
+++ b/third-party/curl/tests/data/test2706
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Invalid masked server message
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   An empty frame with masking
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%81%80%12%34%56%78]hex%
+</data>
+</reply>
+
+<verify>
+
+# No frames
+<protocol nonewline="yes">
+
+</protocol>
+
+# No frames
+<stdout nonewline="yes">
+
+</stdout>
+
+# CURLE_RECV_ERROR
+<errorcode>
+56
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2707 b/third-party/curl/tests/data/test2707
new file mode 100644
index 0000000000..6e85911c2a
--- /dev/null
+++ b/third-party/curl/tests/data/test2707
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Peculiar frame sizes
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+# Frames with sizes around special cases of the frame encoding
+#   see https://datatracker.ietf.org/doc/html/rfc6455#section-5.2
+#    - 0: empty frame
+#    - 125: largest payload with 7-bit encoding
+#    - 126: smallest payload with 16-bit encoding AND this value in first byte indicates 16-bit encoding
+#    - 127: this value in first byte indicates 64-bit encoding
+#    - 65535: largest payload with 16-bit length encoding
+#    - 65536: smallest payload with 64-bit length encoding
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%81%00]hex%%hex[%81%7d]hex%%repeat[125 x _]%%hex[%81%7e%00%7e]hex%%repeat[126 x _]%%hex[%81%7e%00%7f]hex%%repeat[127 x _]%%hex[%81%7e%ff%ff]hex%%repeat[65535 x _]%%hex[%81%7f%00%00%00%00%00%01%00%00]hex%%repeat[65536 x _]%%hex[%88%00]hex%
+</data>
+</reply>
+
+<verify>
+
+# Exact echo of reply data with additional masking
+<protocol nonewline="yes">
+%hex[%81%80%00%00%00%00]hex%%hex[%81%fd%00%00%00%00]hex%%repeat[125 x _]%%hex[%81%fe%00%7e%00%00%00%00]hex%%repeat[126 x _]%%hex[%81%fe%00%7f%00%00%00%00]hex%%repeat[127 x _]%%hex[%81%fe%ff%ff%00%00%00%00]hex%%repeat[65535 x _]%%hex[%81%ff%00%00%00%00%00%01%00%00%00%00%00%00]hex%%repeat[65536 x _]%%hex[%88%80%00%00%00%00]hex%
+</protocol>
+
+<stdout>
+txt fin [0]
+txt fin [125] %repeat[125 x _]%
+txt fin [126] %repeat[126 x _]%
+txt fin [127] %repeat[127 x _]%
+txt fin [65535] %repeat[65535 x _]%
+txt fin [65536] %repeat[65536 x _]%
+close [0]
+</stdout>
+
+# CURLE_OK
+<errorcode>
+0
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2708 b/third-party/curl/tests/data/test2708
new file mode 100644
index 0000000000..97563e43bd
--- /dev/null
+++ b/third-party/curl/tests/data/test2708
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Automatic PONG
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# PING "test"
+# CLOSE
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%89%04test]hex%%hex[%88%00]hex%
+</data>
+</reply>
+
+<verify>
+
+# PONG "test" (payload MUST equal ping payload)
+#   see https://datatracker.ietf.org/doc/html/rfc6455#section-5.2
+# CLOSE
+<protocol nonewline="yes">
+%hex[%8A%84%00%00%00%00test%88%80%00%00%00%00]hex%
+</protocol>
+
+# PING is handled by lib and never given to application
+<stdout>
+close [0]
+</stdout>
+
+# CURLE_OK
+<errorcode>
+0
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2709 b/third-party/curl/tests/data/test2709
new file mode 100644
index 0000000000..e3a3bb49ee
--- /dev/null
+++ b/third-party/curl/tests/data/test2709
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: No automatic PONG
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# PING "test"
+# CLOSE
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%89%04test]hex%%hex[%88%00]hex%
+</data>
+</reply>
+
+<verify>
+
+# Exact echo of reply data with additional masking
+<protocol nonewline="yes">
+%hex[%89%84%00%00%00%00test]hex%%hex[%88%80%00%00%00%00]hex%
+</protocol>
+
+# PING is given to application
+<stdout>
+ping [4] test
+close [0]
+</stdout>
+
+# CURLE_OK
+<errorcode>
+0
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test271 b/third-party/curl/tests/data/test271
index a825198757..8cfbda1643 100644
--- a/third-party/curl/tests/data/test271
+++ b/third-party/curl/tests/data/test271
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ TFTP RRQ
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -17,21 +17,19 @@ returned
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 tftp
 </server>
- <name>
+<name>
 TFTP retrieve
- </name>
- <command>
+</name>
+<command>
 tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify pseudo protocol after the test has been "shot"
 <verify>
 <strip>
diff --git a/third-party/curl/tests/data/test2710 b/third-party/curl/tests/data/test2710
new file mode 100644
index 0000000000..ba8b0124fd
--- /dev/null
+++ b/third-party/curl/tests/data/test2710
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Unsolicited PONG
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   An unsolicited PONG with and without payload
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%8a%00]hex%%hex[%8a%04pong]hex%%hex[%88%00]hex%
+</data>
+</reply>
+
+<verify>
+
+# Exact echo of reply data with additional masking
+<protocol nonewline="yes">
+%hex[%8a%80%00%00%00%00]hex%%hex[%8a%84%00%00%00%00pong]hex%%hex[%88%80%00%00%00%00]hex%
+</protocol>
+
+<stdout>
+pong [0]
+pong [4] pong
+close [0]
+</stdout>
+
+# CURLE_OK
+<errorcode>
+0
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2711 b/third-party/curl/tests/data/test2711
new file mode 100644
index 0000000000..d0bc298b0c
--- /dev/null
+++ b/third-party/curl/tests/data/test2711
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Empty PING/PONG/CLOSE
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   A PING/PONG/CLOSE message without payload
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%89%00]hex%%hex[%8a%00]hex%%hex[%88%00]hex%
+</data>
+</reply>
+
+<verify>
+
+# Exact echo of reply data with additional masking
+<protocol nonewline="yes">
+%hex[%89%80%00%00%00%00]hex%%hex[%8a%80%00%00%00%00]hex%%hex[%88%80%00%00%00%00]hex%
+</protocol>
+
+# PING is handled by lib and never given to application
+<stdout>
+ping [0]
+pong [0]
+close [0]
+</stdout>
+
+# CURLE_OK
+<errorcode>
+0
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2712 b/third-party/curl/tests/data/test2712
new file mode 100644
index 0000000000..b19058d049
--- /dev/null
+++ b/third-party/curl/tests/data/test2712
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Max sized PING/PONG/CLOSE
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   A PING/PONG/CLOSE with 125 bytes payload each
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%89%7d]hex%%repeat[125 x _]%%hex[%8a%7d]hex%%repeat[125 x _]%%hex[%88%7d%03%e8]hex%%repeat[123 x _]%
+</data>
+</reply>
+
+<verify>
+
+# Exact echo of reply data with additional masking
+<protocol nonewline="yes">
+%hex[%89%fd%00%00%00%00]hex%%repeat[125 x _]%%hex[%8a%fd%00%00%00%00]hex%%repeat[125 x _]%%hex[%88%fd%00%00%00%00%03%e8]hex%%repeat[123 x _]%
+</protocol>
+
+# PING is handled by lib and never given to application
+<stdout>
+ping [125] %repeat[125 x _]%
+pong [125] %repeat[125 x _]%
+close [125] %hex[%03%e8]hex%%repeat[123 x _]%
+</stdout>
+
+# CURLE_OK
+<errorcode>
+0
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2713 b/third-party/curl/tests/data/test2713
new file mode 100644
index 0000000000..6c50bc72fe
--- /dev/null
+++ b/third-party/curl/tests/data/test2713
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Invalid oversized PING
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   A 126-byte-long PING
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%89%7e%00%7e]hex%%repeat[126 x _]%
+</data>
+</reply>
+
+<verify>
+
+# No frames
+<protocol nonewline="yes">
+
+</protocol>
+
+# No frames
+<stdout nonewline="yes">
+
+</stdout>
+
+# CURLE_RECV_ERROR
+<errorcode>
+56
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2714 b/third-party/curl/tests/data/test2714
new file mode 100644
index 0000000000..654004966f
--- /dev/null
+++ b/third-party/curl/tests/data/test2714
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Invalid oversized PONG
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   A 126-byte-long PONG
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%8a%7e%00%7e]hex%%repeat[126 x _]%
+</data>
+</reply>
+
+<verify>
+
+# No frames
+<protocol nonewline="yes">
+
+</protocol>
+
+# No frames
+<stdout nonewline="yes">
+
+</stdout>
+
+# CURLE_RECV_ERROR
+<errorcode>
+56
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2715 b/third-party/curl/tests/data/test2715
new file mode 100644
index 0000000000..4cf4febb35
--- /dev/null
+++ b/third-party/curl/tests/data/test2715
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Invalid oversized CLOSE
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   A 126-byte-long CLOSE
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%88%7e%00%7e%03%e8]hex%%repeat[124 x _]%
+</data>
+</reply>
+
+<verify>
+
+# No frames
+<protocol nonewline="yes">
+
+</protocol>
+
+# No frames
+<stdout nonewline="yes">
+
+</stdout>
+
+# CURLE_RECV_ERROR
+<errorcode>
+56
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2716 b/third-party/curl/tests/data/test2716
new file mode 100644
index 0000000000..989e0a1ec9
--- /dev/null
+++ b/third-party/curl/tests/data/test2716
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Invalid fragmented PING
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   A fragmented PING
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%09%02p1]hex%%hex[%80%02p2]hex%
+</data>
+</reply>
+
+<verify>
+
+# No frames
+<protocol nonewline="yes">
+
+</protocol>
+
+# No frames
+<stdout nonewline="yes">
+
+</stdout>
+
+# CURLE_RECV_ERROR
+<errorcode>
+56
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2717 b/third-party/curl/tests/data/test2717
new file mode 100644
index 0000000000..876f5849ba
--- /dev/null
+++ b/third-party/curl/tests/data/test2717
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Invalid fragmented PONG
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   A fragmented PONG
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%0a%02p1]hex%%hex[%80%02p2]hex%
+</data>
+</reply>
+
+<verify>
+
+# No frames
+<protocol nonewline="yes">
+
+</protocol>
+
+# No frames
+<stdout nonewline="yes">
+
+</stdout>
+
+# CURLE_RECV_ERROR
+<errorcode>
+56
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2718 b/third-party/curl/tests/data/test2718
new file mode 100644
index 0000000000..aa44e21a8e
--- /dev/null
+++ b/third-party/curl/tests/data/test2718
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Invalid fragmented CLOSE
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   A fragmented CLOSE
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%08%02p1]hex%%hex[%80%02p2]hex%
+</data>
+</reply>
+
+<verify>
+
+# No frames
+<protocol nonewline="yes">
+
+</protocol>
+
+# No frames
+<stdout nonewline="yes">
+
+</stdout>
+
+# CURLE_RECV_ERROR
+<errorcode>
+56
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2719 b/third-party/curl/tests/data/test2719
new file mode 100644
index 0000000000..bfdd49b104
--- /dev/null
+++ b/third-party/curl/tests/data/test2719
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Fragmented messages
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   Fragmented TEXT/BINARY messages, each with 2/3 fragments
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%01%02t1]hex%%hex[%80%02t2]hex%%hex[%01%02t1]hex%%hex[%00%02t2]hex%%hex[%80%02t3]hex%%hex[%02%02b1]hex%%hex[%80%02b2]hex%%hex[%02%02b1]hex%%hex[%00%02b2]hex%%hex[%80%02b3]hex%%hex[%88%00]hex%
+</data>
+</reply>
+
+<verify>
+
+# Exact echo of reply data with additional masking
+<protocol nonewline="yes">
+%hex[%01%82%00%00%00%00t1]hex%%hex[%80%82%00%00%00%00t2]hex%%hex[%01%82%00%00%00%00t1]hex%%hex[%00%82%00%00%00%00t2]hex%%hex[%80%82%00%00%00%00t3]hex%%hex[%02%82%00%00%00%00b1]hex%%hex[%80%82%00%00%00%00b2]hex%%hex[%02%82%00%00%00%00b1]hex%%hex[%00%82%00%00%00%00b2]hex%%hex[%80%82%00%00%00%00b3]hex%%hex[%88%80%00%00%00%00]hex%
+</protocol>
+
+<stdout>
+txt --- [2] t1
+txt fin [2] t2
+txt --- [2] t1
+txt --- [2] t2
+txt fin [2] t3
+bin --- [2] b1
+bin fin [2] b2
+bin --- [2] b1
+bin --- [2] b2
+bin fin [2] b3
+close [0]
+</stdout>
+
+# CURLE_OK
+<errorcode>
+0
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test272 b/third-party/curl/tests/data/test272
index 5d59fead9b..638a7f5c05 100644
--- a/third-party/curl/tests/data/test272
+++ b/third-party/curl/tests/data/test272
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -18,10 +19,10 @@ RETR
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP timed conditioned get file with identical time stamp
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -z "2004 jan 1 12:12:12 UTC"
 </command>
 
@@ -29,7 +30,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -z "2004 jan 1 12:12:12 UTC"
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test2720 b/third-party/curl/tests/data/test2720
new file mode 100644
index 0000000000..3a6c30d06e
--- /dev/null
+++ b/third-party/curl/tests/data/test2720
@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Fragmented messages with empty fragments
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   1st a message with an empty fragment at the beginning
+#   2nd a message with an empty fragment in the middle
+#   3rd a message with an empty fragment at the end
+#   4th a message with only empty fragments
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%01%00]hex%%hex[%00%02a1]hex%%hex[%80%02a2]hex%%hex[%01%02b1]hex%%hex[%00%00]hex%%hex[%80%02b2]hex%%hex[%01%02c1]hex%%hex[%00%02c2]hex%%hex[%80%00]hex%%hex[%01%00]hex%%hex[%00%00]hex%%hex[%80%00]hex%%hex[%88%00]hex%
+</data>
+</reply>
+
+<verify>
+
+# Exact echo of reply data with additional masking
+<protocol nonewline="yes">
+%hex[%01%80%00%00%00%00]hex%%hex[%00%82%00%00%00%00a1]hex%%hex[%80%82%00%00%00%00a2]hex%%hex[%01%82%00%00%00%00b1]hex%%hex[%00%80%00%00%00%00]hex%%hex[%80%82%00%00%00%00b2]hex%%hex[%01%82%00%00%00%00c1]hex%%hex[%00%82%00%00%00%00c2]hex%%hex[%80%80%00%00%00%00]hex%%hex[%01%80%00%00%00%00]hex%%hex[%00%80%00%00%00%00]hex%%hex[%80%80%00%00%00%00]hex%%hex[%88%80%00%00%00%00]hex%
+</protocol>
+
+<stdout>
+txt --- [0]
+txt --- [2] a1
+txt fin [2] a2
+txt --- [2] b1
+txt --- [0]
+txt fin [2] b2
+txt --- [2] c1
+txt --- [2] c2
+txt fin [0]
+txt --- [0]
+txt --- [0]
+txt fin [0]
+close [0]
+</stdout>
+
+# CURLE_OK
+<errorcode>
+0
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2721 b/third-party/curl/tests/data/test2721
new file mode 100644
index 0000000000..a3260bad02
--- /dev/null
+++ b/third-party/curl/tests/data/test2721
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Fragmented messages with interleaved pong
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   A TEXT/BINARY message fragmented into two frames each, with pongs in the middle
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%01%02t1]hex%%hex[%8a%02p1]hex%%hex[%80%02t2]hex%%hex[%02%02b1]hex%%hex[%8a%02p2]hex%%hex[%80%02b2]hex%%hex[%88%00]hex%
+</data>
+</reply>
+
+<verify>
+
+# Exact echo of reply data with additional masking
+<protocol nonewline="yes">
+%hex[%01%82%00%00%00%00t1]hex%%hex[%8a%82%00%00%00%00p1]hex%%hex[%80%82%00%00%00%00t2]hex%%hex[%02%82%00%00%00%00b1]hex%%hex[%8a%82%00%00%00%00p2]hex%%hex[%80%82%00%00%00%00b2]hex%%hex[%88%80%00%00%00%00]hex%
+</protocol>
+
+<stdout>
+txt --- [2] t1
+pong [2] p1
+txt fin [2] t2
+bin --- [2] b1
+pong [2] p2
+bin fin [2] b2
+close [0]
+</stdout>
+
+# CURLE_OK
+<errorcode>
+0
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2722 b/third-party/curl/tests/data/test2722
new file mode 100644
index 0000000000..61dbee612c
--- /dev/null
+++ b/third-party/curl/tests/data/test2722
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Invalid fragmented message without initial frame
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   First a valid BINARY frame
+#   Second a fragmented message with the first frame missing
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%82%01b]hex%%hex[%00%02m2]hex%%hex[%80%02m3]hex%
+</data>
+</reply>
+
+<verify>
+
+# Echo of reply data with additional masking up to the missing initial frame
+<protocol nonewline="yes">
+%hex[%82%81%00%00%00%00b]hex%
+</protocol>
+
+# Only frames up to the missing initial frame
+<stdout>
+bin fin [1] b
+</stdout>
+
+# CURLE_RECV_ERROR
+<errorcode>
+56
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test2723 b/third-party/curl/tests/data/test2723
new file mode 100644
index 0000000000..6fbac2bc88
--- /dev/null
+++ b/third-party/curl/tests/data/test2723
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+WebSockets
+</keywords>
+</info>
+
+<client>
+<name>
+ws: Invalid fragmented message without final frame
+</name>
+<features>
+Debug
+ws
+</features>
+<server>
+http
+</server>
+<tool>
+lib2700
+</tool>
+<command>
+ws://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_WS_FORCE_ZERO_MASK=1
+</setenv>
+</client>
+
+<reply>
+<servercmd>
+upgrade
+</servercmd>
+
+# Full list of frames: see 'verify.stdout' below
+#   First a fragmented TEXT message with the last frame missing
+#   Second a valid BINARY frame
+<data nocheck="yes" nonewline="yes">
+HTTP/1.1 101 Switching to WebSockets
+Server: server/%TESTNUMBER
+Upgrade: Websocket
+Connection: Upgrade
+Sec-WebSocket-Accept: HkPsVga7+8LuxM4RGQ5p9tZHeYs=
+
+%hex[%01%02t1]hex%%hex[%00%02t2]hex%%hex[%82%01b]hex%
+</data>
+</reply>
+
+<verify>
+
+# Echo of reply data with additional masking up to the missing final frame
+<protocol nonewline="yes">
+%hex[%01%82%00%00%00%00t1]hex%%hex[%00%82%00%00%00%00t2]hex%
+</protocol>
+
+# Only frames up to the missing final frame
+<stdout>
+txt --- [2] t1
+txt --- [2] t2
+</stdout>
+
+# CURLE_RECV_ERROR
+<errorcode>
+56
+</errorcode>
+
+# Strip HTTP header from 'protocol'
+<strip>
+^GET /.*
+^(Host|User-Agent|Accept|Upgrade|Connection|Sec-WebSocket-(Version|Key)): .*
+^\s*$
+</strip>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test273 b/third-party/curl/tests/data/test273
index 5df9de8630..14768a280e 100644
--- a/third-party/curl/tests/data/test273
+++ b/third-party/curl/tests/data/test273
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP Digest auth
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145"
@@ -20,7 +21,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -29,7 +30,7 @@ Content-Length: 23
 This IS the real page!
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145"
@@ -54,18 +55,19 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP with two Digest authorization headers
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --digest
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test274 b/third-party/curl/tests/data/test274
index 1ab23f9cb8..6b99da27fb 100644
--- a/third-party/curl/tests/data/test274
+++ b/third-party/curl/tests/data/test274
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -24,17 +25,17 @@ Connection: close
 <server>
 http
 </server>
- <name>
+<name>
 HTTP Location: following with --max-redirs 0
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -L --max-redirs 0
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test275 b/third-party/curl/tests/data/test275
index 24c2ecdff7..47522f0dd2 100644
--- a/third-party/curl/tests/data/test275
+++ b/third-party/curl/tests/data/test275
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,10 +12,9 @@ proxytunnel
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 OK
 Connected-fine: sure
 
@@ -30,9 +30,9 @@ Content-Length: 9
 contents
 </data>
 <datacheck>
-HTTP/1.1 200 OK
-Connected-fine: sure
-
+HTTP/1.1 200 OK%CR
+Connected-fine: sure%CR
+%CR
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -43,17 +43,16 @@ contents
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 http-proxy
 </server>
- <name>
+<name>
 HTTP CONNECT with proxytunnel getting two URLs from the same host
- </name>
- <command>
+</name>
+<command>
 http://remotesite.com.%TESTNUMBER:%HTTPPORT/we/want/that/page/%TESTNUMBER -p -x %HOSTIP:%PROXYPORT --user iam:myself --proxy-user youare:yourself http://remotesite.com.%TESTNUMBER:%HTTPPORT/we/want/that/page/%TESTNUMBER
 </command>
 <features>
@@ -61,27 +60,26 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 CONNECT remotesite.com.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: remotesite.com.%TESTNUMBER:%HTTPPORT
-Proxy-Authorization: Basic eW91YXJlOnlvdXJzZWxm
+Proxy-Authorization: Basic %b64[youare:yourself]b64%
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
 </proxy>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: remotesite.com.%TESTNUMBER:%HTTPPORT
-Authorization: Basic aWFtOm15c2VsZg==
+Authorization: Basic %b64[iam:myself]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
 GET /we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: remotesite.com.%TESTNUMBER:%HTTPPORT
-Authorization: Basic aWFtOm15c2VsZg==
+Authorization: Basic %b64[iam:myself]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test276 b/third-party/curl/tests/data/test276
index e80a496bc2..4e259da4e4 100644
--- a/third-party/curl/tests/data/test276
+++ b/third-party/curl/tests/data/test276
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -49,17 +50,17 @@ If this is received, the location following worked
 <server>
 http
 </server>
- <name>
+<name>
 HTTP Location: following with multiple question marks in URLs
- </name>
- <command>
+</name>
+<command>
 "http://%HOSTIP:%HTTPPORT/want?uri=http://anything/%TESTNUMBER?secondq/%TESTNUMBER" -L
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want?uri=http://anything/%TESTNUMBER?secondq/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test277 b/third-party/curl/tests/data/test277
index e7199c9287..98bad9db3b 100644
--- a/third-party/curl/tests/data/test277
+++ b/third-party/curl/tests/data/test277
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -26,10 +27,10 @@ Mime
 <server>
 http
 </server>
- <name>
+<name>
 HTTP RFC1867-type formposting with custom Content-Type
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -F name=daniel -H "Content-Type: text/info"
 </command>
 </client>
@@ -37,15 +38,15 @@ http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -F name=daniel -H "Content-Type: text/
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/--------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=------------------------/
+s/^--------------------------[A-Za-z0-9]*/--------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=------------------------/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 POST /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Content-Length: 146
+Content-Length: 158
 Content-Type: text/info; boundary=------------------------
 
 --------------------------
diff --git a/third-party/curl/tests/data/test278 b/third-party/curl/tests/data/test278
index 91f89194f2..9db384aeb8 100644
--- a/third-party/curl/tests/data/test278
+++ b/third-party/curl/tests/data/test278
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ HTTP proxy Basic auth
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Type: text/html
@@ -24,10 +25,10 @@ the content would go here
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with proxy string including http:// and user+empty password
- </name>
- <command>
+</name>
+<command>
 http://we.want.that.site.com/%TESTNUMBER -x http://f%61ke:@%HOSTIP:%HTTPPORT
 </command>
 <features>
@@ -37,10 +38,10 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://we.want.that.site.com/%TESTNUMBER HTTP/1.1
 Host: we.want.that.site.com
-Proxy-Authorization: Basic ZmFrZTo=
+Proxy-Authorization: Basic %b64[fake:]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test279 b/third-party/curl/tests/data/test279
index 82718396d2..8e6e7e5e1e 100644
--- a/third-party/curl/tests/data/test279
+++ b/third-party/curl/tests/data/test279
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ HTTP proxy Basic auth
 
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Type: text/html
@@ -25,10 +26,10 @@ the content would go here
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with proxy string including http:// and user only
- </name>
- <command>
+</name>
+<command>
 http://we.want.that.site.com/%TESTNUMBER -x http://f%61ke@%HOSTIP:%HTTPPORT
 </command>
 <features>
@@ -38,10 +39,10 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://we.want.that.site.com/%TESTNUMBER HTTP/1.1
 Host: we.want.that.site.com
-Proxy-Authorization: Basic ZmFrZTo=
+Proxy-Authorization: Basic %b64[fake:]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test28 b/third-party/curl/tests/data/test28
index 63ee9934d8..b9c981b03c 100644
--- a/third-party/curl/tests/data/test28
+++ b/third-party/curl/tests/data/test28
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -30,11 +31,7 @@ If this is received, the location following worked
 HTTP/1.1 301 This is a weirdo text message swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
-%if hyper
-Location: /online/1,1795,Welcome,00.html/%TESTNUMBER0002.txt?logout=TRUE
-%else
 Location:  /online/1,1795,Welcome,00.html/%TESTNUMBER0002.txt?logout=TRUE
-%endif
 Connection: close
 
 HTTP/1.1 200 Followed here fine swsclose
@@ -52,17 +49,17 @@ If this is received, the location following worked
 <server>
 http
 </server>
- <name>
+<name>
 HTTP Location: following with extra spaces in header
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -L
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test280 b/third-party/curl/tests/data/test280
index e2eadf67e1..0c1727e381 100644
--- a/third-party/curl/tests/data/test280
+++ b/third-party/curl/tests/data/test280
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,12 +8,9 @@ LIST
 --ftp-alternative-to-user
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -23,32 +21,30 @@ dr-xr-xr-x   2 0        1            512 Oct  1  1997 dev
 drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
-dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+dr-xr-xr-x   5 0        1            512 Oct  1  1997 fine
+</data>
 <servercmd>
 REPLY USER 530 We don't like USER commands
 COUNT USER 1
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP --ftp-alternative-to-user on USER failure
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER/ --ftp-alternative-to-user "USER replacement"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 USER replacement
 PASS ftp@example.com
diff --git a/third-party/curl/tests/data/test281 b/third-party/curl/tests/data/test281
index 7177c81921..17673ba9da 100644
--- a/third-party/curl/tests/data/test281
+++ b/third-party/curl/tests/data/test281
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -24,10 +25,10 @@ Server: test-server/fake
 <server>
 http
 </server>
- <name>
+<name>
 HTTP PUT from file with 100 + 401 responses and -f without auth given
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -f -T %LOGDIR/test%TESTNUMBER.txt
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
@@ -43,7 +44,7 @@ Weird
 <errorcode>
 22
 </errorcode>
-<protocol>
+<protocol crlf="headers">
 PUT /we/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test282 b/third-party/curl/tests/data/test282
index 04b776b50f..57f48b6c53 100644
--- a/third-party/curl/tests/data/test282
+++ b/third-party/curl/tests/data/test282
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -15,24 +15,22 @@ HTTP/1.1 200 OK swsclose
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with no response body or headers
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test283 b/third-party/curl/tests/data/test283
index 0f2d0089a6..051e58c87c 100644
--- a/third-party/curl/tests/data/test283
+++ b/third-party/curl/tests/data/test283
@@ -1,27 +1,25 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 TFTP
 TFTP RRQ
-FAILURE
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 tftp
 </server>
- <name>
+<name>
 TFTP retrieve on invalid file
- </name>
- <command>
+</name>
+<command>
 tftp://%HOSTIP:%TFTPPORT//invalid-file --tftp-blksize 1024
 </command>
 </client>
 
-#
 # Verify pseudo protocol after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test284 b/third-party/curl/tests/data/test284
index a18f4929e5..aa48f4388c 100644
--- a/third-party/curl/tests/data/test284
+++ b/third-party/curl/tests/data/test284
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,11 @@ TFTP RRQ
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
 A chunk of data which exactly fits into
-a 512 byte TFTP block, testing a boundary
+a 512-byte TFTP block, testing a boundary
 condition in the TFTP receive code.
 789ABCDEF
 123456789ABCDEF
@@ -41,21 +41,19 @@ condition in the TFTP receive code.
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 tftp
 </server>
- <name>
-TFTP retrieve of boundary case 512 byte file
- </name>
- <command>
+<name>
+TFTP retrieve of boundary case 512-byte file
+</name>
+<command>
 tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify pseudo protocol after the test has been "shot"
 <verify>
 <strip>
diff --git a/third-party/curl/tests/data/test285 b/third-party/curl/tests/data/test285
index 8cb479a129..2c9051d345 100644
--- a/third-party/curl/tests/data/test285
+++ b/third-party/curl/tests/data/test285
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,16 @@ TFTP WRQ
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 tftp
 </server>
- <name>
+<name>
 TFTP send
- </name>
- <command>
--T %LOGDIR/test%TESTNUMBER.txt tftp://%HOSTIP:%TFTPPORT// --connect-time 549
+</name>
+<command>
+-T %LOGDIR/test%TESTNUMBER.txt tftp://%HOSTIP:%TFTPPORT// --connect-timeout 549 --max-time 599
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 a chunk of
@@ -26,7 +26,6 @@ sent
 </file>
 </client>
 
-#
 # Verify pseudo protocol after the test has been "shot"
 <verify>
 <upload>
diff --git a/third-party/curl/tests/data/test286 b/third-party/curl/tests/data/test286
index d51ec10622..cc9fd7c8f6 100644
--- a/third-party/curl/tests/data/test286
+++ b/third-party/curl/tests/data/test286
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,21 +7,20 @@ TFTP WRQ
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 tftp
 </server>
- <name>
-TFTP send of boundary case 512 byte file
- </name>
- <command>
+<name>
+TFTP send of boundary case 512-byte file
+</name>
+<command>
 -T %LOGDIR/test%TESTNUMBER.txt tftp://%HOSTIP:%TFTPPORT//
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 A chunk of data which exactly fits into
-a 512 byte TFTP block, testing a boundary
+a 512-byte TFTP block, testing a boundary
 condition in the TFTP transmit code.
 89ABCDEF
 123456789ABCDEF
@@ -50,12 +50,11 @@ condition in the TFTP transmit code.
 </file>
 </client>
 
-#
 # Verify pseudo protocol after the test has been "shot"
 <verify>
 <upload>
 A chunk of data which exactly fits into
-a 512 byte TFTP block, testing a boundary
+a 512-byte TFTP block, testing a boundary
 condition in the TFTP transmit code.
 89ABCDEF
 123456789ABCDEF
diff --git a/third-party/curl/tests/data/test287 b/third-party/curl/tests/data/test287
index 15bc566c1d..564b8ce99a 100644
--- a/third-party/curl/tests/data/test287
+++ b/third-party/curl/tests/data/test287
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ proxytunnel
 # Server-side
 <reply>
 
-<connect nocheck="yes">
+<connect crlf="headers" nocheck="yes">
 HTTP/1.1 405 Method Not Allowed swsclose
 
 And you should ignore this data.
@@ -24,10 +25,10 @@ And you should ignore this data.
 <server>
 http
 </server>
- <name>
+<name>
 HTTP proxy CONNECT with custom User-Agent header
- </name>
- <command>
+</name>
+<command>
 http://test.remote.example.com.%TESTNUMBER:%HTTPPORT/path/%TESTNUMBER -H "User-Agent: looser/2015" --proxy http://%HOSTIP:%HTTPPORT --proxytunnel --proxy-header "User-Agent: looser/2007"
 </command>
 <features>
@@ -37,18 +38,18 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 CONNECT test.remote.example.com.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: test.remote.example.com.%TESTNUMBER:%HTTPPORT
 Proxy-Connection: Keep-Alive
 User-Agent: looser/2007
 
 </protocol>
-# CURLE_RECV_ERROR
+# CURLE_COULDNT_CONNECT
 <errorcode>
-56
+7
 </errorcode>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 405 Method Not Allowed swsclose
 
 </stdout>
diff --git a/third-party/curl/tests/data/test288 b/third-party/curl/tests/data/test288
index 164cf20e76..a667835c14 100644
--- a/third-party/curl/tests/data/test288
+++ b/third-party/curl/tests/data/test288
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -18,15 +19,12 @@ moo
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 file
 </features>
- <name>
+<name>
 file:// with (unsupported) proxy, authentication and range
- </name>
+</name>
 <setenv>
 all_proxy=http://fake:user@%HOSTIP:%NOLISTENPORT/
 </setenv>
diff --git a/third-party/curl/tests/data/test289 b/third-party/curl/tests/data/test289
index 4b80c908cb..4253c1b776 100644
--- a/third-party/curl/tests/data/test289
+++ b/third-party/curl/tests/data/test289
@@ -1,10 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
 STOR
 Resume
-FAILURE
 </keywords>
 </info>
 
@@ -13,10 +13,10 @@ FAILURE
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP resume upload but denied access to local file
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T %LOGDIR/illegal-nonexistent-file -C -
 </command>
 </client>
diff --git a/third-party/curl/tests/data/test29 b/third-party/curl/tests/data/test29
index 57305e266d..df67f85019 100644
--- a/third-party/curl/tests/data/test29
+++ b/third-party/curl/tests/data/test29
@@ -1,15 +1,15 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
 timeout
-FAILURE
 </keywords>
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
@@ -26,17 +26,20 @@ wait 10
 <server>
 http
 </server>
- <name>
+<killserver>
+http
+</killserver>
+<name>
 HTTP with 2 secs timeout
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -m 2
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test290 b/third-party/curl/tests/data/test290
index 7a769ac25c..e431333a28 100644
--- a/third-party/curl/tests/data/test290
+++ b/third-party/curl/tests/data/test290
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -17,10 +18,10 @@ FTP
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download maximum filesize exceeded
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --max-filesize 30
 </command>
 </client>
@@ -30,7 +31,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --max-filesize 30
 <errorcode>
 63
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test291 b/third-party/curl/tests/data/test291
index d48b4f0dfa..2eabc16d59 100644
--- a/third-party/curl/tests/data/test291
+++ b/third-party/curl/tests/data/test291
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,17 +24,17 @@ works
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP download maximum filesize not exceeded
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --max-filesize 100
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test292 b/third-party/curl/tests/data/test292
index 4876e30065..b0f403f079 100644
--- a/third-party/curl/tests/data/test292
+++ b/third-party/curl/tests/data/test292
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -26,24 +26,22 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with maximum filesize not exceeded
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --max-filesize 1000
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test293 b/third-party/curl/tests/data/test293
index 260d2bb1e5..c6f69f2e01 100644
--- a/third-party/curl/tests/data/test293
+++ b/third-party/curl/tests/data/test293
@@ -1,14 +1,13 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
 --max-filesize
-FAILURE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -27,27 +26,25 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with maximum filesize exceeded
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --max-filesize 2
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 63
 </errorcode>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test294 b/third-party/curl/tests/data/test294
index 8a38fc12d9..9b24ddecfa 100644
--- a/third-party/curl/tests/data/test294
+++ b/third-party/curl/tests/data/test294
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,12 +9,9 @@ ACCT
 --ftp-account
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -25,31 +23,29 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 <servercmd>
 REPLY PASS 332 Give me an ACCT now
 REPLY ACCT 230 Thank-you for the ACCT
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP --ftp-account on ACCT request
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER/ --ftp-account "data for acct"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 ACCT data for acct
diff --git a/third-party/curl/tests/data/test295 b/third-party/curl/tests/data/test295
index 538a79e281..e7fbf6745c 100644
--- a/third-party/curl/tests/data/test295
+++ b/third-party/curl/tests/data/test295
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,8 @@ FTP
 PASV
 LIST
 ACCT
-FAILURE
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <servercmd>
@@ -17,27 +16,25 @@ REPLY PWD 530 No ACCT, go away
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP ACCT request without --ftp-account
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER/
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 67
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 </protocol>
diff --git a/third-party/curl/tests/data/test296 b/third-party/curl/tests/data/test296
index 571e4103b7..c107985db0 100644
--- a/third-party/curl/tests/data/test296
+++ b/third-party/curl/tests/data/test296
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ CWD
 multicwd
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -21,17 +21,17 @@ bla bla bla
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP CWD with --ftp-method multicwd
- </name>
- <command>
+</name>
+<command>
 --ftp-method multicwd ftp://%HOSTIP:%FTPPORT/first/second/third/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test297 b/third-party/curl/tests/data/test297
index a50dc55988..154264535c 100644
--- a/third-party/curl/tests/data/test297
+++ b/third-party/curl/tests/data/test297
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ CWD
 singlecwd
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -21,17 +21,17 @@ bla bla bla
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP CWD with --ftp-method singlecwd
- </name>
- <command>
+</name>
+<command>
 --ftp-method singlecwd ftp://%HOSTIP:%FTPPORT/first/second/third/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test298 b/third-party/curl/tests/data/test298
index 830e0950e9..4602cb2560 100644
--- a/third-party/curl/tests/data/test298
+++ b/third-party/curl/tests/data/test298
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ CWD
 nocwd
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -21,17 +21,17 @@ bla bla bla
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP CWD with --ftp-method nocwd
- </name>
- <command>
+</name>
+<command>
 --ftp-method nocwd ftp://%HOSTIP:%FTPPORT/first/second/th%69rd/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test299 b/third-party/curl/tests/data/test299
index 9522202d98..0c2fdb294a 100644
--- a/third-party/curl/tests/data/test299
+++ b/third-party/curl/tests/data/test299
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -29,20 +30,20 @@ http
 ftp
 proxy
 </features>
- <name>
+<name>
 FTP over HTTP proxy with user:pass not in url
- </name>
- <command>
+</name>
+<command>
 -x http://%HOSTIP:%HTTPPORT -u michal:aybabtu ftp://host.com/we/want/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET ftp://michal:aybabtu@host.com/we/want/%TESTNUMBER HTTP/1.1
 Host: host.com:21
-Authorization: Basic bWljaGFsOmF5YmFidHU=
+Authorization: Basic %b64[michal:aybabtu]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test3 b/third-party/curl/tests/data/test3
index 541e5a3890..1150214777 100644
--- a/third-party/curl/tests/data/test3
+++ b/third-party/curl/tests/data/test3
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ HTTP POST
 HTTP Basic auth
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.0 200 OK
 Server: test-server/fake
 Content-Type: text/html
@@ -17,7 +17,7 @@ Content-Length: 0
 
 this is data even though Content-Length is set to zero
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.0 200 OK
 Server: test-server/fake
 Content-Type: text/html
@@ -26,33 +26,31 @@ Content-Length: 0
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP POST with auth and contents but with content-length set to 0
- </name>
- <command>
- -d "fooo=mooo&pooo=clue&doo=%20%20%20++++" -u "fake:-user" http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</name>
+<command>
+-d "fooo=mooo%AMPpooo=clue%AMPdoo=%20%20%20++++" -u "fake:-user" http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic ZmFrZTotdXNlcg==
+Authorization: Basic %b64[fake:-user]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Content-Length: 37
 Content-Type: application/x-www-form-urlencoded
 
-fooo=mooo&pooo=clue&doo=%20%20%20++++
+fooo=mooo%AMPpooo=clue%AMPdoo=%20%20%20++++
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test30 b/third-party/curl/tests/data/test30
index 706b3f27e8..c0b5d60d43 100644
--- a/third-party/curl/tests/data/test30
+++ b/third-party/curl/tests/data/test30
@@ -1,9 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -17,17 +17,17 @@ FAILURE
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with no data in server reply
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test300 b/third-party/curl/tests/data/test300
index cb6d14ce89..0d0dbf1d1b 100644
--- a/third-party/curl/tests/data/test300
+++ b/third-party/curl/tests/data/test300
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -19,7 +19,6 @@ MooMoo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -28,18 +27,18 @@ SSL
 <server>
 https
 </server>
- <name>
+<name>
 simple HTTPS GET
- </name>
- <command>
+</name>
+# Using '-k' over '--insecure' to also test the short form
+<command>
 -k https://%HOSTIP:%HTTPSPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test3000 b/third-party/curl/tests/data/test3000
index ca035385df..317776e6de 100644
--- a/third-party/curl/tests/data/test3000
+++ b/third-party/curl/tests/data/test3000
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ PEM certificate
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -20,32 +20,27 @@ MooMoo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 SSL
 !Schannel
+local-http
 </features>
 <server>
-https Server-localhost-firstSAN-sv.pem
+https test-localhost-san-first.pem
 </server>
 <name>
-HTTPS GET to localhost, first subject alt name matches, CN does not match
+HTTPS localhost, first subaltname matches, CN does not match
 </name>
 <command>
---cacert %SRCDIR/certs/EdelCurlRoot-ca.crt https://localhost:%HTTPSPORT/%TESTNUMBER
+-4 --cacert %CERTDIR/certs/test-ca.crt https://localhost:%HTTPSPORT/%TESTNUMBER
 </command>
-# Ensure that we're running on localhost because we're checking the host name
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: localhost:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test3001 b/third-party/curl/tests/data/test3001
index 1065dc38cb..ec6a2cb705 100644
--- a/third-party/curl/tests/data/test3001
+++ b/third-party/curl/tests/data/test3001
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ PEM certificate
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -20,32 +20,27 @@ MooMoo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 SSL
 !Schannel
+local-http
 </features>
 <server>
-https Server-localhost-lastSAN-sv.pem
+https test-localhost-san-last.pem
 </server>
 <name>
-HTTPS GET to localhost, last subject alt name matches, CN does not match
+HTTPS localhost, last subject alt name matches, CN does not match
 </name>
 <command>
---cacert %SRCDIR/certs/EdelCurlRoot-ca.crt https://localhost:%HTTPSPORT/%TESTNUMBER
+-4 --cacert %CERTDIR/certs/test-ca.crt https://localhost:%HTTPSPORT/%TESTNUMBER
 </command>
-# Ensure that we're running on localhost because we're checking the host name
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: localhost:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test3002 b/third-party/curl/tests/data/test3002
index ea8c0d1aa3..8c0f063ece 100644
--- a/third-party/curl/tests/data/test3002
+++ b/third-party/curl/tests/data/test3002
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,46 +6,51 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
-SMTP with multiple and invalid (first) --mail-rcpt and --mail-rcpt-allowfails
- </name>
-<stdin>
+<name>
+SMTP multiple and invalid (first) --mail-rcpt and --mail-rcpt-allowfails
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
- <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt-allowfails --mail-rcpt invalid.one --mail-rcpt recipient.two@example.com --mail-rcpt recipient.three@example.com --mail-rcpt recipient.four@example.com --mail-rcpt recipient.five@example.com --mail-from sender@example.com -T -
+<command>
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER
+--mail-rcpt-allowfails
+--mail-rcpt invalid.one
+--mail-rcpt recipient.two@example.com
+--mail-rcpt recipient.three@example.com
+--mail-rcpt recipient.four@example.com
+--mail-rcpt recipient.five@example.com
+--mail-from sender@example.com
+-T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<invalid.one>
-RCPT TO:<recipient.two@example.com>
-RCPT TO:<recipient.three@example.com>
-RCPT TO:<recipient.four@example.com>
-RCPT TO:<recipient.five@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTinvalid.one%GT
+RCPT TO:%LTrecipient.two@example.com%GT
+RCPT TO:%LTrecipient.three@example.com%GT
+RCPT TO:%LTrecipient.four@example.com%GT
+RCPT TO:%LTrecipient.five@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
diff --git a/third-party/curl/tests/data/test3003 b/third-party/curl/tests/data/test3003
index ca18f014a9..cbeb243163 100644
--- a/third-party/curl/tests/data/test3003
+++ b/third-party/curl/tests/data/test3003
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,46 +6,51 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
-SMTP with multiple and invalid (last) --mail-rcpt and --mail-rcpt-allowfails
- </name>
-<stdin>
+<name>
+SMTP multiple and invalid (last) --mail-rcpt and --mail-rcpt-allowfails
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
- <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt-allowfails --mail-rcpt recipient.one@example.com --mail-rcpt recipient.two@example.com --mail-rcpt recipient.three@example.com --mail-rcpt recipient.four@example.com --mail-rcpt invalid.five --mail-from sender@example.com -T -
+<command>
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER
+--mail-rcpt-allowfails
+--mail-rcpt recipient.one@example.com
+--mail-rcpt recipient.two@example.com
+--mail-rcpt recipient.three@example.com
+--mail-rcpt recipient.four@example.com
+--mail-rcpt invalid.five
+--mail-from sender@example.com
+-T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient.one@example.com>
-RCPT TO:<recipient.two@example.com>
-RCPT TO:<recipient.three@example.com>
-RCPT TO:<recipient.four@example.com>
-RCPT TO:<invalid.five>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient.one@example.com%GT
+RCPT TO:%LTrecipient.two@example.com%GT
+RCPT TO:%LTrecipient.three@example.com%GT
+RCPT TO:%LTrecipient.four@example.com%GT
+RCPT TO:%LTinvalid.five%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
diff --git a/third-party/curl/tests/data/test3004 b/third-party/curl/tests/data/test3004
index ac2dd22e91..732c478352 100644
--- a/third-party/curl/tests/data/test3004
+++ b/third-party/curl/tests/data/test3004
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,46 +6,51 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
-SMTP with multiple and invalid (middle) --mail-rcpt and --mail-rcpt-allowfails
- </name>
-<stdin>
+<name>
+SMTP multiple and invalid (middle) --mail-rcpt and --mail-rcpt-allowfails
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
- <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt-allowfails --mail-rcpt recipient.one@example.com --mail-rcpt recipient.two@example.com --mail-rcpt invalid.three --mail-rcpt recipient.four@example.com --mail-rcpt recipient.five@example.com --mail-from sender@example.com -T -
+<command>
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER
+--mail-rcpt-allowfails
+--mail-rcpt recipient.one@example.com
+--mail-rcpt recipient.two@example.com
+--mail-rcpt invalid.three
+--mail-rcpt recipient.four@example.com
+--mail-rcpt recipient.five@example.com
+--mail-from sender@example.com
+-T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient.one@example.com>
-RCPT TO:<recipient.two@example.com>
-RCPT TO:<invalid.three>
-RCPT TO:<recipient.four@example.com>
-RCPT TO:<recipient.five@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient.one@example.com%GT
+RCPT TO:%LTrecipient.two@example.com%GT
+RCPT TO:%LTinvalid.three%GT
+RCPT TO:%LTrecipient.four@example.com%GT
+RCPT TO:%LTrecipient.five@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
diff --git a/third-party/curl/tests/data/test3005 b/third-party/curl/tests/data/test3005
index aad20f26df..6799b3136d 100644
--- a/third-party/curl/tests/data/test3005
+++ b/third-party/curl/tests/data/test3005
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,46 +6,51 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
-SMTP with multiple and invalid (all but one) --mail-rcpt and --mail-rcpt-allowfails
- </name>
-<stdin>
+<name>
+SMTP multiple invalid (all but one) --mail-rcpt and --mail-rcpt-allowfails
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
- <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt-allowfails --mail-rcpt invalid.one --mail-rcpt recipient.two@example.com --mail-rcpt invalid.three --mail-rcpt invalid.four --mail-rcpt invalid.five --mail-from sender@example.com -T -
+<command>
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER
+--mail-rcpt-allowfails
+--mail-rcpt invalid.one
+--mail-rcpt recipient.two@example.com
+--mail-rcpt invalid.three
+--mail-rcpt invalid.four
+--mail-rcpt invalid.five
+--mail-from sender@example.com
+-T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<invalid.one>
-RCPT TO:<recipient.two@example.com>
-RCPT TO:<invalid.three>
-RCPT TO:<invalid.four>
-RCPT TO:<invalid.five>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTinvalid.one%GT
+RCPT TO:%LTrecipient.two@example.com%GT
+RCPT TO:%LTinvalid.three%GT
+RCPT TO:%LTinvalid.four%GT
+RCPT TO:%LTinvalid.five%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
diff --git a/third-party/curl/tests/data/test3006 b/third-party/curl/tests/data/test3006
index 71ccb87fd1..c1583f6397 100644
--- a/third-party/curl/tests/data/test3006
+++ b/third-party/curl/tests/data/test3006
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,46 +6,51 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP with multiple invalid (all) --mail-rcpt and --mail-rcpt-allowfails
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
- <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt-allowfails --mail-rcpt invalid.one --mail-rcpt invalid.two --mail-rcpt invalid.three --mail-rcpt invalid.four --mail-rcpt invalid.five --mail-from sender@example.com -T -
+<command>
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER
+--mail-rcpt-allowfails
+--mail-rcpt invalid.one
+--mail-rcpt invalid.two
+--mail-rcpt invalid.three
+--mail-rcpt invalid.four
+--mail-rcpt invalid.five
+--mail-from sender@example.com
+-T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 55 - CURLE_SEND_ERROR
 <errorcode>
 55
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<invalid.one>
-RCPT TO:<invalid.two>
-RCPT TO:<invalid.three>
-RCPT TO:<invalid.four>
-RCPT TO:<invalid.five>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTinvalid.one%GT
+RCPT TO:%LTinvalid.two%GT
+RCPT TO:%LTinvalid.three%GT
+RCPT TO:%LTinvalid.four%GT
+RCPT TO:%LTinvalid.five%GT
 QUIT
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test3007 b/third-party/curl/tests/data/test3007
index f0007762e6..f1b36ff7d8 100644
--- a/third-party/curl/tests/data/test3007
+++ b/third-party/curl/tests/data/test3007
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,42 +6,43 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP with invalid --mail-rcpt and --mail-rcpt-allowfails
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
- <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt-allowfails --mail-rcpt invalid.one --mail-from sender@example.com -T -
+<command>
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER
+--mail-rcpt-allowfails
+--mail-rcpt invalid.one
+--mail-from sender@example.com
+-T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 55 - CURLE_SEND_ERROR
 <errorcode>
 55
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<invalid.one>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTinvalid.one%GT
 QUIT
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test3008 b/third-party/curl/tests/data/test3008
index 874b269566..4a65b37020 100644
--- a/third-party/curl/tests/data/test3008
+++ b/third-party/curl/tests/data/test3008
@@ -1,10 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 -O
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -23,7 +23,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -40,10 +39,9 @@ http://%HOSTIP:%HTTPPORT/this/is/the/%TESTNUMBER -O --output-dir %PWD/%LOGDIR
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /this/is/the/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test3009 b/third-party/curl/tests/data/test3009
index 0568da0510..395d7a20b7 100644
--- a/third-party/curl/tests/data/test3009
+++ b/third-party/curl/tests/data/test3009
@@ -1,10 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 -O
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -23,7 +23,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -40,10 +39,9 @@ http://%HOSTIP:%HTTPPORT/this/is/the/%TESTNUMBER -O --output-dir %PWD/not-there
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /this/is/the/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test301 b/third-party/curl/tests/data/test301
index fcbcb95ccd..56bcb48809 100644
--- a/third-party/curl/tests/data/test301
+++ b/third-party/curl/tests/data/test301
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP Basic auth
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -20,7 +20,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -29,21 +28,20 @@ SSL
 <server>
 https
 </server>
- <name>
+<name>
 HTTPS GET with user and password
- </name>
- <command>
--k -u fake:user https://%HOSTIP:%HTTPSPORT/%TESTNUMBER
+</name>
+<command>
+--insecure -u fake:user https://%HOSTIP:%HTTPSPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPSPORT
-Authorization: Basic ZmFrZTp1c2Vy
+Authorization: Basic %b64[fake:user]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test3010 b/third-party/curl/tests/data/test3010
index df5aadb4f2..f56ca1496c 100644
--- a/third-party/curl/tests/data/test3010
+++ b/third-party/curl/tests/data/test3010
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
diff --git a/third-party/curl/tests/data/test3011 b/third-party/curl/tests/data/test3011
index 8fd9f0e389..a8598453b4 100644
--- a/third-party/curl/tests/data/test3011
+++ b/third-party/curl/tests/data/test3011
@@ -1,10 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 -O
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -23,7 +23,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -40,10 +39,9 @@ http://%HOSTIP:%HTTPPORT/this/is/the/%TESTNUMBER -O --output-dir %PWD/%LOGDIR/tm
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /this/is/the/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test3012 b/third-party/curl/tests/data/test3012
index cf7e0679a7..c5eb29c6c1 100644
--- a/third-party/curl/tests/data/test3012
+++ b/third-party/curl/tests/data/test3012
@@ -1,12 +1,13 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 -O
 -J
 --output-dir
+--remote-time
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -26,7 +27,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -36,17 +36,16 @@ http
 http
 </features>
 <name>
---output-dir with -J
+--output-dir with -J and -R
 </name>
 <command option="no-output,no-include">
-http://%HOSTIP:%HTTPPORT/this/is/the/%TESTNUMBER -OJ --output-dir %PWD/%LOGDIR
+http://%HOSTIP:%HTTPPORT/this/is/the/%TESTNUMBER -OJR --output-dir %PWD/%LOGDIR
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /this/is/the/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test3013 b/third-party/curl/tests/data/test3013
index 47592b7c58..319593c903 100644
--- a/third-party/curl/tests/data/test3013
+++ b/third-party/curl/tests/data/test3013
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@
 --output-dir
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -26,7 +26,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -43,10 +42,9 @@ http://%HOSTIP:%HTTPPORT/this/is/the/%TESTNUMBER -O --output-dir %PWD/%LOGDIR ht
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /this/is/the/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test3014 b/third-party/curl/tests/data/test3014
index 4362002e71..c70977a53c 100644
--- a/third-party/curl/tests/data/test3014
+++ b/third-party/curl/tests/data/test3014
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -29,7 +30,7 @@ http
 Check if %{num_headers} returns correct number of headers
 </name>
 <command>
-http://%HOSTIP:%HTTPPORT/1439 --write-out '%{num_headers}'
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --write-out '%{num_headers}'
 </command>
 </client>
 
@@ -45,8 +46,8 @@ Content-Type: text/plain
 testdata
 4
 </stdout>
-<protocol>
-GET /1439 HTTP/1.1
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test3015 b/third-party/curl/tests/data/test3015
index 582eea4633..4732276a2c 100644
--- a/third-party/curl/tests/data/test3015
+++ b/third-party/curl/tests/data/test3015
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,10 +10,9 @@ chunked Transfer-Encoding
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 302 OK
 Date: Sun, 13 Sep 2020 15:00 GMT
 Content-Length: 8
@@ -23,41 +23,39 @@ Location: ./%TESTNUMBER0001
 monster
 </data>
 <data1 nocheck="yes">
-HTTP/1.1 200 OK
-Date: Sun, 13 Sep 2020 15:00 GMT
-Transfer-Encoding: chunked
-Connection: close
-Content-Type: text/plain; charset=us-ascii
-
-0007
-bigger 
-0008
+HTTP/1.1 200 OK%CR
+Date: Sun, 13 Sep 2020 15:00 GMT%CR
+Transfer-Encoding: chunked%CR
+Connection: close%CR
+Content-Type: text/plain; charset=us-ascii%CR
+%CR
+0007%CR
+bigger %CR
+0008%CR
 monster
-
-0
-
+%CR
+0%CR
+%CR
 </data1>
 
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET -w num_headers with redirected fetch (2 connects)
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w "%{num_headers}\n" -L -o/dev/null
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w "%{num_headers}\n" -L -o%DEV_NULL
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test3016 b/third-party/curl/tests/data/test3016
index d04633c7a1..c710e39762 100644
--- a/third-party/curl/tests/data/test3016
+++ b/third-party/curl/tests/data/test3016
@@ -1,31 +1,28 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
-HTTP
-HTTP GET
 FILE
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 file
 </server>
 <name>
-GET a directory using file://
+Get current directory using file://
 </name>
-<!-- doesn't work on win32, see #6379 -->
+<!-- does not work on win32, see #6379 -->
 <features>
 !win32
 </features>
 <command>
-file://%PWD/
+file://%FILE_PWD/
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test3017 b/third-party/curl/tests/data/test3017
index 4d907b39f0..5133c7b5a6 100644
--- a/third-party/curl/tests/data/test3017
+++ b/third-party/curl/tests/data/test3017
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,21 +7,16 @@ MQTT SUBSCRIBE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
 hello
 </data>
-<datacheck hex="yes">
-00 04 33 30 31 37   68 65 6c 6c 6f 5b 4c 46 5d 0a
-</datacheck>
 <servercmd>
 excessive-remaining TRUE
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -37,17 +33,15 @@ mqtt://%HOSTIP:%MQTTPORT/%TESTNUMBER -m 3
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # These are hexadecimal protocol dumps from the client
-#
 # Strip out the random part of the client id from the CONNECT message
 # before comparison
 <strippart>
 s/^(.* 00044d5154540402003c000c6375726c).*/$1/
 </strippart>
-# on windows the disconnect is never seen - no idea why
+# on Windows the disconnect is never seen - no idea why
 <strip>
 ^server DISCONNECT 0 e000
 </strip>
diff --git a/third-party/curl/tests/data/test3018 b/third-party/curl/tests/data/test3018
index 71e06b593c..8602a7be47 100644
--- a/third-party/curl/tests/data/test3018
+++ b/third-party/curl/tests/data/test3018
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,18 +8,13 @@ MQTT SUBSCRIBE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
 hello
 </data>
-<datacheck hex="yes">
-00 04 33 30 31 38   68 65 6c 6c 6f 5b 4c 46 5d 0a
-</datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -35,17 +31,15 @@ mqtt://%HOSTIP:%MQTTPORT/%TESTNUMBER --max-filesize 11
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # These are hexadecimal protocol dumps from the client
-#
 # Strip out the random part of the client id from the CONNECT message
 # before comparison
 <strippart>
 s/^(.* 00044d5154540402003c000c6375726c).*/$1/
 </strippart>
-# on windows the disconnect is never seen - no idea why
+# on Windows the disconnect is never seen - no idea why
 <strip>
 ^server DISCONNECT 0 e000
 </strip>
diff --git a/third-party/curl/tests/data/test3019 b/third-party/curl/tests/data/test3019
index 040327828b..a2ebbe4288 100644
--- a/third-party/curl/tests/data/test3019
+++ b/third-party/curl/tests/data/test3019
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,12 +8,10 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -26,7 +25,6 @@ HTTP with invalid --resolve syntax
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test302 b/third-party/curl/tests/data/test302
index 3bb3f77332..3c6eb09851 100644
--- a/third-party/curl/tests/data/test302
+++ b/third-party/curl/tests/data/test302
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,14 +6,13 @@ HTTPS
 HTTP GET
 HTTP CONNECT
 HTTP proxy
-FAILURE
 </keywords>
 </info>
 
 # Server-side
 <reply>
 
-<connect nocheck="yes">
+<connect crlf="headers" nocheck="yes">
 HTTP/1.1 405 Method Not Allowed swsclose
 
 And you should ignore this data.
@@ -29,19 +29,18 @@ proxy
 <server>
 https
 </server>
- <name>
+<name>
 HTTPS GET over HTTP proxy fails
- </name>
- <command>
--k -U fake:user -x %HOSTIP:%HTTPPORT https://bad.fakeurl-to.test:%TESTNUMBER/slash/%TESTNUMBER
+</name>
+<command>
+--insecure -U fake:user -x %HOSTIP:%HTTPPORT https://bad.fakeurl-to.test:%TESTNUMBER/slash/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
-56
+7
 </errorcode>
 <data>
 </data>
diff --git a/third-party/curl/tests/data/test3020 b/third-party/curl/tests/data/test3020
index 25bf6dd929..58107cd5c3 100644
--- a/third-party/curl/tests/data/test3020
+++ b/third-party/curl/tests/data/test3020
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,12 +8,10 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -26,7 +25,6 @@ HTTP with invalid --connect-to syntax
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test3021 b/third-party/curl/tests/data/test3021
index cc126773ee..1aa973a688 100644
--- a/third-party/curl/tests/data/test3021
+++ b/third-party/curl/tests/data/test3021
@@ -1,12 +1,13 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SFTP
-server sha256 key check
+server key check
+SHA256
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -14,21 +15,16 @@ test
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# so far only the libssh2 backend supports SHA256
-<features>
-libssh2
-</features>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP correct sha256 host key
- </name>
- <command>
---hostpubsha256 %SSHSRVSHA256 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt
+</name>
+<command>
+--hostpubsha256 %SSHSRVSHA256 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt
 </command>
 <setenv>
 # Needed for MSYS2 to not treat the argument as a POSIX path list
@@ -40,14 +36,10 @@ test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 0
 </errorcode>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test3022 b/third-party/curl/tests/data/test3022
index 45cdf87949..6d692a817e 100644
--- a/third-party/curl/tests/data/test3022
+++ b/third-party/curl/tests/data/test3022
@@ -1,12 +1,13 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SCP
-server sha256 key check
+server key check
+SHA256
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -14,21 +15,16 @@ test
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-# so far only the libssh2 backend supports SHA256
-<features>
-libssh2
-</features>
 <server>
 scp
 </server>
- <name>
+<name>
 SCP correct sha256 host key
- </name>
- <command>
---hostpubsha256 %SSHSRVSHA256 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: scp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt
+</name>
+<command>
+--hostpubsha256 %SSHSRVSHA256 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: scp://%HOSTIP:%SSHPORT%SCP_PWD/%LOGDIR/file%TESTNUMBER.txt
 </command>
 <setenv>
 # Needed for MSYS2 to not treat the argument as a POSIX path list
@@ -40,14 +36,10 @@ test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 0
 </errorcode>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test3023 b/third-party/curl/tests/data/test3023
index d0b5ee961f..e6ffc6a005 100644
--- a/third-party/curl/tests/data/test3023
+++ b/third-party/curl/tests/data/test3023
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ PEM certificate
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -20,36 +20,31 @@ MooMoo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 SSL
 Schannel
+local-http
 </features>
 <server>
-https Server-localhost-firstSAN-sv.pem
+https test-localhost-san-first.pem
 </server>
 <name>
-HTTPS GET to localhost, first subject alt name matches, CN does not match (Schannel variant)
+HTTPS localhost, first subaltname matches, CN does not match (Schannel)
 </name>
 <setenv>
-# This test is pointless if we're not using the schannel backend
+# This test is pointless if we are not using the Schannel backend
 CURL_SSL_BACKEND=schannel
 </setenv>
 <command>
---cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --ssl-revoke-best-effort https://localhost:%HTTPSPORT/%TESTNUMBER
+-4 --cacert %CERTDIR/certs/test-ca.crt --ssl-revoke-best-effort https://localhost:%HTTPSPORT/%TESTNUMBER
 </command>
-# Ensure that we're running on localhost because we're checking the host name
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: localhost:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test3024 b/third-party/curl/tests/data/test3024
index e91543dd47..07748df071 100644
--- a/third-party/curl/tests/data/test3024
+++ b/third-party/curl/tests/data/test3024
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ PEM certificate
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -20,36 +20,31 @@ MooMoo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 SSL
 Schannel
+local-http
 </features>
 <server>
-https Server-localhost-lastSAN-sv.pem
+https test-localhost-san-last.pem
 </server>
 <name>
-HTTPS GET to localhost, last subject alt name matches, CN does not match (Schannel variant)
+HTTPS localhost, last subaltname matches, CN does not match (Schannel)
 </name>
 <setenv>
-# This test is pointless if we're not using the schannel backend
+# This test is pointless if we are not using the Schannel backend
 CURL_SSL_BACKEND=schannel
 </setenv>
 <command>
---cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --ssl-revoke-best-effort https://localhost:%HTTPSPORT/%TESTNUMBER
+-4 --cacert %CERTDIR/certs/test-ca.crt --ssl-revoke-best-effort https://localhost:%HTTPSPORT/%TESTNUMBER
 </command>
-# Ensure that we're running on localhost because we're checking the host name
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: localhost:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test3025 b/third-party/curl/tests/data/test3025
index eaff47ce74..6b44017d62 100644
--- a/third-party/curl/tests/data/test3025
+++ b/third-party/curl/tests/data/test3025
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -17,15 +17,11 @@ MooMoo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
-<features>
-!hyper
-</features>
 <name>
 CURLOPT_HTTP200ALIASES
 </name>
@@ -37,7 +33,6 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test3026 b/third-party/curl/tests/data/test3026
index ee9b30678b..d9a636f223 100644
--- a/third-party/curl/tests/data/test3026
+++ b/third-party/curl/tests/data/test3026
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,12 +8,10 @@ slow
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 # require the threaded resolver only because it means pthreads might
@@ -21,21 +20,14 @@ slow
 threadsafe
 threaded-resolver
 </features>
-<server>
-none
-</server>
 <name>
 curl_global_init thread-safety
 </name>
 <tool>
 lib%TESTNUMBER
 </tool>
-<command>
-none
-</command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test3027 b/third-party/curl/tests/data/test3027
index 029491b8fd..d6a79cf7e9 100644
--- a/third-party/curl/tests/data/test3027
+++ b/third-party/curl/tests/data/test3027
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -24,9 +25,9 @@ data blobb
 <server>
 ftp
 </server>
- <name>
+<name>
 Get a file via FTP but 550 after MDTM command
- </name>
+</name>
 <tool>
 lib3027
 </tool>
@@ -40,7 +41,7 @@ data blobb
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test3028 b/third-party/curl/tests/data/test3028
index 06d7d098e1..dcdca50cf3 100644
--- a/third-party/curl/tests/data/test3028
+++ b/third-party/curl/tests/data/test3028
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ HTTP
 HTTP CONNECT
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <connect>
@@ -27,7 +27,6 @@ haha
 
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -45,14 +44,13 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
 s/^PROXY TCP4 %CLIENTIP %HOSTIP (\d*) %PROXYPORT/proxy-line/
 </strippart>
 
-<proxy>
+<proxy crlf="headers">
 CONNECT %HOSTIP:%HTTPPORT HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -60,7 +58,7 @@ Proxy-Connection: Keep-Alive
 
 </proxy>
 
-<protocol>
+<protocol crlf="yes">
 proxy-line
 GET /page HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
diff --git a/third-party/curl/tests/data/test3029 b/third-party/curl/tests/data/test3029
index 2e51bbeaf4..ce71125af4 100644
--- a/third-party/curl/tests/data/test3029
+++ b/third-party/curl/tests/data/test3029
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,7 +24,8 @@ http
 HTTP with multiple -D
 </name>
 <command>
--D %LOGDIR/heads%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER --next -D %LOGDIR/heads%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+-D %LOGDIR/heads%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER --next
+-D %LOGDIR/heads%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
@@ -36,4 +38,4 @@ Content-Length: 6
 </file>
 </verify>
 
-</testcase>
\ No newline at end of file
+</testcase>
diff --git a/third-party/curl/tests/data/test303 b/third-party/curl/tests/data/test303
index 72b8f45027..51dc471e61 100644
--- a/third-party/curl/tests/data/test303
+++ b/third-party/curl/tests/data/test303
@@ -1,16 +1,16 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTPS
 HTTP GET
 timeout
-FAILURE
 </keywords>
 </info>
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
@@ -33,17 +33,17 @@ https
 <killserver>
 https
 </killserver>
- <name>
+<name>
 HTTPS with 8 secs timeout
- </name>
- <command>
--k https://%HOSTIP:%HTTPSPORT/want/%TESTNUMBER -m 8
+</name>
+<command>
+--insecure https://%HOSTIP:%HTTPSPORT/want/%TESTNUMBER -m 8
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test3030 b/third-party/curl/tests/data/test3030
index 7e169cf43a..2048bfab47 100644
--- a/third-party/curl/tests/data/test3030
+++ b/third-party/curl/tests/data/test3030
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -40,4 +41,4 @@ Content-Length: 6
 </file>
 </verify>
 
-</testcase>
\ No newline at end of file
+</testcase>
diff --git a/third-party/curl/tests/data/test3031 b/third-party/curl/tests/data/test3031
new file mode 100644
index 0000000000..68ffb46691
--- /dev/null
+++ b/third-party/curl/tests/data/test3031
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+--dump-header
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+http
+</features>
+<name>
+--dump-header with --create-dirs
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/this/is/the/%TESTNUMBER --dump-header %PWD/%LOGDIR/tmp/out.txt --create-dirs
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /this/is/the/%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/tmp/out.txt" crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test3032 b/third-party/curl/tests/data/test3032
new file mode 100644
index 0000000000..cb6fa2108c
--- /dev/null
+++ b/third-party/curl/tests/data/test3032
@@ -0,0 +1,113 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--location
+</keywords>
+</info>
+
+# Server-side
+<reply>
+
+<data crlf="headers">
+HTTP/1.1 301 redirect swsbounce
+Content-Length: 0
+Location: http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+Part: data
+
+</data>
+
+<data1 crlf="headers">
+HTTP/1.1 301 redirect swsbounce
+Content-Length: 0
+Location: http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+Part: data1
+
+</data1>
+
+<data2 crlf="headers">
+HTTP/1.1 301 redirect swsbounce
+Content-Length: 0
+Location: http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+Part: data2
+
+</data2>
+
+<data3 crlf="headers">
+HTTP/1.1 200 OK
+Content-Type: text/html
+Content-Length: 30
+Part: data3
+
+XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+</data3>
+
+<datacheck crlf="headers">
+HTTP/1.1 301 redirect swsbounce
+Content-Length: 0
+Location: http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+Part: data
+
+HTTP/1.1 301 redirect swsbounce
+Content-Length: 0
+Location: http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+Part: data1
+
+HTTP/1.1 301 redirect swsbounce
+Content-Length: 0
+Location: http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+Part: data2
+
+HTTP/1.1 200 OK
+Content-Type: text/html
+Content-Length: 30
+Part: data3
+
+XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+</datacheck>
+
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+# This is a test of the swsbounce keyword which is used during tests to
+# override the data response number for the next request to the previous
+# data response number + 1. eg data, data1, data2 etc.
+<name>
+HTTP redirect loop 3x swsbounce test
+</name>
+<command>
+--location http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test3033 b/third-party/curl/tests/data/test3033
new file mode 100644
index 0000000000..d633b218e5
--- /dev/null
+++ b/third-party/curl/tests/data/test3033
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+curl_easy_setopt
+connection reuse
+libtest
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 OK
+Content-Length: 6
+
+-foo-
+</data>
+<datacheck>
+[0] no network change
+-foo-
+[1] signal network change
+-foo-
+[2] no network change
+-foo-
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+CURLOPT_FRESH_CONNECT=2
+</name>
+<tool>
+lib%TESTNUMBER
+</tool>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+0
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test3034 b/third-party/curl/tests/data/test3034
new file mode 100644
index 0000000000..5a30a9b559
--- /dev/null
+++ b/third-party/curl/tests/data/test3034
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+CURLOPT_READFUNCTION
+curl_easy_reset
+rewind
+</keywords>
+</info>
+
+# Server side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 307 Temporary Redirect OK swsclose
+Content-Length: 0
+Location: /%TESTNUMBER
+</data>
+</reply>
+
+# Client side
+<client>
+<server>
+http
+</server>
+<tool>
+lib%TESTNUMBER
+</tool>
+<name>
+Test reset resolves rewind failure
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+<verify>
+<errorcode>
+0
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test3035 b/third-party/curl/tests/data/test3035
new file mode 100644
index 0000000000..cfb211758b
--- /dev/null
+++ b/third-party/curl/tests/data/test3035
@@ -0,0 +1,118 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+Content-Range
+Resume
+retry
+</keywords>
+</info>
+
+# Server-side
+<reply>
+
+# the first chunk
+<data crlf="headers" nocheck="yes" nonewline="yes">
+HTTP/1.1 200 OK swsbounce swsclose
+Accept-Ranges: bytes
+Content-Type: text/html
+Content-Length: 26
+
+abcde
+</data>
+
+# the second chunk
+<data1 crlf="headers" nocheck="yes" nonewline="yes">
+HTTP/1.1 206 Partial Content swsbounce swsclose
+Content-Type: text/html
+Content-Length: 21
+Content-Range: bytes 5-25/26
+
+fghijk
+</data1>
+
+# some nonsense that curl should ignore as unresumable
+<data2 crlf="headers" nocheck="yes">
+HTTP/1.1 404 Not Found swsbounce
+Content-Type: text/html
+Content-Length: 5
+
+body
+</data2>
+
+# some more nonsense that curl should ignore as unresumable
+<data3 crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK swsbounce
+Accept-Ranges: bytes
+Content-Type: text/html
+Content-Length: 30
+
+XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+</data3>
+
+# the third chunk
+<data4 nocheck="yes" nonewline="yes">
+HTTP/1.1 206 Partial Content swsbounce swsclose
+Content-Type: text/html
+Content-Length: 15
+Content-Range: bytes 11-25/26
+
+lmnopqrstuvwxyz
+</data4>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP retry failed download with keep data and auto-resume
+</name>
+<command option="no-output,no-include">
+--continue-at - --retry 4 --retry-delay 1 --retry-all-errors -o %LOGDIR/outfile%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Range: bytes=5-
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Range: bytes=11-
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Range: bytes=11-
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Range: bytes=11-
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+
+<file1 name="%LOGDIR/outfile%TESTNUMBER" nonewline="yes">
+abcdefghijklmnopqrstuvwxyz
+</file1>
+
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test3036 b/third-party/curl/tests/data/test3036
new file mode 100644
index 0000000000..cac51c765f
--- /dev/null
+++ b/third-party/curl/tests/data/test3036
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+-O
+-J
+--output-dir
+--retry
+--no-clobber
+</keywords>
+</info>
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Disposition: inline; filename="MMM%TESTNUMBERMMM"
+Content-Type: text/html
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+http
+</features>
+<name>
+--no-clobber, --retry and --output-dir identifying a file
+</name>
+<command option="no-output">
+http://%HOSTIP:%HTTPPORT/ --no-clobber --output-dir %LOGDIR/present -OJ --retry 1 --retry-all-errors
+</command>
+<file name="%LOGDIR/present">
+present
+</file>
+</client>
+
+<verify>
+<protocol crlf="headers">
+GET / HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET / HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+# it fails because it cannot create the output file
+<errorcode>
+23
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test304 b/third-party/curl/tests/data/test304
index bd78db0cb2..b1bd44d43f 100644
--- a/third-party/curl/tests/data/test304
+++ b/third-party/curl/tests/data/test304
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,15 +28,15 @@ SSL
 <server>
 https
 </server>
- <name>
+<name>
 HTTPS multipart formpost
- </name>
- <command>
--k https://%HOSTIP:%HTTPSPORT/we/want/%TESTNUMBER -F name=daniel -F tool=curl -F file=@%LOGDIR/test%TESTNUMBER.txt
+</name>
+<command>
+--insecure https://%HOSTIP:%HTTPSPORT/we/want/%TESTNUMBER -F name=daniel -F tool=curl -F file=@%LOGDIR/test%TESTNUMBER.txt
 </command>
 # We create this file before the command is invoked!
 <file name="%LOGDIR/test%TESTNUMBER.txt">
-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+%repeat[1000 x a]%
 </file>
 </client>
 
@@ -45,28 +46,28 @@ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
 ^(Content-Type: multipart/form-data;|------).*
 </strip>
 <protocol>
-POST /we/want/%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPSPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Content-Length: 1386
-Content-Type: multipart/form-data; boundary=----------------------------c3b2ef7f0bb8
-
-------------------------------c3b2ef7f0bb8
-Content-Disposition: form-data; name="name"
-
-daniel
-------------------------------c3b2ef7f0bb8
-Content-Disposition: form-data; name="tool"
-
-curl
-------------------------------c3b2ef7f0bb8
-Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER.txt"
-Content-Type: text/plain
-
-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-
-------------------------------c3b2ef7f0bb8--
+POST /we/want/%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPSPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Content-Length: 1410%CR
+Content-Type: multipart/form-data; boundary=----------------------------qrstuvwxyz0123456789AB%CR
+%CR
+------------------------------qrstuvwxyz0123456789AB%CR
+Content-Disposition: form-data; name="name"%CR
+%CR
+daniel%CR
+------------------------------qrstuvwxyz0123456789AB%CR
+Content-Disposition: form-data; name="tool"%CR
+%CR
+curl%CR
+------------------------------qrstuvwxyz0123456789AB%CR
+Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER.txt"%CR
+Content-Type: text/plain%CR
+%CR
+%repeat[1000 x a]%
+%CR
+------------------------------qrstuvwxyz0123456789AB--%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test305 b/third-party/curl/tests/data/test305
index 4ca5789ed7..1acefe29be 100644
--- a/third-party/curl/tests/data/test305
+++ b/third-party/curl/tests/data/test305
@@ -1,9 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTPS
 HTTP GET
-FAILURE
 </keywords>
 </info>
 
@@ -15,18 +15,21 @@ SSL
 <server>
 https
 </server>
- <name>
+<name>
 insecure HTTPS without permission
- </name>
- <command>
-https://%HOSTIP:%HTTPSPORT/want/%TESTNUMBER --cacert moooo
+</name>
+<command>
+https://%HOSTIP:%HTTPSPORT/want/%TESTNUMBER --cacert "%LOGDIR/cacert" --no-ca-native
 </command>
+<file name="%LOGDIR/cacert">
+made up content
+</file>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
-77
+77,60
 </errorcode>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test306 b/third-party/curl/tests/data/test306
index 1c914742a8..b0974a77a3 100644
--- a/third-party/curl/tests/data/test306
+++ b/third-party/curl/tests/data/test306
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,11 +7,10 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
-No headers at all, just data swsclose
+No headers at all, data swsclose
 
 Let's get
 
@@ -32,28 +32,25 @@ verify
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 SSL
-!hyper
 </features>
 <server>
 https
 </server>
- <name>
+<name>
 HTTPS GET, receive no headers only data!
- </name>
- <command>
--k https://%HOSTIP:%HTTPSPORT/%TESTNUMBER --http0.9
+</name>
+<command>
+--insecure https://%HOSTIP:%HTTPSPORT/%TESTNUMBER --http0.9
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test307 b/third-party/curl/tests/data/test307
index fed3e1033a..27a72ba79c 100644
--- a/third-party/curl/tests/data/test307
+++ b/third-party/curl/tests/data/test307
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -19,7 +19,6 @@ MooMoo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -29,21 +28,20 @@ OpenSSL
 https
 </server>
 <precheck>
-perl %SRCDIR/libtest/test%TESTNUMBER.pl %CURL
+%PERL %SRCDIR/libtest/test%TESTNUMBER.pl %CURL
 </precheck>
 
- <name>
+<name>
 simple HTTPS GET with openssl engine
- </name>
- <command>
---engine openssl -k https://%HOSTIP:%HTTPSPORT/%TESTNUMBER
+</name>
+<command>
+--engine openssl --insecure https://%HOSTIP:%HTTPSPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test308 b/third-party/curl/tests/data/test308
index 7534ed6ba0..593976b4c2 100644
--- a/third-party/curl/tests/data/test308
+++ b/third-party/curl/tests/data/test308
@@ -1,13 +1,12 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTPS
 HTTP GET
-FAILURE
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <features>
@@ -17,15 +16,14 @@ OpenSSL
 <server>
 https
 </server>
- <name>
+<name>
 simple HTTPS GET with invalid crypto engine
- </name>
- <command>
---engine invalid-crypto-engine-xyzzy -k https://%HOSTIP:%HTTPSPORT/%TESTNUMBER
+</name>
+<command>
+--engine invalid-crypto-engine-xyzzy --insecure https://%HOSTIP:%HTTPSPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test309 b/third-party/curl/tests/data/test309
index 1c59e8bed5..df27a23c47 100644
--- a/third-party/curl/tests/data/test309
+++ b/third-party/curl/tests/data/test309
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ followlocation
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 301 This is a weirdo text message swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -20,7 +21,7 @@ Connection: close
 This server reply is for testing a simple Location: following to HTTPS URL
 
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 Followed here fine swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -29,7 +30,7 @@ Content-Length: 52
 If this is received, the location following worked
 
 </data2>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 301 This is a weirdo text message swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -55,17 +56,17 @@ SSL
 http
 https
 </server>
- <name>
+<name>
 HTTP Location: redirect to HTTPS URL
- </name>
- <command>
--k http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -L
+</name>
+<command>
+--insecure http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -L
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test31 b/third-party/curl/tests/data/test31
index 33ed8b96b6..c885b7c9fa 100644
--- a/third-party/curl/tests/data/test31
+++ b/third-party/curl/tests/data/test31
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,124 +6,73 @@ HTTP
 HTTP GET
 cookies
 cookiejar
+--resolve
 </keywords>
 </info>
 # Server-side
-#
-# The cookies set come in two versions. This is because when curl is built
-# with Hyper, the API provides the headers already "sanitized" so we cannot
-# compare with the exact server contents unless it too sends the data
-# "clean".
 
 <reply>
 <data>
-HTTP/1.1 200 OK
-Date: Tue, 09 Nov 2010 14:49:00 GMT
-Server: test-server/fake
-Content-Length: 4
-Content-Type: text/html
-Funny-head: yesyes
+HTTP/1.1 200 OK%CR
+Date: Tue, 09 Nov 2010 14:49:00 GMT%CR
+Server: test-server/fake%CR
+Content-Length: 4%CR
+Content-Type: text/html%CR
+Funny-head: yesyes%CR
+Set-Cookie:
+Set-Cookie: ;
 Set-Cookie: blankdomain=sure; domain=; path=/
-%if !hyper
-Set-Cookie: foobar=name; domain=anything.com; path=/ ; secure
-Set-Cookie:ismatch=this  ; domain=test31.curl; path=/silly/
-Set-Cookie: overwrite=this  ; domain=test31.curl; path=/overwrite/
-Set-Cookie: overwrite=this2  ; domain=test31.curl; path=/overwrite
-Set-Cookie: sec1value=secure1  ; domain=test31.curl; path=/secure1/ ; secure
-Set-Cookie: sec2value=secure2  ; domain=test31.curl; path=/secure2/ ; secure=
-Set-Cookie: sec3value=secure3  ; domain=test31.curl; path=/secure3/ ; secure=
-Set-Cookie: sec4value=secure4  ; secure=; domain=test31.curl; path=/secure4/ ; 
-Set-Cookie: sec5value=secure5  ; secure; domain=test31.curl; path=/secure5/ ; 
-Set-Cookie: sec6value=secure6  ; secure ; domain=test31.curl; path=/secure6/ ; 
-Set-Cookie: sec7value=secure7  ; secure   ; domain=test31.curl; path=/secure7/ ; 
-Set-Cookie: sec8value=secure8  ; secure= ; domain=test31.curl; path=/secure8/ ; 
-Set-Cookie: secure=very1  ; secure=; domain=test31.curl; path=/secure9/; 
-Set-Cookie: httpo1=value1  ; domain=test31.curl; path=/p1/; httponly
-Set-Cookie: httpo2=value2  ; domain=test31.curl; path=/p2/; httponly=
-Set-Cookie: httpo3=value3  ; httponly; domain=test31.curl; path=/p3/;
-Set-Cookie: httpo4=value4  ; httponly=; domain=test31.curl; path=/p4/; 
-Set-Cookie: httponly=myvalue1  ; domain=test31.curl; path=/p4/; httponly
-Set-Cookie: httpandsec=myvalue2  ; domain=test31.curl; path=/p4/; httponly; secure
-Set-Cookie: httpandsec2=myvalue3; domain=test31.curl; path=/p4/; httponly=; secure
-Set-Cookie: httpandsec3=myvalue4  ; domain=test31.curl; path=/p4/; httponly; secure=
-Set-Cookie: httpandsec4=myvalue5  ; domain=test31.curl; path=/p4/; httponly=; secure=
-Set-Cookie: httpandsec5=myvalue6  ; domain=test31.curl; path=/p4/; secure; httponly=
-Set-Cookie: httpandsec6=myvalue7  ; domain=test31.curl; path=/p4/; secure=; httponly=
-Set-Cookie: httpandsec7=myvalue8  ; domain=test31.curl; path=/p4/; secure; httponly
-Set-Cookie: httpandsec8=myvalue9; domain=test31.curl; path=/p4/; secure=; httponly
-Set-Cookie: partmatch=present; domain=test31.curl ; path=/;
-Set-Cookie:eat=this; domain=moo.foo.moo;
-Set-Cookie: eat=this-too; domain=.foo.moo;
-Set-Cookie: nodomainnovalue
+Set-Cookie: foobar=name; domain=anything.com; path=/ ; secure%CR
+Set-Cookie:ismatch=this  ; domain=test31.curl; path=/silly/%CR
+Set-Cookie:ISMATCH=this  ; domain=test31.curl; path=/silly/%CR
+Set-Cookie: overwrite=this  ; domain=test31.curl; path=/overwrite/%CR
+Set-Cookie: overwrite=this2  ; domain=test31.curl; path=/overwrite%CR
+Set-Cookie: sec1value=secure1  ; domain=test31.curl; path=/secure1/ ; secure%CR
+Set-Cookie: sec2value=secure2  ; domain=test31.curl; path=/secure2/ ; secure%CR
+Set-Cookie: sec3value=secure3  ; domain=test31.curl; path=/secure3/ ; secure%CR
+Set-Cookie: sec4value=secure4  ; secure; domain=test31.curl; path=/secure4/ ; %CR
+Set-Cookie: sec5value=secure5  ; secure; domain=test31.curl; path=/secure5/ ; %CR
+Set-Cookie: sec6value=secure6  ; secure ; domain=test31.curl; path=/secure6/ ; %CR
+Set-Cookie: sec7value=secure7  ; secure   ; domain=test31.curl; path=/secure7/ ; %CR
+Set-Cookie: sec8value=secure8  ; secure ; domain=test31.curl; path=/secure8/ ; %CR
+Set-Cookie: secure=very1  ; secure; domain=test31.curl; path=/secure9/; %CR
+Set-Cookie: httpo1=value1  ; domain=test31.curl; path=/p1/; httponly%CR
+Set-Cookie: httpo2=value2  ; domain=test31.curl; path=/p2/; httponly%CR
+Set-Cookie: httpo3=value3  ; httponly; domain=test31.curl; path=/p3/;%CR
+Set-Cookie: httpo4=value4  ; httponly; domain=test31.curl; path=/p4/; %CR
+Set-Cookie: httponly=myvalue1  ; domain=test31.curl; path=/p4/; httponly%CR
+Set-Cookie: httpandsec=myvalue2  ; domain=test31.curl; path=/p4/; httponly; secure%CR
+Set-Cookie: httpandsec2=myvalue3; domain=test31.curl; path=/p4/; httponly; secure%CR
+Set-Cookie: httpandsec3=myvalue4  ; domain=test31.curl; path=/p4/; httponly; secure%CR
+Set-Cookie: httpandsec4=myvalue5  ; domain=test31.curl; path=/p4/; httponly; secure%CR
+Set-Cookie: httpandsec5=myvalue6  ; domain=test31.curl; path=/p4/; secure; httponly%CR
+Set-Cookie: httpandsec6=myvalue7  ; domain=test31.curl; path=/p4/; secure; httponly%CR
+Set-Cookie: httpandsec7=myvalue8  ; domain=test31.curl; path=/p4/; secure; httponly%CR
+Set-Cookie: httpandsec8=myvalue9; domain=test31.curl; path=/p4/; secure; httponly%CR
+Set-Cookie: partmatch=present; domain=test31.curl ; path=/;%CR
+Set-Cookie:eat=this; domain=moo.foo.moo;%CR
+Set-Cookie: eat=this-too; domain=.foo.moo;%CR
+Set-Cookie: nodomainnovalue%CR
 %if large-time
-Set-Cookie:   nodomain=value; expires=Fri Feb 13 11:56:27 GMT 2525
-Set-Cookie: novalue; domain=reallysilly
-Set-Cookie: test=yes; domain=foo.com; expires=Sat Feb 2 11:56:27 GMT 2525
-Set-Cookie: test2=yes; domain=se; expires=Sat Feb 2 11:56:27 GMT 2525
+Set-Cookie:   nodomain=value; expires=Fri Feb 13 11:56:27 GMT 2525%CR
+Set-Cookie: novalue; domain=reallysilly%CR
+Set-Cookie: test=yes; domain=foo.com; expires=Sat Feb 2 11:56:27 GMT 2525%CR
+Set-Cookie: test2=yes; domain=se; expires=Sat Feb 2 11:56:27 GMT 2525%CR
 %else
-Set-Cookie:   nodomain=value; expires=Fri Feb 13 11:56:27 GMT 2037
-Set-Cookie: novalue; domain=reallysilly
-Set-Cookie: test=yes; domain=foo.com; expires=Sat Feb 2 11:56:27 GMT 2030
-Set-Cookie: test2=yes; domain=se; expires=Sat Feb 2 11:56:27 GMT 2030
+Set-Cookie:   nodomain=value; expires=Fri Feb 13 11:56:27 GMT 2037%CR
+Set-Cookie: novalue; domain=reallysilly%CR
+Set-Cookie: test=yes; domain=foo.com; expires=Sat Feb 2 11:56:27 GMT 2030%CR
+Set-Cookie: test2=yes; domain=se; expires=Sat Feb 2 11:56:27 GMT 2030%CR
 %endif
-Set-Cookie: magic=yessir; path=/silly/; HttpOnly
-Set-Cookie: blexp=yesyes; domain=test31.curl; domain=test31.curl; expiry=totally bad;
-Set-Cookie: partialip=nono; domain=.0.0.1;
-Set-Cookie: withspaces=  yes  within and around    ;
-Set-Cookie: withspaces2 =before equals;
-Set-Cookie: prespace=  yes before;
-Set-Cookie: securewithspace=after    ; secure =
-%else
-Set-Cookie: foobar=name; domain=anything.com; path=/ ; secure
-Set-Cookie: ismatch=this  ; domain=test31.curl; path=/silly/
-Set-Cookie: overwrite=this  ; domain=test31.curl; path=/overwrite/
-Set-Cookie: overwrite=this2  ; domain=test31.curl; path=/overwrite
-Set-Cookie: sec1value=secure1  ; domain=test31.curl; path=/secure1/ ; secure
-Set-Cookie: sec2value=secure2  ; domain=test31.curl; path=/secure2/ ; secure=
-Set-Cookie: sec3value=secure3  ; domain=test31.curl; path=/secure3/ ; secure=
-Set-Cookie: sec4value=secure4  ; secure=; domain=test31.curl; path=/secure4/ ;
-Set-Cookie: sec5value=secure5  ; secure; domain=test31.curl; path=/secure5/ ;
-Set-Cookie: sec6value=secure6  ; secure ; domain=test31.curl; path=/secure6/ ;
-Set-Cookie: sec7value=secure7  ; secure   ; domain=test31.curl; path=/secure7/ ;
-Set-Cookie: sec8value=secure8  ; secure= ; domain=test31.curl; path=/secure8/ ;
-Set-Cookie: secure=very1  ; secure=; domain=test31.curl; path=/secure9/;
-Set-Cookie: httpo1=value1  ; domain=test31.curl; path=/p1/; httponly
-Set-Cookie: httpo2=value2  ; domain=test31.curl; path=/p2/; httponly=
-Set-Cookie: httpo3=value3  ; httponly; domain=test31.curl; path=/p3/;
-Set-Cookie: httpo4=value4  ; httponly=; domain=test31.curl; path=/p4/;
-Set-Cookie: httponly=myvalue1  ; domain=test31.curl; path=/p4/; httponly
-Set-Cookie: httpandsec=myvalue2  ; domain=test31.curl; path=/p4/; httponly; secure
-Set-Cookie: httpandsec2=myvalue3; domain=test31.curl; path=/p4/; httponly=; secure
-Set-Cookie: httpandsec3=myvalue4  ; domain=test31.curl; path=/p4/; httponly; secure=
-Set-Cookie: httpandsec4=myvalue5  ; domain=test31.curl; path=/p4/; httponly=; secure=
-Set-Cookie: httpandsec5=myvalue6  ; domain=test31.curl; path=/p4/; secure; httponly=
-Set-Cookie: httpandsec6=myvalue7  ; domain=test31.curl; path=/p4/; secure=; httponly=
-Set-Cookie: httpandsec7=myvalue8  ; domain=test31.curl; path=/p4/; secure; httponly
-Set-Cookie: httpandsec8=myvalue9; domain=test31.curl; path=/p4/; secure=; httponly
-Set-Cookie: partmatch=present; domain=test31.curl ; path=/;
-Set-Cookie: eat=this; domain=moo.foo.moo;
-Set-Cookie: eat=this-too; domain=.foo.moo;
-Set-Cookie: nodomainnovalue
-%if large-time
-Set-Cookie: nodomain=value; expires=Fri Feb 13 11:56:27 GMT 2525
-Set-Cookie: novalue; domain=reallysilly
-Set-Cookie: test=yes; domain=foo.com; expires=Sat Feb 2 11:56:27 GMT 2525
-Set-Cookie: test2=yes; domain=se; expires=Sat Feb 2 11:56:27 GMT 2525
-%else
-Set-Cookie: nodomain=value; expires=Fri Feb 13 11:56:27 GMT 2037
-Set-Cookie: novalue; domain=reallysilly
-Set-Cookie: test=yes; domain=foo.com; expires=Sat Feb 2 11:56:27 GMT 2030
-Set-Cookie: test2=yes; domain=se; expires=Sat Feb 2 11:56:27 GMT 2030
-%endif
-Set-Cookie: magic=yessir; path=/silly/; HttpOnly
-Set-Cookie: blexp=yesyes; domain=test31.curl; domain=test31.curl; expiry=totally bad;
-Set-Cookie: partialip=nono; domain=.0.0.1;
-Set-Cookie: withspaces=  yes  within and around    ;
-Set-Cookie: withspaces2 =before equals;
-Set-Cookie: prespace=  yes before;
-Set-Cookie: securewithspace=after    ; secure =
-%endif
-
+Set-Cookie: magic=yessir; path=/silly/; HttpOnly%CR
+Set-Cookie: blexp=yesyes; domain=test31.curl; domain=test31.curl; expiry=totally bad;%CR
+Set-Cookie: partialip=nono; domain=.0.0.1;%CR
+Set-Cookie: withspaces=  yes  within and around    ;%CR
+Set-Cookie: withspaces2 =before equals;%CR
+Set-Cookie: prespace=  yes before;%CR
+Set-Cookie: securewithspace=after    ; secure %CR
+Set-Cookie: %hex[%c3%82%c2%b3%c3%83%5c%78%39%32%c3%83%5c%78%39%61%c3%83%5c%78%38%64%c3%83%5c%78%39%37]hex%=%96%A6g%9Ay%B0%A5g%A7tm%7C%95%9A
+%CR
 boo
 </data>
 </reply>
@@ -132,29 +82,27 @@ boo
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with weirdly formatted cookies and cookiejar storage
- </name>
+</name>
 # Explicitly set the time zone to a known good one, in case the user is
 # using one of the 'right' zones that take into account leap seconds
 # which causes the cookie expiry times to be different.
 <setenv>
 TZ=GMT
 </setenv>
- <command>
+<command>
 http://test31.curl:%HTTPPORT/we/want/%TESTNUMBER -b none -c %LOGDIR/jar%TESTNUMBER.txt --resolve test31.curl:%HTTPPORT:127.0.0.1
 </command>
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 <features>
 cookies
+local-http
 </features>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/%TESTNUMBER HTTP/1.1
 Host: test31.curl:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -166,24 +114,22 @@ Accept: */*
 # https://curl.se/docs/http-cookies.html
 # This file was generated by libcurl! Edit at your own risk.
 
-test31.curl	FALSE	/we/want/	FALSE	0	prespace	yes before
-test31.curl	FALSE	/we/want/	FALSE	0	withspaces2	before equals
-test31.curl	FALSE	/we/want/	FALSE	0	withspaces	yes  within and around
-.test31.curl	TRUE	/we/want/	FALSE	0	blexp	yesyes
-#HttpOnly_test31.curl	FALSE	/silly/	FALSE	0	magic	yessir
-%if large-time
-test31.curl	FALSE	/we/want/	FALSE	17517902187	nodomain	value
-%else
-test31.curl	FALSE	/we/want/	FALSE	2118138987	nodomain	value
-%endif
+test31.curl	FALSE	/we/want	FALSE	0	%hex[%c3%82%c2%b3%c3%83%5c%78%39%32%c3%83%5c%78%39%61%c3%83%5c%78%38%64%c3%83%5c%78%39%37]hex%	%96%A6g%9Ay%B0%A5g%A7tm%7C%95%9A
+test31.curl	FALSE	/we/want	FALSE	0	prespace	yes before
+test31.curl	FALSE	/we/want	FALSE	0	withspaces2	before equals
+test31.curl	FALSE	/we/want	FALSE	0	withspaces	yes  within and around
+.test31.curl	TRUE	/we/want	FALSE	0	blexp	yesyes
+#HttpOnly_test31.curl	FALSE	/silly	FALSE	0	magic	yessir
+test31.curl	FALSE	/we/want	FALSE	%days[400]	nodomain	value
 .test31.curl	TRUE	/	FALSE	0	partmatch	present
-#HttpOnly_.test31.curl	TRUE	/p4/	FALSE	0	httponly	myvalue1
-#HttpOnly_.test31.curl	TRUE	/p4/	FALSE	0	httpo4	value4
-#HttpOnly_.test31.curl	TRUE	/p3/	FALSE	0	httpo3	value3
-#HttpOnly_.test31.curl	TRUE	/p2/	FALSE	0	httpo2	value2
-#HttpOnly_.test31.curl	TRUE	/p1/	FALSE	0	httpo1	value1
+#HttpOnly_.test31.curl	TRUE	/p4	FALSE	0	httponly	myvalue1
+#HttpOnly_.test31.curl	TRUE	/p4	FALSE	0	httpo4	value4
+#HttpOnly_.test31.curl	TRUE	/p3	FALSE	0	httpo3	value3
+#HttpOnly_.test31.curl	TRUE	/p2	FALSE	0	httpo2	value2
+#HttpOnly_.test31.curl	TRUE	/p1	FALSE	0	httpo1	value1
 .test31.curl	TRUE	/overwrite	FALSE	0	overwrite	this2
-.test31.curl	TRUE	/silly/	FALSE	0	ismatch	this
+.test31.curl	TRUE	/silly	FALSE	0	ISMATCH	this
+.test31.curl	TRUE	/silly	FALSE	0	ismatch	this
 test31.curl	FALSE	/	FALSE	0	blankdomain	sure
 </file>
 </verify>
diff --git a/third-party/curl/tests/data/test310 b/third-party/curl/tests/data/test310
index 3ea1fb4abf..12a12a4f15 100644
--- a/third-party/curl/tests/data/test310
+++ b/third-party/curl/tests/data/test310
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ PEM certificate
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -20,32 +20,27 @@ MooMoo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 SSL
 !Schannel
+local-http
 </features>
 <server>
-https Server-localhost-sv.pem
+https test-localhost.pem
 </server>
- <name>
-simple HTTPS GET
- </name>
- <command>
---cacert %SRCDIR/certs/EdelCurlRoot-ca.crt https://localhost:%HTTPSPORT/%TESTNUMBER
+<name>
+HTTPS GET with specified CA cert bundle
+</name>
+<command>
+-4 --cacert %CERTDIR/certs/test-ca.crt https://localhost:%HTTPSPORT/%TESTNUMBER
 </command>
-# Ensure that we're running on localhost because we're checking the host name
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: localhost:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test3100 b/third-party/curl/tests/data/test3100
index f8e2ecede4..9afd587306 100644
--- a/third-party/curl/tests/data/test3100
+++ b/third-party/curl/tests/data/test3100
@@ -1,6 +1,5 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
-
-#Informational
 <info>
 <keywords>
 RTSP
@@ -10,14 +9,14 @@ RTSP Basic auth
 
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 RTSP/1.0 401 Unauthorized please swsbounce
 Server: RTSPD/libcurl-test
 CSeq: 1
 WWW-Authenticate: Basic realm="please-auth-me"
 
 </data>
-<data1>
+<data1 crlf="yes">
 RTSP/1.0 200 OK
 Server: RTSPD/libcurl-test
 CSeq: 2
@@ -30,7 +29,7 @@ s=rtspd SDP
 i=A fake SDP reply
 u=http://www.curl.example.com/fakesdp.ps
 </data1>
-<datacheck>
+<datacheck crlf="yes">
 RTSP/1.0 401 Unauthorized please swsbounce
 Server: RTSPD/libcurl-test
 CSeq: 1
@@ -69,7 +68,7 @@ rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 DESCRIBE rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER RTSP/1.0
 CSeq: 1
 Accept: application/sdp
@@ -77,7 +76,7 @@ Accept: application/sdp
 DESCRIBE rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER RTSP/1.0
 CSeq: 2
 Accept: application/sdp
-Authorization: Basic dXNlcjpwYXNzd29yZA==
+Authorization: Basic %b64[user:pass]b64%d29yZA==
 
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test3101 b/third-party/curl/tests/data/test3101
index b163e55563..bb385fe61a 100644
--- a/third-party/curl/tests/data/test3101
+++ b/third-party/curl/tests/data/test3101
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP Basic auth
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsbounce
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -21,7 +22,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 200 OK
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -31,7 +32,7 @@ Connection: close
 This IS the real page!
 </data1>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsbounce
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -72,14 +73,14 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
 
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dXNlcjpwYXNzd29yZA==
+Authorization: Basic %b64[user:pass]b64%d29yZA==
 Accept: */*
 
 </protocol>
diff --git a/third-party/curl/tests/data/test3102 b/third-party/curl/tests/data/test3102
index cfe3c45df2..c66098cfbb 100644
--- a/third-party/curl/tests/data/test3102
+++ b/third-party/curl/tests/data/test3102
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,22 +7,17 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 # SSL with libraries supporting CURLOPT_CERTINFO
 <features>
 SSL
-!bearssl
-!mbedtls
-!rustls
 !wolfssl
 </features>
 <server>
@@ -30,18 +26,17 @@ https
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 verify certificate chain order with simple HTTPS GET
- </name>
- <command>
+</name>
+<command>
 https://%HOSTIP:%HTTPSPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPSPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test3103 b/third-party/curl/tests/data/test3103
new file mode 100644
index 0000000000..40179a6fb8
--- /dev/null
+++ b/third-party/curl/tests/data/test3103
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+cookies
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+cookies
+proxy
+</features>
+<server>
+http
+</server>
+<tool>
+lib%TESTNUMBER
+</tool>
+<name>
+CURLOPT_COOKIELIST without expiry
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://localhost/ HTTP/1.1
+Host: localhost
+Accept: */*
+Proxy-Connection: Keep-Alive
+Cookie: c1=v1
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test3104 b/third-party/curl/tests/data/test3104
new file mode 100644
index 0000000000..42271d54bd
--- /dev/null
+++ b/third-party/curl/tests/data/test3104
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+cookies
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+cookies
+proxy
+</features>
+<server>
+http
+</server>
+<tool>
+lib%TESTNUMBER
+</tool>
+<name>
+CURLOPT_COOKIELIST with Netscape format
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://example.com/ HTTP/1.1
+Host: example.com
+Accept: */*
+Proxy-Connection: Keep-Alive
+Cookie: name=value
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test3105 b/third-party/curl/tests/data/test3105
new file mode 100644
index 0000000000..a85a89b597
--- /dev/null
+++ b/third-party/curl/tests/data/test3105
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+curl_multi_remove_handle
+</keywords>
+</info>
+
+# Client-side
+<client>
+<tool>
+lib%TESTNUMBER
+</tool>
+<name>
+curl_multi_remove_handle twice
+</name>
+<command>
+-
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test3106 b/third-party/curl/tests/data/test3106
new file mode 100644
index 0000000000..971107e0fa
--- /dev/null
+++ b/third-party/curl/tests/data/test3106
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTPS
+HTTP proxy
+HTTP Basic auth
+followlocation
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<connect crlf="headers">
+HTTP/1.1 200 OK
+
+</connect>
+
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 302 Found
+Location: http://example.com:%HTTPSPORT/%TESTNUMBER0002
+Content-Length: 0
+
+</data>
+
+<data2 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 2
+
+OK
+</data2>
+</reply>
+
+# Client-side
+<client>
+<features>
+SSL
+proxy
+</features>
+<server>
+https
+http-proxy
+</server>
+<name>
+HTTPS to HTTP redirect on same host and port without auth
+</name>
+<command>
+--insecure --location --user user:secret --proxy %HOSTIP:%PROXYPORT https://example.com:%HTTPSPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<proxy crlf="headers">
+CONNECT example.com:%HTTPSPORT HTTP/1.1
+Host: example.com:%HTTPSPORT
+User-Agent: curl/%VERSION
+Proxy-Connection: Keep-Alive
+
+GET http://example.com:%HTTPSPORT/%TESTNUMBER0002 HTTP/1.1
+Host: example.com:%HTTPSPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</proxy>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: example.com:%HTTPSPORT
+Authorization: Basic %b64[user:secret]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test311 b/third-party/curl/tests/data/test311
index 0e05b63c0f..292aa4d859 100644
--- a/third-party/curl/tests/data/test311
+++ b/third-party/curl/tests/data/test311
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,33 +8,27 @@ PEM certificate
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 SSL
+local-http
 </features>
 <server>
-https Server-localhost0h-sv.pem
+https test-localhost0h.pem
 </server>
- <name>
+<name>
 HTTPS wrong subjectAltName but right CN
- </name>
- <command>
---cacert %SRCDIR/certs/EdelCurlRoot-ca.crt https://localhost:%HTTPSPORT/%TESTNUMBER
+</name>
+<command>
+-4 --cacert %CERTDIR/certs/test-ca.crt https://localhost:%HTTPSPORT/%TESTNUMBER
 </command>
-# Ensure that we're running on localhost because we're checking the host name
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test312 b/third-party/curl/tests/data/test312
index f013a7cfd1..0552138b69 100644
--- a/third-party/curl/tests/data/test312
+++ b/third-party/curl/tests/data/test312
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,33 +8,27 @@ PEM certificate
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 SSL
+local-http
 </features>
 <server>
-https Server-localhost.nn-sv.pem
+https test-localhost.nn.pem
 </server>
- <name>
+<name>
 HTTPS GET to localhost and null-prefixed CN cert
- </name>
- <command>
---cacert %SRCDIR/certs/EdelCurlRoot-ca.crt https://localhost:%HTTPSPORT/%TESTNUMBER
+</name>
+<command>
+-4 --cacert %CERTDIR/certs/test-ca.crt https://localhost:%HTTPSPORT/%TESTNUMBER
 </command>
-# Ensure that we're running on localhost because we're checking the host name
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test313 b/third-party/curl/tests/data/test313
index d87a464919..1807301352 100644
--- a/third-party/curl/tests/data/test313
+++ b/third-party/curl/tests/data/test313
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,28 +9,25 @@ CRL
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <features>
 SSL
+local-http
+!Schannel
+!wolfssl
 </features>
 <server>
-https Server-localhost-sv.pem
+https test-localhost.pem
 </server>
- <name>
+<name>
 CRL test
- </name>
- <command>
---cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --crlfile %SRCDIR/certs/Server-localhost-sv.crl https://localhost:%HTTPSPORT/%TESTNUMBER
+</name>
+<command>
+-4 --cacert %CERTDIR/certs/test-ca.crt --crlfile %CERTDIR/certs/test-localhost.crl https://localhost:%HTTPSPORT/%TESTNUMBER
 </command>
-# Ensure that we're running on localhost because we're checking the host name
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test314 b/third-party/curl/tests/data/test314
index d5fdc7016c..477afcdd5b 100644
--- a/third-party/curl/tests/data/test314
+++ b/third-party/curl/tests/data/test314
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,37 +7,9 @@ HTTP GET
 compressed
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBNb24sIDI5IE5vdiAyMDA0IDIxOjU2OjUzIEdNVA0KU2Vy
-dmVyOiBBcGFjaGUvMS4zLjMxIChEZWJpYW4gR05VL0xpbnV4KSBtb2RfZ3ppcC8xLjMuMjYuMWEg
-UEhQLzQuMy45LTEgbW9kX3NzbC8yLjguMjAgT3BlblNTTC8wLjkuN2QgbW9kX3BlcmwvMS4yOQ0K
-VmFyeTogQWNjZXB0LUVuY29kaW5nDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1J
-U08tODg1OS0xDQpDb250ZW50LUVuY29kaW5nOiBicg0KQ29udGVudC1MZW5ndGg6IDEwNTYNCg0K
-G7ATAJwFdhtdgaQ8i+mZBoO/lwogPKuqHpeP38jV5TDITTB7/oJVCS69FFDKWDVtMk8y4SfMSu/a
-9vvLxWPweDCKePH/2y9VIkbF+EgCYSNs9v53J8QTIHT4ZucHCCRQiXRdT6XdE60KSlbIvobr5rJQ
-sRn7ipIjMVMq3Go+/UXtY2d0yP1qaaGSxCn8nZuUNGh74KOI7EEkgFl1tjYytkpc9mJJy9J+wTTI
-+HroUQP2VR2DYkNoUECqgtOLlGcVEln4+eVzEWcrb8fNrcrVxLArJBpSd8FX8eZs8ebJUO7aBZ5e
-pHz6zel7lhLlfHoQIkGh34riaSVr7VTGDmmO6HjSCzKO27LybZ9I3CtMSD2Il4mB131Tlcbut1Bd
-zL4XU4DZYMLBN4jwVZEoHpjzHX+vQ3prnrNw4oB7OWOr/fBzjvfjDuO24WxwzPqPo+V6VNcthz1p
-fF1+sMK4yWY7He33m32EuQgQFSZ3a5Wu4FyQcAb45Z+wUxM5XCmX52YmdUR2YTs+W+bNw2EZSfMR
-cP3CinyJI/cTT+JubL3T4COkhz0Rffeoh/3E4c/6ugma1ubhokYecXp8HBwmeDL48d62H26u69DO
-yMhg1PFj+oVDWnK4K+L5AlRr0mpJLqoGHrzflMLQ6qL2oIo9hN6qCeZEEqXM+/KunVYpWVeTY+ht
-hA0y5p5RLLTTS4cehaJOpbFyAVxZOardIkJAVx0NshOZY4hDbts9BXsXzFEOgsFhrIQYgh04StZz
-llIRMVDptYlwGmpZCHHmVECdGiFIfEhkQ2INSwMCuuKpaycgSOO9hJA9UFKDBdzTiLJBP9oUVkKL
-bHjwicICCi3k0HcppcvQaW27AMI06kuQU4WUGizgnkaUDcZqCgsotMgG528UFlBo8SFpb05OAjJq
-2gEI0UgN93KS1OvAOYSLN5IaLOCeRnQpJXuLUwcm7urpg6lYxAk26uEoADdsRytHGkSWjOKP6T07
-wiceuNo7CXyu7ohtUZXoEWawRHGVkPDVJYqH+xa0DDRKSSgM4K3efLVPSTaUPvBGIZgnn2JBFFWa
-MsKZguUuUnz6qaSGqnmGAYiupdC1EFye58V4CLbWVjJU4NF2jrOUYR/Dv04zYwVQtQcFzgmK6H4N
-HAhmb0a6pQRKxZaZ+x2vCC7sCuIu4dNCATwqzk12ue6oEsxzYybLPNGJd084M43O9W8E+5/drd/F
-QVB2X4jlFlCuHuWeQxQo+w73Tb9swW692v3BlfQTP1ClWzuJ+RwuSb9m4V3QVa4MEL+0Xzc5FX9P
-+YX1cgaL+6oMHw7L+IOjOt+n1BOloyqk35lLHX7RZmu8SckMnGP95XjWc4FRKP9x/iXrKaeCnut/
-zstyZdJS5FRmBT/wb5KK9YWBGnqPLO8isN2HS8gA
-</data>
-
-<datacheck>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Mon, 29 Nov 2004 21:56:53 GMT
 Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
@@ -45,123 +18,28 @@ Content-Type: text/html; charset=ISO-8859-1
 Content-Encoding: br
 Content-Length: 1056
 
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE project-listing SYSTEM "http://freshmeat.net/backend/fm-projects-0.4.dtd">
-<project-listing>
-  <project>
-    <project_id>1612</project_id>
-    <date_added>1998-08-21 04:01:29</date_added>
-    <date_updated>2004-10-18 02:22:23</date_updated>
-    <projectname_short>curl</projectname_short>
-    <projectname_full>curl and libcurl</projectname_full>
-    <desc_short>Command line tool and library for client-side URL transfers.</desc_short>
-    <desc_full>curl and libcurl is a tool for transferring files
-using URL syntax. It supports HTTP, HTTPS, FTP,
-FTPS, DICT, TELNET, LDAP, FILE, and GOPHER, as
-well as HTTP-post, HTTP-put, cookies, FTP upload,
-resumed transfers, passwords, portnumbers, SSL
-certificates, Kerberos, and proxies. It is powered
-by libcurl, the client-side URL transfer library.
-There are bindings to libcurl for over 20
-languages and environments.
-</desc_full>
-    <vitality_score>5784.57</vitality_score>
-    <vitality_percent>3.16</vitality_percent>
-    <vitality_rank>169</vitality_rank>
-    <popularity_score>6594.54</popularity_score>
-    <popularity_percent>13.81</popularity_percent>
-    <popularity_rank>105</popularity_rank>
-    <rating>8.50</rating>
-    <rating_count>21</rating_count>
-    <rating_rank>183</rating_rank>
-    <subscriptions>323</subscriptions>
-    <branch_name>Default</branch_name>
-    <url_project_page>http://freshmeat.net/projects/curl/</url_project_page>
-    <url_homepage>http://freshmeat.net/redir/curl/1612/url_homepage/</url_homepage>
-    <url_tgz>http://freshmeat.net/redir/curl/1612/url_tgz/</url_tgz>
-    <url_bz2>http://freshmeat.net/redir/curl/1612/url_bz2/</url_bz2>
-    <url_zip>http://freshmeat.net/redir/curl/1612/url_zip/</url_zip>
-    <url_changelog>http://freshmeat.net/redir/curl/1612/url_changelog/</url_changelog>
-    <url_rpm>http://freshmeat.net/redir/curl/1612/url_rpm/</url_rpm>
-    <url_deb>http://freshmeat.net/redir/curl/1612/url_deb/</url_deb>
-    <url_osx>http://freshmeat.net/redir/curl/1612/url_osx/</url_osx>
-    <url_bsdport>http://freshmeat.net/redir/curl/1612/url_bsdport/</url_bsdport>
-    <url_purchase></url_purchase>
-    <url_cvs>http://freshmeat.net/redir/curl/1612/url_cvs/</url_cvs>
-    <url_list>http://freshmeat.net/redir/curl/1612/url_list/</url_list>
-    <url_mirror>http://freshmeat.net/redir/curl/1612/url_mirror/</url_mirror>
-    <url_demo></url_demo>
-    <license>MIT/X Consortium License</license>
-    <latest_release>
-      <latest_release_version>7.12.2</latest_release_version>
-      <latest_release_id>176085</latest_release_id>
-      <latest_release_date>2004-10-18 02:22:23</latest_release_date>
-    </latest_release>
-    <screenshot_thumb></screenshot_thumb>
-    <authors>
-      <author>
-        <author_name>Daniel Stenberg</author_name>
-        <author_url>http://freshmeat.net/~bagder/</author_url>
-        <author_role>Owner</author_role>
-      </author>
-    </authors>
-    <descriminators>
-      <trove_id>12</trove_id>
-      <trove_id>226</trove_id>
-      <trove_id>3</trove_id>
-      <trove_id>2</trove_id>
-      <trove_id>188</trove_id>
-      <trove_id>216</trove_id>
-      <trove_id>200</trove_id>
-      <trove_id>220</trove_id>
-      <trove_id>164</trove_id>
-      <trove_id>90</trove_id>
-      <trove_id>89</trove_id>
-      <trove_id>809</trove_id>
-      <trove_id>150</trove_id>
-      <trove_id>224</trove_id>
-      <trove_id>900</trove_id>
-      <trove_id>839</trove_id>
-    </descriminators>
-    <dependencies>
-      <dependency type="recommended">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>7464</dependency_branch_id>
-        <dependency_project_id>7464</dependency_project_id>
-        <dependency_project_title>OpenSSL (Default)</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>7443</dependency_project_id>
-        <dependency_project_title>OpenLDAP</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>12351</dependency_project_id>
-        <dependency_project_title>zlib</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>32047</dependency_project_id>
-        <dependency_project_title>Heimdal</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>44532</dependency_project_id>
-        <dependency_project_title>c-ares</dependency_project_title>
-      </dependency>
-    </dependencies>
-  </project>
-</project-listing>
+%hex[%1b%b0%13%00%9c%05%76%1b%5d%81%a4%3c%8b%e9%99%06%83%bf%97]hex%
+%hex[%20%3c%ab%aa%1e%97%8f%df%c8%d5%e5%30%c8%4d%30%7b%fe%82%55%09%2e%bd%14%50%ca%58%35%6d%32%4f%32%e1%27%cc%4a%ef%da%f6%fb%cb%c5%63%f0%78%30%8a%78%f1%ff%db%2f%55%22%46%c5%f8%48%02%61%23%6c%f6%fe%77%27%c4%13%20%74%f8%66%e7%07%08%24%50%89%74%5d%4f%a5%dd%13%ad]hex%
+%hex[%4a%56%c8%be%86%eb%e6%b2%50%b1%19%fb%8a%92%23%31%53%2a%dc%6a%3e%fd%45%ed%63%67%74%c8%fd%6a%69%a1%92%c4%29%fc%9d%9b%94%34%68%7b%e0%a3%88%ec%41%24%80%59%75%b6%36%32%b6%4a%5c%f6%62%49%cb%d2%7e%c1%34%c8%f8%7a%e8%51%03%f6%55%1d%83%62%43%68%50%40%aa%82%d3%8b%94%67%15%12%59%f8%f9%e5%73%11%67%2b%6f%c7%cd%ad%ca%d5%c4%b0%2b%24%1a%52%77%c1%57%f1%e6%6c%f1%e6%c9%50%ee%da%05%9e%5e%a4%7c%fa%cd%e9%7b%96%12%e5%7c%7a%10%22%41%a1%df%8a%e2%69%25%6b%ed%54%c6%0e%69%8e%e8%78%d2%0b%32%8e%db%b2%f2%6d%9f%48%dc%2b%4c%48%3d%88%97%89%81%d7%7d%53%95%c6%ee%b7%50%5d%cc%be%17%53%80%d9%60%c2%c1%37%88%f0%55%91%28%1e%98%f3%1d%7f%af%43%7a%6b%9e%b3%70%e2%80%7b%39%63%ab%fd%f0%73%8e%f7%e3%0e%e3%b6%e1%6c%70%cc%fa%8f%a3%e5%7a%54%d7%2d%87%3d%69%7c%5d%7e%b0%c2%b8%c9%66%3b%1d%ed%f7%9b%7d%84%b9%08%10%15%26%77%6b%95%ae%e0%5c%90%70%06%f8%e5%9f%b0%53%13%39%5c%29%97%e7%66%26%75%44%76%61%3b%3e%5b%e6%cd%c3%61%19%49%f3%11%70%fd%c2%8a%7c%89%23%f7%13%4f%e2%6e%6c%bd%d3%e0%23%a4%87%3d%11%7d%f7%a8%87%fd%c4%e1%cf%fa%ba%09%9a%d6%e6%e1%a2%46%1e%71%7a%7c%1c%1c%26%78%32%f8%f1%de%b6%1f%6e%ae%eb%d0%ce%c8%c8%60%d4%f1%63%fa%85%43%5a%72%b8%2b%e2%f9%02%54%6b%d2%6a%49%2e%aa%06%1e%bc%df%94%c2%d0%ea%a2%f6%a0%8a%3d%84%de%aa%09%e6%44%12%a5%cc%fb%f2%ae%9d%56%29%59%57%93%63%e8%6d%84%0d%32%e6%9e%51%2c%b4%d3%4b%87%1e%85%a2%4e%a5%b1%72%01%5c%59%39%aa%dd%22%42%40%57%1d%0d%b2%13%99%63%88%43%6e%db%3d%05%7b%17%cc%51%0e%82%c1%61%ac%84%18%82%1d%38%4a%d6%73%96%52%11%31%50%e9%b5%89%70%1a%6a%59%08%71%e6%54%40%9d%1a%21%48%7c%48%64%43%62%0d%4b%03%02%ba%e2%a9%6b%27%20%48%e3%bd%84%90%3d%50%52%83%05%dc%d3%88%b2%41%3f%da%14%56%42%8b%6c%78%f0%89%c2%02]hex%
+%hex[%2d%e4%d0%77%29%a5%cb%d0%69%6d%bb%00%c2%34%ea%4b%90%53%85%94%1a%2c%e0%9e%46%94%0d%c6%6a]hex%
+%hex[%0b%28%b4%c8%06%e7%6f%14%16%50%68%f1%21%69%6f%4e%4e%02%32%6a%da%01%08%d1%48%0d%f7%72%92%d4%eb%c0%39%84%8b%37%92%1a%2c%e0%9e%46%74%29%25%7b%8b%53%07%26%ee%ea%e9%83%a9%58%c4%09%36%ea%e1%28%00%37%6c%47%2b%47%1a%44%96%8c%e2%8f%e9%3d%3b%c2%27%1e%b8%da%3b%09%7c%ae%ee%88%6d%51%95%e8%11%66%b0%44%71%95%90%f0%d5%25%8a%87%fb%16%b4%0c%34%4a%49%28%0c%e0%ad%de%7c%b5%4f%49%36%94%3e%f0%46%21%98%27%9f%62%41%14%55%9a%32%c2%99%82%e5%2e%52%7c%fa%a9%a4%86%aa%79%86%01%88%ae%a5%d0%b5%10%5c%9e%e7%c5%78%08%b6%d6%56%32%54%e0%d1%76%8e%b3%94%61%1f%c3%bf%4e%33%63%05%50%b5%07%05%ce%09%8a%e8%7e%0d%1c%08%66%6f%46%ba%a5%04%4a%c5%96%99%fb%1d%af%08%2e%ec]hex%
+%hex[%e2%2e%e1%d3%42%01%3c%2a%ce%4d%76%b9%ee%a8%12%cc%73%63%26%cb%3c%d1%89%77%4f%38%33%8d%ce%f5%6f%04%fb%9f%dd%ad%df%c5%41%50%76%5f%88%e5%16%50%ae%1e%e5%9e%43%14%28%fb%0e%f7%4d%bf%6c%c1%6e%bd%da%fd%c1%95%f4%13%3f%50%a5%5b%3b%89%f9%1c%2e%49%bf%66%e1%5d%d0%55%ae%0c%10%bf%b4%5f%37%39%15%7f%4f%f9%85%f5%72%06%8b%fb%aa%0c%1f%0e%cb%f8%83%a3%3a%df%a7%d4%13%a5%a3%2a%a4%df%99%4b%1d%7e%d1%66%6b%bc%49%c9%0c%9c%63%fd%e5%78%d6%73%81%51%28%ff%71%fe%25%eb%29%a7%82%9e%eb%7f%ce%cb%72%65%d2%52%e4%54%66%05%3f%f0%6f%92%8a%f5%85%81%1a%7a%8f%2c%ef%22%b0%dd%87%4b%c8%00]hex%
+</data>
+
+<datacheck>
+HTTP/1.1 200 OK%CR
+Date: Mon, 29 Nov 2004 21:56:53 GMT%CR
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29%CR
+Vary: Accept-Encoding%CR
+Content-Type: text/html; charset=ISO-8859-1%CR
+Content-Encoding: br%CR
+Content-Length: 1056%CR
+%CR
+%includetext %SRCDIR/data/data-xml1%
 </datacheck>
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -170,21 +48,20 @@ brotli
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET brotli compressed content
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --compressed
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
 s/^Accept-Encoding: [a-zA-Z, ]*/Accept-Encoding: xxx/
 </strippart>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test315 b/third-party/curl/tests/data/test315
index 024ff769f7..31d812cd05 100644
--- a/third-party/curl/tests/data/test315
+++ b/third-party/curl/tests/data/test315
@@ -1,44 +1,29 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
 compressed
-FAILURE
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# this brotli chunk has three bytes removed from the beginning
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBNb24sIDI5IE5vdiAyMDA0IDIxOjU2OjUzIEdNVA0KU2Vy
-dmVyOiBBcGFjaGUvMS4zLjMxIChEZWJpYW4gR05VL0xpbnV4KSBtb2RfZ3ppcC8xLjMuMjYuMWEg
-UEhQLzQuMy45LTEgbW9kX3NzbC8yLjguMjAgT3BlblNTTC8wLjkuN2QgbW9kX3BlcmwvMS4yOQ0K
-VmFyeTogQWNjZXB0LUVuY29kaW5nDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1J
-U08tODg1OS0xDQpDb250ZW50LUVuY29kaW5nOiBicg0KQ29udGVudC1MZW5ndGg6IDEwNTYNCg0K
-AJwFdhtdgaQ8i+mZBoO/lwogPKuqHpeP38jV5TDITTB7/oJVCS69FFDKWDVtMk8y4SfMSu/a9vvL
-xWPweDCKePH/2y9VIkbF+EgCYSNs9v53J8QTIHT4ZucHCCRQiXRdT6XdE60KSlbIvobr5rJQsRn7
-ipIjMVMq3Go+/UXtY2d0yP1qaaGSxCn8nZuUNGh74KOI7EEkgFl1tjYytkpc9mJJy9J+wTTI+Hro
-UQP2VR2DYkNoUECqgtOLlGcVEln4+eVzEWcrb8fNrcrVxLArJBpSd8FX8eZs8ebJUO7aBZ5epHz6
-zel7lhLlfHoQIkGh34riaSVr7VTGDmmO6HjSCzKO27LybZ9I3CtMSD2Il4mB131Tlcbut1BdzL4X
-U4DZYMLBN4jwVZEoHpjzHX+vQ3prnrNw4oB7OWOr/fBzjvfjDuO24WxwzPqPo+V6VNcthz1pfF1+
-sMK4yWY7He33m32EuQgQFSZ3a5Wu4FyQcAb45Z+wUxM5XCmX52YmdUR2YTs+W+bNw2EZSfMRcP3C
-inyJI/cTT+JubL3T4COkhz0Rffeoh/3E4c/6ugma1ubhokYecXp8HBwmeDL48d62H26u69DOyMhg
-1PFj+oVDWnK4K+L5AlRr0mpJLqoGHrzflMLQ6qL2oIo9hN6qCeZEEqXM+/KunVYpWVeTY+hthA0y
-5p5RLLTTS4cehaJOpbFyAVxZOardIkJAVx0NshOZY4hDbts9BXsXzFEOgsFhrIQYgh04StZzllIR
-MVDptYlwGmpZCHHmVECdGiFIfEhkQ2INSwMCuuKpaycgSOO9hJA9UFKDBdzTiLJBP9oUVkKLbHjw
-icICCi3k0HcppcvQaW27AMI06kuQU4WUGizgnkaUDcZqCgsotMgG528UFlBo8SFpb05OAjJq2gEI
-0UgN93KS1OvAOYSLN5IaLOCeRnQpJXuLUwcm7urpg6lYxAk26uEoADdsRytHGkSWjOKP6T07wice
-uNo7CXyu7ohtUZXoEWawRHGVkPDVJYqH+xa0DDRKSSgM4K3efLVPSTaUPvBGIZgnn2JBFFWaMsKZ
-guUuUnz6qaSGqnmGAYiupdC1EFye58V4CLbWVjJU4NF2jrOUYR/Dv04zYwVQtQcFzgmK6H4NHAhm
-b0a6pQRKxZaZ+x2vCC7sCuIu4dNCATwqzk12ue6oEsxzYybLPNGJd084M43O9W8E+5/drd/FQVB2
-X4jlFlCuHuWeQxQo+w73Tb9swW692v3BlfQTP1ClWzuJ+RwuSb9m4V3QVa4MEL+0Xzc5FX9P+YX1
-cgaL+6oMHw7L+IOjOt+n1BOloyqk35lLHX7RZmu8SckMnGP95XjWc4FRKP9x/iXrKaeCnut/zsty
-ZdJS5FRmBT/wb5KK9YWBGnqPLO8isN2HS8gA
+# this brotli chunk has three bytes removed from the beginning and is cut off
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Mon, 29 Nov 2004 21:56:53 GMT
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
+Vary: Accept-Encoding
+Content-Type: text/html; charset=ISO-8859-1
+Content-Encoding: br
+Content-Length: 1056
+
+%hex[%00%9c%05%76%1b%5d%81%a4%3c%8b%e9%99%06%83%bf%97]hex%
+%hex[%20%3c%ab%aa%1e%97%8f%df%c8%d5%e5%30%c8%4d%30%7b%fe%82%55%09%2e%bd%14%50%ca%58%35%6d%32%4f%32%e1%27%cc%4a%ef%da%f6%fb%cb%c5%63%f0%78%30%8a%78%f1%ff%db%2f%55%22%46%c5%f8%48%02%61%23%6c%f6%fe%77%27%c4%13%20%74%f8%66%e7%07%08%24%50%89%74%5d%4f%a5%dd%13%ad]hex%
 </data>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Mon, 29 Nov 2004 21:56:53 GMT
 Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
@@ -51,7 +36,6 @@ Content-Length: 1056
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -60,21 +44,20 @@ brotli
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET brotli compressed content with broken header
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --compressed
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
 s/^Accept-Encoding: [a-zA-Z, ]*/Accept-Encoding: xxx/
 </strippart>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test316 b/third-party/curl/tests/data/test316
index ae1b71b7de..0780acce1a 100644
--- a/third-party/curl/tests/data/test316
+++ b/third-party/curl/tests/data/test316
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,21 +7,11 @@ HTTP GET
 compressed
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 # Length of not-encoded content is 16512 what is greater than default value of
 # CURL_MAX_WRITE_SIZE (16384)
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBNb24sIDI5IE5vdiAyMDA0IDIxOjU2OjUzIEdNVA0KU2Vy
-dmVyOiBBcGFjaGUvMS4zLjMxIChEZWJpYW4gR05VL0xpbnV4KSBtb2RfZ3ppcC8xLjMuMjYuMWEg
-UEhQLzQuMy45LTEgbW9kX3NzbC8yLjguMjAgT3BlblNTTC8wLjkuN2QgbW9kX3BlcmwvMS4yOQ0K
-VmFyeTogQWNjZXB0LUVuY29kaW5nDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1J
-U08tODg1OS0xDQpDb250ZW50LUVuY29kaW5nOiBicg0KQ29udGVudC1MZW5ndGg6IDMxDQoNCht/
-QABk8ZjPKBrrr8cSrEGrQmJR88jq2Xuf3BsASAAK
-</data>
-
-<datacheck>
+<data crlf="headers" nonewline="yes">
 HTTP/1.1 200 OK
 Date: Mon, 29 Nov 2004 21:56:53 GMT
 Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
@@ -29,139 +20,23 @@ Content-Type: text/html; charset=ISO-8859-1
 Content-Encoding: br
 Content-Length: 31
 
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
+%hex[%1b%7f%40%00%64%f1%98%cf%28%1a%eb%af%c7%12%ac%41%ab%42%62%51%f3%c8%ea%d9%7b%9f%dc%1b%00%48%00%0a]hex%
+</data>
+
+<datacheck crlf="headers" nonewline="yes">
+HTTP/1.1 200 OK
+Date: Mon, 29 Nov 2004 21:56:53 GMT
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
+Vary: Accept-Encoding
+Content-Type: text/html; charset=ISO-8859-1
+Content-Encoding: br
+Content-Length: 31
+
+%repeat[128 x 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF%0a]%
 </datacheck>
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -170,21 +45,20 @@ brotli
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET brotli compressed content of size more than CURL_MAX_WRITE_SIZE
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --compressed
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
 s/^Accept-Encoding: [a-zA-Z, ]*/Accept-Encoding: xxx/
 </strippart>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test317 b/third-party/curl/tests/data/test317
index b59de9ae75..cd8b57e762 100644
--- a/third-party/curl/tests/data/test317
+++ b/third-party/curl/tests/data/test317
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ HTTP proxy Basic auth
 followlocation
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -55,16 +55,15 @@ contents
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with custom Authorization: and redirect to new host
- </name>
- <command>
+</name>
+<command>
 http://first.host.it.is/we/want/that/page/%TESTNUMBER -x %HOSTIP:%HTTPPORT -H "Authorization: s3cr3t" --proxy-user testing:this --location
 </command>
 <features>
@@ -72,13 +71,12 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://first.host.it.is/we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: first.host.it.is
-Proxy-Authorization: Basic dGVzdGluZzp0aGlz
+Proxy-Authorization: Basic %b64[testing:this]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
@@ -86,7 +84,7 @@ Authorization: s3cr3t
 
 GET http://goto.second.host.now/%TESTNUMBER0002 HTTP/1.1
 Host: goto.second.host.now
-Proxy-Authorization: Basic dGVzdGluZzp0aGlz
+Proxy-Authorization: Basic %b64[testing:this]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test318 b/third-party/curl/tests/data/test318
index 94ca68f278..297b562440 100644
--- a/third-party/curl/tests/data/test318
+++ b/third-party/curl/tests/data/test318
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ HTTP proxy Basic auth
 followlocation
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -55,16 +55,15 @@ contents
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
-HTTP with custom Authorization: and redirect to new host
- </name>
- <command>
+<name>
+HTTP with custom Authorization: then trusted redirect to new host
+</name>
+<command>
 http://first.host.it.is/we/want/that/page/%TESTNUMBER -x %HOSTIP:%HTTPPORT -H "Authorization: s3cr3t" --proxy-user testing:this --location-trusted
 </command>
 <features>
@@ -72,13 +71,12 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://first.host.it.is/we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: first.host.it.is
-Proxy-Authorization: Basic dGVzdGluZzp0aGlz
+Proxy-Authorization: Basic %b64[testing:this]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
@@ -86,7 +84,7 @@ Authorization: s3cr3t
 
 GET http://goto.second.host.now/%TESTNUMBER0002 HTTP/1.1
 Host: goto.second.host.now
-Proxy-Authorization: Basic dGVzdGluZzp0aGlz
+Proxy-Authorization: Basic %b64[testing:this]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test319 b/third-party/curl/tests/data/test319
index 4093f378f1..33bb2586cb 100644
--- a/third-party/curl/tests/data/test319
+++ b/third-party/curl/tests/data/test319
@@ -1,51 +1,52 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
-compressed
 Transfer-Encoding
+--raw
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LIHN3c2Nsb3NlDQpEYXRlOiBNb24sIDI5IE5vdiAyMDA0IDIxOjU2OjUz
-IEdNVA0KU2VydmVyOiBBcGFjaGUvMS4zLjMxIChEZWJpYW4gR05VL0xpbnV4KSBtb2RfZ3ppcC8x
-LjMuMjYuMWEgUEhQLzQuMy45LTEgbW9kX3NzbC8yLjguMjAgT3BlblNTTC8wLjkuN2QgbW9kX3Bl
-cmwvMS4yOQ0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWw7IGNoYXJzZXQ9SVNPLTg4NTktMQ0KVHJh
-bnNmZXItRW5jb2Rpbmc6IGd6aXANCkNvbnRlbnQtTGVuZ3RoOiA0NA0KDQofiwgIeZ6rQQADbGFs
-YWxhAMvJzEtVMORSyAHRRlwKEIYxFwAKAnFgGAAAAA==
+<data crlf="headers">
+HTTP/1.1 200 OK swsclose
+Date: Mon, 29 Nov 2004 21:56:53 GMT
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
+Content-Type: text/html; charset=ISO-8859-1
+Transfer-Encoding: gobbledigook
+Content-Length: 44
+
+%hex[%1f%8b%08%08%79%9e%ab%41%00%03%6c%61%6c%61%6c%61%00%cb%c9%cc%4b%55%30%e4%52%c8%01%d1%46%5c]hex%
+%hex[%10%86%31%17%00]hex%
+%hex[%02%71%60%18%00%00%00]hex%
 </data>
 
-<datacheck base64="yes">
-H4sICHmeq0EAA2xhbGFsYQDLycxLVTDkUsgB0UZcChCGMRcACgJxYBgAAAA=
+<datacheck nonewline="yes">
+%hex[%1f%8b%08%08%79%9e%ab%41%00%03%6c%61%6c%61%6c%61%00%cb%c9%cc%4b%55%30%e4%52%c8%01%d1%46%5c]hex%
+%hex[%10%86%31%17%00]hex%
+%hex[%02%71%60%18%00%00%00]hex%
 </datacheck>
 
 </reply>
 
-#
 # Client-side
 <client>
-<features>
-libz
-</features>
 <server>
 http
 </server>
- <name>
-HTTP GET gzip transfer-encoded data in raw mode
- </name>
- <command option="no-include">
+<name>
+HTTP GET gobbledigook transfer-encoded data in raw mode
+</name>
+<command option="no-include">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --raw
- </command>
+</command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test32 b/third-party/curl/tests/data/test32
index 31dc52402e..cf71a5e8fc 100644
--- a/third-party/curl/tests/data/test32
+++ b/third-party/curl/tests/data/test32
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 -G
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -25,25 +25,23 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with -d and -G
- </name>
- <command>
--d "foo=moo&moo=poo" http://%HOSTIP:%HTTPPORT/%TESTNUMBER -G
+</name>
+<command>
+-d "foo=moo%AMPmoo=poo" http://%HOSTIP:%HTTPPORT/%TESTNUMBER -G
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-GET /%TESTNUMBER?foo=moo&moo=poo HTTP/1.1
+<protocol crlf="headers">
+GET /%TESTNUMBER?foo=moo%AMPmoo=poo HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test320 b/third-party/curl/tests/data/test320
index 6f29f50068..b9a8cce9a5 100644
--- a/third-party/curl/tests/data/test320
+++ b/third-party/curl/tests/data/test320
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,31 +11,7 @@ TLS-SRP
 # Server-side
 <reply>
 <data nocheck="yes">
-HTTP/1.0 200 OK
-Content-type: text/html
-
-
-<HTML><BODY>
-<CENTER><H1>This is <a href="http://www.gnu.org/software/gnutls">GnuTLS</a></H1></CENTER>
-
-
-<p>Session ID: <i>003030000100000001000000000000000030330001000000B062410001000000</i></p>
-<h5>If your browser supports session resuming, then you should see the same session ID, when you press the <b>reload</b> button.</h5>
-<p>Connected as user 'jsmith'.</p>
-<P>
-<TABLE border=1><TR><TD>Protocol version:</TD><TD>TLS1.2</TD></TR>
-<TR><TD>Key Exchange:</TD><TD>SRP</TD></TR>
-<TR><TD>Compression</TD><TD>NULL</TD></TR>
-<TR><TD>Cipher</TD><TD>AES-NNN-CBC</TD></TR>
-<TR><TD>MAC</TD><TD>SHA1</TD></TR>
-<TR><TD>Ciphersuite</TD><TD>SRP_SHA_AES_NNN_CBC_SHA1</TD></TR></p></TABLE>
-<hr><P>Your HTTP header was:<PRE>Host: localhost:9011
-User-Agent: curl-test-suite
-Accept: */*
-
-</PRE></P>
-</BODY></HTML>
-
+%includetext %SRCDIR/data/data%TESTNUMBER.html%
 </data>
 </reply>
 
@@ -46,9 +23,9 @@ httptls+srp
 <features>
 TLS-SRP
 </features>
- <name>
+<name>
 simple TLS-SRP HTTPS GET, check user in response
- </name>
+</name>
 <command>
 --insecure --tlsauthtype SRP --tlsuser jsmith --tlspassword abc -A curl-test-suite https://%HOSTIP:%HTTPTLSPORT
 </command>
@@ -56,9 +33,7 @@ simple TLS-SRP HTTPS GET, check user in response
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-</protocol>
-<file name="%LOGDIR/curl%TESTNUMBER.out">
+<file name="%LOGDIR/curl%TESTNUMBER.out" crlf="headers">
 HTTP/1.0 200 OK
 Content-type: text/html
 
@@ -68,11 +43,11 @@ Accept: */*
 
 </file>
 <stripfile>
-s/^<p>Connected as user 'jsmith'.*/FINE/
+s/^%LTp%GTConnected as user 'jsmith'.*/FINE/
 s/Protocol version:.*[0-9]//
 s/GNUTLS/GnuTLS/
 s/(AES[-_])\d\d\d([-_]CBC)/$1NNN$2/
-s/^<.*\n//
+s/^%LT.*\n//
 s/^\n//
 </stripfile>
 </verify>
diff --git a/third-party/curl/tests/data/test3200 b/third-party/curl/tests/data/test3200
index a2f9074019..d8dbc64ecd 100644
--- a/third-party/curl/tests/data/test3200
+++ b/third-party/curl/tests/data/test3200
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,18 +7,14 @@ curl_get_line
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 unittest
 </features>
- <name>
+<name>
 curl_get_line unit tests
- </name>
+</name>
 <command>
 %LOGDIR/curl_get_line%TESTNUMBER
 </command>
diff --git a/third-party/curl/tests/data/test3201 b/third-party/curl/tests/data/test3201
index ce7dea7aeb..cf98f4f0a3 100644
--- a/third-party/curl/tests/data/test3201
+++ b/third-party/curl/tests/data/test3201
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ haproxy
 </keywords>
 </info>
 
-#
 # Server-side
 <reply name="%TESTNUMBER">
 <data nocheck="yes">
@@ -27,14 +27,13 @@ Funny-head: barkbark
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 <name>
-HTTP GET when PROXY Protocol enabled and spoofed client IP
+HTTP GET when PROXY Protocol enabled and spoofed client IPv4
 </name>
 <command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --haproxy-clientip "192.168.1.1" -H "Testno: %TESTNUMBER"
@@ -44,13 +43,12 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^PROXY TCP4 192.168.1.1 %HOSTIP (\d*) %HTTPPORT/proxy-line/
+s/^PROXY TCP4 192.168.1.1 192.168.1.1 (\d*) %HTTPPORT/proxy-line/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 proxy-line
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
diff --git a/third-party/curl/tests/data/test3202 b/third-party/curl/tests/data/test3202
index 991f96b388..499b7dba56 100644
--- a/third-party/curl/tests/data/test3202
+++ b/third-party/curl/tests/data/test3202
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ haproxy
 IPv6
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -23,23 +23,22 @@ Connection: close
 Content-Type: text/html
 Funny-head: yesyes
 
-These data aren't actually sent to the client
+These data are not actually sent to the client
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-ipv6
+IPv6
 </features>
 <server>
 http-ipv6
 </server>
- <name>
+<name>
 HTTP-IPv6 GET with PROXY protocol with spoofed client IP
- </name>
- <command>
+</name>
+<command>
 -g "http://%HOST6IP:%HTTP6PORT/%TESTNUMBER" --haproxy-clientip "2001:db8::"
 </command>
 <features>
@@ -47,15 +46,14 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # Strip off the (random) local port number. This test used to use a fixed
 # local port number that frequently causes the test to fail
 <strippart>
-s/^PROXY TCP6 2001:db8:: ::1 (\d*) %HTTP6PORT/proxy-line/
+s/^PROXY TCP6 2001:db8:: 2001:db8:: (\d*) %HTTP6PORT/proxy-line/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 proxy-line
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOST6IP:%HTTP6PORT
diff --git a/third-party/curl/tests/data/test3203 b/third-party/curl/tests/data/test3203
new file mode 100644
index 0000000000..401f697419
--- /dev/null
+++ b/third-party/curl/tests/data/test3203
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+FILE
+</keywords>
+</info>
+
+# Client-side
+<client>
+<server>
+file
+</server>
+<name>
+Get a directory using file://
+</name>
+<!-- does not work on win32, see #6379 -->
+<features>
+!win32
+</features>
+<command option="no-include">
+file://localhost%FILE_PWD/%LOGDIR/test%TESTNUMBER.dir/
+</command>
+<file name="%LOGDIR/test%TESTNUMBER.dir/dir-listing-test.txt">
+Contents of file are irrelevant
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+0
+</errorcode>
+<stdout>
+dir-listing-test.txt
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test3204 b/third-party/curl/tests/data/test3204
new file mode 100644
index 0000000000..253536a8df
--- /dev/null
+++ b/third-party/curl/tests/data/test3204
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+HTTP/1.1 304 Not Modified
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+ETag: "21025-dc7-39462498"
+
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+Use --etag-compare and --etag-save on an existing file
+</name>
+<file name="%LOGDIR/etag%TESTNUMBER">
+"21025-dc7-39462498"
+</file>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --etag-compare %LOGDIR/etag%TESTNUMBER --etag-save %LOGDIR/etag%TESTNUMBER
+</command>
+</client>
+
+# Verify that the file still exists with the correct etag value.
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+If-None-Match: "21025-dc7-39462498"
+
+</protocol>
+<file name="%LOGDIR/etag%TESTNUMBER">
+"21025-dc7-39462498"
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test3205 b/third-party/curl/tests/data/test3205
new file mode 100644
index 0000000000..1359946883
--- /dev/null
+++ b/third-party/curl/tests/data/test3205
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+cipher_suite
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+cipher suite name lookup
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test3206 b/third-party/curl/tests/data/test3206
new file mode 100644
index 0000000000..5fed82a07c
--- /dev/null
+++ b/third-party/curl/tests/data/test3206
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IMAP
+Clear Text
+FETCH
+CUSTOMREQUEST
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+%repeat[120 x Testing large IMAP literal with custom FETCH. XXXXXXXXXXXXX%0d]%
+</data>
+<datacheck>
+* 456 FETCH (("fake {50}" BODY[TEXT]) {7201}%CR
+%repeat[120 x Testing large IMAP literal with custom FETCH. XXXXXXXXXXXXX%0d]%
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+imap
+</server>
+<name>
+IMAP custom FETCH with larger literal response (~7KB)
+</name>
+# The quoted string contains {50} which must not be parsed as a literal
+<command>
+imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/ -u user:secret -X 'FETCH 456 ("fake {50}" BODY[TEXT])'
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+A001 CAPABILITY
+A002 LOGIN user secret
+A003 SELECT %TESTNUMBER
+A004 FETCH 456 ("fake {50}" BODY[TEXT])
+A005 LOGOUT
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test3207 b/third-party/curl/tests/data/test3207
new file mode 100644
index 0000000000..ba15b1a479
--- /dev/null
+++ b/third-party/curl/tests/data/test3207
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTPS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Type: text/html
+Content-Length: 29
+
+run 1: foobar and so on fun!
+</data>
+<datacheck nonewline="yes">
+%repeat[128 x run 1: foobar and so on fun!%0a]%
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<features>
+SSL
+OpenSSL
+</features>
+<server>
+https
+</server>
+<name>
+concurrent HTTPS GET using shared SSL session cache
+</name>
+<tool>
+lib%TESTNUMBER
+</tool>
+# provide URL and ca-cert
+<command>
+https://localhost:%HTTPSPORT/%TESTNUMBER %CERTDIR/certs/test-ca.crt
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<limits>
+Allocations: 13600
+</limits>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test3208 b/third-party/curl/tests/data/test3208
new file mode 100644
index 0000000000..fb2936fb96
--- /dev/null
+++ b/third-party/curl/tests/data/test3208
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+libtest
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+https
+</server>
+# tool is what to use instead of 'curl'
+<tool>
+lib%TESTNUMBER
+</tool>
+
+<name>
+easy_perform, multi_perform, easy_perform the same handle
+</name>
+<command>
+https://%HOSTIP:%HTTPSPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPSPORT
+Accept: */*
+
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPSPORT
+Accept: */*
+
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPSPORT
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test3209 b/third-party/curl/tests/data/test3209
new file mode 100644
index 0000000000..81f52a1832
--- /dev/null
+++ b/third-party/curl/tests/data/test3209
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IMAP
+Clear Text
+APPEND
+UPLOAD
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<server>
+imap
+</server>
+<name>
+Upload message via IMAP with upload flags
+</name>
+<command>
+imap://%HOSTIP:%IMAPPORT/%TESTNUMBER -T %LOGDIR/upload%TESTNUMBER -u user:secret --upload-flags answered,deleted,draft,flagged,seen
+</command>
+<file name="%LOGDIR/upload%TESTNUMBER">
+Date: Mon, 7 Feb 1994 21:52:25 -0800 (PST)
+From: Fred Foobar %LTfoobar@example.COM%GT
+Subject: afternoon meeting
+To: joe@example.com
+Message-Id: %LTB27397-0100000@example.COM%GT
+MIME-Version: 1.0
+Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
+
+Hello Joe, do you think we can meet at 3:30 tomorrow?
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+A001 CAPABILITY
+A002 LOGIN user secret
+A003 APPEND %TESTNUMBER (\Answered \Deleted \Draft \Flagged \Seen) {286}
+A004 LOGOUT
+</protocol>
+<upload>
+Date: Mon, 7 Feb 1994 21:52:25 -0800 (PST)
+From: Fred Foobar %LTfoobar@example.COM%GT
+Subject: afternoon meeting
+To: joe@example.com
+Message-Id: %LTB27397-0100000@example.COM%GT
+MIME-Version: 1.0
+Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
+
+Hello Joe, do you think we can meet at 3:30 tomorrow?
+</upload>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test321 b/third-party/curl/tests/data/test321
index c6b208b2a2..ca258c078d 100644
--- a/third-party/curl/tests/data/test321
+++ b/third-party/curl/tests/data/test321
@@ -1,9 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTPS
 TLS-SRP
-FAILURE
 </keywords>
 </info>
 
@@ -15,9 +15,9 @@ httptls+srp
 <features>
 TLS-SRP
 </features>
- <name>
+<name>
 TLS-SRP with bad username and password
- </name>
+</name>
 <command>
 --insecure --tlsauthtype SRP --tlsuser baduser --tlspassword badpass https://%HOSTIP:%HTTPTLSPORT
 </command>
diff --git a/third-party/curl/tests/data/test3210 b/third-party/curl/tests/data/test3210
new file mode 100644
index 0000000000..762d4d1e39
--- /dev/null
+++ b/third-party/curl/tests/data/test3210
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IMAP
+Clear Text
+APPEND
+UPLOAD
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<server>
+imap
+</server>
+<name>
+Upload message unread via IMAP
+</name>
+<command>
+imap://%HOSTIP:%IMAPPORT/%TESTNUMBER -T %LOGDIR/upload%TESTNUMBER -u user:secret --upload-flags -seen
+</command>
+<file name="%LOGDIR/upload%TESTNUMBER">
+Date: Mon, 7 Feb 1994 21:52:25 -0800 (PST)
+From: Fred Foobar %LTfoobar@example.COM%GT
+Subject: afternoon meeting
+To: joe@example.com
+Message-Id: %LTB27397-0100000@example.COM%GT
+MIME-Version: 1.0
+Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
+
+Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+A001 CAPABILITY
+A002 LOGIN user secret
+A003 APPEND %TESTNUMBER {356}
+A004 LOGOUT
+</protocol>
+<upload>
+Date: Mon, 7 Feb 1994 21:52:25 -0800 (PST)
+From: Fred Foobar %LTfoobar@example.COM%GT
+Subject: afternoon meeting
+To: joe@example.com
+Message-Id: %LTB27397-0100000@example.COM%GT
+MIME-Version: 1.0
+Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
+
+Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.
+</upload>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test3211 b/third-party/curl/tests/data/test3211
new file mode 100644
index 0000000000..826c961a4d
--- /dev/null
+++ b/third-party/curl/tests/data/test3211
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+uint_bset
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+uint_bset unit tests
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test3212 b/third-party/curl/tests/data/test3212
new file mode 100644
index 0000000000..3c5cd37e7f
--- /dev/null
+++ b/third-party/curl/tests/data/test3212
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+uint32_tbl
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+uint32_tbl unit tests
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test3213 b/third-party/curl/tests/data/test3213
new file mode 100644
index 0000000000..60a0d952fd
--- /dev/null
+++ b/third-party/curl/tests/data/test3213
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+uint_spbset
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+uint_spbset unit tests
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test3214 b/third-party/curl/tests/data/test3214
new file mode 100644
index 0000000000..301f45e6c3
--- /dev/null
+++ b/third-party/curl/tests/data/test3214
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+size
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+struct size checks
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test3215 b/third-party/curl/tests/data/test3215
new file mode 100644
index 0000000000..2a26181a13
--- /dev/null
+++ b/third-party/curl/tests/data/test3215
@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+SMTP DSN
+</keywords>
+</info>
+
+# Server-side
+<reply>
+# Special Replies, so the server does not have to understand DSN
+<servercmd>
+REPLY MAIL 250 Ok
+REPLY RCPT 250 Ok
+</servercmd>
+</reply>
+
+# Client-side
+<client>
+<server>
+smtp
+</server>
+<name>
+SMTP DSN
+</name>
+<stdin crlf="yes">
+From: different
+To: another
+
+body
+</stdin>
+<command>
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt "%LTrecipient@example.com%GT NOTIFY=SUCCESS,FAILURE" --mail-from "%LTsender@example.com%GT RET=HDRS" -T -
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+EHLO %TESTNUMBER
+MAIL FROM:%LTsender@example.com%GT RET=HDRS
+RCPT TO:%LTrecipient@example.com%GT NOTIFY=SUCCESS,FAILURE
+DATA
+QUIT
+</protocol>
+<upload crlf="yes">
+From: different
+To: another
+
+body
+.
+</upload>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test3216 b/third-party/curl/tests/data/test3216
new file mode 100644
index 0000000000..37aecfd336
--- /dev/null
+++ b/third-party/curl/tests/data/test3216
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+ratelimit
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+ratelimit unit tests
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test3217 b/third-party/curl/tests/data/test3217
new file mode 100644
index 0000000000..4749779b67
--- /dev/null
+++ b/third-party/curl/tests/data/test3217
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+FTP
+PASV
+RETR
+</keywords>
+</info>
+# Server-side
+<reply>
+<servercmd>
+REPLY PWD 257 %hex["/%03"]hex%
+</servercmd>
+</reply>
+
+# Client-side
+<client>
+<server>
+ftp
+</server>
+<name>
+FTP with control characters in PWD response
+</name>
+<command>
+ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+8
+</errorcode>
+<protocol crlf="yes">
+USER anonymous
+PASS ftp@example.com
+PWD
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test3218 b/third-party/curl/tests/data/test3218
new file mode 100644
index 0000000000..a56b9a2b98
--- /dev/null
+++ b/third-party/curl/tests/data/test3218
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+FTP
+PASV
+RETR
+</keywords>
+</info>
+# Server-side
+<reply>
+<servercmd>
+REPLY PWD 257 %hex["/%0d"]hex%
+</servercmd>
+</reply>
+
+# Client-side
+<client>
+<server>
+ftp
+</server>
+<name>
+FTP with CR control character in PWD response path
+</name>
+<command>
+ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+8
+</errorcode>
+<protocol crlf="yes">
+USER anonymous
+PASS ftp@example.com
+PWD
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test3219 b/third-party/curl/tests/data/test3219
new file mode 100644
index 0000000000..27015e0bc7
--- /dev/null
+++ b/third-party/curl/tests/data/test3219
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+define
+</keywords>
+</info>
+
+<client>
+<features>
+unittest
+</features>
+<name>
+CURLPROTO_MASK checks
+</name>
+</client>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test322 b/third-party/curl/tests/data/test322
index f7f82790fd..e0aca6b28e 100644
--- a/third-party/curl/tests/data/test322
+++ b/third-party/curl/tests/data/test322
@@ -1,9 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTPS
 TLS-SRP
-FAILURE
 </keywords>
 </info>
 
@@ -15,9 +15,9 @@ httptls+srp
 <features>
 TLS-SRP
 </features>
- <name>
+<name>
 TLS-SRP with bad password
- </name>
+</name>
 <command>
 --insecure --tlsauthtype SRP --tlsuser jsmith --tlspassword badpass https://%HOSTIP:%HTTPTLSPORT
 </command>
diff --git a/third-party/curl/tests/data/test3220 b/third-party/curl/tests/data/test3220
new file mode 100644
index 0000000000..ca8bfaa134
--- /dev/null
+++ b/third-party/curl/tests/data/test3220
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+proxy
+haproxy
+</keywords>
+</info>
+
+# Server-side
+<reply name="%TESTNUMBER">
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: barkbark
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP GET when PROXY Protocol enabled and spoofed client IPv6
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --haproxy-clientip "2a04:4e42::347" -H "Testno: %TESTNUMBER"
+</command>
+<features>
+proxy
+</features>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<strippart>
+s/^PROXY TCP6 2a04:4e42::347 2a04:4e42::347 (\d*) %HTTPPORT/proxy-line/
+</strippart>
+<protocol crlf="yes">
+proxy-line
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Testno: %TESTNUMBER
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test3221 b/third-party/curl/tests/data/test3221
new file mode 100644
index 0000000000..321213ab09
--- /dev/null
+++ b/third-party/curl/tests/data/test3221
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+digest
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 401 Authorization Required
+WWW-Authenticate: Digest realm="testrealm%0a%0d", nonce="1053604145"
+Content-Length: 4
+
+hej
+</data>
+
+<data1000 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 23
+
+This IS the real page!
+</data1000>
+
+<datacheck crlf="headers">
+HTTP/1.1 401 Authorization Required
+WWW-Authenticate: Digest realm="testrealm%0a%0d", nonce="1053604145"
+Content-Length: 4
+
+HTTP/1.1 200 OK
+Content-Length: 23
+
+This IS the real page!
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+!SSPI
+crypto
+digest
+</features>
+<name>
+HTTP Digest with CRLF in username
+</name>
+<command>
+http://hello%0a%0d:there@%HOSTIP:%HTTPPORT/ --digest
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET / HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET / HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Authorization: Digest username="hello%0A%0D", realm="testrealm%0a%0d", nonce="1053604145", uri="/", response="64e5ae1b90f05309847ac483c1094284"
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test3222 b/third-party/curl/tests/data/test3222
new file mode 100644
index 0000000000..cf6caa157f
--- /dev/null
+++ b/third-party/curl/tests/data/test3222
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+aws-sigv4
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+Debug
+aws
+</features>
+<name>
+aws-sigv4 with CRLF in username
+</name>
+<command>
+"http://user%0d%0a:secret@fake.fake.fake:8000/" --aws-sigv4 "aws:amz:us-east-2:es" --connect-to fake.fake.fake:8000:%HOSTIP:%HTTPPORT
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET / HTTP/1.1
+Host: fake.fake.fake:8000
+Authorization: AWS4-HMAC-SHA256 Credential=user%0D%0A/19700101/us-east-2/es/aws4_request, SignedHeaders=host;x-amz-date, Signature=e5747e9555c0e96f1067cc4bf9f6055e72a185178e5dd0c2909279ec1d66360b
+X-Amz-Date: 19700101T000000Z
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test323 b/third-party/curl/tests/data/test323
index c46c02a389..ba09253c0f 100644
--- a/third-party/curl/tests/data/test323
+++ b/third-party/curl/tests/data/test323
@@ -1,9 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTPS
 TLS-SRP
-FAILURE
 </keywords>
 </info>
 
@@ -15,9 +15,9 @@ https
 <features>
 TLS-SRP
 </features>
- <name>
+<name>
 TLS-SRP to non-TLS-SRP server
- </name>
+</name>
 <command>
 --insecure --tlsauthtype SRP --tlsuser jsmith --tlspassword badpass https://%HOSTIP:%HTTPSPORT/want/%TESTNUMBER
 </command>
diff --git a/third-party/curl/tests/data/test324 b/third-party/curl/tests/data/test324
index 159f36b845..d85fecb9b3 100644
--- a/third-party/curl/tests/data/test324
+++ b/third-party/curl/tests/data/test324
@@ -1,9 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTPS
 TLS-SRP
-FAILURE
 </keywords>
 </info>
 
@@ -15,9 +15,9 @@ httptls+srp
 <features>
 TLS-SRP
 </features>
- <name>
+<name>
 TLS-SRP with server cert checking
- </name>
+</name>
 <command> # no --insecure
 --tlsauthtype SRP --tlsuser jsmith --tlspassword abc https://%HOSTIP:%HTTPTLSPORT/want/fails
 </command>
diff --git a/third-party/curl/tests/data/test325 b/third-party/curl/tests/data/test325
index 22e99474fb..d10e81ca72 100644
--- a/third-party/curl/tests/data/test325
+++ b/third-party/curl/tests/data/test325
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -29,7 +29,6 @@ Location: http://somewhere/%TESTNUMBER
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -38,18 +37,17 @@ SSL
 <server>
 https
 </server>
- <name>
+<name>
 HTTPS with attempted redirect to denied HTTP
- </name>
- <command>
--k https://%HOSTIP:%HTTPSPORT/%TESTNUMBER --proto-redir -http --location
+</name>
+<command>
+--insecure https://%HOSTIP:%HTTPSPORT/%TESTNUMBER --proto-redir -http --location
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test326 b/third-party/curl/tests/data/test326
index ae3d13b4cc..9069995a6d 100644
--- a/third-party/curl/tests/data/test326
+++ b/third-party/curl/tests/data/test326
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,58 +6,52 @@ HTTP
 HTTP GET
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
-HTTP/1.1 200 OK
-Date: Mon, 29 Nov 2004 21:56:53 GMT
-Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
-Content-Type: text/html; charset=ISO-8859-1
-Transfer-Encoding: chunked
-
-18
+HTTP/1.1 200 OK%CR
+Date: Mon, 29 Nov 2004 21:56:53 GMT%CR
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29%CR
+Content-Type: text/html; charset=ISO-8859-1%CR
+Transfer-Encoding: chunked%CR
+%CR
+18%CR
 line 1
  line 2
   line 3
-
-0
-
+%CR
+0%CR
+%CR
 </data>
 
 <datacheck>
-18
+18%CR
 line 1
  line 2
   line 3
-
-0
-
+%CR
+0%CR
+%CR
 </datacheck>
 
 </reply>
 
-#
 # Client-side
 <client>
-<features>
-!hyper
-</features>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET chunked data in raw mode
- </name>
- <command option="no-include">
+</name>
+<command option="no-include">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --raw
- </command>
+</command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test327 b/third-party/curl/tests/data/test327
index 4215ab5291..ec91b180ec 100644
--- a/third-party/curl/tests/data/test327
+++ b/third-party/curl/tests/data/test327
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -39,10 +40,10 @@ Set-Cookie: foobar=name; expires=Thu, 01 Jan 1970 00:00:00 GMT;
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with cookiejar without cookies left
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -b none -c %LOGDIR/cookies%TESTNUMBER http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER0002
 </command>
 <features>
@@ -52,7 +53,7 @@ cookies
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test328 b/third-party/curl/tests/data/test328
index 2c5bd131de..ad65cb1907 100644
--- a/third-party/curl/tests/data/test328
+++ b/third-party/curl/tests/data/test328
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -26,15 +27,15 @@ Q- What did 0 say to 8? A- Nice Belt!
 http
 </server>
 
-# we're actually more interested in any compression support but this is the
+# we are actually more interested in any compression support but this is the
 # best we can do right now
 <features>
 libz
 </features>
- <name>
+<name>
 HTTP with "Content-Encoding: none
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/hello/%TESTNUMBER --compressed
 </command>
 </client>
@@ -44,7 +45,7 @@ http://%HOSTIP:%HTTPPORT/hello/%TESTNUMBER --compressed
 <strip>
 ^Accept-Encoding:.*
 </strip>
-<protocol>
+<protocol crlf="headers">
 GET /hello/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test329 b/third-party/curl/tests/data/test329
index 4b461b31c3..9aebe92b09 100644
--- a/third-party/curl/tests/data/test329
+++ b/third-party/curl/tests/data/test329
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ cookies
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -20,7 +21,7 @@ Content-Length: 4
 
 boo
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK
 Funny-head: yesyes
 Content-Length: 4
@@ -40,16 +41,16 @@ moo
 <server>
 http
 </server>
- <name>
+<name>
 HTTP cookie with Max-Age=0
- </name>
+</name>
 # Explicitly set the time zone to a known good one, in case the user is
 # using one of the 'right' zones that take into account leap seconds
 # which causes the cookie expiry times to be different.
 <setenv>
 TZ=GMT
 </setenv>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -b %LOGDIR/jar%TESTNUMBER.txt -b %LOGDIR/jar%TESTNUMBER-2.txt -H "Host: host.foo.com" http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER0002
 </command>
 <features>
@@ -59,7 +60,7 @@ cookies
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/%TESTNUMBER HTTP/1.1
 Host: host.foo.com
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test33 b/third-party/curl/tests/data/test33
index 4af0dcb12f..2dab07cf8a 100644
--- a/third-party/curl/tests/data/test33
+++ b/third-party/curl/tests/data/test33
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -20,9 +21,9 @@ HTTP/1.1 200 OK swsclose
 <server>
 http
 </server>
- <name>
+<name>
 HTTP PUT with resume
- </name>
+</name>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 012345678
 012345678
@@ -35,14 +36,14 @@ HTTP PUT with resume
 012345678
 012345678
 </file>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -T%LOGDIR/test%TESTNUMBER.txt -C 50
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Content-Range: bytes 50-99/100
diff --git a/third-party/curl/tests/data/test330 b/third-party/curl/tests/data/test330
index 49e2811e0a..81c88806a1 100644
--- a/third-party/curl/tests/data/test330
+++ b/third-party/curl/tests/data/test330
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ followlocation
 cookies
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -54,16 +54,15 @@ contents
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with custom Cookie: and redirect to new host
- </name>
- <command>
+</name>
+<command>
 http://first.host.it.is/we/want/that/page/%TESTNUMBER -x %HOSTIP:%HTTPPORT -H "Cookie: test=yes" --location
 </command>
 <features>
@@ -71,10 +70,9 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://first.host.it.is/we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: first.host.it.is
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test3300 b/third-party/curl/tests/data/test3300
new file mode 100644
index 0000000000..bc5b41b5e0
--- /dev/null
+++ b/third-party/curl/tests/data/test3300
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+threads
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+thrdpool unit tests
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test3301 b/third-party/curl/tests/data/test3301
new file mode 100644
index 0000000000..3c0e6a5c29
--- /dev/null
+++ b/third-party/curl/tests/data/test3301
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+threads
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+thrdqueue unit tests
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test3302 b/third-party/curl/tests/data/test3302
new file mode 100644
index 0000000000..35ccfc79af
--- /dev/null
+++ b/third-party/curl/tests/data/test3302
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+CURLOPT_GSSAPI_DELEGATION
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+CURLOPT_GSSAPI_DELEGATION stores flags in data->set on GSS-API and SSPI builds
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test3303 b/third-party/curl/tests/data/test3303
new file mode 100644
index 0000000000..697049f013
--- /dev/null
+++ b/third-party/curl/tests/data/test3303
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+TLS
+mTLS
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+conn-reuse match distinguishes mTLS key, cert_type, key_type and key_passwd fields
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test3304 b/third-party/curl/tests/data/test3304
new file mode 100644
index 0000000000..4380c0819f
--- /dev/null
+++ b/third-party/curl/tests/data/test3304
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+TLS
+mTLS
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+unittest
+</features>
+<name>
+TLS session cache peer key discriminates on mTLS key, key_type and cert_type fields
+</name>
+</client>
+</testcase>
diff --git a/third-party/curl/tests/data/test3305 b/third-party/curl/tests/data/test3305
new file mode 100644
index 0000000000..7a6d63beee
--- /dev/null
+++ b/third-party/curl/tests/data/test3305
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+cookies
+--resolve
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 301 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 6
+Set-Cookie: this=secret; domain=example.com; secure; path=/
+Set-Cookie: that=secret; domain=www.example.com; secure; path=/
+Set-Cookie: second=fine;
+
+-foo-
+</data>
+
+# The cookie 'this' should not be accepted since it would be the same as already
+# set with a 'secure' flag.
+# The cookie 'second' is however not secure so it is fair game to override
+<data2>
+HTTP/1.1 301 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 6
+Set-Cookie: this=open; path=/
+Set-Cookie: that=open; path=/; domain=example.com
+Set-Cookie: second=override
+
+-foo-
+</data2>
+
+<data3>
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 6
+
+-foo-
+</data3>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+https
+</server>
+<name>
+same-name cookie over HTTPS and HTTP with different domains
+</name>
+<command>
+https://www.example.com:%HTTPSPORT/ http://www.example.com:%HTTPPORT/%TESTNUMBER0002 https://www.example.com:%HTTPSPORT/%TESTNUMBER0003 --insecure -c %LOGDIR/cookie%TESTNUMBER --resolve www.example.com:%HTTPSPORT:%HOSTIP --resolve www.example.com:%HTTPPORT:%HOSTIP
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET / HTTP/1.1
+Host: www.example.com:%HTTPSPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER0002 HTTP/1.1
+Host: www.example.com:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Cookie: second=fine
+
+GET /%TESTNUMBER0003 HTTP/1.1
+Host: www.example.com:%HTTPSPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Cookie: second=override; that=secret; this=secret
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test331 b/third-party/curl/tests/data/test331
index 4dca140058..21cb3e59ee 100644
--- a/third-party/curl/tests/data/test331
+++ b/third-party/curl/tests/data/test331
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -36,10 +37,10 @@ Funny-head: yesyes swsclose
 <server>
 http
 </server>
- <name>
-HTTP with cookie using host name 'moo'
- </name>
- <command>
+<name>
+HTTP with cookie using hostname 'moo'
+</name>
+<command>
 -x http://%HOSTIP:%HTTPPORT http://moo/we/want/%TESTNUMBER -b none http://moo/we/want/%TESTNUMBER0002
 </command>
 <features>
@@ -50,7 +51,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://moo/we/want/%TESTNUMBER HTTP/1.1
 Host: moo
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test332 b/third-party/curl/tests/data/test332
index 54763eda0e..e968c26fe4 100644
--- a/third-party/curl/tests/data/test332
+++ b/third-party/curl/tests/data/test332
@@ -1,9 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 TFTP
 TFTP RRQ
-FAILURE
 </keywords>
 </info>
 
@@ -16,21 +16,19 @@ returned
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 tftp
 </server>
- <name>
+<name>
 TFTP retrieve with blksize 400
- </name>
- <command>
+</name>
+<command>
 tftp://%HOSTIP:%TFTPPORT//%TESTNUMBER --tftp-blksize 400
 </command>
 </client>
 
-#
 # Verify pseudo protocol after the test has been "shot"
 <verify>
 <strip>
diff --git a/third-party/curl/tests/data/test333 b/third-party/curl/tests/data/test333
index e0fc450d54..3206be75e7 100644
--- a/third-party/curl/tests/data/test333
+++ b/third-party/curl/tests/data/test333
@@ -1,30 +1,25 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
-command-line
+cmdline
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
- <name>
+<name>
 Try a non-boolean command line option with --no-
- </name>
- <command>
+</name>
+<command>
 --no-proxy "hey" http://%HOSTIP:%NOLISTENPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # detected the bad --no- prefix
diff --git a/third-party/curl/tests/data/test334 b/third-party/curl/tests/data/test334
index a001a59408..1785071e1e 100644
--- a/third-party/curl/tests/data/test334
+++ b/third-party/curl/tests/data/test334
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -31,7 +32,7 @@ http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test335 b/third-party/curl/tests/data/test335
index 63a54b3820..8824820fbe 100644
--- a/third-party/curl/tests/data/test335
+++ b/third-party/curl/tests/data/test335
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Mostly a duplicate of test168
 <info>
@@ -62,18 +63,19 @@ http
 !SSPI
 crypto
 proxy
+digest
 </features>
- <name>
+<name>
 HTTP with proxy Digest and site Digest with creds in URLs
- </name>
- <command>
-http://digest:alot@data.from.server.requiring.digest.hohoho.com/%TESTNUMBER --proxy http://foo:bar@%HOSTIP:%HTTPPORT --proxy-digest --digest
+</name>
+<command>
+http://digest:a-lot@data.from.server.requiring.digest.hohoho.com/%TESTNUMBER --proxy http://foo:bar@%HOSTIP:%HTTPPORT --proxy-digest --digest
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://data.from.server.requiring.digest.hohoho.com/%TESTNUMBER HTTP/1.1
 Host: data.from.server.requiring.digest.hohoho.com
 User-Agent: curl/%VERSION
@@ -90,7 +92,7 @@ Proxy-Connection: Keep-Alive
 GET http://data.from.server.requiring.digest.hohoho.com/%TESTNUMBER HTTP/1.1
 Host: data.from.server.requiring.digest.hohoho.com
 Proxy-Authorization: Digest username="foo", realm="weirdorealm", nonce="12345", uri="/%TESTNUMBER", response="f61609cd8f5bb205ef4e169b2c5626cb"
-Authorization: Digest username="digest", realm="realmweirdo", nonce="123456", uri="/%TESTNUMBER", response="08a2e2e684047f4219a38ddc189ac00c"
+Authorization: Digest username="digest", realm="realmweirdo", nonce="123456", uri="/%TESTNUMBER", response="ea0f4cb7a119a1a6f6c6c6c2e4190860"
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test336 b/third-party/curl/tests/data/test336
index e237183dd2..5eb65da1a7 100644
--- a/third-party/curl/tests/data/test336
+++ b/third-party/curl/tests/data/test336
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -31,17 +32,17 @@ REPLY SIZE 500 no such command
 <server>
 ftp
 </server>
- <name>
-FTP range download when SIZE doesn't work
- </name>
- <command>
+<name>
+FTP range download when SIZE does not work
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --range 3-6
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test337 b/third-party/curl/tests/data/test337
index ee3a183c9c..4542885cf0 100644
--- a/third-party/curl/tests/data/test337
+++ b/third-party/curl/tests/data/test337
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -31,17 +32,17 @@ REPLY SIZE 213 file: 213, Size =51
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP range download with SIZE returning extra crap
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --range 3-6
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test338 b/third-party/curl/tests/data/test338
index 43c8b3892c..dd83ad3f6c 100644
--- a/third-party/curl/tests/data/test338
+++ b/third-party/curl/tests/data/test338
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # See https://github.com/curl/curl/issues/4499
 <info>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -28,24 +28,22 @@ connection-monitor
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 ANYAUTH connection reuse of non-authed connection
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --next http://%HOSTIP:%HTTPPORT/%TESTNUMBER --anyauth -u foo:moo
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test339 b/third-party/curl/tests/data/test339
index c40db2cd0a..f416c5776f 100644
--- a/third-party/curl/tests/data/test339
+++ b/third-party/curl/tests/data/test339
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,31 +6,29 @@ HTTP
 HTTP GET
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data nocheck="yes">
-HTTP/1.1 200 funky chunky!
-Server: fakeit/0.9 fakeitbad/1.0
-Transfer-Encoding: chunked
-Trailer: chunky-trailer
-Connection: mooo
-ETag: W/"asdf"
-
-40
-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-30
-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
-21;heresatest=moooo
+HTTP/1.1 200 funky chunky!%CR
+Server: fakeit/0.9 fakeitbad/1.0%CR
+Transfer-Encoding: chunked%CR
+Trailer: chunky-trailer%CR
+Connection: mooo%CR
+ETag: W/"asdf"%CR
+%CR
+40%CR
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%CR
+30%CR
+bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%CR
+21;heresatest=moooo%CR
 cccccccccccccccccccccccccccccccc
-
-0
-chunky-trailer: header data
-
+%CR
+0%CR
+chunky-trailer: header data%CR
+%CR
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -43,10 +42,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --etag-save %LOGDIR/etag%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test34 b/third-party/curl/tests/data/test34
index 18ddc8e77c..0982f951e9 100644
--- a/third-party/curl/tests/data/test34
+++ b/third-party/curl/tests/data/test34
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 chunked Transfer-Encoding
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -15,15 +15,15 @@ Server: fakeit/0.9 fakeitbad/1.0
 Transfer-Encoding: chunked
 Connection: mooo
 
-40
-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-30
-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
-21;heresatest=moooo
+40%CR
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%CR
+30%CR
+bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%CR
+21;heresatest=moooo%CR
 cccccccccccccccccccccccccccccccc
-
-0
-
+%CR
+0%CR
+%CR
 </data>
 <datacheck>
 HTTP/1.1 200 funky chunky!
@@ -35,24 +35,22 @@ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbb
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with chunked Transfer-Encoding
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test340 b/third-party/curl/tests/data/test340
index d8aabc4600..0d2a6a92f4 100644
--- a/third-party/curl/tests/data/test340
+++ b/third-party/curl/tests/data/test340
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ CWD
 singlecwd
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 </reply>
@@ -18,17 +18,17 @@ singlecwd
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP using %00 in path with singlecwd
- </name>
- <command>
+</name>
+<command>
 --ftp-method singlecwd ftp://%HOSTIP:%FTPPORT/%00first/second/third/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test3400 b/third-party/curl/tests/data/test3400
new file mode 100644
index 0000000000..12d014bffd
--- /dev/null
+++ b/third-party/curl/tests/data/test3400
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+unittest
+capsule
+</keywords>
+</info>
+
+<client>
+<features>
+unittest
+</features>
+<name>
+capsule protocol encode and decode unit tests
+</name>
+</client>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test3401 b/third-party/curl/tests/data/test3401
new file mode 100644
index 0000000000..0c88738ec2
--- /dev/null
+++ b/third-party/curl/tests/data/test3401
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTPS proxy
+cookies
+Secure
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 4
+
+foo
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+https-proxy
+</server>
+<features>
+HTTPS-proxy
+cookies
+</features>
+<name>
+HTTP via HTTPS proxy does not send Secure cookies
+</name>
+<command>
+-x https://%HOSTIP:%HTTPSPROXYPORT --proxy-insecure -b %LOGDIR/jar%TESTNUMBER.txt http://test.example/%TESTNUMBER
+</command>
+<file name="%LOGDIR/jar%TESTNUMBER.txt">
+# Netscape HTTP Cookie File
+test.example	FALSE	/	TRUE	9999999999	session	secret
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<proxy crlf="headers">
+GET http://test.example/%TESTNUMBER HTTP/1.1
+Host: test.example
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</proxy>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test341 b/third-party/curl/tests/data/test341
index b1a00ff490..0d204a4f13 100644
--- a/third-party/curl/tests/data/test341
+++ b/third-party/curl/tests/data/test341
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,17 +6,16 @@ HTTP
 HTTP GET
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data nocheck="yes">
-HTTP/1.1 200 funky chunky!
-Server: fakeit/0.9 fakeitbad/1.0
-Transfer-Encoding: chunked
-Trailer: chunky-trailer
-Connection: mooo
-ETag: "asdf"
-
+HTTP/1.1 200 funky chunky!%CR
+Server: fakeit/0.9 fakeitbad/1.0%CR
+Transfer-Encoding: chunked%CR
+Trailer: chunky-trailer%CR
+Connection: mooo%CR
+ETag: "asdf"%CR
+%CR
 40
 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
 30
@@ -29,26 +29,29 @@ chunky-trailer: header data
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 <name>
-Try to open a non existing file with --etag-compare should return an error
+A non existing file with --etag-compare is a blank
 </name>
 <command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --etag-compare %LOGDIR/etag%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<errorcode>
-26
-</errorcode>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+If-None-Match: ""
+
+</protocol>
 </verify>
 
 </testcase>
diff --git a/third-party/curl/tests/data/test342 b/third-party/curl/tests/data/test342
index 6021e48014..81f4e479e8 100644
--- a/third-party/curl/tests/data/test342
+++ b/third-party/curl/tests/data/test342
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -24,7 +24,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -41,10 +40,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --etag-compare %LOGDIR/etag%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test343 b/third-party/curl/tests/data/test343
index 2027f88d71..5ab28ece13 100644
--- a/third-party/curl/tests/data/test343
+++ b/third-party/curl/tests/data/test343
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -24,7 +24,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -41,10 +40,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --etag-compare %LOGDIR/etag%TESTNUMBER --et
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test344 b/third-party/curl/tests/data/test344
index 43ce8d437a..2497a82045 100644
--- a/third-party/curl/tests/data/test344
+++ b/third-party/curl/tests/data/test344
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -24,7 +24,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -38,10 +37,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --etag-compare %LOGDIR/etag%TESTNUMBER --et
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test345 b/third-party/curl/tests/data/test345
index 897c1b5fb7..d87cf0696c 100644
--- a/third-party/curl/tests/data/test345
+++ b/third-party/curl/tests/data/test345
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -24,7 +24,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -41,10 +40,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --etag-compare %LOGDIR/etag%TESTNUMBER --et
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test346 b/third-party/curl/tests/data/test346
index fa732e662a..9a4833a6eb 100644
--- a/third-party/curl/tests/data/test346
+++ b/third-party/curl/tests/data/test346
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ proxy
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -25,7 +25,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -42,13 +41,12 @@ HTTP GET over proxy with credentials using blank passwords
 </command>
 </client>
 
-#
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://remote.example/%TESTNUMBER HTTP/1.1
 Host: remote.example
-Proxy-Authorization: Basic cHVzZXI6
-Authorization: Basic c3VzZXI6
+Proxy-Authorization: Basic %b64[puser:]b64%
+Authorization: Basic %b64[suser:]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test347 b/third-party/curl/tests/data/test347
index 98f0fe15d3..31c3b970c2 100644
--- a/third-party/curl/tests/data/test347
+++ b/third-party/curl/tests/data/test347
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,31 +6,29 @@ HTTP
 HTTP GET
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data nocheck="yes">
-HTTP/1.1 200 funky chunky!
-Server: fakeit/0.9 fakeitbad/1.0
-Transfer-Encoding: chunked
-Trailer: chunky-trailer
-Connection: mooo
-ETag:  
-
-40
-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-30
-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
-21;heresatest=moooo
+HTTP/1.1 200 funky chunky!%CR
+Server: fakeit/0.9 fakeitbad/1.0%CR
+Transfer-Encoding: chunked%CR
+Trailer: chunky-trailer%CR
+Connection: mooo%CR
+ETag:  %CR
+%CR
+40%CR
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%CR
+30%CR
+bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%CR
+21;heresatest=moooo%CR
 cccccccccccccccccccccccccccccccc
-
-0
-chunky-trailer: header data
-
+%CR
+0%CR
+chunky-trailer: header data%CR
+%CR
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -43,10 +42,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --etag-save %LOGDIR/etag%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test348 b/third-party/curl/tests/data/test348
index bfa27788e5..7155da7665 100644
--- a/third-party/curl/tests/data/test348
+++ b/third-party/curl/tests/data/test348
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -18,9 +19,9 @@ STOR 552 disk full
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP upload file with 552 disk full response
- </name>
+</name>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 data
     to
@@ -29,7 +30,7 @@ that FTP
 works
   so does it?
 </file>
- <command>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T %LOGDIR/test%TESTNUMBER.txt
 </command>
 </client>
@@ -44,7 +45,7 @@ that FTP
 works
   so does it?
 </upload>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test349 b/third-party/curl/tests/data/test349
index cf4be6eaae..dee9e3facd 100644
--- a/third-party/curl/tests/data/test349
+++ b/third-party/curl/tests/data/test349
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,7 +13,7 @@ HTTP GET
 HTTP/1.0 404 BAD BOY swsclose
 Content-Type: text/html
 
-This silly page doesn't reaaaaaly exist so you should not get it.
+This silly page does not reaaaaaly exist so you should not get it.
 </data>
 </reply>
 
@@ -21,17 +22,17 @@ This silly page doesn't reaaaaaly exist so you should not get it.
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET --fail-with-body on HTTP error return
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --fail-with-body
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test35 b/third-party/curl/tests/data/test35
index 33e6eac73f71ea9faa3830c62498bb611d327a0e..04f5093c0dcbaa65a27619cdbdb988fdbc0a8233 100644
GIT binary patch
delta 207
zcmcb}HiKQu#=asqN1-gWs5mn}&sND$&p=5bH7_|oB{MJGRw*=C*D=`H(^JXbj%xwq
zWJX4P4jcWv#N1RnuE|!6(|J@gQY)fEGBS%*4Gbn<W7K4g1q!H6{?8c9uaI1nlV+=w
zk(!tSG+b$N5R-}omq&haiIsw?hktO0XMmNeM@UFOfPYZP<Oxht@?4I|$*BcEX)S#%
kF6aEblGMBsU7ysv^pXrK1rzhhXP6B5xVUiGsK=}f0F=f)iU0rr

delta 134
zcmbQievxgV79*p=WGzO0E(II?yu{p8J1&LEiHy@(Lozap878|kYfd&|3Z6WLNkxj6
z%Ok(I#7aTc!#_C0Gr&sKBP1jsz&|L2ck%@$DJ5Pm$K>SH0-ypdeJx%t=lr~q)Vva1
dpVYkck_;;a6La3loXiHCyj;9o2(wF>l>v#4Bc%WU

diff --git a/third-party/curl/tests/data/test350 b/third-party/curl/tests/data/test350
index 6b4ac30749..66f76d9226 100644
--- a/third-party/curl/tests/data/test350
+++ b/third-party/curl/tests/data/test350
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,9 @@ PASV
 LIST
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -23,27 +21,25 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP root dir list multicwd
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT// --ftp-method multicwd
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test351 b/third-party/curl/tests/data/test351
index 81598158ac..f8d26b7354 100644
--- a/third-party/curl/tests/data/test351
+++ b/third-party/curl/tests/data/test351
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,9 @@ PASV
 LIST
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -23,27 +21,25 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP root dir list nocwd
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT// --ftp-method nocwd
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test352 b/third-party/curl/tests/data/test352
index 0a0d423381..05d114f2e2 100644
--- a/third-party/curl/tests/data/test352
+++ b/third-party/curl/tests/data/test352
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,9 @@ PASV
 LIST
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -23,27 +21,25 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP root dir list singlecwd
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT// --ftp-method singlecwd
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test353 b/third-party/curl/tests/data/test353
index f9e47153f9..670bef5141 100644
--- a/third-party/curl/tests/data/test353
+++ b/third-party/curl/tests/data/test353
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,9 @@ PASV
 LIST
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -23,27 +21,25 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP home dir list singlecwd
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/ --ftp-method singlecwd
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test354 b/third-party/curl/tests/data/test354
index 6217f1c917..c7a7d56181 100644
--- a/third-party/curl/tests/data/test354
+++ b/third-party/curl/tests/data/test354
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -26,10 +27,10 @@ REPLY USER 200 fine, proceed without password
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP without password
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 
@@ -37,7 +38,7 @@ ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PWD
 EPSV
diff --git a/third-party/curl/tests/data/test355 b/third-party/curl/tests/data/test355
index f4202f6281..5c74321ac2 100644
--- a/third-party/curl/tests/data/test355
+++ b/third-party/curl/tests/data/test355
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ Alt-Svc
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -21,30 +21,32 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 alt-svc
+Debug
 </features>
+<setenv>
+CURL_ALTSVC_HTTP=1
+</setenv>
 <server>
 http
 </server>
- <name>
-load Alt-Svc from file and use
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER --alt-svc ""
+<name>
+Alt-Svc from file with too long date
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --alt-svc "%LOGDIR/altsvc-%TESTNUMBER"
 </command>
 <file name="%LOGDIR/altsvc-%TESTNUMBER">
-h1 example.com 80 h1 %HOSTIP %HTTPPORT "20290222 22:19:28" 0 0
+h1 %HOSTIP %HTTPPORT h1 example.com 80 "20290222 22:19:028" 0 0
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test356 b/third-party/curl/tests/data/test356
index a1b83748dd..b9226af87a 100644
--- a/third-party/curl/tests/data/test356
+++ b/third-party/curl/tests/data/test356
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ Alt-Svc
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -25,32 +25,30 @@ Alt-Svc: h1="nowhere.foo:70000"
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-debug
+Debug
 alt-svc
 </features>
 <server>
 http
 </server>
- <name>
+<name>
 parse incoming Alt-Svc and save to file
- </name>
+</name>
 <setenv>
-# make debug-curl accept Alt-Svc over plain HTTP
+# make Debug-curl accept Alt-Svc over plain HTTP
 CURL_ALTSVC_HTTP="yeah"
 </setenv>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --alt-svc "%LOGDIR/altsvc-%TESTNUMBER"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test357 b/third-party/curl/tests/data/test357
index ba332a0d4f..c6b11bd83c 100644
--- a/third-party/curl/tests/data/test357
+++ b/third-party/curl/tests/data/test357
@@ -1,14 +1,15 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP PUT
-Expect
+Expect: 100-continue
 </keywords>
 </info>
 # Server-side
 <reply>
-# 417 means the server didn't like the Expect header
+# 417 means the server did not like the Expect header
 <data>
 HTTP/1.1 417 BAD swsbounce
 Date: Tue, 09 Nov 2010 14:49:00 GMT
@@ -47,11 +48,14 @@ no-expect
 <server>
 http
 </server>
- <name>
+<features>
+!torture
+</features>
+<name>
 HTTP PUT with Expect: 100-continue and 417 response
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -T %LOGDIR/test%TESTNUMBER.txt
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -T %LOGDIR/test%TESTNUMBER.txt --expect100-timeout 99
 </command>
 # 1053700 x 'x', large enough to invoke the 100-continue behaviour
 <file name="%LOGDIR/test%TESTNUMBER.txt">
@@ -61,7 +65,7 @@ http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -T %LOGDIR/test%TESTNUMBER.txt
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /we/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test358 b/third-party/curl/tests/data/test358
index a6faeede59..99035cc049 100644
--- a/third-party/curl/tests/data/test358
+++ b/third-party/curl/tests/data/test358
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ HTTP/2
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
@@ -24,26 +24,25 @@ Alt-Svc: h2=":%HTTP2PORT", ma=315360000; persist=0
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 alt-svc
-debug
+Debug
 h2c
 </features>
 <server>
 http
 http/2
 </server>
- <name>
-HTTPS GET translated by alt-svc lookup to HTTP/2 GET
- </name>
+<name>
+HTTP GET translated by alt-svc lookup to HTTP/2 GET
+</name>
 <setenv>
-# make debug-curl accept Alt-Svc over plain HTTP
+# make Debug-curl accept Alt-Svc over plain HTTP
 CURL_ALTSVC_HTTP="yeah"
 </setenv>
- <command>
+<command>
 --http2 --alt-svc "%LOGDIR/altsvc-%TESTNUMBER" "http://%HOSTIP:%HTTPPORT/%TESTNUMBER" "http://%HOSTIP:%HTTPPORT/%TESTNUMBER"
 </command>
 <file name="%LOGDIR/altsvc-%TESTNUMBER">
@@ -52,15 +51,14 @@ h2 %HOSTIP %HTTPPORT h2 %HOSTIP %HTTP2PORT "20290222 22:19:28" 0 0
 
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 101 Switching Protocols
 Connection: Upgrade
 Upgrade: h2c
 
-HTTP/2 200 
+HTTP/2 200%SP
 date: Tue, 09 Nov 2010 14:49:00 GMT
 content-length: 6
 content-type: text/html
@@ -69,7 +67,7 @@ alt-svc: h2=":%HTTP2PORT", ma=315360000; persist=0
 via: 1.1 nghttpx
 
 -foo-
-HTTP/2 200 
+HTTP/2 200%SP
 date: Tue, 09 Nov 2010 14:49:00 GMT
 content-length: 6
 content-type: text/html
diff --git a/third-party/curl/tests/data/test359 b/third-party/curl/tests/data/test359
index e86fb0808d..bbb77e697c 100644
--- a/third-party/curl/tests/data/test359
+++ b/third-party/curl/tests/data/test359
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ HTTP/2
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
@@ -24,26 +24,25 @@ Alt-Svc: h2=":%HTTP2PORT", ma=315360000; persist=0
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 alt-svc
-debug
+Debug
 h2c
 </features>
 <server>
 https
 http/2
 </server>
- <name>
+<name>
 HTTPS GET translated by alt-svc lookup to HTTP/2 GET
- </name>
+</name>
 <setenv>
-# make debug-curl accept Alt-Svc over plain HTTP
+# make Debug-curl accept Alt-Svc over plain HTTP
 CURL_ALTSVC_HTTP="yeah"
 </setenv>
- <command>
+<command>
 --http2 --alt-svc "%LOGDIR/altsvc-%TESTNUMBER" "http://%HOSTIP:%HTTPSPORT/%TESTNUMBER" "http://%HOSTIP:%HTTPSPORT/%TESTNUMBER"
 </command>
 <file name="%LOGDIR/altsvc-%TESTNUMBER">
@@ -52,15 +51,14 @@ h2 %HOSTIP %HTTPSPORT h2 %HOSTIP %HTTP2PORT "20290222 22:19:28" 0 0
 
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 101 Switching Protocols
 Connection: Upgrade
 Upgrade: h2c
 
-HTTP/2 200 
+HTTP/2 200%SP
 date: Tue, 09 Nov 2010 14:49:00 GMT
 content-length: 6
 content-type: text/html
@@ -69,7 +67,7 @@ alt-svc: h2=":%HTTP2PORT", ma=315360000; persist=0
 via: 1.1 nghttpx
 
 -foo-
-HTTP/2 200 
+HTTP/2 200%SP
 date: Tue, 09 Nov 2010 14:49:00 GMT
 content-length: 6
 content-type: text/html
diff --git a/third-party/curl/tests/data/test36 b/third-party/curl/tests/data/test36
index 187e5979dd..a99e560bdc 100644
--- a/third-party/curl/tests/data/test36
+++ b/third-party/curl/tests/data/test36
@@ -1,13 +1,12 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
 chunked Transfer-Encoding
-FAILURE
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -16,11 +15,11 @@ Server: fakeit/0.9 fakeitbad/1.0
 Transfer-Encoding: chunked
 Connection: mooo
 
-2
+2%CR
 a
-
-ILLEGAL
-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
+%CR
+ILLEGAL%CR
+bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%CR
 </data>
 <datacheck>
 HTTP/1.1 200 funky chunky!
@@ -32,27 +31,25 @@ a
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with bad chunked Transfer-Encoding
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 56
 </errorcode>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test360 b/third-party/curl/tests/data/test360
index e67c847ed5..74dec3f707 100644
--- a/third-party/curl/tests/data/test360
+++ b/third-party/curl/tests/data/test360
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,23 +7,39 @@
 </keywords>
 </info>
 
-# Client-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 Error on both --fail-with-body and --fail
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER --fail-with-body --fail
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --fail-with-body --fail --no-progress-meter
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<errorcode>
-2
-</errorcode>
+<stderr mode="text">
+Warning: --fail deselects --fail-with-body here
+</stderr>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test361 b/third-party/curl/tests/data/test361
index 4c0d0b3b5d..67d50a1bd1 100644
--- a/third-party/curl/tests/data/test361
+++ b/third-party/curl/tests/data/test361
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,7 +13,7 @@ HTTP GET
 HTTP/1.0 404 BAD BOY swsclose
 Content-Type: text/html
 
-This silly page doesn't reaaaaaly exist so you should not get it.
+This silly page does not reaaaaaly exist so you should not get it.
 </data>
 </reply>
 
@@ -21,17 +22,17 @@ This silly page doesn't reaaaaaly exist so you should not get it.
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET --fail-with-body on HTTP error return - twice
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER --fail-with-body
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test362 b/third-party/curl/tests/data/test362
index 8364fbfc1d..a78782e70b 100644
--- a/third-party/curl/tests/data/test362
+++ b/third-party/curl/tests/data/test362
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,9 +13,9 @@ STOR
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP resume upload file with nothing to start from
- </name>
+</name>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 data
     to
@@ -23,7 +24,7 @@ that FTP
 works
   so does it?
 </file>
- <command>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T %LOGDIR/test%TESTNUMBER.txt --continue-at -
 </command>
 </client>
@@ -37,7 +38,7 @@ that FTP
 works
   so does it?
 </upload>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test363 b/third-party/curl/tests/data/test363
index 40318833d7..8269040f3a 100644
--- a/third-party/curl/tests/data/test363
+++ b/third-party/curl/tests/data/test363
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ proxytunnel
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -21,13 +21,13 @@ Content-Length: 9
 
 contents
 </data>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 
 </connect>
 <datacheck>
-HTTP/1.1 200 Mighty fine indeed
-
+HTTP/1.1 200 Mighty fine indeed%CR
+%CR
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -39,42 +39,40 @@ contents
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-debug
+Debug
 proxy
 </features>
 <server>
 http
 http-proxy
 </server>
- <name>
+<name>
 CONNECT with short sends
- </name>
+</name>
 <setenv>
 # make the first send cut off after this amount of data
 CURL_SMALLREQSEND=8
 # make repeated sends small too
 CURL_SMALLSENDS=8
 </setenv>
- <command>
+<command>
 http://test.%TESTNUMBER:%HTTPPORT/we/want/that/page/%TESTNUMBER -p -x %HOSTIP:%PROXYPORT -d "datatopost=ohthatsfunyesyes"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 CONNECT test.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: test.%TESTNUMBER:%HTTPPORT
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
 </proxy>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: test.%TESTNUMBER:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test364 b/third-party/curl/tests/data/test364
index e60ccf887b..d56a0c618e 100644
--- a/third-party/curl/tests/data/test364
+++ b/third-party/curl/tests/data/test364
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -24,11 +25,11 @@ SSL
 <server>
 https
 </server>
- <name>
+<name>
 HTTPS PUT of small file
- </name>
- <command>
--k https://%HOSTIP:%HTTPSPORT/we/want/%TESTNUMBER -T %LOGDIR/test%TESTNUMBER.txt
+</name>
+<command>
+--insecure https://%HOSTIP:%HTTPSPORT/we/want/%TESTNUMBER -T %LOGDIR/test%TESTNUMBER.txt
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 %repeat[200 x banana]%
@@ -37,7 +38,7 @@ HTTPS PUT of small file
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /we/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test365 b/third-party/curl/tests/data/test365
index ba32ce6f9c..899b99ce64 100644
--- a/third-party/curl/tests/data/test365
+++ b/third-party/curl/tests/data/test365
@@ -1,13 +1,13 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
-Chunked
+chunked Transfer-Encoding
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -19,10 +19,10 @@ Transfer-Encoding: chunked
 Content-Type: text/html
 Funny-head: yesyes
 
-10
-chunked data fun
-0
-
+10%CR
+chunked data fun%CR
+0%CR
+%CR
 </data>
 <datacheck nonewline="yes">
 HTTP/1.1 200 OK
@@ -37,24 +37,22 @@ chunked data fun
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP/1.1 with chunked AND Content-Length headers
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test366 b/third-party/curl/tests/data/test366
index ec35ff34af..2ffc59963c 100644
--- a/third-party/curl/tests/data/test366
+++ b/third-party/curl/tests/data/test366
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 retry
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -20,24 +20,22 @@ server not available
 
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP --retry-max-time with too long Retry-After
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --retry 2 --retry-max-time 10
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test367 b/third-party/curl/tests/data/test367
index 0062a40ee7..1b4051a3fa 100644
--- a/third-party/curl/tests/data/test367
+++ b/third-party/curl/tests/data/test367
@@ -1,13 +1,13 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
-Basic
+HTTP Basic auth
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -19,27 +19,25 @@ Connection: close
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 <name>
-Empty user name provided in URL
+Empty username provided in URL
 </name>
 <command>
 http://:example@%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic OmV4YW1wbGU=
+Authorization: Basic %b64[:example]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test368 b/third-party/curl/tests/data/test368
index 8f7cd1574c..1aa3e5a6e8 100644
--- a/third-party/curl/tests/data/test368
+++ b/third-party/curl/tests/data/test368
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ Range
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -20,24 +20,22 @@ Connection: close
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 Append dash if -r range specified without one
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -r 4
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Range: bytes=4-
diff --git a/third-party/curl/tests/data/test369 b/third-party/curl/tests/data/test369
index 65dbb5e2f2..df6bc32405 100644
--- a/third-party/curl/tests/data/test369
+++ b/third-party/curl/tests/data/test369
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ etag
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -19,7 +19,6 @@ hej
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -33,10 +32,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --etag-save %LOGDIR/nowhere/etag%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test37 b/third-party/curl/tests/data/test37
index 7b60afaa5c..46f994f1e7 100644
--- a/third-party/curl/tests/data/test37
+++ b/third-party/curl/tests/data/test37
@@ -1,39 +1,36 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
-FAILURE
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with nothing returned from server
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 52
 </errorcode>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test370 b/third-party/curl/tests/data/test370
index 671e35f635..71e869a056 100644
--- a/third-party/curl/tests/data/test370
+++ b/third-party/curl/tests/data/test370
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,17 +8,12 @@ etag
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <name>
 --etag-save with bad path - no transfer
 </name>
@@ -26,7 +22,6 @@ http://%HOSTIP:%NOLISTENPORT/%TESTNUMBER --etag-save %LOGDIR/nowhere/etag%TESTNU
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test371 b/third-party/curl/tests/data/test371
index 9d540f06cb..3391981c27 100644
--- a/third-party/curl/tests/data/test371
+++ b/third-party/curl/tests/data/test371
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -25,24 +25,22 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 using more -o than URLs in the command line
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -o %LOGDIR/dump -o %LOGDIR/dump2 --no-progress-meter
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test372 b/third-party/curl/tests/data/test372
index f35ad6eac3..62250f4f50 100644
--- a/third-party/curl/tests/data/test372
+++ b/third-party/curl/tests/data/test372
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,7 @@ HTTP GET
 </info>
 
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Thu, 22 Jul 2010 11:22:33 GMT
 Connection: close
@@ -35,7 +36,7 @@ proxy
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /binary-zero-in-data-section/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test373 b/third-party/curl/tests/data/test373
index f10eae8e84..481a0d9cf5 100644
--- a/third-party/curl/tests/data/test373
+++ b/third-party/curl/tests/data/test373
@@ -1,38 +1,39 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
-chunked transfer encoding
+chunked Transfer-Encoding
 </keywords>
 </info>
 
 <reply>
 <data>
-HTTP/1.1 200 OK
-Date: Thu, 22 Jul 2010 11:22:33 GMT
-Connection: close
-Content-Type: text/html
-Transfer-Encoding: chunked
-X-Control: swsclose
-
-100
+HTTP/1.1 200 OK%CR
+Date: Thu, 22 Jul 2010 11:22:33 GMT%CR
+Connection: close%CR
+Content-Type: text/html%CR
+Transfer-Encoding: chunked%CR
+X-Control: swsclose%CR
+%CR
+100%CR
 %repeat[255 x %00]%
-
-100
+%CR
+100%CR
 %repeat[255 x %00]%
-
-100
+%CR
+100%CR
 %repeat[255 x %00]%
-
-100
+%CR
+100%CR
 %repeat[255 x %00]%
-
-0
-
+%CR
+0%CR
+%CR
 </data>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Thu, 22 Jul 2010 11:22:33 GMT
 Connection: close
@@ -64,7 +65,7 @@ http://%HOSTIP:%HTTPPORT/chunked-transfer-encoding/%TESTNUMBER
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /chunked-transfer-encoding/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test374 b/third-party/curl/tests/data/test374
index ff7f11bc4f..0bb9daaf93 100644
--- a/third-party/curl/tests/data/test374
+++ b/third-party/curl/tests/data/test374
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ gif data
 </info>
 
 <reply>
-<data nonewline="yes">
+<data crlf="headers" nonewline="yes">
 HTTP/1.1 200 OK
 Date: Thu, 22 Jul 2010 11:22:33 GMT
 Connection: close
@@ -35,7 +36,7 @@ http://%HOSTIP:%HTTPPORT/gif/%TESTNUMBER
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /gif/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test375 b/third-party/curl/tests/data/test375
index aefc8e4ac8..d0a05a10e9 100644
--- a/third-party/curl/tests/data/test375
+++ b/third-party/curl/tests/data/test375
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,9 +10,6 @@ CURL_DISABLE_PROXY
 <features>
 !proxy
 </features>
-<server>
-none
-</server>
 <name>
 Disabled proxy should make curl fail with --proxy
 </name>
@@ -20,7 +18,6 @@ Disabled proxy should make curl fail with --proxy
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <stderr mode="text">
diff --git a/third-party/curl/tests/data/test376 b/third-party/curl/tests/data/test376
index e1a1f871bd..fff3736eef 100644
--- a/third-party/curl/tests/data/test376
+++ b/third-party/curl/tests/data/test376
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Crafted to cause error 18
 <reply>
 <data nocheck="yes">
@@ -25,31 +25,25 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 --remove-on-error
- </name>
- <command option="no-output">
+</name>
+<command option="no-output">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -o %LOGDIR/save-%TESTNUMBER --remove-on-error
 </command>
 </client>
 
-#
-# Verify data after the test has been "shot". hyper doesn't do error 18
+# Verify data after the test has been "shot"
 <verify>
 <errorcode>
-%if hyper
-56
-%else
 18
-%endif
 </errorcode>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test378 b/third-party/curl/tests/data/test378
index ca908b7aa0..d4c2b68b14 100644
--- a/third-party/curl/tests/data/test378
+++ b/third-party/curl/tests/data/test378
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,33 +7,27 @@ HTTP POST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
- <name>
+<name>
 Reject using -T and -d at once
- </name>
- <command>
+</name>
+<command>
 -T %LOGDIR/%TESTNUMBER -d input http://never-accessed
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 2
 </errorcode>
 <stderr mode="text">
-Warning: You can only select one HTTP request method! You asked for both PUT 
+Warning: You can only select one HTTP request method! You asked for both PUT%SP
 Warning: (-T, --upload-file) and POST (-d, --data).
 </stderr>
 </verify>
diff --git a/third-party/curl/tests/data/test379 b/third-party/curl/tests/data/test379
index 23913140d9..9405639d7e 100644
--- a/third-party/curl/tests/data/test379
+++ b/third-party/curl/tests/data/test379
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Crafted to cause error
 <reply>
 <data nocheck="yes">
@@ -25,7 +25,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <file name="%LOGDIR/save">
@@ -34,25 +33,20 @@ exists before command runs
 <server>
 http
 </server>
- <name>
+<name>
 --remove-on-error with --no-clobber and an added number
- </name>
- <command option="no-output">
+</name>
+<command option="no-output">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -o %LOGDIR/save --remove-on-error --no-clobber
 </command>
 </client>
 
-#
-# Verify data after the test has been "shot". hyper doesn't do error 18
+# Verify data after the test has been "shot".
 <verify>
 <errorcode>
-%if hyper
-56
-%else
 18
-%endif
 </errorcode>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test38 b/third-party/curl/tests/data/test38
index af8da0c58a..05afab2829 100644
--- a/third-party/curl/tests/data/test38
+++ b/third-party/curl/tests/data/test38
@@ -1,10 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
 Resume
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -24,10 +24,10 @@ todelooooo lalalala yada yada, we know nothing about ranges ;-)
 <server>
 http
 </server>
- <name>
+<name>
 HTTP resume request without server supporting it
- </name>
- <command option="no-output">
+</name>
+<command option="no-output">
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -C - --no-include -o %LOGDIR/fewl%TESTNUMBER.txt
 </command>
 <file name="%LOGDIR/fewl%TESTNUMBER.txt">
@@ -41,7 +41,7 @@ download on.
 <errorcode>
 33
 </errorcode>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Range: bytes=78-
diff --git a/third-party/curl/tests/data/test380 b/third-party/curl/tests/data/test380
index ebf270fe90..bd0c058424 100644
--- a/third-party/curl/tests/data/test380
+++ b/third-party/curl/tests/data/test380
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,12 +8,9 @@ LIST
 netrc
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -24,17 +22,16 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
 <name>
-pick netrc password based on user name in URL
+pick netrc password based on username in URL
 </name>
 
 <command>
@@ -47,10 +44,9 @@ machine %HOSTIP login mary password yram
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER mary
 PASS yram
 PWD
diff --git a/third-party/curl/tests/data/test381 b/third-party/curl/tests/data/test381
index 2692a5910b..6e61432475 100644
--- a/third-party/curl/tests/data/test381
+++ b/third-party/curl/tests/data/test381
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,12 +8,9 @@ LIST
 netrc
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -24,10 +22,9 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -36,7 +33,6 @@ ftp
 
 # When CURL_NETRC_REQUIRED is set, the password in the URL is ignored and
 # using the netrc is mandatory.
-#
 <name>
 netrc-optional lets URL creds override netrc
 </name>
@@ -51,10 +47,9 @@ machine %HOSTIP login mary password yram
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER mary
 PASS drfrank
 PWD
diff --git a/third-party/curl/tests/data/test383 b/third-party/curl/tests/data/test383
index 64951ece12..1c66353c1f 100644
--- a/third-party/curl/tests/data/test383
+++ b/third-party/curl/tests/data/test383
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP POST
 --json
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -25,32 +25,30 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with --json
- </name>
- <command>
---json '{ "drink": "coffe" }' http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</name>
+<command>
+--json '{ "drink": "coffee" }' http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Content-Type: application/json
 Accept: application/json
-Content-Length: 20
+Content-Length: 21
 
-{ "drink": "coffe" }
+{ "drink": "coffee" }
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test384 b/third-party/curl/tests/data/test384
index 0d4e876aa6..af262369b3 100644
--- a/third-party/curl/tests/data/test384
+++ b/third-party/curl/tests/data/test384
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP POST
 --json
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -25,35 +25,33 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with --json from stdin
- </name>
+</name>
 <stdin>
-{ "drink": "coffe" }
+{ "drink": "coffee" }
 </stdin>
 <command>
 --json @- http://%HOSTIP:%HTTPPORT/%TESTNUMBER -H "Accept: foobar/*"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: foobar/*
 Content-Type: application/json
-Content-Length: 21
+Content-Length: 22
 
-{ "drink": "coffe" }
+{ "drink": "coffee" }
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test385 b/third-party/curl/tests/data/test385
index 7926c67b9b..7c81cd8f5e 100644
--- a/third-party/curl/tests/data/test385
+++ b/third-party/curl/tests/data/test385
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP POST
 --json
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -25,32 +25,30 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with --json x 2
- </name>
- <command>
---json '{ "drink": "coffe",' --json ' "crunch": "cookie" }' http://%HOSTIP:%HTTPPORT/%TESTNUMBER -H "Content-Type: drinks/hot"
+</name>
+<command>
+--json '{ "drink": "coffee",' --json ' "crunch": "cookie" }' http://%HOSTIP:%HTTPPORT/%TESTNUMBER -H "Content-Type: drinks/hot"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Content-Type: drinks/hot
 Accept: application/json
-Content-Length: 40
+Content-Length: 41
 
-{ "drink": "coffe", "crunch": "cookie" }
+{ "drink": "coffee", "crunch": "cookie" }
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test386 b/third-party/curl/tests/data/test386
index 412a90f36e..97a745911a 100644
--- a/third-party/curl/tests/data/test386
+++ b/third-party/curl/tests/data/test386
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP POST
 --json
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -39,32 +39,30 @@ hello
 </data2>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with --json + --next
- </name>
- <command>
---json '{ "drink": "coffe" }' http://%HOSTIP:%HTTPPORT/%TESTNUMBER --next http://%HOSTIP:%HTTPPORT/%TESTNUMBER0002
+</name>
+<command>
+--json '{ "drink": "coffee" }' http://%HOSTIP:%HTTPPORT/%TESTNUMBER --next http://%HOSTIP:%HTTPPORT/%TESTNUMBER0002
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Content-Type: application/json
 Accept: application/json
-Content-Length: 20
+Content-Length: 21
 
-{ "drink": "coffe" }GET /%TESTNUMBER0002 HTTP/1.1
+{ "drink": "coffee" }GET /%TESTNUMBER0002 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test387 b/third-party/curl/tests/data/test387
index 9f589f76d6..5872cd692e 100644
--- a/third-party/curl/tests/data/test387
+++ b/third-party/curl/tests/data/test387
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ gzip
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes" crlf="yes">
+<data nocheck="yes" crlf="headers">
 HTTP/1.1 200 OK
 Content-Length: 6
 Transfer-Encoding: gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip
@@ -18,7 +18,6 @@ Transfer-Encoding: gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,g
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -35,16 +34,15 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -sS --tr-encoding
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Connection: TE
 TE: gzip
+Connection: TE
 
 </protocol>
 
@@ -53,7 +51,7 @@ TE: gzip
 61
 </errorcode>
 <stderr mode="text">
-curl: (61) Reject response due to more than 5 content encodings
+curl: (61) Reject response exceeding limit of 5 transfer encodings
 </stderr>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test388 b/third-party/curl/tests/data/test388
index 85202148e7..b9f33e2d25 100644
--- a/third-party/curl/tests/data/test388
+++ b/third-party/curl/tests/data/test388
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ HTTP Digest auth
 # Server-side
 <reply>
 # First reply back and ask for Digest auth
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145"
@@ -21,7 +22,7 @@ This is not the real page
 </data1>
 
 # second reply back
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145"
@@ -33,7 +34,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 200 OK
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -42,11 +43,10 @@ Content-Length: 23
 This IS the real page!
 </data1001>
 
-#
 # This is the second request, and this sends back a response saying that
 # the request contained stale data. We want an update. Set swsbounce to
 # bounce on to data1003 on the second request.
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 401 Authorization re-negotiation please swsbounce
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", algorithm=MD5, nonce="999999", stale=true, qop="crazy, auth"
@@ -56,9 +56,9 @@ Content-Length: 26
 This is not the real page
 </data1002>
 
-# The second request to the 1002 section will bounce this one back instead
+# The second request to the 1002 section bounces this one back instead
 # thanks to the swsbounce keyword up there
-<data1003>
+<data1003 crlf="headers">
 HTTP/1.1 200 OK
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -76,11 +76,12 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP with Digest and multiple qop values with leading space
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001 -u testuser:testpass --digest http://%HOSTIP:%HTTPPORT/%TESTNUMBER0002
 </command>
 </client>
@@ -90,7 +91,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001 -u testuser:testpass --digest http://%H
 <strip>
 ^Authorization.*cnonce
 </strip>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0001 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -115,12 +116,12 @@ Accept: */*
 
 GET /%TESTNUMBER0002 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Digest username="testuser", realm="testrealm", nonce="999999", uri="/%TESTNUMBER0002", cnonce="MTA4MzIy", nc="00000001", qop="auth", response="25291c357671604a16c0242f56721c07", algorithm=MD5
+Authorization: Digest username="testuser", realm="testrealm", nonce="999999", uri="/%TESTNUMBER0002", cnonce="MTA4MzIr", nc="00000001", qop="auth", response="25291c357671604a16c0242f56721c07", algorithm=MD5
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145"
diff --git a/third-party/curl/tests/data/test389 b/third-party/curl/tests/data/test389
index 36fd633126..893a032eba 100644
--- a/third-party/curl/tests/data/test389
+++ b/third-party/curl/tests/data/test389
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -25,28 +25,26 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<features>
+local-http
+</features>
+<name>
 *.localhost is a local host
- </name>
- <command>
-http://curlmachine.localhost:%HTTPPORT/%TESTNUMBER
+</name>
+<command>
+-4 http://curlmachine.localhost:%HTTPPORT/%TESTNUMBER
 </command>
-# Ensure that we're running on localhost
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
+# Ensure that we are running on localhost
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: curlmachine.localhost:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test39 b/third-party/curl/tests/data/test39
index b08eb826dd..964002832c 100644
--- a/third-party/curl/tests/data/test39
+++ b/third-party/curl/tests/data/test39
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,7 @@ HTTP FORMPOST
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -25,11 +26,19 @@ Mime
 <server>
 http
 </server>
- <name>
+<name>
 HTTP RFC1867-type formposting with filename= and type=
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -F name=daniel -F tool=curl --form-string "str1=@literal" --form-string "str2=<verbatim;type=xxx/yyy" -F "file=@%LOGDIR/test%TESTNUMBER.txt;type=moo/foobar;filename=fakerfile" -F file2=@%LOGDIR/test%TESTNUMBER.txt -F "file3=@\"%LOGDIR/test%TESTNUMBER.txt\";type=mo/foo;filename=\"f\\\\\\\\ak\\\\\\er,\\\\an\\d;.t\\\"xt\"" -F 'file4=@"%LOGDIR/test%TESTNUMBER.txt"; filename="A\\AA\"\"\\\"ZZZ"'
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER
+-F name=daniel
+-F tool=curl
+--form-string "str1=@literal"
+--form-string "str2=%LTverbatim;type=xxx/yyy"
+-F "file=@%LOGDIR/test%TESTNUMBER.txt;type=moo/foobar;filename=fakerfile"
+-F file2=@%LOGDIR/test%TESTNUMBER.txt
+-F "file3=@\"%LOGDIR/test%TESTNUMBER.txt\";type=mo/foo;filename=\"f\\\\\\\\ak\\\\\\er,\\\\an\\d;.t\\\"xt\""
+-F 'file4=@"%LOGDIR/test%TESTNUMBER.txt"; filename="A\\AA\"\"\\\"ZZZ"'
 </command>
 # We create this file before the command is invoked!
 <file name="%LOGDIR/test%TESTNUMBER.txt">
@@ -46,66 +55,66 @@ foo
 ^(Content-Type: multipart/form-data;|-------).*
 </strip>
 <protocol>
-POST /we/want/%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Content-Length: 1180
-Content-Type: multipart/form-data; boundary=----------------------------24e78000bd32
-
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="name"
-
-daniel
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="tool"
-
-curl
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="str1"
-
-@literal
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="str2"
-
-<verbatim;type=xxx/yyy
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="file"; filename="fakerfile"
-Content-Type: moo/foobar
-
+POST /we/want/%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Content-Length: 1234%CR
+Content-Type: multipart/form-data; boundary=----------------------------24e78000bd32%CR
+%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="name"%CR
+%CR
+daniel%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="tool"%CR
+%CR
+curl%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="str1"%CR
+%CR
+@literal%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="str2"%CR
+%CR
+%LTverbatim;type=xxx/yyy%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="file"; filename="fakerfile"%CR
+Content-Type: moo/foobar%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="file2"; filename="test%TESTNUMBER.txt"
-Content-Type: text/plain
-
+%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="file2"; filename="test%TESTNUMBER.txt"%CR
+Content-Type: text/plain%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="file3"; filename="f\\ak\\er,\an\d;.t%22xt"
-Content-Type: mo/foo
-
+%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="file3"; filename="f\\ak\\er,\an\d;.t%22xt"%CR
+Content-Type: mo/foo%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-------------------------------24e78000bd32
-Content-Disposition: form-data; name="file4"; filename="A\AA%22%22\%22ZZZ"
-Content-Type: text/plain
-
+%CR
+------------------------------24e78000bd32%CR
+Content-Disposition: form-data; name="file4"; filename="A\AA%22%22\%22ZZZ"%CR
+Content-Type: text/plain%CR
+%CR
 foo bar
 This is a bar foo
 bar
 foo
-
-------------------------------24e78000bd32--
+%CR
+------------------------------24e78000bd32--%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test390 b/third-party/curl/tests/data/test390
index 83f1cec422..0489d9be86 100644
--- a/third-party/curl/tests/data/test390
+++ b/third-party/curl/tests/data/test390
@@ -1,13 +1,14 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
+FILE
 FTP
 parallel
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -24,7 +25,6 @@ Content-Type: text/html
 
 </reply>
 
-#
 # Client-side
 <client>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
@@ -42,7 +42,6 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER file://localhost%FILE_PWD/%LOGDIR/test%TEST
 </command>
 </client>
 
-#
 <verify>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test391 b/third-party/curl/tests/data/test391
index 766830727c..87219ebee3 100644
--- a/third-party/curl/tests/data/test391
+++ b/third-party/curl/tests/data/test391
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -39,30 +39,28 @@ Content-Type: text/html
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 --path-as-is with redirect, keeping dotdots
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/../../%TESTNUMBER --path-as-is -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /../../%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
-GET /../%TESTNUMBER0002 HTTP/1.1
+GET /%TESTNUMBER0002 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test392 b/third-party/curl/tests/data/test392
index 0f6502a3db..8fe7abbfe9 100644
--- a/third-party/curl/tests/data/test392
+++ b/third-party/curl/tests/data/test392
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ secure
 </info>
 
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -27,27 +28,25 @@ boo
 <server>
 http
 </server>
- <name>
+<name>
 HTTP secure cookies over localhost
- </name>
+</name>
 
 <setenv>
 TZ=GMT
 </setenv>
- <command>
-http://localhost:%HTTPPORT/%TESTNUMBER -b none http://localhost:%HTTPPORT/%TESTNUMBER
+<command>
+-4 http://localhost:%HTTPPORT/%TESTNUMBER -b none http://localhost:%HTTPPORT/%TESTNUMBER
 </command>
-<precheck>
-perl -e "print 'Test requires default test server host' if ( '%HOSTIP' ne '127.0.0.1' );"
-</precheck>
 <features>
 cookies
+local-http
 </features>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: localhost:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test393 b/third-party/curl/tests/data/test393
index 0322abacf7..3353da688a 100644
--- a/third-party/curl/tests/data/test393
+++ b/third-party/curl/tests/data/test393
@@ -1,14 +1,13 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
 --max-filesize
-FAILURE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -18,11 +17,7 @@ Server: test-server/fake
 Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
 ETag: "21025-dc7-39462498"
 Accept-Ranges: bytes
-%if hyper
-Content-Length: 3689348814741910323
-%else
 Content-Length: 36893488147419103232
-%endif
 Connection: close
 Content-Type: text/html
 Funny-head: yesyes
@@ -31,27 +26,25 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP max-filesize and out-of-range Content-Length
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --max-filesize 2000000
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 63
 </errorcode>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test394 b/third-party/curl/tests/data/test394
index ca388a970a..c3cbc691eb 100644
--- a/third-party/curl/tests/data/test394
+++ b/third-party/curl/tests/data/test394
@@ -1,13 +1,12 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
-FAILURE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -26,31 +25,25 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with rubbish in Content-Length
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
-%if hyper
-1
-%else
 8
-%endif
 </errorcode>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test395 b/third-party/curl/tests/data/test395
index cf0933dac3..a3edee226e 100644
--- a/third-party/curl/tests/data/test395
+++ b/third-party/curl/tests/data/test395
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -25,36 +25,27 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP and out-of-range Content-Length
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
-
-# hyper cannot work with too-large content-length
-%if hyper
-<errorcode>
-1
-</errorcode>
-%endif
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test396 b/third-party/curl/tests/data/test396
index a4638291c0..95cf51ca69 100644
--- a/third-party/curl/tests/data/test396
+++ b/third-party/curl/tests/data/test396
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,41 +7,9 @@ HTTP GET
 compressed
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBNb24sIDI5IE5vdiAyMDA0IDIxOjU2OjUzIEdNVA0KU2Vy
-dmVyOiBBcGFjaGUvMS4zLjMxIChEZWJpYW4gR05VL0xpbnV4KSBtb2RfZ3ppcC8xLjMuMjYuMWEg
-UEhQLzQuMy45LTEgbW9kX3NzbC8yLjguMjAgT3BlblNTTC8wLjkuN2QgbW9kX3BlcmwvMS4yOQ0K
-VmFyeTogQWNjZXB0LUVuY29kaW5nDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1J
-U08tODg1OS0xDQpDb250ZW50LUVuY29kaW5nOiB6c3RkDQpDb250ZW50LUxlbmd0aDogMTMwOQ0K
-DQootS/9ZLESfSgAhj+9KODQugGwA7ZypiefqCCMWuEChf2B/kAy8O+aCN/J85sQo2WYoY3AzAu3
-ALMArADzIbf2pNpzu3kaHt3a+7pumz3QvrNJn6zxUdptGFLvNOy67bymt1gZRqqBqhqopndRkImC
-WNNUYZLrGFaqAWoasKZHVZBrglyVCoXJljJq+kbJsKImFCan5j0IgxD2kFdKljRBHrJtWNa+0GLG
-t6t0Y2+db98wD3D3dh7PwZLBVGAep877k0Ku1hbWuWeJqMgcQCAAQAgreFCQiuS6IBAYhgcBp05p
-tdrvMUnUg6Da+d6eR7eMAhjTU/ubEztOjRRyTNXz9lh739eZvfb42ruTgRxSd+6LNDLIIdsbw3Lv
-5/fMsM699c68G27U5mZebw1yXDCYbOvqdSvdYvxH7kWyt+7bIUcko6Vc977nhbXai24X3bccJD5K
-GwNyfHyRhGUhAkIhslwYEl4UYYBweVHG8nCxZF6UOWBASIAcUUQm4UWYKCKTWXh/3XJc9+8yPCkj
-3qrx30GObzo3Ht/Px1B6783X6PddJCZey7W1Se0G2a373CC/5z3vYYj1x47mHWT5WcbbjLdZy6zl
-xvnGOWSOpc2psaNx88PNT/XJqk/24dwP50Jmn7K9N9thyPxYcyKnod4xvLSLm0bANB2tRs8i2Fc7
-Lzdd+6x7hpGLIVVht3ZW0zCcJNIVnaFkYkhdUoRiaEkkqyKZeKQdZzmGlQmFXdToDCeUFMFubc2b
-Y0iRSNZFkWDtVnuNxp003ulhCDmkv7W3aj0MIYzht0eIVkUklkWj3GYvUKypimSTfihJpKIi1kSj
-ZSgQ8C4YTG3uzsvQmlgUTE6G00Num9XaHwTNadyn0VOrLWtzLSHDiISaKlfFmlDTNFXUdVGRSVUx
-rDzW7411btMZMkPvigGBNbXOkL0lJ2Yb1DuGHO+s9sU82rPGd9u5XWSIZVvXuZprO1+7XXvIckqu
-aUJhWEkVJVEwTdN2zWV4eVs3r9uv9uBRcIbBAesPgOiggZVzaGZABgAggEEBQELCICNKAyHz5wz5
-Gr+3SMoKzoiT4JcFlMRJ8E0BVdBikl8WJGONBZ5ErsE5h2Oju5HWDnZ50LZofbucqKR8qlj/gvM2
-pP8JtMX1f4XHv4sy+T9yUDCHs9YmJmw5hnGWowLZWgC0/j7rTMyJRnY3KrwRdj/wXTFmjnFucfZu
-/94DmfjeEDOFz0C0f3YgYWUsI+2YO9YVXGtiM3AJTNsy5j6K9jkAKLew5bRCRJqMYqloGVw2M0JH
-f4ZlSeeJaBsx6A24uIythC24JsTWGU7cNBP0NL3qbNPMIllkjj1n95If2W0cQobpYDaGF2ja1bjg
-5MAexBa5GWSJY2kGTsRGwkEd3Ad5qiG3zWSmXQGb7VwHzPvskUlDyLuenXPmlGEajIyyvcZ1Dns9
-S2Ru2G3YO5OHEHZNu4aZS8MuG5GPrZkBNbsTDMDQBg0rr/EM2GW5AKf9gZiRlINAzPQ5ltqgBSFC
-GNOIHYGDMjg5MNphi1sImR3WcGKBiIA8sM64mdAQ0sxEb84XSBFzplx8N2jz0O5guS/GeNfaqg7r
-yLrOzSoJKq2aJUadLQgFtLV6UcfzOw296pBr0/ms+rHmnTs5jnmC0eqLUKV72l4Ym3HYkknmcEsY
-QP51NUQZGktcjt2485yobNJeXv/S9pzH3nguOoYl36mAbjiMjYXDkIwI+7N0JMiHzrs7y3WvSOFZ
-</data>
-
-<datacheck>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Mon, 29 Nov 2004 21:56:53 GMT
 Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
@@ -49,123 +18,25 @@ Content-Type: text/html; charset=ISO-8859-1
 Content-Encoding: zstd
 Content-Length: 1309
 
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE project-listing SYSTEM "http://freshmeat.net/backend/fm-projects-0.4.dtd">
-<project-listing>
-  <project>
-    <project_id>1612</project_id>
-    <date_added>1998-08-21 04:01:29</date_added>
-    <date_updated>2004-10-18 02:22:23</date_updated>
-    <projectname_short>curl</projectname_short>
-    <projectname_full>curl and libcurl</projectname_full>
-    <desc_short>Command line tool and library for client-side URL transfers.</desc_short>
-    <desc_full>curl and libcurl is a tool for transferring files
-using URL syntax. It supports HTTP, HTTPS, FTP,
-FTPS, DICT, TELNET, LDAP, FILE, and GOPHER, as
-well as HTTP-post, HTTP-put, cookies, FTP upload,
-resumed transfers, passwords, portnumbers, SSL
-certificates, Kerberos, and proxies. It is powered
-by libcurl, the client-side URL transfer library.
-There are bindings to libcurl for over 20
-languages and environments.
-</desc_full>
-    <vitality_score>5784.57</vitality_score>
-    <vitality_percent>3.16</vitality_percent>
-    <vitality_rank>169</vitality_rank>
-    <popularity_score>6594.54</popularity_score>
-    <popularity_percent>13.81</popularity_percent>
-    <popularity_rank>105</popularity_rank>
-    <rating>8.50</rating>
-    <rating_count>21</rating_count>
-    <rating_rank>183</rating_rank>
-    <subscriptions>323</subscriptions>
-    <branch_name>Default</branch_name>
-    <url_project_page>http://freshmeat.net/projects/curl/</url_project_page>
-    <url_homepage>http://freshmeat.net/redir/curl/1612/url_homepage/</url_homepage>
-    <url_tgz>http://freshmeat.net/redir/curl/1612/url_tgz/</url_tgz>
-    <url_bz2>http://freshmeat.net/redir/curl/1612/url_bz2/</url_bz2>
-    <url_zip>http://freshmeat.net/redir/curl/1612/url_zip/</url_zip>
-    <url_changelog>http://freshmeat.net/redir/curl/1612/url_changelog/</url_changelog>
-    <url_rpm>http://freshmeat.net/redir/curl/1612/url_rpm/</url_rpm>
-    <url_deb>http://freshmeat.net/redir/curl/1612/url_deb/</url_deb>
-    <url_osx>http://freshmeat.net/redir/curl/1612/url_osx/</url_osx>
-    <url_bsdport>http://freshmeat.net/redir/curl/1612/url_bsdport/</url_bsdport>
-    <url_purchase></url_purchase>
-    <url_cvs>http://freshmeat.net/redir/curl/1612/url_cvs/</url_cvs>
-    <url_list>http://freshmeat.net/redir/curl/1612/url_list/</url_list>
-    <url_mirror>http://freshmeat.net/redir/curl/1612/url_mirror/</url_mirror>
-    <url_demo></url_demo>
-    <license>MIT/X Consortium License</license>
-    <latest_release>
-      <latest_release_version>7.12.2</latest_release_version>
-      <latest_release_id>176085</latest_release_id>
-      <latest_release_date>2004-10-18 02:22:23</latest_release_date>
-    </latest_release>
-    <screenshot_thumb></screenshot_thumb>
-    <authors>
-      <author>
-        <author_name>Daniel Stenberg</author_name>
-        <author_url>http://freshmeat.net/~bagder/</author_url>
-        <author_role>Owner</author_role>
-      </author>
-    </authors>
-    <descriminators>
-      <trove_id>12</trove_id>
-      <trove_id>226</trove_id>
-      <trove_id>3</trove_id>
-      <trove_id>2</trove_id>
-      <trove_id>188</trove_id>
-      <trove_id>216</trove_id>
-      <trove_id>200</trove_id>
-      <trove_id>220</trove_id>
-      <trove_id>164</trove_id>
-      <trove_id>90</trove_id>
-      <trove_id>89</trove_id>
-      <trove_id>809</trove_id>
-      <trove_id>150</trove_id>
-      <trove_id>224</trove_id>
-      <trove_id>900</trove_id>
-      <trove_id>839</trove_id>
-    </descriminators>
-    <dependencies>
-      <dependency type="recommended">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>7464</dependency_branch_id>
-        <dependency_project_id>7464</dependency_project_id>
-        <dependency_project_title>OpenSSL (Default)</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>7443</dependency_project_id>
-        <dependency_project_title>OpenLDAP</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>12351</dependency_project_id>
-        <dependency_project_title>zlib</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>32047</dependency_project_id>
-        <dependency_project_title>Heimdal</dependency_project_title>
-      </dependency>
-      <dependency type="optional">
-        <dependency_release_id>0</dependency_release_id>
-        <dependency_branch_id>0</dependency_branch_id>
-        <dependency_project_id>44532</dependency_project_id>
-        <dependency_project_title>c-ares</dependency_project_title>
-      </dependency>
-    </dependencies>
-  </project>
-</project-listing>
+%hex[%28%b5%2f%fd%64%b1%12%7d%28%00%86%3f%bd%28%e0%d0%ba%01%b0%03%b6%72%a6%27%9f%a8%20%8c%5a%e1%02%85%fd%81%fe%40%32%f0%ef%9a%08%df%c9%f3%9b%10%a3%65%98%a1%8d%c0%cc%0b%b7%00%b3%00%ac%00%f3%21%b7%f6%a4%da%73%bb%79%1a%1e%dd%da%fb%ba%6e%9b%3d%d0%be%b3%49%9f%ac%f1%51%da%6d%18%52%ef%34%ec%ba%ed%bc%a6%b7%58%19%46%aa%81%aa%1a%a8%a6%77%51%90%89%82%58%d3%54%61%92%eb%18%56%aa%01%6a%1a%b0%a6%47%55%90%6b%82%5c%95]hex%
+%hex[%85%c9%96%32%6a%fa%46%c9%b0%a2%26%14%26%a7%e6%3d%08%83%10%f6%90%57%4a%96%34%41%1e%b2%6d%58%d6%be%d0%62%c6%b7%ab%74%63%6f%9d%6f%df%30%0f%70%f7%76%1e%cf%c1%92%c1%54%60%1e%a7%ce%fb%93%42%ae%d6%16%d6%b9%67%89%a8%c8%1c%40%20%00%40%08%2b%78%50%90%8a%e4%ba%20%10%18%86%07%01%a7%4e%69%b5%da%ef%31%49%d4%83%a0%da%f9%de%9e%47%b7%8c%02%18%d3%53%fb%9b%13%3b%4e%8d%14%72%4c%d5%f3%f6%58%7b%df%d7%99%bd%f6%f8%da%bb%93%81%1c%52%77%ee%8b%34%32%c8%21%db%1b%c3%72%ef%e7%f7%cc%b0%ce%bd%f5%ce%bc%1b%6e%d4%e6%66%5e%6f%0d%72%5c%30%98%6c%eb%ea%75%2b%dd%62%fc%47%ee%45%b2%b7%ee%db%21%47%24%a3%a5%5c%f7%be%e7%85%b5%da%8b%6e%17%dd%b7%1c%24%3e%4a%1b%03%72%7c%7c%91%84%65%21%02%42%21%b2%5c%18%12%5e%14%61%80%70%79%51%c6%f2%70%b1%64%5e%94%39%60%40%48%80%1c%51%44%26%e1%45%98%28%22%93%59%78%7f%dd%72%5c%f7%ef%32%3c%29%23%de%aa%f1%df%41%8e%6f%3a%37%1e%df%cf%c7%50%7a%ef%cd%d7%e8%f7%5d%24%26%5e%cb%b5%b5%49%ed%06%d9%ad%fb%dc%20%bf%e7%3d%ef%61%88%f5%c7%8e%e6%1d%64%f9%59%c6%db%8c%b7%59%cb%ac%e5%c6%f9%c6%39%64%8e%a5%cd%a9%b1%a3%71%f3%c3%cd%4f%f5%c9%aa%4f%f6%e1%dc%0f%e7%42%66%9f%b2%bd%37%db%61%c8%fc%58%73%22%a7%a1%de%31%bc%b4%8b%9b%46%c0%34%1d%ad%46%cf%22%d8%57%3b%2f%37%5d%fb%ac%7b%86%91%8b%21%55%61%b7%76%56%d3%30%9c%24%d2%15%9d%a1%64%62%48%5d%52%84%62%68%49%24%ab%22%99%78%a4%1d%67%39%86%95%09%85%5d%d4%e8%0c%27%94%14%c1%6e%6d%cd%9b%63%48%91%48%d6%45%91%60%ed%56%7b%8d%c6%9d%34%de%e9%61%08%39%a4%bf%b5%b7%6a%3d%0c%21%8c%e1%b7%47%88%56%45%24%96%45%a3%dc%66%2f%50%ac%a9%8a%64%93%7e%28%49%a4%a2%22%d6%44%a3%65%28%10%f0%2e%18%4c%6d%ee%ce%cb%d0%9a%58%14%4c%4e%86%d3%43%6e%9b%d5%da%1f%04%cd%69%dc%a7%d1%53%ab%2d%6b%73%2d%21%c3%88%84%9a%2a%57%c5%9a%50%d3%34%55%d4%75%51%91%49%55%31%ac%3c%d6%ef%8d%75%6e%d3%19%32%43%ef%8a%01%81%35%b5%ce%90%bd%25%27%66%1b%d4%3b%86%1c%ef%ac%f6%c5%3c%da%b3%c6%77%db%b9%5d%64%88%65%5b%d7%b9%9a%6b%3b%5f%bb%5d%7b%c8%72%4a%ae%69%42%61%58%49%15%25%51%30%4d%d3%76%cd%65%78%79%5b%37%af%db%af%f6%e0%51%70%86%c1%01%eb%0f%80%e8%a0%81%95%73%68%66%40%06%00%20%80%41%01%40%42%c2%20%23%4a%03%21%f3%e7%0c%f9%1a%bf%b7%48%ca]hex%
+%hex[%ce%88%93%e0%97%05%94%c4%49%f0%4d%01%55%d0%62%92%5f%16%24%63%8d%05%9e%44%ae%c1%39%87%63%a3%bb%91%d6%0e%76%79%d0%b6%68%7d%bb%9c%a8%a4%7c%aa%58%ff%82%f3%36%a4%ff%09%b4%c5%f5%7f%85%c7%bf%8b%32%f9%3f%72%50%30%87%b3%d6%26%26%6c%39%86%71%96%a3%02%d9%5a%00%b4%fe%3e%eb%4c%cc%89%46%76%37%2a%bc%11%76%3f%f0%5d%31%66%8e%71%6e%71%f6%6e%ff%de%03%99%f8%de%10%33%85%cf%40%b4%7f%76%20%61%65%2c%23%ed%98%3b%d6%15%5c%6b%62%33%70%09%4c%db%32%e6%3e%8a%f6%39%00%28%b7%b0%e5%b4%42%44%9a%8c%62%a9%68%19%5c%36%33%42%47%7f%86%65%49%e7%89%68%1b%31%e8%0d%b8%b8%8c%ad%84%2d%b8%26%c4%d6%19%4e%dc%34%13%f4%34%bd%ea%6c%d3%cc%22%59%64%8e%3d%67%f7%92%1f%d9%6d%1c%42%86%e9%60%36%86%17%68%da%d5%b8%e0%e4%c0%1e%c4%16%b9%19%64%89%63%69%06%4e%c4%46%c2%41%1d%dc%07%79%aa%21%b7%cd%64%a6%5d%01%9b%ed%5c%07%cc%fb%ec%91%49%43%c8%bb%9e%9d%73%e6%94%61%1a%8c%8c%b2%bd%c6%75%0e%7b%3d%4b%64%6e%d8%6d%d8%3b%93%87%10%76%4d%bb%86%99%4b%c3%2e%1b%91%8f%ad%99%01%35%bb%13%0c%c0%d0%06%0d%2b%af%f1%0c%d8%65%b9%00%a7%fd%81%98%91%94%83%40%cc%f4%39%96%da%a0%05%21%42%18%d3%88%1d%81%83%32%38%39%30%da%61%8b%5b%08%99%1d%d6%70%62%81%88%80%3c%b0%ce%b8%99%d0%10%d2%cc%44%6f%ce%17%48%11%73%a6%5c%7c%37%68%f3%d0%ee%60%b9%2f%c6%78%d7%da%aa%0e%eb%c8%ba%ce%cd%2a%09%2a%ad%9a%25%46%9d%2d%08%05%b4%b5%7a%51%c7%f3%3b%0d%bd%ea%90%6b%d3%f9%ac%fa%b1%e6%9d%3b%39%8e%79%82%d1%ea%8b%50%a5%7b%da%5e%18%9b%71%d8%92%49%e6%70%4b%18%40%fe%75%35%44%19%1a%4b%5c%8e%dd%b8%f3%9c%a8%6c%d2%5e%5e%ff%d2%f6%9c%c7%de%78%2e%3a%86%25%df%a9%80%6e%38%8c%8d%85%c3%90%8c%08%fb%b3%74%24%c8%87%ce%bb%3b%cb%75%af%48%e1%59]hex%
+</data>
+
+<datacheck>
+HTTP/1.1 200 OK%CR
+Date: Mon, 29 Nov 2004 21:56:53 GMT%CR
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29%CR
+Vary: Accept-Encoding%CR
+Content-Type: text/html; charset=ISO-8859-1%CR
+Content-Encoding: zstd%CR
+Content-Length: 1309%CR
+%CR
+%includetext %SRCDIR/data/data-xml1%
 </datacheck>
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -174,21 +45,20 @@ zstd
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET zstd compressed content
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --compressed
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
 s/^Accept-Encoding: [a-zA-Z, ]*/Accept-Encoding: xxx/
 </strippart>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test397 b/third-party/curl/tests/data/test397
index 1f308220d6..aa17f141f1 100644
--- a/third-party/curl/tests/data/test397
+++ b/third-party/curl/tests/data/test397
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,21 +7,11 @@ HTTP GET
 compressed
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 # Length of not-encoded content is 16512 what is greater than default value of
 # CURL_MAX_WRITE_SIZE (16384)
-<data base64="yes">
-SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBNb24sIDI5IE5vdiAyMDA0IDIxOjU2OjUzIEdNVA0KU2Vy
-dmVyOiBBcGFjaGUvMS4zLjMxIChEZWJpYW4gR05VL0xpbnV4KSBtb2RfZ3ppcC8xLjMuMjYuMWEg
-UEhQLzQuMy45LTEgbW9kX3NzbC8yLjguMjAgT3BlblNTTC8wLjkuN2QgbW9kX3BlcmwvMS4yOQ0K
-VmFyeTogQWNjZXB0LUVuY29kaW5nDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1J
-U08tODg1OS0xDQpDb250ZW50LUVuY29kaW5nOiB6c3RkDQpDb250ZW50LUxlbmd0aDogNDcNCg0K
-KLUv/WSAPw0BAIgwMTIzNDU2Nzg5QUJDREVGCgQAfJ9geAAEGh3Sq006l4KvuZw=
-</data>
-
-<datacheck>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Mon, 29 Nov 2004 21:56:53 GMT
 Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
@@ -29,139 +20,24 @@ Content-Type: text/html; charset=ISO-8859-1
 Content-Encoding: zstd
 Content-Length: 47
 
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
+%hex[%28%b5%2f%fd%64%80%3f%0d%01%00%88%30%31%32%33%34%35%36%37%38%39%41%42%43%44%45%46]hex%
+%hex[%04%00%7c%9f%60%78%00%04%1a%1d%d2%ab%4d%3a%97%82%af%b9%9c]hex%
+</data>
+
+<datacheck crlf="headers" nonewline="yes">
+HTTP/1.1 200 OK
+Date: Mon, 29 Nov 2004 21:56:53 GMT
+Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29
+Vary: Accept-Encoding
+Content-Type: text/html; charset=ISO-8859-1
+Content-Encoding: zstd
+Content-Length: 47
+
+%repeat[128 x 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF%0a]%
 </datacheck>
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -170,21 +46,20 @@ zstd
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET zstd compressed content of size more than CURL_MAX_WRITE_SIZE
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --compressed
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
 s/^Accept-Encoding: [a-zA-Z, ]*/Accept-Encoding: xxx/
 </strippart>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test398 b/third-party/curl/tests/data/test398
index 26d6811f86..ac7033bda8 100644
--- a/third-party/curl/tests/data/test398
+++ b/third-party/curl/tests/data/test398
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ HTTP
 HTTP GET
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 
@@ -29,24 +29,22 @@ Date: Tue, 09 Nov 2010 14:49:00 GMT
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 Reject HTTP/1.1 response with colon-less header
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -54,11 +52,7 @@ Accept: */*
 
 </protocol>
 <errorcode>
-%if hyper
-1
-%else
 8
-%endif
 </errorcode>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test399 b/third-party/curl/tests/data/test399
index da4b3f7cf7..6984fbd85f 100644
--- a/third-party/curl/tests/data/test399
+++ b/third-party/curl/tests/data/test399
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,15 +6,13 @@ URL
 </keywords>
 </info>
 
-
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 <name>
-65536 bytes long host name in URL
+65536-byte-long hostname in URL
 </name>
 <file name="%LOGDIR/input%TESTNUM">
 url = http://%repeat[65536 x a]%/399
diff --git a/third-party/curl/tests/data/test4 b/third-party/curl/tests/data/test4
index 5193a15465..6cfb7c0ff5 100644
--- a/third-party/curl/tests/data/test4
+++ b/third-party/curl/tests/data/test4
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP added headers
 HTTP replaced headers
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -20,31 +20,39 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 Replaced internal and added custom HTTP headers
- </name>
- <command>
- -H "extra-header: here" -H "Accept: replaced" -H "X-Custom-Header;" -H "X-Test: foo; " -H "X-Test:" -H "X-Test2: foo;" -H "X-Test3:  " -H "X-Test4;  " -H "X-Test5;ignored" http://%HOSTIP:%HTTPPORT/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</name>
+<command>
+-H "extra-header: here"
+-H "Accept: replaced"
+-H "X-Custom-Header;"
+-H "X-Test: foo; "
+-H "X-Test:"
+-H "X-Test2: foo;"
+-H "X-Test3:  "
+-H "X-Test4;  "
+-H "X-Test5;ignored"
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 extra-header: here
 Accept: replaced
 X-Custom-Header:
-X-Test: foo; 
+X-Test: foo;%SP
 X-Test2: foo;
 
 GET /%TESTNUMBER HTTP/1.1
@@ -53,7 +61,7 @@ User-Agent: curl/%VERSION
 extra-header: here
 Accept: replaced
 X-Custom-Header:
-X-Test: foo; 
+X-Test: foo;%SP
 X-Test2: foo;
 
 </protocol>
diff --git a/third-party/curl/tests/data/test40 b/third-party/curl/tests/data/test40
index 32dedc7c51..47538fef99 100644
--- a/third-party/curl/tests/data/test40
+++ b/third-party/curl/tests/data/test40
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,16 @@ HTTP GET
 followlocation
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 302 OK swsclose
-Location: ../moo.html/?name=d a niel&testcase=/%TESTNUMBER0002    
+Location: ../moo.html/?name=d a niel%AMPtestcase=/%TESTNUMBER0002%repeat[4 x  ]%
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
 
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Location: this should be ignored
 Date: Tue, 09 Nov 2010 14:49:00 GMT
@@ -24,13 +24,9 @@ Connection: close
 
 body
 </data2>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 302 OK swsclose
-%if !hyper
-Location: ../moo.html/?name=d a niel&testcase=/%TESTNUMBER0002    
-%else
-Location: ../moo.html/?name=d a niel&testcase=/%TESTNUMBER0002
-%endif
+Location: ../moo.html/?name=d a niel%AMPtestcase=/%TESTNUMBER0002%repeat[4 x  ]%
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
 
@@ -43,30 +39,28 @@ body
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP redirect with whitespace after ? (and conversion)
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/are/all/twits/%TESTNUMBER -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/are/all/twits/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
-GET /we/are/all/moo.html/?name=d+a+niel&testcase=/%TESTNUMBER0002 HTTP/1.1
+GET /we/are/all/moo.html/?name=d+a+niel%AMPtestcase=/%TESTNUMBER0002 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test400 b/third-party/curl/tests/data/test400
index 5771de6d8d..53e14d3a1b 100644
--- a/third-party/curl/tests/data/test400
+++ b/third-party/curl/tests/data/test400
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,12 +8,9 @@ PASV
 LIST
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTPS server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -24,10 +22,9 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -36,18 +33,17 @@ SSL
 <server>
 ftps
 </server>
- <name>
+<name>
 FTPS dir list PASV unencrypted data
- </name>
- <command>
--k --ftp-ssl-control ftps://%HOSTIP:%FTPSPORT/
+</name>
+<command>
+--insecure --ftp-ssl-control ftps://%HOSTIP:%FTPSPORT/
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PBSZ 0
diff --git a/third-party/curl/tests/data/test4000 b/third-party/curl/tests/data/test4000
new file mode 100644
index 0000000000..a1924f148d
--- /dev/null
+++ b/third-party/curl/tests/data/test4000
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+ECH GREASE
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 7
+
+MooMoo
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+ECH
+</features>
+<server>
+https
+</server>
+<name>
+HTTPS GET with ECH GREASE
+</name>
+# Using '-k' over '--insecure' to also test the short form
+# Add ECH grease
+<command>
+--ech grease -k https://%HOSTIP:%HTTPSPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPSPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test4001 b/third-party/curl/tests/data/test4001
new file mode 100644
index 0000000000..81e9a5df8e
--- /dev/null
+++ b/third-party/curl/tests/data/test4001
@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+ECH try real and fail
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<features>
+ECH
+</features>
+<server>
+https
+</server>
+<name>
+Make real ECH attempt and fail with "ech required" error (101)
+</name>
+# Using '-k' over '--insecure' to also test the short form
+<command>
+--ech ecl:AEv+DQBHdAAgACCCU49qdxKOUXJPs3wlsM06v/t42sMH5xQOL37MAd3HaAAEAAEAAQAYb3RoZXJwdWJsaWMudGVzdC5kZWZvLmllAAA= -k https://%HOSTIP:%HTTPSPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+%if !wolfssl
+%if !rustls
+101
+%else
+35
+%endif
+%else
+35
+%endif
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test401 b/third-party/curl/tests/data/test401
index a372a2d988..3919001d3d 100644
--- a/third-party/curl/tests/data/test401
+++ b/third-party/curl/tests/data/test401
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -16,9 +17,9 @@ SSL
 <server>
 ftps
 </server>
- <name>
+<name>
 FTPS PASV upload file
- </name>
+</name>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 data
     to
@@ -27,8 +28,8 @@ that FTPS
 works
   so does it?
 </file>
- <command>
--k --ftp-ssl-control ftps://%HOSTIP:%FTPSPORT/%TESTNUMBER -T %LOGDIR/test%TESTNUMBER.txt
+<command>
+--insecure --ftp-ssl-control ftps://%HOSTIP:%FTPSPORT/%TESTNUMBER -T %LOGDIR/test%TESTNUMBER.txt
 </command>
 </client>
 
@@ -42,7 +43,7 @@ that FTPS
 works
   so does it?
 </upload>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PBSZ 0
diff --git a/third-party/curl/tests/data/test402 b/third-party/curl/tests/data/test402
index abd7a6eda7..ab036b27d6 100644
--- a/third-party/curl/tests/data/test402
+++ b/third-party/curl/tests/data/test402
@@ -1,9 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
 FTPS
-FAILURE
 </keywords>
 </info>
 
@@ -15,11 +15,11 @@ SSL
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP SSL required on non-SSL server
- </name>
- <command>
--k --ftp-ssl-reqd ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
+</name>
+<command>
+--insecure --ftp-ssl-reqd ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
 
@@ -28,7 +28,7 @@ FTP SSL required on non-SSL server
 <errorcode>
 64
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 AUTH SSL
 AUTH TLS
 </protocol>
diff --git a/third-party/curl/tests/data/test403 b/third-party/curl/tests/data/test403
index 0cb65e512f..6bf16a6230 100644
--- a/third-party/curl/tests/data/test403
+++ b/third-party/curl/tests/data/test403
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,15 +7,11 @@ FTPS
 PASV
 LIST
 CCC
-FAILURE
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTPS server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -26,10 +23,9 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -38,18 +34,17 @@ SSL
 <server>
 ftps
 </server>
- <name>
+<name>
 FTPS with CCC not supported by server
- </name>
- <command>
--k --ftp-ssl-control --ftp-ssl-ccc ftps://%HOSTIP:%FTPSPORT/
+</name>
+<command>
+--insecure --ftp-ssl-control --ftp-ssl-ccc ftps://%HOSTIP:%FTPSPORT/
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PBSZ 0
diff --git a/third-party/curl/tests/data/test404 b/third-party/curl/tests/data/test404
index 0f73325ebe..1e69b881f7 100644
--- a/third-party/curl/tests/data/test404
+++ b/third-party/curl/tests/data/test404
@@ -1,9 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
 FTPS
-FAILURE
 </keywords>
 </info>
 
@@ -15,18 +15,21 @@ SSL
 <server>
 ftps
 </server>
- <name>
+<name>
 FTPS with invalid cacert
- </name>
- <command>
---ftp-ssl-control --cacert moooo ftps://%HOSTIP:%FTPSPORT/
+</name>
+<command>
+--ftp-ssl-control --cacert "%LOGDIR/cacert" ftps://%HOSTIP:%FTPSPORT/
 </command>
+<file name="%LOGDIR/cacert">
+made up content
+</file>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
-77
+77,60
 </errorcode>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test405 b/third-party/curl/tests/data/test405
index fc291d1ab8..e67dcf16d4 100644
--- a/third-party/curl/tests/data/test405
+++ b/third-party/curl/tests/data/test405
@@ -1,9 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
 FTPS
-FAILURE
 </keywords>
 </info>
 
@@ -15,11 +15,11 @@ SSL
 <server>
 ftp
 </server>
- <name>
+<name>
 FTPS operation to FTP port
- </name>
- <command>
--m 5 -k ftps://%HOSTIP:%FTPPORT/path/to/file/%TESTNUMBER
+</name>
+<command>
+-m 5 --insecure ftps://%HOSTIP:%FTPPORT/path/to/file/%TESTNUMBER
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test406 b/third-party/curl/tests/data/test406
index f59f426c45..deec19ca74 100644
--- a/third-party/curl/tests/data/test406
+++ b/third-party/curl/tests/data/test406
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,12 +8,9 @@ PORT
 LIST
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTPS server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -24,10 +22,9 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -36,15 +33,14 @@ SSL
 <server>
 ftps
 </server>
- <name>
+<name>
 FTPS dir list, PORT with specified IP
- </name>
- <command>
--k --ftp-ssl-control -P %CLIENTIP ftps://%HOSTIP:%FTPSPORT/
+</name>
+<command>
+--insecure --ftp-ssl-control -P %CLIENTIP ftps://%HOSTIP:%FTPSPORT/
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # Strip all valid kinds of PORT and EPRT that curl can send
@@ -52,7 +48,7 @@ FTPS dir list, PORT with specified IP
 ^PORT \d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3}
 ^EPRT \|1\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|\d{1,5}\|
 </strip>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PBSZ 0
diff --git a/third-party/curl/tests/data/test407 b/third-party/curl/tests/data/test407
index 1db4c5caf2..0e9699801e 100644
--- a/third-party/curl/tests/data/test407
+++ b/third-party/curl/tests/data/test407
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -25,11 +26,11 @@ SSL
 <server>
 ftps
 </server>
- <name>
+<name>
 Get two FTPS files from the same remote dir: no second CWD
- </name>
- <command>
--k --ftp-ssl-control ftps://%HOSTIP:%FTPSPORT/a/path/%TESTNUMBER ftps://%HOSTIP:%FTPSPORT/a/path/%TESTNUMBER
+</name>
+<command>
+--insecure --ftp-ssl-control ftps://%HOSTIP:%FTPSPORT/a/path/%TESTNUMBER ftps://%HOSTIP:%FTPSPORT/a/path/%TESTNUMBER
 </command>
 <stdout>
 data blobb
@@ -39,7 +40,7 @@ data blobb
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PBSZ 0
diff --git a/third-party/curl/tests/data/test408 b/third-party/curl/tests/data/test408
index 07bc289631..2eaa801c90 100644
--- a/third-party/curl/tests/data/test408
+++ b/third-party/curl/tests/data/test408
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -21,11 +22,11 @@ SSL
 <server>
 ftps
 </server>
- <name>
+<name>
 FTPS PORT upload with CWD
- </name>
- <command>
--k --ftp-ssl-control ftps://%HOSTIP:%FTPSPORT/CWD/STOR/RETR/%TESTNUMBER -T %LOGDIR/upload%TESTNUMBER -P -
+</name>
+<command>
+--insecure --ftp-ssl-control ftps://%HOSTIP:%FTPSPORT/CWD/STOR/RETR/%TESTNUMBER -T %LOGDIR/upload%TESTNUMBER -P -
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
 Moooooooooooo
@@ -40,7 +41,7 @@ Moooooooooooo
 ^PORT \d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3}
 ^EPRT \|1\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|\d{1,5}\|
 </strip>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PBSZ 0
diff --git a/third-party/curl/tests/data/test409 b/third-party/curl/tests/data/test409
deleted file mode 100644
index b1676e3a4d..0000000000
--- a/third-party/curl/tests/data/test409
+++ /dev/null
@@ -1,57 +0,0 @@
-<testcase>
-<info>
-<keywords>
-FTP
-FTPS
-EPSV
-STOR
-</keywords>
-</info>
-
-# Client-side
-<client>
-<features>
-SSL
-</features>
-<server>
-ftps
-</server>
- <name>
-FTPS PASV upload file
- </name>
-<file name="%LOGDIR/test%TESTNUMBER.txt">
-data
-    to
-      see
-that FTP
-works
-  so does it?
-</file>
- <command>
--k --ftp-ssl-control ftps://%HOSTIP:%FTPSPORT/%TESTNUMBER -T %LOGDIR/test%TESTNUMBER.txt
-</command>
-</client>
-
-# Verify data after the test has been "shot"
-<verify>
-<upload>
-data
-    to
-      see
-that FTP
-works
-  so does it?
-</upload>
-<protocol>
-USER anonymous
-PASS ftp@example.com
-PBSZ 0
-PROT C
-PWD
-EPSV
-TYPE I
-STOR %TESTNUMBER
-QUIT
-</protocol>
-</verify>
-</testcase>
diff --git a/third-party/curl/tests/data/test41 b/third-party/curl/tests/data/test41
index 7a133307d1..0259f25bb9 100644
--- a/third-party/curl/tests/data/test41
+++ b/third-party/curl/tests/data/test41
@@ -1,9 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP FORMPOST
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -18,10 +18,10 @@ Mime
 <server>
 http
 </server>
- <name>
+<name>
 HTTP formpost with missing file
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -F moo=@boo
 </command>
 </client>
diff --git a/third-party/curl/tests/data/test410 b/third-party/curl/tests/data/test410
index 4fee387c45..2772d100a5 100644
--- a/third-party/curl/tests/data/test410
+++ b/third-party/curl/tests/data/test410
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -19,7 +19,6 @@ MooMoo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -28,22 +27,21 @@ SSL
 <server>
 https
 </server>
- <name>
-HTTPS GET with very long request header
- </name>
+<name>
+HTTPS GET with 49 KB long request header
+</name>
 # 14 characters repeated 3500 times makes 49000 bytes
 <file name="%LOGDIR/file%TESTNUMBER">
 Long: %repeat[3500 x header content]%
 </file>
- <command>
--k https://%HOSTIP:%HTTPSPORT/%TESTNUMBER -H @%LOGDIR/file%TESTNUMBER
+<command>
+--insecure https://%HOSTIP:%HTTPSPORT/%TESTNUMBER -H @%LOGDIR/file%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test411 b/third-party/curl/tests/data/test411
index eb6fad1bc6..60e65bc281 100644
--- a/third-party/curl/tests/data/test411
+++ b/third-party/curl/tests/data/test411
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,26 +6,20 @@
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
- <name>
+<name>
 -K with missing file causes error
- </name>
- <command>
+</name>
+<command>
 -K %LOGDIR/missing http://localhost
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <stderr mode="text">
diff --git a/third-party/curl/tests/data/test412 b/third-party/curl/tests/data/test412
index b029428122..038c9ba21a 100644
--- a/third-party/curl/tests/data/test412
+++ b/third-party/curl/tests/data/test412
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ trailing-dot
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -23,24 +23,23 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 alt-svc
-debug
+Debug
 </features>
 <server>
 http
 </server>
- <name>
-alt-svc using host name with trailing dot in URL
- </name>
+<name>
+alt-svc using hostname with trailing dot in URL
+</name>
 <setenv>
-# make debug-curl accept Alt-Svc over plain HTTP
+# make Debug-curl accept Alt-Svc over plain HTTP
 CURL_ALTSVC_HTTP="yeah"
 </setenv>
- <command>
+<command>
 --alt-svc "%LOGDIR/altsvc-%TESTNUMBER" "http://whohoo.:12345/%TESTNUMBER"
 </command>
 <file name="%LOGDIR/altsvc-%TESTNUMBER">
@@ -49,10 +48,9 @@ h1 whohoo 12345 h1 %HOSTIP %HTTPPORT "20290222 22:19:28" 0 0
 
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: whohoo.:12345
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test413 b/third-party/curl/tests/data/test413
index 96a89d47fa..302700a8f7 100644
--- a/third-party/curl/tests/data/test413
+++ b/third-party/curl/tests/data/test413
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ trailing-dot
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -23,24 +23,23 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 alt-svc
-debug
+Debug
 </features>
 <server>
 http
 </server>
- <name>
-alt-svc using host name with trailing dot on host from file
- </name>
+<name>
+alt-svc using hostname with trailing dot on host from file
+</name>
 <setenv>
-# make debug-curl accept Alt-Svc over plain HTTP
+# make Debug-curl accept Alt-Svc over plain HTTP
 CURL_ALTSVC_HTTP="yeah"
 </setenv>
- <command>
+<command>
 --alt-svc "%LOGDIR/altsvc-%TESTNUMBER" "http://whohoo:12345/%TESTNUMBER"
 </command>
 <file name="%LOGDIR/altsvc-%TESTNUMBER">
@@ -49,10 +48,9 @@ h1 whohoo. 12345 h1 %HOSTIP %HTTPPORT "20290222 22:19:28" 0 0
 
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: whohoo:12345
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test414 b/third-party/curl/tests/data/test414
index 8aea07f2bf..d04426e060 100644
--- a/third-party/curl/tests/data/test414
+++ b/third-party/curl/tests/data/test414
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ cookies
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -44,7 +44,6 @@ Content-Length: 6
 </data3>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -55,14 +54,13 @@ https
 HTTPS sec-cookie, HTTP redirect, same name cookie, redirect back
 </name>
 <command>
-https://attack.invalid:%HTTPSPORT/a/b/%TESTNUMBER -k -c %LOGDIR/cookie%TESTNUMBER --resolve attack.invalid:%HTTPSPORT:%HOSTIP --resolve attack.invalid:%HTTPPORT:%HOSTIP -L
+https://attack.invalid:%HTTPSPORT/a/b/%TESTNUMBER --insecure -c %LOGDIR/cookie%TESTNUMBER --resolve attack.invalid:%HTTPSPORT:%HOSTIP --resolve attack.invalid:%HTTPPORT:%HOSTIP -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /a/b/%TESTNUMBER HTTP/1.1
 Host: attack.invalid:%HTTPSPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test415 b/third-party/curl/tests/data/test415
index 099ec830bf..7258362e96 100644
--- a/third-party/curl/tests/data/test415
+++ b/third-party/curl/tests/data/test415
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,60 +7,49 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
-Content-Length: 
-6
+Content-Length: %CR-6
 Content-Type: text/html
 Funny-head: yesyes
 
 moooooooooooo
 </data>
 <datacheck>
-%if hyper
-%else
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
-%endif
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP response with control code then negative Content-Length
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-GET /%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
 </protocol>
 
-# Hyper curl returns unsupported protocol
 # built-in curl returns weird_server_reply
 <errorcode>
-%if hyper
-1
-%else
 8
-%endif
 </errorcode>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test416 b/third-party/curl/tests/data/test416
index e6d5dc17f7..05ce4f150d 100644
--- a/third-party/curl/tests/data/test416
+++ b/third-party/curl/tests/data/test416
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -28,17 +29,17 @@ RETRSIZE 7
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP growing file support
- </name>
- <command>
+</name>
+<command>
 --ignore-content-length ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test417 b/third-party/curl/tests/data/test417
index 3578fab926..cfe3cca193 100644
--- a/third-party/curl/tests/data/test417
+++ b/third-party/curl/tests/data/test417
@@ -1,7 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTPS
+--write-out
 %{certs}
 </keywords>
 </info>
@@ -23,23 +25,21 @@ nomnom
 <features>
 SSL
 !wolfssl
-!bearssl
 !mbedtls
-!rustls
 </features>
 <server>
 http
 https
 </server>
 <name>
-%{certs}
+--write-out with %{certs}
 </name>
 <command option="no-include">
 --insecure https://%HOSTIP:%HTTPSPORT/%TESTNUMBER -w '%{certs}'
 </command>
 </client>
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPSPORT
 User-Agent: curl/%VERSION
@@ -51,31 +51,7 @@ s/^(.*):(.*)[\r\n]*//
 </stripfile>
 <stdout>
 nomnom
------BEGIN CERTIFICATE-----
-MIIERDCCAyygAwIBAgIGDzR1UZ/TMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNVBAYT
-Ak5OMTEwLwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNo
-IENsb3VkMSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjAe
-Fw0yMjEyMjMxMjIxMzlaFw0zMTAzMTExMjIxMzlaMFQxCzAJBgNVBAYTAk5OMTEw
-LwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNoIENsb3Vk
-MRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQCrCrAD0Hb+Xs4V3mHV45FvfNa7yiaOeL4mNdGmWfHVPFU+CSzsoNSvDjxa
-orWweFGVYoCAcchOn1lZk0ASsqnOss0Xi58n8+PPI3gG0gYjX5sg7EJ3Zq2kXoK0
-TZRy6hNkcvzLgyzXoYv1LkzTwYiyyJgZX++Y/GKAs2fMHyP8XzjNgm4tltk1k/4p
-omllwN9Fqz+sFxgAgEq3ybq4Xym7xKwWl8xXNBDJNmVsPtiJRcilQoR8Xs0a6PE+
-VbMhD9A2E/LEL7lzQfqHqtxE1mSW5FpQ+Uqf4KLnafStWs86IOWnCeLP6BmhAK6o
-uyICNFyzz7UkTHa/renxuNOGun2TAgMBAAGjggEGMIIBAjAUBgNVHREEDTALggls
-b2NhbGhvc3QwCwYDVR0PBAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1Ud
-DgQWBBScl7A9s1Cx9tRx4uvLgOqTfJjMcjAfBgNVHSMEGDAWgBSHy7EzLsFnfnHj
-5StMTaSzbtJbqTAJBgNVHRMEAjAAMEMGCCsGAQUFBwEBBDcwNTAzBggrBgEFBQcw
-AoYnaHR0cDovL3Rlc3QuY3VybC5zZS9jYS9FZGVsQ3VybFJvb3QuY2VyMDgGA1Ud
-HwQxMC8wLaAroCmGJ2h0dHA6Ly90ZXN0LmN1cmwuc2UvY2EvRWRlbEN1cmxSb290
-LmNybDANBgkqhkiG9w0BAQsFAAOCAQEAC4rtaof6cRWIJViFG0oJv0MANZN4DXIU
-MFHik4Oh2hsvqTGut8dMcsJeMiTxlpNw1T+1hYATdTLPDvhdxKIphEMsdYEmEmqg
-y3tXwZJ4hQj6ZFDCe4MCTXkTvGFkTbhr1fGEaxJcaZCtQEfA7d3qimZ+h4UZqonT
-PAhyCKFNY2BbmxeeABKhAFLKeAGIGMftW8fk2eu9P6+SUz/+WFcN/PR7e6JP6blc
-taRSULRWWkSO2dDt3o9+rBxYdluoecmVq4Ud20wTgkqlQRsp9dOW34DRHgB9ujWU
-V4HhCCqBaxwwUDcBGg4mT2vtyVAXNyszP2j+xvAhjOeyeVXyQr0vsA==
------END CERTIFICATE-----
+%strippemfile[%CERTDIR/certs/test-localhost.crt]strippemfile%
 </stdout>
 
 </verify>
diff --git a/third-party/curl/tests/data/test418 b/third-party/curl/tests/data/test418
index 6031b867b8..cdd25f4ba9 100644
--- a/third-party/curl/tests/data/test418
+++ b/third-party/curl/tests/data/test418
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ gzip
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -26,7 +26,6 @@ Transfer-Encoding: gzip
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -43,16 +42,15 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -sS --tr-encoding
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol crlf="yes">
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Connection: TE
 TE: gzip
+Connection: TE
 
 </protocol>
 
@@ -61,7 +59,7 @@ TE: gzip
 61
 </errorcode>
 <stderr mode="text">
-curl: (61) Reject response due to more than 5 content encodings
+curl: (61) Reject response exceeding limit of 5 transfer encodings
 </stderr>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test419 b/third-party/curl/tests/data/test419
index 35e12597fe..04a6a63d9f 100644
--- a/third-party/curl/tests/data/test419
+++ b/third-party/curl/tests/data/test419
@@ -1,31 +1,28 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 --dump-header
-failure
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 --dump-header to file that cannot be created
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -D loggg/save-here/fails
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test42 b/third-party/curl/tests/data/test42
index 3adaa0597c..43e8ac8bc5 100644
--- a/third-party/curl/tests/data/test42
+++ b/third-party/curl/tests/data/test42
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,16 @@ HTTP GET
 followlocation
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 302 OK swsclose
-Location: ../m o o.html/%TESTNUMBER0002    
+Location: ../m o o.html/%TESTNUMBER0002%repeat[4 x  ]%
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
 
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Location: this should be ignored
 Date: Tue, 09 Nov 2010 14:49:00 GMT
@@ -24,13 +24,9 @@ Connection: close
 
 body
 </data2>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 302 OK swsclose
-%if !hyper
-Location: ../m o o.html/%TESTNUMBER0002    
-%else
-Location: ../m o o.html/%TESTNUMBER0002
-%endif
+Location: ../m o o.html/%TESTNUMBER0002%repeat[4 x  ]%
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Connection: close
 
@@ -43,24 +39,22 @@ body
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP redirect with whitespace in path (and conversion)
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/are/all/twits/%TESTNUMBER -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/are/all/twits/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test420 b/third-party/curl/tests/data/test420
index 7b7ecb437e..8db0e21cb1 100644
--- a/third-party/curl/tests/data/test420
+++ b/third-party/curl/tests/data/test420
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ cookies
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes">
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Accept-Ranges: bytes
@@ -27,16 +27,15 @@ Set-Cookie: mycookie1=; Path=/; Max-Age=-1; Expires=Thu, 01 Jan 1970 00:00:00 GM
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 Setting cookies set with expired dates that were loaded from jar
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/func_test/del_cookie -b %LOGDIR/cookie%TESTNUMBER -c %LOGDIR/save%TESTNUMBER
 </command>
 <file name="%LOGDIR/cookie%TESTNUMBER" mode="text">
@@ -44,24 +43,23 @@ http://%HOSTIP:%HTTPPORT/func_test/del_cookie -b %LOGDIR/cookie%TESTNUMBER -c %L
 #HttpOnly_%HOSTIP	FALSE	/func_test	FALSE	21709598616	mycookie5	990
 #HttpOnly_%HOSTIP	FALSE	/func_test	FALSE	21709598616	mycookie4	950
 #HttpOnly_%HOSTIP	FALSE	/func_test	FALSE	21709598616	mycookie3	900
-#HttpOnly_%HOSTIP	FALSE	/func_test/	FALSE	21709598616	mycookie2	5900
+#HttpOnly_%HOSTIP	FALSE	/func_test	FALSE	21709598616	mycookie2	5900
 #HttpOnly_%HOSTIP	FALSE	/	FALSE	21709598616	mycookie1	4900
-#HttpOnly_%HOSTIP	FALSE	/func_test/	FALSE	0	mycookie	1200
+#HttpOnly_%HOSTIP	FALSE	/func_test	FALSE	0	mycookie	1200
 </file>
 <features>
 cookies
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol crlf="yes">
+<protocol crlf="headers">
 GET /func_test/del_cookie HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Cookie: mycookie2=5900; mycookie=1200; mycookie3=900; mycookie4=950; mycookie5=990; mycookie6=991; mycookie1=4900
+Cookie: mycookie2=5900; mycookie3=900; mycookie4=950; mycookie5=990; mycookie6=991; mycookie=1200; mycookie1=4900
 
 </protocol>
 <file name="%LOGDIR/save%TESTNUMBER" mode="text">
@@ -69,7 +67,7 @@ Cookie: mycookie2=5900; mycookie=1200; mycookie3=900; mycookie4=950; mycookie5=9
 # https://curl.se/docs/http-cookies.html
 # This file was generated by libcurl! Edit at your own risk.
 
-#HttpOnly_127.0.0.1	FALSE	/func_test/	FALSE	21709598616	mycookie2	5900
+#HttpOnly_127.0.0.1	FALSE	/func_test	FALSE	21709598616	mycookie2	5900
 </file>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test421 b/third-party/curl/tests/data/test421
index 0e4130b064..cee8511248 100644
--- a/third-party/curl/tests/data/test421
+++ b/third-party/curl/tests/data/test421
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,9 @@ header_json
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes">
+<data crlf="headers">
 HTTP/1.1 200 OK
 server: nginx
 date: Tue, 07 Mar 2023 15:14:41 GMT
@@ -21,7 +21,7 @@ referrer-policy: strict-origin-when-cross-origin
 access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
 access-control-max-age: 1728000
 access-control-allow-headers: Authorization, Content-Type, AuthorizationOauth, X-EARLY-ACCESS
-access-control-expose-headers: 
+access-control-expose-headers:%SP
 vary: Accept
 etag: W/"2678f9ab2ba550d164e7cc014aefd31e"
 cache-control: max-age=0, private, must-revalidate
@@ -36,7 +36,6 @@ feature-policy: accelerometer 'none'; camera 'none'; geolocation 'none'; gyrosco
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -50,10 +49,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w '%{stderr}%{header_json}\n' -s
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol crlf="yes">
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -71,7 +69,7 @@ Accept: */*
 "access-control-allow-methods":["GET, POST, PUT, DELETE, OPTIONS"],
 "access-control-max-age":["1728000"],
 "access-control-allow-headers":["Authorization, Content-Type, AuthorizationOauth, X-EARLY-ACCESS"],
-"access-control-expose-headers":["\r"],
+"access-control-expose-headers":[""],
 "etag":["W/\"2678f9ab2ba550d164e7cc014aefd31e\""],
 "cache-control":["max-age=0, private, must-revalidate"],
 "x-request-id":["375b343b3d2ecf9b442c0daf00fc4a9a"],
diff --git a/third-party/curl/tests/data/test422 b/third-party/curl/tests/data/test422
index 2caaa49154..29a50b4897 100644
--- a/third-party/curl/tests/data/test422
+++ b/third-party/curl/tests/data/test422
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,12 @@ cmdline
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <name>
 use --next with missing URL before it
 </name>
@@ -25,7 +21,6 @@ use --next with missing URL before it
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <stderr mode="text">
diff --git a/third-party/curl/tests/data/test423 b/third-party/curl/tests/data/test423
index 6c6e725b01..534087ac0c 100644
--- a/third-party/curl/tests/data/test423
+++ b/third-party/curl/tests/data/test423
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes" nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -24,7 +24,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -34,11 +33,14 @@ http
 -w with url.* variables
 </name>
 <command option="no-include">
-"http://uuuu:pppp@%HOSTIP:%HTTPPORT/%TESTNUMBER?qqqq#ffff" "h55p://hello2000:1/%TESTNUMBER?qqqq#ffff" "local host" "http://u22u:p22p@%HOSTIP:%HTTPPORT/%TESTNUMBER?qqqq#ffff" -w '%{url.host}+%{url.path}+%{url.scheme}+%{url.user}+%{url.password}+%{url.port}+%{url.query}+%{url.fragment}\n'
+"http://uuuu:pppp@%HOSTIP:%HTTPPORT/%TESTNUMBER?qqqq#ffff"
+"h55p://hello2000:1/%TESTNUMBER?qqqq#ffff"
+"local host"
+"http://u22u:p22p@%HOSTIP:%HTTPPORT/%TESTNUMBER?qqqq#ffff"
+-w '%{url.host}+%{url.path}+%{url.scheme}+%{url.user}+%{url.password}+%{url.port}+%{url.query}+%{url.fragment}\n'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <stdout>
diff --git a/third-party/curl/tests/data/test424 b/third-party/curl/tests/data/test424
index 36ba8c4b74..769bcb6901 100644
--- a/third-party/curl/tests/data/test424
+++ b/third-party/curl/tests/data/test424
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes" nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 301 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -23,7 +23,7 @@ Funny-head: yesyes
 Location: http://anotherhost.example:2023/%TESTNUMBER0002?moo.html
 
 </data>
-<data2 crlf="yes" nocheck="yes">
+<data2 crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -38,7 +38,6 @@ Funny-head: yesyes
 </data2>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -51,18 +50,22 @@ http
 -w with urle.* variables
 </name>
 <command option="no-include">
-"http://uuuu:pppp@%HOSTIP:%HTTPPORT/%TESTNUMBER?qqqq#ffff" "h55p://hello2000:1/%TESTNUMBER?qqqq#ffff" "local host" "http://u22u:p22p@%HOSTIP:%HTTPPORT/%TESTNUMBER?qqqq#ffff" -w '%{urle.host}+%{urle.path}+%{urle.scheme}+%{urle.user}+%{urle.password}+%{urle.port}+%{urle.query}+%{urle.fragment}\n' -x http://%HOSTIP:%HTTPPORT/ -L
+"http://uuuu:pppp@%HOSTIP:%HTTPPORT/%TESTNUMBER?qqqq#ffff"
+"h55p://hello2000:1/%TESTNUMBER?qqqq#ffff"
+"local host"
+"http://u22u:p22p@%HOSTIP:%HTTPPORT/%TESTNUMBER?qqqq#ffff"
+-w '%{urle.host}+%{urle.path}+%{urle.scheme}+%{urle.user}+%{urle.password}+%{urle.port}+%{urle.query}+%{urle.fragment}\n'
+-x http://%HOSTIP:%HTTPPORT/ -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <stdout>
-anotherhost.example+/%TESTNUMBER0002+http+uuuu+pppp+2023+moo.html+
-hello2000+/%TESTNUMBER+h55p+++1+qqqq+ffff
+anotherhost.example+/4240002+http+++2023+moo.html+
+hello2000+/424+h55p+++1+qqqq+ffff
 +++++++
-anotherhost.example+/%TESTNUMBER0002+http+u22u+p22p+2023+moo.html+
+anotherhost.example+/4240002+http+++2023+moo.html+
 </stdout>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test425 b/third-party/curl/tests/data/test425
index f09c4d3228..4f38060f9f 100644
--- a/third-party/curl/tests/data/test425
+++ b/third-party/curl/tests/data/test425
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ HTTP PUT
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes">
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
@@ -20,16 +20,15 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP PUT with path ending with slash + query
- </name>
- <command>
+</name>
+<command>
 -T %LOGDIR/up%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER/?fullpath
 </command>
 <file name="%LOGDIR/up%TESTNUMBER">
@@ -37,10 +36,9 @@ content
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER/?fullpath HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test426 b/third-party/curl/tests/data/test426
index 34c80c6aae..1f2443dbfe 100644
--- a/third-party/curl/tests/data/test426
+++ b/third-party/curl/tests/data/test426
@@ -1,16 +1,16 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
+Resume
 error detection
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -24,7 +24,6 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -d foobar -C 3
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test427 b/third-party/curl/tests/data/test427
index 1e08810ebd..4a2c29624b 100644
--- a/third-party/curl/tests/data/test427
+++ b/third-party/curl/tests/data/test427
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ cookies
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes" nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 301 move along
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Accept-Ranges: bytes
@@ -25,7 +25,7 @@ Location: %TESTNUMBER0002
 -foo-
 </data>
 
-<data2 crlf="yes">
+<data2 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Accept-Ranges: bytes
@@ -38,7 +38,6 @@ Content-Type: text/html
 
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -56,10 +55,9 @@ cookies
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol crlf="yes">
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test428 b/third-party/curl/tests/data/test428
index c06f2f9dff..73ef94f4c4 100644
--- a/third-party/curl/tests/data/test428
+++ b/third-party/curl/tests/data/test428
@@ -1,15 +1,16 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 variables
+--config
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes">
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -25,7 +26,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -51,7 +51,6 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -K %LOGDIR/cmd
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <protocol crlf="yes" nonewline="yes">
diff --git a/third-party/curl/tests/data/test429 b/third-party/curl/tests/data/test429
index 4091d1be0d..4971f8c482 100644
--- a/third-party/curl/tests/data/test429
+++ b/third-party/curl/tests/data/test429
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ variables
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes">
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -26,27 +26,25 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 <setenv>
-FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF=contents2023
+%repeat[129 x F]%=contents2023
 </setenv>
 <name>
 Expand environment variable in config file - too long name
 </name>
 <file name="%LOGDIR/cmd">
---expand-data {{FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF}}
+--expand-data {{%repeat[129 x F]%}}
 </file>
 <command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -K %LOGDIR/cmd
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <protocol crlf="yes" nonewline="yes">
@@ -57,7 +55,7 @@ Accept: */*
 Content-Length: 133
 Content-Type: application/x-www-form-urlencoded
 
-{{FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF}}
+{{%repeat[129 x F]%}}
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test43 b/third-party/curl/tests/data/test43
index 2526b60190..baddb70340 100644
--- a/third-party/curl/tests/data/test43
+++ b/third-party/curl/tests/data/test43
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -50,10 +51,10 @@ If this is received, the location following worked
 <server>
 http
 </server>
- <name>
+<name>
 HTTP Location: following over HTTP proxy
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -L -x %HOSTIP:%HTTPPORT
 </command>
 <features>
@@ -63,7 +64,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test430 b/third-party/curl/tests/data/test430
index 803869ed33..5efa519ef0 100644
--- a/third-party/curl/tests/data/test430
+++ b/third-party/curl/tests/data/test430
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Derived from on https://github.com/curl/curl/issues/5120
 <info>
@@ -8,7 +9,6 @@ POST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data1>
@@ -34,7 +34,6 @@ Content-Type: text/3
 </data3>
 </reply>
 
-#
 # Client-side
 <client>
 <file1 name="%LOGDIR/config%TESTNUMBER-a">
@@ -59,18 +58,17 @@ data = "c"
 <server>
 http
 </server>
- <name>
+<name>
 Three -K uses with --next and --data in each
- </name>
- <command>
+</name>
+<command>
 -K %LOGDIR/config%TESTNUMBER-a -K %LOGDIR/config%TESTNUMBER-b -K %LOGDIR/config%TESTNUMBER-c
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER0001 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test431 b/third-party/curl/tests/data/test431
index 339d05011f..f3e7541a81 100644
--- a/third-party/curl/tests/data/test431
+++ b/third-party/curl/tests/data/test431
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Derived from on https://github.com/curl/curl/issues/5120
 <info>
@@ -8,7 +9,6 @@ POST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data1>
@@ -34,7 +34,6 @@ Content-Type: text/3
 </data3>
 </reply>
 
-#
 # Client-side
 <client>
 <file1 name="%LOGDIR/config%TESTNUMBER-a">
@@ -53,18 +52,17 @@ data = "b"
 <server>
 http
 </server>
- <name>
+<name>
 Two -K uses with --next and then one on cmdline
- </name>
- <command>
+</name>
+<command>
 -K %LOGDIR/config%TESTNUMBER-a -K %LOGDIR/config%TESTNUMBER-b --next -d c %HOSTIP:%HTTPPORT/%TESTNUMBER0003 -H "c: c"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER0001 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test432 b/third-party/curl/tests/data/test432
index 474d8d9fab..ff2650782e 100644
--- a/third-party/curl/tests/data/test432
+++ b/third-party/curl/tests/data/test432
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Derived from on https://github.com/curl/curl/issues/5120
 <info>
@@ -8,7 +9,6 @@ POST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data1>
@@ -34,7 +34,6 @@ Content-Type: text/3
 </data3>
 </reply>
 
-#
 # Client-side
 <client>
 <file1 name="%LOGDIR/config%TESTNUMBER">
@@ -58,18 +57,17 @@ data = "c"
 <server>
 http
 </server>
- <name>
+<name>
 Use -K with --next and --config from within
- </name>
- <command>
+</name>
+<command>
 -K %LOGDIR/config%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER0001 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test433 b/third-party/curl/tests/data/test433
index c2e351c87b..85cf29ee49 100644
--- a/third-party/curl/tests/data/test433
+++ b/third-party/curl/tests/data/test433
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,9 @@
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Content-Length: 6
 Content-Type: text/1
@@ -17,10 +17,9 @@ Content-Type: text/1
 </data>
 </reply>
 
-#
 # Client-side
 <client>
-<file1 name="%LOGDIR/.curlrc">
+<file1 name="%LOGDIR/curlrc">
 --next
 header = "a: a"
 data = "curlrc read"
@@ -30,21 +29,24 @@ http
 </server>
 <setenv>
 XDG_CONFIG_HOME=%PWD/%LOGDIR
-HOME=
-CURL_HOME=
+HOME
+CURL_HOME
 </setenv>
 <name>
-Verify XDG_CONFIG_HOME use to find .curlrc
+Verify XDG_CONFIG_HOME use to find curlrc
 </name>
-<command>
-%HOSTIP:%HTTPPORT/%TESTNUMBER
+# set the terminal wide to avoid word wrap in the message
+<setenv>
+COLUMNS=300
+</setenv>
+<command option="no-q">
+%HOSTIP:%HTTPPORT/%TESTNUMBER --no-progress-meter
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -55,5 +57,13 @@ Content-Type: application/x-www-form-urlencoded
 
 curlrc read
 </protocol>
+
+# On Windows curl may use a backslash, convert that for the comparison
+<stripfile>
+s:\\:/:g
+</stripfile>
+<stderr mode="text">
+Note: Read config file from '%PWD/%LOGDIR/curlrc'
+</stderr>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test434 b/third-party/curl/tests/data/test434
index 8cf3622c51..b5f7ab820d 100644
--- a/third-party/curl/tests/data/test434
+++ b/third-party/curl/tests/data/test434
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP
 </keywords>
 </info>
 
-#
 <reply>
 <data>
 HTTP/1.1 200 OK
@@ -17,7 +17,6 @@ Content-Type: text/1
 </data>
 </reply>
 
-#
 <client>
 <file name="%LOGDIR/config%TESTNUMBER" nonewline="yes">
 url = %HOSTIP:%HTTPPORT/%TESTNUMBER
@@ -33,9 +32,8 @@ http
 </command>
 </client>
 
-#
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test435 b/third-party/curl/tests/data/test435
index 70b7896459..375da8bf1e 100644
--- a/third-party/curl/tests/data/test435
+++ b/third-party/curl/tests/data/test435
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,17 +7,15 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Content-Length: 0
 
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -30,10 +29,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w 'lo
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -51,7 +49,7 @@ Accept: */*
 <stripfile>
 s/local port == (\d+)/local port == [digits]/
 </stripfile>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 200 OK
 Content-Length: 0
 
diff --git a/third-party/curl/tests/data/test436 b/third-party/curl/tests/data/test436
index 3dbaa32f77..fa659fb8f6 100644
--- a/third-party/curl/tests/data/test436
+++ b/third-party/curl/tests/data/test436
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,9 @@
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Content-Length: 6
 Content-Type: text/1
@@ -17,7 +17,6 @@ Content-Type: text/1
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <file1 name="%LOGDIR/.config/curlrc">
@@ -30,20 +29,20 @@ http
 </server>
 <setenv>
 CURL_HOME=%PWD/%LOGDIR
-XDG_CONFIG_HOME=
+USERPROFILE
+XDG_CONFIG_HOME
 </setenv>
 <name>
 Find .curlrc in .config/curlrc via CURL_HOME
 </name>
-<command>
+<command option="no-q">
 %HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="yes" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test437 b/third-party/curl/tests/data/test437
index fde02e56f2..3bc6f62b26 100644
--- a/third-party/curl/tests/data/test437
+++ b/third-party/curl/tests/data/test437
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ Alt-Svc
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -22,32 +22,31 @@ Alt-Svc: h1="[ffff::1]:8181"
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-debug
+Debug
 alt-svc
+IPv6
 </features>
 <server>
 http
 </server>
- <name>
+<name>
 Alt-Svc to numerical IPv6 address
- </name>
+</name>
 <setenv>
-# make debug-curl accept Alt-Svc over plain HTTP
+# make Debug-curl accept Alt-Svc over plain HTTP
 CURL_ALTSVC_HTTP="yeah"
 </setenv>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --alt-svc "%LOGDIR/altsvc-%TESTNUMBER"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test438 b/third-party/curl/tests/data/test438
index e489d30a81..bab3bbdc07 100644
--- a/third-party/curl/tests/data/test438
+++ b/third-party/curl/tests/data/test438
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ HTTP/2
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
@@ -24,26 +24,25 @@ Alt-Svc: h1="%HOST6IP:%HTTP6PORT", ma=315360000; persist=0
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 alt-svc
-debug
-ipv6
+Debug
+IPv6
 </features>
 <server>
 http
 http-ipv6
 </server>
- <name>
+<name>
 HTTPS IPv4 GET translated by alt-svc to IPv6 address
- </name>
+</name>
 <setenv>
-# make debug-curl accept Alt-Svc over plain HTTP
+# make Debug-curl accept Alt-Svc over plain HTTP
 CURL_ALTSVC_HTTP="yeah"
 </setenv>
- <command>
+<command>
 --alt-svc "%LOGDIR/altsvc-%TESTNUMBER" "http://%HOSTIP:%HTTPPORT/%TESTNUMBER" "http://%HOSTIP:%HTTPPORT/%TESTNUMBER"
 </command>
 <file name="%LOGDIR/altsvc-%TESTNUMBER">
@@ -52,10 +51,9 @@ h1 %HOSTIP %HTTPPORT h1 %HOST6IP %HTTP6PORT "20290222 22:19:28" 0 0
 
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
diff --git a/third-party/curl/tests/data/test439 b/third-party/curl/tests/data/test439
index da12615316..0570c2d2f6 100644
--- a/third-party/curl/tests/data/test439
+++ b/third-party/curl/tests/data/test439
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ aws-sigv4
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes">
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -25,30 +25,29 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 <features>
-debug
+Debug
+aws
 </features>
 <name>
 aws-sigv4 with query
 </name>
 <command>
-"http://fake.fake.fake:8000/%TESTNUMBER/?name=me%&aim=b%aad&&&weirdo=*.//-" -u user:secret --aws-sigv4 "aws:amz:us-east-2:es" --connect-to fake.fake.fake:8000:%HOSTIP:%HTTPPORT
+"http://fake.fake.fake:8000/%TESTNUMBER/?name=me%AMPnoval%AMPaim=b%aad%AMP%AMP%AMPweirdo=*.//-" -u user:secret --aws-sigv4 "aws:amz:us-east-2:es" --connect-to fake.fake.fake:8000:%HOSTIP:%HTTPPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol crlf="yes">
-GET /%TESTNUMBER/?name=me%&aim=b%aad&&&weirdo=*.//- HTTP/1.1
+<protocol crlf="headers">
+GET /%TESTNUMBER/?name=me%AMPnoval%AMPaim=b%aad%AMP%AMP%AMPweirdo=*.//- HTTP/1.1
 Host: fake.fake.fake:8000
-Authorization: AWS4-HMAC-SHA256 Credential=user/19700101/us-east-2/es/aws4_request, SignedHeaders=host;x-amz-date, Signature=88884e3b3142133685b2092d29d8b522b785b1a9ec9e4a90cbea83e882f8dcb6
+Authorization: AWS4-HMAC-SHA256 Credential=user/19700101/us-east-2/es/aws4_request, SignedHeaders=host;x-amz-date, Signature=9dd8592929306832a6673d10063491391e486e5f50de4647ea7c2c797277e0a6
 X-Amz-Date: 19700101T000000Z
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test44 b/third-party/curl/tests/data/test44
index 46739ce81d..a168be3093 100644
--- a/third-party/curl/tests/data/test44
+++ b/third-party/curl/tests/data/test44
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -26,10 +27,10 @@ Mime
 <server>
 http
 </server>
- <name>
+<name>
 HTTP RFC1867-type formposting without Expect: header
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -F name=daniel -F tool=curl -F file=@%LOGDIR/test%TESTNUMBER.txt -H "Expect:"
 </command>
 # We create this file before the command is invoked!
@@ -46,30 +47,30 @@ bar
 ^(Content-Type: multipart/form-data;|------).*
 </strip>
 <protocol>
-POST /we/want/%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Content-Length: 408
-Content-Type: multipart/form-data; boundary=----------------------------7c633d5c27ce
-
-------------------------------7c633d5c27ce
-Content-Disposition: form-data; name="name"
-
-daniel
-------------------------------7c633d5c27ce
-Content-Disposition: form-data; name="tool"
-
-curl
-------------------------------7c633d5c27ce
-Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER.txt"
-Content-Type: text/plain
-
+POST /we/want/%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Content-Length: 432%CR
+Content-Type: multipart/form-data; boundary=----------------------------7c633d5c27ce%CR
+%CR
+------------------------------7c633d5c27ce%CR
+Content-Disposition: form-data; name="name"%CR
+%CR
+daniel%CR
+------------------------------7c633d5c27ce%CR
+Content-Disposition: form-data; name="tool"%CR
+%CR
+curl%CR
+------------------------------7c633d5c27ce%CR
+Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER.txt"%CR
+Content-Type: text/plain%CR
+%CR
 foo-
 This is a moo-
 bar
-
-------------------------------7c633d5c27ce--
+%CR
+------------------------------7c633d5c27ce--%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test440 b/third-party/curl/tests/data/test440
index 41b72292cb..3ed08f4730 100644
--- a/third-party/curl/tests/data/test440
+++ b/third-party/curl/tests/data/test440
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ trailing-dot
 <reply>
 
 # we use this as response to a CONNECT
-<connect nocheck="yes">
+<connect crlf="headers" nocheck="yes">
 HTTP/1.1 403 not OK at all
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -39,23 +40,27 @@ this.hsts.example "99991001 04:47:41"
 </file>
 
 <name>
-HSTS with trailing-dot host name in URL but none in hsts file
+HSTS with trailing-dot hostname in URL but none in hsts file
 </name>
 <command>
 -x http://%HOSTIP:%HTTPPORT http://this.hsts.example./%TESTNUMBER --hsts %LOGDIR/input%TESTNUMBER -w '%{url_effective}\n'
 </command>
+
+<disable>
+test-duphandle
+</disable>
 </client>
 
 <verify>
 # we let it CONNECT to the server to confirm HSTS but deny from there
-<protocol>
+<protocol crlf="headers">
 CONNECT this.hsts.example.:443 HTTP/1.1
 Host: this.hsts.example.:443
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 403 not OK at all
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -67,7 +72,10 @@ https://this.hsts.example./%TESTNUMBER
 </stdout>
 # Proxy CONNECT aborted
 <errorcode>
-56
+7
 </errorcode>
+<limits>
+Allocations: 160
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test441 b/third-party/curl/tests/data/test441
index 12c2833b2c..9574233302 100644
--- a/third-party/curl/tests/data/test441
+++ b/third-party/curl/tests/data/test441
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ trailing-dot
 <reply>
 
 # we use this as response to a CONNECT
-<connect nocheck="yes">
+<connect crlf="headers" nocheck="yes">
 HTTP/1.1 403 not OK at all
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -39,23 +40,26 @@ this.hsts.example. "99991001 04:47:41"
 </file>
 
 <name>
-HSTS with no t-dot host name in URL but t-dot in file
+HSTS with no t-dot hostname in URL but t-dot in file
 </name>
 <command>
 -x http://%HOSTIP:%HTTPPORT http://this.hsts.example/%TESTNUMBER --hsts %LOGDIR/input%TESTNUMBER -w '%{url_effective}\n'
 </command>
+<disable>
+test-duphandle
+</disable>
 </client>
 
 <verify>
 # we let it CONNECT to the server to confirm HSTS but deny from there
-<protocol>
+<protocol crlf="headers">
 CONNECT this.hsts.example:443 HTTP/1.1
 Host: this.hsts.example:443
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 403 not OK at all
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -67,7 +71,7 @@ https://this.hsts.example/%TESTNUMBER
 </stdout>
 # Proxy CONNECT aborted
 <errorcode>
-56
+7
 </errorcode>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test442 b/third-party/curl/tests/data/test442
index f21dcc47e6..e714a6f93c 100644
--- a/third-party/curl/tests/data/test442
+++ b/third-party/curl/tests/data/test442
@@ -1,12 +1,11 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # perl:
-#
 # for(1 .. 151) {
 #    print join("\t",
 #               "attack.invalid", "TRUE", "/", "FALSE", "0",
 #               "name$_", "could-be-large-$_")."\n";
 # }
-#
 <info>
 <keywords>
 HTTP
@@ -15,7 +14,6 @@ cookies
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -28,7 +26,6 @@ Content-Length: 6
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -198,10 +195,9 @@ cookies
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /a/b/%TESTNUMBER HTTP/1.1
 Host: attack.invalid:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -209,5 +205,8 @@ Accept: */*
 Cookie: name150=could-be-large-150; name149=could-be-large-149; name148=could-be-large-148; name147=could-be-large-147; name146=could-be-large-146; name145=could-be-large-145; name144=could-be-large-144; name143=could-be-large-143; name142=could-be-large-142; name141=could-be-large-141; name140=could-be-large-140; name139=could-be-large-139; name138=could-be-large-138; name137=could-be-large-137; name136=could-be-large-136; name135=could-be-large-135; name134=could-be-large-134; name133=could-be-large-133; name132=could-be-large-132; name131=could-be-large-131; name130=could-be-large-130; name129=could-be-large-129; name128=could-be-large-128; name127=could-be-large-127; name126=could-be-large-126; name125=could-be-large-125; name124=could-be-large-124; name123=could-be-large-123; name122=could-be-large-122; name121=could-be-large-121; name120=could-be-large-120; name119=could-be-large-119; name118=could-be-large-118; name117=could-be-large-117; name116=could-be-large-116; name115=could-be-large-115; name114=could-be-large-114; name113=could-be-large-113; name112=could-be-large-112; name111=could-be-large-111; name110=could-be-large-110; name109=could-be-large-109; name108=could-be-large-108; name107=could-be-large-107; name106=could-be-large-106; name105=could-be-large-105; name104=could-be-large-104; name103=could-be-large-103; name102=could-be-large-102; name101=could-be-large-101; name100=could-be-large-100; name99=could-be-large-99; name98=could-be-large-98; name97=could-be-large-97; name96=could-be-large-96; name95=could-be-large-95; name94=could-be-large-94; name93=could-be-large-93; name92=could-be-large-92; name91=could-be-large-91; name90=could-be-large-90; name89=could-be-large-89; name88=could-be-large-88; name87=could-be-large-87; name86=could-be-large-86; name85=could-be-large-85; name84=could-be-large-84; name83=could-be-large-83; name82=could-be-large-82; name81=could-be-large-81; name80=could-be-large-80; name79=could-be-large-79; name78=could-be-large-78; name77=could-be-large-77; name76=could-be-large-76; name75=could-be-large-75; name74=could-be-large-74; name73=could-be-large-73; name72=could-be-large-72; name71=could-be-large-71; name70=could-be-large-70; name69=could-be-large-69; name68=could-be-large-68; name67=could-be-large-67; name66=could-be-large-66; name65=could-be-large-65; name64=could-be-large-64; name63=could-be-large-63; name62=could-be-large-62; name61=could-be-large-61; name60=could-be-large-60; name59=could-be-large-59; name58=could-be-large-58; name57=could-be-large-57; name56=could-be-large-56; name55=could-be-large-55; name54=could-be-large-54; name53=could-be-large-53; name52=could-be-large-52; name51=could-be-large-51; name50=could-be-large-50; name49=could-be-large-49; name48=could-be-large-48; name47=could-be-large-47; name46=could-be-large-46; name45=could-be-large-45; name44=could-be-large-44; name43=could-be-large-43; name42=could-be-large-42; name41=could-be-large-41; name40=could-be-large-40; name39=could-be-large-39; name38=could-be-large-38; name37=could-be-large-37; name36=could-be-large-36; name35=could-be-large-35; name34=could-be-large-34; name33=could-be-large-33; name32=could-be-large-32; name31=could-be-large-31; name30=could-be-large-30; name29=could-be-large-29; name28=could-be-large-28; name27=could-be-large-27; name26=could-be-large-26; name25=could-be-large-25; name24=could-be-large-24; name23=could-be-large-23; name22=could-be-large-22; name21=could-be-large-21; name20=could-be-large-20; name19=could-be-large-19; name18=could-be-large-18; name17=could-be-large-17; name16=could-be-large-16; name15=could-be-large-15; name14=could-be-large-14; name13=could-be-large-13; name12=could-be-large-12; name11=could-be-large-11; name10=could-be-large-10; name9=could-be-large-9; name8=could-be-large-8; name7=could-be-large-7; name6=could-be-large-6; name5=could-be-large-5; name4=could-be-large-4; name3=could-be-large-3; name2=could-be-large-2; name1=could-be-large-1
 
 </protocol>
+<limits>
+Allocations: 1100
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test443 b/third-party/curl/tests/data/test443
index b06c2536a0..c396450aab 100644
--- a/third-party/curl/tests/data/test443
+++ b/third-party/curl/tests/data/test443
@@ -1,12 +1,11 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # perl:
-#
 #for(1 .. 20) {
 #    print join("\t",
 #               "attack.invalid", "TRUE", "/", "FALSE", "0",
 #               "huge-$_", ('a' x 500)."-$_")."\n";
 #}
-#
 <info>
 <keywords>
 HTTP
@@ -15,7 +14,6 @@ cookies
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -28,7 +26,6 @@ Content-Length: 6
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -41,41 +38,40 @@ Cookie header in request no longer than 8K
 http://attack.invalid:%HTTPPORT/a/b/%TESTNUMBER -b %LOGDIR/cookie%TESTNUMBER --resolve attack.invalid:%HTTPPORT:%HOSTIP -L
 </command>
 <file name="%LOGDIR/cookie%TESTNUMBER" mode="text">
-attack.invalid	TRUE	/	FALSE	0	huge-1	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-1
-attack.invalid	TRUE	/	FALSE	0	huge-2	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-2
-attack.invalid	TRUE	/	FALSE	0	huge-3	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-3
-attack.invalid	TRUE	/	FALSE	0	huge-4	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-4
-attack.invalid	TRUE	/	FALSE	0	huge-5	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-5
-attack.invalid	TRUE	/	FALSE	0	huge-6	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-6
-attack.invalid	TRUE	/	FALSE	0	huge-7	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-7
-attack.invalid	TRUE	/	FALSE	0	huge-8	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-8
-attack.invalid	TRUE	/	FALSE	0	huge-9	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-9
-attack.invalid	TRUE	/	FALSE	0	huge-10	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-10
-attack.invalid	TRUE	/	FALSE	0	huge-11	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-11
-attack.invalid	TRUE	/	FALSE	0	huge-12	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-12
-attack.invalid	TRUE	/	FALSE	0	huge-13	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-13
-attack.invalid	TRUE	/	FALSE	0	huge-14	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-14
-attack.invalid	TRUE	/	FALSE	0	huge-15	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-15
-attack.invalid	TRUE	/	FALSE	0	huge-16	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-16
-attack.invalid	TRUE	/	FALSE	0	huge-17	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-17
-attack.invalid	TRUE	/	FALSE	0	huge-18	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-18
-attack.invalid	TRUE	/	FALSE	0	huge-19	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-19
-attack.invalid	TRUE	/	FALSE	0	huge-20	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-20
+attack.invalid	TRUE	/	FALSE	0	huge-1	%repeat[500 x a]%-1
+attack.invalid	TRUE	/	FALSE	0	huge-2	%repeat[500 x a]%-2
+attack.invalid	TRUE	/	FALSE	0	huge-3	%repeat[500 x a]%-3
+attack.invalid	TRUE	/	FALSE	0	huge-4	%repeat[500 x a]%-4
+attack.invalid	TRUE	/	FALSE	0	huge-5	%repeat[500 x a]%-5
+attack.invalid	TRUE	/	FALSE	0	huge-6	%repeat[500 x a]%-6
+attack.invalid	TRUE	/	FALSE	0	huge-7	%repeat[500 x a]%-7
+attack.invalid	TRUE	/	FALSE	0	huge-8	%repeat[500 x a]%-8
+attack.invalid	TRUE	/	FALSE	0	huge-9	%repeat[500 x a]%-9
+attack.invalid	TRUE	/	FALSE	0	huge-10	%repeat[500 x a]%-10
+attack.invalid	TRUE	/	FALSE	0	huge-11	%repeat[500 x a]%-11
+attack.invalid	TRUE	/	FALSE	0	huge-12	%repeat[500 x a]%-12
+attack.invalid	TRUE	/	FALSE	0	huge-13	%repeat[500 x a]%-13
+attack.invalid	TRUE	/	FALSE	0	huge-14	%repeat[500 x a]%-14
+attack.invalid	TRUE	/	FALSE	0	huge-15	%repeat[500 x a]%-15
+attack.invalid	TRUE	/	FALSE	0	huge-16	%repeat[500 x a]%-16
+attack.invalid	TRUE	/	FALSE	0	huge-17	%repeat[500 x a]%-17
+attack.invalid	TRUE	/	FALSE	0	huge-18	%repeat[500 x a]%-18
+attack.invalid	TRUE	/	FALSE	0	huge-19	%repeat[500 x a]%-19
+attack.invalid	TRUE	/	FALSE	0	huge-20	%repeat[500 x a]%-20
 </file>
 <features>
 cookies
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /a/b/%TESTNUMBER HTTP/1.1
 Host: attack.invalid:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Cookie: huge-20=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-20; huge-19=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-19; huge-18=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-18; huge-17=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-17; huge-16=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-16; huge-15=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-15; huge-14=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-14; huge-13=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-13; huge-12=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-12; huge-11=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-11; huge-10=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-10; huge-9=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-9; huge-8=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-8; huge-7=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-7; huge-6=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-6
+Cookie: huge-20=%repeat[500 x a]%-20; huge-19=%repeat[500 x a]%-19; huge-18=%repeat[500 x a]%-18; huge-17=%repeat[500 x a]%-17; huge-16=%repeat[500 x a]%-16; huge-15=%repeat[500 x a]%-15; huge-14=%repeat[500 x a]%-14; huge-13=%repeat[500 x a]%-13; huge-12=%repeat[500 x a]%-12; huge-11=%repeat[500 x a]%-11; huge-10=%repeat[500 x a]%-10; huge-9=%repeat[500 x a]%-9; huge-8=%repeat[500 x a]%-8; huge-7=%repeat[500 x a]%-7; huge-6=%repeat[500 x a]%-6
 
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test444 b/third-party/curl/tests/data/test444
index cdacda180c..e7623f6546 100644
--- a/third-party/curl/tests/data/test444
+++ b/third-party/curl/tests/data/test444
@@ -1,10 +1,8 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # perl:
-#
 #for(1 .. 200) {
-#
 #}
-#
 <info>
 <keywords>
 HTTP
@@ -13,7 +11,6 @@ cookies
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -106,7 +103,6 @@ Set-Cookie: cookie-80=yes;
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -123,10 +119,9 @@ cookies
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /a/b/%TESTNUMBER HTTP/1.1
 Host: attack.invalid:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -138,56 +133,56 @@ Accept: */*
 # https://curl.se/docs/http-cookies.html
 # This file was generated by libcurl! Edit at your own risk.
 
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-50	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-49	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-48	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-47	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-46	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-45	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-44	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-43	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-42	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-41	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-40	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-39	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-38	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-37	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-36	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-35	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-34	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-33	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-32	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-31	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-30	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-29	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-28	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-27	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-26	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-25	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-24	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-23	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-22	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-21	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-20	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-19	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-18	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-17	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-16	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-15	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-14	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-13	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-12	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-11	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-10	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-9	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-8	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-7	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-6	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-5	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-4	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-3	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-2	yes
-attack.invalid	FALSE	/a/b/	FALSE	0	cookie-1	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-50	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-49	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-48	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-47	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-46	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-45	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-44	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-43	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-42	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-41	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-40	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-39	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-38	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-37	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-36	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-35	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-34	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-33	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-32	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-31	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-30	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-29	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-28	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-27	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-26	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-25	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-24	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-23	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-22	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-21	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-20	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-19	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-18	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-17	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-16	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-15	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-14	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-13	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-12	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-11	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-10	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-9	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-8	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-7	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-6	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-5	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-4	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-3	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-2	yes
+attack.invalid	FALSE	/a/b	FALSE	0	cookie-1	yes
 </file>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test445 b/third-party/curl/tests/data/test445
index 0406c0f9ac..a652cde588 100644
--- a/third-party/curl/tests/data/test445
+++ b/third-party/curl/tests/data/test445
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP proxy
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <connect>
@@ -21,7 +21,6 @@ Connection: close
 </connect>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -36,26 +35,27 @@ pop3
 rtsp
 scp
 sftp
-smb
 smtp
 </features>
 <server>
 http-proxy
 </server>
- <name>
+<name>
 Refuse tunneling protocols through HTTP proxy
- </name>
- <command>
--x http://%HOSTIP:%PROXYPORT/%TESTNUMBER -p gopher://127.0.0.1 dict://127.0.0.1 http://moo https://example telnet://another ftp://yes ftps://again imap://more ldap://perhaps mqtt://yes pop3://mail rtsp://harder scp://copy sftp://files smb://wird smtp://send
+</name>
+<command>
+-x http://%HOSTIP:%PROXYPORT/%TESTNUMBER -p gopher://127.0.0.1 dict://127.0.0.1 http://moo https://example telnet://another ftp://yes ftps://again imap://more ldap://perhaps mqtt://yes pop3://mail rtsp://harder scp://copy sftp://files --insecure
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # refused in the CONNECT
 <errorcode>
-56
+7
 </errorcode>
+<limits>
+Allocations: 1500
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test446 b/third-party/curl/tests/data/test446
index 82a2289fdc..ceae26b7e7 100644
--- a/third-party/curl/tests/data/test446
+++ b/third-party/curl/tests/data/test446
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,18 +12,18 @@ trailing-dot
 <reply>
 
 # we use this as response to a CONNECT
-<connect nocheck="yes">
+<connect crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 
 </connect>
-<data crlf="yes">
+<data crlf="headers">
 HTTP/1.1 200 OK
 Content-Length: 6
 Strict-Transport-Security: max-age=604800
 
 -foo-
 </data>
-<data2 crlf="yes">
+<data2 crlf="headers">
 HTTP/1.1 200 OK
 Content-Length: 6
 Strict-Transport-Security: max-age=6048000
@@ -41,7 +41,7 @@ http-proxy
 HSTS
 proxy
 https
-debug
+Debug
 </features>
 <setenv>
 CURL_HSTS_HTTP=yes
@@ -58,7 +58,7 @@ HSTS with two URLs
 
 <verify>
 # we let it CONNECT to the server to confirm HSTS but deny from there
-<proxy crlf="yes">
+<proxy crlf="headers">
 GET http://this.hsts.example./%TESTNUMBER HTTP/1.1
 Host: this.hsts.example.
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test447 b/third-party/curl/tests/data/test447
index f514a130e5..5a5ede68fe 100644
--- a/third-party/curl/tests/data/test447
+++ b/third-party/curl/tests/data/test447
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ growing file
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes">
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -26,11 +26,10 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-debug
+Debug
 </features>
 <server>
 http
@@ -49,7 +48,6 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -T %LOGDIR/upload%TESTNUMBER
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <protocol crlf="yes" nonewline="yes">
diff --git a/third-party/curl/tests/data/test448 b/third-party/curl/tests/data/test448
index 0e257e7049..208684d80e 100644
--- a/third-party/curl/tests/data/test448
+++ b/third-party/curl/tests/data/test448
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ variables
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes">
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -26,7 +26,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -35,7 +34,6 @@ http
 <setenv>
 FUNVALUE=contents
 VALUE2=curl
-BLANK=
 </setenv>
 <name>
 Environment variables within config file, unbalanced braces
@@ -50,7 +48,6 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -K %LOGDIR/cmd
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <protocol crlf="yes" nonewline="yes">
diff --git a/third-party/curl/tests/data/test449 b/third-party/curl/tests/data/test449
index 5981996025..dd9ee77492 100644
--- a/third-party/curl/tests/data/test449
+++ b/third-party/curl/tests/data/test449
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ variables
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes">
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -26,7 +26,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -36,6 +35,7 @@ http
 FUNVALUE=contents
 VALUE2=curl
 BLANK=
+CURL_NOT_SET
 </setenv>
 <name>
 Environment variables in config file w/o [expand]
@@ -48,7 +48,6 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -K %LOGDIR/cmd
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <protocol crlf="yes" nonewline="yes">
diff --git a/third-party/curl/tests/data/test45 b/third-party/curl/tests/data/test45
index 3cafa63388..6412a68698 100644
--- a/third-party/curl/tests/data/test45
+++ b/third-party/curl/tests/data/test45
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,7 +13,7 @@ followlocation
 HTTP/1.1 301 This is a weirdo text message swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
-Location: data.cgi?moo=http://&/%TESTNUMBER0002
+Location: data.cgi?moo=http://%AMP/%TESTNUMBER0002
 Connection: close
 
 This server reply is for testing a simple Location: following
@@ -31,7 +32,7 @@ If this is received, the location following worked
 HTTP/1.1 301 This is a weirdo text message swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
-Location: data.cgi?moo=http://&/%TESTNUMBER0002
+Location: data.cgi?moo=http://%AMP/%TESTNUMBER0002
 Connection: close
 
 HTTP/1.1 200 Followed here fine swsclose
@@ -49,23 +50,23 @@ If this is received, the location following worked
 <server>
 http
 </server>
- <name>
+<name>
 simple HTTP Location: without protocol in initial URL
- </name>
- <command>
+</name>
+<command>
 %HOSTIP:%HTTPPORT/want/%TESTNUMBER -L
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
-GET /want/data.cgi?moo=http://&/%TESTNUMBER0002 HTTP/1.1
+GET /want/data.cgi?moo=http://%AMP/%TESTNUMBER0002 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test450 b/third-party/curl/tests/data/test450
index a6fa641036..9f19e86871 100644
--- a/third-party/curl/tests/data/test450
+++ b/third-party/curl/tests/data/test450
@@ -1,16 +1,15 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
---config
 variables
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes">
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -26,7 +25,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -43,7 +41,6 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --variable what@%LOGDIR/junk --expand-data
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <protocol crlf="yes" nonewline="yes">
diff --git a/third-party/curl/tests/data/test451 b/third-party/curl/tests/data/test451
index 7c8fe7d93b..3b9e30a7c4 100644
--- a/third-party/curl/tests/data/test451
+++ b/third-party/curl/tests/data/test451
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ variables
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes">
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -25,7 +25,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -42,7 +41,6 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --variable what@%LOGDIR/junk --variable sec
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <protocol crlf="yes" nonewline="yes">
diff --git a/third-party/curl/tests/data/test452 b/third-party/curl/tests/data/test452
index 39f0460dab..d2a8ab314b 100644
--- a/third-party/curl/tests/data/test452
+++ b/third-party/curl/tests/data/test452
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,12 +6,10 @@ variables
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -24,7 +23,6 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --variable what=hello --expand-data "--{{wh
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test453 b/third-party/curl/tests/data/test453
index c1b27d03e2..9dab3ba331 100644
--- a/third-party/curl/tests/data/test453
+++ b/third-party/curl/tests/data/test453
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ variables
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
@@ -23,7 +23,6 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --variable what@%LOGDIR/junk --expand-data
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test454 b/third-party/curl/tests/data/test454
index 85fc779bf1..8526be6407 100644
--- a/third-party/curl/tests/data/test454
+++ b/third-party/curl/tests/data/test454
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,12 +6,10 @@ variables
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -24,7 +23,6 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --variable what=hello --expand-data "--{{wh
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test455 b/third-party/curl/tests/data/test455
index ffe6bd14c1..1d53354eee 100644
--- a/third-party/curl/tests/data/test455
+++ b/third-party/curl/tests/data/test455
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,9 @@ variables
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes">
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -24,7 +24,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -34,15 +33,14 @@ http
 Variable using base64
 </name>
 <command>
---variable moby="Call me Ishmael" --expand-url "http://%HOSTIP:%HTTPPORT/{{moby:b64}}/%TESTNUMBER"
+--variable moby="Call me Ishmael" --variable what=%b64[white-whale]b64% --expand-url "http://%HOSTIP:%HTTPPORT/{{moby:b64}}/{{what:64dec}}/%TESTNUMBER"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <protocol crlf="yes">
-GET /%b64[Call me Ishmael]b64%/%TESTNUMBER HTTP/1.1
+GET /%b64[Call me Ishmael]b64%/white-whale/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test456 b/third-party/curl/tests/data/test456
index 1623aecaf7..169cf3882c 100644
--- a/third-party/curl/tests/data/test456
+++ b/third-party/curl/tests/data/test456
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ variables
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
@@ -23,7 +23,6 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --variable what@%LOGDIR/junk --expand-data
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test457 b/third-party/curl/tests/data/test457
new file mode 100644
index 0000000000..6b0b78df58
--- /dev/null
+++ b/third-party/curl/tests/data/test457
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+chunked Transfer-Encoding
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 funky chunky!
+Server: fakeit/0.9 fakeitbad/1.0
+Transfer-Encoding: chunked
+Connection: mooo
+
+40%CR
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%CR
+30%CR
+bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%CR
+21;heresatest=moooo%CR
+cccccccccccccccccccccccccccccc
+c
+%CR
+0%CR
+%CR
+</data>
+<datacheck>
+HTTP/1.1 200 funky chunky!
+Server: fakeit/0.9 fakeitbad/1.0
+Transfer-Encoding: chunked
+Connection: mooo
+
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbcccccccccccccccccccccccccccccc
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+chunked Transfer-Encoding with --max-filesize
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --max-filesize 143
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+# curl: (63) Exceeded the maximum allowed file size (143)
+<errorcode>
+63
+</errorcode>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test458 b/third-party/curl/tests/data/test458
new file mode 100644
index 0000000000..516bbd250d
--- /dev/null
+++ b/third-party/curl/tests/data/test458
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+variables
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<setenv>
+FUNVALUE=contents%TESTNUMBER
+VALUE2=curl
+</setenv>
+<name>
+variable expand the filename with --expand-output
+</name>
+<file name="%LOGDIR/cmd">
+--variable %FUNVALUE
+--expand-output %LOGDIR/{{FUNVALUE}}
+</file>
+<command option="no-output">
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -K %LOGDIR/cmd
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/contents%TESTNUMBER" crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test459 b/third-party/curl/tests/data/test459
new file mode 100644
index 0000000000..91f2d67bca
--- /dev/null
+++ b/third-party/curl/tests/data/test459
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--config
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+config file with argument using whitespace missing quotes
+</name>
+<file name="%LOGDIR/config">
+data = arg with space
+</file>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --config %LOGDIR/config --silent
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+POST /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 3
+Content-Type: application/x-www-form-urlencoded
+
+arg
+</protocol>
+<stderr mode="warn">
+Warning: %LOGDIR/config:1 Option 'data' uses argument with unquoted whitespace.%SP
+Warning: This may cause side-effects. Consider double quotes.
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test46 b/third-party/curl/tests/data/test46
index 04563ea8c2..b46b0e41a6 100644
--- a/third-party/curl/tests/data/test46
+++ b/third-party/curl/tests/data/test46
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ cookiejar
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Server: Microsoft-IIS/4.0
 Date: Tue, 25 Sep 2001 19:37:44 GMT
@@ -24,7 +25,7 @@ Set-Cookie: ckyPersistent=permanent; expires=Fri, 13-Feb-2037 11:56:27 GMT; path
 Set-Cookie: ckySession=temporary; path=/
 Set-Cookie: ASPSESSIONIDQGGQQSJJ=GKNBDIFAAOFDPDAIEAKDIBKE; path=/
 Set-Cookie: justaname=; path=/;
-Set-Cookie: simplyhuge=zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
+Set-Cookie: simplyhuge=%repeat[3998 x z]%
 Cache-control: private
 Content-Length: 41
 
@@ -37,17 +38,17 @@ This server reply is for testing cookies
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with bad domain name, get cookies and store in cookie jar
- </name>
+</name>
 # Explicitly set the time zone to a known good one, in case the user is
 # using one of the 'right' zones that take into account leap seconds
 # which causes the cookie expiry times to be different from what we expect.
 <setenv>
 TZ=GMT
 </setenv>
- <command>
-domain..tld:%HTTPPORT/want/%TESTNUMBER --resolve domain..tld:%HTTPPORT:%HOSTIP -c %LOGDIR/jar%TESTNUMBER -b %LOGDIR/injar%TESTNUMBER
+<command>
+domain..tld:%HTTPPORT/want/%TESTNUMBER --resolve domain..tld:%HTTPPORT:%HOSTIP -c %LOGDIR/jar%TESTNUMBER -b %LOGDIR -b %LOGDIR/injar%TESTNUMBER
 </command>
 <file name="%LOGDIR/injar%TESTNUMBER">
 # Netscape HTTP Cookie File
@@ -65,7 +66,7 @@ www.loser.com	FALSE	/	FALSE	2139150993	UID	99
 domain..tld	FALSE	/	FALSE	2139150993	mooo	indeed
 #HttpOnly_domain..tld	FALSE	/want	FALSE	2139150993	mooo2	indeed2
 %endif
-domain..tld	FALSE	/want	FALSE	0	empty	
+domain..tld	FALSE	/want	FALSE	0	empty%TAB
 </file>
 <features>
 cookies
@@ -74,7 +75,7 @@ cookies
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: domain..tld:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -87,20 +88,19 @@ Cookie: empty=; mooo2=indeed2; mooo=indeed
 # https://curl.se/docs/http-cookies.html
 # This file was generated by libcurl! Edit at your own risk.
 
-domain..tld	FALSE	/want/	FALSE	0	simplyhuge	zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
-domain..tld	FALSE	/	FALSE	0	justaname	
+domain..tld	FALSE	/want	FALSE	0	simplyhuge	%repeat[3998 x z]%
+domain..tld	FALSE	/	FALSE	0	justaname%TAB
 domain..tld	FALSE	/	FALSE	0	ASPSESSIONIDQGGQQSJJ	GKNBDIFAAOFDPDAIEAKDIBKE
 domain..tld	FALSE	/	FALSE	0	ckySession	temporary
+domain..tld	FALSE	/	FALSE	%days[400]	ckyPersistent	permanent
 %if large-time
-domain..tld	FALSE	/	FALSE	17517902187	ckyPersistent	permanent
-domain..tld	FALSE	/want	FALSE	0	empty	
+domain..tld	FALSE	/want	FALSE	0	empty%TAB
 #HttpOnly_domain..tld	FALSE	/want	FALSE	22139150993	mooo2	indeed2
 domain..tld	FALSE	/	FALSE	22139150993	mooo	indeed
 www.loser.com	FALSE	/	FALSE	22139150993	UID	99
 www.fake.come	FALSE	/	FALSE	22147483647	cookiecliente	si
 %else
-domain..tld	FALSE	/	FALSE	2118138987	ckyPersistent	permanent
-domain..tld	FALSE	/want	FALSE	0	empty	
+domain..tld	FALSE	/want	FALSE	0	empty%TAB
 #HttpOnly_domain..tld	FALSE	/want	FALSE	2139150993	mooo2	indeed2
 domain..tld	FALSE	/	FALSE	2139150993	mooo	indeed
 www.loser.com	FALSE	/	FALSE	2139150993	UID	99
diff --git a/third-party/curl/tests/data/test460 b/third-party/curl/tests/data/test460
new file mode 100644
index 0000000000..0195106356
--- /dev/null
+++ b/third-party/curl/tests/data/test460
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+variables
+expand
+</keywords>
+</info>
+
+# Client-side
+<client>
+<name>
+try --expand without an argument
+</name>
+<command>
+--expand-url
+</command>
+</client>
+
+<verify>
+<errorcode>
+2
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test461 b/third-party/curl/tests/data/test461
new file mode 100644
index 0000000000..b387f8052e
--- /dev/null
+++ b/third-party/curl/tests/data/test461
@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+--header
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+disable Host: when specified as lower case
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -H host:
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test462 b/third-party/curl/tests/data/test462
new file mode 100644
index 0000000000..1a0ec5407e
--- /dev/null
+++ b/third-party/curl/tests/data/test462
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+variables
+--config
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<name>
+Missing environment variables in config file
+</name>
+<file name="%LOGDIR/cmd">
+variable %MISSING
+expand-data {{MISSING}}
+</file>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -K %LOGDIR/cmd
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+2
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test463 b/third-party/curl/tests/data/test463
new file mode 100644
index 0000000000..4cd99d546c
--- /dev/null
+++ b/third-party/curl/tests/data/test463
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP POST
+-d
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 4
+
+ok!
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP with -d @file with file containing CR, LF and null byte
+</name>
+<file name="%LOGDIR/input463">
+%hex[one%0dtwo%0dthree]hex%
+%hex[four%00five]hex%
+</file>
+<command>
+-d @%LOGDIR/input463 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+POST /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 19
+Content-Type: application/x-www-form-urlencoded
+
+onetwothreefourfive
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test467 b/third-party/curl/tests/data/test467
new file mode 100644
index 0000000000..799e1609f6
--- /dev/null
+++ b/third-party/curl/tests/data/test467
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+cmdline
+</keywords>
+</info>
+
+# Client-side
+<client>
+<name>
+use a bad short option letter that does not exist (after one does exist)
+</name>
+
+# the second option is outside the normal accepted range
+<command>
+%hex[curl -v%08 http://example.com]hex%
+</command>
+</client>
+
+# Verify errorcode
+<verify>
+<errorcode>
+2
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test468 b/third-party/curl/tests/data/test468
new file mode 100644
index 0000000000..c1529c0aac
--- /dev/null
+++ b/third-party/curl/tests/data/test468
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--write-out
+--config
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+set -w in config, then reset -w to blank on cmdline
+</name>
+<file name="%LOGDIR/cmd%TESTNUMBER">
+-w "output\n"
+</file>
+<command option="no-include">
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -K %LOGDIR/cmd%TESTNUMBER -w ""
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<stdout>
+-foo-
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test469 b/third-party/curl/tests/data/test469
new file mode 100644
index 0000000000..4f7831b8a4
--- /dev/null
+++ b/third-party/curl/tests/data/test469
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+!win32
+</features>
+<server>
+http
+</server>
+<name>
+warn about Unicode quote character
+</name>
+<command>
+-H %hex[%e2%80%9c]hex%host: %HOSTIP:%HTTPPORT/%hex[%e2%80%9c]hex% -s
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<stderr>
+%hex[Warning: The argument '%e2%80%9chost:' starts with a Unicode character. Maybe ASCII ]hex%
+Warning: was intended?
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test47 b/third-party/curl/tests/data/test47
index 93f15c20cb..879cde9cb2 100644
--- a/third-party/curl/tests/data/test47
+++ b/third-party/curl/tests/data/test47
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 HTTP/1.0
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -18,24 +18,22 @@ Server: test-server/fake
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 simple HTTP 1.0 GET
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -0
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.0
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test470 b/third-party/curl/tests/data/test470
new file mode 100644
index 0000000000..02362e5f3d
--- /dev/null
+++ b/third-party/curl/tests/data/test470
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+warn about Unicode quote character read from config file
+</name>
+<file name="%LOGDIR/input%TESTNUMBER">
+-H %hex[%e2%80%9c]hex%host:fake%hex[%e2%80%9d]hex%
+</file>
+<command>
+%HOSTIP:%HTTPPORT --no-progress-meter -K "%LOGDIR/input%TESTNUMBER"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<stderr mode="text">
+%hex[Warning: The argument '%e2%80%9chost:fake%e2%80%9d' starts with a Unicode character. Maybe ]hex%
+Warning: ASCII was intended?
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test471 b/third-party/curl/tests/data/test471
new file mode 100644
index 0000000000..7f79a7943c
--- /dev/null
+++ b/third-party/curl/tests/data/test471
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+globbing
+{} list
+</keywords>
+</info>
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+<data1>
+HTTP/2 200 OK
+Content-Type: text/html
+Funny-head: swsclose
+Connection: close
+
+crap data
+</data1>
+</reply>
+
+# Client-side
+<client>
+<features>
+http/2
+http
+</features>
+<server>
+http
+</server>
+<name>
+Reject HTTP/1.1 to HTTP/2 switch on the same connection
+</name>
+<command option="no-output">
+"http://%HOSTIP:%HTTPPORT/{%TESTNUMBER,%TESTNUMBER0001}" -o "%LOGDIR/dumpit#1.dump"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+# curl: (1) Version mismatch (from HTTP/1 to HTTP/2)
+<errorcode>
+8
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test472 b/third-party/curl/tests/data/test472
new file mode 100644
index 0000000000..f2e96717f7
--- /dev/null
+++ b/third-party/curl/tests/data/test472
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+aws-sigv4
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+Debug
+Unicode
+aws
+</features>
+<name>
+aws-sigv4 with query using unicode
+</name>
+<command>
+"http://fake.fake.fake:8000/%TESTNUMBER/a=%hex[%e3%81%82]hex%" -u user:secret --aws-sigv4 "aws:amz:us-east-2:es" --connect-to fake.fake.fake:8000:%HOSTIP:%HTTPPORT
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER/a=%E3%81%82 HTTP/1.1
+Host: fake.fake.fake:8000
+Authorization: AWS4-HMAC-SHA256 Credential=user/19700101/us-east-2/es/aws4_request, SignedHeaders=host;x-amz-date, Signature=b8783c8387a5249b084642126fe1f8e07e12a2847820fd5b6cd64b2047149da4
+X-Amz-Date: 19700101T000000Z
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test473 b/third-party/curl/tests/data/test473
new file mode 100644
index 0000000000..c7ed2dd185
--- /dev/null
+++ b/third-party/curl/tests/data/test473
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 301 funky chunky!%CR
+Server: fakeit/0.9 fakeitbad/1.0%CR
+Location: /redirected
+Transfer-Encoding: chunked%CR
+Trailer: chunky-trailer%CR
+Connection: mooo%CR
+ETag: W/"asdf"%CR
+%CR
+40%CR
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%CR
+30%CR
+bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%CR
+21;heresatest=moooo%CR
+cccccccccccccccccccccccccccccccc
+%CR
+0%CR
+chunky-trailer: header data%CR
+%CR
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+Check if --etag-save saved correct etag to a file on 301
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --etag-save %LOGDIR/etag%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/etag%TESTNUMBER">
+W/"asdf"
+</file>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test474 b/third-party/curl/tests/data/test474
new file mode 100644
index 0000000000..871c37a396
--- /dev/null
+++ b/third-party/curl/tests/data/test474
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+-w
+--write-out
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 301 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 0
+Connection: close
+Content-Type: text/html
+Location: https://%HOSTIP:%HTTPSPORT/%TESTNUMBER0002
+
+</data>
+<data2 crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 0
+Connection: close
+
+</data2>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+https
+</server>
+<name>
+-w urle.scheme after HTTP to HTTPS redirect
+</name>
+<command option="no-include">
+--insecure -L http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w "%{num_redirects} %{url_effective} %{urle.scheme}\n"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<stdout>
+1 https://%HOSTIP:%HTTPSPORT/%TESTNUMBER0002 https
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test475 b/third-party/curl/tests/data/test475
new file mode 100644
index 0000000000..a09a11e96c
--- /dev/null
+++ b/third-party/curl/tests/data/test475
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+FTP
+EPSV
+STOR
+TYPE A
+</keywords>
+</info>
+
+# Client-side
+<client>
+<server>
+ftp
+</server>
+<name>
+FTP PASV upload ASCII file
+</name>
+<file name="%LOGDIR/test%TESTNUMBER.txt" nonewline="yes">
+%if win32
+%repeat[1750 x a line of text used for verifying this !%0d%0a]%
+%else
+%repeat[1750 x a line of text used for verifying this !%0a]%
+%endif
+</file>
+<command>
+"ftp://%HOSTIP:%FTPPORT/%TESTNUMBER;type=a" -T %LOGDIR/test%TESTNUMBER.txt
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<upload crlf="yes" nonewline="yes">
+%repeat[1750 x a line of text used for verifying this !%0a]%
+</upload>
+<protocol crlf="yes">
+USER anonymous
+PASS ftp@example.com
+PWD
+EPSV
+TYPE A
+STOR %TESTNUMBER
+QUIT
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test476 b/third-party/curl/tests/data/test476
new file mode 100644
index 0000000000..231d3c6e40
--- /dev/null
+++ b/third-party/curl/tests/data/test476
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+FTP
+EPSV
+STOR
+TYPE A
+</keywords>
+</info>
+
+# Client-side
+<client>
+<server>
+ftp
+</server>
+<name>
+FTP PASV upload ASCII file already using CRLF
+</name>
+<file name="%LOGDIR/test%TESTNUMBER.txt" nonewline="yes">
+%repeat[1750 x a line of text used for verifying this !%0d%0a]%
+</file>
+<command>
+"ftp://%HOSTIP:%FTPPORT/%TESTNUMBER;type=a" -T %LOGDIR/test%TESTNUMBER.txt
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<upload crlf="yes" nonewline="yes">
+%repeat[1750 x a line of text used for verifying this !%0a]%
+</upload>
+<protocol crlf="yes">
+USER anonymous
+PASS ftp@example.com
+PWD
+EPSV
+TYPE A
+STOR %TESTNUMBER
+QUIT
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test477 b/third-party/curl/tests/data/test477
new file mode 100644
index 0000000000..982655b845
--- /dev/null
+++ b/third-party/curl/tests/data/test477
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+--max-filesize
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 301 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Location: %TESTNUMBER0002
+Accept-Ranges: bytes
+Content-Length: 26
+Funny-head: yesyes
+
+aaaaaaaaaaaaaaaaaaaa-foo-
+</data>
+
+<data2 nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Accept-Ranges: bytes
+Content-Length: 4
+Funny-head: yesyes
+
+hej
+</data2>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP GET with maximum filesize with a redirect sending data
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --max-filesize 5 -L
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER0002 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test478 b/third-party/curl/tests/data/test478
new file mode 100644
index 0000000000..eb10228a63
--- /dev/null
+++ b/third-party/curl/tests/data/test478
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+netrc
+HTTP
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+proxy
+</features>
+<name>
+.netrc with multiple accounts for same host
+</name>
+<command>
+--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER -x http://%HOSTIP:%HTTPPORT/ http://debbie@github.com/
+</command>
+<file name="%LOGDIR/netrc%TESTNUMBER" >
+
+machine github.com
+password weird
+password firstone
+login daniel
+
+machine github.com
+
+machine github.com
+login debbie
+
+machine github.com
+password weird
+password "second\r"
+login debbie
+
+</file>
+</client>
+
+<verify>
+<protocol crlf="headers">
+GET http://github.com/ HTTP/1.1
+Host: github.com
+Authorization: Basic %b64[debbie:second%0D]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test479 b/third-party/curl/tests/data/test479
new file mode 100644
index 0000000000..b107dbb293
--- /dev/null
+++ b/third-party/curl/tests/data/test479
@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+netrc
+HTTP
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 301 Follow this you fool
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Location: http://b.com/%TESTNUMBER0002
+
+-foo-
+</data>
+
+<data2 crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 7
+Connection: close
+
+target
+</data2>
+
+<datacheck crlf="headers">
+HTTP/1.1 301 Follow this you fool
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Location: http://b.com/%TESTNUMBER0002
+
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 7
+Connection: close
+
+target
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+proxy
+</features>
+<name>
+.netrc with redirect and default without password
+</name>
+<command>
+--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER -L -x http://%HOSTIP:%HTTPPORT/ http://a.com/
+</command>
+<file name="%LOGDIR/netrc%TESTNUMBER" >
+
+machine a.com
+  login alice
+  password alicespassword
+
+default
+  login bob
+
+</file>
+</client>
+
+<verify>
+<protocol crlf="headers">
+GET http://a.com/ HTTP/1.1
+Host: a.com
+Authorization: Basic %b64[alice:alicespassword]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://b.com/%TESTNUMBER0002 HTTP/1.1
+Host: b.com
+Authorization: Basic %b64[bob:]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test48 b/third-party/curl/tests/data/test48
index c14fd8cabe..6d7d036c69 100644
--- a/third-party/curl/tests/data/test48
+++ b/third-party/curl/tests/data/test48
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP HEAD
 -G
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <servercmd>
@@ -19,30 +19,28 @@ Date: Tue, 09 Nov 2010 14:49:00 GMT
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with -d and -G and -I
- </name>
- <command>
--d "foo=moo&moo=poo" http://%HOSTIP:%HTTPPORT/%TESTNUMBER -G -I http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</name>
+<command>
+-d "foo=moo%AMPmoo=poo" http://%HOSTIP:%HTTPPORT/%TESTNUMBER -G -I http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-HEAD /%TESTNUMBER?foo=moo&moo=poo HTTP/1.1
+<protocol crlf="headers">
+HEAD /%TESTNUMBER?foo=moo%AMPmoo=poo HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
-HEAD /%TESTNUMBER?foo=moo&moo=poo HTTP/1.1
+HEAD /%TESTNUMBER?foo=moo%AMPmoo=poo HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test480 b/third-party/curl/tests/data/test480
new file mode 100644
index 0000000000..8381f5b8eb
--- /dev/null
+++ b/third-party/curl/tests/data/test480
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+netrc
+POP3
+</keywords>
+</info>
+# Server-side
+<reply>
+
+</reply>
+
+# Client-side
+<client>
+<server>
+pop3
+</server>
+<name>
+Reject .netrc with credentials using CRLF for POP3
+</name>
+<command>
+--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER pop3://%HOSTIP:%POP3PORT/%TESTNUMBER
+</command>
+<file name="%LOGDIR/netrc%TESTNUMBER" >
+machine %HOSTIP
+  login alice
+  password "password\r\ncommand"
+</file>
+</client>
+
+<verify>
+<errorcode>
+26
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test481 b/third-party/curl/tests/data/test481
new file mode 100644
index 0000000000..03aa81d0fb
--- /dev/null
+++ b/third-party/curl/tests/data/test481
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+--no-clobber
+--continue-at
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+--no-clobber with --continue-at
+</name>
+<file name="%LOGDIR/%TESTNUMBER">
+initial content
+</file>
+<command option="no-output,no-include">
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --no-clobber -C 1 -o "%LOGDIR/%TESTNUMBER"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+2
+</errorcode>
+<stderr mode="text">
+curl: --continue-at is mutually exclusive with --no-clobber
+curl: option -C: is badly used here
+%if manual
+curl: try 'curl --help' or 'curl --manual' for more information
+%else
+curl: try 'curl --help' for more information
+%endif
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test482 b/third-party/curl/tests/data/test482
new file mode 100644
index 0000000000..b14b7caf66
--- /dev/null
+++ b/third-party/curl/tests/data/test482
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--remove-on-error
+--continue-at
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+--remove-on-error with --continue-at
+</name>
+<command option="no-output,no-include">
+http://non-existing-host.haxx.se. --remove-on-error -C 1 -o "%LOGDIR/%TESTNUMBER"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+2
+</errorcode>
+<stderr mode="text">
+curl: --continue-at is mutually exclusive with --remove-on-error
+curl: option -C: is badly used here
+%if manual
+curl: try 'curl --help' or 'curl --manual' for more information
+%else
+curl: try 'curl --help' for more information
+%endif
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test483 b/third-party/curl/tests/data/test483
new file mode 100644
index 0000000000..860c2caf10
--- /dev/null
+++ b/third-party/curl/tests/data/test483
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+cookies
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Set-Cookie: name=value; expires=Fri Feb 13 11:56:27 GMT 2132
+Set-Cookie: name2=value; expires=Fri Feb 13 11:56:27 ; 2132
+Set-Cookie: name3=value; expires=Fri Feb 13 11:56:27 ...................................................GMT 2132
+Set-Cookie: name4=value; expires=Fri Feb 13 11:56:27 ....................................................GMT 2132
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+cookies
+large-time
+</features>
+<name>
+HTTP cookies with long expire dates
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -c %LOGDIR/c%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/c%TESTNUMBER" mode="text">
+# Netscape HTTP Cookie File
+# https://curl.se/docs/http-cookies.html
+# This file was generated by libcurl! Edit at your own risk.
+
+127.0.0.1	FALSE	/	FALSE	0	name4	value
+127.0.0.1	FALSE	/	FALSE	%days[400]	name3	value
+127.0.0.1	FALSE	/	FALSE	0	name2	value
+127.0.0.1	FALSE	/	FALSE	%days[400]	name	value
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test484 b/third-party/curl/tests/data/test484
new file mode 100644
index 0000000000..b0d090a22d
--- /dev/null
+++ b/third-party/curl/tests/data/test484
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+etag
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<name>
+Use --etag-compare and -save with more than one URL
+</name>
+<command>
+http://example.com/%TESTNUMBER --etag-compare %LOGDIR/etag%TESTNUMBER --etag-save %LOGDIR/etag%TESTNUMBER --url http://example.net/fooo
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+2
+</errorcode>
+<stderr mode="text">
+curl: The etag options only work on a single URL
+curl: option --url: is badly used here
+%if manual
+curl: try 'curl --help' or 'curl --manual' for more information
+%else
+curl: try 'curl --help' for more information
+%endif
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test485 b/third-party/curl/tests/data/test485
new file mode 100644
index 0000000000..f530d8389e
--- /dev/null
+++ b/third-party/curl/tests/data/test485
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+etag
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<name>
+Use --etag-compare and -save with more than one URL, URLs specified first
+</name>
+<command>
+http://example.com/%TESTNUMBER http://example.net/fooo --etag-save %LOGDIR/etag%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+2
+</errorcode>
+<stderr mode="text">
+curl: The etag options only work on a single URL
+curl: option --etag-save: is badly used here
+%if manual
+curl: try 'curl --help' or 'curl --manual' for more information
+%else
+curl: try 'curl --help' for more information
+%endif
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test486 b/third-party/curl/tests/data/test486
new file mode 100644
index 0000000000..c82babfe6c
--- /dev/null
+++ b/third-party/curl/tests/data/test486
@@ -0,0 +1,104 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+netrc
+HTTP
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 301 Follow this you fool
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Location: http://b.com/%TESTNUMBER0002
+
+-foo-
+</data>
+
+<data2 crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 7
+Connection: close
+
+target
+</data2>
+
+<datacheck crlf="headers">
+HTTP/1.1 301 Follow this you fool
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Location: http://b.com/%TESTNUMBER0002
+
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 7
+Connection: close
+
+target
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+proxy
+</features>
+<name>
+.netrc with redirect and "default" with no password or login
+</name>
+<command>
+--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER -L -x http://%HOSTIP:%HTTPPORT/ http://a.com/
+</command>
+<file name="%LOGDIR/netrc%TESTNUMBER" >
+
+machine a.com
+  login alice
+  password alicespassword
+
+default
+
+</file>
+</client>
+
+<verify>
+<protocol crlf="headers">
+GET http://a.com/ HTTP/1.1
+Host: a.com
+Authorization: Basic %b64[alice:alicespassword]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://b.com/%TESTNUMBER0002 HTTP/1.1
+Host: b.com
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test487 b/third-party/curl/tests/data/test487
new file mode 100644
index 0000000000..fbef4b63f0
--- /dev/null
+++ b/third-party/curl/tests/data/test487
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+variables
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+Variable using 64dec with bad base64
+</name>
+<command>
+--variable what=not-base64-data --expand-url "http://%HOSTIP:%HTTPPORT/{{what:64dec}}/%TESTNUMBER" -g
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /[64dec-fail]/%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test488 b/third-party/curl/tests/data/test488
new file mode 100644
index 0000000000..b1010c15f2
--- /dev/null
+++ b/third-party/curl/tests/data/test488
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+--url
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+Download two URLs provided on stdin
+</name>
+<command>
+--output-dir %LOGDIR --url @-
+</command>
+<stdin>
+http://%HOSTIP:%HTTPPORT/a
+http://%HOSTIP:%HTTPPORT/b
+</stdin>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /a HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /b HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test489 b/third-party/curl/tests/data/test489
new file mode 100644
index 0000000000..3551742a26
--- /dev/null
+++ b/third-party/curl/tests/data/test489
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+--url
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+Download two URLs provided in a file
+</name>
+<command>
+--output-dir %LOGDIR --url @%LOGDIR/urls
+</command>
+<file name="%LOGDIR/urls">
+http://%HOSTIP:%HTTPPORT/a
+http://%HOSTIP:%HTTPPORT/b
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /a HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /b HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test49 b/third-party/curl/tests/data/test49
index 5e0b4237b3..d8acd5bcb1 100644
--- a/third-party/curl/tests/data/test49
+++ b/third-party/curl/tests/data/test49
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 followlocation
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -39,24 +39,22 @@ body
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP follow redirect with ../
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/are/all/twits/%TESTNUMBER -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/are/all/twits/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test490 b/third-party/curl/tests/data/test490
index 6ce52d3433..839f8ca7b2 100644
--- a/third-party/curl/tests/data/test490
+++ b/third-party/curl/tests/data/test490
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP PUT
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -25,16 +25,15 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 Two globbed HTTP PUTs
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -T '{%LOGDIR/in%TESTNUMBER,%LOGDIR/in%TESTNUMBER}'
 </command>
 <file name="%LOGDIR/in%TESTNUMBER">
@@ -42,10 +41,9 @@ surprise!
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test491 b/third-party/curl/tests/data/test491
index cd4a097f0e..e93a3a9bdf 100644
--- a/third-party/curl/tests/data/test491
+++ b/third-party/curl/tests/data/test491
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP PUT
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -25,16 +25,15 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 Two globbed HTTP PUTs, the second upload file is missing
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -T '{%LOGDIR/in%TESTNUMBER,%LOGDIR/bad%TESTNUMBER}'
 </command>
 <file name="%LOGDIR/in%TESTNUMBER">
@@ -42,10 +41,9 @@ surprise!
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test492 b/third-party/curl/tests/data/test492
index 11eedb2cb0..c2df23d588 100644
--- a/third-party/curl/tests/data/test492
+++ b/third-party/curl/tests/data/test492
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP PUT
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -25,16 +25,15 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 Two globbed HTTP PUTs to two globbed URLs
- </name>
- <command>
+</name>
+<command>
 'http://%HOSTIP:%HTTPPORT/{one,two}/' -T '{%LOGDIR/first%TESTNUMBER,%LOGDIR/second%TESTNUMBER}' -H "Testno: %TESTNUMBER"
 </command>
 <file name="%LOGDIR/first%TESTNUMBER">
@@ -45,10 +44,9 @@ second %TESTNUMBER contents
 </file1>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /one/first%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test493 b/third-party/curl/tests/data/test493
index 23978a522d..7c882c5600 100644
--- a/third-party/curl/tests/data/test493
+++ b/third-party/curl/tests/data/test493
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ url_effective
 <reply>
 
 # we use this as response to a CONNECT
-<connect nocheck="yes">
+<connect crlf="headers" nocheck="yes">
 HTTP/1.1 403 not OK at all
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -43,18 +44,21 @@ HSTS and %{url_effective} after upgrade
 <command>
 -x http://%HOSTIP:%HTTPPORT http://this.hsts.example/%TESTNUMBER --hsts %LOGDIR/input%TESTNUMBER -w '%{url_effective}\n'
 </command>
+<disable>
+test-duphandle
+</disable>
 </client>
 
 <verify>
 # we let it CONNECT to the server to confirm HSTS but deny from there
-<protocol>
+<protocol crlf="headers">
 CONNECT this.hsts.example:443 HTTP/1.1
 Host: this.hsts.example:443
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
 </protocol>
-<stdout>
+<stdout crlf="headers">
 HTTP/1.1 403 not OK at all
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -66,7 +70,7 @@ https://this.hsts.example/%TESTNUMBER
 </stdout>
 # Proxy CONNECT aborted
 <errorcode>
-56
+7
 </errorcode>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test494 b/third-party/curl/tests/data/test494
index bac93fb723..e893b31742 100644
--- a/third-party/curl/tests/data/test494
+++ b/third-party/curl/tests/data/test494
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ netrc
 macdef
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -15,16 +15,15 @@ blipp
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
- <name>
+<name>
 skip 'macdef' when parsing netrc
- </name>
- <command>
+</name>
+<command>
 --netrc --netrc-file %LOGDIR/netrc%TESTNUMBER ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 <file name="%LOGDIR/netrc%TESTNUMBER" >
@@ -43,10 +42,9 @@ machine %HOSTIP login user1 password passwd1
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER user1
 PASS passwd1
 PWD
diff --git a/third-party/curl/tests/data/test495 b/third-party/curl/tests/data/test495
index 57692db554..93c0157922 100644
--- a/third-party/curl/tests/data/test495
+++ b/third-party/curl/tests/data/test495
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ netrc
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -25,7 +25,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -41,13 +40,12 @@ http://foo%40bar:secret@%HOSTIP:%HTTPPORT/%TESTNUMBER --netrc-optional
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic Zm9vQGJhcjpzZWNyZXQ=
+Authorization: Basic %b64[foo@bar:secret]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test496 b/third-party/curl/tests/data/test496
index 19050f3772..7c0014c382 100644
--- a/third-party/curl/tests/data/test496
+++ b/third-party/curl/tests/data/test496
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,26 +8,20 @@ parallel
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <name>
 parallel upload missing file
 </name>
- <command>
+<command>
 0 -Z -Tz
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test497 b/third-party/curl/tests/data/test497
index 4935d3e50e..e89d5ec24d 100644
--- a/third-party/curl/tests/data/test497
+++ b/third-party/curl/tests/data/test497
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -19,12 +19,11 @@ Accept-Ranges: bytes
 Content-Length: 6
 Connection: close
 Content-Type: text/html
-%repeat[1750 x Repeat-this-Header-a-large-number-of-times: Dorothy lived in the midst of the great Kansas prairies, with Uncle Henry, who was a farmer, and Aunt Em, who was the farmer’s wife.%0a]%
+%repeat[1750 x Repeat-this-Header-a-large-number-of-times: Dorothy lived in the midst of the great Kansas prairies, with Uncle Henry, who was a farmer, and Aunt Em, who was the farmer's wife.%0a]%
 -foo-
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -38,10 +37,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol crlf="yes">
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -49,14 +47,11 @@ Accept: */*
 
 </protocol>
 # curl: (56) Too large response headers: 307215 > 307200
-# hyper returns a generic error that libcurl converts to an even more
-# generic error
 <errorcode>
-%if hyper
-1
-%else
 56
-%endif
 </errorcode>
+<limits>
+Allocations: 1900
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test498 b/third-party/curl/tests/data/test498
new file mode 100644
index 0000000000..7c4c44d4d0
--- /dev/null
+++ b/third-party/curl/tests/data/test498
@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 301 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Location: /
+Connection: close
+Content-Type: text/html
+%repeat[1700 x Repeat-this-Header-a-large-number-of-times: Dorothy lived in the midst of the great Kansas prairies, with Uncle Henry, who was a farmer, and Aunt Em, who was the farmer's wife. Their house was small, for the lumber to build it had to be carried by wagon many miles. There were four walls, a floor and a roof, which made one room; and this room contained a rusty looking cookstove, a cupboard for the dishes, a table, three or four chairs, and the beds. Uncle Henry and Aunt Em had a big bed in one corner, and Dorothy a little bed in another corner. There was no garret at all, and no cellar--except a small hole dug in the ground, called a cyclone cellar, where the family could go in case one of those great whirlwinds arose, mighty enough to crush any building in its path. It was reached by a trap door in the middle of the floor, from which a ladder led down into the small, dark hole.%0a]%
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+Reject too large HTTP response headers on endless redirects
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --max-redirs 400 --location
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+# curl: (56) Too large response headers: 6144086 > 6144000
+<errorcode>
+56
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test499 b/third-party/curl/tests/data/test499
new file mode 100644
index 0000000000..399ca1d3b5
--- /dev/null
+++ b/third-party/curl/tests/data/test499
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+<datacheck crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP HEAD to server still sending a body
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -I
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+HEAD /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test5 b/third-party/curl/tests/data/test5
index 2af3f5dc0a..95cc1ddcb0 100644
--- a/third-party/curl/tests/data/test5
+++ b/third-party/curl/tests/data/test5
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 HTTP proxy
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -19,16 +19,15 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP over proxy
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER#5 -x %HOSTIP:%HTTPPORT
 </command>
 <features>
@@ -36,10 +35,9 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test50 b/third-party/curl/tests/data/test50
index b3464d5946..90bd529899 100644
--- a/third-party/curl/tests/data/test50
+++ b/third-party/curl/tests/data/test50
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 followlocation
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -39,24 +39,22 @@ body
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP follow redirect with ../../
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/are/all/twits/%TESTNUMBER -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/are/all/twits/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test500 b/third-party/curl/tests/data/test500
index 33ea52eb32..077b119ff4 100644
--- a/third-party/curl/tests/data/test500
+++ b/third-party/curl/tests/data/test500
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,9 @@ HTTP
 HTTP GET
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -34,25 +34,28 @@ http
 lib500
 </tool>
 
- <name>
+<name>
 simple libcurl HTTP GET tool
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER %LOGDIR/ip%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <file name="%LOGDIR/ip%TESTNUMBER">
 IP %HOSTIP
 </file>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
 
 </protocol>
+<limits>
+Allocations: 90
+Maximum allocated: 33400
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test501 b/third-party/curl/tests/data/test501
index b86642f6a3..52e2023df2 100644
--- a/third-party/curl/tests/data/test501
+++ b/third-party/curl/tests/data/test501
@@ -1,19 +1,16 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 missing URL
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 </reply>
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 http
 </features>
@@ -22,15 +19,11 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 simple libcurl attempt operation without URL set
- </name>
- <command>
-http://%HOSTIP:%NOLISTENPORT/%TESTNUMBER
-</command>
+</name>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test502 b/third-party/curl/tests/data/test502
index 4a6d60f132..5e0c576608 100644
--- a/third-party/curl/tests/data/test502
+++ b/third-party/curl/tests/data/test502
@@ -1,10 +1,10 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FILE
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -26,11 +26,11 @@ file
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 simple multi file:// get
- </name>
- <command>
-file://%PWD/%LOGDIR/test%TESTNUMBER.txt
+</name>
+<command>
+file://%FILE_PWD/%LOGDIR/test%TESTNUMBER.txt
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 foo
diff --git a/third-party/curl/tests/data/test503 b/third-party/curl/tests/data/test503
index e2aa918bcc..b09ac69ddd 100644
--- a/third-party/curl/tests/data/test503
+++ b/third-party/curl/tests/data/test503
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -16,7 +17,7 @@ multi
 <servercmd>
 connection-monitor
 </servercmd>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 
 </connect>
@@ -29,8 +30,8 @@ ETag: "21025-dc7-39462498"
 
 </data>
 <datacheck>
-HTTP/1.1 200 Mighty fine indeed
-
+HTTP/1.1 200 Mighty fine indeed%CR
+%CR
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -53,10 +54,10 @@ lib%TESTNUMBER
 <features>
 proxy
 </features>
- <name>
+<name>
 simple multi http:// through proxytunnel with authentication info
- </name>
- <command>
+</name>
+<command>
 http://machine.%TESTNUMBER:%HTTPPORT/%TESTNUMBER %HOSTIP:%PROXYPORT
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
@@ -70,18 +71,18 @@ moo
 
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 CONNECT machine.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: machine.%TESTNUMBER:%HTTPPORT
-Proxy-Authorization: Basic dGVzdDppbmc=
+Proxy-Authorization: Basic %b64[test%2520:ing%2541]b64%
 Proxy-Connection: Keep-Alive
 
 [DISCONNECT]
 </proxy>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: machine.%TESTNUMBER:%HTTPPORT
-Authorization: Basic dGVzdDppbmc=
+Authorization: Basic %b64[test:ing]b64%
 Accept: */*
 
 [DISCONNECT]
diff --git a/third-party/curl/tests/data/test504 b/third-party/curl/tests/data/test504
index 05061e2a89..c4670ee1b1 100644
--- a/third-party/curl/tests/data/test504
+++ b/third-party/curl/tests/data/test504
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ HTTP
 HTTP GET
 HTTP proxy
 multi
-FAILURE
 connect to non-listen
 </keywords>
 </info>
@@ -16,9 +16,6 @@ connect to non-listen
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 http
 proxy
@@ -28,19 +25,19 @@ proxy
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 simple multi through local proxy without listener
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%NOLISTENPORT/%TESTNUMBER %HOSTIP:%NOLISTENPORT
 </command>
 </client>
 
 # Verify data after the test has been "shot"
-# TEST_ERR_SUCCESS is errorcode 120
+# TEST_ERR_SUCCESS is errorcode 41
 <verify>
 <errorcode>
-120
+41
 </errorcode>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test505 b/third-party/curl/tests/data/test505
index 0877bd3cce..be6be1b7f1 100644
--- a/third-party/curl/tests/data/test505
+++ b/third-party/curl/tests/data/test505
@@ -1,7 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
+STOR
 </keywords>
 </info>
 
@@ -19,10 +21,10 @@ ftp
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 FTP upload with rename after transfer
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER %LOGDIR/upload%TESTNUMBER
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
@@ -51,7 +53,7 @@ upload
 
 works?
 </upload>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test506 b/third-party/curl/tests/data/test506
index 30d4c62154..ed8e4e315e 100644
--- a/third-party/curl/tests/data/test506
+++ b/third-party/curl/tests/data/test506
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -55,7 +56,7 @@ run 3: overwrite cookie 1 and 4, set cookie 6 with and without tailmatch
 <server>
 http
 </server>
-# don't run this with the threaded-resolver or c-ares since the events might
+# do not run this with the threaded-resolver or c-ares since the events might
 # trigger in a different order!
 <features>
 !threaded-resolver
@@ -92,145 +93,149 @@ CURLOPT_SHARE
 lock:   share  [Pigs in space]: 0
 unlock: share  [Pigs in space]: 1
 CURLOPT_COOKIELIST injected_and_clobbered
+lock:   cookie [Pigs in space]: 0
+unlock: cookie [Pigs in space]: 1
+CURLOPT_COOKIELIST ALL
 lock:   cookie [Pigs in space]: 2
 unlock: cookie [Pigs in space]: 3
-CURLOPT_COOKIELIST ALL
+CURLOPT_COOKIELIST session
 lock:   cookie [Pigs in space]: 4
 unlock: cookie [Pigs in space]: 5
-CURLOPT_COOKIELIST session
+CURLOPT_COOKIELIST injected
 lock:   cookie [Pigs in space]: 6
 unlock: cookie [Pigs in space]: 7
-CURLOPT_COOKIELIST injected
+CURLOPT_COOKIELIST SESS
 lock:   cookie [Pigs in space]: 8
 unlock: cookie [Pigs in space]: 9
-CURLOPT_COOKIELIST SESS
+CLEANUP
 lock:   cookie [Pigs in space]: 10
 unlock: cookie [Pigs in space]: 11
-CLEANUP
-lock:   cookie [Pigs in space]: 12
-unlock: cookie [Pigs in space]: 13
-lock:   share  [Pigs in space]: 14
-unlock: share  [Pigs in space]: 15
+lock:   share  [Pigs in space]: 2
+unlock: share  [Pigs in space]: 3
 *** run 1
 CURLOPT_SHARE
-lock:   share  [Pigs in space]: 16
-unlock: share  [Pigs in space]: 17
+lock:   share  [Pigs in space]: 4
+unlock: share  [Pigs in space]: 5
 PERFORM
+lock:   cookie [Pigs in space]: 12
+unlock: cookie [Pigs in space]: 13
+lock:   cookie [Pigs in space]: 14
+unlock: cookie [Pigs in space]: 15
+lock:   dns    [Pigs in space]: 0
+unlock: dns    [Pigs in space]: 1
+lock:   dns    [Pigs in space]: 2
+unlock: dns    [Pigs in space]: 3
+lock:   dns    [Pigs in space]: 4
+unlock: dns    [Pigs in space]: 5
+lock:   cookie [Pigs in space]: 16
+unlock: cookie [Pigs in space]: 17
 lock:   cookie [Pigs in space]: 18
 unlock: cookie [Pigs in space]: 19
-lock:   dns    [Pigs in space]: 20
-unlock: dns    [Pigs in space]: 21
-lock:   dns    [Pigs in space]: 22
-unlock: dns    [Pigs in space]: 23
+lock:   cookie [Pigs in space]: 20
+unlock: cookie [Pigs in space]: 21
+lock:   cookie [Pigs in space]: 22
+unlock: cookie [Pigs in space]: 23
+run 1: set cookie 1, 2 and 3
+lock:   dns    [Pigs in space]: 6
+unlock: dns    [Pigs in space]: 7
+CLEANUP
 lock:   cookie [Pigs in space]: 24
 unlock: cookie [Pigs in space]: 25
+lock:   share  [Pigs in space]: 6
+unlock: share  [Pigs in space]: 7
+*** run 2
+CURLOPT_SHARE
+lock:   share  [Pigs in space]: 8
+unlock: share  [Pigs in space]: 9
+PERFORM
 lock:   cookie [Pigs in space]: 26
 unlock: cookie [Pigs in space]: 27
 lock:   cookie [Pigs in space]: 28
 unlock: cookie [Pigs in space]: 29
+lock:   dns    [Pigs in space]: 8
+unlock: dns    [Pigs in space]: 9
+lock:   dns    [Pigs in space]: 10
+unlock: dns    [Pigs in space]: 11
 lock:   cookie [Pigs in space]: 30
 unlock: cookie [Pigs in space]: 31
-run 1: set cookie 1, 2 and 3
-lock:   dns    [Pigs in space]: 32
-unlock: dns    [Pigs in space]: 33
-lock:   dns    [Pigs in space]: 34
-unlock: dns    [Pigs in space]: 35
+lock:   cookie [Pigs in space]: 32
+unlock: cookie [Pigs in space]: 33
+lock:   cookie [Pigs in space]: 34
+unlock: cookie [Pigs in space]: 35
+run 2: set cookie 4 and 5
+lock:   dns    [Pigs in space]: 12
+unlock: dns    [Pigs in space]: 13
 CLEANUP
 lock:   cookie [Pigs in space]: 36
 unlock: cookie [Pigs in space]: 37
-lock:   share  [Pigs in space]: 38
-unlock: share  [Pigs in space]: 39
-*** run 2
+lock:   share  [Pigs in space]: 10
+unlock: share  [Pigs in space]: 11
+*** run 3
 CURLOPT_SHARE
-lock:   share  [Pigs in space]: 40
-unlock: share  [Pigs in space]: 41
+lock:   share  [Pigs in space]: 12
+unlock: share  [Pigs in space]: 13
+CURLOPT_COOKIEJAR
+CURLOPT_COOKIELIST FLUSH
+lock:   cookie [Pigs in space]: 38
+unlock: cookie [Pigs in space]: 39
 PERFORM
+lock:   cookie [Pigs in space]: 40
+unlock: cookie [Pigs in space]: 41
+lock:   dns    [Pigs in space]: 14
+unlock: dns    [Pigs in space]: 15
+lock:   dns    [Pigs in space]: 16
+unlock: dns    [Pigs in space]: 17
 lock:   cookie [Pigs in space]: 42
 unlock: cookie [Pigs in space]: 43
-lock:   dns    [Pigs in space]: 44
-unlock: dns    [Pigs in space]: 45
+lock:   cookie [Pigs in space]: 44
+unlock: cookie [Pigs in space]: 45
 lock:   cookie [Pigs in space]: 46
 unlock: cookie [Pigs in space]: 47
 lock:   cookie [Pigs in space]: 48
 unlock: cookie [Pigs in space]: 49
 lock:   cookie [Pigs in space]: 50
 unlock: cookie [Pigs in space]: 51
-run 2: set cookie 4 and 5
-lock:   dns    [Pigs in space]: 52
-unlock: dns    [Pigs in space]: 53
-lock:   dns    [Pigs in space]: 54
-unlock: dns    [Pigs in space]: 55
-CLEANUP
-lock:   cookie [Pigs in space]: 56
-unlock: cookie [Pigs in space]: 57
-lock:   share  [Pigs in space]: 58
-unlock: share  [Pigs in space]: 59
-*** run 3
-CURLOPT_SHARE
-lock:   share  [Pigs in space]: 60
-unlock: share  [Pigs in space]: 61
-CURLOPT_COOKIEJAR
-CURLOPT_COOKIELIST FLUSH
-lock:   cookie [Pigs in space]: 62
-unlock: cookie [Pigs in space]: 63
-PERFORM
-lock:   dns    [Pigs in space]: 64
-unlock: dns    [Pigs in space]: 65
-lock:   cookie [Pigs in space]: 66
-unlock: cookie [Pigs in space]: 67
-lock:   cookie [Pigs in space]: 68
-unlock: cookie [Pigs in space]: 69
-lock:   cookie [Pigs in space]: 70
-unlock: cookie [Pigs in space]: 71
-lock:   cookie [Pigs in space]: 72
-unlock: cookie [Pigs in space]: 73
-lock:   cookie [Pigs in space]: 74
-unlock: cookie [Pigs in space]: 75
 run 3: overwrite cookie 1 and 4, set cookie 6 with and without tailmatch
-lock:   dns    [Pigs in space]: 76
-unlock: dns    [Pigs in space]: 77
-lock:   dns    [Pigs in space]: 78
-unlock: dns    [Pigs in space]: 79
+lock:   dns    [Pigs in space]: 18
+unlock: dns    [Pigs in space]: 19
 CLEANUP
-lock:   cookie [Pigs in space]: 80
-unlock: cookie [Pigs in space]: 81
-lock:   share  [Pigs in space]: 82
-unlock: share  [Pigs in space]: 83
+lock:   cookie [Pigs in space]: 52
+unlock: cookie [Pigs in space]: 53
+lock:   share  [Pigs in space]: 14
+unlock: share  [Pigs in space]: 15
 CURLOPT_SHARE
-lock:   share  [Pigs in space]: 84
-unlock: share  [Pigs in space]: 85
+lock:   share  [Pigs in space]: 16
+unlock: share  [Pigs in space]: 17
 CURLOPT_COOKIELIST ALL
-lock:   cookie [Pigs in space]: 86
-unlock: cookie [Pigs in space]: 87
+lock:   cookie [Pigs in space]: 54
+unlock: cookie [Pigs in space]: 55
 CURLOPT_COOKIEJAR
 CURLOPT_COOKIELIST RELOAD
-lock:   cookie [Pigs in space]: 88
-unlock: cookie [Pigs in space]: 89
-lock:   cookie [Pigs in space]: 90
-unlock: cookie [Pigs in space]: 91
+lock:   cookie [Pigs in space]: 56
+unlock: cookie [Pigs in space]: 57
+lock:   cookie [Pigs in space]: 58
+unlock: cookie [Pigs in space]: 59
 loaded cookies:
 -----------------
-  www.host.foo.com	FALSE	/	FALSE	1993463787	test6	six_more
-  .www.host.foo.com	TRUE	/	FALSE	1993463787	test6	six
-  .host.foo.com	TRUE	/	FALSE	1896263787	test5	five
-  .host.foo.com	TRUE	/	FALSE	2061978987	test4	overwritten4
-  .foo.com	TRUE	/	FALSE	1896263787	test3	three
-  .host.foo.com	TRUE	/	FALSE	1896263787	test2	two
-  .foo.com	TRUE	/	FALSE	1993463787	test1	overwritten1
-  .host.foo.com	TRUE	/	FALSE	1896263787	injected	yes
+  www.host.foo.com	FALSE	/	FALSE	%days[400]	test6	six_more
+  .www.host.foo.com	TRUE	/	FALSE	%days[400]	test6	six
+  .host.foo.com	TRUE	/	FALSE	%days[400]	test5	five
+  .host.foo.com	TRUE	/	FALSE	%days[400]	test4	overwritten4
+  .foo.com	TRUE	/	FALSE	%days[400]	test3	three
+  .host.foo.com	TRUE	/	FALSE	%days[400]	test2	two
+  .foo.com	TRUE	/	FALSE	%days[400]	test1	overwritten1
+  .host.foo.com	TRUE	/	FALSE	%days[400]	injected	yes
 -----------------
 try SHARE_CLEANUP...
-lock:   share  [Pigs in space]: 92
-unlock: share  [Pigs in space]: 93
 SHARE_CLEANUP failed, correct
 CLEANUP
-lock:   cookie [Pigs in space]: 94
-unlock: cookie [Pigs in space]: 95
-lock:   share  [Pigs in space]: 96
-unlock: share  [Pigs in space]: 97
+lock:   cookie [Pigs in space]: 60
+unlock: cookie [Pigs in space]: 61
+lock:   share  [Pigs in space]: 18
+unlock: share  [Pigs in space]: 19
 SHARE_CLEANUP
-lock:   share  [Pigs in space]: 98
-unlock: share  [Pigs in space]: 99
+lock:   share  [Pigs in space]: 20
+unlock: share  [Pigs in space]: 21
 GLOBAL_CLEANUP
 </stdout>
 <file name="%LOGDIR/jar%TESTNUMBER" mode="text">
@@ -238,14 +243,14 @@ GLOBAL_CLEANUP
 # https://curl.se/docs/http-cookies.html
 # This file was generated by libcurl! Edit at your own risk.
 
-www.host.foo.com	FALSE	/	FALSE	1993463787	test6	six_more
-.www.host.foo.com	TRUE	/	FALSE	1993463787	test6	six
-.host.foo.com	TRUE	/	FALSE	1896263787	test5	five
-.host.foo.com	TRUE	/	FALSE	2061978987	test4	overwritten4
-.foo.com	TRUE	/	FALSE	1896263787	test3	three
-.host.foo.com	TRUE	/	FALSE	1896263787	test2	two
-.foo.com	TRUE	/	FALSE	1993463787	test1	overwritten1
-.host.foo.com	TRUE	/	FALSE	1896263787	injected	yes
+www.host.foo.com	FALSE	/	FALSE	%days[400]	test6	six_more
+.www.host.foo.com	TRUE	/	FALSE	%days[400]	test6	six
+.host.foo.com	TRUE	/	FALSE	%days[400]	test5	five
+.host.foo.com	TRUE	/	FALSE	%days[400]	test4	overwritten4
+.foo.com	TRUE	/	FALSE	%days[400]	test3	three
+.host.foo.com	TRUE	/	FALSE	%days[400]	test2	two
+.foo.com	TRUE	/	FALSE	%days[400]	test1	overwritten1
+.host.foo.com	TRUE	/	FALSE	%days[400]	injected	yes
 </file>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test507 b/third-party/curl/tests/data/test507
index 49d7517608..5915ef7042 100644
--- a/third-party/curl/tests/data/test507
+++ b/third-party/curl/tests/data/test507
@@ -1,9 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 multi
-FAILURE
 non-existing host
 </keywords>
 </info>
@@ -18,7 +18,7 @@ non-existing host
 http
 </server>
 <name>
-multi interface get with non-existing host name
+multi interface get with non-existing hostname
 </name>
 <tool>
 lib%TESTNUMBER
diff --git a/third-party/curl/tests/data/test508 b/third-party/curl/tests/data/test508
index cce83f8ec0..11bf74a9b3 100644
--- a/third-party/curl/tests/data/test508
+++ b/third-party/curl/tests/data/test508
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ POST
 POST callback
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -30,22 +30,17 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 send HTTP POST using read callback
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<strippart>
-# remove CR that CURLOPT_TRANSFERTEXT added, when CharConv enabled:
-s/^(this is what we post to the silly web server)\r\n/$1\n/ if($has_charconv)
-</strippart>
-<protocol>
+<protocol crlf="headers">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test509 b/third-party/curl/tests/data/test509
index 4cdbe80dba..a73fbaf5ca 100644
--- a/third-party/curl/tests/data/test509
+++ b/third-party/curl/tests/data/test509
@@ -1,19 +1,16 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 memory callbacks
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 </reply>
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 http
 </features>
@@ -25,12 +22,8 @@ lib%TESTNUMBER
 <name>
 initialization with memory callbacks and actual usage
 </name>
-<command>
-nothing
-</command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <stdout>
diff --git a/third-party/curl/tests/data/test51 b/third-party/curl/tests/data/test51
index 788a2dae32..3592e01eb1 100644
--- a/third-party/curl/tests/data/test51
+++ b/third-party/curl/tests/data/test51
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 followlocation
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -39,24 +39,22 @@ body
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP follow redirect with excessive ../
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/are/all/twits/%TESTNUMBER -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/are/all/twits/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test510 b/third-party/curl/tests/data/test510
index 559f207b85..a865c57705 100644
--- a/third-party/curl/tests/data/test510
+++ b/third-party/curl/tests/data/test510
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ chunked Transfer-Encoding
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -31,18 +31,17 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 send HTTP POST using read callback, using chunked transfer-encoding
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
@@ -56,11 +55,7 @@ one
 two
 5
 three
-%if hyper
-1D
-%else
 1d
-%endif
 and a final longer crap: four
 0
 
diff --git a/third-party/curl/tests/data/test511 b/third-party/curl/tests/data/test511
index 7a1d8dad5c..ea7deec2ad 100644
--- a/third-party/curl/tests/data/test511
+++ b/third-party/curl/tests/data/test511
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ FTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -24,22 +24,21 @@ ftp
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 FTP with FILETIME and NOBODY but missing file
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # CURLE_REMOTE_FILE_NOT_FOUND
 <errorcode>
 78
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test512 b/third-party/curl/tests/data/test512
index 9e65b843c0..daa3362731 100644
--- a/third-party/curl/tests/data/test512
+++ b/third-party/curl/tests/data/test512
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: yes
@@ -29,18 +29,17 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 simple curl_easy_duplicate() test
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test513 b/third-party/curl/tests/data/test513
index 777e3b7e06..551047c940 100644
--- a/third-party/curl/tests/data/test513
+++ b/third-party/curl/tests/data/test513
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP POST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
@@ -21,28 +21,17 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 send HTTP POST using read callback that returns CURL_READFUNC_ABORT
- </name>
+</name>
 # the 1s post-command delay helps to prevent a spurious failure on s390
- <command delay="1">
+<command delay="1">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-%if !hyper
-POST /%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-Accept: */*
-Content-Length: 1
-Content-Type: application/x-www-form-urlencoded
-
-%endif
-</protocol>
 # 42 - aborted by callback
 <errorcode>
 42
diff --git a/third-party/curl/tests/data/test514 b/third-party/curl/tests/data/test514
index 67e015d3db..fadbd9d504 100644
--- a/third-party/curl/tests/data/test514
+++ b/third-party/curl/tests/data/test514
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,9 @@ HTTP
 HTTP HEAD
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -23,7 +23,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -32,19 +31,18 @@ http
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 First set options to POST and then to make HEAD
- </name>
+</name>
 # the 1s post-command delay helps to prevent a spurious failure on s390
- <command delay="1">
+<command delay="1">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 HEAD /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test515 b/third-party/curl/tests/data/test515
index 41308ef533..690f5d54cb 100644
--- a/third-party/curl/tests/data/test515
+++ b/third-party/curl/tests/data/test515
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,9 @@ HTTP
 HTTP POST
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -28,18 +28,17 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 make a POSTFIELDS set to NULL with POSTFIELDSIZE set to zero
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test516 b/third-party/curl/tests/data/test516
index 6ca727484a..ae087387b4 100644
--- a/third-party/curl/tests/data/test516
+++ b/third-party/curl/tests/data/test516
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ FORM
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -33,18 +33,17 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 make an HTTPPOST set to NULL
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test517 b/third-party/curl/tests/data/test517
index 0152c0f29d..6af03b7b62 100644
--- a/third-party/curl/tests/data/test517
+++ b/third-party/curl/tests/data/test517
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,40 +6,32 @@ getdate
 unittest
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 </reply>
 
 # Client-side
 <client>
-<server>
-none
-</server>
 # tool is what to use instead of 'curl'
 <tool>
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 curl_getdate() testing
- </name>
- <command>
-nothing
-</command>
+</name>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <stdout>
 </stdout>
 
 # This test case previously tested an overflow case ("2094 Nov 6 =>
-# 2147483647") for 32bit time_t, but since some systems have 64bit time_t and
-# handles this (returning 3939840000), and some 64bit-time_t systems don't
-# handle this and return -1 for this, it turned very tricky to write a fine
-# test case and thus it is now removed until we have a way to write test cases
+# 2147483647") for 32-bit time_t, but since some systems have 64-bit time_t and
+# handles this (returning 3939840000), and some 64-bit time_t systems do not
+# handle this and return -1 for this, it turned tricky to write a fine test
+# case and thus it is now removed until we have a way to write test cases
 # for this kind of things.
 
 </verify>
diff --git a/third-party/curl/tests/data/test518 b/third-party/curl/tests/data/test518
index 9bde9197a4..54aa631221 100644
--- a/third-party/curl/tests/data/test518
+++ b/third-party/curl/tests/data/test518
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -40,21 +40,20 @@ lib%TESTNUMBER
 # precheck is a command line to run before the test, to see if we can execute
 # the test or not
 <precheck>
-./libtest/lib%TESTNUMBER check
+%LIBTESTS lib%TESTNUMBER check
 </precheck>
 
- <name>
+<name>
 HTTP GET with more than FD_SETSIZE descriptors open
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
@@ -63,5 +62,8 @@ Accept: */*
 <valgrind>
 disable
 </valgrind>
+<limits>
+Maximum allocated: 1100000
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test519 b/third-party/curl/tests/data/test519
index 312a5819a0..53ad2a095c 100644
--- a/third-party/curl/tests/data/test519
+++ b/third-party/curl/tests/data/test519
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsbounce
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -17,7 +17,7 @@ Content-Length: 8
 
 content
 </data>
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -25,7 +25,7 @@ Content-Length: 9
 
 content2
 </data1>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK swsbounce
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -51,26 +51,25 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 GET same URL twice with different users
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic bW9uc3Rlcjp1bmRlcmJlZA==
+Authorization: Basic %b64[monster:underbed]b64%
 Accept: */*
 
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic YW5vdGhlcm1vbnN0ZXI6aW53YXJkcm9iZQ==
+Authorization: Basic %b64[anothermonster:inwardrobe]b64%
 Accept: */*
 
 </protocol>
diff --git a/third-party/curl/tests/data/test52 b/third-party/curl/tests/data/test52
index 64c46f2f57..d7472244ec 100644
--- a/third-party/curl/tests/data/test52
+++ b/third-party/curl/tests/data/test52
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 followlocation
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -39,24 +39,22 @@ body
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP follow redirect with ./-prefix
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/are/all/twits/%TESTNUMBER -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/are/all/twits/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test520 b/third-party/curl/tests/data/test520
index 991463c4b9..1ae3607754 100644
--- a/third-party/curl/tests/data/test520
+++ b/third-party/curl/tests/data/test520
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ FTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -26,19 +26,18 @@ ftp
 lib520
 </tool>
 
- <name>
+<name>
 FTP RETR with FILETIME
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/520
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test521 b/third-party/curl/tests/data/test521
index 5d00d1a6c0..84e1a3646d 100644
--- a/third-party/curl/tests/data/test521
+++ b/third-party/curl/tests/data/test521
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,9 @@ PASV
 CURLOPT_PORT
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -23,10 +21,9 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -35,18 +32,17 @@ ftp
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 FTP dir list PASV with CURLOPT_PORT
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP/%TESTNUMBER/ %FTPPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER xxx
 PASS yyy
 PWD
diff --git a/third-party/curl/tests/data/test522 b/third-party/curl/tests/data/test522
index 843284af86..ef76f5480f 100644
--- a/third-party/curl/tests/data/test522
+++ b/third-party/curl/tests/data/test522
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ CURLOPT_PORT
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -23,7 +23,6 @@ hello
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -32,21 +31,20 @@ http
 <tool>
 lib521
 </tool>
- <name>
+<name>
 HTTP GET with CURLOPT_PORT
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP/%TESTNUMBER %HTTPPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic eHh4Onl5eQ==
+Authorization: Basic %b64[xxx:yyy]b64%
 Accept: */*
 
 </protocol>
diff --git a/third-party/curl/tests/data/test523 b/third-party/curl/tests/data/test523
index 50bd2e8b7d..5c0db2c3e2 100644
--- a/third-party/curl/tests/data/test523
+++ b/third-party/curl/tests/data/test523
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,10 +10,9 @@ CURLOPT_PROXY
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -25,7 +25,6 @@ hello
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -34,11 +33,11 @@ http
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 HTTP GET with proxy and CURLOPT_PORT
- </name>
+</name>
 # first URL then proxy
- <command>
+<command>
 http://www.example.com:999/%TESTNUMBER http://%HOSTIP:%HTTPPORT
 </command>
 <features>
@@ -46,13 +45,12 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://www.example.com:19999/%TESTNUMBER HTTP/1.1
 Host: www.example.com:19999
-Authorization: Basic eHh4Onl5eQ==
+Authorization: Basic %b64[xxx:yyy]b64%
 Accept: */*
 Proxy-Connection: Keep-Alive
 
diff --git a/third-party/curl/tests/data/test524 b/third-party/curl/tests/data/test524
index bfb98a3eb1..37b33cb835 100644
--- a/third-party/curl/tests/data/test524
+++ b/third-party/curl/tests/data/test524
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,10 @@ UPLOAD
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -20,19 +19,18 @@ ftp
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 FTP upload with target URL ending with slash
- </name>
+</name>
 # first URL then proxy
- <command>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/to/
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test525 b/third-party/curl/tests/data/test525
index 8d0c732b0c..11bc85c157 100644
--- a/third-party/curl/tests/data/test525
+++ b/third-party/curl/tests/data/test525
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -22,10 +23,10 @@ ftp
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 FTP PORT upload using multi interface
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER %LOGDIR/upload%TESTNUMBER
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
@@ -41,7 +42,7 @@ Moooooooooooo
 ^PORT \d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3}
 ^EPRT \|1\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|\d{1,5}\|
 </strip>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test526 b/third-party/curl/tests/data/test526
index 676a27dfcf..a55a1f5eae 100644
--- a/third-party/curl/tests/data/test526
+++ b/third-party/curl/tests/data/test526
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -29,17 +30,17 @@ ftp
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 FTP RETR same file using different handles but same connection
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test527 b/third-party/curl/tests/data/test527
index 676a27dfcf..735bd20e85 100644
--- a/third-party/curl/tests/data/test527
+++ b/third-party/curl/tests/data/test527
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,19 +28,19 @@ file contents should appear once for each file
 ftp
 </server>
 <tool>
-lib%TESTNUMBER
+lib526
 </tool>
- <name>
-FTP RETR same file using different handles but same connection
- </name>
- <command>
+<name>
+FTP RETR same file using different handles and closed connections
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test528 b/third-party/curl/tests/data/test528
index a4dd8b5462..54f1707276 100644
--- a/third-party/curl/tests/data/test528
+++ b/third-party/curl/tests/data/test528
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ multi
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -33,17 +34,17 @@ http
 <tool>
 lib526
 </tool>
- <name>
+<name>
 HTTP GET same file using different handles but same connection
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/path/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /path/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test529 b/third-party/curl/tests/data/test529
index d3b12210a8..473bf165f3 100644
--- a/third-party/curl/tests/data/test529
+++ b/third-party/curl/tests/data/test529
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -20,12 +21,12 @@ multi
 ftp
 </server>
 <tool>
-lib%TESTNUMBER
+lib525
 </tool>
- <name>
+<name>
 FTP PORT upload using multi interface (weird cleanup function sequence)
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER %LOGDIR/upload%TESTNUMBER
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
@@ -41,7 +42,7 @@ Moooooooooooo
 ^PORT \d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3}
 ^EPRT \|1\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|\d{1,5}\|
 </strip>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test53 b/third-party/curl/tests/data/test53
index 5db9a07f91..ad5d6ac62d 100644
--- a/third-party/curl/tests/data/test53
+++ b/third-party/curl/tests/data/test53
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ cookies
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Server: Microsoft-IIS/4.0
 Date: Tue, 25 Sep 2001 19:37:44 GMT
@@ -25,10 +26,10 @@ This server says moo
 <server>
 http
 </server>
- <name>
+<name>
 HTTP, junk session cookies
- </name>
- <command>
+</name>
+<command>
 %HOSTIP:%HTTPPORT/want/%TESTNUMBER -b %LOGDIR/injar%TESTNUMBER -j
 </command>
 <file name="%LOGDIR/injar%TESTNUMBER">
@@ -43,7 +44,7 @@ cookies
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test530 b/third-party/curl/tests/data/test530
index 42e27a0d83..0875b5e5f8 100644
--- a/third-party/curl/tests/data/test530
+++ b/third-party/curl/tests/data/test530
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -43,7 +44,5 @@ http://%HOSTIP:%HTTPPORT/file%TESTNUMBER
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-</protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test531 b/third-party/curl/tests/data/test531
index a38b807fab..a43d4d787e 100644
--- a/third-party/curl/tests/data/test531
+++ b/third-party/curl/tests/data/test531
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -25,15 +26,15 @@ ftp
 <tool>
 lib525
 </tool>
- <name>
+<name>
 FTP PORT upload using multi interface and get 425 response
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER %LOGDIR/upload%TESTNUMBER
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
 Moooooooooooo
-don't upload this
+do not upload this
 </file>
 </client>
 
@@ -44,7 +45,7 @@ don't upload this
 ^PORT \d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3},\d{1,3}
 ^EPRT \|1\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|\d{1,5}\|
 </strip>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test532 b/third-party/curl/tests/data/test532
index 9061cc7d14..aed9c3dd77 100644
--- a/third-party/curl/tests/data/test532
+++ b/third-party/curl/tests/data/test532
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,19 +28,19 @@ file contents should appear once for each file
 ftp
 </server>
 <tool>
-lib%TESTNUMBER
+lib526
 </tool>
- <name>
+<name>
 FTP RETR same file using reset handles between each transfer
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test533 b/third-party/curl/tests/data/test533
index 78a3ec4f32..e0ca3b0142 100644
--- a/third-party/curl/tests/data/test533
+++ b/third-party/curl/tests/data/test533
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,17 +28,17 @@ ftp
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 FTP RETR a non-existing file twice using the multi interface
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test534 b/third-party/curl/tests/data/test534
index 8037f90c7a..5ef1f68abd 100644
--- a/third-party/curl/tests/data/test534
+++ b/third-party/curl/tests/data/test534
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -28,17 +29,17 @@ ftp
 <tool>
 lib533
 </tool>
- <name>
+<name>
 FTP RETR twice using multi: non-existing host and non-existing file
- </name>
- <command>
+</name>
+<command>
 ftp://non-existing-host.haxx.se/path/%TESTNUMBER ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test535 b/third-party/curl/tests/data/test535
index f4abb6c389..49802e21ca 100644
--- a/third-party/curl/tests/data/test535
+++ b/third-party/curl/tests/data/test535
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ multi
 </info>
 
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 404 Badness
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 ETag: "21025-dc7-39462498"
@@ -18,7 +19,7 @@ Funny-head: yesyes
 
 hejsan
 </data>
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 200 Fine
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 13
@@ -44,18 +45,17 @@ http
 lib533
 </tool>
 
- <name>
+<name>
 HTTP GET multi two files with FAILONERROR
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER0001
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test536 b/third-party/curl/tests/data/test536
new file mode 100644
index 0000000000..e0bcc906f7
--- /dev/null
+++ b/third-party/curl/tests/data/test536
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+HTTP proxy
+CURLOPT_PROXY
+CURLOPT_NOBODY
+CURLINFO_USED_PROXY
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK swsclose
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+
+hello
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<tool>
+lib%TESTNUMBER
+</tool>
+<name>
+CURLINFO_USED_PROXY
+</name>
+
+# provides:
+# 0 - the proxy URL
+# 1 - the non-proxy using URL
+# 2 - the CURLOPT_RESOLVE string to change IP for the name
+<command>
+http://%HOSTIP:%HTTPPORT goingdirect.test:%HTTPPORT goingdirect.test:%HTTPPORT:%HOSTIP
+</command>
+<features>
+proxy
+</features>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://usingproxy.test/ HTTP/1.1
+Host: usingproxy.test
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET / HTTP/1.1
+Host: goingdirect.test:%HTTPPORT
+Accept: */*
+
+</protocol>
+<stdout mode="text">
+hello
+This used the proxy
+hello
+This DID NOT use the proxy
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test537 b/third-party/curl/tests/data/test537
index ab081ae0e5..177636b3e0 100644
--- a/third-party/curl/tests/data/test537
+++ b/third-party/curl/tests/data/test537
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -40,25 +40,27 @@ lib%TESTNUMBER
 # precheck is a command line to run before the test, to see if we can execute
 # the test or not
 <precheck>
-./libtest/lib%TESTNUMBER check
+%LIBTESTS lib%TESTNUMBER check
 </precheck>
 
- <name>
+<name>
 HTTP GET with a HUGE number of file descriptors open
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
 
 </protocol>
+<limits>
+Maximum allocated: 3200000
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test538 b/third-party/curl/tests/data/test538
index b7b326bd01..69e6fa931c 100644
--- a/third-party/curl/tests/data/test538
+++ b/third-party/curl/tests/data/test538
@@ -1,8 +1,8 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
-FAILURE
 multi
 </keywords>
 </info>
@@ -23,21 +23,21 @@ ftp
 <tool>
 lib504
 </tool>
- <name>
+<name>
 FTP multi-interface download, failed login: PASS not valid
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
-# TEST_ERR_SUCCESS is errorcode 120
+# TEST_ERR_SUCCESS is errorcode 41
 <verify>
 <errorcode>
-120
+41
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 </protocol>
diff --git a/third-party/curl/tests/data/test539 b/third-party/curl/tests/data/test539
index 14d3e25ffb..2a487c652a 100644
--- a/third-party/curl/tests/data/test539
+++ b/third-party/curl/tests/data/test539
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,29 +6,20 @@ FTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
 file contents
 </data>
 
+<data1>
+contents for file number two
+</data1>
+
 <datacheck>
 file contents
+contents for file number two
 </datacheck>
-<datacheck1 mode="text">
-total 20
-drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
-drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
-drwxr-xr-x   2 98       98           512 May  2  1996 .NeXT
--r--r--r--   1 0        1             35 Jul 16  1996 README
-lrwxrwxrwx   1 0        1              7 Dec  9  1999 bin -> usr/bin
-dr-xr-xr-x   2 0        1            512 Oct  1  1997 dev
-drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
-dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
-drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
-dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck1>
 </reply>
 
 # Client-side
@@ -40,18 +32,17 @@ ftp
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 Two FTP fetches using different CURLOPT_FTP_FILEMETHOD
- </name>
- <command>
-ftp://%HOSTIP:%FTPPORT/path/to/the/file/%TESTNUMBER
+</name>
+<command>
+ftp://%HOSTIP:%FTPPORT/path/to/the/file/%TESTNUMBER ftp://%HOSTIP:%FTPPORT/path/to/the/file/%TESTNUMBER0001
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -63,8 +54,8 @@ RETR %TESTNUMBER
 SYST
 CWD /
 EPSV
-TYPE A
-LIST path/to/the/file/%TESTNUMBER.
+SIZE path/to/the/file/%TESTNUMBER0001
+RETR path/to/the/file/%TESTNUMBER0001
 QUIT
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test54 b/third-party/curl/tests/data/test54
index a1a0cf8c3b..f9f1bc1ea8 100644
--- a/third-party/curl/tests/data/test54
+++ b/third-party/curl/tests/data/test54
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ followlocation
 <data>
 HTTP/1.1 302 This is a weirdo text message swsclose
 Connection: close
-Location: 
+Location:%SP
 
 This server reply is for testing
 </data>
@@ -22,17 +23,17 @@ This server reply is for testing
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with blank Location:
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -L
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test540 b/third-party/curl/tests/data/test540
index fc9d40c7e9..0999f5e969 100644
--- a/third-party/curl/tests/data/test540
+++ b/third-party/curl/tests/data/test540
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -16,7 +17,7 @@ connection-monitor
 </servercmd>
 
 # this is returned first since we get no proxy-auth
-<data>
+<data crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me my dear
 Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
 Content-Length: 33
@@ -25,7 +26,7 @@ And you should ignore this data.
 </data>
 
 # then this is returned when we get proxy-auth
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 OK
 Content-Length: 21
 Server: no
@@ -33,7 +34,7 @@ Server: no
 Nice proxy auth sir!
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me my dear
 Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
 Content-Length: 33
@@ -68,18 +69,19 @@ lib%TESTNUMBER
 !SSPI
 crypto
 proxy
+digest
 </features>
- <name>
-HTTP proxy auth Digest multi API re-using connection
- </name>
- <command>
+<name>
+HTTP proxy auth Digest multi API reusing connection
+</name>
+<command>
 http://test.remote.example.com/path/%TESTNUMBER http://%HOSTIP:%HTTPPORT silly:person custom.set.host.name
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
 Host: custom.set.host.name
 Accept: */*
diff --git a/third-party/curl/tests/data/test541 b/third-party/curl/tests/data/test541
index 79a0de0fc8..67039a3e81 100644
--- a/third-party/curl/tests/data/test541
+++ b/third-party/curl/tests/data/test541
@@ -1,7 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 FTP
+STOR
 </keywords>
 </info>
 
@@ -19,10 +21,10 @@ ftp
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 FTP upload and upload same file again without rewind
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER %LOGDIR/upload%TESTNUMBER
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
@@ -42,7 +44,7 @@ works?
 <verify>
 <upload>
 </upload>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test542 b/third-party/curl/tests/data/test542
index ba6b50ea7c..29aa562d68 100644
--- a/third-party/curl/tests/data/test542
+++ b/third-party/curl/tests/data/test542
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -16,7 +17,7 @@ that FTP
 works
   so does it?
 </data>
-<datacheck>
+<datacheck crlf="yes">
 Content-Length: 51
 Accept-ranges: bytes
 </datacheck>
@@ -30,21 +31,20 @@ ftp
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 FTP a file with NOBODY yes and HEADER no
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 
 </client>
 
 # Verify data after the test has been "shot"
-#
-# There's no MTDM in the protocol here since this code doesn't ask for the
+# There is no MTDM in the protocol here since this code does not ask for the
 # time/date of the file
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test543 b/third-party/curl/tests/data/test543
index 2abaa69621..ec6677bf0b 100644
--- a/third-party/curl/tests/data/test543
+++ b/third-party/curl/tests/data/test543
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,24 +9,16 @@ curl_easy_escape
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 curl_easy_escape
- </name>
- <command>
--
-</command>
-
+</name>
 </client>
 
 # Verify data after the test has been "shot"
-#
-# There's no MTDM in the protocol here since this code doesn't ask for the
+# There is no MTDM in the protocol here since this code does not ask for the
 # time/date of the file
 <verify>
 <stdout>
diff --git a/third-party/curl/tests/data/test544 b/third-party/curl/tests/data/test544
index 31e41b70d2..f71cd095e7 100644
--- a/third-party/curl/tests/data/test544
+++ b/third-party/curl/tests/data/test544
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ HTTP POST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -29,18 +29,17 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 HTTP POST text data using CURLOPT_COPYPOSTFIELDS
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="headers" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test545 b/third-party/curl/tests/data/test545
index a06b8ebb6e3844e77e58e78d213f8e9c1b93e409..0cffd7b20be54dd4a88acc976f49ae6bcd7cb96b 100644
GIT binary patch
delta 275
zcmdnSc7aXH#=asqN1-gWs5mn}&sND$&p=5bH7_|oB{MJGRw*=C*D=`H(^JXbj%$LG
zrb2LP5m2daab`*?mrYS>K~AL|mrY7yNuok>QBInzQbuZG3eYH}iE&aBD^(`WlN9E1
z&d)1J%`4IMNzF?y$*@u|=9+l6oY&OEgv&<1BtJjLj*Dw@6r%%&jecHYZmJ#E<Ry%5
zlix6!i5C>*m*gks=b#xq*^5cXoXaD>xWr09)x$qH#52H3)gvS%AizH;gv&8GIkf;N
tqouEfVY7+Z<c&-Qd|X_r8L1V~AsLy)ss;v=UomO2#sURYCkrzx0|2t-R^0#q

delta 266
zcmcb>wvBC~mea&68EHE%kC2c6eM3D%1tS9k1%Gda;_~9;oc!Wc-ihl~40ySMQ;W({
zi>wq%Qj1G;i@_ZIw8ZRGUM}bSypq(s5?!Cvy!4U`D+Oa-F5Zd%%f(bfT!TaWLVcZF
zgSc$;OY-w`?6|lTCO0!Wa4Fd6=OyN*+5x$z8QmuHGg)X9mlS0d*m1>$0?pQSOa~fh
zrKbhd2Nky|D9SI%PtMPo9LJ<%&CBJHUtD6Ppz7ft9O4;Zr3!L<fPYX3FPCF-a%urk
jN=si0(`hDVyps<y8E^t!$Q6>2S<Eo`Ka=KUU1ntfx)4w_

diff --git a/third-party/curl/tests/data/test546 b/third-party/curl/tests/data/test546
index e5a398730d..06bc27501d 100644
--- a/third-party/curl/tests/data/test546
+++ b/third-party/curl/tests/data/test546
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -34,17 +35,17 @@ ftp
 <tool>
 lib533
 </tool>
- <name>
+<name>
 FTP RETR a non-existing file then a found one using the multi interface
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test547 b/third-party/curl/tests/data/test547
index e9fbba37d1..723d687f10 100644
--- a/third-party/curl/tests/data/test547
+++ b/third-party/curl/tests/data/test547
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,7 +13,7 @@ NTLM
 # Server-side
 <reply>
 
-<data>
+<data crlf="headers">
 HTTP/1.1 407 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Proxy-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -25,7 +26,7 @@ This is not the real page
 </data>
 
 # this is returned first since we get no proxy-auth
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me my dear
 Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
 Content-Length: 34
@@ -35,7 +36,7 @@ Hey you, authenticate or go away!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 200 Things are fine in proxy land swsclose
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -44,7 +45,7 @@ Content-Length: 42
 Contents of that page you requested, sir.
 </data1002>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 407 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Proxy-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -91,7 +92,7 @@ http://test.remote.example.com/path/%TESTNUMBER http://%HOSTIP:%HTTPPORT testuse
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 POST http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
 Host: test.remote.example.com
 Accept: */*
@@ -102,7 +103,7 @@ Content-Type: application/x-www-form-urlencoded
 this is the blurb we want to upload
 POST http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
 Host: test.remote.example.com
-Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Proxy-Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 Proxy-Connection: Keep-Alive
 Content-Length: 0
diff --git a/third-party/curl/tests/data/test548 b/third-party/curl/tests/data/test548
index bdcbac476d..2a60640fc2 100644
--- a/third-party/curl/tests/data/test548
+++ b/third-party/curl/tests/data/test548
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,7 +13,7 @@ NTLM
 # Server-side
 <reply>
 
-<data>
+<data crlf="headers">
 HTTP/1.1 407 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Proxy-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -25,7 +26,7 @@ This is not the real page
 </data>
 
 # this is returned first since we get no proxy-auth
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me my dear
 Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
 Content-Length: 34
@@ -35,7 +36,7 @@ Hey you, authenticate or go away!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 200 Things are fine in proxy land swsclose
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -44,7 +45,7 @@ Content-Length: 42
 Contents of that page you requested, sir.
 </data1002>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 407 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Proxy-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -73,7 +74,7 @@ http
 </server>
 # tool to use
 <tool>
-lib%TESTNUMBER
+lib547
 </tool>
 <features>
 NTLM
@@ -91,7 +92,7 @@ http://test.remote.example.com/path/%TESTNUMBER http://%HOSTIP:%HTTPPORT testuse
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 POST http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
 Host: test.remote.example.com
 Accept: */*
@@ -102,7 +103,7 @@ Content-Type: application/x-www-form-urlencoded
 this is the blurb we want to upload
 POST http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
 Host: test.remote.example.com
-Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Proxy-Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 Proxy-Connection: Keep-Alive
 Content-Length: 0
diff --git a/third-party/curl/tests/data/test549 b/third-party/curl/tests/data/test549
index ffa233b7bf..c20612fc27 100644
--- a/third-party/curl/tests/data/test549
+++ b/third-party/curl/tests/data/test549
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ HTTP proxy
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -24,7 +24,6 @@ hello
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -37,19 +36,18 @@ proxy
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 FTP RETR over proxy with CURLOPT_PROXY_TRANSFER_MODE
- </name>
+</name>
 # first URL then proxy
- <command>
+<command>
 ftp://www.example.com/moo/%TESTNUMBER http://%HOSTIP:%HTTPPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET ftp://www.example.com/moo/%TESTNUMBER;type=i HTTP/1.1
 Host: www.example.com:21
 Accept: */*
diff --git a/third-party/curl/tests/data/test55 b/third-party/curl/tests/data/test55
index 9ed6205515..66005b4ef5 100644
--- a/third-party/curl/tests/data/test55
+++ b/third-party/curl/tests/data/test55
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -39,16 +40,16 @@ body
 <server>
 http
 </server>
- <name>
+<name>
 HTTP follow redirect with single slash in path
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -L
 </command>
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test550 b/third-party/curl/tests/data/test550
index 26cf0a150a..c3b7471785 100644
--- a/third-party/curl/tests/data/test550
+++ b/third-party/curl/tests/data/test550
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ CURLOPT_PROXY
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -24,7 +24,6 @@ hello
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -37,19 +36,18 @@ proxy
 <tool>
 lib549
 </tool>
- <name>
+<name>
 FTP RETR over proxy with CURLOPT_PROXY_TRANSFER_MODE and ASCII transfer
- </name>
+</name>
 # first URL then proxy
- <command>
+<command>
 ftp://www.example.com/moo/%TESTNUMBER http://%HOSTIP:%HTTPPORT ascii
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET ftp://www.example.com/moo/%TESTNUMBER;type=a HTTP/1.1
 Host: www.example.com:21
 Accept: */*
diff --git a/third-party/curl/tests/data/test551 b/third-party/curl/tests/data/test551
index 8327bd0f9c..4102145230 100644
--- a/third-party/curl/tests/data/test551
+++ b/third-party/curl/tests/data/test551
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 # this test is meant to be exactly like 547 but using Digest instead of NTLM
@@ -14,10 +15,10 @@ HTTP proxy Digest auth
 <reply>
 
 # as a bonus, ww use an excessive nonce length
-<data>
+<data crlf="headers">
 HTTP/1.1 407 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
-Proxy-Authenticate: Digest realm="something fun to read", nonce="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+Proxy-Authenticate: Digest realm="something fun to read", nonce="%repeat[400 x A]%"
 Content-Type: text/html; charset=iso-8859-1
 Connection: close
 
@@ -26,7 +27,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets the Digest
 # Authorization: line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 Things are fine in proxy land swsclose
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -35,10 +36,10 @@ Content-Length: 42
 Contents of that page you requested, sir.
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 407 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
-Proxy-Authenticate: Digest realm="something fun to read", nonce="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+Proxy-Authenticate: Digest realm="something fun to read", nonce="%repeat[400 x A]%"
 Content-Type: text/html; charset=iso-8859-1
 Connection: close
 
@@ -64,18 +65,19 @@ lib547
 !SSPI
 crypto
 proxy
+digest
 </features>
- <name>
+<name>
 HTTP proxy auth Digest with POST data from read callback
- </name>
- <command>
+</name>
+<command>
 http://test.remote.example.com/path/%TESTNUMBER http://%HOSTIP:%HTTPPORT s1lly:pers0n
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 POST http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
 Host: test.remote.example.com
 Accept: */*
@@ -86,7 +88,7 @@ Content-Type: application/x-www-form-urlencoded
 this is the blurb we want to upload
 POST http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
 Host: test.remote.example.com
-Proxy-Authorization: Digest username="s1lly", realm="something fun to read", nonce="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", uri="/path/%TESTNUMBER", response="3325240726fbdaf1e61f3a0dd40b930c"
+Proxy-Authorization: Digest username="s1lly", realm="something fun to read", nonce="%repeat[400 x A]%", uri="/path/%TESTNUMBER", response="3325240726fbdaf1e61f3a0dd40b930c"
 Accept: */*
 Proxy-Connection: Keep-Alive
 Content-Length: 36
diff --git a/third-party/curl/tests/data/test552 b/third-party/curl/tests/data/test552
index 75e3b682f9..621f378b1e 100644
--- a/third-party/curl/tests/data/test552
+++ b/third-party/curl/tests/data/test552
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 # this test is meant to be exactly like 551 but is based on the debug code
@@ -16,10 +17,10 @@ HTTP proxy Digest auth
 <reply>
 
 # as a bonus, ww use an excessive nonce length
-<data>
+<data crlf="headers">
 HTTP/1.1 407 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
-Proxy-Authenticate: Digest realm="something fun to read", nonce="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+Proxy-Authenticate: Digest realm="something fun to read", nonce="%repeat[400 x A]%"
 Content-Type: text/html; charset=iso-8859-1
 Connection: close
 
@@ -28,7 +29,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets the Digest
 # Authorization: line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 Things are fine in proxy land swsclose
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -57,11 +58,12 @@ lib%TESTNUMBER
 !SSPI
 crypto
 proxy
+digest
 </features>
- <name>
+<name>
 HTTP proxy auth Digest with 70K POST data from read callback
- </name>
- <command>
+</name>
+<command>
 http://test.remote.example.com/path/%TESTNUMBER http://s1lly:pers0n@%HOSTIP:%HTTPPORT/
 </command>
 </client>
@@ -69,21 +71,21 @@ http://test.remote.example.com/path/%TESTNUMBER http://s1lly:pers0n@%HOSTIP:%HTT
 # Verify data after the test has been "shot"
 <verify>
 <protocol nonewline="yes">
-POST http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
-Host: test.remote.example.com
-Accept: */*
-Proxy-Connection: Keep-Alive
-Content-Length: 70000
-Content-Type: application/x-www-form-urlencoded
-
-%repeat[7000 x test data%00]%POST http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
-Host: test.remote.example.com
-Proxy-Authorization: Digest username="s1lly", realm="something fun to read", nonce="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", uri="/path/%TESTNUMBER", response="be7aedc47d821b6d847c445ded782c43"
-Accept: */*
-Proxy-Connection: Keep-Alive
-Content-Length: 70000
-Content-Type: application/x-www-form-urlencoded
-
+POST http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1%CR
+Host: test.remote.example.com%CR
+Accept: */*%CR
+Proxy-Connection: Keep-Alive%CR
+Content-Length: 70000%CR
+Content-Type: application/x-www-form-urlencoded%CR
+%CR
+%repeat[7000 x test data%00]%POST http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1%CR
+Host: test.remote.example.com%CR
+Proxy-Authorization: Digest username="s1lly", realm="something fun to read", nonce="%repeat[400 x A]%", uri="/path/%TESTNUMBER", response="be7aedc47d821b6d847c445ded782c43"%CR
+Accept: */*%CR
+Proxy-Connection: Keep-Alive%CR
+Content-Length: 70000%CR
+Content-Type: application/x-www-form-urlencoded%CR
+%CR
 %repeat[7000 x test data%00]%
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test553 b/third-party/curl/tests/data/test553
index aada6eb147..0a1ce9e414 100644
--- a/third-party/curl/tests/data/test553
+++ b/third-party/curl/tests/data/test553
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ huge request header
 # Server-side
 <reply>
 
-<data>
+<data crlf="headers">
 HTTP/1.1 200 Fine!
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Length: 6
@@ -31,17 +32,17 @@ lib%TESTNUMBER
 </tool>
 <features>
 </features>
- <name>
+<name>
 HTTP post with huge request headers and post data from callback
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/path/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="headers" nonewline="yes">
 POST /path/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test554 b/third-party/curl/tests/data/test554
index 2cbdcfd2bd..04be5b582e 100644
--- a/third-party/curl/tests/data/test554
+++ b/third-party/curl/tests/data/test554
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ FORM
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -19,7 +19,7 @@ Content-Type: text/html
 
 hello
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -50,87 +50,86 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 HTTP multi-part formpost using read callback for the file part
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
 # Note that the stripping above removes 12 bytes from every occurrence of the
 # boundary string and since 5 of them are in the body contents, we see
 # (5*12) == 60 bytes less
 <protocol>
-POST /%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-Accept: */*
-Content-Length: 744
-Content-Type: multipart/form-data; boundary=----------------------------
-
-------------------------------
-Content-Disposition: form-data; name="sendfile"; filename="postit2.c"
-
+POST /%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+Accept: */*%CR
+Content-Length: 780%CR
+Content-Type: multipart/form-data; boundary=----------------------------%CR
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="sendfile"; filename="postit2.c"%CR
+%CR
 this is what we post to the silly web server
-
-------------------------------
-Content-Disposition: form-data; name="callbackdata"
-
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="callbackdata"%CR
+%CR
 this is what we post to the silly web server
-
-------------------------------
-Content-Disposition: form-data; name="filename"
-
-postit2.c
-------------------------------
-Content-Disposition: form-data; name="submit"
-Content-Type: text/plain
-
-send
-------------------------------
-Content-Disposition: form-data; name="somename"; filename="somefile.txt"
-Content-Type: text/plain
-
-blah blah
---------------------------------
-POST /%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-Accept: */*
-Content-Length: 758
-Content-Type: multipart/form-data; boundary=----------------------------
-
-------------------------------
-Content-Disposition: form-data; name="sendfile alternative"; filename="file name 2"
-
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="filename"%CR
+%CR
+postit2.c%CR
+------------------------------%CR
+Content-Disposition: form-data; name="submit"%CR
+Content-Type: text/plain%CR
+%CR
+send%CR
+------------------------------%CR
+Content-Disposition: form-data; name="somename"; filename="somefile.txt"%CR
+Content-Type: text/plain%CR
+%CR
+blah blah%CR
+--------------------------------%CR
+POST /%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+Accept: */*%CR
+Content-Length: 794%CR
+Content-Type: multipart/form-data; boundary=----------------------------%CR
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="sendfile alternative"; filename="filename 2 "%CR
+%CR
 this is what we post to the silly web server
-
-------------------------------
-Content-Disposition: form-data; name="callbackdata"
-
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="callbackdata"%CR
+%CR
 this is what we post to the silly web server
-
-------------------------------
-Content-Disposition: form-data; name="filename"
-
-postit2.c
-------------------------------
-Content-Disposition: form-data; name="submit"
-Content-Type: text/plain
-
-send
-------------------------------
-Content-Disposition: form-data; name="somename"; filename="somefile.txt"
-Content-Type: text/plain
-
-blah blah
---------------------------------
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="filename"%CR
+%CR
+postit2.c%CR
+------------------------------%CR
+Content-Disposition: form-data; name="submit"%CR
+Content-Type: text/plain%CR
+%CR
+send%CR
+------------------------------%CR
+Content-Disposition: form-data; name="somename"; filename="somefile.txt"%CR
+Content-Type: text/plain%CR
+%CR
+blah blah%CR
+--------------------------------%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test555 b/third-party/curl/tests/data/test555
index bc2efe006d..bb2ff515e8 100644
--- a/third-party/curl/tests/data/test555
+++ b/third-party/curl/tests/data/test555
@@ -1,6 +1,7 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # NOTE: this test case is a duplicate of 547 but the tool is built to use the
-# multi interface instead of easy, but that shouldn't be noticeable at all in
+# multi interface instead of easy, but that should not be noticeable at all in
 # this file!
 <info>
 <keywords>
@@ -17,7 +18,7 @@ NTLM
 # Server-side
 <reply>
 
-<data>
+<data crlf="headers">
 HTTP/1.1 407 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Proxy-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -30,7 +31,7 @@ This is not the real page
 </data>
 
 # this is returned first since we get no proxy-auth
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me my dear
 Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
 Content-Length: 34
@@ -40,7 +41,7 @@ Hey you, authenticate or go away!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 200 Things are fine in proxy land swsclose
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -49,7 +50,7 @@ Content-Length: 42
 Contents of that page you requested, sir.
 </data1002>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 407 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Proxy-Authenticate: Blackmagic realm="gimme all yer s3cr3ts"
@@ -96,7 +97,7 @@ http://test.remote.example.com/path/%TESTNUMBER http://%HOSTIP:%HTTPPORT testuse
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 POST http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
 Host: test.remote.example.com
 Accept: */*
@@ -107,7 +108,7 @@ Content-Type: application/x-www-form-urlencoded
 this is the blurb we want to upload
 POST http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
 Host: test.remote.example.com
-Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Proxy-Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 Proxy-Connection: Keep-Alive
 Content-Length: 0
diff --git a/third-party/curl/tests/data/test556 b/third-party/curl/tests/data/test556
index cdab22a75e..7d39cc1737 100644
--- a/third-party/curl/tests/data/test556
+++ b/third-party/curl/tests/data/test556
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,7 @@ HTTP GET
 </info>
 
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Server: test-server/fake
 Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
@@ -18,7 +19,6 @@ Connection: close
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -27,18 +27,17 @@ http
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 send and recv HTTP
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: ninja
 
diff --git a/third-party/curl/tests/data/test557 b/third-party/curl/tests/data/test557
index 1963774946..47242b1487 100644
--- a/third-party/curl/tests/data/test557
+++ b/third-party/curl/tests/data/test557
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,16 +6,12 @@ printf
 unittest
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 </reply>
 
 # Client-side
 <client>
-<server>
-none
-</server>
 # tool is what to use instead of 'curl'
 <tool>
 lib%TESTNUMBER
@@ -23,12 +20,8 @@ lib%TESTNUMBER
 <name>
 curl_mprintf() testing
 </name>
-<command>
-nothing
-</command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <stdout>
@@ -41,6 +34,7 @@ All curl_mprintf() signed long tests OK!
 All curl_mprintf() curl_off_t tests OK!
 All curl_mprintf() strings tests OK!
 All float strings tests OK!
+All curl_mprintf() octal and hexadecimal tests OK!
 </stdout>
 </verify>
 
diff --git a/third-party/curl/tests/data/test558 b/third-party/curl/tests/data/test558
index 06b772816e..e6513ac5a3 100644
--- a/third-party/curl/tests/data/test558
+++ b/third-party/curl/tests/data/test558
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,19 +6,15 @@ TrackMemory
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 TrackMemory
-ipv6
+IPv6
 </features>
 # tool is what to use instead of 'curl'
 <tool>
@@ -27,12 +24,8 @@ lib%TESTNUMBER
 <name>
 libtest memory tracking operational
 </name>
-<command>
-nothing
-</command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <file name="%LOGDIR/memdump">
@@ -49,7 +42,7 @@ s/^MEM escape.c:\d+ free\(\(nil\)\)[\n]$//
 s/ =.*//
 s/\(.*\)/()/
 s/:\d+/:/
-s:^(MEM |FD )(.*/)(.*):$1$3:
+s:^(MEM |FD )(.*[/\\])(.*):$1$3:
 s/\r\n/\n/
 s/^MEM getenv.c: realloc\(\)[\n]$//
 s/^MEM getenv.c: free\(\)[\n]$//
diff --git a/third-party/curl/tests/data/test559 b/third-party/curl/tests/data/test559
index 982209ce9d..35f888ad46 100644
--- a/third-party/curl/tests/data/test559
+++ b/third-party/curl/tests/data/test559
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -19,9 +19,9 @@ Accept-Ranges: bytes
 Content-Length: 2049
 Connection: close
 Content-Type: text/html
-Silly-header: ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
+Silly-header: %repeat[511 x Z]%
 
-ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
+%repeat[2048 x Z]%
 </data>
 </reply>
 
@@ -43,7 +43,6 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 </verify>
diff --git a/third-party/curl/tests/data/test56 b/third-party/curl/tests/data/test56
index 9a8466d6a8..8797da198a 100644
--- a/third-party/curl/tests/data/test56
+++ b/third-party/curl/tests/data/test56
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,28 +24,24 @@ This is the proof it works
 <server>
 http
 </server>
- <name>
+<name>
 HTTP POST with *HUGE* request and chunked transfer-encoding
- </name>
- <stdin>
-#
+</name>
+<stdin>
 data "we post this"
-#
 # enforce chunky post!
 header "Transfer-Encoding: chunked"
-#
 # Set the user-agent using a short-option:
 -A "%repeat[99999 x a]%"
-#
- </stdin>
- <command>
+</stdin>
+<command>
 -K - %HOSTIP:%HTTPPORT/that.site.com/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 POST /that.site.com/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: %repeat[99999 x a]%
@@ -52,11 +49,7 @@ Accept: */*
 Transfer-Encoding: chunked
 Content-Type: application/x-www-form-urlencoded
 
-%if hyper
-C
-%else
 c
-%endif
 we post this
 0
 
diff --git a/third-party/curl/tests/data/test560 b/third-party/curl/tests/data/test560
index 8e765919fb..9aa36a4795 100644
--- a/third-party/curl/tests/data/test560
+++ b/third-party/curl/tests/data/test560
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ multi
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -20,7 +20,6 @@ MooMoo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -32,18 +31,17 @@ https
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 simple HTTPS GET with multi interface
- </name>
- <command>
+</name>
+<command>
 https://%HOSTIP:%HTTPSPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPSPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test561 b/third-party/curl/tests/data/test561
index 2415f7a547..bd752397f3 100644
--- a/third-party/curl/tests/data/test561
+++ b/third-party/curl/tests/data/test561
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,10 +10,9 @@ type=
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -25,7 +25,6 @@ hello
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -38,19 +37,18 @@ proxy
 <tool>
 lib549
 </tool>
- <name>
+<name>
 FTP RETR with CURLOPT_PROXY_TRANSFER_MODE, ASCII transfer and type=i
- </name>
+</name>
 # first URL then proxy
- <command>
+<command>
 "ftp://www.example.com/moo/%TESTNUMBER;type=i" http://%HOSTIP:%HTTPPORT ascii
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET ftp://www.example.com/moo/%TESTNUMBER;type=i HTTP/1.1
 Host: www.example.com:21
 Accept: */*
diff --git a/third-party/curl/tests/data/test562 b/third-party/curl/tests/data/test562
index 752394f4be..6e0778b661 100644
--- a/third-party/curl/tests/data/test562
+++ b/third-party/curl/tests/data/test562
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -22,24 +23,23 @@ ftp
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 FTP a type=A URL and CURLOPT_PORT set
- </name>
+</name>
 
-# note that we need quotes around the URL below to make sure the shell doesn't
+# note that we need quotes around the URL below to make sure the shell does not
 # treat the semicolon as a separator!
- <command>
+<command>
 'ftp://%HOSTIP:23456/%TESTNUMBER;type=A' %FTPPORT
 </command>
 
 </client>
 
 # Verify data after the test has been "shot"
-#
-# There's no MTDM in the protocol here since this code doesn't ask for the
+# There is no MTDM in the protocol here since this code does not ask for the
 # time/date of the file
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test563 b/third-party/curl/tests/data/test563
index 598dd254d5..c3f09884a3 100644
--- a/third-party/curl/tests/data/test563
+++ b/third-party/curl/tests/data/test563
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ HTTP proxy
 
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -29,18 +30,18 @@ ftp
 <tool>
 lib562
 </tool>
- <name>
+<name>
 FTP type=A URL and CURLOPT_PORT set and proxy
- </name>
+</name>
 <features>
 proxy
 </features>
 <setenv>
 ftp_proxy=http://%HOSTIP:%HTTPPORT/
 </setenv>
-# note that we need quotes around the URL below to make sure the shell doesn't
+# note that we need quotes around the URL below to make sure the shell does not
 # treat the semicolon as a separator!
- <command>
+<command>
 "ftp://%HOSTIP:23456/%TESTNUMBER;type=A" %FTPPORT
 </command>
 
@@ -48,7 +49,7 @@ ftp_proxy=http://%HOSTIP:%HTTPPORT/
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET ftp://%HOSTIP:%FTPPORT/%TESTNUMBER;type=A HTTP/1.1
 Host: %HOSTIP:%FTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test564 b/third-party/curl/tests/data/test564
index 5366e18a22..dba2a7fb03 100644
--- a/third-party/curl/tests/data/test564
+++ b/third-party/curl/tests/data/test564
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 # Warning: if this test fails to start the SSH server, check that none of
 # the user's shell profiles sends output to stdout of a non-interactive shell.
@@ -32,9 +33,9 @@ socks4
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 FTP RETR a file over a SOCKS proxy using the multi interface
- </name>
+</name>
 <command>
 ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER %HOSTIP:%SOCKSPORT
 </command>
@@ -45,7 +46,7 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test565 b/third-party/curl/tests/data/test565
index 9d77990e47..432e4177e6 100644
--- a/third-party/curl/tests/data/test565
+++ b/third-party/curl/tests/data/test565
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ HTTP Digest auth
 chunked Transfer-Encoding
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 100 Continue
 Server: Microsoft-IIS/5.0
 Date: Sun, 03 Apr 2005 14:57:45 GMT
@@ -23,7 +23,7 @@ Content-Type: text/html; charset=iso-8859-1
 Content-Length: 0
 
 </data>
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 200 A OK
 Server: Microsoft-IIS/6.0
 Content-Type: text/html; charset=iso-8859-1
@@ -31,7 +31,7 @@ Content-Length: 3
 
 ok
 </data1>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 100 Continue
 Server: Microsoft-IIS/5.0
 Date: Sun, 03 Apr 2005 14:57:45 GMT
@@ -60,24 +60,24 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
 # tool is what to use instead of 'curl'
 <tool>
-lib%TESTNUMBER
+lib510
 </tool>
 
- <name>
+<name>
 send HTTP POST using read callback, chunked transfer-encoding and Digest
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
@@ -100,11 +100,7 @@ one
 two
 5
 three
-%if hyper
-1D
-%else
 1d
-%endif
 and a final longer crap: four
 0
 
diff --git a/third-party/curl/tests/data/test566 b/third-party/curl/tests/data/test566
index 9c1f9908dc..993ba79635 100644
--- a/third-party/curl/tests/data/test566
+++ b/third-party/curl/tests/data/test566
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,9 @@ HTTP
 HTTP GET
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -33,21 +33,20 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 HTTP GET with CURLINFO_CONTENT_LENGTH_DOWNLOAD and 0 bytes transfer
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER %LOGDIR/ip%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <file name="%LOGDIR/ip%TESTNUMBER">
 CL 0
 </file>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test567 b/third-party/curl/tests/data/test567
index 8083c10aee..756e8d438e 100644
--- a/third-party/curl/tests/data/test567
+++ b/third-party/curl/tests/data/test567
@@ -1,6 +1,5 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
-
-#Informational
 <info>
 <keywords>
 RTSP
@@ -10,12 +9,13 @@ OPTIONS
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 RTSP/1.0 200 OK
 Server: RTSPD/libcurl-test
 CSeq: 1
 Public: DESCRIBE, OPTIONS, SETUP, TEARDOWN, PLAY, PAUSE
 Curl-Private: swsclose
+
 </data>
 </reply>
 
@@ -37,7 +37,7 @@ rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 OPTIONS rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER RTSP/1.0
 CSeq: 1
 User-Agent: test%TESTNUMBER
diff --git a/third-party/curl/tests/data/test568 b/third-party/curl/tests/data/test568
index 8e272cfb06..07b610dcc6 100644
--- a/third-party/curl/tests/data/test568
+++ b/third-party/curl/tests/data/test568
@@ -1,6 +1,5 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
-
-#Informational
 <info>
 <keywords>
 RTSP
@@ -10,7 +9,7 @@ ANNOUNCE
 
 # Server-side
 <reply>
-<data1>
+<data1 crlf="headers">
 RTSP/1.0 200 OK
 Server: RTSPD/libcurl-test
 Cseq: 1
@@ -18,24 +17,24 @@ Cseq: 1
 </data1>
 
 <data2>
-RTSP/1.0 200 OK
-Server: RTSPD/libcurl-test
-Cseq: 2
-Content-Length: 70
-Content-Type: application/sdp
-
+RTSP/1.0 200 OK%CR
+Server: RTSPD/libcurl-test%CR
+Cseq: 2%CR
+Content-Length: 70%CR
+Content-Type: application/sdp%CR
+%CR
 v=0
 s=rtspd SDP
 i=A fake SDP reply
 u=http://www.curl.example.com/fakesdp.ps
 </data2>
-<data3>
+<data3 crlf="headers">
 RTSP/1.0 200 Okie Dokie
 Server: RTSPD/libcurl-test
 Cseq: 3
 
 </data3>
-<data4>
+<data4 crlf="headers">
 RTSP/1.0 200 OK
 Server: RTSPD/libcurl-test
 CSeq: 4
@@ -66,8 +65,8 @@ v=0
 o=mhandley 2890844526 2890845468 IN IP4 126.16.64.4
 s=SDP Seminar
 i=A Seminar on the session description protocol
-u=http://www.cs.ucl.ac.uk/staff/M.Handley/sdp.03.ps
-e=mjh@isi.edu (Mark Handley)
+u=something something something something something
+e=once upon the time we knew
 c=IN IP4 224.2.17.12/127
 t=2873397496 2873404696
 a=recvonly
@@ -80,7 +79,7 @@ m=video 2232 RTP/AVP 31
 <strip>
 ^If-Modified-Since:.*
 </strip>
-<protocol>
+<protocol crlf="headers">
 ANNOUNCE rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER0001 RTSP/1.0
 CSeq: 1
 Content-Length: 306
@@ -90,8 +89,8 @@ v=0
 o=mhandley 2890844526 2890845468 IN IP4 126.16.64.4
 s=SDP Seminar
 i=A Seminar on the session description protocol
-u=http://www.cs.ucl.ac.uk/staff/M.Handley/sdp.03.ps
-e=mjh@isi.edu (Mark Handley)
+u=something something something something something
+e=once upon the time we knew
 c=IN IP4 224.2.17.12/127
 t=2873397496 2873404696
 a=recvonly
@@ -106,7 +105,7 @@ CSeq: 3
 Content-Type: posty goodness
 Content-Length: 35
 
-postyfield=postystuff&project=curl
+postyfield=postystuff%AMPproject=curl
 OPTIONS rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER0004 RTSP/1.0
 CSeq: 4
 
diff --git a/third-party/curl/tests/data/test569 b/third-party/curl/tests/data/test569
index a35881a855..1e6ec7c00f 100644
--- a/third-party/curl/tests/data/test569
+++ b/third-party/curl/tests/data/test569
@@ -1,6 +1,5 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
-
-#Informational
 <info>
 <keywords>
 RTSP
@@ -74,7 +73,7 @@ rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER %LOGDIR/idfile%TESTNUMBER.txt
 <strip>
 ^If-Modified-Since:.*
 </strip>
-<protocol>
+<protocol crlf="yes">
 SETUP rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER0001 RTSP/1.0
 CSeq: 1
 Transport: Fake/NotReal/JustATest;foo=baz
diff --git a/third-party/curl/tests/data/test57 b/third-party/curl/tests/data/test57
index e14000726c..34c61b06b4 100644
--- a/third-party/curl/tests/data/test57
+++ b/third-party/curl/tests/data/test57
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,7 +13,7 @@ HTTP GET
 <data nocheck="yes">
 HTTP/1.1 200 OK swsclose
 Funny-head: yesyes
-Content-Type: text/html; charset=ISO-8859-4   
+Content-Type: text/html; charset=ISO-8859-4%repeat[3 x  ]%
 
 </data>
 </reply>
@@ -22,10 +23,10 @@ Content-Type: text/html; charset=ISO-8859-4
 <server>
 http
 </server>
- <name>
+<name>
 HTTP content-type with spaces in
- </name>
- <command>
+</name>
+<command>
 -w "%{content_type}\n" http://%HOSTIP:%HTTPPORT/%TESTNUMBER -o %LOGDIR/out%TESTNUMBER
 </command>
 </client>
@@ -35,7 +36,7 @@ HTTP content-type with spaces in
 <stdout mode="text">
 text/html; charset=ISO-8859-4
 </stdout>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test570 b/third-party/curl/tests/data/test570
index d1901b1efb..10739b071a 100644
--- a/third-party/curl/tests/data/test570
+++ b/third-party/curl/tests/data/test570
@@ -1,6 +1,5 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
-
-#Informational
 <info>
 <keywords>
 RTSP
@@ -10,7 +9,7 @@ Mismatch checking
 
 # Server-side
 <reply>
-<data1>
+<data1 crlf="headers">
 RTSP/1.0 200 OK
 Server: RTSPD/libcurl-test
 CSeq: 2
@@ -18,14 +17,14 @@ Public: DESCRIBE, OPTIONS, SETUP, TEARDOWN, PLAY, PAUSE
 Informational: CSeq Mismatch
 
 </data1>
-<data2>
+<data2 crlf="headers">
 RTSP/1.0 200 OK
 Server: RTSPD/libcurl-test
 Session: asdf
 CSeq: 999
 
 </data2>
-<data3>
+<data3 crlf="headers">
 RTSP/1.0 200 OK
 Server: RTSPD/libcurl-test
 Session: asdfWRONG
@@ -58,7 +57,7 @@ rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER
 <strip>
 ^If-Modified-Since:.*
 </strip>
-<protocol>
+<protocol crlf="yes">
 OPTIONS rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER0001 RTSP/1.0
 CSeq: 1
 
diff --git a/third-party/curl/tests/data/test571 b/third-party/curl/tests/data/test571
index a3032885a4..258ee6ae68 100644
--- a/third-party/curl/tests/data/test571
+++ b/third-party/curl/tests/data/test571
@@ -1,10 +1,9 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
-
-# Informational
 # Bang on RTP by
-#   1) giving an evil payload (with $)
-#   2) Giving evil content (SDP starting with $)
-#   3) packing rtp after headers, after content, and at the start
+# 1. giving an evil payload (with $)
+# 2. Giving evil content (SDP starting with $)
+# 3. packing rtp after headers, after content, and at the start
 <info>
 <keywords>
 RTSP
@@ -14,7 +13,7 @@ RTP
 
 # Server-side
 <reply>
-<data1>
+<data1 crlf="headers">
 RTSP/1.0 200 OK
 Server: RTSPD/libcurl-test
 Session: asdf
@@ -23,7 +22,7 @@ Transport: RTP/AVP/TCP;unicast;interleaved=0-1
 
 </data1>
 
-<data2>
+<data2 crlf="headers">
 RTSP/1.0 200 OK
 Server: RTSPD/libcurl-test
 CSeq: 2
@@ -31,7 +30,7 @@ Session: asdf
 
 </data2>
 
-<data3>
+<data3 crlf="headers">
 RTSP/1.0 200 OK
 Server: RTSPD/libcurl-test
 Cseq: 3
@@ -41,7 +40,7 @@ Content-Type: fake/evil
 $99
 </data3>
 
-<data4>
+<data4 crlf="headers">
 RTSP/1.0 200 OK
 Server: RTSPD/libcurl-test
 Session: asdf
diff --git a/third-party/curl/tests/data/test572 b/third-party/curl/tests/data/test572
index 0d2c38991d..7f887f6b98 100644
--- a/third-party/curl/tests/data/test572
+++ b/third-party/curl/tests/data/test572
@@ -1,6 +1,5 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
-
-#Informational
 <info>
 <keywords>
 RTSP
@@ -10,7 +9,7 @@ GET_PARAMETER
 
 # Server-side
 <reply>
-<data1>
+<data1 crlf="headers">
 RTSP/1.0 200 OK
 Server: RTSPD/libcurl-test
 Session: getparams-test
@@ -18,7 +17,7 @@ CSeq: 1
 
 </data1>
 
-<data2>
+<data2 crlf="headers">
 RTSP/1.0 200 OK
 Server: RTSPD/libcurl-test
 Session: getparams-test
@@ -31,7 +30,7 @@ speed=ludicrous
 
 </data2>
 
-<data3>
+<data3 crlf="headers">
 RTSP/1.0 204 OK
 Server: RTSPD/libcurl-test
 Session: getparams-test
@@ -39,7 +38,7 @@ Cseq: 3
 
 </data3>
 
-<data4>
+<data4 crlf="headers">
 RTSP/1.0 200 Okie Dokie
 Server: RTSPD/libcurl-test
 Session: getparams-test
@@ -49,7 +48,7 @@ Content-Length: 37
 packets_received: 1000
 jitter: 0.314
 </data4>
-<data5>
+<data5 crlf="headers">
 RTSP/1.0 200 OK
 Server: RTSPD/libcurl-test
 Session: getparams-test
@@ -86,7 +85,7 @@ speed
 <strip>
 ^If-Modified-Since:.*
 </strip>
-<protocol>
+<protocol crlf="headers">
 SETUP rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER0001 RTSP/1.0
 CSeq: 1
 Transport: Planes/Trains/Automobiles
diff --git a/third-party/curl/tests/data/test573 b/third-party/curl/tests/data/test573
index 632cff24d2..24c674dd93 100644
--- a/third-party/curl/tests/data/test573
+++ b/third-party/curl/tests/data/test573
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ multi
 flaky
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -35,17 +35,17 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 verify connect time with multi interface
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test574 b/third-party/curl/tests/data/test574
index 0e9a0b3340..6681bfaa25 100644
--- a/third-party/curl/tests/data/test574
+++ b/third-party/curl/tests/data/test574
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,12 +10,8 @@ ftplistparser
 </keywords>
 </info>
 
-#
 # Server-side
-<reply>
-<data mode="text">
-</data>
-</reply>
+# Data is generated by the ftp server itself
 
 # Client-side
 <client>
@@ -39,7 +36,7 @@ ftp://%HOSTIP:%FTPPORT/fully_simulated/UNIX/*.txt
 0
 </errorcode>
 # THERE SHOULD NOT BE "SIZE"! and one "USER/PASS"
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -61,9 +58,6 @@ EPSV
 RETR file.txt
 EPSV
 RETR someothertext.txt
-CWD /
-CWD fully_simulated
-CWD UNIX
 EPSV
 TYPE A
 LIST
diff --git a/third-party/curl/tests/data/test575 b/third-party/curl/tests/data/test575
index 981ed282b9..2f4cf3c6bb 100644
--- a/third-party/curl/tests/data/test575
+++ b/third-party/curl/tests/data/test575
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -23,10 +24,10 @@ ftp
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 FTP wildcard download - dup_handle and multi interface
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/fully_simulated/UNIX/*
 </command>
 </client>
@@ -35,7 +36,7 @@ ftp://%HOSTIP:%FTPPORT/fully_simulated/UNIX/*
 <errorcode>
 0
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
@@ -57,9 +58,6 @@ EPSV
 RETR file.txt
 EPSV
 RETR someothertext.txt
-CWD /
-CWD fully_simulated
-CWD UNIX
 EPSV
 TYPE A
 LIST
@@ -117,5 +115,8 @@ This file should have permissions 777
 This is content of file "file.txt"
 Some junk ;-) This file does not really exist.
 </stdout>
+<limits>
+Allocations: 1500
+</limits>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test576 b/third-party/curl/tests/data/test576
index 2a1b9419cf..7ea0107765 100644
--- a/third-party/curl/tests/data/test576
+++ b/third-party/curl/tests/data/test576
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -21,10 +22,10 @@ ftp
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
-FTP wildcard download - skip/parser_correctness/CURLOPT_FNMATCH_FUNCTION (Unix)
- </name>
- <command>
+<name>
+FTP wildcard - skip/parser_correctness/CURLOPT_FNMATCH_FUNCTION (Unix)
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/fully_simulated/UNIX/*
 </command>
 </client>
diff --git a/third-party/curl/tests/data/test577 b/third-party/curl/tests/data/test577
index f2a814ba9a..5016e1b0d2 100644
--- a/third-party/curl/tests/data/test577
+++ b/third-party/curl/tests/data/test577
@@ -1,6 +1,5 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
-
-#Informational
 <info>
 <keywords>
 RTSP
@@ -10,7 +9,7 @@ OPTIONS
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 RTSP/1.1234567 200 OK
 Server: RTSPD/libcurl-test
 CSeq: 1
@@ -39,7 +38,7 @@ rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 OPTIONS rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER RTSP/1.0
 CSeq: 1
 User-Agent: test567
diff --git a/third-party/curl/tests/data/test578 b/third-party/curl/tests/data/test578
index 5c06b24725..f3768cab12 100644
--- a/third-party/curl/tests/data/test578
+++ b/third-party/curl/tests/data/test578
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,9 @@ HTTP
 HTTP POST
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -34,15 +34,14 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 HTTP POST lower than MAX_INITIAL_POST_SIZE with progress callback
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER %LOGDIR/ip%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <file name="%LOGDIR/ip%TESTNUMBER">
diff --git a/third-party/curl/tests/data/test579 b/third-party/curl/tests/data/test579
index 58b0538c5b..1272239500 100644
--- a/third-party/curl/tests/data/test579
+++ b/third-party/curl/tests/data/test579
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ HTTP POST
 HTTP Digest auth
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 100 Continue
 Server: Microsoft-IIS/5.0
 Date: Sun, 03 Apr 2005 14:57:45 GMT
@@ -22,7 +22,7 @@ Content-Type: text/html; charset=iso-8859-1
 Content-Length: 0
 
 </data>
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 200 A OK
 Server: Microsoft-IIS/6.0
 Content-Type: text/html; charset=iso-8859-1
@@ -30,7 +30,7 @@ Content-Length: 3
 
 ok
 </data1>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 100 Continue
 Server: Microsoft-IIS/5.0
 Date: Sun, 03 Apr 2005 14:57:45 GMT
@@ -58,30 +58,28 @@ http
 </server>
 <features>
 crypto
+digest
 </features>
 # tool is what to use instead of 'curl'
 <tool>
 lib%TESTNUMBER
 </tool>
 
- <name>
-small chunked HTTP POSTs with digest auth. and progress callback
- </name>
- <command>
+<name>
+small chunked HTTP POSTs with digest auth and progress callback
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER %LOGDIR/ip%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <file name="%LOGDIR/ip%TESTNUMBER">
-Progress callback called with UL 0 out of 0
-Progress callback called with UL 8 out of 0
-Progress callback called with UL 16 out of 0
-Progress callback called with UL 26 out of 0
-Progress callback called with UL 61 out of 0
-Progress callback called with UL 66 out of 0
+Progress: start UL 0/0
+Progress: end UL 5/0
+Progress: start UL 0/0
+Progress: end UL 66/0
 </file>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test58 b/third-party/curl/tests/data/test58
index d24ee2ad6c..6126f1a349 100644
--- a/third-party/curl/tests/data/test58
+++ b/third-party/curl/tests/data/test58
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -25,7 +26,7 @@ http
 <name>
 HTTP PUT from file with weird letters
 </name>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/ -T %LOGDIR/%TESTNUMBERte[]st.txt -g
 </command>
 <file name="%LOGDIR/%TESTNUMBERte[]st.txt">
@@ -35,8 +36,8 @@ a few bytes
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-PUT /we/want/%TESTNUMBERte%5b%5dst.txt HTTP/1.1
+<protocol crlf="headers">
+PUT /we/want/%TESTNUMBERte%5B%5Dst.txt HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
diff --git a/third-party/curl/tests/data/test580 b/third-party/curl/tests/data/test580
index a14b4013b7..da043e8125 100644
--- a/third-party/curl/tests/data/test580
+++ b/third-party/curl/tests/data/test580
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ Duplicate-header
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 302 eat this!
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -20,6 +21,14 @@ Connection: close
 Location: and there's a second one too! / moo.html
 
 </data>
+<datacheck crlf="headers">
+HTTP/1.1 302 eat this!
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Location: this-is-the-first.html
+Content-Length: 0
+Connection: close
+</datacheck>
 </reply>
 
 # Client-side
@@ -35,21 +44,24 @@ http
 lib507
 </tool>
 
- <name>
+<name>
 multi interface, multiple Location: headers
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
 
 </protocol>
+<errorcode>
+8
+</errorcode>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test581 b/third-party/curl/tests/data/test581
index 8e2d0d0b89..818ee7149e 100644
--- a/third-party/curl/tests/data/test581
+++ b/third-party/curl/tests/data/test581
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ Duplicate-header
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 all good!
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -35,17 +36,17 @@ http
 lib507
 </tool>
 
- <name>
+<name>
 multi interface, multiple Content-Type: headers
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test582 b/third-party/curl/tests/data/test582
index f626d0bab8..ca533b8c4b 100644
--- a/third-party/curl/tests/data/test582
+++ b/third-party/curl/tests/data/test582
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -20,11 +21,11 @@ sftp
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 SFTP upload using multi interface
- </name>
- <command>
-Sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/upload%TESTNUMBER.txt %PWD/%LOGDIR/file%TESTNUMBER.txt %USER: %LOGDIR/server/curl_client_key.pub %LOGDIR/server/curl_client_key
+</name>
+<command>
+Sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/upload%TESTNUMBER.txt %PWD/%LOGDIR/file%TESTNUMBER.txt %USER: %LOGDIR/server/curl_client_key.pub %LOGDIR/server/curl_client_key
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Moooooooooooo
@@ -34,13 +35,6 @@ Moooooooooooo
 
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
-<strip>
-</strip>
-<protocol>
-</protocol>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Moooooooooooo
  upload this
diff --git a/third-party/curl/tests/data/test583 b/third-party/curl/tests/data/test583
index 51e435c005..8428d31395 100644
--- a/third-party/curl/tests/data/test583
+++ b/third-party/curl/tests/data/test583
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -20,24 +21,21 @@ sftp
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 SFTP with multi interface, remove handle early
- </name>
+</name>
 
-# The command here uses 'localhost' just to make sure that curl_multi_perform
-# won't reach too far in the first invoke. When using c-ares at least, the
-# name resolve will cause it to return rather quickly and thus we could trigger
-# the problem we're looking to verify.
- <command>
-sftp://localhost:%SSHPORT%SSH_PWD/%LOGDIR/upload%TESTNUMBER.txt %USER: %LOGDIR/server/curl_client_key.pub %LOGDIR/server/curl_client_key
+# The command here uses 'localhost' to make sure that curl_multi_perform
+# does not reach too far in the first invoke. When using c-ares at least, the
+# name resolve causes it to return rather quickly and thus we could trigger
+# the problem we are looking to verify.
+<command>
+sftp://localhost:%SSHPORT%SFTP_PWD/%LOGDIR/upload%TESTNUMBER.txt %USER: %LOGDIR/server/curl_client_key.pub %LOGDIR/server/curl_client_key
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 <errorcode>
 0
 </errorcode>
diff --git a/third-party/curl/tests/data/test584 b/third-party/curl/tests/data/test584
index d68d4484bc..563481edb5 100644
--- a/third-party/curl/tests/data/test584
+++ b/third-party/curl/tests/data/test584
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ HTTP MIME
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -18,7 +18,7 @@ Content-Length: 3
 
 OK
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -44,29 +44,28 @@ http
 </server>
 # tool to invoke
 <tool>
-lib%TESTNUMBER
+lib589
 </tool>
 
- <name>
+<name>
 CURLOPT_MIMEPOST first set then set to NULL
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/--------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=------------------------/
+s/^--------------------------[A-Za-z0-9]*/--------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=------------------------/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
-Content-Length: 144
+Content-Length: 156
 Content-Type: multipart/form-data; boundary=------------------------
 
 --------------------------
diff --git a/third-party/curl/tests/data/test585 b/third-party/curl/tests/data/test585
index 8c5af43590..bd5c569a8a 100644
--- a/third-party/curl/tests/data/test585
+++ b/third-party/curl/tests/data/test585
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ CURLOPT_CLOSESOCKETFUNCTION
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 302 eat this!
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -22,13 +23,13 @@ Connection: close
 </data>
 <datacheck>
 [OPEN] counter: 1
-HTTP/1.1 302 eat this!
-Date: Tue, 09 Nov 2010 14:49:00 GMT
-Server: test-server/fake
-Location: this-is-the-first.html
-Content-Length: 0
-Connection: close
-
+HTTP/1.1 302 eat this!%CR
+Date: Tue, 09 Nov 2010 14:49:00 GMT%CR
+Server: test-server/fake%CR
+Location: this-is-the-first.html%CR
+Content-Length: 0%CR
+Connection: close%CR
+%CR
 [CLOSE] counter: 1
 </datacheck>
 </reply>
@@ -43,20 +44,20 @@ http
 </features>
 # tool is what to use instead of 'curl'
 <tool>
-lib%TESTNUMBER
+lib500
 </tool>
 
- <name>
+<name>
 socket open/close callbacks
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test586 b/third-party/curl/tests/data/test586
index c8946a3607..d0da079c98 100644
--- a/third-party/curl/tests/data/test586
+++ b/third-party/curl/tests/data/test586
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ PASV
 CURLOPT_PORT
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -25,27 +25,25 @@ last line
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 ftp
 </server>
 <tool>
-lib585
+lib500
 </tool>
- <name>
+<name>
 FTP and open/close socket callbacks
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test587 b/third-party/curl/tests/data/test587
index 1abcb8ec46..74dbfe3b8f 100644
--- a/third-party/curl/tests/data/test587
+++ b/third-party/curl/tests/data/test587
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ flaky
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -25,35 +25,21 @@ http
 </server>
 # tool is what to use instead of 'curl'
 <tool>
-lib%TESTNUMBER
+lib554
 </tool>
 
- <name>
+<name>
 HTTP multi-part formpost with aborted read callback
- </name>
- <command>
+</name>
+# Add a delay to give server time to write its output since we otherwise might
+# not even give it enough time to write its lock file.
+<command delay="1">
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
-</strippart>
-<protocol>
-POST /%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-Accept: */*
-Content-Length: 744
-Content-Type: multipart/form-data; boundary=----------------------------
-
-------------------------------
-Content-Disposition: form-data; name="sendfile"; filename="postit2.c"
-
-</protocol>
 # CURLE_ABORTED_BY_CALLBACK (42)
 <errorcode>
 42
diff --git a/third-party/curl/tests/data/test588 b/third-party/curl/tests/data/test588
index d7250e394b..da0bceba77 100644
--- a/third-party/curl/tests/data/test588
+++ b/third-party/curl/tests/data/test588
@@ -1,9 +1,8 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
-#
 # This test is exactly like 525 but the server rejects the EPRT command.
-# Written up to make sure that there's nothing in the multi interface
+# Written up to make sure that there is nothing in the multi interface
 # active connection case that differs between PORT and EPRT use
-#
 <info>
 <keywords>
 FTP
@@ -31,10 +30,10 @@ ftp
 <tool>
 lib525
 </tool>
- <name>
-FTP PORT upload using multi interface, EPRT doesn't work
- </name>
- <command>
+<name>
+FTP PORT upload using multi interface, EPRT does not work
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER %LOGDIR/upload%TESTNUMBER
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
@@ -47,10 +46,10 @@ Moooooooooooo
 <verify>
 # Strip off parts of the PORT and EPRT commands that might differ
 <strippart>
-s/^PORT (.*)/PORT/
-s/^EPRT \|1\|(.*)/EPRT \|1\|/
+s/^EPRT \|1\|(\S*)/EPRT \|1\|/
+s/^PORT (\S*)/PORT/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test589 b/third-party/curl/tests/data/test589
index fd486c7bd9..949e5b6f71 100644
--- a/third-party/curl/tests/data/test589
+++ b/third-party/curl/tests/data/test589
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ HTTP MIME
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -33,18 +33,17 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 make an HTTP MIME POST set to NULL
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test59 b/third-party/curl/tests/data/test59
index dcac81d935..690f38e6ce 100644
--- a/third-party/curl/tests/data/test59
+++ b/third-party/curl/tests/data/test59
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ HTTP
 HTTP GET
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -13,28 +13,26 @@ HTTP/1.0 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
 
-hej 
+hej
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP URL with slash but with "parameter"
- </name>
- <command>
+</name>
+<command>
 "http://%HOSTIP:%HTTPPORT?mooo/%TESTNUMBER"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /?mooo/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test590 b/third-party/curl/tests/data/test590
index 243610efa8..8d8400845e 100644
--- a/third-party/curl/tests/data/test590
+++ b/third-party/curl/tests/data/test590
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,7 +13,7 @@ NTLM
 # Server-side
 <reply>
 
-<data>
+<data crlf="headers">
 HTTP/1.1 407 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Proxy-Authenticate: Negotiate
@@ -24,7 +25,7 @@ This is not the real page
 </data>
 
 # this is returned first since we get no proxy-auth
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me my dear
 Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
 Content-Length: 34
@@ -34,7 +35,7 @@ Hey you, authenticate or go away!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 200 Things are fine in proxy land swsclose
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -43,7 +44,7 @@ Content-Length: 42
 Contents of that page you requested, sir.
 </data1002>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 407 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Proxy-Authenticate: Negotiate
@@ -90,7 +91,7 @@ http://test.remote.example.com/path/%TESTNUMBER http://%HOSTIP:%HTTPPORT
 # Verify data after the test has been "shot"
 <verify>
 
-<protocol>
+<protocol crlf="headers">
 GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
 Host: test.remote.example.com
 Accept: */*
@@ -98,7 +99,7 @@ Proxy-Connection: Keep-Alive
 
 GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
 Host: test.remote.example.com
-Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Proxy-Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 Accept: */*
 Proxy-Connection: Keep-Alive
 
diff --git a/third-party/curl/tests/data/test591 b/third-party/curl/tests/data/test591
index 6b1dd004c4..fbcd1b9426 100644
--- a/third-party/curl/tests/data/test591
+++ b/third-party/curl/tests/data/test591
@@ -1,9 +1,8 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
-#
 # For this test the server rejects the EPRT command,
 # code in lib%TESTNUMBER makes use of curl_multi_timeout()
 # and server does not establish data connection.
-#
 <info>
 <keywords>
 FTP
@@ -33,10 +32,10 @@ ftp
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 FTP multi PORT and 425 on upload
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER %FTPTIME2 %LOGDIR/upload%TESTNUMBER
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
@@ -49,10 +48,10 @@ Moooooooooooo for %TESTNUMBER
 <verify>
 # Strip off parts of the PORT and EPRT commands that might differ
 <strippart>
-s/^PORT (.*)/PORT/
-s/^EPRT \|1\|(.*)/EPRT \|1\|/
+s/^PORT (\S*)/PORT/
+s/^EPRT \|1\|(\S*)/EPRT \|1\|/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test592 b/third-party/curl/tests/data/test592
index 299bde5bd9..5ef624ae1b 100644
--- a/third-party/curl/tests/data/test592
+++ b/third-party/curl/tests/data/test592
@@ -1,9 +1,8 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
-#
 # For this test the server rejects the EPRT command,
 # code in lib591 makes use of curl_multi_timeout()
 # and server does not establish data connection.
-#
 <info>
 <keywords>
 FTP
@@ -33,10 +32,10 @@ ftp
 <tool>
 lib591
 </tool>
- <name>
+<name>
 FTP multi PORT and 421 on upload
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER %FTPTIME2 %LOGDIR/upload%TESTNUMBER
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
@@ -49,11 +48,11 @@ Moooooooooooo for %TESTNUMBER
 <verify>
 # Strip off parts of the PORT and EPRT commands that might differ
 <strippart>
-s/^PORT (.*)/PORT/
-s/^EPRT \|1\|(.*)/EPRT \|1\|/
+s/^PORT (\S*)/PORT/
+s/^EPRT \|1\|(\S*)/EPRT \|1\|/
 </strippart>
 # a 421 response must prevent further commands from being sent
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test593 b/third-party/curl/tests/data/test593
index d518ab4428..cb45d7b8d5 100644
--- a/third-party/curl/tests/data/test593
+++ b/third-party/curl/tests/data/test593
@@ -1,9 +1,8 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
-#
 # For this test the server rejects the EPRT command,
 # code in lib591 makes use of curl_multi_timeout()
 # and server does not establish data connection.
-#
 <info>
 <keywords>
 FTP
@@ -33,10 +32,10 @@ ftp
 <tool>
 lib591
 </tool>
- <name>
+<name>
 FTP multi PORT upload, no data conn and no transient neg. reply
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER %FTPTIME2 %LOGDIR/upload%TESTNUMBER
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
@@ -49,10 +48,10 @@ Moooooooooooo for %TESTNUMBER
 <verify>
 # Strip off parts of the PORT and EPRT commands that might differ
 <strippart>
-s/^PORT (.*)/PORT/
-s/^EPRT \|1\|(.*)/EPRT \|1\|/
+s/^PORT (\S*)/PORT/
+s/^EPRT \|1\|(\S*)/EPRT \|1\|/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test594 b/third-party/curl/tests/data/test594
index 30901d4506..aaa007cbde 100644
--- a/third-party/curl/tests/data/test594
+++ b/third-party/curl/tests/data/test594
@@ -1,9 +1,8 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
-#
 # For this test the server rejects the EPRT command,
 # code in lib591 makes use of curl_multi_timeout()
 # and server does not establish data connection.
-#
 <info>
 <keywords>
 FTP
@@ -13,7 +12,6 @@ multi
 EPRT refused
 NODATACONN
 timeout
-FAILURE
 </keywords>
 </info>
 
@@ -35,10 +33,10 @@ ftp
 <tool>
 lib591
 </tool>
- <name>
+<name>
 FTP multi PORT upload, no data conn and no positive prelim. reply
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER %FTPTIME2 %LOGDIR/upload%TESTNUMBER
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
@@ -51,10 +49,10 @@ Moooooooooooo for %TESTNUMBER
 <verify>
 # Strip off parts of the PORT and EPRT commands that might differ
 <strippart>
-s/^PORT (.*)/PORT/
-s/^EPRT \|1\|(.*)/EPRT \|1\|/
+s/^PORT (\S*)/PORT/
+s/^EPRT \|1\|(\S*)/EPRT \|1\|/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test595 b/third-party/curl/tests/data/test595
index 9ef54a4364..d29be62c76 100644
--- a/third-party/curl/tests/data/test595
+++ b/third-party/curl/tests/data/test595
@@ -1,13 +1,11 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
-#
 # This test is like 585 but uses passive FTP instead of HTTP
-#
 <info>
 <keywords>
 FTP
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -29,21 +27,20 @@ ftp
 </server>
 # tool is what to use instead of 'curl'
 <tool>
-lib585
+lib500
 </tool>
 
- <name>
+<name>
 verify close callbacks with passive FTP
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER %LOGDIR/ip%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test596 b/third-party/curl/tests/data/test596
index ce2125081d..4696aa900f 100644
--- a/third-party/curl/tests/data/test596
+++ b/third-party/curl/tests/data/test596
@@ -1,13 +1,11 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
-#
 # This test is like 585 but uses active FTP instead of HTTP
-#
 <info>
 <keywords>
 FTP
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -29,24 +27,23 @@ ftp
 </server>
 # tool is what to use instead of 'curl'
 <tool>
-lib585
+lib500
 </tool>
 
- <name>
+<name>
 verify close callbacks with active FTP
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER %LOGDIR/ip%TESTNUMBER activeftp
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^(EPRT \|1\|)(.*)/$1/
+s/^(EPRT \|1\|)(\S*)/$1/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test597 b/third-party/curl/tests/data/test597
index 13c076faff..d65afa7221 100644
--- a/third-party/curl/tests/data/test597
+++ b/third-party/curl/tests/data/test597
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -14,9 +15,9 @@ ftp
 <tool>
 lib%TESTNUMBER
 </tool>
- <name>
+<name>
 FTP connect only option
- </name>
+</name>
 
 <command>
 ftp://%HOSTIP:%FTPPORT
@@ -24,10 +25,9 @@ ftp://%HOSTIP:%FTPPORT
 
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test598 b/third-party/curl/tests/data/test598
index c6c2537d8b..73c5b82ece 100644
--- a/third-party/curl/tests/data/test598
+++ b/third-party/curl/tests/data/test598
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,10 +10,9 @@ CURLOPT_REFERER
 curl_easy_reset
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
@@ -23,7 +23,7 @@ Content-Type: text/html
 </data>
 
 # since the request runs twice
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
@@ -52,10 +52,10 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 curl_easy_reset with referer and other strings set
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 <features>
@@ -63,10 +63,9 @@ cookies
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: the-moo agent next generation
diff --git a/third-party/curl/tests/data/test599 b/third-party/curl/tests/data/test599
index 47377aa9ce..a8c883dc2d 100644
--- a/third-party/curl/tests/data/test599
+++ b/third-party/curl/tests/data/test599
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ HTTP POST
 chunked Transfer-Encoding
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 302 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -21,21 +21,21 @@ Content-Type: text/html
 -foo-
 </data>
 <data1>
-HTTP/1.1 200 OK
-Date: Tue, 09 Nov 2010 14:49:00 GMT
-Server: test-server/fake
-Transfer-Encoding: chunked
-Connection: close
-Content-Type: text/html
-
-32
+HTTP/1.1 200 OK%CR
+Date: Tue, 09 Nov 2010 14:49:00 GMT%CR
+Server: test-server/fake%CR
+Transfer-Encoding: chunked%CR
+Connection: close%CR
+Content-Type: text/html%CR
+%CR
+32%CR
 this data is slightly larger than the first piece
-
-0
-
+%CR
+0%CR
+%CR
 </data1>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 302 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -68,15 +68,14 @@ lib%TESTNUMBER
 
 # Bug 3510057 pointed out that when following a location to a larger chunked
 # encoded page, the first size would still be used in the progress callback
- <name>
+<name>
 HTTP GET with progress callback and redirects changing content sizes
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER %LOGDIR/ip%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <file name="%LOGDIR/ip%TESTNUMBER">
diff --git a/third-party/curl/tests/data/test6 b/third-party/curl/tests/data/test6
index 546d0692c4..5f1d096d26 100644
--- a/third-party/curl/tests/data/test6
+++ b/third-party/curl/tests/data/test6
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -25,10 +26,10 @@ swsclose: booo
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with simple cookie send
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER -b "name=contents;name2=content2" -b name3=content3
 </command>
 <features>
@@ -38,12 +39,12 @@ cookies
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Cookie: name=contents;name2=content2;name3=content3
+Cookie: name=contents;name2=content2; name3=content3
 
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test60 b/third-party/curl/tests/data/test60
index 85cfe42439..7cdbafbe15 100644
--- a/third-party/curl/tests/data/test60
+++ b/third-party/curl/tests/data/test60
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ chunked Transfer-Encoding
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.0 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -27,7 +28,7 @@ http
 <name>
 HTTP PUT from stdin with wrong content-length
 </name>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/bzz/%TESTNUMBER -T - -H "Content-Length: 1"
 </command>
 <stdin>
@@ -38,21 +39,19 @@ more than one byte
 # Verify data after the test has been "shot"
 <verify>
 <protocol>
-PUT /bzz/%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Transfer-Encoding: chunked
-%if !hyper
-Content-Length: 1
-%endif
-Expect: 100-continue
-
-13
+PUT /bzz/%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Transfer-Encoding: chunked%CR
+Content-Length: 1%CR
+Expect: 100-continue%CR
+%CR
+13%CR
 more than one byte
-
-0
-
+%CR
+0%CR
+%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test600 b/third-party/curl/tests/data/test600
index d110ad15a5..e0f2e612b5 100644
--- a/third-party/curl/tests/data/test600
+++ b/third-party/curl/tests/data/test600
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ SFTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -14,17 +14,16 @@ for ssh test
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP retrieval
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
@@ -32,11 +31,7 @@ for ssh test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test601 b/third-party/curl/tests/data/test601
index 73428decb6..2b8349b7aa 100644
--- a/third-party/curl/tests/data/test601
+++ b/third-party/curl/tests/data/test601
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ SCP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -14,17 +14,16 @@ for ssh test
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 scp
 </server>
- <name>
+<name>
 SCP retrieval
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: scp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: scp://%HOSTIP:%SSHPORT%SCP_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
@@ -32,11 +31,7 @@ for ssh test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test602 b/third-party/curl/tests/data/test602
index 2c89659789..e395e7a545 100644
--- a/third-party/curl/tests/data/test602
+++ b/third-party/curl/tests/data/test602
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,22 +7,20 @@ SFTP put
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP put
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -T %LOGDIR/file%TESTNUMBER.txt sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/upload.%TESTNUMBER --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -T %LOGDIR/file%TESTNUMBER.txt sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/upload.%TESTNUMBER --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
@@ -29,15 +28,11 @@ for ssh upload test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <upload>
 Test data
 for ssh upload test
 </upload>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test603 b/third-party/curl/tests/data/test603
index 7aa20a999d..74ac30d465 100644
--- a/third-party/curl/tests/data/test603
+++ b/third-party/curl/tests/data/test603
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,22 +7,20 @@ SCP upload
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 scp
 </server>
- <name>
+<name>
 SCP upload
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -T %LOGDIR/file%TESTNUMBER.txt scp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/upload.%TESTNUMBER --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -T %LOGDIR/file%TESTNUMBER.txt scp://%HOSTIP:%SSHPORT%SCP_PWD/%LOGDIR/upload.%TESTNUMBER --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
@@ -29,15 +28,11 @@ for ssh upload test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <upload>
 Test data
 for ssh upload test
 </upload>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test604 b/third-party/curl/tests/data/test604
index 14d79335d7..c901cb6fbf 100644
--- a/third-party/curl/tests/data/test604
+++ b/third-party/curl/tests/data/test604
@@ -1,31 +1,26 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SFTP
-FAILURE
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP retrieval of nonexistent file
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SSH_PWD/not-a-valid-file-moooo --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/not-a-valid-file-moooo --insecure
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 <errorcode>
 78
 </errorcode>
diff --git a/third-party/curl/tests/data/test605 b/third-party/curl/tests/data/test605
index 5c9a266748..ba708afeff 100644
--- a/third-party/curl/tests/data/test605
+++ b/third-party/curl/tests/data/test605
@@ -1,33 +1,28 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SCP
-FAILURE
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 scp
 </server>
- <name>
+<name>
 SCP retrieval of nonexistent file
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: scp://%HOSTIP:%SSHPORT%SSH_PWD/not-a-valid-file-moooo --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: scp://%HOSTIP:%SSHPORT%SCP_PWD/not-a-valid-file-moooo --insecure
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 78
 </errorcode>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test606 b/third-party/curl/tests/data/test606
index 92764118db..95e9f3d6b3 100644
--- a/third-party/curl/tests/data/test606
+++ b/third-party/curl/tests/data/test606
@@ -1,33 +1,28 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SFTP
-FAILURE
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP invalid user login
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u not-a-valid-user: sftp://%HOSTIP:%SSHPORT%SSH_PWD/not-a-valid-file-moooo --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u not-a-valid-user: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/not-a-valid-file-moooo --insecure
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 67
 </errorcode>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test607 b/third-party/curl/tests/data/test607
index 317f56b9cb..960cb0b2aa 100644
--- a/third-party/curl/tests/data/test607
+++ b/third-party/curl/tests/data/test607
@@ -1,33 +1,28 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SCP
-FAILURE
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 scp
 </server>
- <name>
+<name>
 SCP invalid user login
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u not-a-valid-user: scp://%HOSTIP:%SSHPORT%SSH_PWD/not-a-valid-file-moooo --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u not-a-valid-user: scp://%HOSTIP:%SSHPORT%SCP_PWD/not-a-valid-file-moooo --insecure
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 67
 </errorcode>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test608 b/third-party/curl/tests/data/test608
index 5b0bf19009..9e35595e76 100644
--- a/third-party/curl/tests/data/test608
+++ b/third-party/curl/tests/data/test608
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ post-quote
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -14,36 +14,31 @@ Test file for rename test
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
-SFTP post-quote rename
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -Q "-rename %PWD/%LOGDIR/file%TESTNUMBER.txt %PWD/%LOGDIR/file%TESTNUMBER-renamed.txt" sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
+<name>
+SFTP post-quote rename a file
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -Q "-rename %SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt %SFTP_PWD/%LOGDIR/file%TESTNUMBER-renamed.txt" sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
 </command>
 # Verify that the file was renamed properly, then rename the file back to what
 # it was so the verify section works and the file can be cleaned up.
-<postcheck>
-perl %SRCDIR/libtest/test610.pl gone %PWD/%LOGDIR/file%TESTNUMBER.txt move %PWD/%LOGDIR/file%TESTNUMBER-renamed.txt %PWD/%LOGDIR/file%TESTNUMBER.txt
-</postcheck>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test file for rename test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test file for rename test
 </file>
-<valgrind>
-disable
-</valgrind>
+<postcheck>
+%PERL %SRCDIR/libtest/test610.pl gone %PWD/%LOGDIR/file%TESTNUMBER.txt move %PWD/%LOGDIR/file%TESTNUMBER-renamed.txt %PWD/%LOGDIR/file%TESTNUMBER.txt
+</postcheck>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test609 b/third-party/curl/tests/data/test609
index 631aa62e0c..c5c7335f73 100644
--- a/third-party/curl/tests/data/test609
+++ b/third-party/curl/tests/data/test609
@@ -1,13 +1,12 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SFTP
 post-quote
-FAILURE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -15,31 +14,26 @@ Test file for mkdir test
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP post-quote mkdir failure
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -Q "-mkdir %PWD/%LOGDIR/file%TESTNUMBER.txt" sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -Q "-mkdir %SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt" sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test file for mkdir test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 21
 </errorcode>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test61 b/third-party/curl/tests/data/test61
index 0a21938f0e..6116f77ba2 100644
--- a/third-party/curl/tests/data/test61
+++ b/third-party/curl/tests/data/test61
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ httponly
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -40,16 +41,16 @@ boo
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with various cookies and custom Host:
- </name>
+</name>
 # Explicitly set the time zone to a known good one, in case the user is
 # using one of the 'right' zones that take into account leap seconds
 # which causes the cookie expiry times to be different.
 <setenv>
 TZ=GMT
 </setenv>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -c %LOGDIR/jar%TESTNUMBER.txt -H "Host: www.host.foo.com"
 </command>
 <features>
@@ -59,7 +60,7 @@ cookies
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/%TESTNUMBER HTTP/1.1
 Host: www.host.foo.com
 User-Agent: curl/%VERSION
@@ -71,13 +72,8 @@ Accept: */*
 # https://curl.se/docs/http-cookies.html
 # This file was generated by libcurl! Edit at your own risk.
 
-%if large-time
-.host.foo.com	TRUE	/we/want/	FALSE	17517902187	test2	yes
-#HttpOnly_.foo.com	TRUE	/we/want/	FALSE	17517902187	test	yes
-%else
-.host.foo.com	TRUE	/we/want/	FALSE	2118138987	test2	yes
-#HttpOnly_.foo.com	TRUE	/we/want/	FALSE	2118138987	test	yes
-%endif
+.host.foo.com	TRUE	/we/want	FALSE	%days[400]	test2	yes
+#HttpOnly_.foo.com	TRUE	/we/want	FALSE	%days[400]	test	yes
 </file>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test610 b/third-party/curl/tests/data/test610
index b3599a2f4f..35b092e8d1 100644
--- a/third-party/curl/tests/data/test610
+++ b/third-party/curl/tests/data/test610
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ post-quote
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -14,34 +14,29 @@ Dummy test file for rmdir test
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
 <precheck>
-perl %SRCDIR/libtest/test%TESTNUMBER.pl mkdir %PWD/%LOGDIR/test%TESTNUMBER.dir
+%PERL %SRCDIR/libtest/test%TESTNUMBER.pl mkdir %PWD/%LOGDIR/test%TESTNUMBER.dir
 </precheck>
- <name>
+<name>
 SFTP post-quote rmdir
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -Q "-rmdir %PWD/%LOGDIR/test%TESTNUMBER.dir" sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -Q "-rmdir %SFTP_PWD/%LOGDIR/test%TESTNUMBER.dir" sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
 </command>
-<postcheck>
-perl %SRCDIR/libtest/test%TESTNUMBER.pl gone %PWD/%LOGDIR/test%TESTNUMBER.dir
-</postcheck>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Dummy test file for rmdir test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
+<postcheck>
+%PERL %SRCDIR/libtest/test%TESTNUMBER.pl gone %PWD/%LOGDIR/test%TESTNUMBER.dir
+</postcheck>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test611 b/third-party/curl/tests/data/test611
index fd9f42fa0e..3de6009e52 100644
--- a/third-party/curl/tests/data/test611
+++ b/third-party/curl/tests/data/test611
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ post-quote
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -14,34 +14,29 @@ Dummy test file for rename test
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
 <precheck>
-perl %SRCDIR/libtest/test610.pl mkdir %PWD/%LOGDIR/test%TESTNUMBER.dir
+%PERL %SRCDIR/libtest/test610.pl mkdir %PWD/%LOGDIR/test%TESTNUMBER.dir
 </precheck>
- <name>
-SFTP post-quote rename
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -Q "-rename %PWD/%LOGDIR/test%TESTNUMBER.dir %PWD/%LOGDIR/test%TESTNUMBER.new" sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
+<name>
+SFTP post-quote rename a directory
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -Q "-rename %SFTP_PWD/%LOGDIR/test%TESTNUMBER.dir %SFTP_PWD/%LOGDIR/test%TESTNUMBER.new" sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
 </command>
-<postcheck>
-perl %SRCDIR/libtest/test610.pl rmdir %PWD/%LOGDIR/test%TESTNUMBER.new
-</postcheck>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Dummy test file for rename test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
+<postcheck>
+%PERL %SRCDIR/libtest/test610.pl rmdir %PWD/%LOGDIR/test%TESTNUMBER.new
+</postcheck>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test612 b/third-party/curl/tests/data/test612
index 37ffc5c6cd..8f82aa9b80 100644
--- a/third-party/curl/tests/data/test612
+++ b/third-party/curl/tests/data/test612
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ post-quote
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -14,34 +14,26 @@ Dummy test file for remove test
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP post-quote remove file
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -T %LOGDIR/file%TESTNUMBER.txt -Q "-rm %PWD/%LOGDIR/file%TESTNUMBER.txt" sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/upload.%TESTNUMBER  --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -T %LOGDIR/file%TESTNUMBER.txt -Q "-rm %SFTP_PWD/%LOGDIR/upload.%TESTNUMBER" sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/upload.%TESTNUMBER --insecure
 </command>
-<postcheck>
-perl %SRCDIR/libtest/test610.pl gone %PWD/%LOGDIR/test%TESTNUMBER.txt
-</postcheck>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Dummy test file for remove test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<upload>
-Dummy test file for remove test
-</upload>
-<valgrind>
-disable
-</valgrind>
+<postcheck>
+%PERL %SRCDIR/libtest/test610.pl gone %PWD/%LOGDIR/upload.%TESTNUMBER
+</postcheck>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test613 b/third-party/curl/tests/data/test613
index 8a57ec663d..2d9e929a3f 100644
--- a/third-party/curl/tests/data/test613
+++ b/third-party/curl/tests/data/test613
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,41 +7,36 @@ directory
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <datacheck>
 d?????????    N U         U               N ???  N NN:NN asubdir
--rw?rw?rw?    1 U         U              37 Jan  1  2000 plainfile.txt
--r-?r-?r-?    1 U         U              47 Dec 31  2000 rofile.txt
+-rw???????    1 U         U               0 Jan  1  2000 emptyfile.txt
+-rw???????    1 U         U              37 Jan  1  2000 plainfile.txt
+-r-???????    1 U         U              47 Dec 31  2000 rofile.txt
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
 <precheck>
-perl %SRCDIR/libtest/test%TESTNUMBER.pl prepare %PWD/%LOGDIR/test%TESTNUMBER.dir
+%PERL %SRCDIR/libtest/test%TESTNUMBER.pl prepare %PWD/%LOGDIR/test%TESTNUMBER.dir
 </precheck>
- <name>
+<name>
 SFTP directory retrieval
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/test%TESTNUMBER.dir/ --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/test%TESTNUMBER.dir/ --insecure
 </command>
-<postcheck>
-perl %SRCDIR/libtest/test%TESTNUMBER.pl postprocess %PWD/%LOGDIR/test%TESTNUMBER.dir %PWD/%LOGDIR/curl%TESTNUMBER.out
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
+<postcheck>
+%PERL %SRCDIR/libtest/test%TESTNUMBER.pl postprocess %PWD/%LOGDIR/test%TESTNUMBER.dir %PWD/%LOGDIR/curl%TESTNUMBER.out
+</postcheck>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test614 b/third-party/curl/tests/data/test614
index d7b45a459a..0e617b82e3 100644
--- a/third-party/curl/tests/data/test614
+++ b/third-party/curl/tests/data/test614
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,41 +8,36 @@ directory
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <datacheck>
 d?????????    N U         U               N ???  N NN:NN asubdir
--r-?r-?r-?    1 U         U              37 Jan  1  2000 plainfile.txt
--r-?r-?r-?    1 U         U              47 Dec 31  2000 rofile.txt
+-rw???????    1 U         U               0 Jan  1  2000 emptyfile.txt
+-r-???????    1 U         U              37 Jan  1  2000 plainfile.txt
+-r-???????    1 U         U              47 Dec 31  2000 rofile.txt
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
 <precheck>
-perl %SRCDIR/libtest/test613.pl prepare %PWD/%LOGDIR/test%TESTNUMBER.dir
+%PERL %SRCDIR/libtest/test613.pl prepare %PWD/%LOGDIR/test%TESTNUMBER.dir
 </precheck>
- <name>
+<name>
 SFTP pre-quote chmod
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -Q "chmod 444 %PWD/%LOGDIR/test%TESTNUMBER.dir/plainfile.txt" sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/test%TESTNUMBER.dir/ --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -Q "chmod 444 %SFTP_PWD/%LOGDIR/test%TESTNUMBER.dir/plainfile.txt" sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/test%TESTNUMBER.dir/ --insecure
 </command>
-<postcheck>
-perl %SRCDIR/libtest/test613.pl postprocess %PWD/%LOGDIR/test%TESTNUMBER.dir %PWD/%LOGDIR/curl%TESTNUMBER.out
-</postcheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
+<postcheck>
+%PERL %SRCDIR/libtest/test613.pl postprocess %PWD/%LOGDIR/test%TESTNUMBER.dir %PWD/%LOGDIR/curl%TESTNUMBER.out
+</postcheck>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test615 b/third-party/curl/tests/data/test615
index d2ed914a69..8e2a6760b7 100644
--- a/third-party/curl/tests/data/test615
+++ b/third-party/curl/tests/data/test615
@@ -1,44 +1,39 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SFTP
 SFTP put
-FAILURE
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
 <precheck>
-perl %SRCDIR/libtest/test613.pl prepare %PWD/%LOGDIR/test%TESTNUMBER.dir
+%PERL %SRCDIR/libtest/test613.pl prepare %PWD/%LOGDIR/test%TESTNUMBER.dir
 </precheck>
- <name>
+<name>
 SFTP put remote failure
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -T %LOGDIR/file%TESTNUMBER.txt sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/test%TESTNUMBER.dir/rofile.txt --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -T %LOGDIR/file%TESTNUMBER.txt sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/test%TESTNUMBER.dir/rofile.txt --insecure
 </command>
-<postcheck>
-perl %SRCDIR/libtest/test613.pl postprocess %PWD/%LOGDIR/test%TESTNUMBER.dir
-</postcheck>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
 for ssh upload test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 9
 </errorcode>
-<valgrind>
-disable
-</valgrind>
+<postcheck>
+%PERL %SRCDIR/libtest/test613.pl postprocess %PWD/%LOGDIR/test%TESTNUMBER.dir
+</postcheck>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test616 b/third-party/curl/tests/data/test616
index 570f1fa11e..1e26375684 100644
--- a/third-party/curl/tests/data/test616
+++ b/third-party/curl/tests/data/test616
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,34 +7,28 @@ zero-length
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data sendzero="yes">
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP retrieval of empty file
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test617 b/third-party/curl/tests/data/test617
index 05c2989b7e..e0b592c398 100644
--- a/third-party/curl/tests/data/test617
+++ b/third-party/curl/tests/data/test617
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,34 +7,28 @@ zero-length
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data sendzero="yes">
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 scp
 </server>
- <name>
+<name>
 SCP retrieval of empty file
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: scp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: scp://%HOSTIP:%SSHPORT%SCP_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test618 b/third-party/curl/tests/data/test618
index 1ffe464483..7262738025 100644
--- a/third-party/curl/tests/data/test618
+++ b/third-party/curl/tests/data/test618
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,17 +6,18 @@ SFTP
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP retrieval of two files
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER:
+sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt
+sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
@@ -23,12 +25,8 @@ for ssh test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 <stdout>
 Test data
 for ssh test
diff --git a/third-party/curl/tests/data/test619 b/third-party/curl/tests/data/test619
index 15309a2579..0b52c7102a 100644
--- a/third-party/curl/tests/data/test619
+++ b/third-party/curl/tests/data/test619
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,17 +6,18 @@ SCP
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 scp
 </server>
- <name>
+<name>
 SCP retrieval of two files
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: scp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt scp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER:
+scp://%HOSTIP:%SSHPORT%SCP_PWD/%LOGDIR/file%TESTNUMBER.txt
+scp://%HOSTIP:%SSHPORT%SCP_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
@@ -23,12 +25,8 @@ for ssh test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 <stdout>
 Test data
 for ssh test
diff --git a/third-party/curl/tests/data/test62 b/third-party/curl/tests/data/test62
index a78d08ba78..a5fa8d5906 100644
--- a/third-party/curl/tests/data/test62
+++ b/third-party/curl/tests/data/test62
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ httponly
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.0 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Type: text/html
@@ -25,11 +26,14 @@ boo
 <server>
 http
 </server>
- <name>
+<name>
 HTTP, send cookies when using custom Host:
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER?hoge=fuga -b %LOGDIR/jar%TESTNUMBER.txt -H "Host: www.host.foo.com"
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER
+http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER?hoge=fuga
+-b %LOGDIR/jar%TESTNUMBER.txt
+-H "Host: www.host.foo.com"
 </command>
 <file name="%LOGDIR/jar%TESTNUMBER.txt">
 # Netscape HTTP Cookie File
@@ -49,7 +53,7 @@ cookies
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/%TESTNUMBER HTTP/1.1
 Host: www.host.foo.com
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test620 b/third-party/curl/tests/data/test620
index 2dd3587346..8ed5784e2d 100644
--- a/third-party/curl/tests/data/test620
+++ b/third-party/curl/tests/data/test620
@@ -1,22 +1,21 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SFTP
-FAILURE
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP retrieval of missing file followed by good file
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/not-a-valid-file-moooo sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/not-a-valid-file-moooo sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
@@ -24,12 +23,8 @@ for ssh test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 <stdout>
 Test data
 for ssh test
diff --git a/third-party/curl/tests/data/test621 b/third-party/curl/tests/data/test621
index 0c65b13d03..d15974cbd6 100644
--- a/third-party/curl/tests/data/test621
+++ b/third-party/curl/tests/data/test621
@@ -1,22 +1,21 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SCP
-FAILURE
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 scp
 </server>
- <name>
+<name>
 SCP retrieval of missing file followed by good file
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: scp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/not-a-valid-file-moooo scp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: scp://%HOSTIP:%SSHPORT%SCP_PWD/%LOGDIR/not-a-valid-file-moooo scp://%HOSTIP:%SSHPORT%SCP_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
@@ -24,12 +23,8 @@ for ssh test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 <stdout>
 Test data
 for ssh test
diff --git a/third-party/curl/tests/data/test622 b/third-party/curl/tests/data/test622
index 530bd2207a..33a73dee03 100644
--- a/third-party/curl/tests/data/test622
+++ b/third-party/curl/tests/data/test622
@@ -1,28 +1,26 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SFTP
 SFTP put
-FAILURE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP put failure
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -T %LOGDIR/file%TESTNUMBER.txt sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/nonexistent-directory/nonexistent-file --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -T %LOGDIR/file%TESTNUMBER.txt sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/nonexistent-directory/nonexistent-file --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
@@ -30,14 +28,10 @@ for ssh upload test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 78
 </errorcode>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test623 b/third-party/curl/tests/data/test623
index 794a25118c..cbafe3811e 100644
--- a/third-party/curl/tests/data/test623
+++ b/third-party/curl/tests/data/test623
@@ -1,28 +1,26 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SCP
 SCP upload
-FAILURE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 scp
 </server>
- <name>
+<name>
 SCP upload failure
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -T %LOGDIR/file%TESTNUMBER.txt scp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/nonexistent-directory/nonexistent-file --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -T %LOGDIR/file%TESTNUMBER.txt scp://%HOSTIP:%SSHPORT%SCP_PWD/%LOGDIR/nonexistent-directory/nonexistent-file --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
@@ -30,12 +28,8 @@ for ssh upload test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 <errorcode>
 25
 </errorcode>
diff --git a/third-party/curl/tests/data/test624 b/third-party/curl/tests/data/test624
index fa7225d68b..ebec098889 100644
--- a/third-party/curl/tests/data/test624
+++ b/third-party/curl/tests/data/test624
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,41 +8,35 @@ SFTP put
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP put with --ftp-create-dirs
- </name>
- <command>
---ftp-create-dirs --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -T %LOGDIR/file%TESTNUMBER.txt sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/test%TESTNUMBER.dir/upload.%TESTNUMBER --insecure
+</name>
+<command>
+--ftp-create-dirs --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -T %LOGDIR/file%TESTNUMBER.txt sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/test%TESTNUMBER.dir/upload.%TESTNUMBER --insecure
 </command>
-<postcheck>
-perl %SRCDIR/libtest/test610.pl move %PWD/%LOGDIR/test%TESTNUMBER.dir/upload.%TESTNUMBER %PWD/%LOGDIR/upload.%TESTNUMBER rmdir %PWD/%LOGDIR/test%TESTNUMBER.dir
-</postcheck>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
 for ssh upload test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <upload>
 Test data
 for ssh upload test
 </upload>
-<valgrind>
-disable
-</valgrind>
+<postcheck>
+%PERL %SRCDIR/libtest/test610.pl move %PWD/%LOGDIR/test%TESTNUMBER.dir/upload.%TESTNUMBER %PWD/%LOGDIR/upload.%TESTNUMBER rmdir %PWD/%LOGDIR/test%TESTNUMBER.dir
+</postcheck>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test625 b/third-party/curl/tests/data/test625
index 6ca9f4ea7e..cab4a4c9ef 100644
--- a/third-party/curl/tests/data/test625
+++ b/third-party/curl/tests/data/test625
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,41 +8,38 @@ SFTP put
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP put with --ftp-create-dirs twice
- </name>
- <command>
---ftp-create-dirs --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -T %LOGDIR/file%TESTNUMBER.txt sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/test%TESTNUMBER.a/upload.%TESTNUMBER -T %LOGDIR/file%TESTNUMBER.txt sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/test%TESTNUMBER.b/upload.%TESTNUMBER --insecure
+</name>
+<command>
+--ftp-create-dirs
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER:
+-T %LOGDIR/file%TESTNUMBER.txt sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/test%TESTNUMBER.a/upload.%TESTNUMBER
+-T %LOGDIR/file%TESTNUMBER.txt sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/test%TESTNUMBER.b/upload.%TESTNUMBER --insecure
 </command>
-<postcheck>
-perl %SRCDIR/libtest/test610.pl move %PWD/%LOGDIR/test%TESTNUMBER.a/upload.%TESTNUMBER %PWD/%LOGDIR/upload.%TESTNUMBER rmdir %PWD/%LOGDIR/test%TESTNUMBER.a rm %PWD/%LOGDIR/test%TESTNUMBER.b/upload.%TESTNUMBER rmdir %PWD/%LOGDIR/test%TESTNUMBER.b
-</postcheck>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
 for ssh upload test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <upload>
 Test data
 for ssh upload test
 </upload>
-<valgrind>
-disable
-</valgrind>
+<postcheck>
+%PERL %SRCDIR/libtest/test610.pl move %PWD/%LOGDIR/test%TESTNUMBER.a/upload.%TESTNUMBER %PWD/%LOGDIR/upload.%TESTNUMBER rmdir %PWD/%LOGDIR/test%TESTNUMBER.a rm %PWD/%LOGDIR/test%TESTNUMBER.b/upload.%TESTNUMBER rmdir %PWD/%LOGDIR/test%TESTNUMBER.b
+</postcheck>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test626 b/third-party/curl/tests/data/test626
index 87b7944edc..2ec6f5d48b 100644
--- a/third-party/curl/tests/data/test626
+++ b/third-party/curl/tests/data/test626
@@ -1,42 +1,36 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SFTP
 pre-quote
-FAILURE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP invalid quote command
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -Q "invalid-command foo bar" sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -Q "invalid-command foo bar" sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test file for rename test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 21
 </errorcode>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test627 b/third-party/curl/tests/data/test627
index 98b563fc7f..a44e4ce06a 100644
--- a/third-party/curl/tests/data/test627
+++ b/third-party/curl/tests/data/test627
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,40 +8,32 @@ NOBODY
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data sendzero="yes">
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP quote remove file with NOBODY
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -I -Q "rm %PWD/%LOGDIR/file%TESTNUMBER.txt" sftp://%HOSTIP:%SSHPORT --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -I -Q "rm %SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt" sftp://%HOSTIP:%SSHPORT --insecure
 </command>
-<postcheck>
-perl %SRCDIR/libtest/test610.pl gone %PWD/%LOGDIR/test%TESTNUMBER.txt
-</postcheck>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Dummy test file for remove test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
-<protocol>
-</protocol>
+<postcheck>
+%PERL %SRCDIR/libtest/test610.pl gone %PWD/%LOGDIR/test%TESTNUMBER.txt
+</postcheck>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test628 b/third-party/curl/tests/data/test628
index 86c00f16d7..c343108e2d 100644
--- a/third-party/curl/tests/data/test628
+++ b/third-party/curl/tests/data/test628
@@ -1,33 +1,28 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SFTP
-FAILURE
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP invalid user login (password authentication)
- </name>
- <command>
--u not-a-valid-user: sftp://%HOSTIP:%SSHPORT%SSH_PWD/irrelevant-file  --insecure
+</name>
+<command>
+-u not-a-valid-user: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/irrelevant-file --insecure
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 67
 </errorcode>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test629 b/third-party/curl/tests/data/test629
index 07ac767ab2..2869517e8f 100644
--- a/third-party/curl/tests/data/test629
+++ b/third-party/curl/tests/data/test629
@@ -1,33 +1,28 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SCP
-FAILURE
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 scp
 </server>
- <name>
+<name>
 SCP invalid user login (password authentication)
- </name>
- <command>
--u not-a-valid-user: scp://%HOSTIP:%SSHPORT%SSH_PWD/irrelevant-file --insecure
+</name>
+<command>
+-u not-a-valid-user: scp://%HOSTIP:%SSHPORT%SCP_PWD/irrelevant-file --insecure
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 67
 </errorcode>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test63 b/third-party/curl/tests/data/test63
index 79eb6c5bbe..ad255419bb 100644
--- a/third-party/curl/tests/data/test63
+++ b/third-party/curl/tests/data/test63
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,11 +6,12 @@ HTTP
 HTTP GET
 HTTP proxy
 HTTP proxy Basic auth
+http_proxy
 </keywords>
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Type: text/html
@@ -24,13 +26,13 @@ the content would go here
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with proxy authorization set in environment
- </name>
+</name>
 <setenv>
 http_proxy=http://fake:user@%HOSTIP:%HTTPPORT/
 </setenv>
- <command>
+<command>
 http://we.want.that.site.com/%TESTNUMBER
 </command>
 <features>
@@ -40,10 +42,10 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://we.want.that.site.com/%TESTNUMBER HTTP/1.1
 Host: we.want.that.site.com
-Proxy-Authorization: Basic ZmFrZTp1c2Vy
+Proxy-Authorization: Basic %b64[fake:user]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test630 b/third-party/curl/tests/data/test630
index 0aed489aa9..e5e2fd8fa4 100644
--- a/third-party/curl/tests/data/test630
+++ b/third-party/curl/tests/data/test630
@@ -1,34 +1,29 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SFTP
-FAILURE
 server key check
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP incorrect host key
- </name>
- <command>
---hostpubmd5 00000000000000000000000000000000 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/irrelevant-file --insecure
+</name>
+<command>
+--hostpubmd5 00000000000000000000000000000000 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/irrelevant-file --insecure
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 60
 </errorcode>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test631 b/third-party/curl/tests/data/test631
index 4e0630724f..813c008e55 100644
--- a/third-party/curl/tests/data/test631
+++ b/third-party/curl/tests/data/test631
@@ -1,34 +1,29 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SCP
-FAILURE
 server key check
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 scp
 </server>
- <name>
+<name>
 SCP incorrect host key
- </name>
- <command>
---hostpubmd5 00000000000000000000000000000000 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: scp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/irrelevant-file --insecure
+</name>
+<command>
+--hostpubmd5 00000000000000000000000000000000 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: scp://%HOSTIP:%SSHPORT%SCP_PWD/%LOGDIR/irrelevant-file --insecure
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 60
 </errorcode>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test632 b/third-party/curl/tests/data/test632
index 8e3a913b04..1c67dff5d8 100644
--- a/third-party/curl/tests/data/test632
+++ b/third-party/curl/tests/data/test632
@@ -1,30 +1,25 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SFTP
-FAILURE
 server key check
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 sftp
 </features>
- <name>
+<name>
 SFTP syntactically invalid host key
- </name>
- <command>
---hostpubmd5 00 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%NOLISTENPORT%SSH_PWD/%LOGDIR/irrelevant-file --insecure
+</name>
+<command>
+--hostpubmd5 00 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%NOLISTENPORT%SFTP_PWD/%LOGDIR/irrelevant-file --insecure
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test633 b/third-party/curl/tests/data/test633
index df3403cc80..f2b7ef53c9 100644
--- a/third-party/curl/tests/data/test633
+++ b/third-party/curl/tests/data/test633
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ Range
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -14,17 +14,16 @@ data
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP retrieval with byte range
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt -r 5-9 --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt -r 5-9 --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
@@ -32,11 +31,7 @@ for ssh test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test634 b/third-party/curl/tests/data/test634
index 3ba7fc6715..5a5160937f 100644
--- a/third-party/curl/tests/data/test634
+++ b/third-party/curl/tests/data/test634
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ Range
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -15,17 +15,16 @@ for ssh test
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP retrieval with byte range past end of file
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt -r 5-99 --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt -r 5-99 --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
@@ -33,11 +32,7 @@ for ssh test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test635 b/third-party/curl/tests/data/test635
index 5cdf3420df..0fd6cb99d0 100644
--- a/third-party/curl/tests/data/test635
+++ b/third-party/curl/tests/data/test635
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ Range
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -14,17 +14,16 @@ ssh test
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP retrieval with byte range relative to end of file
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt -r -9 --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt -r -9 --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
@@ -32,11 +31,7 @@ for ssh test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test636 b/third-party/curl/tests/data/test636
index 8afa222f7e..2d0b6b2729 100644
--- a/third-party/curl/tests/data/test636
+++ b/third-party/curl/tests/data/test636
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ Range
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -15,17 +15,16 @@ for ssh test
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP retrieval with X- byte range
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt -r 5- --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt -r 5- --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
@@ -33,11 +32,7 @@ for ssh test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test637 b/third-party/curl/tests/data/test637
index 77d1ed9c6b..15361c7308 100644
--- a/third-party/curl/tests/data/test637
+++ b/third-party/curl/tests/data/test637
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,24 +7,22 @@ Range
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP retrieval with invalid X- range
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt -r 99- --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt -r 99- --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
@@ -31,14 +30,10 @@ for ssh test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
-36
+33
 </errorcode>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test638 b/third-party/curl/tests/data/test638
index 10b1b4ff97..d9e9c6b406 100644
--- a/third-party/curl/tests/data/test638
+++ b/third-party/curl/tests/data/test638
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ asterisk
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -16,34 +16,29 @@ Dummy test file for rename test
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
 <precheck>
-perl %SRCDIR/libtest/test610.pl mkdir %PWD/%LOGDIR/test%TESTNUMBER.dir
+%PERL %SRCDIR/libtest/test610.pl mkdir %PWD/%LOGDIR/test%TESTNUMBER.dir
 </precheck>
- <name>
+<name>
 SFTP post-quote rename * asterisk accept-fail
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -Q "-*rename %PWD/%LOGDIR/test%TESTNUMBER.dir %PWD/%LOGDIR/test%TESTNUMBER.new" sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -Q "-*rename %SFTP_PWD/%LOGDIR/test%TESTNUMBER.dir %SFTP_PWD/%LOGDIR/test%TESTNUMBER.new" sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
 </command>
-<postcheck>
-perl %SRCDIR/libtest/test610.pl rmdir %PWD/%LOGDIR/test%TESTNUMBER.new
-</postcheck>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Dummy test file for rename test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
+<postcheck>
+%PERL %SRCDIR/libtest/test610.pl rmdir %PWD/%LOGDIR/test%TESTNUMBER.new
+</postcheck>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test639 b/third-party/curl/tests/data/test639
index 3c6f50bd71..529e70515a 100644
--- a/third-party/curl/tests/data/test639
+++ b/third-party/curl/tests/data/test639
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ asterisk
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -16,34 +16,29 @@ Dummy test file for rename test
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
 <precheck>
-perl %SRCDIR/libtest/test610.pl mkdir %PWD/%LOGDIR/test%TESTNUMBER.dir
+%PERL %SRCDIR/libtest/test610.pl mkdir %PWD/%LOGDIR/test%TESTNUMBER.dir
 </precheck>
- <name>
-SFTP post-quote rename * asterisk accept-fail
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -Q "-*rename %PWD/%LOGDIR/test%TESTNUMBER-not-exists-dir %PWD/%LOGDIR/test%TESTNUMBER.new" sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
+<name>
+SFTP post-quote rename error with accept-fail
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: -Q "-*rename %SFTP_PWD/%LOGDIR/test%TESTNUMBER-not-exists-dir %SFTP_PWD/%LOGDIR/test%TESTNUMBER.new" sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
 </command>
-<postcheck>
-perl %SRCDIR/libtest/test610.pl rmdir %PWD/%LOGDIR/test%TESTNUMBER.dir
-</postcheck>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Dummy test file for rename test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
+<postcheck>
+%PERL %SRCDIR/libtest/test610.pl rmdir %PWD/%LOGDIR/test%TESTNUMBER.dir
+</postcheck>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test64 b/third-party/curl/tests/data/test64
index 5c19b2202c..d45cd9b220 100644
--- a/third-party/curl/tests/data/test64
+++ b/third-party/curl/tests/data/test64
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP Digest auth
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145"
@@ -20,7 +21,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -29,7 +30,7 @@ Content-Length: 23
 This IS the real page!
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145"
@@ -54,26 +55,27 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP with Digest authorization
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --digest
+</name>
+<command>
+'http://%HOSTIP:%HTTPPORT/%TESTNUMBER"' -u testuser:testpass --digest
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-GET /%TESTNUMBER HTTP/1.1
+<protocol crlf="headers">
+GET /%TESTNUMBER" HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 
-GET /%TESTNUMBER HTTP/1.1
+GET /%TESTNUMBER" HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Digest username="testuser", realm="testrealm", nonce="1053604145", uri="/%TESTNUMBER", response="c55f7f30d83d774a3d2dcacf725abaca"
+Authorization: Digest username="testuser", realm="testrealm", nonce="1053604145", uri="/%TESTNUMBER\"", response="1ee14b238b3259f17602e9ce41491ef9"
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test640 b/third-party/curl/tests/data/test640
index 816dfd537d..b1e2e96510 100644
--- a/third-party/curl/tests/data/test640
+++ b/third-party/curl/tests/data/test640
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,24 +7,22 @@ NOBODY
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP --head retrieval
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure --head
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure --head
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
@@ -31,11 +30,7 @@ for ssh test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test641 b/third-party/curl/tests/data/test641
index 3487c90ce3..d35f8d1619 100644
--- a/third-party/curl/tests/data/test641
+++ b/third-party/curl/tests/data/test641
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,24 +7,22 @@ NOBODY
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 scp
 </server>
- <name>
+<name>
 SCP --head retrieval
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: scp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure --head
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: scp://%HOSTIP:%SSHPORT%SCP_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure --head
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
@@ -31,11 +30,7 @@ for ssh test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test642 b/third-party/curl/tests/data/test642
index f63bbc6603..c289a49f83 100644
--- a/third-party/curl/tests/data/test642
+++ b/third-party/curl/tests/data/test642
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ SFTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -14,17 +14,16 @@ for ssh test
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
-SFTP retrieval
- </name>
- <command>
---key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: --compressed-ssh sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
+<name>
+SFTP retrieval (compressed)
+</name>
+<command>
+--key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: --compressed-ssh sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt --insecure
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 Test data
@@ -32,11 +31,7 @@ for ssh test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test643 b/third-party/curl/tests/data/test643
index 52e1ea612d..ad3d612e4d 100644
--- a/third-party/curl/tests/data/test643
+++ b/third-party/curl/tests/data/test643
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ HTTP MIME POST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -19,7 +19,7 @@ Content-Type: text/html
 
 hello
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -50,85 +50,84 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 HTTP multi-part mimepost using read callback for the file part
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
 # Note that the stripping above removes 12 bytes from every occurrence of the
 # boundary string and since 5 of them are in the body contents, we see
 # (5*12) == 60 bytes less
 <protocol>
-POST /%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-Accept: */*
-Content-Length: 640
-Content-Type: multipart/form-data; boundary=----------------------------
-
-------------------------------
-Content-Disposition: form-data; name="sendfile"; filename="postit2.c"
-
+POST /%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+Accept: */*%CR
+Content-Length: 676%CR
+Content-Type: multipart/form-data; boundary=----------------------------%CR
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="sendfile"; filename="postit2.c"%CR
+%CR
 dummy
-
-------------------------------
-Content-Disposition: form-data; name="callbackdata"
-
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="callbackdata"%CR
+%CR
 dummy
-
-------------------------------
-Content-Disposition: form-data; name="filename"
-
-postit2.c
-------------------------------
-Content-Disposition: form-data; name="submit"
-
-send
-------------------------------
-Content-Disposition: form-data; name="somename"; filename="somefile.txt"
-Content-Type: text/plain
-
-blah blah
---------------------------------
-POST /%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-Accept: */*
-Content-Length: 654
-Content-Type: multipart/form-data; boundary=----------------------------
-
-------------------------------
-Content-Disposition: form-data; name="sendfile alternative"; filename="file name 2"
-
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="filename"%CR
+%CR
+postit2.c%CR
+------------------------------%CR
+Content-Disposition: form-data; name="submit"%CR
+%CR
+send%CR
+------------------------------%CR
+Content-Disposition: form-data; name="somename"; filename="somefile.txt"%CR
+Content-Type: text/plain%CR
+%CR
+blah blah%CR
+--------------------------------%CR
+POST /%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+Accept: */*%CR
+Content-Length: 690%CR
+Content-Type: multipart/form-data; boundary=----------------------------%CR
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="sendfile alternative"; filename="filename 2 "%CR
+%CR
 dummy
-
-------------------------------
-Content-Disposition: form-data; name="callbackdata"
-
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="callbackdata"%CR
+%CR
 dummy
-
-------------------------------
-Content-Disposition: form-data; name="filename"
-
-postit2.c
-------------------------------
-Content-Disposition: form-data; name="submit"
-
-send
-------------------------------
-Content-Disposition: form-data; name="somename"; filename="somefile.txt"
-Content-Type: text/plain
-
-blah blah
---------------------------------
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="filename"%CR
+%CR
+postit2.c%CR
+------------------------------%CR
+Content-Disposition: form-data; name="submit"%CR
+%CR
+send%CR
+------------------------------%CR
+Content-Disposition: form-data; name="somename"; filename="somefile.txt"%CR
+Content-Type: text/plain%CR
+%CR
+blah blah%CR
+--------------------------------%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test644 b/third-party/curl/tests/data/test644
index 41a3cdd66f..e2199510be 100644
--- a/third-party/curl/tests/data/test644
+++ b/third-party/curl/tests/data/test644
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ xattr
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -40,14 +40,13 @@ Funny-head: yesyes
 </data2>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 <features>
-debug
+Debug
 xattr
 </features>
 # simulate the xattr operations
@@ -62,10 +61,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --xattr -L -o %LOGDIR/out%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -78,6 +76,7 @@ Accept: */*
 
 </protocol>
 <stdout mode="text">
+user.creator => curl
 user.mime_type => text/html
 user.xdg.origin.url => http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </stdout>
diff --git a/third-party/curl/tests/data/test645 b/third-party/curl/tests/data/test645
index 6fd1eb967a..7e48e20a87 100644
--- a/third-party/curl/tests/data/test645
+++ b/third-party/curl/tests/data/test645
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ HTTP MIME POST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -19,7 +19,7 @@ Content-Type: text/html
 
 hello
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -47,158 +47,149 @@ http
 </server>
 # tool is what to use instead of 'curl'
 <tool>
-lib%TESTNUMBER
+lib643
 </tool>
 
- <name>
+<name>
 HTTP multi-part chunked mimepost using read callback for the file part
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
 # Note that the stripping above removes 12 bytes from every occurrence of the
 # boundary string and since 5 of them are in the body contents, we see
 # (5*12) == 60 bytes less
 <protocol>
-POST /%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-Accept: */*
-Transfer-Encoding: chunked
-Content-Type: multipart/form-data; boundary=----------------------------
-Expect: 100-continue
+POST /%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+Accept: */*%CR
+Transfer-Encoding: chunked%CR
+Content-Type: multipart/form-data; boundary=----------------------------%CR
+Expect: 100-continue%CR
+%CR
+7c%CR
+------------------------------%CR
+Content-Disposition: form-data; name="sendfile"; filename="postit2.c"%CR
+%CR
+d%CR
+1%CR
+u%CR
+1%CR
+m%CR
+1%CR
+m%CR
+1%CR
+y%CR
+1%CR
 
-76
-------------------------------
-Content-Disposition: form-data; name="sendfile"; filename="postit2.c"
+%CR
+6b%CR
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="callbackdata"%CR
+%CR
+%CR
+1%CR
+d%CR
+1%CR
+u%CR
+1%CR
+m%CR
+1%CR
+m%CR
+1%CR
+y%CR
+1%CR
 
-d
-1
-u
-1
-m
-1
-m
-1
-y
-1
+%CR
+1b2%CR
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="filename"%CR
+%CR
+postit2.c%CR
+------------------------------%CR
+Content-Disposition: form-data; name="submit"%CR
+%CR
+send%CR
+------------------------------%CR
+Content-Disposition: form-data; name="somename"; filename="somefile.txt"%CR
+Content-Type: text/plain%CR
+%CR
+blah blah%CR
+--------------------------------%CR
+%CR
+0%CR
+%CR
+POST /%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+Accept: */*%CR
+Transfer-Encoding: chunked%CR
+Content-Type: multipart/form-data; boundary=----------------------------%CR
+Expect: 100-continue%CR
+%CR
+8a%CR
+------------------------------%CR
+Content-Disposition: form-data; name="sendfile alternative"; filename="filename 2 "%CR
+%CR
+d%CR
+1%CR
+u%CR
+1%CR
+m%CR
+1%CR
+m%CR
+1%CR
+y%CR
+1%CR
 
+%CR
+6b%CR
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="callbackdata"%CR
+%CR
+%CR
+1%CR
+d%CR
+1%CR
+u%CR
+1%CR
+m%CR
+1%CR
+m%CR
+1%CR
+y%CR
+1%CR
 
-65
-
-------------------------------
-Content-Disposition: form-data; name="callbackdata"
-
-
-1
-d
-1
-u
-1
-m
-1
-m
-1
-y
-1
-
-
-%if hyper
-19A
-%else
-19a
-%endif
-
-------------------------------
-Content-Disposition: form-data; name="filename"
-
-postit2.c
-------------------------------
-Content-Disposition: form-data; name="submit"
-
-send
-------------------------------
-Content-Disposition: form-data; name="somename"; filename="somefile.txt"
-Content-Type: text/plain
-
-blah blah
---------------------------------
-
-0
-
-POST /%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-Accept: */*
-Transfer-Encoding: chunked
-Content-Type: multipart/form-data; boundary=----------------------------
-Expect: 100-continue
-
-84
-------------------------------
-Content-Disposition: form-data; name="sendfile alternative"; filename="file name 2"
-
-d
-1
-u
-1
-m
-1
-m
-1
-y
-1
-
-
-65
-
-------------------------------
-Content-Disposition: form-data; name="callbackdata"
-
-
-1
-d
-1
-u
-1
-m
-1
-m
-1
-y
-1
-
-
-%if hyper
-19A
-%else
-19a
-%endif
-
-------------------------------
-Content-Disposition: form-data; name="filename"
-
-postit2.c
-------------------------------
-Content-Disposition: form-data; name="submit"
-
-send
-------------------------------
-Content-Disposition: form-data; name="somename"; filename="somefile.txt"
-Content-Type: text/plain
-
-blah blah
---------------------------------
-
-0
-
+%CR
+1b2%CR
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="filename"%CR
+%CR
+postit2.c%CR
+------------------------------%CR
+Content-Disposition: form-data; name="submit"%CR
+%CR
+send%CR
+------------------------------%CR
+Content-Disposition: form-data; name="somename"; filename="somefile.txt"%CR
+Content-Type: text/plain%CR
+%CR
+blah blah%CR
+--------------------------------%CR
+%CR
+0%CR
+%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test646 b/third-party/curl/tests/data/test646
index ef9191e75b..8b57014c4c 100644
--- a/third-party/curl/tests/data/test646
+++ b/third-party/curl/tests/data/test646
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,10 @@ MULTIPART
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -20,17 +19,27 @@ Mime
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP multipart using mime API
- </name>
-<stdin>
-From: different
-To: another
-
-body
+</name>
+<stdin crlf="yes">
+From: different
+To: another
+
+body
 </stdin>
- <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -F "=(;type=multipart/alternative" -F "= <body>This is the html version</body>;headers=X-test1: this is a header;type=text/html;headers=X-test2: this is another header " -F "=This is the plain text version;headers=@%LOGDIR/headers%TESTNUMBER" -F "=)" -F "=@%LOGDIR/test%TESTNUMBER.txt;headers=<%LOGDIR/headers%TESTNUMBER" -H "From: different" -H "To: another" -H "Reply-To: <followup@example.com>"
+<command>
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER
+--mail-rcpt recipient@example.com
+--mail-from sender@example.com
+-F "=(;type=multipart/alternative"
+-F "= %LTbody%GTThis is the html version%LT/body%GT;headers=X-test1: this is a header;type=text/html;headers=X-test2: this is another header "
+-F "=This is the plain text version;headers=@%LOGDIR/headers%TESTNUMBER"
+-F "=)"
+-F "=@%LOGDIR/test%TESTNUMBER.txt;headers=%LT%LOGDIR/headers%TESTNUMBER"
+-H "From: different"
+-H "To: another"
+-H "Reply-To: %LTfollowup@example.com%GT"
 </command>
 <file1 name="%LOGDIR/test%TESTNUMBER.txt">
 This is an attached file.
@@ -39,63 +48,62 @@ It may contain any type of data.
 </file1>
 <file2 name="%LOGDIR/headers%TESTNUMBER">
 # This line is a comment
-X-fileheader1: This is a header from a file 
+X-fileheader1: This is a header from a file%SP%CR
 
 # This line is another comment. It precedes a folded header.
-X-fileheader2: This is 
#a
+X-fileheader2: This is #a
  folded header
 </file2>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
-<protocol>
-EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
-DATA
-QUIT
+<protocol crlf="yes">
+EHLO %TESTNUMBER
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
+DATA
+QUIT
 </protocol>
 <upload>
-Content-Type: multipart/mixed; boundary=----------------------------
-Mime-Version: 1.0
-From: different
-To: another
-Reply-To: <followup@example.com>
-
-------------------------------
-Content-Type: multipart/alternative; boundary=----------------------------
-
-------------------------------
-Content-Type: text/html
-Content-Transfer-Encoding: 8bit
-X-test1: this is a header
-X-test2: this is another header
-
-<body>This is the html version</body>
-------------------------------
-X-fileheader1: This is a header from a file
-X-fileheader2: This is #a folded header
-
-This is the plain text version
---------------------------------
-
-------------------------------
-Content-Disposition: attachment; filename="test%TESTNUMBER.txt"
-X-fileheader1: This is a header from a file
-X-fileheader2: This is #a folded header
-
+Content-Type: multipart/mixed; boundary=----------------------------%CR
+Mime-Version: 1.0%CR
+From: different%CR
+To: another%CR
+Reply-To: %LTfollowup@example.com%GT%CR
+%CR
+------------------------------%CR
+Content-Type: multipart/alternative; boundary=----------------------------%CR
+%CR
+------------------------------%CR
+Content-Type: text/html%CR
+Content-Transfer-Encoding: 8bit%CR
+X-test1: this is a header%CR
+X-test2: this is another header%CR
+%CR
+%LTbody%GTThis is the html version%LT/body%GT%CR
+------------------------------%CR
+X-fileheader1: This is a header from a file%CR
+X-fileheader2: This is #a folded header%CR
+%CR
+This is the plain text version%CR
+--------------------------------%CR
+%CR
+------------------------------%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER.txt"%CR
+X-fileheader1: This is a header from a file%CR
+X-fileheader2: This is #a folded header%CR
+%CR
 This is an attached file.
 
 It may contain any type of data.
-
---------------------------------
-.
+%CR
+--------------------------------%CR
+.%CR
 </upload>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test647 b/third-party/curl/tests/data/test647
index c00b2407f8..b9d69cd33f 100644
--- a/third-party/curl/tests/data/test647
+++ b/third-party/curl/tests/data/test647
@@ -1,18 +1,18 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 IMAP
 APPEND
+UPLOAD
 MULTIPART
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -21,11 +21,22 @@ Mime
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP APPEND multipart using mime API
- </name>
- <command>
-imap://%HOSTIP:%IMAPPORT/%TESTNUMBER -F "=(;type=multipart/alternative" -F "= <body>This is the html version</body>;type=text/html" -F "=This is the plain text version" -F "=)" -F "=@%LOGDIR/test%TESTNUMBER.txt" -H "Date: Mon, 7 Feb 1994 21:52:25 -0800 (PST)" -H "From: Fred Foobar <foobar@example.com>" -H "To: joe@example.com" -H "Message-Id: <B27397-0100000@example.com>" -H "Subject: afternoon meeting" -u user:secret
+</name>
+<command>
+imap://%HOSTIP:%IMAPPORT/%TESTNUMBER
+-F "=(;type=multipart/alternative"
+-F "= <body>This is the html version</body>;type=text/html"
+-F "=This is the plain text version"
+-F "=)"
+-F "=@%LOGDIR/test%TESTNUMBER.txt"
+-H "Date: Mon, 7 Feb 1994 21:52:25 -0800 (PST)"
+-H "From: Fred Foobar %LTfoobar@example.com%GT"
+-H "To: joe@example.com"
+-H "Message-Id: %LTB27397-0100000@example.com%GT"
+-H "Subject: afternoon meeting"
+-u user:secret
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 This is an attached file.
@@ -34,49 +45,48 @@ It may contain any type of data.
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
-A003 APPEND %TESTNUMBER (\Seen) {892}
+A003 APPEND %TESTNUMBER (\Seen) {940}
 A004 LOGOUT
 </protocol>
 <upload>
-Content-Type: multipart/mixed; boundary=----------------------------
-Mime-Version: 1.0
-Date: Mon, 7 Feb 1994 21:52:25 -0800 (PST)
-From: Fred Foobar <foobar@example.com>
-To: joe@example.com
-Message-Id: <B27397-0100000@example.com>
-Subject: afternoon meeting
-
-------------------------------
-Content-Type: multipart/alternative; boundary=----------------------------
-
-------------------------------
-Content-Type: text/html
-Content-Transfer-Encoding: 8bit
-
-<body>This is the html version</body>
-------------------------------
-
-This is the plain text version
---------------------------------
-
-------------------------------
-Content-Disposition: attachment; filename="test%TESTNUMBER.txt"
-
+Content-Type: multipart/mixed; boundary=----------------------------%CR
+Mime-Version: 1.0%CR
+Date: Mon, 7 Feb 1994 21:52:25 -0800 (PST)%CR
+From: Fred Foobar %LTfoobar@example.com%GT%CR
+To: joe@example.com%CR
+Message-Id: %LTB27397-0100000@example.com%GT%CR
+Subject: afternoon meeting%CR
+%CR
+------------------------------%CR
+Content-Type: multipart/alternative; boundary=----------------------------%CR
+%CR
+------------------------------%CR
+Content-Type: text/html%CR
+Content-Transfer-Encoding: 8bit%CR
+%CR
+<body>This is the html version</body>%CR
+------------------------------%CR
+%CR
+This is the plain text version%CR
+--------------------------------%CR
+%CR
+------------------------------%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER.txt"%CR
+%CR
 This is an attached file.
 
 It may contain any type of data.
-
---------------------------------
+%CR
+--------------------------------%CR
 </upload>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test648 b/third-party/curl/tests/data/test648
index 242e64e5e4..09dd15d696 100644
--- a/third-party/curl/tests/data/test648
+++ b/third-party/curl/tests/data/test648
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,10 @@ MULTIPART
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -20,17 +19,23 @@ Mime
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP multipart with transfer content encoders
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
- <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -F '=This is the email inline text with a very long line containing the special character = and that should be split by encoder.;headers=Content-disposition: "inline";encoder=quoted-printable' -F "=@%LOGDIR/test%TESTNUMBER.txt;encoder=base64" -H "From: different" -H "To: another"
+<command>
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER
+--mail-rcpt recipient@example.com
+--mail-from sender@example.com
+-F '=This is the email inline text with a very long line containing the special character = and that should be split by encoder.;headers=Content-disposition: "inline";encoder=quoted-printable'
+-F "=@%LOGDIR/test%TESTNUMBER.txt;encoder=base64"
+-H "From: different"
+-H "To: another"
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 This is an attached file.
@@ -39,21 +44,20 @@ It may contain any type of data and will be encoded in base64 for transfer.
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 Content-Type: multipart/mixed; boundary=----------------------------
 Mime-Version: 1.0
 From: different
diff --git a/third-party/curl/tests/data/test649 b/third-party/curl/tests/data/test649
index 37dbef63ce..076cced170 100644
--- a/third-party/curl/tests/data/test649
+++ b/third-party/curl/tests/data/test649
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,10 @@ MULTIPART
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -20,54 +19,33 @@ Mime
 <server>
 smtp
 </server>
- <name>
-SMTP multipart with 7bit encoder error
- </name>
-<stdin>
+<name>
+SMTP multipart with 7-bit encoder error
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -F '=This is valid;encoder=7bit' -F "=@%LOGDIR/test%TESTNUMBER.txt;encoder=7bit" -H "From: different" -H "To: another"
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
-This is an attached file (in french: pièce jointe).
+This is an attached file (in french: pi%hex[%c3%a8]hex%ce jointe).
 
 It contains at least an 8-bit byte value.
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
-</strippart>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 </protocol>
-<upload nonewline="yes">
-Content-Type: multipart/mixed; boundary=----------------------------
-Mime-Version: 1.0
-From: different
-To: another
-
-------------------------------
-Content-Transfer-Encoding: 7bit
-
-This is valid
-------------------------------
-Content-Disposition: attachment; filename="test%TESTNUMBER.txt"
-Content-Transfer-Encoding: 7bit
-
-This is an attached file (in french: pi
-</upload>
 <errorcode>
 26
 </errorcode>
diff --git a/third-party/curl/tests/data/test65 b/third-party/curl/tests/data/test65
index d9d0820c69..0155e52799 100644
--- a/third-party/curl/tests/data/test65
+++ b/third-party/curl/tests/data/test65
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP Digest auth
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="2053604145"
@@ -20,7 +21,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="yes">
 HTTP/1.1 401 Still a bad password you moron
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -29,7 +30,7 @@ Content-Length: 34
 This is not the real page either
 </data1000>
 
-<datacheck>
+<datacheck crlf="yes">
 HTTP/1.1 401 Authorization Required
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="2053604145"
@@ -54,18 +55,19 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP with Digest authorization with bad password
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:test2pass --digest
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test650 b/third-party/curl/tests/data/test650
index be93d8ac97..8e8fb28809 100644
--- a/third-party/curl/tests/data/test650
+++ b/third-party/curl/tests/data/test650
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ FORM
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 301 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -20,7 +20,7 @@ Location: /%TESTNUMBER0002
 
 hello
 </data>
-<data2 crlf="yes">
+<data2 crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -29,7 +29,7 @@ Connection: close
 Content-Type: text/html
 
 -foo-
-</data>
+</data2>
 </reply>
 
 # Client-side
@@ -45,13 +45,13 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 HTTP formpost using form API - with redirect and re-POST
- </name>
+</name>
 <stdin>
  Some data from stdin
 </stdin>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER %LOGDIR/test%TESTNUMBER.filedata
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.filedata">
@@ -59,185 +59,160 @@ This is data from a file.
 </file>
 </client>
 
-#
-# Verify data after the test has been "shot"
+# Verify data bbter the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
 # Note that the stripping above removes 12 bytes from every occurrence of the
 # boundary string and since 5 of them are in the body contents, we see
 # (5*12) == 60 bytes less
 <protocol>
-POST /%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-Accept: */*
-Transfer-Encoding: chunked
-Content-Type: multipart/form-data; boundary=----------------------------
-Expect: 100-continue
-
-361
-------------------------------
-Content-Disposition: form-data; name="fieldname"
-Content-Type: text/plain
-X-customheader-1: Header 1 data
-X-customheader-2: Header 2 data
-
-this is what we post to the silly web server
-------------------------------
-Content-Disposition: form-data; name="fieldnam"
-
-uhis is what we post to the silly web serve
-------------------------------
-Content-Disposition: form-data; name="multifile"
-Content-Type: multipart/mixed; boundary=----------------------------
-
-------------------------------
-Content-Disposition: attachment; filename="test%TESTNUMBER.filedata"
-Content-Type: application/octet-stream
-
+POST /%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+Accept: */*%CR
+Transfer-Encoding: chunked%CR
+Content-Type: multipart/form-data; boundary=----------------------------%CR
+Expect: 100-continue%CR
+%CR
+385%CR
+------------------------------%CR
+Content-Disposition: form-data; name="fieldname"%CR
+Content-Type: text/plain%CR
+X-customheader-1: Header 1 data%CR
+X-customheader-2: Header 2 data%CR
+%CR
+this is what we post to the silly web server%CR
+------------------------------%CR
+Content-Disposition: form-data; name="fieldnam"%CR
+%CR
+uhis is what we post to the silly web serve%CR
+------------------------------%CR
+Content-Disposition: form-data; name="multifile"%CR
+Content-Type: multipart/mixed; boundary=----------------------------%CR
+%CR
+------------------------------%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER.filedata"%CR
+Content-Type: application/octet-stream%CR
+%CR
 This is data from a file.
-
-------------------------------
-Content-Disposition: attachment; filename="test%TESTNUMBER.filedata"
-Content-Type: text/whatever
-
-
-%if hyper
-A5
-%else
-a5
-%endif
+%CR
+------------------------------%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER.filedata"%CR
+Content-Type: text/whatever%CR
+%CR
+%CR
+ab%CR
 This is data from a file.
-
-------------------------------
-Content-Disposition: attachment; filename="test%TESTNUMBER.filedata"
-Content-Type: text/whatever
-
-
-%if hyper
-AF
-%else
-af
-%endif
+%CR
+------------------------------%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER.filedata"%CR
+Content-Type: text/whatever%CR
+%CR
+%CR
+bb%CR
 This is data from a file.
-
---------------------------------
-
-------------------------------
-Content-Disposition: form-data; name="filecontents"
-
-
-%if hyper
-10F
-%else
-10f
-%endif
+%CR
+--------------------------------%CR
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="filecontents"%CR
+%CR
+%CR
+11b%CR
 This is data from a file.
-
-------------------------------
-Content-Disposition: form-data; name="formlength"
-
-1367
-------------------------------
-Content-Disposition: form-data; name="standardinput"
-Content-Type: application/octet-stream
-
-
-16
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="formlength"%CR
+%CR
+1433%CR
+------------------------------%CR
+Content-Disposition: form-data; name="standardinput"%CR
+Content-Type: application/octet-stream%CR
+%CR
+%CR
+16%CR
  Some data from stdin
-
-30
-
---------------------------------
-
-0
-
-POST /%TESTNUMBER0002 HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-Accept: */*
-Transfer-Encoding: chunked
-Content-Type: multipart/form-data; boundary=----------------------------
-Expect: 100-continue
-
-361
-------------------------------
-Content-Disposition: form-data; name="fieldname"
-Content-Type: text/plain
-X-customheader-1: Header 1 data
-X-customheader-2: Header 2 data
-
-this is what we post to the silly web server
-------------------------------
-Content-Disposition: form-data; name="fieldnam"
-
-uhis is what we post to the silly web serve
-------------------------------
-Content-Disposition: form-data; name="multifile"
-Content-Type: multipart/mixed; boundary=----------------------------
-
-------------------------------
-Content-Disposition: attachment; filename="test%TESTNUMBER.filedata"
-Content-Type: application/octet-stream
-
+%CR
+36%CR
+%CR
+--------------------------------%CR
+%CR
+0%CR
+%CR
+POST /%TESTNUMBER0002 HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+Accept: */*%CR
+Transfer-Encoding: chunked%CR
+Content-Type: multipart/form-data; boundary=----------------------------%CR
+Expect: 100-continue%CR
+%CR
+385%CR
+------------------------------%CR
+Content-Disposition: form-data; name="fieldname"%CR
+Content-Type: text/plain%CR
+X-customheader-1: Header 1 data%CR
+X-customheader-2: Header 2 data%CR
+%CR
+this is what we post to the silly web server%CR
+------------------------------%CR
+Content-Disposition: form-data; name="fieldnam"%CR
+%CR
+uhis is what we post to the silly web serve%CR
+------------------------------%CR
+Content-Disposition: form-data; name="multifile"%CR
+Content-Type: multipart/mixed; boundary=----------------------------%CR
+%CR
+------------------------------%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER.filedata"%CR
+Content-Type: application/octet-stream%CR
+%CR
 This is data from a file.
-
-------------------------------
-Content-Disposition: attachment; filename="test%TESTNUMBER.filedata"
-Content-Type: text/whatever
-
-
-%if hyper
-A5
-%else
-a5
-%endif
+%CR
+------------------------------%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER.filedata"%CR
+Content-Type: text/whatever%CR
+%CR
+%CR
+ab%CR
 This is data from a file.
-
-------------------------------
-Content-Disposition: attachment; filename="test%TESTNUMBER.filedata"
-Content-Type: text/whatever
-
-
-%if hyper
-AF
-%else
-af
-%endif
+%CR
+------------------------------%CR
+Content-Disposition: attachment; filename="test%TESTNUMBER.filedata"%CR
+Content-Type: text/whatever%CR
+%CR
+%CR
+bb%CR
 This is data from a file.
-
---------------------------------
-
-------------------------------
-Content-Disposition: form-data; name="filecontents"
-
-
-%if hyper
-10F
-%else
-10f
-%endif
+%CR
+--------------------------------%CR
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="filecontents"%CR
+%CR
+%CR
+11b%CR
 This is data from a file.
-
-------------------------------
-Content-Disposition: form-data; name="formlength"
-
-1367
-------------------------------
-Content-Disposition: form-data; name="standardinput"
-Content-Type: application/octet-stream
-
-
-16
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="formlength"%CR
+%CR
+1433%CR
+------------------------------%CR
+Content-Disposition: form-data; name="standardinput"%CR
+Content-Type: application/octet-stream%CR
+%CR
+%CR
+16%CR
  Some data from stdin
-
-30
-
---------------------------------
-
-0
-
+%CR
+36%CR
+%CR
+--------------------------------%CR
+%CR
+0%CR
+%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test651 b/third-party/curl/tests/data/test651
index 283c91fb9d..49cf1aab93 100644
--- a/third-party/curl/tests/data/test651
+++ b/third-party/curl/tests/data/test651
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ FORM
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -34,13 +34,13 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 curl_formadd with huge COPYCONTENTS
- </name>
+</name>
 <stdin>
  Some data from stdin
 </stdin>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER %LOGDIR/test%TESTNUMBER.filedata
 </command>
 <file name="%LOGDIR/test%TESTNUMBER.filedata">
@@ -48,27 +48,26 @@ This is data from a file.
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
 # Note that the stripping above removes 12 bytes from every occurrence of the
 # boundary string and since 5 of them are in the body contents, we see
 # (5*12) == 60 bytes less
-<protocol>
+<protocol crlf="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
-Content-Length: 17139
+Content-Length: 17151
 Content-Type: multipart/form-data; boundary=----------------------------
 
 ------------------------------
 Content-Disposition: form-data; name="hello"
 
-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ
+%repeat[1000 x A]%%repeat[1000 x B]%%repeat[1000 x C]%%repeat[1000 x D]%%repeat[1000 x E]%%repeat[1000 x F]%%repeat[1000 x G]%%repeat[1000 x H]%%repeat[1000 x I]%%repeat[1000 x J]%%repeat[1000 x K]%%repeat[1000 x L]%%repeat[1000 x M]%%repeat[1000 x N]%%repeat[1000 x O]%%repeat[1000 x P]%%repeat[999 x Q]%
 --------------------------------
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test652 b/third-party/curl/tests/data/test652
index 0b0732ac4e..5315ab4baa 100644
--- a/third-party/curl/tests/data/test652
+++ b/third-party/curl/tests/data/test652
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,10 @@ MIME
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -24,29 +23,28 @@ smtp
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 SMTP with encoded huge mime data contents
- </name>
- <command>
+</name>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<somebody@example.com>
-RCPT TO:<someone@example.com>
+MAIL FROM:%LTsomebody@example.com%GT
+RCPT TO:%LTsomeone@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 Content-Type: multipart/mixed; boundary=----------------------------
 Mime-Version: 1.0
 
diff --git a/third-party/curl/tests/data/test653 b/third-party/curl/tests/data/test653
index 33994fd50f..3674f4e07b 100644
--- a/third-party/curl/tests/data/test653
+++ b/third-party/curl/tests/data/test653
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ MIME
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -19,7 +19,7 @@ Content-Type: text/html
 
 hello
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -50,29 +50,28 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 Reuse of handle after altering mime data
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
 # Note that the stripping above removes 12 bytes from every occurrence of the
 # boundary string and since 5 of them are in the body contents, we see
 # (5*12) == 60 bytes less
-<protocol>
+<protocol crlf="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
-Content-Length: 150
+Content-Length: 162
 Content-Type: multipart/form-data; boundary=----------------------------
 
 ------------------------------
@@ -83,7 +82,7 @@ short value
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
-Content-Length: 167
+Content-Length: 179
 Content-Type: multipart/form-data; boundary=----------------------------
 
 ------------------------------
diff --git a/third-party/curl/tests/data/test654 b/third-party/curl/tests/data/test654
index 48984de59b..34e052836c 100644
--- a/third-party/curl/tests/data/test654
+++ b/third-party/curl/tests/data/test654
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ HTTP MIME POST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -19,7 +19,7 @@ Content-Type: text/html
 
 hello
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -50,10 +50,10 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 HTTP duplicate easy handle with mime data
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER %LOGDIR/file%TESTNUMBER.txt
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
@@ -61,70 +61,65 @@ This is data from a file
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
 # Note that the stripping above removes 12 bytes from every occurrence of the
 # boundary string and since 5 of them are in the body contents, we see
 # (5*12) == 60 bytes less
 <protocol>
-POST /%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-Accept: */*
-Content-Length: 0
-
-POST /%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-Accept: */*
-Transfer-Encoding: chunked
-Content-Type: multipart/form-data; boundary=----------------------------
-Expect: 100-continue
-
-%if hyper
-1AF
-%else
-1af
-%endif
-------------------------------
-Content-Disposition: form-data; name="greeting"
-Content-Type: application/X-Greeting
-Content-Transfer-Encoding: base64
-X-Test-Number: %TESTNUMBER
-
-aGVsbG8=
-------------------------------
-Content-Disposition: form-data; filename="file%TESTNUMBER.txt"
-Content-Type: text/plain
-
+POST /%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+Accept: */*%CR
+Content-Length: 0%CR
+%CR
+POST /%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+Accept: */*%CR
+Transfer-Encoding: chunked%CR
+Content-Type: multipart/form-data; boundary=----------------------------%CR
+Expect: 100-continue%CR
+%CR
+1c1%CR
+------------------------------%CR
+Content-Disposition: form-data; name="greeting"%CR
+Content-Type: application/X-Greeting%CR
+Content-Transfer-Encoding: base64%CR
+X-Test-Number: %TESTNUMBER%CR
+%CR
+aGVsbG8=%CR
+------------------------------%CR
+Content-Disposition: form-data; filename="file%TESTNUMBER.txt"%CR
+Content-Type: text/plain%CR
+%CR
 This is data from a file
+%CR
+------------------------------%CR
+Content-Disposition: form-data%CR
+%CR
+%CR
+1%CR
+d%CR
+1%CR
+u%CR
+1%CR
+m%CR
+1%CR
+m%CR
+1%CR
+y%CR
+1%CR
 
-------------------------------
-Content-Disposition: form-data
-
-
-1
-d
-1
-u
-1
-m
-1
-m
-1
-y
-1
-
-
-30
-
---------------------------------
-
-0
-
+%CR
+36%CR
+%CR
+--------------------------------%CR
+%CR
+0%CR
+%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test655 b/third-party/curl/tests/data/test655
index 53b42196ab..ce2a1726f7 100644
--- a/third-party/curl/tests/data/test655
+++ b/third-party/curl/tests/data/test655
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,9 @@ HTTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -32,15 +32,14 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 resolver start callback
- </name>
- <command>
-http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</name>
+<command>
+http://failthis/%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test656 b/third-party/curl/tests/data/test656
index fff647ca39..4e1599bacc 100644
--- a/third-party/curl/tests/data/test656
+++ b/third-party/curl/tests/data/test656
@@ -1,31 +1,26 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SFTP
-FAILURE
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP retrieval with nonexistent private key file
- </name>
- <command>
---key DOES_NOT_EXIST --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SSH_PWD/not-a-valid-file-moooo --insecure --connect-timeout 8
+</name>
+<command>
+--key DOES_NOT_EXIST --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/not-a-valid-file-moooo --insecure --connect-timeout 8
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<valgrind>
-disable
-</valgrind>
 <errorcode>
 67
 </errorcode>
diff --git a/third-party/curl/tests/data/test658 b/third-party/curl/tests/data/test658
index f8dd4f775f..2ec0e0661e 100644
--- a/third-party/curl/tests/data/test658
+++ b/third-party/curl/tests/data/test658
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -31,14 +32,14 @@ lib%TESTNUMBER
 </tool>
 <name>
 Pass URL to libcurl with CURLOPT_CURLU
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test659 b/third-party/curl/tests/data/test659
index e29dd76e11..e16f2ad753 100644
--- a/third-party/curl/tests/data/test659
+++ b/third-party/curl/tests/data/test659
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -32,8 +33,8 @@ lib%TESTNUMBER
 </tool>
 <name>
 CURLOPT_CURLU without the path set - over proxy
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT
 </command>
 <features>
@@ -42,7 +43,7 @@ proxy
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://www.example.com/ HTTP/1.1
 Host: www.example.com
 Accept: */*
diff --git a/third-party/curl/tests/data/test66 b/third-party/curl/tests/data/test66
index c39fae24ed..c4fb72a7b9 100644
--- a/third-party/curl/tests/data/test66
+++ b/third-party/curl/tests/data/test66
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -15,24 +16,20 @@ no headers swsclose
 
 # Client-side
 <client>
-<features>
-!hyper
-</features>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET without headers in the response
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --http0.9
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test660 b/third-party/curl/tests/data/test660
index c52cee4b5a..62ca998ec3 100644
--- a/third-party/curl/tests/data/test660
+++ b/third-party/curl/tests/data/test660
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -14,9 +15,9 @@ imap
 <tool>
 lib597
 </tool>
- <name>
+<name>
 IMAP CONNECT_ONLY option
- </name>
+</name>
 
 <command>
 imap://%HOSTIP:%IMAPPORT/%TESTNUMBER
@@ -24,10 +25,9 @@ imap://%HOSTIP:%IMAPPORT/%TESTNUMBER
 
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test661 b/third-party/curl/tests/data/test661
index e9454a1bc6..c2e7e5cbc1 100644
--- a/third-party/curl/tests/data/test661
+++ b/third-party/curl/tests/data/test661
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ FTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -22,18 +22,17 @@ ftp
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 Avoid redundant CWDs
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test662 b/third-party/curl/tests/data/test662
index 08b21250eb..68b048a2b3 100644
--- a/third-party/curl/tests/data/test662
+++ b/third-party/curl/tests/data/test662
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,17 +8,16 @@ HTTP proxy
 followlocation
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 302 OK
 Location: http://example.net/tes t case=/%TESTNUMBER0002
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 0
 
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK
 Location: this should be ignored
 Date: Tue, 09 Nov 2010 14:49:00 GMT
@@ -25,7 +25,7 @@ Content-Length: 5
 
 body
 </data2>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 302 OK
 Location: http://example.net/tes t case=/%TESTNUMBER0002
 Date: Tue, 09 Nov 2010 14:49:00 GMT
@@ -40,16 +40,15 @@ body
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP redirect with whitespace in absolute Location: URL
- </name>
- <command>
+</name>
+<command>
 http://example.com/please/gimme/%TESTNUMBER -L -x http://%HOSTIP:%HTTPPORT
 </command>
 <features>
@@ -57,10 +56,9 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://example.com/please/gimme/%TESTNUMBER HTTP/1.1
 Host: example.com
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test663 b/third-party/curl/tests/data/test663
index 66cba602bb..a90e35a2a3 100644
--- a/third-party/curl/tests/data/test663
+++ b/third-party/curl/tests/data/test663
@@ -1,8 +1,7 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
-#
 # This test is crafted to reproduce oss-fuzz bug
 # https://crbug.com/oss-fuzz/17954
-#
 <info>
 <keywords>
 HTTP
@@ -11,17 +10,16 @@ HTTP proxy
 followlocation
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 302 OK
 Location: http://example.net/there/it/is/../../tes t case=/%TESTNUMBER0002? yes no
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 0
 
 </data>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK
 Location: this should be ignored
 Date: Tue, 09 Nov 2010 14:49:00 GMT
@@ -29,7 +27,7 @@ Content-Length: 5
 
 body
 </data2>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 302 OK
 Location: http://example.net/there/it/is/../../tes t case=/%TESTNUMBER0002? yes no
 Date: Tue, 09 Nov 2010 14:49:00 GMT
@@ -44,16 +42,15 @@ body
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP redirect with dotdots and whitespaces in absolute Location: URL
- </name>
- <command>
+</name>
+<command>
 http://example.com/please/../gimme/%TESTNUMBER?foobar#hello -L -x http://%HOSTIP:%HTTPPORT
 </command>
 <features>
@@ -61,10 +58,9 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://example.com/gimme/%TESTNUMBER?foobar HTTP/1.1
 Host: example.com
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test664 b/third-party/curl/tests/data/test664
index 69404ef4f4..f29a3c8c0c 100644
--- a/third-party/curl/tests/data/test664
+++ b/third-party/curl/tests/data/test664
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ server key check
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -14,31 +14,26 @@ test
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 sftp
 </server>
- <name>
+<name>
 SFTP correct host key
- </name>
- <command>
---hostpubmd5 %SSHSRVMD5 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt
+</name>
+<command>
+--hostpubmd5 %SSHSRVMD5 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 0
 </errorcode>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test665 b/third-party/curl/tests/data/test665
index 07aea62af7..071d8f134a 100644
--- a/third-party/curl/tests/data/test665
+++ b/third-party/curl/tests/data/test665
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ server key check
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -14,31 +14,26 @@ test
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 scp
 </server>
- <name>
+<name>
 SCP correct host key
- </name>
- <command>
---hostpubmd5 %SSHSRVMD5 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: scp://%HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/file%TESTNUMBER.txt
+</name>
+<command>
+--hostpubmd5 %SSHSRVMD5 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: scp://%HOSTIP:%SSHPORT%SCP_PWD/%LOGDIR/file%TESTNUMBER.txt
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
 test
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 0
 </errorcode>
-<valgrind>
-disable
-</valgrind>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test666 b/third-party/curl/tests/data/test666
index bbeb0ed572..2ed6ea60c6 100644
--- a/third-party/curl/tests/data/test666
+++ b/third-party/curl/tests/data/test666
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ MIME
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -19,7 +19,7 @@ Content-Length: 3
 
 OK
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -29,7 +29,6 @@ OK
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -42,33 +41,32 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 HTTP mime post with binary-encoded huge data contents
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
 <protocol>
-POST /%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-Accept: */*
-Content-Length: 17225
-Content-Type: multipart/form-data; boundary=----------------------------
-
-------------------------------
-Content-Disposition: form-data; name="upfile"; filename="myfile.txt"
-Content-Type: text/plain
-Content-Transfer-Encoding: binary
-
+POST /%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+Accept: */*%CR
+Content-Length: 17237%CR
+Content-Type: multipart/form-data; boundary=----------------------------%CR
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="upfile"; filename="myfile.txt"%CR
+Content-Type: text/plain%CR
+Content-Transfer-Encoding: binary%CR
+%CR
 ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWX
 ZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVW
 YZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUV
@@ -289,8 +287,8 @@ STUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOP
 RSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNO
 QRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMN
 PQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLM
-OPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUV
---------------------------------
+OPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUV%CR
+--------------------------------%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test667 b/third-party/curl/tests/data/test667
index 19bca38db1..d1a4d41b9c 100644
--- a/third-party/curl/tests/data/test667
+++ b/third-party/curl/tests/data/test667
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ HTTP MIME POST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -19,7 +19,7 @@ Content-Type: text/html
 
 hello
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -43,25 +43,24 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 HTTP chunked mimepost using single-byte read callback with encoder
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
 # Note that the stripping above removes 12 bytes from every occurrence of the
 # boundary string and since 5 of them are in the body contents, we see
 # (5*12) == 60 bytes less
-<protocol>
+<protocol crlf="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
@@ -69,11 +68,7 @@ Transfer-Encoding: chunked
 Content-Type: multipart/form-data; boundary=----------------------------
 Expect: 100-continue
 
-%if hyper
-7F
-%else
-7f
-%endif
+85
 ------------------------------
 Content-Disposition: form-data; name="field"
 Content-Transfer-Encoding: base64
@@ -81,7 +76,7 @@ Content-Transfer-Encoding: base64
 
 4
 ZHVt
-34
+3a
 bXk=
 --------------------------------
 
diff --git a/third-party/curl/tests/data/test668 b/third-party/curl/tests/data/test668
index ceffacafff..288f8c1343 100644
--- a/third-party/curl/tests/data/test668
+++ b/third-party/curl/tests/data/test668
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,21 +8,20 @@ HTTP MIME POST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
-Date: Tue, 09 Nov 2010 14:49:00 GMT
+Date: Tue, 09 Nov 2010 14:4f:00 GMT
 Server: test-server/fake swsclose
 Connection: close
 Content-Type: text/html
 
 hello
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
-Date: Tue, 09 Nov 2010 14:49:00 GMT
+Date: Tue, 09 Nov 2010 14:4f:00 GMT
 Server: test-server/fake swsclose
 Connection: close
 Content-Type: text/html
@@ -43,10 +43,10 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 HTTP mimepost early end of data detection
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER %LOGDIR/file%TESTNUMBER.txt
 </command>
 <file name="%LOGDIR/file%TESTNUMBER.txt">
@@ -54,53 +54,48 @@ This is data from a file
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
 # Note that the stripping above removes 12 bytes from every occurrence of the
 # boundary string and since 5 of them are in the body contents, we see
 # (5*12) == 60 bytes less
 <protocol>
-POST /%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-Accept: */*
-Transfer-Encoding: chunked
-Content-Type: multipart/form-data; boundary=----------------------------
-Expect: 100-continue
-
-%if hyper
-C1
-%else
-c1
-%endif
-------------------------------
-Content-Disposition: form-data; name="field1"
-
-dummy
-------------------------------
-Content-Disposition: form-data; name="field2"
-
-
-5
-dummy
-91
-
-------------------------------
-Content-Disposition: form-data; name="field3"; filename="file%TESTNUMBER.txt"
-Content-Type: text/plain
-
-
-49
+POST /%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+Accept: */*%CR
+Transfer-Encoding: chunked%CR
+Content-Type: multipart/form-data; boundary=----------------------------%CR
+Expect: 100-continue%CR
+%CR
+cd%CR
+------------------------------%CR
+Content-Disposition: form-data; name="field1"%CR
+%CR
+dummy%CR
+------------------------------%CR
+Content-Disposition: form-data; name="field2"%CR
+%CR
+%CR
+5%CR
+dummy%CR
+97%CR
+%CR
+------------------------------%CR
+Content-Disposition: form-data; name="field3"; filename="file%TESTNUMBER.txt"%CR
+Content-Type: text/plain%CR
+%CR
+%CR
+4f%CR
 This is data from a file
-
---------------------------------
-
-0
-
+%CR
+--------------------------------%CR
+%CR
+0%CR
+%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test669 b/third-party/curl/tests/data/test669
index cdb63f029b..2092a6001d 100644
--- a/third-party/curl/tests/data/test669
+++ b/third-party/curl/tests/data/test669
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,10 +28,10 @@ Mime
 <server>
 http
 </server>
- <name>
+<name>
 HTTP custom Content-Type with parameter
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -H 'Content-type: multipart/form-data; charset=utf-8' -F name=daniel -F tool=curl
 </command>
 </client>
@@ -38,15 +39,15 @@ http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -H 'Content-type: multipart/form-da
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 POST /we/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
-Content-Length: 242
+Content-Length: 260
 Content-Type: multipart/form-data; charset=utf-8; boundary=----------------------------
 
 ------------------------------
diff --git a/third-party/curl/tests/data/test67 b/third-party/curl/tests/data/test67
index 869f134920..19f15a4c9e 100644
--- a/third-party/curl/tests/data/test67
+++ b/third-party/curl/tests/data/test67
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -15,7 +16,7 @@ NTLM
 This is supposed to be returned when the server gets a first
 Authorization: NTLM line passed-in from the client -->
 
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 401 Now gimme that second request of crap
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -27,7 +28,7 @@ This is not the real page either!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 200 Things are fine in server land swsclose
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -36,7 +37,7 @@ Content-Length: 32
 Finally, this is the real page!
 </data1002>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Now gimme that second request of crap
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -73,10 +74,10 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --ntlm
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test670 b/third-party/curl/tests/data/test670
index bcf8ee92fe..77262b1049 100644
--- a/third-party/curl/tests/data/test670
+++ b/third-party/curl/tests/data/test670
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ MIME
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -19,7 +19,7 @@ Content-Type: text/html
 
 hello
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -43,26 +43,25 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 Request pause from mime read callback: multi
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
-Content-Length: 142
+Content-Length: 154
 Content-Type: multipart/form-data; boundary=----------------------------
 
 ------------------------------
diff --git a/third-party/curl/tests/data/test671 b/third-party/curl/tests/data/test671
index a951318ee7..5d7e3ef6d0 100644
--- a/third-party/curl/tests/data/test671
+++ b/third-party/curl/tests/data/test671
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ MIME
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -19,7 +19,7 @@ Content-Type: text/html
 
 hello
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -40,29 +40,28 @@ http
 </server>
 # tool is what to use instead of 'curl'
 <tool>
-lib%TESTNUMBER
+lib670
 </tool>
 
- <name>
+<name>
 Request pause from mime read callback: easy
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
-Content-Length: 142
+Content-Length: 154
 Content-Type: multipart/form-data; boundary=----------------------------
 
 ------------------------------
diff --git a/third-party/curl/tests/data/test672 b/third-party/curl/tests/data/test672
index ddcab3cc57..e89923e19e 100644
--- a/third-party/curl/tests/data/test672
+++ b/third-party/curl/tests/data/test672
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ FORM
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -19,7 +19,7 @@ Content-Type: text/html
 
 hello
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -40,29 +40,28 @@ http
 </server>
 # tool is what to use instead of 'curl'
 <tool>
-lib%TESTNUMBER
+lib670
 </tool>
 
- <name>
+<name>
 Request pause from form read callback: multi
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
-Content-Length: 142
+Content-Length: 154
 Content-Type: multipart/form-data; boundary=----------------------------
 
 ------------------------------
diff --git a/third-party/curl/tests/data/test673 b/third-party/curl/tests/data/test673
index f672ef4b89..ed15cea6d8 100644
--- a/third-party/curl/tests/data/test673
+++ b/third-party/curl/tests/data/test673
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ FORM
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -19,7 +19,7 @@ Content-Type: text/html
 
 hello
 </data>
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -40,29 +40,28 @@ http
 </server>
 # tool is what to use instead of 'curl'
 <tool>
-lib%TESTNUMBER
+lib670
 </tool>
 
- <name>
+<name>
 Request pause from form read callback: easy
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <strippart>
-s/^--------------------------[a-z0-9]*/------------------------------/
-s/boundary=------------------------[a-z0-9]*/boundary=----------------------------/
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
 </strippart>
-<protocol>
+<protocol crlf="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
-Content-Length: 142
+Content-Length: 154
 Content-Type: multipart/form-data; boundary=----------------------------
 
 ------------------------------
diff --git a/third-party/curl/tests/data/test674 b/third-party/curl/tests/data/test674
index 70b02ace4a..745d8eaa38 100644
--- a/third-party/curl/tests/data/test674
+++ b/third-party/curl/tests/data/test674
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -32,14 +33,14 @@ lib%TESTNUMBER
 </tool>
 <name>
 Set CURLOPT_CURLU and dupe the handle
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/third-party/curl/tests/data/test675 b/third-party/curl/tests/data/test675
index 664af67be5..60ce6e04ad 100644
--- a/third-party/curl/tests/data/test675
+++ b/third-party/curl/tests/data/test675
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP Basic auth
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Thu, 09 Nov 2010 14:49:00 GMT
 Content-Type: text/html
@@ -23,9 +24,9 @@ the content would go here
 <server>
 http
 </server>
- <name>
+<name>
 HTTP connection reuse and different credentials
- </name>
+</name>
 
 <command>
 http://user1:foo1@%HOSTIP:%HTTPPORT/user1/%TESTNUMBER http://user2:foo2@%HOSTIP:%HTTPPORT/user2/%TESTNUMBER
@@ -37,16 +38,16 @@ proxy
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /user1/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dXNlcjE6Zm9vMQ==
+Authorization: Basic %b64[user1:foo1]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
 GET /user2/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dXNlcjI6Zm9vMg==
+Authorization: Basic %b64[user2:foo2]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test676 b/third-party/curl/tests/data/test676
index 1189072275..0da221e68a 100644
--- a/third-party/curl/tests/data/test676
+++ b/third-party/curl/tests/data/test676
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,10 +10,9 @@ CURLOPT_REFERER
 curl_easy_reset
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
@@ -23,7 +23,7 @@ Content-Type: text/html
 </data>
 
 # since the request runs twice
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Length: 6
@@ -55,10 +55,10 @@ http
 lib%TESTNUMBER
 </tool>
 
- <name>
+<name>
 verify setting CURLOPT_COOKIEFILE to NULL again
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER %LOGDIR/cookies676
 </command>
 <features>
@@ -66,10 +66,9 @@ cookies
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: the-moo agent next generation
diff --git a/third-party/curl/tests/data/test677 b/third-party/curl/tests/data/test677
index 6024218fed..ebff275c02 100644
--- a/third-party/curl/tests/data/test677
+++ b/third-party/curl/tests/data/test677
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,22 +7,20 @@ CONNECT_ONLY
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP with CONNECT_ONLY, custom command then exit
- </name>
+</name>
 <tool>
 lib%TESTNUMBER
 </tool>
@@ -32,10 +31,9 @@ imap://%HOSTIP:%IMAPPORT/677
 
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A1 IDLE
 </protocol>
diff --git a/third-party/curl/tests/data/test678 b/third-party/curl/tests/data/test678
index 358cefec69..8df6707440 100644
--- a/third-party/curl/tests/data/test678
+++ b/third-party/curl/tests/data/test678
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ PEM certificate
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -20,35 +20,33 @@ MooMoo
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
 SSL
 </features>
 <server>
-https Server-localhost-sv.pem
+https test-localhost.pem
 </server>
- <name>
+<name>
 HTTPS GET using CURLOPT_CAINFO_BLOB
- </name>
+</name>
 <tool>
 lib%TESTNUMBER
 </tool>
 # provide URL and ca-cert
 <command>
-https://localhost:%HTTPSPORT/%TESTNUMBER %SRCDIR/certs/EdelCurlRoot-ca.crt
+https://localhost:%HTTPSPORT/%TESTNUMBER %CERTDIR/certs/test-ca.crt
 </command>
-# Ensure that we're running on localhost because we're checking the host name
+# Ensure that we are running on localhost because we are checking the hostname
 <precheck>
-./libtest/lib%TESTNUMBER check
+%LIBTESTS lib%TESTNUMBER check
 </precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: localhost:%HTTPSPORT
 User-Agent: CURLOPT_CAINFO_BLOB
diff --git a/third-party/curl/tests/data/test679 b/third-party/curl/tests/data/test679
index 6ba53212d3..6b995e3d10 100644
--- a/third-party/curl/tests/data/test679
+++ b/third-party/curl/tests/data/test679
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ HTTP
 netrc
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -24,30 +24,28 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
-netrc with quoted password
- </name>
- <command>
+<name>
+netrc with quoted username and password
+</name>
+<command>
 --netrc-optional --netrc-file %LOGDIR/netrc%TESTNUMBER http://%HOSTIP:%HTTPPORT/
 </command>
 <file name="%LOGDIR/netrc%TESTNUMBER" >
-machine %HOSTIP login user1 password "with spaces and \"\n\r\t\a"
+machine %HOSTIP login "user one" password "with spaces and \"\n\r\t\a"
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET / HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dXNlcjE6d2l0aCBzcGFjZXMgYW5kICIKDQlh
+Authorization: Basic %b64[user%20one:with%20spaces%20and%20"%0a%0d%09a]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test68 b/third-party/curl/tests/data/test68
index 73ac1c86d3..0e9576c867 100644
--- a/third-party/curl/tests/data/test68
+++ b/third-party/curl/tests/data/test68
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,7 +13,7 @@ NTLM
 
 # This is supposed to be returned when the server gets a first
 # Authorization: NTLM line passed-in from the client
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 401 Now gimme that second request of crap
 Server: Microsoft-IIS/5.0
 Content-Length: 34
@@ -24,7 +25,7 @@ This is not the real page either!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 401 You give me wrong password
 Server: Microsoft-IIS/5.0
 WWW-Authenticate: NTLM
@@ -34,7 +35,7 @@ Content-Type: text/html; charset=iso-8859-1
 Wrong password dude. Get it fixed and return.
 </data1002>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Now gimme that second request of crap
 Server: Microsoft-IIS/5.0
 Content-Length: 34
@@ -72,10 +73,10 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --ntlm
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test680 b/third-party/curl/tests/data/test680
index 2cd0d47fe0..698c333eda 100644
--- a/third-party/curl/tests/data/test680
+++ b/third-party/curl/tests/data/test680
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,24 +6,19 @@ HTTP
 netrc
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 http
 </features>
- <name>
+<name>
 netrc with quoted password but missing end quote
- </name>
- <command>
+</name>
+<command>
 --netrc --netrc-file %LOGDIR/netrc%TESTNUMBER http://user1@http.example/
 </command>
 <file name="%LOGDIR/netrc%TESTNUMBER" >
@@ -30,7 +26,6 @@ machine %HOSTIP login user1 password "with spaces and \"\n\r\t\a
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test681 b/third-party/curl/tests/data/test681
index 4f61650a77..4ae6b07db3 100644
--- a/third-party/curl/tests/data/test681
+++ b/third-party/curl/tests/data/test681
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -20,7 +20,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -34,10 +33,9 @@ http
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test682 b/third-party/curl/tests/data/test682
index 68a9aea392..4b443588a2 100644
--- a/third-party/curl/tests/data/test682
+++ b/third-party/curl/tests/data/test682
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ HTTP
 netrc
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -20,16 +20,15 @@ Connection: close
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 netrc with multiple logins - pick first
- </name>
- <command>
+</name>
+<command>
 --netrc-optional --netrc-file %LOGDIR/netrc%TESTNUMBER http://user1@%HOSTIP:%HTTPPORT/
 </command>
 <file name="%LOGDIR/netrc%TESTNUMBER" >
@@ -38,10 +37,9 @@ machine %HOSTIP login user2 password passwd2
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET / HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Authorization: Basic %b64[user1:passwd1]b64%
diff --git a/third-party/curl/tests/data/test683 b/third-party/curl/tests/data/test683
index 7e9b62cdc5..0f0047ad30 100644
--- a/third-party/curl/tests/data/test683
+++ b/third-party/curl/tests/data/test683
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ HTTP
 netrc
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -20,16 +20,15 @@ Connection: close
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 netrc with multiple logins - pick second
- </name>
- <command>
+</name>
+<command>
 --netrc-optional --netrc-file %LOGDIR/netrc%TESTNUMBER http://user2@%HOSTIP:%HTTPPORT/
 </command>
 <file name="%LOGDIR/netrc%TESTNUMBER" >
@@ -38,10 +37,9 @@ machine %HOSTIP login user2 password passwd2
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET / HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Authorization: Basic %b64[user2:passwd2]b64%
diff --git a/third-party/curl/tests/data/test684 b/third-party/curl/tests/data/test684
index 274a4a2b78..9350dd9d8d 100644
--- a/third-party/curl/tests/data/test684
+++ b/third-party/curl/tests/data/test684
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ HTTP
 netrc
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -20,16 +20,15 @@ Connection: close
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 netrc with no login
- </name>
- <command>
+</name>
+<command>
 --netrc-optional --netrc-file %LOGDIR/netrc%TESTNUMBER http://%HOSTIP:%HTTPPORT/
 </command>
 <file name="%LOGDIR/netrc%TESTNUMBER" >
@@ -37,10 +36,9 @@ machine %HOSTIP password 5up3r53cr37
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET / HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Authorization: Basic %b64[:5up3r53cr37]b64%
diff --git a/third-party/curl/tests/data/test685 b/third-party/curl/tests/data/test685
index 3a9cac55de..5346cd17ef 100644
--- a/third-party/curl/tests/data/test685
+++ b/third-party/curl/tests/data/test685
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ HTTP
 netrc
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -20,33 +20,33 @@ Connection: close
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
-netrc with no login - provided user
- </name>
- <command>
+<name>
+netrc with no login - but provided user in URL
+</name>
+<command>
 --netrc-optional --netrc-file %LOGDIR/netrc%TESTNUMBER http://user@%HOSTIP:%HTTPPORT/
 </command>
 <file name="%LOGDIR/netrc%TESTNUMBER" >
+machine %HOSTIP password firstthis login unknown
 machine %HOSTIP password 5up3r53cr37
+machine %HOSTIP password d1ff3r3nt login anotherone
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
-</protocol>
+<protocol crlf="headers">
 GET / HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Authorization: Basic %b64[user:5up3r53cr37]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
+</protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test686 b/third-party/curl/tests/data/test686
index 0badad0623..9bf84ebf35 100644
--- a/third-party/curl/tests/data/test686
+++ b/third-party/curl/tests/data/test686
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,26 +6,20 @@ errorcode
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
- <name>
+<name>
 verify return code for missing URL after --next
- </name>
- <command>
+</name>
+<command>
 htdhdhdtp://localhost --next
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test687 b/third-party/curl/tests/data/test687
index 4fd240d013..fd3052da60 100644
--- a/third-party/curl/tests/data/test687
+++ b/third-party/curl/tests/data/test687
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ xattr
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -22,14 +22,13 @@ Content-Type: fake/data
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 <features>
-debug
+Debug
 xattr
 </features>
 # simulate the xattr operations
@@ -44,10 +43,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --xattr -o %LOGDIR/out%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -55,6 +53,7 @@ Accept: */*
 
 </protocol>
 <stdout mode="text">
+user.creator => curl
 user.mime_type => fake/data
 user.xdg.origin.url => http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </stdout>
diff --git a/third-party/curl/tests/data/test688 b/third-party/curl/tests/data/test688
index f002ebec3d..44f621e33c 100644
--- a/third-party/curl/tests/data/test688
+++ b/third-party/curl/tests/data/test688
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ xattr
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -22,14 +22,13 @@ Content-Type: fake/data
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 <features>
-debug
+Debug
 xattr
 </features>
 # simulate the xattr operations
@@ -37,17 +36,16 @@ xattr
 CURL_FAKE_XATTR=1
 </setenv>
 <name>
-basic --xattr with -O
+basic --xattr with (uppercase) -O
 </name>
 <command>
 --xattr -O --output-dir %LOGDIR http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -55,6 +53,7 @@ Accept: */*
 
 </protocol>
 <stdout mode="text">
+user.creator => curl
 user.mime_type => fake/data
 user.xdg.origin.url => http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </stdout>
diff --git a/third-party/curl/tests/data/test689 b/third-party/curl/tests/data/test689
new file mode 100644
index 0000000000..13f514bd74
--- /dev/null
+++ b/third-party/curl/tests/data/test689
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+RTSP
+OPTIONS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+RTSP/1.0 786%repeat[10 x  ]%
+
+RTSP/%repeat[10 x  ]%
+</data>
+<datacheck>
+</datacheck>
+</reply>
+
+# Client-Side
+<client>
+<server>
+rtsp
+</server>
+<tool>
+lib567
+</tool>
+
+<name>
+fuzzing crash issue #12701
+</name>
+<command>
+rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER
+</command>
+</client>
+
+<verify>
+<protocol crlf="headers">
+OPTIONS rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER RTSP/1.0
+CSeq: 1
+User-Agent: test567
+Test-Number: 567
+
+</protocol>
+# 85 == CURLE_RTSP_CSEQ_ERROR
+<errorcode>
+85
+</errorcode>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test69 b/third-party/curl/tests/data/test69
index 52cb1e3dcb..a7f93226bd 100644
--- a/third-party/curl/tests/data/test69
+++ b/third-party/curl/tests/data/test69
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ NTLM
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Basic
@@ -23,7 +24,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a first
 # Authorization: NTLM line passed-in from the client
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 401 Now gimme that second request of crap
 Server: Microsoft-IIS/5.0
 Content-Length: 34
@@ -35,7 +36,7 @@ This is not the real page either!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 200 Things are fine in server land swsclose
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -44,7 +45,7 @@ Content-Length: 32
 Finally, this is the real page!
 </data1002>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Basic
@@ -89,7 +90,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --anyauth
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -97,7 +98,7 @@ Accept: */*
 
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test690 b/third-party/curl/tests/data/test690
new file mode 100644
index 0000000000..4eac70d657
--- /dev/null
+++ b/third-party/curl/tests/data/test690
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+-O with URL without path using trailing slash
+</name>
+<command option="no-output">
+http://%HOSTIP:%HTTPPORT/ -O --output-dir %LOGDIR
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET / HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/curl_response" crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test691 b/third-party/curl/tests/data/test691
new file mode 100644
index 0000000000..5c207884e8
--- /dev/null
+++ b/third-party/curl/tests/data/test691
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+-O with URL with path using trailing slash
+</name>
+<command option="no-output">
+http://%HOSTIP:%HTTPPORT/path/to/here/ -O --output-dir %LOGDIR
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /path/to/here/ HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/here" crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test692 b/third-party/curl/tests/data/test692
new file mode 100644
index 0000000000..4675e068dd
--- /dev/null
+++ b/third-party/curl/tests/data/test692
@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+-JO with URL without path using trailing slash
+</name>
+<command option="no-output/no-include">
+http://%HOSTIP:%HTTPPORT/ -JO --output-dir %LOGDIR
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET / HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/curl_response" crlf="headers">
+-foo-
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test693 b/third-party/curl/tests/data/test693
new file mode 100644
index 0000000000..0a6a649d3c
--- /dev/null
+++ b/third-party/curl/tests/data/test693
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+etag
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 funky chunky!
+Server: fakeit/0.9 fakeitbad/1.0
+Transfer-Encoding: chunked
+Trailer: chunky-trailer
+Connection: mooo
+ETag: W/"asdf"
+
+40
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+30
+bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
+21;heresatest=moooo
+cccccccccccccccccccccccccccccccc
+
+0
+chunky-trailer: header data
+
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+--etag-save with --create-dirs
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --etag-save %LOGDIR/moo/boo/etag%TESTNUMBER --create-dirs
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/moo/boo/etag%TESTNUMBER">
+W/"asdf"
+</file>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test694 b/third-party/curl/tests/data/test694
new file mode 100644
index 0000000000..bfc4181eba
--- /dev/null
+++ b/third-party/curl/tests/data/test694
@@ -0,0 +1,128 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP POST
+POST callback
+HTTP proxy
+HTTP proxy NTLM auth
+NTLM
+</keywords>
+</info>
+# Server-side
+<reply>
+
+<data crlf="headers">
+HTTP/1.1 401 Authorization Required
+Server: Apache/1.3.27 (Darwin) PHP/4.1.2
+WWW-Authenticate: Negotiate
+WWW-Authenticate: NTLM
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 26
+
+This is not the real page
+</data>
+
+# this is returned first since we get no proxy-auth
+<data1001 crlf="headers">
+HTTP/1.1 401 Authorization Required
+WWW-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
+Content-Length: 34
+
+Hey you, authenticate or go away!
+</data1001>
+
+# This is supposed to be returned when the server gets the second
+# Authorization: NTLM line passed-in from the client
+<data1002 crlf="headers">
+HTTP/1.1 200 Things are fine
+Server: Microsoft-IIS/5.0
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 42
+
+Contents of that page you requested, sir.
+</data1002>
+
+# This is supposed to be returned when the server gets the second
+# request.
+<data10 crlf="headers">
+HTTP/1.1 200 Things are fine
+Content-Type: yeah/maybe
+Content-Length: 42
+
+Contents of that second request. Differn.
+</data10>
+
+<datacheck crlf="headers">
+HTTP/1.1 401 Authorization Required
+Server: Apache/1.3.27 (Darwin) PHP/4.1.2
+WWW-Authenticate: Negotiate
+WWW-Authenticate: NTLM
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 26
+
+HTTP/1.1 401 Authorization Required
+WWW-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
+Content-Length: 34
+
+HTTP/1.1 200 Things are fine
+Server: Microsoft-IIS/5.0
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 42
+
+Contents of that page you requested, sir.
+HTTP/1.1 200 Things are fine
+Content-Type: yeah/maybe
+Content-Length: 42
+
+Contents of that second request. Differn.
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+# tool to use
+<tool>
+lib%TESTNUMBER
+</tool>
+<features>
+NTLM
+!SSPI
+</features>
+<name>
+HTTP with NTLM twice, verify CURLINFO_HTTPAUTH_USED
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/path/mine http://%HOSTIP:%HTTPPORT/path/%TESTNUMBER0010
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+
+<protocol crlf="headers">
+GET /path/mine HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+GET /path/mine HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
+Accept: */*
+
+GET /path/mine HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAAAgACAHAAAAALAAsAcgAAAAAAAAAAAAAAhoIBAAQt1KW5CgG4YdWWcfXyfXBz1ZMCzYp37xYjBiAizmw58O6eQS7yR66eqYGWeSwl9W1lV09SS1NUQVRJT04=
+Accept: */*
+
+GET /path/6940010 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test695 b/third-party/curl/tests/data/test695
new file mode 100644
index 0000000000..df65744731
--- /dev/null
+++ b/third-party/curl/tests/data/test695
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+MIME
+</keywords>
+</info>
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.0 200 OK swsclose
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+
+blablabla
+
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+Mime
+</features>
+<server>
+http
+</server>
+<tool>
+lib%TESTNUMBER
+</tool>
+
+<name>
+MIME parts reuse as a child part
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<strippart>
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
+</strippart>
+<protocol crlf="yes">
+POST /we/want/%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 196
+Content-Type: multipart/form-data; boundary=----------------------------
+
+------------------------------
+Content-Disposition: form-data; name="data"
+Content-Type: text/html
+
+<title>hello</title>
+--------------------------------
+POST /we/want/%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 423
+Content-Type: multipart/form-data; boundary=----------------------------
+
+------------------------------
+Content-Disposition: form-data
+Content-Type: multipart/mixed; boundary=----------------------------
+
+------------------------------
+Content-Disposition: attachment; name="data"
+Content-Type: text/html
+
+<title>hello</title>
+--------------------------------
+
+--------------------------------
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test696 b/third-party/curl/tests/data/test696
new file mode 100644
index 0000000000..ce85a5f5b3
--- /dev/null
+++ b/third-party/curl/tests/data/test696
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK swsclose
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+Content-Length: 6
+Connection: close
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<tool>
+lib556
+</tool>
+<name>
+CONNECT_ONLY and doing a second curl_easy_perform
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<stdout crlf="headers">
+HTTP/1.1 200 OK swsclose
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+Content-Length: 6
+Connection: close
+
+-foo-
+HTTP/1.1 200 OK swsclose
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+Content-Length: 6
+Connection: close
+
+-foo-
+</stdout>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: ninja
+
+GET /%TESTNUMBER HTTP/1.1
+Host: ninja
+
+</protocol>
+
+<errorcode>
+0
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test697 b/third-party/curl/tests/data/test697
new file mode 100644
index 0000000000..97c4bca6dc
--- /dev/null
+++ b/third-party/curl/tests/data/test697
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+netrc
+</keywords>
+</info>
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<features>
+http
+</features>
+<name>
+netrc with missing netrc file
+</name>
+<command>
+--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER http://user1@http.example/
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+2
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test698 b/third-party/curl/tests/data/test698
new file mode 100644
index 0000000000..a79df118b7
--- /dev/null
+++ b/third-party/curl/tests/data/test698
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+FTP
+ACCT
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+data
+    to
+      see
+that FTP
+works
+  so does it?
+</data>
+<servercmd>
+REPLY PASS 332 please provide account name
+REPLY ACCT 230 thank you
+</servercmd>
+</reply>
+
+# Client-side
+<client>
+<server>
+ftp
+</server>
+<name>
+FTP with ACCT and connection reuse
+</name>
+<command>
+ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --ftp-account "one count" ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+USER anonymous
+PASS ftp@example.com
+ACCT one count
+PWD
+EPSV
+TYPE I
+SIZE %TESTNUMBER
+RETR %TESTNUMBER
+EPSV
+SIZE %TESTNUMBER
+RETR %TESTNUMBER
+QUIT
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test699 b/third-party/curl/tests/data/test699
new file mode 100644
index 0000000000..87363c8007
--- /dev/null
+++ b/third-party/curl/tests/data/test699
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--config
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+--config with single-letter options plus one that is cleared
+</name>
+<file name="%LOGDIR/cmd">
+-Lfuhej:you
+</file>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -K %LOGDIR/cmd
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Authorization: Basic %b64[hej:you]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test7 b/third-party/curl/tests/data/test7
index 25e589158f..ccdac19273 100644
--- a/third-party/curl/tests/data/test7
+++ b/third-party/curl/tests/data/test7
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -28,17 +29,20 @@ Set-Cookie: partmatch=present; domain=.0.0.1; path=/;
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with cookie parser and header recording
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -b none -D %LOGDIR/heads%TESTNUMBER.txt
 </command>
+<features>
+cookies
+</features>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test70 b/third-party/curl/tests/data/test70
index 51a797afb6..d6044c7f66 100644
--- a/third-party/curl/tests/data/test70
+++ b/third-party/curl/tests/data/test70
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ HTTP Digest auth
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604199"
@@ -22,7 +23,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 OK
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -31,7 +32,7 @@ Content-Length: 23
 This IS the real page!
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604199"
@@ -54,21 +55,22 @@ This IS the real page!
 <features>
 !SSPI
 NTLM
+digest
 </features>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with Digest *OR* NTLM authorization
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --anyauth
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test700 b/third-party/curl/tests/data/test700
index 90667d1d6e..3349191035 100644
--- a/third-party/curl/tests/data/test700
+++ b/third-party/curl/tests/data/test700
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ SOCKS4
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -26,7 +26,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -36,18 +35,17 @@ proxy
 http
 socks4
 </server>
- <name>
+<name>
 HTTP GET via SOCKS4 proxy
- </name>
- <command>
+</name>
+<command>
 --socks4 %HOSTIP:%SOCKSPORT http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test701 b/third-party/curl/tests/data/test701
index 220a6534a6..047941e78d 100644
--- a/third-party/curl/tests/data/test701
+++ b/third-party/curl/tests/data/test701
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ SOCKS5
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -26,7 +26,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -36,18 +35,17 @@ proxy
 http
 socks5
 </server>
- <name>
+<name>
 HTTP GET via SOCKS5 proxy
- </name>
- <command>
+</name>
+<command>
 --socks5 %HOSTIP:%SOCKSPORT http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test702 b/third-party/curl/tests/data/test702
index 4e06f88890..ea565d4be5 100644
--- a/third-party/curl/tests/data/test702
+++ b/third-party/curl/tests/data/test702
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 #based off  19
 <info>
@@ -5,7 +6,6 @@
 HTTP
 SOCKS4
 connect to non-listen
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -30,10 +30,10 @@ socks4
 http
 proxy
 </features>
- <name>
+<name>
 Attempt connect to non-listening HTTP server via SOCKS4 proxy
- </name>
- <command>
+</name>
+<command>
 --socks4 %HOSTIP:%SOCKSPORT http://%HOSTIP:%NOLISTENPORT
 </command>
 </client>
diff --git a/third-party/curl/tests/data/test703 b/third-party/curl/tests/data/test703
index 3c3487aeec..197b0da2b4 100644
--- a/third-party/curl/tests/data/test703
+++ b/third-party/curl/tests/data/test703
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 #based off  19
 <info>
@@ -5,7 +6,6 @@
 HTTP
 SOCKS5
 connect to non-listen
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -27,10 +27,10 @@ socks5
 http
 proxy
 </features>
- <name>
+<name>
 Attempt connect to non-listening HTTP server via SOCKS5 proxy
- </name>
- <command>
+</name>
+<command>
 --socks5 %HOSTIP:%SOCKSPORT http://%HOSTIP:%NOLISTENPORT
 </command>
 </client>
diff --git a/third-party/curl/tests/data/test704 b/third-party/curl/tests/data/test704
index b9abc45e12..5ef11ea6f0 100644
--- a/third-party/curl/tests/data/test704
+++ b/third-party/curl/tests/data/test704
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 #based off  19
 <info>
@@ -5,7 +6,6 @@
 HTTP
 SOCKS4
 connect to non-listen
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -19,10 +19,10 @@ FAILURE
 <server>
 http
 </server>
- <name>
+<name>
 Attempt connect to non-listening SOCKS4 proxy
- </name>
- <command>
+</name>
+<command>
 --socks4 %HOSTIP:%NOLISTENPORT http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 <features>
diff --git a/third-party/curl/tests/data/test705 b/third-party/curl/tests/data/test705
index 5d3692dc40..c86289be67 100644
--- a/third-party/curl/tests/data/test705
+++ b/third-party/curl/tests/data/test705
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 #based off  19
 <info>
@@ -5,7 +6,6 @@
 HTTP
 SOCKS5
 connect to non-listen
-FAILURE
 </keywords>
 </info>
 # Server-side
@@ -19,10 +19,10 @@ FAILURE
 <server>
 http
 </server>
- <name>
+<name>
 Attempt connect to non-listening SOCKS5 proxy
- </name>
- <command>
+</name>
+<command>
 --socks5 %HOSTIP:%NOLISTENPORT http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 <features>
diff --git a/third-party/curl/tests/data/test706 b/third-party/curl/tests/data/test706
index 2838812b31..5981fb5d39 100644
--- a/third-party/curl/tests/data/test706
+++ b/third-party/curl/tests/data/test706
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 #based off test 100
 <info>
@@ -8,12 +9,9 @@ LIST
 SOCKS4
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -25,10 +23,9 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -38,18 +35,17 @@ proxy
 ftp
 socks4
 </server>
- <name>
+<name>
 FTP dir list PASV via SOCKS4
- </name>
- <command>
+</name>
+<command>
 --socks4 %HOSTIP:%SOCKSPORT ftp://%HOSTIP:%FTPPORT/
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test707 b/third-party/curl/tests/data/test707
index 639ab72880..a14d826d8e 100644
--- a/third-party/curl/tests/data/test707
+++ b/third-party/curl/tests/data/test707
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 #based off test 100
 <info>
@@ -8,12 +9,9 @@ LIST
 SOCKS5
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-# When doing LIST, we get the default list output hard-coded in the test
-# FTP server
-<datacheck mode="text">
+<data mode="text">
 total 20
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
 drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
@@ -25,10 +23,9 @@ drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
 dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
 drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
 dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -38,18 +35,17 @@ proxy
 ftp
 socks5
 </server>
- <name>
+<name>
 FTP dir list PASV via SOCKS5
- </name>
- <command>
+</name>
+<command>
 --socks5 %HOSTIP:%SOCKSPORT ftp://%HOSTIP:%FTPPORT/
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test708 b/third-party/curl/tests/data/test708
index 53c380d66a..e96900b52b 100644
--- a/third-party/curl/tests/data/test708
+++ b/third-party/curl/tests/data/test708
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ SOCKS4
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -26,7 +26,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -39,18 +38,17 @@ socks4
 <setenv>
 all_proxy=socks4://%HOSTIP:%SOCKSPORT
 </setenv>
- <name>
-HTTP GET via SOCKS4 proxy
- </name>
- <command>
+<name>
+HTTP GET via SOCKS4 all_proxy
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test709 b/third-party/curl/tests/data/test709
index 54cf3fbfa5..ed234b4ae0 100644
--- a/third-party/curl/tests/data/test709
+++ b/third-party/curl/tests/data/test709
@@ -1,13 +1,14 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
 SOCKS5
+http_proxy
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -26,7 +27,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -39,18 +39,17 @@ socks5
 <setenv>
 http_proxy=socks5://%HOSTIP:%SOCKSPORT
 </setenv>
- <name>
+<name>
 HTTP GET via SOCKS5 set in http_proxy environment variable
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test71 b/third-party/curl/tests/data/test71
index 75b832699f..9e978ebf90 100644
--- a/third-party/curl/tests/data/test71
+++ b/third-party/curl/tests/data/test71
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -27,16 +28,16 @@ Mime
 <server>
 http
 </server>
- <name>
+<name>
 HTTP and -F upload in config file
- </name>
+</name>
 <stdin>
 -F name=daniel
 -F tool=curl
 -F file=@%LOGDIR/test%TESTNUMBER.txt
 user-agent = ""
 </stdin>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -K -
 </command>
 # We create this file before the command is invoked!
@@ -53,29 +54,29 @@ bar
 ^(Content-Type: multipart/form-data;|------------).*
 </strip>
 <protocol>
-POST /we/want/%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-Accept: */*
-Content-Length: 408
-Content-Type: multipart/form-data; boundary=----------------------------9ef8d6205763
-
-------------------------------9ef8d6205763
-Content-Disposition: form-data; name="name"
-
-daniel
-------------------------------9ef8d6205763
-Content-Disposition: form-data; name="tool"
-
-curl
-------------------------------9ef8d6205763
-Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER.txt"
-Content-Type: text/plain
-
+POST /we/want/%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+Accept: */*%CR
+Content-Length: 432%CR
+Content-Type: multipart/form-data; boundary=----------------------------9ef8d6205763%CR
+%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: form-data; name="name"%CR
+%CR
+daniel%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: form-data; name="tool"%CR
+%CR
+curl%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: form-data; name="file"; filename="test%TESTNUMBER.txt"%CR
+Content-Type: text/plain%CR
+%CR
 foo-
 This is a moo-
 bar
-
-------------------------------9ef8d6205763--
+%CR
+------------------------------9ef8d6205763--%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test710 b/third-party/curl/tests/data/test710
index 6032946801..b974cd66e5 100644
--- a/third-party/curl/tests/data/test710
+++ b/third-party/curl/tests/data/test710
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ SOCKS5
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -26,7 +26,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -36,18 +35,17 @@ proxy
 http
 socks5
 </server>
- <name>
+<name>
 HTTP GET via SOCKS5 set with --proxy
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --proxy socks5://%HOSTIP:%SOCKSPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test711 b/third-party/curl/tests/data/test711
index 4e6c16dc9e..9e73893c73 100644
--- a/third-party/curl/tests/data/test711
+++ b/third-party/curl/tests/data/test711
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 #based off test 707 after bug report #1218
 <info>
@@ -9,7 +10,6 @@ SOCKS5
 all_proxy
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -19,7 +19,6 @@ silly content
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -32,18 +31,17 @@ socks5
 <setenv>
 all_proxy=socks5://%HOSTIP:%SOCKSPORT
 </setenv>
- <name>
+<name>
 FTP fetch with all_proxy set to socks5
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test712 b/third-party/curl/tests/data/test712
index 0d03ab2cf7..97161f8f4e 100644
--- a/third-party/curl/tests/data/test712
+++ b/third-party/curl/tests/data/test712
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 #based off test 707 after bug report #1218
 <info>
@@ -8,7 +9,6 @@ RETR
 SOCKS5
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -16,7 +16,6 @@ silly content
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -26,18 +25,17 @@ proxy
 ftp
 socks5
 </server>
- <name>
+<name>
 FTP fetch with --proxy set to socks5://
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%FTPPORT/%TESTNUMBER --proxy socks5://%HOSTIP:%SOCKSPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test713 b/third-party/curl/tests/data/test713
index 5136b9bca3..c3b779f463 100644
--- a/third-party/curl/tests/data/test713
+++ b/third-party/curl/tests/data/test713
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 #based off test 712
 <info>
@@ -9,7 +10,6 @@ SOCKS5
 CURLOPT_CONNECT_TO
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -17,7 +17,6 @@ silly content
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -27,18 +26,17 @@ proxy
 ftp
 socks5
 </server>
- <name>
+<name>
 FTP fetch with --proxy set to socks5:// and with --connect-to
- </name>
- <command>
+</name>
+<command>
 ftp://ftp.example.com/%TESTNUMBER --connect-to ::%HOSTIP:%FTPPORT --proxy socks5://%HOSTIP:%SOCKSPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test714 b/third-party/curl/tests/data/test714
index b5479302fa..cae8486372 100644
--- a/third-party/curl/tests/data/test714
+++ b/third-party/curl/tests/data/test714
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 #based off test 712
 <info>
@@ -11,7 +12,6 @@ proxytunnel
 CURLOPT_CONNECT_TO
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <connect>
@@ -32,7 +32,6 @@ silly content
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -46,18 +45,17 @@ http-proxy
 http
 proxy
 </features>
- <name>
+<name>
 FTP fetch with --proxy set to http:// and with --connect-to
- </name>
- <command>
+</name>
+<command>
 ftp://ftp.example.com.%TESTNUMBER/%TESTNUMBER --connect-to ::connect.example.com.%TESTNUMBER:%FTPPORT --proxytunnel --proxy http://%HOSTIP:%PROXYPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test715 b/third-party/curl/tests/data/test715
index 1694429407..4c30e2e2de 100644
--- a/third-party/curl/tests/data/test715
+++ b/third-party/curl/tests/data/test715
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 #based off test 712
 <info>
@@ -12,7 +13,6 @@ SOCKS5
 CURLOPT_CONNECT_TO
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <connect>
@@ -33,7 +33,6 @@ silly content
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -48,18 +47,17 @@ socks5
 http
 proxy
 </features>
- <name>
+<name>
 FTP fetch with --preproxy, --proxy and --connect-to
- </name>
- <command>
+</name>
+<command>
 ftp://ftp.example.com.%TESTNUMBER/%TESTNUMBER --connect-to ::connect.example.com.%TESTNUMBER:%FTPPORT --proxytunnel --proxy %HOSTIP:%PROXYPORT --preproxy socks5://%HOSTIP:%SOCKSPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 USER anonymous
 PASS ftp@example.com
 PWD
diff --git a/third-party/curl/tests/data/test716 b/third-party/curl/tests/data/test716
index 4de1cd95fd..6f692fbd09 100644
--- a/third-party/curl/tests/data/test716
+++ b/third-party/curl/tests/data/test716
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ SOCKS5
 all_proxy
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 # method 2 is SOCKS5 asking for user+password
@@ -15,7 +15,6 @@ method 2
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -26,16 +25,15 @@ http
 proxy
 </features>
 <name>
-SOCKS5 proxy with too long user name
+SOCKS5 proxy with too long username
 </name>
 
 # it should never connect to the target server
- <command>
-http://hohoho.example.com:99/%TESTNUMBER -x socks5://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:b@%HOSTIP:%SOCKSPORT
+<command>
+http://hohoho.example.com:99/%TESTNUMBER -x socks5://%repeat[256 x A]%:b@%HOSTIP:%SOCKSPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
diff --git a/third-party/curl/tests/data/test717 b/third-party/curl/tests/data/test717
index 5a0f13275b..0afab3daf1 100644
--- a/third-party/curl/tests/data/test717
+++ b/third-party/curl/tests/data/test717
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ SOCKS5
 all_proxy
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -32,7 +32,6 @@ backendport %HTTPPORT
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -43,8 +42,8 @@ http
 SOCKS5 proxy auth
 </name>
 
-# target a port that won't work without the SOCKS magic
- <command>
+# target a port that does not work without the SOCKS magic
+<command>
 http://%HOSTIP:1/%TESTNUMBER -x socks5://uz3r:p4ssworm@%HOSTIP:%SOCKSPORT
 </command>
 <features>
@@ -52,10 +51,9 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:1
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test718 b/third-party/curl/tests/data/test718
index eb34d1c318..0555c20d19 100644
--- a/third-party/curl/tests/data/test718
+++ b/third-party/curl/tests/data/test718
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -14,13 +15,13 @@ HTTP proxy Digest auth
 <reply>
 
 # this is returned first since we get no proxy-auth
-<connect>
+<connect crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me swsclose
 Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
 
 </connect>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 407 Authorization Required to proxy me swsclose
 Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
 
@@ -37,17 +38,17 @@ http
 crypto
 proxy
 </features>
- <name>
+<name>
 HTTP proxy CONNECT (no auth) with proxy returning 407 and closing
- </name>
- <command>
+</name>
+<command>
 http://test.remote.haxx.se.%TESTNUMBER:8990/path/%TESTNUMBER0002 --proxy http://%HOSTIP:%HTTPPORT --proxytunnel
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 CONNECT test.remote.haxx.se.%TESTNUMBER:8990 HTTP/1.1
 Host: test.remote.haxx.se.%TESTNUMBER:8990
 User-Agent: curl/%VERSION
@@ -55,7 +56,7 @@ Proxy-Connection: Keep-Alive
 
 </protocol>
 <errorcode>
-56
+7
 </errorcode>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test719 b/third-party/curl/tests/data/test719
index de3aacca68..5f85a29f0e 100644
--- a/third-party/curl/tests/data/test719
+++ b/third-party/curl/tests/data/test719
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ SOCKS5h
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -27,29 +27,27 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-ipv6
+IPv6
 proxy
 </features>
 <server>
 http
 socks5
 </server>
- <name>
+<name>
 HTTP GET with IPv6 numerical via SOCKS5h
- </name>
- <command>
+</name>
+<command>
 http://[2200::33]:%HTTPPORT/%TESTNUMBER --proxy socks5h://%HOSTIP:%SOCKSPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: [2200::33]:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test72 b/third-party/curl/tests/data/test72
index ab8c7ba4c2..98a7de4e04 100644
--- a/third-party/curl/tests/data/test72
+++ b/third-party/curl/tests/data/test72
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,7 @@ HTTP Digest auth
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Basic realm="foothis"
@@ -21,7 +22,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 OK
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -30,7 +31,7 @@ Content-Length: 23
 This IS the real page!
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Basic realm="foothis"
@@ -56,18 +57,19 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP with Digest *OR* Basic authorization
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --anyauth
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test720 b/third-party/curl/tests/data/test720
index ee28a0fc8c..1b9a496ddf 100644
--- a/third-party/curl/tests/data/test720
+++ b/third-party/curl/tests/data/test720
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ SOCKS5h
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -27,7 +27,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -37,18 +36,17 @@ proxy
 http
 socks5
 </server>
- <name>
+<name>
 HTTP GET with IPv4 numerical via SOCKS5h
- </name>
- <command>
+</name>
+<command>
 http://12.34.56.78:%HTTPPORT/%TESTNUMBER --proxy socks5h://%HOSTIP:%SOCKSPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: 12.34.56.78:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test721 b/third-party/curl/tests/data/test721
index 514171ed68..582c8e5208 100644
--- a/third-party/curl/tests/data/test721
+++ b/third-party/curl/tests/data/test721
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ SOCKS5h
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -27,7 +27,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -37,18 +36,17 @@ proxy
 http
 socks5
 </server>
- <name>
-HTTP GET with host name using SOCKS5h
- </name>
- <command>
+<name>
+HTTP GET with hostname using SOCKS5h
+</name>
+<command>
 http://this.is.a.host.name:%HTTPPORT/%TESTNUMBER --proxy socks5h://%HOSTIP:%SOCKSPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: this.is.a.host.name:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test722 b/third-party/curl/tests/data/test722
new file mode 100644
index 0000000000..c28d1b977c
--- /dev/null
+++ b/third-party/curl/tests/data/test722
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPFS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 21
+Connection: close
+Content-Type: text/plain
+Funny-head: yesyes
+
+Hello curl from IPFS
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+</features>
+<server>
+http
+</server>
+<name>
+IPFS
+</name>
+<command>
+--ipfs-gateway http://%HOSTIP:%HTTPPORT ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /ipfs/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test723 b/third-party/curl/tests/data/test723
new file mode 100644
index 0000000000..a9ff3d40c3
--- /dev/null
+++ b/third-party/curl/tests/data/test723
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPFS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+</features>
+<server>
+http
+</server>
+<name>
+IPFS with malformed gateway URL (bad function argument error)
+</name>
+<command>
+--ipfs-gateway http://nonexisting,local:8080 ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+# malformed gateway URL (bad function argument error)
+<errorcode>
+43
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test724 b/third-party/curl/tests/data/test724
new file mode 100644
index 0000000000..b03484820a
--- /dev/null
+++ b/third-party/curl/tests/data/test724
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPFS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 21
+Connection: close
+Content-Type: text/plain
+Funny-head: yesyes
+
+Hello curl from IPFS
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+</features>
+<server>
+http
+</server>
+<setenv>
+HOME=%PWD/%LOGDIR
+</setenv>
+<name>
+IPFS with gateway URL from gateway file
+</name>
+<command>
+ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u
+</command>
+<file name="%LOGDIR/.ipfs/gateway" >
+http://%HOSTIP:%HTTPPORT
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /ipfs/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test725 b/third-party/curl/tests/data/test725
new file mode 100644
index 0000000000..0cc6a760a8
--- /dev/null
+++ b/third-party/curl/tests/data/test725
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPFS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+</features>
+<server>
+http
+</server>
+<setenv>
+HOME=%PWD/%LOGDIR
+</setenv>
+<name>
+IPFS with malformed gateway URL from gateway file
+</name>
+<command>
+ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u
+</command>
+<file name="%LOGDIR/.ipfs/gateway" >
+http://nonexisting,local:8080
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+3
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test726 b/third-party/curl/tests/data/test726
new file mode 100644
index 0000000000..15358ea519
--- /dev/null
+++ b/third-party/curl/tests/data/test726
@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPFS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+</features>
+<server>
+http
+</server>
+<setenv>
+# Set a home that does not have a ".ipfs" folder. %PWD should be good.
+# This is to prevent the automatic gateway detection from finding a gateway file in your home folder.
+HOME=%PWD
+</setenv>
+<name>
+IPFS with no gateway URL (no environment or home file either)
+</name>
+<command>
+ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u
+</command>
+</client>
+
+# Verify with no gateway URL and no auto detection
+<verify>
+<errorcode>
+37
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test727 b/third-party/curl/tests/data/test727
new file mode 100644
index 0000000000..b4bdd11c38
--- /dev/null
+++ b/third-party/curl/tests/data/test727
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPNS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 21
+Connection: close
+Content-Type: text/plain
+Funny-head: yesyes
+
+Hello curl from IPNS
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+</features>
+<server>
+http
+</server>
+<name>
+IPNS
+</name>
+<command>
+--ipfs-gateway http://%HOSTIP:%HTTPPORT ipns://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /ipns/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test728 b/third-party/curl/tests/data/test728
new file mode 100644
index 0000000000..0adb71fe3c
--- /dev/null
+++ b/third-party/curl/tests/data/test728
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+SOCKS5
+SOCKS5h
+followlocation
+</keywords>
+</info>
+
+# Server-side
+<reply>
+# The hostname in this redirect is 256 characters and too long (> 255) for
+# SOCKS5 remote resolve. curl must return error CURLE_PROXY in this case.
+<data>
+HTTP/1.1 301 Moved Permanently
+Location: http://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/
+Content-Length: 0
+Connection: close
+
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+proxy
+</features>
+<server>
+http
+socks5
+</server>
+<name>
+SOCKS5h with HTTP redirect to hostname too long
+</name>
+<command>
+--no-progress-meter --location --proxy socks5h://%HOSTIP:%SOCKSPORT http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<errorcode>
+97
+</errorcode>
+# the error message is verified because error code CURLE_PROXY (97) may be
+# returned for any number of reasons and we need to make sure it is
+# specifically for the reason below so that we know the check is working.
+<stderr mode="text">
+curl: (97) SOCKS5: the destination hostname is too long to be resolved remotely by the proxy.
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test729 b/third-party/curl/tests/data/test729
new file mode 100644
index 0000000000..e2d194b8d6
--- /dev/null
+++ b/third-party/curl/tests/data/test729
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+SOCKS4
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<features>
+proxy
+</features>
+<server>
+http
+socks4
+</server>
+<name>
+SOCKS4 with long proxy username
+</name>
+<command>
+http://fake --limit-rate 1 -x socks4a://%repeat[1015 x a]%@%HOSTIP:%SOCKSPORT
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+# CURLE_PROXY
+<errorcode>
+97
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test73 b/third-party/curl/tests/data/test73
index 77ed2f4f8b..b9864e83f7 100644
--- a/third-party/curl/tests/data/test73
+++ b/third-party/curl/tests/data/test73
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ cookiejar
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 200 OK swsclose
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Content-Type: text/html
@@ -25,10 +26,10 @@ boo
 <server>
 http
 </server>
- <name>
+<name>
 HTTP, receive cookies when using custom Host:, domain using only two dots
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -c %LOGDIR/jar%TESTNUMBER.txt -H "Host: host.NOT_DISCLOSED.se"
 </command>
 <features>
@@ -38,7 +39,7 @@ cookies
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/%TESTNUMBER HTTP/1.1
 Host: host.NOT_DISCLOSED.se
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test730 b/third-party/curl/tests/data/test730
new file mode 100644
index 0000000000..69210daae2
--- /dev/null
+++ b/third-party/curl/tests/data/test730
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPFS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 21
+Connection: close
+Content-Type: text/plain
+Funny-head: yesyes
+
+Hello curl from IPFS
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+</features>
+<server>
+http
+</server>
+<name>
+IPFS arg gateway with path
+</name>
+<command>
+--ipfs-gateway http://%HOSTIP:%HTTPPORT/foo/bar ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /foo/bar/ipfs/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test731 b/third-party/curl/tests/data/test731
new file mode 100644
index 0000000000..b2ffb63af7
--- /dev/null
+++ b/third-party/curl/tests/data/test731
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPFS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 21
+Connection: close
+Content-Type: text/plain
+Funny-head: yesyes
+
+Hello curl from IPFS
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+</features>
+<server>
+http
+</server>
+<setenv>
+HOME=%PWD/%LOGDIR
+</setenv>
+<name>
+IPFS with gateway URL and path from gateway file
+</name>
+<command>
+ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u
+</command>
+<file name="%LOGDIR/.ipfs/gateway" >
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER/ipfs/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test732 b/third-party/curl/tests/data/test732
new file mode 100644
index 0000000000..f5117d7589
--- /dev/null
+++ b/third-party/curl/tests/data/test732
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPFS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 21
+Connection: close
+Content-Type: text/plain
+Funny-head: yesyes
+
+Hello curl from IPFS
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+</features>
+<server>
+http
+</server>
+<name>
+IPFS with path
+</name>
+<command>
+--ipfs-gateway http://%HOSTIP:%HTTPPORT "ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u/a/b"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /ipfs/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u/a/b HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test733 b/third-party/curl/tests/data/test733
new file mode 100644
index 0000000000..d9130f396d
--- /dev/null
+++ b/third-party/curl/tests/data/test733
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPFS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 21
+Connection: close
+Content-Type: text/plain
+Funny-head: yesyes
+
+Hello curl from IPFS
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+</features>
+<server>
+http
+</server>
+<name>
+IPFS with path and query args
+</name>
+<command>
+--ipfs-gateway http://%HOSTIP:%HTTPPORT "ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u/a/b?foo=bar%AMPaaa=bbb"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /ipfs/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u/a/b?foo=bar%AMPaaa=bbb HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test734 b/third-party/curl/tests/data/test734
new file mode 100644
index 0000000000..208a5fb6ed
--- /dev/null
+++ b/third-party/curl/tests/data/test734
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPFS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 21
+Connection: close
+Content-Type: text/plain
+Funny-head: yesyes
+
+Hello curl from IPFS
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+</features>
+<server>
+http
+</server>
+<name>
+IPFS with path, query args and gateway with path
+</name>
+<command>
+--ipfs-gateway http://%HOSTIP:%HTTPPORT/some/path "ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u/a/b?foo=bar%AMPaaa=bbb"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /some/path/ipfs/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u/a/b?foo=bar%AMPaaa=bbb HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test735 b/third-party/curl/tests/data/test735
new file mode 100644
index 0000000000..2288050632
--- /dev/null
+++ b/third-party/curl/tests/data/test735
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPFS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 21
+Connection: close
+Content-Type: text/plain
+Funny-head: yesyes
+
+Hello curl from IPFS
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+</features>
+<server>
+http
+</server>
+<name>
+IPNS with path, query args and gateway with path
+</name>
+<command>
+--ipfs-gateway http://%HOSTIP:%HTTPPORT/some/path "ipns://fancy.tld/a/b?foo=bar%AMPaaa=bbb"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /some/path/ipns/fancy.tld/a/b?foo=bar%AMPaaa=bbb HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test736 b/third-party/curl/tests/data/test736
new file mode 100644
index 0000000000..8419ed6aee
--- /dev/null
+++ b/third-party/curl/tests/data/test736
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPFS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 21
+Connection: close
+Content-Type: text/plain
+Funny-head: yesyes
+
+Hello curl from IPFS
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+</features>
+<server>
+http
+</server>
+<setenv>
+IPFS_PATH=%LOGDIR/.ipfs
+</setenv>
+<name>
+IPFS with IPFS_PATH set, no trailing slash
+</name>
+<command>
+ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u
+</command>
+<file name="%LOGDIR/.ipfs/gateway" >
+http://%HOSTIP:%HTTPPORT
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /ipfs/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test737 b/third-party/curl/tests/data/test737
new file mode 100644
index 0000000000..4367ce3c43
--- /dev/null
+++ b/third-party/curl/tests/data/test737
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPFS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 21
+Connection: close
+Content-Type: text/plain
+Funny-head: yesyes
+
+Hello curl from IPFS
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+</features>
+<server>
+http
+</server>
+<setenv>
+IPFS_PATH=%LOGDIR/.ipfs/
+</setenv>
+<name>
+IPFS with IPFS_PATH set, with trailing slash
+</name>
+<command>
+ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u
+</command>
+<file name="%LOGDIR/.ipfs/gateway" >
+http://%HOSTIP:%HTTPPORT
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /ipfs/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test738 b/third-party/curl/tests/data/test738
new file mode 100644
index 0000000000..1c2c6d73d3
--- /dev/null
+++ b/third-party/curl/tests/data/test738
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPFS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+</features>
+<server>
+http
+</server>
+<setenv>
+IPFS_PATH=%LOGDIR/.ipfs/
+</setenv>
+<name>
+IPFS with IPFS_PATH, no gateway file
+</name>
+<command>
+ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u
+</command>
+</client>
+
+# Verify error code with no gateway file (detection fails)
+<verify>
+<errorcode>
+37
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test739 b/third-party/curl/tests/data/test739
new file mode 100644
index 0000000000..06b73f9027
--- /dev/null
+++ b/third-party/curl/tests/data/test739
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPFS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+</features>
+<server>
+http
+</server>
+<name>
+IPNS path and query args for gateway and IPFS URL (malformed gateway URL)
+</name>
+<command>
+--ipfs-gateway "http://%HOSTIP:%HTTPPORT/some/path?biz=baz" "ipns://fancy.tld/a/b?foo=bar%AMPaaa=bbb"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+3
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test74 b/third-party/curl/tests/data/test74
index bfb74d132c..b73c9ad328 100644
--- a/third-party/curl/tests/data/test74
+++ b/third-party/curl/tests/data/test74
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ globbing
 {} list
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -33,24 +33,22 @@ crap data
 </data1>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP, urlglob {}-retrieval and -o #[num] usage
- </name>
- <command option="no-output">
+</name>
+<command option="no-output">
 "http://%HOSTIP:%HTTPPORT/{%TESTNUMBER,%TESTNUMBER0001}" -o "%LOGDIR/dumpit#1.dump"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test740 b/third-party/curl/tests/data/test740
new file mode 100644
index 0000000000..85c3325bb7
--- /dev/null
+++ b/third-party/curl/tests/data/test740
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPFS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 21
+Connection: close
+Content-Type: text/plain
+Funny-head: yesyes
+
+Hello curl from IPFS
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+</features>
+<server>
+http
+</server>
+<setenv>
+HOME=%PWD/%LOGDIR
+</setenv>
+<name>
+IPFS with gateway URL from multiline gateway file
+</name>
+<command>
+ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u
+</command>
+<file name="%LOGDIR/.ipfs/gateway" >
+http://%HOSTIP:%HTTPPORT
+foo
+bar
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /ipfs/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test741 b/third-party/curl/tests/data/test741
new file mode 100644
index 0000000000..2c118b657d
--- /dev/null
+++ b/third-party/curl/tests/data/test741
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IPFS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<features>
+ipfs
+</features>
+<server>
+http
+</server>
+<setenv>
+HOME=%PWD/%LOGDIR
+</setenv>
+<name>
+IPFS malformed gw URL from multiline gateway file, first line no URL
+</name>
+<command>
+ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u
+</command>
+<file name="%LOGDIR/.ipfs/gateway" >
+foo
+bar
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+# malformed gateway URL, first line in file must be a gateway URL
+<errorcode>
+3
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test742 b/third-party/curl/tests/data/test742
new file mode 100644
index 0000000000..100d414cd7
--- /dev/null
+++ b/third-party/curl/tests/data/test742
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+SOCKS5
+all_proxy
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+# method 2 is SOCKS5 asking for user+password
+<servercmd>
+method 2
+user %repeat[255 x a]%
+password %repeat[255 x b]%
+backendport %HTTPPORT
+</servercmd>
+</reply>
+
+# Client-side
+<client>
+<server>
+socks5
+http
+</server>
+<name>
+SOCKS5-hostname with max length credentials and max hostname length
+</name>
+
+# target a port that does not work without the SOCKS magic
+<command>
+http://%repeat[254 x c]%:%HTTPPORT -x socks5h://%repeat[255 x a]%:%repeat[255 x b]%@%HOSTIP:%SOCKSPORT
+</command>
+<features>
+proxy
+</features>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET / HTTP/1.1
+Host: %repeat[254 x c]%:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test743 b/third-party/curl/tests/data/test743
new file mode 100644
index 0000000000..8627c36c10
--- /dev/null
+++ b/third-party/curl/tests/data/test743
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--config
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+--config with a 127-byte line
+</name>
+<file name="%LOGDIR/config" nonewline="yes">
+-A pointless
+data = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+</file>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -K %LOGDIR/config
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+POST /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: pointless
+Accept: */*
+Content-Length: 118
+Content-Type: application/x-www-form-urlencoded
+
+%repeat[118 x x]%
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test744 b/third-party/curl/tests/data/test744
new file mode 100644
index 0000000000..06f99e8379
--- /dev/null
+++ b/third-party/curl/tests/data/test744
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--netrc-file
+netrc
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Content-Length: 9
+
+contents
+</data>
+<connect crlf="headers">
+HTTP/1.1 200 Mighty fine indeed
+
+</connect>
+<datacheck>
+HTTP/1.1 200 Mighty fine indeed%CR
+%CR
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Content-Length: 9
+
+contents
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+http-proxy
+</server>
+<name>
+--netrc-file with a 127-byte line
+</name>
+<file name="%LOGDIR/netrc%TESTNUMBER" nonewline="yes">
+machine foo.host login foo password baaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaar
+</file>
+<command>
+http://foo.host:%HTTPPORT/%TESTNUMBER -p --proxy1.0 %HOSTIP:%PROXYPORT -A "" --netrc-file %LOGDIR/netrc%TESTNUMBER
+</command>
+<features>
+proxy
+</features>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<proxy crlf="headers">
+CONNECT foo.host:%HTTPPORT HTTP/1.0
+Host: foo.host:%HTTPPORT
+Proxy-Connection: Keep-Alive
+
+</proxy>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: foo.host:%HTTPPORT
+Authorization: Basic %b64[foo:baaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaar]b64%
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test745 b/third-party/curl/tests/data/test745
new file mode 100644
index 0000000000..fca1a1505b
--- /dev/null
+++ b/third-party/curl/tests/data/test745
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+source analysis
+symbols-in-versions
+</keywords>
+</info>
+
+# Client-side
+<client>
+
+<name>
+Verify that typecheck-gcc and curl.h are in sync
+</name>
+
+<command type="perl">
+%SRCDIR/test745.pl %SRCDIR/..
+</command>
+</client>
+
+<verify>
+<stdout>
+OK
+</stdout>
+</verify>
+
+</testcase>
diff --git a/third-party/curl/tests/data/test746 b/third-party/curl/tests/data/test746
new file mode 100644
index 0000000000..0c25ac9ddf
--- /dev/null
+++ b/third-party/curl/tests/data/test746
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+cmdline
+</keywords>
+</info>
+
+# Client-side
+<client>
+<name>
+too large numerical value passed to -m
+</name>
+<command>
+http://neverused.example/ -m 22222242222222222
+</command>
+</client>
+
+<verify>
+<errorcode>
+2
+</errorcode>
+<stderr mode="text">
+curl: option -m: expected a proper numerical parameter
+%if manual
+curl: try 'curl --help' or 'curl --manual' for more information
+%else
+curl: try 'curl --help' for more information
+%endif
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test747 b/third-party/curl/tests/data/test747
new file mode 100644
index 0000000000..18b2ad81e4
--- /dev/null
+++ b/third-party/curl/tests/data/test747
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+%repeat[5001 x Tiny: but many.%0a]%
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+Reject too many HTTP response headers
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+# curl: (100) Too many response headers, 5000 is max
+<errorcode>
+100
+</errorcode>
+<limits>
+Allocations: 6000
+</limits>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test748 b/third-party/curl/tests/data/test748
new file mode 100644
index 0000000000..70233bb902
--- /dev/null
+++ b/third-party/curl/tests/data/test748
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+--config
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+
+<name>
+A --config file that uses -h and no URL
+</name>
+<file name="%LOGDIR/cmd">
+-h all
+</file>
+<command>
+-K %LOGDIR/cmd
+</command>
+</client>
+
+<verify>
+<errorcode>
+2
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test749 b/third-party/curl/tests/data/test749
new file mode 100644
index 0000000000..1a86e09fb3
--- /dev/null
+++ b/third-party/curl/tests/data/test749
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+HTTP CONNECT
+HTTP proxy
+proxytunnel
+</keywords>
+</info>
+
+# Server-side
+<reply>
+
+# this is returned first since we get no proxy-auth
+<connect crlf="headers">
+HTTP/1.1 400 Bad request
+Connection: close
+
+</connect>
+
+<datacheck crlf="headers">
+HTTP/1.1 400 Bad request
+Connection: close
+
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+proxy
+</features>
+<name>
+HTTP CONNECT with proxy returning 400 and closing
+</name>
+<command>
+http://test.example --proxy http://%HOSTIP:%HTTPPORT --proxytunnel -sS
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+CONNECT test.example:80 HTTP/1.1
+Host: test.example:80
+User-Agent: curl/%VERSION
+Proxy-Connection: Keep-Alive
+
+</protocol>
+<errorcode>
+7
+</errorcode>
+<stderr mode="text">
+curl: (7) CONNECT tunnel failed, response 400
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test75 b/third-party/curl/tests/data/test75
index b11295c991..b76cefbf77 100644
--- a/third-party/curl/tests/data/test75
+++ b/third-party/curl/tests/data/test75
@@ -1,42 +1,36 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
 globbing
-FAILURE
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 http
 </features>
- <name>
+<name>
 HTTP, urlglob retrieval with bad range
- </name>
- <command option="no-output">
+</name>
+<command option="no-output">
 "http://a-site-never-accessed.example.org/[2-1]" -o "%LOGDIR/weee#1.dump" --stderr -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 3
 </errorcode>
 <stdout mode="text">
-curl: (3) bad range in URL position 47:
+curl: (3) bad range in position 47:
 http://a-site-never-accessed.example.org/[2-1]
                                               ^
 </stdout>
diff --git a/third-party/curl/tests/data/test750 b/third-party/curl/tests/data/test750
new file mode 100644
index 0000000000..03352ece66
--- /dev/null
+++ b/third-party/curl/tests/data/test750
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+HTTP CONNECT
+HTTP proxy
+proxytunnel
+</keywords>
+</info>
+
+# Server-side
+<reply>
+
+# this is returned first since we get no proxy-auth
+<connect>
+<html>
+<h1>400 Bad request</h1>
+swsclose
+</html>
+</connect>
+
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+proxy
+</features>
+<name>
+HTTP CONNECT with proxy returning HTML and closing
+</name>
+<command>
+http://test.example --proxy http://%HOSTIP:%HTTPPORT --proxytunnel -sS
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+CONNECT test.example:80 HTTP/1.1
+Host: test.example:80
+User-Agent: curl/%VERSION
+Proxy-Connection: Keep-Alive
+
+</protocol>
+<errorcode>
+43
+</errorcode>
+<stderr mode="text">
+curl: (43) Invalid response header
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test751 b/third-party/curl/tests/data/test751
new file mode 100644
index 0000000000..f642733c7f
--- /dev/null
+++ b/third-party/curl/tests/data/test751
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+MULTI
+</keywords>
+</info>
+<reply>
+<data>
+</data>
+</reply>
+
+# Client-side
+<client>
+# tool is what to use instead of 'curl'
+<tool>
+lib%TESTNUMBER
+</tool>
+
+<name>
+multi - add many easy handles
+</name>
+</client>
+
+# 1000 easy handles needs memory
+<verify>
+<limits>
+Maximum allocated: 6000000
+Allocations: 7000
+</limits>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test752 b/third-party/curl/tests/data/test752
new file mode 100644
index 0000000000..ca9ce116ea
--- /dev/null
+++ b/third-party/curl/tests/data/test752
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+-f
+--retry
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 404 nopes
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+
+<datacheck crlf="headers">
+HTTP/1.1 404 nopes
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+--retry and -f on an HTTP 404 response
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -f --retry 1
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<errorcode>
+22
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test753 b/third-party/curl/tests/data/test753
new file mode 100644
index 0000000000..868c7f2c4c
--- /dev/null
+++ b/third-party/curl/tests/data/test753
@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+FTP
+</keywords>
+</info>
+
+# Client-side
+<client>
+<features>
+Debug
+ftp
+</features>
+<server>
+ftp
+</server>
+<tool>
+lib%TESTNUMBER
+</tool>
+<name>
+cleanup easy without multi_remove_handle
+</name>
+<command>
+ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
+</command>
+<setenv>
+CURL_FTP_PWD_STOP=1
+</setenv>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+USER anonymous
+PASS ftp@example.com
+USER anonymous
+PASS ftp@example.com
+PWD
+EPSV
+TYPE I
+SIZE 753
+QUIT
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test754 b/third-party/curl/tests/data/test754
new file mode 100644
index 0000000000..c8ae2be013
--- /dev/null
+++ b/third-party/curl/tests/data/test754
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+FTP
+list
+post-quote
+pre-quote
+</keywords>
+</info>
+# Server-side
+<reply>
+<data mode="text">
+total 20
+drwxr-xr-x   8 98       98           512 Oct 22 13:06 .
+drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..
+drwxr-xr-x   2 98       98           512 May  2  1996 .NeXT
+-r--r--r--   1 0        1             35 Jul 16  1996 README
+lrwxrwxrwx   1 0        1              7 Dec  9  1999 bin -> usr/bin
+dr-xr-xr-x   2 0        1            512 Oct  1  1997 dev
+drwxrwxrwx   2 98       98           512 May 29 16:04 download.html
+dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc
+drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub
+dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr
+</data>
+<servercmd>
+REPLY FAIL 500 this might not be a failure!
+</servercmd>
+</reply>
+
+# Client-side
+<client>
+<server>
+ftp
+</server>
+<name>
+FTP list with quote ops
+</name>
+<command>
+ftp://%HOSTIP:%FTPPORT/path/ -Q "NOOP 1" -Q "+NOOP 2" -Q "-NOOP 3" -Q "*FAIL" -Q "+*FAIL HARD"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+USER anonymous
+PASS ftp@example.com
+PWD
+NOOP 1
+FAIL
+CWD path
+EPSV
+TYPE A
+NOOP 2
+FAIL HARD
+LIST
+NOOP 3
+QUIT
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test755 b/third-party/curl/tests/data/test755
new file mode 100644
index 0000000000..90fb20e639
--- /dev/null
+++ b/third-party/curl/tests/data/test755
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+netrc
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Content-Length: 9
+
+contents
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+netrc with NETRC pointing out the file
+</name>
+<file name="%LOGDIR/netrc%TESTNUMBER">
+machine foo.host login foo password alone-in-the-dark
+</file>
+<setenv>
+NETRC=%LOGDIR/netrc%TESTNUMBER
+</setenv>
+<command>
+http://foo.host/%TESTNUMBER --proxy %HOSTIP:%HTTPPORT -A "" --netrc
+</command>
+<features>
+proxy
+</features>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://foo.host/%TESTNUMBER HTTP/1.1
+Host: foo.host
+Authorization: Basic %b64[foo:alone-in-the-dark]b64%
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test756 b/third-party/curl/tests/data/test756
new file mode 100644
index 0000000000..013273dd78
--- /dev/null
+++ b/third-party/curl/tests/data/test756
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Response: 1
+Content-Type: text/html
+Content-Length: 8
+
+Hello1!
+</data>
+<data2>
+HTTP/1.1 200 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Response: 2
+Content-Type: text/html
+Content-Length: 8
+
+Hello2!
+</data2>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+</features>
+
+<name>
+mix --output and --out-null
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER0002 --out-null -o -
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /want/%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /want/%TESTNUMBER0002 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<stdout>
+HTTP/1.1 200 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Response: 2
+Content-Type: text/html
+Content-Length: 8
+
+Hello2!
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test757 b/third-party/curl/tests/data/test757
new file mode 100644
index 0000000000..80d7706d61
--- /dev/null
+++ b/third-party/curl/tests/data/test757
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+MIME
+</keywords>
+</info>
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.0 200 OK swsclose
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+
+blablabla
+
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+Mime
+</features>
+<server>
+http
+</server>
+<tool>
+lib%TESTNUMBER
+</tool>
+
+<name>
+MIME parts reused as a child part, using data_cb
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<strippart>
+s/^--------------------------[A-Za-z0-9]*/------------------------------/
+s/boundary=------------------------[A-Za-z0-9]*/boundary=----------------------------/
+</strippart>
+<protocol crlf="yes">
+POST /we/want/%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 200
+Content-Type: multipart/form-data; boundary=----------------------------
+
+------------------------------
+Content-Disposition: form-data; name="data"
+Content-Type: text/html
+
+<title>fun-times</title>
+--------------------------------
+POST /we/want/%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Content-Length: 427
+Content-Type: multipart/form-data; boundary=----------------------------
+
+------------------------------
+Content-Disposition: form-data
+Content-Type: multipart/mixed; boundary=----------------------------
+
+------------------------------
+Content-Disposition: attachment; name="data"
+Content-Type: text/html
+
+<title>fun-times</title>
+--------------------------------
+
+--------------------------------
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test758 b/third-party/curl/tests/data/test758
new file mode 100644
index 0000000000..08f024fecd
--- /dev/null
+++ b/third-party/curl/tests/data/test758
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+multi
+HTTPS
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6007
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+%repeat[1000 x foobar]%
+</data>
+</reply>
+
+<features>
+OpenSSL
+</features>
+
+# Client-side
+<client>
+<server>
+https
+</server>
+<tool>
+lib%TESTNUMBER
+</tool>
+<name>
+HTTPS multi_socket interface transfer with callbacks returning error
+</name>
+<command>
+https://localhost:%HTTPSPORT/file%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test759 b/third-party/curl/tests/data/test759
new file mode 100644
index 0000000000..7ad896bbcc
--- /dev/null
+++ b/third-party/curl/tests/data/test759
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+globbing
+</keywords>
+</info>
+
+# Client-side
+<client>
+<name>
+glob '{,'
+</name>
+<command>
+"{,,,,,,,}" "{," "{,,,"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+# curl: (3) unmatched brace in position 1:
+<errorcode>
+3
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test76 b/third-party/curl/tests/data/test76
index 8aae75aecb..4b67ebf161 100644
--- a/third-party/curl/tests/data/test76
+++ b/third-party/curl/tests/data/test76
@@ -1,36 +1,109 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
-FAILURE
+HTTP
+HTTP GET
+HTTP NTLM auth
+NTLM
 </keywords>
 </info>
-#
 # Server-side
 <reply>
+<data crlf="headers">
+HTTP/1.1 401 Authorization Required swsclose
+Server: Apache/1.3.27 (Darwin) PHP/4.1.2
+WWW-Authenticate: Basic, Wild-and-crazy, NTLM
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 26
+
+This is not the real page
+</data>
+
+# This is supposed to be returned when the server gets a first
+# Authorization: NTLM line passed-in from the client
+<data1001 crlf="headers">
+HTTP/1.1 401 Now gimme that second request of crap
+Server: Microsoft-IIS/5.0
+Content-Length: 34
+Content-Type: text/html; charset=iso-8859-1
+WWW-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
+
+This is not the real page either!
+</data1001>
+
+# This is supposed to be returned when the server gets the second
+# Authorization: NTLM line passed-in from the client
+<data1002 crlf="headers">
+HTTP/1.1 200 Things are fine in server land swsclose
+Server: Microsoft-IIS/5.0
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 32
+
+Finally, this is the real page!
+</data1002>
+
+<datacheck crlf="headers">
+HTTP/1.1 401 Authorization Required swsclose
+Server: Apache/1.3.27 (Darwin) PHP/4.1.2
+WWW-Authenticate: Basic, Wild-and-crazy, NTLM
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 26
+
+HTTP/1.1 401 Now gimme that second request of crap
+Server: Microsoft-IIS/5.0
+Content-Length: 34
+Content-Type: text/html; charset=iso-8859-1
+WWW-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
+
+HTTP/1.1 200 Things are fine in server land swsclose
+Server: Microsoft-IIS/5.0
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 32
+
+Finally, this is the real page!
+</datacheck>
+
 </reply>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
-http
+NTLM
+SSL
+!SSPI
 </features>
- <name>
-HTTP, -O with no file name part in the URL
- </name>
- <command option="no-output">
-http://%HOSTIP:%NOLISTENPORT/%TESTNUMBER/ -O
+<server>
+http
+</server>
+<name>
+HTTP with comma-separated WWW-Authenticate header
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --anyauth
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<errorcode>
-23
-</errorcode>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAALAAsAeAAAAAAAAAAAAAAAhoIBAFpkQwKRCZFMhjj0tw47wEjKHRHlvzfxQamFcheMuv8v+xeqphEO5V41xRd7R9deOXRlc3R1c2VyV09SS1NUQVRJT04=
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test760 b/third-party/curl/tests/data/test760
new file mode 100644
index 0000000000..1a3a0dba5a
--- /dev/null
+++ b/third-party/curl/tests/data/test760
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+globbing
+</keywords>
+</info>
+
+# Client-side
+<client>
+<name>
+more cmdline options than URLs and --next
+</name>
+<command>
+-no1 -no2 --url "Qttp://internal.dxample.lol/status" -: --url "http"
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+# curl: (1) Protocol "qttp" not supported
+<errorcode>
+1
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test761 b/third-party/curl/tests/data/test761
new file mode 100644
index 0000000000..2772a8f78f
--- /dev/null
+++ b/third-party/curl/tests/data/test761
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+globbing
+</keywords>
+</info>
+
+# Client-side
+<client>
+<name>
+too many {} globs
+</name>
+<command>
+http://testingthis/%repeat[201 x {a}b]%
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+3
+</errorcode>
+<stderr mode="text">
+curl: (3) too many {} sets in position 403:
+http://testingthis/%repeat[114 x {a}b]%{a
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test762 b/third-party/curl/tests/data/test762
new file mode 100644
index 0000000000..eaf620ecff
--- /dev/null
+++ b/third-party/curl/tests/data/test762
@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+--remote-time
+</keywords>
+</info>
+
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Wed, 09 Oct 1940 16:45:49 +0100
+Content-Length: 6
+Connection: close
+
+12345
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP GET with --remote-time with file date from 1940
+</name>
+<command option="no-output,no-include">
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -O --remote-time --output-dir %LOGDIR
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/%TESTNUMBER">
+12345
+</file>
+# Modify: 1940-10-09 16:45:49.000000000 +0100
+<postcheck>
+%PERL -e 'exit((stat("%LOGDIR/%TESTNUMBER"))[9] != -922349651)'
+</postcheck>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test763 b/third-party/curl/tests/data/test763
new file mode 100644
index 0000000000..0a85811441
--- /dev/null
+++ b/third-party/curl/tests/data/test763
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+IDN
+</keywords>
+</info>
+
+<client>
+<features>
+IDN
+!AppleIDN
+</features>
+<name>
+Unicode hostname ending up in a blank name
+</name>
+# e2 80 8b - ZERO WIDTH SPACE
+# e2 80 8c - ZERO WIDTH NON-JOINER
+<command>
+%hex['%e2%80%8b%e2%80%8c']hex%
+</command>
+</client>
+
+<verify>
+# curl: (3) URL using bad/illegal format or missing URL
+<errorcode>
+3
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test764 b/third-party/curl/tests/data/test764
new file mode 100644
index 0000000000..e58fbbf78e
--- /dev/null
+++ b/third-party/curl/tests/data/test764
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+-w
+%header
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 301 Redirect
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+This: one
+This: two
+Content-Length: 6
+Location: %TESTNUMBER0002
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+<data2 nocheck="yes">
+HTTP/1.1 200 Not a redirect
+Accept-Ranges: bytes
+This: three
+This: four
+Content-Length: 6
+Funny-head: yesyes
+
+-foo-
+</data2>
+
+</reply>
+
+# Client-side
+<client>
+<features>
+headers-api
+</features>
+<server>
+http
+</server>
+<name>
+-w with multiple header output
+</name>
+<command option="no-output">
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -L -w '%header{this:all:***}\n' -o %LOGDIR/%TESTNUMBER.out
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<stdout mode="text">
+one***two***three***four
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test765 b/third-party/curl/tests/data/test765
new file mode 100644
index 0000000000..31bae45606
--- /dev/null
+++ b/third-party/curl/tests/data/test765
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+-w
+%header
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 301 Redirect
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+This: one
+This: two
+Content-Length: 6
+Location: %TESTNUMBER0002
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+<data2 nocheck="yes">
+HTTP/1.1 200 Not a redirect
+Accept-Ranges: bytes
+This: three
+This: four
+Content-Length: 6
+Funny-head: yesyes
+
+-foo-
+</data2>
+
+</reply>
+
+# Client-side
+<client>
+<features>
+headers-api
+</features>
+<server>
+http
+</server>
+<name>
+-w with multiple header output using } in separator
+</name>
+<command option="no-output">
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -L -w '%header{this:all:-{\}-}\n' -o %LOGDIR/%TESTNUMBER.out
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<stdout mode="text">
+one-{}-two-{}-three-{}-four
+</stdout>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test766 b/third-party/curl/tests/data/test766
new file mode 100644
index 0000000000..6b08c7226f
--- /dev/null
+++ b/third-party/curl/tests/data/test766
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+FTP
+PORT
+CURLOPT_SOCKOPTFUNCTION
+timing-dependent
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+hello
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+ftp
+</server>
+<tool>
+lib%TESTNUMBER
+</tool>
+<name>
+FTP PORT with sockopt callback refusing the accept
+</name>
+<command>
+ftp://%HOSTIP:%FTPPORT/path/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+# Strip off parts of the EPRT command that might differ
+<strippart>
+s/^EPRT \|1\|(\S*)/EPRT \|1\|/
+</strippart>
+# The TYPE command might get sent so we ignore that
+<strip>
+^TYPE
+</strip>
+
+<protocol crlf="yes">
+USER anonymous
+PASS ftp@example.com
+PWD
+CWD path
+EPRT |1|
+</protocol>
+
+# 42 == CURLE_ABORTED_BY_CALLBACK
+<errorcode>
+42
+</errorcode>
+
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test767 b/third-party/curl/tests/data/test767
new file mode 100644
index 0000000000..a0d96f1b6d
--- /dev/null
+++ b/third-party/curl/tests/data/test767
@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP with two Content-Length response header fields same size
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<limits>
+Allocations: 135
+Maximum allocated: 136000
+</limits>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test768 b/third-party/curl/tests/data/test768
new file mode 100644
index 0000000000..f2d1321373
--- /dev/null
+++ b/third-party/curl/tests/data/test768
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6badness
+Content-Length: 44
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP with letters after the number in Content-Length
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<errorcode>
+8
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test769 b/third-party/curl/tests/data/test769
new file mode 100644
index 0000000000..9173f4e47c
--- /dev/null
+++ b/third-party/curl/tests/data/test769
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6%repeat[5 x  ]%
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP with space after Content-Length number
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test77 b/third-party/curl/tests/data/test77
index cbb97051ff..99f96b30d7 100644
--- a/third-party/curl/tests/data/test77
+++ b/third-party/curl/tests/data/test77
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ If-Modified-Since
 -z
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -25,24 +25,22 @@ Content-Type: text/html
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with -z "older date"
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -z "dec 12 12:00:00 1999 GMT"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test770 b/third-party/curl/tests/data/test770
new file mode 100644
index 0000000000..02202a8b0d
--- /dev/null
+++ b/third-party/curl/tests/data/test770
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6,06,6
+Content-Length: 6,    6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP with Content-Length headers using comma separated list
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test771 b/third-party/curl/tests/data/test771
new file mode 100644
index 0000000000..8ee5c99429
--- /dev/null
+++ b/third-party/curl/tests/data/test771
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 44
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP with two Content-Length headers using different sizes
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<errorcode>
+8
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test772 b/third-party/curl/tests/data/test772
new file mode 100644
index 0000000000..f4a1cb5529
--- /dev/null
+++ b/third-party/curl/tests/data/test772
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+Location
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 0
+Connection: close
+Location: this
+Location: that
+
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP with two Location: headers triggers error
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<errorcode>
+8
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test773 b/third-party/curl/tests/data/test773
new file mode 100644
index 0000000000..8e4a2794db
--- /dev/null
+++ b/third-party/curl/tests/data/test773
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+Location
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 0
+Connection: close
+Location: this
+Location: this
+
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP with two identical Location: headers triggers no error
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test774 b/third-party/curl/tests/data/test774
new file mode 100644
index 0000000000..adb09e69a3
--- /dev/null
+++ b/third-party/curl/tests/data/test774
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+--config
+</keywords>
+</info>
+
+<client>
+<name>
+config file recursively including itself
+</name>
+<file name="%LOGDIR/cmd">
+--config %LOGDIR/cmd
+</file>
+<command>
+http://%HOSTIP:%HTTPPORT/ -K %LOGDIR/cmd
+</command>
+</client>
+
+<verify>
+<errorcode>
+2
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test775 b/third-party/curl/tests/data/test775
new file mode 100644
index 0000000000..987b2e908f
--- /dev/null
+++ b/third-party/curl/tests/data/test775
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP NTLM auth
+NTLM
+</keywords>
+</info>
+# Server-side
+<reply>
+
+# This is supposed to be returned when the server gets a first
+# Authorization: NTLM line passed-in from the client
+<data1001 crlf="headers">
+HTTP/1.1 401 Now gimme that second request of crap
+Server: Microsoft-IIS/5.0
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 34
+WWW-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
+
+This is not the real page either!
+</data1001>
+
+<datacheck crlf="headers">
+HTTP/1.1 401 Now gimme that second request of crap
+Server: Microsoft-IIS/5.0
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 34
+WWW-Authenticate: NTLM TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
+
+</datacheck>
+
+</reply>
+
+# Client-side
+<client>
+<features>
+NTLM
+SSL
+!SSPI
+</features>
+<server>
+http
+</server>
+<name>
+HTTP with NTLM with too long username
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser%repeat[1100 x A]%:testpass --ntlm
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<errorcode>
+100
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test776 b/third-party/curl/tests/data/test776
new file mode 100644
index 0000000000..cca5114d70
--- /dev/null
+++ b/third-party/curl/tests/data/test776
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+HTTP NTLM auth
+NTLM
+flaky
+</keywords>
+</info>
+
+<reply>
+<data1001 crlf="headers" nocheck="yes">
+HTTP/1.1 401 Authorization Required swsclose
+WWW-Authenticate: NTLM TlRMTVNTUAACAAAAAAAAAAAAAAABAIgAAQIDBAUGBwgAAAAAAAAAAP////8wAAAAAgD3/0F%repeat[21841 x BQUF]%BQUEAAAAA
+Content-Length: 0
+
+</data1001>
+</reply>
+
+# Client-side
+<client>
+<features>
+NTLM
+!SSPI
+</features>
+<server>
+http
+</server>
+<name>
+HTTP with NTLM with too long NTMLv2 ntresplen
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u user:pass --ntlm
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<errorcode>
+100
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test777 b/third-party/curl/tests/data/test777
new file mode 100644
index 0000000000..2c7629d674
--- /dev/null
+++ b/third-party/curl/tests/data/test777
@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+--ssl-sessions
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200
+Date: Tue, 09 Nov 2030 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+ssl-sessions
+</features>
+<name>
+--ssl-sessions with weird sessions in file
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --ssl-sessions "%LOGDIR/sessions"
+</command>
+<file name="%LOGDIR/sessions">
+# Your SSL session cache. https://curl.se/docs/ssl-sessions.html
+# This file was generated by libcurl! Edit at your own risk.
+%b64[this is a funny test]b64%:%b64[second sequence]b64%
+%b64[also a funny test]b64%:%b64[second different sequence]b64%
+bad base64:also!bad
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test778 b/third-party/curl/tests/data/test778
new file mode 100644
index 0000000000..84c82244c7
--- /dev/null
+++ b/third-party/curl/tests/data/test778
@@ -0,0 +1,95 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP proxy
+HTTP Basic auth
+HTTP proxy Basic auth
+followlocation
+oauth2-bearer
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+HTTP/1.1 302 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Location: http://goto.second.host.now/%TESTNUMBER0002
+Content-Length: 8
+Connection: close
+
+contents
+</data>
+<data2>
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Content-Length: 9
+
+contents
+</data2>
+
+<datacheck>
+HTTP/1.1 302 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Location: http://goto.second.host.now/%TESTNUMBER0002
+Content-Length: 8
+Connection: close
+
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Content-Length: 9
+
+contents
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP --oauth2-bearer redirect to new host (not passed on)
+</name>
+<command>
+http://first.host.it.is/we/want/that/page/%TESTNUMBER -x %HOSTIP:%HTTPPORT --oauth2-bearer s3cr3t --proxy-user testing:this --location
+</command>
+<features>
+proxy
+</features>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://first.host.it.is/we/want/that/page/%TESTNUMBER HTTP/1.1
+Host: first.host.it.is
+Proxy-Authorization: Basic %b64[testing:this]b64%
+Authorization: Bearer s3cr3t
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://goto.second.host.now/%TESTNUMBER0002 HTTP/1.1
+Host: goto.second.host.now
+Proxy-Authorization: Basic %b64[testing:this]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test779 b/third-party/curl/tests/data/test779
new file mode 100644
index 0000000000..42ee363634
--- /dev/null
+++ b/third-party/curl/tests/data/test779
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+IMAP
+oauth2-bearer
+followlocation
+--resolve
+</keywords>
+</info>
+# Server-side
+<reply>
+<servercmd>
+AUTH XOAUTH2
+REPLY AUTHENTICATE +
+REPLY %b64[user=v%01auth=Bearer s3cr3t%01%01]b64% B002 OK AUTHENTICATE completed
+</servercmd>
+<data>
+HTTP/1.1 302 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Location: imap://v@host:%IMAPPORT/%TESTNUMBER0002/
+Content-Length: 8
+Connection: close
+
+contents
+</data>
+
+<datacheck>
+HTTP/1.1 302 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Location: imap://v@host:%IMAPPORT/%TESTNUMBER0002/
+Content-Length: 8
+Connection: close
+
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+imap
+</server>
+<name>
+HTTP --oauth2-bearer redirects to IMAP
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/page/%TESTNUMBER --oauth2-bearer s3cr3t --location --proto-redir imap --resolve host:%IMAPPORT:%HOSTIP
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+GET /page/%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Authorization: Bearer s3cr3t
+User-Agent: curl/%VERSION
+Accept: */*
+
+B001 CAPABILITY
+</protocol>
+# curl: (67) Login denied
+<errorcode>
+67
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test78 b/third-party/curl/tests/data/test78
index 4ad5119a61..be938fb8d2 100644
--- a/third-party/curl/tests/data/test78
+++ b/third-party/curl/tests/data/test78
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ If-Modified-Since
 -z
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -37,24 +37,22 @@ Funny-head: yesyes
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with -z "newer date"
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -z "dec 12 11:00:00 1999 GMT"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test780 b/third-party/curl/tests/data/test780
new file mode 100644
index 0000000000..70211041e2
--- /dev/null
+++ b/third-party/curl/tests/data/test780
@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP proxy
+HSTS
+</keywords>
+</info>
+
+<reply>
+
+# we use this as response to a CONNECT
+<connect crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Server: fake
+
+</connect>
+
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Strict-Transport-Security: max-age  = 1000
+
+</data>
+</reply>
+
+<client>
+<server>
+http
+http-proxy
+https
+</server>
+<features>
+HSTS
+proxy
+https
+Debug
+</features>
+
+<setenv>
+CURL_HSTS_HTTP=yes
+CURL_TIME=1728465947
+</setenv>
+
+<file name="%LOGDIR/input%TESTNUMBER">
+this.hsts.example "99991001 04:47:41"
+expired.example "20011001 04:47:41"
+</file>
+
+<name>
+HSTS with updated expiry in response
+</name>
+<command>
+-x http://%HOSTIP:%PROXYPORT http://this.hsts.example:%HTTPSPORT/%TESTNUMBER --hsts %LOGDIR/input%TESTNUMBER --insecure
+</command>
+<disable>
+test-duphandle
+</disable>
+</client>
+
+<verify>
+
+<stdout>
+HTTP/1.1 200 OK%CR
+Server: fake%CR
+%CR
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Strict-Transport-Security: max-age  = 1000
+
+</stdout>
+
+<file name="%LOGDIR/input%TESTNUMBER" mode="text">
+# Your HSTS cache. https://curl.se/docs/hsts.html
+# This file was generated by libcurl! Edit at your own risk.
+this.hsts.example "20241009 09:42:27"
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test781 b/third-party/curl/tests/data/test781
new file mode 100644
index 0000000000..9c2e7d17f8
--- /dev/null
+++ b/third-party/curl/tests/data/test781
@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP proxy
+HSTS
+</keywords>
+</info>
+
+<reply>
+
+# we use this as response to a CONNECT
+<connect crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Server: fake
+
+</connect>
+
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Strict-Transport-Security: max-age=1000
+
+</data>
+</reply>
+
+<client>
+<server>
+http
+http-proxy
+https
+</server>
+<features>
+HSTS
+proxy
+https
+Debug
+large-time
+</features>
+
+<setenv>
+CURL_HSTS_HTTP=yes
+CURL_TIME=1728465947
+</setenv>
+
+<file name="%LOGDIR/input%TESTNUMBER">
+.hsts.example "20991001 04:47:41"
+this.hsts.example "99991001 04:47:41"
+</file>
+
+<name>
+HSTS update expiry, with parent includeSubDomains domain present
+</name>
+<command>
+-x http://%HOSTIP:%PROXYPORT http://this.hsts.example:%HTTPSPORT/%TESTNUMBER --hsts %LOGDIR/input%TESTNUMBER --insecure
+</command>
+<disable>
+test-duphandle
+</disable>
+</client>
+
+<verify>
+
+<stdout>
+HTTP/1.1 200 OK%CR
+Server: fake%CR
+%CR
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Strict-Transport-Security: max-age=1000
+
+</stdout>
+
+<file name="%LOGDIR/input%TESTNUMBER" mode="text">
+# Your HSTS cache. https://curl.se/docs/hsts.html
+# This file was generated by libcurl! Edit at your own risk.
+.hsts.example "20991001 04:47:41"
+this.hsts.example "20241009 09:42:27"
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test782 b/third-party/curl/tests/data/test782
new file mode 100644
index 0000000000..7b325441b4
--- /dev/null
+++ b/third-party/curl/tests/data/test782
@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP proxy
+HSTS
+</keywords>
+</info>
+
+<reply>
+
+# we use this as response to a CONNECT
+<connect crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Server: fake
+
+</connect>
+
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Strict-Transport-Security: max-age=1000; includesubdomains
+
+</data>
+</reply>
+
+<client>
+<server>
+http
+http-proxy
+https
+</server>
+<features>
+HSTS
+proxy
+https
+Debug
+large-time
+</features>
+
+<setenv>
+CURL_HSTS_HTTP=yes
+CURL_TIME=1728465947
+</setenv>
+
+<file name="%LOGDIR/input%TESTNUMBER">
+.hsts.example "20991001 04:47:41"
+.this.hsts.example "99991001 04:47:41"
+</file>
+
+<name>
+HSTS update expiry, with two includeSubDomains domains present
+</name>
+<command>
+-x http://%HOSTIP:%PROXYPORT http://this.hsts.example:%HTTPSPORT/%TESTNUMBER --hsts %LOGDIR/input%TESTNUMBER --insecure
+</command>
+<disable>
+test-duphandle
+</disable>
+</client>
+
+<verify>
+
+<stdout>
+HTTP/1.1 200 OK%CR
+Server: fake%CR
+%CR
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Strict-Transport-Security: max-age=1000; includesubdomains
+
+</stdout>
+
+<file name="%LOGDIR/input%TESTNUMBER" mode="text">
+# Your HSTS cache. https://curl.se/docs/hsts.html
+# This file was generated by libcurl! Edit at your own risk.
+.hsts.example "20991001 04:47:41"
+.this.hsts.example "20241009 09:42:27"
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test783 b/third-party/curl/tests/data/test783
new file mode 100644
index 0000000000..4c9d5cceb6
--- /dev/null
+++ b/third-party/curl/tests/data/test783
@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP proxy
+HSTS
+</keywords>
+</info>
+
+<reply>
+
+# we use this as response to a CONNECT
+<connect crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Server: fake
+
+</connect>
+
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Strict-Transport-Security: max-age=1000;
+
+</data>
+</reply>
+
+<client>
+<server>
+http
+http-proxy
+https
+</server>
+<features>
+HSTS
+proxy
+https
+Debug
+large-time
+</features>
+
+<setenv>
+CURL_HSTS_HTTP=yes
+CURL_TIME=1728465947
+</setenv>
+
+<file name="%LOGDIR/input%TESTNUMBER">
+.hsts.example "20991001 04:47:41"
+.this.hsts.example "99991001 04:47:41"
+</file>
+
+<name>
+HSTS update expiry, removing includeSubDomains in update
+</name>
+<command>
+-x http://%HOSTIP:%PROXYPORT http://this.hsts.example:%HTTPSPORT/%TESTNUMBER --hsts %LOGDIR/input%TESTNUMBER --insecure
+</command>
+<disable>
+test-duphandle
+</disable>
+</client>
+
+<verify>
+
+<stdout>
+HTTP/1.1 200 OK%CR
+Server: fake%CR
+%CR
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Strict-Transport-Security: max-age=1000;
+
+</stdout>
+
+<file name="%LOGDIR/input%TESTNUMBER" mode="text">
+# Your HSTS cache. https://curl.se/docs/hsts.html
+# This file was generated by libcurl! Edit at your own risk.
+.hsts.example "20991001 04:47:41"
+this.hsts.example "20241009 09:42:27"
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test784 b/third-party/curl/tests/data/test784
new file mode 100644
index 0000000000..a506b2b319
--- /dev/null
+++ b/third-party/curl/tests/data/test784
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--variable
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+--variable with a file byte range
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --variable "name[5-15]@%LOGDIR/in%TESTNUMBER" --expand-data '{{name}}'
+</command>
+<file name="%LOGDIR/in%TESTNUMBER">
+On the first Monday of the month of April, 1625, the market town of Meung
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+POST /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 11
+Content-Type: application/x-www-form-urlencoded
+
+e first Mon
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test785 b/third-party/curl/tests/data/test785
new file mode 100644
index 0000000000..1085ca3d1f
--- /dev/null
+++ b/third-party/curl/tests/data/test785
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--variable
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+--variable with a file byte range without end
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --variable "name[5-]@%LOGDIR/in%TESTNUMBER" --expand-data '{{name}}'
+</command>
+<file name="%LOGDIR/in%TESTNUMBER">
+On the first Monday of the month of April, 1625, the market town of Meung
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+POST /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 69
+Content-Type: application/x-www-form-urlencoded
+
+e first Monday of the month of April, 1625, the market town of Meung
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test786 b/third-party/curl/tests/data/test786
new file mode 100644
index 0000000000..c2b20f97a2
--- /dev/null
+++ b/third-party/curl/tests/data/test786
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--variable
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+--variable with a file byte range, reading from stdin
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --variable "name[5-15]@-" --expand-data '{{name}}'
+</command>
+<stdin>
+On the first Monday of the month of April, 1625, the market town of Meung
+</stdin>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers" nonewline="yes">
+POST /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 11
+Content-Type: application/x-www-form-urlencoded
+
+e first Mon
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test787 b/third-party/curl/tests/data/test787
new file mode 100644
index 0000000000..ba761640b7
--- /dev/null
+++ b/third-party/curl/tests/data/test787
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--variable
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+--variable with a file byte range, bad range
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --variable "name[15-14]@%LOGDIR/fooo" --expand-data '{{name}}'
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+2
+</errorcode>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test788 b/third-party/curl/tests/data/test788
new file mode 100644
index 0000000000..7fb264d4a3
--- /dev/null
+++ b/third-party/curl/tests/data/test788
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--variable
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+--variable with a file and single-byte byte range
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --variable "name[15-15]@%LOGDIR/in%TESTNUMBER" --expand-data '{{name}}'
+</command>
+<file name="%LOGDIR/in%TESTNUMBER">
+On the first Monday of the month of April, 1625, the market town of Meung
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+POST /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 1
+Content-Type: application/x-www-form-urlencoded
+
+n
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test789 b/third-party/curl/tests/data/test789
new file mode 100644
index 0000000000..324ee663be
--- /dev/null
+++ b/third-party/curl/tests/data/test789
@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--variable
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+--variable with a file and byte range out of file
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --variable "name[75-85]@%LOGDIR/in%TESTNUMBER" --expand-data '{{name}}'
+</command>
+<file name="%LOGDIR/in%TESTNUMBER">
+On the first Monday of the month of April, 1625, the market town of Meung
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+POST /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 0
+Content-Type: application/x-www-form-urlencoded
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test79 b/third-party/curl/tests/data/test79
index 3bb42152db..16b702fc0e 100644
--- a/third-party/curl/tests/data/test79
+++ b/third-party/curl/tests/data/test79
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP GET
 HTTP proxy
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -21,7 +21,6 @@ contents
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -31,18 +30,17 @@ http
 ftp
 proxy
 </features>
- <name>
+<name>
 FTP over HTTP proxy
- </name>
- <command>
+</name>
+<command>
 ftp://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER -x %HOSTIP:%HTTPPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET ftp://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test790 b/third-party/curl/tests/data/test790
new file mode 100644
index 0000000000..f99e6de85f
--- /dev/null
+++ b/third-party/curl/tests/data/test790
@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--variable
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+--variable with a byte range using plain assign
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --variable "name[5-9]=0123456789abcdef" --expand-data '{{name}}'
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+POST /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 5
+Content-Type: application/x-www-form-urlencoded
+
+56789
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test791 b/third-party/curl/tests/data/test791
new file mode 100644
index 0000000000..51e1477f1b
--- /dev/null
+++ b/third-party/curl/tests/data/test791
@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--variable
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+--variable with a byte range using plain assign, out of range
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --variable "name[10-30]=0123456789abcdef" --expand-data '{{name}}'
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+POST /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 6
+Content-Type: application/x-www-form-urlencoded
+
+abcdef
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test792 b/third-party/curl/tests/data/test792
new file mode 100644
index 0000000000..1763ffc781
--- /dev/null
+++ b/third-party/curl/tests/data/test792
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+netrc
+FTP
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+content
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+ftp
+</server>
+<features>
+proxy
+</features>
+<name>
+.netrc with embedded NULL byte
+</name>
+<command>
+--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
+</command>
+<file name="%LOGDIR/netrc%TESTNUMBER" >
+machine %HOSTIP login username password%hex[%00]hex% hello
+</file>
+</client>
+
+<verify>
+<protocol crlf="yes">
+USER username
+PASS%SP
+PWD
+EPSV
+TYPE I
+SIZE %TESTNUMBER
+RETR %TESTNUMBER
+QUIT
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test793 b/third-party/curl/tests/data/test793
new file mode 100644
index 0000000000..b293a8e3fb
--- /dev/null
+++ b/third-party/curl/tests/data/test793
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+netrc
+FTP
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+content
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+ftp
+</server>
+<features>
+proxy
+</features>
+<name>
+.netrc with embedded NULL byte, with quoted token
+</name>
+<command>
+--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER ftp://%HOSTIP:%FTPPORT/%TESTNUMBER
+</command>
+<file name="%LOGDIR/netrc%TESTNUMBER" >
+machine %HOSTIP login username "password"%hex[%00]hex% hello
+</file>
+</client>
+
+<verify>
+<protocol crlf="yes">
+USER username
+PASS%SP
+PWD
+EPSV
+TYPE I
+SIZE %TESTNUMBER
+RETR %TESTNUMBER
+QUIT
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test794 b/third-party/curl/tests/data/test794
new file mode 100644
index 0000000000..22166766b8
--- /dev/null
+++ b/third-party/curl/tests/data/test794
@@ -0,0 +1,94 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+--follow
+--location
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 302 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+<data1 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</data1>
+<datacheck crlf="headers">
+HTTP/1.1 302 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+http
+</features>
+
+<name>
+--follow + --location with custom POST method, 302 => GET
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --no-progress-meter -X IGLOO -d moo --location --follow
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+IGLOO /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 3
+Content-Type: application/x-www-form-urlencoded
+
+mooGET /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+
+</protocol>
+<stderr mode="text">
+Warning: --follow overrides --location
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test795 b/third-party/curl/tests/data/test795
new file mode 100644
index 0000000000..a0d168d5ff
--- /dev/null
+++ b/third-party/curl/tests/data/test795
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+IMAP
+followlocation
+--resolve
+</keywords>
+</info>
+# Server-side
+<reply>
+<servercmd>
+AUTH PLAIN
+CAPA SASL-IR
+REPLY AUTHENTICATE B002 OK AUTHENTICATE completed
+</servercmd>
+<data>
+HTTP/1.1 302 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Location: imap://v@host:%IMAPPORT/%TESTNUMBER0002/
+Content-Length: 8
+Connection: close
+
+contents
+</data>
+
+<datacheck>
+HTTP/1.1 302 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake swsclose
+Content-Type: text/html
+Funny-head: yesyes
+Location: imap://v@host:%IMAPPORT/%TESTNUMBER0002/
+Content-Length: 8
+Connection: close
+
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+imap
+</server>
+<name>
+HTTP with credentials redirects to IMAP
+</name>
+<command>
+http://@%HOSTIP:%HTTPPORT/page/%TESTNUMBER -u user:secret --location --proto-redir imap --resolve host:%IMAPPORT:%HOSTIP
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+GET /page/%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Authorization: Basic %b64[user:secret]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+
+B001 CAPABILITY
+B002 AUTHENTICATE PLAIN %b64[%00v%00]b64%
+B003 LIST "%TESTNUMBER0002" *
+B004 LOGOUT
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test796 b/third-party/curl/tests/data/test796
new file mode 100644
index 0000000000..7a25c7bf08
--- /dev/null
+++ b/third-party/curl/tests/data/test796
@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+--follow
+--location
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 302 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+<data1 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</data1>
+<datacheck crlf="headers">
+HTTP/1.1 302 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+http
+</features>
+
+<name>
+--follow with custom POST method, 302 => GET
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -X IGLOO -d moo --follow
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+IGLOO /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 3
+Content-Type: application/x-www-form-urlencoded
+
+mooGET /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test797 b/third-party/curl/tests/data/test797
new file mode 100644
index 0000000000..6abf073432
--- /dev/null
+++ b/third-party/curl/tests/data/test797
@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+--follow
+--location
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 308 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+<data1 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</data1>
+<datacheck crlf="headers">
+HTTP/1.1 308 OK
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Location: %TESTNUMBER0001
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+HTTP/1.1 200 OK
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+-bar-
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+http
+</features>
+
+<name>
+--follow with custom POST method, 308 => custom
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -X IGLOO -d moo --follow
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes" nonewline="yes">
+IGLOO /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 3
+Content-Type: application/x-www-form-urlencoded
+
+mooIGLOO /%TESTNUMBER0001 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+Content-Length: 3
+Content-Type: application/x-www-form-urlencoded
+
+moo
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test798 b/third-party/curl/tests/data/test798
new file mode 100644
index 0000000000..c69461ead7
--- /dev/null
+++ b/third-party/curl/tests/data/test798
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+cookies
+cookiejar
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Content-Length: 4
+Set-Cookie: flavor=tasty;
+ domain=localhost;
+ path=/p4/;
+ httponly;
+ secure
+
+boo
+</data>
+<servercmd>
+writedelay: 20
+</servercmd>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP cookies in a folded header
+</name>
+<command>
+http://localhost:%HTTPPORT/we/want/%TESTNUMBER -b none -c %LOGDIR/jar%TESTNUMBER.txt
+</command>
+<features>
+cookies
+local-http
+</features>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /we/want/%TESTNUMBER HTTP/1.1
+Host: localhost:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/jar%TESTNUMBER.txt" mode="text">
+# Netscape HTTP Cookie File
+# https://curl.se/docs/http-cookies.html
+# This file was generated by libcurl! Edit at your own risk.
+
+#HttpOnly_.localhost	TRUE	/p4	TRUE	0	flavor	tasty
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test799 b/third-party/curl/tests/data/test799
index 931facc1a3..c027136e88 100644
--- a/third-party/curl/tests/data/test799
+++ b/third-party/curl/tests/data/test799
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,14 +8,13 @@ SASL AUTH +LOGIN
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH PLAIN
 REPLY LOGIN A002 OK LOGIN completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -25,24 +25,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP with --login-options 'AUTH=+LOGIN'
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user:secret --login-options AUTH=+LOGIN
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 SELECT %TESTNUMBER
diff --git a/third-party/curl/tests/data/test8 b/third-party/curl/tests/data/test8
index 0f8a31e2af..57d4826d45 100644
--- a/third-party/curl/tests/data/test8
+++ b/third-party/curl/tests/data/test8
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -21,10 +22,10 @@ Server: test-server/fake
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with cookie parsing from header file
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -b %LOGDIR/heads%TESTNUMBER.txt
 </command>
 
@@ -79,7 +80,7 @@ Set-Cookie: cookie31=%hex[%7f-junk]hex%
 
 </file>
 <precheck>
-perl -e 'if ("%HOSTIP" !~ /\.0\.0\.1$/) {print "Test only works for HOSTIPs ending with .0.0.1"; exit(1)}'
+%PERL -e 'if("%HOSTIP" !~ /\.0\.0\.1$/) {print "Test only works for HOSTIPs ending with .0.0.1"; exit(1)}'
 </precheck>
 <features>
 cookies
@@ -88,7 +89,7 @@ cookies
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test80 b/third-party/curl/tests/data/test80
index 68f60199ef..0efbc93ec1 100644
--- a/third-party/curl/tests/data/test80
+++ b/third-party/curl/tests/data/test80
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,6 @@ proxytunnel
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -24,13 +24,13 @@ Content-Length: 9
 
 contents
 </data>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 
 </connect>
 <datacheck>
-HTTP/1.1 200 Mighty fine indeed
-
+HTTP/1.1 200 Mighty fine indeed%CR
+%CR
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -42,40 +42,36 @@ contents
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 http-proxy
 </server>
- <name>
+<name>
 HTTP 1.0 CONNECT with proxytunnel and proxy+host Basic authentication
- </name>
- <command>
-http://test.%TESTNUMBER:%HTTPPORT/we/want/that/page/%TESTNUMBER -p --proxy1.0 %HOSTIP:%PROXYPORT --user iam:myself --proxy-user youare:yourself
+</name>
+<command>
+http://test.%TESTNUMBER:%HTTPPORT/we/want/that/page/%TESTNUMBER -p --proxy1.0 %HOSTIP:%PROXYPORT --user iam:myself --proxy-user youare:yourself -A ""
 </command>
 <features>
 proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 CONNECT test.%TESTNUMBER:%HTTPPORT HTTP/1.0
 Host: test.%TESTNUMBER:%HTTPPORT
-Proxy-Authorization: Basic eW91YXJlOnlvdXJzZWxm
-User-Agent: curl/%VERSION
+Proxy-Authorization: Basic %b64[youare:yourself]b64%
 Proxy-Connection: Keep-Alive
 
 </proxy>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: test.%TESTNUMBER:%HTTPPORT
-Authorization: Basic aWFtOm15c2VsZg==
-User-Agent: curl/%VERSION
+Authorization: Basic %b64[iam:myself]b64%
 Accept: */*
 
 </protocol>
diff --git a/third-party/curl/tests/data/test800 b/third-party/curl/tests/data/test800
index bc5fd301b2..2c4d97088e 100644
--- a/third-party/curl/tests/data/test800
+++ b/third-party/curl/tests/data/test800
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ FETCH
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -21,24 +21,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
-IMAP FETCH message
- </name>
- <command>
+<name>
+IMAP FETCH message with MAILINDEX
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u '"user:sec"ret{'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN "\"user" "sec\"ret{"
 A003 SELECT %TESTNUMBER
diff --git a/third-party/curl/tests/data/test801 b/third-party/curl/tests/data/test801
index 30727a0dd5..72e0208267 100644
--- a/third-party/curl/tests/data/test801
+++ b/third-party/curl/tests/data/test801
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ FETCH
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 body
 
 --
@@ -18,24 +18,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP FETCH message by MAILINDEX and SECTION
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=123/;SECTION=1' -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 SELECT %TESTNUMBER
diff --git a/third-party/curl/tests/data/test802 b/third-party/curl/tests/data/test802
index 984835b073..f6a13bf7fe 100644
--- a/third-party/curl/tests/data/test802
+++ b/third-party/curl/tests/data/test802
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ UIDVALIDITY
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 body
 
 --
@@ -19,24 +19,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP SELECT UIDVALIDITY Success
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER;UIDVALIDITY=3857529045/;MAILINDEX=123/;SECTION=TEXT' -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 SELECT %TESTNUMBER
diff --git a/third-party/curl/tests/data/test803 b/third-party/curl/tests/data/test803
index 28461c2162..6c4c67697c 100644
--- a/third-party/curl/tests/data/test803
+++ b/third-party/curl/tests/data/test803
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,37 +6,33 @@ IMAP
 Clear Text
 SELECT
 UIDVALIDITY
-FAILURE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP SELECT UIDVALIDITY Failure
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER;UIDVALIDITY=12345/;MAILINDEX=123' -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # CURLE_REMOTE_FILE_NOT_FOUND - UIDVALIDITY mismatch
 <errorcode>
 78
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 SELECT %TESTNUMBER
diff --git a/third-party/curl/tests/data/test804 b/third-party/curl/tests/data/test804
index 6c7944aeb0..d60f0e0d0f 100644
--- a/third-party/curl/tests/data/test804
+++ b/third-party/curl/tests/data/test804
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ SELECT
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 body
 
 --
@@ -18,24 +18,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
-IMAP doesn't perform SELECT if re-using the same mailbox
- </name>
- <command>
+<name>
+IMAP does not perform SELECT if reusing the same mailbox
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=123/;SECTION=1' 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=456/;SECTION=2.3' -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 SELECT %TESTNUMBER
diff --git a/third-party/curl/tests/data/test805 b/third-party/curl/tests/data/test805
index 49315b332f..132c89aa0a 100644
--- a/third-party/curl/tests/data/test805
+++ b/third-party/curl/tests/data/test805
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,29 +9,27 @@ UPLOAD
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP APPEND message
- </name>
- <command>
+</name>
+<command>
 imap://%HOSTIP:%IMAPPORT/%TESTNUMBER -T %LOGDIR/upload%TESTNUMBER -u user:secret
 </command>
-<file name="%LOGDIR/upload%TESTNUMBER">
+<file name="%LOGDIR/upload%TESTNUMBER" crlf="yes">
 Date: Mon, 7 Feb 1994 21:52:25 -0800 (PST)
-From: Fred Foobar <foobar@example.COM>
+From: Fred Foobar %LTfoobar@example.COM%GT
 Subject: afternoon meeting
 To: joe@example.com
-Message-Id: <B27397-0100000@example.COM>
+Message-Id: %LTB27397-0100000@example.COM%GT
 MIME-Version: 1.0
 Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
 
@@ -38,21 +37,20 @@ Hello Joe, do you think we can meet at 3:30 tomorrow?
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 APPEND %TESTNUMBER (\Seen) {295}
 A004 LOGOUT
 </protocol>
-<upload>
+<upload crlf="yes">
 Date: Mon, 7 Feb 1994 21:52:25 -0800 (PST)
-From: Fred Foobar <foobar@example.COM>
+From: Fred Foobar %LTfoobar@example.COM%GT
 Subject: afternoon meeting
 To: joe@example.com
-Message-Id: <B27397-0100000@example.COM>
+Message-Id: %LTB27397-0100000@example.COM%GT
 MIME-Version: 1.0
 Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
 
diff --git a/third-party/curl/tests/data/test806 b/third-party/curl/tests/data/test806
index 3cb18de111..d668d1015b 100644
--- a/third-party/curl/tests/data/test806
+++ b/third-party/curl/tests/data/test806
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,34 +8,31 @@ LIST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 * LIST () "/" /%TESTNUMBER/blurdybloop
 * LIST (\Noselect) "/" /%TESTNUMBER/foo
 * LIST () "/" /%TESTNUMBER/foo/bar
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP LIST mailbox
- </name>
- <command>
+</name>
+<command>
 imap://%HOSTIP:%IMAPPORT/%TESTNUMBER -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 LIST "%TESTNUMBER" *
diff --git a/third-party/curl/tests/data/test807 b/third-party/curl/tests/data/test807
index ba672d5f0b..2b8bb5d9d6 100644
--- a/third-party/curl/tests/data/test807
+++ b/third-party/curl/tests/data/test807
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,34 +9,31 @@ CUSTOMREQUEST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 * LSUB () "/" /%TESTNUMBER/blurdybloop
 * LSUB (\Noselect) "/" /%TESTNUMBER/foo
 * LSUB () "/" /%TESTNUMBER/foo/bar
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP LSUB mailbox
- </name>
- <command>
+</name>
+<command>
 imap://%HOSTIP:%IMAPPORT -u user:secret -X 'LSUB "%TESTNUMBER" *'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 LSUB "%TESTNUMBER" *
diff --git a/third-party/curl/tests/data/test808 b/third-party/curl/tests/data/test808
index 95f65aec10..03522380ee 100644
--- a/third-party/curl/tests/data/test808
+++ b/third-party/curl/tests/data/test808
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ CUSTOMREQUEST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 * 17 EXISTS
 * 2 RECENT
 * OK [UNSEEN 8] Message 8 is first unseen
@@ -22,24 +22,22 @@ CUSTOMREQUEST
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP EXAMINE mailbox (CUSTOMREQUEST)
- </name>
- <command>
+</name>
+<command>
 imap://%HOSTIP:%IMAPPORT -u user:secret -X 'EXAMINE %TESTNUMBER'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 EXAMINE %TESTNUMBER
diff --git a/third-party/curl/tests/data/test809 b/third-party/curl/tests/data/test809
index c31b3b903a..55b967e7dc 100644
--- a/third-party/curl/tests/data/test809
+++ b/third-party/curl/tests/data/test809
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,32 +9,29 @@ CUSTOMREQUEST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 * STATUS %TESTNUMBER (MESSAGES 231 UIDNEXT 44292)
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP mailbox STATUS (CUSTOMREQUEST)
- </name>
- <command>
+</name>
+<command>
 imap://%HOSTIP:%IMAPPORT -u user:secret -X 'STATUS %TESTNUMBER (UIDNEXT MESSAGES)'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 STATUS %TESTNUMBER (UIDNEXT MESSAGES)
diff --git a/third-party/curl/tests/data/test81 b/third-party/curl/tests/data/test81
index 55a3d351de..abec58208a 100644
--- a/third-party/curl/tests/data/test81
+++ b/third-party/curl/tests/data/test81
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -14,7 +15,7 @@ NTLM
 
 # This is supposed to be returned when the server gets a first
 # Authorization: NTLM line passed-in from the client
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 407 Now gimme that second request of crap
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -26,7 +27,7 @@ This is not the real page either!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 200 Things are fine in server land swsclose
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -35,7 +36,7 @@ Content-Length: 32
 Finally, this is the real page!
 </data1002>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 407 Now gimme that second request of crap
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -73,10 +74,10 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --proxy-user testuser:testpass -x http://%H
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Proxy-Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test810 b/third-party/curl/tests/data/test810
index de865d87b7..8b53c75afc 100644
--- a/third-party/curl/tests/data/test810
+++ b/third-party/curl/tests/data/test810
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,32 +8,29 @@ SEARCH
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 * SEARCH 1 123 456 %TESTNUMBER
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP SEARCH for NEW messages
- </name>
- <command>
+</name>
+<command>
 imap://%HOSTIP:%IMAPPORT/%TESTNUMBER?NEW -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 SELECT %TESTNUMBER
diff --git a/third-party/curl/tests/data/test811 b/third-party/curl/tests/data/test811
index 1dd4b03c28..4628a7ee91 100644
--- a/third-party/curl/tests/data/test811
+++ b/third-party/curl/tests/data/test811
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,29 +9,26 @@ CUSTOMREQUEST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP CREATE mailbox (CUSTOMREQUEST)
- </name>
- <command>
+</name>
+<command>
 imap://%HOSTIP:%IMAPPORT -u user:secret -X 'CREATE %TESTNUMBER'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 CREATE %TESTNUMBER
diff --git a/third-party/curl/tests/data/test812 b/third-party/curl/tests/data/test812
index 794c8cce43..2bb235c99f 100644
--- a/third-party/curl/tests/data/test812
+++ b/third-party/curl/tests/data/test812
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,29 +9,26 @@ CUSTOMREQUEST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP DELETE mailbox (CUSTOMREQUEST)
- </name>
- <command>
+</name>
+<command>
 imap://%HOSTIP:%IMAPPORT -u user:secret -X 'DELETE %TESTNUMBER'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 DELETE %TESTNUMBER
diff --git a/third-party/curl/tests/data/test813 b/third-party/curl/tests/data/test813
index 649d7b4cb2..f762a4bd4c 100644
--- a/third-party/curl/tests/data/test813
+++ b/third-party/curl/tests/data/test813
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,29 +9,26 @@ CUSTOMREQUEST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP RENAME mailbox (CUSTOMREQUEST)
- </name>
- <command>
+</name>
+<command>
 imap://%HOSTIP:%IMAPPORT -u user:secret -X 'RENAME 666 %TESTNUMBER'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 RENAME 666 %TESTNUMBER
diff --git a/third-party/curl/tests/data/test814 b/third-party/curl/tests/data/test814
index 930b13206c..55dc174f48 100644
--- a/third-party/curl/tests/data/test814
+++ b/third-party/curl/tests/data/test814
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,29 +9,26 @@ CUSTOMREQUEST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP CHECK mailbox (CUSTOMREQUEST)
- </name>
- <command>
+</name>
+<command>
 imap://%HOSTIP:%IMAPPORT/%TESTNUMBER -u user:secret -X 'CHECK'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 SELECT %TESTNUMBER
diff --git a/third-party/curl/tests/data/test815 b/third-party/curl/tests/data/test815
index 6c83529fde..fddac796e6 100644
--- a/third-party/curl/tests/data/test815
+++ b/third-party/curl/tests/data/test815
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,32 +10,29 @@ CUSTOMREQUEST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data1>
+<data1 crlf="yes">
 * 123 FETCH (FLAGS (\Seen \Deleted))
 </data1>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP STORE - delete message (CUSTOMREQUEST)
- </name>
- <command>
+</name>
+<command>
 imap://%HOSTIP:%IMAPPORT/%TESTNUMBER -X 'STORE 123 +Flags \Deleted' -u user:secret -: imap://%HOSTIP:%IMAPPORT/%TESTNUMBER -X CLOSE -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 SELECT %TESTNUMBER
diff --git a/third-party/curl/tests/data/test816 b/third-party/curl/tests/data/test816
index 9c63e0a6aa..6bdeaccd5f 100644
--- a/third-party/curl/tests/data/test816
+++ b/third-party/curl/tests/data/test816
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,35 +10,32 @@ CUSTOMREQUEST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data1>
+<data1 crlf="yes">
 * 123 FETCH (FLAGS (\Seen \Deleted))
 </data1>
-<data2>
+<data2 crlf="yes">
 * 123 EXPUNGE
 </data2>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP STORE - delete message with confirmation (CUSTOMREQUEST)
- </name>
- <command>
+</name>
+<command>
 imap://%HOSTIP:%IMAPPORT/%TESTNUMBER -X 'STORE 123 +Flags \Deleted' -u user:secret -: imap://%HOSTIP:%IMAPPORT/%TESTNUMBER -X EXPUNGE -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 SELECT %TESTNUMBER
diff --git a/third-party/curl/tests/data/test817 b/third-party/curl/tests/data/test817
index 3f6575c2c2..36cb1dff3f 100644
--- a/third-party/curl/tests/data/test817
+++ b/third-party/curl/tests/data/test817
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,29 +9,26 @@ CUSTOMREQUEST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP COPY message to mailbox (CUSTOMREQUEST)
- </name>
- <command>
+</name>
+<command>
 imap://%HOSTIP:%IMAPPORT -u user:secret -X 'COPY 123 %TESTNUMBER'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 COPY 123 %TESTNUMBER
diff --git a/third-party/curl/tests/data/test818 b/third-party/curl/tests/data/test818
index 7b34edb306..cd55e4d8ca 100644
--- a/third-party/curl/tests/data/test818
+++ b/third-party/curl/tests/data/test818
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ CUSTOMREQUEST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 * 22 EXPUNGE
 * 23 EXISTS
 * 3 RECENT
@@ -19,24 +19,22 @@ CUSTOMREQUEST
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP NOOP (CUSTOMREQUEST)
- </name>
- <command>
+</name>
+<command>
 imap://%HOSTIP:%IMAPPORT -X NOOP -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 NOOP
diff --git a/third-party/curl/tests/data/test819 b/third-party/curl/tests/data/test819
index 216a5493d4..266f46f74a 100644
--- a/third-party/curl/tests/data/test819
+++ b/third-party/curl/tests/data/test819
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,15 +9,14 @@ RFC4616
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH PLAIN
 REPLY AUTHENTICATE +
-REPLY AHVzZXIAc2VjcmV0 A002 OK AUTHENTICATE completed
+REPLY %b64[%00user%00secret]b64% A002 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -27,27 +27,25 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP plain authentication
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE PLAIN
-AHVzZXIAc2VjcmV0
+%b64[%00user%00secret]b64%
 A003 SELECT %TESTNUMBER
 A004 FETCH 1 BODY[]
 A005 LOGOUT
diff --git a/third-party/curl/tests/data/test82 b/third-party/curl/tests/data/test82
index 0bbcf6aae6..dcb7f3592f 100644
--- a/third-party/curl/tests/data/test82
+++ b/third-party/curl/tests/data/test82
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,7 @@ HTTP proxy NTLM auth
 # Server-side
 <reply>
 
-<data>
+<data crlf="headers">
 HTTP/1.1 407 We only deal with NTLM my friend
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -31,20 +32,20 @@ proxy
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with proxy requiring NTLM, but we send Basic
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --proxy-user testuser:testpass -x http://%HOSTIP:%HTTPPORT
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Proxy-Authorization: Basic dGVzdHVzZXI6dGVzdHBhc3M=
+Proxy-Authorization: Basic %b64[testuser:testpass]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test820 b/third-party/curl/tests/data/test820
index 5cc3b6dd71..91f0902be7 100644
--- a/third-party/curl/tests/data/test820
+++ b/third-party/curl/tests/data/test820
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,16 +8,15 @@ SASL AUTH LOGIN
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH LOGIN
-REPLY AUTHENTICATE + VXNlcm5hbWU6
-REPLY dXNlcg== + UGFzc3dvcmQ6
-REPLY c2VjcmV0 A002 OK AUTHENTICATE completed
+REPLY AUTHENTICATE + %b64[Username:]b64%
+REPLY %b64[user]b64% + %b64[Password:]b64%
+REPLY %b64[secret]b64% A002 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -27,28 +27,26 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP login authentication
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE LOGIN
-dXNlcg==
-c2VjcmV0
+%b64[user]b64%
+%b64[secret]b64%
 A003 SELECT %TESTNUMBER
 A004 FETCH 1 BODY[]
 A005 LOGOUT
diff --git a/third-party/curl/tests/data/test821 b/third-party/curl/tests/data/test821
index d1870f6bc4..f0ecdc3ade 100644
--- a/third-party/curl/tests/data/test821
+++ b/third-party/curl/tests/data/test821
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,15 +9,14 @@ RFC2195
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH CRAM-MD5
-REPLY AUTHENTICATE + PDE5NzIuOTg3NjU0MzIxQGN1cmw+
-REPLY dXNlciA3MDMxNzI1NTk5ZmRiYjVkNDEyNjg5YWEzMjNlM2UwYg== A002 OK AUTHENTICATE completed
+REPLY AUTHENTICATE + %b64[%3c1972.987654321@curl%3e]b64%
+REPLY %b64[user 7031725599fdbb5d412689aa323e3e0b]b64% A002 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -27,7 +27,6 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -35,22 +34,22 @@ imap
 </server>
 <features>
 crypto
+digest
 </features>
- <name>
+<name>
 IMAP CRAM-MD5 authentication
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE CRAM-MD5
-dXNlciA3MDMxNzI1NTk5ZmRiYjVkNDEyNjg5YWEzMjNlM2UwYg==
+%b64[user 7031725599fdbb5d412689aa323e3e0b]b64%
 A003 SELECT %TESTNUMBER
 A004 FETCH 1 BODY[]
 A005 LOGOUT
diff --git a/third-party/curl/tests/data/test822 b/third-party/curl/tests/data/test822
index 003988e150..71c693e4b5 100644
--- a/third-party/curl/tests/data/test822
+++ b/third-party/curl/tests/data/test822
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,16 +9,15 @@ NTLM
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH NTLM
 REPLY AUTHENTICATE +
-REPLY TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA= + TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
+REPLY %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64% + TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
 REPLY TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAALAAsAeAAAAAAAAAAAAAAAhoIBAFpkQwKRCZFMhjj0tw47wEjKHRHlvzfxQamFcheMuv8v+xeqphEO5V41xRd7R9deOXRlc3R1c2VyV09SS1NUQVRJT04= A002 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -28,7 +28,6 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -47,13 +46,12 @@ IMAP NTLM authentication
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE NTLM
-TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+%b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAALAAsAeAAAAAAAAAAAAAAAhoIBAFpkQwKRCZFMhjj0tw47wEjKHRHlvzfxQamFcheMuv8v+xeqphEO5V41xRd7R9deOXRlc3R1c2VyV09SS1NUQVRJT04=
 A003 SELECT %TESTNUMBER
 A004 FETCH 1 BODY[]
diff --git a/third-party/curl/tests/data/test823 b/third-party/curl/tests/data/test823
index aab0092ad1..0c3b17b550 100644
--- a/third-party/curl/tests/data/test823
+++ b/third-party/curl/tests/data/test823
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,16 +9,15 @@ RFC2831
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH DIGEST-MD5
-REPLY AUTHENTICATE + cmVhbG09ImN1cmwiLG5vbmNlPSI1MzAwZDE3YTFkNjk1YmQ0MTFlNGNkZjk2Zjk1NDhjMjNjZWQ2MTc1IixhbGdvcml0aG09bWQ1LXNlc3MscW9wPSJhdXRoIg==
-REPLY dXNlcm5hbWU9InVzZXIiLHJlYWxtPSJjdXJsIixub25jZT0iNTMwMGQxN2ExZDY5NWJkNDExZTRjZGY5NmY5NTQ4YzIzY2VkNjE3NSIsY25vbmNlPSIzNDMzMzIzMTM1MzMzMjMxMzYzMzMyMzEzNzMzMzIzMSIsbmM9IjAwMDAwMDAxIixkaWdlc3QtdXJpPSJpbWFwLzEyNy4wLjAuMSIscmVzcG9uc2U9YmU2MzgyNDkzNjJkN2FhMGUzNTM4NTA3Njc1MWFiNDgscW9wPWF1dGg= + cnNwYXV0aD04MWY5MDNlYjQ4MjNhZTkyMmRiNWYwNGNiNThjY2RlYg==
+REPLY AUTHENTICATE + %b64[realm="curl",nonce="5300d17a1d695bd411e4cdf96f9548c23ced6175",algorithm=md5-sess,qop="auth"]b64%
+REPLY %b64[username="user",realm="curl",nonce="5300d17a1d695bd411e4cdf96f9548c23ced6175",cnonce="34333231353332313633323137333231",nc="00000001",digest-uri="imap/127.0.0.1",response=be638249362d7aa0e35385076751ab48,qop=auth]b64% + %b64[rspauth=81f903eb4823ae922db5f04cb58ccdeb]b64%
 REPLY  A002 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -28,7 +28,6 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -36,24 +35,27 @@ imap
 </server>
 <features>
 !SSPI
-debug
+Debug
 crypto
+digest
 </features>
- <name>
+<setenv>
+CURL_ENTROPY=12345678
+</setenv>
+<name>
 IMAP DIGEST-MD5 authentication
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE DIGEST-MD5
-dXNlcm5hbWU9InVzZXIiLHJlYWxtPSJjdXJsIixub25jZT0iNTMwMGQxN2ExZDY5NWJkNDExZTRjZGY5NmY5NTQ4YzIzY2VkNjE3NSIsY25vbmNlPSIzNDMzMzIzMTM1MzMzMjMxMzYzMzMyMzEzNzMzMzIzMSIsbmM9IjAwMDAwMDAxIixkaWdlc3QtdXJpPSJpbWFwLzEyNy4wLjAuMSIscmVzcG9uc2U9YmU2MzgyNDkzNjJkN2FhMGUzNTM4NTA3Njc1MWFiNDgscW9wPWF1dGg=
+%b64[username="user",realm="curl",nonce="5300d17a1d695bd411e4cdf96f9548c23ced6175",cnonce="34333231353332313633323137333231",nc="00000001",digest-uri="imap/127.0.0.1",response=be638249362d7aa0e35385076751ab48,qop=auth]b64%
 
 A003 SELECT %TESTNUMBER
 A004 FETCH 1 BODY[]
diff --git a/third-party/curl/tests/data/test824 b/third-party/curl/tests/data/test824
index de15afe3b6..0bce1c3f4e 100644
--- a/third-party/curl/tests/data/test824
+++ b/third-party/curl/tests/data/test824
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,15 +9,14 @@ RFC6749
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH XOAUTH2
 REPLY AUTHENTICATE +
-REPLY dXNlcj11c2VyAWF1dGg9QmVhcmVyIG1GXzkuQjVmLTQuMUpxTQEB A002 OK AUTHENTICATE completed
+REPLY %b64[user=user%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64% A002 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -27,27 +27,25 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP OAuth 2.0 (XOAUTH2) authentication
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user --oauth2-bearer mF_9.B5f-4.1JqM
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE XOAUTH2
-dXNlcj11c2VyAWF1dGg9QmVhcmVyIG1GXzkuQjVmLTQuMUpxTQEB
+%b64[user=user%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64%
 A003 SELECT %TESTNUMBER
 A004 FETCH 1 BODY[]
 A005 LOGOUT
diff --git a/third-party/curl/tests/data/test825 b/third-party/curl/tests/data/test825
index c5f9b46632..386973c4b8 100644
--- a/third-party/curl/tests/data/test825
+++ b/third-party/curl/tests/data/test825
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,6 @@ RFC4616
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -17,7 +17,7 @@ AUTH PLAIN
 CAPA SASL-IR
 REPLY AUTHENTICATE A002 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -28,26 +28,24 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP plain authentication with initial response
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
-A002 AUTHENTICATE PLAIN AHVzZXIAc2VjcmV0
+A002 AUTHENTICATE PLAIN %b64[%00user%00secret]b64%
 A003 SELECT %TESTNUMBER
 A004 FETCH 1 BODY[]
 A005 LOGOUT
diff --git a/third-party/curl/tests/data/test826 b/third-party/curl/tests/data/test826
index d3252d8666..8ea816fb85 100644
--- a/third-party/curl/tests/data/test826
+++ b/third-party/curl/tests/data/test826
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,16 +9,15 @@ SASL-IR
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH LOGIN
 CAPA SASL-IR
-REPLY AUTHENTICATE + UGFzc3dvcmQ6
-REPLY c2VjcmV0 A002 OK AUTHENTICATE completed
+REPLY AUTHENTICATE + %b64[Password:]b64%
+REPLY %b64[secret]b64% A002 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -28,27 +28,25 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP login authentication with initial response
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
-A002 AUTHENTICATE LOGIN dXNlcg==
-c2VjcmV0
+A002 AUTHENTICATE LOGIN %b64[user]b64%
+%b64[secret]b64%
 A003 SELECT %TESTNUMBER
 A004 FETCH 1 BODY[]
 A005 LOGOUT
diff --git a/third-party/curl/tests/data/test827 b/third-party/curl/tests/data/test827
index d392928f4d..7c324b3d32 100644
--- a/third-party/curl/tests/data/test827
+++ b/third-party/curl/tests/data/test827
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,6 @@ NTLM
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -18,7 +18,7 @@ CAPA SASL-IR
 REPLY AUTHENTICATE + TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
 REPLY TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAALAAsAeAAAAAAAAAAAAAAAhoIBAFpkQwKRCZFMhjj0tw47wEjKHRHlvzfxQamFcheMuv8v+xeqphEO5V41xRd7R9deOXRlc3R1c2VyV09SS1NUQVRJT04= A002 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -29,7 +29,6 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -48,12 +47,11 @@ IMAP NTLM authentication with initial response
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
-A002 AUTHENTICATE NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+A002 AUTHENTICATE NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAALAAsAeAAAAAAAAAAAAAAAhoIBAFpkQwKRCZFMhjj0tw47wEjKHRHlvzfxQamFcheMuv8v+xeqphEO5V41xRd7R9deOXRlc3R1c2VyV09SS1NUQVRJT04=
 A003 SELECT %TESTNUMBER
 A004 FETCH 1 BODY[]
diff --git a/third-party/curl/tests/data/test828 b/third-party/curl/tests/data/test828
index 4ea9060600..c488a47e88 100644
--- a/third-party/curl/tests/data/test828
+++ b/third-party/curl/tests/data/test828
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,6 @@ RFC6749
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -17,7 +17,7 @@ AUTH XOAUTH2
 CAPA SASL-IR
 REPLY AUTHENTICATE A002 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -28,26 +28,24 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP OAuth 2.0 (XOAUTH2) authentication with initial response
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user --oauth2-bearer mF_9.B5f-4.1JqM
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
-A002 AUTHENTICATE XOAUTH2 dXNlcj11c2VyAWF1dGg9QmVhcmVyIG1GXzkuQjVmLTQuMUpxTQEB
+A002 AUTHENTICATE XOAUTH2 %b64[user=user%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64%
 A003 SELECT %TESTNUMBER
 A004 FETCH 1 BODY[]
 A005 LOGOUT
diff --git a/third-party/curl/tests/data/test829 b/third-party/curl/tests/data/test829
index 46ff4e165a..eedd20381e 100644
--- a/third-party/curl/tests/data/test829
+++ b/third-party/curl/tests/data/test829
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,15 +12,14 @@ CRLF-in-URL
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP with URL-encoded CR LF in the URL
- </name>
- <command>
+</name>
+<command>
 imap://%HOSTIP:%IMAPPORT/%0d%0a/%TESTNUMBER
 </command>
 </client>
 
-#
 <verify>
 # 3 - CURLE_URL_MALFORMAT
 <errorcode>
diff --git a/third-party/curl/tests/data/test83 b/third-party/curl/tests/data/test83
index 7faffe75ac..53f38674ea 100644
--- a/third-party/curl/tests/data/test83
+++ b/third-party/curl/tests/data/test83
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ HTTP Basic auth
 proxytunnel
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -21,13 +21,13 @@ Content-Length: 9
 
 contents
 </data>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 
 </connect>
 <datacheck>
-HTTP/1.1 200 Mighty fine indeed
-
+HTTP/1.1 200 Mighty fine indeed%CR
+%CR
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -39,17 +39,16 @@ contents
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 http-proxy
 </server>
- <name>
+<name>
 HTTP over proxy-tunnel with site authentication
- </name>
- <command>
+</name>
+<command>
 http://test.%TESTNUMBER:%HTTPPORT/we/want/that/page/%TESTNUMBER -p -x %HOSTIP:%PROXYPORT --user 'iam:my:;self'
 </command>
 <features>
@@ -57,20 +56,19 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 CONNECT test.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: test.%TESTNUMBER:%HTTPPORT
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
 </proxy>
-<protocol>
+<protocol crlf="headers">
 GET /we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: test.%TESTNUMBER:%HTTPPORT
-Authorization: Basic aWFtOm15OjtzZWxm
+Authorization: Basic %b64[iam:my:;self]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test830 b/third-party/curl/tests/data/test830
index edf1b64a87..36ab0a31ec 100644
--- a/third-party/curl/tests/data/test830
+++ b/third-party/curl/tests/data/test830
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,6 @@ RFC2195
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -20,7 +20,6 @@ REPLY * A002 NO AUTH exchange cancelled by client
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -28,26 +27,25 @@ imap
 </server>
 <features>
 crypto
+digest
 </features>
- <name>
+<name>
 IMAP CRAM-MD5 graceful cancellation
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 67 - CURLE_LOGIN_DENIED
 <errorcode>
 67
 </errorcode>
-#
 # The multi interface considers a broken "CONNECT" as a prematurely broken
-# transfer and such a connection will not get a "LOGOUT"
-<protocol>
+# transfer and such a connection does not get a "LOGOUT"
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE CRAM-MD5
 *
diff --git a/third-party/curl/tests/data/test831 b/third-party/curl/tests/data/test831
index 154369b16f..436f98fd10 100644
--- a/third-party/curl/tests/data/test831
+++ b/third-party/curl/tests/data/test831
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,19 +9,17 @@ SASL CANCELLATION
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH NTLM
 CAPA LOGINDISABLED
 REPLY AUTHENTICATE +
-REPLY TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA= + Rubbish
+REPLY %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64% + Rubbish
 REPLY * A002 NO AUTH exchange cancelled by client
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -31,37 +30,26 @@ NTLM
 SSL
 !SSPI
 </features>
- <name>
+<name>
 IMAP NTLM graceful cancellation
- </name>
- <setenv>
-# we force our own host name, in order to make the test machine independent
-CURL_GETHOSTNAME=curlhost
-# we try to use the LD_PRELOAD hack, if not a debug build
-LD_PRELOAD=%PWD/libtest/.libs/libhostname.so
- </setenv>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u testuser:testpass
 </command>
-<precheck>
-chkhostname curlhost
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 67 - CURLE_LOGIN_DENIED
 <errorcode>
 67
 </errorcode>
-#
 # The multi interface considers a broken "CONNECT" as a prematurely broken
-# transfer and such a connection will not get a "LOGOUT"
-<protocol>
+# transfer and such a connection does not get a "LOGOUT"
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE NTLM
-TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+%b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 *
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test832 b/third-party/curl/tests/data/test832
index b54ec6d6f4..bcc7465724 100644
--- a/third-party/curl/tests/data/test832
+++ b/third-party/curl/tests/data/test832
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,6 @@ RFC2831
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -20,7 +20,6 @@ REPLY * A002 NO AUTH exchange cancelled by client
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -28,28 +27,27 @@ imap
 </server>
 <features>
 !SSPI
-debug
+Debug
 crypto
+digest
 </features>
- <name>
+<name>
 IMAP DIGEST-MD5 graceful cancellation
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 67 - CURLE_LOGIN_DENIED
 <errorcode>
 67
 </errorcode>
-#
 # The multi interface considers a broken "CONNECT" as a prematurely broken
-# transfer and such a connection will not get a "LOGOUT"
-<protocol>
+# transfer and such a connection does not get a "LOGOUT"
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE DIGEST-MD5
 *
diff --git a/third-party/curl/tests/data/test833 b/third-party/curl/tests/data/test833
index a5eb9d2693..63ec5950d5 100644
--- a/third-party/curl/tests/data/test833
+++ b/third-party/curl/tests/data/test833
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ RFC2195
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -18,9 +18,9 @@ AUTH CRAM-MD5 PLAIN
 REPLY "AUTHENTICATE CRAM-MD5" + Rubbish
 REPLY * A002 NO AUTH exchange cancelled by client
 REPLY "AUTHENTICATE PLAIN" +
-REPLY AHVzZXIAc2VjcmV0 A003 OK AUTHENTICATE completed
+REPLY %b64[%00user%00secret]b64% A003 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -31,7 +31,6 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -39,24 +38,24 @@ imap
 </server>
 <features>
 crypto
+digest
 </features>
- <name>
+<name>
 IMAP CRAM-MD5 authentication with SASL downgrade
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE CRAM-MD5
 *
 A003 AUTHENTICATE PLAIN
-AHVzZXIAc2VjcmV0
+%b64[%00user%00secret]b64%
 A004 SELECT %TESTNUMBER
 A005 FETCH 1 BODY[]
 A006 LOGOUT
diff --git a/third-party/curl/tests/data/test834 b/third-party/curl/tests/data/test834
index 3650cee6a4..818e150cc3 100644
--- a/third-party/curl/tests/data/test834
+++ b/third-party/curl/tests/data/test834
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,18 +10,17 @@ SASL DOWNGRADE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH NTLM PLAIN
 REPLY "AUTHENTICATE NTLM" +
-REPLY TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA= + Rubbish
+REPLY %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64% + Rubbish
 REPLY * A002 NO AUTH exchange cancelled by client
 REPLY "AUTHENTICATE PLAIN" +
-REPLY AHVzZXIAc2VjcmV0 A003 OK AUTHENTICATE completed
+REPLY %b64[%00user%00secret]b64% A003 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -31,7 +31,6 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -42,33 +41,23 @@ NTLM
 SSL
 !SSPI
 </features>
- <name>
+<name>
 IMAP NTLM authentication with SASL downgrade
- </name>
- <setenv>
-# we force our own host name, in order to make the test machine independent
-CURL_GETHOSTNAME=curlhost
-# we try to use the LD_PRELOAD hack, if not a debug build
-LD_PRELOAD=%PWD/libtest/.libs/libhostname.so
- </setenv>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user:secret
 </command>
-<precheck>
-chkhostname curlhost
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE NTLM
-TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+%b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 *
 A003 AUTHENTICATE PLAIN
-AHVzZXIAc2VjcmV0
+%b64[%00user%00secret]b64%
 A004 SELECT %TESTNUMBER
 A005 FETCH 1 BODY[]
 A006 LOGOUT
diff --git a/third-party/curl/tests/data/test835 b/third-party/curl/tests/data/test835
index 809fdca69f..e6631d6f7c 100644
--- a/third-party/curl/tests/data/test835
+++ b/third-party/curl/tests/data/test835
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ RFC2831
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -18,9 +18,9 @@ AUTH DIGEST-MD5 PLAIN
 REPLY "AUTHENTICATE DIGEST-MD5" + Rubbish
 REPLY * A002 NO AUTH exchange cancelled by client
 REPLY "AUTHENTICATE PLAIN" +
-REPLY AHVzZXIAc2VjcmV0 A003 OK AUTHENTICATE completed
+REPLY %b64[%00user%00secret]b64% A003 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -31,7 +31,6 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -39,26 +38,26 @@ imap
 </server>
 <features>
 !SSPI
-debug
+Debug
 crypto
+digest
 </features>
- <name>
+<name>
 IMAP DIGEST-MD5 authentication with SASL downgrade
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE DIGEST-MD5
 *
 A003 AUTHENTICATE PLAIN
-AHVzZXIAc2VjcmV0
+%b64[%00user%00secret]b64%
 A004 SELECT %TESTNUMBER
 A005 FETCH 1 BODY[]
 A006 LOGOUT
diff --git a/third-party/curl/tests/data/test836 b/third-party/curl/tests/data/test836
index bbb6f84069..23d31e4996 100644
--- a/third-party/curl/tests/data/test836
+++ b/third-party/curl/tests/data/test836
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,14 +9,13 @@ connection reuse
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 REPLY "LOGIN user.one secret" A002 OK LOGIN completed
 REPLY "LOGIN user.two secret" B002 OK LOGIN completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -26,24 +26,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP multiple connection authentication
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user.one:secret -: 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;UID=2' -u user.two:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user.one secret
 A003 SELECT %TESTNUMBER
diff --git a/third-party/curl/tests/data/test837 b/third-party/curl/tests/data/test837
index d89ea263eb..275f5bd892 100644
--- a/third-party/curl/tests/data/test837
+++ b/third-party/curl/tests/data/test837
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,15 +9,14 @@ RFC4422
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH EXTERNAL
 REPLY AUTHENTICATE +
-REPLY dXNlcg== A002 OK AUTHENTICATE completed
+REPLY %b64[user]b64% A002 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -27,27 +27,25 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP external authentication
- </name>
- <command>
+</name>
+<command>
 'imap://user;AUTH=EXTERNAL@%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE EXTERNAL
-dXNlcg==
+%b64[user]b64%
 A003 SELECT %TESTNUMBER
 A004 FETCH 1 BODY[]
 A005 LOGOUT
diff --git a/third-party/curl/tests/data/test838 b/third-party/curl/tests/data/test838
index 96ecf98dfd..b28f7da322 100644
--- a/third-party/curl/tests/data/test838
+++ b/third-party/curl/tests/data/test838
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ RFC4422
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -16,7 +16,7 @@ AUTH EXTERNAL
 REPLY AUTHENTICATE +
 REPLY = A002 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -27,24 +27,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP external authentication without credentials
- </name>
- <command>
+</name>
+<command>
 'imap://;AUTH=EXTERNAL@%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE EXTERNAL
 =
diff --git a/third-party/curl/tests/data/test839 b/third-party/curl/tests/data/test839
index c20dcd89d8..49ca1ac733 100644
--- a/third-party/curl/tests/data/test839
+++ b/third-party/curl/tests/data/test839
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,6 @@ RFC4422
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -17,7 +17,7 @@ AUTH EXTERNAL
 CAPA SASL-IR
 REPLY AUTHENTICATE A002 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -28,26 +28,24 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP external authentication with initial response
- </name>
- <command>
+</name>
+<command>
 'imap://user;AUTH=EXTERNAL@%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
-A002 AUTHENTICATE EXTERNAL dXNlcg==
+A002 AUTHENTICATE EXTERNAL %b64[user]b64%
 A003 SELECT %TESTNUMBER
 A004 FETCH 1 BODY[]
 A005 LOGOUT
diff --git a/third-party/curl/tests/data/test84 b/third-party/curl/tests/data/test84
index 79eeb2c77f..0bf053ffd6 100644
--- a/third-party/curl/tests/data/test84
+++ b/third-party/curl/tests/data/test84
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP Basic auth
 HTTP proxy
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -21,16 +21,15 @@ contents
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP over proxy with site authentication
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER -x %HOSTIP:%HTTPPORT --user iam:myself
 </command>
 <features>
@@ -38,13 +37,12 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic aWFtOm15c2VsZg==
+Authorization: Basic %b64[iam:myself]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test840 b/third-party/curl/tests/data/test840
index 0a9292f872..8e56d02089 100644
--- a/third-party/curl/tests/data/test840
+++ b/third-party/curl/tests/data/test840
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,6 @@ RFC4422
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -17,7 +17,7 @@ AUTH EXTERNAL
 CAPA SASL-IR
 REPLY AUTHENTICATE A002 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -28,24 +28,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP external authentication with initial response without credentials
- </name>
- <command>
+</name>
+<command>
 'imap://;AUTH=EXTERNAL@%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE EXTERNAL =
 A003 SELECT %TESTNUMBER
diff --git a/third-party/curl/tests/data/test841 b/third-party/curl/tests/data/test841
index 62ac4c1f49..71d8fed299 100644
--- a/third-party/curl/tests/data/test841
+++ b/third-party/curl/tests/data/test841
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,39 +9,41 @@ CUSTOMREQUEST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 body
 
 + Curl did not used to like this line
 --
   yours sincerely
 </data>
-<datacheck>
+<datacheck crlf="yes">
 * 123 FETCH (BODY[1] {70}
+body
+
++ Curl did not used to like this line
+--
+  yours sincerely
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
-IMAP custom request doesn't check continuation data
- </name>
- <command>
- imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/ -u user:secret -X 'FETCH 123 BODY[1]'
+<name>
+IMAP custom request does not check continuation data
+</name>
+<command>
+imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/ -u user:secret -X 'FETCH 123 BODY[1]'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 SELECT %TESTNUMBER
diff --git a/third-party/curl/tests/data/test842 b/third-party/curl/tests/data/test842
index 30c43de3f4..1eff0c89fe 100644
--- a/third-party/curl/tests/data/test842
+++ b/third-party/curl/tests/data/test842
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,6 @@ RFC7628
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -17,7 +17,7 @@ AUTH OAUTHBEARER
 REPLY AUTHENTICATE +
 REPLY %b64[n,a=user,%01host=127.0.0.1%01port=%IMAPPORT%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64% A002 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -28,26 +28,24 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP OAuth 2.0 (OAUTHBEARER) authentication
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user --oauth2-bearer mF_9.B5f-4.1JqM
 </command>
-# The protocol section doesn't support ways of specifying the raw data in the
+# The protocol section does not support ways of specifying the raw data in the
 # base64 encoded message so we must assert this
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE OAUTHBEARER
 %b64[n,a=user,%01host=127.0.0.1%01port=%IMAPPORT%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64%
diff --git a/third-party/curl/tests/data/test843 b/third-party/curl/tests/data/test843
index 751c05d067..28b322a072 100644
--- a/third-party/curl/tests/data/test843
+++ b/third-party/curl/tests/data/test843
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ RFC7628
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -18,7 +18,7 @@ AUTH OAUTHBEARER
 CAPA SASL-IR
 REPLY AUTHENTICATE A002 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -29,24 +29,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP OAuth 2.0 (OAUTHBEARER) authentication with initial response
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user --oauth2-bearer mF_9.B5f-4.1JqM
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE OAUTHBEARER %b64[n,a=user,%01host=127.0.0.1%01port=%IMAPPORT%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64%
 A003 SELECT %TESTNUMBER
diff --git a/third-party/curl/tests/data/test844 b/third-party/curl/tests/data/test844
index e4c9621249..7237827d98 100644
--- a/third-party/curl/tests/data/test844
+++ b/third-party/curl/tests/data/test844
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,6 @@ RFC7628
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -19,31 +19,28 @@ REPLY %b64[n,a=user,%01host=127.0.0.1%01port=%IMAPPORT%01auth=Bearer mF_9.B5f-4.
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP OAuth 2.0 (OAUTHBEARER) failure as continuation
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user --oauth2-bearer mF_9.B5f-4.1JqM
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 67 - CURLE_LOGIN_DENIED
 <errorcode>
 67
 </errorcode>
-#
 # The multi interface considers a broken "CONNECT" as a prematurely broken
-# transfer and such a connection will not get a "LOGOUT"
-<protocol>
+# transfer and such a connection does not get a "LOGOUT"
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE OAUTHBEARER
 %b64[n,a=user,%01host=127.0.0.1%01port=%IMAPPORT%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64%
diff --git a/third-party/curl/tests/data/test845 b/third-party/curl/tests/data/test845
index 81aede8c89..97f61b7781 100644
--- a/third-party/curl/tests/data/test845
+++ b/third-party/curl/tests/data/test845
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,42 +11,38 @@ RFC7628
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH OAUTHBEARER
 CAPA SASL-IR
-REPLY AUTHENTICATE + eyJzdGF0dXMiOiJpbnZhbGlkX3Rva2VuIiwic2NvcGUiOiJleGFtcGxlX3Njb3BlIiwib3BlbmlkLWNvbmZpZ3VyYXRpb24iOiJodHRwczovL2V4YW1wbGUuY29tLy53ZWxsLWtub3duL29wZW5pZC1jb25maWd1cmF0aW9uIn0=
+REPLY AUTHENTICATE + %b64[{"status":"invalid_token","scope":"example_scope","openid-configuration":"https://example.com/.well-known/openid-configuration"}]b64%
 REPLY AQ== A002 NO Authentication failed
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP OAuth 2.0 (OAUTHBEARER) failure as continuation with initial response
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user --oauth2-bearer mF_9.B5f-4.1JqM
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 67 - CURLE_LOGIN_DENIED
 <errorcode>
 67
 </errorcode>
-#
 # The multi interface considers a broken "CONNECT" as a prematurely broken
-# transfer and such a connection will not get a "LOGOUT"
-<protocol>
+# transfer and such a connection does not get a "LOGOUT"
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE OAUTHBEARER %b64[n,a=user,%01host=127.0.0.1%01port=%IMAPPORT%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64%
 %b64[%01]b64%
diff --git a/third-party/curl/tests/data/test846 b/third-party/curl/tests/data/test846
index 58d9e0fb9f..5ba4859bbc 100644
--- a/third-party/curl/tests/data/test846
+++ b/third-party/curl/tests/data/test846
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,14 +6,13 @@ IMAP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 REPLY welcome * PREAUTH ready to serve already!
 REPLY CAPABILITY * CAPABILITY IMAP4REV1 I18NLEVEL=1 LITERAL+ IDLE UIDPLUS NAMESPACE CHILDREN MAILBOX-REFERRALS BINARY UNSELECT ESEARCH WITHIN SCAN SORT THREAD=REFERENCES THREAD=ORDEREDSUBJECT MULTIAPPEND SASL-IR LOGIN-REFERRALS STARTTLS LOGINDISABLED\r\nA001 OK CAPABILITY completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -23,24 +23,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP PREAUTH response
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u notused:still-provided
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 SELECT %TESTNUMBER
 A003 FETCH 1 BODY[]
diff --git a/third-party/curl/tests/data/test847 b/third-party/curl/tests/data/test847
index 86e77d34c0..8ee2a22b38 100644
--- a/third-party/curl/tests/data/test847
+++ b/third-party/curl/tests/data/test847
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ FETCH
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -21,24 +21,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
-IMAP FETCH message
- </name>
- <command>
+<name>
+IMAP FETCH message with UID
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;UID=1' -u '"user:sec"ret{'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN "\"user" "sec\"ret{"
 A003 SELECT %TESTNUMBER
diff --git a/third-party/curl/tests/data/test848 b/third-party/curl/tests/data/test848
index 0876fc1779..884f5a003c 100644
--- a/third-party/curl/tests/data/test848
+++ b/third-party/curl/tests/data/test848
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,15 +9,14 @@ RFC4616
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH PLAIN
 REPLY AUTHENTICATE +
-REPLY c2hhcmVkLW1haWxib3gAdXNlcgBzZWNyZXQ= A002 OK AUTHENTICATE completed
+REPLY %b64[shared-mailbox%00user%00secret]b64% A002 OK AUTHENTICATE completed
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -27,27 +27,25 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP plain authentication with alternative authorization identity
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u user:secret --sasl-authzid shared-mailbox
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE PLAIN
-c2hhcmVkLW1haWxib3gAdXNlcgBzZWNyZXQ=
+%b64[shared-mailbox%00user%00secret]b64%
 A003 SELECT %TESTNUMBER
 A004 FETCH 1 BODY[]
 A005 LOGOUT
diff --git a/third-party/curl/tests/data/test849 b/third-party/curl/tests/data/test849
index 60d35c72b4..390c331326 100644
--- a/third-party/curl/tests/data/test849
+++ b/third-party/curl/tests/data/test849
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,44 +9,40 @@ RFC4616
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH PLAIN
 REPLY AUTHENTICATE +
-REPLY dXJzZWwAa3VydAB4aXBqM3BsbXE= A002 NO Not authorized
+REPLY %b64[ursel%00kurt%00xipj3plmq]b64% A002 NO Not authorized
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
-IMAP plain authentication with alternative authorization identity (Not authorized)
- </name>
- <command>
+<name>
+IMAP plain auth with alt authorization identity (Not authorized)
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u kurt:xipj3plmq --sasl-authzid ursel
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 67 - CURLE_LOGIN_DENIED
 <errorcode>
 67
 </errorcode>
-#
 # The multi interface considers a broken "CONNECT" as a prematurely broken
-# transfer and such a connection will not get a "LOGOUT"
-<protocol>
+# transfer and such a connection does not get a "LOGOUT"
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 AUTHENTICATE PLAIN
-dXJzZWwAa3VydAB4aXBqM3BsbXE=
+%b64[ursel%00kurt%00xipj3plmq]b64%
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test85 b/third-party/curl/tests/data/test85
index f2e20a7f85..e2ec40c99a 100644
--- a/third-party/curl/tests/data/test85
+++ b/third-party/curl/tests/data/test85
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,6 @@ HTTP proxy Basic auth
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -24,16 +24,15 @@ contents
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP over proxy with site and proxy authentication
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER -x %HOSTIP:%HTTPPORT --user iam:myself --proxy-user testing:this
 </command>
 <features>
@@ -41,14 +40,13 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Proxy-Authorization: Basic dGVzdGluZzp0aGlz
-Authorization: Basic aWFtOm15c2VsZg==
+Proxy-Authorization: Basic %b64[testing:this]b64%
+Authorization: Basic %b64[iam:myself]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test850 b/third-party/curl/tests/data/test850
index 7976192201..01238b4161 100644
--- a/third-party/curl/tests/data/test850
+++ b/third-party/curl/tests/data/test850
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ RETR
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -21,24 +21,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 RETR message
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 USER user
 PASS secret
diff --git a/third-party/curl/tests/data/test851 b/third-party/curl/tests/data/test851
index 2ad7642973..950f21d4d5 100644
--- a/third-party/curl/tests/data/test851
+++ b/third-party/curl/tests/data/test851
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ LIST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -16,24 +16,22 @@ REPLY LIST +OK %TESTNUMBER 100\r\n.
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 LIST one message
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -l -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 USER user
 PASS secret
diff --git a/third-party/curl/tests/data/test852 b/third-party/curl/tests/data/test852
index 746b4b1784..64e2ad33ad 100644
--- a/third-party/curl/tests/data/test852
+++ b/third-party/curl/tests/data/test852
@@ -1,14 +1,13 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 POP3
 Clear Text
 LIST
-FAILURE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -16,27 +15,25 @@ REPLY LIST -ERR no such message
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 LIST invalid message
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -l -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 8
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 CAPA
 USER user
 PASS secret
diff --git a/third-party/curl/tests/data/test853 b/third-party/curl/tests/data/test853
index 5ca8f96bdc..ab7af93f22 100644
--- a/third-party/curl/tests/data/test853
+++ b/third-party/curl/tests/data/test853
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ SLOWDOWN
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 # We use SLOWDOWN to really exercise the end-of-body parsing over multiple
@@ -18,31 +18,29 @@ SLOWDOWN
 </servercmd>
 # When doing LIST, we get the default list output hard-coded in the test
 # POP3 server
-<datacheck>
+<data crlf="yes">
 1 100
 2 4294967400
 3 200
-</datacheck>
+</data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 LIST messages from *SLOW* server
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/ -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 USER user
 PASS secret
diff --git a/third-party/curl/tests/data/test854 b/third-party/curl/tests/data/test854
index 5c3467c43e..6f844d2f48 100644
--- a/third-party/curl/tests/data/test854
+++ b/third-party/curl/tests/data/test854
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ LIST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -17,24 +17,22 @@ REPLY LIST +OK but no messages\r\n.
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 LIST no messages available
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/ -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 USER user
 PASS secret
diff --git a/third-party/curl/tests/data/test855 b/third-party/curl/tests/data/test855
index 1938d941a8..3e01b32216 100644
--- a/third-party/curl/tests/data/test855
+++ b/third-party/curl/tests/data/test855
@@ -1,14 +1,13 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 POP3
 Clear Text
 RETR
-FAILURE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -16,27 +15,25 @@ REPLY RETR -ERR no such message
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 RETR invalid message
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
 8
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 CAPA
 USER user
 PASS secret
diff --git a/third-party/curl/tests/data/test856 b/third-party/curl/tests/data/test856
index 18e9579afd..553907a114 100644
--- a/third-party/curl/tests/data/test856
+++ b/third-party/curl/tests/data/test856
@@ -1,13 +1,12 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 POP3
 Clear Text
-FAILURE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -15,31 +14,28 @@ REPLY PASS -ERR Login failure
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 invalid login
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:wrong
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 67 - CURLE_LOGIN_DENIED
 <errorcode>
 67
 </errorcode>
-#
 # The multi interface considers a broken "CONNECT" as a prematurely broken
-# transfer and such a connection will not get a "QUIT"
-<protocol>
+# transfer and such a connection does not get a "QUIT"
+<protocol crlf="yes">
 CAPA
 USER user
 PASS wrong
diff --git a/third-party/curl/tests/data/test857 b/third-party/curl/tests/data/test857
index f7e2fca23f..2719bdc6ca 100644
--- a/third-party/curl/tests/data/test857
+++ b/third-party/curl/tests/data/test857
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ RETR
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -20,7 +20,7 @@ To: fake@nowhere
 --
   yours sincerely
 </data>
-<datacheck>
+<datacheck crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -32,24 +32,22 @@ To: fake@nowhere
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 RETR message with dot-prefixed line
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 USER user
 PASS secret
diff --git a/third-party/curl/tests/data/test858 b/third-party/curl/tests/data/test858
index 80beb72258..747735cdb3 100644
--- a/third-party/curl/tests/data/test858
+++ b/third-party/curl/tests/data/test858
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,29 +9,26 @@ CUSTOMREQUEST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 DELE message (CUSTOMREQUEST)
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret -X DELE -I
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 USER user
 PASS secret
diff --git a/third-party/curl/tests/data/test859 b/third-party/curl/tests/data/test859
index c9ccc5cf7a..75cf444694 100644
--- a/third-party/curl/tests/data/test859
+++ b/third-party/curl/tests/data/test859
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,29 +9,26 @@ CUSTOMREQUEST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 STAT (CUSTOMREQUEST)
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT -u user:secret -X STAT -I
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 USER user
 PASS secret
diff --git a/third-party/curl/tests/data/test86 b/third-party/curl/tests/data/test86
index c5549225f6..f12902c73d 100644
--- a/third-party/curl/tests/data/test86
+++ b/third-party/curl/tests/data/test86
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ globbing
 [] range
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -47,24 +47,22 @@ crap data
 </data3>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP, urlglob []-retrieval and -o #[num] usage
- </name>
- <command option="no-output">
+</name>
+<command option="no-output">
 "http://%HOSTIP:%HTTPPORT/[%TESTNUMBER0001-%TESTNUMBER0003]" -o "%LOGDIR/dumpit#1.dump"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER0001 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test860 b/third-party/curl/tests/data/test860
index ce0cdf54dd..9a40678a7e 100644
--- a/third-party/curl/tests/data/test860
+++ b/third-party/curl/tests/data/test860
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,29 +9,26 @@ CUSTOMREQUEST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 NOOP (CUSTOMREQUEST)
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT -u user:secret -X NOOP -I
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 USER user
 PASS secret
diff --git a/third-party/curl/tests/data/test861 b/third-party/curl/tests/data/test861
index 67bc3f23c7..985bb02a39 100644
--- a/third-party/curl/tests/data/test861
+++ b/third-party/curl/tests/data/test861
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,6 @@ RFC2449
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -17,31 +17,29 @@ CAPA UIDL USER
 </servercmd>
 # When doing UIDL, we get the default list output hard-coded in the test
 # POP3 server
-<datacheck>
+<datacheck crlf="yes">
 1 1
 2 2
 3 4
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 UIDL (CUSTOMREQUEST)
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT -u user:secret -X UIDL
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 USER user
 PASS secret
diff --git a/third-party/curl/tests/data/test862 b/third-party/curl/tests/data/test862
index 71c42f1546..ceedf839e4 100644
--- a/third-party/curl/tests/data/test862
+++ b/third-party/curl/tests/data/test862
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,37 +10,34 @@ RFC2449
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 CAPA TOP USER
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 retrieve message header (CUSTOMREQUEST)
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT -u user:secret -X 'TOP %TESTNUMBER 0'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 USER user
 PASS secret
diff --git a/third-party/curl/tests/data/test863 b/third-party/curl/tests/data/test863
index 7ea6ae43be..bc752f170a 100644
--- a/third-party/curl/tests/data/test863
+++ b/third-party/curl/tests/data/test863
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,29 +9,26 @@ CUSTOMREQUEST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 RSET (CUSTOMREQUEST)
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT -u user:secret -X RSET -I
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 USER user
 PASS secret
diff --git a/third-party/curl/tests/data/test864 b/third-party/curl/tests/data/test864
index 7cb7fbfbf5..49a561e162 100644
--- a/third-party/curl/tests/data/test864
+++ b/third-party/curl/tests/data/test864
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,14 +7,13 @@ APOP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 CAPA APOP
-REPLY welcome +OK curl POP3 server ready to serve <1972.987654321\@curl>
+REPLY welcome +OK curl POP3 server ready to serve %LT1972.987654321\@curl%GT
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -24,7 +24,6 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -32,19 +31,19 @@ pop3
 </server>
 <features>
 crypto
+digest
 </features>
- <name>
+<name>
 POP3 APOP authentication
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 APOP user 7501b4cdc224d469940e65e7b5e4d6eb
 RETR %TESTNUMBER
diff --git a/third-party/curl/tests/data/test865 b/third-party/curl/tests/data/test865
index 3f50590cc1..7a74fc77eb 100644
--- a/third-party/curl/tests/data/test865
+++ b/third-party/curl/tests/data/test865
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,15 +11,14 @@ RFC5034
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH PLAIN
 REPLY AUTH +
-REPLY AHVzZXIAc2VjcmV0 +OK Login successful
+REPLY %b64[%00user%00secret]b64% +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -29,27 +29,25 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 plain authentication
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 AUTH PLAIN
-AHVzZXIAc2VjcmV0
+%b64[%00user%00secret]b64%
 RETR %TESTNUMBER
 QUIT
 </protocol>
diff --git a/third-party/curl/tests/data/test866 b/third-party/curl/tests/data/test866
index 569eceff05..8909febf6e 100644
--- a/third-party/curl/tests/data/test866
+++ b/third-party/curl/tests/data/test866
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,16 +10,15 @@ RFC5034
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH LOGIN
-REPLY AUTH + VXNlcm5hbWU6
-REPLY dXNlcg== + UGFzc3dvcmQ6
-REPLY c2VjcmV0 +OK Login successful
+REPLY AUTH + %b64[Username:]b64%
+REPLY %b64[user]b64% + %b64[Password:]b64%
+REPLY %b64[secret]b64% +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -29,28 +29,26 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 login authentication
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 AUTH LOGIN
-dXNlcg==
-c2VjcmV0
+%b64[user]b64%
+%b64[secret]b64%
 RETR %TESTNUMBER
 QUIT
 </protocol>
diff --git a/third-party/curl/tests/data/test867 b/third-party/curl/tests/data/test867
index 0400c6861e..bf157b0780 100644
--- a/third-party/curl/tests/data/test867
+++ b/third-party/curl/tests/data/test867
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,15 +11,14 @@ RFC5034
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH CRAM-MD5
-REPLY AUTH + PDE5NzIuOTg3NjU0MzIxQGN1cmw+
-REPLY dXNlciA3MDMxNzI1NTk5ZmRiYjVkNDEyNjg5YWEzMjNlM2UwYg== +OK Login successful
+REPLY AUTH + %b64[%3c1972.987654321@curl%3e]b64%
+REPLY %b64[user 7031725599fdbb5d412689aa323e3e0b]b64% +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -29,7 +29,6 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -37,22 +36,22 @@ pop3
 </server>
 <features>
 crypto
+digest
 </features>
- <name>
+<name>
 POP3 CRAM-MD5 authentication
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 AUTH CRAM-MD5
-dXNlciA3MDMxNzI1NTk5ZmRiYjVkNDEyNjg5YWEzMjNlM2UwYg==
+%b64[user 7031725599fdbb5d412689aa323e3e0b]b64%
 RETR %TESTNUMBER
 QUIT
 </protocol>
diff --git a/third-party/curl/tests/data/test868 b/third-party/curl/tests/data/test868
index f28c9bf55f..a72cb814b1 100644
--- a/third-party/curl/tests/data/test868
+++ b/third-party/curl/tests/data/test868
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,16 +11,15 @@ NTLM
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH NTLM
 REPLY AUTH +
-REPLY TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA= + TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
+REPLY %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64% + TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
 REPLY TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAALAAsAeAAAAAAAAAAAAAAAhoIBAFpkQwKRCZFMhjj0tw47wEjKHRHlvzfxQamFcheMuv8v+xeqphEO5V41xRd7R9deOXRlc3R1c2VyV09SS1NUQVRJT04= +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -30,7 +30,6 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -49,13 +48,12 @@ pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u testuser:testpass
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 AUTH NTLM
-TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+%b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAALAAsAeAAAAAAAAAAAAAAAhoIBAFpkQwKRCZFMhjj0tw47wEjKHRHlvzfxQamFcheMuv8v+xeqphEO5V41xRd7R9deOXRlc3R1c2VyV09SS1NUQVRJT04=
 RETR %TESTNUMBER
 QUIT
diff --git a/third-party/curl/tests/data/test869 b/third-party/curl/tests/data/test869
index a0b75d2825..ee6b181db9 100644
--- a/third-party/curl/tests/data/test869
+++ b/third-party/curl/tests/data/test869
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,16 +11,15 @@ RFC5034
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH DIGEST-MD5
-REPLY AUTH + cmVhbG09ImN1cmwiLG5vbmNlPSI1MzAwZDE3YTFkNjk1YmQ0MTFlNGNkZjk2Zjk1NDhjMjNjZWQ2MTc1IixhbGdvcml0aG09bWQ1LXNlc3MscW9wPSJhdXRoIg==
-REPLY dXNlcm5hbWU9InVzZXIiLHJlYWxtPSJjdXJsIixub25jZT0iNTMwMGQxN2ExZDY5NWJkNDExZTRjZGY5NmY5NTQ4YzIzY2VkNjE3NSIsY25vbmNlPSIzNDMzMzIzMTM1MzMzMjMxMzYzMzMyMzEzNzMzMzIzMSIsbmM9IjAwMDAwMDAxIixkaWdlc3QtdXJpPSJwb3AvMTI3LjAuMC4xIixyZXNwb25zZT0xODMxNTU0OGM3ZjNhMzdlNzE2ZmE4ZTkwZGZhYjliNixxb3A9YXV0aA== + cnNwYXV0aD1mZWNiMzZiNzA4NmUwYjk1ZDkwNjQ1OWVmYThjYzI5ZQ==
+REPLY AUTH + %b64[realm="curl",nonce="5300d17a1d695bd411e4cdf96f9548c23ced6175",algorithm=md5-sess,qop="auth"]b64%
+REPLY %b64[username="user",realm="curl",nonce="5300d17a1d695bd411e4cdf96f9548c23ced6175",cnonce="34333231353332313633323137333231",nc="00000001",digest-uri="pop/127.0.0.1",response=18315548c7f3a37e716fa8e90dfab9b6,qop=auth]b64% + %b64[rspauth=fecb36b7086e0b95d906459efa8cc29e]b64%
 REPLY  +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -30,7 +30,6 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -38,24 +37,27 @@ pop3
 </server>
 <features>
 !SSPI
-debug
+Debug
 crypto
+digest
 </features>
- <name>
+<setenv>
+CURL_ENTROPY=12345678
+</setenv>
+<name>
 POP3 DIGEST-MD5 authentication
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 AUTH DIGEST-MD5
-dXNlcm5hbWU9InVzZXIiLHJlYWxtPSJjdXJsIixub25jZT0iNTMwMGQxN2ExZDY5NWJkNDExZTRjZGY5NmY5NTQ4YzIzY2VkNjE3NSIsY25vbmNlPSIzNDMzMzIzMTM1MzMzMjMxMzYzMzMyMzEzNzMzMzIzMSIsbmM9IjAwMDAwMDAxIixkaWdlc3QtdXJpPSJwb3AvMTI3LjAuMC4xIixyZXNwb25zZT0xODMxNTU0OGM3ZjNhMzdlNzE2ZmE4ZTkwZGZhYjliNixxb3A9YXV0aA==
+%b64[username="user",realm="curl",nonce="5300d17a1d695bd411e4cdf96f9548c23ced6175",cnonce="34333231353332313633323137333231",nc="00000001",digest-uri="pop/127.0.0.1",response=18315548c7f3a37e716fa8e90dfab9b6,qop=auth]b64%
 
 RETR %TESTNUMBER
 QUIT
diff --git a/third-party/curl/tests/data/test87 b/third-party/curl/tests/data/test87
index 432a08f6de..8477513f0a 100644
--- a/third-party/curl/tests/data/test87
+++ b/third-party/curl/tests/data/test87
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,20 +6,18 @@ HTTP
 HTTP GET
 globbing
 [] range
-FAILURE
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data1>
+<data1 crlf="headers">
 HTTP/1.1 200 OK
 Funny-head: yesyes
 Content-Length: 15
 
 the number one
 </data1>
-<data2>
+<data2 crlf="headers">
 HTTP/1.1 200 OK
 Funny-head: yesyes
 Content-Length: 16
@@ -27,7 +26,6 @@ two is nice too
 </data2>
 
 </reply>
-#
 # Client-side
 <client>
 <server>
@@ -36,21 +34,18 @@ http
 <features>
 http
 </features>
- <name>
+<name>
 urlglob with out of range -o #[num] usage
- </name>
- <command option="no-output">
+</name>
+<command option="no-output">
 "http://%HOSTIP:%HTTPPORT/[%TESTNUMBER0001-%TESTNUMBER0002]" -o "%LOGDIR/dumpit%TESTNUMBER-#2.dump"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot". Note that the command line
-# will write both responses into the same file name so only the second
-# survives
-#
+# writes both responses into the same filename so only the second survives
 <verify>
-<file name="%LOGDIR/dumpit%TESTNUMBER-#2.dump">
+<file name="%LOGDIR/dumpit%TESTNUMBER-#2.dump" crlf="headers">
 HTTP/1.1 200 OK
 Funny-head: yesyes
 Content-Length: 16
diff --git a/third-party/curl/tests/data/test870 b/third-party/curl/tests/data/test870
index 88975352f2..2308e7414a 100644
--- a/third-party/curl/tests/data/test870
+++ b/third-party/curl/tests/data/test870
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,15 +11,14 @@ RFC6749
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH XOAUTH2
 REPLY AUTH +
-REPLY dXNlcj11c2VyAWF1dGg9QmVhcmVyIG1GXzkuQjVmLTQuMUpxTQEB +OK Login successful
+REPLY %b64[user=user%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64% +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -29,27 +29,25 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 OAuth 2.0 (XOAUTH2) authentication
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user --oauth2-bearer mF_9.B5f-4.1JqM
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 AUTH XOAUTH2
-dXNlcj11c2VyAWF1dGg9QmVhcmVyIG1GXzkuQjVmLTQuMUpxTQEB
+%b64[user=user%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64%
 RETR %TESTNUMBER
 QUIT
 </protocol>
diff --git a/third-party/curl/tests/data/test871 b/third-party/curl/tests/data/test871
index 24a0ac56d0..a7bf5c81ca 100644
--- a/third-party/curl/tests/data/test871
+++ b/third-party/curl/tests/data/test871
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,14 +12,13 @@ RFC5034
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH PLAIN
 REPLY AUTH +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -29,26 +29,24 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 plain authentication with initial response
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret --sasl-ir
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
-AUTH PLAIN AHVzZXIAc2VjcmV0
+AUTH PLAIN %b64[%00user%00secret]b64%
 RETR %TESTNUMBER
 QUIT
 </protocol>
diff --git a/third-party/curl/tests/data/test872 b/third-party/curl/tests/data/test872
index 97cae2e886..6cd879cdd8 100644
--- a/third-party/curl/tests/data/test872
+++ b/third-party/curl/tests/data/test872
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,15 +11,14 @@ RFC5034
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH LOGIN
-REPLY AUTH + UGFzc3dvcmQ6
-REPLY c2VjcmV0 +OK Login successful
+REPLY AUTH + %b64[Password:]b64%
+REPLY %b64[secret]b64% +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -29,27 +29,25 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 login authentication with initial response
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret --sasl-ir
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
-AUTH LOGIN dXNlcg==
-c2VjcmV0
+AUTH LOGIN %b64[user]b64%
+%b64[secret]b64%
 RETR %TESTNUMBER
 QUIT
 </protocol>
diff --git a/third-party/curl/tests/data/test873 b/third-party/curl/tests/data/test873
index 52bd25189f..6b19999b62 100644
--- a/third-party/curl/tests/data/test873
+++ b/third-party/curl/tests/data/test873
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,6 @@ NTLM
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -19,7 +19,7 @@ AUTH NTLM
 REPLY AUTH + TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
 REPLY TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAALAAsAeAAAAAAAAAAAAAAAhoIBAFpkQwKRCZFMhjj0tw47wEjKHRHlvzfxQamFcheMuv8v+xeqphEO5V41xRd7R9deOXRlc3R1c2VyV09SS1NUQVRJT04= +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -30,7 +30,6 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -49,12 +48,11 @@ pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u testuser:testpass --sasl-ir
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
-AUTH NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+AUTH NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAALAAsAeAAAAAAAAAAAAAAAhoIBAFpkQwKRCZFMhjj0tw47wEjKHRHlvzfxQamFcheMuv8v+xeqphEO5V41xRd7R9deOXRlc3R1c2VyV09SS1NUQVRJT04=
 RETR %TESTNUMBER
 QUIT
diff --git a/third-party/curl/tests/data/test874 b/third-party/curl/tests/data/test874
index 160d2b51aa..c882db2e20 100644
--- a/third-party/curl/tests/data/test874
+++ b/third-party/curl/tests/data/test874
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,14 +12,13 @@ RFC6749
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH XOAUTH2
 REPLY AUTH +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -29,26 +29,24 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 OAuth 2.0 (XOAUTH2) authentication with initial response
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user --oauth2-bearer mF_9.B5f-4.1JqM --sasl-ir
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
-AUTH XOAUTH2 dXNlcj11c2VyAWF1dGg9QmVhcmVyIG1GXzkuQjVmLTQuMUpxTQEB
+AUTH XOAUTH2 %b64[user=user%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64%
 RETR %TESTNUMBER
 QUIT
 </protocol>
diff --git a/third-party/curl/tests/data/test875 b/third-party/curl/tests/data/test875
index 8850fab050..9dc3f726d3 100644
--- a/third-party/curl/tests/data/test875
+++ b/third-party/curl/tests/data/test875
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,15 +12,14 @@ CRLF-in-URL
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 with URL-encoded CR LF in the URL
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%0d%0a/%TESTNUMBER
 </command>
 </client>
 
-#
 <verify>
 # 3 - CURLE_URL_MALFORMAT
 <errorcode>
diff --git a/third-party/curl/tests/data/test876 b/third-party/curl/tests/data/test876
index 791e39f610..3a81468729 100644
--- a/third-party/curl/tests/data/test876
+++ b/third-party/curl/tests/data/test876
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,6 @@ RFC5034
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -21,7 +21,6 @@ REPLY * -ERR AUTH exchange cancelled by client
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -29,26 +28,25 @@ pop3
 </server>
 <features>
 crypto
+digest
 </features>
- <name>
+<name>
 POP3 CRAM-MD5 graceful cancellation
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 67 - CURLE_LOGIN_DENIED
 <errorcode>
 67
 </errorcode>
-#
 # The multi interface considers a broken "CONNECT" as a prematurely broken
-# transfer and such a connection will not get a "QUIT"
-<protocol>
+# transfer and such a connection does not get a "QUIT"
+<protocol crlf="yes">
 CAPA
 AUTH CRAM-MD5
 *
diff --git a/third-party/curl/tests/data/test877 b/third-party/curl/tests/data/test877
index b11d0f3b83..8f359ff8ec 100644
--- a/third-party/curl/tests/data/test877
+++ b/third-party/curl/tests/data/test877
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,18 +11,16 @@ RFC5034
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH NTLM
 REPLY AUTH +
-REPLY TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA= + Rubbish
+REPLY %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64% + Rubbish
 REPLY * -ERR AUTH exchange cancelled by client
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -32,37 +31,26 @@ NTLM
 SSL
 !SSPI
 </features>
- <name>
+<name>
 POP3 NTLM graceful cancellation
- </name>
- <setenv>
-# we force our own host name, in order to make the test machine independent
-CURL_GETHOSTNAME=curlhost
-# we try to use the LD_PRELOAD hack, if not a debug build
-LD_PRELOAD=%PWD/libtest/.libs/libhostname.so
- </setenv>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u testuser:testpass
 </command>
-<precheck>
-chkhostname curlhost
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 67 - CURLE_LOGIN_DENIED
 <errorcode>
 67
 </errorcode>
-#
 # The multi interface considers a broken "CONNECT" as a prematurely broken
-# transfer and such a connection will not get a "QUIT"
-<protocol>
+# transfer and such a connection does not get a "QUIT"
+<protocol crlf="yes">
 CAPA
 AUTH NTLM
-TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+%b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 *
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test878 b/third-party/curl/tests/data/test878
index c99c57ba95..588a22b502 100644
--- a/third-party/curl/tests/data/test878
+++ b/third-party/curl/tests/data/test878
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,6 @@ RFC5034
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -21,7 +21,6 @@ REPLY * -ERR AUTH exchange cancelled by client
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -29,28 +28,27 @@ pop3
 </server>
 <features>
 !SSPI
-debug
+Debug
 crypto
+digest
 </features>
- <name>
+<name>
 POP3 DIGEST-MD5 graceful cancellation
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 67 - CURLE_LOGIN_DENIED
 <errorcode>
 67
 </errorcode>
-#
 # The multi interface considers a broken "CONNECT" as a prematurely broken
-# transfer and such a connection will not get a "QUIT"
-<protocol>
+# transfer and such a connection does not get a "QUIT"
+<protocol crlf="yes">
 CAPA
 AUTH DIGEST-MD5
 *
diff --git a/third-party/curl/tests/data/test879 b/third-party/curl/tests/data/test879
index 61a559926a..e35901b0d6 100644
--- a/third-party/curl/tests/data/test879
+++ b/third-party/curl/tests/data/test879
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,7 +13,6 @@ RFC5034
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -20,9 +20,9 @@ AUTH CRAM-MD5 PLAIN
 REPLY "AUTH CRAM-MD5" + Rubbish
 REPLY * -ERR AUTH exchange cancelled by client
 REPLY "AUTH PLAIN" +
-REPLY AHVzZXIAc2VjcmV0 +OK Login successful
+REPLY %b64[%00user%00secret]b64% +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -33,7 +33,6 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -41,24 +40,24 @@ pop3
 </server>
 <features>
 crypto
+digest
 </features>
- <name>
+<name>
 POP3 CRAM-MD5 authentication with SASL downgrade
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 AUTH CRAM-MD5
 *
 AUTH PLAIN
-AHVzZXIAc2VjcmV0
+%b64[%00user%00secret]b64%
 RETR %TESTNUMBER
 QUIT
 </protocol>
diff --git a/third-party/curl/tests/data/test88 b/third-party/curl/tests/data/test88
index c2e97ee1c3..f8c61a2f4e 100644
--- a/third-party/curl/tests/data/test88
+++ b/third-party/curl/tests/data/test88
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,7 +13,7 @@ HTTP Digest auth
 <servercmd>
 auth_required
 </servercmd>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145"
@@ -24,7 +25,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a
 # Authorization: Digest line passed-in from the client
-<data1000>
+<data1000 crlf="headers">
 HTTP/1.1 200 OK swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 Content-Type: text/html; charset=iso-8859-1
@@ -33,7 +34,7 @@ Connection: close
 This IS the real page!
 </data1000>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Digest realm="testrealm", nonce="1053604145"
@@ -58,11 +59,12 @@ http
 <features>
 !SSPI
 crypto
+digest
 </features>
- <name>
+<name>
 HTTP PUT with Digest authorization
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -T %LOGDIR/put%TESTNUMBER -u testuser:testpass --digest
 </command>
 <file name="%LOGDIR/put%TESTNUMBER">
@@ -75,7 +77,7 @@ four is the number of lines
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test880 b/third-party/curl/tests/data/test880
index f184a5b6c2..d69a6c004d 100644
--- a/third-party/curl/tests/data/test880
+++ b/third-party/curl/tests/data/test880
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,18 +12,17 @@ RFC5034
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH NTLM PLAIN
 REPLY "AUTH NTLM" +
-REPLY TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA= + Rubbish
+REPLY %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64% + Rubbish
 REPLY * -ERR AUTH exchange cancelled by client
 REPLY "AUTH PLAIN" +
-REPLY AHVzZXIAc2VjcmV0 +OK Login successful
+REPLY %b64[%00user%00secret]b64% +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -33,7 +33,6 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -44,33 +43,23 @@ NTLM
 SSL
 !SSPI
 </features>
- <name>
+<name>
 POP3 NTLM authentication with SASL downgrade
- </name>
- <setenv>
-# we force our own host name, in order to make the test machine independent
-CURL_GETHOSTNAME=curlhost
-# we try to use the LD_PRELOAD hack, if not a debug build
-LD_PRELOAD=%PWD/libtest/.libs/libhostname.so
- </setenv>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret
 </command>
-<precheck>
-chkhostname curlhost
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 AUTH NTLM
-TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+%b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 *
 AUTH PLAIN
-AHVzZXIAc2VjcmV0
+%b64[%00user%00secret]b64%
 RETR %TESTNUMBER
 QUIT
 </protocol>
diff --git a/third-party/curl/tests/data/test881 b/third-party/curl/tests/data/test881
index 773b0868c1..0e953dcb85 100644
--- a/third-party/curl/tests/data/test881
+++ b/third-party/curl/tests/data/test881
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,7 +13,6 @@ RFC5034
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -20,9 +20,9 @@ AUTH DIGEST-MD5 PLAIN
 REPLY "AUTH DIGEST-MD5" + Rubbish
 REPLY * -ERR AUTH exchange cancelled by client
 REPLY "AUTH PLAIN" +
-REPLY AHVzZXIAc2VjcmV0 +OK Login successful
+REPLY %b64[%00user%00secret]b64% +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -33,7 +33,6 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -41,26 +40,26 @@ pop3
 </server>
 <features>
 !SSPI
-debug
+Debug
 crypto
+digest
 </features>
- <name>
+<name>
 POP3 DIGEST-MD5 authentication with SASL downgrade
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 AUTH DIGEST-MD5
 *
 AUTH PLAIN
-AHVzZXIAc2VjcmV0
+%b64[%00user%00secret]b64%
 RETR %TESTNUMBER
 QUIT
 </protocol>
diff --git a/third-party/curl/tests/data/test882 b/third-party/curl/tests/data/test882
index cb6197881a..84181c7ef2 100644
--- a/third-party/curl/tests/data/test882
+++ b/third-party/curl/tests/data/test882
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,13 +9,12 @@ connection reuse
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 REPLY "PASS secret" +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -25,24 +25,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 multiple connection authentication
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER001 -u user.one:secret -: pop3://%HOSTIP:%POP3PORT/%TESTNUMBER002 -u user.two:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 USER user.one
 PASS secret
diff --git a/third-party/curl/tests/data/test883 b/third-party/curl/tests/data/test883
index 24a3d59181..5c8f4548ee 100644
--- a/third-party/curl/tests/data/test883
+++ b/third-party/curl/tests/data/test883
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,15 +11,14 @@ RFC5034
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH EXTERNAL
 REPLY AUTH +
-REPLY dXNlcg== +OK Login successful
+REPLY %b64[user]b64% +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -29,27 +29,25 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 external authentication
- </name>
- <command>
+</name>
+<command>
 'pop3://user;AUTH=EXTERNAL@%HOSTIP:%POP3PORT/%TESTNUMBER'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 AUTH EXTERNAL
-dXNlcg==
+%b64[user]b64%
 RETR %TESTNUMBER
 QUIT
 </protocol>
diff --git a/third-party/curl/tests/data/test884 b/third-party/curl/tests/data/test884
index fb14e92300..1a49a6a5a5 100644
--- a/third-party/curl/tests/data/test884
+++ b/third-party/curl/tests/data/test884
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ RFC5034
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -18,7 +18,7 @@ AUTH EXTERNAL
 REPLY AUTH +
 REPLY = +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -29,24 +29,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 external authentication without credentials
- </name>
- <command>
+</name>
+<command>
 'pop3://;AUTH=EXTERNAL@%HOSTIP:%POP3PORT/%TESTNUMBER'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 AUTH EXTERNAL
 =
diff --git a/third-party/curl/tests/data/test885 b/third-party/curl/tests/data/test885
index a98aef9556..2d1e9c23b7 100644
--- a/third-party/curl/tests/data/test885
+++ b/third-party/curl/tests/data/test885
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,14 +12,13 @@ RFC5034
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH EXTERNAL
 REPLY AUTH +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -29,26 +29,24 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 external authentication with initial response
- </name>
- <command>
+</name>
+<command>
 'pop3://user;AUTH=EXTERNAL@%HOSTIP:%POP3PORT/%TESTNUMBER' --sasl-ir
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
-AUTH EXTERNAL dXNlcg==
+AUTH EXTERNAL %b64[user]b64%
 RETR %TESTNUMBER
 QUIT
 </protocol>
diff --git a/third-party/curl/tests/data/test886 b/third-party/curl/tests/data/test886
index af5cc55e8a..d1cf0887db 100644
--- a/third-party/curl/tests/data/test886
+++ b/third-party/curl/tests/data/test886
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,14 +12,13 @@ RFC5034
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH EXTERNAL
 REPLY AUTH +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -29,24 +29,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 external authentication with initial response without credentials
- </name>
- <command>
+</name>
+<command>
 'pop3://;AUTH=EXTERNAL@%HOSTIP:%POP3PORT/%TESTNUMBER' --sasl-ir
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 AUTH EXTERNAL =
 RETR %TESTNUMBER
diff --git a/third-party/curl/tests/data/test887 b/third-party/curl/tests/data/test887
index 8b067b93d1..a2e32600a5 100644
--- a/third-party/curl/tests/data/test887
+++ b/third-party/curl/tests/data/test887
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,6 @@ RFC7628
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -19,7 +19,7 @@ AUTH OAUTHBEARER
 REPLY AUTH +
 REPLY %b64[n,a=user,%01host=127.0.0.1%01port=%POP3PORT%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64% +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -30,24 +30,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 OAuth 2.0 (OAUTHBEARER) authentication
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user --oauth2-bearer mF_9.B5f-4.1JqM
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 AUTH OAUTHBEARER
 %b64[n,a=user,%01host=127.0.0.1%01port=%POP3PORT%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64%
diff --git a/third-party/curl/tests/data/test888 b/third-party/curl/tests/data/test888
index 79579cf6ab..08e276e913 100644
--- a/third-party/curl/tests/data/test888
+++ b/third-party/curl/tests/data/test888
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,14 +13,13 @@ RFC7628
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH OAUTHBEARER
 REPLY AUTH +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -30,24 +30,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 OAuth 2.0 (OAUTHBEARER) authentication with initial response
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user --oauth2-bearer mF_9.B5f-4.1JqM --sasl-ir
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 AUTH OAUTHBEARER %b64[n,a=user,%01host=127.0.0.1%01port=%POP3PORT%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64%
 RETR %TESTNUMBER
diff --git a/third-party/curl/tests/data/test889 b/third-party/curl/tests/data/test889
index d237768c0e..8a808beda5 100644
--- a/third-party/curl/tests/data/test889
+++ b/third-party/curl/tests/data/test889
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,42 +12,38 @@ RFC7628
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH OAUTHBEARER
 REPLY AUTH +
-REPLY %b64[n,a=user,%01host=127.0.0.1%01port=%POP3PORT%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64% + eyJzdGF0dXMiOiJpbnZhbGlkX3Rva2VuIiwic2NvcGUiOiJleGFtcGxlX3Njb3BlIiwib3BlbmlkLWNvbmZpZ3VyYXRpb24iOiJodHRwczovL2V4YW1wbGUuY29tLy53ZWxsLWtub3duL29wZW5pZC1jb25maWd1cmF0aW9uIn0
+REPLY %b64[n,a=user,%01host=127.0.0.1%01port=%POP3PORT%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64% + %b64[{"status":"invalid_token","scope":"example_scope","openid-configuration":"https://example.com/.well-known/openid-configuration"}]b64%
 REPLY AQ== -ERR Authentication failed
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 OAuth 2.0 (OAUTHBEARER) failure as continuation
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user --oauth2-bearer mF_9.B5f-4.1JqM
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 67 - CURLE_LOGIN_DENIED
 <errorcode>
 67
 </errorcode>
-#
 # The multi interface considers a broken "CONNECT" as a prematurely broken
-# transfer and such a connection will not get a "QUIT"
-<protocol>
+# transfer and such a connection does not get a "QUIT"
+<protocol crlf="yes">
 CAPA
 AUTH OAUTHBEARER
 %b64[n,a=user,%01host=127.0.0.1%01port=%POP3PORT%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64%
diff --git a/third-party/curl/tests/data/test89 b/third-party/curl/tests/data/test89
index 06e4d869d7..51208d5fc3 100644
--- a/third-party/curl/tests/data/test89
+++ b/third-party/curl/tests/data/test89
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -16,7 +17,7 @@ NTLM
 This is supposed to be returned when the server gets a first
 Authorization: NTLM line passed-in from the client -->
 
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 401 Now gimme that second request of crap
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -28,7 +29,7 @@ This is not the real page either!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 301 Things are fine in server land swsclose
 Server: Microsoft-IIS/5.0
 Connection: close
@@ -37,7 +38,7 @@ Location: /you/%TESTNUMBER0010
 </data1002>
 
 # This is the first reply after the redirection
-<data1011>
+<data1011 crlf="headers">
 HTTP/1.1 401 Now gimme that second round of crap
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -49,7 +50,7 @@ This is not the real page either!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1012>
+<data1012 crlf="headers">
 HTTP/1.1 200 Things are fine in server land swsclose
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -58,7 +59,7 @@ Content-Length: 32
 Finally, this is the real page!
 </data1012>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Now gimme that second request of crap
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -106,10 +107,10 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --ntlm -L
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
@@ -121,7 +122,7 @@ Accept: */*
 
 GET /you/%TESTNUMBER0010 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test890 b/third-party/curl/tests/data/test890
index 807db9e9ad..0892ba5b47 100644
--- a/third-party/curl/tests/data/test890
+++ b/third-party/curl/tests/data/test890
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,41 +13,37 @@ RFC7628
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH OAUTHBEARER
-REPLY AUTH + eyJzdGF0dXMiOiJpbnZhbGlkX3Rva2VuIiwic2NvcGUiOiJleGFtcGxlX3Njb3BlIiwib3BlbmlkLWNvbmZpZ3VyYXRpb24iOiJodHRwczovL2V4YW1wbGUuY29tLy53ZWxsLWtub3duL29wZW5pZC1jb25maWd1cmF0aW9uIn0
+REPLY AUTH + %b64[{"status":"invalid_token","scope":"example_scope","openid-configuration":"https://example.com/.well-known/openid-configuration"}]b64%
 REPLY AQ== -ERR Authentication failed
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 OAuth 2.0 (OAUTHBEARER) failure as continuation with initial response
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user --oauth2-bearer mF_9.B5f-4.1JqM --sasl-ir
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 67 - CURLE_LOGIN_DENIED
 <errorcode>
 67
 </errorcode>
-#
 # The multi interface considers a broken "CONNECT" as a prematurely broken
-# transfer and such a connection will not get a "QUIT"
-<protocol>
+# transfer and such a connection does not get a "QUIT"
+<protocol crlf="yes">
 CAPA
 AUTH OAUTHBEARER %b64[n,a=user,%01host=127.0.0.1%01port=%POP3PORT%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64%
 AQ==
diff --git a/third-party/curl/tests/data/test891 b/third-party/curl/tests/data/test891
index 745fd94b2d..3a518af455 100644
--- a/third-party/curl/tests/data/test891
+++ b/third-party/curl/tests/data/test891
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ POP3
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -14,7 +14,6 @@ REPLYLF AUTH +
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -22,22 +21,22 @@ pop3
 </server>
 <features>
 crypto
+digest
 </features>
- <name>
+<name>
 POP3 with short authentication response
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 AUTH CRAM-MD5
-dXNlciA1YzhkYjAzZjA0Y2VjMGY0M2JjYjA2MDAyMzkxNDE5MA==
+%b64[user 5c8db03f04cec0f43bcb060023914190]b64%
 </protocol>
 # CURLE_LOGIN_DENIED
 <errorcode>
diff --git a/third-party/curl/tests/data/test892 b/third-party/curl/tests/data/test892
index 1f57b0add9..a3931b0024 100644
--- a/third-party/curl/tests/data/test892
+++ b/third-party/curl/tests/data/test892
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,15 +11,14 @@ RFC5034
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH PLAIN
 REPLY AUTH +
-REPLY c2hhcmVkLW1haWxib3gAdXNlcgBzZWNyZXQ= +OK Login successful
+REPLY %b64[shared-mailbox%00user%00secret]b64% +OK Login successful
 </servercmd>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -29,27 +29,25 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 plain authentication with alternative authorization identity
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret --sasl-authzid shared-mailbox
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 AUTH PLAIN
-c2hhcmVkLW1haWxib3gAdXNlcgBzZWNyZXQ=
+%b64[shared-mailbox%00user%00secret]b64%
 RETR %TESTNUMBER
 QUIT
 </protocol>
diff --git a/third-party/curl/tests/data/test893 b/third-party/curl/tests/data/test893
index d89a629e10..2e2ed52152 100644
--- a/third-party/curl/tests/data/test893
+++ b/third-party/curl/tests/data/test893
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,44 +11,40 @@ RFC5034
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH PLAIN
 REPLY AUTH +
-REPLY dXJzZWwAa3VydAB4aXBqM3BsbXE= -ERR Not authorized
+REPLY %b64[ursel%00kurt%00xipj3plmq]b64% -ERR Not authorized
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
-POP3 plain authentication with alternative authorization identity (Not authorized)
- </name>
- <command>
+<name>
+POP3 plain auth with alt authorization identity (Not authorized)
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u kurt:xipj3plmq --sasl-authzid ursel
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 67 - CURLE_LOGIN_DENIED
 <errorcode>
 67
 </errorcode>
-#
 # The multi interface considers a broken "CONNECT" as a prematurely broken
-# transfer and such a connection will not get a "QUIT"
-<protocol>
+# transfer and such a connection does not get a "QUIT"
+<protocol crlf="yes">
 CAPA
 AUTH PLAIN
-dXJzZWwAa3VydAB4aXBqM3BsbXE=
+%b64[ursel%00kurt%00xipj3plmq]b64%
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test894 b/third-party/curl/tests/data/test894
index f9866580b2..f5f068df38 100644
--- a/third-party/curl/tests/data/test894
+++ b/third-party/curl/tests/data/test894
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,26 +8,23 @@ RETR
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 with CR in username
- </name>
- <command>
+</name>
+<command>
 pop3://user%0dFRIGGING_cmd:secret@%HOSTIP:%POP3PORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # malformed URL
diff --git a/third-party/curl/tests/data/test895 b/third-party/curl/tests/data/test895
index e7004faed5..d104b80126 100644
--- a/third-party/curl/tests/data/test895
+++ b/third-party/curl/tests/data/test895
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,10 +9,9 @@ FETCH
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -22,24 +22,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP with --login-options 'AUTH=*'
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1' -u '"user:sec"ret{' --login-options 'AUTH=*'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN "\"user" "sec\"ret{"
 A003 SELECT %TESTNUMBER
diff --git a/third-party/curl/tests/data/test896 b/third-party/curl/tests/data/test896
index c972906a45..ab5fadff53 100644
--- a/third-party/curl/tests/data/test896
+++ b/third-party/curl/tests/data/test896
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,26 +9,23 @@ FETCH
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP with --login-options 'AUTH=dummy' (failing)
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/895/;MAILINDEX=1' -u '"user:sec"ret{' --login-options 'AUTH=dummy'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 3 == CURLE_URL_MALFORMAT
diff --git a/third-party/curl/tests/data/test897 b/third-party/curl/tests/data/test897
index ae34f37316..3b7cf61287 100644
--- a/third-party/curl/tests/data/test897
+++ b/third-party/curl/tests/data/test897
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ FETCH
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 body
 
 --
@@ -21,35 +21,33 @@ POSTFETCH extra stuff sent in the envelope after the body
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP and envelope meta data after body transfer
- </name>
- <command>
+</name>
+<command>
 'imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=123/;SECTION=1' -u user:secret -D %LOGDIR/head-%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN user secret
 A003 SELECT %TESTNUMBER
 A004 FETCH 123 BODY[1]
 A005 LOGOUT
 </protocol>
-<file name="%LOGDIR/head-%TESTNUMBER">
-        _   _ ____  _     
-    ___| | | |  _ \| |    
-   / __| | | | |_) | |    
-  | (__| |_| |  _ {| |___ 
+<file name="%LOGDIR/head-%TESTNUMBER" crlf="yes">
+        _   _ ____  _
+    ___| | | |  _ \| |
+   / __| | | | |_) | |
+  | (__| |_| |  _ {| |___
    \___|\___/|_| \_\_____|
 * OK curl IMAP server ready to serve
 A001 BAD Command
diff --git a/third-party/curl/tests/data/test898 b/third-party/curl/tests/data/test898
index df0723d3b9..f0b5bac980 100644
--- a/third-party/curl/tests/data/test898
+++ b/third-party/curl/tests/data/test898
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,11 +6,10 @@ HTTP
 HTTP proxy
 --location
 Authorization
-Cookie
+cookies
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -54,7 +54,6 @@ hey
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -63,24 +62,23 @@ proxy
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with custom auth and cookies redirected to HTTP on a diff port
- </name>
- <command>
--x http://%HOSTIP:%HTTPPORT http://firsthost.com -L -H "Authorization: Basic am9lOnNlY3JldA==" -H "Cookie: userpwd=am9lOnNlY3JldA=="
+</name>
+<command>
+-x http://%HOSTIP:%HTTPPORT http://firsthost.com -L -H "Authorization: Basic %b64[joe:secret]b64%" -H "Cookie: userpwd=am9lOnNlY3JldA=="
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://firsthost.com/ HTTP/1.1
 Host: firsthost.com
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
-Authorization: Basic am9lOnNlY3JldA==
+Authorization: Basic %b64[joe:secret]b64%
 Cookie: userpwd=am9lOnNlY3JldA==
 
 GET http://firsthost.com:9999/a/path/%TESTNUMBER0002 HTTP/1.1
diff --git a/third-party/curl/tests/data/test899 b/third-party/curl/tests/data/test899
index d1f1936fc0..14c06d2b32 100644
--- a/third-party/curl/tests/data/test899
+++ b/third-party/curl/tests/data/test899
@@ -1,16 +1,16 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
-Basic
+HTTP Basic auth
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes" nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 302 go go go
 Content-Length: 8
 Location: http://user:pass@%HOSTIP:%HTTPPORT/basic-auth/user/%TESTNUMBER0002
@@ -19,7 +19,7 @@ Funny-head: yesyes
 
 notreal
 </data>
-<data2 crlf="yes">
+<data2 crlf="headers">
 HTTP/1.1 200 OK
 Content-Length: 6
 Content-Type: text/html
@@ -29,7 +29,6 @@ final
 </data2>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -43,19 +42,18 @@ http://first:secret@%HOSTIP:%HTTPPORT/%TESTNUMBER -L
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol crlf="yes">
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic Zmlyc3Q6c2VjcmV0
+Authorization: Basic %b64[first:secret]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
 GET /basic-auth/user/%TESTNUMBER0002 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic dXNlcjpwYXNz
+Authorization: Basic %b64[user:pass]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test9 b/third-party/curl/tests/data/test9
index d7f1ce224b..29e16f8c98 100644
--- a/third-party/curl/tests/data/test9
+++ b/third-party/curl/tests/data/test9
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -26,10 +27,10 @@ Mime
 <server>
 http
 </server>
- <name>
+<name>
 HTTP RFC1867-type formposting
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER -F name=daniel -F tool=curl -F file=@%LOGDIR/test%TESTNUMBER.txt
 </command>
 # We create this file before the command is invoked!
@@ -46,30 +47,30 @@ bar
 ^(Content-Type: multipart/form-data;|------------).*
 </strip>
 <protocol>
-POST /we/want/%TESTNUMBER HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
-User-Agent: curl/%VERSION
-Accept: */*
-Content-Length: 407
-Content-Type: multipart/form-data; boundary=----------------------------9ef8d6205763
-
-------------------------------9ef8d6205763
-Content-Disposition: form-data; name="name"
-
-daniel
-------------------------------9ef8d6205763
-Content-Disposition: form-data; name="tool"
-
-curl
-------------------------------9ef8d6205763
-Content-Disposition: form-data; name="file"; filename="test9.txt"
-Content-Type: text/plain
-
+POST /we/want/%TESTNUMBER HTTP/1.1%CR
+Host: %HOSTIP:%HTTPPORT%CR
+User-Agent: curl/%VERSION%CR
+Accept: */*%CR
+Content-Length: 431%CR
+Content-Type: multipart/form-data; boundary=----------------------------9ef8d6205763%CR
+%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: form-data; name="name"%CR
+%CR
+daniel%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: form-data; name="tool"%CR
+%CR
+curl%CR
+------------------------------9ef8d6205763%CR
+Content-Disposition: form-data; name="file"; filename="test9.txt"%CR
+Content-Type: text/plain%CR
+%CR
 foo-
 This is a moo-
 bar
-
-------------------------------9ef8d6205763--
+%CR
+------------------------------9ef8d6205763--%CR
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test90 b/third-party/curl/tests/data/test90
index 932a2dd0b5..bc67ad62a0 100644
--- a/third-party/curl/tests/data/test90
+++ b/third-party/curl/tests/data/test90
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -12,7 +13,7 @@ NTLM
 # Server-side
 <reply>
 
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Basic
@@ -26,7 +27,7 @@ This is not the real page
 
 # This is supposed to be returned when the server gets a first
 # Authorization: NTLM line passed-in from the client
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 401 Now gimme that second request of crap
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -38,7 +39,7 @@ This is not the real page either!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 301 Things are fine in server land swsclose
 Server: Microsoft-IIS/5.0
 Connection: close
@@ -47,7 +48,7 @@ Location: /you/%TESTNUMBER0010
 </data1002>
 
 # This is the first reply after the redirection
-<data10>
+<data10 crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Basic
@@ -59,7 +60,7 @@ Content-Length: 26
 This is not the real page
 </data10>
 
-<data1011>
+<data1011 crlf="headers">
 HTTP/1.1 401 Now gimme that second round of crap
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -71,7 +72,7 @@ This is not the real page either!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1012>
+<data1012 crlf="headers">
 HTTP/1.1 200 Things are fine in server land swsclose
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -80,7 +81,7 @@ Content-Length: 32
 Finally, this is the real page!
 </data1012>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Basic
@@ -144,7 +145,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -u testuser:testpass --anyauth -L
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -152,7 +153,7 @@ Accept: */*
 
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
@@ -169,7 +170,7 @@ Accept: */*
 
 GET /you/%TESTNUMBER0010 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test900 b/third-party/curl/tests/data/test900
index 881a3409a8..f9d67a2c08 100644
--- a/third-party/curl/tests/data/test900
+++ b/third-party/curl/tests/data/test900
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,47 +6,48 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP
- </name>
-<stdin>
-From: different
-To: another
+</name>
+<file name="%LOGDIR/mail%TESTNUMBER">
+From: different%CR
+To: another%CR
+%CR
+body%CR
+%repeat[6553 x 0123456789]%
+</file>
 
-body
-</stdin>
- <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -T -
+<command>
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -T %LOGDIR/mail%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
 <upload>
-From: different
-To: another
-
-body
-.
+From: different%CR
+To: another%CR
+%CR
+body%CR
+%repeat[6553 x 0123456789]%
+%CR
+.%CR
 </upload>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test901 b/third-party/curl/tests/data/test901
index 70f612eaa9..286b5b3047 100644
--- a/third-party/curl/tests/data/test901
+++ b/third-party/curl/tests/data/test901
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,21 +6,19 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP with CRLF-dot-CRLF in data
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
@@ -31,22 +30,21 @@ To: another
 
 body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
diff --git a/third-party/curl/tests/data/test902 b/third-party/curl/tests/data/test902
index fbfe081984..fdf2d9a147 100644
--- a/third-party/curl/tests/data/test902
+++ b/third-party/curl/tests/data/test902
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ RFC821
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -15,38 +15,36 @@ REPLY EHLO 500 Command unrecognized
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 RFC821-only SMTP server (EHLO not supported)
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 HELO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
diff --git a/third-party/curl/tests/data/test903 b/third-party/curl/tests/data/test903
index 032930cd75..3876134df5 100644
--- a/third-party/curl/tests/data/test903
+++ b/third-party/curl/tests/data/test903
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,46 +10,43 @@ RFC4954
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH PLAIN
 REPLY AUTH 334 PLAIN supported
-REPLY AHVzZXIAc2VjcmV0 235 Authenticated
+REPLY %b64[%00user%00secret]b64% 235 Authenticated
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP plain authentication
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user:secret -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH PLAIN
-AHVzZXIAc2VjcmV0
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+%b64[%00user%00secret]b64%
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test904 b/third-party/curl/tests/data/test904
index 604f903d3b..f3d14172a5 100644
--- a/third-party/curl/tests/data/test904
+++ b/third-party/curl/tests/data/test904
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,48 +9,45 @@ RFC4954
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH LOGIN
 REPLY AUTH 334 VXNlcm5hbWU6
-REPLY dXNlcg== 334 UGFzc3dvcmQ6
-REPLY c2VjcmV0 235 Authenticated
+REPLY %b64[user]b64% 334 %b64[Password:]b64%
+REPLY %b64[secret]b64% 235 Authenticated
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP login authentication
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user:secret -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH LOGIN
-dXNlcg==
-c2VjcmV0
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+%b64[user]b64%
+%b64[secret]b64%
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test905 b/third-party/curl/tests/data/test905
index eef510e567..658b49c264 100644
--- a/third-party/curl/tests/data/test905
+++ b/third-party/curl/tests/data/test905
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,17 +10,15 @@ RFC4954
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH CRAM-MD5
-REPLY AUTH 334 PDE5NzIuOTg3NjU0MzIxQGN1cmw+
-REPLY dXNlciA3MDMxNzI1NTk5ZmRiYjVkNDEyNjg5YWEzMjNlM2UwYg== 235 Authenticated
+REPLY AUTH 334 %b64[%3c1972.987654321@curl%3e]b64%
+REPLY %b64[user 7031725599fdbb5d412689aa323e3e0b]b64% 235 Authenticated
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -27,31 +26,31 @@ smtp
 </server>
 <features>
 crypto
+digest
 </features>
- <name>
+<name>
 SMTP CRAM-MD5 authentication
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user:secret -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH CRAM-MD5
-dXNlciA3MDMxNzI1NTk5ZmRiYjVkNDEyNjg5YWEzMjNlM2UwYg==
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+%b64[user 7031725599fdbb5d412689aa323e3e0b]b64%
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test906 b/third-party/curl/tests/data/test906
index 14fd880742..bc76a33a2c 100644
--- a/third-party/curl/tests/data/test906
+++ b/third-party/curl/tests/data/test906
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,18 +10,16 @@ NTLM
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH NTLM
 REPLY AUTH 334 NTLM supported
-REPLY TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA= 334 TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
+REPLY %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64% 334 TlRMTVNTUAACAAAAAgACADAAAACGggEAc51AYVDgyNcAAAAAAAAAAG4AbgAyAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwBjAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
 REPLY TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAALAAsAeAAAAAAAAAAAAAAAhoIBAFpkQwKRCZFMhjj0tw47wEjKHRHlvzfxQamFcheMuv8v+xeqphEO5V41xRd7R9deOXRlc3R1c2VyV09SS1NUQVRJT04= 235 Authenticated
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -34,7 +33,7 @@ SSL
 <name>
 SMTP NTLM authentication
 </name>
-<stdin>
+<stdin crlf="yes">
 mail body
 </stdin>
 <command>
@@ -42,20 +41,19 @@ smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-fr
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH NTLM
-TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+%b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAALAAsAeAAAAAAAAAAAAAAAhoIBAFpkQwKRCZFMhjj0tw47wEjKHRHlvzfxQamFcheMuv8v+xeqphEO5V41xRd7R9deOXRlc3R1c2VyV09SS1NUQVRJT04=
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test907 b/third-party/curl/tests/data/test907
index 007c9aace3..72eaf37034 100644
--- a/third-party/curl/tests/data/test907
+++ b/third-party/curl/tests/data/test907
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,18 +10,16 @@ RFC4954
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH DIGEST-MD5
-REPLY AUTH 334 cmVhbG09ImN1cmwiLG5vbmNlPSI1MzAwZDE3YTFkNjk1YmQ0MTFlNGNkZjk2Zjk1NDhjMjNjZWQ2MTc1IixhbGdvcml0aG09bWQ1LXNlc3MscW9wPSJhdXRoIg==
-REPLY dXNlcm5hbWU9InVzZXIiLHJlYWxtPSJjdXJsIixub25jZT0iNTMwMGQxN2ExZDY5NWJkNDExZTRjZGY5NmY5NTQ4YzIzY2VkNjE3NSIsY25vbmNlPSIzNDMzMzIzMTM1MzMzMjMxMzYzMzMyMzEzNzMzMzIzMSIsbmM9IjAwMDAwMDAxIixkaWdlc3QtdXJpPSJzbXRwLzEyNy4wLjAuMSIscmVzcG9uc2U9YTI3YzQzOTVmMzM4Njc0M2JlMTIyMDdiN2QxMTIxYzUscW9wPWF1dGg= 334 cnNwYXV0aD05ZWE4NTljYjlkOTBjMzdjYTMwZDQ5ZDM1Mzc4NjMwYw==
+REPLY AUTH 334 %b64[realm="cu\"rl",nonce="5300d17a1d695bd411e4cdf96f9548c23ced6175",algorithm=md5-sess,qop="auth"]b64%
+REPLY %b64[username="us\"er",realm="cu\"rl",nonce="5300d17a1d695bd411e4cdf96f9548c23ced6175",cnonce="34333231353332313633323137333231",nc="00000001",digest-uri="smtp/127.0.0.1",response=53d3347e1b559d23be78934ae4a78488,qop=auth]b64% 334 %b64[rspauth=9ea859cb9d90c37ca30d49d35378630c]b64%
 REPLY  235 Authenticated
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -28,34 +27,37 @@ smtp
 </server>
 <features>
 !SSPI
-debug
+Debug
 crypto
+digest
 </features>
- <name>
+<setenv>
+CURL_ENTROPY=12345678
+</setenv>
+<name>
 SMTP DIGEST-MD5 authentication
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user:secret -T -
+<command>
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u "us\"er:secret" -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH DIGEST-MD5
-dXNlcm5hbWU9InVzZXIiLHJlYWxtPSJjdXJsIixub25jZT0iNTMwMGQxN2ExZDY5NWJkNDExZTRjZGY5NmY5NTQ4YzIzY2VkNjE3NSIsY25vbmNlPSIzNDMzMzIzMTM1MzMzMjMxMzYzMzMyMzEzNzMzMzIzMSIsbmM9IjAwMDAwMDAxIixkaWdlc3QtdXJpPSJzbXRwLzEyNy4wLjAuMSIscmVzcG9uc2U9YTI3YzQzOTVmMzM4Njc0M2JlMTIyMDdiN2QxMTIxYzUscW9wPWF1dGg=
+%b64[username="us\"er",realm="cu\"rl",nonce="5300d17a1d695bd411e4cdf96f9548c23ced6175",cnonce="34333231353332313633323137333231",nc="00000001",digest-uri="smtp/127.0.0.1",response=53d3347e1b559d23be78934ae4a78488,qop=auth]b64%
 
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test908 b/third-party/curl/tests/data/test908
index c4227d44f9..6d026ea2de 100644
--- a/third-party/curl/tests/data/test908
+++ b/third-party/curl/tests/data/test908
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,46 +10,43 @@ RFC6749
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH XOAUTH2
 REPLY AUTH 334 XOAUTH2 supported
-REPLY dXNlcj11c2VyAWF1dGg9QmVhcmVyIG1GXzkuQjVmLTQuMUpxTQEB 235 Authenticated
+REPLY %b64[user=user%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64% 235 Authenticated
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP OAuth 2.0 (XOAUTH2) authentication
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user --oauth2-bearer mF_9.B5f-4.1JqM -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH XOAUTH2
-dXNlcj11c2VyAWF1dGg9QmVhcmVyIG1GXzkuQjVmLTQuMUpxTQEB
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+%b64[user=user%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64%
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test909 b/third-party/curl/tests/data/test909
index 531f23a45a..83a30afced 100644
--- a/third-party/curl/tests/data/test909
+++ b/third-party/curl/tests/data/test909
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,42 +6,39 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP without SIZE support
- </name>
-<file name="%LOGDIR/test%TESTNUMBER.eml">
+</name>
+<file name="%LOGDIR/test%TESTNUMBER.eml" crlf="yes">
 From: different
 To: another
 
 body
 </file>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -T %LOGDIR/test%TESTNUMBER.eml
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
diff --git a/third-party/curl/tests/data/test91 b/third-party/curl/tests/data/test91
index 0c074314ad..004b8cb470 100644
--- a/third-party/curl/tests/data/test91
+++ b/third-party/curl/tests/data/test91
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,7 @@ NTLM
 </info>
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Magic-Negotiate
@@ -23,7 +24,7 @@ Connection: close
 
 # This is supposed to be returned when the server gets a first
 # Authorization: NTLM line passed-in from the client
-<data1001>
+<data1001 crlf="headers">
 HTTP/1.1 401 Now gimme that second request of crap
 Server: Microsoft-IIS/5.0
 Content-Length: 34
@@ -35,7 +36,7 @@ This is not the real page either!
 
 # This is supposed to be returned when the server gets the second
 # Authorization: NTLM line passed-in from the client
-<data1002>
+<data1002 crlf="headers">
 HTTP/1.1 200 Things are fine in server land swsclose
 Server: Microsoft-IIS/5.0
 Content-Type: text/html; charset=iso-8859-1
@@ -44,7 +45,7 @@ Content-Length: 32
 Finally, this is the real page!
 </data1002>
 
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 401 Authorization Required swsclose
 Server: Apache/1.3.27 (Darwin) PHP/4.1.2
 WWW-Authenticate: Magic-Negotiate
@@ -80,9 +81,9 @@ SSL
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with NTLM/Negotiate/Basic, anyauth and user with domain, with size 0
- </name>
+</name>
 <command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --anyauth -u mydomain\\myself:secret
 </command>
@@ -90,7 +91,7 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --anyauth -u mydomain\\myself:secret
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -98,7 +99,7 @@ Accept: */*
 
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+Authorization: NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test910 b/third-party/curl/tests/data/test910
index 7ed9b14b79..2aa99634e1 100644
--- a/third-party/curl/tests/data/test910
+++ b/third-party/curl/tests/data/test910
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,42 +6,39 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP without terminating CRLF
- </name>
-<stdin nonewline="yes">
+</name>
+<stdin crlf="headers" nonewline="yes">
 From: different
 To: another
 
 body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
diff --git a/third-party/curl/tests/data/test911 b/third-party/curl/tests/data/test911
index 8e44d3f21f..b060a2a315 100644
--- a/third-party/curl/tests/data/test911
+++ b/third-party/curl/tests/data/test911
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,41 +6,38 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP with no mail data
- </name>
+</name>
 
 <stdin nonewline="yes">
 
 </stdin>
 
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 .
 </upload>
 </verify>
diff --git a/third-party/curl/tests/data/test912 b/third-party/curl/tests/data/test912
index 4a9c1041a7..0f74529862 100644
--- a/third-party/curl/tests/data/test912
+++ b/third-party/curl/tests/data/test912
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ SIZE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -14,37 +14,35 @@ CAPA SIZE
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP with SIZE support
- </name>
-<file name="%LOGDIR/test%TESTNUMBER.eml">
+</name>
+<file name="%LOGDIR/test%TESTNUMBER.eml" crlf="yes">
 From: different
 To: another
 
 body
 </file>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -T %LOGDIR/test%TESTNUMBER.eml
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com> SIZE=38
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT SIZE=38
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
diff --git a/third-party/curl/tests/data/test913 b/third-party/curl/tests/data/test913
index 90d93b6829..8cceab63aa 100644
--- a/third-party/curl/tests/data/test913
+++ b/third-party/curl/tests/data/test913
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ SIZE
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -14,36 +14,34 @@ CAPA "SIZE 32"
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP with large message SIZE
- </name>
-<file name="%LOGDIR/test%TESTNUMBER.eml">
+</name>
+<file name="%LOGDIR/test%TESTNUMBER.eml" crlf="yes">
 From: different
 To: another
 
 body
 </file>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -T %LOGDIR/test%TESTNUMBER.eml
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 55 - CURLE_SEND_ERROR
 <errorcode>
 55
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com> SIZE=38
+MAIL FROM:%LTsender@example.com%GT SIZE=38
 QUIT
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test914 b/third-party/curl/tests/data/test914
index 09db331688..803472e1a0 100644
--- a/third-party/curl/tests/data/test914
+++ b/third-party/curl/tests/data/test914
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -13,36 +13,34 @@ REPLY MAIL 501 not fine enough
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP invalid --mail-from
- </name>
-<file name="%LOGDIR/test%TESTNUMBER.eml">
+</name>
+<file name="%LOGDIR/test%TESTNUMBER.eml" crlf="yes">
 From: different
 To: another
 
 body
 </file>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from invalid -T %LOGDIR/test%TESTNUMBER.eml
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 55 - CURLE_SEND_ERROR
 <errorcode>
 55
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<invalid>
+MAIL FROM:%LTinvalid%GT
 QUIT
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test915 b/third-party/curl/tests/data/test915
index 0ed8d9967e..c470c9a10b 100644
--- a/third-party/curl/tests/data/test915
+++ b/third-party/curl/tests/data/test915
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,42 +6,39 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP without --mail-from
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LT%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
diff --git a/third-party/curl/tests/data/test916 b/third-party/curl/tests/data/test916
index ff0fb6c029..4268c19761 100644
--- a/third-party/curl/tests/data/test916
+++ b/third-party/curl/tests/data/test916
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,42 +6,39 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP with invalid --mail-rcpt
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt invalid --mail-from sender@example.com -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 55 - CURLE_SEND_ERROR
 <errorcode>
 55
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<invalid>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTinvalid%GT
 QUIT
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test917 b/third-party/curl/tests/data/test917
index 69a05c78b1..536ea8e816 100644
--- a/third-party/curl/tests/data/test917
+++ b/third-party/curl/tests/data/test917
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,46 +6,50 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP with multiple --mail-rcpt
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
- <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient.one@example.com --mail-rcpt recipient.two@example.com --mail-rcpt recipient.three@example.com --mail-rcpt recipient.four@example.com --mail-rcpt recipient.five@example.com --mail-from sender@example.com -T -
+<command>
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER
+--mail-rcpt recipient.one@example.com
+--mail-rcpt recipient.two@example.com
+--mail-rcpt recipient.three@example.com
+--mail-rcpt recipient.four@example.com
+--mail-rcpt recipient.five@example.com
+--mail-from sender@example.com
+-T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient.one@example.com>
-RCPT TO:<recipient.two@example.com>
-RCPT TO:<recipient.three@example.com>
-RCPT TO:<recipient.four@example.com>
-RCPT TO:<recipient.five@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient.one@example.com%GT
+RCPT TO:%LTrecipient.two@example.com%GT
+RCPT TO:%LTrecipient.three@example.com%GT
+RCPT TO:%LTrecipient.four@example.com%GT
+RCPT TO:%LTrecipient.five@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
diff --git a/third-party/curl/tests/data/test918 b/third-party/curl/tests/data/test918
index 035009a40c..7bb020d448 100644
--- a/third-party/curl/tests/data/test918
+++ b/third-party/curl/tests/data/test918
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,43 +6,47 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP with multiple and invalid --mail-rcpt
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
- <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient.one@example.com --mail-rcpt invalid --mail-rcpt recipient.three@example.com --mail-rcpt sTrAnGe --mail-rcpt recipient.five@example.com --mail-from sender@example.com -T -
+<command>
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER
+--mail-rcpt recipient.one@example.com
+--mail-rcpt invalid
+--mail-rcpt recipient.three@example.com
+--mail-rcpt sTrAnGe
+--mail-rcpt recipient.five@example.com
+--mail-from sender@example.com
+-T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 55 - CURLE_SEND_ERROR
 <errorcode>
 55
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient.one@example.com>
-RCPT TO:<invalid>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient.one@example.com%GT
+RCPT TO:%LTinvalid%GT
 QUIT
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test919 b/third-party/curl/tests/data/test919
index dd5b4beedc..ac42249e86 100644
--- a/third-party/curl/tests/data/test919
+++ b/third-party/curl/tests/data/test919
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ RFC4954
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -19,35 +19,33 @@ REPLY AUTH 235 Authenticated
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP plain authentication with initial response
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user:secret --sasl-ir -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-AUTH PLAIN AHVzZXIAc2VjcmV0
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+AUTH PLAIN %b64[%00user%00secret]b64%
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test92 b/third-party/curl/tests/data/test92
index a9c0a9b90a..54171f8f89 100644
--- a/third-party/curl/tests/data/test92
+++ b/third-party/curl/tests/data/test92
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,7 @@ Resume
 
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.1 416 Requested Range Not Satisfiable
 Date: Fri, 24 Oct 2003 21:33:12 GMT
 Server: Apache/1.3.19 (Unix) (Red-Hat/Linux) mod_ssl/2.8.1 OpenSSL/0.9.6 PHP/4.3.1
@@ -25,7 +26,7 @@ bad
 </data>
 
 # The body should be ignored.
-<datacheck>
+<datacheck crlf="headers">
 HTTP/1.1 416 Requested Range Not Satisfiable
 Date: Fri, 24 Oct 2003 21:33:12 GMT
 Server: Apache/1.3.19 (Unix) (Red-Hat/Linux) mod_ssl/2.8.1 OpenSSL/0.9.6 PHP/4.3.1
@@ -44,17 +45,17 @@ Content-Type: image/gif
 <server>
 http
 </server>
- <name>
+<name>
 HTTP resume transfer with the whole file already downloaded
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/want/%TESTNUMBER -C 87
 </command>
 </client>
 
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /want/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Range: bytes=87-
diff --git a/third-party/curl/tests/data/test920 b/third-party/curl/tests/data/test920
index 840f445ec4..d9cb41210d 100644
--- a/third-party/curl/tests/data/test920
+++ b/third-party/curl/tests/data/test920
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,46 +10,43 @@ RFC4954
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH LOGIN
-REPLY AUTH 334 UGFzc3dvcmQ6
-REPLY c2VjcmV0 235 Authenticated
+REPLY AUTH 334 %b64[Password:]b64%
+REPLY %b64[secret]b64% 235 Authenticated
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP login authentication with initial response
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user:secret --sasl-ir -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-AUTH LOGIN dXNlcg==
-c2VjcmV0
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+AUTH LOGIN %b64[user]b64%
+%b64[secret]b64%
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test921 b/third-party/curl/tests/data/test921
index e7b7ff2587..6daf979d19 100644
--- a/third-party/curl/tests/data/test921
+++ b/third-party/curl/tests/data/test921
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ NTLM
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -20,7 +20,6 @@ REPLY TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAALAAsAeAAAAAAAAA
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -34,7 +33,7 @@ SSL
 <name>
 SMTP NTLM authentication with initial response
 </name>
-<stdin>
+<stdin crlf="yes">
 mail body
 </stdin>
 <command>
@@ -42,19 +41,18 @@ smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-fr
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-AUTH NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+AUTH NTLM %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAALAAsAeAAAAAAAAAAAAAAAhoIBAFpkQwKRCZFMhjj0tw47wEjKHRHlvzfxQamFcheMuv8v+xeqphEO5V41xRd7R9deOXRlc3R1c2VyV09SS1NUQVRJT04=
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test922 b/third-party/curl/tests/data/test922
index a18abbd858..0b28279d71 100644
--- a/third-party/curl/tests/data/test922
+++ b/third-party/curl/tests/data/test922
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ RFC6749
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -19,35 +19,33 @@ REPLY AUTH 235 Authenticated
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP OAuth 2.0 (XOAUTH2) authentication with initial response
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user --oauth2-bearer mF_9.B5f-4.1JqM --sasl-ir -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-AUTH XOAUTH2 dXNlcj11c2VyAWF1dGg9QmVhcmVyIG1GXzkuQjVmLTQuMUpxTQEB
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+AUTH XOAUTH2 %b64[user=user%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64%
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test923 b/third-party/curl/tests/data/test923
index fabcaa6c0e..09a608bd4d 100644
--- a/third-party/curl/tests/data/test923
+++ b/third-party/curl/tests/data/test923
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,29 +7,26 @@ VRFY
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP VRFY
- </name>
- <command>
+</name>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 VRFY recipient
 QUIT
diff --git a/third-party/curl/tests/data/test924 b/third-party/curl/tests/data/test924
index 9347f14a62..b0aae590c6 100644
--- a/third-party/curl/tests/data/test924
+++ b/third-party/curl/tests/data/test924
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,35 +7,32 @@ VRFY
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 553-Ambiguous; Possibilities are:
-553-Joe Smith <joe.smith@example.com>
-553-Harry Smith <harry.smith@example.com>
-553 Melvin Smith <melvin.smith@example.com>
+553-Joe Smith %LTjoe.smith@example.com%GT
+553-Harry Smith %LTharry.smith@example.com%GT
+553 Melvin Smith %LTmelvin.smith@example.com%GT
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP ambiguous VRFY
- </name>
- <command>
+</name>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt smith
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 VRFY smith
 QUIT
diff --git a/third-party/curl/tests/data/test925 b/third-party/curl/tests/data/test925
index c227333dc0..12448cb82b 100644
--- a/third-party/curl/tests/data/test925
+++ b/third-party/curl/tests/data/test925
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,32 +7,29 @@ VRFY
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 252 Send some mail and I'll try my best
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP external VRFY
- </name>
- <command>
+</name>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt user@example.net
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 VRFY user@example.net
 QUIT
diff --git a/third-party/curl/tests/data/test926 b/third-party/curl/tests/data/test926
index 75fca6b7cb..19ecc325ad 100644
--- a/third-party/curl/tests/data/test926
+++ b/third-party/curl/tests/data/test926
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ VRFY
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -14,28 +14,26 @@ REPLY VRFY 550 Unknown user
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP unknown user VRFY
- </name>
- <command>
+</name>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 8 - CURLE_WEIRD_SERVER_REPLY
 <errorcode>
 8
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 VRFY recipient
 QUIT
diff --git a/third-party/curl/tests/data/test927 b/third-party/curl/tests/data/test927
index 220716e55a..c449c3b147 100644
--- a/third-party/curl/tests/data/test927
+++ b/third-party/curl/tests/data/test927
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,34 +8,31 @@ CUSTOMREQUEST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
-250-Joe Smith <joe.smith@example.com>
-250-Harry Smith <harry.smith@example.com>
-250 Melvin Smith <melvin.smith@example.com>
+<data crlf="yes">
+250-Joe Smith %LTjoe.smith@example.com%GT
+250-Harry Smith %LTharry.smith@example.com%GT
+250 Melvin Smith %LTmelvin.smith@example.com%GT
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP mailing list EXPN (CUSTOMREQUEST)
- </name>
- <command>
+</name>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt Friends -X EXPN
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 EXPN Friends
 QUIT
diff --git a/third-party/curl/tests/data/test928 b/third-party/curl/tests/data/test928
index e8f3fee96b..46929b3a85 100644
--- a/third-party/curl/tests/data/test928
+++ b/third-party/curl/tests/data/test928
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,33 +7,30 @@ HELP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 214-This server supports the following commands:
 214 HELO EHLO RCPT DATA RSET MAIL VRFY EXPN QUIT HELP
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP HELP
- </name>
- <command>
+</name>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 HELP
 QUIT
diff --git a/third-party/curl/tests/data/test929 b/third-party/curl/tests/data/test929
index 78537e601c..a5b83b5087 100644
--- a/third-party/curl/tests/data/test929
+++ b/third-party/curl/tests/data/test929
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,29 +8,26 @@ CUSTOMREQUEST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP NOOP (CUSTOMREQUEST)
- </name>
- <command>
+</name>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER -X NOOP -I
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 NOOP
 QUIT
diff --git a/third-party/curl/tests/data/test93 b/third-party/curl/tests/data/test93
index 8780d64328..da1f096460 100644
--- a/third-party/curl/tests/data/test93
+++ b/third-party/curl/tests/data/test93
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 HTTP proxy
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -19,16 +19,15 @@ bing
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with failed proxy auth
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -x %HOSTIP:%HTTPPORT
 </command>
 <features>
@@ -36,10 +35,9 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://%HOSTIP:%HTTPPORT/%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test930 b/third-party/curl/tests/data/test930
index 1c7053e4dd..8d1e7a0e77 100644
--- a/third-party/curl/tests/data/test930
+++ b/third-party/curl/tests/data/test930
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,29 +8,26 @@ CUSTOMREQUEST
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP RSET (CUSTOMREQUEST)
- </name>
- <command>
+</name>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER -X RSET -I
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 RSET
 QUIT
diff --git a/third-party/curl/tests/data/test931 b/third-party/curl/tests/data/test931
index 226f2dd2d3..efd5d79f78 100644
--- a/third-party/curl/tests/data/test931
+++ b/third-party/curl/tests/data/test931
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,15 +12,14 @@ CRLF-in-URL
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP with URL-encoded CR LF in the URL
- </name>
- <command>
+</name>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%0d%0a/%TESTNUMBER
 </command>
 </client>
 
-#
 <verify>
 # 3 - CURLE_URL_MALFORMAT
 <errorcode>
diff --git a/third-party/curl/tests/data/test932 b/third-party/curl/tests/data/test932
index 19418b125d..ec002ae314 100644
--- a/third-party/curl/tests/data/test932
+++ b/third-party/curl/tests/data/test932
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ RFC4954
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -20,7 +20,6 @@ REPLY * 501 AUTH exchange cancelled by client
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -28,26 +27,25 @@ smtp
 </server>
 <features>
 crypto
+digest
 </features>
- <name>
+<name>
 SMTP CRAM-MD5 graceful cancellation
- </name>
- <command>
+</name>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user:secret -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 67 - CURLE_LOGIN_DENIED
 <errorcode>
 67
 </errorcode>
-#
 # The multi interface considers a broken "CONNECT" as a prematurely broken
-# transfer and such a connection will not get a "QUIT"
-<protocol>
+# transfer and such a connection does not get a "QUIT"
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH CRAM-MD5
 *
diff --git a/third-party/curl/tests/data/test933 b/third-party/curl/tests/data/test933
index 55e676657f..0c4a8c42cd 100644
--- a/third-party/curl/tests/data/test933
+++ b/third-party/curl/tests/data/test933
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,18 +10,16 @@ RFC4954
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH NTLM
 REPLY AUTH 334 NTLM supported
-REPLY TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA= 334 Rubbish
+REPLY %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64% 334 Rubbish
 REPLY * 501 AUTH exchange cancelled by client
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -31,37 +30,26 @@ NTLM
 SSL
 !SSPI
 </features>
- <name>
+<name>
 SMTP NTLM graceful cancellation
- </name>
- <setenv>
-# we force our own host name, in order to make the test machine independent
-CURL_GETHOSTNAME=curlhost
-# we try to use the LD_PRELOAD hack, if not a debug build
-LD_PRELOAD=%PWD/libtest/.libs/libhostname.so
- </setenv>
- <command>
+</name>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u testuser:testpass -T -
 </command>
-<precheck>
-chkhostname curlhost
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 67 - CURLE_LOGIN_DENIED
 <errorcode>
 67
 </errorcode>
-#
 # The multi interface considers a broken "CONNECT" as a prematurely broken
-# transfer and such a connection will not get a "QUIT"
-<protocol>
+# transfer and such a connection does not get a "QUIT"
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH NTLM
-TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+%b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 *
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test934 b/third-party/curl/tests/data/test934
index c817de3425..c440eb4974 100644
--- a/third-party/curl/tests/data/test934
+++ b/third-party/curl/tests/data/test934
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ RFC4954
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -20,7 +20,6 @@ REPLY * 501 AUTH exchange cancelled by client
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -28,28 +27,27 @@ smtp
 </server>
 <features>
 !SSPI
-debug
+Debug
 crypto
+digest
 </features>
- <name>
+<name>
 SMTP DIGEST-MD5 graceful cancellation
- </name>
- <command>
+</name>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user:secret -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 67 - CURLE_LOGIN_DENIED
 <errorcode>
 67
 </errorcode>
-#
 # The multi interface considers a broken "CONNECT" as a prematurely broken
-# transfer and such a connection will not get a "QUIT"
-<protocol>
+# transfer and such a connection does not get a "QUIT"
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH DIGEST-MD5
 *
diff --git a/third-party/curl/tests/data/test935 b/third-party/curl/tests/data/test935
index 45176ab174..a7fd990cd2 100644
--- a/third-party/curl/tests/data/test935
+++ b/third-party/curl/tests/data/test935
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,6 @@ RFC4954
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -19,11 +19,10 @@ AUTH CRAM-MD5 PLAIN
 REPLY "AUTH CRAM-MD5" 334 Rubbish
 REPLY * 501 AUTH exchange cancelled by client
 REPLY "AUTH PLAIN" 334 PLAIN supported
-REPLY AHVzZXIAc2VjcmV0 235 Authenticated
+REPLY %b64[%00user%00secret]b64% 235 Authenticated
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -31,33 +30,33 @@ smtp
 </server>
 <features>
 crypto
+digest
 </features>
- <name>
+<name>
 SMTP CRAM-MD5 authentication with SASL downgrade
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user:secret -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH CRAM-MD5
 *
 AUTH PLAIN
-AHVzZXIAc2VjcmV0
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+%b64[%00user%00secret]b64%
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test936 b/third-party/curl/tests/data/test936
index bb9934332d..6a5c9a66d7 100644
--- a/third-party/curl/tests/data/test936
+++ b/third-party/curl/tests/data/test936
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,20 +11,18 @@ RFC4954
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH NTLM PLAIN
 REPLY "AUTH NTLM" 334 NTLM supported
-REPLY TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA= 334 Rubbish
+REPLY %b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64% 334 Rubbish
 REPLY * 501 AUTH exchange cancelled by client
 REPLY "AUTH PLAIN" 334 PLAIN supported
-REPLY AHVzZXIAc2VjcmV0 235 Authenticated
+REPLY %b64[%00user%00secret]b64% 235 Authenticated
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -34,42 +33,32 @@ NTLM
 SSL
 !SSPI
 </features>
- <name>
+<name>
 SMTP NTLM authentication with SASL downgrade
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <setenv>
-# we force our own host name, in order to make the test machine independent
-CURL_GETHOSTNAME=curlhost
-# we try to use the LD_PRELOAD hack, if not a debug build
-LD_PRELOAD=%PWD/libtest/.libs/libhostname.so
- </setenv>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user:secret -T -
 </command>
-<precheck>
-chkhostname curlhost
-</precheck>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH NTLM
-TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
+%b64[NTLMSSP%00%01%00%00%00%06%82%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00]b64%
 *
 AUTH PLAIN
-AHVzZXIAc2VjcmV0
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+%b64[%00user%00secret]b64%
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test937 b/third-party/curl/tests/data/test937
index 2e96cfc936..9f3f4853dd 100644
--- a/third-party/curl/tests/data/test937
+++ b/third-party/curl/tests/data/test937
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,6 @@ RFC4954
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -19,11 +19,10 @@ AUTH DIGEST-MD5 PLAIN
 REPLY "AUTH DIGEST-MD5" 334 Rubbish
 REPLY * 501 AUTH exchange cancelled by client
 REPLY "AUTH PLAIN" 334 PLAIN supported
-REPLY AHVzZXIAc2VjcmV0 235 Authenticated
+REPLY %b64[%00user%00secret]b64% 235 Authenticated
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -31,35 +30,35 @@ smtp
 </server>
 <features>
 !SSPI
-debug
+Debug
 crypto
+digest
 </features>
- <name>
+<name>
 SMTP DIGEST-MD5 authentication with SASL downgrade
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user:secret -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH DIGEST-MD5
 *
 AUTH PLAIN
-AHVzZXIAc2VjcmV0
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+%b64[%00user%00secret]b64%
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test938 b/third-party/curl/tests/data/test938
index 1438556d54..2eae598165 100644
--- a/third-party/curl/tests/data/test938
+++ b/third-party/curl/tests/data/test938
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,54 +11,52 @@ RFC4954
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH PLAIN
 REPLY AUTH 334 PLAIN supported
-REPLY dXNlci5vbmUAdXNlci5vbmUAc2VjcmV0 235 Authenticated
-REPLY dXNlci50d28AdXNlci50d28Ac2VjcmV0 235 Authenticated
+REPLY %b64[user.one%00user.one%00secret]b64% 235 Authenticated
+REPLY %b64[user.two%00user.two%00secret]b64% 235 Authenticated
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP multiple connection authentication
- </name>
-<file name="%LOGDIR/upload%TESTNUMBER">
+</name>
+<file name="%LOGDIR/upload%TESTNUMBER" crlf="yes">
 mail body
 </file>
- <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER001 --mail-rcpt recipient@example.com --mail-from sender@example.com -u user.one:secret -T %LOGDIR/upload%TESTNUMBER -: smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER002 --mail-rcpt recipient@example.com --mail-from sender@example.com -u user.two:secret -T %LOGDIR/upload%TESTNUMBER
+<command>
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER001 --mail-rcpt recipient@example.com --mail-from sender@example.com -u user.one:secret -T %LOGDIR/upload%TESTNUMBER -:
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER002 --mail-rcpt recipient@example.com --mail-from sender@example.com -u user.two:secret -T %LOGDIR/upload%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER001
 AUTH PLAIN
-dXNlci5vbmUAdXNlci5vbmUAc2VjcmV0
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+%b64[user.one%00user.one%00secret]b64%
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 EHLO %TESTNUMBER002
 AUTH PLAIN
-dXNlci50d28AdXNlci50d28Ac2VjcmV0
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+%b64[user.two%00user.two%00secret]b64%
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test939 b/third-party/curl/tests/data/test939
index 2e89def5ff..b8b6bfb43f 100644
--- a/third-party/curl/tests/data/test939
+++ b/third-party/curl/tests/data/test939
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ RFC821
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -14,35 +14,33 @@ REPLY EHLO 500 Command unrecognized
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 RFC821-only SMTP with username and password
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user:secret -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 HELO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test94 b/third-party/curl/tests/data/test94
index bbcfc75358..30c370ef9f 100644
--- a/third-party/curl/tests/data/test94
+++ b/third-party/curl/tests/data/test94
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,8 @@ HTTPS
 HTTP GET
 HTTP CONNECT
 HTTP proxy
-FAILURE
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <connect nocheck="yes">
@@ -21,7 +20,6 @@ bing
 </connect>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -31,21 +29,20 @@ http
 SSL
 proxy
 </features>
- <name>
+<name>
 HTTPS GET with failed proxy auth (CONNECT 1.0)
- </name>
- <command>
+</name>
+<command>
 https://test.anything.really.com:%TESTNUMBER --proxy1.0 %HOSTIP:%HTTPPORT
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <errorcode>
-56
+7
 </errorcode>
-<protocol>
+<protocol crlf="headers">
 CONNECT test.anything.really.com:%TESTNUMBER HTTP/1.0
 Host: test.anything.really.com:%TESTNUMBER
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test940 b/third-party/curl/tests/data/test940
index 9dec799b69..d850609446 100644
--- a/third-party/curl/tests/data/test940
+++ b/third-party/curl/tests/data/test940
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,39 +6,36 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP with username and password but no AUTH capability
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user:secret -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test941 b/third-party/curl/tests/data/test941
index 8b9a636996..c7fdef566f 100644
--- a/third-party/curl/tests/data/test941
+++ b/third-party/curl/tests/data/test941
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,60 +7,59 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP with --crlf
- </name>
+</name>
 <file name="%LOGDIR/upload%TESTNUMBER">
 From: different
 To: another
 
 email
 headers and body
-with unix newlines
+with Unix newlines
 meant to be
 converted
 with
 the
 --crlf option
+%repeat[650 x 0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789%0a]%
 </file>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -T %LOGDIR/upload%TESTNUMBER --crlf
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
 email
 headers and body
-with unix newlines
+with Unix newlines
 meant to be
 converted
 with
 the
 --crlf option
+%repeat[650 x 0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789%0d%0a]%
 .
 </upload>
 </verify>
diff --git a/third-party/curl/tests/data/test942 b/third-party/curl/tests/data/test942
index 79e01d3dca..33ed8db867 100644
--- a/third-party/curl/tests/data/test942
+++ b/third-party/curl/tests/data/test942
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,46 +10,43 @@ RFC4954
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH EXTERNAL
 REPLY AUTH 334 EXTERNAL supported
-REPLY dXNlcg== 235 Authenticated
+REPLY %b64[user]b64% 235 Authenticated
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP external authentication
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 'smtp://user;AUTH=EXTERNAL@%HOSTIP:%SMTPPORT/%TESTNUMBER' --mail-rcpt recipient@example.com --mail-from sender@example.com -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH EXTERNAL
-dXNlcg==
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+%b64[user]b64%
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test943 b/third-party/curl/tests/data/test943
index 3000e05ab7..a9a28d6bd9 100644
--- a/third-party/curl/tests/data/test943
+++ b/third-party/curl/tests/data/test943
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,7 +10,6 @@ RFC4954
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -19,36 +19,34 @@ REPLY = 235 Authenticated
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP external authentication without credentials
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 'smtp://;AUTH=EXTERNAL@%HOSTIP:%SMTPPORT/%TESTNUMBER' --mail-rcpt recipient@example.com --mail-from sender@example.com -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH EXTERNAL
 =
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test944 b/third-party/curl/tests/data/test944
index 88a5478677..14d35ed608 100644
--- a/third-party/curl/tests/data/test944
+++ b/third-party/curl/tests/data/test944
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ RFC4954
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -19,35 +19,33 @@ REPLY AUTH 235 Authenticated
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP external authentication with initial response
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 'smtp://user;AUTH=EXTERNAL@%HOSTIP:%SMTPPORT/%TESTNUMBER' --mail-rcpt recipient@example.com --mail-from sender@example.com --sasl-ir -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-AUTH EXTERNAL dXNlcg==
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+AUTH EXTERNAL %b64[user]b64%
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test945 b/third-party/curl/tests/data/test945
index 41beeaf72d..bcf48b7529 100644
--- a/third-party/curl/tests/data/test945
+++ b/third-party/curl/tests/data/test945
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ RFC4954
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -19,35 +19,33 @@ REPLY AUTH 235 Authenticated
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP external authentication with initial response without credentials
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 'smtp://;AUTH=EXTERNAL@%HOSTIP:%SMTPPORT/%TESTNUMBER' --mail-rcpt recipient@example.com --mail-from sender@example.com --sasl-ir -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH EXTERNAL =
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test946 b/third-party/curl/tests/data/test946
index a1de935c3d..62047c1a62 100644
--- a/third-party/curl/tests/data/test946
+++ b/third-party/curl/tests/data/test946
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,7 +11,6 @@ RFC7628
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -20,36 +20,34 @@ REPLY %b64[n,a=user,%01host=127.0.0.1%01port=%SMTPPORT%01auth=Bearer mF_9.B5f-4.
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP OAuth 2.0 (OAUTHBEARER) authentication
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user --oauth2-bearer mF_9.B5f-4.1JqM -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH OAUTHBEARER
 %b64[n,a=user,%01host=127.0.0.1%01port=%SMTPPORT%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64%
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test947 b/third-party/curl/tests/data/test947
index dbb87acae9..d90febd288 100644
--- a/third-party/curl/tests/data/test947
+++ b/third-party/curl/tests/data/test947
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,7 +12,6 @@ RFC7628
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -20,35 +20,33 @@ REPLY AUTH 235 Authenticated
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP OAuth 2.0 (OAUTHBEARER) authentication with initial response
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user --oauth2-bearer mF_9.B5f-4.1JqM --sasl-ir -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH OAUTHBEARER %b64[n,a=user,%01host=127.0.0.1%01port=%SMTPPORT%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64%
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test948 b/third-party/curl/tests/data/test948
index e4908a400d..6955f993a9 100644
--- a/third-party/curl/tests/data/test948
+++ b/third-party/curl/tests/data/test948
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -10,13 +11,12 @@ RFC7628
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH OAUTHBEARER
 REPLY AUTH 334 OAUTHBEARER supported
-REPLY %b64[n,a=user,%01host=127.0.0.1%01port=%SMTPPORT%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64% 334 eyJzdGF0dXMiOiJpbnZhbGlkX3Rva2VuIiwic2NvcGUiOiJleGFtcGxlX3Njb3BlIiwib3BlbmlkLWNvbmZpZ3VyYXRpb24iOiJodHRwczovL2V4YW1wbGUuY29tLy53ZWxsLWtub3duL29wZW5pZC1jb25maWd1cmF0aW9uIn0
+REPLY %b64[n,a=user,%01host=127.0.0.1%01port=%SMTPPORT%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64% 334 %b64[{"status":"invalid_token","scope":"example_scope","openid-configuration":"https://example.com/.well-known/openid-configuration"}]b64%
 REPLY AQ== 535 Username and Password not accepted. Learn more at\r\n535 http://support.example.com/mail/oauth
 </servercmd>
 </reply>
@@ -27,28 +27,26 @@ REPLY AQ== 535 Username and Password not accepted. Learn more at\r\n535 http://s
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP OAuth 2.0 (OAUTHBEARER) failure as continuation
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user --oauth2-bearer mF_9.B5f-4.1JqM -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 67 - CURLE_LOGIN_DENIED
 <errorcode>
 67
 </errorcode>
-#
 # The multi interface considers a broken "CONNECT" as a prematurely broken
-# transfer and such a connection will not get a "QUIT"
-<protocol>
+# transfer and such a connection does not get a "QUIT"
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH OAUTHBEARER
 %b64[n,a=user,%01host=127.0.0.1%01port=%SMTPPORT%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64%
diff --git a/third-party/curl/tests/data/test949 b/third-party/curl/tests/data/test949
index 0cd2736eae..d2407048c5 100644
--- a/third-party/curl/tests/data/test949
+++ b/third-party/curl/tests/data/test949
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -11,44 +12,40 @@ RFC7628
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH OAUTHBEARER
-REPLY AUTH 334 eyJzdGF0dXMiOiJpbnZhbGlkX3Rva2VuIiwic2NvcGUiOiJleGFtcGxlX3Njb3BlIiwib3BlbmlkLWNvbmZpZ3VyYXRpb24iOiJodHRwczovL2V4YW1wbGUuY29tLy53ZWxsLWtub3duL29wZW5pZC1jb25maWd1cmF0aW9uIn0
+REPLY AUTH 334 %b64[{"status":"invalid_token","scope":"example_scope","openid-configuration":"https://example.com/.well-known/openid-configuration"}]b64%
 REPLY AQ== 535 Username and Password not accepted. Learn more at\r\n535 http://support.example.com/mail/oauth
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP OAuth 2.0 (OAUTHBEARER) failure as continuation with initial response
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user --oauth2-bearer mF_9.B5f-4.1JqM --sasl-ir -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 67 - CURLE_LOGIN_DENIED
 <errorcode>
 67
 </errorcode>
-#
 # The multi interface considers a broken "CONNECT" as a prematurely broken
-# transfer and such a connection will not get a "QUIT"
-<protocol>
+# transfer and such a connection does not get a "QUIT"
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH OAUTHBEARER %b64[n,a=user,%01host=127.0.0.1%01port=%SMTPPORT%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64%
 AQ==
diff --git a/third-party/curl/tests/data/test95 b/third-party/curl/tests/data/test95
index 717b07aed2..7ccc3cd015 100644
--- a/third-party/curl/tests/data/test95
+++ b/third-party/curl/tests/data/test95
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,7 +9,6 @@ proxytunnel
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -21,13 +21,13 @@ Content-Length: 9
 
 contents
 </data>
-<connect>
+<connect crlf="headers">
 HTTP/1.1 200 Mighty fine indeed
 
 </connect>
 <datacheck>
-HTTP/1.1 200 Mighty fine indeed
-
+HTTP/1.1 200 Mighty fine indeed%CR
+%CR
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake swsclose
@@ -39,17 +39,16 @@ contents
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 http-proxy
 </server>
- <name>
+<name>
 HTTP over proxytunnel using POST
- </name>
- <command>
+</name>
+<command>
 http://test.%TESTNUMBER:%HTTPPORT/we/want/that/page/%TESTNUMBER -p -x %HOSTIP:%PROXYPORT -d "datatopost=ohthatsfunyesyes"
 </command>
 <features>
@@ -57,17 +56,16 @@ proxy
 </features>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<proxy>
+<proxy crlf="headers">
 CONNECT test.%TESTNUMBER:%HTTPPORT HTTP/1.1
 Host: test.%TESTNUMBER:%HTTPPORT
 User-Agent: curl/%VERSION
 Proxy-Connection: Keep-Alive
 
 </proxy>
-<protocol nonewline="yes">
+<protocol crlf="headers" nonewline="yes">
 POST /we/want/that/page/%TESTNUMBER HTTP/1.1
 Host: test.%TESTNUMBER:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test950 b/third-party/curl/tests/data/test950
index 7aa6edd615..6d6fcc3033 100644
--- a/third-party/curl/tests/data/test950
+++ b/third-party/curl/tests/data/test950
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,34 +8,31 @@ VRFY
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
-250 <recipient@example.com>
+<data crlf="yes">
+250 %LTrecipient@example.com%GT
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP VRFY with custom request
- </name>
+</name>
 
-# the custom request just does it lowercase to remain the same command
+# the custom request does it lowercase to remain the same command
 <command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient --request "vrfy"
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 vrfy recipient
 QUIT
diff --git a/third-party/curl/tests/data/test951 b/third-party/curl/tests/data/test951
index 14390345e8..a556f3d85d 100644
--- a/third-party/curl/tests/data/test951
+++ b/third-party/curl/tests/data/test951
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,21 +6,19 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP data with dot as first character
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 .This first line starts with a dot
 </stdin>
 <command>
@@ -27,17 +26,16 @@ smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-fr
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 ..This first line starts with a dot
 .
 </upload>
diff --git a/third-party/curl/tests/data/test952 b/third-party/curl/tests/data/test952
index 95908fe51a..936b0e6a55 100644
--- a/third-party/curl/tests/data/test952
+++ b/third-party/curl/tests/data/test952
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,21 +6,19 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP data with single dot-only line
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 .
 </stdin>
 <command>
@@ -27,17 +26,16 @@ smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-fr
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 ..
 .
 </upload>
diff --git a/third-party/curl/tests/data/test953 b/third-party/curl/tests/data/test953
index d6e547afbb..d229e46c68 100644
--- a/third-party/curl/tests/data/test953
+++ b/third-party/curl/tests/data/test953
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -9,46 +10,43 @@ RFC4954
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH PLAIN
 REPLY AUTH 334 PLAIN supported
-REPLY dXJzZWwAa3VydAB4aXBqM3BsbXE= 235 Authenticated
+REPLY %b64[ursel%00kurt%00xipj3plmq]b64% 235 Authenticated
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP plain authentication with alternative authorization identity
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 mail body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u kurt:xipj3plmq --sasl-authzid ursel -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH PLAIN
-dXJzZWwAa3VydAB4aXBqM3BsbXE=
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+%b64[ursel%00kurt%00xipj3plmq]b64%
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 mail body
 .
 </upload>
diff --git a/third-party/curl/tests/data/test954 b/third-party/curl/tests/data/test954
index bf4858ecbb..1d39ff9f10 100644
--- a/third-party/curl/tests/data/test954
+++ b/third-party/curl/tests/data/test954
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,51 +6,47 @@ SMTP
 SASL
 SASL AUTH PLAIN
 RFC4616
-RFC4%TESTNUMBER
+RFC4954
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 AUTH PLAIN
 REPLY AUTH 334 PLAIN supported
-REPLY dXJzZWwAa3VydAB4aXBqM3BsbXE= 501 Not authorized
+REPLY %b64[ursel%00kurt%00xipj3plmq]b64% 501 Not authorized
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
- <name>
-SMTP plain authentication with alternative authorization identity (Not authorized)
- </name>
+<name>
+SMTP plain auth with alt authorization identity (Not authorized)
+</name>
 <stdin>
 mail body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u kurt:xipj3plmq --sasl-authzid ursel -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 67 - CURLE_LOGIN_DENIED
 <errorcode>
 67
 </errorcode>
-#
 # The multi interface considers a broken "CONNECT" as a prematurely broken
-# transfer and such a connection will not get a "QUIT"
-<protocol>
+# transfer and such a connection does not get a "QUIT"
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 AUTH PLAIN
-dXJzZWwAa3VydAB4aXBqM3BsbXE=
+%b64[ursel%00kurt%00xipj3plmq]b64%
 </protocol>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test955 b/third-party/curl/tests/data/test955
index 66dfcd658f..a7b06351e2 100644
--- a/third-party/curl/tests/data/test955
+++ b/third-party/curl/tests/data/test955
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -13,7 +13,6 @@ REPLY MAIL 501 not fine enough
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -21,38 +20,34 @@ smtp
 </server>
 <features>
 !win32
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=en_US.UTF-8
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
+<name>
 SMTP without SMTPUTF8 support - UTF-8 based sender (local part only)
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
 <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from Avsändaren@example.com -T -
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from Avs%hex[%c3%a4]hex%ndaren@example.com -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 55 - CURLE_SEND_ERROR
 <errorcode>
 55
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<Avsändaren@example.com>
+MAIL FROM:%LTAvs%hex[%c3%a4]hex%ndaren@example.com%GT
 QUIT
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test956 b/third-party/curl/tests/data/test956
index 0fe0911502..5ee26997b2 100644
--- a/third-party/curl/tests/data/test956
+++ b/third-party/curl/tests/data/test956
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,12 +6,10 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -18,39 +17,35 @@ smtp
 </server>
 <features>
 !win32
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=en_US.UTF-8
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
+<name>
 SMTP without SMTPUTF8 support - UTF-8 based recipient (local part only)
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
 <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt Stödmottagaren@example.com --mail-from sender@example.com -T -
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt St%hex[%c3%b6]hex%dmottagaren@example.com --mail-from sender@example.com -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 55 - CURLE_SEND_ERROR
 <errorcode>
 55
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<Stödmottagaren@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTSt%hex[%c3%b6]hex%dmottagaren@example.com%GT
 QUIT
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test957 b/third-party/curl/tests/data/test957
index 40fa4682c9..4737367e79 100644
--- a/third-party/curl/tests/data/test957
+++ b/third-party/curl/tests/data/test957
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,10 @@ VRFY
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -19,32 +18,28 @@ smtp
 </server>
 <features>
 !win32
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=en_US.UTF-8
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
-SMTP VRFY without SMTPUTF8 support - UTF-8 based recipient (local part only)
- </name>
+<name>
+SMTP VRFY without SMTPUTF8 support - UTF-8 recipient (local part only)
+</name>
 <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt Användaren
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt Anv%hex[%c3%a4]hex%ndaren
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 8 - CURLE_WEIRD_SERVER_REPLY
 <errorcode>
 8
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-VRFY Användaren
+VRFY Anv%hex[%c3%a4]hex%ndaren
 QUIT
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test958 b/third-party/curl/tests/data/test958
index ef9caffccc..9ee2bb681e 100644
--- a/third-party/curl/tests/data/test958
+++ b/third-party/curl/tests/data/test958
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,12 +7,10 @@ VRFY
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -19,32 +18,28 @@ smtp
 </server>
 <features>
 !win32
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=en_US.UTF-8
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
-SMTP external VRFY without SMTPUTF8 support - UTF-8 based recipient (local part only)
- </name>
+<name>
+SMTP external VRFY without SMTPUTF8 - UTF-8 recipient (local part only)
+</name>
 <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt Användaren@example.com
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt Anv%hex[%c3%a4]hex%ndaren@example.com
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 8 - CURLE_WEIRD_SERVER_REPLY
 <errorcode>
 8
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-VRFY Användaren@example.com
+VRFY Anv%hex[%c3%a4]hex%ndaren@example.com
 QUIT
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test959 b/third-party/curl/tests/data/test959
index 94c92ea95d..6c44a7cb87 100644
--- a/third-party/curl/tests/data/test959
+++ b/third-party/curl/tests/data/test959
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -13,47 +13,42 @@ REPLY MAIL 501 not fine enough
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
 <features>
-!idn
+!IDN
 !win32
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=en_US.UTF-8
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
+<name>
 SMTP without SMTPUTF8 support - UTF-8 based sender (host part only)
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
 <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@åäö.se -T -
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@%hex[%c3%a5%c3%a4%c3%b6]hex%.se -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 55 - CURLE_SEND_ERROR
 <errorcode>
 55
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@åäö.se>
+MAIL FROM:%LTsender@%hex[%c3%a5%c3%a4%c3%b6]hex%.se%GT
 QUIT
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test96 b/third-party/curl/tests/data/test96
index 2bf68cc4bf..eb82903b30 100644
--- a/third-party/curl/tests/data/test96
+++ b/third-party/curl/tests/data/test96
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,16 +6,12 @@ TrackMemory
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
 # Client-side
 <client>
-<server>
-none
-</server>
 <features>
 TrackMemory
 </features>
@@ -27,19 +24,20 @@ curl memory tracking operational
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 <file name="%LOGDIR/memdump">
+MEM tool_cfgable.c
 MEM tool_paramhlp.c
 MEM tool_cfgable.c
 MEM tool_cfgable.c
 MEM tool_cfgable.c
+MEM tool_cfgable.c
 </file>
 <stripfile>
-$_ = '' if ((($_ !~ /tool_paramhlp/) && ($_ !~ /tool_cfgable/)) || ($_ =~ /free\(\(nil\)\)/))
+$_ = '' if((($_ !~ /tool_paramhlp/) and ($_ !~ /tool_cfgable/)) || ($_ =~ /free\(\(nil\)\)/))
 s/:\d+.*//
-s:^(MEM )(.*/)(.*):$1$3:
+s:^(MEM )(.*[/\\])(.*):$1$3:
 </stripfile>
 </verify>
 
diff --git a/third-party/curl/tests/data/test960 b/third-party/curl/tests/data/test960
index a54eb1d54b..0b0d2fd7ac 100644
--- a/third-party/curl/tests/data/test960
+++ b/third-party/curl/tests/data/test960
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,53 +6,47 @@ SMTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
 <features>
-!idn
+!IDN
 !win32
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=en_US.UTF-8
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
+<name>
 SMTP without SMTPUTF8 support - UTF-8 based recipient (host part only)
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
 <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@åäö.se --mail-from sender@example.com -T -
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@%hex[%c3%a5%c3%a4%c3%b6]hex%.se --mail-from sender@example.com -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 55 - CURLE_SEND_ERROR
 <errorcode>
 55
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@åäö.se>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@%hex[%c3%a5%c3%a4%c3%b6]hex%.se%GT
 QUIT
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test961 b/third-party/curl/tests/data/test961
index d8db37c64f..0fa9cc530a 100644
--- a/third-party/curl/tests/data/test961
+++ b/third-party/curl/tests/data/test961
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,46 +7,40 @@ VRFY
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
 <features>
-!idn
+!IDN
 !win32
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=en_US.UTF-8
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
-SMTP external VRFY without SMTPUTF8 support - UTF-8 based recipient (host part only)
- </name>
+<name>
+SMTP external VRFY without SMTPUTF8 - UTF-8 recipient (host part only)
+</name>
 <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt user@åäö.se
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt user@%hex[%c3%a5%c3%a4%c3%b6]hex%.se
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 8 - CURLE_WEIRD_SERVER_REPLY
 <errorcode>
 8
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-VRFY user@åäö.se
+VRFY user@%hex[%c3%a5%c3%a4%c3%b6]hex%.se
 QUIT
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test962 b/third-party/curl/tests/data/test962
index 85c384ee34..a3fb2c99a8 100644
--- a/third-party/curl/tests/data/test962
+++ b/third-party/curl/tests/data/test962
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,53 +7,47 @@ IDN
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
 <features>
-idn
+IDN
 !win32
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=en_US.UTF-8
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
-SMTP without SMTPUTF8 support - UTF-8 based sender (host part only)
- </name>
-<stdin>
+<name>
+SMTP without SMTPUTF8 support - UTF-8 based sender, with IDN
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
 <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@åäö.se -T -
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@%hex[%c3%a5%c3%a4%c3%b6]hex%.se -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@xn--4cab6c.se>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@xn--4cab6c.se%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
diff --git a/third-party/curl/tests/data/test963 b/third-party/curl/tests/data/test963
index fac2c7320d..cc3c9dab57 100644
--- a/third-party/curl/tests/data/test963
+++ b/third-party/curl/tests/data/test963
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,53 +7,47 @@ IDN
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
 <features>
-idn
+IDN
 !win32
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=en_US.UTF-8
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
-SMTP without SMTPUTF8 support (IDN Enabled) - UTF-8 based recipient (host part only)
- </name>
-<stdin>
+<name>
+SMTP without SMTPUTF8 support (IDN) - UTF-8 recipient (host part only)
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
 <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@åäö.se --mail-from sender@example.com -T -
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@%hex[%c3%a5%c3%a4%c3%b6]hex%.se --mail-from sender@example.com -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@xn--4cab6c.se>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@xn--4cab6c.se%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
diff --git a/third-party/curl/tests/data/test964 b/third-party/curl/tests/data/test964
index e4fee09ffa..3465d20211 100644
--- a/third-party/curl/tests/data/test964
+++ b/third-party/curl/tests/data/test964
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,40 +8,34 @@ IDN
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
 <features>
-idn
+IDN
 !win32
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=en_US.UTF-8
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
-SMTP external VRFY without SMTPUTF8 support (IDN Enabled) - UTF-8 based recipient (host part only)
- </name>
+<name>
+SMTP external VRFY without SMTPUTF8 (IDN) - UTF-8 recipient (host part)
+</name>
 <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt user@åäö.se
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt user@%hex[%c3%a5%c3%a4%c3%b6]hex%.se
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 VRFY user@xn--4cab6c.se
 QUIT
diff --git a/third-party/curl/tests/data/test965 b/third-party/curl/tests/data/test965
index 0f9f2f696c..8de36edb25 100644
--- a/third-party/curl/tests/data/test965
+++ b/third-party/curl/tests/data/test965
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ IDN
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -14,48 +14,43 @@ CAPA SMTPUTF8
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
 <features>
-idn
+IDN
 !win32
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=en_US.UTF-8
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
+<name>
 SMTP with SMTPUTF8 support - UTF-8 based sender
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
 <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from Avsändaren@åäö.se -T -
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from Avs%hex[%c3%a4]hex%ndaren@%hex[%c3%a5%c3%a4%c3%b6]hex%.se -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<Avsändaren@xn--4cab6c.se> SMTPUTF8
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTAvs%hex[%c3%a4]hex%ndaren@xn--4cab6c.se%GT SMTPUTF8
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
diff --git a/third-party/curl/tests/data/test966 b/third-party/curl/tests/data/test966
index 6ab8b17be3..9bc20cfe3e 100644
--- a/third-party/curl/tests/data/test966
+++ b/third-party/curl/tests/data/test966
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ IDN
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -14,48 +14,43 @@ CAPA SMTPUTF8
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
 <features>
-idn
+IDN
 !win32
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=en_US.UTF-8
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
+<name>
 SMTP with SMTPUTF8 support - UTF-8 based recipient
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
 <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt Stödmottagaren@åäö.se --mail-from sender@example.com -T -
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt St%hex[%c3%b6]hex%dmottagaren@%hex[%c3%a5%c3%a4%c3%b6]hex%.se --mail-from sender@example.com -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com> SMTPUTF8
-RCPT TO:<Stödmottagaren@xn--4cab6c.se>
+MAIL FROM:%LTsender@example.com%GT SMTPUTF8
+RCPT TO:%LTSt%hex[%c3%b6]hex%dmottagaren@xn--4cab6c.se%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
diff --git a/third-party/curl/tests/data/test967 b/third-party/curl/tests/data/test967
index 49bd1ad6e1..8d87ceee80 100644
--- a/third-party/curl/tests/data/test967
+++ b/third-party/curl/tests/data/test967
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,48 +8,42 @@ IDN
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 CAPA SMTPUTF8
 </servercmd>
-<data>
+<data crlf="yes">
 252 Send some mail and I'll try my best
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
 <features>
-idn
+IDN
 !win32
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=en_US.UTF-8
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
+<name>
 SMTP external VRFY with SMTPUTF8 support
- </name>
+</name>
 <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt Användaren@åäö.se
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt Anv%hex[%c3%a4]hex%ndaren@%hex[%c3%a5%c3%a4%c3%b6]hex%.se
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-VRFY Användaren@xn--4cab6c.se SMTPUTF8
+VRFY Anv%hex[%c3%a4]hex%ndaren@xn--4cab6c.se SMTPUTF8
 QUIT
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test968 b/third-party/curl/tests/data/test968
index 4c225059d5..4959fcdae7 100644
--- a/third-party/curl/tests/data/test968
+++ b/third-party/curl/tests/data/test968
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ IDN
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -15,37 +15,32 @@ CAPA SMTPUTF8
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
 <features>
-idn
+IDN
 !win32
+codeset-utf8
 </features>
 <setenv>
-LC_ALL=en_US.UTF-8
-LC_CTYPE=en_US.UTF-8
+LC_ALL=C.UTF-8
 </setenv>
-<precheck>
-perl -MI18N::Langinfo=langinfo,CODESET -e 'die "Needs a UTF-8 locale" if (lc(langinfo(CODESET())) ne "utf-8");'
-</precheck>
- <name>
+<name>
 SMTP VRFY with SMTPUTF8 support
- </name>
+</name>
 <command>
-smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt Användaren
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt Anv%hex[%c3%a4]hex%ndaren
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-VRFY Användaren SMTPUTF8
+VRFY Anv%hex[%c3%a4]hex%ndaren SMTPUTF8
 QUIT
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test969 b/third-party/curl/tests/data/test969
index a483916b26..bf1c085522 100644
--- a/third-party/curl/tests/data/test969
+++ b/third-party/curl/tests/data/test969
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -8,41 +9,38 @@ IDN
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
 CAPA SMTPUTF8
 </servercmd>
-<data>
-250-Joe Smith <joe.smith@example.com>
-250-Harry Smith <harry.smith@example.com>
-250 Melvin Smith <melvin.smith@example.com>
+<data crlf="yes">
+250-Joe Smith %LTjoe.smith@example.com%GT
+250-Harry Smith %LTharry.smith@example.com%GT
+250 Melvin Smith %LTmelvin.smith@example.com%GT
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtp
 </server>
 <features>
-idn
+IDN
 !win32
 </features>
- <name>
+<name>
 SMTP mailing list EXPN (CUSTOMREQUEST) with SMTPUTF8 support
- </name>
- <command>
+</name>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt Friends -X EXPN
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 EXPN Friends SMTPUTF8
 QUIT
diff --git a/third-party/curl/tests/data/test97 b/third-party/curl/tests/data/test97
index 37f8904846..8b1fad6887 100644
--- a/third-party/curl/tests/data/test97
+++ b/third-party/curl/tests/data/test97
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ HTTP POST
 HTTP replaced headers
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.0 200 OK
 Server: test-server/fake
 Content-Type: text/html
@@ -19,24 +19,22 @@ blaha
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP POST with custom content-type
- </name>
- <command>
- -d "hejsanallabarn" -H "Content-Type: silly/type" http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</name>
+<command>
+-d "hejsanallabarn" -H "Content-Type: silly/type" http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol nonewline="yes">
+<protocol crlf="headers" nonewline="yes">
 POST /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test970 b/third-party/curl/tests/data/test970
index 0fcd8c0b81..e936865d2d 100644
--- a/third-party/curl/tests/data/test970
+++ b/third-party/curl/tests/data/test970
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -25,14 +25,13 @@ Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor i
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
 <features>
-debug
+Debug
 proxy
 </features>
 <setenv>
@@ -48,10 +47,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER --write-out '%{json}' -o %LOGDIR/out%TESTNU
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -59,7 +57,7 @@ Accept: */*
 
 </protocol>
 <stdout nonewline="yes">
-{"certs":"","content_type":"text/html","conn_id":0,"errormsg":null,"exitcode":0,"filename_effective":"%LOGDIR/out%TESTNUMBER","ftp_entry_path":null,"http_code":200,"http_connect":0,"http_version":"1.1","local_ip":"127.0.0.1","local_port":13,"method":"GET","num_certs":0,"num_connects":1,"num_headers":9,"num_redirects":0,"proxy_ssl_verify_result":0,"redirect_url":null,"referer":null,"remote_ip":"%HOSTIP","remote_port":%HTTPPORT,"response_code":200,"scheme":"HTTP","size_download":445,"size_header":4019,"size_request":4019,"size_upload":0,"speed_download":13,"speed_upload":13,"ssl_verify_result":0,"time_appconnect":0.000013,"time_connect":0.000013,"time_namelookup":0.000013,"time_pretransfer":0.000013,"time_redirect":0.000013,"time_starttransfer":0.000013,"time_total":0.000013,"url":"http://%HOSTIP:%HTTPPORT/%TESTNUMBER","url.scheme":"http","url.user":null,"url.password":null,"url.options":null,"url.host":"%HOSTIP","url.port":"%HTTPPORT","url.path":"/%TESTNUMBER","url.query":null,"url.fragment":null,"url.zoneid":null,"urle.scheme":"http","urle.user":null,"urle.password":null,"urle.options":null,"urle.host":"%HOSTIP","urle.port":"%HTTPPORT","urle.path":"/%TESTNUMBER","urle.query":null,"urle.fragment":null,"urle.zoneid":null,"url_effective":"http://%HOSTIP:%HTTPPORT/%TESTNUMBER","urlnum":0,"xfer_id":0,"curl_version":"curl-unit-test-fake-version"}
+{"certs":"","conn_id":0,"content_type":"text/html","errormsg":null,"exitcode":0,"filename_effective":"%LOGDIR/out%TESTNUMBER","ftp_entry_path":null,"http_code":200,"http_connect":0,"http_version":"1.1","local_ip":"127.0.0.1","local_port":13,"method":"GET","num_certs":0,"num_connects":1,"num_headers":9,"num_redirects":0,"num_retries":0,"proxy_ssl_verify_result":0,"proxy_used":0,"redirect_url":null,"referer":null,"remote_ip":"%HOSTIP","remote_port":%HTTPPORT,"response_code":200,"scheme":"http","size_delivered":445,"size_download":445,"size_header":4019,"size_request":4019,"size_upload":0,"speed_download":13,"speed_upload":13,"ssl_verify_result":0,"time_appconnect":0.000013,"time_connect":0.000013,"time_namelookup":0.000013,"time_posttransfer":0.000013,"time_pretransfer":0.000013,"time_queue":0.000013,"time_redirect":0.000013,"time_starttransfer":0.000013,"time_total":0.000013,"tls_earlydata":0,"url":"http://%HOSTIP:%HTTPPORT/%TESTNUMBER","url.fragment":null,"url.host":"127.0.0.1","url.options":null,"url.password":null,"url.path":"/%TESTNUMBER","url.port":"%HTTPPORT","url.query":null,"url.scheme":"http","url.user":null,"url.zoneid":null,"url_effective":"http://%HOSTIP:%HTTPPORT/%TESTNUMBER","urle.fragment":null,"urle.host":"127.0.0.1","urle.options":null,"urle.password":null,"urle.path":"/%TESTNUMBER","urle.port":"%HTTPPORT","urle.query":null,"urle.scheme":"http","urle.user":null,"urle.zoneid":null,"urlnum":0,"xfer_id":0,"curl_version":"curl-unit-test-fake-version"}
 </stdout>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test971 b/third-party/curl/tests/data/test971
index dada920018..06844180e5 100644
--- a/third-party/curl/tests/data/test971
+++ b/third-party/curl/tests/data/test971
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,19 +7,14 @@ options-in-versions
 </keywords>
 </info>
 
-#
 # Client-side
 <client>
-<server>
-none
-</server>
-
- <name>
+<name>
 Verify that options-in-versions and docs/cmdline-opts are in sync
- </name>
+</name>
 
 <command type="perl">
-%SRCDIR/options-scan.pl %SRCDIR/../docs/options-in-versions %SRCDIR/../docs/cmdline-opts
+%SRCDIR/test971.pl %SRCDIR/../docs/options-in-versions %SRCDIR/../docs/cmdline-opts %SRCDIR/../docs/VERSIONS.md
 </command>
 </client>
 
diff --git a/third-party/curl/tests/data/test972 b/third-party/curl/tests/data/test972
index bff81185fc..725da28019 100644
--- a/third-party/curl/tests/data/test972
+++ b/third-party/curl/tests/data/test972
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data nocheck="yes">
@@ -25,7 +25,6 @@ Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor i
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 
@@ -33,7 +32,7 @@ Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor i
 http
 </server>
 <features>
-debug
+Debug
 proxy
 </features>
 <setenv>
@@ -49,10 +48,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -s --write-out '%{json}\n' -o %LOGDIR/out97
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
@@ -60,7 +58,7 @@ Accept: */*
 
 </protocol>
 <stdout mode="text">
-{"certs":"","content_type":"text/html","conn_id":0,"errormsg":null,"exitcode":0,"filename_effective":"%LOGDIR/out972","ftp_entry_path":null,"http_code":200,"http_connect":0,"http_version":"1.1","local_ip":"%HOSTIP","local_port":13,"method":"GET","num_certs":0,"num_connects":1,"num_headers":9,"num_redirects":0,"proxy_ssl_verify_result":0,"redirect_url":null,"referer":null,"remote_ip":"%HOSTIP","remote_port":%HTTPPORT,"response_code":200,"scheme":"HTTP","size_download":445,"size_header":4019,"size_request":4019,"size_upload":0,"speed_download":13,"speed_upload":13,"ssl_verify_result":0,"time_appconnect":0.000013,"time_connect":0.000013,"time_namelookup":0.000013,"time_pretransfer":0.000013,"time_redirect":0.000013,"time_starttransfer":0.000013,"time_total":0.000013,"url":"http://%HOSTIP:%HTTPPORT/%TESTNUMBER","url.scheme":"http","url.user":null,"url.password":null,"url.options":null,"url.host":"%HOSTIP","url.port":"%HTTPPORT","url.path":"/%TESTNUMBER","url.query":null,"url.fragment":null,"url.zoneid":null,"urle.scheme":"http","urle.user":null,"urle.password":null,"urle.options":null,"urle.host":"%HOSTIP","urle.port":"%HTTPPORT","urle.path":"/%TESTNUMBER","urle.query":null,"urle.fragment":null,"urle.zoneid":null,"url_effective":"http://%HOSTIP:%HTTPPORT/%TESTNUMBER","urlnum":0,"xfer_id":0,"curl_version":"curl-unit-test-fake-version"}
+{"certs":"","conn_id":0,"content_type":"text/html","errormsg":null,"exitcode":0,"filename_effective":"%LOGDIR/out%TESTNUMBER","ftp_entry_path":null,"http_code":200,"http_connect":0,"http_version":"1.1","local_ip":"127.0.0.1","local_port":13,"method":"GET","num_certs":0,"num_connects":1,"num_headers":9,"num_redirects":0,"num_retries":0,"proxy_ssl_verify_result":0,"proxy_used":0,"redirect_url":null,"referer":null,"remote_ip":"%HOSTIP","remote_port":%HTTPPORT,"response_code":200,"scheme":"http","size_delivered":445,"size_download":445,"size_header":4019,"size_request":4019,"size_upload":0,"speed_download":13,"speed_upload":13,"ssl_verify_result":0,"time_appconnect":0.000013,"time_connect":0.000013,"time_namelookup":0.000013,"time_posttransfer":0.000013,"time_pretransfer":0.000013,"time_queue":0.000013,"time_redirect":0.000013,"time_starttransfer":0.000013,"time_total":0.000013,"tls_earlydata":0,"url":"http://%HOSTIP:%HTTPPORT/%TESTNUMBER","url.fragment":null,"url.host":"127.0.0.1","url.options":null,"url.password":null,"url.path":"/%TESTNUMBER","url.port":"%HTTPPORT","url.query":null,"url.scheme":"http","url.user":null,"url.zoneid":null,"url_effective":"http://%HOSTIP:%HTTPPORT/%TESTNUMBER","urle.fragment":null,"urle.host":"127.0.0.1","urle.options":null,"urle.password":null,"urle.path":"/%TESTNUMBER","urle.port":"%HTTPPORT","urle.query":null,"urle.scheme":"http","urle.user":null,"urle.zoneid":null,"urlnum":0,"xfer_id":0,"curl_version":"curl-unit-test-fake-version"}
 </stdout>
 </verify>
 </testcase>
diff --git a/third-party/curl/tests/data/test973 b/third-party/curl/tests/data/test973
index 219fc37b15..a4279cff60 100644
--- a/third-party/curl/tests/data/test973
+++ b/third-party/curl/tests/data/test973
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ FTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -48,28 +48,26 @@ works
 
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 ftp
 </server>
- <name>
+<name>
 HTTP with auth redirected to FTP w/o auth
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -L -u joe:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic am9lOnNlY3JldA==
+Authorization: Basic %b64[joe:secret]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test974 b/third-party/curl/tests/data/test974
index 8687e8ab4d..0fc12309e7 100644
--- a/third-party/curl/tests/data/test974
+++ b/third-party/curl/tests/data/test974
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP proxy
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -52,7 +52,6 @@ hey
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -61,21 +60,20 @@ proxy
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with auth redirected to HTTP on a diff port w/o auth
- </name>
- <command>
+</name>
+<command>
 -x http://%HOSTIP:%HTTPPORT http://firsthost.com -L -u joe:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://firsthost.com/ HTTP/1.1
 Host: firsthost.com
-Authorization: Basic am9lOnNlY3JldA==
+Authorization: Basic %b64[joe:secret]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test975 b/third-party/curl/tests/data/test975
index 53ca03126e..fe2891e11d 100644
--- a/third-party/curl/tests/data/test975
+++ b/third-party/curl/tests/data/test975
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ FTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -48,28 +48,26 @@ works
 
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 ftp
 </server>
- <name>
+<name>
 HTTP with auth redirected to FTP allowing auth to continue
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --location-trusted -u joe:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic am9lOnNlY3JldA==
+Authorization: Basic %b64[joe:secret]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test976 b/third-party/curl/tests/data/test976
index 519939d120..0b0bf0ea38 100644
--- a/third-party/curl/tests/data/test976
+++ b/third-party/curl/tests/data/test976
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ HTTP proxy
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -52,7 +52,6 @@ hey
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -61,28 +60,27 @@ proxy
 <server>
 http
 </server>
- <name>
+<name>
 HTTP with auth redirected to HTTP on a diff port --location-trusted
- </name>
- <command>
+</name>
+<command>
 -x http://%HOSTIP:%HTTPPORT http://firsthost.com --location-trusted -u joe:secret
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://firsthost.com/ HTTP/1.1
 Host: firsthost.com
-Authorization: Basic am9lOnNlY3JldA==
+Authorization: Basic %b64[joe:secret]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
 
 GET http://firsthost.com:9999/a/path/%TESTNUMBER0002 HTTP/1.1
 Host: firsthost.com:9999
-Authorization: Basic am9lOnNlY3JldA==
+Authorization: Basic %b64[joe:secret]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 Proxy-Connection: Keep-Alive
diff --git a/third-party/curl/tests/data/test977 b/third-party/curl/tests/data/test977
index d36fc62a02..1c8846f1ba 100644
--- a/third-party/curl/tests/data/test977
+++ b/third-party/curl/tests/data/test977
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,7 +8,6 @@ cookies
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <data>
@@ -23,7 +23,6 @@ Set-Cookie: a=b; Domain=.me.;
 
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -33,18 +32,17 @@ proxy
 <server>
 http
 </server>
- <name>
+<name>
 URL with trailing dot and receiving a cookie for the TLD with dot
- </name>
- <command>
+</name>
+<command>
 -x http://%HOSTIP:%HTTPPORT http://firsthost.me. -c %LOGDIR/cookies%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 GET http://firsthost.me./ HTTP/1.1
 Host: firsthost.me.
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test978 b/third-party/curl/tests/data/test978
index 16e55920d6..e6b64a20b1 100644
--- a/third-party/curl/tests/data/test978
+++ b/third-party/curl/tests/data/test978
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ HTTP
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes">
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -25,24 +25,22 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 verify that --stderr works for -w's stderr as well
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER --stderr %LOGDIR/redir --silent -w '%{stderr}nonsense\n'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol crlf="yes">
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test979 b/third-party/curl/tests/data/test979
index 40cc35044d..9c197396e7 100644
--- a/third-party/curl/tests/data/test979
+++ b/third-party/curl/tests/data/test979
@@ -1,16 +1,16 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 HTTP
 HTTP GET
-Basic
+HTTP Basic auth
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes" nocheck="yes">
+<data crlf="headers" nocheck="yes">
 HTTP/1.1 302 go go go
 Content-Length: 8
 Location: http://%HOSTIP:%HTTPPORT/user/%TESTNUMBER0002
@@ -19,7 +19,7 @@ Funny-head: yesyes
 
 notreal
 </data>
-<data2 crlf="yes">
+<data2 crlf="headers">
 HTTP/1.1 200 OK
 Content-Length: 6
 Content-Type: text/html
@@ -29,7 +29,6 @@ final
 </data2>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -43,19 +42,18 @@ http://first:secret@%HOSTIP:%HTTPPORT/%TESTNUMBER -L -u smith:doggie
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol crlf="yes">
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic c21pdGg6ZG9nZ2ll
+Authorization: Basic %b64[smith:doggie]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
 GET /user/%TESTNUMBER0002 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
-Authorization: Basic c21pdGg6ZG9nZ2ll
+Authorization: Basic %b64[smith:doggie]b64%
 User-Agent: curl/%VERSION
 Accept: */*
 
diff --git a/third-party/curl/tests/data/test98 b/third-party/curl/tests/data/test98
index 5f0ae9ff75..880c532c80 100644
--- a/third-party/curl/tests/data/test98
+++ b/third-party/curl/tests/data/test98
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ HTTP PUT
 chunked Transfer-Encoding
 </keywords>
 </info>
-#
 # Server-side
 <reply>
-<data>
+<data crlf="headers">
 HTTP/1.0 200 OK
 Server: test-server/fake
 Content-Type: text/html
@@ -19,27 +19,25 @@ blaha
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP PUT from stdin with set size, disabling chunked transfer-encoding
- </name>
- <command>
- -T - -H "Transfer-Encoding:" -H "Content-Length: 14" http://%HOSTIP:%HTTPPORT/%TESTNUMBER
+</name>
+<command>
+-T - -H "Transfer-Encoding:" -H "Content-Length: 14" http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 </command>
 <stdin>
 data on stdin
 </stdin>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="headers">
 PUT /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test980 b/third-party/curl/tests/data/test980
index d3b9dec781..fd86426e79 100644
--- a/third-party/curl/tests/data/test980
+++ b/third-party/curl/tests/data/test980
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,18 +7,16 @@ STARTTLS
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
-CAPA STARTTLS
+CAPA starttls
 AUTH PLAIN
 REPLY STARTTLS 454 currently unavailable\r\n235 Authenticated\r\n250 2.1.0 Sender ok\r\n250 2.1.5 Recipient ok\r\n354 Enter mail\r\n250 2.0.0 Accepted
 REPLY AUTH 535 5.7.8 Authentication credentials invalid
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -26,25 +25,24 @@ SSL
 <server>
 smtp
 </server>
- <name>
+<name>
 SMTP STARTTLS pipelined server response
- </name>
+</name>
 <stdin>
 mail body
 </stdin>
- <command>
+<command>
 smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user:secret --ssl --sasl-ir -T -
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 8 is CURLE_WEIRD_SERVER_REPLY
 <errorcode>
 8
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
 STARTTLS
 </protocol>
diff --git a/third-party/curl/tests/data/test981 b/third-party/curl/tests/data/test981
index 9a834f69f2..a8340f3847 100644
--- a/third-party/curl/tests/data/test981
+++ b/third-party/curl/tests/data/test981
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ STARTTLS
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -16,7 +16,6 @@ REPLY LOGIN A003 BAD Authentication credentials invalid
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -25,18 +24,18 @@ SSL
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP STARTTLS pipelined server response
- </name>
- <command>
+</name>
+<command>
 imap://%HOSTIP:%IMAPPORT/%TESTNUMBER -T %LOGDIR/upload%TESTNUMBER -u user:secret --ssl
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
 Date: Mon, 7 Feb 1994 21:52:25 -0800 (PST)
-From: Fred Foobar <foobar@example.COM>
+From: Fred Foobar %LTfoobar@example.COM%GT
 Subject: afternoon meeting
 To: joe@example.com
-Message-Id: <B27397-0100000@example.COM>
+Message-Id: %LTB27397-0100000@example.COM%GT
 MIME-Version: 1.0
 Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
 
@@ -44,14 +43,13 @@ Hello Joe, do you think we can meet at 3:30 tomorrow?
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 8 is CURLE_WEIRD_SERVER_REPLY
 <errorcode>
 8
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 STARTTLS
 </protocol>
diff --git a/third-party/curl/tests/data/test982 b/third-party/curl/tests/data/test982
index d66fe0383a..c3b6a01a0f 100644
--- a/third-party/curl/tests/data/test982
+++ b/third-party/curl/tests/data/test982
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ STARTTLS
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -25,7 +25,6 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -34,22 +33,21 @@ SSL
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 STARTTLS pipelined server response
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret --ssl
- </command>
+</command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 8 is CURLE_WEIRD_SERVER_REPLY
 <errorcode>
 8
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 CAPA
 STLS
 </protocol>
diff --git a/third-party/curl/tests/data/test983 b/third-party/curl/tests/data/test983
index 76b8c1018b..9e1437fe4c 100644
--- a/third-party/curl/tests/data/test983
+++ b/third-party/curl/tests/data/test983
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ STARTTLS
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -23,9 +23,9 @@ SSL
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP STARTTLS pipelined server response
- </name>
+</name>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 data
     to
@@ -34,7 +34,7 @@ that FTPS
 works
   so does it?
 </file>
- <command>
+<command>
 --ssl --ftp-ssl-control ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T %LOGDIR/test%TESTNUMBER.txt -u user:secret -P %CLIENTIP
 </command>
 </client>
@@ -45,7 +45,7 @@ works
 <errorcode>
 8
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 AUTH SSL
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test984 b/third-party/curl/tests/data/test984
index e5eec6898e..36ef010897 100644
--- a/third-party/curl/tests/data/test984
+++ b/third-party/curl/tests/data/test984
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ STARTTLS
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -14,7 +14,6 @@ REPLY CAPABILITY A001 BAD Not implemented
 </servercmd>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -23,18 +22,18 @@ SSL
 <server>
 imap
 </server>
- <name>
+<name>
 IMAP require STARTTLS with failing capabilities
- </name>
- <command>
+</name>
+<command>
 imap://%HOSTIP:%IMAPPORT/%TESTNUMBER -T %LOGDIR/upload%TESTNUMBER -u user:secret --ssl-reqd
 </command>
 <file name="%LOGDIR/upload%TESTNUMBER">
 Date: Mon, 7 Feb 1994 21:52:25 -0800 (PST)
-From: Fred Foobar <foobar@example.COM>
+From: Fred Foobar %LTfoobar@example.COM%GT
 Subject: afternoon meeting
 To: joe@example.com
-Message-Id: <B27397-0100000@example.COM>
+Message-Id: %LTB27397-0100000@example.COM%GT
 MIME-Version: 1.0
 Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
 
@@ -42,14 +41,13 @@ Hello Joe, do you think we can meet at 3:30 tomorrow?
 </file>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 64 is CURLE_USE_SSL_FAILED
 <errorcode>
 64
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test985 b/third-party/curl/tests/data/test985
index 62f52ca1e9..d31bc53365 100644
--- a/third-party/curl/tests/data/test985
+++ b/third-party/curl/tests/data/test985
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ STARTTLS
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -23,7 +23,6 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
@@ -32,22 +31,21 @@ SSL
 <server>
 pop3
 </server>
- <name>
+<name>
 POP3 require STARTTLS with failing capabilities
- </name>
- <command>
+</name>
+<command>
 pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret --ssl-reqd
- </command>
+</command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 64 is CURLE_USE_SSL_FAILED
 <errorcode>
 64
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 CAPA
 </protocol>
 </verify>
diff --git a/third-party/curl/tests/data/test986 b/third-party/curl/tests/data/test986
index a2e1747188..a600446b33 100644
--- a/third-party/curl/tests/data/test986
+++ b/third-party/curl/tests/data/test986
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,7 +7,6 @@ STARTTLS
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 <servercmd>
@@ -23,9 +23,9 @@ SSL
 <server>
 ftp
 </server>
- <name>
+<name>
 FTP require STARTTLS while preauthenticated
- </name>
+</name>
 <file name="%LOGDIR/test%TESTNUMBER.txt">
 data
     to
@@ -34,7 +34,7 @@ that FTPS
 works
   so does it?
 </file>
- <command>
+<command>
 --ssl-reqd --ftp-ssl-control ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T %LOGDIR/test%TESTNUMBER.txt -u user:secret
 </command>
 </client>
@@ -45,7 +45,7 @@ works
 <errorcode>
 64
 </errorcode>
-<protocol>
+<protocol crlf="yes">
 AUTH SSL
 AUTH TLS
 </protocol>
diff --git a/third-party/curl/tests/data/test987 b/third-party/curl/tests/data/test987
index ac1428b8cc..2fb588d487 100644
--- a/third-party/curl/tests/data/test987
+++ b/third-party/curl/tests/data/test987
@@ -1,46 +1,45 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
 SMTPS
+UPLOAD
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 smtps
 </server>
- <name>
+<name>
 SMTPS with redundant explicit SSL request
- </name>
-<stdin>
+</name>
+<stdin crlf="yes">
 From: different
 To: another
 
 body
 </stdin>
- <command>
--k --ssl-reqd --mail-rcpt recipient@example.com --mail-from sender@example.com -T - smtps://%HOSTIP:%SMTPSPORT/%TESTNUMBER
+<command>
+--insecure --ssl-reqd --mail-rcpt recipient@example.com --mail-from sender@example.com -T - smtps://%HOSTIP:%SMTPSPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 EHLO %TESTNUMBER
-MAIL FROM:<sender@example.com>
-RCPT TO:<recipient@example.com>
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
 DATA
 QUIT
 </protocol>
-<upload>
+<upload crlf="yes">
 From: different
 To: another
 
diff --git a/third-party/curl/tests/data/test988 b/third-party/curl/tests/data/test988
index 3caf8b7be0..2085a64810 100644
--- a/third-party/curl/tests/data/test988
+++ b/third-party/curl/tests/data/test988
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ FETCH
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -20,24 +20,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 imaps
 </server>
- <name>
+<name>
 IMAPS FETCH with redundant explicit SSL request
- </name>
- <command>
--k --ssl-reqd -u '"user:sec"ret{' 'imaps://%HOSTIP:%IMAPSPORT/%TESTNUMBER/;MAILINDEX=1'
+</name>
+<command>
+--insecure --ssl-reqd -u '"user:sec"ret{' 'imaps://%HOSTIP:%IMAPSPORT/%TESTNUMBER/;MAILINDEX=1'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 A001 CAPABILITY
 A002 LOGIN "\"user" "sec\"ret{"
 A003 SELECT %TESTNUMBER
diff --git a/third-party/curl/tests/data/test989 b/third-party/curl/tests/data/test989
index 29e319861f..d3e5a62013 100644
--- a/third-party/curl/tests/data/test989
+++ b/third-party/curl/tests/data/test989
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -6,10 +7,9 @@ RETR
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data>
+<data crlf="yes">
 From: me@somewhere
 To: fake@nowhere
 
@@ -20,24 +20,22 @@ body
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
 pop3s
 </server>
- <name>
+<name>
 POP3S RETR with redundant explicit SSL request
- </name>
- <command>
--k --ssl-reqd  -u user:secret pop3s://%HOSTIP:%POP3SPORT/%TESTNUMBER
+</name>
+<command>
+--insecure --ssl-reqd  -u user:secret pop3s://%HOSTIP:%POP3SPORT/%TESTNUMBER
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol>
+<protocol crlf="yes">
 CAPA
 USER user
 PASS secret
diff --git a/third-party/curl/tests/data/test99 b/third-party/curl/tests/data/test99
index f1eb947fe4..4582eba406 100644
--- a/third-party/curl/tests/data/test99
+++ b/third-party/curl/tests/data/test99
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,10 +6,8 @@ HTTP
 HTTP GET
 Resume
 Largefile
-FAILURE
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data>
@@ -31,31 +30,29 @@ Funny-head: yesyes
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <features>
-large_file
+Largefile
 </features>
 <server>
 http
 </server>
- <name>
+<name>
 HTTP GET with large-file resume point and failed resume
- </name>
- <command>
+</name>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -C 9999999999
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
 # 33 is CURLE_RANGE_ERROR
 <errorcode>
 33
 </errorcode>
-<protocol>
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Range: bytes=9999999999-
diff --git a/third-party/curl/tests/data/test990 b/third-party/curl/tests/data/test990
index 1b22d1aa92..6e3408bf89 100644
--- a/third-party/curl/tests/data/test990
+++ b/third-party/curl/tests/data/test990
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes">
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -26,7 +26,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -35,15 +34,14 @@ http
 <name>
 use -w %output{}
 </name>
- <command>
+<command>
 http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w '%output{%LOGDIR/output}%{http_code}\n'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol crlf="yes">
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test991 b/third-party/curl/tests/data/test991
index 5a2cc62f30..d8eaaf7d10 100644
--- a/third-party/curl/tests/data/test991
+++ b/third-party/curl/tests/data/test991
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -7,10 +8,9 @@ HTTP GET
 </keywords>
 </info>
 
-#
 # Server-side
 <reply>
-<data crlf="yes">
+<data crlf="headers">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -26,7 +26,6 @@ Funny-head: yesyes
 </data>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -43,10 +42,9 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER -w '%output{>>%LOGDIR/output}%{http_code}'
 </command>
 </client>
 
-#
 # Verify data after the test has been "shot"
 <verify>
-<protocol crlf="yes">
+<protocol crlf="headers">
 GET /%TESTNUMBER HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
diff --git a/third-party/curl/tests/data/test992 b/third-party/curl/tests/data/test992
new file mode 100644
index 0000000000..c61b8e31d4
--- /dev/null
+++ b/third-party/curl/tests/data/test992
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+SMTP
+SASL
+UPLOAD
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<servercmd>
+AUTH OAUTHBEARER XOAUTH2
+REPLY AUTH 334 XOAUTH2 supported
+REPLY %b64[user=user%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64% 235 Authenticated
+</servercmd>
+</reply>
+
+# Client-side
+<client>
+<server>
+smtp
+</server>
+<name>
+SASL verify default mechanisms are reset by login options
+</name>
+<stdin crlf="yes">
+mail body
+</stdin>
+<command>
+smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com --mail-from sender@example.com -u user --oauth2-bearer mF_9.B5f-4.1JqM --login-options "AUTH=XOAUTH2" -T -
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+EHLO %TESTNUMBER
+AUTH XOAUTH2
+%b64[user=user%01auth=Bearer mF_9.B5f-4.1JqM%01%01]b64%
+MAIL FROM:%LTsender@example.com%GT
+RCPT TO:%LTrecipient@example.com%GT
+DATA
+QUIT
+</protocol>
+<upload crlf="yes">
+mail body
+.
+</upload>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test993 b/third-party/curl/tests/data/test993
new file mode 100644
index 0000000000..019cb31ec1
--- /dev/null
+++ b/third-party/curl/tests/data/test993
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+POP3
+Clear Text
+LIST
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+%repeat[1000 x 95 328485%0d%0a]%</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+pop3
+</server>
+<name>
+POP3 LIST 1000 messages
+</name>
+<command>
+pop3://%HOSTIP:%POP3PORT/ -u user:secret
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+CAPA
+USER user
+PASS secret
+LIST
+QUIT
+</protocol>
+<limits>
+Allocations: 2200
+</limits>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test994 b/third-party/curl/tests/data/test994
new file mode 100644
index 0000000000..436ce1af12
--- /dev/null
+++ b/third-party/curl/tests/data/test994
@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+--skip-existing with globbing
+</name>
+<command option="no-output">
+-o "%LOGDIR/#1" "http://%HOSTIP:%HTTPPORT/%TESTNUMBER/{hey,ho}" --skip-existing
+</command>
+<file name="%LOGDIR/hey">
+content
+</file>
+<file2 name="%LOGDIR/ho">
+content
+</file2>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<stderr mode="text">
+Note: skips transfer, "%LOGDIR/hey" exists locally
+Note: skips transfer, "%LOGDIR/ho" exists locally
+</stderr>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test995 b/third-party/curl/tests/data/test995
new file mode 100644
index 0000000000..6f49a0f0ea
--- /dev/null
+++ b/third-party/curl/tests/data/test995
@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+--skip-existing without file present
+</name>
+<command option="no-output,no-include">
+-o %LOGDIR/there http://%HOSTIP:%HTTPPORT/%TESTNUMBER --skip-existing
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/there">
+-foo-
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test996 b/third-party/curl/tests/data/test996
new file mode 100644
index 0000000000..8572b0d969
--- /dev/null
+++ b/third-party/curl/tests/data/test996
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+--skip-existing with file present
+</name>
+<command option="no-output">
+-o %LOGDIR/there http://%HOSTIP:%HTTPPORT/%TESTNUMBER --skip-existing
+</command>
+<file name="%LOGDIR/there">
+content
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<stderr mode="text">
+Note: skips transfer, "%LOGDIR/there" exists locally
+</stderr>
+<file name="%LOGDIR/there">
+content
+</file>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test997 b/third-party/curl/tests/data/test997
new file mode 100644
index 0000000000..a14456d38b
--- /dev/null
+++ b/third-party/curl/tests/data/test997
@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+POP3
+Clear Text
+STAT
+CUSTOMREQUEST
+RFC2449
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<servercmd>
+CAPA TOP USER
+</servercmd>
+<data>
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+pop3
+</server>
+<name>
+POP3 retrieve STAT (CUSTOMREQUEST)
+</name>
+<command>
+pop3://%HOSTIP:%POP3PORT -u user:secret -X 'STAT'
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="yes">
+CAPA
+USER user
+PASS secret
+STAT
+QUIT
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test998 b/third-party/curl/tests/data/test998
new file mode 100644
index 0000000000..56dbc0c891
--- /dev/null
+++ b/third-party/curl/tests/data/test998
@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--location-trusted
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data>
+HTTP/1.1 301 redirect
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 0
+Connection: close
+Content-Type: text/html
+Location: http://somewhere.else.example/a/path/%TESTNUMBER0002
+
+</data>
+<data2>
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 6
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data2>
+
+<datacheck>
+HTTP/1.1 301 redirect
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 0
+Connection: close
+Content-Type: text/html
+Location: http://somewhere.else.example/a/path/%TESTNUMBER0002
+
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 6
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</datacheck>
+
+</reply>
+
+# Client-side
+<client>
+<features>
+proxy
+</features>
+<server>
+http
+</server>
+<name>
+HTTP with auth in URL redirected to another host
+</name>
+<command>
+-x %HOSTIP:%HTTPPORT http://alberto:einstein@somewhere.example/%TESTNUMBER --location-trusted
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://somewhere.example/998 HTTP/1.1
+Host: somewhere.example
+Authorization: Basic %b64[alberto:einstein]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://somewhere.else.example/a/path/9980002 HTTP/1.1
+Host: somewhere.else.example
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/data/test999 b/third-party/curl/tests/data/test999
new file mode 100644
index 0000000000..1bfb704e71
--- /dev/null
+++ b/third-party/curl/tests/data/test999
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+--location-trusted
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 6
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</data>
+
+<datacheck>
+HTTP/1.1 301 redirect
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 0
+Connection: close
+Content-Type: text/html
+Location: http://somewhere.else.example/a/path/%TESTNUMBER0002
+
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Content-Length: 6
+Content-Type: text/html
+Funny-head: yesyes
+
+-foo-
+</datacheck>
+
+</reply>
+
+# Client-side
+<client>
+<features>
+proxy
+</features>
+<server>
+http
+</server>
+<name>
+HTTP with auth in first URL but not second
+</name>
+<command>
+-x %HOSTIP:%HTTPPORT http://alberto:einstein@somewhere.example/%TESTNUMBER http://somewhere.else.example/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://somewhere.example/%TESTNUMBER HTTP/1.1
+Host: somewhere.example
+Authorization: Basic %b64[alberto:einstein]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://somewhere.else.example/%TESTNUMBER HTTP/1.1
+Host: somewhere.else.example
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
diff --git a/third-party/curl/tests/devtest.pl b/third-party/curl/tests/devtest.pl
index 99a25ab66e..b71689c857 100644
--- a/third-party/curl/tests/devtest.pl
+++ b/third-party/curl/tests/devtest.pl
@@ -24,13 +24,13 @@
 ###########################################################################
 
 # This script is intended for developers to test some internals of the
-# runtests.pl harness. Don't try to use this unless you know what you're
+# runtests.pl harness. Do not try to use this unless you know what you are
 # doing!
 
 # An example command-line that starts a test http server for test 11 and waits
 # for the user before stopping it:
 #   ./devtest.pl --verbose serverfortest https echo "Started https" protoport https preprocess 11 pause echo Stopping stopservers echo Done
-# curl can connect to the server while it's running like this:
+# curl can connect to the server while it is running like this:
 #   curl -vkL https://localhost:<protoport>/11
 
 use strict;
@@ -54,32 +54,31 @@ use servers qw(
     protoport
     serverfortest
     stopservers
-);
+    );
 use runner qw(
     readtestkeywords
     singletest_preprocess
-);
+    );
 use testutil qw(
     setlogfunc
-);
+    );
 use getpart;
 
-
 #######################################################################
 # logmsg is our general message logging subroutine.
 # This function is currently required to be here by servers.pm
 # This is copied from runtests.pl
 #
-my $uname_release = `uname -r`;
+my $uname_release = qx(uname -r);
 my $is_wsl = $uname_release =~ /Microsoft$/;
 sub logmsg {
     for(@_) {
         my $line = $_;
-        if ($is_wsl) {
+        if($is_wsl) {
             # use \r\n for WSL shell
             $line =~ s/\r?\n$/\r\n/g;
         }
-        print "$line";
+        print $line;
     }
 }
 
@@ -94,8 +93,8 @@ sub parseprotocols {
 
     # Generate a "proto-ipv6" version of each protocol to match the
     # IPv6 <server> name and a "proto-unix" to match the variant which
-    # uses Unix domain sockets. This works even if support isn't
-    # compiled in because the <features> test will fail.
+    # uses Unix domain sockets. This works even if support is not
+    # compiled in because the <features> test fails.
     push @protocols, map(("$_-ipv6", "$_-unix"), @protocols);
 
     # 'http-proxy' is used in test cases to do CONNECT through
@@ -105,19 +104,17 @@ sub parseprotocols {
     push @protocols, 'none';
 }
 
-
 #######################################################################
 # Initialize @protocols from the curl binary under test
 #
 sub init_protocols {
-    for (`$CURL -V 2>/dev/null`) {
+    for (qx($CURL -V 2>$dev_null)) {
         if(m/^Protocols: (.*)$/) {
             parseprotocols($1);
         }
     }
 }
 
-
 #######################################################################
 # Initialize the test harness to run tests
 #
@@ -176,7 +173,7 @@ while(@ARGV) {
     }
     elsif($ARGV[0] eq "preprocess") {
         shift @ARGV;
-        loadtest("${TESTDIR}/test${ARGV[0]}");
+        loadtest("${TESTDIR}/test${ARGV[0]}", 1);
         readtestkeywords();
         singletest_preprocess($ARGV[0]);
     }
diff --git a/third-party/curl/tests/dictserver.py b/third-party/curl/tests/dictserver.py
index 0a08522f42..b4e1afd78b 100644
--- a/third-party/curl/tests/dictserver.py
+++ b/third-party/curl/tests/dictserver.py
@@ -24,10 +24,9 @@
 #
 ###########################################################################
 #
-""" DICT server """
+"""DICT server."""
 
-from __future__ import (absolute_import, division, print_function,
-                        unicode_literals)
+from __future__ import absolute_import, division, print_function, unicode_literals
 
 import argparse
 import logging
@@ -37,10 +36,11 @@ import sys
 from util import ClosingFileHandler
 
 try:  # Python 2
-    import SocketServer as socketserver
+    import SocketServer as socketserver  # type: ignore
 except ImportError:  # Python 3
     import socketserver
 
+
 log = logging.getLogger(__name__)
 HOST = "localhost"
 
@@ -50,15 +50,12 @@ VERIFIED_RSP = "WE ROOLZ: {pid}"
 
 
 def dictserver(options):
-    """
-    Starts up a TCP server with a DICT handler and serves DICT requests
-    forever.
-    """
+    """Start up a TCP server with a DICT handler and serve DICT requests forever."""
     if options.pidfile:
         pid = os.getpid()
         # see tests/server/util.c function write_pidfile
         if os.name == "nt":
-            pid += 65536
+            pid += 4194304
         with open(options.pidfile, "w") as f:
             f.write(str(pid))
 
@@ -74,13 +71,10 @@ def dictserver(options):
 
 
 class DictHandler(socketserver.BaseRequestHandler):
-    """Handler class for DICT connections.
+    """Handler class for DICT connections."""
 
-    """
     def handle(self):
-        """
-        Simple function which responds to all queries with a 552.
-        """
+        """Respond to all queries with a 552."""
         try:
             # First, send a response to allow the server to continue.
             rsp = "220 dictserver <xnooptions> <msgid@msgid>\n"
@@ -96,7 +90,7 @@ class DictHandler(socketserver.BaseRequestHandler):
                 pid = os.getpid()
                 # see tests/server/util.c function write_pidfile
                 if os.name == "nt":
-                    pid += 65536
+                    pid += 4194304
                 response_data = VERIFIED_RSP.format(pid=pid)
             else:
                 log.debug("[DICT] Received normal request")
@@ -121,9 +115,9 @@ def get_options():
     parser.add_argument("--verbose", action="store", type=int, default=0,
                         help="verbose output")
     parser.add_argument("--pidfile", action="store",
-                        help="file name for the PID")
+                        help="filename for the PID")
     parser.add_argument("--logfile", action="store",
-                        help="file name for the log")
+                        help="filename for the log")
     parser.add_argument("--srcdir", action="store", help="test directory")
     parser.add_argument("--id", action="store", help="server ID")
     parser.add_argument("--ipv4", action="store_true", default=0,
@@ -133,9 +127,7 @@ def get_options():
 
 
 def setup_logging(options):
-    """
-    Set up logging from the command line options
-    """
+    """Set up logging from the command line options."""
     root_logger = logging.getLogger()
     add_stdout = False
 
@@ -148,7 +140,7 @@ def setup_logging(options):
         handler.setLevel(logging.DEBUG)
         root_logger.addHandler(handler)
     else:
-        # The logfile wasn't specified. Add a stdout logger.
+        # The logfile was not specified. Add a stdout logger.
         add_stdout = True
 
     if options.verbose:
@@ -165,17 +157,14 @@ def setup_logging(options):
         root_logger.addHandler(stdout_handler)
 
 
-class ScriptRC(object):
-    """Enum for script return codes"""
+class ScriptRC:
+    """Enum for script return codes."""
+
     SUCCESS = 0
     FAILURE = 1
     EXCEPTION = 2
 
 
-class ScriptException(Exception):
-    pass
-
-
 if __name__ == '__main__':
     # Get the options from the user.
     options = get_options()
@@ -186,8 +175,8 @@ if __name__ == '__main__':
     # Run main script.
     try:
         rc = dictserver(options)
-    except Exception as e:
-        log.exception(e)
+    except Exception:
+        log.exception('Error running server')
         rc = ScriptRC.EXCEPTION
 
     if options.pidfile and os.path.isfile(options.pidfile):
diff --git a/third-party/curl/tests/directories.pm b/third-party/curl/tests/directories.pm
index 238f7e03eb..cbb5921cd3 100644
--- a/third-party/curl/tests/directories.pm
+++ b/third-party/curl/tests/directories.pm
@@ -37,271 +37,269 @@ BEGIN {
     );
 }
 
-
 my %file_chmod1 = (
-  'name'      => 'chmod1',
-  'content'   => "This file should have permissions 444\n",
-  'perm'      => 'r--r--r--',
-  'time'      => 'Jan 11 10:00',
-  'dostime'   => '01-11-10  10:00AM',
+    'name'      => 'chmod1',
+    'content'   => "This file should have permissions 444\n",
+    'perm'      => 'r--r--r--',
+    'time'      => 'Jan 11 10:00',
+    'dostime'   => '01-11-10  10:00AM',
 );
 
 my %file_chmod2 = (
-  'name'      => 'chmod2',
-  'content'   => "This file should have permissions 666\n",
-  'perm'      => 'rw-rw-rw-',
-  'time'      => 'Feb  1  8:00',
-  'dostime'   => '02-01-10  08:00AM',
+    'name'      => 'chmod2',
+    'content'   => "This file should have permissions 666\n",
+    'perm'      => 'rw-rw-rw-',
+    'time'      => 'Feb  1  8:00',
+    'dostime'   => '02-01-10  08:00AM',
 );
 
 my %file_chmod3 = (
-  'name'      => 'chmod3',
-  'content'   => "This file should have permissions 777\n",
-  'perm'      => 'rwxrwxrwx',
-  'time'      => 'Feb  1  8:00',
-  'dostime'   => '02-01-10  08:00AM',
+    'name'      => 'chmod3',
+    'content'   => "This file should have permissions 777\n",
+    'perm'      => 'rwxrwxrwx',
+    'time'      => 'Feb  1  8:00',
+    'dostime'   => '02-01-10  08:00AM',
 );
 
 my %file_chmod4 = (
-  'type'      => 'd',
-  'name'      => 'chmod4',
-  'content'   => "This file should have permissions 001\n",
-  'perm'      => '--S--S--t',
-  'time'      => 'May  4  4:31',
-  'dostime'   => '05-04-10  04:31AM'
+    'type'      => 'd',
+    'name'      => 'chmod4',
+    'content'   => "This file should have permissions 001\n",
+    'perm'      => '--S--S--t',
+    'time'      => 'May  4  4:31',
+    'dostime'   => '05-04-10  04:31AM'
 );
 
 my %file_chmod5 = (
-  'type'      => 'd',
-  'name'      => 'chmod5',
-  'content'   => "This file should have permissions 110\n",
-  'perm'      => '--s--s--T',
-  'time'      => 'May  4  4:31',
-  'dostime'   => '05-04-10  04:31AM'
+    'type'      => 'd',
+    'name'      => 'chmod5',
+    'content'   => "This file should have permissions 110\n",
+    'perm'      => '--s--s--T',
+    'time'      => 'May  4  4:31',
+    'dostime'   => '05-04-10  04:31AM'
 );
 
 my %link_link = (
-  'type'      => 'l',
-  'name'      => 'link -> file.txt',
-  'size'      => '8',
-  'perm'      => 'rwxrwxrwx',
-  'time'      => 'Jan  6  4:42'
+    'type'      => 'l',
+    'name'      => 'link -> file.txt',
+    'size'      => '8',
+    'perm'      => 'rwxrwxrwx',
+    'time'      => 'Jan  6  4:42'
 );
 
 my %link_link_absolute = (
-  'type'      => 'l',
-  'name'      => 'link_absolute -> /data/ftp/file.txt',
-  'size'      => '15',
-  'perm'      => 'rwxrwxrwx',
-  'time'      => 'Jan  6  4:45'
+    'type'      => 'l',
+    'name'      => 'link_absolute -> /data/ftp/file.txt',
+    'size'      => '15',
+    'perm'      => 'rwxrwxrwx',
+    'time'      => 'Jan  6  4:45'
 );
 
 my %dir_dot = (
-  'type'      => "d",
-  'name'      => ".",
-  'hlink'     => "4",
-  'time'      => "Apr 27  5:12",
-  'size'      => "20480",
-  'dostime'   => "04-27-10  05:12AM",
-  'perm'      => "rwxrwxrwx"
+    'type'      => "d",
+    'name'      => ".",
+    'hlink'     => "4",
+    'time'      => "Apr 27  5:12",
+    'size'      => "20480",
+    'dostime'   => "04-27-10  05:12AM",
+    'perm'      => "rwxrwxrwx"
 );
 
 my %dir_ddot = (
-  'type'      => "d",
-  'name'      => "..",
-  'hlink'     => "4",
-  'size'      => "20480",
-  'time'      => "Apr 23  3:12",
-  'dostime'   => "04-23-10  03:12AM",
-  'perm'      => "rwxrwxrwx"
+    'type'      => "d",
+    'name'      => "..",
+    'hlink'     => "4",
+    'size'      => "20480",
+    'time'      => "Apr 23  3:12",
+    'dostime'   => "04-23-10  03:12AM",
+    'perm'      => "rwxrwxrwx"
 );
 
 my %dir_weirddir_txt = (
-  'type'      => "d",
-  'name'      => "weirddir.txt",
-  'hlink'     => "2",
-  'size'      => "4096",
-  'time'      => "Apr 23  3:12",
-  'dostime'   => "04-23-10  03:12AM",
-  'perm'      => "rwxr-xrwx"
+    'type'      => "d",
+    'name'      => "weirddir.txt",
+    'hlink'     => "2",
+    'size'      => "4096",
+    'time'      => "Apr 23  3:12",
+    'dostime'   => "04-23-10  03:12AM",
+    'perm'      => "rwxr-xrwx"
 );
 
 my %dir_UNIX = (
-  'type'      => "d",
-  'name'      => "UNIX",
-  'hlink'     => "11",
-  'size'      => "4096",
-  'time'      => "Nov 01  2008",
-  'dostime'   => "11-01-08  11:11AM",
-  'perm'      => "rwx--x--x"
+    'type'      => "d",
+    'name'      => "UNIX",
+    'hlink'     => "11",
+    'size'      => "4096",
+    'time'      => "Nov 01  2008",
+    'dostime'   => "11-01-08  11:11AM",
+    'perm'      => "rwx--x--x"
 );
 
 my %dir_DOS = (
-  'type'      => "d",
-  'name'      => "DOS",
-  'hlink'     => "11",
-  'size'      => "4096",
-  'time'      => "Nov 01  2008",
-  'dostime'   => "11-01-08  11:11AM",
-  'perm'      => "rwx--x--x"
+    'type'      => "d",
+    'name'      => "DOS",
+    'hlink'     => "11",
+    'size'      => "4096",
+    'time'      => "Nov 01  2008",
+    'dostime'   => "11-01-08  11:11AM",
+    'perm'      => "rwx--x--x"
 );
 
 my %dir_dot_NeXT = (
-  'type'      => "d",
-  'name'      => ".NeXT",
-  'hlink'     => "4",
-  'size'      => "4096",
-  'time'      => "Jan 23  2:05",
-  'dostime'   => "01-23-05  02:05AM",
-  'perm'      => "rwxrwxrwx"
+    'type'      => "d",
+    'name'      => ".NeXT",
+    'hlink'     => "4",
+    'size'      => "4096",
+    'time'      => "Jan 23  2:05",
+    'dostime'   => "01-23-05  02:05AM",
+    'perm'      => "rwxrwxrwx"
 );
 
 my %file_empty_file_dat = (
-  'name'      => "empty_file.dat",
-  'content'   => "",
-  'perm'      => "rw-r--r--",
-  'time'      => "Apr 27 11:01",
-  'dostime'   => "04-27-10  11:01AM"
+    'name'      => "empty_file.dat",
+    'content'   => "",
+    'perm'      => "rw-r--r--",
+    'time'      => "Apr 27 11:01",
+    'dostime'   => "04-27-10  11:01AM"
 );
 
 my %file_file_txt = (
-  'name'      => "file.txt",
-  'content'   => "This is content of file \"file.txt\"\n",
-  'time'      => "Apr 27 11:01",
-  'dostime'   => "04-27-10  11:01AM",
-  'perm'      => "rw-r--r--"
+    'name'      => "file.txt",
+    'content'   => "This is content of file \"file.txt\"\n",
+    'time'      => "Apr 27 11:01",
+    'dostime'   => "04-27-10  11:01AM",
+    'perm'      => "rw-r--r--"
 );
 
 my %file_someothertext_txt = (
-  'name'      => "someothertext.txt",
-  'content'   => "Some junk ;-) This file does not really exist.\n",
-  'time'      => "Apr 27 11:01",
-  'dostime'   => "04-27-10  11:01AM",
-  'perm'      => "rw-r--r--"
+    'name'      => "someothertext.txt",
+    'content'   => "Some junk ;-) This file does not really exist.\n",
+    'time'      => "Apr 27 11:01",
+    'dostime'   => "04-27-10  11:01AM",
+    'perm'      => "rw-r--r--"
 );
 
 my %lists = (
-  '/fully_simulated/' => {
-    'files'   => [ \%dir_dot, \%dir_ddot, \%dir_DOS, \%dir_UNIX ],
-    'eol'     => "\r\n",
-    'type'    => "unix"
-  },
-  '/fully_simulated/UNIX/' => {
-    'files'   => [ \%dir_dot, \%dir_ddot,
-                   \%file_chmod1, \%file_chmod2, \%file_chmod3, \%file_chmod4, \%file_chmod5,
-                   \%file_empty_file_dat, \%file_file_txt,
-                   \%link_link, \%link_link_absolute, \%dir_dot_NeXT,
-                   \%file_someothertext_txt, \%dir_weirddir_txt ],
-    'eol'     => "\r\n",
-    'type'    => 'unix'
-  },
-  '/fully_simulated/DOS/' => {
-    'files'   => [ \%dir_dot, \%dir_ddot,
-                   \%file_chmod1, \%file_chmod2, \%file_chmod3, \%file_chmod4, \%file_chmod5,
-                   \%file_empty_file_dat, \%file_file_txt,
-                   \%dir_dot_NeXT, \%file_someothertext_txt, \%dir_weirddir_txt ],
-    'eol'     => "\r\n",
-    'type'    => 'dos'
-  }
+    '/fully_simulated/' => {
+        'files'   => [ \%dir_dot, \%dir_ddot, \%dir_DOS, \%dir_UNIX ],
+        'eol'     => "\r\n",
+        'type'    => "unix"
+    },
+    '/fully_simulated/UNIX/' => {
+        'files'   => [ \%dir_dot, \%dir_ddot,
+                       \%file_chmod1, \%file_chmod2, \%file_chmod3, \%file_chmod4, \%file_chmod5,
+                       \%file_empty_file_dat, \%file_file_txt,
+                       \%link_link, \%link_link_absolute, \%dir_dot_NeXT,
+                       \%file_someothertext_txt, \%dir_weirddir_txt ],
+        'eol'     => "\r\n",
+        'type'    => 'unix'
+    },
+    '/fully_simulated/DOS/' => {
+        'files'   => [ \%dir_dot, \%dir_ddot,
+                       \%file_chmod1, \%file_chmod2, \%file_chmod3, \%file_chmod4, \%file_chmod5,
+                       \%file_empty_file_dat, \%file_file_txt,
+                       \%dir_dot_NeXT, \%file_someothertext_txt, \%dir_weirddir_txt ],
+        'eol'     => "\r\n",
+        'type'    => 'dos'
+    }
 );
 
 sub ftp_createcontent {
-  my ($list) = $_[0];
+    my ($list) = $_[0];
 
-  my $type = $$list{'type'};
-  my $eol  = $$list{'eol'};
-  my $list_ref = $$list{'files'};
+    my $type = $$list{'type'};
+    my $eol  = $$list{'eol'};
+    my $list_ref = $$list{'files'};
 
-  my @diroutput;
-  my @contentlist;
-  if($type eq "unix") {
-    for(@$list_ref) {
-      my %file = %$_;
-      my $line = "";
-      my $ftype  = $file{'type'}  ? $file{'type'}  : "-";
-      my $fperm  = $file{'perm'}  ? $file{'perm'}  : "rwxr-xr-x";
-      my $fuser  = $file{'user'}  ? sprintf("%15s", $file{'user'})   : "ftp-default";
-      my $fgroup = $file{'group'} ? sprintf("%15s", $file{'group'})  : "ftp-default";
-      my $fsize = "";
-      if(exists($file{'type'}) && $file{'type'} eq "d") {
-        $fsize = $file{'size'} ? sprintf("%7s", $file{'size'}) : sprintf("%7d", 4096);
-      }
-      else {
-        $fsize = sprintf("%7d", exists($file{'content'}) ? length $file{'content'} : 0);
-      }
-      my $fhlink = $file{'hlink'} ? sprintf("%4d",  $file{'hlink'})  : "   1";
-      my $ftime  = $file{'time'}  ? sprintf("%10s", $file{'time'})   : "Jan 9  1933";
-      push(@contentlist, "$ftype$fperm $fhlink $fuser $fgroup $fsize $ftime $file{'name'}$eol");
+    my @contentlist;
+    if($type eq "unix") {
+        for(@$list_ref) {
+            my %file = %$_;
+            my $line = "";
+            my $ftype  = $file{'type'}  ? $file{'type'}  : "-";
+            my $fperm  = $file{'perm'}  ? $file{'perm'}  : "rwxr-xr-x";
+            my $fuser  = $file{'user'}  ? sprintf("%15s", $file{'user'})   : "ftp-default";
+            my $fgroup = $file{'group'} ? sprintf("%15s", $file{'group'})  : "ftp-default";
+            my $fsize = "";
+            if(exists($file{'type'}) && $file{'type'} eq "d") {
+                $fsize = $file{'size'} ? sprintf("%7s", $file{'size'}) : sprintf("%7d", 4096);
+            }
+            else {
+                $fsize = sprintf("%7d", exists($file{'content'}) ? length $file{'content'} : 0);
+            }
+            my $fhlink = $file{'hlink'} ? sprintf("%4d",  $file{'hlink'})  : "   1";
+            my $ftime  = $file{'time'}  ? sprintf("%10s", $file{'time'})   : "Jan 9  1933";
+            push(@contentlist, "$ftype$fperm $fhlink $fuser $fgroup $fsize $ftime $file{'name'}$eol");
+        }
+
+        return @contentlist;
     }
-
-    return @contentlist;
-  }
-  elsif($type =~ /^dos$/) {
-    for(@$list_ref) {
-      my %file = %$_;
-      my $line = "";
-      my $time = $file{'dostime'} ? $file{'dostime'} : "06-25-97  09:12AM";
-      my $size_or_dir;
-      if(exists($file{'type'}) && $file{'type'} =~ /^d$/) {
-        $size_or_dir = "      <DIR>         ";
-      }
-      else {
-        $size_or_dir = sprintf("%20d", length $file{'content'});
-      }
-      push(@contentlist, "$time $size_or_dir $file{'name'}$eol");
+    elsif($type =~ /^dos$/) {
+        for(@$list_ref) {
+            my %file = %$_;
+            my $line = "";
+            my $time = $file{'dostime'} ? $file{'dostime'} : "06-25-97  09:12AM";
+            my $size_or_dir;
+            if(exists($file{'type'}) && $file{'type'} =~ /^d$/) {
+                $size_or_dir = "      <DIR>         ";
+            }
+            else {
+                $size_or_dir = sprintf("%20d", length $file{'content'});
+            }
+            push(@contentlist, "$time $size_or_dir $file{'name'}$eol");
+        }
+        return @contentlist;
     }
-    return @contentlist;
-  }
 }
 
 sub wildcard_filesize {
-  my ($list_type, $file) = @_;
-  my $list = $lists{$list_type};
-  if($list) {
-    my $files = $list->{'files'};
-    for(@$files) {
-      my %f = %$_;
-      if ($f{'name'} eq $file) {
-        if($f{'content'}) {
-          return length $f{'content'};
+    my ($list_type, $file) = @_;
+    my $list = $lists{$list_type};
+    if($list) {
+        my $files = $list->{'files'};
+        for(@$files) {
+            my %f = %$_;
+            if($f{'name'} eq $file) {
+                if($f{'content'}) {
+                    return length $f{'content'};
+                }
+                elsif($f{'type'} ne "d"){
+                    return 0;
+                }
+                else {
+                    return -1;
+                }
+            }
         }
-        elsif ($f{'type'} ne "d"){
-          return 0;
-        }
-        else {
-          return -1;
-        }
-      }
     }
-  }
-  return -1;
+    return -1;
 }
 
 sub wildcard_getfile {
-  my ($list_type, $file) = @_;
-  my $list = $lists{$list_type};
-  if($list) {
-    my $files = $list->{'files'};
-    for(@$files) {
-      my %f = %$_;
-      if ($f{'name'} eq $file) {
-        if($f{'content'}) {
-          return (length $f{'content'}, $f{'content'});
+    my ($list_type, $file) = @_;
+    my $list = $lists{$list_type};
+    if($list) {
+        my $files = $list->{'files'};
+        for(@$files) {
+            my %f = %$_;
+            if($f{'name'} eq $file) {
+                if($f{'content'}) {
+                    return (length $f{'content'}, $f{'content'});
+                }
+                elsif(!exists($f{'type'}) or $f{'type'} ne "d"){
+                    return (0, "");
+                }
+                else {
+                    return (-1, 0);
+                }
+            }
         }
-        elsif (!exists($f{'type'}) or $f{'type'} ne "d"){
-          return (0, "");
-        }
-        else {
-          return (-1, 0);
-        }
-      }
     }
-  }
-  return (-1, 0);
+    return (-1, 0);
 }
 
 sub ftp_contentlist {
-  my $listname = $_[0];
-  my $list = $lists{$listname};
-  return ftp_createcontent($list);
+    my $listname = $_[0];
+    my $list = $lists{$listname};
+    return ftp_createcontent($list);
 }
diff --git a/third-party/curl/tests/disable-scan.pl b/third-party/curl/tests/disable-scan.pl
deleted file mode 100644
index 99f5436af5..0000000000
--- a/third-party/curl/tests/disable-scan.pl
+++ /dev/null
@@ -1,148 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-#
-
-use strict;
-use warnings;
-
-# the DISABLE options that can be set by configure
-my %disable;
-# the DISABLE options that are used in C files
-my %file;
-# the DISABLE options that are documented
-my %docs;
-
-# we may get the dir root pointed out
-my $root=$ARGV[0] || ".";
-my $DOCS="CURL-DISABLE.md";
-
-sub scanconf {
-    my ($f)=@_;
-    open S, "<$f";
-    while(<S>) {
-        if(/(CURL_DISABLE_[A-Z_]+)/g) {
-            my ($sym)=($1);
-            $disable{$sym} = 1;
-        }
-    }
-    close S;
-}
-
-sub scan_configure {
-    opendir(my $m, "$root/m4") || die "Can't opendir $root/m4: $!";
-    my @m4 = grep { /\.m4$/ } readdir($m);
-    closedir $m;
-    scanconf("$root/configure.ac");
-    # scan all m4 files too
-    for my $e (@m4) {
-        scanconf("$root/m4/$e");
-    }
-}
-
-sub scan_file {
-    my ($source)=@_;
-    open F, "<$source";
-    while(<F>) {
-        while(s/(CURL_DISABLE_[A-Z_]+)//) {
-            my ($sym)=($1);
-            $file{$sym} = $source;
-        }
-    }
-    close F;
-}
-
-sub scan_dir {
-    my ($dir)=@_;
-    opendir(my $dh, $dir) || die "Can't opendir $dir: $!";
-    my @cfiles = grep { /\.[ch]\z/ && -f "$dir/$_" } readdir($dh);
-    closedir $dh;
-    for my $f (sort @cfiles) {
-        scan_file("$dir/$f");
-    }
-}
-
-sub scan_sources {
-    scan_dir("$root/src");
-    scan_dir("$root/lib");
-    scan_dir("$root/lib/vtls");
-    scan_dir("$root/lib/vauth");
-}
-
-sub scan_docs {
-    open F, "<$root/docs/$DOCS";
-    my $line = 0;
-    while(<F>) {
-        $line++;
-        if(/^## `(CURL_DISABLE_[A-Z_]+)/g) {
-            my ($sym)=($1);
-            $docs{$sym} = $line;
-        }
-    }
-    close F;
-}
-
-scan_configure();
-scan_sources();
-scan_docs();
-
-
-my $error = 0;
-# Check the configure symbols for use in code
-for my $s (sort keys %disable) {
-    if(!$file{$s}) {
-        printf "Present in configure.ac, not used by code: %s\n", $s;
-        $error++;
-    }
-    if(!$docs{$s}) {
-        printf "Present in configure.ac, not documented in $DOCS: %s\n", $s;
-        $error++;
-    }
-}
-
-# Check the code symbols for use in configure
-for my $s (sort keys %file) {
-    if(!$disable{$s}) {
-        printf "Not set by configure: %s (%s)\n", $s, $file{$s};
-        $error++;
-    }
-    if(!$docs{$s}) {
-        printf "Used in code, not documented in $DOCS: %s\n", $s;
-        $error++;
-    }
-}
-
-# Check the documented symbols
-for my $s (sort keys %docs) {
-    if(!$disable{$s}) {
-        printf "Documented but not in configure: %s\n", $s;
-        $error++;
-    }
-    if(!$file{$s}) {
-        printf "Documented, but not used by code: %s\n", $s;
-        $error++;
-    }
-}
-
-exit $error;
diff --git a/third-party/curl/tests/ech_combos.py b/third-party/curl/tests/ech_combos.py
new file mode 100644
index 0000000000..8b15eff41f
--- /dev/null
+++ b/third-party/curl/tests/ech_combos.py
@@ -0,0 +1,98 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+# Python3 program to print all combination of size r in an array of size n.
+# This is used to generate test lines in tests/ech_test.sh.
+# This is discarded in the process of moving from experimental,
+# but is worth preserving for the moment in case of changes to the
+# ECH command line args
+
+def CombinationRepetitionUtil(chosen, arr, badarr, index,
+                              r, start, end):
+
+    # Current combination is ready,
+    # print it
+    if index == r:
+        # figure out if result should be good or bad and
+        # print prefix, assuming $turl does support ECH so
+        # should work if given "positive" parameters
+        res = 1
+        j = len(chosen) - 1
+        while res and j >= 0:
+            if chosen[j] in badarr:
+                res = 0
+            j = j - 1
+        print("cli_test $turl 1", res, end = " ")
+        # print combination but eliminating any runs of
+        # two identical params
+        for j in range(r):
+            if j != 0 and chosen[j] != chosen[j-1]:
+                print(chosen[j], end = " ")
+
+        print()
+        return
+
+    # When no more elements are
+    # there to put in chosen[]
+    if start > n:
+        return
+
+    # Current is included, put
+    # next at next location
+    chosen[index] = arr[start]
+
+    # Current is excluded, replace it
+    # with next (Note that i + 1 is passed,
+    # but index is not changed)
+    CombinationRepetitionUtil(chosen, arr, badarr, index + 1,
+                              r, start, end)
+    CombinationRepetitionUtil(chosen, arr, badarr, index,
+                              r, start + 1, end)
+
+
+# The main function that prints all
+# combinations of size r in arr[] of
+# size n. This function mainly uses
+# CombinationRepetitionUtil()
+def CombinationRepetition(arr, badarr, n, r):
+
+    # A temporary array to store
+    # all combination one by one
+    chosen = [0] * r
+
+    # Print all combination using
+    # temporary array 'chosen[]'
+    CombinationRepetitionUtil(chosen, arr, badarr, 0, r, 0, n)
+
+
+# Driver code
+badarr = [ '--ech grease', '--ech false', '--ech ecl:$badecl', '--ech pn:$badpn' ]
+goodarr = [ '--ech hard', '--ech true', '--ech ecl:$goodecl',  '--ech pn:$goodpn' ]
+arr = badarr + goodarr
+r = 8
+n = len(arr) - 1
+
+CombinationRepetition(arr, badarr, n, r)
diff --git a/third-party/curl/tests/ech_tests.sh b/third-party/curl/tests/ech_tests.sh
new file mode 100644
index 0000000000..5b6f60d555
--- /dev/null
+++ b/third-party/curl/tests/ech_tests.sh
@@ -0,0 +1,1102 @@
+#!/usr/bin/env bash
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+
+# Run some tests against servers we know to support ECH (CF, defo.ie, etc.).
+# as well as some we know do not do ECH but have an HTTPS RR, and finally some
+# for which neither is the case.
+
+# TODO: Translate this into something that approximates a valid curl test:-)
+# Should be useful though even before such translation and a pile less work
+# to do this than that.  The pile of work required would include making an
+# ECH-enabled server and a DoH server. For now, this is run manually.
+#
+
+# set -x
+
+# Exit with an error if there is an active ech stanza in ~/.curlrc
+# as that would likely skew some results (e.g. turning a fail into
+# a success or vice versa)
+: "${CURL_CFG_FILE=$HOME/.curlrc}"
+active_ech=$(grep ech "$CURL_CFG_FILE" | grep -v "#.*ech")
+if [[ "$active_ech" != "" ]]; then
+  echo "You seem to have an active ECH setting in $CURL_CFG_FILE"
+  echo "That might affect results so please remove that or comment"
+  echo "it out - exiting."
+  exit 1
+fi
+
+# Targets we expect to be ECH-enabled servers
+# for which an HTTPS RR is published.
+# structure is host:port mapped to pathname
+# TODO: add negative tests for these
+declare -A ech_targets=(
+  [my-own.net]="ech-check.php"
+  [my-own.net:8443]="ech-check.php"
+  [defo.ie]="ech-check.php"
+  [cover.defo.ie]=""
+  [draft-13.esni.defo.ie:8413]="stats"
+  [draft-13.esni.defo.ie:8414]="stats"
+  [draft-13.esni.defo.ie:9413]=""
+  [draft-13.esni.defo.ie:10413]=""
+  [draft-13.esni.defo.ie:11413]=""
+  [draft-13.esni.defo.ie:12413]=""
+  [draft-13.esni.defo.ie:12414]=""
+  [cloudflare-ech.com]="cdn-cgi/trace"
+  [tls-ech.dev]=""
+  # this one's gone away for now (possibly temporarily)
+  # [epochbelt.com]=""
+)
+
+# Targets we expect not to be ECH-enabled servers
+# but for which an HTTPS RR is published.
+declare -A httpsrr_targets=(
+  [ietf.org]=""
+  [rte.ie]=""
+)
+
+# Targets we expect not to be ECH-enabled servers
+# and for which no HTTPS RR is published.
+declare -A neither_targets=(
+  [www.tcd.ie]=""
+  [jell.ie]=""
+)
+
+#
+# Variables that can be over-ridden from environment
+#
+
+# Top of curl test tree, assume we are there
+: "${CTOP:=.}"
+
+# Place to put test log output
+: "${LTOP:=$CTOP/tests/ech-log/}"
+
+# Place to stash outputs when things go wrong
+: "${BTOP:=$LTOP}"
+
+# Time to wait for a remote access to work, 10 seconds
+: "${tout:=10s}"
+
+# Where we find OpenSSL .so's
+: "${OSSL:=$HOME/code/openssl-local-inst}"
+
+# Where we find wolfSSL .so's
+: "${WSSL:=$HOME/code/wolfssl/inst/lib}"
+
+# Where we find BoringSSL .so's
+: "${BSSL:=$HOME/code/boringssl/inst/lib}"
+
+# Where we send DoH queries when using kdig or curl
+: "${DOHSERVER:=one.one.one.one}"
+: "${DOHPATH:=dns-query}"
+
+# Whether to send mail when bad things happen (mostly for cronjob)
+: "${DOMAIL:=no}"
+
+# Misc vars and functions
+
+DEFPORT=443
+
+function whenisitagain() {
+  /bin/date -u +%Y%m%d-%H%M%S
+}
+
+function fileage() {
+  echo $(($(date +%s) - $(date +%s -r "$1")))
+}
+
+function hostport2host() {
+  case $1 in
+    *:*) host=${1%:*} port=${1##*:};;
+      *) host=$1      port=$DEFPORT;;
+  esac
+  echo "$host"
+}
+
+function hostport2port() {
+  case $1 in
+    *:*) host=${1%:*} port=${1##*:};;
+      *) host=$1      port=$DEFPORT;;
+  esac
+  echo "$port"
+}
+
+function cli_test() {
+  # 1st param is target URL
+  turl=$1
+  # 2nd param is 0 if we expect curl to not work or 1 if we expect it
+  # to have worked
+  curl_winorlose=$2
+  # 3rd param is 0 if we expect ECH to not work or 1 if we expect it
+  # to have worked
+  ech_winorlose=$3
+  # remaining params are passed to command line
+  # echparms=(${@:4})
+  IFS=" " read -r -a echparms <<< "${@:4}"
+
+  TMPF=$(mktemp)
+  cmd="timeout $tout $CURL ${CURL_PARAMS[*]} ${echparms[*]} $turl > $TMPF 2>&1"
+  echo "cli_test: $cmd " >> "$logfile"
+  timeout "$tout" "$CURL" "${CURL_PARAMS[@]}" "${echparms[@]}" "$turl" > "$TMPF" 2>&1
+  eres=$?
+  if [[ "$eres" == "124" ]]; then
+    allgood="no"
+    echo "cli_test: Timeout running $cmd"
+    cat "$TMPF" >> "$logfile"
+    echo "cli_test: Timeout running $cmd" >> "$logfile"
+  fi
+  if [[ "$eres" != "0" && "$curl_winorlose" == "1" ]]; then
+    allgood="no"
+    echo "cli_test: curl failure running $cmd"
+    cat "$TMPF" >> "$logfile"
+    echo "cli_test: curl failure running $cmd" >> "$logfile"
+  fi
+  ech_success=$(grep -c "ECH: result: status is succeeded" "$TMPF")
+  if [[ "$ech_success" == "$ech_winorlose" ]]; then
+    echo "cli_test ok for ${echparms[*]}"
+  else
+    allgood="no"
+    echo "cli_test: ECH failure running $cmd"
+    cat "$TMPF" >> "$logfile"
+    echo "cli_test: ECH failure running $cmd" >> "$logfile"
+  fi
+  rm -f "$TMPF"
+}
+
+function get_ech_configlist() {
+  domain=$1
+  ecl=$(dig +short https "$domain" | grep "ech=" | sed -e 's/^.*ech=//' | sed -e 's/ .*//')
+  echo "$ecl"
+}
+
+# start of main script
+
+# start by assuming we have nothing we need...
+have_ossl="no"
+have_wolf="no"
+have_bssl="no"
+using_ossl="no"
+using_wolf="no"
+using_bssl="no"
+have_curl="no"
+have_dig="no"
+have_kdig="no"
+have_presout="no"
+have_portsblocked="no"
+
+# setup logging
+NOW=$(whenisitagain)
+BINNAME=$(basename "$0" .sh)
+if [ ! -d "$LTOP" ]; then
+  mkdir -p "$LTOP"
+fi
+if [ ! -d "$LTOP" ]; then
+  echo "Cannot see $LTOP for logs - exiting"
+  exit 1
+fi
+logfile=$LTOP/${BINNAME}_$NOW.log
+
+echo "-----" > "$logfile"
+echo "Running $0 at $NOW" >> "$logfile"
+echo "Running $0 at $NOW"
+
+# check we have the binaries needed and which TLS library we are using
+if [ -f "$OSSL"/libssl.so ]; then
+  have_ossl="yes"
+fi
+if [ -f "$WSSL"/libwolfssl.so ]; then
+  have_wolf="yes"
+fi
+if [ -f "$BSSL"/libssl.so ]; then
+  have_bssl="yes"
+fi
+CURL="$CTOP/src/curl"
+CURL_PARAMS=(-vvv --doh-url https://one.one.one.one/dns-query)
+if [ -f "$CTOP"/src/curl ]; then
+  have_curl="yes"
+fi
+ossl_cnt=$(LD_LIBRARY_PATH=$OSSL $CURL "${CURL_PARAMS[@]}" -V 2> /dev/null | grep -c OpenSSL)
+if ((ossl_cnt == 1)); then
+  using_ossl="yes"
+  # setup access to our .so
+  export LD_LIBRARY_PATH=$OSSL
+fi
+bssl_cnt=$(LD_LIBRARY_PATH=$BSSL $CURL "${CURL_PARAMS[@]}" -V 2> /dev/null | grep -c BoringSSL)
+if ((bssl_cnt == 1)); then
+  using_bssl="yes"
+  # setup access to our .so
+  export LD_LIBRARY_PATH=$BSSL
+fi
+wolf_cnt=$($CURL "${CURL_PARAMS[@]}" -V 2> /dev/null | grep -c wolfSSL)
+if ((wolf_cnt == 1)); then
+  using_wolf="yes"
+  # for some reason curl + wolfSSL dislikes certs that are ok
+  # for browsers, so we test using "insecure" mode (-k)
+  # but that is OK here as we are only interested in ECH testing
+  CURL_PARAMS+=(-k)
+fi
+# check if we have dig and it knows https or not
+digcmd="dig +short"
+wdig=$(type -p dig)
+if [[ "$wdig" != "" ]]; then
+  have_dig="yes"
+fi
+wkdig=$(type -p kdig)
+if [[ "$wkdig" != "" ]]; then
+  have_kdig="yes"
+  digcmd="kdig @$DOHSERVER +https +short"
+fi
+# see if our dig version knows HTTPS
+digout=$($digcmd https defo.ie)
+if [[ $digout != "1 . "* ]]; then
+  digout=$($digcmd -t TYPE65 defo.ie)
+  if [[ $digout == "1 . "* ]]; then
+    # we are good
+    have_presout="yes"
+  fi
+else
+  have_presout="yes"
+fi
+
+# Check if ports other than 443 are blocked from this
+# vantage point (I run tests in a n/w where that is
+# sadly true sometimes;-)
+# echo "Checking if ports other than 443 are maybe blocked"
+not443testurl="https://draft-13.esni.defo.ie:9413/"
+timeout "$tout" "$CURL" "${CURL_PARAMS[@]}" "$not443testurl" >/dev/null 2>&1
+eres=$?
+if [[ "$eres" == "124" ]]; then
+  echo "Timeout running curl for $not443testurl" >> "$logfile"
+  echo "Timeout running curl for $not443testurl"
+  have_portsblocked="yes"
+fi
+
+{
+  echo "have_ossl: $have_ossl"
+  echo "have_wolf: $have_wolf"
+  echo "have_bssl: $have_bssl"
+  echo "using_ossl: $using_ossl"
+  echo "using_wolf: $using_wolf"
+  echo "using_bssl: $using_bssl"
+  echo "have_curl: $have_curl"
+  echo "have_dig: $have_dig"
+  echo "have_kdig: $have_kdig"
+  echo "have_presout: $have_presout"
+  echo "have_portsblocked: $have_portsblocked"
+} >> "$logfile"
+
+echo "curl: have $have_curl, curl command: |$CURL ${CURL_PARAMS[*]}|"
+echo "ossl: have: $have_ossl, using: $using_ossl"
+echo "wolf: have: $have_wolf, using: $using_wolf"
+echo "bssl: have: $have_bssl, using: $using_bssl"
+echo "dig: $have_dig, kdig: $have_kdig, HTTPS presentation format: $have_presout"
+echo "dig command: |$digcmd|"
+echo "ports != 443 blocked: $have_portsblocked"
+
+if [[ "$have_curl" == "no" ]]; then
+  echo "Cannot proceed without curl - exiting"
+  exit 32
+fi
+
+allgood="yes"
+
+skip="false"
+
+if [[ "$skip" != "true" ]]; then
+
+# basic ECH good/bad
+for targ in "${!ech_targets[@]}"; do
+  if [[ "$using_wolf" == "yes" ]]; then
+    case $targ in
+      "draft-13.esni.defo.ie:8414" | "tls-ech.dev" | \
+      "cloudflare-ech.com" | "epochbelt.com")
+        echo "Skipping $targ 'cause wolf"; continue;;
+      *)
+        ;;
+    esac
+  fi
+  host=$(hostport2host "$targ")
+  port=$(hostport2port "$targ")
+  if [[ "$port" != "443" && "$have_portsblocked" == "yes" ]]; then
+    echo "Skipping $targ as ports != 443 seem blocked"
+    continue
+  fi
+  path=${ech_targets[$targ]}
+  turl="https://$host:$port/$path"
+  echo "ECH check for $turl"
+  {
+    echo ""
+    echo "ECH check for $turl"
+  } >> "$logfile"
+  timeout "$tout" "$CURL" "${CURL_PARAMS[@]}" --ech hard "$turl" >> "$logfile" 2>&1
+  eres=$?
+  if [[ "$eres" == "124" ]]; then
+    allgood="no"
+    {
+      echo "Timeout for $turl"
+      echo -e "\tTimeout for $turl"
+      echo "Timeout running curl for $host:$port/$path"
+    } >> "$logfile"
+  fi
+  if [[ "$eres" != "0" ]]; then
+    allgood="no"
+    echo "Error ($eres) for $turl" >> "$logfile"
+    echo -e "\tError ($eres) for $turl"
+  fi
+  echo "" >> "$logfile"
+done
+
+# check if public_name override works (OpenSSL only)
+if [[ "$using_ossl" == "yes" ]]; then
+  for targ in "${!ech_targets[@]}"; do
+    host=$(hostport2host "$targ")
+    port=$(hostport2port "$targ")
+    if [[ "$port" != "443" && "$have_portsblocked" == "yes" ]]; then
+      echo "Skipping $targ as ports != 443 seem blocked"
+      continue
+    fi
+    if [[ "$host" == "cloudflare-ech.com" ]]; then
+      echo "Skipping $host as they have blocked PN override"
+      continue
+    fi
+    path=${ech_targets[$targ]}
+    turl="https://$host:$port/$path"
+    echo "PN override check for $turl"
+    {
+      echo ""
+      echo "PN override check for $turl"
+    } >> "$logfile"
+    timeout "$tout" "$CURL" "${CURL_PARAMS[@]}" --ech pn:override --ech hard "$turl" >> "$logfile" 2>&1
+    eres=$?
+    if [[ "$eres" == "124" ]]; then
+      allgood="no"
+      {
+        echo "Timeout for $turl"
+        echo -e "\tTimeout for $turl"
+        echo "Timeout running curl for $host:$port/$path"
+      } >> "$logfile"
+    fi
+    if [[ "$eres" != "0" ]]; then
+      allgood="no"
+      echo "PN override Error ($eres) for $turl" >> "$logfile"
+      echo -e "\tPN override Error ($eres) for $turl"
+    fi
+    echo "" >> "$logfile"
+  done
+fi
+
+for targ in "${!httpsrr_targets[@]}"; do
+  host=$(hostport2host "$targ")
+  port=$(hostport2port "$targ")
+  if [[ "$port" != "443" && "$have_portsblocked" == "yes" ]]; then
+    echo "Skipping $targ as ports != 443 seem blocked"
+    continue
+  fi
+  path=${httpsrr_targets[$targ]}
+  turl="https://$host:$port/$path"
+  echo "HTTPS RR but no ECHConfig check for $turl"
+  {
+    echo ""
+    echo "HTTPS RR but no ECHConfig check for $turl"
+  } >> "$logfile"
+  timeout "$tout" "$CURL" "${CURL_PARAMS[@]}" --ech true "$turl" >> "$logfile" 2>&1
+  eres=$?
+  if [[ "$eres" == "124" ]]; then
+    allgood="no"
+    {
+      echo "Timeout for $turl"
+      echo -e "\tTimeout for $turl"
+      echo "Timeout running curl for $host:$port/$path"
+    } >> "$logfile"
+  fi
+  if [[ "$eres" != "0" ]]; then
+    allgood="no"
+    echo "Error ($eres) for $turl" >> "$logfile"
+    echo -e "\tError ($eres) for $turl"
+  fi
+  echo "" >> "$logfile"
+done
+
+for targ in "${!neither_targets[@]}"; do
+  host=$(hostport2host "$targ")
+  port=$(hostport2port "$targ")
+  if [[ "$port" != "443" && "$have_portsblocked" == "yes" ]]; then
+    echo "Skipping $targ as ports != 443 seem blocked"
+    continue
+  fi
+  path=${neither_targets[$targ]}
+  turl="https://$host:$port/$path"
+  echo "Neither HTTPS nor ECHConfig check for $turl"
+  {
+    echo ""
+    echo "Neither HTTPS nor ECHConfig check for $turl"
+  } >> "$logfile"
+  timeout "$tout" "$CURL" "${CURL_PARAMS[@]}" --ech true "$turl" >> "$logfile" 2>&1
+  eres=$?
+  if [[ "$eres" == "124" ]]; then
+    allgood="no"
+    {
+      echo "Timeout for $turl"
+      echo -e "\tTimeout for $turl"
+      echo "Timeout running curl for $host:$port/$path"
+    } >> "$logfile"
+  fi
+  if [[ "$eres" != "0" ]]; then
+    allgood="no"
+    echo "Error ($eres) for $turl" >> "$logfile"
+    echo -e "\tError ($eres) for $turl"
+  fi
+  echo "" >> "$logfile"
+done
+
+# Check various command line options, if we are good so far
+if [[ "$using_ossl" == "yes" && "$allgood" == "yes" ]]; then
+  # use this test URL as it tells us if things worked
+  turl="https://defo.ie/ech-check.php"
+  echo "cli_test with $turl"
+  echo "cli_test with $turl" >> "$logfile"
+  cli_test "$turl" 1 1 --ech true
+  cli_test "$turl" 1 0 --ech false
+  cli_test "$turl" 1 1 --ech false --ech true
+  cli_test "$turl" 1 1 --ech false --ech true --ech pn:foobar
+  cli_test "$turl" 1 1 --ech false --ech pn:foobar --ech true
+  echconfiglist=$(get_ech_configlist defo.ie)
+  cli_test "$turl" 1 1 --ech ecl:"$echconfiglist"
+  cli_test "$turl" 1 0 --ech ecl:
+fi
+
+fi # skip
+
+# Check combinations of command line options, if we are good so far
+# Most of this only works for OpenSSL, which is ok, as we are checking
+# the argument handling here, not the ECH protocol
+if [[ "$using_ossl" == "yes" && "$allgood" == "yes" ]]; then
+  # ech can be hard, true, grease or false
+  # ecl:ecl can be correct, incorrect or missing
+  # ech:pn can be correct, incorrect or missing
+  # in all cases the "last" argument provided should "win"
+  # but only one of hard, true, grease or false applies
+  turl="https://defo.ie/ech-check.php"
+  echconfiglist=$(get_ech_configlist defo.ie)
+  goodecl=$echconfiglist
+  echconfiglist=$(get_ech_configlist hidden.hoba.ie)
+  badecl=$echconfiglist
+  goodpn="cover.defo.ie"
+  badpn="hoba.ie"
+  echo "more cli_test with $turl"
+  echo "more cli_test with $turl" >> "$logfile"
+
+  # The combinatorics here are handled via the tests/ech_combos.py script
+  # which produces all the relevant combinations or inputs and orders
+  # thereof. We have to manually assess whether or not ECH is expected to
+  # work for each case.
+  cli_test "$turl" 0 0
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$badecl" --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$badecl" --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech hard
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$badecl" --ech hard --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$badecl" --ech hard --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech hard --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech hard --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$badecl" --ech hard --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$badecl" --ech hard --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech hard --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$badecl" --ech pn:"$badpn" --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$badecl" --ech pn:"$badpn" --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$badecl" --ech pn:"$badpn" --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$badecl" --ech pn:"$badpn" --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" - 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$badecl" --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$badecl" --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech false
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech false --ech ecl:"$badecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech false --ech ecl:"$badecl" --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech false --ech ecl:"$badecl" --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech hard
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech ecl:"$badecl" --ech hard --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech ecl:"$badecl" --ech hard --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech hard --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech hard --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech ecl:"$badecl" --ech hard --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech ecl:"$badecl" --ech hard --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech hard --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech false --ech ecl:"$badecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech ecl:"$badecl" --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech ecl:"$badecl" --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech false --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech false --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech hard
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech hard --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech hard --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech hard --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech hard --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech hard --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech hard --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech hard --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech false --ech pn:"$badpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech false --ech pn:"$badpn" --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech false --ech pn:"$badpn" --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech pn:"$badpn" --ech hard
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech pn:"$badpn" --ech hard --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech pn:"$badpn" --ech hard --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech pn:"$badpn" --ech hard --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech pn:"$badpn" --ech hard --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech pn:"$badpn" --ech hard --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech pn:"$badpn" --ech hard --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech pn:"$badpn" --ech hard --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech false --ech pn:"$badpn" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech pn:"$badpn" --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech pn:"$badpn" --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech pn:"$badpn" --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech pn:"$badpn" --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech false --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech false --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech hard
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech hard --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech hard --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech hard --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech hard --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech hard --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech hard --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech hard --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech pn:"$badpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech pn:"$badpn" --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech pn:"$badpn" --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech pn:"$badpn" --ech hard
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech pn:"$badpn" --ech hard --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech pn:"$badpn" --ech hard --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech pn:"$badpn" --ech hard --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech pn:"$badpn" --ech hard --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech pn:"$badpn" --ech hard --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech pn:"$badpn" --ech hard --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech pn:"$badpn" --ech hard --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech pn:"$badpn" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech pn:"$badpn" --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech pn:"$badpn" --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech pn:"$badpn" --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech pn:"$badpn" --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 0 --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 1 1 --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+
+  # a target URL that does not support ECH
+  turl="https://tcd.ie"
+  echo "cli_test with $turl"
+  echo "cli_test with $turl" >> "$logfile"
+  # the params below do not matter much here as we fail anyway
+  echconfiglist=$(get_ech_configlist defo.ie)
+  goodecl=$echconfiglist
+  badecl="$goodecl"
+  goodpn="tcd.ie"
+  badpn="tcd.ie"
+  cli_test "$turl" 1 0
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech hard
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech hard --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech hard --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech hard --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech hard --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech hard --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech hard --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech hard --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$badpn" --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$badecl" --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech hard
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech hard --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech hard --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech hard --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech hard --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech hard --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech hard --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech hard --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech hard --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$badpn" --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$badecl" --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech hard
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech hard --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech hard --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech hard --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech hard --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech hard --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech hard --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech hard --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech pn:"$badpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech pn:"$badpn" --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech pn:"$badpn" --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech pn:"$badpn" --ech hard
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech pn:"$badpn" --ech hard --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech pn:"$badpn" --ech hard --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech pn:"$badpn" --ech hard --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech pn:"$badpn" --ech hard --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech pn:"$badpn" --ech hard --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech pn:"$badpn" --ech hard --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech pn:"$badpn" --ech hard --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech pn:"$badpn" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech pn:"$badpn" --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech pn:"$badpn" --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech pn:"$badpn" --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech pn:"$badpn" --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech false --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech hard
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech hard --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech hard --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech hard --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech hard --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech hard --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech hard --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech hard --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech pn:"$badpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech pn:"$badpn" --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech pn:"$badpn" --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech pn:"$badpn" --ech hard
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech pn:"$badpn" --ech hard --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech pn:"$badpn" --ech hard --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech pn:"$badpn" --ech hard --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech pn:"$badpn" --ech hard --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech pn:"$badpn" --ech hard --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech pn:"$badpn" --ech hard --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech pn:"$badpn" --ech hard --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech pn:"$badpn" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech pn:"$badpn" --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech pn:"$badpn" --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech pn:"$badpn" --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech pn:"$badpn" --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech true
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech true --ech ecl:"$goodecl"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech true --ech ecl:"$goodecl" --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+  cli_test "$turl" 0 0 --ech true --ech pn:"$goodpn"
+  [ "$allgood" != "yes" ] && echo "$LINENO"
+fi
+
+END=$(whenisitagain)
+echo "Finished $0 at $END" >> "$logfile"
+echo "-----" >> "$logfile"
+
+if [[ "$allgood" == "yes" ]]; then
+  echo "Finished $0 at $END"
+  echo "All good, log in $logfile"
+  exit 0
+else
+  echo "Finished $0 at $END"
+  echo "NOT all good, log in $logfile"
+fi
+
+# send a mail to root (it is forwarded) but only once every 24 hours
+# 'cause we only really need "new" news
+itsnews="yes"
+age_of_news=0
+if [ -f "$LTOP"/bad_runs ]; then
+  age_of_news=$(fileage "$LTOP"/bad_runs)
+  # only consider news "new" if we have not mailed today
+  if ((age_of_news < 24 * 3600)); then
+    itsnews="no"
+  fi
+fi
+if [[ "$DOMAIL" == "yes" && "$itsnews" == "yes" ]]; then
+  echo "ECH badness at $NOW" | mail -s "ECH badness at $NOW" root
+fi
+# add to list of bad runs (updating file age)
+echo "ECH badness at $NOW" >> "$LTOP"/bad_runs
+exit 2
diff --git a/third-party/curl/tests/error-codes.pl b/third-party/curl/tests/error-codes.pl
deleted file mode 100644
index 8147ef6d01..0000000000
--- a/third-party/curl/tests/error-codes.pl
+++ /dev/null
@@ -1,82 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-#
-#
-
-use strict;
-use warnings;
-
-# we may get the dir root pointed out
-my $root=$ARGV[0] || ".";
-
-my %error; # from the include file
-my %docs; # from libcurl-errors.3
-
-sub getdocserrors {
-    open(my $f, "<", "$root/docs/libcurl/libcurl-errors.3");
-    while(<$f>) {
-        if($_ =~ /^.IP \"(CURL[EM]_[^ \t\"]*)/) {
-            my ($symbol) = ($1);
-            if($symbol =~ /OBSOLETE/) {
-                ;
-            }
-            else {
-                $docs{$symbol}=1;
-            }
-        }
-    }
-    close($f);
-}
-
-sub getincludeerrors {
-    open(my $f, "<", "$root/docs/libcurl/symbols-in-versions");
-    while(<$f>) {
-        if($_ =~ /^(CURL[EM]_[^ \t]*)[ \t]*([0-9.]+)[ \t]*(.*)/) {
-            my ($symbol, $added, $rest) = ($1,$2,$3);
-            if($rest =~ /^([0-9.]+)/) {
-                # removed!
-            }
-            else {
-                $error{$symbol}=$added;
-            }
-        }
-    }
-    close($f);
-}
-
-getincludeerrors();
-getdocserrors();
-
-for(sort keys %error) {
-    if($error{$_} && !$docs{$_}) {
-        print "$_ is not in libcurl-errors.3\n";
-    }
-}
-
-for(sort keys %docs) {
-    if($docs{$_} && !$error{$_}) {
-        print "$_ is not in symbols-in-versions\n";
-    }
-}
diff --git a/third-party/curl/tests/extern-scan.pl b/third-party/curl/tests/extern-scan.pl
deleted file mode 100644
index d8f46ee3ba..0000000000
--- a/third-party/curl/tests/extern-scan.pl
+++ /dev/null
@@ -1,114 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-#
-#
-
-use strict;
-use warnings;
-
-my $sort = 0;
-
-# we may get the dir root pointed out
-my $root = shift @ARGV;
-while(defined $root) {
-
-    if($root =~ /--heading=(.*)/) {
-        print "$1\n";
-        $root = shift @ARGV;
-        next;
-    }
-    elsif($root =~ /--sort/) {
-        $sort = 1;
-        $root = shift @ARGV;
-        next;
-    }
-
-    last;
-}
-
-if(!defined $root) {
-    $root = ".";
-}
-
-$root = "$root/include/curl";
-opendir(D, "$root") || die "Cannot open directory $root: $!\n";
-my @dir = readdir(D);
-closedir(D);
-
-my @incs;
-foreach (sort(@dir)) {
-    if($_ =~ /\.h$/) {
-        push(@incs, "$root/$_");
-    }
-}
-
-my $verbose=0;
-my $summary=0;
-my $misses=0;
-
-my @syms;
-my %doc;
-my %rem;
-
-my @out;
-foreach my $f (@incs) {
-    open H, "<$f" || die;
-    my $first = "";
-    while(<H>) {
-        s/CURL_DEPRECATED\(.*"\)//;
-        s/  */ /g;
-        if (/^(^CURL_EXTERN .*?)\(/) {
-            my $decl = $1;
-            $decl =~ s/\r$//;
-            $decl =~ /([a-z_]+)$/;
-            push(@out, "$1");
-        }
-        elsif (/^(^CURL_EXTERN .*)/) {
-            # handle two-line declarations
-            my $decl = $1;
-            $decl =~ s/\r$//;
-            $first = $decl;
-        }
-        elsif($first) {
-            if (/^ *(.*)\(/) {
-                my $decl = $1;
-                $decl =~ s/\r$//;
-                $first .= $decl;
-                $first =~ /([a-z_]+)$/;
-                push(@out, "$1");
-            }
-            $first = "";
-        }
-    }
-    close H;
-}
-
-if($sort) {
-    @out = sort(@out);
-}
-
-foreach (@out) {
-    print("$_\n");
-}
diff --git a/third-party/curl/tests/ftpserver.pl b/third-party/curl/tests/ftpserver.pl
index eb0b2ec039..bbfa05ce74 100644
--- a/third-party/curl/tests/ftpserver.pl
+++ b/third-party/curl/tests/ftpserver.pl
@@ -32,10 +32,10 @@
 # protocols simultaneously.
 #
 # It is meant to exercise curl, it is not meant to be a fully working
-# or even very standard compliant server.
+# or even overly standard compliant server.
 #
-# You may optionally specify port on the command line, otherwise it'll
-# default to port 8921.
+# You may optionally specify port on the command line, otherwise it
+# defaults to port 8921.
 #
 # All socket/network/TCP related stuff is done by the 'sockfilt' program.
 #
@@ -51,6 +51,7 @@ BEGIN {
 use IPC::Open2;
 use Digest::MD5;
 use File::Basename;
+use Time::HiRes;
 
 use directories;
 
@@ -68,16 +69,13 @@ use serverhelp qw(
     servername_str
     server_pidfilename
     server_logfilename
+    server_exe_args
     mainsockf_pidfilename
     mainsockf_logfilename
     datasockf_pidfilename
     datasockf_logfilename
     );
 
-use pathhelp qw(
-    exe_ext
-    );
-
 use globalconfig qw(
     $SERVERCMD
     $LOCKDIR
@@ -106,11 +104,11 @@ my $port = 8921;               # default primary listener port
 my $listenaddr = '127.0.0.1';  # default address for listener port
 
 #**********************************************************************
-# global vars used for file names
+# global vars used for filenames
 #
-my $PORTFILE="ftpserver.port"; # server port file name
+my $PORTFILE = "ftpserver.port"; # server port filename
 my $portfile;           # server port file path
-my $pidfile;            # server pid file name
+my $pidfile;            # server pid filename
 my $mainsockf_pidfile;  # pid file for primary connection sockfilt process
 my $mainsockf_logfile;  # log file for primary connection sockfilt process
 my $datasockf_pidfile;  # pid file for secondary connection sockfilt process
@@ -149,15 +147,15 @@ my %displaytext;   # text returned to client before callback runs
 #
 my $ctrldelay;     # set if server should throttle ctrl stream
 my $datadelay;     # set if server should throttle data stream
-my $retrweirdo;    # set if ftp server should use RETRWEIRDO
-my $retrnosize;    # set if ftp server should use RETRNOSIZE
-my $retrsize;      # set if ftp server should use RETRSIZE
-my $pasvbadip;     # set if ftp server should use PASVBADIP
-my $nosave;        # set if ftp server should not save uploaded data
-my $nodataconn;    # set if ftp srvr doesn't establish or accepts data channel
-my $nodataconn425; # set if ftp srvr doesn't establish data ch and replies 425
-my $nodataconn421; # set if ftp srvr doesn't establish data ch and replies 421
-my $nodataconn150; # set if ftp srvr doesn't establish data ch and replies 150
+my $retrweirdo;    # set if FTP server should use RETRWEIRDO
+my $retrnosize;    # set if FTP server should use RETRNOSIZE
+my $retrsize;      # set if FTP server should use RETRSIZE
+my $pasvbadip;     # set if FTP server should use PASVBADIP
+my $nosave;        # set if FTP server should not save uploaded data
+my $nodataconn;    # set if FTP srvr does not establish or accepts data channel
+my $nodataconn425; # set if FTP srvr does not establish data ch and replies 425
+my $nodataconn421; # set if FTP srvr does not establish data ch and replies 421
+my $nodataconn150; # set if FTP srvr does not establish data ch and replies 150
 my $storeresp;
 my $postfetch;
 my @capabilities;  # set if server supports capability commands
@@ -168,15 +166,15 @@ my %customcount;   #
 my %delayreply;    #
 
 #**********************************************************************
-# global variables for to test ftp wildcardmatching or other test that
+# global variables for to test FTP wildcardmatching or other test that
 # need flexible LIST responses.. and corresponding files.
 # $ftptargetdir is keeping the fake "name" of LIST directory.
 #
 my $ftplistparserstate;
-my $ftptargetdir="";
+my $ftptargetdir = "";
 
 #**********************************************************************
-# global variables used when running a ftp server to keep state info
+# global variables used when running an FTP server to keep state info
 # relative to the secondary or data sockfilt process. Values of these
 # variables should only be modified using datasockf_state() sub, given
 # that they are closely related and relationship is a bit awkward.
@@ -190,7 +188,6 @@ my $datasockf_conn = 'no';       # ['no','yes']
 # global vars used for signal handling
 #
 my $got_exit_signal = 0; # set if program should finish execution ASAP
-my $exit_signal;         # first signal handled in exit_signal_handler
 
 #**********************************************************************
 # Mail related definitions
@@ -199,13 +196,13 @@ my $TEXT_PASSWORD = "secret";
 my $POP3_TIMESTAMP = "<1972.987654321\@curl>";
 
 #**********************************************************************
-# exit_signal_handler will be triggered to indicate that the program
+# exit_signal_handler is triggered to indicate that the program
 # should finish its execution in a controlled way as soon as possible.
-# For now, program will also terminate from within this handler.
+# For now, program also terminates from within this handler.
 #
 sub exit_signal_handler {
     my $signame = shift;
-    # For now, simply mimic old behavior.
+    # For now, mimic old behavior.
     killsockfilters($piddir, $proto, $ipvnum, $idnum, $verbose);
     unlink($pidfile);
     unlink($portfile);
@@ -218,7 +215,7 @@ sub exit_signal_handler {
 
 sub ftpmsg {
   # append to the server.input file
-  open(my $input, ">>", "$logdir/server$idstr.input") ||
+  open(my $input, ">>", "$logdir/server$idstr.input") or
     logmsg "failed to open $logdir/server$idstr.input\n";
 
   print $input @_;
@@ -226,13 +223,13 @@ sub ftpmsg {
 
   # use this, open->print->close system only to make the file
   # open as little as possible, to make the test suite run
-  # better on windows/cygwin
+  # better on Windows/Cygwin
 }
 
 #**********************************************************************
-# eXsysread is a wrapper around perl's sysread() function. This will
-# repeat the call to sysread() until it has actually read the complete
-# number of requested bytes or an unrecoverable condition occurs.
+# eXsysread is a wrapper around perl's sysread() function. This repeats
+# the call to sysread() until it has actually read the complete number
+# of requested bytes or an unrecoverable condition occurs.
 # On success returns a positive value, the number of bytes requested.
 # On failure or timeout returns zero.
 #
@@ -410,21 +407,22 @@ sub sysread_or_die {
 }
 
 sub startsf {
-    my $mainsockfcmd = "./server/sockfilt".exe_ext('SRV')." " .
-        "--ipv$ipvnum --port $port " .
-        "--pidfile \"$mainsockf_pidfile\" " .
-        "--portfile \"$portfile\" " .
-        "--logfile \"$mainsockf_logfile\"";
-    $sfpid = open2(*SFREAD, *SFWRITE, $mainsockfcmd);
+    my @mainsockfcmd = (server_exe_args('sockfilt'),
+        "--ipv$ipvnum",
+        "--port", $port,
+        "--pidfile", $mainsockf_pidfile,
+        "--portfile", $portfile,
+        "--logfile", $mainsockf_logfile);
+    $sfpid = open2(*SFREAD, *SFWRITE, @mainsockfcmd);
 
-    print STDERR "$mainsockfcmd\n" if($verbose);
+    print STDERR "@mainsockfcmd\n" if($verbose);
 
     print SFWRITE "PING\n";
     my $pong;
     sysread_or_die(\*SFREAD, \$pong, 5);
 
     if($pong !~ /^PONG/) {
-        logmsg "Failed sockfilt command: $mainsockfcmd\n";
+        logmsg "Failed sockfilt command: @mainsockfcmd\n";
         killsockfilters($piddir, $proto, $ipvnum, $idnum, $verbose);
         unlink($pidfile);
         unlink($portfile);
@@ -487,7 +485,7 @@ sub sendcontrol {
 
         for(@a) {
             sockfilt $_;
-            portable_sleep(0.01);
+            Time::HiRes::sleep($ctrldelay);
         }
     }
     my $log;
@@ -524,7 +522,7 @@ sub senddata {
             # pause between each byte
             for (split(//,$l)) {
                 sockfiltsecondary $_;
-                portable_sleep(0.01);
+                Time::HiRes::sleep($datadelay);
             }
         }
     }
@@ -533,7 +531,7 @@ sub senddata {
 #**********************************************************************
 # protocolsetup initializes the 'displaytext' and 'commandfunc' hashes
 # for the given protocol. References to protocol command callbacks are
-# stored in 'commandfunc' hash, and text which will be returned to the
+# stored in 'commandfunc' hash, and text which is returned to the
 # client before the command callback runs is stored in 'displaytext'.
 #
 sub protocolsetup {
@@ -564,8 +562,8 @@ sub protocolsetup {
             'LIST' => '150 here comes a directory',
             'NLST' => '150 here comes a directory',
             'CWD'  => '250 CWD command successful.',
-            'SYST' => '215 UNIX Type: L8', # just fake something
-            'QUIT' => '221 bye bye baby', # just reply something
+            'SYST' => '215 UNIX Type: L8', # fake something
+            'QUIT' => '221 bye bye baby', # reply something
             'MKD'  => '257 Created your requested directory',
             'REST' => '350 Yeah yeah we set it there for you',
             'DELE' => '200 OK OK OK whatever you say',
@@ -575,10 +573,10 @@ sub protocolsetup {
             'PBSZ' => '500 PBSZ not implemented',
             'PROT' => '500 PROT not implemented',
             'welcome' => join("",
-            '220-        _   _ ____  _     '."\r\n",
-            '220-    ___| | | |  _ \| |    '."\r\n",
-            '220-   / __| | | | |_) | |    '."\r\n",
-            '220-  | (__| |_| |  _ {| |___ '."\r\n",
+            '220-        _   _ ____  _'."\r\n",
+            '220-    ___| | | |  _ \| |'."\r\n",
+            '220-   / __| | | | |_) | |'."\r\n",
+            '220-  | (__| |_| |  _ {| |___'."\r\n",
             '220    \___|\___/|_| \_\_____|'."\r\n")
         );
     }
@@ -601,10 +599,10 @@ sub protocolsetup {
         );
         %displaytext = (
             'welcome' => join("",
-            '        _   _ ____  _     '."\r\n",
-            '    ___| | | |  _ \| |    '."\r\n",
-            '   / __| | | | |_) | |    '."\r\n",
-            '  | (__| |_| |  _ {| |___ '."\r\n",
+            '        _   _ ____  _'."\r\n",
+            '    ___| | | |  _ \| |'."\r\n",
+            '   / __| | | | |_) | |'."\r\n",
+            '  | (__| |_| |  _ {| |___'."\r\n",
             '   \___|\___/|_| \_\_____|'."\r\n",
             '+OK curl POP3 server ready to serve '."\r\n")
         );
@@ -636,10 +634,10 @@ sub protocolsetup {
         );
         %displaytext = (
             'welcome' => join("",
-            '        _   _ ____  _     '."\r\n",
-            '    ___| | | |  _ \| |    '."\r\n",
-            '   / __| | | | |_) | |    '."\r\n",
-            '  | (__| |_| |  _ {| |___ '."\r\n",
+            '        _   _ ____  _'."\r\n",
+            '    ___| | | |  _ \| |'."\r\n",
+            '   / __| | | | |_) | |'."\r\n",
+            '  | (__| |_| |  _ {| |___'."\r\n",
             '   \___|\___/|_| \_\_____|'."\r\n",
             '* OK curl IMAP server ready to serve'."\r\n")
         );
@@ -660,17 +658,61 @@ sub protocolsetup {
         );
         %displaytext = (
             'welcome' => join("",
-            '220-        _   _ ____  _     '."\r\n",
-            '220-    ___| | | |  _ \| |    '."\r\n",
-            '220-   / __| | | | |_) | |    '."\r\n",
-            '220-  | (__| |_| |  _ {| |___ '."\r\n",
+            '220-        _   _ ____  _'."\r\n",
+            '220-    ___| | | |  _ \| |'."\r\n",
+            '220-   / __| | | | |_) | |'."\r\n",
+            '220-  | (__| |_| |  _ {| |___'."\r\n",
             '220    \___|\___/|_| \_\_____|'."\r\n")
         );
     }
 }
 
+# Perform the disconnect handshake with sockfilt on the secondary connection
+# (the only connection we actively disconnect).
+# This involves waiting for the disconnect acknowledgment after the DISC
+# command, while throwing away anything else that might come in before
+# that.
+sub disc_handshake {
+    print DWRITE "DISC\n";
+    my $line;
+    my $nr;
+    while(5 == ($nr = sysread DREAD, $line, 5)) {
+        if($line eq "DATA\n") {
+            # Must read the data bytes to stay in sync
+            my $i;
+            sysread DREAD, $i, 5;
+
+            my $size = 0;
+            if($i =~ /^([0-9a-fA-F]{4})\n/) {
+                $size = hex($1);
+            }
+
+            logmsg "> Throwing away $size bytes on closed connection\n";
+            read_datasockf(\$line, $size);
+        }
+        elsif($line eq "DISC\n") {
+            logmsg "Fancy that; client wants to DISC, too\n";
+            printf DWRITE "ACKD\n";
+        }
+        elsif($line eq "ACKD\n") {
+            # Got the ack we were waiting for
+            last;
+        }
+        else {
+            logmsg "Ignoring: $line";
+            # sockfilt should not be sending us any other commands
+        }
+    }
+    if(!defined($nr)) {
+        logmsg "Error: pipe read error ($!) while waiting for ACKD";
+    }
+    elsif($nr <= 0) {
+        logmsg "Error: pipe EOF while waiting for ACKD";
+    }
+}
+
 sub close_dataconn {
-    my ($closed)=@_; # non-zero if already disconnected
+    my ($closed) = @_; # non-zero if already disconnected
 
     my $datapid = processexists($datasockf_pidfile);
 
@@ -679,9 +721,7 @@ sub close_dataconn {
     if(!$closed) {
         if($datapid > 0) {
             logmsg "Server disconnects $datasockf_mode DATA connection\n";
-            print DWRITE "DISC\n";
-            my $i;
-            sysread DREAD, $i, 5;
+            disc_handshake();
             logmsg "Server disconnected $datasockf_mode DATA connection\n";
         }
         else {
@@ -728,7 +768,7 @@ sub EHLO_smtp {
     my @data;
 
     # TODO: Get the IP address of the client connection to use in the
-    # EHLO response when the client doesn't specify one but for now use
+    # EHLO response when the client does not specify one but for now use
     # 127.0.0.1
     if(!$client) {
         $client = "[127.0.0.1]";
@@ -749,7 +789,7 @@ sub EHLO_smtp {
 
         for my $am (@auth_mechs) {
             if(!$mechs) {
-                $mechs = "$am";
+                $mechs = $am;
             }
             else {
                 $mechs .= " $am";
@@ -783,7 +823,7 @@ sub HELO_smtp {
     my ($client) = @_;
 
     # TODO: Get the IP address of the client connection to use in the HELO
-    # response when the client doesn't specify one but for now use 127.0.0.1
+    # response when the client does not specify one but for now use 127.0.0.1
     if(!$client) {
         $client = "[127.0.0.1]";
     }
@@ -805,7 +845,7 @@ sub MAIL_smtp {
 
     logmsg "MAIL_smtp got $args\n";
 
-    if (!$args) {
+    if(!$args) {
         sendcontrol "501 Unrecognized parameter\r\n";
     }
     else {
@@ -824,16 +864,16 @@ sub MAIL_smtp {
             }
         }
 
-        # this server doesn't "validate" MAIL FROM addresses
-        if (length($from)) {
+        # this server does not "validate" MAIL FROM addresses
+        if(length($from)) {
             my @found;
             my $valid = 1;
 
             # Check the capabilities for SIZE and if the specified size is
             # greater than the message size then reject it
-            if (@found = grep /^SIZE (\d+)$/, @capabilities) {
-                if ($found[0] =~ /^SIZE (\d+)$/) {
-                    if ($size > $1) {
+            if(@found = grep /^SIZE (\d+)$/, @capabilities) {
+                if($found[0] =~ /^SIZE (\d+)$/) {
+                    if($size > $1) {
                         $valid = 0;
                     }
                 }
@@ -869,10 +909,10 @@ sub RCPT_smtp {
 
         # Validate the to address (only a valid email address inside <> is
         # allowed, such as <user@example.com>)
-        if ((!$smtputf8 && $to =~
-              /^<([a-zA-Z0-9._%+-]+)\@(([a-zA-Z0-9-]+)\.)+([a-zA-Z]{2,4})>$/) ||
-            ($smtputf8 && $to =~
-              /^<([a-zA-Z0-9\x{80}-\x{ff}._%+-]+)\@(([a-zA-Z0-9\x{80}-\x{ff}-]+)\.)+([a-zA-Z]{2,4})>$/)) {
+        if((!$smtputf8 && $to =~
+             /^<([a-zA-Z0-9._%+-]+)\@(([a-zA-Z0-9-]+)\.)+([a-zA-Z]{2,4})>$/) ||
+           ($smtputf8 && $to =~
+             /^<([a-zA-Z0-9\x{80}-\x{ff}._%+-]+)\@(([a-zA-Z0-9\x{80}-\x{ff}-]+)\.)+([a-zA-Z]{2,4})>$/)) {
             sendcontrol "250 Recipient OK\r\n";
         }
         else {
@@ -886,10 +926,10 @@ sub RCPT_smtp {
 sub DATA_smtp {
     my ($args) = @_;
 
-    if ($args) {
+    if($args) {
         sendcontrol "501 Unrecognized parameter\r\n";
     }
-    elsif ($smtp_client !~ /^(\d*)$/) {
+    elsif($smtp_client !~ /^(\d*)$/) {
         sendcontrol "501 Invalid arguments\r\n";
     }
     else {
@@ -900,14 +940,14 @@ sub DATA_smtp {
 
         logmsg "Store test number $testno in $filename\n";
 
-        open(my $file, ">", "$filename") ||
+        open(my $file, ">", $filename) or
             return 0; # failed to open output
 
         my $line;
-        my $ulsize=0;
-        my $disc=0;
+        my $ulsize = 0;
+        my $disc = 0;
         my $raw;
-        while (5 == (sysread \*SFREAD, $line, 5)) {
+        while(5 == (sysread \*SFREAD, $line, 5)) {
             if($line eq "DATA\n") {
                 my $i;
                 my $eob;
@@ -938,7 +978,8 @@ sub DATA_smtp {
             }
             elsif($line eq "DISC\n") {
                 # disconnect!
-                $disc=1;
+                $disc = 1;
+                printf SFWRITE "ACKD\n";
                 last;
             }
             else {
@@ -948,7 +989,7 @@ sub DATA_smtp {
         }
 
         if($nosave) {
-            print $file "$ulsize bytes would've been stored here\n";
+            print $file "$ulsize bytes would have been stored here\n";
         }
 
         close($file);
@@ -1034,16 +1075,16 @@ sub VRFY_smtp {
 
         # Validate the username (only a valid local or external username is
         # allowed, such as user or user@example.com)
-        if ((!$smtputf8 && $username =~
-            /^([a-zA-Z0-9._%+-]+)(\@(([a-zA-Z0-9-]+)\.)+([a-zA-Z]{2,4}))?$/) ||
-            ($smtputf8 && $username =~
-            /^([a-zA-Z0-9\x{80}-\x{ff}._%+-]+)(\@(([a-zA-Z0-9\x{80}-\x{ff}-]+)\.)+([a-zA-Z]{2,4}))?$/)) {
+        if((!$smtputf8 && $username =~
+           /^([a-zA-Z0-9._%+-]+)(\@(([a-zA-Z0-9-]+)\.)+([a-zA-Z]{2,4}))?$/) ||
+           ($smtputf8 && $username =~
+           /^([a-zA-Z0-9\x{80}-\x{ff}._%+-]+)(\@(([a-zA-Z0-9\x{80}-\x{ff}-]+)\.)+([a-zA-Z]{2,4}))?$/)) {
 
             my @data = getreplydata($smtp_client);
 
             if(!@data) {
-                if ($username !~
-                    /^([a-zA-Z0-9._%+-]+)\@(([a-zA-Z0-9-]+)\.)+([a-zA-Z]{2,4})$/) {
+                if($username !~
+                   /^([a-zA-Z0-9._%+-]+)\@(([a-zA-Z0-9-]+)\.)+([a-zA-Z]{2,4})$/) {
                   push @data, "250 <$username\@example.com>\r\n"
                 }
                 else {
@@ -1102,7 +1143,7 @@ my $cmdid;
 my $selected;
 
 # Any IMAP parameter can come in escaped and in double quotes.
-# This function is dumb (so far) and just removes the quotes if present.
+# This function is dumb (so far) and removes the quotes if present.
 sub fix_imap_params {
     foreach (@_) {
         $_ = $1 if /^"(.*)"$/;
@@ -1144,7 +1185,7 @@ sub LOGIN_imap {
 
     logmsg "LOGIN_imap got $args\n";
 
-    if ($user eq "") {
+    if($user eq "") {
         sendcontrol "$cmdid BAD Command Argument\r\n";
     }
     else {
@@ -1187,7 +1228,7 @@ sub FETCH_imap {
 
     logmsg "FETCH_imap got $args\n";
 
-    if ($selected eq "") {
+    if($selected eq "") {
         sendcontrol "$cmdid BAD Command received in Invalid state\r\n";
     }
     else {
@@ -1232,7 +1273,7 @@ sub FETCH_imap {
 sub APPEND_imap {
     my ($args) = @_;
 
-    logmsg "APPEND_imap got $args\r\n";
+    logmsg "APPEND_imap got $args\n";
 
     $args =~ /^([^ ]+) [^{]*\{(\d+)\}$/;
     my ($mailbox, $size) = ($1, $2);
@@ -1249,7 +1290,7 @@ sub APPEND_imap {
 
         logmsg "Store test number $testno in $filename\n";
 
-        open(my $file, ">", "$filename") ||
+        open(my $file, ">", $filename) or
             return 0; # failed to open output
 
         my $received = 0;
@@ -1285,6 +1326,7 @@ sub APPEND_imap {
             }
             elsif($line eq "DISC\n") {
                 logmsg "Unexpected disconnect!\n";
+                printf SFWRITE "ACKD\n";
                 last;
             }
             else {
@@ -1294,7 +1336,7 @@ sub APPEND_imap {
         }
 
         if($nosave) {
-            print $file "$size bytes would've been stored here\n";
+            print $file "$size bytes would have been stored here\n";
         }
 
         close($file);
@@ -1314,10 +1356,10 @@ sub STORE_imap {
 
     logmsg "STORE_imap got $args\n";
 
-    if ($selected eq "") {
+    if($selected eq "") {
         sendcontrol "$cmdid BAD Command received in Invalid state\r\n";
     }
-    elsif (($uid eq "") || ($what ne "+Flags") || ($value eq "")) {
+    elsif(($uid eq "") || ($what ne "+Flags") || ($value eq "")) {
         sendcontrol "$cmdid BAD Command Argument\r\n";
     }
     else {
@@ -1339,10 +1381,10 @@ sub LIST_imap {
 
     logmsg "LIST_imap got $args\n";
 
-    if ($reference eq "") {
+    if($reference eq "") {
         sendcontrol "$cmdid BAD Command Argument\r\n";
     }
-    elsif ($reference eq "verifiedserver") {
+    elsif($reference eq "verifiedserver") {
         # this is the secret command that verifies that this actually is
         # the curl test server
         sendcontrol "* LIST () \"/\" \"WE ROOLZ: $$\"\r\n";
@@ -1374,7 +1416,7 @@ sub LSUB_imap {
 
     logmsg "LSUB_imap got $args\n";
 
-    if ($reference eq "") {
+    if($reference eq "") {
         sendcontrol "$cmdid BAD Command Argument\r\n";
     }
     else {
@@ -1396,7 +1438,7 @@ sub EXAMINE_imap {
 
     logmsg "EXAMINE_imap got $mailbox\n";
 
-    if ($mailbox eq "") {
+    if($mailbox eq "") {
         sendcontrol "$cmdid BAD Command Argument\r\n";
     }
     else {
@@ -1419,7 +1461,7 @@ sub STATUS_imap {
 
     logmsg "STATUS_imap got $args\n";
 
-    if ($mailbox eq "") {
+    if($mailbox eq "") {
         sendcontrol "$cmdid BAD Command Argument\r\n";
     }
     else {
@@ -1441,10 +1483,10 @@ sub SEARCH_imap {
 
     logmsg "SEARCH_imap got $what\n";
 
-    if ($selected eq "") {
+    if($selected eq "") {
         sendcontrol "$cmdid BAD Command received in Invalid state\r\n";
     }
-    elsif ($what eq "") {
+    elsif($what eq "") {
         sendcontrol "$cmdid BAD Command Argument\r\n";
     }
     else {
@@ -1466,7 +1508,7 @@ sub CREATE_imap {
 
     logmsg "CREATE_imap got $args\n";
 
-    if ($args eq "") {
+    if($args eq "") {
         sendcontrol "$cmdid BAD Command Argument\r\n";
     }
     else {
@@ -1482,7 +1524,7 @@ sub DELETE_imap {
 
     logmsg "DELETE_imap got $args\n";
 
-    if ($args eq "") {
+    if($args eq "") {
         sendcontrol "$cmdid BAD Command Argument\r\n";
     }
     else {
@@ -1499,7 +1541,7 @@ sub RENAME_imap {
 
     logmsg "RENAME_imap got $args\n";
 
-    if (($from_mailbox eq "") || ($to_mailbox eq "")) {
+    if(($from_mailbox eq "") || ($to_mailbox eq "")) {
         sendcontrol "$cmdid BAD Command Argument\r\n";
     }
     else {
@@ -1510,7 +1552,7 @@ sub RENAME_imap {
 }
 
 sub CHECK_imap {
-    if ($selected eq "") {
+    if($selected eq "") {
         sendcontrol "$cmdid BAD Command received in Invalid state\r\n";
     }
     else {
@@ -1521,10 +1563,10 @@ sub CHECK_imap {
 }
 
 sub CLOSE_imap {
-    if ($selected eq "") {
+    if($selected eq "") {
         sendcontrol "$cmdid BAD Command received in Invalid state\r\n";
     }
-    elsif (!@deleted) {
+    elsif(!@deleted) {
         sendcontrol "$cmdid BAD Command Argument\r\n";
     }
     else {
@@ -1537,11 +1579,11 @@ sub CLOSE_imap {
 }
 
 sub EXPUNGE_imap {
-    if ($selected eq "") {
+    if($selected eq "") {
         sendcontrol "$cmdid BAD Command received in Invalid state\r\n";
     }
     else {
-        if (!@deleted) {
+        if(!@deleted) {
             # Report the number of existing messages as per the SELECT
             # command
             sendcontrol "* 172 EXISTS\r\n";
@@ -1568,7 +1610,7 @@ sub COPY_imap {
 
     logmsg "COPY_imap got $args\n";
 
-    if (($uid eq "") || ($mailbox eq "")) {
+    if(($uid eq "") || ($mailbox eq "")) {
         sendcontrol "$cmdid BAD Command Argument\r\n";
     }
     else {
@@ -1592,17 +1634,17 @@ sub UID_imap {
 
     logmsg "UID_imap got $args\n";
 
-    if ($selected eq "") {
+    if($selected eq "") {
         sendcontrol "$cmdid BAD Command received in Invalid state\r\n";
     }
-    elsif (substr($command, 0, 5) eq "FETCH"){
+    elsif(substr($command, 0, 5) eq "FETCH"){
         my $func = $commandfunc{"FETCH"};
         if($func) {
             &$func($args, $command);
         }
     }
-    elsif (($command ne "COPY") &&
-           ($command ne "STORE") && ($command ne "SEARCH")) {
+    elsif(($command ne "COPY") &&
+          ($command ne "STORE") && ($command ne "SEARCH")) {
         sendcontrol "$cmdid BAD Command Argument\r\n";
     }
     else {
@@ -1627,7 +1669,7 @@ sub NOOP_imap {
         "* 14 FETCH (FLAGS (\\Seen \\Deleted))\r\n",
     );
 
-    if ($args) {
+    if($args) {
         sendcontrol "$cmdid BAD Command Argument\r\n";
     }
     else {
@@ -1667,7 +1709,7 @@ sub CAPA_pop3 {
 
     for my $am (@auth_mechs) {
         if(!$mechs) {
-            $mechs = "$am";
+            $mechs = $am;
         }
         else {
             $mechs .= " $am";
@@ -1709,16 +1751,16 @@ sub APOP_pop3 {
     my ($args) = @_;
     my ($user, $secret) = split(/ /, $args, 2);
 
-    if (!grep /^APOP$/, @capabilities) {
+    if(!grep /^APOP$/, @capabilities) {
         sendcontrol "-ERR Unrecognized command\r\n";
     }
-    elsif (($user eq "") || ($secret eq "")) {
+    elsif(($user eq "") || ($secret eq "")) {
         sendcontrol "-ERR Protocol error\r\n";
     }
     else {
         my $digest = Digest::MD5::md5_hex($POP3_TIMESTAMP, $TEXT_PASSWORD);
 
-        if ($secret ne $digest) {
+        if($secret ne $digest) {
             sendcontrol "-ERR Login failure\r\n";
         }
         else {
@@ -1760,7 +1802,7 @@ sub USER_pop3 {
 
     logmsg "USER_pop3 got $user\n";
 
-    if (!$user) {
+    if(!$user) {
         sendcontrol "-ERR Protocol error\r\n";
     }
     else {
@@ -1817,12 +1859,7 @@ sub RETR_pop3 {
 }
 
 sub LIST_pop3 {
-    # This is a built-in fake-message list
-    my @data = (
-        "1 100\r\n",
-        "2 4294967400\r\n",  # > 4 GB
-        "3 200\r\n",
-    );
+    my @data = getpart("reply", "data");
 
     logmsg "retrieve a message list\n";
 
@@ -1843,7 +1880,7 @@ sub DELE_pop3 {
 
     logmsg "DELE_pop3 got $msgid\n";
 
-    if (!$msgid) {
+    if(!$msgid) {
         sendcontrol "-ERR Protocol error\r\n";
     }
     else {
@@ -1858,7 +1895,7 @@ sub DELE_pop3 {
 sub STAT_pop3 {
     my ($args) = @_;
 
-    if ($args) {
+    if($args) {
         sendcontrol "-ERR Protocol error\r\n";
     }
     else {
@@ -1873,7 +1910,7 @@ sub STAT_pop3 {
 sub NOOP_pop3 {
     my ($args) = @_;
 
-    if ($args) {
+    if($args) {
         sendcontrol "-ERR Protocol error\r\n";
     }
     else {
@@ -1891,7 +1928,7 @@ sub UIDL_pop3 {
         "3 4\r\n", # Note that UID 3 is a simulated "deleted" message
     );
 
-    if (!grep /^UIDL$/, @capabilities) {
+    if(!grep /^UIDL$/, @capabilities) {
         sendcontrol "-ERR Unrecognized command\r\n";
     }
     else {
@@ -1916,14 +1953,14 @@ sub TOP_pop3 {
 
     logmsg "TOP_pop3 got $args\n";
 
-    if (!grep /^TOP$/, @capabilities) {
+    if(!grep /^TOP$/, @capabilities) {
         sendcontrol "-ERR Unrecognized command\r\n";
     }
-    elsif (($msgid eq "") || ($lines eq "")) {
+    elsif(($msgid eq "") || ($lines eq "")) {
         sendcontrol "-ERR Protocol error\r\n";
     }
     else {
-        if ($lines == "0") {
+        if($lines == "0") {
             logmsg "retrieve header of mail\n";
         }
         else {
@@ -1950,11 +1987,11 @@ sub TOP_pop3 {
 sub RSET_pop3 {
     my ($args) = @_;
 
-    if ($args) {
+    if($args) {
         sendcontrol "-ERR Protocol error\r\n";
     }
     else {
-        if (@deleted) {
+        if(@deleted) {
             logmsg "resetting @deleted message(s)\n";
 
             @deleted = ();
@@ -1981,33 +2018,33 @@ sub QUIT_pop3 {
 ################
 ################ FTP commands
 ################
-my $rest=0;
+my $rest = 0;
 sub REST_ftp {
     $rest = $_[0];
     logmsg "Set REST position to $rest\n"
 }
 
 sub switch_directory_goto {
-  my $target_dir = $_;
+    my $target_dir = $_;
 
-  if(!$ftptargetdir) {
-    $ftptargetdir = "/";
-  }
+    if(!$ftptargetdir) {
+        $ftptargetdir = "/";
+    }
 
-  if($target_dir eq "") {
-    $ftptargetdir = "/";
-  }
-  elsif($target_dir eq "..") {
-    if($ftptargetdir eq "/") {
-      $ftptargetdir = "/";
+    if($target_dir eq "") {
+        $ftptargetdir = "/";
+    }
+    elsif($target_dir eq "..") {
+        if($ftptargetdir eq "/") {
+            $ftptargetdir = "/";
+        }
+        else {
+            $ftptargetdir =~ s/[[:alnum:]]+\/$//;
+        }
     }
     else {
-      $ftptargetdir =~ s/[[:alnum:]]+\/$//;
+        $ftptargetdir .= $target_dir . "/";
     }
-  }
-  else {
-    $ftptargetdir .= $target_dir . "/";
-  }
 }
 
 sub switch_directory {
@@ -2031,7 +2068,8 @@ sub CWD_ftp {
   my ($folder, $fullcommand) = $_[0];
   switch_directory($folder);
   if($ftptargetdir =~ /^\/fully_simulated/) {
-    $ftplistparserstate = "enabled";
+      $ftplistparserstate = "enabled";
+      logmsg "enabled FTP list parser mode\n";
   }
   else {
     undef $ftplistparserstate;
@@ -2051,19 +2089,6 @@ sub PWD_ftp {
 sub LIST_ftp {
     #  print "150 ASCII data connection for /bin/ls (193.15.23.1,59196) (0 bytes)\r\n";
 
-# this is a built-in fake-dir ;-)
-my @ftpdir=("total 20\r\n",
-"drwxr-xr-x   8 98       98           512 Oct 22 13:06 .\r\n",
-"drwxr-xr-x   8 98       98           512 Oct 22 13:06 ..\r\n",
-"drwxr-xr-x   2 98       98           512 May  2  1996 .NeXT\r\n",
-"-r--r--r--   1 0        1             35 Jul 16  1996 README\r\n",
-"lrwxrwxrwx   1 0        1              7 Dec  9  1999 bin -> usr/bin\r\n",
-"dr-xr-xr-x   2 0        1            512 Oct  1  1997 dev\r\n",
-"drwxrwxrwx   2 98       98           512 May 29 16:04 download.html\r\n",
-"dr-xr-xr-x   2 0        1            512 Nov 30  1995 etc\r\n",
-"drwxrwxrwx   2 98       1            512 Oct 30 14:33 pub\r\n",
-"dr-xr-xr-x   5 0        1            512 Oct  1  1997 usr\r\n");
-
     if($datasockf_conn eq 'no') {
         if($nodataconn425) {
             sendcontrol "150 Opening data connection\r\n";
@@ -2083,15 +2108,17 @@ my @ftpdir=("total 20\r\n",
         return 0;
     }
 
-    if($ftplistparserstate) {
-      @ftpdir = ftp_contentlist($ftptargetdir);
-    }
-
     logmsg "pass LIST data on data connection\n";
 
-    if($cwd_testno) {
-        loadtest("$logdir/test$cwd_testno");
-
+    if($ftplistparserstate) {
+        # provide a synthetic response
+        my @ftpdir = ftp_contentlist($ftptargetdir);
+        # old hard-coded style
+        for(@ftpdir) {
+            senddata $_;
+        }
+    }
+    else {
         my @data = getpart("reply", "data");
         for(@data) {
             my $send = $_;
@@ -2101,13 +2128,6 @@ my @ftpdir=("total 20\r\n",
             logmsg "send $send as data\n";
             senddata $send;
         }
-        $cwd_testno = 0; # forget it again
-    }
-    else {
-        # old hard-coded style
-        for(@ftpdir) {
-            senddata $_;
-        }
     }
     close_dataconn(0);
     sendcontrol "226 ASCII transfer complete\r\n";
@@ -2115,7 +2135,7 @@ my @ftpdir=("total 20\r\n",
 }
 
 sub NLST_ftp {
-    my @ftpdir=("file", "with space", "fake", "..", " ..", "funny", "README");
+    my @ftpdir = ("file", "with space", "fake", "..", " ..", "funny", "README");
 
     if($datasockf_conn eq 'no') {
         if($nodataconn425) {
@@ -2148,7 +2168,7 @@ sub NLST_ftp {
 sub MDTM_ftp {
     my $testno = $_[0];
     my $testpart = "";
-    if ($testno > 10000) {
+    if($testno > 10000) {
         $testpart = $testno % 10000;
         $testno = int($testno / 10000);
     }
@@ -2174,6 +2194,7 @@ sub MDTM_ftp {
 
 sub SIZE_ftp {
     my $testno = $_[0];
+
     if($ftplistparserstate) {
         my $size = wildcard_filesize($ftptargetdir, $testno);
         if($size == -1) {
@@ -2212,6 +2233,7 @@ sub SIZE_ftp {
     my $size = $data[0];
 
     if($size) {
+        $size += 0; # make it a number
         if($size > -1) {
             sendcontrol "213 $size\r\n";
         }
@@ -2220,7 +2242,7 @@ sub SIZE_ftp {
         }
     }
     else {
-        $size=0;
+        $size = 0;
         @data = getpart("reply", "data$testpart");
         for(@data) {
             $size += length($_);
@@ -2289,7 +2311,7 @@ sub RETR_ftp {
 
     $testno =~ s/^([^0-9]*)//;
     my $testpart = "";
-    if ($testno > 10000) {
+    if($testno > 10000) {
         $testpart = $testno % 10000;
         $testno = int($testno / 10000);
     }
@@ -2298,7 +2320,7 @@ sub RETR_ftp {
 
     my @data = getpart("reply", "data$testpart");
 
-    my $size=0;
+    my $size = 0;
     for(@data) {
         $size += length($_);
     }
@@ -2322,7 +2344,7 @@ sub RETR_ftp {
                 senddata $send;
             }
             close_dataconn(0);
-            $retrweirdo=0; # switch off the weirdo again!
+            $retrweirdo = 0; # switch off the weirdo again!
         }
         else {
             my $sz = "($size bytes)";
@@ -2333,7 +2355,7 @@ sub RETR_ftp {
                 $sz = "($retrsize bytes)";
             }
 
-            sendcontrol "150 Binary data connection for $testno () $sz.\r\n";
+            sendcontrol "150 Binary data connection for $testno ($testpart) $sz.\r\n";
 
             for(@data) {
                 my $send = $_;
@@ -2350,7 +2372,7 @@ sub RETR_ftp {
 }
 
 sub STOR_ftp {
-    my $testno=$_[0];
+    my $testno = $_[0];
 
     my $filename = "$logdir/upload.$testno";
 
@@ -2377,13 +2399,13 @@ sub STOR_ftp {
 
     sendcontrol "125 Gimme gimme gimme!\r\n";
 
-    open(my $file, ">", "$filename") ||
+    open(my $file, ">", $filename) or
         return 0; # failed to open output
 
     my $line;
-    my $ulsize=0;
-    my $disc=0;
-    while (5 == (sysread DREAD, $line, 5)) {
+    my $ulsize = 0;
+    my $disc = 0;
+    while(5 == (sysread DREAD, $line, 5)) {
         if($line eq "DATA\n") {
             my $i;
             sysread DREAD, $i, 5;
@@ -2403,7 +2425,8 @@ sub STOR_ftp {
         }
         elsif($line eq "DISC\n") {
             # disconnect!
-            $disc=1;
+            $disc = 1;
+            printf DWRITE "ACKD\n";
             last;
         }
         else {
@@ -2416,7 +2439,7 @@ sub STOR_ftp {
         }
     }
     if($nosave) {
-        print $file "$ulsize bytes would've been stored here\n";
+        print $file "$ulsize bytes would have been stored here\n";
     }
     close($file);
     close_dataconn($disc);
@@ -2431,9 +2454,8 @@ sub STOR_ftp {
 }
 
 sub PASV_ftp {
-    my ($arg, $cmd)=@_;
+    my ($arg, $cmd) = @_;
     my $pasvport;
-    my $bindonly = ($nodataconn) ? '--bindonly' : '';
 
     # kill previous data connection sockfilt when alive
     if($datasockf_runs eq 'yes') {
@@ -2447,11 +2469,14 @@ sub PASV_ftp {
     logmsg "DATA sockfilt for passive data channel starting...\n";
 
     # We fire up a new sockfilt to do the data transfer for us.
-    my $datasockfcmd = "./server/sockfilt".exe_ext('SRV')." " .
-        "--ipv$ipvnum $bindonly --port 0 " .
-        "--pidfile \"$datasockf_pidfile\" " .
-        "--logfile \"$datasockf_logfile\"";
-    $slavepid = open2(\*DREAD, \*DWRITE, $datasockfcmd);
+    my @datasockfcmd = (server_exe_args('sockfilt'),
+        "--ipv$ipvnum", "--port", 0,
+        "--pidfile", $datasockf_pidfile,
+        "--logfile", $datasockf_logfile);
+    if($nodataconn) {
+        push(@datasockfcmd, '--bindonly');
+    }
+    $slavepid = open2(\*DREAD, \*DWRITE, @datasockfcmd);
 
     if($nodataconn) {
         datasockf_state('PASSIVE_NODATACONN');
@@ -2460,7 +2485,7 @@ sub PASV_ftp {
         datasockf_state('PASSIVE');
     }
 
-    print STDERR "$datasockfcmd\n" if($verbose);
+    print STDERR "@datasockfcmd\n" if($verbose);
 
     print DWRITE "PING\n";
     my $pong;
@@ -2536,17 +2561,17 @@ sub PASV_ftp {
 
     if($cmd ne "EPSV") {
         # PASV reply
-        my $p=$listenaddr;
+        my $p = $listenaddr;
         $p =~ s/\./,/g;
         if($pasvbadip) {
-            $p="1,2,3,4";
+            $p = "1,2,3,4";
         }
-        sendcontrol sprintf("227 Entering Passive Mode ($p,%d,%d)\n",
-                            int($pasvport/256), int($pasvport%256));
+        sendcontrol sprintf("227 Entering Passive Mode ($p,%d,%d)\r\n",
+                            int($pasvport / 256), int($pasvport % 256));
     }
     else {
         # EPSV reply
-        sendcontrol sprintf("229 Entering Passive Mode (|||%d|)\n", $pasvport);
+        sendcontrol sprintf("229 Entering Passive Mode (|||%d|)\r\n", $pasvport);
     }
 
     logmsg "Client has been notified that DATA conn ".
@@ -2562,7 +2587,7 @@ sub PASV_ftp {
         local $SIG{ALRM} = sub { die "alarm\n" };
 
         # assume swift operations unless explicitly slow
-        alarm ($datadelay?20:2);
+        alarm ($datadelay ? 20 : 2);
 
         # Wait for 'CNCT'
         my $input;
@@ -2581,7 +2606,7 @@ sub PASV_ftp {
         }
         alarm 0;
     };
-    if ($@) {
+    if($@) {
         # timed out
         logmsg "$srvrname server timed out awaiting data connection ".
             "on port $pasvport\n";
@@ -2627,7 +2652,7 @@ sub PORT_ftp {
             sendcontrol "500 silly you, go away\r\n";
             return;
         }
-        $port = ($5<<8)+$6;
+        $port = ($5 << 8) + $6;
         $addr = "$1.$2.$3.$4";
     }
     # EPRT |2|::1|49706|
@@ -2666,15 +2691,15 @@ sub PORT_ftp {
     logmsg "DATA sockfilt for active data channel starting...\n";
 
     # We fire up a new sockfilt to do the data transfer for us.
-    my $datasockfcmd = "./server/sockfilt".exe_ext('SRV')." " .
-        "--ipv$ipvnum --connect $port --addr \"$addr\" " .
-        "--pidfile \"$datasockf_pidfile\" " .
-        "--logfile \"$datasockf_logfile\"";
-    $slavepid = open2(\*DREAD, \*DWRITE, $datasockfcmd);
+    my @datasockfcmd = (server_exe_args('sockfilt'),
+        "--ipv$ipvnum", "--connect", $port, "--addr", $addr,
+        "--pidfile", $datasockf_pidfile,
+        "--logfile", $datasockf_logfile);
+    $slavepid = open2(\*DREAD, \*DWRITE, @datasockfcmd);
 
     datasockf_state('ACTIVE');
 
-    print STDERR "$datasockfcmd\n" if($verbose);
+    print STDERR "@datasockfcmd\n" if($verbose);
 
     print DWRITE "PING\n";
     my $pong;
@@ -2716,47 +2741,47 @@ sub PORT_ftp {
 sub datasockf_state {
     my $state = $_[0];
 
-  if($state eq 'STOPPED') {
-    # Data sockfilter initial state, not running,
-    # not connected and not used.
-    $datasockf_state = $state;
-    $datasockf_mode = 'none';
-    $datasockf_runs = 'no';
-    $datasockf_conn = 'no';
-  }
-  elsif($state eq 'PASSIVE') {
-    # Data sockfilter accepted connection from client.
-    $datasockf_state = $state;
-    $datasockf_mode = 'passive';
-    $datasockf_runs = 'yes';
-    $datasockf_conn = 'yes';
-  }
-  elsif($state eq 'ACTIVE') {
-    # Data sockfilter has connected to client.
-    $datasockf_state = $state;
-    $datasockf_mode = 'active';
-    $datasockf_runs = 'yes';
-    $datasockf_conn = 'yes';
-  }
-  elsif($state eq 'PASSIVE_NODATACONN') {
-    # Data sockfilter bound port without listening,
-    # client won't be able to establish data connection.
-    $datasockf_state = $state;
-    $datasockf_mode = 'passive';
-    $datasockf_runs = 'yes';
-    $datasockf_conn = 'no';
-  }
-  elsif($state eq 'ACTIVE_NODATACONN') {
-    # Data sockfilter does not even run,
-    # client awaits data connection from server in vain.
-    $datasockf_state = $state;
-    $datasockf_mode = 'active';
-    $datasockf_runs = 'no';
-    $datasockf_conn = 'no';
-  }
-  else {
-      die "Internal error. Unknown datasockf state: $state!";
-  }
+    if($state eq 'STOPPED') {
+        # Data sockfilter initial state, not running,
+        # not connected and not used.
+        $datasockf_state = $state;
+        $datasockf_mode = 'none';
+        $datasockf_runs = 'no';
+        $datasockf_conn = 'no';
+    }
+    elsif($state eq 'PASSIVE') {
+        # Data sockfilter accepted connection from client.
+        $datasockf_state = $state;
+        $datasockf_mode = 'passive';
+        $datasockf_runs = 'yes';
+        $datasockf_conn = 'yes';
+    }
+    elsif($state eq 'ACTIVE') {
+        # Data sockfilter has connected to client.
+        $datasockf_state = $state;
+        $datasockf_mode = 'active';
+        $datasockf_runs = 'yes';
+        $datasockf_conn = 'yes';
+    }
+    elsif($state eq 'PASSIVE_NODATACONN') {
+        # Data sockfilter bound port without listening,
+        # client will not be able to establish data connection.
+        $datasockf_state = $state;
+        $datasockf_mode = 'passive';
+        $datasockf_runs = 'yes';
+        $datasockf_conn = 'no';
+    }
+    elsif($state eq 'ACTIVE_NODATACONN') {
+        # Data sockfilter does not even run,
+        # client awaits data connection from server in vain.
+        $datasockf_state = $state;
+        $datasockf_mode = 'active';
+        $datasockf_runs = 'no';
+        $datasockf_conn = 'no';
+    }
+    else {
+        die "Internal error. Unknown datasockf state: $state!";
+    }
 }
 
 #**********************************************************************
@@ -2770,7 +2795,7 @@ sub nodataconn_str {
     $str = 'NODATACONN425' if($nodataconn425);
     $str = 'NODATACONN421' if($nodataconn421);
     $str = 'NODATACONN150' if($nodataconn150);
-    return "$str";
+    return $str;
 }
 
 #**********************************************************************
@@ -2780,6 +2805,7 @@ sub nodataconn_str {
 # On success returns 1, otherwise zero.
 #
 sub customize {
+    my($cmdfile) = @_;
     $ctrldelay = 0;     # default is no throttling of the ctrl stream
     $datadelay = 0;     # default is no throttling of the data stream
     $retrweirdo = 0;    # default is no use of RETRWEIRDO
@@ -2800,23 +2826,23 @@ sub customize {
     %customcount = ();  #
     %delayreply = ();   #
 
-    open(my $custom, "<", "$logdir/$SERVERCMD") ||
+    open(my $custom, "<", "$logdir/$SERVERCMD") or
         return 1;
 
     logmsg "FTPD: Getting commands from $logdir/$SERVERCMD\n";
 
     while(<$custom>) {
         if($_ =~ /REPLY \"([A-Z]+ [A-Za-z0-9+-\/=\*. ]+)\" (.*)/) {
-            $fulltextreply{$1}=eval "qq{$2}";
+            $fulltextreply{$1} = eval "qq{$2}";
             logmsg "FTPD: set custom reply for $1\n";
         }
         elsif($_ =~ /REPLY(LF|) ([A-Za-z0-9+\/=\*]*) (.*)/) {
-            $commandreply{$2}=eval "qq{$3}";
+            $commandreply{$2} = eval "qq{$3}";
             if($1 ne "LF") {
-                $commandreply{$2}.="\r\n";
+                $commandreply{$2} .= "\r\n";
             }
             else {
-                $commandreply{$2}.="\n";
+                $commandreply{$2} .= "\n";
             }
             if($2 eq "") {
                 logmsg "FTPD: set custom reply for empty command\n";
@@ -2828,29 +2854,34 @@ sub customize {
         elsif($_ =~ /COUNT ([A-Z]+) (.*)/) {
             # we blank the custom reply for this command when having
             # been used this number of times
-            $customcount{$1}=$2;
+            $customcount{$1} = $2;
             logmsg "FTPD: blank custom reply for $1 command after $2 uses\n";
         }
         elsif($_ =~ /DELAY ([A-Z]+) (\d*)/) {
-            $delayreply{$1}=$2;
+            $delayreply{$1} = $2;
             logmsg "FTPD: delay reply for $1 with $2 seconds\n";
         }
         elsif($_ =~ /POSTFETCH (.*)/) {
             logmsg "FTPD: read POSTFETCH header data\n";
             $postfetch = $1;
         }
+        elsif($_ =~ /SLOWDOWNDATA/) {
+            $ctrldelay = 0;
+            $datadelay = 0.005;
+            logmsg "FTPD: send response data with 5ms delay per byte\n";
+        }
         elsif($_ =~ /SLOWDOWN/) {
-            $ctrldelay=1;
-            $datadelay=1;
-            logmsg "FTPD: send response with 0.01 sec delay between each byte\n";
+            $ctrldelay = 0.005;
+            $datadelay = 0.005;
+            logmsg "FTPD: send response with 5ms delay between each byte\n";
         }
         elsif($_ =~ /RETRWEIRDO/) {
             logmsg "FTPD: instructed to use RETRWEIRDO\n";
-            $retrweirdo=1;
+            $retrweirdo = 1;
         }
         elsif($_ =~ /RETRNOSIZE/) {
             logmsg "FTPD: instructed to use RETRNOSIZE\n";
-            $retrnosize=1;
+            $retrnosize = 1;
         }
         elsif($_ =~ /RETRSIZE (\d+)/) {
             $retrsize= $1;
@@ -2858,33 +2889,33 @@ sub customize {
         }
         elsif($_ =~ /PASVBADIP/) {
             logmsg "FTPD: instructed to use PASVBADIP\n";
-            $pasvbadip=1;
+            $pasvbadip = 1;
         }
         elsif($_ =~ /NODATACONN425/) {
             # applies to both active and passive FTP modes
             logmsg "FTPD: instructed to use NODATACONN425\n";
-            $nodataconn425=1;
-            $nodataconn=1;
+            $nodataconn425 = 1;
+            $nodataconn = 1;
         }
         elsif($_ =~ /NODATACONN421/) {
             # applies to both active and passive FTP modes
             logmsg "FTPD: instructed to use NODATACONN421\n";
-            $nodataconn421=1;
-            $nodataconn=1;
+            $nodataconn421 = 1;
+            $nodataconn = 1;
         }
         elsif($_ =~ /NODATACONN150/) {
             # applies to both active and passive FTP modes
             logmsg "FTPD: instructed to use NODATACONN150\n";
-            $nodataconn150=1;
-            $nodataconn=1;
+            $nodataconn150 = 1;
+            $nodataconn = 1;
         }
         elsif($_ =~ /NODATACONN/) {
             # applies to both active and passive FTP modes
             logmsg "FTPD: instructed to use NODATACONN\n";
-            $nodataconn=1;
+            $nodataconn = 1;
         }
         elsif($_ =~ /^STOR (.*)/) {
-            $storeresp=$1;
+            $storeresp = $1;
             logmsg "FTPD: instructed to use respond to STOR with '$storeresp'\n";
         }
         elsif($_ =~ /CAPA (.*)/) {
@@ -2899,7 +2930,7 @@ sub customize {
             @auth_mechs = split(/ /, $1);
         }
         elsif($_ =~ /NOSAVE/) {
-            # don't actually store the file we upload - to be used when
+            # do not actually store the file we upload - to be used when
             # uploading insanely huge amounts
             $nosave = 1;
             logmsg "FTPD: NOSAVE prevents saving of uploaded data\n";
@@ -3013,7 +3044,7 @@ while(@ARGV) {
         }
     }
     else {
-        print STDERR "\nWarning: ftpserver.pl unknown parameter: $ARGV[0]\n";
+        print STDERR "\nWarning: ftpserver.pl unknown parameter: '$ARGV[0]'\n";
     }
     shift @ARGV;
 }
@@ -3054,7 +3085,7 @@ if($proto eq 'ftp') {
 $srvrname = servername_str($proto, $ipvnum, $idnum);
 $serverlogs_lockfile = "$logdir/$LOCKDIR/${srvrname}.lock";
 
-$idstr = "$idnum" if($idnum > 1);
+$idstr = $idnum if($idnum > 1);
 
 protocolsetup($proto);
 
@@ -3066,7 +3097,7 @@ startsf();
 # actual port
 if($portfile && !$port) {
     my $aport;
-    open(my $p, "<", "$portfile");
+    open(my $p, "<", $portfile);
     $aport = <$p>;
     close($p);
     $port = 0 + $aport;
@@ -3074,7 +3105,7 @@ if($portfile && !$port) {
 
 logmsg sprintf("%s server listens on port IPv${ipvnum}/${port}\n", uc($proto));
 
-open(my $pid, ">", "$pidfile");
+open(my $pid, ">", $pidfile);
 print $pid $$."\n";
 close($pid);
 
@@ -3119,7 +3150,7 @@ while(1) {
     }
     else {
         # clear it after use
-        $commandreply{"welcome"}="";
+        $commandreply{"welcome"} = "";
         if($welcome !~ /\r\n\z/) {
             $welcome .= "\r\n";
         }
@@ -3153,6 +3184,7 @@ while(1) {
             logmsg "MAIN sockfilt said $i";
             if($i =~ /^DISC/) {
                 # disconnect
+                printf SFWRITE "ACKD\n";
                 last;
             }
             next;
@@ -3185,21 +3217,21 @@ while(1) {
             # IMAP is different with its identifier first on the command line
             if(($full =~ /^([^ ]+) ([^ ]+) (.*)/) ||
                ($full =~ /^([^ ]+) ([^ ]+)/)) {
-                $cmdid=$1; # set the global variable
-                $FTPCMD=$2;
-                $FTPARG=$3;
+                $cmdid = $1; # set the global variable
+                $FTPCMD = $2;
+                $FTPARG = $3;
             }
             # IMAP authentication cancellation
             elsif($full =~ /^\*$/) {
                 # Command id has already been set
-                $FTPCMD="*";
-                $FTPARG="";
+                $FTPCMD = "*";
+                $FTPARG = "";
             }
             # IMAP long "commands" are base64 authentication data
             elsif($full =~ /^[A-Z0-9+\/]*={0,2}$/i) {
                 # Command id has already been set
-                $FTPCMD=$full;
-                $FTPARG="";
+                $FTPCMD = $full;
+                $FTPARG = "";
             }
             else {
                 sendcontrol "$full BAD Command\r\n";
@@ -3207,19 +3239,19 @@ while(1) {
             }
         }
         elsif($full =~ /^([A-Z]{3,4})(\s(.*))?$/i) {
-            $FTPCMD=$1;
-            $FTPARG=$3;
+            $FTPCMD = $1;
+            $FTPARG = $3;
         }
         elsif($proto eq "pop3") {
             # POP3 authentication cancellation
             if($full =~ /^\*$/) {
-                $FTPCMD="*";
-                $FTPARG="";
+                $FTPCMD = "*";
+                $FTPARG = "";
             }
             # POP3 long "commands" are base64 authentication data
             elsif($full =~ /^[A-Z0-9+\/]*={0,2}$/i) {
-                $FTPCMD=$full;
-                $FTPARG="";
+                $FTPCMD = $full;
+                $FTPARG = "";
             }
             else {
                 sendcontrol "-ERR Unrecognized command\r\n";
@@ -3229,13 +3261,13 @@ while(1) {
         elsif($proto eq "smtp") {
             # SMTP authentication cancellation
             if($full =~ /^\*$/) {
-                $FTPCMD="*";
-                $FTPARG="";
+                $FTPCMD = "*";
+                $FTPARG = "";
             }
             # SMTP long "commands" are base64 authentication data
             elsif($full =~ /^[A-Z0-9+\/]{0,512}={0,2}$/i) {
-                $FTPCMD=$full;
-                $FTPARG="";
+                $FTPCMD = $full;
+                $FTPARG = "";
             }
             else {
                 sendcontrol "500 Unrecognized command\r\n";
@@ -3257,11 +3289,11 @@ while(1) {
 
         my $delay = $delayreply{$FTPCMD};
         if($delay) {
-            # just go sleep this many seconds!
+            # go sleep this many seconds!
             logmsg("Sleep for $delay seconds\n");
             my $twentieths = $delay * 20;
             while($twentieths--) {
-                portable_sleep(0.05) unless($got_exit_signal);
+                Time::HiRes::sleep(0.05) unless($got_exit_signal);
             }
         }
 
@@ -3280,7 +3312,7 @@ while(1) {
             if($text && ($text ne "")) {
                 if($customcount{$FTPCMD} && (!--$customcount{$FTPCMD})) {
                     # used enough times so blank the custom command reply
-                    $commandreply{$FTPCMD}="";
+                    $commandreply{$FTPCMD} = "";
                 }
 
                 sendcontrol $text;
@@ -3300,7 +3332,7 @@ while(1) {
                     $check = 0;
                 }
 
-                # only perform this if we're not faking a reply
+                # only perform this if we are not faking a reply
                 my $func = $commandfunc{uc($FTPCMD)};
                 if($func) {
                     &$func($FTPARG, $FTPCMD);
@@ -3310,7 +3342,7 @@ while(1) {
         }
 
         if($check) {
-            logmsg "$FTPCMD wasn't handled!\n";
+            logmsg "$FTPCMD was not handled!\n";
             if($proto eq 'pop3') {
                 sendcontrol "-ERR $FTPCMD is not dealt with!\r\n";
             }
diff --git a/third-party/curl/tests/getpart.pm b/third-party/curl/tests/getpart.pm
index ed60feca52..fc98da210c 100644
--- a/third-party/curl/tests/getpart.pm
+++ b/third-party/curl/tests/getpart.pm
@@ -33,6 +33,7 @@ BEGIN {
     our @EXPORT = qw(
         compareparts
         fulltest
+        checktest
         getpart
         getpartattr
         loadarray
@@ -44,17 +45,16 @@ BEGIN {
 }
 
 use Memoize;
-use MIME::Base64;
 
 my @xml;      # test data file contents
-my $xmlfile;  # test data file name
+my $xmlfile;  # test data filename
 
-my $warning=0;
-my $trace=0;
+my $warning = 0;
+my $trace = 0;
 
 # Normalize the part function arguments for proper caching. This includes the
-# file name in the arguments since that is an implied parameter that affects the
-# return value.  Any error messages will only be displayed the first time, but
+# filename in the arguments since that is an implied parameter that affects the
+# return value.  Any error messages are only displayed the first time, but
 # those are disabled by default anyway, so should never been seen outside
 # development.
 sub normalize_part {
@@ -62,24 +62,16 @@ sub normalize_part {
     return join("\t", @_);
 }
 
-sub decode_hex {
-    my $s = $_;
-    # remove everything not hex
-    $s =~ s/[^A-Fa-f0-9]//g;
-    # encode everything
-    $s =~ s/([a-fA-F0-9][a-fA-F0-9])/chr(hex($1))/eg;
-    return $s;
-}
-
 sub testcaseattr {
     my %hash;
     for(@xml) {
         if(($_ =~ /^ *\<testcase ([^>]*)/)) {
-            my $attr=$1;
-            while($attr =~ s/ *([^=]*)= *(\"([^\"]*)\"|([^\> ]*))//) {
-                my ($var, $cont)=($1, $2);
+            my $attr = $1;
+            while($attr =~ s/ *([^=]*)= *(\"([^\"]*)\"|\'([^\']*)\')//) {
+                my ($var, $cont) = ($1, $2);
                 $cont =~ s/^\"(.*)\"$/$1/;
-                $hash{$var}=$cont;
+                $cont =~ s/^\'(.*)\'$/$1/;
+                $hash{$var} = $cont;
             }
         }
     }
@@ -90,36 +82,37 @@ sub getpartattr {
     # if $part is undefined (ie only one argument) then
     # return the attributes of the section
 
-    my ($section, $part)=@_;
+    my ($section, $part) = @_;
 
     my %hash;
-    my $inside=0;
+    my $inside = 0;
 
- #   print "Section: $section, part: $part\n";
+  # print "Section: $section, part: $part\n";
 
     for(@xml) {
- #       print "$inside: $_";
+      # print "$inside: $_";
         if(!$inside && ($_ =~ /^ *\<$section/)) {
             $inside++;
         }
-        if((1 ==$inside) && ( ($_ =~ /^ *\<$part ([^>]*)/) ||
-                              !(defined($part)) )
+        if((1 == $inside) && (($_ =~ /^ *\<$part ([^>]*)/) ||
+                              !(defined($part)))
              ) {
             $inside++;
-            my $attr=$1;
+            my $attr = $1;
 
-            while($attr =~ s/ *([^=]*)= *(\"([^\"]*)\"|([^\> ]*))//) {
-                my ($var, $cont)=($1, $2);
+            while($attr =~ s/ *([^=]*)= *(\"([^\"]*)\"|\'([^\']*)\')//) {
+                my ($var, $cont) = ($1, $2);
                 $cont =~ s/^\"(.*)\"$/$1/;
-                $hash{$var}=$cont;
+                $cont =~ s/^\'(.*)\'$/$1/;
+                $hash{$var} = $cont;
             }
             last;
         }
-        # detect end of section when part wasn't found
-        elsif((1 ==$inside) && ($_ =~ /^ *\<\/$section\>/)) {
+        # detect end of section when part was not found
+        elsif((1 == $inside) && ($_ =~ /^ *\<\/$section\>/)) {
             last;
         }
-        elsif((2 ==$inside) && ($_ =~ /^ *\<\/$part/)) {
+        elsif((2 == $inside) && ($_ =~ /^ *\<\/$part/)) {
             $inside--;
         }
     }
@@ -128,12 +121,10 @@ sub getpartattr {
 memoize('getpartattr', NORMALIZER => 'normalize_part');  # cache each result
 
 sub getpart {
-    my ($section, $part)=@_;
+    my ($section, $part) = @_;
 
     my @this;
-    my $inside=0;
-    my $base64=0;
-    my $hex=0;
+    my $inside = 0;
     my $line;
 
     for(@xml) {
@@ -145,14 +136,6 @@ sub getpart {
             if($inside > 1) {
                 push @this, $_;
             }
-            elsif($_ =~ /$part [^>]*base64=/) {
-                # attempt to detect our base64 encoded part
-                $base64=1;
-            }
-            elsif($_ =~ /$part [^>]*hex=/) {
-                # attempt to detect a hex-encoded part
-                $hex=1;
-            }
             $inside++;
         }
         elsif(($inside >= 2) && ($_ =~ /^ *\<\/$part[ \>]/)) {
@@ -172,20 +155,6 @@ sub getpart {
             if($warning && !@this) {
                 print STDERR "*** getpart.pm: $section/$part returned empty!\n";
             }
-            if($base64) {
-                # decode the whole array before returning it!
-                for(@this) {
-                    my $decoded = decode_base64($_);
-                    $_ = $decoded;
-                }
-            }
-            elsif($hex) {
-                # decode the whole array before returning it!
-                for(@this) {
-                    my $decoded = decode_hex($_);
-                    $_ = $decoded;
-                }
-            }
             return @this;
         }
         elsif($inside >= 2) {
@@ -207,7 +176,7 @@ sub getpart {
 memoize('getpart', NORMALIZER => 'normalize_part');  # cache each result
 
 sub partexists {
-    my ($section, $part)=@_;
+    my ($section, $part) = @_;
 
     my $inside = 0;
 
@@ -224,12 +193,13 @@ sub partexists {
     }
     return 0; # does not exist
 }
+
 # The code currently never calls this more than once per part per file, so
-# caching a result that will never be used again just slows things down.
+# caching a result that is never used again only slows things down.
 # memoize('partexists', NORMALIZER => 'normalize_part');  # cache each result
 
 sub loadtest {
-    my ($file)=@_;
+    my ($file, $original) = @_;
 
     if(defined $xmlfile && $file eq $xmlfile) {
         # This test is already loaded
@@ -239,17 +209,26 @@ sub loadtest {
     undef @xml;
     $xmlfile = "";
 
-    if(open(my $xmlh, "<", "$file")) {
-        binmode $xmlh; # for crapage systems, use binary
+    if(open(my $xmlh, "<", $file)) {
+        if($original) {
+            binmode $xmlh, ':crlf';
+        }
+        else {
+            binmode $xmlh; # for crapage systems, use binary
+        }
         while(<$xmlh>) {
             push @xml, $_;
         }
         close($xmlh);
+        if(!@xml) {
+            print STDERR "file $file is empty!\n";
+            return 1;
+        }
     }
     else {
         # failure
         if($warning) {
-            print STDERR "file $file wouldn't open!\n";
+            print STDERR "file $file would not open!\n";
         }
         return 1;
     }
@@ -257,17 +236,61 @@ sub loadtest {
     return 0;
 }
 
-
 # Return entire document as list of lines
 sub fulltest {
     return @xml;
 }
 
+sub eol_detect {
+    my ($content) = @_;
+
+    my $cr = () = $content =~ /\r/g;
+    my $lf = () = $content =~ /\n/g;
+
+    if($cr > 0 && $lf == 0) {
+        return "cr";
+    }
+    elsif($cr == 0 && $lf > 0) {
+        return "lf";
+    }
+    elsif($cr == 0 && $lf == 0) {
+        return "bin";
+    }
+    elsif($cr == $lf) {
+        return "crlf";
+    }
+
+    return "";
+}
+
+sub checktest {
+    my ($file) = @_;
+
+    if(open(my $xmlh, '<', $file)) {
+        binmode $xmlh; # we want the raw data to check original newlines
+        my $content = do { local $/; <$xmlh> };
+        close($xmlh);
+
+        if(index($content, '<?xml version="1.0" encoding="US-ASCII"?>') != 0) {
+            print STDERR "*** getpart.pm: $xmlfile is missing the XML prolog.\n";
+            return 1;
+        }
+
+        my $eol = eol_detect($content);
+        if($eol eq '') {
+            print STDERR "*** getpart.pm: $xmlfile has mixed newlines. Replace significant carriage return with %CR macro, or convert to consistent newlines.\n";
+            return 1;
+        }
+    }
+
+    return 0;
+}
+
 # write the test to the given file
 sub savetest {
-    my ($file)=@_;
+    my ($file) = @_;
 
-    if(open(my $xmlh, ">", "$file")) {
+    if(open(my $xmlh, ">", $file)) {
         binmode $xmlh; # for crapage systems, use binary
         for(@xml) {
             print $xmlh $_;
@@ -277,7 +300,7 @@ sub savetest {
     else {
         # failure
         if($warning) {
-            print STDERR "file $file wouldn't open!\n";
+            print STDERR "file $file would not open!\n";
         }
         return 1;
     }
@@ -288,7 +311,6 @@ sub savetest {
 # Strip off all lines that match the specified pattern and return
 # the new array.
 #
-
 sub striparray {
     my ($pattern, $arrayref) = @_;
 
@@ -306,47 +328,80 @@ sub striparray {
 # pass array *REFERENCES* !
 #
 sub compareparts {
- my ($firstref, $secondref)=@_;
+    my ($firstref, $secondref) = @_;
 
- my $first = join("", @$firstref);
- my $second = join("", @$secondref);
+    # we cannot compare arrays index per index since with data chunks,
+    # they may not be "evenly" distributed
+    my $first = join("", @$firstref);
+    my $second = join("", @$secondref);
 
- # we cannot compare arrays index per index since with the base64 chunks,
- # they may not be "evenly" distributed
+    if($first =~ /%alternatives\[/) {
+        die "bad use of compareparts\n";
+    }
 
- # NOTE: this no longer strips off carriage returns from the arrays. Is that
- # really necessary? It ruins the testing of newlines. I believe it was once
- # added to enable tests on win32.
+    if($second =~ /%alternatives\[([^,]*),([^\]]*)\]/) {
+        # there can be many %alternatives in this chunk, so we call
+        # this function recursively
+        my $alt = $second;
+        $alt =~ s/%alternatives\[([^,]*),([^\]]*)\]/$1/;
 
- if($first ne $second) {
-     return 1;
- }
+        # check first alternative
+        {
+            my @f;
+            my @s;
+            push @f, $first;
+            push @s, $alt;
+            if(!compareparts(\@f, \@s)) {
+                return 0;
+            }
+        }
 
- return 0;
+        $alt = $second;
+        $alt =~ s/%alternatives\[([^,]*),([^\]]*)\]/$2/;
+        # check second alternative
+        {
+            my @f;
+            my @s;
+            push @f, $first;
+            push @s, $alt;
+            if(!compareparts(\@f, \@s)) {
+                return 0;
+            }
+        }
+
+        # neither matched
+        return 1;
+    }
+
+    if($first ne $second) {
+        return 1;
+    }
+
+    return 0;
 }
 
 #
 # Write a given array to the specified file
 #
 sub writearray {
-    my ($filename, $arrayref)=@_;
+    my ($filename, $arrayref) = @_;
 
-    open(my $temp, ">", "$filename") || die "Failure writing file";
-    binmode($temp,":raw"); # cygwin fix by Kevin Roth
+    open(my $temp, ">", $filename) or die "Failure writing file";
+    binmode($temp,":raw");  # Cygwin fix
     for(@$arrayref) {
         print $temp $_;
     }
-    close($temp) || die "Failure writing file";
+    close($temp) or die "Failure writing file";
 }
 
 #
 # Load a specified file and return it as an array
 #
 sub loadarray {
-    my ($filename)=@_;
+    my ($filename) = @_;
     my @array;
 
-    if (open(my $temp, "<", "$filename")) {
+    if(open(my $temp, "<", $filename)) {
         while(<$temp>) {
             push @array, $_;
         }
@@ -355,5 +410,4 @@ sub loadarray {
     return @array;
 }
 
-
 1;
diff --git a/third-party/curl/tests/globalconfig.pm b/third-party/curl/tests/globalconfig.pm
index 5aad483eb5..9b3d1bf76c 100644
--- a/third-party/curl/tests/globalconfig.pm
+++ b/third-party/curl/tests/globalconfig.pm
@@ -37,22 +37,33 @@ BEGIN {
         $anyway
         $automakestyle
         $CURL
+        $CURLINFO
         $CURLVERSION
-        $has_shared
+        $CURLVERNUM
+        $DATE
         $LIBDIR
+        $UNITDIR
+        $TUNITDIR
+        $SRVDIR
         $listonly
+        $buildinfo
         $LOCKDIR
         $LOGDIR
+        $maxtime
+        $mintotal
         $memanalyze
         $MEMDUMP
+        $perlcmd
         $perl
         $PIDDIR
         $proxy_address
         $PROXYIN
         $pwd
         $randseed
+        $run_duphandle
         $run_event_based
         $SERVERCMD
+        $DNSCMD
         $SERVERIN
         $srcdir
         $TESTDIR
@@ -63,55 +74,74 @@ BEGIN {
         %feature
         %keywords
         @protocols
+        $dev_null
     );
 }
-use pathhelp qw(exe_ext);
+use pathhelp qw(
+    exe_ext
+    dirsepadd
+    shell_quote
+    );
 use Cwd qw(getcwd);
-
+use File::Spec;
 
 #######################################################################
 # global configuration variables
 #
 
 # config variables overridden by command-line options
-our $verbose;         # 1 to show verbose test output
-our $torture;         # 1 to enable torture testing
-our $proxy_address;   # external HTTP proxy address
-our $listonly;        # only list the tests
-our $run_event_based; # run curl with --test-event to test the event API
-our $automakestyle;   # use automake-like test status output format
-our $anyway;          # continue anyway, even if a test fail
-our $CURLVERSION="";  # curl's reported version number
-our $randseed = 0;    # random number seed
+our $verbose;          # 1 to show verbose test output
+our $torture;          # 1 to enable torture testing
+our $proxy_address;    # external HTTP proxy address
+our $listonly;         # only list the tests
+our $buildinfo;        # dump buildinfo.txt
+our $run_duphandle;    # run curl with --test-duphandle to verify handle duplication
+our $run_event_based;  # run curl with --test-event to test the event API
+our $automakestyle;    # use automake-like test status output format
+our $anyway;           # continue anyway, even if a test fail
+our $CURLVERSION = ""; # curl's reported version number
+our $CURLVERNUM = "";  # curl's reported version number (without -DEV)
+our $randseed = 0;     # random number seed
+our $maxtime;          # curl command timeout override
+our $mintotal;         # minimum number of tests to run
 
 # paths
 our $pwd = getcwd();  # current working directory
 our $srcdir = $ENV{'srcdir'} || '.';  # root of the test source code
-our $perl="perl -I$srcdir"; # invoke perl like this
-our $LOGDIR="log";  # root of the log directory; this will be different for
-                    # each runner in multiprocess mode
-our $LIBDIR="./libtest";
-our $TESTDIR="$srcdir/data";
-our $CURL="../src/curl".exe_ext('TOOL'); # what curl binary to run on the tests
-our $VCURL=$CURL;  # what curl binary to use to verify the servers with
-                   # VCURL is handy to set to the system one when the one you
-                   # just built hangs or crashes and thus prevent verification
+our $perlcmd = shell_quote($^X);
+our $perl = "$perlcmd -I. " . shell_quote("-I$srcdir"); # invoke perl like this
+our $LOGDIR = "log";  # root of the log directory; this is different for
+                      # each runner in multiprocess mode
+our $LIBDIR = dirsepadd("./libtest/" . ($ENV{'CURL_DIRSUFFIX'} || ''));
+our $UNITDIR = dirsepadd("./unit/" . ($ENV{'CURL_DIRSUFFIX'} || ''));
+our $TUNITDIR = dirsepadd("./tunit/" . ($ENV{'CURL_DIRSUFFIX'} || ''));
+our $SRVDIR = dirsepadd("./server/" . ($ENV{'CURL_DIRSUFFIX'} || ''));
+our $TESTDIR = "$srcdir/data";
+our $CURL = dirsepadd("../src/" . ($ENV{'CURL_DIRSUFFIX'} || '')) .
+    "curl".exe_ext('TOOL'); # what curl binary to run on the tests
+our $CURLINFO = dirsepadd("../src/" . ($ENV{'CURL_DIRSUFFIX'} || '')) .
+    "curlinfo".exe_ext('TOOL'); # what curlinfo binary to run on the tests
+
+our $VCURL = $CURL;  # what curl binary to use to verify the servers with
+                     # VCURL is handy to set to the system one when the one you
+                     # built hangs or crashes and thus prevent verification
 # the path to the script that analyzes the memory debug output file
-our $memanalyze="$perl $srcdir/memanalyze.pl";
+our $memanalyze = "$perl " . shell_quote("$srcdir/memanalyze.pl");
 our $valgrind;     # path to valgrind, or empty if disabled
+our $dev_null = File::Spec->devnull();   # null device path, eg: /dev/null
 
 # paths in $LOGDIR
-our $LOCKDIR = "lock";          # root of the server directory with lock files
-our $PIDDIR = "server";         # root of the server directory with PID files
-our $SERVERIN="server.input";   # what curl sent the server
-our $PROXYIN="proxy.input";     # what curl sent the proxy
-our $MEMDUMP="memdump";         # file that the memory debugging creates
-our $SERVERCMD="server.cmd";    # copy server instructions here
+our $LOCKDIR = "lock";           # root of the server directory with lock files
+our $PIDDIR = "server";          # root of the server directory with PID files
+our $SERVERIN = "server.input";  # what curl sent the server
+our $PROXYIN = "proxy.input";    # what curl sent the proxy
+our $MEMDUMP = "memdump";        # file that the memory debugging creates
+our $SERVERCMD = "server.cmd";   # copy server instructions here
+our $DNSCMD = "dnsd.cmd";        # write DNS instructions here
 
 # other config variables
 our @protocols;   # array of lowercase supported protocol servers
 our %feature;     # hash of enabled features
-our $has_shared;  # built as a shared library
 our %keywords;    # hash of keywords from the test spec
 
 1;
diff --git a/third-party/curl/tests/http-server.pl b/third-party/curl/tests/http-server.pl
index 526ec319bd..14c66a8b42 100644
--- a/third-party/curl/tests/http-server.pl
+++ b/third-party/curl/tests/http-server.pl
@@ -36,14 +36,11 @@ use File::Basename;
 use serverhelp qw(
     server_pidfilename
     server_logfilename
-    );
-
-use pathhelp qw(
-    exe_ext
+    server_exe
     );
 
 my $verbose = 0;     # set to 1 for debugging
-my $port = 8990;     # just a default
+my $port = 8990;     # a default
 my $unix_socket;     # location to place a listening Unix socket
 my $ipvnum = 4;      # default IP version of http server
 my $idnum = 1;       # default http server instance number
@@ -143,7 +140,7 @@ while(@ARGV) {
         $verbose = 1;
     }
     else {
-        print STDERR "\nWarning: http-server.pl unknown parameter: $ARGV[0]\n";
+        print STDERR "\nWarning: http-server.pl unknown parameter: '$ARGV[0]'\n";
     }
     shift @ARGV;
 }
@@ -187,8 +184,8 @@ if($ipvnum eq 'unix') {
 $flags .= "--srcdir \"$srcdir\"";
 
 if($verbose) {
-    print STDERR "RUN: server/sws".exe_ext('SRV')." $flags\n";
+    print STDERR "RUN: ".server_exe('sws')." $flags\n";
 }
 
 $| = 1;
-exec("exec server/sws".exe_ext('SRV')." $flags");
+exec("exec ".server_exe('sws')." $flags");
diff --git a/third-party/curl/tests/http/CMakeLists.txt b/third-party/curl/tests/http/CMakeLists.txt
new file mode 100644
index 0000000000..9801d51907
--- /dev/null
+++ b/third-party/curl/tests/http/CMakeLists.txt
@@ -0,0 +1,80 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+find_program(CADDY "caddy")  # /usr/bin/caddy
+if(NOT CADDY)
+  set(CADDY "")
+endif()
+mark_as_advanced(CADDY)
+
+find_program(H2O "h2o")  # /usr/local/bin/h2o
+if(NOT H2O)
+  set(H2O "")
+endif()
+mark_as_advanced(H2O)
+
+find_program(VSFTPD "vsftpd")  # /usr/sbin/vsftpd
+if(NOT VSFTPD)
+  set(VSFTPD "")
+endif()
+mark_as_advanced(VSFTPD)
+
+find_program(HTTPD NAMES "/usr/sbin/apache2" "httpd" "apache2")
+if(NOT HTTPD)
+  set(HTTPD "")
+endif()
+mark_as_advanced(HTTPD)
+
+find_program(APXS "apxs")
+if(NOT APXS)
+  set(APXS "")
+endif()
+mark_as_advanced(APXS)
+
+find_program(HTTPD_NGHTTPX "nghttpx" PATHS "/usr/bin" "/usr/local/bin")
+if(NOT HTTPD_NGHTTPX)
+  set(HTTPD_NGHTTPX "")
+endif()
+mark_as_advanced(HTTPD_NGHTTPX)
+
+find_program(DANTED "danted")
+if(NOT DANTED)
+  set(DANTED "")
+endif()
+mark_as_advanced(DANTED)
+
+find_program(SSHD "sshd" PATHS "/usr/sbin" "/usr/bin")
+if(NOT SSHD)
+  set(SSHD "")
+endif()
+mark_as_advanced(SSHD)
+
+find_program(SFTPD "sftp-server" PATHS "/usr/libexec" "/usr/lib/openssh")
+if(NOT SFTPD)
+  set(SFTPD "")
+endif()
+mark_as_advanced(SFTPD)
+
+# Consumed variables: APXS, CADDY, DANTED, HTTPD, HTTPD_NGHTTPX, SFTPD, SSHD, VSFTPD
+configure_file("config.ini.in" "${CMAKE_CURRENT_BINARY_DIR}/config.ini" @ONLY)
diff --git a/third-party/curl/tests/http/Makefile.am b/third-party/curl/tests/http/Makefile.am
index cce66daf89..7232c1e8aa 100644
--- a/third-party/curl/tests/http/Makefile.am
+++ b/third-party/curl/tests/http/Makefile.am
@@ -22,16 +22,65 @@
 #
 ###########################################################################
 
-SUBDIRS = clients
+TESTENV =                               \
+  testenv/__init__.py                   \
+  testenv/caddy.py                      \
+  testenv/certs.py                      \
+  testenv/client.py                     \
+  testenv/curl.py                       \
+  testenv/dnsd.py                       \
+  testenv/dante.py                      \
+  testenv/env.py                        \
+  testenv/h2o.py                        \
+  testenv/httpd.py                      \
+  testenv/mod_curltest/mod_curltest.c   \
+  testenv/nghttpx.py                    \
+  testenv/ports.py                      \
+  testenv/sshd.py                       \
+  testenv/vsftpd.py                     \
+  testenv/ws_echo_server.py
+
+EXTRA_DIST =             \
+  CMakeLists.txt         \
+  conftest.py            \
+  requirements.txt       \
+  scorecard.py           \
+  test_01_basic.py       \
+  test_02_download.py    \
+  test_03_goaway.py      \
+  test_04_stuttered.py   \
+  test_05_errors.py      \
+  test_06_eyeballs.py    \
+  test_07_upload.py      \
+  test_08_caddy.py       \
+  test_09_push.py        \
+  test_10_proxy.py       \
+  test_11_unix.py        \
+  test_12_reuse.py       \
+  test_13_proxy_auth.py  \
+  test_14_auth.py        \
+  test_15_tracing.py     \
+  test_16_info.py        \
+  test_17_ssl_use.py     \
+  test_18_methods.py     \
+  test_19_shutdown.py    \
+  test_20_websockets.py  \
+  test_21_resolve.py     \
+  test_22_httpsrr.py     \
+  test_30_vsftpd.py      \
+  test_31_vsftpds.py     \
+  test_32_ftps_vsftpd.py \
+  test_40_socks.py       \
+  test_50_scp.py         \
+  test_51_sftp.py        \
+  test_60_h3_proxy.py    \
+  $(TESTENV)
 
 clean-local:
 	rm -rf *.pyc __pycache__
 	rm -rf gen
 
-check: clients
+check: libtests
 
-clients:
-	@(cd clients; $(MAKE) check)
-
-checksrc:
-	cd clients && $(MAKE) checksrc
+libtests:
+	@(cd ../libtest && $(MAKE) check)
diff --git a/third-party/curl/tests/http/README.md b/third-party/curl/tests/http/README.md
deleted file mode 100644
index 3a4b263943..0000000000
--- a/third-party/curl/tests/http/README.md
+++ /dev/null
@@ -1,128 +0,0 @@
-<!--
-Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-
-SPDX-License-Identifier: curl
--->
-
-# The curl HTTP Test Suite
-
-This is an additional test suite using a combination of Apache httpd and nghttpx servers to perform various tests beyond the capabilities of the standard curl test suite.
-
-# Usage
-
-The test cases and necessary files are in `tests/http`. You can invoke `pytest` from there or from the top level curl checkout and it will find all tests.
-
-```
-curl> pytest
-platform darwin -- Python 3.9.15, pytest-6.2.0, py-1.10.0, pluggy-0.13.1
-rootdir: /Users/sei/projects/curl
-collected 5 items
-
-tests/http/test_01_basic.py .....
-```
-
-Pytest takes arguments. `-v` increases its verbosity and can be used several times. `-k <expr>` can be used to run only matching test cases. The `expr` can be something resembling a python test or just a string that needs to match test cases in their names.
-
-```
-curl> pytest -vv -k test_01_02
-```
-
-runs all test cases that have `test_01_02` in their name. This does not have to be the start of the name.
-
-Depending on your setup, some test cases may be skipped and appear as `s` in the output. If you run pytest verbose, it will also give you the reason for skipping.
-
-
-# Prerequisites
-
-You will need:
-
-1. a recent Python, the `cryptography` module and, of course, `pytest`
-2. a apache httpd development version. On Debian/Ubuntu, the package `apache2-dev` has this.
-3. a local `curl` project build
-3. optionally, a `nghttpx` with HTTP/3 enabled or h3 test cases will be skipped.
-
-### Configuration
-
-Via curl's `configure` script you may specify:
-
-  * `--with-test-nghttpx=<path-of-nghttpx>` if you have nghttpx to use somewhere outside your `$PATH`.
-  * `--with-test-httpd=<httpd-install-path>` if you have an Apache httpd installed somewhere else. On Debian/Ubuntu it will otherwise look into `/usr/bin` and `/usr/sbin` to find those.
-
-## Usage Tips
-
-Several test cases are parameterized, for example with the HTTP version to use. If you want to run a test with a particular protocol only, use a command line like:
-
-```
-curl> pytest -k "test_02_06 and h2"
-```
-
-Several test cases can be repeated, they all have the `repeat` parameter. To make this work, you have to start `pytest` in the test directory itself (for some unknown reason). Like in:
-
-```
-curl/tests/http> pytest -k "test_02_06 and h2" --repeat=100
-```
-
-which then runs this test case a hundred times. In case of flaky tests, you can make pytest stop on the first one with:
-
-```
-curl/tests/http> pytest -k "test_02_06 and h2" --repeat=100 --maxfail=1
-```
-
-which allow you to inspect output and log files for the failed run. Speaking of log files, the verbosity of pytest is also used to collect curl trace output. If you specify `-v` three times, the `curl` command is started with `--trace`:
-
-```
-curl/tests/http> pytest -vvv -k "test_02_06 and h2" --repeat=100 --maxfail=1
-```
-
-all of curl's output and trace file are found in `tests/http/gen/curl`.
-
-## Writing Tests
-
-There is a lot of [`pytest` documentation](https://docs.pytest.org/) with examples. No use in repeating that here. Assuming you are somewhat familiar with it, it is useful how *this* general test suite is setup. Especially if you want to add test cases.
-
-### Servers
-
-In `conftest.py` 3 "fixtures" are defined that are used by all test cases:
-
-1. `env`: the test environment. It is an instance of class `testenv/env.py:Env`. It holds all information about paths, availability of features (HTTP/3!), port numbers to use, domains and SSL certificates for those.
-2. `httpd`: the Apache httpd instance, configured and started, then stopped at the end of the test suite. It has sites configured for the domains from `env`. It also loads a local module `mod_curltest?` and makes it available in certain locations. (more on mod_curltest below).
-3. `nghttpx`: an instance of nghttpx that provides HTTP/3 support. `nghttpx` proxies those requests to the `httpd` server. In a direct mapping, so you may access all the resources under the same path as with HTTP/2. Only the port number used for HTTP/3 requests will be different.
-
-`pytest` manages these fixture so that they are created once and terminated before exit. This means you can `Ctrl-C` a running pytest and the server will shutdown. Only when you brutally chop its head off, might there be servers left
-behind.
-
-### Test Cases
-
-Tests making use of these fixtures have them in their parameter list. This tells pytest that a particular test needs them, so it has to create them. Since one can invoke pytest for just a single test, it is important that a test references the ones it needs.
-
-All test cases start with `test_` in their name. We use a double number scheme to group them. This makes it ease to run only specific tests and also give a short mnemonic to communicate trouble with others in the project. Otherwise you are free to name test cases as you think fitting.
-
-Tests are grouped thematically in a file with a single Python test class. This is convenient if you need a special "fixture" for several tests. "fixtures" can have "class" scope.
-
-There is a curl helper class that knows how to invoke curl and interpret its output. Among other things, it does add the local CA to the command line, so that SSL connections to the test servers are verified. Nothing prevents anyone from running curl directly, for specific uses not covered by the `CurlClient` class.
-
-### mod_curltest
-
-The module source code is found in `testenv/mod_curltest`. It is compiled using the `apxs` command, commonly provided via the `apache2-dev` package. Compilation is quick and done once at the start of a test run.
-
-The module adds 2 "handlers" to the Apache server (right now). Handler are pieces of code that receive HTTP requests and generate the response. Those handlers are:
-
-* `curltest-echo`: hooked up on the path `/curltest/echo`. This one echoes a request and copies all data from the request body to the response body. Useful for simulating upload and checking that the data arrived as intended.
-* `curltest-tweak`: hooked up on the path `/curltest/tweak`. This handler is more of a Swiss army knife. It interprets parameters from the URL query string to drive its behavior.
-  * `status=nnn`: generate a response with HTTP status code `nnn`.
-  * `chunks=n`: generate `n` chunks of data in the response body, defaults to 3.
-  * `chunk_size=nnn`: each chunk should contain `nnn` bytes of data. Maximum is 16KB right now.
-  * `chunkd_delay=duration`: wait `duration` time between writing chunks
-  * `delay=duration`: wait `duration` time to send the response headers
-  * `body_error=(timeout|reset)`: produce an error after the first chunk in the response body
-  * `id=str`: add `str` in the response header `request-id`
-
-`duration` values are integers, optionally followed by a unit. Units are:
-
-  * `d`: days (probably not useful here)
-  * `h`: hours
-  * `mi`: minutes
-  * `s`: seconds (the default)
-  * `ms`: milliseconds
-
-As you can see, `mod_curltest`'s tweak handler allow to simulate many kinds of responses. An example of its use is `test_03_01` where responses are delayed using `chunk_delay`. This gives the response a defined duration and the test uses that to reload `httpd` in the middle of the first request. A graceful reload in httpd lets ongoing requests finish, but will close the connection afterwards and tear down the serving process. The following request need then to open a new connection. This is verified by the test case.
diff --git a/third-party/curl/tests/http/clients/.gitignore b/third-party/curl/tests/http/clients/.gitignore
deleted file mode 100644
index b54dd3ea9e..0000000000
--- a/third-party/curl/tests/http/clients/.gitignore
+++ /dev/null
@@ -1,10 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-h2-serverpush
-h2-download
-ws-data
-ws-pingpong
-h2-upgrade-extreme
-tls-session-reuse
diff --git a/third-party/curl/tests/http/clients/Makefile.am b/third-party/curl/tests/http/clients/Makefile.am
deleted file mode 100644
index 8fdc190b94..0000000000
--- a/third-party/curl/tests/http/clients/Makefile.am
+++ /dev/null
@@ -1,73 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-AUTOMAKE_OPTIONS = foreign nostdinc
-
-
-# Specify our include paths here, and do it relative to $(top_srcdir) and
-# $(top_builddir), to ensure that these paths which belong to the library
-# being currently built and tested are searched before the library which
-# might possibly already be installed in the system.
-#
-# $(top_srcdir)/include is for libcurl's external include files
-
-AM_CPPFLAGS = -I$(top_srcdir)/include   \
-              -I$(top_builddir)/lib     \
-              -I$(top_srcdir)/lib       \
-              -DCURL_DISABLE_DEPRECATION
-
-LIBDIR = $(top_builddir)/lib
-
-# Avoid libcurl obsolete stuff
-AM_CPPFLAGS += -DCURL_NO_OLDIES
-
-if USE_CPPFLAG_CURL_STATICLIB
-AM_CPPFLAGS += -DCURL_STATICLIB
-endif
-
-# Prevent LIBS from being used for all link targets
-LIBS = $(BLANK_AT_MAKETIME)
-
-# Dependencies
-if USE_EXPLICIT_LIB_DEPS
-LDADD = $(LIBDIR)/libcurl.la @LIBCURL_LIBS@
-else
-LDADD = $(LIBDIR)/libcurl.la
-endif
-
-# This might hold -Werror
-CFLAGS += @CURL_CFLAG_EXTRAS@
-
-# Makefile.inc provides the check_PROGRAMS and COMPLICATED_EXAMPLES defines
-include Makefile.inc
-
-all: $(check_PROGRAMS)
-
-CHECKSRC = $(CS_$(V))
-CS_0 = @echo "  RUN     " $@;
-CS_1 =
-CS_ = $(CS_0)
-
-checksrc:
-	$(CHECKSRC)(@PERL@ $(top_srcdir)/scripts/checksrc.pl -D$(srcdir) $(srcdir)/*.c)
diff --git a/third-party/curl/tests/http/clients/Makefile.inc b/third-party/curl/tests/http/clients/Makefile.inc
deleted file mode 100644
index dace3a933c..0000000000
--- a/third-party/curl/tests/http/clients/Makefile.inc
+++ /dev/null
@@ -1,32 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-# These are all libcurl example programs to be test compiled
-check_PROGRAMS = \
-  h2-serverpush \
-  h2-download \
-  ws-data \
-  ws-pingpong \
-  h2-upgrade-extreme \
-  tls-session-reuse
diff --git a/third-party/curl/tests/http/clients/h2-download.c b/third-party/curl/tests/http/clients/h2-download.c
deleted file mode 100644
index 24ccedbddd..0000000000
--- a/third-party/curl/tests/http/clients/h2-download.c
+++ /dev/null
@@ -1,352 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-/* <DESC>
- * HTTP/2 server push
- * </DESC>
- */
-
-/* curl stuff */
-#include <curl/curl.h>
-#include <curl/mprintf.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-/* somewhat unix-specific */
-#include <sys/time.h>
-#include <unistd.h>
-
-#ifndef CURLPIPE_MULTIPLEX
-#error "too old libcurl, cannot do HTTP/2 server push!"
-#endif
-
-static int verbose = 1;
-
-static
-int my_trace(CURL *handle, curl_infotype type,
-             char *data, size_t size,
-             void *userp)
-{
-  const char *text;
-  (void)handle; /* prevent compiler warning */
-  (void)userp;
-
-  switch(type) {
-  case CURLINFO_TEXT:
-    fprintf(stderr, "== Info: %s", data);
-    /* FALLTHROUGH */
-  default: /* in case a new one is introduced to shock us */
-    return 0;
-
-  case CURLINFO_HEADER_OUT:
-    text = "=> Send header";
-    break;
-  case CURLINFO_DATA_OUT:
-    if(verbose <= 1)
-      return 0;
-    text = "=> Send data";
-    break;
-  case CURLINFO_HEADER_IN:
-    text = "<= Recv header";
-    break;
-  case CURLINFO_DATA_IN:
-    if(verbose <= 1)
-      return 0;
-    text = "<= Recv data";
-    break;
-  }
-
-  fprintf(stderr, "%s, %lu bytes (0x%lx)\n",
-          text, (unsigned long)size, (unsigned long)size);
-  return 0;
-}
-
-struct transfer {
-  int idx;
-  CURL *easy;
-  char filename[128];
-  FILE *out;
-  curl_off_t recv_size;
-  curl_off_t pause_at;
-  int started;
-  int paused;
-  int resumed;
-  int done;
-};
-
-static size_t transfer_count = 1;
-static struct transfer *transfers;
-
-static struct transfer *get_transfer_for_easy(CURL *easy)
-{
-  size_t i;
-  for(i = 0; i < transfer_count; ++i) {
-    if(easy == transfers[i].easy)
-      return &transfers[i];
-  }
-  return NULL;
-}
-
-static size_t my_write_cb(char *buf, size_t nitems, size_t buflen,
-                          void *userdata)
-{
-  struct transfer *t = userdata;
-  ssize_t nwritten;
-
-  if(!t->resumed &&
-     t->recv_size < t->pause_at &&
-     ((curl_off_t)(t->recv_size + (nitems * buflen)) >= t->pause_at)) {
-    fprintf(stderr, "[t-%d] PAUSE\n", t->idx);
-    t->paused = 1;
-    return CURL_WRITEFUNC_PAUSE;
-  }
-
-  if(!t->out) {
-    curl_msnprintf(t->filename, sizeof(t->filename)-1, "download_%u.data",
-                   t->idx);
-    t->out = fopen(t->filename, "wb");
-    if(!t->out)
-      return 0;
-  }
-
-  nwritten = fwrite(buf, nitems, buflen, t->out);
-  if(nwritten < 0) {
-    fprintf(stderr, "[t-%d] write failure\n", t->idx);
-    return 0;
-  }
-  t->recv_size += nwritten;
-  return (size_t)nwritten;
-}
-
-static int setup(CURL *hnd, const char *url, struct transfer *t)
-{
-  curl_easy_setopt(hnd, CURLOPT_URL, url);
-  curl_easy_setopt(hnd, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
-  curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYPEER, 0L);
-  curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYHOST, 0L);
-
-  curl_easy_setopt(hnd, CURLOPT_WRITEFUNCTION, my_write_cb);
-  curl_easy_setopt(hnd, CURLOPT_WRITEDATA, t);
-
-  /* please be verbose */
-  if(verbose) {
-    curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-    curl_easy_setopt(hnd, CURLOPT_DEBUGFUNCTION, my_trace);
-  }
-
-#if (CURLPIPE_MULTIPLEX > 0)
-  /* wait for pipe connection to confirm */
-  curl_easy_setopt(hnd, CURLOPT_PIPEWAIT, 1L);
-#endif
-  return 0; /* all is good */
-}
-
-static void usage(const char *msg)
-{
-  if(msg)
-    fprintf(stderr, "%s\n", msg);
-  fprintf(stderr,
-    "usage: [options] url\n"
-    "  download a url with following options:\n"
-    "  -m number  max parallel downloads\n"
-    "  -n number  total downloads\n"
-    "  -p number  pause transfer after `number` response bytes\n"
-  );
-}
-
-/*
- * Download a file over HTTP/2, take care of server push.
- */
-int main(int argc, char *argv[])
-{
-  CURLM *multi_handle;
-  struct CURLMsg *m;
-  const char *url;
-  size_t i, n, max_parallel = 1;
-  size_t active_transfers;
-  long pause_offset = 0;
-  int abort_paused = 0;
-  struct transfer *t;
-  int ch;
-
-  while((ch = getopt(argc, argv, "ahm:n:P:")) != -1) {
-    switch(ch) {
-    case 'h':
-      usage(NULL);
-      return 2;
-      break;
-    case 'a':
-      abort_paused = 1;
-      break;
-    case 'm':
-      max_parallel = (size_t)strtol(optarg, NULL, 10);
-      break;
-    case 'n':
-      transfer_count = (size_t)strtol(optarg, NULL, 10);
-      break;
-    case 'P':
-      pause_offset = strtol(optarg, NULL, 10);
-      break;
-    default:
-     usage("invalid option");
-     return 1;
-    }
-  }
-  argc -= optind;
-  argv += optind;
-
-  if(argc != 1) {
-    usage("not enough arguments");
-    return 2;
-  }
-  url = argv[0];
-
-  transfers = calloc(transfer_count, sizeof(*transfers));
-  if(!transfers) {
-    fprintf(stderr, "error allocating transfer structs\n");
-    return 1;
-  }
-
-  multi_handle = curl_multi_init();
-  curl_multi_setopt(multi_handle, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
-
-  active_transfers = 0;
-  for(i = 0; i < transfer_count; ++i) {
-    t = &transfers[i];
-    t->idx = (int)i;
-    t->pause_at = (curl_off_t)pause_offset * i;
-  }
-
-  n = (max_parallel < transfer_count)? max_parallel : transfer_count;
-  for(i = 0; i < n; ++i) {
-    t = &transfers[i];
-    t->easy = curl_easy_init();
-    if(!t->easy || setup(t->easy, url, t)) {
-      fprintf(stderr, "[t-%d] FAILED setup\n", (int)i);
-      return 1;
-    }
-    curl_multi_add_handle(multi_handle, t->easy);
-    t->started = 1;
-    ++active_transfers;
-    fprintf(stderr, "[t-%d] STARTED\n", t->idx);
-  }
-
-  do {
-    int still_running; /* keep number of running handles */
-    CURLMcode mc = curl_multi_perform(multi_handle, &still_running);
-
-    if(still_running) {
-      /* wait for activity, timeout or "nothing" */
-      mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL);
-      fprintf(stderr, "curl_multi_poll() -> %d\n", mc);
-    }
-
-    if(mc)
-      break;
-
-    do {
-      int msgq = 0;
-      m = curl_multi_info_read(multi_handle, &msgq);
-      if(m && (m->msg == CURLMSG_DONE)) {
-        CURL *e = m->easy_handle;
-        active_transfers--;
-        curl_multi_remove_handle(multi_handle, e);
-        t = get_transfer_for_easy(e);
-        if(t) {
-          t->done = 1;
-        }
-        else
-          curl_easy_cleanup(e);
-      }
-      else {
-        /* nothing happening, maintenance */
-        if(abort_paused) {
-          /* abort paused transfers */
-          for(i = 0; i < transfer_count; ++i) {
-            t = &transfers[i];
-            if(!t->done && t->paused && t->easy) {
-              curl_multi_remove_handle(multi_handle, t->easy);
-              t->done = 1;
-              active_transfers--;
-              fprintf(stderr, "[t-%d] ABORTED\n", t->idx);
-            }
-          }
-        }
-        else {
-          /* resume one paused transfer */
-          for(i = 0; i < transfer_count; ++i) {
-            t = &transfers[i];
-            if(!t->done && t->paused) {
-              t->resumed = 1;
-              t->paused = 0;
-              curl_easy_pause(t->easy, CURLPAUSE_CONT);
-              fprintf(stderr, "[t-%d] RESUMED\n", t->idx);
-              break;
-            }
-          }
-        }
-
-        while(active_transfers < max_parallel) {
-          for(i = 0; i < transfer_count; ++i) {
-            t = &transfers[i];
-            if(!t->started) {
-              t->easy = curl_easy_init();
-              if(!t->easy || setup(t->easy, url, t)) {
-                fprintf(stderr, "[t-%d] FAILEED setup\n", (int)i);
-                return 1;
-              }
-              curl_multi_add_handle(multi_handle, t->easy);
-              t->started = 1;
-              ++active_transfers;
-              fprintf(stderr, "[t-%d] STARTED\n", t->idx);
-              break;
-            }
-          }
-          /* all started */
-          if(i == transfer_count)
-            break;
-        }
-      }
-    } while(m);
-
-  } while(active_transfers); /* as long as we have transfers going */
-
-  for(i = 0; i < transfer_count; ++i) {
-    t = &transfers[i];
-    if(t->out) {
-      fclose(t->out);
-      t->out = NULL;
-    }
-    if(t->easy) {
-      curl_easy_cleanup(t->easy);
-      t->easy = NULL;
-    }
-  }
-  free(transfers);
-
-  curl_multi_cleanup(multi_handle);
-
-  return 0;
-}
diff --git a/third-party/curl/tests/http/clients/h2-serverpush.c b/third-party/curl/tests/http/clients/h2-serverpush.c
deleted file mode 100644
index 742a67e596..0000000000
--- a/third-party/curl/tests/http/clients/h2-serverpush.c
+++ /dev/null
@@ -1,272 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-/* <DESC>
- * HTTP/2 server push
- * </DESC>
- */
-
-/* curl stuff */
-#include <curl/curl.h>
-#include <curl/mprintf.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-/* somewhat unix-specific */
-#include <sys/time.h>
-#include <unistd.h>
-
-#ifndef CURLPIPE_MULTIPLEX
-#error "too old libcurl, cannot do HTTP/2 server push!"
-#endif
-
-static
-void dump(const char *text, unsigned char *ptr, size_t size,
-          char nohex)
-{
-  size_t i;
-  size_t c;
-
-  unsigned int width = 0x10;
-
-  if(nohex)
-    /* without the hex output, we can fit more on screen */
-    width = 0x40;
-
-  fprintf(stderr, "%s, %lu bytes (0x%lx)\n",
-          text, (unsigned long)size, (unsigned long)size);
-
-  for(i = 0; i<size; i += width) {
-
-    fprintf(stderr, "%4.4lx: ", (unsigned long)i);
-
-    if(!nohex) {
-      /* hex not disabled, show it */
-      for(c = 0; c < width; c++)
-        if(i + c < size)
-          fprintf(stderr, "%02x ", ptr[i + c]);
-        else
-          fputs("   ", stderr);
-    }
-
-    for(c = 0; (c < width) && (i + c < size); c++) {
-      /* check for 0D0A; if found, skip past and start a new line of output */
-      if(nohex && (i + c + 1 < size) && ptr[i + c] == 0x0D &&
-         ptr[i + c + 1] == 0x0A) {
-        i += (c + 2 - width);
-        break;
-      }
-      fprintf(stderr, "%c",
-              (ptr[i + c] >= 0x20) && (ptr[i + c]<0x80)?ptr[i + c]:'.');
-      /* check again for 0D0A, to avoid an extra \n if it's at width */
-      if(nohex && (i + c + 2 < size) && ptr[i + c + 1] == 0x0D &&
-         ptr[i + c + 2] == 0x0A) {
-        i += (c + 3 - width);
-        break;
-      }
-    }
-    fputc('\n', stderr); /* newline */
-  }
-}
-
-static
-int my_trace(CURL *handle, curl_infotype type,
-             char *data, size_t size,
-             void *userp)
-{
-  const char *text;
-  (void)handle; /* prevent compiler warning */
-  (void)userp;
-  switch(type) {
-  case CURLINFO_TEXT:
-    fprintf(stderr, "== Info: %s", data);
-    /* FALLTHROUGH */
-  default: /* in case a new one is introduced to shock us */
-    return 0;
-
-  case CURLINFO_HEADER_OUT:
-    text = "=> Send header";
-    break;
-  case CURLINFO_DATA_OUT:
-    text = "=> Send data";
-    break;
-  case CURLINFO_SSL_DATA_OUT:
-    text = "=> Send SSL data";
-    break;
-  case CURLINFO_HEADER_IN:
-    text = "<= Recv header";
-    break;
-  case CURLINFO_DATA_IN:
-    text = "<= Recv data";
-    break;
-  case CURLINFO_SSL_DATA_IN:
-    text = "<= Recv SSL data";
-    break;
-  }
-
-  dump(text, (unsigned char *)data, size, 1);
-  return 0;
-}
-
-#define OUTPUTFILE "download_0.data"
-
-static int setup(CURL *hnd, const char *url)
-{
-  FILE *out = fopen(OUTPUTFILE, "wb");
-  if(!out)
-    /* failed */
-    return 1;
-
-  curl_easy_setopt(hnd, CURLOPT_URL, url);
-  curl_easy_setopt(hnd, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
-  curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYPEER, 0L);
-  curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYHOST, 0L);
-
-  curl_easy_setopt(hnd, CURLOPT_WRITEDATA, out);
-
-  /* please be verbose */
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_DEBUGFUNCTION, my_trace);
-
-#if (CURLPIPE_MULTIPLEX > 0)
-  /* wait for pipe connection to confirm */
-  curl_easy_setopt(hnd, CURLOPT_PIPEWAIT, 1L);
-#endif
-  return 0; /* all is good */
-}
-
-/* called when there's an incoming push */
-static int server_push_callback(CURL *parent,
-                                CURL *easy,
-                                size_t num_headers,
-                                struct curl_pushheaders *headers,
-                                void *userp)
-{
-  char *headp;
-  size_t i;
-  int *transfers = (int *)userp;
-  char filename[128];
-  FILE *out;
-  static unsigned int count = 0;
-  int rv;
-
-  (void)parent; /* we have no use for this */
-  curl_msnprintf(filename, sizeof(filename)-1, "push%u", count++);
-
-  /* here's a new stream, save it in a new file for each new push */
-  out = fopen(filename, "wb");
-  if(!out) {
-    /* if we cannot save it, deny it */
-    fprintf(stderr, "Failed to create output file for push\n");
-    rv = CURL_PUSH_DENY;
-    goto out;
-  }
-
-  /* write to this file */
-  curl_easy_setopt(easy, CURLOPT_WRITEDATA, out);
-
-  fprintf(stderr, "**** push callback approves stream %u, got %lu headers!\n",
-          count, (unsigned long)num_headers);
-
-  for(i = 0; i<num_headers; i++) {
-    headp = curl_pushheader_bynum(headers, i);
-    fprintf(stderr, "**** header %lu: %s\n", (unsigned long)i, headp);
-  }
-
-  headp = curl_pushheader_byname(headers, ":path");
-  if(headp) {
-    fprintf(stderr, "**** The PATH is %s\n", headp /* skip :path + colon */);
-  }
-
-  (*transfers)++; /* one more */
-  rv = CURL_PUSH_OK;
-
-out:
-  return rv;
-}
-
-
-/*
- * Download a file over HTTP/2, take care of server push.
- */
-int main(int argc, char *argv[])
-{
-  CURL *easy;
-  CURLM *multi_handle;
-  int transfers = 1; /* we start with one */
-  struct CURLMsg *m;
-  const char *url;
-
-  if(argc != 2) {
-    fprintf(stderr, "need URL as argument\n");
-    return 2;
-  }
-  url = argv[1];
-
-  multi_handle = curl_multi_init();
-  curl_multi_setopt(multi_handle, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
-  curl_multi_setopt(multi_handle, CURLMOPT_PUSHFUNCTION, server_push_callback);
-  curl_multi_setopt(multi_handle, CURLMOPT_PUSHDATA, &transfers);
-
-  easy = curl_easy_init();
-  if(setup(easy, url)) {
-    fprintf(stderr, "failed\n");
-    return 1;
-  }
-
-  curl_multi_add_handle(multi_handle, easy);
-  do {
-    int still_running; /* keep number of running handles */
-    CURLMcode mc = curl_multi_perform(multi_handle, &still_running);
-
-    if(still_running)
-      /* wait for activity, timeout or "nothing" */
-      mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL);
-
-    if(mc)
-      break;
-
-    /*
-     * A little caution when doing server push is that libcurl itself has
-     * created and added one or more easy handles but we need to clean them up
-     * when we are done.
-     */
-    do {
-      int msgq = 0;
-      m = curl_multi_info_read(multi_handle, &msgq);
-      if(m && (m->msg == CURLMSG_DONE)) {
-        CURL *e = m->easy_handle;
-        transfers--;
-        curl_multi_remove_handle(multi_handle, e);
-        curl_easy_cleanup(e);
-      }
-    } while(m);
-
-  } while(transfers); /* as long as we have transfers going */
-
-  curl_multi_cleanup(multi_handle);
-
-  return 0;
-}
diff --git a/third-party/curl/tests/http/clients/h2-upgrade-extreme.c b/third-party/curl/tests/http/clients/h2-upgrade-extreme.c
deleted file mode 100644
index e15e34ce0a..0000000000
--- a/third-party/curl/tests/http/clients/h2-upgrade-extreme.c
+++ /dev/null
@@ -1,249 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-/* <DESC>
- * HTTP/2 Upgrade test
- * </DESC>
- */
-#include <stdio.h>
-#include <stdlib.h>
-#include <stdint.h>
-#include <inttypes.h>
-/* #include <error.h> */
-#include <errno.h>
-#include <curl/curl.h>
-#include <curl/mprintf.h>
-
-
-static void log_line_start(FILE *log, const char *idsbuf, curl_infotype type)
-{
-  /*
-   * This is the trace look that is similar to what libcurl makes on its
-   * own.
-   */
-  static const char * const s_infotype[] = {
-    "* ", "< ", "> ", "{ ", "} ", "{ ", "} "
-  };
-  if(idsbuf && *idsbuf)
-    fprintf(log, "%s%s", idsbuf, s_infotype[type]);
-  else
-    fputs(s_infotype[type], log);
-}
-
-#define TRC_IDS_FORMAT_IDS_1  "[%" CURL_FORMAT_CURL_OFF_T "-x] "
-#define TRC_IDS_FORMAT_IDS_2  "[%" CURL_FORMAT_CURL_OFF_T "-%" \
-                                   CURL_FORMAT_CURL_OFF_T "] "
-/*
-** callback for CURLOPT_DEBUGFUNCTION
-*/
-static int debug_cb(CURL *handle, curl_infotype type,
-                    char *data, size_t size,
-                    void *userdata)
-{
-  FILE *output = stderr;
-  static int newl = 0;
-  static int traced_data = 0;
-  char idsbuf[60];
-  curl_off_t xfer_id, conn_id;
-
-  (void)handle; /* not used */
-  (void)userdata;
-
-  if(!curl_easy_getinfo(handle, CURLINFO_XFER_ID, &xfer_id) && xfer_id >= 0) {
-    if(!curl_easy_getinfo(handle, CURLINFO_CONN_ID, &conn_id) &&
-        conn_id >= 0) {
-      curl_msnprintf(idsbuf, sizeof(idsbuf), TRC_IDS_FORMAT_IDS_2,
-                     xfer_id, conn_id);
-    }
-    else {
-      curl_msnprintf(idsbuf, sizeof(idsbuf), TRC_IDS_FORMAT_IDS_1, xfer_id);
-    }
-  }
-  else
-    idsbuf[0] = 0;
-
-  switch(type) {
-  case CURLINFO_HEADER_OUT:
-    if(size > 0) {
-      size_t st = 0;
-      size_t i;
-      for(i = 0; i < size - 1; i++) {
-        if(data[i] == '\n') { /* LF */
-          if(!newl) {
-            log_line_start(output, idsbuf, type);
-          }
-          (void)fwrite(data + st, i - st + 1, 1, output);
-          st = i + 1;
-          newl = 0;
-        }
-      }
-      if(!newl)
-        log_line_start(output, idsbuf, type);
-      (void)fwrite(data + st, i - st + 1, 1, output);
-    }
-    newl = (size && (data[size - 1] != '\n')) ? 1 : 0;
-    traced_data = 0;
-    break;
-  case CURLINFO_TEXT:
-  case CURLINFO_HEADER_IN:
-    if(!newl)
-      log_line_start(output, idsbuf, type);
-    (void)fwrite(data, size, 1, output);
-    newl = (size && (data[size - 1] != '\n')) ? 1 : 0;
-    traced_data = 0;
-    break;
-  case CURLINFO_DATA_OUT:
-  case CURLINFO_DATA_IN:
-  case CURLINFO_SSL_DATA_IN:
-  case CURLINFO_SSL_DATA_OUT:
-    if(!traced_data) {
-      if(!newl)
-        log_line_start(output, idsbuf, type);
-      fprintf(output, "[%ld bytes data]\n", (long)size);
-      newl = 0;
-      traced_data = 1;
-    }
-    break;
-  default: /* nada */
-    newl = 0;
-    traced_data = 1;
-    break;
-  }
-
-  return 0;
-}
-
-static size_t write_cb(char *ptr, size_t size, size_t nmemb, void *opaque)
-{
-  (void)ptr;
-  (void)opaque;
-  return size * nmemb;
-}
-
-int main(int argc, char *argv[])
-{
-  const char *url;
-  CURLM *multi;
-  CURL *easy;
-  CURLMcode mc;
-  int running_handles = 0, start_count, numfds;
-  CURLMsg *msg;
-  int msgs_in_queue;
-  char range[128];
-
-  if(argc != 2) {
-    fprintf(stderr, "%s URL\n", argv[0]);
-    exit(2);
-  }
-
-  url = argv[1];
-  multi = curl_multi_init();
-  if(!multi) {
-    fprintf(stderr, "curl_multi_init failed\n");
-    exit(1);
-  }
-
-  start_count = 200;
-  do {
-    if(start_count) {
-      easy = curl_easy_init();
-      if(!easy) {
-        fprintf(stderr, "curl_easy_init failed\n");
-        exit(1);
-      }
-      curl_easy_setopt(easy, CURLOPT_VERBOSE, 1L);
-      curl_easy_setopt(easy, CURLOPT_DEBUGFUNCTION, debug_cb);
-      curl_easy_setopt(easy, CURLOPT_URL, url);
-      curl_easy_setopt(easy, CURLOPT_NOSIGNAL, 1L);
-      curl_easy_setopt(easy, CURLOPT_AUTOREFERER, 1L);
-      curl_easy_setopt(easy, CURLOPT_FAILONERROR, 1L);
-      curl_easy_setopt(easy, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
-      curl_easy_setopt(easy, CURLOPT_WRITEFUNCTION, write_cb);
-      curl_easy_setopt(easy, CURLOPT_WRITEDATA, NULL);
-      curl_easy_setopt(easy, CURLOPT_HTTPGET, 1L);
-      curl_msnprintf(range, sizeof(range), "%" PRIu64 "-%" PRIu64,
-                     UINT64_C(0), UINT64_C(16384));
-      curl_easy_setopt(easy, CURLOPT_RANGE, range);
-
-      mc = curl_multi_add_handle(multi, easy);
-      if(mc != CURLM_OK) {
-        fprintf(stderr, "curl_multi_add_handle: %s\n",
-               curl_multi_strerror(mc));
-        exit(1);
-      }
-      --start_count;
-    }
-
-    mc = curl_multi_perform(multi, &running_handles);
-    if(mc != CURLM_OK) {
-      fprintf(stderr, "curl_multi_perform: %s\n",
-             curl_multi_strerror(mc));
-      exit(1);
-    }
-
-    if(running_handles) {
-      mc = curl_multi_poll(multi, NULL, 0, 1000000, &numfds);
-      if(mc != CURLM_OK) {
-        fprintf(stderr, "curl_multi_poll: %s\n",
-               curl_multi_strerror(mc));
-        exit(1);
-      }
-    }
-
-    /* Check for finished handles and remove. */
-    while((msg = curl_multi_info_read(multi, &msgs_in_queue))) {
-      if(msg->msg == CURLMSG_DONE) {
-        long status = 0;
-        curl_off_t xfer_id;
-        curl_easy_getinfo(msg->easy_handle, CURLINFO_XFER_ID, &xfer_id);
-        curl_easy_getinfo(msg->easy_handle, CURLINFO_RESPONSE_CODE, &status);
-        if(msg->data.result == CURLE_SEND_ERROR ||
-            msg->data.result == CURLE_RECV_ERROR) {
-          /* We get these if the server had a GOAWAY in transit on
-           * re-using a connection */
-        }
-        else if(msg->data.result) {
-          fprintf(stderr, "transfer #%" CURL_FORMAT_CURL_OFF_T
-                  ": failed with %d\n", xfer_id, msg->data.result);
-          exit(1);
-        }
-        else if(status != 206) {
-          fprintf(stderr, "transfer #%" CURL_FORMAT_CURL_OFF_T
-                  ": wrong http status %ld (expected 206)\n", xfer_id, status);
-          exit(1);
-        }
-        curl_multi_remove_handle(multi, msg->easy_handle);
-        curl_easy_cleanup(msg->easy_handle);
-        fprintf(stderr, "transfer #%" CURL_FORMAT_CURL_OFF_T" retiring "
-                "(%d now running)\n", xfer_id, running_handles);
-      }
-    }
-
-    fprintf(stderr, "running_handles=%d, yet_to_start=%d\n",
-            running_handles, start_count);
-
-  } while(running_handles > 0 || start_count);
-
-  fprintf(stderr, "exiting\n");
-  exit(EXIT_SUCCESS);
-}
diff --git a/third-party/curl/tests/http/clients/tls-session-reuse.c b/third-party/curl/tests/http/clients/tls-session-reuse.c
deleted file mode 100644
index 0309276cf8..0000000000
--- a/third-party/curl/tests/http/clients/tls-session-reuse.c
+++ /dev/null
@@ -1,306 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-/* <DESC>
- * TLS session reuse
- * </DESC>
- */
-#include <stdio.h>
-#include <stdlib.h>
-#include <stdint.h>
-#include <string.h>
-#include <inttypes.h>
-/* #include <error.h> */
-#include <errno.h>
-#include <curl/curl.h>
-#include <curl/mprintf.h>
-
-
-static void log_line_start(FILE *log, const char *idsbuf, curl_infotype type)
-{
-  /*
-   * This is the trace look that is similar to what libcurl makes on its
-   * own.
-   */
-  static const char * const s_infotype[] = {
-    "* ", "< ", "> ", "{ ", "} ", "{ ", "} "
-  };
-  if(idsbuf && *idsbuf)
-    fprintf(log, "%s%s", idsbuf, s_infotype[type]);
-  else
-    fputs(s_infotype[type], log);
-}
-
-#define TRC_IDS_FORMAT_IDS_1  "[%" CURL_FORMAT_CURL_OFF_T "-x] "
-#define TRC_IDS_FORMAT_IDS_2  "[%" CURL_FORMAT_CURL_OFF_T "-%" \
-                                   CURL_FORMAT_CURL_OFF_T "] "
-/*
-** callback for CURLOPT_DEBUGFUNCTION
-*/
-static int debug_cb(CURL *handle, curl_infotype type,
-                    char *data, size_t size,
-                    void *userdata)
-{
-  FILE *output = stderr;
-  static int newl = 0;
-  static int traced_data = 0;
-  char idsbuf[60];
-  curl_off_t xfer_id, conn_id;
-
-  (void)handle; /* not used */
-  (void)userdata;
-
-  if(!curl_easy_getinfo(handle, CURLINFO_XFER_ID, &xfer_id) && xfer_id >= 0) {
-    if(!curl_easy_getinfo(handle, CURLINFO_CONN_ID, &conn_id) &&
-        conn_id >= 0) {
-      curl_msnprintf(idsbuf, sizeof(idsbuf), TRC_IDS_FORMAT_IDS_2,
-                     xfer_id, conn_id);
-    }
-    else {
-      curl_msnprintf(idsbuf, sizeof(idsbuf), TRC_IDS_FORMAT_IDS_1, xfer_id);
-    }
-  }
-  else
-    idsbuf[0] = 0;
-
-  switch(type) {
-  case CURLINFO_HEADER_OUT:
-    if(size > 0) {
-      size_t st = 0;
-      size_t i;
-      for(i = 0; i < size - 1; i++) {
-        if(data[i] == '\n') { /* LF */
-          if(!newl) {
-            log_line_start(output, idsbuf, type);
-          }
-          (void)fwrite(data + st, i - st + 1, 1, output);
-          st = i + 1;
-          newl = 0;
-        }
-      }
-      if(!newl)
-        log_line_start(output, idsbuf, type);
-      (void)fwrite(data + st, i - st + 1, 1, output);
-    }
-    newl = (size && (data[size - 1] != '\n')) ? 1 : 0;
-    traced_data = 0;
-    break;
-  case CURLINFO_TEXT:
-  case CURLINFO_HEADER_IN:
-    if(!newl)
-      log_line_start(output, idsbuf, type);
-    (void)fwrite(data, size, 1, output);
-    newl = (size && (data[size - 1] != '\n')) ? 1 : 0;
-    traced_data = 0;
-    break;
-  case CURLINFO_DATA_OUT:
-  case CURLINFO_DATA_IN:
-  case CURLINFO_SSL_DATA_IN:
-  case CURLINFO_SSL_DATA_OUT:
-    if(!traced_data) {
-      if(!newl)
-        log_line_start(output, idsbuf, type);
-      fprintf(output, "[%ld bytes data]\n", (long)size);
-      newl = 0;
-      traced_data = 1;
-    }
-    break;
-  default: /* nada */
-    newl = 0;
-    traced_data = 1;
-    break;
-  }
-
-  return 0;
-}
-
-static size_t write_cb(char *ptr, size_t size, size_t nmemb, void *opaque)
-{
-  (void)ptr;
-  (void)opaque;
-  return size * nmemb;
-}
-
-static void add_transfer(CURLM *multi, CURLSH *share,
-                         struct curl_slist *resolve, const char *url)
-{
-  CURL *easy;
-  CURLMcode mc;
-
-  easy = curl_easy_init();
-  if(!easy) {
-    fprintf(stderr, "curl_easy_init failed\n");
-    exit(1);
-  }
-  curl_easy_setopt(easy, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(easy, CURLOPT_DEBUGFUNCTION, debug_cb);
-  curl_easy_setopt(easy, CURLOPT_URL, url);
-  curl_easy_setopt(easy, CURLOPT_SHARE, share);
-  curl_easy_setopt(easy, CURLOPT_NOSIGNAL, 1L);
-  curl_easy_setopt(easy, CURLOPT_AUTOREFERER, 1L);
-  curl_easy_setopt(easy, CURLOPT_FAILONERROR, 1L);
-  curl_easy_setopt(easy, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
-  curl_easy_setopt(easy, CURLOPT_WRITEFUNCTION, write_cb);
-  curl_easy_setopt(easy, CURLOPT_WRITEDATA, NULL);
-  curl_easy_setopt(easy, CURLOPT_HTTPGET, 1L);
-  curl_easy_setopt(easy, CURLOPT_SSL_VERIFYPEER, 0L);
-  if(resolve)
-    curl_easy_setopt(easy, CURLOPT_RESOLVE, resolve);
-
-
-  mc = curl_multi_add_handle(multi, easy);
-  if(mc != CURLM_OK) {
-    fprintf(stderr, "curl_multi_add_handle: %s\n",
-           curl_multi_strerror(mc));
-    exit(1);
-  }
-}
-
-int main(int argc, char *argv[])
-{
-  const char *url;
-  CURLM *multi;
-  CURLMcode mc;
-  int running_handles = 0, numfds;
-  CURLMsg *msg;
-  CURLSH *share;
-  CURLU *cu;
-  struct curl_slist resolve;
-  char resolve_buf[1024];
-  int msgs_in_queue;
-  int add_more, waits, ongoing = 0;
-  char *host, *port;
-
-  if(argc != 2) {
-    fprintf(stderr, "%s URL\n", argv[0]);
-    exit(2);
-  }
-
-  url = argv[1];
-  cu = curl_url();
-  if(!cu) {
-    fprintf(stderr, "out of memory\n");
-    exit(1);
-  }
-  if(curl_url_set(cu, CURLUPART_URL, url, 0)) {
-    fprintf(stderr, "not a URL: '%s'\n", url);
-    exit(1);
-  }
-  if(curl_url_get(cu, CURLUPART_HOST, &host, 0)) {
-    fprintf(stderr, "could not get host of '%s'\n", url);
-    exit(1);
-  }
-  if(curl_url_get(cu, CURLUPART_PORT, &port, 0)) {
-    fprintf(stderr, "could not get port of '%s'\n", url);
-    exit(1);
-  }
-
-   memset(&resolve, 0, sizeof(resolve));
-   curl_msnprintf(resolve_buf, sizeof(resolve_buf)-1,
-                  "%s:%s:127.0.0.1", host, port);
-  curl_slist_append(&resolve, resolve_buf);
-
-  multi = curl_multi_init();
-  if(!multi) {
-    fprintf(stderr, "curl_multi_init failed\n");
-    exit(1);
-  }
-
-  share = curl_share_init();
-  if(!share) {
-    fprintf(stderr, "curl_share_init failed\n");
-    exit(1);
-  }
-  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_SSL_SESSION);
-
-
-  add_transfer(multi, share, &resolve, url);
-  ++ongoing;
-  add_more = 6;
-  waits = 3;
-  do {
-    mc = curl_multi_perform(multi, &running_handles);
-    if(mc != CURLM_OK) {
-      fprintf(stderr, "curl_multi_perform: %s\n",
-             curl_multi_strerror(mc));
-      exit(1);
-    }
-
-    if(running_handles) {
-      mc = curl_multi_poll(multi, NULL, 0, 1000000, &numfds);
-      if(mc != CURLM_OK) {
-        fprintf(stderr, "curl_multi_poll: %s\n",
-               curl_multi_strerror(mc));
-        exit(1);
-      }
-    }
-
-    if(waits) {
-      --waits;
-    }
-    else {
-      while(add_more) {
-        add_transfer(multi, share, &resolve, url);
-        ++ongoing;
-        --add_more;
-      }
-    }
-
-    /* Check for finished handles and remove. */
-    while((msg = curl_multi_info_read(multi, &msgs_in_queue))) {
-      if(msg->msg == CURLMSG_DONE) {
-        long status = 0;
-        curl_off_t xfer_id;
-        curl_easy_getinfo(msg->easy_handle, CURLINFO_XFER_ID, &xfer_id);
-        curl_easy_getinfo(msg->easy_handle, CURLINFO_RESPONSE_CODE, &status);
-        if(msg->data.result == CURLE_SEND_ERROR ||
-            msg->data.result == CURLE_RECV_ERROR) {
-          /* We get these if the server had a GOAWAY in transit on
-           * re-using a connection */
-        }
-        else if(msg->data.result) {
-          fprintf(stderr, "transfer #%" CURL_FORMAT_CURL_OFF_T
-                  ": failed with %d\n", xfer_id, msg->data.result);
-          exit(1);
-        }
-        else if(status != 200) {
-          fprintf(stderr, "transfer #%" CURL_FORMAT_CURL_OFF_T
-                  ": wrong http status %ld (expected 200)\n", xfer_id, status);
-          exit(1);
-        }
-        curl_multi_remove_handle(multi, msg->easy_handle);
-        curl_easy_cleanup(msg->easy_handle);
-        --ongoing;
-        fprintf(stderr, "transfer #%" CURL_FORMAT_CURL_OFF_T" retiring "
-                "(%d now running)\n", xfer_id, running_handles);
-      }
-    }
-
-    fprintf(stderr, "running_handles=%d, yet_to_start=%d\n",
-            running_handles, add_more);
-
-  } while(ongoing || add_more);
-
-  fprintf(stderr, "exiting\n");
-  exit(EXIT_SUCCESS);
-}
diff --git a/third-party/curl/tests/http/clients/ws-data.c b/third-party/curl/tests/http/clients/ws-data.c
deleted file mode 100644
index 487d109ef3..0000000000
--- a/third-party/curl/tests/http/clients/ws-data.c
+++ /dev/null
@@ -1,263 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-/* <DESC>
- * Websockets data echos
- * </DESC>
- */
-
-/* curl stuff */
-#include "curl_setup.h"
-#include <curl/curl.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-/* somewhat unix-specific */
-#include <sys/time.h>
-#include <unistd.h>
-
-#ifdef USE_WEBSOCKETS
-
-static
-void dump(const char *text, unsigned char *ptr, size_t size,
-          char nohex)
-{
-  size_t i;
-  size_t c;
-
-  unsigned int width = 0x10;
-
-  if(nohex)
-    /* without the hex output, we can fit more on screen */
-    width = 0x40;
-
-  fprintf(stderr, "%s, %lu bytes (0x%lx)\n",
-          text, (unsigned long)size, (unsigned long)size);
-
-  for(i = 0; i<size; i += width) {
-
-    fprintf(stderr, "%4.4lx: ", (unsigned long)i);
-
-    if(!nohex) {
-      /* hex not disabled, show it */
-      for(c = 0; c < width; c++)
-        if(i + c < size)
-          fprintf(stderr, "%02x ", ptr[i + c]);
-        else
-          fputs("   ", stderr);
-    }
-
-    for(c = 0; (c < width) && (i + c < size); c++) {
-      /* check for 0D0A; if found, skip past and start a new line of output */
-      if(nohex && (i + c + 1 < size) && ptr[i + c] == 0x0D &&
-         ptr[i + c + 1] == 0x0A) {
-        i += (c + 2 - width);
-        break;
-      }
-      fprintf(stderr, "%c",
-              (ptr[i + c] >= 0x20) && (ptr[i + c]<0x80)?ptr[i + c]:'.');
-      /* check again for 0D0A, to avoid an extra \n if it's at width */
-      if(nohex && (i + c + 2 < size) && ptr[i + c + 1] == 0x0D &&
-         ptr[i + c + 2] == 0x0A) {
-        i += (c + 3 - width);
-        break;
-      }
-    }
-    fputc('\n', stderr); /* newline */
-  }
-}
-
-static CURLcode send_binary(CURL *curl, char *buf, size_t buflen)
-{
-  size_t nwritten;
-  CURLcode result =
-    curl_ws_send(curl, buf, buflen, &nwritten, 0, CURLWS_BINARY);
-  fprintf(stderr, "ws: send_binary(len=%ld) -> %d, %ld\n",
-          (long)buflen, result, (long)nwritten);
-  return result;
-}
-
-static CURLcode recv_binary(CURL *curl, char *exp_data, size_t exp_len)
-{
-  const struct curl_ws_frame *frame;
-  char recvbuf[256];
-  size_t r_offset, nread;
-  CURLcode result;
-
-  fprintf(stderr, "recv_binary: expected payload %ld bytes\n", (long)exp_len);
-  r_offset = 0;
-  while(1) {
-    result = curl_ws_recv(curl, recvbuf, sizeof(recvbuf), &nread, &frame);
-    if(result == CURLE_AGAIN) {
-      fprintf(stderr, "EAGAIN, sleep, try again\n");
-      usleep(100*1000);
-      continue;
-    }
-    fprintf(stderr, "ws: curl_ws_recv(offset=%ld, len=%ld) -> %d, %ld\n",
-            (long)r_offset, (long)sizeof(recvbuf), result, (long)nread);
-    if(result) {
-      return result;
-    }
-    if(!(frame->flags & CURLWS_BINARY)) {
-      fprintf(stderr, "recv_data: wrong frame, got %ld bytes rflags %x\n",
-              (long)nread, frame->flags);
-      return CURLE_RECV_ERROR;
-    }
-    if(frame->offset != (curl_off_t)r_offset) {
-      fprintf(stderr, "recv_data: frame offset, expected %ld, got %ld\n",
-              (long)r_offset, (long)frame->offset);
-      return CURLE_RECV_ERROR;
-    }
-    if(frame->bytesleft != (curl_off_t)(exp_len - r_offset - nread)) {
-      fprintf(stderr, "recv_data: frame bytesleft, expected %ld, got %ld\n",
-              (long)(exp_len - r_offset - nread), (long)frame->bytesleft);
-      return CURLE_RECV_ERROR;
-    }
-    if(r_offset + nread > exp_len) {
-      fprintf(stderr, "recv_data: data length, expected %ld, now at %ld\n",
-              (long)exp_len, (long)(r_offset + nread));
-      return CURLE_RECV_ERROR;
-    }
-    if(memcmp(exp_data + r_offset, recvbuf, nread)) {
-      fprintf(stderr, "recv_data: data differs, offset=%ld, len=%ld\n",
-              (long)r_offset, (long)nread);
-      dump("expected:", (unsigned char *)exp_data + r_offset, nread, 0);
-      dump("received:", (unsigned char *)recvbuf, nread, 0);
-      return CURLE_RECV_ERROR;
-    }
-    r_offset += nread;
-    if(r_offset >= exp_len) {
-      fprintf(stderr, "recv_data: frame complete\n");
-      break;
-    }
-  }
-  return CURLE_OK;
-}
-
-/* just close the connection */
-static void websocket_close(CURL *curl)
-{
-  size_t sent;
-  CURLcode result =
-    curl_ws_send(curl, "", 0, &sent, 0, CURLWS_CLOSE);
-  fprintf(stderr,
-          "ws: curl_ws_send returned %u, sent %u\n", (int)result, (int)sent);
-}
-
-static CURLcode data_echo(CURL *curl, size_t plen_min, size_t plen_max)
-{
-  CURLcode res;
-  size_t len;
-  char *send_buf;
-  size_t i;
-
-  send_buf = calloc(1, plen_max);
-  if(!send_buf)
-    return CURLE_OUT_OF_MEMORY;
-  for(i = 0; i < plen_max; ++i) {
-    send_buf[i] = (char)('0' + ((int)i % 10));
-  }
-
-  for(len = plen_min; len <= plen_max; ++len) {
-    res = send_binary(curl, send_buf, len);
-    if(res)
-      goto out;
-    res = recv_binary(curl, send_buf, len);
-    if(res) {
-      fprintf(stderr, "recv_data(len=%ld) -> %d\n", (long)len, res);
-      goto out;
-    }
-  }
-
-out:
-  if(!res)
-    websocket_close(curl);
-  free(send_buf);
-  return res;
-}
-
-#endif
-
-int main(int argc, char *argv[])
-{
-#ifdef USE_WEBSOCKETS
-  CURL *curl;
-  CURLcode res = CURLE_OK;
-  const char *url;
-  long l1, l2;
-  size_t plen_min, plen_max;
-
-
-  if(argc != 4) {
-    fprintf(stderr, "usage: ws-data url minlen maxlen\n");
-    return 2;
-  }
-  url = argv[1];
-  l1 = strtol(argv[2], NULL, 10);
-  if(l1 < 0) {
-    fprintf(stderr, "minlen must be >= 0, got %ld\n", l1);
-    return 2;
-  }
-  l2 = strtol(argv[3], NULL, 10);
-  if(l2 < 0) {
-    fprintf(stderr, "maxlen must be >= 0, got %ld\n", l2);
-    return 2;
-  }
-  plen_min = l1;
-  plen_max = l2;
-  if(plen_max < plen_min) {
-    fprintf(stderr, "maxlen must be >= minlen, got %ld-%ld\n",
-            (long)plen_min, (long)plen_max);
-    return 2;
-  }
-
-  curl_global_init(CURL_GLOBAL_ALL);
-
-  curl = curl_easy_init();
-  if(curl) {
-    curl_easy_setopt(curl, CURLOPT_URL, url);
-
-    /* use the callback style */
-    curl_easy_setopt(curl, CURLOPT_USERAGENT, "ws-data");
-    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
-    curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 2L); /* websocket style */
-    res = curl_easy_perform(curl);
-    fprintf(stderr, "curl_easy_perform() returned %u\n", (int)res);
-    if(res == CURLE_OK)
-      res = data_echo(curl, plen_min, plen_max);
-
-    /* always cleanup */
-    curl_easy_cleanup(curl);
-  }
-  curl_global_cleanup();
-  return (int)res;
-
-#else /* USE_WEBSOCKETS */
-  (void)argc;
-  (void)argv;
-  fprintf(stderr, "websockets not enabled in libcurl\n");
-  return 1;
-#endif /* !USE_WEBSOCKETS */
-}
diff --git a/third-party/curl/tests/http/clients/ws-pingpong.c b/third-party/curl/tests/http/clients/ws-pingpong.c
deleted file mode 100644
index dc36d45482..0000000000
--- a/third-party/curl/tests/http/clients/ws-pingpong.c
+++ /dev/null
@@ -1,158 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-/* <DESC>
- * Websockets pingpong
- * </DESC>
- */
-
-/* curl stuff */
-#include "curl_setup.h"
-#include <curl/curl.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-/* somewhat unix-specific */
-#include <sys/time.h>
-#include <unistd.h>
-
-#ifdef USE_WEBSOCKETS
-
-static CURLcode ping(CURL *curl, const char *send_payload)
-{
-  size_t sent;
-  CURLcode result =
-    curl_ws_send(curl, send_payload, strlen(send_payload), &sent, 0,
-                 CURLWS_PING);
-  fprintf(stderr,
-          "ws: curl_ws_send returned %u, sent %u\n", (int)result, (int)sent);
-
-  return result;
-}
-
-static CURLcode recv_pong(CURL *curl, const char *expected_payload)
-{
-  size_t rlen;
-  const struct curl_ws_frame *meta;
-  char buffer[256];
-  CURLcode result = curl_ws_recv(curl, buffer, sizeof(buffer), &rlen, &meta);
-  if(result) {
-    fprintf(stderr, "ws: curl_ws_recv returned %u, received %ld\n",
-            (int)result, (long)rlen);
-    return result;
-  }
-
-  if(!(meta->flags & CURLWS_PONG)) {
-    fprintf(stderr, "recv_pong: wrong frame, got %d bytes rflags %x\n",
-            (int)rlen, meta->flags);
-    return CURLE_RECV_ERROR;
-  }
-
-  fprintf(stderr, "ws: got PONG back\n");
-  if(rlen == strlen(expected_payload) &&
-     !memcmp(expected_payload, buffer, rlen)) {
-    fprintf(stderr, "ws: got the same payload back\n");
-    return CURLE_OK;
-  }
-  fprintf(stderr, "ws: did NOT get the same payload back\n");
-  return CURLE_RECV_ERROR;
-}
-
-/* just close the connection */
-static void websocket_close(CURL *curl)
-{
-  size_t sent;
-  CURLcode result =
-    curl_ws_send(curl, "", 0, &sent, 0, CURLWS_CLOSE);
-  fprintf(stderr,
-          "ws: curl_ws_send returned %u, sent %u\n", (int)result, (int)sent);
-}
-
-static CURLcode pingpong(CURL *curl, const char *payload)
-{
-  CURLcode res;
-  int i;
-
-  res = ping(curl, payload);
-  if(res)
-    return res;
-  for(i = 0; i < 10; ++i) {
-    fprintf(stderr, "Receive pong\n");
-    res = recv_pong(curl, payload);
-    if(res == CURLE_AGAIN) {
-      usleep(100*1000);
-      continue;
-    }
-    websocket_close(curl);
-    return res;
-  }
-  websocket_close(curl);
-  return CURLE_RECV_ERROR;
-}
-
-#endif
-
-int main(int argc, char *argv[])
-{
-#ifdef USE_WEBSOCKETS
-  CURL *curl;
-  CURLcode res = CURLE_OK;
-  const char *url, *payload;
-
-  if(argc != 3) {
-    fprintf(stderr, "usage: ws-pingpong url payload\n");
-    return 2;
-  }
-  url = argv[1];
-  payload = argv[2];
-
-  curl_global_init(CURL_GLOBAL_ALL);
-
-  curl = curl_easy_init();
-  if(curl) {
-    curl_easy_setopt(curl, CURLOPT_URL, url);
-
-    /* use the callback style */
-    curl_easy_setopt(curl, CURLOPT_USERAGENT, "ws-pingpong");
-    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
-    curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 2L); /* websocket style */
-    res = curl_easy_perform(curl);
-    fprintf(stderr, "curl_easy_perform() returned %u\n", (int)res);
-    if(res == CURLE_OK)
-      res = pingpong(curl, payload);
-
-    /* always cleanup */
-    curl_easy_cleanup(curl);
-  }
-  curl_global_cleanup();
-  return (int)res;
-
-#else /* USE_WEBSOCKETS */
-  (void)argc;
-  (void)argv;
-  fprintf(stderr, "websockets not enabled in libcurl\n");
-  return 1;
-#endif /* !USE_WEBSOCKETS */
-}
diff --git a/third-party/curl/tests/http/config.ini.in b/third-party/curl/tests/http/config.ini.in
index 42a967906c..daf9869b7c 100644
--- a/third-party/curl/tests/http/config.ini.in
+++ b/third-party/curl/tests/http/config.ini.in
@@ -28,10 +28,22 @@
 [httpd]
 apxs = @APXS@
 httpd = @HTTPD@
-apachectl = @APACHECTL@
 
 [nghttpx]
 nghttpx = @HTTPD_NGHTTPX@
 
 [caddy]
 caddy = @CADDY@
+
+[vsftpd]
+vsftpd = @VSFTPD@
+
+[danted]
+danted = @DANTED@
+
+[sshd]
+sshd = @SSHD@
+sftpd = @SFTPD@
+
+[h2o]
+h2o = @H2O@
diff --git a/third-party/curl/tests/http/conftest.py b/third-party/curl/tests/http/conftest.py
index 3aca42e66f..225d63fe6d 100644
--- a/third-party/curl/tests/http/conftest.py
+++ b/third-party/curl/tests/http/conftest.py
@@ -1,4 +1,4 @@
-#***************************************************************************
+# ***************************************************************************
 #                                  _   _ ____  _
 #  Project                     ___| | | |  _ \| |
 #                             / __| | | | |_) | |
@@ -24,63 +24,172 @@
 #
 import logging
 import os
+import platform
 import sys
-from typing import Optional
+from typing import Generator, Union
 
 import pytest
+from testenv.env import EnvConfig
 
-sys.path.append(os.path.join(os.path.dirname(__file__), '.'))
+sys.path.append(os.path.join(os.path.dirname(__file__), "."))
 
-from testenv import Env, Nghttpx, Httpd, NghttpxQuic, NghttpxFwd
+from testenv import Env, Httpd, Nghttpx, NghttpxFwd, NghttpxQuic, Sshd
+from testenv.h2o import H2oProxy, H2oServer
 
-@pytest.fixture(scope="package")
-def env(pytestconfig) -> Env:
-    env = Env(pytestconfig=pytestconfig)
+log = logging.getLogger(__name__)
+
+
+def pytest_report_header(config):
+    # Env inits its base properties only once, we can report them here
+    env = Env()
+    report = [
+        f"Testing curl {env.curl_version()}",
+        f"  platform: {platform.platform()}",
+        f"  curl: Version: {env.curl_version_string()}",
+        f"  curl: Features: {env.curl_features_string()}",
+        f"  curl: Protocols: {env.curl_protocols_string()}",
+        f"  httpd: {env.httpd_version()}",
+        f"  httpd-proxy: {env.httpd_version()}",
+    ]
+    if env.have_h3():
+        report.extend([f"  nghttpx: {env.nghttpx_version()}"])
+    if env.have_h2o():
+        report.extend([f"  h2o: {env.h2o_version()}"])
+    if env.has_caddy():
+        report.extend([f"  Caddy: {env.caddy_version()}"])
+    if env.has_vsftpd():
+        report.extend([f"  VsFTPD: {env.vsftpd_version()}"])
+    buildinfo_fn = os.path.join(env.build_dir, "buildinfo.txt")
+    if os.path.exists(buildinfo_fn):
+        with open(buildinfo_fn, "r") as file_in:
+            for line in file_in:
+                line = line.strip()
+                if line and not line.startswith("#"):
+                    report.extend([line])
+    return "\n".join(report)
+
+
+@pytest.fixture(scope="session")
+def env_config(pytestconfig, testrun_uid, worker_id) -> EnvConfig:
+    return EnvConfig(
+        pytestconfig=pytestconfig, testrun_uid=testrun_uid, worker_id=worker_id
+    )
+
+
+@pytest.fixture(scope="session", autouse=True)
+def env(pytestconfig, env_config) -> Env:
+    env = Env(pytestconfig=pytestconfig, env_config=env_config)
     level = logging.DEBUG if env.verbose > 0 else logging.INFO
-    logging.getLogger('').setLevel(level=level)
-    if not env.curl_has_protocol('http'):
+    logging.getLogger("").setLevel(level=level)
+    if not env.curl_has_protocol("http"):
         pytest.skip("curl built without HTTP support")
-    if not env.curl_has_protocol('https'):
+    if not env.curl_has_protocol("https"):
         pytest.skip("curl built without HTTPS support")
     if env.setup_incomplete():
         pytest.skip(env.incomplete_reason())
 
     env.setup()
-    if not env.make_clients():
-        pytest.exit(1)
     return env
 
-@pytest.fixture(scope="package", autouse=True)
-def log_global_env_facts(record_testsuite_property, env):
-    record_testsuite_property("http-port", env.http_port)
 
-
-@pytest.fixture(scope='package')
-def httpd(env) -> Httpd:
+@pytest.fixture(scope="session")
+def httpd(env) -> Generator[Httpd, None, None]:
     httpd = Httpd(env=env)
     if not httpd.exists():
-        pytest.skip(f'httpd not found: {env.httpd}')
+        pytest.skip(f"httpd not found: {env.httpd}")
     httpd.clear_logs()
-    if not httpd.start():
-        pytest.fail(f'failed to start httpd: {env.httpd}')
+    assert httpd.initial_start()
     yield httpd
     httpd.stop()
 
 
-@pytest.fixture(scope='package')
-def nghttpx(env, httpd) -> Optional[Nghttpx]:
+@pytest.fixture(scope="session")
+def nghttpx(env, httpd) -> Generator[Union[Nghttpx, bool], None, None]:
     nghttpx = NghttpxQuic(env=env)
-    if env.have_h3():
+    if nghttpx.exists():
+        if not nghttpx.supports_h3() and env.have_h3_curl():
+            log.warning("nghttpx does not support QUIC, but curl does")
         nghttpx.clear_logs()
-        assert nghttpx.start()
-    yield nghttpx
-    nghttpx.stop()
+        assert nghttpx.initial_start()
+        yield nghttpx
+        nghttpx.stop()
+    else:
+        yield False
 
-@pytest.fixture(scope='package')
-def nghttpx_fwd(env, httpd) -> Optional[Nghttpx]:
+
+@pytest.fixture(scope="session")
+def nghttpx_fwd(env, httpd) -> Generator[Union[Nghttpx, bool], None, None]:
     nghttpx = NghttpxFwd(env=env)
-    if env.have_h3():
+    if nghttpx.exists():
         nghttpx.clear_logs()
-        assert nghttpx.start()
-    yield nghttpx
-    nghttpx.stop()
+        assert nghttpx.initial_start()
+        yield nghttpx
+        nghttpx.stop()
+    else:
+        yield False
+
+
+@pytest.fixture(scope="session")
+def sshd(env: Env) -> Generator[Union[Sshd, bool], None, None]:
+    if env.has_sshd():
+        sshd = Sshd(env=env)
+        assert sshd.initial_start(), f"{sshd.dump_log()}"
+        yield sshd
+        sshd.stop()
+    else:
+        yield False
+
+
+@pytest.fixture(scope="session")
+def configures_httpd(env, httpd) -> Generator[bool, None, None]:
+    # include this fixture as test parameter if the test configures httpd itself
+    yield True
+
+
+@pytest.fixture(scope="session")
+def configures_nghttpx(env, httpd) -> Generator[bool, None, None]:
+    # include this fixture as test parameter if the test configures nghttpx itself
+    yield True
+
+
+@pytest.fixture(autouse=True, scope="function")
+def server_reset(request, env, httpd, nghttpx):
+    # make sure httpd is in default configuration when a test starts
+    if "configures_httpd" not in request.node._fixtureinfo.argnames:
+        httpd.reset_config()
+        httpd.reload_if_config_changed()
+    if (
+        env.have_h3()
+        and "nghttpx" in request.node._fixtureinfo.argnames
+        and "configures_nghttpx" not in request.node._fixtureinfo.argnames
+    ):
+        nghttpx.reset_config()
+        nghttpx.reload_if_config_changed()
+
+
+@pytest.fixture(scope="session")
+def h2o_server(env) -> Generator[Union[H2oServer, bool], None, None]:
+    h2o = H2oServer(env=env)
+    if env.have_h2o():
+        h2o.clear_logs()
+        if not h2o.initial_start():
+            h2o_logs = "\n".join(h2o.dump_logs())
+            pytest.skip(f"h2o server failed to start\n{h2o_logs}")
+        yield h2o
+        h2o.kill()
+    else:
+        yield False
+
+
+@pytest.fixture(scope="session")
+def h2o_proxy(env) -> Generator[Union[H2oProxy, bool], None, None]:
+    h2o = H2oProxy(env=env)
+    if env.have_h2o():
+        h2o.clear_logs()
+        if not h2o.initial_start():
+            h2o_logs = "\n".join(h2o.dump_logs())
+            pytest.skip(f"h2o proxy failed to start\n{h2o_logs}")
+        yield h2o
+        h2o.kill()
+    else:
+        yield False
diff --git a/third-party/curl/tests/http/requirements.txt b/third-party/curl/tests/http/requirements.txt
index ff49a96297..a31374e064 100644
--- a/third-party/curl/tests/http/requirements.txt
+++ b/third-party/curl/tests/http/requirements.txt
@@ -1,29 +1,10 @@
-# -*- coding: utf-8 -*-
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
 # Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
 #
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
 # SPDX-License-Identifier: curl
-#
-###########################################################################
-#
-pytest
-cryptography
-multipart
-websockets
+
+cryptography==48.0.1
+filelock==3.29.0
+psutil==7.2.2
+pytest==9.0.3
+pytest-xdist==3.8.0
+websockets==16.0
diff --git a/third-party/curl/tests/http/scorecard.py b/third-party/curl/tests/http/scorecard.py
index ae466129c0..36947592e2 100644
--- a/third-party/curl/tests/http/scorecard.py
+++ b/third-party/curl/tests/http/scorecard.py
@@ -25,47 +25,270 @@
 ###########################################################################
 #
 import argparse
+import datetime
 import json
 import logging
 import os
 import re
 import sys
 from statistics import mean
-from typing import Dict, Any, Optional, List
+from typing import Any, Dict, List, Optional
 
-from testenv import Env, Httpd, Nghttpx, CurlClient, Caddy, ExecResult, NghttpxFwd
+from testenv import (
+    Caddy,
+    CurlClient,
+    Dante,
+    Env,
+    ExecResult,
+    Httpd,
+    NghttpxQuic,
+    RunProfile,
+)
 
 log = logging.getLogger(__name__)
 
 
-class ScoreCardException(Exception):
+class ScoreCardError(Exception):
     pass
 
 
-class ScoreCard:
+class Card:
+    @classmethod
+    def fmt_ms(cls, tval):
+        return f'{int(tval * 1000)} ms' if tval >= 0 else '--'
+
+    @classmethod
+    def fmt_size(cls, val):
+        if val >= (1024 * 1024 * 1024):
+            return f'{val / (1024 * 1024 * 1024):0.000f}GB'
+        if val >= (1024 * 1024):
+            return f'{val / (1024 * 1024):0.000f}MB'
+        if val >= 1024:
+            return f'{val / 1024:0.000f}KB'
+        return f'{val:0.000f}B'
+
+    @classmethod
+    def fmt_mbs(cls, val):
+        if val is None or val < 0:
+            return '--'
+        if val >= (1024 * 1024):
+            return f'{val / (1024 * 1024):.3g} MB/s'
+        if val >= 1024:
+            return f'{val / 1024:.3g} KB/s'
+        return f'{val:.3g} B/s'
+
+    @classmethod
+    def fmt_speed(cls, val):
+        if val is None or val < 0:
+            return '--'
+        if val >= (10 * 1024 * 1024):
+            return f'{(val / (1024 * 1024)):.3f} MB/s'
+        if val >= (10 * 1024):
+            return f'{val / 1024:.3f} KB/s'
+        return f'{val:.3f} B/s'
+
+    @classmethod
+    def fmt_speed_result(cls, val, limit):
+        if val is None or val < 0:
+            return '--'
+        pct = ((val / limit) * 100) - 100
+        if val >= (10 * 1024 * 1024):
+            return f'{(val / (1024 * 1024)):.3f} MB/s, {pct:+.1f}%'
+        if val >= (10 * 1024):
+            return f'{val / 1024:.3f} KB/s, {pct:+.1f}%'
+        return f'{val:.3f} B/s, {pct:+.1f}%'
+
+    @classmethod
+    def fmt_reqs(cls, val):
+        return f'{val:0.000f} r/s' if val >= 0 else '--'
+
+    @classmethod
+    def mk_mbs_cell(cls, samples, profiles, errors):
+        val = mean(samples) if len(samples) else -1
+        cell = {
+            'val': val,
+            'sval': Card.fmt_mbs(val) if val >= 0 else '--',
+        }
+        if len(profiles):
+            cell['stats'] = RunProfile.AverageStats(profiles)
+        if len(errors):
+            cell['errors'] = errors
+        return cell
+
+    @classmethod
+    def mk_speed_cell(cls, samples, profiles, errors, limit):
+        val = mean(samples) if len(samples) else -1
+        cell = {
+            'val': val,
+            'sval': Card.fmt_speed_result(val, limit) if val >= 0 else '--',
+        }
+        if len(profiles):
+            cell['stats'] = RunProfile.AverageStats(profiles)
+        if len(errors):
+            cell['errors'] = errors
+        return cell
+
+    @classmethod
+    def mk_reqs_cell(cls, samples, profiles, errors):
+        val = mean(samples) if len(samples) else -1
+        cell = {
+            'val': val,
+            'sval': Card.fmt_reqs(val) if val >= 0 else '--',
+        }
+        if len(profiles):
+            cell['stats'] = RunProfile.AverageStats(profiles)
+        if len(errors):
+            cell['errors'] = errors
+        return cell
+
+    @classmethod
+    def parse_size(cls, s):
+        m = re.match(r'(\d+)(mb|kb|gb)?', s, re.IGNORECASE)
+        if m is None:
+            raise Exception(f'unrecognized size: {s}')
+        size = int(m.group(1))
+        if not m.group(2):
+            pass
+        elif m.group(2).lower() == 'kb':
+            size *= 1024
+        elif m.group(2).lower() == 'mb':
+            size *= 1024 * 1024
+        elif m.group(2).lower() == 'gb':
+            size *= 1024 * 1024 * 1024
+        return size
+
+    @classmethod
+    def print_score(cls, score):
+        print(f'Scorecard curl, protocol {score["meta"]["protocol"]} '
+              f'via {score["meta"]["implementation"]}/'
+              f'{score["meta"]["implementation_version"]}')
+        print(f'Date: {score["meta"]["date"]}')
+        if 'curl_V' in score["meta"]:
+            print(f'Version: {score["meta"]["curl_V"]}')
+        if 'curl_features' in score["meta"]:
+            print(f'Features: {score["meta"]["curl_features"]}')
+        if 'limit-rate' in score['meta']:
+            print(f'--limit-rate: {score["meta"]["limit-rate"]}')
+        print(f'Samples Size: {score["meta"]["samples"]}')
+        if 'handshakes' in score:
+            print(f'{"Handshakes":<24} {"ipv4":25} {"ipv6":28}')
+            print(f'  {"Host":<17} {"Connect":>12} {"Handshake":>12} '
+                  f'{"Connect":>12} {"Handshake":>12}     {"Errors":<20}')
+            for key, val in score["handshakes"].items():
+                print(f'  {key:<17} {Card.fmt_ms(val["ipv4-connect"]):>12} '
+                      f'{Card.fmt_ms(val["ipv4-handshake"]):>12} '
+                      f'{Card.fmt_ms(val["ipv6-connect"]):>12} '
+                      f'{Card.fmt_ms(val["ipv6-handshake"]):>12}     '
+                      f'{"/".join(val["ipv4-errors"] + val["ipv6-errors"]):<20}'
+                      )
+        for name in ['downloads', 'uploads', 'requests']:
+            if name in score:
+                Card.print_score_table(score[name])
+
+    @classmethod
+    def print_score_table(cls, score):
+        cols = score['cols']
+        rows = score['rows']
+        colw = []
+        statw = 13
+        errors = []
+        col_has_stats = []
+        for idx, col in enumerate(cols):
+            cellw = max([len(r[idx]["sval"]) for r in rows])
+            colw.append(max(cellw, len(col)))
+            col_has_stats.append(False)
+            for row in rows:
+                if 'stats' in row[idx]:
+                    col_has_stats[idx] = True
+                    break
+        if 'title' in score['meta']:
+            print(score['meta']['title'])
+        for idx, col in enumerate(cols):
+            if col_has_stats[idx]:
+                print(f'  {col:>{colw[idx]}} {"[cpu/rss]":<{statw}}', end='')
+            else:
+                print(f'  {col:>{colw[idx]}}', end='')
+        print('')
+        for row in rows:
+            for idx, cell in enumerate(row):
+                print(f'  {cell["sval"]:>{colw[idx]}}', end='')
+                if col_has_stats[idx]:
+                    if 'stats' in cell:
+                        s = f'[{cell["stats"]["cpu"]:>.1f}%' \
+                            f'/{Card.fmt_size(cell["stats"]["rss"])}]'
+                    else:
+                        s = ''
+                    print(f' {s:<{statw}}', end='')
+                if 'errors' in cell:
+                    errors.extend(cell['errors'])
+            print('')
+        if len(errors):
+            print(f'Errors: {errors}')
+
+
+class ScoreRunner:
 
     def __init__(self, env: Env,
-                 httpd: Optional[Httpd],
-                 nghttpx: Optional[Nghttpx],
-                 caddy: Optional[Caddy],
+                 protocol: str,
+                 server_descr: str,
+                 server_port: int,
                  verbose: int,
-                 curl_verbose: int):
+                 curl_verbose: int,
+                 download_parallel: int = 0,
+                 upload_parallel: int = 0,
+                 server_addr: Optional[str] = None,
+                 with_flame: bool = False,
+                 socks_args: Optional[List[str]] = None,
+                 limit_rate: Optional[str] = None,
+                 http_plain: bool = False,
+                 suppress_cl: bool = False):
         self.verbose = verbose
         self.env = env
-        self.httpd = httpd
-        self.nghttpx = nghttpx
-        self.caddy = caddy
+        self.protocol = protocol
+        self.server_descr = server_descr
+        self.server_addr = server_addr
+        self.server_port = server_port
         self._silent_curl = not curl_verbose
+        self._download_parallel = download_parallel
+        self._upload_parallel = upload_parallel
+        self._with_flame = with_flame
+        self._socks_args = socks_args
+        self._limit_rate_num = 0
+        self._limit_rate = limit_rate
+        self._http_plain = http_plain
+        self._scheme = 'http' if http_plain else 'https'
+        if self._limit_rate:
+            m = re.match(r'(\d+(\.\d+)?)([gmkb])?', self._limit_rate.lower())
+            if not m:
+                raise Exception(f'unrecognised limit-rate: {self._limit_rate}')
+            self._limit_rate_num = float(m.group(1))
+            if m.group(3) == 'g':
+                self._limit_rate_num *= 1024 * 1024 * 1024
+            elif m.group(3) == 'm':
+                self._limit_rate_num *= 1024 * 1024
+            elif m.group(3) == 'k':
+                self._limit_rate_num *= 1024
+            elif m.group(3) == 'b':
+                pass
+            else:
+                raise Exception(f'unrecognised limit-rate: {self._limit_rate}')
+        self.suppress_cl = suppress_cl
 
     def info(self, msg):
         if self.verbose > 0:
             sys.stderr.write(msg)
             sys.stderr.flush()
 
-    def handshakes(self, proto: str) -> Dict[str, Any]:
+    def mk_curl_client(self):
+        return CurlClient(env=self.env, silent=self._silent_curl,
+                          server_addr=self.server_addr,
+                          with_flame=self._with_flame,
+                          socks_args=self._socks_args)
+
+    def handshakes(self) -> Dict[str, Any]:
         props = {}
         sample_size = 5
-        self.info(f'TLS Handshake\n')
+        self.info('TLS Handshake\n')
         for authority in [
             'curl.se', 'google.com', 'cloudflare.com', 'nghttp2.org'
         ]:
@@ -76,11 +299,11 @@ class ScoreCard:
                 c_samples = []
                 hs_samples = []
                 errors = []
-                for i in range(sample_size):
-                    curl = CurlClient(env=self.env, silent=self._silent_curl)
+                for _ in range(sample_size):
+                    curl = self.mk_curl_client()
                     args = [
-                        '--http3-only' if proto == 'h3' else '--http2',
-                        f'--{ipv}', f'https://{authority}/'
+                        '--http3-only' if self.protocol == 'h3' else '--http2',
+                        f'--{ipv}', f'{self._scheme}://{authority}/'
                     ]
                     r = curl.run_direct(args=args, with_stats=True)
                     if r.exit_code == 0 and len(r.stats) == 1:
@@ -104,7 +327,18 @@ class ScoreCard:
             while flen < fsize:
                 fd.write(data1k)
                 flen += len(data1k)
-        return flen
+        return fpath
+
+    def setup_resources(self, server_docs: str,
+                        downloads: Optional[List[int]] = None):
+        if downloads is not None:
+            for fsize in downloads:
+                label = Card.fmt_size(fsize)
+                fname = f'score{label}.data'
+                self._make_docs_file(docs_dir=server_docs,
+                                     fname=fname, fsize=fsize)
+        self._make_docs_file(docs_dir=server_docs,
+                             fname='reqs10.data', fsize=10 * 1024)
 
     def _check_downloads(self, r: ExecResult, count: int):
         error = ''
@@ -117,441 +351,565 @@ class ScoreCard:
             error += f'{len(fails)} failed'
         return error if len(error) > 0 else None
 
-    def transfer_single(self, url: str, proto: str, count: int):
-        sample_size = count
+    def dl_single(self, url: str, nsamples: int = 1):
         count = 1
         samples = []
         errors = []
-        self.info(f'single...')
-        for i in range(sample_size):
-            curl = CurlClient(env=self.env, silent=self._silent_curl)
-            r = curl.http_download(urls=[url], alpn_proto=proto, no_save=True,
-                                   with_headers=False)
+        profiles = []
+        self.info('single...')
+        for _ in range(nsamples):
+            curl = self.mk_curl_client()
+            r = curl.http_download(urls=[url], alpn_proto=self.protocol,
+                                   no_save=True, with_headers=False,
+                                   with_profile=True,
+                                   limit_rate=self._limit_rate)
             err = self._check_downloads(r, count)
             if err:
                 errors.append(err)
+            elif self._limit_rate:
+                total_speed = sum([s['speed_download'] for s in r.stats])
+                samples.append(total_speed / len(r.stats))
+                profiles.append(r.profile)
             else:
                 total_size = sum([s['size_download'] for s in r.stats])
                 samples.append(total_size / r.duration.total_seconds())
-        return {
-            'count': count,
-            'samples': sample_size,
-            'speed': mean(samples) if len(samples) else -1,
-            'errors': errors
-        }
+                profiles.append(r.profile)
+        if self._limit_rate:
+            return Card.mk_speed_cell(samples, profiles, errors, self._limit_rate_num)
+        return Card.mk_mbs_cell(samples, profiles, errors)
 
-    def transfer_serial(self, url: str, proto: str, count: int):
-        sample_size = 1
+    def dl_serial(self, url: str, count: int, nsamples: int = 1):
         samples = []
         errors = []
+        profiles = []
         url = f'{url}?[0-{count - 1}]'
-        self.info(f'serial...')
-        for i in range(sample_size):
-            curl = CurlClient(env=self.env, silent=self._silent_curl)
-            r = curl.http_download(urls=[url], alpn_proto=proto, no_save=True,
-                                   with_headers=False)
-            err = self._check_downloads(r, count)
-            if err:
-                errors.append(err)
-            else:
-                total_size = sum([s['size_download'] for s in r.stats])
-                samples.append(total_size / r.duration.total_seconds())
-        return {
-            'count': count,
-            'samples': sample_size,
-            'speed': mean(samples) if len(samples) else -1,
-            'errors': errors
-        }
-
-    def transfer_parallel(self, url: str, proto: str, count: int):
-        sample_size = 1
-        samples = []
-        errors = []
-        url = f'{url}?[0-{count - 1}]'
-        self.info(f'parallel...')
-        for i in range(sample_size):
-            curl = CurlClient(env=self.env, silent=self._silent_curl)
-            r = curl.http_download(urls=[url], alpn_proto=proto, no_save=True,
+        self.info('serial...')
+        for _ in range(nsamples):
+            curl = self.mk_curl_client()
+            r = curl.http_download(urls=[url], alpn_proto=self.protocol,
+                                   no_save=True,
                                    with_headers=False,
-                                   extra_args=['--parallel',
-                                               '--parallel-max', str(count)])
+                                   with_profile=True,
+                                   limit_rate=self._limit_rate)
             err = self._check_downloads(r, count)
             if err:
                 errors.append(err)
+            elif self._limit_rate:
+                total_speed = sum([s['speed_download'] for s in r.stats])
+                samples.append(total_speed / len(r.stats))
+                profiles.append(r.profile)
             else:
                 total_size = sum([s['size_download'] for s in r.stats])
                 samples.append(total_size / r.duration.total_seconds())
-        return {
-            'count': count,
-            'samples': sample_size,
-            'speed': mean(samples) if len(samples) else -1,
-            'errors': errors
-        }
+                profiles.append(r.profile)
+        if self._limit_rate:
+            return Card.mk_speed_cell(samples, profiles, errors, self._limit_rate_num)
+        return Card.mk_mbs_cell(samples, profiles, errors)
 
-    def download_url(self, label: str, url: str, proto: str, count: int):
-        self.info(f'  {count}x{label}: ')
-        props = {
-            'single': self.transfer_single(url=url, proto=proto, count=10),
-            'serial': self.transfer_serial(url=url, proto=proto, count=count),
-            'parallel': self.transfer_parallel(url=url, proto=proto,
-                                               count=count),
-        }
-        self.info(f'ok.\n')
-        return props
-
-    def downloads(self, proto: str, count: int,
-                  fsizes: List[int]) -> Dict[str, Any]:
-        scores = {}
-        if self.httpd:
-            if proto == 'h3':
-                port = self.env.h3_port
-                via = 'nghttpx'
-                descr = f'port {port}, proxying httpd'
-            else:
-                port = self.env.https_port
-                via = 'httpd'
-                descr = f'port {port}'
-            self.info(f'{via} downloads\n')
-            scores[via] = {
-                'description': descr,
-            }
-            for fsize in fsizes:
-                label = f'{int(fsize / 1024)}KB' if fsize < 1024*1024 else \
-                    f'{int(fsize / (1024 * 1024))}MB'
-                fname = f'score{label}.data'
-                self._make_docs_file(docs_dir=self.httpd.docs_dir,
-                                     fname=fname, fsize=fsize)
-                url = f'https://{self.env.domain1}:{port}/{fname}'
-                results = self.download_url(label=label, url=url,
-                                            proto=proto, count=count)
-                scores[via][label] = results
-        if self.caddy:
-            port = self.caddy.port
-            via = 'caddy'
-            descr = f'port {port}'
-            self.info('caddy downloads\n')
-            scores[via] = {
-                'description': descr,
-            }
-            for fsize in fsizes:
-                label = f'{int(fsize / 1024)}KB' if fsize < 1024*1024 else \
-                    f'{int(fsize / (1024 * 1024))}MB'
-                fname = f'score{label}.data'
-                self._make_docs_file(docs_dir=self.caddy.docs_dir,
-                                     fname=fname, fsize=fsize)
-                url = f'https://{self.env.domain1}:{port}/{fname}'
-                results = self.download_url(label=label, url=url,
-                                            proto=proto, count=count)
-                scores[via][label] = results
-        return scores
-
-    def do_requests(self, url: str, proto: str, count: int,
-                    max_parallel: int = 1):
-        sample_size = 1
+    def dl_parallel(self, url: str, count: int, nsamples: int = 1):
         samples = []
         errors = []
+        profiles = []
+        max_parallel = self._download_parallel if self._download_parallel > 0 else count
         url = f'{url}?[0-{count - 1}]'
-        extra_args = ['--parallel', '--parallel-max', str(max_parallel)] \
-            if max_parallel > 1 else []
-        self.info(f'{max_parallel}...')
-        for i in range(sample_size):
-            curl = CurlClient(env=self.env, silent=self._silent_curl)
-            r = curl.http_download(urls=[url], alpn_proto=proto, no_save=True,
+        self.info('parallel...')
+        for _ in range(nsamples):
+            curl = self.mk_curl_client()
+            r = curl.http_download(urls=[url], alpn_proto=self.protocol,
+                                   no_save=True,
                                    with_headers=False,
-                                   extra_args=extra_args)
+                                   with_profile=True,
+                                   limit_rate=self._limit_rate,
+                                   extra_args=[
+                                       '--parallel',
+                                       '--parallel-max', str(max_parallel)
+                                   ])
             err = self._check_downloads(r, count)
             if err:
                 errors.append(err)
+            elif self._limit_rate:
+                total_speed = sum([s['speed_download'] for s in r.stats])
+                samples.append(total_speed / len(r.stats))
+                profiles.append(r.profile)
             else:
-                for _ in r.stats:
-                    samples.append(count / r.duration.total_seconds())
-        return {
-            'count': count,
-            'samples': sample_size,
-            'speed': mean(samples) if len(samples) else -1,
-            'errors': errors
-        }
+                total_size = sum([s['size_download'] for s in r.stats])
+                samples.append(total_size / r.duration.total_seconds())
+                profiles.append(r.profile)
+        if self._limit_rate:
+            return Card.mk_speed_cell(samples, profiles, errors, self._limit_rate_num)
+        return Card.mk_mbs_cell(samples, profiles, errors)
 
-    def requests_url(self, url: str, proto: str, count: int):
-        self.info(f'  {url}: ')
-        props = {
-            'serial': self.do_requests(url=url, proto=proto, count=count),
-            'par-6': self.do_requests(url=url, proto=proto, count=count,
-                                      max_parallel=6),
-            'par-25': self.do_requests(url=url, proto=proto, count=count,
-                                       max_parallel=25),
-            'par-50': self.do_requests(url=url, proto=proto, count=count,
-                                       max_parallel=50),
-            'par-100': self.do_requests(url=url, proto=proto, count=count,
-                                        max_parallel=100),
-        }
-        self.info(f'ok.\n')
-        return props
-
-    def requests(self, proto: str) -> Dict[str, Any]:
-        scores = {}
-        if self.httpd:
-            if proto == 'h3':
-                port = self.env.h3_port
-                via = 'nghttpx'
-                descr = f'port {port}, proxying httpd'
+    def downloads(self, count: int, fsizes: List[int], meta: Dict[str, Any]) -> Dict[str, Any]:
+        nsamples = meta['samples']
+        max_parallel = self._download_parallel if self._download_parallel > 0 else count
+        cols = ['size']
+        if not self._download_parallel:
+            cols.append('single')
+            if count > 1:
+                cols.append(f'serial({count})')
+        if count > 1:
+            if max_parallel == 1:
+                cols.append(f'serial({count})')
             else:
-                port = self.env.https_port
-                via = 'httpd'
-                descr = f'port {port}'
-            self.info(f'{via} requests\n')
-            self._make_docs_file(docs_dir=self.httpd.docs_dir,
-                                 fname='reqs10.data', fsize=10*1024)
-            url1 = f'https://{self.env.domain1}:{port}/reqs10.data'
-            scores[via] = {
-                'description': descr,
-                '10KB': self.requests_url(url=url1, proto=proto, count=10000),
-            }
-        if self.caddy:
-            port = self.caddy.port
-            via = 'caddy'
-            descr = f'port {port}'
-            self.info('caddy requests\n')
-            self._make_docs_file(docs_dir=self.caddy.docs_dir,
-                                 fname='req10.data', fsize=10 * 1024)
-            url1 = f'https://{self.env.domain1}:{port}/req10.data'
-            scores[via] = {
-                'description': descr,
-                '10KB': self.requests_url(url=url1, proto=proto, count=5000),
-            }
-        return scores
-
-    def score_proto(self, proto: str,
-                    handshakes: bool = True,
-                    downloads: Optional[List[int]] = None,
-                    download_count: int = 50,
-                    requests: bool = True):
-        self.info(f"scoring {proto}\n")
-        p = {}
-        if proto == 'h3':
-            p['name'] = 'h3'
-            if not self.env.have_h3_curl():
-                raise ScoreCardException('curl does not support HTTP/3')
-            for lib in ['ngtcp2', 'quiche', 'msh3']:
-                if self.env.curl_uses_lib(lib):
-                    p['implementation'] = lib
-                    break
-        elif proto == 'h2':
-            p['name'] = 'h2'
-            if not self.env.have_h2_curl():
-                raise ScoreCardException('curl does not support HTTP/2')
-            for lib in ['nghttp2', 'hyper']:
-                if self.env.curl_uses_lib(lib):
-                    p['implementation'] = lib
-                    break
-        elif proto == 'h1' or proto == 'http/1.1':
-            proto = 'http/1.1'
-            p['name'] = proto
-            p['implementation'] = 'hyper' if self.env.curl_uses_lib('hyper')\
-                else 'native'
+                cols.append(f'parallel({count}x{max_parallel})')
+        rows = []
+        for fsize in fsizes:
+            row = [{
+                'val': fsize,
+                'sval': Card.fmt_size(fsize)
+            }]
+            self.info(f'{row[0]["sval"]} downloads...')
+            url = f'{self._scheme}://{self.env.domain1}:{self.server_port}/score{row[0]["sval"]}.data'
+            if 'single' in cols:
+                row.append(self.dl_single(url=url, nsamples=nsamples))
+            if count > 1:
+                if 'single' in cols:
+                    row.append(self.dl_serial(url=url, count=count, nsamples=nsamples))
+                row.append(self.dl_parallel(url=url, count=count, nsamples=nsamples))
+            rows.append(row)
+            self.info('done.\n')
+        if self._limit_rate:
+            title = f'Download Speed ({self.protocol}), limit={Card.fmt_speed(self._limit_rate_num)}, from {meta["server"]}'
         else:
-            raise ScoreCardException(f"unknown protocol: {proto}")
+            title = f'Downloads ({self.protocol})from {meta["server"]}'
+        if self._socks_args:
+            title += f' via {self._socks_args}'
+        return {
+            'meta': {
+                'title': title,
+                'count': count,
+                'max-parallel': max_parallel,
+            },
+            'cols': cols,
+            'rows': rows,
+        }
 
-        if 'implementation' not in p:
-            raise ScoreCardException(f'did not recognized {p} lib')
-        p['version'] = Env.curl_lib_version(p['implementation'])
+    def _check_uploads(self, r: ExecResult, count: int):
+        error = ''
+        if r.exit_code != 0:
+            error += f'exit={r.exit_code} '
+        if r.exit_code != 0 or len(r.stats) != count:
+            error += f'stats={len(r.stats)}/{count} '
+        fails = [s for s in r.stats if s['response_code'] != 200]
+        if len(fails) > 0:
+            error += f'{len(fails)} failed'
+        for f in fails:
+            error += f'[{f["response_code"]}]'
+        return error if len(error) > 0 else None
+
+    def ul_single(self, url: str, fpath: str, nsamples: int = 1):
+        samples = []
+        errors = []
+        profiles = []
+        self.info('single...')
+        for _ in range(nsamples):
+            curl = self.mk_curl_client()
+            r = curl.http_put(urls=[url], fdata=fpath, alpn_proto=self.protocol,
+                              with_headers=False, with_profile=True,
+                              suppress_cl=self.suppress_cl)
+            err = self._check_uploads(r, 1)
+            if err:
+                errors.append(err)
+            else:
+                total_size = sum([s['size_upload'] for s in r.stats])
+                samples.append(total_size / r.duration.total_seconds())
+                profiles.append(r.profile)
+        return Card.mk_mbs_cell(samples, profiles, errors)
+
+    def ul_serial(self, url: str, fpath: str, count: int, nsamples: int = 1):
+        samples = []
+        errors = []
+        profiles = []
+        url = f'{url}?id=[0-{count - 1}]'
+        self.info('serial...')
+        for _ in range(nsamples):
+            curl = self.mk_curl_client()
+            r = curl.http_put(urls=[url], fdata=fpath, alpn_proto=self.protocol,
+                              with_headers=False, with_profile=True,
+                              suppress_cl=self.suppress_cl)
+            err = self._check_uploads(r, count)
+            if err:
+                errors.append(err)
+            else:
+                total_size = sum([s['size_upload'] for s in r.stats])
+                samples.append(total_size / r.duration.total_seconds())
+                profiles.append(r.profile)
+        return Card.mk_mbs_cell(samples, profiles, errors)
+
+    def ul_parallel(self, url: str, fpath: str, count: int, nsamples: int = 1):
+        samples = []
+        errors = []
+        profiles = []
+        max_parallel = self._download_parallel if self._download_parallel > 0 else count
+        url = f'{url}?id=[0-{count - 1}]'
+        self.info('parallel...')
+        for _ in range(nsamples):
+            curl = self.mk_curl_client()
+            r = curl.http_put(urls=[url], fdata=fpath, alpn_proto=self.protocol,
+                              with_headers=False, with_profile=True,
+                              suppress_cl=self.suppress_cl,
+                              extra_args=[
+                                   '--parallel',
+                                   '--parallel-max', str(max_parallel),
+                              ])
+            err = self._check_uploads(r, count)
+            if err:
+                errors.append(err)
+            else:
+                total_size = sum([s['size_upload'] for s in r.stats])
+                samples.append(total_size / r.duration.total_seconds())
+                profiles.append(r.profile)
+        return Card.mk_mbs_cell(samples, profiles, errors)
+
+    def uploads(self, count: int, fsizes: List[int], meta: Dict[str, Any]) -> Dict[str, Any]:
+        nsamples = meta['samples']
+        max_parallel = self._upload_parallel if self._upload_parallel > 0 else count
+        cols = ['size']
+        run_single = not self._upload_parallel
+        run_serial = not self._upload_parallel and count > 1
+        run_parallel = self._upload_parallel or count > 1
+        if run_single:
+            cols.append('single')
+        if run_serial:
+            cols.append(f'serial({count})')
+        if run_parallel:
+            cols.append(f'parallel({count}x{max_parallel})')
+        rows = []
+        for fsize in fsizes:
+            row = [{
+                'val': fsize,
+                'sval': Card.fmt_size(fsize)
+            }]
+            self.info(f'{row[0]["sval"]} uploads...')
+            url = f'{self._scheme}://{self.env.domain1}:{self.server_port}/curltest/put'
+            fname = f'upload{row[0]["sval"]}.data'
+            fpath = self._make_docs_file(docs_dir=self.env.gen_dir,
+                                         fname=fname, fsize=fsize)
+            if run_single:
+                row.append(self.ul_single(url=url, fpath=fpath, nsamples=nsamples))
+            if run_serial:
+                row.append(self.ul_serial(url=url, fpath=fpath, count=count, nsamples=nsamples))
+            if run_parallel:
+                row.append(self.ul_parallel(url=url, fpath=fpath, count=count, nsamples=nsamples))
+            rows.append(row)
+            self.info('done.\n')
+        title = f'Uploads to {meta["server"]}'
+        if self._socks_args:
+            title += f' via {self._socks_args}'
+        return {
+            'meta': {
+                'title': title,
+                'count': count,
+                'max-parallel': max_parallel,
+            },
+            'cols': cols,
+            'rows': rows,
+        }
+
+    def do_requests(self, url: str, count: int, max_parallel: int = 1, nsamples: int = 1):
+        samples = []
+        errors = []
+        profiles = []
+        url = f'{url}?[0-{count - 1}]'
+        extra_args = [
+            '-w', '%{response_code},\\n',
+        ]
+        if max_parallel > 1:
+            extra_args.extend([
+               '--parallel', '--parallel-max', str(max_parallel)
+            ])
+        self.info(f'{max_parallel}...')
+        for _ in range(nsamples):
+            curl = self.mk_curl_client()
+            r = curl.http_download(urls=[url], alpn_proto=self.protocol, no_save=True,
+                                   with_headers=False, with_profile=True,
+                                   with_stats=False, extra_args=extra_args)
+            if r.exit_code != 0:
+                errors.append(f'exit={r.exit_code}')
+            else:
+                samples.append(count / r.duration.total_seconds())
+                non_200s = 0
+                for line in r.stdout.splitlines():
+                    if not line.startswith('200,'):
+                        non_200s += 1
+                if non_200s > 0:
+                    errors.append(f'responses != 200: {non_200s}')
+            profiles.append(r.profile)
+        return Card.mk_reqs_cell(samples, profiles, errors)
+
+    def requests(self, count: int, meta: Dict[str, Any]) -> Dict[str, Any]:
+        url = f'{self._scheme}://{self.env.domain1}:{self.server_port}/reqs10.data'
+        fsize = 10 * 1024
+        cols = ['size', 'total']
+        rows = []
+        mparallel = meta['request_parallels']
+        cols.extend([f'{mp} max' for mp in mparallel])
+        row = [{
+            'val': fsize,
+            'sval': Card.fmt_size(fsize)
+        },{
+            'val': count,
+            'sval': f'{count}',
+        }]
+        self.info('requests, max parallel...')
+        row.extend([self.do_requests(url=url, count=count,
+                                     max_parallel=mp, nsamples=meta["samples"])
+                    for mp in mparallel])
+        rows.append(row)
+        self.info('done.\n')
+        title = f'Requests in parallel to {meta["server"]}'
+        if self._socks_args:
+            title += f' via {self._socks_args}'
+        return {
+            'meta': {
+                'title': title,
+                'count': count,
+            },
+            'cols': cols,
+            'rows': rows,
+        }
+
+    def score(self,
+              handshakes: bool = True,
+              downloads: Optional[List[int]] = None,
+              download_count: int = 50,
+              uploads: Optional[List[int]] = None,
+              upload_count: int = 50,
+              req_count=5000,
+              request_parallels=None,
+              nsamples: int = 1,
+              requests: bool = True):
+        self.info(f"scoring {self.protocol} against {self.server_descr}\n")
 
         score = {
-            'curl': self.env.curl_fullname(),
-            'os': self.env.curl_os(),
-            'protocol': p,
+            'meta': {
+                'curl_version': self.env.curl_version(),
+                'curl_V': self.env.curl_fullname(),
+                'curl_features': self.env.curl_features_string(),
+                'os': self.env.curl_os(),
+                'server': self.server_descr,
+                'samples': nsamples,
+                'date': f'{datetime.datetime.now(tz=datetime.timezone.utc).isoformat()}',
+            }
         }
+        if self._limit_rate:
+            score['meta']['limit-rate'] = self._limit_rate
+
+        if self.protocol == 'h3':
+            score['meta']['protocol'] = 'h3'
+            if not self.env.have_h3_curl():
+                raise ScoreCardError('curl does not support HTTP/3')
+            for lib in ['ngtcp2', 'quiche', 'nghttp3']:
+                if self.env.curl_uses_lib(lib):
+                    score['meta']['implementation'] = lib
+                    break
+        elif self.protocol == 'h2':
+            score['meta']['protocol'] = 'h2'
+            if not self.env.have_h2_curl():
+                raise ScoreCardError('curl does not support HTTP/2')
+            for lib in ['nghttp2']:
+                if self.env.curl_uses_lib(lib):
+                    score['meta']['implementation'] = lib
+                    break
+        elif self.protocol == 'h1' or self.protocol == 'http/1.1':
+            score['meta']['protocol'] = 'http/1.1'
+            score['meta']['implementation'] = 'native'
+        else:
+            raise ScoreCardError(f"unknown protocol: {self.protocol}")
+
+        if 'implementation' not in score['meta']:
+            raise ScoreCardError('did not recognized protocol lib')
+        score['meta']['implementation_version'] = Env.curl_lib_version(score['meta']['implementation'])
+
         if handshakes:
-            score['handshakes'] = self.handshakes(proto=proto)
+            score['handshakes'] = self.handshakes()
         if downloads and len(downloads) > 0:
-            score['downloads'] = self.downloads(proto=proto,
-                                                count=download_count,
-                                                fsizes=downloads)
+            score['downloads'] = self.downloads(count=download_count,
+                                                fsizes=downloads,
+                                                meta=score['meta'])
+        if uploads and len(uploads) > 0:
+            score['uploads'] = self.uploads(count=upload_count,
+                                            fsizes=uploads,
+                                            meta=score['meta'])
         if requests:
-            score['requests'] = self.requests(proto=proto)
-        self.info("\n")
+            if request_parallels is None:
+                request_parallels = [1, 6, 25, 50, 100, 300]
+            score['meta']['request_parallels'] = request_parallels
+            score['requests'] = self.requests(count=req_count, meta=score['meta'])
         return score
 
-    def fmt_ms(self, tval):
-        return f'{int(tval*1000)} ms' if tval >= 0 else '--'
 
-    def fmt_mb(self, val):
-        return f'{val/(1024*1024):0.000f} MB' if val >= 0 else '--'
+def run_score(args, protocol):
+    if protocol not in ['http/1.1', 'h1', 'h2', 'h3']:
+        sys.stderr.write(f'ERROR: protocol "{protocol}" not known to scorecard\n')
+        sys.exit(1)
+    if protocol == 'h1':
+        protocol = 'http/1.1'
 
-    def fmt_mbs(self, val):
-        return f'{val/(1024*1024):0.000f} MB/s' if val >= 0 else '--'
-
-    def fmt_reqs(self, val):
-        return f'{val:0.000f} r/s' if val >= 0 else '--'
-
-    def print_score(self, score):
-        print(f'{score["protocol"]["name"].upper()} in {score["curl"]}')
-        if 'handshakes' in score:
-            print(f'{"Handshakes":<24} {"ipv4":25} {"ipv6":28}')
-            print(f'  {"Host":<17} {"Connect":>12} {"Handshake":>12} '
-                  f'{"Connect":>12} {"Handshake":>12}     {"Errors":<20}')
-            for key, val in score["handshakes"].items():
-                print(f'  {key:<17} {self.fmt_ms(val["ipv4-connect"]):>12} '
-                      f'{self.fmt_ms(val["ipv4-handshake"]):>12} '
-                      f'{self.fmt_ms(val["ipv6-connect"]):>12} '
-                      f'{self.fmt_ms(val["ipv6-handshake"]):>12}     '
-                      f'{"/".join(val["ipv4-errors"] + val["ipv6-errors"]):<20}'
-                      )
-        if 'downloads' in score:
-            print('Downloads')
-            print(f'  {"Server":<8} {"Size":>8} {"Single":>12} {"Serial":>12}'
-                  f' {"Parallel":>12}    {"Errors":<20}')
-            skeys = {}
-            for dkey, dval in score["downloads"].items():
-                for k in dval.keys():
-                    skeys[k] = True
-            for skey in skeys:
-                for dkey, dval in score["downloads"].items():
-                    if skey in dval:
-                        sval = dval[skey]
-                        if isinstance(sval, str):
-                            continue
-                        errors = []
-                        for key, val in sval.items():
-                            if 'errors' in val:
-                                errors.extend(val['errors'])
-                        print(f'  {dkey:<8} {skey:>8} '
-                              f'{self.fmt_mbs(sval["single"]["speed"]):>12} '
-                              f'{self.fmt_mbs(sval["serial"]["speed"]):>12} '
-                              f'{self.fmt_mbs(sval["parallel"]["speed"]):>12} '
-                              f'   {"/".join(errors):<20}')
-        if 'requests' in score:
-            print('Requests, max in parallel')
-            print(f'  {"Server":<8} {"Size":>8} '
-                  f'{"1    ":>12} {"6    ":>12} {"25    ":>12} '
-                  f'{"50    ":>12} {"100    ":>12}    {"Errors":<20}')
-            for dkey, dval in score["requests"].items():
-                for skey, sval in dval.items():
-                    if isinstance(sval, str):
-                        continue
-                    errors = []
-                    for key, val in sval.items():
-                        if 'errors' in val:
-                            errors.extend(val['errors'])
-                    line = f'  {dkey:<8} {skey:>8} '
-                    for k in sval.keys():
-                        line += f'{self.fmt_reqs(sval[k]["speed"]):>12} '
-                    line += f'   {"/".join(errors):<20}'
-                    print(line)
-
-
-def parse_size(s):
-    m = re.match(r'(\d+)(mb|kb|gb)?', s, re.IGNORECASE)
-    if m is None:
-        raise Exception(f'unrecognized size: {s}')
-    size = int(m.group(1))
-    if m.group(2).lower() == 'kb':
-        size *= 1024
-    elif m.group(2).lower() == 'mb':
-        size *= 1024 * 1024
-    elif m.group(2).lower() == 'gb':
-        size *= 1024 * 1024 * 1024
-    return size
-
-
-def main():
-    parser = argparse.ArgumentParser(prog='scorecard', description="""
-        Run a range of tests to give a scorecard for a HTTP protocol
-        'h3' or 'h2' implementation in curl.
-        """)
-    parser.add_argument("-v", "--verbose", action='count', default=1,
-                        help="log more output on stderr")
-    parser.add_argument("-j", "--json", action='store_true',
-                        default=False, help="print json instead of text")
-    parser.add_argument("-H", "--handshakes", action='store_true',
-                        default=False, help="evaluate handshakes only")
-    parser.add_argument("-d", "--downloads", action='store_true',
-                        default=False, help="evaluate downloads only")
-    parser.add_argument("--download", action='append', type=str,
-                        default=None, help="evaluate download size")
-    parser.add_argument("--download-count", action='store', type=int,
-                        default=50, help="perform that many downloads")
-    parser.add_argument("-r", "--requests", action='store_true',
-                        default=False, help="evaluate requests only")
-    parser.add_argument("--httpd", action='store_true', default=False,
-                        help="evaluate httpd server only")
-    parser.add_argument("--caddy", action='store_true', default=False,
-                        help="evaluate caddy server only")
-    parser.add_argument("--curl-verbose", action='store_true',
-                        default=False, help="run curl with `-v`")
-    parser.add_argument("protocol", default='h2', nargs='?',
-                        help="Name of protocol to score")
-    args = parser.parse_args()
-
-    if args.verbose > 0:
-        console = logging.StreamHandler()
-        console.setLevel(logging.INFO)
-        console.setFormatter(logging.Formatter(logging.BASIC_FORMAT))
-        logging.getLogger('').addHandler(console)
-
-    protocol = args.protocol
     handshakes = True
-    downloads = [1024*1024, 10*1024*1024, 100*1024*1024]
+    downloads = [1024 * 1024, 10 * 1024 * 1024, 100 * 1024 * 1024]
+    if args.download_sizes is not None:
+        downloads = []
+        for x in args.download_sizes:
+            downloads.extend([Card.parse_size(s) for s in x.split(',')])
+
+    uploads = [1024 * 1024, 10 * 1024 * 1024, 100 * 1024 * 1024]
+    if args.upload_sizes is not None:
+        uploads = []
+        for x in args.upload_sizes:
+            uploads.extend([Card.parse_size(s) for s in x.split(',')])
+
     requests = True
+    request_parallels = None
+    if args.request_parallels:
+        request_parallels = []
+        for x in args.request_parallels:
+            request_parallels.extend([int(s) for s in x.split(',')])
+
+    if args.downloads or args.uploads or args.requests or args.handshakes:
+        handshakes = args.handshakes
+        if not args.downloads:
+            downloads = None
+        if not args.uploads:
+            uploads = None
+        requests = args.requests
+
     test_httpd = protocol != 'h3'
-    test_caddy = True
-    if args.handshakes:
-        downloads = None
-        requests = False
-    if args.downloads:
-        handshakes = False
-        requests = False
-    if args.download:
-        downloads = sorted([parse_size(x) for x in args.download])
-        handshakes = False
-        requests = False
-    if args.requests:
-        handshakes = False
-        downloads = None
-    if args.caddy:
-        test_caddy = True
-        test_httpd = False
-    if args.httpd:
-        test_caddy = False
-        test_httpd = True
+    test_caddy = protocol == 'h3'
+    if args.caddy or args.httpd:
+        test_caddy = args.caddy
+        test_httpd = args.httpd
 
     rv = 0
     env = Env()
     env.setup()
     env.test_timeout = None
+
+    sockd = None
+    socks_args = None
+    if args.socks4 and args.socks5:
+        raise ScoreCardError('unable to run --socks4 and --socks5 together')
+    elif args.socks4 or args.socks5:
+        sockd = Dante(env=env)
+    if sockd:
+        assert sockd.initial_start()
+        socks_args = [
+            '--socks4' if args.socks4 else '--socks5',
+            f'127.0.0.1:{sockd.port}',
+        ]
+
     httpd = None
     nghttpx = None
     caddy = None
     try:
+        cards = []
+
+        if args.remote:
+            m = re.match(r'^(.+):(\d+)$', args.remote)
+            if m is None:
+                raise ScoreCardError(f'unable to parse ip:port from --remote {args.remote}')
+            test_httpd = False
+            test_caddy = False
+            remote_addr = m.group(1)
+            remote_port = int(m.group(2))
+            card = ScoreRunner(env=env,
+                               protocol=protocol,
+                               server_descr=f'Server at {args.remote}',
+                               server_addr=remote_addr,
+                               server_port=remote_port,
+                               verbose=args.verbose,
+                               curl_verbose=args.curl_verbose,
+                               download_parallel=args.download_parallel,
+                               upload_parallel=args.upload_parallel,
+                               with_flame=args.flame,
+                               socks_args=socks_args,
+                               limit_rate=args.limit_rate,
+                               suppress_cl=args.upload_no_cl)
+            cards.append(card)
+
         if test_httpd:
             httpd = Httpd(env=env)
             assert httpd.exists(), \
                 f'httpd not found: {env.httpd}'
             httpd.clear_logs()
-            assert httpd.start()
-            if 'h3' == protocol:
-                nghttpx = NghttpxFwd(env=env)
+            server_docs = httpd.docs_dir
+            assert httpd.initial_start()
+            if protocol == 'h3':
+                nghttpx = NghttpxQuic(env=env)
                 nghttpx.clear_logs()
-                assert nghttpx.start()
+                assert nghttpx.initial_start()
+                server_descr = f'nghttpx: https:{env.h3_port} [backend httpd/{env.httpd_version()}]'
+                server_port = env.h3_port
+            else:
+                server_descr = f'httpd/{env.httpd_version()}'
+                server_port = env.http_port if args.http_plain else env.https_port
+            card = ScoreRunner(env=env,
+                               protocol=protocol,
+                               server_descr=server_descr,
+                               server_port=server_port,
+                               verbose=args.verbose, curl_verbose=args.curl_verbose,
+                               download_parallel=args.download_parallel,
+                               upload_parallel=args.upload_parallel,
+                               with_flame=args.flame,
+                               socks_args=socks_args,
+                               limit_rate=args.limit_rate,
+                               http_plain=args.http_plain)
+            card.setup_resources(server_docs, downloads)
+            cards.append(card)
+
         if test_caddy and env.caddy:
+            backend = ''
+            if uploads and httpd is None:
+                backend = f' [backend httpd: {env.httpd_version()}]'
+                httpd = Httpd(env=env)
+                assert httpd.exists(), \
+                    f'httpd not found: {env.httpd}'
+                httpd.clear_logs()
+                assert httpd.initial_start()
             caddy = Caddy(env=env)
             caddy.clear_logs()
-            assert caddy.start()
+            assert caddy.initial_start()
+            server_descr = f'Caddy/{env.caddy_version()} {backend}'
+            server_port = caddy.port
+            server_docs = caddy.docs_dir
+            card = ScoreRunner(env=env,
+                               protocol=protocol,
+                               server_descr=server_descr,
+                               server_port=server_port,
+                               verbose=args.verbose, curl_verbose=args.curl_verbose,
+                               download_parallel=args.download_parallel,
+                               upload_parallel=args.upload_parallel,
+                               with_flame=args.flame,
+                               socks_args=socks_args,
+                               limit_rate=args.limit_rate)
+            card.setup_resources(server_docs, downloads)
+            cards.append(card)
 
-        card = ScoreCard(env=env, httpd=httpd, nghttpx=nghttpx, caddy=caddy,
-                         verbose=args.verbose, curl_verbose=args.curl_verbose)
-        score = card.score_proto(proto=protocol,
-                                 handshakes=handshakes,
-                                 downloads=downloads,
-                                 download_count=args.download_count,
-                                 requests=requests)
-        if args.json:
-            print(json.JSONEncoder(indent=2).encode(score))
+        if args.start_only:
+            print('started servers:')
+            for card in cards:
+                print(f'{card.server_descr}')
+            sys.stderr.write('press [RETURN] to finish')
+            sys.stderr.flush()
+            sys.stdin.readline()
         else:
-            card.print_score(score)
+            for card in cards:
+                score = card.score(handshakes=handshakes,
+                                   downloads=downloads,
+                                   download_count=args.download_count,
+                                   uploads=uploads,
+                                   upload_count=args.upload_count,
+                                   req_count=args.request_count,
+                                   requests=requests,
+                                   request_parallels=request_parallels,
+                                   nsamples=args.samples)
+                if args.json:
+                    print(json.JSONEncoder(indent=2).encode(score))
+                else:
+                    Card.print_score(score)
 
-    except ScoreCardException as ex:
-        sys.stderr.write(f"ERROR: {str(ex)}\n")
+    except ScoreCardError as ex:
+        sys.stderr.write(f"ERROR: {ex}\n")
         rv = 1
     except KeyboardInterrupt:
         log.warning("aborted")
@@ -563,6 +921,110 @@ def main():
             nghttpx.stop(wait_dead=False)
         if httpd:
             httpd.stop()
+        if sockd:
+            sockd.stop()
+    return rv
+
+
+def print_file(filename):
+    if not os.path.exists(filename):
+        sys.stderr.write(f"ERROR: file does not exist {filename}\n")
+        return 1
+    with open(filename) as file:
+        data = json.load(file)
+    Card.print_score(data)
+    return 0
+
+
+def main():
+    parser = argparse.ArgumentParser(prog='scorecard', description="""
+        Run a range of tests to give a scorecard for an HTTP protocol
+        'h3' or 'h2' implementation in curl.
+        """)
+    parser.add_argument("-v", "--verbose", action='count', default=1,
+                        help="log more output on stderr")
+    parser.add_argument("-j", "--json", action='store_true',
+                        default=False, help="print json instead of text")
+    parser.add_argument("--samples", action='store', type=int, metavar='number',
+                        default=1, help="how many sample runs to make")
+    parser.add_argument("--httpd", action='store_true', default=False,
+                        help="evaluate httpd server only")
+    parser.add_argument("--caddy", action='store_true', default=False,
+                        help="evaluate caddy server only")
+    parser.add_argument("--curl-verbose", action='store_true',
+                        default=False, help="run curl with `-v`")
+    parser.add_argument("--print", type=str, default=None, metavar='filename',
+                        help="print the results from a JSON file")
+    parser.add_argument("protocol", default=None, nargs='?',
+                        help="Name of protocol to score")
+    parser.add_argument("--start-only", action='store_true', default=False,
+                        help="only start the servers")
+    parser.add_argument("--remote", action='store', type=str,
+                        default=None, help="score against the remote server at <ip>:<port>")
+    parser.add_argument("--flame", action='store_true',
+                        default = False, help="produce a flame graph on curl")
+    parser.add_argument("--limit-rate", action='store', type=str,
+                        default=None, help="use curl's --limit-rate")
+    parser.add_argument("--http-plain", action='store_true',
+                        default=False, help="run http: test instead of https:")
+
+    parser.add_argument("-H", "--handshakes", action='store_true',
+                        default=False, help="evaluate handshakes only")
+
+    parser.add_argument("-d", "--downloads", action='store_true',
+                        default=False, help="evaluate downloads")
+    parser.add_argument("--download-sizes", action='append', type=str,
+                        metavar='numberlist',
+                        default=None, help="evaluate download size")
+    parser.add_argument("--download-count", action='store', type=int,
+                        metavar='number',
+                        default=50, help="perform that many downloads")
+    parser.add_argument("--download-parallel", action='store', type=int,
+                        metavar='number', default=0,
+                        help="perform that many downloads in parallel (default all)")
+
+    parser.add_argument("-u", "--uploads", action='store_true',
+                        default=False, help="evaluate uploads")
+    parser.add_argument("--upload-sizes", action='append', type=str,
+                        metavar='numberlist',
+                        default=None, help="evaluate upload size")
+    parser.add_argument("--upload-count", action='store', type=int,
+                        metavar='number', default=50,
+                        help="perform that many uploads")
+    parser.add_argument("--upload-parallel", action='store', type=int,
+                        metavar='number', default=0,
+                        help="perform that many uploads in parallel (default all)")
+    parser.add_argument("--upload-no-cl", action='store_true',
+                        default=False, help="suppress content-length on upload")
+
+    parser.add_argument("-r", "--requests", action='store_true',
+                        default=False, help="evaluate requests")
+    parser.add_argument("--request-count", action='store', type=int,
+                        metavar='number',
+                        default=5000, help="perform that many requests")
+    parser.add_argument("--request-parallels", action='append', type=str,
+                        metavar='numberlist',
+                        default=None, help="evaluate request with these max-parallel numbers")
+    parser.add_argument("--socks4", action='store_true',
+                        default=False, help="test with SOCKS4 proxy")
+    parser.add_argument("--socks5", action='store_true',
+                        default=False, help="test with SOCKS5 proxy")
+    args = parser.parse_args()
+
+    if args.verbose > 0:
+        console = logging.StreamHandler()
+        console.setLevel(logging.INFO)
+        console.setFormatter(logging.Formatter(logging.BASIC_FORMAT))
+        logging.getLogger('').addHandler(console)
+
+    if args.print:
+        rv = print_file(args.print)
+    elif not args.protocol:
+        parser.print_usage()
+        rv = 1
+    else:
+        rv = run_score(args, args.protocol)
+
     sys.exit(rv)
 
 
diff --git a/third-party/curl/tests/http/test_01_basic.py b/third-party/curl/tests/http/test_01_basic.py
index 7c1792d374..86f7ad191f 100644
--- a/third-party/curl/tests/http/test_01_basic.py
+++ b/third-party/curl/tests/http/test_01_basic.py
@@ -25,22 +25,16 @@
 ###########################################################################
 #
 import logging
+import re
+
 import pytest
-
-from testenv import Env
-from testenv import CurlClient
-
+from testenv import CurlClient, Env
 
 log = logging.getLogger(__name__)
 
 
 class TestBasic:
 
-    @pytest.fixture(autouse=True, scope='class')
-    def _class_scope(self, env, nghttpx):
-        if env.have_h3():
-            nghttpx.start_if_needed()
-
     # simple http: GET
     def test_01_01_http_get(self, env: Env, httpd):
         curl = CurlClient(env=env)
@@ -50,7 +44,7 @@ class TestBasic:
         assert r.json['server'] == env.domain1
 
     # simple https: GET, any http version
-    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason=f"curl without SSL")
+    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason="curl without SSL")
     def test_01_02_https_get(self, env: Env, httpd):
         curl = CurlClient(env=env)
         url = f'https://{env.domain1}:{env.https_port}/data.json'
@@ -59,7 +53,8 @@ class TestBasic:
         assert r.json['server'] == env.domain1
 
     # simple https: GET, h2 wanted and got
-    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason=f"curl without SSL")
+    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason="curl without SSL")
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
     def test_01_03_h2_get(self, env: Env, httpd):
         curl = CurlClient(env=env)
         url = f'https://{env.domain1}:{env.https_port}/data.json'
@@ -68,7 +63,8 @@ class TestBasic:
         assert r.json['server'] == env.domain1
 
     # simple https: GET, h2 unsupported, fallback to h1
-    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason=f"curl without SSL")
+    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason="curl without SSL")
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
     def test_01_04_h2_unsupported(self, env: Env, httpd):
         curl = CurlClient(env=env)
         url = f'https://{env.domain2}:{env.https_port}/data.json'
@@ -84,3 +80,240 @@ class TestBasic:
         r = curl.http_get(url=url, extra_args=['--http3-only'])
         r.check_response(http_status=200, protocol='HTTP/3')
         assert r.json['server'] == env.domain1
+
+    # simple download, check connect/handshake timings
+    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason="curl without SSL")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_01_06_timings(self, env: Env, httpd, nghttpx, proto):
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/data.json'
+        r = curl.http_download(urls=[url], alpn_proto=proto, with_stats=True)
+        r.check_stats(http_status=200, count=1,
+                      remote_port=env.port_for(alpn_proto=proto),
+                      remote_ip='127.0.0.1')
+        # there are cases where time_connect is reported as 0
+        assert r.stats[0]['time_connect'] >= 0, f'{r.stats[0]}'
+        assert r.stats[0]['time_appconnect'] > 0, f'{r.stats[0]}'
+        # ports are reported correctly
+        assert r.stats[0]['remote_port'] == env.port_for(proto), f'{r.dump_logs()}'
+        assert r.stats[0]['local_port'] > 0, f'{r.dump_logs()}'
+
+    # simple https: HEAD
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason="curl without SSL")
+    def test_01_07_head(self, env: Env, httpd, nghttpx, proto):
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/data.json'
+        r = curl.http_download(urls=[url], with_stats=True, with_headers=True,
+                               extra_args=['-I'])
+        r.check_stats(http_status=200, count=1, exitcode=0,
+                      remote_port=env.port_for(alpn_proto=proto),
+                      remote_ip='127.0.0.1')
+        # got the Content-Length: header, but did not download anything
+        assert r.responses[0]['header']['content-length'] == '30', f'{r.responses[0]}'
+        assert r.stats[0]['size_download'] == 0, f'{r.stats[0]}'
+
+    # http: GET for HTTP/2, see Upgrade:, 101 switch
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
+    def test_01_08_h2_upgrade(self, env: Env, httpd):
+        curl = CurlClient(env=env)
+        url = f'http://{env.domain1}:{env.http_port}/data.json'
+        r = curl.http_get(url=url, extra_args=['--http2'])
+        r.check_exit_code(0)
+        assert len(r.responses) == 2, f'{r.responses}'
+        assert r.responses[0]['status'] == 101, f'{r.responses[0]}'
+        assert r.responses[1]['status'] == 200, f'{r.responses[1]}'
+        assert r.responses[1]['protocol'] == 'HTTP/2', f'{r.responses[1]}'
+        assert r.json['server'] == env.domain1
+
+    # http: GET for HTTP/2 with prior knowledge
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
+    def test_01_09_h2_prior_knowledge(self, env: Env, httpd):
+        curl = CurlClient(env=env)
+        url = f'http://{env.domain1}:{env.http_port}/data.json'
+        r = curl.http_get(url=url, extra_args=['--http2-prior-knowledge'])
+        r.check_exit_code(0)
+        assert len(r.responses) == 1, f'{r.responses}'
+        assert r.response['status'] == 200, f'{r.responsw}'
+        assert r.response['protocol'] == 'HTTP/2', f'{r.response}'
+        assert r.json['server'] == env.domain1
+
+    # http: strip TE header in HTTP/2 requests
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
+    def test_01_10_te_strip(self, env: Env, httpd):
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, "h2")}/data.json'
+        r = curl.http_get(url=url, extra_args=['--http2', '-H', 'TE: gzip'])
+        r.check_exit_code(0)
+        assert len(r.responses) == 1, f'{r.responses}'
+        assert r.responses[0]['status'] == 200, f'{r.responses[1]}'
+        assert r.responses[0]['protocol'] == 'HTTP/2', f'{r.responses[1]}'
+
+    # http: large response headers
+    # send 48KB+ sized response headers to check we handle that correctly
+    # larger than 64KB headers expose a bug in Apache HTTP/2 that is not
+    # RSTing the stream correctly when its internal limits are exceeded.
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_01_11_large_resp_headers(self, env: Env, httpd, proto):
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}' \
+            f'/curltest/tweak?x-hd={48 * 1024}'
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[])
+        r.check_exit_code(0)
+        assert len(r.responses) == 1, f'{r.responses}'
+        assert r.responses[0]['status'] == 200, f'{r.responses}'
+
+    # http: response headers larger than what curl buffers for
+    @pytest.mark.skipif(condition=not Env.httpd_is_at_least('2.4.64'),
+                        reason='httpd must be at least 2.4.64')
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    def test_01_12_xlarge_resp_headers(self, env: Env, httpd, configures_httpd, proto):
+        httpd.set_extra_config('base', [
+            f'H2MaxHeaderBlockLen {130 * 1024}',
+        ])
+        httpd.reload_if_config_changed()
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}' \
+            f'/curltest/tweak?x-hd={128 * 1024}'
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[])
+        r.check_exit_code(0)
+        assert len(r.responses) == 1, f'{r.responses}'
+        assert r.responses[0]['status'] == 200, f'{r.responses}'
+
+    # http: 1 response header larger than what curl buffers for
+    @pytest.mark.skipif(condition=not Env.httpd_is_at_least('2.4.64'),
+                        reason='httpd must be at least 2.4.64')
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    def test_01_13_megalarge_resp_headers(self, env: Env, httpd, configures_httpd, proto):
+        httpd.set_extra_config('base', [
+            'LogLevel http2:trace2',
+            f'H2MaxHeaderBlockLen {130 * 1024}',
+        ])
+        httpd.reload_if_config_changed()
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}' \
+            f'/curltest/tweak?x-hd1={128 * 1024}'
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[])
+        if proto == 'h2':
+            r.check_exit_code(16)  # CURLE_HTTP2
+        else:
+            r.check_exit_code(100)  # CURLE_TOO_LARGE
+
+    # http: several response headers, together > 256 KB
+    # nghttp2 error -905: Too many CONTINUATION frames following a HEADER frame
+    @pytest.mark.skipif(condition=not Env.httpd_is_at_least('2.4.64'),
+                        reason='httpd must be at least 2.4.64')
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    def test_01_14_gigalarge_resp_headers(self, env: Env, httpd, configures_httpd, proto):
+        httpd.set_extra_config('base', [
+            'LogLevel http2:trace2',
+            f'H2MaxHeaderBlockLen {1024 * 1024}',
+        ])
+        httpd.reload_if_config_changed()
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}' \
+            f'/curltest/tweak?x-hd={256 * 1024}'
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[])
+        if proto == 'h2':
+            r.check_exit_code(16)  # CURLE_HTTP2
+        else:
+            r.check_exit_code(0)   # 1.1 can do
+
+    # http: one response header > 256 KB
+    @pytest.mark.skipif(condition=not Env.httpd_is_at_least('2.4.64'),
+                        reason='httpd must be at least 2.4.64')
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    def test_01_15_gigalarge_resp_headers(self, env: Env, httpd, configures_httpd, proto):
+        httpd.set_extra_config('base', [
+            'LogLevel http2:trace2',
+            f'H2MaxHeaderBlockLen {1024 * 1024}',
+        ])
+        httpd.reload_if_config_changed()
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}' \
+            f'/curltest/tweak?x-hd1={256 * 1024}'
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[])
+        if proto == 'h2':
+            r.check_exit_code(16)  # CURLE_HTTP2
+        else:
+            r.check_exit_code(100)  # CURLE_TOO_LARGE
+
+    # http: invalid request headers, GET, issue #16998
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_01_16_inv_req_get(self, env: Env, httpd, nghttpx, proto):
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo'
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
+            '-H', "a: a\x0ab"
+        ])
+        # on h1, request is sent, h2/h3 reject
+        if proto == 'http/1.1':
+            r.check_exit_code(0)
+        else:
+            r.check_exit_code(43)
+
+    # http: special handling of TE request header
+    @pytest.mark.parametrize("te_in, te_out", [
+        pytest.param('trailers', 'trailers', id='trailers'),
+        pytest.param('chunked', None, id='chunked'),
+        pytest.param('gzip, trailers', 'trailers', id='gzip+trailers'),
+        pytest.param('gzip ;q=0.2;x="y,x", trailers', 'trailers', id='gzip+q+x+trailers'),
+        pytest.param('gzip ;x="trailers", chunks', None, id='gzip+x+chunks'),
+    ])
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
+    def test_01_17_TE(self, env: Env, httpd, te_in, te_out):
+        proto = 'h2'
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo'
+        r = curl.http_download(urls=[url], alpn_proto=proto, with_stats=True,
+                               with_headers=True,
+                               extra_args=['-H', f'TE: {te_in}'])
+        r.check_response(200)
+        if te_out is not None:
+            assert r.responses[0]['header']['request-te'] == te_out, f'{r.responses[0]}'
+        else:
+            assert 'request-te' not in r.responses[0]['header'], f'{r.responses[0]}'
+
+    # check that an existing https: connection is not reused for http:
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
+    def test_01_18_tls_reuse(self, env: Env, httpd):
+        proto = 'h2'
+        curl = CurlClient(env=env)
+        url1 = f'https://{env.authority_for(env.domain1, proto)}/data.json'
+        url2 = f'http://{env.authority_for(env.domain1, proto)}/data.json'
+        r = curl.http_download(urls=[url1, url2], alpn_proto=proto, with_stats=True)
+        assert len(r.stats) == 2
+        assert r.total_connects == 2, f'{r.dump_logs()}'
+
+    # check that an existing http: connection is not reused for https:
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
+    def test_01_19_plain_reuse(self, env: Env, httpd):
+        proto = 'h2'
+        curl = CurlClient(env=env)
+        url1 = f'http://{env.domain1}:{env.http_port}/data.json'
+        url2 = f'https://{env.domain1}:{env.http_port}/data.json'
+        r = curl.http_download(urls=[url1, url2], alpn_proto=proto, with_stats=True)
+        assert len(r.stats) == 2
+        assert r.total_connects == 2, f'{r.dump_logs()}'
+
+    # use a custom method containing a space
+    # check that h2/h3 did send that in the :method pseudo header. #19543
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs verbosecurl")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_01_20_method_space(self, env: Env, proto, httpd):
+        curl = CurlClient(env=env)
+        method = 'IN SANE'
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo'
+        r = curl.http_download(urls=[url], alpn_proto=proto, with_stats=True,
+                               extra_args=['-X', method])
+        if proto == 'h2' or proto == 'h3':
+            # h2+3 may close the connection for such invalid requests
+            re_m = re.compile(r'.*\[:method: ([^\]]+)\].*')
+            lines = [line for line in r.trace_lines if re_m.match(line)]
+            assert len(lines) == 1, f'{r.dump_logs()}'
+            m = re_m.match(lines[0])
+            assert m.group(1) == method, f'{r.dump_logs()}'
+        else:
+            # h1 should give us a real response
+            assert len(r.stats) == 1
+            r.check_response(http_status=400)
diff --git a/third-party/curl/tests/http/test_02_download.py b/third-party/curl/tests/http/test_02_download.py
index 60aa273097..c75f932b72 100644
--- a/third-party/curl/tests/http/test_02_download.py
+++ b/third-party/curl/tests/http/test_02_download.py
@@ -28,77 +28,71 @@ import difflib
 import filecmp
 import logging
 import os
-from datetime import timedelta
+import re
+import sys
+
 import pytest
-
-from testenv import Env, CurlClient, LocalClient
-
+from testenv import CurlClient, Env, LocalClient
 
 log = logging.getLogger(__name__)
 
 
 class TestDownload:
 
-    @pytest.fixture(autouse=True, scope='class')
-    def _class_scope(self, env, httpd, nghttpx):
-        if env.have_h3():
-            nghttpx.start_if_needed()
-        httpd.clear_extra_configs()
-        httpd.reload()
-
     @pytest.fixture(autouse=True, scope='class')
     def _class_scope(self, env, httpd):
         indir = httpd.docs_dir
-        env.make_data_file(indir=indir, fname="data-10k", fsize=10*1024)
-        env.make_data_file(indir=indir, fname="data-100k", fsize=100*1024)
-        env.make_data_file(indir=indir, fname="data-1m", fsize=1024*1024)
-        env.make_data_file(indir=indir, fname="data-10m", fsize=10*1024*1024)
-        env.make_data_file(indir=indir, fname="data-50m", fsize=50*1024*1024)
+        env.make_data_file(indir=indir, fname="data-0k", fsize=0)
+        env.make_data_file(indir=indir, fname="data-10k", fsize=10 * 1024)
+        env.make_data_file(indir=indir, fname="data-100k", fsize=100 * 1024)
+        env.make_data_file(indir=indir, fname="data-1m", fsize=1024 * 1024)
+        env.make_data_file(indir=indir, fname="data-10m", fsize=10 * 1024 * 1024)
+        env.make_data_file(indir=indir, fname="data-50m", fsize=50 * 1024 * 1024)
+        env.make_data_gzipbomb(indir=indir, fname="bomb-100m.txt", fsize=100 * 1024 * 1024)
 
     # download 1 file
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_02_01_download_1(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    @pytest.mark.parametrize("docname", ['data.json', 'data-0k', 'data-10k', 'data-100k'])
+    def test_02_01_download_1(self, env: Env, httpd, nghttpx, proto, docname):
         curl = CurlClient(env=env)
-        url = f'https://{env.authority_for(env.domain1, proto)}/data.json'
+        url = f'https://{env.authority_for(env.domain1, proto)}/{docname}'
         r = curl.http_download(urls=[url], alpn_proto=proto)
         r.check_response(http_status=200)
 
     # download 2 files
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_02_02_download_2(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_02_download_2(self, env: Env, httpd, nghttpx, proto):
         curl = CurlClient(env=env)
         url = f'https://{env.authority_for(env.domain1, proto)}/data.json?[0-1]'
         r = curl.http_download(urls=[url], alpn_proto=proto)
         r.check_response(http_status=200, count=2)
 
     # download 100 files sequentially
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_02_03_download_100_sequential(self, env: Env,
-                                           httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_03_download_sequential(self, env: Env, httpd, nghttpx, proto):
+        if (proto == 'http/1.1' or proto == 'h2') and env.curl_uses_lib('mbedtls') and \
+           sys.platform.startswith('darwin') and env.ci_run:
+            pytest.skip('mbedtls 3.6.3 fails this test on macOS CI runners')
+        count = 10
         curl = CurlClient(env=env)
-        urln = f'https://{env.authority_for(env.domain1, proto)}/data.json?[0-99]'
+        urln = f'https://{env.authority_for(env.domain1, proto)}/data.json?[0-{count-1}]'
         r = curl.http_download(urls=[urln], alpn_proto=proto)
-        r.check_response(http_status=200, count=100, connect_count=1)
+        r.check_response(http_status=200, count=count, connect_count=1)
 
     # download 100 files parallel
-    @pytest.mark.parametrize("proto", ['h2', 'h3'])
-    def test_02_04_download_100_parallel(self, env: Env,
-                                         httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        max_parallel = 50
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_04_download_parallel(self, env: Env, httpd, nghttpx, proto):
+        if proto == 'h2' and env.curl_uses_lib('mbedtls') and \
+           sys.platform.startswith('darwin') and env.ci_run:
+            pytest.skip('mbedtls 3.6.3 fails this test on macOS CI runners')
+        count = 10
+        max_parallel = 5
         curl = CurlClient(env=env)
-        urln = f'https://{env.authority_for(env.domain1, proto)}/data.json?[0-99]'
+        urln = f'https://{env.authority_for(env.domain1, proto)}/data.json?[0-{count-1}]'
         r = curl.http_download(urls=[urln], alpn_proto=proto, extra_args=[
             '--parallel', '--parallel-max', f'{max_parallel}'
         ])
-        r.check_response(http_status=200, count=100)
+        r.check_response(http_status=200, count=count)
         if proto == 'http/1.1':
             # http/1.1 parallel transfers will open multiple connections
             assert r.total_connects > 1, r.dump_logs()
@@ -107,17 +101,16 @@ class TestDownload:
             assert r.total_connects == 1, r.dump_logs()
 
     # download 500 files sequential
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_02_05_download_500_sequential(self, env: Env,
-                                           httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 shaky here")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_05_download_many_sequential(self, env: Env, httpd, nghttpx, proto):
+        if proto == 'h2' and env.curl_uses_lib('mbedtls') and \
+           sys.platform.startswith('darwin') and env.ci_run:
+            pytest.skip('mbedtls 3.6.3 fails this test on macOS CI runners')
+        count = 200
         curl = CurlClient(env=env)
-        urln = f'https://{env.authority_for(env.domain1, proto)}/data.json?[0-499]'
+        urln = f'https://{env.authority_for(env.domain1, proto)}/data.json?[0-{count-1}]'
         r = curl.http_download(urls=[urln], alpn_proto=proto)
-        r.check_response(http_status=200, count=500)
+        r.check_response(http_status=200, count=count)
         if proto == 'http/1.1':
             # http/1.1 parallel transfers will open multiple connections
             assert r.total_connects > 1, r.dump_logs()
@@ -126,12 +119,12 @@ class TestDownload:
             assert r.total_connects == 1, r.dump_logs()
 
     # download 500 files parallel
-    @pytest.mark.parametrize("proto", ['h2', 'h3'])
-    def test_02_06_download_500_parallel(self, env: Env,
-                                         httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        count = 500
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_02_06_download_many_parallel(self, env: Env, httpd, nghttpx, proto):
+        if proto == 'h2' and env.curl_uses_lib('mbedtls') and \
+           sys.platform.startswith('darwin') and env.ci_run:
+            pytest.skip('mbedtls 3.6.3 fails this test on macOS CI runners')
+        count = 200
         max_parallel = 50
         curl = CurlClient(env=env)
         urln = f'https://{env.authority_for(env.domain1, proto)}/data.json?[000-{count-1}]'
@@ -141,11 +134,8 @@ class TestDownload:
         r.check_response(http_status=200, count=count, connect_count=1)
 
     # download files parallel, check connection reuse/multiplex
-    @pytest.mark.parametrize("proto", ['h2', 'h3'])
-    def test_02_07_download_reuse(self, env: Env,
-                                  httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_02_07_download_reuse(self, env: Env, httpd, nghttpx, proto):
         count = 200
         curl = CurlClient(env=env)
         urln = f'https://{env.authority_for(env.domain1, proto)}/data.json?[0-{count-1}]'
@@ -155,16 +145,13 @@ class TestDownload:
         ])
         r.check_response(http_status=200, count=count)
         # should have used at most 2 connections only (test servers allow 100 req/conn)
-        # it may be just 1 on slow systems where request are answered faster than
+        # it may be 1 on slow systems where request are answered faster than
         # curl can exhaust the capacity or if curl runs with address-sanitizer speed
         assert r.total_connects <= 2, "h2 should use fewer connections here"
 
     # download files parallel with http/1.1, check connection not reused
     @pytest.mark.parametrize("proto", ['http/1.1'])
-    def test_02_07b_download_reuse(self, env: Env,
-                                   httpd, nghttpx, repeat, proto):
-        if env.curl_uses_lib('wolfssl'):
-            pytest.skip("wolfssl session reuse borked")
+    def test_02_07b_download_reuse(self, env: Env, httpd, nghttpx, proto):
         count = 6
         curl = CurlClient(env=env)
         urln = f'https://{env.authority_for(env.domain1, proto)}/data.json?[0-{count-1}]'
@@ -176,23 +163,17 @@ class TestDownload:
         # http/1.1 should have used count connections
         assert r.total_connects == count, "http/1.1 should use this many connections"
 
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_02_08_1MB_serial(self, env: Env,
-                              httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        count = 20
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_08_1MB_serial(self, env: Env, httpd, nghttpx, proto):
+        count = 5
         urln = f'https://{env.authority_for(env.domain1, proto)}/data-1m?[0-{count-1}]'
         curl = CurlClient(env=env)
         r = curl.http_download(urls=[urln], alpn_proto=proto)
         r.check_response(count=count, http_status=200)
 
-    @pytest.mark.parametrize("proto", ['h2', 'h3'])
-    def test_02_09_1MB_parallel(self, env: Env,
-                              httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        count = 20
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_02_09_1MB_parallel(self, env: Env, httpd, nghttpx, proto):
+        count = 5
         urln = f'https://{env.authority_for(env.domain1, proto)}/data-1m?[0-{count-1}]'
         curl = CurlClient(env=env)
         r = curl.http_download(urls=[urln], alpn_proto=proto, extra_args=[
@@ -202,12 +183,9 @@ class TestDownload:
 
     @pytest.mark.skipif(condition=Env().slow_network, reason="not suitable for slow network tests")
     @pytest.mark.skipif(condition=Env().ci_run, reason="not suitable for CI runs")
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_02_10_10MB_serial(self, env: Env,
-                              httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        count = 20
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_10_10MB_serial(self, env: Env, httpd, nghttpx, proto):
+        count = 3
         urln = f'https://{env.authority_for(env.domain1, proto)}/data-10m?[0-{count-1}]'
         curl = CurlClient(env=env)
         r = curl.http_download(urls=[urln], alpn_proto=proto)
@@ -215,14 +193,9 @@ class TestDownload:
 
     @pytest.mark.skipif(condition=Env().slow_network, reason="not suitable for slow network tests")
     @pytest.mark.skipif(condition=Env().ci_run, reason="not suitable for CI runs")
-    @pytest.mark.parametrize("proto", ['h2', 'h3'])
-    def test_02_11_10MB_parallel(self, env: Env,
-                              httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 stalls here")
-        count = 20
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_02_11_10MB_parallel(self, env: Env, httpd, nghttpx, proto):
+        count = 3
         urln = f'https://{env.authority_for(env.domain1, proto)}/data-10m?[0-{count-1}]'
         curl = CurlClient(env=env)
         r = curl.http_download(urls=[urln], alpn_proto=proto, extra_args=[
@@ -230,12 +203,9 @@ class TestDownload:
         ])
         r.check_response(count=count, http_status=200)
 
-    @pytest.mark.parametrize("proto", ['h2', 'h3'])
-    def test_02_12_head_serial_https(self, env: Env,
-                                     httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        count = 100
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_02_12_head_serial_https(self, env: Env, httpd, nghttpx, proto):
+        count = 5
         urln = f'https://{env.authority_for(env.domain1, proto)}/data-10m?[0-{count-1}]'
         curl = CurlClient(env=env)
         r = curl.http_download(urls=[urln], alpn_proto=proto, extra_args=[
@@ -244,11 +214,9 @@ class TestDownload:
         r.check_response(count=count, http_status=200)
 
     @pytest.mark.parametrize("proto", ['h2'])
-    def test_02_13_head_serial_h2c(self, env: Env,
-                                    httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        count = 100
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
+    def test_02_13_head_serial_h2c(self, env: Env, httpd, nghttpx, proto):
+        count = 5
         urln = f'http://{env.domain1}:{env.http_port}/data-10m?[0-{count-1}]'
         curl = CurlClient(env=env)
         r = curl.http_download(urls=[urln], alpn_proto=proto, extra_args=[
@@ -256,27 +224,47 @@ class TestDownload:
         ])
         r.check_response(count=count, http_status=200)
 
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_02_14_not_found(self, env: Env, httpd, nghttpx, proto):
+        count = 5
+        urln = f'https://{env.authority_for(env.domain1, proto)}/not-found?[0-{count-1}]'
+        curl = CurlClient(env=env)
+        r = curl.http_download(urls=[urln], alpn_proto=proto, extra_args=[
+            '--parallel'
+        ])
+        r.check_stats(count=count, http_status=404, exitcode=0,
+                      remote_port=env.port_for(alpn_proto=proto),
+                      remote_ip='127.0.0.1')
+
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_02_15_fail_not_found(self, env: Env, httpd, nghttpx, proto):
+        count = 5
+        urln = f'https://{env.authority_for(env.domain1, proto)}/not-found?[0-{count-1}]'
+        curl = CurlClient(env=env)
+        r = curl.http_download(urls=[urln], alpn_proto=proto, extra_args=[
+            '--fail'
+        ])
+        r.check_stats(count=count, http_status=404, exitcode=22,
+                      remote_port=env.port_for(alpn_proto=proto),
+                      remote_ip='127.0.0.1')
+
     @pytest.mark.skipif(condition=Env().slow_network, reason="not suitable for slow network tests")
-    @pytest.mark.skipif(condition=Env().ci_run, reason="not suitable for CI runs")
-    def test_02_20_h2_small_frames(self, env: Env, httpd, repeat):
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
+    def test_02_20_h2_small_frames(self, env: Env, httpd, configures_httpd):
         # Test case to reproduce content corruption as observed in
         # https://github.com/curl/curl/issues/10525
         # To reliably reproduce, we need an Apache httpd that supports
         # setting smaller frame sizes. This is not released yet, we
         # test if it works and back out if not.
         httpd.set_extra_config(env.domain1, lines=[
-            f'H2MaxDataFrameLen 1024',
+            'H2MaxDataFrameLen 1024',
         ])
-        assert httpd.stop()
-        if not httpd.start():
-            # no, not supported, bail out
-            httpd.set_extra_config(env.domain1, lines=None)
-            assert httpd.start()
-            pytest.skip(f'H2MaxDataFrameLen not supported')
+        if not httpd.reload_if_config_changed():
+            pytest.skip('H2MaxDataFrameLen not supported')
         # ok, make 100 downloads with 2 parallel running and they
         # are expected to stumble into the issue when using `lib/http2.c`
         # from curl 7.88.0
-        count = 100
+        count = 5
         urln = f'https://{env.authority_for(env.domain1, "h2")}/data-1m?[0-{count-1}]'
         curl = CurlClient(env=env)
         r = curl.http_download(urls=[urln], alpn_proto="h2", extra_args=[
@@ -285,114 +273,456 @@ class TestDownload:
         r.check_response(count=count, http_status=200)
         srcfile = os.path.join(httpd.docs_dir, 'data-1m')
         self.check_downloads(curl, srcfile, count)
-        # restore httpd defaults
-        httpd.set_extra_config(env.domain1, lines=None)
-        assert httpd.stop()
-        assert httpd.start()
 
-    # download via lib client, 1 at a time, pause/resume at different offsets
-    @pytest.mark.parametrize("pause_offset", [0, 10*1024, 100*1023, 640000])
-    def test_02_21_h2_lib_serial(self, env: Env, httpd, nghttpx, pause_offset, repeat):
-        count = 10
-        docname = 'data-10m'
+    # download serial via lib client, pause/resume at different offsets
+    @pytest.mark.parametrize("pause_offset", [0, 10 * 1024, 100 * 1023, 640000])
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_21_lib_serial(self, env: Env, httpd, nghttpx, proto, pause_offset):
+        count = 2
+        docname = 'data-1m'
         url = f'https://localhost:{env.https_port}/{docname}'
-        client = LocalClient(name='h2-download', env=env)
+        client = LocalClient(name='cli_hx_download', env=env)
         if not client.exists():
             pytest.skip(f'example client not built: {client.name}')
         r = client.run(args=[
-             '-n', f'{count}', '-P', f'{pause_offset}', url
+             '-n', f'{count}', '-P', f'{pause_offset}',
+             '-C', env.ca.cert_file, '-V', proto, url
         ])
         r.check_exit_code(0)
         srcfile = os.path.join(httpd.docs_dir, docname)
         self.check_downloads(client, srcfile, count)
 
     # download via lib client, several at a time, pause/resume
-    @pytest.mark.parametrize("pause_offset", [100*1023])
-    def test_02_22_h2_lib_parallel_resume(self, env: Env, httpd, nghttpx, pause_offset, repeat):
-        count = 10
+    @pytest.mark.parametrize("pause_offset", [100 * 1023])
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_22_lib_parallel_resume(self, env: Env, httpd, nghttpx, proto, pause_offset):
+        count = 2
         max_parallel = 5
         docname = 'data-10m'
         url = f'https://localhost:{env.https_port}/{docname}'
-        client = LocalClient(name='h2-download', env=env)
+        client = LocalClient(name='cli_hx_download', env=env)
         if not client.exists():
             pytest.skip(f'example client not built: {client.name}')
         r = client.run(args=[
             '-n', f'{count}', '-m', f'{max_parallel}',
-            '-P', f'{pause_offset}', url
+            '-P', f'{pause_offset}', '-C', env.ca.cert_file,
+            '-V', proto, url
         ])
         r.check_exit_code(0)
         srcfile = os.path.join(httpd.docs_dir, docname)
         self.check_downloads(client, srcfile, count)
 
     # download, several at a time, pause and abort paused
-    @pytest.mark.parametrize("pause_offset", [100*1023])
-    def test_02_23_h2_lib_parallel_abort(self, env: Env, httpd, nghttpx, pause_offset, repeat):
-        count = 200
-        max_parallel = 100
-        docname = 'data-10m'
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_23a_lib_abort_paused(self, env: Env, httpd, nghttpx, proto):
+        if proto == 'h3' and env.ci_run and env.curl_uses_lib('quiche'):
+            pytest.skip("fails in CI, but works locally for unknown reasons")
+        count = 10
+        max_parallel = 5
+        if proto in Env.http_mplx_protos():
+            pause_offset = 64 * 1024
+        else:
+            pause_offset = 12 * 1024
+        docname = 'data-1m'
         url = f'https://localhost:{env.https_port}/{docname}'
-        client = LocalClient(name='h2-download', env=env)
+        client = LocalClient(name='cli_hx_download', env=env)
         if not client.exists():
             pytest.skip(f'example client not built: {client.name}')
         r = client.run(args=[
             '-n', f'{count}', '-m', f'{max_parallel}', '-a',
-            '-P', f'{pause_offset}', url
+            '-C', env.ca.cert_file,
+            '-P', f'{pause_offset}', '-V', proto, url
         ])
         r.check_exit_code(0)
         srcfile = os.path.join(httpd.docs_dir, docname)
         # downloads should be there, but not necessarily complete
         self.check_downloads(client, srcfile, count, complete=False)
 
+    # download, several at a time, abort after n bytes
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_23b_lib_abort_offset(self, env: Env, httpd, nghttpx, proto):
+        if proto == 'h3' and env.ci_run and env.curl_uses_lib('quiche'):
+            pytest.skip("fails in CI, but works locally for unknown reasons")
+        count = 10
+        max_parallel = 5
+        if proto in Env.http_mplx_protos():
+            abort_offset = 64 * 1024
+        else:
+            abort_offset = 12 * 1024
+        docname = 'data-1m'
+        url = f'https://localhost:{env.https_port}/{docname}'
+        client = LocalClient(name='cli_hx_download', env=env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        r = client.run(args=[
+            '-n', f'{count}', '-m', f'{max_parallel}', '-a',
+            '-C', env.ca.cert_file,
+            '-A', f'{abort_offset}', '-V', proto, url
+        ])
+        r.check_exit_code(42)  # CURLE_ABORTED_BY_CALLBACK
+        srcfile = os.path.join(httpd.docs_dir, docname)
+        # downloads should be there, but not necessarily complete
+        self.check_downloads(client, srcfile, count, complete=False)
+
+    # download, several at a time, abort after n bytes
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_23c_lib_fail_offset(self, env: Env, httpd, nghttpx, proto):
+        if proto == 'h3' and env.ci_run and env.curl_uses_lib('quiche'):
+            pytest.skip("fails in CI, but works locally for unknown reasons")
+        count = 10
+        max_parallel = 5
+        if proto in Env.http_mplx_protos():
+            fail_offset = 64 * 1024
+        else:
+            fail_offset = 12 * 1024
+        docname = 'data-1m'
+        url = f'https://localhost:{env.https_port}/{docname}'
+        client = LocalClient(name='cli_hx_download', env=env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        r = client.run(args=[
+            '-n', f'{count}', '-m', f'{max_parallel}', '-a',
+            '-C', env.ca.cert_file,
+            '-F', f'{fail_offset}', '-V', proto, url
+        ])
+        r.check_exit_code(23)  # CURLE_WRITE_ERROR
+        srcfile = os.path.join(httpd.docs_dir, docname)
+        # downloads should be there, but not necessarily complete
+        self.check_downloads(client, srcfile, count, complete=False)
+
     # speed limited download
-    @pytest.mark.parametrize("proto", ['h2', 'h3'])
-    def test_02_24_speed_limit(self, env: Env, httpd, nghttpx, proto, repeat):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_24_speed_limit(self, env: Env, httpd, nghttpx, proto):
+        if proto == 'h3' and not env.curl_uses_lib('ngtcp2'):
+            pytest.skip("precise h3 rate limits only with ngtcp2")
         count = 1
         url = f'https://{env.authority_for(env.domain1, proto)}/data-1m'
         curl = CurlClient(env=env)
+        speed_limit = 512 * 1024
         r = curl.http_download(urls=[url], alpn_proto=proto, extra_args=[
-            '--limit-rate', f'{196 * 1024}'
+            '--limit-rate', f'{speed_limit}'
         ])
         r.check_response(count=count, http_status=200)
-        assert r.duration > timedelta(seconds=4), \
-            f'rate limited transfer should take more than 4s, not {r.duration}'
+        dl_speed = r.stats[0]['speed_download']
+        assert dl_speed <= (speed_limit * 1.1), f'{r.stats[0]}'
 
     # make extreme parallel h2 upgrades, check invalid conn reuse
     # before protocol switch has happened
-    def test_02_25_h2_upgrade_x(self, env: Env, httpd, repeat):
-        # not locally reproducible timeouts with certain SSL libs
-        # Since this test is about connection reuse handling, we skip
-        # it on these builds. Although we would certainly like to understand
-        # why this happens.
-        if env.curl_uses_lib('bearssl'):
-            pytest.skip('CI workflows timeout on bearssl build')
+    def test_02_25_h2_upgrade_x(self, env: Env, httpd):
         url = f'http://localhost:{env.http_port}/data-100k'
-        client = LocalClient(name='h2-upgrade-extreme', env=env, timeout=15)
+        client = LocalClient(name='cli_h2_upgrade_extreme', env=env, timeout=15)
         if not client.exists():
             pytest.skip(f'example client not built: {client.name}')
         r = client.run(args=[url])
         assert r.exit_code == 0, f'{client.dump_logs()}'
 
     # Special client that tests TLS session reuse in parallel transfers
-    def test_02_26_session_shared_reuse(self, env: Env, httpd, repeat):
-        curl = CurlClient(env=env)
-        url = f'https://{env.domain1}:{env.https_port}/data-100k'
-        client = LocalClient(name='tls-session-reuse', env=env)
+    # TODO: uses a single connection for h2/h3. Not sure how to prevent that
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_26_session_shared_reuse(self, env: Env, proto, httpd, nghttpx):
+        url = f'https://{env.authority_for(env.domain1, proto)}/data-100k'
+        client = LocalClient(name='cli_tls_session_reuse', env=env)
         if not client.exists():
             pytest.skip(f'example client not built: {client.name}')
-        r = client.run(args=[url])
+        r = client.run(args=[url, proto])
         r.check_exit_code(0)
 
+    # test on paused transfers, based on issue #11982
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_27a_paused_no_cl(self, env: Env, httpd, nghttpx, proto):
+        url = f'https://{env.authority_for(env.domain1, proto)}' \
+            '/curltest/tweak/?&chunks=6&chunk_size=8000'
+        client = LocalClient(env=env, name='cli_h2_pausing')
+        r = client.run(args=['-V', proto, url])
+        r.check_exit_code(0)
+
+    # test on paused transfers, based on issue #11982
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_27b_paused_no_cl(self, env: Env, httpd, nghttpx, proto):
+        url = f'https://{env.authority_for(env.domain1, proto)}' \
+            '/curltest/tweak/?error=502'
+        client = LocalClient(env=env, name='cli_h2_pausing')
+        r = client.run(args=['-V', proto, url])
+        r.check_exit_code(0)
+
+    # test on paused transfers, based on issue #11982
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_27c_paused_no_cl(self, env: Env, httpd, nghttpx, proto):
+        url = f'https://{env.authority_for(env.domain1, proto)}' \
+            '/curltest/tweak/?status=200&chunks=1&chunk_size=100'
+        client = LocalClient(env=env, name='cli_h2_pausing')
+        r = client.run(args=['-V', proto, url])
+        r.check_exit_code(0)
+
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_28_get_compressed(self, env: Env, httpd, nghttpx, proto):
+        if not env.have_compressed_curl():
+            pytest.skip("--compressed not supported")
+        count = 1
+        urln = f'https://{env.authority_for(env.domain1brotli, proto)}/data-100k?[0-{count-1}]'
+        curl = CurlClient(env=env)
+        r = curl.http_download(urls=[urln], alpn_proto=proto, extra_args=[
+            '--compressed'
+        ])
+        r.check_exit_code(code=0)
+        r.check_response(count=count, http_status=200)
+
     def check_downloads(self, client, srcfile: str, count: int,
                         complete: bool = True):
         for i in range(count):
             dfile = client.download_file(i)
             assert os.path.exists(dfile)
             if complete and not filecmp.cmp(srcfile, dfile, shallow=False):
-                diff = "".join(difflib.unified_diff(a=open(srcfile).readlines(),
-                                                    b=open(dfile).readlines(),
+                with open(srcfile) as fa, open(dfile) as fb:
+                    a = fa.readlines()
+                    b = fb.readlines()
+                diff = "".join(difflib.unified_diff(a=a, b=b,
                                                     fromfile=srcfile,
                                                     tofile=dfile,
                                                     n=1))
                 assert False, f'download {dfile} differs:\n{diff}'
+
+    # download via lib client, 1 at a time, pause/resume at different offsets
+    @pytest.mark.parametrize("pause_offset", [0, 10 * 1024, 100 * 1023, 640000])
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_29_h2_lib_serial(self, env: Env, httpd, nghttpx, proto, pause_offset):
+        count = 2
+        docname = 'data-10m'
+        url = f'https://localhost:{env.https_port}/{docname}'
+        client = LocalClient(name='cli_hx_download', env=env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        r = client.run(args=[
+             '-n', f'{count}', '-P', f'{pause_offset}',
+             '-C', env.ca.cert_file, '-V', proto, url
+        ])
+        r.check_exit_code(0)
+        srcfile = os.path.join(httpd.docs_dir, docname)
+        self.check_downloads(client, srcfile, count)
+
+    # download parallel with prior knowledge
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
+    def test_02_30_parallel_prior_knowledge(self, env: Env, httpd):
+        count = 3
+        curl = CurlClient(env=env)
+        urln = f'http://{env.domain1}:{env.http_port}/data.json?[0-{count-1}]'
+        r = curl.http_download(urls=[urln], extra_args=[
+            '--parallel', '--http2-prior-knowledge'
+        ])
+        r.check_response(http_status=200, count=count)
+        assert r.total_connects == 1, r.dump_logs()
+
+    # download parallel with h2 "Upgrade:"
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
+    def test_02_31_parallel_upgrade(self, env: Env, httpd, nghttpx):
+        count = 3
+        curl = CurlClient(env=env)
+        urln = f'http://{env.domain1}:{env.http_port}/data.json?[0-{count-1}]'
+        r = curl.http_download(urls=[urln], extra_args=[
+            '--parallel', '--http2'
+        ])
+        r.check_response(http_status=200, count=count)
+        # we see up to 3 connections, because Apache wants to serve only a single
+        # request via Upgrade: and then closes the connection. But if a new
+        # request comes in time, it might still get served.
+        assert r.total_connects <= 3, r.dump_logs()
+
+    # nghttpx is the only server we have that supports TLS early data
+    @pytest.mark.skipif(condition=not Env.have_nghttpx(), reason="no nghttpx")
+    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_32_earlydata(self, env: Env, httpd, nghttpx, proto):
+        if not env.curl_can_early_data():
+            pytest.skip('TLS earlydata not implemented')
+        if proto == 'h3' and not env.curl_can_h3_early_data():
+            pytest.skip("h3 early data not supported")
+        if proto != 'h3' and sys.platform.startswith('darwin') and env.ci_run:
+            pytest.skip('failing on macOS CI runners')
+        if proto == 'h3' and env.curl_uses_lib('wolfssl'):
+            pytest.skip('h3 wolfssl early data failing')
+        if proto == 'h3' and env.curl_uses_lib('gnutls'):
+            pytest.skip('h3 gnutls early data failing')
+        count = 2
+        docname = 'data-10k'
+        # we want this test to always connect to nghttpx, since it is
+        # the only server we have that supports TLS earlydata
+        port = env.port_for(proto)
+        if proto != 'h3':
+            port = env.nghttpx_https_port
+        url = f'https://{env.domain1}:{port}/{docname}'
+        client = LocalClient(name='cli_hx_download', env=env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        r = client.run(args=[
+             '-n', f'{count}',
+             '-C', env.ca.cert_file,
+             '-e',  # use TLS earlydata
+             '-f',  # forbid reuse of connections
+             '-r', f'{env.domain1}:{port}:127.0.0.1',
+             '-V', proto, url
+        ])
+        r.check_exit_code(0)
+        srcfile = os.path.join(httpd.docs_dir, docname)
+        self.check_downloads(client, srcfile, count)
+        # check that TLS earlydata worked as expected
+        earlydata = {}
+        reused_session = False
+        for line in r.trace_lines:
+            m = re.match(r'^\[t-(\d+)] EarlyData: (-?\d+)', line)
+            if m:
+                earlydata[int(m.group(1))] = int(m.group(2))
+                continue
+            if re.match(r'\[1-1] \* SSL reusing session.*', line):
+                reused_session = True
+        assert reused_session, 'session was not reused for 2nd transfer'
+        assert earlydata[0] == 0, f'{earlydata}'
+        if proto == 'http/1.1':
+            assert earlydata[1] == 111, f'{earlydata}'
+        elif proto == 'h2':
+            assert earlydata[1] == 127, f'{earlydata}'
+        elif proto == 'h3':
+            assert earlydata[1] == 109, f'{earlydata}'
+
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    @pytest.mark.parametrize("max_host_conns", [0, 1, 5])
+    def test_02_33_max_host_conns(self, env: Env, httpd, nghttpx, proto, max_host_conns):
+        if not env.curl_is_debug():
+            pytest.skip('only works for curl debug builds')
+        if not env.curl_is_verbose():
+            pytest.skip('only works for curl with verbose strings')
+        count = 50
+        max_parallel = 50
+        docname = 'data-10k'
+        port = env.port_for(proto)
+        url = f'https://{env.domain1}:{port}/{docname}'
+        run_env = os.environ.copy()
+        run_env['CURL_DEBUG'] = 'multi'
+        client = LocalClient(name='cli_hx_download', env=env, run_env=run_env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        r = client.run(args=[
+             '-n', f'{count}',
+             '-m', f'{max_parallel}',
+             '-C', env.ca.cert_file,
+             '-x',  # always use a fresh connection
+             '-M',  str(max_host_conns),  # limit conns per host
+             '-r', f'{env.domain1}:{port}:127.0.0.1',
+             '-V', proto, url
+        ])
+        r.check_exit_code(0)
+        srcfile = os.path.join(httpd.docs_dir, docname)
+        self.check_downloads(client, srcfile, count)
+        if max_host_conns > 0:
+            matched_lines = 0
+            for line in r.trace_lines:
+                m = re.match(r'.*The cache now contains (\d+) members.*', line)
+                if m:
+                    matched_lines += 1
+                    n = int(m.group(1))
+                    assert n <= max_host_conns
+            assert matched_lines > 0
+
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    @pytest.mark.parametrize("max_total_conns", [0, 1, 5])
+    def test_02_34_max_total_conns(self, env: Env, httpd, nghttpx, proto, max_total_conns):
+        if not env.curl_is_debug():
+            pytest.skip('only works for curl debug builds')
+        if not env.curl_is_verbose():
+            pytest.skip('only works for curl with verbose strings')
+        count = 50
+        max_parallel = 50
+        docname = 'data-10k'
+        port = env.port_for(proto)
+        url = f'https://{env.domain1}:{port}/{docname}'
+        run_env = os.environ.copy()
+        run_env['CURL_DEBUG'] = 'multi'
+        client = LocalClient(name='cli_hx_download', env=env, run_env=run_env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        r = client.run(args=[
+             '-n', f'{count}',
+             '-m', f'{max_parallel}',
+             '-C', env.ca.cert_file,
+             '-x',  # always use a fresh connection
+             '-T',  str(max_total_conns),  # limit total connections
+             '-r', f'{env.domain1}:{port}:127.0.0.1',
+             '-V', proto, url
+        ])
+        r.check_exit_code(0)
+        srcfile = os.path.join(httpd.docs_dir, docname)
+        self.check_downloads(client, srcfile, count)
+        if max_total_conns > 0:
+            matched_lines = 0
+            for line in r.trace_lines:
+                m = re.match(r'.*The cache now contains (\d+) members.*', line)
+                if m:
+                    matched_lines += 1
+                    n = int(m.group(1))
+                    assert n <= max_total_conns
+            assert matched_lines > 0
+
+    # 2 parallel transers, pause and resume. Load a 100 MB zip bomb from
+    # the server with "Content-Encoding: gzip" that gets exloded during
+    # response writing to the client. Client pauses after 1MB unzipped data
+    # and causes buffers to fill while the server sends more response
+    # data.
+    # * http/1.1: not much buffering is done as curl does no longer
+    #   serve the connections that are paused
+    # * h2/h3: server continues sending what the stream window allows and
+    #   since the one connection involved unpaused transfers, data continues
+    #   to be received, requiring buffering.
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_02_35_pause_bomb(self, env: Env, httpd, nghttpx, proto):
+        count = 2
+        pause_offset = 1024 * 1024
+        docname = 'bomb-100m.txt.var'
+        url = f'https://localhost:{env.https_port}/{docname}'
+        client = LocalClient(name='cli_hx_download', env=env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        r = client.run(args=[
+             '-n', f'{count}', '-m', f'{count}',
+             '-P', f'{pause_offset}', '-C', env.ca.cert_file,
+             '-V', proto, url
+        ])
+        r.check_exit_code(0)
+
+    # download with looong urls
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    @pytest.mark.parametrize("url_junk", [1024, 16 * 1024, 32 * 1024, 64 * 1024, 80 * 1024, 96 * 1024])
+    def test_02_36_looong_urls(self, env: Env, httpd, nghttpx, proto, url_junk):
+        if proto == 'h3' and env.curl_uses_lib('quiche'):
+            pytest.skip("quiche fails from 16k onwards")
+        curl = CurlClient(env=env)
+        # 'url' is longer than 'url_len'
+        url = f'https://{env.authority_for(env.domain1, proto)}/data.json?{"x"*(url_junk)}'
+        r = curl.http_download(urls=[url], alpn_proto=proto)
+        if url_junk <= 1024:
+            r.check_exit_code(0)
+            r.check_response(http_status=200)
+        elif url_junk <= 16 * 1024:
+            r.check_exit_code(0)
+            # server replies with 414, Request URL too long
+            r.check_response(http_status=414)
+        elif url_junk <= 32 * 1024:
+            r.check_exit_code(0)
+            # server replies with 414, Request URL too long
+            r.check_response(http_status=414)
+        else:
+            # with urls larger than 64k, behaviour differs
+            if proto == 'http/1.1':
+                r.check_exit_code(0)
+                r.check_response(http_status=414)
+            elif proto == 'h2':
+                # h2 is unable to send such large headers (frame limits)
+                r.check_exit_code(55)
+            elif proto == 'h3':
+                if url_junk <= 64 * 1024:
+                    r.check_exit_code(0)
+                    # nghttpx reports 431 Request Header Field too Large
+                    r.check_response(http_status=431)
+                else:
+                    # nghttpx destroys the connection with internal error
+                    # ERR_QPACK_HEADER_TOO_LARGE
+                    r.check_exit_code(56)
diff --git a/third-party/curl/tests/http/test_03_goaway.py b/third-party/curl/tests/http/test_03_goaway.py
index f9d9263bf5..4c57bf2715 100644
--- a/third-party/curl/tests/http/test_03_goaway.py
+++ b/third-party/curl/tests/http/test_03_goaway.py
@@ -28,34 +28,28 @@ import logging
 import time
 from datetime import timedelta
 from threading import Thread
+
 import pytest
-
-from testenv import Env, CurlClient, ExecResult
-
+from testenv import CurlClient, Env, ExecResult
 
 log = logging.getLogger(__name__)
 
 
 class TestGoAway:
 
-    @pytest.fixture(autouse=True, scope='class')
-    def _class_scope(self, env, httpd, nghttpx):
-        if env.have_h3():
-            nghttpx.start_if_needed()
-        httpd.clear_extra_configs()
-        httpd.reload()
-
     # download files sequentially with delay, reload server for GOAWAY
-    def test_03_01_h2_goaway(self, env: Env, httpd, nghttpx, repeat):
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
+    def test_03_01_h2_goaway(self, env: Env, httpd, nghttpx):
         proto = 'h2'
         count = 3
         self.r = None
+
         def long_run():
             curl = CurlClient(env=env)
             #  send 10 chunks of 1024 bytes in a response body with 100ms delay in between
             urln = f'https://{env.authority_for(env.domain1, proto)}' \
-                   f'/curltest/tweak?id=[0-{count - 1}]'\
-                   '&chunks=10&chunk_size=1024&chunk_delay=100ms'
+                f'/curltest/tweak?id=[0-{count - 1}]'\
+                '&chunks=10&chunk_size=1024&chunk_delay=100ms'
             self.r = curl.http_download(urls=[urln], alpn_proto=proto)
 
         t = Thread(target=long_run)
@@ -76,53 +70,29 @@ class TestGoAway:
         # this should take `count` seconds to retrieve
         assert r.duration >= timedelta(seconds=count)
 
-    # download files sequentially with delay, reload server for GOAWAY
-    @pytest.mark.skipif(condition=not Env.have_h3(), reason="h3 not supported")
-    def test_03_02_h3_goaway(self, env: Env, httpd, nghttpx, repeat):
-        proto = 'h3'
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 stalls here")
-        if proto == 'h3' and env.curl_uses_lib('quiche'):
-            pytest.skip("does not work in CI, but locally for some reason")
-        count = 3
-        self.r = None
-        def long_run():
-            curl = CurlClient(env=env)
-            #  send 10 chunks of 1024 bytes in a response body with 100ms delay in between
-            urln = f'https://{env.authority_for(env.domain1, proto)}' \
-                   f'/curltest/tweak?id=[0-{count - 1}]'\
-                   '&chunks=10&chunk_size=1024&chunk_delay=100ms'
-            self.r = curl.http_download(urls=[urln], alpn_proto=proto)
-
-        t = Thread(target=long_run)
-        t.start()
-        # each request will take a second, reload the server in the middle
-        # of the first one.
-        time.sleep(1.5)
-        assert nghttpx.reload(timeout=timedelta(seconds=2))
-        t.join()
-        r: ExecResult = self.r
-        # this should take `count` seconds to retrieve
-        assert r.duration >= timedelta(seconds=count)
-        r.check_response(count=count, http_status=200, connect_count=2)
-        # reload will shut down the connection gracefully with GOAWAY
-        # we expect to see a second connection opened afterwards
-        for idx, s in enumerate(r.stats):
-            if s['num_connects'] > 0:
-                log.debug(f'request {idx} connected')
+    # We had a test for HTTP/3, same as the ones for h1/h2, where we restart
+    # nghttpx during transfers. This proved to be unreliable. The nature of
+    # UDP makes QUIC streams error (ERR_DRAINGIN, e.g. connection closes)
+    # at possibly any point. We do not retry on requests in all such
+    # situations which made the test fail in CI occasionally. Not good enough.
+    # def test_03_02_h3_goaway(self, env: Env, httpd, nghttpx):
 
     # download files sequentially with delay, reload server for GOAWAY
-    def test_03_03_h1_goaway(self, env: Env, httpd, nghttpx, repeat):
+    def test_03_03_h1_goaway(self, env: Env, httpd, nghttpx):
         proto = 'http/1.1'
         count = 3
         self.r = None
+
         def long_run():
             curl = CurlClient(env=env)
             #  send 10 chunks of 1024 bytes in a response body with 100ms delay in between
+            # pause 2 seconds between requests
             urln = f'https://{env.authority_for(env.domain1, proto)}' \
-                   f'/curltest/tweak?id=[0-{count - 1}]'\
-                   '&chunks=10&chunk_size=1024&chunk_delay=100ms'
-            self.r = curl.http_download(urls=[urln], alpn_proto=proto)
+                f'/curltest/tweak?id=[0-{count - 1}]'\
+                '&chunks=10&chunk_size=1024&chunk_delay=100ms'
+            self.r = curl.http_download(urls=[urln], alpn_proto=proto, extra_args=[
+                '--rate', '30/m',
+            ])
 
         t = Thread(target=long_run)
         t.start()
@@ -133,7 +103,7 @@ class TestGoAway:
         t.join()
         r: ExecResult = self.r
         r.check_response(count=count, http_status=200, connect_count=2)
-        # reload will shut down the connection gracefully with GOAWAY
+        # reload will shut down the connection gracefully
         # we expect to see a second connection opened afterwards
         for idx, s in enumerate(r.stats):
             if s['num_connects'] > 0:
diff --git a/third-party/curl/tests/http/test_04_stuttered.py b/third-party/curl/tests/http/test_04_stuttered.py
index e017a44c3c..1c578e2e9e 100644
--- a/third-party/curl/tests/http/test_04_stuttered.py
+++ b/third-party/curl/tests/http/test_04_stuttered.py
@@ -25,12 +25,10 @@
 ###########################################################################
 #
 import logging
-import os
-from typing import Tuple, List, Dict
+from typing import Dict, List, Tuple
+
 import pytest
-
-from testenv import Env, CurlClient
-
+from testenv import CurlClient, Env
 
 log = logging.getLogger(__name__)
 
@@ -39,42 +37,29 @@ log = logging.getLogger(__name__)
 @pytest.mark.skipif(condition=Env().ci_run, reason="not suitable for CI runs")
 class TestStuttered:
 
-    @pytest.fixture(autouse=True, scope='class')
-    def _class_scope(self, env, httpd, nghttpx):
-        if env.have_h3():
-            nghttpx.start_if_needed()
-        httpd.clear_extra_configs()
-        httpd.reload()
-
     # download 1 file, check that delayed response works in general
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_04_01_download_1(self, env: Env, httpd, nghttpx, repeat,
-                              proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_04_01_download_1(self, env: Env, httpd, nghttpx, proto):
         count = 1
         curl = CurlClient(env=env)
         urln = f'https://{env.authority_for(env.domain1, proto)}' \
-               f'/curltest/tweak?id=[0-{count - 1}]'\
-               '&chunks=100&chunk_size=100&chunk_delay=10ms'
+            f'/curltest/tweak?id=[0-{count - 1}]'\
+            '&chunks=100&chunk_size=100&chunk_delay=10ms'
         r = curl.http_download(urls=[urln], alpn_proto=proto)
         r.check_response(count=1, http_status=200)
 
     # download 50 files in 100 chunks a 100 bytes with 10ms delay between
     # prepend 100 file requests to warm up connection processing limits
     # (Apache2 increases # of parallel processed requests after successes)
-    @pytest.mark.parametrize("proto", ['h2', 'h3'])
-    def test_04_02_100_100_10(self, env: Env,
-                                httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_04_02_100_100_10(self, env: Env, httpd, nghttpx, proto):
         count = 50
         warmups = 100
         curl = CurlClient(env=env)
         url1 = f'https://{env.authority_for(env.domain1, proto)}/data.json?[0-{warmups-1}]'
         urln = f'https://{env.authority_for(env.domain1, proto)}' \
-               f'/curltest/tweak?id=[0-{count-1}]'\
-               '&chunks=100&chunk_size=100&chunk_delay=10ms'
+            f'/curltest/tweak?id=[0-{count-1}]'\
+            '&chunks=100&chunk_size=100&chunk_delay=10ms'
         r = curl.http_download(urls=[url1, urln], alpn_proto=proto,
                                extra_args=['--parallel'])
         r.check_response(count=warmups+count, http_status=200)
@@ -86,17 +71,15 @@ class TestStuttered:
     # download 50 files in 1000 chunks a 10 bytes with 1ms delay between
     # prepend 100 file requests to warm up connection processing limits
     # (Apache2 increases # of parallel processed requests after successes)
-    @pytest.mark.parametrize("proto", ['h2', 'h3'])
-    def test_04_03_1000_10_1(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_04_03_1000_10_1(self, env: Env, httpd, nghttpx, proto):
         count = 50
         warmups = 100
         curl = CurlClient(env=env)
         url1 = f'https://{env.authority_for(env.domain1, proto)}/data.json?[0-{warmups-1}]'
         urln = f'https://{env.authority_for(env.domain1, proto)}' \
-               f'/curltest/tweak?id=[0-{count - 1}]'\
-               '&chunks=1000&chunk_size=10&chunk_delay=100us'
+            f'/curltest/tweak?id=[0-{count - 1}]'\
+            '&chunks=1000&chunk_size=10&chunk_delay=100us'
         r = curl.http_download(urls=[url1, urln], alpn_proto=proto,
                                extra_args=['--parallel'])
         r.check_response(count=warmups+count, http_status=200)
@@ -108,17 +91,15 @@ class TestStuttered:
     # download 50 files in 10000 chunks a 1 byte with 10us delay between
     # prepend 100 file requests to warm up connection processing limits
     # (Apache2 increases # of parallel processed requests after successes)
-    @pytest.mark.parametrize("proto", ['h2', 'h3'])
-    def test_04_04_1000_10_1(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_04_04_1000_10_1(self, env: Env, httpd, nghttpx, proto):
         count = 50
         warmups = 100
         curl = CurlClient(env=env)
         url1 = f'https://{env.authority_for(env.domain1, proto)}/data.json?[0-{warmups-1}]'
         urln = f'https://{env.authority_for(env.domain1, proto)}' \
-               f'/curltest/tweak?id=[0-{count - 1}]'\
-               '&chunks=10000&chunk_size=1&chunk_delay=50us'
+            f'/curltest/tweak?id=[0-{count - 1}]'\
+            '&chunks=10000&chunk_size=1&chunk_delay=50us'
         r = curl.http_download(urls=[url1, urln], alpn_proto=proto,
                                extra_args=['--parallel'])
         r.check_response(count=warmups+count, http_status=200)
diff --git a/third-party/curl/tests/http/test_05_errors.py b/third-party/curl/tests/http/test_05_errors.py
index b59f3f177a..76c12bc8e5 100644
--- a/third-party/curl/tests/http/test_05_errors.py
+++ b/third-party/curl/tests/http/test_05_errors.py
@@ -24,13 +24,13 @@
 #
 ###########################################################################
 #
-import json
 import logging
-from typing import Optional, Tuple, List, Dict
+import os
+import socket
+import threading
+
 import pytest
-
-from testenv import Env, CurlClient, ExecResult
-
+from testenv import CurlClient, Env
 
 log = logging.getLogger(__name__)
 
@@ -39,26 +39,17 @@ log = logging.getLogger(__name__)
                     reason=f"httpd version too old for this: {Env.httpd_version()}")
 class TestErrors:
 
-    @pytest.fixture(autouse=True, scope='class')
-    def _class_scope(self, env, httpd, nghttpx):
-        if env.have_h3():
-            nghttpx.start_if_needed()
-        httpd.clear_extra_configs()
-        httpd.reload()
-
     # download 1 file, check that we get CURLE_PARTIAL_FILE
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_05_01_partial_1(self, env: Env, httpd, nghttpx, repeat,
-                              proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 stalls here")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_05_01_partial_1(self, env: Env, httpd, nghttpx, proto):
+        if proto == 'h3' and env.curl_uses_lib('quiche') and \
+                not env.curl_lib_version_at_least('quiche', '0.29.0'):
+            pytest.skip("quiche issue #2277 not fixed")
         count = 1
         curl = CurlClient(env=env)
         urln = f'https://{env.authority_for(env.domain1, proto)}' \
-               f'/curltest/tweak?id=[0-{count - 1}]'\
-               '&chunks=3&chunk_size=16000&body_error=reset'
+            f'/curltest/tweak?id=[0-{count - 1}]'\
+            '&chunks=3&chunk_size=16000&body_error=reset'
         r = curl.http_download(urls=[urln], alpn_proto=proto, extra_args=[
             '--retry', '0'
         ])
@@ -70,18 +61,16 @@ class TestErrors:
         assert len(invalid_stats) == 0, f'failed: {invalid_stats}'
 
     # download files, check that we get CURLE_PARTIAL_FILE for all
-    @pytest.mark.parametrize("proto", ['h2', 'h3'])
-    def test_05_02_partial_20(self, env: Env, httpd, nghttpx, repeat,
-                              proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 stalls here")
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_05_02_partial_20(self, env: Env, httpd, nghttpx, proto):
+        if proto == 'h3' and env.curl_uses_lib('quiche') and \
+                not env.curl_lib_version_at_least('quiche', '0.29.0'):
+            pytest.skip("quiche issue #2277 not fixed")
         count = 20
         curl = CurlClient(env=env)
         urln = f'https://{env.authority_for(env.domain1, proto)}' \
-               f'/curltest/tweak?id=[0-{count - 1}]'\
-               '&chunks=5&chunk_size=16000&body_error=reset'
+            f'/curltest/tweak?id=[0-{count - 1}]'\
+            '&chunks=5&chunk_size=16000&body_error=reset'
         r = curl.http_download(urls=[urln], alpn_proto=proto, extra_args=[
             '--retry', '0', '--parallel',
         ])
@@ -90,11 +79,12 @@ class TestErrors:
         invalid_stats = []
         for idx, s in enumerate(r.stats):
             if 'exitcode' not in s or s['exitcode'] not in [18, 55, 56, 92, 95]:
-                invalid_stats.append(f'request {idx} exit with {s["exitcode"]}\n{s}')
-        assert len(invalid_stats) == 0, f'failed: {invalid_stats}'
+                invalid_stats.append(f'request {idx} exit with {s["exitcode"]}\n{r.dump_logs()}')
+        assert len(invalid_stats) == 0, f'failed: {invalid_stats}\n{r.dump_logs()}'
 
     # access a resource that, on h2, RST the stream with HTTP_1_1_REQUIRED
-    def test_05_03_required(self, env: Env, httpd, nghttpx, repeat):
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
+    def test_05_03_required(self, env: Env, httpd, nghttpx):
         curl = CurlClient(env=env)
         proto = 'http/1.1'
         urln = f'https://{env.authority_for(env.domain1, proto)}/curltest/1_1'
@@ -108,3 +98,134 @@ class TestErrors:
         r.check_response(http_status=200, count=1)
         # check that we did a downgrade
         assert r.stats[0]['http_version'] == '1.1', r.dump_logs()
+
+    # On the URL used here, Apache is doing an "unclean" TLS shutdown,
+    # meaning it sends no shutdown notice and closes TCP.
+    # The HTTP response delivers a body without Content-Length. We expect:
+    # - http/1.0 to fail since it relies on a clean connection close to
+    #   detect the end of the body
+    # - http/1.1 to work since it will used "chunked" transfer encoding
+    #   and stop receiving when that signals the end
+    # - h2 to work since it will signal the end of the response before
+    #   and not see the "unclean" close either
+    @pytest.mark.parametrize("proto", ['http/1.0', 'http/1.1', 'h2'])
+    def test_05_04_unclean_tls_shutdown(self, env: Env, httpd, nghttpx, proto):
+        if proto == 'h2' and not env.have_h2_curl():
+            pytest.skip("h2 not supported")
+        if proto == 'h3' and not env.have_h3():
+            pytest.skip("h3 not supported")
+        count = 10 if proto == 'h2' else 1
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}'\
+            f'/curltest/shutdown_unclean?id=[0-{count-1}]&chunks=4'
+        r = curl.http_download(urls=[url], alpn_proto=proto, extra_args=[
+            '--parallel', '--trace-config', 'ssl'
+        ])
+        if proto == 'http/1.0':
+            # we are inconsistent if we fail or not in missing TLS shutdown
+            # openssl code ignore such errors intentionally in non-debug builds
+            r.check_exit_code(56)
+        else:
+            r.check_exit_code(0)
+            r.check_response(http_status=200, count=count)
+
+    # Make a connect with a fail for '::1' and wrong certificate for '127.0.0.1'
+    # The error message reported needs to be from the certificate.
+    # verifies issue #20608
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    def test_05_05_failed_peer(self, env: Env, proto, httpd, nghttpx):
+        domain = f'invalid.{env.tld}'
+        url = f'https://{domain}:{env.port_for(proto)}/'
+        run_env = os.environ.copy()
+        run_env['CURL_DBG_SOCK_FAIL_IPV6'] = '1'
+        curl = CurlClient(env=env, run_env=run_env)
+        r = curl.http_download(urls=[url], alpn_proto=proto, extra_args=[
+            '--resolve', f'{domain}:{env.port_for(proto)}:::1,127.0.0.1',
+        ])
+        assert r.exit_code == 60, f'{r}'
+        assert r.stats[0]['errormsg'] != 'CURL_DBG_SOCK_FAIL_IPV6: failed to open socket'
+
+    # Get, retry on 502
+    def test_05_06_retry_502(self, env: Env, httpd, nghttpx):
+        proto = 'http/1.1'
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/tweak?status=502'
+        r = curl.http_download(urls=[url], alpn_proto=proto, extra_args=[
+            '--retry', '2', '--retry-all-errors', '--retry-delay', '1',
+        ])
+        r.check_response(http_status=502)
+        assert r.stats[0]['num_retries'] == 2, f'{r}'
+        # curious, since curl does the retries, it finds the previous
+        # connection in the cache and reports that no connects were done
+        assert r.stats[0]['num_connects'] == 0, f'{r}'
+
+    # Get, retry on 502 in parallel mode
+    def test_05_07_retry_502_parallel(self, env: Env, httpd, nghttpx):
+        proto = 'http/1.1'
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/tweak?status=502'
+        r = curl.http_download(urls=[url], alpn_proto=proto, extra_args=[
+            '--retry', '2', '--retry-all-errors', '--retry-delay', '1', '--parallel'
+        ])
+        r.check_response(http_status=502)
+        assert r.stats[0]['num_retries'] == 2, f'{r}'
+
+    # Get, retry on 401, not happening
+    def test_05_08_retry_401(self, env: Env, httpd, nghttpx):
+        proto = 'http/1.1'
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/tweak?status=401'
+        r = curl.http_download(urls=[url], alpn_proto=proto, extra_args=[
+            '--retry', '2', '--retry-all-errors', '--retry-delay', '1'
+        ])
+        r.check_response(http_status=401)
+        # No retries on a 401
+        assert r.stats[0]['num_retries'] == 0, f'{r}'
+
+    # Server closes the connection immediately after accept,
+    def test_05_09_handshake_eof(self, env: Env):
+        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as server:
+            server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+            server.bind(('127.0.0.1', 0))
+            server.listen(1)
+            port = server.getsockname()[1]
+
+            # accept one connection and immediately close it
+            def accept_and_close():
+                try:
+                    conn, _ = server.accept()
+                    conn.recv(1)  # wait for ClientHello
+                    conn.close()
+                except Exception:
+                    # ignore expected socket error
+                    pass
+
+            t = threading.Thread(target=accept_and_close)
+            t.start()
+
+            run_env = os.environ.copy()
+            run_env['CURL_DEBUG'] = 'all'
+            curl = CurlClient(env=env, timeout=env.test_timeout, run_env=run_env)
+            url = f'https://127.0.0.1:{port}/'
+            r = curl.run_direct(args=[url, '--insecure', '-v'])
+
+            t.join(timeout=10)
+
+        # We expect an error code, not success (0) and not timeout (-1)
+        # Expected error codes are:
+        # - CURLE_SSL_CONNECT_ERROR (35) - common for handshake failures
+        # - CURLE_RECV_ERROR (56) - some TLS backends fail with that
+        assert r.exit_code in [35, 56], \
+            f'unexpected error {r.exit_code}\n{r.dump_logs()}'
+
+    # Get a resource many times with limited requests
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason='curl without HTTP/2')
+    def test_05_10_limits(self, env: Env, httpd):
+        proto = 'h2'
+        count = 6
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/limit?id=[0-{count-1}]'
+        r = curl.http_download(urls=[url], alpn_proto=proto, extra_args=[
+            '--parallel', '--retry', '5'
+        ])
+        r.check_stats(count=count, http_status=200, exitcode=0)
diff --git a/third-party/curl/tests/http/test_06_eyeballs.py b/third-party/curl/tests/http/test_06_eyeballs.py
index 8a93440c59..a423524fa5 100644
--- a/third-party/curl/tests/http/test_06_eyeballs.py
+++ b/third-party/curl/tests/http/test_06_eyeballs.py
@@ -24,29 +24,20 @@
 #
 ###########################################################################
 #
-import json
 import logging
-from typing import Optional, Tuple, List, Dict
+import re
+
 import pytest
-
-from testenv import Env, CurlClient, ExecResult
-
+from testenv import CurlClient, Env
 
 log = logging.getLogger(__name__)
 
 
 class TestEyeballs:
 
-    @pytest.fixture(autouse=True, scope='class')
-    def _class_scope(self, env, httpd, nghttpx):
-        if env.have_h3():
-            nghttpx.start_if_needed()
-        httpd.clear_extra_configs()
-        httpd.reload()
-
     # download using only HTTP/3 on working server
-    @pytest.mark.skipif(condition=not Env.have_h3(), reason=f"missing HTTP/3 support")
-    def test_06_01_h3_only(self, env: Env, httpd, nghttpx, repeat):
+    @pytest.mark.skipif(condition=not Env.have_h3(), reason="missing HTTP/3 support")
+    def test_06_01_h3_only(self, env: Env, httpd, nghttpx):
         curl = CurlClient(env=env)
         urln = f'https://{env.authority_for(env.domain1, "h3")}/data.json'
         r = curl.http_download(urls=[urln], extra_args=['--http3-only'])
@@ -54,36 +45,33 @@ class TestEyeballs:
         assert r.stats[0]['http_version'] == '3'
 
     # download using only HTTP/3 on missing server
-    @pytest.mark.skipif(condition=not Env.have_h3(), reason=f"missing HTTP/3 support")
-    def test_06_02_h3_only(self, env: Env, httpd, nghttpx, repeat):
-        nghttpx.stop_if_running()
+    @pytest.mark.skipif(condition=not Env.have_h3(), reason="missing HTTP/3 support")
+    def test_06_02_h3_only(self, env: Env, httpd, nghttpx):
         curl = CurlClient(env=env)
-        urln = f'https://{env.authority_for(env.domain1, "h3")}/data.json'
+        urln = f'https://{env.domain1}:{env.https_only_tcp_port}/data.json'
         r = curl.http_download(urls=[urln], extra_args=['--http3-only'])
         r.check_response(exitcode=7, http_status=None)
 
     # download using HTTP/3 on missing server with fallback on h2
-    @pytest.mark.skipif(condition=not Env.have_h3(), reason=f"missing HTTP/3 support")
-    def test_06_03_h3_fallback_h2(self, env: Env, httpd, nghttpx, repeat):
-        nghttpx.stop_if_running()
+    @pytest.mark.skipif(condition=not Env.have_h3(), reason="missing HTTP/3 support")
+    def test_06_03_h3_fallback_h2(self, env: Env, httpd, nghttpx):
         curl = CurlClient(env=env)
-        urln = f'https://{env.authority_for(env.domain1, "h3")}/data.json'
+        urln = f'https://{env.domain1}:{env.https_only_tcp_port}/data.json'
         r = curl.http_download(urls=[urln], extra_args=['--http3'])
         r.check_response(count=1, http_status=200)
         assert r.stats[0]['http_version'] == '2'
 
     # download using HTTP/3 on missing server with fallback on http/1.1
-    @pytest.mark.skipif(condition=not Env.have_h3(), reason=f"missing HTTP/3 support")
-    def test_06_04_h3_fallback_h1(self, env: Env, httpd, nghttpx, repeat):
-        nghttpx.stop_if_running()
+    @pytest.mark.skipif(condition=not Env.have_h3(), reason="missing HTTP/3 support")
+    def test_06_04_h3_fallback_h1(self, env: Env, httpd, nghttpx):
         curl = CurlClient(env=env)
-        urln = f'https://{env.authority_for(env.domain2, "h3")}/data.json'
+        urln = f'https://{env.domain2}:{env.https_only_tcp_port}/data.json'
         r = curl.http_download(urls=[urln], extra_args=['--http3'])
         r.check_response(count=1, http_status=200)
         assert r.stats[0]['http_version'] == '1.1'
 
     # make a successful https: transfer and observer the timer stats
-    def test_06_10_stats_success(self, env: Env, httpd, nghttpx, repeat):
+    def test_06_10_stats_success(self, env: Env, httpd, nghttpx):
         curl = CurlClient(env=env)
         urln = f'https://{env.authority_for(env.domain1, "h2")}/data.json'
         r = curl.http_download(urls=[urln])
@@ -92,7 +80,7 @@ class TestEyeballs:
         assert r.stats[0]['time_appconnect'] > 0.0
 
     # make https: to a hostname that tcp connects, but will not verify
-    def test_06_11_stats_fail_verify(self, env: Env, httpd, nghttpx, repeat):
+    def test_06_11_stats_fail_verify(self, env: Env, httpd, nghttpx):
         curl = CurlClient(env=env)
         urln = f'https://not-valid.com:{env.https_port}/data.json'
         r = curl.http_download(urls=[urln], extra_args=[
@@ -103,12 +91,139 @@ class TestEyeballs:
         assert r.stats[0]['time_appconnect'] == 0  # but not SSL verified
 
     # make https: to an invalid address
-    def test_06_12_stats_fail_tcp(self, env: Env, httpd, nghttpx, repeat):
+    def test_06_12_stats_fail_tcp(self, env: Env, httpd, nghttpx):
         curl = CurlClient(env=env)
-        urln = f'https://not-valid.com:1/data.json'
+        urln = 'https://not-valid.com:1/data.json'
         r = curl.http_download(urls=[urln], extra_args=[
             '--resolve', f'not-valid.com:{1}:127.0.0.1'
         ])
         r.check_response(count=1, http_status=None, exitcode=False)
         assert r.stats[0]['time_connect'] == 0     # no one should have listened
         assert r.stats[0]['time_appconnect'] == 0  # did not happen either
+
+    # check timers when trying 3 unresponsive addresses
+    @pytest.mark.skipif(condition=not Env.curl_has_feature('IPv6'),
+                        reason='curl lacks ipv6 support')
+    @pytest.mark.skipif(condition=not Env.curl_has_feature('AsynchDNS'),
+                        reason='curl lacks async DNS support')
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
+    def test_06_13_timers(self, env: Env):
+        curl = CurlClient(env=env)
+        # ipv6 0100::/64 is supposed to go into the void (rfc6666)
+        r = curl.http_download(urls=['https://xxx.invalid/'], extra_args=[
+            '--resolve', 'xxx.invalid:443:0100::1,0100::2,0100::3',
+            '--connect-timeout', '1',
+            '--happy-eyeballs-timeout-ms', '123',
+            '--trace-config', 'timer,happy-eyeballs,tcp'
+        ])
+        r.check_response(count=1, http_status=None, exitcode=False)
+        assert r.stats[0]['time_connect'] == 0     # no one connected
+        # check that we indeed started attempts on all 3 addresses
+        tcp_attempts = [line for line in r.trace_lines
+                         if re.match(r'.*Trying \[100::[123]]:443', line)]
+        assert len(tcp_attempts) == 3, f'fond: {"".join(tcp_attempts)}\n{r.dump_logs()}'
+        # if the 0100::/64 really goes into the void, we should see 2 HAPPY_EYEBALLS
+        # timeouts being set here
+        failed_attempts = [line for line in r.trace_lines
+                           if re.match(r'.*checked connect attempts: 0 ongoing', line)]
+        if len(failed_attempts):
+            # github CI fails right away with "Network is unreachable", slackers...
+            assert len(failed_attempts) == 3, f'found: {"".join(failed_attempts)}\n{r.dump_logs()}'
+        else:
+            # no immediately failed attempts, as should be
+            he_timers_set = [line for line in r.trace_lines
+                             if re.match(r'.*\[TIMER] \[HAPPY_EYEBALLS] set for', line)]
+            assert len(he_timers_set) == 2, f'found: {"".join(he_timers_set)}\n{r.dump_logs()}'
+
+    # download using HTTP/3 on missing server with alt-svc pointing there
+    @pytest.mark.skipif(condition=not Env.have_h3(), reason="missing HTTP/3 support")
+    def test_06_20_h2_altsvc_h3_fallback(self, env: Env, httpd, nghttpx):
+        curl = CurlClient(env=env)
+        urln = f'https://{env.domain1}:{env.https_only_tcp_port}/data.json'
+        altsvc_file = curl.mk_altsvc_file('test_06',
+                                          'h2', env.domain1, env.https_only_tcp_port,
+                                          'h3', env.domain1, env.https_only_tcp_port)
+        r = curl.http_download(urls=[urln], extra_args=[
+            '--alt-svc', altsvc_file
+        ])
+        # Should try a QUIC connection that fails and fallback to h2
+        r.check_exit_code(0)
+        r.check_response(count=1, http_status=200)
+        assert r.stats[0]['http_version'] == '2'
+
+    @pytest.mark.skipif(condition=not Env.have_h3(), reason="h3 not supported")
+    def test_06_21_as_follow_h3h1(self, env: Env, httpd, configures_httpd, nghttpx):
+        # With '--http3` an Alt-Svc redirection from h3 to h1 is allowed
+        # write an alt-svc file the advises h1 instead of h3
+        curl = CurlClient(env=env)
+        asfile = curl.mk_altsvc_file('test_12',
+                                     'h3', env.domain1, env.https_only_tcp_port,
+                                     'http/1.1', env.domain1, env.https_only_tcp_port)
+        urln = f'https://{env.domain1}:{env.https_only_tcp_port}/data.json'
+        r = curl.http_download(urls=[urln], with_stats=True, extra_args=[
+            '--alt-svc', f'{asfile}', '--http3'
+        ])
+        r.check_response(count=1, http_status=200)
+        # We expect the connection to use HTTP/1.1
+        assert r.total_connects == 1, f'{r.dump_logs()}'
+        assert r.stats[0]['http_version'] == '1.1', f'{r}'
+
+    @pytest.mark.skipif(condition=not Env.have_h3(), reason="h3 not supported")
+    def test_06_22_as_ignore_h3h1(self, env: Env, httpd, configures_httpd, nghttpx):
+        # With '--http3-only` an Alt-Svc redirection from h3 to h1 is ignored
+        # write an alt-svc file the advises h1 instead of h3
+        curl = CurlClient(env=env)
+        asfile = curl.mk_altsvc_file('test_12',
+                                     'h3', env.domain1, env.https_port,
+                                     'http/1.1', env.domain1, env.https_port)
+        urln = f'https://{env.authority_for(env.domain1, "h3")}/data.json'
+        r = curl.http_download(urls=[urln], with_stats=True, extra_args=[
+            '--alt-svc', f'{asfile}', '--http3-only'
+        ])
+        r.check_response(count=1, http_status=200)
+        # We expect the connection to be stay on h3, since we used --http3-only
+        assert r.total_connects == 1
+        assert r.stats[0]['http_version'] == '3', f'{r.stats}'
+
+    @pytest.mark.skipif(condition=not Env.have_h3(), reason="h3 not supported")
+    def test_06_23_as_ignore_h2h3(self, env: Env, httpd, configures_httpd, nghttpx):
+        # With '--http2` an Alt-Svc redirection from h2 to h3 is ignored
+        # write an alt-svc file that advises h3 instead of h2
+        curl = CurlClient(env=env)
+        asfile = curl.mk_altsvc_file('test_12',
+                                     'h2', env.domain1, env.https_port,
+                                     'h3', env.domain1, env.h3_port)
+        urln = f'https://{env.authority_for(env.domain1, "h2")}/data.json'
+        r = curl.http_download(urls=[urln], with_stats=True, extra_args=[
+            '--alt-svc', f'{asfile}', '--http2'
+        ])
+        r.check_response(count=1, http_status=200)
+        assert r.stats[0]['http_version'] == '2', f'{r.stats}'
+
+    # download using HTTP/3 on available server with alt-svc to h2, use h2
+    @pytest.mark.skipif(condition=not Env.have_h3(), reason="missing HTTP/3 support")
+    def test_06_24_h3_altsvc_h2_used(self, env: Env, httpd, nghttpx):
+        curl = CurlClient(env=env)
+        urln = f'https://{env.domain1}:{env.https_only_tcp_port}/data.json'
+        altsvc_file = curl.mk_altsvc_file('test_12',
+                                          'h3', env.domain1, env.https_only_tcp_port,
+                                          'h2', env.domain1, env.https_only_tcp_port)
+        r = curl.http_download(urls=[urln], extra_args=[
+            '--http3', '--alt-svc', altsvc_file
+        ])
+        r.check_exit_code(0)
+        r.check_response(count=1, http_status=200)
+        assert r.stats[0]['http_version'] == '2'
+
+    # h3 download using --connect-to IPv6 address
+    @pytest.mark.skipif(condition=not Env.have_h3(), reason="missing HTTP/3 support")
+    @pytest.mark.skipif(condition=not Env.curl_has_feature('IPv6'), reason="no IPv6")
+    def test_06_25_h3_connect_to(self, env: Env, httpd, nghttpx):
+        curl = CurlClient(env=env, force_resolv=False)
+        urln = f'https://{env.authority_for(env.domain1, "h3")}/data.json'
+        r = curl.http_download(urls=[urln], extra_args=[
+            '--http3-only', '--connect-to',
+            f'{env.authority_for(env.domain1, "h3")}:[::1]:{env.https_port}'
+        ])
+        r.check_response(count=1, http_status=200)
+        assert r.stats[0]['http_version'] == '3'
diff --git a/third-party/curl/tests/http/test_07_upload.py b/third-party/curl/tests/http/test_07_upload.py
index 5aee3ea266..6cb4d943e1 100644
--- a/third-party/curl/tests/http/test_07_upload.py
+++ b/third-party/curl/tests/http/test_07_upload.py
@@ -28,10 +28,12 @@ import difflib
 import filecmp
 import logging
 import os
+import re
+import sys
+from typing import List, Union
+
 import pytest
-
-from testenv import Env, CurlClient
-
+from testenv import CurlClient, Env, ExecResult, LocalClient
 
 log = logging.getLogger(__name__)
 
@@ -40,72 +42,57 @@ class TestUpload:
 
     @pytest.fixture(autouse=True, scope='class')
     def _class_scope(self, env, httpd, nghttpx):
-        if env.have_h3():
-            nghttpx.start_if_needed()
-        env.make_data_file(indir=env.gen_dir, fname="data-63k", fsize=63*1024)
-        env.make_data_file(indir=env.gen_dir, fname="data-64k", fsize=64*1024)
-        env.make_data_file(indir=env.gen_dir, fname="data-100k", fsize=100*1024)
-        env.make_data_file(indir=env.gen_dir, fname="data-10m", fsize=10*1024*1024)
-        httpd.clear_extra_configs()
-        httpd.reload()
+        env.make_data_file(indir=env.gen_dir, fname="data-10k", fsize=10 * 1024)
+        env.make_data_file(indir=env.gen_dir, fname="data-63k", fsize=63 * 1024)
+        env.make_data_file(indir=env.gen_dir, fname="data-64k", fsize=64 * 1024)
+        env.make_data_file(indir=env.gen_dir, fname="data-100k", fsize=100 * 1024)
+        env.make_data_file(indir=env.gen_dir, fname="data-1m+", fsize=(1024 * 1024) + 1)
+        env.make_data_file(indir=env.gen_dir, fname="data-10m", fsize=10 * 1024 * 1024)
 
     # upload small data, check that this is what was echoed
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_07_01_upload_1_small(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 fails here")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_01_upload_1_small(self, env: Env, httpd, nghttpx, proto):
         data = '0123456789'
         curl = CurlClient(env=env)
         url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=[0-0]'
         r = curl.http_upload(urls=[url], data=data, alpn_proto=proto)
         r.check_stats(count=1, http_status=200, exitcode=0)
-        respdata = open(curl.response_file(0)).readlines()
+        with open(curl.response_file(0)) as fr:
+            respdata = fr.readlines()
         assert respdata == [data]
 
     # upload large data, check that this is what was echoed
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_07_02_upload_1_large(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 fails here")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_02_upload_1_large(self, env: Env, httpd, nghttpx, proto):
         fdata = os.path.join(env.gen_dir, 'data-100k')
         curl = CurlClient(env=env)
         url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=[0-0]'
         r = curl.http_upload(urls=[url], data=f'@{fdata}', alpn_proto=proto)
         r.check_stats(count=1, http_status=200, exitcode=0)
-        indata = open(fdata).readlines()
-        respdata = open(curl.response_file(0)).readlines()
+        with open(fdata) as fi, open(curl.response_file(0)) as fr:
+            indata = fi.readlines()
+            respdata = fr.readlines()
         assert respdata == indata
 
     # upload data sequentially, check that they were echoed
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_07_10_upload_sequential(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 stalls here")
-        count = 50
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_10_upload_sequential(self, env: Env, httpd, nghttpx, proto):
+        count = 20
         data = '0123456789'
         curl = CurlClient(env=env)
         url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=[0-{count-1}]'
         r = curl.http_upload(urls=[url], data=data, alpn_proto=proto)
         r.check_stats(count=count, http_status=200, exitcode=0)
         for i in range(count):
-            respdata = open(curl.response_file(i)).readlines()
+            with open(curl.response_file(i)) as fr:
+                respdata = fr.readlines()
             assert respdata == [data]
 
     # upload data parallel, check that they were echoed
-    @pytest.mark.parametrize("proto", ['h2', 'h3'])
-    def test_07_11_upload_parallel(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 stalls here")
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_07_11_upload_parallel(self, env: Env, httpd, nghttpx, proto):
         # limit since we use a separate connection in h1
-        count = 50
+        count = 20
         data = '0123456789'
         curl = CurlClient(env=env)
         url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=[0-{count-1}]'
@@ -113,55 +100,106 @@ class TestUpload:
                              extra_args=['--parallel'])
         r.check_stats(count=count, http_status=200, exitcode=0)
         for i in range(count):
-            respdata = open(curl.response_file(i)).readlines()
+            with open(curl.response_file(i)) as fr:
+                respdata = fr.readlines()
             assert respdata == [data]
 
     # upload large data sequentially, check that this is what was echoed
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_07_12_upload_seq_large(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 stalls here")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_12_upload_seq_large(self, env: Env, httpd, nghttpx, proto):
         fdata = os.path.join(env.gen_dir, 'data-100k')
-        count = 50
+        count = 10
         curl = CurlClient(env=env)
         url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=[0-{count-1}]'
         r = curl.http_upload(urls=[url], data=f'@{fdata}', alpn_proto=proto)
         r.check_response(count=count, http_status=200)
-        indata = open(fdata).readlines()
+        with open(fdata) as fi:
+            indata = fi.readlines()
         r.check_stats(count=count, http_status=200, exitcode=0)
         for i in range(count):
-            respdata = open(curl.response_file(i)).readlines()
+            with open(curl.response_file(i)) as fr:
+                respdata = fr.readlines()
             assert respdata == indata
 
     # upload very large data sequentially, check that this is what was echoed
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_07_13_upload_seq_large(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 stalls here")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_13_upload_seq_large(self, env: Env, httpd, nghttpx, proto):
         fdata = os.path.join(env.gen_dir, 'data-10m')
         count = 2
         curl = CurlClient(env=env)
         url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=[0-{count-1}]'
         r = curl.http_upload(urls=[url], data=f'@{fdata}', alpn_proto=proto)
         r.check_stats(count=count, http_status=200, exitcode=0)
-        indata = open(fdata).readlines()
+        with open(fdata) as fi:
+            indata = fi.readlines()
         for i in range(count):
-            respdata = open(curl.response_file(i)).readlines()
+            with open(curl.response_file(i)) as fr:
+                respdata = fr.readlines()
             assert respdata == indata
 
+    # upload from stdin, issue #14870
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    @pytest.mark.parametrize("indata", [
+        '', '1', '123\n456andsomething\n\n'
+    ])
+    def test_07_14_upload_stdin(self, env: Env, httpd, nghttpx, proto, indata):
+        count = 1
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/put?id=[0-{count-1}]'
+        r = curl.http_put(urls=[url], data=indata, alpn_proto=proto)
+        r.check_stats(count=count, http_status=200, exitcode=0)
+        for i in range(count):
+            with open(curl.response_file(i)) as fr:
+                respdata = fr.readlines()
+            assert respdata == [f'{len(indata)}']
+
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_15_hx_put(self, env: Env, httpd, nghttpx, proto):
+        count = 2
+        upload_size = 128 * 1024
+        url = f'https://localhost:{env.https_port}/curltest/put'
+        client = LocalClient(name='cli_hx_upload', env=env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        r = client.run(args=[
+             '-n', f'{count}', '-S', f'{upload_size}', '-V', proto, url
+        ])
+        r.check_exit_code(0)
+        self.check_downloads(client, r, [f"{upload_size}"], count)
+
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_16_hx_put_reuse(self, env: Env, httpd, nghttpx, proto):
+        count = 2
+        upload_size = 128 * 1024
+        url = f'https://localhost:{env.https_port}/curltest/put'
+        client = LocalClient(name='cli_hx_upload', env=env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        r = client.run(args=[
+             '-n', f'{count}', '-S', f'{upload_size}', '-R', '-V', proto, url
+        ])
+        r.check_exit_code(0)
+        self.check_downloads(client, r, [f"{upload_size}"], count)
+
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_17_hx_post_reuse(self, env: Env, httpd, nghttpx, proto):
+        count = 2
+        upload_size = 128 * 1024
+        url = f'https://localhost:{env.https_port}/curltest/echo'
+        client = LocalClient(name='cli_hx_upload', env=env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        r = client.run(args=[
+             '-n', f'{count}', '-M', 'POST', '-S', f'{upload_size}', '-R', '-V', proto, url
+        ])
+        r.check_exit_code(0)
+        self.check_downloads(client, r, ["x" * upload_size], count)
+
     # upload data parallel, check that they were echoed
-    @pytest.mark.parametrize("proto", ['h2', 'h3'])
-    def test_07_20_upload_parallel(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 stalls here")
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_07_20_upload_parallel(self, env: Env, httpd, nghttpx, proto):
         # limit since we use a separate connection in h1
-        count = 50
+        count = 10
         data = '0123456789'
         curl = CurlClient(env=env)
         url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=[0-{count-1}]'
@@ -169,73 +207,76 @@ class TestUpload:
                              extra_args=['--parallel'])
         r.check_stats(count=count, http_status=200, exitcode=0)
         for i in range(count):
-            respdata = open(curl.response_file(i)).readlines()
+            with open(curl.response_file(i)) as fr:
+                respdata = fr.readlines()
             assert respdata == [data]
 
     # upload large data parallel, check that this is what was echoed
-    @pytest.mark.parametrize("proto", ['h2', 'h3'])
-    def test_07_21_upload_parallel_large(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 stalls here")
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_07_21_upload_parallel_large(self, env: Env, httpd, nghttpx, proto):
         fdata = os.path.join(env.gen_dir, 'data-100k')
         # limit since we use a separate connection in h1
-        count = 50
+        count = 10
         curl = CurlClient(env=env)
         url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=[0-{count-1}]'
         r = curl.http_upload(urls=[url], data=f'@{fdata}', alpn_proto=proto,
                              extra_args=['--parallel'])
         r.check_response(count=count, http_status=200)
-        self.check_download(count, fdata, curl)
+        self.check_download(r, count, fdata, curl)
+
+    # upload single large data to a URL that fails uploads, causing RESETs
+    # We used to test h3 as well, but this is unreliable in CI with nghttpx
+    # not reporting a RESET sometimes.
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    def test_07_22_upload_fail(self, env: Env, httpd, nghttpx, proto):
+        fdata = os.path.join(env.gen_dir, 'data-10m')
+        count = 1
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}'\
+            f'/curltest/tweak?status=200&delay=5ms&chunks=1&body_error=reset&id=[0-{count-1}]'
+        r = curl.http_upload(urls=[url], data=f'@{fdata}', alpn_proto=proto,
+                             extra_args=['--parallel'])
+        # depending on timing and protocol, we might get CURLE_PARTIAL_FILE or
+        # CURLE_SEND_ERROR or CURLE_HTTP3 or CURLE_HTTP2_STREAM
+        r.check_stats(count=count, exitcode=[18, 55, 56, 92, 95])
 
     # PUT 100k
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_07_30_put_100k(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 fails here")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_30_put_100k(self, env: Env, httpd, nghttpx, proto):
         fdata = os.path.join(env.gen_dir, 'data-100k')
         count = 1
         curl = CurlClient(env=env)
         url = f'https://{env.authority_for(env.domain1, proto)}/curltest/put?id=[0-{count-1}]'
         r = curl.http_put(urls=[url], fdata=fdata, alpn_proto=proto,
-                             extra_args=['--parallel'])
+                          extra_args=['--parallel'])
         r.check_stats(count=count, http_status=200, exitcode=0)
         exp_data = [f'{os.path.getsize(fdata)}']
         r.check_response(count=count, http_status=200)
         for i in range(count):
-            respdata = open(curl.response_file(i)).readlines()
+            with open(curl.response_file(i)) as fr:
+                respdata = fr.readlines()
             assert respdata == exp_data
 
     # PUT 10m
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_07_31_put_10m(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 fails here")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_31_put_10m(self, env: Env, httpd, nghttpx, proto):
         fdata = os.path.join(env.gen_dir, 'data-10m')
         count = 1
         curl = CurlClient(env=env)
-        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/put?id=[0-{count-1}]&chunk_delay=10ms'
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/put?id=[0-{count-1}]&chunk_delay=2ms'
         r = curl.http_put(urls=[url], fdata=fdata, alpn_proto=proto,
-                             extra_args=['--parallel'])
+                          extra_args=['--parallel'])
         r.check_stats(count=count, http_status=200, exitcode=0)
         exp_data = [f'{os.path.getsize(fdata)}']
         r.check_response(count=count, http_status=200)
         for i in range(count):
-            respdata = open(curl.response_file(i)).readlines()
+            with open(curl.response_file(i)) as fr:
+                respdata = fr.readlines()
             assert respdata == exp_data
 
     # issue #10591
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_07_32_issue_10591(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 fails here")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_32_issue_10591(self, env: Env, httpd, nghttpx, proto):
         fdata = os.path.join(env.gen_dir, 'data-10m')
         count = 1
         curl = CurlClient(env=env)
@@ -245,7 +286,8 @@ class TestUpload:
 
     # issue #11157, upload that is 404'ed by server, needs to terminate
     # correctly and not time out on sending
-    def test_07_33_issue_11157a(self, env: Env, httpd, nghttpx, repeat):
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
+    def test_07_33_issue_11157a(self, env: Env, httpd, nghttpx):
         proto = 'h2'
         fdata = os.path.join(env.gen_dir, 'data-10m')
         # send a POST to our PUT handler which will send immediately a 404 back
@@ -266,7 +308,8 @@ class TestUpload:
         r.check_stats(1, 404)
 
     # issue #11157, send upload that is slowly read in
-    def test_07_33_issue_11157b(self, env: Env, httpd, nghttpx, repeat):
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
+    def test_07_33_issue_11157b(self, env: Env, httpd, nghttpx):
         proto = 'h2'
         fdata = os.path.join(env.gen_dir, 'data-10m')
         # tell our test PUT handler to read the upload more slowly, so
@@ -288,7 +331,8 @@ class TestUpload:
         assert r.exit_code == 0, r.dump_logs()
         r.check_stats(1, 200)
 
-    def test_07_34_issue_11194(self, env: Env, httpd, nghttpx, repeat):
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
+    def test_07_34_issue_11194(self, env: Env, httpd, nghttpx):
         proto = 'h2'
         # tell our test PUT handler to read the upload more slowly, so
         # that the send buffering and transfer loop needs to wait
@@ -308,7 +352,8 @@ class TestUpload:
         r.check_stats(1, 200)
 
     # upload large data on a h1 to h2 upgrade
-    def test_07_35_h1_h2_upgrade_upload(self, env: Env, httpd, nghttpx, repeat):
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
+    def test_07_35_h1_h2_upgrade_upload(self, env: Env, httpd, nghttpx):
         fdata = os.path.join(env.gen_dir, 'data-100k')
         curl = CurlClient(env=env)
         url = f'http://{env.domain1}:{env.http_port}/curltest/echo?id=[0-0]'
@@ -318,18 +363,17 @@ class TestUpload:
         r.check_response(count=1, http_status=200)
         # apache does not Upgrade on request with a body
         assert r.stats[0]['http_version'] == '1.1', f'{r}'
-        indata = open(fdata).readlines()
-        respdata = open(curl.response_file(0)).readlines()
+        with open(fdata) as fi, open(curl.response_file(0)) as fr:
+            indata = fi.readlines()
+            respdata = fr.readlines()
         assert respdata == indata
 
     # upload to a 301,302,303 response
     @pytest.mark.parametrize("redir", ['301', '302', '303'])
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_07_36_upload_30x(self, env: Env, httpd, nghttpx, repeat, redir, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 fails here")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_36_upload_30x(self, env: Env, httpd, nghttpx, redir, proto):
+        if proto == 'h3' and env.curl_uses_ossl_quic():
+            pytest.skip("OpenSSL's own QUIC is flaky here")
         data = '0123456789' * 10
         curl = CurlClient(env=env)
         url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo{redir}?id=[0-0]'
@@ -337,16 +381,15 @@ class TestUpload:
             '-L', '--trace-config', 'http/2,http/3'
         ])
         r.check_response(count=1, http_status=200)
-        respdata = open(curl.response_file(0)).readlines()
+        with open(curl.response_file(0)) as fr:
+            respdata = fr.readlines()
         assert respdata == []  # was transformed to a GET
 
     # upload to a 307 response
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_07_37_upload_307(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 fails here")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_37_upload_307(self, env: Env, httpd, nghttpx, proto):
+        if proto == 'h3' and env.curl_uses_ossl_quic():
+            pytest.skip("OpenSSL's own QUIC is flaky here")
         data = '0123456789' * 10
         curl = CurlClient(env=env)
         url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo307?id=[0-0]'
@@ -354,16 +397,13 @@ class TestUpload:
             '-L', '--trace-config', 'http/2,http/3'
         ])
         r.check_response(count=1, http_status=200)
-        respdata = open(curl.response_file(0)).readlines()
+        with open(curl.response_file(0)) as fr:
+            respdata = fr.readlines()
         assert respdata == [data]  # was POST again
 
     # POST form data, yet another code path in transfer
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_07_38_form_small(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 fails here")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_38_form_small(self, env: Env, httpd, nghttpx, proto):
         curl = CurlClient(env=env)
         url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=[0-0]'
         r = curl.http_form(urls=[url], alpn_proto=proto, form={
@@ -372,12 +412,8 @@ class TestUpload:
         r.check_stats(count=1, http_status=200, exitcode=0)
 
     # POST data urlencoded, small enough to be sent with request headers
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_07_39_post_urlenc_small(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 fails here")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_39_post_urlenc_small(self, env: Env, httpd, nghttpx, proto):
         fdata = os.path.join(env.gen_dir, 'data-63k')
         curl = CurlClient(env=env)
         url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=[0-0]'
@@ -385,17 +421,14 @@ class TestUpload:
             '--trace-config', 'http/2,http/3'
         ])
         r.check_stats(count=1, http_status=200, exitcode=0)
-        indata = open(fdata).readlines()
-        respdata = open(curl.response_file(0)).readlines()
+        with open(fdata) as fi, open(curl.response_file(0)) as fr:
+            indata = fi.readlines()
+            respdata = fr.readlines()
         assert respdata == indata
 
     # POST data urlencoded, large enough to be sent separate from request headers
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_07_40_post_urlenc_large(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 fails here")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_40_post_urlenc_large(self, env: Env, httpd, nghttpx, proto):
         fdata = os.path.join(env.gen_dir, 'data-64k')
         curl = CurlClient(env=env)
         url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=[0-0]'
@@ -403,8 +436,9 @@ class TestUpload:
             '--trace-config', 'http/2,http/3'
         ])
         r.check_stats(count=1, http_status=200, exitcode=0)
-        indata = open(fdata).readlines()
-        respdata = open(curl.response_file(0)).readlines()
+        with open(fdata) as fi, open(curl.response_file(0)) as fr:
+            indata = fi.readlines()
+            respdata = fr.readlines()
         assert respdata == indata
 
     # POST data urlencoded, small enough to be sent with request headers
@@ -412,12 +446,8 @@ class TestUpload:
     # than our default upload buffer length (64KB).
     # Unfixed, this will fail when run with CURL_DBG_SOCK_WBLOCK=80 most
     # of the time
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_07_41_post_urlenc_small(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 fails here")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_41_post_urlenc_small(self, env: Env, httpd, nghttpx, proto):
         if proto == 'h3' and env.curl_uses_lib('quiche'):
             pytest.skip("quiche has CWND issues with large requests")
         fdata = os.path.join(env.gen_dir, 'data-63k')
@@ -429,18 +459,270 @@ class TestUpload:
         url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=[0-0]'
         r = curl.http_upload(urls=[url], data=f'@{fdata}', alpn_proto=proto, extra_args=extra_args)
         r.check_stats(count=1, http_status=200, exitcode=0)
-        indata = open(fdata).readlines()
-        respdata = open(curl.response_file(0)).readlines()
+        with open(fdata) as fi, open(curl.response_file(0)) as fr:
+            indata = fi.readlines()
+            respdata = fr.readlines()
         assert respdata == indata
 
-    def check_download(self, count, srcfile, curl):
+    def check_download(self, r: ExecResult, count: int, srcfile: Union[str, os.PathLike], curl: CurlClient):
         for i in range(count):
             dfile = curl.download_file(i)
-            assert os.path.exists(dfile)
+            assert os.path.exists(dfile), f'download {dfile} missing\n{r.dump_logs()}'
             if not filecmp.cmp(srcfile, dfile, shallow=False):
-                diff = "".join(difflib.unified_diff(a=open(srcfile).readlines(),
-                                                    b=open(dfile).readlines(),
+                with open(srcfile) as fa, open(dfile) as fb:
+                    a = fa.readlines()
+                    b = fb.readlines()
+                diff = "".join(difflib.unified_diff(a=a, b=b,
                                                     fromfile=srcfile,
                                                     tofile=dfile,
                                                     n=1))
-                assert False, f'download {dfile} differs:\n{diff}'
+                assert False, f'download {dfile} differs:\n{diff}\n{r.dump_logs()}'
+
+    # upload data, pause, let connection die with an incomplete response
+    # issues #11769 #13260
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_42a_upload_disconnect(self, env: Env, httpd, nghttpx, proto):
+        client = LocalClient(name='cli_upload_pausing', env=env, timeout=60)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=[0-0]&die_after=0'
+        r = client.run(['-V', proto, url])
+        if r.exit_code == 18:  # PARTIAL_FILE is always ok
+            pass
+        elif proto == 'h2':
+            # CURLE_HTTP2, CURLE_HTTP2_STREAM
+            assert r.exit_code in [16, 92], f'unexpected exit code\n{r.dump_logs()}'
+        elif proto == 'h3':
+            r.check_exit_code(95)  # CURLE_HTTP3 also ok
+        else:
+            r.check_exit_code(18)  # will fail as it should
+
+    # upload data, pause, let connection die without any response at all
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_42b_upload_disconnect(self, env: Env, httpd, nghttpx, proto):
+        client = LocalClient(name='cli_upload_pausing', env=env, timeout=60)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=0&just_die=1'
+        r = client.run(['-V', proto, url])
+        exp_code = 52  # GOT_NOTHING
+        if proto == 'h2' or proto == 'h3':
+            exp_code = 0  # we get a 500 from the server
+        r.check_exit_code(exp_code)  # GOT_NOTHING
+
+    # upload data, pause, let connection die after 100 continue
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_42c_upload_disconnect(self, env: Env, httpd, nghttpx, proto):
+        client = LocalClient(name='cli_upload_pausing', env=env, timeout=60)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=0&die_after_100=1'
+        r = client.run(['-V', proto, url])
+        exp_code = 52  # GOT_NOTHING
+        if proto == 'h2' or proto == 'h3':
+            exp_code = 0  # we get a 500 from the server
+        r.check_exit_code(exp_code)  # GOT_NOTHING
+
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_43_upload_denied(self, env: Env, httpd, nghttpx, proto):
+        fdata = os.path.join(env.gen_dir, 'data-10m')
+        count = 1
+        max_upload = 128 * 1024
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/put?'\
+            f'id=[0-{count-1}]&max_upload={max_upload}'
+        r = curl.http_put(urls=[url], fdata=fdata, alpn_proto=proto,
+                          extra_args=['--trace-config', 'all'])
+        r.check_stats(count=count, http_status=413, exitcode=0)
+
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    @pytest.mark.parametrize("httpcode", [301, 302, 307, 308])
+    def test_07_44_put_redir(self, env: Env, httpd, nghttpx, proto, httpcode):
+        count = 1
+        upload_size = 128 * 1024
+        url = f'https://localhost:{env.https_port}/curltest/put-redir-{httpcode}'
+        client = LocalClient(name='cli_hx_upload', env=env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        r = client.run(args=[
+             '-n', f'{count}', '-l', '-S', f'{upload_size}', '-V', proto, url
+        ])
+        r.check_exit_code(0)
+        results = [int(m.group(1)) for line in r.trace_lines
+                     if (m := re.match(r'.* FINISHED, result=(\d+), response=(\d+)', line))]
+        httpcodes = [int(m.group(2)) for line in r.trace_lines
+                     if (m := re.match(r'.* FINISHED, result=(\d+), response=(\d+)', line))]
+        if httpcode == 308:
+            assert results[0] == 65, f'{r}'  # could not rewind input
+        else:
+            assert httpcodes[0] == httpcode, f'{r}'
+
+    # speed limited on put handler
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_50_put_speed_limit(self, env: Env, httpd, nghttpx, proto):
+        count = 1
+        fdata = os.path.join(env.gen_dir, 'data-100k')
+        up_len = 100 * 1024
+        speed_limit = 50 * 1024
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/put?id=[0-0]'
+        r = curl.http_put(urls=[url], fdata=fdata, alpn_proto=proto,
+                          with_headers=True, extra_args=[
+            '--limit-rate', f'{speed_limit}'
+        ])
+        r.check_response(count=count, http_status=200)
+        assert r.responses[0]['header']['received-length'] == f'{up_len}', f'{r.responses[0]}'
+        up_speed = r.stats[0]['speed_upload']
+        assert up_speed <= (speed_limit * 1.1), f'{r.stats[0]}'
+
+    # speed limited on echo handler
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_07_51_echo_speed_limit(self, env: Env, httpd, nghttpx, proto):
+        count = 1
+        fdata = os.path.join(env.gen_dir, 'data-100k')
+        speed_limit = 50 * 1024
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=[0-0]'
+        r = curl.http_upload(urls=[url], data=f'@{fdata}', alpn_proto=proto,
+                             with_headers=True, extra_args=[
+            '--limit-rate', f'{speed_limit}'
+        ])
+        r.check_response(count=count, http_status=200)
+        up_speed = r.stats[0]['speed_upload']
+        assert up_speed <= (speed_limit * 1.1), f'{r.stats[0]}'
+
+    # upload larger data, triggering "Expect: 100-continue" code paths
+    @pytest.mark.parametrize("proto", ['http/1.1'])
+    def test_07_60_upload_exp100(self, env: Env, httpd, nghttpx, proto):
+        fdata = os.path.join(env.gen_dir, 'data-1m+')
+        read_delay = 1
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/put?id=[0-0]'\
+            f'&read_delay={read_delay}s'
+        r = curl.http_put(urls=[url], fdata=fdata, alpn_proto=proto, extra_args=[
+            '--expect100-timeout', f'{read_delay+1}'
+        ])
+        r.check_stats(count=1, http_status=200, exitcode=0)
+
+    # upload larger data, triggering "Expect: 100-continue" code paths
+    @pytest.mark.parametrize("proto", ['http/1.1'])
+    def test_07_61_upload_exp100_timeout(self, env: Env, httpd, nghttpx, proto):
+        fdata = os.path.join(env.gen_dir, 'data-1m+')
+        read_delay = 2
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/put?id=[0-0]'\
+            f'&read_delay={read_delay}s'
+        r = curl.http_put(urls=[url], fdata=fdata, alpn_proto=proto, extra_args=[
+            '--expect100-timeout', f'{read_delay-1}'
+        ])
+        r.check_stats(count=1, http_status=200, exitcode=0)
+
+    # issue #15688 when posting a form and cr_mime_read() is called with
+    # length < 4, we did not progress
+    @pytest.mark.parametrize("proto", ['http/1.1'])
+    def test_07_62_upload_issue_15688(self, env: Env, httpd, proto):
+        # this length leads to (including multipart formatting) to a
+        # client reader invocation with length 1.
+        upload_len = 196169
+        fname = f'data-{upload_len}'
+        env.make_data_file(indir=env.gen_dir, fname=fname, fsize=upload_len)
+        fdata = os.path.join(env.gen_dir, fname)
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=[0-0]'
+        r = curl.http_form(urls=[url], form={
+            'file': f'@{fdata}',
+        }, alpn_proto=proto, extra_args=[
+            '--max-time', '10'
+        ])
+        r.check_stats(count=1, http_status=200, exitcode=0)
+
+    @pytest.mark.parametrize("proto", ['http/1.1'])
+    def test_07_63_upload_exp100_paused(self, env: Env, httpd, nghttpx, proto):
+        read_delay = 1
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=[0-0]'\
+            f'&read_delay={read_delay}s'
+        upload_size = 128 * 1024
+        client = LocalClient(name='cli_hx_upload', env=env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        r = client.run(args=[
+             '-n', '1',
+             '-S', f'{upload_size}',
+             '-P', '1',
+             '-M', 'MIME',
+             '-r', f'{env.domain1}:{env.port_for(proto)}:127.0.0.1',
+             '-V', proto, url
+        ])
+        r.check_exit_code(0)
+
+    # nghttpx is the only server we have that supports TLS early data
+    @pytest.mark.skipif(condition=not Env.have_nghttpx(), reason="no nghttpx")
+    @pytest.mark.parametrize("proto,upload_size", [
+        pytest.param('http/1.1', 100, id='h1-small-body'),
+        pytest.param('http/1.1', 10 * 1024, id='h1-medium-body'),
+        pytest.param('http/1.1', 32 * 1024, id='h1-limited-body'),
+        pytest.param('h2', 10 * 1024, id='h2-medium-body'),
+        pytest.param('h2', 32 * 1024, id='h2-limited-body'),
+        pytest.param('h3', 1024, id='h3-small-body'),
+        pytest.param('h3', 1024 * 1024, id='h3-limited-body'),
+    ])
+    def test_07_70_put_earlydata(self, env: Env, httpd, nghttpx, proto, upload_size):
+        if not env.curl_can_early_data():
+            pytest.skip('TLS earlydata not implemented')
+        if proto == 'h2' and not env.have_h2_curl():
+            pytest.skip("h2 not supported")
+        if proto == 'h3' and \
+           (not env.have_h3() or not env.curl_can_h3_early_data()):
+            pytest.skip("h3 not supported")
+        if proto != 'h3' and sys.platform.startswith('darwin') and env.ci_run:
+            pytest.skip('failing on macOS CI runners')
+        if proto == 'h3' and env.curl_uses_lib('wolfssl'):
+            pytest.skip('h3 wolfssl early data failing')
+        if proto == 'h3' and env.curl_uses_lib('gnutls'):
+            pytest.skip('h3 gnutls early data failing')
+        count = 2
+        # we want this test to always connect to nghttpx, since it is
+        # the only server we have that supports TLS earlydata
+        port = env.port_for(proto)
+        if proto != 'h3':
+            port = env.nghttpx_https_port
+        url = f'https://{env.domain1}:{port}/curltest/put'
+        client = LocalClient(name='cli_hx_upload', env=env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        r = client.run(args=[
+             '-n', f'{count}',
+             '-e',  # use TLS earlydata
+             '-f',  # forbid reuse of connections
+             '-l',  # announce upload length, no 'Expect: 100'
+             '-S', f'{upload_size}',
+             '-r', f'{env.domain1}:{port}:127.0.0.1',
+             '-V', proto, url
+        ])
+        r.check_exit_code(0)
+        self.check_downloads(client, r, [f"{upload_size}"], count)
+        earlydata = {}
+        for line in r.trace_lines:
+            m = re.match(r'^\[t-(\d+)] EarlyData: (-?\d+)', line)
+            if m:
+                earlydata[int(m.group(1))] = int(m.group(2))
+        # 1st transfer did not use early data
+        assert earlydata[0] == 0, f'{earlydata}\n{r.dump_logs()}'
+        # depending on cpu load, the amount of early data might differ.
+        # when the server is slow, we might send more. when curl is slow,
+        # we might send less before the server handshakes.
+        assert 0 < earlydata[1] <= (upload_size + 1024), f'{earlydata}\n{r.dump_logs()}'
+
+    def check_downloads(self, client, r, source: List[str], count: int,
+                        complete: bool = True):
+        for i in range(count):
+            dfile = client.download_file(i)
+            assert os.path.exists(dfile), f'download {dfile} missing\n{r.dump_logs()}'
+            if complete:
+                with open(dfile) as fb:
+                    b = fb.readlines()
+                diff = "".join(difflib.unified_diff(a=source, b=b,
+                                                    fromfile='-',
+                                                    tofile=dfile,
+                                                    n=1))
+                assert not diff, f'download {dfile} differs:\n{diff}\n{r.dump_logs()}'
diff --git a/third-party/curl/tests/http/test_08_caddy.py b/third-party/curl/tests/http/test_08_caddy.py
index c95d8457a8..23cea4582a 100644
--- a/third-party/curl/tests/http/test_08_caddy.py
+++ b/third-party/curl/tests/http/test_08_caddy.py
@@ -24,24 +24,26 @@
 #
 ###########################################################################
 #
+import difflib
+import filecmp
 import logging
 import os
+import re
+
 import pytest
-
-from testenv import Env, CurlClient, Caddy
-
+from testenv import Caddy, CurlClient, Env, LocalClient
 
 log = logging.getLogger(__name__)
 
 
-@pytest.mark.skipif(condition=not Env.has_caddy(), reason=f"missing caddy")
-@pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason=f"curl without SSL")
+@pytest.mark.skipif(condition=not Env.has_caddy(), reason="missing caddy")
+@pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason="curl without SSL")
 class TestCaddy:
 
     @pytest.fixture(autouse=True, scope='class')
     def caddy(self, env):
         caddy = Caddy(env=env)
-        assert caddy.start()
+        assert caddy.initial_start()
         yield caddy
         caddy.stop()
 
@@ -57,31 +59,24 @@ class TestCaddy:
 
     @pytest.fixture(autouse=True, scope='class')
     def _class_scope(self, env, caddy):
-        self._make_docs_file(docs_dir=caddy.docs_dir, fname='data1.data', fsize=1024*1024)
-        self._make_docs_file(docs_dir=caddy.docs_dir, fname='data5.data', fsize=5*1024*1024)
-        self._make_docs_file(docs_dir=caddy.docs_dir, fname='data10.data', fsize=10*1024*1024)
-        self._make_docs_file(docs_dir=caddy.docs_dir, fname='data100.data', fsize=100*1024*1024)
+        self._make_docs_file(docs_dir=caddy.docs_dir, fname='data10k.data', fsize=10 * 1024)
+        self._make_docs_file(docs_dir=caddy.docs_dir, fname='data1.data', fsize=1024 * 1024)
+        self._make_docs_file(docs_dir=caddy.docs_dir, fname='data5.data', fsize=5 * 1024 * 1024)
+        self._make_docs_file(docs_dir=caddy.docs_dir, fname='data10.data', fsize=10 * 1024 * 1024)
+        self._make_docs_file(docs_dir=caddy.docs_dir, fname='data100.data', fsize=100 * 1024 * 1024)
+        env.make_data_file(indir=env.gen_dir, fname="data-10m", fsize=10 * 1024 * 1024)
 
     # download 1 file
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_08_01_download_1(self, env: Env, caddy: Caddy, repeat, proto):
-        if proto == 'h3' and not env.have_h3_curl():
-            pytest.skip("h3 not supported in curl")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 itself crashes")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_08_01_download_1(self, env: Env, caddy: Caddy, proto):
         curl = CurlClient(env=env)
         url = f'https://{env.domain1}:{caddy.port}/data.json'
         r = curl.http_download(urls=[url], alpn_proto=proto)
         r.check_response(count=1, http_status=200)
 
     # download 1MB files sequentially
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_08_02_download_1mb_sequential(self, env: Env, caddy: Caddy,
-                                           repeat, proto):
-        if proto == 'h3' and not env.have_h3_curl():
-            pytest.skip("h3 not supported in curl")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 itself crashes")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_08_02_download_1mb_sequential(self, env: Env, caddy: Caddy, proto):
         count = 50
         curl = CurlClient(env=env)
         urln = f'https://{env.domain1}:{caddy.port}/data1.data?[0-{count-1}]'
@@ -89,13 +84,8 @@ class TestCaddy:
         r.check_response(count=count, http_status=200, connect_count=1)
 
     # download 1MB files parallel
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_08_03_download_1mb_parallel(self, env: Env, caddy: Caddy,
-                                         repeat, proto):
-        if proto == 'h3' and not env.have_h3_curl():
-            pytest.skip("h3 not supported in curl")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 itself crashes")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_08_03_download_1mb_parallel(self, env: Env, caddy: Caddy, proto):
         count = 20
         curl = CurlClient(env=env)
         urln = f'https://{env.domain1}:{caddy.port}/data1.data?[0-{count-1}]'
@@ -111,14 +101,8 @@ class TestCaddy:
 
     # download 5MB files sequentially
     @pytest.mark.skipif(condition=Env().slow_network, reason="not suitable for slow network tests")
-    @pytest.mark.skipif(condition=Env().ci_run, reason="not suitable for CI runs")
-    @pytest.mark.parametrize("proto", ['h2', 'h3'])
-    def test_08_04a_download_10mb_sequential(self, env: Env, caddy: Caddy,
-                                           repeat, proto):
-        if proto == 'h3' and not env.have_h3_curl():
-            pytest.skip("h3 not supported in curl")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 itself crashes")
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_08_04a_download_10mb_sequential(self, env: Env, caddy: Caddy, proto):
         count = 40
         curl = CurlClient(env=env)
         urln = f'https://{env.domain1}:{caddy.port}/data5.data?[0-{count-1}]'
@@ -127,14 +111,8 @@ class TestCaddy:
 
     # download 10MB files sequentially
     @pytest.mark.skipif(condition=Env().slow_network, reason="not suitable for slow network tests")
-    @pytest.mark.skipif(condition=Env().ci_run, reason="not suitable for CI runs")
-    @pytest.mark.parametrize("proto", ['h2', 'h3'])
-    def test_08_04b_download_10mb_sequential(self, env: Env, caddy: Caddy,
-                                           repeat, proto):
-        if proto == 'h3' and not env.have_h3_curl():
-            pytest.skip("h3 not supported in curl")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 itself crashes")
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_08_04b_download_10mb_sequential(self, env: Env, caddy: Caddy, proto):
         count = 20
         curl = CurlClient(env=env)
         urln = f'https://{env.domain1}:{caddy.port}/data10.data?[0-{count-1}]'
@@ -143,14 +121,11 @@ class TestCaddy:
 
     # download 10MB files parallel
     @pytest.mark.skipif(condition=Env().slow_network, reason="not suitable for slow network tests")
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    @pytest.mark.skipif(condition=Env().ci_run, reason="not suitable for CI runs")
-    def test_08_05_download_1mb_parallel(self, env: Env, caddy: Caddy,
-                                         repeat, proto):
-        if proto == 'h3' and not env.have_h3_curl():
-            pytest.skip("h3 not supported in curl")
-        if proto == 'h3' and env.curl_uses_lib('msh3'):
-            pytest.skip("msh3 itself crashes")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_08_05_download_1mb_parallel(self, env: Env, caddy: Caddy, proto):
+        if proto == 'http/1.1' and env.curl_uses_lib('mbedtls'):
+            pytest.skip("mbedtls 3.6.0 fails on 50 connections with: "
+                        "ssl_handshake returned: (-0x7F00) SSL - Memory allocation failed")
         count = 50
         curl = CurlClient(env=env)
         urln = f'https://{env.domain1}:{caddy.port}/data10.data?[0-{count-1}]'
@@ -163,3 +138,85 @@ class TestCaddy:
             assert r.total_connects > 1, r.dump_logs()
         else:
             assert r.total_connects == 1, r.dump_logs()
+
+    # post data parallel, check that they were echoed
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_08_06_post_parallel(self, env: Env, httpd, caddy, proto):
+        # limit since we use a separate connection in h1
+        count = 20
+        data = '0123456789'
+        curl = CurlClient(env=env)
+        url = f'https://{env.domain2}:{caddy.port}/curltest/echo?id=[0-{count-1}]'
+        r = curl.http_upload(urls=[url], data=data, alpn_proto=proto,
+                             extra_args=['--parallel'])
+        r.check_stats(count=count, http_status=200, exitcode=0)
+        for i in range(count):
+            with open(curl.response_file(i)) as fr:
+                respdata = fr.readlines()
+            assert respdata == [data]
+
+    # put large file, check that they length were echoed
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_08_07_put_large(self, env: Env, httpd, caddy, proto):
+        # limit since we use a separate connection in h1<
+        count = 1
+        fdata = os.path.join(env.gen_dir, 'data-10m')
+        curl = CurlClient(env=env)
+        url = f'https://{env.domain2}:{caddy.port}/curltest/put?id=[0-{count-1}]'
+        r = curl.http_put(urls=[url], fdata=fdata, alpn_proto=proto)
+        exp_data = [f'{os.path.getsize(fdata)}']
+        r.check_response(count=count, http_status=200)
+        for i in range(count):
+            with open(curl.response_file(i)) as fr:
+                respdata = fr.readlines()
+            assert respdata == exp_data
+
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_08_08_earlydata(self, env: Env, httpd, caddy, proto):
+        if not env.curl_can_early_data():
+            pytest.skip('TLS earlydata not implemented')
+        if proto == 'h3' and not env.curl_can_h3_early_data():
+            pytest.skip("h3 early data not supported")
+        count = 2
+        docname = 'data10k.data'
+        url = f'https://{env.domain1}:{caddy.port}/{docname}'
+        client = LocalClient(name='cli_hx_download', env=env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        r = client.run(args=[
+             '-n', f'{count}',
+             '-C', env.ca.cert_file,
+             '-e',  # use TLS earlydata
+             '-f',  # forbid reuse of connections
+             '-r', f'{env.domain1}:{caddy.port}:127.0.0.1',
+             '-V', proto, url
+        ])
+        r.check_exit_code(0)
+        srcfile = os.path.join(caddy.docs_dir, docname)
+        self.check_downloads(client, srcfile, count)
+        earlydata = {}
+        for line in r.trace_lines:
+            m = re.match(r'^\[t-(\d+)] EarlyData: (-?\d+)', line)
+            if m:
+                earlydata[int(m.group(1))] = int(m.group(2))
+        assert earlydata[0] == 0, f'{earlydata}'
+        if proto == 'h3':
+            assert earlydata[1] == 113, f'{earlydata}'
+        else:
+            # Caddy does not support early data on TCP
+            assert earlydata[1] == 0, f'{earlydata}'
+
+    def check_downloads(self, client, srcfile: str, count: int,
+                        complete: bool = True):
+        for i in range(count):
+            dfile = client.download_file(i)
+            assert os.path.exists(dfile)
+            if complete and not filecmp.cmp(srcfile, dfile, shallow=False):
+                with open(srcfile) as fa, open(dfile) as fb:
+                    a = fa.readlines()
+                    b = fb.readlines()
+                diff = "".join(difflib.unified_diff(a=a, b=b,
+                                                    fromfile=srcfile,
+                                                    tofile=dfile,
+                                                    n=1))
+                assert False, f'download {dfile} differs:\n{diff}'
diff --git a/third-party/curl/tests/http/test_09_push.py b/third-party/curl/tests/http/test_09_push.py
index 9007415057..386289b39e 100644
--- a/third-party/curl/tests/http/test_09_push.py
+++ b/third-party/curl/tests/http/test_09_push.py
@@ -26,10 +26,9 @@
 #
 import logging
 import os
+
 import pytest
-
-from testenv import Env, CurlClient, LocalClient
-
+from testenv import CurlClient, Env, LocalClient
 
 log = logging.getLogger(__name__)
 
@@ -41,27 +40,28 @@ class TestPush:
         push_dir = os.path.join(httpd.docs_dir, 'push')
         if not os.path.exists(push_dir):
             os.makedirs(push_dir)
-        env.make_data_file(indir=push_dir, fname="data1", fsize=1*1024)
-        env.make_data_file(indir=push_dir, fname="data2", fsize=1*1024)
-        env.make_data_file(indir=push_dir, fname="data3", fsize=1*1024)
+        env.make_data_file(indir=push_dir, fname="data1", fsize=1 * 1024)
+        env.make_data_file(indir=push_dir, fname="data2", fsize=1 * 1024)
+        env.make_data_file(indir=push_dir, fname="data3", fsize=1 * 1024)
+
+    def httpd_configure(self, env, httpd):
         httpd.set_extra_config(env.domain1, [
-            f'H2EarlyHints on',
-            f'<Location /push/data1>',
-            f'  H2PushResource /push/data2',
-            f'</Location>',
-            f'<Location /push/data2>',
-            f'  H2PushResource /push/data1',
-            f'  H2PushResource /push/data3',
-            f'</Location>',
+            'H2EarlyHints on',
+            '<Location /push/data1>',
+            '  H2PushResource /push/data2',
+            '</Location>',
+            '<Location /push/data2>',
+            '  H2PushResource /push/data1',
+            '  H2PushResource /push/data3',
+            '</Location>',
         ])
         # activate the new config
-        httpd.reload()
-        yield
-        httpd.clear_extra_configs()
-        httpd.reload()
+        httpd.reload_if_config_changed()
 
     # download a file that triggers a "103 Early Hints" response
-    def test_09_01_h2_early_hints(self, env: Env, httpd, repeat):
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
+    def test_09_01_h2_early_hints(self, env: Env, httpd, configures_httpd):
+        self.httpd_configure(env, httpd)
         curl = CurlClient(env=env)
         url = f'https://{env.domain1}:{env.https_port}/push/data1'
         r = curl.http_download(urls=[url], alpn_proto='h2', with_stats=False,
@@ -72,10 +72,12 @@ class TestPush:
         assert 'link' in r.responses[0]['header'], f'{r.responses[0]}'
         assert r.responses[0]['header']['link'] == '</push/data2>; rel=preload', f'{r.responses[0]}'
 
-    def test_09_02_h2_push(self, env: Env, httpd, repeat):
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
+    def test_09_02_h2_push(self, env: Env, httpd, configures_httpd):
+        self.httpd_configure(env, httpd)
         # use localhost as we do not have resolve support in local client
         url = f'https://localhost:{env.https_port}/push/data1'
-        client = LocalClient(name='h2-serverpush', env=env)
+        client = LocalClient(name='cli_h2_serverpush', env=env)
         if not client.exists():
             pytest.skip(f'example client not built: {client.name}')
         r = client.run(args=[url])
diff --git a/third-party/curl/tests/http/test_10_proxy.py b/third-party/curl/tests/http/test_10_proxy.py
index df234013c1..5843c30b08 100644
--- a/third-party/curl/tests/http/test_10_proxy.py
+++ b/third-party/curl/tests/http/test_10_proxy.py
@@ -28,10 +28,10 @@ import filecmp
 import logging
 import os
 import re
+import sys
+
 import pytest
-
-from testenv import Env, CurlClient, ExecResult
-
+from testenv import CurlClient, Env, ExecResult
 
 log = logging.getLogger(__name__)
 
@@ -45,21 +45,21 @@ class TestProxy:
             os.makedirs(push_dir)
         if env.have_nghttpx():
             nghttpx_fwd.start_if_needed()
-        env.make_data_file(indir=env.gen_dir, fname="data-100k", fsize=100*1024)
-        env.make_data_file(indir=env.gen_dir, fname="data-10m", fsize=10*1024*1024)
-        httpd.clear_extra_configs()
-        httpd.reload()
+        env.make_data_file(indir=env.gen_dir, fname="data-100k", fsize=100 * 1024)
+        env.make_data_file(indir=env.gen_dir, fname="data-10m", fsize=10 * 1024 * 1024)
+        indir = httpd.docs_dir
+        env.make_data_file(indir=indir, fname="data-100k", fsize=100 * 1024)
+        env.make_data_file(indir=indir, fname="data-1m", fsize=1024 * 1024)
 
     def get_tunnel_proto_used(self, r: ExecResult):
-        for l in r.trace_lines:
-            m = re.match(r'.* CONNECT tunnel: (\S+) negotiated$', l)
+        for line in r.trace_lines:
+            m = re.match(r'.* CONNECT: \'(\S+)\' negotiated$', line)
             if m:
                 return m.group(1)
         assert False, f'tunnel protocol not found in:\n{"".join(r.trace_lines)}'
-        return None
 
     # download via http: proxy (no tunnel)
-    def test_10_01_proxy_http(self, env: Env, httpd, repeat):
+    def test_10_01_proxy_http(self, env: Env, httpd):
         curl = CurlClient(env=env)
         url = f'http://localhost:{env.http_port}/data.json'
         r = curl.http_download(urls=[url], alpn_proto='http/1.1', with_stats=True,
@@ -69,9 +69,8 @@ class TestProxy:
     # download via https: proxy (no tunnel)
     @pytest.mark.skipif(condition=not Env.curl_has_feature('HTTPS-proxy'),
                         reason='curl lacks HTTPS-proxy support')
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2'])
-    @pytest.mark.skipif(condition=not Env.have_nghttpx(), reason="no nghttpx available")
-    def test_10_02_proxys_down(self, env: Env, httpd, nghttpx_fwd, proto, repeat):
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    def test_10_02_proxys_down(self, env: Env, httpd, proto):
         if proto == 'h2' and not env.curl_uses_lib('nghttp2'):
             pytest.skip('only supported with nghttp2')
         curl = CurlClient(env=env)
@@ -83,17 +82,18 @@ class TestProxy:
                          protocol='HTTP/2' if proto == 'h2' else 'HTTP/1.1')
 
     # upload via https: with proto (no tunnel)
-    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason=f"curl without SSL")
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2'])
-    @pytest.mark.parametrize("fname, fcount", [
-        ['data.json', 5],
-        ['data-100k', 5],
-        ['data-1m', 2]
+    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason="curl without SSL")
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    @pytest.mark.parametrize("fname, fcount, with_alpn", [
+        ['data.json', 5, False],
+        ['data.json', 5, True],
+        ['data-100k', 5, True],
+        ['data-1m', 2, True]
     ])
     @pytest.mark.skipif(condition=not Env.have_nghttpx(),
                         reason="no nghttpx available")
     def test_10_02_proxys_up(self, env: Env, httpd, nghttpx, proto,
-                             fname, fcount, repeat):
+                             fname, fcount, with_alpn):
         if proto == 'h2' and not env.curl_uses_lib('nghttp2'):
             pytest.skip('only supported with nghttp2')
         count = fcount
@@ -101,17 +101,21 @@ class TestProxy:
         curl = CurlClient(env=env)
         url = f'http://localhost:{env.http_port}/curltest/echo?id=[0-{count-1}]'
         xargs = curl.get_proxy_args(proto=proto)
+        if not with_alpn:
+            xargs.append('--no-alpn')
         r = curl.http_upload(urls=[url], data=f'@{srcfile}', alpn_proto=proto,
                              extra_args=xargs)
         r.check_response(count=count, http_status=200,
                          protocol='HTTP/2' if proto == 'h2' else 'HTTP/1.1')
-        indata = open(srcfile).readlines()
+        with open(srcfile) as fi:
+            indata = fi.readlines()
         for i in range(count):
-            respdata = open(curl.response_file(i)).readlines()
+            with open(curl.response_file(i)) as fr:
+                respdata = fr.readlines()
             assert respdata == indata
 
     # download http: via http: proxytunnel
-    def test_10_03_proxytunnel_http(self, env: Env, httpd, repeat):
+    def test_10_03_proxytunnel_http(self, env: Env, httpd, nghttpx_fwd):
         curl = CurlClient(env=env)
         url = f'http://localhost:{env.http_port}/data.json'
         xargs = curl.get_proxy_args(proxys=False, tunnel=True)
@@ -123,7 +127,7 @@ class TestProxy:
     @pytest.mark.skipif(condition=not Env.curl_has_feature('HTTPS-proxy'),
                         reason='curl lacks HTTPS-proxy support')
     @pytest.mark.skipif(condition=not Env.have_nghttpx(), reason="no nghttpx available")
-    def test_10_04_proxy_https(self, env: Env, httpd, nghttpx_fwd, repeat):
+    def test_10_04_proxy_https(self, env: Env, httpd, nghttpx_fwd):
         curl = CurlClient(env=env)
         url = f'http://localhost:{env.http_port}/data.json'
         xargs = curl.get_proxy_args(tunnel=True)
@@ -132,9 +136,9 @@ class TestProxy:
         r.check_response(count=1, http_status=200)
 
     # download https: with proto via http: proxytunnel
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2'])
-    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason=f"curl without SSL")
-    def test_10_05_proxytunnel_http(self, env: Env, httpd, proto, repeat):
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason="curl without SSL")
+    def test_10_05_proxytunnel_http(self, env: Env, httpd, nghttpx_fwd, proto):
         curl = CurlClient(env=env)
         url = f'https://localhost:{env.https_port}/data.json'
         xargs = curl.get_proxy_args(proxys=False, tunnel=True)
@@ -146,10 +150,12 @@ class TestProxy:
     # download https: with proto via https: proxytunnel
     @pytest.mark.skipif(condition=not Env.curl_has_feature('HTTPS-proxy'),
                         reason='curl lacks HTTPS-proxy support')
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2'])
-    @pytest.mark.parametrize("tunnel", ['http/1.1', 'h2'])
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    @pytest.mark.parametrize("tunnel", Env.http_h1_h2_protos())
     @pytest.mark.skipif(condition=not Env.have_nghttpx(), reason="no nghttpx available")
-    def test_10_06_proxytunnel_https(self, env: Env, httpd, nghttpx_fwd, proto, tunnel, repeat):
+    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
+    def test_10_06_proxytunnel_https(self, env: Env, httpd, nghttpx_fwd, proto, tunnel):
         if tunnel == 'h2' and not env.curl_uses_lib('nghttp2'):
             pytest.skip('only supported with nghttp2')
         curl = CurlClient(env=env)
@@ -159,16 +165,17 @@ class TestProxy:
                                extra_args=xargs)
         r.check_response(count=1, http_status=200,
                          protocol='HTTP/2' if proto == 'h2' else 'HTTP/1.1')
-        assert self.get_tunnel_proto_used(r) == 'HTTP/2' \
-            if tunnel == 'h2' else 'HTTP/1.1'
+        assert self.get_tunnel_proto_used(r) == tunnel
         srcfile = os.path.join(httpd.docs_dir, 'data.json')
         dfile = curl.download_file(0)
         assert filecmp.cmp(srcfile, dfile, shallow=False)
 
     # download many https: with proto via https: proxytunnel
-    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason=f"curl without SSL")
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2'])
-    @pytest.mark.parametrize("tunnel", ['http/1.1', 'h2'])
+    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason="curl without SSL")
+    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    @pytest.mark.parametrize("tunnel", Env.http_h1_h2_protos())
     @pytest.mark.parametrize("fname, fcount", [
         ['data.json', 100],
         ['data-100k', 20],
@@ -176,9 +183,12 @@ class TestProxy:
     ])
     @pytest.mark.skipif(condition=not Env.have_nghttpx(), reason="no nghttpx available")
     def test_10_07_pts_down_small(self, env: Env, httpd, nghttpx_fwd, proto,
-                                  tunnel, fname, fcount, repeat):
+                                  tunnel, fname, fcount):
         if tunnel == 'h2' and not env.curl_uses_lib('nghttp2'):
             pytest.skip('only supported with nghttp2')
+        if env.curl_uses_lib('mbedtls') and \
+           sys.platform.startswith('darwin') and env.ci_run:
+            pytest.skip('mbedtls 3.6.3 fails this test on macOS CI runners')
         count = fcount
         curl = CurlClient(env=env)
         url = f'https://localhost:{env.https_port}/{fname}?[0-{count-1}]'
@@ -187,8 +197,7 @@ class TestProxy:
                                extra_args=xargs)
         r.check_response(count=count, http_status=200,
                          protocol='HTTP/2' if proto == 'h2' else 'HTTP/1.1')
-        assert self.get_tunnel_proto_used(r) == 'HTTP/2' \
-            if tunnel == 'h2' else 'HTTP/1.1'
+        assert self.get_tunnel_proto_used(r) == tunnel
         srcfile = os.path.join(httpd.docs_dir, fname)
         for i in range(count):
             dfile = curl.download_file(i)
@@ -196,19 +205,24 @@ class TestProxy:
         assert r.total_connects == 1, r.dump_logs()
 
     # upload many https: with proto via https: proxytunnel
-    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason=f"curl without SSL")
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2'])
-    @pytest.mark.parametrize("tunnel", ['http/1.1', 'h2'])
+    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason="curl without SSL")
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    @pytest.mark.parametrize("tunnel", Env.http_h1_h2_protos())
     @pytest.mark.parametrize("fname, fcount", [
         ['data.json', 50],
         ['data-100k', 20],
         ['data-1m', 5]
     ])
+    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
     @pytest.mark.skipif(condition=not Env.have_nghttpx(), reason="no nghttpx available")
     def test_10_08_upload_seq_large(self, env: Env, httpd, nghttpx, proto,
-                                    tunnel, fname, fcount, repeat):
+                                    tunnel, fname, fcount):
         if tunnel == 'h2' and not env.curl_uses_lib('nghttp2'):
             pytest.skip('only supported with nghttp2')
+        if env.curl_uses_lib('mbedtls') and \
+           sys.platform.startswith('darwin') and env.ci_run:
+            pytest.skip('mbedtls 3.6.3 fails this test on macOS CI runners')
         count = fcount
         srcfile = os.path.join(httpd.docs_dir, fname)
         curl = CurlClient(env=env)
@@ -216,19 +230,22 @@ class TestProxy:
         xargs = curl.get_proxy_args(tunnel=True, proto=tunnel)
         r = curl.http_upload(urls=[url], data=f'@{srcfile}', alpn_proto=proto,
                              extra_args=xargs)
-        assert self.get_tunnel_proto_used(r) == 'HTTP/2' \
-            if tunnel == 'h2' else 'HTTP/1.1'
+        assert self.get_tunnel_proto_used(r) == tunnel
         r.check_response(count=count, http_status=200)
-        indata = open(srcfile).readlines()
-        for i in range(count):
-            respdata = open(curl.response_file(i)).readlines()
-            assert respdata == indata
         assert r.total_connects == 1, r.dump_logs()
+        with open(srcfile) as fi:
+            indata = fi.readlines()
+        for i in range(count):
+            with open(curl.response_file(i)) as fr:
+                respdata = fr.readlines()
+            assert respdata == indata, f'response {i} differs'
 
-    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason=f"curl without SSL")
-    @pytest.mark.parametrize("tunnel", ['http/1.1', 'h2'])
+    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason="curl without SSL")
+    @pytest.mark.parametrize("tunnel", Env.http_h1_h2_protos())
     @pytest.mark.skipif(condition=not Env.have_nghttpx(), reason="no nghttpx available")
-    def test_10_09_reuse_ser(self, env: Env, httpd, nghttpx_fwd, tunnel, repeat):
+    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
+    def test_10_09_reuse_server(self, env: Env, httpd, nghttpx_fwd, tunnel):
         if tunnel == 'h2' and not env.curl_uses_lib('nghttp2'):
             pytest.skip('only supported with nghttp2')
         curl = CurlClient(env=env)
@@ -238,8 +255,7 @@ class TestProxy:
         r = curl.http_download(urls=[url1, url2], alpn_proto='http/1.1', with_stats=True,
                                extra_args=xargs)
         r.check_response(count=2, http_status=200)
-        assert self.get_tunnel_proto_used(r) == 'HTTP/2' \
-            if tunnel == 'h2' else 'HTTP/1.1'
+        assert self.get_tunnel_proto_used(r) == tunnel
         if tunnel == 'h2':
             # TODO: we would like to reuse the first connection for the
             # second URL, but this is currently not possible
@@ -247,3 +263,169 @@ class TestProxy:
             assert r.total_connects == 2
         else:
             assert r.total_connects == 2
+
+    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason="curl without SSL")
+    @pytest.mark.parametrize("tunnel", Env.http_h1_h2_protos())
+    @pytest.mark.skipif(condition=not Env.have_nghttpx(), reason="no nghttpx available")
+    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
+    def test_10_10_reuse_proxy(self, env: Env, httpd, nghttpx_fwd, tunnel):
+        # URL twice via https: proxy separated with '--next', will reuse
+        if tunnel == 'h2' and not env.curl_uses_lib('nghttp2'):
+            pytest.skip('only supported with nghttp2')
+        if env.curl_uses_lib('mbedtls') and \
+           sys.platform.startswith('darwin') and env.ci_run:
+            pytest.skip('mbedtls 3.6.3 fails this test on macOS CI runners')
+        curl = CurlClient(env=env)
+        url = f'https://localhost:{env.https_port}/data.json'
+        proxy_args = curl.get_proxy_args(tunnel=True, proto=tunnel)
+        r1 = curl.http_download(urls=[url], alpn_proto='http/1.1', with_stats=True,
+                                extra_args=proxy_args)
+        r1.check_response(count=1, http_status=200)
+        assert self.get_tunnel_proto_used(r1) == tunnel
+        # get the args, duplicate separated with '--next'
+        x2_args = r1.args[1:]
+        x2_args.append('--next')
+        x2_args.extend(proxy_args)
+        r2 = curl.http_download(urls=[url], alpn_proto='http/1.1', with_stats=True,
+                                extra_args=x2_args)
+        r2.check_response(count=2, http_status=200)
+        assert r2.total_connects == 1
+
+    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason="curl without SSL")
+    @pytest.mark.parametrize("tunnel", Env.http_h1_h2_protos())
+    @pytest.mark.skipif(condition=not Env.have_nghttpx(), reason="no nghttpx available")
+    @pytest.mark.skipif(condition=not Env.curl_uses_lib('openssl'), reason="tls13-ciphers not supported")
+    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
+    def test_10_11_noreuse_proxy_https(self, env: Env, httpd, nghttpx_fwd, tunnel):
+        # different --proxy-tls13-ciphers, no reuse of connection for https:
+        curl = CurlClient(env=env)
+        if tunnel == 'h2' and not env.curl_uses_lib('nghttp2'):
+            pytest.skip('only supported with nghttp2')
+        url = f'https://localhost:{env.https_port}/data.json'
+        proxy_args = curl.get_proxy_args(tunnel=True, proto=tunnel)
+        r1 = curl.http_download(urls=[url], alpn_proto='http/1.1', with_stats=True,
+                                extra_args=proxy_args)
+        r1.check_response(count=1, http_status=200)
+        assert self.get_tunnel_proto_used(r1) == tunnel
+        # get the args, duplicate separated with '--next'
+        x2_args = r1.args[1:]
+        x2_args.append('--next')
+        x2_args.extend(proxy_args)
+        x2_args.extend(['--proxy-tls13-ciphers', 'TLS_AES_256_GCM_SHA384'])
+        r2 = curl.http_download(urls=[url], alpn_proto='http/1.1', with_stats=True,
+                                extra_args=x2_args)
+        r2.check_response(count=2, http_status=200)
+        assert r2.total_connects == 2
+
+    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason="curl without SSL")
+    @pytest.mark.parametrize("tunnel", Env.http_h1_h2_protos())
+    @pytest.mark.skipif(condition=not Env.have_nghttpx(), reason="no nghttpx available")
+    @pytest.mark.skipif(condition=not Env.curl_uses_lib('openssl'), reason="tls13-ciphers not supported")
+    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
+    def test_10_12_noreuse_proxy_http(self, env: Env, httpd, nghttpx_fwd, tunnel):
+        # different --proxy-tls13-ciphers, no reuse of connection for http:
+        if tunnel == 'h2' and not env.curl_uses_lib('nghttp2'):
+            pytest.skip('only supported with nghttp2')
+        curl = CurlClient(env=env)
+        url = f'http://localhost:{env.http_port}/data.json'
+        proxy_args = curl.get_proxy_args(tunnel=True, proto=tunnel)
+        r1 = curl.http_download(urls=[url], alpn_proto='http/1.1', with_stats=True,
+                                extra_args=proxy_args)
+        r1.check_response(count=1, http_status=200)
+        assert self.get_tunnel_proto_used(r1) == tunnel
+        # get the args, duplicate separated with '--next'
+        x2_args = r1.args[1:]
+        x2_args.append('--next')
+        x2_args.extend(proxy_args)
+        x2_args.extend(['--proxy-tls13-ciphers', 'TLS_AES_256_GCM_SHA384'])
+        r2 = curl.http_download(urls=[url], alpn_proto='http/1.1', with_stats=True,
+                                extra_args=x2_args)
+        r2.check_response(count=2, http_status=200)
+        assert r2.total_connects == 2
+
+    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason="curl without SSL")
+    @pytest.mark.parametrize("tunnel", Env.http_h1_h2_protos())
+    @pytest.mark.skipif(condition=not Env.have_nghttpx(), reason="no nghttpx available")
+    @pytest.mark.skipif(condition=not Env.curl_uses_lib('openssl'), reason="tls13-ciphers not supported")
+    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
+    def test_10_13_noreuse_https(self, env: Env, httpd, nghttpx_fwd, tunnel):
+        # different --tls13-ciphers on https: same proxy config
+        if tunnel == 'h2' and not env.curl_uses_lib('nghttp2'):
+            pytest.skip('only supported with nghttp2')
+        curl = CurlClient(env=env)
+        url = f'https://localhost:{env.https_port}/data.json'
+        proxy_args = curl.get_proxy_args(tunnel=True, proto=tunnel)
+        r1 = curl.http_download(urls=[url], alpn_proto='http/1.1', with_stats=True,
+                                extra_args=proxy_args)
+        r1.check_response(count=1, http_status=200)
+        assert self.get_tunnel_proto_used(r1) == tunnel
+        # get the args, duplicate separated with '--next'
+        x2_args = r1.args[1:]
+        x2_args.append('--next')
+        x2_args.extend(proxy_args)
+        x2_args.extend(['--tls13-ciphers', 'TLS_AES_256_GCM_SHA384'])
+        r2 = curl.http_download(urls=[url], alpn_proto='http/1.1', with_stats=True,
+                                extra_args=x2_args)
+        r2.check_response(count=2, http_status=200)
+        assert r2.total_connects == 2
+
+    # download via https: proxy (no tunnel) using IP address
+    @pytest.mark.skipif(condition=not Env.curl_has_feature('HTTPS-proxy'),
+                        reason='curl lacks HTTPS-proxy support')
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    def test_10_14_proxys_ip_addr(self, env: Env, httpd, proto):
+        if proto == 'h2' and not env.curl_uses_lib('nghttp2'):
+            pytest.skip('only supported with nghttp2')
+        curl = CurlClient(env=env)
+        url = f'http://localhost:{env.http_port}/data.json'
+        xargs = curl.get_proxy_args(proto=proto, use_ip=True)
+        r = curl.http_download(urls=[url], alpn_proto='http/1.1', with_stats=True,
+                               extra_args=xargs)
+        if env.curl_uses_lib('mbedtls') and \
+                not env.curl_lib_version_at_least('mbedtls', '3.5.0'):
+            r.check_exit_code(60)  # CURLE_PEER_FAILED_VERIFICATION
+        else:
+            r.check_response(count=1, http_status=200,
+                             protocol='HTTP/2' if proto == 'h2' else 'HTTP/1.1')
+
+    # download via http: ipv4 proxy (no tunnel) using IP address, IPv6 only
+    @pytest.mark.skipif(condition=not Env.curl_has_feature('IPv6'),
+                        reason='no ipv6 support')
+    def test_10_15_proxy_ip_addr(self, env: Env, httpd):
+        proto = 'http/1.1'
+        curl = CurlClient(env=env, force_resolv=False)
+        url = f'http://localhost:{env.http_port}/data.json'
+        xargs = curl.get_proxy_args(proto=proto, use_ip=True, proxys=False)
+        xargs.append('-6')
+        r = curl.http_download(urls=[url], alpn_proto='http/1.1', with_stats=True,
+                               extra_args=xargs)
+        r.check_exit_code(0)
+        r.check_response(count=1, http_status=200, protocol='HTTP/1.1')
+
+    # download via http: ipv6 proxy (no tunnel) using IP address, IPv4 only
+    @pytest.mark.skipif(condition=not Env.curl_has_feature('IPv6'),
+                        reason='no ipv6 support')
+    def test_10_16_proxy_ip_addr(self, env: Env, httpd):
+        proto = 'http/1.1'
+        curl = CurlClient(env=env, force_resolv=False)
+        url = f'http://localhost:{env.http_port}/data.json'
+        xargs = curl.get_proxy_args(proto=proto, use_ipv6=True, proxys=False)
+        xargs.append('-4')
+        r = curl.http_download(urls=[url], alpn_proto='http/1.1', with_stats=True,
+                               extra_args=xargs)
+        r.check_exit_code(0)
+        r.check_response(count=1, http_status=200, protocol='HTTP/1.1')
+
+    # download via http: proxy (no tunnel), check connection reuse
+    def test_10_17_proxy_http(self, env: Env, httpd):
+        curl = CurlClient(env=env)
+        url1 = f'http://localhost:{env.http_port}/data.json'
+        url2 = f'http://127.0.0.1:{env.http_port}/data.json'
+        r = curl.http_download(urls=[url1, url2], alpn_proto='http/1.1', with_stats=True,
+                               extra_args=curl.get_proxy_args(proxys=False))
+        r.check_response(count=2, http_status=200)
+        assert r.total_connects == 1, r.dump_logs()
diff --git a/third-party/curl/tests/http/test_11_unix.py b/third-party/curl/tests/http/test_11_unix.py
index dc2684adb1..774a7737c9 100644
--- a/third-party/curl/tests/http/test_11_unix.py
+++ b/third-party/curl/tests/http/test_11_unix.py
@@ -28,18 +28,21 @@ import logging
 import os
 import socket
 from threading import Thread
+from typing import Generator
+
 import pytest
-
-from testenv import Env, CurlClient
-
+from testenv import CurlClient, Env
 
 log = logging.getLogger(__name__)
 
+
 class UDSFaker:
 
     def __init__(self, path):
         self._uds_path = path
         self._done = False
+        self._socket = None
+        self._thread = None
 
     @property
     def path(self):
@@ -69,7 +72,7 @@ class UDSFaker:
             try:
                 c, client_address = self._socket.accept()
                 try:
-                    data = c.recv(16)
+                    c.recv(16)
                     c.sendall("""HTTP/1.1 200 Ok
 Server: UdsFaker
 Content-Type: application/json
@@ -81,20 +84,22 @@ Content-Length: 19
 
             except ConnectionAbortedError:
                 self._done = True
+            except OSError:
+                self._done = True
 
 
 class TestUnix:
 
     @pytest.fixture(scope="class")
-    def uds_faker(self, env: Env) -> UDSFaker:
+    def uds_faker(self, env: Env) -> Generator[UDSFaker, None, None]:
         uds_path = os.path.join(env.gen_dir, 'uds_11.sock')
         faker = UDSFaker(path=uds_path)
         faker.start()
         yield faker
         faker.stop()
 
-    # download http: via unix socket
-    def test_11_01_unix_connect_http(self, env: Env, httpd, uds_faker, repeat):
+    # download http: via Unix socket
+    def test_11_01_unix_connect_http(self, env: Env, httpd, uds_faker):
         curl = CurlClient(env=env)
         url = f'http://{env.domain1}:{env.http_port}/data.json'
         r = curl.http_download(urls=[url], with_stats=True,
@@ -102,10 +107,12 @@ class TestUnix:
                                  '--unix-socket', uds_faker.path,
                                ])
         r.check_response(count=1, http_status=200)
+        assert r.stats[0]['remote_port'] == -1, f'{r.dump_logs()}'
+        assert r.stats[0]['local_port'] == -1, f'{r.dump_logs()}'
 
-    # download https: via unix socket
-    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason=f"curl without SSL")
-    def test_11_02_unix_connect_http(self, env: Env, httpd, uds_faker, repeat):
+    # download https: via Unix socket
+    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason="curl without SSL")
+    def test_11_02_unix_connect_http(self, env: Env, httpd, uds_faker):
         curl = CurlClient(env=env)
         url = f'https://{env.domain1}:{env.https_port}/data.json'
         r = curl.http_download(urls=[url], with_stats=True,
@@ -113,10 +120,12 @@ class TestUnix:
                                  '--unix-socket', uds_faker.path,
                                ])
         r.check_response(exitcode=35, http_status=None)
+        assert r.stats[0]['remote_port'] == -1, f'{r.dump_logs()}'
+        assert r.stats[0]['local_port'] == -1, f'{r.dump_logs()}'
 
-    # download HTTP/3 via unix socket
+    # download HTTP/3 via Unix socket
     @pytest.mark.skipif(condition=not Env.have_h3(), reason='h3 not supported')
-    def test_11_03_unix_connect_quic(self, env: Env, httpd, uds_faker, repeat):
+    def test_11_03_unix_connect_quic(self, env: Env, httpd, uds_faker):
         curl = CurlClient(env=env)
         url = f'https://{env.domain1}:{env.https_port}/data.json'
         r = curl.http_download(urls=[url], with_stats=True,
@@ -125,3 +134,18 @@ class TestUnix:
                                  '--unix-socket', uds_faker.path,
                                ])
         r.check_response(exitcode=96, http_status=None)
+        assert r.stats[0]['remote_port'] == -1, f'{r.dump_logs()}'
+        assert r.stats[0]['local_port'] == -1, f'{r.dump_logs()}'
+
+    # download http: via Unix socket, ignore proxy args
+    def test_11_04_unix_connect_http(self, env: Env, httpd, uds_faker):
+        curl = CurlClient(env=env)
+        url = f'http://{env.domain1}:{env.http_port}/data.json'
+        xargs = curl.get_proxy_args(proto='http/1.1', use_ip=True, proxys=False)
+        xargs.extend([
+            '--unix-socket', uds_faker.path,
+        ])
+        r = curl.http_download(urls=[url], with_stats=True, extra_args=xargs)
+        r.check_response(count=1, http_status=200)
+        assert r.stats[0]['remote_port'] == -1, f'{r.dump_logs()}'
+        assert r.stats[0]['local_port'] == -1, f'{r.dump_logs()}'
diff --git a/third-party/curl/tests/http/test_12_reuse.py b/third-party/curl/tests/http/test_12_reuse.py
index 83bfadfe4a..8ff062d6dc 100644
--- a/third-party/curl/tests/http/test_12_reuse.py
+++ b/third-party/curl/tests/http/test_12_reuse.py
@@ -24,31 +24,25 @@
 #
 ###########################################################################
 #
-import difflib
-import filecmp
 import logging
-import os
+
 import pytest
-
-from testenv import Env, CurlClient
-
+from testenv import CurlClient, Env
 
 log = logging.getLogger(__name__)
 
 
-@pytest.mark.skipif(condition=Env.curl_uses_lib('bearssl'), reason='BearSSL too slow')
-@pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason=f"curl without SSL")
+@pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason="curl without SSL")
 class TestReuse:
 
     # check if HTTP/1.1 handles 'Connection: close' correctly
     @pytest.mark.parametrize("proto", ['http/1.1'])
-    def test_12_01_h1_conn_close(self, env: Env,
-                                 httpd, nghttpx, repeat, proto):
-        httpd.clear_extra_configs()
+    def test_12_01_h1_conn_close(self, env: Env, httpd, configures_httpd, nghttpx, proto):
+        httpd.reset_config()
         httpd.set_extra_config('base', [
-            f'MaxKeepAliveRequests 1',
+            'MaxKeepAliveRequests 1',
         ])
-        httpd.reload()
+        httpd.reload_if_config_changed()
         count = 100
         curl = CurlClient(env=env)
         urln = f'https://{env.authority_for(env.domain1, proto)}/data.json?[0-{count-1}]'
@@ -59,14 +53,15 @@ class TestReuse:
         delta = 5
         assert (count/2 - delta) < r.total_connects < (count/2 + delta)
 
+    @pytest.mark.skipif(condition=Env.httpd_is_at_least('2.5.0'),
+                        reason="httpd 2.5+ handles KeepAlives different")
     @pytest.mark.parametrize("proto", ['http/1.1'])
-    def test_12_02_h1_conn_timeout(self, env: Env,
-                                   httpd, nghttpx, repeat, proto):
-        httpd.clear_extra_configs()
+    def test_12_02_h1_conn_timeout(self, env: Env, httpd, configures_httpd, nghttpx, proto):
+        httpd.reset_config()
         httpd.set_extra_config('base', [
-            f'KeepAliveTimeout 1',
+            'KeepAliveTimeout 1',
         ])
-        httpd.reload()
+        httpd.reload_if_config_changed()
         count = 5
         curl = CurlClient(env=env)
         urln = f'https://{env.authority_for(env.domain1, proto)}/data.json?[0-{count-1}]'
diff --git a/third-party/curl/tests/http/test_13_proxy_auth.py b/third-party/curl/tests/http/test_13_proxy_auth.py
index abeae0100e..50e4596057 100644
--- a/third-party/curl/tests/http/test_13_proxy_auth.py
+++ b/third-party/curl/tests/http/test_13_proxy_auth.py
@@ -24,15 +24,12 @@
 #
 ###########################################################################
 #
-import filecmp
 import logging
 import os
 import re
-import time
+
 import pytest
-
-from testenv import Env, CurlClient, ExecResult
-
+from testenv import CurlClient, Env, ExecResult
 
 log = logging.getLogger(__name__)
 
@@ -41,27 +38,20 @@ log = logging.getLogger(__name__)
                     reason=f"missing: {Env.incomplete_reason()}")
 class TestProxyAuth:
 
-    @pytest.fixture(autouse=True, scope='class')
-    def _class_scope(self, env, httpd, nghttpx_fwd):
-        if env.have_nghttpx():
-            nghttpx_fwd.start_if_needed()
-        httpd.clear_extra_configs()
+    def httpd_configure(self, env, httpd):
         httpd.set_proxy_auth(True)
-        httpd.reload()
-        yield
-        httpd.set_proxy_auth(False)
-        httpd.reload()
+        httpd.reload_if_config_changed()
 
     def get_tunnel_proto_used(self, r: ExecResult):
         for line in r.trace_lines:
-            m = re.match(r'.* CONNECT tunnel: (\S+) negotiated$', line)
+            m = re.match(r'.* CONNECT: \'(\S+)\' negotiated$', line)
             if m:
                 return m.group(1)
         assert False, f'tunnel protocol not found in:\n{"".join(r.trace_lines)}'
-        return None
 
     # download via http: proxy (no tunnel), no auth
-    def test_13_01_proxy_no_auth(self, env: Env, httpd, repeat):
+    def test_13_01_proxy_no_auth(self, env: Env, httpd, configures_httpd):
+        self.httpd_configure(env, httpd)
         curl = CurlClient(env=env)
         url = f'http://localhost:{env.http_port}/data.json'
         r = curl.http_download(urls=[url], alpn_proto='http/1.1', with_stats=True,
@@ -69,7 +59,8 @@ class TestProxyAuth:
         r.check_response(count=1, http_status=407)
 
     # download via http: proxy (no tunnel), auth
-    def test_13_02_proxy_auth(self, env: Env, httpd, repeat):
+    def test_13_02_proxy_auth(self, env: Env, httpd, configures_httpd):
+        self.httpd_configure(env, httpd)
         curl = CurlClient(env=env)
         url = f'http://localhost:{env.http_port}/data.json'
         xargs = curl.get_proxy_args(proxys=False)
@@ -81,7 +72,8 @@ class TestProxyAuth:
     @pytest.mark.skipif(condition=not Env.curl_has_feature('HTTPS-proxy'),
                         reason='curl lacks HTTPS-proxy support')
     @pytest.mark.skipif(condition=not Env.have_nghttpx(), reason="no nghttpx available")
-    def test_13_03_proxys_no_auth(self, env: Env, httpd, nghttpx_fwd, repeat):
+    def test_13_03_proxys_no_auth(self, env: Env, httpd, configures_httpd, nghttpx_fwd):
+        self.httpd_configure(env, httpd)
         curl = CurlClient(env=env)
         url = f'http://localhost:{env.http_port}/data.json'
         xargs = curl.get_proxy_args(proxys=True)
@@ -92,7 +84,8 @@ class TestProxyAuth:
     @pytest.mark.skipif(condition=not Env.curl_has_feature('HTTPS-proxy'),
                         reason='curl lacks HTTPS-proxy support')
     @pytest.mark.skipif(condition=not Env.have_nghttpx(), reason="no nghttpx available")
-    def test_13_04_proxys_auth(self, env: Env, httpd, nghttpx_fwd, repeat):
+    def test_13_04_proxys_auth(self, env: Env, httpd, configures_httpd, nghttpx_fwd):
+        self.httpd_configure(env, httpd)
         curl = CurlClient(env=env)
         url = f'http://localhost:{env.http_port}/data.json'
         xargs = curl.get_proxy_args(proxys=True)
@@ -101,16 +94,18 @@ class TestProxyAuth:
                                extra_args=xargs)
         r.check_response(count=1, http_status=200)
 
-    def test_13_05_tunnel_http_no_auth(self, env: Env, httpd, repeat):
+    def test_13_05_tunnel_http_no_auth(self, env: Env, httpd, configures_httpd, nghttpx_fwd):
+        self.httpd_configure(env, httpd)
         curl = CurlClient(env=env)
         url = f'http://localhost:{env.http_port}/data.json'
         xargs = curl.get_proxy_args(proxys=False, tunnel=True)
         r = curl.http_download(urls=[url], alpn_proto='http/1.1', with_stats=True,
                                extra_args=xargs)
         # expect "COULD_NOT_CONNECT"
-        r.check_response(exitcode=56, http_status=None)
+        r.check_response(exitcode=7, http_status=None)
 
-    def test_13_06_tunnel_http_auth(self, env: Env, httpd, repeat):
+    def test_13_06_tunnel_http_auth(self, env: Env, httpd, configures_httpd):
+        self.httpd_configure(env, httpd)
         curl = CurlClient(env=env)
         url = f'http://localhost:{env.http_port}/data.json'
         xargs = curl.get_proxy_args(proxys=False, tunnel=True)
@@ -122,9 +117,12 @@ class TestProxyAuth:
     @pytest.mark.skipif(condition=not Env.have_nghttpx(), reason="no nghttpx available")
     @pytest.mark.skipif(condition=not Env.curl_has_feature('HTTPS-proxy'),
                         reason='curl lacks HTTPS-proxy support')
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2'])
-    @pytest.mark.parametrize("tunnel", ['http/1.1', 'h2'])
-    def test_13_07_tunnels_no_auth(self, env: Env, httpd, proto, tunnel, repeat):
+    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    @pytest.mark.parametrize("tunnel", Env.http_h1_h2_protos())
+    def test_13_07_tunnels_no_auth(self, env: Env, httpd, configures_httpd, nghttpx_fwd, proto, tunnel):
+        self.httpd_configure(env, httpd)
         if tunnel == 'h2' and not env.curl_uses_lib('nghttp2'):
             pytest.skip('only supported with nghttp2')
         curl = CurlClient(env=env)
@@ -133,16 +131,18 @@ class TestProxyAuth:
         r = curl.http_download(urls=[url], alpn_proto=proto, with_stats=True,
                                extra_args=xargs)
         # expect "COULD_NOT_CONNECT"
-        r.check_response(exitcode=56, http_status=None)
-        assert self.get_tunnel_proto_used(r) == 'HTTP/2' \
-            if tunnel == 'h2' else 'HTTP/1.1'
+        r.check_response(exitcode=7, http_status=None)
+        assert self.get_tunnel_proto_used(r) == tunnel
 
     @pytest.mark.skipif(condition=not Env.have_nghttpx(), reason="no nghttpx available")
     @pytest.mark.skipif(condition=not Env.curl_has_feature('HTTPS-proxy'),
                         reason='curl lacks HTTPS-proxy support')
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2'])
-    @pytest.mark.parametrize("tunnel", ['http/1.1', 'h2'])
-    def test_13_08_tunnels_auth(self, env: Env, httpd, proto, tunnel, repeat):
+    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    @pytest.mark.parametrize("tunnel", Env.http_h1_h2_protos())
+    def test_13_08_tunnels_auth(self, env: Env, httpd, configures_httpd, nghttpx_fwd, proto, tunnel):
+        self.httpd_configure(env, httpd)
         if tunnel == 'h2' and not env.curl_uses_lib('nghttp2'):
             pytest.skip('only supported with nghttp2')
         curl = CurlClient(env=env)
@@ -153,5 +153,37 @@ class TestProxyAuth:
                                extra_args=xargs)
         r.check_response(count=1, http_status=200,
                          protocol='HTTP/2' if proto == 'h2' else 'HTTP/1.1')
-        assert self.get_tunnel_proto_used(r) == 'HTTP/2' \
-            if tunnel == 'h2' else 'HTTP/1.1'
+        assert self.get_tunnel_proto_used(r) == tunnel
+
+    @pytest.mark.skipif(condition=not Env.curl_has_feature('SPNEGO'),
+                        reason='curl lacks SPNEGO support')
+    def test_13_09_negotiate_http(self, env: Env, httpd, configures_httpd):
+        self.httpd_configure(env, httpd)
+        run_env = os.environ.copy()
+        run_env['https_proxy'] = f'http://127.0.0.1:{env.proxy_port}'
+        curl = CurlClient(env=env, run_env=run_env)
+        url = f'https://localhost:{env.https_port}/data.json'
+        r1 = curl.http_download(urls=[url], alpn_proto='http/1.1', with_stats=True, extra_args=[
+            '--negotiate', '--proxy-user', 'proxy:proxy'
+        ])
+        r1.check_response(count=1, http_status=200)
+
+    def test_13_10_tunnels_mixed_auth(self, env: Env, httpd, configures_httpd):
+        self.httpd_configure(env, httpd)
+        curl = CurlClient(env=env)
+        url1 = f'http://localhost:{env.http_port}/data.json?1'
+        url2 = f'http://localhost:{env.http_port}/data.json?2'
+        url3 = f'http://localhost:{env.http_port}/data.json?3'
+        xargs1 = curl.get_proxy_args(proxys=False, tunnel=True)
+        xargs1.extend(['--proxy-user', 'proxy:proxy']) # good auth
+        xargs2 = curl.get_proxy_args(proxys=False, tunnel=True)
+        xargs2.extend(['--proxy-user', 'ungood:ungood']) # bad auth
+        xargs3 = curl.get_proxy_args(proxys=False, tunnel=True)
+        # no auth
+        r = curl.http_download(urls=[url1, url2, url3], alpn_proto='http/1.1', with_stats=True,
+                               url_options={url1: xargs1, url2: xargs2, url3: xargs3})
+        # only url1 succeeds, others fail, no connection reuse
+        assert r.stats[0]['http_code'] == 200, f'{r.dump_logs()}'
+        assert r.stats[1]['http_code'] == 0, f'{r.dump_logs()}'
+        assert r.stats[2]['http_code'] == 0, f'{r.dump_logs()}'
+        assert r.total_connects == 3, f'{r.dump_logs()}'
diff --git a/third-party/curl/tests/http/test_14_auth.py b/third-party/curl/tests/http/test_14_auth.py
index 0cc0f925f2..69866baedf 100644
--- a/third-party/curl/tests/http/test_14_auth.py
+++ b/third-party/curl/tests/http/test_14_auth.py
@@ -24,14 +24,11 @@
 #
 ###########################################################################
 #
-import difflib
-import filecmp
 import logging
 import os
+
 import pytest
-
-from testenv import Env, CurlClient, LocalClient
-
+from testenv import CurlClient, Env
 
 log = logging.getLogger(__name__)
 
@@ -40,27 +37,21 @@ class TestAuth:
 
     @pytest.fixture(autouse=True, scope='class')
     def _class_scope(self, env, httpd, nghttpx):
-        if env.have_h3():
-            nghttpx.start_if_needed()
-        env.make_data_file(indir=env.gen_dir, fname="data-10m", fsize=10*1024*1024)
-        httpd.clear_extra_configs()
-        httpd.reload()
+        env.make_data_file(indir=env.gen_dir, fname="data-10m", fsize=10 * 1024 * 1024)
 
     # download 1 file, not authenticated
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_14_01_digest_get_noauth(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_14_01_digest_get_noauth(self, env: Env, httpd, nghttpx, proto):
         curl = CurlClient(env=env)
         url = f'https://{env.authority_for(env.domain1, proto)}/restricted/digest/data.json'
         r = curl.http_download(urls=[url], alpn_proto=proto)
         r.check_response(http_status=401)
 
     # download 1 file, authenticated
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_14_02_digest_get_auth(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_14_02_digest_get_auth(self, env: Env, httpd, nghttpx, proto):
+        if not env.curl_has_feature('digest'):
+            pytest.skip("curl built without digest")
         curl = CurlClient(env=env)
         url = f'https://{env.authority_for(env.domain1, proto)}/restricted/digest/data.json'
         r = curl.http_download(urls=[url], alpn_proto=proto, extra_args=[
@@ -69,10 +60,10 @@ class TestAuth:
         r.check_response(http_status=200)
 
     # PUT data, authenticated
-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
-    def test_14_03_digest_put_auth(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_14_03_digest_put_auth(self, env: Env, httpd, nghttpx, proto):
+        if not env.curl_has_feature('digest'):
+            pytest.skip("curl built without digest")
         data='0123456789'
         curl = CurlClient(env=env)
         url = f'https://{env.authority_for(env.domain1, proto)}/restricted/digest/data.json'
@@ -82,10 +73,10 @@ class TestAuth:
         r.check_response(http_status=200)
 
     # PUT data, digest auth large pw
-    @pytest.mark.parametrize("proto", ['h2', 'h3'])
-    def test_14_04_digest_large_pw(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_14_04_digest_large_pw(self, env: Env, httpd, nghttpx, proto):
+        if not env.curl_has_feature('digest'):
+            pytest.skip("curl built without digest")
         data='0123456789'
         password = 'x' * 65535
         curl = CurlClient(env=env)
@@ -99,14 +90,12 @@ class TestAuth:
         r.check_response(http_status=401)
 
     # PUT data, basic auth large pw
-    @pytest.mark.parametrize("proto", ['h2', 'h3'])
-    def test_14_05_basic_large_pw(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
-        if proto == 'h3' and env.curl_uses_lib('quiche'):
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_14_05_basic_large_pw(self, env: Env, httpd, nghttpx, proto):
+        if proto == 'h3' and not env.curl_uses_lib('ngtcp2'):
             # See <https://github.com/cloudflare/quiche/issues/1573>
             pytest.skip("quiche has problems with large requests")
-        # just large enough that nghttp2 will submit
+        # large enough that nghttp2 will submit
         password = 'x' * (47 * 1024)
         fdata = os.path.join(env.gen_dir, 'data-10m')
         curl = CurlClient(env=env)
@@ -115,14 +104,13 @@ class TestAuth:
             '--basic', '--user', f'test:{password}',
             '--trace-config', 'http/2,http/3'
         ])
-        # but apache denies on length limit
-        r.check_response(http_status=431)
+        # but apache either denies on length limit or gives a 400
+        r.check_exit_code(0)
+        assert r.stats[0]['http_code'] in [400, 431]
 
     # PUT data, basic auth with very large pw
-    @pytest.mark.parametrize("proto", ['h2', 'h3'])
-    def test_14_06_basic_very_large_pw(self, env: Env, httpd, nghttpx, repeat, proto):
-        if proto == 'h3' and not env.have_h3():
-            pytest.skip("h3 not supported")
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_14_06_basic_very_large_pw(self, env: Env, httpd, nghttpx, proto):
         if proto == 'h3' and env.curl_uses_lib('quiche'):
             # See <https://github.com/cloudflare/quiche/issues/1573>
             pytest.skip("quiche has problems with large requests")
@@ -133,5 +121,7 @@ class TestAuth:
         r = curl.http_upload(urls=[url], data=f'@{fdata}', alpn_proto=proto, extra_args=[
             '--basic', '--user', f'test:{password}'
         ])
-        # request was never sent
-        r.check_response(exitcode=55, http_status=0)
+        # Depending on protocol, we might have an error sending or
+        # the server might shutdown the connection and we see the error
+        # on receiving
+        assert r.exit_code in [55, 56, 95], f'{r.dump_logs()}'
diff --git a/third-party/curl/tests/http/test_15_tracing.py b/third-party/curl/tests/http/test_15_tracing.py
index a826044232..d1bcc22273 100644
--- a/third-party/curl/tests/http/test_15_tracing.py
+++ b/third-party/curl/tests/http/test_15_tracing.py
@@ -27,13 +27,13 @@
 import logging
 import re
 
-from testenv import Env
-from testenv import CurlClient
-
+import pytest
+from testenv import CurlClient, Env
 
 log = logging.getLogger(__name__)
 
 
+@pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
 class TestTracing:
 
     # default verbose output
@@ -75,6 +75,8 @@ class TestTracing:
 
     # trace all
     def test_15_04_trace_all(self, env: Env, httpd):
+        if not env.curl_is_verbose():
+            pytest.skip('only works for curl with verbose strings')
         curl = CurlClient(env=env)
         url = f'http://{env.domain1}:{env.http_port}/data.json'
         r = curl.http_get(url=url, def_tracing=False, extra_args=[
@@ -86,11 +88,10 @@ class TestTracing:
             m = re.match(r'^([0-9:.]+) \[0-[0x]] .+', line)
             if m is None:
                 assert False, f'no match: {line}'
-            m = re.match(r'^([0-9:.]+) \[0-[0x]] . \[TCP].+', line)
+            m = re.match(r'^([0-9:.]+) \[0-[0x]] .+ \[TCP].+', line)
             if m is not None:
                 found_tcp = True
-        if not found_tcp:
-            assert False, f'TCP filter does not appear in trace "all": {r.stderr}'
+        assert found_tcp, f'TCP filter does not appear in trace "all": {r.stderr}'
 
     # trace all, no TCP, no time
     def test_15_05_trace_all(self, env: Env, httpd):
diff --git a/third-party/curl/tests/http/test_16_info.py b/third-party/curl/tests/http/test_16_info.py
new file mode 100644
index 0000000000..977342eb55
--- /dev/null
+++ b/third-party/curl/tests/http/test_16_info.py
@@ -0,0 +1,122 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+import logging
+import os
+
+import pytest
+from testenv import CurlClient, Env
+
+log = logging.getLogger(__name__)
+
+
+class TestInfo:
+
+    @pytest.fixture(autouse=True, scope='class')
+    def _class_scope(self, env, httpd):
+        indir = httpd.docs_dir
+        env.make_data_file(indir=indir, fname="data-10k", fsize=10 * 1024)
+        env.make_data_file(indir=indir, fname="data-100k", fsize=100 * 1024)
+        env.make_data_file(indir=indir, fname="data-1m", fsize=1024 * 1024)
+        env.make_data_file(indir=env.gen_dir, fname="data-100k", fsize=100 * 1024)
+
+    # download plain file
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_16_01_info_download(self, env: Env, httpd, nghttpx, proto):
+        count = 2
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/data.json?[0-{count-1}]'
+        r = curl.http_download(urls=[url], alpn_proto=proto, with_stats=True)
+        r.check_stats(count=count, http_status=200, exitcode=0,
+                      remote_port=env.port_for(alpn_proto=proto),
+                      remote_ip='127.0.0.1')
+        for idx, s in enumerate(r.stats):
+            self.check_stat(idx, s, r, dl_size=30, ul_size=0)
+            r.check_stats_timeline(idx)
+
+    # download plain file with a 302 redirect
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_16_02_info_302_download(self, env: Env, httpd, nghttpx, proto):
+        count = 2
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/data.json.302?[0-{count-1}]'
+        r = curl.http_download(urls=[url], alpn_proto=proto, with_stats=True, extra_args=[
+            '--location'
+        ])
+        r.check_stats(count=count, http_status=200, exitcode=0,
+                      remote_port=env.port_for(alpn_proto=proto),
+                      remote_ip='127.0.0.1')
+        for idx, s in enumerate(r.stats):
+            self.check_stat(idx, s, r, dl_size=30, ul_size=0)
+            r.check_stats_timeline(idx)
+
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_16_03_info_upload(self, env: Env, httpd, nghttpx, proto):
+        count = 2
+        fdata = os.path.join(env.gen_dir, 'data-100k')
+        fsize = 100 * 1024
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=[0-{count-1}]'
+        r = curl.http_upload(urls=[url], data=f'@{fdata}', alpn_proto=proto,
+                             with_headers=True, extra_args=[
+                                '--trace-config', 'http/2,http/3'
+                             ])
+        r.check_response(count=count, http_status=200)
+        r.check_stats(count=count, http_status=200, exitcode=0,
+                      remote_port=env.port_for(alpn_proto=proto),
+                      remote_ip='127.0.0.1')
+        for idx, s in enumerate(r.stats):
+            self.check_stat(idx, s, r, dl_size=fsize, ul_size=fsize)
+            r.check_stats_timeline(idx)
+
+    # download plain file via http: ('time_appconnect' is 0)
+    @pytest.mark.parametrize("proto", ['http/1.1'])
+    def test_16_04_info_http_download(self, env: Env, httpd, nghttpx, proto):
+        count = 2
+        curl = CurlClient(env=env)
+        url = f'http://{env.domain1}:{env.http_port}/data.json?[0-{count-1}]'
+        r = curl.http_download(urls=[url], alpn_proto=proto, with_stats=True)
+        r.check_stats(count=count, http_status=200, exitcode=0,
+                      remote_port=env.http_port, remote_ip='127.0.0.1')
+        for idx, s in enumerate(r.stats):
+            self.check_stat(idx, s, r, dl_size=30, ul_size=0)
+            r.check_stats_timeline(idx)
+
+    def check_stat(self, idx, s, r, dl_size=None, ul_size=None):
+        # we always send something
+        self.check_stat_positive(s, idx, 'size_request')
+        # we always receive response headers
+        self.check_stat_positive(s, idx, 'size_header')
+        if ul_size is not None:
+            assert s['size_upload'] == ul_size, f'stat #{idx}\n{r.dump_logs()}'  # the file we sent
+        assert s['size_request'] >= s['size_upload'], \
+            f'stat #{idx}, "size_request" smaller than "size_upload", {s}\n{r.dump_logs()}'
+        if dl_size is not None:
+            assert s['size_download'] == dl_size, f'stat #{idx}\n{r.dump_logs()}'  # the file we received
+
+    def check_stat_positive(self, s, idx, key):
+        assert key in s, f'stat #{idx} "{key}" missing: {s}'
+        assert s[key] > 0, f'stat #{idx} "{key}" not positive: {s}'
diff --git a/third-party/curl/tests/http/test_17_ssl_use.py b/third-party/curl/tests/http/test_17_ssl_use.py
new file mode 100644
index 0000000000..4179925f42
--- /dev/null
+++ b/third-party/curl/tests/http/test_17_ssl_use.py
@@ -0,0 +1,601 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+import json
+import logging
+import os
+import re
+
+import pytest
+from testenv import CurlClient, Env, LocalClient
+
+log = logging.getLogger(__name__)
+
+
+class TLSDefs:
+    TLS_VERSIONS = ['TLSv1', 'TLSv1.1', 'TLSv1.2', 'TLSv1.3']
+    TLS_VERSION_IDS = {
+        'TLSv1': 0x301,
+        'TLSv1.1': 0x302,
+        'TLSv1.2': 0x303,
+        'TLSv1.3': 0x304
+    }
+    CURL_ARG_MIN_VERSION_ID = {
+        'none': 0x0,
+        'tlsv1': 0x301,
+        'tlsv1.0': 0x301,
+        'tlsv1.1': 0x302,
+        'tlsv1.2': 0x303,
+        'tlsv1.3': 0x304,
+    }
+    CURL_ARG_MAX_VERSION_ID = {
+        'none': 0x0,
+        '1.0': 0x301,
+        '1.1': 0x302,
+        '1.2': 0x303,
+        '1.3': 0x304,
+    }
+
+
+class TestSSLUse:
+
+    @pytest.fixture(autouse=True, scope='class')
+    def _class_scope(self, env, httpd, nghttpx):
+        env.make_data_file(indir=httpd.docs_dir, fname="data-10k", fsize=10 * 1024)
+
+    def test_17_01_sslinfo_plain(self, env: Env, httpd):
+        proto = 'http/1.1'
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
+        r = curl.http_get(url=url, alpn_proto=proto)
+        assert r.json['HTTPS'] == 'on', f'{r.json}'
+        assert 'SSL_SESSION_ID' in r.json, f'{r.json}'
+        assert 'SSL_SESSION_RESUMED' in r.json, f'{r.json}'
+        assert r.json['SSL_SESSION_RESUMED'] == 'Initial', f'{r.json}'
+
+    @pytest.mark.parametrize("tls_max", ['1.2', '1.3'])
+    def test_17_02_sslinfo_reconnect(self, env: Env, tls_max, httpd):
+        proto = 'http/1.1'
+        count = 3
+        exp_resumed = 'Resumed'
+        xargs = ['--sessionid', '--tls-max', tls_max, f'--tlsv{tls_max}']
+        if env.curl_uses_lib('libressl'):
+            if tls_max == '1.3':
+                exp_resumed = 'Initial'  # 1.2 works in LibreSSL, but 1.3 does not, TODO
+        if env.curl_uses_lib('rustls-ffi'):
+            exp_resumed = 'Initial'  # Rustls does not support sessions, TODO
+        if env.curl_uses_lib('mbedtls') and tls_max == '1.3' and \
+           not env.curl_lib_version_at_least('mbedtls', '3.6.0'):
+            pytest.skip('mbedtls TLSv1.3 session resume not working in 3.6.0')
+
+        run_env = os.environ.copy()
+        run_env['CURL_DEBUG'] = 'ssl'
+        curl = CurlClient(env=env, run_env=run_env)
+        # tell the server to close the connection after each request
+        urln = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo?'\
+            f'id=[0-{count-1}]&close'
+        r = curl.http_download(urls=[urln], alpn_proto=proto, with_stats=True,
+                               extra_args=xargs)
+        r.check_response(count=count, http_status=200)
+        # should have used one connection for each request, sessions after
+        # first should have been resumed
+        assert r.total_connects == count, r.dump_logs()
+        for i in range(count):
+            dfile = curl.download_file(i)
+            assert os.path.exists(dfile)
+            with open(dfile) as f:
+                djson = json.load(f)
+            assert djson['HTTPS'] == 'on', f'{i}: {djson}'
+            if i == 0:
+                assert djson['SSL_SESSION_RESUMED'] == 'Initial', f'{i}: {djson}\n{r.dump_logs()}'
+            else:
+                assert djson['SSL_SESSION_RESUMED'] == exp_resumed, f'{i}: {djson}\n{r.dump_logs()}'
+
+    # use hostname with trailing dot, verify handshake
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_17_03_trailing_dot(self, env: Env, proto, httpd, nghttpx):
+        curl = CurlClient(env=env)
+        domain = f'{env.domain1}.'
+        url = f'https://{env.authority_for(domain, proto)}/curltest/sslinfo'
+        r = curl.http_get(url=url, alpn_proto=proto)
+        assert r.exit_code == 0, f'{r}'
+        assert r.json, f'{r}'
+        if proto != 'h3':  # we proxy h3
+            # the SNI the server received is without trailing dot
+            assert r.json['SSL_TLS_SNI'] == env.domain1, f'{r.json}'
+
+    # use hostname with double trailing dot
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_17_04_double_dot(self, env: Env, proto, httpd, nghttpx):
+        curl = CurlClient(env=env)
+        domain = f'{env.domain1}..'
+        url = f'https://{env.authority_for(domain, proto)}/curltest/sslinfo'
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
+            '-H', f'Host: {env.domain1}',
+        ])
+        if r.exit_code == 0:
+            assert r.json, f'{r.stdout}'
+            # the SNI the server received is without trailing dot
+            if proto != 'h3':  # we proxy h3
+                assert r.json['SSL_TLS_SNI'] == env.domain1, f'{r.json}'
+            assert False, f'should not have succeeded: {r.json}'
+        # 3 - not allowed in the URL
+        assert r.exit_code in [3], f'{r}'
+
+    # use ip address for connect
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_17_05_good_ip_addr(self, env: Env, proto, httpd, nghttpx):
+        if env.curl_uses_lib('mbedtls'):
+            pytest.skip("mbedTLS does use IP addresses in SNI")
+        curl = CurlClient(env=env)
+        domain = '127.0.0.1'
+        url = f'https://{env.authority_for(domain, proto)}/curltest/sslinfo'
+        r = curl.http_get(url=url, alpn_proto=proto)
+        assert r.exit_code == 0, f'{r}'
+        assert r.json, f'{r}'
+        if proto != 'h3':  # we proxy h3
+            # the SNI should not have been used
+            assert 'SSL_TLS_SNI' not in r.json, f'{r.json}'
+
+    # use IP address that is not in cert
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_17_05_bad_ip_addr(self, env: Env, proto,
+                               httpd, configures_httpd,
+                               nghttpx, configures_nghttpx):
+        httpd.set_domain1_cred_name('domain1-no-ip')
+        httpd.reload_if_config_changed()
+        if proto == 'h3':
+            nghttpx.set_cred_name('domain1-no-ip')
+            nghttpx.reload_if_config_changed()
+        curl = CurlClient(env=env)
+        url = f'https://127.0.0.1:{env.port_for(proto)}/curltest/sslinfo'
+        r = curl.http_get(url=url, alpn_proto=proto)
+        assert r.exit_code == 60, f'{r}'
+
+    # use IP address that is in cert as DNS name (not really legal)
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_17_05_very_bad_ip_addr(self, env: Env, proto,
+                                    httpd, configures_httpd,
+                                    nghttpx, configures_nghttpx):
+        if env.curl_uses_lib('mbedtls'):
+            pytest.skip("mbedtls falsely verifies a DNS: altname as IP address")
+        if env.curl_uses_lib('wolfssl') and \
+           env.curl_lib_version_before('wolfssl', '5.8.4'):
+            pytest.skip("wolfSSL falsely verifies a DNS: altname as IP address in 5.8.2 and before")
+        httpd.set_domain1_cred_name('domain1-very-bad')
+        httpd.reload_if_config_changed()
+        if proto == 'h3':
+            nghttpx.set_cred_name('domain1-very-bad')
+            nghttpx.reload_if_config_changed()
+        curl = CurlClient(env=env)
+        url = f'https://127.0.0.1:{env.port_for(proto)}/curltest/sslinfo'
+        r = curl.http_get(url=url, alpn_proto=proto)
+        assert r.exit_code == 60, f'{r}'
+
+    # use localhost for connect
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_17_06_localhost(self, env: Env, proto, httpd, nghttpx):
+        curl = CurlClient(env=env)
+        domain = 'localhost'
+        url = f'https://{env.authority_for(domain, proto)}/curltest/sslinfo'
+        r = curl.http_get(url=url, alpn_proto=proto)
+        assert r.exit_code == 0, f'{r}'
+        assert r.json, f'{r}'
+        if proto != 'h3':  # we proxy h3
+            assert r.json['SSL_TLS_SNI'] == domain, f'{r.json}'
+
+    @staticmethod
+    def gen_test_17_07_list():
+        tls13_tests = [
+            ['def', None, True],
+            ['AES128SHA256', ['TLS_AES_128_GCM_SHA256'], True],
+            ['AES128SHA384', ['TLS_AES_256_GCM_SHA384'], False],
+            ['CHACHA20SHA256', ['TLS_CHACHA20_POLY1305_SHA256'], True],
+            ['AES128SHA384+CHACHA20SHA256', ['TLS_AES_256_GCM_SHA384', 'TLS_CHACHA20_POLY1305_SHA256'], True],
+        ]
+        tls12_tests = [
+            ['def', None, True],
+            ['AES128ish', ['ECDHE-ECDSA-AES128-GCM-SHA256', 'ECDHE-RSA-AES128-GCM-SHA256'], True],
+            ['AES256ish', ['ECDHE-ECDSA-AES256-GCM-SHA384', 'ECDHE-RSA-AES256-GCM-SHA384'], False],
+            ['CHACHA20ish', ['ECDHE-ECDSA-CHACHA20-POLY1305', 'ECDHE-RSA-CHACHA20-POLY1305'], True],
+            ['AES256ish+CHACHA20ish', ['ECDHE-ECDSA-AES256-GCM-SHA384', 'ECDHE-RSA-AES256-GCM-SHA384',
+              'ECDHE-ECDSA-CHACHA20-POLY1305', 'ECDHE-RSA-CHACHA20-POLY1305'], True],
+        ]
+        ret = []
+        for tls_id, tls_proto in {
+                'TLSv1.2+3': 'TLSv1.3 +TLSv1.2',
+                'TLSv1.3': 'TLSv1.3',
+                'TLSv1.2': 'TLSv1.2'}.items():
+            for [cid13, ciphers13, succeed13] in tls13_tests:
+                for [cid12, ciphers12, succeed12] in tls12_tests:
+                    id = f'{tls_id}-{cid13}-{cid12}'
+                    ret.append(pytest.param(tls_proto, ciphers13, ciphers12, succeed13, succeed12, id=id))
+        return ret
+
+    @pytest.mark.parametrize(
+        "tls_proto, ciphers13, ciphers12, succeed13, succeed12",
+        gen_test_17_07_list())
+    def test_17_07_ssl_ciphers(self, env: Env, httpd, configures_httpd,
+                               tls_proto, ciphers13, ciphers12,
+                               succeed13, succeed12):
+        # to test setting cipher suites, the AES 256 ciphers are disabled in the test server
+        httpd.set_extra_config('base', [
+            'SSLCipherSuite SSL' +
+            ' ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256' +
+            ':ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305',
+            'SSLCipherSuite TLSv1.3' +
+            ' TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256',
+            f'SSLProtocol {tls_proto}'
+        ])
+        httpd.reload_if_config_changed()
+        proto = 'http/1.1'
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
+        # SSL backend specifics
+        # see wolfSSL/wolfssl#9462
+        if env.curl_uses_lib('wolfssl') and env.curl_lib_version('wolfssl') == '5.8.4' \
+           and ciphers13 and 'TLS_CHACHA20_POLY1305_SHA256' in ciphers13:
+            pytest.skip('wolfSSL 5.8.4 is borked on ARM with CHACHA20')
+        if env.curl_uses_lib('gnutls'):
+            pytest.skip('GnuTLS does not support setting ciphers')
+        elif env.curl_uses_lib('boringssl'):
+            if ciphers13 is not None:
+                pytest.skip('BoringSSL does not support setting TLSv1.3 ciphers')
+        elif env.curl_uses_lib('schannel'):  # not in CI, so untested
+            if ciphers12 is not None:
+                pytest.skip('Schannel does not support setting TLSv1.2 ciphers by name')
+        elif env.curl_uses_lib('mbedtls') and not env.curl_lib_version_at_least('mbedtls', '3.6.0'):
+            if tls_proto == 'TLSv1.3':
+                pytest.skip('mbedTLS < 3.6.0 does not support TLSv1.3')
+        # test
+        extra_args = ['--tls13-ciphers', ':'.join(ciphers13)] if ciphers13 else []
+        extra_args += ['--ciphers', ':'.join(ciphers12)] if ciphers12 else []
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=extra_args)
+        if tls_proto != 'TLSv1.2' and succeed13:
+            assert r.exit_code == 0, r.dump_logs()
+            assert r.json['HTTPS'] == 'on', r.dump_logs()
+            assert r.json['SSL_PROTOCOL'] == 'TLSv1.3', r.dump_logs()
+            assert ciphers13 is None or r.json['SSL_CIPHER'] in ciphers13, r.dump_logs()
+        elif tls_proto == 'TLSv1.2' and succeed12:
+            assert r.exit_code == 0, r.dump_logs()
+            assert r.json['HTTPS'] == 'on', r.dump_logs()
+            assert r.json['SSL_PROTOCOL'] == 'TLSv1.2', r.dump_logs()
+            assert ciphers12 is None or r.json['SSL_CIPHER'] in ciphers12, r.dump_logs()
+        else:
+            assert r.exit_code != 0, r.dump_logs()
+
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_17_08_cert_status(self, env: Env, proto, httpd, nghttpx):
+        if not env.curl_can_cert_status():
+            pytest.skip("TLS library does not support --cert-status")
+        curl = CurlClient(env=env)
+        domain = 'localhost'
+        url = f'https://{env.authority_for(domain, proto)}/'
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
+            '--cert-status'
+        ])
+        # CURLE_SSL_INVALIDCERTSTATUS, our certs have no OCSP info
+        assert r.exit_code == 91, f'{r}'
+
+    @staticmethod
+    def gen_test_17_09_list():
+        return [
+            [server_tls, min_arg, max_arg]
+            for server_tls in TLSDefs.TLS_VERSIONS
+            for min_arg in TLSDefs.CURL_ARG_MIN_VERSION_ID
+            for max_arg in TLSDefs.CURL_ARG_MAX_VERSION_ID
+        ]
+
+    @pytest.mark.parametrize("server_tls, min_arg, max_arg", gen_test_17_09_list())
+    def test_17_09_ssl_min_max(self, env: Env, httpd, configures_httpd, server_tls, min_arg, max_arg):
+        # We test if curl using min/max versions arguments (and defaults) can connect
+        # to a server using 'server_tls' version only
+        httpd.set_extra_config('base', [
+            f'SSLProtocol {server_tls}',
+            'SSLCipherSuite ALL:@SECLEVEL=0',
+        ])
+        httpd.reload_if_config_changed()
+        # curl's TLS backend supported version
+        if env.curl_uses_lib('gnutls') or \
+           env.curl_uses_lib('quiche') or \
+           env.curl_uses_lib('aws-lc') or \
+           env.curl_uses_lib('boringssl'):
+            curl_supported = [0x301, 0x302, 0x303, 0x304]
+        elif env.curl_uses_lib('openssl') and \
+             env.curl_lib_version_before('openssl', '3.0.0'):
+            curl_supported = [0x301, 0x302, 0x303, 0x304]
+        else:  # most SSL backends dropped support for TLSv1.0, TLSv1.1
+            curl_supported = [0x303, 0x304]
+
+        extra_args = ['--trace-config', 'ssl']
+
+        # determine effective min/max version used by curl with these args
+        if max_arg != 'none':
+            extra_args.extend(['--tls-max', max_arg])
+            curl_max_ver = TLSDefs.CURL_ARG_MAX_VERSION_ID[max_arg]
+        else:
+            curl_max_ver = max(TLSDefs.TLS_VERSION_IDS.values())
+        if min_arg != 'none':
+            extra_args.append(f'--{min_arg}')
+            curl_min_ver = TLSDefs.CURL_ARG_MIN_VERSION_ID[min_arg]
+        else:
+            curl_min_ver = min(0x303, curl_max_ver)  # TLSv1.2 is the default now
+
+        # collect all versions that curl is allowed with this command lines and supports
+        curl_allowed = [tid for tid in sorted(TLSDefs.TLS_VERSION_IDS.values())
+                        if curl_min_ver <= tid <= curl_max_ver and
+                        tid in curl_supported]
+        # we expect a successful transfer, when the server TLS version is allowed
+        server_ver = TLSDefs.TLS_VERSION_IDS[server_tls]
+        # do the transfer
+        proto = 'http/1.1'
+        run_env = os.environ.copy()
+        if env.curl_uses_lib('gnutls'):
+            # we need to override any default system configuration since
+            # we want to test all protocol versions. Ubuntu (or the GH image)
+            # disable TSL1.0 and TLS1.1 system wide. We do not want.
+            our_config = os.path.join(env.gen_dir, 'gnutls_config')
+            if not os.path.exists(our_config):
+                with open(our_config, 'w') as fd:
+                    fd.write('# empty\n')
+            run_env['GNUTLS_SYSTEM_PRIORITY_FILE'] = our_config
+        curl = CurlClient(env=env, run_env=run_env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=extra_args)
+
+        if server_ver in curl_allowed:
+            assert r.exit_code == 0, f'should succeed, server={server_ver:04x}, curl=[{curl_min_ver:04x}, {curl_max_ver:04x}], allowed={curl_allowed}\n{r.dump_logs()}'
+            assert r.json['HTTPS'] == 'on', r.dump_logs()
+            assert r.json['SSL_PROTOCOL'] == server_tls, r.dump_logs()
+        else:
+            assert r.exit_code != 0, f'should fail, server={server_ver:04x}, curl=[{curl_min_ver:04x}, {curl_max_ver:04x}]\n{r.dump_logs()}'
+
+    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
+    def test_17_10_h3_session_reuse(self, env: Env, httpd, nghttpx):
+        if not env.have_h3():
+            pytest.skip("h3 not supported")
+        if not env.curl_uses_lib('quictls') and \
+           not env.curl_uses_lib('openssl') and \
+           not env.curl_uses_lib('gnutls') and \
+           not env.curl_uses_lib('wolfssl'):
+            pytest.skip("QUIC session reuse not implemented")
+        count = 2
+        docname = 'data-10k'
+        url = f'https://localhost:{env.https_port}/{docname}'
+        client = LocalClient(name='cli_hx_download', env=env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        r = client.run(args=[
+             '-n', f'{count}',
+             '-f',  # forbid reuse of connections
+             '-C', env.ca.cert_file,
+             '-r', f'{env.domain1}:{env.port_for("h3")}:127.0.0.1',
+             '-V', 'h3', url
+        ])
+        r.check_exit_code(0)
+        # check that TLS session was reused as expected
+        reused_session = False
+        for line in r.trace_lines:
+            if re.match(r'.*\[1-1] (\* )?SSL reusing session.*', line):
+                reused_session = True
+        assert reused_session, f'{r}\n{r.dump_logs()}'
+
+    # use hostname server has no certificate for
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_17_11_wrong_host(self, env: Env, proto, httpd, nghttpx):
+        curl = CurlClient(env=env)
+        domain = f'insecure.{env.tld}'
+        url = f'https://{domain}:{env.port_for(proto)}/curltest/sslinfo'
+        r = curl.http_get(url=url, alpn_proto=proto)
+        assert r.exit_code == 60, f'{r}'
+
+    # use hostname server has no cert for with --insecure
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_17_12_insecure(self, env: Env, proto, httpd, nghttpx):
+        curl = CurlClient(env=env)
+        domain = f'insecure.{env.tld}'
+        url = f'https://{domain}:{env.port_for(proto)}/curltest/sslinfo'
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
+            '--insecure'
+        ])
+        assert r.exit_code == 0, f'{r}'
+        assert r.json, f'{r}'
+
+    # connect to an expired certificate
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    def test_17_14_expired_cert(self, env: Env, proto, httpd):
+        curl = CurlClient(env=env)
+        url = f'https://{env.expired_domain}:{env.port_for(proto)}/'
+        r = curl.http_get(url=url, alpn_proto=proto)
+        assert r.exit_code == 60, f'{r}'  # peer failed verification
+        exp_trace = None
+        match_trace = None
+        if env.curl_uses_lib('openssl') or env.curl_uses_lib('quictls'):
+            exp_trace = r'.*SSL certificate OpenSSL verify result: certificate has expired.*$'
+        elif env.curl_uses_lib('gnutls'):
+            exp_trace = r'.*SSL certificate verification failed: certificate has expired\..*'
+        elif env.curl_uses_lib('wolfssl'):
+            exp_trace = r'.*server verification failed: certificate has expired\.$'
+        if exp_trace is not None:
+            for line in r.trace_lines:
+                if re.match(exp_trace, line):
+                    match_trace = line
+                    break
+            assert match_trace, f'Did not find "{exp_trace}" in trace\n{r.dump_logs()}'
+
+    @pytest.mark.skipif(condition=not Env.curl_has_feature('SSLS-EXPORT'),
+                        reason='curl lacks SSL session export support')
+    def test_17_15_session_export(self, env: Env, httpd):
+        proto = 'http/1.1'
+        if env.curl_uses_lib('libressl'):
+            pytest.skip('Libressl resumption does not work inTLSv1.3')
+        if env.curl_uses_lib('rustls-ffi'):
+            pytest.skip('rustsls does not expose sessions')
+        if env.curl_uses_lib('mbedtls') and \
+           not env.curl_lib_version_at_least('mbedtls', '3.6.0'):
+            pytest.skip('mbedtls TLSv1.3 session resume not working before 3.6.0')
+        run_env = os.environ.copy()
+        run_env['CURL_DEBUG'] = 'ssl,ssls'
+        # clean session file first, then reuse
+        session_file = os.path.join(env.gen_dir, 'test_17_15.sessions')
+        if os.path.exists(session_file):
+            os.remove(session_file)
+        xargs = ['--tls-max', '1.3', '--tlsv1.3', '--ssl-sessions', session_file]
+        curl = CurlClient(env=env, run_env=run_env)
+        # tell the server to close the connection after each request
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=xargs)
+        assert r.exit_code == 0, f'{r}'
+        assert r.json['HTTPS'] == 'on', f'{r.json}'
+        assert r.json['SSL_SESSION_RESUMED'] == 'Initial', f'{r.json}\n{r.dump_logs()}'
+        # ok, run again, sessions should be imported
+        run_dir2 = os.path.join(env.gen_dir, 'curl2')
+        curl = CurlClient(env=env, run_env=run_env, run_dir=run_dir2)
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=xargs)
+        assert r.exit_code == 0, f'{r}'
+        assert r.json['SSL_SESSION_RESUMED'] == 'Resumed', f'{r.json}\n{r.dump_logs()}'
+
+    # verify the ciphers are ignored when talking TLSv1.3 only
+    # see issue #16232
+    def test_17_16_h3_ignore_ciphers12(self, env: Env, httpd, nghttpx):
+        proto = 'h3'
+        if proto == 'h3' and not env.have_h3():
+            pytest.skip("h3 not supported")
+        if env.curl_uses_lib('gnutls'):
+            pytest.skip("gnutls does not ignore --ciphers on TLSv1.3")
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
+            '--ciphers', 'NONSENSE'
+        ])
+        assert r.exit_code == 0, f'{r}'
+
+    def test_17_17_h1_ignore_ciphers13(self, env: Env, httpd):
+        proto = 'http/1.1'
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
+            '--tls13-ciphers', 'NONSENSE', '--tls-max', '1.2'
+        ])
+        assert r.exit_code == 0, f'{r}'
+
+    @pytest.mark.parametrize("priority, tls_proto, ciphers, success", [
+        pytest.param("", "", [], False, id='prio-empty'),
+        pytest.param("NONSENSE", "", [], False, id='nonsense'),
+        pytest.param("+NONSENSE", "", [], False, id='+nonsense'),
+        pytest.param("NORMAL:-VERS-ALL:+VERS-TLS1.2", "TLSv1.2", ['ECDHE-RSA-CHACHA20-POLY1305'], True, id='TLSv1.2-normal-only'),
+        pytest.param("-VERS-ALL:+VERS-TLS1.2", "TLSv1.2", ['ECDHE-RSA-CHACHA20-POLY1305'], True, id='TLSv1.2-only'),
+        pytest.param("NORMAL", "TLSv1.3", ['TLS_CHACHA20_POLY1305_SHA256'], True, id='TLSv1.3-normal'),
+        pytest.param("NORMAL:-VERS-ALL:+VERS-TLS1.3", "TLSv1.3", ['TLS_CHACHA20_POLY1305_SHA256'], True, id='TLSv1.3-normal-only'),
+        pytest.param("-VERS-ALL:+VERS-TLS1.3", "TLSv1.3", ['TLS_CHACHA20_POLY1305_SHA256'], True, id='TLSv1.3-only'),
+        pytest.param("!CHACHA20-POLY1305", "TLSv1.3", ['TLS_AES_128_GCM_SHA256'], True, id='TLSv1.3-no-chacha'),
+        pytest.param("-CIPHER-ALL:+CHACHA20-POLY1305", "TLSv1.3", ['TLS_CHACHA20_POLY1305_SHA256'], True, id='TLSv1.3-only-chacha'),
+        pytest.param("-CIPHER-ALL:+AES-256-GCM", "", [], False, id='only-AES256'),
+        pytest.param("-CIPHER-ALL:+AES-128-GCM", "TLSv1.3", ['TLS_AES_128_GCM_SHA256'], True, id='TLSv1.3-only-AES128'),
+        pytest.param("SECURE:-CIPHER-ALL:+AES-128-GCM:-VERS-ALL:+VERS-TLS1.2", "TLSv1.2", ['ECDHE-RSA-AES128-GCM-SHA256'], True, id='TLSv1.2-secure'),
+        pytest.param("-MAC-ALL:+SHA256", "", [], False, id='MAC-only-SHA256'),
+        pytest.param("-MAC-ALL:+AEAD", "TLSv1.3", ['TLS_CHACHA20_POLY1305_SHA256'], True, id='TLSv1.3-MAC-only-AEAD'),
+        pytest.param("-GROUP-ALL:+GROUP-X25519", "TLSv1.3", ['TLS_CHACHA20_POLY1305_SHA256'], True, id='TLSv1.3-group-only-X25519'),
+        pytest.param("-GROUP-ALL:+GROUP-SECP192R1", "", [], False, id='group-only-SECP192R1'),
+        ])
+    def test_17_18_gnutls_priority(self, env: Env, httpd, configures_httpd, priority, tls_proto, ciphers, success):
+        # to test setting cipher suites, the AES 256 ciphers are disabled in the test server
+        httpd.set_extra_config('base', [
+            'SSLCipherSuite SSL' +
+            ' ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256' +
+            ':ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305',
+            'SSLCipherSuite TLSv1.3' +
+            ' TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256',
+        ])
+        httpd.reload_if_config_changed()
+        proto = 'http/1.1'
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
+        # SSL backend specifics
+        if not env.curl_uses_lib('gnutls'):
+            pytest.skip('curl not build with GnuTLS')
+        # test
+        extra_args = ['--ciphers', f'{priority}']
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=extra_args)
+        if success:
+            assert r.exit_code == 0, r.dump_logs()
+            assert r.json['HTTPS'] == 'on', r.dump_logs()
+            if tls_proto:
+                assert r.json['SSL_PROTOCOL'] == tls_proto, r.dump_logs()
+            assert r.json['SSL_CIPHER'] in ciphers, r.dump_logs()
+        else:
+            assert r.exit_code != 0, r.dump_logs()
+
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_17_19_wrong_pin(self, env: Env, proto, httpd, nghttpx):
+        if env.curl_uses_lib('rustls-ffi'):
+            pytest.skip('TLS backend ignores --pinnedpubkey')
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
+            '--pinnedpubkey', 'sha256//ffff'
+        ])
+        # expect NOT_IMPLEMENTED or CURLE_SSL_PINNEDPUBKEYNOTMATCH
+        assert r.exit_code in [2, 90], f'{r.dump_logs()}'
+
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_17_20_correct_pin(self, env: Env, proto, httpd, nghttpx):
+        curl = CurlClient(env=env)
+        creds = env.get_credentials(env.domain1)
+        assert creds
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
+            '--pinnedpubkey', f'sha256//{creds.pub_sha256_b64()}'
+        ])
+        # expect NOT_IMPLEMENTED or OK
+        assert r.exit_code in [0, 2], f'{r.dump_logs()}'
+
+    @pytest.mark.skipif(condition=not Env.have_openssl(), reason="needs openssl command")
+    def test_17_21_capath_valid(self, env: Env, httpd):
+        if env.curl_uses_lib('rustls-ffi'):
+            pytest.skip('rustls does not support CURLOPT_CAPATH')
+        proto = 'http/1.1'
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
+            '--capath', env.ca.hashdir
+        ])
+        assert r.exit_code == 0, f'{r.dump_logs()}'
+        assert r.json['HTTPS'] == 'on', f'{r.json}'
+
+    @pytest.mark.skipif(condition=not Env.have_openssl(), reason="needs openssl command")
+    def test_17_22_capath_invalid(self, env: Env, httpd):
+        # we can test all TLS backends here. the ones not supporting CAPATH
+        # need to fail as well as the ones which do, but get an invalid path.
+        proto = 'http/1.1'
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
+        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
+            '--capath', os.path.join(env.gen_dir, 'ca/invalid')
+        ])
+        # CURLE_PEER_FAILED_VERIFICATION or CURLE_SSL_CACERT_BADFILE
+        assert r.exit_code in [60, 77], f'{r.dump_logs()}'
diff --git a/third-party/curl/tests/http/test_18_methods.py b/third-party/curl/tests/http/test_18_methods.py
new file mode 100644
index 0000000000..faa31a638e
--- /dev/null
+++ b/third-party/curl/tests/http/test_18_methods.py
@@ -0,0 +1,65 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+import logging
+
+import pytest
+from testenv import CurlClient, Env
+
+log = logging.getLogger(__name__)
+
+
+class TestMethods:
+
+    @pytest.fixture(autouse=True, scope='class')
+    def _class_scope(self, env, httpd, nghttpx):
+        indir = httpd.docs_dir
+        env.make_data_file(indir=indir, fname="data-10k", fsize=10 * 1024)
+        env.make_data_file(indir=indir, fname="data-100k", fsize=100 * 1024)
+        env.make_data_file(indir=indir, fname="data-1m", fsize=1024 * 1024)
+
+    # download 1 file
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_18_01_delete(self, env: Env, httpd, nghttpx, proto):
+        count = 1
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/tweak?id=[0-{count-1}]'
+        r = curl.http_delete(urls=[url], alpn_proto=proto)
+        r.check_stats(count=count, http_status=204, exitcode=0)
+
+    # make HTTP/2 in the server send
+    # - HEADER frame with 204 and eos=0
+    # - 10ms later DATA frame length=0 and eos=1
+    # should be accepted
+    @pytest.mark.skipif(condition=not Env.have_h2_curl(), reason="curl without h2")
+    def test_18_02_delete_h2_special(self, env: Env, httpd, nghttpx):
+        proto = 'h2'
+        count = 1
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/tweak?id=[0-{count-1}]'\
+            '&chunks=1&chunk_size=0&chunk_delay=10ms'
+        r = curl.http_delete(urls=[url], alpn_proto=proto)
+        r.check_stats(count=count, http_status=204, exitcode=0)
diff --git a/third-party/curl/tests/http/test_19_shutdown.py b/third-party/curl/tests/http/test_19_shutdown.py
new file mode 100644
index 0000000000..4ed9ad27fb
--- /dev/null
+++ b/third-party/curl/tests/http/test_19_shutdown.py
@@ -0,0 +1,213 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+import logging
+import os
+import re
+
+import pytest
+from testenv import CurlClient, Env, LocalClient
+
+log = logging.getLogger(__name__)
+
+
+class TestShutdown:
+
+    @pytest.fixture(autouse=True, scope='class')
+    def _class_scope(self, env, httpd):
+        indir = httpd.docs_dir
+        env.make_data_file(indir=indir, fname="data-10k", fsize=10 * 1024)
+        env.make_data_file(indir=indir, fname="data-100k", fsize=100 * 1024)
+        env.make_data_file(indir=indir, fname="data-1m", fsize=1024 * 1024)
+
+    # check with `tcpdump` that we see curl TCP RST packets
+    @pytest.mark.skipif(condition=not Env.tcpdump(), reason="tcpdump not available")
+    @pytest.mark.parametrize("proto", ['http/1.1'])
+    def test_19_01_check_tcp_rst(self, env: Env, httpd, proto):
+        if env.ci_run:
+            pytest.skip("seems not to work in CI")
+        # timing critical, disable trace overrides
+        run_env = os.environ.copy()
+        if 'CURL_DEBUG' in run_env:
+            del run_env['CURL_DEBUG']
+        curl = CurlClient(env=env, run_env=run_env)
+        port = env.port_for(alpn_proto=proto)
+        url = f'https://{env.domain1}:{port}/data.json?[0-1]'
+        r = curl.http_download(urls=[url], alpn_proto=proto, with_tcpdump=True, extra_args=[
+            '--parallel'
+        ])
+        r.check_response(http_status=200, count=2)
+        assert r.tcpdump
+        assert len(r.tcpdump.get_rsts(ports=[port])) != 0, f'Expected TCP RSTs packets: {r.tcpdump.stderr}'
+
+    # check with `tcpdump` that we do NOT see TCP RST when CURL_GRACEFUL_SHUTDOWN set
+    @pytest.mark.skipif(condition=not Env.tcpdump(), reason="tcpdump not available")
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    def test_19_02_check_shutdown(self, env: Env, httpd, proto):
+        if not env.curl_is_debug():
+            pytest.skip('only works for curl debug builds')
+        run_env = os.environ.copy()
+        run_env.update({
+            'CURL_GRACEFUL_SHUTDOWN': '2000',
+            'CURL_DEBUG': 'ssl,tcp,lib-ids,multi'
+        })
+        curl = CurlClient(env=env, run_env=run_env)
+        port = env.port_for(alpn_proto=proto)
+        url = f'https://{env.domain1}:{port}/data.json?[0-1]'
+        r = curl.http_download(urls=[url], alpn_proto=proto, with_tcpdump=True, extra_args=[
+            '--parallel'
+        ])
+        r.check_response(http_status=200, count=2)
+        assert r.tcpdump
+        assert len(r.tcpdump.get_rsts(ports=[port])) == 0, 'Unexpected TCP RST packets'
+
+    # run downloads where the server closes the connection after each request
+    @pytest.mark.parametrize("proto", ['http/1.1'])
+    def test_19_03_shutdown_by_server(self, env: Env, httpd, proto):
+        if not env.curl_is_debug():
+            pytest.skip('only works for curl debug builds')
+        if not env.curl_is_verbose():
+            pytest.skip('only works for curl with verbose strings')
+        count = 10
+        curl = CurlClient(env=env, run_env={
+            'CURL_GRACEFUL_SHUTDOWN': '2000',
+            'CURL_DEBUG': 'ssl,multi'
+        })
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/tweak/?'\
+            f'id=[0-{count-1}]&with_cl&close'
+        r = curl.http_download(urls=[url], alpn_proto=proto)
+        r.check_response(http_status=200, count=count)
+        shutdowns = [line for line in r.trace_lines
+                     if re.match(r'.*\[SHUTDOWN] shutdown, done=1', line)]
+        assert len(shutdowns) == count, f'{shutdowns}'
+
+    # run downloads with CURLOPT_FORBID_REUSE set, meaning *we* close
+    # the connection after each request
+    @pytest.mark.parametrize("proto", ['http/1.1'])
+    def test_19_04_shutdown_by_curl(self, env: Env, httpd, proto):
+        if not env.curl_is_debug():
+            pytest.skip('only works for curl debug builds')
+        if not env.curl_is_verbose():
+            pytest.skip('only works for curl with verbose strings')
+        count = 10
+        docname = 'data.json'
+        url = f'https://localhost:{env.https_port}/{docname}'
+        client = LocalClient(name='cli_hx_download', env=env, run_env={
+            'CURL_GRACEFUL_SHUTDOWN': '2000',
+            'CURL_DEBUG': 'ssl,multi'
+        })
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        r = client.run(args=[
+             '-n', f'{count}', '-f', '-C', env.ca.cert_file,
+             '-V', proto, url
+        ])
+        r.check_exit_code(0)
+        shutdowns = [line for line in r.trace_lines
+                     if re.match(r'.*SHUTDOWN] shutdown, done=1', line)]
+        assert len(shutdowns) == count, f'{shutdowns}'
+
+    # run event-based downloads with CURLOPT_FORBID_REUSE set, meaning *we* close
+    # the connection after each request
+    @pytest.mark.parametrize("proto", ['http/1.1'])
+    def test_19_05_event_shutdown_by_server(self, env: Env, httpd, proto):
+        if not env.curl_is_debug():
+            pytest.skip('only works for curl debug builds')
+        if not env.curl_is_verbose():
+            pytest.skip('only works for curl with verbose strings')
+        count = 10
+        run_env = os.environ.copy()
+        # forbid connection reuse to trigger shutdowns after transfer
+        run_env['CURL_FORBID_REUSE'] = '1'
+        # make socket receives block 50% of the time to delay shutdown
+        run_env['CURL_DBG_SOCK_RBLOCK'] = '50'
+        run_env['CURL_DEBUG'] = 'ssl,multi,lib-ids'
+        curl = CurlClient(env=env, run_env=run_env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/tweak/?'\
+            f'id=[0-{count-1}]&with_cl&'
+        r = curl.http_download(urls=[url], alpn_proto=proto, extra_args=[
+            '--test-event'
+        ])
+        r.check_response(http_status=200, count=count)
+        # check that we closed all connections
+        closings = [line for line in r.trace_lines
+                    if re.match(r'.*SHUTDOWN] (force )?closing', line)]
+        assert len(closings) == count, f'{closings}'
+        # check that all connection sockets were removed from event
+        removes = [line for line in r.trace_lines
+                   if re.match(r'.*socket cb: socket \d+ REMOVED', line)]
+        assert len(removes) >= count, f'{removes}'
+
+    # check graceful shutdown on multiplexed http
+    @pytest.mark.parametrize("proto", Env.http_mplx_protos())
+    def test_19_06_check_shutdown(self, env: Env, httpd, nghttpx, proto):
+        if not env.curl_is_debug():
+            pytest.skip('only works for curl debug builds')
+        if not env.curl_is_verbose():
+            pytest.skip('only works for curl with verbose strings')
+        curl = CurlClient(env=env, run_env={
+            'CURL_GRACEFUL_SHUTDOWN': '2000',
+            'CURL_DEBUG': 'all'
+        })
+        url = f'https://{env.authority_for(env.domain1, proto)}/data.json?[0-1]'
+        r = curl.http_download(urls=[url], alpn_proto=proto, with_tcpdump=True, extra_args=[
+            '--parallel'
+        ])
+        r.check_response(http_status=200, count=2)
+        # check connection cache closings
+        shutdowns = [line for line in r.trace_lines
+                     if re.match(r'.*SHUTDOWN] shutdown, done=1', line)]
+        assert len(shutdowns) == 1, f'{shutdowns}'
+
+    # run connection pressure, many small transfers, not reusing connections,
+    # limited total
+    @pytest.mark.parametrize("proto", ['http/1.1'])
+    def test_19_07_shutdown_by_curl(self, env: Env, httpd, proto):
+        if not env.curl_is_debug():
+            pytest.skip('only works for curl debug builds')
+        count = 500
+        docname = 'data.json'
+        url = f'https://localhost:{env.https_port}/{docname}'
+        client = LocalClient(name='cli_hx_download', env=env, run_env={
+            'CURL_GRACEFUL_SHUTDOWN': '2000',
+            'CURL_DEBUG': 'ssl,multi'
+        })
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        r = client.run(args=[
+             '-n', f'{count}',  # that many transfers
+             '-C', env.ca.cert_file,
+             '-f',  # forbid conn reuse
+             '-m', '10',  # max parallel
+             '-T', '5',  # max total conns at a time
+             '-V', proto,
+             url
+        ])
+        r.check_exit_code(0)
+        shutdowns = [line for line in r.trace_lines
+                     if re.match(r'.*SHUTDOWN] shutdown, done=1', line)]
+        # we see less clean shutdowns as total limit forces early closes
+        assert len(shutdowns) < count, f'{shutdowns}'
diff --git a/third-party/curl/tests/http/test_20_websockets.py b/third-party/curl/tests/http/test_20_websockets.py
index 4e70dcef00..0a86e6439b 100644
--- a/third-party/curl/tests/http/test_20_websockets.py
+++ b/third-party/curl/tests/http/test_20_websockets.py
@@ -24,16 +24,22 @@
 #
 ###########################################################################
 #
+import base64
+import hashlib
 import logging
 import os
+import re
 import shutil
+import socket
 import subprocess
+import threading
 import time
 from datetime import datetime, timedelta
+from typing import Dict
+
 import pytest
-
-from testenv import Env, CurlClient, LocalClient
-
+from testenv import CurlClient, Env, LocalClient
+from testenv.ports import alloc_ports_and_do
 
 log = logging.getLogger(__name__)
 
@@ -42,9 +48,13 @@ log = logging.getLogger(__name__)
                     reason='curl lacks ws protocol support')
 class TestWebsockets:
 
-    def check_alive(self, env, timeout=5):
+    PORT_SPECS = {
+        'ws': socket.SOCK_STREAM,
+    }
+
+    def check_alive(self, env, port, timeout=Env.SERVER_TIMEOUT):
         curl = CurlClient(env=env)
-        url = f'http://localhost:{env.ws_port}/'
+        url = f'http://localhost:{port}/'
         end = datetime.now() + timedelta(seconds=timeout)
         while datetime.now() < end:
             r = curl.http_download(urls=[url])
@@ -55,38 +65,54 @@ class TestWebsockets:
 
     def _mkpath(self, path):
         if not os.path.exists(path):
-            return os.makedirs(path)
+            os.makedirs(path)
 
     def _rmrf(self, path):
         if os.path.exists(path):
-            return shutil.rmtree(path)
+            shutil.rmtree(path)
 
     @pytest.fixture(autouse=True, scope='class')
     def ws_echo(self, env):
-        run_dir = os.path.join(env.gen_dir, 'ws-echo-server')
-        err_file = os.path.join(run_dir, 'stderr')
-        self._rmrf(run_dir)
-        self._mkpath(run_dir)
+        self.run_dir = os.path.join(env.gen_dir, 'ws_echo_server')
+        err_file = os.path.join(self.run_dir, 'stderr')
+        self._rmrf(self.run_dir)
+        self._mkpath(self.run_dir)
+        self.cmd = os.path.join(env.project_dir,
+                                'tests/http/testenv/ws_echo_server.py')
+        self.wsproc = None
+        self.cerr = None
 
-        with open(err_file, 'w') as cerr:
-            cmd = os.path.join(env.project_dir,
-                               'tests/http/testenv/ws_echo_server.py')
-            args = [cmd, '--port', str(env.ws_port)]
-            p = subprocess.Popen(args=args, cwd=run_dir, stderr=cerr,
-                                 stdout=cerr)
-            assert self.check_alive(env)
+        def startup(ports: Dict[str, int]) -> bool:
+            wargs = [self.cmd, '--port', str(ports['ws'])]
+            log.info(f'start_ {wargs}')
+            self.wsproc = subprocess.Popen(args=wargs,
+                                           cwd=self.run_dir,
+                                           stderr=self.cerr,
+                                           stdout=self.cerr)
+            if self.check_alive(env, ports['ws']):
+                env.update_ports(ports)
+                return True
+            log.error(f'not alive {wargs}')
+            self.wsproc.terminate()
+            self.wsproc = None
+            return False
+
+        with open(err_file, 'w') as self.cerr:
+            assert alloc_ports_and_do(TestWebsockets.PORT_SPECS, startup,
+                                      env.gen_root, max_tries=3)
+            assert self.wsproc
             yield
-            p.terminate()
+            self.wsproc.terminate()
 
-    def test_20_01_basic(self, env: Env, ws_echo, repeat):
+    def test_20_01_basic(self, env: Env, ws_echo):
         curl = CurlClient(env=env)
         url = f'http://localhost:{env.ws_port}/'
         r = curl.http_download(urls=[url])
         r.check_response(http_status=426)
 
-    def test_20_02_pingpong_small(self, env: Env, ws_echo, repeat):
+    def test_20_02_pingpong_small(self, env: Env, ws_echo):
         payload = 125 * "x"
-        client = LocalClient(env=env, name='ws-pingpong')
+        client = LocalClient(env=env, name='cli_ws_pingpong')
         if not client.exists():
             pytest.skip(f'example client not built: {client.name}')
         url = f'ws://localhost:{env.ws_port}/'
@@ -94,38 +120,183 @@ class TestWebsockets:
         r.check_exit_code(0)
 
     # the python websocket server does not like 'large' control frames
-    def test_20_03_pingpong_too_large(self, env: Env, ws_echo, repeat):
+    def test_20_03_pingpong_too_large(self, env: Env, ws_echo):
         payload = 127 * "x"
-        client = LocalClient(env=env, name='ws-pingpong')
+        client = LocalClient(env=env, name='cli_ws_pingpong')
         if not client.exists():
             pytest.skip(f'example client not built: {client.name}')
         url = f'ws://localhost:{env.ws_port}/'
         r = client.run(args=[url, payload])
-        r.check_exit_code(56)
+        r.check_exit_code(100)  # CURLE_TOO_LARGE
 
-    # the python websocket server does not like 'large' control frames
-    def test_20_04_data_small(self, env: Env, ws_echo, repeat):
-        client = LocalClient(env=env, name='ws-data')
+    @pytest.mark.parametrize("model", [
+        pytest.param(1, id='multi_perform'),
+        pytest.param(2, id='curl_ws_send+recv'),
+    ])
+    def test_20_04_data_small(self, env: Env, ws_echo, model):
+        client = LocalClient(env=env, name='cli_ws_data')
         if not client.exists():
             pytest.skip(f'example client not built: {client.name}')
         url = f'ws://localhost:{env.ws_port}/'
-        r = client.run(args=[url, str(0), str(10)])
+        r = client.run(args=[f'-{model}', '-m', str(1), '-M', str(10), url])
         r.check_exit_code(0)
 
-    # the python websocket server does not like 'large' control frames
-    def test_20_05_data_med(self, env: Env, ws_echo, repeat):
-        client = LocalClient(env=env, name='ws-data')
+    @pytest.mark.parametrize("model", [
+        pytest.param(1, id='multi_perform'),
+        pytest.param(2, id='curl_ws_send+recv'),
+    ])
+    def test_20_05_data_med(self, env: Env, ws_echo, model):
+        client = LocalClient(env=env, name='cli_ws_data')
         if not client.exists():
             pytest.skip(f'example client not built: {client.name}')
         url = f'ws://localhost:{env.ws_port}/'
-        r = client.run(args=[url, str(120), str(130)])
+        r = client.run(args=[f'-{model}', '-m', str(120), '-M', str(130), url])
         r.check_exit_code(0)
 
-    # the python websocket server does not like 'large' control frames
-    def test_20_06_data_large(self, env: Env, ws_echo, repeat):
-        client = LocalClient(env=env, name='ws-data')
+    @pytest.mark.parametrize("model", [
+        pytest.param(1, id='multi_perform'),
+        pytest.param(2, id='curl_ws_send+recv'),
+    ])
+    def test_20_06_data_large(self, env: Env, ws_echo, model):
+        client = LocalClient(env=env, name='cli_ws_data')
         if not client.exists():
             pytest.skip(f'example client not built: {client.name}')
         url = f'ws://localhost:{env.ws_port}/'
-        r = client.run(args=[url, str(65535 - 5), str(65535 + 5)])
+        r = client.run(args=[f'-{model}', '-m', str(65535 - 5), '-M', str(65535 + 5), url])
         r.check_exit_code(0)
+
+    @pytest.mark.parametrize("model", [
+        pytest.param(1, id='multi_perform'),
+        pytest.param(2, id='curl_ws_send+recv'),
+    ])
+    def test_20_07_data_large_small_recv(self, env: Env, ws_echo, model):
+        run_env = os.environ.copy()
+        run_env['CURL_WS_CHUNK_SIZE'] = '1024'
+        client = LocalClient(env=env, name='cli_ws_data', run_env=run_env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        url = f'ws://localhost:{env.ws_port}/'
+        r = client.run(args=[f'-{model}', '-m', str(65535 - 5), '-M', str(65535 + 5), url])
+        r.check_exit_code(0)
+
+    # Send large frames and simulate send blocking on 8192 bytes chunks
+    # Simulates error reported in #15865
+    @pytest.mark.parametrize("model", [
+        pytest.param(1, id='multi_perform'),
+        pytest.param(2, id='curl_ws_send+recv'),
+    ])
+    def test_20_08_data_very_large(self, env: Env, ws_echo, model):
+        run_env = os.environ.copy()
+        run_env['CURL_WS_CHUNK_EAGAIN'] = '8192'
+        client = LocalClient(env=env, name='cli_ws_data', run_env=run_env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        url = f'ws://localhost:{env.ws_port}/'
+        count = 10
+        large = 20000
+        r = client.run(args=[f'-{model}', '-c', str(count), '-m', str(large), url])
+        r.check_exit_code(0)
+
+    @pytest.mark.parametrize("model", [
+        pytest.param(1, id='multi_perform'),
+        pytest.param(2, id='curl_ws_send+recv'),
+    ])
+    def test_20_09_data_empty(self, env: Env, ws_echo, model):
+        client = LocalClient(env=env, name='cli_ws_data')
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        url = f'ws://localhost:{env.ws_port}/'
+        count = 10
+        large = 0
+        r = client.run(args=[f'-{model}', '-c', str(count), '-m', str(large), url])
+        r.check_exit_code(0)
+
+    # use ws:// url with HTTP proxy, check that it tunnels automatically
+    def test_20_10_proxy_http(self, env: Env, httpd, ws_echo):
+        curl = CurlClient(env=env)
+        url = f'ws://127.0.0.1:{env.ws_port}/'
+        xargs = curl.get_proxy_args(proxys=False)
+        xargs.extend([
+            '--max-time', '2'
+        ])
+        r = curl.http_download(urls=[url], alpn_proto='http/1.1', with_stats=True,
+                               extra_args=xargs)
+        # The CONNECT through the proxy fails as it does not allow it
+        r.check_exit_code(7) # CURLE_COULDNT_CONNECT
+        assert r.stats[0]['http_connect'] == 403, f'{r}'
+
+    def test_20_11_crazy_pings(self, env: Env):
+        st = {}
+        send_rounds = 1
+
+        def srv():
+            try:
+                with socket.socket() as s:
+                    s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+                    s.bind(("127.0.0.1", 0))
+                    s.listen(1)
+                    st["p"] = s.getsockname()[1]
+
+                    c, _ = s.accept()
+                    c.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 4096)
+                    c.settimeout(Env.SERVER_TIMEOUT)
+                    req = b""
+                    while b"\r\n\r\n" not in req:
+                        req += c.recv(4096)
+
+                    k = re.search(rb"(?im)^Sec-WebSocket-Key:\s*(\S+)", req).group(1)
+                    a = base64.b64encode(
+                        hashlib.sha1(k + b"258EAFA5-E914-47DA-95CA-C5AB0DC85B11").digest()
+                    ).decode()
+                    c.sendall(
+                        (
+                            "HTTP/1.1 101 Switching Protocols\r\n"
+                            "Upgrade: websocket\r\n"
+                            "Connection: Upgrade\r\n"
+                            f"Sec-WebSocket-Accept: {a}\r\n\r\n"
+                        ).encode()
+                    )
+
+                    f = b"\x89\x00" * 65536  # PING frames, many
+                    try:
+                        for _ in range(send_rounds):
+                            c.sendall(f)
+                        f = b"\x88\x00"  # CLOSE frame
+                        c.sendall(f)
+                    except OSError:
+                        # Client may close/reset while we intentionally flood frames.
+                        # Send errors are expected here, ignore them.
+                        pass
+                    time.sleep(1)
+                    c.close()
+            except OSError as e:
+                st["err"] = e
+
+        curl = CurlClient(env=env)
+        send_rounds = 2
+        threading.Thread(target=srv, daemon=True).start()
+        while "p" not in st and "err" not in st:
+            time.sleep(0.01)
+        assert "err" not in st, f'ws-ping server failed to start: {st["err"]}'
+
+        url = f'ws://127.0.0.1:{st["p"]}/'
+        r = curl.http_download(urls=[url], alpn_proto='http/1.1', with_stats=True,
+                               with_profile=True)
+        assert r.exit_code in [55, 56], f'{r.dump_logs()}'  # SEND/RECV_ERROR
+        assert r.profile, f'{r}'
+        rss1 = r.profile.stats['rss'] / (1024 * 1024)
+
+        st.clear()
+        send_rounds = 10
+        threading.Thread(target=srv, daemon=True).start()
+        while "p" not in st and "err" not in st:
+            time.sleep(0.01)
+        assert "err" not in st, f'ws-ping server failed to start: {st["err"]}'
+
+        url = f'ws://127.0.0.1:{st["p"]}/'
+        r = curl.http_download(urls=[url], alpn_proto='http/1.1', with_stats=True,
+                               with_profile=True)
+        assert r.exit_code in [55, 56], f'{r.dump_logs()}'  # SEND/RECV_ERROR
+        assert r.profile, f'{r}'
+        rss2 = r.profile.stats['rss'] / (1024 * 1024)
+        assert (rss1 * 1.1) >= rss2, 'bad memory increase'
diff --git a/third-party/curl/tests/http/test_21_resolve.py b/third-party/curl/tests/http/test_21_resolve.py
new file mode 100644
index 0000000000..8f2937f42f
--- /dev/null
+++ b/third-party/curl/tests/http/test_21_resolve.py
@@ -0,0 +1,202 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+import logging
+import os
+from datetime import timedelta
+from typing import Generator
+
+import pytest
+from testenv import CurlClient, Dnsd, Env, LocalClient
+
+log = logging.getLogger(__name__)
+
+
+@pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+@pytest.mark.skipif(condition=not Env.curl_has_feature('AsynchDNS'), reason="needs AsynchDNS")
+class TestResolve:
+
+    @pytest.fixture(scope='class')
+    def dnsd(self, env: Env) -> Generator[Dnsd, None, None]:
+        dnsd = Dnsd(env=env)
+        assert dnsd.initial_start()
+        yield dnsd
+        dnsd.stop()
+
+    @pytest.fixture(autouse=True, scope='class')
+    def _class_scope(self, env, httpd):
+        indir = httpd.docs_dir
+        env.make_data_file(indir=indir, fname="data-0k", fsize=0)
+
+    # use .invalid host name that should never resolv
+    def test_21_01_resolv_invalid_one(self, env: Env, httpd, nghttpx):
+        count = 1
+        run_env = os.environ.copy()
+        run_env['CURL_DBG_RESOLV_FAIL_DELAY'] = '5'
+        curl = CurlClient(env=env, run_env=run_env, force_resolv=False)
+        url = f'https://test-{count}.http.curl.invalid/'
+        r = curl.http_download(urls=[url], with_stats=True)
+        r.check_exit_code(6)
+        r.check_stats(count=count, http_status=0, exitcode=6)
+
+    # use .invalid host name, one after the other
+    @pytest.mark.parametrize("delay_ms", [1, 50])
+    def test_21_02_resolv_invalid_serial(self, env: Env, delay_ms, httpd, nghttpx):
+        count = 10
+        run_env = os.environ.copy()
+        run_env['CURL_DBG_RESOLV_FAIL_DELAY'] = f'{delay_ms}'
+        curl = CurlClient(env=env, run_env=run_env, force_resolv=False)
+        urls = [ f'https://test-{i}.http.curl.invalid/' for i in range(count)]
+        r = curl.http_download(urls=urls, with_stats=True)
+        r.check_exit_code(6)
+        r.check_stats(count=count, http_status=0, exitcode=6)
+
+    # use .invalid host name, parallel
+    @pytest.mark.parametrize("delay_ms", [1, 50])
+    def test_21_03_resolv_invalid_parallel(self, env: Env, delay_ms, httpd, nghttpx):
+        count = 20
+        run_env = os.environ.copy()
+        run_env['CURL_DBG_RESOLV_FAIL_DELAY'] = f'{delay_ms}'
+        curl = CurlClient(env=env, run_env=run_env, force_resolv=False)
+        urls = [ f'https://test-{i}.http.curl.invalid/' for i in range(count)]
+        r = curl.http_download(urls=urls, with_stats=True, extra_args=[
+            '--parallel'
+        ])
+        r.check_exit_code(6)
+        r.check_stats(count=count, http_status=0, exitcode=6)
+
+    # resolve first url with ipv6 only and fail that, resolve second
+    # with ipv*, should succeed.
+    def test_21_04_resolv_inv_v6(self, env: Env, httpd):
+        count = 2
+        run_env = os.environ.copy()
+        run_env['CURL_DBG_RESOLV_FAIL_IPV6'] = '1'
+        url = f'https://localhost:{env.https_port}/'
+        client = LocalClient(name='cli_hx_download', env=env, run_env=run_env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        dfiles = [client.download_file(i) for i in range(count)]
+        self._clean_files(dfiles)
+        # let the first URL resolve via ipv6 only, which we force to fail
+        r = client.run(args=[
+            '-n', f'{count}', '-6', '-C', env.ca.cert_file, url
+        ])
+        r.check_exit_code(6)
+        assert not os.path.exists(dfiles[0])
+        assert os.path.exists(dfiles[1])
+
+    # use .invalid host name, parallel, single resolve thread
+    @pytest.mark.skipif(condition=not Env.curl_resolv_threaded(), reason="no threaded resolver")
+    def test_21_05_resolv_single_thread(self, env: Env, httpd, nghttpx):
+        count = 10
+        delay_ms = 50
+        run_env = os.environ.copy()
+        run_env['CURL_DBG_RESOLV_FAIL_DELAY'] = f'{delay_ms}'
+        run_env['CURL_DBG_RESOLV_MAX_THREADS'] = '1'
+        curl = CurlClient(env=env, run_env=run_env, force_resolv=False)
+        urls = [ f'https://test-{i}.http.curl.invalid/' for i in range(count)]
+        r = curl.http_download(urls=urls, with_stats=True, extra_args=[
+            '--parallel', '-6'
+        ])
+        r.check_exit_code(6)
+        r.check_stats(count=count, http_status=0, exitcode=6)
+        assert r.duration > timedelta(milliseconds=count * delay_ms), f'{r}'
+
+    # dnsd with no answers
+    @pytest.mark.skipif(condition=not Env.curl_override_dns(), reason="no DNS override")
+    def test_21_06_dnsd_empty(self, env: Env, httpd, dnsd):
+        dnsd.set_answers()
+        run_env = os.environ.copy()
+        run_env['CURL_DNS_SERVER'] = f'127.0.0.1:{dnsd.port}'
+        curl = CurlClient(env=env, run_env=run_env, force_resolv=False)
+        url = 'https://test-dnsd.http.curl.invalid/'
+        r = curl.http_download(urls=[url], with_stats=True)
+        r.check_exit_code(6)  # could not resolve host
+        r.check_stats(count=1, http_status=0, exitcode=6)
+
+    # dnsd with one answer for A
+    @pytest.mark.skipif(condition=not Env.curl_override_dns(), reason="no DNS override")
+    def test_21_07_dnsd_a(self, env: Env, httpd, dnsd):
+        dnsd.set_answers(addr_a=['127.0.0.1'])
+        run_env = os.environ.copy()
+        run_env['CURL_DNS_SERVER'] = f'127.0.0.1:{dnsd.port}'
+        curl = CurlClient(env=env, run_env=run_env, force_resolv=False)
+        url = f'https://{env.authority_for(env.domain1, "http/1.1")}/data.json'
+        r = curl.http_download(urls=[url], with_stats=True)
+        r.check_exit_code(0)
+        r.check_stats(count=1, http_status=200, exitcode=0)
+        assert r.stats[0]['remote_ip'] == '127.0.0.1'
+
+    # dnsd with one answer for AAAA
+    @pytest.mark.skipif(condition=not Env.curl_override_dns(), reason="no DNS override")
+    @pytest.mark.skipif(condition=not Env.curl_has_feature('IPv6'), reason="no IPv6")
+    def test_21_08_dnsd_aaaa(self, env: Env, httpd, dnsd):
+        dnsd.set_answers(addr_aaaa=['[::1]'])
+        run_env = os.environ.copy()
+        run_env['CURL_DNS_SERVER'] = f'127.0.0.1:{dnsd.port}'
+        run_env['CURL_QUICK_EXIT'] = '1'
+        curl = CurlClient(env=env, run_env=run_env, force_resolv=False)
+        url = f'https://{env.authority_for(env.domain1, "http/1.1")}/data.json'
+        r = curl.http_download(urls=[url], with_stats=True)
+        r.check_exit_code(0)
+        r.check_stats(count=1, http_status=200, exitcode=0)
+        assert r.stats[0]['remote_ip'] == '::1'
+
+    # dnsd with one answer for A, delayed one for AAAA
+    @pytest.mark.skipif(condition=not Env.curl_override_dns(), reason="no DNS override")
+    def test_21_09_dnsd_a_delay(self, env: Env, httpd, dnsd):
+        dnsd.set_answers(addr_a=['127.0.0.1'], addr_aaaa=['[::1]'],
+                         delay_aaaa_ms=env.test_timeout * 1000)
+        run_env = os.environ.copy()
+        run_env['CURL_DNS_SERVER'] = f'127.0.0.1:{dnsd.port}'
+        run_env['CURL_QUICK_EXIT'] = '1'
+        curl = CurlClient(env=env, run_env=run_env, force_resolv=False)
+        url = f'https://{env.authority_for(env.domain1, "http/1.1")}/data.json'
+        r = curl.http_download(urls=[url], with_stats=True)
+        r.check_exit_code(0)
+        r.check_stats(count=1, http_status=200, exitcode=0)
+        assert r.stats[0]['remote_ip'] == '127.0.0.1'
+
+    # dnsd with one answer for AAAA, delayed one for A
+    @pytest.mark.skipif(condition=not Env.curl_override_dns(), reason="no DNS override")
+    @pytest.mark.skipif(condition=not Env.curl_has_feature('IPv6'), reason="no IPv6")
+    def test_21_10_dnsd_aaaa_delay(self, env: Env, httpd, dnsd):
+        dnsd.set_answers(addr_a=['127.0.0.1'], addr_aaaa=['[::1]'],
+                         delay_a_ms=env.test_timeout * 1000)
+        run_env = os.environ.copy()
+        run_env['CURL_DNS_SERVER'] = f'127.0.0.1:{dnsd.port}'
+        run_env['CURL_QUICK_EXIT'] = '1'
+        curl = CurlClient(env=env, run_env=run_env, force_resolv=False)
+        url = f'https://{env.authority_for(env.domain1, "http/1.1")}/data.json'
+        r = curl.http_download(urls=[url], with_stats=True)
+        r.check_exit_code(0)
+        r.check_stats(count=1, http_status=200, exitcode=0)
+        assert r.stats[0]['remote_ip'] == '::1'
+
+    def _clean_files(self, files):
+        for file in files:
+            if os.path.exists(file):
+                os.remove(file)
diff --git a/third-party/curl/tests/http/test_22_httpsrr.py b/third-party/curl/tests/http/test_22_httpsrr.py
new file mode 100644
index 0000000000..51ed3bbd9d
--- /dev/null
+++ b/third-party/curl/tests/http/test_22_httpsrr.py
@@ -0,0 +1,131 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+import logging
+import os
+from typing import Generator
+
+import pytest
+from testenv import CurlClient, Dnsd, Env
+
+log = logging.getLogger(__name__)
+
+
+@pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+@pytest.mark.skipif(condition=not Env.curl_override_dns(), reason="no DNS override")
+@pytest.mark.skipif(condition=not Env.curl_has_feature('HTTPSRR'), reason="no HTTPSRR support")
+class TestHTTPSRR:
+
+    @pytest.fixture(scope='class')
+    def dnsd(self, env: Env) -> Generator[Dnsd, None, None]:
+        dnsd = Dnsd(env=env)
+        assert dnsd.initial_start()
+        yield dnsd
+        dnsd.stop()
+
+    # dnsd a HTTPS-RR that prefers HTTP/1.1.
+    def test_22_01_httpsrr_h1(self, env: Env, httpd, dnsd):
+        dnsd.set_answers(addr_a=['127.0.0.1'],
+                         https=['10 . alpn=http/1.1'])
+        run_env = os.environ.copy()
+        run_env['CURL_DNS_SERVER'] = f'127.0.0.1:{dnsd.port}'
+        run_env['CURL_DBG_AWAIT_HTTPSRR'] = '1'
+        run_env['CURL_QUICK_EXIT'] = '1'
+        run_env['CURL_DEBUG'] = 'dns,https-connect'
+        curl = CurlClient(env=env, run_env=run_env, force_resolv=False)
+        url = f'https://{env.authority_for(env.domain1, "http/1.1")}/data.json'
+        r = curl.http_download(urls=[url], with_stats=True)
+        r.check_exit_code(0)
+        r.check_stats(count=1, http_status=200, exitcode=0)
+        assert r.stats[0]['http_version'] == '1.1', f'{r}'
+
+    # dnsd a HTTPS-RR that prefers HTTP/2, this overrides the --http3 option.
+    @pytest.mark.skipif(condition=not Env.have_h3(), reason="missing HTTP/3 support")
+    def test_22_02_httpsrr_h3(self, env: Env, httpd, dnsd, nghttpx):
+        dnsd.set_answers(addr_a=['127.0.0.1'],
+                         https=['10 . alpn=h2'])
+        run_env = os.environ.copy()
+        run_env['CURL_DNS_SERVER'] = f'127.0.0.1:{dnsd.port}'
+        run_env['CURL_DBG_AWAIT_HTTPSRR'] = '1'
+        run_env['CURL_QUICK_EXIT'] = '1'
+        run_env['CURL_DEBUG'] = 'dns,https-connect'
+        curl = CurlClient(env=env, run_env=run_env, force_resolv=False)
+        url = f'https://{env.authority_for(env.domain1, "http/1.1")}/data.json'
+        r = curl.http_download(urls=[url], with_stats=True, extra_args=[
+            '--http3'
+        ])
+        r.check_exit_code(0)
+        r.check_stats(count=1, http_status=200, exitcode=0)
+        assert r.stats[0]['http_version'] == '2', f'{r}'
+
+    # dnsd a HTTPS-RR that prefers HTTP/3.
+    @pytest.mark.skipif(condition=not Env.have_h3(), reason="missing HTTP/3 support")
+    def test_22_03_httpsrr_h3(self, env: Env, httpd, dnsd, nghttpx):
+        dnsd.set_answers(addr_a=['127.0.0.1'],
+                         https=['10 . alpn=h3,h2'])
+        run_env = os.environ.copy()
+        run_env['CURL_DNS_SERVER'] = f'127.0.0.1:{dnsd.port}'
+        run_env['CURL_DBG_AWAIT_HTTPSRR'] = '1'
+        run_env['CURL_QUICK_EXIT'] = '1'
+        run_env['CURL_DEBUG'] = 'dns,https-connect'
+        curl = CurlClient(env=env, run_env=run_env, force_resolv=False)
+        url = f'https://{env.authority_for(env.domain1, "http/1.1")}/data.json'
+        r = curl.http_download(urls=[url], with_stats=True)
+        r.check_exit_code(0)
+        r.check_stats(count=1, http_status=200, exitcode=0)
+        assert r.stats[0]['http_version'] == '3', f'{r}'
+
+    # dnsd a HTTPS-RR that prefers HTTP/1.1 for another target, so ignored.
+    def test_22_04_httpsrr_wrong_target(self, env: Env, httpd, dnsd):
+        dnsd.set_answers(addr_a=['127.0.0.1'],
+                         https=['10 another alpn=http/1.1'])
+        run_env = os.environ.copy()
+        run_env['CURL_DNS_SERVER'] = f'127.0.0.1:{dnsd.port}'
+        run_env['CURL_DBG_AWAIT_HTTPSRR'] = '1'
+        run_env['CURL_QUICK_EXIT'] = '1'
+        run_env['CURL_DEBUG'] = 'dns,https-connect'
+        curl = CurlClient(env=env, run_env=run_env, force_resolv=False)
+        url = f'https://{env.authority_for(env.domain1, "http/1.1")}/data.json'
+        r = curl.http_download(urls=[url], with_stats=True)
+        r.check_exit_code(0)
+        r.check_stats(count=1, http_status=200, exitcode=0)
+        assert r.stats[0]['http_version'] == '2', f'{r}'
+
+    # dnsd a HTTPS-RR with no-default-alpn, ignored by curl for now
+    def test_22_05_httpsrr_no_default_alpn(self, env: Env, httpd, dnsd):
+        dnsd.set_answers(addr_a=['127.0.0.1'],
+                         https=['10 . no-default-alpn alpn=http/1.1'])
+        run_env = os.environ.copy()
+        run_env['CURL_DNS_SERVER'] = f'127.0.0.1:{dnsd.port}'
+        run_env['CURL_DBG_AWAIT_HTTPSRR'] = '1'
+        run_env['CURL_QUICK_EXIT'] = '1'
+        run_env['CURL_DEBUG'] = 'dns,https-connect'
+        curl = CurlClient(env=env, run_env=run_env, force_resolv=False)
+        url = f'https://{env.authority_for(env.domain1, "http/1.1")}/data.json'
+        r = curl.http_download(urls=[url], with_stats=True)
+        r.check_exit_code(0)
+        r.check_stats(count=1, http_status=200, exitcode=0)
+        assert r.stats[0]['http_version'] == '2', f'{r}'
diff --git a/third-party/curl/tests/http/test_30_vsftpd.py b/third-party/curl/tests/http/test_30_vsftpd.py
new file mode 100644
index 0000000000..d625852249
--- /dev/null
+++ b/third-party/curl/tests/http/test_30_vsftpd.py
@@ -0,0 +1,277 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+import difflib
+import filecmp
+import logging
+import os
+import shutil
+
+import pytest
+from testenv import CurlClient, Env, LocalClient, VsFTPD
+
+log = logging.getLogger(__name__)
+
+
+@pytest.mark.skipif(condition=not Env.has_vsftpd(), reason="missing vsftpd")
+class TestVsFTPD:
+
+    @pytest.fixture(autouse=True, scope='class')
+    def vsftpd(self, env):
+        vsftpd = VsFTPD(env=env)
+        assert vsftpd.initial_start()
+        yield vsftpd
+        vsftpd.stop()
+
+    def _make_docs_file(self, docs_dir: str, fname: str, fsize: int):
+        fpath = os.path.join(docs_dir, fname)
+        data1k = 1024*'x'
+        flen = 0
+        with open(fpath, 'w') as fd:
+            while flen < fsize:
+                fd.write(data1k)
+                flen += len(data1k)
+        return flen
+
+    @pytest.fixture(autouse=True, scope='class')
+    def _class_scope(self, env, vsftpd):
+        if os.path.exists(vsftpd.docs_dir):
+            shutil.rmtree(vsftpd.docs_dir)
+        if not os.path.exists(vsftpd.docs_dir):
+            os.makedirs(vsftpd.docs_dir)
+        self._make_docs_file(docs_dir=vsftpd.docs_dir, fname='data-0k', fsize=0)
+        self._make_docs_file(docs_dir=vsftpd.docs_dir, fname='data-1k', fsize=1024)
+        self._make_docs_file(docs_dir=vsftpd.docs_dir, fname='data-10k', fsize=10 * 1024)
+        self._make_docs_file(docs_dir=vsftpd.docs_dir, fname='data-1m', fsize=1024 * 1024)
+        self._make_docs_file(docs_dir=vsftpd.docs_dir, fname='data-10m', fsize=10 * 1024 * 1024)
+        env.make_data_file(indir=env.gen_dir, fname="upload-0k", fsize=0)
+        env.make_data_file(indir=env.gen_dir, fname="upload-1k", fsize=1024)
+        env.make_data_file(indir=env.gen_dir, fname="upload-100k", fsize=100 * 1024)
+        env.make_data_file(indir=env.gen_dir, fname="upload-1m", fsize=1024 * 1024)
+
+    def test_30_01_list_dir(self, env: Env, vsftpd: VsFTPD):
+        curl = CurlClient(env=env)
+        url = f'ftp://{env.ftp_domain}:{vsftpd.port}/'
+        r = curl.ftp_get(urls=[url], with_stats=True)
+        r.check_stats(count=1, http_status=226)
+        with open(os.path.join(curl.run_dir, 'download_#1.data')) as fd:
+            lines = fd.readlines()
+        assert len(lines) == 5, f'list: {lines}'
+        r.check_stats_timelines()
+
+    # download 1 file, no SSL
+    @pytest.mark.parametrize("docname", [
+        'data-0k', 'data-1k', 'data-1m', 'data-10m'
+    ])
+    def test_30_02_download_1(self, env: Env, vsftpd: VsFTPD, docname):
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(vsftpd.docs_dir, f'{docname}')
+        count = 1
+        url = f'ftp://{env.ftp_domain}:{vsftpd.port}/{docname}?[0-{count-1}]'
+        r = curl.ftp_get(urls=[url], with_stats=True)
+        r.check_stats(count=count, http_status=226)
+        self.check_downloads(curl, srcfile, count)
+        r.check_stats_timelines()
+
+    @pytest.mark.parametrize("docname", [
+        'data-0k', 'data-1k', 'data-1m', 'data-10m'
+    ])
+    def test_30_03_download_10_serial(self, env: Env, vsftpd: VsFTPD, docname):
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(vsftpd.docs_dir, f'{docname}')
+        count = 10
+        url = f'ftp://{env.ftp_domain}:{vsftpd.port}/{docname}?[0-{count-1}]'
+        r = curl.ftp_get(urls=[url], with_stats=True)
+        r.check_stats(count=count, http_status=226)
+        self.check_downloads(curl, srcfile, count)
+        assert r.total_connects == count + 1, 'should reuse the control conn'
+        r.check_stats_timelines()
+
+    @pytest.mark.parametrize("docname", [
+        'data-0k', 'data-1k', 'data-1m', 'data-10m'
+    ])
+    def test_30_04_download_10_parallel(self, env: Env, vsftpd: VsFTPD, docname):
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(vsftpd.docs_dir, f'{docname}')
+        count = 10
+        url = f'ftp://{env.ftp_domain}:{vsftpd.port}/{docname}?[0-{count-1}]'
+        r = curl.ftp_get(urls=[url], with_stats=True, extra_args=[
+            '--parallel'
+        ])
+        r.check_stats(count=count, http_status=226)
+        self.check_downloads(curl, srcfile, count)
+        assert r.total_connects > count + 1, 'should have used several control conns'
+        r.check_stats_timelines()
+
+    @pytest.mark.parametrize("docname", [
+        'upload-0k', 'upload-1k', 'upload-100k', 'upload-1m'
+    ])
+    def test_30_05_upload_1(self, env: Env, vsftpd: VsFTPD, docname):
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(env.gen_dir, docname)
+        dstfile = os.path.join(vsftpd.docs_dir, docname)
+        self._rmf(dstfile)
+        count = 1
+        url = f'ftp://{env.ftp_domain}:{vsftpd.port}/'
+        r = curl.ftp_upload(urls=[url], fupload=f'{srcfile}', with_stats=True)
+        r.check_stats(count=count, http_status=226)
+        self.check_upload(env, vsftpd, docname=docname)
+        r.check_stats_timelines()
+
+    def _rmf(self, path):
+        if os.path.exists(path):
+            os.remove(path)
+
+    # check with `tcpdump` if curl causes any TCP RST packets
+    @pytest.mark.skipif(condition=not Env.tcpdump(), reason="tcpdump not available")
+    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
+    def test_30_06_shutdown_download(self, env: Env, vsftpd: VsFTPD):
+        docname = 'data-1k'
+        curl = CurlClient(env=env)
+        count = 1
+        url = f'ftp://{env.ftp_domain}:{vsftpd.port}/{docname}?[0-{count-1}]'
+        r = curl.ftp_get(urls=[url], with_stats=True, with_tcpdump=True)
+        r.check_stats(count=count, http_status=226)
+        assert r.tcpdump
+        # vsftp closes control connection without niceties,
+        # look only at ports from DATA connection.
+        data_ports = vsftpd.get_data_ports(r)
+        assert len(data_ports), f'unable to find FTP data port connected to\n{r.dump_logs()}'
+        assert len(r.tcpdump.get_rsts(ports=data_ports)) == 0, 'Unexpected TCP RST packets'
+
+    # check with `tcpdump` if curl causes any TCP RST packets
+    @pytest.mark.skipif(condition=not Env.tcpdump(), reason="tcpdump not available")
+    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
+    def test_30_07_shutdown_upload(self, env: Env, vsftpd: VsFTPD):
+        docname = 'upload-1k'
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(env.gen_dir, docname)
+        dstfile = os.path.join(vsftpd.docs_dir, docname)
+        self._rmf(dstfile)
+        count = 1
+        url = f'ftp://{env.ftp_domain}:{vsftpd.port}/'
+        r = curl.ftp_upload(urls=[url], fupload=f'{srcfile}', with_stats=True, with_tcpdump=True)
+        r.check_stats(count=count, http_status=226)
+        assert r.tcpdump
+        # vsftp closes control connection without niceties,
+        # look only at ports from DATA connection.
+        data_ports = vsftpd.get_data_ports(r)
+        assert len(data_ports), f'unable to find FTP data port connected to\n{r.dump_logs()}'
+        assert len(r.tcpdump.get_rsts(ports=data_ports)) == 0, 'Unexpected TCP RST packets'
+
+    def test_30_08_active_download(self, env: Env, vsftpd: VsFTPD):
+        docname = 'data-10k'
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(vsftpd.docs_dir, f'{docname}')
+        count = 1
+        url = f'ftp://{env.ftp_domain}:{vsftpd.port}/{docname}?[0-{count-1}]'
+        r = curl.ftp_get(urls=[url], with_stats=True, extra_args=[
+            '--ftp-port', '127.0.0.1'
+        ])
+        r.check_stats(count=count, http_status=226)
+        self.check_downloads(curl, srcfile, count)
+        r.check_stats_timelines()
+
+    def test_30_09_active_up_file(self, env: Env, vsftpd: VsFTPD):
+        docname = 'upload-1k'
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(env.gen_dir, docname)
+        dstfile = os.path.join(vsftpd.docs_dir, docname)
+        self._rmf(dstfile)
+        count = 1
+        url = f'ftp://{env.ftp_domain}:{vsftpd.port}/'
+        r = curl.ftp_upload(urls=[url], fupload=f'{srcfile}', with_stats=True, extra_args=[
+            '--ftp-port', '127.0.0.1'
+        ])
+        r.check_stats(count=count, http_status=226)
+        self.check_upload(env, vsftpd, docname=docname)
+        r.check_stats_timelines()
+
+    def test_30_10_active_up_ascii(self, env: Env, vsftpd: VsFTPD):
+        docname = 'upload-1k'
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(env.gen_dir, docname)
+        dstfile = os.path.join(vsftpd.docs_dir, docname)
+        self._rmf(dstfile)
+        count = 1
+        url = f'ftp://{env.ftp_domain}:{vsftpd.port}/'
+        r = curl.ftp_upload(urls=[url], fupload=f'{srcfile}', with_stats=True, extra_args=[
+            '--ftp-port', '127.0.0.1', '--use-ascii'
+        ])
+        r.check_stats(count=count, http_status=226)
+        self.check_upload(env, vsftpd, docname=docname, binary=False)
+        r.check_stats_timelines()
+
+    def test_30_11_download_non_existing(self, env: Env, vsftpd: VsFTPD):
+        curl = CurlClient(env=env)
+        url = f'ftp://{env.ftp_domain}:{vsftpd.port}/does-not-exist'
+        r = curl.ftp_get(urls=[url], with_stats=True)
+        r.check_exit_code(78)
+        r.check_stats(count=1, exitcode=78)
+        r.check_stats_timelines()
+
+    def test_30_12_upload_eprt(self, env: Env, vsftpd: VsFTPD):
+        docname = 'test_30_12'
+        client = LocalClient(name='cli_ftp_upload', env=env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        url = f'ftp://{env.ftp_domain}:{vsftpd.port}/{docname}'
+        r = client.run(args=['-r', f'{env.ftp_domain}:{vsftpd.port}:127.0.0.1', url])
+        r.check_exit_code(0)
+        dstfile = os.path.join(vsftpd.docs_dir, docname)
+        assert os.path.exists(dstfile), f'{r.dump_logs()}'
+
+    def check_downloads(self, client, srcfile: str, count: int,
+                        complete: bool = True):
+        for i in range(count):
+            dfile = client.download_file(i)
+            assert os.path.exists(dfile)
+            if complete and not filecmp.cmp(srcfile, dfile, shallow=False):
+                with open(srcfile) as fa, open(dfile) as fb:
+                    a = fa.readlines()
+                    b = fb.readlines()
+                diff = "".join(difflib.unified_diff(a=a, b=b,
+                                                    fromfile=srcfile,
+                                                    tofile=dfile,
+                                                    n=1))
+                assert False, f'download {dfile} differs:\n{diff}'
+
+    def check_upload(self, env, vsftpd: VsFTPD, docname, binary=True):
+        srcfile = os.path.join(env.gen_dir, docname)
+        dstfile = os.path.join(vsftpd.docs_dir, docname)
+        assert os.path.exists(srcfile)
+        assert os.path.exists(dstfile)
+        if not filecmp.cmp(srcfile, dstfile, shallow=False):
+            with open(srcfile) as fa, open(dstfile) as fb:
+                a = fa.readlines()
+                b = fb.readlines()
+            diff = "".join(difflib.unified_diff(a=a, b=b,
+                                                fromfile=srcfile,
+                                                tofile=dstfile,
+                                                n=1))
+            assert not binary and len(diff) == 0, f'upload {dstfile} differs:\n{diff}'
diff --git a/third-party/curl/tests/http/test_31_vsftpds.py b/third-party/curl/tests/http/test_31_vsftpds.py
new file mode 100644
index 0000000000..ac4c154c47
--- /dev/null
+++ b/third-party/curl/tests/http/test_31_vsftpds.py
@@ -0,0 +1,328 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+import difflib
+import filecmp
+import logging
+import os
+import shutil
+
+import pytest
+from testenv import CurlClient, Env, LocalClient, VsFTPD
+
+log = logging.getLogger(__name__)
+
+
+@pytest.mark.skipif(condition=not Env.has_vsftpd(), reason="missing vsftpd")
+class TestVsFTPD:
+
+    SUPPORTS_SSL = True
+
+    @pytest.fixture(autouse=True, scope='class')
+    def vsftpds(self, env):
+        if not TestVsFTPD.SUPPORTS_SSL:
+            pytest.skip('vsftpd does not seem to support SSL')
+        vsftpds = VsFTPD(env=env, with_ssl=True)
+        if not vsftpds.initial_start():
+            vsftpds.stop()
+            TestVsFTPD.SUPPORTS_SSL = False
+            pytest.skip('vsftpd does not seem to support SSL')
+        yield vsftpds
+        vsftpds.stop()
+
+    def _make_docs_file(self, docs_dir: str, fname: str, fsize: int):
+        fpath = os.path.join(docs_dir, fname)
+        data1k = 1024*'x'
+        flen = 0
+        with open(fpath, 'w') as fd:
+            while flen < fsize:
+                fd.write(data1k)
+                flen += len(data1k)
+        return flen
+
+    @pytest.fixture(autouse=True, scope='class')
+    def _class_scope(self, env, vsftpds):
+        if os.path.exists(vsftpds.docs_dir):
+            shutil.rmtree(vsftpds.docs_dir)
+        if not os.path.exists(vsftpds.docs_dir):
+            os.makedirs(vsftpds.docs_dir)
+        self._make_docs_file(docs_dir=vsftpds.docs_dir, fname='data-1k', fsize=1024)
+        self._make_docs_file(docs_dir=vsftpds.docs_dir, fname='data-10k', fsize=10 * 1024)
+        self._make_docs_file(docs_dir=vsftpds.docs_dir, fname='data-1m', fsize=1024 * 1024)
+        self._make_docs_file(docs_dir=vsftpds.docs_dir, fname='data-10m', fsize=10 * 1024 * 1024)
+        env.make_data_file(indir=env.gen_dir, fname="upload-1k", fsize=1024)
+        env.make_data_file(indir=env.gen_dir, fname="upload-100k", fsize=100 * 1024)
+        env.make_data_file(indir=env.gen_dir, fname="upload-1m", fsize=1024 * 1024)
+
+    def test_31_01_list_dir(self, env: Env, vsftpds: VsFTPD):
+        curl = CurlClient(env=env)
+        url = f'ftp://{env.ftp_domain}:{vsftpds.port}/'
+        r = curl.ftp_ssl_get(urls=[url], with_stats=True)
+        r.check_stats(count=1, http_status=226)
+        with open(os.path.join(curl.run_dir, 'download_#1.data')) as fd:
+            lines = fd.readlines()
+        assert len(lines) == 4, f'list: {lines}'
+        r.check_stats_timelines()
+
+    # download 1 file, no SSL
+    @pytest.mark.parametrize("docname", [
+        'data-1k', 'data-1m', 'data-10m'
+    ])
+    def test_31_02_download_1(self, env: Env, vsftpds: VsFTPD, docname):
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(vsftpds.docs_dir, f'{docname}')
+        count = 1
+        url = f'ftp://{env.ftp_domain}:{vsftpds.port}/{docname}?[0-{count-1}]'
+        r = curl.ftp_ssl_get(urls=[url], with_stats=True)
+        r.check_stats(count=count, http_status=226)
+        self.check_downloads(curl, srcfile, count)
+        r.check_stats_timelines()
+
+    @pytest.mark.parametrize("docname", [
+        'data-1k', 'data-1m', 'data-10m'
+    ])
+    def test_31_03_download_10_serial(self, env: Env, vsftpds: VsFTPD, docname):
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(vsftpds.docs_dir, f'{docname}')
+        count = 10
+        url = f'ftp://{env.ftp_domain}:{vsftpds.port}/{docname}?[0-{count-1}]'
+        r = curl.ftp_ssl_get(urls=[url], with_stats=True)
+        r.check_stats(count=count, http_status=226)
+        self.check_downloads(curl, srcfile, count)
+        assert r.total_connects == count + 1, 'should reuse the control conn'
+        r.check_stats_timelines()
+
+    @pytest.mark.parametrize("docname", [
+        'data-1k', 'data-1m', 'data-10m'
+    ])
+    def test_31_04_download_10_parallel(self, env: Env, vsftpds: VsFTPD, docname):
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(vsftpds.docs_dir, f'{docname}')
+        count = 10
+        url = f'ftp://{env.ftp_domain}:{vsftpds.port}/{docname}?[0-{count-1}]'
+        r = curl.ftp_ssl_get(urls=[url], with_stats=True, extra_args=[
+            '--parallel'
+        ])
+        r.check_stats(count=count, http_status=226)
+        self.check_downloads(curl, srcfile, count)
+        assert r.total_connects > count + 1, 'should have used several control conns'
+        r.check_stats_timelines()
+
+    @pytest.mark.parametrize("docname", [
+        'upload-1k', 'upload-100k', 'upload-1m'
+    ])
+    def test_31_05_upload_1(self, env: Env, vsftpds: VsFTPD, docname):
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(env.gen_dir, docname)
+        dstfile = os.path.join(vsftpds.docs_dir, docname)
+        self._rmf(dstfile)
+        count = 1
+        url = f'ftp://{env.ftp_domain}:{vsftpds.port}/'
+        r = curl.ftp_ssl_upload(urls=[url], fupload=f'{srcfile}', with_stats=True)
+        r.check_stats(count=count, http_status=226)
+        self.check_upload(env, vsftpds, docname=docname)
+        r.check_stats_timelines()
+
+    def _rmf(self, path):
+        if os.path.exists(path):
+            os.remove(path)
+
+    # check with `tcpdump` if curl causes any TCP RST packets
+    @pytest.mark.skipif(condition=not Env.tcpdump(), reason="tcpdump not available")
+    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
+    def test_31_06_shutdown_download(self, env: Env, vsftpds: VsFTPD):
+        docname = 'data-1k'
+        curl = CurlClient(env=env)
+        count = 1
+        url = f'ftp://{env.ftp_domain}:{vsftpds.port}/{docname}?[0-{count-1}]'
+        r = curl.ftp_ssl_get(urls=[url], with_stats=True, with_tcpdump=True)
+        r.check_stats(count=count, http_status=226)
+        # vsftp closes control connection without niceties,
+        # look only at ports from DATA connection.
+        data_ports = vsftpds.get_data_ports(r)
+        assert len(data_ports), f'unable to find FTP data port connected to\n{r.dump_logs()}'
+        assert len(r.tcpdump.get_rsts(ports=data_ports)) == 0, 'Unexpected TCP RST packets'
+
+    # check with `tcpdump` if curl causes any TCP RST packets
+    @pytest.mark.skipif(condition=not Env.tcpdump(), reason="tcpdump not available")
+    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
+    def test_31_07_shutdown_upload(self, env: Env, vsftpds: VsFTPD):
+        docname = 'upload-1k'
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(env.gen_dir, docname)
+        dstfile = os.path.join(vsftpds.docs_dir, docname)
+        self._rmf(dstfile)
+        count = 1
+        url = f'ftp://{env.ftp_domain}:{vsftpds.port}/'
+        r = curl.ftp_ssl_upload(urls=[url], fupload=f'{srcfile}', with_stats=True, with_tcpdump=True)
+        r.check_stats(count=count, http_status=226)
+        # vsftp closes control connection without niceties,
+        # look only at ports from DATA connection.
+        data_ports = vsftpds.get_data_ports(r)
+        assert len(data_ports), f'unable to find FTP data port connected to\n{r.dump_logs()}'
+        assert len(r.tcpdump.get_rsts(ports=data_ports)) == 0, 'Unexpected TCP RST packets'
+
+    def test_31_08_upload_ascii(self, env: Env, vsftpds: VsFTPD):
+        docname = 'upload-ascii'
+        line_length = 21
+        srcfile = os.path.join(env.gen_dir, docname)
+        dstfile = os.path.join(vsftpds.docs_dir, docname)
+        env.make_data_file(indir=env.gen_dir, fname=docname, fsize=100 * 1024,
+                           line_length=line_length)
+        srcsize = os.path.getsize(srcfile)
+        self._rmf(dstfile)
+        count = 1
+        curl = CurlClient(env=env)
+        url = f'ftp://{env.ftp_domain}:{vsftpds.port}/'
+        r = curl.ftp_ssl_upload(urls=[url], fupload=f'{srcfile}', with_stats=True,
+                                extra_args=['--use-ascii'])
+        r.check_stats(count=count, http_status=226)
+        # expect the uploaded file to be number of converted newlines larger
+        dstsize = os.path.getsize(dstfile)
+        with open(srcfile) as fd:
+            newlines = len(fd.readlines())
+        assert (srcsize + newlines) == dstsize, \
+            f'expected source with {newlines} lines to be that much larger,'\
+            f'instead srcsize={srcsize}, upload size={dstsize}, diff={dstsize-srcsize}'
+
+    def test_31_08_active_download(self, env: Env, vsftpds: VsFTPD):
+        docname = 'data-10k'
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(vsftpds.docs_dir, f'{docname}')
+        count = 1
+        url = f'ftp://{env.ftp_domain}:{vsftpds.port}/{docname}?[0-{count-1}]'
+        r = curl.ftp_ssl_get(urls=[url], with_stats=True, extra_args=[
+            '--ftp-port', '127.0.0.1'
+        ])
+        r.check_stats(count=count, http_status=226)
+        self.check_downloads(curl, srcfile, count)
+
+    def test_31_09_active_upload(self, env: Env, vsftpds: VsFTPD):
+        docname = 'upload-1k'
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(env.gen_dir, docname)
+        dstfile = os.path.join(vsftpds.docs_dir, docname)
+        self._rmf(dstfile)
+        count = 1
+        url = f'ftp://{env.ftp_domain}:{vsftpds.port}/'
+        r = curl.ftp_ssl_upload(urls=[url], fupload=f'{srcfile}', with_stats=True, extra_args=[
+            '--ftp-port', '127.0.0.1'
+        ])
+        r.check_stats(count=count, http_status=226)
+        self.check_upload(env, vsftpds, docname=docname)
+
+    @pytest.mark.parametrize("indata", [
+        pytest.param('1234567890', id='10-bytes'),
+        pytest.param('', id='0-bytes'),
+    ])
+    def test_31_10_upload_stdin(self, env: Env, vsftpds: VsFTPD, indata):
+        curl = CurlClient(env=env)
+        docname = "upload_31_10"
+        dstfile = os.path.join(vsftpds.docs_dir, docname)
+        self._rmf(dstfile)
+        count = 1
+        url = f'ftp://{env.ftp_domain}:{vsftpds.port}/{docname}'
+        r = curl.ftp_ssl_upload(urls=[url], updata=indata, with_stats=True)
+        r.check_stats(count=count, http_status=226)
+        assert os.path.exists(dstfile)
+        with open(dstfile) as fd:
+            destdata = fd.readlines()
+        expdata = [indata] if len(indata) else []
+        assert expdata == destdata, f'expected: {expdata}, got: {destdata}'
+
+    def test_31_11_download_non_existing(self, env: Env, vsftpds: VsFTPD):
+        curl = CurlClient(env=env)
+        url = f'ftp://{env.ftp_domain}:{vsftpds.port}/does-not-exist'
+        r = curl.ftp_ssl_get(urls=[url], with_stats=True)
+        r.check_exit_code(78)
+        r.check_stats(count=1, exitcode=78)
+
+    def test_31_12_upload_eprt(self, env: Env, vsftpds: VsFTPD):
+        docname = 'test_31_12'
+        client = LocalClient(name='cli_ftp_upload', env=env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        url = f'ftp://{env.ftp_domain}:{vsftpds.port}/{docname}'
+        r = client.run(args=['-r', f'{env.ftp_domain}:{vsftpds.port}:127.0.0.1', url])
+        r.check_exit_code(0)
+        dstfile = os.path.join(vsftpds.docs_dir, docname)
+        assert os.path.exists(dstfile), f'{r.dump_logs()}'
+
+    # connection reuse with STARTTLS required
+    # 1st download without STARTTLS, 2nd with --ssl-reqd
+    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+    def test_31_13_starttls_reuse(self, env: Env, vsftpds: VsFTPD):
+        run_env = os.environ.copy()
+        run_env['CURL_DBG_NO_USE_SSL_ON_FIRST'] = '1'
+        curl = CurlClient(env=env, run_env=run_env)
+        url1 = f'ftp://{env.ftp_domain}:{vsftpds.port}/data-1k'
+        url2 = f'ftp://{env.ftp_domain}:{vsftpds.port}/data-10k'
+        r = curl.run_direct(with_stats=True, args=[
+            '-svv', '--resolve', f'{env.ftp_domain}:{vsftpds.port}:127.0.0.1',
+            '--cacert', env.ca.cert_file,
+            url1, '--out-null',
+            url2, '--out-null', '--ssl-reqd'
+        ])
+        r.check_exit_code(0)
+        r.check_stats(count=2, http_status=226)
+        # expect 4 connections to have been made:
+        # 1. 1st CONTROL without STARTTLS
+        # 2. 1st DATA for download
+        # 3. 2nd CONTROL with STARTTLS (not reuse of 1)
+        # 4. 2nd DATA for download
+        assert r.total_connects == 4, f'{r.dump_logs()}'
+
+    def check_downloads(self, client, srcfile: str, count: int,
+                        complete: bool = True):
+        for i in range(count):
+            dfile = client.download_file(i)
+            assert os.path.exists(dfile)
+            if complete and not filecmp.cmp(srcfile, dfile, shallow=False):
+                with open(srcfile) as fa, open(dfile) as fb:
+                    a = fa.readlines()
+                    b = fb.readlines()
+                diff = "".join(difflib.unified_diff(a=a, b=b,
+                                                    fromfile=srcfile,
+                                                    tofile=dfile,
+                                                    n=1))
+                assert False, f'download {dfile} differs:\n{diff}'
+
+    def check_upload(self, env, vsftpd: VsFTPD, docname):
+        srcfile = os.path.join(env.gen_dir, docname)
+        dstfile = os.path.join(vsftpd.docs_dir, docname)
+        assert os.path.exists(srcfile)
+        assert os.path.exists(dstfile)
+        if not filecmp.cmp(srcfile, dstfile, shallow=False):
+            with open(srcfile) as fa, open(dstfile) as fb:
+                a = fa.readlines()
+                b = fb.readlines()
+            diff = "".join(difflib.unified_diff(a=a, b=b,
+                                                fromfile=srcfile,
+                                                tofile=dstfile,
+                                                n=1))
+            assert False, f'upload {dstfile} differs:\n{diff}'
diff --git a/third-party/curl/tests/http/test_32_ftps_vsftpd.py b/third-party/curl/tests/http/test_32_ftps_vsftpd.py
new file mode 100644
index 0000000000..1181bb3211
--- /dev/null
+++ b/third-party/curl/tests/http/test_32_ftps_vsftpd.py
@@ -0,0 +1,317 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+import difflib
+import filecmp
+import logging
+import os
+import shutil
+
+import pytest
+from testenv import CurlClient, Env, LocalClient, VsFTPD
+
+log = logging.getLogger(__name__)
+
+
+@pytest.mark.skipif(condition=not Env.has_vsftpd(), reason="missing vsftpd")
+class TestFtpsVsFTPD:
+
+    SUPPORTS_SSL = True
+
+    @pytest.fixture(autouse=True, scope='class')
+    def vsftpds(self, env):
+        if not TestFtpsVsFTPD.SUPPORTS_SSL:
+            pytest.skip('vsftpd does not seem to support SSL')
+        vsftpds = VsFTPD(env=env, with_ssl=True, ssl_implicit=True)
+        if not vsftpds.initial_start():
+            vsftpds.stop()
+            TestFtpsVsFTPD.SUPPORTS_SSL = False
+            pytest.skip('vsftpd does not seem to support SSL')
+        yield vsftpds
+        vsftpds.stop()
+
+    def _make_docs_file(self, docs_dir: str, fname: str, fsize: int):
+        fpath = os.path.join(docs_dir, fname)
+        data1k = 1024*'x'
+        flen = 0
+        with open(fpath, 'w') as fd:
+            while flen < fsize:
+                fd.write(data1k)
+                flen += len(data1k)
+        return flen
+
+    @pytest.fixture(autouse=True, scope='class')
+    def _class_scope(self, env, vsftpds):
+        if os.path.exists(vsftpds.docs_dir):
+            shutil.rmtree(vsftpds.docs_dir)
+        if not os.path.exists(vsftpds.docs_dir):
+            os.makedirs(vsftpds.docs_dir)
+        self._make_docs_file(docs_dir=vsftpds.docs_dir, fname='data-1k', fsize=1024)
+        self._make_docs_file(docs_dir=vsftpds.docs_dir, fname='data-10k', fsize=10 * 1024)
+        self._make_docs_file(docs_dir=vsftpds.docs_dir, fname='data-1m', fsize=1024 * 1024)
+        self._make_docs_file(docs_dir=vsftpds.docs_dir, fname='data-10m', fsize=10 * 1024 * 1024)
+        env.make_data_file(indir=env.gen_dir, fname="upload-1k", fsize=1024)
+        env.make_data_file(indir=env.gen_dir, fname="upload-100k", fsize=100 * 1024)
+        env.make_data_file(indir=env.gen_dir, fname="upload-1m", fsize=1024 * 1024)
+
+    def test_32_01_list_dir(self, env: Env, vsftpds: VsFTPD):
+        curl = CurlClient(env=env)
+        url = f'ftps://{env.ftp_domain}:{vsftpds.port}/'
+        r = curl.ftp_get(urls=[url], with_stats=True)
+        r.check_stats(count=1, http_status=226)
+        with open(os.path.join(curl.run_dir, 'download_#1.data')) as fd:
+            lines = fd.readlines()
+        assert len(lines) == 4, f'list: {lines}'
+        r.check_stats_timelines()
+
+    # download 1 file, no SSL
+    @pytest.mark.parametrize("docname", [
+        'data-1k', 'data-1m', 'data-10m'
+    ])
+    def test_32_02_download_1(self, env: Env, vsftpds: VsFTPD, docname):
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(vsftpds.docs_dir, f'{docname}')
+        count = 1
+        url = f'ftps://{env.ftp_domain}:{vsftpds.port}/{docname}?[0-{count-1}]'
+        r = curl.ftp_get(urls=[url], with_stats=True)
+        r.check_stats(count=count, http_status=226)
+        self.check_downloads(curl, srcfile, count)
+        r.check_stats_timelines()
+
+    @pytest.mark.parametrize("docname", [
+        'data-1k', 'data-1m', 'data-10m'
+    ])
+    def test_32_03_download_10_serial(self, env: Env, vsftpds: VsFTPD, docname):
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(vsftpds.docs_dir, f'{docname}')
+        count = 10
+        url = f'ftps://{env.ftp_domain}:{vsftpds.port}/{docname}?[0-{count-1}]'
+        r = curl.ftp_get(urls=[url], with_stats=True)
+        r.check_stats(count=count, http_status=226)
+        self.check_downloads(curl, srcfile, count)
+        assert r.total_connects == count + 1, 'should reuse the control conn'
+        r.check_stats_timelines()
+
+    # 2 serial transfers, first with 'ftps://' and second with 'ftp://'
+    # we want connection reuse in this case
+    def test_32_03b_ftp_compat_ftps(self, env: Env, vsftpds: VsFTPD):
+        curl = CurlClient(env=env)
+        docname = 'data-1k'
+        count = 2
+        url1= f'ftps://{env.ftp_domain}:{vsftpds.port}/{docname}'
+        url2 = f'ftp://{env.ftp_domain}:{vsftpds.port}/{docname}'
+        r = curl.ftp_get(urls=[url1, url2], with_stats=True)
+        r.check_stats(count=count, http_status=226)
+        assert r.total_connects == count + 1, 'should reuse the control conn'
+        r.check_stats_timelines()
+
+    @pytest.mark.parametrize("docname", [
+        'data-1k', 'data-1m', 'data-10m'
+    ])
+    def test_32_04_download_10_parallel(self, env: Env, vsftpds: VsFTPD, docname):
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(vsftpds.docs_dir, f'{docname}')
+        count = 10
+        url = f'ftps://{env.ftp_domain}:{vsftpds.port}/{docname}?[0-{count-1}]'
+        r = curl.ftp_get(urls=[url], with_stats=True, extra_args=[
+            '--parallel'
+        ])
+        r.check_stats(count=count, http_status=226)
+        self.check_downloads(curl, srcfile, count)
+        assert r.total_connects > count + 1, 'should have used several control conns'
+        r.check_stats_timelines()
+
+    @pytest.mark.parametrize("docname", [
+        'upload-1k', 'upload-100k', 'upload-1m'
+    ])
+    def test_32_05_upload_1(self, env: Env, vsftpds: VsFTPD, docname):
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(env.gen_dir, docname)
+        dstfile = os.path.join(vsftpds.docs_dir, docname)
+        self._rmf(dstfile)
+        count = 1
+        url = f'ftps://{env.ftp_domain}:{vsftpds.port}/'
+        r = curl.ftp_upload(urls=[url], fupload=f'{srcfile}', with_stats=True)
+        r.check_stats(count=count, http_status=226)
+        self.check_upload(env, vsftpds, docname=docname)
+        r.check_stats_timelines()
+
+    def _rmf(self, path):
+        if os.path.exists(path):
+            os.remove(path)
+
+    # check with `tcpdump` if curl causes any TCP RST packets
+    @pytest.mark.skipif(condition=not Env.tcpdump(), reason="tcpdump not available")
+    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
+    def test_32_06_shutdown_download(self, env: Env, vsftpds: VsFTPD):
+        docname = 'data-1k'
+        curl = CurlClient(env=env)
+        count = 1
+        url = f'ftps://{env.ftp_domain}:{vsftpds.port}/{docname}?[0-{count-1}]'
+        r = curl.ftp_get(urls=[url], with_stats=True, with_tcpdump=True)
+        r.check_stats(count=count, http_status=226)
+        # vsftp closes control connection without niceties,
+        # look only at ports from DATA connection.
+        data_ports = vsftpds.get_data_ports(r)
+        assert len(data_ports), f'unable to find FTP data port connected to\n{r.dump_logs()}'
+        assert len(r.tcpdump.get_rsts(ports=data_ports)) == 0, 'Unexpected TCP RST packets'
+
+    # check with `tcpdump` if curl causes any TCP RST packets
+    @pytest.mark.skipif(condition=not Env.tcpdump(), reason="tcpdump not available")
+    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
+    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
+    def test_32_07_shutdown_upload(self, env: Env, vsftpds: VsFTPD):
+        docname = 'upload-1k'
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(env.gen_dir, docname)
+        dstfile = os.path.join(vsftpds.docs_dir, docname)
+        self._rmf(dstfile)
+        count = 1
+        url = f'ftps://{env.ftp_domain}:{vsftpds.port}/'
+        r = curl.ftp_upload(urls=[url], fupload=f'{srcfile}', with_stats=True, with_tcpdump=True)
+        r.check_stats(count=count, http_status=226)
+        # vsftp closes control connection without niceties,
+        # look only at ports from DATA connection.
+        data_ports = vsftpds.get_data_ports(r)
+        assert len(data_ports), f'unable to find FTP data port connected to\n{r.dump_logs()}'
+        assert len(r.tcpdump.get_rsts(ports=data_ports)) == 0, 'Unexpected TCP RST packets'
+
+    def test_32_08_upload_ascii(self, env: Env, vsftpds: VsFTPD):
+        docname = 'upload-ascii'
+        line_length = 21
+        srcfile = os.path.join(env.gen_dir, docname)
+        dstfile = os.path.join(vsftpds.docs_dir, docname)
+        env.make_data_file(indir=env.gen_dir, fname=docname, fsize=100 * 1024,
+                           line_length=line_length)
+        srcsize = os.path.getsize(srcfile)
+        self._rmf(dstfile)
+        count = 1
+        curl = CurlClient(env=env)
+        url = f'ftps://{env.ftp_domain}:{vsftpds.port}/'
+        r = curl.ftp_upload(urls=[url], fupload=f'{srcfile}', with_stats=True,
+                            extra_args=['--use-ascii'])
+        r.check_stats(count=count, http_status=226)
+        # expect the uploaded file to be number of converted newlines larger
+        dstsize = os.path.getsize(dstfile)
+        with open(srcfile) as fd:
+            newlines = len(fd.readlines())
+        assert (srcsize + newlines) == dstsize, \
+            f'expected source with {newlines} lines to be that much larger,'\
+            f'instead srcsize={srcsize}, upload size={dstsize}, diff={dstsize-srcsize}'
+
+    def test_32_08_active_download(self, env: Env, vsftpds: VsFTPD):
+        docname = 'data-10k'
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(vsftpds.docs_dir, f'{docname}')
+        count = 1
+        url = f'ftps://{env.ftp_domain}:{vsftpds.port}/{docname}?[0-{count-1}]'
+        r = curl.ftp_get(urls=[url], with_stats=True, extra_args=[
+            '--ftp-port', '127.0.0.1'
+        ])
+        r.check_stats(count=count, http_status=226)
+        self.check_downloads(curl, srcfile, count)
+
+    def test_32_09_active_upload(self, env: Env, vsftpds: VsFTPD):
+        docname = 'upload-1k'
+        curl = CurlClient(env=env)
+        srcfile = os.path.join(env.gen_dir, docname)
+        dstfile = os.path.join(vsftpds.docs_dir, docname)
+        self._rmf(dstfile)
+        count = 1
+        url = f'ftps://{env.ftp_domain}:{vsftpds.port}/'
+        r = curl.ftp_upload(urls=[url], fupload=f'{srcfile}', with_stats=True, extra_args=[
+            '--ftp-port', '127.0.0.1'
+        ])
+        r.check_stats(count=count, http_status=226)
+        self.check_upload(env, vsftpds, docname=docname)
+
+    @pytest.mark.parametrize("indata", [
+        pytest.param('1234567890', id='10-bytes'),
+        pytest.param('', id='0-bytes'),
+    ])
+    def test_32_10_upload_stdin(self, env: Env, vsftpds: VsFTPD, indata):
+        curl = CurlClient(env=env)
+        docname = "upload_31_10"
+        dstfile = os.path.join(vsftpds.docs_dir, docname)
+        self._rmf(dstfile)
+        count = 1
+        url = f'ftps://{env.ftp_domain}:{vsftpds.port}/{docname}'
+        r = curl.ftp_upload(urls=[url], updata=indata, with_stats=True)
+        r.check_stats(count=count, http_status=226)
+        assert os.path.exists(dstfile)
+        with open(dstfile) as fd:
+            destdata = fd.readlines()
+        expdata = [indata] if len(indata) else []
+        assert expdata == destdata, f'expected: {expdata}, got: {destdata}'
+
+    def test_32_11_download_non_existing(self, env: Env, vsftpds: VsFTPD):
+        curl = CurlClient(env=env)
+        url = f'ftps://{env.ftp_domain}:{vsftpds.port}/does-not-exist'
+        r = curl.ftp_get(urls=[url], with_stats=True)
+        r.check_exit_code(78)
+        r.check_stats(count=1, exitcode=78)
+
+    def test_32_12_upload_eprt(self, env: Env, vsftpds: VsFTPD):
+        docname = 'test_32_12'
+        client = LocalClient(name='cli_ftp_upload', env=env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        url = f'ftps://{env.ftp_domain}:{vsftpds.port}/{docname}'
+        r = client.run(args=['-r', f'{env.ftp_domain}:{vsftpds.port}:127.0.0.1', url])
+        r.check_exit_code(0)
+        dstfile = os.path.join(vsftpds.docs_dir, docname)
+        assert os.path.exists(dstfile), f'{r.dump_logs()}'
+
+    def check_downloads(self, client, srcfile: str, count: int,
+                        complete: bool = True):
+        for i in range(count):
+            dfile = client.download_file(i)
+            assert os.path.exists(dfile)
+            if complete and not filecmp.cmp(srcfile, dfile, shallow=False):
+                with open(srcfile) as fa, open(dfile) as fb:
+                    a = fa.readlines()
+                    b = fb.readlines()
+                diff = "".join(difflib.unified_diff(a=a, b=b,
+                                                    fromfile=srcfile,
+                                                    tofile=dfile,
+                                                    n=1))
+                assert False, f'download {dfile} differs:\n{diff}'
+
+    def check_upload(self, env, vsftpd: VsFTPD, docname):
+        srcfile = os.path.join(env.gen_dir, docname)
+        dstfile = os.path.join(vsftpd.docs_dir, docname)
+        assert os.path.exists(srcfile)
+        assert os.path.exists(dstfile)
+        if not filecmp.cmp(srcfile, dstfile, shallow=False):
+            with open(srcfile) as fa, open(dstfile) as fb:
+                a = fa.readlines()
+                b = fb.readlines()
+            diff = "".join(difflib.unified_diff(a=a, b=b,
+                                                fromfile=srcfile,
+                                                tofile=dstfile,
+                                                n=1))
+            assert False, f'upload {dstfile} differs:\n{diff}'
diff --git a/third-party/curl/tests/http/test_40_socks.py b/third-party/curl/tests/http/test_40_socks.py
new file mode 100644
index 0000000000..f4ae322f73
--- /dev/null
+++ b/third-party/curl/tests/http/test_40_socks.py
@@ -0,0 +1,122 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+import logging
+import os
+import time
+from typing import Generator
+
+import pytest
+from testenv import CurlClient, Dante, Env
+
+log = logging.getLogger(__name__)
+
+
+@pytest.mark.skipif(condition=not Env.has_danted(), reason="missing danted")
+class TestSocks:
+
+    @pytest.fixture(scope='class')
+    def danted(self, env: Env) -> Generator[Dante, None, None]:
+        danted = Dante(env=env)
+        assert danted.initial_start()
+        time.sleep(1)
+        yield danted
+        danted.stop()
+
+    @pytest.fixture(autouse=True, scope='class')
+    def _class_scope(self, env, httpd):
+        indir = httpd.docs_dir
+        env.make_data_file(indir=indir, fname="data-10m", fsize=10 * 1024 * 1024)
+        env.make_data_file(indir=env.gen_dir, fname="data-10m", fsize=10 * 1024 * 1024)
+
+    @pytest.mark.parametrize("sproto", ['socks4', 'socks5'])
+    def test_40_01_socks_http(self, env: Env, sproto, danted: Dante, httpd):
+        curl = CurlClient(env=env, socks_args=[
+            f'--{sproto}', f'127.0.0.1:{danted.port}'
+        ])
+        url = f'http://{env.domain1}:{env.http_port}/data.json'
+        r = curl.http_get(url=url)
+        r.check_response(http_status=200)
+
+    @pytest.mark.parametrize("sproto", ['socks4', 'socks5'])
+    @pytest.mark.parametrize("proto", Env.http_protos())
+    def test_40_02_socks_https(self, env: Env, sproto, proto, danted: Dante, httpd):
+        curl = CurlClient(env=env, socks_args=[
+            f'--{sproto}', f'127.0.0.1:{danted.port}'
+        ])
+        url = f'https://{env.authority_for(env.domain1, proto)}/data.json'
+        r = curl.http_get(url=url, alpn_proto=proto)
+        if proto == 'h3':
+            assert r.exit_code == 3  # unsupported combination
+        else:
+            r.check_response(http_status=200)
+
+    # download via socks to https: proxy (no tunnel)
+    @pytest.mark.parametrize("sproto", ['socks4', 'socks5'])
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    def test_40_02b_socks_https_proxy(self, env: Env, sproto, proto, danted: Dante, httpd):
+        if proto == 'h2' and not env.curl_uses_lib('nghttp2'):
+            pytest.skip('only supported with nghttp2')
+        curl = CurlClient(env=env, socks_args=[
+            f'--{sproto}', f'127.0.0.1:{danted.port}'
+        ])
+        url = f'http://localhost:{env.http_port}/data.json'
+        xargs = curl.get_proxy_args(proto=proto, tunnel=False)
+        r = curl.http_download(urls=[url], alpn_proto=proto, with_stats=True,
+                               extra_args=xargs)
+        r.check_response(http_status=200)
+        exp_http_version = '2' if proto == 'h2' else '1.1'
+        assert r.stats[0]['proxy_used'] == 1, f'{r}'
+        assert r.stats[0]['http_version'] == exp_http_version, f'{r}'
+
+    @pytest.mark.parametrize("sproto", ['socks4', 'socks5'])
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    def test_40_03_dl_serial(self, env: Env, httpd, danted, proto, sproto):
+        count = 3
+        urln = f'https://{env.authority_for(env.domain1, proto)}/data-10m?[0-{count-1}]'
+        curl = CurlClient(env=env, socks_args=[
+            f'--{sproto}', f'127.0.0.1:{danted.port}'
+        ])
+        r = curl.http_download(urls=[urln], alpn_proto=proto)
+        r.check_response(count=count, http_status=200)
+
+    @pytest.mark.parametrize("sproto", ['socks4', 'socks5'])
+    @pytest.mark.parametrize("proto", Env.http_h1_h2_protos())
+    def test_40_04_ul_serial(self, env: Env, httpd, danted, proto, sproto):
+        fdata = os.path.join(env.gen_dir, 'data-10m')
+        count = 2
+        curl = CurlClient(env=env, socks_args=[
+            f'--{sproto}', f'127.0.0.1:{danted.port}'
+        ])
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/echo?id=[0-{count-1}]'
+        r = curl.http_upload(urls=[url], data=f'@{fdata}', alpn_proto=proto)
+        r.check_stats(count=count, http_status=200, exitcode=0)
+        with open(fdata) as fi:
+            indata = fi.readlines()
+        for i in range(count):
+            with open(curl.response_file(i)) as fr:
+                respdata = fr.readlines()
+            assert respdata == indata
diff --git a/third-party/curl/tests/http/test_50_scp.py b/third-party/curl/tests/http/test_50_scp.py
new file mode 100644
index 0000000000..831ee5b3f8
--- /dev/null
+++ b/third-party/curl/tests/http/test_50_scp.py
@@ -0,0 +1,214 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+import difflib
+import filecmp
+import logging
+import os
+
+import pytest
+from testenv import CurlClient, Env, Sshd
+
+log = logging.getLogger(__name__)
+
+
+@pytest.mark.skipif(condition=not Env.curl_has_protocol('scp'), reason="curl built without scp:")
+@pytest.mark.skipif(condition=not Env.has_sshd(), reason="missing sshd")
+class TestScp:
+
+    @pytest.fixture(autouse=True, scope='class')
+    def _class_scope(self, env, sshd):
+        env.make_data_file(indir=sshd.home_dir, fname="data-10k", fsize=10 * 1024)
+        env.make_data_file(indir=sshd.home_dir, fname="data-10m", fsize=10 * 1024 * 1024)
+        env.make_data_file(indir=env.gen_dir, fname="data-10k", fsize=10 * 1024)
+        env.make_data_file(indir=env.gen_dir, fname="data-10m", fsize=10 * 1024 * 1024)
+
+    def test_50_01_insecure(self, env: Env, sshd: Sshd):
+        curl = CurlClient(env=env)
+        doc_file = os.path.join(sshd.home_dir, 'data')
+        url = f'scp://{env.domain1}:{sshd.port}/{doc_file}'
+        r = curl.ssh_download(urls=[url], extra_args=[
+            '--insecure',
+            '--pubkey', sshd.user1_pubkey_file,
+            '--key', sshd.user1_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(0)
+
+    def test_50_02_unknown_hosts(self, env: Env, sshd: Sshd):
+        curl = CurlClient(env=env)
+        doc_file = os.path.join(sshd.home_dir, 'data')
+        url = f'scp://{env.domain1}:{sshd.port}/{doc_file}'
+        r = curl.ssh_download(urls=[url], extra_args=[
+            '--knownhosts', sshd.unknown_hosts,
+            '--pubkey', sshd.user1_pubkey_file,
+            '--key', sshd.user1_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(60)  # CURLE_PEER_FAILED_VERIFICATION
+
+    def test_50_03_known_hosts(self, env: Env, sshd: Sshd):
+        curl = CurlClient(env=env)
+        doc_file = os.path.join(sshd.home_dir, 'data')
+        url = f'scp://{env.domain1}:{sshd.port}/{doc_file}'
+        r = curl.ssh_download(urls=[url], extra_args=[
+            '--knownhosts', sshd.known_hosts,
+            '--pubkey', sshd.user1_pubkey_file,
+            '--key', sshd.user1_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(0)
+
+    # use key not in authorized_keys file
+    def test_50_04_unauth_user(self, env: Env, sshd: Sshd):
+        curl = CurlClient(env=env)
+        doc_file = os.path.join(sshd.home_dir, 'data')
+        url = f'scp://{env.domain1}:{sshd.port}/{doc_file}'
+        r = curl.ssh_download(urls=[url], extra_args=[
+            '--knownhosts', sshd.known_hosts,
+            '--pubkey', sshd.user2_pubkey_file,
+            '--key', sshd.user2_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(67)  # CURLE_LOGIN_DENIED
+
+    def test_50_10_dl_single(self, env: Env, sshd: Sshd):
+        count = 1
+        curl = CurlClient(env=env)
+        doc_file = os.path.join(sshd.home_dir, 'data-10k')
+        url = f'scp://{env.domain1}:{sshd.port}/{doc_file}?[0-{count-1}]'
+        r = curl.ssh_download(urls=[url], extra_args=[
+            '--knownhosts', sshd.known_hosts,
+            '--pubkey', sshd.user1_pubkey_file,
+            '--key', sshd.user1_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(0)
+        self.check_downloads(curl, doc_file, count)
+
+    def test_50_11_dl_serial(self, env: Env, sshd: Sshd):
+        count = 5
+        curl = CurlClient(env=env)
+        doc_file = os.path.join(sshd.home_dir, 'data-10k')
+        url = f'scp://{env.domain1}:{sshd.port}/{doc_file}?[0-{count-1}]'
+        r = curl.ssh_download(urls=[url], extra_args=[
+            '--knownhosts', sshd.known_hosts,
+            '--pubkey', sshd.user1_pubkey_file,
+            '--key', sshd.user1_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(0)
+        self.check_downloads(curl, doc_file, count)
+
+    def test_50_12_dl_parallel(self, env: Env, sshd: Sshd):
+        count = 5
+        curl = CurlClient(env=env)
+        doc_file = os.path.join(sshd.home_dir, 'data-10k')
+        url = f'scp://{env.domain1}:{sshd.port}/{doc_file}?[0-{count-1}]'
+        r = curl.http_download(urls=[url], extra_args=[
+            '--parallel',
+            '--knownhosts', sshd.known_hosts,
+            '--pubkey', sshd.user1_pubkey_file,
+            '--key', sshd.user1_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(0)
+        self.check_downloads(curl, doc_file, count)
+
+    def test_50_20_ul_single(self, env: Env, sshd: Sshd):
+        srcfile = os.path.join(env.gen_dir, 'data-10k')
+        destfile = os.path.join(sshd.home_dir, 'upload_20.data')
+        curl = CurlClient(env=env)
+        url = f'scp://{env.domain1}:{sshd.port}/{destfile}'
+        r = curl.ssh_upload(urls=[url], fupload=srcfile, extra_args=[
+            '--knownhosts', sshd.known_hosts,
+            '--pubkey', sshd.user1_pubkey_file,
+            '--key', sshd.user1_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(0)
+        self.check_upload(sshd, srcfile, destfile)
+
+    def test_50_21_ul_serial(self, env: Env, sshd: Sshd):
+        count = 5
+        srcfile = os.path.join(env.gen_dir, 'data-10k')
+        destfile = os.path.join(sshd.home_dir, 'upload_21.data')
+        curl = CurlClient(env=env)
+        url = f'scp://{env.domain1}:{sshd.port}/{destfile}.[0-{count-1}]'
+        r = curl.ssh_upload(urls=[url], fupload=srcfile, extra_args=[
+            '--knownhosts', sshd.known_hosts,
+            '--pubkey', sshd.user1_pubkey_file,
+            '--key', sshd.user1_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(0)
+        for i in range(count):
+            self.check_upload(sshd, srcfile, f'{destfile}.{i}')
+
+    def test_50_22_ul_parallel(self, env: Env, sshd: Sshd):
+        count = 5
+        srcfile = os.path.join(env.gen_dir, 'data-10k')
+        destfile = os.path.join(sshd.home_dir, 'upload_22.data')
+        curl = CurlClient(env=env)
+        url = f'scp://{env.domain1}:{sshd.port}/{destfile}.[0-{count-1}]'
+        r = curl.ssh_upload(urls=[url], fupload=srcfile, extra_args=[
+            '--parallel',
+            '--knownhosts', sshd.known_hosts,
+            '--pubkey', sshd.user1_pubkey_file,
+            '--key', sshd.user1_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(0)
+        for i in range(count):
+            self.check_upload(sshd, srcfile, f'{destfile}.{i}')
+
+    def check_downloads(self, client, srcfile: str, count: int,
+                        complete: bool = True):
+        for i in range(count):
+            dfile = client.download_file(i)
+            assert os.path.exists(dfile)
+            if complete and not filecmp.cmp(srcfile, dfile, shallow=False):
+                with open(srcfile) as fa, open(dfile) as fb:
+                    a = fa.readlines()
+                    b = fb.readlines()
+                diff = "".join(difflib.unified_diff(a=a, b=b,
+                                                    fromfile=srcfile,
+                                                    tofile=dfile,
+                                                    n=1))
+                assert False, f'download {dfile} differs:\n{diff}'
+
+    def check_upload(self, sshd: Sshd, srcfile, destfile, binary=True):
+        assert os.path.exists(srcfile)
+        assert os.path.exists(destfile)
+        if not filecmp.cmp(srcfile, destfile, shallow=False):
+            with open(srcfile) as fa, open(destfile) as fb:
+                a = fa.readlines()
+                b = fb.readlines()
+            diff = "".join(difflib.unified_diff(a=a, b=b,
+                                                fromfile=srcfile,
+                                                tofile=destfile,
+                                                n=1))
+            assert not binary and len(diff) == 0, f'upload {destfile} differs:\n{diff}'
diff --git a/third-party/curl/tests/http/test_51_sftp.py b/third-party/curl/tests/http/test_51_sftp.py
new file mode 100644
index 0000000000..acf76ef683
--- /dev/null
+++ b/third-party/curl/tests/http/test_51_sftp.py
@@ -0,0 +1,214 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+import difflib
+import filecmp
+import logging
+import os
+
+import pytest
+from testenv import CurlClient, Env, Sshd
+
+log = logging.getLogger(__name__)
+
+
+@pytest.mark.skipif(condition=not Env.curl_has_protocol('sftp'), reason="curl built without sfto:")
+@pytest.mark.skipif(condition=not Env.has_sftpd(), reason="missing sftp server")
+class TestSftp:
+
+    @pytest.fixture(autouse=True, scope='class')
+    def _class_scope(self, env, sshd):
+        env.make_data_file(indir=sshd.home_dir, fname="data-10k", fsize=10 * 1024)
+        env.make_data_file(indir=sshd.home_dir, fname="data-10m", fsize=10 * 1024 * 1024)
+        env.make_data_file(indir=env.gen_dir, fname="data-10k", fsize=10 * 1024)
+        env.make_data_file(indir=env.gen_dir, fname="data-10m", fsize=10 * 1024 * 1024)
+
+    def test_51_01_insecure(self, env: Env, sshd: Sshd):
+        curl = CurlClient(env=env)
+        doc_file = os.path.join(sshd.home_dir, 'data')
+        url = f'sftp://{env.domain1}:{sshd.port}/{doc_file}'
+        r = curl.ssh_download(urls=[url], extra_args=[
+            '--insecure',
+            '--pubkey', sshd.user1_pubkey_file,
+            '--key', sshd.user1_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(0)
+
+    def test_51_02_unknown_hosts(self, env: Env, sshd: Sshd):
+        curl = CurlClient(env=env)
+        doc_file = os.path.join(sshd.home_dir, 'data')
+        url = f'sftp://{env.domain1}:{sshd.port}/{doc_file}'
+        r = curl.ssh_download(urls=[url], extra_args=[
+            '--knownhosts', sshd.unknown_hosts,
+            '--pubkey', sshd.user1_pubkey_file,
+            '--key', sshd.user1_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(60)  # CURLE_PEER_FAILED_VERIFICATION
+
+    def test_51_03_known_hosts(self, env: Env, sshd: Sshd):
+        curl = CurlClient(env=env)
+        doc_file = os.path.join(sshd.home_dir, 'data')
+        url = f'sftp://{env.domain1}:{sshd.port}/{doc_file}'
+        r = curl.ssh_download(urls=[url], extra_args=[
+            '--knownhosts', sshd.known_hosts,
+            '--pubkey', sshd.user1_pubkey_file,
+            '--key', sshd.user1_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(0)
+
+    # use key not in authorized_keys file
+    def test_51_04_unauth_user(self, env: Env, sshd: Sshd):
+        curl = CurlClient(env=env)
+        doc_file = os.path.join(sshd.home_dir, 'data')
+        url = f'sftp://{env.domain1}:{sshd.port}/{doc_file}'
+        r = curl.ssh_download(urls=[url], extra_args=[
+            '--knownhosts', sshd.known_hosts,
+            '--pubkey', sshd.user2_pubkey_file,
+            '--key', sshd.user2_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(67)  # CURLE_LOGIN_DENIED
+
+    def test_51_10_dl_single(self, env: Env, sshd: Sshd):
+        count = 1
+        curl = CurlClient(env=env)
+        doc_file = os.path.join(sshd.home_dir, 'data-10k')
+        url = f'sftp://{env.domain1}:{sshd.port}/{doc_file}?[0-{count-1}]'
+        r = curl.ssh_download(urls=[url], extra_args=[
+            '--knownhosts', sshd.known_hosts,
+            '--pubkey', sshd.user1_pubkey_file,
+            '--key', sshd.user1_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(0)
+        self.check_downloads(curl, doc_file, count)
+
+    def test_51_11_dl_serial(self, env: Env, sshd: Sshd):
+        count = 5
+        curl = CurlClient(env=env)
+        doc_file = os.path.join(sshd.home_dir, 'data-10k')
+        url = f'sftp://{env.domain1}:{sshd.port}/{doc_file}?[0-{count-1}]'
+        r = curl.ssh_download(urls=[url], extra_args=[
+            '--knownhosts', sshd.known_hosts,
+            '--pubkey', sshd.user1_pubkey_file,
+            '--key', sshd.user1_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(0)
+        self.check_downloads(curl, doc_file, count)
+
+    def test_51_12_dl_parallel(self, env: Env, sshd: Sshd):
+        count = 5
+        curl = CurlClient(env=env)
+        doc_file = os.path.join(sshd.home_dir, 'data-10k')
+        url = f'sftp://{env.domain1}:{sshd.port}/{doc_file}?[0-{count-1}]'
+        r = curl.http_download(urls=[url], extra_args=[
+            '--parallel',
+            '--knownhosts', sshd.known_hosts,
+            '--pubkey', sshd.user1_pubkey_file,
+            '--key', sshd.user1_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(0)
+        self.check_downloads(curl, doc_file, count)
+
+    def test_51_20_ul_single(self, env: Env, sshd: Sshd):
+        srcfile = os.path.join(env.gen_dir, 'data-10k')
+        destfile = os.path.join(sshd.home_dir, 'upload_20.data')
+        curl = CurlClient(env=env)
+        url = f'sftp://{env.domain1}:{sshd.port}/{destfile}'
+        r = curl.ssh_upload(urls=[url], fupload=srcfile, extra_args=[
+            '--knownhosts', sshd.known_hosts,
+            '--pubkey', sshd.user1_pubkey_file,
+            '--key', sshd.user1_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(0)
+        self.check_upload(sshd, srcfile, destfile)
+
+    def test_51_21_ul_serial(self, env: Env, sshd: Sshd):
+        count = 5
+        srcfile = os.path.join(env.gen_dir, 'data-10k')
+        destfile = os.path.join(sshd.home_dir, 'upload_21.data')
+        curl = CurlClient(env=env)
+        url = f'sftp://{env.domain1}:{sshd.port}/{destfile}.[0-{count-1}]'
+        r = curl.ssh_upload(urls=[url], fupload=srcfile, extra_args=[
+            '--knownhosts', sshd.known_hosts,
+            '--pubkey', sshd.user1_pubkey_file,
+            '--key', sshd.user1_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(0)
+        for i in range(count):
+            self.check_upload(sshd, srcfile, f'{destfile}.{i}')
+
+    def test_51_22_ul_parallel(self, env: Env, sshd: Sshd):
+        count = 5
+        srcfile = os.path.join(env.gen_dir, 'data-10k')
+        destfile = os.path.join(sshd.home_dir, 'upload_22.data')
+        curl = CurlClient(env=env)
+        url = f'sftp://{env.domain1}:{sshd.port}/{destfile}.[0-{count-1}]'
+        r = curl.ssh_upload(urls=[url], fupload=srcfile, extra_args=[
+            '--parallel',
+            '--knownhosts', sshd.known_hosts,
+            '--pubkey', sshd.user1_pubkey_file,
+            '--key', sshd.user1_privkey_file,
+            '--user', f'{os.environ["USER"]}:',
+        ])
+        r.check_exit_code(0)
+        for i in range(count):
+            self.check_upload(sshd, srcfile, f'{destfile}.{i}')
+
+    def check_downloads(self, client, srcfile: str, count: int,
+                        complete: bool = True):
+        for i in range(count):
+            dfile = client.download_file(i)
+            assert os.path.exists(dfile)
+            if complete and not filecmp.cmp(srcfile, dfile, shallow=False):
+                with open(srcfile) as fa, open(dfile) as fb:
+                    a = fa.readlines()
+                    b = fb.readlines()
+                diff = "".join(difflib.unified_diff(a=a, b=b,
+                                                    fromfile=srcfile,
+                                                    tofile=dfile,
+                                                    n=1))
+                assert False, f'download {dfile} differs:\n{diff}'
+
+    def check_upload(self, sshd: Sshd, srcfile, destfile, binary=True):
+        assert os.path.exists(srcfile)
+        assert os.path.exists(destfile)
+        if not filecmp.cmp(srcfile, destfile, shallow=False):
+            with open(srcfile) as fa, open(destfile) as fb:
+                a = fa.readlines()
+                b = fb.readlines()
+            diff = "".join(difflib.unified_diff(a=a, b=b,
+                                                fromfile=srcfile,
+                                                tofile=destfile,
+                                                n=1))
+            assert not binary and len(diff) == 0, f'upload {destfile} differs:\n{diff}'
diff --git a/third-party/curl/tests/http/test_60_h3_proxy.py b/third-party/curl/tests/http/test_60_h3_proxy.py
new file mode 100644
index 0000000000..9382ef70d9
--- /dev/null
+++ b/third-party/curl/tests/http/test_60_h3_proxy.py
@@ -0,0 +1,626 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+# ***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+import os
+import subprocess
+import time
+
+import pytest
+from testenv import CurlClient, Env
+
+MARK_NEEDS_HTTPS_PROXY = pytest.mark.skipif(
+    condition=not Env.curl_has_feature("HTTPS-proxy"),
+    reason="curl lacks HTTPS-proxy support"
+)
+MARK_NEEDS_HTTP3 = pytest.mark.skipif(
+    condition=not Env.curl_has_feature("HTTP3"), reason="curl lacks HTTP/3 support"
+)
+MARK_NEEDS_PROXY_HTTP3 = pytest.mark.skipif(
+    condition=not Env.curl_has_feature("proxy-HTTP3"),
+    reason="curl lacks experimental HTTP/3 proxy support"
+)
+MARK_NEEDS_NGHTTP3 = pytest.mark.skipif(
+    condition=not Env.curl_uses_lib("nghttp3"), reason="only supported with nghttp3"
+)
+MARK_NEEDS_NGHTTP2 = pytest.mark.skipif(
+    condition=not Env.curl_uses_lib("nghttp2"), reason="only supported with nghttp2"
+)
+MARK_NEEDS_H2O = pytest.mark.skipif(
+    condition=not Env.have_h2o(), reason="no h2o available"
+)
+MARK_NEEDS_NGHTTPX = pytest.mark.skipif(
+    condition=not Env.have_nghttpx(), reason="no nghttpx available"
+)
+
+UNSUPPORTED_OPT_MSG = "does not support this"
+H2O_HELLO_MSG = '"message": "Hello from h2o HTTP/3 server"'
+
+
+def _require_available(**items):
+    missing = [name for name, value in items.items() if not value]
+    if missing:
+        pytest.skip(f"{' or '.join(missing)} not available")
+
+
+def _download_path(curl: CurlClient) -> str:
+    return os.path.join(curl.run_dir, "download_#1.data")
+
+
+def _check_download_message(curl: CurlClient, expected: str):
+    dpath = _download_path(curl)
+    assert os.path.exists(dpath), f"Download file not found: {dpath}"
+    with open(dpath, "r") as fd:
+        content = fd.read()
+    assert expected in content, f"Unexpected response content: {content}"
+
+
+def _check_download_size(curl: CurlClient, expected_size: int):
+    dpath = _download_path(curl)
+    assert os.path.exists(dpath), f"Download file not found: {dpath}"
+    actual = os.path.getsize(dpath)
+    assert actual == expected_size, f"expected {expected_size}B download, got {actual}B"
+
+
+def _nghttpx_proxy_args(
+    env: Env,
+    nghttpx,
+    nghttpx_fwd,
+    proxy_proto: str,
+    tunnel: bool,
+):
+    port = env.pts_port(proxy_proto)
+    domain = env.proxy_domain
+    xxarg = None
+    if proxy_proto == "h3":
+        port = nghttpx.port
+        domain = env.domain1
+        xxarg = "--proxy-http3"
+    elif proxy_proto == "h2":
+        xxarg = "--proxy-http2"
+
+    xargs = [
+        "--proxy", f"https://{domain}:{port}/",
+        "--resolve", f"{domain}:{port}:127.0.0.1",
+        "--proxy-cacert", env.ca.cert_file
+    ]
+    if xxarg:
+        xargs.append(xxarg)
+    if tunnel:
+        xargs.append("--proxytunnel")
+    return xargs
+
+
+def _h2o_proxy_args(
+    env: Env,
+    h2o_proxy,
+    proxy_proto: str,
+    tunnel: bool,
+):
+    pport = env.pts_port(proxy_proto, use_h2o=True)
+    xargs = [
+        "--proxy", f"https://{env.proxy_domain}:{pport}/",
+        "--resolve", f"{env.proxy_domain}:{pport}:127.0.0.1",
+        "--proxy-cacert", env.ca.cert_file,
+        "--cacert", env.ca.cert_file,
+    ]
+    if proxy_proto == "h2":
+        xargs.append("--proxy-http2")
+    elif proxy_proto == "h3":
+        xargs.append("--proxy-http3")
+
+    if tunnel:
+        xargs.append("--proxytunnel")
+
+    return xargs
+
+
+@MARK_NEEDS_HTTPS_PROXY
+@MARK_NEEDS_HTTP3
+@MARK_NEEDS_NGHTTP3
+class TestH3Proxy:
+
+    # Success matrix for HTTP/3 proxy CONNECT / CONNECT-UDP.
+
+    @MARK_NEEDS_PROXY_HTTP3
+    @MARK_NEEDS_H2O
+    @pytest.mark.parametrize(
+        ["alpn_proto", "proxy_proto"],
+        [
+            pytest.param("http/1.1", "h3", id="h1_over_h3_proxytunnel"),
+            pytest.param(
+                "h2",
+                "h3",
+                marks=MARK_NEEDS_NGHTTP2,
+                id="h2_over_h3_proxytunnel",
+            ),
+            pytest.param("h3", "h3", id="h3_over_h3_proxytunnel"),
+            pytest.param(
+                "h3",
+                "h2",
+                marks=MARK_NEEDS_NGHTTP2,
+                id="h3_over_h2_proxytunnel",
+            ),
+            pytest.param("h3", "http/1.1", id="h3_over_h1_proxytunnel"),
+        ],
+    )
+    def test_60_01_connect_tunnel(
+        self,
+        env: Env,
+        h2o_server,
+        h2o_proxy,
+        alpn_proto,
+        proxy_proto,
+    ):
+        _require_available(h2o_server=h2o_server, h2o_proxy=h2o_proxy)
+
+        curl = CurlClient(env=env)
+        url = f"https://localhost:{h2o_server.port}/data.json"
+        proxy_args = _h2o_proxy_args(
+            env, h2o_proxy, proxy_proto, tunnel=True
+        )
+
+        r = curl.http_download(
+            urls=[url], alpn_proto=alpn_proto, with_stats=True, extra_args=proxy_args
+        )
+        r.check_response(count=1, http_status=200)
+        _check_download_message(curl, H2O_HELLO_MSG)
+
+    # Failure matrix when proxy side does not support requested mode.
+
+    @MARK_NEEDS_PROXY_HTTP3
+    @MARK_NEEDS_NGHTTPX
+    @pytest.mark.parametrize(
+        ["alpn_proto", "proxy_proto", "exp_err"],
+        [
+            pytest.param(
+                "http/1.1",
+                "h3",
+                "could not connect to server",
+                id="fail_h1_over_h3_proxytunnel",
+            ),
+            pytest.param(
+                "h2",
+                "h3",
+                "could not connect to server",
+                marks=MARK_NEEDS_NGHTTP2,
+                id="fail_h2_over_h3_proxytunnel",
+            ),
+            pytest.param(
+                "h3",
+                "h3",
+                "could not connect to server",
+                id="fail_h3_over_h3_proxytunnel",
+            ),
+            #pytest.param(
+            #    "h3",
+            #    "h2",
+            #    "proxy closed connection",
+            #    marks=MARK_NEEDS_NGHTTP2,
+            #    id="fail_h3_over_h2_proxytunnel",
+            #),
+            pytest.param(
+                "h3",
+                "http/1.1",
+                "connect-udp tunnel failed",
+                id="fail_h3_over_h1_proxytunnel",
+            ),
+        ],
+    )
+    def test_60_02_connect_tunnel_fail(
+        self,
+        env: Env,
+        httpd,
+        nghttpx,
+        nghttpx_fwd,
+        h2o_proxy,
+        alpn_proto,
+        proxy_proto,
+        exp_err,
+    ):
+        _require_available(httpd=httpd, nghttpx=nghttpx, nghttpx_fwd=nghttpx_fwd,
+                           h2o_proxy=h2o_proxy)
+
+        curl = CurlClient(env=env)
+        url = f"https://localhost:{env.https_port}/data.json"
+        proxy_args = _nghttpx_proxy_args(
+            env, nghttpx, nghttpx_fwd, proxy_proto, tunnel=True
+        )
+        r = curl.http_download(
+            urls=[url], alpn_proto=alpn_proto, with_stats=True, extra_args=proxy_args
+        )
+        assert r.exit_code != 0, f"Expected failure but curl succeeded: {r.dump_logs()}"
+        assert exp_err in r.stderr.lower(), (
+            f"Expected protocol/proxy error but got: {r.dump_logs()}"
+        )
+
+    # Behavior checks for tunnel vs non-tunnel proxy mode selection.
+
+    @MARK_NEEDS_PROXY_HTTP3
+    @MARK_NEEDS_NGHTTPX
+    @pytest.mark.parametrize(
+        ["proxy_proto"],
+        [
+            #pytest.param("h3", id="proxy_h3"),
+            pytest.param("h2", marks=MARK_NEEDS_NGHTTP2, id="proxy_h2"),
+            pytest.param("http/1.1", id="proxy_h1"),
+        ],
+    )
+    def test_60_03_h3_target_auto_connect_udp(
+        self, env: Env, httpd, nghttpx, nghttpx_fwd, proxy_proto
+    ):
+        _require_available(
+            httpd=httpd, nghttpx=nghttpx, nghttpx_fwd=nghttpx_fwd
+        )
+
+        curl = CurlClient(env=env)
+        url = f"https://localhost:{httpd.ports['https']}/data.json"
+        proxy_args = _nghttpx_proxy_args(
+            env, nghttpx, nghttpx_fwd, proxy_proto, tunnel=False
+        )
+        r = curl.http_download(
+            urls=[url], alpn_proto="h3", with_stats=True, extra_args=proxy_args
+        )
+
+        # An HTTP/3 target auto-triggers CONNECT-UDP even without --proxytunnel,
+        # as HTTPS targets auto-trigger CONNECT. nghttpx does not support
+        # CONNECT-UDP so this fails, which confirms auto-CONNECT-UDP is active.
+        assert r.exit_code != 0, (
+            "expected failure: h3 target auto-triggers CONNECT-UDP "
+            "which nghttpx does not support"
+        )
+        assert "connect-udp" in r.stderr.lower(), (
+            f"expected CONNECT-UDP attempt in output, got: {r.dump_logs()}"
+        )
+
+    # Guard checks for unsupported HTTP/3 proxy options.
+
+    @pytest.mark.skipif(
+        condition=Env.curl_has_feature("proxy-HTTP3"), reason="curl has h3 proxy support"
+    )
+    def test_60_04_guard_proxy_http3_unsupported(self, env: Env, httpd):
+        curl = CurlClient(env=env)
+        url = f"https://localhost:{httpd.ports['https']}/data.json"
+        proxy_args = [
+            "--proxy",
+            "https://127.0.0.1:1/",
+            "--proxy-http3",
+            "--proxytunnel",
+            "--cacert",
+            env.ca.cert_file,
+        ]
+
+        r = curl.http_download(
+            urls=[url], alpn_proto="http/1.1", with_stats=True, extra_args=proxy_args
+        )
+        r.check_exit_code(2)
+        assert UNSUPPORTED_OPT_MSG in r.stderr.lower(), (
+            f"Expected unsupported option failure but got: {r.stderr}"
+        )
+
+    # Robustness checks for shutdown and proxy loss during transfer.
+
+    @MARK_NEEDS_PROXY_HTTP3
+    @MARK_NEEDS_H2O
+    def test_60_05_graceful_shutdown(self, env: Env, h2o_server, h2o_proxy):
+        if not env.curl_is_debug():
+            pytest.skip("needs debug curl for shutdown trace lines")
+        if not env.curl_is_verbose():
+            pytest.skip("needs verbose-strings curl build")
+
+        curl = CurlClient(env=env, run_env={"CURL_DEBUG": "all"})
+        url = f"https://localhost:{h2o_server.port}/data.json"
+        proxy_args = curl.get_proxy_args(proto="h3", tunnel=True)
+        proxy_args.extend(["--cacert", env.ca.cert_file, "--insecure"])
+
+        r = curl.http_download(
+            urls=[url], alpn_proto="h3", with_stats=True, extra_args=proxy_args
+        )
+        r.check_response(count=1, http_status=200)
+
+        shutdown_lines = [
+            line
+            for line in r.trace_lines
+            if ("start shutdown(" in line.lower())
+            or ("shutdown completely sent off" in line.lower())
+        ]
+        assert shutdown_lines, f"No shutdown trace lines found:\n{r.stderr}"
+
+    @MARK_NEEDS_PROXY_HTTP3
+    @MARK_NEEDS_H2O
+    def test_60_06_proxy_drop_mid_transfer(self, env: Env, h2o_server, h2o_proxy):
+        _require_available(h2o_server=h2o_server, h2o_proxy=h2o_proxy)
+
+        env.make_data_file(indir=h2o_server.docs_dir, fname="proxy-drop-20m", fsize=20 * 1024 * 1024)
+        proxy_port = h2o_proxy.port
+        url = f"https://localhost:{h2o_server.port}/proxy-drop-20m"
+        out_path = os.path.join(env.gen_dir, "proxy-drop.out")
+        if os.path.exists(out_path):
+            os.remove(out_path)
+        args = [
+            env.curl,
+            "--http1.1",
+            "--proxy", f"https://{env.proxy_domain}:{proxy_port}/",
+            "--resolve", f"{env.proxy_domain}:{proxy_port}:127.0.0.1",
+            "--proxy-http3",
+            "--proxytunnel",
+            "--proxy-cacert", env.ca.cert_file,
+            "--cacert", env.ca.cert_file,
+            "--limit-rate", "10k",
+            "--max-time", "20",
+            "-o", out_path,
+            "-v",
+            url,
+        ]
+
+        proc = None
+        try:
+            proc = subprocess.Popen(
+                args=args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True
+            )
+            while not os.path.exists(out_path):
+                time.sleep(0.1)
+            assert h2o_proxy.kill(), "failed to stop h2o proxy"
+            _, stderr = proc.communicate(timeout=30)
+            assert proc.returncode != 0, (
+                "curl should fail when proxy is terminated mid-transfer"
+            )
+            assert proc.returncode == 56, f'{stderr}'
+        finally:
+            if proc and (proc.poll() is None):
+                proc.kill()
+                proc.wait(timeout=5)
+            assert h2o_proxy.start(), "failed to restart h2o proxy"
+
+    # Large file transfers and multiplexing through HTTP/3 proxy.
+
+    @MARK_NEEDS_PROXY_HTTP3
+    @MARK_NEEDS_H2O
+    def test_60_07_large_download(self, env: Env, h2o_server, h2o_proxy):
+        _require_available(h2o_server=h2o_server, h2o_proxy=h2o_proxy)
+        env.make_data_file(indir=h2o_server.docs_dir, fname="download-10m", fsize=10 * 1024 * 1024)
+        curl = CurlClient(env=env)
+        url = f"https://localhost:{h2o_server.port}/download-10m"
+        proxy_args = _h2o_proxy_args(env, h2o_proxy, "h3", tunnel=True)
+        r = curl.http_download(
+            urls=[url], alpn_proto="http/1.1", with_stats=True, extra_args=proxy_args
+        )
+        r.check_response(count=1, http_status=200)
+        _check_download_size(curl, 10 * 1024 * 1024)
+
+    @MARK_NEEDS_PROXY_HTTP3
+    @MARK_NEEDS_H2O
+    def test_60_08_large_upload(self, env: Env, httpd, h2o_server, h2o_proxy):
+        _require_available(h2o_proxy=h2o_proxy)
+        env.make_data_file(indir=env.gen_dir, fname="upload-2m", fsize=2 * 1024 * 1024)
+        fdata = os.path.join(env.gen_dir, "upload-2m")
+        curl = CurlClient(env=env)
+        url = f"https://localhost:{httpd.ports['https']}/curltest/echo?id=[0-0]"
+        proxy_args = _h2o_proxy_args(env, h2o_proxy, "h3", tunnel=True)
+        r = curl.http_upload(
+            urls=[url],
+            data=f"@{fdata}",
+            alpn_proto="http/1.1",
+            with_stats=True,
+            extra_args=proxy_args,
+        )
+        r.check_response(count=1, http_status=200)
+
+    @MARK_NEEDS_PROXY_HTTP3
+    @MARK_NEEDS_H2O
+    def test_60_09_parallel_downloads(self, env: Env, h2o_server, h2o_proxy):
+        _require_available(h2o_server=h2o_server, h2o_proxy=h2o_proxy)
+        env.make_data_file(indir=h2o_server.docs_dir, fname="download-1m", fsize=1 * 1024 * 1024)
+        count = 5
+        curl = CurlClient(env=env)
+        urln = f"https://localhost:{h2o_server.port}/download-1m?[0-{count - 1}]"
+        proxy_args = _h2o_proxy_args(env, h2o_proxy, "h3", tunnel=True)
+        proxy_args.extend(["--parallel", "--parallel-max", f"{count}"])
+        r = curl.http_download(
+            urls=[urln], alpn_proto="http/1.1", with_stats=True, extra_args=proxy_args
+        )
+        r.check_response(count=count, http_status=200)
+
+    @MARK_NEEDS_PROXY_HTTP3
+    @MARK_NEEDS_H2O
+    def test_60_10_proxy_basic_auth(self, env: Env, h2o_server, h2o_proxy):
+        _require_available(h2o_server=h2o_server, h2o_proxy=h2o_proxy)
+        curl = CurlClient(env=env)
+        url = f"https://localhost:{h2o_server.port}/data.json"
+        proxy_args = _h2o_proxy_args(env, h2o_proxy, "h3", tunnel=True)
+        proxy_args.extend(["--proxy-user", "testuser:testpass"])
+        r = curl.http_download(
+            urls=[url], alpn_proto="http/1.1", with_stats=True, extra_args=proxy_args
+        )
+        r.check_response(count=1, http_status=200)
+        _check_download_message(curl, H2O_HELLO_MSG)
+
+    @MARK_NEEDS_PROXY_HTTP3
+    @MARK_NEEDS_H2O
+    def test_60_11_connection_reuse(self, env: Env, h2o_server, h2o_proxy):
+        _require_available(h2o_server=h2o_server, h2o_proxy=h2o_proxy)
+        curl = CurlClient(env=env)
+        urln = f"https://localhost:{h2o_server.port}/data.json?[0-2]"
+        proxy_args = _h2o_proxy_args(env, h2o_proxy, "h3", tunnel=True)
+        r = curl.http_download(
+            urls=[urln], alpn_proto="http/1.1", with_stats=True, extra_args=proxy_args
+        )
+        r.check_response(count=3, http_status=200)
+        assert r.total_connects <= 3, (
+            f"expected proxy connection reuse, got {r.total_connects} connects"
+        )
+
+    @MARK_NEEDS_PROXY_HTTP3
+    @MARK_NEEDS_H2O
+    @pytest.mark.skipif(condition=not Env.curl_has_feature('SSLS-EXPORT'),
+                        reason='curl lacks SSL session export support')
+    def test_60_12_quic_session_resumption(self, env: Env, h2o_server, h2o_proxy):
+        _require_available(h2o_server=h2o_server, h2o_proxy=h2o_proxy)
+        curl = CurlClient(env=env)
+        url = f"https://localhost:{h2o_server.port}/data.json"
+        xargs = _h2o_proxy_args(env, h2o_proxy, "h3", tunnel=True)
+        session_file = os.path.join(env.gen_dir, 'test_60_12.sessions')
+        if os.path.exists(session_file):
+            os.remove(session_file)
+        xargs.extend(['--ssl-sessions', session_file])
+        # First request establishes QUIC session
+        r1 = curl.http_download(
+            urls=[url], alpn_proto="http/1.1", with_stats=True, extra_args=xargs
+        )
+        r1.check_response(count=1, http_status=200)
+        xargs.extend(['--trace-config', 'ssls'])
+        r2 = curl.http_download(
+            urls=[url], alpn_proto="http/1.1", with_stats=True, extra_args=xargs
+        )
+        r2.check_response(count=1, http_status=200)
+        reuses = [line for line in r2.trace_lines if '[SSLS] took session for proxy.http.curl.se' in line]
+        assert len(reuses), f'{r2.dump_logs()}'
+
+    # CONNECT-UDP tunnel payload size and capsule-protocol tests.
+
+    @MARK_NEEDS_PROXY_HTTP3
+    @MARK_NEEDS_H2O
+    @pytest.mark.parametrize(
+        "fname,fsize",
+        [
+            ("download-1400", 1400),
+            ("download-1m", 1 * 1024 * 1024),
+            ("download-10m", 10 * 1024 * 1024),
+        ],
+    )
+    def test_60_13_udp_tunnel_payload_sizes(
+        self, env: Env, h2o_server, h2o_proxy, fname, fsize
+    ):
+        _require_available(h2o_server=h2o_server, h2o_proxy=h2o_proxy)
+        env.make_data_file(indir=h2o_server.docs_dir, fname=fname, fsize=fsize)
+        curl = CurlClient(env=env)
+        url = f"https://localhost:{h2o_server.port}/{fname}"
+        proxy_args = _h2o_proxy_args(env, h2o_proxy, "h3", tunnel=True)
+        r = curl.http_download(
+            urls=[url], alpn_proto="h3", with_stats=True, extra_args=proxy_args
+        )
+        r.check_response(count=1, http_status=200)
+        _check_download_size(curl, fsize)
+
+    @MARK_NEEDS_PROXY_HTTP3
+    @MARK_NEEDS_NGHTTPX
+    def test_60_14_udp_tunnel_capsule_absent(
+        self, env: Env, httpd, nghttpx, nghttpx_fwd
+    ):
+        _require_available(
+            httpd=httpd, nghttpx=nghttpx, nghttpx_fwd=nghttpx_fwd
+        )
+        curl = CurlClient(env=env)
+        url = f"https://localhost:{httpd.ports['https']}/data.json"
+        proxy_args = _nghttpx_proxy_args(
+            env, nghttpx, nghttpx_fwd, "h3", tunnel=True
+        )
+        r = curl.http_download(
+            urls=[url], alpn_proto="h3", with_stats=True, extra_args=proxy_args
+        )
+        assert r.exit_code != 0, (
+            "expected failure: nghttpx does not support CONNECT-UDP / Capsule-Protocol"
+        )
+
+    # Timeout and protocol-mismatch edge cases.
+
+    #@MARK_NEEDS_PROXY_HTTP3
+    #@MARK_NEEDS_H2O
+    #def test_60_15_connect_timeout(self, env: Env, h2o_proxy):
+    #    _require_available(h2o_proxy=h2o_proxy)
+    #    curl = CurlClient(env=env, timeout=15)
+    #    url = f"https://localhost:{h2o_proxy.port}/data.json"
+    #    # ipv6 0100::/64 is supposed to go into the void (rfc6666)
+    #    xargs = [
+    #        '--proxy', 'https://xxx.invalid/',
+    #        '--resolve', 'xxx.invalid:443:0100::1,0100::2,0100::3',
+    #        '--proxy-http3', '--proxytunnel',
+    #        '--connect-timeout', '1',
+    #    ]
+    #    r = curl.http_download(
+    #        urls=[url], alpn_proto="http/1.1", with_stats=True, extra_args=xargs
+    #    )
+    #    r.check_exit_code(28)  # CURLE_OPERATION_TIMEDOUT
+    #    assert r.duration.total_seconds() < 10, (
+    #        f"timeout not respected: took {r.duration.total_seconds():.1f}s"
+    #    )
+
+    @MARK_NEEDS_PROXY_HTTP3
+    @MARK_NEEDS_H2O
+    @MARK_NEEDS_NGHTTP2
+    def test_60_16_h2_uses_connect_tcp_not_udp(self, env: Env, httpd, h2o_proxy):
+        _require_available(httpd=httpd, h2o_proxy=h2o_proxy)
+        curl = CurlClient(env=env)
+        url = f"https://localhost:{env.https_port}/data.json"
+        proxy_args = curl.get_proxy_args("h3", tunnel=True)
+        # h2 inner traffic always uses CONNECT (TCP), never CONNECT-UDP,
+        # even through an HTTP/3 proxy with --proxytunnel. h2o supports
+        # CONNECT TCP tunneling, so this request succeeds.
+        r = curl.http_download(
+            urls=[url], alpn_proto="h2", with_stats=True, extra_args=proxy_args
+        )
+        r.check_response(count=1, http_status=200)
+
+    # Verify that happy eyeballs is active for HTTP/3 proxy connections.
+    #
+    # With the H3-PROXY filter sitting above HAPPY-EYEBALLS -> UDP, address
+    # family selection to the proxy is done by happy eyeballs.
+
+    @MARK_NEEDS_PROXY_HTTP3
+    @MARK_NEEDS_H2O
+    def test_60_17_happy_eyeballs_filter_present(self, env: Env, h2o_server, h2o_proxy):
+        """Verbose trace confirms HAPPY-EYEBALLS filter is in the H3 proxy chain."""
+        if not env.curl_is_debug():
+            pytest.skip("needs debug curl for filter trace")
+        _require_available(h2o_server=h2o_server, h2o_proxy=h2o_proxy)
+        curl = CurlClient(env=env, run_env={"CURL_DEBUG": "HAPPY-EYEBALLS,H3-PROXY"})
+        url = f"https://localhost:{h2o_server.port}/data.json"
+        proxy_args = _h2o_proxy_args(env, h2o_proxy, "h3", tunnel=True)
+        r = curl.http_download(
+            urls=[url], alpn_proto="http/1.1", with_stats=True, extra_args=proxy_args
+        )
+        r.check_response(count=1, http_status=200)
+        assert "happy-eyeballs" in r.stderr.lower(), (
+            f"expected HAPPY-EYEBALLS trace for H3 proxy, got: {r.stderr}"
+        )
+
+    @MARK_NEEDS_PROXY_HTTP3
+    @MARK_NEEDS_H2O
+    @MARK_NEEDS_NGHTTP2
+    def test_60_18_happy_eyeballs_ipv4_all_proto(self, env: Env, h2o_server, h2o_proxy):
+        """IPv4-forced H3 proxy works for h1/h2/h3 inner protocols."""
+        _require_available(h2o_server=h2o_server, h2o_proxy=h2o_proxy)
+        for alpn_proto in ["http/1.1", "h2", "h3"]:
+            curl = CurlClient(env=env)
+            url = f"https://localhost:{h2o_server.port}/data.json"
+            proxy_args = _h2o_proxy_args(env, h2o_proxy, "h3", tunnel=True)
+            proxy_args.append("--ipv4")
+            r = curl.http_download(
+                urls=[url],
+                alpn_proto=alpn_proto,
+                with_stats=True,
+                extra_args=proxy_args,
+            )
+            r.check_response(count=1, http_status=200)
diff --git a/third-party/curl/tests/http/testenv/__init__.py b/third-party/curl/tests/http/testenv/__init__.py
index 2195634fdd..08ab2e2311 100644
--- a/third-party/curl/tests/http/testenv/__init__.py
+++ b/third-party/curl/tests/http/testenv/__init__.py
@@ -23,16 +23,22 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-#
+# ruff: noqa: F401, E402
 import pytest
+
 pytest.register_assert_rewrite("testenv.env", "testenv.curl", "testenv.caddy",
                                "testenv.httpd", "testenv.nghttpx")
 
-from .env import Env
-from .certs import TestCA, Credentials
+# This import must be first to avoid circular imports
+from .curl import CurlClient, ExecResult, RunProfile  # noqa: I001
+
 from .caddy import Caddy
-from .httpd import Httpd
-from .curl import CurlClient, ExecResult
+from .certs import Credentials, TestCA
 from .client import LocalClient
-from .nghttpx import Nghttpx
-from .nghttpx import Nghttpx, NghttpxQuic, NghttpxFwd
+from .dante import Dante
+from .dnsd import Dnsd
+from .env import Env
+from .httpd import Httpd
+from .nghttpx import Nghttpx, NghttpxFwd, NghttpxQuic
+from .sshd import Sshd
+from .vsftpd import VsFTPD
diff --git a/third-party/curl/tests/http/testenv/caddy.py b/third-party/curl/tests/http/testenv/caddy.py
index ea1343a950..1d554b1906 100644
--- a/third-party/curl/tests/http/testenv/caddy.py
+++ b/third-party/curl/tests/http/testenv/caddy.py
@@ -26,20 +26,27 @@
 #
 import logging
 import os
+import socket
 import subprocess
 import time
-from datetime import timedelta, datetime
+from datetime import datetime, timedelta
 from json import JSONEncoder
+from typing import Dict
 
 from .curl import CurlClient
 from .env import Env
-
+from .ports import alloc_ports_and_do
 
 log = logging.getLogger(__name__)
 
 
 class Caddy:
 
+    PORT_SPECS = {
+        'caddy': socket.SOCK_STREAM,
+        'caddys': socket.SOCK_STREAM,
+    }
+
     def __init__(self, env: Env):
         self.env = env
         self._caddy = os.environ['CADDY'] if 'CADDY' in os.environ else env.caddy
@@ -48,7 +55,10 @@ class Caddy:
         self._conf_file = os.path.join(self._caddy_dir, 'Caddyfile')
         self._error_log = os.path.join(self._caddy_dir, 'caddy.log')
         self._tmp_dir = os.path.join(self._caddy_dir, 'tmp')
+        self._error_fd = None
         self._process = None
+        self._http_port = 0
+        self._https_port = 0
         self._rmf(self._error_log)
 
     @property
@@ -56,8 +66,13 @@ class Caddy:
         return self._docs_dir
 
     @property
-    def port(self) -> str:
-        return self.env.caddy_https_port
+    def port(self) -> int:
+        return self._https_port
+
+    def close_log(self):
+        if self._error_fd:
+            self._error_fd.close()
+            self._error_fd = None
 
     def clear_logs(self):
         self._rmf(self._error_log)
@@ -73,7 +88,24 @@ class Caddy:
             return self.start()
         return True
 
+    def initial_start(self):
+
+        def startup(ports: Dict[str, int]) -> bool:
+            self._http_port = ports['caddy']
+            self._https_port = ports['caddys']
+            if self.start():
+                self.env.update_ports(ports)
+                return True
+            self.stop()
+            self._http_port = 0
+            self._https_port = 0
+            return False
+
+        return alloc_ports_and_do(Caddy.PORT_SPECS, startup,
+                                  self.env.gen_root, max_tries=3)
+
     def start(self, wait_live=True):
+        assert self._http_port > 0 and self._https_port > 0
         self._mkpath(self._tmp_dir)
         if self._process:
             self.stop()
@@ -81,24 +113,24 @@ class Caddy:
         args = [
             self._caddy, 'run'
         ]
-        caddyerr = open(self._error_log, 'a')
-        self._process = subprocess.Popen(args=args, cwd=self._caddy_dir, stderr=caddyerr)
+        self._error_fd = open(self._error_log, 'a')
+        self._process = subprocess.Popen(args=args, cwd=self._caddy_dir, stderr=self._error_fd)
         if self._process.returncode is not None:
             return False
-        return not wait_live or self.wait_live(timeout=timedelta(seconds=5))
-
-    def stop_if_running(self):
-        if self.is_running():
-            return self.stop()
-        return True
+        return not wait_live or self.wait_live(timeout=timedelta(seconds=Env.SERVER_TIMEOUT))
 
     def stop(self, wait_dead=True):
         self._mkpath(self._tmp_dir)
         if self._process:
             self._process.terminate()
-            self._process.wait(timeout=2)
+            try:
+                self._process.wait(timeout=1)
+            except Exception:
+                self._process.kill()
             self._process = None
+            self.close_log()
             return not wait_dead or self.wait_dead(timeout=timedelta(seconds=5))
+        self.close_log()
         return True
 
     def restart(self):
@@ -132,15 +164,19 @@ class Caddy:
 
     def _rmf(self, path):
         if os.path.exists(path):
-            return os.remove(path)
+            os.remove(path)
 
     def _mkpath(self, path):
         if not os.path.exists(path):
-            return os.makedirs(path)
+            os.makedirs(path)
 
     def _write_config(self):
         domain1 = self.env.domain1
         creds1 = self.env.get_credentials(domain1)
+        assert creds1  # convince pytype this is not None
+        domain2 = self.env.domain2
+        creds2 = self.env.get_credentials(domain2)
+        assert creds2  # convince pytype this is not None
         self._mkpath(self._docs_dir)
         self._mkpath(self._tmp_dir)
         with open(os.path.join(self._docs_dir, 'data.json'), 'w') as fd:
@@ -150,18 +186,29 @@ class Caddy:
             fd.write(JSONEncoder().encode(data))
         with open(self._conf_file, 'w') as fd:
             conf = [   # base server config
-                f'{{',
-                f'  http_port {self.env.caddy_http_port}',
-                f'  https_port {self.env.caddy_https_port}',
-                f'  servers :{self.env.caddy_https_port} {{',
-                f'    protocols h3 h2 h1',
-                f'  }}',
-                f'}}',
-                f'{domain1}:{self.env.caddy_https_port} {{',
-                f'  file_server * {{',
+                '{',
+                f'  http_port {self._http_port}',
+                f'  https_port {self._https_port}',
+                '  log default {',
+                '     level ERROR',
+                '}',
+                f'  servers :{self._https_port} {{',
+                '    protocols h3 h2 h1',
+                '  }',
+                '}',
+                f'{domain1}:{self._https_port} {{',
+                '  file_server * {',
                 f'    root {self._docs_dir}',
-                f'  }}',
+                '  }',
                 f'  tls {creds1.cert_file} {creds1.pkey_file}',
-                f'}}',
+                '}',
             ]
+            if self.env.http_port > 0:
+                conf.extend([
+                    f'{domain2} {{',
+                    f'  reverse_proxy /* http://localhost:{self.env.http_port} {{',
+                    '  }',
+                    f'  tls {creds2.cert_file} {creds2.pkey_file}',
+                    '}',
+                ])
             fd.write("\n".join(conf))
diff --git a/third-party/curl/tests/http/testenv/certs.py b/third-party/curl/tests/http/testenv/certs.py
index f575a74129..85012634a5 100644
--- a/third-party/curl/tests/http/testenv/certs.py
+++ b/third-party/curl/tests/http/testenv/certs.py
@@ -24,21 +24,30 @@
 #
 ###########################################################################
 #
+import base64
+import ipaddress
 import os
 import re
-from datetime import timedelta, datetime
-from typing import List, Any, Optional
+import shutil
+import subprocess
+from datetime import datetime, timedelta, timezone
+from typing import Any, List, Optional
 
 from cryptography import x509
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives._serialization import PublicFormat
 from cryptography.hazmat.primitives.asymmetric import ec, rsa
 from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePrivateKey
 from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
-from cryptography.hazmat.primitives.serialization import Encoding, PrivateFormat, NoEncryption, load_pem_private_key
+from cryptography.hazmat.primitives.serialization import (
+    Encoding,
+    NoEncryption,
+    PrivateFormat,
+    load_pem_private_key,
+)
 from cryptography.x509 import ExtendedKeyUsageOID, NameOID
 
-
 EC_SUPPORTED = {}
 EC_SUPPORTED.update([(curve.name.upper(), curve) for curve in [
     ec.SECP192R1,
@@ -79,6 +88,7 @@ class CertificateSpec:
                  valid_from: timedelta = timedelta(days=-1),
                  valid_to: timedelta = timedelta(days=89),
                  client: bool = False,
+                 check_valid: bool = True,
                  sub_specs: Optional[List['CertificateSpec']] = None):
         self._name = name
         self.domains = domains
@@ -89,12 +99,13 @@ class CertificateSpec:
         self.valid_from = valid_from
         self.valid_to = valid_to
         self.sub_specs = sub_specs
+        self.check_valid = check_valid
 
     @property
     def name(self) -> Optional[str]:
         if self._name:
             return self._name
-        elif self.domains:
+        if self.domains:
             return self.domains[0]
         return None
 
@@ -102,9 +113,9 @@ class CertificateSpec:
     def type(self) -> Optional[str]:
         if self.domains and len(self.domains):
             return "server"
-        elif self.client:
+        if self.client:
             return "client"
-        elif self.name:
+        if self.name:
             return "ca"
         return None
 
@@ -123,6 +134,7 @@ class Credentials:
         self._cert_file = None
         self._pkey_file = None
         self._store = None
+        self._combined_file = None
 
     @property
     def name(self) -> str:
@@ -136,15 +148,23 @@ class Credentials:
     def key_type(self):
         if isinstance(self._pkey, RSAPrivateKey):
             return f"rsa{self._pkey.key_size}"
-        elif isinstance(self._pkey, EllipticCurvePrivateKey):
+        if isinstance(self._pkey, EllipticCurvePrivateKey):
             return f"{self._pkey.curve.name}"
-        else:
-            raise Exception(f"unknown key type: {self._pkey}")
+        raise Exception(f"unknown key type: {self._pkey}")
 
     @property
     def private_key(self) -> Any:
         return self._pkey
 
+    def pub_sha256_b64(self) -> Any:
+        pubkey = self._pkey.public_key()
+        sha256 = hashes.Hash(algorithm=hashes.SHA256())
+        sha256.update(pubkey.public_bytes(
+            encoding=Encoding.DER,
+            format=PublicFormat.SubjectPublicKeyInfo
+        ))
+        return base64.b64encode(sha256.finalize()).decode('utf8')
+
     @property
     def certificate(self) -> Any:
         return self._cert
@@ -185,6 +205,10 @@ class Credentials:
     def combined_file(self) -> Optional[str]:
         return self._combined_file
 
+    @property
+    def hashdir(self) -> Optional[str]:
+        return os.path.join(self._store.path, 'hashdir')
+
     def get_first(self, name) -> Optional['Credentials']:
         creds = self._store.get_credentials_for_name(name) if self._store else []
         return creds[0] if len(creds) else None
@@ -202,7 +226,8 @@ class Credentials:
         creds = None
         if self._store:
             creds = self._store.load_credentials(
-                name=spec.name, key_type=key_type, single_file=spec.single_file, issuer=self)
+                name=spec.name, key_type=key_type, single_file=spec.single_file,
+                issuer=self, check_valid=spec.check_valid)
         if creds is None:
             creds = TestCA.create_credentials(spec=spec, issuer=self, key_type=key_type,
                                               valid_from=spec.valid_from, valid_to=spec.valid_to)
@@ -220,6 +245,16 @@ class Credentials:
             creds.issue_certs(spec.sub_specs, chain=subchain)
         return creds
 
+    def create_hashdir(self, openssl):
+        os.makedirs(self.hashdir, exist_ok=True)
+        p = subprocess.run(args=[
+            openssl, 'x509', '-hash', '-noout', '-in', self.cert_file
+        ], capture_output=True, text=True)
+        if p.returncode != 0:
+            raise Exception(f'openssl failed to compute cert hash: {p}')
+        cert_hname = f'{p.stdout.strip()}.0'
+        shutil.copy(self.cert_file, os.path.join(self.hashdir, cert_hname))
+
 
 class CertStore:
 
@@ -303,13 +338,26 @@ class CertStore:
 
     def load_credentials(self, name: str, key_type=None,
                          single_file: bool = False,
-                         issuer: Optional[Credentials] = None):
+                         issuer: Optional[Credentials] = None,
+                         check_valid: bool = False):
         cert_file = self.get_cert_file(name=name, key_type=key_type)
         pkey_file = cert_file if single_file else self.get_pkey_file(name=name, key_type=key_type)
         comb_file = self.get_combined_file(name=name, key_type=key_type)
         if os.path.isfile(cert_file) and os.path.isfile(pkey_file):
             cert = self.load_pem_cert(cert_file)
             pkey = self.load_pem_pkey(pkey_file)
+            try:
+                now = datetime.now(tz=timezone.utc)
+                if check_valid and \
+                    ((cert.not_valid_after_utc < now) or
+                     (cert.not_valid_before_utc > now)):
+                    return None
+            except AttributeError:  # older python
+                now = datetime.now()
+                if check_valid and \
+                        ((cert.not_valid_after < now) or
+                         (cert.not_valid_before > now)):
+                    return None
             creds = Credentials(name=name, cert=cert, pkey=pkey, issuer=issuer)
             creds.set_store(self)
             creds.set_files(cert_file, pkey_file, comb_file)
@@ -335,7 +383,9 @@ class TestCA:
                            valid_from: timedelta = timedelta(days=-1),
                            valid_to: timedelta = timedelta(days=89),
                            ) -> Credentials:
-        """Create a certificate signed by this CA for the given domains.
+        """
+        Create a certificate signed by this CA for the given domains.
+
         :returns: the certificate and private key PEM file paths
         """
         if spec.domains and len(spec.domains):
@@ -355,7 +405,7 @@ class TestCA:
         return creds
 
     @staticmethod
-    def _make_x509_name(org_name: str = None, common_name: str = None, parent: x509.Name = None) -> x509.Name:
+    def _make_x509_name(org_name: Optional[str] = None, common_name: Optional[str] = None, parent: x509.Name = None) -> x509.Name:
         name_pieces = []
         if org_name:
             oid = NameOID.ORGANIZATIONAL_UNIT_NAME if parent else NameOID.ORGANIZATION_NAME
@@ -363,7 +413,7 @@ class TestCA:
         elif common_name:
             name_pieces.append(x509.NameAttribute(NameOID.COMMON_NAME, common_name))
         if parent:
-            name_pieces.extend([rdn for rdn in parent])
+            name_pieces.extend(list(parent))
         return x509.Name(name_pieces)
 
     @staticmethod
@@ -371,9 +421,9 @@ class TestCA:
             subject: x509.Name,
             pkey: Any,
             issuer_subject: Optional[Credentials],
-            valid_from_delta: timedelta = None,
-            valid_until_delta: timedelta = None
-    ):
+            valid_from_delta: Optional[timedelta] = None,
+            valid_until_delta: Optional[timedelta] = None
+    ) -> x509.CertificateBuilder:
         pubkey = pkey.public_key()
         issuer_subject = issuer_subject if issuer_subject is not None else subject
 
@@ -426,6 +476,17 @@ class TestCA:
 
     @staticmethod
     def _add_leaf_usages(csr: Any, domains: List[str], issuer: Credentials) -> Any:
+        names = []
+        for name in domains:
+            m = re.match(r'dns:(.+)', name)
+            if m:
+                names.append(x509.DNSName(m.group(1)))
+            else:
+                try:
+                    names.append(x509.IPAddress(ipaddress.ip_address(name)))
+                except ValueError:
+                    names.append(x509.DNSName(name))
+
         return csr.add_extension(
             x509.BasicConstraints(ca=False, path_length=None),
             critical=True,
@@ -435,8 +496,7 @@ class TestCA:
                     x509.SubjectKeyIdentifier).value),
             critical=False
         ).add_extension(
-            x509.SubjectAlternativeName([x509.DNSName(domain) for domain in domains]),
-            critical=True,
+            x509.SubjectAlternativeName(names), critical=True,
         ).add_extension(
             x509.ExtendedKeyUsage([
                 ExtendedKeyUsageOID.SERVER_AUTH,
@@ -445,7 +505,7 @@ class TestCA:
         )
 
     @staticmethod
-    def _add_client_usages(csr: Any, issuer: Credentials, rfc82name: str = None) -> Any:
+    def _add_client_usages(csr: Any, issuer: Credentials, rfc82name: Optional[str] = None) -> Any:
         cert = csr.add_extension(
             x509.BasicConstraints(ca=False, path_length=None),
             critical=True,
@@ -470,7 +530,7 @@ class TestCA:
 
     @staticmethod
     def _make_ca_credentials(name, key_type: Any,
-                             issuer: Credentials = None,
+                             issuer: Optional[Credentials] = None,
                              valid_from: timedelta = timedelta(days=-1),
                              valid_to: timedelta = timedelta(days=89),
                              ) -> Credentials:
@@ -497,7 +557,6 @@ class TestCA:
                                  valid_from: timedelta = timedelta(days=-1),
                                  valid_to: timedelta = timedelta(days=89),
                                  ) -> Credentials:
-        name = name
         pkey = _private_key(key_type=key_type)
         subject = TestCA._make_x509_name(common_name=name, parent=issuer.subject)
         csr = TestCA._make_csr(subject=subject,
diff --git a/third-party/curl/tests/http/testenv/client.py b/third-party/curl/tests/http/testenv/client.py
index 098e55b9cd..76c4822cbc 100644
--- a/third-party/curl/tests/http/testenv/client.py
+++ b/third-party/curl/tests/http/testenv/client.py
@@ -24,31 +24,28 @@
 #
 ###########################################################################
 #
-import pytest
-import json
 import logging
 import os
-import re
 import shutil
 import subprocess
-from datetime import timedelta, datetime
-from typing import List, Optional, Dict, Union
-from urllib.parse import urlparse
+from datetime import datetime
+from typing import Dict, Optional
 
 from . import ExecResult
 from .env import Env
 
-
 log = logging.getLogger(__name__)
 
 
 class LocalClient:
 
     def __init__(self, name: str, env: Env, run_dir: Optional[str] = None,
-                 timeout: Optional[float] = None):
+                 timeout: Optional[float] = None,
+                 run_env: Optional[Dict[str,str]] = None):
         self.name = name
-        self.path = os.path.join(env.project_dir, f'tests/http/clients/{name}')
+        self.path = os.path.join(env.build_dir, 'tests/libtest/libtests')
         self.env = env
+        self._run_env = run_env
         self._timeout = timeout if timeout else env.test_timeout
         self._curl = os.environ['CURL'] if 'CURL' in os.environ else env.curl
         self._run_dir = run_dir if run_dir else os.path.join(env.gen_dir, name)
@@ -73,37 +70,43 @@ class LocalClient:
 
     def _rmf(self, path):
         if os.path.exists(path):
-            return os.remove(path)
+            os.remove(path)
 
     def _rmrf(self, path):
         if os.path.exists(path):
-            return shutil.rmtree(path)
+            shutil.rmtree(path)
 
     def _mkpath(self, path):
         if not os.path.exists(path):
-            return os.makedirs(path)
+            os.makedirs(path)
 
     def run(self, args):
         self._rmf(self._stdoutfile)
         self._rmf(self._stderrfile)
         start = datetime.now()
         exception = None
-        myargs = [self.path]
+        myargs = [self.path, self.name]
         myargs.extend(args)
+        run_env = None
+        if self._run_env:
+            run_env = self._run_env.copy()
+            for key in ['CURL_DEBUG']:
+                if key in os.environ and key not in run_env:
+                    run_env[key] = os.environ[key]
         try:
-            with open(self._stdoutfile, 'w') as cout:
-                with open(self._stderrfile, 'w') as cerr:
-                    p = subprocess.run(myargs, stderr=cerr, stdout=cout,
-                                       cwd=self._run_dir, shell=False,
-                                       input=None,
-                                       timeout=self._timeout)
-                    exitcode = p.returncode
+            with open(self._stdoutfile, 'w') as cout, open(self._stderrfile, 'w') as cerr:
+                p = subprocess.run(myargs, stderr=cerr, stdout=cout,
+                                   cwd=self._run_dir, shell=False,
+                                   input=None, env=run_env,
+                                   timeout=self._timeout)
+                exitcode = p.returncode
         except subprocess.TimeoutExpired:
             log.warning(f'Timeout after {self._timeout}s: {args}')
             exitcode = -1
             exception = 'TimeoutExpired'
-        coutput = open(self._stdoutfile).readlines()
-        cerrput = open(self._stderrfile).readlines()
+        with open(self._stdoutfile) as fout, open(self._stderrfile) as ferr:
+            coutput = fout.readlines()
+            cerrput = ferr.readlines()
         return ExecResult(args=myargs, exit_code=exitcode, exception=exception,
                           stdout=coutput, stderr=cerrput,
                           duration=datetime.now() - start)
@@ -111,8 +114,10 @@ class LocalClient:
     def dump_logs(self):
         lines = []
         lines.append('>>--stdout ----------------------------------------------\n')
-        lines.extend(open(self._stdoutfile).readlines())
+        with open(self._stdoutfile) as fd:
+            lines.extend(fd.readlines())
         lines.append('>>--stderr ----------------------------------------------\n')
-        lines.extend(open(self._stderrfile).readlines())
+        with open(self._stderrfile) as fd:
+            lines.extend(fd.readlines())
         lines.append('<<-------------------------------------------------------\n')
         return ''.join(lines)
diff --git a/third-party/curl/tests/http/testenv/curl.py b/third-party/curl/tests/http/testenv/curl.py
index 9f92f629cf..3071d7dd4a 100644
--- a/third-party/curl/tests/http/testenv/curl.py
+++ b/third-party/curl/tests/http/testenv/curl.py
@@ -30,28 +30,249 @@ import os
 import re
 import shutil
 import subprocess
-from datetime import timedelta, datetime
-from typing import List, Optional, Dict, Union
+import sys
+import time
+from datetime import datetime, timedelta, timezone
+from functools import cmp_to_key
+from statistics import fmean, mean
+from threading import Thread
+from typing import Any, Dict, List, Optional, Union
 from urllib.parse import urlparse
 
+import psutil
+
 from .env import Env
 
-
 log = logging.getLogger(__name__)
 
 
+class RunProfile:
+
+    STAT_KEYS = ['cpu', 'rss', 'vsz']
+
+    @classmethod
+    def AverageStats(cls, profiles: List['RunProfile']):
+        avg = {}
+        stats = [p.stats for p in profiles]
+        for key in cls.STAT_KEYS:
+            vals = [s[key] for s in stats]
+            avg[key] = mean(vals) if len(vals) else 0.0
+        return avg
+
+    def __init__(self, pid: int, started_at: datetime, run_dir):
+        self._pid = pid
+        self._started_at = started_at
+        self._duration = timedelta(seconds=0)
+        self._run_dir = run_dir
+        self._samples = []
+        self._psu = None
+        self._stats = None
+
+    @property
+    def duration(self) -> timedelta:
+        return self._duration
+
+    @property
+    def stats(self) -> Optional[Dict[str,Any]]:
+        return self._stats
+
+    def sample(self):
+        elapsed = datetime.now() - self._started_at
+        try:
+            if self._psu is None:
+                self._psu = psutil.Process(pid=self._pid)
+            mem = self._psu.memory_info()
+            self._samples.append({
+                'time': elapsed,
+                'cpu': self._psu.cpu_percent(),
+                'vsz': mem.vms,
+                'rss': mem.rss,
+            })
+        except psutil.NoSuchProcess:
+            # process may exit between sampling ticks: ignore this
+            pass
+
+    def finish(self):
+        self._duration = datetime.now() - self._started_at
+        if len(self._samples) > 0:
+            weights = [s['time'].total_seconds() for s in self._samples]
+            self._stats = {}
+            for key in self.STAT_KEYS:
+                self._stats[key] = fmean([s[key] for s in self._samples], weights)
+        else:
+            self._stats = None
+        self._psu = None
+
+    def __repr__(self):
+        return f'RunProfile[pid={self._pid}, '\
+               f'duration={self.duration.total_seconds():.3f}s, '\
+               f'stats={self.stats}]'
+
+
+class PerfProfile:
+
+    def __init__(self, pid: int, run_dir):
+        self._pid = pid
+        self._run_dir = run_dir
+        self._proc = None
+        self._rc = 0
+        self._file = os.path.join(self._run_dir, 'curl.perf_stacks')
+
+    def start(self):
+        if os.path.exists(self._file):
+            os.remove(self._file)
+        args = [
+            'sudo', 'perf', 'record', '-F', '99', '-p', f'{self._pid}',
+            '-g', '--', 'sleep', '60'
+        ]
+        self._proc = subprocess.Popen(args, text=True, cwd=self._run_dir, shell=False)
+        assert self._proc
+
+    def finish(self):
+        if self._proc:
+            self._proc.terminate()
+            self._rc = self._proc.returncode
+        with open(self._file, 'w') as cout:
+            p = subprocess.run([
+                'sudo', 'perf', 'script'
+            ], stdout=cout, cwd=self._run_dir, shell=False)
+            rc = p.returncode
+            if rc != 0:
+                raise Exception(f'perf returned error {rc}')
+
+    @property
+    def file(self):
+        return self._file
+
+
+class DTraceProfile:
+
+    def __init__(self, pid: int, run_dir):
+        self._pid = pid
+        self._run_dir = run_dir
+        self._proc = None
+        self._rc = 0
+        self._file = os.path.join(self._run_dir, 'curl.dtrace_stacks')
+
+    def start(self):
+        if os.path.exists(self._file):
+            os.remove(self._file)
+        args = [
+            'sudo', 'dtrace',
+            '-x', 'ustackframes=100',
+            '-n', f'profile-97 /pid == {self._pid}/ {{ @[ustack()] = count(); }} tick-60s {{ exit(0); }}',
+            '-o', f'{self._file}'
+        ]
+        if sys.platform.startswith('darwin'):
+            # macOS seems to like this for producing symbols in user stacks
+            args.extend(['-p', f'{self._pid}'])
+        self._proc = subprocess.Popen(args, text=True, cwd=self._run_dir, shell=False)
+        assert self._proc
+
+    def finish(self):
+        if self._proc:
+            self._proc.terminate()
+            self._rc = self._proc.returncode
+
+    @property
+    def file(self):
+        return self._file
+
+
+class RunTcpDump:
+
+    def __init__(self, env, run_dir):
+        self._env = env
+        self._run_dir = run_dir
+        self._proc = None
+        self._stdoutfile = os.path.join(self._run_dir, 'tcpdump.out')
+        self._stderrfile = os.path.join(self._run_dir, 'tcpdump.err')
+
+    def get_rsts(self, ports: Optional[List[int]] = None) -> Optional[List[str]]:
+        if self._proc:
+            raise Exception('tcpdump still running')
+        lines = []
+        with open(self._stdoutfile) as fd:
+            for line in fd:
+                m = re.match(r'.* IP 127\.0\.0\.1\.(\d+) [<>] 127\.0\.0\.1\.(\d+):.*', line)
+                if m:
+                    sport = int(m.group(1))
+                    dport = int(m.group(2))
+                    if ports is None or sport in ports or dport in ports:
+                        lines.append(line)
+        return lines
+
+    @property
+    def stats(self) -> Optional[List[str]]:
+        return self.get_rsts()
+
+    @property
+    def stderr(self) -> List[str]:
+        if self._proc:
+            raise Exception('tcpdump still running')
+        with open(self._stderrfile) as fd:
+            return fd.readlines()
+
+    def sample(self):
+        # not sure how to make that detection reliable for all platforms
+        local_if = 'lo0' if sys.platform.startswith('darwin') else 'lo'
+        try:
+            tcpdump = self._env.tcpdump()
+            if tcpdump is None:
+                raise Exception('tcpdump not available')
+            # look with tcpdump for TCP RST packets which indicate
+            # we did not shut down connections cleanly
+            args = []
+            # at least on Linux, we need root permissions to run tcpdump
+            if sys.platform.startswith('linux'):
+                args.append('sudo')
+            args.extend([
+                tcpdump, '-i', local_if, '-n', 'tcp[tcpflags] & (tcp-rst)!=0'
+            ])
+            with open(self._stdoutfile, 'w') as cout, open(self._stderrfile, 'w') as cerr:
+                self._proc = subprocess.Popen(args, stdout=cout, stderr=cerr,
+                                              text=True, cwd=self._run_dir,
+                                              shell=False)
+                assert self._proc
+                assert self._proc.returncode is None
+                while self._proc:
+                    try:
+                        self._proc.wait(timeout=1)
+                    except subprocess.TimeoutExpired:
+                        # timeout means tcpdump is still running
+                        pass
+        except Exception:
+            log.exception('Tcpdump')
+
+    def start(self):
+        def do_sample():
+            self.sample()
+        t = Thread(target=do_sample)
+        t.start()
+
+    def finish(self):
+        if self._proc:
+            time.sleep(1)
+            self._proc.terminate()
+            self._proc = None
+
+
 class ExecResult:
 
     def __init__(self, args: List[str], exit_code: int,
                  stdout: List[str], stderr: List[str],
                  duration: Optional[timedelta] = None,
                  with_stats: bool = False,
-                 exception: Optional[str] = None):
+                 exception: Optional[str] = None,
+                 profile: Optional[RunProfile] = None,
+                 tcpdump: Optional[RunTcpDump] = None):
         self._args = args
         self._exit_code = exit_code
         self._exception = exception
         self._stdout = stdout
         self._stderr = stderr
+        self._profile = profile
+        self._tcpdump = tcpdump
         self._duration = duration if duration is not None else timedelta()
         self._response = None
         self._responses = []
@@ -63,11 +284,11 @@ class ExecResult:
         if with_stats:
             self._parse_stats()
         else:
-            # noinspection PyBroadException
             try:
                 out = ''.join(self._stdout)
                 self._json_out = json.loads(out)
-            except:
+            except (json.JSONDecodeError, TypeError, ValueError):
+                # stdout not guaranteed to be JSON, keep _json_out as None
                 pass
 
     def __repr__(self):
@@ -76,11 +297,11 @@ class ExecResult:
 
     def _parse_stats(self):
         self._stats = []
-        for l in self._stdout:
+        for line in self._stdout:
             try:
-                self._stats.append(json.loads(l))
-            except:
-                log.error(f'not a JSON stat: {l}')
+                self._stats.append(json.loads(line))
+            except (json.JSONDecodeError, TypeError, ValueError):
+                log.exception(f'not a JSON stat: {line}')
                 break
 
     @property
@@ -116,6 +337,14 @@ class ExecResult:
     def duration(self) -> timedelta:
         return self._duration
 
+    @property
+    def profile(self) -> Optional[RunProfile]:
+        return self._profile
+
+    @property
+    def tcpdump(self) -> Optional[RunTcpDump]:
+        return self._tcpdump
+
     @property
     def response(self) -> Optional[Dict]:
         return self._response
@@ -167,7 +396,7 @@ class ExecResult:
                                         f'got {self.exit_code}\n{self.dump_logs()}'
         elif code is False:
             assert self.exit_code != 0, f'expected exit code {code}, '\
-                                                f'got {self.exit_code}\n{self.dump_logs()}'
+                                        f'got {self.exit_code}\n{self.dump_logs()}'
         else:
             assert self.exit_code == code, f'expected exit code {code}, '\
                                            f'got {self.exit_code}\n{self.dump_logs()}'
@@ -232,9 +461,13 @@ class ExecResult:
                 f'were made\n{self.dump_logs()}'
 
     def check_stats(self, count: int, http_status: Optional[int] = None,
-                    exitcode: Optional[int] = None):
+                    exitcode: Optional[Union[int, List[int]]] = None,
+                    remote_port: Optional[int] = None,
+                    remote_ip: Optional[str] = None):
         if exitcode is None:
             self.check_exit_code(0)
+        elif isinstance(exitcode, int):
+            exitcode = [exitcode]
         assert len(self.stats) == count, \
             f'stats count: expected {count}, got {len(self.stats)}\n{self.dump_logs()}'
         if http_status is not None:
@@ -247,9 +480,94 @@ class ExecResult:
         if exitcode is not None:
             for idx, x in enumerate(self.stats):
                 if 'exitcode' in x:
-                    assert x['exitcode'] == 0, \
+                    assert x['exitcode'] in exitcode, \
                         f'status #{idx} exitcode: expected {exitcode}, '\
                         f'got {x["exitcode"]}\n{self.dump_stat(x)}'
+        if remote_port is not None:
+            for idx, x in enumerate(self.stats):
+                assert 'remote_port' in x, f'remote_port missing\n{self.dump_stat(x)}'
+                assert x['remote_port'] == remote_port, \
+                        f'status #{idx} remote_port: expected {remote_port}, '\
+                        f'got {x["remote_port"]}\n{self.dump_stat(x)}'
+        if remote_ip is not None:
+            for idx, x in enumerate(self.stats):
+                assert 'remote_ip' in x, f'remote_ip missing\n{self.dump_stat(x)}'
+                assert x['remote_ip'] == remote_ip, \
+                        f'status #{idx} remote_ip: expected {remote_ip}, '\
+                        f'got {x["remote_ip"]}\n{self.dump_stat(x)}'
+
+    def check_stat_positive(self, s, idx, key):
+        assert key in s, f'stat #{idx} "{key}" missing: {s}'
+        assert s[key] > 0, f'stat #{idx} "{key}" not positive: {s}'
+
+    def check_stat_positive_or_0(self, s, idx, key):
+        assert key in s, f'stat #{idx} "{key}" missing: {s}'
+        assert s[key] >= 0, f'stat #{idx} "{key}" not positive: {s}'
+
+    def check_stat_zero(self, s, key):
+        assert key in s, f'stat "{key}" missing: {s}'
+        assert s[key] == 0, f'stat "{key}" not zero: {s}'
+
+    def check_stats_timelines(self):
+        for i in range(len(self._stats)):
+            self.check_stats_timeline(i)
+
+    def check_stats_timeline(self, idx):
+        # check timings reported on a transfer for consistency
+        s = self._stats[idx]
+
+        url = s['url_effective']
+
+        self.check_stat_positive_or_0(s, idx, 'time_connect')
+        # all stat keys which reporting timings
+        all_keys = {
+            'time_queue', 'time_namelookup',
+            'time_connect', 'time_appconnect',
+            'time_pretransfer', 'time_posttransfer',
+            'time_starttransfer', 'time_total',
+        }
+        # stat keys where we expect a positive value
+        ref_tl = []
+        # time_queue has its own start timestamp. Other timers start *after*
+        # queueing is done. queue duration might therefore be anywhere.
+        somewhere_keys = ['time_queue']
+        exact_match = True
+        # redirects mess up the times, some are accumulative
+        if s['time_redirect']:
+            exact_match = False
+        # connect events?
+        if url.startswith('ftp'):
+            # ftp is messy with connect events for its DATA connection
+            exact_match = False
+        elif s['num_connects'] > 0:
+            ref_tl += ['time_namelookup', 'time_connect']
+            if url.startswith('https:'):
+                ref_tl += ['time_appconnect']
+        ref_tl += ['time_pretransfer', 'time_posttransfer']
+        somewhere_keys.extend(['time_starttransfer'])
+        # always there at the end
+        ref_tl += ['time_total']
+
+        # assert all events in reference timeline are > 0
+        for key in ref_tl:
+            self.check_stat_positive(s, idx, key)
+        if exact_match:
+            # assert all events not in reference timeline are 0
+            for key in [key for key in all_keys if key not in ref_tl and key not in somewhere_keys]:
+                self.check_stat_zero(s, key)
+
+        # calculate the timeline that did happen
+        def cmp_ts(t1, t2):
+            n = s[t1] - s[t2]
+            if not n:  # same timestamp, order to expected occurrence
+                return ref_tl.index(t1) - ref_tl.index(t2)
+            return n
+
+        seen_tl = sorted(ref_tl, key=cmp_to_key(cmp_ts))
+        assert seen_tl == ref_tl, f'timeline {idx}: {[f"{ts}: {s[ts]}" for ts in seen_tl]}\n{self.dump_logs()}'
+        for key in somewhere_keys:
+            self.check_stat_positive(s, idx, key)
+            assert s[key] <= s['time_total']
 
     def dump_logs(self):
         lines = ['>>--stdout ----------------------------------------------\n']
@@ -290,8 +608,17 @@ class CurlClient:
         'h3': '--http3-only',
     }
 
-    def __init__(self, env: Env, run_dir: Optional[str] = None,
-                 timeout: Optional[float] = None, silent: bool = False):
+    def __init__(self, env: Env,
+                 run_dir: Optional[str] = None,
+                 timeout: Optional[float] = None,
+                 silent: bool = False,
+                 run_env: Optional[Dict[str, str]] = None,
+                 server_addr: Optional[str] = None,
+                 with_dtrace: bool = False,
+                 with_perf: bool = False,
+                 with_flame: bool = False,
+                 force_resolv: bool = True,
+                 socks_args: Optional[List[str]] = None):
         self.env = env
         self._timeout = timeout if timeout else env.test_timeout
         self._curl = os.environ['CURL'] if 'CURL' in os.environ else env.curl
@@ -300,7 +627,27 @@ class CurlClient:
         self._stderrfile = f'{self._run_dir}/curl.stderr'
         self._headerfile = f'{self._run_dir}/curl.headers'
         self._log_path = f'{self._run_dir}/curl.log'
+        self._with_dtrace = with_dtrace
+        self._with_perf = with_perf
+        self._with_flame = with_flame
+        self._fg_dir = None
+        if self._with_flame:
+            self._fg_dir = os.path.join(self.env.project_dir, '../FlameGraph')
+            if 'FLAMEGRAPH' in os.environ:
+                self._fg_dir = os.environ['FLAMEGRAPH']
+            if not os.path.exists(self._fg_dir):
+                raise Exception(f'FlameGraph checkout not found in {self._fg_dir}, set env variable FLAMEGRAPH')
+            if sys.platform.startswith('linux'):
+                self._with_perf = True
+            elif sys.platform.startswith('darwin'):
+                self._with_dtrace = True
+            else:
+                raise Exception(f'flame graphs unsupported on {sys.platform}')
+        self._socks_args = socks_args
         self._silent = silent
+        self._run_env = run_env
+        self._server_addr = server_addr if server_addr else '127.0.0.1'
+        self._force_resolv = force_resolv
         self._rmrf(self._run_dir)
         self._mkpath(self._run_dir)
 
@@ -313,57 +660,80 @@ class CurlClient:
 
     def _rmf(self, path):
         if os.path.exists(path):
-            return os.remove(path)
+            os.remove(path)
 
     def _rmrf(self, path):
         if os.path.exists(path):
-            return shutil.rmtree(path)
+            shutil.rmtree(path)
 
     def _mkpath(self, path):
         if not os.path.exists(path):
-            return os.makedirs(path)
+            os.makedirs(path)
 
     def get_proxy_args(self, proto: str = 'http/1.1',
-                       proxys: bool = True, tunnel: bool = False):
+                       proxys: bool = True, tunnel: bool = False,
+                       use_ip: bool = False, use_ipv6: bool = False,
+                       use_h2o: bool = False):
+        proxy_name = '[::1]' if use_ipv6 else \
+            self._server_addr if use_ip else self.env.proxy_domain
         if proxys:
-            pport = self.env.pts_port(proto) if tunnel else self.env.proxys_port
+            if tunnel:
+                pport = self.env.pts_port(proto, use_h2o=use_h2o)
+            elif proto == 'h3':
+                pport = self.env.h3proxys_port
+            else:
+                pport = self.env.proxys_port
             xargs = [
-                '--proxy', f'https://{self.env.proxy_domain}:{pport}/',
-                '--resolve', f'{self.env.proxy_domain}:{pport}:127.0.0.1',
+                '--proxy', f'https://{proxy_name}:{pport}/',
                 '--proxy-cacert', self.env.ca.cert_file,
             ]
+            if self._force_resolv and not use_ip and not use_ipv6:
+                xargs.extend(['--resolve', f'{proxy_name}:{pport}:{self._server_addr}'])
             if proto == 'h2':
                 xargs.append('--proxy-http2')
+            elif proto == 'h3':
+                xargs.append('--proxy-http3')
         else:
             xargs = [
-                '--proxy', f'http://{self.env.proxy_domain}:{self.env.proxy_port}/',
-                '--resolve', f'{self.env.proxy_domain}:{self.env.proxy_port}:127.0.0.1',
+                '--proxy', f'http://{proxy_name}:{self.env.proxy_port}/',
             ]
+            if self._force_resolv and not use_ip and not use_ipv6:
+                xargs.extend(['--resolve', f'{proxy_name}:{self.env.proxy_port}:{self._server_addr}'])
         if tunnel:
             xargs.append('--proxytunnel')
         return xargs
 
     def http_get(self, url: str, extra_args: Optional[List[str]] = None,
-                 def_tracing: bool = True):
-        return self._raw(url, options=extra_args, with_stats=False,
-                         def_tracing=def_tracing)
+                 alpn_proto: Optional[str] = None,
+                 def_tracing: bool = True,
+                 with_stats: bool = False,
+                 with_profile: bool = False,
+                 with_tcpdump: bool = False):
+        return self._raw(url, options=extra_args,
+                         with_stats=with_stats,
+                         alpn_proto=alpn_proto,
+                         def_tracing=def_tracing,
+                         with_profile=with_profile,
+                         with_tcpdump=with_tcpdump)
 
     def http_download(self, urls: List[str],
                       alpn_proto: Optional[str] = None,
                       with_stats: bool = True,
                       with_headers: bool = False,
+                      with_profile: bool = False,
+                      with_tcpdump: bool = False,
                       no_save: bool = False,
-                      extra_args: List[str] = None):
+                      limit_rate: Optional[str] = None,
+                      extra_args: Optional[List[str]] = None,
+                      url_options: Optional[Dict[str, List[str]]] = None):
         if extra_args is None:
             extra_args = []
         if no_save:
-            extra_args.extend([
-                '-o', '/dev/null',
-            ])
+            extra_args.extend(['--out-null'])
         else:
-            extra_args.extend([
-                '-o', 'download_#1.data',
-            ])
+            extra_args.extend(['-o', 'download_#1.data'])
+        if limit_rate:
+            extra_args.extend(['--limit-rate', limit_rate])
         # remove any existing ones
         for i in range(100):
             self._rmf(self.download_file(i))
@@ -373,12 +743,17 @@ class CurlClient:
             ])
         return self._raw(urls, alpn_proto=alpn_proto, options=extra_args,
                          with_stats=with_stats,
-                         with_headers=with_headers)
+                         url_options=url_options,
+                         with_headers=with_headers,
+                         with_profile=with_profile,
+                         with_tcpdump=with_tcpdump)
 
     def http_upload(self, urls: List[str], data: str,
                     alpn_proto: Optional[str] = None,
                     with_stats: bool = True,
                     with_headers: bool = False,
+                    with_profile: bool = False,
+                    with_tcpdump: bool = False,
                     extra_args: Optional[List[str]] = None):
         if extra_args is None:
             extra_args = []
@@ -391,12 +766,35 @@ class CurlClient:
             ])
         return self._raw(urls, alpn_proto=alpn_proto, options=extra_args,
                          with_stats=with_stats,
-                         with_headers=with_headers)
+                         with_headers=with_headers,
+                         with_profile=with_profile,
+                         with_tcpdump=with_tcpdump)
+
+    def http_delete(self, urls: List[str],
+                    alpn_proto: Optional[str] = None,
+                    with_stats: bool = True,
+                    with_profile: bool = False,
+                    extra_args: Optional[List[str]] = None):
+        if extra_args is None:
+            extra_args = []
+        extra_args.extend([
+            '-X', 'DELETE', '--out-null',
+        ])
+        if with_stats:
+            extra_args.extend([
+                '-w', '%{json}\\n'
+            ])
+        return self._raw(urls, alpn_proto=alpn_proto, options=extra_args,
+                         with_stats=with_stats,
+                         with_headers=False,
+                         with_profile=with_profile)
 
     def http_put(self, urls: List[str], data=None, fdata=None,
                  alpn_proto: Optional[str] = None,
                  with_stats: bool = True,
                  with_headers: bool = False,
+                 with_profile: bool = False,
+                 suppress_cl: bool = False,
                  extra_args: Optional[List[str]] = None):
         if extra_args is None:
             extra_args = []
@@ -411,10 +809,16 @@ class CurlClient:
             extra_args.extend([
                 '-w', '%{json}\\n'
             ])
+        if suppress_cl:
+            extra_args.extend([
+                '-H', 'Content-Length:',
+                '-H', 'Transfer-Encoding: chunked',
+            ])
         return self._raw(urls, intext=data,
                          alpn_proto=alpn_proto, options=extra_args,
                          with_stats=with_stats,
-                         with_headers=with_headers)
+                         with_headers=with_headers,
+                         with_profile=with_profile)
 
     def http_form(self, urls: List[str], form: Dict[str, str],
                   alpn_proto: Optional[str] = None,
@@ -436,10 +840,161 @@ class CurlClient:
                          with_stats=with_stats,
                          with_headers=with_headers)
 
+    def ftp_get(self, urls: List[str],
+                      with_stats: bool = True,
+                      with_profile: bool = False,
+                      with_tcpdump: bool = False,
+                      no_save: bool = False,
+                      extra_args: Optional[List[str]] = None):
+        if extra_args is None:
+            extra_args = []
+        if no_save:
+            extra_args.extend([
+                '--out-null',
+            ])
+        else:
+            extra_args.extend([
+                '-o', 'download_#1.data',
+            ])
+        # remove any existing ones
+        for i in range(100):
+            self._rmf(self.download_file(i))
+        if with_stats:
+            extra_args.extend([
+                '-w', '%{json}\\n'
+            ])
+        return self._raw(urls, options=extra_args,
+                         with_stats=with_stats,
+                         with_headers=False,
+                         with_profile=with_profile,
+                         with_tcpdump=with_tcpdump)
+
+    def ftp_ssl_get(self, urls: List[str],
+                      with_stats: bool = True,
+                      with_profile: bool = False,
+                      with_tcpdump: bool = False,
+                      no_save: bool = False,
+                      extra_args: Optional[List[str]] = None):
+        if extra_args is None:
+            extra_args = []
+        extra_args.extend([
+            '--ssl-reqd',
+        ])
+        return self.ftp_get(urls=urls, with_stats=with_stats,
+                            with_profile=with_profile, no_save=no_save,
+                            with_tcpdump=with_tcpdump,
+                            extra_args=extra_args)
+
+    def ftp_upload(self, urls: List[str],
+                   fupload: Optional[Any] = None,
+                   updata: Optional[str] = None,
+                   with_stats: bool = True,
+                   with_profile: bool = False,
+                   with_tcpdump: bool = False,
+                   extra_args: Optional[List[str]] = None):
+        if extra_args is None:
+            extra_args = []
+        if fupload is not None:
+            extra_args.extend([
+                '--upload-file', fupload
+            ])
+        elif updata is not None:
+            extra_args.extend([
+                '--upload-file', '-'
+            ])
+        else:
+            raise Exception('need either file or data to upload')
+        if with_stats:
+            extra_args.extend([
+                '-w', '%{json}\\n'
+            ])
+        return self._raw(urls, options=extra_args,
+                         intext=updata,
+                         with_stats=with_stats,
+                         with_headers=False,
+                         with_profile=with_profile,
+                         with_tcpdump=with_tcpdump)
+
+    def ftp_ssl_upload(self, urls: List[str],
+                       fupload: Optional[Any] = None,
+                       updata: Optional[str] = None,
+                       with_stats: bool = True,
+                       with_profile: bool = False,
+                       with_tcpdump: bool = False,
+                       extra_args: Optional[List[str]] = None):
+        if extra_args is None:
+            extra_args = []
+        extra_args.extend([
+            '--ssl-reqd',
+        ])
+        return self.ftp_upload(urls=urls, fupload=fupload, updata=updata,
+                               with_stats=with_stats, with_profile=with_profile,
+                               with_tcpdump=with_tcpdump,
+                               extra_args=extra_args)
+
+    def ssh_download(self, urls: List[str],
+                     with_stats: bool = True,
+                     with_profile: bool = False,
+                     with_tcpdump: bool = False,
+                     no_save: bool = False,
+                     extra_args: Optional[List[str]] = None):
+        if extra_args is None:
+            extra_args = []
+        if no_save:
+            extra_args.extend([
+                '--out-null',
+            ])
+        else:
+            extra_args.extend([
+                '-o', 'download_#1.data',
+            ])
+        # remove any existing ones
+        for i in range(100):
+            self._rmf(self.download_file(i))
+        if with_stats:
+            extra_args.extend([
+                '-w', '%{json}\\n'
+            ])
+        return self._raw(urls, options=extra_args,
+                         with_stats=with_stats,
+                         with_headers=False,
+                         with_profile=with_profile,
+                         with_tcpdump=with_tcpdump)
+
+    def ssh_upload(self, urls: List[str],
+                   fupload: Optional[Any] = None,
+                   updata: Optional[str] = None,
+                   with_stats: bool = True,
+                   with_profile: bool = False,
+                   with_tcpdump: bool = False,
+                   extra_args: Optional[List[str]] = None):
+        if extra_args is None:
+            extra_args = []
+        if fupload is not None:
+            extra_args.extend([
+                '--upload-file', fupload
+            ])
+        elif updata is not None:
+            extra_args.extend([
+                '--upload-file', '-'
+            ])
+        else:
+            raise Exception('need either file or data to upload')
+        if with_stats:
+            extra_args.extend([
+                '-w', '%{json}\\n'
+            ])
+        return self._raw(urls, options=extra_args,
+                         intext=updata,
+                         with_stats=with_stats,
+                         with_headers=False,
+                         with_profile=with_profile,
+                         with_tcpdump=with_tcpdump)
+
     def response_file(self, idx: int):
         return os.path.join(self._run_dir, f'download_{idx}.data')
 
-    def run_direct(self, args, with_stats: bool = False):
+    def run_direct(self, args, with_stats: bool = False, with_profile: bool = False):
         my_args = [self._curl]
         if with_stats:
             my_args.extend([
@@ -449,69 +1004,144 @@ class CurlClient:
             '-o', 'download.data',
         ])
         my_args.extend(args)
-        return self._run(args=my_args, with_stats=with_stats)
+        return self._run(args=my_args, with_stats=with_stats, with_profile=with_profile)
 
-    def _run(self, args, intext='', with_stats: bool = False):
+    def _run(self, args, intext='', with_stats: bool = False,
+             with_profile: bool = True, with_tcpdump: bool = False):
         self._rmf(self._stdoutfile)
         self._rmf(self._stderrfile)
         self._rmf(self._headerfile)
-        start = datetime.now()
         exception = None
+        profile = None
+        tcpdump = None
+        perf = None
+        dtrace = None
+        if with_tcpdump:
+            tcpdump = RunTcpDump(self.env, self._run_dir)
+            tcpdump.start()
+        started_at = datetime.now()
         try:
-            with open(self._stdoutfile, 'w') as cout:
-                with open(self._stderrfile, 'w') as cerr:
+            with open(self._stdoutfile, 'w') as cout, open(self._stderrfile, 'w') as cerr:
+                if with_profile:
+                    end_at = started_at + timedelta(seconds=self._timeout) \
+                        if self._timeout else None
+                    log.info(f'starting: {args}')
+                    p = subprocess.Popen(args, stderr=cerr, stdout=cout,
+                                         cwd=self._run_dir, shell=False,
+                                         env=self._run_env)
+                    profile = RunProfile(p.pid, started_at, self._run_dir)
+                    if self._with_perf:
+                        perf = PerfProfile(p.pid, self._run_dir)
+                        perf.start()
+                    elif self._with_dtrace:
+                        dtrace = DTraceProfile(p.pid, self._run_dir)
+                        dtrace.start()
+                    ptimeout = 0.0
+                    while True:
+                        try:
+                            p.wait(timeout=ptimeout)
+                            break
+                        except subprocess.TimeoutExpired as e:
+                            if end_at and datetime.now() >= end_at:
+                                p.kill()
+                                raise subprocess.TimeoutExpired(cmd=args, timeout=self._timeout) from e
+                            profile.sample()
+                            ptimeout = 0.01
+                    exitcode = p.returncode
+                    profile.finish()
+                    log.info(f'done: exit={exitcode}, profile={profile}')
+                else:
                     p = subprocess.run(args, stderr=cerr, stdout=cout,
                                        cwd=self._run_dir, shell=False,
                                        input=intext.encode() if intext else None,
-                                       timeout=self._timeout)
+                                       timeout=self._timeout,
+                                       env=self._run_env)
                     exitcode = p.returncode
         except subprocess.TimeoutExpired:
-            log.warning(f'Timeout after {self._timeout}s: {args}')
+            now = datetime.now()
+            duration = now - started_at
+            log.warning(f'Timeout at {now} after {duration.total_seconds()}s '
+                        f'(configured {self._timeout}s): {args}')
             exitcode = -1
             exception = 'TimeoutExpired'
-        coutput = open(self._stdoutfile).readlines()
-        cerrput = open(self._stderrfile).readlines()
+        ended_at = datetime.now()
+        if tcpdump:
+            tcpdump.finish()
+        if perf:
+            perf.finish()
+        if dtrace:
+            dtrace.finish()
+        if self._with_flame:
+            self._generate_flame(args, dtrace=dtrace, perf=perf)
+        with open(self._stdoutfile) as fout, open(self._stderrfile) as ferr:
+            coutput = fout.readlines()
+            cerrput = ferr.readlines()
         return ExecResult(args=args, exit_code=exitcode, exception=exception,
                           stdout=coutput, stderr=cerrput,
-                          duration=datetime.now() - start,
-                          with_stats=with_stats)
+                          duration=ended_at - started_at,
+                          with_stats=with_stats,
+                          profile=profile, tcpdump=tcpdump)
 
     def _raw(self, urls, intext='', timeout=None, options=None, insecure=False,
              alpn_proto: Optional[str] = None,
-             force_resolve=True,
+             url_options=None,
              with_stats=False,
              with_headers=True,
-             def_tracing=True):
+             def_tracing=True,
+             with_profile=False,
+             with_tcpdump=False):
         args = self._complete_args(
             urls=urls, timeout=timeout, options=options, insecure=insecure,
-            alpn_proto=alpn_proto, force_resolve=force_resolve,
-            with_headers=with_headers, def_tracing=def_tracing)
-        r = self._run(args, intext=intext, with_stats=with_stats)
+            alpn_proto=alpn_proto, with_headers=with_headers,
+            def_tracing=def_tracing, url_options=url_options)
+        r = self._run(args, intext=intext, with_stats=with_stats,
+                      with_profile=with_profile, with_tcpdump=with_tcpdump)
         if r.exit_code == 0 and with_headers:
             self._parse_headerfile(self._headerfile, r=r)
-            if r.json:
-                r.response["json"] = r.json
         return r
 
     def _complete_args(self, urls, timeout=None, options=None,
-                       insecure=False, force_resolve=True,
-                       alpn_proto: Optional[str] = None,
+                       insecure=False, alpn_proto: Optional[str] = None,
+                       url_options=None,
                        with_headers: bool = True,
                        def_tracing: bool = True):
+        url_sep = []
         if not isinstance(urls, list):
             urls = [urls]
 
-        args = [self._curl, "-s", "--path-as-is"]
+        if options is not None and '--resolve' in options:
+            force_resolve = False
+        else:
+            force_resolve = self._force_resolv
+
+        args = [self._curl, "--disable", "-s", "--path-as-is"]
+        if 'CURL_TEST_EVENT' in os.environ:
+            args.append('--test-event')
+
+        if self._socks_args:
+            args.extend(self._socks_args)
+
         if with_headers:
             args.extend(["-D", self._headerfile])
-        if def_tracing is not False:
-            args.extend(['-v', '--trace-config', 'ids,time'])
+        if def_tracing is not False and not self._silent:
+            args.extend(['-v', '--trace-ids', '--trace-time'])
             if self.env.verbose > 1:
                 args.extend(['--trace-config', 'http/2,http/3,h2-proxy,h1-proxy'])
-                pass
+
+        active_options = options
+        if options is not None and '--next' in options:
+            active_options = options[options.index('--next') + 1:]
 
         for url in urls:
-            u = urlparse(urls[0])
+            args.extend(url_sep)
+            if url_options is not None:
+                url_sep = ['--next']
+
+            u = urlparse(url)
+            if url_options is not None and url in url_options:
+                args.extend(url_options[url])
+            if options:
+                args.extend(options)
             if alpn_proto is not None:
                 if alpn_proto not in self.ALPN_ARG:
                     raise Exception(f'unknown ALPN protocol: "{alpn_proto}"')
@@ -521,7 +1151,8 @@ class CurlClient:
                 pass
             elif insecure:
                 args.append('--insecure')
-            elif options and "--cacert" in options:
+            elif active_options and ("--cacert" in active_options or
+                    "--capath" in active_options):
                 pass
             elif u.hostname:
                 args.extend(["--cacert", self.env.ca.cert_file])
@@ -529,16 +1160,17 @@ class CurlClient:
             if force_resolve and u.hostname and u.hostname != 'localhost' \
                     and not re.match(r'^(\d+|\[|:).*', u.hostname):
                 port = u.port if u.port else 443
-                args.extend(["--resolve", f"{u.hostname}:{port}:127.0.0.1"])
+                args.extend([
+                    '--resolve', f'{u.hostname}:{port}:{self._server_addr}',
+                ])
             if timeout is not None and int(timeout) > 0:
                 args.extend(["--connect-timeout", str(int(timeout))])
-            if options:
-                args.extend(options)
             args.append(url)
         return args
 
-    def _parse_headerfile(self, headerfile: str, r: ExecResult = None) -> ExecResult:
-        lines = open(headerfile).readlines()
+    def _parse_headerfile(self, headerfile: str, r: Optional[ExecResult] = None) -> ExecResult:
+        with open(headerfile) as fd:
+            lines = fd.readlines()
         if r is None:
             r = ExecResult(args=[], exit_code=0, stdout=[], stderr=[])
 
@@ -592,3 +1224,83 @@ class CurlClient:
 
         fin_response(response)
         return r
+
+    def _perf_collapse(self, perf: PerfProfile, file_err):
+        if not os.path.exists(perf.file):
+            raise Exception(f'perf output file does not exist: {perf.file}')
+        fg_collapse = os.path.join(self._fg_dir, 'stackcollapse-perf.pl')
+        if not os.path.exists(fg_collapse):
+            raise Exception(f'FlameGraph script not found: {fg_collapse}')
+        stacks_collapsed = f'{perf.file}.collapsed'
+        log.info(f'collapsing stacks into {stacks_collapsed}')
+        with open(stacks_collapsed, 'w') as cout, open(file_err, 'w') as cerr:
+            p = subprocess.run([
+                fg_collapse, perf.file
+            ], stdout=cout, stderr=cerr, cwd=self._run_dir, shell=False)
+            rc = p.returncode
+            if rc != 0:
+                raise Exception(f'{fg_collapse} returned error {rc}')
+        return stacks_collapsed
+
+    def _dtrace_collapse(self, dtrace: DTraceProfile, file_err):
+        if not os.path.exists(dtrace.file):
+            raise Exception(f'dtrace output file does not exist: {dtrace.file}')
+        fg_collapse = os.path.join(self._fg_dir, 'stackcollapse.pl')
+        if not os.path.exists(fg_collapse):
+            raise Exception(f'FlameGraph script not found: {fg_collapse}')
+        stacks_collapsed = f'{dtrace.file}.collapsed'
+        log.info(f'collapsing stacks into {stacks_collapsed}')
+        with open(stacks_collapsed, 'w') as cout, open(file_err, 'a') as cerr:
+            p = subprocess.run([
+                fg_collapse, dtrace.file
+            ], stdout=cout, stderr=cerr, cwd=self._run_dir, shell=False)
+            rc = p.returncode
+            if rc != 0:
+                raise Exception(f'{fg_collapse} returned error {rc}')
+        return stacks_collapsed
+
+    def _generate_flame(self, curl_args: List[str],
+                        dtrace: Optional[DTraceProfile] = None,
+                        perf: Optional[PerfProfile] = None):
+        fg_gen_flame = os.path.join(self._fg_dir, 'flamegraph.pl')
+        file_svg = os.path.join(self._run_dir, 'curl.flamegraph.svg')
+        if not os.path.exists(fg_gen_flame):
+            raise Exception(f'FlameGraph script not found: {fg_gen_flame}')
+
+        log.info('waiting a sec for perf/dtrace to finish flushing')
+        time.sleep(2)
+        log.info('generating flame graph for this run')
+        file_err = os.path.join(self._run_dir, 'curl.flamegraph.stderr')
+        if perf:
+            stacks_collapsed = self._perf_collapse(perf, file_err)
+        elif dtrace:
+            stacks_collapsed = self._dtrace_collapse(dtrace, file_err)
+        else:
+            raise Exception('no stacks measure given')
+
+        log.info(f'generating graph into {file_svg}')
+        cmdline = ' '.join(curl_args)
+        if len(cmdline) > 80:
+            title = f'{cmdline[:80]}...'
+            subtitle = f'...{cmdline[-80:]}'
+        else:
+            title = cmdline
+            subtitle = ''
+        with open(file_svg, 'w') as cout, open(file_err, 'a') as cerr:
+            p = subprocess.run([
+                fg_gen_flame, '--colors', 'green',
+                '--title', title, '--subtitle', subtitle,
+                stacks_collapsed
+            ], stdout=cout, stderr=cerr, cwd=self._run_dir, shell=False)
+            rc = p.returncode
+            if rc != 0:
+                raise Exception(f'{fg_gen_flame} returned error {rc}')
+
+    def mk_altsvc_file(self, name, src_alpn, src_host, src_port,
+                       dest_alpn, dest_host, dest_port):
+        fpath = os.path.join(self.run_dir, f'{name}.altsvc')
+        ts = datetime.now(timezone.utc) + timedelta(hours=1)
+        ts = ts.strftime('%Y%m%d %H:%M:%S')
+        with open(fpath, 'w') as fd:
+            fd.write(f'{src_alpn} {src_host} {src_port} {dest_alpn} {dest_host} {dest_port} "{ts}" 1 0\n')
+        return fpath
diff --git a/third-party/curl/tests/http/testenv/dante.py b/third-party/curl/tests/http/testenv/dante.py
new file mode 100644
index 0000000000..b2ea4dd0cf
--- /dev/null
+++ b/third-party/curl/tests/http/testenv/dante.py
@@ -0,0 +1,179 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+import logging
+import os
+import socket
+import subprocess
+import time
+from datetime import datetime, timedelta
+from typing import Dict
+
+from . import CurlClient
+from .env import Env
+from .ports import alloc_ports_and_do
+
+log = logging.getLogger(__name__)
+
+
+class Dante:
+
+    def __init__(self, env: Env):
+        self.env = env
+        self._cmd = env.danted
+        self._port = 0
+        self.name = 'danted'
+        self._port_skey = 'danted'
+        self._port_specs = {
+            'danted': socket.SOCK_STREAM,
+        }
+        self._dante_dir = os.path.join(env.gen_dir, self.name)
+        self._run_dir = os.path.join(self._dante_dir, 'run')
+        self._tmp_dir = os.path.join(self._dante_dir, 'tmp')
+        self._conf_file = os.path.join(self._dante_dir, 'test.conf')
+        self._dante_log = os.path.join(self._dante_dir, 'dante.log')
+        self._error_log = os.path.join(self._dante_dir, 'error.log')
+        self._pid_file = os.path.join(self._dante_dir, 'dante.pid')
+        self._error_fd = None
+        self._process = None
+
+        self.clear_logs()
+
+    @property
+    def port(self) -> int:
+        return self._port
+
+    def close_log(self):
+        if self._error_fd:
+            self._error_fd.close()
+            self._error_fd = None
+
+    def clear_logs(self):
+        self._rmf(self._error_log)
+        self._rmf(self._dante_log)
+
+    def exists(self):
+        return os.path.exists(self._cmd)
+
+    def is_running(self):
+        if self._process:
+            self._process.poll()
+            return self._process.returncode is None
+        return False
+
+    def start_if_needed(self):
+        if not self.is_running():
+            return self.start()
+        return True
+
+    def stop(self, wait_dead=True):
+        self._mkpath(self._tmp_dir)
+        if self._process:
+            self._process.terminate()
+            self._process.wait(timeout=2)
+            self._process = None
+        self.close_log()
+        return True
+
+    def restart(self):
+        self.stop()
+        return self.start()
+
+    def initial_start(self):
+
+        def startup(ports: Dict[str, int]) -> bool:
+            self._port = ports[self._port_skey]
+            if self.start():
+                self.env.update_ports(ports)
+                return True
+            self.stop()
+            self._port = 0
+            return False
+
+        return alloc_ports_and_do(self._port_specs, startup,
+                                  self.env.gen_root, max_tries=3)
+
+    def start(self, wait_live=True):
+        assert self._port > 0
+        self._mkpath(self._tmp_dir)
+        if self._process:
+            self.stop()
+        self._write_config()
+        args = [
+            self._cmd,
+            '-f', f'{self._conf_file}',
+            '-p', f'{self._pid_file}',
+            '-d', '0',
+        ]
+        self._error_fd = open(self._error_log, 'a')
+        self._process = subprocess.Popen(args=args, stderr=self._error_fd)
+        if self._process.returncode is not None:
+            return False
+        return self.wait_live(timeout=timedelta(seconds=Env.SERVER_TIMEOUT))
+
+    def wait_live(self, timeout: timedelta):
+        curl = CurlClient(env=self.env, run_dir=self._tmp_dir,
+                          timeout=timeout.total_seconds(), socks_args=[
+            '--socks5', f'127.0.0.1:{self._port}'
+        ])
+        try_until = datetime.now() + timeout
+        while datetime.now() < try_until:
+            r = curl.http_get(url=f'http://{self.env.domain1}:{self.env.http_port}/')
+            if r.exit_code == 0:
+                return True
+            time.sleep(.1)
+        log.error(f"Server still not responding after {timeout}")
+        return False
+
+    def _rmf(self, path):
+        if os.path.exists(path):
+            os.remove(path)
+
+    def _mkpath(self, path):
+        if not os.path.exists(path):
+            os.makedirs(path)
+
+    def _write_config(self):
+        conf = [
+            f'errorlog: {self._error_log}',
+            f'logoutput: {self._dante_log}',
+            f'internal: 127.0.0.1 port = {self._port}',
+            'external: 127.0.0.1',
+            'clientmethod: none',
+            'socksmethod: none',
+            'client pass {',
+            '  from: 127.0.0.0/24 to: 0.0.0.0/0',
+            '  log: error',
+            '}',
+            'socks pass {',
+            '  from: 0.0.0.0/0 to: 0.0.0.0/0',
+            '  command: bindreply connect udpreply',
+            '  log: error',
+            '}',
+            '\n',
+        ]
+        with open(self._conf_file, 'w') as fd:
+            fd.write("\n".join(conf))
diff --git a/third-party/curl/tests/http/testenv/dnsd.py b/third-party/curl/tests/http/testenv/dnsd.py
new file mode 100644
index 0000000000..a7dc088557
--- /dev/null
+++ b/third-party/curl/tests/http/testenv/dnsd.py
@@ -0,0 +1,175 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+import logging
+import os
+import socket
+import subprocess
+import time
+from datetime import datetime, timedelta
+from typing import Dict, List, Optional
+
+from .env import Env
+from .ports import alloc_ports_and_do
+
+log = logging.getLogger(__name__)
+
+
+class Dnsd:
+
+    def __init__(self, env: Env):
+        self.env = env
+        self._cmd = os.path.join(env.build_dir, 'tests/server/servers')
+        self._port = 0
+        self.name = 'dnsd'
+        self._port_skey = 'dnsd'
+        self._port_specs = {
+            'dnsd': socket.SOCK_DGRAM,
+        }
+        self._dnsd_dir = os.path.join(env.gen_dir, self.name)
+        self._log_dir = self._dnsd_dir
+        self._lock_dir = os.path.join(self._dnsd_dir, 'lock')
+        self._log_file = os.path.join(self._log_dir, 'dnsd.log')
+        self._conf_file = os.path.join(self._log_dir, 'dnsd.cmd')
+        self._pid_file = os.path.join(self._log_dir, 'dnsd.pid')
+        self._error_log = os.path.join(self._log_dir, 'dnsd.err.log')
+        self._error_fd = None
+        self._process = None
+
+        self.clear_logs()
+
+    @property
+    def port(self) -> int:
+        return self._port
+
+    def close_log(self):
+        if self._error_fd:
+            self._error_fd.close()
+            self._error_fd = None
+
+    def clear_logs(self):
+        self._rmf(self._log_file)
+        self._rmf(self._error_log)
+
+    def exists(self):
+        return os.path.exists(self._cmd)
+
+    def is_running(self):
+        if self._process:
+            self._process.poll()
+            return self._process.returncode is None
+        return False
+
+    def start_if_needed(self):
+        if not self.is_running():
+            return self.start()
+        return True
+
+    def stop(self, wait_dead=True):
+        if self._process:
+            self._process.terminate()
+            self._process.wait(timeout=2)
+            self._process = None
+        self.close_log()
+        return True
+
+    def restart(self):
+        self.stop()
+        return self.start()
+
+    def initial_start(self):
+        self._mkpath(self._lock_dir)
+
+        def startup(ports: Dict[str, int]) -> bool:
+            self._port = ports[self._port_skey]
+            if self.start():
+                self.env.update_ports(ports)
+                return True
+            self.stop()
+            self._port = 0
+            return False
+
+        return alloc_ports_and_do(self._port_specs, startup,
+                                  self.env.gen_root, max_tries=3)
+
+    def start(self, wait_live=True):
+        assert self._port > 0
+        if self._process:
+            self.stop()
+        self.set_answers()  # empty answers by default
+        self._rmf(self._log_file)
+        args = [
+            self._cmd, 'dnsd',
+            '--port', str(self._port),
+            '--logdir', f'{self._log_dir}',
+            '--logfile', f'{self._log_file}',
+            '--pidfile', f'{self._pid_file}',
+        ]
+        self._error_fd = open(self._error_log, 'a')
+        self._process = subprocess.Popen(args=args, stderr=self._error_fd)
+        if self._process.returncode is not None:
+            return False
+        return self.wait_live(timeout=timedelta(seconds=Env.SERVER_TIMEOUT))
+
+    def wait_live(self, timeout: timedelta):
+        try_until = datetime.now() + timeout
+        while datetime.now() < try_until:
+            if os.path.exists(self._log_file):
+                return True
+            time.sleep(.1)
+        log.error(f"Server still not responding after {timeout}")
+        return False
+
+    def _rmf(self, path):
+        if os.path.exists(path):
+            os.remove(path)
+
+    def _mkpath(self, path):
+        if not os.path.exists(path):
+            os.makedirs(path)
+
+    def set_answers(self, addr_a: Optional[List[str]] = None,
+                    addr_aaaa: Optional[List[str]] = None,
+                    https: Optional[List[str]] = None,
+                    delay_a_ms: int = 0,
+                    delay_aaaa_ms: int = 0,
+                    delay_https_ms: int = 0):
+        conf = []
+        if addr_a:
+            conf.extend([f'A: {addr}' for addr in addr_a])
+        if addr_aaaa:
+            conf.extend([f'AAAA: {addr}' for addr in addr_aaaa])
+        if https:
+            conf.extend([f'HTTPS: {hline}' for hline in https])
+        if delay_a_ms:
+            conf.append(f'Delay-A: {delay_a_ms}')
+        if delay_aaaa_ms:
+            conf.append(f'Delay-AAAA: {delay_aaaa_ms}')
+        if delay_https_ms:
+            conf.append(f'Delay-HTTPS: {delay_https_ms}')
+        conf.append('\n')
+        with open(self._conf_file, 'w') as fd:
+            fd.write("\n".join(conf))
diff --git a/third-party/curl/tests/http/testenv/env.py b/third-party/curl/tests/http/testenv/env.py
index 7c5f7e31a0..4a18d65ffa 100644
--- a/third-party/curl/tests/http/testenv/env.py
+++ b/third-party/curl/tests/http/testenv/env.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 # -*- coding: utf-8 -*-
-#***************************************************************************
+# ***************************************************************************
 #                                  _   _ ____  _
 #  Project                     ___| | | |  _ \| |
 #                             / __| | | | |_) | |
@@ -24,20 +24,21 @@
 #
 ###########################################################################
 #
+import gzip
 import logging
 import os
 import re
-import socket
+import shutil
 import subprocess
-import sys
+import tempfile
 from configparser import ConfigParser, ExtendedInterpolation
-from typing import Optional
+from datetime import timedelta
+from typing import Dict, List, Optional
 
 import pytest
+from filelock import FileLock
 
-from .certs import CertificateSpec, TestCA, Credentials
-from .ports import alloc_ports
-
+from .certs import CertificateSpec, Credentials, TestCA
 
 log = logging.getLogger(__name__)
 
@@ -51,164 +52,366 @@ def init_config_from(conf_path):
 
 
 TESTS_HTTPD_PATH = os.path.dirname(os.path.dirname(__file__))
-DEF_CONFIG = init_config_from(os.path.join(TESTS_HTTPD_PATH, 'config.ini'))
+PROJ_PATH = os.path.dirname(os.path.dirname(TESTS_HTTPD_PATH))
+TOP_PATH = os.path.join(os.getcwd(), os.path.pardir)
+CONFIG_PATH = os.path.join(TOP_PATH, "tests", "http", "config.ini")
+if not os.path.exists(CONFIG_PATH):
+    ALT_CONFIG_PATH = os.path.join(PROJ_PATH, "tests", "http", "config.ini")
+    if not os.path.exists(ALT_CONFIG_PATH):
+        raise Exception(
+            f"unable to find config.ini in {CONFIG_PATH} nor {ALT_CONFIG_PATH}"
+        )
+    TOP_PATH = PROJ_PATH
+    CONFIG_PATH = ALT_CONFIG_PATH
+DEF_CONFIG = init_config_from(CONFIG_PATH)
+CURL = os.path.join(TOP_PATH, "src", "curl")
+CURLINFO = os.path.join(TOP_PATH, "src", "curlinfo")
 
-TOP_PATH = os.path.dirname(os.path.dirname(TESTS_HTTPD_PATH))
-CURL = os.path.join(TOP_PATH, 'src/curl')
+
+class NghttpxUtil:
+    CMD = None
+    VERSION_FULL = None
+
+    @classmethod
+    def version(cls, cmd):
+        if cmd is None:
+            return None
+        if cls.VERSION_FULL is None or cmd != cls.CMD:
+            p = subprocess.run(args=[cmd, "--version"], capture_output=True, text=True)
+            if p.returncode != 0:
+                raise RuntimeError(
+                    f"{cmd} --version failed with exit code: {p.returncode}"
+                )
+            cls.CMD = cmd
+            for line in p.stdout.splitlines(keepends=False):
+                if line.startswith("nghttpx "):
+                    cls.VERSION_FULL = line
+            if cls.VERSION_FULL is None:
+                raise RuntimeError(f"{cmd}: unable to determine version")
+        return cls.VERSION_FULL
+
+    @staticmethod
+    def version_with_h3(version):
+        return re.match(r".* ngtcp2/\d+\.\d+\.\d+.*", version) is not None
 
 
 class EnvConfig:
-
-    def __init__(self):
+    def __init__(
+        self,
+        pytestconfig: Optional[pytest.Config] = None,
+        testrun_uid=None,
+        worker_id=None,
+    ):
+        self.pytestconfig = pytestconfig
+        self.testrun_uid = testrun_uid
+        self.worker_id = worker_id if worker_id is not None else "master"
         self.tests_dir = TESTS_HTTPD_PATH
-        self.gen_dir = os.path.join(self.tests_dir, 'gen')
+        self.gen_root = self.gen_dir = os.path.join(self.tests_dir, "gen")
+        if self.worker_id != "master":
+            self.gen_dir = os.path.join(self.gen_dir, self.worker_id)
         self.project_dir = os.path.dirname(os.path.dirname(self.tests_dir))
+        self.build_dir = TOP_PATH
         self.config = DEF_CONFIG
         # check cur and its features
         self.curl = CURL
-        if 'CURL' in os.environ:
-            self.curl = os.environ['CURL']
+        self.curlinfo = CURLINFO
+        if "CURL" in os.environ:
+            self.curl = os.environ["CURL"]
         self.curl_props = {
-            'version': None,
-            'os': None,
-            'fullname': None,
-            'features': [],
-            'protocols': [],
-            'libs': [],
-            'lib_versions': [],
+            "version_string": "",
+            "version": "",
+            "os": "",
+            "fullname": "",
+            "features_string": "",
+            "features": set(),
+            "protocols_string": "",
+            "protocols": set(),
+            "libs": set(),
+            "lib_versions": set(),
         }
+        self.curl_is_debug = False
         self.curl_protos = []
-        p = subprocess.run(args=[self.curl, '-V'],
-                           capture_output=True, text=True)
+        p = subprocess.run(args=[self.curl, "-V"], capture_output=True, text=True)
         if p.returncode != 0:
-            assert False, f'{self.curl} -V failed with exit code: {p.returncode}'
-        for l in p.stdout.splitlines(keepends=False):
-            if l.startswith('curl '):
-                m = re.match(r'^curl (?P<version>\S+) (?P<os>\S+) (?P<libs>.*)$', l)
+            raise RuntimeError(f"{self.curl} -V failed with exit code: {p.returncode}")
+        if p.stderr.startswith("WARNING:"):
+            self.curl_is_debug = True
+        for line in p.stdout.splitlines(keepends=False):
+            if line.startswith("curl "):
+                self.curl_props["version_string"] = line
+                m = re.match(r"^curl (?P<version>\S+) (?P<os>\S+) (?P<libs>.*)$", line)
                 if m:
-                    self.curl_props['fullname'] = m.group(0)
-                    self.curl_props['version'] = m.group('version')
-                    self.curl_props['os'] = m.group('os')
-                    self.curl_props['lib_versions'] = [
-                        lib.lower() for lib in m.group('libs').split(' ')
-                    ]
-                    self.curl_props['libs'] = [
-                        re.sub(r'/.*', '', lib) for lib in self.curl_props['lib_versions']
-                    ]
-            if l.startswith('Features: '):
-                self.curl_props['features'] = [
-                    feat.lower() for feat in l[10:].split(' ')
-                ]
-            if l.startswith('Protocols: '):
-                self.curl_props['protocols'] = [
-                    prot.lower() for prot in l[11:].split(' ')
-                ]
+                    self.curl_props["fullname"] = m.group(0)
+                    self.curl_props["version"] = m.group("version")
+                    self.curl_props["os"] = m.group("os")
+                    self.curl_props["lib_versions"] = {
+                        lib.lower() for lib in m.group("libs").split(" ")
+                    }
+                    self.curl_props["libs"] = {
+                        re.sub(r"/[a-z0-9.-]*", "", lib)
+                        for lib in self.curl_props["lib_versions"]
+                    }
+            if line.startswith("Features: "):
+                self.curl_props["features_string"] = line[10:]
+                self.curl_props["features"] = {
+                    feat.lower() for feat in line[10:].split(" ")
+                }
+            if line.startswith("Protocols: "):
+                self.curl_props["protocols_string"] = line[11:]
+                self.curl_props["protocols"] = {
+                    prot.lower() for prot in line[11:].split(" ")
+                }
 
-        self.ports = alloc_ports(port_specs={
-            'http': socket.SOCK_STREAM,
-            'https': socket.SOCK_STREAM,
-            'proxy': socket.SOCK_STREAM,
-            'proxys': socket.SOCK_STREAM,
-            'h2proxys': socket.SOCK_STREAM,
-            'caddy': socket.SOCK_STREAM,
-            'caddys': socket.SOCK_STREAM,
-            'ws': socket.SOCK_STREAM,
-        })
-        self.httpd = self.config['httpd']['httpd']
-        self.apachectl = self.config['httpd']['apachectl']
-        self.apxs = self.config['httpd']['apxs']
+        p = subprocess.run(args=[self.curlinfo], capture_output=True, text=True)
+        if p.returncode != 0:
+            raise RuntimeError(f"{self.curlinfo} failed with exit code: {p.returncode}")
+        self.curl_is_verbose = 'verbose-strings: ON' in p.stdout
+        self.curl_can_cert_status = 'cert-status: ON' in p.stdout
+        self.curl_override_dns = 'override-dns: ON' in p.stdout
+        self.curl_resolv_threaded = 'resolv-threaded: ON' in p.stdout
+
+        self.ports = {}
+
+        self.httpd = self.config["httpd"]["httpd"]
+        self.apxs = self.config["httpd"]["apxs"]
         if len(self.apxs) == 0:
             self.apxs = None
         self._httpd_version = None
 
         self.examples_pem = {
-            'key': 'xxx',
-            'cert': 'xxx',
+            "key": "xxx",
+            "cert": "xxx",
         }
-        self.htdocs_dir = os.path.join(self.gen_dir, 'htdocs')
-        self.tld = 'http.curl.se'
+        self.htdocs_dir = os.path.join(self.gen_dir, "htdocs")
+        self.tld = "http.curl.se"
         self.domain1 = f"one.{self.tld}"
+        self.domain1brotli = f"brotli.one.{self.tld}"
         self.domain2 = f"two.{self.tld}"
+        self.ftp_domain = f"ftp.{self.tld}"
         self.proxy_domain = f"proxy.{self.tld}"
+        self.expired_domain = f"expired.{self.tld}"
         self.cert_specs = [
-            CertificateSpec(domains=[self.domain1, 'localhost'], key_type='rsa2048'),
-            CertificateSpec(domains=[self.domain2], key_type='rsa2048'),
-            CertificateSpec(domains=[self.proxy_domain], key_type='rsa2048'),
-            CertificateSpec(name="clientsX", sub_specs=[
-               CertificateSpec(name="user1", client=True),
-            ]),
+            CertificateSpec(
+                domains=[self.domain1, self.domain1brotli, "localhost", "127.0.0.1"],
+                key_type="rsa2048",
+            ),
+            CertificateSpec(
+                name="domain1-no-ip",
+                domains=[self.domain1, self.domain1brotli],
+                key_type="rsa2048",
+            ),
+            CertificateSpec(
+                name="domain1-very-bad",
+                domains=[self.domain1, "dns:127.0.0.1"],
+                key_type="rsa2048",
+            ),
+            CertificateSpec(domains=[self.domain2], key_type="rsa2048"),
+            CertificateSpec(domains=[self.ftp_domain], key_type="rsa2048"),
+            CertificateSpec(
+                domains=[self.proxy_domain, "127.0.0.1"], key_type="rsa2048"
+            ),
+            CertificateSpec(
+                domains=[self.expired_domain],
+                key_type="rsa2048",
+                valid_from=timedelta(days=-100),
+                valid_to=timedelta(days=-10),
+            ),
+            CertificateSpec(
+                name="clientsX",
+                sub_specs=[
+                    CertificateSpec(name="user1", client=True),
+                ],
+            ),
         ]
 
-        self.nghttpx = self.config['nghttpx']['nghttpx']
+        self.openssl = "openssl"
+        p = subprocess.run(
+            args=[self.openssl, "version"], capture_output=True, text=True
+        )
+        if p.returncode != 0:
+            # no openssl in path
+            self.openssl = None
+            self.openssl_version = None
+        else:
+            self.openssl_version = p.stdout.strip()
+
+        self.nghttpx = self.config["nghttpx"]["nghttpx"]
         if len(self.nghttpx.strip()) == 0:
             self.nghttpx = None
         self._nghttpx_version = None
         self.nghttpx_with_h3 = False
         if self.nghttpx is not None:
-            p = subprocess.run(args=[self.nghttpx, '-v'],
-                               capture_output=True, text=True)
-            if p.returncode != 0:
-                # not a working nghttpx
-                self.nghttpx = None
-            else:
-                self._nghttpx_version = re.sub(r'^nghttpx\s*', '', p.stdout.strip())
-                self.nghttpx_with_h3 = re.match(r'.* nghttp3/.*', p.stdout.strip()) is not None
-                log.debug(f'nghttpx -v: {p.stdout}')
+            self._nghttpx_version = NghttpxUtil.version(self.nghttpx)
+            self.nghttpx_with_h3 = NghttpxUtil.version_with_h3(self._nghttpx_version)
 
-        self.caddy = self.config['caddy']['caddy']
+        self.caddy = self.config["caddy"]["caddy"]
         self._caddy_version = None
         if len(self.caddy.strip()) == 0:
             self.caddy = None
-        if self.caddy is not None:
+
+        self.h2o = self.config["h2o"]["h2o"]
+        if len(self.h2o.strip()) == 0:
+            self.h2o = None
+        self._h2o_version = None
+        if self.h2o is not None:
             try:
-                p = subprocess.run(args=[self.caddy, 'version'],
-                                   capture_output=True, text=True)
+                p = subprocess.run(
+                    args=[self.h2o, "--version"], capture_output=True, text=True
+                )
                 if p.returncode != 0:
-                    # not a working caddy
-                    self.caddy = None
-                self._caddy_version = re.sub(r' .*', '', p.stdout.strip())
-            except:
+                    # not a working h2o
+                    self.h2o = None
+                else:
+                    # h2o --version output format: "h2o version 2.3.0"
+                    m = re.search(r"h2o version (\S+)", p.stdout)
+                    if m:
+                        self._h2o_version = m.group(1)
+                    else:
+                        self.h2o = None
+            except Exception:
+                log.exception("checking h2o version")
+                self.h2o = None
+
+        if self.caddy is not None:
+            p = subprocess.run(
+                args=[self.caddy, "version"], capture_output=True, text=True
+            )
+            if p.returncode != 0:
+                # not a working caddy
                 self.caddy = None
+            m = re.match(r"v?(\d+\.\d+\.\d+).*", p.stdout)
+            if m:
+                self._caddy_version = m.group(1)
+            else:
+                raise RuntimeError(
+                    f"Unable to determine caddy version from: {p.stdout}"
+                )
+
+        self.vsftpd = self.config["vsftpd"]["vsftpd"]
+        if self.vsftpd == "":
+            self.vsftpd = None
+        self._vsftpd_version = None
+        if self.vsftpd is not None:
+            with tempfile.TemporaryFile("w+") as tmp:
+                p = subprocess.run(
+                    args=[self.vsftpd, "-v"], capture_output=True, text=True, stdin=tmp
+                )
+                if p.returncode != 0:
+                    # not a working vsftpd
+                    self.vsftpd = None
+                if p.stderr:
+                    ver_text = p.stderr
+                else:
+                    # Oddly, some versions of vsftpd write to stdin (!)
+                    # instead of stderr, which is odd but works. If there
+                    # is nothing on stderr, read the file on stdin and use
+                    # any data there instead.
+                    tmp.seek(0)
+                    ver_text = tmp.read()
+            m = re.match(r"vsftpd: version (\d+\.\d+\.\d+)", ver_text)
+            if m:
+                self._vsftpd_version = m.group(1)
+            elif len(p.stderr) == 0:
+                # vsftp does not use stdout or stderr for printing its version... -.-
+                self._vsftpd_version = "unknown"
+            else:
+                raise Exception(f"Unable to determine VsFTPD version from: {p.stderr}")
+
+        self.danted = self.config["danted"]["danted"]
+        if self.danted == "":
+            self.danted = None
+        self._danted_version = None
+        if self.danted is not None:
+            p = subprocess.run(args=[self.danted, "-v"], capture_output=True, text=True)
+            assert p.returncode == 0
+            if p.returncode != 0:
+                # not a working vsftpd
+                self.danted = None
+            m = re.match(r"^Dante v(\d+\.\d+\.\d+).*", p.stdout)
+            if not m:
+                m = re.match(r"^Dante v(\d+\.\d+\.\d+).*", p.stderr)
+            if m:
+                self._danted_version = m.group(1)
+            else:
+                self.danted = None
+                raise Exception(f"Unable to determine danted version from: {p.stderr}")
+
+        self.sshd = self.config["sshd"]["sshd"]
+        if self.sshd == "":
+            self.sshd = None
+        self._sshd_version = None
+        if self.sshd is not None:
+            p = subprocess.run(args=[self.sshd, "-V"], capture_output=True, text=True)
+            assert p.returncode == 0
+            if p.returncode != 0:
+                self.sshd = None
+            else:
+                m = re.match(r"^OpenSSH_(\d+\.\d+.*),.*", p.stderr)
+                assert m, f"version: {p.stderr}"
+                if m:
+                    self._sshd_version = m.group(1)
+                else:
+                    self.sshd = None
+                    raise Exception(
+                        f"Unable to determine sshd version from: {p.stderr}"
+                    )
+
+        if self.sshd:
+            self.sftpd = self.config["sshd"]["sftpd"]
+            if self.sftpd == "":
+                self.sftpd = None
+        else:
+            self.sftpd = None
+
+        self._tcpdump = shutil.which("tcpdump")
 
     @property
     def httpd_version(self):
         if self._httpd_version is None and self.apxs is not None:
             try:
-                p = subprocess.run(args=[self.apxs, '-q', 'HTTPD_VERSION'],
-                                   capture_output=True, text=True)
+                p = subprocess.run(
+                    args=[self.apxs, "-q", "HTTPD_VERSION"],
+                    capture_output=True,
+                    text=True,
+                )
                 if p.returncode != 0:
-                    log.error(f'{self.apxs} failed to query HTTPD_VERSION: {p}')
+                    log.error(f"{self.apxs} failed to query HTTPD_VERSION: {p}")
                 else:
                     self._httpd_version = p.stdout.strip()
-            except Exception as e:
-                log.error(f'{self.apxs} failed to run: {e}')
+            except Exception:
+                log.exception(f"{self.apxs} failed to run")
         return self._httpd_version
 
-    def _versiontuple(self, v):
-        v = re.sub(r'(\d+\.\d+(\.\d+)?)(-\S+)?', r'\1', v)
-        return tuple(map(int, v.split('.')))
+    def versiontuple(self, v):
+        v = re.sub(r"(\d+\.\d+(\.\d+)?)(-\S+)?", r"\1", v)
+        return tuple(map(int, v.split(".")))
 
     def httpd_is_at_least(self, minv):
         if self.httpd_version is None:
             return False
-        hv = self._versiontuple(self.httpd_version)
-        return hv >= self._versiontuple(minv)
+        hv = self.versiontuple(self.httpd_version)
+        return hv >= self.versiontuple(minv)
+
+    def caddy_is_at_least(self, minv):
+        if self.caddy_version is None:
+            return False
+        hv = self.versiontuple(self.caddy_version)
+        return hv >= self.versiontuple(minv)
 
     def is_complete(self) -> bool:
-        return os.path.isfile(self.httpd) and \
-               os.path.isfile(self.apachectl) and \
-               self.apxs is not None and \
-               os.path.isfile(self.apxs)
+        return (
+            os.path.isfile(self.httpd)
+            and self.apxs is not None
+            and os.path.isfile(self.apxs)
+        )
 
     def get_incomplete_reason(self) -> Optional[str]:
         if self.httpd is None or len(self.httpd.strip()) == 0:
-            return f'httpd not configured, see `--with-test-httpd=<path>`'
+            return "httpd not configured, see `--with-test-httpd=<path>`"
         if not os.path.isfile(self.httpd):
-            return f'httpd ({self.httpd}) not found'
-        if not os.path.isfile(self.apachectl):
-            return f'apachectl ({self.apachectl}) not found'
+            return f"httpd ({self.httpd}) not found"
         if self.apxs is None:
-            return f"command apxs not found (commonly provided in apache2-dev)"
+            return "command apxs not found (commonly provided in apache2-dev)"
         if not os.path.isfile(self.apxs):
             return f"apxs ({self.apxs}) not found"
         return None
@@ -221,8 +424,26 @@ class EnvConfig:
     def caddy_version(self):
         return self._caddy_version
 
+    @property
+    def vsftpd_version(self):
+        return self._vsftpd_version
+
+    @property
+    def h2o_version(self):
+        return self._h2o_version
+
+    @property
+    def tcpdump(self) -> Optional[str]:
+        return self._tcpdump
+
+    def clear_locks(self):
+        ca_lock = os.path.join(self.gen_root, "ca/ca.lock")
+        if os.path.exists(ca_lock):
+            os.remove(ca_lock)
+
 
 class Env:
+    SERVER_TIMEOUT = 30  # seconds to wait for server to come up/reload
 
     CONFIG = EnvConfig()
 
@@ -234,6 +455,10 @@ class Env:
     def incomplete_reason() -> Optional[str]:
         return Env.CONFIG.get_incomplete_reason()
 
+    @staticmethod
+    def have_openssl() -> bool:
+        return Env.CONFIG.openssl is not None
+
     @staticmethod
     def have_nghttpx() -> bool:
         return Env.CONFIG.nghttpx is not None
@@ -242,49 +467,161 @@ class Env:
     def have_h3_server() -> bool:
         return Env.CONFIG.nghttpx_with_h3
 
+    @staticmethod
+    def have_h2o() -> bool:
+        return Env.CONFIG.h2o is not None
+
     @staticmethod
     def have_ssl_curl() -> bool:
-        return 'ssl' in Env.CONFIG.curl_props['features']
+        return Env.curl_has_feature("ssl") or Env.curl_has_feature("multissl")
 
     @staticmethod
     def have_h2_curl() -> bool:
-        return 'http2' in Env.CONFIG.curl_props['features']
+        return "http2" in Env.CONFIG.curl_props["features"]
 
     @staticmethod
     def have_h3_curl() -> bool:
-        return 'http3' in Env.CONFIG.curl_props['features']
+        return "http3" in Env.CONFIG.curl_props["features"]
+
+    @staticmethod
+    def have_compressed_curl() -> bool:
+        return (
+            "brotli" in Env.CONFIG.curl_props["libs"]
+            or "zlib" in Env.CONFIG.curl_props["libs"]
+            or "zstd" in Env.CONFIG.curl_props["libs"]
+        )
 
     @staticmethod
     def curl_uses_lib(libname: str) -> bool:
-        return libname.lower() in Env.CONFIG.curl_props['libs']
+        return libname.lower() in Env.CONFIG.curl_props["libs"]
+
+    @staticmethod
+    def curl_uses_any_libs(libs: List[str]) -> bool:
+        for libname in libs:
+            if libname.lower() in Env.CONFIG.curl_props["libs"]:
+                return True
+        return False
+
+    @staticmethod
+    def curl_uses_ossl_quic() -> bool:
+        if Env.have_h3_curl():
+            return not Env.curl_uses_lib("ngtcp2") and Env.curl_uses_lib("nghttp3")
+        return False
+
+    @staticmethod
+    def curl_version_string() -> str:
+        return Env.CONFIG.curl_props["version_string"]
+
+    @staticmethod
+    def curl_features_string() -> str:
+        return Env.CONFIG.curl_props["features_string"]
 
     @staticmethod
     def curl_has_feature(feature: str) -> bool:
-        return feature.lower() in Env.CONFIG.curl_props['features']
+        return feature.lower() in Env.CONFIG.curl_props["features"]
+
+    @staticmethod
+    def curl_protocols_string() -> str:
+        return Env.CONFIG.curl_props["protocols_string"]
 
     @staticmethod
     def curl_has_protocol(protocol: str) -> bool:
-        return protocol.lower() in Env.CONFIG.curl_props['protocols']
+        return protocol.lower() in Env.CONFIG.curl_props["protocols"]
 
     @staticmethod
     def curl_lib_version(libname: str) -> str:
-        prefix = f'{libname.lower()}/'
-        for lversion in Env.CONFIG.curl_props['lib_versions']:
+        prefix = f"{libname.lower()}/"
+        for lversion in Env.CONFIG.curl_props["lib_versions"]:
             if lversion.startswith(prefix):
-                return lversion[len(prefix):]
-        return 'unknown'
+                return lversion[len(prefix) :]
+        return "unknown"
+
+    @staticmethod
+    def curl_lib_version_at_least(libname: str, min_version) -> bool:
+        lversion = Env.curl_lib_version(libname)
+        if lversion != "unknown":
+            return Env.CONFIG.versiontuple(min_version) <= Env.CONFIG.versiontuple(
+                lversion
+            )
+        return False
+
+    @staticmethod
+    def curl_lib_version_before(libname: str, lib_version) -> bool:
+        lversion = Env.curl_lib_version(libname)
+        if lversion != "unknown":
+            if m := re.match(r"(\d+\.\d+\.\d+).*", lversion):
+                lversion = m.group(1)
+            return Env.CONFIG.versiontuple(lib_version) > Env.CONFIG.versiontuple(
+                lversion
+            )
+        return False
 
     @staticmethod
     def curl_os() -> str:
-        return Env.CONFIG.curl_props['os']
+        return Env.CONFIG.curl_props["os"]
 
     @staticmethod
     def curl_fullname() -> str:
-        return Env.CONFIG.curl_props['fullname']
+        return Env.CONFIG.curl_props["fullname"]
 
     @staticmethod
     def curl_version() -> str:
-        return Env.CONFIG.curl_props['version']
+        return Env.CONFIG.curl_props["version"]
+
+    @staticmethod
+    def curl_is_debug() -> bool:
+        return Env.CONFIG.curl_is_debug
+
+    @staticmethod
+    def curl_is_verbose() -> bool:
+        return Env.CONFIG.curl_is_verbose
+
+    @staticmethod
+    def curl_can_cert_status() -> bool:
+        return Env.CONFIG.curl_can_cert_status
+
+    @staticmethod
+    def curl_override_dns() -> bool:
+        return Env.CONFIG.curl_override_dns
+
+    @staticmethod
+    def curl_resolv_threaded() -> bool:
+        return Env.CONFIG.curl_resolv_threaded
+
+    @staticmethod
+    def curl_can_early_data() -> bool:
+        if Env.curl_uses_lib('gnutls'):
+            return Env.curl_lib_version_at_least('gnutls', '3.7.2')
+        return Env.curl_uses_any_libs(['wolfssl', 'quictls', 'openssl'])
+
+    @staticmethod
+    def curl_can_h3_early_data() -> bool:
+        return Env.curl_can_early_data() and Env.curl_uses_lib("ngtcp2")
+
+    @staticmethod
+    def http_protos() -> List[str]:
+        # http protocols we can test
+        if Env.have_h2_curl():
+            if Env.have_h3():
+                return ["http/1.1", "h2", "h3"]
+            return ["http/1.1", "h2"]
+        return ["http/1.1"]
+
+    @staticmethod
+    def http_h1_h2_protos() -> List[str]:
+        # http 1+2 protocols we can test
+        if Env.have_h2_curl():
+            return ["http/1.1", "h2"]
+        return ["http/1.1"]
+
+    @staticmethod
+    def http_mplx_protos() -> List[str]:
+        # http multiplexing protocols we can test
+        if Env.have_h2_curl():
+            if Env.have_h3():
+                return ["h2", "h3"]
+            return ["h2"]
+        return []
 
     @staticmethod
     def have_h3() -> bool:
@@ -302,6 +639,14 @@ class Env:
     def caddy_version() -> str:
         return Env.CONFIG.caddy_version
 
+    @staticmethod
+    def h2o_version() -> str:
+        return Env.CONFIG.h2o_version
+
+    @staticmethod
+    def caddy_is_at_least(minv) -> bool:
+        return Env.CONFIG.caddy_is_at_least(minv)
+
     @staticmethod
     def httpd_is_at_least(minv) -> bool:
         return Env.CONFIG.httpd_is_at_least(minv)
@@ -310,19 +655,50 @@ class Env:
     def has_caddy() -> bool:
         return Env.CONFIG.caddy is not None
 
-    def __init__(self, pytestconfig=None):
-        self._verbose = pytestconfig.option.verbose \
-            if pytestconfig is not None else 0
+    @staticmethod
+    def has_vsftpd() -> bool:
+        return Env.CONFIG.vsftpd is not None
+
+    @staticmethod
+    def vsftpd_version() -> str:
+        return Env.CONFIG.vsftpd_version
+
+    @staticmethod
+    def has_danted() -> bool:
+        return Env.CONFIG.danted is not None
+
+    @staticmethod
+    def has_sshd() -> bool:
+        return Env.CONFIG.sshd is not None
+
+    @staticmethod
+    def has_sftpd() -> bool:
+        return Env.has_sshd() and Env.CONFIG.sftpd is not None
+
+    @staticmethod
+    def tcpdump() -> Optional[str]:
+        return Env.CONFIG.tcpdump
+
+    def __init__(self, pytestconfig=None, env_config=None):
+        if env_config:
+            Env.CONFIG = env_config
+        self._verbose = pytestconfig.option.verbose if pytestconfig is not None else 0
         self._ca = None
         self._test_timeout = 300.0 if self._verbose > 1 else 60.0  # seconds
 
     def issue_certs(self):
         if self._ca is None:
-            ca_dir = os.path.join(self.CONFIG.gen_dir, 'ca')
-            self._ca = TestCA.create_root(name=self.CONFIG.tld,
-                                          store_dir=ca_dir,
-                                          key_type="rsa2048")
-        self._ca.issue_certs(self.CONFIG.cert_specs)
+            # ca_dir = os.path.join(self.CONFIG.gen_root, 'ca')
+            ca_dir = os.path.join(self.gen_dir, "ca")
+            os.makedirs(ca_dir, exist_ok=True)
+            lock_file = os.path.join(ca_dir, "ca.lock")
+            with FileLock(lock_file):
+                self._ca = TestCA.create_root(
+                    name=self.CONFIG.tld, store_dir=ca_dir, key_type="rsa2048"
+                )
+                self._ca.issue_certs(self.CONFIG.cert_specs)
+                if self.have_openssl():
+                    self._ca.create_hashdir(self.openssl)
 
     def setup(self):
         os.makedirs(self.gen_dir, exist_ok=True)
@@ -351,10 +727,18 @@ class Env:
     def gen_dir(self) -> str:
         return self.CONFIG.gen_dir
 
+    @property
+    def gen_root(self) -> str:
+        return self.CONFIG.gen_root
+
     @property
     def project_dir(self) -> str:
         return self.CONFIG.project_dir
 
+    @property
+    def build_dir(self) -> str:
+        return self.CONFIG.build_dir
+
     @property
     def ca(self):
         return self._ca
@@ -363,25 +747,56 @@ class Env:
     def htdocs_dir(self) -> str:
         return self.CONFIG.htdocs_dir
 
+    @property
+    def tld(self) -> str:
+        return self.CONFIG.tld
+
     @property
     def domain1(self) -> str:
         return self.CONFIG.domain1
 
+    @property
+    def domain1brotli(self) -> str:
+        return self.CONFIG.domain1brotli
+
     @property
     def domain2(self) -> str:
         return self.CONFIG.domain2
 
+    @property
+    def ftp_domain(self) -> str:
+        return self.CONFIG.ftp_domain
+
     @property
     def proxy_domain(self) -> str:
         return self.CONFIG.proxy_domain
 
+    @property
+    def expired_domain(self) -> str:
+        return self.CONFIG.expired_domain
+
+    @property
+    def ports(self) -> Dict[str, int]:
+        return self.CONFIG.ports
+
+    def update_ports(self, ports: Dict[str, int]):
+        self.CONFIG.ports.update(ports)
+
     @property
     def http_port(self) -> int:
-        return self.CONFIG.ports['http']
+        return self.CONFIG.ports.get("http", 0)
 
     @property
     def https_port(self) -> int:
-        return self.CONFIG.ports['https']
+        return self.CONFIG.ports["https"]
+
+    @property
+    def https_only_tcp_port(self) -> int:
+        return self.CONFIG.ports["https-tcp-only"]
+
+    @property
+    def nghttpx_https_port(self) -> int:
+        return self.CONFIG.ports["nghttpx_https"]
 
     @property
     def h3_port(self) -> int:
@@ -389,19 +804,36 @@ class Env:
 
     @property
     def proxy_port(self) -> int:
-        return self.CONFIG.ports['proxy']
+        return self.CONFIG.ports["proxy"]
 
     @property
     def proxys_port(self) -> int:
-        return self.CONFIG.ports['proxys']
+        return self.CONFIG.ports["proxys"]
+
+    @property
+    def ftp_port(self) -> int:
+        return self.CONFIG.ports["ftp"]
+
+    @property
+    def ftps_port(self) -> int:
+        return self.CONFIG.ports["ftps"]
 
     @property
     def h2proxys_port(self) -> int:
-        return self.CONFIG.ports['h2proxys']
+        return self.CONFIG.ports["h2proxys"]
 
-    def pts_port(self, proto: str = 'http/1.1') -> int:
+    @property
+    def h3proxys_port(self) -> int:
+        return self.CONFIG.ports["h2o_h3proxys"]
+
+    def pts_port(self, proto: str = "http/1.1", use_h2o: bool = False) -> int:
         # proxy tunnel port
-        return self.CONFIG.ports['h2proxys' if proto == 'h2' else 'proxys']
+        prefix = 'h2o_' if use_h2o else ''
+        if proto == "h3":
+            return self.CONFIG.ports.get("h2o_h3proxys", 0)
+        if proto == "h2":
+            return self.CONFIG.ports.get(f"{prefix}h2proxys", 0)
+        return self.CONFIG.ports[f"{prefix}proxys"]
 
     @property
     def caddy(self) -> str:
@@ -409,27 +841,35 @@ class Env:
 
     @property
     def caddy_https_port(self) -> int:
-        return self.CONFIG.ports['caddys']
+        return self.CONFIG.ports["caddys"]
 
     @property
     def caddy_http_port(self) -> int:
-        return self.CONFIG.ports['caddy']
+        return self.CONFIG.ports["caddy"]
+
+    @property
+    def danted(self) -> str:
+        return self.CONFIG.danted
+
+    @property
+    def vsftpd(self) -> str:
+        return self.CONFIG.vsftpd
 
     @property
     def ws_port(self) -> int:
-        return self.CONFIG.ports['ws']
+        return self.CONFIG.ports["ws"]
 
     @property
     def curl(self) -> str:
         return self.CONFIG.curl
 
     @property
-    def httpd(self) -> str:
-        return self.CONFIG.httpd
+    def openssl(self) -> Optional[str]:
+        return self.CONFIG.openssl
 
     @property
-    def apachectl(self) -> str:
-        return self.CONFIG.apachectl
+    def httpd(self) -> str:
+        return self.CONFIG.httpd
 
     @property
     def apxs(self) -> str:
@@ -441,40 +881,66 @@ class Env:
 
     @property
     def slow_network(self) -> bool:
-        return "CURL_DBG_SOCK_WBLOCK" in os.environ or \
-               "CURL_DBG_SOCK_WPARTIAL" in os.environ
+        return (
+            "CURL_DBG_SOCK_WBLOCK" in os.environ
+            or "CURL_DBG_SOCK_WPARTIAL" in os.environ
+        )
 
     @property
     def ci_run(self) -> bool:
         return "CURL_CI" in os.environ
 
-    def authority_for(self, domain: str, alpn_proto: Optional[str] = None):
-        if alpn_proto is None or \
-                alpn_proto in ['h2', 'http/1.1', 'http/1.0', 'http/0.9']:
-            return f'{domain}:{self.https_port}'
-        if alpn_proto in ['h3']:
-            return f'{domain}:{self.h3_port}'
-        return f'{domain}:{self.http_port}'
+    def port_for(self, alpn_proto: Optional[str] = None):
+        if alpn_proto is None or alpn_proto in [
+            "h2",
+            "http/1.1",
+            "http/1.0",
+            "http/0.9",
+        ]:
+            return self.https_port
+        if alpn_proto in ["h3"]:
+            return self.h3_port
+        return self.http_port
 
-    def make_data_file(self, indir: str, fname: str, fsize: int) -> str:
+    def authority_for(self, domain: str, alpn_proto: Optional[str] = None):
+        return f"{domain}:{self.port_for(alpn_proto=alpn_proto)}"
+
+    def make_data_file(
+        self, indir: str, fname: str, fsize: int, line_length: int = 1024
+    ) -> str:
+        if line_length < 11:
+            raise RuntimeError("line_length less than 11 not supported")
+        os.makedirs(indir, exist_ok=True)
         fpath = os.path.join(indir, fname)
         s10 = "0123456789"
-        s = (101 * s10) + s10[0:3]
-        with open(fpath, 'w') as fd:
-            for i in range(int(fsize / 1024)):
+        s = round((line_length / 10) + 1) * s10
+        s = s[0 : line_length - 11]
+        with open(fpath, "w") as fd:
+            for i in range(int(fsize / line_length)):
                 fd.write(f"{i:09d}-{s}\n")
-            remain = int(fsize % 1024)
+            remain = int(fsize % line_length)
             if remain != 0:
-                i = int(fsize / 1024) + 1
-                s = f"{i:09d}-{s}\n"
-                fd.write(s[0:remain])
+                i = int(fsize / line_length) + 1
+                fd.write(f"{i:09d}-{s}"[0 : remain - 1] + "\n")
         return fpath
 
-    def make_clients(self):
-        client_dir = os.path.join(self.project_dir, 'tests/http/clients')
-        p = subprocess.run(['make'], capture_output=True, text=True,
-                           cwd=client_dir)
-        if p.returncode != 0:
-            pytest.exit(f"`make`in {client_dir} failed:\n{p.stderr}")
-            return False
-        return True
+    def make_data_gzipbomb(self, indir: str, fname: str, fsize: int) -> str:
+        fpath = os.path.join(indir, fname)
+        gzpath = f"{fpath}.gz"
+        varpath = f"{fpath}.var"
+
+        with open(fpath, "w") as fd:
+            fd.write("not what we are looking for!\n")
+        count = int(fsize / 1024)
+        zero1k = bytearray(1024)
+        with gzip.open(gzpath, "wb") as fd:
+            for _ in range(count):
+                fd.write(zero1k)
+        with open(varpath, "w") as fd:
+            fd.write(f"URI: {fname}\n")
+            fd.write("\n")
+            fd.write(f"URI: {fname}.gz\n")
+            fd.write("Content-Type: text/plain\n")
+            fd.write("Content-Encoding: x-gzip\n")
+            fd.write("\n")
+        return fpath
diff --git a/third-party/curl/tests/http/testenv/h2o.py b/third-party/curl/tests/http/testenv/h2o.py
new file mode 100644
index 0000000000..deb3608d3a
--- /dev/null
+++ b/third-party/curl/tests/http/testenv/h2o.py
@@ -0,0 +1,448 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+# ***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+import logging
+import os
+import signal
+import socket
+import subprocess
+import time
+from datetime import datetime, timedelta
+from typing import Dict, Optional
+
+from .curl import CurlClient
+from .env import Env
+from .ports import alloc_ports_and_do
+
+log = logging.getLogger(__name__)
+
+
+class H2o:
+    def __init__(self, env: Env, name: str, domain: str, cred_name: str):
+        self.env = env
+        self._name = name
+        self._domain = domain
+        self._port = 0  # defaults to h3_port
+        self._cred_name = cred_name
+        self._loaded_cred_name = None
+        self._error_fd = None
+        self._process = None
+        self._tmp_dir = os.path.join(self.env.gen_dir, self._name)
+        self._run_dir = os.path.join(self._tmp_dir, "run")
+        self._conf_file = os.path.join(self._run_dir, "h2o.conf")
+        self._error_log = os.path.join(self._run_dir, "h2o.log")
+        self._pid_file = os.path.join(self._run_dir, "h2o.pid")
+        self._stderr = os.path.join(self._run_dir, "h2o.stderr")
+        self._cmd = env.CONFIG.h2o
+        # For proxy subclasses
+        self._h1_port = None
+        self._h2_port = None
+
+    @property
+    def port(self) -> int:
+        return self._port
+
+    @property
+    def h1_port(self) -> Optional[int]:
+        return getattr(self, "_h1_port", None)
+
+    @property
+    def h2_port(self) -> Optional[int]:
+        return getattr(self, "_h2_port", None)
+
+    def close_log(self):
+        if self._error_fd:
+            self._error_fd.close()
+            self._error_fd = None
+
+    def clear_logs(self):
+        self._rmf(self._error_log)
+        self._rmf(self._stderr)
+
+    def dump_logs(self):
+        lines = []
+        lines.append(f"stderr of {self._name}")
+        lines.append("-------------------------------------------")
+        self._dump_file(self._stderr, lines)
+        lines.append("")
+        lines.append(f"errorlog of {self._name}")
+        lines.append("-------------------------------------------")
+        self._dump_file(self._error_log, lines)
+        lines.append("")
+        return lines
+
+    def _rmf(self, path):
+        if os.path.isfile(path):
+            os.remove(path)
+        return
+
+    def _dump_file(self, path, lines):
+        if os.path.isfile(path):
+            with open(path) as fd:
+                for line in fd:
+                    lines.append(line.rstrip())
+
+    def _mkpath(self, path):
+        if not os.path.exists(path):
+            os.makedirs(path)
+        return
+
+    def _log(self, level, msg):
+        getattr(log, level)(f"[{self._name}] {msg}")
+
+    def is_running(self):
+        if self._process:
+            self._process.poll()
+            return self._process.returncode is None
+        return False
+
+    def initial_start(self):
+        self._rmf(self._pid_file)
+        self._rmf(self._error_log)
+        self._mkpath(self._run_dir)
+        self.write_config()
+
+    def start(self, wait_live=True):
+        self._mkpath(self._tmp_dir)
+        self._mkpath(self._run_dir)
+        if self._process:
+            self.stop()
+        self._loaded_cred_name = self._cred_name
+        self.write_config()
+        args = [self._cmd, "-c", self._conf_file]
+        self._error_fd = open(self._stderr, "a")
+        self._process = subprocess.Popen(args=args, stderr=self._error_fd)
+        if self._process.returncode is not None:
+            return False
+        if wait_live:
+            time.sleep(1)
+            # fail fast if h2o rejected the config and already exited
+            self._process.poll()
+            if self._process.returncode is not None:
+                self._log("error",
+                          f"h2o exited early (rc={self._process.returncode})"
+                          f" - check {self._stderr} for details")
+                self._process = None
+                return False
+        return not wait_live or self.wait_for_state(
+            live=True, timeout=timedelta(seconds=Env.SERVER_TIMEOUT)
+        )
+
+    def stop(self, wait_dead=True):
+        self._mkpath(self._tmp_dir)
+        if self._process:
+            self._process.terminate()
+            try:
+                self._process.wait(timeout=5)
+            except subprocess.TimeoutExpired:
+                self._process.kill()
+                self._process.wait(timeout=2)
+            self._process = None
+            self.close_log()
+            return not wait_dead or self.wait_for_state(
+                live=False, timeout=timedelta(seconds=5)
+            )
+        self.close_log()
+        return True
+
+    def kill(self, wait_dead=True):
+        if self._process:
+            self._process.kill()
+            self.close_log()
+            return True
+        self.close_log()
+        return False
+
+    def restart(self):
+        self.stop()
+        return self.start()
+
+    def reload(self, timeout: timedelta = timedelta(seconds=Env.SERVER_TIMEOUT)):
+        if self._process:
+            running = self._process
+            self._process = None
+            os.kill(running.pid, signal.SIGQUIT)
+            end_wait = datetime.now() + timedelta(seconds=5)
+            exited = False
+            if not self.start(wait_live=False):
+                self._process = running
+                return False
+            while datetime.now() < end_wait:
+                try:
+                    self._log("debug", f"waiting for h2o({running.pid}) to exit.")
+                    running.wait(1)
+                    self._log(
+                        "debug",
+                        f"h2o({running.pid}) terminated -> {running.returncode}",
+                    )
+                    exited = True
+                    break
+                except subprocess.TimeoutExpired:
+                    self._log("warning", f"h2o({running.pid}), not shut down yet.")
+                    os.kill(running.pid, signal.SIGQUIT)
+            if not exited and datetime.now() >= end_wait:
+                self._log("error", f"h2o({running.pid}), terminate forcefully.")
+                os.kill(running.pid, signal.SIGKILL)
+                running.terminate()
+                running.wait(1)
+            return self.wait_for_state(live=True, timeout=timeout)
+        return False
+
+    def wait_for_state(
+        self,
+        live: bool,
+        timeout: timedelta,
+        url: Optional[str] = None,
+        log_prefix: str = "h2o",
+    ):
+        curl = CurlClient(env=self.env, run_dir=self._tmp_dir)
+        try_until = datetime.now() + timeout
+        if url is None:
+            url = f"https://{self._domain}:{self._port}/"
+        while datetime.now() < try_until:
+            if live:
+                r = curl.http_get(
+                    url=url, extra_args=["--trace", "curl.trace", "--trace-time"]
+                )
+                if r.exit_code == 0:
+                    return True
+            else:
+                r = curl.http_get(url=url)
+                if r.exit_code != 0:
+                    return True
+            time.sleep(0.1)
+        if live:
+            self._log("error", f"Server still not responding after {timeout}")
+        else:
+            self._log("debug", f"Server still responding after {timeout}")
+        return False
+
+    def write_config(self):
+        # To be overridden by subclasses
+        with open(self._conf_file, "w") as fd:
+            fd.write("# h2o test config\n")
+
+
+class H2oServer(H2o):
+    """h2o HTTP/3 server for testing."""
+
+    PORT_SPECS = {
+        "h2o_https": socket.SOCK_STREAM,
+    }
+
+    def __init__(self, env: Env):
+        super().__init__(
+            env=env, name="h2o-server", domain=env.domain1, cred_name=env.domain1
+        )
+        self._docs_dir = os.path.join(self.env.gen_dir, "docs")
+
+    @property
+    def docs_dir(self):
+        return self._docs_dir
+
+    def initial_start(self):
+        super().initial_start()
+
+        def startup(ports: Dict[str, int]) -> bool:
+            self._port = ports["h2o_https"]
+            if self.start():
+                self.env.update_ports(ports)
+                return True
+            self.stop()
+            self._port = 0
+            return False
+
+        return alloc_ports_and_do(
+            H2oServer.PORT_SPECS, startup, self.env.gen_root, max_tries=3
+        )
+
+    def write_config(self):
+        creds = self.env.get_credentials(self._cred_name)
+        assert creds  # convince pytype this is not None
+        self._mkpath(self._docs_dir)
+        self._mkpath(self._run_dir)
+        # Create a simple test file
+        with open(os.path.join(self._docs_dir, "data.json"), "w") as f:
+            f.write('{"message": "Hello from h2o HTTP/3 server"}\n')
+        with open(self._conf_file, "w") as fd:
+            fd.write(f"""# h2o HTTP/3 server configuration
+server-name: "h2o-test-server"
+num-threads: 1
+
+listen: &ssl_listen
+  port: {self._port}
+  ssl:
+    certificate-file: {creds.cert_file}
+    key-file: {creds.pkey_file}
+    neverbleed: OFF
+    minimum-version: TLSv1.2
+    ocsp-update-interval: 0
+
+listen:
+  <<: *ssl_listen
+  type: quic
+
+hosts:
+  "{self._domain}":
+    paths:
+      "/":
+        file.dir: {self._docs_dir}
+
+http2-reprioritize-blocking-assets: ON
+
+access-log: {self._run_dir}/access.log
+error-log: {self._error_log}
+""")
+
+
+class H2oProxy(H2o):
+    """h2o MASQUE proxy for testing."""
+
+    def __init__(self, env: Env):
+        super().__init__(
+            env=env,
+            name="h2o-proxy",
+            domain=env.proxy_domain,
+            cred_name=env.proxy_domain,
+        )
+
+    def initial_start(self):
+        super().initial_start()
+
+        def startup(ports: Dict[str, int]) -> bool:
+            self._port = ports["h2o_h3proxys"]
+            self._h2_port = ports["h2o_h2proxys"]
+            self._h1_port = ports["h2o_proxys"]
+            if self.start():
+                self.env.update_ports(ports)
+                return True
+            self.stop()
+            self._port = 0
+            self._h2_port = 0
+            self._h1_port = 0
+            return False
+
+        return alloc_ports_and_do(
+            {
+                "h2o_h3proxys": socket.SOCK_DGRAM,
+                "h2o_h2proxys": socket.SOCK_STREAM,
+                "h2o_proxys": socket.SOCK_STREAM,
+            },
+            startup,
+            self.env.gen_root,
+            max_tries=3,
+        )
+
+    def write_config(self):
+        creds = self.env.get_credentials(self._cred_name)
+        assert creds  # convince pytype this is not None
+        self._mkpath(self._run_dir)
+        with open(self._conf_file, "w") as fd:
+            fd.write(f"""# h2o MASQUE proxy configuration
+server-name: "h2o-test-proxy"
+num-threads: 1
+
+proxy.tunnel: ON
+
+# HTTP/1.1 proxy listener
+listen: &h1_listen
+  port: {getattr(self, "_h1_port", self._port)}
+  ssl:
+    certificate-file: {creds.cert_file}
+    key-file: {creds.pkey_file}
+    neverbleed: OFF
+    minimum-version: TLSv1.2
+    ocsp-update-interval: 0
+
+# HTTP/2 proxy listener
+listen: &h2_listen
+  port: {getattr(self, "_h2_port", self._port)}
+  ssl:
+    certificate-file: {creds.cert_file}
+    key-file: {creds.pkey_file}
+    neverbleed: OFF
+    minimum-version: TLSv1.2
+    ocsp-update-interval: 0
+
+# HTTP/3 proxy listener (main port)
+listen: &h3_listen
+  port: {self._port}
+  ssl:
+    certificate-file: {creds.cert_file}
+    key-file: {creds.pkey_file}
+    neverbleed: OFF
+    minimum-version: TLSv1.2
+    ocsp-update-interval: 0
+
+# QUIC listener for HTTP/3
+listen:
+  <<: *h3_listen
+  type: quic
+
+hosts:
+  "{self._domain}":
+    paths:
+      "/":
+        proxy.connect: [+*]
+        proxy.ssl.verify-peer: OFF
+      "/.well-known/masque/udp":
+        proxy.connect-udp: [+*]
+        proxy.ssl.verify-peer: OFF
+
+http2-reprioritize-blocking-assets: ON
+
+access-log: {self._run_dir}/access.log
+error-log: {self._error_log}
+""")
+
+    def wait_for_state(
+        self,
+        live: bool,
+        timeout: timedelta,
+        url: Optional[str] = None,
+        log_prefix: str = "h2o",
+    ):
+        curl = CurlClient(env=self.env, run_dir=self._tmp_dir)
+        try_until = datetime.now() + timeout
+        if url is None:
+            url = f"https://{self.env.proxy_domain}:{self._port}/"
+        while datetime.now() < try_until:
+            if live:
+                r = curl.http_get(
+                    url=url, extra_args=["--trace", "curl.trace", "--trace-time"]
+                )
+                if r.exit_code == 0:
+                    return True
+            else:
+                r = curl.http_get(url=url)
+                if r.exit_code != 0:
+                    return True
+            time.sleep(0.1)
+        if live:
+            self._log("error", f"Proxy still not responding after {timeout}")
+        else:
+            self._log("debug", f"Proxy still responding after {timeout}")
+        return False
diff --git a/third-party/curl/tests/http/testenv/httpd.py b/third-party/curl/tests/http/testenv/httpd.py
index 7e7688d065..64ca796d13 100644
--- a/third-party/curl/tests/http/testenv/httpd.py
+++ b/third-party/curl/tests/http/testenv/httpd.py
@@ -24,18 +24,21 @@
 #
 ###########################################################################
 #
+import copy
 import inspect
 import logging
 import os
+import shutil
+import socket
 import subprocess
-from datetime import timedelta, datetime
-from json import JSONEncoder
 import time
-from typing import List, Union, Optional
+from datetime import datetime, timedelta
+from json import JSONEncoder
+from typing import Dict, List, Optional, Union
 
 from .curl import CurlClient, ExecResult
 from .env import Env
-
+from .ports import alloc_ports_and_do
 
 log = logging.getLogger(__name__)
 
@@ -47,9 +50,10 @@ class Httpd:
         'authn_core', 'authn_file',
         'authz_user', 'authz_core', 'authz_host',
         'auth_basic', 'auth_digest',
-        'alias', 'env', 'filter', 'headers', 'mime',
+        'alias', 'env', 'filter', 'headers', 'mime', 'setenvif', 'negotiation',
         'socache_shmcb',
         'rewrite', 'http2', 'ssl', 'proxy', 'proxy_http', 'proxy_connect',
+        'brotli',
         'mpm_event',
     ]
     COMMON_MODULES_DIRS = [
@@ -59,9 +63,16 @@ class Httpd:
 
     MOD_CURLTEST = None
 
-    def __init__(self, env: Env, proxy_auth: bool = False):
+    PORT_SPECS = {
+        'http': socket.SOCK_STREAM,
+        'https': socket.SOCK_STREAM,
+        'https-tcp-only': socket.SOCK_STREAM,
+        'proxy': socket.SOCK_STREAM,
+        'proxys': socket.SOCK_STREAM,
+    }
+
+    def __init__(self, env: Env):
         self.env = env
-        self._cmd = env.apachectl
         self._apache_dir = os.path.join(env.gen_dir, 'apache')
         self._run_dir = os.path.join(self._apache_dir, 'run')
         self._lock_dir = os.path.join(self._apache_dir, 'locks')
@@ -75,8 +86,13 @@ class Httpd:
         self._digest_passwords = os.path.join(self._conf_dir, 'digest.passwords')
         self._mods_dir = None
         self._auth_digest = True
-        self._proxy_auth_basic = proxy_auth
+        self._proxy_auth_basic = False
+        # name used to lookup credentials for env.domain1
+        self._domain1_cred_name = env.domain1
         self._extra_configs = {}
+        self._loaded_extra_configs = None
+        self._loaded_proxy_auth = None
+        self._loaded_domain1_cred_name = None
         assert env.apxs
         p = subprocess.run(args=[env.apxs, '-q', 'libexecdir'],
                            capture_output=True, text=True)
@@ -84,10 +100,11 @@ class Httpd:
             raise Exception(f'{env.apxs} failed to query libexecdir: {p}')
         self._mods_dir = p.stdout.strip()
         if self._mods_dir is None:
-            raise Exception(f'apache modules dir cannot be found')
+            raise Exception('apache modules directory cannot be found')
         if not os.path.exists(self._mods_dir):
-            raise Exception(f'apache modules dir does not exist: {self._mods_dir}')
-        self._process = None
+            raise Exception(f'apache modules directory does not exist: {self._mods_dir}')
+        self._maybe_running = False
+        self.ports = {}
         self._rmf(self._error_log)
         self._init_curltest()
 
@@ -99,7 +116,7 @@ class Httpd:
         self._rmf(self._error_log)
 
     def exists(self):
-        return os.path.exists(self._cmd)
+        return os.path.exists(self.env.httpd)
 
     def set_extra_config(self, domain: str, lines: Optional[Union[str, List[str]]]):
         if lines is None:
@@ -107,16 +124,19 @@ class Httpd:
         else:
             self._extra_configs[domain] = lines
 
-    def clear_extra_configs(self):
+    def reset_config(self):
         self._extra_configs = {}
+        self.set_proxy_auth(False)
+        self._domain1_cred_name = self.env.domain1
 
     def set_proxy_auth(self, active: bool):
         self._proxy_auth_basic = active
 
+    def set_domain1_cred_name(self, name):
+        self._domain1_cred_name = name
+
     def _run(self, args, intext=''):
-        env = {}
-        for key, val in os.environ.items():
-            env[key] = val
+        env = os.environ.copy()
         env['APACHE_RUN_DIR'] = self._run_dir
         env['APACHE_RUN_USER'] = os.environ['USER']
         env['APACHE_LOCK_DIR'] = self._lock_dir
@@ -131,51 +151,85 @@ class Httpd:
                           stderr=p.stderr.decode().splitlines(),
                           duration=datetime.now() - start)
 
-    def _apachectl(self, cmd: str):
-        args = [self.env.apachectl,
+    def _cmd_httpd(self, cmd: str):
+        args = [self.env.httpd,
                 "-d", self._apache_dir,
                 "-f", self._conf_file,
                 "-k", cmd]
         return self._run(args=args)
 
+    def initial_start(self):
+
+        def startup(ports: Dict[str, int]) -> bool:
+            self.ports.update(ports)
+            if self.start():
+                self.env.update_ports(ports)
+                return True
+            self.stop()
+            self.ports.clear()
+            return False
+
+        return alloc_ports_and_do(Httpd.PORT_SPECS, startup,
+                                  self.env.gen_root, max_tries=3)
+
     def start(self):
-        if self._process:
+        # assure ports are allocated
+        for key, _ in Httpd.PORT_SPECS.items():
+            assert self.ports[key] is not None
+        if self._maybe_running:
             self.stop()
         self._write_config()
         with open(self._error_log, 'a') as fd:
             fd.write('start of server\n')
         with open(os.path.join(self._apache_dir, 'xxx'), 'a') as fd:
             fd.write('start of server\n')
-        r = self._apachectl('start')
-        if r.exit_code != 0:
+        r = self._cmd_httpd('start')
+        if r.exit_code != 0 or len(r.stderr):
             log.error(f'failed to start httpd: {r}')
+            self.stop()
             return False
-        return self.wait_live(timeout=timedelta(seconds=5))
+        self._loaded_extra_configs = copy.deepcopy(self._extra_configs)
+        self._loaded_proxy_auth = self._proxy_auth_basic
+        return self.wait_live(timeout=timedelta(seconds=Env.SERVER_TIMEOUT))
 
     def stop(self):
-        r = self._apachectl('stop')
+        r = self._cmd_httpd('stop')
+        self._loaded_extra_configs = None
+        self._loaded_proxy_auth = None
         if r.exit_code == 0:
-            return self.wait_dead(timeout=timedelta(seconds=5))
+            return self.wait_dead(timeout=timedelta(seconds=Env.SERVER_TIMEOUT))
         log.fatal(f'stopping httpd failed: {r}')
         return r.exit_code == 0
 
-    def restart(self):
-        self.stop()
-        return self.start()
-
     def reload(self):
         self._write_config()
-        r = self._apachectl("graceful")
+        r = self._cmd_httpd("graceful")
         if r.exit_code != 0:
             log.error(f'failed to reload httpd: {r}')
-        return self.wait_live(timeout=timedelta(seconds=5))
+            return False
+        self._loaded_extra_configs = None
+        self._loaded_proxy_auth = None
+        if r.exit_code != 0:
+            log.error(f'failed to reload httpd: {r}')
+        self._loaded_extra_configs = copy.deepcopy(self._extra_configs)
+        self._loaded_proxy_auth = self._proxy_auth_basic
+        return self.wait_live(timeout=timedelta(seconds=Env.SERVER_TIMEOUT))
+
+    def reload_if_config_changed(self):
+        if self._maybe_running and \
+                self._loaded_extra_configs == self._extra_configs and \
+                self._loaded_proxy_auth == self._proxy_auth_basic and \
+                self._loaded_domain1_cred_name == self._domain1_cred_name:
+            return True
+        return self.reload()
 
     def wait_dead(self, timeout: timedelta):
         curl = CurlClient(env=self.env, run_dir=self._tmp_dir)
         try_until = datetime.now() + timeout
         while datetime.now() < try_until:
-            r = curl.http_get(url=f'http://{self.env.domain1}:{self.env.http_port}/')
+            r = curl.http_get(url=f'http://{self.env.domain1}:{self.ports["http"]}/')
             if r.exit_code != 0:
+                self._maybe_running = False
                 return True
             time.sleep(.1)
         log.debug(f"Server still responding after {timeout}")
@@ -186,29 +240,39 @@ class Httpd:
                           timeout=timeout.total_seconds())
         try_until = datetime.now() + timeout
         while datetime.now() < try_until:
-            r = curl.http_get(url=f'http://{self.env.domain1}:{self.env.http_port}/')
+            r = curl.http_get(url=f'http://{self.env.domain1}:{self.ports["http"]}/')
             if r.exit_code == 0:
+                self._maybe_running = True
                 return True
             time.sleep(.1)
-        log.debug(f"Server still not responding after {timeout}")
+        log.error(f"Server still not responding after {timeout}")
         return False
 
     def _rmf(self, path):
         if os.path.exists(path):
-            return os.remove(path)
+            os.remove(path)
 
     def _mkpath(self, path):
         if not os.path.exists(path):
-            return os.makedirs(path)
+            os.makedirs(path)
 
     def _write_config(self):
         domain1 = self.env.domain1
-        creds1 = self.env.get_credentials(domain1)
+        domain1brotli = self.env.domain1brotli
+        creds1 = self.env.get_credentials(self._domain1_cred_name)
+        assert creds1  # convince pytype this is not None
+        self._loaded_domain1_cred_name = self._domain1_cred_name
         domain2 = self.env.domain2
         creds2 = self.env.get_credentials(domain2)
+        assert creds2  # convince pytype this is not None
+        exp_domain = self.env.expired_domain
+        exp_creds = self.env.get_credentials(exp_domain)
+        assert exp_creds  # convince pytype this is not None
         proxy_domain = self.env.proxy_domain
         proxy_creds = self.env.get_credentials(proxy_domain)
+        assert proxy_creds  # convince pytype this is not None
         self._mkpath(self._conf_dir)
+        self._mkpath(self._docs_dir)
         self._mkpath(self._logs_dir)
         self._mkpath(self._tmp_dir)
         self._mkpath(os.path.join(self._docs_dir, 'two'))
@@ -236,44 +300,47 @@ class Httpd:
                 if os.path.exists(os.path.join(self._mods_dir, f'mod_{m}.so')):
                     fd.write(f'LoadModule {m}_module   "{self._mods_dir}/mod_{m}.so"\n')
             if Httpd.MOD_CURLTEST is not None:
-                fd.write(f'LoadModule curltest_module   \"{Httpd.MOD_CURLTEST}\"\n')
+                fd.write(f'LoadModule curltest_module   "{Httpd.MOD_CURLTEST}"\n')
             conf = [   # base server config
                 f'ServerRoot "{self._apache_dir}"',
-                f'DefaultRuntimeDir logs',
-                f'PidFile httpd.pid',
+                'DefaultRuntimeDir logs',
+                'PidFile httpd.pid',
+                f'ServerName {self.env.tld}',
                 f'ErrorLog {self._error_log}',
                 f'LogLevel {self._get_log_level()}',
-                f'StartServers 4',
-                f'H2MinWorkers 16',
-                f'H2MaxWorkers 256',
-                f'H2Direct on',
-                f'Listen {self.env.http_port}',
-                f'Listen {self.env.https_port}',
-                f'Listen {self.env.proxy_port}',
-                f'Listen {self.env.proxys_port}',
+                'StartServers 4',
+                'ReadBufferSize 16000',
+                'KeepAliveTimeout 30',  # CI may exceed the default of 5 sec
+                'H2MinWorkers 16',
+                'H2MaxWorkers 256',
                 f'TypesConfig "{self._conf_dir}/mime.types',
-                f'SSLSessionCache "shmcb:ssl_gcache_data(32000)"',
+                'SSLSessionCache "shmcb:ssl_gcache_data(32000)"',
+                'AddEncoding x-gzip .gz .tgz .gzip',
+                'AddHandler type-map .var',
             ]
+            conf.extend([f'Listen {port}' for _, port in self.ports.items()])
+
             if 'base' in self._extra_configs:
                 conf.extend(self._extra_configs['base'])
             conf.extend([  # plain http host for domain1
-                f'<VirtualHost *:{self.env.http_port}>',
+                f'<VirtualHost *:{self.ports["http"]}>',
                 f'    ServerName {domain1}',
-                f'    ServerAlias localhost',
+                '    ServerAlias localhost',
                 f'    DocumentRoot "{self._docs_dir}"',
-                f'    Protocols h2c http/1.1',
+                '    Protocols h2c http/1.1',
+                '    H2Direct on',
             ])
             conf.extend(self._curltest_conf(domain1))
             conf.extend([
-                f'</VirtualHost>',
-                f'',
+                '</VirtualHost>',
+                '',
             ])
             conf.extend([  # https host for domain1, h1 + h2
-                f'<VirtualHost *:{self.env.https_port}>',
+                f'<VirtualHost *:{self.ports["https"]}>',
                 f'    ServerName {domain1}',
-                f'    ServerAlias localhost',
-                f'    Protocols h2 http/1.1',
-                f'    SSLEngine on',
+                '    ServerAlias localhost',
+                '    Protocols h2 http/1.1',
+                '    SSLEngine on',
                 f'    SSLCertificateFile {creds1.cert_file}',
                 f'    SSLCertificateKeyFile {creds1.pkey_file}',
                 f'    DocumentRoot "{self._docs_dir}"',
@@ -282,14 +349,62 @@ class Httpd:
             if domain1 in self._extra_configs:
                 conf.extend(self._extra_configs[domain1])
             conf.extend([
-                f'</VirtualHost>',
-                f'',
+                '</VirtualHost>',
+                '',
             ])
-            conf.extend([  # https host for domain2, no h2
-                f'<VirtualHost *:{self.env.https_port}>',
+            conf.extend([  # https host for domain1, h1 + h2, tcp only
+                f'<VirtualHost *:{self.ports["https-tcp-only"]}>',
+                f'    ServerName {domain1}',
+                '    ServerAlias localhost',
+                '    Protocols h2 http/1.1',
+                '    SSLEngine on',
+                f'    SSLCertificateFile {creds1.cert_file}',
+                f'    SSLCertificateKeyFile {creds1.pkey_file}',
+                f'    DocumentRoot "{self._docs_dir}"',
+            ])
+            conf.extend(self._curltest_conf(domain1))
+            if domain1 in self._extra_configs:
+                conf.extend(self._extra_configs[domain1])
+            conf.extend([
+                '</VirtualHost>',
+                '',
+            ])
+            # Alternate to domain1 with BROTLI compression
+            conf.extend([  # https host for domain1, h1 + h2
+                f'<VirtualHost *:{self.ports["https"]}>',
+                f'    ServerName {domain1brotli}',
+                '    Protocols h2 http/1.1',
+                '    SSLEngine on',
+                f'    SSLCertificateFile {creds1.cert_file}',
+                f'    SSLCertificateKeyFile {creds1.pkey_file}',
+                f'    DocumentRoot "{self._docs_dir}"',
+                '    SetOutputFilter BROTLI_COMPRESS',
+            ])
+            conf.extend(self._curltest_conf(domain1))
+            if domain1 in self._extra_configs:
+                conf.extend(self._extra_configs[domain1])
+            conf.extend([
+                '</VirtualHost>',
+                '',
+            ])
+            conf.extend([  # plain http host for domain2
+                f'<VirtualHost *:{self.ports["http"]}>',
                 f'    ServerName {domain2}',
-                f'    Protocols http/1.1',
-                f'    SSLEngine on',
+                '    ServerAlias localhost',
+                f'    DocumentRoot "{self._docs_dir}"',
+                '    Protocols h2c http/1.1',
+            ])
+            conf.extend(self._curltest_conf(domain2))
+            conf.extend([
+                '</VirtualHost>',
+                '',
+            ])
+            self._mkpath(os.path.join(self._docs_dir, 'two'))
+            conf.extend([  # https host for domain2, no h2
+                f'<VirtualHost *:{self.ports["https"]}>',
+                f'    ServerName {domain2}',
+                '    Protocols http/1.1',
+                '    SSLEngine on',
                 f'    SSLCertificateFile {creds2.cert_file}',
                 f'    SSLCertificateKeyFile {creds2.pkey_file}',
                 f'    DocumentRoot "{self._docs_dir}/two"',
@@ -298,66 +413,102 @@ class Httpd:
             if domain2 in self._extra_configs:
                 conf.extend(self._extra_configs[domain2])
             conf.extend([
-                f'</VirtualHost>',
-                f'',
+                '</VirtualHost>',
+                '',
+            ])
+            conf.extend([  # https host for domain2, no h2, tcp only
+                f'<VirtualHost *:{self.ports["https-tcp-only"]}>',
+                f'    ServerName {domain2}',
+                '    Protocols http/1.1',
+                '    SSLEngine on',
+                f'    SSLCertificateFile {creds2.cert_file}',
+                f'    SSLCertificateKeyFile {creds2.pkey_file}',
+                f'    DocumentRoot "{self._docs_dir}/two"',
+            ])
+            conf.extend(self._curltest_conf(domain2))
+            if domain2 in self._extra_configs:
+                conf.extend(self._extra_configs[domain2])
+            conf.extend([
+                '</VirtualHost>',
+                '',
+            ])
+            self._mkpath(os.path.join(self._docs_dir, 'expired'))
+            conf.extend([  # https host for expired domain
+                f'<VirtualHost *:{self.ports["https"]}>',
+                f'    ServerName {exp_domain}',
+                '    Protocols h2 http/1.1',
+                '    SSLEngine on',
+                f'    SSLCertificateFile {exp_creds.cert_file}',
+                f'    SSLCertificateKeyFile {exp_creds.pkey_file}',
+                f'    DocumentRoot "{self._docs_dir}/expired"',
+            ])
+            conf.extend(self._curltest_conf(exp_domain))
+            if exp_domain in self._extra_configs:
+                conf.extend(self._extra_configs[exp_domain])
+            conf.extend([
+                '</VirtualHost>',
+                '',
             ])
             conf.extend([  # http forward proxy
-                f'<VirtualHost *:{self.env.proxy_port}>',
+                f'<VirtualHost *:{self.ports["proxy"]}>',
                 f'    ServerName {proxy_domain}',
-                f'    Protocols h2c http/1.1',
-                f'    ProxyRequests On',
-                f'    H2ProxyRequests On',
-                f'    ProxyVia On',
-                f'    AllowCONNECT {self.env.http_port} {self.env.https_port}',
+                '    Protocols h2c http/1.1',
+                '    ProxyRequests On',
+                '    H2ProxyRequests On',
+                '    ProxyVia On',
+                f'    AllowCONNECT {self.ports["http"]} {self.ports["https"]}',
             ])
             conf.extend(self._get_proxy_conf())
             conf.extend([
-                f'</VirtualHost>',
-                f'',
+                '</VirtualHost>',
+                '',
             ])
             conf.extend([  # https forward proxy
-                f'<VirtualHost *:{self.env.proxys_port}>',
+                f'<VirtualHost *:{self.ports["proxys"]}>',
                 f'    ServerName {proxy_domain}',
-                f'    Protocols h2 http/1.1',
-                f'    SSLEngine on',
+                '    Protocols h2 http/1.1',
+                '    SSLEngine on',
                 f'    SSLCertificateFile {proxy_creds.cert_file}',
                 f'    SSLCertificateKeyFile {proxy_creds.pkey_file}',
-                f'    ProxyRequests On',
-                f'    H2ProxyRequests On',
-                f'    ProxyVia On',
-                f'    AllowCONNECT {self.env.http_port} {self.env.https_port}',
+                '    ProxyRequests On',
+                '    H2ProxyRequests On',
+                '    ProxyVia On',
+                f'    AllowCONNECT {self.ports["http"]} {self.ports["https"]}',
             ])
             conf.extend(self._get_proxy_conf())
             conf.extend([
-                f'</VirtualHost>',
-                f'',
+                '</VirtualHost>',
+                '',
             ])
 
             fd.write("\n".join(conf))
         with open(os.path.join(self._conf_dir, 'mime.types'), 'w') as fd:
             fd.write("\n".join([
+                'text/plain            txt',
                 'text/html             html',
                 'application/json      json',
+                'application/x-gzip    gzip',
+                'application/x-gzip    gz',
                 ''
             ]))
 
     def _get_proxy_conf(self):
         if self._proxy_auth_basic:
             return [
-                f'    <Proxy "*">',
-                f'      AuthType Basic',
-                f'      AuthName "Restricted Proxy"',
-                f'      AuthBasicProvider file',
+                '    <Proxy "*">',
+                '      AuthType Basic',
+                '      AuthName "Restricted Proxy"',
+                '      AuthBasicProvider file',
                 f'      AuthUserFile "{self._basic_passwords}"',
-                f'      Require user proxy',
-                f'    </Proxy>',
-            ]
-        else:
-            return [
-                f'    <Proxy "*">',
-                f'      Require ip 127.0.0.1',
-                f'    </Proxy>',
+                '      Require user proxy',
+                '    </Proxy>',
             ]
+        return [
+            '    <Proxy "*">',
+            '      Require ip 127.0.0.1',
+            '      Require ip ::1',
+            '    </Proxy>',
+        ]
 
     def _get_log_level(self):
         if self.env.verbose > 3:
@@ -372,33 +523,52 @@ class Httpd:
         lines = []
         if Httpd.MOD_CURLTEST is not None:
             lines.extend([
-                f'    Redirect 301 /curltest/echo301 /curltest/echo',
-                f'    Redirect 302 /curltest/echo302 /curltest/echo',
-                f'    Redirect 303 /curltest/echo303 /curltest/echo',
-                f'    Redirect 307 /curltest/echo307 /curltest/echo',
-                f'    <Location /curltest/echo>',
-                f'      SetHandler curltest-echo',
-                f'    </Location>',
-                f'    <Location /curltest/put>',
-                f'      SetHandler curltest-put',
-                f'    </Location>',
-                f'    <Location /curltest/tweak>',
-                f'      SetHandler curltest-tweak',
-                f'    </Location>',
-                f'    <Location /curltest/1_1>',
-                f'      SetHandler curltest-1_1-required',
-                f'    </Location>',
+                '    Redirect 302 /data.json.302 /data.json',
+                '    Redirect 301 /curltest/echo301 /curltest/echo',
+                '    Redirect 302 /curltest/echo302 /curltest/echo',
+                '    Redirect 303 /curltest/echo303 /curltest/echo',
+                '    Redirect 307 /curltest/echo307 /curltest/echo',
+                '    <Location /curltest/sslinfo>',
+                '      SSLOptions StdEnvVars',
+                '      SetHandler curltest-sslinfo',
+                '    </Location>',
+                '    <Location /curltest/echo>',
+                '      SetHandler curltest-echo',
+                '    </Location>',
+                '    <Location /curltest/limit>',
+                '      SetHandler curltest-limit',
+                '    </Location>',
+                '    <Location /curltest/put>',
+                '      SetHandler curltest-put',
+                '    </Location>',
+                '    <Location /curltest/tweak>',
+                '      SetHandler curltest-tweak',
+                '    </Location>',
+                '    Redirect 302 /tweak /curltest/tweak',
+                '    <Location /curltest/1_1>',
+                '      SetHandler curltest-1_1-required',
+                '    </Location>',
+                '    <Location /curltest/shutdown_unclean>',
+                '      SetHandler curltest-tweak',
+                '      SetEnv force-response-1.0 1',
+                '    </Location>',
+                '    SetEnvIf Request_URI "/shutdown_unclean" ssl-unclean=1',
+                '    RewriteEngine on',
+                '    RewriteRule    "^/curltest/put-redir-301$"  "/curltest/put"  [R=301]',
+                '    RewriteRule    "^/curltest/put-redir-302$"  "/curltest/put"  [R=302]',
+                '    RewriteRule    "^/curltest/put-redir-307$"  "/curltest/put"  [R=307]',
+                '    RewriteRule    "^/curltest/put-redir-308$"  "/curltest/put"  [R=308]',
             ])
         if self._auth_digest:
             lines.extend([
                 f'    <Directory {self.docs_dir}/restricted/digest>',
-                f'      AuthType Digest',
-                f'      AuthName "restricted area"',
+                '      AuthType Digest',
+                '      AuthName "restricted area"',
                 f'      AuthDigestDomain "https://{servername}"',
-                f'      AuthBasicProvider file',
+                '      AuthBasicProvider file',
                 f'      AuthUserFile "{self._digest_passwords}"',
-                f'      Require valid-user',
-                f'    </Directory>',
+                '      Require valid-user',
+                '    </Directory>',
 
             ])
         return lines
@@ -407,12 +577,19 @@ class Httpd:
         if Httpd.MOD_CURLTEST is not None:
             return
         local_dir = os.path.dirname(inspect.getfile(Httpd))
-        p = subprocess.run([self.env.apxs, '-c', 'mod_curltest.c'],
-                           capture_output=True,
-                           cwd=os.path.join(local_dir, 'mod_curltest'))
+        out_dir = os.path.join(self.env.gen_dir, 'mod_curltest')
+        in_source = os.path.join(local_dir, 'mod_curltest/mod_curltest.c')
+        out_source = os.path.join(out_dir, 'mod_curltest.c')
+        if not os.path.exists(out_dir):
+            os.mkdir(out_dir)
+        if not os.path.exists(out_source) or \
+                os.stat(in_source).st_mtime > os.stat(out_source).st_mtime:
+            shutil.copy(in_source, out_source)
+        p = subprocess.run([
+            self.env.apxs, '-c', out_source
+        ], capture_output=True, cwd=out_dir)
         rv = p.returncode
         if rv != 0:
             log.error(f"compiling mod_curltest failed: {p.stderr}")
             raise Exception(f"compiling mod_curltest failed: {p.stderr}")
-        Httpd.MOD_CURLTEST = os.path.join(
-            local_dir, 'mod_curltest/.libs/mod_curltest.so')
+        Httpd.MOD_CURLTEST = os.path.join(out_dir, '.libs/mod_curltest.so')
diff --git a/third-party/curl/tests/http/testenv/mod_curltest/mod_curltest.c b/third-party/curl/tests/http/testenv/mod_curltest/mod_curltest.c
index 30fb765aea..bd09c8b377 100644
--- a/third-party/curl/tests/http/testenv/mod_curltest/mod_curltest.c
+++ b/third-party/curl/tests/http/testenv/mod_curltest/mod_curltest.c
@@ -21,6 +21,8 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include <assert.h>
+
 #include <apr_optional.h>
 #include <apr_optional_hooks.h>
 #include <apr_strings.h>
@@ -33,66 +35,11 @@
 #include <http_request.h>
 #include <http_log.h>
 
-static void curltest_hooks(apr_pool_t *pool);
-static int curltest_echo_handler(request_rec *r);
-static int curltest_put_handler(request_rec *r);
-static int curltest_tweak_handler(request_rec *r);
-static int curltest_1_1_required(request_rec *r);
+#define SECS_PER_HOUR      (60 * 60)
+#define SECS_PER_DAY       (24 * SECS_PER_HOUR)
 
-AP_DECLARE_MODULE(curltest) = {
-  STANDARD20_MODULE_STUFF,
-  NULL, /* func to create per dir config */
-  NULL,  /* func to merge per dir config */
-  NULL, /* func to create per server config */
-  NULL,  /* func to merge per server config */
-  NULL,              /* command handlers */
-  curltest_hooks,
-#if defined(AP_MODULE_FLAG_NONE)
-  AP_MODULE_FLAG_ALWAYS_MERGE
-#endif
-};
-
-static int curltest_post_config(apr_pool_t *p, apr_pool_t *plog,
-                                apr_pool_t *ptemp, server_rec *s)
-{
-  void *data = NULL;
-  const char *key = "mod_curltest_init_counter";
-
-  (void)plog;(void)ptemp;
-
-  apr_pool_userdata_get(&data, key, s->process->pool);
-  if(!data) {
-    /* dry run */
-    apr_pool_userdata_set((const void *)1, key,
-                          apr_pool_cleanup_null, s->process->pool);
-    return APR_SUCCESS;
-  }
-
-  /* mess with the overall server here */
-
-  return APR_SUCCESS;
-}
-
-static void curltest_hooks(apr_pool_t *pool)
-{
-  ap_log_perror(APLOG_MARK, APLOG_TRACE1, 0, pool, "installing hooks");
-
-  /* Run once after configuration is set, but before mpm children initialize.
-   */
-  ap_hook_post_config(curltest_post_config, NULL, NULL, APR_HOOK_MIDDLE);
-
-  /* curl test handlers */
-  ap_hook_handler(curltest_echo_handler, NULL, NULL, APR_HOOK_MIDDLE);
-  ap_hook_handler(curltest_put_handler, NULL, NULL, APR_HOOK_MIDDLE);
-  ap_hook_handler(curltest_tweak_handler, NULL, NULL, APR_HOOK_MIDDLE);
-  ap_hook_handler(curltest_1_1_required, NULL, NULL, APR_HOOK_MIDDLE);
-}
-
-#define SECS_PER_HOUR      (60*60)
-#define SECS_PER_DAY       (24*SECS_PER_HOUR)
-
-static apr_status_t duration_parse(apr_interval_time_t *ptimeout, const char *value,
-                                   const char *def_unit)
+static apr_status_t duration_parse(apr_interval_time_t *ptimeout,
+                                   const char *value, const char *def_unit)
 {
   char *endp;
   apr_int64_t n;
@@ -102,7 +49,8 @@ static apr_status_t duration_parse(apr_interval_time_t *ptimeout, const char *va
     return errno;
   }
   if(!endp || !*endp) {
-    if (!def_unit) def_unit = "s";
+    if(!def_unit)
+      def_unit = "s";
   }
   else if(endp == value) {
     return APR_EINVAL;
@@ -118,12 +66,12 @@ static apr_status_t duration_parse(apr_interval_time_t *ptimeout, const char *va
     break;
   case 's':
   case 'S':
-    *ptimeout = (apr_interval_time_t) apr_time_from_sec(n);
+    *ptimeout = (apr_interval_time_t)apr_time_from_sec(n);
     break;
   case 'h':
   case 'H':
     /* Time is in hours */
-    *ptimeout = (apr_interval_time_t) apr_time_from_sec(n * SECS_PER_HOUR);
+    *ptimeout = (apr_interval_time_t)apr_time_from_sec(n * SECS_PER_HOUR);
     break;
   case 'm':
   case 'M':
@@ -131,12 +79,12 @@ static apr_status_t duration_parse(apr_interval_time_t *ptimeout, const char *va
     /* Time is in milliseconds */
     case 's':
     case 'S':
-      *ptimeout = (apr_interval_time_t) n * 1000;
+      *ptimeout = (apr_interval_time_t)n * 1000;
       break;
     /* Time is in minutes */
     case 'i':
     case 'I':
-      *ptimeout = (apr_interval_time_t) apr_time_from_sec(n * 60);
+      *ptimeout = (apr_interval_time_t)apr_time_from_sec(n * 60);
       break;
     default:
       return APR_EGENERAL;
@@ -148,7 +96,7 @@ static apr_status_t duration_parse(apr_interval_time_t *ptimeout, const char *va
     /* Time is in microseconds */
     case 's':
     case 'S':
-      *ptimeout = (apr_interval_time_t) n;
+      *ptimeout = (apr_interval_time_t)n;
       break;
     default:
       return APR_EGENERAL;
@@ -181,6 +129,9 @@ static int curltest_echo_handler(request_rec *r)
   apr_status_t rv;
   char buffer[8192];
   const char *ct;
+  apr_off_t die_after_len = -1, total_read_len = 0;
+  apr_time_t read_delay = 0;
+  int just_die = 0, die_after_100 = 0;
   long l;
 
   if(strcmp(r->handler, "curltest-echo")) {
@@ -191,29 +142,109 @@ static int curltest_echo_handler(request_rec *r)
   }
 
   ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "echo_handler: processing");
+  if(r->args) {
+    apr_array_header_t *args = NULL;
+    int i;
+    args = apr_cstr_split(r->args, "&", 1, r->pool);
+    for(i = 0; i < args->nelts; ++i) {
+      char *s, *val, *arg = APR_ARRAY_IDX(args, i, char *);
+      s = strchr(arg, '=');
+      if(s) {
+        *s = '\0';
+        val = s + 1;
+        if(!strcmp("die_after", arg)) {
+          die_after_len = (apr_off_t)apr_atoi64(val);
+          continue;
+        }
+        else if(!strcmp("just_die", arg)) {
+          just_die = 1;
+          continue;
+        }
+        else if(!strcmp("die_after_100", arg)) {
+          die_after_100 = 1;
+          continue;
+        }
+        else if(!strcmp("read_delay", arg)) {
+          rv = duration_parse(&read_delay, val, "s");
+          if(APR_SUCCESS == rv) {
+            continue;
+          }
+        }
+      }
+    }
+  }
+
+  if(just_die) {
+    ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
+                  "echo_handler: dying right away");
+    /* Generate no HTTP response at all. */
+    ap_remove_output_filter_byhandle(r->output_filters, "HTTP_HEADER");
+    r->connection->keepalive = AP_CONN_CLOSE;
+    return AP_FILTER_ERROR;
+  }
+
   r->status = 200;
-  r->clength = -1;
-  r->chunked = 1;
-  apr_table_unset(r->headers_out, "Content-Length");
+  if(die_after_len >= 0) {
+    r->clength = die_after_len + 1;
+    r->chunked = 0;
+    apr_table_set(r->headers_out, "Content-Length",
+                  apr_ltoa(r->pool, (long)r->clength));
+  }
+  else {
+    r->clength = -1;
+    r->chunked = 1;
+    apr_table_unset(r->headers_out, "Content-Length");
+  }
   /* Discourage content-encodings */
   apr_table_unset(r->headers_out, "Content-Encoding");
   apr_table_setn(r->subprocess_env, "no-brotli", "1");
   apr_table_setn(r->subprocess_env, "no-gzip", "1");
 
   ct = apr_table_get(r->headers_in, "content-type");
-  ap_set_content_type(r, ct? ct : "application/octet-stream");
+  ap_set_content_type(r, ct ? ct : "application/octet-stream");
+
+  if(apr_table_get(r->headers_in, "TE"))
+    apr_table_setn(r->headers_out, "Request-TE",
+                   apr_table_get(r->headers_in, "TE"));
+
+  if(read_delay) {
+    ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "put_handler: read_delay");
+    apr_sleep(read_delay);
+  }
 
   bb = apr_brigade_create(r->pool, c->bucket_alloc);
   /* copy any request body into the response */
-  if((rv = ap_setup_client_block(r, REQUEST_CHUNKED_DECHUNK))) goto cleanup;
+  rv = ap_setup_client_block(r, REQUEST_CHUNKED_DECHUNK);
+  if(rv)
+    goto cleanup;
+  if(die_after_100) {
+    ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
+                  "echo_handler: dying after 100-continue");
+    /* Generate no HTTP response at all. */
+    ap_remove_output_filter_byhandle(r->output_filters, "HTTP_HEADER");
+    r->connection->keepalive = AP_CONN_CLOSE;
+    return AP_FILTER_ERROR;
+  }
   if(ap_should_client_block(r)) {
     while(0 < (l = ap_get_client_block(r, &buffer[0], sizeof(buffer)))) {
+      total_read_len += l;
+      if(die_after_len >= 0 && total_read_len >= die_after_len) {
+        ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
+                      "echo_handler: dying after %ld bytes as requested",
+                      (long)total_read_len);
+        ap_pass_brigade(r->output_filters, bb);
+        ap_remove_output_filter_byhandle(r->output_filters, "HTTP_HEADER");
+        r->connection->keepalive = AP_CONN_CLOSE;
+        return DONE;
+      }
       ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r,
                     "echo_handler: copying %ld bytes from request body", l);
       rv = apr_brigade_write(bb, NULL, NULL, buffer, l);
-      if (APR_SUCCESS != rv) goto cleanup;
+      if(APR_SUCCESS != rv)
+        goto cleanup;
       rv = ap_pass_brigade(r->output_filters, bb);
-      if (APR_SUCCESS != rv) goto cleanup;
+      if(APR_SUCCESS != rv)
+        goto cleanup;
       ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r,
                     "echo_handler: passed %ld bytes from request body", l);
     }
@@ -253,26 +284,32 @@ static int curltest_tweak_handler(request_rec *r)
   apr_bucket_brigade *bb;
   apr_bucket *b;
   apr_status_t rv;
-  char buffer[16*1024];
+  char buffer[16 * 1024];
   int i, chunks = 3, error_bucket = 1;
   size_t chunk_size = sizeof(buffer);
   const char *request_id = "none";
-  apr_time_t delay = 0, chunk_delay = 0;
+  apr_time_t delay = 0, chunk_delay = 0, close_delay = 0;
   apr_array_header_t *args = NULL;
   int http_status = 200;
   apr_status_t error = APR_SUCCESS, body_error = APR_SUCCESS;
+  int close_conn = 0, with_cl = 0;
+  int x_hd_len = 0, x_hd1_len = 0;
 
   if(strcmp(r->handler, "curltest-tweak")) {
     return DECLINED;
   }
-  if(r->method_number != M_GET && r->method_number != M_POST) {
+  if(r->method_number == M_DELETE) {
+    http_status = 204;
+    chunks = 0;
+  }
+  else if(r->method_number != M_GET && r->method_number != M_POST) {
     return DECLINED;
   }
 
   if(r->args) {
     args = apr_cstr_split(r->args, "&", 1, r->pool);
     for(i = 0; i < args->nelts; ++i) {
-      char *s, *val, *arg = APR_ARRAY_IDX(args, i, char*);
+      char *s, *val, *arg = APR_ARRAY_IDX(args, i, char *);
       s = strchr(arg, '=');
       if(s) {
         *s = '\0';
@@ -302,7 +339,7 @@ static int curltest_tweak_handler(request_rec *r)
           }
         }
         else if(!strcmp("id", arg)) {
-          /* just an id for repeated requests with curl's url globbing */
+          /* an id for repeated requests with curl's URL globbing */
           request_id = val;
           continue;
         }
@@ -334,6 +371,29 @@ static int curltest_tweak_handler(request_rec *r)
             continue;
           }
         }
+        else if(!strcmp("close_delay", arg)) {
+          rv = duration_parse(&close_delay, val, "s");
+          if(APR_SUCCESS == rv) {
+            continue;
+          }
+        }
+        else if(!strcmp("x-hd", arg)) {
+          x_hd_len = (int)apr_atoi64(val);
+          continue;
+        }
+        else if(!strcmp("x-hd1", arg)) {
+          x_hd1_len = (int)apr_atoi64(val);
+          continue;
+        }
+      }
+      else if(!strcmp("close", arg)) {
+        /* we are asked to close the connection */
+        close_conn = 1;
+        continue;
+      }
+      else if(!strcmp("with_cl", arg)) {
+        with_cl = 1;
+        continue;
       }
       ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "query parameter not "
                     "understood: '%s' in %s",
@@ -346,15 +406,42 @@ static int curltest_tweak_handler(request_rec *r)
   ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "error_handler: processing "
                 "request, %s", r->args? r->args : "(no args)");
   r->status = http_status;
-  r->clength = -1;
-  r->chunked = 1;
+  r->clength = with_cl ? (chunks * chunk_size) : -1;
+  r->chunked = (r->proto_num >= HTTP_VERSION(1, 1)) && !with_cl;
   apr_table_setn(r->headers_out, "request-id", request_id);
-  apr_table_unset(r->headers_out, "Content-Length");
+  if(r->clength >= 0) {
+    apr_table_set(r->headers_out, "Content-Length",
+                  apr_ltoa(r->pool, (long)r->clength));
+  }
+  else
+    apr_table_unset(r->headers_out, "Content-Length");
   /* Discourage content-encodings */
   apr_table_unset(r->headers_out, "Content-Encoding");
+  if(x_hd_len > 0) {
+    int i, hd_len = (16 * 1024);
+    int n = (x_hd_len / hd_len);
+    char *hd_val = apr_palloc(r->pool, hd_len);
+    memset(hd_val, 'X', hd_len);
+    hd_val[hd_len - 1] = 0;
+    for(i = 0; i < n; ++i) {
+      apr_table_setn(r->headers_out,
+                     apr_psprintf(r->pool, "X-Header-%d", i), hd_val);
+    }
+    if(x_hd_len % hd_len) {
+      hd_val[(x_hd_len % hd_len)] = 0;
+      apr_table_setn(r->headers_out,
+                     apr_psprintf(r->pool, "X-Header-%d", i), hd_val);
+    }
+  }
+  if(x_hd1_len > 0) {
+    char *hd_val = apr_palloc(r->pool, x_hd1_len);
+    memset(hd_val, 'Y', x_hd1_len);
+    hd_val[x_hd1_len - 1] = 0;
+    apr_table_setn(r->headers_out, "X-Mega-Header", hd_val);
+  }
+
   apr_table_setn(r->subprocess_env, "no-brotli", "1");
   apr_table_setn(r->subprocess_env, "no-gzip", "1");
-
   ap_set_content_type(r, "application/octet-stream");
   bb = apr_brigade_create(r->pool, c->bucket_alloc);
 
@@ -368,7 +455,8 @@ static int curltest_tweak_handler(request_rec *r)
   b = apr_bucket_flush_create(c->bucket_alloc);
   APR_BRIGADE_INSERT_TAIL(bb, b);
   rv = ap_pass_brigade(r->output_filters, bb);
-  if (APR_SUCCESS != rv) goto cleanup;
+  if(APR_SUCCESS != rv)
+    goto cleanup;
 
   memset(buffer, 'X', sizeof(buffer));
   for(i = 0; i < chunks; ++i) {
@@ -376,9 +464,11 @@ static int curltest_tweak_handler(request_rec *r)
       apr_sleep(chunk_delay);
     }
     rv = apr_brigade_write(bb, NULL, NULL, buffer, chunk_size);
-    if(APR_SUCCESS != rv) goto cleanup;
+    if(APR_SUCCESS != rv)
+      goto cleanup;
     rv = ap_pass_brigade(r->output_filters, bb);
-    if(APR_SUCCESS != rv) goto cleanup;
+    if(APR_SUCCESS != rv)
+      goto cleanup;
     ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r,
                   "error_handler: passed %lu bytes as response body",
                   (unsigned long)chunk_size);
@@ -396,9 +486,19 @@ static int curltest_tweak_handler(request_rec *r)
                 "error_handler: response passed");
 
 cleanup:
+  if(close_conn) {
+    if(close_delay) {
+      b = apr_bucket_flush_create(c->bucket_alloc);
+      APR_BRIGADE_INSERT_TAIL(bb, b);
+      rv = ap_pass_brigade(r->output_filters, bb);
+      apr_brigade_cleanup(bb);
+      apr_sleep(close_delay);
+    }
+    r->connection->keepalive = AP_CONN_CLOSE;
+  }
   ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r,
-                "error_handler: request cleanup, r->status=%d, aborted=%d",
-                r->status, c->aborted);
+                "error_handler: request cleanup, r->status=%d, aborted=%d, "
+                "close=%d", r->status, c->aborted, close_conn);
   if(rv == APR_SUCCESS) {
     return OK;
   }
@@ -411,6 +511,10 @@ cleanup:
     APR_BRIGADE_INSERT_TAIL(bb, b);
     ap_pass_brigade(r->output_filters, bb);
   }
+  if(rv == APR_ECONNRESET) {
+    r->connection->aborted = 1;
+    return rv;
+  }
   return AP_FILTER_ERROR;
 }
 
@@ -420,11 +524,13 @@ static int curltest_put_handler(request_rec *r)
   apr_bucket_brigade *bb;
   apr_bucket *b;
   apr_status_t rv;
-  char buffer[16*1024];
+  char buffer[128 * 1024];
   const char *ct;
   apr_off_t rbody_len = 0;
+  apr_off_t rbody_max_len = -1;
+  const char *s_rbody_len;
   const char *request_id = "none";
-  apr_time_t chunk_delay = 0;
+  apr_time_t read_delay = 0, chunk_delay = 0;
   apr_array_header_t *args = NULL;
   long l;
   int i;
@@ -439,22 +545,32 @@ static int curltest_put_handler(request_rec *r)
   if(r->args) {
     args = apr_cstr_split(r->args, "&", 1, r->pool);
     for(i = 0; i < args->nelts; ++i) {
-      char *s, *val, *arg = APR_ARRAY_IDX(args, i, char*);
+      char *s, *val, *arg = APR_ARRAY_IDX(args, i, char *);
       s = strchr(arg, '=');
       if(s) {
         *s = '\0';
         val = s + 1;
         if(!strcmp("id", arg)) {
-          /* just an id for repeated requests with curl's url globbing */
+          /* an id for repeated requests with curl's URL globbing */
           request_id = val;
           continue;
         }
+        else if(!strcmp("read_delay", arg)) {
+          rv = duration_parse(&read_delay, val, "s");
+          if(APR_SUCCESS == rv) {
+            continue;
+          }
+        }
         else if(!strcmp("chunk_delay", arg)) {
           rv = duration_parse(&chunk_delay, val, "s");
           if(APR_SUCCESS == rv) {
             continue;
           }
         }
+        else if(!strcmp("max_upload", arg)) {
+          rbody_max_len = (apr_off_t)apr_atoi64(val);
+          continue;
+        }
       }
       ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "query parameter not "
                     "understood: '%s' in %s",
@@ -471,15 +587,22 @@ static int curltest_put_handler(request_rec *r)
   apr_table_unset(r->headers_out, "Content-Length");
   /* Discourage content-encodings */
   apr_table_unset(r->headers_out, "Content-Encoding");
+  apr_table_setn(r->headers_out, "request-id", request_id);
   apr_table_setn(r->subprocess_env, "no-brotli", "1");
   apr_table_setn(r->subprocess_env, "no-gzip", "1");
 
   ct = apr_table_get(r->headers_in, "content-type");
-  ap_set_content_type(r, ct? ct : "text/plain");
+  ap_set_content_type(r, ct ? ct : "text/plain");
 
+  if(read_delay) {
+    ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "put_handler: read_delay");
+    apr_sleep(read_delay);
+  }
   bb = apr_brigade_create(r->pool, c->bucket_alloc);
   /* copy any request body into the response */
-  if((rv = ap_setup_client_block(r, REQUEST_CHUNKED_DECHUNK))) goto cleanup;
+  rv = ap_setup_client_block(r, REQUEST_CHUNKED_DECHUNK);
+  if(rv)
+    goto cleanup;
   if(ap_should_client_block(r)) {
     while(0 < (l = ap_get_client_block(r, &buffer[0], sizeof(buffer)))) {
       ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r,
@@ -488,21 +611,32 @@ static int curltest_put_handler(request_rec *r)
         apr_sleep(chunk_delay);
       }
       rbody_len += l;
+      if((rbody_max_len > 0) && (rbody_len > rbody_max_len)) {
+        r->status = 413;
+        break;
+      }
     }
   }
   /* we are done */
-  rv = apr_brigade_printf(bb, NULL, NULL, "%"APR_OFF_T_FMT, rbody_len);
-  if(APR_SUCCESS != rv) goto cleanup;
+  s_rbody_len = apr_psprintf(r->pool, "%" APR_OFF_T_FMT, rbody_len);
+  apr_table_setn(r->headers_out, "Received-Length", s_rbody_len);
+  rv = apr_brigade_puts(bb, NULL, NULL, s_rbody_len);
+  if(APR_SUCCESS != rv)
+    goto cleanup;
   b = apr_bucket_eos_create(c->bucket_alloc);
   APR_BRIGADE_INSERT_TAIL(bb, b);
   ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "put_handler: request read");
 
   rv = ap_pass_brigade(r->output_filters, bb);
 
+  if(r->status == 413) {
+    apr_sleep(apr_time_from_sec(1));
+  }
+
 cleanup:
-  if(rv == APR_SUCCESS
-     || r->status != HTTP_OK
-     || c->aborted) {
+  if(rv == APR_SUCCESS ||
+     r->status != HTTP_OK ||
+     c->aborted) {
     ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r, "put_handler: done");
     return OK;
   }
@@ -520,19 +654,13 @@ static int curltest_1_1_required(request_rec *r)
   apr_bucket_brigade *bb;
   apr_bucket *b;
   apr_status_t rv;
-  char buffer[16*1024];
   const char *ct;
-  const char *request_id = "none";
-  apr_time_t chunk_delay = 0;
-  apr_array_header_t *args = NULL;
-  long l;
-  int i;
 
   if(strcmp(r->handler, "curltest-1_1-required")) {
     return DECLINED;
   }
 
-  if (HTTP_VERSION_MAJOR(r->proto_num) > 1) {
+  if(HTTP_VERSION_MAJOR(r->proto_num) > 1) {
     apr_table_setn(r->notes, "ssl-renegotiate-forbidden", "1");
     ap_die(HTTP_FORBIDDEN, r);
     return OK;
@@ -549,18 +677,20 @@ static int curltest_1_1_required(request_rec *r)
   apr_table_setn(r->subprocess_env, "no-gzip", "1");
 
   ct = apr_table_get(r->headers_in, "content-type");
-  ap_set_content_type(r, ct? ct : "text/plain");
+  ap_set_content_type(r, ct ? ct : "text/plain");
 
   bb = apr_brigade_create(r->pool, c->bucket_alloc);
   /* flush response */
   b = apr_bucket_flush_create(c->bucket_alloc);
   APR_BRIGADE_INSERT_TAIL(bb, b);
   rv = ap_pass_brigade(r->output_filters, bb);
-  if (APR_SUCCESS != rv) goto cleanup;
+  if(APR_SUCCESS != rv)
+    goto cleanup;
 
   /* we are done */
   rv = apr_brigade_printf(bb, NULL, NULL, "well done!");
-  if(APR_SUCCESS != rv) goto cleanup;
+  if(APR_SUCCESS != rv)
+    goto cleanup;
   b = apr_bucket_eos_create(c->bucket_alloc);
   APR_BRIGADE_INSERT_TAIL(bb, b);
   ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "1_1_handler: request read");
@@ -568,9 +698,9 @@ static int curltest_1_1_required(request_rec *r)
   rv = ap_pass_brigade(r->output_filters, bb);
 
 cleanup:
-  if(rv == APR_SUCCESS
-     || r->status != HTTP_OK
-     || c->aborted) {
+  if(rv == APR_SUCCESS ||
+     r->status != HTTP_OK ||
+     c->aborted) {
     ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r, "1_1_handler: done");
     return OK;
   }
@@ -581,3 +711,292 @@ cleanup:
   }
   return DECLINED;
 }
+
+static int brigade_env_var(request_rec *r, apr_bucket_brigade *bb,
+                           const char *name)
+{
+  const char *s;
+  s = apr_table_get(r->subprocess_env, name);
+  if(s)
+    return apr_brigade_printf(bb, NULL, NULL, ",\n  \"%s\": \"%s\"", name, s);
+  return 0;
+}
+
+static int curltest_sslinfo_handler(request_rec *r)
+{
+  conn_rec *c = r->connection;
+  apr_bucket_brigade *bb;
+  apr_bucket *b;
+  apr_status_t rv;
+  const char *request_id = NULL;
+  int close_conn = 0;
+  int i;
+
+  if(strcmp(r->handler, "curltest-sslinfo")) {
+    return DECLINED;
+  }
+  if(r->method_number != M_GET) {
+    return DECLINED;
+  }
+
+  if(r->args) {
+    apr_array_header_t *args = apr_cstr_split(r->args, "&", 1, r->pool);
+    for(i = 0; i < args->nelts; ++i) {
+      char *s, *val, *arg = APR_ARRAY_IDX(args, i, char *);
+      s = strchr(arg, '=');
+      if(s) {
+        *s = '\0';
+        val = s + 1;
+        if(!strcmp("id", arg)) {
+          /* an id for repeated requests with curl's URL globbing */
+          request_id = val;
+          continue;
+        }
+      }
+      else if(!strcmp("close", arg)) {
+        /* we are asked to close the connection */
+        close_conn = 1;
+        continue;
+      }
+      ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "query parameter not "
+                    "understood: '%s' in %s",
+                    arg, r->args);
+      ap_die(HTTP_BAD_REQUEST, r);
+      return OK;
+    }
+  }
+
+  ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "sslinfo: processing");
+  r->status = 200;
+  r->clength = -1;
+  r->chunked = 1;
+  apr_table_unset(r->headers_out, "Content-Length");
+  /* Discourage content-encodings */
+  apr_table_unset(r->headers_out, "Content-Encoding");
+  if(request_id)
+    apr_table_setn(r->headers_out, "request-id", request_id);
+  apr_table_setn(r->subprocess_env, "no-brotli", "1");
+  apr_table_setn(r->subprocess_env, "no-gzip", "1");
+
+  ap_set_content_type(r, "application/json");
+
+  bb = apr_brigade_create(r->pool, c->bucket_alloc);
+
+  apr_brigade_puts(bb, NULL, NULL, "{\n  \"Name\": \"SSL-Information\"");
+  brigade_env_var(r, bb, "HTTPS");
+  brigade_env_var(r, bb, "SSL_PROTOCOL");
+  brigade_env_var(r, bb, "SSL_CIPHER");
+  brigade_env_var(r, bb, "SSL_SESSION_ID");
+  brigade_env_var(r, bb, "SSL_SESSION_RESUMED");
+  brigade_env_var(r, bb, "SSL_SRP_USER");
+  brigade_env_var(r, bb, "SSL_SRP_USERINFO");
+  brigade_env_var(r, bb, "SSL_TLS_SNI");
+  apr_brigade_puts(bb, NULL, NULL, "}\n");
+
+  /* flush response */
+  b = apr_bucket_flush_create(c->bucket_alloc);
+  APR_BRIGADE_INSERT_TAIL(bb, b);
+  rv = ap_pass_brigade(r->output_filters, bb);
+  if(APR_SUCCESS != rv)
+    goto cleanup;
+
+  /* we are done */
+  b = apr_bucket_eos_create(c->bucket_alloc);
+  APR_BRIGADE_INSERT_TAIL(bb, b);
+  ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "1_1_handler: request read");
+
+  rv = ap_pass_brigade(r->output_filters, bb);
+
+cleanup:
+  if(close_conn)
+    r->connection->keepalive = AP_CONN_CLOSE;
+  if(rv == APR_SUCCESS ||
+     r->status != HTTP_OK ||
+     c->aborted) {
+    ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r, "1_1_handler: done");
+    return OK;
+  }
+  else {
+    /* no way to know what type of error occurred */
+    ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r, "1_1_handler failed");
+    return AP_FILTER_ERROR;
+  }
+  return DECLINED;
+}
+
+struct curltest_limit_rec {
+  int rcount;
+  int rlimit;
+  apr_time_t end;
+  apr_time_t duration_sec;
+  struct apr_thread_mutex_t *lock;
+};
+
+static struct curltest_limit_rec limitrec = {
+  0, 5, 0, 2
+};
+
+static int curltest_limit_handler(request_rec *r)
+{
+  conn_rec *c = r->connection;
+  apr_bucket_brigade *bb;
+  apr_bucket *b;
+  apr_status_t rv;
+  const char *request_id = NULL;
+  int i, denied;
+  apr_time_t now;
+
+  if(strcmp(r->handler, "curltest-limit")) {
+    return DECLINED;
+  }
+  if(r->method_number != M_GET) {
+    return DECLINED;
+  }
+
+  if(r->args) {
+    apr_array_header_t *args = apr_cstr_split(r->args, "&", 1, r->pool);
+    for(i = 0; i < args->nelts; ++i) {
+      char *s, *val, *arg = APR_ARRAY_IDX(args, i, char *);
+      s = strchr(arg, '=');
+      if(s) {
+        *s = '\0';
+        val = s + 1;
+        if(!strcmp("id", arg)) {
+          /* an id for repeated requests with curl's URL globbing */
+          request_id = val;
+          continue;
+        }
+      }
+      ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "query parameter not "
+                    "understood: '%s' in %s",
+                    arg, r->args);
+      ap_die(HTTP_BAD_REQUEST, r);
+      return OK;
+    }
+  }
+
+  ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "limit: processing");
+
+  now = apr_time_now();
+  apr_thread_mutex_lock(limitrec.lock);
+  if(limitrec.end && (now > limitrec.end)) {
+    /* reset limit */
+    ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, "limit: reset");
+    limitrec.rcount = 0;
+    limitrec.end = 0;
+  }
+  limitrec.rcount += 1;
+  denied = (limitrec.rcount > limitrec.rlimit);
+  if(denied) {
+    /* extend limit duration */
+    limitrec.end = now + apr_time_from_sec(limitrec.duration_sec);
+    ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, "limit: denied, %d request %s",
+                  limitrec.rcount, request_id);
+  }
+  else {
+    ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, "limit: ok, %d request %s",
+                  limitrec.rcount, request_id);
+  }
+  apr_thread_mutex_unlock(limitrec.lock);
+
+  r->status = denied ? 429 : 200;
+  r->clength = -1;
+  r->chunked = 1;
+  apr_table_unset(r->headers_out, "Content-Length");
+  /* Discourage content-encodings */
+  apr_table_unset(r->headers_out, "Content-Encoding");
+  if(request_id)
+    apr_table_setn(r->headers_out, "request-id", request_id);
+  apr_table_setn(r->subprocess_env, "no-brotli", "1");
+  apr_table_setn(r->subprocess_env, "no-gzip", "1");
+
+  if(denied) {
+    char *v = apr_psprintf(r->pool, "%d", limitrec.duration_sec);
+    apr_table_set(r->headers_out, "Retry-After", v);
+  }
+
+  ap_set_content_type(r, "text/plain");
+
+  bb = apr_brigade_create(r->pool, c->bucket_alloc);
+
+  apr_brigade_puts(bb, NULL, NULL, "The resource served with limits.\n");
+
+  /* flush response */
+  b = apr_bucket_flush_create(c->bucket_alloc);
+  APR_BRIGADE_INSERT_TAIL(bb, b);
+  rv = ap_pass_brigade(r->output_filters, bb);
+  if(APR_SUCCESS != rv)
+    goto cleanup;
+
+  /* we are done */
+  b = apr_bucket_eos_create(c->bucket_alloc);
+  APR_BRIGADE_INSERT_TAIL(bb, b);
+  rv = ap_pass_brigade(r->output_filters, bb);
+
+cleanup:
+  if(rv == APR_SUCCESS ||
+     r->status != HTTP_OK ||
+     c->aborted) {
+    ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r, "limit: done");
+    return OK;
+  }
+  else {
+    /* no way to know what type of error occurred */
+    ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r, "limit failed");
+    return AP_FILTER_ERROR;
+  }
+  return DECLINED;
+}
+
+static int curltest_post_config(apr_pool_t *p, apr_pool_t *plog,
+                                apr_pool_t *ptemp, server_rec *s)
+{
+  void *data = NULL;
+  const char *key = "mod_curltest_init_counter";
+  apr_status_t rv;
+
+  (void)p;
+  (void)plog;
+  (void)ptemp;
+
+  apr_pool_userdata_get(&data, key, s->process->pool);
+  if(!data) {
+    /* dry run */
+    apr_pool_userdata_set((const void *)1, key,
+                          apr_pool_cleanup_null, s->process->pool);
+    return APR_SUCCESS;
+  }
+
+  return apr_thread_mutex_create(&limitrec.lock, APR_THREAD_MUTEX_DEFAULT, p);
+}
+
+static void curltest_hooks(apr_pool_t *pool)
+{
+  ap_log_perror(APLOG_MARK, APLOG_TRACE1, 0, pool, "installing hooks");
+
+  /* Run once after configuration is set, but before mpm children initialize.
+   */
+  ap_hook_post_config(curltest_post_config, NULL, NULL, APR_HOOK_MIDDLE);
+
+  /* curl test handlers */
+  ap_hook_handler(curltest_echo_handler, NULL, NULL, APR_HOOK_MIDDLE);
+  ap_hook_handler(curltest_put_handler, NULL, NULL, APR_HOOK_MIDDLE);
+  ap_hook_handler(curltest_tweak_handler, NULL, NULL, APR_HOOK_MIDDLE);
+  ap_hook_handler(curltest_1_1_required, NULL, NULL, APR_HOOK_MIDDLE);
+  ap_hook_handler(curltest_sslinfo_handler, NULL, NULL, APR_HOOK_MIDDLE);
+  ap_hook_handler(curltest_limit_handler, NULL, NULL, APR_HOOK_MIDDLE);
+}
+
+AP_DECLARE_MODULE(curltest) =
+{
+  STANDARD20_MODULE_STUFF,
+  NULL, /* func to create per-directory config */
+  NULL,  /* func to merge per-directory config */
+  NULL, /* func to create per-server config */
+  NULL,  /* func to merge per-server config */
+  NULL,              /* command handlers */
+  curltest_hooks,
+#ifdef AP_MODULE_FLAG_NONE
+  AP_MODULE_FLAG_ALWAYS_MERGE
+#endif
+};
diff --git a/third-party/curl/tests/http/testenv/nghttpx.py b/third-party/curl/tests/http/testenv/nghttpx.py
index 4be060b567..37c72ad945 100644
--- a/third-party/curl/tests/http/testenv/nghttpx.py
+++ b/third-party/curl/tests/http/testenv/nghttpx.py
@@ -27,24 +27,27 @@
 import logging
 import os
 import signal
+import socket
 import subprocess
 import time
-from typing import Optional
 from datetime import datetime, timedelta
+from typing import Dict, Optional
 
-from .env import Env
 from .curl import CurlClient
-
+from .env import Env, NghttpxUtil
+from .ports import alloc_ports_and_do
 
 log = logging.getLogger(__name__)
 
 
 class Nghttpx:
 
-    def __init__(self, env: Env, port: int, name: str):
+    def __init__(self, env: Env, name: str, domain: str, cred_name: str):
         self.env = env
         self._name = name
-        self._port = port
+        self._domain = domain
+        self._port = 0
+        self._port_is_quic = False
         self._cmd = env.nghttpx
         self._run_dir = os.path.join(env.gen_dir, name)
         self._pid_file = os.path.join(self._run_dir, 'nghttpx.pid')
@@ -52,15 +55,42 @@ class Nghttpx:
         self._error_log = os.path.join(self._run_dir, 'nghttpx.log')
         self._stderr = os.path.join(self._run_dir, 'nghttpx.stderr')
         self._tmp_dir = os.path.join(self._run_dir, 'tmp')
-        self._process = None
+        self._error_fd = None
         self._process: Optional[subprocess.Popen] = None
-        self._rmf(self._pid_file)
-        self._rmf(self._error_log)
-        self._mkpath(self._run_dir)
-        self._write_config()
+        self._cred_name = self._def_cred_name = cred_name
+        self._loaded_cred_name = ''
+        self._version = NghttpxUtil.version(self._cmd)
+
+    def supports_h3(self):
+        return NghttpxUtil.version_with_h3(self._version)
+
+    def set_cred_name(self, name: str):
+        self._cred_name = name
+
+    def reset_config(self):
+        self._cred_name = self._def_cred_name
+
+    def reload_if_config_changed(self):
+        if self._process and self._port > 0 and \
+                self._loaded_cred_name == self._cred_name:
+            return True
+        return self.reload()
+
+    @property
+    def port(self):
+        return self._port
+
+    @property
+    def port_is_quic(self):
+        return self._port_is_quic
 
     def exists(self):
-        return os.path.exists(self._cmd)
+        return self._cmd and os.path.exists(self._cmd)
+
+    def close_log(self):
+        if self._error_fd:
+            self._error_fd.close()
+            self._error_fd = None
 
     def clear_logs(self):
         self._rmf(self._error_log)
@@ -77,59 +107,69 @@ class Nghttpx:
             return self.start()
         return True
 
+    def initial_start(self):
+        self._rmf(self._pid_file)
+        self._rmf(self._error_log)
+        self._mkpath(self._run_dir)
+        self._write_config()
+
     def start(self, wait_live=True):
         pass
 
-    def stop_if_running(self):
-        if self.is_running():
-            return self.stop()
-        return True
-
     def stop(self, wait_dead=True):
         self._mkpath(self._tmp_dir)
         if self._process:
             self._process.terminate()
             self._process.wait(timeout=2)
             self._process = None
+            self.close_log()
             return not wait_dead or self.wait_dead(timeout=timedelta(seconds=5))
+        self.close_log()
         return True
 
     def restart(self):
         self.stop()
         return self.start()
 
-    def reload(self, timeout: timedelta):
+    def reload(self, timeout: timedelta = timedelta(seconds=Env.SERVER_TIMEOUT)):
         if self._process:
             running = self._process
             self._process = None
             os.kill(running.pid, signal.SIGQUIT)
-            end_wait = datetime.now() + timeout
+            end_wait = datetime.now() + timedelta(seconds=5)
             if not self.start(wait_live=False):
                 self._process = running
                 return False
             while datetime.now() < end_wait:
                 try:
                     log.debug(f'waiting for nghttpx({running.pid}) to exit.')
-                    running.wait(2)
+                    running.wait(1)
                     log.debug(f'nghttpx({running.pid}) terminated -> {running.returncode}')
+                    running = None
                     break
                 except subprocess.TimeoutExpired:
                     log.warning(f'nghttpx({running.pid}), not shut down yet.')
                     os.kill(running.pid, signal.SIGQUIT)
-            if datetime.now() >= end_wait:
+            if running and datetime.now() >= end_wait:
                 log.error(f'nghttpx({running.pid}), terminate forcefully.')
                 os.kill(running.pid, signal.SIGKILL)
                 running.terminate()
                 running.wait(1)
-            return self.wait_live(timeout=timedelta(seconds=5))
+            return self.wait_live(timeout=timeout)
         return False
 
     def wait_dead(self, timeout: timedelta):
         curl = CurlClient(env=self.env, run_dir=self._tmp_dir)
         try_until = datetime.now() + timeout
         while datetime.now() < try_until:
-            check_url = f'https://{self.env.domain1}:{self._port}/'
-            r = curl.http_get(url=check_url, extra_args=['--http3-only'])
+            xargs = [
+                '--trace', 'curl.trace', '--trace-time',
+                '--connect-timeout', '1'
+            ]
+            if self.port_is_quic:
+                xargs.extend(['--http3-only'])
+            check_url = f'https://{self._domain}:{self.port}/'
+            r = curl.http_get(url=check_url, extra_args=xargs)
             if r.exit_code != 0:
                 return True
             log.debug(f'waiting for nghttpx to stop responding: {r}')
@@ -141,28 +181,31 @@ class Nghttpx:
         curl = CurlClient(env=self.env, run_dir=self._tmp_dir)
         try_until = datetime.now() + timeout
         while datetime.now() < try_until:
-            check_url = f'https://{self.env.domain1}:{self._port}/'
-            r = curl.http_get(url=check_url, extra_args=[
-                '--http3-only', '--trace', 'curl.trace', '--trace-time'
-            ])
+            xargs = [
+                '--trace', 'curl.trace', '--trace-time',
+                '--connect-timeout', '1'
+            ]
+            if self.port_is_quic:
+                xargs.extend(['--http3-only'])
+            check_url = f'https://{self._domain}:{self.port}/'
+            r = curl.http_get(url=check_url, extra_args=xargs)
             if r.exit_code == 0:
                 return True
-            log.debug(f'waiting for nghttpx to become responsive: {r}')
             time.sleep(.1)
         log.error(f"Server still not responding after {timeout}")
         return False
 
     def _rmf(self, path):
         if os.path.exists(path):
-            return os.remove(path)
+            os.remove(path)
 
     def _mkpath(self, path):
         if not os.path.exists(path):
-            return os.makedirs(path)
+            os.makedirs(path)
 
     def _write_config(self):
         with open(self._conf_file, 'w') as fd:
-            fd.write(f'# nghttpx test config'),
+            fd.write('# nghttpx test config')
             fd.write("\n".join([
                 '# do we need something here?'
             ]))
@@ -170,70 +213,124 @@ class Nghttpx:
 
 class NghttpxQuic(Nghttpx):
 
+    PORT_SPECS = {
+        'nghttpx_https': socket.SOCK_STREAM,
+    }
+
     def __init__(self, env: Env):
-        super().__init__(env=env, name='nghttpx-quic', port=env.h3_port)
+        super().__init__(env=env, name='nghttpx-quic',
+                         domain=env.domain1, cred_name=env.domain1)
+        self._https_port = 0
+
+    def initial_start(self):
+        super().initial_start()
+
+        def startup(ports: Dict[str, int]) -> bool:
+            self._https_port = ports['nghttpx_https']
+            if self.supports_h3():
+                self._port = self.env.h3_port
+                self._port_is_quic = True
+            else:
+                self._port = self._https_port
+            if self.start():
+                self.env.update_ports(ports)
+                return True
+            self.stop()
+            self._port = 0
+            return False
+
+        return alloc_ports_and_do(NghttpxQuic.PORT_SPECS, startup,
+                                  self.env.gen_root, max_tries=3)
 
     def start(self, wait_live=True):
         self._mkpath(self._tmp_dir)
         if self._process:
             self.stop()
-        args = [
-            self._cmd,
-            f'--frontend=*,{self.env.h3_port};quic',
-            f'--backend=127.0.0.1,{self.env.https_port};{self.env.domain1};sni={self.env.domain1};proto=h2;tls',
+        creds = self.env.get_credentials(self._cred_name)
+        assert creds  # convince pytype this is not None
+        self._loaded_cred_name = self._cred_name
+        args = [self._cmd, f'--frontend=*,{self._https_port};tls']
+        if self.supports_h3():
+            args.extend([
+                f'--frontend=*,{self._port};quic',
+                '--frontend-quic-early-data',
+            ])
+        args.extend([
             f'--backend=127.0.0.1,{self.env.http_port}',
-            f'--log-level=INFO',
+            '--log-level=ERROR',
             f'--pid-file={self._pid_file}',
             f'--errorlog-file={self._error_log}',
             f'--conf={self._conf_file}',
             f'--cacert={self.env.ca.cert_file}',
-            self.env.get_credentials(self.env.domain1).pkey_file,
-            self.env.get_credentials(self.env.domain1).cert_file,
-            f'--frontend-http3-window-size=1M',
-            f'--frontend-http3-max-window-size=10M',
-            f'--frontend-http3-connection-window-size=10M',
-            f'--frontend-http3-max-connection-window-size=100M',
-        ]
-        ngerr = open(self._stderr, 'a')
-        self._process = subprocess.Popen(args=args, stderr=ngerr)
+            creds.pkey_file,
+            creds.cert_file,
+            '--frontend-http3-window-size=1M',
+            '--frontend-http3-max-window-size=10M',
+            '--frontend-http3-connection-window-size=10M',
+            '--frontend-http3-max-connection-window-size=100M',
+            # f'--frontend-quic-debug-log',
+        ])
+        self._error_fd = open(self._stderr, 'a')
+        self._process = subprocess.Popen(args=args, stderr=self._error_fd)
         if self._process.returncode is not None:
             return False
-        return not wait_live or self.wait_live(timeout=timedelta(seconds=5))
+        return not wait_live or self.wait_live(timeout=timedelta(seconds=Env.SERVER_TIMEOUT))
 
 
 class NghttpxFwd(Nghttpx):
 
     def __init__(self, env: Env):
-        super().__init__(env=env, name='nghttpx-fwd', port=env.h2proxys_port)
+        super().__init__(env=env, name='nghttpx-fwd',
+                         domain=env.proxy_domain,
+                         cred_name=env.proxy_domain)
+
+    def initial_start(self):
+        super().initial_start()
+
+        def startup(ports: Dict[str, int]) -> bool:
+            self._port = ports['h2proxys']
+            if self.start():
+                self.env.update_ports(ports)
+                return True
+            self.stop()
+            self._port = 0
+            return False
+
+        return alloc_ports_and_do({'h2proxys': socket.SOCK_STREAM},
+                                  startup, self.env.gen_root, max_tries=3)
 
     def start(self, wait_live=True):
+        assert self._port > 0
         self._mkpath(self._tmp_dir)
         if self._process:
             self.stop()
+        creds = self.env.get_credentials(self._cred_name)
+        assert creds  # convince pytype this is not None
+        self._loaded_cred_name = self._cred_name
         args = [
             self._cmd,
-            f'--http2-proxy',
-            f'--frontend=*,{self.env.h2proxys_port}',
+            '--http2-proxy',
+            f'--frontend=*,{self._port}',
             f'--backend=127.0.0.1,{self.env.proxy_port}',
-            f'--log-level=INFO',
+            '--log-level=ERROR',
             f'--pid-file={self._pid_file}',
             f'--errorlog-file={self._error_log}',
             f'--conf={self._conf_file}',
             f'--cacert={self.env.ca.cert_file}',
-            self.env.get_credentials(self.env.proxy_domain).pkey_file,
-            self.env.get_credentials(self.env.proxy_domain).cert_file,
+            creds.pkey_file,
+            creds.cert_file,
         ]
-        ngerr = open(self._stderr, 'a')
-        self._process = subprocess.Popen(args=args, stderr=ngerr)
+        self._error_fd = open(self._stderr, 'a')
+        self._process = subprocess.Popen(args=args, stderr=self._error_fd)
         if self._process.returncode is not None:
             return False
-        return not wait_live or self.wait_live(timeout=timedelta(seconds=5))
+        return not wait_live or self.wait_live(timeout=timedelta(seconds=Env.SERVER_TIMEOUT))
 
     def wait_dead(self, timeout: timedelta):
         curl = CurlClient(env=self.env, run_dir=self._tmp_dir)
         try_until = datetime.now() + timeout
         while datetime.now() < try_until:
-            check_url = f'https://{self.env.proxy_domain}:{self.env.h2proxys_port}/'
+            check_url = f'https://{self.env.proxy_domain}:{self._port}/'
             r = curl.http_get(url=check_url)
             if r.exit_code != 0:
                 return True
@@ -246,13 +343,12 @@ class NghttpxFwd(Nghttpx):
         curl = CurlClient(env=self.env, run_dir=self._tmp_dir)
         try_until = datetime.now() + timeout
         while datetime.now() < try_until:
-            check_url = f'https://{self.env.proxy_domain}:{self.env.h2proxys_port}/'
+            check_url = f'https://{self.env.proxy_domain}:{self._port}/'
             r = curl.http_get(url=check_url, extra_args=[
                 '--trace', 'curl.trace', '--trace-time'
             ])
             if r.exit_code == 0:
                 return True
-            log.debug(f'waiting for nghttpx-fwd to become responsive: {r}')
             time.sleep(.1)
         log.error(f"Server still not responding after {timeout}")
         return False
diff --git a/third-party/curl/tests/http/testenv/ports.py b/third-party/curl/tests/http/testenv/ports.py
index d6f9a3c218..f3d2348fa6 100644
--- a/third-party/curl/tests/http/testenv/ports.py
+++ b/third-party/curl/tests/http/testenv/ports.py
@@ -25,19 +25,23 @@
 ###########################################################################
 #
 import logging
+import os
 import socket
+from collections.abc import Callable
 from typing import Dict
 
+from filelock import FileLock
+
 log = logging.getLogger(__name__)
 
 
-def alloc_ports(port_specs: Dict[str, int]) -> Dict[str, int]:
-    ports = {}
+def alloc_port_set(port_specs: Dict[str, int]) -> Dict[str, int]:
     socks = []
+    ports = {}
     for name, ptype in port_specs.items():
         try:
             s = socket.socket(type=ptype)
-            s.bind(('', 0))
+            s.bind(('127.0.0.1', 0))
             ports[name] = s.getsockname()[1]
             socks.append(s)
         except Exception as e:
@@ -45,3 +49,15 @@ def alloc_ports(port_specs: Dict[str, int]) -> Dict[str, int]:
     for s in socks:
         s.close()
     return ports
+
+
+def alloc_ports_and_do(port_spec: Dict[str, int],
+                       do_func: Callable[[Dict[str, int]], bool],
+                       gen_dir, max_tries=1) -> bool:
+    lock_file = os.path.join(gen_dir, 'ports.lock')
+    with FileLock(lock_file):
+        for _ in range(max_tries):
+            port_set = alloc_port_set(port_spec)
+            if do_func(port_set):
+                return True
+    return False
diff --git a/third-party/curl/tests/http/testenv/sshd.py b/third-party/curl/tests/http/testenv/sshd.py
new file mode 100644
index 0000000000..de8078dd26
--- /dev/null
+++ b/third-party/curl/tests/http/testenv/sshd.py
@@ -0,0 +1,293 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+import logging
+import os
+import socket
+import stat
+import subprocess
+import time
+from datetime import datetime, timedelta
+from typing import Dict
+
+from . import CurlClient
+from .env import Env
+from .ports import alloc_ports_and_do
+
+log = logging.getLogger(__name__)
+
+
+class Sshd:
+
+    def __init__(self, env: Env):
+        self.env = env
+        self._cmd = Env.CONFIG.sshd
+        self._sftpd = Env.CONFIG.sftpd
+        self._keygen = 'ssh-keygen'
+        self._port = 0
+        self.name = 'sshd'
+        self._port_skey = 'sshd'
+        self._port_specs = {
+            'sshd': socket.SOCK_STREAM,
+        }
+        self._sshd_dir = os.path.join(env.gen_dir, self.name)
+        self._home_dir = os.path.join(self._sshd_dir, 'home')
+        self._run_dir = os.path.join(self._sshd_dir, 'run')
+        self._tmp_dir = os.path.join(self._sshd_dir, 'tmp')
+        self._conf_file = os.path.join(self._sshd_dir, 'test.conf')
+        self._auth_keys = os.path.join(self._sshd_dir, 'authorized_keys')
+        self._known_hosts = os.path.join(self._sshd_dir, 'known_hosts')
+        self._unknown_hosts = os.path.join(self._sshd_dir, 'unknown_hosts')
+        self._sshd_log = os.path.join(self._sshd_dir, 'sshd.log')
+        self._pid_file = os.path.join(self._sshd_dir, 'sshd.pid')
+        self._key_algs = [
+            'rsa', 'ecdsa', 'ed25519',
+        ]
+        self._host_key_files = []
+        self._host_pub_files = []
+        self._users = [
+            'user1',
+            'user2',
+        ]
+        self._user_key_files = []
+        self._user_pub_files = []
+        self._error_fd = None
+        self._process = None
+
+        self.clear_logs()
+        self._mkpath(self._home_dir)
+        env.make_data_file(indir=self._home_dir, fname="data", fsize=1024)
+        self._mkpath(self._tmp_dir)
+
+    @property
+    def port(self) -> int:
+        return self._port
+
+    @property
+    def home_dir(self):
+        return self._home_dir
+
+    @property
+    def known_hosts(self):
+        return self._known_hosts
+
+    @property
+    def unknown_hosts(self):
+        return self._unknown_hosts
+
+    @property
+    def user1_pubkey_file(self):
+        return self._user_pub_files[0]
+
+    @property
+    def user1_privkey_file(self):
+        return self._user_key_files[0]
+
+    @property
+    def user2_pubkey_file(self):
+        return self._user_pub_files[1]
+
+    @property
+    def user2_privkey_file(self):
+        return self._user_key_files[1]
+
+    def mk_host_keys(self):
+        self._host_key_files = []
+        self._host_pub_files = []
+        # a known_host file that knows all our test host pubkeys
+        with open(self._unknown_hosts, 'w') as fd_unknown, \
+             open(self._known_hosts, 'w') as fd_known:
+            os.chmod(self._unknown_hosts, stat.S_IRUSR | stat.S_IWUSR)
+            os.chmod(self._known_hosts, stat.S_IRUSR | stat.S_IWUSR)
+            for alg in self._key_algs:
+                key_file = os.path.join(self._sshd_dir, f'ssh_host_{alg}_key')
+                if not os.path.exists(key_file):
+                    p = subprocess.run(args=[
+                        self._keygen, '-q', '-N', '', '-t', alg, '-f', key_file
+                    ], capture_output=True, text=True)
+                    if p.returncode != 0:
+                        raise RuntimeError(f'error generating host key {key_file}: {p.returncode}')
+                self._host_key_files.append(key_file)
+                pub_file = f'{key_file}.pub'
+                self._host_pub_files.append(pub_file)
+                with open(pub_file) as fp:
+                    pubkey = fp.read()
+                # fd_known.write(f'[127.0.0.1]:{self.port} {pubkey}')
+                fd_known.write(f'[{self.env.domain1.lower()}]:{self.port} {pubkey}')
+                fd_unknown.write(f'dummy.invalid {pubkey}')
+        # hash the known_hosts file, libssh requires it
+        p = subprocess.run(args=[
+            self._keygen, '-H', '-f', self._known_hosts
+        ], capture_output=True, text=True)
+        if p.returncode != 0:
+            raise RuntimeError(f'error hashing {self._known_hosts}: {p.returncode}')
+
+    def mk_user_keys(self):
+        self._user_key_files = []
+        self._user_pub_files = []
+        alg = 'rsa'
+        for user in self._users:
+            key_file = os.path.join(self._sshd_dir, f'id_{user}_user_{alg}_key')
+            if not os.path.exists(key_file):
+                p = subprocess.run(args=[
+                    self._keygen, '-q', '-N', '', '-t', alg, '-f', key_file
+                ], capture_output=True, text=True)
+                if p.returncode != 0:
+                    raise RuntimeError(f'error generating user key {key_file}: {p.returncode}')
+            self._user_key_files.append(key_file)
+            self._user_pub_files.append(f'{key_file}.pub')
+        with open(self._auth_keys, 'w') as fd:
+            os.chmod(self._auth_keys, stat.S_IRUSR | stat.S_IWUSR)
+            with open(self._user_pub_files[0]) as fp:
+                pubkey = fp.read()
+            fd.write(pubkey)
+
+    def close_log(self):
+        if self._error_fd:
+            self._error_fd.close()
+            self._error_fd = None
+
+    def clear_logs(self):
+        self._rmf(self._sshd_log)
+
+    def dump_log(self):
+        lines = ['>>--sshd log ----------------------------------------------\n']
+        with open(self._sshd_log) as fd:
+            lines.extend(fd.readlines())
+        lines.extend(['>>--curl log ----------------------------------------------\n'])
+        with open(os.path.join(self._tmp_dir, 'curl.stderr')) as fd:
+            lines.extend(fd.readlines())
+        lines.append('<<-------------------------------------------------------\n')
+        return ''.join(lines)
+
+    def exists(self):
+        return os.path.exists(self._cmd)
+
+    def is_running(self):
+        if self._process:
+            self._process.poll()
+            return self._process.returncode is None
+        return False
+
+    def start_if_needed(self):
+        if not self.is_running():
+            return self.start()
+        return True
+
+    def stop(self, wait_dead=True):
+        self._mkpath(self._tmp_dir)
+        if self._process:
+            self._process.terminate()
+            self._process.wait(timeout=2)
+            self._process = None
+        self.close_log()
+        return True
+
+    def restart(self):
+        self.stop()
+        return self.start()
+
+    def initial_start(self):
+
+        def startup(ports: Dict[str, int]) -> bool:
+            self._port = ports[self._port_skey]
+            self.mk_host_keys()
+            self.mk_user_keys()
+            if self.start():
+                self.env.update_ports(ports)
+                return True
+            self.stop()
+            self._port = 0
+            return False
+
+        return alloc_ports_and_do(self._port_specs, startup,
+                                  self.env.gen_root, max_tries=3)
+
+    def start(self, wait_live=True):
+        assert self._port > 0
+        self._mkpath(self._tmp_dir)
+        if self._process:
+            self.stop()
+        self._write_config()
+        args = [
+            self._cmd,
+            '-D',
+            '-f', f'{self._conf_file}',
+            '-E', f'{self._sshd_log}',
+        ]
+        run_env = os.environ.copy()
+        # does not have any effect, sadly
+        # run_env['HOME'] = f'{self._home_dir}'
+        self._error_fd = open(self._sshd_log, 'a')
+        self._process = subprocess.Popen(args=args, stderr=self._error_fd, env=run_env)
+        if self._process.returncode is not None:
+            return False
+        return self.wait_live(timeout=timedelta(seconds=Env.SERVER_TIMEOUT))
+
+    def wait_live(self, timeout: timedelta):
+        curl = CurlClient(env=self.env, run_dir=self._tmp_dir,
+                          timeout=timeout.total_seconds())
+        try_until = datetime.now() + timeout
+        while datetime.now() < try_until:
+            r = curl.http_get(url=f'scp://{self.env.domain1}:{self._port}/{self.home_dir}/data',
+                              extra_args=[
+                                  '--insecure',
+                                  '--pubkey', self.user1_pubkey_file,
+                                  '--key', self.user1_privkey_file,
+                                  '--user', f'{os.environ["USER"]}:',
+                              ])
+            if r.exit_code == 0:
+                return True
+            time.sleep(.1)
+        log.error(f"sshd still not responding after {timeout}")
+        return False
+
+    def _rmf(self, path):
+        if os.path.exists(path):
+            os.remove(path)
+
+    def _mkpath(self, path):
+        if not os.path.exists(path):
+            os.makedirs(path)
+
+    def _write_config(self):
+        conf = [
+            f'ListenAddress 127.0.0.1:{self._port}',
+            'AllowTcpForwarding yes',
+            'AuthenticationMethods publickey',
+            'PasswordAuthentication no',
+            # in CI, we might run as root, allow this
+            'PermitRootLogin yes',
+            'LogLevel VERBOSE',
+            f'AuthorizedKeysFile {self._auth_keys}',
+            f'PidFile {self._pid_file}',
+        ]
+        conf.extend([f'HostKey {key_file}' for key_file in self._host_key_files])
+        if self._sftpd:
+            conf.append(f'Subsystem sftp {self._sftpd}')
+        conf.append('\n')
+        with open(self._conf_file, 'w') as fd:
+            fd.write("\n".join(conf))
diff --git a/third-party/curl/tests/http/testenv/vsftpd.py b/third-party/curl/tests/http/testenv/vsftpd.py
new file mode 100644
index 0000000000..6c2d1db8c5
--- /dev/null
+++ b/third-party/curl/tests/http/testenv/vsftpd.py
@@ -0,0 +1,231 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+import logging
+import os
+import re
+import socket
+import subprocess
+import time
+from datetime import datetime, timedelta
+from typing import Dict, List
+
+from .curl import CurlClient, ExecResult
+from .env import Env
+from .ports import alloc_ports_and_do
+
+log = logging.getLogger(__name__)
+
+
+class VsFTPD:
+
+    def __init__(self, env: Env, with_ssl=False, ssl_implicit=False):
+        self.env = env
+        self._cmd = env.vsftpd
+        self._port = 0
+        self._with_ssl = with_ssl
+        self._ssl_implicit = ssl_implicit and with_ssl
+        self._scheme = 'ftps' if self._ssl_implicit else 'ftp'
+        if self._with_ssl:
+            self.name = 'vsftpds'
+            self._port_skey = 'ftps'
+            self._port_specs = {
+                'ftps': socket.SOCK_STREAM,
+            }
+        else:
+            self.name = 'vsftpd'
+            self._port_skey = 'ftp'
+            self._port_specs = {
+                'ftp': socket.SOCK_STREAM,
+            }
+        self._vsftpd_dir = os.path.join(env.gen_dir, self.name)
+        self._run_dir = os.path.join(self._vsftpd_dir, 'run')
+        self._docs_dir = os.path.join(self._vsftpd_dir, 'docs')
+        self._tmp_dir = os.path.join(self._vsftpd_dir, 'tmp')
+        self._conf_file = os.path.join(self._vsftpd_dir, 'test.conf')
+        self._pid_file = os.path.join(self._vsftpd_dir, 'vsftpd.pid')
+        self._error_log = os.path.join(self._vsftpd_dir, 'vsftpd.log')
+        self._error_fd = None
+        self._process = None
+
+        self.clear_logs()
+
+    @property
+    def domain(self):
+        return self.env.ftp_domain
+
+    @property
+    def docs_dir(self):
+        return self._docs_dir
+
+    @property
+    def port(self) -> int:
+        return self._port
+
+    def close_log(self):
+        if self._error_fd:
+            self._error_fd.close()
+            self._error_fd = None
+
+    def clear_logs(self):
+        self._rmf(self._error_log)
+
+    def exists(self):
+        return os.path.exists(self._cmd)
+
+    def is_running(self):
+        if self._process:
+            self._process.poll()
+            return self._process.returncode is None
+        return False
+
+    def start_if_needed(self):
+        if not self.is_running():
+            return self.start()
+        return True
+
+    def stop(self, wait_dead=True):
+        self._mkpath(self._tmp_dir)
+        if self._process:
+            self._process.terminate()
+            self._process.wait(timeout=2)
+            self._process = None
+            self.close_log()
+            return not wait_dead or self.wait_dead(timeout=timedelta(seconds=5))
+        self.close_log()
+        return True
+
+    def restart(self):
+        self.stop()
+        return self.start()
+
+    def initial_start(self):
+
+        def startup(ports: Dict[str, int]) -> bool:
+            self._port = ports[self._port_skey]
+            if self.start():
+                self.env.update_ports(ports)
+                return True
+            self.stop()
+            self._port = 0
+            return False
+
+        return alloc_ports_and_do(self._port_specs, startup,
+                                  self.env.gen_root, max_tries=3)
+
+    def start(self, wait_live=True):
+        assert self._port > 0
+        self._mkpath(self._tmp_dir)
+        if self._process:
+            self.stop()
+        self._write_config()
+        args = [
+            self._cmd,
+            f'{self._conf_file}',
+        ]
+        self._error_fd = open(self._error_log, 'a')
+        self._process = subprocess.Popen(args=args, stderr=self._error_fd)
+        if self._process.returncode is not None:
+            return False
+        return not wait_live or self.wait_live(timeout=timedelta(seconds=Env.SERVER_TIMEOUT))
+
+    def wait_dead(self, timeout: timedelta):
+        curl = CurlClient(env=self.env, run_dir=self._tmp_dir)
+        try_until = datetime.now() + timeout
+        while datetime.now() < try_until:
+            check_url = f'{self._scheme}://{self.domain}:{self.port}/'
+            r = curl.ftp_get(urls=[check_url], extra_args=['-v'])
+            if r.exit_code != 0:
+                return True
+            log.debug(f'waiting for vsftpd to stop responding: {r}')
+            time.sleep(.1)
+        log.debug(f"Server still responding after {timeout}")
+        return False
+
+    def wait_live(self, timeout: timedelta):
+        curl = CurlClient(env=self.env, run_dir=self._tmp_dir)
+        try_until = datetime.now() + timeout
+        while datetime.now() < try_until:
+            check_url = f'{self._scheme}://{self.domain}:{self.port}/'
+            r = curl.ftp_get(urls=[check_url], extra_args=[
+                '--trace', 'curl-start.trace', '--trace-time'
+            ])
+            if r.exit_code == 0:
+                return True
+            time.sleep(.1)
+        log.error(f"Server still not responding after {timeout}")
+        return False
+
+    def _rmf(self, path):
+        if os.path.exists(path):
+            os.remove(path)
+
+    def _mkpath(self, path):
+        if not os.path.exists(path):
+            os.makedirs(path)
+
+    def _write_config(self):
+        self._mkpath(self._docs_dir)
+        self._mkpath(self._tmp_dir)
+        conf = [  # base server config
+            'listen=YES',
+            'run_as_launching_user=YES',
+            '#listen_address=127.0.0.1',
+            f'listen_port={self.port}',
+            'local_enable=NO',
+            'anonymous_enable=YES',
+            f'anon_root={self._docs_dir}',
+            'dirmessage_enable=YES',
+            'write_enable=YES',
+            'anon_upload_enable=YES',
+            'log_ftp_protocol=YES',
+            'xferlog_enable=YES',
+            'xferlog_std_format=NO',
+            f'vsftpd_log_file={self._error_log}',
+            '\n',
+        ]
+        if self._with_ssl:
+            creds = self.env.get_credentials(self.domain)
+            assert creds  # convince pytype this is not None
+            conf.extend([
+                'ssl_enable=YES',
+                'debug_ssl=YES',
+                'allow_anon_ssl=YES',
+                f'rsa_cert_file={creds.cert_file}',
+                f'rsa_private_key_file={creds.pkey_file}',
+                # require_ssl_reuse=YES means ctrl and data connection need to use the same session
+                'require_ssl_reuse=NO',
+            ])
+            if self._ssl_implicit:
+                conf.extend([
+                     'implicit_ssl=YES',
+                ])
+        with open(self._conf_file, 'w') as fd:
+            fd.write("\n".join(conf))
+
+    def get_data_ports(self, r: ExecResult) -> List[int]:
+        return [int(m.group(1)) for line in r.trace_lines if
+                (m := re.match(r'.*Established 2nd connection to .* \(\S+ port (\d+)\)', line))]
diff --git a/third-party/curl/tests/http/testenv/ws_echo_server.py b/third-party/curl/tests/http/testenv/ws_echo_server.py
index d13f757c78..f3f659a27f 100644
--- a/third-party/curl/tests/http/testenv/ws_echo_server.py
+++ b/third-party/curl/tests/http/testenv/ws_echo_server.py
@@ -27,7 +27,6 @@
 import argparse
 import asyncio
 import logging
-from asyncio import IncompleteReadError
 
 from websockets import server
 from websockets.exceptions import ConnectionClosedError
@@ -38,6 +37,7 @@ async def echo(websocket):
         async for message in websocket:
             await websocket.send(message)
     except ConnectionClosedError:
+        # websocket connection closed by client
         pass
 
 
diff --git a/third-party/curl/tests/http2-server.pl b/third-party/curl/tests/http2-server.pl
index 52c5284c0c..0729a00593 100644
--- a/third-party/curl/tests/http2-server.pl
+++ b/third-party/curl/tests/http2-server.pl
@@ -23,12 +23,17 @@
 #
 #***************************************************************************
 
+use strict;
+use warnings;
+
 # This script invokes nghttpx properly to have it serve HTTP/2 for us.
 # nghttpx runs as a proxy in front of our "actual" HTTP/1 server.
 use Cwd;
 use Cwd 'abs_path';
 use File::Basename;
+use File::Spec;
 
+my $verbose = 0;     # set to 1 for debugging
 my $logdir = "log";
 my $pidfile = "$logdir/nghttpx.pid";
 my $logfile = "$logdir/http2.log";
@@ -37,7 +42,8 @@ my $listenport = 9015;
 my $listenport2 = 9016;
 my $connect = "127.0.0.1,8990";
 my $conf = "nghttpx.conf";
-my $cert = "Server-localhost-sv";
+my $cert = "test-localhost";
+my $dev_null = File::Spec->devnull();
 
 #***************************************************************************
 # Process command line options
@@ -95,19 +101,17 @@ while(@ARGV) {
             shift @ARGV;
         }
     }
-    else {
-        print STDERR "\nWarning: http2-server.pl unknown parameter: $ARGV[0]\n";
+    elsif($ARGV[0]) {
+        print STDERR "\nWarning: http2-server.pl unknown parameter: '$ARGV[0]'\n";
     }
     shift @ARGV;
 }
 
-my $srcdir = dirname(__FILE__);
-$certfile = "$srcdir/certs/$cert.pem";
-$keyfile = "$srcdir/certs/$cert.key";
-$certfile = abs_path($certfile);
-$keyfile = abs_path($keyfile);
+my $certfile = abs_path("certs/$cert.pem");
+my $keyfile = abs_path("certs/$cert.key");
 
-my $cmdline="$nghttpx --backend=$connect ".
+my $cmdline = "$nghttpx --backend=$connect ".
+    "--backend-keep-alive-timeout=500ms ".
     "--frontend=\"*,$listenport;no-tls\" ".
     "--frontend=\"*,$listenport2\" ".
     "--log-level=INFO ".
@@ -116,4 +120,4 @@ my $cmdline="$nghttpx --backend=$connect ".
     "--errorlog-file=$logfile ".
     "$keyfile $certfile";
 print "RUN: $cmdline\n" if($verbose);
-system("$cmdline 2>/dev/null");
+exec("exec $cmdline 2>$dev_null");
diff --git a/third-party/curl/tests/http3-server.pl b/third-party/curl/tests/http3-server.pl
index bc9e98ad11..b86a6a58b3 100644
--- a/third-party/curl/tests/http3-server.pl
+++ b/third-party/curl/tests/http3-server.pl
@@ -23,21 +23,27 @@
 #
 #***************************************************************************
 
+use strict;
+use warnings;
+
 # This script invokes nghttpx properly to have it serve HTTP/3 for us.
 # nghttpx runs as a proxy in front of our "actual" HTTP/1 server.
 
 use Cwd;
 use Cwd 'abs_path';
 use File::Basename;
+use File::Spec;
 
+my $verbose = 0;     # set to 1 for debugging
 my $logdir = "log";
 my $pidfile = "$logdir/nghttpx.pid";
 my $logfile = "$logdir/http3.log";
 my $nghttpx = "nghttpx";
 my $listenport = 9017;
 my $connect = "127.0.0.1,8990";
-my $cert = "Server-localhost-sv";
+my $cert = "test-localhost";
 my $conf = "nghttpx.conf";
+my $dev_null = File::Spec->devnull();
 
 #***************************************************************************
 # Process command line options
@@ -96,18 +102,16 @@ while(@ARGV) {
         }
     }
     else {
-        print STDERR "\nWarning: http3-server.pl unknown parameter: $ARGV[0]\n";
+        print STDERR "\nWarning: http3-server.pl unknown parameter: '$ARGV[0]'\n";
     }
     shift @ARGV;
 }
 
-my $srcdir = dirname(__FILE__);
-$certfile = "$srcdir/certs/$cert.pem";
-$keyfile = "$srcdir/certs/$cert.key";
-$certfile = abs_path($certfile);
-$keyfile = abs_path($keyfile);
+my $certfile = abs_path("certs/$cert.pem");
+my $keyfile = abs_path("certs/$cert.key");
 
-my $cmdline="$nghttpx --http2-proxy --backend=$connect ".
+my $cmdline = "$nghttpx --http2-proxy --backend=$connect ".
+    "--backend-keep-alive-timeout=500ms ".
     "--frontend=\"*,$listenport\" ".
     "--frontend=\"*,$listenport;quic\" ".
     "--log-level=INFO ".
@@ -116,4 +120,4 @@ my $cmdline="$nghttpx --http2-proxy --backend=$connect ".
     "--conf=$conf ".
     "$keyfile $certfile";
 print "RUN: $cmdline\n" if($verbose);
-system("$cmdline 2>/dev/null");
+exec("exec $cmdline 2>$dev_null");
diff --git a/third-party/curl/tests/libtest/.checksrc b/third-party/curl/tests/libtest/.checksrc
deleted file mode 100644
index 37f7909524..0000000000
--- a/third-party/curl/tests/libtest/.checksrc
+++ /dev/null
@@ -1,2 +0,0 @@
-disable TYPEDEFSTRUCT
-disable BANNEDFUNC
diff --git a/third-party/curl/tests/libtest/.gitignore b/third-party/curl/tests/libtest/.gitignore
index 9541d16e17..c78bdfd766 100644
--- a/third-party/curl/tests/libtest/.gitignore
+++ b/third-party/curl/tests/libtest/.gitignore
@@ -2,10 +2,6 @@
 #
 # SPDX-License-Identifier: curl
 
-chkhostname
-lib[1234][0-9][0-9][0-9]
-lib[56][0-9][0-9]
+libtests
+libtests.c
 lib1521.c
-libauthretry
-libntlmconnect
-libprereq
diff --git a/third-party/curl/tests/libtest/CMakeLists.txt b/third-party/curl/tests/libtest/CMakeLists.txt
index 98f5b9c67e..7991a11486 100644
--- a/third-party/curl/tests/libtest/CMakeLists.txt
+++ b/third-party/curl/tests/libtest/CMakeLists.txt
@@ -21,68 +21,49 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-set(TARGET_LABEL_PREFIX "Test ")
 
-function(setup_test TEST_NAME)          # ARGN are the files in the test
+# Get BUNDLE, FIRST_C, FIRST_H, UTILS_C, UTILS_H, CURLX_C, TOOLX_C, TESTS_C variables
+curl_transform_makefile_inc("Makefile.inc" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
+include("${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
 
-  if(LIB_SELECTED STREQUAL LIB_STATIC)
-    # These are part of the libcurl static lib. Do not compile/link them again.
-    list(REMOVE_ITEM ARGN ${WARNLESS} ${MULTIBYTE} ${TIMEDIFF})
-  endif()
-
-  add_executable(${TEST_NAME} EXCLUDE_FROM_ALL ${ARGN})
-  add_dependencies(testdeps ${TEST_NAME})
-  string(TOUPPER ${TEST_NAME} UPPER_TEST_NAME)
-
-  include_directories(
-    ${CURL_SOURCE_DIR}/lib          # To be able to reach "curl_setup_once.h"
-    ${CURL_BINARY_DIR}/lib          # To be able to reach "curl_config.h"
-    ${CURL_BINARY_DIR}/include      # To be able to reach "curl/curl.h"
-    ${CURL_SOURCE_DIR}/tests/libtest # To be able to build generated tests
-    )
-  if(USE_ARES)
-    include_directories(${CARES_INCLUDE_DIR})
-  endif()
-
-  target_link_libraries(${TEST_NAME} ${LIB_SELECTED} ${CURL_LIBS})
-
-  set_target_properties(${TEST_NAME}
-    PROPERTIES COMPILE_DEFINITIONS ${UPPER_TEST_NAME})
-  set_target_properties(${TEST_NAME}
-    PROPERTIES PROJECT_LABEL "${TARGET_LABEL_PREFIX}${TEST_NAME}")
-endfunction()
-
-
-transform_makefile_inc("Makefile.inc" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
-include(${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake)
-
-foreach(TEST_NAME ${noinst_PROGRAMS})
-  if(DEFINED ${TEST_NAME}_SOURCES)
-    setup_test(${TEST_NAME} ${${TEST_NAME}_SOURCES})
-  else()
-    setup_test(${TEST_NAME} ${nodist_${TEST_NAME}_SOURCES})
-  endif()
-endforeach()
-
-# Allows for hostname override to make tests machine independent.
-# TODO this cmake build assumes a shared build, detect static linking here!
-if(NOT WIN32)
-  add_library(hostname MODULE EXCLUDE_FROM_ALL sethostname.c sethostname.h)
-  add_dependencies(testdeps hostname)
-  # Output to .libs for compatibility with autotools, the test data expects a
-  # library at (tests)/libtest/.libs/libhostname.so
-  set_target_properties(hostname PROPERTIES
-      LIBRARY_OUTPUT_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/.libs)
-  if(HIDES_CURL_PRIVATE_SYMBOLS)
-    set_property(TARGET hostname APPEND PROPERTY COMPILE_DEFINITIONS "CURL_HIDDEN_SYMBOLS")
-    set_property(TARGET hostname APPEND PROPERTY COMPILE_FLAGS ${CURL_CFLAG_SYMBOLS_HIDE})
-  endif()
+if(LIB_SELECTED STREQUAL LIB_STATIC)
+  set(CURLX_C "")  # Already exported from the libcurl static build. Skip them.
 endif()
 
-add_custom_command(
-  OUTPUT lib1521.c
-  COMMAND ${PERL_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/mk-lib1521.pl < ${CURL_SOURCE_DIR}/include/curl/curl.h > lib1521.c
+add_custom_command(OUTPUT "lib1521.c"
+  COMMAND ${PERL_EXECUTABLE} "${CMAKE_CURRENT_SOURCE_DIR}/mk-lib1521.pl" < "${PROJECT_SOURCE_DIR}/include/curl/curl.h" "lib1521.c"
   DEPENDS
     "${CMAKE_CURRENT_SOURCE_DIR}/mk-lib1521.pl"
-    "${CURL_SOURCE_DIR}/include/curl/curl.h"
+    "${PROJECT_SOURCE_DIR}/include/curl/curl.h"
   VERBATIM)
+
+list(APPEND TESTS_C "lib1521.c")
+
+if(_CURL_TESTS_CONCAT)
+  set(_mk_unity_extra "--concat" "-I${CMAKE_CURRENT_SOURCE_DIR}")
+endif()
+
+add_custom_command(OUTPUT "${BUNDLE}.c"
+  COMMAND ${PERL_EXECUTABLE} "${PROJECT_SOURCE_DIR}/scripts/mk-unity.pl" ${_mk_unity_extra}
+    --include ${UTILS_C} ${CURLX_C} ${TOOLX_C} --test ${TESTS_C} > "${BUNDLE}.c"
+  DEPENDS
+    "${PROJECT_SOURCE_DIR}/scripts/mk-unity.pl" "${CMAKE_CURRENT_SOURCE_DIR}/Makefile.inc"
+    ${FIRST_C} ${FIRST_H} ${UTILS_C} ${CURLX_C} ${TOOLX_C} ${TESTS_C}
+  VERBATIM)
+
+add_executable(${BUNDLE} EXCLUDE_FROM_ALL "${BUNDLE}.c")
+add_dependencies(tt ${BUNDLE})
+target_link_libraries(${BUNDLE} ${LIB_SELECTED} ${CURL_LIBS})
+target_include_directories(${BUNDLE} PRIVATE
+  "${PROJECT_BINARY_DIR}/lib"            # for "curl_config.h"
+  "${PROJECT_SOURCE_DIR}/lib"            # for "curl_setup.h", curlx
+  "${PROJECT_SOURCE_DIR}/src"            # for toolx
+  "${CMAKE_CURRENT_SOURCE_DIR}"          # for the generated bundle source to find included test sources
+)
+target_compile_definitions(${BUNDLE} PRIVATE ${CURL_DEBUG_MACROS})
+set_target_properties(${BUNDLE} PROPERTIES OUTPUT_NAME "${BUNDLE}" PROJECT_LABEL "Test ${BUNDLE}" UNITY_BUILD OFF)
+
+if(NOT _CURL_TESTS_CONCAT)
+  set_target_properties(${BUNDLE} PROPERTIES C_CLANG_TIDY "")
+  curl_add_clang_tidy_test_target("${BUNDLE}-clang-tidy" ${BUNDLE} ${FIRST_C} ${UTILS_C} ${TESTS_C})
+endif()
diff --git a/third-party/curl/tests/libtest/Makefile.am b/third-party/curl/tests/libtest/Makefile.am
index 09a13914af..db7c9d741b 100644
--- a/third-party/curl/tests/libtest/Makefile.am
+++ b/third-party/curl/tests/libtest/Makefile.am
@@ -31,110 +31,61 @@ AUTOMAKE_OPTIONS = foreign nostdinc
 # $(top_srcdir)/include is for libcurl's external include files
 # $(top_builddir)/lib is for libcurl's generated lib/curl_config.h file
 # $(top_srcdir)/lib for libcurl's lib/curl_setup.h and other "borrowed" files
+# $(top_srcdir)/src for toolx header files
+# $(srcdir) for the generated bundle source to find included test sources
 
 AM_CPPFLAGS = -I$(top_srcdir)/include        \
               -I$(top_builddir)/lib          \
-              -I$(top_srcdir)/lib
+              -I$(top_srcdir)/lib            \
+              -I$(top_srcdir)/src            \
+              -I$(srcdir)
 
-EXTRA_DIST = test307.pl test610.pl test613.pl test1013.pl test1022.pl   \
-  Makefile.inc notexists.pl CMakeLists.txt mk-lib1521.pl .checksrc
+# Get BUNDLE, FIRST_C, FIRST_H, UTILS_C, UTILS_H, CURLX_C, TOOLX_C, TESTS_C variables
+include Makefile.inc
 
-CFLAG_CURL_SYMBOL_HIDING = @CFLAG_CURL_SYMBOL_HIDING@
+EXTRA_DIST = CMakeLists.txt $(FIRST_C) $(FIRST_H) $(UTILS_C) $(UTILS_H) $(TESTS_C) \
+  test307.pl test610.pl test613.pl test1013.pl test1022.pl mk-lib1521.pl
 
 CFLAGS += @CURL_CFLAG_EXTRAS@
 
-CLEANFILES = lib1521.c
-
 # Prevent LIBS from being used for all link targets
 LIBS = $(BLANK_AT_MAKETIME)
 
-if USE_EXPLICIT_LIB_DEPS
-SUPPORTFILES_LIBS = $(top_builddir)/lib/libcurl.la @LIBCURL_LIBS@
-TESTUTIL_LIBS = $(top_builddir)/lib/libcurl.la @LIBCURL_LIBS@
-else
-SUPPORTFILES_LIBS = $(top_builddir)/lib/libcurl.la @CURL_NETWORK_LIBS@
-TESTUTIL_LIBS = $(top_builddir)/lib/libcurl.la @CURL_NETWORK_AND_TIME_LIBS@
-endif
-
-# Dependencies (may need to be overridden)
-LDADD = $(SUPPORTFILES_LIBS)
-
-# Makefile.inc provides the source defines (TESTUTIL, SUPPORTFILES,
-# noinst_PROGRAMS, lib*_SOURCES, and lib*_CFLAGS)
-include Makefile.inc
-
-# Preloading of libhostname allows host name overriding,
-# this is used to make some tests machine independent.
-
-if BUILD_LIBHOSTNAME
-noinst_LTLIBRARIES = libhostname.la
-else
-noinst_LTLIBRARIES =
-endif
-
 if USE_CPPFLAG_CURL_STATICLIB
 AM_CPPFLAGS += -DCURL_STATICLIB
 endif
-
-AM_LDFLAGS =
-AM_CFLAGS =
-
-libhostname_la_CPPFLAGS_EXTRA =
-libhostname_la_LDFLAGS_EXTRA = -module -avoid-version -rpath /nowhere
-libhostname_la_CFLAGS_EXTRA =
-
-libstubgss_la_LDFLAGS_EXTRA =
-
-if CURL_LT_SHLIB_USE_NO_UNDEFINED
-libhostname_la_LDFLAGS_EXTRA += -no-undefined
-libstubgss_la_LDFLAGS_EXTRA += -no-undefined
+if DEBUGBUILD
+AM_CPPFLAGS += -DDEBUGBUILD
 endif
 
-if CURL_LT_SHLIB_USE_MIMPURE_TEXT
-libhostname_la_LDFLAGS_EXTRA += -mimpure-text
-endif
-
-if DOING_CURL_SYMBOL_HIDING
-libhostname_la_CPPFLAGS_EXTRA += -DCURL_HIDDEN_SYMBOLS
-libhostname_la_CFLAGS_EXTRA += $(CFLAG_CURL_SYMBOL_HIDING)
-endif
-
-libhostname_la_CPPFLAGS = $(AM_CPPFLAGS) $(libhostname_la_CPPFLAGS_EXTRA)
-libhostname_la_LDFLAGS = $(AM_LDFLAGS) $(libhostname_la_LDFLAGS_EXTRA)
-libhostname_la_CFLAGS = $(AM_CFLAGS) $(libhostname_la_CFLAGS_EXTRA)
-
-libhostname_la_SOURCES = sethostname.c sethostname.h
-
-libhostname_la_LIBADD =
-libhostname_la_DEPENDENCIES =
-
-# Build a stub gssapi implementation for testing
-if BUILD_STUB_GSS
-noinst_LTLIBRARIES += libstubgss.la
-
-libstubgss_la_CPPFLAGS = $(AM_CPPFLAGS)
-libstubgss_la_LDFLAGS = $(AM_LDFLAGS) $(libstubgss_la_LDFLAGS_EXTRA) -avoid-version -rpath /nowhere
-libstubgss_la_CFLAGS = $(AM_CFLAGS) -g
-
-libstubgss_la_SOURCES = stub_gssapi.c stub_gssapi.h
-
-libstubgss_la_LIBADD =
-libstubgss_la_DEPENDENCIES =
+if USE_CPPFLAG_CURL_STATICLIB
+curlx_c_lib =
+else
+# These are part of the libcurl static lib. Add them here when linking shared.
+curlx_c_lib = $(CURLX_C)
 endif
+$(BUNDLE).c: $(top_srcdir)/scripts/mk-unity.pl Makefile.inc $(FIRST_C) $(UTILS_C) $(curlx_c_lib) $(TOOLX_C) $(TESTS_C) lib1521.c
+	@PERL@ $(top_srcdir)/scripts/mk-unity.pl --include $(UTILS_C) $(curlx_c_lib) $(TOOLX_C) --test $(TESTS_C) lib1521.c > $(BUNDLE).c
 
+noinst_PROGRAMS = $(BUNDLE)
+LDADD = $(top_builddir)/lib/libcurl.la @LIBCURL_PC_LIBS_PRIVATE@
+CLEANFILES = $(BUNDLE).c lib1521.c
 
 lib1521.c: $(top_srcdir)/tests/libtest/mk-lib1521.pl $(top_srcdir)/include/curl/curl.h
-	@PERL@ $(top_srcdir)/tests/libtest/mk-lib1521.pl < $(top_srcdir)/include/curl/curl.h > lib1521.c
+	@PERL@ $(top_srcdir)/tests/libtest/mk-lib1521.pl < $(top_srcdir)/include/curl/curl.h lib1521.c
 
 CHECKSRC = $(CS_$(V))
 CS_0 = @echo "  RUN     " $@;
 CS_1 =
 CS_ = $(CS_0)
 
-checksrc:
-	$(CHECKSRC)@PERL@ $(top_srcdir)/scripts/checksrc.pl -D$(srcdir) $(srcdir)/*.[ch]
+# ignore generated C files since they play by slightly different rules!
+checksrc: lib1521.c
+	$(CHECKSRC)(@PERL@ $(top_srcdir)/scripts/checksrc.pl -D$(srcdir) -W$(srcdir)/$(BUNDLE).c $(FIRST_C) $(FIRST_H) $(UTILS_C) $(UTILS_H) $(TESTS_C))
 
-if CURLDEBUG
-# for debug builds, we scan the sources on all regular make invokes
+if NOT_CURL_CI
 all-local: checksrc
 endif
+
+clean-local:
+	rm -f $(BUNDLE)
diff --git a/third-party/curl/tests/libtest/Makefile.inc b/third-party/curl/tests/libtest/Makefile.inc
index df44f1be1b..bec648542b 100644
--- a/third-party/curl/tests/libtest/Makefile.inc
+++ b/third-party/curl/tests/libtest/Makefile.inc
@@ -21,671 +21,103 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# files used only in some libcurl test programs
-TESTUTIL = testutil.c testutil.h
-
-# files used only in some libcurl test programs
-TSTTRACE = testtrace.c testtrace.h
-
-# files used only in some libcurl test programs
-WARNLESS = ../../lib/warnless.c ../../lib/warnless.h
-
-# files used only in some libcurl test programs
-MULTIBYTE = ../../lib/curl_multibyte.c ../../lib/curl_multibyte.h
-
-# these files are used in every single test program below
-TIMEDIFF = ../../lib/timediff.c ../../lib/timediff.h
-SUPPORTFILES = $(TIMEDIFF) first.c test.h
-
-# These are all libcurl test programs
-noinst_PROGRAMS = chkhostname libauthretry libntlmconnect libprereq      \
- lib500 lib501 lib502 lib503 lib504 lib505 lib506 lib507 lib508 lib509   \
- lib510 lib511 lib512 lib513 lib514 lib515 lib516 lib517 lib518 lib519   \
- lib520 lib521 lib523 lib524 lib525 lib526 lib527 lib529 lib530 lib532   \
- lib533        lib537 lib539 lib540 lib541 lib542 lib543 lib544 lib545   \
- lib547 lib548 lib549 lib552 lib553 lib554 lib555 lib556 lib557 lib558   \
- lib559 lib560 lib562 lib564 lib565 lib566 lib567 lib568 lib569 lib570   \
- lib571 lib572 lib573 lib574 lib575 lib576        lib578 lib579 lib582   \
- lib583 lib584 lib585 lib586 lib587 lib589 lib590 lib591 lib597 lib598   \
- lib599 \
- lib643        lib645 lib650 lib651 lib652 lib653 lib654 lib655 lib658   \
- lib659 lib661 lib666 lib667 lib668 \
- lib670 lib671 lib672 lib673 lib674 lib676 lib677 lib678 \
- lib1156 \
- lib1301 \
- lib1500 lib1501 lib1502 lib1503 lib1504 lib1505 lib1506 lib1507 lib1508 \
- lib1509 lib1510 lib1511 lib1512 lib1513 lib1514 lib1515         lib1517 \
- lib1518         lib1520 lib1521 lib1522 lib1523 \
- lib1525 lib1526 lib1527 lib1528 lib1529 lib1530 lib1531 lib1532 lib1533 \
- lib1534 lib1535 lib1536 lib1537 lib1538 lib1539 \
- lib1540         lib1542 lib1543 \
- lib1550 lib1551 lib1552 lib1553 lib1554 lib1555 lib1556 lib1557 \
- lib1558 lib1559 lib1560 lib1564 lib1565 lib1567 lib1568 lib1569 \
- lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 \
- \
- lib1662 \
- \
- lib1903 lib1905 lib1906 lib1907 lib1908 lib1910 lib1911 lib1912 lib1913 \
-         lib1915 lib1916 lib1917 lib1918 lib1919 \
- lib1933 lib1934 lib1935 lib1936 lib1937 lib1938 lib1939 lib1940 \
- lib1945 lib1946 lib1947 lib1948 lib1955 lib1956 lib1957 lib1958 lib1959 \
- lib1960 lib1964 \
- lib1970 lib1971 lib1972 lib1973 lib1974 lib1975 \
- lib2301 lib2302 lib2304 lib2305 lib2306 \
- lib2402 lib2404 \
- lib2502 \
- lib3010 lib3025 lib3026 lib3027 \
- lib3100 lib3101 lib3102
-
-chkhostname_SOURCES = chkhostname.c ../../lib/curl_gethostname.c
-chkhostname_LDADD = @CURL_NETWORK_LIBS@
-chkhostname_DEPENDENCIES =
-
-libntlmconnect_SOURCES = libntlmconnect.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-libntlmconnect_LDADD = $(TESTUTIL_LIBS)
-
-libauthretry_SOURCES = libauthretry.c $(SUPPORTFILES)
-
-libprereq_SOURCES = libprereq.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-libprereq_LDADD = $(TESTUTIL_LIBS)
-
-lib500_SOURCES = lib500.c $(SUPPORTFILES) $(TESTUTIL) $(TSTTRACE) $(MULTIBYTE)
-lib500_LDADD = $(TESTUTIL_LIBS)
-
-lib501_SOURCES = lib501.c $(SUPPORTFILES)
-
-lib502_SOURCES = lib502.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib502_LDADD = $(TESTUTIL_LIBS)
-
-lib503_SOURCES = lib503.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib503_LDADD = $(TESTUTIL_LIBS)
-
-lib504_SOURCES = lib504.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib504_LDADD = $(TESTUTIL_LIBS)
-
-lib505_SOURCES = lib505.c $(SUPPORTFILES) $(MULTIBYTE)
-
-lib506_SOURCES = lib506.c $(SUPPORTFILES)
-
-lib507_SOURCES = lib507.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib507_LDADD = $(TESTUTIL_LIBS)
-
-lib508_SOURCES = lib508.c $(SUPPORTFILES)
-
-lib509_SOURCES = lib509.c $(SUPPORTFILES)
-
-lib510_SOURCES = lib510.c $(SUPPORTFILES)
-
-lib511_SOURCES = lib511.c $(SUPPORTFILES)
-
-lib512_SOURCES = lib512.c $(SUPPORTFILES)
-
-lib513_SOURCES = lib513.c $(SUPPORTFILES)
-
-lib514_SOURCES = lib514.c $(SUPPORTFILES)
-
-lib515_SOURCES = lib515.c $(SUPPORTFILES)
-
-lib516_SOURCES = lib516.c $(SUPPORTFILES)
-
-lib517_SOURCES = lib517.c $(SUPPORTFILES)
-
-lib518_SOURCES = lib518.c $(SUPPORTFILES) $(WARNLESS) $(MULTIBYTE)
-
-lib519_SOURCES = lib519.c $(SUPPORTFILES)
-
-lib520_SOURCES = lib520.c $(SUPPORTFILES)
-
-lib521_SOURCES = lib521.c $(SUPPORTFILES)
-
-lib523_SOURCES = lib523.c $(SUPPORTFILES)
-
-lib524_SOURCES = lib524.c $(SUPPORTFILES)
-
-lib525_SOURCES = lib525.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) $(MULTIBYTE)
-lib525_LDADD = $(TESTUTIL_LIBS)
-
-lib526_SOURCES = lib526.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib526_LDADD = $(TESTUTIL_LIBS)
-lib526_CPPFLAGS = $(AM_CPPFLAGS) -DLIB526
-
-lib527_SOURCES = lib526.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib527_LDADD = $(TESTUTIL_LIBS)
-lib527_CPPFLAGS = $(AM_CPPFLAGS) -DLIB527
-
-lib529_SOURCES = lib525.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) $(MULTIBYTE)
-lib529_LDADD = $(TESTUTIL_LIBS)
-lib529_CPPFLAGS = $(AM_CPPFLAGS) -DLIB529
-
-lib530_SOURCES = lib530.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib530_LDADD = $(TESTUTIL_LIBS)
-
-lib532_SOURCES = lib526.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib532_LDADD = $(TESTUTIL_LIBS)
-lib532_CPPFLAGS = $(AM_CPPFLAGS) -DLIB532
-
-lib533_SOURCES = lib533.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib533_LDADD = $(TESTUTIL_LIBS)
-
-lib537_SOURCES = lib537.c $(SUPPORTFILES) $(WARNLESS) $(MULTIBYTE)
-
-lib539_SOURCES = lib539.c $(SUPPORTFILES)
-
-lib540_SOURCES = lib540.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib540_LDADD = $(TESTUTIL_LIBS)
-
-lib541_SOURCES = lib541.c $(SUPPORTFILES) $(MULTIBYTE)
-
-lib542_SOURCES = lib542.c $(SUPPORTFILES)
-
-lib543_SOURCES = lib543.c $(SUPPORTFILES)
-
-lib544_SOURCES = lib544.c $(SUPPORTFILES)
-
-lib545_SOURCES = lib544.c $(SUPPORTFILES)
-lib545_CPPFLAGS = $(AM_CPPFLAGS) -DLIB545
-
-lib547_SOURCES = lib547.c $(SUPPORTFILES)
-
-lib548_SOURCES = lib547.c $(SUPPORTFILES)
-lib548_CPPFLAGS = $(AM_CPPFLAGS) -DLIB548
-
-lib549_SOURCES = lib549.c $(SUPPORTFILES)
-
-lib552_SOURCES = lib552.c $(SUPPORTFILES) $(WARNLESS)
-
-lib553_SOURCES = lib553.c $(SUPPORTFILES)
-
-lib554_SOURCES = lib554.c $(SUPPORTFILES)
-
-lib555_SOURCES = lib555.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib555_LDADD = $(TESTUTIL_LIBS)
-
-lib556_SOURCES = lib556.c $(SUPPORTFILES) $(WARNLESS)
-
-lib557_SOURCES = lib557.c $(SUPPORTFILES)
-
-lib558_SOURCES = lib558.c $(SUPPORTFILES)
-
-lib559_SOURCES = lib559.c $(SUPPORTFILES)
-
-lib560_SOURCES = lib560.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib560_LDADD = $(TESTUTIL_LIBS)
-
-lib562_SOURCES = lib562.c $(SUPPORTFILES)
-
-lib564_SOURCES = lib564.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib564_LDADD = $(TESTUTIL_LIBS)
-
-lib565_SOURCES = lib510.c $(SUPPORTFILES)
-lib565_CPPFLAGS = $(AM_CPPFLAGS) -DLIB565
-
-lib566_SOURCES = lib566.c $(SUPPORTFILES) $(MULTIBYTE)
-
-lib567_SOURCES = lib567.c $(SUPPORTFILES)
-
-lib568_SOURCES = lib568.c $(SUPPORTFILES) $(MULTIBYTE)
-
-lib569_SOURCES = lib569.c $(SUPPORTFILES) $(MULTIBYTE)
-
-lib570_SOURCES = lib570.c $(SUPPORTFILES)
-
-lib571_SOURCES = lib571.c $(SUPPORTFILES) $(WARNLESS) $(MULTIBYTE)
-
-lib572_SOURCES = lib572.c $(SUPPORTFILES) $(MULTIBYTE)
-
-lib573_SOURCES = lib573.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) $(TSTTRACE)
-lib573_LDADD = $(TESTUTIL_LIBS)
-
-lib574_SOURCES = lib574.c $(SUPPORTFILES)
-
-lib575_SOURCES = lib575.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib575_LDADD = $(TESTUTIL_LIBS)
-
-lib576_SOURCES = lib576.c $(SUPPORTFILES)
-
-lib578_SOURCES = lib578.c $(SUPPORTFILES) $(MULTIBYTE)
-
-lib579_SOURCES = lib579.c $(SUPPORTFILES) $(MULTIBYTE)
-
-lib582_SOURCES = lib582.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) $(MULTIBYTE)
-lib582_LDADD = $(TESTUTIL_LIBS)
-
-lib583_SOURCES = lib583.c $(SUPPORTFILES)
-
-lib584_SOURCES = lib589.c $(SUPPORTFILES)
-lib584_CPPFLAGS = $(AM_CPPFLAGS) -DLIB584
-
-lib585_SOURCES = lib500.c $(SUPPORTFILES) $(TESTUTIL) $(TSTTRACE) $(MULTIBYTE)
-lib585_LDADD = $(TESTUTIL_LIBS)
-lib585_CPPFLAGS = $(AM_CPPFLAGS) -DLIB585
-
-lib586_SOURCES = lib586.c $(SUPPORTFILES)
-
-lib587_SOURCES = lib554.c $(SUPPORTFILES)
-lib587_CPPFLAGS = $(AM_CPPFLAGS) -DLIB587
-
-lib589_SOURCES = lib589.c $(SUPPORTFILES)
-
-lib590_SOURCES = lib590.c $(SUPPORTFILES)
-
-lib591_SOURCES = lib591.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) $(MULTIBYTE)
-lib591_LDADD = $(TESTUTIL_LIBS)
-
-lib597_SOURCES = lib597.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib597_LDADD = $(TESTUTIL_LIBS)
-
-lib598_SOURCES = lib598.c $(SUPPORTFILES)
-
-lib599_SOURCES = lib599.c $(SUPPORTFILES) $(MULTIBYTE)
-
-lib643_SOURCES = lib643.c $(SUPPORTFILES)
-
-lib645_SOURCES = lib643.c $(SUPPORTFILES)
-lib645_CPPFLAGS = $(AM_CPPFLAGS) -DLIB645
-
-lib650_SOURCES = lib650.c $(SUPPORTFILES)
-
-lib651_SOURCES = lib651.c $(SUPPORTFILES)
-
-lib652_SOURCES = lib652.c $(SUPPORTFILES)
-
-lib653_SOURCES = lib653.c $(SUPPORTFILES)
-
-lib654_SOURCES = lib654.c $(SUPPORTFILES)
-
-lib655_SOURCES = lib655.c $(SUPPORTFILES)
-
-lib658_SOURCES = lib658.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib658_LDADD = $(TESTUTIL_LIBS)
-
-lib659_SOURCES = lib659.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib659_LDADD = $(TESTUTIL_LIBS)
-
-lib661_SOURCES = lib661.c $(SUPPORTFILES)
-
-lib666_SOURCES = lib666.c $(SUPPORTFILES)
-
-lib667_SOURCES = lib667.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib667_LDADD = $(TESTUTIL_LIBS)
-
-lib668_SOURCES = lib668.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib668_LDADD = $(TESTUTIL_LIBS)
-
-lib670_SOURCES = lib670.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib670_LDADD = $(TESTUTIL_LIBS)
-lib670_CPPFLAGS = $(AM_CPPFLAGS) -DLIB670
-
-lib671_SOURCES = lib670.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib671_LDADD = $(TESTUTIL_LIBS)
-lib671_CPPFLAGS = $(AM_CPPFLAGS) -DLIB671
-
-lib672_SOURCES = lib670.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib672_LDADD = $(TESTUTIL_LIBS)
-lib672_CPPFLAGS = $(AM_CPPFLAGS) -DLIB672
-
-lib673_SOURCES = lib670.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib673_LDADD = $(TESTUTIL_LIBS)
-
-lib674_SOURCES = lib674.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib674_LDADD = $(TESTUTIL_LIBS)
-
-lib676_SOURCES = lib676.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib676_LDADD = $(TESTUTIL_LIBS)
-
-lib677_SOURCES = lib677.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) $(MULTIBYTE)
-lib677_LDADD = $(TESTUTIL_LIBS)
-
-lib678_SOURCES = lib678.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) $(MULTIBYTE)
-lib678_LDADD = $(TESTUTIL_LIBS)
-
-lib1301_SOURCES = lib1301.c $(SUPPORTFILES) $(TESTUTIL)
-lib1301_LDADD = $(TESTUTIL_LIBS)
-
-lib1500_SOURCES = lib1500.c $(SUPPORTFILES) $(TESTUTIL)
-lib1500_LDADD = $(TESTUTIL_LIBS)
-
-lib1501_SOURCES = lib1501.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1501_LDADD = $(TESTUTIL_LIBS)
-
-lib1502_SOURCES = lib1502.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1502_LDADD = $(TESTUTIL_LIBS)
-lib1502_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1502
-
-lib1503_SOURCES = lib1502.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1503_LDADD = $(TESTUTIL_LIBS)
-lib1503_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1503
-
-lib1504_SOURCES = lib1502.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1504_LDADD = $(TESTUTIL_LIBS)
-lib1504_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1504
-
-lib1505_SOURCES = lib1502.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1505_LDADD = $(TESTUTIL_LIBS)
-lib1505_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1505
-
-lib1506_SOURCES = lib1506.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1506_LDADD = $(TESTUTIL_LIBS)
-
-lib1156_SOURCES = lib1156.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1156_LDADD = $(TESTUTIL_LIBS)
-
-lib1507_SOURCES = lib1507.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1507_LDADD = $(TESTUTIL_LIBS)
-
-lib1508_SOURCES = lib1508.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1508_LDADD = $(TESTUTIL_LIBS)
-
-lib1509_SOURCES = lib1509.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1509_LDADD = $(TESTUTIL_LIBS)
-
-lib1510_SOURCES = lib1510.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1510_LDADD = $(TESTUTIL_LIBS)
-
-lib1511_SOURCES = lib1511.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1511_LDADD = $(TESTUTIL_LIBS)
-
-lib1512_SOURCES = lib1512.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1512_LDADD = $(TESTUTIL_LIBS)
-
-lib1513_SOURCES = lib1513.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1513_LDADD = $(TESTUTIL_LIBS)
-
-lib1514_SOURCES = lib1514.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1514_LDADD = $(TESTUTIL_LIBS)
-
-lib1515_SOURCES = lib1515.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1515_LDADD = $(TESTUTIL_LIBS)
-
-lib1517_SOURCES = lib1517.c $(SUPPORTFILES)
-
-lib1518_SOURCES = lib1518.c $(SUPPORTFILES)
-
-lib1520_SOURCES = lib1520.c $(SUPPORTFILES)
-
-nodist_lib1521_SOURCES = lib1521.c $(SUPPORTFILES)
-lib1521_CPPFLAGS = $(AM_CPPFLAGS) -I$(srcdir)
-
-lib1522_SOURCES = lib1522.c $(SUPPORTFILES) $(TESTUTIL) $(TSTTRACE)
-lib1522_LDADD = $(TESTUTIL_LIBS)
-
-lib1523_SOURCES = lib1523.c $(SUPPORTFILES)
-
-lib1525_SOURCES = lib1525.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1525_LDADD = $(TESTUTIL_LIBS)
-
-lib1526_SOURCES = lib1526.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1526_LDADD = $(TESTUTIL_LIBS)
-
-lib1527_SOURCES = lib1527.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1527_LDADD = $(TESTUTIL_LIBS)
-
-lib1528_SOURCES = lib1528.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1528_LDADD = $(TESTUTIL_LIBS)
-
-lib1529_SOURCES = lib1529.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1529_LDADD = $(TESTUTIL_LIBS)
-
-lib1530_SOURCES = lib1530.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1530_LDADD = $(TESTUTIL_LIBS)
-
-lib1531_SOURCES = lib1531.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1531_LDADD = $(TESTUTIL_LIBS)
-
-lib1532_SOURCES = lib1532.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1532_LDADD = $(TESTUTIL_LIBS)
-
-lib1533_SOURCES = lib1533.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1533_LDADD = $(TESTUTIL_LIBS)
-
-lib1534_SOURCES = lib1534.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1534_LDADD = $(TESTUTIL_LIBS)
-
-lib1535_SOURCES = lib1535.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1535_LDADD = $(TESTUTIL_LIBS)
-
-lib1536_SOURCES = lib1536.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1536_LDADD = $(TESTUTIL_LIBS)
-
-lib1537_SOURCES = lib1537.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1537_LDADD = $(TESTUTIL_LIBS)
-
-lib1538_SOURCES = lib1538.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1538_LDADD = $(TESTUTIL_LIBS)
-
-lib1539_SOURCES = lib1514.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1539_LDADD = $(TESTUTIL_LIBS)
-lib1539_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1539
-
-lib1540_SOURCES = lib1540.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1540_LDADD = $(TESTUTIL_LIBS)
-
-lib1542_SOURCES = lib1542.c $(SUPPORTFILES) $(TESTUTIL) $(TSTTRACE) $(WARNLESS)
-lib1542_LDADD = $(TESTUTIL_LIBS)
-
-lib1543_SOURCES = lib1518.c $(SUPPORTFILES)
-lib1543_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1543
-
-lib1550_SOURCES = lib1550.c $(SUPPORTFILES)
-
-lib1551_SOURCES = lib1551.c $(SUPPORTFILES)
-
-lib1552_SOURCES = lib1552.c $(SUPPORTFILES) $(TESTUTIL)
-lib1552_LDADD = $(TESTUTIL_LIBS)
-
-lib1553_SOURCES = lib1553.c $(SUPPORTFILES) $(TESTUTIL)
-lib1553_LDADD = $(TESTUTIL_LIBS)
-
-lib1554_SOURCES = lib1554.c $(SUPPORTFILES)
-
-lib1555_SOURCES = lib1555.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1555_LDADD = $(TESTUTIL_LIBS)
-
-lib1556_SOURCES = lib1556.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1556_LDADD = $(TESTUTIL_LIBS)
-
-lib1557_SOURCES = lib1557.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1557_LDADD = $(TESTUTIL_LIBS)
-
-lib1558_SOURCES = lib1558.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1558_LDADD = $(TESTUTIL_LIBS)
-
-lib1559_SOURCES = lib1559.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1559_LDADD = $(TESTUTIL_LIBS)
-
-lib1560_SOURCES = lib1560.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1560_LDADD = $(TESTUTIL_LIBS)
-
-lib1564_SOURCES = lib1564.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1564_LDADD = $(TESTUTIL_LIBS)
-
-lib1565_SOURCES = lib1565.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1565_LDADD = $(TESTUTIL_LIBS)
-
-lib1567_SOURCES = lib1567.c $(SUPPORTFILES)
-
-lib1568_SOURCES = lib1568.c $(SUPPORTFILES)
-
-lib1569_SOURCES = lib1569.c $(SUPPORTFILES)
-
-lib1591_SOURCES = lib1591.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1591_LDADD = $(TESTUTIL_LIBS)
-
-lib1592_SOURCES = lib1592.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1592_LDADD = $(TESTUTIL_LIBS)
-
-lib1593_SOURCES = lib1593.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1593_LDADD = $(TESTUTIL_LIBS)
-
-lib1594_SOURCES = lib1594.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1594_LDADD = $(TESTUTIL_LIBS)
-
-lib1596_SOURCES = lib1594.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1596_LDADD = $(TESTUTIL_LIBS)
-lib1596_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1596
-
-lib1597_SOURCES = lib1597.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1597_LDADD = $(TESTUTIL_LIBS)
-
-lib1662_SOURCES = lib1662.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1662_LDADD = $(TESTUTIL_LIBS)
-
-lib1903_SOURCES = lib1903.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1903_LDADD = $(TESTUTIL_LIBS)
-
-lib1905_SOURCES = lib1905.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1905_LDADD = $(TESTUTIL_LIBS)
-
-lib1906_SOURCES = lib1906.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1906_LDADD = $(TESTUTIL_LIBS)
-
-lib1907_SOURCES = lib1907.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1907_LDADD = $(TESTUTIL_LIBS)
-
-lib1908_SOURCES = lib1908.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1908_LDADD = $(TESTUTIL_LIBS)
-
-lib1910_SOURCES = lib1910.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1910_LDADD = $(TESTUTIL_LIBS)
-
-lib1911_SOURCES = lib1911.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1911_LDADD = $(TESTUTIL_LIBS)
-
-lib1912_SOURCES = lib1912.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1912_LDADD = $(TESTUTIL_LIBS)
-
-lib1913_SOURCES = lib1913.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1913_LDADD = $(TESTUTIL_LIBS)
-
-lib1915_SOURCES = lib1915.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1915_LDADD = $(TESTUTIL_LIBS)
-
-lib1916_SOURCES = lib1916.c $(SUPPORTFILES) $(WARNLESS)
-
-lib1917_SOURCES = lib1916.c $(SUPPORTFILES) $(WARNLESS)
-lib1917_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1917
-
-lib1918_SOURCES = lib1918.c $(SUPPORTFILES) $(WARNLESS)
-
-lib1919_SOURCES = lib1919.c $(SUPPORTFILES) $(WARNLESS)
-
-lib1933_SOURCES = lib1933.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1933_LDADD = $(TESTUTIL_LIBS)
-
-lib1934_SOURCES = lib1934.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1934_LDADD = $(TESTUTIL_LIBS)
-
-lib1935_SOURCES = lib1935.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1935_LDADD = $(TESTUTIL_LIBS)
-
-lib1936_SOURCES = lib1936.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1936_LDADD = $(TESTUTIL_LIBS)
-
-lib1937_SOURCES = lib1937.c $(SUPPORTFILES)
-lib1937_LDADD = $(TESTUTIL_LIBS)
-
-lib1938_SOURCES = lib1938.c $(SUPPORTFILES)
-lib1938_LDADD = $(TESTUTIL_LIBS)
-
-lib1939_SOURCES = lib1939.c $(SUPPORTFILES)
-lib1939_LDADD = $(TESTUTIL_LIBS)
-
-lib1940_SOURCES = lib1940.c $(SUPPORTFILES)
-lib1940_LDADD = $(TESTUTIL_LIBS)
-
-lib1945_SOURCES = lib1945.c $(SUPPORTFILES)
-lib1945_LDADD = $(TESTUTIL_LIBS)
-
-lib1946_SOURCES = lib1940.c $(SUPPORTFILES)
-lib1946_LDADD = $(TESTUTIL_LIBS)
-lib1946_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1946
-
-lib1947_SOURCES = lib1947.c $(SUPPORTFILES)
-lib1947_LDADD = $(TESTUTIL_LIBS)
-
-lib1948_SOURCES = lib1948.c $(SUPPORTFILES)
-lib1948_LDADD = $(TESTUTIL_LIBS)
-
-lib1955_SOURCES = lib1955.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1955_LDADD = $(TESTUTIL_LIBS)
-
-lib1956_SOURCES = lib1956.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1956_LDADD = $(TESTUTIL_LIBS)
-
-lib1957_SOURCES = lib1957.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1957_LDADD = $(TESTUTIL_LIBS)
-
-lib1958_SOURCES = lib1958.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1958_LDADD = $(TESTUTIL_LIBS)
-
-lib1959_SOURCES = lib1959.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1959_LDADD = $(TESTUTIL_LIBS)
-
-lib1960_SOURCES = lib1960.c $(SUPPORTFILES)
-lib1960_LDADD = $(TESTUTIL_LIBS)
-
-lib1964_SOURCES = lib1964.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1964_LDADD = $(TESTUTIL_LIBS)
-
-lib1970_SOURCES = lib1970.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1970_LDADD = $(TESTUTIL_LIBS)
-
-lib1971_SOURCES = lib1971.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1971_LDADD = $(TESTUTIL_LIBS)
-
-lib1972_SOURCES = lib1972.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1972_LDADD = $(TESTUTIL_LIBS)
-
-lib1973_SOURCES = lib1973.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1973_LDADD = $(TESTUTIL_LIBS)
-
-lib1974_SOURCES = lib1974.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1974_LDADD = $(TESTUTIL_LIBS)
-
-lib1975_SOURCES = lib1975.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib1975_LDADD = $(TESTUTIL_LIBS)
-
-lib2301_SOURCES = lib2301.c $(SUPPORTFILES)
-lib2301_LDADD = $(TESTUTIL_LIBS)
-
-lib2302_SOURCES = lib2302.c $(SUPPORTFILES)
-lib2302_LDADD = $(TESTUTIL_LIBS)
-
-lib2304_SOURCES = lib2304.c $(SUPPORTFILES)
-lib2304_LDADD = $(TESTUTIL_LIBS)
-
-lib2305_SOURCES = lib2305.c $(SUPPORTFILES) $(TESTUTIL) $(TSTTRACE) $(MULTIBYTE)
-lib2305_LDADD = $(TESTUTIL_LIBS)
-
-lib2306_SOURCES = lib2306.c $(SUPPORTFILES)
-lib2306_LDADD = $(TESTUTIL_LIBS)
-
-lib2402_SOURCES = lib2402.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib2402_LDADD = $(TESTUTIL_LIBS)
-
-lib2404_SOURCES = lib2404.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib2404_LDADD = $(TESTUTIL_LIBS)
-
-lib2502_SOURCES = lib2502.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib2502_LDADD = $(TESTUTIL_LIBS)
-
-lib3010_SOURCES = lib3010.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib3010_LDADD = $(TESTUTIL_LIBS)
-
-lib3025_SOURCES = lib3025.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib3025_LDADD = $(TESTUTIL_LIBS)
-
-lib3026_SOURCES = lib3026.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib3026_LDADD = $(TESTUTIL_LIBS)
-
-lib3027_SOURCES = lib3027.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib3027_LDADD = $(TESTUTIL_LIBS)
-
-lib3100_SOURCES = lib3100.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib3100_LDADD = $(TESTUTIL_LIBS)
-
-lib3101_SOURCES = lib3101.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib3101_LDADD = $(TESTUTIL_LIBS)
-
-lib3102_SOURCES = lib3102.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-lib3102_LDADD = $(TESTUTIL_LIBS)
+# Shared between CMakeLists.txt and Makefile.am
+
+BUNDLE = libtests
+
+# Files referenced from the bundle source
+FIRST_C = first.c
+FIRST_H = first.h
+
+# Common files used by test programs
+UTILS_C = memptr.c testutil.c testtrace.c
+UTILS_H = testutil.h testtrace.h unitcheck.h
+
+CURLX_C = \
+  ../../lib/curl_threads.c \
+  ../../lib/curlx/fopen.c \
+  ../../lib/curlx/multibyte.c \
+  ../../lib/curlx/strcopy.c \
+  ../../lib/curlx/strerr.c \
+  ../../lib/curlx/strparse.c \
+  ../../lib/curlx/timediff.c \
+  ../../lib/curlx/timeval.c \
+  ../../lib/curlx/version_win32.c \
+  ../../lib/curlx/wait.c \
+  ../../lib/curlx/warnless.c \
+  ../../lib/curlx/winapi.c
+
+TOOLX_C = \
+  ../../src/toolx/tool_time.c
+
+# All libtest programs
+TESTS_C = \
+  cli_ftp_upload.c \
+  cli_h2_pausing.c \
+  cli_h2_serverpush.c \
+  cli_h2_upgrade_extreme.c \
+  cli_hx_download.c \
+  cli_hx_upload.c \
+  cli_tls_session_reuse.c \
+  cli_upload_pausing.c \
+  cli_ws_data.c \
+  cli_ws_pingpong.c \
+  \
+  lib500.c lib501.c lib502.c lib503.c lib504.c lib505.c lib506.c lib507.c \
+  lib508.c lib509.c lib510.c lib511.c lib512.c lib513.c lib514.c lib515.c \
+  lib516.c lib517.c lib518.c lib519.c lib520.c lib521.c lib523.c lib524.c \
+  lib525.c lib526.c                            lib530.c \
+  lib533.c                   lib536.c lib537.c lib539.c lib540.c lib541.c \
+  lib542.c lib543.c lib544.c                   lib547.c          lib549.c \
+  lib552.c lib553.c lib554.c lib555.c lib556.c lib557.c lib558.c lib559.c \
+  lib560.c          lib562.c          lib564.c          lib566.c lib567.c \
+  lib568.c lib569.c lib570.c lib571.c lib572.c lib573.c lib574.c lib575.c \
+  lib576.c          lib578.c lib579.c lib582.c lib583.c \
+  lib586.c                   lib589.c lib590.c lib591.c \
+  lib597.c lib598.c lib599.c \
+  lib643.c \
+  lib650.c lib651.c lib652.c lib653.c lib654.c lib655.c lib658.c lib659.c \
+  lib661.c                                     lib666.c lib667.c lib668.c \
+  lib670.c                            lib674.c lib676.c lib677.c lib678.c \
+  lib694.c lib695.c \
+  lib751.c          lib753.c                                     lib758.c \
+  lib757.c \
+  lib766.c \
+  lib1156.c \
+  lib1301.c                                                   lib1308.c \
+  lib1485.c \
+  lib1500.c lib1501.c lib1502.c                               lib1506.c \
+  lib1507.c lib1508.c lib1509.c lib1510.c lib1511.c lib1512.c lib1513.c \
+  lib1514.c lib1515.c           lib1517.c lib1518.c           lib1520.c \
+  lib1522.c lib1523.c           lib1525.c lib1526.c lib1527.c lib1528.c \
+  lib1529.c lib1530.c lib1531.c lib1532.c lib1533.c lib1534.c lib1535.c \
+  lib1536.c lib1537.c lib1538.c           lib1540.c lib1541.c lib1542.c \
+  lib1545.c                               lib1549.c lib1550.c lib1551.c \
+  lib1552.c lib1553.c lib1554.c lib1555.c lib1556.c lib1557.c lib1558.c \
+  lib1559.c lib1560.c                               lib1564.c lib1565.c \
+  lib1567.c lib1568.c lib1569.c           lib1571.c \
+  lib1576.c lib1582.c lib1587.c lib1588.c lib1589.c \
+  lib1591.c lib1592.c lib1593.c lib1594.c                     lib1597.c \
+  lib1598.c lib1599.c \
+  lib1647.c lib1648.c lib1649.c \
+  lib1662.c \
+  lib1686.c \
+  lib1900.c lib1901.c lib1902.c lib1903.c lib1905.c lib1906.c lib1907.c \
+  lib1908.c           lib1910.c lib1911.c lib1912.c lib1913.c \
+  lib1915.c lib1916.c           lib1918.c lib1919.c lib1920.c lib1921.c \
+  lib1922.c \
+  lib1933.c lib1934.c lib1935.c lib1936.c lib1937.c lib1938.c lib1939.c \
+  lib1940.c                                         lib1945.c \
+  lib1947.c lib1948.c \
+  lib1955.c lib1956.c lib1957.c lib1958.c lib1959.c lib1960.c \
+  lib1964.c lib1965.c           lib1967.c                     lib1970.c \
+  lib1971.c lib1972.c lib1973.c lib1974.c lib1975.c lib1977.c lib1978.c \
+  lib2023.c lib2032.c lib2082.c \
+  lib2301.c lib2302.c lib2304.c           lib2306.c lib2308.c lib2309.c \
+  lib2402.c           lib2404.c lib2405.c \
+  lib2412.c \
+  lib2502.c lib2504.c lib2505.c lib2506.c \
+  lib2700.c \
+  lib3010.c lib3025.c lib3026.c lib3027.c lib3033.c lib3034.c \
+  lib3100.c lib3101.c lib3102.c lib3103.c lib3104.c lib3105.c \
+  lib3207.c lib3208.c
diff --git a/third-party/curl/tests/libtest/chkhostname.c b/third-party/curl/tests/libtest/chkhostname.c
deleted file mode 100644
index e49da133c9..0000000000
--- a/third-party/curl/tests/libtest/chkhostname.c
+++ /dev/null
@@ -1,49 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "curl_setup.h"
-
-#include "curl_gethostname.h"
-
-#define HOSTNAME_MAX 1024
-
-int main(int argc, char *argv[])
-{
-  char buff[HOSTNAME_MAX];
-  if(argc != 2) {
-    printf("Usage: %s EXPECTED_HOSTNAME\n", argv[0]);
-    return 1;
-  }
-
-  if(Curl_gethostname(buff, HOSTNAME_MAX)) {
-    printf("Curl_gethostname() failed\n");
-    return 1;
-  }
-
-  /* compare the name returned by Curl_gethostname() with the expected one */
-  if(strncmp(buff, argv[1], HOSTNAME_MAX)) {
-    printf("got unexpected host name back, LD_PRELOAD failed\n");
-    return 1;
-  }
-  return 0;
-}
diff --git a/third-party/curl/tests/libtest/cli_ftp_upload.c b/third-party/curl/tests/libtest/cli_ftp_upload.c
new file mode 100644
index 0000000000..7e05807b5c
--- /dev/null
+++ b/third-party/curl/tests/libtest/cli_ftp_upload.c
@@ -0,0 +1,182 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#include "testtrace.h"
+
+#ifndef CURL_DISABLE_FTP
+
+struct test_cli_ftp_upload_data {
+  const char *data;
+  size_t data_len;
+  size_t offset;
+  int done;
+};
+
+static size_t test_cli_ftp_upload_read(char *buf,
+                                       size_t nitems, size_t blen,
+                                       void *userdata)
+{
+  struct test_cli_ftp_upload_data *d = userdata;
+  size_t nread = d->data_len - d->offset;
+
+  if(nread) {
+    if(nread > (nitems * blen))
+      nread = (nitems * blen);
+    memcpy(buf, d->data + d->offset, nread);
+    d->offset += nread;
+  }
+  else
+    d->done = 1;
+  return nread;
+}
+
+static void usage_ftp_upload(const char *msg)
+{
+  if(msg)
+    curl_mfprintf(stderr, "%s\n", msg);
+  curl_mfprintf(stderr,
+    "usage: [options] url\n"
+    "  -r <host>:<port>:<addr>  resolve information\n"
+  );
+}
+
+#endif
+
+static CURLcode test_cli_ftp_upload(const char *URL)
+{
+#ifndef CURL_DISABLE_FTP
+  CURLM *multi_handle;
+  CURL *curl_handle;
+  int running_handles = 0;
+  int max_fd = -1;
+  struct timeval timeout;
+  fd_set fdread;
+  fd_set fdwrite;
+  fd_set fdexcep;
+  struct test_cli_ftp_upload_data data;
+  struct curl_slist *host = NULL;
+  const char *resolve = NULL, *url;
+  int ch;
+  CURLcode result = CURLE_FAILED_INIT;
+  curl_off_t uploadsize = -1;
+
+  timeout.tv_sec = 1;
+  timeout.tv_usec = 0;
+
+  (void)URL;
+  while((ch = cgetopt(test_argc, test_argv, "r:")) != -1) {
+    switch(ch) {
+    case 'r':
+      resolve = coptarg;
+      break;
+    default:
+      usage_ftp_upload("unknown option");
+      return (CURLcode)1;
+    }
+  }
+  test_argc -= coptind;
+  test_argv += coptind;
+  if(test_argc != 1) {
+    usage_ftp_upload("not enough arguments");
+    return (CURLcode)2;
+  }
+  url = test_argv[0];
+
+  if(resolve)
+    host = curl_slist_append(NULL, resolve);
+
+  memset(&data, 0, sizeof(data));
+  data.data = "abcdefghijklmnopqrstuvwxyz"
+              "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+  data.data_len = strlen(data.data);
+
+  curl_global_init(CURL_GLOBAL_ALL);
+  multi_handle = curl_multi_init();
+  curl_handle = curl_easy_init();
+
+  curl_easy_setopt(curl_handle, CURLOPT_FTPPORT, "-");
+  curl_easy_setopt(curl_handle, CURLOPT_FTP_USE_EPRT, 1L);
+  curl_easy_setopt(curl_handle, CURLOPT_SSL_VERIFYPEER, 0L);
+  curl_easy_setopt(curl_handle, CURLOPT_SSL_VERIFYHOST, 0L);
+  curl_easy_setopt(curl_handle, CURLOPT_USE_SSL, CURLUSESSL_TRY);
+  curl_easy_setopt(curl_handle, CURLOPT_URL, url);
+  curl_easy_setopt(curl_handle, CURLOPT_USERPWD, NULL);
+  curl_easy_setopt(curl_handle, CURLOPT_FTP_CREATE_MISSING_DIRS,
+                   CURLFTP_CREATE_DIR);
+  curl_easy_setopt(curl_handle, CURLOPT_UPLOAD, 1L);
+  curl_easy_setopt(curl_handle, CURLOPT_READFUNCTION,
+                   test_cli_ftp_upload_read);
+  curl_easy_setopt(curl_handle, CURLOPT_READDATA, &data);
+  curl_easy_setopt(curl_handle, CURLOPT_INFILESIZE_LARGE, uploadsize);
+
+  curl_easy_setopt(curl_handle, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl_handle, CURLOPT_DEBUGFUNCTION, cli_debug_cb);
+  if(host)
+    curl_easy_setopt(curl_handle, CURLOPT_RESOLVE, host);
+
+  curl_multi_add_handle(multi_handle, curl_handle);
+  curl_multi_perform(multi_handle, &running_handles);
+  while(running_handles && !data.done) {
+    FD_ZERO(&fdread);
+    FD_ZERO(&fdwrite);
+    FD_ZERO(&fdexcep);
+
+    curl_multi_fdset(multi_handle, &fdread, &fdwrite, &fdexcep, &max_fd);
+    select(max_fd + 1, &fdread, &fdwrite, &fdexcep, &timeout);
+    curl_multi_perform(multi_handle, &running_handles);
+  }
+  while(running_handles) {
+    curl_mfprintf(stderr, "reports to hang herel\n");
+    curl_multi_perform(multi_handle, &running_handles);
+  }
+
+  while(1) {
+    int msgq = 0;
+    struct CURLMsg *msg = curl_multi_info_read(multi_handle, &msgq);
+    if(msg && (msg->msg == CURLMSG_DONE)) {
+      if(msg->easy_handle == curl_handle) {
+        result = msg->data.result;
+      }
+    }
+    else
+      break;
+  }
+
+  curl_multi_remove_handle(multi_handle, curl_handle);
+
+  curl_easy_reset(curl_handle);
+  curl_easy_cleanup(curl_handle);
+  curl_multi_cleanup(multi_handle);
+  curl_global_cleanup();
+  curl_slist_free_all(host);
+
+  curl_mfprintf(stderr, "transfer result: %d\n", (int)result);
+  return result;
+#else /* !CURL_DISABLE_FTP */
+  (void)URL;
+  curl_mfprintf(stderr, "FTP not enabled in libcurl\n");
+  return (CURLcode)1;
+#endif /* CURL_DISABLE_FTP */
+}
diff --git a/third-party/curl/tests/libtest/cli_h2_pausing.c b/third-party/curl/tests/libtest/cli_h2_pausing.c
new file mode 100644
index 0000000000..bf98d03eca
--- /dev/null
+++ b/third-party/curl/tests/libtest/cli_h2_pausing.c
@@ -0,0 +1,316 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/* This is based on the PoC client of issue #11982
+ */
+#include "first.h"
+
+#include "testtrace.h"
+
+static void usage_h2_pausing(const char *msg)
+{
+  if(msg)
+    curl_mfprintf(stderr, "%s\n", msg);
+  curl_mfprintf(stderr,
+    "usage: [options] url\n"
+    "  pause downloads with following options:\n"
+    "  -V http_version (http/1.1, h2, h3) http version to use\n"
+  );
+}
+
+struct handle {
+  size_t idx;
+  int paused;
+  int resumed;
+  int errored;
+  int fail_write;
+  CURL *curl;
+};
+
+static size_t cb(char *data, size_t size, size_t nmemb, void *clientp)
+{
+  size_t realsize = size * nmemb;
+  struct handle *handle = (struct handle *)clientp;
+  curl_off_t totalsize;
+
+  (void)data;
+  if(curl_easy_getinfo(handle->curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD_T,
+                       &totalsize) == CURLE_OK)
+    curl_mfprintf(stderr, "INFO: [%zu] write, "
+                  "Content-Length %" CURL_FORMAT_CURL_OFF_T "\n",
+                  handle->idx, totalsize);
+
+  if(!handle->resumed) {
+    ++handle->paused;
+    curl_mfprintf(stderr, "INFO: [%zu] write, PAUSING %d time on %zu bytes\n",
+                  handle->idx, handle->paused, realsize);
+    assert(handle->paused == 1);
+    return CURL_WRITEFUNC_PAUSE;
+  }
+  if(handle->fail_write) {
+    ++handle->errored;
+    curl_mfprintf(stderr, "INFO: [%zu] FAIL write of %zu bytes, %d time\n",
+                  handle->idx, realsize, handle->errored);
+    return CURL_WRITEFUNC_ERROR;
+  }
+  curl_mfprintf(stderr, "INFO: [%zu] write, accepting %zu bytes\n",
+                handle->idx, realsize);
+  return realsize;
+}
+
+static CURLcode test_cli_h2_pausing(const char *URL)
+{
+  struct handle handles[2];
+  CURLM *multi = NULL;
+  int still_running = 1, msgs_left, numfds;
+  size_t i;
+  CURLMsg *msg;
+  int rounds = 0;
+  CURLcode result = CURLE_OK;
+  CURLU *cu;
+  struct curl_slist *resolve = NULL;
+  char resolve_buf[1024];
+  const char *url;
+  char *host = NULL, *port = NULL;
+  int all_paused = 0;
+  int resume_round = -1;
+  long http_version = CURL_HTTP_VERSION_2_0;
+  int ch;
+
+  (void)URL;
+
+  while((ch = cgetopt(test_argc, test_argv, "hV:")) != -1) {
+    switch(ch) {
+    case 'h':
+      usage_h2_pausing(NULL);
+      return (CURLcode)2;
+    case 'V': {
+      if(!strcmp("http/1.1", coptarg))
+        http_version = CURL_HTTP_VERSION_1_1;
+      else if(!strcmp("h2", coptarg))
+        http_version = CURL_HTTP_VERSION_2_0;
+      else if(!strcmp("h3", coptarg))
+        http_version = CURL_HTTP_VERSION_3ONLY;
+      else {
+        usage_h2_pausing("invalid http version");
+        return (CURLcode)1;
+      }
+      break;
+    }
+    default:
+      usage_h2_pausing("invalid option");
+      return (CURLcode)1;
+    }
+  }
+  test_argc -= coptind;
+  test_argv += coptind;
+
+  if(test_argc != 1) {
+    curl_mfprintf(stderr, "ERROR: need URL as argument\n");
+    return (CURLcode)2;
+  }
+  url = test_argv[0];
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return (CURLcode)3;
+  }
+
+  curl_global_trace("ids,time,http/2,http/3");
+
+  memset(handles, 0, sizeof(handles));
+
+  cu = curl_url();
+  if(!cu) {
+    curl_mfprintf(stderr, "out of memory\n");
+    result = (CURLcode)1;
+    goto cleanup;
+  }
+  if(curl_url_set(cu, CURLUPART_URL, url, 0)) {
+    curl_mfprintf(stderr, "not a URL: '%s'\n", url);
+    result = (CURLcode)1;
+    goto cleanup;
+  }
+  if(curl_url_get(cu, CURLUPART_HOST, &host, 0)) {
+    curl_mfprintf(stderr, "could not get host of '%s'\n", url);
+    result = (CURLcode)1;
+    goto cleanup;
+  }
+  if(curl_url_get(cu, CURLUPART_PORT, &port, 0)) {
+    curl_mfprintf(stderr, "could not get port of '%s'\n", url);
+    result = (CURLcode)1;
+    goto cleanup;
+  }
+
+  curl_msnprintf(resolve_buf, sizeof(resolve_buf) - 1, "%s:%s:127.0.0.1",
+                 host, port);
+  resolve = curl_slist_append(resolve, resolve_buf);
+
+  for(i = 0; i < CURL_ARRAYSIZE(handles); i++) {
+    handles[i].idx = i;
+    handles[i].paused = 0;
+    handles[i].resumed = 0;
+    handles[i].errored = 0;
+    handles[i].fail_write = 1;
+    handles[i].curl = curl_easy_init();
+    if(!handles[i].curl ||
+       curl_easy_setopt(handles[i].curl, CURLOPT_WRITEFUNCTION, cb)
+         != CURLE_OK ||
+       curl_easy_setopt(handles[i].curl, CURLOPT_WRITEDATA, &handles[i])
+         != CURLE_OK ||
+       curl_easy_setopt(handles[i].curl, CURLOPT_FOLLOWLOCATION, 1L)
+         != CURLE_OK ||
+       curl_easy_setopt(handles[i].curl, CURLOPT_VERBOSE, 1L) != CURLE_OK ||
+       curl_easy_setopt(handles[i].curl, CURLOPT_DEBUGFUNCTION, cli_debug_cb)
+         != CURLE_OK ||
+       curl_easy_setopt(handles[i].curl, CURLOPT_SSL_VERIFYPEER, 0L)
+         != CURLE_OK ||
+       curl_easy_setopt(handles[i].curl, CURLOPT_RESOLVE, resolve)
+         != CURLE_OK ||
+       curl_easy_setopt(handles[i].curl, CURLOPT_PIPEWAIT, 1L) != CURLE_OK ||
+       curl_easy_setopt(handles[i].curl, CURLOPT_URL, url) != CURLE_OK) {
+       curl_mfprintf(stderr, "failed configuring easy handle - bailing out\n");
+      result = (CURLcode)2;
+      goto cleanup;
+    }
+    curl_easy_setopt(handles[i].curl, CURLOPT_HTTP_VERSION, http_version);
+  }
+
+  multi = curl_multi_init();
+  if(!multi) {
+    curl_mfprintf(stderr, "curl_multi_init() failed - bailing out\n");
+    result = (CURLcode)2;
+    goto cleanup;
+  }
+
+  for(i = 0; i < CURL_ARRAYSIZE(handles); i++) {
+    if(curl_multi_add_handle(multi, handles[i].curl) != CURLM_OK) {
+      curl_mfprintf(stderr, "curl_multi_add_handle() failed - bailing out\n");
+      result = (CURLcode)2;
+      goto cleanup;
+    }
+  }
+
+  for(rounds = 0;; rounds++) {
+    curl_mfprintf(stderr, "INFO: multi_perform round %d\n", rounds);
+    if(curl_multi_perform(multi, &still_running) != CURLM_OK) {
+      curl_mfprintf(stderr, "curl_multi_perform() failed - bailing out\n");
+      result = (CURLcode)2;
+      goto cleanup;
+    }
+
+    if(!still_running) {
+      int as_expected = 1;
+      curl_mfprintf(stderr, "INFO: no more handles running\n");
+      for(i = 0; i < CURL_ARRAYSIZE(handles); i++) {
+        if(!handles[i].paused) {
+          curl_mfprintf(stderr, "ERROR: [%zu] NOT PAUSED\n", i);
+          as_expected = 0;
+        }
+        else if(handles[i].paused != 1) {
+          curl_mfprintf(stderr, "ERROR: [%zu] PAUSED %d times!\n",
+                        i, handles[i].paused);
+          as_expected = 0;
+        }
+        else if(!handles[i].resumed) {
+          curl_mfprintf(stderr, "ERROR: [%zu] NOT resumed!\n", i);
+          as_expected = 0;
+        }
+        else if(handles[i].errored != 1) {
+          curl_mfprintf(stderr, "ERROR: [%zu] NOT errored once, %d instead!\n",
+                        i, handles[i].errored);
+          as_expected = 0;
+        }
+      }
+      if(!as_expected) {
+        curl_mfprintf(stderr, "ERROR: handles not in expected state "
+                      "after %d rounds\n", rounds);
+        result = (CURLcode)1;
+      }
+      break;
+    }
+
+    if(curl_multi_poll(multi, NULL, 0, 100, &numfds) != CURLM_OK) {
+      curl_mfprintf(stderr, "curl_multi_poll() failed - bailing out\n");
+      result = (CURLcode)2;
+      goto cleanup;
+    }
+
+    /* !checksrc! disable EQUALSNULL 1 */
+    while((msg = curl_multi_info_read(multi, &msgs_left)) != NULL) {
+      if(msg->msg == CURLMSG_DONE) {
+        for(i = 0; i < CURL_ARRAYSIZE(handles); i++) {
+          if(msg->easy_handle == handles[i].curl) {
+            if(handles[i].paused != 1 || !handles[i].resumed) {
+              curl_mfprintf(stderr, "ERROR: [%zu] done, paused=%d, "
+                            "resumed=%d, result %d - wtf?\n", i,
+                            handles[i].paused,
+                            handles[i].resumed, (int)msg->data.result);
+              result = (CURLcode)1;
+              goto cleanup;
+            }
+          }
+        }
+      }
+    }
+
+    /* Successfully paused? */
+    if(!all_paused) {
+      for(i = 0; i < CURL_ARRAYSIZE(handles); i++) {
+        if(!handles[i].paused) {
+          break;
+        }
+      }
+      all_paused = (i == CURL_ARRAYSIZE(handles));
+      if(all_paused) {
+        curl_mfprintf(stderr, "INFO: all transfers paused\n");
+        /* give transfer some rounds to mess things up */
+        resume_round = rounds + 2;
+      }
+    }
+    if(resume_round > 0 && rounds == resume_round) {
+      /* time to resume */
+      for(i = 0; i < CURL_ARRAYSIZE(handles); i++) {
+        curl_mfprintf(stderr, "INFO: [%zu] resumed\n", i);
+        handles[i].resumed = 1;
+        curl_easy_pause(handles[i].curl, CURLPAUSE_CONT);
+      }
+    }
+  }
+
+cleanup:
+
+  for(i = 0; i < CURL_ARRAYSIZE(handles); i++) {
+    curl_multi_remove_handle(multi, handles[i].curl);
+    curl_easy_cleanup(handles[i].curl);
+  }
+
+  curl_slist_free_all(resolve);
+  curl_free(host);
+  curl_free(port);
+  curl_url_cleanup(cu);
+  curl_multi_cleanup(multi);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/cli_h2_serverpush.c b/third-party/curl/tests/libtest/cli_h2_serverpush.c
new file mode 100644
index 0000000000..8a16b01eba
--- /dev/null
+++ b/third-party/curl/tests/libtest/cli_h2_serverpush.c
@@ -0,0 +1,192 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#include "testtrace.h"
+
+static FILE *out_download = NULL;
+
+static int setup_h2_serverpush(CURL *curl, const char *url)
+{
+  out_download = curlx_fopen("download_0.data", "wb");
+  if(!out_download)
+    return 1;  /* failed */
+
+  curl_easy_setopt(curl, CURLOPT_URL, url);
+  curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
+  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
+
+  curl_easy_setopt(curl, CURLOPT_WRITEDATA, out_download);
+
+  /* please be verbose */
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
+  curl_easy_setopt(curl, CURLOPT_DEBUGDATA, &debug_config);
+
+  /* wait for pipe connection to confirm */
+  curl_easy_setopt(curl, CURLOPT_PIPEWAIT, 1L);
+
+  return 0; /* all is good */
+}
+
+static FILE *out_push = NULL;
+
+/* called when there is an incoming push */
+static int server_push_callback(CURL *parent,
+                                CURL *curl,
+                                size_t num_headers,
+                                struct curl_pushheaders *headers,
+                                void *userp)
+{
+  const char *headp;
+  size_t i;
+  int *transfers = (int *)userp;
+  char filename[128];
+  static unsigned int count = 0;
+
+  (void)parent;
+
+  curl_msnprintf(filename, sizeof(filename) - 1, "push%u", count++);
+
+  /* here's a new stream, save it in a new file for each new push */
+  out_push = curlx_fopen(filename, "wb");
+  if(!out_push) {
+    /* if we cannot save it, deny it */
+    curl_mfprintf(stderr, "Failed to create output file for push\n");
+    return CURL_PUSH_DENY;
+  }
+
+  /* write to this file */
+  curl_easy_setopt(curl, CURLOPT_WRITEDATA, out_push);
+
+  curl_mfprintf(stderr, "**** push callback approves stream %u, "
+                "got %zu headers!\n", count, num_headers);
+
+  for(i = 0; i < num_headers; i++) {
+    headp = curl_pushheader_bynum(headers, i);
+    curl_mfprintf(stderr, "**** header %zu: %s\n", i, headp);
+  }
+
+  headp = curl_pushheader_byname(headers, ":path");
+  if(headp) {
+    curl_mfprintf(stderr, "**** The PATH is %s\n",
+                  headp /* skip :path + colon */);
+  }
+
+  (*transfers)++; /* one more */
+
+  return CURL_PUSH_OK;
+}
+
+/*
+ * Download a file over HTTP/2, take care of server push.
+ */
+static CURLcode test_cli_h2_serverpush(const char *URL)
+{
+  CURL *curl = NULL;
+  CURLM *multi;
+  int transfers = 1; /* we start with one */
+  CURLcode result = CURLE_OK;
+
+  debug_config.nohex = TRUE;
+  debug_config.tracetime = FALSE;
+
+  if(!URL) {
+    curl_mfprintf(stderr, "need URL as argument\n");
+    return (CURLcode)2;
+  }
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return (CURLcode)3;
+  }
+
+  multi = curl_multi_init();
+  if(!multi) {
+    result = (CURLcode)1;
+    goto cleanup;
+  }
+
+  curl = curl_easy_init();
+  if(!curl) {
+    result = (CURLcode)1;
+    goto cleanup;
+  }
+
+  if(setup_h2_serverpush(curl, URL)) {
+    curl_mfprintf(stderr, "failed\n");
+    result = (CURLcode)1;
+    goto cleanup;
+  }
+
+  curl_multi_setopt(multi, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
+  curl_multi_setopt(multi, CURLMOPT_PUSHFUNCTION, server_push_callback);
+  curl_multi_setopt(multi, CURLMOPT_PUSHDATA, &transfers);
+
+  curl_multi_add_handle(multi, curl);
+
+  do {
+    struct CURLMsg *m;
+    int still_running; /* keep number of running handles */
+    CURLMcode mresult = curl_multi_perform(multi, &still_running);
+
+    if(still_running)
+      /* wait for activity, timeout or "nothing" */
+      mresult = curl_multi_poll(multi, NULL, 0, 1000, NULL);
+
+    if(mresult)
+      break;
+
+    /*
+     * A little caution when doing server push is that libcurl itself has
+     * created and added one or more easy handles but we need to clean them up
+     * when we are done.
+     */
+    do {
+      int msgq = 0;
+      m = curl_multi_info_read(multi, &msgq);
+      if(m && (m->msg == CURLMSG_DONE)) {
+        CURL *easy = m->easy_handle;
+        transfers--;
+        curl_multi_remove_handle(multi, easy);
+        curl_easy_cleanup(easy);
+      }
+    } while(m);
+
+  } while(transfers); /* as long as we have transfers going */
+
+cleanup:
+
+  curl_multi_cleanup(multi);
+
+  if(out_download)
+    curlx_fclose(out_download);
+  if(out_push)
+    curlx_fclose(out_push);
+
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/cli_h2_upgrade_extreme.c b/third-party/curl/tests/libtest/cli_h2_upgrade_extreme.c
new file mode 100644
index 0000000000..9df8640cff
--- /dev/null
+++ b/third-party/curl/tests/libtest/cli_h2_upgrade_extreme.c
@@ -0,0 +1,171 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#include "testtrace.h"
+
+static size_t write_h2_upg_extreme_cb(char *ptr, size_t size, size_t nmemb,
+                                      void *opaque)
+{
+  (void)ptr;
+  (void)opaque;
+  return size * nmemb;
+}
+
+static CURLcode test_cli_h2_upgrade_extreme(const char *URL)
+{
+  CURLM *multi = NULL;
+  CURL *curl;
+  CURLMcode mresult;
+  int running_handles = 0, start_count, numfds;
+  CURLMsg *msg;
+  int msgs_in_queue;
+  char range[128];
+  CURLcode result = (CURLcode)1;
+
+  if(!URL) {
+    curl_mfprintf(stderr, "need URL as argument\n");
+    return (CURLcode)2;
+  }
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return (CURLcode)3;
+  }
+
+  multi = curl_multi_init();
+  if(!multi) {
+    curl_mfprintf(stderr, "curl_multi_init failed\n");
+    goto cleanup;
+  }
+
+  start_count = 200;
+  do {
+    if(start_count) {
+      curl = curl_easy_init();
+      if(!curl) {
+        curl_mfprintf(stderr, "curl_easy_init failed\n");
+        goto cleanup;
+      }
+      curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+      curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, cli_debug_cb);
+      curl_easy_setopt(curl, CURLOPT_URL, URL);
+      curl_easy_setopt(curl, CURLOPT_NOSIGNAL, 1L);
+      curl_easy_setopt(curl, CURLOPT_AUTOREFERER, 1L);
+      curl_easy_setopt(curl, CURLOPT_FAILONERROR, 1L);
+      curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
+      curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_h2_upg_extreme_cb);
+      curl_easy_setopt(curl, CURLOPT_WRITEDATA, NULL);
+      curl_easy_setopt(curl, CURLOPT_HTTPGET, 1L);
+      curl_msnprintf(range, sizeof(range),
+                     "%" CURL_FORMAT_CURL_OFF_T "-"
+                     "%" CURL_FORMAT_CURL_OFF_T,
+                     (curl_off_t)0,
+                     (curl_off_t)16384);
+      curl_easy_setopt(curl, CURLOPT_RANGE, range);
+
+      mresult = curl_multi_add_handle(multi, curl);
+      if(mresult != CURLM_OK) {
+        curl_mfprintf(stderr, "curl_multi_add_handle: %s\n",
+                      curl_multi_strerror(mresult));
+        curl_easy_cleanup(curl);
+        goto cleanup;
+      }
+      --start_count;
+    }
+
+    mresult = curl_multi_perform(multi, &running_handles);
+    if(mresult != CURLM_OK) {
+      curl_mfprintf(stderr, "curl_multi_perform: %s\n",
+                    curl_multi_strerror(mresult));
+      goto cleanup;
+    }
+
+    if(running_handles) {
+      mresult = curl_multi_poll(multi, NULL, 0, 1000000, &numfds);
+      if(mresult != CURLM_OK) {
+        curl_mfprintf(stderr, "curl_multi_poll: %s\n",
+                      curl_multi_strerror(mresult));
+        goto cleanup;
+      }
+    }
+
+    /* Check for finished handles and remove. */
+    /* !checksrc! disable EQUALSNULL 1 */
+    while((msg = curl_multi_info_read(multi, &msgs_in_queue)) != NULL) {
+      if(msg->msg == CURLMSG_DONE) {
+        long status = 0;
+        curl_off_t xfer_id;
+        curl_easy_getinfo(msg->easy_handle, CURLINFO_XFER_ID, &xfer_id);
+        curl_easy_getinfo(msg->easy_handle, CURLINFO_RESPONSE_CODE, &status);
+        if(msg->data.result == CURLE_SEND_ERROR ||
+           msg->data.result == CURLE_RECV_ERROR) {
+          /* We get these if the server had a GOAWAY in transit on
+           * reusing a connection */
+        }
+        else if(msg->data.result) {
+          curl_mfprintf(stderr, "transfer #%" CURL_FORMAT_CURL_OFF_T
+                        ": failed with %d\n", xfer_id, (int)msg->data.result);
+          goto cleanup;
+        }
+        else if(status != 206) {
+          curl_mfprintf(stderr, "transfer #%" CURL_FORMAT_CURL_OFF_T
+                        ": wrong http status %ld (expected 206)\n", xfer_id,
+                        status);
+          goto cleanup;
+        }
+        curl_multi_remove_handle(multi, msg->easy_handle);
+        curl_easy_cleanup(msg->easy_handle);
+        curl_mfprintf(stderr, "transfer #%" CURL_FORMAT_CURL_OFF_T " retiring "
+                      "(%d now running)\n", xfer_id, running_handles);
+      }
+    }
+
+    curl_mfprintf(stderr, "running_handles=%d, yet_to_start=%d\n",
+                  running_handles, start_count);
+
+  } while(running_handles > 0 || start_count);
+
+  curl_mfprintf(stderr, "exiting\n");
+  result = CURLE_OK;
+
+cleanup:
+
+  if(multi) {
+    CURL **list = curl_multi_get_handles(multi);
+    if(list) {
+      int i;
+      for(i = 0; list[i]; i++) {
+        curl_multi_remove_handle(multi, list[i]);
+        curl_easy_cleanup(list[i]);
+      }
+      curl_free(list);
+    }
+    curl_multi_cleanup(multi);
+  }
+
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/cli_hx_download.c b/third-party/curl/tests/libtest/cli_hx_download.c
new file mode 100644
index 0000000000..b472ed5691
--- /dev/null
+++ b/third-party/curl/tests/libtest/cli_hx_download.c
@@ -0,0 +1,607 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#include "testtrace.h"
+
+#ifdef USE_OPENSSL
+#include <openssl/ssl.h>
+#endif
+#ifdef USE_WOLFSSL
+#include <wolfssl/options.h>
+#include <wolfssl/version.h>
+#include <wolfssl/ssl.h>
+#endif
+#ifdef USE_GNUTLS
+#include <gnutls/gnutls.h>
+#endif
+#ifdef USE_MBEDTLS
+#include <mbedtls/ssl.h>
+#endif
+#ifdef USE_RUSTLS
+#include <rustls.h>
+#endif
+#ifdef USE_SCHANNEL
+#include <sspi.h>  /* for CtxtHandle, QueryContextAttributes() */
+#include <schannel.h>  /* for SecPkgContext_ConnectionInfo,
+                          SECPKG_ATTR_CONNECTION_INFO */
+#endif
+
+static int verbose_d = 1;
+
+struct transfer_d {
+  size_t idx;
+  CURL *curl;
+  char filename[128];
+  FILE *out;
+  curl_off_t recv_size;
+  curl_off_t fail_at;
+  curl_off_t pause_at;
+  curl_off_t abort_at;
+  int started;
+  int paused;
+  int resumed;
+  int done;
+  int checked_ssl;
+  CURLcode result;
+};
+
+static size_t transfer_count_d = 1;
+static struct transfer_d *transfer_d;
+static int forbid_reuse_d = 0;
+
+static struct transfer_d *get_transfer_for_easy_d(CURL *curl)
+{
+  size_t i;
+  for(i = 0; i < transfer_count_d; ++i) {
+    if(curl == transfer_d[i].curl)
+      return &transfer_d[i];
+  }
+  return NULL;
+}
+
+static size_t my_write_d_cb(char *buf, size_t nitems, size_t buflen,
+                            void *userdata)
+{
+  struct transfer_d *t = userdata;
+  curl_off_t blen = nitems * buflen;
+  size_t nwritten;
+
+  curl_mfprintf(stderr, "[t-%zu] RECV %" CURL_FORMAT_CURL_OFF_T " bytes, "
+                "total=%" CURL_FORMAT_CURL_OFF_T ", "
+                "pause_at=%" CURL_FORMAT_CURL_OFF_T "\n",
+                t->idx, blen, t->recv_size, t->pause_at);
+  if(!t->out) {
+    curl_msnprintf(t->filename, sizeof(t->filename) - 1, "download_%zu.data",
+                   t->idx);
+    t->out = curlx_fopen(t->filename, "wb");
+    if(!t->out)
+      return 0;
+  }
+
+  if(!t->resumed &&
+     t->recv_size < t->pause_at &&
+     ((t->recv_size + (curl_off_t)blen) >= t->pause_at)) {
+    curl_mfprintf(stderr, "[t-%zu] PAUSE\n", t->idx);
+    t->paused = 1;
+    return CURL_WRITEFUNC_PAUSE;
+  }
+
+  nwritten = fwrite(buf, buflen, nitems, t->out);
+  if(nwritten < nitems) {
+    curl_mfprintf(stderr, "[t-%zu] write failure\n", t->idx);
+    return 0;
+  }
+  t->recv_size += blen;
+  if(t->fail_at > 0 && t->recv_size >= t->fail_at) {
+    curl_mfprintf(stderr, "[t-%zu] FAIL by write callback at "
+                  "%" CURL_FORMAT_CURL_OFF_T " bytes\n", t->idx, t->recv_size);
+    return CURL_WRITEFUNC_ERROR;
+  }
+
+  return (size_t)blen;
+}
+
+static int my_progress_d_cb(void *userdata,
+                            curl_off_t dltotal, curl_off_t dlnow,
+                            curl_off_t ultotal, curl_off_t ulnow)
+{
+  struct transfer_d *t = userdata;
+  (void)ultotal;
+  (void)ulnow;
+  (void)dltotal;
+  if(t->abort_at > 0 && dlnow >= t->abort_at) {
+    curl_mfprintf(stderr, "[t-%zu] ABORT by progress_cb at "
+                  "%" CURL_FORMAT_CURL_OFF_T " bytes\n", t->idx, dlnow);
+    return 1;
+  }
+
+#if defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_WOLFSSL) || \
+  defined(USE_MBEDTLS) || defined(USE_RUSTLS) || defined(USE_SCHANNEL)
+  if(!t->checked_ssl && dlnow > 0) {
+    struct curl_tlssessioninfo *tls;
+    CURLcode result;
+
+    t->checked_ssl = TRUE;
+    result = curl_easy_getinfo(t->curl, CURLINFO_TLS_SSL_PTR, &tls);
+    if(result) {
+      curl_mfprintf(stderr, "[t-%zu] info CURLINFO_TLS_SSL_PTR failed: %d\n",
+                    t->idx, (int)result);
+      assert(0);
+    }
+    else {
+      switch(tls->backend) {
+#ifdef USE_OPENSSL
+      case CURLSSLBACKEND_OPENSSL: {
+        const char *version = SSL_get_version((SSL *)tls->internals);
+        assert(version);
+        assert(strcmp(version, "unknown"));
+        curl_mfprintf(stderr, "[t-%zu] info OpenSSL using %s\n",
+                      t->idx, version);
+        break;
+      }
+#endif
+#ifdef USE_WOLFSSL
+      case CURLSSLBACKEND_WOLFSSL: {
+        const char *version = wolfSSL_get_version((WOLFSSL *)tls->internals);
+        assert(version);
+        assert(strcmp(version, "unknown"));
+        curl_mfprintf(stderr, "[t-%zu] info wolfSSL using %s\n",
+                      t->idx, version);
+        break;
+      }
+#endif
+#ifdef USE_GNUTLS
+      case CURLSSLBACKEND_GNUTLS: {
+        gnutls_protocol_t v = gnutls_protocol_get_version(
+          (gnutls_session_t)tls->internals);
+        assert(v);
+        curl_mfprintf(stderr, "[t-%zu] info GnuTLS using %s\n",
+                      t->idx, gnutls_protocol_get_name(v));
+        break;
+      }
+#endif
+#ifdef USE_MBEDTLS
+      case CURLSSLBACKEND_MBEDTLS: {
+        const char *version =
+          mbedtls_ssl_get_version((mbedtls_ssl_context *)tls->internals);
+        assert(version);
+        assert(strcmp(version, "unknown"));
+        curl_mfprintf(stderr, "[t-%zu] info mbedTLS using %s\n",
+                      t->idx, version);
+        break;
+      }
+#endif
+#ifdef USE_RUSTLS
+      case CURLSSLBACKEND_RUSTLS: {
+        int v = rustls_connection_get_protocol_version(
+          (struct rustls_connection *)tls->internals);
+        assert(v);
+        curl_mfprintf(stderr, "[t-%zu] info rustls TLS version 0x%x\n",
+                      t->idx, (unsigned int)v);
+        break;
+      }
+#endif
+#ifdef USE_SCHANNEL
+      case CURLSSLBACKEND_SCHANNEL: {
+        CtxtHandle *ctxt_handle = (CtxtHandle *)tls->internals;
+        SecPkgContext_ConnectionInfo info;
+        SECURITY_STATUS sspi_status;
+        sspi_status = QueryContextAttributes(ctxt_handle,
+                                             SECPKG_ATTR_CONNECTION_INFO,
+                                             &info);
+        assert(sspi_status == SEC_E_OK);
+        (void)sspi_status;
+        curl_mfprintf(stderr, "[t-%zu] info Schannel TLS version 0x%08lx\n",
+                      t->idx, (unsigned long)info.dwProtocol);
+        break;
+      }
+#endif
+      default:
+        curl_mfprintf(stderr, "[t-%zu] info SSL_PTR backend=%d, ptr=%p\n",
+                      t->idx, (int)tls->backend, tls->internals);
+        break;
+      }
+    }
+  }
+#endif
+  return 0;
+}
+
+static int setup_hx_download(CURL *curl, const char *url, struct transfer_d *t,
+                             long http_version, struct curl_slist *host,
+                             CURLSH *share, int use_earlydata,
+                             int fresh_connect, const char *cafile)
+{
+  curl_easy_setopt(curl, CURLOPT_SHARE, share);
+  curl_easy_setopt(curl, CURLOPT_URL, url);
+  curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, http_version);
+  if(cafile)
+    curl_easy_setopt(curl, CURLOPT_CAINFO, cafile);
+  curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, "");
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, (long)(128 * 1024));
+  curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, my_write_d_cb);
+  curl_easy_setopt(curl, CURLOPT_WRITEDATA, t);
+  curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
+  curl_easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, my_progress_d_cb);
+  curl_easy_setopt(curl, CURLOPT_XFERINFODATA, t);
+  if(use_earlydata)
+    curl_easy_setopt(curl, CURLOPT_SSL_OPTIONS, CURLSSLOPT_EARLYDATA);
+  if(forbid_reuse_d)
+    curl_easy_setopt(curl, CURLOPT_FORBID_REUSE, 1L);
+  if(host)
+    curl_easy_setopt(curl, CURLOPT_RESOLVE, host);
+  if(fresh_connect)
+    curl_easy_setopt(curl, CURLOPT_FRESH_CONNECT, 1L);
+
+  /* please be verbose */
+  if(verbose_d) {
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+    curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, cli_debug_cb);
+  }
+
+  /* wait for pipe connection to confirm */
+  curl_easy_setopt(curl, CURLOPT_PIPEWAIT, 1L);
+
+  return 0; /* all is good */
+}
+
+static void usage_hx_download(const char *msg)
+{
+  if(msg)
+    curl_mfprintf(stderr, "%s\n", msg);
+  curl_mfprintf(stderr,
+    "usage: [options] url\n"
+    "  download a URL with following options:\n"
+    "  -a         abort paused transfer\n"
+    "  -m number  max parallel downloads\n"
+    "  -e         use TLS early data when possible\n"
+    "  -f         forbid connection reuse\n"
+    "  -n number  total downloads\n");
+  curl_mfprintf(stderr,
+    "  -A number  abort transfer after `number` response bytes\n"
+    "  -F number  fail writing response after `number` response bytes\n"
+    "  -M number  max concurrent connections to a host\n"
+    "  -P number  pause transfer after `number` response bytes\n"
+    "  -r <host>:<port>:<addr>  resolve information\n"
+    "  -T number  max concurrent connections total\n"
+    "  -V http_version (http/1.1, h2, h3) http version to use\n"
+    "  -6 use ipv6 for resolving the FIRST URL\n"
+  );
+}
+
+/*
+ * Download a file over HTTP/2, take care of server push.
+ */
+static CURLcode test_cli_hx_download(const char *URL)
+{
+  CURLM *multi = NULL;
+  struct CURLMsg *m;
+  CURLSH *share = NULL;
+  const char *url;
+  size_t i, n, max_parallel = 1;
+  size_t active_transfers;
+  size_t pause_offset = 0;
+  size_t abort_offset = 0;
+  size_t fail_offset = 0;
+  int abort_paused = 0, use_earlydata = 0;
+  struct transfer_d *t = NULL;
+  long http_version = CURL_HTTP_VERSION_2_0;
+  int ch;
+  struct curl_slist *host = NULL;
+  char *resolve = NULL;
+  size_t max_host_conns = 0;
+  size_t max_total_conns = 0;
+  int fresh_connect = 0;
+  char *cafile = NULL;
+  bool first_ipv6 = FALSE;
+  CURLcode result = CURLE_OK;
+
+  (void)URL;
+
+  while((ch = cgetopt(test_argc, test_argv, "aefhm:n:xA:C:F:M:P:r:T:V:6"))
+        != -1) {
+    const char *opt = coptarg;
+    curl_off_t num;
+    switch(ch) {
+    case 'h':
+      usage_hx_download(NULL);
+      result = (CURLcode)2;
+      goto optcleanup;
+    case 'a':
+      abort_paused = 1;
+      break;
+    case 'e':
+      use_earlydata = 1;
+      break;
+    case 'f':
+      forbid_reuse_d = 1;
+      break;
+    case 'm':
+      if(!curlx_str_number(&opt, &num, LONG_MAX))
+        max_parallel = (size_t)num;
+      break;
+    case 'n':
+      if(!curlx_str_number(&opt, &num, LONG_MAX))
+        transfer_count_d = (size_t)num;
+      break;
+    case 'x':
+      fresh_connect = 1;
+      break;
+    case 'A':
+      if(!curlx_str_number(&opt, &num, LONG_MAX))
+        abort_offset = (size_t)num;
+      break;
+    case 'C':
+      curlx_free(cafile);
+      cafile = curlx_strdup(coptarg);
+      break;
+    case 'F':
+      if(!curlx_str_number(&opt, &num, LONG_MAX))
+        fail_offset = (size_t)num;
+      break;
+    case 'M':
+      if(!curlx_str_number(&opt, &num, LONG_MAX))
+        max_host_conns = (size_t)num;
+      break;
+    case 'P':
+      if(!curlx_str_number(&opt, &num, LONG_MAX))
+        pause_offset = (size_t)num;
+      break;
+    case 'r':
+      curlx_free(resolve);
+      resolve = curlx_strdup(coptarg);
+      break;
+    case 'T':
+      if(!curlx_str_number(&opt, &num, LONG_MAX))
+        max_total_conns = (size_t)num;
+      break;
+    case 'V': {
+      if(!strcmp("http/1.1", coptarg))
+        http_version = CURL_HTTP_VERSION_1_1;
+      else if(!strcmp("h2", coptarg))
+        http_version = CURL_HTTP_VERSION_2_0;
+      else if(!strcmp("h3", coptarg))
+        http_version = CURL_HTTP_VERSION_3ONLY;
+      else {
+        usage_hx_download("invalid http version");
+        result = (CURLcode)1;
+        goto optcleanup;
+      }
+      break;
+    }
+    case '6':
+      first_ipv6 = TRUE;
+      break;
+    default:
+      usage_hx_download("invalid option");
+      result = (CURLcode)1;
+      goto optcleanup;
+    }
+  }
+  test_argc -= coptind;
+  test_argv += coptind;
+
+  curl_global_trace("ids,time,http/2,http/3");
+
+  if(test_argc != 1) {
+    usage_hx_download("not enough arguments");
+    result = (CURLcode)2;
+    goto optcleanup;
+  }
+  url = test_argv[0];
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    result = (CURLcode)3;
+    goto optcleanup;
+  }
+
+  if(resolve)
+    host = curl_slist_append(NULL, resolve);
+
+  share = curl_share_init();
+  if(!share) {
+    curl_mfprintf(stderr, "error allocating share\n");
+    result = (CURLcode)1;
+    goto cleanup;
+  }
+  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_COOKIE);
+  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_DNS);
+  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_SSL_SESSION);
+#if 0
+  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_CONNECT);
+#endif
+  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_PSL);
+  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_HSTS);
+
+  transfer_d = curlx_calloc(transfer_count_d, sizeof(*transfer_d));
+  if(!transfer_d) {
+    curl_mfprintf(stderr, "error allocating transfer structs\n");
+    result = (CURLcode)1;
+    goto cleanup;
+  }
+
+  multi = curl_multi_init();
+  curl_multi_setopt(multi, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
+  curl_multi_setopt(multi, CURLMOPT_MAX_TOTAL_CONNECTIONS,
+                    (long)max_total_conns);
+  curl_multi_setopt(multi, CURLMOPT_MAX_HOST_CONNECTIONS,
+                    (long)max_host_conns);
+
+  active_transfers = 0;
+  for(i = 0; i < transfer_count_d; ++i) {
+    t = &transfer_d[i];
+    t->idx = i;
+    t->abort_at = (curl_off_t)abort_offset;
+    t->fail_at = (curl_off_t)fail_offset;
+    t->pause_at = (curl_off_t)pause_offset;
+  }
+
+  n = (max_parallel < transfer_count_d) ? max_parallel : transfer_count_d;
+  for(i = 0; i < n; ++i) {
+    t = &transfer_d[i];
+    t->curl = curl_easy_init();
+    if(!t->curl ||
+       setup_hx_download(t->curl, url, t, http_version, host, share,
+                         use_earlydata, fresh_connect, cafile)) {
+      curl_mfprintf(stderr, "[t-%zu] FAILED setup\n", i);
+      result = (CURLcode)1;
+      goto cleanup;
+    }
+    if(!i && first_ipv6)
+      curl_easy_setopt(t->curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V6);
+    curl_multi_add_handle(multi, t->curl);
+    t->started = 1;
+    ++active_transfers;
+    curl_mfprintf(stderr, "[t-%zu] STARTED\n", t->idx);
+  }
+
+  do {
+    int still_running; /* keep number of running handles */
+    CURLMcode mresult = curl_multi_perform(multi, &still_running);
+
+    if(still_running) {
+      /* wait for activity, timeout or "nothing" */
+      mresult = curl_multi_poll(multi, NULL, 0, 500, NULL);
+    }
+
+    if(mresult)
+      break;
+
+    do {
+      int msgq = 0;
+      m = curl_multi_info_read(multi, &msgq);
+      if(m && (m->msg == CURLMSG_DONE)) {
+        CURL *easy = m->easy_handle;
+        --active_transfers;
+        curl_multi_remove_handle(multi, easy);
+        t = get_transfer_for_easy_d(easy);
+        if(t) {
+          t->done = 1;
+          t->result = m->data.result;
+          curl_mfprintf(stderr, "[t-%zu] FINISHED with result %d\n",
+                        t->idx, (int)t->result);
+          if(use_earlydata) {
+            curl_off_t sent;
+            curl_easy_getinfo(easy, CURLINFO_EARLYDATA_SENT_T, &sent);
+            curl_mfprintf(stderr, "[t-%zu] EarlyData: "
+                          "%" CURL_FORMAT_CURL_OFF_T "\n", t->idx, sent);
+          }
+        }
+        else {
+          curl_easy_cleanup(easy);
+          curl_mfprintf(stderr, "unknown FINISHED???\n");
+        }
+      }
+
+      /* nothing happening, maintenance */
+      if(abort_paused) {
+        /* abort paused transfers */
+        for(i = 0; i < transfer_count_d; ++i) {
+          t = &transfer_d[i];
+          if(!t->done && t->paused && t->curl) {
+            curl_multi_remove_handle(multi, t->curl);
+            t->done = 1;
+            active_transfers--;
+            curl_mfprintf(stderr, "[t-%zu] ABORTED\n", t->idx);
+          }
+        }
+      }
+      else {
+        /* resume one paused transfer */
+        for(i = 0; i < transfer_count_d; ++i) {
+          t = &transfer_d[i];
+          if(!t->done && t->paused) {
+            t->resumed = 1;
+            t->paused = 0;
+            curl_easy_pause(t->curl, CURLPAUSE_CONT);
+            curl_mfprintf(stderr, "[t-%zu] RESUMED\n", t->idx);
+            break;
+          }
+        }
+      }
+
+      while(active_transfers < max_parallel) {
+        for(i = 0; i < transfer_count_d; ++i) {
+          t = &transfer_d[i];
+          if(!t->started) {
+            t->curl = curl_easy_init();
+            if(!t->curl ||
+               setup_hx_download(t->curl, url, t, http_version, host, share,
+                                 use_earlydata, fresh_connect, cafile)) {
+              curl_mfprintf(stderr, "[t-%zu] FAILED setup\n", i);
+              result = (CURLcode)1;
+              goto cleanup;
+            }
+            curl_multi_add_handle(multi, t->curl);
+            t->started = 1;
+            ++active_transfers;
+            curl_mfprintf(stderr, "[t-%zu] STARTED\n", t->idx);
+            break;
+          }
+        }
+        /* all started */
+        if(i == transfer_count_d)
+          break;
+      }
+    } while(m);
+
+  } while(active_transfers); /* as long as we have transfers going */
+
+cleanup:
+
+  curl_multi_cleanup(multi);
+
+  if(transfer_d) {
+    for(i = 0; i < transfer_count_d; ++i) {
+      t = &transfer_d[i];
+      if(t->out) {
+        curlx_fclose(t->out);
+        t->out = NULL;
+      }
+      if(t->curl) {
+        curl_easy_cleanup(t->curl);
+        t->curl = NULL;
+      }
+      if(t->result)
+        result = t->result;
+      else /* on success we expect SSL to have been checked */
+        assert(t->checked_ssl);
+    }
+    curlx_free(transfer_d);
+  }
+
+  curl_share_cleanup(share);
+  curl_slist_free_all(host);
+
+  curl_global_cleanup();
+
+optcleanup:
+
+  curlx_free(resolve);
+  curlx_free(cafile);
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/cli_hx_upload.c b/third-party/curl/tests/libtest/cli_hx_upload.c
new file mode 100644
index 0000000000..64c3bbb3a5
--- /dev/null
+++ b/third-party/curl/tests/libtest/cli_hx_upload.c
@@ -0,0 +1,548 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#include "testtrace.h"
+
+static int verbose_u = 1;
+
+struct transfer_u {
+  size_t idx;
+  CURL *curl;
+  const char *method;
+  char filename[128];
+  curl_mime *mime;
+  FILE *out;
+  curl_off_t send_total;
+  curl_off_t recv_size;
+  curl_off_t send_size;
+  curl_off_t fail_at;
+  curl_off_t pause_at;
+  curl_off_t abort_at;
+  int started;
+  int paused;
+  int resumed;
+  int done;
+};
+
+static size_t transfer_count_u = 1;
+static struct transfer_u *transfer_u;
+static int forbid_reuse_u = 0;
+
+static struct transfer_u *get_transfer_for_easy_u(CURL *curl)
+{
+  size_t i;
+  for(i = 0; i < transfer_count_u; ++i) {
+    if(curl == transfer_u[i].curl)
+      return &transfer_u[i];
+  }
+  return NULL;
+}
+
+static size_t my_write_u_cb(char *buf, size_t nitems, size_t buflen,
+                            void *userdata)
+{
+  struct transfer_u *t = userdata;
+  curl_off_t blen = nitems * buflen;
+  size_t nwritten;
+
+  curl_mfprintf(stderr, "[t-%zu] RECV %" CURL_FORMAT_CURL_OFF_T " bytes, "
+                "total=%" CURL_FORMAT_CURL_OFF_T ", "
+                "pause_at=%" CURL_FORMAT_CURL_OFF_T "\n",
+                t->idx, blen, t->recv_size, t->pause_at);
+  if(!t->out) {
+    curl_msnprintf(t->filename, sizeof(t->filename) - 1, "download_%zu.data",
+                   t->idx);
+    t->out = curlx_fopen(t->filename, "wb");
+    if(!t->out)
+      return 0;
+  }
+
+  nwritten = fwrite(buf, buflen, nitems, t->out);
+  if(nwritten < nitems) {
+    curl_mfprintf(stderr, "[t-%zu] write failure\n", t->idx);
+    return 0;
+  }
+  t->recv_size += blen;
+  return (size_t)blen;
+}
+
+static size_t my_read_cb(char *buf, size_t nitems, size_t buflen,
+                         void *userdata)
+{
+  struct transfer_u *t = userdata;
+  size_t blen = (nitems * buflen);
+  size_t nread;
+
+  if(t->send_total <= t->send_size)
+    nread = 0;
+  else if((t->send_total - t->send_size) < (curl_off_t)blen)
+    nread = (size_t)(t->send_total - t->send_size);
+  else
+    nread = blen;
+
+  curl_mfprintf(stderr, "[t-%zu] SEND %zu bytes, "
+                "total=%" CURL_FORMAT_CURL_OFF_T ", "
+                "pause_at=%" CURL_FORMAT_CURL_OFF_T "\n",
+                t->idx, nread, t->send_total, t->pause_at);
+
+  if(!t->resumed &&
+     t->send_size < t->pause_at &&
+     ((t->send_size + (curl_off_t)blen) >= t->pause_at)) {
+    curl_mfprintf(stderr, "[t-%zu] PAUSE\n", t->idx);
+    t->paused = 1;
+    return CURL_READFUNC_PAUSE;
+  }
+
+  memset(buf, 'x', nread);
+  t->send_size += (curl_off_t)nread;
+  if(t->fail_at > 0 && t->send_size >= t->fail_at) {
+    curl_mfprintf(stderr, "[t-%zu] ABORT by read callback at "
+                  "%" CURL_FORMAT_CURL_OFF_T " bytes\n", t->idx, t->send_size);
+    return CURL_READFUNC_ABORT;
+  }
+  return nread;
+}
+
+static int my_progress_u_cb(void *userdata,
+                            curl_off_t dltotal, curl_off_t dlnow,
+                            curl_off_t ultotal, curl_off_t ulnow)
+{
+  struct transfer_u *t = userdata;
+  (void)ultotal;
+  (void)dlnow;
+  (void)dltotal;
+  if(t->abort_at > 0 && ulnow >= t->abort_at) {
+    curl_mfprintf(stderr, "[t-%zu] ABORT by progress_cb at "
+                  "%" CURL_FORMAT_CURL_OFF_T " bytes sent\n", t->idx, ulnow);
+    return 1;
+  }
+  return 0;
+}
+
+static int setup_hx_upload(CURL *curl, const char *url, struct transfer_u *t,
+                           long http_version, struct curl_slist *host,
+                           CURLSH *share, int use_earlydata,
+                           int announce_length)
+{
+  curl_easy_setopt(curl, CURLOPT_SHARE, share);
+  curl_easy_setopt(curl, CURLOPT_URL, url);
+  curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, http_version);
+  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, (long)(128 * 1024));
+  curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, CURLFOLLOW_OBEYCODE);
+  curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, my_write_u_cb);
+  curl_easy_setopt(curl, CURLOPT_WRITEDATA, t);
+  if(use_earlydata)
+    curl_easy_setopt(curl, CURLOPT_SSL_OPTIONS, CURLSSLOPT_EARLYDATA);
+
+  if(t->method && !strcmp("MIME", t->method)) {
+    curl_mimepart *part;
+    t->mime = curl_mime_init(curl);
+    part = curl_mime_addpart(t->mime);
+    curl_mime_name(part, "file");
+    curl_mime_data_cb(part, -1, my_read_cb, NULL, NULL, t);
+    curl_easy_setopt(curl, CURLOPT_MIMEPOST, t->mime);
+  }
+  else {
+    if(!t->method || !strcmp("PUT", t->method))
+      curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+    else if(!strcmp("POST", t->method))
+      curl_easy_setopt(curl, CURLOPT_POST, 1L);
+    else {
+      curl_mfprintf(stderr, "unsupported method '%s'\n", t->method);
+      return 1;
+    }
+    curl_easy_setopt(curl, CURLOPT_READFUNCTION, my_read_cb);
+    curl_easy_setopt(curl, CURLOPT_READDATA, t);
+    if(announce_length)
+      curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, t->send_total);
+  }
+
+  curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
+  curl_easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, my_progress_u_cb);
+  curl_easy_setopt(curl, CURLOPT_XFERINFODATA, t);
+  if(forbid_reuse_u)
+    curl_easy_setopt(curl, CURLOPT_FORBID_REUSE, 1L);
+  if(host)
+    curl_easy_setopt(curl, CURLOPT_RESOLVE, host);
+
+  /* please be verbose */
+  if(verbose_u) {
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+    curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, cli_debug_cb);
+  }
+
+  /* wait for pipe connection to confirm */
+  curl_easy_setopt(curl, CURLOPT_PIPEWAIT, 1L);
+
+  return 0; /* all is good */
+}
+
+static void usage_hx_upload(const char *msg)
+{
+  if(msg)
+    curl_mfprintf(stderr, "%s\n", msg);
+  curl_mfprintf(stderr,
+    "usage: [options] url\n"
+    "  upload to a URL with following options:\n"
+    "  -a         abort paused transfer\n"
+    "  -e         use TLS earlydata\n"
+    "  -m number  max parallel uploads\n"
+    "  -n number  total uploads\n"
+    "  -A number  abort transfer after `number` request body bytes\n"
+    "  -F number  fail reading request body after `number` of bytes\n"
+    "  -P number  pause transfer after `number` request body bytes\n"
+    "  -r <host>:<port>:<addr>  resolve information\n"
+    "  -S number  size to upload\n"
+    "  -V http_version (http/1.1, h2, h3) http version to use\n"
+  );
+}
+
+/*
+ * Download a file over HTTP/2, take care of server push.
+ */
+static CURLcode test_cli_hx_upload(const char *URL)
+{
+  CURLM *multi;
+  CURLSH *share;
+  const char *url;
+  const char *method = "PUT";
+  size_t i, n, max_parallel = 1;
+  size_t active_transfers;
+  size_t pause_offset = 0;
+  size_t abort_offset = 0;
+  size_t fail_offset = 0;
+  size_t send_total = (128 * 1024);
+  int abort_paused = 0;
+  int reuse_easy = 0;
+  int use_earlydata = 0;
+  int announce_length = 0;
+  struct transfer_u *t = NULL;
+  long http_version = CURL_HTTP_VERSION_2_0;
+  struct curl_slist *host = NULL;
+  const char *resolve = NULL;
+  int ch;
+  CURLcode result = CURLE_OK;
+
+  (void)URL;
+
+  while((ch = cgetopt(test_argc, test_argv, "aefhlm:n:A:F:M:P:r:RS:V:"))
+        != -1) {
+    const char *opt = coptarg;
+    curl_off_t num;
+    switch(ch) {
+    case 'h':
+      usage_hx_upload(NULL);
+      return (CURLcode)2;
+    case 'a':
+      abort_paused = 1;
+      break;
+    case 'e':
+      use_earlydata = 1;
+      break;
+    case 'f':
+      forbid_reuse_u = 1;
+      break;
+    case 'l':
+      announce_length = 1;
+      break;
+    case 'm':
+      if(!curlx_str_number(&opt, &num, LONG_MAX))
+        max_parallel = (size_t)num;
+      break;
+    case 'n':
+      if(!curlx_str_number(&opt, &num, LONG_MAX))
+        transfer_count_u = (size_t)num;
+      break;
+    case 'A':
+      if(!curlx_str_number(&opt, &num, LONG_MAX))
+        abort_offset = (size_t)num;
+      break;
+    case 'F':
+      if(!curlx_str_number(&opt, &num, LONG_MAX))
+        fail_offset = (size_t)num;
+      break;
+    case 'M':
+      method = coptarg;
+      break;
+    case 'P':
+      if(!curlx_str_number(&opt, &num, LONG_MAX))
+        pause_offset = (size_t)num;
+      break;
+    case 'r':
+      resolve = coptarg;
+      break;
+    case 'R':
+      reuse_easy = 1;
+      break;
+    case 'S':
+      if(!curlx_str_number(&opt, &num, LONG_MAX))
+        send_total = (size_t)num;
+      break;
+    case 'V': {
+      if(!strcmp("http/1.1", coptarg))
+        http_version = CURL_HTTP_VERSION_1_1;
+      else if(!strcmp("h2", coptarg))
+        http_version = CURL_HTTP_VERSION_2_0;
+      else if(!strcmp("h3", coptarg))
+        http_version = CURL_HTTP_VERSION_3ONLY;
+      else {
+        usage_hx_upload("invalid http version");
+        return (CURLcode)1;
+      }
+      break;
+    }
+    default:
+      usage_hx_upload("invalid option");
+      return (CURLcode)1;
+    }
+  }
+  test_argc -= coptind;
+  test_argv += coptind;
+
+  if(max_parallel > 1 && reuse_easy) {
+    usage_hx_upload("cannot mix -R and -P");
+    return (CURLcode)2;
+  }
+
+  if(test_argc != 1) {
+    usage_hx_upload("not enough arguments");
+    return (CURLcode)2;
+  }
+  url = test_argv[0];
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return (CURLcode)3;
+  }
+
+  curl_global_trace("ids,time,http/2,http/3");
+
+  if(resolve)
+    host = curl_slist_append(NULL, resolve);
+
+  share = curl_share_init();
+  if(!share) {
+    curl_mfprintf(stderr, "error allocating share\n");
+    result = (CURLcode)1;
+    goto cleanup;
+  }
+  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_COOKIE);
+  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_DNS);
+  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_SSL_SESSION);
+  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_CONNECT);
+  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_PSL);
+  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_HSTS);
+
+  transfer_u = curlx_calloc(transfer_count_u, sizeof(*transfer_u));
+  if(!transfer_u) {
+    curl_mfprintf(stderr, "error allocating transfer structs\n");
+    result = (CURLcode)1;
+    goto cleanup;
+  }
+
+  active_transfers = 0;
+  for(i = 0; i < transfer_count_u; ++i) {
+    t = &transfer_u[i];
+    t->idx = i;
+    t->method = method;
+    t->send_total = (curl_off_t)send_total;
+    t->abort_at = (curl_off_t)abort_offset;
+    t->fail_at = (curl_off_t)fail_offset;
+    t->pause_at = (curl_off_t)pause_offset;
+  }
+
+  if(reuse_easy) {
+    CURL *curl = curl_easy_init();
+    if(!curl) {
+      curl_mfprintf(stderr, "failed to init easy handle\n");
+      result = (CURLcode)1;
+      goto cleanup;
+    }
+    for(i = 0; i < transfer_count_u; ++i) {
+      CURLcode rc;
+      t = &transfer_u[i];
+      t->curl = curl;
+      if(setup_hx_upload(t->curl, url, t, http_version, host, share,
+                         use_earlydata, announce_length)) {
+        curl_mfprintf(stderr, "[t-%zu] FAILED setup\n", i);
+        result = (CURLcode)1;
+        goto cleanup;
+      }
+
+      curl_mfprintf(stderr, "[t-%zu] STARTING\n", t->idx);
+      rc = curl_easy_perform(curl);
+      curl_mfprintf(stderr, "[t-%zu] DONE -> %d\n", t->idx, (int)rc);
+      t->curl = NULL;
+      curl_easy_reset(curl);
+    }
+    curl_easy_cleanup(curl);
+  }
+  else {
+    multi = curl_multi_init();
+    curl_multi_setopt(multi, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
+
+    n = (max_parallel < transfer_count_u) ? max_parallel : transfer_count_u;
+    for(i = 0; i < n; ++i) {
+      t = &transfer_u[i];
+      t->curl = curl_easy_init();
+      if(!t->curl || setup_hx_upload(t->curl, url, t, http_version, host,
+                                     share, use_earlydata, announce_length)) {
+        curl_mfprintf(stderr, "[t-%zu] FAILED setup\n", i);
+        result = (CURLcode)1;
+        goto cleanup;
+      }
+      curl_multi_add_handle(multi, t->curl);
+      t->started = 1;
+      ++active_transfers;
+      curl_mfprintf(stderr, "[t-%zu] STARTED\n", t->idx);
+    }
+
+    do {
+      int still_running; /* keep number of running handles */
+      CURLMcode mresult = curl_multi_perform(multi, &still_running);
+      struct CURLMsg *m;
+
+      if(still_running) {
+        /* wait for activity, timeout or "nothing" */
+        mresult = curl_multi_poll(multi, NULL, 0, 1000, NULL);
+      }
+
+      if(mresult)
+        break;
+
+      do {
+        int msgq = 0;
+        m = curl_multi_info_read(multi, &msgq);
+        if(m && (m->msg == CURLMSG_DONE)) {
+          CURL *easy = m->easy_handle;
+          --active_transfers;
+          curl_multi_remove_handle(multi, easy);
+          t = get_transfer_for_easy_u(easy);
+          if(t) {
+            long res_status;
+            curl_easy_getinfo(easy, CURLINFO_RESPONSE_CODE, &res_status);
+            t->done = 1;
+            curl_mfprintf(stderr, "[t-%zu] FINISHED, "
+                          "result=%d, response=%ld\n",
+                          t->idx, (int)m->data.result, res_status);
+            if(use_earlydata) {
+              curl_off_t sent;
+              curl_easy_getinfo(easy, CURLINFO_EARLYDATA_SENT_T, &sent);
+              curl_mfprintf(stderr, "[t-%zu] EarlyData: "
+                            "%" CURL_FORMAT_CURL_OFF_T "\n", t->idx, sent);
+            }
+          }
+          else {
+            curl_easy_cleanup(easy);
+            curl_mfprintf(stderr, "unknown FINISHED???\n");
+          }
+        }
+
+        /* nothing happening, maintenance */
+        if(abort_paused) {
+          /* abort paused transfers */
+          for(i = 0; i < transfer_count_u; ++i) {
+            t = &transfer_u[i];
+            if(!t->done && t->paused && t->curl) {
+              curl_multi_remove_handle(multi, t->curl);
+              t->done = 1;
+              active_transfers--;
+              curl_mfprintf(stderr, "[t-%zu] ABORTED\n", t->idx);
+            }
+          }
+        }
+        else {
+          /* resume one paused transfer */
+          for(i = 0; i < transfer_count_u; ++i) {
+            t = &transfer_u[i];
+            if(!t->done && t->paused) {
+              t->resumed = 1;
+              t->paused = 0;
+              curl_easy_pause(t->curl, CURLPAUSE_CONT);
+              curl_mfprintf(stderr, "[t-%zu] RESUMED\n", t->idx);
+              break;
+            }
+          }
+        }
+
+        while(active_transfers < max_parallel) {
+          for(i = 0; i < transfer_count_u; ++i) {
+            t = &transfer_u[i];
+            if(!t->started) {
+              t->curl = curl_easy_init();
+              if(!t->curl || setup_hx_upload(t->curl, url, t, http_version,
+                                             host, share, use_earlydata,
+                                             announce_length)) {
+                curl_mfprintf(stderr, "[t-%zu] FAILED setup\n", i);
+                result = (CURLcode)1;
+                goto cleanup;
+              }
+              curl_multi_add_handle(multi, t->curl);
+              t->started = 1;
+              ++active_transfers;
+              curl_mfprintf(stderr, "[t-%zu] STARTED\n", t->idx);
+              break;
+            }
+          }
+          /* all started */
+          if(i == transfer_count_u)
+            break;
+        }
+      } while(m);
+
+    } while(active_transfers); /* as long as we have transfers going */
+
+    curl_mfprintf(stderr, "all transfers done, cleanup multi\n");
+    curl_multi_cleanup(multi);
+  }
+
+cleanup:
+
+  if(transfer_u) {
+    for(i = 0; i < transfer_count_u; ++i) {
+      t = &transfer_u[i];
+      if(t->out) {
+        curlx_fclose(t->out);
+        t->out = NULL;
+      }
+      if(t->curl) {
+        curl_easy_cleanup(t->curl);
+        t->curl = NULL;
+      }
+      if(t->mime) {
+        curl_mime_free(t->mime);
+      }
+    }
+    curlx_free(transfer_u);
+  }
+
+  curl_share_cleanup(share);
+  curl_slist_free_all(host);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/cli_tls_session_reuse.c b/third-party/curl/tests/libtest/cli_tls_session_reuse.c
new file mode 100644
index 0000000000..ba97485a96
--- /dev/null
+++ b/third-party/curl/tests/libtest/cli_tls_session_reuse.c
@@ -0,0 +1,266 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#include "testtrace.h"
+
+static int tse_found_tls_session = FALSE;
+
+static size_t write_tse_cb(char *ptr, size_t size, size_t nmemb, void *opaque)
+{
+  CURL *curl = opaque;
+  (void)ptr;
+  if(!tse_found_tls_session) {
+    struct curl_tlssessioninfo *tlssession;
+    CURLcode result;
+
+    result = curl_easy_getinfo(curl, CURLINFO_TLS_SSL_PTR, &tlssession);
+    if(result) {
+      curl_mfprintf(stderr, "curl_easy_getinfo(CURLINFO_TLS_SSL_PTR) "
+                    "failed: %s\n", curl_easy_strerror(result));
+      return result;
+    }
+    if(tlssession->backend == CURLSSLBACKEND_NONE) {
+      curl_mfprintf(stderr, "curl_easy_getinfo(CURLINFO_TLS_SSL_PTR) "
+                    "gave no backend\n");
+      return CURLE_FAILED_INIT;
+    }
+    if(!tlssession->internals) {
+      curl_mfprintf(stderr, "curl_easy_getinfo(CURLINFO_TLS_SSL_PTR) "
+                    "missing\n");
+      return CURLE_FAILED_INIT;
+    }
+    tse_found_tls_session = TRUE;
+  }
+  return size * nmemb;
+}
+
+static CURL *tse_add_transfer(CURLM *multi, CURLSH *share,
+                              struct curl_slist *resolve,
+                              const char *url, long http_version)
+{
+  CURL *curl;
+  CURLMcode mresult;
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init failed\n");
+    return NULL;
+  }
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, cli_debug_cb);
+  curl_easy_setopt(curl, CURLOPT_URL, url);
+  curl_easy_setopt(curl, CURLOPT_SHARE, share);
+  curl_easy_setopt(curl, CURLOPT_NOSIGNAL, 1L);
+  curl_easy_setopt(curl, CURLOPT_AUTOREFERER, 1L);
+  curl_easy_setopt(curl, CURLOPT_FAILONERROR, 1L);
+  curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, http_version);
+  curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_tse_cb);
+  curl_easy_setopt(curl, CURLOPT_WRITEDATA, curl);
+  curl_easy_setopt(curl, CURLOPT_HTTPGET, 1L);
+  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+  if(resolve)
+    curl_easy_setopt(curl, CURLOPT_RESOLVE, resolve);
+
+  mresult = curl_multi_add_handle(multi, curl);
+  if(mresult != CURLM_OK) {
+    curl_mfprintf(stderr, "curl_multi_add_handle: %s\n",
+                  curl_multi_strerror(mresult));
+    curl_easy_cleanup(curl);
+    return NULL;
+  }
+  return curl;
+}
+
+static CURLcode test_cli_tls_session_reuse(const char *URL)
+{
+  CURLM *multi = NULL;
+  CURLMcode mresult;
+  int running_handles = 0, numfds;
+  CURLMsg *msg;
+  CURLSH *share = NULL;
+  CURLU *cu;
+  struct curl_slist *resolve = NULL;
+  char resolve_buf[1024];
+  int msgs_in_queue;
+  int add_more, waits, ongoing = 0;
+  char *host = NULL, *port = NULL;
+  long http_version = CURL_HTTP_VERSION_1_1;
+  CURLcode result = (CURLcode)1;
+
+  if(!URL || !libtest_arg2) {
+    curl_mfprintf(stderr, "need args: URL proto\n");
+    return (CURLcode)2;
+  }
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return (CURLcode)3;
+  }
+
+  if(!strcmp("h2", libtest_arg2))
+    http_version = CURL_HTTP_VERSION_2;
+  else if(!strcmp("h3", libtest_arg2))
+    http_version = CURL_HTTP_VERSION_3ONLY;
+
+  cu = curl_url();
+  if(!cu) {
+    curl_mfprintf(stderr, "out of memory\n");
+    result = (CURLcode)1;
+    goto cleanup;
+  }
+  if(curl_url_set(cu, CURLUPART_URL, URL, 0)) {
+    curl_mfprintf(stderr, "not a URL: '%s'\n", URL);
+    goto cleanup;
+  }
+  if(curl_url_get(cu, CURLUPART_HOST, &host, 0)) {
+    curl_mfprintf(stderr, "could not get host of '%s'\n", URL);
+    goto cleanup;
+  }
+  if(curl_url_get(cu, CURLUPART_PORT, &port, 0)) {
+    curl_mfprintf(stderr, "could not get port of '%s'\n", URL);
+    goto cleanup;
+  }
+
+  curl_msnprintf(resolve_buf, sizeof(resolve_buf) - 1, "%s:%s:127.0.0.1",
+                 host, port);
+  resolve = curl_slist_append(resolve, resolve_buf);
+
+  multi = curl_multi_init();
+  if(!multi) {
+    curl_mfprintf(stderr, "curl_multi_init failed\n");
+    goto cleanup;
+  }
+
+  share = curl_share_init();
+  if(!share) {
+    curl_mfprintf(stderr, "curl_share_init failed\n");
+    goto cleanup;
+  }
+  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_SSL_SESSION);
+
+  if(!tse_add_transfer(multi, share, resolve, URL, http_version))
+    goto cleanup;
+  ++ongoing;
+  add_more = 6;
+  waits = 3;
+  do {
+    mresult = curl_multi_perform(multi, &running_handles);
+    if(mresult != CURLM_OK) {
+      curl_mfprintf(stderr, "curl_multi_perform: %s\n",
+                    curl_multi_strerror(mresult));
+      goto cleanup;
+    }
+
+    if(running_handles) {
+      mresult = curl_multi_poll(multi, NULL, 0, 1000000, &numfds);
+      if(mresult != CURLM_OK) {
+        curl_mfprintf(stderr, "curl_multi_poll: %s\n",
+                      curl_multi_strerror(mresult));
+        goto cleanup;
+      }
+    }
+
+    if(waits) {
+      --waits;
+    }
+    else {
+      while(add_more) {
+        if(!tse_add_transfer(multi, share, resolve, URL, http_version))
+          goto cleanup;
+        ++ongoing;
+        --add_more;
+      }
+    }
+
+    /* Check for finished handles and remove. */
+    /* !checksrc! disable EQUALSNULL 1 */
+    while((msg = curl_multi_info_read(multi, &msgs_in_queue)) != NULL) {
+      if(msg->msg == CURLMSG_DONE) {
+        long status = 0;
+        curl_off_t xfer_id;
+        curl_easy_getinfo(msg->easy_handle, CURLINFO_XFER_ID, &xfer_id);
+        curl_easy_getinfo(msg->easy_handle, CURLINFO_RESPONSE_CODE, &status);
+        if(msg->data.result == CURLE_SEND_ERROR ||
+           msg->data.result == CURLE_RECV_ERROR) {
+          /* We get these if the server had a GOAWAY in transit on
+           * reusing a connection */
+        }
+        else if(msg->data.result) {
+          curl_mfprintf(stderr, "transfer #%" CURL_FORMAT_CURL_OFF_T
+                        ": failed with %d\n", xfer_id, (int)msg->data.result);
+          goto cleanup;
+        }
+        else if(status != 200) {
+          curl_mfprintf(stderr, "transfer #%" CURL_FORMAT_CURL_OFF_T
+                        ": wrong http status %ld (expected 200)\n", xfer_id,
+                        status);
+          goto cleanup;
+        }
+        curl_multi_remove_handle(multi, msg->easy_handle);
+        curl_easy_cleanup(msg->easy_handle);
+        --ongoing;
+        curl_mfprintf(stderr, "transfer #%" CURL_FORMAT_CURL_OFF_T " retiring "
+                      "(%d now running)\n", xfer_id, running_handles);
+      }
+    }
+
+    curl_mfprintf(stderr, "running_handles=%d, yet_to_start=%d\n",
+                  running_handles, add_more);
+
+  } while(ongoing || add_more);
+
+  if(!tse_found_tls_session) {
+    curl_mfprintf(stderr, "CURLINFO_TLS_SSL_PTR not found during run\n");
+    result = CURLE_FAILED_INIT;
+    goto cleanup;
+  }
+
+  curl_mfprintf(stderr, "exiting\n");
+  result = CURLE_OK;
+
+cleanup:
+
+  if(multi) {
+    CURL **list = curl_multi_get_handles(multi);
+    if(list) {
+      int i;
+      for(i = 0; list[i]; i++) {
+        curl_multi_remove_handle(multi, list[i]);
+        curl_easy_cleanup(list[i]);
+      }
+      curl_free(list);
+    }
+    curl_multi_cleanup(multi);
+  }
+  curl_share_cleanup(share);
+  curl_slist_free_all(resolve);
+  curl_free(host);
+  curl_free(port);
+  if(cu)
+    curl_url_cleanup(cu);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/cli_upload_pausing.c b/third-party/curl/tests/libtest/cli_upload_pausing.c
new file mode 100644
index 0000000000..228304368a
--- /dev/null
+++ b/third-party/curl/tests/libtest/cli_upload_pausing.c
@@ -0,0 +1,215 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/* This is based on the PoC client of issue #11769
+ */
+#include "first.h"
+
+#include "testtrace.h"
+
+static size_t total_read = 0;
+
+static size_t read_callback(char *ptr, size_t size, size_t nmemb,
+                            void *userdata)
+{
+  static const size_t PAUSE_READ_AFTER = 1;
+
+  (void)size;
+  (void)nmemb;
+  (void)userdata;
+  if(total_read >= PAUSE_READ_AFTER) {
+    curl_mfprintf(stderr, "read_callback, return PAUSE\n");
+    return CURL_READFUNC_PAUSE;
+  }
+  else {
+    ptr[0] = '\n';
+    ++total_read;
+    curl_mfprintf(stderr, "read_callback, return 1 byte\n");
+    return 1;
+  }
+}
+
+static int progress_callback(void *clientp,
+                             curl_off_t dltotal,
+                             curl_off_t dlnow,
+                             curl_off_t ultotal,
+                             curl_off_t ulnow)
+{
+  (void)dltotal;
+  (void)dlnow;
+  (void)ultotal;
+  (void)ulnow;
+  (void)clientp;
+#if 0
+  /* Used to unpause on progress, but keeping for now. */
+  {
+    CURL *curl = (CURL *)clientp;
+    curl_easy_pause(curl, CURLPAUSE_CONT);
+#if 0
+    curl_easy_pause(curl, CURLPAUSE_RECV_CONT);
+#endif
+  }
+#endif
+  return 0;
+}
+
+static void usage_upload_pausing(const char *msg)
+{
+  if(msg)
+    curl_mfprintf(stderr, "%s\n", msg);
+  curl_mfprintf(stderr,
+    "usage: [options] url\n"
+    "  upload and pause, options:\n"
+    "  -V http_version (http/1.1, h2, h3) http version to use\n"
+  );
+}
+
+static CURLcode test_cli_upload_pausing(const char *URL)
+{
+  CURL *curl = NULL;
+  CURLcode result = CURLE_OK;
+  CURLU *cu;
+  struct curl_slist *resolve = NULL;
+  char resolve_buf[1024];
+  const char *url;
+  char *host = NULL, *port = NULL;
+  long http_version = CURL_HTTP_VERSION_1_1;
+  int ch;
+
+  (void)URL;
+
+  while((ch = cgetopt(test_argc, test_argv, "V:")) != -1) {
+    switch(ch) {
+    case 'V': {
+      if(!strcmp("http/1.1", coptarg))
+        http_version = CURL_HTTP_VERSION_1_1;
+      else if(!strcmp("h2", coptarg))
+        http_version = CURL_HTTP_VERSION_2_0;
+      else if(!strcmp("h3", coptarg))
+        http_version = CURL_HTTP_VERSION_3ONLY;
+      else {
+        usage_upload_pausing("invalid http version");
+        return (CURLcode)1;
+      }
+      break;
+    }
+    default:
+      usage_upload_pausing("invalid option");
+      return (CURLcode)1;
+    }
+  }
+  test_argc -= coptind;
+  test_argv += coptind;
+
+  if(test_argc != 1) {
+    usage_upload_pausing("not enough arguments");
+    return (CURLcode)2;
+  }
+  url = test_argv[0];
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return (CURLcode)3;
+  }
+
+  curl_global_trace("ids,time");
+
+  cu = curl_url();
+  if(!cu) {
+    curl_mfprintf(stderr, "out of memory\n");
+    result = (CURLcode)1;
+    goto cleanup;
+  }
+  if(curl_url_set(cu, CURLUPART_URL, url, 0)) {
+    curl_mfprintf(stderr, "not a URL: '%s'\n", url);
+    result = (CURLcode)1;
+    goto cleanup;
+  }
+  if(curl_url_get(cu, CURLUPART_HOST, &host, 0)) {
+    curl_mfprintf(stderr, "could not get host of '%s'\n", url);
+    result = (CURLcode)1;
+    goto cleanup;
+  }
+  if(curl_url_get(cu, CURLUPART_PORT, &port, 0)) {
+    curl_mfprintf(stderr, "could not get port of '%s'\n", url);
+    result = (CURLcode)1;
+    goto cleanup;
+  }
+
+  curl_msnprintf(resolve_buf, sizeof(resolve_buf) - 1, "%s:%s:127.0.0.1",
+                 host, port);
+  resolve = curl_slist_append(resolve, resolve_buf);
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "out of memory\n");
+    result = (CURLcode)1;
+    goto cleanup;
+  }
+  /* We want to use our own read function. */
+  curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_callback);
+
+  /* It helps us to continue the read function. */
+  curl_easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, progress_callback);
+  curl_easy_setopt(curl, CURLOPT_XFERINFODATA, curl);
+  curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
+
+  /* It helps us to ensure that keepalive does not help. */
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPIDLE, 1L);
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPINTVL, 1L);
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPCNT, 1L);
+
+  /* Enable uploading. */
+  curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "POST");
+  curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+
+  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
+
+  if(curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L) != CURLE_OK ||
+     curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, cli_debug_cb) != CURLE_OK ||
+     curl_easy_setopt(curl, CURLOPT_RESOLVE, resolve) != CURLE_OK) {
+    curl_mfprintf(stderr, "something unexpected went wrong - bailing out!\n");
+    result = (CURLcode)2;
+    goto cleanup;
+  }
+
+  curl_easy_setopt(curl, CURLOPT_URL, url);
+  curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, http_version);
+
+  result = curl_easy_perform(curl);
+
+cleanup:
+
+  if(curl)
+    curl_easy_cleanup(curl);
+  curl_slist_free_all(resolve);
+  curl_free(host);
+  curl_free(port);
+  if(cu)
+    curl_url_cleanup(cu);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/cli_ws_data.c b/third-party/curl/tests/libtest/cli_ws_data.c
new file mode 100644
index 0000000000..20d15c89d8
--- /dev/null
+++ b/third-party/curl/tests/libtest/cli_ws_data.c
@@ -0,0 +1,484 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#include "testtrace.h"
+
+#ifndef CURL_DISABLE_WEBSOCKETS
+
+static CURLcode test_ws_data_m2_check_recv(const struct curl_ws_frame *frame,
+                                           size_t r_offset, size_t nread,
+                                           size_t exp_len)
+{
+  if(!frame)
+    return CURLE_OK;
+
+  if(frame->flags & CURLWS_CLOSE) {
+    curl_mfprintf(stderr, "recv_data: unexpected CLOSE frame from server, "
+                  "got %zu bytes, offset=%zu, rflags %x\n",
+                  nread, r_offset, (unsigned int)frame->flags);
+    return CURLE_RECV_ERROR;
+  }
+  if(!r_offset && !(frame->flags & CURLWS_BINARY)) {
+    curl_mfprintf(stderr, "recv_data: wrong frame, got %zu bytes, offset=%zu, "
+                  "rflags %x\n",
+                  nread, r_offset, (unsigned int)frame->flags);
+    return CURLE_RECV_ERROR;
+  }
+  if(frame->offset != (curl_off_t)r_offset) {
+    curl_mfprintf(stderr, "recv_data: frame offset, expected %zu, "
+                  "got %" CURL_FORMAT_CURL_OFF_T "\n",
+                  r_offset, frame->offset);
+    return CURLE_RECV_ERROR;
+  }
+  if(frame->bytesleft != (curl_off_t)(exp_len - r_offset - nread)) {
+    curl_mfprintf(stderr, "recv_data: frame bytesleft, "
+                  "expected %" CURL_FORMAT_CURL_OFF_T ", "
+                  "got %" CURL_FORMAT_CURL_OFF_T "\n",
+                  (curl_off_t)(exp_len - r_offset - nread), frame->bytesleft);
+    return CURLE_RECV_ERROR;
+  }
+  if(r_offset + nread > exp_len) {
+    curl_mfprintf(stderr, "recv_data: data length, expected %zu, now at %zu\n",
+                  exp_len, r_offset + nread);
+    return CURLE_RECV_ERROR;
+  }
+  return CURLE_OK;
+}
+
+/* WebSocket Mode 2: CONNECT_ONLY 2, curl_ws_send()/curl_ws_recv() */
+static CURLcode test_ws_data_m2_echo(const char *url,
+                                     size_t count,
+                                     size_t plen_min,
+                                     size_t plen_max)
+{
+  CURL *curl = NULL;
+  CURLcode result = CURLE_OK;
+  const struct curl_ws_frame *frame;
+  size_t len;
+  char *send_buf = NULL, *recv_buf = NULL;
+  size_t i, scount = count, rcount = count;
+  int rblock, sblock;
+
+  send_buf = curlx_calloc(1, plen_max + 1);
+  recv_buf = curlx_calloc(1, plen_max + 1);
+  if(!send_buf || !recv_buf) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+  for(i = 0; i < plen_max; ++i) {
+    send_buf[i] = (char)('0' + ((int)i % 10));
+  }
+
+  curl = curl_easy_init();
+  if(!curl) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  curl_easy_setopt(curl, CURLOPT_URL, url);
+
+  /* use the callback style */
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "ws-data");
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 2L); /* websocket style */
+  result = curl_easy_perform(curl);
+  curl_mfprintf(stderr, "curl_easy_perform() returned %d\n", (int)result);
+  if(result != CURLE_OK)
+    goto out;
+
+  for(len = plen_min; len <= plen_max; ++len) {
+    size_t nwritten, nread, slen = len, rlen = len;
+    char *sbuf = send_buf, *rbuf = recv_buf;
+
+    memset(recv_buf, 0, plen_max);
+    while(slen || rlen || scount || rcount) {
+      sblock = rblock = 1;
+      if(slen) {
+        result = curl_ws_send(curl, sbuf, slen, &nwritten, 0, CURLWS_BINARY);
+        sblock = (result == CURLE_AGAIN);
+        if(!result || (result == CURLE_AGAIN)) {
+          curl_mfprintf(stderr, "curl_ws_send(len=%zu) -> %d, "
+                        "%zu (%" CURL_FORMAT_CURL_OFF_T "/%zu)\n", slen,
+                        (int)result, nwritten, (curl_off_t)(len - slen), len);
+          sbuf += nwritten;
+          slen -= nwritten;
+        }
+        else
+          goto out;
+      }
+      if(!slen && scount) { /* go again? */
+        scount--;
+        sbuf = send_buf;
+        slen = len;
+      }
+
+      if(rlen) {
+        size_t max_recv = (64 * 1024);
+        result = curl_ws_recv(curl, rbuf, (rlen > max_recv) ? max_recv : rlen,
+                              &nread, &frame);
+        if(!result || (result == CURLE_AGAIN)) {
+          rblock = (result == CURLE_AGAIN);
+          curl_mfprintf(stderr, "curl_ws_recv(len=%zu) -> %d, %zu (%ld/%zu)\n",
+                        rlen, (int)result, nread, (long)(len - rlen), len);
+          if(!result) {
+            result = test_ws_data_m2_check_recv(frame, len - rlen, nread, len);
+            if(result)
+              goto out;
+          }
+          rbuf += nread;
+          rlen -= nread;
+        }
+        else
+          goto out;
+      }
+      if(!rlen && rcount) { /* go again? */
+        rcount--;
+        rbuf = recv_buf;
+        rlen = len;
+      }
+
+      if(rblock && sblock) {
+        curl_mfprintf(stderr, "EAGAIN, sleep, try again\n");
+        curlx_wait_ms(1);
+      }
+    }
+
+    if(memcmp(send_buf, recv_buf, len)) {
+      curl_mfprintf(stderr, "recv_data: data differs\n");
+      debug_dump("", "expected:", stderr,
+                 (const unsigned char *)send_buf, len, FALSE);
+      debug_dump("", "received:", stderr,
+                 (const unsigned char *)recv_buf, len, FALSE);
+      result = CURLE_RECV_ERROR;
+      goto out;
+    }
+  }
+
+out:
+  if(curl) {
+    if(!result)
+      ws_close(curl);
+    curl_easy_cleanup(curl);
+  }
+  curlx_free(send_buf);
+  curlx_free(recv_buf);
+  return result;
+}
+
+struct test_ws_m1_ctx {
+  CURL *curl;
+  char *send_buf;
+  char *recv_buf;
+  size_t send_len, nsent;
+  size_t recv_len, nrcvd;
+  int nframes;
+  int read_calls;
+  int write_calls;
+  int frames_read;
+  int frames_written;
+  BIT(frame_reading);
+};
+
+static size_t test_ws_data_m1_read(char *buf, size_t nitems, size_t buflen,
+                                   void *userdata)
+{
+  struct test_ws_m1_ctx *ctx = userdata;
+  size_t len = nitems * buflen;
+  size_t left = ctx->send_len - ctx->nsent;
+
+  ctx->read_calls++;
+
+  if(ctx->frames_read >= ctx->nframes)
+    goto out;
+
+  if(!ctx->frame_reading) {
+    curl_ws_start_frame(ctx->curl, CURLWS_BINARY, ctx->send_len);
+    ctx->frame_reading = TRUE;
+  }
+
+  if(ctx->frame_reading) {
+    bool complete;
+    if(left > len)
+      left = len;
+    memcpy(buf, ctx->send_buf + ctx->nsent, left);
+    ctx->nsent += left;
+    complete = (ctx->send_len == ctx->nsent);
+    curl_mfprintf(stderr, "m1_read(len=%zu, call #%d, frame #%d%s) -> %zu\n",
+                  len, ctx->read_calls, ctx->frames_read,
+                  complete ? " complete" : "", left);
+    if(complete) {
+      ++ctx->frames_read;
+      ctx->frame_reading = FALSE;
+      ctx->nsent = 0;
+    }
+    return left;
+  }
+out:
+  curl_mfprintf(stderr, "m1_read(len=%zu, call #%d) -> EOS\n",
+                len, ctx->read_calls);
+  return 0;
+}
+
+static size_t test_ws_data_m1_write(char *buf, size_t nitems, size_t buflen,
+                                    void *userdata)
+{
+  struct test_ws_m1_ctx *ctx = userdata;
+  size_t len = nitems * buflen;
+  bool complete;
+
+  ctx->write_calls++;
+  if(len > (ctx->recv_len - ctx->nrcvd)) {
+    curl_mfprintf(stderr, "m1_write(len=%zu, call #%d) -> ERROR\n",
+                  len, ctx->write_calls);
+    return CURL_WRITEFUNC_ERROR;
+  }
+  memcpy(ctx->recv_buf + ctx->nrcvd, buf, len);
+  ctx->nrcvd += len;
+  complete = (ctx->recv_len == ctx->nrcvd);
+
+  if(memcmp(ctx->send_buf, ctx->recv_buf, ctx->nrcvd)) {
+    curl_mfprintf(stderr, "m1_write(len=%zu, call #%d, frame #%d) -> "
+                  "data differs\n",
+                  len, ctx->write_calls, ctx->frames_written);
+    debug_dump("", "expected:", stderr,
+               (unsigned char *)ctx->send_buf, ctx->nrcvd, 0);
+    debug_dump("", "received:", stderr,
+               (unsigned char *)ctx->recv_buf, ctx->nrcvd, 0);
+    return CURL_WRITEFUNC_ERROR;
+  }
+
+  curl_mfprintf(stderr, "m1_write(len=%zu, call #%d, frame #%d%s) -> %zu\n",
+                len, ctx->write_calls, ctx->frames_written,
+                complete ? " complete" : "", len);
+  if(complete) {
+    ++ctx->frames_written;
+    ctx->nrcvd = 0;
+  }
+  return len;
+}
+
+/* WebSocket Mode 1: multi handle, READ/WRITEFUNCTION use */
+static CURLcode test_ws_data_m1_echo(const char *url,
+                                     size_t plen_min,
+                                     size_t plen_max)
+{
+  CURLM *multi = NULL;
+  CURLcode result = CURLE_OK;
+  struct test_ws_m1_ctx m1_ctx;
+  size_t i, len;
+
+  curl_mfprintf(stderr, "test_ws_data_m1_echo(min=%zu, max=%zu)\n",
+                plen_min, plen_max);
+  memset(&m1_ctx, 0, sizeof(m1_ctx));
+  m1_ctx.send_buf = curlx_calloc(1, plen_max + 1);
+  m1_ctx.recv_buf = curlx_calloc(1, plen_max + 1);
+  if(!m1_ctx.send_buf || !m1_ctx.recv_buf) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+  for(i = 0; i < plen_max; ++i) {
+    m1_ctx.send_buf[i] = (char)('0' + ((int)i % 10));
+  }
+
+  multi = curl_multi_init();
+  if(!multi) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  m1_ctx.curl = curl_easy_init();
+  if(!m1_ctx.curl) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+
+  for(len = plen_min; len <= plen_max; ++len) {
+    /* init what we want to send and expect to receive */
+    curl_mfprintf(stderr, "m1_echo, iter len=%zu\n", len);
+
+    m1_ctx.send_len = len;
+    m1_ctx.nsent = 0;
+    m1_ctx.recv_len = len;
+    m1_ctx.nrcvd = 0;
+    m1_ctx.nframes = 2;
+    m1_ctx.read_calls = 0;
+    m1_ctx.write_calls = 0;
+    m1_ctx.frames_read = 0;
+    m1_ctx.frames_written = 0;
+    memset(m1_ctx.recv_buf, 0, plen_max);
+    curl_easy_pause(m1_ctx.curl, CURLPAUSE_CONT);
+
+    curl_easy_reset(m1_ctx.curl);
+    curl_easy_setopt(m1_ctx.curl, CURLOPT_URL, url);
+    /* use the callback style */
+    curl_easy_setopt(m1_ctx.curl, CURLOPT_USERAGENT, "ws-data");
+    curl_easy_setopt(m1_ctx.curl, CURLOPT_VERBOSE, 1L);
+    /* we want to send */
+    curl_easy_setopt(m1_ctx.curl, CURLOPT_UPLOAD, 1L);
+    curl_easy_setopt(m1_ctx.curl, CURLOPT_READFUNCTION, test_ws_data_m1_read);
+    curl_easy_setopt(m1_ctx.curl, CURLOPT_READDATA, &m1_ctx);
+    curl_easy_setopt(m1_ctx.curl, CURLOPT_WRITEFUNCTION,
+                     test_ws_data_m1_write);
+    curl_easy_setopt(m1_ctx.curl, CURLOPT_WRITEDATA, &m1_ctx);
+
+    curl_multi_add_handle(multi, m1_ctx.curl);
+
+    while(1) {
+      int still_running; /* keep number of running handles */
+      CURLMcode mresult = curl_multi_perform(multi, &still_running);
+
+      if(!still_running || (m1_ctx.frames_written >= m1_ctx.nframes)) {
+        /* got the full echo back or failed */
+        break;
+      }
+
+      if(!mresult && still_running) {
+        mresult = curl_multi_poll(multi, NULL, 0, 1, NULL);
+      }
+      if(mresult) {
+        result = CURLE_RECV_ERROR;
+        goto out;
+      }
+    }
+
+    curl_multi_remove_handle(multi, m1_ctx.curl);
+
+    /* check results */
+    if(m1_ctx.frames_read < m1_ctx.nframes) {
+      curl_mfprintf(stderr, "m1_echo, sent only %d/%d frames\n",
+                    m1_ctx.frames_read, m1_ctx.nframes);
+      result = CURLE_SEND_ERROR;
+      goto out;
+    }
+    if(m1_ctx.frames_written < m1_ctx.frames_read) {
+      curl_mfprintf(stderr, "m1_echo, received only %d/%d frames\n",
+                    m1_ctx.frames_written, m1_ctx.frames_read);
+      result = CURLE_RECV_ERROR;
+      goto out;
+    }
+  }
+
+out:
+  if(multi)
+    curl_multi_cleanup(multi);
+  if(m1_ctx.curl) {
+    curl_easy_cleanup(m1_ctx.curl);
+  }
+  curlx_free(m1_ctx.send_buf);
+  curlx_free(m1_ctx.recv_buf);
+  return result;
+}
+
+static void test_ws_data_usage(const char *msg)
+{
+  if(msg)
+    curl_mfprintf(stderr, "%s\n", msg);
+  curl_mfprintf(stderr,
+    "usage: [options] url\n"
+    "  -m number  minimum frame size\n"
+    "  -M number  maximum frame size\n"
+  );
+}
+
+#endif
+
+static CURLcode test_cli_ws_data(const char *URL)
+{
+#ifndef CURL_DISABLE_WEBSOCKETS
+  CURLcode result = CURLE_OK;
+  const char *url;
+  size_t plen_min = 0, plen_max = 0, count = 1;
+  int ch, model = 2;
+
+  (void)URL;
+
+  while((ch = cgetopt(test_argc, test_argv, "12c:hm:M:")) != -1) {
+    const char *opt = coptarg;
+    curl_off_t num;
+    switch(ch) {
+    case '1':
+      model = 1;
+      break;
+    case '2':
+      model = 2;
+      break;
+    case 'h':
+      test_ws_data_usage(NULL);
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    case 'c':
+      if(!curlx_str_number(&opt, &num, LONG_MAX))
+        count = (size_t)num;
+      break;
+    case 'm':
+      if(!curlx_str_number(&opt, &num, LONG_MAX))
+        plen_min = (size_t)num;
+      break;
+    case 'M':
+      if(!curlx_str_number(&opt, &num, LONG_MAX))
+        plen_max = (size_t)num;
+      break;
+    default:
+      test_ws_data_usage("invalid option");
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    }
+  }
+  test_argc -= coptind;
+  test_argv += coptind;
+
+  if(!plen_max)
+    plen_max = plen_min;
+
+  if(plen_max < plen_min) {
+    curl_mfprintf(stderr, "maxlen must be >= minlen, got %zu-%zu\n",
+                  plen_min, plen_max);
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
+
+  if(test_argc != 1) {
+    test_ws_data_usage(NULL);
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
+  url = test_argv[0];
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return (CURLcode)3;
+  }
+
+  if(model == 1)
+    result = test_ws_data_m1_echo(url, plen_min, plen_max);
+  else
+    result = test_ws_data_m2_echo(url, count, plen_min, plen_max);
+
+  curl_global_cleanup();
+
+  return result;
+
+#else /* !CURL_DISABLE_WEBSOCKETS */
+  (void)URL;
+  curl_mfprintf(stderr, "WebSockets not enabled in libcurl\n");
+  return (CURLcode)1;
+#endif /* CURL_DISABLE_WEBSOCKETS */
+}
diff --git a/third-party/curl/tests/libtest/cli_ws_pingpong.c b/third-party/curl/tests/libtest/cli_ws_pingpong.c
new file mode 100644
index 0000000000..32961da721
--- /dev/null
+++ b/third-party/curl/tests/libtest/cli_ws_pingpong.c
@@ -0,0 +1,96 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#include "testtrace.h"
+
+#ifndef CURL_DISABLE_WEBSOCKETS
+
+static CURLcode pingpong(CURL *curl, const char *payload)
+{
+  CURLcode result;
+  int i;
+
+  result = ws_send_ping(curl, payload);
+  if(result)
+    return result;
+  for(i = 0; i < 10; ++i) {
+    curl_mfprintf(stderr, "Receive pong\n");
+    result = ws_recv_pong(curl, payload);
+    if(result == CURLE_AGAIN) {
+      curlx_wait_ms(100);
+      continue;
+    }
+    ws_close(curl);
+    return result;
+  }
+  ws_close(curl);
+  return CURLE_RECV_ERROR;
+}
+
+#endif
+
+static CURLcode test_cli_ws_pingpong(const char *URL)
+{
+#ifndef CURL_DISABLE_WEBSOCKETS
+  CURL *curl;
+  CURLcode result = CURLE_OK;
+  const char *payload;
+
+  if(!URL || !libtest_arg2) {
+    curl_mfprintf(stderr, "need args: URL payload\n");
+    return (CURLcode)2;
+  }
+  payload = libtest_arg2;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return (CURLcode)3;
+  }
+
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_URL, URL);
+
+    /* use the callback style */
+    curl_easy_setopt(curl, CURLOPT_USERAGENT, "ws-pingpong");
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+    curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 2L); /* websocket style */
+    result = curl_easy_perform(curl);
+    curl_mfprintf(stderr, "curl_easy_perform() returned %d\n", (int)result);
+    if(result == CURLE_OK)
+      result = pingpong(curl, payload);
+
+    /* always cleanup */
+    curl_easy_cleanup(curl);
+  }
+  curl_global_cleanup();
+  return result;
+
+#else /* !CURL_DISABLE_WEBSOCKETS */
+  (void)URL;
+  curl_mfprintf(stderr, "WebSockets not enabled in libcurl\n");
+  return (CURLcode)1;
+#endif /* CURL_DISABLE_WEBSOCKETS */
+}
diff --git a/third-party/curl/tests/libtest/first.c b/third-party/curl/tests/libtest/first.c
index ba7fc3365e..a512cddae9 100644
--- a/third-party/curl/tests/libtest/first.c
+++ b/third-party/curl/tests/libtest/first.c
@@ -21,32 +21,21 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
 #ifdef HAVE_LOCALE_H
-#  include <locale.h> /* for setlocale() */
+#include <locale.h> /* for setlocale() */
 #endif
 
-#ifdef HAVE_IO_H
-#  include <io.h> /* for setmode() */
+#if defined(UNITTESTS) && !defined(BUILDING_LIBCURL)
+#include "tool_stderr.h"  /* for tool_init_stderr() */
 #endif
 
-#ifdef HAVE_FCNTL_H
-#  include <fcntl.h> /* for setmode() */
-#endif
-
-#ifdef CURLDEBUG
-#  define MEMDEBUG_NODEFINES
-#  include "memdebug.h"
-#endif
-
-#include "timediff.h"
-
 int select_wrapper(int nfds, fd_set *rd, fd_set *wr, fd_set *exc,
                    struct timeval *tv)
 {
   if(nfds < 0) {
-    SET_SOCKERRNO(EINVAL);
+    SET_SOCKERRNO(SOCKEINVAL);
     return -1;
   }
 #ifdef USE_WINSOCK
@@ -63,86 +52,180 @@ int select_wrapper(int nfds, fd_set *rd, fd_set *wr, fd_set *exc,
   return select(nfds, rd, wr, exc, tv);
 }
 
-void wait_ms(int ms)
-{
-#ifdef USE_WINSOCK
-  Sleep(ms);
-#else
-  struct timeval t;
-  curlx_mstotv(&t, ms);
-  select_wrapper(0, NULL, NULL, NULL, &t);
-#endif
-}
-
-char *libtest_arg2 = NULL;
-char *libtest_arg3 = NULL;
+const char *libtest_arg2 = NULL;
+const char *libtest_arg3 = NULL;
+const char *libtest_arg4 = NULL;
+const char *libtest_arg5 = NULL;
 int test_argc;
-char **test_argv;
+const char **test_argv;
+int testnum;
 
-struct timeval tv_test_start; /* for test timing */
+struct curltime tv_test_start; /* for test timing */
 
 int unitfail; /* for unittests */
 
-#ifdef CURLDEBUG
+int coptind;
+const char *coptarg;
+
+int cgetopt(int argc, const char * const argv[], const char *optstring)
+{
+  static int optpos = 1;
+  int coptopt;
+  const char *arg;
+
+  if(coptind == 0) {  /* Reset? */
+    coptind = !!argc;
+    optpos = 1;
+  }
+
+  arg = argv[coptind];
+  if(arg && !strcmp(arg, "--")) {
+    coptind++;
+    return -1;
+  }
+  else if(!arg || arg[0] != '-') {
+    return -1;
+  }
+  else {
+    const char *opt = strchr(optstring, arg[optpos]);
+    coptopt = (unsigned char)arg[optpos];
+    if(!opt) {
+      if(!arg[++optpos]) {
+        coptind++;
+        optpos = 1;
+      }
+      return '?';
+    }
+    else if(opt[1] == ':') {
+      if(arg[optpos + 1]) {
+        coptarg = arg + optpos + 1;
+        coptind++;
+        optpos = 1;
+        return coptopt;
+      }
+      else if(argv[coptind + 1]) {
+        coptarg = argv[coptind + 1];
+        coptind += 2;
+        optpos = 1;
+        return coptopt;
+      }
+      else {
+        if(!arg[++optpos]) {
+          coptind++;
+          optpos = 1;
+        }
+        return *optstring == ':' ? ':' : '?';
+      }
+    }
+    else {
+      if(!arg[++optpos]) {
+        coptind++;
+        optpos = 1;
+      }
+      return coptopt;
+    }
+  }
+}
+
+#ifdef CURL_MEMDEBUG
 static void memory_tracking_init(void)
 {
-  char *env;
+  const char *env;
   /* if CURL_MEMDEBUG is set, this starts memory tracking message logging */
-  env = curl_getenv("CURL_MEMDEBUG");
+  env = getenv("CURL_MEMDEBUG");
   if(env) {
-    /* use the value as file name */
-    char fname[CURL_MT_LOGFNAME_BUFSIZE];
-    if(strlen(env) >= CURL_MT_LOGFNAME_BUFSIZE)
-      env[CURL_MT_LOGFNAME_BUFSIZE-1] = '\0';
-    strcpy(fname, env);
-    curl_free(env);
-    curl_dbg_memdebug(fname);
-    /* this weird stuff here is to make curl_free() get called before
-       curl_dbg_memdebug() as otherwise memory tracking will log a free()
-       without an alloc! */
+    /* use the value as filename */
+    curl_dbg_memdebug(env);
   }
   /* if CURL_MEMLIMIT is set, this enables fail-on-alloc-number-N feature */
-  env = curl_getenv("CURL_MEMLIMIT");
+  env = getenv("CURL_MEMLIMIT");
   if(env) {
-    char *endptr;
-    long num = strtol(env, &endptr, 10);
-    if((endptr != env) && (endptr == env + strlen(env)) && (num > 0))
-      curl_dbg_memlimit(num);
-    curl_free(env);
+    curl_off_t num;
+    if(!curlx_str_number(&env, &num, LONG_MAX) && num > 0)
+      curl_dbg_memlimit((long)num);
   }
 }
 #else
-#  define memory_tracking_init() Curl_nop_stmt
+#define memory_tracking_init() Curl_nop_stmt
 #endif
 
 /* returns a hexdump in a static memory area */
-char *hexdump(const unsigned char *buffer, size_t len)
+char *hexdump(const unsigned char *buf, size_t len)
 {
-  static char dump[200 * 3 + 1];
+  static char dump[(200 * 3) + 1];
   char *p = dump;
   size_t i;
   if(len > 200)
     return NULL;
-  for(i = 0; i<len; i++, p += 3)
-    msnprintf(p, 4, "%02x ", buffer[i]);
+  for(i = 0; i < len; i++, p += 3)
+    curl_msnprintf(p, 4, "%02x ", buf[i]);
   return dump;
 }
 
-
-int main(int argc, char **argv)
+#ifndef CURL_DISABLE_WEBSOCKETS
+CURLcode ws_send_ping(CURL *curl, const char *send_payload)
 {
-  char *URL;
-  int result;
+  size_t sent;
+  CURLcode result = curl_ws_send(curl, send_payload, strlen(send_payload),
+                                 &sent, 0, CURLWS_PING);
+  curl_mfprintf(stderr, "ws: curl_ws_send returned %d, sent %zu\n",
+                (int)result, sent);
+  return result;
+}
 
-#ifdef O_BINARY
-#  ifdef __HIGHC__
-  _setmode(stdout, O_BINARY);
-#  else
-  setmode(fileno(stdout), O_BINARY);
-#  endif
-#endif
+CURLcode ws_recv_pong(CURL *curl, const char *expected_payload)
+{
+  size_t rlen;
+  const struct curl_ws_frame *meta;
+  char buffer[256];
+  CURLcode result = curl_ws_recv(curl, buffer, sizeof(buffer), &rlen, &meta);
+  if(result) {
+    curl_mfprintf(stderr, "ws: curl_ws_recv returned %d, received %zu\n",
+                  (int)result, rlen);
+    return result;
+  }
+
+  if(!(meta->flags & CURLWS_PONG)) {
+    curl_mfprintf(stderr, "recv_pong: wrong frame, got %zu bytes rflags %x\n",
+                  rlen, (unsigned int)meta->flags);
+    return CURLE_RECV_ERROR;
+  }
+
+  curl_mfprintf(stderr, "ws: got PONG back\n");
+  if(rlen == strlen(expected_payload) &&
+     !memcmp(expected_payload, buffer, rlen)) {
+    curl_mfprintf(stderr, "ws: got the same payload back\n");
+    return CURLE_OK;
+  }
+  curl_mfprintf(stderr, "ws: did NOT get the same payload back\n");
+  return CURLE_RECV_ERROR;
+}
+
+/* close the connection */
+void ws_close(CURL *curl)
+{
+  size_t sent;
+  CURLcode result = curl_ws_send(curl, "", 0, &sent, 0, CURLWS_CLOSE);
+  curl_mfprintf(stderr, "ws: curl_ws_send returned %d, sent %zu\n",
+                (int)result, sent);
+}
+#endif /* CURL_DISABLE_WEBSOCKETS */
+
+int main(int argc, const char **argv)
+{
+  const char *URL = "";
+  CURLcode result;
+  entry_func_t entry_func;
+  const char *entry_name;
+  const char *env;
+  size_t tmp;
+
+  CURL_BINMODE(stdout);
 
   memory_tracking_init();
+#ifdef _WIN32
+  curlx_now_init();
+#endif
 
   /*
    * Setup proper locale from environment. This is needed to enable locale-
@@ -153,27 +236,62 @@ int main(int argc, char **argv)
   setlocale(LC_ALL, "");
 #endif
 
-  if(argc< 2) {
-    fprintf(stderr, "Pass URL as argument please\n");
+  test_argc = argc - 1;
+  test_argv = argv + 1;
+
+  if(argc < 2) {
+    curl_mfprintf(stderr, "Pass testname "
+                  "(and URL as argument for numbered tests) please\n");
     return 1;
   }
 
-  test_argc = argc;
-  test_argv = argv;
+  entry_name = argv[1];
+  entry_func = NULL;
+  for(tmp = 0; s_entries[tmp].ptr; ++tmp) {
+    if(!strcmp(entry_name, s_entries[tmp].name)) {
+      entry_func = s_entries[tmp].ptr;
+      break;
+    }
+  }
 
-  if(argc>2)
-    libtest_arg2 = argv[2];
+  if(!entry_func) {
+    curl_mfprintf(stderr, "Test '%s' not found.\n", entry_name);
+    return 1;
+  }
 
-  if(argc>3)
-    libtest_arg3 = argv[3];
+  if(argc > 2) {
+    URL = argv[2];
+    curl_mfprintf(stderr, "URL: %s\n", URL);
+  }
 
-  URL = argv[1]; /* provide this to the rest */
+  if(argc > 3)
+    libtest_arg2 = argv[3];
 
-  fprintf(stderr, "URL: %s\n", URL);
+  if(argc > 4)
+    libtest_arg3 = argv[4];
 
-  result = test(URL);
+  if(argc > 5)
+    libtest_arg4 = argv[5];
 
-#ifdef WIN32
+  if(argc > 6)
+    libtest_arg5 = argv[6];
+
+  testnum = 0;
+  env = getenv("CURL_TESTNUM");
+  if(env) {
+    curl_off_t num;
+    if(!curlx_str_number(&env, &num, INT_MAX) && num > 0)
+      testnum = (int)num;
+  }
+
+#if defined(UNITTESTS) && !defined(BUILDING_LIBCURL)
+  tool_init_stderr();
+#endif
+
+  result = entry_func(URL);
+  curl_mfprintf(stderr, "Test ended with result %d\n", (int)result);
+
+#ifdef _WIN32
   /* flush buffers of all streams regardless of mode */
   _flushall();
 #endif
diff --git a/third-party/curl/tests/libtest/first.h b/third-party/curl/tests/libtest/first.h
new file mode 100644
index 0000000000..fda2fd9f1f
--- /dev/null
+++ b/third-party/curl/tests/libtest/first.h
@@ -0,0 +1,536 @@
+#ifndef HEADER_LIBTEST_FIRST_H
+#define HEADER_LIBTEST_FIRST_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#define CURL_NO_OLDIES
+#define CURL_DISABLE_DEPRECATION
+
+/* Now include the curl_setup.h file from libcurl's private libdir (the source
+   version, but that might include "curl_config.h" from the build directory so
+   we need both of them in the include path), so that we get good in-depth
+   knowledge about the system we are building this on */
+#include "curl_setup.h"
+#include "testutil.h"
+
+typedef CURLcode (*entry_func_t)(const char *);
+
+struct entry_s {
+  const char *name;
+  entry_func_t ptr;
+};
+
+extern const struct entry_s s_entries[];
+
+extern int unitfail; /* for unittests */
+
+#include "curlx/base64.h" /* for curlx_base64* */
+#include "curlx/dynbuf.h" /* for curlx_dyn_*() */
+#include "curlx/fopen.h" /* for curlx_f*() */
+#include "curlx/strcopy.h" /* for curlx_strcopy() */
+#include "curlx/strerr.h" /* for curlx_strerror() */
+#include "curlx/strparse.h" /* for curlx_str_* parsing functions */
+#include "curlx/timediff.h" /* for timediff_t type and related functions */
+#include "curlx/timeval.h" /* for curlx_now type and related functions */
+#include "curlx/wait.h" /* for curlx_wait_ms() */
+
+#ifdef HAVE_SYS_SELECT_H
+/* since so many tests use select(), we can as well include it here */
+#include <sys/select.h>
+#endif
+
+extern const char *libtest_arg2; /* set by first.c to the argv[2] or NULL */
+extern const char *libtest_arg3; /* set by first.c to the argv[3] or NULL */
+extern const char *libtest_arg4; /* set by first.c to the argv[4] or NULL */
+extern const char *libtest_arg5; /* set by first.c to the argv[5] or NULL */
+
+/* argc and argv as passed in to the main() function */
+extern int test_argc;
+extern const char **test_argv;
+extern int testnum;
+extern struct curltime tv_test_start; /* for test timing */
+
+extern int coptind;
+extern const char *coptarg;
+int cgetopt(int argc, const char * const argv[], const char *optstring);
+
+extern int select_wrapper(int nfds, fd_set *rd, fd_set *wr, fd_set *exc,
+                          struct timeval *tv);
+
+extern char *hexdump(const unsigned char *buf, size_t len);
+
+#ifndef CURL_DISABLE_WEBSOCKETS
+CURLcode ws_send_ping(CURL *curl, const char *send_payload);
+CURLcode ws_recv_pong(CURL *curl, const char *expected_payload);
+void ws_close(CURL *curl);  /* close the connection */
+#endif
+
+/*
+ * TEST_ERR_* values must be within the CURLcode range to not cause compiler
+ * errors.
+ *
+ * For portability reasons TEST_ERR_* values should be less than 127.
+ */
+#define TEST_ERR_MAJOR_BAD    CURLE_OBSOLETE20
+#define TEST_ERR_RUNS_FOREVER CURLE_OBSOLETE24
+#define TEST_ERR_EASY_INIT    CURLE_OBSOLETE29
+#define TEST_ERR_MULTI        CURLE_OBSOLETE32
+#define TEST_ERR_NUM_HANDLES  CURLE_OBSOLETE34
+#define TEST_ERR_SELECT       CURLE_OBSOLETE40
+#define TEST_ERR_SUCCESS      CURLE_OBSOLETE41
+#define TEST_ERR_FAILURE      CURLE_OBSOLETE44
+#define TEST_ERR_USAGE        CURLE_OBSOLETE46
+#define TEST_ERR_FOPEN        CURLE_OBSOLETE50
+#define TEST_ERR_FSTAT        CURLE_OBSOLETE51
+#define TEST_ERR_BAD_TIMEOUT  CURLE_OBSOLETE57
+
+/*
+ * Macros for test source code readability/maintainability.
+ *
+ * All of the following macros require that an int data type 'res' variable
+ * exists in scope where macro is used, and that it has been initialized to
+ * zero before the macro is used.
+ *
+ * exe_* and chk_* macros are helper macros not intended to be used from
+ * outside of this header file. Arguments 'Y' and 'Z' of these represent
+ * source code file and line number, while Arguments 'A', 'B', etc, are
+ * the arguments used to actually call a libcurl function.
+ *
+ * All easy_* and multi_* macros call a libcurl function and evaluate if
+ * the function has succeeded or failed. When the function succeeds 'res'
+ * variable is not set nor cleared and program continues normal flow. On
+ * the other hand if function fails 'res' variable is set and a jump to
+ * label 'test_cleanup' is performed.
+ *
+ * Every easy_* and multi_* macros have a res_easy_* and res_multi_* macro
+ * counterpart that operates in the same way with the exception that no
+ * jump takes place in case of failure. res_easy_* and res_multi_* macros
+ * should be immediately followed by checking if 'res' variable has been
+ * set.
+ *
+ * 'res' variable when set holds a CURLcode, CURLMcode, or any of the
+ * TEST_ERR_* values defined above. It is advisable to return this value
+ * as test result.
+ */
+#ifndef UNITTESTS
+
+/* ---------------------------------------------------------------- */
+
+#define exe_easy_init(A, Y, Z)                                        \
+  do {                                                                \
+    (A) = curl_easy_init();                                           \
+    if(!(A)) {                                                        \
+      curl_mfprintf(stderr, "%s:%d curl_easy_init() failed\n", Y, Z); \
+      result = TEST_ERR_EASY_INIT;                                    \
+    }                                                                 \
+  } while(0)
+
+#define res_easy_init(A) \
+  exe_easy_init(A, __FILE__, __LINE__)
+
+#define chk_easy_init(A, Y, Z) \
+  do {                         \
+    exe_easy_init(A, Y, Z);    \
+    if(result)                 \
+      goto test_cleanup;       \
+  } while(0)
+
+#define easy_init(A) \
+  chk_easy_init(A, __FILE__, __LINE__)
+
+/* ---------------------------------------------------------------- */
+
+#define exe_multi_init(A, Y, Z)                                        \
+  do {                                                                 \
+    (A) = curl_multi_init();                                           \
+    if(!(A)) {                                                         \
+      curl_mfprintf(stderr, "%s:%d curl_multi_init() failed\n", Y, Z); \
+      result = TEST_ERR_MULTI;                                         \
+    }                                                                  \
+  } while(0)
+
+#define res_multi_init(A) \
+  exe_multi_init(A, __FILE__, __LINE__)
+
+#define chk_multi_init(A, Y, Z) \
+  do {                          \
+    exe_multi_init(A, Y, Z);    \
+    if(result)                  \
+      goto test_cleanup;        \
+  } while(0)
+
+#define multi_init(A) \
+  chk_multi_init(A, __FILE__, __LINE__)
+
+/* ---------------------------------------------------------------- */
+
+#define exe_easy_setopt(A, B, C, Y, Z)                              \
+  do {                                                              \
+    result = curl_easy_setopt(A, B, C);                             \
+    if(result)                                                      \
+      curl_mfprintf(stderr,                                         \
+                    "%s:%d curl_easy_setopt() failed, "             \
+                    "with code %d (%s)\n",                          \
+                    Y, Z, (int)result, curl_easy_strerror(result)); \
+  } while(0)
+
+#define res_easy_setopt(A, B, C) \
+  exe_easy_setopt(A, B, C, __FILE__, __LINE__)
+
+#define chk_easy_setopt(A, B, C, Y, Z) \
+  do {                                 \
+    exe_easy_setopt(A, B, C, Y, Z);    \
+    if(result)                         \
+      goto test_cleanup;               \
+  } while(0)
+
+#define easy_setopt(A, B, C) \
+  chk_easy_setopt(A, B, C, __FILE__, __LINE__)
+
+/* ---------------------------------------------------------------- */
+
+#define exe_multi_setopt(A, B, C, Y, Z)                  \
+  do {                                                   \
+    CURLMcode ec = curl_multi_setopt(A, B, C);           \
+    if(ec != CURLM_OK) {                                 \
+      curl_mfprintf(stderr,                              \
+                    "%s:%d curl_multi_setopt() failed, " \
+                    "with code %d (%s)\n",               \
+                    Y, Z, ec, curl_multi_strerror(ec));  \
+      result = TEST_ERR_MULTI;                           \
+    }                                                    \
+  } while(0)
+
+#define chk_multi_setopt(A, B, C, Y, Z) \
+  do {                                  \
+    exe_multi_setopt(A, B, C, Y, Z);    \
+    if(result)                          \
+      goto test_cleanup;                \
+  } while(0)
+
+#define multi_setopt(A, B, C) \
+  chk_multi_setopt(A, B, C, __FILE__, __LINE__)
+
+/* ---------------------------------------------------------------- */
+
+#define exe_multi_add_handle(A, B, Y, Z)                     \
+  do {                                                       \
+    CURLMcode ec = curl_multi_add_handle(A, B);              \
+    if(ec != CURLM_OK) {                                     \
+      curl_mfprintf(stderr,                                  \
+                    "%s:%d curl_multi_add_handle() failed, " \
+                    "with code %d (%s)\n",                   \
+                    Y, Z, ec, curl_multi_strerror(ec));      \
+      result = TEST_ERR_MULTI;                               \
+    }                                                        \
+  } while(0)
+
+#define res_multi_add_handle(A, B) \
+  exe_multi_add_handle(A, B, __FILE__, __LINE__)
+
+#define chk_multi_add_handle(A, B, Y, Z) \
+  do {                                   \
+    exe_multi_add_handle(A, B, Y, Z);    \
+    if(result)                           \
+      goto test_cleanup;                 \
+  } while(0)
+
+#define multi_add_handle(A, B) \
+  chk_multi_add_handle(A, B, __FILE__, __LINE__)
+
+/* ---------------------------------------------------------------- */
+
+#define exe_multi_remove_handle(A, B, Y, Z)                     \
+  do {                                                          \
+    CURLMcode ec = curl_multi_remove_handle(A, B);              \
+    if(ec != CURLM_OK) {                                        \
+      curl_mfprintf(stderr,                                     \
+                    "%s:%d curl_multi_remove_handle() failed, " \
+                    "with code %d (%s)\n",                      \
+                    Y, Z, ec, curl_multi_strerror(ec));         \
+      result = TEST_ERR_MULTI;                                  \
+    }                                                           \
+  } while(0)
+
+#define chk_multi_remove_handle(A, B, Y, Z) \
+  do {                                      \
+    exe_multi_remove_handle(A, B, Y, Z);    \
+    if(result)                              \
+      goto test_cleanup;                    \
+  } while(0)
+
+#define multi_remove_handle(A, B) \
+  chk_multi_remove_handle(A, B, __FILE__, __LINE__)
+
+/* ---------------------------------------------------------------- */
+
+#define exe_multi_perform(A, B, Y, Z)                                    \
+  do {                                                                   \
+    CURLMcode ec = curl_multi_perform(A, B);                             \
+    if(ec != CURLM_OK) {                                                 \
+      curl_mfprintf(stderr,                                              \
+                    "%s:%d curl_multi_perform() failed, "                \
+                    "with code %d (%s)\n",                               \
+                    Y, Z, ec, curl_multi_strerror(ec));                  \
+      result = TEST_ERR_MULTI;                                           \
+    }                                                                    \
+    else if(*(B) < 0) {                                                  \
+      curl_mfprintf(stderr,                                              \
+                    "%s:%d curl_multi_perform() succeeded, "             \
+                    "but returned invalid running_handles value (%d)\n", \
+                    Y, Z, (int)*(B));                                    \
+      result = TEST_ERR_NUM_HANDLES;                                     \
+    }                                                                    \
+  } while(0)
+
+#define res_multi_perform(A, B) \
+  exe_multi_perform(A, B, __FILE__, __LINE__)
+
+#define chk_multi_perform(A, B, Y, Z) \
+  do {                                \
+    exe_multi_perform(A, B, Y, Z);    \
+    if(result)                        \
+      goto test_cleanup;              \
+  } while(0)
+
+#define multi_perform(A, B) \
+  chk_multi_perform(A, B, __FILE__, __LINE__)
+
+/* ---------------------------------------------------------------- */
+
+#define exe_multi_fdset(A, B, C, D, E, Y, Z)                    \
+  do {                                                          \
+    CURLMcode ec = curl_multi_fdset(A, B, C, D, E);             \
+    if(ec != CURLM_OK) {                                        \
+      curl_mfprintf(stderr,                                     \
+                    "%s:%d curl_multi_fdset() failed, "         \
+                    "with code %d (%s)\n",                      \
+                    Y, Z, ec, curl_multi_strerror(ec));         \
+      result = TEST_ERR_MULTI;                                  \
+    }                                                           \
+    else if(*(E) < -1) {                                        \
+      curl_mfprintf(stderr,                                     \
+                    "%s:%d curl_multi_fdset() succeeded, "      \
+                    "but returned invalid max_fd value (%d)\n", \
+                    Y, Z, (int)*(E));                           \
+      result = TEST_ERR_NUM_HANDLES;                            \
+    }                                                           \
+  } while(0)
+
+#define res_multi_fdset(A, B, C, D, E) \
+  exe_multi_fdset(A, B, C, D, E, __FILE__, __LINE__)
+
+#define chk_multi_fdset(A, B, C, D, E, Y, Z) \
+  do {                                       \
+    exe_multi_fdset(A, B, C, D, E, Y, Z);    \
+    if(result)                               \
+      goto test_cleanup;                     \
+  } while(0)
+
+#define multi_fdset(A, B, C, D, E) \
+  chk_multi_fdset(A, B, C, D, E, __FILE__, __LINE__)
+
+/* ---------------------------------------------------------------- */
+
+#define exe_multi_timeout(A, B, Y, Z)                             \
+  do {                                                            \
+    CURLMcode ec = curl_multi_timeout(A, B);                      \
+    if(ec != CURLM_OK) {                                          \
+      curl_mfprintf(stderr,                                       \
+                    "%s:%d curl_multi_timeout() failed, "         \
+                    "with code %d (%s)\n",                        \
+                    Y, Z, ec, curl_multi_strerror(ec));           \
+      result = TEST_ERR_BAD_TIMEOUT;                              \
+    }                                                             \
+    else if(*(B) < -1L) {                                         \
+      curl_mfprintf(stderr,                                       \
+                    "%s:%d curl_multi_timeout() succeeded, "      \
+                    "but returned invalid timeout value (%ld)\n", \
+                    Y, Z, (long)*(B));                            \
+      result = TEST_ERR_BAD_TIMEOUT;                              \
+    }                                                             \
+  } while(0)
+
+#define res_multi_timeout(A, B) \
+  exe_multi_timeout(A, B, __FILE__, __LINE__)
+
+#define chk_multi_timeout(A, B, Y, Z) \
+  do {                                \
+    exe_multi_timeout(A, B, Y, Z);    \
+    if(result)                        \
+      goto test_cleanup;              \
+  } while(0)
+
+#define multi_timeout(A, B) \
+  chk_multi_timeout(A, B, __FILE__, __LINE__)
+
+/* ---------------------------------------------------------------- */
+
+#define exe_multi_poll(A, B, C, D, E, Y, Z)                     \
+  do {                                                          \
+    CURLMcode ec = curl_multi_poll(A, B, C, D, E);              \
+    if(ec != CURLM_OK) {                                        \
+      curl_mfprintf(stderr,                                     \
+                    "%s:%d curl_multi_poll() failed, "          \
+                    "with code %d (%s)\n",                      \
+                    Y, Z, ec, curl_multi_strerror(ec));         \
+      result = TEST_ERR_MULTI;                                  \
+    }                                                           \
+    else if(*(E) < 0) {                                         \
+      curl_mfprintf(stderr,                                     \
+                    "%s:%d curl_multi_poll() succeeded, "       \
+                    "but returned invalid numfds value (%d)\n", \
+                    Y, Z, (int)*(E));                           \
+      result = TEST_ERR_NUM_HANDLES;                            \
+    }                                                           \
+  } while(0)
+
+#define chk_multi_poll(A, B, C, D, E, Y, Z) \
+  do {                                      \
+    exe_multi_poll(A, B, C, D, E, Y, Z);    \
+    if(result)                              \
+      goto test_cleanup;                    \
+  } while(0)
+
+#define multi_poll(A, B, C, D, E) \
+  chk_multi_poll(A, B, C, D, E, __FILE__, __LINE__)
+
+/* ---------------------------------------------------------------- */
+
+#define exe_multi_wakeup(A, Y, Z)                        \
+  do {                                                   \
+    CURLMcode ec = curl_multi_wakeup(A);                 \
+    if(ec != CURLM_OK) {                                 \
+      curl_mfprintf(stderr,                              \
+                    "%s:%d curl_multi_wakeup() failed, " \
+                    "with code %d (%s)\n",               \
+                    Y, Z, ec, curl_multi_strerror(ec));  \
+      result = TEST_ERR_MULTI;                           \
+    }                                                    \
+  } while(0)
+
+#define res_multi_wakeup(A) \
+  exe_multi_wakeup(A, __FILE__, __LINE__)
+
+/* ---------------------------------------------------------------- */
+
+#define exe_select_test(A, B, C, D, E, Y, Z)                             \
+  do {                                                                   \
+    if(select_wrapper(A, B, C, D, E) == -1) {                            \
+      int sockerr = SOCKERRNO;                                           \
+      char sockerrbuf[STRERROR_LEN];                                     \
+      curl_mfprintf(stderr,                                              \
+                    "%s:%d select() failed, with errno %d (%s)\n", Y, Z, \
+                    sockerr, curlx_strerror(sockerr, sockerrbuf,         \
+                                            sizeof(sockerrbuf)));        \
+      result = TEST_ERR_SELECT;                                          \
+    }                                                                    \
+  } while(0)
+
+#define res_select_test(A, B, C, D, E) \
+  exe_select_test(A, B, C, D, E, __FILE__, __LINE__)
+
+#define chk_select_test(A, B, C, D, E, Y, Z) \
+  do {                                       \
+    exe_select_test(A, B, C, D, E, Y, Z);    \
+    if(result)                               \
+      goto test_cleanup;                     \
+  } while(0)
+
+#define select_test(A, B, C, D, E) \
+  chk_select_test(A, B, C, D, E, __FILE__, __LINE__)
+
+/* ---------------------------------------------------------------- */
+
+#define start_test_timing()      \
+  do {                           \
+    tv_test_start = curlx_now(); \
+  } while(0)
+
+#define TEST_HANG_TIMEOUT (60 * 1000)  /* global default */
+
+#define exe_test_timedout(T, Y, Z)                                        \
+  do {                                                                    \
+    timediff_t timediff = curlx_timediff_ms(curlx_now(), tv_test_start);  \
+    if(timediff > (T)) {                                                  \
+      curl_mfprintf(stderr,                                               \
+                    "%s:%d ABORTING TEST, since it seems "                \
+                    "that it would have run forever (%ld ms > %ld ms)\n", \
+                    Y, Z, (long)timediff, (long)TEST_HANG_TIMEOUT);       \
+      result = TEST_ERR_RUNS_FOREVER;                                     \
+    }                                                                     \
+  } while(0)
+
+#define res_test_timedout() \
+  exe_test_timedout(TEST_HANG_TIMEOUT, __FILE__, __LINE__)
+
+#define chk_test_timedout(T, Y, Z) \
+  do {                             \
+    exe_test_timedout(T, Y, Z);    \
+    if(result)                     \
+      goto test_cleanup;           \
+  } while(0)
+
+#define abort_on_test_timeout() \
+  chk_test_timedout(TEST_HANG_TIMEOUT, __FILE__, __LINE__)
+
+#define abort_on_test_timeout_custom(T) \
+  chk_test_timedout(T, __FILE__, __LINE__)
+
+#define NUM_HANDLES 4  /* global default */
+
+#define res_global_init(A) \
+  exe_global_init(A, __FILE__, __LINE__)
+
+#endif /* !UNITTESTS */
+
+#if !defined(UNITTESTS) || defined(BUILDING_LIBCURL)
+
+/* ---------------------------------------------------------------- */
+
+#define exe_global_init(A, Y, Z)                                    \
+  do {                                                              \
+    result = curl_global_init(A);                                   \
+    if(result)                                                      \
+      curl_mfprintf(stderr,                                         \
+                    "%s:%d curl_global_init() failed, "             \
+                    "with code %d (%s)\n",                          \
+                    Y, Z, (int)result, curl_easy_strerror(result)); \
+  } while(0)
+
+#define chk_global_init(A, Y, Z) \
+  do {                           \
+    exe_global_init(A, Y, Z);    \
+    if(result)                   \
+      return result;             \
+  } while(0)
+
+/* global_init() is different than other macros. In case of
+   failure it 'return's instead of going to 'test_cleanup'. */
+
+#define global_init(A) \
+  chk_global_init(A, __FILE__, __LINE__)
+
+#endif /* !UNITTESTS || BUILDING_LIBCURL */
+
+#endif /* HEADER_LIBTEST_FIRST_H */
diff --git a/third-party/curl/tests/libtest/lib1156.c b/third-party/curl/tests/libtest/lib1156.c
index aae2893ef3..b8339c2456 100644
--- a/third-party/curl/tests/libtest/lib1156.c
+++ b/third-party/curl/tests/libtest/lib1156.c
@@ -21,7 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
 /*
   Check range/resume returned error codes and data presence.
@@ -34,20 +34,18 @@
 
 */
 
-#include "memdebug.h"
-
-#define F_RESUME        (1 << 0)        /* resume/range. */
-#define F_HTTP416       (1 << 1)        /* Server returns http code 416. */
-#define F_FAIL          (1 << 2)        /* Fail on error. */
-#define F_CONTENTRANGE  (1 << 3)        /* Server sends content-range hdr. */
-#define F_IGNOREBODY    (1 << 4)        /* Body should be ignored. */
+#define F_RESUME       (1 << 0)        /* resume/range. */
+#define F_HTTP416      (1 << 1)        /* Server returns http code 416. */
+#define F_FAIL         (1 << 2)        /* Fail on error. */
+#define F_CONTENTRANGE (1 << 3)        /* Server sends content-range hdr. */
+#define F_IGNOREBODY   (1 << 4)        /* Body should be ignored. */
 
 struct testparams {
   unsigned int flags; /* ORed flags as above. */
   CURLcode result; /* Code that should be returned by curl_easy_perform(). */
 };
 
-static const struct testparams params[] = {
+static const struct testparams testparams[] = {
   { 0,                                                             CURLE_OK },
   {                                 F_CONTENTRANGE,                CURLE_OK },
   {                        F_FAIL,                                 CURLE_OK },
@@ -68,15 +66,15 @@ static const struct testparams params[] = {
   { F_RESUME | F_HTTP416 |          F_CONTENTRANGE | F_IGNOREBODY, CURLE_OK },
   { F_RESUME | F_HTTP416 | F_FAIL |                  F_IGNOREBODY, CURLE_OK },
   { F_RESUME | F_HTTP416 | F_FAIL | F_CONTENTRANGE | F_IGNOREBODY,
-                                                  CURLE_HTTP_RETURNED_ERROR }
+                                                                   CURLE_OK }
 };
 
-static int      hasbody;
+static int hasbody;
 
 static size_t writedata(char *data, size_t size, size_t nmemb, void *userdata)
 {
-  (void) data;
-  (void) userdata;
+  (void)data;
+  (void)userdata;
 
   if(size && nmemb)
     hasbody = 1;
@@ -86,39 +84,39 @@ static size_t writedata(char *data, size_t size, size_t nmemb, void *userdata)
 static int onetest(CURL *curl, const char *url, const struct testparams *p,
                    size_t num)
 {
-  CURLcode res;
+  CURLcode result;
   unsigned int replyselector;
   char urlbuf[256];
 
-  replyselector = (p->flags & F_CONTENTRANGE)? 1: 0;
+  replyselector = (p->flags & F_CONTENTRANGE) ? 1 : 0;
   if(p->flags & F_HTTP416)
     replyselector += 2;
-  msnprintf(urlbuf, sizeof(urlbuf), "%s%04u", url, replyselector);
-  test_setopt(curl, CURLOPT_URL, urlbuf);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_RESUME_FROM, (p->flags & F_RESUME)? 3: 0);
-  test_setopt(curl, CURLOPT_RANGE, !(p->flags & F_RESUME)?
-                                   "3-1000000": (char *) NULL);
-  test_setopt(curl, CURLOPT_FAILONERROR, (p->flags & F_FAIL)? 1: 0);
+  curl_msnprintf(urlbuf, sizeof(urlbuf), "%s%04u", url, replyselector);
+  easy_setopt(curl, CURLOPT_URL, urlbuf);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_RESUME_FROM, (p->flags & F_RESUME) ? 3L : 0L);
+  easy_setopt(curl, CURLOPT_RANGE, !(p->flags & F_RESUME) ?
+                                   "3-1000000" : (char *)NULL);
+  easy_setopt(curl, CURLOPT_FAILONERROR, (p->flags & F_FAIL) ? 1L : 0L);
   hasbody = 0;
-  res = curl_easy_perform(curl);
-  if(res != p->result) {
-    printf("%zd: bad error code (%d): resume=%s, fail=%s, http416=%s, "
-           "content-range=%s, expected=%d\n", num, res,
-           (p->flags & F_RESUME)? "yes": "no",
-           (p->flags & F_FAIL)? "yes": "no",
-           (p->flags & F_HTTP416)? "yes": "no",
-           (p->flags & F_CONTENTRANGE)? "yes": "no",
-           p->result);
+  result = curl_easy_perform(curl);
+  if(result != p->result) {
+    curl_mprintf("%zu: bad error code (%d): resume=%s, fail=%s, http416=%s, "
+                 "content-range=%s, expected=%d\n", num, (int)result,
+                 (p->flags & F_RESUME) ? "yes" : "no",
+                 (p->flags & F_FAIL) ? "yes" : "no",
+                 (p->flags & F_HTTP416) ? "yes" : "no",
+                 (p->flags & F_CONTENTRANGE) ? "yes" : "no",
+                 (int)p->result);
     return 1;
   }
   if(hasbody && (p->flags & F_IGNOREBODY)) {
-    printf("body should be ignored and is not: resume=%s, fail=%s, "
-           "http416=%s, content-range=%s\n",
-           (p->flags & F_RESUME)? "yes": "no",
-           (p->flags & F_FAIL)? "yes": "no",
-           (p->flags & F_HTTP416)? "yes": "no",
-           (p->flags & F_CONTENTRANGE)? "yes": "no");
+    curl_mprintf("body should be ignored and is not: resume=%s, fail=%s, "
+                 "http416=%s, content-range=%s\n",
+                 (p->flags & F_RESUME) ? "yes" : "no",
+                 (p->flags & F_FAIL) ? "yes" : "no",
+                 (p->flags & F_HTTP416) ? "yes" : "no",
+                 (p->flags & F_CONTENTRANGE) ? "yes" : "no");
     return 1;
   }
   return 0;
@@ -131,43 +129,43 @@ test_cleanup:
 /* for debugging: */
 /* #define SINGLETEST 9 */
 
-int test(char *URL)
+static CURLcode test_lib1156(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
   size_t i;
   int status = 0;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
-  for(i = 0; i < sizeof(params) / sizeof(params[0]); i++) {
+  for(i = 0; i < CURL_ARRAYSIZE(testparams); i++) {
     curl = curl_easy_init();
     if(!curl) {
-      fprintf(stderr, "curl_easy_init() failed\n");
+      curl_mfprintf(stderr, "curl_easy_init() failed\n");
       curl_global_cleanup();
       return TEST_ERR_MAJOR_BAD;
     }
 
-    test_setopt(curl, CURLOPT_WRITEFUNCTION, writedata);
+    easy_setopt(curl, CURLOPT_WRITEFUNCTION, writedata);
 
 #ifdef SINGLETEST
     if(SINGLETEST == i)
 #endif
-      status |= onetest(curl, URL, params + i, i);
+      status |= onetest(curl, URL, testparams + i, i);
     curl_easy_cleanup(curl);
   }
 
   curl_global_cleanup();
-  printf("%d\n", status);
-  return status;
+  curl_mprintf("%d\n", status);
+  return status ? TEST_ERR_FAILURE : CURLE_OK;
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1301.c b/third-party/curl/tests/libtest/lib1301.c
index f63b94ccda..d476aed148 100644
--- a/third-party/curl/tests/libtest/lib1301.c
+++ b/third-party/curl/tests/libtest/lib1301.c
@@ -21,42 +21,42 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#define fail_unless(expr, msg)                             \
-  do {                                                     \
-    if(!(expr)) {                                          \
-      fprintf(stderr, "%s:%d Assertion '%s' failed: %s\n", \
-              __FILE__, __LINE__, #expr, msg);             \
-      return 1;                                            \
-    }                                                      \
+#define t1301_fail_unless(expr, msg)                             \
+  do {                                                           \
+    if(!(expr)) {                                                \
+      curl_mfprintf(stderr, "%s:%d Assertion '%s' FAILED: %s\n", \
+                    __FILE__, __LINE__, #expr, msg);             \
+      return TEST_ERR_FAILURE;                                   \
+    }                                                            \
   } while(0)
 
-int test(char *URL)
+static CURLcode test_lib1301(const char *URL)
 {
   int rc;
   (void)URL;
 
   rc = curl_strequal("iii", "III");
-  fail_unless(rc != 0, "return code should be non-zero");
+  t1301_fail_unless(rc != 0, "return code should be non-zero");
 
   rc = curl_strequal("iiia", "III");
-  fail_unless(rc == 0, "return code should be zero");
+  t1301_fail_unless(rc == 0, "return code should be zero");
 
   rc = curl_strequal("iii", "IIIa");
-  fail_unless(rc == 0, "return code should be zero");
+  t1301_fail_unless(rc == 0, "return code should be zero");
 
   rc = curl_strequal("iiiA", "IIIa");
-  fail_unless(rc != 0, "return code should be non-zero");
+  t1301_fail_unless(rc != 0, "return code should be non-zero");
 
   rc = curl_strnequal("iii", "III", 3);
-  fail_unless(rc != 0, "return code should be non-zero");
+  t1301_fail_unless(rc != 0, "return code should be non-zero");
 
   rc = curl_strnequal("iiiABC", "IIIcba", 3);
-  fail_unless(rc != 0, "return code should be non-zero");
+  t1301_fail_unless(rc != 0, "return code should be non-zero");
 
   rc = curl_strnequal("ii", "II", 3);
-  fail_unless(rc != 0, "return code should be non-zero");
+  t1301_fail_unless(rc != 0, "return code should be non-zero");
 
-  return 0;
+  return CURLE_OK;
 }
diff --git a/third-party/curl/tests/libtest/lib1308.c b/third-party/curl/tests/libtest/lib1308.c
new file mode 100644
index 0000000000..aaddbf04ed
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1308.c
@@ -0,0 +1,99 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static size_t print_httppost_callback(void *arg, const char *buf, size_t len)
+{
+  fwrite(buf, len, 1, stdout);
+  *((size_t *)arg) += len;
+  return len;
+}
+
+#define t1308_fail_unless(expr, msg)                             \
+  do {                                                           \
+    if(!(expr)) {                                                \
+      curl_mfprintf(stderr, "%s:%d Assertion '%s' FAILED: %s\n", \
+                    __FILE__, __LINE__, #expr, msg);             \
+      errorcount++;                                              \
+    }                                                            \
+  } while(0)
+
+static CURLcode test_lib1308(const char *URL)
+{
+  int errorcount = 0;
+  CURLFORMcode rc;
+  CURLcode result = CURLE_OK;
+  int formres = 0;
+  struct curl_httppost *post = NULL;
+  struct curl_httppost *last = NULL;
+  size_t total_size = 0;
+  char buffer[] = "test buffer";
+
+  global_init(CURL_GLOBAL_ALL);
+
+  rc = curl_formadd(&post, &last, CURLFORM_COPYNAME, "name",
+                    CURLFORM_COPYCONTENTS, "content", CURLFORM_END);
+  t1308_fail_unless(rc == 0, "curl_formadd returned error");
+
+  /* after the first curl_formadd when there is a single entry, both pointers
+     should point to the same struct */
+  t1308_fail_unless(post == last, "post and last were not the same");
+
+  rc = curl_formadd(&post, &last, CURLFORM_COPYNAME, "htmlcode",
+                    CURLFORM_COPYCONTENTS, "<HTML></HTML>",
+                    CURLFORM_CONTENTTYPE, "text/html", CURLFORM_END);
+  t1308_fail_unless(rc == 0, "curl_formadd returned error");
+
+  rc = curl_formadd(&post, &last, CURLFORM_COPYNAME, "name_for_ptrcontent",
+                    CURLFORM_PTRCONTENTS, buffer, CURLFORM_END);
+  t1308_fail_unless(rc == 0, "curl_formadd returned error");
+
+  formres = curl_formget(post, &total_size, print_httppost_callback);
+  t1308_fail_unless(formres == 0, "curl_formget returned error");
+
+  t1308_fail_unless(total_size == 518, "curl_formget got wrong size back");
+
+  curl_formfree(post);
+
+  /* start a new formpost with a file upload and formget */
+  post = last = NULL;
+
+  rc = curl_formadd(&post, &last,
+                    CURLFORM_PTRNAME, "name of file field",
+                    CURLFORM_FILE, URL,
+                    CURLFORM_FILENAME, "custom named file",
+                    CURLFORM_END);
+  t1308_fail_unless(rc == 0, "curl_formadd returned error");
+
+  formres = curl_formget(post, &total_size, print_httppost_callback);
+
+  t1308_fail_unless(formres == 0, "curl_formget returned error");
+  t1308_fail_unless(total_size == 899, "curl_formget got wrong size back");
+
+  curl_formfree(post);
+
+  curl_global_cleanup();
+
+  return errorcount ? TEST_ERR_FAILURE : CURLE_OK;
+}
diff --git a/third-party/curl/tests/libtest/lib1485.c b/third-party/curl/tests/libtest/lib1485.c
new file mode 100644
index 0000000000..46b9851513
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1485.c
@@ -0,0 +1,117 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+struct t1485_transfer_status {
+  CURL *curl;
+  curl_off_t out_len;
+  size_t hd_line;
+  CURLcode result;
+  int http_status;
+};
+
+static size_t t1485_header_callback(char *ptr, size_t size, size_t nmemb,
+                                    void *userp)
+{
+  struct t1485_transfer_status *st = (struct t1485_transfer_status *)userp;
+  const char *hd = ptr;
+  size_t len = size * nmemb;
+  CURLcode result;
+
+  (void)fwrite(ptr, size, nmemb, stdout);
+  ++st->hd_line;
+  if(len == 2 && hd[0] == '\r' && hd[1] == '\n') {
+    curl_off_t clen;
+    long httpcode = 0;
+    /* end of a response */
+    result = curl_easy_getinfo(st->curl, CURLINFO_RESPONSE_CODE, &httpcode);
+    curl_mfprintf(stderr, "header_callback, get status: %ld, %d\n",
+                  httpcode, (int)result);
+    if(httpcode < 100 || httpcode >= 1000) {
+      curl_mfprintf(stderr, "header_callback, invalid status: %ld, %d\n",
+                    httpcode, (int)result);
+      return CURLE_WRITE_ERROR;
+    }
+    st->http_status = (int)httpcode;
+    if(st->http_status >= 200 && st->http_status < 300) {
+      result = curl_easy_getinfo(st->curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD_T,
+                              &clen);
+      curl_mfprintf(stderr, "header_callback, info Content-Length: "
+                    "%" CURL_FORMAT_CURL_OFF_T ", %d\n", clen, (int)result);
+      if(result) {
+        st->result = result;
+        return CURLE_WRITE_ERROR;
+      }
+      if(clen < 0) {
+        curl_mfprintf(stderr,
+                      "header_callback, expected known Content-Length, "
+                      "got: %" CURL_FORMAT_CURL_OFF_T "\n", clen);
+        return CURLE_WRITE_ERROR;
+      }
+    }
+  }
+  return len;
+}
+
+static size_t t1485_write_cb(char *ptr, size_t size, size_t nmemb, void *userp)
+{
+  struct t1485_transfer_status *st = (struct t1485_transfer_status *)userp;
+  size_t len = size * nmemb;
+  fwrite(ptr, size, nmemb, stdout);
+  st->out_len += (curl_off_t)len;
+  return len;
+}
+
+static CURLcode test_lib1485(const char *URL)
+{
+  CURL *curl = NULL;
+  CURLcode result = CURLE_OK;
+  struct t1485_transfer_status st;
+
+  start_test_timing();
+
+  memset(&st, 0, sizeof(st));
+
+  global_init(CURL_GLOBAL_ALL);
+
+  easy_init(curl);
+  st.curl = curl; /* to allow callbacks access */
+
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_WRITEFUNCTION, t1485_write_cb);
+  easy_setopt(curl, CURLOPT_WRITEDATA, &st);
+  easy_setopt(curl, CURLOPT_HEADERFUNCTION, t1485_header_callback);
+  easy_setopt(curl, CURLOPT_HEADERDATA, &st);
+
+  easy_setopt(curl, CURLOPT_NOPROGRESS, 1L);
+
+  result = curl_easy_perform(curl);
+
+test_cleanup:
+
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+
+  return result; /* return the final return code */
+}
diff --git a/third-party/curl/tests/libtest/lib1500.c b/third-party/curl/tests/libtest/lib1500.c
index 3f237a0316..02c304795b 100644
--- a/third-party/curl/tests/libtest/lib1500.c
+++ b/third-party/curl/tests/libtest/lib1500.c
@@ -21,21 +21,15 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
-
-int test(char *URL)
+static CURLcode test_lib1500(const char *URL)
 {
-  CURL *curls = NULL;
+  CURL *curl = NULL;
   CURLM *multi = NULL;
   int still_running;
-  int i = TEST_ERR_FAILURE;
-  int res = 0;
+  CURLcode i = TEST_ERR_FAILURE;
+  CURLcode result = CURLE_OK;
   CURLMsg *msg;
 
   start_test_timing();
@@ -44,23 +38,24 @@ int test(char *URL)
 
   multi_init(multi);
 
-  easy_init(curls);
+  easy_init(curl);
 
-  easy_setopt(curls, CURLOPT_URL, URL);
-  easy_setopt(curls, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-  multi_add_handle(multi, curls);
+  multi_add_handle(multi, curl);
 
   multi_perform(multi, &still_running);
 
   abort_on_test_timeout();
 
   while(still_running) {
+    CURLMcode mresult;
     int num;
-    res = curl_multi_wait(multi, NULL, 0, TEST_HANG_TIMEOUT, &num);
-    if(res != CURLM_OK) {
-      printf("curl_multi_wait() returned %d\n", res);
-      res = TEST_ERR_MAJOR_BAD;
+    mresult = curl_multi_wait(multi, NULL, 0, TEST_HANG_TIMEOUT, &num);
+    if(mresult != CURLM_OK) {
+      curl_mprintf("curl_multi_wait() returned %d\n", mresult);
+      result = TEST_ERR_MAJOR_BAD;
       goto test_cleanup;
     }
 
@@ -82,11 +77,11 @@ test_cleanup:
   /* undocumented cleanup sequence - type UA */
 
   curl_multi_cleanup(multi);
-  curl_easy_cleanup(curls);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  if(res)
-    i = res;
+  if(result)
+    i = result;
 
   return i; /* return the final return code */
 }
diff --git a/third-party/curl/tests/libtest/lib1501.c b/third-party/curl/tests/libtest/lib1501.c
index a4816c777c..5a6eacd09f 100644
--- a/third-party/curl/tests/libtest/lib1501.c
+++ b/third-party/curl/tests/libtest/lib1501.c
@@ -21,43 +21,36 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include <fcntl.h>
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 30 * 1000
-
-/* 500 milliseconds allowed. An extreme number but lets be really conservative
-   to allow old and slow machines to run this test too */
-#define MAX_BLOCKED_TIME_MS 500
-
-int test(char *URL)
+static CURLcode test_lib1501(const char *URL)
 {
-  CURL *handle = NULL;
-  CURLM *mhandle = NULL;
-  int res = 0;
+  static const long HANG_TIMEOUT = 30 * 1000;
+  /* 500 milliseconds allowed. An extreme number but lets be really
+     conservative to allow old and slow machines to run this test too */
+  static const int MAX_BLOCKED_TIME_MS = 500;
+
+  CURL *curl = NULL;
+  CURLM *multi = NULL;
+  CURLcode result = CURLE_OK;
   int still_running = 0;
 
   start_test_timing();
 
   global_init(CURL_GLOBAL_ALL);
 
-  easy_init(handle);
+  easy_init(curl);
 
-  easy_setopt(handle, CURLOPT_URL, URL);
-  easy_setopt(handle, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  multi_init(mhandle);
+  multi_init(multi);
 
-  multi_add_handle(mhandle, handle);
+  multi_add_handle(multi, curl);
 
-  multi_perform(mhandle, &still_running);
+  multi_perform(multi, &still_running);
 
-  abort_on_test_timeout();
+  abort_on_test_timeout_custom(HANG_TIMEOUT);
 
   while(still_running) {
     struct timeval timeout;
@@ -65,9 +58,9 @@ int test(char *URL)
     fd_set fdwrite;
     fd_set fdexcep;
     int maxfd = -99;
-    struct timeval before;
-    struct timeval after;
-    long e;
+    struct curltime before;
+    struct curltime after;
+    timediff_t e;
 
     timeout.tv_sec = 0;
     timeout.tv_usec = 100000L; /* 100 ms */
@@ -76,27 +69,27 @@ int test(char *URL)
     FD_ZERO(&fdwrite);
     FD_ZERO(&fdexcep);
 
-    multi_fdset(mhandle, &fdread, &fdwrite, &fdexcep, &maxfd);
+    multi_fdset(multi, &fdread, &fdwrite, &fdexcep, &maxfd);
 
     /* At this point, maxfd is guaranteed to be greater or equal than -1. */
 
     select_test(maxfd + 1, &fdread, &fdwrite, &fdexcep, &timeout);
 
-    abort_on_test_timeout();
+    abort_on_test_timeout_custom(HANG_TIMEOUT);
 
-    fprintf(stderr, "ping\n");
-    before = tutil_tvnow();
+    curl_mfprintf(stderr, "ping\n");
+    before = curlx_now();
 
-    multi_perform(mhandle, &still_running);
+    multi_perform(multi, &still_running);
 
-    abort_on_test_timeout();
+    abort_on_test_timeout_custom(HANG_TIMEOUT);
 
-    after = tutil_tvnow();
-    e = tutil_tvdiff(after, before);
-    fprintf(stderr, "pong = %ld\n", e);
+    after = curlx_now();
+    e = curlx_timediff_ms(after, before);
+    curl_mfprintf(stderr, "pong = %ld\n", (long)e);
 
     if(e > MAX_BLOCKED_TIME_MS) {
-      res = 100;
+      result = CURLE_TOO_LARGE;
       break;
     }
   }
@@ -105,9 +98,9 @@ test_cleanup:
 
   /* undocumented cleanup sequence - type UA */
 
-  curl_multi_cleanup(mhandle);
-  curl_easy_cleanup(handle);
+  curl_multi_cleanup(multi);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1502.c b/third-party/curl/tests/libtest/lib1502.c
index 2e2415b723..4b52a8050b 100644
--- a/third-party/curl/tests/libtest/lib1502.c
+++ b/third-party/curl/tests/libtest/lib1502.c
@@ -23,73 +23,64 @@
  ***************************************************************************/
 /*
  * This source code is used for lib1502, lib1503, lib1504 and lib1505 with
- * only #ifdefs controlling the cleanup sequence.
+ * only the testnum controlling the cleanup sequence.
  *
  * Test case 1502 converted from bug report #3575448, identifying a memory
  * leak in the CURLOPT_RESOLVE handling with the multi interface.
  */
 
-#include "test.h"
+#include "first.h"
 
-#include <limits.h>
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
-
-int test(char *URL)
+static CURLcode test_lib1502(const char *URL)
 {
-  CURL *easy = NULL;
-  CURL *dup;
+  CURL *curl = NULL;
+  CURL *curldupe;
   CURLM *multi = NULL;
   int still_running;
-  int res = 0;
-
+  CURLcode result = CURLE_OK;
   char redirect[160];
 
   /* DNS cache injection */
   struct curl_slist *dns_cache_list;
 
   res_global_init(CURL_GLOBAL_ALL);
-  if(res) {
-    return res;
+  if(result) {
+    return result;
   }
 
-  msnprintf(redirect, sizeof(redirect), "google.com:%s:%s", libtest_arg2,
-            libtest_arg3);
+  curl_msnprintf(redirect, sizeof(redirect), "google.com:%s:%s", libtest_arg2,
+                 libtest_arg3);
 
   start_test_timing();
 
   dns_cache_list = curl_slist_append(NULL, redirect);
   if(!dns_cache_list) {
-    fprintf(stderr, "curl_slist_append() failed\n");
+    curl_mfprintf(stderr, "curl_slist_append() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  easy_init(easy);
+  easy_init(curl);
 
-  easy_setopt(easy, CURLOPT_URL, URL);
-  easy_setopt(easy, CURLOPT_HEADER, 1L);
-  easy_setopt(easy, CURLOPT_RESOLVE, dns_cache_list);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_RESOLVE, dns_cache_list);
 
-  dup = curl_easy_duphandle(easy);
-  if(dup) {
-    curl_easy_cleanup(easy);
-    easy = dup;
+  curldupe = curl_easy_duphandle(curl);
+  if(curldupe) {
+    curl_easy_cleanup(curl);
+    curl = curldupe;
   }
   else {
     curl_slist_free_all(dns_cache_list);
-    curl_easy_cleanup(easy);
+    curl_easy_cleanup(curl);
     curl_global_cleanup();
     return CURLE_OUT_OF_MEMORY;
   }
 
   multi_init(multi);
 
-  multi_add_handle(multi, easy);
+  multi_add_handle(multi, curl);
 
   multi_perform(multi, &still_running);
 
@@ -123,37 +114,37 @@ int test(char *URL)
 
 test_cleanup:
 
-#ifdef LIB1502
-  /* undocumented cleanup sequence - type UA */
-  curl_multi_cleanup(multi);
-  curl_easy_cleanup(easy);
-  curl_global_cleanup();
-#endif
-
-#ifdef LIB1503
-  /* proper cleanup sequence - type PA */
-  curl_multi_remove_handle(multi, easy);
-  curl_multi_cleanup(multi);
-  curl_easy_cleanup(easy);
-  curl_global_cleanup();
-#endif
-
-#ifdef LIB1504
-  /* undocumented cleanup sequence - type UB */
-  curl_easy_cleanup(easy);
-  curl_multi_cleanup(multi);
-  curl_global_cleanup();
-#endif
-
-#ifdef LIB1505
-  /* proper cleanup sequence - type PB */
-  curl_multi_remove_handle(multi, easy);
-  curl_easy_cleanup(easy);
-  curl_multi_cleanup(multi);
-  curl_global_cleanup();
-#endif
+  switch(testnum) {
+  case 1502:
+  default:
+    /* undocumented cleanup sequence - type UA */
+    curl_multi_cleanup(multi);
+    curl_easy_cleanup(curl);
+    curl_global_cleanup();
+    break;
+  case 1503:
+    /* proper cleanup sequence - type PA */
+    curl_multi_remove_handle(multi, curl);
+    curl_multi_cleanup(multi);
+    curl_easy_cleanup(curl);
+    curl_global_cleanup();
+    break;
+  case 1504:
+    /* undocumented cleanup sequence - type UB */
+    curl_easy_cleanup(curl);
+    curl_multi_cleanup(multi);
+    curl_global_cleanup();
+    break;
+  case 1505:
+    /* proper cleanup sequence - type PB */
+    curl_multi_remove_handle(multi, curl);
+    curl_easy_cleanup(curl);
+    curl_multi_cleanup(multi);
+    curl_global_cleanup();
+    break;
+  }
 
   curl_slist_free_all(dns_cache_list);
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1506.c b/third-party/curl/tests/libtest/lib1506.c
index a1a72b2a1f..2caa8f8ed8 100644
--- a/third-party/curl/tests/libtest/lib1506.c
+++ b/third-party/curl/tests/libtest/lib1506.c
@@ -21,39 +21,31 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
-
-#define NUM_HANDLES 4
-
-int test(char *URL)
+static CURLcode test_lib1506(const char *URL)
 {
-  int res = 0;
-  CURL *curl[NUM_HANDLES] = {0};
+  CURLcode result = CURLE_OK;
+  CURL *curl[NUM_HANDLES] = { 0 };
   int running;
-  CURLM *m = NULL;
-  int i;
+  CURLM *multi = NULL;
+  size_t i;
   char target_url[256];
   char dnsentry[256];
   struct curl_slist *slist = NULL, *slist2;
-  char *port = libtest_arg3;
-  char *address = libtest_arg2;
+  const char *port = libtest_arg3;
+  const char *address = libtest_arg2;
 
   (void)URL;
 
   /* Create fake DNS entries for serverX.example.com for all handles */
-  for(i = 0; i < NUM_HANDLES; i++) {
-    msnprintf(dnsentry, sizeof(dnsentry), "server%d.example.com:%s:%s",
-              i + 1, port, address);
-    printf("%s\n", dnsentry);
+  for(i = 0; i < CURL_ARRAYSIZE(curl); i++) {
+    curl_msnprintf(dnsentry, sizeof(dnsentry), "server%zu.example.com:%s:%s",
+                   i + 1, port, address);
+    curl_mprintf("%s\n", dnsentry);
     slist2 = curl_slist_append(slist, dnsentry);
     if(!slist2) {
-      fprintf(stderr, "curl_slist_append() failed\n");
+      curl_mfprintf(stderr, "curl_slist_append() failed\n");
       goto test_cleanup;
     }
     slist = slist2;
@@ -63,18 +55,18 @@ int test(char *URL)
 
   global_init(CURL_GLOBAL_ALL);
 
-  multi_init(m);
+  multi_init(multi);
 
-  multi_setopt(m, CURLMOPT_MAXCONNECTS, 3L);
+  multi_setopt(multi, CURLMOPT_MAXCONNECTS, 3L);
 
-  /* get NUM_HANDLES easy handles */
-  for(i = 0; i < NUM_HANDLES; i++) {
+  /* get each easy handle */
+  for(i = 0; i < CURL_ARRAYSIZE(curl); i++) {
     /* get an easy handle */
     easy_init(curl[i]);
     /* specify target */
-    msnprintf(target_url, sizeof(target_url),
-              "http://server%d.example.com:%s/path/1506%04i",
-              i + 1, port, i + 1);
+    curl_msnprintf(target_url, sizeof(target_url),
+                   "http://server%zu.example.com:%s/path/1506%04zu",
+                   i + 1, port, i + 1);
     target_url[sizeof(target_url) - 1] = '\0';
     easy_setopt(curl[i], CURLOPT_URL, target_url);
     /* go verbose */
@@ -85,11 +77,11 @@ int test(char *URL)
     easy_setopt(curl[i], CURLOPT_RESOLVE, slist);
   }
 
-  fprintf(stderr, "Start at URL 0\n");
+  curl_mfprintf(stderr, "Start at URL 0\n");
 
-  for(i = 0; i < NUM_HANDLES; i++) {
+  for(i = 0; i < CURL_ARRAYSIZE(curl); i++) {
     /* add handle to multi */
-    multi_add_handle(m, curl[i]);
+    multi_add_handle(multi, curl[i]);
 
     for(;;) {
       struct timeval interval;
@@ -99,7 +91,7 @@ int test(char *URL)
       interval.tv_sec = 1;
       interval.tv_usec = 0;
 
-      multi_perform(m, &running);
+      multi_perform(multi, &running);
 
       abort_on_test_timeout();
 
@@ -110,7 +102,7 @@ int test(char *URL)
       FD_ZERO(&wr);
       FD_ZERO(&exc);
 
-      multi_fdset(m, &rd, &wr, &exc, &maxfd);
+      multi_fdset(multi, &rd, &wr, &exc, &maxfd);
 
       /* At this point, maxfd is guaranteed to be greater or equal than -1. */
 
@@ -118,22 +110,22 @@ int test(char *URL)
 
       abort_on_test_timeout();
     }
-    wait_ms(1); /* to ensure different end times */
+    curlx_wait_ms(1); /* to ensure different end times */
   }
 
 test_cleanup:
 
   /* proper cleanup sequence - type PB */
 
-  for(i = 0; i < NUM_HANDLES; i++) {
-    curl_multi_remove_handle(m, curl[i]);
+  for(i = 0; i < CURL_ARRAYSIZE(curl); i++) {
+    curl_multi_remove_handle(multi, curl[i]);
     curl_easy_cleanup(curl[i]);
   }
 
   curl_slist_free_all(slist);
 
-  curl_multi_cleanup(m);
+  curl_multi_cleanup(multi);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1507.c b/third-party/curl/tests/libtest/lib1507.c
index d23e0b1845..d125a4975b 100644
--- a/third-party/curl/tests/libtest/lib1507.c
+++ b/third-party/curl/tests/libtest/lib1507.c
@@ -21,24 +21,9 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "timediff.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-/*
- * This is the list of basic details you need to tweak to get things right.
- */
-#define USERNAME "user@example.com"
-#define PASSWORD "123qwerty"
-#define RECIPIENT "<1507-recipient@example.com>"
-#define MAILFROM "<1507-realuser@example.com>"
-
-#define MULTI_PERFORM_HANG_TIMEOUT 60 * 1000
-
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t t1507_read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
   (void)ptr;
   (void)size;
@@ -47,42 +32,44 @@ static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
   return CURL_READFUNC_ABORT;
 }
 
-int test(char *URL)
+static CURLcode test_lib1507(const char *URL)
 {
-   int res = 0;
-   CURL *curl = NULL;
-   CURLM *mcurl = NULL;
-   int still_running = 1;
-   struct timeval mp_start;
-   struct curl_slist *rcpt_list = NULL;
+  static const int MULTI_PERFORM_HANG_TIMEOUT = 60 * 1000;
 
-   curl_global_init(CURL_GLOBAL_DEFAULT);
+  CURLcode result = CURLE_OK;
+  CURL *curl = NULL;
+  CURLM *multi = NULL;
+  int still_running = 1;
+  struct curltime mp_start;
+  struct curl_slist *rcpt_list = NULL;
 
-   easy_init(curl);
+  curl_global_init(CURL_GLOBAL_DEFAULT);
 
-   multi_init(mcurl);
+  easy_init(curl);
 
-   rcpt_list = curl_slist_append(rcpt_list, RECIPIENT);
-   /* more addresses can be added here
-      rcpt_list = curl_slist_append(rcpt_list, "<others@example.com>");
-   */
+  multi_init(multi);
 
-   curl_easy_setopt(curl, CURLOPT_URL, URL);
+  rcpt_list = curl_slist_append(rcpt_list, "<1507-recipient@example.com>");
 #if 0
-   curl_easy_setopt(curl, CURLOPT_USERNAME, USERNAME);
-   curl_easy_setopt(curl, CURLOPT_PASSWORD, PASSWORD);
+  /* more addresses can be added here */
+  rcpt_list = curl_slist_append(rcpt_list, "<others@example.com>");
 #endif
-   curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
-   curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_callback);
-   curl_easy_setopt(curl, CURLOPT_MAIL_FROM, MAILFROM);
-   curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, rcpt_list);
-   curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
-   multi_add_handle(mcurl, curl);
+  curl_easy_setopt(curl, CURLOPT_URL, URL);
+#if 0
+  curl_easy_setopt(curl, CURLOPT_USERNAME, "user@example.com");
+  curl_easy_setopt(curl, CURLOPT_PASSWORD, "123qwerty");
+#endif
+  curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+  curl_easy_setopt(curl, CURLOPT_READFUNCTION, t1507_read_cb);
+  curl_easy_setopt(curl, CURLOPT_MAIL_FROM, "<1507-realuser@example.com>");
+  curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, rcpt_list);
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  multi_add_handle(multi, curl);
 
-   mp_start = tutil_tvnow();
+  mp_start = curlx_now();
 
   /* we start some action by calling perform right away */
-  curl_multi_perform(mcurl, &still_running);
+  curl_multi_perform(multi, &still_running);
 
   while(still_running) {
     struct timeval timeout;
@@ -103,7 +90,7 @@ int test(char *URL)
     timeout.tv_sec = 1;
     timeout.tv_usec = 0;
 
-    curl_multi_timeout(mcurl, &curl_timeo);
+    curl_multi_timeout(multi, &curl_timeo);
     if(curl_timeo >= 0) {
       curlx_mstotv(&timeout, curl_timeo);
       if(timeout.tv_sec > 1) {
@@ -113,19 +100,19 @@ int test(char *URL)
     }
 
     /* get file descriptors from the transfers */
-    curl_multi_fdset(mcurl, &fdread, &fdwrite, &fdexcep, &maxfd);
+    curl_multi_fdset(multi, &fdread, &fdwrite, &fdexcep, &maxfd);
 
     /* In a real-world program you OF COURSE check the return code of the
        function calls.  On success, the value of maxfd is guaranteed to be
        greater or equal than -1.  We call select(maxfd + 1, ...), specially in
-       case of (maxfd == -1), we call select(0, ...), which is basically equal
-       to sleep. */
+       case of (maxfd == -1), we call select(0, ...), which is equal to sleep.
+     */
 
     rc = select(maxfd + 1, &fdread, &fdwrite, &fdexcep, &timeout);
 
-    if(tutil_tvdiff(tutil_tvnow(), mp_start) > MULTI_PERFORM_HANG_TIMEOUT) {
-      fprintf(stderr, "ABORTING TEST, since it seems "
-              "that it would have run forever.\n");
+    if(curlx_timediff_ms(curlx_now(), mp_start) > MULTI_PERFORM_HANG_TIMEOUT) {
+      curl_mfprintf(stderr, "ABORTING TEST, since it seems "
+                    "that it would have run forever.\n");
       break;
     }
 
@@ -135,7 +122,7 @@ int test(char *URL)
       break;
     case 0: /* timeout */
     default: /* action */
-      curl_multi_perform(mcurl, &still_running);
+      curl_multi_perform(multi, &still_running);
       break;
     }
   }
@@ -143,10 +130,10 @@ int test(char *URL)
 test_cleanup:
 
   curl_slist_free_all(rcpt_list);
-  curl_multi_remove_handle(mcurl, curl);
-  curl_multi_cleanup(mcurl);
+  curl_multi_remove_handle(multi, curl);
+  curl_multi_cleanup(multi);
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1508.c b/third-party/curl/tests/libtest/lib1508.c
index 9810391371..f3ae79cb62 100644
--- a/third-party/curl/tests/libtest/lib1508.c
+++ b/third-party/curl/tests/libtest/lib1508.c
@@ -21,31 +21,27 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1508(const char *URL)
 {
-  int res = 0;
-  CURLM *m = NULL;
+  CURLcode result = CURLE_OK;
+  CURLM *multi = NULL;
 
   (void)URL;
 
   global_init(CURL_GLOBAL_ALL);
 
-  multi_init(m);
+  multi_init(multi);
 
 test_cleanup:
 
   /* proper cleanup sequence - type PB */
 
-  curl_multi_cleanup(m);
+  curl_multi_cleanup(multi);
   curl_global_cleanup();
 
-  printf("We are done\n");
+  curl_mprintf("We are done\n");
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1509.c b/third-party/curl/tests/libtest/lib1509.c
index 2277e6cee0..95258d678f 100644
--- a/third-party/curl/tests/libtest/lib1509.c
+++ b/third-party/curl/tests/libtest/lib1509.c
@@ -21,23 +21,32 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
+static size_t realHeaderSize = 0;
 
-size_t WriteOutput(void *ptr, size_t size, size_t nmemb, void *stream);
-size_t WriteHeader(void *ptr, size_t size, size_t nmemb, void *stream);
-
-static unsigned long realHeaderSize = 0;
-
-int test(char *URL)
+static size_t WriteOutput(char *ptr, size_t size, size_t nmemb, void *stream)
+{
+  fwrite(ptr, size, nmemb, stream);
+  return nmemb * size;
+}
+
+static size_t WriteHeader(char *ptr, size_t size, size_t nmemb, void *stream)
+{
+  (void)ptr;
+  (void)stream;
+
+  realHeaderSize += size * nmemb;
+
+  return nmemb * size;
+}
+
+static CURLcode test_lib1509(const char *URL)
 {
-  long headerSize;
-  CURLcode code;
   CURL *curl = NULL;
-  int res = 0;
+  CURLcode code;
+  CURLcode result = CURLE_OK;
+  long headerSize;
 
   global_init(CURL_GLOBAL_ALL);
 
@@ -45,8 +54,8 @@ int test(char *URL)
 
   easy_setopt(curl, CURLOPT_PROXY, libtest_arg2); /* set in first.c */
 
-  easy_setopt(curl, CURLOPT_WRITEFUNCTION, *WriteOutput);
-  easy_setopt(curl, CURLOPT_HEADERFUNCTION, *WriteHeader);
+  easy_setopt(curl, CURLOPT_WRITEFUNCTION, WriteOutput);
+  easy_setopt(curl, CURLOPT_HEADERFUNCTION, WriteHeader);
 
   easy_setopt(curl, CURLOPT_HEADER, 1L);
   easy_setopt(curl, CURLOPT_VERBOSE, 1L);
@@ -54,46 +63,30 @@ int test(char *URL)
   easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
 
   code = curl_easy_perform(curl);
-  if(CURLE_OK != code) {
-    fprintf(stderr, "%s:%d curl_easy_perform() failed, "
-            "with code %d (%s)\n",
-            __FILE__, __LINE__, (int)code, curl_easy_strerror(code));
-    res = TEST_ERR_MAJOR_BAD;
+  if(code != CURLE_OK) {
+    curl_mfprintf(stderr, "%s:%d curl_easy_perform() failed, "
+                  "with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)code, curl_easy_strerror(code));
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
 
   code = curl_easy_getinfo(curl, CURLINFO_HEADER_SIZE, &headerSize);
-  if(CURLE_OK != code) {
-    fprintf(stderr, "%s:%d curl_easy_getinfo() failed, "
-            "with code %d (%s)\n",
-            __FILE__, __LINE__, (int)code, curl_easy_strerror(code));
-    res = TEST_ERR_MAJOR_BAD;
+  if(code != CURLE_OK) {
+    curl_mfprintf(stderr, "%s:%d curl_easy_getinfo() failed, "
+                  "with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)code, curl_easy_strerror(code));
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
 
-  printf("header length is ........: %ld\n", headerSize);
-  printf("header length should be..: %lu\n", realHeaderSize);
+  curl_mprintf("header length is ........: %ld\n", headerSize);
+  curl_mprintf("header length should be..: %zu\n", realHeaderSize);
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
-}
-
-size_t WriteOutput(void *ptr, size_t size, size_t nmemb, void *stream)
-{
-  fwrite(ptr, size, nmemb, stream);
-  return nmemb * size;
-}
-
-size_t WriteHeader(void *ptr, size_t size, size_t nmemb, void *stream)
-{
-  (void)ptr;
-  (void)stream;
-
-  realHeaderSize += curlx_uztoul(size * nmemb);
-
-  return nmemb * size;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1510.c b/third-party/curl/tests/libtest/lib1510.c
index 7b0e12ce94..0d7a155feb 100644
--- a/third-party/curl/tests/libtest/lib1510.c
+++ b/third-party/curl/tests/libtest/lib1510.c
@@ -21,37 +21,31 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
-
-#define NUM_URLS 4
-
-int test(char *URL)
+static CURLcode test_lib1510(const char *URL)
 {
-  int res = 0;
+  static const int NUM_URLS = 4;
+
+  CURLcode result = CURLE_OK;
   CURL *curl = NULL;
   int i;
   char target_url[256];
   char dnsentry[256];
   struct curl_slist *slist = NULL, *slist2;
-  char *port = libtest_arg3;
-  char *address = libtest_arg2;
+  const char *port = libtest_arg3;
+  const char *address = libtest_arg2;
 
   (void)URL;
 
   /* Create fake DNS entries for serverX.example.com for all handles */
   for(i = 0; i < NUM_URLS; i++) {
-    msnprintf(dnsentry, sizeof(dnsentry), "server%d.example.com:%s:%s", i + 1,
-              port, address);
-    printf("%s\n", dnsentry);
+    curl_msnprintf(dnsentry, sizeof(dnsentry),
+                   "server%d.example.com:%s:%s", i + 1, port, address);
+    curl_mprintf("%s\n", dnsentry);
     slist2 = curl_slist_append(slist, dnsentry);
     if(!slist2) {
-      fprintf(stderr, "curl_slist_append() failed\n");
+      curl_mfprintf(stderr, "curl_slist_append() failed\n");
       goto test_cleanup;
     }
     slist = slist2;
@@ -73,16 +67,18 @@ int test(char *URL)
 
   easy_setopt(curl, CURLOPT_MAXCONNECTS, 3L);
 
-  /* get NUM_HANDLES easy handles */
+  /* get NUM_URLS easy handles */
   for(i = 0; i < NUM_URLS; i++) {
     /* specify target */
-    msnprintf(target_url, sizeof(target_url),
-              "http://server%d.example.com:%s/path/1510%04i",
-              i + 1, port, i + 1);
+    curl_msnprintf(target_url, sizeof(target_url),
+                   "http://server%d.example.com:%s/path/1510%04i",
+                   i + 1, port, i + 1);
     target_url[sizeof(target_url) - 1] = '\0';
     easy_setopt(curl, CURLOPT_URL, target_url);
 
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
+    if(result)
+      goto test_cleanup;
 
     abort_on_test_timeout();
   }
@@ -97,5 +93,5 @@ test_cleanup:
 
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1511.c b/third-party/curl/tests/libtest/lib1511.c
index d093a5bd2e..d6897cc748 100644
--- a/third-party/curl/tests/libtest/lib1511.c
+++ b/third-party/curl/tests/libtest/lib1511.c
@@ -21,15 +21,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1511(const char *URL)
 {
   long unmet;
   CURL *curl = NULL;
-  int res = 0;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
 
@@ -37,35 +35,35 @@ int test(char *URL)
 
   easy_setopt(curl, CURLOPT_URL, URL);
   easy_setopt(curl, CURLOPT_HEADER, 1L);
-  easy_setopt(curl, CURLOPT_TIMECONDITION, (long)CURL_TIMECOND_IFMODSINCE);
+  easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE);
 
   /* TIMEVALUE in the future */
   easy_setopt(curl, CURLOPT_TIMEVALUE, 1566210680L);
 
-  res = curl_easy_perform(curl);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
   curl_easy_getinfo(curl, CURLINFO_CONDITION_UNMET, &unmet);
   if(unmet != 1L) {
-    res = TEST_ERR_FAILURE; /* not correct */
+    result = TEST_ERR_FAILURE; /* not correct */
     goto test_cleanup;
   }
 
   /* TIMEVALUE in the past */
   easy_setopt(curl, CURLOPT_TIMEVALUE, 1L);
 
-  res = curl_easy_perform(curl);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
   curl_easy_getinfo(curl, CURLINFO_CONDITION_UNMET, &unmet);
   if(unmet) {
-    res = TEST_ERR_FAILURE; /* not correct */
+    result = TEST_ERR_FAILURE; /* not correct */
     goto test_cleanup;
   }
 
-  res = TEST_ERR_SUCCESS; /* this is where we should be */
+  result = TEST_ERR_SUCCESS; /* this is where we should be */
 
 test_cleanup:
 
@@ -73,5 +71,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1512.c b/third-party/curl/tests/libtest/lib1512.c
index 2ca0fe6205..10cf67e1d2 100644
--- a/third-party/curl/tests/libtest/lib1512.c
+++ b/third-party/curl/tests/libtest/lib1512.c
@@ -28,42 +28,38 @@
  * easy transfer finds and uses the populated stuff.
  */
 
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-#define NUM_HANDLES 2
-
-int test(char *URL)
+static CURLcode test_lib1512(const char *URL)
 {
-  int res = 0;
-  CURL *curl[NUM_HANDLES] = {NULL, NULL};
-  char *port = libtest_arg3;
-  char *address = libtest_arg2;
+  CURLcode result = CURLE_OK;
+  CURL *curl[2] = { NULL, NULL };
+  const char *port = libtest_arg3;
+  const char *address = libtest_arg2;
   char dnsentry[256];
   struct curl_slist *slist = NULL;
-  int i;
+  size_t i;
   char target_url[256];
-  (void)URL; /* URL is setup in the code */
+  (void)URL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
-  msnprintf(dnsentry, sizeof(dnsentry), "server.example.curl:%s:%s",
-            port, address);
-  printf("%s\n", dnsentry);
+  curl_msnprintf(dnsentry, sizeof(dnsentry), "server.example.curl:%s:%s",
+                 port, address);
+  curl_mprintf("%s\n", dnsentry);
   slist = curl_slist_append(slist, dnsentry);
 
-  /* get NUM_HANDLES easy handles */
-  for(i = 0; i < NUM_HANDLES; i++) {
+  /* get each easy handle */
+  for(i = 0; i < CURL_ARRAYSIZE(curl); i++) {
     /* get an easy handle */
     easy_init(curl[i]);
     /* specify target */
-    msnprintf(target_url, sizeof(target_url),
-              "http://server.example.curl:%s/path/1512%04i",
-              port, i + 1);
+    curl_msnprintf(target_url, sizeof(target_url),
+                   "http://server.example.curl:%s/path/1512%04zu",
+                   port, i + 1);
     target_url[sizeof(target_url) - 1] = '\0';
     easy_setopt(curl[i], CURLOPT_URL, target_url);
     /* go verbose */
@@ -71,17 +67,18 @@ int test(char *URL)
     /* include headers */
     easy_setopt(curl[i], CURLOPT_HEADER, 1L);
 
-    CURL_IGNORE_DEPRECATION(
-      easy_setopt(curl[i], CURLOPT_DNS_USE_GLOBAL_CACHE, 1L);
-    )
+    easy_setopt(curl[i], CURLOPT_DNS_USE_GLOBAL_CACHE, 1L);
   }
 
   /* make the first one populate the GLOBAL cache */
   easy_setopt(curl[0], CURLOPT_RESOLVE, slist);
 
-  /* run NUM_HANDLES transfers */
-  for(i = 0; (i < NUM_HANDLES) && !res; i++)
-    res = curl_easy_perform(curl[i]);
+  /* run each transfer */
+  for(i = 0; (i < CURL_ARRAYSIZE(curl)) && !result; i++) {
+    result = curl_easy_perform(curl[i]);
+    if(result)
+      goto test_cleanup;
+  }
 
 test_cleanup:
 
@@ -90,5 +87,5 @@ test_cleanup:
   curl_slist_free_all(slist);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1513.c b/third-party/curl/tests/libtest/lib1513.c
index 19c23c06ee..d5148510d9 100644
--- a/third-party/curl/tests/libtest/lib1513.c
+++ b/third-party/curl/tests/libtest/lib1513.c
@@ -28,9 +28,7 @@
  * of 42 (CURLE_ABORTED_BY_CALLBACK).
  */
 
-#include "test.h"
-
-#include "memdebug.h"
+#include "first.h"
 
 static int progressKiller(void *arg,
                           double dltotal,
@@ -43,29 +41,27 @@ static int progressKiller(void *arg,
   (void)dlnow;
   (void)ultotal;
   (void)ulnow;
-  printf("PROGRESSFUNCTION called\n");
+  curl_mprintf("PROGRESSFUNCTION called\n");
   return 1;
 }
 
-int test(char *URL)
+static CURLcode test_lib1513(const char *URL)
 {
   CURL *curl;
-  int res = 0;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
 
   easy_init(curl);
 
   easy_setopt(curl, CURLOPT_URL, URL);
-  easy_setopt(curl, CURLOPT_TIMEOUT, (long)7);
-  easy_setopt(curl, CURLOPT_NOSIGNAL, (long)1);
-  CURL_IGNORE_DEPRECATION(
-    easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, progressKiller);
-    easy_setopt(curl, CURLOPT_PROGRESSDATA, NULL);
-  )
-  easy_setopt(curl, CURLOPT_NOPROGRESS, (long)0);
+  easy_setopt(curl, CURLOPT_TIMEOUT, 7L);
+  easy_setopt(curl, CURLOPT_NOSIGNAL, 1L);
+  easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, progressKiller);
+  easy_setopt(curl, CURLOPT_PROGRESSDATA, NULL);
+  easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -74,5 +70,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1514.c b/third-party/curl/tests/libtest/lib1514.c
index 6582b5977a..a799e7668d 100644
--- a/third-party/curl/tests/libtest/lib1514.c
+++ b/third-party/curl/tests/libtest/lib1514.c
@@ -26,40 +26,38 @@
  * size is unknown.
  */
 
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static char data[]="dummy";
-
-struct WriteThis {
+struct t1514_WriteThis {
   char *readptr;
   size_t sizeleft;
 };
 
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t t1514_read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
-  struct WriteThis *pooh = (struct WriteThis *)userp;
+  struct t1514_WriteThis *pooh = (struct t1514_WriteThis *)userp;
 
-  if(size*nmemb < 1)
+  if(size * nmemb < 1)
     return 0;
 
   if(pooh->sizeleft) {
-    *ptr = pooh->readptr[0]; /* copy one single byte */
-    pooh->readptr++;                 /* advance pointer */
-    pooh->sizeleft--;                /* less data left */
-    return 1;                        /* we return 1 byte at a time! */
+    *ptr = pooh->readptr[0];  /* copy one single byte */
+    pooh->readptr++;          /* advance pointer */
+    pooh->sizeleft--;         /* less data left */
+    return 1;                 /* we return 1 byte at a time! */
   }
 
-  return 0;                         /* no more data left to deliver */
+  return 0;                   /* no more data left to deliver */
 }
 
-int test(char *URL)
+static CURLcode test_lib1514(const char *URL)
 {
   CURL *curl;
   CURLcode result = CURLE_OK;
-  int res = 0;
-  struct WriteThis pooh = { data, sizeof(data)-1 };
+
+  static char testdata[] = "dummy";
+
+  struct t1514_WriteThis pooh = { testdata, sizeof(testdata) - 1 };
 
   global_init(CURL_GLOBAL_ALL);
 
@@ -68,12 +66,13 @@ int test(char *URL)
   easy_setopt(curl, CURLOPT_URL, URL);
   easy_setopt(curl, CURLOPT_POST, 1L);
   /* Purposely omit to set CURLOPT_POSTFIELDSIZE */
-  easy_setopt(curl, CURLOPT_READFUNCTION, read_callback);
+  easy_setopt(curl, CURLOPT_READFUNCTION, t1514_read_cb);
   easy_setopt(curl, CURLOPT_READDATA, &pooh);
-#ifdef LIB1539
-  /* speak HTTP 1.0 - no chunked! */
-  easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_0);
-#endif
+
+  if(testnum == 1539) {
+    /* speak HTTP 1.0 - no chunked! */
+    easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_0);
+  }
 
   result = curl_easy_perform(curl);
 
@@ -82,5 +81,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)result;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1515.c b/third-party/curl/tests/libtest/lib1515.c
index d210ed3bed..f9bacf5c60 100644
--- a/third-party/curl/tests/libtest/lib1515.c
+++ b/third-party/curl/tests/libtest/lib1515.c
@@ -28,48 +28,38 @@
  * (test1515) nor a dead connection is detected (test1616).
  */
 
-#include "test.h"
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
+#include "first.h"
 
-#define TEST_HANG_TIMEOUT 60 * 1000
+#include "testtrace.h"
 
-#define DNS_TIMEOUT 1
+#define DNS_TIMEOUT 1L
 
-static int debug_callback(CURL *curl, curl_infotype info, char *msg,
-                          size_t len, void *ptr)
+static CURLcode do_one_request(CURLM *multi, const char *URL,
+                               const char *resolve)
 {
-  (void)curl;
-  (void)ptr;
-
-  if(info == CURLINFO_TEXT)
-    fprintf(stderr, "debug: %.*s", (int) len, msg);
-
-  return 0;
-}
-
-static int do_one_request(CURLM *m, char *URL, char *resolve)
-{
-  CURL *curls;
+  CURL *curl;
   struct curl_slist *resolve_list = NULL;
   int still_running;
-  int res = 0;
+  CURLcode result = CURLE_OK;
   CURLMsg *msg;
   int msgs_left;
 
   resolve_list = curl_slist_append(resolve_list, resolve);
 
-  easy_init(curls);
+  easy_init(curl);
 
-  easy_setopt(curls, CURLOPT_URL, URL);
-  easy_setopt(curls, CURLOPT_RESOLVE, resolve_list);
-  easy_setopt(curls, CURLOPT_DEBUGFUNCTION, debug_callback);
-  easy_setopt(curls, CURLOPT_VERBOSE, 1);
-  easy_setopt(curls, CURLOPT_DNS_CACHE_TIMEOUT, DNS_TIMEOUT);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_RESOLVE, resolve_list);
+  easy_setopt(curl, CURLOPT_DNS_CACHE_TIMEOUT, DNS_TIMEOUT);
 
-  multi_add_handle(m, curls);
-  multi_perform(m, &still_running);
+  debug_config.nohex = TRUE;
+  debug_config.tracetime = TRUE;
+  easy_setopt(curl, CURLOPT_DEBUGDATA, &debug_config);
+  easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+  multi_add_handle(multi, curl);
+  multi_perform(multi, &still_running);
 
   abort_on_test_timeout();
 
@@ -84,63 +74,67 @@ static int do_one_request(CURLM *m, char *URL, char *resolve)
     timeout.tv_sec = 1;
     timeout.tv_usec = 0;
 
-    multi_fdset(m, &fdread, &fdwrite, &fdexcep, &maxfd);
+    multi_fdset(multi, &fdread, &fdwrite, &fdexcep, &maxfd);
     select_test(maxfd + 1, &fdread, &fdwrite, &fdexcep, &timeout);
 
     abort_on_test_timeout();
-    multi_perform(m, &still_running);
+    multi_perform(multi, &still_running);
 
     abort_on_test_timeout();
   }
 
   do {
-    msg = curl_multi_info_read(m, &msgs_left);
-    if(msg && msg->msg == CURLMSG_DONE && msg->easy_handle == curls) {
-      res = msg->data.result;
+    msg = curl_multi_info_read(multi, &msgs_left);
+    if(msg && msg->msg == CURLMSG_DONE && msg->easy_handle == curl) {
+      result = msg->data.result;
       break;
     }
   } while(msg);
 
 test_cleanup:
 
-  curl_multi_remove_handle(m, curls);
-  curl_easy_cleanup(curls);
+  curl_multi_remove_handle(multi, curl);
+  curl_easy_cleanup(curl);
   curl_slist_free_all(resolve_list);
 
-  return res;
+  return result;
 }
 
-int test(char *URL)
+static CURLcode test_lib1515(const char *URL)
 {
   CURLM *multi = NULL;
-  int res = 0;
-  char *address = libtest_arg2;
-  char *port = libtest_arg3;
-  char *path = URL;
+  CURLcode result = CURLE_OK;
+  const char *path = URL;
+  const char *address = libtest_arg2;
+  const char *port = libtest_arg3;
   char dns_entry[256];
   int i;
   int count = 2;
 
-  msnprintf(dns_entry, sizeof(dns_entry), "testserver.example.com:%s:%s",
-            port, address);
+  curl_msnprintf(dns_entry, sizeof(dns_entry), "testserver.example.com:%s:%s",
+                 port, address);
 
   start_test_timing();
 
   global_init(CURL_GLOBAL_ALL);
+  curl_global_trace("all");
   multi_init(multi);
 
   for(i = 1; i <= count; i++) {
     char target_url[256];
-    msnprintf(target_url, sizeof(target_url),
-              "http://testserver.example.com:%s/%s%04d", port, path, i);
+    curl_msnprintf(target_url, sizeof(target_url),
+                   "http://testserver.example.com:%s/%s%04d", port, path, i);
 
     /* second request must succeed like the first one */
-    res = do_one_request(multi, target_url, dns_entry);
-    if(res)
+    result = do_one_request(multi, target_url, dns_entry);
+    if(result != CURLE_OK) {
+      curl_mfprintf(stderr, "request %s failed with %d\n", target_url,
+                    (int)result);
       goto test_cleanup;
+    }
 
     if(i < count)
-      sleep(DNS_TIMEOUT + 1);
+      curlx_wait_ms((DNS_TIMEOUT + 1) * 1000);
   }
 
 test_cleanup:
@@ -148,5 +142,5 @@ test_cleanup:
   curl_multi_cleanup(multi);
   curl_global_cleanup();
 
-  return (int) res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1517.c b/third-party/curl/tests/libtest/lib1517.c
index 706b5567c9..30e80a7bce 100644
--- a/third-party/curl/tests/libtest/lib1517.c
+++ b/third-party/curl/tests/libtest/lib1517.c
@@ -21,25 +21,21 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static char data[]="this is what we post to the silly web server\n";
-
-struct WriteThis {
-  char *readptr;
+struct t1517_WriteThis {
+  const char *readptr;
   size_t sizeleft;
 };
 
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t t1517_read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
-  struct WriteThis *pooh = (struct WriteThis *)userp;
+  struct t1517_WriteThis *pooh = (struct t1517_WriteThis *)userp;
   size_t tocopy = size * nmemb;
 
-  /* Wait one second before return POST data          *
-   * so libcurl will wait before sending request body */
-  wait_ms(1000);
+  /* Wait one second before return POST data
+     so libcurl waits before sending request body */
+  curlx_wait_ms(1000);
 
   if(tocopy < 1 || !pooh->sizeleft)
     return 0;
@@ -47,71 +43,65 @@ static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
   if(pooh->sizeleft < tocopy)
     tocopy = pooh->sizeleft;
 
-  memcpy(ptr, pooh->readptr, tocopy);/* copy requested data */
-  pooh->readptr += tocopy;           /* advance pointer */
-  pooh->sizeleft -= tocopy;          /* less data left */
+  memcpy(ptr, pooh->readptr, tocopy); /* copy requested data */
+  pooh->readptr += tocopy;            /* advance pointer */
+  pooh->sizeleft -= tocopy;           /* less data left */
   return tocopy;
 }
 
-int test(char *URL)
+static CURLcode test_lib1517(const char *URL)
 {
+  static const char testdata[] =
+    "this is what we post to the silly web server\n";
+
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
-  struct WriteThis pooh;
+  struct t1517_WriteThis pooh;
 
-  if(!strcmp(URL, "check")) {
-#if (defined(WIN32) || defined(__CYGWIN__))
-    printf("Windows TCP does not deliver response data but reports "
-           "CONNABORTED\n");
-    return 1; /* skip since test will fail on Windows without workaround */
-#else
-    return 0; /* sure, run this! */
-#endif
-  }
-
-  pooh.readptr = data;
-  pooh.sizeleft = strlen(data);
+  pooh.readptr = testdata;
+  pooh.sizeleft = sizeof(testdata) - 1;
 
   if(curl_global_init(CURL_GLOBAL_ALL)) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* Now specify we want to POST data */
-  test_setopt(curl, CURLOPT_POST, 1L);
+  easy_setopt(curl, CURLOPT_POST, 1L);
 
   /* Set the expected POST size */
-  test_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)pooh.sizeleft);
+  easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)pooh.sizeleft);
 
   /* we want to use our own read function */
-  test_setopt(curl, CURLOPT_READFUNCTION, read_callback);
+  easy_setopt(curl, CURLOPT_READFUNCTION, t1517_read_cb);
 
   /* pointer to pass to our read function */
-  test_setopt(curl, CURLOPT_READDATA, &pooh);
+  easy_setopt(curl, CURLOPT_READDATA, &pooh);
 
   /* get verbose debug output please */
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* include headers in the output */
-  test_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
+#if 0
   /* detect HTTP error codes >= 400 */
-  /* test_setopt(curl, CURLOPT_FAILONERROR, 1L); */
+  easy_setopt(curl, CURLOPT_FAILONERROR, 1L);
+#endif
 
-
-  /* Perform the request, res will get the return code */
-  res = curl_easy_perform(curl);
+  /* Perform the request, result gets the return code */
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -119,5 +109,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1518.c b/third-party/curl/tests/libtest/lib1518.c
index 9805a2206b..09b8514819 100644
--- a/third-party/curl/tests/libtest/lib1518.c
+++ b/third-party/curl/tests/libtest/lib1518.c
@@ -21,42 +21,27 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "memdebug.h"
+#include "first.h"
 
 /* Test inspired by github issue 3340 */
 
-static size_t writecb(char *buffer, size_t size, size_t nitems,
-                      void *outstream)
-{
-  (void)buffer;
-  (void)size;
-  (void)nitems;
-  (void)outstream;
-  return 0;
-}
-
-int test(char *URL)
+static CURLcode test_lib1518(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
   long curlResponseCode;
   long curlRedirectCount;
-  char *effectiveUrl = NULL;
-  char *redirectUrl = NULL;
-#ifdef LIB1543
+  const char *effectiveUrl = NULL;
+  const char *redirectUrl = NULL;
   CURLU *urlu = NULL;
-#endif
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
-#ifdef LIB1543
-  /* set CURLOPT_URLU */
-  {
+  if(testnum == 1543) {
+    /* set CURLOPT_URLU */
     CURLUcode rc = CURLUE_OK;
     urlu = curl_url();
     if(urlu)
@@ -64,43 +49,42 @@ int test(char *URL)
     if(!urlu || rc) {
       goto test_cleanup;
     }
-    test_setopt(curl, CURLOPT_CURLU, urlu);
+    easy_setopt(curl, CURLOPT_CURLU, urlu);
+    easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+  }
+  else {
+    easy_setopt(curl, CURLOPT_URL, URL);
+    /* to make it explicit and visible in this test: */
+    easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 0L);
   }
-  test_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
-#else
-  test_setopt(curl, CURLOPT_URL, URL);
-  /* just to make it explicit and visible in this test: */
-  test_setopt(curl, CURLOPT_FOLLOWLOCATION, 0L);
-#endif
 
-
-  /* Perform the request, res will get the return code */
-  res = curl_easy_perform(curl);
+  /* Perform the request, result gets the return code */
+  result = curl_easy_perform(curl);
+  if(result)
+    goto test_cleanup;
 
   curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &curlResponseCode);
   curl_easy_getinfo(curl, CURLINFO_REDIRECT_COUNT, &curlRedirectCount);
   curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_URL, &effectiveUrl);
   curl_easy_getinfo(curl, CURLINFO_REDIRECT_URL, &redirectUrl);
-  res = curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writecb);
+  easy_setopt(curl, CURLOPT_WRITEFUNCTION, tutil_throwaway_cb);
 
-  printf("res %d\n"
-         "status %d\n"
-         "redirects %d\n"
-         "effectiveurl %s\n"
-         "redirecturl %s\n",
-         (int)res,
-         (int)curlResponseCode,
-         (int)curlRedirectCount,
-         effectiveUrl,
-         redirectUrl ? redirectUrl : "blank");
+  curl_mprintf("result %d\n"
+               "status %ld\n"
+               "redirects %ld\n"
+               "effectiveurl %s\n"
+               "redirecturl %s\n",
+               (int)result,
+               curlResponseCode,
+               curlRedirectCount,
+               effectiveUrl,
+               redirectUrl ? redirectUrl : "blank");
 
 test_cleanup:
 
   /* always cleanup */
   curl_easy_cleanup(curl);
   curl_global_cleanup();
-#ifdef LIB1543
   curl_url_cleanup(urlu);
-#endif
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1520.c b/third-party/curl/tests/libtest/lib1520.c
index 5b6c3dcfb1..9ed257591e 100644
--- a/third-party/curl/tests/libtest/lib1520.c
+++ b/third-party/curl/tests/libtest/lib1520.c
@@ -21,40 +21,32 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "memdebug.h"
-
-/*
- * This is the list of basic details you need to tweak to get things right.
- */
-#define TO "<recipient@example.com>"
-#define FROM "<sender@example.com>"
-
-static const char *payload_text[] = {
-  "From: different\r\n",
-  "To: another\r\n",
-  "\r\n",
-  "\r\n",
-  ".\r\n",
-  ".\r\n",
-  "\r\n",
-  ".\r\n",
-  "\r\n",
-  "body",
-  NULL
-};
+#include "first.h"
 
 struct upload_status {
   int lines_read;
 };
 
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t t1520_read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
+  static const char *payload_text[] = {
+    "From: different\r\n",
+    "To: another\r\n",
+    "\r\n",
+    "\r\n",
+    ".\r\n",
+    ".\r\n",
+    "\r\n",
+    ".\r\n",
+    "\r\n",
+    "body",
+    NULL
+  };
+
   struct upload_status *upload_ctx = (struct upload_status *)userp;
   const char *data;
 
-  if((size == 0) || (nmemb == 0) || ((size*nmemb) < 1)) {
+  if((size == 0) || (nmemb == 0) || ((size * nmemb) < 1)) {
     return 0;
   }
 
@@ -62,7 +54,7 @@ static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
 
   if(data) {
     size_t len = strlen(data);
-    memcpy(ptr, data, len);
+    memcpy(ptr, data, len); /* NOLINT(bugprone-not-null-terminated-result) */
     upload_ctx->lines_read++;
 
     return len;
@@ -71,39 +63,39 @@ static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
   return 0;
 }
 
-int test(char *URL)
+static CURLcode test_lib1520(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
   struct curl_slist *rcpt_list = NULL;
-  struct upload_status upload_ctx = {0};
+  struct upload_status upload_ctx = { 0 };
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  rcpt_list = curl_slist_append(rcpt_list, TO);
-  /* more addresses can be added here
-     rcpt_list = curl_slist_append(rcpt_list, "<others@example.com>");
-  */
+  rcpt_list = curl_slist_append(rcpt_list, "<recipient@example.com>");
+#if 0
+  /* more addresses can be added here */
+  rcpt_list = curl_slist_append(rcpt_list, "<others@example.com>");
+#endif
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+  easy_setopt(curl, CURLOPT_READFUNCTION, t1520_read_cb);
+  easy_setopt(curl, CURLOPT_READDATA, &upload_ctx);
+  easy_setopt(curl, CURLOPT_MAIL_FROM, "<sender@example.com>");
+  easy_setopt(curl, CURLOPT_MAIL_RCPT, rcpt_list);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_UPLOAD, 1L);
-  test_setopt(curl, CURLOPT_READFUNCTION, read_callback);
-  test_setopt(curl, CURLOPT_READDATA, &upload_ctx);
-  test_setopt(curl, CURLOPT_MAIL_FROM, FROM);
-  test_setopt(curl, CURLOPT_MAIL_RCPT, rcpt_list);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -111,5 +103,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1522.c b/third-party/curl/tests/libtest/lib1522.c
index 1fbd7b92ce..9f6dc33515 100644
--- a/third-party/curl/tests/libtest/lib1522.c
+++ b/third-party/curl/tests/libtest/lib1522.c
@@ -21,24 +21,19 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
 /* test case and code based on https://github.com/curl/curl/issues/2847 */
 
 #include "testtrace.h"
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-static char g_Data[40 * 1024]; /* POST 40KB */
 
 static int sockopt_callback(void *clientp, curl_socket_t curlfd,
                             curlsocktype purpose)
 {
 #if defined(SOL_SOCKET) && defined(SO_SNDBUF)
   int sndbufsize = 4 * 1024; /* 4KB send buffer */
-  (void) clientp;
-  (void) purpose;
+  (void)clientp;
+  (void)purpose;
   setsockopt(curlfd, SOL_SOCKET, SO_SNDBUF,
              (char *)&sndbufsize, sizeof(sndbufsize));
 #else
@@ -49,10 +44,12 @@ static int sockopt_callback(void *clientp, curl_socket_t curlfd,
   return CURL_SOCKOPT_OK;
 }
 
-int test(char *URL)
+static CURLcode test_lib1522(const char *URL)
 {
-  CURLcode code;
-  CURLcode res;
+  static char g_Data[40 * 1024]; /* POST 40KB */
+
+  CURLcode code = TEST_ERR_MAJOR_BAD;
+  CURLcode result;
   struct curl_slist *pHeaderList = NULL;
   CURL *curl = curl_easy_init();
   memset(g_Data, 'A', sizeof(g_Data)); /* send As! */
@@ -62,11 +59,11 @@ int test(char *URL)
   curl_easy_setopt(curl, CURLOPT_POSTFIELDS, g_Data);
   curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)sizeof(g_Data));
 
-  libtest_debug_config.nohex = 1;
-  libtest_debug_config.tracetime = 1;
-  test_setopt(curl, CURLOPT_DEBUGDATA, &libtest_debug_config);
-  test_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  debug_config.nohex = TRUE;
+  debug_config.tracetime = TRUE;
+  easy_setopt(curl, CURLOPT_DEBUGDATA, &debug_config);
+  easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* Remove "Expect: 100-continue" */
   pHeaderList = curl_slist_append(pHeaderList, "Expect:");
@@ -79,23 +76,23 @@ int test(char *URL)
     curl_off_t uploadSize;
     curl_easy_getinfo(curl, CURLINFO_SIZE_UPLOAD_T, &uploadSize);
 
-    printf("uploadSize = %ld\n", (long)uploadSize);
+    curl_mprintf("uploadSize = %" CURL_FORMAT_CURL_OFF_T "\n", uploadSize);
 
-    if((size_t) uploadSize == sizeof(g_Data)) {
-      printf("!!!!!!!!!! PASS\n");
+    if((size_t)uploadSize == sizeof(g_Data)) {
+      curl_mprintf("!!!!!!!!!! PASS\n");
     }
     else {
-      printf("sent %d, libcurl says %d\n",
-             (int)sizeof(g_Data), (int)uploadSize);
+      curl_mprintf("sent %zu, libcurl says %" CURL_FORMAT_CURL_OFF_T "\n",
+                   sizeof(g_Data), uploadSize);
     }
   }
   else {
-    printf("curl_easy_perform() failed. e = %d\n", code);
+    curl_mprintf("curl_easy_perform() failed. e = %d\n", (int)code);
   }
 test_cleanup:
   curl_slist_free_all(pHeaderList);
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return 0;
+  return code;
 }
diff --git a/third-party/curl/tests/libtest/lib1523.c b/third-party/curl/tests/libtest/lib1523.c
index 9aa9e3cb48..53ed580a59 100644
--- a/third-party/curl/tests/libtest/lib1523.c
+++ b/third-party/curl/tests/libtest/lib1523.c
@@ -21,14 +21,10 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
 /* test case and code based on https://github.com/curl/curl/issues/3927 */
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
 static int dload_progress_cb(void *a, curl_off_t b, curl_off_t c,
                              curl_off_t d, curl_off_t e)
 {
@@ -40,46 +36,38 @@ static int dload_progress_cb(void *a, curl_off_t b, curl_off_t c,
   return 0;
 }
 
-static size_t write_cb(char *d, size_t n, size_t l, void *p)
+static CURLcode run(CURL *curl, long limit, long time)
 {
-  /* take care of the data here, ignored in this example */
-  (void)d;
-  (void)p;
-  return n*l;
+  curl_easy_setopt(curl, CURLOPT_LOW_SPEED_LIMIT, limit);
+  curl_easy_setopt(curl, CURLOPT_LOW_SPEED_TIME, time);
+  return curl_easy_perform(curl);
 }
 
-static CURLcode run(CURL *hnd, long limit, long time)
+static CURLcode test_lib1523(const char *URL)
 {
-  curl_easy_setopt(hnd, CURLOPT_LOW_SPEED_LIMIT, limit);
-  curl_easy_setopt(hnd, CURLOPT_LOW_SPEED_TIME, time);
-  return curl_easy_perform(hnd);
-}
-
-int test(char *URL)
-{
-  CURLcode ret;
-  CURL *hnd;
+  CURLcode result;
+  CURL *curl;
   char buffer[CURL_ERROR_SIZE];
   curl_global_init(CURL_GLOBAL_ALL);
-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_URL, URL);
-  curl_easy_setopt(hnd, CURLOPT_WRITEFUNCTION, write_cb);
-  curl_easy_setopt(hnd, CURLOPT_ERRORBUFFER, buffer);
-  curl_easy_setopt(hnd, CURLOPT_NOPROGRESS, 0L);
-  curl_easy_setopt(hnd, CURLOPT_XFERINFOFUNCTION, dload_progress_cb);
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_URL, URL);
+  curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, tutil_throwaway_cb);
+  curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, buffer);
+  curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
+  curl_easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, dload_progress_cb);
 
-  ret = run(hnd, 1, 2);
-  if(ret)
-    fprintf(stderr, "error %d: %s\n", ret, buffer);
+  result = run(curl, 1, 2);
+  if(result)
+    curl_mfprintf(stderr, "error (%d) %s\n", (int)result, buffer);
 
-  ret = run(hnd, 12000, 1);
-  if(ret != CURLE_OPERATION_TIMEDOUT)
-    fprintf(stderr, "error %d: %s\n", ret, buffer);
+  result = run(curl, 12000, 1);
+  if(result != CURLE_OPERATION_TIMEDOUT)
+    curl_mfprintf(stderr, "error (%d) %s\n", (int)result, buffer);
   else
-    ret = CURLE_OK;
+    result = CURLE_OK;
 
-  curl_easy_cleanup(hnd);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)ret;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1525.c b/third-party/curl/tests/libtest/lib1525.c
index 591eb413fd..3498941ea2 100644
--- a/third-party/curl/tests/libtest/lib1525.c
+++ b/third-party/curl/tests/libtest/lib1525.c
@@ -24,43 +24,41 @@
  ***************************************************************************/
 
 /*
- * This unit test PUT http data over proxy. Proxy header will be different
+ * This unit test PUT http data over proxy. Proxy header is different
  * from server http header
  */
 
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
+static const char t1525_data[] = "Hello Cloud!\n";
+static size_t const t1525_datalen = sizeof(t1525_data) - 1;
 
-static char data [] = "Hello Cloud!\n";
-
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *stream)
+static size_t t1525_read_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
-  size_t  amount = nmemb * size; /* Total bytes curl wants */
-  if(amount < strlen(data)) {
-    return strlen(data);
+  size_t amount = nmemb * size; /* Total bytes curl wants */
+  if(amount < t1525_datalen) {
+    return t1525_datalen;
   }
   (void)stream;
-  memcpy(ptr, data, strlen(data));
-  return strlen(data);
+  memcpy(ptr, t1525_data, t1525_datalen);
+  return t1525_datalen;
 }
 
-
-int test(char *URL)
+static CURLcode test_lib1525(const char *URL)
 {
   CURL *curl = NULL;
-  CURLcode res = CURLE_FAILED_INIT;
+  CURLcode result = CURLE_FAILED_INIT;
   /* http and proxy header list */
   struct curl_slist *hhl = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
@@ -71,22 +69,22 @@ int test(char *URL)
     goto test_cleanup;
   }
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_PROXY, libtest_arg2);
-  test_setopt(curl, CURLOPT_HTTPHEADER, hhl);
-  test_setopt(curl, CURLOPT_PROXYHEADER, hhl);
-  test_setopt(curl, CURLOPT_HEADEROPT, CURLHEADER_UNIFIED);
-  test_setopt(curl, CURLOPT_POST, 0L);
-  test_setopt(curl, CURLOPT_UPLOAD, 1L);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_HTTP);
-  test_setopt(curl, CURLOPT_HEADER, 1L);
-  test_setopt(curl, CURLOPT_WRITEFUNCTION, fwrite);
-  test_setopt(curl, CURLOPT_READFUNCTION, read_callback);
-  test_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
-  test_setopt(curl, CURLOPT_INFILESIZE, (long)strlen(data));
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_PROXY, libtest_arg2);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, hhl);
+  easy_setopt(curl, CURLOPT_PROXYHEADER, hhl);
+  easy_setopt(curl, CURLOPT_HEADEROPT, CURLHEADER_UNIFIED);
+  easy_setopt(curl, CURLOPT_POST, 0L);
+  easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_HTTP);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_WRITEFUNCTION, fwrite);
+  easy_setopt(curl, CURLOPT_READFUNCTION, t1525_read_cb);
+  easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
+  easy_setopt(curl, CURLOPT_INFILESIZE, (long)t1525_datalen);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -96,5 +94,5 @@ test_cleanup:
 
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1526.c b/third-party/curl/tests/libtest/lib1526.c
index c11e536ebb..6e01804628 100644
--- a/third-party/curl/tests/libtest/lib1526.c
+++ b/third-party/curl/tests/libtest/lib1526.c
@@ -23,42 +23,41 @@
  ***************************************************************************/
 
 /*
- * This unit test PUT http data over proxy. Proxy header will be different
+ * This unit test PUT http data over proxy. Proxy header is different
  * from server http header
  */
 
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
+static const char t1526_data[] = "Hello Cloud!\n";
+static size_t const t1526_datalen = sizeof(t1526_data) - 1;
 
-static char data [] = "Hello Cloud!\n";
-
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *stream)
+static size_t t1526_read_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
-  size_t  amount = nmemb * size; /* Total bytes curl wants */
-  if(amount < strlen(data)) {
-    return strlen(data);
+  size_t amount = nmemb * size; /* Total bytes curl wants */
+  if(amount < t1526_datalen) {
+    return t1526_datalen;
   }
   (void)stream;
-  memcpy(ptr, data, strlen(data));
-  return strlen(data);
+  memcpy(ptr, t1526_data, t1526_datalen);
+  return t1526_datalen;
 }
 
-int test(char *URL)
+static CURLcode test_lib1526(const char *URL)
 {
   CURL *curl = NULL;
-  CURLcode res = CURLE_FAILED_INIT;
+  CURLcode result = CURLE_FAILED_INIT;
   /* http and proxy header list */
   struct curl_slist *hhl = NULL, *phl = NULL, *tmp = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
@@ -74,22 +73,22 @@ int test(char *URL)
   }
   phl = tmp;
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_PROXY, libtest_arg2);
-  test_setopt(curl, CURLOPT_HTTPHEADER, hhl);
-  test_setopt(curl, CURLOPT_PROXYHEADER, phl);
-  test_setopt(curl, CURLOPT_HEADEROPT, CURLHEADER_SEPARATE);
-  test_setopt(curl, CURLOPT_POST, 0L);
-  test_setopt(curl, CURLOPT_UPLOAD, 1L);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_HTTP);
-  test_setopt(curl, CURLOPT_HEADER, 1L);
-  test_setopt(curl, CURLOPT_WRITEFUNCTION, fwrite);
-  test_setopt(curl, CURLOPT_READFUNCTION, read_callback);
-  test_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
-  test_setopt(curl, CURLOPT_INFILESIZE, (long)strlen(data));
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_PROXY, libtest_arg2);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, hhl);
+  easy_setopt(curl, CURLOPT_PROXYHEADER, phl);
+  easy_setopt(curl, CURLOPT_HEADEROPT, CURLHEADER_SEPARATE);
+  easy_setopt(curl, CURLOPT_POST, 0L);
+  easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_HTTP);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_WRITEFUNCTION, fwrite);
+  easy_setopt(curl, CURLOPT_READFUNCTION, t1526_read_cb);
+  easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
+  easy_setopt(curl, CURLOPT_INFILESIZE, (long)t1526_datalen);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -101,5 +100,5 @@ test_cleanup:
 
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1527.c b/third-party/curl/tests/libtest/lib1527.c
index e598705853..ef438dc901 100644
--- a/third-party/curl/tests/libtest/lib1527.c
+++ b/third-party/curl/tests/libtest/lib1527.c
@@ -23,43 +23,41 @@
  ***************************************************************************/
 
 /*
- * This unit test PUT http data over proxy. Same  http header will be generated
+ * This unit test PUT http data over proxy. Same http header is generated
  * for server and proxy
  */
 
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
+static const char t1527_data[] = "Hello Cloud!\n";
+static size_t const t1527_datalen = sizeof(t1527_data) - 1;
 
-static char data [] = "Hello Cloud!\n";
-
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *stream)
+static size_t t1527_read_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
-  size_t  amount = nmemb * size; /* Total bytes curl wants */
-  if(amount < strlen(data)) {
-    return strlen(data);
+  size_t amount = nmemb * size; /* Total bytes curl wants */
+  if(amount < t1527_datalen) {
+    return t1527_datalen;
   }
   (void)stream;
-  memcpy(ptr, data, strlen(data));
-  return strlen(data);
+  memcpy(ptr, t1527_data, t1527_datalen);
+  return t1527_datalen;
 }
 
-
-int test(char *URL)
+static CURLcode test_lib1527(const char *URL)
 {
   CURL *curl = NULL;
-  CURLcode res = CURLE_FAILED_INIT;
+  CURLcode result = CURLE_FAILED_INIT;
   /* http header list */
   struct curl_slist *hhl = NULL, *tmp = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
@@ -74,21 +72,21 @@ int test(char *URL)
   }
   hhl = tmp;
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_PROXY, libtest_arg2);
-  test_setopt(curl, CURLOPT_HTTPHEADER, hhl);
-  test_setopt(curl, CURLOPT_POST, 0L);
-  test_setopt(curl, CURLOPT_UPLOAD, 1L);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_HTTP);
-  test_setopt(curl, CURLOPT_HEADER, 1L);
-  test_setopt(curl, CURLOPT_WRITEFUNCTION, fwrite);
-  test_setopt(curl, CURLOPT_READFUNCTION, read_callback);
-  test_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
-  test_setopt(curl, CURLOPT_INFILESIZE, (long)strlen(data));
-  test_setopt(curl, CURLOPT_HEADEROPT, CURLHEADER_UNIFIED);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_PROXY, libtest_arg2);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, hhl);
+  easy_setopt(curl, CURLOPT_POST, 0L);
+  easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_HTTP);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_WRITEFUNCTION, fwrite);
+  easy_setopt(curl, CURLOPT_READFUNCTION, t1527_read_cb);
+  easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
+  easy_setopt(curl, CURLOPT_INFILESIZE, (long)t1527_datalen);
+  easy_setopt(curl, CURLOPT_HEADEROPT, CURLHEADER_UNIFIED);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -98,5 +96,5 @@ test_cleanup:
 
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1528.c b/third-party/curl/tests/libtest/lib1528.c
index ae23604148..f8db672535 100644
--- a/third-party/curl/tests/libtest/lib1528.c
+++ b/third-party/curl/tests/libtest/lib1528.c
@@ -21,27 +21,24 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "first.h"
 
-#include "test.h"
-
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1528(const char *URL)
 {
   CURL *curl = NULL;
-  CURLcode res = CURLE_FAILED_INIT;
+  CURLcode result = CURLE_FAILED_INIT;
   /* http header list */
   struct curl_slist *hhl = NULL;
   struct curl_slist *phl = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
@@ -53,16 +50,16 @@ int test(char *URL)
     goto test_cleanup;
   }
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_PROXY, libtest_arg2);
-  test_setopt(curl, CURLOPT_HTTPHEADER, hhl);
-  test_setopt(curl, CURLOPT_PROXYHEADER, phl);
-  test_setopt(curl, CURLOPT_HEADEROPT, CURLHEADER_SEPARATE);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_HTTP);
-  test_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_PROXY, libtest_arg2);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, hhl);
+  easy_setopt(curl, CURLOPT_PROXYHEADER, phl);
+  easy_setopt(curl, CURLOPT_HEADEROPT, CURLHEADER_SEPARATE);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_HTTP);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -71,5 +68,5 @@ test_cleanup:
   curl_slist_free_all(phl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1529.c b/third-party/curl/tests/libtest/lib1529.c
index 5b0f990fdb..ccf0032035 100644
--- a/third-party/curl/tests/libtest/lib1529.c
+++ b/third-party/curl/tests/libtest/lib1529.c
@@ -21,43 +21,40 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "first.h"
 
-#include "test.h"
-
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1529(const char *URL)
 {
   CURL *curl = NULL;
-  CURLcode res = CURLE_FAILED_INIT;
+  CURLcode result = CURLE_FAILED_INIT;
   char bURL[512];
-  msnprintf(bURL, sizeof(bURL),
-            "%s HTTP/1.1\r\nGET http://1529.com/1529", URL);
+  curl_msnprintf(bURL, sizeof(bURL),
+                 "%s HTTP/1.1\r\nGET http://1529.com/1529", URL);
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_URL, bURL);
-  test_setopt(curl, CURLOPT_PROXY, libtest_arg2);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_HTTP);
-  test_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_URL, bURL);
+  easy_setopt(curl, CURLOPT_PROXY, libtest_arg2);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_HTTP);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1530.c b/third-party/curl/tests/libtest/lib1530.c
index e45949294d..ecce16803d 100644
--- a/third-party/curl/tests/libtest/lib1530.c
+++ b/third-party/curl/tests/libtest/lib1530.c
@@ -21,10 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
-#include "test.h"
-
-#include "memdebug.h"
+#include "first.h"
 
 static curl_socket_t opensocket(void *clientp,
                                 curlsocktype purpose,
@@ -33,38 +30,38 @@ static curl_socket_t opensocket(void *clientp,
   (void)purpose;
   (void)address;
   (void)clientp;
-  fprintf(stderr, "opensocket() returns CURL_SOCKET_BAD\n");
+  curl_mfprintf(stderr, "opensocket() returns CURL_SOCKET_BAD\n");
   return CURL_SOCKET_BAD;
 }
 
-int test(char *URL)
+static CURLcode test_lib1530(const char *URL)
 {
   CURL *curl = NULL;
-  CURLcode res = CURLE_FAILED_INIT;
+  CURLcode result = CURLE_FAILED_INIT;
   (void)URL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_URL, "http://99.99.99.99:9999");
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, opensocket);
+  easy_setopt(curl, CURLOPT_URL, "http://99.99.99.99:9999");
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, opensocket);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1531.c b/third-party/curl/tests/libtest/lib1531.c
index 7034001784..def737f9f1 100644
--- a/third-party/curl/tests/libtest/lib1531.c
+++ b/third-party/curl/tests/libtest/lib1531.c
@@ -21,55 +21,47 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "timediff.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
-
-static char const testData[] = ".abc\0xyz";
-static off_t const testDataSize = sizeof(testData) - 1;
-
-int test(char *URL)
+static CURLcode test_lib1531(const char *URL)
 {
-  CURL *easy;
-  CURLM *multi_handle;
+  static char const testdata[] = ".abc\0xyz";
+  static curl_off_t const testdatalen = sizeof(testdata) - 1;
+
+  CURL *curl;
+  CURLM *multi;
   int still_running; /* keep number of running handles */
   CURLMsg *msg; /* for picking up messages with the transfer status */
   int msgs_left; /* how many messages are left */
-  int res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   start_test_timing();
 
   global_init(CURL_GLOBAL_ALL);
 
-  /* Allocate one CURL handle per transfer */
-  easy = curl_easy_init();
+  /* Allocate one curl handle per transfer */
+  curl = curl_easy_init();
 
   /* init a multi stack */
-  multi_handle = curl_multi_init();
+  multi = curl_multi_init();
 
   /* add the individual transfer */
-  curl_multi_add_handle(multi_handle, easy);
+  curl_multi_add_handle(multi, curl);
 
-  /* set the options (I left out a few, you'll get the point anyway) */
-  curl_easy_setopt(easy, CURLOPT_URL, URL);
-  curl_easy_setopt(easy, CURLOPT_POSTFIELDSIZE_LARGE,
-                   (curl_off_t)testDataSize);
-  curl_easy_setopt(easy, CURLOPT_POSTFIELDS, testData);
+  /* set the options (I left out a few, you get the point anyway) */
+  curl_easy_setopt(curl, CURLOPT_URL, URL);
+  curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE_LARGE, testdatalen);
+  curl_easy_setopt(curl, CURLOPT_POSTFIELDS, testdata);
 
   /* we start some action by calling perform right away */
-  curl_multi_perform(multi_handle, &still_running);
+  curl_multi_perform(multi, &still_running);
 
   abort_on_test_timeout();
 
   do {
     struct timeval timeout;
     int rc; /* select() return code */
-    CURLMcode mc; /* curl_multi_fdset() return code */
+    CURLMcode mresult; /* curl_multi_fdset() return code */
 
     fd_set fdread;
     fd_set fdwrite;
@@ -86,7 +78,7 @@ int test(char *URL)
     timeout.tv_sec = 1;
     timeout.tv_usec = 0;
 
-    curl_multi_timeout(multi_handle, &curl_timeo);
+    curl_multi_timeout(multi, &curl_timeo);
     if(curl_timeo >= 0) {
       curlx_mstotv(&timeout, curl_timeo);
       if(timeout.tv_sec > 1) {
@@ -96,10 +88,10 @@ int test(char *URL)
     }
 
     /* get file descriptors from the transfers */
-    mc = curl_multi_fdset(multi_handle, &fdread, &fdwrite, &fdexcep, &maxfd);
+    mresult = curl_multi_fdset(multi, &fdread, &fdwrite, &fdexcep, &maxfd);
 
-    if(mc != CURLM_OK) {
-      fprintf(stderr, "curl_multi_fdset() failed, code %d.\n", mc);
+    if(mresult != CURLM_OK) {
+      curl_mfprintf(stderr, "curl_multi_fdset() failed, code %d.\n", mresult);
       break;
     }
 
@@ -110,14 +102,7 @@ int test(char *URL)
        curl_multi_fdset() doc. */
 
     if(maxfd == -1) {
-#if defined(WIN32) || defined(_WIN32)
-      Sleep(100);
-      rc = 0;
-#else
-      /* Portable sleep for platforms other than Windows. */
-      struct timeval wait = { 0, 100 * 1000 }; /* 100ms */
-      rc = select(0, NULL, NULL, NULL, &wait);
-#endif
+      rc = curlx_wait_ms(100);
     }
     else {
       /* Note that on some platforms 'timeout' may be modified by select().
@@ -131,7 +116,7 @@ int test(char *URL)
       break;
     case 0: /* timeout */
     default: /* action */
-      curl_multi_perform(multi_handle, &still_running);
+      curl_multi_perform(multi, &still_running);
       break;
     }
 
@@ -140,9 +125,10 @@ int test(char *URL)
 
   /* See how the transfers went */
   do {
-    msg = curl_multi_info_read(multi_handle, &msgs_left);
+    msg = curl_multi_info_read(multi, &msgs_left);
     if(msg && msg->msg == CURLMSG_DONE) {
-      printf("HTTP transfer completed with status %d\n", msg->data.result);
+      curl_mprintf("HTTP transfer completed with status %d\n",
+                   (int)msg->data.result);
       break;
     }
 
@@ -150,11 +136,11 @@ int test(char *URL)
   } while(msg);
 
 test_cleanup:
-  curl_multi_cleanup(multi_handle);
+  curl_multi_cleanup(multi);
 
-  /* Free the CURL handles */
-  curl_easy_cleanup(easy);
+  /* Free the curl handles */
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1532.c b/third-party/curl/tests/libtest/lib1532.c
index a3ac70929d..25c5ab439a 100644
--- a/third-party/curl/tests/libtest/lib1532.c
+++ b/third-party/curl/tests/libtest/lib1532.c
@@ -21,17 +21,15 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "memdebug.h"
+#include "first.h"
 
 /* Test CURLINFO_RESPONSE_CODE */
 
-int test(char *URL)
+static CURLcode test_lib1532(const char *URL)
 {
   CURL *curl;
   long httpcode;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
 
@@ -39,44 +37,49 @@ int test(char *URL)
 
   easy_setopt(curl, CURLOPT_URL, URL);
 
-  res = curl_easy_perform(curl);
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_perform() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  result = curl_easy_perform(curl);
+  if(result) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_perform() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
 
-  res = curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpcode);
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  result = curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpcode);
+  if(result) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
   if(httpcode != 200) {
-    fprintf(stderr, "%s:%d unexpected response code %ld\n",
-            __FILE__, __LINE__, httpcode);
-    res = CURLE_HTTP_RETURNED_ERROR;
+    curl_mfprintf(stderr, "%s:%d unexpected response code %ld\n",
+                  __FILE__, __LINE__, httpcode);
+    result = CURLE_HTTP_RETURNED_ERROR;
     goto test_cleanup;
   }
 
   /* Test for a regression of github bug 1017 (response code does not reset) */
   curl_easy_reset(curl);
 
-  res = curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpcode);
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  result = curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpcode);
+  if(result) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
   if(httpcode) {
-    fprintf(stderr, "%s:%d curl_easy_reset failed to zero the response code\n"
-            "possible regression of github bug 1017\n", __FILE__, __LINE__);
-    res = CURLE_HTTP_RETURNED_ERROR;
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_reset failed to zero the response code\n"
+                  "possible regression of github bug 1017\n",
+                  __FILE__, __LINE__);
+    result = CURLE_HTTP_RETURNED_ERROR;
     goto test_cleanup;
   }
 
 test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1533.c b/third-party/curl/tests/libtest/lib1533.c
index 555fb962b5..c0ad8e46cb 100644
--- a/third-party/curl/tests/libtest/lib1533.c
+++ b/third-party/curl/tests/libtest/lib1533.c
@@ -29,31 +29,26 @@
  * because this implies that the data has been sent completely to the server.
  */
 
-#include "test.h"
-
-#include "memdebug.h"
+#include "first.h"
 
 struct cb_data {
-  CURL *easy_handle;
+  CURL *curl;
   int response_received;
   int paused;
   size_t remaining_bytes;
 };
 
-
 static void reset_data(struct cb_data *data, CURL *curl)
 {
-  data->easy_handle = curl;
+  data->curl = curl;
   data->response_received = 0;
   data->paused = 0;
   data->remaining_bytes = 3;
 }
 
-
-static size_t read_callback(char *ptr, size_t size, size_t nitems,
-                            void *userdata)
+static size_t t1533_read_cb(char *ptr, size_t size, size_t nitems, void *userp)
 {
-  struct cb_data *data = (struct cb_data *)userdata;
+  struct cb_data *data = (struct cb_data *)userp;
 
   /* wait until the server has sent all response headers */
   if(data->response_received) {
@@ -75,14 +70,11 @@ static size_t read_callback(char *ptr, size_t size, size_t nitems,
   }
 }
 
-
-static size_t write_callback(char *ptr, size_t size, size_t nmemb,
-                             void *userdata)
+static size_t t1533_write_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
-  struct cb_data *data = (struct cb_data *)userdata;
+  struct cb_data *data = (struct cb_data *)userp;
   size_t totalsize = nmemb * size;
 
-  /* unused parameter */
   (void)ptr;
 
   /* all response headers have been received */
@@ -91,33 +83,34 @@ static size_t write_callback(char *ptr, size_t size, size_t nmemb,
   if(data->paused) {
     /* continue to send request body data */
     data->paused = 0;
-    curl_easy_pause(data->easy_handle, CURLPAUSE_CONT);
+    curl_easy_pause(data->curl, CURLPAUSE_CONT);
   }
 
   return totalsize;
 }
 
-
-static int perform_and_check_connections(CURL *curl, const char *description,
-                                         long expected_connections)
+static CURLcode perform_and_check_connections(CURL *curl,
+                                              const char *description,
+                                              long expected_connections)
 {
-  CURLcode res;
+  CURLcode result;
   long connections = 0;
 
-  res = curl_easy_perform(curl);
-  if(res != CURLE_OK) {
-    fprintf(stderr, "curl_easy_perform() failed\n");
+  result = curl_easy_perform(curl);
+  if(result != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_easy_perform() failed with %d\n", (int)result);
     return TEST_ERR_MAJOR_BAD;
   }
 
-  res = curl_easy_getinfo(curl, CURLINFO_NUM_CONNECTS, &connections);
-  if(res != CURLE_OK) {
-    fprintf(stderr, "curl_easy_getinfo() failed\n");
+  result = curl_easy_getinfo(curl, CURLINFO_NUM_CONNECTS, &connections);
+  if(result != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_easy_getinfo() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
-  fprintf(stderr, "%s: expected: %ld connections; actual: %ld connections\n",
-          description, expected_connections, connections);
+  curl_mfprintf(stderr,
+                "%s: expected: %ld connections; actual: %ld connections\n",
+                description, expected_connections, connections);
 
   if(connections != expected_connections) {
     return TEST_ERR_FAILURE;
@@ -126,76 +119,75 @@ static int perform_and_check_connections(CURL *curl, const char *description,
   return TEST_ERR_SUCCESS;
 }
 
-
-int test(char *URL)
+static CURLcode test_lib1533(const char *URL)
 {
   struct cb_data data;
   CURL *curl = NULL;
-  int res = TEST_ERR_FAILURE;
+  CURLcode result = TEST_ERR_FAILURE;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   reset_data(&data, curl);
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_POST, 1L);
-  test_setopt(curl, CURLOPT_POSTFIELDSIZE_LARGE,
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_POST, 1L);
+  easy_setopt(curl, CURLOPT_POSTFIELDSIZE_LARGE,
               (curl_off_t)data.remaining_bytes);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_READFUNCTION, read_callback);
-  test_setopt(curl, CURLOPT_READDATA, &data);
-  test_setopt(curl, CURLOPT_WRITEFUNCTION, write_callback);
-  test_setopt(curl, CURLOPT_WRITEDATA, &data);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_READFUNCTION, t1533_read_cb);
+  easy_setopt(curl, CURLOPT_READDATA, &data);
+  easy_setopt(curl, CURLOPT_WRITEFUNCTION, t1533_write_cb);
+  easy_setopt(curl, CURLOPT_WRITEDATA, &data);
 
-  res = perform_and_check_connections(curl,
-    "First request without CURLOPT_KEEP_SENDING_ON_ERROR", 1);
-  if(res != TEST_ERR_SUCCESS) {
+  result =
+    perform_and_check_connections(curl,
+                                  "First request without "
+                                  "CURLOPT_KEEP_SENDING_ON_ERROR", 1);
+  if(result != TEST_ERR_SUCCESS) {
     goto test_cleanup;
   }
 
   reset_data(&data, curl);
 
-  res = perform_and_check_connections(curl,
+  result = perform_and_check_connections(curl,
     "Second request without CURLOPT_KEEP_SENDING_ON_ERROR", 1);
-  if(res != TEST_ERR_SUCCESS) {
+  if(result != TEST_ERR_SUCCESS) {
     goto test_cleanup;
   }
 
-  test_setopt(curl, CURLOPT_KEEP_SENDING_ON_ERROR, 1L);
+  easy_setopt(curl, CURLOPT_KEEP_SENDING_ON_ERROR, 1L);
 
   reset_data(&data, curl);
 
-  res = perform_and_check_connections(curl,
+  result = perform_and_check_connections(curl,
     "First request with CURLOPT_KEEP_SENDING_ON_ERROR", 1);
-  if(res != TEST_ERR_SUCCESS) {
+  if(result != TEST_ERR_SUCCESS) {
     goto test_cleanup;
   }
 
   reset_data(&data, curl);
 
-  res = perform_and_check_connections(curl,
+  result = perform_and_check_connections(curl,
     "Second request with CURLOPT_KEEP_SENDING_ON_ERROR", 0);
-  if(res != TEST_ERR_SUCCESS) {
+  if(result != TEST_ERR_SUCCESS) {
     goto test_cleanup;
   }
 
-  res = TEST_ERR_SUCCESS;
+  result = TEST_ERR_SUCCESS;
 
 test_cleanup:
-
   curl_easy_cleanup(curl);
-
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1534.c b/third-party/curl/tests/libtest/lib1534.c
index 620e383385..9c4491b8bc 100644
--- a/third-party/curl/tests/libtest/lib1534.c
+++ b/third-party/curl/tests/libtest/lib1534.c
@@ -21,105 +21,110 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "memdebug.h"
+#include "first.h"
 
 /* Test CURLINFO_FILETIME */
 
-int test(char *URL)
+static CURLcode test_lib1534(const char *URL)
 {
   CURL *curl, *dupe = NULL;
   long filetime;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
 
   easy_init(curl);
 
   /* Test that a filetime is properly initialized on curl_easy_init.
-  */
+   */
 
-  res = curl_easy_getinfo(curl, CURLINFO_FILETIME, &filetime);
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  result = curl_easy_getinfo(curl, CURLINFO_FILETIME, &filetime);
+  if(result) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
   if(filetime != -1) {
-    fprintf(stderr, "%s:%d filetime init failed; expected -1 but is %ld\n",
-            __FILE__, __LINE__, filetime);
-    res = CURLE_FAILED_INIT;
+    curl_mfprintf(stderr,
+                  "%s:%d filetime init failed; expected -1 but is %ld\n",
+                  __FILE__, __LINE__, filetime);
+    result = CURLE_FAILED_INIT;
     goto test_cleanup;
   }
 
   easy_setopt(curl, CURLOPT_URL, URL);
   easy_setopt(curl, CURLOPT_FILETIME, 1L);
 
-  res = curl_easy_perform(curl);
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_perform() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  result = curl_easy_perform(curl);
+  if(result) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_perform() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
 
   /* Test that a filetime is properly set after receiving an HTTP resource.
-  */
+   */
 
-  res = curl_easy_getinfo(curl, CURLINFO_FILETIME, &filetime);
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  result = curl_easy_getinfo(curl, CURLINFO_FILETIME, &filetime);
+  if(result) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
   if(filetime != 30) {
-    fprintf(stderr, "%s:%d filetime of http resource is incorrect; "
-            "expected 30 but is %ld\n",
-            __FILE__, __LINE__, filetime);
-    res = CURLE_HTTP_RETURNED_ERROR;
+    curl_mfprintf(stderr, "%s:%d filetime of http resource is incorrect; "
+                  "expected 30 but is %ld\n",
+                  __FILE__, __LINE__, filetime);
+    result = CURLE_HTTP_RETURNED_ERROR;
     goto test_cleanup;
   }
 
   /* Test that a filetime is properly initialized on curl_easy_duphandle.
-  */
+   */
 
   dupe = curl_easy_duphandle(curl);
   if(!dupe) {
-    fprintf(stderr, "%s:%d curl_easy_duphandle() failed\n",
-            __FILE__, __LINE__);
-    res = CURLE_FAILED_INIT;
+    curl_mfprintf(stderr, "%s:%d curl_easy_duphandle() failed\n",
+                  __FILE__, __LINE__);
+    result = CURLE_FAILED_INIT;
     goto test_cleanup;
   }
 
-  res = curl_easy_getinfo(dupe, CURLINFO_FILETIME, &filetime);
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  result = curl_easy_getinfo(dupe, CURLINFO_FILETIME, &filetime);
+  if(result) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
   if(filetime != -1) {
-    fprintf(stderr, "%s:%d filetime init failed; expected -1 but is %ld\n",
-            __FILE__, __LINE__, filetime);
-    res = CURLE_FAILED_INIT;
+    curl_mfprintf(stderr,
+                  "%s:%d filetime init failed; expected -1 but is %ld\n",
+                  __FILE__, __LINE__, filetime);
+    result = CURLE_FAILED_INIT;
     goto test_cleanup;
   }
 
-
   /* Test that a filetime is properly initialized on curl_easy_reset.
-  */
+   */
 
   curl_easy_reset(curl);
 
-  res = curl_easy_getinfo(curl, CURLINFO_FILETIME, &filetime);
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  result = curl_easy_getinfo(curl, CURLINFO_FILETIME, &filetime);
+  if(result) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
   if(filetime != -1) {
-    fprintf(stderr, "%s:%d filetime init failed; expected -1 but is %ld\n",
-            __FILE__, __LINE__, filetime);
-    res = CURLE_FAILED_INIT;
+    curl_mfprintf(stderr,
+                  "%s:%d filetime init failed; expected -1 but is %ld\n",
+                  __FILE__, __LINE__, filetime);
+    result = CURLE_FAILED_INIT;
     goto test_cleanup;
   }
 
@@ -127,5 +132,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_easy_cleanup(dupe);
   curl_global_cleanup();
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1535.c b/third-party/curl/tests/libtest/lib1535.c
index 6edf887312..68ec25fb60 100644
--- a/third-party/curl/tests/libtest/lib1535.c
+++ b/third-party/curl/tests/libtest/lib1535.c
@@ -21,112 +21,114 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "memdebug.h"
+#include "first.h"
 
 /* Test CURLINFO_PROTOCOL */
 
-int test(char *URL)
+static CURLcode test_lib1535(const char *URL)
 {
   CURL *curl, *dupe = NULL;
   long protocol;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
 
   easy_init(curl);
 
   /* Test that protocol is properly initialized on curl_easy_init.
-  */
+   */
 
-  CURL_IGNORE_DEPRECATION(
-    res = curl_easy_getinfo(curl, CURLINFO_PROTOCOL, &protocol);
-  )
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  result = curl_easy_getinfo(curl, CURLINFO_PROTOCOL, &protocol);
+
+  if(result) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
   if(protocol) {
-    fprintf(stderr, "%s:%d protocol init failed; expected 0 but is %ld\n",
-            __FILE__, __LINE__, protocol);
-    res = CURLE_FAILED_INIT;
+    curl_mfprintf(stderr,
+                  "%s:%d protocol init failed; expected 0 but is %ld\n",
+                  __FILE__, __LINE__, protocol);
+    result = CURLE_FAILED_INIT;
     goto test_cleanup;
   }
 
   easy_setopt(curl, CURLOPT_URL, URL);
 
-  res = curl_easy_perform(curl);
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_perform() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  result = curl_easy_perform(curl);
+  if(result) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_perform() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
 
   /* Test that a protocol is properly set after receiving an HTTP resource.
-  */
+   */
 
-  CURL_IGNORE_DEPRECATION(
-    res = curl_easy_getinfo(curl, CURLINFO_PROTOCOL, &protocol);
-  )
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  result = curl_easy_getinfo(curl, CURLINFO_PROTOCOL, &protocol);
+
+  if(result) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
   if(protocol != CURLPROTO_HTTP) {
-    fprintf(stderr, "%s:%d protocol of http resource is incorrect; "
-            "expected %d but is %ld\n",
-            __FILE__, __LINE__, CURLPROTO_HTTP, protocol);
-    res = CURLE_HTTP_RETURNED_ERROR;
+    curl_mfprintf(stderr,
+                  "%s:%d protocol of http resource is incorrect; "
+                  "expected %ld but is %ld\n",
+                  __FILE__, __LINE__, CURLPROTO_HTTP, protocol);
+    result = CURLE_HTTP_RETURNED_ERROR;
     goto test_cleanup;
   }
 
   /* Test that a protocol is properly initialized on curl_easy_duphandle.
-  */
+   */
 
   dupe = curl_easy_duphandle(curl);
   if(!dupe) {
-    fprintf(stderr, "%s:%d curl_easy_duphandle() failed\n",
-            __FILE__, __LINE__);
-    res = CURLE_FAILED_INIT;
+    curl_mfprintf(stderr, "%s:%d curl_easy_duphandle() failed\n",
+                  __FILE__, __LINE__);
+    result = CURLE_FAILED_INIT;
     goto test_cleanup;
   }
 
-  CURL_IGNORE_DEPRECATION(
-    res = curl_easy_getinfo(dupe, CURLINFO_PROTOCOL, &protocol);
-  )
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  result = curl_easy_getinfo(dupe, CURLINFO_PROTOCOL, &protocol);
+
+  if(result) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
   if(protocol) {
-    fprintf(stderr, "%s:%d protocol init failed; expected 0 but is %ld\n",
-            __FILE__, __LINE__, protocol);
-    res = CURLE_FAILED_INIT;
+    curl_mfprintf(stderr,
+                  "%s:%d protocol init failed; expected 0 but is %ld\n",
+                  __FILE__, __LINE__, protocol);
+    result = CURLE_FAILED_INIT;
     goto test_cleanup;
   }
 
-
   /* Test that a protocol is properly initialized on curl_easy_reset.
-  */
+   */
 
   curl_easy_reset(curl);
 
-  CURL_IGNORE_DEPRECATION(
-    res = curl_easy_getinfo(curl, CURLINFO_PROTOCOL, &protocol);
-  )
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  result = curl_easy_getinfo(curl, CURLINFO_PROTOCOL, &protocol);
+
+  if(result) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
   if(protocol) {
-    fprintf(stderr, "%s:%d protocol init failed; expected 0 but is %ld\n",
-            __FILE__, __LINE__, protocol);
-    res = CURLE_FAILED_INIT;
+    curl_mfprintf(stderr,
+                  "%s:%d protocol init failed; expected 0 but is %ld\n",
+                  __FILE__, __LINE__, protocol);
+    result = CURLE_FAILED_INIT;
     goto test_cleanup;
   }
 
@@ -134,5 +136,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_easy_cleanup(dupe);
   curl_global_cleanup();
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1536.c b/third-party/curl/tests/libtest/lib1536.c
index 9ba7ec18e9..f6632c7361 100644
--- a/third-party/curl/tests/libtest/lib1536.c
+++ b/third-party/curl/tests/libtest/lib1536.c
@@ -21,105 +21,107 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "memdebug.h"
+#include "first.h"
 
 /* Test CURLINFO_SCHEME */
 
-int test(char *URL)
+static CURLcode test_lib1536(const char *URL)
 {
   CURL *curl, *dupe = NULL;
-  char *scheme;
-  CURLcode res = CURLE_OK;
+  const char *scheme;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
 
   easy_init(curl);
 
   /* Test that scheme is properly initialized on curl_easy_init.
-  */
+   */
 
-  res = curl_easy_getinfo(curl, CURLINFO_SCHEME, &scheme);
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  result = curl_easy_getinfo(curl, CURLINFO_SCHEME, &scheme);
+  if(result) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
   if(scheme) {
-    fprintf(stderr, "%s:%d scheme init failed; expected NULL\n",
-            __FILE__, __LINE__);
-    res = CURLE_FAILED_INIT;
+    curl_mfprintf(stderr,
+                  "%s:%d scheme init failed; expected NULL\n",
+                  __FILE__, __LINE__);
+    result = CURLE_FAILED_INIT;
     goto test_cleanup;
   }
 
   easy_setopt(curl, CURLOPT_URL, URL);
 
-  res = curl_easy_perform(curl);
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_perform() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  result = curl_easy_perform(curl);
+  if(result) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_perform() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
 
   /* Test that a scheme is properly set after receiving an HTTP resource.
-  */
+   */
 
-  res = curl_easy_getinfo(curl, CURLINFO_SCHEME, &scheme);
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  result = curl_easy_getinfo(curl, CURLINFO_SCHEME, &scheme);
+  if(result) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
-  if(!scheme || memcmp(scheme, "HTTP", 5) != 0) {
-    fprintf(stderr, "%s:%d scheme of http resource is incorrect; "
-            "expected 'HTTP' but is %s\n",
-            __FILE__, __LINE__,
-            (scheme == NULL ? "NULL" : "invalid"));
-    res = CURLE_HTTP_RETURNED_ERROR;
+  if(!scheme || memcmp(scheme, "http", 5)) {
+    curl_mfprintf(stderr, "%s:%d scheme of http resource is incorrect; "
+                  "expected 'http' but is %s\n",
+                  __FILE__, __LINE__, scheme ? "invalid" : "NULL");
+    result = CURLE_HTTP_RETURNED_ERROR;
     goto test_cleanup;
   }
 
   /* Test that a scheme is properly initialized on curl_easy_duphandle.
-  */
+   */
 
   dupe = curl_easy_duphandle(curl);
   if(!dupe) {
-    fprintf(stderr, "%s:%d curl_easy_duphandle() failed\n",
-            __FILE__, __LINE__);
-    res = CURLE_FAILED_INIT;
+    curl_mfprintf(stderr, "%s:%d curl_easy_duphandle() failed\n",
+                  __FILE__, __LINE__);
+    result = CURLE_FAILED_INIT;
     goto test_cleanup;
   }
 
-  res = curl_easy_getinfo(dupe, CURLINFO_SCHEME, &scheme);
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  result = curl_easy_getinfo(dupe, CURLINFO_SCHEME, &scheme);
+  if(result) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
   if(scheme) {
-    fprintf(stderr, "%s:%d scheme init failed; expected NULL\n",
-            __FILE__, __LINE__);
-    res = CURLE_FAILED_INIT;
+    curl_mfprintf(stderr, "%s:%d scheme init failed; expected NULL\n",
+                  __FILE__, __LINE__);
+    result = CURLE_FAILED_INIT;
     goto test_cleanup;
   }
 
-
   /* Test that a scheme is properly initialized on curl_easy_reset.
-  */
+   */
 
   curl_easy_reset(curl);
 
-  res = curl_easy_getinfo(curl, CURLINFO_SCHEME, &scheme);
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  result = curl_easy_getinfo(curl, CURLINFO_SCHEME, &scheme);
+  if(result) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_getinfo() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
   if(scheme) {
-    fprintf(stderr, "%s:%d scheme init failed; expected NULL\n",
-            __FILE__, __LINE__);
-    res = CURLE_FAILED_INIT;
+    curl_mfprintf(stderr, "%s:%d scheme init failed; expected NULL\n",
+                  __FILE__, __LINE__);
+    result = CURLE_FAILED_INIT;
     goto test_cleanup;
   }
 
@@ -127,5 +129,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_easy_cleanup(dupe);
   curl_global_cleanup();
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1537.c b/third-party/curl/tests/libtest/lib1537.c
index 21252fb790..1ef0be9c75 100644
--- a/third-party/curl/tests/libtest/lib1537.c
+++ b/third-party/curl/tests/libtest/lib1537.c
@@ -21,71 +21,69 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1537(const char *URL)
 {
-  const unsigned char a[] = {0x2f, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
-                             0x91, 0xa2, 0xb3, 0xc4, 0xd5, 0xe6, 0xf7};
-  CURLcode res = CURLE_OK;
+  const unsigned char a[] = { 0x2f, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
+                              0x91, 0xa2, 0xb3, 0xc4, 0xd5, 0xe6, 0xf7 };
+  CURLcode result = CURLE_OK;
   char *ptr = NULL;
   int asize;
   int outlen = 0;
   char *raw;
 
-  (void)URL; /* we don't use this */
+  (void)URL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   asize = (int)sizeof(a);
-  ptr = curl_easy_escape(NULL, (char *)a, asize);
-  printf("%s\n", ptr);
+  ptr = curl_easy_escape(NULL, (const char *)a, asize);
+  curl_mprintf("%s\n", ptr);
   curl_free(ptr);
 
   /* deprecated API */
-  ptr = curl_escape((char *)a, asize);
+  ptr = curl_escape((const char *)a, asize);
   if(!ptr) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  printf("%s\n", ptr);
+  curl_mprintf("%s\n", ptr);
 
   raw = curl_easy_unescape(NULL, ptr, (int)strlen(ptr), &outlen);
-  printf("outlen == %d\n", outlen);
-  printf("unescape == original? %s\n",
-         memcmp(raw, a, outlen) ? "no" : "YES");
+  curl_mprintf("outlen == %d\n", outlen);
+  curl_mprintf("unescape == original? %s\n",
+               memcmp(raw, a, outlen) ? "no" : "YES");
   curl_free(raw);
 
   /* deprecated API */
   raw = curl_unescape(ptr, (int)strlen(ptr));
   if(!raw) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
   outlen = (int)strlen(raw);
-  printf("[old] outlen == %d\n", outlen);
-  printf("[old] unescape == original? %s\n",
-         memcmp(raw, a, outlen) ? "no" : "YES");
+  curl_mprintf("[old] outlen == %d\n", outlen);
+  curl_mprintf("[old] unescape == original? %s\n",
+               memcmp(raw, a, outlen) ? "no" : "YES");
   curl_free(raw);
   curl_free(ptr);
 
   /* weird input length */
-  ptr = curl_easy_escape(NULL, (char *)a, -1);
-  printf("escape -1 length: %s\n", ptr);
+  ptr = curl_easy_escape(NULL, (const char *)a, -1);
+  curl_mprintf("escape -1 length: %s\n", ptr);
 
   /* weird input length */
-  outlen = 2017; /* just a value */
-  ptr = curl_easy_unescape(NULL, (char *)"moahahaha", -1, &outlen);
-  printf("unescape -1 length: %s %d\n", ptr, outlen);
+  outlen = 2017; /* an arbitrary value */
+  ptr = curl_easy_unescape(NULL, "moahahaha", -1, &outlen);
+  curl_mprintf("unescape -1 length: %s %d\n", ptr, outlen);
 
 test_cleanup:
   curl_free(ptr);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1538.c b/third-party/curl/tests/libtest/lib1538.c
index cd9e3f65c6..6433e571b7 100644
--- a/third-party/curl/tests/libtest/lib1538.c
+++ b/third-party/curl/tests/libtest/lib1538.c
@@ -21,19 +21,18 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1538(const char *URL)
 {
-  int res = 0;
+  CURLcode result = CURLE_OK;
   CURLcode easyret;
-  CURLMcode multiret;
+  CURLMcode mresult;
   CURLSHcode shareret;
   CURLUcode urlret;
   (void)URL;
 
+  /* NOLINTBEGIN(clang-analyzer-optin.core.EnumCastOutOfRange) */
   curl_easy_strerror((CURLcode)INT_MAX);
   curl_multi_strerror((CURLMcode)INT_MAX);
   curl_share_strerror((CURLSHcode)INT_MAX);
@@ -42,19 +41,19 @@ int test(char *URL)
   curl_multi_strerror((CURLMcode)-INT_MAX);
   curl_share_strerror((CURLSHcode)-INT_MAX);
   curl_url_strerror((CURLUcode)-INT_MAX);
+  /* NOLINTEND(clang-analyzer-optin.core.EnumCastOutOfRange) */
   for(easyret = CURLE_OK; easyret <= CURL_LAST; easyret++) {
-    printf("e%d: %s\n", (int)easyret, curl_easy_strerror(easyret));
+    curl_mprintf("e%d: %s\n", (int)easyret, curl_easy_strerror(easyret));
   }
-  for(multiret = CURLM_CALL_MULTI_PERFORM; multiret <= CURLM_LAST;
-      multiret++) {
-    printf("m%d: %s\n", (int)multiret, curl_multi_strerror(multiret));
+  for(mresult = CURLM_CALL_MULTI_PERFORM; mresult <= CURLM_LAST; mresult++) {
+    curl_mprintf("m%d: %s\n", mresult, curl_multi_strerror(mresult));
   }
   for(shareret = CURLSHE_OK; shareret <= CURLSHE_LAST; shareret++) {
-    printf("s%d: %s\n", (int)shareret, curl_share_strerror(shareret));
+    curl_mprintf("s%d: %s\n", (int)shareret, curl_share_strerror(shareret));
   }
   for(urlret = CURLUE_OK; urlret <= CURLUE_LAST; urlret++) {
-    printf("u%d: %s\n", (int)urlret, curl_url_strerror(urlret));
+    curl_mprintf("u%d: %s\n", (int)urlret, curl_url_strerror(urlret));
   }
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1540.c b/third-party/curl/tests/libtest/lib1540.c
index 8ea82a2634..b4fc49eb2b 100644
--- a/third-party/curl/tests/libtest/lib1540.c
+++ b/third-party/curl/tests/libtest/lib1540.c
@@ -21,14 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
+#include "testtrace.h"
 
-struct transfer_status {
-  CURL *easy;
+struct t1540_transfer_status {
+  CURL *curl;
   int halted;
   int counter; /* count write callback invokes */
   int please;  /* number of times xferinfo is called while halted */
@@ -40,7 +38,7 @@ static int please_continue(void *userp,
                            curl_off_t ultotal,
                            curl_off_t ulnow)
 {
-  struct transfer_status *st = (struct transfer_status *)userp;
+  struct t1540_transfer_status *st = (struct t1540_transfer_status *)userp;
   (void)dltotal;
   (void)dlnow;
   (void)ultotal;
@@ -49,15 +47,15 @@ static int please_continue(void *userp,
     st->please++;
     if(st->please == 2) {
       /* waited enough, unpause! */
-      curl_easy_pause(st->easy, CURLPAUSE_CONT);
+      curl_easy_pause(st->curl, CURLPAUSE_CONT);
     }
   }
-  fprintf(stderr, "xferinfo: paused %d\n", st->halted);
+  curl_mfprintf(stderr, "xferinfo: paused %d\n", st->halted);
   return 0; /* go on */
 }
 
-static size_t header_callback(void *ptr, size_t size, size_t nmemb,
-                              void *userp)
+static size_t t1540_header_callback(char *ptr, size_t size, size_t nmemb,
+                                    void *userp)
 {
   size_t len = size * nmemb;
   (void)userp;
@@ -65,9 +63,9 @@ static size_t header_callback(void *ptr, size_t size, size_t nmemb,
   return len;
 }
 
-static size_t write_callback(void *ptr, size_t size, size_t nmemb, void *userp)
+static size_t t1540_write_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
-  struct transfer_status *st = (struct transfer_status *)userp;
+  struct t1540_transfer_status *st = (struct t1540_transfer_status *)userp;
   size_t len = size * nmemb;
   st->counter++;
   if(st->counter > 1) {
@@ -76,17 +74,17 @@ static size_t write_callback(void *ptr, size_t size, size_t nmemb, void *userp)
     fwrite(ptr, size, nmemb, stdout);
     return len;
   }
-  printf("Got %d bytes but pausing!\n", (int)len);
+  if(len)
+    curl_mprintf("Got bytes but pausing!\n");
   st->halted = 1;
   return CURL_WRITEFUNC_PAUSE;
 }
 
-int test(char *URL)
+static CURLcode test_lib1540(const char *URL)
 {
-  CURL *curls = NULL;
-  int i = 0;
-  int res = 0;
-  struct transfer_status st;
+  CURL *curl = NULL;
+  CURLcode result = CURLE_OK;
+  struct t1540_transfer_status st;
 
   start_test_timing();
 
@@ -94,28 +92,31 @@ int test(char *URL)
 
   global_init(CURL_GLOBAL_ALL);
 
-  easy_init(curls);
-  st.easy = curls; /* to allow callbacks access */
+  easy_init(curl);
+  st.curl = curl; /* to allow callbacks access */
 
-  easy_setopt(curls, CURLOPT_URL, URL);
-  easy_setopt(curls, CURLOPT_WRITEFUNCTION, write_callback);
-  easy_setopt(curls, CURLOPT_WRITEDATA, &st);
-  easy_setopt(curls, CURLOPT_HEADERFUNCTION, header_callback);
-  easy_setopt(curls, CURLOPT_HEADERDATA, &st);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_WRITEFUNCTION, t1540_write_cb);
+  easy_setopt(curl, CURLOPT_WRITEDATA, &st);
+  easy_setopt(curl, CURLOPT_HEADERFUNCTION, t1540_header_callback);
+  easy_setopt(curl, CURLOPT_HEADERDATA, &st);
 
-  easy_setopt(curls, CURLOPT_XFERINFOFUNCTION, please_continue);
-  easy_setopt(curls, CURLOPT_XFERINFODATA, &st);
-  easy_setopt(curls, CURLOPT_NOPROGRESS, 0L);
+  easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, please_continue);
+  easy_setopt(curl, CURLOPT_XFERINFODATA, &st);
+  easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
 
-  res = curl_easy_perform(curls);
+  debug_config.nohex = TRUE;
+  debug_config.tracetime = TRUE;
+  easy_setopt(curl, CURLOPT_DEBUGDATA, &debug_config);
+  easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
-  curl_easy_cleanup(curls);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  if(res)
-    i = res;
-
-  return i; /* return the final return code */
+  return result; /* return the final return code */
 }
diff --git a/third-party/curl/tests/libtest/lib1541.c b/third-party/curl/tests/libtest/lib1541.c
index 7146288683..d6888dbb63 100644
--- a/third-party/curl/tests/libtest/lib1541.c
+++ b/third-party/curl/tests/libtest/lib1541.c
@@ -21,140 +21,127 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-/*
- * KNOW_BUGS "A shared connection cache is not thread-safe"
- *
- * This source code was used to verify shared connection cache but since this
- * is a known issue the test is no longer built or run. This code is here to
- * allow for testing once someone gets to work on fixing this.
- */
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#ifdef HAVE_PTHREAD_H
-#include <pthread.h>
-#include <time.h>
-
-/* number of threads to fire up in parallel */
-#define NUM_THREADS 67
-
-/* for how many seconds each thread will loop */
-#define RUN_FOR_SECONDS 7
-
-static pthread_mutex_t connlock;
-
-static size_t write_db(void *ptr, size_t size, size_t nmemb, void *data)
-{
-  /* not interested in the downloaded bytes, return the size */
-  (void)ptr;  /* unused */
-  (void)data; /* unused */
-  return (size_t)(size * nmemb);
-}
-
-static void lock_cb(CURL *handle, curl_lock_data data,
-                    curl_lock_access access, void *userptr)
-{
-  (void)access; /* unused */
-  (void)userptr; /* unused */
-  (void)handle; /* unused */
-  (void)data; /* unused */
-  pthread_mutex_lock(&connlock);
-}
-
-static void unlock_cb(CURL *handle, curl_lock_data data,
-                      void *userptr)
-{
-  (void)userptr; /* unused */
-  (void)handle;  /* unused */
-  (void)data;    /* unused */
-  pthread_mutex_unlock(&connlock);
-}
-
-static void init_locks(void)
-{
-  pthread_mutex_init(&connlock, NULL);
-}
-
-static void kill_locks(void)
-{
-  pthread_mutex_destroy(&connlock);
-}
-
-struct initurl {
-  const char *url;
-  CURLSH *share;
-  int threadno;
+struct t1541_transfer_status {
+  CURL *curl;
+  int hd_count;
+  int bd_count;
 };
 
-static void *run_thread(void *ptr)
+#define KN(a) a, #a
+
+static void t1541_geterr(const char *name, CURLcode val, int lineno)
 {
-  struct initurl *u = (struct initurl *)ptr;
-  int i;
-  time_t end = time(NULL) + RUN_FOR_SECONDS;
-
-  for(i = 0; time(NULL) < end; i++) {
-    CURL *curl = curl_easy_init();
-    curl_easy_setopt(curl, CURLOPT_URL, u->url);
-    curl_easy_setopt(curl, CURLOPT_VERBOSE, 0L);
-    curl_easy_setopt(curl, CURLOPT_SHARE, u->share);
-    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_db);
-    curl_easy_perform(curl); /* ignores error */
-    curl_easy_cleanup(curl);
-    fprintf(stderr, "Thread %d transfer %d\n", u->threadno, i);
-  }
-
-  return NULL;
+  curl_mprintf("CURLINFO_%s returned %d, \"%s\" on line %d\n",
+               name, (int)val, curl_easy_strerror(val), lineno);
 }
 
-int test(char *URL)
+static void report_time(const char *key, const char *where, curl_off_t time,
+                        bool ok)
 {
-  pthread_t tid[NUM_THREADS];
-  int i;
-  CURLSH *share;
-  struct initurl url[NUM_THREADS];
+  if(ok)
+    curl_mprintf("%s on %s is OK\n", key, where);
+  else
+    curl_mprintf("%s on %s is WRONG: %" CURL_FORMAT_CURL_OFF_T "\n",
+                 key, where, time);
+}
 
-  /* Must initialize libcurl before any threads are started */
-  curl_global_init(CURL_GLOBAL_ALL);
-
-  share = curl_share_init();
-  curl_share_setopt(share, CURLSHOPT_LOCKFUNC, lock_cb);
-  curl_share_setopt(share, CURLSHOPT_UNLOCKFUNC, unlock_cb);
-  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_CONNECT);
-
-  init_locks();
-
-  for(i = 0; i< NUM_THREADS; i++) {
-    int error;
-    url[i].url = URL;
-    url[i].share = share;
-    url[i].threadno = i;
-    error = pthread_create(&tid[i], NULL, run_thread, &url[i]);
-    if(0 != error)
-      fprintf(stderr, "Couldn't run thread number %d, errno %d\n", i, error);
-    else
-      fprintf(stderr, "Thread %d, gets %s\n", i, URL);
+static void check_time(CURL *curl, int key, const char *name,
+                       const char *where)
+{
+  curl_off_t tval;
+  CURLcode result = curl_easy_getinfo(curl, (CURLINFO)key, &tval);
+  if(result) {
+    t1541_geterr(name, result, __LINE__);
   }
+  else
+    report_time(name, where, tval, tval > 0);
+}
 
-  /* now wait for all threads to terminate */
-  for(i = 0; i< NUM_THREADS; i++) {
-    pthread_join(tid[i], NULL);
-    fprintf(stderr, "Thread %d terminated\n", i);
+static void check_time0(CURL *curl, int key, const char *name,
+                        const char *where)
+{
+  curl_off_t tval;
+  CURLcode result = curl_easy_getinfo(curl, (CURLINFO)key, &tval);
+  if(result) {
+    t1541_geterr(name, result, __LINE__);
   }
+  else
+    report_time(name, where, tval, !tval);
+}
 
-  kill_locks();
+static size_t t1541_header_callback(char *ptr, size_t size, size_t nmemb,
+                                    void *userp)
+{
+  struct t1541_transfer_status *st = (struct t1541_transfer_status *)userp;
+  size_t len = size * nmemb;
 
-  curl_share_cleanup(share);
+  (void)ptr;
+  if(!st->hd_count++) {
+    /* first header, check some CURLINFO value to be reported. See #13125 */
+    check_time(st->curl, KN(CURLINFO_CONNECT_TIME_T), "1st header");
+    check_time(st->curl, KN(CURLINFO_PRETRANSFER_TIME_T), "1st header");
+    check_time(st->curl, KN(CURLINFO_STARTTRANSFER_TIME_T), "1st header");
+    /* continuously updated */
+    check_time(st->curl, KN(CURLINFO_TOTAL_TIME_T), "1st header");
+    /* no SSL, must be 0 */
+    check_time0(st->curl, KN(CURLINFO_APPCONNECT_TIME_T), "1st header");
+    /* download not really started */
+    check_time0(st->curl, KN(CURLINFO_SPEED_DOWNLOAD_T), "1st header");
+  }
+  (void)fwrite(ptr, size, nmemb, stdout);
+  return len;
+}
+
+static size_t t1541_write_cb(char *ptr, size_t size, size_t nmemb, void *userp)
+{
+  struct t1541_transfer_status *st = (struct t1541_transfer_status *)userp;
+
+  (void)ptr;
+  (void)st;
+  fwrite(ptr, size, nmemb, stdout);
+  return size * nmemb;
+}
+
+static CURLcode test_lib1541(const char *URL)
+{
+  CURL *curl = NULL;
+  CURLcode result = CURLE_OK;
+  struct t1541_transfer_status st;
+
+  start_test_timing();
+
+  memset(&st, 0, sizeof(st));
+
+  global_init(CURL_GLOBAL_ALL);
+
+  easy_init(curl);
+  st.curl = curl; /* to allow callbacks access */
+
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_WRITEFUNCTION, t1541_write_cb);
+  easy_setopt(curl, CURLOPT_WRITEDATA, &st);
+  easy_setopt(curl, CURLOPT_HEADERFUNCTION, t1541_header_callback);
+  easy_setopt(curl, CURLOPT_HEADERDATA, &st);
+
+  easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
+
+  result = curl_easy_perform(curl);
+
+  check_time(curl, KN(CURLINFO_CONNECT_TIME_T), "done");
+  check_time(curl, KN(CURLINFO_PRETRANSFER_TIME_T), "done");
+  check_time(curl, KN(CURLINFO_POSTTRANSFER_TIME_T), "done");
+  check_time(curl, KN(CURLINFO_STARTTRANSFER_TIME_T), "done");
+  /* no SSL, must be 0 */
+  check_time0(curl, KN(CURLINFO_APPCONNECT_TIME_T), "done");
+  check_time(curl, KN(CURLINFO_SPEED_DOWNLOAD_T), "done");
+  check_time(curl, KN(CURLINFO_TOTAL_TIME_T), "done");
+
+test_cleanup:
+
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
-  return 0;
-}
 
-#else /* without pthread, this test doesn't work */
-int test(char *URL)
-{
-  (void)URL;
-  return 0;
+  return result; /* return the final return code */
 }
-#endif
diff --git a/third-party/curl/tests/libtest/lib1542.c b/third-party/curl/tests/libtest/lib1542.c
index 2570ea3cf6..2ea59a5cb3 100644
--- a/third-party/curl/tests/libtest/lib1542.c
+++ b/third-party/curl/tests/libtest/lib1542.c
@@ -30,55 +30,53 @@
  * first connection and open a second.
  */
 
-#include "test.h"
-#include "testutil.h"
-#include "testtrace.h"
-#include "warnless.h"
-#include "memdebug.h"
+#include "first.h"
 
-int test(char *URL)
+#include "testtrace.h"
+
+static CURLcode test_lib1542(const char *URL)
 {
-  CURL *easy = NULL;
-  int res = 0;
+  CURL *curl = NULL;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
 
-  res_easy_init(easy);
+  res_easy_init(curl);
 
-  easy_setopt(easy, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
-  libtest_debug_config.nohex = 1;
-  libtest_debug_config.tracetime = 0;
-  easy_setopt(easy, CURLOPT_DEBUGDATA, &libtest_debug_config);
-  easy_setopt(easy, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
-  easy_setopt(easy, CURLOPT_VERBOSE, 1L);
+  debug_config.nohex = TRUE;
+  debug_config.tracetime = FALSE;
+  easy_setopt(curl, CURLOPT_DEBUGDATA, &debug_config);
+  easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  res = curl_easy_perform(easy);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
-  res = curl_easy_perform(easy);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
   /* CURLOPT_MAXLIFETIME_CONN is inclusive - the connection needs to be 2
    * seconds old */
-  sleep(2);
+  curlx_wait_ms(2000);
 
-  res = curl_easy_perform(easy);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
-  easy_setopt(easy, CURLOPT_MAXLIFETIME_CONN, 1L);
+  easy_setopt(curl, CURLOPT_MAXLIFETIME_CONN, 1L);
 
-  res = curl_easy_perform(easy);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
 test_cleanup:
 
-  curl_easy_cleanup(easy);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1545.c b/third-party/curl/tests/libtest/lib1545.c
new file mode 100644
index 0000000000..979bec8b02
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1545.c
@@ -0,0 +1,52 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static CURLcode test_lib1545(const char *URL)
+{
+  CURL *curl = NULL;
+  CURLcode result = CURLE_OK;
+  struct curl_httppost *lastptr = NULL;
+  struct curl_httppost *m_formpost = NULL;
+
+  global_init(CURL_GLOBAL_ALL);
+
+  easy_init(curl);
+
+  easy_setopt(curl, CURLOPT_URL, URL);
+  curl_formadd(&m_formpost, &lastptr, CURLFORM_COPYNAME, "file",
+               CURLFORM_FILE, "missing-file", CURLFORM_END);
+  curl_easy_setopt(curl, CURLOPT_HTTPPOST, m_formpost);
+
+  (void)curl_easy_perform(curl);
+  (void)curl_easy_perform(curl);
+
+test_cleanup:
+
+  curl_formfree(m_formpost);
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1549.c b/third-party/curl/tests/libtest/lib1549.c
new file mode 100644
index 0000000000..e004546f58
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1549.c
@@ -0,0 +1,75 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#include "testtrace.h"
+
+static CURLcode test_lib1549(const char *URL)
+{
+  CURLcode result;
+  CURL *curl;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_COOKIEFILE, "");
+
+  result = curl_easy_perform(curl);
+
+  if(!result) {
+    /* extract all known cookies */
+    struct curl_slist *cookies = NULL;
+    int num = 0;
+    result = curl_easy_getinfo(curl, CURLINFO_COOKIELIST, &cookies);
+    if(!result && cookies) {
+      /* a linked list of cookies in cookie file format */
+      struct curl_slist *each = cookies;
+      while(each) {
+        curl_mprintf("%s\n", each->data);
+        each = each->next;
+        num++;
+      }
+      /* we must free these cookies when we are done */
+      curl_slist_free_all(cookies);
+    }
+    curl_mfprintf(stderr, "%d cookies\n", num);
+  }
+test_cleanup:
+
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1550.c b/third-party/curl/tests/libtest/lib1550.c
index 4c34be8657..8de7b84669 100644
--- a/third-party/curl/tests/libtest/lib1550.c
+++ b/third-party/curl/tests/libtest/lib1550.c
@@ -21,28 +21,26 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "memdebug.h"
+#include "first.h"
 
 #include <curl/multi.h>
 
-int test(char *URL)
+static CURLcode test_lib1550(const char *URL)
 {
-  CURLM *handle;
-  int res = CURLE_OK;
+  CURLM *multi;
+  CURLcode result = CURLE_OK;
   static const char * const bl_servers[] =
-     {"Microsoft-IIS/6.0", "nginx/0.8.54", NULL};
+     { "Microsoft-IIS/6.0", "nginx/0.8.54", NULL };
   static const char * const bl_sites[] =
-     {"curl.se:443", "example.com:80", NULL};
+     { "curl.se:443", "example.com:80", NULL };
 
   global_init(CURL_GLOBAL_ALL);
-  handle = curl_multi_init();
-  (void)URL; /* unused */
+  multi = curl_multi_init();
+  (void)URL;
 
-  curl_multi_setopt(handle, CURLMOPT_PIPELINING_SERVER_BL, bl_servers);
-  curl_multi_setopt(handle, CURLMOPT_PIPELINING_SITE_BL, bl_sites);
-  curl_multi_cleanup(handle);
+  curl_multi_setopt(multi, CURLMOPT_PIPELINING_SERVER_BL, bl_servers);
+  curl_multi_setopt(multi, CURLMOPT_PIPELINING_SITE_BL, bl_sites);
+  curl_multi_cleanup(multi);
   curl_global_cleanup();
-  return 0;
+  return CURLE_OK;
 }
diff --git a/third-party/curl/tests/libtest/lib1551.c b/third-party/curl/tests/libtest/lib1551.c
index f693cb1fd1..b8e460748e 100644
--- a/third-party/curl/tests/libtest/lib1551.c
+++ b/third-party/curl/tests/libtest/lib1551.c
@@ -21,16 +21,14 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "memdebug.h"
+#include "first.h"
 
 #include <curl/multi.h>
 
-int test(char *URL)
+static CURLcode test_lib1551(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
   curl = curl_easy_init();
@@ -38,12 +36,16 @@ int test(char *URL)
     curl_easy_setopt(curl, CURLOPT_URL, URL);
     curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
-    res = curl_easy_perform(curl);
+    result = curl_easy_perform(curl);
+    if(result)
+      goto test_cleanup;
 
-    fprintf(stderr, "****************************** Do it again\n");
-    res = curl_easy_perform(curl);
-    curl_easy_cleanup(curl);
+    curl_mfprintf(stderr, "****************************** Do it again\n");
+    result = curl_easy_perform(curl);
   }
+
+test_cleanup:
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1552.c b/third-party/curl/tests/libtest/lib1552.c
index c48d640d62..bf70452f6c 100644
--- a/third-party/curl/tests/libtest/lib1552.c
+++ b/third-party/curl/tests/libtest/lib1552.c
@@ -21,21 +21,15 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
-
-int test(char *URL)
+static CURLcode test_lib1552(const char *URL)
 {
-  CURL *curls = NULL;
+  CURL *curl = NULL;
   CURLM *multi = NULL;
   int still_running;
-  int i = 0;
-  int res = 0;
+  CURLcode i = CURLE_OK;
+  CURLcode result = CURLE_OK;
   CURLMsg *msg;
   int counter = 3;
 
@@ -45,25 +39,26 @@ int test(char *URL)
 
   multi_init(multi);
 
-  easy_init(curls);
+  easy_init(curl);
 
-  easy_setopt(curls, CURLOPT_URL, URL);
-  easy_setopt(curls, CURLOPT_HEADER, 1L);
-  easy_setopt(curls, CURLOPT_VERBOSE, 1L);
-  easy_setopt(curls, CURLOPT_USERPWD, "u:s");
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_USERPWD, "u:s");
 
-  multi_add_handle(multi, curls);
+  multi_add_handle(multi, curl);
 
   multi_perform(multi, &still_running);
 
   abort_on_test_timeout();
 
   while(still_running && counter--) {
+    CURLMcode mresult;
     int num;
-    res = curl_multi_wait(multi, NULL, 0, TEST_HANG_TIMEOUT, &num);
-    if(res != CURLM_OK) {
-      printf("curl_multi_wait() returned %d\n", res);
-      res = TEST_ERR_MAJOR_BAD;
+    mresult = curl_multi_wait(multi, NULL, 0, TEST_HANG_TIMEOUT, &num);
+    if(mresult != CURLM_OK) {
+      curl_mprintf("curl_multi_wait() returned %d\n", mresult);
+      result = TEST_ERR_MAJOR_BAD;
       goto test_cleanup;
     }
 
@@ -85,11 +80,11 @@ test_cleanup:
   /* undocumented cleanup sequence - type UA */
 
   curl_multi_cleanup(multi);
-  curl_easy_cleanup(curls);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  if(res)
-    i = res;
+  if(result)
+    i = result;
 
   return i; /* return the final return code */
 }
diff --git a/third-party/curl/tests/libtest/lib1553.c b/third-party/curl/tests/libtest/lib1553.c
index 8bf15684bd..8aa2b1a153 100644
--- a/third-party/curl/tests/libtest/lib1553.c
+++ b/third-party/curl/tests/libtest/lib1553.c
@@ -21,34 +21,30 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
+#include "testtrace.h"
 
-#define TEST_HANG_TIMEOUT 60 * 1000
-
-static int xferinfo(void *p,
-                    curl_off_t dltotal, curl_off_t dlnow,
-                    curl_off_t ultotal, curl_off_t ulnow)
+static int t1553_xferinfo(void *p,
+                          curl_off_t dltotal, curl_off_t dlnow,
+                          curl_off_t ultotal, curl_off_t ulnow)
 {
   (void)p;
   (void)dlnow;
   (void)dltotal;
   (void)ulnow;
   (void)ultotal;
-  fprintf(stderr, "xferinfo fail!\n");
+  curl_mfprintf(stderr, "xferinfo fail!\n");
   return 1; /* fail as fast as we can */
 }
 
-int test(char *URL)
+static CURLcode test_lib1553(const char *URL)
 {
-  CURL *curls = NULL;
+  CURL *curl = NULL;
   CURLM *multi = NULL;
   int still_running;
-  int i = 0;
-  int res = 0;
+  CURLcode i = CURLE_OK;
+  CURLcode result = CURLE_OK;
   curl_mimepart *field = NULL;
   curl_mime *mime = NULL;
   int counter = 1;
@@ -59,33 +55,40 @@ int test(char *URL)
 
   multi_init(multi);
 
-  easy_init(curls);
+  easy_init(curl);
 
-  mime = curl_mime_init(curls);
+  mime = curl_mime_init(curl);
   field = curl_mime_addpart(mime);
   curl_mime_name(field, "name");
   curl_mime_data(field, "value", CURL_ZERO_TERMINATED);
 
-  easy_setopt(curls, CURLOPT_URL, URL);
-  easy_setopt(curls, CURLOPT_HEADER, 1L);
-  easy_setopt(curls, CURLOPT_VERBOSE, 1L);
-  easy_setopt(curls, CURLOPT_MIMEPOST, mime);
-  easy_setopt(curls, CURLOPT_USERPWD, "u:s");
-  easy_setopt(curls, CURLOPT_XFERINFOFUNCTION, xferinfo);
-  easy_setopt(curls, CURLOPT_NOPROGRESS, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_MIMEPOST, mime);
+  easy_setopt(curl, CURLOPT_USERPWD, "u:s");
+  easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, t1553_xferinfo);
+  easy_setopt(curl, CURLOPT_NOPROGRESS, 1L);
 
-  multi_add_handle(multi, curls);
+  debug_config.nohex = TRUE;
+  debug_config.tracetime = TRUE;
+  easy_setopt(curl, CURLOPT_DEBUGDATA, &debug_config);
+  easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+  multi_add_handle(multi, curl);
 
   multi_perform(multi, &still_running);
 
   abort_on_test_timeout();
 
   while(still_running && counter--) {
+    CURLMcode mresult;
     int num;
-    res = curl_multi_wait(multi, NULL, 0, TEST_HANG_TIMEOUT, &num);
-    if(res != CURLM_OK) {
-      printf("curl_multi_wait() returned %d\n", res);
-      res = TEST_ERR_MAJOR_BAD;
+    mresult = curl_multi_wait(multi, NULL, 0, TEST_HANG_TIMEOUT, &num);
+    if(mresult != CURLM_OK) {
+      curl_mprintf("curl_multi_wait() returned %d\n", mresult);
+      result = TEST_ERR_MAJOR_BAD;
       goto test_cleanup;
     }
 
@@ -99,13 +102,13 @@ int test(char *URL)
 test_cleanup:
 
   curl_mime_free(mime);
-  curl_multi_remove_handle(multi, curls);
+  curl_multi_remove_handle(multi, curl);
   curl_multi_cleanup(multi);
-  curl_easy_cleanup(curls);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  if(res)
-    i = res;
+  if(result)
+    i = result;
 
   return i; /* return the final return code */
 }
diff --git a/third-party/curl/tests/libtest/lib1554.c b/third-party/curl/tests/libtest/lib1554.c
index b0e94b8fba..8b37374c5a 100644
--- a/third-party/curl/tests/libtest/lib1554.c
+++ b/third-party/curl/tests/libtest/lib1554.c
@@ -21,49 +21,59 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-#include "memdebug.h"
+#include "first.h"
 
-static void my_lock(CURL *handle, curl_lock_data data,
-                    curl_lock_access laccess, void *useptr)
+static const char *ldata_names[] = {
+  "NONE",
+  "SHARE",
+  "COOKIE",
+  "DNS",
+  "SESSION",
+  "CONNECT",
+  "PSL",
+  "HSTS",
+  "NULL",
+};
+
+static void t1554_test_lock(CURL *curl, curl_lock_data data,
+                            curl_lock_access laccess, void *useptr)
 {
-  (void)handle;
+  (void)curl;
   (void)data;
   (void)laccess;
   (void)useptr;
-  printf("-> Mutex lock\n");
+  curl_mprintf("-] Mutex lock %s\n", ldata_names[data]);
 }
 
-static void my_unlock(CURL *handle, curl_lock_data data, void *useptr)
+static void t1554_test_unlock(CURL *curl, curl_lock_data data, void *useptr)
 {
-  (void)handle;
+  (void)curl;
   (void)data;
   (void)useptr;
-  printf("<- Mutex unlock\n");
+  curl_mprintf("[- Mutex unlock %s\n", ldata_names[data]);
 }
 
 /* test function */
-int test(char *URL)
+static CURLcode test_lib1554(const char *URL)
 {
-  CURLcode res = CURLE_OK;
-  CURLSH *share;
+  CURLcode result = CURLE_OK;
+  CURLSH *share = NULL;
   int i;
 
   global_init(CURL_GLOBAL_ALL);
 
   share = curl_share_init();
   if(!share) {
-    fprintf(stderr, "curl_share_init() failed\n");
-    curl_global_cleanup();
-    return TEST_ERR_MAJOR_BAD;
+    curl_mfprintf(stderr, "curl_share_init() failed\n");
+    goto test_cleanup;
   }
 
   curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_CONNECT);
-  curl_share_setopt(share, CURLSHOPT_LOCKFUNC, my_lock);
-  curl_share_setopt(share, CURLSHOPT_UNLOCKFUNC, my_unlock);
+  curl_share_setopt(share, CURLSHOPT_LOCKFUNC, t1554_test_lock);
+  curl_share_setopt(share, CURLSHOPT_UNLOCKFUNC, t1554_test_unlock);
 
-  /* Loop the transfer and cleanup the handle properly every lap. This will
-     still reuse connections since the pool is in the shared object! */
+  /* Loop the transfer and cleanup the handle properly every lap. This
+     still reuses connections since the pool is in the shared object! */
 
   for(i = 0; i < 3; i++) {
     CURL *curl = curl_easy_init();
@@ -73,20 +83,24 @@ int test(char *URL)
       /* use the share object */
       curl_easy_setopt(curl, CURLOPT_SHARE, share);
 
-      /* Perform the request, res will get the return code */
-      res = curl_easy_perform(curl);
-      /* Check for errors */
-      if(res != CURLE_OK)
-        fprintf(stderr, "curl_easy_perform() failed: %s\n",
-                curl_easy_strerror(res));
+      /* Perform the request, result gets the return code */
+      result = curl_easy_perform(curl);
 
       /* always cleanup */
       curl_easy_cleanup(curl);
+
+      /* Check for errors */
+      if(result != CURLE_OK) {
+        curl_mfprintf(stderr, "curl_easy_perform() failed: %s\n",
+                      curl_easy_strerror(result));
+        goto test_cleanup;
+      }
     }
   }
 
+test_cleanup:
   curl_share_cleanup(share);
   curl_global_cleanup();
 
-  return 0;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1555.c b/third-party/curl/tests/libtest/lib1555.c
index 1ff6f28d57..c6c806426a 100644
--- a/third-party/curl/tests/libtest/lib1555.c
+++ b/third-party/curl/tests/libtest/lib1555.c
@@ -25,11 +25,9 @@
  * Verify that some API functions are locked from being called inside callback
  */
 
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static CURL *curl;
+static CURL *t1555_curl;
 
 static int progressCallback(void *arg,
                             double dltotal,
@@ -37,7 +35,7 @@ static int progressCallback(void *arg,
                             double ultotal,
                             double ulnow)
 {
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
   char buffer[256];
   size_t n = 0;
   (void)arg;
@@ -45,39 +43,37 @@ static int progressCallback(void *arg,
   (void)dlnow;
   (void)ultotal;
   (void)ulnow;
-  res = curl_easy_recv(curl, buffer, 256, &n);
-  printf("curl_easy_recv returned %d\n", res);
-  res = curl_easy_send(curl, buffer, n, &n);
-  printf("curl_easy_send returned %d\n", res);
+  result = curl_easy_recv(t1555_curl, buffer, 256, &n);
+  curl_mprintf("curl_easy_recv returned %d\n", (int)result);
+  result = curl_easy_send(t1555_curl, buffer, n, &n);
+  curl_mprintf("curl_easy_send returned %d\n", (int)result);
 
   return 1;
 }
 
-int test(char *URL)
+static CURLcode test_lib1555(const char *URL)
 {
-  int res = 0;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
 
-  easy_init(curl);
+  easy_init(t1555_curl);
 
-  easy_setopt(curl, CURLOPT_URL, URL);
-  easy_setopt(curl, CURLOPT_TIMEOUT, (long)7);
-  easy_setopt(curl, CURLOPT_NOSIGNAL, (long)1);
-  CURL_IGNORE_DEPRECATION(
-    easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, progressCallback);
-    easy_setopt(curl, CURLOPT_PROGRESSDATA, NULL);
-  )
-  easy_setopt(curl, CURLOPT_NOPROGRESS, (long)0);
+  easy_setopt(t1555_curl, CURLOPT_URL, URL);
+  easy_setopt(t1555_curl, CURLOPT_TIMEOUT, 7L);
+  easy_setopt(t1555_curl, CURLOPT_NOSIGNAL, 1L);
+  easy_setopt(t1555_curl, CURLOPT_PROGRESSFUNCTION, progressCallback);
+  easy_setopt(t1555_curl, CURLOPT_PROGRESSDATA, NULL);
+  easy_setopt(t1555_curl, CURLOPT_NOPROGRESS, 0L);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(t1555_curl);
 
 test_cleanup:
 
   /* undocumented cleanup sequence - type UA */
 
-  curl_easy_cleanup(curl);
+  curl_easy_cleanup(t1555_curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1556.c b/third-party/curl/tests/libtest/lib1556.c
index 6f8a214391..201ea4b159 100644
--- a/third-party/curl/tests/libtest/lib1556.c
+++ b/third-party/curl/tests/libtest/lib1556.c
@@ -21,17 +21,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
+#include "first.h"
 
 struct headerinfo {
   size_t largest;
 };
 
-static size_t header(void *ptr, size_t size, size_t nmemb, void *stream)
+static size_t header(char *ptr, size_t size, size_t nmemb, void *stream)
 {
   size_t headersize = size * nmemb;
   struct headerinfo *info = (struct headerinfo *)stream;
@@ -44,12 +40,12 @@ static size_t header(void *ptr, size_t size, size_t nmemb, void *stream)
   return nmemb * size;
 }
 
-int test(char *URL)
+static CURLcode test_lib1556(const char *URL)
 {
-  CURLcode code;
   CURL *curl = NULL;
-  int res = 0;
-  struct headerinfo info = {0};
+  CURLcode code;
+  CURLcode result = CURLE_OK;
+  struct headerinfo info = { 0 };
 
   global_init(CURL_GLOBAL_ALL);
 
@@ -61,20 +57,20 @@ int test(char *URL)
   easy_setopt(curl, CURLOPT_URL, URL);
 
   code = curl_easy_perform(curl);
-  if(CURLE_OK != code) {
-    fprintf(stderr, "%s:%d curl_easy_perform() failed, "
-            "with code %d (%s)\n",
-            __FILE__, __LINE__, (int)code, curl_easy_strerror(code));
-    res = TEST_ERR_MAJOR_BAD;
+  if(code != CURLE_OK) {
+    curl_mfprintf(stderr, "%s:%d curl_easy_perform() failed, "
+                  "with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)code, curl_easy_strerror(code));
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
 
-  printf("Max = %ld\n", (long)info.largest);
+  curl_mprintf("Max = %zu\n", info.largest);
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1557.c b/third-party/curl/tests/libtest/lib1557.c
index 2fa34ada37..e94941934a 100644
--- a/third-party/curl/tests/libtest/lib1557.c
+++ b/third-party/curl/tests/libtest/lib1557.c
@@ -21,44 +21,40 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1557(const char *URL)
 {
-  CURLM *curlm = NULL;
+  CURLM *multi = NULL;
   CURL *curl1 = NULL;
   CURL *curl2 = NULL;
   int running_handles = 0;
-  int res = 0;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
 
-  multi_init(curlm);
-  multi_setopt(curlm, CURLMOPT_MAX_HOST_CONNECTIONS, 1);
+  multi_init(multi);
+  multi_setopt(multi, CURLMOPT_MAX_HOST_CONNECTIONS, 1L);
 
   easy_init(curl1);
   easy_setopt(curl1, CURLOPT_URL, URL);
-  multi_add_handle(curlm, curl1);
+  multi_add_handle(multi, curl1);
 
   easy_init(curl2);
   easy_setopt(curl2, CURLOPT_URL, URL);
-  multi_add_handle(curlm, curl2);
+  multi_add_handle(multi, curl2);
 
-  multi_perform(curlm, &running_handles);
+  multi_perform(multi, &running_handles);
 
-  multi_remove_handle(curlm, curl2);
+  multi_remove_handle(multi, curl2);
 
-  /* If curl2 is still in the connect-pending list, this will crash */
-  multi_remove_handle(curlm, curl1);
+  /* If curl2 is still in the connect-pending list, this crashes */
+  multi_remove_handle(multi, curl1);
 
 test_cleanup:
   curl_easy_cleanup(curl1);
   curl_easy_cleanup(curl2);
-  curl_multi_cleanup(curlm);
+  curl_multi_cleanup(multi);
   curl_global_cleanup();
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1558.c b/third-party/curl/tests/libtest/lib1558.c
index d64b59801a..0832f8b1c5 100644
--- a/third-party/curl/tests/libtest/lib1558.c
+++ b/third-party/curl/tests/libtest/lib1558.c
@@ -21,15 +21,11 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1558(const char *URL)
 {
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
   CURL *curl = NULL;
   long protocol = 0;
 
@@ -37,33 +33,31 @@ int test(char *URL)
   easy_init(curl);
 
   easy_setopt(curl, CURLOPT_URL, URL);
-  res = curl_easy_perform(curl);
-  if(res) {
-    fprintf(stderr, "curl_easy_perform() returned %d (%s)\n",
-            res, curl_easy_strerror(res));
+  result = curl_easy_perform(curl);
+  if(result) {
+    curl_mfprintf(stderr, "curl_easy_perform() returned %d (%s)\n",
+                  (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
 
-  CURL_IGNORE_DEPRECATION(
-    res = curl_easy_getinfo(curl, CURLINFO_PROTOCOL, &protocol);
-  )
-  if(res) {
-    fprintf(stderr, "curl_easy_getinfo() returned %d (%s)\n",
-            res, curl_easy_strerror(res));
+  result = curl_easy_getinfo(curl, CURLINFO_PROTOCOL, &protocol);
+  if(result) {
+    curl_mfprintf(stderr, "curl_easy_getinfo() returned %d (%s)\n",
+                  (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
 
-  printf("Protocol: %lx\n", protocol);
+  curl_mprintf("Protocol: %lx\n", (unsigned long)protocol);
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return 0;
+  return CURLE_OK;
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res; /* return the final return code */
+  return result; /* return the final return code */
 }
diff --git a/third-party/curl/tests/libtest/lib1559.c b/third-party/curl/tests/libtest/lib1559.c
index 402fee3d05..951b5db234 100644
--- a/third-party/curl/tests/libtest/lib1559.c
+++ b/third-party/curl/tests/libtest/lib1559.c
@@ -21,56 +21,56 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define EXCESSIVE 10*1000*1000
-int test(char *URL)
+static CURLcode test_lib1559(const char *URL)
 {
-  CURLcode res = CURLE_OK;
+  static const int EXCESSIVE = 10 * 1000 * 1000;
+
+  CURLcode result = CURLE_OK;
   CURL *curl = NULL;
-  char *longurl = malloc(EXCESSIVE);
+  char *longurl = NULL;
   CURLU *u;
   (void)URL;
 
-  if(!longurl)
-    return 1;
-
-  memset(longurl, 'a', EXCESSIVE);
-  longurl[EXCESSIVE-1] = 0;
-
   global_init(CURL_GLOBAL_ALL);
   easy_init(curl);
 
-  res = curl_easy_setopt(curl, CURLOPT_URL, longurl);
-  printf("CURLOPT_URL %d bytes URL == %d\n",
-         EXCESSIVE, (int)res);
+  longurl = curlx_malloc(EXCESSIVE);
+  if(!longurl) {
+    result = TEST_ERR_MAJOR_BAD;
+    goto test_cleanup;
+  }
 
-  res = curl_easy_setopt(curl, CURLOPT_POSTFIELDS, longurl);
-  printf("CURLOPT_POSTFIELDS %d bytes data == %d\n",
-         EXCESSIVE, (int)res);
+  memset(longurl, 'a', EXCESSIVE);
+  longurl[EXCESSIVE - 1] = 0;
+
+  result = curl_easy_setopt(curl, CURLOPT_URL, longurl);
+  curl_mprintf("CURLOPT_URL %d bytes URL == %d\n",
+               EXCESSIVE, (int)result);
+
+  result = curl_easy_setopt(curl, CURLOPT_POSTFIELDS, longurl);
+  curl_mprintf("CURLOPT_POSTFIELDS %d bytes data == %d\n",
+               EXCESSIVE, (int)result);
 
   u = curl_url();
   if(u) {
     CURLUcode uc = curl_url_set(u, CURLUPART_URL, longurl, 0);
-    printf("CURLUPART_URL %d bytes URL == %d (%s)\n",
-           EXCESSIVE, (int)uc, curl_url_strerror(uc));
+    curl_mprintf("CURLUPART_URL %d bytes URL == %d (%s)\n",
+                 EXCESSIVE, (int)uc, curl_url_strerror(uc));
     uc = curl_url_set(u, CURLUPART_SCHEME, longurl, CURLU_NON_SUPPORT_SCHEME);
-    printf("CURLUPART_SCHEME %d bytes scheme == %d (%s)\n",
-           EXCESSIVE, (int)uc, curl_url_strerror(uc));
+    curl_mprintf("CURLUPART_SCHEME %d bytes scheme == %d (%s)\n",
+                 EXCESSIVE, (int)uc, curl_url_strerror(uc));
     uc = curl_url_set(u, CURLUPART_USER, longurl, 0);
-    printf("CURLUPART_USER %d bytes user == %d (%s)\n",
-           EXCESSIVE, (int)uc, curl_url_strerror(uc));
+    curl_mprintf("CURLUPART_USER %d bytes user == %d (%s)\n",
+                 EXCESSIVE, (int)uc, curl_url_strerror(uc));
     curl_url_cleanup(u);
   }
 
 test_cleanup:
-  free(longurl);
+  curlx_free(longurl);
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res; /* return the final return code */
+  return result; /* return the final return code */
 }
diff --git a/third-party/curl/tests/libtest/lib1560.c b/third-party/curl/tests/libtest/lib1560.c
index 2843b41c11..d4274bfb3e 100644
--- a/third-party/curl/tests/libtest/lib1560.c
+++ b/third-party/curl/tests/libtest/lib1560.c
@@ -27,24 +27,14 @@
  *
  * Since the URL parser by default only accepts schemes that *this instance*
  * of libcurl supports, make sure that the test1560 file lists all the schemes
- * that this test will assume to be present!
+ * that this test assumes to be present!
  */
 
-#include "test.h"
-#if defined(USE_LIBIDN2) || defined(USE_WIN32_IDN)
+#include "first.h"
+#if defined(USE_LIBIDN2) || defined(USE_WIN32_IDN) || defined(USE_APPLE_IDN)
 #define USE_IDN
 #endif
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h" /* LAST include file */
-
-struct part {
-  CURLUPart part;
-  const char *name;
-};
-
-
 static int checkparts(CURLU *u, const char *in, const char *wanted,
                       unsigned int getflags)
 {
@@ -53,37 +43,49 @@ static int checkparts(CURLU *u, const char *in, const char *wanted,
   char buf[256];
   char *bufp = &buf[0];
   size_t len = sizeof(buf);
+
+  struct part {
+    CURLUPart part;
+    const char *name;
+  };
+
   struct part parts[] = {
-    {CURLUPART_SCHEME, "scheme"},
-    {CURLUPART_USER, "user"},
-    {CURLUPART_PASSWORD, "password"},
-    {CURLUPART_OPTIONS, "options"},
-    {CURLUPART_HOST, "host"},
-    {CURLUPART_PORT, "port"},
-    {CURLUPART_PATH, "path"},
-    {CURLUPART_QUERY, "query"},
-    {CURLUPART_FRAGMENT, "fragment"},
-    {CURLUPART_URL, NULL}
+    { CURLUPART_SCHEME, "scheme" },
+    { CURLUPART_USER, "user" },
+    { CURLUPART_PASSWORD, "password" },
+    { CURLUPART_OPTIONS, "options" },
+    { CURLUPART_HOST, "host" },
+    { CURLUPART_PORT, "port" },
+    { CURLUPART_PATH, "path" },
+    { CURLUPART_QUERY, "query" },
+    { CURLUPART_FRAGMENT, "fragment" },
+    { CURLUPART_URL, NULL }
   };
   memset(buf, 0, sizeof(buf));
 
   for(i = 0; parts[i].name; i++) {
     char *p = NULL;
+    char *z = NULL;
     size_t n;
     rc = curl_url_get(u, parts[i].part, &p, getflags);
     if(!rc && p) {
-      msnprintf(bufp, len, "%s%s", buf[0]?" | ":"", p);
+      if((parts[i].part == CURLUPART_HOST) && (p[0] == '['))
+        /* an IPv6 numerical address host, get the zone */
+        (void)curl_url_get(u, CURLUPART_ZONEID, &z, getflags);
+      curl_msnprintf(bufp, len, "%s%s%s%s", buf[0] ? " | " : "", p,
+                     z ? " " : "", z ? z : "");
     }
     else
-      msnprintf(bufp, len, "%s[%d]", buf[0]?" | ":"", (int)rc);
+      curl_msnprintf(bufp, len, "%s[%d]", buf[0] ? " | " : "", (int)rc);
 
     n = strlen(bufp);
     bufp += n;
     len -= n;
     curl_free(p);
+    curl_free(z);
   }
   if(strcmp(buf, wanted)) {
-    fprintf(stderr, "in: %s\nwanted: %s\ngot:    %s\n", in, wanted, buf);
+    curl_mfprintf(stderr, "in: %s\nwanted: %s\ngot:    %s\n", in, wanted, buf);
     return 1;
   }
   return 0;
@@ -150,62 +152,172 @@ struct clearurlcase {
   CURLUcode ucode;
 };
 
-static const struct testcase get_parts_list[] ={
-  {"", "", 0, 0, CURLUE_MALFORMED_INPUT},
-  {" ", "", 0, 0, CURLUE_MALFORMED_INPUT},
-  {"1h://example.net", "", 0, 0, CURLUE_BAD_SCHEME},
-  {"..://example.net", "", 0, 0, CURLUE_BAD_SCHEME},
-  {"-ht://example.net", "", 0, 0, CURLUE_BAD_SCHEME},
-  {"+ftp://example.net", "", 0, 0, CURLUE_BAD_SCHEME},
-  {"hej.hej://example.net",
-   "hej.hej | [11] | [12] | [13] | example.net | [15] | / | [16] | [17]",
-   CURLU_NON_SUPPORT_SCHEME, 0, CURLUE_OK},
-  {"ht-tp://example.net",
-   "ht-tp | [11] | [12] | [13] | example.net | [15] | / | [16] | [17]",
-   CURLU_NON_SUPPORT_SCHEME, 0, CURLUE_OK},
-  {"ftp+more://example.net",
-   "ftp+more | [11] | [12] | [13] | example.net | [15] | / | [16] | [17]",
-   CURLU_NON_SUPPORT_SCHEME, 0, CURLUE_OK},
-  {"f1337://example.net",
-   "f1337 | [11] | [12] | [13] | example.net | [15] | / | [16] | [17]",
-   CURLU_NON_SUPPORT_SCHEME, 0, CURLUE_OK},
-  {"https://user@example.net?hello# space ",
-   "https | user | [12] | [13] | example.net | [15] | / | hello | %20space%20",
-   CURLU_ALLOW_SPACE|CURLU_URLENCODE, 0, CURLUE_OK},
-  {"https://test%test", "", 0, 0, CURLUE_BAD_HOSTNAME},
-  {"https://example.com%252f%40@example.net",
-   "https | example.com%2f@ | [12] | [13] | example.net | [15] | / "
-   "| [16] | [17]",
-   0, CURLU_URLDECODE, CURLUE_OK },
+static const struct testcase get_parts_list[] = {
+  { /* query and fragments with control characters */
+    "http://host/path/?\001#\002",
+    "", CURLU_URLENCODE, 0, CURLUE_MALFORMED_INPUT },
+  { /* Control code in port number is never okay, even when URL encoding */
+    "http://host:\x1f""80/path/",
+    "", CURLU_URLENCODE, 0, CURLUE_MALFORMED_INPUT },
+  { /* Control code in scheme never okay, even when URL encoding */
+    "http\x1f://host/path/",
+    "", CURLU_URLENCODE, 0, CURLUE_MALFORMED_INPUT },
+  { /* Control code in separator never okay, even when URL encoding */
+    "http:/%1f/host/path/",
+    "", CURLU_URLENCODE, 0, CURLUE_BAD_HOSTNAME },
+  { /* Path with control characters */
+    "http://host/path\001with\002ctrl/",
+    "", CURLU_URLENCODE, 0, CURLUE_MALFORMED_INPUT },
+  { /* Path with control characters and space! */
+    "http://host/path\x7fwith space/",
+    "", CURLU_URLENCODE, 0, CURLUE_MALFORMED_INPUT },
+  { /* Ensure %2f is NOT normalized to / even if path-as-is is NOT set */
+    "http://host/path%2f..%2f/",
+    "http | [11] | [12] | [13] | host | [15] | /path%2f..%2f/ | [16] | [17]",
+    0, 0, CURLUE_OK },
+  { /* Set without scheme using guess, then get without it */
+    "example.com/path",
+    "[10] | [11] | [12] | [13] | example.com | [15] | /path | [16] | [17]",
+    CURLU_GUESS_SCHEME, CURLU_NO_GUESS_SCHEME, CURLUE_OK
+  },
+  { /* CURLU_GET_EMPTY: ensures empty query/fragments are returned as "" not
+       NULL */
+    "http://host/path?#",
+    "http | [11] | [12] | [13] | host | [15] | /path |  | ",
+    0, CURLU_GET_EMPTY, CURLUE_OK },
+  { /* Port number overflow ( > 65535 ) */
+    "http://host:65536/",
+    "", 0, 0, CURLUE_BAD_PORT_NUMBER },
+  { /* Port zero - often discouraged/invalid in URLs */
+    "http://host:0/",
+    "http | [11] | [12] | [13] | host | 0 | / | [16] | [17]",
+    0, 0, CURLUE_OK },
+  { /* Leading zeros in port */
+    "http://host:00080/",
+    "http | [11] | [12] | [13] | host | 80 | / | [16] | [17]",
+    0, 0, CURLUE_OK },
+  { /* Single dot host - not ok */
+    "http://./",
+    "",
+    0, 0, CURLUE_BAD_HOSTNAME },
+  { /* Host starting with a dash (RFC 1123 technically allows it, but many
+       parsers do not) */
+    "http://-atest/",
+    "http | [11] | [12] | [13] | -atest | [15] | / | [16] | [17]",
+    0, 0, CURLUE_OK },
+  { /* Multiple trailing dots is not okay */
+    "http://example.com../",
+    "",
+    0, 0, CURLUE_BAD_HOSTNAME },
+  {  /* Empty IPv6 Zone ID */
+    "http://[fe80::1%]/",
+    "", 0, 0, CURLUE_BAD_IPV6 },
+  { /* Zone ID with escaped characters */
+    "http://[fe80::1%25eth0]/",
+    "http | [11] | [12] | [13] | [fe80::1] eth0 | [15] | / | [16] | [17]",
+    0, 0, CURLUE_OK },
+  { "curl.se",
+    "[10] | [11] | [12] | [13] | curl.se | [15] | / | [16] | [17]",
+    CURLU_GUESS_SCHEME, CURLU_NO_GUESS_SCHEME, CURLUE_OK },
+  { "https://curl.se:0/#",
+    "https | [11] | [12] | [13] | curl.se | 0 | / | [16] | ",
+    0, CURLU_GET_EMPTY, CURLUE_OK },
+  { "https://curl.se/#",
+    "https | [11] | [12] | [13] | curl.se | [15] | / | [16] | ",
+    0, CURLU_GET_EMPTY, CURLUE_OK },
+  { "https://curl.se/?#",
+    "https | [11] | [12] | [13] | curl.se | [15] | / |  | ",
+    0, CURLU_GET_EMPTY, CURLUE_OK },
+  { "https://curl.se/?",
+    "https | [11] | [12] | [13] | curl.se | [15] | / |  | [17]",
+    0, CURLU_GET_EMPTY, CURLUE_OK },
+  { "https://curl.se/?",
+    "https | [11] | [12] | [13] | curl.se | [15] | / | [16] | [17]",
+    0, 0, CURLUE_OK },
+  { "https://curl.se/?#",
+    "https | [11] | [12] | [13] | curl.se | [15] | / | [16] | [17]",
+    0, 0, CURLUE_OK },
+  { "https://curl.se/#  ",
+    "https | [11] | [12] | [13] | curl.se | [15] | / | [16] | %20%20",
+    CURLU_URLENCODE | CURLU_ALLOW_SPACE, 0, CURLUE_OK },
+  { "", "", 0, 0, CURLUE_MALFORMED_INPUT },
+  { " ", "", 0, 0, CURLUE_MALFORMED_INPUT },
+  { "1h://example.net", "", 0, 0, CURLUE_BAD_SCHEME },
+  { "..://example.net", "", 0, 0, CURLUE_BAD_SCHEME },
+  { "-ht://example.net", "", 0, 0, CURLUE_BAD_SCHEME },
+  { "+ftp://example.net", "", 0, 0, CURLUE_BAD_SCHEME },
+  { "hej.hej://example.net",
+    "hej.hej | [11] | [12] | [13] | example.net | [15] | / | [16] | [17]",
+    CURLU_NON_SUPPORT_SCHEME, 0, CURLUE_OK },
+  { "ht-tp://example.net",
+    "ht-tp | [11] | [12] | [13] | example.net | [15] | / | [16] | [17]",
+    CURLU_NON_SUPPORT_SCHEME, 0, CURLUE_OK },
+  { "ftp+more://example.net",
+    "ftp+more | [11] | [12] | [13] | example.net | [15] | / | [16] | [17]",
+    CURLU_NON_SUPPORT_SCHEME, 0, CURLUE_OK },
+  { "f1337://example.net",
+    "f1337 | [11] | [12] | [13] | example.net | [15] | / | [16] | [17]",
+    CURLU_NON_SUPPORT_SCHEME, 0, CURLUE_OK },
+  { "https://user@example.net?hello# space ",
+    "https | user | [12] | [13] | example.net | [15] | / | hello | "
+    "%20space%20",
+    CURLU_ALLOW_SPACE | CURLU_URLENCODE, 0, CURLUE_OK },
+  { "https://test%test", "", 0, 0, CURLUE_BAD_HOSTNAME },
+  { "https://example.com%252f%40@example.net",
+    "https | example.com%2f@ | [12] | [13] | example.net | [15] | / "
+    "| [16] | [17]",
+    0, CURLU_URLDECODE, CURLUE_OK },
 #ifdef USE_IDN
-  {"https://räksmörgås.se",
-   "https | [11] | [12] | [13] | xn--rksmrgs-5wao1o.se | "
-   "[15] | / | [16] | [17]", 0, CURLU_PUNYCODE, CURLUE_OK},
-  {"https://xn--rksmrgs-5wao1o.se",
-   "https | [11] | [12] | [13] | räksmörgås.se | "
-   "[15] | / | [16] | [17]", 0, CURLU_PUNY2IDN, CURLUE_OK},
+  /*
+    https://sv.wikipedia.org/wiki/R%c3%a4ksm%c3%b6rg%c3%a5s
+    https://codepoints.net/U+00E4 Latin Small Letter A with Diaeresis
+    https://codepoints.net/U+00F6 Latin Small Letter O with Diaeresis
+    https://codepoints.net/U+00E5 Latin Small Letter A with Ring Above
+  */
+  { "https://r\xc3\xa4ksm\xc3\xb6rg\xc3\xa5s.se",
+    "https | [11] | [12] | [13] | xn--rksmrgs-5wao1o.se | "
+    "[15] | / | [16] | [17]", 0, CURLU_PUNYCODE, CURLUE_OK },
+  { "https://xn--rksmrgs-5wao1o.se",
+    "https | [11] | [12] | [13] | r\xc3\xa4ksm\xc3\xb6rg\xc3\xa5s.se | "
+    "[15] | / | [16] | [17]", 0, CURLU_PUNY2IDN, CURLUE_OK },
+  { "https://www.xn--rksmrgs-5wao1o.se",
+    "https | [11] | [12] | [13] | www.r\xc3\xa4ksm\xc3\xb6rg\xc3\xa5s.se | "
+    "[15] | / | [16] | [17]", 0, CURLU_PUNY2IDN, CURLUE_OK },
+  { "https://www.r\xc3\xa4ksm\xc3\xb6rg\xc3\xa5s.se",
+    "https | [11] | [12] | [13] | www.r\xc3\xa4ksm\xc3\xb6rg\xc3\xa5s.se | "
+    "[15] | / | [16] | [17]", 0, CURLU_PUNY2IDN, CURLUE_OK },
 #else
-  {"https://räksmörgås.se",
-   "https | [11] | [12] | [13] | [30] | [15] | / | [16] | [17]",
-   0, CURLU_PUNYCODE, CURLUE_OK},
+  { "https://r\xc3\xa4ksm\xc3\xb6rg\xc3\xa5s.se",
+    "https | [11] | [12] | [13] | [30] | [15] | / | [16] | [17]",
+    0, CURLU_PUNYCODE, CURLUE_OK },
 #endif
-  /* https://ℂᵤⓇℒ。�🄴 */
+  /*
+    https://codepoints.net/U+2102  Double-Struck Capital C
+    https://codepoints.net/U+1d64  Latin Subscript Small Letter U
+    https://codepoints.net/U+24c7  Circled Latin Capital Letter R
+    https://codepoints.net/U+2112  Script Capital L
+    https://codepoints.net/U+3002  Ideographic Full Stop
+    https://codepoints.net/U+1d412 Mathematical Bold Capital S
+    https://codepoints.net/U+1f134 Squared Latin Capital Letter E
+  */
   {"https://"
    "%e2%84%82%e1%b5%a4%e2%93%87%e2%84%92%e3%80%82%f0%9d%90%92%f0%9f%84%b4",
-   "https | [11] | [12] | [13] | ℂᵤⓇℒ。�🄴 | [15] |"
-   " / | [16] | [17]",
+   "https | [11] | [12] | [13] | "
+   "\xe2\x84\x82\xe1\xb5\xa4\xe2\x93\x87\xe2\x84\x92"
+   "\xe3\x80\x82\xf0\x9d\x90\x92\xf0\x9f\x84\xb4"
+   " | [15] | / | [16] | [17]",
    0, 0, CURLUE_OK},
   {"https://"
    "%e2%84%82%e1%b5%a4%e2%93%87%e2%84%92%e3%80%82%f0%9d%90%92%f0%9f%84%b4",
    "https | [11] | [12] | [13] | "
-   "%e2%84%82%e1%b5%a4%e2%93%87%e2%84%92%e3%80%82%f0%9d%90%92%f0%9f%84%b4 "
+   "%E2%84%82%E1%B5%A4%E2%93%87%E2%84%92%E3%80%82%F0%9D%90%92%F0%9F%84%B4 "
    "| [15] | / | [16] | [17]",
    0, CURLU_URLENCODE, CURLUE_OK},
   {"https://"
    "\xe2\x84\x82\xe1\xb5\xa4\xe2\x93\x87\xe2\x84\x92"
    "\xe3\x80\x82\xf0\x9d\x90\x92\xf0\x9f\x84\xb4",
    "https | [11] | [12] | [13] | "
-   "%e2%84%82%e1%b5%a4%e2%93%87%e2%84%92%e3%80%82%f0%9d%90%92%f0%9f%84%b4 "
+   "%E2%84%82%E1%B5%A4%E2%93%87%E2%84%92%E3%80%82%F0%9D%90%92%F0%9F%84%B4 "
    "| [15] | / | [16] | [17]",
    0, CURLU_URLENCODE, CURLUE_OK},
   {"https://user@example.net?he l lo",
@@ -214,6 +326,7 @@ static const struct testcase get_parts_list[] ={
   {"https://user@example.net?he l lo",
    "https | user | [12] | [13] | example.net | [15] | / | he l lo | [17]",
    CURLU_ALLOW_SPACE, 0, CURLUE_OK},
+  {"https://exam|ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME},
   {"https://exam{}[]ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME},
   {"https://exam{ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME},
   {"https://exam}ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME},
@@ -250,7 +363,7 @@ static const struct testcase get_parts_list[] ={
   {"https://user@example.net",
    "https | user | [12] | [13] | example.net | [15] | / | [16] | [17]",
    0, 0, CURLUE_OK},
-#ifdef USE_WEBSOCKETS
+#ifndef CURL_DISABLE_WEBSOCKETS
   {"ws://example.com/color/?green",
    "ws | [11] | [12] | [13] | example.com | [15] | /color/ | green |"
    " [17]",
@@ -275,7 +388,7 @@ static const struct testcase get_parts_list[] ={
    CURLU_DEFAULT_SCHEME, 0, CURLUE_MALFORMED_INPUT},
   /* no space allowed in scheme */
   {"htt ps://user:password@example.net/get?this=and-what", "",
-   CURLU_NON_SUPPORT_SCHEME|CURLU_ALLOW_SPACE, 0, CURLUE_BAD_SCHEME},
+   CURLU_NON_SUPPORT_SCHEME | CURLU_ALLOW_SPACE, 0, CURLUE_BAD_SCHEME},
   {"https://user:password@example.net/get?this=and what",
    "https | user | password | [13] | example.net | [15] | /get | "
    "this=and what | [17]",
@@ -316,7 +429,7 @@ static const struct testcase get_parts_list[] ={
    "http | ftp.user | moo | [13] | example.com | [15] | /color/ | [16] | "
    "green?no-red",
    CURLU_GUESS_SCHEME, 0, CURLUE_OK },
-#ifdef WIN32
+#ifdef _WIN32
   {"file:/C:\\programs\\foo",
    "file | [11] | [12] | [13] | [14] | [15] | C:\\programs\\foo | [16] | [17]",
    CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
@@ -326,11 +439,9 @@ static const struct testcase get_parts_list[] ={
   {"file:///C:\\programs\\foo",
    "file | [11] | [12] | [13] | [14] | [15] | C:\\programs\\foo | [16] | [17]",
    CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
-  {"file://host.example.com/Share/path/to/file.txt",
-   "file | [11] | [12] | [13] | host.example.com | [15] | "
-   "//host.example.com/Share/path/to/file.txt | [16] | [17]",
-   CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
 #endif
+  {"file://host.example.com/Share/path/to/file.txt", "",
+   CURLU_DEFAULT_SCHEME, 0, CURLUE_BAD_FILE_URL},
   {"https://example.com/color/#green?no-red",
    "https | [11] | [12] | [13] | example.com | [15] | /color/ | [16] | "
    "green?no-red",
@@ -355,12 +466,12 @@ static const struct testcase get_parts_list[] ={
    CURLU_DEFAULT_SCHEME, 0, CURLUE_BAD_IPV6},
   {"http://[ab.be]/x", "",
    CURLU_DEFAULT_SCHEME, 0, CURLUE_BAD_IPV6},
-  /* URL without host name */
+  /* URL without hostname */
   {"http://a:b@/x", "",
    CURLU_DEFAULT_SCHEME, 0, CURLUE_NO_HOST},
   {"boing:80",
    "https | [11] | [12] | [13] | boing | 80 | / | [16] | [17]",
-   CURLU_DEFAULT_SCHEME|CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+   CURLU_DEFAULT_SCHEME | CURLU_GUESS_SCHEME, 0, CURLUE_OK},
   {"http://[fd00:a41::50]:8080",
    "http | [11] | [12] | [13] | [fd00:a41::50] | 8080 | / | [16] | [17]",
    CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
@@ -371,12 +482,12 @@ static const struct testcase get_parts_list[] ={
    "http | [11] | [12] | [13] | [fd00:a41::50] | [15] | / | [16] | [17]",
    CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
   {"https://[::1%252]:1234",
-   "https | [11] | [12] | [13] | [::1] | 1234 | / | [16] | [17]",
+   "https | [11] | [12] | [13] | [::1] 2 | 1234 | / | [16] | [17]",
    CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
 
-  /* here's "bad" zone id */
+  /* non-RFC6874 (unescaped '%') zone id, still accepted/normalized */
   {"https://[fe80::20c:29ff:fe9c:409b%eth0]:1234",
-   "https | [11] | [12] | [13] | [fe80::20c:29ff:fe9c:409b] | 1234 "
+   "https | [11] | [12] | [13] | [fe80::20c:29ff:fe9c:409b] eth0 | 1234 "
    "| / | [16] | [17]",
    CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
   {"https://127.0.0.1:443",
@@ -501,12 +612,153 @@ static const struct testcase get_parts_list[] ={
   {"http:////user:password@example.com:1234/path/html?query=name#anchor",
    "",
    CURLU_DEFAULT_SCHEME, 0, CURLUE_BAD_SLASHES},
+  { /* CURLU_DISALLOW_USER with user */
+    "https://user@example.com", "", CURLU_DISALLOW_USER, 0,
+    CURLUE_USER_NOT_ALLOWED },
+  { /* CURLU_DISALLOW_USER with user:password */
+    "https://user:password@example.com", "", CURLU_DISALLOW_USER, 0,
+    CURLUE_USER_NOT_ALLOWED },
+  { /* Hostname with trailing dot */
+    "https://example.com./",
+    "https | [11] | [12] | [13] | example.com. | [15] | / | [16] | [17]",
+    0, 0, CURLUE_OK },
   {NULL, NULL, 0, 0, CURLUE_OK},
 };
 
 static const struct urltestcase get_url_list[] = {
+  /* percent-encoded IP addresses */
+  {"https://127.0.0.%31.", "https://127.0.0.1/", 0, 0, CURLUE_OK},
+  {"https://127.0.0.0%78f%46.", "https://127.0.0.255/", 0, 0, CURLUE_OK},
+  {"https://%30%31%37%37%2e%31", "https://127.0.0.1/", 0, 0, CURLUE_OK},
+  {"https://[fe80%3A%3A20c%3A29ff%3Afe9c%3A409b]/",
+   "https://[fe80::20c:29ff:fe9c:409b]/", 0, 0, CURLUE_OK },
+
+  /* IPvFuture format */
+  {"http://[v1.fe80::abcd]/", "", 0, 0, CURLUE_BAD_IPV6},
+
+  /* trailing dot on valid host */
+  {"http://example.com./", "http://example.com./", 0, 0, CURLUE_OK},
+
+  /* the exact upper valid port boundary */
+  {"http://host:65535/", "http://host:65535/", 0, 0, CURLUE_OK},
+
+  /* Internationalized path (not host). */
+  {"https://example.com/r\xc3\xa4ksm\xc3\xb6rg\xc3\xa5s",
+   "https://example.com/r%C3%A4ksm%C3%B6rg%C3%A5s",
+   CURLU_URLENCODE, 0, CURLUE_OK},
+
+  /* weird fragments */
+  {"http://host/#a#b", "http://host/#a#b", 0, 0, CURLUE_OK},
+
+  /* Empty query parameter values */
+  {"http://host/?a=", "http://host/?a=", 0, 0, CURLUE_OK},
+  {"http://host/?a=&b=", "http://host/?a=&b=", 0, 0, CURLUE_OK},
+
+  /* Percent-encoded userinfo */
+  {"https://user%20name@example.com/", "https://user%20name@example.com/",
+   0, 0, CURLUE_OK},
+  {"https://user:pa%3Ass@example.com/", "https://user:pa%3Ass@example.com/",
+   0, 0, CURLUE_OK},
+
+  /* malformed unbracketed IPv6 */
+  {"https://fe80:8080::1/", "", 0, 0, CURLUE_BAD_PORT_NUMBER},
+  {"https://::1/", "", 0, 0, CURLUE_BAD_PORT_NUMBER},
+
+  /* Empty host with standard schemes */
+  {"http:///", "", 0, 0, CURLUE_NO_HOST},
+  {"https://?q=1", "", 0, 0, CURLUE_NO_HOST},
+
+  /* Empty path segment normalization */
+  {"http://example.com//", "http://example.com//", 0, 0, CURLUE_OK},
+  {"http://example.com///foo", "http://example.com///foo", 0, 0, CURLUE_OK},
+
+  /* Empty user and password combinations */
+  {"http://@example.com/", "http://@example.com/", 0, 0, CURLUE_OK},
+  {"http://user:@example.com/", "http://user:@example.com/", 0, 0, CURLUE_OK},
+  {"http://:password@example.com/", "http://:password@example.com/",
+   0, 0, CURLUE_OK},
+
+  {"https://127.1.0x", "https://127.1.0x/", 0, 0, CURLUE_OK},
+  {"https://127.0x", "https://127.0x/", 0, 0, CURLUE_OK},
+  {"https://127.0x.1", "https://127.0x.1/", 0, 0, CURLUE_OK},
+  {"https://127.1.1.0x", "https://127.1.1.0x/", 0, 0, CURLUE_OK},
+  {"https://127.1.", "https://127.0.0.1/", 0, 0, CURLUE_OK},
+  {"https://127.1.:443", "https://127.0.0.1:443/", 0, 0, CURLUE_OK},
+  {"https://127.1.?moo", "https://127.0.0.1/?moo", 0, 0, CURLUE_OK},
+  {"https://127.1.#moo", "https://127.0.0.1/#moo", 0, 0, CURLUE_OK},
+  {"https://127.1.a", "https://127.1.a/", 0, 0, CURLUE_OK},
+  {"https://127.1..", "", 0, 0, CURLUE_BAD_HOSTNAME},
+  {"https://127.1..:443", "", 0, 0, CURLUE_BAD_HOSTNAME},
+  {"https://127.1..?moo", "", 0, 0, CURLUE_BAD_HOSTNAME},
+  {"https://127.1..#moo", "", 0, 0, CURLUE_BAD_HOSTNAME},
+  {"https://127.1.1.", "https://127.1.0.1/", 0, 0, CURLUE_OK},
+  {"https://127.1.1./foo", "https://127.1.0.1/foo", 0, 0, CURLUE_OK},
+  {"https://127.1.1.1.", "https://127.1.1.1/", 0, 0, CURLUE_OK},
+  {"https://127.1", "https://127.0.0.1/", 0, 0, CURLUE_OK},
+  {"https://127.0.0.1.", "https://127.0.0.1/", 0, 0, CURLUE_OK},
+  {"https://127.0.0.0xff.", "https://127.0.0.255/", 0, 0, CURLUE_OK},
+  {"https://127.0.0.1..", "", 0, 0, CURLUE_BAD_HOSTNAME},
+  {"https://127.0.0.256..", "", 0, 0, CURLUE_BAD_HOSTNAME},
+  {"http://hej./", "http://hej./", 0, 0, CURLUE_OK},
+  {"http://hej../", "", 0, 0, CURLUE_BAD_HOSTNAME},
+  {"http://hej.../", "", 0, 0, CURLUE_BAD_HOSTNAME},
+  {"http://hej..../index.html", "", 0, 0, CURLUE_BAD_HOSTNAME},
+  {"http://.", "", 0, 0, CURLUE_BAD_HOSTNAME},
+  {"http://..", "", 0, 0, CURLUE_BAD_HOSTNAME},
+  {"http://...", "", 0, 0, CURLUE_BAD_HOSTNAME},
+  {"018.0.0.0", "http://018.0.0.0/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"08", "http://08/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"0", "http://0.0.0.0/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"01", "http://0.0.0.1/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"02", "http://0.0.0.2/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"03", "http://0.0.0.3/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"04", "http://0.0.0.4/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"05", "http://0.0.0.5/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"06", "http://0.0.0.6/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"07", "http://0.0.0.7/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"07.1", "http://7.0.0.1/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"7.1", "http://7.0.0.1/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"0x7.1", "http://7.0.0.1/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"0x", "http://0x/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"0x1", "http://0.0.0.1/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"0x2", "http://0.0.0.2/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"0x3", "http://0.0.0.3/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"0x4", "http://0.0.0.4/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"0x5", "http://0.0.0.5/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"0x6", "http://0.0.0.6/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"0x7", "http://0.0.0.7/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"0x8", "http://0.0.0.8/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"0x9", "http://0.0.0.9/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"0xa", "http://0.0.0.10/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"0xb", "http://0.0.0.11/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"0xc", "http://0.0.0.12/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"0xd", "http://0.0.0.13/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"0xe", "http://0.0.0.14/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"0xf", "http://0.0.0.15/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"0xg", "http://0xg/", CURLU_GUESS_SCHEME, 0, CURLUE_OK},
+  {"https://0/", "https://0.0.0.0/", 0, 0, CURLUE_OK},
+  {"https://0.0x0/", "https://0.0.0.0/", 0, 0, CURLUE_OK},
+  {"https://0.000/", "https://0.0.0.0/", 0, 0, CURLUE_OK},
+  {"example.com",
+   "example.com/",
+   CURLU_GUESS_SCHEME, CURLU_NO_GUESS_SCHEME, CURLUE_OK},
+  {"http://user@example.com?#",
+   "http://user@example.com/?#",
+   0, CURLU_GET_EMPTY, CURLUE_OK},
+  /* WHATWG disagrees, it wants "https:/0.0.0.0/" */
+  {"https://0x.0x.0", "https://0x.0x.0/", 0, 0, CURLUE_OK},
+
+  {"https://example.com:000000000000000000000443/foo",
+   "https://example.com/foo",
+   0, CURLU_NO_DEFAULT_PORT, CURLUE_OK},
+  {"https://example.com:000000000000000000000/foo",
+   "https://example.com:0/foo",
+   0, CURLU_NO_DEFAULT_PORT, CURLUE_OK},
+  {"https://192.0x0000A80001", "https://192.168.0.1/", 0, 0, CURLUE_OK},
+  {"https://0xffffffff", "https://255.255.255.255/", 0, 0, CURLUE_OK},
   {"https://1.0x1000000", "https://1.0x1000000/", 0, 0, CURLUE_OK},
   {"https://0x7f.1", "https://127.0.0.1/", 0, 0, CURLUE_OK},
+  {"https://0X7F.1", "https://127.0.0.1/", 0, 0, CURLUE_OK},
   {"https://1.2.3.256.com", "https://1.2.3.256.com/", 0, 0, CURLUE_OK},
   {"https://10.com", "https://10.com/", 0, 0, CURLUE_OK},
   {"https://1.2.com", "https://1.2.com/", 0, 0, CURLUE_OK},
@@ -524,6 +776,10 @@ static const struct urltestcase get_url_list[] = {
   {"https://[fe80:0:0:0:409b::]:80/moo",
    "https://[fe80::409b:0:0:0]:80/moo",
    0, 0, CURLUE_OK},
+  /* normalize to lower case */
+  {"https://[FE80:0:A:0:409B:0:0:0]:80/moo",
+   "https://[fe80:0:a:0:409b::]:80/moo",
+   0, 0, CURLUE_OK},
   {"https://[::%25fakeit];80/moo",
    "",
    0, 0, CURLUE_BAD_PORT_NUMBER},
@@ -531,7 +787,7 @@ static const struct urltestcase get_url_list[] = {
    "",
    0, 0, CURLUE_BAD_PORT_NUMBER},
 #ifdef USE_IDN
-  {"https://räksmörgås.se/path?q#frag",
+  {"https://r\xc3\xa4ksm\xc3\xb6rg\xc3\xa5s.se/path?q#frag",
    "https://xn--rksmrgs-5wao1o.se/path?q#frag", 0, CURLU_PUNYCODE, CURLUE_OK},
 #endif
   /* unsupported schemes with no guessing enabled */
@@ -543,7 +799,7 @@ static const struct urltestcase get_url_list[] = {
   {"mailto:infobot@example.com?body=send%20current-issue", "", 0, 0,
    CURLUE_UNSUPPORTED_SCHEME},
   {"about:80", "https://about:80/", CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
-  /* percent encoded host names */
+  /* percent encoded hostnames */
   {"http://example.com%40127.0.0.1/", "", 0, 0, CURLUE_BAD_HOSTNAME},
   {"http://example.com%21127.0.0.1/", "", 0, 0, CURLUE_BAD_HOSTNAME},
   {"http://example.com%3f127.0.0.1/", "", 0, 0, CURLUE_BAD_HOSTNAME},
@@ -553,7 +809,7 @@ static const struct urltestcase get_url_list[] = {
   {"http://example.com%2F127.0.0.1/", "", 0, 0, CURLUE_BAD_HOSTNAME},
   {"https://%41", "https://A/", 0, 0, CURLUE_OK},
   {"https://%20", "", 0, 0, CURLUE_BAD_HOSTNAME},
-  {"https://%41%0d", "", 0, 0, CURLUE_BAD_HOSTNAME},
+  {"https://%41%0D", "", 0, 0, CURLUE_BAD_HOSTNAME},
   {"https://%25", "", 0, 0, CURLUE_BAD_HOSTNAME},
   {"https://_%c0_", "https://_\xC0_/", 0, 0, CURLUE_OK},
   {"https://_%c0_", "https://_%C0_/", 0, CURLU_URLENCODE, CURLUE_OK},
@@ -562,12 +818,14 @@ static const struct urltestcase get_url_list[] = {
   {"https://16843009", "https://1.1.1.1/", 0, 0, CURLUE_OK},
   {"https://0177.1", "https://127.0.0.1/", 0, 0, CURLUE_OK},
   {"https://0111.02.0x3", "https://73.2.0.3/", 0, 0, CURLUE_OK},
-  {"https://0111.02.0x3.", "https://0111.02.0x3./", 0, 0, CURLUE_OK},
+  {"https://0111.02.0X3", "https://73.2.0.3/", 0, 0, CURLUE_OK},
+  {"https://0111.02.0x3.", "https://73.2.0.3/", 0, 0, CURLUE_OK},
   {"https://0111.02.030", "https://73.2.0.24/", 0, 0, CURLUE_OK},
-  {"https://0111.02.030.", "https://0111.02.030./", 0, 0, CURLUE_OK},
+  {"https://0111.02.030.", "https://73.2.0.24/", 0, 0, CURLUE_OK},
   {"https://0xff.0xff.0377.255", "https://255.255.255.255/", 0, 0, CURLUE_OK},
+  {"https://0XFF.0XFF.0377.255", "https://255.255.255.255/", 0, 0, CURLUE_OK},
   {"https://1.0xffffff", "https://1.255.255.255/", 0, 0, CURLUE_OK},
-  /* IPv4 numerical overflows or syntax errors will not normalize */
+  /* IPv4 numerical overflows or syntax errors do not normalize */
   {"https://a127.0.0.1", "https://a127.0.0.1/", 0, 0, CURLUE_OK},
   {"https://\xff.127.0.0.1", "https://%FF.127.0.0.1/", 0, CURLU_URLENCODE,
    CURLUE_OK},
@@ -591,8 +849,8 @@ static const struct urltestcase get_url_list[] = {
    "",
    0, 0, CURLUE_BAD_IPV6},
   {"https://[fe80::20c:29ff:fe9c:409b%25]:1234",
-   "https://[fe80::20c:29ff:fe9c:409b%2525]:1234/",
-   0, 0, CURLUE_OK},
+   "",
+   0, 0, CURLUE_BAD_IPV6},
   {"https://[fe80::20c:29ff:fe9c:409b%eth0]:1234",
    "https://[fe80::20c:29ff:fe9c:409b%25eth0]:1234/",
    0, 0, CURLUE_OK},
@@ -679,7 +937,15 @@ static const struct urltestcase get_url_list[] = {
   {"file:///file.txt#moo", "file:///file.txt#moo", 0, 0, CURLUE_OK},
   {"file:////file.txt", "file:////file.txt", 0, 0, CURLUE_OK},
   {"file:///file.txt", "file:///file.txt", 0, 0, CURLUE_OK},
-  {"file:./", "file://", 0, 0, CURLUE_OK},
+  {"file:///", "file:///", 0, 0, CURLUE_OK},
+  {"file:///.", "file:///", 0, 0, CURLUE_OK},
+  {"file:///./", "file:///", 0, 0, CURLUE_OK},
+  {"file:///a", "file:///a", 0, 0, CURLUE_OK},
+  {"file:./", "", 0, 0, CURLUE_BAD_FILE_URL},
+  {"file:foo", "", 0, 0, CURLUE_BAD_FILE_URL},
+  {"file:foo/bar", "", 0, 0, CURLUE_BAD_FILE_URL},
+  {"file:?q", "", 0, 0, CURLUE_BAD_FILE_URL},
+  {"file:#f", "", 0, 0, CURLUE_BAD_FILE_URL},
   {"http://example.com/hello/../here",
    "http://example.com/hello/../here",
    CURLU_PATH_AS_IS, 0, CURLUE_OK},
@@ -746,17 +1012,19 @@ static const struct urltestcase get_url_list[] = {
   {"custom-scheme://host?expected=test-still-good",
    "custom-scheme://host/?expected=test-still-good",
    CURLU_NON_SUPPORT_SCHEME | CURLU_NO_AUTHORITY, 0, CURLUE_OK},
+  {"https://%41%0D%0A%42/", "", 0, 0, CURLUE_BAD_HOSTNAME},
+  {"https://[fe80::1]:0/foo", "https://[fe80::1]:0/foo", 0, 0, CURLUE_OK},
   {NULL, NULL, 0, 0, CURLUE_OK}
 };
 
 static int checkurl(const char *org, const char *url, const char *out)
 {
   if(strcmp(out, url)) {
-    fprintf(stderr,
-            "Org:    %s\n"
-            "Wanted: %s\n"
-            "Got   : %s\n",
-            org, out, url);
+    curl_mfprintf(stderr,
+                  "Org:    %s\n"
+                  "Wanted: %s\n"
+                  "Got   : %s\n",
+                  org, out, url);
     return 1;
   }
   return 0;
@@ -767,6 +1035,18 @@ static int checkurl(const char *org, const char *url, const char *out)
    3. Extract all components (not URL)
 */
 static const struct setgetcase setget_parts_list[] = {
+  {"https://example.com/",
+   "query=\"\",",
+   "https | [11] | [12] | [13] | example.com | [15] | / |  | [17]",
+   0, 0, CURLU_GET_EMPTY, CURLUE_OK},
+  {"https://example.com/",
+   "fragment=\"\",",
+   "https | [11] | [12] | [13] | example.com | [15] | / | [16] | ",
+   0, 0, CURLU_GET_EMPTY, CURLUE_OK},
+  {"https://example.com/",
+   "query=\"\",",
+   "https | [11] | [12] | [13] | example.com | [15] | / | [16] | [17]",
+   0, 0, 0, CURLUE_OK},
   {"https://example.com",
    "path=get,",
    "https | [11] | [12] | [13] | example.com | [15] | /get | [16] | [17]",
@@ -785,6 +1065,54 @@ static const struct setgetcase setget_parts_list[] = {
 
 /* !checksrc! disable SPACEBEFORECOMMA 1 */
 static const struct setcase set_parts_list[] = {
+  {"https://example.com/",
+   "path=one /$!$&'()*+;=:@{}[]%,",
+   "https://example.com/one%20/$!$&'()*+;=:@{}[]%25",
+   0, CURLU_URLENCODE, CURLUE_OK, CURLUE_OK},
+  {NULL, /* start fresh! */
+   "scheme=https,path=/,url=\"\",", /* incomplete URL, redirect to "" */
+   "https://example.com/",
+   0, 0, CURLUE_OK, CURLUE_MALFORMED_INPUT},
+  {NULL, /* start fresh! */
+   "scheme=https,host=example.com,path=/,url=\"\",", /* redirect to "" */
+   "https://example.com/",
+   0, 0, CURLUE_OK, CURLUE_OK},
+  {"https://example.com/",
+   "path=one\ntwo,",
+   "https://example.com/one\ntwo",
+   0, 0, CURLUE_OK, CURLUE_OK},
+  {"https://example.com/",
+   "path=one\rtwo,",
+   "https://example.com/one\rtwo",
+   0, 0, CURLUE_OK, CURLUE_OK},
+  {"https://example.com/",
+   "path=one\ntwo,",
+   "https://example.com/one%0Atwo",
+   0, CURLU_URLENCODE, CURLUE_OK, CURLUE_OK},
+  {"https://example.com/",
+   "path=one\rtwo,",
+   "https://example.com/one%0Dtwo",
+   0, CURLU_URLENCODE, CURLUE_OK, CURLUE_OK},
+  {"https://example.com/",
+   "host=%43url.se,",
+   "https://%43url.se/",
+   0, 0, CURLUE_OK, CURLUE_OK},
+  {"https://example.com/",
+   "host=%25url.se,",
+   "",
+   0, 0, CURLUE_OK, CURLUE_BAD_HOSTNAME},
+  {"https://example.com/?param=value",
+   "query=\"\",",
+   "https://example.com/",
+   0, CURLU_APPENDQUERY | CURLU_URLENCODE, CURLUE_OK, CURLUE_OK},
+  {"https://example.com/",
+   "host=\"\",",
+   "https://example.com/",
+   0, CURLU_URLENCODE, CURLUE_OK, CURLUE_BAD_HOSTNAME},
+  {"https://example.com/",
+   "host=\"\",",
+   "https://example.com/",
+   0, 0, CURLUE_OK, CURLUE_BAD_HOSTNAME},
   {"https://example.com",
    "path=get,",
    "https://example.com/get",
@@ -838,7 +1166,7 @@ static const struct setcase set_parts_list[] = {
    0, /* set */
    CURLUE_OK, CURLUE_BAD_HOSTNAME},
   {"https://example.com/",
-   "host=0xff,", /* '++' there's no automatic URL decode when settin this
+   "host=0xff,", /* '++' there is no automatic URL decode when setting this
                   part */
    "https://0xff/",
    0, /* get */
@@ -847,7 +1175,7 @@ static const struct setcase set_parts_list[] = {
 
   {"https://example.com/",
    "query=Al2cO3tDkcDZ3EWE5Lh+LX8TPHs,", /* contains '+' */
-   "https://example.com/?Al2cO3tDkcDZ3EWE5Lh%2bLX8TPHs",
+   "https://example.com/?Al2cO3tDkcDZ3EWE5Lh%2BLX8TPHs",
    CURLU_URLDECODE, /* decode on get */
    CURLU_URLENCODE, /* encode on set */
    CURLUE_OK, CURLUE_OK},
@@ -858,7 +1186,7 @@ static const struct setcase set_parts_list[] = {
    "https://example.com/",
    0, CURLU_NON_SUPPORT_SCHEME, CURLUE_OK, CURLUE_BAD_SCHEME},
   {"https://example.com/",
-   /* Set a 41 bytes scheme. That's too long so the old scheme remains set. */
+   /* Set a 41 bytes scheme. That is too long so the old scheme remains set. */
    "scheme=bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbc,",
    "https://example.com/",
    0, CURLU_NON_SUPPORT_SCHEME, CURLUE_OK, CURLUE_BAD_SCHEME},
@@ -885,8 +1213,8 @@ static const struct setcase set_parts_list[] = {
    0, 0, CURLUE_OK, CURLUE_BAD_PORT_NUMBER},
   {"https://host:1234/",
    "port=0,",
-   "https://host:1234/",
-   0, 0, CURLUE_OK, CURLUE_BAD_PORT_NUMBER},
+   "https://host:0/",
+   0, 0, CURLUE_OK, CURLUE_OK},
   {"https://host:1234/",
    "port=65535,",
    "https://host:65535/",
@@ -896,8 +1224,8 @@ static const struct setcase set_parts_list[] = {
    "https://host:1234/",
    0, 0, CURLUE_OK, CURLUE_BAD_PORT_NUMBER},
   {"https://host/",
-   "path=%4A%4B%4C,",
-   "https://host/%4a%4b%4c",
+   "path=%4A%4b%4C,",
+   "https://host/%4A%4B%4C",
    0, 0, CURLUE_OK, CURLUE_OK},
   {"https://host/mooo?q#f",
    "path=NULL,query=NULL,fragment=NULL,",
@@ -909,9 +1237,9 @@ static const struct setcase set_parts_list[] = {
    0, 0, CURLUE_OK, CURLUE_OK},
   {NULL,
    "scheme=https,user=   @:,host=foobar,",
-   "https://%20%20%20%40%3a@foobar/",
+   "https://%20%20%20%40%3A@foobar/",
    0, CURLU_URLENCODE, CURLUE_OK, CURLUE_OK},
-  /* Setting a host name with spaces is not OK: */
+  /* Setting a hostname with spaces is not OK: */
   {NULL,
    "scheme=https,host=  ,path= ,user= ,password= ,query= ,fragment= ,",
    "[nothing]",
@@ -922,7 +1250,7 @@ static const struct setcase set_parts_list[] = {
    0, CURLU_URLENCODE, CURLUE_OK, CURLUE_OK},
   {NULL,
    "scheme=https,host=foobar,path=\xc3\xa4\xc3\xb6\xc3\xbc,",
-   "https://foobar/%c3%a4%c3%b6%c3%bc",
+   "https://foobar/%C3%A4%C3%B6%C3%BC",
    0, CURLU_URLENCODE, CURLUE_OK, CURLUE_OK},
   {"imap://user:secret;opt@host/",
    "options=updated,scheme=imaps,password=p4ssw0rd,",
@@ -990,11 +1318,22 @@ static const struct setcase set_parts_list[] = {
    "custom-scheme:///",
    CURLU_NON_SUPPORT_SCHEME, CURLU_NON_SUPPORT_SCHEME | CURLU_NO_AUTHORITY,
    CURLUE_OK, CURLUE_OK},
-
+  {"https://example.com/",
+   "port=0,",
+   "https://example.com:0/",
+   0, 0, CURLUE_OK, CURLUE_OK},
+  {"https://example.com/",
+   "port=65535,",
+   "https://example.com:65535/",
+   0, 0, CURLUE_OK, CURLUE_OK},
+  {"https://example.com/",
+   "query=foo=bar,",
+   "https://example.com/?foo=bar",
+   0, CURLU_APPENDQUERY, CURLUE_OK, CURLUE_OK},
   {NULL, NULL, NULL, 0, 0, CURLUE_OK, CURLUE_OK}
 };
 
-static CURLUPart part2id(char *part)
+static CURLUPart part2id(const char *part)
 {
   if(!strcmp("url", part))
     return CURLUPART_URL;
@@ -1018,6 +1357,7 @@ static CURLUPart part2id(char *part)
     return CURLUPART_FRAGMENT;
   if(!strcmp("zoneid", part))
     return CURLUPART_ZONEID;
+  /* NOLINTNEXTLINE(clang-analyzer-optin.core.EnumCastOutOfRange) */
   return (CURLUPart)9999; /* bad input => bad output */
 }
 
@@ -1028,9 +1368,9 @@ static CURLUcode updateurl(CURLU *u, const char *cmd, unsigned int setflags)
 
   /* make sure the last command ends with a comma too! */
   while(p) {
-    char *e = strchr(p, ',');
+    const char *e = strchr(p, ',');
     if(e) {
-      size_t n = e-p;
+      size_t n = (size_t)(e - p);
       char buf[80];
       char part[80];
       char value[80];
@@ -1039,14 +1379,15 @@ static CURLUcode updateurl(CURLU *u, const char *cmd, unsigned int setflags)
       memset(value, 0, sizeof(value)); /* Avoid valgrind false positive. */
       memcpy(buf, p, n);
       buf[n] = 0;
-      if(2 == sscanf(buf, "%79[^=]=%79[^,]", part, value)) {
+      /* !checksrc! disable BANNEDFUNC 1 */
+      if(sscanf(buf, "%79[^=]=%79[^,]", part, value) == 2) {
         CURLUPart what = part2id(part);
 #if 0
         /* for debugging this */
-        fprintf(stderr, "%s = \"%s\" [%d]\n", part, value, (int)what);
+        curl_mfprintf(stderr, "%s = \"%s\" [%d]\n", part, value, what);
 #endif
         if(what > CURLUPART_ZONEID)
-          fprintf(stderr, "UNKNOWN part '%s'\n", part);
+          curl_mfprintf(stderr, "UNKNOWN part '%s'\n", part);
 
         if(!strcmp("NULL", value))
           uc = curl_url_set(u, what, NULL, setflags);
@@ -1066,14 +1407,150 @@ static CURLUcode updateurl(CURLU *u, const char *cmd, unsigned int setflags)
 }
 
 static const struct redircase set_url_list[] = {
+  {"https://example.com",
+   "", /* blank redirect */
+   "https://example.com/",
+   0, 0, CURLUE_OK },
+  {"file:///test?test#test",
+   "", "file:///test?test",
+   0, 0, CURLUE_OK},
+  {"https://example.com/path?query#frag",
+   "", "https://example.com/path?query",
+   0, 0, CURLUE_OK},
+  {"ftp://example.com/dir/file#anchor",
+   "", "ftp://example.com/dir/file",
+   0, 0, CURLUE_OK},
+  {"http://example.com/path#frag",
+   "", "http://example.com/path",
+   0, 0, CURLUE_OK},
+  {"http://example.com/#frag",
+   "", "http://example.com/",
+   0, 0, CURLUE_OK},
+  {"http://user:pass@example.com/path?query#frag",
+   "", "http://user:pass@example.com/path?query",
+   0, 0, CURLUE_OK},
+  {"http://example.com:8080/path?query#frag",
+   "", "http://example.com:8080/path?query",
+   0, 0, CURLUE_OK},
+  {"https://user:pass@example.com:8443/path?query#frag",
+   "", "https://user:pass@example.com:8443/path?query",
+   0, 0, CURLUE_OK},
+  {"http://[::1]/path#frag",
+   "", "http://[::1]/path",
+   0, 0, CURLUE_OK},
+  {"http://firstplace.example.com/want/1314",
+   "//somewhere.example.com/reply/1314",
+   "http://somewhere.example.com/reply/1314",
+   0, 0, CURLUE_OK },
+  {"http://127.0.0.1:46383/want?uri=http://anything/276?secondq/276",
+   "data/2760002.txt?coolsite=http://anotherurl/?a_second/2760002",
+   "http://127.0.0.1:46383/"
+   "data/2760002.txt?coolsite=http://anotherurl/?a_second/2760002",
+   0, 0, CURLUE_OK },
+  {"file:///basic#", "#yay",
+   "file:///basic#yay", 0, 0, CURLUE_OK},
+  {"file:///basic", "?yay",
+   "file:///basic?yay", 0, 0, CURLUE_OK},
+  {"file:///basic?", "?yay",
+   "file:///basic?yay", 0, 0, CURLUE_OK},
+  {"file:///basic?hello", "#frag",
+   "file:///basic?hello#frag", 0, 0, CURLUE_OK},
+  {"file:///basic?hello", "?q",
+   "file:///basic?q", 0, 0, CURLUE_OK},
+  {"http://example.org#without/ash", "/moo#frag",
+   "http://example.org/moo#frag",
+   0, 0, CURLUE_OK},
+  {"http://example.org/", "../path/././../././../moo",
+   "http://example.org/moo",
+   0, 0, CURLUE_OK},
+  {"http://example.org/", ".%2e/path/././../%2E/./../moo",
+   "http://example.org/moo",
+   0, 0, CURLUE_OK},
+  {"http://example.org/", ".%2e/path/./%2e/.%2E/%2E/./%2e%2E/moo",
+   "http://example.org/moo",
+   0, 0, CURLUE_OK},
+
+  {"http://example.org?bar/moo", "?weird",
+   "http://example.org/?weird", 0, 0, CURLUE_OK},
+  {"http://example.org/foo?bar", "?weird",
+   "http://example.org/foo?weird", 0, 0, CURLUE_OK},
+  {"http://example.org/foo", "?weird",
+   "http://example.org/foo?weird", 0, 0, CURLUE_OK},
+  {"http://example.org", "?weird",
+   "http://example.org/?weird", 0, 0, CURLUE_OK},
+  {"http://example.org/#original", "?weird#moo",
+   "http://example.org/?weird#moo", 0, 0, CURLUE_OK},
+
+  {"http://example.org?bar/moo#yes/path", "#new/slash",
+   "http://example.org/?bar/moo#new/slash", 0, 0, CURLUE_OK},
+  {"http://example.org/foo?bar", "#weird",
+   "http://example.org/foo?bar#weird", 0, 0, CURLUE_OK},
+  {"http://example.org/foo?bar#original", "#weird",
+   "http://example.org/foo?bar#weird", 0, 0, CURLUE_OK},
+  {"http://example.org/foo#original", "#weird",
+   "http://example.org/foo#weird", 0, 0, CURLUE_OK},
+  {"http://example.org/#original", "#weird",
+   "http://example.org/#weird", 0, 0, CURLUE_OK},
+  {"http://example.org#original", "#weird",
+   "http://example.org/#weird", 0, 0, CURLUE_OK},
+  {"http://example.org/foo?bar", "moo?hey#weird",
+   "http://example.org/moo?hey#weird", 0, 0, CURLUE_OK},
+  {"http://example.org/",
+   "../path/././../../moo",
+   "http://example.org/moo",
+   0, 0, CURLUE_OK},
+  {"http://example.org/",
+   "//example.org/../path/../../",
+   "http://example.org/",
+   0, 0, CURLUE_OK},
+  {"http://example.org/",
+   "///example.org/../path/../../",
+   "http://example.org/",
+   0, 0, CURLUE_OK},
+  {"http://example.org/foo/bar",
+   ":23",
+   "http://example.org/foo/:23",
+   0, 0, CURLUE_OK},
+  {"http://example.org/foo/bar",
+   "\\x",
+   "http://example.org/foo/\\x",
+   /* WHATWG disagrees */
+   0, 0, CURLUE_OK},
+  {"http://example.org/foo/bar",
+   "#/",
+   "http://example.org/foo/bar#/",
+   0, 0, CURLUE_OK},
+  {"http://example.org/foo/bar",
+   "?/",
+   "http://example.org/foo/bar?/",
+   0, 0, CURLUE_OK},
+  {"http://example.org/foo/bar",
+   "#;?",
+   "http://example.org/foo/bar#;?",
+   0, 0, CURLUE_OK},
+  {"http://example.org/foo/bar",
+   "#",
+   "http://example.org/foo/bar",
+   /* This happens because the parser removes empty fragments */
+   0, 0, CURLUE_OK},
+  {"http://example.org/foo/bar",
+   "?",
+   "http://example.org/foo/bar",
+   /* This happens because the parser removes empty queries */
+   0, 0, CURLUE_OK},
+  {"http://example.org/foo/bar",
+   "?#",
+   "http://example.org/foo/bar",
+   /* This happens because the parser removes empty queries and fragments */
+   0, 0, CURLUE_OK},
   {"http://example.com/please/../gimme/%TESTNUMBER?foobar#hello",
    "http://example.net/there/it/is/../../tes t case=/%TESTNUMBER0002? yes no",
    "http://example.net/there/tes%20t%20case=/%TESTNUMBER0002?+yes+no",
-   0, CURLU_URLENCODE|CURLU_ALLOW_SPACE, CURLUE_OK},
+   0, CURLU_URLENCODE | CURLU_ALLOW_SPACE, CURLUE_OK},
   {"http://local.test?redirect=http://local.test:80?-321",
    "http://local.test:80?-123",
    "http://local.test:80/?-123",
-   0, CURLU_URLENCODE|CURLU_ALLOW_SPACE, CURLUE_OK},
+   0, CURLU_URLENCODE | CURLU_ALLOW_SPACE, CURLUE_OK},
   {"http://local.test?redirect=http://local.test:80?-321",
    "http://local.test:80?-123",
    "http://local.test:80/?-123",
@@ -1110,6 +1587,8 @@ static const struct redircase set_url_list[] = {
    "http://?hi",
    "http:///?hi",
    0, CURLU_NO_AUTHORITY, CURLUE_OK},
+  {"http://host/path", "?query", "http://host/path?query", 0, 0, CURLUE_OK},
+  {"http://host/path", "#frag", "http://host/path#frag", 0, 0, CURLUE_OK},
   {NULL, NULL, NULL, 0, 0, CURLUE_OK}
 };
 
@@ -1121,38 +1600,38 @@ static int set_url(void)
   for(i = 0; set_url_list[i].in && !error; i++) {
     CURLUcode rc;
     CURLU *urlp = curl_url();
-    if(!urlp)
+    if(!urlp) {
+      error++;
       break;
+    }
     rc = curl_url_set(urlp, CURLUPART_URL, set_url_list[i].in,
                       set_url_list[i].urlflags);
     if(!rc) {
       rc = curl_url_set(urlp, CURLUPART_URL, set_url_list[i].set,
                         set_url_list[i].setflags);
       if(rc) {
-        fprintf(stderr, "%s:%d Set URL %s returned %d (%s)\n",
-                __FILE__, __LINE__, set_url_list[i].set,
-                (int)rc, curl_url_strerror(rc));
+        curl_mfprintf(stderr, "%s:%d Set URL %s returned %d (%s)\n",
+                      __FILE__, __LINE__, set_url_list[i].set,
+                      (int)rc, curl_url_strerror(rc));
         error++;
       }
       else {
         char *url = NULL;
         rc = curl_url_get(urlp, CURLUPART_URL, &url, 0);
         if(rc) {
-          fprintf(stderr, "%s:%d Get URL returned %d (%s)\n",
-                  __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
+          curl_mfprintf(stderr, "%s:%d Get URL returned %d (%s)\n",
+                        __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
           error++;
         }
-        else {
-          if(checkurl(set_url_list[i].in, url, set_url_list[i].out)) {
-            error++;
-          }
+        else if(checkurl(set_url_list[i].in, url, set_url_list[i].out)) {
+          error++;
         }
         curl_free(url);
       }
     }
     else if(rc != set_url_list[i].ucode) {
-      fprintf(stderr, "Set URL\nin: %s\nreturned %d (expected %d)\n",
-              set_url_list[i].in, (int)rc, set_url_list[i].ucode);
+      curl_mfprintf(stderr, "Set URL\nin: %s\nreturned %d (expected %d)\n",
+                    set_url_list[i].in, (int)rc, (int)set_url_list[i].ucode);
       error++;
     }
     curl_url_cleanup(urlp);
@@ -1164,44 +1643,49 @@ static int set_url(void)
    2. Set one or more parts
    3. Extract and compare all parts - not the URL
 */
-static int setget_parts(void)
+static int setget_parts(bool has_utf8)
 {
   int i;
   int error = 0;
 
   for(i = 0; setget_parts_list[i].set && !error; i++) {
-    CURLUcode rc;
     CURLU *urlp = curl_url();
     if(!urlp) {
       error++;
       break;
     }
-    if(setget_parts_list[i].in)
-      rc = curl_url_set(urlp, CURLUPART_URL, setget_parts_list[i].in,
-                        setget_parts_list[i].urlflags);
-    else
-      rc = CURLUE_OK;
-    if(!rc) {
-      char *url = NULL;
-      CURLUcode uc = updateurl(urlp, setget_parts_list[i].set,
-                               setget_parts_list[i].setflags);
+    if((setget_parts_list[i].getflags != CURLU_PUNYCODE &&
+        setget_parts_list[i].getflags != CURLU_PUNY2IDN) || has_utf8) {
+      CURLUcode rc;
+      if(setget_parts_list[i].in)
+        rc = curl_url_set(urlp, CURLUPART_URL, setget_parts_list[i].in,
+                          setget_parts_list[i].urlflags);
+      else
+        rc = CURLUE_OK;
+      if(!rc) {
+        CURLUcode uc = updateurl(urlp, setget_parts_list[i].set,
+                                 setget_parts_list[i].setflags);
 
-      if(uc != setget_parts_list[i].pcode) {
-        fprintf(stderr, "updateurl\nin: %s\nreturned %d (expected %d)\n",
-                setget_parts_list[i].set, (int)uc, setget_parts_list[i].pcode);
+        if(uc != setget_parts_list[i].pcode) {
+          curl_mfprintf(stderr,
+                        "updateurl\nin: %s\nreturned %d (expected %d)\n",
+                        setget_parts_list[i].set,
+                        (int)uc, (int)setget_parts_list[i].pcode);
+          error++;
+        }
+        if(!uc) {
+          if(checkparts(urlp,
+                        setget_parts_list[i].set,
+                        setget_parts_list[i].out,
+                        setget_parts_list[i].getflags))
+            error++;        /* add */
+        }
+      }
+      else if(rc != CURLUE_OK) {
+        curl_mfprintf(stderr, "Set parts\nin: %s\nreturned %d (expected %d)\n",
+                      setget_parts_list[i].in, (int)rc, 0);
         error++;
       }
-      if(!uc) {
-        if(checkparts(urlp, setget_parts_list[i].set, setget_parts_list[i].out,
-                      setget_parts_list[i].getflags))
-          error++;        /* add */
-      }
-      curl_free(url);
-    }
-    else if(rc != CURLUE_OK) {
-      fprintf(stderr, "Set parts\nin: %s\nreturned %d (expected %d)\n",
-              setget_parts_list[i].in, (int)rc, 0);
-      error++;
     }
     curl_url_cleanup(urlp);
   }
@@ -1231,17 +1715,17 @@ static int set_parts(void)
                                set_parts_list[i].setflags);
 
       if(uc != set_parts_list[i].pcode) {
-        fprintf(stderr, "updateurl\nin: %s\nreturned %d (expected %d)\n",
-                set_parts_list[i].set, (int)uc, set_parts_list[i].pcode);
+        curl_mfprintf(stderr, "updateurl\nin: %s\nreturned %d (expected %d)\n",
+                      set_parts_list[i].set,
+                      (int)uc, (int)set_parts_list[i].pcode);
         error++;
       }
       if(!uc) {
         /* only do this if it worked */
         rc = curl_url_get(urlp, CURLUPART_URL, &url, 0);
-
         if(rc) {
-          fprintf(stderr, "%s:%d Get URL returned %d (%s)\n",
-                  __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
+          curl_mfprintf(stderr, "%s:%d Get URL returned %d (%s)\n",
+                        __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
           error++;
         }
         else if(checkurl(set_parts_list[i].in, url, set_parts_list[i].out)) {
@@ -1251,8 +1735,9 @@ static int set_parts(void)
       curl_free(url);
     }
     else if(rc != set_parts_list[i].ucode) {
-      fprintf(stderr, "Set parts\nin: %s\nreturned %d (expected %d)\n",
-              set_parts_list[i].in, (int)rc, set_parts_list[i].ucode);
+      curl_mfprintf(stderr, "Set parts\nin: %s\nreturned %d (expected %d)\n",
+                    set_parts_list[i].in,
+                    (int)rc, (int)set_parts_list[i].ucode);
       error++;
     }
     curl_url_cleanup(urlp);
@@ -1260,71 +1745,75 @@ static int set_parts(void)
   return error;
 }
 
-static int get_url(void)
+static int get_url(bool has_utf8)
 {
   int i;
   int error = 0;
   for(i = 0; get_url_list[i].in && !error; i++) {
-    CURLUcode rc;
     CURLU *urlp = curl_url();
     if(!urlp) {
       error++;
       break;
     }
-    rc = curl_url_set(urlp, CURLUPART_URL, get_url_list[i].in,
-                      get_url_list[i].urlflags);
-    if(!rc) {
-      char *url = NULL;
-      rc = curl_url_get(urlp, CURLUPART_URL, &url, get_url_list[i].getflags);
-
-      if(rc) {
-        fprintf(stderr, "%s:%d returned %d (%s). URL: '%s'\n",
-                __FILE__, __LINE__, (int)rc, curl_url_strerror(rc),
-                get_url_list[i].in);
-        error++;
-      }
-      else {
-        if(checkurl(get_url_list[i].in, url, get_url_list[i].out)) {
+    if((get_url_list[i].getflags != CURLU_PUNYCODE &&
+        get_url_list[i].getflags != CURLU_PUNY2IDN) || has_utf8) {
+      CURLUcode rc;
+      rc = curl_url_set(urlp, CURLUPART_URL, get_url_list[i].in,
+                        get_url_list[i].urlflags);
+      if(!rc) {
+        char *url = NULL;
+        rc = curl_url_get(urlp, CURLUPART_URL, &url, get_url_list[i].getflags);
+        if(rc) {
+          curl_mfprintf(stderr, "%s:%d returned %d (%s). URL: '%s'\n",
+                        __FILE__, __LINE__, (int)rc, curl_url_strerror(rc),
+                        get_url_list[i].in);
           error++;
         }
+        else if(checkurl(get_url_list[i].in, url, get_url_list[i].out)) {
+          error++;
+        }
+        curl_free(url);
+      }
+      if(rc != get_url_list[i].ucode) {
+        curl_mfprintf(stderr, "Get URL\nin: %s\nreturned %d (expected %d)\n",
+                      get_url_list[i].in, (int)rc, (int)get_url_list[i].ucode);
+        error++;
       }
-      curl_free(url);
-    }
-    if(rc != get_url_list[i].ucode) {
-      fprintf(stderr, "Get URL\nin: %s\nreturned %d (expected %d)\n",
-              get_url_list[i].in, (int)rc, get_url_list[i].ucode);
-      error++;
     }
     curl_url_cleanup(urlp);
   }
   return error;
 }
 
-static int get_parts(void)
+static int get_parts(bool has_utf8)
 {
   int i;
   int error = 0;
   for(i = 0; get_parts_list[i].in && !error; i++) {
-    CURLUcode rc;
     CURLU *urlp = curl_url();
     if(!urlp) {
       error++;
       break;
     }
-    rc = curl_url_set(urlp, CURLUPART_URL,
+    if((get_parts_list[i].getflags != CURLU_PUNYCODE &&
+        get_parts_list[i].getflags != CURLU_PUNY2IDN) || has_utf8) {
+      CURLUcode rc;
+      rc = curl_url_set(urlp, CURLUPART_URL,
+                        get_parts_list[i].in,
+                        get_parts_list[i].urlflags);
+      if(rc != get_parts_list[i].ucode) {
+        curl_mfprintf(stderr, "Get parts\nin: %s\nreturned %d (expected %d)\n",
                       get_parts_list[i].in,
-                      get_parts_list[i].urlflags);
-    if(rc != get_parts_list[i].ucode) {
-      fprintf(stderr, "Get parts\nin: %s\nreturned %d (expected %d)\n",
-              get_parts_list[i].in, (int)rc, get_parts_list[i].ucode);
-      error++;
+                      (int)rc, (int)get_parts_list[i].ucode);
+        error++;
+      }
+      else if(get_parts_list[i].ucode) {
+        /* the expected error happened */
+      }
+      else if(checkparts(urlp, get_parts_list[i].in, get_parts_list[i].out,
+                         get_parts_list[i].getflags))
+        error++;
     }
-    else if(get_parts_list[i].ucode) {
-      /* the expected error happened */
-    }
-    else if(checkparts(urlp, get_parts_list[i].in, get_parts_list[i].out,
-                       get_parts_list[i].getflags))
-      error++;
     curl_url_cleanup(urlp);
   }
   return error;
@@ -1333,7 +1822,7 @@ static int get_parts(void)
 static const struct querycase append_list[] = {
   {"HTTP://test/?s", "name=joe\x02", "http://test/?s&name=joe%02",
    0, CURLU_URLENCODE, CURLUE_OK},
-  {"HTTP://test/?size=2#f", "name=joe=", "http://test/?size=2&name=joe%3d#f",
+  {"HTTP://test/?size=2#f", "name=joe=", "http://test/?size=2&name=joe%3D#f",
    0, CURLU_URLENCODE, CURLUE_OK},
   {"HTTP://test/?size=2#f", "name=joe doe",
    "http://test/?size=2&name=joe+doe#f",
@@ -1371,8 +1860,8 @@ static int append(void)
     if(error)
       ;
     else if(rc != append_list[i].ucode) {
-      fprintf(stderr, "Append\nin: %s\nreturned %d (expected %d)\n",
-              append_list[i].in, (int)rc, append_list[i].ucode);
+      curl_mfprintf(stderr, "Append\nin: %s\nreturned %d (expected %d)\n",
+                    append_list[i].in, (int)rc, (int)append_list[i].ucode);
       error++;
     }
     else if(append_list[i].ucode) {
@@ -1382,8 +1871,8 @@ static int append(void)
       char *url;
       rc = curl_url_get(urlp, CURLUPART_URL, &url, 0);
       if(rc) {
-        fprintf(stderr, "%s:%d Get URL returned %d (%s)\n",
-                __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
+        curl_mfprintf(stderr, "%s:%d Get URL returned %d (%s)\n",
+                      __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
         error++;
       }
       else {
@@ -1404,19 +1893,22 @@ static int scopeid(void)
   int error = 0;
   CURLUcode rc;
   char *url;
+  if(!u)
+    return 1;
 
   rc = curl_url_set(u, CURLUPART_URL,
                     "https://[fe80::20c:29ff:fe9c:409b%25eth0]/hello.html", 0);
   if(rc != CURLUE_OK) {
-    fprintf(stderr, "%s:%d curl_url_set returned %d (%s)\n",
-            __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
+    curl_mfprintf(stderr, "%s:%d curl_url_set returned %d (%s)\n",
+                  __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
     error++;
   }
 
   rc = curl_url_get(u, CURLUPART_HOST, &url, 0);
   if(rc != CURLUE_OK) {
-    fprintf(stderr, "%s:%d curl_url_get CURLUPART_HOST returned %d (%s)\n",
-            __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
+    curl_mfprintf(stderr,
+                  "%s:%d curl_url_get CURLUPART_HOST returned %d (%s)\n",
+                  __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
     error++;
   }
   else {
@@ -1425,15 +1917,17 @@ static int scopeid(void)
 
   rc = curl_url_set(u, CURLUPART_HOST, "[::1]", 0);
   if(rc != CURLUE_OK) {
-    fprintf(stderr, "%s:%d curl_url_set CURLUPART_HOST returned %d (%s)\n",
-            __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
+    curl_mfprintf(stderr,
+                  "%s:%d curl_url_set CURLUPART_HOST returned %d (%s)\n",
+                  __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
     error++;
   }
 
   rc = curl_url_get(u, CURLUPART_URL, &url, 0);
   if(rc != CURLUE_OK) {
-    fprintf(stderr, "%s:%d curl_url_get CURLUPART_URL returned %d (%s)\n",
-            __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
+    curl_mfprintf(stderr,
+                  "%s:%d curl_url_get CURLUPART_URL returned %d (%s)\n",
+                  __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
     error++;
   }
   else {
@@ -1442,33 +1936,36 @@ static int scopeid(void)
 
   rc = curl_url_set(u, CURLUPART_HOST, "example.com", 0);
   if(rc != CURLUE_OK) {
-    fprintf(stderr, "%s:%d curl_url_set CURLUPART_HOST returned %d (%s)\n",
-            __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
+    curl_mfprintf(stderr,
+                  "%s:%d curl_url_set CURLUPART_HOST returned %d (%s)\n",
+                  __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
     error++;
   }
 
   rc = curl_url_get(u, CURLUPART_URL, &url, 0);
   if(rc != CURLUE_OK) {
-    fprintf(stderr, "%s:%d curl_url_get CURLUPART_URL returned %d (%s)\n",
-            __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
+    curl_mfprintf(stderr,
+                  "%s:%d curl_url_get CURLUPART_URL returned %d (%s)\n",
+                  __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
     error++;
   }
   else {
     curl_free(url);
   }
 
-  rc = curl_url_set(u, CURLUPART_HOST,
-                    "[fe80::20c:29ff:fe9c:409b%25eth0]", 0);
+  rc = curl_url_set(u, CURLUPART_HOST, "[fe80::20c:29ff:fe9c:409b%25eth0]", 0);
   if(rc != CURLUE_OK) {
-    fprintf(stderr, "%s:%d curl_url_set CURLUPART_HOST returned %d (%s)\n",
-            __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
+    curl_mfprintf(stderr,
+                  "%s:%d curl_url_set CURLUPART_HOST returned %d (%s)\n",
+                  __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
     error++;
   }
 
   rc = curl_url_get(u, CURLUPART_URL, &url, 0);
   if(rc != CURLUE_OK) {
-    fprintf(stderr, "%s:%d curl_url_get CURLUPART_URL returned %d (%s)\n",
-            __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
+    curl_mfprintf(stderr,
+                  "%s:%d curl_url_get CURLUPART_URL returned %d (%s)\n",
+                  __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
     error++;
   }
   else {
@@ -1477,8 +1974,9 @@ static int scopeid(void)
 
   rc = curl_url_get(u, CURLUPART_HOST, &url, 0);
   if(rc != CURLUE_OK) {
-    fprintf(stderr, "%s:%d curl_url_get CURLUPART_HOST returned %d (%s)\n",
-            __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
+    curl_mfprintf(stderr,
+                  "%s:%d curl_url_get CURLUPART_HOST returned %d (%s)\n",
+                  __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
     error++;
   }
   else {
@@ -1487,8 +1985,9 @@ static int scopeid(void)
 
   rc = curl_url_get(u, CURLUPART_ZONEID, &url, 0);
   if(rc != CURLUE_OK) {
-    fprintf(stderr, "%s:%d curl_url_get CURLUPART_ZONEID returned %d (%s)\n",
-            __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
+    curl_mfprintf(stderr,
+                  "%s:%d curl_url_get CURLUPART_ZONEID returned %d (%s)\n",
+                  __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
     error++;
   }
   else {
@@ -1497,15 +1996,17 @@ static int scopeid(void)
 
   rc = curl_url_set(u, CURLUPART_ZONEID, "clown", 0);
   if(rc != CURLUE_OK) {
-    fprintf(stderr, "%s:%d curl_url_set CURLUPART_ZONEID returned %d (%s)\n",
-            __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
+    curl_mfprintf(stderr,
+                  "%s:%d curl_url_set CURLUPART_ZONEID returned %d (%s)\n",
+                  __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
     error++;
   }
 
   rc = curl_url_get(u, CURLUPART_URL, &url, 0);
   if(rc != CURLUE_OK) {
-    fprintf(stderr, "%s:%d curl_url_get CURLUPART_URL returned %d (%s)\n",
-            __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
+    curl_mfprintf(stderr,
+                  "%s:%d curl_url_get CURLUPART_URL returned %d (%s)\n",
+                  __FILE__, __LINE__, (int)rc, curl_url_strerror(rc));
     error++;
   }
   else {
@@ -1520,95 +2021,127 @@ static int scopeid(void)
 static int get_nothing(void)
 {
   CURLU *u = curl_url();
-  if(u) {
-    char *p;
-    CURLUcode rc;
+  int error = 0;
+  CURLUcode rc;
+  char *p = NULL;
+  if(!u)
+    return 1;
 
-    rc = curl_url_get(u, CURLUPART_SCHEME, &p, 0);
-    if(rc != CURLUE_NO_SCHEME)
-      fprintf(stderr, "unexpected return code line %u\n", __LINE__);
-
-    rc = curl_url_get(u, CURLUPART_HOST, &p, 0);
-    if(rc != CURLUE_NO_HOST)
-      fprintf(stderr, "unexpected return code line %u\n", __LINE__);
-
-    rc = curl_url_get(u, CURLUPART_USER, &p, 0);
-    if(rc != CURLUE_NO_USER)
-      fprintf(stderr, "unexpected return code line %u\n", __LINE__);
-
-    rc = curl_url_get(u, CURLUPART_PASSWORD, &p, 0);
-    if(rc != CURLUE_NO_PASSWORD)
-      fprintf(stderr, "unexpected return code line %u\n", __LINE__);
-
-    rc = curl_url_get(u, CURLUPART_OPTIONS, &p, 0);
-    if(rc != CURLUE_NO_OPTIONS)
-      fprintf(stderr, "unexpected return code line %u\n", __LINE__);
-
-    rc = curl_url_get(u, CURLUPART_PATH, &p, 0);
-    if(rc != CURLUE_OK)
-      fprintf(stderr, "unexpected return code line %u\n", __LINE__);
-    else
-      curl_free(p);
-
-    rc = curl_url_get(u, CURLUPART_QUERY, &p, 0);
-    if(rc != CURLUE_NO_QUERY)
-      fprintf(stderr, "unexpected return code line %u\n", __LINE__);
-
-    rc = curl_url_get(u, CURLUPART_FRAGMENT, &p, 0);
-    if(rc != CURLUE_NO_FRAGMENT)
-      fprintf(stderr, "unexpected return code line %u\n", __LINE__);
-
-    rc = curl_url_get(u, CURLUPART_ZONEID, &p, 0);
-    if(rc != CURLUE_NO_ZONEID)
-      fprintf(stderr, "unexpected return code %u on line %u\n", (int)rc,
-              __LINE__);
-
-    curl_url_cleanup(u);
+  rc = curl_url_get(u, CURLUPART_SCHEME, &p, 0);
+  if(rc != CURLUE_NO_SCHEME) {
+    curl_mfprintf(stderr, "unexpected return code line %d\n", __LINE__);
+    error++;
+    curl_free(p);
   }
-  return 0;
+
+  rc = curl_url_get(u, CURLUPART_HOST, &p, 0);
+  if(rc != CURLUE_NO_HOST) {
+    curl_mfprintf(stderr, "unexpected return code line %d\n", __LINE__);
+    error++;
+    curl_free(p);
+  }
+
+  rc = curl_url_get(u, CURLUPART_USER, &p, 0);
+  if(rc != CURLUE_NO_USER) {
+    curl_mfprintf(stderr, "unexpected return code line %d\n", __LINE__);
+    error++;
+    curl_free(p);
+  }
+
+  rc = curl_url_get(u, CURLUPART_PASSWORD, &p, 0);
+  if(rc != CURLUE_NO_PASSWORD) {
+    curl_mfprintf(stderr, "unexpected return code line %d\n", __LINE__);
+    error++;
+    curl_free(p);
+  }
+
+  rc = curl_url_get(u, CURLUPART_OPTIONS, &p, 0);
+  if(rc != CURLUE_NO_OPTIONS) {
+    curl_mfprintf(stderr, "unexpected return code line %d\n", __LINE__);
+    error++;
+    curl_free(p);
+  }
+
+  rc = curl_url_get(u, CURLUPART_PATH, &p, 0);
+  if(rc != CURLUE_OK) {
+    curl_mfprintf(stderr, "unexpected return code line %d\n", __LINE__);
+    error++;
+  }
+  else
+    curl_free(p);
+
+  rc = curl_url_get(u, CURLUPART_QUERY, &p, 0);
+  if(rc != CURLUE_NO_QUERY) {
+    curl_mfprintf(stderr, "unexpected return code line %d\n", __LINE__);
+    error++;
+    curl_free(p);
+  }
+
+  rc = curl_url_get(u, CURLUPART_FRAGMENT, &p, 0);
+  if(rc != CURLUE_NO_FRAGMENT) {
+    curl_mfprintf(stderr, "unexpected return code line %d\n", __LINE__);
+    error++;
+    curl_free(p);
+  }
+
+  rc = curl_url_get(u, CURLUPART_ZONEID, &p, 0);
+  if(rc != CURLUE_NO_ZONEID) {
+    curl_mfprintf(stderr, "unexpected return code %d on line %d\n", (int)rc,
+                  __LINE__);
+    error++;
+    curl_free(p);
+  }
+
+  curl_url_cleanup(u);
+
+  return error;
 }
 
-static const struct clearurlcase clear_url_list[] ={
-  {CURLUPART_SCHEME, "http", NULL, CURLUE_NO_SCHEME},
-  {CURLUPART_USER, "user", NULL, CURLUE_NO_USER},
-  {CURLUPART_PASSWORD, "password", NULL, CURLUE_NO_PASSWORD},
-  {CURLUPART_OPTIONS, "options", NULL, CURLUE_NO_OPTIONS},
-  {CURLUPART_HOST, "host", NULL, CURLUE_NO_HOST},
-  {CURLUPART_ZONEID, "eth0", NULL, CURLUE_NO_ZONEID},
-  {CURLUPART_PORT, "1234", NULL, CURLUE_NO_PORT},
-  {CURLUPART_PATH, "/hello", "/", CURLUE_OK},
-  {CURLUPART_QUERY, "a=b", NULL, CURLUE_NO_QUERY},
-  {CURLUPART_FRAGMENT, "anchor", NULL, CURLUE_NO_FRAGMENT},
-  {CURLUPART_URL, NULL, NULL, CURLUE_OK},
+static const struct clearurlcase clear_url_list[] = {
+  { CURLUPART_SCHEME, "http", NULL, CURLUE_NO_SCHEME },
+  { CURLUPART_USER, "user", NULL, CURLUE_NO_USER },
+  { CURLUPART_PASSWORD, "password", NULL, CURLUE_NO_PASSWORD },
+  { CURLUPART_OPTIONS, "options", NULL, CURLUE_NO_OPTIONS },
+  { CURLUPART_HOST, "host", NULL, CURLUE_NO_HOST },
+  { CURLUPART_ZONEID, "eth0", NULL, CURLUE_NO_ZONEID },
+  { CURLUPART_PORT, "1234", NULL, CURLUE_NO_PORT },
+  { CURLUPART_PATH, "/hello", "/", CURLUE_OK },
+  { CURLUPART_QUERY, "a=b", NULL, CURLUE_NO_QUERY },
+  { CURLUPART_FRAGMENT, "anchor", NULL, CURLUE_NO_FRAGMENT },
+  { CURLUPART_URL, NULL, NULL, CURLUE_OK },
 };
 
 static int clear_url(void)
 {
   CURLU *u = curl_url();
   int i, error = 0;
-  if(u) {
-    char *p = NULL;
-    CURLUcode rc;
+  CURLUcode rc;
+  char *p = NULL;
+  if(!u)
+    return 1;
 
-    for(i = 0; clear_url_list[i].in && !error; i++) {
-      rc = curl_url_set(u, clear_url_list[i].part, clear_url_list[i].in, 0);
-      if(rc != CURLUE_OK)
-        fprintf(stderr, "unexpected return code line %u\n", __LINE__);
-
-      rc = curl_url_set(u, CURLUPART_URL, NULL, 0);
-      if(rc != CURLUE_OK)
-        fprintf(stderr, "unexpected return code line %u\n", __LINE__);
-
-      rc = curl_url_get(u, clear_url_list[i].part, &p, 0);
-      if(rc != clear_url_list[i].ucode || (clear_url_list[i].out &&
-         0 != strcmp(p, clear_url_list[i].out))) {
-
-        fprintf(stderr, "unexpected return code line %u\n", __LINE__);
-        error++;
-      }
-      if(rc == CURLUE_OK)
-        curl_free(p);
+  for(i = 0; clear_url_list[i].in && !error; i++) {
+    rc = curl_url_set(u, clear_url_list[i].part, clear_url_list[i].in, 0);
+    if(rc != CURLUE_OK) {
+      curl_mfprintf(stderr, "unexpected return code line %d\n", __LINE__);
+      error++;
     }
+
+    rc = curl_url_set(u, CURLUPART_URL, NULL, 0);
+    if(rc != CURLUE_OK) {
+      curl_mfprintf(stderr, "unexpected return code line %d\n", __LINE__);
+      error++;
+    }
+
+    rc = curl_url_get(u, clear_url_list[i].part, &p, 0);
+    if(rc != clear_url_list[i].ucode ||
+       (p && clear_url_list[i].out && strcmp(p, clear_url_list[i].out))) {
+
+      curl_mfprintf(stderr, "unexpected return code line %d\n", __LINE__);
+      error++;
+    }
+    if(rc == CURLUE_OK)
+      curl_free(p);
   }
 
   curl_url_cleanup(u);
@@ -1624,12 +2157,11 @@ static char bigpart[120000];
  */
 static int huge(void)
 {
-  const char *url = "%s://%s:%s@%s/%s?%s#%s";
-  const char *smallpart = "c";
+  static const char *smallpart = "c";
   int i;
   CURLU *urlp = curl_url();
   CURLUcode rc;
-  CURLUPart part[]= {
+  CURLUPart part[] = {
     CURLUPART_SCHEME,
     CURLUPART_USER,
     CURLUPART_PASSWORD,
@@ -1645,21 +2177,21 @@ static int huge(void)
   memset(&bigpart[1], 'a', sizeof(bigpart) - 2);
   bigpart[sizeof(bigpart) - 1] = 0;
 
-  for(i = 0; i <  7; i++) {
+  for(i = 0; i < 7; i++) {
     char *partp;
-    msnprintf(total, sizeof(total),
-              url,
-              (i == 0)? &bigpart[1] : smallpart,
-              (i == 1)? &bigpart[1] : smallpart,
-              (i == 2)? &bigpart[1] : smallpart,
-              (i == 3)? &bigpart[1] : smallpart,
-              (i == 4)? &bigpart[1] : smallpart,
-              (i == 5)? &bigpart[1] : smallpart,
-              (i == 6)? &bigpart[1] : smallpart);
+    curl_msnprintf(total, sizeof(total),
+                   "%s://%s:%s@%s/%s?%s#%s",
+                   (i == 0) ? &bigpart[1] : smallpart,
+                   (i == 1) ? &bigpart[1] : smallpart,
+                   (i == 2) ? &bigpart[1] : smallpart,
+                   (i == 3) ? &bigpart[1] : smallpart,
+                   (i == 4) ? &bigpart[1] : smallpart,
+                   (i == 5) ? &bigpart[1] : smallpart,
+                   (i == 6) ? &bigpart[1] : smallpart);
     rc = curl_url_set(urlp, CURLUPART_URL, total, CURLU_NON_SUPPORT_SCHEME);
     if((!i && (rc != CURLUE_BAD_SCHEME)) ||
        (i && rc)) {
-      printf("URL %u: failed to parse [%s]\n", i, total);
+      curl_mprintf("URL %d: failed to parse [%s]\n", i, total);
       error++;
     }
 
@@ -1667,7 +2199,7 @@ static int huge(void)
     if(!rc) {
       curl_url_get(urlp, part[i], &partp, 0);
       if(!partp || strcmp(partp, &bigpart[1 - (i == 4)])) {
-        printf("URL %u part %u: failure\n", i, part[i]);
+        curl_mprintf("URL %d part %d: failure\n", i, (int)part[i]);
         error++;
       }
       curl_free(partp);
@@ -1679,7 +2211,7 @@ static int huge(void)
 
 static int urldup(void)
 {
-  const char *url[] = {
+  static const char *url[] = {
     "http://"
     "user:pwd@"
     "[2a04:4e42:e00::347%25eth0]"
@@ -1705,8 +2237,7 @@ static int urldup(void)
     goto err;
 
   for(i = 0; url[i]; i++) {
-    CURLUcode rc = curl_url_set(h, CURLUPART_URL, url[i],
-                                CURLU_GUESS_SCHEME);
+    CURLUcode rc = curl_url_set(h, CURLUPART_URL, url[i], CURLU_GUESS_SCHEME);
     if(rc)
       goto err;
     copy = curl_url_dup(h);
@@ -1720,8 +2251,8 @@ static int urldup(void)
       goto err;
 
     if(strcmp(h_str, copy_str)) {
-      printf("Original:  %s\nParsed:    %s\nCopy:      %s\n",
-             url[i], h_str, copy_str);
+      curl_mprintf("Original:  %s\nParsed:    %s\nCopy:      %s\n",
+                   url[i], h_str, copy_str);
       goto err;
     }
     curl_free(copy_str);
@@ -1741,43 +2272,80 @@ err:
   return 1;
 }
 
-int test(char *URL)
+static int test_api_errors(void)
 {
-  (void)URL; /* not used */
-
-  if(urldup())
-    return 11;
-
-  if(setget_parts())
-    return 10;
-
-  if(get_url())
-    return 3;
-
-  if(huge())
-    return 9;
-
-  if(get_nothing())
-    return 7;
-
-  if(scopeid())
-    return 6;
-
-  if(append())
-    return 5;
-
-  if(set_url())
+  CURLU *u = curl_url();
+  char *p = NULL;
+  CURLUcode rc;
+  if(!u)
     return 1;
 
-  if(set_parts())
+  /* NULL handle */
+  rc = curl_url_get(NULL, CURLUPART_URL, &p, 0);
+  if(rc != CURLUE_BAD_HANDLE)
+    return 1;
+
+  rc = curl_url_set(NULL, CURLUPART_URL, "http://example.com", 0);
+  if(rc != CURLUE_BAD_HANDLE)
+    return 1;
+
+  /* NULL part pointer */
+  rc = curl_url_get(u, CURLUPART_URL, NULL, 0);
+  if(rc != CURLUE_BAD_PARTPOINTER)
     return 2;
 
-  if(get_parts())
-    return 4;
+  /* Unknown part */
+  /* NOLINTNEXTLINE(clang-analyzer-optin.core.EnumCastOutOfRange) */
+  rc = curl_url_get(u, (CURLUPart)12345, &p, 0);
+  if(rc != CURLUE_UNKNOWN_PART)
+    return 3;
 
-  if(clear_url())
-    return 8;
-
-  printf("success\n");
+  curl_url_cleanup(u);
   return 0;
 }
+
+static CURLcode test_lib1560(const char *URL)
+{
+  bool has_utf8 = !!getenv("CURL_TEST_HAVE_CODESET_UTF8");
+
+  (void)URL;
+
+  if(test_api_errors())
+    return (CURLcode)12;
+
+  if(urldup())
+    return (CURLcode)11;
+
+  if(setget_parts(has_utf8))
+    return (CURLcode)10;
+
+  if(get_url(has_utf8))
+    return (CURLcode)3;
+
+  if(huge())
+    return (CURLcode)9;
+
+  if(get_nothing())
+    return (CURLcode)7;
+
+  if(scopeid())
+    return (CURLcode)6;
+
+  if(append())
+    return (CURLcode)5;
+
+  if(set_url())
+    return (CURLcode)1;
+
+  if(set_parts())
+    return (CURLcode)2;
+
+  if(get_parts(has_utf8))
+    return (CURLcode)4;
+
+  if(clear_url())
+    return (CURLcode)8;
+
+  curl_mprintf("success\n");
+  return CURLE_OK;
+}
diff --git a/third-party/curl/tests/libtest/lib1564.c b/third-party/curl/tests/libtest/lib1564.c
index b10d034414..573ec91711 100644
--- a/third-party/curl/tests/libtest/lib1564.c
+++ b/third-party/curl/tests/libtest/lib1564.c
@@ -21,22 +21,17 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
 #define WAKEUP_NUM 10
 
-int test(char *URL)
+static CURLcode test_lib1564(const char *URL)
 {
   CURLM *multi = NULL;
   int numfds;
   int i;
-  int res = 0;
-  struct timeval time_before_wait, time_after_wait;
+  CURLcode result = CURLE_OK;
+  struct curltime time_before_wait, time_after_wait;
 
   (void)URL;
 
@@ -48,14 +43,14 @@ int test(char *URL)
 
   /* no wakeup */
 
-  time_before_wait = tutil_tvnow();
+  time_before_wait = curlx_now();
   multi_poll(multi, NULL, 0, 1000, &numfds);
-  time_after_wait = tutil_tvnow();
+  time_after_wait = curlx_now();
 
-  if(tutil_tvdiff(time_after_wait, time_before_wait) < 500) {
-    fprintf(stderr, "%s:%d curl_multi_poll returned too early\n",
-            __FILE__, __LINE__);
-    res = TEST_ERR_MAJOR_BAD;
+  if(curlx_timediff_ms(time_after_wait, time_before_wait) < 500) {
+    curl_mfprintf(stderr, "%s:%d curl_multi_poll returned too early\n",
+                  __FILE__, __LINE__);
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
 
@@ -65,14 +60,14 @@ int test(char *URL)
 
   res_multi_wakeup(multi);
 
-  time_before_wait = tutil_tvnow();
+  time_before_wait = curlx_now();
   multi_poll(multi, NULL, 0, 1000, &numfds);
-  time_after_wait = tutil_tvnow();
+  time_after_wait = curlx_now();
 
-  if(tutil_tvdiff(time_after_wait, time_before_wait) > 500) {
-    fprintf(stderr, "%s:%d curl_multi_poll returned too late\n",
-            __FILE__, __LINE__);
-    res = TEST_ERR_MAJOR_BAD;
+  if(curlx_timediff_ms(time_after_wait, time_before_wait) > 500) {
+    curl_mfprintf(stderr, "%s:%d curl_multi_poll returned too late\n",
+                  __FILE__, __LINE__);
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
 
@@ -80,14 +75,14 @@ int test(char *URL)
 
   /* previous wakeup should not wake up this */
 
-  time_before_wait = tutil_tvnow();
+  time_before_wait = curlx_now();
   multi_poll(multi, NULL, 0, 1000, &numfds);
-  time_after_wait = tutil_tvnow();
+  time_after_wait = curlx_now();
 
-  if(tutil_tvdiff(time_after_wait, time_before_wait) < 500) {
-    fprintf(stderr, "%s:%d curl_multi_poll returned too early\n",
-            __FILE__, __LINE__);
-    res = TEST_ERR_MAJOR_BAD;
+  if(curlx_timediff_ms(time_after_wait, time_before_wait) < 500) {
+    curl_mfprintf(stderr, "%s:%d curl_multi_poll returned too early\n",
+                  __FILE__, __LINE__);
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
 
@@ -98,14 +93,14 @@ int test(char *URL)
   for(i = 0; i < WAKEUP_NUM; ++i)
     res_multi_wakeup(multi);
 
-  time_before_wait = tutil_tvnow();
+  time_before_wait = curlx_now();
   multi_poll(multi, NULL, 0, 1000, &numfds);
-  time_after_wait = tutil_tvnow();
+  time_after_wait = curlx_now();
 
-  if(tutil_tvdiff(time_after_wait, time_before_wait) > 500) {
-    fprintf(stderr, "%s:%d curl_multi_poll returned too late\n",
-            __FILE__, __LINE__);
-    res = TEST_ERR_MAJOR_BAD;
+  if(curlx_timediff_ms(time_after_wait, time_before_wait) > 500) {
+    curl_mfprintf(stderr, "%s:%d curl_multi_poll returned too late\n",
+                  __FILE__, __LINE__);
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
 
@@ -113,14 +108,14 @@ int test(char *URL)
 
   /* Even lots of previous wakeups should not wake up this. */
 
-  time_before_wait = tutil_tvnow();
+  time_before_wait = curlx_now();
   multi_poll(multi, NULL, 0, 1000, &numfds);
-  time_after_wait = tutil_tvnow();
+  time_after_wait = curlx_now();
 
-  if(tutil_tvdiff(time_after_wait, time_before_wait) < 500) {
-    fprintf(stderr, "%s:%d curl_multi_poll returned too early\n",
-            __FILE__, __LINE__);
-    res = TEST_ERR_MAJOR_BAD;
+  if(curlx_timediff_ms(time_after_wait, time_before_wait) < 500) {
+    curl_mfprintf(stderr, "%s:%d curl_multi_poll returned too early\n",
+                  __FILE__, __LINE__);
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
 
@@ -131,5 +126,5 @@ test_cleanup:
   curl_multi_cleanup(multi);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1565.c b/third-party/curl/tests/libtest/lib1565.c
index 9003951471..825d88e2ed 100644
--- a/third-party/curl/tests/libtest/lib1565.c
+++ b/third-party/curl/tests/libtest/lib1565.c
@@ -21,121 +21,117 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
+#ifdef HAVE_THREADS_POSIX
 
-#ifdef HAVE_PTHREAD_H
-#include <pthread.h>
-#include <unistd.h>
-
-#define TEST_HANG_TIMEOUT 60 * 1000
-#define CONN_NUM 3
+#define CONN_NUM                3
 #define TIME_BETWEEN_START_SECS 2
 
 static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
-static CURL *pending_handles[CONN_NUM];
+static CURL *pending_curls[CONN_NUM];
 static int pending_num = 0;
-static int test_failure = 0;
+static CURLcode t1565_test_failure = CURLE_OK;
 
-static CURLM *multi = NULL;
-static const char *url;
+static CURLM *testmulti = NULL;
+static const char *t1565_url;
 
-static void *run_thread(void *ptr)
+static void *t1565_run_thread(void *ptr)
 {
-  CURL *easy = NULL;
-  int res = 0;
+  CURL *curl = NULL;
+  CURLcode result = CURLE_OK;
   int i;
 
   (void)ptr;
 
   for(i = 0; i < CONN_NUM; i++) {
-    wait_ms(TIME_BETWEEN_START_SECS * 1000);
+    curlx_wait_ms(TIME_BETWEEN_START_SECS * 1000);
 
-    easy_init(easy);
+    easy_init(curl);
 
-    easy_setopt(easy, CURLOPT_URL, url);
-    easy_setopt(easy, CURLOPT_VERBOSE, 0L);
+    easy_setopt(curl, CURLOPT_URL, t1565_url);
+    easy_setopt(curl, CURLOPT_VERBOSE, 0L);
 
     pthread_mutex_lock(&lock);
 
-    if(test_failure) {
+    if(t1565_test_failure) {
       pthread_mutex_unlock(&lock);
       goto test_cleanup;
     }
 
-    pending_handles[pending_num] = easy;
+    pending_curls[pending_num] = curl;
     pending_num++;
-    easy = NULL;
+    curl = NULL;
 
     pthread_mutex_unlock(&lock);
 
-    res_multi_wakeup(multi);
+    res_multi_wakeup(testmulti);
   }
 
 test_cleanup:
 
-  curl_easy_cleanup(easy);
+  curl_easy_cleanup(curl);
 
   pthread_mutex_lock(&lock);
 
-  if(!test_failure)
-    test_failure = res;
+  if(!t1565_test_failure)
+    t1565_test_failure = result;
 
   pthread_mutex_unlock(&lock);
 
   return NULL;
 }
 
-int test(char *URL)
+static CURLcode test_lib1565(const char *URL)
 {
   int still_running;
   int num;
   int i;
-  int res = 0;
-  CURL *started_handles[CONN_NUM];
+  int rc;
+  CURLcode result = CURLE_OK;
+  CURL *started_curls[CONN_NUM];
   int started_num = 0;
   int finished_num = 0;
-  pthread_t tid;
-  bool tid_valid = false;
+  pthread_t tid = 0;
+  bool tid_valid = FALSE;
   struct CURLMsg *message;
 
   start_test_timing();
 
   global_init(CURL_GLOBAL_ALL);
 
-  multi_init(multi);
+  multi_init(testmulti);
 
-  url = URL;
+  t1565_url = URL;
 
-  res = pthread_create(&tid, NULL, run_thread, NULL);
-  if(!res)
-    tid_valid = true;
+  rc = pthread_create(&tid, NULL, t1565_run_thread, NULL);
+  if(!rc)
+    tid_valid = TRUE;
   else {
-    fprintf(stderr, "%s:%d Couldn't create thread, errno %d\n",
-            __FILE__, __LINE__, res);
+    curl_mfprintf(stderr, "%s:%d Could not create thread, errno %d\n",
+                  __FILE__, __LINE__, rc);
+    result = CURLE_FAILED_INIT;
     goto test_cleanup;
   }
 
   while(1) {
-    multi_perform(multi, &still_running);
+    multi_perform(testmulti, &still_running);
 
     abort_on_test_timeout();
 
-    while((message = curl_multi_info_read(multi, &num))) {
+    while((message = curl_multi_info_read(testmulti, &num))) {
       if(message->msg == CURLMSG_DONE) {
-        res = message->data.result;
-        if(res)
+        result = message->data.result;
+        if(result)
           goto test_cleanup;
-        multi_remove_handle(multi, message->easy_handle);
+        multi_remove_handle(testmulti, message->easy_handle);
         finished_num++;
       }
       else {
-        fprintf(stderr, "%s:%d Got an unexpected message from curl: %i\n",
-              __FILE__, __LINE__, (int)message->msg);
-        res = TEST_ERR_MAJOR_BAD;
+        curl_mfprintf(stderr,
+                      "%s:%d Got an unexpected message from curl: %d\n",
+                      __FILE__, __LINE__, (int)message->msg);
+        result = TEST_ERR_MAJOR_BAD;
         goto test_cleanup;
       }
 
@@ -145,20 +141,20 @@ int test(char *URL)
     if(CONN_NUM == finished_num)
       break;
 
-    multi_poll(multi, NULL, 0, TEST_HANG_TIMEOUT, &num);
+    multi_poll(testmulti, NULL, 0, TEST_HANG_TIMEOUT, &num);
 
     abort_on_test_timeout();
 
     pthread_mutex_lock(&lock);
 
     while(pending_num > 0) {
-      res_multi_add_handle(multi, pending_handles[pending_num - 1]);
-      if(res) {
+      res_multi_add_handle(testmulti, pending_curls[pending_num - 1]);
+      if(result) {
         pthread_mutex_unlock(&lock);
         goto test_cleanup;
       }
 
-      started_handles[started_num] = pending_handles[pending_num - 1];
+      started_curls[started_num] = pending_curls[pending_num - 1];
       started_num++;
       pending_num--;
     }
@@ -169,41 +165,41 @@ int test(char *URL)
   }
 
   if(CONN_NUM != started_num) {
-    fprintf(stderr, "%s:%d Not all connections started: %d of %d\n",
-            __FILE__, __LINE__, started_num, CONN_NUM);
+    curl_mfprintf(stderr, "%s:%d Not all connections started: %d of %d\n",
+                  __FILE__, __LINE__, started_num, CONN_NUM);
     goto test_cleanup;
   }
 
   if(CONN_NUM != finished_num) {
-    fprintf(stderr, "%s:%d Not all connections finished: %d of %d\n",
-            __FILE__, __LINE__, started_num, CONN_NUM);
+    curl_mfprintf(stderr, "%s:%d Not all connections finished: %d of %d\n",
+                  __FILE__, __LINE__, started_num, CONN_NUM);
     goto test_cleanup;
   }
 
 test_cleanup:
 
   pthread_mutex_lock(&lock);
-  if(!test_failure)
-    test_failure = res;
+  if(!t1565_test_failure)
+    t1565_test_failure = result;
   pthread_mutex_unlock(&lock);
 
   if(tid_valid)
     pthread_join(tid, NULL);
 
-  curl_multi_cleanup(multi);
+  curl_multi_cleanup(testmulti);
   for(i = 0; i < pending_num; i++)
-    curl_easy_cleanup(pending_handles[i]);
+    curl_easy_cleanup(pending_curls[i]);
   for(i = 0; i < started_num; i++)
-    curl_easy_cleanup(started_handles[i]);
+    curl_easy_cleanup(started_curls[i]);
   curl_global_cleanup();
 
-  return test_failure;
+  return t1565_test_failure;
 }
 
-#else /* without pthread, this test doesn't work */
-int test(char *URL)
+#else /* without pthread, this test does not work */
+static CURLcode test_lib1565(const char *URL)
 {
   (void)URL;
-  return 0;
+  return CURLE_OK;
 }
 #endif
diff --git a/third-party/curl/tests/libtest/lib1567.c b/third-party/curl/tests/libtest/lib1567.c
index 82f2f014ac..7d4d623350 100644
--- a/third-party/curl/tests/libtest/lib1567.c
+++ b/third-party/curl/tests/libtest/lib1567.c
@@ -21,34 +21,37 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "memdebug.h"
+#include "first.h"
 
 #include <curl/multi.h>
 
-int test(char *URL)
+static CURLcode test_lib1567(const char *URL)
 {
-  CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURL *curl = NULL;
+  CURLcode result = CURLE_OK;
+  CURLU *u = NULL;
 
   global_init(CURL_GLOBAL_ALL);
   curl = curl_easy_init();
   if(curl) {
-    CURLU *u = curl_url();
+    u = curl_url();
     if(u) {
       curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
       curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
       curl_url_set(u, CURLUPART_URL, URL, 0);
       curl_easy_setopt(curl, CURLOPT_CURLU, u);
-      res = curl_easy_perform(curl);
+      result = curl_easy_perform(curl);
+      if(result)
+        goto test_cleanup;
 
-      fprintf(stderr, "****************************** Do it again\n");
-      res = curl_easy_perform(curl);
-      curl_url_cleanup(u);
+      curl_mfprintf(stderr, "****************************** Do it again\n");
+      result = curl_easy_perform(curl);
     }
-    curl_easy_cleanup(curl);
   }
+
+test_cleanup:
+  curl_url_cleanup(u);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1568.c b/third-party/curl/tests/libtest/lib1568.c
index 78e7e6b8a5..68c1734ede 100644
--- a/third-party/curl/tests/libtest/lib1568.c
+++ b/third-party/curl/tests/libtest/lib1568.c
@@ -21,32 +21,34 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testtrace.h"
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1568(const char *URL)
 {
-  CURLcode ret;
-  CURL *hnd;
-  curl_global_init(CURL_GLOBAL_ALL);
+  CURLcode result = TEST_ERR_MAJOR_BAD;
+  CURL *curl;
+  curl_off_t port;
 
-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_URL, URL);
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_HEADER, 1L);
-  curl_easy_setopt(hnd, CURLOPT_USERPWD, "testuser:testpass");
-  curl_easy_setopt(hnd, CURLOPT_USERAGENT, "lib1568");
-  curl_easy_setopt(hnd, CURLOPT_HTTPAUTH, (long)CURLAUTH_DIGEST);
-  curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
-  curl_easy_setopt(hnd, CURLOPT_PORT, strtol(libtest_arg2, NULL, 10));
+  if(curlx_str_number(&libtest_arg2, &port, 0xffff))
+    return result;
 
-  ret = curl_easy_perform(hnd);
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK)
+    return result;
 
-  curl_easy_cleanup(hnd);
-  hnd = NULL;
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_URL, URL);
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_HEADER, 1L);
+  curl_easy_setopt(curl, CURLOPT_USERPWD, "testuser:testpass");
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "lib1568");
+  curl_easy_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_DIGEST);
+  curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 50L);
+  curl_easy_setopt(curl, CURLOPT_PORT, (long)port);
+
+  result = curl_easy_perform(curl);
+
+  curl_easy_cleanup(curl);
 
   curl_global_cleanup();
-  return (int)ret;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1569.c b/third-party/curl/tests/libtest/lib1569.c
index 941bcc26d4..52dc364b05 100644
--- a/third-party/curl/tests/libtest/lib1569.c
+++ b/third-party/curl/tests/libtest/lib1569.c
@@ -21,28 +21,28 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testtrace.h"
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1569(const char *URL)
 {
-  CURLcode ret;
-  CURL *hnd;
-  curl_global_init(CURL_GLOBAL_ALL);
+  CURLcode result = CURLE_OK;
+  CURL *curl;
+  global_init(CURL_GLOBAL_ALL);
 
-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_URL, URL);
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_HEADER, 1L);
+  easy_init(curl);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-  ret = curl_easy_perform(hnd);
+  result = curl_easy_perform(curl);
+  if(result)
+    goto test_cleanup;
 
-  curl_easy_setopt(hnd, CURLOPT_URL, libtest_arg2);
-  ret = curl_easy_perform(hnd);
-  curl_easy_cleanup(hnd);
+  curl_easy_setopt(curl, CURLOPT_URL, libtest_arg2);
+  result = curl_easy_perform(curl);
 
+test_cleanup:
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
-  return (int)ret;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1571.c b/third-party/curl/tests/libtest/lib1571.c
new file mode 100644
index 0000000000..2cf218bf22
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1571.c
@@ -0,0 +1,70 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static CURLcode test_lib1571(const char *URL)
+{
+  CURLcode result;
+  CURL *curl;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  if((testnum == 1571) || (testnum == 1572) ||
+     (testnum == 1575) || (testnum == 1581)) {
+    easy_setopt(curl, CURLOPT_POSTFIELDS, "moo");
+  }
+  if(testnum == 1581) {
+    easy_setopt(curl, CURLOPT_POSTREDIR, CURL_REDIR_POST_301);
+  }
+
+  easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "IGLOO");
+  if((testnum == 1574) || (testnum == 1575)) {
+    easy_setopt(curl, CURLOPT_FOLLOWLOCATION, CURLFOLLOW_FIRSTONLY);
+  }
+  else {
+    easy_setopt(curl, CURLOPT_FOLLOWLOCATION, CURLFOLLOW_OBEYCODE);
+  }
+
+  result = curl_easy_perform(curl);
+
+test_cleanup:
+
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1576.c b/third-party/curl/tests/libtest/lib1576.c
new file mode 100644
index 0000000000..64aaa4c5ea
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1576.c
@@ -0,0 +1,94 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static char t1576_data[] = "request indicates that the client, which made";
+static size_t const t1576_datalen = sizeof(t1576_data) - 1;
+
+static size_t t1576_read_cb(char *ptr, size_t size, size_t nmemb, void *stream)
+{
+  size_t amount = nmemb * size; /* Total bytes curl wants */
+  if(amount < t1576_datalen) {
+    return t1576_datalen;
+  }
+  (void)stream;
+  memcpy(ptr, t1576_data, t1576_datalen);
+  return t1576_datalen;
+}
+
+static int t1576_seek_callback(void *ptr, curl_off_t offset, int origin)
+{
+  (void)ptr;
+  (void)offset;
+  if(origin != SEEK_SET)
+    return CURL_SEEKFUNC_FAIL;
+  return CURL_SEEKFUNC_OK;
+}
+
+static CURLcode test_lib1576(const char *URL)
+{
+  CURLcode result;
+  CURL *curl;
+  struct curl_slist *pHeaderList = NULL;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+  easy_setopt(curl, CURLOPT_READFUNCTION, t1576_read_cb);
+  easy_setopt(curl, CURLOPT_SEEKFUNCTION, t1576_seek_callback);
+  easy_setopt(curl, CURLOPT_INFILESIZE, (long)t1576_datalen);
+
+  easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "CURL");
+  if(testnum == 1578 || testnum == 1580) {
+    easy_setopt(curl, CURLOPT_FOLLOWLOCATION, CURLFOLLOW_FIRSTONLY);
+  }
+  else {
+    easy_setopt(curl, CURLOPT_FOLLOWLOCATION, CURLFOLLOW_OBEYCODE);
+  }
+  /* Remove "Expect: 100-continue" */
+  pHeaderList = curl_slist_append(pHeaderList, "Expect:");
+
+  curl_easy_setopt(curl, CURLOPT_HTTPHEADER, pHeaderList);
+  result = curl_easy_perform(curl);
+
+test_cleanup:
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+  curl_slist_free_all(pHeaderList);
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1582.c b/third-party/curl/tests/libtest/lib1582.c
new file mode 100644
index 0000000000..ec9624be94
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1582.c
@@ -0,0 +1,58 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static CURLcode test_lib1582(const char *URL)
+{
+  CURLcode result;
+  CURL *curl;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HTTPAUTH, (long)CURLAUTH_NEGOTIATE);
+  easy_setopt(curl, CURLOPT_USERPWD, ":");
+  easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+  easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
+
+  result = curl_easy_perform(curl);
+
+test_cleanup:
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1587.c b/third-party/curl/tests/libtest/lib1587.c
new file mode 100644
index 0000000000..5789804acb
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1587.c
@@ -0,0 +1,98 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#ifdef USE_OPENSSL
+#include <vtls/openssl.h>
+
+#ifdef HAVE_BORINGSSL_LIKE
+/* AWS-LC and BoringSSL */
+typedef uint32_t opt1587;
+#else
+typedef uint64_t opt1587;
+#endif
+
+static size_t write_cb(char *ptr, size_t size, size_t nmemb, void *stream)
+{
+  const struct curl_tlssessioninfo *info;
+  CURLcode result;
+  static int once;
+  CURL *curl = stream;
+  (void)ptr;
+
+  if(!once++) {
+    result = curl_easy_getinfo(curl, CURLINFO_TLS_SESSION, &info);
+
+    if(result == CURLE_OK) {
+      /* set and read stuff using the SSL_CTX to verify it */
+      opt1587 opts = SSL_CTX_get_options(info->internals);
+      SSL_CTX_set_options(info->internals, opts);
+      curl_mprintf("CURLINFO_TLS_SESSION: OK\n");
+    }
+
+    result = curl_easy_getinfo(curl, CURLINFO_TLS_SSL_PTR, &info);
+
+    if(result == CURLE_OK) {
+      /* set and read stuff using the SSL pointer to verify it */
+      opt1587 opts = SSL_get_options(info->internals);
+      SSL_set_options(info->internals, opts);
+      curl_mprintf("CURLINFO_TLS_SSL_PTR: OK\n");
+    }
+  }
+
+  return size * nmemb;
+}
+
+static CURLcode test_lib1587(const char *URL)
+{
+  CURLcode result = curl_global_init(CURL_GLOBAL_ALL);
+  CURL *curl;
+  if(result)
+    return result;
+
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_URL, URL);
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
+    curl_easy_setopt(curl, CURLOPT_WRITEDATA, curl);
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+
+  curl_global_cleanup();
+
+  return result;
+}
+#else
+/* without OpenSSL this does nothing */
+static CURLcode test_lib1587(const char *URL)
+{
+  (void)URL;
+  return CURLE_OK;
+}
+#endif
diff --git a/third-party/curl/tests/libtest/lib1588.c b/third-party/curl/tests/libtest/lib1588.c
new file mode 100644
index 0000000000..896a08a854
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1588.c
@@ -0,0 +1,150 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/*
+ * argv1 = URL
+ * argv2 = proxy host
+ * argv3 = proxy port
+ * argv4 = proxyuser:password
+ */
+
+#include "first.h"
+
+static CURLcode init1588(CURL *curl, const char *url,
+                         const char *userpwd, const char *proxy)
+{
+  CURLcode result = CURLE_OK;
+
+  res_easy_setopt(curl, CURLOPT_URL, url);
+  if(result)
+    goto init_failed;
+
+  res_easy_setopt(curl, CURLOPT_PROXY, proxy);
+  if(result)
+    goto init_failed;
+
+  res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd);
+  if(result)
+    goto init_failed;
+
+  res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST);
+  if(result)
+    goto init_failed;
+
+  res_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  if(result)
+    goto init_failed;
+#if 0
+  res_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
+  if(result)
+    goto init_failed;
+#endif
+
+  res_easy_setopt(curl, CURLOPT_HEADER, 1L);
+  if(result)
+    goto init_failed;
+
+  return CURLE_OK; /* success */
+
+init_failed:
+  return result; /* failure */
+}
+
+static CURLcode run1588(CURL *curl, const char *url, const char *userpwd,
+                        const char *proxy)
+{
+  CURLcode result = CURLE_OK;
+
+  result = init1588(curl, url, userpwd, proxy);
+  if(result)
+    return result;
+
+  return curl_easy_perform(curl);
+}
+
+static CURLcode test_lib1588(const char *URL)
+{
+  CURLcode result = CURLE_OK;
+  CURL *curl = NULL;
+  const char *proxyuserpwd = libtest_arg4;
+  struct curl_slist *host = NULL;
+  struct curl_slist *host2 = NULL;
+  char proxy1_resolve[128];
+  char proxy2_resolve[128];
+  char proxy1_connect[128];
+  char proxy2_connect[128];
+
+  if(test_argc < 3)
+    return TEST_ERR_MAJOR_BAD;
+
+  curl_msnprintf(proxy1_resolve, sizeof(proxy1_resolve),
+                 "firstproxy:%s:%s", libtest_arg3, libtest_arg2);
+  curl_msnprintf(proxy2_resolve, sizeof(proxy2_resolve),
+                 "secondproxy:%s:%s", libtest_arg3, libtest_arg2);
+
+  /* we connect to the fake hostname but the right port number */
+  curl_msnprintf(proxy1_connect, sizeof(proxy1_connect),
+                 "firstproxy:%s", libtest_arg3);
+  curl_msnprintf(proxy2_connect, sizeof(proxy2_connect),
+                 "secondproxy:%s", libtest_arg3);
+
+  res_global_init(CURL_GLOBAL_ALL);
+  if(result)
+    return result;
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  host = curl_slist_append(NULL, proxy1_resolve);
+  if(!host)
+    goto test_cleanup;
+  host2 = curl_slist_append(host, proxy2_resolve);
+  if(!host2)
+    goto test_cleanup;
+  host = host2;
+
+  start_test_timing();
+
+  easy_setopt(curl, CURLOPT_RESOLVE, host);
+
+  result = run1588(curl, URL, proxyuserpwd, proxy1_connect);
+  if(result)
+    goto test_cleanup;
+
+  curl_mfprintf(stderr, "lib1588: now we do the request again\n");
+
+  result = run1588(curl, URL, proxyuserpwd, proxy2_connect);
+
+test_cleanup:
+
+  /* proper cleanup sequence - type PB */
+
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+  curl_slist_free_all(host);
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1589.c b/third-party/curl/tests/libtest/lib1589.c
new file mode 100644
index 0000000000..e8d029034a
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1589.c
@@ -0,0 +1,132 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/*
+ * argv1 = URL
+ * argv2 = proxy host
+ * argv3 = proxy1 port
+ * argv4 = proxy2 port
+ * argv5 = proxyuser:password
+ */
+
+#include "first.h"
+
+static CURLcode init1589(CURL *curl, const char *url,
+                         const char *userpwd, const char *proxy,
+                         int port)
+{
+  CURLcode result = CURLE_OK;
+
+  res_easy_setopt(curl, CURLOPT_URL, url);
+  if(result)
+    goto init_failed;
+
+  res_easy_setopt(curl, CURLOPT_PROXY, proxy);
+  if(result)
+    goto init_failed;
+
+  res_easy_setopt(curl, CURLOPT_PROXYPORT, (long)port);
+  if(result)
+    goto init_failed;
+
+  res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd);
+  if(result)
+    goto init_failed;
+
+  res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST);
+  if(result)
+    goto init_failed;
+
+  res_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  if(result)
+    goto init_failed;
+#if 0
+  res_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
+  if(result)
+    goto init_failed;
+#endif
+
+  res_easy_setopt(curl, CURLOPT_HEADER, 1L);
+  if(result)
+    goto init_failed;
+
+  return CURLE_OK; /* success */
+
+init_failed:
+  return result; /* failure */
+}
+
+static CURLcode run1589(CURL *curl, const char *url, const char *userpwd,
+                        const char *proxy, int port)
+{
+  CURLcode result = CURLE_OK;
+
+  result = init1589(curl, url, userpwd, proxy, port);
+  if(result)
+    return result;
+
+  return curl_easy_perform(curl);
+}
+
+static CURLcode test_lib1589(const char *URL)
+{
+  CURLcode result = CURLE_OK;
+  CURL *curl = NULL;
+  const char *proxy = libtest_arg2;
+  /* !checksrc! disable BANNEDFUNC 2 */
+  int port1 = atoi(libtest_arg3);
+  int port2 = atoi(libtest_arg4);
+  const char *proxyuserpwd = libtest_arg5;
+
+  if(test_argc < 5)
+    return TEST_ERR_MAJOR_BAD;
+
+  res_global_init(CURL_GLOBAL_ALL);
+  if(result)
+    return result;
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  start_test_timing();
+
+  result = run1589(curl, URL, proxyuserpwd, proxy, port1);
+  if(result)
+    goto test_cleanup;
+
+  curl_mfprintf(stderr, "lib1589: now we do the request again\n");
+
+  result = run1589(curl, URL, proxyuserpwd, proxy, port2);
+
+test_cleanup:
+
+  /* proper cleanup sequence - type PB */
+
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1591.c b/third-party/curl/tests/libtest/lib1591.c
index 5701e10a9b..97b234234f 100644
--- a/third-party/curl/tests/libtest/lib1591.c
+++ b/third-party/curl/tests/libtest/lib1591.c
@@ -23,39 +23,39 @@
  ***************************************************************************/
 
 /*
- * This unit test PUT http data over proxy. Proxy header will be different
+ * This unit test PUT http data over proxy. Proxy header is different
  * from server http header
  */
 
-#include "test.h"
-#include <stdio.h>
-#include "memdebug.h"
+#include "first.h"
 
-static char data [] = "Hello Cloud!\r\n";
 static size_t consumed = 0;
 
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *stream)
+static size_t t1591_read_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
-  size_t  amount = nmemb * size; /* Total bytes curl wants */
+  static const char testdata[] = "Hello Cloud!\r\n";
+  static size_t const datalen = sizeof(testdata) - 1;
 
-  if(consumed == strlen(data)) {
+  size_t amount = nmemb * size; /* Total bytes curl wants */
+
+  if(consumed == datalen) {
     return 0;
   }
 
-  if(amount > strlen(data)-consumed) {
-    amount = strlen(data);
+  if(amount > datalen - consumed) {
+    amount = datalen - consumed;
   }
 
   consumed += amount;
   (void)stream;
-  memcpy(ptr, data, amount);
+  memcpy(ptr, testdata, amount);
   return amount;
 }
 
 /*
  * carefully not leak memory on OOM
  */
-static int trailers_callback(struct curl_slist **list, void *userdata)
+static int t1591_trailers_callback(struct curl_slist **list, void *userdata)
 {
   struct curl_slist *nlist = NULL;
   struct curl_slist *nlist2 = NULL;
@@ -73,22 +73,21 @@ static int trailers_callback(struct curl_slist **list, void *userdata)
   }
 }
 
-int test(char *URL)
+static CURLcode test_lib1591(const char *URL)
 {
   CURL *curl = NULL;
-  CURLcode res = CURLE_FAILED_INIT;
+  CURLcode result = CURLE_FAILED_INIT;
   /* http and proxy header list */
   struct curl_slist *hhl = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
-
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
@@ -99,14 +98,14 @@ int test(char *URL)
     goto test_cleanup;
   }
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_HTTPHEADER, hhl);
-  test_setopt(curl, CURLOPT_UPLOAD, 1L);
-  test_setopt(curl, CURLOPT_READFUNCTION, read_callback);
-  test_setopt(curl, CURLOPT_TRAILERFUNCTION, trailers_callback);
-  test_setopt(curl, CURLOPT_TRAILERDATA, NULL);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, hhl);
+  easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+  easy_setopt(curl, CURLOPT_READFUNCTION, t1591_read_cb);
+  easy_setopt(curl, CURLOPT_TRAILERFUNCTION, t1591_trailers_callback);
+  easy_setopt(curl, CURLOPT_TRAILERDATA, NULL);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -116,5 +115,5 @@ test_cleanup:
 
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1592.c b/third-party/curl/tests/libtest/lib1592.c
index 77b637d3de..497659b100 100644
--- a/third-party/curl/tests/libtest/lib1592.c
+++ b/third-party/curl/tests/libtest/lib1592.c
@@ -26,98 +26,94 @@
  *
  * This test case checks whether curl_multi_remove_handle() cancels
  * asynchronous DNS resolvers without blocking where possible.  Obviously, it
- * only tests whichever resolver cURL is actually built with.
+ * only tests whichever resolver curl is actually built with.
  */
 
-/* We're willing to wait a very generous two seconds for the removal.  This is
-   as low as we can go while still easily supporting SIGALRM timing for the
-   non-threaded blocking resolver.  It doesn't matter that much because when
-   the test passes, we never wait this long. */
-#define TEST_HANG_TIMEOUT 2 * 1000
+/* We are waiting a generous two seconds for the removal.  This is as low as we
+   can go while still easily supporting SIGALRM timing for the non-threaded
+   blocking resolver.  It does not matter that much because when the test
+   passes, we never wait this long. We set it much higher via the default
+   TEST_HANG_TIMEOUT to avoid issues when running on overloaded CI machines. */
 
-#include "test.h"
-#include "testutil.h"
+#include "first.h"
 
-#include <sys/stat.h>
-
-int test(char *URL)
+static CURLcode test_lib1592(const char *URL)
 {
   int stillRunning;
-  CURLM *multiHandle = NULL;
+  CURLM *multi = NULL;
   CURL *curl = NULL;
-  CURLcode res = CURLE_OK;
-  CURLMcode mres;
-  int timeout;
+  CURLcode result = CURLE_OK;
+  CURLMcode mresult;
+  long timeout;
 
   global_init(CURL_GLOBAL_ALL);
 
-  multi_init(multiHandle);
+  multi_init(multi);
 
   easy_init(curl);
 
   easy_setopt(curl, CURLOPT_VERBOSE, 1L);
   easy_setopt(curl, CURLOPT_URL, URL);
 
-  /* Set a DNS server that hopefully will not respond when using c-ares. */
+  /* Set a DNS server that hopefully does not respond when using c-ares. */
   if(curl_easy_setopt(curl, CURLOPT_DNS_SERVERS, "0.0.0.0") == CURLE_OK)
     /* Since we could set the DNS server, presume we are working with a
        resolver that can be cancelled (i.e. c-ares).  Thus,
        curl_multi_remove_handle() should not block even when the resolver
-       request is outstanding.  So, set a request timeout _longer_ than the
-       test hang timeout so we will fail if the handle removal call incorrectly
+       request is outstanding. Thus, set a request timeout _longer_ than the
+       test hang timeout so we fail if the handle removal call incorrectly
        blocks. */
     timeout = TEST_HANG_TIMEOUT * 2;
   else {
-    /* If we can't set the DNS server, presume that we are configured to use a
-       resolver that can't be cancelled (i.e. the threaded resolver or the
-       non-threaded blocking resolver).  So, we just test that the
+    /* If we cannot set the DNS server, presume that we are configured to use
+       a resolver that cannot be cancelled (i.e. the threaded resolver or the
+       non-threaded blocking resolver). Thus, we test that the
        curl_multi_remove_handle() call does finish well within our test
        timeout.
 
-       But, it is very unlikely that the resolver request will take any time at
-       all because we haven't been able to configure the resolver to use an
-       non-responsive DNS server.  At least we exercise the flow.
-       */
-    fprintf(stderr,
-            "CURLOPT_DNS_SERVERS not supported; "
-            "assuming curl_multi_remove_handle() will block\n");
+       But, it is unlikely that the resolver request takes any time at
+       all because we have not been able to configure the resolver to use an
+       non-responsive DNS server. At least we exercise the flow. */
+    curl_mfprintf(stderr,
+                  "CURLOPT_DNS_SERVERS not supported; "
+                  "assuming curl_multi_remove_handle() does block\n");
     timeout = TEST_HANG_TIMEOUT / 2;
   }
 
   /* Setting a timeout on the request should ensure that even if we have to
-     wait for the resolver during curl_multi_remove_handle(), it won't take
+     wait for the resolver during curl_multi_remove_handle(), it does not take
      longer than this, because the resolver request inherits its timeout from
      this. */
   easy_setopt(curl, CURLOPT_TIMEOUT_MS, timeout);
 
-  multi_add_handle(multiHandle, curl);
+  multi_add_handle(multi, curl);
 
   /* This should move the handle from INIT => CONNECT => WAITRESOLVE. */
-  fprintf(stderr, "curl_multi_perform()...\n");
-  multi_perform(multiHandle, &stillRunning);
-  fprintf(stderr, "curl_multi_perform() succeeded\n");
+  curl_mfprintf(stderr, "curl_multi_perform()...\n");
+  multi_perform(multi, &stillRunning);
+  curl_mfprintf(stderr, "curl_multi_perform() succeeded\n");
 
   /* Start measuring how long it takes to remove the handle. */
-  fprintf(stderr, "curl_multi_remove_handle()...\n");
+  curl_mfprintf(stderr, "curl_multi_remove_handle()...\n");
   start_test_timing();
-  mres = curl_multi_remove_handle(multiHandle, curl);
-  if(mres) {
-    fprintf(stderr, "curl_multi_remove_handle() failed, "
-            "with code %d\n", (int)res);
-    res = TEST_ERR_MULTI;
+  mresult = curl_multi_remove_handle(multi, curl);
+  if(mresult) {
+    curl_mfprintf(stderr, "curl_multi_remove_handle() failed, with code %d\n",
+                  mresult);
+    result = TEST_ERR_MULTI;
     goto test_cleanup;
   }
-  fprintf(stderr, "curl_multi_remove_handle() succeeded\n");
+  curl_mfprintf(stderr, "curl_multi_remove_handle() succeeded\n");
 
   /* Fail the test if it took too long to remove.  This happens after the fact,
-     and says "it seems that it would have run forever", which isn't true, but
-     it's close enough, and simple to do. */
+     and says "it seems that it would have run forever", which is not true, but
+     it is close enough, and simple to do. */
   abort_on_test_timeout();
 
 test_cleanup:
   curl_easy_cleanup(curl);
-  curl_multi_cleanup(multiHandle);
+  curl_multi_cleanup(multi);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1593.c b/third-party/curl/tests/libtest/lib1593.c
index b0a91b9fd5..1ba6351c55 100644
--- a/third-party/curl/tests/libtest/lib1593.c
+++ b/third-party/curl/tests/libtest/lib1593.c
@@ -24,36 +24,34 @@
 
 /* Test suppressing the If-Modified-Since header */
 
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1593(const char *URL)
 {
   struct curl_slist *header = NULL;
   long unmet;
   CURL *curl = NULL;
-  int res = 0;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
 
   easy_init(curl);
 
   easy_setopt(curl, CURLOPT_URL, URL);
-  easy_setopt(curl, CURLOPT_TIMECONDITION, (long)CURL_TIMECOND_IFMODSINCE);
-  /* Some TIMEVALUE; it doesn't matter. */
+  easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE);
+  /* Some TIMEVALUE; it does not matter. */
   easy_setopt(curl, CURLOPT_TIMEVALUE, 1566210680L);
 
   header = curl_slist_append(NULL, "If-Modified-Since:");
   if(!header) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
 
   easy_setopt(curl, CURLOPT_HTTPHEADER, header);
 
-  res = curl_easy_perform(curl);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
   /* Confirm that the condition checking still worked, even though we
@@ -61,12 +59,12 @@ int test(char *URL)
    * The server returns 304, which means the condition is "unmet".
    */
 
-  res = curl_easy_getinfo(curl, CURLINFO_CONDITION_UNMET, &unmet);
-  if(res)
+  result = curl_easy_getinfo(curl, CURLINFO_CONDITION_UNMET, &unmet);
+  if(result)
     goto test_cleanup;
 
   if(unmet != 1L) {
-    res = TEST_ERR_FAILURE;
+    result = TEST_ERR_FAILURE;
     goto test_cleanup;
   }
 
@@ -77,5 +75,5 @@ test_cleanup:
   curl_slist_free_all(header);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1594.c b/third-party/curl/tests/libtest/lib1594.c
index 5346c662a7..1a6f16361c 100644
--- a/third-party/curl/tests/libtest/lib1594.c
+++ b/third-party/curl/tests/libtest/lib1594.c
@@ -24,16 +24,14 @@
 
 /* Testing Retry-After header parser */
 
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1594(const char *URL)
 {
   struct curl_slist *header = NULL;
   curl_off_t retry;
   CURL *curl = NULL;
-  int res = 0;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
 
@@ -41,21 +39,15 @@ int test(char *URL)
 
   easy_setopt(curl, CURLOPT_URL, URL);
 
-  res = curl_easy_perform(curl);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
-  res = curl_easy_getinfo(curl, CURLINFO_RETRY_AFTER, &retry);
-  if(res)
+  result = curl_easy_getinfo(curl, CURLINFO_RETRY_AFTER, &retry);
+  if(result)
     goto test_cleanup;
 
-#ifdef LIB1596
-  /* we get a relative number of seconds, so add the number of seconds
-     we're at to make it a somewhat stable number. Then remove accuracy. */
-  retry += time(NULL);
-  retry /= 10000;
-#endif
-  printf("Retry-After %" CURL_FORMAT_CURL_OFF_T "\n", retry);
+  curl_mprintf("Retry-After %" CURL_FORMAT_CURL_OFF_T "\n", retry);
 
 test_cleanup:
 
@@ -64,5 +56,5 @@ test_cleanup:
   curl_slist_free_all(header);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1597.c b/third-party/curl/tests/libtest/lib1597.c
index 44769f9cfe..11da472c4d 100644
--- a/third-party/curl/tests/libtest/lib1597.c
+++ b/third-party/curl/tests/libtest/lib1597.c
@@ -24,22 +24,19 @@
 
 /* Testing CURLOPT_PROTOCOLS_STR */
 
-#include "test.h"
-
-#include "memdebug.h"
+#include "first.h"
 
 struct pair {
   const char *in;
-  CURLcode *exp;
+  CURLcode *result_exp;
 };
 
-int test(char *URL)
+static CURLcode test_lib1597(const char *URL)
 {
   CURL *curl = NULL;
-  int res = 0;
   CURLcode result = CURLE_OK;
   curl_version_info_data *curlinfo;
-  const char *const *proto;
+  const char * const *proto;
   int n;
   int i;
   static CURLcode ok = CURLE_OK;
@@ -50,22 +47,22 @@ int test(char *URL)
   static char protolist[1024];
 
   static const struct pair prots[] = {
-    {"goobar", &unsup},
-    {"http ", &unsup},
-    {" http", &unsup},
-    {"http", &httpcode},
-    {"http,", &httpcode},
-    {"https,", &httpscode},
-    {"https,http", &httpscode},
-    {"http,http", &httpcode},
-    {"HTTP,HTTP", &httpcode},
-    {",HTTP,HTTP", &httpcode},
-    {"http,http,ft", &unsup},
-    {"", &bad},
-    {",,", &bad},
-    {protolist, &ok},
-    {"all", &ok},
-    {NULL, NULL},
+    { "goobar", &unsup },
+    { "http ", &unsup },
+    { " http", &unsup },
+    { "http", &httpcode },
+    { "http,", &httpcode },
+    { "https,", &httpscode },
+    { "https,http", &httpscode },
+    { "http,http", &httpcode },
+    { "HTTP,HTTP", &httpcode },
+    { ",HTTP,HTTP", &httpcode },
+    { "http,http,ft", &unsup },
+    { "", &bad },
+    { ",,", &bad },
+    { protolist, &ok },
+    { "all", &ok },
+    { NULL, NULL },
   };
   (void)URL;
 
@@ -77,18 +74,18 @@ int test(char *URL)
   curlinfo = curl_version_info(CURLVERSION_NOW);
   if(!curlinfo) {
     fputs("curl_version_info failed\n", stderr);
-    res = (int) TEST_ERR_FAILURE;
+    result = TEST_ERR_FAILURE;
     goto test_cleanup;
   }
 
   n = 0;
   for(proto = curlinfo->protocols; *proto; proto++) {
-    if((size_t) n >= sizeof(protolist)) {
+    if((size_t)n >= sizeof(protolist)) {
       puts("protolist buffer too small\n");
-      res = (int) TEST_ERR_FAILURE;
+      result = TEST_ERR_FAILURE;
       goto test_cleanup;
     }
-    n += msnprintf(protolist + n, sizeof(protolist) - n, ",%s", *proto);
+    n += curl_msnprintf(protolist + n, sizeof(protolist) - n, ",%s", *proto);
     if(curl_strequal(*proto, "http"))
       httpcode = CURLE_OK;
     if(curl_strequal(*proto, "https"))
@@ -98,18 +95,17 @@ int test(char *URL)
   /* Run the tests. */
   for(i = 0; prots[i].in; i++) {
     result = curl_easy_setopt(curl, CURLOPT_PROTOCOLS_STR, prots[i].in);
-    if(result != *prots[i].exp) {
-      printf("unexpectedly '%s' returned %u\n",
-             prots[i].in, result);
+    if(result != *prots[i].result_exp) {
+      curl_mprintf("unexpectedly '%s' returned %d\n", prots[i].in,
+                   (int)result);
       break;
     }
   }
-  printf("Tested %u strings\n", i);
-  res = (int)result;
+  curl_mprintf("Tested %d strings\n", i);
 
 test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)result;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1598.c b/third-party/curl/tests/libtest/lib1598.c
new file mode 100644
index 0000000000..961c424e68
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1598.c
@@ -0,0 +1,104 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+/*
+ * This unit test PUT http data over proxy. Proxy header is different
+ * from server http header
+ */
+
+#include "first.h"
+
+/*
+ * carefully not leak memory on OOM
+ */
+static int t1598_trailers_callback(struct curl_slist **list, void *userdata)
+{
+  struct curl_slist *nlist = NULL;
+  struct curl_slist *nlist2 = NULL;
+  (void)userdata;
+  nlist = curl_slist_append(*list, "my-super-awesome-trailer: trail1");
+  if(nlist)
+    nlist2 = curl_slist_append(nlist, "my-other-awesome-trailer: trail2");
+  if(nlist2) {
+    *list = nlist2;
+    return CURL_TRAILERFUNC_OK;
+  }
+  else {
+    curl_slist_free_all(nlist);
+    return CURL_TRAILERFUNC_ABORT;
+  }
+}
+
+static CURLcode test_lib1598(const char *URL)
+{
+  static const char *post_data = "xxx=yyy&aaa=bbbbb";
+
+  CURL *curl = NULL;
+  CURLcode result = CURLE_FAILED_INIT;
+  /* http and proxy header list */
+  struct curl_slist *hhl = NULL, *list;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  hhl = curl_slist_append(hhl, "Trailer: my-super-awesome-trailer,"
+                               " my-other-awesome-trailer");
+  if(!hhl)
+    goto test_cleanup;
+  if(hhl) {
+    list = curl_slist_append(hhl, "Transfer-Encoding: chunked");
+    if(!list)
+      goto test_cleanup;
+    hhl = list;
+  }
+
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, hhl);
+  easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(post_data));
+  easy_setopt(curl, CURLOPT_POSTFIELDS, post_data);
+  easy_setopt(curl, CURLOPT_TRAILERFUNCTION, t1598_trailers_callback);
+  easy_setopt(curl, CURLOPT_TRAILERDATA, NULL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+  result = curl_easy_perform(curl);
+
+test_cleanup:
+
+  curl_easy_cleanup(curl);
+
+  curl_slist_free_all(hhl);
+
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1599.c b/third-party/curl/tests/libtest/lib1599.c
new file mode 100644
index 0000000000..62731be16b
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1599.c
@@ -0,0 +1,44 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static CURLcode test_lib1599(const char *URL)
+{
+  CURL *curl;
+  CURLcode result = CURLE_OK;
+
+  global_init(CURL_GLOBAL_ALL);
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_URL, URL);
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+    curl_easy_setopt(curl, CURLOPT_NETRC, CURL_NETRC_REQUIRED);
+    curl_easy_setopt(curl, CURLOPT_NETRC_FILE, libtest_arg2);
+
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+  curl_global_cleanup();
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1647.c b/third-party/curl/tests/libtest/lib1647.c
new file mode 100644
index 0000000000..8060e1bfe9
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1647.c
@@ -0,0 +1,120 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/*
+ * argv1 = the first URL
+ * argv2 = URL2
+ * argv3 = credentials 1
+ * argv4 = credentials 2
+ */
+
+#include "first.h"
+
+/* this is meant to pick up the proxy from the environment variable */
+static CURLcode init1647(CURL *curl, const char *url, const char *userpwd)
+{
+  CURLcode result = CURLE_OK;
+
+  res_easy_setopt(curl, CURLOPT_URL, url);
+  if(result)
+    goto init_failed;
+
+  res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd);
+  if(result)
+    goto init_failed;
+
+  res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST);
+  if(result)
+    goto init_failed;
+
+  res_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+  if(result)
+    goto init_failed;
+
+  res_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
+  if(result)
+    goto init_failed;
+
+  res_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYPEER, 0L);
+  if(result)
+    goto init_failed;
+
+  res_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYHOST, 0L);
+  if(result)
+    goto init_failed;
+
+  res_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  if(result)
+    goto init_failed;
+
+  return CURLE_OK; /* success */
+
+init_failed:
+  return result; /* failure */
+}
+
+static CURLcode run1647(CURL *curl, const char *url, const char *userpwd)
+{
+  CURLcode result = CURLE_OK;
+
+  result = init1647(curl, url, userpwd);
+  if(result)
+    return result;
+
+  return curl_easy_perform(curl);
+}
+
+static CURLcode test_lib1647(const char *URL)
+{
+  CURLcode result = CURLE_OK;
+  CURL *curl = NULL;
+
+  res_global_init(CURL_GLOBAL_ALL);
+  if(result)
+    return result;
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  start_test_timing();
+
+  curl_mprintf("--- First get '%s'\n", URL);
+  result = run1647(curl, URL, libtest_arg3);
+  if(result)
+    goto test_cleanup;
+
+  curl_mprintf("--- Then get '%s'\n", libtest_arg2);
+  result = run1647(curl, libtest_arg2, libtest_arg4);
+
+test_cleanup:
+
+  /* proper cleanup sequence - type PB */
+
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1648.c b/third-party/curl/tests/libtest/lib1648.c
new file mode 100644
index 0000000000..91afbcead4
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1648.c
@@ -0,0 +1,135 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/*
+ * URL = host
+ * arg2 = port
+ */
+
+#include "first.h"
+
+/* this is meant to pick up the proxy from the environment variable */
+static CURLcode init1648(CURL *curl, const char *url, const char *proxy)
+{
+  CURLcode result = CURLE_OK;
+
+  res_easy_setopt(curl, CURLOPT_URL, url);
+  if(result)
+    goto init_failed;
+
+  res_easy_setopt(curl, CURLOPT_PROXY, proxy);
+  if(result)
+    goto init_failed;
+
+  res_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  if(result)
+    goto init_failed;
+
+  return CURLE_OK; /* success */
+
+init_failed:
+  return result; /* failure */
+}
+
+static CURLcode run1648(CURL *curl, const char *url, const char *proxy)
+{
+  CURLcode result = CURLE_OK;
+
+  result = init1648(curl, url, proxy);
+  if(result)
+    return result;
+
+  return curl_easy_perform(curl);
+}
+
+#define GET_THIS "http://example.com/"
+
+/*
+ * First get the URL over 'firstproxy' with auth.
+ * Then clear the auth and get the URL again over 'secondproxy'.
+ */
+static CURLcode test_lib1648(const char *hostip)
+{
+  CURLcode result = CURLE_OK;
+  CURL *curl = NULL;
+  struct curl_slist *host = NULL;
+  struct curl_slist *host2 = NULL;
+  char proxy1_resolve[128];
+  char proxy2_resolve[128];
+  char proxy1_connect[128];
+  char proxy2_connect[128];
+
+  curl_msnprintf(proxy1_resolve, sizeof(proxy1_resolve),
+                 "firstproxy:%s:%s", libtest_arg2, hostip);
+  curl_msnprintf(proxy2_resolve, sizeof(proxy2_resolve),
+                 "secondproxy:%s:%s", libtest_arg2, hostip);
+
+  /* we connect to the fake hostname but the right port number */
+  curl_msnprintf(proxy1_connect, sizeof(proxy1_connect),
+                 "firstproxy:%s", libtest_arg2);
+  curl_msnprintf(proxy2_connect, sizeof(proxy2_connect),
+                 "secondproxy:%s", libtest_arg2);
+
+  res_global_init(CURL_GLOBAL_ALL);
+  if(result)
+    return result;
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  host = curl_slist_append(NULL, proxy1_resolve);
+  if(!host)
+    goto test_cleanup;
+  host2 = curl_slist_append(host, proxy2_resolve);
+  if(!host2)
+    goto test_cleanup;
+  host = host2;
+
+  start_test_timing();
+
+  easy_setopt(curl, CURLOPT_RESOLVE, host);
+  easy_setopt(curl, CURLOPT_PROXYUSERPWD, "victim:secret");
+
+  curl_mprintf("--- First get over %s\n", proxy1_connect);
+  result = run1648(curl, GET_THIS, proxy1_connect);
+  if(result)
+    goto test_cleanup;
+
+  easy_setopt(curl, CURLOPT_PROXYUSERPWD, NULL);
+
+  curl_mprintf("--- Then over '%s'\n", proxy2_connect);
+  result = run1648(curl, GET_THIS, proxy2_connect);
+
+test_cleanup:
+
+  /* proper cleanup sequence - type PB */
+
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+  curl_slist_free_all(host);
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1649.c b/third-party/curl/tests/libtest/lib1649.c
new file mode 100644
index 0000000000..2dd66c0231
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1649.c
@@ -0,0 +1,90 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+#include "first.h"
+
+/* this is meant to pick up the proxy from the environment variable */
+static CURLcode init1649(CURL *curl, const char *url)
+{
+  CURLcode result = CURLE_OK;
+
+  res_easy_setopt(curl, CURLOPT_URL, url);
+  if(result)
+    goto init_failed;
+
+  res_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  if(result)
+    goto init_failed;
+
+  return CURLE_OK; /* success */
+
+init_failed:
+  return result; /* failure */
+}
+
+static CURLcode run1649(CURL *curl, const char *url)
+{
+  CURLcode result = CURLE_OK;
+
+  result = init1649(curl, url);
+  if(result)
+    return result;
+
+  return curl_easy_perform(curl);
+}
+
+static CURLcode test_lib1649(const char *URL)
+{
+  CURLcode result = CURLE_OK;
+  CURL *curl = NULL;
+
+  res_global_init(CURL_GLOBAL_ALL);
+  if(result)
+    return result;
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  start_test_timing();
+
+  easy_setopt(curl, CURLOPT_REFERER, "https://secret.example.com/");
+
+  result = run1649(curl, URL);
+  if(result)
+    goto test_cleanup;
+
+  /* reset it */
+  easy_setopt(curl, CURLOPT_REFERER, NULL);
+
+  result = run1649(curl, URL);
+
+test_cleanup:
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1662.c b/third-party/curl/tests/libtest/lib1662.c
index 93c0800330..0e4942e9ad 100644
--- a/third-party/curl/tests/libtest/lib1662.c
+++ b/third-party/curl/tests/libtest/lib1662.c
@@ -21,70 +21,68 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-static char data[]="mooaaa";
-
-struct WriteThis {
+struct t1662_WriteThis {
   size_t sizeleft;
 };
 
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t t1662_read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
-  struct WriteThis *pooh = (struct WriteThis *)userp;
-  size_t len = strlen(data);
+  static const char testdata[] = "mooaaa";
+  static size_t const testdatalen = sizeof(testdata) - 1;
 
-  if(size*nmemb < len)
+  struct t1662_WriteThis *pooh = (struct t1662_WriteThis *)userp;
+
+  if(size * nmemb < testdatalen)
     return 0;
 
   if(pooh->sizeleft) {
-    memcpy(ptr, data, strlen(data));
+    memcpy(ptr, testdata, testdatalen);
     pooh->sizeleft = 0;
-    return len;
+    return testdatalen;
   }
 
   return 0;                         /* no more data left to deliver */
 }
 
-
-int test(char *URL)
+static CURLcode test_lib1662(const char *URL)
 {
-  CURLcode res = CURLE_OK;
-  CURL *hnd;
+  CURLcode result = CURLE_OK;
+  CURL *curl;
   curl_mime *mime1;
   curl_mimepart *part1;
-  struct WriteThis pooh = { 1 };
+  struct t1662_WriteThis pooh = { 1 };
 
   mime1 = NULL;
 
   global_init(CURL_GLOBAL_ALL);
 
-  hnd = curl_easy_init();
-  if(hnd) {
-    curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-    curl_easy_setopt(hnd, CURLOPT_URL, URL);
-    curl_easy_setopt(hnd, CURLOPT_NOPROGRESS, 1L);
-    mime1 = curl_mime_init(hnd);
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+    curl_easy_setopt(curl, CURLOPT_URL, URL);
+    curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 1L);
+    mime1 = curl_mime_init(curl);
     if(mime1) {
       part1 = curl_mime_addpart(mime1);
-      curl_mime_data_cb(part1, -1, read_callback, NULL, NULL, &pooh);
+      curl_mime_data_cb(part1, -1, t1662_read_cb, NULL, NULL, &pooh);
       curl_mime_filename(part1, "poetry.txt");
       curl_mime_name(part1, "content");
-      curl_easy_setopt(hnd, CURLOPT_MIMEPOST, mime1);
-      curl_easy_setopt(hnd, CURLOPT_USERAGENT, "curl/2000");
-      curl_easy_setopt(hnd, CURLOPT_FOLLOWLOCATION, 1L);
-      curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
-      curl_easy_setopt(hnd, CURLOPT_HTTP_VERSION,
-                       (long)CURL_HTTP_VERSION_2TLS);
-      curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-      curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
-      curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
-      res = curl_easy_perform(hnd);
+      curl_easy_setopt(curl, CURLOPT_MIMEPOST, mime1);
+      curl_easy_setopt(curl, CURLOPT_USERAGENT, "curl/2000");
+      curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+      curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 50L);
+      curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2TLS);
+      curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+      curl_easy_setopt(curl, CURLOPT_FTP_SKIP_PASV_IP, 1L);
+      curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+      result = curl_easy_perform(curl);
     }
   }
 
-  curl_easy_cleanup(hnd);
+  curl_easy_cleanup(curl);
   curl_mime_free(mime1);
   curl_global_cleanup();
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1686.c b/third-party/curl/tests/libtest/lib1686.c
new file mode 100644
index 0000000000..b7817463d2
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1686.c
@@ -0,0 +1,93 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#define FIRSTHOST "first.test"
+#define SECONDHOST "second.test"
+
+static CURLcode test_lib1686(const char *hostip)
+{
+  CURL *curl = NULL;
+  CURLcode result = CURLE_OK;
+  const char *httpport = libtest_arg2;
+  char firsturl[100];
+  char secondurl[100];
+  char firstres[100];
+  char secondres[100];
+  struct curl_slist *host = NULL;
+  struct curl_slist *host2 = NULL;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  /* create strings for CURLOPT_RESOLVE */
+  curl_msnprintf(firstres, sizeof(firstres), "%s:%s:%s",
+                 FIRSTHOST, httpport, hostip);
+  curl_msnprintf(secondres, sizeof(secondres), "%s:%s:%s",
+                 SECONDHOST, httpport, hostip);
+
+  /* create URLs */
+  curl_msnprintf(firsturl, sizeof(firsturl), "http://%s:%s/api",
+                 FIRSTHOST, httpport);
+  curl_msnprintf(secondurl, sizeof(secondurl), "http://%s:%s/hook",
+                 SECONDHOST, httpport);
+
+  host = curl_slist_append(NULL, firstres);
+  if(!host)
+    goto test_cleanup;
+  host2 = curl_slist_append(host, secondres);
+  if(!host2)
+    goto test_cleanup;
+  host = host2;
+
+  curl = curl_easy_init();
+  if(curl) {
+    easy_setopt(curl, CURLOPT_RESOLVE, host);
+    easy_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_DIGEST);
+    easy_setopt(curl, CURLOPT_USERPWD, "alice:bond");
+    easy_setopt(curl, CURLOPT_WRITEFUNCTION, tutil_throwaway_cb);
+
+    easy_setopt(curl, CURLOPT_URL, firsturl);
+    result = curl_easy_perform(curl);
+    if(result)
+      goto test_cleanup;
+
+    easy_setopt(curl, CURLOPT_URL, secondurl);
+    result = curl_easy_perform(curl);
+    if(result)
+      goto test_cleanup;
+
+    easy_setopt(curl, CURLOPT_USERPWD, "bob:secret");
+    easy_setopt(curl, CURLOPT_URL, secondurl);
+    result = curl_easy_perform(curl);
+  }
+
+test_cleanup:
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+  curl_slist_free_all(host);
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1900.c b/third-party/curl/tests/libtest/lib1900.c
new file mode 100644
index 0000000000..599085ef7c
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1900.c
@@ -0,0 +1,51 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static CURLcode test_lib1900(const char *URL)
+{
+  CURLcode result = CURLE_OK;
+  CURL *curl1 = NULL;
+  CURL *curl2 = NULL;
+
+  global_init(CURL_GLOBAL_ALL);
+
+  easy_init(curl1);
+  easy_setopt(curl1, CURLOPT_URL, URL);
+  easy_setopt(curl1, CURLOPT_HSTS, "first-hsts.txt");
+  easy_setopt(curl1, CURLOPT_HSTS, "second-hsts.txt");
+
+  curl2 = curl_easy_duphandle(curl1);
+
+  curl_easy_cleanup(curl1);
+  curl_easy_cleanup(curl2);
+  curl_global_cleanup();
+  return CURLE_OK;
+
+test_cleanup:
+  curl_easy_cleanup(curl1);
+  curl_easy_cleanup(curl2);
+  curl_global_cleanup();
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1901.c b/third-party/curl/tests/libtest/lib1901.c
new file mode 100644
index 0000000000..a6ccbdb0cb
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1901.c
@@ -0,0 +1,79 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static size_t t1901_read_cb(char *ptr, size_t size, size_t nmemb, void *stream)
+{
+  static const char *chunks[] = { "one", "two", "three", "four", NULL };
+  static int ix = 0;
+  (void)stream;
+  if(chunks[ix]) {
+    size_t len = strlen(chunks[ix]);
+    curlx_strcopy(ptr, size * nmemb, chunks[ix], len);
+    ix++;
+    return len;
+  }
+  return 0;
+}
+
+static CURLcode test_lib1901(const char *URL)
+{
+  CURL *curl;
+  CURLcode result = CURLE_OK;
+  struct curl_slist *chunk = NULL;
+
+  curl_global_init(CURL_GLOBAL_ALL);
+
+  curl = curl_easy_init();
+  if(curl) {
+    /* deliberately setting the size - to a wrong value to make sure libcurl
+       ignores it */
+    easy_setopt(curl, CURLOPT_POSTFIELDSIZE, 4L);
+    easy_setopt(curl, CURLOPT_POSTFIELDS, NULL);
+    easy_setopt(curl, CURLOPT_READFUNCTION, t1901_read_cb);
+    easy_setopt(curl, CURLOPT_POST, 1L);
+    easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+    easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
+    easy_setopt(curl, CURLOPT_URL, URL);
+    easy_setopt(curl, CURLOPT_READDATA, NULL);
+
+    chunk = curl_slist_append(chunk, "Expect:");
+    if(chunk) {
+      struct curl_slist *n =
+        curl_slist_append(chunk, "Transfer-Encoding: chunked");
+      if(n)
+        chunk = n;
+      if(n)
+        easy_setopt(curl, CURLOPT_HTTPHEADER, n);
+    }
+
+    result = curl_easy_perform(curl);
+  }
+test_cleanup:
+  curl_easy_cleanup(curl);
+  curl_slist_free_all(chunk);
+
+  curl_global_cleanup();
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1902.c b/third-party/curl/tests/libtest/lib1902.c
new file mode 100644
index 0000000000..b2ceb3dc39
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1902.c
@@ -0,0 +1,46 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static CURLcode test_lib1902(const char *URL)
+{
+  CURLcode result = CURLE_OK;
+  CURL *curl;
+
+  curl_global_init(CURL_GLOBAL_ALL);
+
+  curl = curl_easy_init();
+  if(curl) {
+    easy_setopt(curl, CURLOPT_COOKIEFILE, URL);
+    easy_setopt(curl, CURLOPT_COOKIEJAR, URL);
+
+    /* Do not perform any actual network operation,
+       the issue occur when not calling curl.*perform */
+  }
+
+test_cleanup:
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1903.c b/third-party/curl/tests/libtest/lib1903.c
index 79baa17dd3..b63808667f 100644
--- a/third-party/curl/tests/libtest/lib1903.c
+++ b/third-party/curl/tests/libtest/lib1903.c
@@ -21,35 +21,32 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "timediff.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1903(const char *URL)
 {
-  CURL *ch = NULL;
-  curl_global_init(CURL_GLOBAL_ALL);
+  CURLcode result = CURLE_OK;
+  CURL *curl = NULL;
+  global_init(CURL_GLOBAL_ALL);
 
-  ch = curl_easy_init();
-  if(!ch)
-    goto cleanup;
+  easy_init(curl);
 
-  curl_easy_setopt(ch, CURLOPT_URL, URL);
-  curl_easy_setopt(ch, CURLOPT_COOKIEFILE, libtest_arg2);
-  curl_easy_perform(ch);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_COOKIEFILE, libtest_arg2);
+  result = curl_easy_perform(curl);
+  if(result)
+    goto test_cleanup;
 
-  curl_easy_reset(ch);
+  curl_easy_reset(curl);
 
-  curl_easy_setopt(ch, CURLOPT_URL, URL);
-  curl_easy_setopt(ch, CURLOPT_COOKIEFILE, libtest_arg2);
-  curl_easy_perform(ch);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_COOKIEFILE, libtest_arg2);
+  easy_setopt(curl, CURLOPT_COOKIEJAR, libtest_arg3);
+  result = curl_easy_perform(curl);
 
-cleanup:
-  curl_easy_cleanup(ch);
+test_cleanup:
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return 0;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1905.c b/third-party/curl/tests/libtest/lib1905.c
index 62b9c60cde..d1fdba4d2e 100644
--- a/third-party/curl/tests/libtest/lib1905.c
+++ b/third-party/curl/tests/libtest/lib1905.c
@@ -21,44 +21,39 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "timediff.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1905(const char *URL)
 {
-  CURLSH *sh = NULL;
-  CURL *ch = NULL;
+  CURLSH *share = NULL;
+  CURL *curl = NULL;
   int unfinished;
-  CURLM *cm;
+  CURLM *multi;
 
   curl_global_init(CURL_GLOBAL_ALL);
 
-  cm = curl_multi_init();
-  if(!cm) {
+  multi = curl_multi_init();
+  if(!multi) {
     curl_global_cleanup();
-    return 1;
+    return TEST_ERR_MULTI;
   }
-  sh = curl_share_init();
-  if(!sh)
+  share = curl_share_init();
+  if(!share)
     goto cleanup;
 
-  curl_share_setopt(sh, CURLSHOPT_SHARE, CURL_LOCK_DATA_COOKIE);
-  curl_share_setopt(sh, CURLSHOPT_SHARE, CURL_LOCK_DATA_COOKIE);
+  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_COOKIE);
+  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_COOKIE);
 
-  ch = curl_easy_init();
-  if(!ch)
+  curl = curl_easy_init();
+  if(!curl)
     goto cleanup;
 
-  curl_easy_setopt(ch, CURLOPT_SHARE, sh);
-  curl_easy_setopt(ch, CURLOPT_URL, URL);
-  curl_easy_setopt(ch, CURLOPT_COOKIEFILE, libtest_arg2);
-  curl_easy_setopt(ch, CURLOPT_COOKIEJAR, libtest_arg2);
+  curl_easy_setopt(curl, CURLOPT_SHARE, share);
+  curl_easy_setopt(curl, CURLOPT_URL, URL);
+  curl_easy_setopt(curl, CURLOPT_COOKIEFILE, libtest_arg2);
+  curl_easy_setopt(curl, CURLOPT_COOKIEJAR, libtest_arg2);
 
-  curl_multi_add_handle(cm, ch);
+  curl_multi_add_handle(multi, curl);
 
   unfinished = 1;
   while(unfinished) {
@@ -70,10 +65,10 @@ int test(char *URL)
     FD_ZERO(&R);
     FD_ZERO(&W);
     FD_ZERO(&E);
-    curl_multi_perform(cm, &unfinished);
+    curl_multi_perform(multi, &unfinished);
 
-    curl_multi_fdset(cm, &R, &W, &E, &MAX);
-    curl_multi_timeout(cm, &max_tout);
+    curl_multi_fdset(multi, &R, &W, &E, &MAX);
+    curl_multi_timeout(multi, &max_tout);
 
     if(max_tout > 0) {
       curlx_mstotv(&timeout, max_tout);
@@ -86,15 +81,15 @@ int test(char *URL)
     select(MAX + 1, &R, &W, &E, &timeout);
   }
 
-  curl_easy_setopt(ch, CURLOPT_COOKIELIST, "FLUSH");
-  curl_easy_setopt(ch, CURLOPT_SHARE, NULL);
+  curl_easy_setopt(curl, CURLOPT_COOKIELIST, "FLUSH");
+  curl_easy_setopt(curl, CURLOPT_SHARE, NULL);
 
-  curl_multi_remove_handle(cm, ch);
+  curl_multi_remove_handle(multi, curl);
 cleanup:
-  curl_easy_cleanup(ch);
-  curl_share_cleanup(sh);
-  curl_multi_cleanup(cm);
+  curl_easy_cleanup(curl);
+  curl_share_cleanup(share);
+  curl_multi_cleanup(multi);
   curl_global_cleanup();
 
-  return 0;
+  return CURLE_OK;
 }
diff --git a/third-party/curl/tests/libtest/lib1906.c b/third-party/curl/tests/libtest/lib1906.c
index c0d485f69e..e649263338 100644
--- a/third-party/curl/tests/libtest/lib1906.c
+++ b/third-party/curl/tests/libtest/lib1906.c
@@ -21,54 +21,60 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1906(const char *URL)
 {
-  char *url_after;
+  CURLcode result = CURLE_OK;
+  char *url_after = NULL;
   CURLU *curlu = curl_url();
-  CURL *curl = curl_easy_init();
-  CURLcode curl_code;
   char error_buffer[CURL_ERROR_SIZE] = "";
+  CURL *curl;
+
+  easy_init(curl);
 
   curl_url_set(curlu, CURLUPART_URL, URL, CURLU_DEFAULT_SCHEME);
-  curl_easy_setopt(curl, CURLOPT_CURLU, curlu);
-  curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, error_buffer);
-  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_CURLU, curlu);
+  easy_setopt(curl, CURLOPT_ERRORBUFFER, error_buffer);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  /* msys2 times out instead of CURLE_COULDNT_CONNECT, so make it faster */
+  easy_setopt(curl, CURLOPT_CONNECTTIMEOUT_MS, 5000L);
   /* set a port number that makes this request fail */
-  curl_easy_setopt(curl, CURLOPT_PORT, 1L);
-  curl_code = curl_easy_perform(curl);
-  if(!curl_code)
-    fprintf(stderr, "failure expected, "
-            "curl_easy_perform returned %ld: <%s>, <%s>\n",
-            (long) curl_code, curl_easy_strerror(curl_code), error_buffer);
+  easy_setopt(curl, CURLOPT_PORT, 1L);
+  result = curl_easy_perform(curl);
+  if(result != CURLE_COULDNT_CONNECT && result != CURLE_OPERATION_TIMEDOUT) {
+    curl_mfprintf(stderr, "failure expected, "
+                  "curl_easy_perform returned %d: <%s>, <%s>\n",
+                  (int)result, curl_easy_strerror(result), error_buffer);
+    if(result == CURLE_OK)
+      result = TEST_ERR_MAJOR_BAD;  /* force an error return */
+    goto test_cleanup;
+  }
 
-  /* print the used url */
+  /* print the used URL */
   curl_url_get(curlu, CURLUPART_URL, &url_after, 0);
-  fprintf(stderr, "curlu now: <%s>\n", url_after);
+  curl_mfprintf(stderr, "curlu now: <%s>\n", url_after);
   curl_free(url_after);
+  url_after = NULL;
 
   /* now reset CURLOP_PORT to go back to originally set port number */
-  curl_easy_setopt(curl, CURLOPT_PORT, 0L);
+  easy_setopt(curl, CURLOPT_PORT, 0L);
 
-  curl_code = curl_easy_perform(curl);
-  if(curl_code)
-    fprintf(stderr, "success expected, "
-            "curl_easy_perform returned %ld: <%s>, <%s>\n",
-            (long) curl_code, curl_easy_strerror(curl_code), error_buffer);
+  result = curl_easy_perform(curl);
+  if(result)
+    curl_mfprintf(stderr, "success expected, "
+                  "curl_easy_perform returned %d: <%s>, <%s>\n",
+                  (int)result, curl_easy_strerror(result), error_buffer);
 
-  /* print url */
+  /* print URL */
   curl_url_get(curlu, CURLUPART_URL, &url_after, 0);
-  fprintf(stderr, "curlu now: <%s>\n", url_after);
-  curl_free(url_after);
+  curl_mfprintf(stderr, "curlu now: <%s>\n", url_after);
 
+test_cleanup:
+  curl_free(url_after);
   curl_easy_cleanup(curl);
   curl_url_cleanup(curlu);
   curl_global_cleanup();
 
-  return 0;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1907.c b/third-party/curl/tests/libtest/lib1907.c
index d0876dc581..3b91d846f7 100644
--- a/third-party/curl/tests/libtest/lib1907.c
+++ b/third-party/curl/tests/libtest/lib1907.c
@@ -21,17 +21,13 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1907(const char *URL)
 {
   char *url_after;
   CURL *curl;
-  CURLcode curl_code;
+  CURLcode result = CURLE_OK;
   char error_buffer[CURL_ERROR_SIZE] = "";
 
   curl_global_init(CURL_GLOBAL_DEFAULT);
@@ -39,18 +35,18 @@ int test(char *URL)
   curl_easy_setopt(curl, CURLOPT_URL, URL);
   curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, error_buffer);
   curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
-  curl_code = curl_easy_perform(curl);
-  if(!curl_code)
-    fprintf(stderr, "failure expected, "
-            "curl_easy_perform returned %ld: <%s>, <%s>\n",
-            (long) curl_code, curl_easy_strerror(curl_code), error_buffer);
+  result = curl_easy_perform(curl);
+  if(!result)
+    curl_mfprintf(stderr, "failure expected, "
+                  "curl_easy_perform returned %d: <%s>, <%s>\n",
+                  (int)result, curl_easy_strerror(result), error_buffer);
 
-  /* print the used url */
+  /* print the used URL */
   if(!curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_URL, &url_after))
-    printf("Effective URL: %s\n", url_after);
+    curl_mprintf("Effective URL: %s\n", url_after);
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return 0;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1908.c b/third-party/curl/tests/libtest/lib1908.c
index ff92dafb4b..9d6a7a1219 100644
--- a/third-party/curl/tests/libtest/lib1908.c
+++ b/third-party/curl/tests/libtest/lib1908.c
@@ -21,44 +21,40 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1908(const char *URL)
 {
-  CURLcode ret = CURLE_OK;
-  CURL *hnd;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
+  CURL *curl;
   start_test_timing();
 
   curl_global_init(CURL_GLOBAL_ALL);
 
-  hnd = curl_easy_init();
-  if(hnd) {
-    curl_easy_setopt(hnd, CURLOPT_URL, URL);
-    curl_easy_setopt(hnd, CURLOPT_NOPROGRESS, 1L);
-    curl_easy_setopt(hnd, CURLOPT_ALTSVC, libtest_arg2);
-    ret = curl_easy_perform(hnd);
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_URL, URL);
+    curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 1L);
+    curl_easy_setopt(curl, CURLOPT_ALTSVC, libtest_arg2);
+    result = curl_easy_perform(curl);
 
-    if(!ret) {
+    if(!result) {
       /* make a copy and check that this also has alt-svc activated */
-      CURL *also = curl_easy_duphandle(hnd);
-      if(also) {
-        ret = curl_easy_perform(also);
+      CURL *curldupe = curl_easy_duphandle(curl);
+      if(curldupe) {
+        result = curl_easy_perform(curldupe);
         /* we close the second handle first, which makes it store the alt-svc
            file only to get overwritten when the next handle is closed! */
-        curl_easy_cleanup(also);
+        curl_easy_cleanup(curldupe);
       }
     }
 
-    curl_easy_reset(hnd);
+    curl_easy_reset(curl);
 
-    /* using the same file name for the alt-svc cache, this clobbers the
-       content just written from the 'also' handle */
-    curl_easy_cleanup(hnd);
+    /* using the same filename for the alt-svc cache, this clobbers the
+       content written from the 'curldupe' handle */
+    curl_easy_cleanup(curl);
   }
   curl_global_cleanup();
-  return (int)ret;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1910.c b/third-party/curl/tests/libtest/lib1910.c
index fed1ca22b3..d8b9f7abdc 100644
--- a/third-party/curl/tests/libtest/lib1910.c
+++ b/third-party/curl/tests/libtest/lib1910.c
@@ -21,29 +21,25 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1910(const char *URL)
 {
-  CURLcode ret = CURLE_OK;
-  CURL *hnd;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
+  CURL *curl;
   start_test_timing();
 
   curl_global_init(CURL_GLOBAL_ALL);
 
-  hnd = curl_easy_init();
-  if(hnd) {
-    curl_easy_setopt(hnd, CURLOPT_URL, URL);
-    curl_easy_setopt(hnd, CURLOPT_NOPROGRESS, 1L);
-    curl_easy_setopt(hnd, CURLOPT_FOLLOWLOCATION, 1L);
-    curl_easy_setopt(hnd, CURLOPT_USERPWD, "user\nname:pass\nword");
-    ret = curl_easy_perform(hnd);
-    curl_easy_cleanup(hnd);
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_URL, URL);
+    curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 1L);
+    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+    curl_easy_setopt(curl, CURLOPT_USERPWD, "user\nname:pass\nword");
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
   }
   curl_global_cleanup();
-  return (int)ret;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1911.c b/third-party/curl/tests/libtest/lib1911.c
index b7c50fc5eb..662093a61f 100644
--- a/third-party/curl/tests/libtest/lib1911.c
+++ b/third-party/curl/tests/libtest/lib1911.c
@@ -21,62 +21,54 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
+#include "first.h"
 
 /* The maximum string length limit (CURL_MAX_INPUT_LENGTH) is an internal
    define not publicly exposed so we set our own */
 #define MAX_INPUT_LENGTH 8000000
 
-static char buffer[MAX_INPUT_LENGTH + 2];
-
-int test(char *URL)
+static CURLcode test_lib1911(const char *URL)
 {
+  static char testbuf[MAX_INPUT_LENGTH + 2];
+
   const struct curl_easyoption *o;
-  CURL *easy;
+  CURL *curl;
   int error = 0;
   (void)URL;
 
   curl_global_init(CURL_GLOBAL_ALL);
-  easy = curl_easy_init();
-  if(!easy) {
+  curl = curl_easy_init();
+  if(!curl) {
     curl_global_cleanup();
-    return 1;
+    return TEST_ERR_EASY_INIT;
   }
 
-  /* make it a null-terminated C string with just As */
-  memset(buffer, 'A', MAX_INPUT_LENGTH + 1);
-  buffer[MAX_INPUT_LENGTH + 1] = 0;
+  /* make it a null-terminated C string with only As */
+  memset(testbuf, 'A', MAX_INPUT_LENGTH + 1);
+  testbuf[MAX_INPUT_LENGTH + 1] = 0;
 
-  printf("string length: %d\n", (int)strlen(buffer));
+  curl_mprintf("string length: %zu\n", strlen(testbuf));
 
-  for(o = curl_easy_option_next(NULL);
-      o;
-      o = curl_easy_option_next(o)) {
+  for(o = curl_easy_option_next(NULL); o; o = curl_easy_option_next(o)) {
     if(o->type == CURLOT_STRING) {
       CURLcode result;
       /*
        * Whitelist string options that are safe for abuse
        */
-      CURL_IGNORE_DEPRECATION(
-        switch(o->id) {
-        case CURLOPT_PROXY_TLSAUTH_TYPE:
-        case CURLOPT_TLSAUTH_TYPE:
-        case CURLOPT_RANDOM_FILE:
-        case CURLOPT_EGDSOCKET:
-          continue;
-        default:
-          /* check this */
-          break;
-        }
-      )
+      switch(o->id) {
+      case CURLOPT_PROXY_TLSAUTH_TYPE:
+      case CURLOPT_TLSAUTH_TYPE:
+      case CURLOPT_RANDOM_FILE:
+      case CURLOPT_EGDSOCKET:
+        continue;
+      default:
+        /* check this */
+        break;
+      }
 
       /* This is a string. Make sure that passing in a string longer
          CURL_MAX_INPUT_LENGTH returns an error */
-      result = curl_easy_setopt(easy, o->id, buffer);
+      result = curl_easy_setopt(curl, o->id, testbuf);
       switch(result) {
       case CURLE_BAD_FUNCTION_ARGUMENT: /* the most normal */
       case CURLE_UNKNOWN_OPTION: /* left out from the build */
@@ -85,14 +77,14 @@ int test(char *URL)
         break;
       default:
         /* all other return codes are unexpected */
-        fprintf(stderr, "curl_easy_setopt(%s...) returned %d\n",
-                o->name, (int)result);
+        curl_mfprintf(stderr, "curl_easy_setopt(%s...) returned %d\n",
+                      o->name, (int)result);
         error++;
         break;
       }
     }
   }
-  curl_easy_cleanup(easy);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
-  return error;
+  return error == 0 ? CURLE_OK : TEST_ERR_FAILURE;
 }
diff --git a/third-party/curl/tests/libtest/lib1912.c b/third-party/curl/tests/libtest/lib1912.c
index 13f25bc993..65de8b3ffb 100644
--- a/third-party/curl/tests/libtest/lib1912.c
+++ b/third-party/curl/tests/libtest/lib1912.c
@@ -21,64 +21,57 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define print_err(name, exp) \
-  fprintf(stderr, "Type mismatch for CURLOPT_%s (expected %s)\n", name, exp);
-
-int test(char *URL)
+static CURLcode test_lib1912(const char *URL)
 {
-/* Only test if GCC typechecking is available */
+/* Only test if GCC/clang type checking is available */
   int error = 0;
 #ifdef CURLINC_TYPECHECK_GCC_H
   const struct curl_easyoption *o;
-  for(o = curl_easy_option_next(NULL);
-      o;
-      o = curl_easy_option_next(o)) {
-    CURL_IGNORE_DEPRECATION(
-      /* Test for mismatch OR missing typecheck macros */
-      if(curlcheck_long_option(o->id) !=
-          (o->type == CURLOT_LONG || o->type == CURLOT_VALUES)) {
-        print_err(o->name, "CURLOT_LONG or CURLOT_VALUES");
-        error++;
-      }
-      if(curlcheck_off_t_option(o->id) != (o->type == CURLOT_OFF_T)) {
-        print_err(o->name, "CURLOT_OFF_T");
-        error++;
-      }
-      if(curlcheck_string_option(o->id) != (o->type == CURLOT_STRING)) {
-        print_err(o->name, "CURLOT_STRING");
-        error++;
-      }
-      if(curlcheck_slist_option(o->id) != (o->type == CURLOT_SLIST)) {
-        print_err(o->name, "CURLOT_SLIST");
-        error++;
-      }
-      if(curlcheck_cb_data_option(o->id) != (o->type == CURLOT_CBPTR)) {
-        print_err(o->name, "CURLOT_CBPTR");
-        error++;
-      }
-      /* From here: only test that the type matches if macro is known */
-      if(curlcheck_write_cb_option(o->id) && (o->type != CURLOT_FUNCTION)) {
-        print_err(o->name, "CURLOT_FUNCTION");
-        error++;
-      }
-      if(curlcheck_conv_cb_option(o->id) && (o->type != CURLOT_FUNCTION)) {
-        print_err(o->name, "CURLOT_FUNCTION");
-        error++;
-      }
-      if(curlcheck_postfields_option(o->id) && (o->type != CURLOT_OBJECT)) {
-        print_err(o->name, "CURLOT_OBJECT");
-        error++;
-      }
-      /* Todo: no gcc typecheck for CURLOPTTYPE_BLOB types? */
-    )
+
+#define print_err(name, exp)                                            \
+  curl_mfprintf(stderr, "Type mismatch for CURLOPT_%s (expected %s)\n", \
+                name, exp)
+
+  for(o = curl_easy_option_next(NULL); o; o = curl_easy_option_next(o)) {
+    /* Test for mismatch OR missing typecheck macros */
+    if(curlcheck_long_option(o->id) !=
+       (o->type == CURLOT_LONG || o->type == CURLOT_VALUES)) {
+      print_err(o->name, "CURLOT_LONG or CURLOT_VALUES");
+      error++;
+    }
+    if(curlcheck_off_t_option(o->id) != (o->type == CURLOT_OFF_T)) {
+      print_err(o->name, "CURLOT_OFF_T");
+      error++;
+    }
+    if(curlcheck_string_option(o->id) != (o->type == CURLOT_STRING)) {
+      print_err(o->name, "CURLOT_STRING");
+      error++;
+    }
+    if(curlcheck_slist_option(o->id) != (o->type == CURLOT_SLIST)) {
+      print_err(o->name, "CURLOT_SLIST");
+      error++;
+    }
+    if(curlcheck_cb_data_option(o->id) != (o->type == CURLOT_CBPTR)) {
+      print_err(o->name, "CURLOT_CBPTR");
+      error++;
+    }
+    /* From here: only test that the type matches if macro is known */
+    if(curlcheck_write_cb_option(o->id) && (o->type != CURLOT_FUNCTION)) {
+      print_err(o->name, "CURLOT_FUNCTION");
+      error++;
+    }
+    if(curlcheck_conv_cb_option(o->id) && (o->type != CURLOT_FUNCTION)) {
+      print_err(o->name, "CURLOT_FUNCTION");
+      error++;
+    }
+    if(curlcheck_postfields_option(o->id) && (o->type != CURLOT_OBJECT)) {
+      print_err(o->name, "CURLOT_OBJECT");
+      error++;
+    }
   }
 #endif
   (void)URL;
-  return error;
+  return error == 0 ? CURLE_OK : TEST_ERR_FAILURE;
 }
diff --git a/third-party/curl/tests/libtest/lib1913.c b/third-party/curl/tests/libtest/lib1913.c
index a283863683..8f3c397581 100644
--- a/third-party/curl/tests/libtest/lib1913.c
+++ b/third-party/curl/tests/libtest/lib1913.c
@@ -21,30 +21,26 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1913(const char *URL)
 {
-  CURLcode ret = CURLE_OK;
-  CURL *hnd;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
+  CURL *curl;
   start_test_timing();
 
   curl_global_init(CURL_GLOBAL_ALL);
 
-  hnd = curl_easy_init();
-  if(hnd) {
-    curl_easy_setopt(hnd, CURLOPT_URL, URL);
-    curl_easy_setopt(hnd, CURLOPT_NOBODY, 1L);
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_URL, URL);
+    curl_easy_setopt(curl, CURLOPT_NOBODY, 1L);
     if(libtest_arg2)
       /* test1914 sets this extra arg */
-      curl_easy_setopt(hnd, CURLOPT_FILETIME, 1L);
-    ret = curl_easy_perform(hnd);
-    curl_easy_cleanup(hnd);
+      curl_easy_setopt(curl, CURLOPT_FILETIME, 1L);
+    result = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
   }
   curl_global_cleanup();
-  return (int)ret;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1915.c b/third-party/curl/tests/libtest/lib1915.c
index 290212fdcc..eebf7ba755 100644
--- a/third-party/curl/tests/libtest/lib1915.c
+++ b/third-party/curl/tests/libtest/lib1915.c
@@ -21,51 +21,51 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-struct entry {
-  const char *name;
-  const char *exp;
-};
-
-static const struct entry preload_hosts[] = {
-#if (SIZEOF_TIME_T < 5)
-  { "1.example.com", "20370320 01:02:03" },
-  { "2.example.com", "20370320 03:02:01" },
-  { "3.example.com", "20370319 01:02:03" },
-#else
-  { "1.example.com", "25250320 01:02:03" },
-  { "2.example.com", "25250320 03:02:01" },
-  { "3.example.com", "25250319 01:02:03" },
-#endif
-  { "4.example.com", "" },
-  { NULL, NULL } /* end of list marker */
-};
+#include "testtrace.h"
 
 struct state {
   int index;
 };
 
 /* "read" is from the point of the library, it wants data from us */
-static CURLSTScode hstsread(CURL *easy, struct curl_hstsentry *e,
-                            void *userp)
+static CURLSTScode hstsread(CURL *curl, struct curl_hstsentry *e, void *userp)
 {
+  struct entry {
+    const char *name;
+    const char *exp;
+  };
+
+  static const struct entry preload_hosts[] = {
+#if SIZEOF_TIME_T < 5
+    { "1.example.com", "20370320 01:02:03" },
+    { "2.example.com.", "20370320 03:02:01" },
+    { "3.example.com", "20370319 01:02:03" },
+    { ".3.example.com", "20270319 01:02:03" },
+#else
+    { "1.example.com", "25250320 01:02:03" },
+    { "2.example.com.", "25250320 03:02:01" },
+    { "3.example.com", "25250319 01:02:03" },
+    { ".3.example.com", "22250319 01:02:03" },
+#endif
+    { "4.example.com", "" }, /* forever */
+    { ".4.example.com", "20370319 01:02:03" },
+    { NULL, NULL } /* end of list marker */
+  };
+
   const char *host;
   const char *expire;
   struct state *s = (struct state *)userp;
-  (void)easy;
+  (void)curl;
   host = preload_hosts[s->index].name;
   expire = preload_hosts[s->index++].exp;
 
-  if(host && (strlen(host) < e->namelen)) {
-    strcpy(e->name, host);
+  if(host) {
+    curlx_strcopy(e->name, e->namelen, host, strlen(host));
     e->includeSubDomains = FALSE;
-    strcpy(e->expire, expire);
-    fprintf(stderr, "add '%s'\n", host);
+    curlx_strcopy(e->expire, sizeof(e->expire), expire, strlen(expire));
+    curl_mfprintf(stderr, "add '%s'\n", host);
   }
   else
     return CURLSTS_DONE;
@@ -73,22 +73,23 @@ static CURLSTScode hstsread(CURL *easy, struct curl_hstsentry *e,
 }
 
 /* verify error from callback */
-static CURLSTScode hstsreadfail(CURL *easy, struct curl_hstsentry *e,
+static CURLSTScode hstsreadfail(CURL *curl, struct curl_hstsentry *e,
                                 void *userp)
 {
-  (void)easy;
+  (void)curl;
   (void)e;
   (void)userp;
   return CURLSTS_FAIL;
 }
 
 /* check that we get the hosts back in the save */
-static CURLSTScode hstswrite(CURL *easy, struct curl_hstsentry *e,
+static CURLSTScode hstswrite(CURL *curl, struct curl_hstsentry *e,
                              struct curl_index *i, void *userp)
 {
-  (void)easy;
+  (void)curl;
   (void)userp;
-  printf("[%zu/%zu] %s %s\n", i->index, i->total, e->name, e->expire);
+  curl_mprintf("[%zu/%zu] %s%s %s\n", i->index, i->total,
+               e->includeSubDomains ? "." : "", e->name, e->expire);
   return CURLSTS_OK;
 }
 
@@ -96,38 +97,54 @@ static CURLSTScode hstswrite(CURL *easy, struct curl_hstsentry *e,
  * Read/write HSTS cache entries via callback.
  */
 
-int test(char *URL)
+static CURLcode test_lib1915(const char *URL)
 {
-  CURLcode ret = CURLE_OK;
-  CURL *hnd;
-  struct state st = {0};
+  CURLcode result = CURLE_OK;
+  CURL *curl;
+  struct state st = { 0 };
 
-  curl_global_init(CURL_GLOBAL_ALL);
+  global_init(CURL_GLOBAL_ALL);
 
-  hnd = curl_easy_init();
-  if(hnd) {
-    curl_easy_setopt(hnd, CURLOPT_URL, URL);
-    curl_easy_setopt(hnd, CURLOPT_HSTSREADFUNCTION, hstsread);
-    curl_easy_setopt(hnd, CURLOPT_HSTSREADDATA, &st);
-    curl_easy_setopt(hnd, CURLOPT_HSTSWRITEFUNCTION, hstswrite);
-    curl_easy_setopt(hnd, CURLOPT_HSTSWRITEDATA, &st);
-    curl_easy_setopt(hnd, CURLOPT_HSTS_CTRL, CURLHSTS_ENABLE);
-    ret = curl_easy_perform(hnd);
-    curl_easy_cleanup(hnd);
-    printf("First request returned %d\n", (int)ret);
-  }
-  hnd = curl_easy_init();
-  if(hnd) {
-    curl_easy_setopt(hnd, CURLOPT_URL, URL);
-    curl_easy_setopt(hnd, CURLOPT_HSTSREADFUNCTION, hstsreadfail);
-    curl_easy_setopt(hnd, CURLOPT_HSTSREADDATA, &st);
-    curl_easy_setopt(hnd, CURLOPT_HSTSWRITEFUNCTION, hstswrite);
-    curl_easy_setopt(hnd, CURLOPT_HSTSWRITEDATA, &st);
-    curl_easy_setopt(hnd, CURLOPT_HSTS_CTRL, CURLHSTS_ENABLE);
-    ret = curl_easy_perform(hnd);
-    curl_easy_cleanup(hnd);
-    printf("Second request returned %d\n", (int)ret);
-  }
+  debug_config.nohex = TRUE;
+  debug_config.tracetime = TRUE;
+
+  easy_init(curl);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 1L);
+  easy_setopt(curl, CURLOPT_HSTSREADFUNCTION, hstsread);
+  easy_setopt(curl, CURLOPT_HSTSREADDATA, &st);
+  easy_setopt(curl, CURLOPT_HSTSWRITEFUNCTION, hstswrite);
+  easy_setopt(curl, CURLOPT_HSTSWRITEDATA, &st);
+  easy_setopt(curl, CURLOPT_HSTS_CTRL, CURLHSTS_ENABLE);
+  easy_setopt(curl, CURLOPT_DEBUGDATA, &debug_config);
+  easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  result = curl_easy_perform(curl);
+  curl_easy_cleanup(curl);
+  curl = NULL;
+  if(result == CURLE_OPERATION_TIMEDOUT) /* we expect that on Windows */
+    result = CURLE_COULDNT_CONNECT;
+  curl_mprintf("First request returned %d\n", (int)result);
+  result = CURLE_OK;
+
+  easy_init(curl);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 1L);
+  easy_setopt(curl, CURLOPT_HSTSREADFUNCTION, hstsreadfail);
+  easy_setopt(curl, CURLOPT_HSTSREADDATA, &st);
+  easy_setopt(curl, CURLOPT_HSTSWRITEFUNCTION, hstswrite);
+  easy_setopt(curl, CURLOPT_HSTSWRITEDATA, &st);
+  easy_setopt(curl, CURLOPT_HSTS_CTRL, CURLHSTS_ENABLE);
+  easy_setopt(curl, CURLOPT_DEBUGDATA, &debug_config);
+  easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  result = curl_easy_perform(curl);
+  curl_easy_cleanup(curl);
+  curl = NULL;
+  curl_mprintf("Second request returned %d\n", (int)result);
+
+test_cleanup:
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
-  return (int)ret;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1916.c b/third-party/curl/tests/libtest/lib1916.c
index b97263c2e7..575080d09f 100644
--- a/third-party/curl/tests/libtest/lib1916.c
+++ b/third-party/curl/tests/libtest/lib1916.c
@@ -21,36 +21,34 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "warnless.h"
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1916(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(curl) {
     curl_easy_setopt(curl, CURLOPT_URL, URL);
-#ifdef LIB1917
-    /* without any postfields set! */
-    curl_easy_setopt(curl, CURLOPT_POST, 1L);
-#else
-    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, "");
-#endif
-    res = curl_easy_perform(curl);
-    if(res) {
-      printf("res: %d\n", res);
+    if(testnum == 1917) {
+      /* without any postfields set! */
+      curl_easy_setopt(curl, CURLOPT_POST, 1L);
+    }
+    else {
+      curl_easy_setopt(curl, CURLOPT_POSTFIELDS, "");
+    }
+    result = curl_easy_perform(curl);
+    if(result) {
+      curl_mprintf("result: %d\n", (int)result);
     }
     curl_easy_cleanup(curl);
   }
   curl_global_cleanup();
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1918.c b/third-party/curl/tests/libtest/lib1918.c
index 34c3608897..4932c1cfa6 100644
--- a/third-party/curl/tests/libtest/lib1918.c
+++ b/third-party/curl/tests/libtest/lib1918.c
@@ -21,37 +21,30 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1918(const char *URL)
 {
   const struct curl_easyoption *o;
-  int error = 0;
   (void)URL;
 
   curl_global_init(CURL_GLOBAL_ALL);
 
-  for(o = curl_easy_option_next(NULL);
-      o;
-      o = curl_easy_option_next(o)) {
+  for(o = curl_easy_option_next(NULL); o; o = curl_easy_option_next(o)) {
     const struct curl_easyoption *ename =
       curl_easy_option_by_name(o->name);
     const struct curl_easyoption *eid =
       curl_easy_option_by_id(o->id);
 
     if(ename->id != o->id) {
-      printf("name lookup id %d doesn't match %d\n",
-             ename->id, o->id);
+      curl_mprintf("name lookup id %d does not match %d\n",
+                   (int)ename->id, (int)o->id);
     }
     else if(eid->id != o->id) {
-      printf("ID lookup %d doesn't match %d\n",
-             ename->id, o->id);
+      curl_mprintf("ID lookup %d does not match %d\n",
+                   (int)ename->id, (int)o->id);
     }
   }
   curl_global_cleanup();
-  return error;
+  return CURLE_OK;
 }
diff --git a/third-party/curl/tests/libtest/lib1919.c b/third-party/curl/tests/libtest/lib1919.c
index 39ba1d96c4..f970b0aff3 100644
--- a/third-party/curl/tests/libtest/lib1919.c
+++ b/third-party/curl/tests/libtest/lib1919.c
@@ -21,33 +21,32 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1919(const char *URL)
 {
+  CURLcode result = CURLE_OK;
   CURL *curl;
-  curl_global_init(CURL_GLOBAL_ALL);
+  int i;
 
-  curl = curl_easy_init();
-  if(curl) {
-    int i;
-    curl_easy_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_BEARER);
-    curl_easy_setopt(curl, CURLOPT_XOAUTH2_BEARER,
-                     "c4e448d652a961fda0ab64f882c8c161d5985f805d45d80c9ddca1");
-    curl_easy_setopt(curl, CURLOPT_SASL_AUTHZID,
-                     "c4e448d652a961fda0ab64f882c8c161d5985f805d45d80c9ddca2");
-    curl_easy_setopt(curl, CURLOPT_URL, URL);
+  global_init(CURL_GLOBAL_ALL);
+  easy_init(curl);
+  easy_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_BEARER);
+  easy_setopt(curl, CURLOPT_XOAUTH2_BEARER,
+              "c4e448d652a961fda0ab64f882c8c161d5985f805d45d80c9ddca1");
+  easy_setopt(curl, CURLOPT_SASL_AUTHZID,
+              "c4e448d652a961fda0ab64f882c8c161d5985f805d45d80c9ddca2");
+  easy_setopt(curl, CURLOPT_URL, URL);
 
-    for(i = 0; i < 2; i++)
-      /* the second request needs to do connection reuse */
-      curl_easy_perform(curl);
-
-    curl_easy_cleanup(curl);
+  for(i = 0; i < 2; i++) {
+    /* the second request needs to do connection reuse */
+    result = curl_easy_perform(curl);
+    if(result)
+      goto test_cleanup;
   }
+
+test_cleanup:
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
-  return 0;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1920.c b/third-party/curl/tests/libtest/lib1920.c
new file mode 100644
index 0000000000..84a747ee6f
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1920.c
@@ -0,0 +1,55 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static CURLcode test_lib1920(const char *URL)
+{
+  CURLcode result = CURLE_OK;
+  CURL *curl = NULL;
+
+  curl_global_init(CURL_GLOBAL_ALL);
+
+  curl = curl_easy_init();
+  if(curl) {
+    easy_setopt(curl, CURLOPT_COOKIEFILE, libtest_arg2);
+    easy_setopt(curl, CURLOPT_COOKIEJAR, libtest_arg2);
+    easy_setopt(curl, CURLOPT_URL, URL);
+    easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+    result = curl_easy_perform(curl);
+
+    if(!result) {
+      /* doing a reset here should not change the cookie jar content */
+      curl_easy_reset(curl);
+      /* set the cookie jar name so that curl knows where to store the
+         cookies after reset */
+      easy_setopt(curl, CURLOPT_COOKIEJAR, libtest_arg2);
+    }
+  }
+
+test_cleanup:
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1921.c b/third-party/curl/tests/libtest/lib1921.c
new file mode 100644
index 0000000000..8799c2d960
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1921.c
@@ -0,0 +1,52 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static CURLcode test_lib1921(const char *URL)
+{
+  CURLU *u = curl_url();
+  CURLUcode rc;
+  if(!u)
+    return CURLE_FAILED_INIT;
+  (void)URL; /* unused */
+  /* u->scheme remains NULL */
+  rc = curl_url_set(u, CURLUPART_HOST, "example.com", 0);
+  if(!rc)
+    rc = curl_url_set(u, CURLUPART_PATH, "/original", 0);
+
+  if(!rc)
+    /* Relative URL + CURLU_DEFAULT_SCHEME reaches redirect_url() */
+    rc = curl_url_set(u, CURLUPART_URL, "/newpath", CURLU_DEFAULT_SCHEME);
+
+  if(!rc) {
+    char *url;
+    rc = curl_url_get(u, CURLUPART_URL, &url, 0);
+    if(!rc) {
+      curl_mprintf("URL: %s\n", url);
+      curl_free(url);
+    }
+  }
+  curl_url_cleanup(u);
+  return rc ? CURLE_BAD_FUNCTION_ARGUMENT : CURLE_OK;
+}
diff --git a/third-party/curl/tests/libtest/lib1922.c b/third-party/curl/tests/libtest/lib1922.c
new file mode 100644
index 0000000000..17b9cb8e34
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1922.c
@@ -0,0 +1,116 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static CURLcode test_lib1922(const char *URL)
+{
+  CURLcode result = CURLE_OK;
+  CURL *curl = NULL;
+  CURL *dup = NULL;
+  struct curl_slist *resolve = NULL;
+  char resolve_entry[256];
+  char direct_url[256];
+  char http_url[256];
+  char proxy_url[256];
+  const char *effective = NULL;
+  const char *host = libtest_arg2;     /* %HOSTIP   */
+  const char *httpport = libtest_arg3; /* %HTTPPORT  */
+  const char *proxyport = libtest_arg4;/* %PROXYPORT */
+
+  (void)URL;
+
+  if(!host || !httpport || !proxyport) {
+    curl_mfprintf(stderr,
+                  "Usage: lib1922 - <host> <httpport> <proxyport>\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  /* Synthetic DNS so hsts.example.com resolves to the test server. */
+  curl_msnprintf(resolve_entry, sizeof(resolve_entry),
+                 "hsts.example.com:%s:%s", httpport, host);
+  resolve = curl_slist_append(NULL, resolve_entry);
+  if(!resolve) {
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  curl_msnprintf(direct_url, sizeof(direct_url),
+                 "http://hsts.example.com:%s/%d", httpport, 1922);
+  curl_msnprintf(http_url, sizeof(http_url),
+                 "http://hsts.example.com/%d", 1922);
+  curl_msnprintf(proxy_url, sizeof(proxy_url),
+                 "http://%s:%s", host, proxyport);
+
+  global_init(CURL_GLOBAL_ALL);
+  easy_init(curl);
+
+  easy_setopt(curl, CURLOPT_WRITEFUNCTION, tutil_throwaway_cb);
+  easy_setopt(curl, CURLOPT_RESOLVE, resolve);
+  easy_setopt(curl, CURLOPT_URL, direct_url);
+  easy_setopt(curl, CURLOPT_HSTS_CTRL, CURLHSTS_ENABLE);
+
+  /* Direct HTTP request: Server returns Strict-Transport-Security.
+   * CURL_HSTS_HTTP env var (set in the test) allows processing it over
+   * HTTP in debug builds, populating the live HSTS cache. */
+  result = curl_easy_perform(curl);
+  if(result) {
+    curl_mfprintf(stderr, "First perform failed: %d (%s)\n",
+                  (int)result, curl_easy_strerror(result));
+    goto test_cleanup;
+  }
+  curl_mprintf("First request: HSTS cache populated\n");
+
+  dup = curl_easy_duphandle(curl);
+  if(!dup) {
+    result = CURLE_FAILED_INIT;
+    goto test_cleanup;
+  }
+
+  /* Point the dup at the plain HTTP URL for the same hostname, via a proxy.
+   * The copied HSTS cache upgrades the URL to HTTPS, causing a CONNECT to
+   * port 443. The test proxy rejects CONNECT with 403, so curl returns
+   * CURLE_COULDNT_CONNECT (7). The CONNECT to port 443 is itself the proof
+   * of the upgrade. */
+  easy_setopt(dup, CURLOPT_URL, http_url);
+  easy_setopt(dup, CURLOPT_PROXY, proxy_url);
+
+  result = curl_easy_perform(dup);
+  if(result != CURLE_COULDNT_CONNECT) {
+    curl_mfprintf(stderr, "Dup perform unexpected result: %d (%s)\n",
+                  (int)result, curl_easy_strerror(result));
+    goto test_cleanup;
+  }
+
+  /* Confirm the dup's URL was upgraded to HTTPS by the copied HSTS cache. */
+  curl_easy_getinfo(dup, CURLINFO_EFFECTIVE_URL, &effective);
+  if(effective) {
+    curl_mprintf("Dup effective URL: %s\n", effective);
+  }
+
+test_cleanup:
+  curl_easy_cleanup(curl);
+  curl_easy_cleanup(dup);
+  curl_slist_free_all(resolve);
+  curl_global_cleanup();
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1933.c b/third-party/curl/tests/libtest/lib1933.c
index cc3af078fc..abe4361bea 100644
--- a/third-party/curl/tests/libtest/lib1933.c
+++ b/third-party/curl/tests/libtest/lib1933.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,41 +21,39 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1933(const char *URL)
 {
   CURL *curl;
-  CURLcode res = TEST_ERR_MAJOR_BAD;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   struct curl_slist *connect_to = NULL;
   struct curl_slist *list = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_AWS_SIGV4, "xxx");
-  test_setopt(curl, CURLOPT_HEADER, 0L);
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_AWS_SIGV4, "xxx");
+  easy_setopt(curl, CURLOPT_HEADER, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
   if(libtest_arg2) {
     connect_to = curl_slist_append(connect_to, libtest_arg2);
   }
-  test_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
+  easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
   list = curl_slist_append(list, "Content-Type: application/json");
-  test_setopt(curl, CURLOPT_HTTPHEADER, list);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, list);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -64,5 +62,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1934.c b/third-party/curl/tests/libtest/lib1934.c
index 36fc8f7033..1ddb8bee0b 100644
--- a/third-party/curl/tests/libtest/lib1934.c
+++ b/third-party/curl/tests/libtest/lib1934.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,42 +21,40 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1934(const char *URL)
 {
   CURL *curl;
-  CURLcode res = TEST_ERR_MAJOR_BAD;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   struct curl_slist *connect_to = NULL;
   struct curl_slist *list = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_AWS_SIGV4, "xxx:yyy");
-  test_setopt(curl, CURLOPT_USERPWD, "xxx:yyy");
-  test_setopt(curl, CURLOPT_HEADER, 0L);
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_AWS_SIGV4, "xxx:yyy");
+  easy_setopt(curl, CURLOPT_USERPWD, "xxx:yyy");
+  easy_setopt(curl, CURLOPT_HEADER, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
   if(libtest_arg2) {
     connect_to = curl_slist_append(connect_to, libtest_arg2);
   }
-  test_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
+  easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
   list = curl_slist_append(list, "Content-Type: application/json");
-  test_setopt(curl, CURLOPT_HTTPHEADER, list);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, list);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -65,5 +63,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1935.c b/third-party/curl/tests/libtest/lib1935.c
index ee52d44153..26d17c6851 100644
--- a/third-party/curl/tests/libtest/lib1935.c
+++ b/third-party/curl/tests/libtest/lib1935.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,42 +21,40 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1935(const char *URL)
 {
   CURL *curl;
-  CURLcode res = TEST_ERR_MAJOR_BAD;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   struct curl_slist *connect_to = NULL;
   struct curl_slist *list = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_AWS_SIGV4, "xxx:yyy:rrr");
-  test_setopt(curl, CURLOPT_USERPWD, "xxx:yyy");
-  test_setopt(curl, CURLOPT_HEADER, 0L);
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_AWS_SIGV4, "xxx:yyy:rrr");
+  easy_setopt(curl, CURLOPT_USERPWD, "xxx:yyy");
+  easy_setopt(curl, CURLOPT_HEADER, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
   if(libtest_arg2) {
     connect_to = curl_slist_append(connect_to, libtest_arg2);
   }
-  test_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
+  easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
   list = curl_slist_append(list, "Content-Type: application/json");
-  test_setopt(curl, CURLOPT_HTTPHEADER, list);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, list);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -65,5 +63,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1936.c b/third-party/curl/tests/libtest/lib1936.c
index b86eee7bd6..dba9f1ccba 100644
--- a/third-party/curl/tests/libtest/lib1936.c
+++ b/third-party/curl/tests/libtest/lib1936.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,42 +21,40 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1936(const char *URL)
 {
   CURL *curl;
-  CURLcode res = TEST_ERR_MAJOR_BAD;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   struct curl_slist *connect_to = NULL;
   struct curl_slist *list = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_AWS_SIGV4, "xxx:yyy:rrr:sss");
-  test_setopt(curl, CURLOPT_USERPWD, "xxx:yyy");
-  test_setopt(curl, CURLOPT_HEADER, 0L);
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_AWS_SIGV4, "xxx:yyy:rrr:sss");
+  easy_setopt(curl, CURLOPT_USERPWD, "xxx:yyy");
+  easy_setopt(curl, CURLOPT_HEADER, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
   if(libtest_arg2) {
     connect_to = curl_slist_append(connect_to, libtest_arg2);
   }
-  test_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
+  easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
   list = curl_slist_append(list, "Content-Type: application/json");
-  test_setopt(curl, CURLOPT_HTTPHEADER, list);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, list);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -65,5 +63,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1937.c b/third-party/curl/tests/libtest/lib1937.c
index 74249666e7..a249375179 100644
--- a/third-party/curl/tests/libtest/lib1937.c
+++ b/third-party/curl/tests/libtest/lib1937.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,45 +21,42 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "first.h"
 
-#include "test.h"
-
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1937(const char *URL)
 {
   CURL *curl;
-  CURLcode res = TEST_ERR_MAJOR_BAD;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   struct curl_slist *connect_to = NULL;
   struct curl_slist *list = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_POST, 1L);
-  test_setopt(curl, CURLOPT_AWS_SIGV4, "provider1:provider2:region:service");
-  test_setopt(curl, CURLOPT_USERPWD, "keyId:SecretKey");
-  test_setopt(curl, CURLOPT_HEADER, 0L);
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_POST, 1L);
+  easy_setopt(curl, CURLOPT_AWS_SIGV4, "provider1:provider2:region:service");
+  easy_setopt(curl, CURLOPT_USERPWD, "keyId:SecretKey");
+  easy_setopt(curl, CURLOPT_HEADER, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
   if(libtest_arg2) {
     connect_to = curl_slist_append(connect_to, libtest_arg2);
   }
-  test_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
+  easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
   list = curl_slist_append(list, "Content-Type: application/json");
-  test_setopt(curl, CURLOPT_HTTPHEADER, list);
-  test_setopt(curl, CURLOPT_POSTFIELDS, "postData");
+  easy_setopt(curl, CURLOPT_HTTPHEADER, list);
+  easy_setopt(curl, CURLOPT_POSTFIELDS, "postData");
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -68,5 +65,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1938.c b/third-party/curl/tests/libtest/lib1938.c
index 4b5218bdb8..300a092fd5 100644
--- a/third-party/curl/tests/libtest/lib1938.c
+++ b/third-party/curl/tests/libtest/lib1938.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,47 +21,44 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "first.h"
 
-#include "test.h"
-
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1938(const char *URL)
 {
   CURL *curl;
-  CURLcode res = TEST_ERR_MAJOR_BAD;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   struct curl_slist *connect_to = NULL;
   struct curl_slist *list = NULL;
-  unsigned char data[] = {0x70, 0x6f, 0x73, 0x74, 0, 0x44, 0x61, 0x74, 0x61};
+  unsigned char data[] = { 0x70, 0x6f, 0x73, 0x74, 0, 0x44, 0x61, 0x74, 0x61 };
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_POST, 1L);
-  test_setopt(curl, CURLOPT_AWS_SIGV4, "provider1:provider2:region:service");
-  test_setopt(curl, CURLOPT_USERPWD, "keyId:SecretKey");
-  test_setopt(curl, CURLOPT_HEADER, 0L);
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_POST, 1L);
+  easy_setopt(curl, CURLOPT_AWS_SIGV4, "provider1:provider2:region:service");
+  easy_setopt(curl, CURLOPT_USERPWD, "keyId:SecretKey");
+  easy_setopt(curl, CURLOPT_HEADER, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
   if(libtest_arg2) {
     connect_to = curl_slist_append(connect_to, libtest_arg2);
   }
-  test_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
+  easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
   list = curl_slist_append(list, "Content-Type: application/json");
-  test_setopt(curl, CURLOPT_HTTPHEADER, list);
-  test_setopt(curl, CURLOPT_POSTFIELDS, data);
-  test_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)sizeof(data));
+  easy_setopt(curl, CURLOPT_HTTPHEADER, list);
+  easy_setopt(curl, CURLOPT_POSTFIELDS, data);
+  easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)sizeof(data));
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -70,5 +67,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1939.c b/third-party/curl/tests/libtest/lib1939.c
index 4adc876693..5445251df3 100644
--- a/third-party/curl/tests/libtest/lib1939.c
+++ b/third-party/curl/tests/libtest/lib1939.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,49 +21,46 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "first.h"
 
-#include "test.h"
-
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1939(const char *URL)
 {
   CURLM *multi;
-  CURL *easy;
+  CURL *curl;
   int running_handles;
 
   curl_global_init(CURL_GLOBAL_DEFAULT);
 
   multi = curl_multi_init();
   if(multi) {
-    easy = curl_easy_init();
-    if(easy) {
-      CURLcode c;
-      CURLMcode m;
+    curl = curl_easy_init();
+    if(curl) {
+      CURLcode result;
+      CURLMcode mresult;
 
       /* Crash only happens when using HTTPS */
-      c = curl_easy_setopt(easy, CURLOPT_URL, URL);
-      if(!c)
-        /* Any old HTTP tunneling proxy will do here */
-        c = curl_easy_setopt(easy, CURLOPT_PROXY, libtest_arg2);
+      result = curl_easy_setopt(curl, CURLOPT_URL, URL);
+      if(!result)
+        /* Any old HTTP tunneling proxy does the job here */
+        result = curl_easy_setopt(curl, CURLOPT_PROXY, libtest_arg2);
 
-      if(!c) {
+      if(!result) {
 
-        /* We're going to drive the transfer using multi interface here,
+        /* We are going to drive the transfer using multi interface here,
            because we want to stop during the middle. */
-        m = curl_multi_add_handle(multi, easy);
+        mresult = curl_multi_add_handle(multi, curl);
 
-        if(!m)
-          /* Run the multi handle once, just enough to start establishing an
+        if(!mresult)
+          /* Run the multi handle once, enough to start establishing an
              HTTPS connection. */
-          m = curl_multi_perform(multi, &running_handles);
+          mresult = curl_multi_perform(multi, &running_handles);
 
-        if(m)
-          fprintf(stderr, "curl_multi_perform failed\n");
+        if(mresult)
+          curl_mfprintf(stderr, "curl_multi_perform failed\n");
       }
       /* Close the easy handle *before* the multi handle. Doing it the other
          way around avoids the issue. */
-      curl_easy_cleanup(easy);
+      curl_easy_cleanup(curl);
     }
     curl_multi_cleanup(multi); /* double-free happens here */
   }
diff --git a/third-party/curl/tests/libtest/lib1940.c b/third-party/curl/tests/libtest/lib1940.c
index 5e90f6a366..349d8131c6 100644
--- a/third-party/curl/tests/libtest/lib1940.c
+++ b/third-party/curl/tests/libtest/lib1940.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,99 +21,93 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "first.h"
 
-#include "test.h"
-
-#include "memdebug.h"
-
-static const char *show[]={
-  "daTE",
-  "Server",
-  "content-type",
-  "content-length",
-  "location",
-  "set-cookie",
-  "silly-thing",
-  "fold",
-  NULL
-};
-
-#ifdef LIB1946
-#define HEADER_REQUEST 0
-#else
-#define HEADER_REQUEST -1
-#endif
-
-static void showem(CURL *easy, unsigned int type)
+static void t1940_showem(CURL *curl, int header_request, unsigned int type)
 {
+  static const char *testdata[] = {
+    "daTE",
+    "Server",
+    "content-type",
+    "content-length",
+    "location",
+    "set-cookie",
+    "silly-thing",
+    "fold",
+    "blank",
+    "Blank2",
+    "Test",
+    NULL
+  };
+
   int i;
   struct curl_header *header;
-  for(i = 0; show[i]; i++) {
-    if(CURLHE_OK == curl_easy_header(easy, show[i], 0, type, HEADER_REQUEST,
-                                     &header)) {
+  for(i = 0; testdata[i]; i++) {
+    if(CURLHE_OK == curl_easy_header(curl, testdata[i], 0,
+                                     type, header_request, &header)) {
       if(header->amount > 1) {
         /* more than one, iterate over them */
         size_t index = 0;
         size_t amount = header->amount;
         do {
-          printf("- %s == %s (%u/%u)\n", header->name, header->value,
-                 (int)index, (int)amount);
+          curl_mprintf("- %s == %s (%zu/%zu)\n", header->name, header->value,
+                       index, amount);
 
           if(++index == amount)
             break;
-          if(CURLHE_OK != curl_easy_header(easy, show[i], index, type,
-                                           HEADER_REQUEST, &header))
+          if(CURLHE_OK != curl_easy_header(curl, testdata[i], index,
+                                           type, header_request, &header))
             break;
         } while(1);
       }
       else {
         /* only one of this */
-        printf(" %s == %s\n", header->name, header->value);
+        curl_mprintf(" %s == %s\n", header->name, header->value);
       }
     }
   }
 }
 
-static size_t write_cb(char *data, size_t n, size_t l, void *userp)
+static CURLcode test_lib1940(const char *URL)
 {
-  /* take care of the data here, ignored in this example */
-  (void)data;
-  (void)userp;
-  return n*l;
-}
-int test(char *URL)
-{
-  CURL *easy;
+  CURL *curl = NULL;
+  CURLcode result = CURLE_OK;
 
-  curl_global_init(CURL_GLOBAL_DEFAULT);
-
-  easy = curl_easy_init();
-  if(easy) {
-    CURLcode res;
-    curl_easy_setopt(easy, CURLOPT_URL, URL);
-    curl_easy_setopt(easy, CURLOPT_VERBOSE, 1L);
-    curl_easy_setopt(easy, CURLOPT_FOLLOWLOCATION, 1L);
-    /* ignores any content */
-    curl_easy_setopt(easy, CURLOPT_WRITEFUNCTION, write_cb);
-
-    /* if there's a proxy set, use it */
-    if(libtest_arg2 && *libtest_arg2) {
-      curl_easy_setopt(easy, CURLOPT_PROXY, libtest_arg2);
-      curl_easy_setopt(easy, CURLOPT_HTTPPROXYTUNNEL, 1L);
-    }
-    res = curl_easy_perform(easy);
-    if(res) {
-      printf("badness: %d\n", (int)res);
-    }
-    showem(easy, CURLH_HEADER);
-    if(libtest_arg2 && *libtest_arg2) {
-      /* now show connect headers only */
-      showem(easy, CURLH_CONNECT);
-    }
-    showem(easy, CURLH_1XX);
-    showem(easy, CURLH_TRAILER);
-    curl_easy_cleanup(easy);
+  int header_request;
+  if(testnum == 1946) {
+    header_request = 0;
   }
+  else {
+    header_request = -1;
+  }
+
+  global_init(CURL_GLOBAL_DEFAULT);
+  easy_init(curl);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+  /* ignores any content */
+  easy_setopt(curl, CURLOPT_WRITEFUNCTION, tutil_throwaway_cb);
+
+  /* if there is a proxy set, use it */
+  if(libtest_arg2 && *libtest_arg2) {
+    easy_setopt(curl, CURLOPT_PROXY, libtest_arg2);
+    easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
+  }
+  result = curl_easy_perform(curl);
+  if(result)
+    goto test_cleanup;
+
+  t1940_showem(curl, header_request, CURLH_HEADER);
+  if(libtest_arg2 && *libtest_arg2) {
+    /* now show connect headers only */
+    t1940_showem(curl, header_request, CURLH_CONNECT);
+  }
+  t1940_showem(curl, header_request, CURLH_1XX);
+  t1940_showem(curl, header_request, CURLH_TRAILER);
+
+test_cleanup:
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
-  return 0;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1945.c b/third-party/curl/tests/libtest/lib1945.c
index 1b658b0916..e76a5dc528 100644
--- a/third-party/curl/tests/libtest/lib1945.c
+++ b/third-party/curl/tests/libtest/lib1945.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,61 +21,48 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "first.h"
 
-#include "test.h"
-
-#include "memdebug.h"
-
-#ifdef _MSC_VER
-/* warning C4706: assignment within conditional expression */
-#pragma warning(disable:4706)
-#endif
-static void showem(CURL *easy, unsigned int type)
+static void t1945_showem(CURL *curl, unsigned int type)
 {
   struct curl_header *header = NULL;
   struct curl_header *prev = NULL;
 
-  while((header = curl_easy_nextheader(easy, type, 0, prev))) {
-    printf(" %s == %s (%u/%u)\n", header->name, header->value,
-           (int)header->index, (int)header->amount);
+  /* !checksrc! disable EQUALSNULL 1 */
+  while((header = curl_easy_nextheader(curl, type, 0, prev)) != NULL) {
+    curl_mprintf(" %s == %s (%zu/%zu)\n", header->name, header->value,
+                 header->index, header->amount);
     prev = header;
   }
 }
 
-static size_t write_cb(char *data, size_t n, size_t l, void *userp)
+static CURLcode test_lib1945(const char *URL)
 {
-  /* take care of the data here, ignored in this example */
-  (void)data;
-  (void)userp;
-  return n*l;
-}
-int test(char *URL)
-{
-  CURL *easy;
+  CURL *curl;
+  CURLcode result = CURLE_OK;
 
-  curl_global_init(CURL_GLOBAL_DEFAULT);
+  global_init(CURL_GLOBAL_DEFAULT);
 
-  easy = curl_easy_init();
-  if(easy) {
-    CURLcode res;
-    curl_easy_setopt(easy, CURLOPT_URL, URL);
-    curl_easy_setopt(easy, CURLOPT_VERBOSE, 1L);
-    curl_easy_setopt(easy, CURLOPT_FOLLOWLOCATION, 1L);
-    /* ignores any content */
-    curl_easy_setopt(easy, CURLOPT_WRITEFUNCTION, write_cb);
+  easy_init(curl);
+  curl_easy_setopt(curl, CURLOPT_URL, URL);
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+  /* ignores any content */
+  curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, tutil_throwaway_cb);
 
-    /* if there's a proxy set, use it */
-    if(libtest_arg2 && *libtest_arg2) {
-      curl_easy_setopt(easy, CURLOPT_PROXY, libtest_arg2);
-      curl_easy_setopt(easy, CURLOPT_HTTPPROXYTUNNEL, 1L);
-    }
-    res = curl_easy_perform(easy);
-    if(res) {
-      printf("badness: %d\n", (int)res);
-    }
-    showem(easy, CURLH_CONNECT|CURLH_HEADER|CURLH_TRAILER|CURLH_1XX);
-    curl_easy_cleanup(easy);
+  /* if there is a proxy set, use it */
+  if(libtest_arg2 && *libtest_arg2) {
+    curl_easy_setopt(curl, CURLOPT_PROXY, libtest_arg2);
+    curl_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
   }
+  result = curl_easy_perform(curl);
+  if(result) {
+    curl_mprintf("badness: %d\n", (int)result);
+  }
+  t1945_showem(curl, CURLH_CONNECT | CURLH_HEADER | CURLH_TRAILER | CURLH_1XX);
+
+test_cleanup:
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
-  return 0;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1947.c b/third-party/curl/tests/libtest/lib1947.c
index b9b40079e3..a4abb497ca 100644
--- a/third-party/curl/tests/libtest/lib1947.c
+++ b/third-party/curl/tests/libtest/lib1947.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,69 +21,62 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "first.h"
 
-#include "test.h"
-
-#include "memdebug.h"
-
-static size_t writecb(char *data, size_t n, size_t l, void *userp)
-{
-  /* ignore the data */
-  (void)data;
-  (void)userp;
-  return n*l;
-}
-int test(char *URL)
+static CURLcode test_lib1947(const char *URL)
 {
   CURL *curl;
-  CURLcode res;
+  CURLcode result = CURLE_OK;
+  struct curl_header *h;
+  int count = 0;
+  unsigned int origins;
 
-  curl_global_init(CURL_GLOBAL_DEFAULT);
+  global_init(CURL_GLOBAL_DEFAULT);
 
-  curl = curl_easy_init();
-  if(curl) {
-    struct curl_header *h;
-    int count = 0;
-    int origins;
+  easy_init(curl);
 
-    /* perform a request that involves redirection */
-    curl_easy_setopt(curl, CURLOPT_URL, URL);
-    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writecb);
-    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
-    res = curl_easy_perform(curl);
-    if(res)
-      fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
-
-    /* count the number of requests by reading the first header of each
-       request. */
-    origins = (CURLH_HEADER|CURLH_TRAILER|CURLH_CONNECT|
-               CURLH_1XX|CURLH_PSEUDO);
-    do {
-      h = curl_easy_nextheader(curl, origins, count, NULL);
-      if(h)
-        count++;
-    } while(h);
-    printf("count = %u\n", count);
-
-    /* perform another request - without redirect */
-    curl_easy_setopt(curl, CURLOPT_URL, libtest_arg2);
-    res = curl_easy_perform(curl);
-    if(res)
-      fprintf(stderr, "curl_easy_perform() failed: %s\n",
-              curl_easy_strerror(res));
-
-    /* count the number of requests again. */
-    count = 0;
-    do {
-      h = curl_easy_nextheader(curl, origins, count, NULL);
-      if(h)
-        count++;
-    } while(h);
-    printf("count = %u\n", count);
-    curl_easy_cleanup(curl);
+  /* perform a request that involves redirection */
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_WRITEFUNCTION, tutil_throwaway_cb);
+  easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+  result = curl_easy_perform(curl);
+  if(result) {
+    curl_mfprintf(stderr, "curl_easy_perform() failed: %s\n",
+                  curl_easy_strerror(result));
+    goto test_cleanup;
   }
 
+  /* count the number of requests by reading the first header of each
+     request. */
+  origins = CURLH_HEADER | CURLH_TRAILER | CURLH_CONNECT | CURLH_1XX |
+            CURLH_PSEUDO;
+  do {
+    h = curl_easy_nextheader(curl, origins, count, NULL);
+    if(h)
+      count++;
+  } while(h);
+  curl_mprintf("count = %d\n", count);
+
+  /* perform another request - without redirect */
+  easy_setopt(curl, CURLOPT_URL, libtest_arg2);
+  result = curl_easy_perform(curl);
+  if(result) {
+    curl_mfprintf(stderr, "curl_easy_perform() failed: %s\n",
+                  curl_easy_strerror(result));
+    goto test_cleanup;
+  }
+
+  /* count the number of requests again. */
+  count = 0;
+  do {
+    h = curl_easy_nextheader(curl, origins, count, NULL);
+    if(h)
+      count++;
+  } while(h);
+  curl_mprintf("count = %d\n", count);
+
+test_cleanup:
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
-  return 0;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1948.c b/third-party/curl/tests/libtest/lib1948.c
index 4ee565e29d..9b8217be8f 100644
--- a/third-party/curl/tests/libtest/lib1948.c
+++ b/third-party/curl/tests/libtest/lib1948.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,18 +21,16 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "first.h"
 
-#include "test.h"
-
-typedef struct
-{
-  char *buf;
+struct put_buffer {
+  const char *buf;
   size_t len;
-} put_buffer;
+};
 
 static size_t put_callback(char *ptr, size_t size, size_t nmemb, void *stream)
 {
-  put_buffer *putdata = (put_buffer *)stream;
+  struct put_buffer *putdata = (struct put_buffer *)stream;
   size_t totalsize = size * nmemb;
   size_t tocopy = (putdata->len < totalsize) ? putdata->len : totalsize;
   memcpy(ptr, putdata->buf, tocopy);
@@ -41,39 +39,38 @@ static size_t put_callback(char *ptr, size_t size, size_t nmemb, void *stream)
   return tocopy;
 }
 
-int test(char *URL)
+static CURLcode test_lib1948(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OUT_OF_MEMORY;
+  CURLcode result = CURLE_OK;
+  static const char testput[] = "This is test PUT data\n";
+  struct put_buffer pbuf;
 
   curl_global_init(CURL_GLOBAL_DEFAULT);
 
-  curl = curl_easy_init();
-  if(curl) {
-    const char *testput = "This is test PUT data\n";
-    put_buffer pbuf;
+  easy_init(curl);
 
-    /* PUT */
-    curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
-    curl_easy_setopt(curl, CURLOPT_HEADER, 1L);
-    curl_easy_setopt(curl, CURLOPT_READFUNCTION, put_callback);
-    pbuf.buf = (char *)testput;
-    pbuf.len = strlen(testput);
-    curl_easy_setopt(curl, CURLOPT_READDATA, &pbuf);
-    curl_easy_setopt(curl, CURLOPT_INFILESIZE, (long)strlen(testput));
-    res = curl_easy_setopt(curl, CURLOPT_URL, URL);
-    if(!res)
-      res = curl_easy_perform(curl);
-    if(!res) {
-      /* POST */
-      curl_easy_setopt(curl, CURLOPT_POST, 1L);
-      curl_easy_setopt(curl, CURLOPT_POSTFIELDS, testput);
-      curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(testput));
-      res = curl_easy_perform(curl);
-    }
-    curl_easy_cleanup(curl);
-  }
+  /* PUT */
+  easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_READFUNCTION, put_callback);
+  pbuf.buf = testput;
+  pbuf.len = sizeof(testput) - 1;
+  easy_setopt(curl, CURLOPT_READDATA, &pbuf);
+  easy_setopt(curl, CURLOPT_INFILESIZE, (long)(sizeof(testput) - 1));
+  easy_setopt(curl, CURLOPT_URL, URL);
+  result = curl_easy_perform(curl);
+  if(result)
+    goto test_cleanup;
 
+  /* POST */
+  easy_setopt(curl, CURLOPT_POST, 1L);
+  easy_setopt(curl, CURLOPT_POSTFIELDS, testput);
+  easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)(sizeof(testput) - 1));
+  result = curl_easy_perform(curl);
+
+test_cleanup:
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1955.c b/third-party/curl/tests/libtest/lib1955.c
index 3328d7ef1a..ff640c20d4 100644
--- a/third-party/curl/tests/libtest/lib1955.c
+++ b/third-party/curl/tests/libtest/lib1955.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,41 +21,39 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1955(const char *URL)
 {
   CURL *curl;
-  CURLcode res = TEST_ERR_MAJOR_BAD;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   struct curl_slist *list = NULL;
   struct curl_slist *connect_to = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_AWS_SIGV4, "xxx");
-  test_setopt(curl, CURLOPT_USERPWD, "xxx");
-  test_setopt(curl, CURLOPT_HEADER, 0L);
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_AWS_SIGV4, "xxx");
+  easy_setopt(curl, CURLOPT_USERPWD, "xxx");
+  easy_setopt(curl, CURLOPT_HEADER, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
   list = curl_slist_append(list, "test3: 1234");
   if(!list)
     goto test_cleanup;
   if(libtest_arg2) {
     connect_to = curl_slist_append(connect_to, libtest_arg2);
   }
-  test_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
+  easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
   curl_slist_append(list, "Content-Type: application/json");
 
   /* 'name;' user headers with no value are used to send an empty header in the
@@ -75,9 +73,9 @@ int test(char *URL)
 
   curl_slist_append(list, "test_space: t\ts  m\t   end    ");
   curl_slist_append(list, "tesMixCase: MixCase");
-  test_setopt(curl, CURLOPT_HTTPHEADER, list);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, list);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -86,5 +84,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1956.c b/third-party/curl/tests/libtest/lib1956.c
index 105418dc89..5d569c785b 100644
--- a/third-party/curl/tests/libtest/lib1956.c
+++ b/third-party/curl/tests/libtest/lib1956.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,46 +21,44 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1956(const char *URL)
 {
   CURL *curl;
-  CURLcode res = TEST_ERR_MAJOR_BAD;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   struct curl_slist *list = NULL;
   struct curl_slist *connect_to = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_AWS_SIGV4, "xxx");
-  test_setopt(curl, CURLOPT_USERPWD, "xxx");
-  test_setopt(curl, CURLOPT_HEADER, 0L);
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_AWS_SIGV4, "xxx");
+  easy_setopt(curl, CURLOPT_USERPWD, "xxx");
+  easy_setopt(curl, CURLOPT_HEADER, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
   list = curl_slist_append(list, "Content-Type: application/json");
   if(!list)
     goto test_cleanup;
   if(libtest_arg2) {
     connect_to = curl_slist_append(connect_to, libtest_arg2);
   }
-  test_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
+  easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
   curl_slist_append(list, "X-Xxx-Content-Sha256: "
       "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855");
-  test_setopt(curl, CURLOPT_HTTPHEADER, list);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, list);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -69,5 +67,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1957.c b/third-party/curl/tests/libtest/lib1957.c
index 8397d9d243..b422e48553 100644
--- a/third-party/curl/tests/libtest/lib1957.c
+++ b/third-party/curl/tests/libtest/lib1957.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,45 +21,43 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1957(const char *URL)
 {
   CURL *curl;
-  CURLcode res = TEST_ERR_MAJOR_BAD;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   struct curl_slist *list = NULL;
   struct curl_slist *connect_to = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_AWS_SIGV4, "xxx");
-  test_setopt(curl, CURLOPT_USERPWD, "xxx");
-  test_setopt(curl, CURLOPT_HEADER, 0L);
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_AWS_SIGV4, "xxx");
+  easy_setopt(curl, CURLOPT_USERPWD, "xxx");
+  easy_setopt(curl, CURLOPT_HEADER, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
   list = curl_slist_append(list, "Content-Type: application/json");
   if(!list)
     goto test_cleanup;
   if(libtest_arg2) {
     connect_to = curl_slist_append(connect_to, libtest_arg2);
   }
-  test_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
+  easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
   curl_slist_append(list, "X-Xxx-Content-Sha256: arbitrary");
-  test_setopt(curl, CURLOPT_HTTPHEADER, list);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, list);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -68,5 +66,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1958.c b/third-party/curl/tests/libtest/lib1958.c
index 66b8d5dfd9..dc4ac1cd9a 100644
--- a/third-party/curl/tests/libtest/lib1958.c
+++ b/third-party/curl/tests/libtest/lib1958.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,45 +21,43 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1958(const char *URL)
 {
   CURL *curl;
-  CURLcode res = TEST_ERR_MAJOR_BAD;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   struct curl_slist *list = NULL;
   struct curl_slist *connect_to = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_AWS_SIGV4, "xxx");
-  test_setopt(curl, CURLOPT_USERPWD, "xxx");
-  test_setopt(curl, CURLOPT_HEADER, 0L);
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_AWS_SIGV4, "xxx");
+  easy_setopt(curl, CURLOPT_USERPWD, "xxx");
+  easy_setopt(curl, CURLOPT_HEADER, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
   list = curl_slist_append(list, "Content-Type: application/json");
   if(!list)
     goto test_cleanup;
   if(libtest_arg2) {
     connect_to = curl_slist_append(connect_to, libtest_arg2);
   }
-  test_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
+  easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
   curl_slist_append(list, "X-Xxx-Content-Sha256: \tarbitrary ");
-  test_setopt(curl, CURLOPT_HTTPHEADER, list);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, list);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -68,5 +66,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1959.c b/third-party/curl/tests/libtest/lib1959.c
index 5eee4f0123..4df8bd71cd 100644
--- a/third-party/curl/tests/libtest/lib1959.c
+++ b/third-party/curl/tests/libtest/lib1959.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,47 +21,45 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1959(const char *URL)
 {
   CURL *curl;
-  CURLcode res = TEST_ERR_MAJOR_BAD;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   struct curl_slist *list = NULL;
   struct curl_slist *connect_to = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_AWS_SIGV4, "xxx");
-  test_setopt(curl, CURLOPT_USERPWD, "xxx");
-  test_setopt(curl, CURLOPT_HEADER, 0L);
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_AWS_SIGV4, "xxx");
+  easy_setopt(curl, CURLOPT_USERPWD, "xxx");
+  easy_setopt(curl, CURLOPT_HEADER, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
   list = curl_slist_append(list, "Content-Type: application/json");
   if(!list)
     goto test_cleanup;
   if(libtest_arg2) {
     connect_to = curl_slist_append(connect_to, libtest_arg2);
   }
-  test_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
+  easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
   curl_slist_append(list, "X-Xxx-Content-Sha256: "
       "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
       "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855");
-  test_setopt(curl, CURLOPT_HTTPHEADER, list);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, list);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -70,5 +68,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1960.c b/third-party/curl/tests/libtest/lib1960.c
index fc2f4b0af7..fbb0f7e597 100644
--- a/third-party/curl/tests/libtest/lib1960.c
+++ b/third-party/curl/tests/libtest/lib1960.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,28 +21,17 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
 #ifdef HAVE_INET_PTON
 
-#ifdef WIN32
-#include <winsock2.h>
-#include <ws2tcpip.h>
-#include <windows.h>
-#endif
-
 #ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
 #endif
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
 #ifdef HAVE_ARPA_INET_H
 #include <arpa/inet.h>
 #endif
 
-#include "memdebug.h"
-
 /* to prevent libcurl from closing our socket */
 static int closesocket_cb(void *clientp, curl_socket_t item)
 {
@@ -73,24 +62,31 @@ static int sockopt_cb(void *clientp,
   return CURL_SOCKOPT_ALREADY_CONNECTED;
 }
 
+#ifdef __AMIGA__
+#define my_inet_pton(x, y, z) inet_pton(x, (unsigned char *)CURL_UNCONST(y), z)
+#else
+#define my_inet_pton(x, y, z) inet_pton(x, y, z)
+#endif
+
 /* Expected args: URL IP PORT */
-int test(char *URL)
+static CURLcode test_lib1960(const char *URL)
 {
   CURL *curl = NULL;
-  CURLcode res = TEST_ERR_MAJOR_BAD;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   int status;
   curl_socket_t client_fd = CURL_SOCKET_BAD;
   struct sockaddr_in serv_addr;
-  unsigned short port;
+  curl_off_t port;
 
   if(!strcmp("check", URL))
-    return 0; /* no output makes it not skipped */
+    return CURLE_OK; /* no output makes it not skipped */
 
-  port = (unsigned short)atoi(libtest_arg3);
+  if(curlx_str_number(&libtest_arg3, &port, 0xffff))
+    return result;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
-    return TEST_ERR_MAJOR_BAD;
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return result;
   }
 
   /*
@@ -98,58 +94,60 @@ int test(char *URL)
    * over this socket as "already connected" to libcurl and make sure that
    * this works.
    */
-  client_fd = socket(AF_INET, SOCK_STREAM, 0);
+  client_fd = CURL_SOCKET(AF_INET, SOCK_STREAM, 0);
   if(client_fd == CURL_SOCKET_BAD) {
-    fprintf(stderr, "socket creation error\n");
+    curl_mfprintf(stderr, "socket creation error\n");
     goto test_cleanup;
   }
 
+  memset(&serv_addr, 0, sizeof(serv_addr));
   serv_addr.sin_family = AF_INET;
-  serv_addr.sin_port = htons(port);
+  serv_addr.sin_port = htons((unsigned short)port);
 
-  if(inet_pton(AF_INET, libtest_arg2, &serv_addr.sin_addr) <= 0) {
-    fprintf(stderr, "inet_pton failed\n");
+  if(my_inet_pton(AF_INET, libtest_arg2, &serv_addr.sin_addr) <= 0) {
+    curl_mfprintf(stderr, "inet_pton failed\n");
     goto test_cleanup;
   }
 
-  status = connect(client_fd, (struct sockaddr*)&serv_addr, sizeof(serv_addr));
+  status = connect(client_fd, (struct sockaddr *)&serv_addr,
+                   sizeof(serv_addr));
   if(status < 0) {
-    fprintf(stderr, "connection failed\n");
+    curl_mfprintf(stderr, "connection failed\n");
     goto test_cleanup;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     goto test_cleanup;
   }
 
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, socket_cb);
-  test_setopt(curl, CURLOPT_OPENSOCKETDATA, &client_fd);
-  test_setopt(curl, CURLOPT_SOCKOPTFUNCTION, sockopt_cb);
-  test_setopt(curl, CURLOPT_SOCKOPTDATA, NULL);
-  test_setopt(curl, CURLOPT_CLOSESOCKETFUNCTION, closesocket_cb);
-  test_setopt(curl, CURLOPT_CLOSESOCKETDATA, NULL);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_HEADER, 1L);
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, socket_cb);
+  easy_setopt(curl, CURLOPT_OPENSOCKETDATA, &client_fd);
+  easy_setopt(curl, CURLOPT_SOCKOPTFUNCTION, sockopt_cb);
+  easy_setopt(curl, CURLOPT_SOCKOPTDATA, NULL);
+  easy_setopt(curl, CURLOPT_CLOSESOCKETFUNCTION, closesocket_cb);
+  easy_setopt(curl, CURLOPT_CLOSESOCKETDATA, NULL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
+  curl_easy_cleanup(curl);
   if(client_fd != CURL_SOCKET_BAD)
     sclose(client_fd);
-  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
 #else
-int test(char *URL)
+static CURLcode test_lib1960(const char *URL)
 {
   (void)URL;
-  printf("lacks inet_pton\n");
-  return 0;
+  curl_mprintf("lacks inet_pton\n");
+  return CURLE_OK;
 }
 #endif
diff --git a/third-party/curl/tests/libtest/lib1964.c b/third-party/curl/tests/libtest/lib1964.c
index a9881e98dd..17199ba898 100644
--- a/third-party/curl/tests/libtest/lib1964.c
+++ b/third-party/curl/tests/libtest/lib1964.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,14 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1964(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
   struct curl_slist *connect_to = NULL;
   struct curl_slist *list = NULL, *tmp;
 
@@ -41,7 +39,7 @@ int test(char *URL)
   if(libtest_arg2) {
     connect_to = curl_slist_append(connect_to, libtest_arg2);
     if(!connect_to) {
-      res = CURLE_FAILED_INIT;
+      result = CURLE_FAILED_INIT;
       goto test_cleanup;
     }
   }
@@ -49,13 +47,13 @@ int test(char *URL)
   list = curl_slist_append(list, "Content-Type: application/json");
   tmp = curl_slist_append(list, "X-Xxx-Date: 19700101T000000Z");
   if(!list || !tmp) {
-    res = CURLE_FAILED_INIT;
+    result = CURLE_FAILED_INIT;
     goto test_cleanup;
   }
   list = tmp;
   easy_setopt(curl, CURLOPT_HTTPHEADER, list);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -64,5 +62,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1965.c b/third-party/curl/tests/libtest/lib1965.c
new file mode 100644
index 0000000000..e09ff349b3
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1965.c
@@ -0,0 +1,55 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static CURLcode test_lib1965(const char *URL)
+{
+  CURLcode result = CURLE_OK;
+  CURLUcode rc;
+  static const char *schemes[] = {
+    "bad!", "bad{", "bad/", "bad\\", "a!",
+    "a+123", "http-2", "http.1",
+    "a+-.123", "http-+++2", "http.1--",
+    "+a123", "-http2", ".http1",
+    "ABC2", "2CBA", "", "a",
+    "aaaaaaaaaabbbbbbbbbbccccccccccdddddddddd",
+    "aaaaaaaaaabbbbbbbbbbccccccccccdddddddddde",
+    NULL };
+  int i;
+  (void)URL;
+
+  global_init(CURL_GLOBAL_ALL);
+
+  for(i = 0; schemes[i]; i++) {
+    CURLU *url = curl_url();
+    rc = curl_url_set(url, CURLUPART_SCHEME, schemes[i],
+                      CURLU_NON_SUPPORT_SCHEME);
+    curl_mprintf("%s %s\n", schemes[i],
+                 rc == CURLUE_OK ? "ACCEPTED" : "REJECTED");
+    curl_url_cleanup(url);
+  }
+
+  curl_global_cleanup();
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1967.c b/third-party/curl/tests/libtest/lib1967.c
new file mode 100644
index 0000000000..e271df28d9
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1967.c
@@ -0,0 +1,42 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static CURLcode test_lib1967(const char *URL)
+{
+  CURLU *u = curl_url();
+  (void)URL;
+  if(u) {
+    char *url;
+    curl_url_set(u, CURLUPART_URL, "a.b", CURLU_GUESS_SCHEME);
+    curl_url_set(u, CURLUPART_URL, "/x", CURLU_NO_GUESS_SCHEME);
+
+    if(!curl_url_get(u, CURLUPART_URL, &url, 0)) {
+      curl_mprintf("URL %s\n", url);
+      curl_free(url);
+    }
+    curl_url_cleanup(u);
+  }
+  return CURLE_OK;
+}
diff --git a/third-party/curl/tests/libtest/lib1970.c b/third-party/curl/tests/libtest/lib1970.c
index ff86fdd2c1..8fd69f6f1e 100644
--- a/third-party/curl/tests/libtest/lib1970.c
+++ b/third-party/curl/tests/libtest/lib1970.c
@@ -5,11 +5,11 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,46 +21,44 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1970(const char *URL)
 {
   CURL *curl;
-  CURLcode res = TEST_ERR_MAJOR_BAD;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   struct curl_slist *list = NULL;
   struct curl_slist *connect_to = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_UPLOAD, 1L);
-  test_setopt(curl, CURLOPT_INFILESIZE, 0L);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_AWS_SIGV4, "aws:amz:us-east-1:s3");
-  test_setopt(curl, CURLOPT_USERPWD, "xxx");
-  test_setopt(curl, CURLOPT_HEADER, 0L);
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+  easy_setopt(curl, CURLOPT_INFILESIZE, 0L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_AWS_SIGV4, "aws:amz:us-east-1:s3");
+  easy_setopt(curl, CURLOPT_USERPWD, "xxx");
+  easy_setopt(curl, CURLOPT_HEADER, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
   list = curl_slist_append(list, "Content-Type: application/json");
   if(!list)
     goto test_cleanup;
-  test_setopt(curl, CURLOPT_HTTPHEADER, list);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, list);
   if(libtest_arg2) {
     connect_to = curl_slist_append(connect_to, libtest_arg2);
   }
-  test_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
+  easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -69,5 +67,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1971.c b/third-party/curl/tests/libtest/lib1971.c
index 173fc2f12b..81d5956a44 100644
--- a/third-party/curl/tests/libtest/lib1971.c
+++ b/third-party/curl/tests/libtest/lib1971.c
@@ -5,11 +5,11 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,56 +21,53 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static size_t read_callback(char *buffer, size_t size, size_t nitems,
-                            void *userdata)
+static size_t t1971_read_cb(char *ptr, size_t size, size_t nitems, void *userp)
 {
-  (void)buffer; /* unused */
-  (void)size; /* unused */
-  (void)nitems; /* unused */
-  (void)userdata; /* unused */
+  (void)ptr;
+  (void)size;
+  (void)nitems;
+  (void)userp;
   return 0;
 }
 
-int test(char *URL)
+static CURLcode test_lib1971(const char *URL)
 {
   CURL *curl;
-  CURLcode res = TEST_ERR_MAJOR_BAD;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   struct curl_slist *list = NULL;
   struct curl_slist *connect_to = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_UPLOAD, 1L);
-  test_setopt(curl, CURLOPT_READFUNCTION, read_callback);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_AWS_SIGV4, "aws:amz:us-east-1:s3");
-  test_setopt(curl, CURLOPT_USERPWD, "xxx");
-  test_setopt(curl, CURLOPT_HEADER, 0L);
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+  easy_setopt(curl, CURLOPT_READFUNCTION, t1971_read_cb);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_AWS_SIGV4, "aws:amz:us-east-1:s3");
+  easy_setopt(curl, CURLOPT_USERPWD, "xxx");
+  easy_setopt(curl, CURLOPT_HEADER, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
   list = curl_slist_append(list, "Content-Type: application/json");
   if(!list)
     goto test_cleanup;
-  test_setopt(curl, CURLOPT_HTTPHEADER, list);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, list);
   if(libtest_arg2) {
     connect_to = curl_slist_append(connect_to, libtest_arg2);
   }
-  test_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
+  easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -79,5 +76,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1972.c b/third-party/curl/tests/libtest/lib1972.c
index c21e8da937..4315798aec 100644
--- a/third-party/curl/tests/libtest/lib1972.c
+++ b/third-party/curl/tests/libtest/lib1972.c
@@ -5,11 +5,11 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,27 +21,25 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1972(const char *URL)
 {
   CURL *curl;
   curl_mime *mime = NULL;
   curl_mimepart *part = NULL;
-  CURLcode res = TEST_ERR_MAJOR_BAD;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   struct curl_slist *list = NULL;
   struct curl_slist *connect_to = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
@@ -55,22 +53,22 @@ int test(char *URL)
   curl_mime_name(part, "foo");
   curl_mime_data(part, "bar", CURL_ZERO_TERMINATED);
 
-  test_setopt(curl, CURLOPT_MIMEPOST, mime);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_AWS_SIGV4, "aws:amz:us-east-1:s3");
-  test_setopt(curl, CURLOPT_USERPWD, "xxx");
-  test_setopt(curl, CURLOPT_HEADER, 0L);
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_MIMEPOST, mime);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_AWS_SIGV4, "aws:amz:us-east-1:s3");
+  easy_setopt(curl, CURLOPT_USERPWD, "xxx");
+  easy_setopt(curl, CURLOPT_HEADER, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
   list = curl_slist_append(list, "Content-Type: application/json");
   if(!list)
     goto test_cleanup;
-  test_setopt(curl, CURLOPT_HTTPHEADER, list);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, list);
   if(libtest_arg2) {
     connect_to = curl_slist_append(connect_to, libtest_arg2);
   }
-  test_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
+  easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -80,5 +78,5 @@ test_cleanup:
   curl_mime_free(mime);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1973.c b/third-party/curl/tests/libtest/lib1973.c
index d95744fcb5..778b7af636 100644
--- a/third-party/curl/tests/libtest/lib1973.c
+++ b/third-party/curl/tests/libtest/lib1973.c
@@ -5,11 +5,11 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,45 +21,43 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1973(const char *URL)
 {
   CURL *curl;
-  CURLcode res = TEST_ERR_MAJOR_BAD;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   struct curl_slist *list = NULL;
   struct curl_slist *connect_to = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_POSTFIELDS, "post fields\n");
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_AWS_SIGV4, "aws:amz:us-east-1:s3");
-  test_setopt(curl, CURLOPT_USERPWD, "xxx");
-  test_setopt(curl, CURLOPT_HEADER, 0L);
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_POSTFIELDS, "post fields\n");
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_AWS_SIGV4, "aws:amz:us-east-1:s3");
+  easy_setopt(curl, CURLOPT_USERPWD, "xxx");
+  easy_setopt(curl, CURLOPT_HEADER, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
   list = curl_slist_append(list, "Content-Type: application/json");
   if(!list)
     goto test_cleanup;
-  test_setopt(curl, CURLOPT_HTTPHEADER, list);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, list);
   if(libtest_arg2) {
     connect_to = curl_slist_append(connect_to, libtest_arg2);
   }
-  test_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
+  easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -68,5 +66,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1974.c b/third-party/curl/tests/libtest/lib1974.c
index 948d44df9d..84bd430f56 100644
--- a/third-party/curl/tests/libtest/lib1974.c
+++ b/third-party/curl/tests/libtest/lib1974.c
@@ -5,11 +5,11 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,39 +21,37 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib1974(const char *URL)
 {
   CURL *curl;
-  CURLcode res = TEST_ERR_MAJOR_BAD;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   struct curl_slist *connect_to = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_AWS_SIGV4, "aws:amz:us-east-1:s3");
-  test_setopt(curl, CURLOPT_USERPWD, "xxx");
-  test_setopt(curl, CURLOPT_HEADER, 0L);
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_AWS_SIGV4, "aws:amz:us-east-1:s3");
+  easy_setopt(curl, CURLOPT_USERPWD, "xxx");
+  easy_setopt(curl, CURLOPT_HEADER, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
   if(libtest_arg2) {
     connect_to = curl_slist_append(connect_to, libtest_arg2);
   }
-  test_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
+  easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -61,5 +59,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1975.c b/third-party/curl/tests/libtest/lib1975.c
index bca0c763f8..05d6e7c67f 100644
--- a/third-party/curl/tests/libtest/lib1975.c
+++ b/third-party/curl/tests/libtest/lib1975.c
@@ -5,11 +5,11 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at https://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is
@@ -21,58 +21,55 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static size_t read_callback(char *buffer, size_t size, size_t nitems,
-                            void *userdata)
+static size_t t1975_read_cb(char *ptr, size_t size, size_t nitems, void *userp)
 {
-  (void)buffer; /* unused */
-  (void)size; /* unused */
-  (void)nitems; /* unused */
-  (void)userdata; /* unused */
+  (void)ptr;
+  (void)size;
+  (void)nitems;
+  (void)userp;
   return 0;
 }
 
-int test(char *URL)
+static CURLcode test_lib1975(const char *URL)
 {
   CURL *curl;
-  CURLcode res = TEST_ERR_MAJOR_BAD;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   struct curl_slist *list = NULL;
   struct curl_slist *connect_to = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_UPLOAD, 1L);
-  test_setopt(curl, CURLOPT_READFUNCTION, read_callback);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_AWS_SIGV4, "aws:amz:us-east-1:s3");
-  test_setopt(curl, CURLOPT_USERPWD, "xxx");
-  test_setopt(curl, CURLOPT_HEADER, 0L);
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+  easy_setopt(curl, CURLOPT_READFUNCTION, t1975_read_cb);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_AWS_SIGV4, "aws:amz:us-east-1:s3");
+  easy_setopt(curl, CURLOPT_USERPWD, "xxx");
+  easy_setopt(curl, CURLOPT_HEADER, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
   list = curl_slist_append(list, "Content-Type: application/json");
   if(!list)
     goto test_cleanup;
   curl_slist_append(list, "X-Amz-Content-Sha256: "
     "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855");
-  test_setopt(curl, CURLOPT_HTTPHEADER, list);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, list);
   if(libtest_arg2) {
     connect_to = curl_slist_append(connect_to, libtest_arg2);
   }
-  test_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
+  easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -81,5 +78,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib1977.c b/third-party/curl/tests/libtest/lib1977.c
new file mode 100644
index 0000000000..a5db34226c
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1977.c
@@ -0,0 +1,89 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static CURLcode test_lib1977(const char *URL)
+{
+  CURLcode result = CURLE_OK;
+  CURLU *curlu = curl_url();
+  CURLU *curlu_2 = curl_url();
+  CURL *curl;
+  const char *effective = NULL;
+
+  global_init(CURL_GLOBAL_ALL);
+  easy_init(curl);
+
+  /* first transfer: set the URL in the first CURLU handle */
+  curl_url_set(curlu, CURLUPART_URL, URL, CURLU_DEFAULT_SCHEME);
+  easy_setopt(curl, CURLOPT_CURLU, curlu);
+
+  result = curl_easy_perform(curl);
+  if(result)
+    goto test_cleanup;
+
+  effective = NULL;
+  result = curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_URL, &effective);
+  if(result)
+    goto test_cleanup;
+  curl_mprintf("effective URL: %s\n", effective);
+
+  /* second transfer: set URL + query in the second CURLU handle */
+  curl_url_set(curlu_2, CURLUPART_URL, URL, CURLU_DEFAULT_SCHEME);
+  curl_url_set(curlu_2, CURLUPART_QUERY, "foo", 0);
+  easy_setopt(curl, CURLOPT_CURLU, curlu_2);
+
+  result = curl_easy_perform(curl);
+  if(result)
+    goto test_cleanup;
+
+  effective = NULL;
+  result = curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_URL, &effective);
+  if(result)
+    goto test_cleanup;
+  curl_mprintf("effective URL: %s\n", effective);
+
+  /* third transfer: append extra query in the second CURLU handle, but do not
+     set CURLOPT_CURLU again. this is to test that the contents of the handle
+     is allowed to change between transfers and is used without having to set
+     CURLOPT_CURLU again */
+  curl_url_set(curlu_2, CURLUPART_QUERY, "bar", CURLU_APPENDQUERY);
+
+  result = curl_easy_perform(curl);
+  if(result)
+    goto test_cleanup;
+
+  effective = NULL;
+  result = curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_URL, &effective);
+  if(result)
+    goto test_cleanup;
+  curl_mprintf("effective URL: %s\n", effective);
+
+test_cleanup:
+  curl_easy_cleanup(curl);
+  curl_url_cleanup(curlu);
+  curl_url_cleanup(curlu_2);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib1978.c b/third-party/curl/tests/libtest/lib1978.c
new file mode 100644
index 0000000000..5a6a44a048
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib1978.c
@@ -0,0 +1,102 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static CURLcode test_lib1978(const char *URL)
+{
+  CURL *curl;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
+  struct curl_slist *connect_to = NULL;
+  struct curl_slist *list = NULL;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+  easy_setopt(curl, CURLOPT_INFILESIZE, 0L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_AWS_SIGV4, "aws:amz:us-east-1:s3");
+  easy_setopt(curl, CURLOPT_HEADER, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+
+  /* We want to test a couple assumptions here.
+     1. the merging works with non-adjacent headers
+     2. the merging works across multiple duplicate headers
+     3. the merging works if a duplicate header has no colon
+     4. the merging works if the headers are cased differently
+     5. the merging works across multiple duplicate headers
+     6. the merging works across multiple duplicate headers with the
+        same value
+     7. merging works for headers all with no values
+     8. merging works for headers some with no values
+  */
+
+  list = curl_slist_append(list, "x-amz-meta-test: test2");
+  if(!list)
+    goto test_cleanup;
+  curl_slist_append(list, "some-other-header: value");
+  curl_slist_append(list, "x-amz-meta-test: test1");
+  curl_slist_append(list, "duplicate-header: duplicate");
+  curl_slist_append(list, "header-no-value");
+  curl_slist_append(list, "x-amz-meta-test: test3");
+  curl_slist_append(list, "X-amz-meta-test2: test2");
+  curl_slist_append(list, "x-amz-meta-blah: blah");
+  curl_slist_append(list, "x-Amz-meta-test2: test1");
+  curl_slist_append(list, "x-amz-Meta-test2: test3");
+  curl_slist_append(list, "curr-header-no-colon");
+  curl_slist_append(list, "curr-header-no-colon: value");
+  curl_slist_append(list, "next-header-no-colon: value");
+  curl_slist_append(list, "next-header-no-colon");
+  curl_slist_append(list, "duplicate-header: duplicate");
+  curl_slist_append(list, "header-no-value;");
+  curl_slist_append(list, "header-no-value;");
+  curl_slist_append(list, "header-some-no-value;");
+  curl_slist_append(list, "header-some-no-value: value");
+
+  easy_setopt(curl, CURLOPT_HTTPHEADER, list);
+  if(libtest_arg2) {
+    connect_to = curl_slist_append(connect_to, libtest_arg2);
+  }
+  easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
+
+  result = curl_easy_perform(curl);
+
+test_cleanup:
+
+  curl_slist_free_all(connect_to);
+  curl_slist_free_all(list);
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib2023.c b/third-party/curl/tests/libtest/lib2023.c
new file mode 100644
index 0000000000..b0072b6b12
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib2023.c
@@ -0,0 +1,148 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/* argv1 = URL
+ * argv2 = main auth type
+ * argv3 = second auth type
+ */
+
+#include "first.h"
+
+static CURLcode send_request(CURL *curl, const char *url, int seq,
+                             long auth_scheme, const char *userpwd)
+{
+  CURLcode result;
+  size_t len = strlen(url) + 4 + 1;
+  char *full_url = curlx_malloc(len);
+  if(!full_url) {
+    curl_mfprintf(stderr, "Not enough memory for full URL\n");
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  curl_msnprintf(full_url, len, "%s%04d", url, seq);
+  curl_mfprintf(stderr, "Sending new request %d to %s with credential %s "
+                "(auth %ld)\n", seq, full_url, userpwd, auth_scheme);
+  easy_setopt(curl, CURLOPT_URL, full_url);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_HTTPGET, 1L);
+  easy_setopt(curl, CURLOPT_USERPWD, userpwd);
+  easy_setopt(curl, CURLOPT_HTTPAUTH, auth_scheme);
+
+  result = curl_easy_perform(curl);
+
+test_cleanup:
+  curlx_free(full_url);
+  return result;
+}
+
+static CURLcode send_wrong_password(CURL *curl, const char *url, int seq,
+                                    long auth_scheme)
+{
+  return send_request(curl, url, seq, auth_scheme, "testuser:wrongpass");
+}
+
+static CURLcode send_right_password(CURL *curl, const char *url, int seq,
+                                    long auth_scheme)
+{
+  return send_request(curl, url, seq, auth_scheme, "testuser:testpass");
+}
+
+static long parse_auth_name(const char *arg)
+{
+  if(!arg)
+    return CURLAUTH_NONE;
+  if(curl_strequal(arg, "basic"))
+    return CURLAUTH_BASIC;
+  if(curl_strequal(arg, "digest"))
+    return CURLAUTH_DIGEST;
+  if(curl_strequal(arg, "ntlm"))
+    return CURLAUTH_NTLM;
+  return CURLAUTH_NONE;
+}
+
+static CURLcode test_lib2023(const char *URL)  /* libauthretry */
+{
+  CURLcode result;
+  CURL *curl = NULL;
+
+  long main_auth_scheme = parse_auth_name(libtest_arg2);
+  long fallback_auth_scheme = parse_auth_name(libtest_arg3);
+
+  if(main_auth_scheme == CURLAUTH_NONE ||
+     fallback_auth_scheme == CURLAUTH_NONE) {
+    curl_mfprintf(stderr, "auth schemes not found on commandline\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  /* Send wrong password, then right password */
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  result = send_wrong_password(curl, URL, 100, main_auth_scheme);
+  if(result != CURLE_OK)
+    goto test_cleanup;
+
+  result = send_right_password(curl, URL, 200, fallback_auth_scheme);
+  if(result != CURLE_OK)
+    goto test_cleanup;
+
+  curl_easy_cleanup(curl);
+
+  /* Send wrong password twice, then right password */
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  result = send_wrong_password(curl, URL, 300, main_auth_scheme);
+  if(result != CURLE_OK)
+    goto test_cleanup;
+
+  result = send_wrong_password(curl, URL, 400, fallback_auth_scheme);
+  if(result != CURLE_OK)
+    goto test_cleanup;
+
+  result = send_right_password(curl, URL, 500, fallback_auth_scheme);
+  if(result != CURLE_OK)
+    goto test_cleanup;
+
+test_cleanup:
+
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib2032.c b/third-party/curl/tests/libtest/lib2032.c
new file mode 100644
index 0000000000..e06a4d704b
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib2032.c
@@ -0,0 +1,234 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#define MAX_EASY_HANDLES 3
+
+static int ntlm_counter[MAX_EASY_HANDLES];
+static CURL *ntlm_curls[MAX_EASY_HANDLES];
+static curl_socket_t ntlm_sockets[MAX_EASY_HANDLES];
+static CURLcode ntlmcb_res = CURLE_OK;
+
+static size_t cb2032(char *ptr, size_t size, size_t nmemb, void *data)
+{
+  ssize_t idx = ((CURL **)data) - ntlm_curls;
+  curl_socket_t sock;
+  long longdata;
+  CURLcode result;
+  const size_t failure = (size && nmemb) ? 0 : 1;
+  (void)ptr;
+
+  ntlm_counter[idx] += (int)(size * nmemb);
+
+  /* Get socket being used for this easy handle, otherwise CURL_SOCKET_BAD */
+  result = curl_easy_getinfo(ntlm_curls[idx], CURLINFO_LASTSOCKET, &longdata);
+
+  if(result != CURLE_OK) {
+    curl_mfprintf(stderr, "%s:%d curl_easy_getinfo() failed, "
+                  "with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
+    ntlmcb_res = TEST_ERR_MAJOR_BAD;
+    return failure;
+  }
+  if(longdata == -1L)
+    sock = CURL_SOCKET_BAD;
+  else
+    sock = (curl_socket_t)longdata;
+
+  if(sock != CURL_SOCKET_BAD) {
+    /* Track relationship between this easy handle and the socket. */
+    if(ntlm_sockets[idx] == CURL_SOCKET_BAD) {
+      /* An easy handle without previous socket, record the socket. */
+      ntlm_sockets[idx] = sock;
+    }
+    else if(sock != ntlm_sockets[idx]) {
+      /* An easy handle with a socket different to previously
+         tracked one, log and fail right away. Known bug #37. */
+      curl_mfprintf(stderr, "Handle %zd started on socket %" FMT_SOCKET_T
+                    " and moved to %" FMT_SOCKET_T "\n",
+                    idx, ntlm_sockets[idx], sock);
+      ntlmcb_res = TEST_ERR_MAJOR_BAD;
+      return failure;
+    }
+  }
+  return size * nmemb;
+}
+
+static CURLcode test_lib2032(const char *URL) /* libntlmconnect */
+{
+  enum HandleState {
+    ReadyForNewHandle,
+    NeedSocketForNewHandle,
+    NoMoreHandles
+  };
+
+  CURLcode result = CURLE_OK;
+  CURLM *multi = NULL;
+  int running;
+  int i;
+  int num_handles = 0;
+  enum HandleState state = ReadyForNewHandle;
+  size_t urllen = strlen(URL) + 4 + 1;
+  char *full_url = curlx_malloc(urllen);
+
+  start_test_timing();
+
+  if(!full_url) {
+    curl_mfprintf(stderr, "Not enough memory for full URL\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  for(i = 0; i < MAX_EASY_HANDLES; ++i) {
+    ntlm_curls[i] = NULL;
+    ntlm_sockets[i] = CURL_SOCKET_BAD;
+  }
+
+  res_global_init(CURL_GLOBAL_ALL);
+  if(result) {
+    curlx_free(full_url);
+    return result;
+  }
+
+  multi_init(multi);
+
+  for(;;) {
+    struct timeval interval;
+    fd_set fdread;
+    fd_set fdwrite;
+    fd_set fdexcep;
+    long timeout = -99;
+    int maxfd = -99;
+    bool found_new_socket = FALSE;
+
+    /* Start a new handle if we are not at the max */
+    if(state == ReadyForNewHandle) {
+      easy_init(ntlm_curls[num_handles]);
+
+      if(num_handles % 3 == 2) {
+        curl_msnprintf(full_url, urllen, "%s0200", URL);
+        easy_setopt(ntlm_curls[num_handles], CURLOPT_HTTPAUTH, CURLAUTH_NTLM);
+      }
+      else {
+        curl_msnprintf(full_url, urllen, "%s0100", URL);
+        easy_setopt(ntlm_curls[num_handles], CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
+      }
+      easy_setopt(ntlm_curls[num_handles], CURLOPT_FRESH_CONNECT, 1L);
+      easy_setopt(ntlm_curls[num_handles], CURLOPT_URL, full_url);
+      easy_setopt(ntlm_curls[num_handles], CURLOPT_VERBOSE, 1L);
+      easy_setopt(ntlm_curls[num_handles], CURLOPT_HTTPGET, 1L);
+      easy_setopt(ntlm_curls[num_handles], CURLOPT_USERPWD,
+                  "testuser:testpass");
+      easy_setopt(ntlm_curls[num_handles], CURLOPT_WRITEFUNCTION, cb2032);
+      easy_setopt(ntlm_curls[num_handles], CURLOPT_WRITEDATA,
+                  (void *)(ntlm_curls + num_handles));
+      easy_setopt(ntlm_curls[num_handles], CURLOPT_HEADER, 1L);
+
+      multi_add_handle(multi, ntlm_curls[num_handles]);
+      num_handles += 1;
+      state = NeedSocketForNewHandle;
+      result = ntlmcb_res;
+    }
+
+    multi_perform(multi, &running);
+
+    curl_mfprintf(stderr, "%s:%d running %d state %d\n",
+                  __FILE__, __LINE__, running, (int)state);
+
+    abort_on_test_timeout();
+
+    if(!running && state == NoMoreHandles)
+      break; /* done */
+
+    FD_ZERO(&fdread);
+    FD_ZERO(&fdwrite);
+    FD_ZERO(&fdexcep);
+
+    multi_fdset(multi, &fdread, &fdwrite, &fdexcep, &maxfd);
+
+    /* At this point, maxfd is guaranteed to be greater or equal than -1. */
+
+    if(state == NeedSocketForNewHandle) {
+      if(maxfd != -1 && !found_new_socket) {
+        curl_mfprintf(stderr,
+                      "Warning: socket did not open immediately for new "
+                      "handle (trying again)\n");
+        continue;
+      }
+      state =
+        num_handles < MAX_EASY_HANDLES ? ReadyForNewHandle : NoMoreHandles;
+      curl_mfprintf(stderr, "%s:%d new state %d\n",
+                    __FILE__, __LINE__, (int)state);
+    }
+
+    multi_timeout(multi, &timeout);
+
+    /* At this point, timeout is guaranteed to be greater or equal than -1. */
+
+    curl_mfprintf(stderr, "%s:%d num_handles %d timeout %ld running %d\n",
+                  __FILE__, __LINE__, num_handles, timeout, running);
+
+    if(timeout != -1L) {
+      int itimeout;
+#if LONG_MAX > INT_MAX
+      itimeout = (timeout > (long)INT_MAX) ? INT_MAX : (int)timeout;
+#else
+      itimeout = (int)timeout;
+#endif
+      interval.tv_sec = itimeout / 1000;
+      interval.tv_usec = (itimeout % 1000) * 1000;
+    }
+    else {
+      interval.tv_sec = 0;
+      interval.tv_usec = 5000;
+
+      /* if there is no timeout and we get here on the last handle, we may
+         already have read the last part of the stream so waiting makes no
+         sense */
+      if(!running && num_handles == MAX_EASY_HANDLES) {
+        break;
+      }
+    }
+
+    select_test(maxfd + 1, &fdread, &fdwrite, &fdexcep, &interval);
+
+    abort_on_test_timeout();
+  }
+
+test_cleanup:
+
+  /* proper cleanup sequence - type PB */
+
+  for(i = 0; i < MAX_EASY_HANDLES; i++) {
+    curl_mprintf("Data connection %d: %d\n", i, ntlm_counter[i]);
+    curl_multi_remove_handle(multi, ntlm_curls[i]);
+    curl_easy_cleanup(ntlm_curls[i]);
+  }
+
+  curl_multi_cleanup(multi);
+  curl_global_cleanup();
+
+  curlx_free(full_url);
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib2082.c b/third-party/curl/tests/libtest/lib2082.c
new file mode 100644
index 0000000000..8a404f2327
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib2082.c
@@ -0,0 +1,102 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Max Dymond, <max.dymond@microsoft.com>
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+struct prcs {
+  int prereq_retcode;
+  int ipv6;
+};
+
+static int prereq_callback(void *clientp,
+                           char *conn_primary_ip,
+                           char *conn_local_ip,
+                           int conn_primary_port,
+                           int conn_local_port)
+{
+  struct prcs *prereq_cb = (struct prcs *)clientp;
+
+  if(prereq_cb->ipv6) {
+    curl_mprintf("Connected to [%s]\n", conn_primary_ip);
+    curl_mprintf("Connected from [%s]\n", conn_local_ip);
+  }
+  else {
+    curl_mprintf("Connected to %s\n", conn_primary_ip);
+    curl_mprintf("Connected from %s\n", conn_local_ip);
+  }
+
+  curl_mprintf("Remote port = %d\n", conn_primary_port);
+  curl_mprintf("Local port = %d\n", conn_local_port);
+  curl_mprintf("Returning = %d\n", prereq_cb->prereq_retcode);
+  return prereq_cb->prereq_retcode;
+}
+
+static CURLcode test_lib2082(const char *URL)  /* libprereq */
+{
+  CURLcode result = TEST_ERR_MAJOR_BAD;
+  CURL *curl = NULL;
+
+  struct prcs prereq_cb;
+
+  prereq_cb.prereq_retcode = CURL_PREREQFUNC_OK;
+  prereq_cb.ipv6 = 0;
+
+  curl_global_init(CURL_GLOBAL_ALL);
+  curl = curl_easy_init();
+
+  if(curl) {
+    if(strstr(URL, "#ipv6")) {
+      /* The IP addresses should be surrounded by brackets! */
+      prereq_cb.ipv6 = 1;
+    }
+    if(strstr(URL, "#err")) {
+      /* Set the callback to exit with failure */
+      prereq_cb.prereq_retcode = CURL_PREREQFUNC_ABORT;
+    }
+
+    curl_easy_setopt(curl, CURLOPT_URL, URL);
+    curl_easy_setopt(curl, CURLOPT_PREREQFUNCTION, prereq_callback);
+    curl_easy_setopt(curl, CURLOPT_PREREQDATA, &prereq_cb);
+    curl_easy_setopt(curl, CURLOPT_WRITEDATA, stderr);
+
+    if(strstr(URL, "#redir")) {
+      /* Enable follow-location */
+      curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+    }
+
+    result = curl_easy_perform(curl);
+    if(result) {
+      curl_mfprintf(stderr,
+                    "%s:%d curl_easy_perform() failed with code %d (%s)\n",
+                    __FILE__, __LINE__, (int)result,
+                    curl_easy_strerror(result));
+      goto test_cleanup;
+    }
+  }
+
+test_cleanup:
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib2301.c b/third-party/curl/tests/libtest/lib2301.c
index e654f8166b..0af579231e 100644
--- a/third-party/curl/tests/libtest/lib2301.c
+++ b/third-party/curl/tests/libtest/lib2301.c
@@ -21,108 +21,57 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "first.h"
 
-#include "test.h"
-
-#ifdef USE_WEBSOCKETS
+#ifndef CURL_DISABLE_WEBSOCKETS
 #if 0
-
-static int ping(CURL *curl, const char *send_payload)
-{
-  size_t sent;
-  CURLcode result =
-    curl_ws_send(curl, send_payload, strlen(send_payload), &sent, CURLWS_PING);
-  fprintf(stderr,
-          "ws: curl_ws_send returned %u, sent %u\n", (int)result, (int)sent);
-
-  return (int)result;
-}
-
-static int recv_pong(CURL *curl, const char *expected_payload)
-{
-  size_t rlen;
-  unsigned int rflags;
-  char buffer[256];
-  CURLcode result =
-    curl_ws_recv(curl, buffer, sizeof(buffer), &rlen, &rflags);
-  if(rflags & CURLWS_PONG) {
-    int same = 0;
-    fprintf(stderr, "ws: got PONG back\n");
-    if(rlen == strlen(expected_payload)) {
-      if(!memcmp(expected_payload, buffer, rlen)) {
-        fprintf(stderr, "ws: got the same payload back\n");
-        same = 1;
-      }
-    }
-    if(!same)
-      fprintf(stderr, "ws: did NOT get the same payload back\n");
-  }
-  else {
-    fprintf(stderr, "recv_pong: got %u bytes rflags %x\n", (int)rlen, rflags);
-  }
-  fprintf(stderr, "ws: curl_ws_recv returned %u, received %u\n", (int)result,
-         rlen);
-  return (int)result;
-}
-
-/* just close the connection */
-static void websocket_close(CURL *curl)
-{
-  size_t sent;
-  CURLcode result =
-    curl_ws_send(curl, "", 0, &sent, CURLWS_CLOSE);
-  fprintf(stderr,
-          "ws: curl_ws_send returned %u, sent %u\n", (int)result, (int)sent);
-}
-
-static void websocket(CURL *curl)
+static void t2301_websocket(CURL *curl)
 {
   int i = 0;
-  fprintf(stderr, "ws: websocket() starts\n");
+  curl_mfprintf(stderr, "ws: websocket() starts\n");
   do {
-    if(ping(curl, "foobar"))
+    if(ws_send_ping(curl, "foobar"))
       return;
-    if(recv_pong(curl, "foobar"))
+    if(ws_recv_pong(curl, "foobar"))
       return;
-    sleep(2);
+    curlx_wait_ms(2000);
   } while(i++ < 10);
-  websocket_close(curl);
+  ws_close(curl);
 }
-
 #endif
 
-static size_t writecb(char *b, size_t size, size_t nitems, void *p)
+static size_t t2301_write_cb(char *b, size_t size, size_t nitems, void *p)
 {
-  CURL *easy = p;
+  CURL *curl = p;
   unsigned char *buffer = (unsigned char *)b;
   size_t i;
   size_t sent;
-  unsigned char pong[] = {
-    0x8a, 0x0
-  };
+  unsigned char pong[] = { 0x8a, 0x0 };
   size_t incoming = nitems;
-  fprintf(stderr, "Called CURLOPT_WRITEFUNCTION with %u bytes: ",
-          (int)nitems);
+  curl_mfprintf(stderr, "Called CURLOPT_WRITEFUNCTION with %zu bytes: ",
+                nitems);
   for(i = 0; i < nitems; i++)
-    fprintf(stderr, "%02x ", (unsigned char)buffer[i]);
-  fprintf(stderr, "\n");
+    curl_mfprintf(stderr, "%02x ", buffer[i]);
+  curl_mfprintf(stderr, "\n");
   (void)size;
   if(buffer[0] == 0x89) {
     CURLcode result;
-    fprintf(stderr, "send back a simple PONG\n");
-    result = curl_ws_send(easy, pong, 2, &sent, 0, 0);
+    curl_mfprintf(stderr, "send back a simple PONG\n");
+    result = curl_ws_send(curl, pong, 2, &sent, 0, 0);
     if(result)
       nitems = 0;
   }
   if(nitems != incoming)
-    fprintf(stderr, "returns error from callback\n");
+    curl_mfprintf(stderr, "returns error from callback\n");
   return nitems;
 }
+#endif
 
-int test(char *URL)
+static CURLcode test_lib2301(const char *URL)
 {
+#ifndef CURL_DISABLE_WEBSOCKETS
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
 
@@ -134,21 +83,22 @@ int test(char *URL)
     curl_easy_setopt(curl, CURLOPT_USERAGENT, "webbie-sox/3");
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
     curl_easy_setopt(curl, CURLOPT_WS_OPTIONS, CURLWS_RAW_MODE);
-    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writecb);
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, t2301_write_cb);
     curl_easy_setopt(curl, CURLOPT_WRITEDATA, curl);
-    res = curl_easy_perform(curl);
-    fprintf(stderr, "curl_easy_perform() returned %u\n", (int)res);
+    result = curl_easy_perform(curl);
+    curl_mfprintf(stderr, "curl_easy_perform() returned %d\n", (int)result);
 #if 0
-    if(res == CURLE_OK)
-      websocket(curl);
+    if(result == CURLE_OK)
+      t2301_websocket(curl);
 #endif
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
   curl_global_cleanup();
-  return (int)res;
-}
-
-#else /* no websockets */
-NO_SUPPORT_BUILT_IN
+  return result;
+#else
+  (void)URL;
+  curl_mfprintf(stderr, "Missing support\n");
+  return CURLE_UNSUPPORTED_PROTOCOL;
 #endif
+}
diff --git a/third-party/curl/tests/libtest/lib2302.c b/third-party/curl/tests/libtest/lib2302.c
index b581659a4b..759ea5eafd 100644
--- a/third-party/curl/tests/libtest/lib2302.c
+++ b/third-party/curl/tests/libtest/lib2302.c
@@ -21,136 +21,112 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "first.h"
 
-#include "test.h"
+#ifndef CURL_DISABLE_WEBSOCKETS
 
-#ifdef USE_WEBSOCKETS
+struct ws_data {
+  CURL *curl;
+  char *buf;
+  size_t blen;
+  size_t nwrites;
+  int has_meta;
+  int meta_flags;
+};
 
-#if 0
+#define LIB2302_BUFSIZE (1024 * 1024)
 
-static int ping(CURL *curl, const char *send_payload)
+static void flush_data(struct ws_data *wd)
 {
-  size_t sent;
-  CURLcode result =
-    curl_ws_send(curl, send_payload, strlen(send_payload), &sent, CURLWS_PING);
-  fprintf(stderr,
-          "ws: curl_ws_send returned %u, sent %u\n", (int)result, (int)sent);
-
-  return (int)result;
-}
-
-static int recv_pong(CURL *curl, const char *expected_payload)
-{
-  size_t rlen;
-  unsigned int rflags;
-  char buffer[256];
-  CURLcode result =
-    curl_ws_recv(curl, buffer, sizeof(buffer), &rlen, &rflags);
-  if(rflags & CURLWS_PONG) {
-    int same = 0;
-    fprintf(stderr, "ws: got PONG back\n");
-    if(rlen == strlen(expected_payload)) {
-      if(!memcmp(expected_payload, buffer, rlen)) {
-        fprintf(stderr, "ws: got the same payload back\n");
-        same = 1;
-      }
-    }
-    if(!same)
-      fprintf(stderr, "ws: did NOT get the same payload back\n");
-  }
-  else {
-    fprintf(stderr, "recv_pong: got %u bytes rflags %x\n", (int)rlen, rflags);
-  }
-  fprintf(stderr, "ws: curl_ws_recv returned %u, received %u\n", (int)result,
-         rlen);
-  return (int)result;
-}
-
-/* just close the connection */
-static void websocket_close(CURL *curl)
-{
-  size_t sent;
-  CURLcode result =
-    curl_ws_send(curl, "", 0, &sent, CURLWS_CLOSE);
-  fprintf(stderr,
-          "ws: curl_ws_send returned %u, sent %u\n", (int)result, (int)sent);
-}
-
-static void websocket(CURL *curl)
-{
-  int i = 0;
-  fprintf(stderr, "ws: websocket() starts\n");
-  do {
-    if(ping(curl, "foobar"))
-      return;
-    if(recv_pong(curl, "foobar"))
-      return;
-    sleep(2);
-  } while(i++ < 10);
-  websocket_close(curl);
-}
-
-#endif
-
-static size_t writecb(char *buffer, size_t size, size_t nitems, void *p)
-{
-  CURL *easy = p;
   size_t i;
+
+  if(!wd->nwrites)
+    return;
+
+  for(i = 0; i < wd->blen; ++i)
+    curl_mprintf("%02x ", (unsigned char)wd->buf[i]);
+
+  curl_mprintf("\n");
+  if(wd->has_meta)
+    curl_mprintf("RECFLAGS: %x\n", (unsigned int)wd->meta_flags);
+  else
+    curl_mfprintf(stderr, "RECFLAGS: NULL\n");
+  wd->blen = 0;
+  wd->nwrites = 0;
+}
+
+static size_t add_data(struct ws_data *wd, const char *buf, size_t blen,
+                       const struct curl_ws_frame *meta)
+{
+  if((wd->nwrites == 0) ||
+     (!!meta != !!wd->has_meta) ||
+     (meta && meta->flags != wd->meta_flags)) {
+    if(wd->nwrites > 0)
+      flush_data(wd);
+    wd->has_meta = !!meta;
+    wd->meta_flags = meta ? meta->flags : 0;
+  }
+
+  if(wd->blen + blen > LIB2302_BUFSIZE) {
+    return 0;
+  }
+  memcpy(wd->buf + wd->blen, buf, blen);
+  wd->blen += blen;
+  wd->nwrites++;
+  return blen;
+}
+
+static size_t t2302_write_cb(char *buffer, size_t size, size_t nitems, void *p)
+{
+  struct ws_data *ws_data = p;
   size_t incoming = nitems;
   const struct curl_ws_frame *meta;
   (void)size;
-  for(i = 0; i < nitems; i++)
-    printf("%02x ", (unsigned char)buffer[i]);
-  printf("\n");
 
-  meta = curl_ws_meta(easy);
-  if(meta)
-    printf("RECFLAGS: %x\n", meta->flags);
-  else
-    fprintf(stderr, "RECFLAGS: NULL\n");
+  meta = curl_ws_meta(ws_data->curl);
+  incoming = add_data(ws_data, buffer, incoming, meta);
 
-  /* this assumes we get a simple TEXT frame first */
-  {
-    CURLcode result = CURLE_OK;
-    fprintf(stderr, "send back a TEXT\n");
-    (void)easy;
-    if(result)
-      nitems = 0;
-  }
   if(nitems != incoming)
-    fprintf(stderr, "returns error from callback\n");
+    curl_mfprintf(stderr, "returns error from callback\n");
   return nitems;
 }
+#endif
 
-int test(char *URL)
+static CURLcode test_lib2302(const char *URL)
 {
+#ifndef CURL_DISABLE_WEBSOCKETS
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
+  struct ws_data ws_data;
 
   global_init(CURL_GLOBAL_ALL);
 
-  curl = curl_easy_init();
-  if(curl) {
-    curl_easy_setopt(curl, CURLOPT_URL, URL);
+  memset(&ws_data, 0, sizeof(ws_data));
+  ws_data.buf = curlx_calloc(LIB2302_BUFSIZE, 1);
+  if(ws_data.buf) {
+    curl = curl_easy_init();
+    if(curl) {
+      ws_data.curl = curl;
 
-    /* use the callback style */
-    curl_easy_setopt(curl, CURLOPT_USERAGENT, "webbie-sox/3");
-    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
-    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writecb);
-    curl_easy_setopt(curl, CURLOPT_WRITEDATA, curl);
-    res = curl_easy_perform(curl);
-    fprintf(stderr, "curl_easy_perform() returned %u\n", (int)res);
-#if 0
-    if(res == CURLE_OK)
-      websocket(curl);
-#endif
-    /* always cleanup */
-    curl_easy_cleanup(curl);
+      curl_easy_setopt(curl, CURLOPT_URL, URL);
+      /* use the callback style */
+      curl_easy_setopt(curl, CURLOPT_USERAGENT, "webbie-sox/3");
+      curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+      curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, t2302_write_cb);
+      curl_easy_setopt(curl, CURLOPT_WRITEDATA, &ws_data);
+      result = curl_easy_perform(curl);
+      curl_mfprintf(stderr, "curl_easy_perform() returned %d\n", (int)result);
+      /* always cleanup */
+      curl_easy_cleanup(curl);
+      flush_data(&ws_data);
+    }
+    curlx_free(ws_data.buf);
   }
   curl_global_cleanup();
-  return (int)res;
-}
-
+  return result;
 #else
-NO_SUPPORT_BUILT_IN
+  (void)URL;
+  curl_mfprintf(stderr, "Missing support\n");
+  return CURLE_UNSUPPORTED_PROTOCOL;
 #endif
+}
diff --git a/third-party/curl/tests/libtest/lib2304.c b/third-party/curl/tests/libtest/lib2304.c
index a8ee87548a..e4055315a7 100644
--- a/third-party/curl/tests/libtest/lib2304.c
+++ b/third-party/curl/tests/libtest/lib2304.c
@@ -21,53 +21,10 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "first.h"
 
-#include "test.h"
-
-#ifdef USE_WEBSOCKETS
-
-static int ping(CURL *curl, const char *send_payload)
-{
-  size_t sent;
-  CURLcode result =
-    curl_ws_send(curl, send_payload, strlen(send_payload), &sent, 0,
-                 CURLWS_PING);
-  fprintf(stderr,
-          "ws: curl_ws_send returned %u, sent %u\n", (int)result, (int)sent);
-
-  return (int)result;
-}
-
-static int recv_pong(CURL *curl, const char *expected_payload)
-{
-  size_t rlen;
-  const struct curl_ws_frame *meta;
-  char buffer[256];
-  CURLcode result = curl_ws_recv(curl, buffer, sizeof(buffer), &rlen, &meta);
-  if(!result) {
-    if(meta->flags & CURLWS_PONG) {
-      int same = 0;
-      fprintf(stderr, "ws: got PONG back\n");
-      if(rlen == strlen(expected_payload)) {
-        if(!memcmp(expected_payload, buffer, rlen)) {
-          fprintf(stderr, "ws: got the same payload back\n");
-          same = 1;
-        }
-      }
-      if(!same)
-        fprintf(stderr, "ws: did NOT get the same payload back\n");
-    }
-    else {
-      fprintf(stderr, "recv_pong: got %u bytes rflags %x\n", (int)rlen,
-              meta->flags);
-    }
-  }
-  fprintf(stderr, "ws: curl_ws_recv returned %u, received %u\n", (int)result,
-          (int)rlen);
-  return (int)result;
-}
-
-static int recv_any(CURL *curl)
+#ifndef CURL_DISABLE_WEBSOCKETS
+static CURLcode recv_any(CURL *curl)
 {
   size_t rlen;
   const struct curl_ws_frame *meta;
@@ -76,44 +33,36 @@ static int recv_any(CURL *curl)
   if(result)
     return result;
 
-  fprintf(stderr, "recv_any: got %u bytes rflags %x\n", (int)rlen,
-          meta->flags);
-  return 0;
+  curl_mfprintf(stderr, "recv_any: got %zu bytes rflags %x\n", rlen,
+                (unsigned int)meta->flags);
+  return CURLE_OK;
 }
 
-/* just close the connection */
-static void websocket_close(CURL *curl)
-{
-  size_t sent;
-  CURLcode result =
-    curl_ws_send(curl, "", 0, &sent, 0, CURLWS_CLOSE);
-  fprintf(stderr,
-          "ws: curl_ws_send returned %u, sent %u\n", (int)result, (int)sent);
-}
-
-static void websocket(CURL *curl)
+static void t2304_websocket(CURL *curl)
 {
   int i = 0;
-  fprintf(stderr, "ws: websocket() starts\n");
+  curl_mfprintf(stderr, "ws: websocket() starts\n");
   do {
     recv_any(curl);
-    fprintf(stderr, "Send ping\n");
-    if(ping(curl, "foobar"))
+    curl_mfprintf(stderr, "Send ping\n");
+    if(ws_send_ping(curl, "foobar"))
       return;
-    fprintf(stderr, "Receive pong\n");
-    if(recv_pong(curl, "foobar")) {
-      printf("Connection closed\n");
+    curl_mfprintf(stderr, "Receive pong\n");
+    if(ws_recv_pong(curl, "foobar")) {
+      curl_mprintf("Connection closed\n");
       return;
     }
-    sleep(2);
+    curlx_wait_ms(2000);
   } while(i++ < 10);
-  websocket_close(curl);
+  ws_close(curl);
 }
+#endif
 
-int test(char *URL)
+static CURLcode test_lib2304(const char *URL)
 {
+#ifndef CURL_DISABLE_WEBSOCKETS
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
 
@@ -125,18 +74,19 @@ int test(char *URL)
     curl_easy_setopt(curl, CURLOPT_USERAGENT, "websocket/2304");
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
     curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 2L); /* websocket style */
-    res = curl_easy_perform(curl);
-    fprintf(stderr, "curl_easy_perform() returned %u\n", (int)res);
-    if(res == CURLE_OK)
-      websocket(curl);
+    result = curl_easy_perform(curl);
+    curl_mfprintf(stderr, "curl_easy_perform() returned %d\n", (int)result);
+    if(result == CURLE_OK)
+      t2304_websocket(curl);
 
     /* always cleanup */
     curl_easy_cleanup(curl);
   }
   curl_global_cleanup();
-  return (int)res;
-}
-
+  return result;
 #else
-NO_SUPPORT_BUILT_IN
+  (void)URL;
+  curl_mfprintf(stderr, "Missing support\n");
+  return CURLE_UNSUPPORTED_PROTOCOL;
 #endif
+}
diff --git a/third-party/curl/tests/libtest/lib2305.c b/third-party/curl/tests/libtest/lib2305.c
deleted file mode 100644
index 0778e0b585..0000000000
--- a/third-party/curl/tests/libtest/lib2305.c
+++ /dev/null
@@ -1,109 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "test.h"
-#include "testtrace.h"
-
-#ifdef USE_WEBSOCKETS
-
-/* just close the connection */
-static void websocket_close(CURL *curl)
-{
-  size_t sent;
-  CURLcode result =
-    curl_ws_send(curl, "", 0, &sent, 0, CURLWS_CLOSE);
-  fprintf(stderr,
-          "ws: curl_ws_send returned %u, sent %u\n", (int)result, (int)sent);
-}
-
-static void websocket(CURL *curl)
-{
-  char buffer[256];
-  const struct curl_ws_frame *meta;
-  size_t nread;
-  size_t i = 0;
-  FILE *save = fopen(libtest_arg2, FOPEN_WRITETEXT);
-  if(!save)
-    return;
-
-  /* Three 4097-bytes frames are expected, 12291 bytes */
-  while(i < 12291) {
-    CURLcode result =
-      curl_ws_recv(curl, buffer, sizeof(buffer), &nread, &meta);
-    if(result) {
-      if(result == CURLE_AGAIN)
-        /* crude busy-loop */
-        continue;
-      printf("curl_ws_recv returned %d\n", (int)result);
-      return;
-    }
-    printf("%u: nread %zu Age %u Flags %x "
-           "Offset %" CURL_FORMAT_CURL_OFF_T " "
-           "Bytesleft %" CURL_FORMAT_CURL_OFF_T "\n",
-           (int)i,
-           nread, meta->age, meta->flags, meta->offset, meta->bytesleft);
-    i += meta->len;
-    fwrite(buffer, 1, nread, save);
-  }
-  fclose(save);
-
-  websocket_close(curl);
-}
-
-extern struct libtest_trace_cfg libtest_debug_config;
-
-int test(char *URL)
-{
-  CURL *curl;
-  CURLcode res = CURLE_OK;
-
-  global_init(CURL_GLOBAL_ALL);
-
-  curl = curl_easy_init();
-  if(curl) {
-    curl_easy_setopt(curl, CURLOPT_URL, URL);
-
-    /* use the callback style */
-    curl_easy_setopt(curl, CURLOPT_USERAGENT, "websocket/2304");
-    libtest_debug_config.nohex = 1;
-    libtest_debug_config.tracetime = 1;
-    curl_easy_setopt(curl, CURLOPT_DEBUGDATA, &libtest_debug_config);
-    curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
-    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
-    curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 2L); /* websocket style */
-    res = curl_easy_perform(curl);
-    fprintf(stderr, "curl_easy_perform() returned %u\n", (int)res);
-    if(res == CURLE_OK)
-      websocket(curl);
-
-    /* always cleanup */
-    curl_easy_cleanup(curl);
-  }
-  curl_global_cleanup();
-  return (int)res;
-}
-
-#else
-NO_SUPPORT_BUILT_IN
-#endif
diff --git a/third-party/curl/tests/libtest/lib2306.c b/third-party/curl/tests/libtest/lib2306.c
index 6023bfee4c..fbfdc635e8 100644
--- a/third-party/curl/tests/libtest/lib2306.c
+++ b/third-party/curl/tests/libtest/lib2306.c
@@ -21,31 +21,29 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "first.h"
 
-#include "test.h"
-#include "testtrace.h"
-
-#include <curl/curl.h>
-
-#define URL2 libtest_arg2
-
-int test(char *URL)
+static CURLcode test_lib2306(const char *URL)
 {
   /* first a fine GET response, then a bad one */
-  CURL *cl;
-  int res = 0;
+  CURL *curl;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
 
-  cl = curl_easy_init();
-  curl_easy_setopt(cl, CURLOPT_URL, URL);
-  curl_easy_setopt(cl, CURLOPT_VERBOSE, 1L);
-  curl_easy_perform(cl);
+  easy_init(curl);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  result = curl_easy_perform(curl);
+  if(result)
+    goto test_cleanup;
 
-  /* re-use handle, do a second transfer */
-  curl_easy_setopt(cl, CURLOPT_URL, URL2);
-  curl_easy_perform(cl);
-  curl_easy_cleanup(cl);
+  /* reuse handle, do a second transfer */
+  easy_setopt(curl, CURLOPT_URL, libtest_arg2);
+  result = curl_easy_perform(curl);
+
+test_cleanup:
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib2308.c b/third-party/curl/tests/libtest/lib2308.c
new file mode 100644
index 0000000000..d582c7135c
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib2308.c
@@ -0,0 +1,50 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static size_t cb_curl(char *buffer, size_t size, size_t nmemb, void *userp)
+{
+  (void)buffer;
+  (void)size;
+  (void)nmemb;
+  (void)userp;
+  return CURL_WRITEFUNC_ERROR;
+}
+
+static CURLcode test_lib2308(const char *URL)
+{
+  CURL *curl;
+  CURLcode result = CURLE_OK;
+
+  global_init(CURL_GLOBAL_ALL);
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, cb_curl);
+  curl_easy_setopt(curl, CURLOPT_URL, URL);
+  result = curl_easy_perform(curl);
+  curl_mprintf("Returned %d, should be %d.\n", (int)result, CURLE_WRITE_ERROR);
+  fflush(stdout);
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+  return CURLE_OK;
+}
diff --git a/third-party/curl/tests/libtest/lib2309.c b/third-party/curl/tests/libtest/lib2309.c
new file mode 100644
index 0000000000..212d82aa16
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib2309.c
@@ -0,0 +1,63 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static size_t cb_ignore(char *buffer, size_t size, size_t nmemb, void *userp)
+{
+  (void)buffer;
+  (void)size;
+  (void)nmemb;
+  (void)userp;
+  return CURL_WRITEFUNC_ERROR;
+}
+
+static CURLcode test_lib2309(const char *URL)
+{
+  CURL *curl;
+  CURL *curldupe;
+  CURLcode result = CURLE_OK;
+
+  global_init(CURL_GLOBAL_ALL);
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, cb_ignore);
+    curl_easy_setopt(curl, CURLOPT_URL, URL);
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+    curl_easy_setopt(curl, CURLOPT_PROXY, libtest_arg3);
+    curl_easy_setopt(curl, CURLOPT_NETRC, CURL_NETRC_REQUIRED);
+    curl_easy_setopt(curl, CURLOPT_NETRC_FILE, libtest_arg2);
+
+    curldupe = curl_easy_duphandle(curl);
+    if(curldupe) {
+      result = curl_easy_perform(curldupe);
+      curl_mprintf("Returned %d, should be %d.\n", (int)result,
+                   CURLE_WRITE_ERROR);
+      fflush(stdout);
+      curl_easy_cleanup(curldupe);
+    }
+    curl_easy_cleanup(curl);
+  }
+  curl_global_cleanup();
+  return CURLE_OK;
+}
diff --git a/third-party/curl/tests/libtest/lib2402.c b/third-party/curl/tests/libtest/lib2402.c
index ab20f92c03..93b2e382ec 100644
--- a/third-party/curl/tests/libtest/lib2402.c
+++ b/third-party/curl/tests/libtest/lib2402.c
@@ -21,37 +21,28 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
-
-#define NUM_HANDLES 4
-
-int test(char *URL)
+static CURLcode test_lib2402(const char *URL)
 {
-  int res = 0;
-  CURL *curl[NUM_HANDLES] = {0};
+  CURLcode result = CURLE_OK;
+  CURL *curl[NUM_HANDLES] = { 0 };
   int running;
-  CURLM *m = NULL;
-  int i;
+  CURLM *multi = NULL;
+  size_t i;
   char target_url[256];
   char dnsentry[256];
   struct curl_slist *slist = NULL;
-  char *port = libtest_arg3;
-  char *address = libtest_arg2;
+  const char *port = libtest_arg3;
+  const char *address = libtest_arg2;
 
   (void)URL;
 
-  msnprintf(dnsentry, sizeof(dnsentry), "localhost:%s:%s",
-            port, address);
-  printf("%s\n", dnsentry);
+  curl_msnprintf(dnsentry, sizeof(dnsentry), "localhost:%s:%s", port, address);
+  curl_mprintf("%s\n", dnsentry);
   slist = curl_slist_append(slist, dnsentry);
   if(!slist) {
-    fprintf(stderr, "curl_slist_append() failed\n");
+    curl_mfprintf(stderr, "curl_slist_append() failed\n");
     goto test_cleanup;
   }
 
@@ -59,18 +50,17 @@ int test(char *URL)
 
   global_init(CURL_GLOBAL_ALL);
 
-  multi_init(m);
+  multi_init(multi);
 
-  multi_setopt(m, CURLMOPT_MAXCONNECTS, 1L);
+  multi_setopt(multi, CURLMOPT_MAXCONNECTS, 1L);
 
-  /* get NUM_HANDLES easy handles */
-  for(i = 0; i < NUM_HANDLES; i++) {
+  /* get each easy handle */
+  for(i = 0; i < CURL_ARRAYSIZE(curl); i++) {
     /* get an easy handle */
     easy_init(curl[i]);
     /* specify target */
-    msnprintf(target_url, sizeof(target_url),
-              "https://localhost:%s/path/2402%04i",
-              port, i + 1);
+    curl_msnprintf(target_url, sizeof(target_url),
+                   "https://localhost:%s/path/2402%04zu", port, i + 1);
     target_url[sizeof(target_url) - 1] = '\0';
     easy_setopt(curl[i], CURLOPT_URL, target_url);
     /* go http2 */
@@ -88,11 +78,11 @@ int test(char *URL)
     easy_setopt(curl[i], CURLOPT_RESOLVE, slist);
   }
 
-  fprintf(stderr, "Start at URL 0\n");
+  curl_mfprintf(stderr, "Start at URL 0\n");
 
-  for(i = 0; i < NUM_HANDLES; i++) {
+  for(i = 0; i < CURL_ARRAYSIZE(curl); i++) {
     /* add handle to multi */
-    multi_add_handle(m, curl[i]);
+    multi_add_handle(multi, curl[i]);
 
     for(;;) {
       struct timeval interval;
@@ -102,7 +92,7 @@ int test(char *URL)
       interval.tv_sec = 1;
       interval.tv_usec = 0;
 
-      multi_perform(m, &running);
+      multi_perform(multi, &running);
 
       abort_on_test_timeout();
 
@@ -113,7 +103,7 @@ int test(char *URL)
       FD_ZERO(&wr);
       FD_ZERO(&exc);
 
-      multi_fdset(m, &rd, &wr, &exc, &maxfd);
+      multi_fdset(multi, &rd, &wr, &exc, &maxfd);
 
       /* At this point, maxfd is guaranteed to be greater or equal than -1. */
 
@@ -121,22 +111,22 @@ int test(char *URL)
 
       abort_on_test_timeout();
     }
-    wait_ms(1); /* to ensure different end times */
+    curlx_wait_ms(1); /* to ensure different end times */
   }
 
 test_cleanup:
 
   /* proper cleanup sequence - type PB */
 
-  for(i = 0; i < NUM_HANDLES; i++) {
-    curl_multi_remove_handle(m, curl[i]);
+  for(i = 0; i < CURL_ARRAYSIZE(curl); i++) {
+    curl_multi_remove_handle(multi, curl[i]);
     curl_easy_cleanup(curl[i]);
   }
 
   curl_slist_free_all(slist);
 
-  curl_multi_cleanup(m);
+  curl_multi_cleanup(multi);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib2404.c b/third-party/curl/tests/libtest/lib2404.c
index 1a282ffe2a..9999f965df 100644
--- a/third-party/curl/tests/libtest/lib2404.c
+++ b/third-party/curl/tests/libtest/lib2404.c
@@ -21,37 +21,28 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
-
-#define NUM_HANDLES 4
-
-int test(char *URL)
+static CURLcode test_lib2404(const char *URL)
 {
-  int res = 0;
-  CURL *curl[NUM_HANDLES] = {0};
+  CURLcode result = CURLE_OK;
+  CURL *curl[NUM_HANDLES] = { 0 };
   int running;
-  CURLM *m = NULL;
-  int i;
+  CURLM *multi = NULL;
+  size_t i;
   char target_url[256];
   char dnsentry[256];
   struct curl_slist *slist = NULL;
-  char *port = libtest_arg3;
-  char *address = libtest_arg2;
+  const char *port = libtest_arg3;
+  const char *address = libtest_arg2;
 
   (void)URL;
 
-  msnprintf(dnsentry, sizeof(dnsentry), "localhost:%s:%s",
-            port, address);
-  printf("%s\n", dnsentry);
+  curl_msnprintf(dnsentry, sizeof(dnsentry), "localhost:%s:%s", port, address);
+  curl_mprintf("%s\n", dnsentry);
   slist = curl_slist_append(slist, dnsentry);
   if(!slist) {
-    fprintf(stderr, "curl_slist_append() failed\n");
+    curl_mfprintf(stderr, "curl_slist_append() failed\n");
     goto test_cleanup;
   }
 
@@ -59,18 +50,17 @@ int test(char *URL)
 
   global_init(CURL_GLOBAL_ALL);
 
-  multi_init(m);
+  multi_init(multi);
 
-  multi_setopt(m, CURLMOPT_MAXCONNECTS, 1L);
+  multi_setopt(multi, CURLMOPT_MAXCONNECTS, 1L);
 
-  /* get NUM_HANDLES easy handles */
-  for(i = 0; i < NUM_HANDLES; i++) {
+  /* get each easy handle */
+  for(i = 0; i < CURL_ARRAYSIZE(curl); i++) {
     /* get an easy handle */
     easy_init(curl[i]);
     /* specify target */
-    msnprintf(target_url, sizeof(target_url),
-              "https://localhost:%s/path/2404%04i",
-              port, i + 1);
+    curl_msnprintf(target_url, sizeof(target_url),
+                   "https://localhost:%s/path/2404%04zu", port, i + 1);
     target_url[sizeof(target_url) - 1] = '\0';
     easy_setopt(curl[i], CURLOPT_URL, target_url);
     /* go http2 */
@@ -87,14 +77,14 @@ int test(char *URL)
 
     easy_setopt(curl[i], CURLOPT_RESOLVE, slist);
 
-    easy_setopt(curl[i], CURLOPT_STREAM_WEIGHT, (long)128 + i);
+    easy_setopt(curl[i], CURLOPT_STREAM_WEIGHT, (long)i + 128);
   }
 
-  fprintf(stderr, "Start at URL 0\n");
+  curl_mfprintf(stderr, "Start at URL 0\n");
 
-  for(i = 0; i < NUM_HANDLES; i++) {
+  for(i = 0; i < CURL_ARRAYSIZE(curl); i++) {
     /* add handle to multi */
-    multi_add_handle(m, curl[i]);
+    multi_add_handle(multi, curl[i]);
 
     for(;;) {
       struct timeval interval;
@@ -104,7 +94,7 @@ int test(char *URL)
       interval.tv_sec = 1;
       interval.tv_usec = 0;
 
-      multi_perform(m, &running);
+      multi_perform(multi, &running);
 
       abort_on_test_timeout();
 
@@ -115,7 +105,7 @@ int test(char *URL)
       FD_ZERO(&wr);
       FD_ZERO(&exc);
 
-      multi_fdset(m, &rd, &wr, &exc, &maxfd);
+      multi_fdset(multi, &rd, &wr, &exc, &maxfd);
 
       /* At this point, maxfd is guaranteed to be greater or equal than -1. */
 
@@ -123,22 +113,22 @@ int test(char *URL)
 
       abort_on_test_timeout();
     }
-    wait_ms(1); /* to ensure different end times */
+    curlx_wait_ms(1); /* to ensure different end times */
   }
 
 test_cleanup:
 
   /* proper cleanup sequence - type PB */
 
-  for(i = 0; i < NUM_HANDLES; i++) {
-    curl_multi_remove_handle(m, curl[i]);
+  for(i = 0; i < CURL_ARRAYSIZE(curl); i++) {
+    curl_multi_remove_handle(multi, curl[i]);
     curl_easy_cleanup(curl[i]);
   }
 
   curl_slist_free_all(slist);
 
-  curl_multi_cleanup(m);
+  curl_multi_cleanup(multi);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib2405.c b/third-party/curl/tests/libtest/lib2405.c
new file mode 100644
index 0000000000..412faf45a0
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib2405.c
@@ -0,0 +1,392 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Dmitry Karpov <dkarpov1970@gmail.com>
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+/*
+ * The purpose of this test is to test behavior of curl_multi_waitfds
+ * function in different scenarios:
+ *  empty multi handle (expected zero descriptors),
+ *  HTTP1 amd HTTP2 (no multiplexing) two transfers (expected two descriptors),
+ *  HTTP2 with multiplexing (expected one descriptors)
+ *  Improper inputs to the API result in CURLM_BAD_FUNCTION_ARGUMENT.
+ *  Sending an empty ufds, and size = 0 returns the number of fds needed.
+ *  Sending a non-empty ufds, but smaller than the fds needed results in a
+ *    CURLM_OUT_OF_MEMORY, and a number of fds that is >= to the number needed.
+ *
+ *  It is also expected that all transfers run by multi-handle should complete
+ *  successfully.
+ */
+
+#include "first.h"
+
+/* ---------------------------------------------------------------- */
+
+#define test_check(expected_fds)                                             \
+  if(result != CURLE_OK) {                                                   \
+    curl_mfprintf(stderr, "test failed with code: %d\n", (int)result);       \
+    goto test_cleanup;                                                       \
+  }                                                                          \
+  else if(fd_count != (expected_fds)) {                                      \
+    curl_mfprintf(stderr, "Max number of waitfds: %u not as expected: %u\n", \
+                  fd_count, expected_fds);                                   \
+    result = TEST_ERR_FAILURE;                                               \
+    goto test_cleanup;                                                       \
+  }
+
+#define test_run_check(option, expected_fds)   \
+  do {                                         \
+    result = test_run(URL, option, &fd_count); \
+    test_check(expected_fds);                  \
+  } while(0)
+
+/* ---------------------------------------------------------------- */
+
+enum {
+  TEST_USE_HTTP1 = 0,
+  TEST_USE_HTTP2,
+  TEST_USE_HTTP2_MPLEX
+};
+
+static CURLcode set_easy(const char *URL, CURL *curl, long option)
+{
+  CURLcode result = CURLE_OK;
+
+  /* First set the URL that is about to receive our POST. */
+  easy_setopt(curl, CURLOPT_URL, URL);
+
+  /* get verbose debug output please */
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+  switch(option) {
+  case TEST_USE_HTTP1:
+    /* go http1 */
+    easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
+    break;
+
+  case TEST_USE_HTTP2:
+    /* go http2 */
+    easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
+    break;
+
+  case TEST_USE_HTTP2_MPLEX:
+    /* go http2 with multiplexing */
+    easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
+    easy_setopt(curl, CURLOPT_PIPEWAIT, 1L);
+    break;
+  }
+
+  /* no peer verify */
+  easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+  easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
+
+  /* include headers */
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+
+  /* empty write function */
+  easy_setopt(curl, CURLOPT_WRITEFUNCTION, tutil_throwaway_cb);
+
+test_cleanup:
+  return result;
+}
+
+static CURLcode test_run(const char *URL, long option,
+                         unsigned int *max_fd_count)
+{
+  CURLMcode mresult = CURLM_OK;
+  CURLM *multi = NULL;
+  CURLM *multi1 = NULL;
+
+  CURL *curl1 = NULL;
+  CURL *curl2 = NULL;
+
+  unsigned int max_count = 0;
+
+  int still_running; /* keep number of running handles */
+  CURLMsg *msg; /* for picking up messages with the transfer status */
+  int msgs_left; /* how many messages are left */
+
+  CURLcode result = CURLE_OK;
+
+  struct curl_waitfd ufds[10];
+  struct curl_waitfd ufds1[10];
+  int numfds;
+
+  easy_init(curl1);
+  easy_init(curl2);
+
+  if(set_easy(URL, curl1, option) != CURLE_OK)
+    goto test_cleanup;
+
+  if(set_easy(URL, curl2, option) != CURLE_OK)
+    goto test_cleanup;
+
+  multi_init(multi);
+  multi_init(multi1);
+
+  if(option == TEST_USE_HTTP2_MPLEX)
+    multi_setopt(multi, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
+
+  multi_add_handle(multi, curl1);
+  multi_add_handle(multi, curl2);
+
+  while(!mresult) {
+    /* get the count of file descriptors from the transfers */
+    unsigned int fd_count = 0;
+    unsigned int fd_count_chk = 0;
+
+    mresult = curl_multi_perform(multi, &still_running);
+    if(!still_running || mresult != CURLM_OK)
+      break;
+
+    /* verify improper inputs are treated correctly. */
+    mresult = curl_multi_waitfds(multi, NULL, 0, NULL);
+
+    if(mresult != CURLM_BAD_FUNCTION_ARGUMENT) {
+      curl_mfprintf(stderr, "curl_multi_waitfds() return code %d instead of "
+                    "CURLM_BAD_FUNCTION_ARGUMENT.\n", mresult);
+      result = TEST_ERR_FAILURE;
+      break;
+    }
+
+    mresult = curl_multi_waitfds(multi, NULL, 1, NULL);
+
+    if(mresult != CURLM_BAD_FUNCTION_ARGUMENT) {
+      curl_mfprintf(stderr, "curl_multi_waitfds() return code %d instead of "
+                    "CURLM_BAD_FUNCTION_ARGUMENT.\n", mresult);
+      result = TEST_ERR_FAILURE;
+      break;
+    }
+
+    mresult = curl_multi_waitfds(multi, NULL, 1, &fd_count);
+
+    if(mresult != CURLM_BAD_FUNCTION_ARGUMENT) {
+      curl_mfprintf(stderr, "curl_multi_waitfds() return code %d instead of "
+                    "CURLM_BAD_FUNCTION_ARGUMENT.\n", mresult);
+      result = TEST_ERR_FAILURE;
+      break;
+    }
+
+    mresult = curl_multi_waitfds(multi, ufds, 10, &fd_count);
+
+    if(mresult != CURLM_OK) {
+      curl_mfprintf(stderr, "curl_multi_waitfds() failed, code %d.\n",
+                    mresult);
+      result = TEST_ERR_FAILURE;
+      break;
+    }
+
+    if(!fd_count)
+      continue; /* no descriptors yet */
+
+    /* verify that sending nothing but the fd_count results in at least the
+     * same number of fds */
+    mresult = curl_multi_waitfds(multi, NULL, 0, &fd_count_chk);
+
+    if(mresult != CURLM_OK) {
+      curl_mfprintf(stderr, "curl_multi_waitfds() failed, code %d.\n",
+                    mresult);
+      result = TEST_ERR_FAILURE;
+      break;
+    }
+
+    if(fd_count_chk < fd_count) {
+      curl_mfprintf(stderr,
+                    "curl_multi_waitfds() should return at least the number "
+                    "of fds needed (%u vs. %u)\n", fd_count_chk, fd_count);
+      result = TEST_ERR_FAILURE;
+      break;
+    }
+
+    /* checking case when we do not have enough space for waitfds */
+    mresult = curl_multi_waitfds(multi, ufds1, fd_count - 1, &fd_count_chk);
+
+    if(mresult != CURLM_OUT_OF_MEMORY) {
+      curl_mfprintf(stderr, "curl_multi_waitfds() return code %d instead of "
+                    "CURLM_OUT_OF_MEMORY.\n", mresult);
+      result = TEST_ERR_FAILURE;
+      break;
+    }
+
+    if(fd_count_chk < fd_count) {
+      curl_mfprintf(stderr,
+                    "curl_multi_waitfds() should return the amount of fds "
+                    "needed if enough is not passed in (%u vs. %u).\n",
+                    fd_count_chk, fd_count);
+      result = TEST_ERR_FAILURE;
+      break;
+    }
+
+    /* sending ufds with zero size, is valid */
+    mresult = curl_multi_waitfds(multi, ufds, 0, NULL);
+
+    if(mresult != CURLM_OUT_OF_MEMORY) {
+      curl_mfprintf(stderr, "curl_multi_waitfds() return code %d instead of "
+                    "CURLM_OUT_OF_MEMORY.\n", mresult);
+      result = TEST_ERR_FAILURE;
+      break;
+    }
+
+    mresult = curl_multi_waitfds(multi, ufds, 0, &fd_count_chk);
+
+    if(mresult != CURLM_OUT_OF_MEMORY) {
+      curl_mfprintf(stderr, "curl_multi_waitfds() return code %d instead of "
+                    "CURLM_OUT_OF_MEMORY.\n", mresult);
+      result = TEST_ERR_FAILURE;
+      break;
+    }
+
+    if(fd_count_chk < fd_count) {
+      curl_mfprintf(stderr,
+                    "curl_multi_waitfds() should return the amount of fds "
+                    "needed if enough is not passed in (%u vs. %u).\n",
+                    fd_count_chk, fd_count);
+      result = TEST_ERR_FAILURE;
+      break;
+    }
+
+    if(fd_count > max_count)
+      max_count = fd_count;
+
+    /* Do polling on descriptors in ufds in Multi 1 */
+    mresult = curl_multi_poll(multi1, ufds, fd_count, 500, &numfds);
+
+    if(mresult != CURLM_OK) {
+      curl_mfprintf(stderr, "curl_multi_poll() failed, code %d.\n", mresult);
+      result = TEST_ERR_FAILURE;
+      break;
+    }
+  }
+
+  for(;;) {
+    msg = curl_multi_info_read(multi, &msgs_left);
+    if(!msg)
+      break;
+    if(msg->msg == CURLMSG_DONE) {
+      result = msg->data.result;
+    }
+  }
+
+  curl_multi_remove_handle(multi, curl1);
+  curl_multi_remove_handle(multi, curl2);
+
+test_cleanup:
+  curl_easy_cleanup(curl1);
+  curl_easy_cleanup(curl2);
+
+  curl_multi_cleanup(multi);
+  curl_multi_cleanup(multi1);
+
+  if(max_fd_count)
+    *max_fd_count = max_count;
+
+  return result;
+}
+
+static CURLcode empty_multi_test(void)
+{
+  CURLMcode mresult = CURLM_OK;
+  CURLM *multi = NULL;
+  CURL *curl = NULL;
+
+  struct curl_waitfd ufds[10];
+
+  CURLcode result = CURLE_OK;
+  unsigned int fd_count = 0;
+
+  multi_init(multi);
+
+  /* calling curl_multi_waitfds() on an empty multi handle. */
+  mresult = curl_multi_waitfds(multi, ufds, 10, &fd_count);
+
+  if(mresult != CURLM_OK) {
+    curl_mfprintf(stderr, "curl_multi_waitfds() failed, code %d.\n", mresult);
+    result = TEST_ERR_FAILURE;
+    goto test_cleanup;
+  }
+  else if(fd_count > 0) {
+    curl_mfprintf(stderr, "curl_multi_waitfds(), empty, returned non-zero "
+                  "count of waitfds: %u.\n", fd_count);
+    result = TEST_ERR_FAILURE;
+    goto test_cleanup;
+  }
+
+  /* calling curl_multi_waitfds() on multi handle with added easy handle. */
+  easy_init(curl);
+
+  if(set_easy("http://example.com", curl, TEST_USE_HTTP1) != CURLE_OK)
+    goto test_cleanup;
+
+  multi_add_handle(multi, curl);
+
+  mresult = curl_multi_waitfds(multi, ufds, 10, &fd_count);
+
+  if(mresult != CURLM_OK) {
+    curl_mfprintf(stderr, "curl_multi_waitfds() failed, code %d.\n", mresult);
+    result = TEST_ERR_FAILURE;
+    goto test_cleanup;
+  }
+  else if(fd_count > 1) {
+    curl_mfprintf(stderr, "curl_multi_waitfds() returned > 1 count of "
+                  "waitfds: %u.\n", fd_count);
+    result = TEST_ERR_FAILURE;
+    goto test_cleanup;
+  }
+
+  curl_multi_remove_handle(multi, curl);
+
+test_cleanup:
+  curl_easy_cleanup(curl);
+  curl_multi_cleanup(multi);
+  return result;
+}
+
+static CURLcode test_lib2405(const char *URL)
+{
+  CURLcode result = CURLE_OK;
+  unsigned int fd_count = 0;
+
+  global_init(CURL_GLOBAL_ALL);
+
+  /* Testing curl_multi_waitfds on empty and not started handles */
+  result = empty_multi_test();
+  if(result != CURLE_OK)
+    goto test_cleanup;
+
+  if(testnum == 2405) {
+    /* HTTP1, expected 3 waitfds - one for each transfer  + wakeup */
+    test_run_check(TEST_USE_HTTP1, 3U);
+  }
+#ifdef USE_HTTP2
+  else { /* 2407 */
+    /* HTTP2, expected 3 waitfds - one for each transfer + wakeup */
+    test_run_check(TEST_USE_HTTP2, 3U);
+
+    /* HTTP2 with multiplexing, expected 2 waitfds - transfers + wakeup */
+    test_run_check(TEST_USE_HTTP2_MPLEX, 2U);
+  }
+#endif
+
+test_cleanup:
+  curl_global_cleanup();
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib2412.c b/third-party/curl/tests/libtest/lib2412.c
new file mode 100644
index 0000000000..79d49a2d76
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib2412.c
@@ -0,0 +1,95 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Dmitry Karpov <dkarpov1970@gmail.com>
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+#include "first.h"
+#include "testtrace.h"
+
+static CURLcode test_lib2412(const char *URL)
+{
+  CURLcode result = CURLE_OK;
+  CURLM *multi = NULL;
+  CURL *easy = NULL;
+  CURLMcode rc;
+  fd_set readFdSet, writeFdSet, exceptFdSet;
+  int maxFd;
+
+  (void)URL;
+  global_init(CURL_GLOBAL_ALL);
+
+  multi = curl_multi_init();
+  if(!multi) {
+    curl_mfprintf(stderr, "curl_multi_init() failed\n");
+    result = TEST_ERR_MAJOR_BAD;
+    goto test_cleanup;
+  }
+
+  easy = curl_easy_init();
+  if(!easy) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    result = TEST_ERR_MAJOR_BAD;
+    goto test_cleanup;
+  }
+  debug_config.nohex = TRUE;
+  debug_config.tracetime = TRUE;
+  easy_setopt(easy, CURLOPT_DEBUGDATA, &debug_config);
+  easy_setopt(easy, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
+  easy_setopt(easy, CURLOPT_VERBOSE, 1L);
+
+  rc = curl_multi_add_handle(multi, easy);
+  if(rc) {
+    curl_mfprintf(stderr, "curl_multi_add_handle() failed: %d\n", rc);
+    result = TEST_ERR_MAJOR_BAD;
+    goto test_cleanup;
+  }
+
+  FD_ZERO(&readFdSet);
+  FD_ZERO(&writeFdSet);
+  FD_ZERO(&exceptFdSet);
+  maxFd = -1;
+  rc = curl_multi_fdset(multi, &readFdSet, &writeFdSet, &exceptFdSet,
+                        &maxFd);
+  if(rc) {
+    curl_mfprintf(stderr, "curl_multi_fdset() failed: %d\n", rc);
+    result = TEST_ERR_MAJOR_BAD;
+    goto test_cleanup;
+  }
+
+  if(maxFd == -1)
+    curl_mfprintf(stderr, "There are no file descriptors to wait for\n");
+  else {
+    curl_mfprintf(stderr, "libcurl supplied a file descriptor to "
+           "wait for (maxFd=%d).  Waiting now ...\n", maxFd);
+    result = TEST_ERR_FAILURE;
+  }
+
+test_cleanup:
+  if(easy) {
+    curl_multi_remove_handle(multi, easy);
+    curl_easy_cleanup(easy);
+  }
+  if(multi)
+    curl_multi_cleanup(multi);
+  curl_global_cleanup();
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib2502.c b/third-party/curl/tests/libtest/lib2502.c
index e5a7061b08..18382436c6 100644
--- a/third-party/curl/tests/libtest/lib2502.c
+++ b/third-party/curl/tests/libtest/lib2502.c
@@ -21,37 +21,30 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
+#include "testtrace.h"
 
-#define TEST_HANG_TIMEOUT 60 * 1000
-
-#define NUM_HANDLES 4
-
-int test(char *URL)
+static CURLcode test_lib2502(const char *URL)
 {
-  int res = 0;
-  CURL *curl[NUM_HANDLES] = {0};
+  CURLcode result = CURLE_OK;
+  CURL *curl[NUM_HANDLES] = { 0 };
   int running;
-  CURLM *m = NULL;
-  int i;
+  CURLM *multi = NULL;
+  size_t i;
   char target_url[256];
   char dnsentry[256];
   struct curl_slist *slist = NULL;
-  char *port = libtest_arg3;
-  char *address = libtest_arg2;
+  const char *port = libtest_arg3;
+  const char *address = libtest_arg2;
 
   (void)URL;
 
-  msnprintf(dnsentry, sizeof(dnsentry), "localhost:%s:%s",
-            port, address);
-  printf("%s\n", dnsentry);
+  curl_msnprintf(dnsentry, sizeof(dnsentry), "localhost:%s:%s", port, address);
+  curl_mprintf("%s\n", dnsentry);
   slist = curl_slist_append(slist, dnsentry);
   if(!slist) {
-    fprintf(stderr, "curl_slist_append() failed\n");
+    curl_mfprintf(stderr, "curl_slist_append() failed\n");
     goto test_cleanup;
   }
 
@@ -59,27 +52,30 @@ int test(char *URL)
 
   global_init(CURL_GLOBAL_ALL);
 
-  multi_init(m);
+  multi_init(multi);
 
-  multi_setopt(m, CURLMOPT_MAXCONNECTS, 1L);
+  multi_setopt(multi, CURLMOPT_MAXCONNECTS, 1L);
 
-  /* get NUM_HANDLES easy handles */
-  for(i = 0; i < NUM_HANDLES; i++) {
+  /* get each easy handle */
+  for(i = 0; i < CURL_ARRAYSIZE(curl); i++) {
     /* get an easy handle */
     easy_init(curl[i]);
     /* specify target */
-    msnprintf(target_url, sizeof(target_url),
-              "https://localhost:%s/path/2502%04i",
-              port, i + 1);
+    curl_msnprintf(target_url, sizeof(target_url),
+                   "https://localhost:%s/path/2502%04zu", port, i + 1);
     target_url[sizeof(target_url) - 1] = '\0';
     easy_setopt(curl[i], CURLOPT_URL, target_url);
     /* go http2 */
     easy_setopt(curl[i], CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_3ONLY);
-    easy_setopt(curl[i], CURLOPT_CONNECTTIMEOUT_MS, (long)5000);
-    easy_setopt(curl[i], CURLOPT_CAINFO, "./certs/EdelCurlRoot-ca.cacert");
+    easy_setopt(curl[i], CURLOPT_CONNECTTIMEOUT_MS, 5000L);
+    easy_setopt(curl[i], CURLOPT_CAINFO, libtest_arg4);
     /* wait for first connection established to see if we can share it */
     easy_setopt(curl[i], CURLOPT_PIPEWAIT, 1L);
     /* go verbose */
+    debug_config.nohex = TRUE;
+    debug_config.tracetime = FALSE;
+    easy_setopt(curl[i], CURLOPT_DEBUGDATA, &debug_config);
+    easy_setopt(curl[i], CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
     easy_setopt(curl[i], CURLOPT_VERBOSE, 1L);
     /* include headers */
     easy_setopt(curl[i], CURLOPT_HEADER, 1L);
@@ -87,11 +83,11 @@ int test(char *URL)
     easy_setopt(curl[i], CURLOPT_RESOLVE, slist);
   }
 
-  fprintf(stderr, "Start at URL 0\n");
+  curl_mfprintf(stderr, "Start at URL 0\n");
 
-  for(i = 0; i < NUM_HANDLES; i++) {
+  for(i = 0; i < CURL_ARRAYSIZE(curl); i++) {
     /* add handle to multi */
-    multi_add_handle(m, curl[i]);
+    multi_add_handle(multi, curl[i]);
 
     for(;;) {
       struct timeval interval;
@@ -101,7 +97,7 @@ int test(char *URL)
       interval.tv_sec = 1;
       interval.tv_usec = 0;
 
-      multi_perform(m, &running);
+      multi_perform(multi, &running);
 
       abort_on_test_timeout();
 
@@ -112,7 +108,7 @@ int test(char *URL)
       FD_ZERO(&wr);
       FD_ZERO(&exc);
 
-      multi_fdset(m, &rd, &wr, &exc, &maxfd);
+      multi_fdset(multi, &rd, &wr, &exc, &maxfd);
 
       /* At this point, maxfd is guaranteed to be greater or equal than -1. */
 
@@ -120,22 +116,22 @@ int test(char *URL)
 
       abort_on_test_timeout();
     }
-    wait_ms(1); /* to ensure different end times */
+    curlx_wait_ms(1); /* to ensure different end times */
   }
 
 test_cleanup:
 
   /* proper cleanup sequence - type PB */
 
-  for(i = 0; i < NUM_HANDLES; i++) {
-    curl_multi_remove_handle(m, curl[i]);
+  for(i = 0; i < CURL_ARRAYSIZE(curl); i++) {
+    curl_multi_remove_handle(multi, curl[i]);
     curl_easy_cleanup(curl[i]);
   }
 
   curl_slist_free_all(slist);
 
-  curl_multi_cleanup(m);
+  curl_multi_cleanup(multi);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib2504.c b/third-party/curl/tests/libtest/lib2504.c
new file mode 100644
index 0000000000..3b7b61fe8b
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib2504.c
@@ -0,0 +1,86 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Linus Nielsen Feltzing <linus@haxx.se>
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#include "testtrace.h"
+
+static void dump_cookies2504(CURL *h, const char *tag)
+{
+  struct curl_slist *cookies = NULL;
+  struct curl_slist *nc;
+  CURLcode rc = curl_easy_getinfo(h, CURLINFO_COOKIELIST, &cookies);
+
+  curl_mprintf("== %s ==\n", tag);
+  if(rc) {
+    curl_mprintf("getinfo error: %d\n", (int)rc);
+    return;
+  }
+  for(nc = cookies; nc; nc = nc->next)
+    puts(nc->data);
+  curl_slist_free_all(cookies);
+}
+
+static CURLcode test_lib2504(const char *URL)
+{
+  CURL *curl;
+  CURLcode result = CURLE_OUT_OF_MEMORY;
+  struct curl_slist *hdrs = NULL;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  hdrs = curl_slist_append(hdrs, "Host: victim.internal");
+  if(hdrs) {
+    easy_setopt(curl, CURLOPT_WRITEFUNCTION, tutil_throwaway_cb);
+    easy_setopt(curl, CURLOPT_COOKIEFILE, "");
+    easy_setopt(curl, CURLOPT_HTTPHEADER, hdrs);
+    easy_setopt(curl, CURLOPT_URL, URL);
+
+    result = curl_easy_perform(curl);
+    curl_mprintf("req1=%d\n", (int)result);
+    dump_cookies2504(curl, "after request 1");
+
+    easy_setopt(curl, CURLOPT_HTTPHEADER, NULL);
+    easy_setopt(curl, CURLOPT_URL, URL);
+
+    result = curl_easy_perform(curl);
+    curl_mprintf("req2=%d\n", (int)result);
+    dump_cookies2504(curl, "after request 2");
+  }
+test_cleanup:
+  curl_slist_free_all(hdrs);
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib2505.c b/third-party/curl/tests/libtest/lib2505.c
new file mode 100644
index 0000000000..5d43eec392
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib2505.c
@@ -0,0 +1,64 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Linus Nielsen Feltzing <linus@haxx.se>
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#include "testtrace.h"
+
+static CURLcode test_lib2505(const char *URL)
+{
+  CURL *curl;
+  CURLcode result = CURLE_OUT_OF_MEMORY;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  easy_setopt(curl, CURLOPT_WRITEFUNCTION, tutil_throwaway_cb);
+  easy_setopt(curl, CURLOPT_AUTOREFERER, 1L);
+  easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+
+  result = curl_easy_perform(curl);
+  curl_mprintf("req1=%d\n", (int)result);
+
+  easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+
+  result = curl_easy_perform(curl);
+  curl_mprintf("req2=%d\n", (int)result);
+
+test_cleanup:
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib2506.c b/third-party/curl/tests/libtest/lib2506.c
new file mode 100644
index 0000000000..8779f6c9d5
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib2506.c
@@ -0,0 +1,64 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Linus Nielsen Feltzing <linus@haxx.se>
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#include "testtrace.h"
+
+static CURLcode test_lib2506(const char *URL)
+{
+  CURL *curl;
+  CURLcode result = CURLE_OUT_OF_MEMORY;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  easy_setopt(curl, CURLOPT_WRITEFUNCTION, tutil_throwaway_cb);
+  easy_setopt(curl, CURLOPT_PROXY, URL);
+  easy_setopt(curl, CURLOPT_URL, libtest_arg2);
+  easy_setopt(curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
+  easy_setopt(curl, CURLOPT_NETRC_FILE, libtest_arg3);
+  easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+  /* CURLOPT_UNRESTRICTED_AUTH should not make a difference because the
+     credentials come from netrc */
+  easy_setopt(curl, CURLOPT_UNRESTRICTED_AUTH, 1L);
+
+  result = curl_easy_perform(curl);
+
+test_cleanup:
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib2700.c b/third-party/curl/tests/libtest/lib2700.c
new file mode 100644
index 0000000000..c2bb39e221
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib2700.c
@@ -0,0 +1,256 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#include "testtrace.h"
+
+#ifndef CURL_DISABLE_WEBSOCKETS
+
+static const char *descr_flags(int flags)
+{
+  if(flags & CURLWS_TEXT)
+    return flags & CURLWS_CONT ? "txt ---" : "txt fin";
+  if(flags & CURLWS_BINARY)
+    return flags & CURLWS_CONT ? "bin ---" : "bin fin";
+  if(flags & CURLWS_PING)
+    return "ping";
+  if(flags & CURLWS_PONG)
+    return "pong";
+  if(flags & CURLWS_CLOSE)
+    return "close";
+  assert(FALSE);
+  return "";
+}
+
+static CURLcode send_header(CURL *curl, int flags, size_t size)
+{
+  CURLcode result = CURLE_OK;
+  size_t nsent;
+
+retry:
+  result = curl_ws_send(curl, NULL, 0, &nsent, (curl_off_t)size,
+                        flags | CURLWS_OFFSET);
+  if(result == CURLE_AGAIN) {
+    assert(nsent == 0);
+    goto retry;
+  }
+  if(result) {
+    curl_mfprintf(stderr, "%s:%d curl_ws_send() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
+    assert(nsent == 0);
+    return result;
+  }
+
+  assert(nsent == 0);
+
+  return CURLE_OK;
+}
+
+static CURLcode recv_header(CURL *curl, int *flags, curl_off_t *offset,
+                            curl_off_t *bytesleft)
+{
+  CURLcode result = CURLE_OK;
+  size_t nread;
+  const struct curl_ws_frame *meta;
+
+  *flags = 0;
+  *offset = 0;
+  *bytesleft = 0;
+
+retry:
+  result = curl_ws_recv(curl, NULL, 0, &nread, &meta);
+  if(result == CURLE_AGAIN) {
+    assert(nread == 0);
+    goto retry;
+  }
+  if(result) {
+    curl_mfprintf(stderr, "%s:%d curl_ws_recv() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
+    assert(nread == 0);
+    return result;
+  }
+
+  assert(nread == 0);
+  assert(meta);
+  assert(meta->flags);
+  assert(meta->offset == 0);
+
+  *flags = meta->flags;
+  *offset = meta->offset;
+  *bytesleft = meta->bytesleft;
+
+  curl_mfprintf(stdout, "%s [%" FMT_OFF_T "]", descr_flags(meta->flags),
+                meta->bytesleft);
+
+  if(meta->bytesleft > 0)
+    curl_mfprintf(stdout, " ");
+
+  result = send_header(curl, meta->flags, (size_t)meta->bytesleft);
+  if(result)
+    return result;
+
+  return CURLE_OK;
+}
+
+static CURLcode send_chunk(CURL *curl, int flags, const char *buffer,
+                           size_t size, size_t *offset)
+{
+  CURLcode result = CURLE_OK;
+  size_t nsent;
+
+retry:
+  result = curl_ws_send(curl, buffer + *offset, size - *offset, &nsent,
+                        0, flags);
+  if(result == CURLE_AGAIN) {
+    assert(nsent == 0);
+    goto retry;
+  }
+  if(result) {
+    curl_mfprintf(stderr, "%s:%d curl_ws_send() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
+    assert(nsent == 0);
+    return result;
+  }
+
+  assert(nsent <= size - *offset);
+
+  *offset += nsent;
+
+  return CURLE_OK;
+}
+
+static CURLcode recv_chunk(CURL *curl, int flags, curl_off_t *offset,
+                           curl_off_t *bytesleft)
+{
+  CURLcode result = CURLE_OK;
+  char buffer[256];
+  size_t nread;
+  const struct curl_ws_frame *meta;
+  size_t sendoffset = 0;
+
+retry:
+  result = curl_ws_recv(curl, buffer, sizeof(buffer), &nread, &meta);
+  if(result == CURLE_AGAIN) {
+    assert(nread == 0);
+    goto retry;
+  }
+  if(result) {
+    curl_mfprintf(stderr, "%s:%d curl_ws_recv() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
+    assert(nread == 0);
+    return result;
+  }
+
+  assert(nread <= sizeof(buffer));
+  assert(meta);
+  assert(meta->flags == flags);
+  assert(meta->offset == *offset);
+  assert(meta->bytesleft == (*bytesleft - (curl_off_t)nread));
+
+  *offset += nread;
+  *bytesleft -= nread;
+
+  fwrite(buffer, 1, nread, stdout);
+
+  while(sendoffset < nread) {
+    result = send_chunk(curl, flags, buffer, nread, &sendoffset);
+    if(result)
+      return result;
+  }
+
+  return CURLE_OK;
+}
+
+static CURLcode recv_frame(CURL *curl, bool *stop)
+{
+  CURLcode result = CURLE_OK;
+  int flags = 0;
+  curl_off_t offset = 0;
+  curl_off_t bytesleft = 0;
+
+  result = recv_header(curl, &flags, &offset, &bytesleft);
+  if(result)
+    return result;
+
+  while(bytesleft > 0) {
+    result = recv_chunk(curl, flags, &offset, &bytesleft);
+    if(result)
+      return result;
+  }
+
+  if(flags & CURLWS_CLOSE)
+    *stop = TRUE;
+
+  curl_mfprintf(stdout, "\n");
+
+  return result;
+}
+#endif
+
+static CURLcode test_lib2700(const char *URL)
+{
+#ifndef CURL_DISABLE_WEBSOCKETS
+  CURLcode result = CURLE_OK;
+  bool stop = FALSE;
+  CURL *curl;
+
+  global_init(CURL_GLOBAL_ALL);
+  curl_global_trace("ws");
+  easy_init(curl);
+
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_USERAGENT, "client/test2700");
+  debug_config.nohex = TRUE;
+  debug_config.tracetime = TRUE;
+  easy_setopt(curl, CURLOPT_DEBUGDATA, &debug_config);
+  easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_CONNECT_ONLY, 2L);
+  if(testnum != 2708)
+    easy_setopt(curl, CURLOPT_WS_OPTIONS, CURLWS_NOAUTOPONG);
+
+  result = curl_easy_perform(curl);
+  if(result) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_perform() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
+    goto test_cleanup;
+  }
+
+  while(!stop) {
+    result = recv_frame(curl, &stop);
+    if(result)
+      goto test_cleanup;
+  }
+
+test_cleanup:
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+  return result;
+#else
+  (void)URL;
+  curl_mfprintf(stderr, "Missing support\n");
+  return CURLE_UNSUPPORTED_PROTOCOL;
+#endif
+}
diff --git a/third-party/curl/tests/libtest/lib3010.c b/third-party/curl/tests/libtest/lib3010.c
index 598b79fcc9..7552b021ec 100644
--- a/third-party/curl/tests/libtest/lib3010.c
+++ b/third-party/curl/tests/libtest/lib3010.c
@@ -21,47 +21,49 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib3010(const char *URL)
 {
-  CURLcode ret = CURLE_OK;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   CURL *curl = NULL;
   curl_off_t retry_after;
-  char *follow_url = NULL;
+  const char *follow_url = NULL;
 
   curl_global_init(CURL_GLOBAL_ALL);
   curl = curl_easy_init();
 
   if(curl) {
     curl_easy_setopt(curl, CURLOPT_URL, URL);
-    ret = curl_easy_perform(curl);
-    if(ret) {
-      fprintf(stderr, "%s:%d curl_easy_perform() failed with code %d (%s)\n",
-          __FILE__, __LINE__, ret, curl_easy_strerror(ret));
+    result = curl_easy_perform(curl);
+    if(result) {
+      curl_mfprintf(stderr,
+                    "%s:%d curl_easy_perform() failed with code %d (%s)\n",
+                    __FILE__, __LINE__, (int)result,
+                    curl_easy_strerror(result));
       goto test_cleanup;
     }
     curl_easy_getinfo(curl, CURLINFO_REDIRECT_URL, &follow_url);
     curl_easy_getinfo(curl, CURLINFO_RETRY_AFTER, &retry_after);
-    printf("Retry-After %" CURL_FORMAT_CURL_OFF_T "\n", retry_after);
+    curl_mprintf("Retry-After %" CURL_FORMAT_CURL_OFF_T "\n", retry_after);
     curl_easy_setopt(curl, CURLOPT_URL, follow_url);
-    ret = curl_easy_perform(curl);
-    if(ret) {
-      fprintf(stderr, "%s:%d curl_easy_perform() failed with code %d (%s)\n",
-          __FILE__, __LINE__, ret, curl_easy_strerror(ret));
+    result = curl_easy_perform(curl);
+    if(result) {
+      curl_mfprintf(stderr,
+                    "%s:%d curl_easy_perform() failed with code %d (%s)\n",
+                    __FILE__, __LINE__, (int)result,
+                    curl_easy_strerror(result));
       goto test_cleanup;
     }
 
     curl_easy_reset(curl);
     curl_easy_getinfo(curl, CURLINFO_RETRY_AFTER, &retry_after);
-    printf("Retry-After %" CURL_FORMAT_CURL_OFF_T "\n", retry_after);
+    curl_mprintf("Retry-After %" CURL_FORMAT_CURL_OFF_T "\n", retry_after);
   }
 
 test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return ret;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib3025.c b/third-party/curl/tests/libtest/lib3025.c
index f3e3f92084..c7b38e465d 100644
--- a/third-party/curl/tests/libtest/lib3025.c
+++ b/third-party/curl/tests/libtest/lib3025.c
@@ -21,35 +21,33 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib3025(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
   struct curl_slist *icy = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   icy = curl_slist_append(icy, "ICY 200 OK");
-  test_setopt(curl, CURLOPT_HTTP200ALIASES, icy);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_HEADER, 1L);
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HTTP200ALIASES, icy);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -57,5 +55,5 @@ test_cleanup:
   curl_slist_free_all(icy);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib3026.c b/third-party/curl/tests/libtest/lib3026.c
index 24f7768153..f072dee282 100644
--- a/third-party/curl/tests/libtest/lib3026.c
+++ b/third-party/curl/tests/libtest/lib3026.c
@@ -21,20 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "testutil.h"
-#include "warnless.h"
+#include "first.h"
 
 #define NUM_THREADS 100
 
-#ifdef WIN32
-#ifdef _WIN32_WCE
-static DWORD WINAPI run_thread(LPVOID ptr)
-#else
-#include <process.h>
-static unsigned int WINAPI run_thread(void *ptr)
-#endif
+#ifdef _WIN32
+static DWORD WINAPI t3026_run_thread(void *ptr)
 {
   CURLcode *result = ptr;
 
@@ -45,76 +37,56 @@ static unsigned int WINAPI run_thread(void *ptr)
   return 0;
 }
 
-int test(char *URL)
+static CURLcode test_lib3026(const char *URL)
 {
-#ifdef _WIN32_WCE
-  typedef HANDLE curl_win_thread_handle_t;
-#elif defined(__MINGW32__) && !defined(__MINGW64_VERSION_MAJOR)
-  typedef unsigned long curl_win_thread_handle_t;
-#else
-  typedef uintptr_t curl_win_thread_handle_t;
-#endif
   CURLcode results[NUM_THREADS];
-  curl_win_thread_handle_t ths[NUM_THREADS];
+  HANDLE thread_handles[NUM_THREADS];
   unsigned tid_count = NUM_THREADS, i;
-  int test_failure = 0;
+  CURLcode result = CURLE_OK;
   curl_version_info_data *ver;
-  (void) URL;
+  (void)URL;
 
   ver = curl_version_info(CURLVERSION_NOW);
   if((ver->features & CURL_VERSION_THREADSAFE) == 0) {
-    fprintf(stderr, "%s:%d On Windows but the "
-            "CURL_VERSION_THREADSAFE feature flag is not set\n",
-            __FILE__, __LINE__);
-    return -1;
+    curl_mfprintf(stderr, "%s:%d On Windows but the "
+                  "CURL_VERSION_THREADSAFE feature flag is not set\n",
+                  __FILE__, __LINE__);
+    return TEST_ERR_MAJOR_BAD;
   }
 
-  /* On Windows libcurl global init/cleanup calls LoadLibrary/FreeLibrary for
-     secur32.dll and iphlpapi.dll. Here we load them beforehand so that when
-     libcurl calls LoadLibrary/FreeLibrary it only increases/decreases the
-     library's refcount rather than actually loading/unloading the library,
-     which would affect the test runtime. */
-  (void)win32_load_system_library(TEXT("secur32.dll"));
-  (void)win32_load_system_library(TEXT("iphlpapi.dll"));
-
   for(i = 0; i < tid_count; i++) {
-    curl_win_thread_handle_t th;
+    HANDLE th;
     results[i] = CURL_LAST; /* initialize with invalid value */
-#ifdef _WIN32_WCE
-    th = CreateThread(NULL, 0, run_thread, &results[i], 0, NULL);
-#else
-    th = _beginthreadex(NULL, 0, run_thread, &results[i], 0, NULL);
-#endif
+    th = CreateThread(NULL, 0, t3026_run_thread, &results[i], 0, NULL);
     if(!th) {
-      fprintf(stderr, "%s:%d Couldn't create thread, errno %d\n",
-              __FILE__, __LINE__, GetLastError());
+      curl_mfprintf(stderr, "%s:%d Could not create thread, "
+                    "GetLastError 0x%08lx\n",
+                    __FILE__, __LINE__, GetLastError());
       tid_count = i;
-      test_failure = -1;
+      result = TEST_ERR_MAJOR_BAD;
       goto cleanup;
     }
-    ths[i] = th;
+    thread_handles[i] = th;
   }
 
 cleanup:
   for(i = 0; i < tid_count; i++) {
-    WaitForSingleObject((HANDLE)ths[i], INFINITE);
-    CloseHandle((HANDLE)ths[i]);
+    WaitForSingleObject(thread_handles[i], INFINITE);
+    CloseHandle(thread_handles[i]);
     if(results[i] != CURLE_OK) {
-      fprintf(stderr, "%s:%d thread[%u]: curl_global_init() failed,"
-              "with code %d (%s)\n", __FILE__, __LINE__,
-              i, (int) results[i], curl_easy_strerror(results[i]));
-      test_failure = -1;
+      curl_mfprintf(stderr, "%s:%d thread[%u]: curl_global_init() failed,"
+                    "with code %d (%s)\n", __FILE__, __LINE__,
+                    i, (int)results[i], curl_easy_strerror(results[i]));
+      result = TEST_ERR_MAJOR_BAD;
     }
   }
 
-  return test_failure;
+  return result;
 }
 
-#elif defined(HAVE_PTHREAD_H)
-#include <pthread.h>
-#include <unistd.h>
+#elif defined(HAVE_THREADS_POSIX)
 
-static void *run_thread(void *ptr)
+static void *t3026_run_thread(void *ptr)
 {
   CURLcode *result = ptr;
 
@@ -125,32 +97,32 @@ static void *run_thread(void *ptr)
   return NULL;
 }
 
-int test(char *URL)
+static CURLcode test_lib3026(const char *URL)
 {
   CURLcode results[NUM_THREADS];
   pthread_t tids[NUM_THREADS];
   unsigned tid_count = NUM_THREADS, i;
-  int test_failure = 0;
+  CURLcode result = CURLE_OK;
   curl_version_info_data *ver;
-  (void) URL;
+  (void)URL;
 
   ver = curl_version_info(CURLVERSION_NOW);
   if((ver->features & CURL_VERSION_THREADSAFE) == 0) {
-    fprintf(stderr, "%s:%d Have pthread but the "
-            "CURL_VERSION_THREADSAFE feature flag is not set\n",
-            __FILE__, __LINE__);
-    return -1;
+    curl_mfprintf(stderr, "%s:%d Have pthread but the "
+                  "CURL_VERSION_THREADSAFE feature flag is not set\n",
+                  __FILE__, __LINE__);
+    return TEST_ERR_MAJOR_BAD;
   }
 
   for(i = 0; i < tid_count; i++) {
     int res;
     results[i] = CURL_LAST; /* initialize with invalid value */
-    res = pthread_create(&tids[i], NULL, run_thread, &results[i]);
+    res = pthread_create(&tids[i], NULL, t3026_run_thread, &results[i]);
     if(res) {
-      fprintf(stderr, "%s:%d Couldn't create thread, errno %d\n",
-              __FILE__, __LINE__, res);
+      curl_mfprintf(stderr, "%s:%d Could not create thread, errno %d\n",
+                    __FILE__, __LINE__, res);
       tid_count = i;
-      test_failure = -1;
+      result = TEST_ERR_MAJOR_BAD;
       goto cleanup;
     }
   }
@@ -159,29 +131,29 @@ cleanup:
   for(i = 0; i < tid_count; i++) {
     pthread_join(tids[i], NULL);
     if(results[i] != CURLE_OK) {
-      fprintf(stderr, "%s:%d thread[%u]: curl_global_init() failed,"
-              "with code %d (%s)\n", __FILE__, __LINE__,
-              i, (int) results[i], curl_easy_strerror(results[i]));
-      test_failure = -1;
+      curl_mfprintf(stderr, "%s:%d thread[%u]: curl_global_init() failed,"
+                    "with code %d (%s)\n", __FILE__, __LINE__,
+                    i, (int)results[i], curl_easy_strerror(results[i]));
+      result = TEST_ERR_MAJOR_BAD;
     }
   }
 
-  return test_failure;
+  return result;
 }
 
-#else /* without pthread or Windows, this test doesn't work */
-int test(char *URL)
+#else /* without pthread or Windows, this test does not work */
+static CURLcode test_lib3026(const char *URL)
 {
   curl_version_info_data *ver;
   (void)URL;
 
   ver = curl_version_info(CURLVERSION_NOW);
   if((ver->features & CURL_VERSION_THREADSAFE) != 0) {
-    fprintf(stderr, "%s:%d No pthread but the "
-            "CURL_VERSION_THREADSAFE feature flag is set\n",
-            __FILE__, __LINE__);
-    return -1;
+    curl_mfprintf(stderr, "%s:%d No pthread but the "
+                  "CURL_VERSION_THREADSAFE feature flag is set\n",
+                  __FILE__, __LINE__);
+    return TEST_ERR_MAJOR_BAD;
   }
-  return 0;
+  return CURLE_OK;
 }
 #endif
diff --git a/third-party/curl/tests/libtest/lib3027.c b/third-party/curl/tests/libtest/lib3027.c
index 6808f29fd0..013c13f43e 100644
--- a/third-party/curl/tests/libtest/lib3027.c
+++ b/third-party/curl/tests/libtest/lib3027.c
@@ -21,36 +21,32 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib3027(const char *URL)
 {
-  CURLcode ret = CURLE_OK;
-  CURL *hnd;
+  CURLcode result = CURLE_OK;
+  CURL *curl;
   start_test_timing();
 
   curl_global_init(CURL_GLOBAL_ALL);
 
-  hnd = curl_easy_init();
-  if(hnd) {
-    curl_easy_setopt(hnd, CURLOPT_URL, URL);
-    curl_easy_setopt(hnd, CURLOPT_FILETIME, 1L);
-    ret = curl_easy_perform(hnd);
-    if(CURLE_OK == ret) {
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_URL, URL);
+    curl_easy_setopt(curl, CURLOPT_FILETIME, 1L);
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
       long filetime;
-      ret = curl_easy_getinfo(hnd, CURLINFO_FILETIME, &filetime);
+      result = curl_easy_getinfo(curl, CURLINFO_FILETIME, &filetime);
       /* MTDM fails with 550, so filetime should be -1 */
-      if((CURLE_OK == ret) && (filetime != -1)) {
-        /* we just need to return something which is not CURLE_OK */
-        ret = CURLE_UNSUPPORTED_PROTOCOL;
+      if((result == CURLE_OK) && (filetime != -1)) {
+        /* we need to return something which is not CURLE_OK */
+        result = CURLE_UNSUPPORTED_PROTOCOL;
       }
     }
-    curl_easy_cleanup(hnd);
+    curl_easy_cleanup(curl);
   }
   curl_global_cleanup();
-  return (int)ret;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib3033.c b/third-party/curl/tests/libtest/lib3033.c
new file mode 100644
index 0000000000..f43c1696ca
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib3033.c
@@ -0,0 +1,128 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#include "testtrace.h"
+
+static CURLcode t3033_req_test(CURLM *multi, CURL *curl,
+                               const char *URL, int index)
+{
+  CURLMsg *msg = NULL;
+  CURLcode result = CURLE_OK;
+  int still_running = 0;
+
+  if(index == 1) {
+    curl_multi_setopt(multi, CURLMOPT_NETWORK_CHANGED, CURLMNWC_CLEAR_CONNS);
+    curl_mprintf("[1] signal network change\n");
+  }
+  else {
+    curl_mprintf("[%d] no network change\n", index);
+  }
+
+  curl_easy_reset(curl);
+  curl_easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_DEBUGDATA, &debug_config);
+  easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+  curl_multi_add_handle(multi, curl);
+
+  do {
+    CURLMcode mresult;
+    int num;
+    curl_multi_perform(multi, &still_running);
+    mresult = curl_multi_wait(multi, NULL, 0, TEST_HANG_TIMEOUT, &num);
+    if(mresult != CURLM_OK) {
+      curl_mfprintf(stderr, "curl_multi_wait() returned %d\n", mresult);
+      result = TEST_ERR_MAJOR_BAD;
+      goto test_cleanup;
+    }
+  } while(still_running);
+
+  do {
+    long num_connects = 0L;
+    msg = curl_multi_info_read(multi, &still_running);
+    if(msg) {
+      if(msg->msg != CURLMSG_DONE)
+        continue;
+
+      result = msg->data.result;
+      if(result != CURLE_OK) {
+        curl_mfprintf(stderr, "curl_multi_info_read() returned %d\n",
+                      (int)result);
+        goto test_cleanup;
+      }
+
+      curl_easy_getinfo(curl, CURLINFO_NUM_CONNECTS, &num_connects);
+      if(index == 1 && num_connects == 0) {
+        curl_mprintf("[1] should not reuse connection in pool\n");
+        result = TEST_ERR_MAJOR_BAD;
+        goto test_cleanup;
+      }
+      else if(index == 2 && num_connects) {
+        curl_mprintf("[2] should have reused connection from [1]\n");
+        result = TEST_ERR_MAJOR_BAD;
+        goto test_cleanup;
+      }
+    }
+  } while(msg);
+
+test_cleanup:
+
+  curl_multi_remove_handle(multi, curl);
+
+  return result;
+}
+
+static CURLcode test_lib3033(const char *URL)
+{
+  CURL *curl = NULL;
+  CURLM *multi = NULL;
+  CURLcode result = CURLE_OK;
+
+  global_init(CURL_GLOBAL_ALL);
+  multi_init(multi);
+  easy_init(curl);
+
+  debug_config.nohex = TRUE;
+  debug_config.tracetime = TRUE;
+
+  result = t3033_req_test(multi, curl, URL, 0);
+  if(result != CURLE_OK)
+    goto test_cleanup;
+  result = t3033_req_test(multi, curl, URL, 1);
+  if(result != CURLE_OK)
+    goto test_cleanup;
+  result = t3033_req_test(multi, curl, URL, 2);
+  if(result != CURLE_OK)
+    goto test_cleanup;
+
+test_cleanup:
+
+  curl_easy_cleanup(curl);
+  curl_multi_cleanup(multi);
+  curl_global_cleanup();
+
+  return result; /* return the final return code */
+}
diff --git a/third-party/curl/tests/libtest/lib3034.c b/third-party/curl/tests/libtest/lib3034.c
new file mode 100644
index 0000000000..0dbfee8439
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib3034.c
@@ -0,0 +1,77 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static const char data_3034[] = "hello";
+
+static size_t t3034_read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
+{
+  size_t len = size * nmemb;
+  size_t tocopy = sizeof(data_3034) < len ? sizeof(data_3034) : len;
+  (void)userp;
+  memcpy(ptr, data_3034, tocopy);
+  return tocopy;
+}
+
+static CURLcode test_lib3034(const char *URL)
+{
+  CURL *curl;
+  CURLcode result = CURLE_OK;
+
+  global_init(CURL_GLOBAL_ALL);
+  easy_init(curl);
+
+  /* This first request receives a redirect response; deliberately only
+   * set the CURLOPT_READFUNCTION but not the CURLOPT_SEEKFUNCTION to force a
+   * rewind failure (CURLE_SEND_FAIL_REWIND).
+   */
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+  easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+  easy_setopt(curl, CURLOPT_INFILESIZE, 5L);
+  easy_setopt(curl, CURLOPT_READFUNCTION, t3034_read_cb);
+
+  result = curl_easy_perform(curl);
+  if(result != CURLE_SEND_FAIL_REWIND) {
+    curl_mfprintf(stderr,
+                  "%s:%d curl_easy_perform() failed with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
+    goto test_cleanup;
+  }
+
+  /* Reset the easy handle, which should clear the rewind failure. */
+  curl_easy_reset(curl);
+
+  /* Perform a second request, which should succeed. */
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+
+  result = curl_easy_perform(curl);
+
+test_cleanup:
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib3100.c b/third-party/curl/tests/libtest/lib3100.c
index a508d5c7a7..121d0a8490 100644
--- a/third-party/curl/tests/libtest/lib3100.c
+++ b/third-party/curl/tests/libtest/lib3100.c
@@ -21,42 +21,41 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-#include "memdebug.h"
+#include "first.h"
 
-int test(char *URL)
+static CURLcode test_lib3100(const char *URL)
 {
-  int res;
+  CURLcode result;
   CURL *curl;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_HEADERDATA, stdout);
-  test_setopt(curl, CURLOPT_WRITEDATA, stdout);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_HEADERDATA, stdout);
+  easy_setopt(curl, CURLOPT_WRITEDATA, stdout);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_RTSP_STREAM_URI, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, URL);
 
-  test_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_ANY);
-  test_setopt(curl, CURLOPT_USERNAME, "user");
-  test_setopt(curl, CURLOPT_PASSWORD, "password");
-  test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_DESCRIBE);
+  easy_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_ANY);
+  easy_setopt(curl, CURLOPT_USERNAME, "user");
+  easy_setopt(curl, CURLOPT_PASSWORD, "password");
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_DESCRIBE);
 
-  res = curl_easy_perform(curl);
-  if(res != (int)CURLE_OK) {
-    fprintf(stderr, "Failed to send DESCRIBE: %d\n", res);
-    res = TEST_ERR_MAJOR_BAD;
+  result = curl_easy_perform(curl);
+  if(result != CURLE_OK) {
+    curl_mfprintf(stderr, "Failed to send DESCRIBE: %d\n", (int)result);
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
 
@@ -64,5 +63,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib3101.c b/third-party/curl/tests/libtest/lib3101.c
index dbcf3a6c75..2e2b45357a 100644
--- a/third-party/curl/tests/libtest/lib3101.c
+++ b/third-party/curl/tests/libtest/lib3101.c
@@ -21,38 +21,37 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-#include "memdebug.h"
+#include "first.h"
 
-int test(char *URL)
+static CURLcode test_lib3101(const char *URL)
 {
-  int res;
+  CURLcode result;
   CURL *curl;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_HEADERDATA, stdout);
-  test_setopt(curl, CURLOPT_WRITEDATA, stdout);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_ANY);
-  test_setopt(curl, CURLOPT_USERNAME, "user");
-  test_setopt(curl, CURLOPT_PASSWORD, "password");
-  test_setopt(curl, CURLOPT_REDIR_PROTOCOLS_STR, "https");
+  easy_setopt(curl, CURLOPT_HEADERDATA, stdout);
+  easy_setopt(curl, CURLOPT_WRITEDATA, stdout);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_ANY);
+  easy_setopt(curl, CURLOPT_USERNAME, "user");
+  easy_setopt(curl, CURLOPT_PASSWORD, "password");
+  easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS_STR, "https");
 
-  res = curl_easy_perform(curl);
-  if(res != (int)CURLE_OK) {
-    res = TEST_ERR_MAJOR_BAD;
+  result = curl_easy_perform(curl);
+  if(result != CURLE_OK) {
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
 
@@ -60,5 +59,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib3102.c b/third-party/curl/tests/libtest/lib3102.c
index abc0a27eab..59db9e45f1 100644
--- a/third-party/curl/tests/libtest/lib3102.c
+++ b/third-party/curl/tests/libtest/lib3102.c
@@ -21,9 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "memdebug.h"
+#include "first.h"
 
 /*
  * Verify correct order of certificates in the chain by comparing the
@@ -31,45 +29,46 @@
  */
 static bool is_chain_in_order(struct curl_certinfo *cert_info)
 {
-  char *last_issuer = NULL;
+  const char *last_issuer = NULL;
   int cert;
 
   /* Chains with only a single certificate are always in order */
   if(cert_info->num_of_certs <= 1)
-    return 1;
+    return TRUE;
 
   /* Enumerate each certificate in the chain */
   for(cert = 0; cert < cert_info->num_of_certs; cert++) {
     struct curl_slist *slist = cert_info->certinfo[cert];
-    char *issuer = NULL;
-    char *subject = NULL;
+    const char *issuer = NULL;
+    const char *subject = NULL;
 
     /* Find the certificate issuer and subject by enumerating each field */
     for(; slist && (!issuer || !subject); slist = slist->next) {
-      const char issuer_prefix[] = "Issuer:";
-      const char subject_prefix[] = "Subject:";
+      static const char issuer_prefix[] = "Issuer:";
+      static const char subject_prefix[] = "Subject:";
 
-      if(!strncmp(slist->data, issuer_prefix, sizeof(issuer_prefix)-1)) {
-        issuer = slist->data + sizeof(issuer_prefix)-1;
+      if(!strncmp(slist->data, issuer_prefix, sizeof(issuer_prefix) - 1)) {
+        issuer = slist->data + sizeof(issuer_prefix) - 1;
       }
-      if(!strncmp(slist->data, subject_prefix, sizeof(subject_prefix)-1)) {
-        subject = slist->data + sizeof(subject_prefix)-1;
+      if(!strncmp(slist->data, subject_prefix, sizeof(subject_prefix) - 1)) {
+        subject = slist->data + sizeof(subject_prefix) - 1;
       }
     }
 
     if(subject && issuer) {
-      printf("cert %d\n", cert);
-      printf("  subject: %s\n", subject);
-      printf("  issuer: %s\n", issuer);
+      curl_mprintf("cert %d\n", cert);
+      curl_mprintf("  subject: %s\n", subject);
+      curl_mprintf("  issuer: %s\n", issuer);
 
       if(last_issuer) {
         /* If the last certificate's issuer matches the current certificate's
          * subject, then the chain is in order */
-        if(strcmp(last_issuer, subject) != 0) {
-          fprintf(stderr, "cert %d issuer does not match cert %d subject\n",
-                  cert - 1, cert);
-          fprintf(stderr, "certificate chain is not in order\n");
-          return false;
+        if(strcmp(last_issuer, subject)) {
+          curl_mfprintf(stderr,
+                        "cert %d issuer does not match cert %d subject\n",
+                        cert - 1, cert);
+          curl_mfprintf(stderr, "certificate chain is not in order\n");
+          return FALSE;
         }
       }
     }
@@ -77,57 +76,50 @@ static bool is_chain_in_order(struct curl_certinfo *cert_info)
     last_issuer = issuer;
   }
 
-  printf("certificate chain is in order\n");
-  return true;
+  curl_mprintf("certificate chain is in order\n");
+  return TRUE;
 }
 
-static size_t wrfu(void *ptr,  size_t  size,  size_t  nmemb,  void *stream)
-{
-  (void)stream;
-  (void)ptr;
-  return size * nmemb;
-}
-
-int test(char *URL)
+static CURLcode test_lib3102(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  /* Set the HTTPS url to retrieve. */
-  test_setopt(curl, CURLOPT_URL, URL);
+  /* Set the HTTPS URL to retrieve. */
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* Capture certificate information */
-  test_setopt(curl, CURLOPT_CERTINFO, 1L);
+  easy_setopt(curl, CURLOPT_CERTINFO, 1L);
 
   /* Ignore output */
-  test_setopt(curl, CURLOPT_WRITEFUNCTION, wrfu);
+  easy_setopt(curl, CURLOPT_WRITEFUNCTION, tutil_throwaway_cb);
 
   /* No peer verify */
-  test_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
-  test_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
+  easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+  easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
 
-  /* Perform the request, res will get the return code */
-  res = curl_easy_perform(curl);
-  if(!res || res == CURLE_GOT_NOTHING) {
+  /* Perform the request, result gets the return code */
+  result = curl_easy_perform(curl);
+  if(!result || result == CURLE_GOT_NOTHING) {
     struct curl_certinfo *cert_info = NULL;
     /* Get the certificate information */
-    res = curl_easy_getinfo(curl, CURLINFO_CERTINFO, &cert_info);
-    if(!res) {
+    result = curl_easy_getinfo(curl, CURLINFO_CERTINFO, &cert_info);
+    if(!result) {
       /* Check to see if the certificate chain is ordered correctly */
       if(!is_chain_in_order(cert_info))
-        res = TEST_ERR_FAILURE;
+        result = TEST_ERR_FAILURE;
     }
   }
 
@@ -137,5 +129,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib3103.c b/third-party/curl/tests/libtest/lib3103.c
new file mode 100644
index 0000000000..cedb21d28a
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib3103.c
@@ -0,0 +1,64 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static CURLcode test_lib3103(const char *URL)
+{
+  CURLcode result = CURLE_OK;
+  CURLSH *share;
+  CURL *curl;
+
+  curl_global_init(CURL_GLOBAL_ALL);
+
+  share = curl_share_init();
+  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_COOKIE);
+
+  curl = curl_easy_init();
+  easy_setopt(curl, CURLOPT_SHARE, share);
+
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_PROXY, URL);
+  easy_setopt(curl, CURLOPT_URL, "http://localhost/");
+
+  easy_setopt(curl, CURLOPT_COOKIEFILE, "");
+
+  /* Set a cookie without Max-age or Expires */
+  easy_setopt(curl, CURLOPT_COOKIELIST, "Set-Cookie: c1=v1; domain=localhost");
+
+  result = curl_easy_perform(curl);
+  if(result) {
+    curl_mfprintf(stderr, "curl_easy_perform() failed: %s\n",
+                  curl_easy_strerror(result));
+  }
+
+test_cleanup:
+
+  /* always cleanup */
+  curl_easy_cleanup(curl);
+  curl_share_cleanup(share);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib3104.c b/third-party/curl/tests/libtest/lib3104.c
new file mode 100644
index 0000000000..96ca51205e
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib3104.c
@@ -0,0 +1,64 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static CURLcode test_lib3104(const char *URL)
+{
+  CURLcode result = CURLE_OK;
+  CURLSH *share;
+  CURL *curl;
+
+  curl_global_init(CURL_GLOBAL_ALL);
+
+  share = curl_share_init();
+  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_COOKIE);
+
+  curl = curl_easy_init();
+  easy_setopt(curl, CURLOPT_SHARE, share);
+
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_PROXY, URL);
+  easy_setopt(curl, CURLOPT_URL, "http://example.com/");
+
+  easy_setopt(curl, CURLOPT_COOKIEFILE, "");
+
+  easy_setopt(curl, CURLOPT_COOKIELIST,
+              "example.com\tFALSE\t/\tFALSE\t0\tname\tvalue");
+
+  result = curl_easy_perform(curl);
+  if(result) {
+    curl_mfprintf(stderr, "curl_easy_perform() failed: %s\n",
+                  curl_easy_strerror(result));
+  }
+
+test_cleanup:
+
+  /* always cleanup */
+  curl_easy_cleanup(curl);
+  curl_share_cleanup(share);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib3105.c b/third-party/curl/tests/libtest/lib3105.c
new file mode 100644
index 0000000000..b269e6f75e
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib3105.c
@@ -0,0 +1,62 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static CURLcode test_lib3105(const char *URL)
+{
+  CURL *curl = NULL;
+  CURLM *multi = NULL;
+  CURLcode i = CURLE_OK;
+  CURLcode result = CURLE_OK;
+  CURLMcode mresult;
+
+  global_init(CURL_GLOBAL_ALL);
+
+  multi_init(multi);
+
+  easy_init(curl);
+
+  easy_setopt(curl, CURLOPT_URL, URL);
+
+  multi_add_handle(multi, curl);
+
+  mresult = curl_multi_remove_handle(multi, curl);
+  if(!mresult)
+    mresult = curl_multi_remove_handle(multi, curl);
+
+  if(mresult) {
+    curl_mfprintf(stderr, "%d was unexpected\n", mresult);
+    i = CURLE_FAILED_INIT;
+  }
+
+test_cleanup:
+  curl_multi_cleanup(multi);
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+
+  if(result)
+    i = result;
+
+  return i; /* return the final return code */
+}
diff --git a/third-party/curl/tests/libtest/lib3207.c b/third-party/curl/tests/libtest/lib3207.c
new file mode 100644
index 0000000000..77df591710
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib3207.c
@@ -0,0 +1,214 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#include "curl_threads.h"
+
+#define THREAD_SIZE     16
+#define PER_THREAD_SIZE 8
+
+struct Ctx {
+  const char *URL;
+  CURLSH *share;
+  CURLcode result;
+  size_t thread_id;
+  struct curl_slist *contents;
+};
+
+static size_t write_memory_callback(char *contents, size_t size,
+                                    size_t nmemb, void *userp)
+{
+  /* append the data to contents */
+  size_t realsize = size * nmemb;
+  struct Ctx *mem = (struct Ctx *)userp;
+  char *data = curlx_malloc(realsize + 1);
+  struct curl_slist *item_append = NULL;
+  if(!data) {
+    curl_mprintf("not enough memory (malloc returned NULL)\n");
+    return 0;
+  }
+  memcpy(data, contents, realsize);
+  data[realsize] = '\0';
+  item_append = curl_slist_append(mem->contents, data);
+  curlx_free(data);
+  if(item_append) {
+    mem->contents = item_append;
+  }
+  else {
+    curl_mprintf("not enough memory (curl_slist_append returned NULL)\n");
+    return 0;
+  }
+  return realsize;
+}
+
+#ifdef USE_THREADS
+static CURL_THREAD_RETURN_T CURL_STDCALL test_thread(void *ptr)
+#else
+static unsigned int test_thread(void *ptr)
+#endif
+{
+  struct Ctx *ctx = (struct Ctx *)ptr;
+  CURLcode result = CURLE_OK;
+
+  int i;
+
+  /* Loop the transfer and cleanup the handle properly every lap. This
+     still reuses SSL session since the pool is in the shared object. */
+  for(i = 0; i < PER_THREAD_SIZE; i++) {
+    CURL *curl = curl_easy_init();
+    if(curl) {
+      curl_easy_setopt(curl, CURLOPT_URL, ctx->URL);
+
+      /* use the share object */
+      curl_easy_setopt(curl, CURLOPT_SHARE, ctx->share);
+      curl_easy_setopt(curl, CURLOPT_CAINFO, libtest_arg2);
+
+      curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_memory_callback);
+      curl_easy_setopt(curl, CURLOPT_WRITEDATA, ptr);
+      curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+      /* Perform the request, result gets the return code */
+      result = curl_easy_perform(curl);
+
+      /* always cleanup */
+      curl_easy_cleanup(curl);
+      /* Check for errors */
+      if(result != CURLE_OK) {
+        curl_mfprintf(stderr, "curl_easy_perform() failed: %s\n",
+                      curl_easy_strerror(result));
+        goto test_cleanup;
+      }
+    }
+  }
+
+test_cleanup:
+  ctx->result = result;
+  return 0;
+}
+
+#ifdef USE_THREADS
+
+static void t3207_test_lock(CURL *curl, curl_lock_data data,
+                            curl_lock_access laccess, void *useptr)
+{
+  curl_mutex_t *mutexes = (curl_mutex_t *)useptr;
+  (void)curl;
+  (void)laccess;
+  Curl_mutex_acquire(&mutexes[data]);
+}
+
+static void t3207_test_unlock(CURL *curl, curl_lock_data data, void *useptr)
+{
+  curl_mutex_t *mutexes = (curl_mutex_t *)useptr;
+  (void)curl;
+  Curl_mutex_release(&mutexes[data]);
+}
+
+static void execute(CURLSH *share, struct Ctx *ctx)
+{
+  size_t i;
+  curl_mutex_t mutexes[CURL_LOCK_DATA_LAST - 1];
+  curl_thread_t thread[THREAD_SIZE];
+  for(i = 0; i < CURL_ARRAYSIZE(mutexes); i++) {
+    Curl_mutex_init(&mutexes[i]);
+  }
+  curl_share_setopt(share, CURLSHOPT_LOCKFUNC, t3207_test_lock);
+  curl_share_setopt(share, CURLSHOPT_UNLOCKFUNC, t3207_test_unlock);
+  curl_share_setopt(share, CURLSHOPT_USERDATA, (void *)mutexes);
+  curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_SSL_SESSION);
+
+  for(i = 0; i < CURL_ARRAYSIZE(thread); i++) {
+    thread[i] = Curl_thread_create(test_thread, (void *)&ctx[i]);
+  }
+  for(i = 0; i < CURL_ARRAYSIZE(thread); i++) {
+    if(thread[i]) {
+      Curl_thread_join(&thread[i]);
+      Curl_thread_destroy(&thread[i]);
+    }
+  }
+  curl_share_setopt(share, CURLSHOPT_LOCKFUNC, NULL);
+  curl_share_setopt(share, CURLSHOPT_UNLOCKFUNC, NULL);
+  for(i = 0; i < CURL_ARRAYSIZE(mutexes); i++) {
+    Curl_mutex_destroy(&mutexes[i]);
+  }
+}
+
+#else /* without pthread, run serially */
+
+static void execute(CURLSH *share, struct Ctx *ctx)
+{
+  size_t i;
+  (void)share;
+  for(i = 0; i < THREAD_SIZE; i++) {
+    test_thread((void *)&ctx[i]);
+  }
+}
+
+#endif
+
+static CURLcode test_lib3207(const char *URL)
+{
+  CURLcode result = CURLE_OK;
+  size_t i;
+  CURLSH *share;
+  struct Ctx ctx[THREAD_SIZE];
+
+  curl_global_init(CURL_GLOBAL_ALL);
+
+  share = curl_share_init();
+  if(!share) {
+    curl_mfprintf(stderr, "curl_share_init() failed\n");
+    goto test_cleanup;
+  }
+
+  for(i = 0; i < CURL_ARRAYSIZE(ctx); i++) {
+    ctx[i].share = share;
+    ctx[i].URL = URL;
+    ctx[i].thread_id = i;
+    ctx[i].result = CURLE_OK;
+    ctx[i].contents = NULL;
+  }
+
+  execute(share, ctx);
+
+  for(i = 0; i < CURL_ARRAYSIZE(ctx); i++) {
+    if(ctx[i].result) {
+      result = ctx[i].result;
+    }
+    else {
+      struct curl_slist *item = ctx[i].contents;
+      while(item) {
+        curl_mprintf("%s", item->data);
+        item = item->next;
+      }
+    }
+    curl_slist_free_all(ctx[i].contents);
+  }
+
+test_cleanup:
+  if(share)
+    curl_share_cleanup(share);
+  curl_global_cleanup();
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib3208.c b/third-party/curl/tests/libtest/lib3208.c
new file mode 100644
index 0000000000..70ecfd9cad
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib3208.c
@@ -0,0 +1,100 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static CURLcode test_lib3208(const char *URL)
+{
+  CURL *curl = NULL;
+  CURLM *multi = NULL;
+  int still_running;
+  CURLcode i = TEST_ERR_FAILURE;
+  CURLcode result = CURLE_OK;
+  CURLMsg *msg;
+
+  start_test_timing();
+
+  global_init(CURL_GLOBAL_ALL);
+
+  multi_init(multi);
+
+  easy_init(curl);
+
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  /* no peer verify */
+  easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+  easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
+
+  /* first, make an easy perform with the handle */
+  curl_easy_perform(curl);
+
+  /* then proceed and use it for a multi perform */
+  multi_add_handle(multi, curl);
+
+  multi_perform(multi, &still_running);
+
+  abort_on_test_timeout();
+
+  while(still_running) {
+    CURLMcode mresult;
+    int num;
+    mresult = curl_multi_wait(multi, NULL, 0, TEST_HANG_TIMEOUT, &num);
+    if(mresult != CURLM_OK) {
+      curl_mprintf("curl_multi_wait() returned %d\n", mresult);
+      result = TEST_ERR_MAJOR_BAD;
+      goto test_cleanup;
+    }
+
+    abort_on_test_timeout();
+
+    multi_perform(multi, &still_running);
+
+    abort_on_test_timeout();
+  }
+
+  msg = curl_multi_info_read(multi, &still_running);
+  if(msg)
+    /* this should now contain a result code from the easy handle,
+       get it */
+    i = msg->data.result;
+
+  curl_multi_remove_handle(multi, curl);
+
+  /* make a third transfer with the easy handle */
+  curl_easy_perform(curl);
+
+test_cleanup:
+
+  /* undocumented cleanup sequence - type UA */
+
+  curl_multi_cleanup(multi);
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+
+  if(result)
+    i = result;
+
+  return i; /* return the final return code */
+}
diff --git a/third-party/curl/tests/libtest/lib500.c b/third-party/curl/tests/libtest/lib500.c
index f99b244b49..786d8360b1 100644
--- a/third-party/curl/tests/libtest/lib500.c
+++ b/third-party/curl/tests/libtest/lib500.c
@@ -21,14 +21,11 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
 #include "testtrace.h"
-#include "memdebug.h"
 
-#ifdef LIB585
-
-static int counter;
+static int testcounter;
 
 static curl_socket_t tst_opensocket(void *clientp,
                                     curlsocktype purpose,
@@ -36,14 +33,14 @@ static curl_socket_t tst_opensocket(void *clientp,
 {
   (void)clientp;
   (void)purpose;
-  printf("[OPEN] counter: %d\n", ++counter);
-  return socket(addr->family, addr->socktype, addr->protocol);
+  curl_mprintf("[OPEN] counter: %d\n", ++testcounter);
+  return CURL_SOCKET(addr->family, addr->socktype, addr->protocol);
 }
 
 static int tst_closesocket(void *clientp, curl_socket_t sock)
 {
   (void)clientp;
-  printf("[CLOSE] counter: %d\n", counter--);
+  curl_mprintf("[CLOSE] counter: %d\n", testcounter--);
   return sclose(sock);
 }
 
@@ -51,100 +48,121 @@ static void setupcallbacks(CURL *curl)
 {
   curl_easy_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, tst_opensocket);
   curl_easy_setopt(curl, CURLOPT_CLOSESOCKETFUNCTION, tst_closesocket);
-  counter = 0;
+  testcounter = 0;
 }
 
-#else
-#define setupcallbacks(x) Curl_nop_stmt
-#endif
-
-
-int test(char *URL)
+static CURLcode test_lib500(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
-  char *ipstr = NULL;
+  const char *ipstr = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-  libtest_debug_config.nohex = 1;
-  libtest_debug_config.tracetime = 1;
-  test_setopt(curl, CURLOPT_DEBUGDATA, &libtest_debug_config);
-  test_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  debug_config.nohex = TRUE;
+  debug_config.tracetime = TRUE;
+  easy_setopt(curl, CURLOPT_DEBUGDATA, &debug_config);
+  easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   if(libtest_arg3 && !strcmp(libtest_arg3, "activeftp"))
-    test_setopt(curl, CURLOPT_FTPPORT, "-");
+    easy_setopt(curl, CURLOPT_FTPPORT, "-");
 
-  setupcallbacks(curl);
+  if(testnum == 585 || testnum == 586 || testnum == 595 || testnum == 596)
+    setupcallbacks(curl);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
-  if(!res) {
-    res = curl_easy_getinfo(curl, CURLINFO_PRIMARY_IP, &ipstr);
+  if(!result) {
+    result = curl_easy_getinfo(curl, CURLINFO_PRIMARY_IP, &ipstr);
     if(libtest_arg2) {
-      FILE *moo = fopen(libtest_arg2, "wb");
+      FILE *moo = curlx_fopen(libtest_arg2, "wb");
       if(moo) {
         curl_off_t time_namelookup;
         curl_off_t time_connect;
         curl_off_t time_pretransfer;
+        curl_off_t time_posttransfer;
         curl_off_t time_starttransfer;
         curl_off_t time_total;
-        fprintf(moo, "IP %s\n", ipstr);
+        curl_mfprintf(moo, "IP %s\n", ipstr);
         curl_easy_getinfo(curl, CURLINFO_NAMELOOKUP_TIME_T, &time_namelookup);
         curl_easy_getinfo(curl, CURLINFO_CONNECT_TIME_T, &time_connect);
         curl_easy_getinfo(curl, CURLINFO_PRETRANSFER_TIME_T,
                           &time_pretransfer);
+        curl_easy_getinfo(curl, CURLINFO_POSTTRANSFER_TIME_T,
+                          &time_posttransfer);
         curl_easy_getinfo(curl, CURLINFO_STARTTRANSFER_TIME_T,
                           &time_starttransfer);
         curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME_T, &time_total);
 
-        /* since the timing will always vary we only compare relative
+        /* since the timing always varies we only compare relative
            differences between these 5 times */
         if(time_namelookup > time_connect) {
-          fprintf(moo, "namelookup vs connect: %" CURL_FORMAT_CURL_OFF_T
-                  ".%06ld %" CURL_FORMAT_CURL_OFF_T ".%06ld\n",
-                  (time_namelookup / 1000000),
-                  (long)(time_namelookup % 1000000),
-                  (time_connect / 1000000), (long)(time_connect % 1000000));
+          curl_mfprintf(moo, "namelookup vs connect: %" CURL_FORMAT_CURL_OFF_T
+                        ".%06ld %" CURL_FORMAT_CURL_OFF_T ".%06ld\n",
+                        (time_namelookup / 1000000),
+                        (long)(time_namelookup % 1000000),
+                        (time_connect / 1000000),
+                        (long)(time_connect % 1000000));
         }
         if(time_connect > time_pretransfer) {
-          fprintf(moo, "connect vs pretransfer: %" CURL_FORMAT_CURL_OFF_T
-                  ".%06ld %" CURL_FORMAT_CURL_OFF_T ".%06ld\n",
-                  (time_connect / 1000000), (long)(time_connect % 1000000),
-                  (time_pretransfer / 1000000),
-                  (long)(time_pretransfer % 1000000));
+          curl_mfprintf(moo, "connect vs pretransfer: %"
+                        CURL_FORMAT_CURL_OFF_T
+                        ".%06ld %" CURL_FORMAT_CURL_OFF_T ".%06ld\n",
+                        (time_connect / 1000000),
+                        (long)(time_connect % 1000000),
+                        (time_pretransfer / 1000000),
+                        (long)(time_pretransfer % 1000000));
+        }
+        if(time_pretransfer > time_posttransfer) {
+          curl_mfprintf(moo, "pretransfer vs posttransfer: %"
+                        CURL_FORMAT_CURL_OFF_T
+                        ".%06ld %" CURL_FORMAT_CURL_OFF_T ".%06ld\n",
+                        (time_pretransfer / 1000000),
+                        (long)(time_pretransfer % 1000000),
+                        (time_posttransfer / 1000000),
+                        (long)(time_posttransfer % 1000000));
         }
         if(time_pretransfer > time_starttransfer) {
-          fprintf(moo, "pretransfer vs starttransfer: %" CURL_FORMAT_CURL_OFF_T
-                  ".%06ld %" CURL_FORMAT_CURL_OFF_T ".%06ld\n",
-                  (time_pretransfer / 1000000),
-                  (long)(time_pretransfer % 1000000),
-                  (time_starttransfer / 1000000),
-                  (long)(time_starttransfer % 1000000));
+          curl_mfprintf(moo, "pretransfer vs starttransfer: %"
+                        CURL_FORMAT_CURL_OFF_T
+                        ".%06ld %" CURL_FORMAT_CURL_OFF_T ".%06ld\n",
+                        (time_pretransfer / 1000000),
+                        (long)(time_pretransfer % 1000000),
+                        (time_starttransfer / 1000000),
+                        (long)(time_starttransfer % 1000000));
         }
         if(time_starttransfer > time_total) {
-          fprintf(moo, "starttransfer vs total: %" CURL_FORMAT_CURL_OFF_T
-                  ".%06ld %" CURL_FORMAT_CURL_OFF_T ".%06ld\n",
-                  (time_starttransfer / 1000000),
-                  (long)(time_starttransfer % 1000000),
-                  (time_total / 1000000), (long)(time_total % 1000000));
+          curl_mfprintf(moo, "starttransfer vs total: %" CURL_FORMAT_CURL_OFF_T
+                        ".%06ld %" CURL_FORMAT_CURL_OFF_T ".%06ld\n",
+                        (time_starttransfer / 1000000),
+                        (long)(time_starttransfer % 1000000),
+                        (time_total / 1000000),
+                        (long)(time_total % 1000000));
+        }
+        if(time_posttransfer > time_total) {
+          curl_mfprintf(moo, "posttransfer vs total: %" CURL_FORMAT_CURL_OFF_T
+                        ".%06ld %" CURL_FORMAT_CURL_OFF_T ".%06ld\n",
+                        (time_posttransfer / 1000000),
+                        (long)(time_posttransfer % 1000000),
+                        (time_total / 1000000),
+                        (long)(time_total % 1000000));
         }
 
-        fclose(moo);
+        curlx_fclose(moo);
       }
     }
   }
@@ -154,5 +172,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib501.c b/third-party/curl/tests/libtest/lib501.c
index 7ef8501100..73bf010a1a 100644
--- a/third-party/curl/tests/libtest/lib501.c
+++ b/third-party/curl/tests/libtest/lib501.c
@@ -21,40 +21,38 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib501(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
 
-  (void)URL; /* we don't use this */
+  (void)URL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-  /* just verify that setting this to -1 is fine */
-  test_setopt(curl, CURLOPT_MAXREDIRS, -1L);
+  /* verify that setting this to -1 is fine */
+  easy_setopt(curl, CURLOPT_MAXREDIRS, -1L);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib502.c b/third-party/curl/tests/libtest/lib502.c
index 91f96e6f59..ebdc837fea 100644
--- a/third-party/curl/tests/libtest/lib502.c
+++ b/third-party/curl/tests/libtest/lib502.c
@@ -21,36 +21,30 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
+#include "first.h"
 
 /*
  * Get a single URL without select().
  */
 
-int test(char *URL)
+static CURLcode test_lib502(const char *URL)
 {
-  CURL *c = NULL;
-  CURLM *m = NULL;
-  int res = 0;
+  CURL *curl = NULL;
+  CURLM *multi = NULL;
+  CURLcode result = CURLE_OK;
   int running;
 
   start_test_timing();
 
   global_init(CURL_GLOBAL_ALL);
 
-  easy_init(c);
+  easy_init(curl);
 
-  easy_setopt(c, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
-  multi_init(m);
+  multi_init(multi);
 
-  multi_add_handle(m, c);
+  multi_add_handle(multi, curl);
 
   for(;;) {
     struct timeval timeout;
@@ -60,7 +54,7 @@ int test(char *URL)
     timeout.tv_sec = 0;
     timeout.tv_usec = 100000L; /* 100 ms */
 
-    multi_perform(m, &running);
+    multi_perform(multi, &running);
 
     abort_on_test_timeout();
 
@@ -71,7 +65,7 @@ int test(char *URL)
     FD_ZERO(&fdwrite);
     FD_ZERO(&fdexcep);
 
-    multi_fdset(m, &fdread, &fdwrite, &fdexcep, &maxfd);
+    multi_fdset(multi, &fdread, &fdwrite, &fdexcep, &maxfd);
 
     /* At this point, maxfd is guaranteed to be greater or equal than -1. */
 
@@ -84,10 +78,10 @@ test_cleanup:
 
   /* proper cleanup sequence - type PA */
 
-  curl_multi_remove_handle(m, c);
-  curl_multi_cleanup(m);
-  curl_easy_cleanup(c);
+  curl_multi_remove_handle(multi, curl);
+  curl_multi_cleanup(multi);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib503.c b/third-party/curl/tests/libtest/lib503.c
index 15b09476e3..384dfc86c0 100644
--- a/third-party/curl/tests/libtest/lib503.c
+++ b/third-party/curl/tests/libtest/lib503.c
@@ -21,13 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
+#include "first.h"
 
 /*
  * Source code in here hugely as reported in bug report 651460 by
@@ -37,30 +31,31 @@
  * auth info.
  */
 
-int test(char *URL)
+static CURLcode test_lib503(const char *URL)
 {
-  CURL *c = NULL;
-  CURLM *m = NULL;
-  int res = 0;
+  CURL *curl = NULL;
+  CURLM *multi = NULL;
+  CURLcode result = CURLE_OK;
   int running;
 
   start_test_timing();
 
   global_init(CURL_GLOBAL_ALL);
 
-  easy_init(c);
+  easy_init(curl);
 
-  easy_setopt(c, CURLOPT_PROXY, libtest_arg2); /* set in first.c */
-  easy_setopt(c, CURLOPT_URL, URL);
-  easy_setopt(c, CURLOPT_USERPWD, "test:ing");
-  easy_setopt(c, CURLOPT_PROXYUSERPWD, "test:ing");
-  easy_setopt(c, CURLOPT_HTTPPROXYTUNNEL, 1L);
-  easy_setopt(c, CURLOPT_HEADER, 1L);
-  easy_setopt(c, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_PROXY, libtest_arg2); /* set in first.c */
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_USERPWD, "test:ing");
+  easy_setopt(curl, CURLOPT_PROXYUSERNAME, "test%20");
+  easy_setopt(curl, CURLOPT_PROXYPASSWORD, "ing%41");
+  easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  multi_init(m);
+  multi_init(multi);
 
-  multi_add_handle(m, c);
+  multi_add_handle(multi, curl);
 
   for(;;) {
     struct timeval interval;
@@ -70,7 +65,7 @@ int test(char *URL)
     interval.tv_sec = 1;
     interval.tv_usec = 0;
 
-    multi_perform(m, &running);
+    multi_perform(multi, &running);
 
     abort_on_test_timeout();
 
@@ -81,7 +76,7 @@ int test(char *URL)
     FD_ZERO(&wr);
     FD_ZERO(&exc);
 
-    multi_fdset(m, &rd, &wr, &exc, &maxfd);
+    multi_fdset(multi, &rd, &wr, &exc, &maxfd);
 
     /* At this point, maxfd is guaranteed to be greater or equal than -1. */
 
@@ -94,10 +89,10 @@ test_cleanup:
 
   /* proper cleanup sequence - type PA */
 
-  curl_multi_remove_handle(m, c);
-  curl_multi_cleanup(m);
-  curl_easy_cleanup(c);
+  curl_multi_remove_handle(multi, curl);
+  curl_multi_cleanup(multi);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib504.c b/third-party/curl/tests/libtest/lib504.c
index cbe1d57733..ecf0ee0c49 100644
--- a/third-party/curl/tests/libtest/lib504.c
+++ b/third-party/curl/tests/libtest/lib504.c
@@ -21,13 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
+#include "first.h"
 
 /*
  * Source code in here hugely as reported in bug report 651464 by
@@ -36,11 +30,11 @@
  * Use multi interface to get document over proxy with bad port number.
  * This caused the interface to "hang" in libcurl 7.10.2.
  */
-int test(char *URL)
+static CURLcode test_lib504(const char *URL)
 {
-  CURL *c = NULL;
-  int res = 0;
-  CURLM *m = NULL;
+  CURL *curl = NULL;
+  CURLcode result = CURLE_OK;
+  CURLM *multi = NULL;
   fd_set rd, wr, exc;
   int running;
 
@@ -48,18 +42,18 @@ int test(char *URL)
 
   global_init(CURL_GLOBAL_ALL);
 
-  easy_init(c);
+  easy_init(curl);
 
   /* The point here is that there must not be anything running on the given
      proxy port */
   if(libtest_arg2)
-    easy_setopt(c, CURLOPT_PROXY, libtest_arg2);
-  easy_setopt(c, CURLOPT_URL, URL);
-  easy_setopt(c, CURLOPT_VERBOSE, 1L);
+    easy_setopt(curl, CURLOPT_PROXY, libtest_arg2);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  multi_init(m);
+  multi_init(multi);
 
-  multi_add_handle(m, c);
+  multi_add_handle(multi, curl);
 
   for(;;) {
     struct timeval interval;
@@ -68,32 +62,47 @@ int test(char *URL)
     interval.tv_sec = 1;
     interval.tv_usec = 0;
 
-    fprintf(stderr, "curl_multi_perform()\n");
+    curl_mfprintf(stderr, "curl_multi_perform()\n");
 
-    multi_perform(m, &running);
+    multi_perform(multi, &running);
+
+    while(running) {
+      CURLMcode mresult;
+      int num;
+      mresult = curl_multi_wait(multi, NULL, 0, TEST_HANG_TIMEOUT, &num);
+      if(mresult != CURLM_OK) {
+        curl_mprintf("curl_multi_wait() returned %d\n", mresult);
+        result = TEST_ERR_MAJOR_BAD;
+        goto test_cleanup;
+      }
+
+      abort_on_test_timeout();
+      multi_perform(multi, &running);
+      abort_on_test_timeout();
+    }
 
     abort_on_test_timeout();
 
     if(!running) {
       /* This is where this code is expected to reach */
       int numleft;
-      CURLMsg *msg = curl_multi_info_read(m, &numleft);
-      fprintf(stderr, "Expected: not running\n");
+      CURLMsg *msg = curl_multi_info_read(multi, &numleft);
+      curl_mfprintf(stderr, "Expected: not running\n");
       if(msg && !numleft)
-        res = TEST_ERR_SUCCESS; /* this is where we should be */
+        result = TEST_ERR_SUCCESS; /* this is where we should be */
       else
-        res = TEST_ERR_FAILURE; /* not correct */
+        result = TEST_ERR_FAILURE; /* not correct */
       break; /* done */
     }
-    fprintf(stderr, "running == %d\n", running);
+    curl_mfprintf(stderr, "running == %d\n", running);
 
     FD_ZERO(&rd);
     FD_ZERO(&wr);
     FD_ZERO(&exc);
 
-    fprintf(stderr, "curl_multi_fdset()\n");
+    curl_mfprintf(stderr, "curl_multi_fdset()\n");
 
-    multi_fdset(m, &rd, &wr, &exc, &maxfd);
+    multi_fdset(multi, &rd, &wr, &exc, &maxfd);
 
     /* At this point, maxfd is guaranteed to be greater or equal than -1. */
 
@@ -106,10 +115,10 @@ test_cleanup:
 
   /* proper cleanup sequence - type PA */
 
-  curl_multi_remove_handle(m, c);
-  curl_multi_cleanup(m);
-  curl_easy_cleanup(c);
+  curl_multi_remove_handle(multi, curl);
+  curl_multi_cleanup(multi);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib505.c b/third-party/curl/tests/libtest/lib505.c
index 6c67ed9015..7abaacd14e 100644
--- a/third-party/curl/tests/libtest/lib505.c
+++ b/third-party/curl/tests/libtest/lib505.c
@@ -21,121 +21,115 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#ifdef HAVE_FCNTL_H
-#include <fcntl.h>
-#endif
-
-#include "memdebug.h"
+#include "first.h"
 
 /*
- * This example shows an FTP upload, with a rename of the file just after
+ * This example shows an FTP upload, with a rename of the file right after
  * a successful upload.
  *
  * Example based on source code provided by Erick Nuwendam. Thanks!
  */
 
-int test(char *URL)
+static CURLcode test_lib505(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
+  char errbuf[STRERROR_LEN];
   FILE *hd_src;
   int hd;
-  struct_stat file_info;
-  struct curl_slist *hl;
+  curlx_struct_stat file_info;
+  struct curl_slist *headerlist;
+  struct curl_slist *temp;
 
-  struct curl_slist *headerlist = NULL;
-  const char *buf_1 = "RNFR 505";
-  const char *buf_2 = "RNTO 505-forreal";
+  static const char *buf_1 = "RNFR 505";
+  static const char *buf_2 = "RNTO 505-forreal";
 
   if(!libtest_arg2) {
-    fprintf(stderr, "Usage: <url> <file-to-upload>\n");
+    curl_mfprintf(stderr, "Usage: <url> <file-to-upload>\n");
     return TEST_ERR_USAGE;
   }
 
-  hd_src = fopen(libtest_arg2, "rb");
+  hd_src = curlx_fopen(libtest_arg2, "rb");
   if(!hd_src) {
-    fprintf(stderr, "fopen failed with error: %d %s\n",
-            errno, strerror(errno));
-    fprintf(stderr, "Error opening file: %s\n", libtest_arg2);
+    curl_mfprintf(stderr, "fopen() failed with error (%d) %s\n",
+                  errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
+    curl_mfprintf(stderr, "Error opening file '%s'\n", libtest_arg2);
     return TEST_ERR_MAJOR_BAD; /* if this happens things are major weird */
   }
 
   /* get the file size of the local file */
-  hd = fstat(fileno(hd_src), &file_info);
+  hd = curlx_fstat(fileno(hd_src), &file_info);
   if(hd == -1) {
-    /* can't open file, bail out */
-    fprintf(stderr, "fstat() failed with error: %d %s\n",
-            errno, strerror(errno));
-    fprintf(stderr, "ERROR: cannot open file %s\n", libtest_arg2);
-    fclose(hd_src);
+    /* cannot open file, bail out */
+    curl_mfprintf(stderr, "fstat() failed with error (%d) %s\n",
+                  errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
+    curl_mfprintf(stderr, "Error opening file '%s'\n", libtest_arg2);
+    curlx_fclose(hd_src);
     return TEST_ERR_MAJOR_BAD;
   }
 
   if(!file_info.st_size) {
-    fprintf(stderr, "ERROR: file %s has zero size!\n", libtest_arg2);
-    fclose(hd_src);
+    curl_mfprintf(stderr, "File %s has zero size!\n", libtest_arg2);
+    curlx_fclose(hd_src);
     return TEST_ERR_MAJOR_BAD;
   }
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
-    fclose(hd_src);
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    curlx_fclose(hd_src);
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* get a curl handle */
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
-    fclose(hd_src);
+    curlx_fclose(hd_src);
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* build a list of commands to pass to libcurl */
 
-  hl = curl_slist_append(headerlist, buf_1);
-  if(!hl) {
-    fprintf(stderr, "curl_slist_append() failed\n");
-    curl_easy_cleanup(curl);
-    curl_global_cleanup();
-    fclose(hd_src);
-    return TEST_ERR_MAJOR_BAD;
-  }
-  headerlist = curl_slist_append(hl, buf_2);
+  headerlist = curl_slist_append(NULL, buf_1);
   if(!headerlist) {
-    fprintf(stderr, "curl_slist_append() failed\n");
-    curl_slist_free_all(hl);
+    curl_mfprintf(stderr, "curl_slist_append() failed\n");
     curl_easy_cleanup(curl);
     curl_global_cleanup();
-    fclose(hd_src);
+    curlx_fclose(hd_src);
     return TEST_ERR_MAJOR_BAD;
   }
-  headerlist = hl;
+  temp = curl_slist_append(headerlist, buf_2);
+  if(!temp) {
+    curl_mfprintf(stderr, "curl_slist_append() failed\n");
+    curl_slist_free_all(headerlist);
+    curl_easy_cleanup(curl);
+    curl_global_cleanup();
+    curlx_fclose(hd_src);
+    return TEST_ERR_MAJOR_BAD;
+  }
+  headerlist = temp;
 
   /* enable uploading */
-  test_setopt(curl, CURLOPT_UPLOAD, 1L);
+  easy_setopt(curl, CURLOPT_UPLOAD, 1L);
 
   /* enable verbose */
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* specify target */
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* pass in that last of FTP commands to run after the transfer */
-  test_setopt(curl, CURLOPT_POSTQUOTE, headerlist);
+  easy_setopt(curl, CURLOPT_POSTQUOTE, headerlist);
 
   /* now specify which file to upload */
-  test_setopt(curl, CURLOPT_READDATA, hd_src);
+  easy_setopt(curl, CURLOPT_READDATA, hd_src);
 
   /* and give the size of the upload (optional) */
-  test_setopt(curl, CURLOPT_INFILESIZE_LARGE,
-                   (curl_off_t)file_info.st_size);
+  easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, (curl_off_t)file_info.st_size);
 
-  /* Now run off and do what you've been told! */
-  res = curl_easy_perform(curl);
+  /* Now run off and do what you have been told! */
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -143,10 +137,10 @@ test_cleanup:
   curl_slist_free_all(headerlist);
 
   /* close the local file */
-  fclose(hd_src);
+  curlx_fclose(hd_src);
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib506.c b/third-party/curl/tests/libtest/lib506.c
index dd4759ac45..8d36c32ec3 100644
--- a/third-party/curl/tests/libtest/lib506.c
+++ b/third-party/curl/tests/libtest/lib506.c
@@ -21,213 +21,210 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-#include "memdebug.h"
+#include "first.h"
 
-static const char * const HOSTHEADER = "Host: www.host.foo.com";
-#define JAR libtest_arg2
 #define THREADS 2
 
 /* struct containing data of a thread */
-struct Tdata {
+struct t506_Tdata {
   CURLSH *share;
   char *url;
 };
 
-struct userdata {
+struct t506_userdata {
   const char *text;
-  int counter;
+  int share_counter;
+  int dns_counter;
+  int cookie_counter;
 };
 
 static int locks[3];
 
 /* lock callback */
-static void my_lock(CURL *handle, curl_lock_data data,
-                    curl_lock_access laccess, void *useptr)
+static void t506_test_lock(CURL *curl, curl_lock_data data,
+                           curl_lock_access laccess, void *useptr)
 {
   const char *what;
-  struct userdata *user = (struct userdata *)useptr;
-  int locknum;
+  struct t506_userdata *user = (struct t506_userdata *)useptr;
+  int locknum, *pcounter;
 
-  (void)handle;
+  (void)curl;
   (void)laccess;
 
   switch(data) {
-    case CURL_LOCK_DATA_SHARE:
-      what = "share";
-      locknum = 0;
-      break;
-    case CURL_LOCK_DATA_DNS:
-      what = "dns";
-      locknum = 1;
-      break;
-    case CURL_LOCK_DATA_COOKIE:
-      what = "cookie";
-      locknum = 2;
-      break;
-    default:
-      fprintf(stderr, "lock: no such data: %d\n", (int)data);
-      return;
+  case CURL_LOCK_DATA_SHARE:
+    what = "share";
+    locknum = 0;
+    pcounter = &user->share_counter;
+    break;
+  case CURL_LOCK_DATA_DNS:
+    what = "dns";
+    locknum = 1;
+    pcounter = &user->dns_counter;
+    break;
+  case CURL_LOCK_DATA_COOKIE:
+    what = "cookie";
+    locknum = 2;
+    pcounter = &user->cookie_counter;
+    break;
+  default:
+    curl_mfprintf(stderr, "lock: no such data: %d\n", (int)data);
+    return;
   }
 
   /* detect locking of locked locks */
   if(locks[locknum]) {
-    printf("lock: double locked %s\n", what);
+    curl_mprintf("lock: double locked %s\n", what);
     return;
   }
   locks[locknum]++;
 
-  printf("lock:   %-6s [%s]: %d\n", what, user->text, user->counter);
-  user->counter++;
+  curl_mprintf("lock:   %-6s [%s]: %d\n", what, user->text, *pcounter);
+  (*pcounter)++;
 }
 
 /* unlock callback */
-static void my_unlock(CURL *handle, curl_lock_data data, void *useptr)
+static void t506_test_unlock(CURL *curl, curl_lock_data data, void *useptr)
 {
   const char *what;
-  struct userdata *user = (struct userdata *)useptr;
-  int locknum;
-  (void)handle;
+  struct t506_userdata *user = (struct t506_userdata *)useptr;
+  int locknum, *pcounter;
+  (void)curl;
   switch(data) {
-    case CURL_LOCK_DATA_SHARE:
-      what = "share";
-      locknum = 0;
-      break;
-    case CURL_LOCK_DATA_DNS:
-      what = "dns";
-      locknum = 1;
-      break;
-    case CURL_LOCK_DATA_COOKIE:
-      what = "cookie";
-      locknum = 2;
-      break;
-    default:
-      fprintf(stderr, "unlock: no such data: %d\n", (int)data);
-      return;
+  case CURL_LOCK_DATA_SHARE:
+    what = "share";
+    locknum = 0;
+    pcounter = &user->share_counter;
+    break;
+  case CURL_LOCK_DATA_DNS:
+    what = "dns";
+    locknum = 1;
+    pcounter = &user->dns_counter;
+    break;
+  case CURL_LOCK_DATA_COOKIE:
+    what = "cookie";
+    pcounter = &user->cookie_counter;
+    locknum = 2;
+    break;
+  default:
+    curl_mfprintf(stderr, "unlock: no such data: %d\n", (int)data);
+    return;
   }
 
   /* detect unlocking of unlocked locks */
   if(!locks[locknum]) {
-    printf("unlock: double unlocked %s\n", what);
+    curl_mprintf("unlock: double unlocked %s\n", what);
     return;
   }
   locks[locknum]--;
 
-  printf("unlock: %-6s [%s]: %d\n", what, user->text, user->counter);
-  user->counter++;
+  curl_mprintf("unlock: %-6s [%s]: %d\n", what, user->text, *pcounter);
+  (*pcounter)++;
 }
 
-
 /* build host entry */
 static struct curl_slist *sethost(struct curl_slist *headers)
 {
   (void)headers;
-  return curl_slist_append(NULL, HOSTHEADER);
+  return curl_slist_append(NULL, "Host: www.host.foo.com");
 }
 
-
 /* the dummy thread function */
-static void *fire(void *ptr)
+static void *t506_test_fire(void *ptr)
 {
-  CURLcode code;
+  CURLcode result;
   struct curl_slist *headers;
-  struct Tdata *tdata = (struct Tdata*)ptr;
+  struct t506_Tdata *tdata = (struct t506_Tdata *)ptr;
   CURL *curl;
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     return NULL;
   }
 
   headers = sethost(NULL);
-  curl_easy_setopt(curl, CURLOPT_VERBOSE,    1L);
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
   curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
-  curl_easy_setopt(curl, CURLOPT_URL,        tdata->url);
+  curl_easy_setopt(curl, CURLOPT_URL, tdata->url);
   curl_easy_setopt(curl, CURLOPT_COOKIEFILE, "");
-  printf("CURLOPT_SHARE\n");
+  curl_mprintf("CURLOPT_SHARE\n");
   curl_easy_setopt(curl, CURLOPT_SHARE, tdata->share);
 
-  printf("PERFORM\n");
-  code = curl_easy_perform(curl);
-  if(code) {
+  curl_mprintf("PERFORM\n");
+  result = curl_easy_perform(curl);
+  if(result) {
     int i = 0;
-    fprintf(stderr, "perform url '%s' repeat %d failed, curlcode %d\n",
-            tdata->url, i, (int)code);
+    curl_mfprintf(stderr, "perform URL '%s' repeat %d failed, curlcode %d\n",
+                  tdata->url, i, (int)result);
   }
 
-  printf("CLEANUP\n");
+  curl_mprintf("CLEANUP\n");
   curl_easy_cleanup(curl);
   curl_slist_free_all(headers);
 
   return NULL;
 }
 
-
-/* build request url */
-static char *suburl(const char *base, int i)
-{
-  return curl_maprintf("%s%.4d", base, i);
-}
-
-
 /* test function */
-int test(char *URL)
+static CURLcode test_lib506(const char *URL)
 {
-  int res;
+  CURLcode result;
   CURLSHcode scode = CURLSHE_OK;
   CURLcode code = CURLE_OK;
   char *url = NULL;
-  struct Tdata tdata;
+  struct t506_Tdata tdata;
   CURL *curl;
   CURLSH *share;
   struct curl_slist *headers = NULL;
   struct curl_slist *cookies = NULL;
   struct curl_slist *next_cookie = NULL;
   int i;
-  struct userdata user;
+  struct t506_userdata user;
 
+  const char *jar = libtest_arg2;
+
+  memset(&user, 0, sizeof(user));
   user.text = "Pigs in space";
-  user.counter = 0;
 
-  printf("GLOBAL_INIT\n");
+  curl_mprintf("GLOBAL_INIT\n");
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* prepare share */
-  printf("SHARE_INIT\n");
+  curl_mprintf("SHARE_INIT\n");
   share = curl_share_init();
   if(!share) {
-    fprintf(stderr, "curl_share_init() failed\n");
+    curl_mfprintf(stderr, "curl_share_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   if(CURLSHE_OK == scode) {
-    printf("CURLSHOPT_LOCKFUNC\n");
-    scode = curl_share_setopt(share, CURLSHOPT_LOCKFUNC, my_lock);
+    curl_mprintf("CURLSHOPT_LOCKFUNC\n");
+    scode = curl_share_setopt(share, CURLSHOPT_LOCKFUNC, t506_test_lock);
   }
   if(CURLSHE_OK == scode) {
-    printf("CURLSHOPT_UNLOCKFUNC\n");
-    scode = curl_share_setopt(share, CURLSHOPT_UNLOCKFUNC, my_unlock);
+    curl_mprintf("CURLSHOPT_UNLOCKFUNC\n");
+    scode = curl_share_setopt(share, CURLSHOPT_UNLOCKFUNC, t506_test_unlock);
   }
   if(CURLSHE_OK == scode) {
-    printf("CURLSHOPT_USERDATA\n");
+    curl_mprintf("CURLSHOPT_USERDATA\n");
     scode = curl_share_setopt(share, CURLSHOPT_USERDATA, &user);
   }
   if(CURLSHE_OK == scode) {
-    printf("CURL_LOCK_DATA_COOKIE\n");
+    curl_mprintf("CURL_LOCK_DATA_COOKIE\n");
     scode = curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_COOKIE);
   }
   if(CURLSHE_OK == scode) {
-    printf("CURL_LOCK_DATA_DNS\n");
+    curl_mprintf("CURL_LOCK_DATA_DNS\n");
     scode = curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_DNS);
   }
 
   if(CURLSHE_OK != scode) {
-    fprintf(stderr, "curl_share_setopt() failed\n");
+    curl_mfprintf(stderr, "curl_share_setopt() failed\n");
     curl_share_cleanup(share);
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
@@ -236,73 +233,69 @@ int test(char *URL)
   /* initial cookie manipulation */
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_share_cleanup(share);
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
-  printf("CURLOPT_SHARE\n");
-  test_setopt(curl, CURLOPT_SHARE,      share);
-  printf("CURLOPT_COOKIELIST injected_and_clobbered\n");
-  test_setopt(curl, CURLOPT_COOKIELIST,
-               "Set-Cookie: injected_and_clobbered=yes; "
-               "domain=host.foo.com; expires=Sat Feb 2 11:56:27 GMT 2030");
-  printf("CURLOPT_COOKIELIST ALL\n");
-  test_setopt(curl, CURLOPT_COOKIELIST, "ALL");
-  printf("CURLOPT_COOKIELIST session\n");
-  test_setopt(curl, CURLOPT_COOKIELIST, "Set-Cookie: session=elephants");
-  printf("CURLOPT_COOKIELIST injected\n");
-  test_setopt(curl, CURLOPT_COOKIELIST,
-               "Set-Cookie: injected=yes; domain=host.foo.com; "
-               "expires=Sat Feb 2 11:56:27 GMT 2030");
-  printf("CURLOPT_COOKIELIST SESS\n");
-  test_setopt(curl, CURLOPT_COOKIELIST, "SESS");
-  printf("CLEANUP\n");
+  curl_mprintf("CURLOPT_SHARE\n");
+  easy_setopt(curl, CURLOPT_SHARE, share);
+  curl_mprintf("CURLOPT_COOKIELIST injected_and_clobbered\n");
+  easy_setopt(curl, CURLOPT_COOKIELIST,
+              "Set-Cookie: injected_and_clobbered=yes; "
+              "domain=host.foo.com; expires=Sat Feb 2 11:56:27 GMT 2030");
+  curl_mprintf("CURLOPT_COOKIELIST ALL\n");
+  easy_setopt(curl, CURLOPT_COOKIELIST, "ALL");
+  curl_mprintf("CURLOPT_COOKIELIST session\n");
+  easy_setopt(curl, CURLOPT_COOKIELIST, "Set-Cookie: session=elephants");
+  curl_mprintf("CURLOPT_COOKIELIST injected\n");
+  easy_setopt(curl, CURLOPT_COOKIELIST,
+              "Set-Cookie: injected=yes; domain=host.foo.com; "
+              "expires=Sat Feb 2 11:56:27 GMT 2030");
+  curl_mprintf("CURLOPT_COOKIELIST SESS\n");
+  easy_setopt(curl, CURLOPT_COOKIELIST, "SESS");
+  curl_mprintf("CLEANUP\n");
   curl_easy_cleanup(curl);
 
-
-  res = 0;
-
   /* start treads */
   for(i = 1; i <= THREADS; i++) {
 
     /* set thread data */
-    tdata.url   = suburl(URL, i); /* must be curl_free()d */
+    tdata.url = tutil_suburl(URL, i); /* must be curl_free()d */
     tdata.share = share;
 
     /* simulate thread, direct call of "thread" function */
-    printf("*** run %d\n",i);
-    fire(&tdata);
+    curl_mprintf("*** run %d\n", i);
+    t506_test_fire(&tdata);
 
     curl_free(tdata.url);
   }
 
-
-  /* fetch a another one and save cookies */
-  printf("*** run %d\n", i);
+  /* fetch another one and save cookies */
+  curl_mprintf("*** run %d\n", i);
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_share_cleanup(share);
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  url = suburl(URL, i);
+  url = tutil_suburl(URL, i);
   headers = sethost(NULL);
-  test_setopt(curl, CURLOPT_HTTPHEADER, headers);
-  test_setopt(curl, CURLOPT_URL,        url);
-  printf("CURLOPT_SHARE\n");
-  test_setopt(curl, CURLOPT_SHARE,      share);
-  printf("CURLOPT_COOKIEJAR\n");
-  test_setopt(curl, CURLOPT_COOKIEJAR,  JAR);
-  printf("CURLOPT_COOKIELIST FLUSH\n");
-  test_setopt(curl, CURLOPT_COOKIELIST, "FLUSH");
+  easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
+  easy_setopt(curl, CURLOPT_URL, url);
+  curl_mprintf("CURLOPT_SHARE\n");
+  easy_setopt(curl, CURLOPT_SHARE, share);
+  curl_mprintf("CURLOPT_COOKIEJAR\n");
+  easy_setopt(curl, CURLOPT_COOKIEJAR, jar);
+  curl_mprintf("CURLOPT_COOKIELIST FLUSH\n");
+  easy_setopt(curl, CURLOPT_COOKIELIST, "FLUSH");
 
-  printf("PERFORM\n");
+  curl_mprintf("PERFORM\n");
   curl_easy_perform(curl);
 
-  printf("CLEANUP\n");
+  curl_mprintf("CLEANUP\n");
   curl_easy_cleanup(curl);
   curl_free(url);
   curl_slist_free_all(headers);
@@ -310,73 +303,75 @@ int test(char *URL)
   /* load cookies */
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_share_cleanup(share);
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
-  url = suburl(URL, i);
+  url = tutil_suburl(URL, i);
   headers = sethost(NULL);
-  test_setopt(curl, CURLOPT_HTTPHEADER, headers);
-  test_setopt(curl, CURLOPT_URL,        url);
-  printf("CURLOPT_SHARE\n");
-  test_setopt(curl, CURLOPT_SHARE,      share);
-  printf("CURLOPT_COOKIELIST ALL\n");
-  test_setopt(curl, CURLOPT_COOKIELIST, "ALL");
-  printf("CURLOPT_COOKIEJAR\n");
-  test_setopt(curl, CURLOPT_COOKIEFILE, JAR);
-  printf("CURLOPT_COOKIELIST RELOAD\n");
-  test_setopt(curl, CURLOPT_COOKIELIST, "RELOAD");
+  easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
+  easy_setopt(curl, CURLOPT_URL, url);
+  curl_mprintf("CURLOPT_SHARE\n");
+  easy_setopt(curl, CURLOPT_SHARE, share);
+  curl_mprintf("CURLOPT_COOKIELIST ALL\n");
+  easy_setopt(curl, CURLOPT_COOKIELIST, "ALL");
+  curl_mprintf("CURLOPT_COOKIEJAR\n");
+  easy_setopt(curl, CURLOPT_COOKIEFILE, jar);
+  curl_mprintf("CURLOPT_COOKIELIST RELOAD\n");
+  easy_setopt(curl, CURLOPT_COOKIELIST, "RELOAD");
+
+  result = CURLE_OK;
 
   code = curl_easy_getinfo(curl, CURLINFO_COOKIELIST, &cookies);
   if(code != CURLE_OK) {
-    fprintf(stderr, "curl_easy_getinfo() failed\n");
-    res = TEST_ERR_MAJOR_BAD;
+    curl_mfprintf(stderr, "curl_easy_getinfo() failed\n");
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  printf("loaded cookies:\n");
+  curl_mprintf("loaded cookies:\n");
   if(!cookies) {
-    fprintf(stderr, "  reloading cookies from '%s' failed\n", JAR);
-    res = TEST_ERR_MAJOR_BAD;
+    curl_mfprintf(stderr, "  reloading cookies from '%s' failed\n", jar);
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  printf("-----------------\n");
+  curl_mprintf("-----------------\n");
   next_cookie = cookies;
   while(next_cookie) {
-    printf("  %s\n", next_cookie->data);
+    curl_mprintf("  %s\n", next_cookie->data);
     next_cookie = next_cookie->next;
   }
-  printf("-----------------\n");
+  curl_mprintf("-----------------\n");
   curl_slist_free_all(cookies);
 
   /* try to free share, expect to fail because share is in use */
-  printf("try SHARE_CLEANUP...\n");
+  curl_mprintf("try SHARE_CLEANUP...\n");
   scode = curl_share_cleanup(share);
   if(scode == CURLSHE_OK) {
-    fprintf(stderr, "curl_share_cleanup succeed but error expected\n");
+    curl_mfprintf(stderr, "curl_share_cleanup succeed but error expected\n");
     share = NULL;
   }
   else {
-    printf("SHARE_CLEANUP failed, correct\n");
+    curl_mprintf("SHARE_CLEANUP failed, correct\n");
   }
 
 test_cleanup:
 
   /* clean up last handle */
-  printf("CLEANUP\n");
+  curl_mprintf("CLEANUP\n");
   curl_easy_cleanup(curl);
   curl_slist_free_all(headers);
   curl_free(url);
 
   /* free share */
-  printf("SHARE_CLEANUP\n");
+  curl_mprintf("SHARE_CLEANUP\n");
   scode = curl_share_cleanup(share);
   if(scode != CURLSHE_OK)
-    fprintf(stderr, "curl_share_cleanup failed, code errno %d\n",
-            (int)scode);
+    curl_mfprintf(stderr, "curl_share_cleanup failed, code errno %d\n",
+                  (int)scode);
 
-  printf("GLOBAL_CLEANUP\n");
+  curl_mprintf("GLOBAL_CLEANUP\n");
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib507.c b/third-party/curl/tests/libtest/lib507.c
index be6dd7eeef..fec4fbaead 100644
--- a/third-party/curl/tests/libtest/lib507.c
+++ b/third-party/curl/tests/libtest/lib507.c
@@ -21,21 +21,15 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
-
-int test(char *URL)
+static CURLcode test_lib507(const char *URL)
 {
-  CURL *curls = NULL;
+  CURL *curl = NULL;
   CURLM *multi = NULL;
   int still_running;
-  int i = -1;
-  int res = 0;
+  CURLcode i = TEST_ERR_MAJOR_BAD;
+  CURLcode result = CURLE_OK;
   CURLMsg *msg;
 
   start_test_timing();
@@ -44,12 +38,12 @@ int test(char *URL)
 
   multi_init(multi);
 
-  easy_init(curls);
+  easy_init(curl);
 
-  easy_setopt(curls, CURLOPT_URL, URL);
-  easy_setopt(curls, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-  multi_add_handle(multi, curls);
+  multi_add_handle(multi, curl);
 
   multi_perform(multi, &still_running);
 
@@ -92,11 +86,11 @@ test_cleanup:
   /* undocumented cleanup sequence - type UA */
 
   curl_multi_cleanup(multi);
-  curl_easy_cleanup(curls);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  if(res)
-    i = res;
+  if(result)
+    i = result;
 
   return i; /* return the final return code */
 }
diff --git a/third-party/curl/tests/libtest/lib508.c b/third-party/curl/tests/libtest/lib508.c
index b793731b34..7ecf2665c4 100644
--- a/third-party/curl/tests/libtest/lib508.c
+++ b/third-party/curl/tests/libtest/lib508.c
@@ -21,79 +21,78 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static char data[]="this is what we post to the silly web server\n";
-
-struct WriteThis {
-  char *readptr;
+struct t508_WriteThis {
+  const char *readptr;
   size_t sizeleft;
 };
 
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t t508_read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
-  struct WriteThis *pooh = (struct WriteThis *)userp;
+  struct t508_WriteThis *pooh = (struct t508_WriteThis *)userp;
 
-  if(size*nmemb < 1)
+  if(size * nmemb < 1)
     return 0;
 
   if(pooh->sizeleft) {
-    *ptr = pooh->readptr[0]; /* copy one single byte */
-    pooh->readptr++;                 /* advance pointer */
-    pooh->sizeleft--;                /* less data left */
-    return 1;                        /* we return 1 byte at a time! */
+    *ptr = pooh->readptr[0];  /* copy one single byte */
+    pooh->readptr++;          /* advance pointer */
+    pooh->sizeleft--;         /* less data left */
+    return 1;                 /* we return 1 byte at a time! */
   }
 
-  return 0;                         /* no more data left to deliver */
+  return 0;                   /* no more data left to deliver */
 }
 
-int test(char *URL)
+static CURLcode test_lib508(const char *URL)
 {
+  static const char testdata[] =
+    "this is what we post to the silly web server\n";
+
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
-  struct WriteThis pooh;
+  struct t508_WriteThis pooh;
 
-  pooh.readptr = data;
-  pooh.sizeleft = strlen(data);
+  pooh.readptr = testdata;
+  pooh.sizeleft = sizeof(testdata) - 1;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* Now specify we want to POST data */
-  test_setopt(curl, CURLOPT_POST, 1L);
+  easy_setopt(curl, CURLOPT_POST, 1L);
 
   /* Set the expected POST size */
-  test_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)pooh.sizeleft);
+  easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)pooh.sizeleft);
 
   /* we want to use our own read function */
-  test_setopt(curl, CURLOPT_READFUNCTION, read_callback);
+  easy_setopt(curl, CURLOPT_READFUNCTION, t508_read_cb);
 
   /* pointer to pass to our read function */
-  test_setopt(curl, CURLOPT_READDATA, &pooh);
+  easy_setopt(curl, CURLOPT_READDATA, &pooh);
 
   /* get verbose debug output please */
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* include headers in the output */
-  test_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-  /* Perform the request, res will get the return code */
-  res = curl_easy_perform(curl);
+  /* Perform the request, result gets the return code */
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -101,5 +100,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib509.c b/third-party/curl/tests/libtest/lib509.c
index cb510ef214..38da36428f 100644
--- a/third-party/curl/tests/libtest/lib509.c
+++ b/third-party/curl/tests/libtest/lib509.c
@@ -21,9 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include <string.h>
+#include "first.h"
 
 /*
  * This test uses these funny custom memory callbacks for the only purpose
@@ -31,9 +29,8 @@
  * libcurl and that it works unconditionally no matter how libcurl is built,
  * nothing more.
  *
- * Do not include memdebug.h in this source file, and do not use directly
- * memory related functions in this file except those used inside custom
- * memory callbacks which should be calling 'the real thing'.
+ * Do not use directly memory related functions in this file except those used
+ * inside custom memory callbacks which should be calling 'the real thing'.
  */
 
 static int seen;
@@ -41,69 +38,75 @@ static int seen;
 static void *custom_calloc(size_t nmemb, size_t size)
 {
   seen++;
-  return (calloc)(nmemb, size);
+  /* !checksrc! disable BANNEDFUNC 1 */
+  return calloc(nmemb, size);
 }
 
 static void *custom_malloc(size_t size)
 {
   seen++;
-  return (malloc)(size);
+  /* !checksrc! disable BANNEDFUNC 1 */
+  return malloc(size);
 }
 
 static char *custom_strdup(const char *ptr)
 {
   seen++;
-  return (strdup)(ptr);
+  return CURLX_STRDUP_LOW(ptr);
 }
 
 static void *custom_realloc(void *ptr, size_t size)
 {
   seen++;
-  return (realloc)(ptr, size);
+  /* !checksrc! disable BANNEDFUNC 1 */
+  return realloc(ptr, size);
 }
 
 static void custom_free(void *ptr)
 {
   seen++;
-  (free)(ptr);
+  /* !checksrc! disable BANNEDFUNC 1 */
+  free(ptr);
 }
 
-
-int test(char *URL)
+static CURLcode test_lib509(const char *URL)
 {
-  unsigned char a[] = {0x2f, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
-                       0x91, 0xa2, 0xb3, 0xc4, 0xd5, 0xe6, 0xf7};
-  CURLcode res;
+  static const unsigned char a[] = {
+    0x2f, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
+    0x91, 0xa2, 0xb3, 0xc4, 0xd5, 0xe6, 0xf7
+  };
+  CURLcode result;
   CURL *curl;
   int asize;
   char *str = NULL;
   (void)URL;
 
-  res = curl_global_init_mem(CURL_GLOBAL_ALL,
-                             custom_malloc,
-                             custom_free,
-                             custom_realloc,
-                             custom_strdup,
-                             custom_calloc);
-  if(res != CURLE_OK) {
-    fprintf(stderr, "curl_global_init_mem() failed\n");
+  result = curl_global_init_mem(CURL_GLOBAL_ALL,
+                                custom_malloc,
+                                custom_free,
+                                custom_realloc,
+                                custom_strdup,
+                                custom_calloc);
+  if(result != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init_mem() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_USERAGENT, "test509"); /* uses strdup() */
+  easy_setopt(curl, CURLOPT_USERAGENT, "test509"); /* uses curlx_strdup() */
 
   asize = (int)sizeof(a);
-  str = curl_easy_escape(curl, (char *)a, asize); /* uses realloc() */
+  /* uses curlx_realloc() */
+  str = curl_easy_escape(curl, (const char *)a, asize);
 
   if(seen)
-    printf("Callbacks were invoked!\n");
+    curl_mprintf("Callbacks were invoked!\n");
 
 test_cleanup:
 
@@ -113,5 +116,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib510.c b/third-party/curl/tests/libtest/lib510.c
index 87a85a5578..a4acbdddb6 100644
--- a/third-party/curl/tests/libtest/lib510.c
+++ b/third-party/curl/tests/libtest/lib510.c
@@ -21,102 +21,99 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static const char *post[]={
-  "one",
-  "two",
-  "three",
-  "and a final longer crap: four",
-  NULL
-};
-
-
-struct WriteThis {
+struct t510_WriteThis {
   int counter;
 };
 
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t t510_read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
-  struct WriteThis *pooh = (struct WriteThis *)userp;
+  static const char * const testpost[] = {
+    "one",
+    "two",
+    "three",
+    "and a final longer crap: four",
+    NULL
+  };
+
+  struct t510_WriteThis *pooh = (struct t510_WriteThis *)userp;
   const char *data;
 
-  if(size*nmemb < 1)
+  if(size * nmemb < 1)
     return 0;
 
-  data = post[pooh->counter];
+  data = testpost[pooh->counter];
 
   if(data) {
     size_t len = strlen(data);
-    if(size*nmemb < len) {
-      fprintf(stderr, "read buffer is too small to run test\n");
+    if(size * nmemb < len) {
+      curl_mfprintf(stderr, "read buffer is too small to run test\n");
       return 0;
     }
-    memcpy(ptr, data, len);
+    memcpy(ptr, data, len); /* NOLINT(bugprone-not-null-terminated-result) */
     pooh->counter++; /* advance pointer */
     return len;
   }
   return 0;                         /* no more data left to deliver */
 }
 
-int test(char *URL)
+static CURLcode test_lib510(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
   struct curl_slist *slist = NULL;
-  struct WriteThis pooh;
+  struct t510_WriteThis pooh;
   pooh.counter = 0;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   slist = curl_slist_append(slist, "Transfer-Encoding: chunked");
   if(!slist) {
-    fprintf(stderr, "curl_slist_append() failed\n");
+    curl_mfprintf(stderr, "curl_slist_append() failed\n");
     curl_easy_cleanup(curl);
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* Now specify we want to POST data */
-  test_setopt(curl, CURLOPT_POST, 1L);
+  easy_setopt(curl, CURLOPT_POST, 1L);
 
   /* we want to use our own read function */
-  test_setopt(curl, CURLOPT_READFUNCTION, read_callback);
+  easy_setopt(curl, CURLOPT_READFUNCTION, t510_read_cb);
 
   /* pointer to pass to our read function */
-  test_setopt(curl, CURLOPT_READDATA, &pooh);
+  easy_setopt(curl, CURLOPT_READDATA, &pooh);
 
   /* get verbose debug output please */
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* include headers in the output */
-  test_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
   /* enforce chunked transfer by setting the header */
-  test_setopt(curl, CURLOPT_HTTPHEADER, slist);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, slist);
 
-#ifdef LIB565
-  test_setopt(curl, CURLOPT_HTTPAUTH, (long)CURLAUTH_DIGEST);
-  test_setopt(curl, CURLOPT_USERPWD, "foo:bar");
-#endif
+  if(testnum == 565) {
+    easy_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_DIGEST);
+    easy_setopt(curl, CURLOPT_USERPWD, "foo:bar");
+  }
 
-  /* Perform the request, res will get the return code */
-  res = curl_easy_perform(curl);
+  /* Perform the request, result gets the return code */
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -128,5 +125,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib511.c b/third-party/curl/tests/libtest/lib511.c
index c53224801c..7907f500ee 100644
--- a/third-party/curl/tests/libtest/lib511.c
+++ b/third-party/curl/tests/libtest/lib511.c
@@ -21,38 +21,36 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib511(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_FILETIME, 1L);
-  test_setopt(curl, CURLOPT_NOBODY, 1L);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_FILETIME, 1L);
+  easy_setopt(curl, CURLOPT_NOBODY, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib512.c b/third-party/curl/tests/libtest/lib512.c
index 706acb2e1a..b9121c34ac 100644
--- a/third-party/curl/tests/libtest/lib512.c
+++ b/third-party/curl/tests/libtest/lib512.c
@@ -21,20 +21,18 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "memdebug.h"
+#include "first.h"
 
 /* Test case code based on source in a bug report filed by James Bursa on
    28 Apr 2004 */
 
-int test(char *URL)
+static CURLcode test_lib512(const char *URL)
 {
-  CURLcode code;
+  CURLcode result;
   int rc = 99;
 
-  code = curl_global_init(CURL_GLOBAL_ALL);
-  if(code == CURLE_OK) {
+  result = curl_global_init(CURL_GLOBAL_ALL);
+  if(result == CURLE_OK) {
     CURL *curl = curl_easy_init();
     if(curl) {
       CURL *curl2;
@@ -45,11 +43,11 @@ int test(char *URL)
       curl2 = curl_easy_duphandle(curl);
       if(curl2) {
 
-        code = curl_easy_setopt(curl2, CURLOPT_URL, URL);
-        if(code == CURLE_OK) {
+        result = curl_easy_setopt(curl2, CURLOPT_URL, URL);
+        if(result == CURLE_OK) {
 
-          code = curl_easy_perform(curl2);
-          if(code == CURLE_OK)
+          result = curl_easy_perform(curl2);
+          if(result == CURLE_OK)
             rc = 0;
           else
             rc = 1;
@@ -72,5 +70,5 @@ int test(char *URL)
   else
     rc = 5;
 
-  return rc;
+  return (CURLcode)rc;
 }
diff --git a/third-party/curl/tests/libtest/lib513.c b/third-party/curl/tests/libtest/lib513.c
index b381098fb9..9ed3f1dd42 100644
--- a/third-party/curl/tests/libtest/lib513.c
+++ b/third-party/curl/tests/libtest/lib513.c
@@ -21,11 +21,9 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t t513_read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
   (void)ptr;
   (void)size;
@@ -34,46 +32,46 @@ static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
   return CURL_READFUNC_ABORT;
 }
 
-int test(char *URL)
+static CURLcode test_lib513(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* Now specify we want to POST data */
-  test_setopt(curl, CURLOPT_POST, 1L);
+  easy_setopt(curl, CURLOPT_POST, 1L);
 
   /* Set the expected POST size */
-  test_setopt(curl, CURLOPT_POSTFIELDSIZE, 1L);
+  easy_setopt(curl, CURLOPT_POSTFIELDSIZE, 1L);
 
   /* we want to use our own read function */
-  test_setopt(curl, CURLOPT_READFUNCTION, read_callback);
+  easy_setopt(curl, CURLOPT_READFUNCTION, t513_read_cb);
 
   /* pointer to pass to our read function */
-  test_setopt(curl, CURLOPT_READDATA, NULL);
+  easy_setopt(curl, CURLOPT_READDATA, NULL);
 
   /* get verbose debug output please */
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* include headers in the output */
-  test_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-  /* Perform the request, res will get the return code */
-  res = curl_easy_perform(curl);
+  /* Perform the request, result gets the return code */
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -81,5 +79,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib514.c b/third-party/curl/tests/libtest/lib514.c
index 0f31c8c4cc..1fe9adc8d5 100644
--- a/third-party/curl/tests/libtest/lib514.c
+++ b/third-party/curl/tests/libtest/lib514.c
@@ -21,29 +21,27 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib514(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* Based on a bug report by Niels van Tongeren on June 29, 2004:
 
@@ -54,22 +52,22 @@ int test(char *URL)
 
   */
 
-  test_setopt(curl, CURLOPT_POSTFIELDS, "moo");
-  test_setopt(curl, CURLOPT_POSTFIELDSIZE, 3L);
-  test_setopt(curl, CURLOPT_POST, 1L);
+  easy_setopt(curl, CURLOPT_POSTFIELDS, "moo");
+  easy_setopt(curl, CURLOPT_POSTFIELDSIZE, 3L);
+  easy_setopt(curl, CURLOPT_POST, 1L);
 
   /* this is where transfer 1 would take place, but skip that and change
      options right away instead */
 
-  test_setopt(curl, CURLOPT_NOBODY, 1L);
+  easy_setopt(curl, CURLOPT_NOBODY, 1L);
 
-  test_setopt(curl, CURLOPT_VERBOSE, 1L); /* show verbose for debug */
-  test_setopt(curl, CURLOPT_HEADER, 1L); /* include header */
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L); /* show verbose for debug */
+  easy_setopt(curl, CURLOPT_HEADER, 1L); /* include header */
 
   /* Now, we should be making a fine HEAD request */
 
-  /* Perform the request 2, res will get the return code */
-  res = curl_easy_perform(curl);
+  /* Perform the request 2, result gets the return code */
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -77,5 +75,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib515.c b/third-party/curl/tests/libtest/lib515.c
index 3c744fb953..825cbe56cf 100644
--- a/third-party/curl/tests/libtest/lib515.c
+++ b/third-party/curl/tests/libtest/lib515.c
@@ -21,36 +21,34 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib515(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_POSTFIELDS, NULL);
-  test_setopt(curl, CURLOPT_POSTFIELDSIZE, 0L);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L); /* show verbose for debug */
-  test_setopt(curl, CURLOPT_HEADER, 1L); /* include header */
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_POSTFIELDS, NULL);
+  easy_setopt(curl, CURLOPT_POSTFIELDSIZE, 0L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L); /* show verbose for debug */
+  easy_setopt(curl, CURLOPT_HEADER, 1L); /* include header */
 
   /* Now, we should be making a zero byte POST request */
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -58,5 +56,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib516.c b/third-party/curl/tests/libtest/lib516.c
index 59abb091aa..61090736b7 100644
--- a/third-party/curl/tests/libtest/lib516.c
+++ b/third-party/curl/tests/libtest/lib516.c
@@ -21,37 +21,33 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib516(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(curl, CURLOPT_URL, URL);
-  CURL_IGNORE_DEPRECATION(
-    test_setopt(curl, CURLOPT_HTTPPOST, NULL);
-  )
-  test_setopt(curl, CURLOPT_VERBOSE, 1L); /* show verbose for debug */
-  test_setopt(curl, CURLOPT_HEADER, 1L); /* include header */
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HTTPPOST, NULL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L); /* show verbose for debug */
+  easy_setopt(curl, CURLOPT_HEADER, 1L); /* include header */
 
   /* Now, we should be making a zero byte POST request */
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -59,5 +55,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib517.c b/third-party/curl/tests/libtest/lib517.c
index 7c65a659cf..609a44a06b 100644
--- a/third-party/curl/tests/libtest/lib517.c
+++ b/third-party/curl/tests/libtest/lib517.c
@@ -21,153 +21,236 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-struct dcheck {
-  const char *input;
-  time_t output;
-};
-
-static const struct dcheck dates[] = {
-  {"Sun, 06 Nov 1994 08:49:37 GMT", 784111777 },
-  {"Sunday, 06-Nov-94 08:49:37 GMT", 784111777 },
-  {"Sun Nov  6 08:49:37 1994", 784111777 },
-  {"Sun Nov  6 8:49:37 1994", 784111777 },
-  {"Sun Nov  6 8:9:37 1994", 784109377 },
-  {"Sun Nov  6 008:09:37 1994", -1 },
-  {"Nov      Sun      6 8:9:7 1994", 784109347 },
-  {"06 Nov 1994 08:49:37 GMT", 784111777 },
-  {"06-Nov-94 08:49:37 GMT", 784111777 },
-  {"Nov  6 08:49:37 1994", 784111777 },
-  {"06 Nov 1994 08:49:37", 784111777 },
-  {"06-Nov-94 08:49:37", 784111777 },
-  {"1994 Nov 6 08:49:37", 784111777 },
-  {"GMT 08:49:37 06-Nov-94 Sunday", 784111777 },
-  {"94 6 Nov 08:49:37", 784111777 },
-  {"1994 Nov 6", 784080000 },
-  {"06-Nov-94", 784080000 },
-  {"Sun Nov 6 94", 784080000 },
-  {"1994.Nov.6", 784080000 },
-  {"Sun/Nov/6/94/GMT", 784080000 },
-  {"Sun, 06 Nov 1994 08:49:37 CET", 784108177 },
-  {"06 Nov 1994 08:49:37 EST", 784129777 },
-  {"Sun, 06 Nov 1994 08:49:37 UT", 784111777 },
-  {"Sun, 12 Sep 2004 15:05:58 -0700", 1095026758 },
-  {"Sat, 11 Sep 2004 21:32:11 +0200", 1094931131 },
-  {"20040912 15:05:58 -0700", 1095026758 },
-  {"20040911 +0200", 1094853600 },
-  {"Thu, 01-Jan-1970 00:59:59 GMT", 3599 },
-  {"Thu, 01-Jan-1970 01:00:00 GMT", 3600 },
-  {"Sat, 15-Apr-17 21:01:22 GMT", 1492290082 },
-  {"Thu, 19-Apr-2007 16:00:00 GMT", 1176998400 },
-  {"Wed, 25 Apr 2007 21:02:13 GMT", 1177534933 },
-  {"Thu, 19/Apr\\2007 16:00:00 GMT", 1176998400 },
-  {"Fri, 1 Jan 2010 01:01:50 GMT", 1262307710 },
-  {"Wednesday, 1-Jan-2003 00:00:00 GMT", 1041379200 },
-  {", 1-Jan-2003 00:00:00 GMT", 1041379200 },
-  {"1-Jan-2003 00:00:00 GMT", 1041379200 },
-  {"1-Jan-2003 00:00:00 GMT", 1041379200 },
-  {"Wed,18-Apr-07 22:50:12 GMT", 1176936612 },
-  {"WillyWonka  , 18-Apr-07 22:50:12 GMT", -1 },
-  {"WillyWonka  , 18-Apr-07 22:50:12", -1 },
-  {"WillyWonka  ,  18-apr-07   22:50:12", -1 },
-  {"Mon, 18-Apr-1977 22:50:13 GMT", 230251813 },
-  {"Mon, 18-Apr-77 22:50:13 GMT", 230251813 },
-  {"Sat, 15-Apr-17\"21:01:22\"GMT", 1492290082 },
-  {"Partyday, 18- April-07 22:50:12", -1 },
-  {"Partyday, 18 - Apri-07 22:50:12", -1 },
-  {"Wednes, 1-Januar-2003 00:00:00 GMT", -1 },
-  {"Sat, 15-Apr-17 21:01:22", 1492290082 },
-  {"Sat, 15-Apr-17 21:01:22 GMT-2", 1492290082 },
-  {"Sat, 15-Apr-17 21:01:22 GMT BLAH", 1492290082 },
-  {"Sat, 15-Apr-17 21:01:22 GMT-0400", 1492290082 },
-  {"Sat, 15-Apr-17 21:01:22 GMT-0400 (EDT)", 1492290082 },
-  {"Sat, 15-Apr-17 21:01:22 DST", -1 },
-  {"Sat, 15-Apr-17 21:01:22 -0400", 1492304482 },
-  {"Sat, 15-Apr-17 21:01:22 (hello there)", -1 },
-  {"Sat, 15-Apr-17 21:01:22 11:22:33", -1 },
-  {"Sat, 15-Apr-17 ::00 21:01:22", -1 },
-  {"Sat, 15-Apr-17 boink:z 21:01:22", -1 },
-  {"Sat, 15-Apr-17 91:22:33 21:01:22", -1 },
-  {"Thu Apr 18 22:50:12 2007 GMT", 1176936612 },
-  {"22:50:12 Thu Apr 18 2007 GMT", 1176936612 },
-  {"Thu 22:50:12 Apr 18 2007 GMT", 1176936612 },
-  {"Thu Apr 22:50:12 18 2007 GMT", 1176936612 },
-  {"Thu Apr 18 22:50:12 2007 GMT", 1176936612 },
-  {"Thu Apr 18 2007 22:50:12 GMT", 1176936612 },
-  {"Thu Apr 18 2007 GMT 22:50:12", 1176936612 },
-  {"Sat, 15-Apr-17 21:01:22 GMT", 1492290082 },
-  {"15-Sat, Apr-17 21:01:22 GMT", 1492290082 },
-  {"15-Sat, Apr 21:01:22 GMT 17", 1492290082 },
-  {"15-Sat, Apr 21:01:22 GMT 2017", 1492290082 },
-  {"15 Apr 21:01:22 2017", 1492290082 },
-  {"15 17 Apr 21:01:22", 1492290082 },
-  {"Apr 15 17 21:01:22", 1492290082 },
-  {"Apr 15 21:01:22 17", 1492290082 },
-  {"2017 April 15 21:01:22", -1 },
-  {"15 April 2017 21:01:22", -1 },
-  {"98 April 17 21:01:22", -1 },
-  {"Thu, 012-Aug-2008 20:49:07 GMT", 1218574147 },
-  {"Thu, 999999999999-Aug-2007 20:49:07 GMT", -1 },
-  {"Thu, 12-Aug-2007 20:61:99999999999 GMT", -1 },
-  {"IAintNoDateFool", -1 },
-  {"Thu Apr 18 22:50 2007 GMT", 1176936600 },
-  {"20110623 12:34:56", 1308832496 },
-  {"20110632 12:34:56", -1 },
-  {"20110623 56:34:56", -1 },
-  {"20111323 12:34:56", -1 },
-  {"20110623 12:34:79", -1 },
-  {"Wed, 31 Dec 2008 23:59:60 GMT", 1230768000 },
-  {"Wed, 31 Dec 2008 23:59:61 GMT", -1 },
-  {"Wed, 31 Dec 2008 24:00:00 GMT", -1 },
-  {"Wed, 31 Dec 2008 23:60:59 GMT", -1 },
-  {"20110623 12:3", 1308830580 },
-  {"20110623 1:3", 1308790980 },
-  {"20110623 1:30", 1308792600 },
-  {"20110623 12:12:3", 1308831123 },
-  {"20110623 01:12:3", 1308791523 },
-  {"20110623 01:99:30", -1 },
-  {"Thu, 01-Jan-1970 00:00:00 GMT", 0 },
-  {"Thu, 31-Dec-1969 23:59:58 GMT", -2 },
-  {"Thu, 31-Dec-1969 23:59:59 GMT", 0 }, /* avoids -1 ! */
-#if SIZEOF_TIME_T > 4
-  {"Sun, 06 Nov 2044 08:49:37 GMT", (time_t) CURL_OFF_TU_C(2362034977) },
-  {"Sun, 06 Nov 3144 08:49:37 GMT", 37074617377 },
-#ifndef HAVE_TIME_T_UNSIGNED
-#if 0
-  /* causes warning on MSVC */
-  {"Sun, 06 Nov 1900 08:49:37 GMT", -2182259423 },
-#endif
-  {"Sun, 06 Nov 1800 08:49:37 GMT", -5337933023 },
-  {"Thu, 01-Jan-1583 00:00:00 GMT", -12212553600 },
-#endif
-  {"Thu, 01-Jan-1499 00:00:00 GMT", -1 },
-#else
-  {"Sun, 06 Nov 2044 08:49:37 GMT", -1 },
-#endif
-#ifndef HAVE_TIME_T_UNSIGNED
-  {"Sun, 06 Nov 1968 08:49:37 GMT", -36342623 },
-#endif
-  { NULL, 0 }
-};
-
-int test(char *URL)
+static CURLcode test_lib517(const char *URL)
 {
+  struct dcheck {
+    const char *input;
+    time_t output;
+  };
+
+  static const struct dcheck dates[] = {
+    { "Sun, 06 Nov 1994 08:49:37 GMT", 784111777 },
+    { "Sunday, 06-Nov-94 08:49:37 GMT", 784111777 },
+    { "Sun Nov  6 08:49:37 1994", 784111777 },
+    { "Sun Nov  6 8:49:37 1994", 784111777 },
+    { "Sun Nov  6 8:9:37 1994", 784109377 },
+    { "Sun Nov  6 008:09:37 1994", -1 },
+    { "Nov      Sun      6 8:9:7 1994", 784109347 },
+    { "06 Nov 1994 08:49:37 GMT", 784111777 },
+    { "06-Nov-94 08:49:37 GMT", 784111777 },
+    { "Nov  6 08:49:37 1994", 784111777 },
+    { "06 Nov 1994 08:49:37", 784111777 },
+    { "06-Nov-94 08:49:37", 784111777 },
+    { "1994 Nov 6 08:49:37", 784111777 },
+    { "GMT 08:49:37 06-Nov-94 Sunday", 784111777 },
+    { "94 6 Nov 08:49:37", 784111777 },
+    { "1994 Nov 6", 784080000 },
+    { "06-Nov-94", 784080000 },
+    { "Sun Nov 6 94", 784080000 },
+    { "1994.Nov.6", 784080000 },
+    { "Sun/Nov/6/94/GMT", 784080000 },
+    { "Sun, 06 Nov 1994 08:49:37 CET", 784108177 },
+    { "Sun, 06 Nov 1994 08:49:37 cet", -1 }, /* lowercase time zone */
+    { "Sun, 06 Nov 1994 08:49:37 utc", -1 }, /* lowercase time zone */
+    { "Sun, 06 Nov 1994 08:49:37 gmt", -1 }, /* lowercase time zone */
+    { "06 Nov 1994 08:49:37 EST", 784129777 },
+    { "Sun, 06 Nov 1994 08:49:37 UT", 784111777 },
+    { "Sun, 12 Sep 2004 15:05:58 -0700", 1095026758 },
+    { "Sat, 11 Sep 2004 21:32:11 +0200", 1094931131 },
+    { "20040912 15:05:58 -0700", 1095026758 },
+    { "20040911 +0200", 1094853600 },
+    { "Thu, 01-Jan-1970 00:59:59 GMT", 3599 },
+    { "Thu, 01-Jan-1970 01:00:00 GMT", 3600 },
+    { "Sat, 15-Apr-17 21:01:22 GMT", 1492290082 },
+    { "Thu, 19-Apr-2007 16:00:00 GMT", 1176998400 },
+    { "Wed, 25 Apr 2007 21:02:13 GMT", 1177534933 },
+    { "Thu, 19/Apr\\2007 16:00:00 GMT", 1176998400 },
+    { "Fri, 1 Jan 2010 01:01:50 GMT", 1262307710 },
+    { "Wednesday, 1-Jan-2003 00:00:00 GMT", 1041379200 },
+    { ", 1-Jan-2003 00:00:00 GMT", 1041379200 },
+    { "1-Jan-2003 00:00:00 GMT", 1041379200 },
+    { "1-Jan-2003 00:00:00 GMT", 1041379200 },
+    { "Wed,18-Apr-07 22:50:12 GMT", 1176936612 },
+    { "BillyWonka  , 18-Apr-07 22:50:12 GMT", -1 },
+    { "BillyWonka  , 18-Apr-07 22:50:12", -1 },
+    { "BillyWonka  ,  18-apr-07   22:50:12", -1 },
+    { "Mon, 18-Apr-1977 22:50:13 GMT", 230251813 },
+    { "Mon, 18-Apr-77 22:50:13 GMT", 230251813 },
+    { "Sat, 15-Apr-17\"21:01:22\"GMT", 1492290082 },
+    { "Partyday, 18- April-07 22:50:12", -1 },
+    { "Partyday, 18 - Apri-07 22:50:12", -1 },
+    { "Wednes, 1-Januar-2003 00:00:00 GMT", -1 },
+    { "Sat, 15-Apr-17 21:01:22", 1492290082 },
+    { "Sat, 15-Apr-17 21:01:22 GMT-2", 1492290082 },
+    { "Sat, 15-Apr-17 21:01:22 GMT BLAH", 1492290082 },
+    { "Sat, 15-Apr-17 21:01:22 GMT-0400", 1492290082 },
+    { "Sat, 15-Apr-17 21:01:22 GMT-0400 (EDT)", 1492290082 },
+    { "Sat, 15-Apr-17 21:01:22 DST", -1 },
+    { "Sat, 15-Apr-17 21:01:22 -0400", 1492304482 },
+    { "Sat, 15-Apr-17 21:01:22 (hello there)", -1 },
+    { "Sat, 15-Apr-17 21:01:22 11:22:33", -1 },
+    { "Sat, 15-Apr-17 ::00 21:01:22", -1 },
+    { "Sat, 15-Apr-17 boink:z 21:01:22", -1 },
+    { "Sat, 15-Apr-17 91:22:33 21:01:22", -1 },
+    { "Thu Apr 18 22:50:12 2007 GMT", 1176936612 },
+    { "22:50:12 Thu Apr 18 2007 GMT", 1176936612 },
+    { "Thu 22:50:12 Apr 18 2007 GMT", 1176936612 },
+    { "Thu Apr 22:50:12 18 2007 GMT", 1176936612 },
+    { "Thu Apr 18 22:50:12 2007 GMT", 1176936612 },
+    { "Thu Apr 18 2007 22:50:12 GMT", 1176936612 },
+    { "Thu Apr 18 2007 GMT 22:50:12", 1176936612 },
+
+    { "\"Thu Apr 18 22:50:12 2007 GMT\"", 1176936612 },
+    { "-\"22:50:12 Thu Apr 18 2007 GMT\"", 1176936612 },
+    { "*\"Thu 22:50:12 Apr 18 2007 GMT\"", 1176936612 },
+    { ";\"Thu Apr 22:50:12 18 2007 GMT\"", 1176936612 },
+    { ".\"Thu Apr 18 22:50:12 2007 GMT\"", 1176936612 },
+    { "\"Thu Apr 18 2007 22:50:12 GMT\"", 1176936612 },
+    { "\"Thu Apr 18 2007 GMT 22:50:12\"", 1176936612 },
+
+    { "Sat, 15-Apr-17 21:01:22 GMT", 1492290082 },
+    { "15-Sat, Apr-17 21:01:22 GMT", 1492290082 },
+    { "15-Sat, Apr 21:01:22 GMT 17", 1492290082 },
+    { "15-Sat, Apr 21:01:22 GMT 2017", 1492290082 },
+    { "15 Apr 21:01:22 2017", 1492290082 },
+    { "15 17 Apr 21:01:22", 1492290082 },
+    { "Apr 15 17 21:01:22", 1492290082 },
+    { "Apr 15 21:01:22 17", 1492290082 },
+    { "2017 April 15 21:01:22", -1 },
+    { "15 April 2017 21:01:22", -1 },
+    { "98 April 17 21:01:22", -1 },
+    { "Thu, 012-Aug-2008 20:49:07 GMT", 1218574147 },
+    { "Thu, 999999999999-Aug-2007 20:49:07 GMT", -1 },
+    { "Thu, 12-Aug-2007 20:61:99999999999 GMT", -1 },
+    { "IAintNoDateFool", -1 },
+    { "Thu Apr 18 22:50 2007 GMT", 1176936600 },
+    { "20110623 12:34:56", 1308832496 },
+    { "20110023 12:34:56", -1 },
+    { "20110632 12:34:56", -1 },
+    { "20110623 56:34:56", -1 },
+    { "20111323 12:34:56", -1 },
+    { "20110623 12:34:79", -1 },
+    { "Wed, 31 Dec 2008 23:59:60 GMT", 1230768000 },
+    { "Wed, 31 Dec 2008 23:59:61 GMT", -1 },
+    { "Wed, 31 Dec 2008 24:00:00 GMT", -1 },
+    { "Wed, 31 Dec 2008 23:60:59 GMT", -1 },
+    { "20110623 12:3", 1308830580 },
+    { "20110623 1:3", 1308790980 },
+    { "20110623 1:30", 1308792600 },
+    { "20110623 12:12:3", 1308831123 },
+    { "20110623 01:12:3", 1308791523 },
+    { "20110623 01:99:30", -1 },
+    { "Thu, 01-Jan-1970 00:00:00 GMT", 0 },
+    { "Thu, 31-Dec-1969 23:59:58 GMT", -2 },
+    { "Thu, 31-Dec-1969 23:59:59 GMT", 0 }, /* avoids -1 ! */
+#if SIZEOF_TIME_T > 4
+    { "Sun, 06 Nov 2044 08:49:37 GMT", (time_t)2362034977LL },
+    { "Sun, 06 Nov 3144 08:49:37 GMT", 37074617377 },
+#ifndef HAVE_TIME_T_UNSIGNED
+    { "Sun, 06 Nov 1900 08:49:37 GMT", (time_t)-2182259423LL },
+    { "Sun, 06 Nov 1800 08:49:37 GMT", -5337933023 },
+    { "Thu, 01-Jan-1583 00:00:00 GMT", -12212553600 },
+#endif /* HAVE_TIME_T_UNSIGNED */
+    { "Thu, 01-Jan-1499 00:00:00 GMT", -1 },
+#else
+    { "Sun, 06 Nov 2044 08:49:37 GMT", -1 },
+#endif /* SIZEOF_TIME_T > 4 */
+#ifndef HAVE_TIME_T_UNSIGNED
+    { "Sun, 06 Nov 1968 08:49:37 GMT", -36342623 },
+#endif /* !HAVE_TIME_T_UNSIGNED */
+
+#if SIZEOF_TIME_T > 4
+    { "2094 Nov 6 08:49:37", 3939871777 },
+#endif
+    { "01 Jan 2001 8:0:0", 978336000 },
+    { "01 Jan 2001 8:00:0", 978336000 },
+    /* Out-of-range day-of-month Cases */
+    { "29 Feb 2023 12:00:00 GMT", 1677672000 },
+    { "31 Apr 2024 12:00:00 GMT", 1714564800 },
+    { "30 Feb 2024 12:00:00 GMT", 1709294400 },
+    { "01-13-2024", -1 },
+    { "32 Jan 2024", -1 },
+    { "31 Jan 2024", 1706659200 },
+    { "32 Feb 2024", -1 },
+    { "32 Mar 2024", -1 },
+    { "32 Apr 2024", -1 },
+    { "32 May 2024", -1 },
+    { "32 Jun 2024", -1 },
+    { "32 Jul 2024", -1 },
+    { "32 Aug 2024", -1 },
+    { "32 Sep 2024", -1 },
+    { "32 Oct 2024", -1 },
+    { "32 Nov 2024", -1 },
+    { "32 Dec 2024", -1 },
+    /* Timezone Offsets */
+    { "Sun, 06 Nov 1994 08:49:37 +0530", 784091977 },
+    { "Sun, 06 Nov 1994 08:49:37 +0545", 784091077 },
+    { "06 Nov 1994 08:49:37 Z", 784111777 },
+    { "06 Nov 1994 08:49:37 A", 784108177 },
+    { "06 Nov 1994 08:49:37 B", 784104577 },
+    { "06 Nov 1994 08:49:37 C", 784100977 },
+    { "06 Nov 1994 08:49:37 D", 784097377 },
+    { "06 Nov 1994 08:49:37 E", 784093777 },
+    { "06 Nov 1994 08:49:37 F", 784090177 },
+    { "06 Nov 1994 08:49:37 G", 784086577 },
+    { "06 Nov 1994 08:49:37 H", 784082977 },
+    { "06 Nov 1994 08:49:37 I", 784079377 },
+    { "06 Nov 1994 08:49:37 J", -1 }, /* not a valid time zone */
+    { "06 Nov 1994 08:49:37 K", 784075777 },
+    { "06 Nov 1994 08:49:37 L", 784072177 },
+    { "06 Nov 1994 08:49:37 M", 784068577 },
+    { "06 Nov 1994 08:49:37 N", 784115377 },
+    { "06 Nov 1994 08:49:37 O", 784118977 },
+    { "06 Nov 1994 08:49:37 P", 784122577 },
+    { "06 Nov 1994 08:49:37 Q", 784126177 },
+    { "06 Nov 1994 08:49:37 R", 784129777 },
+    { "06 Nov 1994 08:49:37 S", 784133377 },
+    { "06 Nov 1994 08:49:37 T", 784136977 },
+    { "06 Nov 1994 08:49:37 U", 784140577 },
+    { "06 Nov 1994 08:49:37 V", 784144177 },
+    { "06 Nov 1994 08:49:37 W", 784147777 },
+    { "06 Nov 1994 08:49:37 X", 784151377 },
+    { "06 Nov 1994 08:49:37 Y", 784154977 },
+    { "GMT+05:30", -1 },
+    { "GMT-08:00", -1 },
+    /* ISO 8601 & Variations - not supported */
+    { "1994-11-06T08:49:37Z", -1 },
+    { "1994-11-06 08:49:37.123 GMT", -1 },
+    { "19941106T084937Z", -1 },
+    /* Y2K38 & Historical Boundaries */
+    { "19 Jan 2038 03:14:07 GMT", 2147483647 },
+#if SIZEOF_TIME_T > 4
+    { "19 Jan 2038 03:14:08 GMT", 2147483648 },
+    { "01 Jan 69 00:00:00 GMT", 3124224000 },
+#endif
+    { "01 Jan 1500 00:00:00 GMT", -1 },
+    /* Formatting & Malformed Junk */
+    { "Sun, 06-Nov/1994 08:49:37", 784111777 },
+    { "Sun,    06 Nov   1994   08:49:37 GMT", 784111777 },
+    { "  Sun, 06 Nov 1994 08:49:37 GMT  ", 784111777 },
+    { "Date: Sun, 06 Nov 1994 08:49:37 GMT", -1 },
+    /* wrong day name is ignored */
+    { "Monday, 06 Nov 1994 08:49:37 GMT", 784111777 },
+    { NULL, 0 }
+  };
+
   int i;
   int error = 0;
 
-  (void)URL; /* not used */
+  (void)URL;
 
   for(i = 0; dates[i].input; i++) {
     time_t out = curl_getdate(dates[i].input, NULL);
     if(out != dates[i].output) {
-      printf("WRONGLY %s => %ld (instead of %ld)\n",
-             dates[i].input, out, dates[i].output);
+      curl_mprintf("WRONGLY %s => %" CURL_FORMAT_CURL_OFF_T
+                   " (instead of %" CURL_FORMAT_CURL_OFF_T ")\n",
+                   dates[i].input,
+                   (curl_off_t)out, (curl_off_t)dates[i].output);
       error++;
     }
   }
 
-  return error;
+  return error == 0 ? CURLE_OK : TEST_ERR_FAILURE;
 }
diff --git a/third-party/curl/tests/libtest/lib518.c b/third-party/curl/tests/libtest/lib518.c
index 87b6f2d88b..bef952bac7 100644
--- a/third-party/curl/tests/libtest/lib518.c
+++ b/third-party/curl/tests/libtest/lib518.c
@@ -21,60 +21,47 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#ifdef HAVE_SYS_RESOURCE_H
-#include <sys/resource.h>
-#endif
-#ifdef HAVE_FCNTL_H
-#include <fcntl.h>
-#endif
-#include <limits.h>
+#if defined(HAVE_GETRLIMIT) && defined(HAVE_SETRLIMIT)
 
-#include "warnless.h"
-#include "memdebug.h"
+#define T518_SAFETY_MARGIN 16
 
-#ifndef FD_SETSIZE
-#error "this test requires FD_SETSIZE"
-#endif
+#define NUM_OPEN   (FD_SETSIZE + 10)
+#define NUM_NEEDED (NUM_OPEN + T518_SAFETY_MARGIN)
 
-#define SAFETY_MARGIN (16)
-#define NUM_OPEN      (FD_SETSIZE + 10)
-#define NUM_NEEDED    (NUM_OPEN + SAFETY_MARGIN)
-
-#if defined(WIN32) || defined(_WIN32) || defined(MSDOS)
+#if defined(_WIN32) || defined(MSDOS)
 #define DEV_NULL "NUL"
 #else
 #define DEV_NULL "/dev/null"
 #endif
 
-#if defined(HAVE_GETRLIMIT) && defined(HAVE_SETRLIMIT)
+static int *t518_testfd = NULL;
+static struct rlimit t518_num_open;
+static char t518_msgbuff[256];
 
-static int *fd = NULL;
-static struct rlimit num_open;
-static char msgbuff[256];
-
-static void store_errmsg(const char *msg, int err)
+static void t518_store_errmsg(const char *msg, int err)
 {
   if(!err)
-    msnprintf(msgbuff, sizeof(msgbuff), "%s", msg);
-  else
-    msnprintf(msgbuff, sizeof(msgbuff), "%s, errno %d, %s", msg,
-              err, strerror(err));
+    curl_msnprintf(t518_msgbuff, sizeof(t518_msgbuff), "%s", msg);
+  else {
+    char errbuf[STRERROR_LEN];
+    curl_msnprintf(t518_msgbuff, sizeof(t518_msgbuff), "%s, errno %d, %s", msg,
+                   err, curlx_strerror(err, errbuf, sizeof(errbuf)));
+  }
 }
 
-static void close_file_descriptors(void)
+static void t518_close_file_descriptors(void)
 {
-  for(num_open.rlim_cur = 0;
-      num_open.rlim_cur < num_open.rlim_max;
-      num_open.rlim_cur++)
-    if(fd[num_open.rlim_cur] > 0)
-      close(fd[num_open.rlim_cur]);
-  free(fd);
-  fd = NULL;
+  for(t518_num_open.rlim_cur = 0;
+      t518_num_open.rlim_cur < t518_num_open.rlim_max;
+      t518_num_open.rlim_cur++)
+    if(t518_testfd[t518_num_open.rlim_cur] > 0)
+      curlx_close(t518_testfd[t518_num_open.rlim_cur]);
+  curlx_safefree(t518_testfd);
 }
 
-static int fopen_works(void)
+static int t518_fopen_works(void)
 {
   FILE *fpa[3];
   int i;
@@ -84,72 +71,51 @@ static int fopen_works(void)
     fpa[i] = NULL;
   }
   for(i = 0; i < 3; i++) {
-    fpa[i] = fopen(DEV_NULL, FOPEN_READTEXT);
+    fpa[i] = curlx_fopen(DEV_NULL, FOPEN_READTEXT);
     if(!fpa[i]) {
-      store_errmsg("fopen failed", errno);
-      fprintf(stderr, "%s\n", msgbuff);
+      t518_store_errmsg("fopen failed", errno);
+      curl_mfprintf(stderr, "%s\n", t518_msgbuff);
       ret = 0;
       break;
     }
   }
   for(i = 0; i < 3; i++) {
     if(fpa[i])
-      fclose(fpa[i]);
+      curlx_fclose(fpa[i]);
   }
   return ret;
 }
 
-static int rlimit(int keep_open)
+static int t518_test_rlimit(int keep_open)
 {
-  int nitems, i;
+  rlim_t nitems, i;
   int *memchunk = NULL;
-  char *fmt;
   struct rlimit rl;
   char strbuff[256];
   char strbuff1[81];
   char strbuff2[81];
-  char fmt_u[] = "%u";
-  char fmt_lu[] = "%lu";
-#ifdef HAVE_LONGLONG
-  char fmt_llu[] = "%llu";
-
-  if(sizeof(rl.rlim_max) > sizeof(long))
-    fmt = fmt_llu;
-  else
-#endif
-    fmt = (sizeof(rl.rlim_max) < sizeof(long))?fmt_u:fmt_lu;
 
   /* get initial open file limits */
 
-  if(getrlimit(RLIMIT_NOFILE, &rl) != 0) {
-    store_errmsg("getrlimit() failed", errno);
-    fprintf(stderr, "%s\n", msgbuff);
+  if(getrlimit(RLIMIT_NOFILE, &rl)) {
+    t518_store_errmsg("getrlimit() failed", errno);
+    curl_mfprintf(stderr, "%s\n", t518_msgbuff);
     return -1;
   }
 
   /* show initial open file limits */
 
-#ifdef RLIM_INFINITY
-  if(rl.rlim_cur == RLIM_INFINITY)
-    strcpy(strbuff, "INFINITY");
-  else
-#endif
-    msnprintf(strbuff, sizeof(strbuff), fmt, rl.rlim_cur);
-  fprintf(stderr, "initial soft limit: %s\n", strbuff);
+  tutil_rlim2str(strbuff, sizeof(strbuff), rl.rlim_cur);
+  curl_mfprintf(stderr, "initial soft limit: %s\n", strbuff);
 
-#ifdef RLIM_INFINITY
-  if(rl.rlim_max == RLIM_INFINITY)
-    strcpy(strbuff, "INFINITY");
-  else
-#endif
-    msnprintf(strbuff, sizeof(strbuff), fmt, rl.rlim_max);
-  fprintf(stderr, "initial hard limit: %s\n", strbuff);
+  tutil_rlim2str(strbuff, sizeof(strbuff), rl.rlim_max);
+  curl_mfprintf(stderr, "initial hard limit: %s\n", strbuff);
 
   /* show our constants */
 
-  fprintf(stderr, "test518 FD_SETSIZE: %d\n", FD_SETSIZE);
-  fprintf(stderr, "test518 NUM_OPEN  : %d\n", NUM_OPEN);
-  fprintf(stderr, "test518 NUM_NEEDED: %d\n", NUM_NEEDED);
+  curl_mfprintf(stderr, "test518 FD_SETSIZE: %d\n", FD_SETSIZE);
+  curl_mfprintf(stderr, "test518 NUM_OPEN  : %d\n", NUM_OPEN);
+  curl_mfprintf(stderr, "test518 NUM_NEEDED: %d\n", NUM_NEEDED);
 
   /*
    * if soft limit and hard limit are different we ask the
@@ -157,7 +123,7 @@ static int rlimit(int keep_open)
    * limit. Due to some other system limit the soft limit
    * might not be raised up to the hard limit. So from this
    * point the resulting soft limit is our limit. Trying to
-   * open more than soft limit file descriptors will fail.
+   * open more than soft limit file descriptors does fail.
    */
 
   if(rl.rlim_cur != rl.rlim_max) {
@@ -165,51 +131,41 @@ static int rlimit(int keep_open)
 #ifdef OPEN_MAX
     if((rl.rlim_cur > 0) &&
        (rl.rlim_cur < OPEN_MAX)) {
-      fprintf(stderr, "raising soft limit up to OPEN_MAX\n");
+      curl_mfprintf(stderr, "raising soft limit up to OPEN_MAX\n");
       rl.rlim_cur = OPEN_MAX;
-      if(setrlimit(RLIMIT_NOFILE, &rl) != 0) {
-        /* on failure don't abort just issue a warning */
-        store_errmsg("setrlimit() failed", errno);
-        fprintf(stderr, "%s\n", msgbuff);
-        msgbuff[0] = '\0';
+      if(setrlimit(RLIMIT_NOFILE, &rl)) {
+        /* on failure do not abort, only issue a warning */
+        t518_store_errmsg("setrlimit() failed", errno);
+        curl_mfprintf(stderr, "%s\n", t518_msgbuff);
+        t518_msgbuff[0] = '\0';
       }
     }
 #endif
 
-    fprintf(stderr, "raising soft limit up to hard limit\n");
+    curl_mfprintf(stderr, "raising soft limit up to hard limit\n");
     rl.rlim_cur = rl.rlim_max;
-    if(setrlimit(RLIMIT_NOFILE, &rl) != 0) {
-      /* on failure don't abort just issue a warning */
-      store_errmsg("setrlimit() failed", errno);
-      fprintf(stderr, "%s\n", msgbuff);
-      msgbuff[0] = '\0';
+    if(setrlimit(RLIMIT_NOFILE, &rl)) {
+      /* on failure do not abort, only issue a warning */
+      t518_store_errmsg("setrlimit() failed", errno);
+      curl_mfprintf(stderr, "%s\n", t518_msgbuff);
+      t518_msgbuff[0] = '\0';
     }
 
     /* get current open file limits */
 
-    if(getrlimit(RLIMIT_NOFILE, &rl) != 0) {
-      store_errmsg("getrlimit() failed", errno);
-      fprintf(stderr, "%s\n", msgbuff);
+    if(getrlimit(RLIMIT_NOFILE, &rl)) {
+      t518_store_errmsg("getrlimit() failed", errno);
+      curl_mfprintf(stderr, "%s\n", t518_msgbuff);
       return -3;
     }
 
     /* show current open file limits */
 
-#ifdef RLIM_INFINITY
-    if(rl.rlim_cur == RLIM_INFINITY)
-      strcpy(strbuff, "INFINITY");
-    else
-#endif
-      msnprintf(strbuff, sizeof(strbuff), fmt, rl.rlim_cur);
-    fprintf(stderr, "current soft limit: %s\n", strbuff);
+    tutil_rlim2str(strbuff, sizeof(strbuff), rl.rlim_cur);
+    curl_mfprintf(stderr, "current soft limit: %s\n", strbuff);
 
-#ifdef RLIM_INFINITY
-    if(rl.rlim_max == RLIM_INFINITY)
-      strcpy(strbuff, "INFINITY");
-    else
-#endif
-      msnprintf(strbuff, sizeof(strbuff), fmt, rl.rlim_max);
-    fprintf(stderr, "current hard limit: %s\n", strbuff);
+    tutil_rlim2str(strbuff, sizeof(strbuff), rl.rlim_max);
+    curl_mfprintf(stderr, "current hard limit: %s\n", strbuff);
 
   } /* (rl.rlim_cur != rl.rlim_max) */
 
@@ -224,23 +180,23 @@ static int rlimit(int keep_open)
   /*
    * verify that soft limit is higher than NUM_NEEDED,
    * which is the number of file descriptors we would
-   * try to open plus SAFETY_MARGIN to not exhaust the
+   * try to open plus T518_SAFETY_MARGIN to not exhaust the
    * file descriptor pool
    */
 
-  num_open.rlim_cur = NUM_NEEDED;
+  t518_num_open.rlim_cur = NUM_NEEDED;
 
   if((rl.rlim_cur > 0) &&
 #ifdef RLIM_INFINITY
      (rl.rlim_cur != RLIM_INFINITY) &&
 #endif
-     (rl.rlim_cur <= num_open.rlim_cur)) {
-    msnprintf(strbuff2, sizeof(strbuff2), fmt, rl.rlim_cur);
-    msnprintf(strbuff1, sizeof(strbuff1), fmt, num_open.rlim_cur);
-    msnprintf(strbuff, sizeof(strbuff), "fds needed %s > system limit %s",
-              strbuff1, strbuff2);
-    store_errmsg(strbuff, 0);
-    fprintf(stderr, "%s\n", msgbuff);
+     (rl.rlim_cur <= t518_num_open.rlim_cur)) {
+    tutil_rlim2str(strbuff2, sizeof(strbuff2), rl.rlim_cur);
+    tutil_rlim2str(strbuff1, sizeof(strbuff1), t518_num_open.rlim_cur);
+    curl_msnprintf(strbuff, sizeof(strbuff), "fds needed %s > system limit %s",
+                   strbuff1, strbuff2);
+    t518_store_errmsg(strbuff, 0);
+    curl_mfprintf(stderr, "%s\n", t518_msgbuff);
     return -4;
   }
 
@@ -249,8 +205,8 @@ static int rlimit(int keep_open)
    * avoid a low memory condition once the file descriptors are
    * open. System conditions that could make the test fail should
    * be addressed in the precheck phase. This chunk of memory shall
-   * be always free()ed before exiting the rlimit() function so
-   * that it becomes available to the test.
+   * be always curlx_free()ed before exiting the t518_test_rlimit()
+   * function so that it becomes available to the test.
    */
 
   for(nitems = i = 1; nitems <= i; i *= 2)
@@ -258,169 +214,166 @@ static int rlimit(int keep_open)
   if(nitems > 0x7fff)
     nitems = 0x40000;
   do {
-    num_open.rlim_max = sizeof(*memchunk) * (size_t)nitems;
-    msnprintf(strbuff, sizeof(strbuff), fmt, num_open.rlim_max);
-    fprintf(stderr, "allocating memchunk %s byte array\n", strbuff);
-    memchunk = malloc(sizeof(*memchunk) * (size_t)nitems);
+    t518_num_open.rlim_max = sizeof(*memchunk) * nitems;
+    tutil_rlim2str(strbuff, sizeof(strbuff), t518_num_open.rlim_max);
+    curl_mfprintf(stderr, "allocating memchunk %s byte array\n", strbuff);
+    memchunk = curlx_malloc(sizeof(*memchunk) * (size_t)nitems);
     if(!memchunk) {
-      fprintf(stderr, "memchunk, malloc() failed\n");
+      curl_mfprintf(stderr, "memchunk, malloc() failed\n");
       nitems /= 2;
     }
   } while(nitems && !memchunk);
   if(!memchunk) {
-    store_errmsg("memchunk, malloc() failed", errno);
-    fprintf(stderr, "%s\n", msgbuff);
+    t518_store_errmsg("memchunk, malloc() failed", errno);
+    curl_mfprintf(stderr, "%s\n", t518_msgbuff);
     return -5;
   }
 
   /* initialize it to fight lazy allocation */
 
-  fprintf(stderr, "initializing memchunk array\n");
+  curl_mfprintf(stderr, "initializing memchunk array\n");
 
   for(i = 0; i < nitems; i++)
     memchunk[i] = -1;
 
-  /* set the number of file descriptors we will try to open */
+  /* set the number of file descriptors we try to open */
 
-  num_open.rlim_max = NUM_OPEN;
+  t518_num_open.rlim_max = NUM_OPEN;
 
-  /* verify that we won't overflow size_t in malloc() */
+  /* verify that we do not overflow size_t in curlx_malloc() */
 
-  if((size_t)(num_open.rlim_max) > ((size_t)-1) / sizeof(*fd)) {
-    msnprintf(strbuff1, sizeof(strbuff1), fmt, num_open.rlim_max);
-    msnprintf(strbuff, sizeof(strbuff), "unable to allocate an array for %s "
-              "file descriptors, would overflow size_t", strbuff1);
-    store_errmsg(strbuff, 0);
-    fprintf(stderr, "%s\n", msgbuff);
-    free(memchunk);
+  if((size_t)(t518_num_open.rlim_max) > ((size_t)-1) / sizeof(*t518_testfd)) {
+    tutil_rlim2str(strbuff1, sizeof(strbuff1), t518_num_open.rlim_max);
+    curl_msnprintf(strbuff, sizeof(strbuff),
+                   "unable to allocate an array for %s "
+                   "file descriptors, would overflow size_t", strbuff1);
+    t518_store_errmsg(strbuff, 0);
+    curl_mfprintf(stderr, "%s\n", t518_msgbuff);
+    curlx_free(memchunk);
     return -6;
   }
 
   /* allocate array for file descriptors */
 
-  msnprintf(strbuff, sizeof(strbuff), fmt, num_open.rlim_max);
-  fprintf(stderr, "allocating array for %s file descriptors\n", strbuff);
+  tutil_rlim2str(strbuff, sizeof(strbuff), t518_num_open.rlim_max);
+  curl_mfprintf(stderr, "allocating array for %s file descriptors\n", strbuff);
 
-  fd = malloc(sizeof(*fd) * (size_t)(num_open.rlim_max));
-  if(!fd) {
-    store_errmsg("fd, malloc() failed", errno);
-    fprintf(stderr, "%s\n", msgbuff);
-    free(memchunk);
+  t518_testfd = curlx_malloc(sizeof(*t518_testfd) *
+                             (size_t)(t518_num_open.rlim_max));
+  if(!t518_testfd) {
+    t518_store_errmsg("testfd, malloc() failed", errno);
+    curl_mfprintf(stderr, "%s\n", t518_msgbuff);
+    curlx_free(memchunk);
     return -7;
   }
 
   /* initialize it to fight lazy allocation */
 
-  fprintf(stderr, "initializing fd array\n");
+  curl_mfprintf(stderr, "initializing testfd array\n");
 
-  for(num_open.rlim_cur = 0;
-      num_open.rlim_cur < num_open.rlim_max;
-      num_open.rlim_cur++)
-    fd[num_open.rlim_cur] = -1;
+  for(t518_num_open.rlim_cur = 0;
+      t518_num_open.rlim_cur < t518_num_open.rlim_max;
+      t518_num_open.rlim_cur++)
+    t518_testfd[t518_num_open.rlim_cur] = -1;
 
-  msnprintf(strbuff, sizeof(strbuff), fmt, num_open.rlim_max);
-  fprintf(stderr, "trying to open %s file descriptors\n", strbuff);
+  tutil_rlim2str(strbuff, sizeof(strbuff), t518_num_open.rlim_max);
+  curl_mfprintf(stderr, "trying to open %s file descriptors\n", strbuff);
 
   /* open a dummy descriptor */
 
-  fd[0] = open(DEV_NULL, O_RDONLY);
-  if(fd[0] < 0) {
-    msnprintf(strbuff, sizeof(strbuff), "opening of %s failed", DEV_NULL);
-    store_errmsg(strbuff, errno);
-    fprintf(stderr, "%s\n", msgbuff);
-    free(fd);
-    fd = NULL;
-    free(memchunk);
+  t518_testfd[0] = curlx_open(DEV_NULL, O_RDONLY);
+  if(t518_testfd[0] < 0) {
+    curl_msnprintf(strbuff, sizeof(strbuff), "opening of %s failed", DEV_NULL);
+    t518_store_errmsg(strbuff, errno);
+    curl_mfprintf(stderr, "%s\n", t518_msgbuff);
+    curlx_safefree(t518_testfd);
+    curlx_free(memchunk);
     return -8;
   }
 
   /* create a bunch of file descriptors */
 
-  for(num_open.rlim_cur = 1;
-      num_open.rlim_cur < num_open.rlim_max;
-      num_open.rlim_cur++) {
+  for(t518_num_open.rlim_cur = 1;
+      t518_num_open.rlim_cur < t518_num_open.rlim_max;
+      t518_num_open.rlim_cur++) {
 
-    fd[num_open.rlim_cur] = dup(fd[0]);
+    t518_testfd[t518_num_open.rlim_cur] = dup(t518_testfd[0]);
 
-    if(fd[num_open.rlim_cur] < 0) {
+    if(t518_testfd[t518_num_open.rlim_cur] < 0) {
 
-      fd[num_open.rlim_cur] = -1;
+      t518_testfd[t518_num_open.rlim_cur] = -1;
 
-      msnprintf(strbuff1, sizeof(strbuff1), fmt, num_open.rlim_cur);
-      msnprintf(strbuff, sizeof(strbuff), "dup() attempt %s failed", strbuff1);
-      fprintf(stderr, "%s\n", strbuff);
+      tutil_rlim2str(strbuff1, sizeof(strbuff1), t518_num_open.rlim_cur);
+      curl_msnprintf(strbuff, sizeof(strbuff), "dup() attempt %s failed",
+                     strbuff1);
+      curl_mfprintf(stderr, "%s\n", strbuff);
 
-      msnprintf(strbuff1, sizeof(strbuff), fmt, num_open.rlim_cur);
-      msnprintf(strbuff, sizeof(strbuff), "fds system limit seems close to %s",
-               strbuff1);
-      fprintf(stderr, "%s\n", strbuff);
+      tutil_rlim2str(strbuff1, sizeof(strbuff1), t518_num_open.rlim_cur);
+      curl_msnprintf(strbuff, sizeof(strbuff),
+                     "fds system limit seems close to %s", strbuff1);
+      curl_mfprintf(stderr, "%s\n", strbuff);
 
-      num_open.rlim_max = NUM_NEEDED;
+      t518_num_open.rlim_max = NUM_NEEDED;
 
-      msnprintf(strbuff2, sizeof(strbuff2), fmt, num_open.rlim_max);
-      msnprintf(strbuff1, sizeof(strbuff1), fmt, num_open.rlim_cur);
-      msnprintf(strbuff, sizeof(strbuff), "fds needed %s > system limit %s",
-               strbuff2, strbuff1);
-      store_errmsg(strbuff, 0);
-      fprintf(stderr, "%s\n", msgbuff);
+      tutil_rlim2str(strbuff2, sizeof(strbuff2), t518_num_open.rlim_max);
+      tutil_rlim2str(strbuff1, sizeof(strbuff1), t518_num_open.rlim_cur);
+      curl_msnprintf(strbuff, sizeof(strbuff),
+                     "fds needed %s > system limit %s", strbuff2, strbuff1);
+      t518_store_errmsg(strbuff, 0);
+      curl_mfprintf(stderr, "%s\n", t518_msgbuff);
 
-      for(num_open.rlim_cur = 0;
-          fd[num_open.rlim_cur] >= 0;
-          num_open.rlim_cur++)
-        close(fd[num_open.rlim_cur]);
-      free(fd);
-      fd = NULL;
-      free(memchunk);
+      for(t518_num_open.rlim_cur = 0;
+          t518_testfd[t518_num_open.rlim_cur] >= 0;
+          t518_num_open.rlim_cur++)
+        curlx_close(t518_testfd[t518_num_open.rlim_cur]);
+      curlx_safefree(t518_testfd);
+      curlx_free(memchunk);
       return -9;
-
     }
-
   }
 
-  msnprintf(strbuff, sizeof(strbuff), fmt, num_open.rlim_max);
-  fprintf(stderr, "%s file descriptors open\n", strbuff);
-
-#if !defined(HAVE_POLL_FINE) && !defined(USE_WINSOCK)
+  tutil_rlim2str(strbuff, sizeof(strbuff), t518_num_open.rlim_max);
+  curl_mfprintf(stderr, "%s file descriptors open\n", strbuff);
 
+#if !defined(HAVE_POLL) && !defined(USE_WINSOCK)
   /*
    * when using select() instead of poll() we cannot test
    * libcurl functionality with a socket number equal or
    * greater than FD_SETSIZE. In any case, macro VERIFY_SOCK
    * in lib/select.c enforces this check and protects libcurl
    * from a possible crash. The effect of this protection
-   * is that test 518 will always fail, since the actual
+   * is that test 518 always fails, since the actual
    * call to select() never takes place. We skip test 518
    * with an indication that select limit would be exceeded.
    */
 
-  num_open.rlim_cur = FD_SETSIZE - SAFETY_MARGIN;
-  if(num_open.rlim_max > num_open.rlim_cur) {
-    msnprintf(strbuff, sizeof(strbuff), "select limit is FD_SETSIZE %d",
-             FD_SETSIZE);
-    store_errmsg(strbuff, 0);
-    fprintf(stderr, "%s\n", msgbuff);
-    close_file_descriptors();
-    free(memchunk);
+  t518_num_open.rlim_cur = FD_SETSIZE - T518_SAFETY_MARGIN;
+  if(t518_num_open.rlim_max > t518_num_open.rlim_cur) {
+    curl_msnprintf(strbuff, sizeof(strbuff), "select limit is FD_SETSIZE %d",
+                   FD_SETSIZE);
+    t518_store_errmsg(strbuff, 0);
+    curl_mfprintf(stderr, "%s\n", t518_msgbuff);
+    t518_close_file_descriptors();
+    curlx_free(memchunk);
     return -10;
   }
 
-  num_open.rlim_cur = FD_SETSIZE - SAFETY_MARGIN;
+  t518_num_open.rlim_cur = FD_SETSIZE - T518_SAFETY_MARGIN;
   for(rl.rlim_cur = 0;
-      rl.rlim_cur < num_open.rlim_max;
+      rl.rlim_cur < t518_num_open.rlim_max;
       rl.rlim_cur++) {
-    if((fd[rl.rlim_cur] > 0) &&
-       ((unsigned int)fd[rl.rlim_cur] > num_open.rlim_cur)) {
-      msnprintf(strbuff, sizeof(strbuff), "select limit is FD_SETSIZE %d",
-               FD_SETSIZE);
-      store_errmsg(strbuff, 0);
-      fprintf(stderr, "%s\n", msgbuff);
-      close_file_descriptors();
-      free(memchunk);
+    if((t518_testfd[rl.rlim_cur] > 0) &&
+       ((unsigned int)t518_testfd[rl.rlim_cur] > t518_num_open.rlim_cur)) {
+      curl_msnprintf(strbuff, sizeof(strbuff), "select limit is FD_SETSIZE %d",
+                     FD_SETSIZE);
+      t518_store_errmsg(strbuff, 0);
+      curl_mfprintf(stderr, "%s\n", t518_msgbuff);
+      t518_close_file_descriptors();
+      curlx_free(memchunk);
       return -11;
     }
   }
-
-#endif /* using a FD_SETSIZE bound select() */
+#endif /* !HAVE_POLL && !USE_WINSOCK */
 
   /*
    * Old or 'backwards compatible' implementations of stdio do not allow
@@ -431,49 +384,48 @@ static int rlimit(int keep_open)
    * if it is capable of fopen()ing some additional files.
    */
 
-  if(!fopen_works()) {
-    msnprintf(strbuff1, sizeof(strbuff1), fmt, num_open.rlim_max);
-    msnprintf(strbuff, sizeof(strbuff),
-             "fopen fails with %s fds open()",
-             strbuff1);
-    fprintf(stderr, "%s\n", msgbuff);
-    msnprintf(strbuff, sizeof(strbuff),
-             "fopen fails with lots of fds open()");
-    store_errmsg(strbuff, 0);
-    close_file_descriptors();
-    free(memchunk);
+  if(!t518_fopen_works()) {
+    tutil_rlim2str(strbuff1, sizeof(strbuff1), t518_num_open.rlim_max);
+    curl_msnprintf(strbuff, sizeof(strbuff), "fopen fails with %s fds open",
+                   strbuff1);
+    curl_mfprintf(stderr, "%s\n", t518_msgbuff);
+    curl_msnprintf(strbuff, sizeof(strbuff),
+                   "fopen fails with lots of fds open");
+    t518_store_errmsg(strbuff, 0);
+    t518_close_file_descriptors();
+    curlx_free(memchunk);
     return -12;
   }
 
   /* free the chunk of memory we were reserving so that it
-     becomes becomes available to the test */
+     becomes available to the test */
 
-  free(memchunk);
+  curlx_free(memchunk);
 
   /* close file descriptors unless instructed to keep them */
 
   if(!keep_open) {
-    close_file_descriptors();
+    t518_close_file_descriptors();
   }
 
   return 0;
 }
 
-int test(char *URL)
+static CURLcode test_lib518(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
 
   if(!strcmp(URL, "check")) {
     /* used by the test script to ask if we can run this test or not */
-    if(rlimit(FALSE)) {
-      fprintf(stdout, "rlimit problem: %s\n", msgbuff);
-      return 1;
+    if(t518_test_rlimit(FALSE)) {
+      curl_mfprintf(stdout, "test_rlimit problem: %s\n", t518_msgbuff);
+      return TEST_ERR_FAILURE;
     }
-    return 0; /* sure, run this! */
+    return CURLE_OK; /* sure, run this! */
   }
 
-  if(rlimit(TRUE)) {
+  if(t518_test_rlimit(TRUE)) {
     /* failure */
     return TEST_ERR_MAJOR_BAD;
   }
@@ -482,40 +434,40 @@ int test(char *URL)
      and close them all once the test is over */
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
-    close_file_descriptors();
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    t518_close_file_descriptors();
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
-    close_file_descriptors();
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    t518_close_file_descriptors();
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
-  close_file_descriptors();
+  t518_close_file_descriptors();
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
 
-#else /* defined(HAVE_GETRLIMIT) && defined(HAVE_SETRLIMIT) */
+#else /* HAVE_GETRLIMIT && HAVE_SETRLIMIT */
 
-int test(char *URL)
+static CURLcode test_lib518(const char *URL)
 {
   (void)URL;
-  printf("system lacks necessary system function(s)");
-  return 1; /* skip test */
+  curl_mprintf("system lacks necessary system function(s)");
+  return TEST_ERR_MAJOR_BAD; /* skip test */
 }
 
-#endif /* defined(HAVE_GETRLIMIT) && defined(HAVE_SETRLIMIT) */
+#endif /* HAVE_GETRLIMIT && HAVE_SETRLIMIT */
diff --git a/third-party/curl/tests/libtest/lib519.c b/third-party/curl/tests/libtest/lib519.c
index a4abba0807..30aee83ff5 100644
--- a/third-party/curl/tests/libtest/lib519.c
+++ b/third-party/curl/tests/libtest/lib519.c
@@ -21,44 +21,44 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib519(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_USERPWD, "monster:underbed");
-  test_setopt(curl, CURLOPT_HEADER, 1L);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_USERPWD, "monster:underbed");
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* get first page */
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
+  if(result)
+    goto test_cleanup;
 
-  test_setopt(curl, CURLOPT_USERPWD, "anothermonster:inwardrobe");
+  easy_setopt(curl, CURLOPT_USERPWD, "anothermonster:inwardrobe");
 
   /* get second page */
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib520.c b/third-party/curl/tests/libtest/lib520.c
index 7e5d0abd7e..9da55e0273 100644
--- a/third-party/curl/tests/libtest/lib520.c
+++ b/third-party/curl/tests/libtest/lib520.c
@@ -21,37 +21,35 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib520(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_FILETIME, 1L);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_FILETIME, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib521.c b/third-party/curl/tests/libtest/lib521.c
index e3611685be..1469d6dc0b 100644
--- a/third-party/curl/tests/libtest/lib521.c
+++ b/third-party/curl/tests/libtest/lib521.c
@@ -21,38 +21,40 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib521(const char *URL)
 {
-  CURLcode res;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   CURL *curl;
+  curl_off_t port;
+
+  if(curlx_str_number(&libtest_arg2, &port, 0xffff))
+    return result;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
-    return TEST_ERR_MAJOR_BAD;
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return result;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
-    return TEST_ERR_MAJOR_BAD;
+    return result;
   }
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_PORT, strtol(libtest_arg2, NULL, 10));
-  test_setopt(curl, CURLOPT_USERPWD, "xxx:yyy");
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_PORT, (long)port);
+  easy_setopt(curl, CURLOPT_USERPWD, "xxx:yyy");
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib523.c b/third-party/curl/tests/libtest/lib523.c
index 86128e6c0b..ecc3e0ccce 100644
--- a/third-party/curl/tests/libtest/lib523.c
+++ b/third-party/curl/tests/libtest/lib523.c
@@ -21,39 +21,37 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib523(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_PROXY, libtest_arg2);
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_PORT, 19999L);
-  test_setopt(curl, CURLOPT_USERPWD, "xxx:yyy");
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_PROXY, libtest_arg2);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_PORT, 19999L);
+  easy_setopt(curl, CURLOPT_USERPWD, "xxx:yyy");
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib524.c b/third-party/curl/tests/libtest/lib524.c
index 6b8cc207d0..66ada8b0fa 100644
--- a/third-party/curl/tests/libtest/lib524.c
+++ b/third-party/curl/tests/libtest/lib524.c
@@ -21,37 +21,35 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib524(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_UPLOAD, 1L);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib525.c b/third-party/curl/tests/libtest/lib525.c
index 3f8abeef19..caedbde935 100644
--- a/third-party/curl/tests/libtest/lib525.c
+++ b/third-party/curl/tests/libtest/lib525.c
@@ -21,62 +21,49 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include <fcntl.h>
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
-
-int test(char *URL)
+static CURLcode test_lib525(const char *URL)
 {
-  int res = 0;
+  CURLcode result = CURLE_OK;
   CURL *curl = NULL;
+  char errbuf[STRERROR_LEN];
   FILE *hd_src = NULL;
   int hd;
-  struct_stat file_info;
-  CURLM *m = NULL;
+  curlx_struct_stat file_info;
+  CURLM *multi = NULL;
   int running;
 
   start_test_timing();
 
   if(!libtest_arg2) {
-#ifdef LIB529
-    /* test 529 */
-    fprintf(stderr, "Usage: lib529 [url] [uploadfile]\n");
-#else
-    /* test 525 */
-    fprintf(stderr, "Usage: lib525 [url] [uploadfile]\n");
-#endif
+    curl_mfprintf(stderr, "Usage: test [url] [uploadfile]\n");
     return TEST_ERR_USAGE;
   }
 
-  hd_src = fopen(libtest_arg2, "rb");
+  hd_src = curlx_fopen(libtest_arg2, "rb");
   if(!hd_src) {
-    fprintf(stderr, "fopen failed with error: %d (%s)\n",
-            errno, strerror(errno));
-    fprintf(stderr, "Error opening file: (%s)\n", libtest_arg2);
+    curl_mfprintf(stderr, "fopen() failed with error (%d) %s\n",
+                  errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
+    curl_mfprintf(stderr, "Error opening file '%s'\n", libtest_arg2);
     return TEST_ERR_FOPEN;
   }
 
   /* get the file size of the local file */
-  hd = fstat(fileno(hd_src), &file_info);
+  hd = curlx_fstat(fileno(hd_src), &file_info);
   if(hd == -1) {
-    /* can't open file, bail out */
-    fprintf(stderr, "fstat() failed with error: %d (%s)\n",
-            errno, strerror(errno));
-    fprintf(stderr, "ERROR: cannot open file (%s)\n", libtest_arg2);
-    fclose(hd_src);
+    /* cannot open file, bail out */
+    curl_mfprintf(stderr, "fstat() failed with error (%d) %s\n",
+                  errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
+    curl_mfprintf(stderr, "Error opening file '%s'\n", libtest_arg2);
+    curlx_fclose(hd_src);
     return TEST_ERR_FSTAT;
   }
 
   res_global_init(CURL_GLOBAL_ALL);
-  if(res) {
-    fclose(hd_src);
-    return res;
+  if(result) {
+    curlx_fclose(hd_src);
+    return result;
   }
 
   easy_init(curl);
@@ -98,7 +85,7 @@ int test(char *URL)
 
   /* NOTE: if you want this code to work on Windows with libcurl as a DLL, you
      MUST also provide a read callback with CURLOPT_READFUNCTION. Failing to
-     do so will give you a crash since a DLL may not use the variable's memory
+     do so gives you a crash since a DLL may not use the variable's memory
      when passed in to it from an app like this. */
 
   /* Set the size of the file to upload (optional).  If you give a *_LARGE
@@ -107,9 +94,9 @@ int test(char *URL)
      make sure that to pass in a type 'long' argument. */
   easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, (curl_off_t)file_info.st_size);
 
-  multi_init(m);
+  multi_init(multi);
 
-  multi_add_handle(m, curl);
+  multi_add_handle(multi, curl);
 
   for(;;) {
     struct timeval interval;
@@ -119,7 +106,7 @@ int test(char *URL)
     interval.tv_sec = 1;
     interval.tv_usec = 0;
 
-    multi_perform(m, &running);
+    multi_perform(multi, &running);
 
     abort_on_test_timeout();
 
@@ -130,7 +117,7 @@ int test(char *URL)
     FD_ZERO(&wr);
     FD_ZERO(&exc);
 
-    multi_fdset(m, &rd, &wr, &exc, &maxfd);
+    multi_fdset(multi, &rd, &wr, &exc, &maxfd);
 
     /* At this point, maxfd is guaranteed to be greater or equal than -1. */
 
@@ -141,24 +128,23 @@ int test(char *URL)
 
 test_cleanup:
 
-#ifdef LIB529
-  /* test 529 */
-  /* proper cleanup sequence - type PA */
-  curl_multi_remove_handle(m, curl);
-  curl_multi_cleanup(m);
-  curl_easy_cleanup(curl);
-  curl_global_cleanup();
-#else
-  /* test 525 */
-  /* proper cleanup sequence - type PB */
-  curl_multi_remove_handle(m, curl);
-  curl_easy_cleanup(curl);
-  curl_multi_cleanup(m);
-  curl_global_cleanup();
-#endif
+  if(testnum == 529) {
+    /* proper cleanup sequence - type PA */
+    curl_multi_remove_handle(multi, curl);
+    curl_multi_cleanup(multi);
+    curl_easy_cleanup(curl);
+    curl_global_cleanup();
+  }
+  else { /* testnum == 525 */
+    /* proper cleanup sequence - type PB */
+    curl_multi_remove_handle(multi, curl);
+    curl_easy_cleanup(curl);
+    curl_multi_cleanup(multi);
+    curl_global_cleanup();
+  }
 
   /* close the local file */
-  fclose(hd_src);
+  curlx_fclose(hd_src);
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib526.c b/third-party/curl/tests/libtest/lib526.c
index d6b365a199..23fbe727c4 100644
--- a/third-party/curl/tests/libtest/lib526.c
+++ b/third-party/curl/tests/libtest/lib526.c
@@ -27,49 +27,39 @@
  * sharing within the multi handle all transfers are performed on the same
  * persistent connection.
  *
- * This source code is used for lib526, lib527 and lib532 with only #ifdefs
+ * This source code is used for test526, test527 and test532 with branches
  * controlling the small differences.
  *
- * - lib526 closes all easy handles after
+ * - test526 closes all easy handles after
  *   they all have transferred the file over the single connection
- * - lib527 closes each easy handle after each single transfer.
- * - lib532 uses only a single easy handle that is removed, reset and then
+ * - test527 closes each easy handle after each single transfer.
+ * - test532 uses only a single easy handle that is removed, reset and then
  *   re-added for each transfer
  *
  * Test case 526, 527 and 532 use FTP, while test 528 uses the lib526 tool but
  * with HTTP.
  */
 
-#include "test.h"
+#include "first.h"
 
-#include <fcntl.h>
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
-
-#define NUM_HANDLES 4
-
-int test(char *URL)
+static CURLcode test_lib526(const char *URL)
 {
-  int res = 0;
+  CURLcode result = CURLE_OK;
   CURL *curl[NUM_HANDLES];
   int running;
-  CURLM *m = NULL;
-  int current = 0;
-  int i;
+  CURLM *multi = NULL;
+  size_t current = 0;
+  size_t i;
 
-  for(i = 0; i < NUM_HANDLES; i++)
+  for(i = 0; i < CURL_ARRAYSIZE(curl); i++)
     curl[i] = NULL;
 
   start_test_timing();
 
   global_init(CURL_GLOBAL_ALL);
 
-  /* get NUM_HANDLES easy handles */
-  for(i = 0; i < NUM_HANDLES; i++) {
+  /* get each easy handle */
+  for(i = 0; i < CURL_ARRAYSIZE(curl); i++) {
     easy_init(curl[i]);
     /* specify target */
     easy_setopt(curl[i], CURLOPT_URL, URL);
@@ -77,11 +67,11 @@ int test(char *URL)
     easy_setopt(curl[i], CURLOPT_VERBOSE, 1L);
   }
 
-  multi_init(m);
+  multi_init(multi);
 
-  multi_add_handle(m, curl[current]);
+  multi_add_handle(multi, curl[current]);
 
-  fprintf(stderr, "Start at URL 0\n");
+  curl_mfprintf(stderr, "Start at URL 0\n");
 
   for(;;) {
     struct timeval interval;
@@ -91,36 +81,37 @@ int test(char *URL)
     interval.tv_sec = 1;
     interval.tv_usec = 0;
 
-    multi_perform(m, &running);
+    multi_perform(multi, &running);
 
     abort_on_test_timeout();
 
     if(!running) {
-#ifdef LIB527
-      /* NOTE: this code does not remove the handle from the multi handle
-         here, which would be the nice, sane and documented way of working.
-         This however tests that the API survives this abuse gracefully. */
-      curl_easy_cleanup(curl[current]);
-      curl[current] = NULL;
-#endif
-      if(++current < NUM_HANDLES) {
-        fprintf(stderr, "Advancing to URL %d\n", current);
-#ifdef LIB532
-        /* first remove the only handle we use */
-        curl_multi_remove_handle(m, curl[0]);
+      if(testnum == 527) {
+        /* NOTE: this code does not remove the handle from the multi handle
+           here, which would be the nice, sane and documented way of working.
+           This however tests that the API survives this abuse gracefully. */
+        curl_easy_cleanup(curl[current]);
+        curl[current] = NULL;
+      }
+      if(++current < CURL_ARRAYSIZE(curl)) {
+        curl_mfprintf(stderr, "Advancing to URL %zu\n", current);
+        if(testnum == 532) {
+          /* first remove the only handle we use */
+          curl_multi_remove_handle(multi, curl[0]);
 
-        /* make us re-use the same handle all the time, and try resetting
-           the handle first too */
-        curl_easy_reset(curl[0]);
-        easy_setopt(curl[0], CURLOPT_URL, URL);
-        /* go verbose */
-        easy_setopt(curl[0], CURLOPT_VERBOSE, 1L);
+          /* make us reuse the same handle all the time, and try resetting
+             the handle first too */
+          curl_easy_reset(curl[0]);
+          easy_setopt(curl[0], CURLOPT_URL, URL);
+          /* go verbose */
+          easy_setopt(curl[0], CURLOPT_VERBOSE, 1L);
 
-        /* re-add it */
-        multi_add_handle(m, curl[0]);
-#else
-        multi_add_handle(m, curl[current]);
-#endif
+          /* re-add it */
+          multi_add_handle(multi, curl[0]);
+        }
+        else {
+          multi_add_handle(multi, curl[current]);
+        }
       }
       else {
         break; /* done */
@@ -131,7 +122,7 @@ int test(char *URL)
     FD_ZERO(&wr);
     FD_ZERO(&exc);
 
-    multi_fdset(m, &rd, &wr, &exc, &maxfd);
+    multi_fdset(multi, &rd, &wr, &exc, &maxfd);
 
     /* At this point, maxfd is guaranteed to be greater or equal than -1. */
 
@@ -142,45 +133,37 @@ int test(char *URL)
 
 test_cleanup:
 
-#if defined(LIB526)
+  if((testnum == 526) || (testnum == 528)) {
+    /* proper cleanup sequence - type PB */
 
-  /* test 526 and 528 */
-  /* proper cleanup sequence - type PB */
-
-  for(i = 0; i < NUM_HANDLES; i++) {
-    curl_multi_remove_handle(m, curl[i]);
-    curl_easy_cleanup(curl[i]);
-  }
-  curl_multi_cleanup(m);
-  curl_global_cleanup();
-
-#elif defined(LIB527)
-
-  /* test 527 */
-
-  /* Upon non-failure test flow the easy's have already been cleanup'ed. In
-     case there is a failure we arrive here with easy's that have not been
-     cleanup'ed yet, in this case we have to cleanup them or otherwise these
-     will be leaked, let's use undocumented cleanup sequence - type UB */
-
-  if(res)
-    for(i = 0; i < NUM_HANDLES; i++)
+    for(i = 0; i < CURL_ARRAYSIZE(curl); i++) {
+      curl_multi_remove_handle(multi, curl[i]);
       curl_easy_cleanup(curl[i]);
+    }
+    curl_multi_cleanup(multi);
+    curl_global_cleanup();
+  }
+  else if(testnum == 527) {
+    /* Upon non-failure test flow the easy's have already been cleanup'ed. In
+       case there is a failure we arrive here with easy's that have not been
+       cleanup'ed yet, in this case we have to cleanup them or otherwise these
+       leak, let's use undocumented cleanup sequence - type UB */
 
-  curl_multi_cleanup(m);
-  curl_global_cleanup();
+    if(result != CURLE_OK)
+      for(i = 0; i < CURL_ARRAYSIZE(curl); i++)
+        curl_easy_cleanup(curl[i]);
 
-#elif defined(LIB532)
+    curl_multi_cleanup(multi);
+    curl_global_cleanup();
+  }
+  else if(testnum == 532) {
+    /* undocumented cleanup sequence - type UB */
 
-  /* test 532 */
-  /* undocumented cleanup sequence - type UB */
+    for(i = 0; i < CURL_ARRAYSIZE(curl); i++)
+      curl_easy_cleanup(curl[i]);
+    curl_multi_cleanup(multi);
+    curl_global_cleanup();
+  }
 
-  for(i = 0; i < NUM_HANDLES; i++)
-    curl_easy_cleanup(curl[i]);
-  curl_multi_cleanup(m);
-  curl_global_cleanup();
-
-#endif
-
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib530.c b/third-party/curl/tests/libtest/lib530.c
index 0173dd9789..bddb857be0 100644
--- a/third-party/curl/tests/libtest/lib530.c
+++ b/third-party/curl/tests/libtest/lib530.c
@@ -28,43 +28,58 @@
  * aborted correctly.
  */
 
-#include "test.h"
+#include "first.h"
+#include "testtrace.h"
 
-#include <fcntl.h>
+static struct t530_ctx {
+  int socket_calls;
+  int max_socket_calls;
+  int timer_calls;
+  int max_timer_calls;
+  char buf[1024];
+} t530_ctx;
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
-
-struct Sockets
+static const char *t530_tag(void)
 {
+  curl_msnprintf(t530_ctx.buf, sizeof(t530_ctx.buf),
+                "[T530-%d-%d] [%d/%d]",
+                t530_ctx.max_socket_calls, t530_ctx.max_timer_calls,
+                t530_ctx.socket_calls, t530_ctx.timer_calls);
+  return t530_ctx.buf;
+}
+
+static void t530_msg(const char *msg)
+{
+  curl_mfprintf(stderr, "%s %s\n", t530_tag(), msg);
+}
+
+struct t530_Sockets {
   curl_socket_t *sockets;
   int count;      /* number of sockets actually stored in array */
   int max_count;  /* max number of sockets that fit in allocated array */
 };
 
-struct ReadWriteSockets
-{
-  struct Sockets read, write;
+struct t530_ReadWriteSockets {
+  struct t530_Sockets read, write;
 };
 
 /**
  * Remove a file descriptor from a sockets array.
  */
-static void removeFd(struct Sockets *sockets, curl_socket_t fd, int mention)
+static void t530_removeFd(struct t530_Sockets *sockets, curl_socket_t fd,
+                          int mention)
 {
   int i;
 
   if(mention)
-    fprintf(stderr, "Remove socket fd %d\n", (int) fd);
+    curl_mfprintf(stderr, "%s remove socket fd %" FMT_SOCKET_T "\n",
+                  t530_tag(), fd);
 
   for(i = 0; i < sockets->count; ++i) {
     if(sockets->sockets[i] == fd) {
       if(i < sockets->count - 1)
         memmove(&sockets->sockets[i], &sockets->sockets[i + 1],
-              sizeof(curl_socket_t) * (sockets->count - (i + 1)));
+                sizeof(curl_socket_t) * (sockets->count - (i + 1)));
       --sockets->count;
     }
   }
@@ -74,26 +89,29 @@ static void removeFd(struct Sockets *sockets, curl_socket_t fd, int mention)
  * Add a file descriptor to a sockets array.
  * Return 0 on success, 1 on error.
  */
-static int addFd(struct Sockets *sockets, curl_socket_t fd, const char *what)
+static int t530_addFd(struct t530_Sockets *sockets, curl_socket_t fd,
+                      const char *what)
 {
   /**
    * To ensure we only have each file descriptor once, we remove it then add
    * it again.
    */
-  fprintf(stderr, "Add socket fd %d for %s\n", (int) fd, what);
-  removeFd(sockets, fd, 0);
+  curl_mfprintf(stderr, "%s add socket fd %" FMT_SOCKET_T " for %s\n",
+                t530_tag(), fd, what);
+  t530_removeFd(sockets, fd, 0);
   /*
    * Allocate array storage when required.
    */
   if(!sockets->sockets) {
-    sockets->sockets = malloc(sizeof(curl_socket_t) * 20U);
+    sockets->sockets = curlx_malloc(sizeof(curl_socket_t) * 20U);
     if(!sockets->sockets)
       return 1;
     sockets->max_count = 20;
   }
   else if(sockets->count + 1 > sockets->max_count) {
-    curl_socket_t *ptr = realloc(sockets->sockets, sizeof(curl_socket_t) *
-                                 (sockets->max_count + 20));
+    curl_socket_t *ptr = curlx_realloc(sockets->sockets,
+                                       sizeof(curl_socket_t) *
+                                       (sockets->max_count + 20));
     if(!ptr)
       /* cleanup in test_cleanup */
       return 1;
@@ -108,60 +126,56 @@ static int addFd(struct Sockets *sockets, curl_socket_t fd, const char *what)
   return 0;
 }
 
-static int max_socket_calls;
-static int socket_calls = 0;
-
 /**
  * Callback invoked by curl to poll reading / writing of a socket.
  */
-static int curlSocketCallback(CURL *easy, curl_socket_t s, int action,
-                              void *userp, void *socketp)
+static int t530_curlSocketCallback(CURL *curl, curl_socket_t s, int action,
+                                   void *userp, void *socketp)
 {
-  struct ReadWriteSockets *sockets = userp;
+  struct t530_ReadWriteSockets *sockets = userp;
 
-  (void)easy; /* unused */
-  (void)socketp; /* unused */
+  (void)curl;
+  (void)socketp;
 
-  fprintf(stderr, "CURLMOPT_SOCKETFUNCTION called: %u\n", socket_calls++);
-  if(socket_calls == max_socket_calls) {
-    fprintf(stderr, "curlSocketCallback returns error\n");
+  t530_ctx.socket_calls++;
+  t530_msg("-> CURLMOPT_SOCKETFUNCTION");
+  if(t530_ctx.socket_calls == t530_ctx.max_socket_calls) {
+    t530_msg("<- CURLMOPT_SOCKETFUNCTION returns error");
     return -1;
   }
 
   if(action == CURL_POLL_IN || action == CURL_POLL_INOUT)
-    if(addFd(&sockets->read, s, "read"))
+    if(t530_addFd(&sockets->read, s, "read"))
       return -1; /* bail out */
 
   if(action == CURL_POLL_OUT || action == CURL_POLL_INOUT)
-    if(addFd(&sockets->write, s, "write"))
+    if(t530_addFd(&sockets->write, s, "write"))
       return -1;
 
   if(action == CURL_POLL_REMOVE) {
-    removeFd(&sockets->read, s, 1);
-    removeFd(&sockets->write, s, 0);
+    t530_removeFd(&sockets->read, s, 1);
+    t530_removeFd(&sockets->write, s, 0);
   }
 
   return 0;
 }
 
-static int max_timer_calls;
-static int timer_calls = 0;
-
 /**
  * Callback invoked by curl to set a timeout.
  */
-static int curlTimerCallback(CURLM *multi, long timeout_ms, void *userp)
+static int t530_curlTimerCallback(CURLM *multi, long timeout_ms, void *userp)
 {
-  struct timeval *timeout = userp;
+  struct curltime *timeout = userp;
 
-  (void)multi; /* unused */
-  fprintf(stderr, "CURLMOPT_TIMERFUNCTION called: %u\n", timer_calls++);
-  if(timer_calls == max_timer_calls) {
-    fprintf(stderr, "curlTimerCallback returns error\n");
+  (void)multi;
+  t530_ctx.timer_calls++;
+  t530_msg("-> CURLMOPT_TIMERFUNCTION");
+  if(t530_ctx.timer_calls == t530_ctx.max_timer_calls) {
+    t530_msg("<- CURLMOPT_TIMERFUNCTION returns error");
     return -1;
   }
   if(timeout_ms != -1) {
-    *timeout = tutil_tvnow();
+    *timeout = curlx_now();
     timeout->tv_usec += (int)timeout_ms * 1000;
   }
   else {
@@ -173,13 +187,13 @@ static int curlTimerCallback(CURLM *multi, long timeout_ms, void *userp)
 /**
  * Check for curl completion.
  */
-static int checkForCompletion(CURLM *curl, int *success)
+static int t530_checkForCompletion(CURLM *multi, int *success)
 {
   int result = 0;
   *success = 0;
   while(1) {
     int numMessages;
-    CURLMsg *message = curl_multi_info_read(curl, &numMessages);
+    CURLMsg *message = curl_multi_info_read(multi, &numMessages);
     if(!message)
       break;
     if(message->msg == CURLMSG_DONE) {
@@ -190,8 +204,8 @@ static int checkForCompletion(CURLM *curl, int *success)
         *success = 0;
     }
     else {
-      fprintf(stderr, "Got an unexpected message from curl: %i\n",
-              (int)message->msg);
+      curl_mfprintf(stderr, "%s got an unexpected message from curl: %d\n",
+                    t530_tag(), (int)message->msg);
       result = 1;
       *success = 0;
     }
@@ -199,24 +213,24 @@ static int checkForCompletion(CURLM *curl, int *success)
   return result;
 }
 
-static int getMicroSecondTimeout(struct timeval *timeout)
+static ssize_t t530_getMicroSecondTimeout(struct curltime *timeout)
 {
-  struct timeval now;
+  struct curltime now;
   ssize_t result;
-  now = tutil_tvnow();
-  result = (ssize_t)((timeout->tv_sec - now.tv_sec) * 1000000 +
+  now = curlx_now();
+  result = (ssize_t)(((timeout->tv_sec - now.tv_sec) * 1000000) +
     timeout->tv_usec - now.tv_usec);
   if(result < 0)
     result = 0;
 
-  return curlx_sztosi(result);
+  return result;
 }
 
 /**
  * Update a fd_set with all of the sockets in use.
  */
-static void updateFdSet(struct Sockets *sockets, fd_set* fdset,
-                        curl_socket_t *maxFd)
+static void t530_updateFdSet(struct t530_Sockets *sockets, fd_set *fdset,
+                             curl_socket_t *maxFd)
 {
   int i;
   for(i = 0; i < sockets->count; ++i) {
@@ -227,57 +241,59 @@ static void updateFdSet(struct Sockets *sockets, fd_set* fdset,
   }
 }
 
-static int socket_action(CURLM *curl, curl_socket_t s, int evBitmask,
+static CURLMcode socket_action(CURLM *multi, curl_socket_t s, int evBitmask,
                                const char *info)
 {
   int numhandles = 0;
-  CURLMcode result = curl_multi_socket_action(curl, s, evBitmask, &numhandles);
-  if(result != CURLM_OK) {
-    fprintf(stderr, "Curl error on %s: %i (%s)\n",
-            info, result, curl_multi_strerror(result));
+  CURLMcode mresult = curl_multi_socket_action(multi, s, evBitmask,
+                                              &numhandles);
+  if(mresult != CURLM_OK) {
+    curl_mfprintf(stderr, "%s curl error on %s (%d) %s\n",
+                  t530_tag(), info, mresult, curl_multi_strerror(mresult));
   }
-  return (int)result;
+  return mresult;
 }
 
 /**
  * Invoke curl when a file descriptor is set.
  */
-static int checkFdSet(CURLM *curl,
-                      struct Sockets *sockets, fd_set *fdset,
-                      int evBitmask, const char *name)
+static CURLMcode t530_checkFdSet(CURLM *multi, struct t530_Sockets *sockets,
+                                 fd_set *fdset, int evBitmask,
+                                 const char *name)
 {
   int i;
-  int result = 0;
+  CURLMcode mresult = CURLM_OK;
   for(i = 0; i < sockets->count; ++i) {
     if(FD_ISSET(sockets->sockets[i], fdset)) {
-      result = socket_action(curl, sockets->sockets[i], evBitmask, name);
-      if(result)
+      mresult = socket_action(multi, sockets->sockets[i], evBitmask, name);
+      if(mresult)
         break;
     }
   }
-  return result;
+  return mresult;
 }
 
-static int testone(char *URL, int timercb, int socketcb)
+static CURLcode testone(const char *URL, int timer_fail_at, int socket_fail_at)
 {
-  int res = 0;
-  CURL *curl = NULL;  CURLM *m = NULL;
-  struct ReadWriteSockets sockets = {{NULL, 0, 0}, {NULL, 0, 0}};
-  struct timeval timeout = {-1, 0};
+  CURLcode result = CURLE_OK;
+  CURL *curl = NULL;
+  CURLM *multi = NULL;
+  struct t530_ReadWriteSockets sockets = { { NULL, 0, 0 }, { NULL, 0, 0 } };
   int success = 0;
+  struct curltime timeout = { 0 };
+  timeout.tv_sec = (time_t)-1;
 
   /* set the limits */
-  max_timer_calls = timercb;
-  max_socket_calls = socketcb;
-  timer_calls = 0; /* reset the globals */
-  socket_calls = 0;
+  memset(&t530_ctx, 0, sizeof(t530_ctx));
+  t530_ctx.max_timer_calls = timer_fail_at;
+  t530_ctx.max_socket_calls = socket_fail_at;
 
-  fprintf(stderr, "start test: %d %d\n", timercb, socketcb);
+  t530_msg("start");
   start_test_timing();
 
   res_global_init(CURL_GLOBAL_ALL);
-  if(res)
-    return res;
+  if(result != CURLE_OK)
+    return result;
 
   easy_init(curl);
 
@@ -285,34 +301,38 @@ static int testone(char *URL, int timercb, int socketcb)
   easy_setopt(curl, CURLOPT_URL, URL);
 
   /* go verbose */
+  easy_setopt(curl, CURLOPT_DEBUGDATA, &debug_config);
+  easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
   easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  multi_init(m);
+  multi_init(multi);
 
-  multi_setopt(m, CURLMOPT_SOCKETFUNCTION, curlSocketCallback);
-  multi_setopt(m, CURLMOPT_SOCKETDATA, &sockets);
+  multi_setopt(multi, CURLMOPT_SOCKETFUNCTION, t530_curlSocketCallback);
+  multi_setopt(multi, CURLMOPT_SOCKETDATA, &sockets);
 
-  multi_setopt(m, CURLMOPT_TIMERFUNCTION, curlTimerCallback);
-  multi_setopt(m, CURLMOPT_TIMERDATA, &timeout);
+  multi_setopt(multi, CURLMOPT_TIMERFUNCTION, t530_curlTimerCallback);
+  multi_setopt(multi, CURLMOPT_TIMERDATA, &timeout);
 
-  multi_add_handle(m, curl);
+  multi_add_handle(multi, curl);
 
-  res = socket_action(m, CURL_SOCKET_TIMEOUT, 0, "timeout");
-  if(res)
+  if(socket_action(multi, CURL_SOCKET_TIMEOUT, 0, "timeout")) {
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
+  }
 
-  while(!checkForCompletion(m, &success)) {
+  while(!t530_checkForCompletion(multi, &success)) {
     fd_set readSet, writeSet;
     curl_socket_t maxFd = 0;
-    struct timeval tv = {10, 0};
+    struct timeval tv = { 0 };
+    tv.tv_sec = 10;
 
     FD_ZERO(&readSet);
     FD_ZERO(&writeSet);
-    updateFdSet(&sockets.read, &readSet, &maxFd);
-    updateFdSet(&sockets.write, &writeSet, &maxFd);
+    t530_updateFdSet(&sockets.read, &readSet, &maxFd);
+    t530_updateFdSet(&sockets.write, &writeSet, &maxFd);
 
-    if(timeout.tv_sec != -1) {
-      int usTimeout = getMicroSecondTimeout(&timeout);
+    if(timeout.tv_sec != (time_t)-1) {
+      int usTimeout = curlx_sztosi(t530_getMicroSecondTimeout(&timeout));
       tv.tv_sec = usTimeout / 1000000;
       tv.tv_usec = usTimeout % 1000000;
     }
@@ -325,67 +345,75 @@ static int testone(char *URL, int timercb, int socketcb)
     select_test((int)maxFd, &readSet, &writeSet, NULL, &tv);
 
     /* Check the sockets for reading / writing */
-    res = checkFdSet(m, &sockets.read, &readSet, CURL_CSELECT_IN, "read");
-    if(res)
+    if(t530_checkFdSet(multi, &sockets.read, &readSet, CURL_CSELECT_IN,
+                       "read")) {
+      result = TEST_ERR_MAJOR_BAD;
       goto test_cleanup;
-    res = checkFdSet(m, &sockets.write, &writeSet, CURL_CSELECT_OUT, "write");
-    if(res)
+    }
+    if(t530_checkFdSet(multi, &sockets.write, &writeSet, CURL_CSELECT_OUT,
+                       "write")) {
+      result = TEST_ERR_MAJOR_BAD;
       goto test_cleanup;
+    }
 
-    if(timeout.tv_sec != -1 && getMicroSecondTimeout(&timeout) == 0) {
-      /* Curl's timer has elapsed. */
-      res = socket_action(m, CURL_SOCKET_TIMEOUT, 0, "timeout");
-      if(res)
+    if(timeout.tv_sec != (time_t)-1 &&
+       t530_getMicroSecondTimeout(&timeout) == 0) {
+      /* curl's timer has elapsed. */
+      if(socket_action(multi, CURL_SOCKET_TIMEOUT, 0, "timeout")) {
+        result = TEST_ERR_BAD_TIMEOUT;
         goto test_cleanup;
+      }
     }
 
     abort_on_test_timeout();
   }
 
   if(!success) {
-    fprintf(stderr, "Error getting file.\n");
-    res = TEST_ERR_MAJOR_BAD;
+    t530_msg("Error getting file.");
+    result = TEST_ERR_MAJOR_BAD;
   }
 
 test_cleanup:
 
   /* proper cleanup sequence */
-  fprintf(stderr, "cleanup: %d %d\n", timercb, socketcb);
-  curl_multi_remove_handle(m, curl);
+  t530_msg("cleanup");
+  curl_multi_remove_handle(multi, curl);
   curl_easy_cleanup(curl);
-  curl_multi_cleanup(m);
+  curl_multi_cleanup(multi);
   curl_global_cleanup();
 
   /* free local memory */
-  free(sockets.read.sockets);
-  free(sockets.write.sockets);
-  return res;
+  curlx_free(sockets.read.sockets);
+  curlx_free(sockets.write.sockets);
+  t530_msg("done");
+
+  return result;
 }
 
-int test(char *URL)
+static CURLcode test_lib530(const char *URL)
 {
-  int rc;
+  CURLcode result;
   /* rerun the same transfer multiple times and make it fail in different
      callback calls */
-  rc = testone(URL, 0, 0);
-  if(rc)
-    fprintf(stderr, "test 0/0 failed: %d\n", rc);
+  result = testone(URL, 0, 0); /* no callback fails */
+  if(result)
+    curl_mfprintf(stderr, "%s FAILED: %d\n", t530_tag(), (int)result);
 
-  rc = testone(URL, 1, 0);
-  if(!rc)
-    fprintf(stderr, "test 1/0 failed: %d\n", rc);
+  result = testone(URL, 1, 0); /* fail 1st call to timer callback */
+  if(!result)
+    curl_mfprintf(stderr, "%s FAILED: %d\n", t530_tag(), (int)result);
 
-  rc = testone(URL, 2, 0);
-  if(!rc)
-    fprintf(stderr, "test 2/0 failed: %d\n", rc);
+  result = testone(URL, 2, 0); /* fail 2nd call to timer callback */
+  if(!result)
+    curl_mfprintf(stderr, "%s FAILED: %d\n", t530_tag(), (int)result);
 
-  rc = testone(URL, 0, 1);
-  if(!rc)
-    fprintf(stderr, "test 0/1 failed: %d\n", rc);
+  result = testone(URL, 0, 2); /* fail 2nd call to socket callback */
+  if(!result)
+    curl_mfprintf(stderr, "%s FAILED: %d\n", t530_tag(), (int)result);
 
-  rc = testone(URL, 0, 2);
-  if(!rc)
-    fprintf(stderr, "test 0/2 failed: %d\n", rc);
+  result = testone(URL, 0, 3); /* fail 3rd call to socket callback */
+  if(!result)
+    curl_mfprintf(stderr, "%s FAILED: %d\n", t530_tag(), (int)result);
 
-  return 0;
+  return CURLE_OK;
 }
diff --git a/third-party/curl/tests/libtest/lib533.c b/third-party/curl/tests/libtest/lib533.c
index ff476343fa..188732f8e5 100644
--- a/third-party/curl/tests/libtest/lib533.c
+++ b/third-party/curl/tests/libtest/lib533.c
@@ -21,24 +21,16 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-/* used for test case 533, 534 and 535 */
+/* used for test case 533, 534, 535 and 546 */
 
-#include "test.h"
+#include "first.h"
 
-#include <fcntl.h>
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
-
-int test(char *URL)
+static CURLcode test_lib533(const char *URL)
 {
-  int res = 0;
+  CURLcode result = CURLE_OK;
   CURL *curl = NULL;
   int running;
-  CURLM *m = NULL;
+  CURLM *multi = NULL;
   int current = 0;
 
   start_test_timing();
@@ -51,11 +43,11 @@ int test(char *URL)
   easy_setopt(curl, CURLOPT_VERBOSE, 1L);
   easy_setopt(curl, CURLOPT_FAILONERROR, 1L);
 
-  multi_init(m);
+  multi_init(multi);
 
-  multi_add_handle(m, curl);
+  multi_add_handle(multi, curl);
 
-  fprintf(stderr, "Start at URL 0\n");
+  curl_mfprintf(stderr, "Start at URL 0\n");
 
   for(;;) {
     struct timeval interval;
@@ -65,17 +57,17 @@ int test(char *URL)
     interval.tv_sec = 1;
     interval.tv_usec = 0;
 
-    multi_perform(m, &running);
+    multi_perform(multi, &running);
 
     abort_on_test_timeout();
 
     if(!running) {
       if(!current++) {
-        fprintf(stderr, "Advancing to URL 1\n");
+        curl_mfprintf(stderr, "Advancing to URL 1\n");
         /* remove the handle we use */
-        curl_multi_remove_handle(m, curl);
+        curl_multi_remove_handle(multi, curl);
 
-        /* make us re-use the same handle all the time, and try resetting
+        /* make us reuse the same handle all the time, and try resetting
            the handle first too */
         curl_easy_reset(curl);
         easy_setopt(curl, CURLOPT_URL, libtest_arg2);
@@ -83,7 +75,7 @@ int test(char *URL)
         easy_setopt(curl, CURLOPT_FAILONERROR, 1L);
 
         /* re-add it */
-        multi_add_handle(m, curl);
+        multi_add_handle(multi, curl);
       }
       else
         break; /* done */
@@ -93,7 +85,7 @@ int test(char *URL)
     FD_ZERO(&wr);
     FD_ZERO(&exc);
 
-    multi_fdset(m, &rd, &wr, &exc, &maxfd);
+    multi_fdset(multi, &rd, &wr, &exc, &maxfd);
 
     /* At this point, maxfd is guaranteed to be greater or equal than -1. */
 
@@ -107,8 +99,8 @@ test_cleanup:
   /* undocumented cleanup sequence - type UB */
 
   curl_easy_cleanup(curl);
-  curl_multi_cleanup(m);
+  curl_multi_cleanup(multi);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib536.c b/third-party/curl/tests/libtest/lib536.c
new file mode 100644
index 0000000000..e25922062a
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib536.c
@@ -0,0 +1,81 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static void proxystat(CURL *curl)
+{
+  long wasproxy;
+  if(!curl_easy_getinfo(curl, CURLINFO_USED_PROXY, &wasproxy)) {
+    curl_mprintf("This %sthe proxy\n", wasproxy ? "used " : "DID NOT use ");
+  }
+}
+
+static CURLcode test_lib536(const char *URL)
+{
+  CURLcode result = CURLE_OK;
+  CURL *curl;
+  struct curl_slist *host = NULL;
+
+  static const char *url_with_proxy = "http://usingproxy.test/";
+  const char *url_without_proxy = libtest_arg2;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  host = curl_slist_append(NULL, libtest_arg3);
+  if(!host)
+    goto test_cleanup;
+
+  easy_setopt(curl, CURLOPT_RESOLVE, host);
+  easy_setopt(curl, CURLOPT_PROXY, URL);
+  easy_setopt(curl, CURLOPT_URL, url_with_proxy);
+  easy_setopt(curl, CURLOPT_NOPROXY, "goingdirect.test");
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+  result = curl_easy_perform(curl);
+  if(!result) {
+    proxystat(curl);
+    easy_setopt(curl, CURLOPT_URL, url_without_proxy);
+    result = curl_easy_perform(curl);
+    if(!result)
+      proxystat(curl);
+  }
+
+test_cleanup:
+
+  curl_easy_cleanup(curl);
+  curl_slist_free_all(host);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib537.c b/third-party/curl/tests/libtest/lib537.c
index 3782282b87..5f99b4f006 100644
--- a/third-party/curl/tests/libtest/lib537.c
+++ b/third-party/curl/tests/libtest/lib537.c
@@ -21,60 +21,44 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#ifdef HAVE_SYS_RESOURCE_H
-#include <sys/resource.h>
-#endif
-#ifdef HAVE_FCNTL_H
-#include <fcntl.h>
-#endif
-#include <limits.h>
+#if defined(HAVE_GETRLIMIT) && defined(HAVE_SETRLIMIT)
 
-#include "warnless.h"
-#include "memdebug.h"
+#define T537_SAFETY_MARGIN 11
 
-#if !defined(HAVE_POLL_FINE)    && \
-    !defined(USE_WINSOCK)       && \
-    !defined(FD_SETSIZE)
-#error "this test requires FD_SETSIZE"
-#endif
-
-#define SAFETY_MARGIN (11)
-
-#if defined(WIN32) || defined(_WIN32) || defined(MSDOS)
+#if defined(_WIN32) || defined(MSDOS)
 #define DEV_NULL "NUL"
 #else
 #define DEV_NULL "/dev/null"
 #endif
 
-#if defined(HAVE_GETRLIMIT) && defined(HAVE_SETRLIMIT)
+static int *t537_testfd = NULL;
+static struct rlimit t537_num_open;
+static char t537_msgbuff[256];
 
-static int *fd = NULL;
-static struct rlimit num_open;
-static char msgbuff[256];
-
-static void store_errmsg(const char *msg, int err)
+static void t537_store_errmsg(const char *msg, int err)
 {
   if(!err)
-    msnprintf(msgbuff, sizeof(msgbuff), "%s", msg);
-  else
-    msnprintf(msgbuff, sizeof(msgbuff), "%s, errno %d, %s", msg, err,
-              strerror(err));
+    curl_msnprintf(t537_msgbuff, sizeof(t537_msgbuff), "%s", msg);
+  else {
+    char errbuf[STRERROR_LEN];
+    curl_msnprintf(t537_msgbuff, sizeof(t537_msgbuff), "%s, errno %d, %s", msg,
+                   err, curlx_strerror(err, errbuf, sizeof(errbuf)));
+  }
 }
 
-static void close_file_descriptors(void)
+static void t537_close_file_descriptors(void)
 {
-  for(num_open.rlim_cur = 0;
-      num_open.rlim_cur < num_open.rlim_max;
-      num_open.rlim_cur++)
-    if(fd[num_open.rlim_cur] > 0)
-      close(fd[num_open.rlim_cur]);
-  free(fd);
-  fd = NULL;
+  for(t537_num_open.rlim_cur = 0;
+      t537_num_open.rlim_cur < t537_num_open.rlim_max;
+      t537_num_open.rlim_cur++)
+    if(t537_testfd[t537_num_open.rlim_cur] > 0)
+      curlx_close(t537_testfd[t537_num_open.rlim_cur]);
+  curlx_safefree(t537_testfd);
 }
 
-static int fopen_works(void)
+static int t537_fopen_works(void)
 {
   FILE *fpa[3];
   int i;
@@ -84,66 +68,55 @@ static int fopen_works(void)
     fpa[i] = NULL;
   }
   for(i = 0; i < 3; i++) {
-    fpa[i] = fopen(DEV_NULL, FOPEN_READTEXT);
+    fpa[i] = curlx_fopen(DEV_NULL, FOPEN_READTEXT);
     if(!fpa[i]) {
-      store_errmsg("fopen failed", errno);
-      fprintf(stderr, "%s\n", msgbuff);
+      t537_store_errmsg("fopen failed", errno);
+      curl_mfprintf(stderr, "%s\n", t537_msgbuff);
       ret = 0;
       break;
     }
   }
   for(i = 0; i < 3; i++) {
     if(fpa[i])
-      fclose(fpa[i]);
+      curlx_fclose(fpa[i]);
   }
   return ret;
 }
 
-static int rlimit(int keep_open)
+static int t537_test_rlimit(int keep_open)
 {
   int *tmpfd;
   rlim_t nitems, i;
   int *memchunk = NULL;
-  char *fmt;
   struct rlimit rl;
   char strbuff[256];
   char strbuff1[81];
-  char fmt_u[] = "%u";
-  char fmt_lu[] = "%lu";
-#ifdef HAVE_LONGLONG
-  char fmt_llu[] = "%llu";
-
-  if(sizeof(rl.rlim_max) > sizeof(long))
-    fmt = fmt_llu;
-  else
-#endif
-    fmt = (sizeof(rl.rlim_max) < sizeof(long))?fmt_u:fmt_lu;
 
   /* get initial open file limits */
 
-  if(getrlimit(RLIMIT_NOFILE, &rl) != 0) {
-    store_errmsg("getrlimit() failed", errno);
-    fprintf(stderr, "%s\n", msgbuff);
+  if(getrlimit(RLIMIT_NOFILE, &rl)) {
+    t537_store_errmsg("getrlimit() failed", errno);
+    curl_mfprintf(stderr, "%s\n", t537_msgbuff);
     return -1;
   }
 
   /* show initial open file limits */
 
-#ifdef RLIM_INFINITY
-  if(rl.rlim_cur == RLIM_INFINITY)
-    strcpy(strbuff, "INFINITY");
-  else
-#endif
-    msnprintf(strbuff, sizeof(strbuff), fmt, rl.rlim_cur);
-  fprintf(stderr, "initial soft limit: %s\n", strbuff);
+  tutil_rlim2str(strbuff, sizeof(strbuff), rl.rlim_cur);
+  curl_mfprintf(stderr, "initial soft limit: %s\n", strbuff);
 
-#ifdef RLIM_INFINITY
-  if(rl.rlim_max == RLIM_INFINITY)
-    strcpy(strbuff, "INFINITY");
-  else
-#endif
-    msnprintf(strbuff, sizeof(strbuff), fmt, rl.rlim_max);
-  fprintf(stderr, "initial hard limit: %s\n", strbuff);
+  tutil_rlim2str(strbuff, sizeof(strbuff), rl.rlim_max);
+  curl_mfprintf(stderr, "initial hard limit: %s\n", strbuff);
+
+  /* If the OS allows a HUGE number of open files, we do not run.
+   * Modern debian sid reports a limit of 134217724 and this tests
+   * takes minutes. */
+#define LIMIT_CAP (256 * 1024)
+  if(rl.rlim_cur > LIMIT_CAP) {
+    curl_mfprintf(stderr, "soft limit above %ld, not running\n",
+                  (long)LIMIT_CAP);
+    return -2;
+  }
 
   /*
    * if soft limit and hard limit are different we ask the
@@ -151,69 +124,59 @@ static int rlimit(int keep_open)
    * limit. Due to some other system limit the soft limit
    * might not be raised up to the hard limit. So from this
    * point the resulting soft limit is our limit. Trying to
-   * open more than soft limit file descriptors will fail.
+   * open more than soft limit file descriptors does fail.
    */
 
   if(rl.rlim_cur != rl.rlim_max) {
 
 #ifdef OPEN_MAX
     if((rl.rlim_cur > 0) &&
-        (rl.rlim_cur < OPEN_MAX)) {
-      fprintf(stderr, "raising soft limit up to OPEN_MAX\n");
+       (rl.rlim_cur < OPEN_MAX)) {
+      curl_mfprintf(stderr, "raising soft limit up to OPEN_MAX\n");
       rl.rlim_cur = OPEN_MAX;
-      if(setrlimit(RLIMIT_NOFILE, &rl) != 0) {
-        /* on failure don't abort just issue a warning */
-        store_errmsg("setrlimit() failed", errno);
-        fprintf(stderr, "%s\n", msgbuff);
-        msgbuff[0] = '\0';
+      if(setrlimit(RLIMIT_NOFILE, &rl)) {
+        /* on failure do not abort, only issue a warning */
+        t537_store_errmsg("setrlimit() failed", errno);
+        curl_mfprintf(stderr, "%s\n", t537_msgbuff);
+        t537_msgbuff[0] = '\0';
       }
     }
 #endif
 
-    fprintf(stderr, "raising soft limit up to hard limit\n");
+    curl_mfprintf(stderr, "raising soft limit up to hard limit\n");
     rl.rlim_cur = rl.rlim_max;
-    if(setrlimit(RLIMIT_NOFILE, &rl) != 0) {
-      /* on failure don't abort just issue a warning */
-      store_errmsg("setrlimit() failed", errno);
-      fprintf(stderr, "%s\n", msgbuff);
-      msgbuff[0] = '\0';
+    if(setrlimit(RLIMIT_NOFILE, &rl)) {
+      /* on failure do not abort, only issue a warning */
+      t537_store_errmsg("setrlimit() failed", errno);
+      curl_mfprintf(stderr, "%s\n", t537_msgbuff);
+      t537_msgbuff[0] = '\0';
     }
 
     /* get current open file limits */
 
-    if(getrlimit(RLIMIT_NOFILE, &rl) != 0) {
-      store_errmsg("getrlimit() failed", errno);
-      fprintf(stderr, "%s\n", msgbuff);
+    if(getrlimit(RLIMIT_NOFILE, &rl)) {
+      t537_store_errmsg("getrlimit() failed", errno);
+      curl_mfprintf(stderr, "%s\n", t537_msgbuff);
       return -3;
     }
 
     /* show current open file limits */
 
-#ifdef RLIM_INFINITY
-    if(rl.rlim_cur == RLIM_INFINITY)
-      strcpy(strbuff, "INFINITY");
-    else
-#endif
-      msnprintf(strbuff, sizeof(strbuff), fmt, rl.rlim_cur);
-    fprintf(stderr, "current soft limit: %s\n", strbuff);
+    tutil_rlim2str(strbuff, sizeof(strbuff), rl.rlim_cur);
+    curl_mfprintf(stderr, "current soft limit: %s\n", strbuff);
 
-#ifdef RLIM_INFINITY
-    if(rl.rlim_max == RLIM_INFINITY)
-      strcpy(strbuff, "INFINITY");
-    else
-#endif
-      msnprintf(strbuff, sizeof(strbuff), fmt, rl.rlim_max);
-    fprintf(stderr, "current hard limit: %s\n", strbuff);
+    tutil_rlim2str(strbuff, sizeof(strbuff), rl.rlim_max);
+    curl_mfprintf(stderr, "current hard limit: %s\n", strbuff);
 
   } /* (rl.rlim_cur != rl.rlim_max) */
 
   /*
    * test 537 is all about testing libcurl functionality
    * when the system has nearly exhausted the number of
-   * available file descriptors. Test 537 will try to run
-   * with a very small number of file descriptors available.
+   * available file descriptors. Test 537 tries to run
+   * with a small number of file descriptors available.
    * This implies that any file descriptor which is open
-   * when the test runs will have a number in the high range
+   * when the test runs does have a number in the high range
    * of whatever the system supports.
    */
 
@@ -222,8 +185,8 @@ static int rlimit(int keep_open)
    * avoid a low memory condition once the file descriptors are
    * open. System conditions that could make the test fail should
    * be addressed in the precheck phase. This chunk of memory shall
-   * be always free()ed before exiting the rlimit() function so
-   * that it becomes available to the test.
+   * be always curlx_free()ed before exiting the t537_test_rlimit()
+   * function so that it becomes available to the test.
    */
 
   for(nitems = i = 1; nitems <= i; i *= 2)
@@ -231,37 +194,37 @@ static int rlimit(int keep_open)
   if(nitems > 0x7fff)
     nitems = 0x40000;
   do {
-    num_open.rlim_max = sizeof(*memchunk) * nitems;
-    msnprintf(strbuff, sizeof(strbuff), fmt, num_open.rlim_max);
-    fprintf(stderr, "allocating memchunk %s byte array\n", strbuff);
-    memchunk = malloc(sizeof(*memchunk) * (size_t)nitems);
+    t537_num_open.rlim_max = sizeof(*memchunk) * nitems;
+    tutil_rlim2str(strbuff, sizeof(strbuff), t537_num_open.rlim_max);
+    curl_mfprintf(stderr, "allocating memchunk %s byte array\n", strbuff);
+    memchunk = curlx_malloc(sizeof(*memchunk) * (size_t)nitems);
     if(!memchunk) {
-      fprintf(stderr, "memchunk, malloc() failed\n");
+      curl_mfprintf(stderr, "memchunk, malloc() failed\n");
       nitems /= 2;
     }
   } while(nitems && !memchunk);
   if(!memchunk) {
-    store_errmsg("memchunk, malloc() failed", errno);
-    fprintf(stderr, "%s\n", msgbuff);
+    t537_store_errmsg("memchunk, malloc() failed", errno);
+    curl_mfprintf(stderr, "%s\n", t537_msgbuff);
     return -4;
   }
 
   /* initialize it to fight lazy allocation */
 
-  fprintf(stderr, "initializing memchunk array\n");
+  curl_mfprintf(stderr, "initializing memchunk array\n");
 
   for(i = 0; i < nitems; i++)
     memchunk[i] = -1;
 
-  /* set the number of file descriptors we will try to open */
+  /* set the number of file descriptors we try to open */
 
 #ifdef RLIM_INFINITY
   if((rl.rlim_cur > 0) && (rl.rlim_cur != RLIM_INFINITY)) {
 #else
   if(rl.rlim_cur > 0) {
 #endif
-    /* soft limit minus SAFETY_MARGIN */
-    num_open.rlim_max = rl.rlim_cur - SAFETY_MARGIN;
+    /* soft limit minus T537_SAFETY_MARGIN */
+    t537_num_open.rlim_max = rl.rlim_cur - T537_SAFETY_MARGIN;
   }
   else {
     /* a huge number of file descriptors */
@@ -269,161 +232,164 @@ static int rlimit(int keep_open)
       nitems = i;
     if(nitems > 0x7fff)
       nitems = 0x40000;
-    num_open.rlim_max = nitems;
+    t537_num_open.rlim_max = nitems;
   }
 
-  /* verify that we won't overflow size_t in malloc() */
+  /* verify that we do not overflow size_t in curlx_malloc() */
 
-  if((size_t)(num_open.rlim_max) > ((size_t)-1) / sizeof(*fd)) {
-    msnprintf(strbuff1, sizeof(strbuff1), fmt, num_open.rlim_max);
-    msnprintf(strbuff, sizeof(strbuff), "unable to allocate an array for %s "
-              "file descriptors, would overflow size_t", strbuff1);
-    store_errmsg(strbuff, 0);
-    fprintf(stderr, "%s\n", msgbuff);
-    free(memchunk);
+  if((size_t)(t537_num_open.rlim_max) > ((size_t)-1) / sizeof(*t537_testfd)) {
+    tutil_rlim2str(strbuff1, sizeof(strbuff1), t537_num_open.rlim_max);
+    curl_msnprintf(strbuff, sizeof(strbuff),
+                   "unable to allocate an array for %s "
+                   "file descriptors, would overflow size_t", strbuff1);
+    t537_store_errmsg(strbuff, 0);
+    curl_mfprintf(stderr, "%s\n", t537_msgbuff);
+    curlx_free(memchunk);
     return -5;
   }
 
   /* allocate array for file descriptors */
 
   do {
-    msnprintf(strbuff, sizeof(strbuff), fmt, num_open.rlim_max);
-    fprintf(stderr, "allocating array for %s file descriptors\n", strbuff);
-    fd = malloc(sizeof(*fd) * (size_t)(num_open.rlim_max));
-    if(!fd) {
-      fprintf(stderr, "fd, malloc() failed\n");
-      num_open.rlim_max /= 2;
+    tutil_rlim2str(strbuff, sizeof(strbuff), t537_num_open.rlim_max);
+    curl_mfprintf(stderr, "allocating array for %s file descriptors\n",
+                  strbuff);
+
+    t537_testfd = curlx_malloc(sizeof(*t537_testfd) *
+                               (size_t)(t537_num_open.rlim_max));
+    if(!t537_testfd) {
+      curl_mfprintf(stderr, "testfd, malloc() failed\n");
+      t537_num_open.rlim_max /= 2;
     }
-  } while(num_open.rlim_max && !fd);
-  if(!fd) {
-    store_errmsg("fd, malloc() failed", errno);
-    fprintf(stderr, "%s\n", msgbuff);
-    free(memchunk);
+  } while(t537_num_open.rlim_max && !t537_testfd);
+  if(!t537_testfd) {
+    t537_store_errmsg("testfd, malloc() failed", errno);
+    curl_mfprintf(stderr, "%s\n", t537_msgbuff);
+    curlx_free(memchunk);
     return -6;
   }
 
   /* initialize it to fight lazy allocation */
 
-  fprintf(stderr, "initializing fd array\n");
+  curl_mfprintf(stderr, "initializing testfd array\n");
 
-  for(num_open.rlim_cur = 0;
-      num_open.rlim_cur < num_open.rlim_max;
-      num_open.rlim_cur++)
-    fd[num_open.rlim_cur] = -1;
+  for(t537_num_open.rlim_cur = 0;
+      t537_num_open.rlim_cur < t537_num_open.rlim_max;
+      t537_num_open.rlim_cur++)
+    t537_testfd[t537_num_open.rlim_cur] = -1;
 
-  msnprintf(strbuff, sizeof(strbuff), fmt, num_open.rlim_max);
-  fprintf(stderr, "trying to open %s file descriptors\n", strbuff);
+  tutil_rlim2str(strbuff, sizeof(strbuff), t537_num_open.rlim_max);
+  curl_mfprintf(stderr, "trying to open %s file descriptors\n", strbuff);
 
   /* open a dummy descriptor */
 
-  fd[0] = open(DEV_NULL, O_RDONLY);
-  if(fd[0] < 0) {
-    msnprintf(strbuff, sizeof(strbuff), "opening of %s failed", DEV_NULL);
-    store_errmsg(strbuff, errno);
-    fprintf(stderr, "%s\n", msgbuff);
-    free(fd);
-    fd = NULL;
-    free(memchunk);
+  t537_testfd[0] = curlx_open(DEV_NULL, O_RDONLY);
+  if(t537_testfd[0] < 0) {
+    curl_msnprintf(strbuff, sizeof(strbuff), "opening of %s failed", DEV_NULL);
+    t537_store_errmsg(strbuff, errno);
+    curl_mfprintf(stderr, "%s\n", t537_msgbuff);
+    curlx_safefree(t537_testfd);
+    curlx_free(memchunk);
     return -7;
   }
 
   /* create a bunch of file descriptors */
 
-  for(num_open.rlim_cur = 1;
-      num_open.rlim_cur < num_open.rlim_max;
-      num_open.rlim_cur++) {
+  for(t537_num_open.rlim_cur = 1;
+      t537_num_open.rlim_cur < t537_num_open.rlim_max;
+      t537_num_open.rlim_cur++) {
 
-    fd[num_open.rlim_cur] = dup(fd[0]);
+    t537_testfd[t537_num_open.rlim_cur] = dup(t537_testfd[0]);
 
-    if(fd[num_open.rlim_cur] < 0) {
+    if(t537_testfd[t537_num_open.rlim_cur] < 0) {
 
-      fd[num_open.rlim_cur] = -1;
+      t537_testfd[t537_num_open.rlim_cur] = -1;
 
-      msnprintf(strbuff1, sizeof(strbuff1), fmt, num_open.rlim_cur);
-      msnprintf(strbuff, sizeof(strbuff), "dup() attempt %s failed", strbuff1);
-      fprintf(stderr, "%s\n", strbuff);
+      tutil_rlim2str(strbuff1, sizeof(strbuff1), t537_num_open.rlim_cur);
+      curl_msnprintf(strbuff, sizeof(strbuff), "dup() attempt %s failed",
+                     strbuff1);
+      curl_mfprintf(stderr, "%s\n", strbuff);
 
-      msnprintf(strbuff1, sizeof(strbuff1), fmt, num_open.rlim_cur);
-      msnprintf(strbuff, sizeof(strbuff), "fds system limit seems close to %s",
-                strbuff1);
-      fprintf(stderr, "%s\n", strbuff);
+      tutil_rlim2str(strbuff1, sizeof(strbuff1), t537_num_open.rlim_cur);
+      curl_msnprintf(strbuff, sizeof(strbuff),
+                     "fds system limit seems close to %s", strbuff1);
+      curl_mfprintf(stderr, "%s\n", strbuff);
 
-      num_open.rlim_max = num_open.rlim_cur - SAFETY_MARGIN;
+      t537_num_open.rlim_max = t537_num_open.rlim_cur - T537_SAFETY_MARGIN;
 
-      num_open.rlim_cur -= num_open.rlim_max;
-      msnprintf(strbuff1, sizeof(strbuff1), fmt, num_open.rlim_cur);
-      msnprintf(strbuff, sizeof(strbuff), "closing %s file descriptors",
-                strbuff1);
-      fprintf(stderr, "%s\n", strbuff);
+      t537_num_open.rlim_cur -= t537_num_open.rlim_max;
+      tutil_rlim2str(strbuff1, sizeof(strbuff1), t537_num_open.rlim_cur);
+      curl_msnprintf(strbuff, sizeof(strbuff), "closing %s file descriptors",
+                     strbuff1);
+      curl_mfprintf(stderr, "%s\n", strbuff);
 
-      for(num_open.rlim_cur = num_open.rlim_max;
-          fd[num_open.rlim_cur] >= 0;
-          num_open.rlim_cur++) {
-        close(fd[num_open.rlim_cur]);
-        fd[num_open.rlim_cur] = -1;
+      for(t537_num_open.rlim_cur = t537_num_open.rlim_max;
+          t537_testfd[t537_num_open.rlim_cur] >= 0;
+          t537_num_open.rlim_cur++) {
+        curlx_close(t537_testfd[t537_num_open.rlim_cur]);
+        t537_testfd[t537_num_open.rlim_cur] = -1;
       }
 
-      msnprintf(strbuff, sizeof(strbuff), fmt, num_open.rlim_max);
-      fprintf(stderr, "shrinking array for %s file descriptors\n", strbuff);
+      tutil_rlim2str(strbuff, sizeof(strbuff), t537_num_open.rlim_max);
+      curl_mfprintf(stderr, "shrinking array for %s file descriptors\n",
+                    strbuff);
 
-      /* we don't care if we can't shrink it */
+      /* we do not care if we cannot shrink it */
 
-      tmpfd = realloc(fd, sizeof(*fd) * (size_t)(num_open.rlim_max));
+      tmpfd = curlx_realloc(t537_testfd,
+                            sizeof(*t537_testfd) *
+                            (size_t)(t537_num_open.rlim_max));
       if(tmpfd) {
-        fd = tmpfd;
+        t537_testfd = tmpfd;
         tmpfd = NULL;
       }
 
       break;
-
     }
-
   }
 
-  msnprintf(strbuff, sizeof(strbuff), fmt, num_open.rlim_max);
-  fprintf(stderr, "%s file descriptors open\n", strbuff);
-
-#if !defined(HAVE_POLL_FINE) && !defined(USE_WINSOCK)
+  tutil_rlim2str(strbuff, sizeof(strbuff), t537_num_open.rlim_max);
+  curl_mfprintf(stderr, "%s file descriptors open\n", strbuff);
 
+#if !defined(HAVE_POLL) && !defined(USE_WINSOCK)
   /*
    * when using select() instead of poll() we cannot test
    * libcurl functionality with a socket number equal or
    * greater than FD_SETSIZE. In any case, macro VERIFY_SOCK
    * in lib/select.c enforces this check and protects libcurl
    * from a possible crash. The effect of this protection
-   * is that test 537 will always fail, since the actual
+   * is that test 537 always fails, since the actual
    * call to select() never takes place. We skip test 537
    * with an indication that select limit would be exceeded.
    */
 
-  num_open.rlim_cur = FD_SETSIZE - SAFETY_MARGIN;
-  if(num_open.rlim_max > num_open.rlim_cur) {
-    msnprintf(strbuff, sizeof(strbuff), "select limit is FD_SETSIZE %d",
-              FD_SETSIZE);
-    store_errmsg(strbuff, 0);
-    fprintf(stderr, "%s\n", msgbuff);
-    close_file_descriptors();
-    free(memchunk);
+  t537_num_open.rlim_cur = FD_SETSIZE - T537_SAFETY_MARGIN;
+  if(t537_num_open.rlim_max > t537_num_open.rlim_cur) {
+    curl_msnprintf(strbuff, sizeof(strbuff), "select limit is FD_SETSIZE %d",
+                   FD_SETSIZE);
+    t537_store_errmsg(strbuff, 0);
+    curl_mfprintf(stderr, "%s\n", t537_msgbuff);
+    t537_close_file_descriptors();
+    curlx_free(memchunk);
     return -8;
   }
 
-  num_open.rlim_cur = FD_SETSIZE - SAFETY_MARGIN;
+  t537_num_open.rlim_cur = FD_SETSIZE - T537_SAFETY_MARGIN;
   for(rl.rlim_cur = 0;
-      rl.rlim_cur < num_open.rlim_max;
+      rl.rlim_cur < t537_num_open.rlim_max;
       rl.rlim_cur++) {
-    if((fd[rl.rlim_cur] > 0) &&
-       ((unsigned int)fd[rl.rlim_cur] > num_open.rlim_cur)) {
-      msnprintf(strbuff, sizeof(strbuff), "select limit is FD_SETSIZE %d",
-                FD_SETSIZE);
-      store_errmsg(strbuff, 0);
-      fprintf(stderr, "%s\n", msgbuff);
-      close_file_descriptors();
-      free(memchunk);
+    if((t537_testfd[rl.rlim_cur] > 0) &&
+       ((unsigned int)t537_testfd[rl.rlim_cur] > t537_num_open.rlim_cur)) {
+      curl_msnprintf(strbuff, sizeof(strbuff), "select limit is FD_SETSIZE %d",
+                     FD_SETSIZE);
+      t537_store_errmsg(strbuff, 0);
+      curl_mfprintf(stderr, "%s\n", t537_msgbuff);
+      t537_close_file_descriptors();
+      curlx_free(memchunk);
       return -9;
     }
   }
-
-#endif /* using a FD_SETSIZE bound select() */
+#endif /* !HAVE_POLL && !USE_WINSOCK */
 
   /*
    * Old or 'backwards compatible' implementations of stdio do not allow
@@ -434,47 +400,48 @@ static int rlimit(int keep_open)
    * if it is capable of fopen()ing some additional files.
    */
 
-  if(!fopen_works()) {
-    msnprintf(strbuff1, sizeof(strbuff1), fmt, num_open.rlim_max);
-    msnprintf(strbuff, sizeof(strbuff), "fopen fails with %s fds open",
-              strbuff1);
-    fprintf(stderr, "%s\n", msgbuff);
-    msnprintf(strbuff, sizeof(strbuff), "fopen fails with lots of fds open");
-    store_errmsg(strbuff, 0);
-    close_file_descriptors();
-    free(memchunk);
+  if(!t537_fopen_works()) {
+    tutil_rlim2str(strbuff1, sizeof(strbuff1), t537_num_open.rlim_max);
+    curl_msnprintf(strbuff, sizeof(strbuff), "fopen fails with %s fds open",
+                   strbuff1);
+    curl_mfprintf(stderr, "%s\n", t537_msgbuff);
+    curl_msnprintf(strbuff, sizeof(strbuff),
+                   "fopen fails with lots of fds open");
+    t537_store_errmsg(strbuff, 0);
+    t537_close_file_descriptors();
+    curlx_free(memchunk);
     return -10;
   }
 
   /* free the chunk of memory we were reserving so that it
-     becomes becomes available to the test */
+     becomes available to the test */
 
-  free(memchunk);
+  curlx_free(memchunk);
 
   /* close file descriptors unless instructed to keep them */
 
   if(!keep_open) {
-    close_file_descriptors();
+    t537_close_file_descriptors();
   }
 
   return 0;
 }
 
-int test(char *URL)
+static CURLcode test_lib537(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
 
   if(!strcmp(URL, "check")) {
     /* used by the test script to ask if we can run this test or not */
-    if(rlimit(FALSE)) {
-      fprintf(stdout, "rlimit problem: %s\n", msgbuff);
-      return 1;
+    if(t537_test_rlimit(FALSE)) {
+      curl_mfprintf(stdout, "test_rlimit problem: %s\n", t537_msgbuff);
+      return TEST_ERR_FAILURE;
     }
-    return 0; /* sure, run this! */
+    return CURLE_OK; /* sure, run this! */
   }
 
-  if(rlimit(TRUE)) {
+  if(t537_test_rlimit(TRUE)) {
     /* failure */
     return TEST_ERR_MAJOR_BAD;
   }
@@ -483,40 +450,40 @@ int test(char *URL)
      and close them all once the test is over */
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
-    close_file_descriptors();
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    t537_close_file_descriptors();
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
-    close_file_descriptors();
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    t537_close_file_descriptors();
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
-  close_file_descriptors();
+  t537_close_file_descriptors();
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
 
-#else /* defined(HAVE_GETRLIMIT) && defined(HAVE_SETRLIMIT) */
+#else /* HAVE_GETRLIMIT && HAVE_SETRLIMIT */
 
-int test(char *URL)
+static CURLcode test_lib537(const char *URL)
 {
   (void)URL;
-  printf("system lacks necessary system function(s)");
-  return 1; /* skip test */
+  curl_mprintf("system lacks necessary system function(s)");
+  return TEST_ERR_MAJOR_BAD; /* skip test */
 }
 
-#endif /* defined(HAVE_GETRLIMIT) && defined(HAVE_SETRLIMIT) */
+#endif /* HAVE_GETRLIMIT && HAVE_SETRLIMIT */
diff --git a/third-party/curl/tests/libtest/lib539.c b/third-party/curl/tests/libtest/lib539.c
index 75f146c002..b6719ea53a 100644
--- a/third-party/curl/tests/libtest/lib539.c
+++ b/third-party/curl/tests/libtest/lib539.c
@@ -21,73 +21,64 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib539(const char *URL)
 {
-   CURLcode res;
-   CURL *curl;
-   char *newURL = NULL;
-   struct curl_slist *slist = NULL;
+  CURLcode result;
+  CURL *curl;
+  char *newURL = NULL;
+  struct curl_slist *slist = NULL;
 
-   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-     fprintf(stderr, "curl_global_init() failed\n");
-     return TEST_ERR_MAJOR_BAD;
-   }
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
 
-   curl = curl_easy_init();
-   if(!curl) {
-     fprintf(stderr, "curl_easy_init() failed\n");
-     curl_global_cleanup();
-     return TEST_ERR_MAJOR_BAD;
-   }
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
 
-   /*
-    * Begin with curl set to use a single CWD to the URL's directory.
-    */
-   test_setopt(curl, CURLOPT_URL, URL);
-   test_setopt(curl, CURLOPT_VERBOSE, 1L);
-   test_setopt(curl, CURLOPT_FTP_FILEMETHOD, (long) CURLFTPMETHOD_SINGLECWD);
+  /*
+   * Begin with curl set to use a single CWD to the URL's directory.
+   */
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_FTP_FILEMETHOD, CURLFTPMETHOD_SINGLECWD);
 
-   res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
+  if(result == CURLE_OK) {
+    /*
+     * Change the FTP_FILEMETHOD option to use full paths rather than a CWD
+     * command. Use an innocuous QUOTE command, after which curl does CWD to
+     * ftp_conn->entrypath and then (on the next call to ftp_statemach_act)
+     * find a non-zero ftpconn->dirdepth even though no directories are stored
+     * in the ftpconn->dirs array (after a call to freedirs).
+     */
 
-   /*
-    * Change the FTP_FILEMETHOD option to use full paths rather than a CWD
-    * command.  Alter the URL's path a bit, appending a "./".  Use an innocuous
-    * QUOTE command, after which curl will CWD to ftp_conn->entrypath and then
-    * (on the next call to ftp_statemach_act) find a non-zero ftpconn->dirdepth
-    * even though no directories are stored in the ftpconn->dirs array (after a
-    * call to freedirs).
-    */
-   newURL = aprintf("%s./", URL);
-   if(!newURL) {
-     curl_easy_cleanup(curl);
-     curl_global_cleanup();
-     return TEST_ERR_MAJOR_BAD;
-   }
+    slist = curl_slist_append(NULL, "SYST");
+    if(!slist) {
+      curl_free(newURL);
+      curl_easy_cleanup(curl);
+      curl_global_cleanup();
+      return TEST_ERR_MAJOR_BAD;
+    }
 
-   slist = curl_slist_append(NULL, "SYST");
-   if(!slist) {
-     curl_free(newURL);
-     curl_easy_cleanup(curl);
-     curl_global_cleanup();
-     return TEST_ERR_MAJOR_BAD;
-   }
-
-   test_setopt(curl, CURLOPT_URL, newURL);
-   test_setopt(curl, CURLOPT_FTP_FILEMETHOD, (long) CURLFTPMETHOD_NOCWD);
-   test_setopt(curl, CURLOPT_QUOTE, slist);
-
-   res = curl_easy_perform(curl);
+    easy_setopt(curl, CURLOPT_URL, libtest_arg2);
+    easy_setopt(curl, CURLOPT_FTP_FILEMETHOD, CURLFTPMETHOD_NOCWD);
+    easy_setopt(curl, CURLOPT_QUOTE, slist);
 
+    result = curl_easy_perform(curl);
+  }
 test_cleanup:
 
-   curl_slist_free_all(slist);
-   curl_free(newURL);
-   curl_easy_cleanup(curl);
-   curl_global_cleanup();
+  curl_slist_free_all(slist);
+  curl_free(newURL);
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
 
-   return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib540.c b/third-party/curl/tests/libtest/lib540.c
index 88007c4f1f..ec9d3da7c9 100644
--- a/third-party/curl/tests/libtest/lib540.c
+++ b/third-party/curl/tests/libtest/lib540.c
@@ -27,125 +27,119 @@
  * argv1 = URL
  * argv2 = proxy
  * argv3 = proxyuser:password
- * argv4 = host name to use for the custom Host: header
+ * argv4 = hostname to use for the custom Host: header
  */
 
-#include "test.h"
+#include "first.h"
 
-#include <limits.h>
+static CURL *t540_curl[2];
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
-
-#define PROXY libtest_arg2
-#define PROXYUSERPWD libtest_arg3
-#define HOST test_argv[4]
-
-#define NUM_HANDLES 2
-
-static CURL *eh[NUM_HANDLES];
-
-static int init(int num, CURLM *cm, const char *url, const char *userpwd,
-                struct curl_slist *headers)
+static CURLcode init(int num, CURLM *multi, const char *url,
+                     const char *userpwd, struct curl_slist *headers)
 {
-  int res = 0;
+  CURLcode result = CURLE_OK;
 
-  res_easy_init(eh[num]);
-  if(res)
+  const char *proxy = libtest_arg2;
+
+  res_easy_init(t540_curl[num]);
+  if(result)
     goto init_failed;
 
-  res_easy_setopt(eh[num], CURLOPT_URL, url);
-  if(res)
+  res_easy_setopt(t540_curl[num], CURLOPT_URL, url);
+  if(result)
     goto init_failed;
 
-  res_easy_setopt(eh[num], CURLOPT_PROXY, PROXY);
-  if(res)
+  res_easy_setopt(t540_curl[num], CURLOPT_PROXY, proxy);
+  if(result)
     goto init_failed;
 
-  res_easy_setopt(eh[num], CURLOPT_PROXYUSERPWD, userpwd);
-  if(res)
+  res_easy_setopt(t540_curl[num], CURLOPT_PROXYUSERPWD, userpwd);
+  if(result)
     goto init_failed;
 
-  res_easy_setopt(eh[num], CURLOPT_PROXYAUTH, (long)CURLAUTH_ANY);
-  if(res)
+  res_easy_setopt(t540_curl[num], CURLOPT_PROXYAUTH, CURLAUTH_ANY);
+  if(result)
     goto init_failed;
 
-  res_easy_setopt(eh[num], CURLOPT_VERBOSE, 1L);
-  if(res)
+  res_easy_setopt(t540_curl[num], CURLOPT_VERBOSE, 1L);
+  if(result)
     goto init_failed;
 
-  res_easy_setopt(eh[num], CURLOPT_HEADER, 1L);
-  if(res)
+  res_easy_setopt(t540_curl[num], CURLOPT_HEADER, 1L);
+  if(result)
     goto init_failed;
 
-  res_easy_setopt(eh[num], CURLOPT_HTTPHEADER, headers); /* custom Host: */
-  if(res)
+  /* custom Host: */
+  res_easy_setopt(t540_curl[num], CURLOPT_HTTPHEADER, headers);
+  if(result)
     goto init_failed;
 
-  res_multi_add_handle(cm, eh[num]);
-  if(res)
+  res_multi_add_handle(multi, t540_curl[num]);
+  if(result)
     goto init_failed;
 
-  return 0; /* success */
+  return CURLE_OK; /* success */
 
 init_failed:
 
-  curl_easy_cleanup(eh[num]);
-  eh[num] = NULL;
+  curl_easy_cleanup(t540_curl[num]);
+  t540_curl[num] = NULL;
 
-  return res; /* failure */
+  return result; /* failure */
 }
 
-static int loop(int num, CURLM *cm, const char *url, const char *userpwd,
-                struct curl_slist *headers)
+static CURLcode loop(int num, CURLM *multi, const char *url,
+                     const char *userpwd, struct curl_slist *headers)
 {
   CURLMsg *msg;
   long L;
   int Q, U = -1;
   fd_set R, W, E;
   struct timeval T;
-  int res = 0;
+  CURLcode result = CURLE_OK;
 
-  res = init(num, cm, url, userpwd, headers);
-  if(res)
-    return res;
+  result = init(num, multi, url, userpwd, headers);
+  if(result)
+    return result;
 
   while(U) {
 
     int M = -99;
 
-    res_multi_perform(cm, &U);
-    if(res)
-      return res;
+    res_multi_perform(multi, &U);
+    if(result)
+      return result;
 
     res_test_timedout();
-    if(res)
-      return res;
+    if(result)
+      return result;
 
     if(U) {
       FD_ZERO(&R);
       FD_ZERO(&W);
       FD_ZERO(&E);
 
-      res_multi_fdset(cm, &R, &W, &E, &M);
-      if(res)
-        return res;
+      res_multi_fdset(multi, &R, &W, &E, &M);
+      if(result)
+        return result;
 
       /* At this point, M is guaranteed to be greater or equal than -1. */
 
-      res_multi_timeout(cm, &L);
-      if(res)
-        return res;
+      res_multi_timeout(multi, &L);
+      if(result)
+        return result;
 
       /* At this point, L is guaranteed to be greater or equal than -1. */
 
       if(L != -1) {
-        int itimeout = (L > (long)INT_MAX) ? INT_MAX : (int)L;
-        T.tv_sec = itimeout/1000;
-        T.tv_usec = (itimeout%1000)*1000;
+        int itimeout;
+#if LONG_MAX > INT_MAX
+        itimeout = (L > INT_MAX) ? INT_MAX : (int)L;
+#else
+        itimeout = (int)L;
+#endif
+        T.tv_sec = itimeout / 1000;
+        T.tv_usec = (itimeout % 1000) * 1000;
       }
       else {
         T.tv_sec = 5;
@@ -153,99 +147,103 @@ static int loop(int num, CURLM *cm, const char *url, const char *userpwd,
       }
 
       res_select_test(M + 1, &R, &W, &E, &T);
-      if(res)
-        return res;
+      if(result)
+        return result;
     }
 
     while(1) {
-      msg = curl_multi_info_read(cm, &Q);
+      msg = curl_multi_info_read(multi, &Q);
       if(!msg)
         break;
       if(msg->msg == CURLMSG_DONE) {
-        int i;
-        CURL *e = msg->easy_handle;
-        fprintf(stderr, "R: %d - %s\n", (int)msg->data.result,
-                curl_easy_strerror(msg->data.result));
-        curl_multi_remove_handle(cm, e);
-        curl_easy_cleanup(e);
-        for(i = 0; i < NUM_HANDLES; i++) {
-          if(eh[i] == e) {
-            eh[i] = NULL;
+        size_t i;
+        CURL *curl = msg->easy_handle;
+        curl_mfprintf(stderr, "R: %d - %s\n", (int)msg->data.result,
+                      curl_easy_strerror(msg->data.result));
+        curl_multi_remove_handle(multi, curl);
+        curl_easy_cleanup(curl);
+        for(i = 0; i < CURL_ARRAYSIZE(t540_curl); i++) {
+          if(t540_curl[i] == curl) {
+            t540_curl[i] = NULL;
             break;
           }
         }
       }
       else
-        fprintf(stderr, "E: CURLMsg (%d)\n", (int)msg->msg);
+        curl_mfprintf(stderr, "E: CURLMsg (%d)\n", (int)msg->msg);
     }
 
     res_test_timedout();
-    if(res)
-      return res;
+    if(result)
+      return result;
   }
 
-  return 0; /* success */
+  return CURLE_OK;
 }
 
-int test(char *URL)
+static CURLcode test_lib540(const char *URL)
 {
-  CURLM *cm = NULL;
+  CURLM *multi = NULL;
   struct curl_slist *headers = NULL;
   char buffer[246]; /* naively fixed-size */
-  int res = 0;
-  int i;
+  CURLcode result = CURLE_OK;
+  size_t i;
 
-  for(i = 0; i < NUM_HANDLES; i++)
-    eh[i] = NULL;
+  const char *proxyuserpws = libtest_arg3;
+  const char *host;
+
+  for(i = 0; i < CURL_ARRAYSIZE(t540_curl); i++)
+    t540_curl[i] = NULL;
 
   start_test_timing();
 
   if(test_argc < 4)
-    return 99;
+    return TEST_ERR_MAJOR_BAD;
 
-  msnprintf(buffer, sizeof(buffer), "Host: %s", HOST);
+  host = test_argv[4];
+  curl_msnprintf(buffer, sizeof(buffer), "Host: %s", host);
 
   /* now add a custom Host: header */
   headers = curl_slist_append(headers, buffer);
   if(!headers) {
-    fprintf(stderr, "curl_slist_append() failed\n");
+    curl_mfprintf(stderr, "curl_slist_append() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   res_global_init(CURL_GLOBAL_ALL);
-  if(res) {
+  if(result) {
     curl_slist_free_all(headers);
-    return res;
+    return result;
   }
 
-  res_multi_init(cm);
-  if(res) {
+  res_multi_init(multi);
+  if(result) {
     curl_global_cleanup();
     curl_slist_free_all(headers);
-    return res;
+    return result;
   }
 
-  res = loop(0, cm, URL, PROXYUSERPWD, headers);
-  if(res)
+  result = loop(0, multi, URL, proxyuserpws, headers);
+  if(result)
     goto test_cleanup;
 
-  fprintf(stderr, "lib540: now we do the request again\n");
+  curl_mfprintf(stderr, "lib540: now we do the request again\n");
 
-  res = loop(1, cm, URL, PROXYUSERPWD, headers);
+  result = loop(1, multi, URL, proxyuserpws, headers);
 
 test_cleanup:
 
   /* proper cleanup sequence - type PB */
 
-  for(i = 0; i < NUM_HANDLES; i++) {
-    curl_multi_remove_handle(cm, eh[i]);
-    curl_easy_cleanup(eh[i]);
+  for(i = 0; i < CURL_ARRAYSIZE(t540_curl); i++) {
+    curl_multi_remove_handle(multi, t540_curl[i]);
+    curl_easy_cleanup(t540_curl[i]);
   }
 
-  curl_multi_cleanup(cm);
+  curl_multi_cleanup(multi);
   curl_global_cleanup();
 
   curl_slist_free_all(headers);
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib541.c b/third-party/curl/tests/libtest/lib541.c
index fdddae2c75..35e9d5a0cd 100644
--- a/third-party/curl/tests/libtest/lib541.c
+++ b/third-party/curl/tests/libtest/lib541.c
@@ -21,97 +21,94 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#ifdef HAVE_FCNTL_H
-#include <fcntl.h>
-#endif
-
-#include "memdebug.h"
+#include "first.h"
 
 /*
  * Two FTP uploads, the second with no content sent.
  */
 
-int test(char *URL)
+static CURLcode test_lib541(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
+  char errbuf[STRERROR_LEN];
   FILE *hd_src;
   int hd;
-  struct_stat file_info;
+  curlx_struct_stat file_info;
 
   if(!libtest_arg2) {
-    fprintf(stderr, "Usage: <url> <file-to-upload>\n");
+    curl_mfprintf(stderr, "Usage: <url> <file-to-upload>\n");
     return TEST_ERR_USAGE;
   }
 
-  hd_src = fopen(libtest_arg2, "rb");
+  hd_src = curlx_fopen(libtest_arg2, "rb");
   if(!hd_src) {
-    fprintf(stderr, "fopen failed with error: %d %s\n",
-            errno, strerror(errno));
-    fprintf(stderr, "Error opening file: %s\n", libtest_arg2);
-    return -2; /* if this happens things are major weird */
+    curl_mfprintf(stderr, "fopen() failed with error (%d) %s\n",
+                  errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
+    curl_mfprintf(stderr, "Error opening file '%s'\n", libtest_arg2);
+    return TEST_ERR_MAJOR_BAD; /* if this happens things are major weird */
   }
 
   /* get the file size of the local file */
-  hd = fstat(fileno(hd_src), &file_info);
+  hd = curlx_fstat(fileno(hd_src), &file_info);
   if(hd == -1) {
-    /* can't open file, bail out */
-    fprintf(stderr, "fstat() failed with error: %d %s\n",
-            errno, strerror(errno));
-    fprintf(stderr, "ERROR: cannot open file %s\n", libtest_arg2);
-    fclose(hd_src);
+    /* cannot open file, bail out */
+    curl_mfprintf(stderr, "fstat() failed with error (%d) %s\n",
+                  errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
+    curl_mfprintf(stderr, "Error opening file '%s'\n", libtest_arg2);
+    curlx_fclose(hd_src);
     return TEST_ERR_MAJOR_BAD;
   }
 
   if(!file_info.st_size) {
-    fprintf(stderr, "ERROR: file %s has zero size!\n", libtest_arg2);
-    fclose(hd_src);
+    curl_mfprintf(stderr, "File %s has zero size!\n", libtest_arg2);
+    curlx_fclose(hd_src);
     return TEST_ERR_MAJOR_BAD;
   }
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
-    fclose(hd_src);
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    curlx_fclose(hd_src);
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* get a curl handle */
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
-    fclose(hd_src);
+    curlx_fclose(hd_src);
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* enable uploading */
-  test_setopt(curl, CURLOPT_UPLOAD, 1L);
+  easy_setopt(curl, CURLOPT_UPLOAD, 1L);
 
   /* enable verbose */
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* specify target */
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* now specify which file to upload */
-  test_setopt(curl, CURLOPT_READDATA, hd_src);
+  easy_setopt(curl, CURLOPT_READDATA, hd_src);
 
-  /* Now run off and do what you've been told! */
-  curl_easy_perform(curl);
+  /* Now run off and do what you have been told! */
+  result = curl_easy_perform(curl);
+  if(result)
+    goto test_cleanup;
 
   /* and now upload the exact same again, but without rewinding so it already
      is at end of file */
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
   /* close the local file */
-  fclose(hd_src);
+  curlx_fclose(hd_src);
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib542.c b/third-party/curl/tests/libtest/lib542.c
index 27429fd6cf..fe3eb9cd13 100644
--- a/third-party/curl/tests/libtest/lib542.c
+++ b/third-party/curl/tests/libtest/lib542.c
@@ -21,55 +21,49 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#ifdef HAVE_FCNTL_H
-#include <fcntl.h>
-#endif
-
-#include "memdebug.h"
+#include "first.h"
 
 /*
  * FTP get with NOBODY but no HEADER
  */
 
-int test(char *URL)
+static CURLcode test_lib542(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* get a curl handle */
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* enable verbose */
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* enable NOBODY */
-  test_setopt(curl, CURLOPT_NOBODY, 1L);
+  easy_setopt(curl, CURLOPT_NOBODY, 1L);
 
   /* disable HEADER */
-  test_setopt(curl, CURLOPT_HEADER, 0L);
+  easy_setopt(curl, CURLOPT_HEADER, 0L);
 
   /* specify target */
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
-  /* Now run off and do what you've been told! */
-  res = curl_easy_perform(curl);
+  /* Now run off and do what you have been told! */
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib543.c b/third-party/curl/tests/libtest/lib543.c
index 2bec2f1a6c..f112b89ccd 100644
--- a/third-party/curl/tests/libtest/lib543.c
+++ b/third-party/curl/tests/libtest/lib543.c
@@ -23,50 +23,49 @@
  ***************************************************************************/
 /* Based on Alex Fishman's bug report on September 30, 2007 */
 
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib543(const char *URL)
 {
   static const unsigned char a[] = {
-      0x9c, 0x26, 0x4b, 0x3d, 0x49, 0x4, 0xa1, 0x1,
-      0xe0, 0xd8, 0x7c,  0x20, 0xb7, 0xef, 0x53, 0x29, 0xfa,
-      0x1d, 0x57, 0xe1};
+    0x9c, 0x26, 0x4b, 0x3d, 0x49, 0x4, 0xa1, 0x1,
+    0xe0, 0xd8, 0x7c, 0x20, 0xb7, 0xef, 0x53, 0x29, 0xfa,
+    0x1d, 0x57, 0xe1
+  };
 
-  CURL *easy;
-  CURLcode res = CURLE_OK;
+  CURL *curl;
+  CURLcode result = CURLE_OK;
   (void)URL;
 
   global_init(CURL_GLOBAL_ALL);
-  easy = curl_easy_init();
-  if(!easy) {
-    fprintf(stderr, "curl_easy_init() failed\n");
-    res = TEST_ERR_MAJOR_BAD;
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    result = TEST_ERR_MAJOR_BAD;
   }
   else {
     int asize = (int)sizeof(a);
-    char *s = curl_easy_escape(easy, (const char *)a, asize);
+    char *s = curl_easy_escape(curl, (const char *)a, asize);
 
     if(s) {
-      printf("%s\n", s);
+      curl_mprintf("%s\n", s);
       curl_free(s);
     }
 
-    s = curl_easy_escape(easy, "", 0);
+    s = curl_easy_escape(curl, "", 0);
     if(s) {
-      printf("IN: '' OUT: '%s'\n", s);
+      curl_mprintf("IN: '' OUT: '%s'\n", s);
       curl_free(s);
     }
-    s = curl_easy_escape(easy, " 123", 3);
+    s = curl_easy_escape(curl, " 123", 3);
     if(s) {
-      printf("IN: ' 12' OUT: '%s'\n", s);
+      curl_mprintf("IN: ' 12' OUT: '%s'\n", s);
       curl_free(s);
     }
 
-    curl_easy_cleanup(easy);
+    curl_easy_cleanup(curl);
   }
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib544.c b/third-party/curl/tests/libtest/lib544.c
index 192bfb2e70..02dc11f39b 100644
--- a/third-party/curl/tests/libtest/lib544.c
+++ b/third-party/curl/tests/libtest/lib544.c
@@ -21,60 +21,60 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static char teststring[] =
-{   'T', 'h', 'i', 's', '\0', ' ', 'i', 's', ' ', 't', 'e', 's', 't', ' ',
-    'b', 'i', 'n', 'a', 'r', 'y', ' ', 'd', 'a', 't', 'a', ' ',
-    'w', 'i', 't', 'h', ' ', 'a', 'n', ' ',
-    'e', 'm', 'b', 'e', 'd', 'd', 'e', 'd', ' ', 'N', 'U', 'L'};
-
-int test(char *URL)
+static CURLcode test_lib544(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
+
+  static const char teststring_init[] = {
+    'T', 'h', 'i', 's', '\0', ' ', 'i', 's', ' ', 't', 'e', 's', 't', ' ',
+    'b', 'i', 'n', 'a', 'r', 'y', ' ', 'd', 'a', 't', 'a', ' ',
+    'w', 'i', 't', 'h', ' ', 'a', 'n', ' ',
+    'e', 'm', 'b', 'e', 'd', 'd', 'e', 'd', ' ', 'N', 'U', 'L'
+  };
+
+  char teststring[sizeof(teststring_init)];
+
+  memcpy(teststring, teststring_init, sizeof(teststring_init));
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
-#ifdef LIB545
-  test_setopt(curl, CURLOPT_POSTFIELDSIZE, (long) sizeof(teststring));
-#endif
+  if(testnum == 545)
+    easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)sizeof(teststring));
 
-  test_setopt(curl, CURLOPT_COPYPOSTFIELDS, teststring);
+  easy_setopt(curl, CURLOPT_COPYPOSTFIELDS, teststring);
 
-  test_setopt(curl, CURLOPT_VERBOSE, 1L); /* show verbose for debug */
-  test_setopt(curl, CURLOPT_HEADER, 1L); /* include header */
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L); /* show verbose for debug */
+  easy_setopt(curl, CURLOPT_HEADER, 1L); /* include header */
 
   /* Update the original data to detect non-copy. */
-  strcpy(teststring, "FAIL");
+  curlx_strcopy(teststring, sizeof(teststring), "FAIL", strlen("FAIL"));
 
-#ifdef LIB545
   {
-    CURL *handle2;
-    handle2 = curl_easy_duphandle(curl);
+    CURL *curl2;
+    curl2 = curl_easy_duphandle(curl);
     curl_easy_cleanup(curl);
 
-    curl = handle2;
+    curl = curl2;
   }
-#endif
 
   /* Now, this is a POST request with binary 0 embedded in POST data. */
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -82,5 +82,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib547.c b/third-party/curl/tests/libtest/lib547.c
index dbe657e9d3..e44c16b55b 100644
--- a/third-party/curl/tests/libtest/lib547.c
+++ b/third-party/curl/tests/libtest/lib547.c
@@ -26,102 +26,90 @@
  * argv3 = proxyuser:password
  */
 
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
+static const char t547_uploadthis[] = "this is the blurb we want to upload\n";
+static size_t const t547_datalen = sizeof(t547_uploadthis) - 1;
 
-#define UPLOADTHIS "this is the blurb we want to upload\n"
-
-#ifndef LIB548
-static size_t readcallback(char  *ptr,
-                           size_t size,
-                           size_t nmemb,
-                           void *clientp)
+static size_t t547_read_cb(char *ptr, size_t size, size_t nmemb, void *clientp)
 {
   int *counter = (int *)clientp;
 
   if(*counter) {
     /* only do this once and then require a clearing of this */
-    fprintf(stderr, "READ ALREADY DONE!\n");
+    curl_mfprintf(stderr, "READ ALREADY DONE!\n");
     return 0;
   }
   (*counter)++; /* bump */
 
-  if(size * nmemb > strlen(UPLOADTHIS)) {
-    fprintf(stderr, "READ!\n");
-    strcpy(ptr, UPLOADTHIS);
-    return strlen(UPLOADTHIS);
+  if(size * nmemb >= t547_datalen) {
+    curl_mfprintf(stderr, "READ!\n");
+    memcpy(ptr, t547_uploadthis, t547_datalen);
+    return t547_datalen;
   }
-  fprintf(stderr, "READ NOT FINE!\n");
+  curl_mfprintf(stderr, "READ NOT FINE!\n");
   return 0;
 }
-static curlioerr ioctlcallback(CURL *handle,
-                               int cmd,
-                               void *clientp)
+
+static curlioerr t547_ioctl_callback(CURL *curl, int cmd, void *clientp)
 {
   int *counter = (int *)clientp;
-  (void)handle; /* unused */
+  (void)curl;
   if(cmd == CURLIOCMD_RESTARTREAD) {
-    fprintf(stderr, "REWIND!\n");
+    curl_mfprintf(stderr, "REWIND!\n");
     *counter = 0; /* clear counter to make the read callback restart */
   }
   return CURLIOE_OK;
 }
 
-
-
-#endif
-
-int test(char *URL)
+static CURLcode test_lib547(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
-#ifndef LIB548
   int counter = 0;
-#endif
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_HEADER, 1L);
-#ifdef LIB548
-  /* set the data to POST with a mere pointer to a null-terminated string */
-  test_setopt(curl, CURLOPT_POSTFIELDS, UPLOADTHIS);
-#else
-  /* 547 style, which means reading the POST data from a callback */
-  CURL_IGNORE_DEPRECATION(
-    test_setopt(curl, CURLOPT_IOCTLFUNCTION, ioctlcallback);
-    test_setopt(curl, CURLOPT_IOCTLDATA, &counter);
-  )
-  test_setopt(curl, CURLOPT_READFUNCTION, readcallback);
-  test_setopt(curl, CURLOPT_READDATA, &counter);
-  /* We CANNOT do the POST fine without setting the size (or choose
-     chunked)! */
-  test_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(UPLOADTHIS));
-#endif
-  test_setopt(curl, CURLOPT_POST, 1L);
-  test_setopt(curl, CURLOPT_PROXY, libtest_arg2);
-  test_setopt(curl, CURLOPT_PROXYUSERPWD, libtest_arg3);
-  test_setopt(curl, CURLOPT_PROXYAUTH,
-                   (long) (CURLAUTH_NTLM | CURLAUTH_DIGEST | CURLAUTH_BASIC) );
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  if(testnum == 548) {
+    /* set the data to POST with a mere pointer to a null-terminated string */
+    easy_setopt(curl, CURLOPT_POSTFIELDS, t547_uploadthis);
+  }
+  else {
+    /* 547 style, which means reading the POST data from a callback */
+    easy_setopt(curl, CURLOPT_IOCTLFUNCTION, t547_ioctl_callback);
+    easy_setopt(curl, CURLOPT_IOCTLDATA, &counter);
 
-  res = curl_easy_perform(curl);
+    easy_setopt(curl, CURLOPT_READFUNCTION, t547_read_cb);
+    easy_setopt(curl, CURLOPT_READDATA, &counter);
+    /* We CANNOT do the POST fine without setting the size (or choose
+       chunked)! */
+    easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)t547_datalen);
+  }
+  easy_setopt(curl, CURLOPT_POST, 1L);
+  easy_setopt(curl, CURLOPT_PROXY, libtest_arg2);
+  easy_setopt(curl, CURLOPT_PROXYUSERPWD, libtest_arg3);
+  easy_setopt(curl, CURLOPT_PROXYAUTH,
+              CURLAUTH_BASIC | CURLAUTH_DIGEST | CURLAUTH_NTLM);
+
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib549.c b/third-party/curl/tests/libtest/lib549.c
index 8e91d93567..fb718988b2 100644
--- a/third-party/curl/tests/libtest/lib549.c
+++ b/third-party/curl/tests/libtest/lib549.c
@@ -26,42 +26,40 @@
  * argv3 = non-zero means ASCII transfer
  */
 
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib549(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_PROXY, libtest_arg2);
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_PROXY_TRANSFER_MODE, 1L);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_PROXY, libtest_arg2);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_PROXY_TRANSFER_MODE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
   if(libtest_arg3) {
-    /* enable ascii/text mode */
-    test_setopt(curl, CURLOPT_TRANSFERTEXT, 1L);
+    /* enable ASCII/text mode */
+    easy_setopt(curl, CURLOPT_TRANSFERTEXT, 1L);
   }
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib552.c b/third-party/curl/tests/libtest/lib552.c
index 8b70231b76..69222d217f 100644
--- a/third-party/curl/tests/libtest/lib552.c
+++ b/third-party/curl/tests/libtest/lib552.c
@@ -25,199 +25,95 @@
  * argv2 = proxy with embedded user+password
  */
 
-#include "test.h"
-
-#include "warnless.h"
-#include "memdebug.h"
-
-struct data {
-  char trace_ascii; /* 1 or 0 */
-};
-
-static
-void dump(const char *text,
-          FILE *stream, unsigned char *ptr, size_t size,
-          char nohex)
-{
-  size_t i;
-  size_t c;
-
-  unsigned int width = 0x10;
-
-  if(nohex)
-    /* without the hex output, we can fit more on screen */
-    width = 0x40;
-
-  fprintf(stream, "%s, %zu bytes (0x%zx)\n", text, size, size);
-
-  for(i = 0; i<size; i += width) {
-
-    fprintf(stream, "%04zx: ", i);
-
-    if(!nohex) {
-      /* hex not disabled, show it */
-      for(c = 0; c < width; c++)
-        if(i + c < size)
-          fprintf(stream, "%02x ", ptr[i + c]);
-        else
-          fputs("   ", stream);
-    }
-
-    for(c = 0; (c < width) && (i + c < size); c++) {
-      /* check for 0D0A; if found, skip past and start a new line of output */
-      if(nohex && (i + c + 1 < size) && ptr[i + c] == 0x0D &&
-         ptr[i + c + 1] == 0x0A) {
-        i += (c + 2 - width);
-        break;
-      }
-      fprintf(stream, "%c",
-              (ptr[i + c] >= 0x20) && (ptr[i + c]<0x80)? ptr[i + c] : '.');
-      /* check again for 0D0A, to avoid an extra \n if it's at width */
-      if(nohex && (i + c + 2 < size) && ptr[i + c + 1] == 0x0D &&
-         ptr[i + c + 2] == 0x0A) {
-        i += (c + 3 - width);
-        break;
-      }
-    }
-    fputc('\n', stream); /* newline */
-  }
-  fflush(stream);
-}
-
-static
-int my_trace(CURL *handle, curl_infotype type,
-             char *data, size_t size,
-             void *userp)
-{
-  struct data *config = (struct data *)userp;
-  const char *text;
-  (void)handle; /* prevent compiler warning */
-
-  switch(type) {
-  case CURLINFO_TEXT:
-    fprintf(stderr, "== Info: %s", (char *)data);
-    /* FALLTHROUGH */
-  default: /* in case a new one is introduced to shock us */
-    return 0;
-
-  case CURLINFO_HEADER_OUT:
-    text = "=> Send header";
-    break;
-  case CURLINFO_DATA_OUT:
-    text = "=> Send data";
-    break;
-  case CURLINFO_SSL_DATA_OUT:
-    text = "=> Send SSL data";
-    break;
-  case CURLINFO_HEADER_IN:
-    text = "<= Recv header";
-    break;
-  case CURLINFO_DATA_IN:
-    text = "<= Recv data";
-    break;
-  case CURLINFO_SSL_DATA_IN:
-    text = "<= Recv SSL data";
-    break;
-  }
-
-  dump(text, stderr, (unsigned char *)data, size, config->trace_ascii);
-  return 0;
-}
+#include "first.h"
 
+#include "testtrace.h"
 
 static size_t current_offset = 0;
 static char databuf[70000]; /* MUST be more than 64k OR
                                MAX_INITIAL_POST_SIZE */
 
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *stream)
+static size_t t552_read_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
-  size_t  amount = nmemb * size; /* Total bytes curl wants */
-  size_t  available = sizeof(databuf) - current_offset; /* What we have to
-                                                           give */
-  size_t  given = amount < available ? amount : available; /* What is given */
+  size_t amount = nmemb * size; /* Total bytes curl wants */
+  size_t available = sizeof(databuf) - current_offset; /* What we have to
+                                                          give */
+  size_t given = amount < available ? amount : available; /* What is given */
   (void)stream;
   memcpy(ptr, databuf + current_offset, given);
   current_offset += given;
   return given;
 }
 
-
-static size_t write_callback(void *ptr, size_t size, size_t nmemb,
-                             void *stream)
+static size_t t552_write_cb(char *ptr, size_t size, size_t nmemb, void *stream)
 {
-  int amount = curlx_uztosi(size * nmemb);
-  printf("%.*s", amount, (char *)ptr);
+  size_t amount = size * nmemb;
+  curl_mprintf("%.*s", (int)amount, ptr);
   (void)stream;
-  return size * nmemb;
+  return amount;
 }
 
-
-static curlioerr ioctl_callback(CURL *handle, int cmd, void *clientp)
+static curlioerr ioctl_callback(CURL *curl, int cmd, void *clientp)
 {
   (void)clientp;
   if(cmd == CURLIOCMD_RESTARTREAD) {
-    printf("APPLICATION received a CURLIOCMD_RESTARTREAD request\n");
-    printf("APPLICATION ** REWINDING! **\n");
+    curl_mprintf("APPLICATION received a CURLIOCMD_RESTARTREAD request\n");
+    curl_mprintf("APPLICATION ** REWINDING! **\n");
     current_offset = 0;
     return CURLIOE_OK;
   }
-  (void)handle;
+  (void)curl;
   return CURLIOE_UNKNOWNCMD;
 }
 
-
-
-int test(char *URL)
+static CURLcode test_lib552(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
-  struct data config;
+  CURLcode result = CURLE_OK;
   size_t i;
   static const char fill[] = "test data";
 
-  config.trace_ascii = 1; /* enable ascii tracing */
+  debug_config.nohex = TRUE;
+  debug_config.tracetime = FALSE;
 
   global_init(CURL_GLOBAL_ALL);
   easy_init(curl);
 
-  test_setopt(curl, CURLOPT_DEBUGFUNCTION, my_trace);
-  test_setopt(curl, CURLOPT_DEBUGDATA, &config);
+  easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
+  easy_setopt(curl, CURLOPT_DEBUGDATA, &debug_config);
   /* the DEBUGFUNCTION has no effect until we enable VERBOSE */
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* setup repeated data string */
   for(i = 0; i < sizeof(databuf); ++i)
     databuf[i] = fill[i % sizeof(fill)];
 
   /* Post */
-  test_setopt(curl, CURLOPT_POST, 1L);
+  easy_setopt(curl, CURLOPT_POST, 1L);
 
   /* Setup read callback */
-  test_setopt(curl, CURLOPT_POSTFIELDSIZE, (long) sizeof(databuf));
-  test_setopt(curl, CURLOPT_READFUNCTION, read_callback);
+  easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)sizeof(databuf));
+  easy_setopt(curl, CURLOPT_READFUNCTION, t552_read_cb);
 
   /* Write callback */
-  test_setopt(curl, CURLOPT_WRITEFUNCTION, write_callback);
+  easy_setopt(curl, CURLOPT_WRITEFUNCTION, t552_write_cb);
 
   /* Ioctl function */
-  CURL_IGNORE_DEPRECATION(
-    test_setopt(curl, CURLOPT_IOCTLFUNCTION, ioctl_callback);
-  )
+  easy_setopt(curl, CURLOPT_IOCTLFUNCTION, ioctl_callback);
 
-  test_setopt(curl, CURLOPT_PROXY, libtest_arg2);
+  easy_setopt(curl, CURLOPT_PROXY, libtest_arg2);
 
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* Accept any auth. But for this bug configure proxy with DIGEST, basic
      might work too, not NTLM */
-  test_setopt(curl, CURLOPT_PROXYAUTH, (long)CURLAUTH_ANY);
+  easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_ANY);
 
-  res = curl_easy_perform(curl);
-  fprintf(stderr, "curl_easy_perform = %d\n", (int)res);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib553.c b/third-party/curl/tests/libtest/lib553.c
index f282c89500..dc812aa4a4 100644
--- a/third-party/curl/tests/libtest/lib553.c
+++ b/third-party/curl/tests/libtest/lib553.c
@@ -26,9 +26,7 @@
  * bug report #1871269, fixed on Jan 14 2008 before the 7.18.0 release.
  */
 
-#include "test.h"
-
-#include "memdebug.h"
+#include "first.h"
 
 #define POSTLEN 40960
 
@@ -52,35 +50,35 @@ static size_t myreadfunc(char *ptr, size_t size, size_t nmemb, void *stream)
   return size;
 }
 
-#define NUM_HEADERS 8
+#define NUM_HEADERS  8
 #define SIZE_HEADERS 5000
 
-static char buf[SIZE_HEADERS + 100];
-
-int test(char *URL)
+static CURLcode test_lib553(const char *URL)
 {
+  static char testbuf[SIZE_HEADERS + 100];
+
   CURL *curl;
-  CURLcode res = CURLE_FAILED_INIT;
+  CURLcode result = CURLE_FAILED_INIT;
   int i;
   struct curl_slist *headerlist = NULL, *hl;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   for(i = 0; i < NUM_HEADERS; i++) {
-    int len = msnprintf(buf, sizeof(buf), "Header%d: ", i);
-    memset(&buf[len], 'A', SIZE_HEADERS);
-    buf[len + SIZE_HEADERS] = 0; /* null-terminate */
-    hl = curl_slist_append(headerlist,  buf);
+    int len = curl_msnprintf(testbuf, sizeof(testbuf), "Header%d: ", i);
+    memset(&testbuf[len], 'A', SIZE_HEADERS);
+    testbuf[len + SIZE_HEADERS] = 0; /* null-terminate */
+    hl = curl_slist_append(headerlist, testbuf);
     if(!hl)
       goto test_cleanup;
     headerlist = hl;
@@ -91,15 +89,15 @@ int test(char *URL)
     goto test_cleanup;
   headerlist = hl;
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_HTTPHEADER, headerlist);
-  test_setopt(curl, CURLOPT_POST, 1L);
-  test_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)POSTLEN);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_HEADER, 1L);
-  test_setopt(curl, CURLOPT_READFUNCTION, myreadfunc);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, headerlist);
+  easy_setopt(curl, CURLOPT_POST, 1L);
+  easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)POSTLEN);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_READFUNCTION, myreadfunc);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -109,5 +107,5 @@ test_cleanup:
 
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib554.c b/third-party/curl/tests/libtest/lib554.c
index 1d049815cc..98a7ba7fdc 100644
--- a/third-party/curl/tests/libtest/lib554.c
+++ b/third-party/curl/tests/libtest/lib554.c
@@ -21,58 +21,55 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#define CURL_DISABLE_DEPRECATION  /* Using and testing the form api */
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static char data[]=
-  "this is what we post to the silly web server\n";
-
-struct WriteThis {
-  char *readptr;
+struct t554_WriteThis {
+  const char *readptr;
   size_t sizeleft;
 };
 
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t t554_read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
+{
+  struct t554_WriteThis *pooh = (struct t554_WriteThis *)userp;
+
+  if(size * nmemb < 1)
+    return 0;
+
+  if(pooh->sizeleft) {
+    *ptr = pooh->readptr[0];  /* copy one single byte */
+    pooh->readptr++;          /* advance pointer */
+    pooh->sizeleft--;         /* less data left */
+    return 1;                 /* we return 1 byte at a time! */
+  }
+
+  return 0;                   /* no more data left to deliver */
+}
+
+static size_t t587_read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
-#ifdef LIB587
   (void)ptr;
   (void)size;
   (void)nmemb;
   (void)userp;
   return CURL_READFUNC_ABORT;
-#else
-
-  struct WriteThis *pooh = (struct WriteThis *)userp;
-
-  if(size*nmemb < 1)
-    return 0;
-
-  if(pooh->sizeleft) {
-    *ptr = pooh->readptr[0]; /* copy one single byte */
-    pooh->readptr++;                 /* advance pointer */
-    pooh->sizeleft--;                /* less data left */
-    return 1;                        /* we return 1 byte at a time! */
-  }
-
-  return 0;                         /* no more data left to deliver */
-#endif
 }
 
-static int once(char *URL, bool oldstyle)
+static CURLcode t554_test_once(const char *URL, bool oldstyle)
 {
+  static const char testdata[] =
+    "this is what we post to the silly web server\n";
+
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
   CURLFORMcode formrc;
 
   struct curl_httppost *formpost = NULL;
   struct curl_httppost *lastptr = NULL;
-  struct WriteThis pooh;
-  struct WriteThis pooh2;
+  struct t554_WriteThis pooh;
+  struct t554_WriteThis pooh2;
 
-  pooh.readptr = data;
-  pooh.sizeleft = strlen(data);
+  pooh.readptr = testdata;
+  pooh.sizeleft = sizeof(testdata) - 1;
 
   /* Fill in the file upload field */
   if(oldstyle) {
@@ -91,18 +88,18 @@ static int once(char *URL, bool oldstyle)
                           CURLFORM_COPYNAME, "sendfile alternative",
                           CURLFORM_STREAM, &pooh,
                           CURLFORM_CONTENTLEN, (curl_off_t)pooh.sizeleft,
-                          CURLFORM_FILENAME, "file name 2",
+                          CURLFORM_FILENAME, "filename 2 ",
                           CURLFORM_END);
   }
 
   if(formrc)
-    printf("curl_formadd(1) = %d\n", (int)formrc);
+    curl_mprintf("curl_formadd(1) = %d\n", (int)formrc);
 
   /* Now add the same data with another name and make it not look like
      a file upload but still using the callback */
 
-  pooh2.readptr = data;
-  pooh2.sizeleft = strlen(data);
+  pooh2.readptr = testdata;
+  pooh2.sizeleft = sizeof(testdata) - 1;
 
   /* Fill in the file upload field */
   formrc = curl_formadd(&formpost,
@@ -113,7 +110,7 @@ static int once(char *URL, bool oldstyle)
                         CURLFORM_END);
 
   if(formrc)
-    printf("curl_formadd(2) = %d\n", (int)formrc);
+    curl_mprintf("curl_formadd(2) = %d\n", (int)formrc);
 
   /* Fill in the filename field */
   formrc = curl_formadd(&formpost,
@@ -121,9 +118,8 @@ static int once(char *URL, bool oldstyle)
                         CURLFORM_COPYNAME, "filename",
                         CURLFORM_COPYCONTENTS, "postit2.c",
                         CURLFORM_END);
-
   if(formrc)
-    printf("curl_formadd(3) = %d\n", (int)formrc);
+    curl_mprintf("curl_formadd(3) = %d\n", (int)formrc);
 
   /* Fill in a submit field too */
   formrc = curl_formadd(&formpost,
@@ -134,49 +130,54 @@ static int once(char *URL, bool oldstyle)
                         CURLFORM_END);
 
   if(formrc)
-    printf("curl_formadd(4) = %d\n", (int)formrc);
+    curl_mprintf("curl_formadd(4) = %d\n", (int)formrc);
 
   formrc = curl_formadd(&formpost, &lastptr,
                         CURLFORM_COPYNAME, "somename",
                         CURLFORM_BUFFER, "somefile.txt",
                         CURLFORM_BUFFERPTR, "blah blah",
-                        CURLFORM_BUFFERLENGTH, (long)9,
+                        CURLFORM_BUFFERLENGTH, 9L,
                         CURLFORM_END);
 
   if(formrc)
-    printf("curl_formadd(5) = %d\n", (int)formrc);
+    curl_mprintf("curl_formadd(5) = %d\n", (int)formrc);
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_formfree(formpost);
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* Now specify we want to POST data */
-  test_setopt(curl, CURLOPT_POST, 1L);
+  easy_setopt(curl, CURLOPT_POST, 1L);
 
   /* Set the expected POST size */
-  test_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)pooh.sizeleft);
+  easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)pooh.sizeleft);
 
   /* we want to use our own read function */
-  test_setopt(curl, CURLOPT_READFUNCTION, read_callback);
+  if(testnum == 587) {
+    easy_setopt(curl, CURLOPT_READFUNCTION, t587_read_cb);
+  }
+  else {
+    easy_setopt(curl, CURLOPT_READFUNCTION, t554_read_cb);
+  }
 
   /* send a multi-part formpost */
-  test_setopt(curl, CURLOPT_HTTPPOST, formpost);
+  easy_setopt(curl, CURLOPT_HTTPPOST, formpost);
 
   /* get verbose debug output please */
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* include headers in the output */
-  test_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-  /* Perform the request, res will get the return code */
-  res = curl_easy_perform(curl);
+  /* Perform the request, result gets the return code */
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -186,23 +187,23 @@ test_cleanup:
   /* now cleanup the formpost chain */
   curl_formfree(formpost);
 
-  return res;
+  return result;
 }
 
-int test(char *URL)
+static CURLcode test_lib554(const char *URL)
 {
-  int res;
+  CURLcode result;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
-  res = once(URL, TRUE); /* old */
-  if(!res)
-    res = once(URL, FALSE); /* new */
+  result = t554_test_once(URL, TRUE); /* old */
+  if(!result)
+    result = t554_test_once(URL, FALSE); /* new */
 
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib555.c b/third-party/curl/tests/libtest/lib555.c
index 6e3e30b137..9e11aae7d7 100644
--- a/third-party/curl/tests/libtest/lib555.c
+++ b/third-party/curl/tests/libtest/lib555.c
@@ -30,58 +30,48 @@
  * argv3 = proxyuser:password
  */
 
-#include "test.h"
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
+#include "first.h"
 
-#define TEST_HANG_TIMEOUT 60 * 1000
+static const char t555_uploadthis[] = "this is the blurb we want to upload\n";
+static size_t const t555_datalen = sizeof(t555_uploadthis) - 1;
 
-static const char uploadthis[] =
-  "this is the blurb we want to upload\n";
-
-static size_t readcallback(char  *ptr,
-                           size_t size,
-                           size_t nmemb,
-                           void *clientp)
+static size_t t555_read_cb(char *ptr, size_t size, size_t nmemb, void *clientp)
 {
   int *counter = (int *)clientp;
 
   if(*counter) {
     /* only do this once and then require a clearing of this */
-    fprintf(stderr, "READ ALREADY DONE!\n");
+    curl_mfprintf(stderr, "READ ALREADY DONE!\n");
     return 0;
   }
   (*counter)++; /* bump */
 
-  if(size * nmemb > strlen(uploadthis)) {
-    fprintf(stderr, "READ!\n");
-    strcpy(ptr, uploadthis);
-    return strlen(uploadthis);
+  if(size * nmemb >= t555_datalen) {
+    curl_mfprintf(stderr, "READ!\n");
+    memcpy(ptr, t555_uploadthis, t555_datalen);
+    return t555_datalen;
   }
-  fprintf(stderr, "READ NOT FINE!\n");
+  curl_mfprintf(stderr, "READ NOT FINE!\n");
   return 0;
 }
-static curlioerr ioctlcallback(CURL *handle,
-                               int cmd,
-                               void *clientp)
+
+static curlioerr t555_ioctl_callback(CURL *curl, int cmd, void *clientp)
 {
   int *counter = (int *)clientp;
-  (void)handle; /* unused */
+  (void)curl;
   if(cmd == CURLIOCMD_RESTARTREAD) {
-    fprintf(stderr, "REWIND!\n");
+    curl_mfprintf(stderr, "REWIND!\n");
     *counter = 0; /* clear counter to make the read callback restart */
   }
   return CURLIOE_OK;
 }
 
-
-int test(char *URL)
+static CURLcode test_lib555(const char *URL)
 {
-  int res = 0;
+  CURLcode result = CURLE_OK;
   CURL *curl = NULL;
   int counter = 0;
-  CURLM *m = NULL;
+  CURLM *multi = NULL;
   int running = 1;
 
   start_test_timing();
@@ -95,25 +85,24 @@ int test(char *URL)
   easy_setopt(curl, CURLOPT_HEADER, 1L);
 
   /* read the POST data from a callback */
-  CURL_IGNORE_DEPRECATION(
-    easy_setopt(curl, CURLOPT_IOCTLFUNCTION, ioctlcallback);
-    easy_setopt(curl, CURLOPT_IOCTLDATA, &counter);
-  )
-  easy_setopt(curl, CURLOPT_READFUNCTION, readcallback);
+  easy_setopt(curl, CURLOPT_IOCTLFUNCTION, t555_ioctl_callback);
+  easy_setopt(curl, CURLOPT_IOCTLDATA, &counter);
+
+  easy_setopt(curl, CURLOPT_READFUNCTION, t555_read_cb);
   easy_setopt(curl, CURLOPT_READDATA, &counter);
   /* We CANNOT do the POST fine without setting the size (or choose
      chunked)! */
-  easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(uploadthis));
+  easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)t555_datalen);
 
   easy_setopt(curl, CURLOPT_POST, 1L);
   easy_setopt(curl, CURLOPT_PROXY, libtest_arg2);
   easy_setopt(curl, CURLOPT_PROXYUSERPWD, libtest_arg3);
   easy_setopt(curl, CURLOPT_PROXYAUTH,
-                   (long) (CURLAUTH_NTLM | CURLAUTH_DIGEST | CURLAUTH_BASIC) );
+              CURLAUTH_BASIC | CURLAUTH_DIGEST | CURLAUTH_NTLM);
 
-  multi_init(m);
+  multi_init(multi);
 
-  multi_add_handle(m, curl);
+  multi_add_handle(multi, curl);
 
   while(running) {
     struct timeval timeout;
@@ -123,7 +112,7 @@ int test(char *URL)
     timeout.tv_sec = 0;
     timeout.tv_usec = 100000L; /* 100 ms */
 
-    multi_perform(m, &running);
+    multi_perform(multi, &running);
 
     abort_on_test_timeout();
 
@@ -134,7 +123,7 @@ int test(char *URL)
     FD_ZERO(&fdwrite);
     FD_ZERO(&fdexcep);
 
-    multi_fdset(m, &fdread, &fdwrite, &fdexcep, &maxfd);
+    multi_fdset(multi, &fdread, &fdwrite, &fdexcep, &maxfd);
 
     /* At this point, maxfd is guaranteed to be greater or equal than -1. */
 
@@ -147,10 +136,10 @@ test_cleanup:
 
   /* proper cleanup sequence - type PA */
 
-  curl_multi_remove_handle(m, curl);
-  curl_multi_cleanup(m);
+  curl_multi_remove_handle(multi, curl);
+  curl_multi_cleanup(multi);
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib556.c b/third-party/curl/tests/libtest/lib556.c
index ead6529eac..1bc4638b9b 100644
--- a/third-party/curl/tests/libtest/lib556.c
+++ b/third-party/curl/tests/libtest/lib556.c
@@ -21,73 +21,83 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "warnless.h"
-#include "memdebug.h"
-
-/* For Windows, mainly (may be moved in a config file?) */
-#ifndef STDIN_FILENO
-  #define STDIN_FILENO 0
-#endif
-#ifndef STDOUT_FILENO
-  #define STDOUT_FILENO 1
-#endif
-#ifndef STDERR_FILENO
-  #define STDERR_FILENO 2
-#endif
-
-int test(char *URL)
+static CURLcode test_lib556(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
+  int transfers = 0;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  res = curl_easy_perform(curl);
+again:
 
-  if(!res) {
+  result = curl_easy_perform(curl);
+
+  if(!result) {
     /* we are connected, now get an HTTP document the raw way */
-    const char *request =
-      "GET /556 HTTP/1.1\r\n"
-      "Host: ninja\r\n\r\n";
-    size_t iolen = 0;
+    char request[64];
+    const char *sbuf = request;
+    size_t sblen;
+    size_t nwritten = 0, nread = 0;
 
-    res = curl_easy_send(curl, request, strlen(request), &iolen);
+    sblen = curl_msnprintf(request, sizeof(request),
+                           "GET /%d HTTP/1.1\r\n"
+                           "Host: ninja\r\n\r\n", testnum);
 
-    if(!res) {
-      /* we assume that sending always work */
+    do {
+      char buf[1024];
 
-      do {
-        char buf[1024];
-        /* busy-read like crazy */
-        res = curl_easy_recv(curl, buf, sizeof(buf), &iolen);
-
-        if(iolen) {
-          /* send received stuff to stdout */
-          if(!write(STDOUT_FILENO, buf, iolen))
-            break;
+      if(sblen) {
+        result = curl_easy_send(curl, sbuf, sblen, &nwritten);
+        if(result && result != CURLE_AGAIN)
+          break;
+        if(nwritten > 0) {
+          sbuf += nwritten;
+          sblen -= nwritten;
         }
+      }
 
-      } while((res == CURLE_OK && iolen) || (res == CURLE_AGAIN));
-    }
+      /* busy-read like crazy */
+      result = curl_easy_recv(curl, buf, sizeof(buf), &nread);
 
-    if(iolen)
-      res = (CURLcode)TEST_ERR_FAILURE;
+      if(nread) {
+        /* send received stuff to stdout */
+        if((size_t)write(STDOUT_FILENO, buf, nread) != nread) {
+          char errbuf[STRERROR_LEN];
+          curl_mfprintf(stderr, "write() failed: errno %d (%s)\n",
+                        errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
+          result = TEST_ERR_FAILURE;
+          break;
+        }
+      }
+
+    } while((result == CURLE_OK && nread) || (result == CURLE_AGAIN));
+
+    if(result && result != CURLE_AGAIN)
+      result = TEST_ERR_FAILURE;
+  }
+
+  if(testnum == 696) {
+    ++transfers;
+    /* perform the transfer a second time */
+    if(!result && transfers == 1)
+      goto again;
   }
 
 test_cleanup:
@@ -95,5 +105,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib557.c b/third-party/curl/tests/libtest/lib557.c
index 6f96668da2..e7fb499fb8 100644
--- a/third-party/curl/tests/libtest/lib557.c
+++ b/third-party/curl/tests/libtest/lib557.c
@@ -27,43 +27,26 @@
  * curl_m*printf formatting capabilities and handling of some data types.
  */
 
-#define CURL_NO_FMT_CHECKS /* disable compiler *printf format checks */
-
-#include "test.h"
-
-#include <limits.h>
+#include "first.h"
 
 #ifdef HAVE_LOCALE_H
 #  include <locale.h> /* for setlocale() */
 #endif
 
-#include "memdebug.h"
-
-#if (SIZEOF_CURL_OFF_T > SIZEOF_LONG)
-#  define MPRNT_SUFFIX_CURL_OFF_T  LL
-#else
-#  define MPRNT_SUFFIX_CURL_OFF_T  L
+#ifdef CURL_HAVE_DIAG
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wformat"
+#pragma GCC diagnostic ignored "-Wformat-extra-args"
+#if !defined(__clang__) && __GNUC__ >= 7
+#pragma GCC diagnostic ignored "-Wformat-overflow"
+#endif
+#if defined(__clang__) && \
+  (__clang_major__ > 3 || (__clang_major__ == 3 && __clang_minor__ >= 1))
+#pragma clang diagnostic ignored "-Wformat-non-iso"
+#endif
 #endif
 
-
-#ifdef CURL_ISOCPP
-#  define MPRNT_OFF_T_C_HELPER2(Val,Suffix) Val ## Suffix
-#else
-#  define MPRNT_OFF_T_C_HELPER2(Val,Suffix) Val/**/Suffix
-#endif
-#define MPRNT_OFF_T_C_HELPER1(Val,Suffix) MPRNT_OFF_T_C_HELPER2(Val,Suffix)
-#define MPRNT_OFF_T_C(Val)  MPRNT_OFF_T_C_HELPER1(Val,MPRNT_SUFFIX_CURL_OFF_T)
-
-
-#define BUFSZ    256
-#define USHORT_TESTS_ARRSZ 1 + 100
-#define SSHORT_TESTS_ARRSZ 1 + 100
-#define UINT_TESTS_ARRSZ   1 + 100
-#define SINT_TESTS_ARRSZ   1 + 100
-#define ULONG_TESTS_ARRSZ  1 + 100
-#define SLONG_TESTS_ARRSZ  1 + 100
-#define COFFT_TESTS_ARRSZ  1 + 100
-
+#define BUFSZ 256
 
 struct unsshort_st {
   unsigned short num;   /* unsigned short  */
@@ -71,57 +54,74 @@ struct unsshort_st {
   char result[BUFSZ];   /* result string   */
 };
 
-
 struct sigshort_st {
   short num;            /* signed short    */
   const char *expected; /* expected string */
   char result[BUFSZ];   /* result string   */
 };
 
-
 struct unsint_st {
   unsigned int num;     /* unsigned int    */
   const char *expected; /* expected string */
   char result[BUFSZ];   /* result string   */
 };
 
-
 struct sigint_st {
   int num;              /* signed int      */
   const char *expected; /* expected string */
   char result[BUFSZ];   /* result string   */
 };
 
-
 struct unslong_st {
   unsigned long num;    /* unsigned long   */
   const char *expected; /* expected string */
   char result[BUFSZ];   /* result string   */
 };
 
-
 struct siglong_st {
   long num;             /* signed long     */
   const char *expected; /* expected string */
   char result[BUFSZ];   /* result string   */
 };
 
-
 struct curloff_st {
   curl_off_t num;       /* curl_off_t      */
   const char *expected; /* expected string */
   char result[BUFSZ];   /* result string   */
 };
 
+static int string_check_low(int linenumber, char *buf, const char *buf2)
+{
+  if(strcmp(buf, buf2)) {
+    /* they should not differ */
+    curl_mprintf("sprintf line %d failed:\nwe      '%s'\nsystem: '%s'\n",
+                 linenumber, buf, buf2);
+    return 1;
+  }
+  return 0;
+}
+#define string_check(x, y) string_check_low(__LINE__, x, y)
 
-static struct unsshort_st us_test[USHORT_TESTS_ARRSZ];
-static struct sigshort_st ss_test[SSHORT_TESTS_ARRSZ];
-static struct unsint_st   ui_test[UINT_TESTS_ARRSZ];
-static struct sigint_st   si_test[SINT_TESTS_ARRSZ];
-static struct unslong_st  ul_test[ULONG_TESTS_ARRSZ];
-static struct siglong_st  sl_test[SLONG_TESTS_ARRSZ];
-static struct curloff_st  co_test[COFFT_TESTS_ARRSZ];
+static int strlen_check_low(int linenumber, char *buf, size_t len)
+{
+  size_t buflen = strlen(buf);
+  if(len != buflen) {
+    /* they should not differ */
+    curl_mprintf("sprintf strlen:%d failed:\nwe '%zu'\nsystem: '%zu'\n",
+                 linenumber, buflen, len);
+    return 1;
+  }
+  return 0;
+}
+#define strlen_check(x, y) strlen_check_low(__LINE__, x, y)
 
+static struct unsshort_st us_test[1 + 100];
+static struct sigshort_st ss_test[1 + 100];
+static struct unsint_st   ui_test[1 + 100];
+static struct sigint_st   si_test[1 + 100];
+static struct unslong_st  ul_test[1 + 100];
+static struct siglong_st  sl_test[1 + 100];
+static struct curloff_st  co_test[1 + 100];
 
 static int test_unsigned_short_formatting(void)
 {
@@ -150,31 +150,30 @@ static int test_unsigned_short_formatting(void)
 
   for(i = 1; i <= num_ushort_tests; i++) {
 
-    for(j = 0; j<BUFSZ; j++)
+    for(j = 0; j < BUFSZ; j++)
       us_test[i].result[j] = 'X';
-    us_test[i].result[BUFSZ-1] = '\0';
+    us_test[i].result[BUFSZ - 1] = '\0';
 
     (void)curl_msprintf(us_test[i].result, "%hu", us_test[i].num);
 
     if(memcmp(us_test[i].result,
-               us_test[i].expected,
-               strlen(us_test[i].expected))) {
-      printf("unsigned short test #%.2d: Failed (Expected: %s Got: %s)\n",
-             i, us_test[i].expected, us_test[i].result);
+              us_test[i].expected,
+              strlen(us_test[i].expected))) {
+      curl_mprintf("unsigned short test #%.2d: Failed "
+                   "(Expected: %s Got: %s)\n",
+                   i, us_test[i].expected, us_test[i].result);
       failed++;
     }
-
   }
 
   if(!failed)
-    printf("All curl_mprintf() unsigned short tests OK!\n");
+    curl_mprintf("All curl_mprintf() unsigned short tests OK!\n");
   else
-    printf("Some curl_mprintf() unsigned short tests Failed!\n");
+    curl_mprintf("Some curl_mprintf() unsigned short tests Failed!\n");
 
   return failed;
 }
 
-
 static int test_signed_short_formatting(void)
 {
   int i, j;
@@ -218,65 +217,41 @@ static int test_signed_short_formatting(void)
   i++; ss_test[i].num = -0x0050 -1; ss_test[i].expected = "-81";
   i++; ss_test[i].num = -0x0005 -1; ss_test[i].expected = "-6";
 
-  i++; ss_test[i].num =  0x0000 -1; ss_test[i].expected = "-1";
+  i++; ss_test[i].num = 0x0000 -1; ss_test[i].expected = "-1";
 
   num_sshort_tests = i;
 
   for(i = 1; i <= num_sshort_tests; i++) {
 
-    for(j = 0; j<BUFSZ; j++)
+    for(j = 0; j < BUFSZ; j++)
       ss_test[i].result[j] = 'X';
-    ss_test[i].result[BUFSZ-1] = '\0';
+    ss_test[i].result[BUFSZ - 1] = '\0';
 
     (void)curl_msprintf(ss_test[i].result, "%hd", ss_test[i].num);
 
     if(memcmp(ss_test[i].result,
               ss_test[i].expected,
               strlen(ss_test[i].expected))) {
-      printf("signed short test #%.2d: Failed (Expected: %s Got: %s)\n",
-             i, ss_test[i].expected, ss_test[i].result);
+      curl_mprintf("signed short test #%.2d: Failed (Expected: %s Got: %s)\n",
+                   i, ss_test[i].expected, ss_test[i].result);
       failed++;
     }
-
   }
 
   if(!failed)
-    printf("All curl_mprintf() signed short tests OK!\n");
+    curl_mprintf("All curl_mprintf() signed short tests OK!\n");
   else
-    printf("Some curl_mprintf() signed short tests Failed!\n");
+    curl_mprintf("Some curl_mprintf() signed short tests Failed!\n");
 
   return failed;
 }
 
-
 static int test_unsigned_int_formatting(void)
 {
   int i, j;
   int num_uint_tests = 0;
   int failed = 0;
-
-#if (SIZEOF_INT == 2)
-
-  i = 1; ui_test[i].num = 0xFFFFU; ui_test[i].expected = "65535";
-  i++; ui_test[i].num = 0xFF00U; ui_test[i].expected = "65280";
-  i++; ui_test[i].num = 0x00FFU; ui_test[i].expected = "255";
-
-  i++; ui_test[i].num = 0xF000U; ui_test[i].expected = "61440";
-  i++; ui_test[i].num = 0x0F00U; ui_test[i].expected = "3840";
-  i++; ui_test[i].num = 0x00F0U; ui_test[i].expected = "240";
-  i++; ui_test[i].num = 0x000FU; ui_test[i].expected = "15";
-
-  i++; ui_test[i].num = 0xC000U; ui_test[i].expected = "49152";
-  i++; ui_test[i].num = 0x0C00U; ui_test[i].expected = "3072";
-  i++; ui_test[i].num = 0x00C0U; ui_test[i].expected = "192";
-  i++; ui_test[i].num = 0x000CU; ui_test[i].expected = "12";
-
-  i++; ui_test[i].num = 0x0001U; ui_test[i].expected = "1";
-  i++; ui_test[i].num = 0x0000U; ui_test[i].expected = "0";
-
-  num_uint_tests = i;
-
-#elif (SIZEOF_INT == 4)
+  char buf[128];
 
   i = 1; ui_test[i].num = 0xFFFFFFFFU; ui_test[i].expected = "4294967295";
   i++; ui_test[i].num = 0xFFFF0000U; ui_test[i].expected = "4294901760";
@@ -310,146 +285,40 @@ static int test_unsigned_int_formatting(void)
 
   num_uint_tests = i;
 
-#elif (SIZEOF_INT == 8)
-
-  /* !checksrc! disable LONGLINE all */
-  i = 1; ui_test[i].num = 0xFFFFFFFFFFFFFFFFU; ui_test[i].expected = "18446744073709551615";
-  i++; ui_test[i].num = 0xFFFFFFFF00000000U; ui_test[i].expected = "18446744069414584320";
-  i++; ui_test[i].num = 0x00000000FFFFFFFFU; ui_test[i].expected = "4294967295";
-
-  i++; ui_test[i].num = 0xFFFF000000000000U; ui_test[i].expected = "18446462598732840960";
-  i++; ui_test[i].num = 0x0000FFFF00000000U; ui_test[i].expected = "281470681743360";
-  i++; ui_test[i].num = 0x00000000FFFF0000U; ui_test[i].expected = "4294901760";
-  i++; ui_test[i].num = 0x000000000000FFFFU; ui_test[i].expected = "65535";
-
-  i++; ui_test[i].num = 0xFF00000000000000U; ui_test[i].expected = "18374686479671623680";
-  i++; ui_test[i].num = 0x00FF000000000000U; ui_test[i].expected = "71776119061217280";
-  i++; ui_test[i].num = 0x0000FF0000000000U; ui_test[i].expected = "280375465082880";
-  i++; ui_test[i].num = 0x000000FF00000000U; ui_test[i].expected = "1095216660480";
-  i++; ui_test[i].num = 0x00000000FF000000U; ui_test[i].expected = "4278190080";
-  i++; ui_test[i].num = 0x0000000000FF0000U; ui_test[i].expected = "16711680";
-  i++; ui_test[i].num = 0x000000000000FF00U; ui_test[i].expected = "65280";
-  i++; ui_test[i].num = 0x00000000000000FFU; ui_test[i].expected = "255";
-
-  i++; ui_test[i].num = 0xF000000000000000U; ui_test[i].expected = "17293822569102704640";
-  i++; ui_test[i].num = 0x0F00000000000000U; ui_test[i].expected = "1080863910568919040";
-  i++; ui_test[i].num = 0x00F0000000000000U; ui_test[i].expected = "67553994410557440";
-  i++; ui_test[i].num = 0x000F000000000000U; ui_test[i].expected = "4222124650659840";
-  i++; ui_test[i].num = 0x0000F00000000000U; ui_test[i].expected = "263882790666240";
-  i++; ui_test[i].num = 0x00000F0000000000U; ui_test[i].expected = "16492674416640";
-  i++; ui_test[i].num = 0x000000F000000000U; ui_test[i].expected = "1030792151040";
-  i++; ui_test[i].num = 0x0000000F00000000U; ui_test[i].expected = "64424509440";
-  i++; ui_test[i].num = 0x00000000F0000000U; ui_test[i].expected = "4026531840";
-  i++; ui_test[i].num = 0x000000000F000000U; ui_test[i].expected = "251658240";
-  i++; ui_test[i].num = 0x0000000000F00000U; ui_test[i].expected = "15728640";
-  i++; ui_test[i].num = 0x00000000000F0000U; ui_test[i].expected = "983040";
-  i++; ui_test[i].num = 0x000000000000F000U; ui_test[i].expected = "61440";
-  i++; ui_test[i].num = 0x0000000000000F00U; ui_test[i].expected = "3840";
-  i++; ui_test[i].num = 0x00000000000000F0U; ui_test[i].expected = "240";
-  i++; ui_test[i].num = 0x000000000000000FU; ui_test[i].expected = "15";
-
-  i++; ui_test[i].num = 0xC000000000000000U; ui_test[i].expected = "13835058055282163712";
-  i++; ui_test[i].num = 0x0C00000000000000U; ui_test[i].expected = "864691128455135232";
-  i++; ui_test[i].num = 0x00C0000000000000U; ui_test[i].expected = "54043195528445952";
-  i++; ui_test[i].num = 0x000C000000000000U; ui_test[i].expected = "3377699720527872";
-  i++; ui_test[i].num = 0x0000C00000000000U; ui_test[i].expected = "211106232532992";
-  i++; ui_test[i].num = 0x00000C0000000000U; ui_test[i].expected = "13194139533312";
-  i++; ui_test[i].num = 0x000000C000000000U; ui_test[i].expected = "824633720832";
-  i++; ui_test[i].num = 0x0000000C00000000U; ui_test[i].expected = "51539607552";
-  i++; ui_test[i].num = 0x00000000C0000000U; ui_test[i].expected = "3221225472";
-  i++; ui_test[i].num = 0x000000000C000000U; ui_test[i].expected = "201326592";
-  i++; ui_test[i].num = 0x0000000000C00000U; ui_test[i].expected = "12582912";
-  i++; ui_test[i].num = 0x00000000000C0000U; ui_test[i].expected = "786432";
-  i++; ui_test[i].num = 0x000000000000C000U; ui_test[i].expected = "49152";
-  i++; ui_test[i].num = 0x0000000000000C00U; ui_test[i].expected = "3072";
-  i++; ui_test[i].num = 0x00000000000000C0U; ui_test[i].expected = "192";
-  i++; ui_test[i].num = 0x000000000000000CU; ui_test[i].expected = "12";
-
-  i++; ui_test[i].num = 0x00000001U; ui_test[i].expected = "1";
-  i++; ui_test[i].num = 0x00000000U; ui_test[i].expected = "0";
-
-  num_uint_tests = i;
-
-#endif
-
   for(i = 1; i <= num_uint_tests; i++) {
 
-    for(j = 0; j<BUFSZ; j++)
+    for(j = 0; j < BUFSZ; j++)
       ui_test[i].result[j] = 'X';
-    ui_test[i].result[BUFSZ-1] = '\0';
+    ui_test[i].result[BUFSZ - 1] = '\0';
 
     (void)curl_msprintf(ui_test[i].result, "%u", ui_test[i].num);
 
     if(memcmp(ui_test[i].result,
-               ui_test[i].expected,
-               strlen(ui_test[i].expected))) {
-      printf("unsigned int test #%.2d: Failed (Expected: %s Got: %s)\n",
-             i, ui_test[i].expected, ui_test[i].result);
+              ui_test[i].expected,
+              strlen(ui_test[i].expected))) {
+      curl_mprintf("unsigned int test #%.2d: Failed (Expected: %s Got: %s)\n",
+                   i, ui_test[i].expected, ui_test[i].result);
       failed++;
     }
-
   }
 
+  curl_msnprintf(buf, sizeof(buf), "%+u", 1234);
+  failed += string_check(buf, "+1234");
+
   if(!failed)
-    printf("All curl_mprintf() unsigned int tests OK!\n");
+    curl_mprintf("All curl_mprintf() unsigned int tests OK!\n");
   else
-    printf("Some curl_mprintf() unsigned int tests Failed!\n");
+    curl_mprintf("Some curl_mprintf() unsigned int tests Failed!\n");
 
   return failed;
 }
 
-
 static int test_signed_int_formatting(void)
 {
   int i, j;
   int num_sint_tests = 0;
   int failed = 0;
 
-#if (SIZEOF_INT == 2)
-
-  i = 1; si_test[i].num = 0x7FFF; si_test[i].expected = "32767";
-  i++; si_test[i].num = 0x7FFE; si_test[i].expected = "32766";
-  i++; si_test[i].num = 0x7FFD; si_test[i].expected = "32765";
-  i++; si_test[i].num = 0x7F00; si_test[i].expected = "32512";
-  i++; si_test[i].num = 0x07F0; si_test[i].expected = "2032";
-  i++; si_test[i].num = 0x007F; si_test[i].expected = "127";
-
-  i++; si_test[i].num = 0x7000; si_test[i].expected = "28672";
-  i++; si_test[i].num = 0x0700; si_test[i].expected = "1792";
-  i++; si_test[i].num = 0x0070; si_test[i].expected = "112";
-  i++; si_test[i].num = 0x0007; si_test[i].expected = "7";
-
-  i++; si_test[i].num = 0x5000; si_test[i].expected = "20480";
-  i++; si_test[i].num = 0x0500; si_test[i].expected = "1280";
-  i++; si_test[i].num = 0x0050; si_test[i].expected = "80";
-  i++; si_test[i].num = 0x0005; si_test[i].expected = "5";
-
-  i++; si_test[i].num = 0x0001; si_test[i].expected = "1";
-  i++; si_test[i].num = 0x0000; si_test[i].expected = "0";
-
-  i++; si_test[i].num = -0x7FFF -1; si_test[i].expected = "-32768";
-  i++; si_test[i].num = -0x7FFE -1; si_test[i].expected = "-32767";
-  i++; si_test[i].num = -0x7FFD -1; si_test[i].expected = "-32766";
-  i++; si_test[i].num = -0x7F00 -1; si_test[i].expected = "-32513";
-  i++; si_test[i].num = -0x07F0 -1; si_test[i].expected = "-2033";
-  i++; si_test[i].num = -0x007F -1; si_test[i].expected = "-128";
-
-  i++; si_test[i].num = -0x7000 -1; si_test[i].expected = "-28673";
-  i++; si_test[i].num = -0x0700 -1; si_test[i].expected = "-1793";
-  i++; si_test[i].num = -0x0070 -1; si_test[i].expected = "-113";
-  i++; si_test[i].num = -0x0007 -1; si_test[i].expected = "-8";
-
-  i++; si_test[i].num = -0x5000 -1; si_test[i].expected = "-20481";
-  i++; si_test[i].num = -0x0500 -1; si_test[i].expected = "-1281";
-  i++; si_test[i].num = -0x0050 -1; si_test[i].expected = "-81";
-  i++; si_test[i].num = -0x0005 -1; si_test[i].expected = "-6";
-
-  i++; si_test[i].num =  0x0000 -1; si_test[i].expected = "-1";
-
-  num_sint_tests = i;
-
-#elif (SIZEOF_INT == 4)
-
   i = 1; si_test[i].num = 0x7FFFFFFF; si_test[i].expected = "2147483647";
   i++; si_test[i].num = 0x7FFFFFFE; si_test[i].expected = "2147483646";
   i++; si_test[i].num = 0x7FFFFFFD; si_test[i].expected = "2147483645";
@@ -511,150 +380,42 @@ static int test_signed_int_formatting(void)
   i++; si_test[i].num = -0x00000050 -1; si_test[i].expected = "-81";
   i++; si_test[i].num = -0x00000005 -1; si_test[i].expected = "-6";
 
-  i++; si_test[i].num =  0x00000000 -1; si_test[i].expected = "-1";
+  i++; si_test[i].num = 0x00000000 -1; si_test[i].expected = "-1";
 
   num_sint_tests = i;
 
-#elif (SIZEOF_INT == 8)
-
-  i = 1; si_test[i].num = 0x7FFFFFFFFFFFFFFF; si_test[i].expected = "9223372036854775807";
-  i++; si_test[i].num = 0x7FFFFFFFFFFFFFFE; si_test[i].expected = "9223372036854775806";
-  i++; si_test[i].num = 0x7FFFFFFFFFFFFFFD; si_test[i].expected = "9223372036854775805";
-  i++; si_test[i].num = 0x7FFFFFFF00000000; si_test[i].expected = "9223372032559808512";
-  i++; si_test[i].num = 0x000000007FFFFFFF; si_test[i].expected = "2147483647";
-
-  i++; si_test[i].num = 0x7FFF000000000000; si_test[i].expected = "9223090561878065152";
-  i++; si_test[i].num = 0x00007FFF00000000; si_test[i].expected = "140733193388032";
-  i++; si_test[i].num = 0x000000007FFF0000; si_test[i].expected = "2147418112";
-  i++; si_test[i].num = 0x0000000000007FFF; si_test[i].expected = "32767";
-
-  i++; si_test[i].num = 0x7F00000000000000; si_test[i].expected = "9151314442816847872";
-  i++; si_test[i].num = 0x007F000000000000; si_test[i].expected = "35747322042253312";
-  i++; si_test[i].num = 0x00007F0000000000; si_test[i].expected = "139637976727552";
-  i++; si_test[i].num = 0x0000007F00000000; si_test[i].expected = "545460846592";
-  i++; si_test[i].num = 0x000000007F000000; si_test[i].expected = "2130706432";
-  i++; si_test[i].num = 0x00000000007F0000; si_test[i].expected = "8323072";
-  i++; si_test[i].num = 0x0000000000007F00; si_test[i].expected = "32512";
-  i++; si_test[i].num = 0x000000000000007F; si_test[i].expected = "127";
-
-  i++; si_test[i].num = 0x7000000000000000; si_test[i].expected = "8070450532247928832";
-  i++; si_test[i].num = 0x0700000000000000; si_test[i].expected = "504403158265495552";
-  i++; si_test[i].num = 0x0070000000000000; si_test[i].expected = "31525197391593472";
-  i++; si_test[i].num = 0x0007000000000000; si_test[i].expected = "1970324836974592";
-  i++; si_test[i].num = 0x0000700000000000; si_test[i].expected = "123145302310912";
-  i++; si_test[i].num = 0x0000070000000000; si_test[i].expected = "7696581394432";
-  i++; si_test[i].num = 0x0000007000000000; si_test[i].expected = "481036337152";
-  i++; si_test[i].num = 0x0000000700000000; si_test[i].expected = "30064771072";
-  i++; si_test[i].num = 0x0000000070000000; si_test[i].expected = "1879048192";
-  i++; si_test[i].num = 0x0000000007000000; si_test[i].expected = "117440512";
-  i++; si_test[i].num = 0x0000000000700000; si_test[i].expected = "7340032";
-  i++; si_test[i].num = 0x0000000000070000; si_test[i].expected = "458752";
-  i++; si_test[i].num = 0x0000000000007000; si_test[i].expected = "28672";
-  i++; si_test[i].num = 0x0000000000000700; si_test[i].expected = "1792";
-  i++; si_test[i].num = 0x0000000000000070; si_test[i].expected = "112";
-  i++; si_test[i].num = 0x0000000000000007; si_test[i].expected = "7";
-
-  i++; si_test[i].num = 0x0000000000000001; si_test[i].expected = "1";
-  i++; si_test[i].num = 0x0000000000000000; si_test[i].expected = "0";
-
-  i++; si_test[i].num = -0x7FFFFFFFFFFFFFFF -1; si_test[i].expected = "-9223372036854775808";
-  i++; si_test[i].num = -0x7FFFFFFFFFFFFFFE -1; si_test[i].expected = "-9223372036854775807";
-  i++; si_test[i].num = -0x7FFFFFFFFFFFFFFD -1; si_test[i].expected = "-9223372036854775806";
-  i++; si_test[i].num = -0x7FFFFFFF00000000 -1; si_test[i].expected = "-9223372032559808513";
-  i++; si_test[i].num = -0x000000007FFFFFFF -1; si_test[i].expected = "-2147483648";
-
-  i++; si_test[i].num = -0x7FFF000000000000 -1; si_test[i].expected = "-9223090561878065153";
-  i++; si_test[i].num = -0x00007FFF00000000 -1; si_test[i].expected = "-140733193388033";
-  i++; si_test[i].num = -0x000000007FFF0000 -1; si_test[i].expected = "-2147418113";
-  i++; si_test[i].num = -0x0000000000007FFF -1; si_test[i].expected = "-32768";
-
-  i++; si_test[i].num = -0x7F00000000000000 -1; si_test[i].expected = "-9151314442816847873";
-  i++; si_test[i].num = -0x007F000000000000 -1; si_test[i].expected = "-35747322042253313";
-  i++; si_test[i].num = -0x00007F0000000000 -1; si_test[i].expected = "-139637976727553";
-  i++; si_test[i].num = -0x0000007F00000000 -1; si_test[i].expected = "-545460846593";
-  i++; si_test[i].num = -0x000000007F000000 -1; si_test[i].expected = "-2130706433";
-  i++; si_test[i].num = -0x00000000007F0000 -1; si_test[i].expected = "-8323073";
-  i++; si_test[i].num = -0x0000000000007F00 -1; si_test[i].expected = "-32513";
-  i++; si_test[i].num = -0x000000000000007F -1; si_test[i].expected = "-128";
-
-  i++; si_test[i].num = -0x7000000000000000 -1; si_test[i].expected = "-8070450532247928833";
-  i++; si_test[i].num = -0x0700000000000000 -1; si_test[i].expected = "-504403158265495553";
-  i++; si_test[i].num = -0x0070000000000000 -1; si_test[i].expected = "-31525197391593473";
-  i++; si_test[i].num = -0x0007000000000000 -1; si_test[i].expected = "-1970324836974593";
-  i++; si_test[i].num = -0x0000700000000000 -1; si_test[i].expected = "-123145302310913";
-  i++; si_test[i].num = -0x0000070000000000 -1; si_test[i].expected = "-7696581394433";
-  i++; si_test[i].num = -0x0000007000000000 -1; si_test[i].expected = "-481036337153";
-  i++; si_test[i].num = -0x0000000700000000 -1; si_test[i].expected = "-30064771073";
-  i++; si_test[i].num = -0x0000000070000000 -1; si_test[i].expected = "-1879048193";
-  i++; si_test[i].num = -0x0000000007000000 -1; si_test[i].expected = "-117440513";
-  i++; si_test[i].num = -0x0000000000700000 -1; si_test[i].expected = "-7340033";
-  i++; si_test[i].num = -0x0000000000070000 -1; si_test[i].expected = "-458753";
-  i++; si_test[i].num = -0x0000000000007000 -1; si_test[i].expected = "-28673";
-  i++; si_test[i].num = -0x0000000000000700 -1; si_test[i].expected = "-1793";
-  i++; si_test[i].num = -0x0000000000000070 -1; si_test[i].expected = "-113";
-  i++; si_test[i].num = -0x0000000000000007 -1; si_test[i].expected = "-8";
-
-  i++; si_test[i].num =  0x0000000000000000 -1; si_test[i].expected = "-1";
-
-  num_sint_tests = i;
-
-#endif
-
   for(i = 1; i <= num_sint_tests; i++) {
 
-    for(j = 0; j<BUFSZ; j++)
+    for(j = 0; j < BUFSZ; j++)
       si_test[i].result[j] = 'X';
-    si_test[i].result[BUFSZ-1] = '\0';
+    si_test[i].result[BUFSZ - 1] = '\0';
 
     (void)curl_msprintf(si_test[i].result, "%d", si_test[i].num);
 
     if(memcmp(si_test[i].result,
               si_test[i].expected,
               strlen(si_test[i].expected))) {
-      printf("signed int test #%.2d: Failed (Expected: %s Got: %s)\n",
-             i, si_test[i].expected, si_test[i].result);
+      curl_mprintf("signed int test #%.2d: Failed (Expected: %s Got: %s)\n",
+                   i, si_test[i].expected, si_test[i].result);
       failed++;
     }
-
   }
 
   if(!failed)
-    printf("All curl_mprintf() signed int tests OK!\n");
+    curl_mprintf("All curl_mprintf() signed int tests OK!\n");
   else
-    printf("Some curl_mprintf() signed int tests Failed!\n");
+    curl_mprintf("Some curl_mprintf() signed int tests Failed!\n");
 
   return failed;
 }
 
-
 static int test_unsigned_long_formatting(void)
 {
   int i, j;
   int num_ulong_tests = 0;
   int failed = 0;
 
-#if (SIZEOF_LONG == 2)
-
-  i = 1; ul_test[i].num = 0xFFFFUL; ul_test[i].expected = "65535";
-  i++; ul_test[i].num = 0xFF00UL; ul_test[i].expected = "65280";
-  i++; ul_test[i].num = 0x00FFUL; ul_test[i].expected = "255";
-
-  i++; ul_test[i].num = 0xF000UL; ul_test[i].expected = "61440";
-  i++; ul_test[i].num = 0x0F00UL; ul_test[i].expected = "3840";
-  i++; ul_test[i].num = 0x00F0UL; ul_test[i].expected = "240";
-  i++; ul_test[i].num = 0x000FUL; ul_test[i].expected = "15";
-
-  i++; ul_test[i].num = 0xC000UL; ul_test[i].expected = "49152";
-  i++; ul_test[i].num = 0x0C00UL; ul_test[i].expected = "3072";
-  i++; ul_test[i].num = 0x00C0UL; ul_test[i].expected = "192";
-  i++; ul_test[i].num = 0x000CUL; ul_test[i].expected = "12";
-
-  i++; ul_test[i].num = 0x0001UL; ul_test[i].expected = "1";
-  i++; ul_test[i].num = 0x0000UL; ul_test[i].expected = "0";
-
-  num_ulong_tests = i;
-
-#elif (SIZEOF_LONG == 4)
+#if SIZEOF_LONG == 4
 
   i = 1; ul_test[i].num = 0xFFFFFFFFUL; ul_test[i].expected = "4294967295";
   i++; ul_test[i].num = 0xFFFF0000UL; ul_test[i].expected = "4294901760";
@@ -688,8 +449,8 @@ static int test_unsigned_long_formatting(void)
 
   num_ulong_tests = i;
 
-#elif (SIZEOF_LONG == 8)
-
+#elif SIZEOF_LONG == 8
+  /* !checksrc! disable LONGLINE all */
   i = 1; ul_test[i].num = 0xFFFFFFFFFFFFFFFFUL; ul_test[i].expected = "18446744073709551615";
   i++; ul_test[i].num = 0xFFFFFFFF00000000UL; ul_test[i].expected = "18446744069414584320";
   i++; ul_test[i].num = 0x00000000FFFFFFFFUL; ul_test[i].expected = "4294967295";
@@ -751,81 +512,36 @@ static int test_unsigned_long_formatting(void)
 
   for(i = 1; i <= num_ulong_tests; i++) {
 
-    for(j = 0; j<BUFSZ; j++)
+    for(j = 0; j < BUFSZ; j++)
       ul_test[i].result[j] = 'X';
-    ul_test[i].result[BUFSZ-1] = '\0';
+    ul_test[i].result[BUFSZ - 1] = '\0';
 
     (void)curl_msprintf(ul_test[i].result, "%lu", ul_test[i].num);
 
     if(memcmp(ul_test[i].result,
-               ul_test[i].expected,
-               strlen(ul_test[i].expected))) {
-      printf("unsigned long test #%.2d: Failed (Expected: %s Got: %s)\n",
-             i, ul_test[i].expected, ul_test[i].result);
+              ul_test[i].expected,
+              strlen(ul_test[i].expected))) {
+      curl_mprintf("unsigned long test #%.2d: Failed (Expected: %s Got: %s)\n",
+                   i, ul_test[i].expected, ul_test[i].result);
       failed++;
     }
-
   }
 
   if(!failed)
-    printf("All curl_mprintf() unsigned long tests OK!\n");
+    curl_mprintf("All curl_mprintf() unsigned long tests OK!\n");
   else
-    printf("Some curl_mprintf() unsigned long tests Failed!\n");
+    curl_mprintf("Some curl_mprintf() unsigned long tests Failed!\n");
 
   return failed;
 }
 
-
 static int test_signed_long_formatting(void)
 {
   int i, j;
   int num_slong_tests = 0;
   int failed = 0;
 
-#if (SIZEOF_LONG == 2)
-
-  i = 1; sl_test[i].num = 0x7FFFL; sl_test[i].expected = "32767";
-  i++; sl_test[i].num = 0x7FFEL; sl_test[i].expected = "32766";
-  i++; sl_test[i].num = 0x7FFDL; sl_test[i].expected = "32765";
-  i++; sl_test[i].num = 0x7F00L; sl_test[i].expected = "32512";
-  i++; sl_test[i].num = 0x07F0L; sl_test[i].expected = "2032";
-  i++; sl_test[i].num = 0x007FL; sl_test[i].expected = "127";
-
-  i++; sl_test[i].num = 0x7000L; sl_test[i].expected = "28672";
-  i++; sl_test[i].num = 0x0700L; sl_test[i].expected = "1792";
-  i++; sl_test[i].num = 0x0070L; sl_test[i].expected = "112";
-  i++; sl_test[i].num = 0x0007L; sl_test[i].expected = "7";
-
-  i++; sl_test[i].num = 0x5000L; sl_test[i].expected = "20480";
-  i++; sl_test[i].num = 0x0500L; sl_test[i].expected = "1280";
-  i++; sl_test[i].num = 0x0050L; sl_test[i].expected = "80";
-  i++; sl_test[i].num = 0x0005L; sl_test[i].expected = "5";
-
-  i++; sl_test[i].num = 0x0001L; sl_test[i].expected = "1";
-  i++; sl_test[i].num = 0x0000L; sl_test[i].expected = "0";
-
-  i++; sl_test[i].num = -0x7FFFL -1L; sl_test[i].expected = "-32768";
-  i++; sl_test[i].num = -0x7FFEL -1L; sl_test[i].expected = "-32767";
-  i++; sl_test[i].num = -0x7FFDL -1L; sl_test[i].expected = "-32766";
-  i++; sl_test[i].num = -0x7F00L -1L; sl_test[i].expected = "-32513";
-  i++; sl_test[i].num = -0x07F0L -1L; sl_test[i].expected = "-2033";
-  i++; sl_test[i].num = -0x007FL -1L; sl_test[i].expected = "-128";
-
-  i++; sl_test[i].num = -0x7000L -1L; sl_test[i].expected = "-28673";
-  i++; sl_test[i].num = -0x0700L -1L; sl_test[i].expected = "-1793";
-  i++; sl_test[i].num = -0x0070L -1L; sl_test[i].expected = "-113";
-  i++; sl_test[i].num = -0x0007L -1L; sl_test[i].expected = "-8";
-
-  i++; sl_test[i].num = -0x5000L -1L; sl_test[i].expected = "-20481";
-  i++; sl_test[i].num = -0x0500L -1L; sl_test[i].expected = "-1281";
-  i++; sl_test[i].num = -0x0050L -1L; sl_test[i].expected = "-81";
-  i++; sl_test[i].num = -0x0005L -1L; sl_test[i].expected = "-6";
-
-  i++; sl_test[i].num =  0x0000L -1L; sl_test[i].expected = "-1";
-
-  num_slong_tests = i;
-
-#elif (SIZEOF_LONG == 4)
+#if SIZEOF_LONG == 4
 
   i = 1; sl_test[i].num = 0x7FFFFFFFL; sl_test[i].expected = "2147483647";
   i++; sl_test[i].num = 0x7FFFFFFEL; sl_test[i].expected = "2147483646";
@@ -888,11 +604,11 @@ static int test_signed_long_formatting(void)
   i++; sl_test[i].num = -0x00000050L -1L; sl_test[i].expected = "-81";
   i++; sl_test[i].num = -0x00000005L -1L; sl_test[i].expected = "-6";
 
-  i++; sl_test[i].num =  0x00000000L -1L; sl_test[i].expected = "-1";
+  i++; sl_test[i].num = 0x00000000L -1L; sl_test[i].expected = "-1";
 
   num_slong_tests = i;
 
-#elif (SIZEOF_LONG == 8)
+#elif SIZEOF_LONG == 8
 
   i = 1; sl_test[i].num = 0x7FFFFFFFFFFFFFFFL; sl_test[i].expected = "9223372036854775807";
   i++; sl_test[i].num = 0x7FFFFFFFFFFFFFFEL; sl_test[i].expected = "9223372036854775806";
@@ -971,7 +687,7 @@ static int test_signed_long_formatting(void)
   i++; sl_test[i].num = -0x0000000000000070L -1L; sl_test[i].expected = "-113";
   i++; sl_test[i].num = -0x0000000000000007L -1L; sl_test[i].expected = "-8";
 
-  i++; sl_test[i].num =  0x0000000000000000L -1L; sl_test[i].expected = "-1";
+  i++; sl_test[i].num = 0x0000000000000000L -1L; sl_test[i].expected = "-1";
 
   num_slong_tests = i;
 
@@ -979,123 +695,122 @@ static int test_signed_long_formatting(void)
 
   for(i = 1; i <= num_slong_tests; i++) {
 
-    for(j = 0; j<BUFSZ; j++)
+    for(j = 0; j < BUFSZ; j++)
       sl_test[i].result[j] = 'X';
-    sl_test[i].result[BUFSZ-1] = '\0';
+    sl_test[i].result[BUFSZ - 1] = '\0';
 
     (void)curl_msprintf(sl_test[i].result, "%ld", sl_test[i].num);
 
     if(memcmp(sl_test[i].result,
               sl_test[i].expected,
               strlen(sl_test[i].expected))) {
-      printf("signed long test #%.2d: Failed (Expected: %s Got: %s)\n",
-             i, sl_test[i].expected, sl_test[i].result);
+      curl_mprintf("signed long test #%.2d: Failed (Expected: %s Got: %s)\n",
+                   i, sl_test[i].expected, sl_test[i].result);
       failed++;
     }
-
   }
 
   if(!failed)
-    printf("All curl_mprintf() signed long tests OK!\n");
+    curl_mprintf("All curl_mprintf() signed long tests OK!\n");
   else
-    printf("Some curl_mprintf() signed long tests Failed!\n");
+    curl_mprintf("Some curl_mprintf() signed long tests Failed!\n");
 
   return failed;
 }
 
-
 static int test_curl_off_t_formatting(void)
 {
   int i, j;
   int num_cofft_tests = 0;
   int failed = 0;
 
-  i = 1; co_test[i].num = MPRNT_OFF_T_C(0x7FFFFFFFFFFFFFFF); co_test[i].expected = "9223372036854775807";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x7FFFFFFFFFFFFFFE); co_test[i].expected = "9223372036854775806";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x7FFFFFFFFFFFFFFD); co_test[i].expected = "9223372036854775805";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x7FFFFFFF00000000); co_test[i].expected = "9223372032559808512";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x000000007FFFFFFF); co_test[i].expected = "2147483647";
+  i = 1; co_test[i].num = 0x7FFFFFFFFFFFFFFFLL; co_test[i].expected = "9223372036854775807";
+  i++; co_test[i].num = 0x7FFFFFFFFFFFFFFE; co_test[i].expected = "9223372036854775806";
+  i++; co_test[i].num = 0x7FFFFFFFFFFFFFFD; co_test[i].expected = "9223372036854775805";
+  i++; co_test[i].num = 0x7FFFFFFF00000000; co_test[i].expected = "9223372032559808512";
+  i++; co_test[i].num = 0x000000007FFFFFFF; co_test[i].expected = "2147483647";
 
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x7FFF000000000000); co_test[i].expected = "9223090561878065152";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x00007FFF00000000); co_test[i].expected = "140733193388032";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x000000007FFF0000); co_test[i].expected = "2147418112";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0000000000007FFF); co_test[i].expected = "32767";
+  i++; co_test[i].num = 0x7FFF000000000000; co_test[i].expected = "9223090561878065152";
+  i++; co_test[i].num = 0x00007FFF00000000; co_test[i].expected = "140733193388032";
+  i++; co_test[i].num = 0x000000007FFF0000; co_test[i].expected = "2147418112";
+  i++; co_test[i].num = 0x0000000000007FFF; co_test[i].expected = "32767";
 
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x7F00000000000000); co_test[i].expected = "9151314442816847872";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x007F000000000000); co_test[i].expected = "35747322042253312";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x00007F0000000000); co_test[i].expected = "139637976727552";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0000007F00000000); co_test[i].expected = "545460846592";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x000000007F000000); co_test[i].expected = "2130706432";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x00000000007F0000); co_test[i].expected = "8323072";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0000000000007F00); co_test[i].expected = "32512";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x000000000000007F); co_test[i].expected = "127";
+  i++; co_test[i].num = 0x7F00000000000000; co_test[i].expected = "9151314442816847872";
+  i++; co_test[i].num = 0x007F000000000000; co_test[i].expected = "35747322042253312";
+  i++; co_test[i].num = 0x00007F0000000000; co_test[i].expected = "139637976727552";
+  i++; co_test[i].num = 0x0000007F00000000; co_test[i].expected = "545460846592";
+  i++; co_test[i].num = 0x000000007F000000; co_test[i].expected = "2130706432";
+  i++; co_test[i].num = 0x00000000007F0000; co_test[i].expected = "8323072";
+  i++; co_test[i].num = 0x0000000000007F00; co_test[i].expected = "32512";
+  i++; co_test[i].num = 0x000000000000007F; co_test[i].expected = "127";
 
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x7000000000000000); co_test[i].expected = "8070450532247928832";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0700000000000000); co_test[i].expected = "504403158265495552";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0070000000000000); co_test[i].expected = "31525197391593472";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0007000000000000); co_test[i].expected = "1970324836974592";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0000700000000000); co_test[i].expected = "123145302310912";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0000070000000000); co_test[i].expected = "7696581394432";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0000007000000000); co_test[i].expected = "481036337152";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0000000700000000); co_test[i].expected = "30064771072";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0000000070000000); co_test[i].expected = "1879048192";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0000000007000000); co_test[i].expected = "117440512";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0000000000700000); co_test[i].expected = "7340032";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0000000000070000); co_test[i].expected = "458752";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0000000000007000); co_test[i].expected = "28672";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0000000000000700); co_test[i].expected = "1792";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0000000000000070); co_test[i].expected = "112";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0000000000000007); co_test[i].expected = "7";
+  i++; co_test[i].num = 0x7000000000000000; co_test[i].expected = "8070450532247928832";
+  i++; co_test[i].num = 0x0700000000000000; co_test[i].expected = "504403158265495552";
+  i++; co_test[i].num = 0x0070000000000000; co_test[i].expected = "31525197391593472";
+  i++; co_test[i].num = 0x0007000000000000; co_test[i].expected = "1970324836974592";
+  i++; co_test[i].num = 0x0000700000000000; co_test[i].expected = "123145302310912";
+  i++; co_test[i].num = 0x0000070000000000; co_test[i].expected = "7696581394432";
+  i++; co_test[i].num = 0x0000007000000000; co_test[i].expected = "481036337152";
+  i++; co_test[i].num = 0x0000000700000000; co_test[i].expected = "30064771072";
+  i++; co_test[i].num = 0x0000000070000000; co_test[i].expected = "1879048192";
+  i++; co_test[i].num = 0x0000000007000000; co_test[i].expected = "117440512";
+  i++; co_test[i].num = 0x0000000000700000; co_test[i].expected = "7340032";
+  i++; co_test[i].num = 0x0000000000070000; co_test[i].expected = "458752";
+  i++; co_test[i].num = 0x0000000000007000; co_test[i].expected = "28672";
+  i++; co_test[i].num = 0x0000000000000700; co_test[i].expected = "1792";
+  i++; co_test[i].num = 0x0000000000000070; co_test[i].expected = "112";
+  i++; co_test[i].num = 0x0000000000000007; co_test[i].expected = "7";
 
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0000000000000001); co_test[i].expected = "1";
-  i++; co_test[i].num = MPRNT_OFF_T_C(0x0000000000000000); co_test[i].expected = "0";
+  i++; co_test[i].num = 0x0000000000000001; co_test[i].expected = "1";
+  i++; co_test[i].num = 0x0000000000000000; co_test[i].expected = "0";
 
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x7FFFFFFFFFFFFFFF) -MPRNT_OFF_T_C(1); co_test[i].expected = "-9223372036854775808";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x7FFFFFFFFFFFFFFE) -MPRNT_OFF_T_C(1); co_test[i].expected = "-9223372036854775807";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x7FFFFFFFFFFFFFFD) -MPRNT_OFF_T_C(1); co_test[i].expected = "-9223372036854775806";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x7FFFFFFF00000000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-9223372032559808513";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x000000007FFFFFFF) -MPRNT_OFF_T_C(1); co_test[i].expected = "-2147483648";
+  i++; co_test[i].num = -0x7FFFFFFFFFFFFFFFLL - 1; co_test[i].expected = "-9223372036854775808";
+  i++; co_test[i].num = -0x7FFFFFFFFFFFFFFE -1; co_test[i].expected = "-9223372036854775807";
+  i++; co_test[i].num = -0x7FFFFFFFFFFFFFFD -1; co_test[i].expected = "-9223372036854775806";
+  i++; co_test[i].num = -0x7FFFFFFF00000000 -1; co_test[i].expected = "-9223372032559808513";
+  i++; co_test[i].num = -0x000000007FFFFFFF -1; co_test[i].expected = "-2147483648";
 
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x7FFF000000000000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-9223090561878065153";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x00007FFF00000000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-140733193388033";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x000000007FFF0000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-2147418113";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x0000000000007FFF) -MPRNT_OFF_T_C(1); co_test[i].expected = "-32768";
+  i++; co_test[i].num = -0x7FFF000000000000 -1; co_test[i].expected = "-9223090561878065153";
+  i++; co_test[i].num = -0x00007FFF00000000 -1; co_test[i].expected = "-140733193388033";
+  i++; co_test[i].num = -0x000000007FFF0000 -1; co_test[i].expected = "-2147418113";
+  i++; co_test[i].num = -0x0000000000007FFF -1; co_test[i].expected = "-32768";
 
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x7F00000000000000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-9151314442816847873";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x007F000000000000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-35747322042253313";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x00007F0000000000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-139637976727553";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x0000007F00000000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-545460846593";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x000000007F000000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-2130706433";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x00000000007F0000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-8323073";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x0000000000007F00) -MPRNT_OFF_T_C(1); co_test[i].expected = "-32513";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x000000000000007F) -MPRNT_OFF_T_C(1); co_test[i].expected = "-128";
+  i++; co_test[i].num = -0x7F00000000000000 -1; co_test[i].expected = "-9151314442816847873";
+  i++; co_test[i].num = -0x007F000000000000 -1; co_test[i].expected = "-35747322042253313";
+  i++; co_test[i].num = -0x00007F0000000000 -1; co_test[i].expected = "-139637976727553";
+  i++; co_test[i].num = -0x0000007F00000000 -1; co_test[i].expected = "-545460846593";
+  i++; co_test[i].num = -0x000000007F000000 -1; co_test[i].expected = "-2130706433";
+  i++; co_test[i].num = -0x00000000007F0000 -1; co_test[i].expected = "-8323073";
+  i++; co_test[i].num = -0x0000000000007F00 -1; co_test[i].expected = "-32513";
+  i++; co_test[i].num = -0x000000000000007F -1; co_test[i].expected = "-128";
 
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x7000000000000000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-8070450532247928833";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x0700000000000000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-504403158265495553";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x0070000000000000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-31525197391593473";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x0007000000000000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-1970324836974593";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x0000700000000000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-123145302310913";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x0000070000000000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-7696581394433";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x0000007000000000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-481036337153";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x0000000700000000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-30064771073";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x0000000070000000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-1879048193";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x0000000007000000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-117440513";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x0000000000700000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-7340033";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x0000000000070000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-458753";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x0000000000007000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-28673";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x0000000000000700) -MPRNT_OFF_T_C(1); co_test[i].expected = "-1793";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x0000000000000070) -MPRNT_OFF_T_C(1); co_test[i].expected = "-113";
-  i++; co_test[i].num = -MPRNT_OFF_T_C(0x0000000000000007) -MPRNT_OFF_T_C(1); co_test[i].expected = "-8";
+  i++; co_test[i].num = -0x7000000000000000 -1; co_test[i].expected = "-8070450532247928833";
+  i++; co_test[i].num = -0x0700000000000000 -1; co_test[i].expected = "-504403158265495553";
+  i++; co_test[i].num = -0x0070000000000000 -1; co_test[i].expected = "-31525197391593473";
+  i++; co_test[i].num = -0x0007000000000000 -1; co_test[i].expected = "-1970324836974593";
+  i++; co_test[i].num = -0x0000700000000000 -1; co_test[i].expected = "-123145302310913";
+  i++; co_test[i].num = -0x0000070000000000 -1; co_test[i].expected = "-7696581394433";
+  i++; co_test[i].num = -0x0000007000000000 -1; co_test[i].expected = "-481036337153";
+  i++; co_test[i].num = -0x0000000700000000 -1; co_test[i].expected = "-30064771073";
+  i++; co_test[i].num = -0x0000000070000000 -1; co_test[i].expected = "-1879048193";
+  i++; co_test[i].num = -0x0000000007000000 -1; co_test[i].expected = "-117440513";
+  i++; co_test[i].num = -0x0000000000700000 -1; co_test[i].expected = "-7340033";
+  i++; co_test[i].num = -0x0000000000070000 -1; co_test[i].expected = "-458753";
+  i++; co_test[i].num = -0x0000000000007000 -1; co_test[i].expected = "-28673";
+  i++; co_test[i].num = -0x0000000000000700 -1; co_test[i].expected = "-1793";
+  i++; co_test[i].num = -0x0000000000000070 -1; co_test[i].expected = "-113";
+  i++; co_test[i].num = -0x0000000000000007 -1; co_test[i].expected = "-8";
 
-  i++; co_test[i].num =  MPRNT_OFF_T_C(0x0000000000000000) -MPRNT_OFF_T_C(1); co_test[i].expected = "-1";
+  i++; co_test[i].num = 0x0000000000000000 -1; co_test[i].expected = "-1";
+/* !checksrc! enable LONGLINE */
 
   num_cofft_tests = i;
 
   for(i = 1; i <= num_cofft_tests; i++) {
 
-    for(j = 0; j<BUFSZ; j++)
+    for(j = 0; j < BUFSZ; j++)
       co_test[i].result[j] = 'X';
-    co_test[i].result[BUFSZ-1] = '\0';
+    co_test[i].result[BUFSZ - 1] = '\0';
 
     (void)curl_msprintf(co_test[i].result, "%" CURL_FORMAT_CURL_OFF_T,
                         co_test[i].num);
@@ -1103,47 +818,20 @@ static int test_curl_off_t_formatting(void)
     if(memcmp(co_test[i].result,
               co_test[i].expected,
               strlen(co_test[i].expected))) {
-      printf("curl_off_t test #%.2d: Failed (Expected: %s Got: %s)\n",
-             i, co_test[i].expected, co_test[i].result);
+      curl_mprintf("curl_off_t test #%.2d: Failed (Expected: %s Got: %s)\n",
+                   i, co_test[i].expected, co_test[i].result);
       failed++;
     }
-
   }
 
   if(!failed)
-    printf("All curl_mprintf() curl_off_t tests OK!\n");
+    curl_mprintf("All curl_mprintf() curl_off_t tests OK!\n");
   else
-    printf("Some curl_mprintf() curl_off_t tests Failed!\n");
+    curl_mprintf("Some curl_mprintf() curl_off_t tests Failed!\n");
 
   return failed;
 }
 
-static int _string_check(int linenumber, char *buf, const char *buf2)
-{
-  if(strcmp(buf, buf2)) {
-    /* they shouldn't differ */
-    printf("sprintf line %d failed:\nwe      '%s'\nsystem: '%s'\n",
-           linenumber, buf, buf2);
-    return 1;
-  }
-  return 0;
-}
-#define string_check(x,y) _string_check(__LINE__, x, y)
-
-static int _strlen_check(int linenumber, char *buf, size_t len)
-{
-  size_t buflen = strlen(buf);
-  if(len != buflen) {
-    /* they shouldn't differ */
-    printf("sprintf strlen:%d failed:\nwe '%zu'\nsystem: '%zu'\n",
-           linenumber, buflen, len);
-    return 1;
-  }
-  return 0;
-}
-
-#define strlen_check(x,y) _strlen_check(__LINE__, x, y)
-
 /*
  * The output strings in this test need to have been verified with a system
  * sprintf() before used here.
@@ -1156,7 +844,7 @@ static int test_string_formatting(void)
   errors += string_check(buf, "09foo");
 
   curl_msnprintf(buf, sizeof(buf), "%*.*s", 5, 2, "foo");
-  errors += string_check(buf, "   fo");
+  errors += string_check(buf, "   fo"); /* spellchecker:disable-line */
 
   curl_msnprintf(buf, sizeof(buf), "%*.*s", 2, 5, "foo");
   errors += string_check(buf, "foo");
@@ -1174,9 +862,66 @@ static int test_string_formatting(void)
   errors += string_check(buf, "foo       ");
 
   if(!errors)
-    printf("All curl_mprintf() strings tests OK!\n");
+    curl_mprintf("All curl_mprintf() strings tests OK!\n");
   else
-    printf("Some curl_mprintf() string tests Failed!\n");
+    curl_mprintf("Some curl_mprintf() string tests Failed!\n");
+
+  return errors;
+}
+
+static int test_pos_arguments(void)
+{
+  int errors = 0;
+  char buf[256];
+
+  curl_msnprintf(buf, sizeof(buf), "%3$d %2$d %1$d", 500, 501, 502);
+  errors += string_check(buf, "502 501 500");
+
+  curl_msnprintf(buf, sizeof(buf), "%3$d %1$d %2$d", 500, 501, 502);
+  errors += string_check(buf, "502 500 501");
+
+  /* this is in invalid sequence but the output does not match
+     what glibc does */
+  curl_msnprintf(buf, sizeof(buf), "%3$d %d %2$d", 500, 501, 502);
+  errors += string_check(buf, "");
+
+  return errors;
+}
+
+static int test_width_precision(void)
+{
+  /* 325 is max precision (and width) for a double */
+  char larger[1024];
+#define SPACE60  "                                                            "
+#define SPACE300 SPACE60 SPACE60 SPACE60 SPACE60 SPACE60
+#define OK325    SPACE300 "                        0"
+
+  int rc;
+  int errors = 0;
+  rc = curl_msnprintf(larger, sizeof(larger), "%325.325f", 0.1);
+  if(rc != 325)
+    errors++;
+  errors += string_check(larger, OK325);
+
+  rc = curl_msnprintf(larger, sizeof(larger), "%326.326f", 0.1);
+  if(rc != 325)
+    errors++;
+  errors += string_check(larger, OK325);
+
+  rc = curl_msnprintf(larger, sizeof(larger), "%1000.1000f", 0.1);
+  if(rc != 325)
+    errors++;
+  errors += string_check(larger, OK325);
+
+  rc = curl_msnprintf(larger, sizeof(larger), "%324.324f", 0.1);
+  if(rc != 324)
+    errors++;
+  rc = curl_msnprintf(larger, sizeof(larger), "%324.0f", 0.1);
+  if(rc != 324)
+    errors++;
+  rc = curl_msnprintf(larger, sizeof(larger), "%0.324f", 0.1);
+  if(rc != 325)
+    errors++;
 
   return errors;
 }
@@ -1187,6 +932,24 @@ static int test_weird_arguments(void)
   char buf[256];
   int rc;
 
+  /* verify %% */
+  (void)curl_msnprintf(buf, sizeof(buf), "%-20d%% right? %%", 500);
+  errors += string_check(buf, "500                 % right? %");
+
+  /* 100 x % */
+  (void)curl_msnprintf(buf, sizeof(buf), "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%"
+                       "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%"
+                       "%%%%%%%%%%%%%%%%%%%%%%");
+  /* 50 x % */
+  errors += string_check(buf, "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%"
+                         "%%%%%%%%%%%%%%%");
+
+  (void)curl_msnprintf(buf, sizeof(buf), "%2 AA %d %K", 500, 501, 502);
+  errors += string_check(buf, "%2 AA 500 %K");
+
+  (void)curl_msnprintf(buf, sizeof(buf), "%2 %d %K", 500, 501, 502);
+  errors += string_check(buf, "%2 500 %K");
+
   /* MAX_PARAMETERS is 128, try exact 128! */
   rc = curl_msnprintf(buf, sizeof(buf),
                       "%d%d%d%d%d%d%d%d%d%d" /* 10 */
@@ -1215,10 +978,10 @@ static int test_weird_arguments(void)
                       0, 1, 2, 3, 4, 5, 6, 7, 8, 9, /* 10 9 */
                       0, 1, 2, 3, 4, 5, 6, 7, 8, 9, /* 10 10 */
                       0, 1, 2, 3, 4, 5, 6, 7, 8, 9, /* 10 11 */
-                      0, 1, 2, 3, 4, 5, 6, 7); /* 8 */
+                      0, 1, 2, 3, 4, 5, 6, 7);      /* 8 */
 
   if(rc != 128) {
-    printf("curl_mprintf() returned %d and not 128!\n", rc);
+    curl_mprintf("curl_mprintf() returned %d and not 128!\n", rc);
     errors++;
   }
 
@@ -1270,32 +1033,22 @@ static int test_weird_arguments(void)
                       0, 1, 2, 3, 4, 5, 6, 7, 8);   /* 9 */
 
   if(rc) {
-    printf("curl_mprintf() returned %d and not 0\n", rc);
+    curl_mprintf("curl_mprintf() returned %d and not 0\n", rc);
     errors++;
   }
 
   errors += string_check(buf, "");
 
-  /* Do not skip sanity checks with parameters! */
-  buf[0] = 0;
-  rc = curl_msnprintf(buf, sizeof(buf), "%d, %.*1$d", 500, 1);
-
-  if(rc != sizeof(buf) - 1) {
-    printf("curl_mprintf() returned %d and not %d!\n", rc,
-           sizeof(buf) - 1);
-    errors++;
-  }
-
-  errors += strlen_check(buf, 255);
+  errors += test_width_precision();
 
   if(errors)
-    printf("Some curl_mprintf() weird arguments tests failed!\n");
+    curl_mprintf("Some curl_mprintf() weird arguments tests failed!\n");
 
   return errors;
 }
 
 /* DBL_MAX value from Linux */
-#define MAXIMIZE -1.7976931348623157081452E+308
+#define MAXIMIZE (-1.7976931348623157081452E+308)
 
 static int test_float_formatting(void)
 {
@@ -1361,10 +1114,10 @@ static int test_float_formatting(void)
   curl_msnprintf(buf, sizeof(buf), "%.*f", 0, 9.2987654);
   errors += string_check(buf, "9");
 
-  /* very large precisions easily turn into system specific outputs so we only
+  /* large precisions easily turn into system specific outputs so we only
      check the output buffer length here as we know the internal limit */
 
-  curl_msnprintf(buf, sizeof(buf), "%.*f", (1<<30), 9.2987654);
+  curl_msnprintf(buf, sizeof(buf), "%.*f", (1 << 30), 9.2987654);
   errors += strlen_check(buf, 325);
 
   curl_msnprintf(buf, sizeof(buf), "%10000.10000f", 9.2987654);
@@ -1374,16 +1127,29 @@ static int test_float_formatting(void)
                  123456789123456789123456789.2987654);
   errors += strlen_check(buf, 325);
 
-  /* check negative when used signed */
+  /* check negative width argument when used signed, is treated as positive
+     and maxes out the internal float width == 325 */
   curl_msnprintf(buf, sizeof(buf), "%*f", INT_MIN, 9.1);
-  errors += string_check(buf, "9.100000");
+  errors += string_check(buf, "9.100000                                       "
+    "                                                                         "
+    "                                                                         "
+    "                                                                         "
+    "                                                           ");
 
   /* curl_msnprintf() limits a single float output to 325 bytes maximum
      width */
-  curl_msnprintf(buf, sizeof(buf), "%*f", (1<<30), 9.1);
-  errors += string_check(buf, "                                                                                                                                                                                                                                                                                                                             9.100000");
+  curl_msnprintf(buf, sizeof(buf), "%*f", (1 << 30), 9.1);
+  errors += string_check(buf, "                                               "
+    "                                                                         "
+    "                                                                         "
+    "                                                                         "
+    "                                                   9.100000");
   curl_msnprintf(buf, sizeof(buf), "%100000f", 9.1);
-  errors += string_check(buf, "                                                                                                                                                                                                                                                                                                                             9.100000");
+  errors += string_check(buf, "                                               "
+    "                                                                         "
+    "                                                                         "
+    "                                                                         "
+    "                                                   9.100000");
 
   curl_msnprintf(buf, sizeof(buf), "%f", MAXIMIZE);
   errors += strlen_check(buf, 317);
@@ -1400,13 +1166,45 @@ static int test_float_formatting(void)
   errors += strlen_check(buf, 5);
 
   if(!errors)
-    printf("All float strings tests OK!\n");
+    curl_mprintf("All float strings tests OK!\n");
   else
-    printf("test_float_formatting Failed!\n");
+    curl_mprintf("test_float_formatting Failed!\n");
+
+  return errors;
+}
+
+static int test_oct_hex_formatting(void)
+{
+  int errors = 0;
+  char buf[256];
+
+  curl_msnprintf(buf, sizeof(buf), "%ho %hx %hX %+X %+x",
+                 0xFA10U, 0xFA10U, 0xFA10U, 0xFA10, 0xFA10);
+  errors += string_check(buf, "175020 fa10 FA10 +FA10 +fa10");
+
+  curl_msnprintf(buf, sizeof(buf), "%o %x %X %+o",
+                 0xFABC1230U, 0xFABC1230U, 0xFABC1230U, 1234U);
+  errors += string_check(buf, "37257011060 fabc1230 FABC1230 +2322");
+
+#if SIZEOF_LONG == 4
+  curl_msnprintf(buf, sizeof(buf), "%lo %lx %lX %+lo",
+                 0xFABC1230UL, 0xFABC1230UL, 0xFABC1230UL, 1234UL);
+  errors += string_check(buf, "37257011060 fabc1230 FABC1230 +2322");
+#elif SIZEOF_LONG == 8
+  curl_msnprintf(buf, sizeof(buf), "%lo %lx %lX %+lo",
+                 0xFABCDEF123456780UL, 0xFABCDEF123456780UL,
+                 0xFABCDEF123456780UL, 1234UL);
+  errors += string_check(buf, "1752746757044321263600 fabcdef123456780 "
+                         "FABCDEF123456780 +2322");
+#endif
+
+  if(!errors)
+    curl_mprintf("All curl_mprintf() octal and hexadecimal tests OK!\n");
+  else
+    curl_mprintf("Some curl_mprintf() octal or hexadecimal tests Failed!\n");
 
   return errors;
 }
-/* !checksrc! enable LONGLINE */
 
 static int test_return_codes(void)
 {
@@ -1438,10 +1236,11 @@ static int test_return_codes(void)
 
   return 0;
 }
-int test(char *URL)
+
+static CURLcode test_lib557(const char *URL)
 {
   int errors = 0;
-  (void)URL; /* not used */
+  (void)URL;
 
 #ifdef HAVE_SETLOCALE
   /*
@@ -1451,30 +1250,26 @@ int test(char *URL)
   setlocale(LC_NUMERIC, "C");
 #endif
 
+  errors += test_pos_arguments();
   errors += test_weird_arguments();
-
   errors += test_unsigned_short_formatting();
-
   errors += test_signed_short_formatting();
-
   errors += test_unsigned_int_formatting();
-
   errors += test_signed_int_formatting();
-
   errors += test_unsigned_long_formatting();
-
   errors += test_signed_long_formatting();
-
   errors += test_curl_off_t_formatting();
-
   errors += test_string_formatting();
-
   errors += test_float_formatting();
-
+  errors += test_oct_hex_formatting();
   errors += test_return_codes();
 
   if(errors)
     return TEST_ERR_MAJOR_BAD;
   else
-    return 0;
+    return CURLE_OK;
 }
+
+#ifdef CURL_HAVE_DIAG
+#pragma GCC diagnostic pop
+#endif
diff --git a/third-party/curl/tests/libtest/lib558.c b/third-party/curl/tests/libtest/lib558.c
index 1f42aa3b71..6a14719bb5 100644
--- a/third-party/curl/tests/libtest/lib558.c
+++ b/third-party/curl/tests/libtest/lib558.c
@@ -21,27 +21,25 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib558(const char *URL)
 {
-  unsigned char a[] = {0x2f, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
-                       0x91, 0xa2, 0xb3, 0xc4, 0xd5, 0xe6, 0xf7};
-  CURLcode res = CURLE_OK;
+  unsigned char a[] = { 0x2f, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
+                        0x91, 0xa2, 0xb3, 0xc4, 0xd5, 0xe6, 0xf7 };
+  CURLcode result = CURLE_OK;
   char *ptr = NULL;
   int asize;
 
-  (void)URL; /* we don't use this */
+  (void)URL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
-  ptr = malloc(558);
-  Curl_safefree(ptr);
+  ptr = curlx_malloc(558);
+  curlx_safefree(ptr);
 
   asize = (int)sizeof(a);
   ptr = curl_easy_escape(NULL, (char *)a, asize);
@@ -50,5 +48,5 @@ int test(char *URL)
 
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib559.c b/third-party/curl/tests/libtest/lib559.c
index 8b06fb451d..27a8cb9c22 100644
--- a/third-party/curl/tests/libtest/lib559.c
+++ b/third-party/curl/tests/libtest/lib559.c
@@ -21,37 +21,34 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testtrace.h"
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib559(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_HEADER, 1L);
-  test_setopt(curl, CURLOPT_BUFFERSIZE, 1L); /* the smallest! */
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_BUFFERSIZE, 1L); /* the smallest! */
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib560.c b/third-party/curl/tests/libtest/lib560.c
index d643b7e76d..ef36049668 100644
--- a/third-party/curl/tests/libtest/lib560.c
+++ b/third-party/curl/tests/libtest/lib560.c
@@ -21,54 +21,46 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
+#include "first.h"
 
 /*
- * Simply download an HTTPS file!
+ * Download an HTTPS file!
  *
  * This test was added after the HTTPS-using-multi-interface with OpenSSL
  * regression of 7.19.1 to hopefully prevent this embarrassing mistake from
- * appearing again... Unfortunately the bug wasn't triggered by this test,
+ * appearing again... Unfortunately the bug was not triggered by this test,
  * which presumably is because the connect to a local server is too
  * fast/different compared to the real/distant servers we saw the bug happen
  * with.
  */
-int test(char *URL)
+static CURLcode test_lib560(const char *URL)
 {
-  CURL *http_handle = NULL;
-  CURLM *multi_handle = NULL;
-  int res = 0;
+  CURL *curl = NULL;
+  CURLM *multi = NULL;
+  CURLcode result = CURLE_OK;
 
   int still_running; /* keep number of running handles */
 
   start_test_timing();
 
-  /*
-  ** curl_global_init called indirectly from curl_easy_init.
-  */
+  /* curl_global_init called indirectly from curl_easy_init */
 
-  easy_init(http_handle);
+  easy_init(curl);
 
   /* set options */
-  easy_setopt(http_handle, CURLOPT_URL, URL);
-  easy_setopt(http_handle, CURLOPT_HEADER, 1L);
-  easy_setopt(http_handle, CURLOPT_SSL_VERIFYPEER, 0L);
-  easy_setopt(http_handle, CURLOPT_SSL_VERIFYHOST, 0L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+  easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
 
   /* init a multi stack */
-  multi_init(multi_handle);
+  multi_init(multi);
 
   /* add the individual transfers */
-  multi_add_handle(multi_handle, http_handle);
+  multi_add_handle(multi, curl);
 
   /* we start some action by calling perform right away */
-  multi_perform(multi_handle, &still_running);
+  multi_perform(multi, &still_running);
 
   abort_on_test_timeout();
 
@@ -89,7 +81,7 @@ int test(char *URL)
     timeout.tv_usec = 0;
 
     /* get file descriptors from the transfers */
-    multi_fdset(multi_handle, &fdread, &fdwrite, &fdexcep, &maxfd);
+    multi_fdset(multi, &fdread, &fdwrite, &fdexcep, &maxfd);
 
     /* At this point, maxfd is guaranteed to be greater or equal than -1. */
 
@@ -98,7 +90,7 @@ int test(char *URL)
     abort_on_test_timeout();
 
     /* timeout or readable/writable sockets */
-    multi_perform(multi_handle, &still_running);
+    multi_perform(multi, &still_running);
 
     abort_on_test_timeout();
   }
@@ -107,9 +99,9 @@ test_cleanup:
 
   /* undocumented cleanup sequence - type UA */
 
-  curl_multi_cleanup(multi_handle);
-  curl_easy_cleanup(http_handle);
+  curl_multi_cleanup(multi);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib562.c b/third-party/curl/tests/libtest/lib562.c
index 8b9807e375..5cec3f7472 100644
--- a/third-party/curl/tests/libtest/lib562.c
+++ b/third-party/curl/tests/libtest/lib562.c
@@ -21,56 +21,53 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#ifdef HAVE_FCNTL_H
-#include <fcntl.h>
-#endif
-
-#include "memdebug.h"
+#include "first.h"
 
 /*
- * From "KNOWN_BUGS" April 2009:
-
- 59. If the CURLOPT_PORT option is used on an FTP URL like
- "ftp://example.com/file;type=A" the ";type=A" is stripped off.
+  From "KNOWN_BUGS" April 2009:
 
+  59. If the CURLOPT_PORT option is used on an FTP URL like
+      "ftp://example.com/file;type=A" the ";type=A" is stripped off.
  */
 
-int test(char *URL)
+static CURLcode test_lib562(const char *URL)
 {
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  curl_off_t port;
+
+  if(curlx_str_number(&libtest_arg2, &port, 0xffff))
+    return result;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
-    return TEST_ERR_MAJOR_BAD;
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return result;
   }
 
   /* get a curl handle */
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
-    return TEST_ERR_MAJOR_BAD;
+    return result;
   }
 
   /* enable verbose */
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* set port number */
-  test_setopt(curl, CURLOPT_PORT, strtol(libtest_arg2, NULL, 10));
+  easy_setopt(curl, CURLOPT_PORT, (long)port);
 
   /* specify target */
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
-  /* Now run off and do what you've been told! */
-  res = curl_easy_perform(curl);
+  /* Now run off and do what you have been told! */
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib564.c b/third-party/curl/tests/libtest/lib564.c
index 6c785feacc..41c3bc8c41 100644
--- a/third-party/curl/tests/libtest/lib564.c
+++ b/third-party/curl/tests/libtest/lib564.c
@@ -21,22 +21,19 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include <fcntl.h>
+#include "testtrace.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
-
-int test(char *URL)
+static CURLcode test_lib564(const char *URL)
 {
-  int res = 0;
+  CURLcode result = CURLE_OK;
   CURL *curl = NULL;
   int running;
-  CURLM *m = NULL;
+  CURLM *multi = NULL;
+
+  debug_config.nohex = TRUE;
+  debug_config.tracetime = TRUE;
 
   start_test_timing();
 
@@ -45,15 +42,17 @@ int test(char *URL)
   easy_init(curl);
 
   easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_DEBUGDATA, &debug_config);
+  easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
   easy_setopt(curl, CURLOPT_VERBOSE, 1L);
   easy_setopt(curl, CURLOPT_PROXY, libtest_arg2);
-  easy_setopt(curl, CURLOPT_PROXYTYPE, (long)CURLPROXY_SOCKS4);
+  easy_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS4);
 
-  multi_init(m);
+  multi_init(multi);
 
-  multi_add_handle(m, curl);
+  multi_add_handle(multi, curl);
 
-  fprintf(stderr, "Start at URL 0\n");
+  curl_mfprintf(stderr, "Start at URL 0\n");
 
   for(;;) {
     struct timeval interval;
@@ -63,7 +62,7 @@ int test(char *URL)
     interval.tv_sec = 1;
     interval.tv_usec = 0;
 
-    multi_perform(m, &running);
+    multi_perform(multi, &running);
 
     abort_on_test_timeout();
 
@@ -74,7 +73,7 @@ int test(char *URL)
     FD_ZERO(&wr);
     FD_ZERO(&exc);
 
-    multi_fdset(m, &rd, &wr, &exc, &maxfd);
+    multi_fdset(multi, &rd, &wr, &exc, &maxfd);
 
     /* At this point, maxfd is guaranteed to be greater or equal than -1. */
 
@@ -88,8 +87,8 @@ test_cleanup:
   /* undocumented cleanup sequence - type UB */
 
   curl_easy_cleanup(curl);
-  curl_multi_cleanup(m);
+  curl_multi_cleanup(multi);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib566.c b/third-party/curl/tests/libtest/lib566.c
index 7d695ad5ee..9042894618 100644
--- a/third-party/curl/tests/libtest/lib566.c
+++ b/third-party/curl/tests/libtest/lib566.c
@@ -21,44 +21,41 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib566(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
 
   double content_length = 3;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
-  if(!res) {
+  if(!result) {
     FILE *moo;
-    CURL_IGNORE_DEPRECATION(
-      res = curl_easy_getinfo(curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD,
-                              &content_length);
-    )
-    moo = fopen(libtest_arg2, "wb");
+    result = curl_easy_getinfo(curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD,
+                               &content_length);
+
+    moo = curlx_fopen(libtest_arg2, "wb");
     if(moo) {
-      fprintf(moo, "CL %.0f\n", content_length);
-      fclose(moo);
+      curl_mfprintf(moo, "CL %.0f\n", content_length);
+      curlx_fclose(moo);
     }
   }
 
@@ -67,5 +64,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib567.c b/third-party/curl/tests/libtest/lib567.c
index 00937e71d6..dc17f53b0b 100644
--- a/third-party/curl/tests/libtest/lib567.c
+++ b/third-party/curl/tests/libtest/lib567.c
@@ -21,44 +21,43 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "memdebug.h"
+#include "first.h"
 
 /*
  * Test a simple OPTIONS request with a custom header
  */
-int test(char *URL)
+static CURLcode test_lib567(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
   struct curl_slist *custom_headers = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* Dump data to stdout for protocol verification */
-  test_setopt(curl, CURLOPT_HEADERDATA, stdout);
-  test_setopt(curl, CURLOPT_WRITEDATA, stdout);
+  easy_setopt(curl, CURLOPT_HEADERDATA, stdout);
+  easy_setopt(curl, CURLOPT_WRITEDATA, stdout);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_RTSP_STREAM_URI, URL);
-  test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_OPTIONS);
-  test_setopt(curl, CURLOPT_USERAGENT, "test567");
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, URL);
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_OPTIONS);
+  easy_setopt(curl, CURLOPT_USERAGENT, "test567");
 
   custom_headers = curl_slist_append(custom_headers, "Test-Number: 567");
-  test_setopt(curl, CURLOPT_RTSPHEADER, custom_headers);
+  easy_setopt(curl, CURLOPT_RTSPHEADER, custom_headers);
 
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -67,5 +66,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib568.c b/third-party/curl/tests/libtest/lib568.c
index 97304fa58a..654de68461 100644
--- a/third-party/curl/tests/libtest/lib568.c
+++ b/third-party/curl/tests/libtest/lib568.c
@@ -21,151 +21,147 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#ifdef HAVE_SYS_STAT_H
-#include <sys/stat.h>
-#endif
-#ifdef HAVE_FCNTL_H
-#include <fcntl.h>
-#endif
-
-#include "memdebug.h"
-
-/* build request url */
-static char *suburl(const char *base, int i)
-{
-  return curl_maprintf("%s%.4d", base, i);
-}
+#include "first.h"
 
 /*
  * Test the Client->Server ANNOUNCE functionality (PUT style)
  */
-int test(char *URL)
+static CURLcode test_lib568(const char *URL)
 {
-  int res;
+  CURLcode result;
   CURL *curl;
+  char errbuf[STRERROR_LEN];
   int sdp;
   FILE *sdpf = NULL;
-  struct_stat file_info;
+  curlx_struct_stat file_info;
   char *stream_uri = NULL;
   int request = 1;
   struct curl_slist *custom_headers = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_HEADERDATA, stdout);
-  test_setopt(curl, CURLOPT_WRITEDATA, stdout);
+  easy_setopt(curl, CURLOPT_HEADERDATA, stdout);
+  easy_setopt(curl, CURLOPT_WRITEDATA, stdout);
 
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
-  stream_uri = suburl(URL, request++);
+  stream_uri = tutil_suburl(URL, request++);
   if(!stream_uri) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  test_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
   curl_free(stream_uri);
   stream_uri = NULL;
 
-  sdp = open(libtest_arg2, O_RDONLY);
-  fstat(sdp, &file_info);
-  close(sdp);
-
-  sdpf = fopen(libtest_arg2, "rb");
-  if(!sdpf) {
-    fprintf(stderr, "can't open %s\n", libtest_arg2);
-    res = TEST_ERR_MAJOR_BAD;
+  sdp = curlx_open(libtest_arg2, O_RDONLY);
+  if(sdp == -1) {
+    curl_mfprintf(stderr, "open() failed with error (%d) %s\n",
+                  errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
+    curl_mfprintf(stderr, "Error opening file '%s'\n", libtest_arg2);
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_ANNOUNCE);
+  curlx_fstat(sdp, &file_info);
+  curlx_close(sdp);
 
-  test_setopt(curl, CURLOPT_READDATA, sdpf);
-  test_setopt(curl, CURLOPT_UPLOAD, 1L);
-  test_setopt(curl, CURLOPT_INFILESIZE_LARGE, (curl_off_t) file_info.st_size);
+  sdpf = curlx_fopen(libtest_arg2, "rb");
+  if(!sdpf) {
+    curl_mfprintf(stderr, "fopen() failed with error (%d) %s\n",
+                  errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
+    curl_mfprintf(stderr, "Error opening file '%s'\n", libtest_arg2);
+    result = TEST_ERR_MAJOR_BAD;
+    goto test_cleanup;
+  }
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_ANNOUNCE);
+
+  easy_setopt(curl, CURLOPT_READDATA, sdpf);
+  easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+  easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, (curl_off_t)file_info.st_size);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* Do the ANNOUNCE */
-  res = curl_easy_perform(curl);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
-  test_setopt(curl, CURLOPT_UPLOAD, 0L);
-  fclose(sdpf);
+  easy_setopt(curl, CURLOPT_UPLOAD, 0L);
+  curlx_fclose(sdpf);
   sdpf = NULL;
 
   /* Make sure we can do a normal request now */
-  stream_uri = suburl(URL, request++);
+  stream_uri = tutil_suburl(URL, request++);
   if(!stream_uri) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  test_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
   curl_free(stream_uri);
   stream_uri = NULL;
 
-  test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_DESCRIBE);
-  res = curl_easy_perform(curl);
-  if(res)
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_DESCRIBE);
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
   /* Now do a POST style one */
 
-  stream_uri = suburl(URL, request++);
+  stream_uri = tutil_suburl(URL, request++);
   if(!stream_uri) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  test_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
   curl_free(stream_uri);
   stream_uri = NULL;
 
   custom_headers = curl_slist_append(custom_headers,
                                      "Content-Type: posty goodness");
   if(!custom_headers) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  test_setopt(curl, CURLOPT_RTSPHEADER, custom_headers);
-  test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_ANNOUNCE);
-  test_setopt(curl, CURLOPT_POSTFIELDS,
+  easy_setopt(curl, CURLOPT_RTSPHEADER, custom_headers);
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_ANNOUNCE);
+  easy_setopt(curl, CURLOPT_POSTFIELDS,
               "postyfield=postystuff&project=curl\n");
 
-  res = curl_easy_perform(curl);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
-  test_setopt(curl, CURLOPT_POSTFIELDS, NULL);
-  test_setopt(curl, CURLOPT_RTSPHEADER, NULL);
+  easy_setopt(curl, CURLOPT_POSTFIELDS, NULL);
+  easy_setopt(curl, CURLOPT_RTSPHEADER, NULL);
   curl_slist_free_all(custom_headers);
   custom_headers = NULL;
 
   /* Make sure we can do a normal request now */
-  stream_uri = suburl(URL, request++);
+  stream_uri = tutil_suburl(URL, request++);
   if(!stream_uri) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  test_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
   curl_free(stream_uri);
   stream_uri = NULL;
 
-  test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_OPTIONS);
-  res = curl_easy_perform(curl);
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_OPTIONS);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
   if(sdpf)
-    fclose(sdpf);
+    curlx_fclose(sdpf);
 
   curl_free(stream_uri);
 
@@ -175,5 +171,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib569.c b/third-party/curl/tests/libtest/lib569.c
index da95bb9558..8f79eeb71b 100644
--- a/third-party/curl/tests/libtest/lib569.c
+++ b/third-party/curl/tests/libtest/lib569.c
@@ -21,108 +21,103 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-#include "memdebug.h"
-
-/* build request url */
-static char *suburl(const char *base, int i)
-{
-  return curl_maprintf("%s%.4d", base, i);
-}
+#include "first.h"
 
 /*
  * Test Session ID capture
  */
-int test(char *URL)
+static CURLcode test_lib569(const char *URL)
 {
-  int res;
+  CURLcode result;
   CURL *curl;
   char *stream_uri = NULL;
-  char *rtsp_session_id;
   int request = 1;
   int i;
 
-  FILE *idfile = fopen(libtest_arg2, "wb");
+  FILE *idfile = curlx_fopen(libtest_arg2, "wb");
   if(!idfile) {
-    fprintf(stderr, "couldn't open the Session ID File\n");
+    curl_mfprintf(stderr, "Could not open the Session ID File\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
-    fclose(idfile);
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    curlx_fclose(idfile);
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
-    fclose(idfile);
+    curlx_fclose(idfile);
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_HEADERDATA, stdout);
-  test_setopt(curl, CURLOPT_WRITEDATA, stdout);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_HEADERDATA, stdout);
+  easy_setopt(curl, CURLOPT_WRITEDATA, stdout);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
-  test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_SETUP);
-  res = curl_easy_perform(curl);
-  if(res != (int)CURLE_BAD_FUNCTION_ARGUMENT) {
-    fprintf(stderr, "This should have failed. "
-            "Cannot setup without a Transport: header");
-    res = TEST_ERR_MAJOR_BAD;
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_SETUP);
+  result = curl_easy_perform(curl);
+  if(result != CURLE_BAD_FUNCTION_ARGUMENT) {
+    curl_mfprintf(stderr, "This should have failed. "
+                  "Cannot setup without a Transport: header");
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
 
   /* Go through the various Session IDs */
   for(i = 0; i < 3; i++) {
-    stream_uri = suburl(URL, request++);
+    const char *rtsp_session_id;
+    stream_uri = tutil_suburl(URL, request++);
     if(!stream_uri) {
-      res = TEST_ERR_MAJOR_BAD;
+      result = TEST_ERR_MAJOR_BAD;
       goto test_cleanup;
     }
-    test_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
+    easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
     curl_free(stream_uri);
     stream_uri = NULL;
 
-    test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_SETUP);
-    test_setopt(curl, CURLOPT_RTSP_TRANSPORT,
+    easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_SETUP);
+    easy_setopt(curl, CURLOPT_RTSP_TRANSPORT,
                 "Fake/NotReal/JustATest;foo=baz");
-    res = curl_easy_perform(curl);
-    if(res)
+    result = curl_easy_perform(curl);
+    if(result)
       goto test_cleanup;
 
     curl_easy_getinfo(curl, CURLINFO_RTSP_SESSION_ID, &rtsp_session_id);
-    fprintf(idfile, "Got Session ID: [%s]\n", rtsp_session_id);
+    curl_mfprintf(idfile, "Got Session ID: [%s]\n", rtsp_session_id);
     rtsp_session_id = NULL;
 
-    stream_uri = suburl(URL, request++);
+    stream_uri = tutil_suburl(URL, request++);
     if(!stream_uri) {
-      res = TEST_ERR_MAJOR_BAD;
+      result = TEST_ERR_MAJOR_BAD;
       goto test_cleanup;
     }
-    test_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
+    easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
     curl_free(stream_uri);
     stream_uri = NULL;
 
-    test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_TEARDOWN);
-    res = curl_easy_perform(curl);
+    easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_TEARDOWN);
+    result = curl_easy_perform(curl);
+    if(result)
+      goto test_cleanup;
 
     /* Clear for the next go-round */
-    test_setopt(curl, CURLOPT_RTSP_SESSION_ID, NULL);
+    easy_setopt(curl, CURLOPT_RTSP_SESSION_ID, NULL);
   }
 
 test_cleanup:
 
   if(idfile)
-    fclose(idfile);
+    curlx_fclose(idfile);
 
   curl_free(stream_uri);
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib570.c b/third-party/curl/tests/libtest/lib570.c
index 392c398a8f..998dd68cfa 100644
--- a/third-party/curl/tests/libtest/lib570.c
+++ b/third-party/curl/tests/libtest/lib570.c
@@ -21,94 +21,87 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-#include "memdebug.h"
+#include "first.h"
 
-/* build request url */
-static char *suburl(const char *base, int i)
+static CURLcode test_lib570(const char *URL)
 {
-  return curl_maprintf("%s%.4d", base, i);
-}
-
-int test(char *URL)
-{
-  int res;
+  CURLcode result;
   CURL *curl;
   int request = 1;
   char *stream_uri = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_HEADERDATA, stdout);
-  test_setopt(curl, CURLOPT_WRITEDATA, stdout);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_HEADERDATA, stdout);
+  easy_setopt(curl, CURLOPT_WRITEDATA, stdout);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
-  test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_OPTIONS);
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_OPTIONS);
 
-  stream_uri = suburl(URL, request++);
+  stream_uri = tutil_suburl(URL, request++);
   if(!stream_uri) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  test_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
   curl_free(stream_uri);
   stream_uri = NULL;
 
-  res = curl_easy_perform(curl);
-  if(res != (int)CURLE_RTSP_CSEQ_ERROR) {
-    fprintf(stderr, "Failed to detect CSeq mismatch");
-    res = TEST_ERR_MAJOR_BAD;
+  result = curl_easy_perform(curl);
+  if(result != CURLE_RTSP_CSEQ_ERROR) {
+    curl_mfprintf(stderr, "Failed to detect CSeq mismatch");
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
 
-  test_setopt(curl, CURLOPT_RTSP_CLIENT_CSEQ, 999L);
-  test_setopt(curl, CURLOPT_RTSP_TRANSPORT,
-                    "RAW/RAW/UDP;unicast;client_port=3056-3057");
-  test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_SETUP);
+  easy_setopt(curl, CURLOPT_RTSP_CLIENT_CSEQ, 999L);
+  easy_setopt(curl, CURLOPT_RTSP_TRANSPORT,
+              "RAW/RAW/UDP;unicast;client_port=3056-3057");
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_SETUP);
 
-  stream_uri = suburl(URL, request++);
+  stream_uri = tutil_suburl(URL, request++);
   if(!stream_uri) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  test_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
   curl_free(stream_uri);
   stream_uri = NULL;
 
-  res = curl_easy_perform(curl);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
-  test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_PLAY);
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_PLAY);
 
-  stream_uri = suburl(URL, request++);
+  stream_uri = tutil_suburl(URL, request++);
   if(!stream_uri) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  test_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
   curl_free(stream_uri);
   stream_uri = NULL;
 
-  res = curl_easy_perform(curl);
-  if(res == CURLE_RTSP_SESSION_ERROR) {
-    res = 0;
+  result = curl_easy_perform(curl);
+  if(result == CURLE_RTSP_SESSION_ERROR) {
+    result = CURLE_OK;
   }
   else {
-    fprintf(stderr, "Failed to detect a Session ID mismatch");
-    res = 1;
+    curl_mfprintf(stderr, "Failed to detect a Session ID mismatch");
+    result = TEST_ERR_FAILURE;
   }
 
 test_cleanup:
@@ -117,5 +110,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib571.c b/third-party/curl/tests/libtest/lib571.c
index 60b4b36e01..37b93e5390 100644
--- a/third-party/curl/tests/libtest/lib571.c
+++ b/third-party/curl/tests/libtest/lib571.c
@@ -21,26 +21,17 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
 #ifdef HAVE_NETINET_IN_H
-#  include <netinet/in.h>
+#include <netinet/in.h>
 #endif
 #ifdef HAVE_NETDB_H
-#  include <netdb.h>
+#include <netdb.h>
 #endif
 #ifdef HAVE_ARPA_INET_H
-#  include <arpa/inet.h>
+#include <arpa/inet.h>
 #endif
-#ifdef HAVE_SYS_STAT_H
-#  include <sys/stat.h>
-#endif
-#ifdef HAVE_FCNTL_H
-#  include <fcntl.h>
-#endif
-
-#include "warnless.h"
-#include "memdebug.h"
 
 #define RTP_PKT_CHANNEL(p)   ((int)((unsigned char)((p)[1])))
 
@@ -48,13 +39,13 @@
                              ((int)((unsigned char)((p)[3]))))
 
 #define RTP_DATA_SIZE 12
-static const char *RTP_DATA = "$_1234\n\0Rsdf";
 
 static int rtp_packet_count = 0;
 
-static size_t rtp_write(void *ptr, size_t size, size_t nmemb, void *stream)
+static size_t rtp_write(char *data, size_t size, size_t nmemb, void *stream)
 {
-  char *data = (char *)ptr;
+  static const char *RTP_DATA = "$_1234\n\0Rsdf";
+
   int channel = RTP_PKT_CHANNEL(data);
   int message_size;
   int coded_size = RTP_PKT_LENGTH(data);
@@ -64,152 +55,150 @@ static size_t rtp_write(void *ptr, size_t size, size_t nmemb, void *stream)
 
   message_size = curlx_uztosi(size * nmemb) - 4;
 
-  printf("RTP: message size %d, channel %d\n", message_size, channel);
+  curl_mprintf("RTP: message size %d, channel %d\n", message_size, channel);
   if(message_size != coded_size) {
-    printf("RTP embedded size (%d) does not match the write size (%d).\n",
-           coded_size, message_size);
+    curl_mprintf("RTP embedded size (%d) does not match "
+                 "the write size (%d).\n", coded_size, message_size);
     return failure;
   }
 
   data += 4;
   for(i = 0; i < message_size; i += RTP_DATA_SIZE) {
     if(message_size - i > RTP_DATA_SIZE) {
-      if(memcmp(RTP_DATA, data + i, RTP_DATA_SIZE) != 0) {
-        printf("RTP PAYLOAD CORRUPTED [%s]\n", data + i);
-        /* return failure; */
+      if(memcmp(RTP_DATA, data + i, RTP_DATA_SIZE)) {
+        curl_mprintf("RTP PAYLOAD CORRUPTED [%s]\n", data + i);
+#if 0
+        return failure;
+#endif
       }
     }
     else {
-      if(memcmp(RTP_DATA, data + i, message_size - i) != 0) {
-        printf("RTP PAYLOAD END CORRUPTED (%d), [%s]\n",
-               message_size - i, data + i);
-        /* return failure; */
+      if(memcmp(RTP_DATA, data + i, message_size - i)) {
+        curl_mprintf("RTP PAYLOAD END CORRUPTED (%d), [%s]\n",
+                     message_size - i, data + i);
+#if 0
+        return failure;
+#endif
       }
     }
   }
 
   rtp_packet_count++;
-  fprintf(stderr, "packet count is %d\n", rtp_packet_count);
+  curl_mfprintf(stderr, "packet count is %d\n", rtp_packet_count);
 
   return size * nmemb;
 }
 
-/* build request url */
-static char *suburl(const char *base, int i)
+static CURLcode test_lib571(const char *URL)
 {
-  return curl_maprintf("%s%.4d", base, i);
-}
-
-int test(char *URL)
-{
-  int res;
+  CURLcode result;
   CURL *curl;
   char *stream_uri = NULL;
   int request = 1;
 
-  FILE *protofile = fopen(libtest_arg2, "wb");
+  FILE *protofile = curlx_fopen(libtest_arg2, "wb");
   if(!protofile) {
-    fprintf(stderr, "Couldn't open the protocol dump file\n");
+    curl_mfprintf(stderr, "Could not open the protocol dump file\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
-    fclose(protofile);
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    curlx_fclose(protofile);
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
-    fclose(protofile);
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curlx_fclose(protofile);
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
-  stream_uri = suburl(URL, request++);
+  stream_uri = tutil_suburl(URL, request++);
   if(!stream_uri) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  test_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
   curl_free(stream_uri);
   stream_uri = NULL;
 
-  test_setopt(curl, CURLOPT_INTERLEAVEFUNCTION, rtp_write);
-  test_setopt(curl, CURLOPT_TIMEOUT, 3L);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_WRITEDATA, protofile);
+  easy_setopt(curl, CURLOPT_INTERLEAVEFUNCTION, rtp_write);
+  easy_setopt(curl, CURLOPT_TIMEOUT, 30L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_WRITEDATA, protofile);
 
-  test_setopt(curl, CURLOPT_RTSP_TRANSPORT, "RTP/AVP/TCP;interleaved=0-1");
-  test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_SETUP);
+  easy_setopt(curl, CURLOPT_RTSP_TRANSPORT, "RTP/AVP/TCP;interleaved=0-1");
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_SETUP);
 
-  res = curl_easy_perform(curl);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
   /* This PLAY starts the interleave */
-  stream_uri = suburl(URL, request++);
+  stream_uri = tutil_suburl(URL, request++);
   if(!stream_uri) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  test_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
   curl_free(stream_uri);
   stream_uri = NULL;
-  test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_PLAY);
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_PLAY);
 
-  res = curl_easy_perform(curl);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
-  /* The DESCRIBE request will try to consume data after the Content */
-  stream_uri = suburl(URL, request++);
+  /* The DESCRIBE request tries to consume data after the Content */
+  stream_uri = tutil_suburl(URL, request++);
   if(!stream_uri) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  test_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
   curl_free(stream_uri);
   stream_uri = NULL;
-  test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_DESCRIBE);
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_DESCRIBE);
 
-  res = curl_easy_perform(curl);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
-  stream_uri = suburl(URL, request++);
+  stream_uri = tutil_suburl(URL, request++);
   if(!stream_uri) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  test_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
   curl_free(stream_uri);
   stream_uri = NULL;
-  test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_PLAY);
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_PLAY);
 
-  res = curl_easy_perform(curl);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
-  fprintf(stderr, "PLAY COMPLETE\n");
+  curl_mfprintf(stderr, "PLAY COMPLETE\n");
 
   /* Use Receive to get the rest of the data */
-  while(!res && rtp_packet_count < 19) {
-    fprintf(stderr, "LOOPY LOOP!\n");
-    test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_RECEIVE);
-    res = curl_easy_perform(curl);
+  while(!result && rtp_packet_count < 19) {
+    curl_mfprintf(stderr, "LOOPY LOOP!\n");
+    easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_RECEIVE);
+    result = curl_easy_perform(curl);
   }
 
 test_cleanup:
   curl_free(stream_uri);
 
   if(protofile)
-    fclose(protofile);
+    curlx_fclose(protofile);
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib572.c b/third-party/curl/tests/libtest/lib572.c
index b199c48956..1ed292761f 100644
--- a/third-party/curl/tests/libtest/lib572.c
+++ b/third-party/curl/tests/libtest/lib572.c
@@ -21,157 +21,151 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#ifdef HAVE_SYS_STAT_H
-#include <sys/stat.h>
-#endif
-#ifdef HAVE_FCNTL_H
-#include <fcntl.h>
-#endif
-
-#include "memdebug.h"
-
-/* build request url */
-static char *suburl(const char *base, int i)
-{
-  return curl_maprintf("%s%.4d", base, i);
-}
+#include "first.h"
 
 /*
  * Test GET_PARAMETER: PUT, HEARTBEAT, and POST
  */
-int test(char *URL)
+static CURLcode test_lib572(const char *URL)
 {
-  int res;
+  CURLcode result;
   CURL *curl;
+  char errbuf[STRERROR_LEN];
   int params;
   FILE *paramsf = NULL;
-  struct_stat file_info;
+  curlx_struct_stat file_info;
   char *stream_uri = NULL;
   int request = 1;
   struct curl_slist *custom_headers = NULL;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
+  easy_setopt(curl, CURLOPT_HEADERDATA, stdout);
+  easy_setopt(curl, CURLOPT_WRITEDATA, stdout);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  test_setopt(curl, CURLOPT_HEADERDATA, stdout);
-  test_setopt(curl, CURLOPT_WRITEDATA, stdout);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* SETUP */
-  stream_uri = suburl(URL, request++);
+  stream_uri = tutil_suburl(URL, request++);
   if(!stream_uri) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  test_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
   curl_free(stream_uri);
   stream_uri = NULL;
 
-  test_setopt(curl, CURLOPT_RTSP_TRANSPORT, "Planes/Trains/Automobiles");
-  test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_SETUP);
-  res = curl_easy_perform(curl);
-  if(res)
+  easy_setopt(curl, CURLOPT_RTSP_TRANSPORT, "Planes/Trains/Automobiles");
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_SETUP);
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
-  stream_uri = suburl(URL, request++);
+  stream_uri = tutil_suburl(URL, request++);
   if(!stream_uri) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  test_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
   curl_free(stream_uri);
   stream_uri = NULL;
 
   /* PUT style GET_PARAMETERS */
-  params = open(libtest_arg2, O_RDONLY);
-  fstat(params, &file_info);
-  close(params);
-
-  paramsf = fopen(libtest_arg2, "rb");
-  if(!paramsf) {
-    fprintf(stderr, "can't open %s\n", libtest_arg2);
-    res = TEST_ERR_MAJOR_BAD;
+  params = curlx_open(libtest_arg2, O_RDONLY);
+  if(params == -1) {
+    curl_mfprintf(stderr, "open() failed with error (%d) %s\n",
+                  errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
+    curl_mfprintf(stderr, "Error opening file '%s'\n", libtest_arg2);
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_GET_PARAMETER);
+  curlx_fstat(params, &file_info);
+  curlx_close(params);
 
-  test_setopt(curl, CURLOPT_READDATA, paramsf);
-  test_setopt(curl, CURLOPT_UPLOAD, 1L);
-  test_setopt(curl, CURLOPT_INFILESIZE_LARGE, (curl_off_t) file_info.st_size);
+  paramsf = curlx_fopen(libtest_arg2, "rb");
+  if(!paramsf) {
+    curl_mfprintf(stderr, "fopen() failed with error (%d) %s\n",
+                  errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
+    curl_mfprintf(stderr, "Error opening file '%s'\n", libtest_arg2);
+    result = TEST_ERR_MAJOR_BAD;
+    goto test_cleanup;
+  }
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_GET_PARAMETER);
 
-  res = curl_easy_perform(curl);
-  if(res)
+  easy_setopt(curl, CURLOPT_READDATA, paramsf);
+  easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+  easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, (curl_off_t)file_info.st_size);
+
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
-  test_setopt(curl, CURLOPT_UPLOAD, 0L);
-  fclose(paramsf);
+  easy_setopt(curl, CURLOPT_UPLOAD, 0L);
+  curlx_fclose(paramsf);
   paramsf = NULL;
 
   /* Heartbeat GET_PARAMETERS */
-  stream_uri = suburl(URL, request++);
+  stream_uri = tutil_suburl(URL, request++);
   if(!stream_uri) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  test_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
   curl_free(stream_uri);
   stream_uri = NULL;
 
-  res = curl_easy_perform(curl);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
   /* POST GET_PARAMETERS */
 
-  stream_uri = suburl(URL, request++);
+  stream_uri = tutil_suburl(URL, request++);
   if(!stream_uri) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  test_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
   curl_free(stream_uri);
   stream_uri = NULL;
 
-  test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_GET_PARAMETER);
-  test_setopt(curl, CURLOPT_POSTFIELDS, "packets_received\njitter\n");
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_GET_PARAMETER);
+  easy_setopt(curl, CURLOPT_POSTFIELDS, "packets_received\njitter\n");
 
-  res = curl_easy_perform(curl);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
-  test_setopt(curl, CURLOPT_POSTFIELDS, NULL);
+  easy_setopt(curl, CURLOPT_POSTFIELDS, NULL);
 
   /* Make sure we can do a normal request now */
-  stream_uri = suburl(URL, request++);
+  stream_uri = tutil_suburl(URL, request++);
   if(!stream_uri) {
-    res = TEST_ERR_MAJOR_BAD;
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  test_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, stream_uri);
   curl_free(stream_uri);
   stream_uri = NULL;
 
-  test_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_OPTIONS);
-  res = curl_easy_perform(curl);
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_OPTIONS);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
   if(paramsf)
-    fclose(paramsf);
+    curlx_fclose(paramsf);
 
   curl_free(stream_uri);
 
@@ -181,5 +175,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib573.c b/third-party/curl/tests/libtest/lib573.c
index af140e2db5..158a35bb3b 100644
--- a/third-party/curl/tests/libtest/lib573.c
+++ b/third-party/curl/tests/libtest/lib573.c
@@ -21,24 +21,19 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
 #include "testtrace.h"
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
 
 /*
  * Get a single URL without select().
  */
 
-int test(char *URL)
+static CURLcode test_lib573(const char *URL)
 {
-  CURL *c = NULL;
-  CURLM *m = NULL;
-  int res = 0;
+  CURL *curl = NULL;
+  CURLM *multi = NULL;
+  CURLcode result = CURLE_OK;
   int running = 1;
   double connect_time = 0.0;
   double dbl_epsilon;
@@ -46,26 +41,26 @@ int test(char *URL)
   dbl_epsilon = 1.0;
   do {
     dbl_epsilon /= 2.0;
-  } while((double)(1.0 + (dbl_epsilon/2.0)) > (double)1.0);
+  } while((1.0 + (dbl_epsilon / 2.0)) > 1.0);
 
   start_test_timing();
 
   global_init(CURL_GLOBAL_ALL);
 
-  easy_init(c);
+  easy_init(curl);
 
-  easy_setopt(c, CURLOPT_HEADER, 1L);
-  easy_setopt(c, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
-  libtest_debug_config.nohex = 1;
-  libtest_debug_config.tracetime = 1;
-  easy_setopt(c, CURLOPT_DEBUGDATA, &libtest_debug_config);
-  easy_setopt(c, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
-  easy_setopt(c, CURLOPT_VERBOSE, 1L);
+  debug_config.nohex = TRUE;
+  debug_config.tracetime = TRUE;
+  easy_setopt(curl, CURLOPT_DEBUGDATA, &debug_config);
+  easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  multi_init(m);
+  multi_init(multi);
 
-  multi_add_handle(m, c);
+  multi_add_handle(multi, curl);
 
   while(running) {
     struct timeval timeout;
@@ -75,7 +70,7 @@ int test(char *URL)
     timeout.tv_sec = 0;
     timeout.tv_usec = 100000L; /* 100 ms */
 
-    multi_perform(m, &running);
+    multi_perform(multi, &running);
 
     abort_on_test_timeout();
 
@@ -86,7 +81,7 @@ int test(char *URL)
     FD_ZERO(&fdwrite);
     FD_ZERO(&fdexcep);
 
-    multi_fdset(m, &fdread, &fdwrite, &fdexcep, &maxfd);
+    multi_fdset(multi, &fdread, &fdwrite, &fdexcep, &maxfd);
 
     /* At this point, maxfd is guaranteed to be greater or equal than -1. */
 
@@ -95,21 +90,21 @@ int test(char *URL)
     abort_on_test_timeout();
   }
 
-  curl_easy_getinfo(c, CURLINFO_CONNECT_TIME, &connect_time);
+  curl_easy_getinfo(curl, CURLINFO_CONNECT_TIME, &connect_time);
   if(connect_time < dbl_epsilon) {
-    fprintf(stderr, "connect time %e is < epsilon %e\n",
-            connect_time, dbl_epsilon);
-    res = TEST_ERR_MAJOR_BAD;
+    curl_mfprintf(stderr, "connect time %e is < epsilon %e\n",
+                  connect_time, dbl_epsilon);
+    result = TEST_ERR_MAJOR_BAD;
   }
 
 test_cleanup:
 
   /* proper cleanup sequence - type PA */
 
-  curl_multi_remove_handle(m, c);
-  curl_multi_cleanup(m);
-  curl_easy_cleanup(c);
+  curl_multi_remove_handle(multi, curl);
+  curl_multi_cleanup(multi);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib574.c b/third-party/curl/tests/libtest/lib574.c
index 8bb8704b93..6b5e415fa7 100644
--- a/third-party/curl/tests/libtest/lib574.c
+++ b/third-party/curl/tests/libtest/lib574.c
@@ -21,53 +21,51 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static int new_fnmatch(void *ptr,
-                       const char *pattern, const char *string)
+static int new_fnmatch(void *ptr, const char *pattern, const char *string)
 {
   (void)ptr;
-  (void)pattern;
-  (void)string;
+  curl_mfprintf(stderr, "lib574: match string '%s' against pattern '%s'\n",
+                string, pattern);
   return CURL_FNMATCHFUNC_MATCH;
 }
 
-int test(char *URL)
+static CURLcode test_lib574(const char *URL)
 {
-  int res;
+  CURLcode result;
   CURL *curl;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_WILDCARDMATCH, 1L);
-  test_setopt(curl, CURLOPT_FNMATCH_FUNCTION, new_fnmatch);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_WILDCARDMATCH, 1L);
+  easy_setopt(curl, CURLOPT_FNMATCH_FUNCTION, new_fnmatch);
+  easy_setopt(curl, CURLOPT_TIMEOUT_MS, (long)TEST_HANG_TIMEOUT);
 
-  res = curl_easy_perform(curl);
-  if(res) {
-    fprintf(stderr, "curl_easy_perform() failed %d\n", res);
+  result = curl_easy_perform(curl);
+  if(result) {
+    curl_mfprintf(stderr, "curl_easy_perform() failed %d\n", (int)result);
     goto test_cleanup;
   }
-  res = curl_easy_perform(curl);
-  if(res) {
-    fprintf(stderr, "curl_easy_perform() failed %d\n", res);
+  result = curl_easy_perform(curl);
+  if(result) {
+    curl_mfprintf(stderr, "curl_easy_perform() failed %d\n", (int)result);
     goto test_cleanup;
   }
 
 test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib575.c b/third-party/curl/tests/libtest/lib575.c
index 1de6e32843..6e7831f9d4 100644
--- a/third-party/curl/tests/libtest/lib575.c
+++ b/third-party/curl/tests/libtest/lib575.c
@@ -21,15 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include <fcntl.h>
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
+#include "first.h"
 
 /* 3x download!
  * 1. normal
@@ -37,43 +29,43 @@
  * 3. with multi interface
  */
 
-int test(char *URL)
+static CURLcode test_lib575(const char *URL)
 {
-  CURL *handle = NULL;
-  CURL *duphandle = NULL;
-  CURLM *mhandle = NULL;
-  int res = 0;
+  CURL *curl = NULL;
+  CURL *curldupe = NULL;
+  CURLM *multi = NULL;
+  CURLcode result = CURLE_OK;
   int still_running = 0;
 
   start_test_timing();
 
   global_init(CURL_GLOBAL_ALL);
 
-  easy_init(handle);
+  easy_init(curl);
 
-  easy_setopt(handle, CURLOPT_URL, URL);
-  easy_setopt(handle, CURLOPT_WILDCARDMATCH, 1L);
-  easy_setopt(handle, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_WILDCARDMATCH, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  res = curl_easy_perform(handle);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
-  res = curl_easy_perform(handle);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
-  duphandle = curl_easy_duphandle(handle);
-  if(!duphandle)
+  curldupe = curl_easy_duphandle(curl);
+  if(!curldupe)
     goto test_cleanup;
-  curl_easy_cleanup(handle);
-  handle = duphandle;
+  curl_easy_cleanup(curl);
+  curl = curldupe;
 
-  multi_init(mhandle);
+  multi_init(multi);
 
-  multi_add_handle(mhandle, handle);
+  multi_add_handle(multi, curl);
 
-  multi_perform(mhandle, &still_running);
+  multi_perform(multi, &still_running);
 
   abort_on_test_timeout();
 
@@ -91,7 +83,7 @@ int test(char *URL)
     FD_ZERO(&fdwrite);
     FD_ZERO(&fdexcep);
 
-    multi_fdset(mhandle, &fdread, &fdwrite, &fdexcep, &maxfd);
+    multi_fdset(multi, &fdread, &fdwrite, &fdexcep, &maxfd);
 
     /* At this point, maxfd is guaranteed to be greater or equal than -1. */
 
@@ -99,7 +91,7 @@ int test(char *URL)
 
     abort_on_test_timeout();
 
-    multi_perform(mhandle, &still_running);
+    multi_perform(multi, &still_running);
 
     abort_on_test_timeout();
   }
@@ -108,9 +100,9 @@ test_cleanup:
 
   /* undocumented cleanup sequence - type UA */
 
-  curl_multi_cleanup(mhandle);
-  curl_easy_cleanup(handle);
+  curl_multi_cleanup(multi);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib576.c b/third-party/curl/tests/libtest/lib576.c
index f6839e7f81..889969d5b8 100644
--- a/third-party/curl/tests/libtest/lib576.c
+++ b/third-party/curl/tests/libtest/lib576.c
@@ -21,107 +21,102 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "testutil.h"
-#include "memdebug.h"
+#include "first.h"
 
 struct chunk_data {
   int remains;
   int print_content;
 };
 
-static
-long chunk_bgn(const struct curl_fileinfo *finfo, void *ptr, int remains);
-static
-long chunk_end(void *ptr);
-
-static
-long chunk_bgn(const struct curl_fileinfo *finfo, void *ptr, int remains)
+static long chunk_bgn(const void *f, void *ptr, int remains)
 {
+  const struct curl_fileinfo *finfo = f;
   struct chunk_data *ch_d = ptr;
   ch_d->remains = remains;
 
-  printf("=============================================================\n");
-  printf("Remains:      %d\n", remains);
-  printf("Filename:     %s\n", finfo->filename);
+  curl_mprintf("=================================="
+               "===========================\n");
+  curl_mprintf("Remains:      %d\n", remains);
+  curl_mprintf("Filename:     %s\n", finfo->filename);
   if(finfo->strings.perm) {
-    printf("Permissions:  %s", finfo->strings.perm);
+    curl_mprintf("Permissions:  %s", finfo->strings.perm);
     if(finfo->flags & CURLFINFOFLAG_KNOWN_PERM)
-      printf(" (parsed => %o)", finfo->perm);
-    printf("\n");
+      curl_mprintf(" (parsed => %o)", finfo->perm);
+    curl_mprintf("\n");
   }
-  printf("Size:         %ldB\n", (long)finfo->size);
+  curl_mprintf("Size:         %" CURL_FORMAT_CURL_OFF_T "B\n", finfo->size);
   if(finfo->strings.user)
-    printf("User:         %s\n", finfo->strings.user);
+    curl_mprintf("User:         %s\n", finfo->strings.user);
   if(finfo->strings.group)
-    printf("Group:        %s\n", finfo->strings.group);
+    curl_mprintf("Group:        %s\n", finfo->strings.group);
   if(finfo->strings.time)
-    printf("Time:         %s\n", finfo->strings.time);
-  printf("Filetype:     ");
+    curl_mprintf("Time:         %s\n", finfo->strings.time);
+  curl_mprintf("Filetype:     ");
   switch(finfo->filetype) {
   case CURLFILETYPE_FILE:
-    printf("regular file\n");
+    curl_mprintf("regular file\n");
     break;
   case CURLFILETYPE_DIRECTORY:
-    printf("directory\n");
+    curl_mprintf("directory\n");
     break;
   case CURLFILETYPE_SYMLINK:
-    printf("symlink\n");
-    printf("Target:       %s\n", finfo->strings.target);
+    curl_mprintf("symlink\n");
+    curl_mprintf("Target:       %s\n", finfo->strings.target);
     break;
   default:
-    printf("other type\n");
+    curl_mprintf("other type\n");
     break;
   }
   if(finfo->filetype == CURLFILETYPE_FILE) {
     ch_d->print_content = 1;
-    printf("Content:\n-----------------------"
-           "--------------------------------------\n");
+    curl_mprintf("Content:\n"
+                 "-------------------------------------------"
+                 "------------------\n");
   }
-  if(strcmp(finfo->filename, "someothertext.txt") == 0) {
-    printf("# THIS CONTENT WAS SKIPPED IN CHUNK_BGN CALLBACK #\n");
+  if(!strcmp(finfo->filename, "someothertext.txt")) {
+    curl_mprintf("# THIS CONTENT WAS SKIPPED IN CHUNK_BGN CALLBACK #\n");
     return CURL_CHUNK_BGN_FUNC_SKIP;
   }
   return CURL_CHUNK_BGN_FUNC_OK;
 }
 
-static
-long chunk_end(void *ptr)
+static long chunk_end(void *ptr)
 {
   struct chunk_data *ch_d = ptr;
   if(ch_d->print_content) {
     ch_d->print_content = 0;
-    printf("-------------------------------------------------------------\n");
+    curl_mprintf("-------------------------------------------"
+                 "------------------\n");
   }
   if(ch_d->remains == 1)
-    printf("=============================================================\n");
+    curl_mprintf("==========================================="
+                 "==================\n");
   return CURL_CHUNK_END_FUNC_OK;
 }
 
-int test(char *URL)
+static CURLcode test_lib576(const char *URL)
 {
-  CURL *handle = NULL;
-  CURLcode res = CURLE_OK;
-  struct chunk_data chunk_data = {0, 0};
+  CURL *curl = NULL;
+  CURLcode result = CURLE_OK;
+  struct chunk_data chunk_data = { 0, 0 };
   curl_global_init(CURL_GLOBAL_ALL);
-  handle = curl_easy_init();
-  if(!handle) {
-    res = CURLE_OUT_OF_MEMORY;
+  curl = curl_easy_init();
+  if(!curl) {
+    result = CURLE_OUT_OF_MEMORY;
     goto test_cleanup;
   }
 
-  test_setopt(handle, CURLOPT_URL, URL);
-  test_setopt(handle, CURLOPT_WILDCARDMATCH, 1L);
-  test_setopt(handle, CURLOPT_CHUNK_BGN_FUNCTION, chunk_bgn);
-  test_setopt(handle, CURLOPT_CHUNK_END_FUNCTION, chunk_end);
-  test_setopt(handle, CURLOPT_CHUNK_DATA, &chunk_data);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_WILDCARDMATCH, 1L);
+  easy_setopt(curl, CURLOPT_CHUNK_BGN_FUNCTION, chunk_bgn);
+  easy_setopt(curl, CURLOPT_CHUNK_END_FUNCTION, chunk_end);
+  easy_setopt(curl, CURLOPT_CHUNK_DATA, &chunk_data);
 
-  res = curl_easy_perform(handle);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
-  if(handle)
-    curl_easy_cleanup(handle);
+  if(curl)
+    curl_easy_cleanup(curl);
   curl_global_cleanup();
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib578.c b/third-party/curl/tests/libtest/lib578.c
index 7c6af99457..4341785524 100644
--- a/third-party/curl/tests/libtest/lib578.c
+++ b/third-party/curl/tests/libtest/lib578.c
@@ -21,76 +21,72 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "memdebug.h"
+#include "first.h"
 
 /* The size of data should be kept below MAX_INITIAL_POST_SIZE! */
-static char data[]="this is a short string.\n";
+static char t578_testdata[] = "this is a short string.\n";
 
-static size_t data_size = sizeof(data) / sizeof(char);
+static size_t data_size = CURL_ARRAYSIZE(t578_testdata);
 
-static int progress_callback(void *clientp, double dltotal, double dlnow,
-                             double ultotal, double ulnow)
+static int t578_progress_callback(void *clientp, double dltotal, double dlnow,
+                                  double ultotal, double ulnow)
 {
-  FILE *moo = fopen(libtest_arg2, "wb");
+  FILE *moo = curlx_fopen(libtest_arg2, "wb");
 
-  (void)clientp; /* UNUSED */
-  (void)dltotal; /* UNUSED */
-  (void)dlnow; /* UNUSED */
+  (void)clientp;
+  (void)dltotal;
+  (void)dlnow;
 
   if(moo) {
     if((size_t)ultotal == data_size && (size_t)ulnow == data_size)
-      fprintf(moo, "PASSED, UL data matched data size\n");
+      curl_mfprintf(moo, "PASSED, UL data matched data size\n");
     else
-      fprintf(moo, "Progress callback called with UL %f out of %f\n",
-              ulnow, ultotal);
-    fclose(moo);
+      curl_mfprintf(moo, "Progress callback called with UL %f out of %f\n",
+                    ulnow, ultotal);
+    curlx_fclose(moo);
   }
   return 0;
 }
 
-int test(char *URL)
+static CURLcode test_lib578(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* Now specify we want to POST data */
-  test_setopt(curl, CURLOPT_POST, 1L);
+  easy_setopt(curl, CURLOPT_POST, 1L);
 
   /* Set the expected POST size */
-  test_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)data_size);
-  test_setopt(curl, CURLOPT_POSTFIELDS, data);
+  easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)data_size);
+  easy_setopt(curl, CURLOPT_POSTFIELDS, t578_testdata);
 
   /* we want to use our own progress function */
-  CURL_IGNORE_DEPRECATION(
-    test_setopt(curl, CURLOPT_NOPROGRESS, 0L);
-    test_setopt(curl, CURLOPT_PROGRESSFUNCTION, progress_callback);
-  )
+  easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
+  easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, t578_progress_callback);
 
   /* get verbose debug output please */
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* include headers in the output */
-  test_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-  /* Perform the request, res will get the return code */
-  res = curl_easy_perform(curl);
+  /* Perform the request, result gets the return code */
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -98,5 +94,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib579.c b/third-party/curl/tests/libtest/lib579.c
index 5f962179a1..7ad133188b 100644
--- a/third-party/curl/tests/libtest/lib579.c
+++ b/third-party/curl/tests/libtest/lib579.c
@@ -21,130 +21,143 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static const char * const post[]={
-  "one",
-  "two",
-  "three",
-  "and a final longer crap: four",
-  NULL
-};
-
-
-struct WriteThis {
+struct t579_WriteThis {
   int counter;
 };
 
-static int progress_callback(void *clientp, double dltotal, double dlnow,
-                             double ultotal, double ulnow)
+static bool started = FALSE;
+static size_t last_ul = 0;
+static size_t last_ul_total = 0;
+
+static void progress_final_report(void)
 {
-  static int prev_ultotal = -1;
-  static int prev_ulnow = -1;
-  (void)clientp; /* UNUSED */
-  (void)dltotal; /* UNUSED */
-  (void)dlnow; /* UNUSED */
+  FILE *moo = curlx_fopen(libtest_arg2, "ab");
+  curl_mfprintf(moo ? moo : stderr, "Progress: end UL %zu/%zu\n",
+                last_ul, last_ul_total);
+  if(moo)
+    curlx_fclose(moo);
+  else
+    curl_mfprintf(stderr, "Progress: end UL, cannot open %s\n", libtest_arg2);
+  started = FALSE;
+}
 
-  /* to avoid depending on timing, which will cause this progress function to
-     get called a different number of times depending on circumstances, we
-     only log these lines if the numbers are different from the previous
-     invoke */
-  if((prev_ultotal != (int)ultotal) ||
-     (prev_ulnow != (int)ulnow)) {
+static int t579_progress_callback(void *clientp, double dltotal, double dlnow,
+                                  double ultotal, double ulnow)
+{
+  (void)clientp;
+  (void)dltotal;
+  (void)dlnow;
 
-    FILE *moo = fopen(libtest_arg2, "ab");
-    if(moo) {
-      fprintf(moo, "Progress callback called with UL %d out of %d\n",
-              (int)ulnow, (int)ultotal);
-      fclose(moo);
-    }
-    prev_ulnow = (int) ulnow;
-    prev_ultotal = (int) ultotal;
+  if(started && ulnow <= 0.0 && last_ul) {
+    progress_final_report();
   }
+
+  last_ul = (size_t)ulnow;
+  last_ul_total = (size_t)ultotal;
+  if(!started) {
+    FILE *moo = curlx_fopen(libtest_arg2, "ab");
+    curl_mfprintf(moo ? moo : stderr, "Progress: start UL %zu/%zu\n",
+                  last_ul, last_ul_total);
+    if(moo)
+      curlx_fclose(moo);
+    else
+      curl_mfprintf(stderr, "Progress: start UL, cannot open %s\n",
+                    libtest_arg2);
+    started = TRUE;
+  }
+
   return 0;
 }
 
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t t579_read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
-  struct WriteThis *pooh = (struct WriteThis *)userp;
+  static const char * const testpost[] = {
+    "one",
+    "two",
+    "three",
+    "and a final longer crap: four",
+    NULL
+  };
+
+  struct t579_WriteThis *pooh = (struct t579_WriteThis *)userp;
   const char *data;
 
-  if(size*nmemb < 1)
+  if(size * nmemb < 1)
     return 0;
 
-  data = post[pooh->counter];
+  data = testpost[pooh->counter];
 
   if(data) {
     size_t len = strlen(data);
-    memcpy(ptr, data, len);
+    memcpy(ptr, data, len); /* NOLINT(bugprone-not-null-terminated-result) */
     pooh->counter++; /* advance pointer */
     return len;
   }
   return 0;                         /* no more data left to deliver */
 }
 
-int test(char *URL)
+static CURLcode test_lib579(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
   struct curl_slist *slist = NULL;
-  struct WriteThis pooh;
+  struct t579_WriteThis pooh;
   pooh.counter = 0;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   slist = curl_slist_append(slist, "Transfer-Encoding: chunked");
   if(!slist) {
-    fprintf(stderr, "curl_slist_append() failed\n");
+    curl_mfprintf(stderr, "curl_slist_append() failed\n");
     curl_easy_cleanup(curl);
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* Now specify we want to POST data */
-  test_setopt(curl, CURLOPT_POST, 1L);
+  easy_setopt(curl, CURLOPT_POST, 1L);
 
   /* we want to use our own read function */
-  test_setopt(curl, CURLOPT_READFUNCTION, read_callback);
+  easy_setopt(curl, CURLOPT_READFUNCTION, t579_read_cb);
 
   /* pointer to pass to our read function */
-  test_setopt(curl, CURLOPT_READDATA, &pooh);
+  easy_setopt(curl, CURLOPT_READDATA, &pooh);
 
   /* get verbose debug output please */
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* include headers in the output */
-  test_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
   /* enforce chunked transfer by setting the header */
-  test_setopt(curl, CURLOPT_HTTPHEADER, slist);
+  easy_setopt(curl, CURLOPT_HTTPHEADER, slist);
 
-  test_setopt(curl, CURLOPT_HTTPAUTH, (long)CURLAUTH_DIGEST);
-  test_setopt(curl, CURLOPT_USERPWD, "foo:bar");
+  easy_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_DIGEST);
+  easy_setopt(curl, CURLOPT_USERPWD, "foo:bar");
 
   /* we want to use our own progress function */
-  test_setopt(curl, CURLOPT_NOPROGRESS, 0L);
-  CURL_IGNORE_DEPRECATION(
-    test_setopt(curl, CURLOPT_PROGRESSFUNCTION, progress_callback);
-  )
+  easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
+  easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, t579_progress_callback);
 
-  /* Perform the request, res will get the return code */
-  res = curl_easy_perform(curl);
+  /* Perform the request, result gets the return code */
+  result = curl_easy_perform(curl);
+
+  progress_final_report();
 
 test_cleanup:
 
@@ -156,5 +169,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib582.c b/third-party/curl/tests/libtest/lib582.c
index a50f8a429f..4b3f042852 100644
--- a/third-party/curl/tests/libtest/lib582.c
+++ b/third-party/curl/tests/libtest/lib582.c
@@ -21,43 +21,34 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include <fcntl.h>
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
-
-struct Sockets
-{
+struct t582_Sockets {
   curl_socket_t *sockets;
   int count;      /* number of sockets actually stored in array */
   int max_count;  /* max number of sockets that fit in allocated array */
 };
 
-struct ReadWriteSockets
-{
-  struct Sockets read, write;
+struct t582_ReadWriteSockets {
+  struct t582_Sockets read, write;
 };
 
 /**
  * Remove a file descriptor from a sockets array.
  */
-static void removeFd(struct Sockets *sockets, curl_socket_t fd, int mention)
+static void t582_removeFd(struct t582_Sockets *sockets, curl_socket_t fd,
+                          int mention)
 {
   int i;
 
   if(mention)
-    fprintf(stderr, "Remove socket fd %d\n", (int) fd);
+    curl_mfprintf(stderr, "Remove socket fd %" FMT_SOCKET_T "\n", fd);
 
   for(i = 0; i < sockets->count; ++i) {
     if(sockets->sockets[i] == fd) {
       if(i < sockets->count - 1)
         memmove(&sockets->sockets[i], &sockets->sockets[i + 1],
-              sizeof(curl_socket_t) * (sockets->count - (i + 1)));
+                sizeof(curl_socket_t) * (sockets->count - (i + 1)));
       --sockets->count;
     }
   }
@@ -66,33 +57,28 @@ static void removeFd(struct Sockets *sockets, curl_socket_t fd, int mention)
 /**
  * Add a file descriptor to a sockets array.
  */
-static void addFd(struct Sockets *sockets, curl_socket_t fd, const char *what)
+static void t582_addFd(struct t582_Sockets *sockets, curl_socket_t fd,
+                       const char *what)
 {
   /**
    * To ensure we only have each file descriptor once, we remove it then add
    * it again.
    */
-  fprintf(stderr, "Add socket fd %d for %s\n", (int) fd, what);
-  removeFd(sockets, fd, 0);
+  curl_mfprintf(stderr, "Add socket fd %" FMT_SOCKET_T " for %s\n", fd, what);
+  t582_removeFd(sockets, fd, 0);
   /*
    * Allocate array storage when required.
    */
   if(!sockets->sockets) {
-    sockets->sockets = malloc(sizeof(curl_socket_t) * 20U);
+    sockets->sockets = curlx_malloc(sizeof(curl_socket_t) * 20U);
     if(!sockets->sockets)
       return;
     sockets->max_count = 20;
   }
-  else if(sockets->count + 1 > sockets->max_count) {
-    curl_socket_t *oldptr = sockets->sockets;
-    sockets->sockets = realloc(oldptr, sizeof(curl_socket_t) *
-                               (sockets->max_count + 20));
-    if(!sockets->sockets) {
-      /* cleanup in test_cleanup */
-      sockets->sockets = oldptr;
-      return;
-    }
-    sockets->max_count += 20;
+  else if(sockets->count >= sockets->max_count) {
+    /* this cannot happen in normal cases */
+    curl_mfprintf(stderr, "too many file handles error\n");
+    exit(2);
   }
   /*
    * Add file descriptor to array.
@@ -104,23 +90,23 @@ static void addFd(struct Sockets *sockets, curl_socket_t fd, const char *what)
 /**
  * Callback invoked by curl to poll reading / writing of a socket.
  */
-static int curlSocketCallback(CURL *easy, curl_socket_t s, int action,
-                              void *userp, void *socketp)
+static int t582_curlSocketCallback(CURL *curl, curl_socket_t s, int action,
+                                   void *userp, void *socketp)
 {
-  struct ReadWriteSockets *sockets = userp;
+  struct t582_ReadWriteSockets *sockets = userp;
 
-  (void)easy; /* unused */
-  (void)socketp; /* unused */
+  (void)curl;
+  (void)socketp;
 
   if(action == CURL_POLL_IN || action == CURL_POLL_INOUT)
-    addFd(&sockets->read, s, "read");
+    t582_addFd(&sockets->read, s, "read");
 
   if(action == CURL_POLL_OUT || action == CURL_POLL_INOUT)
-    addFd(&sockets->write, s, "write");
+    t582_addFd(&sockets->write, s, "write");
 
   if(action == CURL_POLL_REMOVE) {
-    removeFd(&sockets->read, s, 1);
-    removeFd(&sockets->write, s, 0);
+    t582_removeFd(&sockets->read, s, 1);
+    t582_removeFd(&sockets->write, s, 0);
   }
 
   return 0;
@@ -129,13 +115,13 @@ static int curlSocketCallback(CURL *easy, curl_socket_t s, int action,
 /**
  * Callback invoked by curl to set a timeout.
  */
-static int curlTimerCallback(CURLM *multi, long timeout_ms, void *userp)
+static int t582_curlTimerCallback(CURLM *multi, long timeout_ms, void *userp)
 {
-  struct timeval *timeout = userp;
+  struct curltime *timeout = userp;
 
-  (void)multi; /* unused */
+  (void)multi;
   if(timeout_ms != -1) {
-    *timeout = tutil_tvnow();
+    *timeout = curlx_now();
     timeout->tv_usec += (int)timeout_ms * 1000;
   }
   else {
@@ -147,13 +133,13 @@ static int curlTimerCallback(CURLM *multi, long timeout_ms, void *userp)
 /**
  * Check for curl completion.
  */
-static int checkForCompletion(CURLM *curl, int *success)
+static int t582_checkForCompletion(CURLM *multi, int *success)
 {
   int result = 0;
   *success = 0;
   while(1) {
     int numMessages;
-    CURLMsg *message = curl_multi_info_read(curl, &numMessages);
+    CURLMsg *message = curl_multi_info_read(multi, &numMessages);
     if(!message)
       break;
     if(message->msg == CURLMSG_DONE) {
@@ -164,8 +150,8 @@ static int checkForCompletion(CURLM *curl, int *success)
         *success = 0;
     }
     else {
-      fprintf(stderr, "Got an unexpected message from curl: %i\n",
-              (int)message->msg);
+      curl_mfprintf(stderr, "Got an unexpected message from curl: %d\n",
+                    (int)message->msg);
       result = 1;
       *success = 0;
     }
@@ -173,24 +159,24 @@ static int checkForCompletion(CURLM *curl, int *success)
   return result;
 }
 
-static int getMicroSecondTimeout(struct timeval *timeout)
+static ssize_t t582_getMicroSecondTimeout(struct curltime *timeout)
 {
-  struct timeval now;
+  struct curltime now;
   ssize_t result;
-  now = tutil_tvnow();
-  result = (ssize_t)((timeout->tv_sec - now.tv_sec) * 1000000 +
+  now = curlx_now();
+  result = (ssize_t)(((timeout->tv_sec - now.tv_sec) * 1000000) +
     timeout->tv_usec - now.tv_usec);
   if(result < 0)
     result = 0;
 
-  return curlx_sztosi(result);
+  return result;
 }
 
 /**
  * Update a fd_set with all of the sockets in use.
  */
-static void updateFdSet(struct Sockets *sockets, fd_set* fdset,
-                        curl_socket_t *maxFd)
+static void t582_updateFdSet(struct t582_Sockets *sockets, fd_set *fdset,
+                             curl_socket_t *maxFd)
 {
   int i;
   for(i = 0; i < sockets->count; ++i) {
@@ -201,76 +187,80 @@ static void updateFdSet(struct Sockets *sockets, fd_set* fdset,
   }
 }
 
-static void notifyCurl(CURLM *curl, curl_socket_t s, int evBitmask,
+static void notifyCurl(CURLM *multi, curl_socket_t s, int evBitmask,
                        const char *info)
 {
   int numhandles = 0;
-  CURLMcode result = curl_multi_socket_action(curl, s, evBitmask, &numhandles);
-  if(result != CURLM_OK) {
-    fprintf(stderr, "Curl error on %s: %i (%s)\n",
-            info, result, curl_multi_strerror(result));
+  CURLMcode mresult = curl_multi_socket_action(multi, s, evBitmask,
+                                               &numhandles);
+  if(mresult != CURLM_OK) {
+    curl_mfprintf(stderr, "curl error on %s (%d) %s\n",
+                  info, mresult, curl_multi_strerror(mresult));
   }
 }
 
 /**
  * Invoke curl when a file descriptor is set.
  */
-static void checkFdSet(CURLM *curl, struct Sockets *sockets, fd_set *fdset,
-                       int evBitmask, const char *name)
+static void t582_checkFdSet(CURLM *multi, struct t582_Sockets *sockets,
+                            fd_set *fdset, int evBitmask, const char *name)
 {
   int i;
   for(i = 0; i < sockets->count; ++i) {
     if(FD_ISSET(sockets->sockets[i], fdset)) {
-      notifyCurl(curl, sockets->sockets[i], evBitmask, name);
+      notifyCurl(multi, sockets->sockets[i], evBitmask, name);
     }
   }
 }
 
-int test(char *URL)
+static CURLcode test_lib582(const char *URL)
 {
-  int res = 0;
+  CURLcode result = CURLE_OK;
   CURL *curl = NULL;
+  char errbuf[STRERROR_LEN];
   FILE *hd_src = NULL;
   int hd;
-  struct_stat file_info;
-  CURLM *m = NULL;
-  struct ReadWriteSockets sockets = {{NULL, 0, 0}, {NULL, 0, 0}};
-  struct timeval timeout = {-1, 0};
+  curlx_struct_stat file_info;
+  CURLM *multi = NULL;
+  struct t582_ReadWriteSockets sockets = { { NULL, 0, 0 }, { NULL, 0, 0 } };
   int success = 0;
+  struct curltime timeout = { 0 };
+  timeout.tv_sec = (time_t)-1;
 
   assert(test_argc >= 5);
 
   start_test_timing();
 
   if(!libtest_arg3) {
-    fprintf(stderr, "Usage: lib582 [url] [filename] [username]\n");
+    curl_mfprintf(stderr, "Usage: lib582 [url] [filename] [username]\n");
     return TEST_ERR_USAGE;
   }
 
-  hd_src = fopen(libtest_arg2, "rb");
+  hd_src = curlx_fopen(libtest_arg2, "rb");
   if(!hd_src) {
-    fprintf(stderr, "fopen() failed with error: %d (%s)\n",
-            errno, strerror(errno));
-    fprintf(stderr, "Error opening file: (%s)\n", libtest_arg2);
+    curl_mfprintf(stderr, "fopen() failed with error (%d) %s\n",
+                  errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
+    curl_mfprintf(stderr, "Error opening file '%s'\n", libtest_arg2);
     return TEST_ERR_FOPEN;
   }
 
   /* get the file size of the local file */
-  hd = fstat(fileno(hd_src), &file_info);
+  hd = curlx_fstat(fileno(hd_src), &file_info);
   if(hd == -1) {
-    /* can't open file, bail out */
-    fprintf(stderr, "fstat() failed with error: %d (%s)\n",
-            errno, strerror(errno));
-    fprintf(stderr, "ERROR: cannot open file (%s)\n", libtest_arg2);
-    fclose(hd_src);
+    /* cannot open file, bail out */
+    curl_mfprintf(stderr, "fstat() failed with error (%d) %s\n",
+                  errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
+    curl_mfprintf(stderr, "Error opening file '%s'\n", libtest_arg2);
+    curlx_fclose(hd_src);
     return TEST_ERR_FSTAT;
   }
-  fprintf(stderr, "Set to upload %d bytes\n", (int)file_info.st_size);
+  curl_mfprintf(stderr, "Set to upload %" CURL_FORMAT_CURL_OFF_T " bytes\n",
+                (curl_off_t)file_info.st_size);
 
   res_global_init(CURL_GLOBAL_ALL);
-  if(res) {
-    fclose(hd_src);
-    return res;
+  if(result != CURLE_OK) {
+    curlx_fclose(hd_src);
+    return result;
   }
 
   easy_init(curl);
@@ -294,28 +284,29 @@ int test(char *URL)
 
   easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, (curl_off_t)file_info.st_size);
 
-  multi_init(m);
+  multi_init(multi);
 
-  multi_setopt(m, CURLMOPT_SOCKETFUNCTION, curlSocketCallback);
-  multi_setopt(m, CURLMOPT_SOCKETDATA, &sockets);
+  multi_setopt(multi, CURLMOPT_SOCKETFUNCTION, t582_curlSocketCallback);
+  multi_setopt(multi, CURLMOPT_SOCKETDATA, &sockets);
 
-  multi_setopt(m, CURLMOPT_TIMERFUNCTION, curlTimerCallback);
-  multi_setopt(m, CURLMOPT_TIMERDATA, &timeout);
+  multi_setopt(multi, CURLMOPT_TIMERFUNCTION, t582_curlTimerCallback);
+  multi_setopt(multi, CURLMOPT_TIMERDATA, &timeout);
 
-  multi_add_handle(m, curl);
+  multi_add_handle(multi, curl);
 
-  while(!checkForCompletion(m, &success)) {
+  while(!t582_checkForCompletion(multi, &success)) {
     fd_set readSet, writeSet;
     curl_socket_t maxFd = 0;
-    struct timeval tv = {10, 0};
+    struct timeval tv = { 0 };
+    tv.tv_sec = 10;
 
     FD_ZERO(&readSet);
     FD_ZERO(&writeSet);
-    updateFdSet(&sockets.read, &readSet, &maxFd);
-    updateFdSet(&sockets.write, &writeSet, &maxFd);
+    t582_updateFdSet(&sockets.read, &readSet, &maxFd);
+    t582_updateFdSet(&sockets.write, &writeSet, &maxFd);
 
-    if(timeout.tv_sec != -1) {
-      int usTimeout = getMicroSecondTimeout(&timeout);
+    if(timeout.tv_sec != (time_t)-1) {
+      int usTimeout = curlx_sztosi(t582_getMicroSecondTimeout(&timeout));
       tv.tv_sec = usTimeout / 1000000;
       tv.tv_usec = usTimeout % 1000000;
     }
@@ -327,37 +318,40 @@ int test(char *URL)
     select_test((int)maxFd, &readSet, &writeSet, NULL, &tv);
 
     /* Check the sockets for reading / writing */
-    checkFdSet(m, &sockets.read, &readSet, CURL_CSELECT_IN, "read");
-    checkFdSet(m, &sockets.write, &writeSet, CURL_CSELECT_OUT, "write");
+    t582_checkFdSet(multi, &sockets.read, &readSet, CURL_CSELECT_IN,
+                    "read");
+    t582_checkFdSet(multi, &sockets.write, &writeSet, CURL_CSELECT_OUT,
+                    "write");
 
-    if(timeout.tv_sec != -1 && getMicroSecondTimeout(&timeout) == 0) {
-      /* Curl's timer has elapsed. */
-      notifyCurl(m, CURL_SOCKET_TIMEOUT, 0, "timeout");
+    if(timeout.tv_sec != (time_t)-1 &&
+       t582_getMicroSecondTimeout(&timeout) == 0) {
+      /* curl's timer has elapsed. */
+      notifyCurl(multi, CURL_SOCKET_TIMEOUT, 0, "timeout");
     }
 
     abort_on_test_timeout();
   }
 
   if(!success) {
-    fprintf(stderr, "Error uploading file.\n");
-    res = TEST_ERR_MAJOR_BAD;
+    curl_mfprintf(stderr, "Error uploading file.\n");
+    result = TEST_ERR_MAJOR_BAD;
   }
 
 test_cleanup:
 
   /* proper cleanup sequence - type PB */
 
-  curl_multi_remove_handle(m, curl);
+  curl_multi_remove_handle(multi, curl);
   curl_easy_cleanup(curl);
-  curl_multi_cleanup(m);
+  curl_multi_cleanup(multi);
   curl_global_cleanup();
 
   /* close the local file */
-  fclose(hd_src);
+  curlx_fclose(hd_src);
 
   /* free local memory */
-  free(sockets.read.sockets);
-  free(sockets.write.sockets);
+  curlx_free(sockets.read.sockets);
+  curlx_free(sockets.write.sockets);
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib583.c b/third-party/curl/tests/libtest/lib583.c
index ba44b5d25e..8f366003f4 100644
--- a/third-party/curl/tests/libtest/lib583.c
+++ b/third-party/curl/tests/libtest/lib583.c
@@ -26,66 +26,62 @@
  * https://curl.se/mail/lib-2011-03/0066.html
  */
 
-#include "test.h"
+#include "first.h"
 
-#include <sys/stat.h>
-
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib583(const char *URL)
 {
   int stillRunning;
-  CURLM *multiHandle = NULL;
+  CURLM *multi = NULL;
   CURL *curl = NULL;
-  CURLcode res = CURLE_OK;
-  CURLMcode mres;
+  CURLcode result = CURLE_OK;
+  CURLMcode mresult;
 
   assert(test_argc >= 4);
 
   global_init(CURL_GLOBAL_ALL);
 
-  multi_init(multiHandle);
+  multi_init(multi);
 
   easy_init(curl);
 
   easy_setopt(curl, CURLOPT_USERPWD, libtest_arg2);
-  easy_setopt(curl, CURLOPT_SSH_PUBLIC_KEYFILE,  test_argv[3]);
+  easy_setopt(curl, CURLOPT_SSH_PUBLIC_KEYFILE, test_argv[3]);
   easy_setopt(curl, CURLOPT_SSH_PRIVATE_KEYFILE, test_argv[4]);
 
   easy_setopt(curl, CURLOPT_UPLOAD, 1L);
   easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   easy_setopt(curl, CURLOPT_URL, URL);
-  easy_setopt(curl, CURLOPT_INFILESIZE, (long)5);
+  easy_setopt(curl, CURLOPT_INFILESIZE, 5L);
 
-  multi_add_handle(multiHandle, curl);
+  multi_add_handle(multi, curl);
 
   /* this tests if removing an easy handle immediately after multi
      perform has been called succeeds or not. */
 
-  fprintf(stderr, "curl_multi_perform()...\n");
+  curl_mfprintf(stderr, "curl_multi_perform()...\n");
 
-  multi_perform(multiHandle, &stillRunning);
+  multi_perform(multi, &stillRunning);
 
-  fprintf(stderr, "curl_multi_perform() succeeded\n");
+  curl_mfprintf(stderr, "curl_multi_perform() succeeded\n");
 
-  fprintf(stderr, "curl_multi_remove_handle()...\n");
-  mres = curl_multi_remove_handle(multiHandle, curl);
-  if(mres) {
-    fprintf(stderr, "curl_multi_remove_handle() failed, "
-            "with code %d\n", (int)mres);
-    res = TEST_ERR_MULTI;
+  curl_mfprintf(stderr, "curl_multi_remove_handle()...\n");
+  mresult = curl_multi_remove_handle(multi, curl);
+  if(mresult) {
+    curl_mfprintf(stderr, "curl_multi_remove_handle() failed, with code %d\n",
+                  mresult);
+    result = TEST_ERR_MULTI;
   }
   else
-    fprintf(stderr, "curl_multi_remove_handle() succeeded\n");
+    curl_mfprintf(stderr, "curl_multi_remove_handle() succeeded\n");
 
 test_cleanup:
 
   /* undocumented cleanup sequence - type UB */
 
   curl_easy_cleanup(curl);
-  curl_multi_cleanup(multiHandle);
+  curl_multi_cleanup(multi);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib586.c b/third-party/curl/tests/libtest/lib586.c
index 90d180070d..29eab18443 100644
--- a/third-party/curl/tests/libtest/lib586.c
+++ b/third-party/curl/tests/libtest/lib586.c
@@ -21,228 +21,221 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-#include "memdebug.h"
+#include "first.h"
 
 #define THREADS 2
 
 /* struct containing data of a thread */
-struct Tdata {
+struct t586_Tdata {
   CURLSH *share;
-  char *url;
+  const char *url;
 };
 
-struct userdata {
+struct t586_userdata {
   const char *text;
   int counter;
 };
 
 /* lock callback */
-static void my_lock(CURL *handle, curl_lock_data data,
-                    curl_lock_access laccess, void *useptr)
+static void t586_test_lock(CURL *curl, curl_lock_data data,
+                           curl_lock_access laccess, void *useptr)
 {
   const char *what;
-  struct userdata *user = (struct userdata *)useptr;
+  struct t586_userdata *user = (struct t586_userdata *)useptr;
 
-  (void)handle;
+  (void)curl;
   (void)laccess;
 
   switch(data) {
-    case CURL_LOCK_DATA_SHARE:
-      what = "share";
-      break;
-    case CURL_LOCK_DATA_DNS:
-      what = "dns";
-      break;
-    case CURL_LOCK_DATA_COOKIE:
-      what = "cookie";
-      break;
-    case CURL_LOCK_DATA_SSL_SESSION:
-      what = "ssl_session";
-      break;
-    default:
-      fprintf(stderr, "lock: no such data: %d\n", (int)data);
-      return;
+  case CURL_LOCK_DATA_SHARE:
+    what = "share";
+    break;
+  case CURL_LOCK_DATA_DNS:
+    what = "dns";
+    break;
+  case CURL_LOCK_DATA_COOKIE:
+    what = "cookie";
+    break;
+  case CURL_LOCK_DATA_SSL_SESSION:
+    what = "ssl_session";
+    break;
+  default:
+    curl_mfprintf(stderr, "lock: no such data: %d\n", (int)data);
+    return;
   }
-  printf("lock:   %-6s [%s]: %d\n", what, user->text, user->counter);
+  curl_mprintf("lock:   %-6s [%s]: %d\n", what, user->text, user->counter);
   user->counter++;
 }
 
 /* unlock callback */
-static void my_unlock(CURL *handle, curl_lock_data data, void *useptr)
+static void t586_test_unlock(CURL *curl, curl_lock_data data, void *useptr)
 {
   const char *what;
-  struct userdata *user = (struct userdata *)useptr;
-  (void)handle;
+  struct t586_userdata *user = (struct t586_userdata *)useptr;
+  (void)curl;
   switch(data) {
-    case CURL_LOCK_DATA_SHARE:
-      what = "share";
-      break;
-    case CURL_LOCK_DATA_DNS:
-      what = "dns";
-      break;
-    case CURL_LOCK_DATA_COOKIE:
-      what = "cookie";
-      break;
-    case CURL_LOCK_DATA_SSL_SESSION:
-      what = "ssl_session";
-      break;
-    default:
-      fprintf(stderr, "unlock: no such data: %d\n", (int)data);
-      return;
+  case CURL_LOCK_DATA_SHARE:
+    what = "share";
+    break;
+  case CURL_LOCK_DATA_DNS:
+    what = "dns";
+    break;
+  case CURL_LOCK_DATA_COOKIE:
+    what = "cookie";
+    break;
+  case CURL_LOCK_DATA_SSL_SESSION:
+    what = "ssl_session";
+    break;
+  default:
+    curl_mfprintf(stderr, "unlock: no such data: %d\n", (int)data);
+    return;
   }
-  printf("unlock: %-6s [%s]: %d\n", what, user->text, user->counter);
+  curl_mprintf("unlock: %-6s [%s]: %d\n", what, user->text, user->counter);
   user->counter++;
 }
 
 /* the dummy thread function */
-static void *fire(void *ptr)
+static void *t586_test_fire(void *ptr)
 {
-  CURLcode code;
-  struct Tdata *tdata = (struct Tdata*)ptr;
+  CURLcode result;
+  struct t586_Tdata *tdata = (struct t586_Tdata *)ptr;
   CURL *curl;
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     return NULL;
   }
 
   curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
-  curl_easy_setopt(curl, CURLOPT_VERBOSE,    1L);
-  curl_easy_setopt(curl, CURLOPT_URL,        tdata->url);
-  printf("CURLOPT_SHARE\n");
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_URL, tdata->url);
+  curl_mprintf("CURLOPT_SHARE\n");
   curl_easy_setopt(curl, CURLOPT_SHARE, tdata->share);
 
-  printf("PERFORM\n");
-  code = curl_easy_perform(curl);
-  if(code != CURLE_OK) {
+  curl_mprintf("PERFORM\n");
+  result = curl_easy_perform(curl);
+  if(result != CURLE_OK) {
     int i = 0;
-    fprintf(stderr, "perform url '%s' repeat %d failed, curlcode %d\n",
-            tdata->url, i, (int)code);
+    curl_mfprintf(stderr, "perform URL '%s' repeat %d failed, curlcode %d\n",
+                  tdata->url, i, (int)result);
   }
 
-  printf("CLEANUP\n");
+  curl_mprintf("CLEANUP\n");
   curl_easy_cleanup(curl);
 
   return NULL;
 }
 
 /* test function */
-int test(char *URL)
+static CURLcode test_lib586(const char *URL)
 {
-  int res;
+  CURLcode result = CURLE_OK;
   CURLSHcode scode = CURLSHE_OK;
-  char *url;
-  struct Tdata tdata;
+  struct t586_Tdata tdata;
   CURL *curl;
   CURLSH *share;
   int i;
-  struct userdata user;
+  struct t586_userdata user;
 
   user.text = "Pigs in space";
   user.counter = 0;
 
-  printf("GLOBAL_INIT\n");
+  curl_mprintf("GLOBAL_INIT\n");
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* prepare share */
-  printf("SHARE_INIT\n");
+  curl_mprintf("SHARE_INIT\n");
   share = curl_share_init();
   if(!share) {
-    fprintf(stderr, "curl_share_init() failed\n");
+    curl_mfprintf(stderr, "curl_share_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   if(CURLSHE_OK == scode) {
-    printf("CURLSHOPT_LOCKFUNC\n");
-    scode = curl_share_setopt(share, CURLSHOPT_LOCKFUNC, my_lock);
+    curl_mprintf("CURLSHOPT_LOCKFUNC\n");
+    scode = curl_share_setopt(share, CURLSHOPT_LOCKFUNC, t586_test_lock);
   }
   if(CURLSHE_OK == scode) {
-    printf("CURLSHOPT_UNLOCKFUNC\n");
-    scode = curl_share_setopt(share, CURLSHOPT_UNLOCKFUNC, my_unlock);
+    curl_mprintf("CURLSHOPT_UNLOCKFUNC\n");
+    scode = curl_share_setopt(share, CURLSHOPT_UNLOCKFUNC, t586_test_unlock);
   }
   if(CURLSHE_OK == scode) {
-    printf("CURLSHOPT_USERDATA\n");
+    curl_mprintf("CURLSHOPT_USERDATA\n");
     scode = curl_share_setopt(share, CURLSHOPT_USERDATA, &user);
   }
   if(CURLSHE_OK == scode) {
-    printf("CURL_LOCK_DATA_SSL_SESSION\n");
+    curl_mprintf("CURL_LOCK_DATA_SSL_SESSION\n");
     scode = curl_share_setopt(share, CURLSHOPT_SHARE,
                               CURL_LOCK_DATA_SSL_SESSION);
   }
 
   if(CURLSHE_OK != scode) {
-    fprintf(stderr, "curl_share_setopt() failed\n");
+    curl_mfprintf(stderr, "curl_share_setopt() failed\n");
     curl_share_cleanup(share);
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-
-  res = 0;
-
   /* start treads */
   for(i = 1; i <= THREADS; i++) {
 
     /* set thread data */
-    tdata.url   = URL;
+    tdata.url = URL;
     tdata.share = share;
 
     /* simulate thread, direct call of "thread" function */
-    printf("*** run %d\n",i);
-    fire(&tdata);
+    curl_mprintf("*** run %d\n", i);
+    t586_test_fire(&tdata);
   }
 
-
-  /* fetch a another one */
-  printf("*** run %d\n", i);
+  /* fetch another one */
+  curl_mprintf("*** run %d\n", i);
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_share_cleanup(share);
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  url = URL;
-  test_setopt(curl, CURLOPT_URL, url);
-  printf("CURLOPT_SHARE\n");
-  test_setopt(curl, CURLOPT_SHARE, share);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  curl_mprintf("CURLOPT_SHARE\n");
+  easy_setopt(curl, CURLOPT_SHARE, share);
 
-  printf("PERFORM\n");
-  curl_easy_perform(curl);
+  curl_mprintf("PERFORM\n");
+  result = curl_easy_perform(curl);
 
   /* try to free share, expect to fail because share is in use */
-  printf("try SHARE_CLEANUP...\n");
+  curl_mprintf("try SHARE_CLEANUP...\n");
   scode = curl_share_cleanup(share);
   if(scode == CURLSHE_OK) {
-    fprintf(stderr, "curl_share_cleanup succeed but error expected\n");
+    curl_mfprintf(stderr, "curl_share_cleanup succeed but error expected\n");
     share = NULL;
   }
   else {
-    printf("SHARE_CLEANUP failed, correct\n");
+    curl_mprintf("SHARE_CLEANUP failed, correct\n");
   }
 
 test_cleanup:
 
   /* clean up last handle */
-  printf("CLEANUP\n");
+  curl_mprintf("CLEANUP\n");
   curl_easy_cleanup(curl);
 
   /* free share */
-  printf("SHARE_CLEANUP\n");
+  curl_mprintf("SHARE_CLEANUP\n");
   scode = curl_share_cleanup(share);
   if(scode != CURLSHE_OK)
-    fprintf(stderr, "curl_share_cleanup failed, code errno %d\n",
-            (int)scode);
+    curl_mfprintf(stderr, "curl_share_cleanup failed, code errno %d\n",
+                  (int)scode);
 
-  printf("GLOBAL_CLEANUP\n");
+  curl_mprintf("GLOBAL_CLEANUP\n");
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib589.c b/third-party/curl/tests/libtest/lib589.c
index 5fe56dbba8..1f4b6cfbe1 100644
--- a/third-party/curl/tests/libtest/lib589.c
+++ b/third-party/curl/tests/libtest/lib589.c
@@ -21,54 +21,56 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib589(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
+  curl_mime *mime = NULL;
+  curl_mimepart *part;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L); /* show verbose for debug */
-  test_setopt(curl, CURLOPT_HEADER, 1L); /* include header */
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L); /* show verbose for debug */
+  easy_setopt(curl, CURLOPT_HEADER, 1L); /* include header */
 
-#ifdef LIB584
-  {
-    curl_mime *mime = curl_mime_init(curl);
-    curl_mimepart *part = curl_mime_addpart(mime);
-    curl_mime_name(part, "fake");
-    curl_mime_data(part, "party", 5);
-    test_setopt(curl, CURLOPT_MIMEPOST, mime);
-    res = curl_easy_perform(curl);
-    curl_mime_free(mime);
+  if(testnum == 584) {
+    mime = curl_mime_init(curl);
+    part = curl_mime_addpart(mime);
+    if(mime && part) {
+      curl_mime_name(part, "fake");
+      curl_mime_data(part, "party", 5);
+      easy_setopt(curl, CURLOPT_MIMEPOST, mime);
+      result = curl_easy_perform(curl);
+    }
+    if(result)
+      goto test_cleanup;
   }
-#endif
 
-  test_setopt(curl, CURLOPT_MIMEPOST, NULL);
+  easy_setopt(curl, CURLOPT_MIMEPOST, NULL);
 
   /* Now, we should be making a zero byte POST request */
-  res = curl_easy_perform(curl);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
   /* always cleanup */
+  curl_mime_free(mime);
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib590.c b/third-party/curl/tests/libtest/lib590.c
index babcd19528..3a83e62701 100644
--- a/third-party/curl/tests/libtest/lib590.c
+++ b/third-party/curl/tests/libtest/lib590.c
@@ -21,7 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
 /*
   Based on a bug report recipe by Rene Bernhardt in
@@ -29,45 +29,56 @@
 
   It is reproducible by the following steps:
 
-  - Use a proxy that offers NTLM and Negotiate ( CURLOPT_PROXY and
-  CURLOPT_PROXYPORT)
-  - Tell libcurl NOT to use Negotiate  CURL_EASY_SETOPT(CURLOPT_PROXYAUTH,
-  CURLAUTH_BASIC | CURLAUTH_DIGEST | CURLAUTH_NTLM)
+  - Use a proxy that offers NTLM and Negotiate
+    (CURLOPT_PROXY and CURLOPT_PROXYPORT)
+  - Tell libcurl NOT to use Negotiate
+    curl_easy_setopt(CURLOPT_PROXYAUTH,
+                     CURLAUTH_BASIC | CURLAUTH_DIGEST | CURLAUTH_NTLM)
   - Start the request
 */
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib590(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
+  long usedauth = 0;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_HEADER, 1L);
-  test_setopt(curl, CURLOPT_PROXYAUTH,
-              (long) (CURLAUTH_BASIC | CURLAUTH_DIGEST | CURLAUTH_NTLM));
-  test_setopt(curl, CURLOPT_PROXY, libtest_arg2); /* set in first.c */
-  test_setopt(curl, CURLOPT_PROXYUSERPWD, "me:password");
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_PROXYAUTH,
+              CURLAUTH_BASIC | CURLAUTH_DIGEST | CURLAUTH_NTLM);
+  easy_setopt(curl, CURLOPT_PROXY, libtest_arg2); /* set in first.c */
 
-  res = curl_easy_perform(curl);
+  /* set the name + password twice to test that the API is fine with it */
+  easy_setopt(curl, CURLOPT_PROXYUSERNAME, "me");
+  easy_setopt(curl, CURLOPT_PROXYPASSWORD, "password");
+  easy_setopt(curl, CURLOPT_PROXYUSERPWD, "me:password");
+
+  result = curl_easy_perform(curl);
+  if(result)
+    goto test_cleanup;
+
+  result = curl_easy_getinfo(curl, CURLINFO_PROXYAUTH_USED, &usedauth);
+  if(CURLAUTH_NTLM != usedauth) {
+    curl_mprintf("CURLINFO_PROXYAUTH_USED did not say NTLM\n");
+  }
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib591.c b/third-party/curl/tests/libtest/lib591.c
index 94fd65605e..455b4ff2d2 100644
--- a/third-party/curl/tests/libtest/lib591.c
+++ b/third-party/curl/tests/libtest/lib591.c
@@ -21,70 +21,64 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
 /* lib591 is used for test cases 591, 592, 593 and 594 */
 
-#include <limits.h>
+#include "first.h"
 
-#include <fcntl.h>
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 60 * 1000
-
-int test(char *URL)
+static CURLcode test_lib591(const char *URL)
 {
-  CURL *easy = NULL;
+  CURL *curl = NULL;
   CURLM *multi = NULL;
-  int res = 0;
+  CURLcode result = CURLE_OK;
   int running;
   int msgs_left;
   CURLMsg *msg;
   FILE *upload = NULL;
+  curl_off_t accept_timeout;
+
+  if(curlx_str_number(&libtest_arg2, &accept_timeout, 65535))
+    return TEST_ERR_MAJOR_BAD;
 
   start_test_timing();
 
-  upload = fopen(libtest_arg3, "rb");
+  upload = curlx_fopen(libtest_arg3, "rb");
   if(!upload) {
-    fprintf(stderr, "fopen() failed with error: %d (%s)\n",
-            errno, strerror(errno));
-    fprintf(stderr, "Error opening file: (%s)\n", libtest_arg3);
+    char errbuf[STRERROR_LEN];
+    curl_mfprintf(stderr, "fopen() failed with error (%d) %s\n",
+                  errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
+    curl_mfprintf(stderr, "Error opening file '%s'\n", libtest_arg3);
     return TEST_ERR_FOPEN;
   }
 
   res_global_init(CURL_GLOBAL_ALL);
-  if(res) {
-    fclose(upload);
-    return res;
+  if(result) {
+    curlx_fclose(upload);
+    return result;
   }
 
-  easy_init(easy);
+  easy_init(curl);
 
   /* go verbose */
-  easy_setopt(easy, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* specify target */
-  easy_setopt(easy, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* enable uploading */
-  easy_setopt(easy, CURLOPT_UPLOAD, 1L);
+  easy_setopt(curl, CURLOPT_UPLOAD, 1L);
 
   /* data pointer for the file read function */
-  easy_setopt(easy, CURLOPT_READDATA, upload);
+  easy_setopt(curl, CURLOPT_READDATA, upload);
 
   /* use active mode FTP */
-  easy_setopt(easy, CURLOPT_FTPPORT, "-");
+  easy_setopt(curl, CURLOPT_FTPPORT, "-");
 
   /* server connection timeout */
-  easy_setopt(easy, CURLOPT_ACCEPTTIMEOUT_MS,
-              strtol(libtest_arg2, NULL, 10)*1000);
+  easy_setopt(curl, CURLOPT_ACCEPTTIMEOUT_MS, (long)(accept_timeout * 1000));
 
   multi_init(multi);
 
-  multi_add_handle(multi, easy);
+  multi_add_handle(multi, curl);
 
   for(;;) {
     struct timeval interval;
@@ -114,9 +108,14 @@ int test(char *URL)
     /* At this point, timeout is guaranteed to be greater or equal than -1. */
 
     if(timeout != -1L) {
-      int itimeout = (timeout > (long)INT_MAX) ? INT_MAX : (int)timeout;
-      interval.tv_sec = itimeout/1000;
-      interval.tv_usec = (itimeout%1000)*1000;
+      int itimeout;
+#if LONG_MAX > INT_MAX
+      itimeout = (timeout > (long)INT_MAX) ? INT_MAX : (int)timeout;
+#else
+      itimeout = (int)timeout;
+#endif
+      interval.tv_sec = itimeout / 1000;
+      interval.tv_usec = (itimeout % 1000) * 1000;
     }
     else {
       interval.tv_sec = 0;
@@ -130,18 +129,18 @@ int test(char *URL)
 
   msg = curl_multi_info_read(multi, &msgs_left);
   if(msg)
-    res = msg->data.result;
+    result = msg->data.result;
 
 test_cleanup:
 
   /* undocumented cleanup sequence - type UA */
 
   curl_multi_cleanup(multi);
-  curl_easy_cleanup(easy);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
   /* close the local file */
-  fclose(upload);
+  curlx_fclose(upload);
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib597.c b/third-party/curl/tests/libtest/lib597.c
index 4f40821265..0c1fc473f1 100644
--- a/third-party/curl/tests/libtest/lib597.c
+++ b/third-party/curl/tests/libtest/lib597.c
@@ -21,15 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include <limits.h>
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 5 * 1000
+#include "first.h"
 
 /*
  * Test case for below scenario:
@@ -40,11 +32,11 @@
  * with function curl_multi_info_read().
  */
 
-int test(char *URL)
+static CURLcode test_lib597(const char *URL)
 {
-  CURL *easy = NULL;
+  CURL *curl = NULL;
   CURLM *multi = NULL;
-  int res = 0;
+  CURLcode result = CURLE_OK;
   int running;
   int msgs_left;
   CURLMsg *msg;
@@ -53,19 +45,19 @@ int test(char *URL)
 
   global_init(CURL_GLOBAL_ALL);
 
-  easy_init(easy);
+  easy_init(curl);
 
   multi_init(multi);
 
   /* go verbose */
-  easy_setopt(easy, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* specify target */
-  easy_setopt(easy, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
-  easy_setopt(easy, CURLOPT_CONNECT_ONLY, 1L);
+  easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
 
-  multi_add_handle(multi, easy);
+  multi_add_handle(multi, curl);
 
   for(;;) {
     struct timeval interval;
@@ -96,12 +88,17 @@ int test(char *URL)
        -1. */
 
     if(timeout != -1L) {
-      int itimeout = (timeout > (long)INT_MAX) ? INT_MAX : (int)timeout;
-      interval.tv_sec = itimeout/1000;
-      interval.tv_usec = (itimeout%1000)*1000;
+      int itimeout;
+#if LONG_MAX > INT_MAX
+      itimeout = (timeout > (long)INT_MAX) ? INT_MAX : (int)timeout;
+#else
+      itimeout = (int)timeout;
+#endif
+      interval.tv_sec = itimeout / 1000;
+      interval.tv_usec = (itimeout % 1000) * 1000;
     }
     else {
-      interval.tv_sec = TEST_HANG_TIMEOUT/1000 + 1;
+      interval.tv_sec = (TEST_HANG_TIMEOUT / 1000) - 1;
       interval.tv_usec = 0;
     }
 
@@ -112,17 +109,17 @@ int test(char *URL)
 
   msg = curl_multi_info_read(multi, &msgs_left);
   if(msg)
-    res = msg->data.result;
+    result = msg->data.result;
 
-  multi_remove_handle(multi, easy);
+  multi_remove_handle(multi, curl);
 
 test_cleanup:
 
   /* undocumented cleanup sequence - type UA */
 
   curl_multi_cleanup(multi);
-  curl_easy_cleanup(easy);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib598.c b/third-party/curl/tests/libtest/lib598.c
index 62b3655142..c6025c578b 100644
--- a/third-party/curl/tests/libtest/lib598.c
+++ b/third-party/curl/tests/libtest/lib598.c
@@ -21,54 +21,52 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib598(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_HEADER, 1L);
-  test_setopt(curl, CURLOPT_REFERER, "http://example.com/the-moo");
-  test_setopt(curl, CURLOPT_USERAGENT, "the-moo agent next generation");
-  test_setopt(curl, CURLOPT_COOKIE, "name=moo");
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_REFERER, "http://example.com/the-moo");
+  easy_setopt(curl, CURLOPT_USERAGENT, "the-moo agent next generation");
+  easy_setopt(curl, CURLOPT_COOKIE, "name=moo");
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  res = curl_easy_perform(curl);
-  if(res) {
-    fprintf(stderr, "retrieve 1 failed\n");
+  result = curl_easy_perform(curl);
+  if(result) {
+    curl_mfprintf(stderr, "retrieve 1 failed\n");
     goto test_cleanup;
   }
 
   curl_easy_reset(curl);
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_HEADER, 1L);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  res = curl_easy_perform(curl);
-  if(res)
-    fprintf(stderr, "retrieve 2 failed\n");
+  result = curl_easy_perform(curl);
+  if(result)
+    curl_mfprintf(stderr, "retrieve 2 failed\n");
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib599.c b/third-party/curl/tests/libtest/lib599.c
index 6002e0fb04..ba8ebca97b 100644
--- a/third-party/curl/tests/libtest/lib599.c
+++ b/third-party/curl/tests/libtest/lib599.c
@@ -21,12 +21,10 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static int progress_callback(void *clientp, double dltotal,
-                             double dlnow, double ultotal, double ulnow)
+static int t599_progress_callback(void *clientp, double dltotal,
+                                  double dlnow, double ultotal, double ulnow)
 {
   (void)clientp;
   (void)ulnow;
@@ -34,62 +32,58 @@ static int progress_callback(void *clientp, double dltotal,
 
   if((dltotal > 0.0) && (dlnow > dltotal)) {
     /* this should not happen with test case 599 */
-    printf("%.0f > %.0f !!\n", dltotal, dlnow);
+    curl_mprintf("%.0f > %.0f !!\n", dltotal, dlnow);
     return -1;
   }
 
   return 0;
 }
 
-int test(char *URL)
+static CURLcode test_lib599(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
   double content_length = 0.0;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* we want to use our own progress function */
-  test_setopt(curl, CURLOPT_NOPROGRESS, 0L);
-  CURL_IGNORE_DEPRECATION(
-    test_setopt(curl, CURLOPT_PROGRESSFUNCTION, progress_callback);
-  )
+  easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
+  easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, t599_progress_callback);
 
   /* get verbose debug output please */
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* follow redirects */
-  test_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+  easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
 
   /* include headers in the output */
-  test_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-  /* Perform the request, res will get the return code */
-  res = curl_easy_perform(curl);
+  /* Perform the request, result gets the return code */
+  result = curl_easy_perform(curl);
 
-  if(!res) {
+  if(!result) {
     FILE *moo;
-    CURL_IGNORE_DEPRECATION(
-      res = curl_easy_getinfo(curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD,
-                            &content_length);
-    )
-    moo = fopen(libtest_arg2, "wb");
+    result = curl_easy_getinfo(curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD,
+                               &content_length);
+    moo = curlx_fopen(libtest_arg2, "wb");
     if(moo) {
-      fprintf(moo, "CL %.0f\n", content_length);
-      fclose(moo);
+      curl_mfprintf(moo, "CL %.0f\n", content_length);
+      curlx_fclose(moo);
     }
   }
 
@@ -99,5 +93,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib643.c b/third-party/curl/tests/libtest/lib643.c
index efd508f8d0..eaf75e8fe1 100644
--- a/third-party/curl/tests/libtest/lib643.c
+++ b/third-party/curl/tests/libtest/lib643.c
@@ -21,68 +21,67 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static char data[]=
-  "dummy\n";
-
-struct WriteThis {
-  char *readptr;
+struct t643_WriteThis {
+  const char *readptr;
   curl_off_t sizeleft;
 };
 
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t t643_read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
-  struct WriteThis *pooh = (struct WriteThis *)userp;
-  int eof = !*pooh->readptr;
+  struct t643_WriteThis *pooh = (struct t643_WriteThis *)userp;
+  int eof;
 
-  if(size*nmemb < 1)
+  if(size * nmemb < 1)
     return 0;
 
-#ifndef LIB645
-  eof = pooh->sizeleft <= 0;
-  if(!eof)
-    pooh->sizeleft--;
-#endif
-
-  if(!eof) {
-    *ptr = *pooh->readptr;           /* copy one single byte */
-    pooh->readptr++;                 /* advance pointer */
-    return 1;                        /* we return 1 byte at a time! */
+  if(testnum == 643) {
+    eof = pooh->sizeleft <= 0;
+    if(!eof)
+      pooh->sizeleft--;
+  }
+  else {
+    eof = !*pooh->readptr;
   }
 
-  return 0;                         /* no more data left to deliver */
+  if(!eof) {
+    *ptr = *pooh->readptr;  /* copy one single byte */
+    pooh->readptr++;        /* advance pointer */
+    return 1;               /* we return 1 byte at a time! */
+  }
+
+  return 0;                 /* no more data left to deliver */
 }
 
-static int once(char *URL, bool oldstyle)
+static CURLcode t643_test_once(const char *URL, bool oldstyle)
 {
+  static const char testdata[] = "dummy\n";
+
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   curl_mime *mime = NULL;
   curl_mimepart *part = NULL;
-  struct WriteThis pooh;
-  struct WriteThis pooh2;
+  struct t643_WriteThis pooh;
+  struct t643_WriteThis pooh2;
   curl_off_t datasize = -1;
 
-  pooh.readptr = data;
-#ifndef LIB645
-  datasize = (curl_off_t)strlen(data);
-#endif
+  pooh.readptr = testdata;
+  if(testnum == 643)
+    datasize = (curl_off_t)(sizeof(testdata) - 1);
   pooh.sizeleft = datasize;
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   mime = curl_mime_init(curl);
   if(!mime) {
-    fprintf(stderr, "curl_mime_init() failed\n");
+    curl_mfprintf(stderr, "curl_mime_init() failed\n");
     curl_easy_cleanup(curl);
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
@@ -90,7 +89,7 @@ static int once(char *URL, bool oldstyle)
 
   part = curl_mime_addpart(mime);
   if(!part) {
-    fprintf(stderr, "curl_mime_addpart(1) failed\n");
+    curl_mfprintf(stderr, "curl_mime_addpart(1) failed\n");
     curl_mime_free(mime);
     curl_easy_cleanup(curl);
     curl_global_cleanup();
@@ -99,55 +98,54 @@ static int once(char *URL, bool oldstyle)
 
   /* Fill in the file upload part */
   if(oldstyle) {
-    res = curl_mime_name(part, "sendfile");
-    if(!res)
-      res = curl_mime_data_cb(part, datasize, read_callback,
-                              NULL, NULL, &pooh);
-    if(!res)
-      res = curl_mime_filename(part, "postit2.c");
+    result = curl_mime_name(part, "sendfile");
+    if(!result)
+      result = curl_mime_data_cb(part, datasize, t643_read_cb, NULL, NULL,
+                                 &pooh);
+    if(!result)
+      result = curl_mime_filename(part, "postit2.c");
   }
   else {
     /* new style */
-    res = curl_mime_name(part, "sendfile alternative");
-    if(!res)
-      res = curl_mime_data_cb(part, datasize, read_callback,
-                              NULL, NULL, &pooh);
-    if(!res)
-      res = curl_mime_filename(part, "file name 2");
+    result = curl_mime_name(part, "sendfile alternative");
+    if(!result)
+      result = curl_mime_data_cb(part, datasize, t643_read_cb, NULL, NULL,
+                                 &pooh);
+    if(!result)
+      result = curl_mime_filename(part, "filename 2 ");
   }
 
-  if(res)
-    printf("curl_mime_xxx(1) = %s\n", curl_easy_strerror(res));
+  if(result)
+    curl_mprintf("curl_mime_xxx(1) = %s\n", curl_easy_strerror(result));
 
   /* Now add the same data with another name and make it not look like
      a file upload but still using the callback */
 
-  pooh2.readptr = data;
-#ifndef LIB645
-  datasize = (curl_off_t)strlen(data);
-#endif
+  pooh2.readptr = testdata;
+  if(testnum == 643)
+    datasize = (curl_off_t)(sizeof(testdata) - 1);
   pooh2.sizeleft = datasize;
 
   part = curl_mime_addpart(mime);
   if(!part) {
-    fprintf(stderr, "curl_mime_addpart(2) failed\n");
+    curl_mfprintf(stderr, "curl_mime_addpart(2) failed\n");
     curl_mime_free(mime);
     curl_easy_cleanup(curl);
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
   /* Fill in the file upload part */
-  res = curl_mime_name(part, "callbackdata");
-  if(!res)
-    res = curl_mime_data_cb(part, datasize, read_callback,
-                            NULL, NULL, &pooh2);
+  result = curl_mime_name(part, "callbackdata");
+  if(!result)
+    result = curl_mime_data_cb(part, datasize, t643_read_cb, NULL, NULL,
+                               &pooh2);
 
-  if(res)
-    printf("curl_mime_xxx(2) = %s\n", curl_easy_strerror(res));
+  if(result)
+    curl_mprintf("curl_mime_xxx(2) = %s\n", curl_easy_strerror(result));
 
   part = curl_mime_addpart(mime);
   if(!part) {
-    fprintf(stderr, "curl_mime_addpart(3) failed\n");
+    curl_mfprintf(stderr, "curl_mime_addpart(3) failed\n");
     curl_mime_free(mime);
     curl_easy_cleanup(curl);
     curl_global_cleanup();
@@ -155,62 +153,60 @@ static int once(char *URL, bool oldstyle)
   }
 
   /* Fill in the filename field */
-  res = curl_mime_name(part, "filename");
-  if(!res)
-    res = curl_mime_data(part, "postit2.c",
-                         CURL_ZERO_TERMINATED);
+  result = curl_mime_name(part, "filename");
+  if(!result)
+    result = curl_mime_data(part, "postit2.c", CURL_ZERO_TERMINATED);
 
-  if(res)
-    printf("curl_mime_xxx(3) = %s\n", curl_easy_strerror(res));
+  if(result)
+    curl_mprintf("curl_mime_xxx(3) = %s\n", curl_easy_strerror(result));
 
   /* Fill in a submit field too */
   part = curl_mime_addpart(mime);
   if(!part) {
-    fprintf(stderr, "curl_mime_addpart(4) failed\n");
+    curl_mfprintf(stderr, "curl_mime_addpart(4) failed\n");
     curl_mime_free(mime);
     curl_easy_cleanup(curl);
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
-  res = curl_mime_name(part, "submit");
-  if(!res)
-    res = curl_mime_data(part, "send",
-                         CURL_ZERO_TERMINATED);
+  result = curl_mime_name(part, "submit");
+  if(!result)
+    result = curl_mime_data(part, "send", CURL_ZERO_TERMINATED);
 
-  if(res)
-    printf("curl_mime_xxx(4) = %s\n", curl_easy_strerror(res));
+  if(result)
+    curl_mprintf("curl_mime_xxx(4) = %s\n", curl_easy_strerror(result));
 
   part = curl_mime_addpart(mime);
   if(!part) {
-    fprintf(stderr, "curl_mime_addpart(5) failed\n");
+    curl_mfprintf(stderr, "curl_mime_addpart(5) failed\n");
     curl_mime_free(mime);
     curl_easy_cleanup(curl);
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
-  res = curl_mime_name(part, "somename");
-  if(!res)
-    res = curl_mime_filename(part, "somefile.txt");
-  if(!res)
-    res = curl_mime_data(part, "blah blah", 9);
+  result = curl_mime_name(part, "somename");
+  if(!result)
+    result = curl_mime_filename(part, "somefile.txt");
+  if(!result)
+    result = curl_mime_data(part, "blah blah", 9);
 
-  if(res)
-    printf("curl_mime_xxx(5) = %s\n", curl_easy_strerror(res));
+  if(result)
+    curl_mprintf("curl_mime_xxx(5) = %s\n", curl_easy_strerror(result));
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* send a multi-part mimepost */
-  test_setopt(curl, CURLOPT_MIMEPOST, mime);
+  easy_setopt(curl, CURLOPT_MIMEPOST, mime);
 
   /* get verbose debug output please */
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* include headers in the output */
-  test_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-  /* Perform the request, res will get the return code */
-  res = curl_easy_perform(curl);
+  /* Perform the request, result gets the return code */
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -220,50 +216,50 @@ test_cleanup:
   /* now cleanup the mimepost structure */
   curl_mime_free(mime);
 
-  return res;
+  return result;
 }
 
-static int cyclic_add(void)
+static CURLcode t643_cyclic_add(void)
 {
-  CURL *easy = curl_easy_init();
-  curl_mime *mime = curl_mime_init(easy);
+  CURL *curl = curl_easy_init();
+  curl_mime *mime = curl_mime_init(curl);
   curl_mimepart *part = curl_mime_addpart(mime);
-  CURLcode a1 = curl_mime_subparts(part, mime);
+  CURLcode result = curl_mime_subparts(part, mime);
 
-  if(a1 == CURLE_BAD_FUNCTION_ARGUMENT) {
-    curl_mime *submime = curl_mime_init(easy);
+  if(result == CURLE_BAD_FUNCTION_ARGUMENT) {
+    curl_mime *submime = curl_mime_init(curl);
     curl_mimepart *subpart = curl_mime_addpart(submime);
 
     curl_mime_subparts(part, submime);
-    a1 = curl_mime_subparts(subpart, mime);
+    result = curl_mime_subparts(subpart, mime);
   }
 
   curl_mime_free(mime);
-  curl_easy_cleanup(easy);
-  if(a1 != CURLE_BAD_FUNCTION_ARGUMENT)
+  curl_easy_cleanup(curl);
+  if(result != CURLE_BAD_FUNCTION_ARGUMENT)
     /* that should have failed */
-    return 1;
+    return TEST_ERR_FAILURE;
 
-  return 0;
+  return CURLE_OK;
 }
 
-int test(char *URL)
+static CURLcode test_lib643(const char *URL)
 {
-  int res;
+  CURLcode result;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
-  res = once(URL, TRUE); /* old */
-  if(!res)
-    res = once(URL, FALSE); /* new */
+  result = t643_test_once(URL, TRUE); /* old */
+  if(!result)
+    result = t643_test_once(URL, FALSE); /* new */
 
-  if(!res)
-    res = cyclic_add();
+  if(!result)
+    result = t643_cyclic_add();
 
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib650.c b/third-party/curl/tests/libtest/lib650.c
index 14c79e94bc..b0766eee1d 100644
--- a/third-party/curl/tests/libtest/lib650.c
+++ b/third-party/curl/tests/libtest/lib650.c
@@ -21,16 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#define CURL_DISABLE_DEPRECATION  /* Using and testing the form api */
-#include "test.h"
-
-#include "memdebug.h"
-
-static char data[] =
-  "this is what we post to the silly web server";
-
-static const char name[] = "fieldname";
-
+#include "first.h"
 
 /* This test attempts to use all form API features that are not
  * used elsewhere.
@@ -39,18 +30,17 @@ static const char name[] = "fieldname";
 /* curl_formget callback to count characters. */
 static size_t count_chars(void *userp, const char *buf, size_t len)
 {
-  size_t *pcounter = (size_t *) userp;
+  size_t *pcounter = (size_t *)userp;
 
-  (void) buf;
+  (void)buf;
   *pcounter += len;
   return len;
 }
 
-
-int test(char *URL)
+static CURLcode test_lib650(const char *URL)
 {
   CURL *curl = NULL;
-  CURLcode res = TEST_ERR_MAJOR_BAD;
+  CURLcode result = TEST_ERR_MAJOR_BAD;
   CURLFORMcode formrc;
   struct curl_slist *headers, *headers2 = NULL;
   struct curl_httppost *formpost = NULL;
@@ -58,10 +48,12 @@ int test(char *URL)
   struct curl_forms formarray[3];
   size_t formlength = 0;
   char flbuf[32];
-  long contentlength = 0;
+
+  static const char testname[] = "fieldname";
+  static char testdata[] = "this is what we post to the silly web server";
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
@@ -81,42 +73,39 @@ int test(char *URL)
   }
   headers = headers2;
   formrc = curl_formadd(&formpost, &lastptr,
-                        CURLFORM_COPYNAME, &name,
-                        CURLFORM_COPYCONTENTS, &data,
+                        CURLFORM_COPYNAME, &testname,
+                        CURLFORM_COPYCONTENTS, &testdata,
                         CURLFORM_CONTENTHEADER, headers,
                         CURLFORM_END);
-
   if(formrc) {
-    printf("curl_formadd(1) = %d\n", (int) formrc);
+    curl_mprintf("curl_formadd(1) = %d\n", (int)formrc);
     goto test_cleanup;
   }
 
-  contentlength = (long)(strlen(data) - 1);
-
   /* Use a form array for the non-copy test. */
   formarray[0].option = CURLFORM_PTRCONTENTS;
-  formarray[0].value = data;
+  formarray[0].value = testdata;
   formarray[1].option = CURLFORM_CONTENTSLENGTH;
-  formarray[1].value = (char *)(size_t)contentlength;
+  formarray[1].value = (char *)(strlen(testdata) - 1);
   formarray[2].option = CURLFORM_END;
   formarray[2].value = NULL;
   formrc = curl_formadd(&formpost,
                         &lastptr,
-                        CURLFORM_PTRNAME, name,
-                        CURLFORM_NAMELENGTH, strlen(name) - 1,
+                        CURLFORM_PTRNAME, testname,
+                        CURLFORM_NAMELENGTH, (long)(sizeof(testname) - 2),
                         CURLFORM_ARRAY, formarray,
                         CURLFORM_FILENAME, "remotefile.txt",
                         CURLFORM_END);
 
   if(formrc) {
-    printf("curl_formadd(2) = %d\n", (int) formrc);
+    curl_mprintf("curl_formadd(2) = %d\n", (int)formrc);
     goto test_cleanup;
   }
 
   /* Now change in-memory data to affect CURLOPT_PTRCONTENTS value.
      Copied values (first field) must not be affected.
      CURLOPT_PTRNAME actually copies the name thus we do not test this here. */
-  data[0]++;
+  testdata[0]++;
 
   /* Check multi-files and content type propagation. */
   formrc = curl_formadd(&formpost,
@@ -129,7 +118,7 @@ int test(char *URL)
                         CURLFORM_END);
 
   if(formrc) {
-    printf("curl_formadd(3) = %d\n", (int) formrc);
+    curl_mprintf("curl_formadd(3) = %d\n", (int)formrc);
     goto test_cleanup;
   }
 
@@ -139,9 +128,8 @@ int test(char *URL)
                         CURLFORM_COPYNAME, "filecontents",
                         CURLFORM_FILECONTENT, libtest_arg2,
                         CURLFORM_END);
-
   if(formrc) {
-    printf("curl_formadd(4) = %d\n", (int) formrc);
+    curl_mprintf("curl_formadd(4) = %d\n", (int)formrc);
     goto test_cleanup;
   }
 
@@ -149,17 +137,19 @@ int test(char *URL)
    * This is done before including stdin data because we want to reuse it
    * and stdin cannot be rewound.
    */
-  curl_formget(formpost, (void *) &formlength, count_chars);
+  curl_formget(formpost, (void *)&formlength, count_chars);
 
   /* Include length in data for external check. */
-  curl_msnprintf(flbuf, sizeof(flbuf), "%lu", (unsigned long) formlength);
+  curl_msnprintf(flbuf, sizeof(flbuf), "%zu", formlength);
+
   formrc = curl_formadd(&formpost,
                         &lastptr,
                         CURLFORM_COPYNAME, "formlength",
                         CURLFORM_COPYCONTENTS, &flbuf,
                         CURLFORM_END);
+
   if(formrc) {
-    printf("curl_formadd(5) = %d\n", (int) formrc);
+    curl_mprintf("curl_formadd(5) = %d\n", (int)formrc);
     goto test_cleanup;
   }
 
@@ -169,34 +159,35 @@ int test(char *URL)
                         CURLFORM_COPYNAME, "standardinput",
                         CURLFORM_FILE, "-",
                         CURLFORM_END);
+
   if(formrc) {
-    printf("curl_formadd(6) = %d\n", (int) formrc);
+    curl_mprintf("curl_formadd(6) = %d\n", (int)formrc);
     goto test_cleanup;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     goto test_cleanup;
   }
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* send a multi-part formpost */
-  test_setopt(curl, CURLOPT_HTTPPOST, formpost);
+  easy_setopt(curl, CURLOPT_HTTPPOST, formpost);
 
   /* get verbose debug output please */
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  test_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
-  test_setopt(curl, CURLOPT_POSTREDIR, (long)CURL_REDIR_POST_301);
+  easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+  easy_setopt(curl, CURLOPT_POSTREDIR, CURL_REDIR_POST_301);
 
   /* include headers in the output */
-  test_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-  /* Perform the request, res will get the return code */
-  res = curl_easy_perform(curl);
+  /* Perform the request, result gets the return code */
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -209,5 +200,5 @@ test_cleanup:
 
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib651.c b/third-party/curl/tests/libtest/lib651.c
index 2e45ccc212..1c8fca2fd1 100644
--- a/third-party/curl/tests/libtest/lib651.c
+++ b/third-party/curl/tests/libtest/lib651.c
@@ -21,67 +21,62 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#define CURL_DISABLE_DEPRECATION  /* Using and testing the form api */
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static char buffer[17000]; /* more than 16K */
-
-int test(char *URL)
+static CURLcode test_lib651(const char *URL)
 {
+  static char testbuf[17000]; /* more than 16K */
+
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
   CURLFORMcode formrc;
   struct curl_httppost *formpost = NULL;
   struct curl_httppost *lastptr = NULL;
 
   /* create a buffer with AAAA...BBBBB...CCCC...etc */
   int i;
-  int size = (int)sizeof(buffer)/1000;
+  int size = (int)sizeof(testbuf) / 1000;
 
-  for(i = 0; i < size ; i++)
-    memset(&buffer[i * 1000], 65 + i, 1000);
+  for(i = 0; i < size; i++)
+    memset(&testbuf[i * 1000], 65 + i, 1000);
 
-  buffer[ sizeof(buffer)-1] = 0; /* null-terminate */
+  testbuf[sizeof(testbuf) - 1] = 0; /* null-terminate */
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* Check proper name and data copying. */
   formrc = curl_formadd(&formpost, &lastptr,
                         CURLFORM_COPYNAME, "hello",
-                        CURLFORM_COPYCONTENTS, buffer,
+                        CURLFORM_COPYCONTENTS, testbuf,
                         CURLFORM_END);
-
   if(formrc)
-    printf("curl_formadd(1) = %d\n", (int) formrc);
-
+    curl_mprintf("curl_formadd(1) = %d\n", (int)formrc);
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_formfree(formpost);
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* send a multi-part formpost */
-  test_setopt(curl, CURLOPT_HTTPPOST, formpost);
+  easy_setopt(curl, CURLOPT_HTTPPOST, formpost);
 
   /* get verbose debug output please */
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* include headers in the output */
-  test_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-  /* Perform the request, res will get the return code */
-  res = curl_easy_perform(curl);
+  /* Perform the request, result gets the return code */
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -93,5 +88,5 @@ test_cleanup:
 
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib652.c b/third-party/curl/tests/libtest/lib652.c
index 7a100b7319..bf225348ed 100644
--- a/third-party/curl/tests/libtest/lib652.c
+++ b/third-party/curl/tests/libtest/lib652.c
@@ -21,100 +21,98 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static char buffer[17000]; /* more than 16K */
-
-int test(char *URL)
+static CURLcode test_lib652(const char *URL)
 {
+  static char testbuf[17000]; /* more than 16K */
+
   CURL *curl = NULL;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
   curl_mime *mime = NULL;
   curl_mimepart *part;
   struct curl_slist *recipients = NULL;
 
-  /* create a buffer with AAAA...BBBBB...CCCC...etc */
+  /* create a testbuf with AAAA...BBBBB...CCCC...etc */
   int i;
-  int size = (int)sizeof(buffer) / 10;
+  int size = (int)sizeof(testbuf) / 10;
 
-  for(i = 0; i < size ; i++)
-    memset(&buffer[i * 10], 65 + (i % 26), 10);
+  for(i = 0; i < size; i++)
+    memset(&testbuf[i * 10], 65 + (i % 26), 10);
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
-    res = (CURLcode) TEST_ERR_MAJOR_BAD;
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
 
   /* Build mime structure. */
   mime = curl_mime_init(curl);
   if(!mime) {
-    fprintf(stderr, "curl_mime_init() failed\n");
-    res = (CURLcode) TEST_ERR_MAJOR_BAD;
+    curl_mfprintf(stderr, "curl_mime_init() failed\n");
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
   part = curl_mime_addpart(mime);
   if(!part) {
-    fprintf(stderr, "curl_mime_addpart() failed\n");
-    res = (CURLcode) TEST_ERR_MAJOR_BAD;
+    curl_mfprintf(stderr, "curl_mime_addpart() failed\n");
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  res = curl_mime_filename(part, "myfile.jpg");
-  if(res) {
-    fprintf(stderr, "curl_mime_filename() failed\n");
+  result = curl_mime_filename(part, "myfile.jpg");
+  if(result) {
+    curl_mfprintf(stderr, "curl_mime_filename() failed\n");
     goto test_cleanup;
   }
-  res = curl_mime_type(part, "image/jpeg");
-  if(res) {
-    fprintf(stderr, "curl_mime_type() failed\n");
+  result = curl_mime_type(part, "image/jpeg");
+  if(result) {
+    curl_mfprintf(stderr, "curl_mime_type() failed\n");
     goto test_cleanup;
   }
-  res = curl_mime_data(part, buffer, sizeof(buffer));
-  if(res) {
-    fprintf(stderr, "curl_mime_data() failed\n");
+  result = curl_mime_data(part, testbuf, sizeof(testbuf));
+  if(result) {
+    curl_mfprintf(stderr, "curl_mime_data() failed\n");
     goto test_cleanup;
   }
-  res = curl_mime_encoder(part, "base64");
-  if(res) {
-    fprintf(stderr, "curl_mime_encoder() failed\n");
+  result = curl_mime_encoder(part, "base64");
+  if(result) {
+    curl_mfprintf(stderr, "curl_mime_encoder() failed\n");
     goto test_cleanup;
   }
 
   /* Prepare recipients. */
   recipients = curl_slist_append(NULL, "someone@example.com");
   if(!recipients) {
-    fprintf(stderr, "curl_slist_append() failed\n");
+    curl_mfprintf(stderr, "curl_slist_append() failed\n");
     goto test_cleanup;
   }
 
   /* First set the URL that is about to receive our mime mail. */
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* Set sender. */
-  test_setopt(curl, CURLOPT_MAIL_FROM, "somebody@example.com");
+  easy_setopt(curl, CURLOPT_MAIL_FROM, "somebody@example.com");
 
   /* Set recipients. */
-  test_setopt(curl, CURLOPT_MAIL_RCPT, recipients);
+  easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients);
 
   /* send a multi-part mail */
-  test_setopt(curl, CURLOPT_MIMEPOST, mime);
+  easy_setopt(curl, CURLOPT_MIMEPOST, mime);
 
   /* Shorten upload buffer. */
-  test_setopt(curl, CURLOPT_UPLOAD_BUFFERSIZE, 16411L);
+  easy_setopt(curl, CURLOPT_UPLOAD_BUFFERSIZE, 16411L);
 
   /* get verbose debug output please */
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  /* Perform the request, res will get the return code */
-  res = curl_easy_perform(curl);
+  /* Perform the request, result gets the return code */
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -129,5 +127,5 @@ test_cleanup:
 
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib653.c b/third-party/curl/tests/libtest/lib653.c
index 8a6fff3415..4cce921c5b 100644
--- a/third-party/curl/tests/libtest/lib653.c
+++ b/third-party/curl/tests/libtest/lib653.c
@@ -21,45 +21,40 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-
-int test(char *URL)
+static CURLcode test_lib653(const char *URL)
 {
-  CURL *curls = NULL;
-  int res = 0;
+  CURL *curl = NULL;
+  CURLcode result = CURLE_OK;
   curl_mimepart *field = NULL;
   curl_mime *mime = NULL;
 
   global_init(CURL_GLOBAL_ALL);
-  easy_init(curls);
+  easy_init(curl);
 
-  mime = curl_mime_init(curls);
+  mime = curl_mime_init(curl);
   field = curl_mime_addpart(mime);
   curl_mime_name(field, "name");
   curl_mime_data(field, "short value", CURL_ZERO_TERMINATED);
 
-  easy_setopt(curls, CURLOPT_URL, URL);
-  easy_setopt(curls, CURLOPT_HEADER, 1L);
-  easy_setopt(curls, CURLOPT_VERBOSE, 1L);
-  easy_setopt(curls, CURLOPT_MIMEPOST, mime);
-  easy_setopt(curls, CURLOPT_NOPROGRESS, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_MIMEPOST, mime);
+  easy_setopt(curl, CURLOPT_NOPROGRESS, 1L);
 
-  res = curl_easy_perform(curls);
-  if(res)
+  result = curl_easy_perform(curl);
+  if(result)
     goto test_cleanup;
 
   /* Alter form and resubmit. */
   curl_mime_data(field, "long value for length change", CURL_ZERO_TERMINATED);
-  res = curl_easy_perform(curls);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
   curl_mime_free(mime);
-  curl_easy_cleanup(curls);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
-  return (int) res; /* return the final return code */
+  return result; /* return the final return code */
 }
diff --git a/third-party/curl/tests/libtest/lib654.c b/third-party/curl/tests/libtest/lib654.c
index 96551637df..0494d580ab 100644
--- a/third-party/curl/tests/libtest/lib654.c
+++ b/third-party/curl/tests/libtest/lib654.c
@@ -21,32 +21,27 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static char data[]=
-  "dummy\n";
-
-struct WriteThis {
-  char *readptr;
+struct t654_WriteThis {
+  const char *readptr;
   curl_off_t sizeleft;
   int freecount;
 };
 
 static void free_callback(void *userp)
 {
-  struct WriteThis *pooh = (struct WriteThis *) userp;
+  struct t654_WriteThis *pooh = (struct t654_WriteThis *)userp;
 
   pooh->freecount++;
 }
 
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t t654_read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
-  struct WriteThis *pooh = (struct WriteThis *)userp;
-  int eof = !*pooh->readptr;
+  struct t654_WriteThis *pooh = (struct t654_WriteThis *)userp;
+  int eof;
 
-  if(size*nmemb < 1)
+  if(size * nmemb < 1)
     return 0;
 
   eof = pooh->sizeleft <= 0;
@@ -54,24 +49,25 @@ static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
     pooh->sizeleft--;
 
   if(!eof) {
-    *ptr = *pooh->readptr;           /* copy one single byte */
-    pooh->readptr++;                 /* advance pointer */
-    return 1;                        /* we return 1 byte at a time! */
+    *ptr = *pooh->readptr;  /* copy one single byte */
+    pooh->readptr++;        /* advance pointer */
+    return 1;               /* we return 1 byte at a time! */
   }
 
-  return 0;                         /* no more data left to deliver */
+  return 0;                 /* no more data left to deliver */
 }
 
-int test(char *URL)
+static CURLcode test_lib654(const char *URL)
 {
-  CURL *easy = NULL;
-  CURL *easy2 = NULL;
+  static const char testdata[] = "dummy\n";
+
+  CURL *curl = NULL;
+  CURL *curl2 = NULL;
   curl_mime *mime = NULL;
   curl_mimepart *part;
   struct curl_slist *hdrs = NULL;
-  CURLcode result;
-  int res = TEST_ERR_FAILURE;
-  struct WriteThis pooh;
+  CURLcode result = TEST_ERR_FAILURE;
+  struct t654_WriteThis pooh;
 
   /*
    * Check proper copy/release of mime post data bound to a duplicated
@@ -79,28 +75,28 @@ int test(char *URL)
    */
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
-  easy = curl_easy_init();
+  curl = curl_easy_init();
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(easy, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* get verbose debug output please */
-  test_setopt(easy, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* include headers in the output */
-  test_setopt(easy, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
   /* Prepare the callback structure. */
-  pooh.readptr = data;
-  pooh.sizeleft = (curl_off_t) strlen(data);
+  pooh.readptr = testdata;
+  pooh.sizeleft = (curl_off_t)(sizeof(testdata) - 1);
   pooh.freecount = 0;
 
   /* Build the mime tree. */
-  mime = curl_mime_init(easy);
+  mime = curl_mime_init(curl);
   part = curl_mime_addpart(mime);
   curl_mime_data(part, "hello", CURL_ZERO_TERMINATED);
   curl_mime_name(part, "greeting");
@@ -111,17 +107,17 @@ int test(char *URL)
   part = curl_mime_addpart(mime);
   curl_mime_filedata(part, libtest_arg2);
   part = curl_mime_addpart(mime);
-  curl_mime_data_cb(part, (curl_off_t) -1, read_callback, NULL, free_callback,
-                    &pooh);
+  curl_mime_data_cb(part, (curl_off_t)-1, t654_read_cb, NULL,
+                    free_callback, &pooh);
 
   /* Bind mime data to its easy handle. */
-  test_setopt(easy, CURLOPT_MIMEPOST, mime);
+  easy_setopt(curl, CURLOPT_MIMEPOST, mime);
 
   /* Duplicate the handle. */
-  easy2 = curl_easy_duphandle(easy);
-  if(!easy2) {
-    fprintf(stderr, "curl_easy_duphandle() failed\n");
-    res = TEST_ERR_FAILURE;
+  curl2 = curl_easy_duphandle(curl);
+  if(!curl2) {
+    curl_mfprintf(stderr, "curl_easy_duphandle() failed\n");
+    result = TEST_ERR_FAILURE;
     goto test_cleanup;
   }
 
@@ -131,39 +127,37 @@ int test(char *URL)
   mime = NULL;  /* Already cleaned up. */
 
   /* Perform on the first handle: should not send any data. */
-  result = curl_easy_perform(easy);
-  if(result) {
-    fprintf(stderr, "curl_easy_perform(original) failed\n");
-    res = (int) result;
+  result = curl_easy_perform(curl);
+  if(result != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_easy_perform(original) failed\n");
     goto test_cleanup;
   }
 
   /* Perform on the second handle: if the bound mime structure has not been
      duplicated properly, it should cause a valgrind error. */
-  result = curl_easy_perform(easy2);
-  if(result) {
-    fprintf(stderr, "curl_easy_perform(duplicated) failed\n");
-    res = (int) result;
+  result = curl_easy_perform(curl2);
+  if(result != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_easy_perform(duplicated) failed\n");
     goto test_cleanup;
   }
 
   /* Free the duplicated handle: it should call free_callback again.
      If the mime copy was bad or not automatically released, valgrind
-     will signal it. */
-  curl_easy_cleanup(easy2);
-  easy2 = NULL;  /* Already cleaned up. */
+     signals it. */
+  curl_easy_cleanup(curl2);
+  curl2 = NULL;  /* Already cleaned up. */
 
   if(pooh.freecount != 2) {
-    fprintf(stderr, "free_callback() called %d times instead of 2\n",
-            pooh.freecount);
-    res = TEST_ERR_FAILURE;
+    curl_mfprintf(stderr, "free_callback() called %d times instead of 2\n",
+                  pooh.freecount);
+    result = TEST_ERR_FAILURE;
     goto test_cleanup;
   }
 
 test_cleanup:
-  curl_easy_cleanup(easy);
-  curl_easy_cleanup(easy2);
+  curl_easy_cleanup(curl);
+  curl_easy_cleanup(curl2);
   curl_mime_free(mime);
   curl_global_cleanup();
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib655.c b/third-party/curl/tests/libtest/lib655.c
index 83525e57db..3dd70dfa73 100644
--- a/third-party/curl/tests/libtest/lib655.c
+++ b/third-party/curl/tests/libtest/lib655.c
@@ -21,87 +21,100 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
+#include "testtrace.h"
 
 static const char *TEST_DATA_STRING = "Test data";
 static int cb_count = 0;
 
-static int
-resolver_alloc_cb_fail(void *resolver_state, void *reserved, void *userdata)
+static int resolver_alloc_cb_fail(void *resolver_state, void *reserved,
+                                  void *userdata)
 {
   (void)resolver_state;
   (void)reserved;
 
   cb_count++;
   if(strcmp(userdata, TEST_DATA_STRING)) {
-    fprintf(stderr, "Invalid test data received");
+    curl_mfprintf(stderr, "Invalid test data received");
     exit(1);
   }
 
   return 1;
 }
 
-static int
-resolver_alloc_cb_pass(void *resolver_state, void *reserved, void *userdata)
+static int resolver_alloc_cb_pass(void *resolver_state, void *reserved,
+                                  void *userdata)
 {
   (void)resolver_state;
   (void)reserved;
 
   cb_count++;
   if(strcmp(userdata, TEST_DATA_STRING)) {
-    fprintf(stderr, "Invalid test data received");
+    curl_mfprintf(stderr, "Invalid test data received");
     exit(1);
   }
 
   return 0;
 }
 
-int test(char *URL)
+static CURLcode test_lib655(const char *URL)
 {
   CURL *curl;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
+
+  debug_config.nohex = TRUE;
+  debug_config.tracetime = TRUE;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
-    res = TEST_ERR_MAJOR_BAD;
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
 
-  /* First set the URL that is about to receive our request. */
-  test_setopt(curl, CURLOPT_URL, URL);
+  /* Set the URL that is about to receive our first request. */
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_DEBUGDATA, &debug_config);
+  easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  test_setopt(curl, CURLOPT_RESOLVER_START_DATA, TEST_DATA_STRING);
-  test_setopt(curl, CURLOPT_RESOLVER_START_FUNCTION, resolver_alloc_cb_fail);
+  easy_setopt(curl, CURLOPT_RESOLVER_START_DATA, TEST_DATA_STRING);
+  easy_setopt(curl, CURLOPT_RESOLVER_START_FUNCTION, resolver_alloc_cb_fail);
 
   /* this should fail */
-  res = curl_easy_perform(curl);
-  if(res != CURLE_COULDNT_RESOLVE_HOST) {
-    fprintf(stderr, "curl_easy_perform should have returned "
-            "CURLE_COULDNT_RESOLVE_HOST but instead returned error %d\n", res);
-    if(res == CURLE_OK)
-      res = TEST_ERR_FAILURE;
+  result = curl_easy_perform(curl);
+  if(result != CURLE_ABORTED_BY_CALLBACK) {
+    curl_mfprintf(stderr, "curl_easy_perform should have returned "
+                  "CURLE_ABORTED_BY_CALLBACK but instead returned error %d\n",
+                  (int)result);
+    if(result == CURLE_OK)
+      result = TEST_ERR_FAILURE;
     goto test_cleanup;
   }
 
-  test_setopt(curl, CURLOPT_RESOLVER_START_FUNCTION, resolver_alloc_cb_pass);
+  /* Set the URL that receives our second request. */
+  easy_setopt(curl, CURLOPT_URL, libtest_arg2);
+  easy_setopt(curl, CURLOPT_DEBUGDATA, &debug_config);
+  easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+  easy_setopt(curl, CURLOPT_RESOLVER_START_FUNCTION, resolver_alloc_cb_pass);
 
   /* this should succeed */
-  res = curl_easy_perform(curl);
-  if(res) {
-    fprintf(stderr, "curl_easy_perform failed.\n");
+  result = curl_easy_perform(curl);
+  if(result) {
+    curl_mfprintf(stderr, "curl_easy_perform failed.\n");
     goto test_cleanup;
   }
 
   if(cb_count != 2) {
-    fprintf(stderr, "Unexpected number of callbacks: %d\n", cb_count);
-    res = TEST_ERR_FAILURE;
+    curl_mfprintf(stderr, "Unexpected number of callbacks: %d\n", cb_count);
+    result = TEST_ERR_FAILURE;
     goto test_cleanup;
   }
 
@@ -110,5 +123,5 @@ test_cleanup:
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib658.c b/third-party/curl/tests/libtest/lib658.c
index 5be239f672..8ed465715f 100644
--- a/third-party/curl/tests/libtest/lib658.c
+++ b/third-party/curl/tests/libtest/lib658.c
@@ -21,59 +21,56 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
+#include "first.h"
 
 /*
  * Get a single URL without select().
  */
 
-int test(char *URL)
+static CURLcode test_lib658(const char *URL)
 {
-  CURL *handle = NULL;
-  CURLcode res = CURLE_OK;
+  CURL *curl = NULL;
+  CURLcode result = CURLE_OK;
   CURLU *urlp = NULL;
   CURLUcode uc = CURLUE_OK;
 
   global_init(CURL_GLOBAL_ALL);
-  easy_init(handle);
+  easy_init(curl);
 
   urlp = curl_url();
 
   if(!urlp) {
-    fprintf(stderr, "problem init URL api.");
+    curl_mfprintf(stderr, "problem init URL api.");
     goto test_cleanup;
   }
 
   uc = curl_url_set(urlp, CURLUPART_URL, URL, 0);
   if(uc) {
-    fprintf(stderr, "problem setting CURLUPART_URL: %s.",
-            curl_url_strerror(uc));
+    curl_mfprintf(stderr, "problem setting CURLUPART_URL: %s.",
+                  curl_url_strerror(uc));
     goto test_cleanup;
   }
 
   /* demonstrate override behavior */
-  easy_setopt(handle, CURLOPT_URL, "http://www.example.com");
+  easy_setopt(curl, CURLOPT_URL, "http://www.example.com");
 
-  easy_setopt(handle, CURLOPT_CURLU, urlp);
-  easy_setopt(handle, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_CURLU, urlp);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  res = curl_easy_perform(handle);
+  result = curl_easy_perform(curl);
 
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_perform() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  if(result) {
+    curl_mfprintf(stderr, "%s:%d curl_easy_perform() failed "
+                  "with code %d (%s)\n", __FILE__, __LINE__,
+                  (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
 
 test_cleanup:
 
   curl_url_cleanup(urlp);
-  curl_easy_cleanup(handle);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib659.c b/third-party/curl/tests/libtest/lib659.c
index 97efbec65d..c2fb30d4ea 100644
--- a/third-party/curl/tests/libtest/lib659.c
+++ b/third-party/curl/tests/libtest/lib659.c
@@ -21,57 +21,54 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
+#include "first.h"
 
 /*
  * Get a single URL without select().
  */
 
-int test(char *URL)
+static CURLcode test_lib659(const char *URL)
 {
-  CURL *handle = NULL;
-  CURLcode res = CURLE_OK;
+  CURL *curl = NULL;
+  CURLcode result = CURLE_OK;
   CURLU *urlp = NULL;
 
   global_init(CURL_GLOBAL_ALL);
-  easy_init(handle);
+  easy_init(curl);
 
   urlp = curl_url();
 
   if(!urlp) {
-    fprintf(stderr, "problem init URL api.");
+    curl_mfprintf(stderr, "problem init URL api.");
     goto test_cleanup;
   }
 
-  /* this doesn't set the PATH part */
+  /* this does not set the PATH part */
   if(curl_url_set(urlp, CURLUPART_HOST, "www.example.com", 0) ||
      curl_url_set(urlp, CURLUPART_SCHEME, "http", 0) ||
      curl_url_set(urlp, CURLUPART_PORT, "80", 0)) {
-    fprintf(stderr, "problem setting CURLUPART");
+    curl_mfprintf(stderr, "problem setting CURLUPART");
     goto test_cleanup;
   }
 
-  easy_setopt(handle, CURLOPT_CURLU, urlp);
-  easy_setopt(handle, CURLOPT_VERBOSE, 1L);
-  easy_setopt(handle, CURLOPT_PROXY, URL);
+  easy_setopt(curl, CURLOPT_CURLU, urlp);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_PROXY, URL);
 
-  res = curl_easy_perform(handle);
+  result = curl_easy_perform(curl);
 
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_perform() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  if(result) {
+    curl_mfprintf(stderr, "%s:%d curl_easy_perform() failed "
+                  "with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
 
 test_cleanup:
 
   curl_url_cleanup(urlp);
-  curl_easy_cleanup(handle);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib661.c b/third-party/curl/tests/libtest/lib661.c
index 6478ddbf59..80d46e8738 100644
--- a/third-party/curl/tests/libtest/lib661.c
+++ b/third-party/curl/tests/libtest/lib661.c
@@ -21,132 +21,146 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-#include "memdebug.h"
+#include "first.h"
 
-int test(char *URL)
+static CURLcode test_lib661(const char *URL)
 {
-   CURLcode res;
-   CURL *curl = NULL;
-   char *newURL = NULL;
-   struct curl_slist *slist = NULL;
+  CURLcode result;
+  CURL *curl = NULL;
+  char *newURL = NULL;
+  struct curl_slist *slist = NULL;
 
-   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-     fprintf(stderr, "curl_global_init() failed\n");
-     return TEST_ERR_MAJOR_BAD;
-   }
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
 
-   curl = curl_easy_init();
-   if(!curl) {
-     fprintf(stderr, "curl_easy_init() failed\n");
-     res = TEST_ERR_MAJOR_BAD;
-     goto test_cleanup;
-   }
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    result = TEST_ERR_MAJOR_BAD;
+    goto test_cleanup;
+  }
 
-   /* test: CURLFTPMETHOD_SINGLECWD with absolute path should
-            skip CWD to entry path */
-   newURL = aprintf("%s/folderA/661", URL);
-   test_setopt(curl, CURLOPT_URL, newURL);
-   test_setopt(curl, CURLOPT_VERBOSE, 1L);
-   test_setopt(curl, CURLOPT_IGNORE_CONTENT_LENGTH, 1L);
-   test_setopt(curl, CURLOPT_FTP_FILEMETHOD, (long) CURLFTPMETHOD_SINGLECWD);
-   res = curl_easy_perform(curl);
+  /* test: CURLFTPMETHOD_SINGLECWD with absolute path should
+           skip CWD to entry path */
+  newURL = curl_maprintf("%s/folderA/661", URL);
+  easy_setopt(curl, CURLOPT_URL, newURL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_IGNORE_CONTENT_LENGTH, 1L);
+  easy_setopt(curl, CURLOPT_FTP_FILEMETHOD, CURLFTPMETHOD_SINGLECWD);
+  result = curl_easy_perform(curl);
+  if(result != CURLE_REMOTE_FILE_NOT_FOUND)
+    goto test_cleanup;
 
-   curl_free(newURL);
-   newURL = aprintf("%s/folderB/661", URL);
-   test_setopt(curl, CURLOPT_URL, newURL);
-   res = curl_easy_perform(curl);
+  curl_free(newURL);
+  newURL = curl_maprintf("%s/folderB/661", URL);
+  easy_setopt(curl, CURLOPT_URL, newURL);
+  result = curl_easy_perform(curl);
+  if(result != CURLE_REMOTE_FILE_NOT_FOUND)
+    goto test_cleanup;
 
-   /* test: CURLFTPMETHOD_NOCWD with absolute path should
-      never emit CWD (for both new and reused easy handle) */
-   curl_easy_cleanup(curl);
-   curl = curl_easy_init();
-   if(!curl) {
-     fprintf(stderr, "curl_easy_init() failed\n");
-     res = TEST_ERR_MAJOR_BAD;
-     goto test_cleanup;
-   }
+  /* test: CURLFTPMETHOD_NOCWD with absolute path should
+     never emit CWD (for both new and reused easy handle) */
+  curl_easy_cleanup(curl);
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    result = TEST_ERR_MAJOR_BAD;
+    goto test_cleanup;
+  }
 
-   curl_free(newURL);
-   newURL = aprintf("%s/folderA/661", URL);
-   test_setopt(curl, CURLOPT_URL, newURL);
-   test_setopt(curl, CURLOPT_VERBOSE, 1L);
-   test_setopt(curl, CURLOPT_IGNORE_CONTENT_LENGTH, 1L);
-   test_setopt(curl, CURLOPT_FTP_FILEMETHOD, (long) CURLFTPMETHOD_NOCWD);
-   res = curl_easy_perform(curl);
+  curl_free(newURL);
+  newURL = curl_maprintf("%s/folderA/661", URL);
+  easy_setopt(curl, CURLOPT_URL, newURL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_IGNORE_CONTENT_LENGTH, 1L);
+  easy_setopt(curl, CURLOPT_FTP_FILEMETHOD, CURLFTPMETHOD_NOCWD);
+  result = curl_easy_perform(curl);
+  if(result != CURLE_REMOTE_FILE_NOT_FOUND)
+    goto test_cleanup;
 
-   /* curve ball: CWD /folderB before reusing connection with _NOCWD */
-   curl_free(newURL);
-   newURL = aprintf("%s/folderB/661", URL);
-   test_setopt(curl, CURLOPT_URL, newURL);
-   test_setopt(curl, CURLOPT_FTP_FILEMETHOD, (long) CURLFTPMETHOD_SINGLECWD);
-   res = curl_easy_perform(curl);
+  /* curve ball: CWD /folderB before reusing connection with _NOCWD */
+  curl_free(newURL);
+  newURL = curl_maprintf("%s/folderB/661", URL);
+  easy_setopt(curl, CURLOPT_URL, newURL);
+  easy_setopt(curl, CURLOPT_FTP_FILEMETHOD, CURLFTPMETHOD_SINGLECWD);
+  result = curl_easy_perform(curl);
+  if(result != CURLE_REMOTE_FILE_NOT_FOUND)
+    goto test_cleanup;
 
-   curl_free(newURL);
-   newURL = aprintf("%s/folderA/661", URL);
-   test_setopt(curl, CURLOPT_URL, newURL);
-   test_setopt(curl, CURLOPT_FTP_FILEMETHOD, (long) CURLFTPMETHOD_NOCWD);
-   res = curl_easy_perform(curl);
+  curl_free(newURL);
+  newURL = curl_maprintf("%s/folderA/661", URL);
+  easy_setopt(curl, CURLOPT_URL, newURL);
+  easy_setopt(curl, CURLOPT_FTP_FILEMETHOD, CURLFTPMETHOD_NOCWD);
+  result = curl_easy_perform(curl);
+  if(result != CURLE_REMOTE_FILE_NOT_FOUND)
+    goto test_cleanup;
 
-   /* test: CURLFTPMETHOD_NOCWD with home-relative path should
-      not emit CWD for first FTP access after login */
-   curl_easy_cleanup(curl);
-   curl = curl_easy_init();
-   if(!curl) {
-     fprintf(stderr, "curl_easy_init() failed\n");
-     res = TEST_ERR_MAJOR_BAD;
-     goto test_cleanup;
-   }
+  /* test: CURLFTPMETHOD_NOCWD with home-relative path should
+     not emit CWD for first FTP access after login */
+  curl_easy_cleanup(curl);
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    result = TEST_ERR_MAJOR_BAD;
+    goto test_cleanup;
+  }
 
-   slist = curl_slist_append(NULL, "SYST");
-   if(!slist) {
-     fprintf(stderr, "curl_slist_append() failed\n");
-     res = TEST_ERR_MAJOR_BAD;
-     goto test_cleanup;
-   }
+  slist = curl_slist_append(NULL, "SYST");
+  if(!slist) {
+    curl_mfprintf(stderr, "curl_slist_append() failed\n");
+    result = TEST_ERR_MAJOR_BAD;
+    goto test_cleanup;
+  }
 
-   test_setopt(curl, CURLOPT_URL, URL);
-   test_setopt(curl, CURLOPT_VERBOSE, 1L);
-   test_setopt(curl, CURLOPT_NOBODY, 1L);
-   test_setopt(curl, CURLOPT_FTP_FILEMETHOD, (long) CURLFTPMETHOD_NOCWD);
-   test_setopt(curl, CURLOPT_QUOTE, slist);
-   res = curl_easy_perform(curl);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_NOBODY, 1L);
+  easy_setopt(curl, CURLOPT_FTP_FILEMETHOD, CURLFTPMETHOD_NOCWD);
+  easy_setopt(curl, CURLOPT_QUOTE, slist);
+  result = curl_easy_perform(curl);
+  if(result)
+    goto test_cleanup;
 
-   /* test: CURLFTPMETHOD_SINGLECWD with home-relative path should
-      not emit CWD for first FTP access after login */
-   curl_easy_cleanup(curl);
-   curl = curl_easy_init();
-   if(!curl) {
-     fprintf(stderr, "curl_easy_init() failed\n");
-     res = TEST_ERR_MAJOR_BAD;
-     goto test_cleanup;
-   }
+  /* test: CURLFTPMETHOD_SINGLECWD with home-relative path should
+     not emit CWD for first FTP access after login */
+  curl_easy_cleanup(curl);
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    result = TEST_ERR_MAJOR_BAD;
+    goto test_cleanup;
+  }
 
-   test_setopt(curl, CURLOPT_URL, URL);
-   test_setopt(curl, CURLOPT_VERBOSE, 1L);
-   test_setopt(curl, CURLOPT_NOBODY, 1L);
-   test_setopt(curl, CURLOPT_FTP_FILEMETHOD, (long) CURLFTPMETHOD_SINGLECWD);
-   test_setopt(curl, CURLOPT_QUOTE, slist);
-   res = curl_easy_perform(curl);
-
-   /* test: CURLFTPMETHOD_NOCWD with home-relative path should
-      not emit CWD for second FTP access when not needed +
-      bonus: see if path buffering survives curl_easy_reset() */
-   curl_easy_reset(curl);
-   test_setopt(curl, CURLOPT_URL, URL);
-   test_setopt(curl, CURLOPT_VERBOSE, 1L);
-   test_setopt(curl, CURLOPT_NOBODY, 1L);
-   test_setopt(curl, CURLOPT_FTP_FILEMETHOD, (long) CURLFTPMETHOD_NOCWD);
-   test_setopt(curl, CURLOPT_QUOTE, slist);
-   res = curl_easy_perform(curl);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_NOBODY, 1L);
+  easy_setopt(curl, CURLOPT_FTP_FILEMETHOD, CURLFTPMETHOD_SINGLECWD);
+  easy_setopt(curl, CURLOPT_QUOTE, slist);
+  result = curl_easy_perform(curl);
+  if(result)
+    goto test_cleanup;
 
+  /* test: CURLFTPMETHOD_NOCWD with home-relative path should
+     not emit CWD for second FTP access when not needed +
+     bonus: see if path buffering survives curl_easy_reset() */
+  curl_easy_reset(curl);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_NOBODY, 1L);
+  easy_setopt(curl, CURLOPT_FTP_FILEMETHOD, CURLFTPMETHOD_NOCWD);
+  easy_setopt(curl, CURLOPT_QUOTE, slist);
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
-   curl_slist_free_all(slist);
-   curl_free(newURL);
-   curl_easy_cleanup(curl);
-   curl_global_cleanup();
+  if(result)
+    curl_mfprintf(stderr, "test encountered error %d\n", (int)result);
+  curl_slist_free_all(slist);
+  curl_free(newURL);
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
 
-   return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib666.c b/third-party/curl/tests/libtest/lib666.c
index 62590702e0..43ea1eb88e 100644
--- a/third-party/curl/tests/libtest/lib666.c
+++ b/third-party/curl/tests/libtest/lib666.c
@@ -21,92 +21,90 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static char buffer[17000]; /* more than 16K */
-
-int test(char *URL)
+static CURLcode test_lib666(const char *URL)
 {
+  static char testbuf[17000]; /* more than 16K */
+
   CURL *curl = NULL;
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
   curl_mime *mime = NULL;
   curl_mimepart *part;
   size_t i;
 
   /* Checks huge binary-encoded mime post. */
 
-  /* Create a buffer with pseudo-binary data. */
-  for(i = 0; i < sizeof(buffer); i++)
+  /* Create a testbuf with pseudo-binary data. */
+  for(i = 0; i < sizeof(testbuf); i++)
     if(i % 77 == 76)
-      buffer[i] = '\n';
+      testbuf[i] = '\n';
     else
-      buffer[i] = (char) (0x41 + i % 26); /* A...Z */
+      testbuf[i] = (char)(0x41 + (i % 26)); /* A...Z */
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
-    res = (CURLcode) TEST_ERR_MAJOR_BAD;
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
 
   /* Build mime structure. */
   mime = curl_mime_init(curl);
   if(!mime) {
-    fprintf(stderr, "curl_mime_init() failed\n");
-    res = (CURLcode) TEST_ERR_MAJOR_BAD;
+    curl_mfprintf(stderr, "curl_mime_init() failed\n");
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
   part = curl_mime_addpart(mime);
   if(!part) {
-    fprintf(stderr, "curl_mime_addpart() failed\n");
-    res = (CURLcode) TEST_ERR_MAJOR_BAD;
+    curl_mfprintf(stderr, "curl_mime_addpart() failed\n");
+    result = TEST_ERR_MAJOR_BAD;
     goto test_cleanup;
   }
-  res = curl_mime_name(part, "upfile");
-  if(res) {
-    fprintf(stderr, "curl_mime_name() failed\n");
+  result = curl_mime_name(part, "upfile");
+  if(result) {
+    curl_mfprintf(stderr, "curl_mime_name() failed\n");
     goto test_cleanup;
   }
-  res = curl_mime_filename(part, "myfile.txt");
-  if(res) {
-    fprintf(stderr, "curl_mime_filename() failed\n");
+  result = curl_mime_filename(part, "myfile.txt");
+  if(result) {
+    curl_mfprintf(stderr, "curl_mime_filename() failed\n");
     goto test_cleanup;
   }
-  res = curl_mime_data(part, buffer, sizeof(buffer));
-  if(res) {
-    fprintf(stderr, "curl_mime_data() failed\n");
+  result = curl_mime_data(part, testbuf, sizeof(testbuf));
+  if(result) {
+    curl_mfprintf(stderr, "curl_mime_data() failed\n");
     goto test_cleanup;
   }
-  res = curl_mime_encoder(part, "binary");
-  if(res) {
-    fprintf(stderr, "curl_mime_encoder() failed\n");
+  result = curl_mime_encoder(part, "binary");
+  if(result) {
+    curl_mfprintf(stderr, "curl_mime_encoder() failed\n");
     goto test_cleanup;
   }
 
   /* First set the URL that is about to receive our mime mail. */
-  test_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* Post form */
-  test_setopt(curl, CURLOPT_MIMEPOST, mime);
+  easy_setopt(curl, CURLOPT_MIMEPOST, mime);
 
   /* Shorten upload buffer. */
-  test_setopt(curl, CURLOPT_UPLOAD_BUFFERSIZE, 16411L);
+  easy_setopt(curl, CURLOPT_UPLOAD_BUFFERSIZE, 16411L);
 
   /* get verbose debug output please */
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* include headers in the output */
-  test_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
-  /* Perform the request, res will get the return code */
-  res = curl_easy_perform(curl);
+  /* Perform the request, result gets the return code */
+  result = curl_easy_perform(curl);
 
 test_cleanup:
 
@@ -118,5 +116,5 @@ test_cleanup:
 
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib667.c b/third-party/curl/tests/libtest/lib667.c
index 076361add2..28a9cde6d2 100644
--- a/third-party/curl/tests/libtest/lib667.c
+++ b/third-party/curl/tests/libtest/lib667.c
@@ -21,24 +21,19 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static char data[]=
-  "dummy";
-
-struct WriteThis {
-  char *readptr;
+struct t667_WriteThis {
+  const char *readptr;
   curl_off_t sizeleft;
 };
 
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t t667_read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
-  struct WriteThis *pooh = (struct WriteThis *)userp;
-  int eof = !*pooh->readptr;
+  struct t667_WriteThis *pooh = (struct t667_WriteThis *)userp;
+  int eof;
 
-  if(size*nmemb < 1)
+  if(size * nmemb < 1)
     return 0;
 
   eof = pooh->sizeleft <= 0;
@@ -46,22 +41,23 @@ static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
     pooh->sizeleft--;
 
   if(!eof) {
-    *ptr = *pooh->readptr;           /* copy one single byte */
-    pooh->readptr++;                 /* advance pointer */
-    return 1;                        /* we return 1 byte at a time! */
+    *ptr = *pooh->readptr;  /* copy one single byte */
+    pooh->readptr++;        /* advance pointer */
+    return 1;               /* we return 1 byte at a time! */
   }
 
-  return 0;                         /* no more data left to deliver */
+  return 0;                 /* no more data left to deliver */
 }
 
-int test(char *URL)
+static CURLcode test_lib667(const char *URL)
 {
-  CURL *easy = NULL;
+  static const char testdata[] = "dummy";
+
+  CURL *curl = NULL;
   curl_mime *mime = NULL;
   curl_mimepart *part;
-  CURLcode result;
-  int res = TEST_ERR_FAILURE;
-  struct WriteThis pooh;
+  CURLcode result = TEST_ERR_FAILURE;
+  struct t667_WriteThis pooh;
 
   /*
    * Check proper handling of mime encoder feature when the part read callback
@@ -69,46 +65,45 @@ int test(char *URL)
    */
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
-  easy = curl_easy_init();
+  curl = curl_easy_init();
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(easy, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* get verbose debug output please */
-  test_setopt(easy, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* include headers in the output */
-  test_setopt(easy, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
   /* Prepare the callback structure. */
-  pooh.readptr = data;
-  pooh.sizeleft = (curl_off_t) strlen(data);
+  pooh.readptr = testdata;
+  pooh.sizeleft = (curl_off_t)(sizeof(testdata) - 1);
 
   /* Build the mime tree. */
-  mime = curl_mime_init(easy);
+  mime = curl_mime_init(curl);
   part = curl_mime_addpart(mime);
   curl_mime_name(part, "field");
   curl_mime_encoder(part, "base64");
   /* Using an undefined length forces chunked transfer. */
-  curl_mime_data_cb(part, (curl_off_t) -1, read_callback, NULL, NULL, &pooh);
+  curl_mime_data_cb(part, (curl_off_t)-1, t667_read_cb, NULL, NULL, &pooh);
 
   /* Bind mime data to its easy handle. */
-  test_setopt(easy, CURLOPT_MIMEPOST, mime);
+  easy_setopt(curl, CURLOPT_MIMEPOST, mime);
 
   /* Send data. */
-  result = curl_easy_perform(easy);
-  if(result) {
-    fprintf(stderr, "curl_easy_perform() failed\n");
-    res = (int) result;
+  result = curl_easy_perform(curl);
+  if(result != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_easy_perform() failed\n");
   }
 
 test_cleanup:
-  curl_easy_cleanup(easy);
+  curl_easy_cleanup(curl);
   curl_mime_free(mime);
   curl_global_cleanup();
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib668.c b/third-party/curl/tests/libtest/lib668.c
index 35ab758f38..33cf25e549 100644
--- a/third-party/curl/tests/libtest/lib668.c
+++ b/third-party/curl/tests/libtest/lib668.c
@@ -21,79 +21,77 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-static char data[]= "dummy";
-
-struct WriteThis {
-  char *readptr;
-  curl_off_t sizeleft;
+struct t668_WriteThis {
+  const char *readptr;
+  size_t sizeleft;
 };
 
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t t668_read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
-  struct WriteThis *pooh = (struct WriteThis *)userp;
-  size_t len = strlen(pooh->readptr);
+  struct t668_WriteThis *pooh = (struct t668_WriteThis *)userp;
+  size_t len = pooh->sizeleft;
 
-  (void) size; /* Always 1.*/
+  (void)size; /* Always 1 */
 
   if(len > nmemb)
     len = nmemb;
   if(len) {
     memcpy(ptr, pooh->readptr, len);
     pooh->readptr += len;
+    pooh->sizeleft -= len;
   }
   return len;
 }
 
-int test(char *URL)
+static CURLcode test_lib668(const char *URL)
 {
-  CURL *easy = NULL;
+  static const char testdata[] = "dummy";
+
+  CURL *curl = NULL;
   curl_mime *mime = NULL;
   curl_mimepart *part;
-  CURLcode result;
-  int res = TEST_ERR_FAILURE;
-  struct WriteThis pooh1, pooh2;
+  CURLcode result = TEST_ERR_FAILURE;
+  struct t668_WriteThis pooh1, pooh2;
 
   /*
    * Check early end of part data detection.
    */
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
-  easy = curl_easy_init();
+  curl = curl_easy_init();
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(easy, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_URL, URL);
 
   /* get verbose debug output please */
-  test_setopt(easy, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
   /* include headers in the output */
-  test_setopt(easy, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
 
   /* Prepare the callback structures. */
-  pooh1.readptr = data;
-  pooh1.sizeleft = (curl_off_t) strlen(data);
+  pooh1.readptr = testdata;
+  pooh1.sizeleft = sizeof(testdata) - 1;
   pooh2 = pooh1;
 
   /* Build the mime tree. */
-  mime = curl_mime_init(easy);
+  mime = curl_mime_init(curl);
   part = curl_mime_addpart(mime);
   curl_mime_name(part, "field1");
   /* Early end of data detection can be done because the data size is known. */
-  curl_mime_data_cb(part, (curl_off_t) strlen(data),
-                    read_callback, NULL, NULL, &pooh1);
+  curl_mime_data_cb(part, (curl_off_t)pooh1.sizeleft,
+                    t668_read_cb, NULL, NULL, &pooh1);
   part = curl_mime_addpart(mime);
   curl_mime_name(part, "field2");
   /* Using an undefined length forces chunked transfer and disables early
      end of data detection for this part. */
-  curl_mime_data_cb(part, (curl_off_t) -1, read_callback, NULL, NULL, &pooh2);
+  curl_mime_data_cb(part, (curl_off_t)-1, t668_read_cb, NULL, NULL, &pooh2);
   part = curl_mime_addpart(mime);
   curl_mime_name(part, "field3");
   /* Regular file part sources early end of data can be detected because
@@ -101,18 +99,17 @@ int test(char *URL)
   curl_mime_filedata(part, libtest_arg2);
 
   /* Bind mime data to its easy handle. */
-  test_setopt(easy, CURLOPT_MIMEPOST, mime);
+  easy_setopt(curl, CURLOPT_MIMEPOST, mime);
 
   /* Send data. */
-  result = curl_easy_perform(easy);
-  if(result) {
-    fprintf(stderr, "curl_easy_perform() failed\n");
-    res = (int) result;
+  result = curl_easy_perform(curl);
+  if(result != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_easy_perform() failed\n");
   }
 
 test_cleanup:
-  curl_easy_cleanup(easy);
+  curl_easy_cleanup(curl);
   curl_mime_free(mime);
   curl_global_cleanup();
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib670.c b/third-party/curl/tests/libtest/lib670.c
index 9af40731c0..2daeb06576 100644
--- a/third-party/curl/tests/libtest/lib670.c
+++ b/third-party/curl/tests/libtest/lib670.c
@@ -21,32 +21,19 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "first.h"
 
-#if !defined(LIB670) && !defined(LIB671)
-#define CURL_DISABLE_DEPRECATION  /* Using and testing the form api */
-#endif
+#define PAUSE_TIME 5
 
-#include "test.h"
-
-#include <time.h>
-
-#include "memdebug.h"
-
-#define PAUSE_TIME      2
-
-
-static const char name[] = "field";
-
-struct ReadThis {
-  CURL *easy;
+struct t670_ReadThis {
+  CURL *curl;
   time_t origin;
   int count;
 };
 
-
-static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
+static size_t t670_read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
 {
-  struct ReadThis *pooh = (struct ReadThis *) userp;
+  struct t670_ReadThis *pooh = (struct t670_ReadThis *)userp;
   time_t delta;
 
   if(size * nmemb < 1)
@@ -61,204 +48,197 @@ static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp)
     return CURL_READFUNC_PAUSE;
   case 2:
     delta = time(NULL) - pooh->origin;
-    *ptr = delta >= PAUSE_TIME? '\x42': '\x41'; /* ASCII A or B. */
+    *ptr = delta >= PAUSE_TIME ? '\x42' : '\x41'; /* ASCII A or B. */
     return 1;
   case 3:
     return 0;
   }
-  fprintf(stderr, "Read callback called after EOF\n");
+  curl_mfprintf(stderr, "Read callback called after EOF\n");
   exit(1);
 }
 
-#if !defined(LIB670) && !defined(LIB672)
-static int xferinfo(void *clientp, curl_off_t dltotal, curl_off_t dlnow,
-                    curl_off_t ultotal, curl_off_t ulnow)
+static int t670_xferinfo(void *clientp,
+                         curl_off_t dltotal, curl_off_t dlnow,
+                         curl_off_t ultotal, curl_off_t ulnow)
 {
-  struct ReadThis *pooh = (struct ReadThis *) clientp;
+  struct t670_ReadThis *pooh = (struct t670_ReadThis *)clientp;
 
-  (void) dltotal;
-  (void) dlnow;
-  (void) ultotal;
-  (void) ulnow;
+  (void)dltotal;
+  (void)dlnow;
+  (void)ultotal;
+  (void)ulnow;
 
   if(pooh->origin) {
     time_t delta = time(NULL) - pooh->origin;
 
     if(delta >= 4 * PAUSE_TIME) {
-      fprintf(stderr, "unpausing failed: drain problem?\n");
+      curl_mfprintf(stderr, "unpausing failed: drain problem?\n");
       return CURLE_ABORTED_BY_CALLBACK;
     }
 
     if(delta >= PAUSE_TIME)
-      curl_easy_pause(pooh->easy, CURLPAUSE_CONT);
+      curl_easy_pause(pooh->curl, CURLPAUSE_CONT);
   }
 
   return 0;
 }
-#endif
 
-int test(char *URL)
+static CURLcode test_lib670(const char *URL)
 {
-#if defined(LIB670) || defined(LIB671)
+  static const char testname[] = "field";
   curl_mime *mime = NULL;
-  curl_mimepart *part;
-#else
-  CURLFORMcode formrc;
   struct curl_httppost *formpost = NULL;
-  struct curl_httppost *lastptr = NULL;
-#endif
-#if defined(LIB670) || defined(LIB672)
-  CURLM *multi = NULL;
-  CURLMcode mres;
-  CURLMsg *msg;
-  int msgs_left;
-  int still_running = 0;
-#endif
-
-  struct ReadThis pooh;
-  CURLcode result;
-  int res = TEST_ERR_FAILURE;
+  struct t670_ReadThis pooh;
+  CURLcode result = TEST_ERR_FAILURE;
 
   /*
    * Check proper pausing/unpausing from a mime or form read callback.
    */
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
-  pooh.origin = (time_t) 0;
+  pooh.origin = (time_t)0;
   pooh.count = 0;
-  pooh.easy = curl_easy_init();
+  pooh.curl = curl_easy_init();
 
   /* First set the URL that is about to receive our POST. */
-  test_setopt(pooh.easy, CURLOPT_URL, URL);
+  easy_setopt(pooh.curl, CURLOPT_URL, URL);
 
   /* get verbose debug output please */
-  test_setopt(pooh.easy, CURLOPT_VERBOSE, 1L);
+  easy_setopt(pooh.curl, CURLOPT_VERBOSE, 1L);
 
   /* include headers in the output */
-  test_setopt(pooh.easy, CURLOPT_HEADER, 1L);
+  easy_setopt(pooh.curl, CURLOPT_HEADER, 1L);
 
-#if defined(LIB670) || defined(LIB671)
-  /* Build the mime tree. */
-  mime = curl_mime_init(pooh.easy);
-  part = curl_mime_addpart(mime);
-  result = curl_mime_name(part, name);
-  if(result) {
-    fprintf(stderr,
-            "Something went wrong when building the mime structure: %d\n",
-            (int) result);
-    goto test_cleanup;
+  if(testnum == 670 || testnum == 671) {
+    curl_mimepart *part;
+    /* Build the mime tree. */
+    mime = curl_mime_init(pooh.curl);
+    part = curl_mime_addpart(mime);
+    result = curl_mime_name(part, testname);
+    if(result != CURLE_OK) {
+      curl_mfprintf(stderr,
+                    "Something went wrong when building the "
+                    "mime structure: %d\n", (int)result);
+      goto test_cleanup;
+    }
+
+    result = curl_mime_data_cb(part, (curl_off_t)2, t670_read_cb,
+                               NULL, NULL, &pooh);
+
+    /* Bind mime data to its easy handle. */
+    if(result == CURLE_OK)
+      easy_setopt(pooh.curl, CURLOPT_MIMEPOST, mime);
+  }
+  else {
+    struct curl_httppost *lastptr = NULL;
+    CURLFORMcode formrc;
+    /* Build the form. */
+    formrc = curl_formadd(&formpost, &lastptr,
+                          CURLFORM_COPYNAME, testname,
+                          CURLFORM_STREAM, &pooh,
+                          CURLFORM_CONTENTLEN, (curl_off_t)2,
+                          CURLFORM_END);
+    if(formrc) {
+      curl_mfprintf(stderr, "curl_formadd() = %d\n", (int)formrc);
+      goto test_cleanup;
+    }
+
+    /* We want to use our own read function. */
+    easy_setopt(pooh.curl, CURLOPT_READFUNCTION, t670_read_cb);
+
+    /* Send a multi-part formpost. */
+    easy_setopt(pooh.curl, CURLOPT_HTTPPOST, formpost);
   }
 
-  res = curl_mime_data_cb(part, (curl_off_t) 2, read_callback,
-                          NULL, NULL, &pooh);
+  if(testnum == 670 || testnum == 672) {
+    CURLMcode mresult;
+    CURLM *multi;
+    /* Use the multi interface. */
+    multi = curl_multi_init();
+    mresult = curl_multi_add_handle(multi, pooh.curl);
+    while(!mresult) {
+      struct timeval timeout;
+      int rc = 0;
+      fd_set fdread;
+      fd_set fdwrite;
+      fd_set fdexcept;
+      int maxfd = -1;
+      int still_running = 0;
 
-  /* Bind mime data to its easy handle. */
-  if(!res)
-    test_setopt(pooh.easy, CURLOPT_MIMEPOST, mime);
-#else
-  /* Build the form. */
-  formrc = curl_formadd(&formpost, &lastptr,
-                        CURLFORM_COPYNAME, name,
-                        CURLFORM_STREAM, &pooh,
-                        CURLFORM_CONTENTLEN, (curl_off_t) 2,
-                        CURLFORM_END);
-  if(formrc) {
-    fprintf(stderr, "curl_formadd() = %d\n", (int) formrc);
-    goto test_cleanup;
-  }
-
-  /* We want to use our own read function. */
-  test_setopt(pooh.easy, CURLOPT_READFUNCTION, read_callback);
-
-  /* Send a multi-part formpost. */
-  test_setopt(pooh.easy, CURLOPT_HTTPPOST, formpost);
-#endif
-
-#if defined(LIB670) || defined(LIB672)
-  /* Use the multi interface. */
-  multi = curl_multi_init();
-  mres = curl_multi_add_handle(multi, pooh.easy);
-  while(!mres) {
-    struct timeval timeout;
-    int rc = 0;
-    fd_set fdread;
-    fd_set fdwrite;
-    fd_set fdexcept;
-    int maxfd = -1;
-
-    mres = curl_multi_perform(multi, &still_running);
-    if(!still_running || mres != CURLM_OK)
-      break;
-
-    if(pooh.origin) {
-      time_t delta = time(NULL) - pooh.origin;
-
-      if(delta >= 4 * PAUSE_TIME) {
-        fprintf(stderr, "unpausing failed: drain problem?\n");
-        res = CURLE_OPERATION_TIMEDOUT;
+      mresult = curl_multi_perform(multi, &still_running);
+      if(!still_running || mresult != CURLM_OK)
         break;
+
+      if(pooh.origin) {
+        time_t delta = time(NULL) - pooh.origin;
+
+        if(delta >= 4 * PAUSE_TIME) {
+          curl_mfprintf(stderr, "unpausing failed: drain problem?\n");
+          result = CURLE_OPERATION_TIMEDOUT;
+          break;
+        }
+
+        if(delta >= PAUSE_TIME)
+          curl_easy_pause(pooh.curl, CURLPAUSE_CONT);
       }
 
-      if(delta >= PAUSE_TIME)
-        curl_easy_pause(pooh.easy, CURLPAUSE_CONT);
-    }
-
-    FD_ZERO(&fdread);
-    FD_ZERO(&fdwrite);
-    FD_ZERO(&fdexcept);
-    timeout.tv_sec = 0;
-    timeout.tv_usec = 1000000 * PAUSE_TIME / 10;
-    mres = curl_multi_fdset(multi, &fdread, &fdwrite, &fdexcept, &maxfd);
-    if(mres)
-      break;
-#if defined(WIN32) || defined(_WIN32)
-    if(maxfd == -1)
-      Sleep(100);
-    else
-#endif
-    rc = select(maxfd + 1, &fdread, &fdwrite, &fdexcept, &timeout);
-    if(rc == -1) {
-      fprintf(stderr, "Select error\n");
-      break;
-    }
-  }
-
-  if(mres != CURLM_OK)
-    for(;;) {
-      msg = curl_multi_info_read(multi, &msgs_left);
-      if(!msg)
+      FD_ZERO(&fdread);
+      FD_ZERO(&fdwrite);
+      FD_ZERO(&fdexcept);
+      timeout.tv_sec = 0;
+      timeout.tv_usec = 1000000 * PAUSE_TIME / 10;
+      mresult = curl_multi_fdset(multi, &fdread, &fdwrite, &fdexcept, &maxfd);
+      if(mresult)
+        break;
+#ifdef _WIN32
+      if(maxfd == -1)
+        curlx_wait_ms(100);
+      else
+#endif
+      rc = select(maxfd + 1, &fdread, &fdwrite, &fdexcept, &timeout);
+      if(rc == -1) {
+        curl_mfprintf(stderr, "Select error\n");
         break;
-      if(msg->msg == CURLMSG_DONE) {
-        result = msg->data.result;
-        res = (int) result;
       }
     }
 
-  curl_multi_remove_handle(multi, pooh.easy);
-  curl_multi_cleanup(multi);
-
-#else
-  /* Use the easy interface. */
-  test_setopt(pooh.easy, CURLOPT_XFERINFODATA, &pooh);
-  test_setopt(pooh.easy, CURLOPT_XFERINFOFUNCTION, xferinfo);
-  test_setopt(pooh.easy, CURLOPT_NOPROGRESS, 0L);
-  result = curl_easy_perform(pooh.easy);
-  res = (int) result;
-#endif
+    if(mresult != CURLM_OK)
+      for(;;) {
+        int msgs_left;
+        CURLMsg *msg;
+        msg = curl_multi_info_read(multi, &msgs_left);
+        if(!msg)
+          break;
+        if(msg->msg == CURLMSG_DONE) {
+          result = msg->data.result;
+        }
+      }
 
+    curl_multi_remove_handle(multi, pooh.curl);
+    curl_multi_cleanup(multi);
+  }
+  else {
+    /* Use the easy interface. */
+    easy_setopt(pooh.curl, CURLOPT_XFERINFODATA, &pooh);
+    easy_setopt(pooh.curl, CURLOPT_XFERINFOFUNCTION, t670_xferinfo);
+    easy_setopt(pooh.curl, CURLOPT_NOPROGRESS, 0L);
+    result = curl_easy_perform(pooh.curl);
+  }
 
 test_cleanup:
-  curl_easy_cleanup(pooh.easy);
-#if defined(LIB670) || defined(LIB671)
-  curl_mime_free(mime);
-#else
-  curl_formfree(formpost);
-#endif
+  curl_easy_cleanup(pooh.curl);
+
+  if(testnum == 670 || testnum == 671) {
+    curl_mime_free(mime);
+  }
+  else {
+    curl_formfree(formpost);
+  }
 
   curl_global_cleanup();
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib674.c b/third-party/curl/tests/libtest/lib674.c
index 1a01d9c187..761ee3e16f 100644
--- a/third-party/curl/tests/libtest/lib674.c
+++ b/third-party/curl/tests/libtest/lib674.c
@@ -21,64 +21,60 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
+#include "first.h"
 
 /*
  * Get a single URL without select().
  */
 
-int test(char *URL)
+static CURLcode test_lib674(const char *URL)
 {
-  CURL *handle = NULL;
-  CURL *handle2;
-  CURLcode res = CURLE_OK;
+  CURL *curl = NULL;
+  CURL *curl2;
+  CURLcode result = CURLE_OK;
   CURLU *urlp = NULL;
   CURLUcode uc = CURLUE_OK;
 
   global_init(CURL_GLOBAL_ALL);
-  easy_init(handle);
+  easy_init(curl);
 
   urlp = curl_url();
 
   if(!urlp) {
-    fprintf(stderr, "problem init URL api.");
+    curl_mfprintf(stderr, "problem init URL api.");
     goto test_cleanup;
   }
 
   uc = curl_url_set(urlp, CURLUPART_URL, URL, 0);
   if(uc) {
-    fprintf(stderr, "problem setting CURLUPART_URL: %s.",
-            curl_url_strerror(uc));
+    curl_mfprintf(stderr, "problem setting CURLUPART_URL: %s.",
+                  curl_url_strerror(uc));
     goto test_cleanup;
   }
 
   /* demonstrate override behavior */
 
+  easy_setopt(curl, CURLOPT_CURLU, urlp);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  easy_setopt(handle, CURLOPT_CURLU, urlp);
-  easy_setopt(handle, CURLOPT_VERBOSE, 1L);
+  result = curl_easy_perform(curl);
 
-  res = curl_easy_perform(handle);
-
-  if(res) {
-    fprintf(stderr, "%s:%d curl_easy_perform() failed with code %d (%s)\n",
-            __FILE__, __LINE__, res, curl_easy_strerror(res));
+  if(result) {
+    curl_mfprintf(stderr, "%s:%d curl_easy_perform() failed "
+                  "with code %d (%s)\n",
+                  __FILE__, __LINE__, (int)result, curl_easy_strerror(result));
     goto test_cleanup;
   }
 
-  handle2 = curl_easy_duphandle(handle);
-  res = curl_easy_perform(handle2);
-  curl_easy_cleanup(handle2);
+  curl2 = curl_easy_duphandle(curl);
+  result = curl_easy_perform(curl2);
+  curl_easy_cleanup(curl2);
 
 test_cleanup:
 
   curl_url_cleanup(urlp);
-  curl_easy_cleanup(handle);
+  curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib676.c b/third-party/curl/tests/libtest/lib676.c
index 478d5f3a1e..e08f2d4b12 100644
--- a/third-party/curl/tests/libtest/lib676.c
+++ b/third-party/curl/tests/libtest/lib676.c
@@ -21,50 +21,48 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "memdebug.h"
-
-int test(char *URL)
+static CURLcode test_lib676(const char *URL)
 {
-  CURLcode res;
+  CURLcode result;
   CURL *curl;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     curl_global_cleanup();
     return TEST_ERR_MAJOR_BAD;
   }
 
-  test_setopt(curl, CURLOPT_URL, URL);
-  test_setopt(curl, CURLOPT_HEADER, 1L);
-  test_setopt(curl, CURLOPT_USERAGENT, "the-moo agent next generation");
-  test_setopt(curl, CURLOPT_COOKIEFILE, libtest_arg2);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_USERAGENT, "the-moo agent next generation");
+  easy_setopt(curl, CURLOPT_COOKIEFILE, libtest_arg2);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
 
-  res = curl_easy_perform(curl);
-  if(res) {
-    fprintf(stderr, "retrieve 1 failed\n");
+  result = curl_easy_perform(curl);
+  if(result) {
+    curl_mfprintf(stderr, "retrieve 1 failed\n");
     goto test_cleanup;
   }
 
   /* now clear the cookies */
-  test_setopt(curl, CURLOPT_COOKIEFILE, NULL);
+  easy_setopt(curl, CURLOPT_COOKIEFILE, NULL);
 
-  res = curl_easy_perform(curl);
-  if(res)
-    fprintf(stderr, "retrieve 2 failed\n");
+  result = curl_easy_perform(curl);
+  if(result)
+    curl_mfprintf(stderr, "retrieve 2 failed\n");
 
 test_cleanup:
 
   curl_easy_cleanup(curl);
   curl_global_cleanup();
 
-  return (int)res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib677.c b/third-party/curl/tests/libtest/lib677.c
index b4ca93e1af..106fbb2603 100644
--- a/third-party/curl/tests/libtest/lib677.c
+++ b/third-party/curl/tests/libtest/lib677.c
@@ -21,17 +21,12 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
+#include "first.h"
 
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-static const char cmd[] = "A1 IDLE\r\n";
-static char buf[1024];
-
-int test(char *URL)
+static CURLcode test_lib677(const char *URL)
 {
+  static const char testcmd[] = "A1 IDLE\r\n";
+  static char testbuf[1024];
   CURLM *mcurl;
   CURL *curl = NULL;
   int mrun;
@@ -39,27 +34,22 @@ int test(char *URL)
   time_t start = time(NULL);
   int state = 0;
   ssize_t pos = 0;
+  CURLcode result = CURLE_OK;
 
-  curl_global_init(CURL_GLOBAL_DEFAULT);
-  mcurl = curl_multi_init();
-  if(!mcurl)
-    goto fail;
-  curl = curl_easy_init();
-  if(!curl)
-    goto fail;
+  global_init(CURL_GLOBAL_DEFAULT);
+  multi_init(mcurl);
+  easy_init(curl);
 
-  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
-  if(curl_easy_setopt(curl, CURLOPT_URL, URL))
-    goto fail;
-  curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
   if(curl_multi_add_handle(mcurl, curl))
-    goto fail;
+    goto test_cleanup;
 
   while(time(NULL) - start < 5) {
     struct curl_waitfd waitfd;
 
-    if(curl_multi_perform(mcurl, &mrun))
-      goto fail;
+    multi_perform(mcurl, &mrun);
     for(;;) {
       int i;
       struct CURLMsg *m = curl_multi_info_read(mcurl, &i);
@@ -69,8 +59,8 @@ int test(char *URL)
       if(m->msg == CURLMSG_DONE && m->easy_handle == curl) {
         curl_easy_getinfo(curl, CURLINFO_ACTIVESOCKET, &sock);
         if(sock == CURL_SOCKET_BAD)
-          goto fail;
-        printf("Connected fine, extracted socket. Moving on\n");
+          goto test_cleanup;
+        curl_mprintf("Connected fine, extracted socket. Moving on\n");
       }
     }
 
@@ -80,24 +70,45 @@ int test(char *URL)
       curl_easy_getinfo(curl, CURLINFO_ACTIVESOCKET, &sock);
       waitfd.fd = sock;
     }
-    curl_multi_wait(mcurl, &waitfd, sock == CURL_SOCKET_BAD ? 0 : 1, 500,
+    curl_multi_wait(mcurl, &waitfd, sock == CURL_SOCKET_BAD ? 0 : 1, 50,
                     &mrun);
     if((sock != CURL_SOCKET_BAD) && (waitfd.revents & waitfd.events)) {
       size_t len = 0;
 
       if(!state) {
-        curl_easy_send(curl, cmd + pos, sizeof(cmd) - 1 - pos, &len);
+        CURLcode ec;
+        ec = curl_easy_send(curl, testcmd + pos,
+                            sizeof(testcmd) - 1 - pos, &len);
+        if(ec == CURLE_AGAIN) {
+          continue;
+        }
+        else if(ec) {
+          curl_mfprintf(stderr, "curl_easy_send() failed, with code %d (%s)\n",
+                        (int)ec, curl_easy_strerror(ec));
+          result = ec;
+          goto test_cleanup;
+        }
         if(len > 0)
           pos += len;
         else
           pos = 0;
-        if(pos == sizeof(cmd) - 1) {
+        if(pos == sizeof(testcmd) - 1) {
           state++;
           pos = 0;
         }
       }
-      else if(pos < (ssize_t)sizeof(buf)) {
-        curl_easy_recv(curl, buf + pos, sizeof(buf) - pos, &len);
+      else if(pos < (ssize_t)sizeof(testbuf)) {
+        CURLcode ec;
+        ec = curl_easy_recv(curl, testbuf + pos, sizeof(testbuf) - pos, &len);
+        if(ec == CURLE_AGAIN) {
+          continue;
+        }
+        else if(ec) {
+          curl_mfprintf(stderr, "curl_easy_recv() failed, with code %d (%s)\n",
+                        (int)ec, curl_easy_strerror(ec));
+          result = ec;
+          goto test_cleanup;
+        }
         if(len > 0)
           pos += len;
       }
@@ -107,15 +118,15 @@ int test(char *URL)
   }
 
   if(state) {
-    fwrite(buf, pos, 1, stdout);
+    fwrite(testbuf, pos, 1, stdout);
     putchar('\n');
   }
 
   curl_multi_remove_handle(mcurl, curl);
-fail:
+test_cleanup:
   curl_easy_cleanup(curl);
   curl_multi_cleanup(mcurl);
 
   curl_global_cleanup();
-  return 0;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib678.c b/third-party/curl/tests/libtest/lib678.c
index 942808e2a6..90295f42a8 100644
--- a/third-party/curl/tests/libtest/lib678.c
+++ b/third-party/curl/tests/libtest/lib678.c
@@ -21,18 +21,14 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "test.h"
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
+#include "first.h"
 
 static int loadfile(const char *filename, void **filedata, size_t *filesize)
 {
   size_t datasize = 0;
   void *data = NULL;
   if(filename) {
-    FILE *fInCert = fopen(filename, "rb");
+    FILE *fInCert = curlx_fopen(filename, "rb");
 
     if(fInCert) {
       long cert_tell = 0;
@@ -46,26 +42,24 @@ static int loadfile(const char *filename, void **filedata, size_t *filesize)
       if(continue_reading)
         continue_reading = fseek(fInCert, 0, SEEK_SET) == 0;
       if(continue_reading)
-        data = malloc(datasize + 1);
-      if((!data) ||
-         ((int)fread(data, datasize, 1, fInCert) != 1))
+        data = curlx_malloc(datasize + 1);
+      if(!data || ((int)fread(data, datasize, 1, fInCert) != 1))
         continue_reading = FALSE;
-      fclose(fInCert);
+      curlx_fclose(fInCert);
       if(!continue_reading) {
-        free(data);
+        curlx_safefree(data);
         datasize = 0;
-        data = NULL;
       }
-   }
+    }
   }
   *filesize = datasize;
   *filedata = data;
   return data ? 1 : 0;
 }
 
-static int test_cert_blob(const char *url, const char *cafile)
+static CURLcode test_cert_blob(const char *url, const char *cafile)
 {
-  CURLcode code = CURLE_OUT_OF_MEMORY;
+  CURLcode result = CURLE_OUT_OF_MEMORY;
   CURL *curl;
   struct curl_blob blob;
   size_t certsize;
@@ -73,50 +67,48 @@ static int test_cert_blob(const char *url, const char *cafile)
 
   curl = curl_easy_init();
   if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
     return CURLE_FAILED_INIT;
   }
 
   if(loadfile(cafile, &certdata, &certsize)) {
-    curl_easy_setopt(curl, CURLOPT_VERBOSE,     1L);
-    curl_easy_setopt(curl, CURLOPT_HEADER,      1L);
-    curl_easy_setopt(curl, CURLOPT_URL,         url);
-    curl_easy_setopt(curl, CURLOPT_USERAGENT,   "CURLOPT_CAINFO_BLOB");
-    curl_easy_setopt(curl, CURLOPT_SSL_OPTIONS,
-                     CURLSSLOPT_REVOKE_BEST_EFFORT);
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+    curl_easy_setopt(curl, CURLOPT_HEADER, 1L);
+    curl_easy_setopt(curl, CURLOPT_URL, url);
+    curl_easy_setopt(curl, CURLOPT_USERAGENT, "CURLOPT_CAINFO_BLOB");
+    curl_easy_setopt(curl, CURLOPT_SSL_OPTIONS, CURLSSLOPT_REVOKE_BEST_EFFORT);
 
     blob.data = certdata;
     blob.len = certsize;
     blob.flags = CURL_BLOB_COPY;
     curl_easy_setopt(curl, CURLOPT_CAINFO_BLOB, &blob);
-    free(certdata);
-    code = curl_easy_perform(curl);
+    curlx_free(certdata);
+    result = curl_easy_perform(curl);
   }
   curl_easy_cleanup(curl);
 
-  return (int)code;
+  return result;
 }
 
-int test(char *URL)
+static CURLcode test_lib678(const char *URL)
 {
-  int res = 0;
+  CURLcode result = CURLE_OK;
   curl_global_init(CURL_GLOBAL_DEFAULT);
   if(!strcmp("check", URL)) {
-    CURL *e;
     CURLcode w = CURLE_OK;
-    struct curl_blob blob = {0};
-    e = curl_easy_init();
-    if(e) {
-      w = curl_easy_setopt(e, CURLOPT_CAINFO_BLOB, &blob);
+    struct curl_blob blob = { CURL_UNCONST("silly"), 5, 0 };
+    CURL *curl = curl_easy_init();
+    if(curl) {
+      w = curl_easy_setopt(curl, CURLOPT_CAINFO_BLOB, &blob);
       if(w)
-        printf("CURLOPT_CAINFO_BLOB is not supported\n");
-      curl_easy_cleanup(e);
+        curl_mprintf("CURLOPT_CAINFO_BLOB is not supported\n");
+      curl_easy_cleanup(curl);
     }
-    res = (int)w;
+    result = w;
   }
   else
-    res = test_cert_blob(URL, libtest_arg2);
+    result = test_cert_blob(URL, libtest_arg2);
 
   curl_global_cleanup();
-  return res;
+  return result;
 }
diff --git a/third-party/curl/tests/libtest/lib694.c b/third-party/curl/tests/libtest/lib694.c
new file mode 100644
index 0000000000..1b2c6e2d8b
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib694.c
@@ -0,0 +1,75 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static CURLcode test_lib694(const char *URL)
+{
+  CURLcode result;
+  CURL *curl;
+  long usedauth = 0;
+  int count = 0;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_HEADER, 1L);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_HTTPAUTH,
+              CURLAUTH_BASIC | CURLAUTH_DIGEST | CURLAUTH_NTLM);
+  easy_setopt(curl, CURLOPT_USERPWD, "me:password");
+
+  do {
+
+    result = curl_easy_perform(curl);
+    if(result)
+      goto test_cleanup;
+
+    result = curl_easy_getinfo(curl, CURLINFO_HTTPAUTH_USED, &usedauth);
+    if(result)
+      goto test_cleanup;
+    if(CURLAUTH_NTLM != usedauth) {
+      curl_mprintf("CURLINFO_HTTPAUTH_USED did not say NTLM\n");
+    }
+
+    /* set a new URL for the second, so that we do not restart NTLM */
+    easy_setopt(curl, CURLOPT_URL, libtest_arg2);
+  } while(!result && ++count < 2);
+
+test_cleanup:
+
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib695.c b/third-party/curl/tests/libtest/lib695.c
new file mode 100644
index 0000000000..de8986d888
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib695.c
@@ -0,0 +1,104 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static CURLcode test_lib695(const char *URL)
+{
+  CURL *curl = NULL;
+  curl_mime *mime1 = NULL;
+  curl_mime *mime2 = NULL;
+  curl_mimepart *part;
+  CURLcode result = TEST_ERR_FAILURE;
+
+  /*
+   * Check proper rewind when reusing a mime structure.
+   */
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  curl = curl_easy_init();
+
+  /* First set the URL that is about to receive our POST. */
+  easy_setopt(curl, CURLOPT_URL, URL);
+
+  /* get verbose debug output please */
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+  /* Do not write anything. */
+  curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, tutil_throwaway_cb);
+
+  /* Build the first mime structure. */
+  mime1 = curl_mime_init(curl);
+  part = curl_mime_addpart(mime1);
+  curl_mime_data(part, "<title>hello</title>", CURL_ZERO_TERMINATED);
+  curl_mime_type(part, "text/html");
+  curl_mime_name(part, "data");
+
+  /* Use first mime structure as top level MIME POST. */
+  curl_easy_setopt(curl, CURLOPT_MIMEPOST, mime1);
+
+  /* Perform the request, result gets the return code */
+  result = curl_easy_perform(curl);
+
+  /* Check for errors */
+  if(result != CURLE_OK)
+    curl_mfprintf(stderr, "curl_easy_perform() 1 failed: %s\n",
+                  curl_easy_strerror(result));
+  else {
+    /* phase two, create a mime struct using the mime1 handle */
+    mime2 = curl_mime_init(curl);
+    part = curl_mime_addpart(mime2);
+
+    /* use the new mime setup */
+    curl_easy_setopt(curl, CURLOPT_MIMEPOST, mime2);
+
+    /* Reuse previous mime structure as a child. */
+    result = curl_mime_subparts(part, mime1);
+
+    if(result != CURLE_OK)
+      curl_mfprintf(stderr, "curl_mime_subparts() failed: %s\n",
+                    curl_easy_strerror(result));
+    else {
+      mime1 = NULL;
+
+      /* Perform the request, result gets the return code */
+      result = curl_easy_perform(curl);
+
+      /* Check for errors */
+      if(result != CURLE_OK)
+        curl_mfprintf(stderr, "curl_easy_perform() 2 failed: %s\n",
+                      curl_easy_strerror(result));
+    }
+  }
+
+test_cleanup:
+  curl_easy_cleanup(curl);
+  curl_mime_free(mime1);
+  curl_mime_free(mime2);
+  curl_global_cleanup();
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib751.c b/third-party/curl/tests/libtest/lib751.c
new file mode 100644
index 0000000000..cc14014416
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib751.c
@@ -0,0 +1,86 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+/*
+ * Get a single URL without select().
+ */
+
+static CURLcode test_lib751(const char *URL)
+{
+  CURL *curls[1000];
+  CURLM *multi;
+  CURLcode result = CURLE_FAILED_INIT;
+  CURLMcode mresult;
+  int i;
+
+  (void)URL;
+  memset(curls, 0, sizeof(curls));
+
+  curl_global_init(CURL_GLOBAL_DEFAULT);
+  multi = curl_multi_init();
+  if(!multi) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto test_cleanup;
+  }
+
+  for(i = 0; i < 1000; i++) {
+    CURL *curl = curl_easy_init();
+    if(!curl) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto test_cleanup;
+    }
+    curls[i] = curl;
+
+    result = curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");
+    if(!result)
+      result = curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+    if(result)
+      goto test_cleanup;
+
+    mresult = curl_multi_add_handle(multi, curl);
+    if(mresult != CURLM_OK) {
+      curl_mfprintf(stderr, "MULTI ERROR: %s\n", curl_multi_strerror(mresult));
+      result = CURLE_FAILED_INIT;
+      goto test_cleanup;
+    }
+  }
+
+test_cleanup:
+
+  if(result)
+    curl_mfprintf(stderr, "ERROR: %s\n", curl_easy_strerror(result));
+
+  for(i = 0; i < 1000; i++) {
+    if(curls[i]) {
+      curl_multi_add_handle(multi, curls[i]);
+      curl_easy_cleanup(curls[i]);
+      curls[i] = NULL;
+    }
+  }
+  curl_multi_cleanup(multi);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib753.c b/third-party/curl/tests/libtest/lib753.c
new file mode 100644
index 0000000000..6260afb6bc
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib753.c
@@ -0,0 +1,183 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#include "testtrace.h"
+
+struct t753_transfer_status {
+  CURL *curl;
+  const char *name;
+  bool pause;
+  bool is_paused;
+  bool seen_welcome;
+};
+
+static size_t t753_write_cb(char *ptr, size_t size, size_t nmemb, void *userp)
+{
+  struct t753_transfer_status *st = userp;
+  size_t len = size * nmemb;
+  (void)ptr;
+  if(st->pause) {
+    curl_mfprintf(stderr, "[%s] write_cb(len=%zu), PAUSE\n", st->name, len);
+    st->is_paused = TRUE;
+    return CURL_READFUNC_PAUSE;
+  }
+  curl_mfprintf(stderr, "[%s] write_cb(len=%zu), CONSUME\n", st->name, len);
+  st->is_paused = FALSE;
+  return len;
+}
+
+static size_t t753_hd_cb(char *ptr, size_t size, size_t nmemb, void *userp)
+{
+  struct t753_transfer_status *st = userp;
+  size_t len = size * nmemb;
+  curl_mfprintf(stderr, "[%s] hd_cb '%.*s'\n", st->name, (int)len, ptr);
+  if(!strcmp("230 Welcome you silly person\r\n", ptr)) {
+    st->seen_welcome = TRUE;
+    st->curl = NULL;
+  }
+  return len;
+}
+
+static bool t753_setup(const char *URL, const char *name,
+                       CURL **pcurl,
+                       struct t753_transfer_status *st)
+{
+  CURL *curl = NULL;
+  CURLcode result = CURLE_OK;
+
+  *pcurl = NULL;
+  memset(st, 0, sizeof(*st));
+  st->name = name;
+  st->curl = curl;
+  st->pause = TRUE;
+
+  easy_init(curl);
+
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_WRITEFUNCTION, t753_write_cb);
+  easy_setopt(curl, CURLOPT_WRITEDATA, st);
+  easy_setopt(curl, CURLOPT_HEADERFUNCTION, t753_hd_cb);
+  easy_setopt(curl, CURLOPT_HEADERDATA, st);
+
+  easy_setopt(curl, CURLOPT_NOPROGRESS, 1L);
+  easy_setopt(curl, CURLOPT_DEBUGDATA, &debug_config);
+  easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+  *pcurl = curl;
+  return TRUE;
+
+test_cleanup:
+  if(curl)
+    curl_easy_cleanup(curl);
+  return FALSE;
+}
+
+static CURLcode test_lib753(const char *URL)
+{
+  CURL *curl1 = NULL, *curl2 = NULL;
+  CURLM *multi = NULL;
+  struct t753_transfer_status st1, st2;
+  CURLcode result = CURLE_OK;
+  CURLMcode mresult;
+  int still_running;
+
+  start_test_timing();
+
+  debug_config.nohex = TRUE;
+  debug_config.tracetime = TRUE;
+
+  curl_global_init(CURL_GLOBAL_DEFAULT);
+
+  curl_mfprintf(stderr, "init multi\n");
+  multi = curl_multi_init();
+  if(!multi) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto test_cleanup;
+  }
+
+  if(!t753_setup(URL, "EASY1", &curl1, &st1))
+    goto test_cleanup;
+
+  multi_add_handle(multi, curl1);
+
+  multi_perform(multi, &still_running);
+  abort_on_test_timeout();
+  curl_mfprintf(stderr, "multi_perform() -> %d running\n", still_running);
+
+  while(still_running) {
+    int num;
+
+    /* The purpose of this Test:
+     * 1. Violently cleanup EASY1 *without* removing it from the multi
+     *    handle first. This MUST discard the connection that EASY1 holds,
+     *    as EASY1 is not DONE at this point.
+     *    With the env var CURL_FTP_PWD_STOP set, the connection has
+     *    no outstanding data at this point. This would allow
+     *    reuse if the connection is not terminated by the cleanup.
+     * 2. Add EASY2 for the same URL and observe in the expected result
+     *    that the connection is NOT reused, e.g. all FTP commands
+     *    are sent again on the new connection.
+     */
+    if(curl1 && st1.seen_welcome) {
+      curl_easy_cleanup(curl1);
+      curl1 = NULL;
+      if(!curl2) {
+        if(!t753_setup(URL, "EASY2", &curl2, &st2))
+          goto test_cleanup;
+        st2.pause = FALSE;
+        multi_add_handle(multi, curl2);
+      }
+    }
+
+    mresult = curl_multi_wait(multi, NULL, 0, 1, &num);
+    if(mresult != CURLM_OK) {
+      curl_mfprintf(stderr, "curl_multi_wait() returned %d\n", mresult);
+      result = TEST_ERR_MAJOR_BAD;
+      goto test_cleanup;
+    }
+
+    abort_on_test_timeout();
+
+    multi_perform(multi, &still_running);
+    curl_mfprintf(stderr, "multi_perform() -> %d running\n", still_running);
+
+    abort_on_test_timeout();
+  }
+
+test_cleanup:
+
+  if(result)
+    curl_mfprintf(stderr, "ERROR: %s\n", curl_easy_strerror(result));
+
+  if(curl1)
+    curl_easy_cleanup(curl1);
+  if(curl2)
+    curl_easy_cleanup(curl2);
+  curl_multi_cleanup(multi);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib757.c b/third-party/curl/tests/libtest/lib757.c
new file mode 100644
index 0000000000..325f3b7b6b
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib757.c
@@ -0,0 +1,125 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+static const char t757_data[] = "<title>fun-times</title>";
+static size_t const t757_datalen = sizeof(t757_data) - 1;
+
+static size_t read_757(char *buffer, size_t size, size_t nitems, void *arg)
+{
+  (void)arg;
+  if((size * nitems) >= t757_datalen) {
+    memcpy(buffer, t757_data, t757_datalen);
+    return t757_datalen;
+  }
+  return 0;
+}
+
+static int seek_757(void *arg, curl_off_t offset, int origin)
+{
+  (void)arg;
+  (void)offset;
+  (void)origin;
+  return CURL_SEEKFUNC_OK;
+}
+
+static CURLcode test_lib757(const char *URL)
+{
+  CURL *curl = NULL;
+  curl_mime *mime1 = NULL;
+  curl_mime *mime2 = NULL;
+  curl_mimepart *part;
+  CURLcode result = TEST_ERR_FAILURE;
+
+  /*
+   * Check proper rewind when reusing a mime structure.
+   */
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  curl = curl_easy_init();
+
+  /* First set the URL that is about to receive our POST. */
+  easy_setopt(curl, CURLOPT_URL, URL);
+
+  /* get verbose debug output please */
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+  /* Do not write anything. */
+  curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, tutil_throwaway_cb);
+
+  /* Build the first mime structure. */
+  mime1 = curl_mime_init(curl);
+  part = curl_mime_addpart(mime1);
+  curl_mime_data_cb(part, t757_datalen, read_757, seek_757, NULL, NULL);
+  curl_mime_type(part, "text/html");
+  curl_mime_name(part, "data");
+
+  /* Use first mime structure as top level MIME POST. */
+  curl_easy_setopt(curl, CURLOPT_MIMEPOST, mime1);
+
+  /* Perform the request, result gets the return code */
+  result = curl_easy_perform(curl);
+
+  /* Check for errors */
+  if(result != CURLE_OK)
+    curl_mfprintf(stderr, "curl_easy_perform() 1 failed: %s\n",
+                  curl_easy_strerror(result));
+  else {
+    /* phase two, create a mime struct using the mime1 handle */
+    mime2 = curl_mime_init(curl);
+    part = curl_mime_addpart(mime2);
+
+    /* use the new mime setup */
+    curl_easy_setopt(curl, CURLOPT_MIMEPOST, mime2);
+
+    /* Reuse previous mime structure as a child. */
+    result = curl_mime_subparts(part, mime1);
+
+    if(result != CURLE_OK)
+      curl_mfprintf(stderr, "curl_mime_subparts() failed: %s\n",
+                    curl_easy_strerror(result));
+    else {
+      mime1 = NULL;
+
+      /* Perform the request, result gets the return code */
+      result = curl_easy_perform(curl);
+
+      /* Check for errors */
+      if(result != CURLE_OK)
+        curl_mfprintf(stderr, "curl_easy_perform() 2 failed: %s\n",
+                      curl_easy_strerror(result));
+    }
+  }
+
+test_cleanup:
+  curl_easy_cleanup(curl);
+  curl_mime_free(mime1);
+  curl_mime_free(mime2);
+  curl_global_cleanup();
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/lib758.c b/third-party/curl/tests/libtest/lib758.c
new file mode 100644
index 0000000000..2fa8ef3ab1
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib758.c
@@ -0,0 +1,505 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+/*
+ * The purpose of this test is to make sure that if CURLMOPT_SOCKETFUNCTION or
+ * CURLMOPT_TIMERFUNCTION returns error, the associated transfer should be
+ * aborted correctly.
+ */
+
+#include "first.h"
+
+#ifdef USE_OPENSSL
+
+#include <openssl/ssl.h>
+
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#define T578_ENABLED
+#endif
+#endif
+
+#ifdef T578_ENABLED
+
+#include "testtrace.h"
+
+static struct t758_ctx {
+  int socket_calls;
+  int max_socket_calls;
+  int timer_calls;
+  int max_timer_calls;
+  int fake_async_cert_verification_pending;
+  int fake_async_cert_verification_finished;
+  int number_of_cert_verify_callbacks;
+  char buf[1024];
+} t758_ctx;
+
+static const char *t758_tag(void)
+{
+  curl_msnprintf(t758_ctx.buf, sizeof(t758_ctx.buf), "[T758-%d-%d] [%d/%d]",
+                 t758_ctx.max_socket_calls, t758_ctx.max_timer_calls,
+                 t758_ctx.socket_calls, t758_ctx.timer_calls);
+  return t758_ctx.buf;
+}
+
+static void t758_msg(const char *msg)
+{
+  curl_mfprintf(stderr, "%s %s\n", t758_tag(), msg);
+}
+
+struct t758_Sockets {
+  curl_socket_t *sockets;
+  int count;      /* number of sockets actually stored in array */
+  int max_count;  /* max number of sockets that fit in allocated array */
+};
+
+struct t758_ReadWriteSockets {
+  struct t758_Sockets read, write;
+};
+
+/**
+ * Remove a file descriptor from a sockets array.
+ */
+static void t758_removeFd(struct t758_Sockets *sockets, curl_socket_t fd,
+                          int mention)
+{
+  int i;
+
+  if(mention)
+    curl_mfprintf(stderr, "%s remove socket fd %" FMT_SOCKET_T "\n",
+                  t758_tag(), fd);
+
+  for(i = 0; i < sockets->count; ++i) {
+    if(sockets->sockets[i] == fd) {
+      if(i < sockets->count - 1)
+        memmove(&sockets->sockets[i], &sockets->sockets[i + 1],
+                sizeof(curl_socket_t) * (sockets->count - (i + 1)));
+      --sockets->count;
+    }
+  }
+}
+
+/**
+ * Add a file descriptor to a sockets array.
+ * Return 0 on success, 1 on error.
+ */
+static int t758_addFd(struct t758_Sockets *sockets, curl_socket_t fd,
+                      const char *what)
+{
+  /**
+   * To ensure we only have each file descriptor once, we remove it then add
+   * it again.
+   */
+  curl_mfprintf(stderr, "%s add socket fd %" FMT_SOCKET_T " for %s\n",
+                t758_tag(), fd, what);
+  t758_removeFd(sockets, fd, 0);
+  /*
+   * Allocate array storage when required.
+   */
+  if(!sockets->sockets) {
+    sockets->sockets = curlx_malloc(sizeof(curl_socket_t) * 20U);
+    if(!sockets->sockets)
+      return 1;
+    sockets->max_count = 20;
+  }
+  else if(sockets->count + 1 > sockets->max_count) {
+    curl_socket_t *ptr = curlx_realloc(sockets->sockets,
+                                       sizeof(curl_socket_t) *
+                                       (sockets->max_count + 20));
+    if(!ptr)
+      /* cleanup in test_cleanup */
+      return 1;
+    sockets->sockets = ptr;
+    sockets->max_count += 20;
+  }
+  /*
+   * Add file descriptor to array.
+   */
+  sockets->sockets[sockets->count] = fd;
+  ++sockets->count;
+  return 0;
+}
+
+/**
+ * Callback invoked by curl to poll reading / writing of a socket.
+ */
+static int t758_curlSocketCallback(CURL *curl, curl_socket_t s, int action,
+                                   void *userp, void *socketp)
+{
+  struct t758_ReadWriteSockets *sockets = userp;
+
+  (void)curl;
+  (void)socketp;
+
+  t758_ctx.socket_calls++;
+  t758_msg("-> CURLMOPT_SOCKETFUNCTION");
+  if(t758_ctx.socket_calls == t758_ctx.max_socket_calls) {
+    t758_msg("<- CURLMOPT_SOCKETFUNCTION returns error");
+    return -1;
+  }
+
+  if(action == CURL_POLL_IN || action == CURL_POLL_INOUT)
+    if(t758_addFd(&sockets->read, s, "read"))
+      return -1; /* bail out */
+
+  if(action == CURL_POLL_OUT || action == CURL_POLL_INOUT)
+    if(t758_addFd(&sockets->write, s, "write"))
+      return -1;
+
+  if(action == CURL_POLL_REMOVE) {
+    t758_removeFd(&sockets->read, s, 1);
+    t758_removeFd(&sockets->write, s, 0);
+  }
+
+  return 0;
+}
+
+/**
+ * Callback invoked by curl to set a timeout.
+ */
+static int t758_curlTimerCallback(CURLM *multi, long timeout_ms, void *userp)
+{
+  struct curltime *timeout = userp;
+
+  (void)multi;
+  t758_ctx.timer_calls++;
+  t758_msg("-> CURLMOPT_TIMERFUNCTION");
+  if(t758_ctx.timer_calls == t758_ctx.max_timer_calls) {
+    t758_msg("<- CURLMOPT_TIMERFUNCTION returns error");
+    return -1;
+  }
+  if(timeout_ms != -1) {
+    *timeout = curlx_now();
+    timeout->tv_usec += (int)timeout_ms * 1000;
+  }
+  else {
+    timeout->tv_sec = -1;
+  }
+  return 0;
+}
+
+static int t758_cert_verify_callback(X509_STORE_CTX *ctx, void *arg)
+{
+  SSL *ssl;
+  (void)arg;
+  ssl = (SSL *)X509_STORE_CTX_get_ex_data(
+    ctx, SSL_get_ex_data_X509_STORE_CTX_idx());
+  t758_ctx.number_of_cert_verify_callbacks++;
+  if(!t758_ctx.fake_async_cert_verification_pending) {
+    t758_ctx.fake_async_cert_verification_pending = 1;
+    t758_msg("   initial t758_cert_verify_callback");
+    return SSL_set_retry_verify(ssl);
+  }
+  else if(t758_ctx.fake_async_cert_verification_finished) {
+    t758_msg("   final t758_cert_verify_callback");
+    return 1; /* success */
+  }
+  else {
+    t758_msg("   pending t758_cert_verify_callback");
+    return SSL_set_retry_verify(ssl);
+  }
+}
+
+static CURLcode t758_set_ssl_ctx_callback(CURL *curl, void *ssl_ctx,
+                                          void *clientp)
+{
+  SSL_CTX *ctx = (SSL_CTX *)ssl_ctx;
+  (void)curl;
+  SSL_CTX_set_cert_verify_callback(ctx, t758_cert_verify_callback, clientp);
+  return CURLE_OK;
+}
+
+/**
+ * Check for curl completion.
+ */
+static int t758_checkForCompletion(CURLM *multi, int *success)
+{
+  int result = 0;
+  *success = 0;
+  while(1) {
+    int numMessages;
+    CURLMsg *message = curl_multi_info_read(multi, &numMessages);
+    if(!message)
+      break;
+    if(message->msg == CURLMSG_DONE) {
+      result = 1;
+      if(message->data.result == CURLE_OK)
+        *success = 1;
+      else
+        *success = 0;
+    }
+    else {
+      curl_mfprintf(stderr, "%s got an unexpected message from curl: %d\n",
+                    t758_tag(), (int)message->msg);
+      result = 1;
+      *success = 0;
+    }
+  }
+  return result;
+}
+
+static ssize_t t758_getMicroSecondTimeout(struct curltime *timeout)
+{
+  struct curltime now;
+  ssize_t result;
+  now = curlx_now();
+  result = (ssize_t)(((timeout->tv_sec - now.tv_sec) * 1000000) +
+    timeout->tv_usec - now.tv_usec);
+  if(result < 0)
+    result = 0;
+
+  return result;
+}
+
+/**
+ * Update a fd_set with all of the sockets in use.
+ */
+static void t758_updateFdSet(struct t758_Sockets *sockets, fd_set *fdset,
+                             curl_socket_t *maxFd)
+{
+  int i;
+  for(i = 0; i < sockets->count; ++i) {
+    FD_SET(sockets->sockets[i], fdset);
+    if(*maxFd < sockets->sockets[i] + 1) {
+      *maxFd = sockets->sockets[i] + 1;
+    }
+  }
+}
+
+static CURLMcode t758_saction(CURLM *multi, curl_socket_t s,
+                              int evBitmask, const char *info)
+{
+  int numhandles = 0;
+  CURLMcode mresult = curl_multi_socket_action(multi, s, evBitmask,
+                                               &numhandles);
+  if(mresult != CURLM_OK) {
+    curl_mfprintf(stderr, "%s curl error on %s (%d) %s\n",
+                  t758_tag(), info, mresult, curl_multi_strerror(mresult));
+  }
+  return mresult;
+}
+
+/**
+ * Invoke curl when a file descriptor is set.
+ */
+static CURLMcode t758_checkFdSet(CURLM *multi, struct t758_Sockets *sockets,
+                                 fd_set *fdset, int evBitmask,
+                                 const char *name)
+{
+  int i;
+  CURLMcode mresult = CURLM_OK;
+  for(i = 0; i < sockets->count; ++i) {
+    if(FD_ISSET(sockets->sockets[i], fdset)) {
+      mresult = t758_saction(multi, sockets->sockets[i], evBitmask, name);
+      if(mresult)
+        break;
+    }
+  }
+  return mresult;
+}
+
+static CURLcode t758_one(const char *URL, int timer_fail_at,
+                         int socket_fail_at)
+{
+  CURLcode result = CURLE_OK;
+  CURL *curl = NULL;
+  CURLM *multi = NULL;
+  struct t758_ReadWriteSockets sockets = { { NULL, 0, 0 }, { NULL, 0, 0 } };
+  int success = 0;
+  struct curltime timeout = { 0 };
+  timeout.tv_sec = (time_t)-1;
+
+  /* set the limits */
+  memset(&t758_ctx, 0, sizeof(t758_ctx));
+  t758_ctx.max_timer_calls = timer_fail_at;
+  t758_ctx.max_socket_calls = socket_fail_at;
+
+  t758_msg("start");
+  start_test_timing();
+
+  if(curl_global_sslset(CURLSSLBACKEND_OPENSSL, NULL, NULL) != CURLSSLSET_OK) {
+    t758_msg("could not set OpenSSL as backend");
+    result = CURLE_FAILED_INIT;
+    return result;
+  }
+
+  res_global_init(CURL_GLOBAL_ALL);
+  if(result != CURLE_OK)
+    return result;
+
+  curl_global_trace("all");
+
+  easy_init(curl);
+  debug_config.nohex = TRUE;
+  debug_config.tracetime = TRUE;
+  easy_setopt(curl, CURLOPT_DEBUGDATA, &debug_config);
+  easy_setopt(curl, CURLOPT_DEBUGFUNCTION, libtest_debug_cb);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+  /* specify target */
+  easy_setopt(curl, CURLOPT_URL, URL);
+
+  /* go verbose */
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+  easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, t758_set_ssl_ctx_callback);
+
+  multi_init(multi);
+
+  multi_setopt(multi, CURLMOPT_SOCKETFUNCTION, t758_curlSocketCallback);
+  multi_setopt(multi, CURLMOPT_SOCKETDATA, &sockets);
+
+  multi_setopt(multi, CURLMOPT_TIMERFUNCTION, t758_curlTimerCallback);
+  multi_setopt(multi, CURLMOPT_TIMERDATA, &timeout);
+
+  multi_add_handle(multi, curl);
+
+  if(t758_saction(multi, CURL_SOCKET_TIMEOUT, 0, "timeout")) {
+    result = TEST_ERR_MAJOR_BAD;
+    goto test_cleanup;
+  }
+  while(!t758_checkForCompletion(multi, &success)) {
+    fd_set readSet, writeSet;
+    curl_socket_t maxFd = 0;
+    struct timeval tv = { 0 };
+    tv.tv_sec = 10;
+
+    if(t758_ctx.fake_async_cert_verification_pending &&
+       !t758_ctx.fake_async_cert_verification_finished) {
+      /* the wakeup socket is monitored */
+      if((sockets.read.count > 1) || sockets.write.count) {
+        t758_msg("during verification there should be no sockets scheduled");
+        result = TEST_ERR_MAJOR_BAD;
+        goto test_cleanup;
+      }
+      if(t758_ctx.number_of_cert_verify_callbacks != 1) {
+        t758_msg("expecting exactly one cert verify callback here");
+        result = TEST_ERR_MAJOR_BAD;
+        goto test_cleanup;
+      }
+      t758_ctx.fake_async_cert_verification_finished = 1;
+      if(t758_saction(multi, CURL_SOCKET_TIMEOUT, 0, "timeout")) {
+        t758_msg("spurious retry cert action");
+        result = TEST_ERR_MAJOR_BAD;
+        goto test_cleanup;
+      }
+      curl_easy_pause(curl, CURLPAUSE_CONT);
+      if(t758_saction(multi, CURL_SOCKET_TIMEOUT, 0, "timeout")) {
+        t758_msg("unblocking transfer after cert verification finished");
+        result = TEST_ERR_MAJOR_BAD;
+        goto test_cleanup;
+      }
+      if(t758_ctx.number_of_cert_verify_callbacks != 2) {
+        t758_msg("this should have triggered the callback again, right?");
+        result = TEST_ERR_MAJOR_BAD;
+        goto test_cleanup;
+      }
+      t758_msg("TEST: all fine?");
+    }
+    FD_ZERO(&readSet);
+    FD_ZERO(&writeSet);
+    t758_updateFdSet(&sockets.read, &readSet, &maxFd);
+    t758_updateFdSet(&sockets.write, &writeSet, &maxFd);
+
+    if(timeout.tv_sec != (time_t)-1) {
+      int usTimeout = curlx_sztosi(t758_getMicroSecondTimeout(&timeout));
+      tv.tv_sec = usTimeout / 1000000;
+      tv.tv_usec = usTimeout % 1000000;
+    }
+    else if(maxFd <= 0) {
+      tv.tv_sec = 0;
+      tv.tv_usec = 100000;
+    }
+
+    select_test((int)maxFd, &readSet, &writeSet, NULL, &tv);
+
+    /* Check the sockets for reading / writing */
+    if(t758_checkFdSet(multi, &sockets.read, &readSet, CURL_CSELECT_IN,
+                       "read")) {
+      result = TEST_ERR_MAJOR_BAD;
+      goto test_cleanup;
+    }
+    if(t758_checkFdSet(multi, &sockets.write, &writeSet, CURL_CSELECT_OUT,
+                       "write")) {
+      result = TEST_ERR_MAJOR_BAD;
+      goto test_cleanup;
+    }
+
+    if(timeout.tv_sec != (time_t)-1 &&
+       t758_getMicroSecondTimeout(&timeout) == 0) {
+      /* curl's timer has elapsed. */
+      if(t758_saction(multi, CURL_SOCKET_TIMEOUT, 0, "timeout")) {
+        result = TEST_ERR_BAD_TIMEOUT;
+        goto test_cleanup;
+      }
+    }
+
+    abort_on_test_timeout();
+  }
+  if(success && t758_ctx.number_of_cert_verify_callbacks != 2) {
+    t758_msg("unexpected invocations of cert verify callback");
+    result = TEST_ERR_MAJOR_BAD;
+    goto test_cleanup;
+  }
+
+  if(!success) {
+    t758_msg("Error getting file.");
+    result = TEST_ERR_MAJOR_BAD;
+  }
+
+test_cleanup:
+
+  /* proper cleanup sequence */
+  t758_msg("cleanup");
+  curl_multi_remove_handle(multi, curl);
+  curl_easy_cleanup(curl);
+  curl_multi_cleanup(multi);
+  curl_global_cleanup();
+
+  /* free local memory */
+  curlx_free(sockets.read.sockets);
+  curlx_free(sockets.write.sockets);
+  t758_msg("done");
+
+  return result;
+}
+
+static CURLcode test_lib758(const char *URL)
+{
+  CURLcode result;
+  /* rerun the same transfer multiple times and make it fail in different
+     callback calls */
+  result = t758_one(URL, 0, 0); /* no callback fails */
+  if(result)
+    curl_mfprintf(stderr, "%s FAILED: %d\n", t758_tag(), (int)result);
+
+  return result;
+}
+
+#else /* T578_ENABLED */
+static CURLcode test_lib758(const char *URL)
+{
+  (void)URL;
+  return CURLE_OK;
+}
+#endif
diff --git a/third-party/curl/tests/libtest/lib766.c b/third-party/curl/tests/libtest/lib766.c
new file mode 100644
index 0000000000..b3bf62ea52
--- /dev/null
+++ b/third-party/curl/tests/libtest/lib766.c
@@ -0,0 +1,64 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+#include "first.h"
+
+static int sockopt_766(void *clientp,
+                       curl_socket_t curlfd,
+                       curlsocktype purpose)
+{
+  (void)clientp;
+  (void)curlfd;
+  if(purpose == CURLSOCKTYPE_ACCEPT) {
+    curl_mfprintf(stderr,
+                  "Return error from CURLOPT_SOCKOPTFUNCTION callback\n");
+    return 1; /* force error */
+  }
+  return 0;
+}
+
+static CURLcode test_lib766(const char *URL)
+{
+  CURL *curl = NULL;
+  CURLcode result = CURLE_OK;
+
+  start_test_timing();
+
+  res_global_init(CURL_GLOBAL_ALL);
+
+  easy_init(curl);
+  easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  easy_setopt(curl, CURLOPT_URL, URL);
+  easy_setopt(curl, CURLOPT_FTPPORT, "-");
+  easy_setopt(curl, CURLOPT_SOCKOPTFUNCTION, sockopt_766);
+
+  result = curl_easy_perform(curl);
+
+test_cleanup:
+
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+
+  return result;
+}
diff --git a/third-party/curl/tests/libtest/libauthretry.c b/third-party/curl/tests/libtest/libauthretry.c
deleted file mode 100644
index a71fe20ede..0000000000
--- a/third-party/curl/tests/libtest/libauthretry.c
+++ /dev/null
@@ -1,149 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-/* argv1 = URL
- * argv2 = main auth type
- * argv3 = second auth type
- */
-
-#include "test.h"
-#include "memdebug.h"
-
-static CURLcode send_request(CURL *curl, const char *url, int seq,
-                             long auth_scheme, const char *userpwd)
-{
-  CURLcode res;
-  size_t len = strlen(url) + 4 + 1;
-  char *full_url = malloc(len);
-  if(!full_url) {
-    fprintf(stderr, "Not enough memory for full url\n");
-    return CURLE_OUT_OF_MEMORY;
-  }
-
-  msnprintf(full_url, len, "%s%04d", url, seq);
-  fprintf(stderr, "Sending new request %d to %s with credential %s "
-          "(auth %ld)\n", seq, full_url, userpwd, auth_scheme);
-  test_setopt(curl, CURLOPT_URL, full_url);
-  test_setopt(curl, CURLOPT_VERBOSE, 1L);
-  test_setopt(curl, CURLOPT_HEADER, 1L);
-  test_setopt(curl, CURLOPT_HTTPGET, 1L);
-  test_setopt(curl, CURLOPT_USERPWD, userpwd);
-  test_setopt(curl, CURLOPT_HTTPAUTH, auth_scheme);
-
-  res = curl_easy_perform(curl);
-
-test_cleanup:
-  free(full_url);
-  return res;
-}
-
-static CURLcode send_wrong_password(CURL *curl, const char *url, int seq,
-                                    long auth_scheme)
-{
-    return send_request(curl, url, seq, auth_scheme, "testuser:wrongpass");
-}
-
-static CURLcode send_right_password(CURL *curl, const char *url, int seq,
-                                    long auth_scheme)
-{
-    return send_request(curl, url, seq, auth_scheme, "testuser:testpass");
-}
-
-static long parse_auth_name(const char *arg)
-{
-  if(!arg)
-    return CURLAUTH_NONE;
-  if(curl_strequal(arg, "basic"))
-    return CURLAUTH_BASIC;
-  if(curl_strequal(arg, "digest"))
-    return CURLAUTH_DIGEST;
-  if(curl_strequal(arg, "ntlm"))
-    return CURLAUTH_NTLM;
-  return CURLAUTH_NONE;
-}
-
-int test(char *url)
-{
-  CURLcode res;
-  CURL *curl = NULL;
-
-  long main_auth_scheme = parse_auth_name(libtest_arg2);
-  long fallback_auth_scheme = parse_auth_name(libtest_arg3);
-
-  if(main_auth_scheme == CURLAUTH_NONE ||
-      fallback_auth_scheme == CURLAUTH_NONE) {
-    fprintf(stderr, "auth schemes not found on commandline\n");
-    return TEST_ERR_MAJOR_BAD;
-  }
-
-  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
-    return TEST_ERR_MAJOR_BAD;
-  }
-
-  /* Send wrong password, then right password */
-
-  curl = curl_easy_init();
-  if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
-    curl_global_cleanup();
-    return TEST_ERR_MAJOR_BAD;
-  }
-
-  res = send_wrong_password(curl, url, 100, main_auth_scheme);
-  if(res != CURLE_OK)
-    goto test_cleanup;
-
-  res = send_right_password(curl, url, 200, fallback_auth_scheme);
-  if(res != CURLE_OK)
-    goto test_cleanup;
-
-  curl_easy_cleanup(curl);
-
-  /* Send wrong password twice, then right password */
-  curl = curl_easy_init();
-  if(!curl) {
-    fprintf(stderr, "curl_easy_init() failed\n");
-    curl_global_cleanup();
-    return TEST_ERR_MAJOR_BAD;
-  }
-
-  res = send_wrong_password(curl, url, 300, main_auth_scheme);
-  if(res != CURLE_OK)
-    goto test_cleanup;
-
-  res = send_wrong_password(curl, url, 400, fallback_auth_scheme);
-  if(res != CURLE_OK)
-    goto test_cleanup;
-
-  res = send_right_password(curl, url, 500, fallback_auth_scheme);
-  if(res != CURLE_OK)
-    goto test_cleanup;
-
-test_cleanup:
-
-  curl_easy_cleanup(curl);
-  curl_global_cleanup();
-
-  return (int)res;
-}
diff --git a/third-party/curl/tests/libtest/libntlmconnect.c b/third-party/curl/tests/libtest/libntlmconnect.c
deleted file mode 100644
index 9f1c1315f8..0000000000
--- a/third-party/curl/tests/libtest/libntlmconnect.c
+++ /dev/null
@@ -1,238 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "test.h"
-
-#include <limits.h>
-#include <assert.h>
-
-#include "testutil.h"
-#include "warnless.h"
-#include "memdebug.h"
-
-#define TEST_HANG_TIMEOUT 5 * 1000
-#define MAX_EASY_HANDLES 3
-
-static int counter[MAX_EASY_HANDLES];
-static CURL *easy[MAX_EASY_HANDLES];
-static curl_socket_t sockets[MAX_EASY_HANDLES];
-static int res = 0;
-
-static size_t callback(char *ptr, size_t size, size_t nmemb, void *data)
-{
-  ssize_t idx = ((CURL **) data) - easy;
-  curl_socket_t sock;
-  long longdata;
-  CURLcode code;
-  const size_t failure = (size && nmemb) ? 0 : 1;
-  (void)ptr;
-
-  counter[idx] += (int)(size * nmemb);
-
-  /* Get socket being used for this easy handle, otherwise CURL_SOCKET_BAD */
-  CURL_IGNORE_DEPRECATION(
-    code = curl_easy_getinfo(easy[idx], CURLINFO_LASTSOCKET, &longdata);
-  )
-  if(CURLE_OK != code) {
-    fprintf(stderr, "%s:%d curl_easy_getinfo() failed, "
-            "with code %d (%s)\n",
-            __FILE__, __LINE__, (int)code, curl_easy_strerror(code));
-    res = TEST_ERR_MAJOR_BAD;
-    return failure;
-  }
-  if(longdata == -1L)
-    sock = CURL_SOCKET_BAD;
-  else
-    sock = (curl_socket_t)longdata;
-
-  if(sock != CURL_SOCKET_BAD) {
-    /* Track relationship between this easy handle and the socket. */
-    if(sockets[idx] == CURL_SOCKET_BAD) {
-      /* An easy handle without previous socket, record the socket. */
-      sockets[idx] = sock;
-    }
-    else if(sock != sockets[idx]) {
-      /* An easy handle with a socket different to previously
-         tracked one, log and fail right away. Known bug #37. */
-      fprintf(stderr, "Handle %d started on socket %d and moved to %d\n",
-              curlx_sztosi(idx), (int)sockets[idx], (int)sock);
-      res = TEST_ERR_MAJOR_BAD;
-      return failure;
-    }
-  }
-  return size * nmemb;
-}
-
-enum HandleState {
-  ReadyForNewHandle,
-  NeedSocketForNewHandle,
-  NoMoreHandles
-};
-
-int test(char *url)
-{
-  CURLM *multi = NULL;
-  int running;
-  int i;
-  int num_handles = 0;
-  enum HandleState state = ReadyForNewHandle;
-  size_t urllen = strlen(url) + 4 + 1;
-  char *full_url = malloc(urllen);
-
-  start_test_timing();
-
-  if(!full_url) {
-    fprintf(stderr, "Not enough memory for full url\n");
-    return TEST_ERR_MAJOR_BAD;
-  }
-
-  for(i = 0; i < MAX_EASY_HANDLES; ++i) {
-    easy[i] = NULL;
-    sockets[i] = CURL_SOCKET_BAD;
-  }
-
-  res_global_init(CURL_GLOBAL_ALL);
-  if(res) {
-    free(full_url);
-    return res;
-  }
-
-  multi_init(multi);
-
-#ifdef USE_PIPELINING
-  multi_setopt(multi, CURLMOPT_PIPELINING, 1L);
-  multi_setopt(multi, CURLMOPT_MAX_HOST_CONNECTIONS, 5L);
-  multi_setopt(multi, CURLMOPT_MAX_TOTAL_CONNECTIONS, 10L);
-#endif
-
-  for(;;) {
-    struct timeval interval;
-    fd_set fdread;
-    fd_set fdwrite;
-    fd_set fdexcep;
-    long timeout = -99;
-    int maxfd = -99;
-    bool found_new_socket = FALSE;
-
-    /* Start a new handle if we aren't at the max */
-    if(state == ReadyForNewHandle) {
-      easy_init(easy[num_handles]);
-
-      if(num_handles % 3 == 2) {
-        msnprintf(full_url, urllen, "%s0200", url);
-        easy_setopt(easy[num_handles], CURLOPT_HTTPAUTH, CURLAUTH_NTLM);
-      }
-      else {
-        msnprintf(full_url, urllen, "%s0100", url);
-        easy_setopt(easy[num_handles], CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
-      }
-      easy_setopt(easy[num_handles], CURLOPT_FRESH_CONNECT, 1L);
-      easy_setopt(easy[num_handles], CURLOPT_URL, full_url);
-      easy_setopt(easy[num_handles], CURLOPT_VERBOSE, 1L);
-      easy_setopt(easy[num_handles], CURLOPT_HTTPGET, 1L);
-      easy_setopt(easy[num_handles], CURLOPT_USERPWD, "testuser:testpass");
-      easy_setopt(easy[num_handles], CURLOPT_WRITEFUNCTION, callback);
-      easy_setopt(easy[num_handles], CURLOPT_WRITEDATA, easy + num_handles);
-      easy_setopt(easy[num_handles], CURLOPT_HEADER, 1L);
-
-      multi_add_handle(multi, easy[num_handles]);
-      num_handles += 1;
-      state = NeedSocketForNewHandle;
-    }
-
-    multi_perform(multi, &running);
-
-    fprintf(stderr, "%s:%d running %d state %d\n",
-            __FILE__, __LINE__, running, state);
-
-    abort_on_test_timeout();
-
-    if(!running && state == NoMoreHandles)
-      break; /* done */
-
-    FD_ZERO(&fdread);
-    FD_ZERO(&fdwrite);
-    FD_ZERO(&fdexcep);
-
-    multi_fdset(multi, &fdread, &fdwrite, &fdexcep, &maxfd);
-
-    /* At this point, maxfd is guaranteed to be greater or equal than -1. */
-
-    if(state == NeedSocketForNewHandle) {
-      if(maxfd != -1 && !found_new_socket) {
-        fprintf(stderr, "Warning: socket did not open immediately for new "
-                "handle (trying again)\n");
-        continue;
-      }
-      state = num_handles < MAX_EASY_HANDLES ? ReadyForNewHandle
-                                             : NoMoreHandles;
-      fprintf(stderr, "%s:%d new state %d\n",
-              __FILE__, __LINE__, state);
-    }
-
-    multi_timeout(multi, &timeout);
-
-    /* At this point, timeout is guaranteed to be greater or equal than -1. */
-
-    fprintf(stderr, "%s:%d num_handles %d timeout %ld running %d\n",
-            __FILE__, __LINE__, num_handles, timeout, running);
-
-    if(timeout != -1L) {
-      int itimeout = (timeout > (long)INT_MAX) ? INT_MAX : (int)timeout;
-      interval.tv_sec = itimeout/1000;
-      interval.tv_usec = (itimeout%1000)*1000;
-    }
-    else {
-      interval.tv_sec = 0;
-      interval.tv_usec = 5000;
-
-      /* if there's no timeout and we get here on the last handle, we may
-         already have read the last part of the stream so waiting makes no
-         sense */
-      if(!running && num_handles == MAX_EASY_HANDLES) {
-        break;
-      }
-    }
-
-    select_test(maxfd + 1, &fdread, &fdwrite, &fdexcep, &interval);
-
-    abort_on_test_timeout();
-  }
-
-test_cleanup:
-
-  /* proper cleanup sequence - type PB */
-
-  for(i = 0; i < MAX_EASY_HANDLES; i++) {
-    printf("Data connection %d: %d\n", i, counter[i]);
-    curl_multi_remove_handle(multi, easy[i]);
-    curl_easy_cleanup(easy[i]);
-  }
-
-  curl_multi_cleanup(multi);
-  curl_global_cleanup();
-
-  free(full_url);
-
-  return res;
-}
diff --git a/third-party/curl/tests/libtest/libprereq.c b/third-party/curl/tests/libtest/libprereq.c
deleted file mode 100644
index 92369d838d..0000000000
--- a/third-party/curl/tests/libtest/libprereq.c
+++ /dev/null
@@ -1,99 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Max Dymond, <max.dymond@microsoft.com>
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "test.h"
-
-typedef struct prcs {
-  int prereq_retcode;
-  int ipv6;
-} PRCS;
-
-static int prereq_callback(void *clientp,
-                           char *conn_primary_ip,
-                           char *conn_local_ip,
-                           int conn_primary_port,
-                           int conn_local_port)
-{
-  PRCS *prereq_cb = (PRCS *)clientp;
-
-  if(prereq_cb->ipv6) {
-    printf("Connected to [%s]\n", conn_primary_ip);
-    printf("Connected from [%s]\n", conn_local_ip);
-  }
-  else {
-    printf("Connected to %s\n", conn_primary_ip);
-    printf("Connected from %s\n", conn_local_ip);
-  }
-
-  printf("Remote port = %d\n", conn_primary_port);
-  printf("Local port = %d\n", conn_local_port);
-  printf("Returning = %d\n", prereq_cb->prereq_retcode);
-  return prereq_cb->prereq_retcode;
-}
-
-int test(char *URL)
-{
-  PRCS prereq_cb;
-  CURLcode ret = CURLE_OK;
-  CURL *curl = NULL;
-
-  prereq_cb.prereq_retcode = CURL_PREREQFUNC_OK;
-  prereq_cb.ipv6 = 0;
-
-  curl_global_init(CURL_GLOBAL_ALL);
-  curl = curl_easy_init();
-
-  if(curl) {
-    if(strstr(URL, "#ipv6")) {
-      /* The IP addresses should be surrounded by brackets! */
-      prereq_cb.ipv6 = 1;
-    }
-    if(strstr(URL, "#err")) {
-      /* Set the callback to exit with failure */
-      prereq_cb.prereq_retcode = CURL_PREREQFUNC_ABORT;
-    }
-
-    curl_easy_setopt(curl, CURLOPT_URL, URL);
-    curl_easy_setopt(curl, CURLOPT_PREREQFUNCTION, prereq_callback);
-    curl_easy_setopt(curl, CURLOPT_PREREQDATA, &prereq_cb);
-    curl_easy_setopt(curl, CURLOPT_WRITEDATA, stderr);
-
-    if(strstr(URL, "#redir")) {
-      /* Enable follow-location */
-      curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1);
-    }
-
-    ret = curl_easy_perform(curl);
-    if(ret) {
-      fprintf(stderr, "%s:%d curl_easy_perform() failed with code %d (%s)\n",
-          __FILE__, __LINE__, ret, curl_easy_strerror(ret));
-      goto test_cleanup;
-    }
-  }
-
-test_cleanup:
-  curl_easy_cleanup(curl);
-  curl_global_cleanup();
-
-  return ret;
-}
diff --git a/third-party/curl/tests/libtest/memptr.c b/third-party/curl/tests/libtest/memptr.c
new file mode 100644
index 0000000000..361d9a5c52
--- /dev/null
+++ b/third-party/curl/tests/libtest/memptr.c
@@ -0,0 +1,46 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#ifndef CURL_STATICLIB
+
+#if defined(_MSC_VER) && defined(_DLL)
+#pragma warning(push)
+#pragma warning(disable:4232) /* MSVC extension, dllimport identity */
+#endif
+
+/* when libcurl is *not* static and we build libtests, the global pointers in
+   curl_memory.c is not available unless we provide them like this */
+
+curl_malloc_callback Curl_cmalloc = (curl_malloc_callback)malloc;
+curl_free_callback Curl_cfree = (curl_free_callback)free;
+curl_realloc_callback Curl_crealloc = (curl_realloc_callback)realloc;
+curl_strdup_callback Curl_cstrdup = (curl_strdup_callback)CURLX_STRDUP_LOW;
+curl_calloc_callback Curl_ccalloc = (curl_calloc_callback)calloc;
+
+#if defined(_MSC_VER) && defined(_DLL)
+#pragma warning(pop)
+#endif
+
+#endif /* !CURL_STATICLIB */
diff --git a/third-party/curl/tests/libtest/mk-lib1521.pl b/third-party/curl/tests/libtest/mk-lib1521.pl
index e1418a0133..6590d5257a 100644
--- a/third-party/curl/tests/libtest/mk-lib1521.pl
+++ b/third-party/curl/tests/libtest/mk-lib1521.pl
@@ -22,19 +22,166 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+use strict;
+use warnings;
 
 # Usage:
-#   perl mk-lib1521.pl < ../../include/curl/curl.h > lib1521.c
+#   perl mk-lib1521.pl < ../../include/curl/curl.h lib1521.c
 
 # minimum and maximum long signed values
 my $minlong = "LONG_MIN";
 my $maxlong = "LONG_MAX";
-# maximum long unsigned value
-my $maxulong = "ULONG_MAX";
+# maximum curl_off_t
+my $maxofft = "CURL_OFF_T_MAX";
 my $line = "";
 my $incomment = 0;
 
-print <<HEADER
+# Options allowed to return CURLE_BAD_FUNCTION_ARGUMENT if given a string they
+# do not recognize as valid
+my @bad_function_argument = (
+    'CURLOPT_DNS_LOCAL_IP4',
+    'CURLOPT_DNS_LOCAL_IP6',
+    'CURLOPT_DNS_SERVERS',
+    'CURLOPT_ECH',
+    'CURLOPT_PROXY_TLSAUTH_TYPE',
+    'CURLOPT_SSLENGINE',
+    'CURLOPT_TLSAUTH_TYPE',
+);
+
+# Options allowed to return CURLE_UNSUPPORTED_PROTOCOL if given a string they
+# do not recognize as valid
+my @unsupported_protocol = (
+    'CURLOPT_PROTOCOLS_STR',
+    'CURLOPT_REDIR_PROTOCOLS_STR',
+    );
+
+# Options allowed to return CURLE_SSL_ENGINE_NOTFOUND if given a string they
+# do not recognize as valid
+my @ssl_engine_notfound = (
+    'CURLOPT_SSLENGINE',
+    );
+
+# Options allowed to return CURLE_UNSUPPORTED_PROTOCOL if given a bad
+# numerical input they do not recognize as valid
+my @unsupported_protocol_num = (
+    'CURLOPT_HTTP_VERSION',
+    );
+
+# Options allowed to return CURLE_NOT_BUILT_IN if given a bad
+# numerical input they do not recognize as valid
+my @not_built_in_num = (
+    'CURLOPT_HTTPAUTH',
+    'CURLOPT_PROXYAUTH',
+    'CURLOPT_SOCKS5_AUTH',
+    );
+
+#
+# Generate a set of string checks
+#
+
+my $allowedstringerrors = <<MOO
+  switch(result) {
+  case CURLE_BAD_FUNCTION_ARGUMENT:
+MOO
+    ;
+
+for my $o (@bad_function_argument) {
+    $allowedstringerrors .= <<MOO
+    if(!strcmp("$o", name))
+      return;
+MOO
+        ;
+}
+
+$allowedstringerrors .= <<MOO
+     break;
+MOO
+    ;
+
+$allowedstringerrors .= <<MOO
+  case CURLE_UNSUPPORTED_PROTOCOL:
+MOO
+    ;
+for my $o (@unsupported_protocol) {
+    $allowedstringerrors .= <<MOO
+    if(!strcmp("$o", name))
+      return;
+MOO
+        ;
+}
+$allowedstringerrors .= <<MOO
+    break;
+MOO
+    ;
+
+$allowedstringerrors .= <<MOO
+  case CURLE_SSL_ENGINE_NOTFOUND:
+MOO
+    ;
+for my $o (@ssl_engine_notfound) {
+    $allowedstringerrors .= <<MOO
+    if(!strcmp("$o", name))
+      return;
+MOO
+        ;
+}
+$allowedstringerrors .= <<MOO
+    break;
+  default:
+    break;
+  }
+MOO
+    ;
+
+#
+# Generate a set of string checks
+#
+
+my $allowednumerrors = <<MOO
+  switch(result) {
+  case CURLE_UNSUPPORTED_PROTOCOL:
+MOO
+    ;
+
+for my $o (@unsupported_protocol_num) {
+    $allowednumerrors .= <<MOO
+    if(!strcmp("$o", name))
+      return;
+MOO
+        ;
+}
+
+$allowednumerrors .= <<MOO
+    break;
+  case CURLE_NOT_BUILT_IN:
+MOO
+    ;
+
+for my $o (@not_built_in_num) {
+    $allowednumerrors .= <<MOO
+    if(!strcmp("$o", name))
+      return;
+MOO
+        ;
+}
+
+$allowednumerrors .= <<MOO
+    break;
+  default:
+    break;
+  }
+MOO
+    ;
+
+if(!$ARGV[0]) {
+    die "missing target filename";
+}
+
+use File::Temp qw/ :mktemp  /;
+
+my ($fh, $tempfile) = mkstemp("lib1521-XXXXX");
+
+print $fh <<HEADER
 /***************************************************************************
  *                                  _   _ ____  _
  *  Project                     ___| | | |  _ \\| |
@@ -42,7 +189,7 @@ print <<HEADER
  *                            | (__| |_| |  _ <| |___
  *                             \\___|\\___/|_| \\_\\_____|
  *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) Daniel Stenberg, <daniel\@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -58,36 +205,19 @@ print <<HEADER
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#define CURL_DISABLE_DEPRECATION  /* Deprecated options are tested too */
-#include "test.h"
-#include "memdebug.h"
-#include <limits.h>
+#include "first.h"
 
 /* This source code is generated by mk-lib1521.pl ! */
 
-struct data {
-    char *blaha;
+struct t1521_testdata {
+  const char *blaha;
 };
 
 #define LO $minlong
 #define HI $maxlong
-#define OFF_LO (curl_off_t) LO
-#define OFF_HI (curl_off_t) $maxulong
-#define OFF_NO (curl_off_t) 0
-
-/* Unexpected error.
-    CURLE_NOT_BUILT_IN   - means disabled at build
-    CURLE_UNKNOWN_OPTION - means no such option (anymore?)
-    CURLE_SSL_ENGINE_NOTFOUND - set unknown ssl engine
-    CURLE_UNSUPPORTED_PROTOCOL - set bad HTTP version
-    CURLE_BAD_FUNCTION_ARGUMENT - unsupported value
-   */
-#define UNEX(x) ((x) && \\
-                 ((x) != CURLE_NOT_BUILT_IN) && \\
-                 ((x) != CURLE_UNKNOWN_OPTION) && \\
-                 ((x) != CURLE_SSL_ENGINE_NOTFOUND) && \\
-                 ((x) != CURLE_UNSUPPORTED_PROTOCOL) && \\
-                 ((x) != CURLE_BAD_FUNCTION_ARGUMENT) )
+#define OFF_LO ((curl_off_t)(LO))
+#define OFF_HI ((curl_off_t)($maxofft))
+#define OFF_NO ((curl_off_t)0)
 
 static size_t writecb(char *buffer, size_t size, size_t nitems,
                       void *outstream)
@@ -111,18 +241,50 @@ static size_t readcb(char *buffer,
   return 0;
 }
 
-static int err(const char *name, CURLcode val, int lineno)
+static void errlongzero(const char *name, CURLcode result, int lineno)
 {
-  printf("CURLOPT_%s returned %d, \\"%s\\" on line %d\\n",
-         name, val, curl_easy_strerror(val), lineno);
-  return (int)val;
+  curl_mprintf("%s set to 0 returned %d, \\"%s\\" on line %d\\n",
+               name, (int)result, curl_easy_strerror(result), lineno);
 }
 
-static int geterr(const char *name, CURLcode val, int lineno)
+static void errlong(const char *name, CURLcode result, int lineno)
 {
-  printf("CURLINFO_%s returned %d, \\"%s\\" on line %d\\n",
-         name, val, curl_easy_strerror(val), lineno);
-  return (int)val;
+$allowednumerrors
+  curl_mprintf("%s set to non-zero returned %d, \\"%s\\" on line %d\\n",
+               name, (int)result, curl_easy_strerror(result), lineno);
+}
+
+static void errneg(const char *name, CURLcode result, int lineno)
+{
+  curl_mprintf("%s set to -1 returned %d, \\"%s\\" on line %d\\n",
+               name, (int)result, curl_easy_strerror(result), lineno);
+}
+
+static void errstring(const char *name, CURLcode result, int lineno)
+{
+  /* allow this set of options to return CURLE_BAD_FUNCTION_ARGUMENT
+     when given a strange string input */
+$allowedstringerrors
+  curl_mprintf("%s set to a string returned %d, \\"%s\\" on line %d\\n",
+               name, (int)result, curl_easy_strerror(result), lineno);
+}
+
+static void err(const char *name, CURLcode result, int lineno)
+{
+  curl_mprintf("%s returned %d, \\"%s\\" on line %d\\n",
+               name, (int)result, curl_easy_strerror(result), lineno);
+}
+
+static void errnull(const char *name, CURLcode result, int lineno)
+{
+  curl_mprintf("%s set to NULL returned %d, \\"%s\\" on line %d\\n",
+               name, (int)result, curl_easy_strerror(result), lineno);
+}
+
+static void t1521_geterr(const char *name, CURLcode result, int lineno)
+{
+  curl_mprintf("CURLINFO_%s returned %d, \\"%s\\" on line %d\\n",
+               name, (int)result, curl_easy_strerror(result), lineno);
 }
 
 static curl_progress_callback progresscb;
@@ -145,45 +307,92 @@ static curl_hstsread_callback hstsreadcb;
 static curl_hstswrite_callback hstswritecb;
 static curl_resolver_start_callback resolver_start_cb;
 static curl_prereq_callback prereqcb;
+static curl_conv_callback conv_from_network_cb;
+static curl_conv_callback conv_to_network_cb;
+static curl_conv_callback conv_from_utf8_cb;
+typedef size_t (*interleave_callback)(void *ptr, size_t size, size_t nmemb,
+                                      void *userdata);
+static interleave_callback interleavecb;
 
-int test(char *URL)
+/* long options that are okay to return
+   CURLE_BAD_FUNCTION_ARGUMENT */
+static bool bad_long(CURLcode res, int check)
+{
+  if(res != CURLE_BAD_FUNCTION_ARGUMENT)
+    return 0; /* not okay */
+
+  if(check < CURLOPTTYPE_OBJECTPOINT) {
+    /* LONG */
+    return 1;
+  }
+  else if((check >= CURLOPTTYPE_OFF_T) &&
+          (check < CURLOPTTYPE_BLOB)) {
+    /* OFF_T */
+    return 1;
+  }
+  return 0;
+}
+
+/* long options that should handle -1 */
+static bool bad_neg(int check)
+{
+  switch(check) {
+  case CURLOPT_DNS_CACHE_TIMEOUT:
+  case CURLOPT_INFILESIZE:
+  case CURLOPT_INFILESIZE_LARGE:
+  case CURLOPT_MAXREDIRS:
+  case CURLOPT_POSTFIELDSIZE:
+  case CURLOPT_POSTFIELDSIZE_LARGE:
+  case CURLOPT_RESUME_FROM:
+  case CURLOPT_RESUME_FROM_LARGE:
+    return TRUE;
+  }
+  return FALSE;
+}
+
+/* macro to check the first setopt of an option which then is allowed to get a
+   non-existing function return code back */
+#define present(x)                \\
+  (((x) != CURLE_NOT_BUILT_IN) && \\
+   ((x) != CURLE_UNKNOWN_OPTION))
+
+static CURLcode test_lib1521(const char *URL)
 {
   CURL *curl = NULL;
   CURL *dep = NULL;
   CURLSH *share = NULL;
   char errorbuffer[CURL_ERROR_SIZE];
-  void *conv_from_network_cb = NULL;
-  void *conv_to_network_cb = NULL;
-  void *conv_from_utf8_cb = NULL;
-  void *interleavecb = NULL;
-  char *stringpointerextra = (char *)"moooo";
+  const char *stringpointerextra = "moooo";
   struct curl_slist *slist = NULL;
   struct curl_httppost *httppost = NULL;
   curl_mime *mimepost = NULL;
   FILE *stream = stderr;
-  struct data object;
-  char *charp;
+  struct t1521_testdata object;
+  CURLU *curlu = (CURLU *)&object;
+  const char *charp;
   long val;
   curl_off_t oval;
   double dval;
   curl_socket_t sockfd;
-  struct curl_certinfo *certinfo;
+  const struct curl_certinfo *certinfo;
   struct curl_tlssessioninfo *tlssession;
-  struct curl_blob blob = { (void *)"silly", 5, 0};
-  CURLcode res = CURLE_OK;
-  (void)URL; /* not used */
+  struct curl_blob blob = { CURL_UNCONST("silly"), 5, 0 };
+  CURLcode result = CURLE_OK;
+  (void)URL;
   global_init(CURL_GLOBAL_ALL);
   easy_init(dep);
   easy_init(curl);
   share = curl_share_init();
   if(!share) {
-    res = CURLE_OUT_OF_MEMORY;
+    result = CURLE_OUT_OF_MEMORY;
     goto test_cleanup;
   }
 
 HEADER
     ;
 
+my $infomode = 0;
+
 while(<STDIN>) {
     s/^\s*(.*?)\s*$/$1/;      # Trim.
     # Remove multi-line comment trail.
@@ -233,115 +442,187 @@ while(<STDIN>) {
         next;
     }
     if($_ =~ /^CURLOPT(?:DEPRECATED)?\(([^ ]*), ([^ ]*), (\d*)[,)]/) {
-        my ($name, $type, $val)=($1, $2, $3);
-        my $w="  ";
-        my $pref = "${w}res = curl_easy_setopt(curl, $name,";
-        my $i = ' ' x (length($w) + 23);
-        my $check = "  if(UNEX(res)) {\n    err(\"$name\", res, __LINE__);\n    goto test_cleanup;\n  }\n";
+        my ($name, $type, $val) = ($1, $2, $3);
+        my $w = "  ";
+        my $w2 = "$w$w";
+        my $w3 = "$w$w$w";
+        my $opt = $name;
+        $opt =~ s/^CURLOPT_//;
+        my $exists = "${w}{\n";
+        # the first check for an option
+        my $fpref = "${exists}${w2}CURLcode first =\n${w3}curl_easy_setopt(curl, $name,";
+        my $ifpresent = "${w2}if(present(first)) {\n";
+        my $pref = "${w3}result =\n".
+                   "${w3}  curl_easy_setopt(curl, $name,";
+        my $ignoreset = "${w3}/* set string again to check for leaks */\n".
+            "${w3}(void)curl_easy_setopt(curl, $name,";
+        my $i = ' ' x (length($w) + 21);
+        my $fcheck = <<MOO
+    if(first && present(first)) /* first setopt check only */
+      err("$name", first, __LINE__);
+MOO
+            ;
+        my $fstringcheck = <<MOO
+    if(first && present(first)) /* first setopt check only */
+      errstring("$name", first, __LINE__);
+MOO
+            ;
+        my $check = <<MOO
+      if(result)
+        err("$name", result, __LINE__);
+MOO
+            ;
+        my $flongcheckzero = <<MOO
+    if(first && present(first) && !bad_long(first,
+       $name))
+      errlongzero("$name", first, __LINE__);
+MOO
+            ;
+
+        my $longcheck = <<MOO
+      if(result && !bad_long(result, $name))
+        errlong("$name", result, __LINE__);
+MOO
+            ;
+
+        my $negcheck = <<MOO
+      if(result && bad_neg($name))
+        errneg("$name", result, __LINE__);
+MOO
+            ;
+
+        my $nullcheck = <<MOO
+      if(result)
+        errnull(\"$name\", result, __LINE__);
+MOO
+            ;
+
+        print $fh "\n  /****** Verify $name ******/\n";
         if($type eq "CURLOPTTYPE_STRINGPOINT") {
-            print "${pref} \"string\");\n$check";
-            print "${pref} NULL);\n$check";
+            print $fh "${fpref} \"string\");\n$fstringcheck";
+            print $fh "$ifpresent";
+            print $fh "${ignoreset} \"\");\n";
+            print $fh "${pref} NULL);\n$nullcheck";
         }
         elsif(($type eq "CURLOPTTYPE_LONG") ||
               ($type eq "CURLOPTTYPE_VALUES")) {
-            print "${pref} 0L);\n$check";
-            print "${pref} 22L);\n$check";
-            print "${pref} LO);\n$check";
-            print "${pref} HI);\n$check";
+            print $fh "${fpref} 0L);\n$flongcheckzero";
+            print $fh "$ifpresent";
+            print $fh "${pref} 22L);\n$longcheck";
+            print $fh "${pref} LO);\n$longcheck";
+            print $fh "${pref} -1L);\n$negcheck";
+            print $fh "${pref} HI);\n$longcheck";
+        }
+        elsif($type eq "CURLOPTTYPE_OFF_T") {
+            print $fh "${fpref} OFF_NO);\n$flongcheckzero";
+            print $fh "$ifpresent";
+            my $lvl = " " x 25;
+            print $fh "${pref}\n${lvl}(curl_off_t)22);\n$longcheck";
+            print $fh "${pref} OFF_HI);\n$longcheck";
+            print $fh "${pref} OFF_LO);\n$longcheck";
         }
         elsif(($type eq "CURLOPTTYPE_OBJECTPOINT") ||
               ($type eq "CURLOPTTYPE_CBPOINT")) {
             if($name =~ /DEPENDS/) {
-              print "${pref} dep);\n$check";
+              print $fh "${fpref} dep);\n$fcheck";
             }
             elsif($name =~ "SHARE") {
-              print "${pref} share);\n$check";
+              print $fh "${fpref} share);\n$fcheck";
             }
             elsif($name eq "CURLOPT_ERRORBUFFER") {
-              print "${pref} errorbuffer);\n$check";
+              print $fh "${fpref} errorbuffer);\n$fcheck";
             }
             elsif(($name eq "CURLOPT_POSTFIELDS") ||
                   ($name eq "CURLOPT_COPYPOSTFIELDS")) {
                 # set size to zero to avoid it being "illegal"
-                print "  (void)curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, 0);\n";
-                print "${pref} stringpointerextra);\n$check";
+                print $fh "  (void)curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, 0L);\n";
+                print $fh "${fpref} stringpointerextra);\n$fcheck";
             }
             elsif($name eq "CURLOPT_HTTPPOST") {
-              print "${pref} httppost);\n$check";
+              print $fh "${fpref} httppost);\n$fcheck";
             }
             elsif($name eq "CURLOPT_MIMEPOST") {
-              print "${pref} mimepost);\n$check";
+              print $fh "${fpref} mimepost);\n$fcheck";
             }
             elsif($name eq "CURLOPT_STDERR") {
-              print "${pref} stream);\n$check";
+              print $fh "${fpref} stream);\n$fcheck";
+            }
+            elsif($name eq "CURLOPT_CURLU") {
+              print $fh "${fpref} curlu);\n$fcheck";
             }
             else {
-              print "${pref} &object);\n$check";
+              print $fh "${fpref} &object);\n$fcheck";
             }
-            print "${pref} NULL);\n$check";
+            print $fh "$ifpresent";
+            print $fh "${pref} NULL);\n$nullcheck";
         }
         elsif($type eq "CURLOPTTYPE_SLISTPOINT") {
-            print "${pref} slist);\n$check";
+            print $fh "${fpref} slist);\n$fcheck";
+            print $fh "$ifpresent";
+            print $fh "${pref} NULL);\n$nullcheck";
         }
         elsif($type eq "CURLOPTTYPE_FUNCTIONPOINT") {
             if($name =~ /([^ ]*)FUNCTION/) {
-                my $l=lc($1);
+                my $l = lc($1);
                 $l =~ s/^curlopt_//;
-                print "${pref}\n$i${l}cb);\n$check";
+                print $fh "${fpref}\n$i${l}cb);\n$fcheck";
             }
             else {
-                print "${pref} &func);\n$check";
+                print $fh "${fpref} &func);\n$fcheck";
             }
-            print "${pref} NULL);\n$check";
-        }
-        elsif($type eq "CURLOPTTYPE_OFF_T") {
-            # play conservative to work with 32bit curl_off_t
-            print "${pref} OFF_NO);\n$check";
-            print "${pref} OFF_HI);\n$check";
-            print "${pref} OFF_LO);\n$check";
+            print $fh "$ifpresent";
+            print $fh "${pref} NULL);\n$nullcheck";
         }
         elsif($type eq "CURLOPTTYPE_BLOB") {
-            print "${pref} &blob);\n$check";
+            print $fh "${fpref} &blob);\n$check";
+            print $fh "$ifpresent";
+            print $fh "${pref} NULL);\n$nullcheck";
         }
         else {
             print STDERR "\nUnknown type: $type\n";
             exit 22; # exit to make this noticed!
         }
+
+        print $fh <<MOO
+    } /* end of secondary checks */
+  } /* end of single setopt */
+MOO
+            ;
     }
     elsif($_ =~ /^CURLINFO_NONE/) {
        $infomode = 1;
     }
     elsif($infomode &&
           ($_ =~ /^CURLINFO_([^ ]*) *= *CURLINFO_([^ ]*)/)) {
-       my ($info, $type)=($1, $2);
-       my $c = "  res = curl_easy_getinfo(curl, CURLINFO_$info,";
-       my $check = "  if(UNEX(res)) {\n    geterr(\"$info\", res, __LINE__);\n    goto test_cleanup;\n  }\n";
+       my ($info, $type) = ($1, $2);
+       my $c = "  result = curl_easy_getinfo(curl, CURLINFO_$info,";
+       my $check = "  if(result)\n    t1521_geterr(\"$info\", result, __LINE__);\n";
        if($type eq "STRING") {
-         print "$c &charp);\n$check";
+         print $fh "$c &charp);\n$check";
        }
        elsif($type eq "LONG") {
-         print "$c &val);\n$check";
+         print $fh "$c &val);\n$check";
        }
        elsif($type eq "OFF_T") {
-         print "$c &oval);\n$check";
+         print $fh "$c &oval);\n$check";
        }
        elsif($type eq "DOUBLE") {
-         print "$c &dval);\n$check";
+         print $fh "$c &dval);\n$check";
        }
        elsif($type eq "SLIST") {
-         print "$c &slist);\n$check";
-         print "  if(slist)\n    curl_slist_free_all(slist);\n";
+         print $fh "$c &slist);\n$check";
+         print $fh "  if(slist)\n    curl_slist_free_all(slist);\n";
        }
        elsif($type eq "SOCKET") {
-         print "$c &sockfd);\n$check";
+         print $fh "$c &sockfd);\n$check";
        }
        elsif($type eq "PTR") {
          if($info eq "CERTINFO") {
-            print "$c &certinfo);\n$check";
+            print $fh "$c &certinfo);\n$check";
          }
          elsif(($info eq "TLS_SESSION") ||
                ($info eq "TLS_SSL_PTR")) {
-            print "$c &tlssession);\n$check";
+            print $fh "$c &tlssession);\n$check";
          }
          else {
             print STDERR "$info/$type is unsupported\n";
@@ -353,17 +634,23 @@ while(<STDIN>) {
     }
 }
 
+print $fh <<FOOTER
 
-print <<FOOTER
-  curl_easy_setopt(curl, (CURLoption)1, 0);
-  res = CURLE_OK;
+  /* NOLINTNEXTLINE(clang-analyzer-optin.core.EnumCastOutOfRange) */
+  curl_easy_setopt(curl, (CURLoption)1, 0L);
+  result = CURLE_OK;
 test_cleanup:
   curl_easy_cleanup(curl);
   curl_easy_cleanup(dep);
   curl_share_cleanup(share);
   curl_global_cleanup();
 
-  return (int)res;
+  if(!result)
+    puts("ok");
+  return result;
 }
 FOOTER
     ;
+
+close($fh);
+rename($tempfile, $ARGV[0]);
diff --git a/third-party/curl/tests/libtest/notexists.pl b/third-party/curl/tests/libtest/notexists.pl
deleted file mode 100644
index 2bc9bb5a39..0000000000
--- a/third-party/curl/tests/libtest/notexists.pl
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Check that given arguments do not exist on filesystem.
-my $code = 0;
-if ($#ARGV < 0) {
-    print "Usage: $0 file1 [fileN]\n";
-    exit 2;
-}
-while (@ARGV) {
-    my $fname = shift @ARGV;
-    if (-e $fname) {
-        print "Found '$fname' when not supposed to exist.\n";
-        $code = 1;
-    }
-}
-exit $code;
diff --git a/third-party/curl/tests/libtest/sethostname.c b/third-party/curl/tests/libtest/sethostname.c
deleted file mode 100644
index 9dcad976c8..0000000000
--- a/third-party/curl/tests/libtest/sethostname.c
+++ /dev/null
@@ -1,43 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "curl_setup.h"
-
-#include "sethostname.h"
-
-/*
- * we force our own host name, in order to make some tests machine independent
- */
-
-int gethostname(char *name, GETHOSTNAME_TYPE_ARG2 namelen)
-{
-  const char *force_hostname = getenv("CURL_GETHOSTNAME");
-  if(force_hostname) {
-    strncpy(name, force_hostname, namelen);
-    name[namelen-1] = '\0';
-    return 0;
-  }
-
-  /* LD_PRELOAD used, but no hostname set, we'll just return a failure */
-  return -1;
-}
diff --git a/third-party/curl/tests/libtest/sethostname.h b/third-party/curl/tests/libtest/sethostname.h
deleted file mode 100644
index 1ffcba1109..0000000000
--- a/third-party/curl/tests/libtest/sethostname.h
+++ /dev/null
@@ -1,42 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#ifdef CURL_STATICLIB
-#  define LIBHOSTNAME_EXTERN
-#elif defined(WIN32)
-#  define LIBHOSTNAME_EXTERN  __declspec(dllexport)
-#elif defined(CURL_HIDDEN_SYMBOLS)
-#  define LIBHOSTNAME_EXTERN CURL_EXTERN_SYMBOL
-#else
-#  define LIBHOSTNAME_EXTERN
-#endif
-
-#ifdef USE_WINSOCK
-#  define FUNCALLCONV __stdcall
-#else
-#  define FUNCALLCONV
-#endif
-
-LIBHOSTNAME_EXTERN int FUNCALLCONV
-  gethostname(char *name, GETHOSTNAME_TYPE_ARG2 namelen);
diff --git a/third-party/curl/tests/libtest/stub_gssapi.c b/third-party/curl/tests/libtest/stub_gssapi.c
deleted file mode 100644
index 634dddfd01..0000000000
--- a/third-party/curl/tests/libtest/stub_gssapi.c
+++ /dev/null
@@ -1,462 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-/* Only provides the bare minimum to link with libcurl */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include "stub_gssapi.h"
-
-/* !checksrc! disable SNPRINTF all */
-
-#define MAX_CREDS_LENGTH 250
-#define APPROX_TOKEN_LEN 250
-
-enum min_err_code {
-    GSS_OK = 0,
-    GSS_NO_MEMORY,
-    GSS_INVALID_ARGS,
-    GSS_INVALID_CREDS,
-    GSS_INVALID_CTX,
-    GSS_SERVER_ERR,
-    GSS_NO_MECH,
-    GSS_LAST
-};
-
-static const char *min_err_table[] = {
-  "stub-gss: no error",
-  "stub-gss: no memory",
-  "stub-gss: invalid arguments",
-  "stub-gss: invalid credentials",
-  "stub-gss: invalid context",
-  "stub-gss: server returned error",
-  "stub-gss: cannot find a mechanism",
-  NULL
-};
-
-struct gss_ctx_id_t_desc_struct {
-  enum { NONE, KRB5, NTLM1, NTLM3 } sent;
-  int have_krb5;
-  int have_ntlm;
-  OM_uint32 flags;
-  char creds[MAX_CREDS_LENGTH];
-};
-
-/* simple implementation of strndup(), which isn't portable */
-static char *my_strndup(const char *ptr, size_t len)
-{
-  char *copy = malloc(len + 1);
-  if(!copy)
-    return NULL;
-  memcpy(copy, ptr, len);
-  copy[len] = '\0';
-  return copy;
-}
-
-OM_uint32 gss_init_sec_context(OM_uint32 *min,
-            gss_const_cred_id_t initiator_cred_handle,
-            gss_ctx_id_t *context_handle,
-            gss_const_name_t target_name,
-            const gss_OID mech_type,
-            OM_uint32 req_flags,
-            OM_uint32 time_req,
-            const gss_channel_bindings_t input_chan_bindings,
-            const gss_buffer_t input_token,
-            gss_OID *actual_mech_type,
-            gss_buffer_t output_token,
-            OM_uint32 *ret_flags,
-            OM_uint32 *time_rec)
-{
-  /* The token will be encoded in base64 */
-  int length = APPROX_TOKEN_LEN * 3 / 4;
-  int used = 0;
-  char *token = NULL;
-  const char *creds = NULL;
-  gss_ctx_id_t ctx = NULL;
-
-  (void)initiator_cred_handle;
-  (void)mech_type;
-  (void)time_req;
-  (void)input_chan_bindings;
-  (void)actual_mech_type;
-
-  if(!min)
-    return GSS_S_FAILURE;
-
-  *min = 0;
-
-  if(!context_handle || !target_name || !output_token) {
-    *min = GSS_INVALID_ARGS;
-    return GSS_S_FAILURE;
-  }
-
-  creds = getenv("CURL_STUB_GSS_CREDS");
-  if(!creds || strlen(creds) >= MAX_CREDS_LENGTH) {
-    *min = GSS_INVALID_CREDS;
-    return GSS_S_FAILURE;
-  }
-
-  ctx = *context_handle;
-  if(ctx && strcmp(ctx->creds, creds)) {
-    *min = GSS_INVALID_CREDS;
-    return GSS_S_FAILURE;
-  }
-
-  output_token->length = 0;
-  output_token->value = NULL;
-
-  if(input_token && input_token->length) {
-    if(!ctx) {
-      *min = GSS_INVALID_CTX;
-      return GSS_S_FAILURE;
-    }
-
-    /* Server response, either D (RA==) or C (Qw==) */
-    if(((char *) input_token->value)[0] == 'D') {
-      /* Done */
-      switch(ctx->sent) {
-      case KRB5:
-      case NTLM3:
-        if(ret_flags)
-          *ret_flags = ctx->flags;
-        if(time_rec)
-          *time_rec = GSS_C_INDEFINITE;
-        return GSS_S_COMPLETE;
-      default:
-        *min = GSS_SERVER_ERR;
-        return GSS_S_FAILURE;
-      }
-    }
-
-    if(((char *) input_token->value)[0] != 'C') {
-      /* We only support Done or Continue */
-      *min = GSS_SERVER_ERR;
-      return GSS_S_FAILURE;
-    }
-
-    /* Continue */
-    switch(ctx->sent) {
-    case KRB5:
-      /* We sent KRB5 and it failed, let's try NTLM */
-      if(ctx->have_ntlm) {
-        ctx->sent = NTLM1;
-        break;
-      }
-      else {
-        *min = GSS_SERVER_ERR;
-        return GSS_S_FAILURE;
-      }
-    case NTLM1:
-      ctx->sent = NTLM3;
-      break;
-    default:
-      *min = GSS_SERVER_ERR;
-      return GSS_S_FAILURE;
-    }
-  }
-  else {
-    if(ctx) {
-      *min = GSS_INVALID_CTX;
-      return GSS_S_FAILURE;
-    }
-
-    ctx = (gss_ctx_id_t) calloc(sizeof(*ctx), 1);
-    if(!ctx) {
-      *min = GSS_NO_MEMORY;
-      return GSS_S_FAILURE;
-    }
-
-    if(strstr(creds, "KRB5"))
-      ctx->have_krb5 = 1;
-
-    if(strstr(creds, "NTLM"))
-      ctx->have_ntlm = 1;
-
-    if(ctx->have_krb5)
-      ctx->sent = KRB5;
-    else if(ctx->have_ntlm)
-      ctx->sent = NTLM1;
-    else {
-      free(ctx);
-      *min = GSS_NO_MECH;
-      return GSS_S_FAILURE;
-    }
-
-    strcpy(ctx->creds, creds);
-    ctx->flags = req_flags;
-  }
-
-  token = malloc(length);
-  if(!token) {
-    free(ctx);
-    *min = GSS_NO_MEMORY;
-    return GSS_S_FAILURE;
-  }
-
-  /* Token format: creds:target:type:padding */
-  /* Note: this is using the *real* snprintf() and not the curl provided
-     one */
-  used = snprintf(token, length, "%s:%s:%d:", creds,
-                  (char *) target_name, ctx->sent);
-
-  if(used >= length) {
-    free(token);
-    free(ctx);
-    *min = GSS_NO_MEMORY;
-    return GSS_S_FAILURE;
-  }
-
-  /* Overwrite null terminator */
-  memset(token + used, 'A', length - used);
-
-  *context_handle = ctx;
-
-  output_token->value = token;
-  output_token->length = length;
-
-  return GSS_S_CONTINUE_NEEDED;
-}
-
-OM_uint32 gss_delete_sec_context(OM_uint32 *min,
-                                 gss_ctx_id_t *context_handle,
-                                 gss_buffer_t output_token)
-{
-  (void)output_token;
-
-  if(!min)
-    return GSS_S_FAILURE;
-
-  if(!context_handle) {
-    *min = GSS_INVALID_CTX;
-    return GSS_S_FAILURE;
-  }
-
-  free(*context_handle);
-  *context_handle = NULL;
-  *min = 0;
-
-  return GSS_S_COMPLETE;
-}
-
-OM_uint32 gss_release_buffer(OM_uint32 *min,
-                             gss_buffer_t buffer)
-{
-  if(min)
-    *min = 0;
-
-  if(buffer && buffer->length) {
-    free(buffer->value);
-    buffer->length = 0;
-  }
-
-  return GSS_S_COMPLETE;
-}
-
-OM_uint32 gss_import_name(OM_uint32 *min,
-                          const gss_buffer_t input_name_buffer,
-                          const gss_OID input_name_type,
-                          gss_name_t *output_name)
-{
-  char *name = NULL;
-  (void)input_name_type;
-
-  if(!min)
-    return GSS_S_FAILURE;
-
-  if(!input_name_buffer || !output_name) {
-    *min = GSS_INVALID_ARGS;
-    return GSS_S_FAILURE;
-  }
-
-  name = my_strndup(input_name_buffer->value, input_name_buffer->length);
-  if(!name) {
-    *min = GSS_NO_MEMORY;
-    return GSS_S_FAILURE;
-  }
-
-  *output_name = (gss_name_t) name;
-  *min = 0;
-
-  return GSS_S_COMPLETE;
-}
-
-OM_uint32 gss_release_name(OM_uint32 *min,
-                           gss_name_t *input_name)
-{
-  if(min)
-    *min = 0;
-
-  if(input_name)
-    free(*input_name);
-
-  return GSS_S_COMPLETE;
-}
-
-OM_uint32 gss_display_status(OM_uint32 *min,
-                             OM_uint32 status_value,
-                             int status_type,
-                             const gss_OID mech_type,
-                             OM_uint32 *message_context,
-                             gss_buffer_t status_string)
-{
-  const char maj_str[] = "Stub GSS error";
-  (void)mech_type;
-  if(min)
-    *min = 0;
-
-  if(message_context)
-    *message_context = 0;
-
-  if(status_string) {
-    status_string->value = NULL;
-    status_string->length = 0;
-
-    if(status_value >= GSS_LAST)
-      return GSS_S_FAILURE;
-
-    switch(status_type) {
-      case GSS_C_GSS_CODE:
-        status_string->value = strdup(maj_str);
-        break;
-      case GSS_C_MECH_CODE:
-        status_string->value = strdup(min_err_table[status_value]);
-        break;
-      default:
-        return GSS_S_FAILURE;
-    }
-
-    if(status_string->value)
-      status_string->length = strlen(status_string->value);
-    else
-      return GSS_S_FAILURE;
-  }
-
-  return GSS_S_COMPLETE;
-}
-
-/* Stubs returning error */
-
-OM_uint32 gss_display_name(OM_uint32 *min,
-                           gss_const_name_t input_name,
-                           gss_buffer_t output_name_buffer,
-                           gss_OID *output_name_type)
-{
-  (void)min;
-  (void)input_name;
-  (void)output_name_buffer;
-  (void)output_name_type;
-  return GSS_S_FAILURE;
-}
-
-OM_uint32 gss_inquire_context(OM_uint32 *min,
-                              gss_const_ctx_id_t context_handle,
-                              gss_name_t *src_name,
-                              gss_name_t *targ_name,
-                              OM_uint32 *lifetime_rec,
-                              gss_OID *mech_type,
-                              OM_uint32 *ctx_flags,
-                              int *locally_initiated,
-                              int *open_context)
-{
-  (void)min;
-  (void)context_handle;
-  (void)src_name;
-  (void)targ_name;
-  (void)lifetime_rec;
-  (void)mech_type;
-  (void)ctx_flags;
-  (void)locally_initiated;
-  (void)open_context;
-  return GSS_S_FAILURE;
-}
-
-OM_uint32 gss_wrap(OM_uint32 *min,
-                   gss_const_ctx_id_t context_handle,
-                   int conf_req_flag,
-                   gss_qop_t qop_req,
-                   const gss_buffer_t input_message_buffer,
-                   int *conf_state,
-                   gss_buffer_t output_message_buffer)
-{
-  (void)min;
-  (void)context_handle;
-  (void)conf_req_flag;
-  (void)qop_req;
-  (void)input_message_buffer;
-  (void)conf_state;
-  (void)output_message_buffer;
-  return GSS_S_FAILURE;
-}
-
-OM_uint32 gss_unwrap(OM_uint32 *min,
-                     gss_const_ctx_id_t context_handle,
-                     const gss_buffer_t input_message_buffer,
-                     gss_buffer_t output_message_buffer,
-                     int *conf_state,
-                     gss_qop_t *qop_state)
-{
-  (void)min;
-  (void)context_handle;
-  (void)input_message_buffer;
-  (void)output_message_buffer;
-  (void)conf_state;
-  (void)qop_state;
-  return GSS_S_FAILURE;
-}
-
-OM_uint32 gss_seal(OM_uint32 *min,
-                   gss_ctx_id_t context_handle,
-                   int conf_req_flag,
-                   int qop_req,
-                   gss_buffer_t input_message_buffer,
-                   int *conf_state,
-                   gss_buffer_t output_message_buffer)
-{
-  (void)min;
-  (void)context_handle;
-  (void)conf_req_flag;
-  (void)qop_req;
-  (void)input_message_buffer;
-  (void)conf_state;
-  (void)output_message_buffer;
-  return GSS_S_FAILURE;
-}
-
-OM_uint32 gss_unseal(OM_uint32 *min,
-                     gss_ctx_id_t context_handle,
-                     gss_buffer_t input_message_buffer,
-                     gss_buffer_t output_message_buffer,
-                     int *conf_state,
-                     int *qop_state)
-{
-  (void)min;
-  (void)context_handle;
-  (void)input_message_buffer;
-  (void)output_message_buffer;
-  (void)conf_state;
-  (void)qop_state;
-  return GSS_S_FAILURE;
-}
diff --git a/third-party/curl/tests/libtest/stub_gssapi.h b/third-party/curl/tests/libtest/stub_gssapi.h
deleted file mode 100644
index d29c69e8a1..0000000000
--- a/third-party/curl/tests/libtest/stub_gssapi.h
+++ /dev/null
@@ -1,184 +0,0 @@
-#ifndef HEADER_CURL_GSSAPI_STUBS_H
-#define HEADER_CURL_GSSAPI_STUBS_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-/* Roughly based on Heimdal's gssapi.h */
-
-#include <stdint.h>
-#include <stddef.h>
-
-#define GSS_ERROR(status) (status & 0x80000000)
-
-#define GSS_S_COMPLETE 0
-#define GSS_S_FAILURE (0x80000000)
-#define GSS_S_CONTINUE_NEEDED (1ul)
-
-#define GSS_C_QOP_DEFAULT 0
-#define GSS_C_NO_OID ((gss_OID) 0)
-#define GSS_C_NO_NAME ((gss_name_t) 0)
-#define GSS_C_NO_BUFFER ((gss_buffer_t) 0)
-#define GSS_C_NO_CONTEXT ((gss_ctx_id_t) 0)
-#define GSS_C_NO_CREDENTIAL ((gss_cred_id_t) 0)
-#define GSS_C_NO_CHANNEL_BINDINGS ((gss_channel_bindings_t) 0)
-
-#define GSS_C_NULL_OID GSS_C_NO_OID
-
-#define GSS_C_EMPTY_BUFFER {0, NULL}
-
-#define GSS_C_AF_INET 2
-
-#define GSS_C_GSS_CODE 1
-#define GSS_C_MECH_CODE 2
-
-#define GSS_C_DELEG_FLAG 1
-#define GSS_C_MUTUAL_FLAG 2
-#define GSS_C_REPLAY_FLAG 4
-#define GSS_C_CONF_FLAG 16
-#define GSS_C_INTEG_FLAG 32
-
-/*
- * Expiration time of 2^32-1 seconds means infinite lifetime for a
- * credential or security context
- */
-#define GSS_C_INDEFINITE 0xfffffffful
-
-#define GSS_C_NT_HOSTBASED_SERVICE NULL
-
-typedef uint32_t OM_uint32;
-
-typedef OM_uint32 gss_qop_t;
-
-typedef struct gss_buffer_desc_struct {
-  size_t length;
-  void *value;
-} gss_buffer_desc, *gss_buffer_t;
-
-struct gss_cred_id_t_desc_struct;
-typedef struct gss_cred_id_t_desc_struct *gss_cred_id_t;
-typedef const struct gss_cred_id_t_desc_struct *gss_const_cred_id_t;
-
-struct gss_ctx_id_t_desc_struct;
-typedef struct gss_ctx_id_t_desc_struct *gss_ctx_id_t;
-typedef const struct gss_ctx_id_t_desc_struct *gss_const_ctx_id_t;
-
-struct gss_name_t_desc_struct;
-typedef struct gss_name_t_desc_struct *gss_name_t;
-typedef const struct gss_name_t_desc_struct *gss_const_name_t;
-
-typedef struct gss_OID_desc_struct {
-  OM_uint32 length;
-  void      *elements;
-} gss_OID_desc, *gss_OID;
-
-typedef struct gss_channel_bindings_struct {
-  OM_uint32 initiator_addrtype;
-  gss_buffer_desc initiator_address;
-  OM_uint32 acceptor_addrtype;
-  gss_buffer_desc acceptor_address;
-  gss_buffer_desc application_data;
-} *gss_channel_bindings_t;
-
-OM_uint32 gss_release_buffer(OM_uint32 * /* minor_status */,
-                             gss_buffer_t /* buffer */);
-
-OM_uint32 gss_init_sec_context(OM_uint32 * /* minor_status */,
-            gss_const_cred_id_t /* initiator_cred_handle */,
-            gss_ctx_id_t * /* context_handle */,
-            gss_const_name_t /* target_name */,
-            const gss_OID /* mech_type */,
-            OM_uint32 /* req_flags */,
-            OM_uint32 /* time_req */,
-            const gss_channel_bindings_t /* input_chan_bindings */,
-            const gss_buffer_t /* input_token */,
-            gss_OID * /* actual_mech_type */,
-            gss_buffer_t /* output_token */,
-            OM_uint32 * /* ret_flags */,
-            OM_uint32 * /* time_rec */);
-
-OM_uint32 gss_delete_sec_context(OM_uint32 * /* minor_status */,
-                                 gss_ctx_id_t * /* context_handle */,
-                                 gss_buffer_t /* output_token */);
-
-OM_uint32 gss_inquire_context(OM_uint32 * /* minor_status */,
-                              gss_const_ctx_id_t /* context_handle */,
-                              gss_name_t * /* src_name */,
-                              gss_name_t * /* targ_name */,
-                              OM_uint32 * /* lifetime_rec */,
-                              gss_OID * /* mech_type */,
-                              OM_uint32 * /* ctx_flags */,
-                              int * /* locally_initiated */,
-                              int * /* open_context */);
-
-OM_uint32 gss_wrap(OM_uint32 * /* minor_status */,
-                   gss_const_ctx_id_t /* context_handle */,
-                   int /* conf_req_flag */,
-                   gss_qop_t /* qop_req */,
-                   const gss_buffer_t /* input_message_buffer */,
-                   int * /* conf_state */,
-                   gss_buffer_t /* output_message_buffer */);
-
-OM_uint32 gss_unwrap(OM_uint32 * /* minor_status */,
-                     gss_const_ctx_id_t /* context_handle */,
-                     const gss_buffer_t /* input_message_buffer */,
-                     gss_buffer_t /* output_message_buffer */,
-                     int * /* conf_state */,
-                     gss_qop_t * /* qop_state */);
-
-OM_uint32 gss_seal(OM_uint32 * /* minor_status */,
-                   gss_ctx_id_t /* context_handle n */,
-                   int /* conf_req_flag */,
-                   int /* qop_req */,
-                   gss_buffer_t /* input_message_buffer */,
-                   int * /* conf_state */,
-                   gss_buffer_t /* output_message_buffer */);
-
-OM_uint32 gss_unseal(OM_uint32 * /* minor_status */,
-                     gss_ctx_id_t /* context_handle */,
-                     gss_buffer_t /* input_message_buffer */,
-                     gss_buffer_t /* output_message_buffer */,
-                     int * /* conf_state */,
-                     int * /* qop_state */);
-
-OM_uint32 gss_import_name(OM_uint32 * /* minor_status */,
-                          const gss_buffer_t /* input_name_buffer */,
-                          const gss_OID /* input_name_type */,
-                          gss_name_t * /* output_name */);
-
-OM_uint32 gss_release_name(OM_uint32 * /* minor_status */,
-                           gss_name_t * /* input_name */);
-
-OM_uint32 gss_display_name(OM_uint32 * /* minor_status */,
-                           gss_const_name_t /* input_name */,
-                           gss_buffer_t /* output_name_buffer */,
-                           gss_OID * /* output_name_type */);
-
-OM_uint32 gss_display_status(OM_uint32 * /* minor_status */,
-                             OM_uint32 /* status_value */,
-                             int /* status_type */,
-                             const gss_OID /* mech_type */,
-                             OM_uint32 * /* message_context */,
-                             gss_buffer_t /* status_string */);
-
-#endif /* HEADER_CURL_GSSAPI_STUBS_H */
diff --git a/third-party/curl/tests/libtest/test.h b/third-party/curl/tests/libtest/test.h
deleted file mode 100644
index 7eb7fdaa2f..0000000000
--- a/third-party/curl/tests/libtest/test.h
+++ /dev/null
@@ -1,500 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-/* Now include the curl_setup.h file from libcurl's private libdir (the source
-   version, but that might include "curl_config.h" from the build dir so we
-   need both of them in the include path), so that we get good in-depth
-   knowledge about the system we're building this on */
-
-#define CURL_NO_OLDIES
-
-#include "curl_setup.h"
-
-#include <curl/curl.h>
-
-#ifdef HAVE_SYS_SELECT_H
-/* since so many tests use select(), we can just as well include it here */
-#include <sys/select.h>
-#elif defined(HAVE_UNISTD_H)
-#include <unistd.h>
-#endif
-
-#include "curl_printf.h"
-
-#ifdef WIN32
-#define sleep(sec) Sleep ((sec)*1000)
-#endif
-
-#define test_setopt(A,B,C)                                      \
-  if((res = curl_easy_setopt((A), (B), (C))) != CURLE_OK)       \
-    goto test_cleanup
-
-#define test_multi_setopt(A,B,C)                                \
-  if((res = curl_multi_setopt((A), (B), (C))) != CURLE_OK)      \
-    goto test_cleanup
-
-extern char *libtest_arg2; /* set by first.c to the argv[2] or NULL */
-extern char *libtest_arg3; /* set by first.c to the argv[3] or NULL */
-
-/* argc and argv as passed in to the main() function */
-extern int test_argc;
-extern char **test_argv;
-
-extern struct timeval tv_test_start; /* for test timing */
-
-extern int select_wrapper(int nfds, fd_set *rd, fd_set *wr, fd_set *exc,
-                          struct timeval *tv);
-
-extern void wait_ms(int ms); /* wait this many milliseconds */
-
-extern int test(char *URL); /* the actual test function provided by each
-                               individual libXXX.c file */
-
-extern char *hexdump(const unsigned char *buffer, size_t len);
-
-extern int unitfail;
-
-/*
-** TEST_ERR_* values must be greater than CURL_LAST CURLcode in order
-** to avoid confusion with any CURLcode or CURLMcode. These TEST_ERR_*
-** codes are returned to signal test specific situations and should
-** not get mixed with CURLcode or CURLMcode values.
-**
-** For portability reasons TEST_ERR_* values should be less than 127.
-*/
-
-#define TEST_ERR_MAJOR_BAD     (CURLcode) 126
-#define TEST_ERR_RUNS_FOREVER  (CURLcode) 125
-#define TEST_ERR_EASY_INIT     (CURLcode) 124
-#define TEST_ERR_MULTI         (CURLcode) 123
-#define TEST_ERR_NUM_HANDLES   (CURLcode) 122
-#define TEST_ERR_SELECT        (CURLcode) 121
-#define TEST_ERR_SUCCESS       (CURLcode) 120
-#define TEST_ERR_FAILURE       (CURLcode) 119
-#define TEST_ERR_USAGE         (CURLcode) 118
-#define TEST_ERR_FOPEN         (CURLcode) 117
-#define TEST_ERR_FSTAT         (CURLcode) 116
-#define TEST_ERR_BAD_TIMEOUT   (CURLcode) 115
-
-/*
-** Macros for test source code readability/maintainability.
-**
-** All of the following macros require that an int data type 'res' variable
-** exists in scope where macro is used, and that it has been initialized to
-** zero before the macro is used.
-**
-** exe_* and chk_* macros are helper macros not intended to be used from
-** outside of this header file. Arguments 'Y' and 'Z' of these represent
-** source code file and line number, while Arguments 'A', 'B', etc, are
-** the arguments used to actually call a libcurl function.
-**
-** All easy_* and multi_* macros call a libcurl function and evaluate if
-** the function has succeeded or failed. When the function succeeds 'res'
-** variable is not set nor cleared and program continues normal flow. On
-** the other hand if function fails 'res' variable is set and a jump to
-** label 'test_cleanup' is performed.
-**
-** Every easy_* and multi_* macros have a res_easy_* and res_multi_* macro
-** counterpart that operates in the same way with the exception that no
-** jump takes place in case of failure. res_easy_* and res_multi_* macros
-** should be immediately followed by checking if 'res' variable has been
-** set.
-**
-** 'res' variable when set will hold a CURLcode, CURLMcode, or any of the
-** TEST_ERR_* values defined above. It is advisable to return this value
-** as test result.
-*/
-
-/* ---------------------------------------------------------------- */
-
-#define exe_easy_init(A,Y,Z) do {                                 \
-  if(((A) = curl_easy_init()) == NULL) {                          \
-    fprintf(stderr, "%s:%d curl_easy_init() failed\n", (Y), (Z)); \
-    res = TEST_ERR_EASY_INIT;                                     \
-  }                                                               \
-} while(0)
-
-#define res_easy_init(A) \
-  exe_easy_init((A), (__FILE__), (__LINE__))
-
-#define chk_easy_init(A,Y,Z) do { \
-  exe_easy_init((A), (Y), (Z));   \
-  if(res)                         \
-    goto test_cleanup;            \
-} while(0)
-
-#define easy_init(A) \
-  chk_easy_init((A), (__FILE__), (__LINE__))
-
-/* ---------------------------------------------------------------- */
-
-#define exe_multi_init(A,Y,Z) do {                                 \
-  if(((A) = curl_multi_init()) == NULL) {                          \
-    fprintf(stderr, "%s:%d curl_multi_init() failed\n", (Y), (Z)); \
-    res = TEST_ERR_MULTI;                                          \
-  }                                                                \
-} while(0)
-
-#define res_multi_init(A) \
-  exe_multi_init((A), (__FILE__), (__LINE__))
-
-#define chk_multi_init(A,Y,Z) do { \
-  exe_multi_init((A), (Y), (Z));   \
-  if(res)                          \
-    goto test_cleanup;             \
-} while(0)
-
-#define multi_init(A) \
-  chk_multi_init((A), (__FILE__), (__LINE__))
-
-/* ---------------------------------------------------------------- */
-
-#define exe_easy_setopt(A,B,C,Y,Z) do {                    \
-  CURLcode ec;                                             \
-  if((ec = curl_easy_setopt((A), (B), (C))) != CURLE_OK) { \
-    fprintf(stderr, "%s:%d curl_easy_setopt() failed, "    \
-            "with code %d (%s)\n",                         \
-            (Y), (Z), (int)ec, curl_easy_strerror(ec));    \
-    res = ec;                                              \
-  }                                                        \
-} while(0)
-
-#define res_easy_setopt(A, B, C) \
-  exe_easy_setopt((A), (B), (C), (__FILE__), (__LINE__))
-
-#define chk_easy_setopt(A, B, C, Y, Z) do { \
-  exe_easy_setopt((A), (B), (C), (Y), (Z)); \
-  if(res)                                   \
-    goto test_cleanup;                      \
-} while(0)
-
-#define easy_setopt(A, B, C) \
-  chk_easy_setopt((A), (B), (C), (__FILE__), (__LINE__))
-
-/* ---------------------------------------------------------------- */
-
-#define exe_multi_setopt(A, B, C, Y, Z) do {                \
-  CURLMcode ec;                                             \
-  if((ec = curl_multi_setopt((A), (B), (C))) != CURLM_OK) { \
-    fprintf(stderr, "%s:%d curl_multi_setopt() failed, "    \
-            "with code %d (%s)\n",                          \
-            (Y), (Z), (int)ec, curl_multi_strerror(ec));    \
-    res = TEST_ERR_MULTI;                                   \
-  }                                                         \
-} while(0)
-
-#define res_multi_setopt(A,B,C) \
-  exe_multi_setopt((A), (B), (C), (__FILE__), (__LINE__))
-
-#define chk_multi_setopt(A,B,C,Y,Z) do {     \
-  exe_multi_setopt((A), (B), (C), (Y), (Z)); \
-  if(res)                                    \
-    goto test_cleanup;                       \
-} while(0)
-
-#define multi_setopt(A,B,C) \
-  chk_multi_setopt((A), (B), (C), (__FILE__), (__LINE__))
-
-/* ---------------------------------------------------------------- */
-
-#define exe_multi_add_handle(A,B,Y,Z) do {                   \
-  CURLMcode ec;                                              \
-  if((ec = curl_multi_add_handle((A), (B))) != CURLM_OK) {   \
-    fprintf(stderr, "%s:%d curl_multi_add_handle() failed, " \
-            "with code %d (%s)\n",                           \
-            (Y), (Z), (int)ec, curl_multi_strerror(ec));     \
-    res = TEST_ERR_MULTI;                                    \
-  }                                                          \
-} while(0)
-
-#define res_multi_add_handle(A, B) \
-  exe_multi_add_handle((A), (B), (__FILE__), (__LINE__))
-
-#define chk_multi_add_handle(A, B, Y, Z) do { \
-  exe_multi_add_handle((A), (B), (Y), (Z));   \
-  if(res)                                     \
-    goto test_cleanup;                        \
-} while(0)
-
-#define multi_add_handle(A, B) \
-  chk_multi_add_handle((A), (B), (__FILE__), (__LINE__))
-
-/* ---------------------------------------------------------------- */
-
-#define exe_multi_remove_handle(A,B,Y,Z) do {                   \
-  CURLMcode ec;                                                 \
-  if((ec = curl_multi_remove_handle((A), (B))) != CURLM_OK) {   \
-    fprintf(stderr, "%s:%d curl_multi_remove_handle() failed, " \
-            "with code %d (%s)\n",                              \
-            (Y), (Z), (int)ec, curl_multi_strerror(ec));        \
-    res = TEST_ERR_MULTI;                                       \
-  }                                                             \
-} while(0)
-
-#define res_multi_remove_handle(A, B) \
-  exe_multi_remove_handle((A), (B), (__FILE__), (__LINE__))
-
-#define chk_multi_remove_handle(A, B, Y, Z) do { \
-  exe_multi_remove_handle((A), (B), (Y), (Z));   \
-  if(res)                                        \
-    goto test_cleanup;                           \
-} while(0)
-
-
-#define multi_remove_handle(A, B) \
-  chk_multi_remove_handle((A), (B), (__FILE__), (__LINE__))
-
-/* ---------------------------------------------------------------- */
-
-#define exe_multi_perform(A,B,Y,Z) do {                          \
-  CURLMcode ec;                                                  \
-  if((ec = curl_multi_perform((A), (B))) != CURLM_OK) {          \
-    fprintf(stderr, "%s:%d curl_multi_perform() failed, "        \
-            "with code %d (%s)\n",                               \
-            (Y), (Z), (int)ec, curl_multi_strerror(ec));         \
-    res = TEST_ERR_MULTI;                                        \
-  }                                                              \
-  else if(*((B)) < 0) {                                          \
-    fprintf(stderr, "%s:%d curl_multi_perform() succeeded, "     \
-            "but returned invalid running_handles value (%d)\n", \
-            (Y), (Z), (int)*((B)));                              \
-    res = TEST_ERR_NUM_HANDLES;                                  \
-  }                                                              \
-} while(0)
-
-#define res_multi_perform(A, B) \
-  exe_multi_perform((A), (B), (__FILE__), (__LINE__))
-
-#define chk_multi_perform(A, B, Y, Z) do { \
-  exe_multi_perform((A), (B), (Y), (Z));   \
-  if(res)                                  \
-    goto test_cleanup;                     \
-} while(0)
-
-#define multi_perform(A,B) \
-  chk_multi_perform((A), (B), (__FILE__), (__LINE__))
-
-/* ---------------------------------------------------------------- */
-
-#define exe_multi_fdset(A, B, C, D, E, Y, Z) do {                    \
-  CURLMcode ec;                                                      \
-  if((ec = curl_multi_fdset((A), (B), (C), (D), (E))) != CURLM_OK) { \
-    fprintf(stderr, "%s:%d curl_multi_fdset() failed, "              \
-            "with code %d (%s)\n",                                   \
-            (Y), (Z), (int)ec, curl_multi_strerror(ec));             \
-    res = TEST_ERR_MULTI;                                            \
-  }                                                                  \
-  else if(*((E)) < -1) {                                             \
-    fprintf(stderr, "%s:%d curl_multi_fdset() succeeded, "           \
-            "but returned invalid max_fd value (%d)\n",              \
-            (Y), (Z), (int)*((E)));                                  \
-    res = TEST_ERR_NUM_HANDLES;                                      \
-  }                                                                  \
-} while(0)
-
-#define res_multi_fdset(A, B, C, D, E) \
-  exe_multi_fdset((A), (B), (C), (D), (E), (__FILE__), (__LINE__))
-
-#define chk_multi_fdset(A, B, C, D, E, Y, Z) do {       \
-    exe_multi_fdset((A), (B), (C), (D), (E), (Y), (Z)); \
-    if(res)                                             \
-      goto test_cleanup;                                \
-  } while(0)
-
-#define multi_fdset(A, B, C, D, E) \
-  chk_multi_fdset((A), (B), (C), (D), (E), (__FILE__), (__LINE__))
-
-/* ---------------------------------------------------------------- */
-
-#define exe_multi_timeout(A,B,Y,Z) do {                      \
-  CURLMcode ec;                                              \
-  if((ec = curl_multi_timeout((A), (B))) != CURLM_OK) {      \
-    fprintf(stderr, "%s:%d curl_multi_timeout() failed, "    \
-            "with code %d (%s)\n",                           \
-            (Y), (Z), (int)ec, curl_multi_strerror(ec));     \
-    res = TEST_ERR_BAD_TIMEOUT;                              \
-  }                                                          \
-  else if(*((B)) < -1L) {                                    \
-    fprintf(stderr, "%s:%d curl_multi_timeout() succeeded, " \
-            "but returned invalid timeout value (%ld)\n",    \
-            (Y), (Z), (long)*((B)));                         \
-    res = TEST_ERR_BAD_TIMEOUT;                              \
-  }                                                          \
-} while(0)
-
-#define res_multi_timeout(A, B) \
-  exe_multi_timeout((A), (B), (__FILE__), (__LINE__))
-
-#define chk_multi_timeout(A, B, Y, Z) do { \
-    exe_multi_timeout((A), (B), (Y), (Z)); \
-    if(res)                                \
-      goto test_cleanup;                   \
-  } while(0)
-
-#define multi_timeout(A, B) \
-  chk_multi_timeout((A), (B), (__FILE__), (__LINE__))
-
-/* ---------------------------------------------------------------- */
-
-#define exe_multi_poll(A,B,C,D,E,Y,Z) do {                          \
-  CURLMcode ec;                                                     \
-  if((ec = curl_multi_poll((A), (B), (C), (D), (E))) != CURLM_OK) { \
-    fprintf(stderr, "%s:%d curl_multi_poll() failed, "              \
-            "with code %d (%s)\n",                                  \
-            (Y), (Z), (int)ec, curl_multi_strerror(ec));            \
-    res = TEST_ERR_MULTI;                                           \
-  }                                                                 \
-  else if(*((E)) < 0) {                                             \
-    fprintf(stderr, "%s:%d curl_multi_poll() succeeded, "           \
-            "but returned invalid numfds value (%d)\n",             \
-            (Y), (Z), (int)*((E)));                                 \
-    res = TEST_ERR_NUM_HANDLES;                                     \
-  }                                                                 \
-} while(0)
-
-#define res_multi_poll(A, B, C, D, E) \
-  exe_multi_poll((A), (B), (C), (D), (E), (__FILE__), (__LINE__))
-
-#define chk_multi_poll(A, B, C, D, E, Y, Z) do {     \
-  exe_multi_poll((A), (B), (C), (D), (E), (Y), (Z)); \
-  if(res)                                            \
-    goto test_cleanup;                               \
-} while(0)
-
-#define multi_poll(A, B, C, D, E) \
-  chk_multi_poll((A), (B), (C), (D), (E), (__FILE__), (__LINE__))
-
-/* ---------------------------------------------------------------- */
-
-#define exe_multi_wakeup(A,Y,Z) do {                     \
-  CURLMcode ec;                                          \
-  if((ec = curl_multi_wakeup((A))) != CURLM_OK) {        \
-    fprintf(stderr, "%s:%d curl_multi_wakeup() failed, " \
-            "with code %d (%s)\n",                       \
-            (Y), (Z), (int)ec, curl_multi_strerror(ec)); \
-    res = TEST_ERR_MULTI;                                \
-  }                                                      \
-} while(0)
-
-#define res_multi_wakeup(A) \
-  exe_multi_wakeup((A), (__FILE__), (__LINE__))
-
-#define chk_multi_wakeup(A, Y, Z) do { \
-  exe_multi_wakeup((A), (Y), (Z));     \
-  if(res)                              \
-    goto test_cleanup;                 \
-} while(0)
-
-#define multi_wakeup(A) \
-  chk_multi_wakeup((A), (__FILE__), (__LINE__))
-
-/* ---------------------------------------------------------------- */
-
-#define exe_select_test(A, B, C, D, E, Y, Z) do {               \
-    int ec;                                                     \
-    if(select_wrapper((A), (B), (C), (D), (E)) == -1) {         \
-      ec = SOCKERRNO;                                           \
-      fprintf(stderr, "%s:%d select() failed, with "            \
-              "errno %d (%s)\n",                                \
-              (Y), (Z), ec, strerror(ec));                      \
-      res = TEST_ERR_SELECT;                                    \
-    }                                                           \
-  } while(0)
-
-#define res_select_test(A, B, C, D, E) \
-  exe_select_test((A), (B), (C), (D), (E), (__FILE__), (__LINE__))
-
-#define chk_select_test(A, B, C, D, E, Y, Z) do {       \
-    exe_select_test((A), (B), (C), (D), (E), (Y), (Z)); \
-    if(res)                                             \
-      goto test_cleanup;                                \
-  } while(0)
-
-#define select_test(A, B, C, D, E) \
-  chk_select_test((A), (B), (C), (D), (E), (__FILE__), (__LINE__))
-
-/* ---------------------------------------------------------------- */
-
-#define start_test_timing() do { \
-  tv_test_start = tutil_tvnow(); \
-} while(0)
-
-#define exe_test_timedout(Y,Z) do {                                       \
-  long timediff = tutil_tvdiff(tutil_tvnow(), tv_test_start);             \
-  if(timediff > (TEST_HANG_TIMEOUT)) {                                    \
-    fprintf(stderr, "%s:%d ABORTING TEST, since it seems "                \
-            "that it would have run forever (%ld ms > %ld ms)\n",         \
-            (Y), (Z), timediff, (long) (TEST_HANG_TIMEOUT));              \
-    res = TEST_ERR_RUNS_FOREVER;                                          \
-  }                                                                       \
-} while(0)
-
-#define res_test_timedout() \
-  exe_test_timedout((__FILE__), (__LINE__))
-
-#define chk_test_timedout(Y, Z) do { \
-    exe_test_timedout(Y, Z);         \
-    if(res)                          \
-      goto test_cleanup;             \
-  } while(0)
-
-#define abort_on_test_timeout() \
-  chk_test_timedout((__FILE__), (__LINE__))
-
-/* ---------------------------------------------------------------- */
-
-#define exe_global_init(A,Y,Z) do {                     \
-  CURLcode ec;                                          \
-  if((ec = curl_global_init((A))) != CURLE_OK) {        \
-    fprintf(stderr, "%s:%d curl_global_init() failed, " \
-            "with code %d (%s)\n",                      \
-            (Y), (Z), (int)ec, curl_easy_strerror(ec)); \
-    res = ec;                                           \
-  }                                                     \
-} while(0)
-
-#define res_global_init(A) \
-  exe_global_init((A), (__FILE__), (__LINE__))
-
-#define chk_global_init(A, Y, Z) do { \
-    exe_global_init((A), (Y), (Z));   \
-    if(res)                           \
-      return res;                     \
-  } while(0)
-
-/* global_init() is different than other macros. In case of
-   failure it 'return's instead of going to 'test_cleanup'. */
-
-#define global_init(A) \
-  chk_global_init((A), (__FILE__), (__LINE__))
-
-#define NO_SUPPORT_BUILT_IN                     \
-  int test(char *URL)                           \
-  {                                             \
-    (void)URL;                                  \
-    fprintf(stderr, "Missing support\n");       \
-    return 1;                                   \
-  }
-
-/* ---------------------------------------------------------------- */
diff --git a/third-party/curl/tests/libtest/test1013.pl b/third-party/curl/tests/libtest/test1013.pl
index aec7fb9020..b6bd5be7ff 100644
--- a/third-party/curl/tests/libtest/test1013.pl
+++ b/third-party/curl/tests/libtest/test1013.pl
@@ -22,51 +22,51 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+use strict;
+use warnings;
+
 # Determine if curl-config --protocols/--features matches the
 # curl --version protocols/features
-if ( $#ARGV != 2 )
-{
+if($#ARGV != 2) {
     print "Usage: $0 curl-config-script curl-version-output-file features|protocols\n";
     exit 3;
 }
 
-my $what=$ARGV[2];
+my $what = $ARGV[2];
 
 # Read the output of curl --version
-my $curl_protocols="";
-open(CURL, "$ARGV[1]") || die "Can't get curl $what list\n";
-while( <CURL> )
-{
-    $curl_protocols = lc($_) if ( /$what:/i );
+my $curl_protocols = "";
+open(CURL, $ARGV[1]) or die "Cannot get curl $what list\n";
+while(<CURL>) {
+    $curl_protocols = $_ if(/$what:/i);
 }
 close CURL;
 
 $curl_protocols =~ s/\r//;
 $curl_protocols =~ /\w+: (.*)$/;
-@curl = split / /,$1;
-
-# These features are not supported by curl-config
-@curl = grep(!/^(Debug|TrackMemory|CharConv)$/i, @curl);
-@curl = sort @curl;
+my @curl = split / /,$1;
 
 # Read the output of curl-config
 my @curl_config;
-open(CURLCONFIG, "sh $ARGV[0] --$what|") || die "Can't get curl-config $what list\n";
-while( <CURLCONFIG> )
-{
+open(CURLCONFIG, '-|', 'sh', $ARGV[0], "--$what") or die "Cannot get curl-config $what list\n";
+while(<CURLCONFIG>) {
     chomp;
-    # ignore curl-config --features not in curl's feature list
-    push @curl_config, lc($_);
+    $_ = lc($_) if($what eq "protocols");  # accept uppercase protocols in curl-config
+    push @curl_config, $_;
 }
 close CURLCONFIG;
 
-@curl_config = sort @curl_config;
+# allow order mismatch to handle autotools builds with no 'sort -f' available
+if($what eq "features") {
+    @curl = sort @curl;
+    @curl_config = sort @curl_config;
+}
 
 my $curlproto = join ' ', @curl;
 my $curlconfigproto = join ' ', @curl_config;
 
 my $different = $curlproto ne $curlconfigproto;
-if ($different) {
+if($different) {
     print "Mismatch in $what lists:\n";
     print "curl:        $curlproto\n";
     print "curl-config: $curlconfigproto\n";
diff --git a/third-party/curl/tests/libtest/test1022.pl b/third-party/curl/tests/libtest/test1022.pl
index 583b8f8562..a74a180e1d 100644
--- a/third-party/curl/tests/libtest/test1022.pl
+++ b/third-party/curl/tests/libtest/test1022.pl
@@ -22,32 +22,34 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+use strict;
+use warnings;
+
 # Determine if curl-config --version matches the curl --version
-if ( $#ARGV != 2 )
-{
+if($#ARGV != 2) {
     print "Usage: $0 curl-config-script curl-version-output-file version|vernum\n";
     exit 3;
 }
 
-my $what=$ARGV[2];
+my $what = $ARGV[2];
 
 # Read the output of curl --version
-open(CURL, "$ARGV[1]") || die "Can't open curl --version list in $ARGV[1]\n";
+open(CURL, $ARGV[1]) or die "Cannot open curl --version list in $ARGV[1]\n";
 $_ = <CURL>;
 chomp;
-/libcurl\/([\.\d]+((-DEV)|(-\d+))?)/;
+/libcurl\/([\.\d]+((-DEV)|(-rc\d)|(-\d+))?)/;
 my $version = $1;
 close CURL;
 
 my $curlconfigversion;
 
 # Read the output of curl-config --version/--vernum
-open(CURLCONFIG, "sh $ARGV[0] --$what|") || die "Can't get curl-config --$what list\n";
+open(CURLCONFIG, '-|', 'sh', $ARGV[0], "--$what") or die "Cannot get curl-config --$what list\n";
 $_ = <CURLCONFIG>;
 chomp;
-my $filever=$_;
-if ( $what eq "version" ) {
-    if($filever =~ /^libcurl ([\.\d]+((-DEV)|(-\d+))?)$/) {
+my $filever = $_;
+if($what eq "version") {
+    if($filever =~ /^libcurl ([\.\d]+((-DEV)|(-rc\d)|(-\d+))?)$/) {
         $curlconfigversion = $1;
     }
     else {
@@ -63,13 +65,13 @@ else { # "vernum" case
         $curlconfigversion = "illegal value";
     }
 
-    # Strip off the -DEV from the curl version if it's there
+    # Strip off the -DEV and -rc suffixes from the curl version if they are there
     $version =~ s/-\w*$//;
 }
 close CURLCONFIG;
 
 my $different = $version ne $curlconfigversion;
-if ($different || !$version) {
+if($different || !$version) {
     print "Mismatch in --version:\n";
     print "curl:        $version\n";
     print "curl-config: $curlconfigversion\n";
diff --git a/third-party/curl/tests/libtest/test307.pl b/third-party/curl/tests/libtest/test307.pl
index 862f0e9729..ddfa67be48 100644
--- a/third-party/curl/tests/libtest/test307.pl
+++ b/third-party/curl/tests/libtest/test307.pl
@@ -22,20 +22,20 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+use strict;
+use warnings;
+
 # Determine if the given curl executable supports the 'openssl' SSL engine
-if ( $#ARGV != 0 )
-{
+if($#ARGV != 0) {
     print "Usage: $0 curl-executable\n";
     exit 3;
 }
-if (!open(CURL, "@ARGV[0] -s --engine list|"))
-{
-    print "Can't get SSL engine list\n";
+if(!open(CURL, '-|', $ARGV[0], '-s', '--engine', 'list')) {
+    print "Cannot get SSL engine list\n";
     exit 2;
 }
-while( <CURL> )
-{
-    exit 0 if ( /openssl/ );
+while(<CURL>) {
+    exit 0 if(/openssl/);
 }
 close CURL;
 print "openssl engine not supported\n";
diff --git a/third-party/curl/tests/libtest/test610.pl b/third-party/curl/tests/libtest/test610.pl
index 0ef9330684..af63c3e6b3 100644
--- a/third-party/curl/tests/libtest/test610.pl
+++ b/third-party/curl/tests/libtest/test610.pl
@@ -22,9 +22,11 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+use strict;
+use warnings;
+
 # Perform simple file and directory manipulation in a portable way
-if ( $#ARGV <= 0 )
-{
+if($#ARGV <= 0) {
     print "Usage: $0 mkdir|rmdir|rm|move|gone path1 [path2] [more commands...]\n";
     exit 1;
 }
@@ -33,21 +35,21 @@ use File::Copy;
 while(@ARGV) {
     my $cmd = shift @ARGV;
     my $arg = shift @ARGV;
-    if ($cmd eq "mkdir") {
-        mkdir $arg || die "$!";
+    if($cmd eq "mkdir") {
+        mkdir $arg or die "$!";
     }
-    elsif ($cmd eq "rmdir") {
-        rmdir $arg || die "$!";
+    elsif($cmd eq "rmdir") {
+        rmdir $arg or die "$!";
     }
-    elsif ($cmd eq "rm") {
-        unlink $arg || die "$!";
+    elsif($cmd eq "rm") {
+        unlink $arg or die "$!";
     }
-    elsif ($cmd eq "move") {
+    elsif($cmd eq "move") {
         my $arg2 = shift @ARGV;
-        move($arg,$arg2) || die "$!";
+        move($arg,$arg2) or die "$!";
     }
-    elsif ($cmd eq "gone") {
-        ! -e $arg || die "Path $arg exists";
+    elsif($cmd eq "gone") {
+        ! -e $arg or die "Path $arg exists";
     } else {
         print "Unsupported command $cmd\n";
         exit 1;
diff --git a/third-party/curl/tests/libtest/test613.pl b/third-party/curl/tests/libtest/test613.pl
index 3ad7805af0..a404bb6139 100644
--- a/third-party/curl/tests/libtest/test613.pl
+++ b/third-party/curl/tests/libtest/test613.pl
@@ -22,12 +22,14 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+use strict;
+use warnings;
+
 # Prepare a directory with known files and clean up afterwards
 use Time::Local;
 
-if ( $#ARGV < 1 )
-{
-    print "Usage: $0 prepare|postprocess dir [logfile]\n";
+if($#ARGV < 1) {
+    print "Usage: $0 prepare|postprocess directory [logfile]\n";
     exit 1;
 }
 
@@ -37,51 +39,72 @@ sub errout {
     exit 1;
 }
 
-if ($ARGV[0] eq "prepare")
-{
+if($ARGV[0] eq "prepare") {
     my $dirname = $ARGV[1];
-    mkdir $dirname || errout "$!";
+    mkdir $dirname or errout "$!";
     chdir $dirname;
 
     # Create the files in alphabetical order, to increase the chances
     # of receiving a consistent set of directory contents regardless
     # of whether the server alphabetizes the results or not.
-    mkdir "asubdir" || errout "$!";
+    mkdir "asubdir" or errout "$!";
     chmod 0777, "asubdir";
 
-    open(FILE, ">plainfile.txt") || errout "$!";
+    open(FILE, ">plainfile.txt") or errout "$!";
     binmode FILE;
     print FILE "Test file to support curl test suite\n";
     close(FILE);
     # The mtime is specifically chosen to be an even number so that it can be
-    # represented exactly on a FAT filesystem.
+    # represented exactly on a FAT file system.
     utime time, timegm(0,0,12,1,0,100), "plainfile.txt";
     chmod 0666, "plainfile.txt";
 
-    open(FILE, ">rofile.txt") || errout "$!";
+    open(FILE, ">emptyfile.txt") or errout "$!";
+    binmode FILE;
+    close(FILE);
+    # The mtime is specifically chosen to be an even number so that it can be
+    # represented exactly on a FAT file system.
+    utime time, timegm(0,0,12,1,0,100), "emptyfile.txt";
+    chmod 0666, "emptyfile.txt";
+
+    open(FILE, ">rofile.txt") or errout "$!";
     binmode FILE;
     print FILE "Read-only test file to support curl test suite\n";
     close(FILE);
     # The mtime is specifically chosen to be an even number so that it can be
-    # represented exactly on a FAT filesystem.
+    # represented exactly on a FAT file system.
     utime time, timegm(0,0,12,31,11,100), "rofile.txt";
     chmod 0444, "rofile.txt";
+    if($^O eq 'cygwin') {
+      system('chattr', ('+r', 'rofile.txt'));
+    }
 
     exit 0;
 }
-elsif ($ARGV[0] eq "postprocess")
-{
+elsif($ARGV[0] eq "postprocess") {
     my $dirname = $ARGV[1];
-    my $logfile = $ARGV[2];
 
     # Clean up the test directory
+    if($^O eq 'cygwin') {
+      system('chattr', ('-r', "$dirname/rofile.txt"));
+    }
+    chmod 0666, "$dirname/rofile.txt";
     unlink "$dirname/rofile.txt";
+    unlink "$dirname/emptyfile.txt";
     unlink "$dirname/plainfile.txt";
     rmdir "$dirname/asubdir";
 
-    rmdir $dirname || die "$!";
+    rmdir $dirname or die "$!";
 
-    if ($logfile) {
+    if($#ARGV >= 3) {  # Verify mtime if requested
+        my $checkfile = $ARGV[2];
+        my $expected_mtime = int($ARGV[3]);
+        my $mtime = (stat($checkfile))[9];
+        exit ($mtime != $expected_mtime);
+    }
+
+    my $logfile = $ARGV[2];
+    if($logfile && -s $logfile) {
         # Process the directory file to remove all information that
         # could be inconsistent from one test run to the next (e.g.
         # file date) or may be unsupported on some platforms (e.g.
@@ -97,42 +120,35 @@ elsif ($ARGV[0] eq "postprocess")
         # -r-?r-?r-?   12 U         U              47 Dec 31  2000 rofile.txt
 
         my @canondir;
-        open(IN, "<$logfile") || die "$!";
-        while (<IN>) {
+        open(IN, "<$logfile") or die "$!";
+        while(<IN>) {
             /^(.)(..).(..).(..).\s*(\S+)\s+\S+\s+\S+\s+(\S+)\s+(\S+\s+\S+\s+\S+)\s+(.*)$/;
-            if ($1 eq "d") {
+            if($1 eq "d") {
                 # Skip current and parent directory listing, because some SSH
                 # servers (eg. OpenSSH for Windows) are not listing those
-                if ($8 eq "." || $8 eq "..") {
+                if($8 eq "." || $8 eq "..") {
                     next;
                 }
                 # Erase all directory metadata except for the name, as it is not
-                # consistent for across all test systems and filesystems
+                # consistent for across all test systems and file systems
                 push @canondir, "d?????????    N U         U               N ???  N NN:NN $8\n";
-            } elsif ($1 eq "-") {
-                # Replace missing group and other permissions with user
-                # permissions (eg. on Windows) due to them being shown as *
-                my ($u, $g, $o) = ($2, $3, $4);
-                if($g eq "**") {
-                    $g = $u;
-                }
-                if($o eq "**") {
-                    $o = $u;
-                }
+            } elsif($1 eq "-") {
+                # Ignore group and other permissions, because these may vary on
+                # some systems (e.g. on Windows)
                 # Erase user and group names, as they are not consistent across
                 # all test systems
-                my $line = sprintf("%s%s?%s?%s?%5d U         U %15d %s %s\n", $1,$u,$g,$o,$5,$6,$7,$8);
+                my $line = sprintf("%s%s???????%5d U         U %15d %s %s\n", $1,$2,$5,$6,$7,$8);
                 push @canondir, $line;
             } else {
-                # Unexpected format; just pass it through and let the test fail
+                # Unexpected format; pass it through and let the test fail
                 push @canondir, $_;
             }
         }
         close(IN);
 
-        @canondir = sort {substr($a,57) cmp substr($b,57)} @canondir;
+        @canondir = sort {substr($a, 57) cmp substr($b, 57)} @canondir;
         my $newfile = $logfile . ".new";
-        open(OUT, ">$newfile") || die "$!";
+        open(OUT, ">$newfile") or die "$!";
         print OUT join('', @canondir);
         close(OUT);
 
diff --git a/third-party/curl/tests/libtest/testtrace.c b/third-party/curl/tests/libtest/testtrace.c
index f78a9b9433..2433c84889 100644
--- a/third-party/curl/tests/libtest/testtrace.c
+++ b/third-party/curl/tests/libtest/testtrace.c
@@ -21,20 +21,18 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-
-#include "test.h"
-#include "testutil.h"
 #include "testtrace.h"
-#include "memdebug.h"
 
-struct libtest_trace_cfg libtest_debug_config;
+#include <toolx/tool_time.h>
+
+struct libtest_trace_cfg debug_config;
 
 static time_t epoch_offset; /* for test time tracing */
 static int    known_offset; /* for test time tracing */
 
-static
-void libtest_debug_dump(const char *timebuf, const char *text, FILE *stream,
-                        const unsigned char *ptr, size_t size, int nohex)
+void debug_dump(const char *timebuf, const char *text,
+                FILE *stream, const unsigned char *ptr,
+                size_t size, bool nohex)
 {
   size_t i;
   size_t c;
@@ -45,36 +43,35 @@ void libtest_debug_dump(const char *timebuf, const char *text, FILE *stream,
     /* without the hex output, we can fit more on screen */
     width = 0x40;
 
-  fprintf(stream, "%s%s, %zu bytes (0x%zx)\n", timebuf, text,
-          size, size);
+  curl_mfprintf(stream, "%s%s, %zu bytes (0x%zx)\n", timebuf, text,
+                size, size);
 
   for(i = 0; i < size; i += width) {
 
-    fprintf(stream, "%04zx: ", i);
+    curl_mfprintf(stream, "%04zx: ", i);
 
     if(!nohex) {
       /* hex not disabled, show it */
       for(c = 0; c < width; c++)
         if(i + c < size)
-          fprintf(stream, "%02x ", ptr[i + c]);
+          curl_mfprintf(stream, "%02x ", ptr[i + c]);
         else
           fputs("   ", stream);
     }
 
     for(c = 0; (c < width) && (i + c < size); c++) {
       /* check for 0D0A; if found, skip past and start a new line of output */
-      if(nohex &&
-         (i + c + 1 < size) && (ptr[i + c] == 0x0D) &&
-         (ptr[i + c + 1] == 0x0A)) {
+      if(nohex && (i + c + 1 < size) && ptr[i + c] == 0x0D &&
+         ptr[i + c + 1] == 0x0A) {
         i += (c + 2 - width);
         break;
       }
-      fprintf(stream, "%c", ((ptr[i + c] >= 0x20) && (ptr[i + c] < 0x80)) ?
-              ptr[i + c] : '.');
-      /* check again for 0D0A, to avoid an extra \n if it's at width */
-      if(nohex &&
-         (i + c + 2 < size) && (ptr[i + c + 1] == 0x0D) &&
-         (ptr[i + c + 2] == 0x0A)) {
+      curl_mfprintf(stream, "%c",
+                    ((ptr[i + c] >= 0x20) && (ptr[i + c] < 0x80)) ?
+                    ptr[i + c] : '.');
+      /* check again for 0D0A, to avoid an extra \n if it is at width */
+      if(nohex && (i + c + 2 < size) && ptr[i + c + 1] == 0x0D &&
+         ptr[i + c + 2] == 0x0A) {
         i += (c + 3 - width);
         break;
       }
@@ -84,43 +81,41 @@ void libtest_debug_dump(const char *timebuf, const char *text, FILE *stream,
   fflush(stream);
 }
 
-int libtest_debug_cb(CURL *handle, curl_infotype type,
-                     unsigned char *data, size_t size,
-                     void *userp)
+int libtest_debug_cb(CURL *curl, curl_infotype type,
+                     char *data, size_t size, void *userp)
 {
-
   struct libtest_trace_cfg *trace_cfg = userp;
   const char *text;
-  struct timeval tv;
   char timebuf[20];
-  char *timestr;
-  time_t secs;
+  const char *timestr;
 
-  (void)handle;
+  (void)curl;
 
   timebuf[0] = '\0';
   timestr = &timebuf[0];
 
   if(trace_cfg->tracetime) {
-    struct tm *now;
-    tv = tutil_tvnow();
+    CURLcode result;
+    struct tm now;
+    struct curltime tv;
+    time_t secs;
+    tv = curlx_now();
     if(!known_offset) {
       epoch_offset = time(NULL) - tv.tv_sec;
       known_offset = 1;
     }
     secs = epoch_offset + tv.tv_sec;
-    now = localtime(&secs);  /* not thread safe but we don't care */
-    msnprintf(timebuf, sizeof(timebuf), "%02d:%02d:%02d.%06ld ",
-              now->tm_hour, now->tm_min, now->tm_sec, (long)tv.tv_usec);
+    result = toolx_localtime(secs, &now);
+    if(result)
+      memset(&now, 0, sizeof(now));
+    curl_msnprintf(timebuf, sizeof(timebuf), "%02d:%02d:%02d.%06ld ",
+                   now.tm_hour, now.tm_min, now.tm_sec, (long)tv.tv_usec);
   }
 
   switch(type) {
   case CURLINFO_TEXT:
-    fprintf(stderr, "%s== Info: %s", timestr, (char *)data);
-    /* FALLTHROUGH */
-  default: /* in case a new one is introduced to shock us */
+    curl_mfprintf(stderr, "%s== Info: %s", timestr, data);
     return 0;
-
   case CURLINFO_HEADER_OUT:
     text = "=> Send header";
     break;
@@ -139,8 +134,105 @@ int libtest_debug_cb(CURL *handle, curl_infotype type,
   case CURLINFO_SSL_DATA_IN:
     text = "<= Recv SSL data";
     break;
+  default: /* in case a new one is introduced to shock us */
+    return 0;
+  }
+
+  debug_dump(timebuf, text, stderr, (const unsigned char *)data, size,
+             trace_cfg->nohex);
+  return 0;
+}
+
+static void log_line_start(FILE *log, const char *idsbuf, curl_infotype type)
+{
+  /*
+   * This is the trace look that is similar to what libcurl makes on its
+   * own.
+   */
+  static const char * const s_infotype[] = {
+    "* ", "< ", "> ", "{ ", "} ", "{ ", "} "
+  };
+  if(idsbuf && *idsbuf)
+    curl_mfprintf(log, "%s%s", idsbuf, s_infotype[type]);
+  else
+    fputs(s_infotype[type], log);
+}
+
+/* callback for CURLOPT_DEBUGFUNCTION (used in client tests) */
+int cli_debug_cb(CURL *curl, curl_infotype type,
+                 char *data, size_t size, void *userp)
+{
+  FILE *output = stderr;
+  static int newl = 0;
+  static int traced_data = 0;
+  char idsbuf[60];
+  curl_off_t xfer_id, conn_id;
+
+  (void)curl;
+  (void)userp;
+
+  if(!curl_easy_getinfo(curl, CURLINFO_XFER_ID, &xfer_id) && xfer_id >= 0) {
+    if(!curl_easy_getinfo(curl, CURLINFO_CONN_ID, &conn_id) &&
+       conn_id >= 0) {
+      curl_msnprintf(idsbuf, sizeof(idsbuf),
+                     "[%" CURL_FORMAT_CURL_OFF_T "-"
+                      "%" CURL_FORMAT_CURL_OFF_T "] ", xfer_id, conn_id);
+    }
+    else {
+      curl_msnprintf(idsbuf, sizeof(idsbuf),
+                     "[%" CURL_FORMAT_CURL_OFF_T "-x] ", xfer_id);
+    }
+  }
+  else
+    idsbuf[0] = 0;
+
+  switch(type) {
+  case CURLINFO_HEADER_OUT:
+    if(size > 0) {
+      size_t st = 0;
+      size_t i;
+      for(i = 0; i < size - 1; i++) {
+        if(data[i] == '\n') { /* LF */
+          if(!newl) {
+            log_line_start(output, idsbuf, type);
+          }
+          (void)fwrite(data + st, i - st + 1, 1, output);
+          st = i + 1;
+          newl = 0;
+        }
+      }
+      if(!newl)
+        log_line_start(output, idsbuf, type);
+      (void)fwrite(data + st, i - st + 1, 1, output);
+    }
+    newl = (size && (data[size - 1] != '\n')) ? 1 : 0;
+    traced_data = 0;
+    break;
+  case CURLINFO_TEXT:
+  case CURLINFO_HEADER_IN:
+    if(!newl)
+      log_line_start(output, idsbuf, type);
+    (void)fwrite(data, size, 1, output);
+    newl = (size && (data[size - 1] != '\n')) ? 1 : 0;
+    traced_data = 0;
+    break;
+  case CURLINFO_DATA_OUT:
+  case CURLINFO_DATA_IN:
+  case CURLINFO_SSL_DATA_IN:
+  case CURLINFO_SSL_DATA_OUT:
+    if(!traced_data) {
+      if(!newl)
+        log_line_start(output, idsbuf, type);
+      curl_mfprintf(output, "[%zu bytes data]\n", size);
+      newl = 0;
+      traced_data = 1;
+    }
+    break;
+  default: /* nada */
+    newl = 0;
+    traced_data = 1;
+    break;
   }
 
-  libtest_debug_dump(timebuf, text, stderr, data, size, trace_cfg->nohex);
   return 0;
 }
diff --git a/third-party/curl/tests/libtest/testtrace.h b/third-party/curl/tests/libtest/testtrace.h
index 35f27b0965..e066595b2c 100644
--- a/third-party/curl/tests/libtest/testtrace.h
+++ b/third-party/curl/tests/libtest/testtrace.h
@@ -23,16 +23,24 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
+#include "first.h"
+
+void debug_dump(const char *timebuf, const char *text,
+                FILE *stream, const unsigned char *ptr,
+                size_t size, bool nohex);
 
 struct libtest_trace_cfg {
-  int tracetime;  /* 0 represents FALSE, anything else TRUE */
-  int nohex;      /* 0 represents FALSE, anything else TRUE */
+  bool tracetime;
+  bool nohex;
 };
 
-extern struct libtest_trace_cfg libtest_debug_config;
+extern struct libtest_trace_cfg debug_config;
 
-int libtest_debug_cb(CURL *handle, curl_infotype type,
-                     unsigned char *data, size_t size,
-                     void *userp);
+int libtest_debug_cb(CURL *curl, curl_infotype type,
+                     char *data, size_t size, void *userp);
+
+/* callback for CURLOPT_DEBUGFUNCTION (client tests) */
+int cli_debug_cb(CURL *curl, curl_infotype type,
+                 char *data, size_t size, void *userp);
 
 #endif /* HEADER_LIBTEST_TESTTRACE_H */
diff --git a/third-party/curl/tests/libtest/testutil.c b/third-party/curl/tests/libtest/testutil.c
index 1a1e689e72..7336a736f6 100644
--- a/third-party/curl/tests/libtest/testutil.c
+++ b/third-party/curl/tests/libtest/testutil.c
@@ -21,142 +21,37 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curl_setup.h"
-#include <curl/curl.h>
-#include "testutil.h"
-#include "memdebug.h"
+#include "first.h"
 
-#if defined(WIN32) && !defined(MSDOS)
-
-struct timeval tutil_tvnow(void)
+/* build request URL */
+char *tutil_suburl(const char *base, int i)
 {
-  /*
-  ** GetTickCount() is available on _all_ Windows versions from W95 up
-  ** to nowadays. Returns milliseconds elapsed since last system boot,
-  ** increases monotonically and wraps once 49.7 days have elapsed.
-  */
-  struct timeval now;
-  DWORD milliseconds = GetTickCount();
-  now.tv_sec = milliseconds / 1000;
-  now.tv_usec = (milliseconds % 1000) * 1000;
-  return now;
+  return curl_maprintf("%s%.4d", base, i);
 }
 
-#elif defined(HAVE_CLOCK_GETTIME_MONOTONIC)
-
-struct timeval tutil_tvnow(void)
+#if defined(HAVE_GETRLIMIT) && defined(HAVE_SETRLIMIT)
+void tutil_rlim2str(char *buf, size_t len, rlim_t val)
 {
-  /*
-  ** clock_gettime() is granted to be increased monotonically when the
-  ** monotonic clock is queried. Time starting point is unspecified, it
-  ** could be the system start-up time, the Epoch, or something else,
-  ** in any case the time starting point does not change once that the
-  ** system has started up.
-  */
-  struct timeval now;
-  struct timespec tsnow;
-  if(0 == clock_gettime(CLOCK_MONOTONIC, &tsnow)) {
-    now.tv_sec = tsnow.tv_sec;
-    now.tv_usec = (int)(tsnow.tv_nsec / 1000);
+#ifdef RLIM_INFINITY
+  if(val == RLIM_INFINITY) {
+    curl_msnprintf(buf, len, "INFINITY");
+    return;
   }
-  /*
-  ** Even when the configure process has truly detected monotonic clock
-  ** availability, it might happen that it is not actually available at
-  ** run-time. When this occurs simply fallback to other time source.
-  */
-#ifdef HAVE_GETTIMEOFDAY
+#endif
+  if(sizeof(rlim_t) == SIZEOF_INT)
+    curl_msnprintf(buf, len, "%u", (unsigned int)val);
   else
-    (void)gettimeofday(&now, NULL);
-#else
-  else {
-    now.tv_sec = time(NULL);
-    now.tv_usec = 0;
-  }
-#endif
-  return now;
+    curl_msnprintf(buf, len, "%lu", (unsigned long)val);
 }
-
-#elif defined(HAVE_GETTIMEOFDAY)
-
-struct timeval tutil_tvnow(void)
-{
-  /*
-  ** gettimeofday() is not granted to be increased monotonically, due to
-  ** clock drifting and external source time synchronization it can jump
-  ** forward or backward in time.
-  */
-  struct timeval now;
-  (void)gettimeofday(&now, NULL);
-  return now;
-}
-
-#else
-
-struct timeval tutil_tvnow(void)
-{
-  /*
-  ** time() returns the value of time in seconds since the Epoch.
-  */
-  struct timeval now;
-  now.tv_sec = time(NULL);
-  now.tv_usec = 0;
-  return now;
-}
-
 #endif
 
 /*
- * Make sure that the first argument is the more recent time, as otherwise
- * we'll get a weird negative time-diff back...
- *
- * Returns: the time difference in number of milliseconds.
+ * Handy CURLOPT_WRITEFUNCTION for tests that do not need to keep received
+ * data.
  */
-long tutil_tvdiff(struct timeval newer, struct timeval older)
+size_t tutil_throwaway_cb(char *data, size_t n, size_t l, void *userp)
 {
-  return (long)(newer.tv_sec-older.tv_sec)*1000+
-    (long)(newer.tv_usec-older.tv_usec)/1000;
+  (void)data;
+  (void)userp;
+  return n * l;
 }
-
-/*
- * Same as tutil_tvdiff but with full usec resolution.
- *
- * Returns: the time difference in seconds with subsecond resolution.
- */
-double tutil_tvdiff_secs(struct timeval newer, struct timeval older)
-{
-  if(newer.tv_sec != older.tv_sec)
-    return (double)(newer.tv_sec-older.tv_sec)+
-      (double)(newer.tv_usec-older.tv_usec)/1000000.0;
-  return (double)(newer.tv_usec-older.tv_usec)/1000000.0;
-}
-
-#ifdef WIN32
-HMODULE win32_load_system_library(const TCHAR *filename)
-{
-  size_t filenamelen = _tcslen(filename);
-  size_t systemdirlen = GetSystemDirectory(NULL, 0);
-  size_t written;
-  TCHAR *path;
-
-  if(!filenamelen || filenamelen > 32768 ||
-     !systemdirlen || systemdirlen > 32768)
-    return NULL;
-
-  /* systemdirlen includes null character */
-  path = malloc(sizeof(TCHAR) * (systemdirlen + 1 + filenamelen));
-  if(!path)
-    return NULL;
-
-  /* if written >= systemdirlen then nothing was written */
-  written = GetSystemDirectory(path, (unsigned int)systemdirlen);
-  if(!written || written >= systemdirlen)
-    return NULL;
-
-  if(path[written - 1] != _T('\\'))
-    path[written++] = _T('\\');
-
-  _tcscpy(path + written, filename);
-
-  return LoadLibrary(path);
-}
-#endif
diff --git a/third-party/curl/tests/libtest/testutil.h b/third-party/curl/tests/libtest/testutil.h
index 36b9448345..9799752cd5 100644
--- a/third-party/curl/tests/libtest/testutil.h
+++ b/third-party/curl/tests/libtest/testutil.h
@@ -23,27 +23,22 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curl_setup.h"
 
-struct timeval tutil_tvnow(void);
+/* build request URL */
+char *tutil_suburl(const char *base, int i);
 
-/*
- * Make sure that the first argument (t1) is the more recent time and t2 is
- * the older time, as otherwise you get a weird negative time-diff back...
- *
- * Returns: the time difference in number of milliseconds.
- */
-long tutil_tvdiff(struct timeval t1, struct timeval t2);
-
-/*
- * Same as tutil_tvdiff but with full usec resolution.
- *
- * Returns: the time difference in seconds with subsecond resolution.
- */
-double tutil_tvdiff_secs(struct timeval t1, struct timeval t2);
-
-#ifdef WIN32
-HMODULE win32_load_system_library(const TCHAR *filename);
+#ifdef HAVE_SYS_RESOURCE_H
+#include <sys/resource.h>  /* for getrlimit() */
 #endif
 
-#endif  /* HEADER_CURL_LIBTEST_TESTUTIL_H */
+#if defined(HAVE_GETRLIMIT) && defined(HAVE_SETRLIMIT)
+void tutil_rlim2str(char *buf, size_t len, rlim_t val);
+#endif
+
+/*
+ * Handy CURLOPT_WRITEFUNCTION for tests that do not need to keep received
+ * data.
+ */
+size_t tutil_throwaway_cb(char *data, size_t n, size_t l, void *userp);
+
+#endif /* HEADER_CURL_LIBTEST_TESTUTIL_H */
diff --git a/third-party/curl/tests/libtest/unitcheck.h b/third-party/curl/tests/libtest/unitcheck.h
new file mode 100644
index 0000000000..bc616d135b
--- /dev/null
+++ b/third-party/curl/tests/libtest/unitcheck.h
@@ -0,0 +1,124 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#ifdef BUILDING_LIBCURL
+#include "unitprotos.h"
+#endif
+
+/* The fail macros mark the current test step as failed, and continue */
+#define fail_if(expr, msg)                                             \
+  do {                                                                 \
+    if(expr) {                                                         \
+      curl_mfprintf(stderr, "%s:%d FAILED Assertion '%s' met: %s\n",   \
+                    __FILE__, __LINE__, #expr, msg);                   \
+      unitfail++;                                                      \
+    }                                                                  \
+  } while(0)
+
+#define fail_unless(expr, msg)                                   \
+  do {                                                           \
+    if(!(expr)) {                                                \
+      curl_mfprintf(stderr, "%s:%d Assertion '%s' FAILED: %s\n", \
+                    __FILE__, __LINE__, #expr, msg);             \
+      unitfail++;                                                \
+    }                                                            \
+  } while(0)
+
+#define verify_memory(dynamic, check, len)                                  \
+  do {                                                                      \
+    if(memcmp(dynamic, check, len)) {                                       \
+      curl_mfprintf(stderr, "%s:%d Memory buffer FAILED match size %d. "    \
+                    "'%s' is not\n", __FILE__, __LINE__, len,               \
+                    hexdump((const unsigned char *)(check), len));          \
+      curl_mfprintf(stderr, "%s:%d the same as '%s'\n", __FILE__, __LINE__, \
+                    hexdump((const unsigned char *)(dynamic), len));        \
+      unitfail++;                                                           \
+    }                                                                       \
+  } while(0)
+
+/* fail() is for when the test case figured out by itself that a check
+   proved a failure */
+#define fail(msg)                                                       \
+  do {                                                                  \
+    curl_mfprintf(stderr, "%s:%d test FAILED: '%s'\n",                  \
+                  __FILE__, __LINE__, msg);                             \
+    unitfail++;                                                         \
+  } while(0)
+
+/* The abort macros mark the current test step as failed, and exit the test */
+#define abort_if(expr, msg)                                           \
+  do {                                                                \
+    if(expr) {                                                        \
+      curl_mfprintf(stderr, "%s:%d ABORT assertion '%s' met: %s\n",   \
+                    __FILE__, __LINE__, #expr, msg);                  \
+      unitfail++;                                                     \
+      goto unit_test_abort;                                           \
+    }                                                                 \
+  } while(0)
+
+#define abort_unless(expr, msg)                                         \
+  do {                                                                  \
+    if(!(expr)) {                                                       \
+      curl_mfprintf(stderr, "%s:%d ABORT assertion '%s' failed: %s\n",  \
+                    __FILE__, __LINE__, #expr, msg);                    \
+      unitfail++;                                                       \
+      goto unit_test_abort;                                             \
+    }                                                                   \
+  } while(0)
+
+#define unittest_abort(msg)                                         \
+  do {                                                              \
+    curl_mfprintf(stderr, "%s:%d test ABORTED: '%s'\n",             \
+                  __FILE__, __LINE__, msg);                         \
+    unitfail++;                                                     \
+    goto unit_test_abort;                                           \
+  } while(0)
+
+/* begin/end macros */
+
+#define UNITTEST_BEGIN_SIMPLE                   \
+  (void)arg;                                    \
+  {
+
+#define UNITTEST_END_SIMPLE                     \
+    goto unit_test_abort; /* avoid warning */   \
+  }                                             \
+unit_test_abort:                                \
+  return (CURLcode)unitfail;
+
+#define UNITTEST_BEGIN(setupfunc)               \
+  (void)arg;                                    \
+  if(setupfunc) {                               \
+    fail("unit_setup() FAILURE");               \
+    return (CURLcode)unitfail;                  \
+  }                                             \
+  {
+
+#define UNITTEST_END(stopfunc)                  \
+    goto unit_test_abort; /* avoid warning */   \
+  }                                             \
+unit_test_abort:                                \
+  (stopfunc);                                   \
+  return (CURLcode)unitfail;
diff --git a/third-party/curl/tests/manpage-scan.pl b/third-party/curl/tests/manpage-scan.pl
deleted file mode 100644
index 0a7654d33b..0000000000
--- a/third-party/curl/tests/manpage-scan.pl
+++ /dev/null
@@ -1,305 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-#
-# Scan symbols-in-version (which is verified to be correct by test 1119), then
-# verify that each option mention in there that should have its own man page
-# actually does.
-#
-# In addition, make sure that every current option to curl_easy_setopt,
-# curl_easy_getinfo and curl_multi_setopt are also mentioned in their
-# corresponding main (index) man page.
-#
-# src/tool_getparam.c lists all options curl can parse
-# docs/curl.1 documents all command line options
-# src/tool_listhelp.c outputs all options with curl -h
-# - make sure they're all in sync
-#
-# Output all deviances to stderr.
-
-use strict;
-use warnings;
-
-# we may get the dir roots pointed out
-my $root=$ARGV[0] || ".";
-my $buildroot=$ARGV[1] || ".";
-my $syms = "$root/docs/libcurl/symbols-in-versions";
-my $curlh = "$root/include/curl/curl.h";
-my $errors=0;
-
-# the prepopulated alias list is the CURLINFO_* defines that are used for the
-# debug function callback and the fact that they use the same prefix as the
-# curl_easy_getinfo options was a mistake.
-my %alias = (
-    'CURLINFO_DATA_IN' => 'none',
-    'CURLINFO_DATA_OUT' => 'none',
-    'CURLINFO_END' => 'none',
-    'CURLINFO_HEADER_IN' => 'none',
-    'CURLINFO_HEADER_OUT' => 'none',
-    'CURLINFO_LASTONE' => 'none',
-    'CURLINFO_NONE' => 'none',
-    'CURLINFO_SSL_DATA_IN' => 'none',
-    'CURLINFO_SSL_DATA_OUT' => 'none',
-    'CURLINFO_TEXT' => 'none'
-    );
-
-sub scanmanpage {
-    my ($file, @words) = @_;
-
-    open(my $mh, "<", "$file");
-    my @m;
-    while(<$mh>) {
-        if($_ =~ /^\.IP (.*)/) {
-            my $w = $1;
-            # "unquote" minuses
-            $w =~ s/\\-/-/g;
-            push @m, $w;
-        }
-    }
-    close($mh);
-
-    foreach my $m (@words) {
-        my @g = grep(/$m/, @m);
-        if(!$g[0]) {
-            print STDERR "Missing mention of $m in $file\n";
-            $errors++;
-        }
-    }
-}
-
-my $r;
-
-# check for define alises
-open($r, "<", "$curlh") ||
-    die "no curl.h";
-while(<$r>) {
-    if(/^\#define (CURL(OPT|INFO|MOPT)_\w+) (.*)/) {
-        $alias{$1}=$3;
-    }
-}
-close($r);
-
-my @curlopt;
-my @curlinfo;
-my @curlmopt;
-open($r, "<", "$syms") ||
-    die "no input file";
-while(<$r>) {
-    chomp;
-    my $l= $_;
-    if($l =~ /(CURL(OPT|INFO|MOPT)_\w+) *([0-9.]*) *([0-9.-]*) *([0-9.]*)/) {
-        my ($opt, $type, $add, $dep, $rem) = ($1, $2, $3, $4, $5);
-
-        if($alias{$opt}) {
-            #print "$opt => $alias{$opt}\n";
-        }
-        elsif($rem) {
-            # $opt was removed in $rem
-            # so don't check for that
-        }
-        else {
-            if($type eq "OPT") {
-                push @curlopt, $opt,
-            }
-            elsif($type eq "INFO") {
-                push @curlinfo, $opt,
-            }
-            elsif($type eq "MOPT") {
-                push @curlmopt, $opt,
-            }
-            if(! -f "$root/docs/libcurl/opts/$opt.3") {
-                print STDERR "Missing $opt.3\n";
-                $errors++;
-            }
-        }
-    }
-}
-close($r);
-
-scanmanpage("$root/docs/libcurl/curl_easy_setopt.3", @curlopt);
-scanmanpage("$root/docs/libcurl/curl_easy_getinfo.3", @curlinfo);
-scanmanpage("$root/docs/libcurl/curl_multi_setopt.3", @curlmopt);
-
-# using this hash array, we can skip specific options
-my %opts = (
-    # pretend these --no options exists in tool_getparam.c
-    '--no-alpn' => 1,
-    '--no-npn' => 1,
-    '-N, --no-buffer' => 1,
-    '--no-sessionid' => 1,
-    '--no-keepalive' => 1,
-    '--no-progress-meter' => 1,
-    '--no-clobber' => 1,
-
-    # pretend these options without -no exist in curl.1 and tool_listhelp.c
-    '--alpn' => 6,
-    '--npn' => 6,
-    '--eprt' => 6,
-    '--epsv' => 6,
-    '--keepalive' => 6,
-    '-N, --buffer' => 6,
-    '--sessionid' => 6,
-    '--progress-meter' => 6,
-    '--clobber' => 6,
-
-    # deprecated options do not need to be in tool_help.c nor curl.1
-    '--krb4' => 6,
-    '--ftp-ssl' => 6,
-    '--ftp-ssl-reqd' => 6,
-
-    # for tests and debug only, can remain hidden
-    '--test-event' => 6,
-    '--wdebug' => 6,
-    );
-
-
-#########################################################################
-# parse the curl code that parses the command line arguments!
-open($r, "<", "$root/src/tool_getparam.c") ||
-    die "no input file";
-my $list;
-my @getparam; # store all parsed parameters
-
-while(<$r>) {
-    chomp;
-    my $l= $_;
-    if(/struct LongShort aliases/) {
-        $list=1;
-    }
-    elsif($list) {
-        if( /^  \{([^,]*), *([^ ]*)/) {
-            my ($s, $l)=($1, $2);
-            my $sh;
-            my $lo;
-            my $title;
-            if($l =~ /\"(.*)\"/) {
-                # long option
-                $lo = $1;
-                $title="--$lo";
-            }
-            if($s =~ /\"(.)\"/) {
-                # a short option
-                $sh = $1;
-                $title="-$sh, $title";
-            }
-            push @getparam, $title;
-            $opts{$title} |= 1;
-        }
-    }
-}
-close($r);
-
-#########################################################################
-# parse the curl.1 man page, extract all documented command line options
-# The man page may or may not be rebuilt, so check both possible locations
-open($r, "<", "$buildroot/docs/curl.1") || open($r, "<", "$root/docs/curl.1") ||
-    die "no input file";
-my @manpage; # store all parsed parameters
-while(<$r>) {
-    chomp;
-    my $l= $_;
-    $l =~ s/\\-/-/g;
-    if($l =~ /^\.IP \"(-[^\"]*)\"/) {
-        my $str = $1;
-        my $combo;
-        if($str =~ /^-(.), --([a-z0-9.-]*)/) {
-            # figure out the -short, --long combo
-            $combo = "-$1, --$2";
-        }
-        elsif($str =~ /^--([a-z0-9.-]*)/) {
-            # figure out the --long name
-            $combo = "--$1";
-        }
-        if($combo) {
-            push @manpage, $combo;
-            $opts{$combo} |= 2;
-        }
-    }
-}
-close($r);
-
-
-#########################################################################
-# parse the curl code that outputs the curl -h list
-open($r, "<", "$root/src/tool_listhelp.c") ||
-    die "no input file";
-my @toolhelp; # store all parsed parameters
-while(<$r>) {
-    chomp;
-    my $l= $_;
-    if(/^  \{\" *(.*)/) {
-        my $str=$1;
-        my $combo;
-        if($str =~ /^-(.), --([a-z0-9.-]*)/) {
-            # figure out the -short, --long combo
-            $combo = "-$1, --$2";
-        }
-        elsif($str =~ /^--([a-z0-9.-]*)/) {
-            # figure out the --long name
-            $combo = "--$1";
-        }
-        if($combo) {
-            push @toolhelp, $combo;
-            $opts{$combo} |= 4;
-        }
-
-    }
-}
-close($r);
-
-#
-# Now we have three arrays with options to cross-reference.
-
-foreach my $o (keys %opts) {
-    my $where = $opts{$o};
-
-    if($where != 7) {
-        # this is not in all three places
-        $errors++;
-        my $exists;
-        my $missing;
-        if($where & 1) {
-            $exists=" tool_getparam.c";
-        }
-        else {
-            $missing=" tool_getparam.c";
-        }
-        if($where & 2) {
-            $exists.= " curl.1";
-        }
-        else {
-            $missing.= " curl.1";
-        }
-        if($where & 4) {
-            $exists .= " tool_listhelp.c";
-        }
-        else {
-            $missing .= " tool_listhelp.c";
-        }
-
-        print STDERR "$o is not in$missing (but in$exists)\n";
-    }
-}
-
-print STDERR "$errors\n";
diff --git a/third-party/curl/tests/manpage-syntax.pl b/third-party/curl/tests/manpage-syntax.pl
deleted file mode 100644
index 31b212f21f..0000000000
--- a/third-party/curl/tests/manpage-syntax.pl
+++ /dev/null
@@ -1,288 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-#
-# Scan man page(s) and detect some simple and yet common formatting mistakes.
-#
-# Output all deviances to stderr.
-
-use strict;
-use warnings;
-
-# get the file name first
-my $symbolsinversions=shift @ARGV;
-
-# we may get the dir roots pointed out
-my @manpages=@ARGV;
-my $errors = 0;
-
-my %optblessed;
-my %funcblessed;
-my @optorder = (
-    'NAME',
-    'SYNOPSIS',
-    'DESCRIPTION',
-     #'DEFAULT', # CURLINFO_ has no default
-    'PROTOCOLS',
-    'EXAMPLE',
-    'AVAILABILITY',
-    'RETURN VALUE',
-    'SEE ALSO'
-    );
-my @funcorder = (
-    'NAME',
-    'SYNOPSIS',
-    'DESCRIPTION',
-    'EXAMPLE',
-    'AVAILABILITY',
-    'RETURN VALUE',
-    'SEE ALSO'
-    );
-my %shline; # section => line number
-
-my %symbol;
-
-# some CURLINFO_ symbols are not actual options for curl_easy_getinfo,
-# mark them as "deprecated" to hide them from link-warnings
-my %deprecated = (
-    CURLINFO_TEXT => 1,
-    CURLINFO_HEADER_IN => 1,
-    CURLINFO_HEADER_OUT => 1,
-    CURLINFO_DATA_IN => 1,
-    CURLINFO_DATA_OUT => 1,
-    CURLINFO_SSL_DATA_IN => 1,
-    CURLINFO_SSL_DATA_OUT => 1,
-    );
-sub allsymbols {
-    open(my $f, "<", "$symbolsinversions") ||
-        die "$symbolsinversions: $|";
-    while(<$f>) {
-        if($_ =~ /^([^ ]*) +(.*)/) {
-            my ($name, $info) = ($1, $2);
-            $symbol{$name}=$name;
-
-            if($info =~ /([0-9.]+) +([0-9.]+)/) {
-                $deprecated{$name}=$info;
-            }
-        }
-    }
-    close($f);
-}
-
-sub scanmanpage {
-    my ($file) = @_;
-    my $reqex = 0;
-    my $inex = 0;
-    my $insynop = 0;
-    my $exsize = 0;
-    my $synopsize = 0;
-    my $shc = 0;
-    my $optpage = 0; # option or function
-    my @sh;
-    my $SH="";
-
-    open(my $m, "<", "$file") || die "no such file: $file";
-    if($file =~ /[\/\\](CURL|curl_)[^\/\\]*.3/) {
-        # This is a man page for libcurl. It requires an example!
-        $reqex = 1;
-        if($1 eq "CURL") {
-            $optpage = 1;
-        }
-    }
-    my $line = 1;
-    while(<$m>) {
-        chomp;
-        if($_ =~ /^.so /) {
-            # this man page is just a referral
-            close($m);
-            return;
-        }
-        if(($_ =~ /^\.SH SYNOPSIS/i) && ($reqex)) {
-            # this is for libcurl man page SYNOPSIS checks
-            $insynop = 1;
-            $inex = 0;
-        }
-        elsif($_ =~ /^\.SH EXAMPLE/i) {
-            $insynop = 0;
-            $inex = 1;
-        }
-        elsif($_ =~ /^\.SH/i) {
-            $insynop = 0;
-            $inex = 0;
-        }
-        elsif($inex)  {
-            $exsize++;
-            if($_ =~ /[^\\]\\n/) {
-                print STDERR "$file:$line '\\n' need to be '\\\\n'!\n";
-            }
-        }
-        elsif($insynop)  {
-            $synopsize++;
-            if(($synopsize == 1) && ($_ !~ /\.nf/)) {
-                print STDERR "$file:$line:1:ERROR: be .nf for proper formatting\n";
-            }
-        }
-        if($_ =~ /^\.SH ([^\r\n]*)/i) {
-            my $n = $1;
-            # remove enclosing quotes
-            $n =~ s/\"(.*)\"\z/$1/;
-            push @sh, $n;
-            $shline{$n} = $line;
-            $SH = $n;
-        }
-
-        if($_ =~ /^\'/) {
-            print STDERR "$file:$line line starts with single quote!\n";
-            $errors++;
-        }
-        if($_ =~ /\\f([BI])(.*)/) {
-            my ($format, $rest) = ($1, $2);
-            if($rest !~ /\\fP/) {
-                print STDERR "$file:$line missing \\f${format} terminator!\n";
-                $errors++;
-            }
-        }
-        if($_ =~ /(.*)\\f([^BIP])/) {
-            my ($pre, $format) = ($1, $2);
-            if($pre !~ /\\\z/) {
-                # only if there wasn't another backslash before the \f
-                print STDERR "$file:$line suspicious \\f format!\n";
-                $errors++;
-            }
-        }
-        if($optpage && $SH && ($SH !~ /^(SYNOPSIS|EXAMPLE|NAME|SEE ALSO)/i) &&
-           ($_ =~ /(.*)(CURL(OPT_|MOPT_|INFO_)[A-Z0-9_]*)/)) {
-            # an option with its own man page, check that it is tagged
-            # for linking
-            my ($pref, $symbol) = ($1, $2);
-            if($deprecated{$symbol}) {
-                # let it be
-            }
-            elsif($pref !~ /\\fI\z/) {
-                print STDERR "$file:$line option $symbol missing \\fI tagging\n";
-                $errors++;
-            }
-        }
-        if($_ =~ /[ \t]+$/) {
-            print STDERR "$file:$line trailing whitespace\n";
-            $errors++;
-        }
-        if($_ =~ /\\f([BI])([^\\]*)\\fP/) {
-            my $r = $2;
-            if($r =~ /^(CURL.*)\(3\)/) {
-                my $rr = $1;
-                if(!$symbol{$rr}) {
-                    print STDERR "$file:$line link to non-libcurl option $rr!\n";
-                    $errors++;
-                }
-            }
-        }
-        $line++;
-    }
-    close($m);
-
-    if($reqex) {
-        # only for libcurl options man-pages
-
-        my $shcount = scalar(@sh); # before @sh gets shifted
-        if($exsize < 2) {
-            print STDERR "$file:$line missing EXAMPLE section\n";
-            $errors++;
-        }
-
-        if($shcount < 3) {
-            print STDERR "$file:$line too few man page sections!\n";
-            $errors++;
-            return;
-        }
-
-        my $got = "start";
-        my $i = 0;
-        my $shused = 1;
-        my @shorig = @sh;
-        my @order = $optpage ? @optorder : @funcorder;
-        my $blessed = $optpage ? \%optblessed : \%funcblessed;
-
-        while($got) {
-            my $finesh;
-            $got = shift(@sh);
-            if($got) {
-                if($$blessed{$got}) {
-                    $i = $$blessed{$got};
-                    $finesh = $got; # a mandatory one
-                }
-            }
-            if($i && defined($finesh)) {
-                # mandatory section
-
-                if($i != $shused) {
-                    printf STDERR "$file:%u Got %s, when %s was expected\n",
-                        $shline{$finesh},
-                        $finesh,
-                        $order[$shused-1];
-                    $errors++;
-                    return;
-                }
-                $shused++;
-                if($i == scalar(@order)) {
-                    # last mandatory one, exit
-                    last;
-                }
-            }
-        }
-
-        if($i != scalar(@order)) {
-            printf STDERR "$file:$line missing mandatory section: %s\n",
-                $order[$i];
-            printf STDERR "$file:$line section found at index %u: '%s'\n",
-                $i, $shorig[$i];
-            printf STDERR " Found %u used sections\n", $shcount;
-            $errors++;
-        }
-    }
-}
-
-allsymbols();
-
-if(!$symbol{'CURLALTSVC_H1'}) {
-    print STDERR "didn't get the symbols-in-version!\n";
-    exit;
-}
-
-my $ind = 1;
-for my $s (@optorder) {
-    $optblessed{$s} = $ind++
-}
-$ind = 1;
-for my $s (@funcorder) {
-    $funcblessed{$s} = $ind++
-}
-
-for my $m (@manpages) {
-    scanmanpage($m);
-}
-
-print STDERR "ok\n" if(!$errors);
-
-exit $errors;
diff --git a/third-party/curl/tests/markdown-uppercase.pl b/third-party/curl/tests/markdown-uppercase.pl
deleted file mode 100644
index 707f286cc7..0000000000
--- a/third-party/curl/tests/markdown-uppercase.pl
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-my $root=$ARGV[0] || "..";
-
-my @m = `git ls-files -- $root`;
-
-my $errors;
-
-my %accepted=('curl' => 1,
-              'libcurl' => 1);
-
-sub checkfile {
-    my ($f) = @_;
-    chomp $f;
-    if($f !~ /\.md\z/) {
-        return;
-    }
-    open(my $fh, "<", "$f");
-    my $l = 1;
-    my $prevl;
-    my $ignore = 0;
-    while(<$fh>) {
-        my $line = $_;
-        chomp $line;
-        if($line =~ /^(\`\`\`|\~\~\~)/) {
-            # start or stop ignore-mode
-            $ignore ^= 1;
-        }
-        if(!$ignore) {
-            if(($prevl =~ /\.\z/) && ($line =~ /^( *)([a-z]+)/)) {
-                my ($prefix, $word) = ($1, $2);
-                if(!$accepted{$word}) {
-                    my $c = length($prefix);
-                    print STDERR
-                        "$f:$l:$c:error: lowercase $word after period\n";
-                    print STDERR "$line\n";
-                    print STDERR ' ' x $c;
-                    print STDERR "^\n";
-                    $errors++;
-                }
-            }
-            elsif($line =~ /^(.*)\. +([a-z]+)/) {
-                my ($prefix, $word) = ($1, $2);
-
-                if(($prefix =~ /\.\.\z/) ||
-                   ($prefix =~ /[0-9]\z/) ||
-                   ($prefix =~ /e.g\z/) ||
-                   ($prefix =~ /i.e\z/) ||
-                   ($prefix =~ /etc\z/) ||
-                   $accepted{$word}) {
-                }
-                else {
-                    my $c = length($prefix) + 2;
-                    print STDERR
-                        "$f:$l:$c:error: lowercase $word after period\n";
-                    print STDERR "$line\n";
-                    print STDERR ' ' x $c;
-                    print STDERR "^\n";
-                    $errors++;
-                }
-            }
-        }
-        $prevl = $line;
-        $l++;
-    }
-    close($fh);
-}
-
-
-for my $f (@m) {
-    checkfile($f);
-}
-
-if($errors) {
-    exit 1;
-}
-print "ok\n";
diff --git a/third-party/curl/tests/mem-include-scan.pl b/third-party/curl/tests/mem-include-scan.pl
deleted file mode 100644
index e808c2e8c8..0000000000
--- a/third-party/curl/tests/mem-include-scan.pl
+++ /dev/null
@@ -1,98 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-#
-# This script scans C source files. If they seem to use memory functions,
-# it also makes sure that it #includes the correct two header files!
-#
-# You can also mark a C source as fine by using 'mem-include-scan' anywhere in
-# it.
-#
-
-use strict;
-use warnings;
-
-my $dir = $ARGV[0] || die "specify directory!";
-
-sub scanfile {
-    my ($file) = @_;
-    my $memfunc;
-    my $memdebug;
-    my $curlmem;
-
-    print STDERR "checking $file...\n";
-
-    open(my $f, "<", "$file");
-    while(<$f>) {
-        if($_ =~ /\W(free|alloc|strdup)\(/) {
-            $memfunc++;
-        }
-        elsif($_ =~ /^ *# *include \"memdebug.h\"/) {
-            $memdebug++;
-        }
-        elsif($_ =~ /^ *# *include \"curl_memory.h\"/) {
-            $curlmem++;
-        }
-        elsif($_ =~ /mem-include-scan/) {
-            # free pass
-            close($f);
-            return 0;
-        }
-        if($memfunc && $memdebug && $curlmem) {
-            last;
-        }
-    }
-    close($f);
-
-
-    if($memfunc) {
-        if($memdebug && $curlmem) {
-            return 0;
-        }
-        else {
-            if(!$memdebug) {
-                print STDERR "$file doesn't include \"memdebug.h\"!\n";
-            }
-            if(!$curlmem) {
-                print STDERR "$file doesn't include \"curl_memory.h\"!\n";
-            }
-            return 1;
-        }
-    }
-    return 0;
-}
-
-opendir(my $dh, $dir) || die "can't opendir $dir: $!";
-my @cfiles = grep { /\.c\z/ && -f "$dir/$_" } readdir($dh);
-closedir $dh;
-
-my $errs;
-for(@cfiles) {
-    $errs += scanfile("$dir/$_");
-}
-
-if($errs) {
-    print STDERR "----\n$errs errors detected!\n";
-    exit 2;
-}
diff --git a/third-party/curl/tests/memanalyze.pl b/third-party/curl/tests/memanalyze.pl
index 4e164fe389..15382e527a 100644
--- a/third-party/curl/tests/memanalyze.pl
+++ b/third-party/curl/tests/memanalyze.pl
@@ -22,35 +22,28 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-#
-# Example input:
-#
-# MEM mprintf.c:1094 malloc(32) = e5718
-# MEM mprintf.c:1103 realloc(e5718, 64) = e6118
-# MEM sendf.c:232 free(f6520)
 
-my $mallocs=0;
-my $callocs=0;
-my $reallocs=0;
-my $strdups=0;
-my $wcsdups=0;
-my $showlimit;
-my $sends=0;
-my $recvs=0;
-my $sockets=0;
+use strict;
+use warnings;
 
-while(1) {
+use memanalyzer;
+
+my $showlimit = 0;
+my $verbose = 0;
+my $trace = 0;
+
+while(@ARGV) {
     if($ARGV[0] eq "-v") {
-        $verbose=1;
+        $verbose = 1;
         shift @ARGV;
     }
     elsif($ARGV[0] eq "-t") {
-        $trace=1;
+        $trace = 1;
         shift @ARGV;
     }
     elsif($ARGV[0] eq "-l") {
         # only show what alloc that caused a memlimit failure
-        $showlimit=1;
+        $showlimit = 1;
         shift @ARGV;
     }
     else {
@@ -58,377 +51,10 @@ while(1) {
     }
 }
 
-my $memsum; # the total number of memory allocated over the lifetime
-my $maxmem; # the high water mark
+my $file = $ARGV[0] || '';
 
-sub newtotal {
-    my ($newtot)=@_;
-    # count a max here
+my @res = memanalyze($file, $verbose, $trace, $showlimit);
 
-    if($newtot > $maxmem) {
-        $maxmem= $newtot;
-    }
-}
-
-my $file = $ARGV[0];
-
-if(! -f $file) {
-    print "Usage: memanalyze.pl [options] <dump file>\n",
-    "Options:\n",
-    " -l  memlimit failure displayed\n",
-    " -v  Verbose\n",
-    " -t  Trace\n";
-    exit;
-}
-
-open(my $fileh, "<", "$file");
-
-if($showlimit) {
-    while(<$fileh>) {
-        if(/^LIMIT.*memlimit$/) {
-            print $_;
-            last;
-        }
-    }
-    close($fileh);
-    exit;
-}
-
-
-my $lnum=0;
-while(<$fileh>) {
-    chomp $_;
-    $line = $_;
-    $lnum++;
-    if($line =~ /^LIMIT ([^ ]*):(\d*) (.*)/) {
-        # new memory limit test prefix
-        my $i = $3;
-        my ($source, $linenum) = ($1, $2);
-        if($trace && ($i =~ /([^ ]*) reached memlimit/)) {
-            print "LIMIT: $1 returned error at $source:$linenum\n";
-        }
-    }
-    elsif($line =~ /^MEM ([^ ]*):(\d*) (.*)/) {
-        # generic match for the filename+linenumber
-        $source = $1;
-        $linenum = $2;
-        $function = $3;
-
-        if($function =~ /free\((\(nil\)|0x([0-9a-f]*))/) {
-            $addr = $2;
-            if($1 eq "(nil)") {
-                ; # do nothing when free(NULL)
-            }
-            elsif(!exists $sizeataddr{$addr}) {
-                print "FREE ERROR: No memory allocated: $line\n";
-            }
-            elsif(-1 == $sizeataddr{$addr}) {
-                print "FREE ERROR: Memory freed twice: $line\n";
-                print "FREE ERROR: Previously freed at: ".$getmem{$addr}."\n";
-            }
-            else {
-                $totalmem -= $sizeataddr{$addr};
-                if($trace) {
-                    print "FREE: malloc at ".$getmem{$addr}." is freed again at $source:$linenum\n";
-                    printf("FREE: %d bytes freed, left allocated: $totalmem bytes\n", $sizeataddr{$addr});
-                }
-
-                newtotal($totalmem);
-                $frees++;
-
-                $sizeataddr{$addr}=-1; # set -1 to mark as freed
-                $getmem{$addr}="$source:$linenum";
-
-            }
-        }
-        elsif($function =~ /malloc\((\d*)\) = 0x([0-9a-f]*)/) {
-            $size = $1;
-            $addr = $2;
-
-            if($sizeataddr{$addr}>0) {
-                # this means weeeeeirdo
-                print "Mixed debug compile ($source:$linenum at line $lnum), rebuild curl now\n";
-                print "We think $sizeataddr{$addr} bytes are already allocated at that memory address: $addr!\n";
-            }
-
-            $sizeataddr{$addr}=$size;
-            $totalmem += $size;
-            $memsum += $size;
-
-            if($trace) {
-                print "MALLOC: malloc($size) at $source:$linenum",
-                " makes totally $totalmem bytes\n";
-            }
-
-            newtotal($totalmem);
-            $mallocs++;
-
-            $getmem{$addr}="$source:$linenum";
-        }
-        elsif($function =~ /calloc\((\d*),(\d*)\) = 0x([0-9a-f]*)/) {
-            $size = $1*$2;
-            $addr = $3;
-
-            $arg1 = $1;
-            $arg2 = $2;
-
-            if($sizeataddr{$addr}>0) {
-                # this means weeeeeirdo
-                print "Mixed debug compile, rebuild curl now\n";
-            }
-
-            $sizeataddr{$addr}=$size;
-            $totalmem += $size;
-            $memsum += $size;
-
-            if($trace) {
-                print "CALLOC: calloc($arg1,$arg2) at $source:$linenum",
-                " makes totally $totalmem bytes\n";
-            }
-
-            newtotal($totalmem);
-            $callocs++;
-
-            $getmem{$addr}="$source:$linenum";
-        }
-        elsif($function =~ /realloc\((\(nil\)|0x([0-9a-f]*)), (\d*)\) = 0x([0-9a-f]*)/) {
-            my ($oldaddr, $newsize, $newaddr) = ($2, $3, $4);
-
-            $totalmem -= $sizeataddr{$oldaddr};
-            if($trace) {
-                printf("REALLOC: %d less bytes and ", $sizeataddr{$oldaddr});
-            }
-            $sizeataddr{$oldaddr}=0;
-
-            $totalmem += $newsize;
-            $memsum += $size;
-            $sizeataddr{$newaddr}=$newsize;
-
-            if($trace) {
-                printf("%d more bytes ($source:$linenum)\n", $newsize);
-            }
-
-            newtotal($totalmem);
-            $reallocs++;
-
-            $getmem{$oldaddr}="";
-            $getmem{$newaddr}="$source:$linenum";
-        }
-        elsif($function =~ /strdup\(0x([0-9a-f]*)\) \((\d*)\) = 0x([0-9a-f]*)/) {
-            # strdup(a5b50) (8) = df7c0
-
-            $dup = $1;
-            $size = $2;
-            $addr = $3;
-            $getmem{$addr}="$source:$linenum";
-            $sizeataddr{$addr}=$size;
-
-            $totalmem += $size;
-            $memsum += $size;
-
-            if($trace) {
-                printf("STRDUP: $size bytes at %s, makes totally: %d bytes\n",
-                       $getmem{$addr}, $totalmem);
-            }
-
-            newtotal($totalmem);
-            $strdups++;
-        }
-        elsif($function =~ /wcsdup\(0x([0-9a-f]*)\) \((\d*)\) = 0x([0-9a-f]*)/) {
-            # wcsdup(a5b50) (8) = df7c0
-
-            $dup = $1;
-            $size = $2;
-            $addr = $3;
-            $getmem{$addr}="$source:$linenum";
-            $sizeataddr{$addr}=$size;
-
-            $totalmem += $size;
-            $memsum += $size;
-
-            if($trace) {
-                printf("WCSDUP: $size bytes at %s, makes totally: %d bytes\n",
-                       $getmem{$addr}, $totalmem);
-            }
-
-            newtotal($totalmem);
-            $wcsdups++;
-        }
-        else {
-            print "Not recognized input line: $function\n";
-        }
-    }
-    # FD url.c:1282 socket() = 5
-    elsif($_ =~ /^FD ([^ ]*):(\d*) (.*)/) {
-        # generic match for the filename+linenumber
-        $source = $1;
-        $linenum = $2;
-        $function = $3;
-
-        if($function =~ /socket\(\) = (\d*)/) {
-            $filedes{$1}=1;
-            $getfile{$1}="$source:$linenum";
-            $openfile++;
-            $sockets++; # number of socket() calls
-        }
-        elsif($function =~ /socketpair\(\) = (\d*) (\d*)/) {
-            $filedes{$1}=1;
-            $getfile{$1}="$source:$linenum";
-            $openfile++;
-            $filedes{$2}=1;
-            $getfile{$2}="$source:$linenum";
-            $openfile++;
-        }
-        elsif($function =~ /accept\(\) = (\d*)/) {
-            $filedes{$1}=1;
-            $getfile{$1}="$source:$linenum";
-            $openfile++;
-        }
-        elsif($function =~ /sclose\((\d*)\)/) {
-            if($filedes{$1} != 1) {
-                print "Close without open: $line\n";
-            }
-            else {
-                $filedes{$1}=0; # closed now
-                $openfile--;
-            }
-        }
-    }
-    # FILE url.c:1282 fopen("blabla") = 0x5ddd
-    elsif($_ =~ /^FILE ([^ ]*):(\d*) (.*)/) {
-        # generic match for the filename+linenumber
-        $source = $1;
-        $linenum = $2;
-        $function = $3;
-
-        if($function =~ /f[d]*open\(\"(.*)\",\"([^\"]*)\"\) = (\(nil\)|0x([0-9a-f]*))/) {
-            if($3 eq "(nil)") {
-                ;
-            }
-            else {
-                $fopen{$4}=1;
-                $fopenfile{$4}="$source:$linenum";
-                $fopens++;
-            }
-        }
-        # fclose(0x1026c8)
-        elsif($function =~ /fclose\(0x([0-9a-f]*)\)/) {
-            if(!$fopen{$1}) {
-                print "fclose() without fopen(): $line\n";
-            }
-            else {
-                $fopen{$1}=0;
-                $fopens--;
-            }
-        }
-    }
-    # GETNAME url.c:1901 getnameinfo()
-    elsif($_ =~ /^GETNAME ([^ ]*):(\d*) (.*)/) {
-        # not much to do
-    }
-    # SEND url.c:1901 send(83) = 83
-    elsif($_ =~ /^SEND ([^ ]*):(\d*) (.*)/) {
-        $sends++;
-    }
-    # RECV url.c:1901 recv(102400) = 256
-    elsif($_ =~ /^RECV ([^ ]*):(\d*) (.*)/) {
-        $recvs++;
-    }
-
-    # ADDR url.c:1282 getaddrinfo() = 0x5ddd
-    elsif($_ =~ /^ADDR ([^ ]*):(\d*) (.*)/) {
-        # generic match for the filename+linenumber
-        $source = $1;
-        $linenum = $2;
-        $function = $3;
-
-        if($function =~ /getaddrinfo\(\) = (\(nil\)|0x([0-9a-f]*))/) {
-            my $add = $2;
-            if($add eq "(nil)") {
-                ;
-            }
-            else {
-                $addrinfo{$add}=1;
-                $addrinfofile{$add}="$source:$linenum";
-                $addrinfos++;
-            }
-            if($trace) {
-                printf("GETADDRINFO ($source:$linenum)\n");
-            }
-        }
-        # fclose(0x1026c8)
-        elsif($function =~ /freeaddrinfo\(0x([0-9a-f]*)\)/) {
-            if(!$addrinfo{$1}) {
-                print "freeaddrinfo() without getaddrinfo(): $line\n";
-            }
-            else {
-                $addrinfo{$1}=0;
-                $addrinfos--;
-            }
-            if($trace) {
-                printf("FREEADDRINFO ($source:$linenum)\n");
-            }
-        }
-
-    }
-    else {
-        print "Not recognized prefix line: $line\n";
-    }
-}
-close($fileh);
-
-if($totalmem) {
-    print "Leak detected: memory still allocated: $totalmem bytes\n";
-
-    for(keys %sizeataddr) {
-        $addr = $_;
-        $size = $sizeataddr{$addr};
-        if($size > 0) {
-            print "At $addr, there's $size bytes.\n";
-            print " allocated by ".$getmem{$addr}."\n";
-        }
-    }
-}
-
-if($openfile) {
-    for(keys %filedes) {
-        if($filedes{$_} == 1) {
-            print "Open file descriptor created at ".$getfile{$_}."\n";
-        }
-    }
-}
-
-if($fopens) {
-    print "Open FILE handles left at:\n";
-    for(keys %fopen) {
-        if($fopen{$_} == 1) {
-            print "fopen() called at ".$fopenfile{$_}."\n";
-        }
-    }
-}
-
-if($addrinfos) {
-    print "IPv6-style name resolve data left at:\n";
-    for(keys %addrinfofile) {
-        if($addrinfo{$_} == 1) {
-            print "getaddrinfo() called at ".$addrinfofile{$_}."\n";
-        }
-    }
-}
-
-if($verbose) {
-    print "Mallocs: $mallocs\n",
-        "Reallocs: $reallocs\n",
-        "Callocs: $callocs\n",
-        "Strdups:  $strdups\n",
-        "Wcsdups:  $wcsdups\n",
-        "Frees: $frees\n",
-        "Sends: $sends\n",
-        "Recvs: $recvs\n",
-        "Sockets: $sockets\n",
-        "Allocations: ".($mallocs + $callocs + $reallocs + $strdups + $wcsdups)."\n",
-        "Operations: ".($mallocs + $callocs + $reallocs + $strdups + $wcsdups + $sends + $recvs + $sockets)."\n";
-
-    print "Maximum allocated: $maxmem\n";
-    print "Total allocated: $memsum\n";
+for (@res) {
+    print $_;
 }
diff --git a/third-party/curl/tests/memanalyzer.pm b/third-party/curl/tests/memanalyzer.pm
new file mode 100644
index 0000000000..110b39d241
--- /dev/null
+++ b/third-party/curl/tests/memanalyzer.pm
@@ -0,0 +1,446 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+# Example input:
+#
+# MEM mprintf.c:1094 malloc(32) = e5718
+# MEM mprintf.c:1103 realloc(e5718, 64) = e6118
+# MEM sendf.c:232 free(f6520)
+
+package memanalyzer;
+
+use strict;
+use warnings;
+
+BEGIN {
+    use base qw(Exporter);
+
+    our @EXPORT = qw(
+        memanalyze
+    );
+}
+
+my $memsum;
+my $maxmem;
+
+sub newtotal {
+    my ($newtot) = @_;
+    # count a max here
+
+    if($newtot > $maxmem) {
+        $maxmem = $newtot;
+    }
+}
+
+sub memanalyze {
+    my ($file, $verbose, $trace, $showlimit) = @_;
+    my @res;
+
+    my $mallocs = 0;
+    my $callocs = 0;
+    my $reallocs = 0;
+    my $strdups = 0;
+    my $wcsdups = 0;
+    my $sockets = 0;
+
+    $memsum = 0; # the total number of memory allocated over the lifetime
+    $maxmem = 0; # the high water mark
+
+    open(my $fileh, "<", $file) or return ();
+
+    if($showlimit) {
+        while(<$fileh>) {
+            if(/^LIMIT.*memlimit$/) {
+                push @res, $_;
+                last;
+            }
+        }
+        close($fileh);
+        return @res;
+    }
+
+    my %sizeataddr;
+    my %getmem;
+
+    my $totalmem = 0;
+    my $frees = 0;
+
+    my $dup;
+    my $size;
+    my $addr;
+
+    my %filedes;
+    my %getfile;
+
+    my %fopen;
+    my %fopenfile;
+    my $openfile = 0;
+    my $fopens = 0;
+
+    my %addrinfo;
+    my %addrinfofile;
+    my $addrinfos = 0;
+
+    my $source;
+    my $linenum;
+    my $function;
+
+    my $lnum = 0;
+
+    while(<$fileh>) {
+        chomp $_;
+        my $line = $_;
+        $lnum++;
+        if($line =~ /^BT/) {
+            # back-trace, ignore
+        }
+        elsif($line =~ /^LIMIT ([^ ]*):(\d*) (.*)/) {
+            # new memory limit test prefix
+            my $i = $3;
+            my ($source, $linenum) = ($1, $2);
+            if($trace && ($i =~ /([^ ]*) reached memlimit/)) {
+                push @res, "LIMIT: $1 returned error at $source:$linenum\n";
+            }
+        }
+        elsif($line =~ /^MEM ([^ ]*):(\d*) (.*)/) {
+            # generic match for the filename+linenumber
+            $source = $1;
+            $linenum = $2;
+            $function = $3;
+
+            if($function =~ /free\((\(nil\)|0x([0-9a-f]*))/) {
+                $addr = $2;
+                if($1 eq "(nil)") {
+                    ; # do nothing when free(NULL)
+                }
+                elsif(!exists $sizeataddr{$addr}) {
+                    push @res, "FREE ERROR: No memory allocated: $line\n";
+                }
+                elsif(-1 == $sizeataddr{$addr}) {
+                    push @res, "FREE ERROR: Memory freed twice: $line\n";
+                    push @res, "FREE ERROR: Previously freed at: $getmem{$addr}\n";
+                }
+                else {
+                    $totalmem -= $sizeataddr{$addr};
+                    if($trace) {
+                        push @res, "FREE: malloc at $getmem{$addr} is freed again at $source:$linenum\n";
+                        push @res, "FREE: $sizeataddr{$addr} bytes freed, left allocated: $totalmem bytes\n";
+                    }
+
+                    newtotal($totalmem);
+                    $frees++;
+
+                    $sizeataddr{$addr} = -1; # set -1 to mark as freed
+                    $getmem{$addr} = "$source:$linenum";
+                }
+            }
+            elsif($function =~ /malloc\((\d*)\) = 0x([0-9a-f]*)/) {
+                $size = $1;
+                $addr = $2;
+
+                if($sizeataddr{$addr} && $sizeataddr{$addr}>0) {
+                    # this means weeeeeirdo
+                    push @res, "Mixed debug compile ($source:$linenum at line $lnum), rebuild curl now\n";
+                    push @res, "We think $sizeataddr{$addr} bytes are already allocated at that memory address: $addr!\n";
+                }
+
+                $sizeataddr{$addr} = $size;
+                $totalmem += $size;
+                $memsum += $size;
+
+                if($trace) {
+                    push @res, "MALLOC: malloc($size) at $source:$linenum makes totally $totalmem bytes\n";
+                }
+
+                newtotal($totalmem);
+                $mallocs++;
+
+                $getmem{$addr} = "$source:$linenum";
+            }
+            elsif($function =~ /calloc\((\d*),(\d*)\) = 0x([0-9a-f]*)/) {
+                $size = $1 * $2;
+                $addr = $3;
+
+                my $arg1 = $1;
+                my $arg2 = $2;
+
+                if($sizeataddr{$addr} && $sizeataddr{$addr}>0) {
+                    # this means weeeeeirdo
+                    push @res, "Mixed debug compile ($source:$linenum at line $lnum), rebuild curl now\n";
+                    push @res, "We think $sizeataddr{$addr} bytes are already allocated at that memory address: $addr!\n";
+                }
+
+                $sizeataddr{$addr} = $size;
+                $totalmem += $size;
+                $memsum += $size;
+
+                if($trace) {
+                    push @res, "CALLOC: calloc($arg1,$arg2) at $source:$linenum makes totally $totalmem bytes\n";
+                }
+
+                newtotal($totalmem);
+                $callocs++;
+
+                $getmem{$addr} = "$source:$linenum";
+            }
+            elsif($function =~ /realloc\((\(nil\)|0x([0-9a-f]*)), (\d*)\) = 0x([0-9a-f]*)/) {
+                my ($oldaddr, $newsize, $newaddr) = ($2, $3, $4);
+                my $oldsize = '-';
+
+                if($oldaddr) {
+                    $oldsize = $sizeataddr{$oldaddr} ? $sizeataddr{$oldaddr} : 0;
+
+                    $totalmem -= $oldsize;
+                    if($trace) {
+                    }
+                    $sizeataddr{$oldaddr} = 0;
+
+                    $getmem{$oldaddr} = "";
+                }
+
+                $totalmem += $newsize;
+                $memsum += $newsize;
+                $sizeataddr{$newaddr} = $newsize;
+
+                if($trace) {
+                    push @res, "REALLOC: $oldsize less bytes and $newsize more bytes ($source:$linenum)\n";
+                }
+
+                newtotal($totalmem);
+                $reallocs++;
+
+                $getmem{$newaddr} = "$source:$linenum";
+            }
+            elsif($function =~ /strdup\(0x([0-9a-f]*)\) \((\d*)\) = 0x([0-9a-f]*)/) {
+                # strdup(a5b50) (8) = df7c0
+
+                $dup = $1;
+                $size = $2;
+                $addr = $3;
+                $getmem{$addr} = "$source:$linenum";
+                $sizeataddr{$addr} = $size;
+
+                $totalmem += $size;
+                $memsum += $size;
+
+                if($trace) {
+                    push @res, "STRDUP: $size bytes at $getmem{$addr}, makes totally: $totalmem bytes\n";
+                }
+
+                newtotal($totalmem);
+                $strdups++;
+            }
+            elsif($function =~ /wcsdup\(0x([0-9a-f]*)\) \((\d*)\) = 0x([0-9a-f]*)/) {
+                # wcsdup(a5b50) (8) = df7c0
+
+                $dup = $1;
+                $size = $2;
+                $addr = $3;
+                $getmem{$addr} = "$source:$linenum";
+                $sizeataddr{$addr} = $size;
+
+                $totalmem += $size;
+                $memsum += $size;
+
+                if($trace) {
+                    push @res, "WCSDUP: $size bytes at $getmem{$addr}, makes totally: $totalmem bytes\n";
+                }
+
+                newtotal($totalmem);
+                $wcsdups++;
+            }
+            else {
+                push @res, "Not recognized input line: $function\n";
+            }
+        }
+        # FD url.c:1282 socket() = 5
+        elsif($_ =~ /^FD ([^ ]*):(\d*) (.*)/) {
+            # generic match for the filename+linenumber
+            $source = $1;
+            $linenum = $2;
+            $function = $3;
+
+            if($function =~ /socket\(\) = (\d*)/) {
+                $filedes{$1} = 1;
+                $getfile{$1} = "$source:$linenum";
+                $openfile++;
+                $sockets++; # number of socket() calls
+            }
+            elsif($function =~ /socketpair\(\) = (\d*) (\d*)/) {
+                $filedes{$1} = 1;
+                $getfile{$1} = "$source:$linenum";
+                $openfile++;
+                $filedes{$2} = 1;
+                $getfile{$2} = "$source:$linenum";
+                $openfile++;
+            }
+            elsif($function =~ /accept\(\) = (\d*)/) {
+                $filedes{$1} = 1;
+                $getfile{$1} = "$source:$linenum";
+                $openfile++;
+            }
+            elsif($function =~ /sclose\((\d*)\)/) {
+                if($filedes{$1} != 1) {
+                    push @res, "Close without open: $line\n";
+                }
+                else {
+                    $filedes{$1} = 0; # closed now
+                    $openfile--;
+                }
+            }
+        }
+        # FILE url.c:1282 fopen("blabla") = 0x5ddd
+        elsif($_ =~ /^FILE ([^ ]*):(\d*) (.*)/) {
+            # generic match for the filename+linenumber
+            $source = $1;
+            $linenum = $2;
+            $function = $3;
+
+            if($function =~ /f[d]*open\(\"(.*)\",\"([^\"]*)\"\) = (\(nil\)|0x([0-9a-f]*))/) {
+                if($3 eq "(nil)") {
+                    ;
+                }
+                else {
+                    $fopen{$4} = 1;
+                    $fopenfile{$4} = "$source:$linenum";
+                    $fopens++;
+                }
+            }
+            # fclose(0x1026c8)
+            elsif($function =~ /fclose\(0x([0-9a-f]*)\)/) {
+                if(!$fopen{$1}) {
+                    push @res, "fclose() without fopen(): $line\n";
+                }
+                else {
+                    $fopen{$1} = 0;
+                    $fopens--;
+                }
+            }
+        }
+        # GETNAME url.c:1901 getnameinfo()
+        elsif($_ =~ /^GETNAME ([^ ]*):(\d*) (.*)/) {
+            # not much to do
+        }
+
+        # ADDR url.c:1282 getaddrinfo() = 0x5ddd
+        elsif($_ =~ /^ADDR ([^ ]*):(\d*) (.*)/) {
+            # generic match for the filename+linenumber
+            $source = $1;
+            $linenum = $2;
+            $function = $3;
+
+            if($function =~ /getaddrinfo\(\) = (\(nil\)|0x([0-9a-f]*))/) {
+                my $add = $1;
+                if($add eq "(nil)") {
+                    ;
+                }
+                else {
+                    $addrinfo{$add} = 1;
+                    $addrinfofile{$add} = "$source:$linenum";
+                    $addrinfos++;
+                }
+                if($trace) {
+                    push @res, "GETADDRINFO ($source:$linenum)\n";
+                }
+            }
+            # fclose(0x1026c8)
+            elsif($function =~ /freeaddrinfo\((0x[0-9a-f]*)\)/) {
+                my $addr = $1;
+                if(!$addrinfo{$addr}) {
+                    push @res, "freeaddrinfo() without getaddrinfo(): $line\n";
+                }
+                else {
+                    $addrinfo{$addr} = 0;
+                    $addrinfos--;
+                }
+                if($trace) {
+                    push @res, "FREEADDRINFO ($source:$linenum)\n";
+                }
+            }
+        }
+        else {
+            push @res, "Not recognized prefix line: $line\n";
+        }
+    }
+    close($fileh);
+
+    if($totalmem) {
+        push @res, "Leak detected: memory still allocated: $totalmem bytes\n";
+
+        for(keys %sizeataddr) {
+            $addr = $_;
+            $size = $sizeataddr{$addr};
+            if($size > 0) {
+                push @res, "At $addr, there is $size bytes.\n";
+                push @res, " allocated by $getmem{$addr}\n";
+            }
+        }
+    }
+
+    if($openfile) {
+        for(keys %filedes) {
+            if($filedes{$_} == 1) {
+                push @res, "Open file descriptor created at $getfile{$_}.\n";
+            }
+        }
+    }
+
+    if($fopens) {
+        push @res, "Open FILE handles left at:\n";
+        for(keys %fopen) {
+            if($fopen{$_} == 1) {
+                push @res, "fopen() called at $fopenfile{$_}.\n";
+            }
+        }
+    }
+
+    if($addrinfos) {
+        push @res, "IPv6-style name resolve data left at:\n";
+        for(keys %addrinfofile) {
+            if($addrinfo{$_} == 1) {
+                push @res, "getaddrinfo() called at $addrinfofile{$_}.\n";
+            }
+        }
+    }
+
+    if($verbose) {
+        push @res,
+            "Mallocs: $mallocs\n",
+            "Reallocs: $reallocs\n",
+            "Callocs: $callocs\n",
+            "Strdups: $strdups\n",
+            "Wcsdups: $wcsdups\n",
+            "Frees: $frees\n",
+            "Sockets: $sockets\n",
+            "Allocations: ".($mallocs + $callocs + $reallocs + $strdups + $wcsdups)."\n",
+            "Operations: ".($mallocs + $callocs + $reallocs + $strdups + $wcsdups + $sockets)."\n",
+            "Maximum allocated: $maxmem\n",
+            "Total allocated: $memsum\n";
+    }
+
+    return @res;
+}
+
+1;
diff --git a/third-party/curl/tests/negtelnetserver.py b/third-party/curl/tests/negtelnetserver.py
index 8c04bdc108..a9a4880018 100644
--- a/third-party/curl/tests/negtelnetserver.py
+++ b/third-party/curl/tests/negtelnetserver.py
@@ -21,17 +21,15 @@
 #
 # SPDX-License-Identifier: curl
 #
-""" A telnet server which negotiates"""
+"""A telnet server which negotiates."""
 
-from __future__ import (absolute_import, division, print_function,
-                        unicode_literals)
+from __future__ import absolute_import, division, print_function, unicode_literals
 
 import argparse
 import logging
 import os
 import socket
 import sys
-import time
 
 from util import ClosingFileHandler
 
@@ -40,26 +38,23 @@ if sys.version_info.major >= 3:
 else:
     import SocketServer as socketserver
 
+
 log = logging.getLogger(__name__)
 HOST = "localhost"
 IDENT = "NTEL"
 
-
 # The strings that indicate the test framework is checking our aliveness
 VERIFIED_REQ = "verifiedserver"
 VERIFIED_RSP = "WE ROOLZ: {pid}"
 
 
 def telnetserver(options):
-    """
-    Starts up a TCP server with a telnet handler and serves DICT requests
-    forever.
-    """
+    """Start up a TCP server with a telnet handler and serve DICT requests forever."""
     if options.pidfile:
         pid = os.getpid()
         # see tests/server/util.c function write_pidfile
         if os.name == "nt":
-            pid += 65536
+            pid += 4194304
         with open(options.pidfile, "w") as f:
             f.write(str(pid))
 
@@ -75,13 +70,10 @@ def telnetserver(options):
 
 
 class NegotiatingTelnetHandler(socketserver.BaseRequestHandler):
-    """Handler class for Telnet connections.
+    """Handler class for Telnet connections."""
 
-    """
     def handle(self):
-        """
-        Negotiates options before reading data.
-        """
+        """Negotiates options before reading data."""
         neg = Negotiator(self.request)
 
         try:
@@ -92,7 +84,7 @@ class NegotiatingTelnetHandler(socketserver.BaseRequestHandler):
             neg.send_wont("NAWS")
 
             # Get the data passed through the negotiator
-            data = neg.recv(4*1024)
+            data = neg.recv(4 * 1024)
             log.debug("Incoming data: %r", data)
 
             if VERIFIED_REQ.encode('utf-8') in data:
@@ -100,7 +92,7 @@ class NegotiatingTelnetHandler(socketserver.BaseRequestHandler):
                 pid = os.getpid()
                 # see tests/server/util.c function write_pidfile
                 if os.name == "nt":
-                    pid += 65536
+                    pid += 4194304
                 response = VERIFIED_RSP.format(pid=pid)
                 response_data = response.encode('utf-8')
             else:
@@ -114,14 +106,14 @@ class NegotiatingTelnetHandler(socketserver.BaseRequestHandler):
             # put some effort into making a clean socket shutdown
             # that does not give the client ECONNRESET
             self.request.settimeout(0.1)
-            self.request.recv(4*1024)
+            self.request.recv(4 * 1024)
             self.request.shutdown(socket.SHUT_RDWR)
 
         except IOError:
             log.exception("IOError hit during request")
 
 
-class Negotiator(object):
+class Negotiator:
     NO_NEG = 0
     START_NEG = 1
     WILL = 2
@@ -135,14 +127,14 @@ class Negotiator(object):
 
     def recv(self, bytes):
         """
-        Read bytes from TCP, handling negotiation sequences
+        Read bytes from TCP, handling negotiation sequences.
 
         :param bytes: Number of bytes to read
         :return: a buffer of bytes
         """
         buffer = bytearray()
 
-        # If we keep receiving negotiation sequences, we won't fill the buffer.
+        # If we keep receiving negotiation sequences, we will not fill the buffer.
         # Keep looping while we can, and until we have something to give back
         # to the caller.
         while len(buffer) == 0:
@@ -175,7 +167,7 @@ class Negotiator(object):
             log.debug("Starting negotiation (IAC)")
             self.state = self.START_NEG
         else:
-            # Just append the incoming byte to the buffer
+            # Append the incoming byte to the buffer
             buffer.append(byte_int)
 
     def start_neg(self, byte_int):
@@ -197,8 +189,8 @@ class Negotiator(object):
             log.debug("Client can do")
             self.state = self.DO
         elif byte_int == NegTokens.DONT:
-            # Client is indicating they can't do an option
-            log.debug("Client can't do")
+            # Client is indicating they cannot do an option
+            log.debug("Client cannot do")
             self.state = self.DONT
         else:
             # Received an unexpected byte. Stop negotiations
@@ -250,14 +242,14 @@ class Negotiator(object):
         self.send_iac([NegTokens.WONT, NegOptions.to_val(option_str)])
 
 
-class NegBase(object):
+class NegBase:
     @classmethod
     def to_val(cls, name):
         return getattr(cls, name)
 
     @classmethod
     def from_val(cls, val):
-        for k in cls.__dict__.keys():
+        for k in cls.__dict__:
             if getattr(cls, k) == val:
                 return k
 
@@ -303,9 +295,9 @@ def get_options():
     parser.add_argument("--verbose", action="store", type=int, default=0,
                         help="verbose output")
     parser.add_argument("--pidfile", action="store",
-                        help="file name for the PID")
+                        help="filename for the PID")
     parser.add_argument("--logfile", action="store",
-                        help="file name for the log")
+                        help="filename for the log")
     parser.add_argument("--srcdir", action="store", help="test directory")
     parser.add_argument("--id", action="store", help="server ID")
     parser.add_argument("--ipv4", action="store_true", default=0,
@@ -315,9 +307,7 @@ def get_options():
 
 
 def setup_logging(options):
-    """
-    Set up logging from the command line options
-    """
+    """Set up logging from the command line options."""
     root_logger = logging.getLogger()
     add_stdout = False
 
@@ -332,7 +322,7 @@ def setup_logging(options):
         handler.setLevel(logging.DEBUG)
         root_logger.addHandler(handler)
     else:
-        # The logfile wasn't specified. Add a stdout logger.
+        # The logfile was not specified. Add a stdout logger.
         add_stdout = True
 
     if options.verbose:
@@ -349,17 +339,14 @@ def setup_logging(options):
         root_logger.addHandler(stdout_handler)
 
 
-class ScriptRC(object):
-    """Enum for script return codes"""
+class ScriptRC:
+    """Enum for script return codes."""
+
     SUCCESS = 0
     FAILURE = 1
     EXCEPTION = 2
 
 
-class ScriptException(Exception):
-    pass
-
-
 if __name__ == '__main__':
     # Get the options from the user.
     options = get_options()
@@ -370,8 +357,8 @@ if __name__ == '__main__':
     # Run main script.
     try:
         rc = telnetserver(options)
-    except Exception as e:
-        log.exception(e)
+    except Exception:
+        log.exception('Error in telnet server')
         rc = ScriptRC.EXCEPTION
 
     if options.pidfile and os.path.isfile(options.pidfile):
diff --git a/third-party/curl/tests/nroff-scan.pl b/third-party/curl/tests/nroff-scan.pl
deleted file mode 100644
index 4dddf7cf1b..0000000000
--- a/third-party/curl/tests/nroff-scan.pl
+++ /dev/null
@@ -1,112 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-#
-# scan nroff pages to find basic syntactic problems such as unbalanced \f
-# codes or references to non-existing curl man pages.
-
-my $docsroot = $ARGV[0];
-
-if(!$docsroot || ($docsroot eq "-g")) {
-    print "Usage: nroff-scan.pl <docs root dir> [nroff files]\n";
-    exit;
-}
-
-
-shift @ARGV;
-
-my @f = @ARGV;
-
-my %manp;
-
-sub manpresent {
-    my ($man) = @_;
-    if($manp{$man}) {
-        return 1;
-    }
-    elsif(-r "$docsroot/$man" ||
-          -r "$docsroot/libcurl/$man" ||
-          -r "$docsroot/libcurl/opts/$man") {
-        $manp{$man}=1;
-        return 1;
-    }
-    return 0;
-}
-
-sub file {
-    my ($f) = @_;
-    open(my $fh, "<", "$f") ||
-        die "no file";
-    my $line = 1;
-    while(<$fh>) {
-        chomp;
-        my $l = $_;
-        while($l =~ s/\\f(.)([^ ]*)\\f(.)//) {
-            my ($pre, $str, $post)=($1, $2, $3);
-            if($str =~ /^\\f[ib]/i) {
-                print "error: $f:$line: double-highlight\n";
-                $errors++;
-            }
-            if($post ne "P") {
-                print "error: $f:$line: missing \\fP after $str\n";
-                $errors++;
-            }
-            if($str =~ /((libcurl|curl)([^ ]*))\(3\)/i) {
-                my $man = "$1.3";
-                if(!manpresent($man)) {
-                    print "error: $f:$line: referring to non-existing man page $man\n";
-                    $errors++;
-                }
-                if($pre ne "I") {
-                    print "error: $f:$line: use \\fI before $str\n";
-                    $errors++;
-                }
-            }
-        }
-        if($l =~ /(curl([^ ]*)\(3\))/i) {
-            print "error: $f:$line: non-referencing $1\n";
-            $errors++;
-        }
-        if($l =~ /^\.BR (.*)/) {
-            my $i= $1;
-            while($i =~ s/((lib|)curl([^ ]*)) *\"\(3\)(,|) *\" *//i ) {
-                my $man = "$1.3";
-                if(!manpresent($man)) {
-                    print "error: $f:$line: referring to non-existing man page $man\n";
-                    $errors++;
-                }
-            }
-        }
-        $line++;
-    }
-    close($fh);
-}
-
-foreach my $f (@f) {
-    file($f);
-}
-
-print "OK\n" if(!$errors);
-
-exit $errors?1:0;
diff --git a/third-party/curl/tests/option-check.pl b/third-party/curl/tests/option-check.pl
deleted file mode 100644
index 74d4651734..0000000000
--- a/third-party/curl/tests/option-check.pl
+++ /dev/null
@@ -1,66 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-sub showline {
-    my ($l) = @_;
-    $l =~ s/([^\x20-\x7f])/sprintf "%%%02x", ord $1/eg;
-    return $l;
-}
-
-my $root = $ARGV[0];
-
-open(my $fh, "-|", "perl $root/lib/optiontable.pl < $root/include/curl/curl.h");
-binmode $fh;
-my @gen=<$fh>;
-close($fh);
-
-open($fh, "<", "$root/lib/easyoptions.c");
-binmode $fh;
-my @file=<$fh>;
-close($fh);
-
-if(join("", @gen) ne join("", @file)) {
-    print "easyoptions.c need to be regenerated!\n";
-
-    printf "easyoptions.c is %u lines\n", scalar(@file);
-    printf "generated file is %u lines\n", scalar(@gen);
-    my $e = 0;
-    for my $i (0 .. $#gen) {
-        # strip CRLFs to unify
-        $gen[$i] =~ s/[\r\n]//g;
-        $file[$i] =~ s/[\r\n]//g;
-        if($gen[$i] ne $file[$i]) {
-            printf "File: %u:%s\nGen:  %u:%s\n",
-                $i+1, showline($file[$i]),
-                $i+1, showline($gen[$i]);
-            $e++;
-            if($e > 10) {
-                # only show 10 lines diff
-                last;
-            }
-        }
-    }
-    exit 1 if($e);
-}
diff --git a/third-party/curl/tests/options-scan.pl b/third-party/curl/tests/options-scan.pl
deleted file mode 100644
index 05e50bf590..0000000000
--- a/third-party/curl/tests/options-scan.pl
+++ /dev/null
@@ -1,125 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-#
-#
-# - Get all options mentioned in the $cmddir.
-# - Make sure they're all mentioned in the $opts document
-# - Make usre that the version in $opts matches the version in the file in
-#   $cmddir
-#
-
-my $opts = $ARGV[0];
-my $cmddir = $ARGV[1];
-
-sub cmdfiles {
-    my ($dir)=@_;
-
-    opendir(my $dh, $dir) || die "Can't opendir $dir: $!";
-    my @opts = grep { /\.d$/ && -f "$dir/$_" } readdir($dh);
-    closedir $dh;
-
-    for(@opts) {
-        $_ =~ s/\.d$//;
-        $file{$_}=1;
-    }
-    return @opts;
-}
-
-sub mentions {
-    my ($f) = @_;
-    my @options;
-    open(my $fh, "<", "$f");
-    while(<$fh>) {
-        chomp;
-        if(/(.*) +([0-9.]+)/) {
-            my ($flag, $version)=($1, $2);
-
-            # store the name without the leading dashes
-            $flag =~ s/^--//;
-
-            # cut out short option (if present)
-            $flag =~ s/ \(-.\)//;
-
-            # store the name without trailing space
-            $flag =~ s/ +$//;
-
-            push @options, $flag;
-
-            # options-in-versions says...
-            $oiv{$flag} = $version;
-        }
-    }
-    close($fh);
-    return @options;
-}
-
-sub versioncheck {
-    my ($f, $v)=@_;
-    open(my $fh, "<", "$cmddir/$f.d");
-    while(<$fh>) {
-        chomp;
-        if(/^Added: ([0-9.]+)/) {
-            if($1 ne $v) {
-                print STDERR "$f lists $v in doc but $1 in file\n";
-                $error++;
-            }
-            last;
-        }
-    }
-    close($fh);
-}
-
-# get all the files
-my @cmdopts = cmdfiles($cmddir);
-
-# get all the options mentioned in $o
-my @veropts = mentions($opts);
-
-# check if all files are in the doc
-for my $c (sort @cmdopts) {
-    if($oiv{$c}) {
-        # present, but at same version?
-        versioncheck($c, $oiv{$c});
-    }
-    else {
-        print STDERR "--$c is in the option directory but not in $opts!\n";
-        $error++;
-    }
-}
-
-# check if the all options in the doc have files
-for my $v (sort @veropts) {
-    if($file{$v}) {
-        # present
-    }
-    else {
-        print STDERR "$v is in the doc but NOT as a file!\n";
-        $error++;
-    }
-}
-
-print STDERR "ok\n" if(!$error);
-
-exit $error;
diff --git a/third-party/curl/tests/pathhelp.pm b/third-party/curl/tests/pathhelp.pm
index 7d924b8621..500e43f125 100644
--- a/third-party/curl/tests/pathhelp.pm
+++ b/third-party/curl/tests/pathhelp.pm
@@ -23,37 +23,35 @@
 ###########################################################################
 
 # This Perl package helps with path transforming when running curl tests on
-# Win32 platform with Msys or Cygwin.
-# Three main functions 'sys_native_abs_path', 'sys_native_path' and
-# 'build_sys_abs_path' autodetect format of given pathnames. Following formats
-# are supported:
-#  (1) /some/path   - absolute path in Unix-style
-#  (2) D:/some/path - absolute path in Win32-style
+# native Windows and MSYS/Cygwin.
+# Following input formats are supported (via built-in Perl functions):
+#  (1) /some/path   - absolute path in POSIX-style
+#  (2) D:/some/path - absolute path in Windows-style
 #  (3) some/path    - relative path
-#  (4) D:some/path  - path relative to current directory on Win32 drive (paths
-#                     like 'D:' are treated as 'D:./') (*)
-#  (5) \some/path   - path from root directory on current Win32 drive (*)
+#  (4) D:some/path  - path relative to current directory on Windows drive
+#                     (paths like 'D:' are treated as 'D:./') (*)
+#  (5) \some/path   - path from root directory on current Windows drive (*)
 # All forward '/' and back '\' slashes are treated identically except leading
 # slash in forms (1) and (5).
 # Forward slashes are simpler processed in Perl, do not require extra escaping
-# for shell (unlike back slashes) and accepted by Win32 native programs, so
-# all functions return paths with only forward slashes except
-# 'sys_native_path' which returns paths with first forward slash for form (5).
-# All returned paths don't contain any duplicated slashes, only single slashes
+# for shell (unlike back slashes) and accepted by Windows native programs, so
+# all functions return paths with only forward slashes.
+# All returned paths do not contain any duplicated slashes, only single slashes
 # are used as directory separators on output.
 # On non-Windows platforms functions acts as transparent wrappers for similar
 # Perl's functions or return unmodified string (depending on functionality),
 # so all functions can be unconditionally used on all platforms.
 #
 # (*) CAUTION! Forms (4) and (5) are not recommended to use as they can be
-#     interpreted incorrectly in Perl and Msys/Cygwin environment have low
-#     control on Win32 current drive and Win32 current path on specific drive.
+#     interpreted incorrectly in Perl and MSYS/Cygwin environment have low
+#     control on Windows current drive and Windows current path on specific
+#     drive.
 
 package pathhelp;
 
 use strict;
 use warnings;
-use Cwd 'abs_path';
+use File::Spec;
 
 BEGIN {
     use base qw(Exporter);
@@ -61,24 +59,22 @@ BEGIN {
     our @EXPORT_OK = qw(
         os_is_win
         exe_ext
+        dirsepadd
+        shell_quote
         sys_native_abs_path
         sys_native_current_path
         build_sys_abs_path
-        normalize_path
-        should_use_cygpath
-        drives_mounted_on_cygdrive
     );
 }
 
-
 #######################################################################
 # Block for cached static variables
 #
 {
     # Cached static variable, Perl 5.0-compatible.
-    my $is_win = $^O eq 'MSWin32'
-              || $^O eq 'cygwin'
-              || $^O eq 'msys';
+    my $is_win = $^O eq 'MSWin32' ||
+                 $^O eq 'cygwin' ||
+                 $^O eq 'msys';
 
     # Returns boolean true if OS is any form of Windows.
     sub os_is_win {
@@ -88,7 +84,7 @@ BEGIN {
     # Cached static variable, Perl 5.0-compatible.
     my $cygdrive_present;
 
-    # Returns boolean true if Win32 drives mounted with '/cygdrive/' prefix.
+    # Returns boolean true if Windows drives mounted with '/cygdrive/' prefix.
     sub drives_mounted_on_cygdrive {
         return $cygdrive_present if defined $cygdrive_present;
         $cygdrive_present = ((-e '/cygdrive/') && (-d '/cygdrive/')) ? 1 : 0;
@@ -96,699 +92,123 @@ BEGIN {
     }
 }
 
-my $use_cygpath;     # Only for Win32:
-                     #  undef - autodetect
-                     #      0 - do not use cygpath
-                     #      1 - use cygpath
-
-# Returns boolean true if 'cygpath' utility should be used for path conversion.
-sub should_use_cygpath {
-    return $use_cygpath if defined $use_cygpath;
-    if(os_is_win()) {
-        $use_cygpath = (qx{cygpath -u '.\\' 2>/dev/null} eq "./\n" && $? == 0);
-    } else {
-        $use_cygpath = 0;
-    }
-    return $use_cygpath;
-}
-
 #######################################################################
-# Performs path "normalization": all slashes converted to forward
-# slashes (except leading slash), all duplicated slashes are replaced
-# with single slashes, all relative directories ('./' and '../') are
-# resolved if possible.
-# Path processed as string, directories are not checked for presence so
-# path for not yet existing directory can be "normalized".
-#
-sub normalize_path;
-
-#######################################################################
-# Returns current working directory in Win32 format on Windows.
+# Returns current working directory in Windows format on Windows.
 #
 sub sys_native_current_path {
     return Cwd::getcwd() if !os_is_win();
 
     my $cur_dir;
-    if($^O eq 'msys') {
-        # MSys shell has built-in command.
-        chomp($cur_dir = `bash -c 'pwd -W'`);
-        if($? != 0) {
-            warn "Can't determine Win32 current directory.\n";
-            return undef;
-        }
-        # Add final slash if required.
-        $cur_dir .= '/' if length($cur_dir) > 3;
+    if($^O eq 'MSWin32') {
+        $cur_dir = Cwd::getcwd();
     }
     else {
-        # Do not use 'cygpath' - it falsely succeed on paths like '/cygdrive'.
-        $cur_dir = `cmd "/c;" echo %__CD__%`;
-        if($? != 0 || substr($cur_dir, 0, 1) eq '%') {
-            warn "Can't determine Win32 current directory.\n";
-            return undef;
-        }
-        # Remove both '\r' and '\n'.
-        $cur_dir =~ s{\n|\r}{}g;
-
-        # Replace back slashes with forward slashes.
-        $cur_dir =~ s{\\}{/}g;
+        $cur_dir = Cygwin::posix_to_win_path(Cwd::getcwd());
     }
+    $cur_dir =~ s{[/\\]+}{/}g;
     return $cur_dir;
 }
 
 #######################################################################
-# Returns Win32 current drive letter with colon.
-#
-sub get_win32_current_drive {
-    # Notice parameter "/c;" - it's required to turn off Msys's
-    # transformation of '/c' and compatible with Cygwin.
-    my $drive_letter = `cmd "/c;" echo %__CD__:~0,2%`;
-    if($? != 0 || substr($drive_letter, 1, 1) ne ':') {
-        warn "Can't determine current Win32 drive letter.\n";
-        return undef;
-    }
-
-    return substr($drive_letter, 0, 2);
-}
-
-# Internal function. Converts path by using Msys's built-in transformation.
-# Returned path may contain duplicated and back slashes.
-sub do_msys_transform;
-
-# Internal function. Gets two parameters: first parameter must be single
-# drive letter ('c'), second optional parameter is path relative to drive's
-# current working directory. Returns Win32 absolute normalized path.
-sub get_abs_path_on_win32_drive;
-
-# Internal function. Tries to find or guess Win32 version of given
-# absolute Unix-style path. Other types of paths are not supported.
-# Returned paths contain only single forward slashes (no back and
-# duplicated slashes).
-# Last resort. Used only when other transformations are not available.
-sub do_dumb_guessed_transform;
-
-#######################################################################
-# Converts given path to system native format, i.e. to Win32 format on
-# Windows platform. Relative paths converted to relative, absolute
-# paths converted to absolute.
-#
-sub sys_native_path {
-    my ($path) = @_;
-
-    # Return untouched on non-Windows platforms.
-    return $path if (!os_is_win());
-
-    # Do not process empty path.
-    return $path if ($path eq '');
-
-    if($path =~ s{^([a-zA-Z]):$}{\u$1:}) {
-        # Path is single drive with colon. (C:)
-        # This type of paths is not processed correctly by 'cygpath'.
-        # WARNING!
-        # Be careful, this relative path can be accidentally transformed
-        # into wrong absolute path by adding to it some '/dirname' with
-        # slash at font.
-        return $path;
-    }
-    elsif($path =~ m{^\\} || $path =~ m{^[a-zA-Z]:[^/\\]}) {
-        # Path is a directory or filename on Win32 current drive or relative
-        # path on current directory on specific Win32 drive.
-        # ('\path' or 'D:path')
-        # First type of paths is not processed by Msys transformation and
-        # resolved to absolute path by 'cygpath'.
-        # Second type is not processed by Msys transformation and may be
-        # incorrectly processed by 'cygpath' (for paths like 'D:..\../.\')
-
-        my $first_char = ucfirst(substr($path, 0, 1));
-
-        # Replace any back and duplicated slashes with single forward slashes.
-        $path =~ s{[\\/]+}{/}g;
-
-        # Convert leading slash back to forward slash to indicate
-        # directory on Win32 current drive or capitalize drive letter.
-        substr($path, 0, 1, $first_char);
-        return $path;
-    }
-    elsif(should_use_cygpath()) {
-        # 'cygpath' is available - use it.
-
-        # Remove leading duplicated forward and back slashes, as they may
-        # prevent transforming and may be not processed.
-        $path =~ s{^([\\/])[\\/]+}{$1}g;
-
-        my $has_final_slash = ($path =~ m{[/\\]$});
-
-        # Use 'cygpath', '-m' means Win32 path with forward slashes.
-        chomp($path = `cygpath -m '$path'`);
-        if ($? != 0) {
-            warn "Can't convert path by \"cygpath\".\n";
-            return undef;
-        }
-
-        # 'cygpath' may remove last slash for existing directories.
-        $path .= '/' if($has_final_slash);
-
-        # Remove any duplicated forward slashes (added by 'cygpath' for root
-        # directories)
-        $path =~ s{//+}{/}g;
-
-        return $path;
-    }
-    elsif($^O eq 'msys') {
-        # Msys transforms automatically path to Windows native form in staring
-        # program parameters if program is not Msys-based.
-
-        $path = do_msys_transform($path);
-        return undef if !defined $path;
-
-        # Capitalize drive letter for Win32 paths.
-        $path =~ s{^([a-z]:)}{\u$1};
-
-        # Replace any back and duplicated slashes with single forward slashes.
-        $path =~ s{[\\/]+}{/}g;
-        return $path;
-    }
-    elsif($path =~ s{^([a-zA-Z]):[/\\]}{\u$1:/}) {
-        # Path is already in Win32 form. ('C:\path')
-
-        # Replace any back and duplicated slashes with single forward slashes.
-        $path =~ s{[\\/]+}{/}g;
-        return $path;
-    }
-    elsif($path !~ m{^/}) {
-        # Path is in relative form. ('path/name', './path' or '../path')
-
-        # Replace any back and duplicated slashes with single forward slashes.
-        $path =~ s{[\\/]+}{/}g;
-        return $path;
-    }
-
-    # OS is Windows, but not Msys, path is absolute, path is not in Win32
-    # form and 'cygpath' is not available.
-    return do_dumb_guessed_transform($path);
-}
-
-#######################################################################
-# Converts given path to system native absolute path, i.e. to Win32
+# Converts given path to system native absolute path, i.e. to Windows
 # absolute format on Windows platform. Both relative and absolute
 # formats are supported for input.
 #
 sub sys_native_abs_path {
     my ($path) = @_;
 
-    if(!os_is_win()) {
-        # Convert path to absolute form.
-        $path = Cwd::abs_path($path);
+    # Return untouched on non-Windows platforms.
+    return File::Spec->rel2abs($path) if !os_is_win();
 
-        # Do not process further on non-Windows platforms.
-        return $path;
+    # Do not process empty path.
+    return $path if($path eq '');
+
+    my $res;
+    if($^O eq 'msys' || $^O eq 'cygwin') {
+        $res = Cygwin::posix_to_win_path(File::Spec->rel2abs($path));
+    }
+    elsif($path =~ m{^/(cygdrive/)?([a-z])/(.*)}) {
+        $res = uc($2) . ":/" . $3;
+    }
+    else {
+        $res = File::Spec->rel2abs($path);
     }
 
-    if($path =~ m{^([a-zA-Z]):($|[^/\\].*$)}) {
-        # Path is single drive with colon or relative path on Win32 drive.
-        # ('C:' or 'C:path')
-        # This kind of relative path is not processed correctly by 'cygpath'.
-        # Get specified drive letter
-        return get_abs_path_on_win32_drive($1, $2);
-    }
-    elsif($path eq '') {
-        # Path is empty string. Return current directory.
-        # Empty string processed correctly by 'cygpath'.
-
-        return sys_native_current_path();
-    }
-    elsif(should_use_cygpath()) {
-        # 'cygpath' is available - use it.
-
-        my $has_final_slash = ($path =~ m{[\\/]$});
-
-        # Remove leading duplicated forward and back slashes, as they may
-        # prevent transforming and may be not processed.
-        $path =~ s{^([\\/])[\\/]+}{$1}g;
-
-        print "Inter result: \"$path\"\n";
-        # Use 'cygpath', '-m' means Win32 path with forward slashes,
-        # '-a' means absolute path
-        chomp($path = `cygpath -m -a '$path'`);
-        if($? != 0) {
-            warn "Can't resolve path by usung \"cygpath\".\n";
-            return undef;
-        }
-
-        # 'cygpath' may remove last slash for existing directories.
-        $path .= '/' if($has_final_slash);
-
-        # Remove any duplicated forward slashes (added by 'cygpath' for root
-        # directories)
-        $path =~ s{//+}{/}g;
-
-        return $path
-    }
-    elsif($path =~ s{^([a-zA-Z]):[/\\]}{\u$1:/}) {
-        # Path is already in Win32 form. ('C:\path')
-
-        # Replace any possible back slashes with forward slashes,
-        # remove any duplicated slashes, resolve relative dirs.
-        return normalize_path($path);
-    }
-    elsif(substr($path, 0, 1) eq '\\' ) {
-        # Path is directory or filename on Win32 current drive. ('\Windows')
-
-        my $w32drive = get_win32_current_drive();
-        return undef if !defined $w32drive;
-
-        # Combine drive and path.
-        # Replace any possible back slashes with forward slashes,
-        # remove any duplicated slashes, resolve relative dirs.
-        return normalize_path($w32drive . $path);
-    }
-
-    if(substr($path, 0, 1) ne '/') {
-        # Path is in relative form. Resolve relative directories in Unix form
-        # *BEFORE* converting to Win32 form otherwise paths like
-        # '../../../cygdrive/c/windows' will not be resolved.
-
-        my $cur_dir;
-        # MSys shell has built-in command.
-        if($^O eq 'msys') {
-            $cur_dir = `bash -c 'pwd -L'`;
-        }
-        else {
-            $cur_dir = `pwd -L`;
-        }
-        if($? != 0) {
-            warn "Can't determine current working directory.\n";
-            return undef;
-        }
-        chomp($cur_dir);
-
-        $path = $cur_dir . '/' . $path;
-    }
-
-    # Resolve relative dirs.
-    $path = normalize_path($path);
-    return undef unless defined $path;
-
-    if($^O eq 'msys') {
-        # Msys transforms automatically path to Windows native form in staring
-        # program parameters if program is not Msys-based.
-        $path = do_msys_transform($path);
-        return undef if !defined $path;
-
-        # Replace any back and duplicated slashes with single forward slashes.
-        $path =~ s{[\\/]+}{/}g;
-        return $path;
-    }
-    # OS is Windows, but not Msys, path is absolute, path is not in Win32
-    # form and 'cygpath' is not available.
-
-    return do_dumb_guessed_transform($path);
+    $res =~ s{[/\\]+}{/}g;
+    return $res;
 }
 
-# Internal function. Converts given Unix-style absolute path to Win32 format.
-sub simple_transform_win32_to_unix;
-
 #######################################################################
 # Converts given path to build system format absolute path, i.e. to
-# Msys/Cygwin Unix-style absolute format on Windows platform. Both
+# MSYS/Cygwin POSIX-style absolute format on Windows platform. Both
 # relative and absolute formats are supported for input.
 #
 sub build_sys_abs_path {
     my ($path) = @_;
 
-    if(!os_is_win()) {
-        # Convert path to absolute form.
-        $path = Cwd::abs_path($path);
+    # Return untouched on non-Windows platforms.
+    return File::Spec->rel2abs($path) if !os_is_win();
 
-        # Do not process further on non-Windows platforms.
-        return $path;
-    }
-
-    if($path =~ m{^([a-zA-Z]):($|[^/\\].*$)}) {
-        # Path is single drive with colon or relative path on Win32 drive.
-        # ('C:' or 'C:path')
-        # This kind of relative path is not processed correctly by 'cygpath'.
-        # Get specified drive letter
-
-        # Resolve relative dirs in Win32-style path or paths like 'D:/../c/'
-        # will be resolved incorrectly.
-        # Replace any possible back slashes with forward slashes,
-        # remove any duplicated slashes.
-        $path = get_abs_path_on_win32_drive($1, $2);
-        return undef if !defined $path;
-
-        return simple_transform_win32_to_unix($path);
-    }
-    elsif($path eq '') {
-        # Path is empty string. Return current directory.
-        # Empty string processed correctly by 'cygpath'.
-
-        # MSys shell has built-in command.
-        if($^O eq 'msys') {
-            chomp($path = `bash -c 'pwd -L'`);
-        }
-        else {
-            chomp($path = `pwd -L`);
-        }
-        if($? != 0) {
-            warn "Can't determine Unix-style current working directory.\n";
-            return undef;
-        }
-
-        # Add final slash if not at root dir.
-        $path .= '/' if length($path) > 2;
-        return $path;
-    }
-    elsif(should_use_cygpath()) {
-        # 'cygpath' is available - use it.
-
-        my $has_final_slash = ($path =~ m{[\\/]$});
-
-        # Resolve relative directories, as they may be not resolved for
-        # Unix-style paths.
-        # Remove duplicated slashes, as they may be not processed.
-        $path = normalize_path($path);
-        return undef if !defined $path;
-
-        # Use 'cygpath', '-u' means Unix-stile path,
-        # '-a' means absolute path
-        chomp($path = `cygpath -u -a '$path'`);
-        if($? != 0) {
-            warn "Can't resolve path by usung \"cygpath\".\n";
-            return undef;
-        }
-
-        # 'cygpath' removes last slash if path is root dir on Win32 drive.
-        # Restore it.
-        $path .= '/' if($has_final_slash &&
-                        substr($path, length($path) - 1, 1) ne '/');
-
-        return $path
-    }
-    elsif($path =~ m{^[a-zA-Z]:[/\\]}) {
-        # Path is already in Win32 form. ('C:\path')
-
-        # Resolve relative dirs in Win32-style path otherwise paths
-        # like 'D:/../c/' will be resolved incorrectly.
-        # Replace any possible back slashes with forward slashes,
-        # remove any duplicated slashes.
-        $path = normalize_path($path);
-        return undef if !defined $path;
-
-        return simple_transform_win32_to_unix($path);
-    }
-    elsif(substr($path, 0, 1) eq '\\') {
-        # Path is directory or filename on Win32 current drive. ('\Windows')
-
-        my $w32drive = get_win32_current_drive();
-        return undef if !defined $w32drive;
-
-        # Combine drive and path.
-        # Resolve relative dirs in Win32-style path or paths like 'D:/../c/'
-        # will be resolved incorrectly.
-        # Replace any possible back slashes with forward slashes,
-        # remove any duplicated slashes.
-        $path = normalize_path($w32drive . $path);
-        return undef if !defined $path;
-
-        return simple_transform_win32_to_unix($path);
-    }
-
-    # Path is not in any Win32 form.
-    if(substr($path, 0, 1) ne '/') {
-        # Path in relative form. Resolve relative directories in Unix form
-        # *BEFORE* converting to Win32 form otherwise paths like
-        # '../../../cygdrive/c/windows' will not be resolved.
-
-        my $cur_dir;
-        # MSys shell has built-in command.
-        if($^O eq 'msys') {
-            $cur_dir = `bash -c 'pwd -L'`;
-        }
-        else {
-            $cur_dir = `pwd -L`;
-        }
-        if($? != 0) {
-            warn "Can't determine current working directory.\n";
-            return undef;
-        }
-        chomp($cur_dir);
-
-        $path = $cur_dir . '/' . $path;
-    }
-
-    return normalize_path($path);
-}
-
-#######################################################################
-# Performs path "normalization": all slashes converted to forward
-# slashes (except leading slash), all duplicated slashes are replaced
-# with single slashes, all relative directories ('./' and '../') are
-# resolved if possible.
-# Path processed as string, directories are not checked for presence so
-# path for not yet existing directory can be "normalized".
-#
-sub normalize_path {
-    my ($path) = @_;
-
-    # Don't process empty paths.
-    return $path if $path eq '';
-
-    if($path !~ m{(?:^|\\|/)\.{1,2}(?:\\|/|$)}) {
-        # Speed up processing of simple paths.
-        my $first_char = substr($path, 0, 1);
-        $path =~ s{[\\/]+}{/}g;
-        # Restore starting backslash if any.
-        substr($path, 0, 1, $first_char);
-        return $path;
-    }
-
-    my @arr;
-    my $prefix;
-    my $have_root = 0;
-
-    # Check whether path starts from Win32 drive. ('C:path' or 'C:\path')
-    if($path =~ m{^([a-zA-Z]:(/|\\)?)(.*$)}) {
-        $prefix = $1;
-        $have_root = 1 if defined $2;
-        # Process path separately from drive letter.
-        @arr = split(m{\/|\\}, $3);
-        # Replace backslash with forward slash if required.
-        substr($prefix, 2, 1, '/') if $have_root;
-    }
-    else {
-        if($path =~ m{^(\/|\\)}) {
-            $have_root = 1;
-            $prefix = $1;
-        }
-        else {
-            $prefix = '';
-        }
-        @arr = split(m{\/|\\}, $path);
-    }
-
-    my $p = 0;
-    my @res;
-
-    for my $el (@arr) {
-        if(length($el) == 0 || $el eq '.') {
-            next;
-        }
-        elsif($el eq '..' && @res > 0 && $res[-1] ne '..') {
-            pop @res;
-            next;
-        }
-        push @res, $el;
-    }
-    if($have_root && @res > 0 && $res[0] eq '..') {
-        warn "Error processing path \"$path\": " .
-             "Parent directory of root directory does not exist!\n";
-        return undef;
-    }
-
-    my $ret = $prefix . join('/', @res);
-    $ret .= '/' if($path =~ m{\\$|/$} && scalar @res > 0);
-
-    return $ret;
-}
-
-# Internal function. Converts path by using Msys's built-in
-# transformation.
-sub do_msys_transform {
-    my ($path) = @_;
-    return undef if $^O ne 'msys';
-    return $path if $path eq '';
-
-    # Remove leading double forward slashes, as they turn off Msys
-    # transforming.
-    $path =~ s{^/[/\\]+}{/};
-
-    # Msys transforms automatically path to Windows native form in staring
-    # program parameters if program is not Msys-based.
-    # Note: already checked that $path is non-empty.
-    $path = `cmd //c echo '$path'`;
-    if($? != 0) {
-        warn "Can't transform path into Win32 form by using Msys" .
-             "internal transformation.\n";
-        return undef;
-    }
-
-    # Remove double quotes, they are added for paths with spaces,
-    # remove both '\r' and '\n'.
-    $path =~ s{^\"|\"$|\"\r|\n|\r}{}g;
-
-    return $path;
-}
-
-# Internal function. Gets two parameters: first parameter must be single
-# drive letter ('c'), second optional parameter is path relative to drive's
-# current working directory. Returns Win32 absolute normalized path.
-sub get_abs_path_on_win32_drive {
-    my ($drv, $rel_path) = @_;
     my $res;
-
-    # Get current directory on specified drive.
-    # "/c;" is compatible with both Msys and Cygwin.
-    my $cur_dir_on_drv = `cmd "/c;" echo %=$drv:%`;
-    if($? != 0) {
-        warn "Can't determine Win32 current directory on drive $drv:.\n";
-        return undef;
-    }
-
-    if($cur_dir_on_drv =~ m{^[%]}) {
-        # Current directory on drive is not set, default is
-        # root directory.
-
-        $res = ucfirst($drv) . ':/';
+    if($^O eq 'msys' || $^O eq 'cygwin') {
+        $res = Cygwin::win_to_posix_path($path, 1);
     }
     else {
-        # Current directory on drive was set.
-        # Remove both '\r' and '\n'.
-        $cur_dir_on_drv =~ s{\n|\r}{}g;
+        $res = File::Spec->rel2abs($path);
 
-        # Append relative path part.
-        $res = $cur_dir_on_drv . '/';
+        if($res =~ m{^([A-Za-z]):(.*)}) {
+            $res = "/" . lc($1) . $2;
+            $res = '/cygdrive' . $res if(drives_mounted_on_cygdrive());
+        }
     }
-    $res .= $rel_path if defined $rel_path;
 
-    # Replace any possible back slashes with forward slashes,
-    # remove any duplicated slashes, resolve relative dirs.
-    return normalize_path($res);
+    return $res;
 }
 
-# Internal function. Tries to find or guess Win32 version of given
-# absolute Unix-style path. Other types of paths are not supported.
-# Returned paths contain only single forward slashes (no back and
-# duplicated slashes).
-# Last resort. Used only when other transformations are not available.
-sub do_dumb_guessed_transform {
-    my ($path) = @_;
-
-    # Replace any possible back slashes and duplicated forward slashes
-    # with single forward slashes.
-    $path =~ s{[/\\]+}{/}g;
-
-    # Empty path is not valid.
-    return undef if (length($path) == 0);
-
-    # RE to find Win32 drive letter
-    my $drv_ltr_re = drives_mounted_on_cygdrive() ?
-                        qr{^/cygdrive/([a-zA-Z])($|/.*$)} :
-                        qr{^/([a-zA-Z])($|/.*$)};
-
-    # Check path whether path is Win32 directly mapped drive and try to
-    # transform it assuming that drive letter is matched to Win32 drive letter.
-    if($path =~ m{$drv_ltr_re}) {
-        return ucfirst($1) . ':/' if(length($2) == 0);
-        return ucfirst($1) . ':' . $2;
-    }
-
-    # This may be some custom mapped path. ('/mymount/path')
-
-    # Must check longest possible path component as subdir can be mapped to
-    # different directory. For example '/usr/bin/' can be mapped to '/bin/' or
-    # '/bin/' can be mapped to '/usr/bin/'.
-    my $check_path = $path;
-    my $path_tail = '';
-    while(1) {
-        if(-d $check_path) {
-            my $res =
-                `(cd "$check_path" && cmd /c "echo %__CD__%") 2>/dev/null`;
-            if($? == 0 && substr($path, 0, 1) ne '%') {
-                # Remove both '\r' and '\n'.
-                $res =~ s{\n|\r}{}g;
-
-                # Replace all back slashes with forward slashes.
-                $res =~ s{\\}{/}g;
-
-                if(length($path_tail) > 0) {
-                    return $res . $path_tail;
-                }
-                else {
-                    $res =~ s{/$}{} if $check_path !~ m{/$};
-                    return $res;
-                }
-            }
-        }
-        if($check_path =~ m{(^.*/)([^/]+/*)}) {
-            $check_path = $1;
-            $path_tail = $2 . $path_tail;
-        }
-        else {
-            # Shouldn't happens as root '/' directory should always
-            # be resolvable.
-            warn "Can't determine Win32 directory for path \"$path\".\n";
-            return undef;
-        }
-    }
-}
-
-
-# Internal function. Converts given Unix-style absolute path to Win32 format.
-sub simple_transform_win32_to_unix {
-    my ($path) = @_;
-
-    if(should_use_cygpath()) {
-        # 'cygpath' gives precise result.
-        my $res;
-        chomp($res = `cygpath -a -u '$path'`);
-        if($? != 0) {
-            warn "Can't determine Unix-style directory for Win32 " .
-                 "directory \"$path\".\n";
-            return undef;
-        }
-
-        # 'cygpath' removes last slash if path is root dir on Win32 drive.
-        $res .= '/' if(substr($res, length($res) - 1, 1) ne '/' &&
-                       $path =~ m{[/\\]$});
-        return $res;
-    }
-
-    # 'cygpath' is not available, use guessed transformation.
-    if($path !~ s{^([a-zA-Z]):(?:/|\\)}{/\l$1/}) {
-        warn "Can't determine Unix-style directory for Win32 " .
-             "directory \"$path\".\n";
-        return undef;
-    }
-
-    $path = '/cygdrive' . $path if(drives_mounted_on_cygdrive());
-    return $path;
-}
-#
 #***************************************************************************
 # Return file extension for executable files on this operating system
 #
 sub exe_ext {
     my ($component, @arr) = @_;
-    if ($ENV{'CURL_TEST_EXE_EXT'}) {
+    if($ENV{'CURL_TEST_EXE_EXT'}) {
         return $ENV{'CURL_TEST_EXE_EXT'};
     }
-    if ($ENV{'CURL_TEST_EXE_EXT_'.$component}) {
-        return $ENV{'CURL_TEST_EXE_EXT_'.$component};
+    if($ENV{'CURL_TEST_EXE_EXT_' . $component}) {
+        return $ENV{'CURL_TEST_EXE_EXT_' . $component};
     }
-    if ($^O eq 'MSWin32' || $^O eq 'cygwin' || $^O eq 'msys' ||
-        $^O eq 'dos' || $^O eq 'os2') {
+    if($^O eq 'MSWin32' || $^O eq 'cygwin' || $^O eq 'msys' ||
+       $^O eq 'dos' || $^O eq 'os2') {
         return '.exe';
     }
+    return '';
+}
+
+#***************************************************************************
+# Add ending slash if missing
+#
+sub dirsepadd {
+    my ($dir) = @_;
+    $dir =~ s/\/$//;
+    return $dir . '/';
+}
+
+#######################################################################
+# Quote an argument for passing safely to a Bourne shell
+# This does the same thing as String::ShellQuote but does not need a package.
+#
+sub shell_quote {
+    my ($s) = @_;
+    if($^O eq 'MSWin32') {
+        $s = '"' . $s . '"';
+    }
+    else {
+        if($s !~ m/^[-+=.,_\/:a-zA-Z0-9]+$/) {
+            # string contains a "dangerous" character--quote it
+            $s =~ s/'/'"'"'/g;
+            $s = "'" . $s . "'";
+        }
+    }
+    return $s;
 }
 
 1;    # End of module
diff --git a/third-party/curl/tests/processhelp.pm b/third-party/curl/tests/processhelp.pm
index 170863f2fa..434a14f7cf 100644
--- a/third-party/curl/tests/processhelp.pm
+++ b/third-party/curl/tests/processhelp.pm
@@ -27,11 +27,18 @@ package processhelp;
 use strict;
 use warnings;
 
+use Time::HiRes;
+
+use pathhelp qw(
+    os_is_win
+    );
+
+my $has_win32_process;
+
 BEGIN {
     use base qw(Exporter);
 
     our @EXPORT = qw(
-        portable_sleep
         pidfromfile
         pidexists
         pidwait
@@ -43,15 +50,16 @@ BEGIN {
         clear_advisor_read_lock
     );
 
-    # portable sleeping needs Time::HiRes
-    eval {
-        no warnings "all";
-        require Time::HiRes;
-    };
-    # portable sleeping falls back to native Sleep on Win32
-    eval {
-        no warnings "all";
-        require Win32;
+    if(os_is_win() && $^O ne 'MSWin32') {
+        $has_win32_process = eval {
+            no warnings "all";
+            # https://metacpan.org/pod/Win32::Process
+            require Win32::Process;
+            # https://metacpan.org/pod/Win32::Process::List
+            require Win32::Process::List;
+        };
+    } else {
+      $has_win32_process = 0;
     }
 }
 
@@ -61,67 +69,76 @@ use serverhelp qw(
     datasockf_pidfilename
     );
 
-use pathhelp qw(
-    os_is_win
+use globalconfig qw(
+    $dev_null
     );
 
-#######################################################################
-# portable_sleep uses Time::HiRes::sleep if available and falls back
-# to the classic approach of using select(undef, undef, undef, ...).
-# even though that one is not portable due to being implemented using
-# select on Windows: https://perldoc.perl.org/perlport.html#select
-# Therefore it uses Win32::Sleep on Windows systems instead.
-#
-sub portable_sleep {
-    my ($seconds) = @_;
-
-    if($Time::HiRes::VERSION) {
-        Time::HiRes::sleep($seconds);
-    }
-    elsif (os_is_win()) {
-        Win32::Sleep($seconds*1000);
-    }
-    else {
-        select(undef, undef, undef, $seconds);
-    }
-}
-
 #######################################################################
 # pidfromfile returns the pid stored in the given pidfile.  The value
-# of the returned pid will never be a negative value. It will be zero
-# on any file related error or if a pid can not be extracted from the
-# given file.
+# of the returned pid is never a negative value. It is zero on any file
+# related error or if a pid can not be extracted from the given file.
 #
 sub pidfromfile {
     my $pidfile = $_[0];
+    my $timeout_sec = $_[1];
     my $pid = 0;
-
-    if(-f $pidfile && -s $pidfile && open(my $pidfh, "<", "$pidfile")) {
-        $pid = 0 + <$pidfh>;
-        close($pidfh);
-        $pid = 0 if($pid < 0);
+    my $waits = 0;
+    # wait at max 15 seconds for the file to exist and have valid content
+    while(!$pid && ($waits <= ($timeout_sec * 10))) {
+        if(-f $pidfile && -s $pidfile && open(my $pidfh, "<", $pidfile)) {
+            $pid = 0 + <$pidfh>;
+            close($pidfh);
+            $pid = 0 if($pid < 0);
+        }
+        Time::HiRes::sleep(0.1) unless $pid || !$timeout_sec;
+        ++$waits;
     }
     return $pid;
 }
 
+#######################################################################
+# return Cygwin pid from virtual pid
+#
+sub winpid_to_pid {
+    my $vpid = $_[0];
+    if(($^O eq 'cygwin' || $^O eq 'msys') && $vpid > 4194304) {
+        my $pid = Cygwin::winpid_to_pid($vpid - 4194304);
+        if($pid) {
+            return $pid;
+        } else {
+            return $vpid
+        }
+    }
+    return $vpid;
+}
+
 #######################################################################
 # pidexists checks if a process with a given pid exists and is alive.
-# This will return the positive pid if the process exists and is alive.
-# This will return the negative pid if the process exists differently.
-# This will return 0 if the process could not be found.
+# This returns the positive pid if the process exists and is alive.
+# This returns the negative pid if the process exists differently.
+# This returns 0 if the process could not be found.
 #
 sub pidexists {
     my $pid = $_[0];
 
     if($pid > 0) {
         # verify if currently existing Windows process
-        if ($pid > 65536 && os_is_win()) {
-            $pid -= 65536;
+        $pid = winpid_to_pid($pid);
+        if($pid > 4194304 && os_is_win()) {
+            $pid -= 4194304;
             if($^O ne 'MSWin32') {
-                my $filter = "PID eq $pid";
-                my $result = `tasklist -fi \"$filter\" 2>nul`;
-                if(index($result, "$pid") != -1) {
-                    return -$pid;
+                if($has_win32_process) {
+                    my %processes = Win32::Process::List->new()->GetProcesses();
+                    if(exists $processes{$pid}) {
+                        return -$pid;
+                    }
+                } else {
+                    my $filter = "PID eq $pid";
+                    # https://ss64.com/nt/tasklist.html
+                    my $result = qx(tasklist -fi \"$filter\" 2>$dev_null);
+                    if(index($result, $pid) != -1) {
+                        return -$pid;
+                    }
                 }
                 return 0;
             }
@@ -144,13 +161,39 @@ sub pidterm {
 
     if($pid > 0) {
         # request the process to quit
-        if ($pid > 65536 && os_is_win()) {
-            $pid -= 65536;
+        $pid = winpid_to_pid($pid);
+        if($pid > 4194304 && os_is_win()) {
+            $pid -= 4194304;
             if($^O ne 'MSWin32') {
-                my $filter = "PID eq $pid";
-                my $result = `tasklist -fi \"$filter\" 2>nul`;
-                if(index($result, "$pid") != -1) {
-                    system("taskkill -fi \"$filter\" >nul 2>&1");
+                if($has_win32_process) {
+                    Win32::Process::KillProcess($pid, 0);
+                } else {
+                    # https://ss64.com/nt/tasklist.html
+                    my $result = qx(tasklist -v -fo list -fi "PID eq $pid" 2>&1);
+                    $result =~ s/\r//g;
+                    $result =~ s/\n/ | /g;
+                    print "Task info for $pid before taskkill: '$result'\n";
+
+                    $result = qx(powershell -Command "Get-CimInstance -ClassName Win32_Process -Filter 'ParentProcessId=$pid' | Select ProcessId,ParentProcessId,Name,CommandLine");
+                    $result =~ s/\r//g;
+                    print "Task child processes for $pid before taskkill:\n";
+                    print "$result\n";
+
+                    if(!$ENV{'CURL_TEST_NO_TASKKILL'}) {
+                        # https://ss64.com/nt/taskkill.html
+                        my $cmd;
+                        if($ENV{'CURL_TEST_NO_TASKKILL_TREE'}) {
+                            $cmd = "taskkill -f    -pid $pid >$dev_null 2>&1";
+                        }
+                        else {
+                            $cmd = "taskkill -f -t -pid $pid >$dev_null 2>&1";
+                        }
+                        print "Executing: '$cmd'\n";
+                        system($cmd);
+                    }
+                    else {
+                        print "taskkill disabled via CURL_TEST_NO_TASKKILL.\n";
+                    }
                 }
                 return;
             }
@@ -169,15 +212,39 @@ sub pidkill {
 
     if($pid > 0) {
         # request the process to quit
-        if ($pid > 65536 && os_is_win()) {
-            $pid -= 65536;
+        $pid = winpid_to_pid($pid);
+        if($pid > 4194304 && os_is_win()) {
+            $pid -= 4194304;
             if($^O ne 'MSWin32') {
-                my $filter = "PID eq $pid";
-                my $result = `tasklist -fi \"$filter\" 2>nul`;
-                if(index($result, "$pid") != -1) {
-                    system("taskkill -f -fi \"$filter\" >nul 2>&1");
-                    # Windows XP Home compatibility
-                    system("tskill $pid >nul 2>&1");
+                if($has_win32_process) {
+                    Win32::Process::KillProcess($pid, 0);
+                } else {
+                    # https://ss64.com/nt/tasklist.html
+                    my $result = qx(tasklist -v -fo list -fi "PID eq $pid" 2>&1);
+                    $result =~ s/\r//g;
+                    $result =~ s/\n/ | /g;
+                    print "Task info for $pid before taskkill: '$result'\n";
+
+                    $result = qx(powershell -Command "Get-CimInstance -ClassName Win32_Process -Filter 'ParentProcessId=$pid' | Select ProcessId,ParentProcessId,Name,CommandLine");
+                    $result =~ s/\r//g;
+                    print "Task child processes for $pid before taskkill:\n";
+                    print "$result\n";
+
+                    if(!$ENV{'CURL_TEST_NO_TASKKILL'}) {
+                        # https://ss64.com/nt/taskkill.html
+                        my $cmd;
+                        if($ENV{'CURL_TEST_NO_TASKKILL_TREE'}) {
+                            $cmd = "taskkill -f    -pid $pid >$dev_null 2>&1";
+                        }
+                        else {
+                            $cmd = "taskkill -f -t -pid $pid >$dev_null 2>&1";
+                        }
+                        print "Executing: '$cmd'\n";
+                        system($cmd);
+                    }
+                    else {
+                        print "taskkill disabled via CURL_TEST_NO_TASKKILL.\n";
+                    }
                 }
                 return;
             }
@@ -195,13 +262,24 @@ sub pidwait {
     my $pid = $_[0];
     my $flags = $_[1];
 
+    $pid = winpid_to_pid($pid);
     # check if the process exists
-    if ($pid > 65536 && os_is_win()) {
+    if($pid > 4194304 && os_is_win()) {
         if($flags == &WNOHANG) {
             return pidexists($pid)?0:$pid;
         }
+        my $start = time;
+        my $warn_at = 5;
         while(pidexists($pid)) {
-            portable_sleep(0.01);
+            if(time - $start > $warn_at) {
+                print "pidwait: still waiting for PID ", $pid, "\n";
+                $warn_at += 5;
+                if($warn_at > 20) {
+                    print "pidwait: giving up waiting for PID ", $pid, "\n";
+                    last;
+                }
+            }
+            Time::HiRes::sleep(0.2);
         }
         return $pid;
     }
@@ -212,18 +290,18 @@ sub pidwait {
 
 #######################################################################
 # processexists checks if a process with the pid stored in the given
-# pidfile exists and is alive. This will return 0 on any file related
+# pidfile exists and is alive. This returns 0 on any file related
 # error or if a pid can not be extracted from the given file. When a
 # process with the same pid as the one extracted from the given file
 # is currently alive this returns that positive pid. Otherwise, when
-# the process is not alive, will return the negative value of the pid.
+# the process is not alive, it returns the negative value of the pid.
 #
 sub processexists {
     use POSIX ":sys_wait_h";
     my $pidfile = $_[0];
 
     # fetch pid from pidfile
-    my $pid = pidfromfile($pidfile);
+    my $pid = pidfromfile($pidfile, 0);
 
     if($pid > 0) {
         # verify if currently alive
@@ -232,7 +310,7 @@ sub processexists {
         }
         else {
             # get rid of the certainly invalid pidfile
-            unlink($pidfile) if($pid == pidfromfile($pidfile));
+            unlink($pidfile) if($pid == pidfromfile($pidfile, 0));
             # reap its dead children, if not done yet
             pidwait($pid, &WNOHANG);
             # negative return value means dead process
@@ -244,7 +322,7 @@ sub processexists {
 
 #######################################################################
 # killpid attempts to gracefully stop processes in the given pid list
-# with a SIGTERM signal and SIGKILLs those which haven't died on time.
+# with a SIGTERM signal and SIGKILLs those which have not died on time.
 #
 sub killpid {
     my ($verbose, $pidlist) = @_;
@@ -263,8 +341,8 @@ sub killpid {
         @requested = sort({$a <=> $b} @requested);
     }
     for(my $i = scalar(@requested) - 2; $i >= 0; $i--) {
-        if($requested[$i] == $requested[$i+1]) {
-            splice @requested, $i+1, 1;
+        if($requested[$i] == $requested[$i + 1]) {
+            splice @requested, $i + 1, 1;
         }
     }
 
@@ -307,7 +385,9 @@ sub killpid {
                 }
             }
             last if(not scalar(@signalled));
-            portable_sleep(0.05);
+            # give any zombies of us a chance to move on to the afterlife
+            pidwait(0, &WNOHANG);
+            Time::HiRes::sleep(0.05);
         }
     }
 
@@ -393,18 +473,16 @@ sub killallsockfilters {
     }
 }
 
-
 sub set_advisor_read_lock {
     my ($filename) = @_;
 
     my $fileh;
-    if(open($fileh, ">", "$filename") && close($fileh)) {
+    if(open($fileh, ">", $filename) && close($fileh)) {
         return;
     }
     printf "Error creating lock file $filename error: $!\n";
 }
 
-
 sub clear_advisor_read_lock {
     my ($filename) = @_;
 
@@ -413,5 +491,4 @@ sub clear_advisor_read_lock {
     }
 }
 
-
 1;
diff --git a/third-party/curl/tests/requirements.txt b/third-party/curl/tests/requirements.txt
index 706043ac39..cb30e3e298 100644
--- a/third-party/curl/tests/requirements.txt
+++ b/third-party/curl/tests/requirements.txt
@@ -1,26 +1,5 @@
-# -*- coding: utf-8 -*-
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
 # Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
 #
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
 # SPDX-License-Identifier: curl
-#
-###########################################################################
-#
-impacket
+
+impacket==0.13.0
diff --git a/third-party/curl/tests/rtspserver.pl b/third-party/curl/tests/rtspserver.pl
index 3282d9c231..cbe914eee0 100644
--- a/third-party/curl/tests/rtspserver.pl
+++ b/third-party/curl/tests/rtspserver.pl
@@ -34,14 +34,11 @@ BEGIN {
 use serverhelp qw(
     server_pidfilename
     server_logfilename
-    );
-
-use pathhelp qw(
-    exe_ext
+    server_exe
     );
 
 my $verbose = 0;     # set to 1 for debugging
-my $port = 8990;     # just a default
+my $port = 8990;     # a default
 my $ipvnum = 4;      # default IP version of rtsp server
 my $idnum = 1;       # default rtsp server instance number
 my $proto = 'rtsp';  # protocol the rtsp server speaks
@@ -107,7 +104,7 @@ while(@ARGV) {
         $verbose = 1;
     }
     else {
-        print STDERR "\nWarning: rtspserver.pl unknown parameter: $ARGV[0]\n";
+        print STDERR "\nWarning: rtspserver.pl unknown parameter: '$ARGV[0]'\n";
     }
     shift @ARGV;
 }
@@ -133,4 +130,4 @@ $flags .= "--pidfile \"$pidfile\" ".
 $flags .= "--ipv$ipvnum --port $port --srcdir \"$srcdir\"";
 
 $| = 1;
-exec("exec server/rtspd".exe_ext('SRV')." $flags");
+exec("exec ".server_exe('rtspd')." $flags");
diff --git a/third-party/curl/tests/runner.pm b/third-party/curl/tests/runner.pm
index 0a288c4138..9e514f0e23 100644
--- a/third-party/curl/tests/runner.pm
+++ b/third-party/curl/tests/runner.pm
@@ -23,13 +23,13 @@
 ###########################################################################
 
 # This module contains entry points to run a single test. runner_init
-# determines whether they will run in a separate process or in the process of
-# the caller. The relevant interface is asynchronous so it will work in either
+# determines whether they run in a separate process or in the process of
+# the caller. The relevant interface is asynchronous so it works in either
 # case. Program arguments are marshalled and then written to the end of a pipe
 # (in controlleripccall) which is later read from and the arguments
 # unmarshalled (in ipcrecv) before the desired function is called normally.
 # The function return values are then marshalled and written into another pipe
-# (again in ipcrecv) when is later read from and unmarshalled (in runnerar)
+# (again in ipcrecv) which is later read from and unmarshalled (in runnerar)
 # before being returned to the caller.
 
 package runner;
@@ -38,6 +38,9 @@ use strict;
 use warnings;
 use 5.006;
 
+use File::Basename;
+use Time::HiRes;
+
 BEGIN {
     use base qw(Exporter);
 
@@ -47,7 +50,6 @@ BEGIN {
         readtestkeywords
         restore_test_env
         runner_init
-        runnerac_clearlocks
         runnerac_shutdown
         runnerac_stopservers
         runnerac_test_preprocess
@@ -82,13 +84,10 @@ use Storable qw(
 
 use pathhelp qw(
     exe_ext
-    );
-use processhelp qw(
-    portable_sleep
+    shell_quote
     );
 use servers qw(
     checkcmd
-    clearlocks
     initserverconfig
     serverfortest
     stopserver
@@ -101,21 +100,25 @@ use testutil qw(
     clearlogs
     logmsg
     runclient
-    shell_quote
+    exerunner
+    subtextfile
+    subchars
     subbase64
+    subsha256base64file
+    substrippemfile
     subnewlines
     );
 use valgrind;
-
+use memanalyzer;
 
 #######################################################################
 # Global variables set elsewhere but used only by this package
 # These may only be set *before* runner_init is called
-our $DBGCURL=$CURL; #"../src/.libs/curl";  # alternative for debugging
-our $valgrind_logfile="--log-file";  # the option name for valgrind >=3
-our $valgrind_tool="--tool=memcheck";
+our $DBGCURL = $CURL; #"../src/.libs/curl";  # alternative for debugging
+our $valgrind_logfile = "--log-file";  # the option name for valgrind >=3
+our $valgrind_tool = "--tool=memcheck";
 our $gdb = checktestcmd("gdb");
-our $gdbthis;      # run test case with gdb debugger
+our $gdbthis = 0;  # run test case with debugger (gdb or lldb)
 our $gdbxwin;      # use windowed gdb when using gdb
 
 # torture test variables
@@ -124,9 +127,8 @@ our $tortalloc;
 
 # local variables
 my %oldenv;       # environment variables before test is started
-my $UNITDIR="./unit";
-my $CURLLOG="$LOGDIR/commands.log"; # all command lines run
-my $defserverlogslocktimeout = 2; # timeout to await server logs lock removal
+my $CURLLOG = "commands.log"; # all command lines run
+my $defserverlogslocktimeout = 5; # timeout to await server logs lock removal
 my $defpostcommanddelay = 0; # delay between command and postcheck sections
 my $multiprocess;   # nonzero with a separate test runner process
 
@@ -140,12 +142,12 @@ my %controllerw;    # pipe that controller writes to
 
 # redirected stdout/stderr to these files
 sub stdoutfilename {
-    my ($logdir, $testnum)=@_;
+    my ($logdir, $testnum) = @_;
     return "$logdir/stdout$testnum";
 }
 
 sub stderrfilename {
-    my ($logdir, $testnum)=@_;
+    my ($logdir, $testnum) = @_;
     return "$logdir/stderr$testnum";
 }
 
@@ -155,19 +157,19 @@ sub stderrfilename {
 # runnerac_* functions
 # Called by controller
 sub runner_init {
-    my ($logdir, $jobs)=@_;
+    my ($logdir, $jobs) = @_;
 
     $multiprocess = !!$jobs;
 
     # enable memory debugging if curl is compiled with it
     $ENV{'CURL_MEMDEBUG'} = "$logdir/$MEMDUMP";
-    $ENV{'CURL_ENTROPY'}="12345678";
-    $ENV{'CURL_FORCETIME'}=1; # for debug NTLM magic
-    $ENV{'CURL_GLOBAL_INIT'}=1; # debug curl_global_init/cleanup use
-    $ENV{'HOME'}=$pwd;
-    $ENV{'CURL_HOME'}=$ENV{'HOME'};
-    $ENV{'XDG_CONFIG_HOME'}=$ENV{'HOME'};
-    $ENV{'COLUMNS'}=79; # screen width!
+    delete $ENV{'CURL_ENTROPY'} if($ENV{'CURL_ENTROPY'});
+    $ENV{'CURL_FORCETIME'} = 1; # for debug NTLM magic
+    $ENV{'CURL_GLOBAL_INIT'} = 1; # debug curl_global_init/cleanup use
+    $ENV{'HOME'} = $pwd;
+    $ENV{'CURL_HOME'} = $ENV{'HOME'};
+    $ENV{'XDG_CONFIG_HOME'} = $ENV{'HOME'};
+    $ENV{'COLUMNS'} = 79; # screen width!
 
     # Incorporate the $logdir into the random seed and re-seed the PRNG.
     # This gives each runner a unique yet consistent seed which provides
@@ -190,7 +192,7 @@ sub runner_init {
             $SIG{INT} = 'IGNORE';
             $SIG{TERM} = 'IGNORE';
             eval {
-                # some msys2 perl versions don't define SIGUSR1
+                # some MSYS2 Perl versions do not define SIGUSR1, also missing from Win32 Perl
                 $SIG{USR1} = 'IGNORE';
             };
 
@@ -214,7 +216,7 @@ sub runner_init {
             # handle IPC calls
             event_loop();
 
-            # Can't rely on logmsg here in case it's buffered
+            # Cannot rely on logmsg here in case it is buffered
             print "Runner $thisrunnerid exiting\n" if($verbose);
 
             # To reach this point, either the controller has sent
@@ -234,13 +236,15 @@ sub runner_init {
         # Create our pid directory
         mkdir("$LOGDIR/$PIDDIR", 0777);
 
-        # Don't create a separate process
+        # Do not create a separate process
         $thisrunnerid = "integrated";
     }
 
     $controllerw{$thisrunnerid} = $thiscontrollerw;
-    $runnerr = $thisrunnerr;
-    $runnerw = $thisrunnerw;
+    if(!$multiprocess) {
+        $runnerr = $thisrunnerr;
+        $runnerw = $thisrunnerw;
+    }
     $controllerr{$thisrunnerid} = $thiscontrollerr;
 
     return $thisrunnerid;
@@ -249,7 +253,7 @@ sub runner_init {
 #######################################################################
 # Loop to execute incoming IPC calls until the shutdown call
 sub event_loop {
-    while () {
+    while(1) {
         if(ipcrecv()) {
             last;
         }
@@ -260,8 +264,8 @@ sub event_loop {
 # Check for a command in the PATH of the machine running curl.
 #
 sub checktestcmd {
-    my ($cmd)=@_;
-    my @testpaths=("$LIBDIR/.libs", "$LIBDIR");
+    my ($cmd) = @_;
+    my @testpaths = ($LIBDIR . ".libs", $LIBDIR);
     return checkcmd($cmd, @testpaths);
 }
 
@@ -299,7 +303,7 @@ sub prepro {
     my (@entiretest) = @_;
     my $show = 1;
     my @out;
-    my $data_crlf;
+    my $data_crlf = "";
     my @pshow;
     my @altshow;
     my $plvl;
@@ -307,7 +311,7 @@ sub prepro {
     for my $s (@entiretest) {
         my $f = $s;
         $line++;
-        if($s =~ /^ *%if (.*)/) {
+        if($s =~ /^ *%if ([A-Za-z0-9!_-]*)/) {
             my $cond = $1;
             my $rev = 0;
 
@@ -351,27 +355,36 @@ sub prepro {
             next;
         }
         if($show) {
-            # The processor does CRLF replacements in the <data*> sections if
-            # necessary since those parts might be read by separate servers.
-            if($s =~ /^ *<data(.*)\>/) {
-                if($1 =~ /crlf="yes"/ ||
-                   ($feature{"hyper"} && ($keywords{"HTTP"} || $keywords{"HTTPS"}))) {
-                    $data_crlf = 1;
+            # The processor does CRLF replacements in the <data*> and <connect*>
+            # sections if necessary since those parts might be read by separate
+            # servers.
+            if($s =~ /^ *<(data|connect)(.*)\>/) {
+                if($2 =~ /crlf="yes"/) {
+                    $data_crlf = "yes";
+                }
+                elsif($2 =~ /crlf="headers"/) {
+                    $data_crlf = "headers";
                 }
             }
-            elsif(($s =~ /^ *<\/data/) && $data_crlf) {
-                $data_crlf = 0;
+            elsif(($s =~ /^ *<\/(data|connect)/) && $data_crlf ne "") {
+                $data_crlf = "";
             }
             subvariables(\$s, $testnum, "%");
+            if(subtextfile(\$s)) {
+                subvariables(\$s, $testnum, "%");
+            }
+            subchars(\$s);
             subbase64(\$s);
-            subnewlines(0, \$s) if($data_crlf);
+            subsha256base64file(\$s);
+            substrippemfile(\$s);
+            subnewlines(1, \$s) if($data_crlf eq "yes");
+            subnewlines(0, \$s) if($data_crlf eq "headers");
             push @out, $s;
         }
     }
     return @out;
 }
 
-
 #######################################################################
 # Load test keywords into %keywords hash
 #
@@ -386,7 +399,6 @@ sub readtestkeywords {
     }
 }
 
-
 #######################################################################
 # Return a list of log locks that still exist
 #
@@ -401,6 +413,32 @@ sub logslocked {
     return @locks;
 }
 
+#######################################################################
+# Wait log locks to be unlocked
+#
+sub waitlockunlock {
+    # If a server logs advisor read lock file exists, it is an indication
+    # that the server has not yet finished writing out all its log files,
+    # including server request log files used for protocol verification.
+    # So, if the lock file exists the script waits here a certain amount
+    # of time until the server removes it, or the given time expires.
+    my $serverlogslocktimeout = shift;
+
+    if($serverlogslocktimeout) {
+        my $lockretry = $serverlogslocktimeout * 20;
+        my @locks;
+        while((@locks = logslocked()) && $lockretry--) {
+            Time::HiRes::sleep(0.05);
+        }
+        if(($lockretry < 0) &&
+           ($serverlogslocktimeout >= $defserverlogslocktimeout)) {
+            logmsg "Warning: server logs lock timeout ",
+                   "($serverlogslocktimeout seconds) expired (locks: " .
+                   join(", ", @locks) . ")\n";
+        }
+    }
+}
+
 #######################################################################
 # Memory allocation test and failure torture testing.
 #
@@ -416,8 +454,8 @@ sub torture {
     logmsg " CMD: $testcmd\n" if($verbose);
 
     # memanalyze -v is our friend, get the number of allocations made
-    my $count=0;
-    my @out = `$memanalyze -v "$LOGDIR/$MEMDUMP"`;
+    my $count = 0;
+    my @out = memanalyze("$LOGDIR/$MEMDUMP", 1, 0, 0);
     for(@out) {
         if(/^Operations: (\d+)/) {
             $count = $1;
@@ -429,18 +467,18 @@ sub torture {
         return 0;
     }
 
-    my @ttests = (1 .. $count);
+    my @torture_tests = (1 .. $count);
     if($shallow && ($shallow < $count)) {
-        my $discard = scalar(@ttests) - $shallow;
-        my $percent = sprintf("%.2f%%", $shallow * 100 / scalar(@ttests));
+        my $discard = scalar(@torture_tests) - $shallow;
+        my $percent = sprintf("%.2f%%", $shallow * 100 / scalar(@torture_tests));
         logmsg " $count functions found, but only fail $shallow ($percent)\n";
         while($discard) {
             my $rm;
             do {
                 # find a test to discard
-                $rm = rand(scalar(@ttests));
-            } while(!$ttests[$rm]);
-            $ttests[$rm] = undef;
+                $rm = rand(scalar(@torture_tests));
+            } while(!$torture_tests[$rm]);
+            $torture_tests[$rm] = undef;
             $discard--;
         }
     }
@@ -448,7 +486,7 @@ sub torture {
         logmsg " $count functions to make fail\n";
     }
 
-    for (@ttests) {
+    for (@torture_tests) {
         my $limit = $_;
         my $fail;
         my $dumped_core;
@@ -462,10 +500,10 @@ sub torture {
         }
 
         if($verbose) {
-            my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) =
+            my ($sec, $min, $hour, $mday, $mon, $year, $wday, $yday, $isdst) =
                 localtime(time());
             my $now = sprintf("%02d:%02d:%02d ", $hour, $min, $sec);
-            logmsg "Fail function no: $limit at $now\r";
+            logmsg "Fail function no: $limit at $now\n";
         }
 
         # make the memory allocation function number $limit return failure
@@ -475,19 +513,6 @@ sub torture {
         unlink("$LOGDIR/$MEMDUMP");
 
         my $cmd = $testcmd;
-        if($valgrind && !$gdbthis) {
-            my @valgrindoption = getpart("verify", "valgrind");
-            if((!@valgrindoption) || ($valgrindoption[0] !~ /disable/)) {
-                my $valgrindcmd = "$valgrind ";
-                $valgrindcmd .= "$valgrind_tool " if($valgrind_tool);
-                $valgrindcmd .= "--quiet --leak-check=yes ";
-                $valgrindcmd .= "--suppressions=$srcdir/valgrind.supp ";
-                # $valgrindcmd .= "--gen-suppressions=all ";
-                $valgrindcmd .= "--num-callers=16 ";
-                $valgrindcmd .= "${valgrind_logfile}=$LOGDIR/valgrind$testnum";
-                $cmd = "$valgrindcmd $testcmd";
-            }
-        }
         logmsg "*** Function number $limit is now set to fail ***\n" if($gdbthis);
 
         my $ret = 0;
@@ -503,7 +528,7 @@ sub torture {
         delete $ENV{'CURL_MEMLIMIT'} if($ENV{'CURL_MEMLIMIT'});
 
         if(-r "core") {
-            # there's core file present now!
+            # there is core file present now!
             logmsg " core dumped\n";
             $dumped_core = 1;
             $fail = 2;
@@ -523,26 +548,26 @@ sub torture {
             }
         }
 
-        # verify that it returns a proper error code, doesn't leak memory
-        # and doesn't core dump
+        # verify that it returns a proper error code, does not leak memory
+        # and does not core dump
         if(($ret & 255) || ($ret >> 8) >= 128) {
             logmsg " system() returned $ret\n";
-            $fail=1;
+            $fail = 1;
         }
         else {
-            my @memdata=`$memanalyze "$LOGDIR/$MEMDUMP"`;
-            my $leak=0;
+            my @memdata = memanalyze("$LOGDIR/$MEMDUMP", 0, 0, 0);
+            my $leak = 0;
             for(@memdata) {
                 if($_ ne "") {
                     # well it could be other memory problems as well, but
                     # we call it leak for short here
-                    $leak=1;
+                    $leak = 1;
                 }
             }
             if($leak) {
                 logmsg "** MEMORY FAILURE\n";
                 logmsg @memdata;
-                logmsg `$memanalyze -l "$LOGDIR/$MEMDUMP"`;
+                logmsg memanalyze("$LOGDIR/$MEMDUMP", 0, 0, 1);
                 $fail = 1;
             }
         }
@@ -559,7 +584,6 @@ sub torture {
     return 0;
 }
 
-
 #######################################################################
 # restore environment variables that were modified in test
 sub restore_test_env {
@@ -577,7 +601,6 @@ sub restore_test_env {
     }
 }
 
-
 #######################################################################
 # Start the servers needed to run this test case
 sub singletest_startservers {
@@ -593,13 +616,9 @@ sub singletest_startservers {
 
     my $why;
     my $error;
-    if (!$listonly) {
+    if(!$listonly) {
         my @what = getpart("client", "server");
-        if(!$what[0]) {
-            warn "Test case $testnum has no server(s) specified";
-            $why = "no server specified";
-            $error = -1;
-        } else {
+        if($what[0]) {
             my $err;
             ($why, $err) = serverfortest(@what);
             if($err == 1) {
@@ -617,7 +636,6 @@ sub singletest_startservers {
     return ($why, $error);
 }
 
-
 #######################################################################
 # Generate preprocessed test file
 sub singletest_preprocess {
@@ -631,44 +649,36 @@ sub singletest_preprocess {
     @entiretest = prepro($testnum, @entiretest);
 
     # save the new version
-    open(my $fulltesth, ">", "$otest") || die "Failure writing test file";
+    open(my $fulltesth, ">", $otest) or die "Failure writing test file";
     foreach my $bytes (@entiretest) {
         print $fulltesth pack('a*', $bytes) or die "Failed to print '$bytes': $!";
     }
-    close($fulltesth) || die "Failure writing test file";
+    close($fulltesth) or die "Failure writing test file";
 
     # in case the process changed the file, reload it
     loadtest("$LOGDIR/test${testnum}");
 }
 
-
 #######################################################################
 # Set up the test environment to run this test case
 sub singletest_setenv {
     my @setenv = getpart("client", "setenv");
     foreach my $s (@setenv) {
         chomp $s;
-        if($s =~ /([^=]*)=(.*)/) {
+        if($s =~ /([^=]*)(.*)/) {
             my ($var, $content) = ($1, $2);
             # remember current setting, to restore it once test runs
-            $oldenv{$var} = ($ENV{$var})?"$ENV{$var}":'notset';
-            # set new value
-            if(!$content) {
-                delete $ENV{$var} if($ENV{$var});
+            $oldenv{$var} = $ENV{$var} ? $ENV{$var} : 'notset';
+
+            if($content =~ /^=(.*)/) {
+                # assign it
+                $content = $1;
+                $ENV{$var} = $content;
+                logmsg "setenv $var = $content\n" if($verbose);
             }
             else {
-                if($var =~ /^LD_PRELOAD/) {
-                    if(exe_ext('TOOL') && (exe_ext('TOOL') eq '.exe')) {
-                        logmsg "Skipping LD_PRELOAD due to lack of OS support\n" if($verbose);
-                        next;
-                    }
-                    if($feature{"debug"} || !$has_shared) {
-                        logmsg "Skipping LD_PRELOAD due to no release shared build\n" if($verbose);
-                        next;
-                    }
-                }
-                $ENV{$var} = "$content";
-                logmsg "setenv $var = $content\n" if($verbose);
+                # remove it
+                delete $ENV{$var} if($ENV{$var});
             }
         }
     }
@@ -678,7 +688,6 @@ sub singletest_setenv {
     }
 }
 
-
 #######################################################################
 # Check that test environment is fine to run this test case
 sub singletest_precheck {
@@ -691,9 +700,9 @@ sub singletest_precheck {
         if($cmd) {
             my @p = split(/ /, $cmd);
             if($p[0] !~ /\//) {
-                # the first word, the command, does not contain a slash so
-                # we will scan the "improved" PATH to find the command to
-                # be able to run it
+                # the first word, the command, does not contain a slash so we
+                # scan the "improved" PATH to find the command to be able
+                # to run it
                 my $fullp = checktestcmd($p[0]);
 
                 if($fullp) {
@@ -702,7 +711,10 @@ sub singletest_precheck {
                 $cmd = join(" ", @p);
             }
 
-            my @o = `$cmd 2> $LOGDIR/precheck-$testnum`;
+            # provide an environment variable
+            $ENV{'CURL_TESTNUM'} = $testnum;
+
+            my @o = qx($cmd 2> $LOGDIR/precheck-$testnum);
             if($o[0]) {
                 $why = $o[0];
                 $why =~ s/[\r\n]//g;
@@ -716,7 +728,6 @@ sub singletest_precheck {
     return $why;
 }
 
-
 #######################################################################
 # Prepare the test environment to run this test case
 sub singletest_prepare {
@@ -731,29 +742,35 @@ sub singletest_prepare {
     unlink("$LOGDIR/$SERVERIN");
     unlink("$LOGDIR/$PROXYIN");
 
-    # if this section exists, it might be FTP server instructions:
-    my @ftpservercmd = getpart("reply", "servercmd");
-    push @ftpservercmd, "Testnum $testnum\n";
+    # if this section exists, it might be server instructions:
+    my @servercmd = getpart("reply", "servercmd");
+    push @servercmd, "Testnum $testnum\n";
     # write the instructions to file
-    writearray("$LOGDIR/$SERVERCMD", \@ftpservercmd);
+    writearray("$LOGDIR/$SERVERCMD", \@servercmd);
+
+    # if this section exists, it might be DNS instructions:
+    my @dnscmd = getpart("reply", "dns");
+    # write the instructions to file
+    writearray("$LOGDIR/$DNSCMD", \@dnscmd);
+
+    # provide an environment variable
+    $ENV{'CURL_TESTNUM'} = $testnum;
 
     # create (possibly-empty) files before starting the test
     for my $partsuffix (('', '1', '2', '3', '4')) {
-        my @inputfile=getpart("client", "file".$partsuffix);
+        my @inputfile = getpart("client", "file".$partsuffix);
         my %fileattr = getpartattr("client", "file".$partsuffix);
-        my $filename=$fileattr{'name'};
+        my $filename = $fileattr{'name'};
         if(@inputfile || $filename) {
             if(!$filename) {
-                logmsg " $testnum: IGNORED: section client=>file has no name attribute\n";
+                logmsg " $testnum: IGNORED: Section client=>file has no name attribute\n";
                 return -1;
             }
-            my $fileContent = join('', @inputfile);
 
             # make directories if needed
-            my $path = $filename;
-            # cut off the file name part
-            $path =~ s/^(.*)\/[^\/]*/$1/;
-            my $nparts = scalar(split(/\//, $LOGDIR));
+            my $path = dirname($filename);
+            my @ldparts = split(/\//, $LOGDIR);
+            my $nparts = @ldparts;
             my @parts = split(/\//, $path);
             if(join("/", @parts[0..$nparts-1]) eq $LOGDIR) {
                 # the file is in $LOGDIR/
@@ -763,13 +780,17 @@ sub singletest_prepare {
                     mkdir $d; # 0777
                 }
             }
-            if (open(my $outfile, ">", "$filename")) {
+            if(open(my $outfile, ">", $filename)) {
                 binmode $outfile; # for crapage systems, use binary
+
                 if($fileattr{'nonewline'}) {
                     # cut off the final newline
-                    chomp($fileContent);
+                    chomp($inputfile[-1]);
                 }
-                print $outfile $fileContent;
+                if($fileattr{'crlf'}) {
+                    subnewlines(1, \$_) for @inputfile;
+                }
+                print $outfile join('', @inputfile);
                 close($outfile);
             } else {
                 logmsg "ERROR: cannot write $filename\n";
@@ -779,67 +800,71 @@ sub singletest_prepare {
     return 0;
 }
 
-
 #######################################################################
 # Run the test command
 sub singletest_run {
     my ($testnum, $testtimings) = @_;
 
     # get the command line options to use
-    my ($cmd, @blaha)= getpart("client", "command");
-    if($cmd) {
-        # make some nice replace operations
+    my $cmd;
+    my @cmd = getpart("client", "command");
+    if(@cmd) {
+        # allow splitting the command-line to multiple lines
+        $cmd = join(' ', @cmd);
         $cmd =~ s/\n//g; # no newlines please
+        chomp $cmd; # no newlines please
         # substitute variables in the command line
     }
     else {
         # there was no command given, use something silly
-        $cmd="-";
+        $cmd = "-";
     }
 
-    my $CURLOUT="$LOGDIR/curl$testnum.out"; # curl output if not stdout
+    my $CURLOUT = "$LOGDIR/curl$testnum.out"; # curl output if not stdout
 
     # if stdout section exists, we verify that the stdout contained this:
-    my $out="";
+    my $out = "";
     my %cmdhash = getpartattr("client", "command");
     if((!$cmdhash{'option'}) || ($cmdhash{'option'} !~ /no-output/)) {
         #We may slap on --output!
-        if (!partexists("verify", "stdout") ||
+        if(!partexists("verify", "stdout") ||
                 ($cmdhash{'option'} && $cmdhash{'option'} =~ /force-output/)) {
-            $out=" --output $CURLOUT ";
+            $out = " --output $CURLOUT ";
         }
     }
 
     my @codepieces = getpart("client", "tool");
-    my $tool="";
+    my $tool = "";
+    my $tool_name = "";  # without exe extension
     if(@codepieces) {
-        $tool = $codepieces[0];
-        chomp $tool;
-        $tool .= exe_ext('TOOL');
+        $tool_name = $codepieces[0];
+        chomp $tool_name;
+        $tool = $tool_name . exe_ext('TOOL');
     }
 
+    my $oldmemdebug;
     my $disablevalgrind;
-    my $CMDLINE="";
+    my $CMDLINE = "";
     my $cmdargs;
     my $cmdtype = $cmdhash{'type'} || "default";
     my $fail_due_event_based = $run_event_based;
     if($cmdtype eq "perl") {
         # run the command line prepended with "perl"
-        $cmdargs ="$cmd";
+        $cmdargs = $cmd;
         $CMDLINE = "$perl ";
-        $tool=$CMDLINE;
-        $disablevalgrind=1;
+        $tool = $CMDLINE;
+        $disablevalgrind = 1;
     }
     elsif($cmdtype eq "shell") {
         # run the command line prepended with "/bin/sh"
-        $cmdargs ="$cmd";
+        $cmdargs = $cmd;
         $CMDLINE = "/bin/sh ";
-        $tool=$CMDLINE;
-        $disablevalgrind=1;
+        $tool = $CMDLINE;
+        $disablevalgrind = 1;
     }
     elsif(!$tool && !$keywords{"unittest"}) {
         # run curl, add suitable command line options
-        my $inc="";
+        my $inc = "";
         if((!$cmdhash{'option'}) || ($cmdhash{'option'} !~ /no-include/)) {
             $inc = " --include";
         }
@@ -856,8 +881,20 @@ sub singletest_run {
             $cmdargs .= "--test-event ";
             $fail_due_event_based--;
         }
+        if($run_duphandle) {
+            $cmdargs .= "--test-duphandle ";
+            my @dis = getpart("client", "disable");
+            if(@dis) {
+                chomp $dis[0] if($dis[0]);
+                if($dis[0] eq "test-duphandle") {
+                    # marked to not run with duphandle
+                    logmsg " $testnum: IGNORED: Cannot run test-duphandle\n";
+                    return (-1, 0, 0, "", "", 0);
+                }
+            }
+        }
         $cmdargs .= $cmd;
-        if ($proxy_address) {
+        if($proxy_address) {
             $cmdargs .= " --proxy $proxy_address ";
         }
     }
@@ -867,21 +904,38 @@ sub singletest_run {
 
         # Default the tool to a unit test with the same name as the test spec
         if($keywords{"unittest"} && !$tool) {
-            $tool="unit$testnum";
+            $tool_name = "unit$testnum";
+            $tool = $tool_name . exe_ext('TOOL');
         }
 
         if($tool =~ /^lib/) {
-            $CMDLINE="$LIBDIR/$tool";
+            $tool = "libtests" . exe_ext('TOOL');
+            $CMDLINE = $LIBDIR . $tool;
+        }
+        elsif($tool =~ /^tool/) {
+            $tool = "tunits" . exe_ext('TOOL');
+            $CMDLINE = $TUNITDIR . $tool;
         }
         elsif($tool =~ /^unit/) {
-            $CMDLINE="$UNITDIR/$tool";
+            $tool = "units" . exe_ext('TOOL');
+            $CMDLINE = $UNITDIR . $tool;
         }
 
         if(! -f $CMDLINE) {
             logmsg " $testnum: IGNORED: The tool set in the test case for this: '$tool' does not exist\n";
             return (-1, 0, 0, "", "", 0);
         }
-        $DBGCURL=$CMDLINE;
+
+        $CMDLINE = exerunner() . $CMDLINE;
+
+        if($gdbthis) {
+            $cmdargs = " $tool_name$cmdargs";
+        }
+        else {
+            $CMDLINE .= " $tool_name";
+        }
+
+        $DBGCURL = $CMDLINE;
     }
 
     if($fail_due_event_based) {
@@ -893,13 +947,13 @@ sub singletest_run {
         # gdb is incompatible with valgrind, so disable it when debugging
         # Perhaps a better approach would be to run it under valgrind anyway
         # with --db-attach=yes or --vgdb=yes.
-        $disablevalgrind=1;
+        $disablevalgrind = 1;
     }
 
     my @stdintest = getpart("client", "stdin");
 
     if(@stdintest) {
-        my $stdinfile="$LOGDIR/stdin-for-$testnum";
+        my $stdinfile = "$LOGDIR/stdin-for-$testnum";
 
         my %hash = getpartattr("client", "stdin");
         if($hash{'nonewline'}) {
@@ -907,13 +961,23 @@ sub singletest_run {
             chomp($stdintest[-1]);
         }
 
+        if($hash{'crlf'}) {
+            subnewlines(1, \$_) for @stdintest;
+        }
+
         writearray($stdinfile, \@stdintest);
 
         $cmdargs .= " <$stdinfile";
     }
 
     if(!$tool) {
-        $CMDLINE=shell_quote($CURL);
+        $CMDLINE = exerunner() . shell_quote($CURL);
+        if((!$cmdhash{'option'}) || ($cmdhash{'option'} !~ /no-q/)) {
+            $CMDLINE .= " -q";
+        }
+        if($maxtime) {
+            $CMDLINE .= " --max-time $maxtime";
+        }
     }
 
     if(use_valgrind() && !$disablevalgrind) {
@@ -934,20 +998,27 @@ sub singletest_run {
         logmsg "$CMDLINE\n";
     }
 
-    open(my $cmdlog, ">", $CURLLOG) || die "Failure writing log file";
+    open(my $cmdlog, ">", "$LOGDIR/$CURLLOG") or die "Failure writing log file";
     print $cmdlog "$CMDLINE\n";
-    close($cmdlog) || die "Failure writing log file";
+    close($cmdlog) or die "Failure writing log file";
 
     my $dumped_core;
     my $cmdres;
 
     if($gdbthis) {
         my $gdbinit = "$TESTDIR/gdbinit$testnum";
-        open(my $gdbcmd, ">", "$LOGDIR/gdbcmd") || die "Failure writing gdb file";
-        print $gdbcmd "set args $cmdargs\n";
-        print $gdbcmd "show args\n";
-        print $gdbcmd "source $gdbinit\n" if -e $gdbinit;
-        close($gdbcmd) || die "Failure writing gdb file";
+        open(my $gdbcmd, ">", "$LOGDIR/gdbcmd") or die "Failure writing gdb file";
+        if($gdbthis == 1) {
+            # gdb mode
+            print $gdbcmd "set args $cmdargs\n";
+            print $gdbcmd "show args\n";
+            print $gdbcmd "source $gdbinit\n" if -e $gdbinit;
+        }
+        else {
+            # lldb mode
+            print $gdbcmd "set args $cmdargs\n";
+        }
+        close($gdbcmd) or die "Failure writing gdb file";
     }
 
     # Flush output.
@@ -956,20 +1027,37 @@ sub singletest_run {
     # timestamp starting of test command
     $$testtimings{"timetoolini"} = Time::HiRes::time();
 
+    if($cmdhash{'option'} && ($cmdhash{'option'} =~ /no-memdebug/)) {
+        $oldmemdebug = $ENV{'CURL_MEMDEBUG'};
+        delete $ENV{'CURL_MEMDEBUG'};
+    }
+
     # run the command line we built
-    if ($torture) {
+    if($torture) {
         $cmdres = torture($CMDLINE,
                           $testnum,
                           "$gdb --directory $LIBDIR " . shell_quote($DBGCURL) . " -x $LOGDIR/gdbcmd");
     }
-    elsif($gdbthis) {
+    elsif($gdbthis == 1) {
+        # gdb
         my $GDBW = ($gdbxwin) ? "-w" : "";
         runclient("$gdb --directory $LIBDIR " . shell_quote($DBGCURL) . " $GDBW -x $LOGDIR/gdbcmd");
-        $cmdres=0; # makes it always continue after a debugged run
+        $cmdres = 0; # makes it always continue after a debugged run
+    }
+    elsif($gdbthis == 2) {
+        # $gdb is "lldb"
+        print "runs lldb -- $CURL $cmdargs\n";
+        runclient("lldb -- $CURL $cmdargs");
+        $cmdres = 0; # makes it always continue after a debugged run
     }
     else {
         # Convert the raw result code into a more useful one
-        ($cmdres, $dumped_core) = normalize_cmdres(runclient("$CMDLINE"));
+        ($cmdres, $dumped_core) = normalize_cmdres(runclient($CMDLINE));
+    }
+
+    # restore contents
+    if($oldmemdebug) {
+        $ENV{'CURL_MEMDEBUG'} = $oldmemdebug;
     }
 
     # timestamp finishing of test command
@@ -978,15 +1066,14 @@ sub singletest_run {
     return (0, $cmdres, $dumped_core, $CURLOUT, $tool, use_valgrind() && !$disablevalgrind);
 }
 
-
 #######################################################################
 # Clean up after test command
 sub singletest_clean {
-    my ($testnum, $dumped_core, $testtimings)=@_;
+    my ($testnum, $dumped_core, $testtimings) = @_;
 
     if(!$dumped_core) {
         if(-r "core") {
-            # there's core file present now!
+            # there is core file present now!
             $dumped_core = 1;
         }
     }
@@ -995,19 +1082,14 @@ sub singletest_clean {
         logmsg "core dumped\n";
         if(0 && $gdb) {
             logmsg "running gdb for post-mortem analysis:\n";
-            open(my $gdbcmd, ">", "$LOGDIR/gdbcmd2") || die "Failure writing gdb file";
+            open(my $gdbcmd, ">", "$LOGDIR/gdbcmd2") or die "Failure writing gdb file";
             print $gdbcmd "bt\n";
-            close($gdbcmd) || die "Failure writing gdb file";
+            close($gdbcmd) or die "Failure writing gdb file";
             runclient("$gdb --directory libtest -x $LOGDIR/gdbcmd2 -batch " . shell_quote($DBGCURL) . " core ");
      #       unlink("$LOGDIR/gdbcmd2");
         }
     }
 
-    # If a server logs advisor read lock file exists, it is an indication
-    # that the server has not yet finished writing out all its log files,
-    # including server request log files used for protocol verification.
-    # So, if the lock file exists the script waits here a certain amount
-    # of time until the server removes it, or the given time expires.
     my $serverlogslocktimeout = $defserverlogslocktimeout;
     my %cmdhash = getpartattr("client", "command");
     if($cmdhash{'timeout'}) {
@@ -1016,19 +1098,6 @@ sub singletest_clean {
             $serverlogslocktimeout = $1 if($1 >= 0);
         }
     }
-    if($serverlogslocktimeout) {
-        my $lockretry = $serverlogslocktimeout * 20;
-        my @locks;
-        while((@locks = logslocked()) && $lockretry--) {
-            portable_sleep(0.05);
-        }
-        if(($lockretry < 0) &&
-           ($serverlogslocktimeout >= $defserverlogslocktimeout)) {
-            logmsg "Warning: server logs lock timeout ",
-                   "($serverlogslocktimeout seconds) expired (locks: " .
-                   join(", ", @locks) . ")\n";
-        }
-    }
 
     # Test harness ssh server does not have this synchronization mechanism,
     # this implies that some ssh server based tests might need a small delay
@@ -1045,13 +1114,7 @@ sub singletest_clean {
         }
     }
 
-    portable_sleep($postcommanddelay) if($postcommanddelay);
-
-    # timestamp removal of server logs advisor read lock
-    $$testtimings{"timesrvrlog"} = Time::HiRes::time();
-
-    # test definition might instruct to stop some servers
-    # stop also all servers relative to the given one
+    Time::HiRes::sleep($postcommanddelay) if($postcommanddelay);
 
     my @killtestservers = getpart("client", "killserver");
     if(@killtestservers) {
@@ -1063,39 +1126,58 @@ sub singletest_clean {
             }
         }
     }
+
+    # wait for any servers left running to release their locks
+    waitlockunlock($serverlogslocktimeout);
+
+    # timestamp removal of server logs advisor read lock
+    $$testtimings{"timesrvrlog"} = Time::HiRes::time();
+
+    # test definition might instruct to stop some servers
+    # stop also all servers relative to the given one
+
     return 0;
 }
 
 #######################################################################
 # Verify that the postcheck succeeded
 sub singletest_postcheck {
-    my ($testnum)=@_;
+    my ($testnum) = @_;
 
     # run the postcheck command
-    my @postcheck= getpart("client", "postcheck");
+    my @postcheck = getpart("client", "postcheck");
+    if(@postcheck) {
+        die "test$testnum uses client/postcheck";
+    }
+
+    @postcheck = getpart("verify", "postcheck");
     if(@postcheck) {
         my $cmd = join("", @postcheck);
         chomp $cmd;
         if($cmd) {
             logmsg "postcheck $cmd\n" if($verbose);
-            my $rc = runclient("$cmd");
+            my $rc = runclient($cmd);
             # Must run the postcheck command in torture mode in order
-            # to clean up, but the result can't be relied upon.
+            # to clean up, but the result cannot be relied upon.
             if($rc != 0 && !$torture) {
                 logmsg " $testnum: postcheck FAILED\n";
                 return -1;
             }
         }
     }
+
+    if(checktest("${TESTDIR}/test${testnum}")) {
+        logmsg " $testnum: postcheck FAILED: issue(s) found in test data\n";
+        return -1;
+    }
+
     return 0;
 }
 
-
-
 ###################################################################
 # Get ready to run a single test case
 sub runner_test_preprocess {
-    my ($testnum)=@_;
+    my ($testnum) = @_;
     my %testtimings;
 
     if(clearlogs()) {
@@ -1112,7 +1194,7 @@ sub runner_test_preprocess {
     # ignore any error here--if there were one, it would have been
     # caught during the selection phase and this test would not be
     # running now
-    loadtest("${TESTDIR}/test${testnum}");
+    loadtest("${TESTDIR}/test${testnum}", 1);
     readtestkeywords();
 
     ###################################################################
@@ -1124,6 +1206,9 @@ sub runner_test_preprocess {
     # Start the servers needed to run this test case
     my ($why, $error) = singletest_startservers($testnum, \%testtimings);
 
+    # make sure no locks left for responsive test
+    waitlockunlock($defserverlogslocktimeout);
+
     if(!$why) {
 
         ###############################################################
@@ -1138,7 +1223,7 @@ sub runner_test_preprocess {
 
         ###############################################################
         # Check that the test environment is fine to run this test case
-        if (!$listonly) {
+        if(!$listonly) {
             $why = singletest_precheck($testnum);
             $error = -1;
         }
@@ -1146,14 +1231,13 @@ sub runner_test_preprocess {
     return ($why, $error, clearlogs(), \%testtimings);
 }
 
-
 ###################################################################
 # Run a single test case with an environment that already been prepared
 # Returns 0=success, -1=skippable failure, -2=permanent error,
 #   1=unskippable test failure, as first integer, plus any log messages,
 #   plus more return values when error is 0
 sub runner_test_run {
-    my ($testnum)=@_;
+    my ($testnum) = @_;
 
     if(clearlogs()) {
         logmsg "Warning: log messages were lost\n";
@@ -1200,18 +1284,12 @@ sub runner_test_run {
     return (0, clearlogs(), \%testtimings, $cmdres, $CURLOUT, $tool, $usedvalgrind);
 }
 
-# Async call runner_clearlocks
-# Called by controller
-sub runnerac_clearlocks {
-    return controlleripccall(\&runner_clearlocks, @_);
-}
-
 # Async call runner_shutdown
 # This call does NOT generate an IPC response and must be the last IPC call
 # received.
 # Called by controller
 sub runnerac_shutdown {
-    my ($runnerid)=$_[0];
+    my ($runnerid) = $_[0];
     my $err = controlleripccall(\&runner_shutdown, @_);
 
     # These have no more use
@@ -1251,12 +1329,13 @@ sub controlleripccall {
     # Get the name of the function from the reference
     my $cv = svref_2object($funcref);
     my $gv = $cv->GV;
-    # Prepend the name to the function arguments so it's marshalled along with them
+    # Prepend the name to the function arguments so it is marshalled along with them
     unshift @_, $gv->NAME;
     # Marshall the arguments into a flat string
     my $margs = freeze \@_;
 
     # Send IPC call via pipe
+    length($margs) < 1000 or die "A large IPC write risks blocking on some platforms";
     my $err;
     while(! defined ($err = syswrite($controllerw{$runnerid}, (pack "L", length($margs)) . $margs)) || $err <= 0) {
         if((!defined $err && ! $!{EINTR}) || (defined $err && $err == 0)) {
@@ -1269,8 +1348,8 @@ sub controlleripccall {
     if(!$multiprocess) {
         # Call the remote function here in single process mode
         ipcrecv();
-     }
-     return 0;
+    }
+    return 0;
 }
 
 ###################################################################
@@ -1288,7 +1367,7 @@ sub runnerar {
         }
         # system call was interrupted, probably by ^C; restart it so we stay in sync
     }
-    my $len=unpack("L", $datalen);
+    my $len = unpack("L", $datalen);
     my $buf;
     while(! defined ($err = sysread($controllerr{$runnerid}, $buf, $len)) || $err <= 0) {
         if((!defined $err && ! $!{EINTR}) || (defined $err && $err == 0)) {
@@ -1302,7 +1381,7 @@ sub runnerar {
     my $resarrayref = thaw $buf;
 
     # First argument is runner ID
-    # TODO: remove this; it's unneeded since it's passed in
+    # TODO: remove this; it is unneeded since it is passed in
     unshift @$resarrayref, $runnerid;
     return @$resarrayref;
 }
@@ -1310,45 +1389,46 @@ sub runnerar {
 ###################################################################
 # Returns runner ID if a response from an async call is ready or error
 # First value is ready, second is error, however an error case shows up
-# as ready in Linux, so you can't trust it.
+# as ready in Linux, so you cannot trust it.
 # argument is 0 for nonblocking, undef for blocking, anything else for timeout
 # Called by controller
 sub runnerar_ready {
     my ($blocking) = @_;
-    my $rin = "";
+    my $r_in = "";
     my %idbyfileno;
-    my $maxfileno=0;
+    my $maxfileno = 0;
+    my @ready_runners = ();
     foreach my $p (keys(%controllerr)) {
         my $fd = fileno($controllerr{$p});
-        vec($rin, $fd, 1) = 1;
+        vec($r_in, $fd, 1) = 1;
         $idbyfileno{$fd} = $p;  # save the runner ID for each pipe fd
         if($fd > $maxfileno) {
             $maxfileno = $fd;
         }
     }
-    $maxfileno || die "Internal error: no runners are available to wait on\n";
+    $maxfileno or die "Internal error: no runners are available to wait on\n";
 
     # Wait for any pipe from any runner to be ready
     # This may be interrupted and return EINTR, but this is ignored and the
-    # caller will need to later call this function again.
+    # caller needs to later call this function again.
     # TODO: this is relatively slow with hundreds of fds
-    my $ein = $rin;
-    if(select(my $rout=$rin, undef, my $eout=$ein, $blocking) >= 1) {
+    my $e_in = $r_in;
+    if(select(my $r_out = $r_in, undef, my $e_out = $e_in, $blocking) >= 1) {
         for my $fd (0..$maxfileno) {
-            # Return an error condition first in case it's both
-            if(vec($eout, $fd, 1)) {
+            # Return an error condition first in case it is both
+            if(vec($e_out, $fd, 1)) {
                 return (undef, $idbyfileno{$fd});
             }
-            if(vec($rout, $fd, 1)) {
-                return ($idbyfileno{$fd}, undef);
+            if(vec($r_out, $fd, 1)) {
+                push(@ready_runners, $idbyfileno{$fd});
             }
         }
-        die "Internal pipe readiness inconsistency\n";
+        die "Internal pipe readiness inconsistency\n" if(!@ready_runners);
+        return (@ready_runners, undef);
     }
     return (undef, undef);
 }
 
-
 ###################################################################
 # Cleanly abort and exit the runner
 # This uses print since there is no longer any controller to write logs.
@@ -1371,18 +1451,18 @@ sub ipcrecv {
         if((!defined $err && ! $!{EINTR}) || (defined $err && $err == 0)) {
             # pipe has closed; controller is gone and we must exit
             runnerabort();
-            # Special case: no response will be forthcoming
+            # Special case: no response is forthcoming
             return 1;
         }
         # system call was interrupted, probably by ^C; restart it so we stay in sync
     }
-    my $len=unpack("L", $datalen);
+    my $len = unpack("L", $datalen);
     my $buf;
     while(! defined ($err = sysread($runnerr, $buf, $len)) || $err <= 0) {
         if((!defined $err && ! $!{EINTR}) || (defined $err && $err == 0)) {
             # pipe has closed; controller is gone and we must exit
             runnerabort();
-            # Special case: no response will be forthcoming
+            # Special case: no response is forthcoming
             return 1;
         }
         # system call was interrupted, probably by ^C; restart it so we stay in sync
@@ -1397,12 +1477,9 @@ sub ipcrecv {
     # print "ipcrecv $funcname\n";
     # Synchronously call the desired function
     my @res;
-    if($funcname eq "runner_clearlocks") {
-        @res = runner_clearlocks(@$argsarrayref);
-    }
-    elsif($funcname eq "runner_shutdown") {
+    if($funcname eq "runner_shutdown") {
         runner_shutdown(@$argsarrayref);
-        # Special case: no response will be forthcoming
+        # Special case: no response is forthcoming
         return 1;
     }
     elsif($funcname eq "runner_stopservers") {
@@ -1425,7 +1502,7 @@ sub ipcrecv {
         if((!defined $err && ! $!{EINTR}) || (defined $err && $err == 0)) {
             # pipe has closed; controller is gone and we must exit
             runnerabort();
-            # Special case: no response will be forthcoming
+            # Special case: no response is forthcoming
             return 1;
         }
         # system call was interrupted, probably by ^C; restart it so we stay in sync
@@ -1434,18 +1511,6 @@ sub ipcrecv {
     return 0;
 }
 
-###################################################################
-# Kill the server processes that still have lock files in a directory
-sub runner_clearlocks {
-    my ($lockdir)=@_;
-    if(clearlogs()) {
-        logmsg "Warning: log messages were lost\n";
-    }
-    clearlocks($lockdir);
-    return clearlogs();
-}
-
-
 ###################################################################
 # Kill all server processes
 sub runner_stopservers {
@@ -1463,5 +1528,4 @@ sub runner_shutdown {
     undef $runnerw;
 }
 
-
 1;
diff --git a/third-party/curl/tests/runtests.1 b/third-party/curl/tests/runtests.1
deleted file mode 100644
index 571e5ce062..0000000000
--- a/third-party/curl/tests/runtests.1
+++ /dev/null
@@ -1,196 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH runtests.pl 1 "06 Jun 2023" runtests runtests
-.SH NAME
-runtests.pl \- run one or more test cases
-.SH SYNOPSIS
-.B runtests.pl [options] [tests]
-.SH DESCRIPTION
-\fIruntests.pl\fP runs one, several or all the existing test cases in curl's
-test suite. It is often called from the root Makefile of the curl package with
-\&'make test'.
-.SH "TESTS"
-Specify which test(s) to run by specifying test numbers or keywords.
-
-If no test number or keyword is given, all existing tests that the script can
-find will be considered for running. You can specify single test cases to run
-by specifying test numbers space-separated, like "1 3 5 7 11", and you can
-specify a range of tests like "45 to 67".
-
-Specify tests to not run with a leading exclamation point, like "!66", which
-runs all available tests except number 66.
-
-Prefix a test number with a tilde (~) to still run it, but ignore the results.
-
-It is also possible to specify tests based on a keyword describing the test(s)
-to run, like "FTPS". The keywords are strings used in the individual tests.
-
-You can also specify keywords with a leading exclamation point and the keyword
-or phrase, like "!HTTP NTLM auth" to run all tests \fBexcept\fP those using
-this keyword. Remember that the exclamation marks and spaces will need to be
-quoted somehow when entered at many command shells.
-
-Prefix a keyword with a tilde (~) to still run it, but ignore the results.
-.SH OPTIONS
-.IP "-a"
-Continue running the rest of the test cases even if one test fails. By
-default, the test script stops as soon as an error is detected.
-.IP "-ac <curl>"
-Provide a path to a curl binary to talk to APIs (currently only CI test APIs).
-.IP "-am"
-Display test results in automake style output (PASS/FAIL: [number] [name]).
-.IP "-c <curl>"
-Provide a path to a custom curl binary to run the tests with. Default is the
-curl executable in the build tree.
-.IP "-d"
-Enable protocol debug: have the servers display protocol output.  If used in
-conjunction with parallel testing, it will be difficult to associate the logs
-with the test being run.
-.IP "-E <exclude_file>"
-Load the \fBexclude_file\fP with additional reasons why certain tests
-should be skipped. Useful when testing with external HTTP proxies in
-which case some of the tests aren't appropriate.
-The file contains colon-delimited lines. The first field contains the
-type of exclusion, the second field contains a pattern and the final
-field contains the reason why matching tests should be skipped.
-The exclusion types are \fkeyword\fP, \ftest\fP, and \ftool\fP.
-.IP "-e"
-Run the test event-based (if possible). This will make runtests invoke curl
-with --test-event option. This option only works if both curl and libcurl were
-built debug-enabled.
-.IP "-f"
-Force the test to run even if mentioned in DISABLED.
-.IP "-g"
-Run the given test(s) with gdb. This is best used on a single test case and
-curl built --disable-shared. This then fires up gdb with command line set to
-run the specified test case. Simply (set a break-point and) type 'run' to
-start.
-.IP "-gw"
-Run the given test(s) with gdb as a windowed application.
-.IP "-h, --help"
-Displays a help text about this program's command line options.
-.IP "-k"
-Keep output and log files in log/ after a test run, even if no error was
-detected. Useful for debugging.
-.IP "-j[num]"
-Spawn num processes to run tests. This defaults to 0 to run tests serially
-within a single process. Using a number greater than one allows multiple tests
-to run in parallel, speeding up a test run. The optimum number is dependent on
-the system and set of tests to run, but 7*number of CPU cores is a good figure
-to start with, or 1.3*number of CPU cores if Valgrind is in use. Enabling
-parallel tests is not recommended in conjunction with the \-g option.
-.IP "-L <file>"
-Load and execute the specified file which should contain perl code.
-This option allows one to change \fIruntests.pl\fP behaviour by overwriting
-functions and variables and is useful when testing external proxies
-using curl's regression test suite.
-.IP "-l"
-Lists all test case names.
-.IP "-n"
-Disable the check for and use of valgrind.
-.IP "--no-debuginfod"
-Delete the DEBUGINFOD_URLS variable if that is defined. Makes valgrind, gdb
-etc not able to use this functionality.
-.IP "-o <variablename=value>"
-Overwrite the specified internal \fBvariable\fP with \fBvalue\fP.
-Useful to change variables that didn't get a dedicated flag to change them.
-Check the source to see which variables are available.
-.IP "-P <proxy>"
-Use the specified HTTP proxy when executing tests, even if the tests
-themselves don't specify a proxy. This option allows one to test external
-proxies using curl's regression test suite.
-.IP "-p"
-Prints out all files in "log/" to stdout when a test case fails. Very
-practical when used in the automated and distributed tests since then the
-people checking the failures and the reasons for them might not have physical
-access to the machine and logs.
-.IP "-R"
-Run the tests in a scrambled, or randomized, order instead of sequentially.
-
-The random seed initially set for this is fixed per month and can be set with
-\fI--seed\fP.
-.IP "-r"
-Display run time statistics. (Requires Perl Time::HiRes module)
-.IP "-rf"
-Display full run time statistics. (Requires Perl Time::HiRes module)
-.IP "-rm"
-Force removal of files by killing locking processes. (Windows only,
-requires Sysinternals handle[64].exe to be on PATH)
-.IP "--repeat=[num]"
-This will repeat the given set of test numbers this many times. If no test
-numbers are given, it will repeat ALL tests this many times. It iteratively
-adds the new sequence at the end of the initially given one.
-
-If \fB-R\fP is also used, the scrambling is done after the repeats have
-extended the test sequence.
-.IP "-s"
-Shorter output. Speaks less than default.
-.IP "--seed=[num]"
-When using \fI--shallow\fP or \fI-R\fP that randomize certain aspects of the
-behavior, this option can set the initial seed. If not set, the random seed
-will be set based on the currently set local year and month and the first line
-of the "curl -V" output.
-.IP "--shallow=[num]"
-Used together with \fB-t\fP. This limits the number of tests to fail in
-torture mode to no more than 'num' per test case. If this reduces the amount,
-the script will randomly discard entries to fail until the amount is 'num'.
-
-The random seed initially set for this is fixed per month and can be set with
-\fI--seed\fP.
-.IP "-t[num]"
-Selects a \fBtorture\fP test for the given tests. This makes runtests.pl first
-run the tests once and count the number of memory allocations made. It then
-reruns the test that number of times, each time forcing one of the allocations
-to fail until all allocs have been tested. By setting \fInum\fP you can force
-the allocation with that number to be set to fail at once instead of looping
-through everyone, which is very handy when debugging and then often in
-combination with \fI-g\fP.
-.IP "-u"
-Error instead of warning on server unexpectedly alive.
-.IP "-v"
-Enable verbose output. Speaks more than by default. If used in conjunction with
-parallel testing, it will be difficult to associate the logs with the test
-being run.
-.IP "-vc <curl>"
-Provide a path to a custom curl binary to run when verifying that the servers
-running are indeed our test servers. Default is the curl executable in the
-build tree.
-.SH "RUNNING TESTS"
-Many tests have conditions that must be met before the test case can run
-fine. They could depend on built-in features in libcurl or features present in
-the operating system or even in third-party libraries that curl may or may not
-use.
-.P
-The test script checks most of these by itself to determine when it is
-safe to attempt to run each test.  Those which cannot be run due to
-failed requirements will simply be skipped and listed at the completion
-of all test cases.  In some unusual configurations, the test script
-cannot make the correct determination for all tests.  In these cases,
-the problematic tests can be skipped using the "!keyword" skip feature
-documented earlier.
-.SH "WRITING TESTS"
-The simplest way to write test cases is to start with a similar existing test,
-save it with a new number and then adjust it to fit. There's an attempt to
-document the test case file format in the tests/FILEFORMAT.md.
diff --git a/third-party/curl/tests/runtests.pl b/third-party/curl/tests/runtests.pl
index 5c3643f994..61949614b9 100644
--- a/third-party/curl/tests/runtests.pl
+++ b/third-party/curl/tests/runtests.pl
@@ -23,6 +23,8 @@
 #
 ###########################################################################
 
+# For documentation, see docs/runtests.md and README.md.
+
 # Experimental hooks are available to run tests remotely on machines that
 # are able to run curl but are unable to run the test harness.
 # The following sections need to be modified:
@@ -42,7 +44,7 @@
 # the contents of the tests/server/ directory must be from the host
 # running the test suite, while the rest must be from the host running curl.
 #
-# Note that even with these changes a number of tests will still fail (mainly
+# Note that even with these changes a number of tests still fail (mainly
 # to do with cookies, those that set environment variables, or those that
 # do more than touch the file system in a <precheck> or <postcheck>
 # section). These can be added to the $TESTCASES line below,
@@ -52,12 +54,12 @@
 # to check the remote system's PATH, and the places in the code where
 # the curl binary is read directly to determine its type also need to be
 # fixed. As long as the -g option is never given, and the -n is always
-# given, this won't be a problem.
+# given, this is not a problem.
 
 use strict;
-# Promote all warnings to fatal
-use warnings FATAL => 'all';
+use warnings;
 use 5.006;
+use POSIX qw(strftime);
 
 # These should be the only variables that might be needed to get edited:
 
@@ -80,13 +82,16 @@ BEGIN {
 
 use Digest::MD5 qw(md5);
 use List::Util 'sum';
+use I18N::Langinfo qw(langinfo CODESET);
+use POSIX qw(setlocale LC_ALL);
 
+use serverhelp qw(
+    server_exe
+    );
 use pathhelp qw(
     exe_ext
     sys_native_current_path
-    );
-use processhelp qw(
-    portable_sleep
+    shell_quote
     );
 
 use appveyor;
@@ -97,19 +102,20 @@ use valgrind;  # valgrind report parser
 use globalconfig;
 use runner;
 use testutil;
+use memanalyzer;
 
 my %custom_skip_reasons;
 
-my $ACURL=$VCURL;  # what curl binary to use to talk to APIs (relevant for CI)
-                   # ACURL is handy to set to the system one for reliability
-my $CURLCONFIG="../curl-config"; # curl-config from current build
+my $ACURL = $VCURL;  # what curl binary to use to talk to APIs (relevant for CI)
+                     # ACURL is handy to set to the system one for reliability
+my $CURLCONFIG = "../curl-config"; # curl-config from current build
 
 # Normally, all test cases should be run, but at times it is handy to
-# simply run a particular one:
-my $TESTCASES="all";
+# run a particular one:
+my $TESTCASES = "all";
 
 # To run specific test cases, set them like:
-# $TESTCASES="1 2 3 7 8";
+# $TESTCASES = "1 2 3 7 8";
 
 #######################################################################
 # No variables below this point should need to be modified
@@ -117,10 +123,12 @@ my $TESTCASES="all";
 
 my $libtool;
 my $repeat = 0;
+my $retry = 0;
 
 my $start;          # time at which testing started
+my $args;           # command-line arguments
 
-my $uname_release = `uname -r`;
+my $uname_release = qx(uname -r);
 my $is_wsl = $uname_release =~ /Microsoft$/;
 
 my $http_ipv6;      # set if HTTP server has IPv6 support
@@ -129,9 +137,6 @@ my $ftp_ipv6;       # set if FTP server has IPv6 support
 
 my $resolver;       # name of the resolver backend (for human presentation)
 
-my $has_textaware;  # set if running on a system that has a text mode concept
-                    # on files. Windows for example
-
 my %skipped;    # skipped{reason}=counter, reasons for skip
 my @teststat;   # teststat[testnum]=reason, reasons for skip
 my %disabled_keywords;  # key words of tests to skip
@@ -141,6 +146,11 @@ my %disabled;           # disabled test cases
 my %ignored;            # ignored results of test cases
 my %ignoretestcodes;    # if test results are to be ignored
 
+my @global_strip_stderr;  # global patterns added to stripfile before stderr check
+my @global_strip_file;    # global patterns added to stripfile before file check
+
+my $passedign;   # tests passed with results ignored
+
 my $timestats;   # time stamping and stats generation
 my $fullstats;   # show time stats for every single test
 my %timeprepini; # timestamp for each test preparation start
@@ -155,7 +165,6 @@ my $globalabort; # flag signalling program abort
 # values for $singletest_state
 use constant {
     ST_INIT => 0,
-    ST_CLEARLOCKS => 1,
     ST_INITED => 2,
     ST_PREPROCESS => 3,
     ST_RUN => 4,
@@ -173,8 +182,6 @@ my %runnersrunning;    # tests currently running by runner ID
 #
 my $short;
 my $no_debuginfod;
-my $keepoutfiles; # keep stdout and stderr files after tests
-my $clearlocks;   # force removal of files by killing locking processes
 my $postmortem;   # display detailed info about failed tests
 my $run_disabled; # run the specific tests even if listed in DISABLED
 my $scrambleorder;
@@ -197,11 +204,11 @@ sub logmsg {
         if(!$line) {
             next;
         }
-        if ($is_wsl) {
+        if($is_wsl) {
             # use \r\n for WSL shell
             $line =~ s/\r?\n$/\r\n/g;
         }
-        print "$line";
+        print $line;
     }
 }
 
@@ -209,12 +216,13 @@ sub logmsg {
 # enable logmsg buffering for the given runner ID
 #
 sub logmsg_bufferfortest {
-    my ($runnerid)=@_;
+    my ($runnerid) = @_;
     if($jobs) {
         # Only enable buffering in multiprocess mode
         $singletest_bufferedrunner = $runnerid;
     }
 }
+
 #######################################################################
 # Store a log message in a buffer for this test
 # The messages can then be displayed all at once at the end of the test
@@ -229,7 +237,7 @@ sub singletest_logmsg {
 }
 
 #######################################################################
-# Stop buffering log messages, but don't touch them
+# Stop buffering log messages, but do not touch them
 sub singletest_unbufferlogs {
     undef $singletest_bufferedrunner;
 }
@@ -238,7 +246,7 @@ sub singletest_unbufferlogs {
 # Clear the buffered log messages & stop buffering after returning them
 sub singletest_dumplogs {
     if(!defined $singletest_bufferedrunner) {
-        # probably not multiprocess mode and logs weren't buffered
+        # probably not multiprocess mode and logs were not buffered
         return undef;
     }
     my $logsref = $singletest_logs{$singletest_bufferedrunner};
@@ -272,7 +280,7 @@ sub catch_usr1 {
 }
 
 eval {
-    # some msys2 perl versions don't define SIGUSR1
+    # some msys2 perl versions do not define SIGUSR1
     $SIG{USR1} = \&catch_usr1;
 };
 $SIG{PIPE} = 'IGNORE';  # these errors are captured in the read/write calls
@@ -289,7 +297,7 @@ foreach my $protocol (('ftp', 'http', 'ftps', 'https', 'no', 'all')) {
     delete $ENV{uc($proxy)} if($ENV{uc($proxy)});
 }
 
-# make sure we don't get affected by other variables that control our
+# make sure we do not get affected by other variables that control our
 # behavior
 
 delete $ENV{'SSL_CERT_DIR'} if($ENV{'SSL_CERT_DIR'});
@@ -298,9 +306,9 @@ delete $ENV{'CURL_CA_BUNDLE'} if($ENV{'CURL_CA_BUNDLE'});
 
 # provide defaults from our config file for ENV vars not explicitly
 # set by the caller
-if (open(my $fd, "<", "config")) {
+if(open(my $fd, "<", "config")) {
     while(my $line = <$fd>) {
-        next if ($line =~ /^#/);
+        next if($line =~ /^#/);
         chomp $line;
         my ($name, $val) = split(/\s*:\s*/, $line, 2);
         $ENV{$name} = $val if(!$ENV{$name});
@@ -310,24 +318,24 @@ if (open(my $fd, "<", "config")) {
 
 # Check if we have nghttpx available and if it talks http/3
 my $nghttpx_h3 = 0;
-if (!$ENV{"NGHTTPX"}) {
+if(!$ENV{"NGHTTPX"}) {
     $ENV{"NGHTTPX"} = checktestcmd("nghttpx");
 }
-if ($ENV{"NGHTTPX"}) {
-    my $nghttpx_version=join(' ', `"$ENV{'NGHTTPX'}" -v 2>/dev/null`);
+if($ENV{"NGHTTPX"}) {
+    my $cmd = "\"$ENV{'NGHTTPX'}\" -v 2>$dev_null";
+    my $nghttpx_version = join(' ', qx($cmd));
     $nghttpx_h3 = $nghttpx_version =~ /nghttp3\//;
     chomp $nghttpx_h3;
 }
 
-
 #######################################################################
 # Get the list of tests that the tests/data/Makefile.am knows about!
 #
 my $disttests = "";
 sub get_disttests {
     # If a non-default $TESTDIR is being used there may not be any
-    # Makefile.inc in which case there's nothing to do.
-    open(my $dh, "<", "$TESTDIR/Makefile.inc") or return;
+    # Makefile.am in which case there is nothing to do.
+    open(my $dh, "<", "$TESTDIR/Makefile.am") or return;
     while(<$dh>) {
         chomp $_;
         if(($_ =~ /^#/) ||($_ !~ /test/)) {
@@ -338,7 +346,6 @@ sub get_disttests {
     close($dh);
 }
 
-
 #######################################################################
 # Remove all files in the specified directory
 #
@@ -348,13 +355,12 @@ sub cleardir {
     my $file;
 
     # Get all files
-    opendir(my $dh, $dir) ||
-        return 0; # can't open dir
+    opendir(my $dh, $dir) or return 0; # cannot open dir
     while($file = readdir($dh)) {
-        # Don't clear the $PIDDIR or $LOCKDIR since those need to live beyond
+        # Do not clear the $PIDDIR or $LOCKDIR since those need to live beyond
         # one test
         if(($file !~ /^(\.|\.\.)\z/) &&
-            "$file" ne $PIDDIR && "$file" ne $LOCKDIR) {
+            $file ne $PIDDIR && $file ne $LOCKDIR) {
             if(-d "$dir/$file") {
                 if(!cleardir("$dir/$file")) {
                     $done = 0;
@@ -365,7 +371,7 @@ sub cleardir {
             }
             else {
                 # Ignore stunnel since we cannot do anything about its locks
-                if(!unlink("$dir/$file") && "$file" !~ /_stunnel\.log$/) {
+                if(!unlink("$dir/$file") && $file !~ /_stunnel\.log$/) {
                     $done = 0;
                 }
             }
@@ -375,17 +381,16 @@ sub cleardir {
     return $done;
 }
 
-
 #######################################################################
-# Given two array references, this function will store them in two temporary
+# Given two array references, this function stores them in two temporary
 # files, run 'diff' on them, store the result and return the diff output!
 sub showdiff {
-    my ($logdir, $firstref, $secondref)=@_;
+    my ($logdir, $firstref, $secondref) = @_;
 
-    my $file1="$logdir/check-generated";
-    my $file2="$logdir/check-expected";
+    my $file1 = "$logdir/check-generated";
+    my $file2 = "$logdir/check-expected";
 
-    open(my $temp, ">", "$file1") || die "Failure writing diff file";
+    open(my $temp, ">", $file1) or die "Failure writing diff file";
     for(@$firstref) {
         my $l = $_;
         $l =~ s/\r/[CR]/g;
@@ -394,9 +399,9 @@ sub showdiff {
         print $temp $l;
         print $temp "\n";
     }
-    close($temp) || die "Failure writing diff file";
+    close($temp) or die "Failure writing diff file";
 
-    open($temp, ">", "$file2") || die "Failure writing diff file";
+    open($temp, ">", $file2) or die "Failure writing diff file";
     for(@$secondref) {
         my $l = $_;
         $l =~ s/\r/[CR]/g;
@@ -405,23 +410,25 @@ sub showdiff {
         print $temp $l;
         print $temp "\n";
     }
-    close($temp) || die "Failure writing diff file";
-    my @out = `diff -u $file2 $file1 2>/dev/null`;
+    close($temp) or die "Failure writing diff file";
+    my @out = qx(diff -u $file2 $file1 2>$dev_null);
 
     if(!$out[0]) {
-        @out = `diff -c $file2 $file1 2>/dev/null`;
+        @out = qx(diff -c $file2 $file1 2>$dev_null);
+        if(!$out[0]) {
+            logmsg "Failed to show diff. The diff tool may be missing.\n";
+        }
     }
 
     return @out;
 }
 
-
 #######################################################################
 # compare test results with the expected output, we might filter off
 # some pattern that is allowed to differ, output test results
 #
 sub compare {
-    my ($runnerid, $testnum, $testname, $subject, $firstref, $secondref)=@_;
+    my ($runnerid, $testnum, $testname, $subject, $firstref, $secondref) = @_;
 
     my $result = compareparts($firstref, $secondref);
 
@@ -445,44 +452,74 @@ sub compare {
     return $result;
 }
 
+#######################################################################
+# Numeric-sort words in a string
+sub numsortwords {
+    my ($string) = @_;
+    return join(' ', sort { $a <=> $b } split(' ', $string));
+}
+
 #######################################################################
 # Parse and store the protocols in curl's Protocols: line
 sub parseprotocols {
-    my ($line)=@_;
+    my ($line) = @_;
 
     @protocols = split(' ', lc($line));
 
     # Generate a "proto-ipv6" version of each protocol to match the
     # IPv6 <server> name and a "proto-unix" to match the variant which
-    # uses Unix domain sockets. This works even if support isn't
-    # compiled in because the <features> test will fail.
+    # uses Unix domain sockets. This works even if support is not
+    # compiled in because the <features> test fails.
     push @protocols, map(("$_-ipv6", "$_-unix"), @protocols);
 
     # 'http-proxy' is used in test cases to do CONNECT through
     push @protocols, 'http-proxy';
 
+    # 'https-mtls' is used for client certificate auth testing
+    push @protocols, 'https-mtls';
+
     # 'none' is used in test cases to mean no server
     push @protocols, 'none';
 }
 
+#######################################################################
+# Check if the operating environment supports UTF-8.
+sub is_utf8_supported {
+    my $result;
+    my $old_LC_ALL;
+    my $was_defined = defined $ENV{'LC_ALL'};
+    if($was_defined) {
+        $old_LC_ALL = $ENV{'LC_ALL'};
+    }
+    setlocale(LC_ALL, $ENV{'LC_ALL'} = "C.UTF-8");
+    $result = lc(langinfo(CODESET())) eq "utf-8";
+    if($was_defined) {
+        $ENV{'LC_ALL'} = $old_LC_ALL;
+    }
+    else {
+        delete $ENV{'LC_ALL'};
+    }
+    return $result;
+}
 
 #######################################################################
 # Check & display information about curl and the host the test suite runs on.
 # Information to do with servers is displayed in displayserverfeatures, after
 # the server initialization is performed.
 sub checksystemfeatures {
+    my $proto;
     my $feat;
     my $curl;
     my $libcurl;
     my $versretval;
     my $versnoexec;
-    my @version=();
+    my @version = ();
     my @disabled;
     my $dis = "";
 
-    my $curlverout="$LOGDIR/curlverout.log";
-    my $curlvererr="$LOGDIR/curlvererr.log";
-    my $versioncmd=shell_quote($CURL) . " --version 1>$curlverout 2>$curlvererr";
+    my $curlverout = "$LOGDIR/curlverout.log";
+    my $curlvererr = "$LOGDIR/curlvererr.log";
+    my $versioncmd = exerunner() . shell_quote($CURL) . " --version 1>$curlverout 2>$curlvererr";
 
     unlink($curlverout);
     unlink($curlvererr);
@@ -490,12 +527,22 @@ sub checksystemfeatures {
     $versretval = runclient($versioncmd);
     $versnoexec = $!;
 
-    open(my $versout, "<", "$curlverout");
+    my $current_time = int(time());
+    $ENV{'SOURCE_DATE_EPOCH'} = $current_time;
+    $DATE = strftime "%Y-%m-%d", gmtime($current_time);
+
+    open(my $versout, "<", $curlverout);
     @version = <$versout>;
     close($versout);
 
-    open(my $disabledh, "-|", "server/disabled".exe_ext('TOOL'));
-    @disabled = <$disabledh>;
+    open(my $disabledh, "-|", exerunner() . shell_quote($CURLINFO));
+    while(<$disabledh>) {
+        if($_ =~ /([^:]*): ([ONF]*)/) {
+            my ($val, $toggle) = ($1, $2);
+            push @disabled, $val if($toggle eq "OFF");
+            $feature{$val} = 1 if($toggle eq "ON");
+        }
+    }
     close($disabledh);
 
     if($disabled[0]) {
@@ -503,120 +550,135 @@ sub checksystemfeatures {
         $dis = join(", ", @disabled);
     }
 
-    $resolver="stock";
+    $resolver = "stock";
     for(@version) {
         chomp;
 
         if($_ =~ /^curl ([^ ]*)/) {
             $curl = $_;
             $CURLVERSION = $1;
-            $curl =~ s/^(.*)(libcurl.*)/$1/g || die "Failure determining curl binary version";
+            $CURLVERNUM = $CURLVERSION;
+            $CURLVERNUM =~ s/^([0-9.]+)(.*)/$1/; # leading dots and numbers
+            $curl =~ s/^(.*)(libcurl.*)/$1/g or die "Failure determining curl binary version";
 
             $libcurl = $2;
-            if($curl =~ /linux|bsd|solaris/) {
-                # system support LD_PRELOAD; may be disabled later
-                $feature{"ld_preload"} = 1;
-            }
-            if($curl =~ /win32|Windows|mingw(32|64)/) {
+            if($curl =~ /win32|Windows|windows|mingw(32|64)/) {
                 # This is a Windows MinGW build or native build, we need to use
-                # Win32-style path.
+                # Windows-style path.
                 $pwd = sys_native_current_path();
-                $has_textaware = 1;
                 $feature{"win32"} = 1;
-                # set if built with MinGW (as opposed to MinGW-w64)
-                $feature{"MinGW"} = 1 if ($curl =~ /-pc-mingw32/);
             }
-           if ($libcurl =~ /\s(winssl|schannel)\b/i) {
-               $feature{"Schannel"} = 1;
-               $feature{"SSLpinning"} = 1;
-           }
-           elsif ($libcurl =~ /\sopenssl\b/i) {
-               $feature{"OpenSSL"} = 1;
-               $feature{"SSLpinning"} = 1;
-           }
-           elsif ($libcurl =~ /\sgnutls\b/i) {
-               $feature{"GnuTLS"} = 1;
-               $feature{"SSLpinning"} = 1;
-           }
-           elsif ($libcurl =~ /\srustls-ffi\b/i) {
-               $feature{"rustls"} = 1;
-           }
-           elsif ($libcurl =~ /\swolfssl\b/i) {
-               $feature{"wolfssl"} = 1;
-               $feature{"SSLpinning"} = 1;
-           }
-           elsif ($libcurl =~ /\sbearssl\b/i) {
-               $feature{"bearssl"} = 1;
-           }
-           elsif ($libcurl =~ /\ssecuretransport\b/i) {
-               $feature{"sectransp"} = 1;
-               $feature{"SSLpinning"} = 1;
-           }
-           elsif ($libcurl =~ /\sBoringSSL\b/i) {
-               # OpenSSL compatible API
-               $feature{"OpenSSL"} = 1;
-               $feature{"SSLpinning"} = 1;
-           }
-           elsif ($libcurl =~ /\slibressl\b/i) {
-               # OpenSSL compatible API
-               $feature{"OpenSSL"} = 1;
-               $feature{"SSLpinning"} = 1;
-           }
-           elsif ($libcurl =~ /\smbedTLS\b/i) {
-               $feature{"mbedtls"} = 1;
-               $feature{"SSLpinning"} = 1;
-           }
-           if ($libcurl =~ /ares/i) {
-               $feature{"c-ares"} = 1;
-               $resolver="c-ares";
-           }
-           if ($libcurl =~ /Hyper/i) {
-               $feature{"hyper"} = 1;
-           }
-            if ($libcurl =~ /nghttp2/i) {
-                # nghttp2 supports h2c, hyper does not
+            if($curl =~ /cygwin|msys/i) {
+                $feature{"cygwin"} = 1;
+            }
+            if($libcurl =~ /\sschannel\b/i) {
+                $feature{"Schannel"} = 1;
+                $feature{"SSLpinning"} = 1;
+            }
+            elsif($libcurl =~ /\sopenssl\b/i) {
+                $feature{"OpenSSL"} = 1;
+                $feature{"SSLpinning"} = 1;
+            }
+            elsif($libcurl =~ /\sgnutls\b/i) {
+                $feature{"GnuTLS"} = 1;
+                $feature{"SSLpinning"} = 1;
+            }
+            elsif($libcurl =~ /\srustls-ffi\b/i) {
+                $feature{"rustls"} = 1;
+            }
+            elsif($libcurl =~ /\swolfssl\b/i) {
+                $feature{"wolfssl"} = 1;
+                $feature{"SSLpinning"} = 1;
+            }
+            elsif($libcurl =~ /\s(AWS-LC|BoringSSL)\b/i) {
+                # OpenSSL compatible API
+                $feature{"OpenSSL"} = 1;
+                $feature{"SSLpinning"} = 1;
+            }
+            elsif($libcurl =~ /\slibressl\b/i) {
+                # OpenSSL compatible API
+                $feature{"OpenSSL"} = 1;
+                $feature{"SSLpinning"} = 1;
+            }
+            elsif($libcurl =~ /\squictls\b/i) {
+                # OpenSSL compatible API
+                $feature{"OpenSSL"} = 1;
+                $feature{"SSLpinning"} = 1;
+            }
+            elsif($libcurl =~ /\smbedTLS\b/i) {
+                $feature{"mbedtls"} = 1;
+                $feature{"SSLpinning"} = 1;
+            }
+            if($libcurl =~ /ares/i) {
+                $feature{"c-ares"} = 1;
+                $resolver = "c-ares";
+            }
+            if($libcurl =~ /nghttp2/i) {
+                # nghttp2 supports h2c
                 $feature{"h2c"} = 1;
             }
-            if ($libcurl =~ /libssh2/i) {
-                $feature{"libssh2"} = 1;
+            if($libcurl =~ /AppleIDN/) {
+                $feature{"AppleIDN"} = 1;
             }
-            if ($libcurl =~ /libssh\/([0-9.]*)\//i) {
+            if($libcurl =~ /WinIDN/) {
+                $feature{"WinIDN"} = 1;
+            }
+            if($libcurl =~ /libidn2/) {
+                $feature{"libidn2"} = 1;
+            }
+            if($libcurl =~ /libssh2/i) {
+                $feature{"libssh2"} = 1;
+                $feature{"sshkeyalgo"} = ($ENV{'CURL_TEST_SSH_KEYALGO'} and
+                    $ENV{'CURL_TEST_SSH_KEYALGO'} =~ /^(?:rsa|ecdsa|ed25519)$/) ? $ENV{'CURL_TEST_SSH_KEYALGO'} : 'rsa';
+            }
+            if($libcurl =~ /libssh\/([0-9.]*)\//i) {
                 $feature{"libssh"} = 1;
-                if($1 =~ /(\d+)\.(\d+).(\d+)/) {
-                    my $v = $1 * 100 + $2 * 10 + $3;
-                    if($v < 94) {
-                        # before 0.9.4
-                        $feature{"oldlibssh"} = 1;
+                $feature{"sshkeyalgo"} = ($ENV{'CURL_TEST_SSH_KEYALGO'} and
+                    $ENV{'CURL_TEST_SSH_KEYALGO'} =~ /^(?:rsa|ecdsa|ed25519)$/) ? $ENV{'CURL_TEST_SSH_KEYALGO'} : 'rsa';
+                # Detect simple cases of default libssh configuration files ending up
+                # setting 'StrictHostKeyChecking no'. include files, quoted values,
+                # '=value' format not implemented.
+                $feature{"badlibssh"} = 0;
+                foreach my $libssh_configfile (('/etc/ssh/ssh_config', $ENV{'HOME'} . '/.ssh/config')) {
+                    if(open(my $fd, '<', $libssh_configfile)) {
+                        while(my $line = <$fd>) {
+                            chomp $line;
+                            if($line =~ /^\s*StrictHostKeyChecking\s+(yes|no)\s*$/) {
+                                $feature{"badlibssh"} = ($1 eq 'no' ? 1 : 0);
+                                last;  # Do as openssh and libssh
+                            }
+                        }
+                        close($fd);
                     }
                 }
             }
-            if ($libcurl =~ /wolfssh/i) {
-                $feature{"wolfssh"} = 1;
-            }
         }
         elsif($_ =~ /^Protocols: (.*)/i) {
+            $proto = $1;
             # these are the protocols compiled in to this libcurl
-            parseprotocols($1);
+            parseprotocols($proto);
         }
         elsif($_ =~ /^Features: (.*)/i) {
             $feat = $1;
 
-            # built with memory tracking support (--enable-curldebug); may be disabled later
-            $feature{"TrackMemory"} = $feat =~ /TrackMemory/i;
+            # built with memory tracking support (--enable-debug); may be disabled later
+            $feature{"TrackMemory"} = $feat =~ /\bDebug/;
             # curl was built with --enable-debug
-            $feature{"debug"} = $feat =~ /debug/i;
-            # ssl enabled
+            $feature{"Debug"} = $feat =~ /\bDebug/;
+            # SSL enabled
             $feature{"SSL"} = $feat =~ /SSL/i;
-            # multiple ssl backends available.
+            # multiple SSL backends available.
             $feature{"MultiSSL"} = $feat =~ /MultiSSL/i;
+            # embedded CA certificate bundle
+            $feature{"CAcert"} = $feat =~ /CAcert/i;
             # large file support
-            $feature{"large_file"} = $feat =~ /Largefile/i;
+            $feature{"Largefile"} = $feat =~ /Largefile/i;
             # IDN support
-            $feature{"idn"} = $feat =~ /IDN/i;
+            $feature{"IDN"} = $feat =~ /IDN/i;
             # IPv6 support
-            $feature{"ipv6"} = $feat =~ /IPv6/i;
+            $feature{"IPv6"} = $feat =~ /IPv6/i;
             # Unix sockets support
-            $feature{"unix-sockets"} = $feat =~ /UnixSockets/i;
+            $feature{"UnixSockets"} = $feat =~ /UnixSockets/i;
             # libz compression
             $feature{"libz"} = $feat =~ /libz/i;
             # Brotli compression
@@ -635,8 +697,6 @@ sub checksystemfeatures {
             $feature{"Kerberos"} = $feat =~ /Kerberos/i;
             # SPNEGO enabled
             $feature{"SPNEGO"} = $feat =~ /SPNEGO/i;
-            # CharConv enabled
-            $feature{"CharConv"} = $feat =~ /CharConv/i;
             # TLS-SRP enabled
             $feature{"TLS-SRP"} = $feat =~ /TLS-SRP/i;
             # PSL enabled
@@ -645,11 +705,15 @@ sub checksystemfeatures {
             $feature{"alt-svc"} = $feat =~ /alt-svc/i;
             # HSTS support
             $feature{"HSTS"} = $feat =~ /HSTS/i;
+            $feature{"asyn-rr"} = $feat =~ /asyn-rr/;
             if($feat =~ /AsynchDNS/i) {
-                if(!$feature{"c-ares"}) {
+                if(!$feature{"c-ares"} || $feature{"asyn-rr"}) {
                     # this means threaded resolver
                     $feature{"threaded-resolver"} = 1;
-                    $resolver="threaded";
+                    $resolver = "threaded";
+
+                    # does not count as "real" c-ares
+                    $feature{"c-ares"} = 0;
                 }
             }
             # http2 enabled
@@ -663,15 +727,17 @@ sub checksystemfeatures {
                 push @protocols, 'http/3';
             }
             # https proxy support
-            $feature{"https-proxy"} = $feat =~ /HTTPS-proxy/;
-            if($feature{"https-proxy"}) {
+            $feature{"HTTPS-proxy"} = $feat =~ /HTTPS-proxy/;
+            if($feature{"HTTPS-proxy"}) {
                 # 'https-proxy' is used as "server" so consider it a protocol
                 push @protocols, 'https-proxy';
             }
-            # UNICODE support
+            # Unicode support
             $feature{"Unicode"} = $feat =~ /Unicode/i;
             # Thread-safe init
             $feature{"threadsafe"} = $feat =~ /threadsafe/i;
+            $feature{"HTTPSRR"} = $feat =~ /HTTPSRR/;
+            $feature{"ECH"} = $feat =~ /ECH/;
         }
         #
         # Test harness currently uses a non-stunnel server in order to
@@ -685,7 +751,7 @@ sub checksystemfeatures {
             my $add_httptls;
             for(@protocols) {
                 if($_ =~ /^https(-ipv6|)$/) {
-                    $add_httptls=1;
+                    $add_httptls = 1;
                     last;
                 }
             }
@@ -696,26 +762,30 @@ sub checksystemfeatures {
         }
     }
 
+    if($torture) {
+        $feature{"torture"} = 1;
+    }
+
     if(!$curl) {
         logmsg "unable to get curl's version, further details are:\n";
         logmsg "issued command: \n";
         logmsg "$versioncmd \n";
-        if ($versretval == -1) {
+        if($versretval == -1) {
             logmsg "command failed with: \n";
             logmsg "$versnoexec \n";
         }
-        elsif ($versretval & 127) {
+        elsif($versretval & 127) {
             logmsg sprintf("command died with signal %d, and %s coredump.\n",
-                           ($versretval & 127), ($versretval & 128)?"a":"no");
+                           ($versretval & 127), ($versretval & 128) ? "a" : "no");
         }
         else {
             logmsg sprintf("command exited with value %d \n", $versretval >> 8);
         }
         logmsg "contents of $curlverout: \n";
-        displaylogcontent("$curlverout");
+        displaylogcontent($curlverout);
         logmsg "contents of $curlvererr: \n";
-        displaylogcontent("$curlvererr");
-        die "couldn't get curl's version";
+        displaylogcontent($curlvererr);
+        die "Could not get curl's version";
     }
 
     if(-r "../lib/curl_config.h") {
@@ -729,36 +799,40 @@ sub checksystemfeatures {
         close($conf);
     }
 
-    # allow this feature only if debug mode is disabled
-    $feature{"ld_preload"} = $feature{"ld_preload"} && !$feature{"debug"};
-
-    if($feature{"ipv6"}) {
+    if($feature{"IPv6"}) {
         # client has IPv6 support
 
         # check if the HTTP server has it!
-        my $cmd = "server/sws".exe_ext('SRV')." --version";
-        my @sws = `$cmd`;
+        my $cmd = server_exe('sws')." --version";
+        my @sws = qx($cmd);
         if($sws[0] =~ /IPv6/) {
             # HTTP server has IPv6 support!
             $http_ipv6 = 1;
         }
 
         # check if the FTP server has it!
-        $cmd = "server/sockfilt".exe_ext('SRV')." --version";
-        @sws = `$cmd`;
+        $cmd = server_exe('sockfilt')." --version";
+        @sws = qx($cmd);
         if($sws[0] =~ /IPv6/) {
             # FTP server has IPv6 support!
             $ftp_ipv6 = 1;
         }
     }
 
-    if($feature{"unix-sockets"}) {
+    if($feature{"UnixSockets"}) {
         # client has Unix sockets support, check whether the HTTP server has it
-        my $cmd = "server/sws".exe_ext('SRV')." --version";
-        my @sws = `$cmd`;
+        my $cmd = server_exe('sws')." --version";
+        my @sws = qx($cmd);
         $http_unix = 1 if($sws[0] =~ /unix/);
     }
 
+    # strip line from stderr and file output to not confuse tests
+    if($feature{"CAcert"}) {
+        my $strip_cacert = 's/^Note: Using embedded CA bundle.*\n//';
+        push @global_strip_stderr, $strip_cacert;
+        push @global_strip_file, $strip_cacert;
+    }
+
     open(my $manh, "-|", shell_quote($CURL) . " -M 2>&1");
     while(my $s = <$manh>) {
         if($s =~ /built-in manual was disabled at build-time/) {
@@ -770,30 +844,17 @@ sub checksystemfeatures {
     }
     close($manh);
 
-    $feature{"unittest"} = $feature{"debug"};
+    $feature{"unittest"} = 1;
     $feature{"nghttpx"} = !!$ENV{'NGHTTPX'};
     $feature{"nghttpx-h3"} = !!$nghttpx_h3;
 
-    #
-    # strings that must exactly match the names used in server/disabled.c
-    #
-    $feature{"cookies"} = 1;
     # Use this as a proxy for any cryptographic authentication
     $feature{"crypto"} = $feature{"NTLM"} || $feature{"Kerberos"} || $feature{"SPNEGO"};
-    $feature{"DoH"} = 1;
-    $feature{"HTTP-auth"} = 1;
-    $feature{"Mime"} = 1;
-    $feature{"form-api"} = 1;
-    $feature{"netrc"} = 1;
-    $feature{"parsedate"} = 1;
-    $feature{"proxy"} = 1;
-    $feature{"shuffle-dns"} = 1;
-    $feature{"typecheck"} = 1;
-    $feature{"verbose-strings"} = 1;
-    $feature{"wakeup"} = 1;
-    $feature{"headers-api"} = 1;
-    $feature{"xattr"} = 1;
-    $feature{"large-time"} = 1;
+    $feature{"local-http"} = servers::localhttp();
+    $feature{"codeset-utf8"} = is_utf8_supported();
+    if($feature{"codeset-utf8"}) {
+        $ENV{'CURL_TEST_HAVE_CODESET_UTF8'} = 1;
+    }
 
     # make each protocol an enabled "feature"
     for my $p (@protocols) {
@@ -801,51 +862,49 @@ sub checksystemfeatures {
     }
     # 'socks' was once here but is now removed
 
-    $has_shared = `sh $CURLCONFIG --built-shared`;
-    chomp $has_shared;
-    $has_shared = $has_shared eq "yes";
-
-    if(!$feature{"TrackMemory"} && $torture) {
-        die "can't run torture tests since curl was built without ".
-            "TrackMemory feature (--enable-curldebug)";
+    if($torture && !$feature{"TrackMemory"}) {
+        die "cannot run torture tests since curl was built without ".
+            "TrackMemory feature (--enable-debug)";
     }
 
-    my $hostname=join(' ', runclientoutput("hostname"));
-    my $hosttype=join(' ', runclientoutput("uname -a"));
-    my $hostos=$^O;
+    my $hostname = join(' ', runclientoutput("hostname"));
+    chomp $hostname;
+    my $hosttype = join(' ', runclientoutput("uname -a"));
+    chomp $hosttype;
+    my $hostos = $^O;
 
     # display summary information about curl and the test host
-    logmsg ("********* System characteristics ******** \n",
-            "* $curl\n",
-            "* $libcurl\n",
-            "* Features: $feat\n",
-            "* Disabled: $dis\n",
-            "* Host: $hostname",
-            "* System: $hosttype",
-            "* OS: $hostos\n");
-
+    logmsg("********* System characteristics ******** \n",
+           "* $curl\n",
+           "* $libcurl\n",
+           "* Protocols: $proto\n",
+           "* Features: $feat\n",
+           "* Disabled: $dis\n",
+           "* Host: $hostname\n",
+           "* System: $hosttype\n",
+           "* OS: $hostos\n",
+           "* Perl: $^V ($^X)\n",
+           "* Args: $args\n");
     if($jobs) {
         # Only show if not the default for now
         logmsg "* Jobs: $jobs\n";
     }
-    if($feature{"TrackMemory"} && $feature{"threaded-resolver"}) {
-        logmsg("*\n",
-               "*** DISABLES memory tracking when using threaded resolver\n",
-               "*\n");
+
+    my $env = sprintf("%s%s%s%s%s",
+                      $valgrind ? "Valgrind " : "",
+                      $run_duphandle ? "test-duphandle " : "",
+                      $run_event_based ? "event-based " : "",
+                      $nghttpx_h3 ? "nghttpx-h3 " : "",
+                      $libtool ? "Libtool " : "");
+    if($env) {
+        logmsg "* Env: $env\n";
     }
-
-    logmsg sprintf("* Env: %s%s%s", $valgrind?"Valgrind ":"",
-                   $run_event_based?"event-based ":"",
-                   $nghttpx_h3);
-    logmsg sprintf("%s\n", $libtool?"Libtool ":"");
-    logmsg ("* Seed: $randseed\n");
-
-    # Disable memory tracking when using threaded resolver
-    $feature{"TrackMemory"} = $feature{"TrackMemory"} && !$feature{"threaded-resolver"};
-
-    # toggle off the features that were disabled in the build
-    for my $d(@disabled) {
-        $feature{$d} = 0;
+    logmsg "* Seed: $randseed\n";
+    if(system("diff $TESTDIR/DISABLED $TESTDIR/DISABLED 2>$dev_null") != 0) {
+        logmsg "* diff: missing\n";
+    }
+    if($mintotal) {
+        logmsg "* Min tests: $mintotal\n";
     }
 }
 
@@ -853,10 +912,10 @@ sub checksystemfeatures {
 # display information about server features
 #
 sub displayserverfeatures {
-    logmsg sprintf("* Servers: %s", $stunnel?"SSL ":"");
-    logmsg sprintf("%s", $http_ipv6?"HTTP-IPv6 ":"");
-    logmsg sprintf("%s", $http_unix?"HTTP-unix ":"");
-    logmsg sprintf("%s\n", $ftp_ipv6?"FTP-IPv6 ":"");
+    logmsg sprintf("* Servers: %s", $stunnel ? "SSL " : "");
+    logmsg sprintf("%s", $http_ipv6 ? "HTTP-IPv6 " : "");
+    logmsg sprintf("%s", $http_unix ? "HTTP-unix " : "");
+    logmsg sprintf("%s\n", $ftp_ipv6 ? "FTP-IPv6 " : "");
     logmsg "***************************************** \n";
 }
 
@@ -910,17 +969,15 @@ sub timestampskippedevents {
     }
 }
 
-
 # Setup CI Test Run
 sub citest_starttestrun {
     if(azure_check_environment()) {
         $AZURE_RUN_ID = azure_create_test_run($ACURL);
-        logmsg "Azure Run ID: $AZURE_RUN_ID\n" if ($verbose);
+        logmsg "Azure Run ID: $AZURE_RUN_ID\n" if($verbose);
     }
-    # Appveyor doesn't require anything here
+    # Appveyor does not require anything here
 }
 
-
 # Register the test case with the CI runner
 sub citest_starttest {
     my $testnum = $_[0];
@@ -938,7 +995,6 @@ sub citest_starttest {
     }
 }
 
-
 # Submit the test case result with the CI runner
 sub citest_finishtest {
     my ($testnum, $error) = @_;
@@ -957,13 +1013,12 @@ sub citest_finishtestrun {
     if(azure_check_environment() && $AZURE_RUN_ID) {
         $AZURE_RUN_ID = azure_update_test_run($ACURL, $AZURE_RUN_ID);
     }
-    # Appveyor doesn't require anything here
+    # Appveyor does not require anything here
 }
 
-
 # add one set of test timings from the runner to global set
 sub updatetesttimings {
-    my ($testnum, %testtimings)=@_;
+    my ($testnum, %testtimings) = @_;
 
     if(defined $testtimings{"timeprepini"}) {
         $timeprepini{$testnum} = $testtimings{"timeprepini"};
@@ -985,7 +1040,6 @@ sub updatetesttimings {
     }
 }
 
-
 #######################################################################
 # Return the log directory for the given test runner
 sub getrunnernumlogdir {
@@ -1009,17 +1063,16 @@ sub getrunnerlogdir {
     die "Internal error: runner ID $runnerid not found";
 }
 
-
 #######################################################################
 # Verify that this test case should be run
 sub singletest_shouldrun {
     my $testnum = $_[0];
-    my $why;   # why the test won't be run
+    my $why;   # why the test is not run
     my $errorreturncode = 1; # 1 means normal error, 2 means ignored error
     my @what;  # what features are needed
 
     if($disttests !~ /test$testnum(\W|\z)/ ) {
-        logmsg "Warning: test$testnum not present in tests/data/Makefile.inc\n";
+        logmsg "Warning: test$testnum not present in tests/data/Makefile.am\n";
     }
     if($disabled{$testnum}) {
         if(!$run_disabled) {
@@ -1034,10 +1087,10 @@ sub singletest_shouldrun {
         $errorreturncode = 2;
     }
 
-    if(loadtest("${TESTDIR}/test${testnum}")) {
+    if(loadtest("${TESTDIR}/test${testnum}", 1)) {
         if($verbose) {
             # this is not a test
-            logmsg "RUN: $testnum doesn't look like a test case\n";
+            logmsg "RUN: $testnum does not look like a test case\n";
         }
         $why = "no test";
     }
@@ -1087,54 +1140,74 @@ sub singletest_shouldrun {
         if(!$info_keywords[0]) {
             $why = "missing the <keywords> section!";
         }
+        # Only evaluate keywords if the section is present.
+        else {
+            # Prefix features with "feat:" and add to keywords list.
+            push @info_keywords, map { "feat:" . lc($_) } getpart("client", "features");
 
-        my $match;
-        for my $k (@info_keywords) {
-            chomp $k;
-            if ($disabled_keywords{lc($k)}) {
-                $why = "disabled by keyword";
+            my $match;
+            for my $k (@info_keywords) {
+                chomp $k;
+                if($disabled_keywords{lc($k)}) {
+                    if($k =~ /^feat:/) {
+                        $why = "disabled by feature";
+                    }
+                    else {
+                        $why = "disabled by keyword";
+                    }
+                }
+                elsif($enabled_keywords{lc($k)}) {
+                    $match = 1;
+                }
+                if($ignored_keywords{lc($k)}) {
+                    logmsg "Warning: test$testnum result is ignored due to $k\n";
+                    $errorreturncode = 2;
+                }
             }
-            elsif ($enabled_keywords{lc($k)}) {
-                $match = 1;
-            }
-            if ($ignored_keywords{lc($k)}) {
-                logmsg "Warning: test$testnum result is ignored due to $k\n";
-                $errorreturncode = 2;
-            }
-        }
 
-        if(!$why && !$match && %enabled_keywords) {
-            $why = "disabled by missing keyword";
+            if(!$why && !$match && %enabled_keywords) {
+                if(grep { /^feat:/ } keys %enabled_keywords) {
+                    $why = "disabled by missing feature";
+                }
+                else {
+                    $why = "disabled by missing keyword";
+                }
+            }
         }
     }
 
-    if (!$why && defined $custom_skip_reasons{test}{$testnum}) {
+    if(!$why && defined $custom_skip_reasons{test}{$testnum}) {
         $why = $custom_skip_reasons{test}{$testnum};
     }
 
-    if (!$why && defined $custom_skip_reasons{tool}) {
+    if(!$why && defined $custom_skip_reasons{tool}) {
         foreach my $tool (getpart("client", "tool")) {
             foreach my $tool_skip_pattern (keys %{$custom_skip_reasons{tool}}) {
-                if ($tool =~ /$tool_skip_pattern/i) {
+                if($tool =~ /$tool_skip_pattern/i) {
                     $why = $custom_skip_reasons{tool}{$tool_skip_pattern};
                 }
             }
         }
     }
 
-    if (!$why && defined $custom_skip_reasons{keyword}) {
+    if(!$why && defined $custom_skip_reasons{keyword}) {
         foreach my $keyword (@info_keywords) {
             foreach my $keyword_skip_pattern (keys %{$custom_skip_reasons{keyword}}) {
-                if ($keyword =~ /$keyword_skip_pattern/i) {
+                if($keyword =~ /$keyword_skip_pattern/i) {
                     $why = $custom_skip_reasons{keyword}{$keyword_skip_pattern};
                 }
             }
         }
     }
 
+    if($why && checktest("${TESTDIR}/test${testnum}")) {
+        logmsg "Warning: issue(s) found in test data: ${TESTDIR}/test${testnum}\n";
+    }
+
     return ($why, $errorreturncode);
 }
 
+my %allnames;
 
 #######################################################################
 # Print the test name and count tests
@@ -1142,9 +1215,9 @@ sub singletest_count {
     my ($testnum, $why) = @_;
 
     if($why && !$listonly) {
-        # there's a problem, count it as "skipped"
+        # there is a problem, count it as "skipped"
         $skipped{$why}++;
-        $teststat[$testnum]=$why; # store reason for this test case
+        $teststat[$testnum] = $why; # store reason for this test case
 
         if(!$short) {
             if($skipped{$why} <= 3) {
@@ -1157,7 +1230,7 @@ sub singletest_count {
         return -1;
     }
 
-    # At this point we've committed to run this test
+    # At this point we have committed to run this test
     logmsg sprintf("test %04d...", $testnum) if(!$automakestyle);
 
     # name of the test
@@ -1168,17 +1241,34 @@ sub singletest_count {
     if($listonly) {
         timestampskippedevents($testnum);
     }
+    else {
+        if(exists $allnames{$testname} &&
+           ($allnames{$testname} != $testnum)) {
+            logmsg sprintf("ERROR: test %d has duplicate test name: \"%s\". ".
+                           "The same as test %d\n", $testnum,
+                           $testname, $allnames{$testname});
+            exit 1;
+        }
+        # store which test that uses this name
+        $allnames{$testname} = $testnum;
+    }
     return 0;
 }
 
+# Make sure all line endings in the array are the same: CRLF
+sub normalize_text {
+    my ($ref) = @_;
+    s/\r\n/\n/g for @$ref;
+    s/\n/\r\n/g for @$ref;
+}
 
 #######################################################################
 # Verify test succeeded
 sub singletest_check {
-    my ($runnerid, $testnum, $cmdres, $CURLOUT, $tool, $usedvalgrind)=@_;
+    my ($runnerid, $testnum, $cmdres, $CURLOUT, $tool, $usedvalgrind) = @_;
 
     # Skip all the verification on torture tests
-    if ($torture) {
+    if($torture) {
         # timestamp test result verification end
         $timevrfyend{$testnum} = Time::HiRes::time();
         return -2;
@@ -1187,11 +1277,12 @@ sub singletest_check {
     my $logdir = getrunnerlogdir($runnerid);
     my @err = getpart("verify", "errorcode");
     my $errorcode = $err[0] || "0";
-    my $ok="";
+    my $ok = "";
     my $res;
     chomp $errorcode;
     my $testname= (getpart("client", "name"))[0];
     chomp $testname;
+
     # what parts to cut off from stdout/stderr
     my @stripfile = getpart("verify", "stripfile");
 
@@ -1200,8 +1291,8 @@ sub singletest_check {
     my %hash = getpartattr("verify", "stdout");
 
     my $loadfile = $hash{'loadfile'};
-    if ($loadfile) {
-        open(my $tmp, "<", "$loadfile") || die "Cannot open file $loadfile: $!";
+    if($loadfile) {
+        open(my $tmp, "<", $loadfile) or die "Cannot open file $loadfile: $!";
         @validstdout = <$tmp>;
         close($tmp);
 
@@ -1209,7 +1300,9 @@ sub singletest_check {
         s/\r\n/\n/g for @validstdout;
     }
 
-    if (@validstdout) {
+    if(@validstdout) {
+        $validstdout[0] =~ s/^%EMPTY[\r\n]*//;
+
         # verify redirected stdout
         my @actual = loadarray(stdoutfilename($logdir, $testnum));
 
@@ -1228,11 +1321,10 @@ sub singletest_check {
         }
 
         # get the mode attribute
-        my $filemode=$hash{'mode'};
-        if($filemode && ($filemode eq "text") && $has_textaware) {
-            # text mode when running on windows: fix line endings
-            s/\r\n/\n/g for @validstdout;
-            s/\n/\r\n/g for @validstdout;
+        my $filemode = $hash{'mode'};
+        if($filemode && ($filemode eq "text")) {
+            normalize_text(\@validstdout);
+            normalize_text(\@actual);
         }
 
         if($hash{'nonewline'}) {
@@ -1241,10 +1333,13 @@ sub singletest_check {
             chomp($validstdout[-1]);
         }
 
-        if($hash{'crlf'} ||
-           ($feature{"hyper"} && ($keywords{"HTTP"}
-                           || $keywords{"HTTPS"}))) {
-            subnewlines(0, \$_) for @validstdout;
+        if($hash{'crlf'}) {
+            if($hash{'crlf'} eq "headers") {
+                subnewlines(0, \$_) for @validstdout;
+            }
+            else {
+                subnewlines(1, \$_) for @validstdout;
+            }
         }
 
         $res = compare($runnerid, $testnum, $testname, "stdout", \@actual, \@validstdout);
@@ -1258,11 +1353,11 @@ sub singletest_check {
     }
 
     my @validstderr = getpart("verify", "stderr");
-    if (@validstderr) {
+    if(@validstderr) {
         # verify redirected stderr
         my @actual = loadarray(stderrfilename($logdir, $testnum));
 
-        foreach my $strip (@stripfile) {
+        foreach my $strip (@global_strip_stderr, @stripfile) {
             chomp $strip;
             my @newgen;
             for(@actual) {
@@ -1280,17 +1375,26 @@ sub singletest_check {
         my %hash = getpartattr("verify", "stderr");
 
         # get the mode attribute
-        my $filemode=$hash{'mode'};
-        if($filemode && ($filemode eq "text") && $feature{"hyper"}) {
-            # text mode check in hyper-mode. Sometimes necessary if the stderr
-            # data *looks* like HTTP and thus has gotten CRLF newlines
-            # mistakenly
-            s/\r\n/\n/g for @validstderr;
+        my $filemode = $hash{'mode'};
+        if($filemode && ($filemode eq "text")) {
+            normalize_text(\@validstderr);
+            normalize_text(\@actual);
         }
-        if($filemode && ($filemode eq "text") && $has_textaware) {
-            # text mode when running on windows: fix line endings
-            s/\r\n/\n/g for @validstderr;
-            s/\n/\r\n/g for @validstderr;
+        if($filemode && ($filemode eq "warn")) {
+            for(@validstderr) {
+                s/Warning: //;
+                s/\r//;
+                s/\n/ /;
+            }
+            for(@actual) {
+                s/Warning: //;
+                s/\r//;
+                s/\n/ /;
+            }
+            my $v = join(@validstderr, "");
+            my $a = join(@actual, "");
+            @validstderr = $v;
+            @actual = $a;
         }
 
         if($hash{'nonewline'}) {
@@ -1299,6 +1403,15 @@ sub singletest_check {
             chomp($validstderr[-1]);
         }
 
+        if($hash{'crlf'}) {
+            if($hash{'crlf'} eq "headers") {
+                subnewlines(0, \$_) for @validstderr;
+            }
+            else {
+                subnewlines(1, \$_) for @validstderr;
+            }
+        }
+
         $res = compare($runnerid, $testnum, $testname, "stderr", \@actual, \@validstderr);
         if($res) {
             return -1;
@@ -1321,7 +1434,7 @@ sub singletest_check {
         # Verify the sent request
         my @out = loadarray("$logdir/$SERVERIN");
 
-        # check if there's any attributes on the verify/protocol section
+        # check if there is any attributes on the verify/protocol section
         my %hash = getpartattr("verify", "protocol");
 
         if($hash{'nonewline'}) {
@@ -1345,7 +1458,12 @@ sub singletest_check {
         }
 
         if($hash{'crlf'}) {
-            subnewlines(1, \$_) for @protocol;
+            if($hash{'crlf'} eq "headers") {
+                subnewlines(0, \$_) for @protocol;
+            }
+            else {
+                subnewlines(1, \$_) for @protocol;
+            }
         }
 
         if((!$out[0] || ($out[0] eq "")) && $protocol[0]) {
@@ -1363,7 +1481,6 @@ sub singletest_check {
         }
 
         $ok .= "p";
-
     }
     else {
         $ok .= "-"; # protocol not checked
@@ -1371,27 +1488,28 @@ sub singletest_check {
 
     my %replyattr = getpartattr("reply", "data");
     my @reply;
-    if (partexists("reply", "datacheck")) {
+    if(partexists("reply", "datacheck")) {
         for my $partsuffix (('', '1', '2', '3', '4')) {
             my @replycheckpart = getpart("reply", "datacheck".$partsuffix);
             if(@replycheckpart) {
                 my %replycheckpartattr = getpartattr("reply", "datacheck".$partsuffix);
                 # get the mode attribute
-                my $filemode=$replycheckpartattr{'mode'};
-                if($filemode && ($filemode eq "text") && $has_textaware) {
-                    # text mode when running on windows: fix line endings
-                    s/\r\n/\n/g for @replycheckpart;
-                    s/\n/\r\n/g for @replycheckpart;
+                my $filemode = $replycheckpartattr{'mode'};
+                if($filemode && ($filemode eq "text")) {
+                    normalize_text(\@replycheckpart);
                 }
                 if($replycheckpartattr{'nonewline'}) {
                     # Yes, we must cut off the final newline from the final line
                     # of the datacheck
                     chomp($replycheckpart[-1]);
                 }
-                if($replycheckpartattr{'crlf'} ||
-                   ($feature{"hyper"} && ($keywords{"HTTP"}
-                                   || $keywords{"HTTPS"}))) {
-                    subnewlines(0, \$_) for @replycheckpart;
+                if($replycheckpartattr{'crlf'}) {
+                    if($replycheckpartattr{'crlf'} eq "headers") {
+                        subnewlines(0, \$_) for @replycheckpart;
+                    }
+                    else {
+                        subnewlines(1, \$_) for @replycheckpart;
+                    }
                 }
                 push(@reply, @replycheckpart);
             }
@@ -1407,24 +1525,31 @@ sub singletest_check {
             }
         }
         # get the mode attribute
-        my $filemode=$replyattr{'mode'};
-        if($filemode && ($filemode eq "text") && $has_textaware) {
-            # text mode when running on windows: fix line endings
-            s/\r\n/\n/g for @reply;
-            s/\n/\r\n/g for @reply;
+        my $filemode = $replyattr{'mode'};
+        if($filemode && ($filemode eq "text")) {
+            normalize_text(\@reply);
         }
-        if($replyattr{'crlf'} ||
-           ($feature{"hyper"} && ($keywords{"HTTP"}
-                           || $keywords{"HTTPS"}))) {
-            subnewlines(0, \$_) for @reply;
+        if($replyattr{'crlf'}) {
+            if($replyattr{'crlf'} eq "headers") {
+                subnewlines(0, \$_) for @reply;
+            }
+            else {
+                subnewlines(1, \$_) for @reply;
+            }
         }
     }
 
     if(!$replyattr{'nocheck'} && (@reply || $replyattr{'sendzero'})) {
         # verify the received data
         my @out = loadarray($CURLOUT);
+
+        # get the mode attribute
+        my $filemode = $replyattr{'mode'};
+        if($filemode && ($filemode eq "text")) {
+            normalize_text(\@out);
+        }
         $res = compare($runnerid, $testnum, $testname, "data", \@out, \@reply);
-        if ($res) {
+        if($res) {
             return -1;
         }
         $ok .= "d";
@@ -1441,6 +1566,11 @@ sub singletest_check {
             # cut off the final newline from the final line of the upload data
             chomp($upload[-1]);
         }
+        for my $line (@upload) {
+            subbase64(\$line);
+            subsha256base64file(\$line);
+            substrippemfile(\$line);
+        }
 
         # verify uploaded data
         my @out = loadarray("$logdir/upload.$testnum");
@@ -1450,9 +1580,17 @@ sub singletest_check {
                 eval $strip;
             }
         }
+        if($hash{'crlf'}) {
+            subnewlines(1, \$_) for @upload;
+        }
+        if($hash{'nonewline'}) {
+            # Yes, we must cut off the final newline from the final line
+            # of the upload data
+            chomp($upload[-1]);
+        }
 
         $res = compare($runnerid, $testnum, $testname, "upload", \@out, \@upload);
-        if ($res) {
+        if($res) {
             return -1;
         }
         $ok .= "u";
@@ -1465,7 +1603,7 @@ sub singletest_check {
     my @proxyprot = getpart("verify", "proxy");
     if(@proxyprot) {
         # Verify the sent proxy request
-        # check if there's any attributes on the verify/protocol section
+        # check if there is any attributes on the verify/protocol section
         my %hash = getpartattr("verify", "proxy");
 
         if($hash{'nonewline'}) {
@@ -1489,9 +1627,13 @@ sub singletest_check {
             }
         }
 
-        if($hash{'crlf'} ||
-           ($feature{"hyper"} && ($keywords{"HTTP"} || $keywords{"HTTPS"}))) {
-            subnewlines(0, \$_) for @proxyprot;
+        if($hash{'crlf'}) {
+            if($hash{'crlf'} eq "headers") {
+                subnewlines(0, \$_) for @proxyprot;
+            }
+            else {
+                subnewlines(1, \$_) for @proxyprot;
+            }
         }
 
         $res = compare($runnerid, $testnum, $testname, "proxy", \@out, \@proxyprot);
@@ -1500,28 +1642,27 @@ sub singletest_check {
         }
 
         $ok .= "P";
-
     }
     else {
-        $ok .= "-"; # protocol not checked
+        $ok .= "-"; # proxy not checked
     }
 
     my $outputok;
     for my $partsuffix (('', '1', '2', '3', '4')) {
-        my @outfile=getpart("verify", "file".$partsuffix);
+        my @outfile = getpart("verify", "file".$partsuffix);
         if(@outfile || partexists("verify", "file".$partsuffix) ) {
-            # we're supposed to verify a dynamically generated file!
+            # we are supposed to verify a dynamically generated file!
             my %hash = getpartattr("verify", "file".$partsuffix);
 
-            my $filename=$hash{'name'};
+            my $filename = $hash{'name'};
             if(!$filename) {
                 logmsg " $testnum: IGNORED: section verify=>file$partsuffix ".
                        "has no name attribute\n";
-                if (runnerac_stopservers($runnerid)) {
+                if(runnerac_stopservers($runnerid)) {
                     logmsg "ERROR: runner $runnerid seems to have died\n";
                 } else {
 
-                    # TODO: this is a blocking call that will stall the controller,
+                    # TODO: this is a blocking call that stalls the controller,
                     if($verbose) {
                         logmsg "WARNING: blocking call in async function\n";
                     }
@@ -1538,24 +1679,26 @@ sub singletest_check {
                 $timevrfyend{$testnum} = Time::HiRes::time();
                 return -1;
             }
-            my @generated=loadarray($filename);
+            my @generated = loadarray($filename);
 
             # what parts to cut off from the file
             my @stripfilepar = getpart("verify", "stripfile".$partsuffix);
 
-            my $filemode=$hash{'mode'};
-            if($filemode && ($filemode eq "text") && $has_textaware) {
-                # text mode when running on windows: fix line endings
-                s/\r\n/\n/g for @outfile;
-                s/\n/\r\n/g for @outfile;
+            my $filemode = $hash{'mode'};
+            if($filemode && ($filemode eq "text")) {
+                normalize_text(\@outfile);
+                normalize_text(\@generated);
             }
-            if($hash{'crlf'} ||
-               ($feature{"hyper"} && ($keywords{"HTTP"}
-                               || $keywords{"HTTPS"}))) {
-                subnewlines(0, \$_) for @outfile;
+            if($hash{'crlf'}) {
+                if($hash{'crlf'} eq "headers") {
+                    subnewlines(0, \$_) for @outfile;
+                }
+                else {
+                    subnewlines(1, \$_) for @outfile;
+                }
             }
 
-            for my $strip (@stripfilepar) {
+            for my $strip (@global_strip_file, @stripfilepar) {
                 chomp $strip;
                 my @newgen;
                 for(@generated) {
@@ -1597,6 +1740,28 @@ sub singletest_check {
         }
     }
 
+    my @dnsd = getpart("verify", "dns");
+    if(@dnsd) {
+        # we are supposed to verify a dynamically generated file!
+        my %hash = getpartattr("verify", "dns");
+        my $hostname = $hash{'host'};
+
+        # Verify the sent DNS requests
+        my @out = loadarray("$logdir/dnsd.input");
+        my @sverify = sort @dnsd;
+        my @sout = sort @out;
+
+        if($hostname) {
+            # when a hostname is set, we filter out requests to this pattern
+            @sout = grep {/$hostname/} @sout;
+        }
+
+        $res = compare($runnerid, $testnum, $testname, "DNS", \@sout, \@sverify);
+        if($res) {
+            return -1;
+        }
+    }
+
     # accept multiple comma-separated error codes
     my @splerr = split(/ *, */, $errorcode);
     my $errok;
@@ -1614,7 +1779,7 @@ sub singletest_check {
     else {
         if(!$short) {
             logmsg sprintf("\n%s returned $cmdres, when expecting %s\n",
-                           (!$tool)?"curl":$tool, $errorcode);
+                           (!$tool) ? "curl" : $tool, $errorcode);
         }
         logmsg " $testnum: exit FAILED\n";
         # timestamp test result verification end
@@ -1626,23 +1791,26 @@ sub singletest_check {
         if(! -f "$logdir/$MEMDUMP") {
             my %cmdhash = getpartattr("client", "command");
             my $cmdtype = $cmdhash{'type'} || "default";
-            logmsg "\n** ALERT! memory tracking with no output file?\n"
-                if(!$cmdtype eq "perl");
+            if($cmdhash{'option'} && $cmdhash{'option'} !~ /no-memdebug/) {
+                logmsg "\n** ALERT! memory tracking with no output file?\n"
+                    if($cmdtype ne "perl");
+            }
             $ok .= "-"; # problem with memory checking
         }
         else {
-            my @memdata=`$memanalyze "$logdir/$MEMDUMP"`;
-            my $leak=0;
+            my @memdata = memanalyze("$logdir/$MEMDUMP", 0, 0, 0);
+            my $leak = 0;
             for(@memdata) {
                 if($_ ne "") {
                     # well it could be other memory problems as well, but
                     # we call it leak for short here
-                    $leak=1;
+                    $leak = 1;
                 }
             }
             if($leak) {
                 logmsg "\n** MEMORY FAILURE\n";
                 logmsg @memdata;
+                logmsg " $testnum: memory FAILED\n";
                 # timestamp test result verification end
                 $timevrfyend{$testnum} = Time::HiRes::time();
                 return -1;
@@ -1650,15 +1818,78 @@ sub singletest_check {
             else {
                 $ok .= "m";
             }
+            my @more = memanalyze("$logdir/$MEMDUMP", 1, 0, 0);
+            my $allocs = 0;
+            my $max = 0;
+            for(@more) {
+                if(/^Allocations: (\d+)/) {
+                    $allocs = $1;
+                }
+                elsif(/^Maximum allocated: (\d+)/) {
+                    $max = $1;
+                }
+            }
+            my @limits = getpart("verify", "limits");
+            my $lim_allocs = 1000; # high default values
+            my $lim_max = 1000000;
+            for(@limits) {
+                if(/^Allocations: (\d+)/i) {
+                    $lim_allocs = $1;
+                }
+                elsif(/^Maximum allocated: (\d+)/i) {
+                    $lim_max = $1;
+                }
+            }
+            logmsg "did $allocs allocations, $lim_allocs allowed\n"
+                if($verbose);
+
+            logmsg "allocated $max maximum, $lim_max allowed\n"
+                if($verbose);
+
+            if($allocs > $lim_allocs) {
+                logmsg "\n** TOO MANY ALLOCS\n";
+                logmsg "$lim_allocs allocations allowed, did $allocs\n";
+                logmsg " $testnum: allocs FAILED\n";
+                # timestamp test result verification end
+                $timevrfyend{$testnum} = Time::HiRes::time();
+                return -1;
+            }
+            if($max > $lim_max) {
+                logmsg "\n** TOO MUCH TOTAL ALLOCATION\n";
+                logmsg "$lim_max maximum allocation allowed, did $max\n";
+                logmsg " $testnum: allocsize FAILED\n";
+                # timestamp test result verification end
+                $timevrfyend{$testnum} = Time::HiRes::time();
+                return -1;
+            }
         }
     }
     else {
         $ok .= "-"; # memory not checked
     }
 
+    my @notexists = getpart("verify", "notexists");
+    if(@notexists) {
+        # a list of directory entries that must not exist
+        my $err;
+        while(@notexists) {
+            my $fname = shift @notexists;
+            chomp $fname;
+            if(-e $fname) {
+                logmsg "ERROR: Found '$fname' when not supposed to exist.\n";
+                $err++;
+            }
+            elsif($verbose) {
+                logmsg "Found '$fname' confirmed to not exist.\n";
+            }
+        }
+        if($err) {
+            return -1;
+        }
+    }
     if($valgrind) {
         if($usedvalgrind) {
-            if(!opendir(DIR, "$logdir")) {
+            if(!opendir(DIR, $logdir)) {
                 logmsg "ERROR: unable to read $logdir\n";
                 # timestamp test result verification end
                 $timevrfyend{$testnum} = Time::HiRes::time();
@@ -1715,21 +1946,20 @@ sub singletest_check {
     return 0;
 }
 
-
 #######################################################################
 # Report a successful test
 sub singletest_success {
-    my ($testnum, $count, $total, $errorreturncode)=@_;
+    my ($testnum, $count, $total, $errorreturncode) = @_;
 
     my $sofar= time()-$start;
     my $esttotal = $sofar/$count * $total;
     my $estleft = $esttotal - $sofar;
-    my $timeleft=sprintf("remaining: %02d:%02d",
-                     $estleft/60,
-                     $estleft%60);
+    my $timeleft = sprintf("remaining: %02d:%02d",
+                     $estleft / 60,
+                     $estleft % 60);
     my $took = $timevrfyend{$testnum} - $timeprepini{$testnum};
     my $duration = sprintf("duration: %02d:%02d",
-                           $sofar/60, $sofar%60);
+                           $sofar / 60, $sofar % 60);
     if(!$automakestyle) {
         logmsg sprintf("OK (%-3d out of %-3d, %s, took %.3fs, %s)\n",
                        $count, $total, $timeleft, $took, $duration);
@@ -1740,7 +1970,9 @@ sub singletest_success {
         logmsg "PASS: $testnum - $testname\n";
     }
 
-    if($errorreturncode==2) {
+    if($errorreturncode == 2) {
+        # ignored test success
+        $passedign .= "$testnum ";
         logmsg "Warning: test$testnum result is ignored, but passed!\n";
     }
 }
@@ -1754,7 +1986,7 @@ sub singletest_success {
 # arrived.
 #
 sub singletest {
-    my ($runnerid, $testnum, $count, $total)=@_;
+    my ($runnerid, $testnum, $count, $total) = @_;
 
     # start buffering logmsg; stop it on return
     logmsg_bufferfortest($runnerid);
@@ -1766,33 +1998,13 @@ sub singletest {
     if($singletest_state{$runnerid} == ST_INIT) {
         my $logdir = getrunnerlogdir($runnerid);
         # first, remove all lingering log & lock files
-        if((!cleardir($logdir) || !cleardir("$logdir/$LOCKDIR"))
-            && $clearlocks) {
-            # On Windows, lock files can't be deleted when the process still
-            # has them open, so kill those processes first
-            if(runnerac_clearlocks($runnerid, "$logdir/$LOCKDIR")) {
-                logmsg "ERROR: runner $runnerid seems to have died\n";
-                $singletest_state{$runnerid} = ST_INIT;
-                return (-1, 0);
-            }
-            $singletest_state{$runnerid} = ST_CLEARLOCKS;
-        } else {
-            $singletest_state{$runnerid} = ST_INITED;
-            # Recursively call the state machine again because there is no
-            # event expected that would otherwise trigger a new call.
-            return singletest(@_);
+        if(!cleardir($logdir)) {
+            #logmsg "Warning: $runnerid: cleardir($logdir) failed\n";
+        }
+        if(!cleardir("$logdir/$LOCKDIR")) {
+            logmsg "Warning: $runnerid: cleardir($logdir/$LOCKDIR) failed\n";
         }
 
-    } elsif($singletest_state{$runnerid} == ST_CLEARLOCKS) {
-        my ($rid, $logs) = runnerar($runnerid);
-        if(!$rid) {
-            logmsg "ERROR: runner $runnerid seems to have died\n";
-            $singletest_state{$runnerid} = ST_INIT;
-            return (-1, 0);
-        }
-        logmsg $logs;
-        my $logdir = getrunnerlogdir($runnerid);
-        cleardir($logdir);
         $singletest_state{$runnerid} = ST_INITED;
         # Recursively call the state machine again because there is no
         # event expected that would otherwise trigger a new call.
@@ -1802,14 +2014,14 @@ sub singletest {
         ###################################################################
         # Restore environment variables that were modified in a previous run.
         # Test definition may instruct to (un)set environment vars.
-        # This is done this early so that leftover variables don't affect
+        # This is done this early so that leftover variables do not affect
         # starting servers or CI registration.
         # restore_test_env(1);
 
         ###################################################################
         # Load test file so CI registration can get the right data before the
         # runner is called
-        loadtest("${TESTDIR}/test${testnum}");
+        loadtest("${TESTDIR}/test${testnum}", 1);
 
         ###################################################################
         # Register the test case with the CI environment
@@ -1878,7 +2090,7 @@ sub singletest {
         logmsg $logs;
         updatetesttimings($testnum, %$testtimings);
         if($error == -1) {
-            # no further verification will occur
+            # no further verification occurs
             $timevrfyend{$testnum} = Time::HiRes::time();
             my $err = ignoreresultcode($testnum);
             # Submit the test case result with the CI environment
@@ -1898,7 +2110,7 @@ sub singletest {
             return ($error, 0);
         }
         elsif($error > 0) {
-            # no further verification will occur
+            # no further verification occurs
             $timevrfyend{$testnum} = Time::HiRes::time();
             # Submit the test case result with the CI environment
             citest_finishtest($testnum, $error);
@@ -1935,7 +2147,6 @@ sub singletest {
             return ($cmdres, 0);
         }
 
-
         #######################################################################
         # Report a successful test
         singletest_success($testnum, $count, $total, ignoreresultcode($testnum));
@@ -1959,6 +2170,8 @@ sub runtimestats {
 
     return if(not $timestats);
 
+    logmsg "::group::Run Time Stats\n";
+
     logmsg "\nTest suite total running time breakdown per task...\n\n";
 
     my @timesrvr;
@@ -2026,7 +2239,7 @@ sub runtimestats {
 
     $counter = 25;
     logmsg "\nTest server starting and verification time per test ".
-        sprintf("(%s)...\n\n", (not $fullstats)?"top $counter":"full");
+        sprintf("(%s)...\n\n", (not $fullstats) ? "top $counter" : "full");
     logmsg "-time-  test\n";
     logmsg "------  ----\n";
     foreach my $txt (@timesrvr) {
@@ -2036,7 +2249,7 @@ sub runtimestats {
 
     $counter = 10;
     logmsg "\nTest definition reading and preparation time per test ".
-        sprintf("(%s)...\n\n", (not $fullstats)?"top $counter":"full");
+        sprintf("(%s)...\n\n", (not $fullstats) ? "top $counter" : "full");
     logmsg "-time-  test\n";
     logmsg "------  ----\n";
     foreach my $txt (@timeprep) {
@@ -2046,7 +2259,7 @@ sub runtimestats {
 
     $counter = 25;
     logmsg "\nTest tool execution time per test ".
-        sprintf("(%s)...\n\n", (not $fullstats)?"top $counter":"full");
+        sprintf("(%s)...\n\n", (not $fullstats) ? "top $counter" : "full");
     logmsg "-time-  test\n";
     logmsg "------  ----\n";
     foreach my $txt (@timetool) {
@@ -2056,7 +2269,7 @@ sub runtimestats {
 
     $counter = 15;
     logmsg "\nTest server logs lock removal time per test ".
-        sprintf("(%s)...\n\n", (not $fullstats)?"top $counter":"full");
+        sprintf("(%s)...\n\n", (not $fullstats) ? "top $counter" : "full");
     logmsg "-time-  test\n";
     logmsg "------  ----\n";
     foreach my $txt (@timelock) {
@@ -2066,7 +2279,7 @@ sub runtimestats {
 
     $counter = 10;
     logmsg "\nTest results verification time per test ".
-        sprintf("(%s)...\n\n", (not $fullstats)?"top $counter":"full");
+        sprintf("(%s)...\n\n", (not $fullstats) ? "top $counter" : "full");
     logmsg "-time-  test\n";
     logmsg "------  ----\n";
     foreach my $txt (@timevrfy) {
@@ -2076,7 +2289,7 @@ sub runtimestats {
 
     $counter = 50;
     logmsg "\nTotal time per test ".
-        sprintf("(%s)...\n\n", (not $fullstats)?"top $counter":"full");
+        sprintf("(%s)...\n\n", (not $fullstats) ? "top $counter" : "full");
     logmsg "-time-  test\n";
     logmsg "------  ----\n";
     foreach my $txt (@timetest) {
@@ -2085,6 +2298,8 @@ sub runtimestats {
     }
 
     logmsg "\n";
+
+    logmsg "::endgroup::\n";
 }
 
 #######################################################################
@@ -2092,7 +2307,7 @@ sub runtimestats {
 # 0=unknown test, 1=use test result, 2=ignore test result
 #
 sub ignoreresultcode {
-    my ($testnum)=@_;
+    my ($testnum) = @_;
     if(defined $ignoretestcodes{$testnum}) {
         return $ignoretestcodes{$testnum};
     }
@@ -2103,7 +2318,7 @@ sub ignoreresultcode {
 # Put the given runner ID onto the queue of runners ready for a new task
 #
 sub runnerready {
-    my ($runnerid)=@_;
+    my ($runnerid) = @_;
     push @runnersidle, $runnerid;
 }
 
@@ -2111,7 +2326,7 @@ sub runnerready {
 # Create test runners
 #
 sub createrunners {
-    my ($numrunners)=@_;
+    my ($numrunners) = @_;
     if(! $numrunners) {
         $numrunners++;
     }
@@ -2129,8 +2344,8 @@ sub createrunners {
 # Pick a test runner for the given test
 #
 sub pickrunner {
-    my ($testnum)=@_;
-    scalar(@runnersidle) || die "No runners available";
+    my ($testnum) = @_;
+    scalar(@runnersidle) or die "No runners available";
 
     return pop @runnersidle;
 }
@@ -2146,54 +2361,60 @@ if(@ARGV && $ARGV[-1] eq '$TFLAGS') {
     push(@ARGV, split(' ', $ENV{'TFLAGS'})) if defined($ENV{'TFLAGS'});
 }
 
+$args = join(' ', @ARGV);
+
 $valgrind = checktestcmd("valgrind");
-my $number=0;
-my $fromnum=-1;
+my $number = 0;
+my $fromnum = -1;
 my @testthis;
 while(@ARGV) {
-    if ($ARGV[0] eq "-v") {
+    if($ARGV[0] eq "-v") {
         # verbose output
-        $verbose=1;
+        $verbose = 1;
     }
-    elsif ($ARGV[0] eq "-c") {
+    elsif($ARGV[0] eq "-c") {
         # use this path to curl instead of default
-        $DBGCURL=$CURL=$ARGV[1];
+        $DBGCURL = $CURL = $ARGV[1];
         shift @ARGV;
     }
-    elsif ($ARGV[0] eq "-vc") {
+    elsif($ARGV[0] eq "-vc") {
         # use this path to a curl used to verify servers
 
         # Particularly useful when you introduce a crashing bug somewhere in
-        # the development version as then it won't be able to run any tests
-        # since it can't verify the servers!
+        # the development version as then it is not able to run any tests
+        # since it cannot verify the servers!
 
-        $VCURL=shell_quote($ARGV[1]);
+        $VCURL = shell_quote($ARGV[1]);
         shift @ARGV;
     }
-    elsif ($ARGV[0] eq "-ac") {
+    elsif($ARGV[0] eq "-ac") {
         # use this curl only to talk to APIs (currently only CI test APIs)
-        $ACURL=shell_quote($ARGV[1]);
+        $ACURL = shell_quote($ARGV[1]);
         shift @ARGV;
     }
-    elsif ($ARGV[0] eq "-d") {
+    elsif($ARGV[0] eq "-d") {
         # have the servers display protocol output
-        $debugprotocol=1;
+        $debugprotocol = 1;
     }
-    elsif($ARGV[0] eq "-e") {
+    elsif(($ARGV[0] eq "-e") || ($ARGV[0] eq "--test-event")) {
         # run the tests cases event based if possible
-        $run_event_based=1;
+        $run_event_based = 1;
+    }
+    elsif($ARGV[0] eq "--test-duphandle") {
+        # run the tests with --test-duphandle
+        $run_duphandle = 1;
     }
     elsif($ARGV[0] eq "-f") {
         # force - run the test case even if listed in DISABLED
-        $run_disabled=1;
+        $run_disabled = 1;
     }
     elsif($ARGV[0] eq "-E") {
         # load additional reasons to skip tests
         shift @ARGV;
         my $exclude_file = $ARGV[0];
-        open(my $fd, "<", $exclude_file) or die "Couldn't open '$exclude_file': $!";
+        open(my $fd, "<", $exclude_file) or die "Could not open '$exclude_file': $!";
         while(my $line = <$fd>) {
-            next if ($line =~ /^#/);
+            next if($line =~ /^#/);
             chomp $line;
             my ($type, $patterns, $skip_reason) = split(/\s*:\s*/, $line, 3);
 
@@ -2209,23 +2430,35 @@ while(@ARGV) {
         }
         close($fd);
     }
-    elsif ($ARGV[0] eq "-g") {
+    elsif($ARGV[0] eq "-g") {
         # run this test with gdb
-        $gdbthis=1;
+        $gdbthis = 1;
     }
-    elsif ($ARGV[0] eq "-gw") {
+    elsif($ARGV[0] eq "-gl") {
+        # run this test with lldb
+        $gdbthis = 2;
+    }
+    elsif($ARGV[0] eq "-gw") {
         # run this test with windowed gdb
-        $gdbthis=1;
-        $gdbxwin=1;
+        $gdbthis = 1;
+        $gdbxwin = 1;
     }
     elsif($ARGV[0] eq "-s") {
         # short output
-        $short=1;
+        $short = 1;
     }
     elsif($ARGV[0] eq "-am") {
         # automake-style output
-        $short=1;
-        $automakestyle=1;
+        $short = 1;
+        $automakestyle = 1;
+    }
+    elsif($ARGV[0] =~ /-m=(\d+)/) {
+        my ($num) = ($1);
+        $maxtime = $num;
+    }
+    elsif($ARGV[0] =~ /--min=(\d+)/) {
+        my ($num) = ($1);
+        $mintotal = $num;
     }
     elsif($ARGV[0] eq "-n") {
         # no valgrind
@@ -2235,13 +2468,13 @@ while(@ARGV) {
         # disable the valgrind debuginfod functionality
         $no_debuginfod = 1;
     }
-    elsif ($ARGV[0] eq "-R") {
+    elsif($ARGV[0] eq "-R") {
         # execute in scrambled order
-        $scrambleorder=1;
+        $scrambleorder = 1;
     }
     elsif($ARGV[0] =~ /^-t(.*)/) {
         # torture
-        $torture=1;
+        $torture = 1;
         my $xtra = $1;
 
         if($xtra =~ s/(\d+)$//) {
@@ -2251,24 +2484,28 @@ while(@ARGV) {
     elsif($ARGV[0] =~ /--shallow=(\d+)/) {
         # Fail no more than this amount per tests when running
         # torture.
-        my ($num)=($1);
-        $shallow=$num;
+        my ($num) = ($1);
+        $shallow = $num;
     }
     elsif($ARGV[0] =~ /--repeat=(\d+)/) {
         # Repeat-run the given tests this many times
         $repeat = $1;
     }
+    elsif($ARGV[0] =~ /--retry=(\d+)/) {
+        # Number of attempts for the whole test run to retry failed tests
+        $retry = $1;
+    }
     elsif($ARGV[0] =~ /--seed=(\d+)/) {
         # Set a fixed random seed (used for -R and --shallow)
         $randseed = $1;
     }
     elsif($ARGV[0] eq "-a") {
         # continue anyway, even if a test fail
-        $anyway=1;
+        $anyway = 1;
     }
     elsif($ARGV[0] eq "-o") {
         shift @ARGV;
-        if ($ARGV[0] =~ /^(\w+)=([\w.:\/\[\]-]+)$/) {
+        if($ARGV[0] =~ /^(\w+)=([\w.:\/\[\]-]+)$/) {
             my ($variable, $value) = ($1, $2);
             eval "\$$variable='$value'" or die "Failed to set \$$variable to $value: $@";
         } else {
@@ -2276,11 +2513,11 @@ while(@ARGV) {
         }
     }
     elsif($ARGV[0] eq "-p") {
-        $postmortem=1;
+        $postmortem = 1;
     }
     elsif($ARGV[0] eq "-P") {
         shift @ARGV;
-        $proxy_address=$ARGV[0];
+        $proxy_address = $ARGV[0];
     }
     elsif($ARGV[0] eq "-L") {
         # require additional library file
@@ -2289,20 +2526,19 @@ while(@ARGV) {
     }
     elsif($ARGV[0] eq "-l") {
         # lists the test case names only
-        $listonly=1;
+        $listonly = 1;
+    }
+    elsif($ARGV[0] eq "--buildinfo") {
+        $buildinfo = 1;
     }
     elsif($ARGV[0] =~ /^-j(.*)/) {
         # parallel jobs
-        $jobs=1;
+        $jobs = 1;
         my $xtra = $1;
         if($xtra =~ s/(\d+)$//) {
             $jobs = $1;
         }
     }
-    elsif($ARGV[0] eq "-k") {
-        # keep stdout and stderr files after tests
-        $keepoutfiles=1;
-    }
     elsif($ARGV[0] eq "-r") {
         # run time statistics needs Time::HiRes
         if($Time::HiRes::VERSION) {
@@ -2314,8 +2550,8 @@ while(@ARGV) {
             keys(%timetoolend) = 2000;
             keys(%timesrvrlog) = 2000;
             keys(%timevrfyend) = 2000;
-            $timestats=1;
-            $fullstats=0;
+            $timestats = 1;
+            $fullstats = 0;
         }
     }
     elsif($ARGV[0] eq "-rf") {
@@ -2329,17 +2565,13 @@ while(@ARGV) {
             keys(%timetoolend) = 2000;
             keys(%timesrvrlog) = 2000;
             keys(%timevrfyend) = 2000;
-            $timestats=1;
-            $fullstats=1;
+            $timestats = 1;
+            $fullstats = 1;
         }
     }
-    elsif($ARGV[0] eq "-rm") {
-        # force removal of files by killing locking processes
-        $clearlocks=1;
-    }
     elsif($ARGV[0] eq "-u") {
         # error instead of warning on server unexpectedly alive
-        $err_unexpected=1;
+        $err_unexpected = 1;
     }
     elsif(($ARGV[0] eq "-h") || ($ARGV[0] eq "--help")) {
         # show help text
@@ -2348,18 +2580,21 @@ Usage: runtests.pl [options] [test selection(s)]
   -a       continue even if a test fails
   -ac path use this curl only to talk to APIs (currently only CI test APIs)
   -am      automake style output PASS/FAIL: [number] [name]
+  --buildinfo dump buildinfo.txt
   -c path  use this curl executable
   -d       display server debug info
-  -e       event-based execution
+  -e, --test-event  event-based execution
+  --test-duphandle  duplicate handles before use
   -E file  load the specified file to exclude certain tests
   -f       forcibly run even if disabled
   -g       run the test case with gdb
   -gw      run the test case with gdb as a windowed application
   -h       this help text
   -j[N]    spawn this number of processes to run tests (default 0)
-  -k       keep stdout and stderr files present after tests
   -L path  require an additional perl library file to replace certain functions
   -l       list all test case names/descriptions
+  -m=[seconds] set timeout for curl commands in tests
+  --min=[count] minimum number of tests to run.
   -n       no valgrind
   --no-debuginfod disable the valgrind debuginfod functionality
   -o variable=value set internal variable to the specified value
@@ -2368,8 +2603,8 @@ Usage: runtests.pl [options] [test selection(s)]
   -R       scrambled order (uses the random seed, see --seed)
   -r       run time statistics
   -rf      full run time statistics
-  -rm      force removal of files by killing locking processes (Windows only)
   --repeat=[num] run the given tests this many times
+  --retry=[num] number of attempts for the whole test run to retry failed tests
   -s       short output
   --seed=[num] set the random seed to a fixed number
   --shallow=[num] randomly makes the torture tests "thinner"
@@ -2400,24 +2635,24 @@ EOHELP
         }
     }
     elsif($ARGV[0] =~ /^to$/i) {
-        $fromnum = $number+1;
+        $fromnum = $number + 1;
     }
     elsif($ARGV[0] =~ /^!(\d+)/) {
         $fromnum = -1;
-        $disabled{$1}=$1;
+        $disabled{$1} = $1;
     }
     elsif($ARGV[0] =~ /^~(\d+)/) {
         $fromnum = -1;
-        $ignored{$1}=$1;
+        $ignored{$1} = $1;
     }
     elsif($ARGV[0] =~ /^!(.+)/) {
-        $disabled_keywords{lc($1)}=$1;
+        $disabled_keywords{lc($1)} = $1;
     }
     elsif($ARGV[0] =~ /^~(.+)/) {
-        $ignored_keywords{lc($1)}=$1;
+        $ignored_keywords{lc($1)} = $1;
     }
     elsif($ARGV[0] =~ /^([-[{a-zA-Z].*)/) {
-        $enabled_keywords{lc($1)}=$1;
+        $enabled_keywords{lc($1)} = $1;
     }
     else {
         print "Unknown option: $ARGV[0]\n";
@@ -2429,29 +2664,29 @@ EOHELP
 delete $ENV{'DEBUGINFOD_URLS'} if($ENV{'DEBUGINFOD_URLS'} && $no_debuginfod);
 
 if(!$randseed) {
-    my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) =
-        localtime(time);
+    my ($sec, $min, $hour, $mday, $mon, $year, $wday, $yday, $isdst) = localtime(time);
     # seed of the month. December 2019 becomes 201912
-    $randseed = ($year+1900)*100 + $mon+1;
-    open(my $curlvh, "-|", shell_quote($CURL) . " --version 2>/dev/null") ||
+    $randseed = ($year + 1900) * 100 + $mon + 1;
+    print "Using curl: $CURL\n";
+    open(my $curlvh, "-|", exerunner() . shell_quote($CURL) . " --version 2>$dev_null") or
         die "could not get curl version!";
     my @c = <$curlvh>;
-    close($curlvh) || die "could not get curl version!";
+    close($curlvh) or die "could not get curl version!";
     # use the first line of output and get the md5 out of it
     my $str = md5($c[0]);
-    $randseed += unpack('S', $str);  # unsigned 16 bit value
+    $randseed += unpack('S', $str);  # unsigned 16-bit value
 }
 srand $randseed;
 
 if(@testthis && ($testthis[0] ne "")) {
-    $TESTCASES=join(" ", @testthis);
+    $TESTCASES = join(" ", @testthis);
 }
 
 if($valgrind) {
     # we have found valgrind on the host, use it
 
     # verify that we can invoke it fine
-    my $code = runclient("valgrind >/dev/null 2>&1");
+    my $code = runclient("valgrind >$dev_null 2>&1");
 
     if(($code>>8) != 1) {
         #logmsg "Valgrind failure, disable it\n";
@@ -2460,39 +2695,39 @@ if($valgrind) {
 
         # since valgrind 2.1.x, '--tool' option is mandatory
         # use it, if it is supported by the version installed on the system
-        # (this happened in 2003, so we could probably don't need to care about
-        # that old version any longer and just delete this check)
-        runclient("valgrind --help 2>&1 | grep -- --tool > /dev/null 2>&1");
-        if (($? >> 8)) {
-            $valgrind_tool="";
+        # (this happened in 2003, so we could probably do not need to care about
+        # that old version any longer and delete this check)
+        runclient("valgrind --help 2>&1 | grep -- --tool >$dev_null 2>&1");
+        if(($? >> 8)) {
+            $valgrind_tool = "";
         }
-        open(my $curlh, "<", "$CURL");
+        open(my $curlh, "<", $CURL);
         my $l = <$curlh>;
         if($l =~ /^\#\!/) {
             # A shell script. This is typically when built with libtool,
-            $valgrind="../libtool --mode=execute $valgrind";
+            $valgrind = "../libtool --mode=execute $valgrind";
         }
         close($curlh);
 
         # valgrind 3 renamed the --logfile option to --log-file!!!
-        # (this happened in 2005, so we could probably don't need to care about
-        # that old version any longer and just delete this check)
-        my $ver=join(' ', runclientoutput("valgrind --version"));
+        # (this happened in 2005, so we could probably do not need to care about
+        # that old version any longer and delete this check)
+        my $ver = join(' ', runclientoutput("valgrind --version"));
         # cut off all but digits and dots
         $ver =~ s/[^0-9.]//g;
 
         if($ver =~ /^(\d+)/) {
             $ver = $1;
             if($ver < 3) {
-                $valgrind_logfile="--logfile";
+                $valgrind_logfile = "--logfile";
             }
         }
     }
 }
 
-if ($gdbthis) {
+if($gdbthis) {
     # open the executable curl and read the first 4 bytes of it
-    open(my $check, "<", "$CURL");
+    open(my $check, "<", $CURL);
     my $c;
     sysread $check, $c, 4;
     close($check);
@@ -2507,7 +2742,7 @@ if ($gdbthis) {
 # clear and create logging directory:
 #
 
-# TODO: figure how to get around this. This dir is needed for checksystemfeatures()
+# TODO: figure how to get around this. This directory is needed for checksystemfeatures()
 # Maybe create & use & delete a temporary directory in that function
 cleardir($LOGDIR);
 mkdir($LOGDIR, 0777);
@@ -2523,6 +2758,10 @@ if(!$jobs) {
     setlogfunc(\&logmsg);
 }
 
+if(!$mintotal && $ENV{"CURL_TEST_MIN"}) {
+    $mintotal = $ENV{"CURL_TEST_MIN"};
+}
+
 #######################################################################
 # Output curl version and host info being tested
 #
@@ -2531,6 +2770,21 @@ if(!$listonly) {
     checksystemfeatures();
 }
 
+#######################################################################
+# Output information about the curl build
+#
+if(!$listonly && $buildinfo) {
+    if(open(my $fd, "<", "../buildinfo.txt")) {
+        while(my $line = <$fd>) {
+            chomp $line;
+            if($line && $line !~ /^#/) {
+                logmsg("* $line\n");
+            }
+        }
+        close($fd);
+    }
+}
+
 #######################################################################
 # initialize configuration needed to set up servers
 # TODO: rearrange things so this can be called only in runner_init()
@@ -2548,12 +2802,11 @@ if(!$listonly) {
 #######################################################################
 # Fetch all disabled tests, if there are any
 #
-
 sub disabledtests {
     my ($file) = @_;
     my @input;
 
-    if(open(my $disabledh, "<", "$file")) {
+    if(open(my $disabledh, "<", $file)) {
         while(<$disabledh>) {
             if(/^ *\#/) {
                 # allow comments
@@ -2569,13 +2822,13 @@ sub disabledtests {
         for my $t (@pp) {
             if($t =~ /(\d+)/) {
                 my ($n) = $1;
-                $disabled{$n}=$n; # disable this test number
+                $disabled{$n} = $n; # disable this test number
                 if(! -f "$srcdir/data/test$n") {
                     print STDERR "WARNING! Non-existing test $n in $file!\n";
                     # fail hard to make user notice
                     exit 1;
                 }
-                logmsg "DISABLED: test $n\n" if ($verbose);
+                logmsg "DISABLED: test $n\n" if($verbose);
             }
             else {
                 print STDERR "$file: rubbish content: $t\n";
@@ -2583,19 +2836,23 @@ sub disabledtests {
             }
         }
     }
+    else {
+        print STDERR "Cannot open $file, exiting\n";
+        exit 3;
+    }
 }
 
 #######################################################################
 # If 'all' tests are requested, find out all test numbers
 #
 
-if ( $TESTCASES eq "all") {
+if($TESTCASES eq "all") {
     # Get all commands and find out their test numbers
-    opendir(DIR, $TESTDIR) || die "can't opendir $TESTDIR: $!";
+    opendir(DIR, $TESTDIR) or die "cannot opendir $TESTDIR: $!";
     my @cmds = grep { /^test([0-9]+)$/ && -f "$TESTDIR/$_" } readdir(DIR);
     closedir(DIR);
 
-    $TESTCASES=""; # start with no test cases
+    $TESTCASES = ""; # start with no test cases
 
     # cut off everything but the digits
     for(@cmds) {
@@ -2607,17 +2864,17 @@ if ( $TESTCASES eq "all") {
             # skip disabled test cases
             my $why = "configured as DISABLED";
             $skipped{$why}++;
-            $teststat[$n]=$why; # store reason for this test case
+            $teststat[$n] = $why; # store reason for this test case
             next;
         }
         $TESTCASES .= " $n";
     }
 }
 else {
-    my $verified="";
+    my $verified = "";
     for(split(" ", $TESTCASES)) {
-        if (-e "$TESTDIR/test$_") {
-            $verified.="$_ ";
+        if(-e "$TESTDIR/test$_") {
+            $verified .= "$_ ";
         }
     }
     if($verified eq "") {
@@ -2645,7 +2902,7 @@ if($scrambleorder) {
         }
         my $r = rand @all;
         push @rand, $all[$r];
-        $all[$r]="";
+        $all[$r] = "";
         $TESTCASES = join(" ", @all);
     }
     $TESTCASES = join(" ", @rand);
@@ -2654,8 +2911,8 @@ if($scrambleorder) {
 # Display the contents of the given file.  Line endings are canonicalized
 # and excessively long files are elided
 sub displaylogcontent {
-    my ($file)=@_;
-    if(open(my $single, "<", "$file")) {
+    my ($file) = @_;
+    if(open(my $single, "<", $file)) {
         my $linecount = 0;
         my $truncate;
         my @tail;
@@ -2666,7 +2923,7 @@ sub displaylogcontent {
             $string =~ tr/\n//;
             for my $line (split(m/\n/, $string)) {
                 $line =~ s/\s*\!$//;
-                if ($truncate) {
+                if($truncate) {
                     push @tail, " $line\n";
                 } else {
                     logmsg " $line\n";
@@ -2692,14 +2949,13 @@ sub displaylogcontent {
 }
 
 sub displaylogs {
-    my ($runnerid, $testnum)=@_;
+    my ($runnerid, $testnum) = @_;
     my $logdir = getrunnerlogdir($runnerid);
-    opendir(DIR, "$logdir") ||
-        die "can't open dir: $!";
+    opendir(DIR, $logdir) or die "cannot open dir: $!";
     my @logs = readdir(DIR);
     closedir(DIR);
 
-    logmsg "== Contents of files in the $logdir/ dir after test $testnum\n";
+    logmsg "== Contents of files in the $logdir/ directory after test $testnum\n";
     foreach my $log (sort @logs) {
         if($log =~ /\.(\.|)$/) {
             next; # skip "." and ".."
@@ -2741,7 +2997,7 @@ sub displaylogs {
             next; # skip valgrindNnn of other tests
         }
         if(($log =~ /^test$testnum$/)) {
-            next; # skip test$testnum since it can be very big
+            next; # skip test$testnum since it can be big
         }
         logmsg "=== Start of file $log\n";
         displaylogcontent("$logdir/$log");
@@ -2755,12 +3011,16 @@ sub displaylogs {
 
 my $failed;
 my $failedign;
-my $ok=0;
-my $ign=0;
-my $total=0;
-my $lasttest=0;
+my $failedre;
+my $ok = 0;
+my $ign = 0;
+my $total = 0;
+my $executed = 0;
+my $retry_done = 0;
+my $lasttest = 0;
 my @at = split(" ", $TESTCASES);
-my $count=0;
+my $count = 0;
+my $endwaitcnt = 0;
 
 $start = time();
 
@@ -2770,7 +3030,7 @@ foreach my $testnum (@at) {
     $lasttest = $testnum if($testnum > $lasttest);
     my ($why, $errorreturncode) = singletest_shouldrun($testnum);
     if($why || $listonly) {
-        # Display test name now--test will be completely skipped later
+        # Display test name now--test is completely skipped later
         my $error = singletest_count($testnum, $why);
         next;
     }
@@ -2803,7 +3063,18 @@ createrunners($numrunners);
 #   - if a runner has a response for us, process the response
 
 # run through each candidate test and execute it
-while () {
+my $runner_wait_cnt = 0;
+
+# number of retry attempts for the whole test run
+my $retry_left;
+if($torture) {
+    $retry_left = 0;  # No use of retrying torture tests
+}
+else {
+    $retry_left = $retry;
+}
+
+while(1) {
     # check the abort flag
     if($globalabort) {
         logmsg singletest_dumplogs();
@@ -2849,7 +3120,7 @@ while () {
         }
     }
 
-    # See if we've completed all the tests
+    # See if we have completed all the tests
     if(!scalar(%runnersrunning)) {
         # No runners are running; we must be done
         scalar(@runtests) && die 'Internal error: still have tests to run';
@@ -2857,62 +3128,99 @@ while () {
     }
 
     # See if a test runner needs attention
-    # If we could be running more tests, don't wait so we can schedule a new
+    # If we could be running more tests, do not wait so we can schedule a new
     # one immediately. If all runners are busy, wait a fraction of a second
     # for one to finish so we can still loop around to check the abort flag.
-    my $runnerwait = scalar(@runnersidle) && scalar(@runtests) ? 0 : 0.5;
-    my ($ridready, $riderror) = runnerar_ready($runnerwait);
-    if($ridready && ! defined $runnersrunning{$ridready}) {
-        # On Linux, a closed pipe still shows up as ready instead of error.
-        # Detect this here by seeing if we are expecting it to be ready and
-        # treat it as an error if not.
-        logmsg "ERROR: Runner $ridready is unexpectedly ready; is probably actually dead\n";
-        $riderror = $ridready;
-        undef $ridready;
+    my $runnerwait = scalar(@runnersidle) && scalar(@runtests) ? 0.1 : 1.0;
+    my (@ridsready, $riderror) = runnerar_ready($runnerwait);
+    if(@ridsready) {
+        for my $ridready (@ridsready) {
+            if($ridready && ! defined $runnersrunning{$ridready}) {
+                # On Linux, a closed pipe still shows up as ready instead of error.
+                # Detect this here by seeing if we are expecting it to be ready and
+                # treat it as an error if not.
+                logmsg "ERROR: Runner $ridready is unexpectedly ready; is probably actually dead\n";
+                $riderror = $ridready;
+                undef $ridready;
+            }
+            if($ridready) {
+                $endwaitcnt = 0;
+                # This runner is ready to be serviced
+                my $testnum = $runnersrunning{$ridready};
+                defined $testnum or die "Internal error: test for runner $ridready unknown";
+                delete $runnersrunning{$ridready};
+                my ($error, $again) = singletest($ridready, $testnum, $countforrunner{$ridready}, $totaltests);
+                if($again) {
+                    # this runner is busy running a test
+                    $runnersrunning{$ridready} = $testnum;
+                } else {
+                    # Test is complete
+                    $runner_wait_cnt = 0;
+                    runnerready($ridready);
+
+                    if($error < 0) {
+                        # not a test we can run
+                        next;
+                    }
+
+                    $total++; # number of tests we have run
+                    $executed++;
+
+                    if($error > 0) {
+                        if($error == 2) {
+                            # ignored test failures
+                            $failedign .= "$testnum ";
+                        }
+                        else {
+                            # make another attempt to counteract flaky failures
+                            if($retry_left > 0) {
+                                $retry_left--;
+                                $retry_done++;
+                                $total--;
+                                push(@runtests, $testnum);
+                                $failedre .= "$testnum ";
+                            }
+                            else {
+                                $failed.= "$testnum ";
+                            }
+                        }
+                        if($postmortem) {
+                            # display all files in $LOGDIR/ in a nice way
+                            displaylogs($ridready, $testnum);
+                        }
+                        if($error == 2) {
+                            $ign++; # ignored test result counter
+                        }
+                        elsif(!$anyway) {
+                            # a test failed, abort
+                            logmsg "\n - abort tests\n";
+                            undef @runtests;  # empty out the remaining tests
+                        }
+                    }
+                    elsif(!$error) {
+                        $ok++; # successful test counter
+                    }
+                }
+            }
+        }
     }
-    if($ridready) {
-        # This runner is ready to be serviced
-        my $testnum = $runnersrunning{$ridready};
-        defined $testnum ||  die "Internal error: test for runner $ridready unknown";
-        delete $runnersrunning{$ridready};
-        my ($error, $again) = singletest($ridready, $testnum, $countforrunner{$ridready}, $totaltests);
-        if($again) {
-            # this runner is busy running a test
-            $runnersrunning{$ridready} = $testnum;
-        } else {
-            # Test is complete
-            runnerready($ridready);
-
-            if($error < 0) {
-                # not a test we can run
-                next;
+    if(!@ridsready && $runnerwait && !$torture && scalar(%runnersrunning)) {
+        $runner_wait_cnt++;
+        if($runner_wait_cnt >= 5) {
+            my $msg = "waiting for " . scalar(%runnersrunning) . " results:";
+            my $sep = " ";
+            foreach my $rid (keys %runnersrunning) {
+                $msg .= $sep . $runnersrunning{$rid} . "[$rid]";
+                $sep = ", "
             }
-
-            $total++; # number of tests we've run
-
-            if($error>0) {
-                if($error==2) {
-                    # ignored test failures
-                    $failedign .= "$testnum ";
-                }
-                else {
-                    $failed.= "$testnum ";
-                }
-                if($postmortem) {
-                    # display all files in $LOGDIR/ in a nice way
-                    displaylogs($ridready, $testnum);
-                }
-                if($error==2) {
-                    $ign++; # ignored test result counter
-                }
-                elsif(!$anyway) {
-                    # a test failed, abort
-                    logmsg "\n - abort tests\n";
-                    undef @runtests;  # empty out the remaining tests
-                }
-            }
-            elsif(!$error) {
-                $ok++; # successful test counter
+            logmsg "$msg\n";
+        }
+        if($runner_wait_cnt >= 10) {
+            $runner_wait_cnt = 0;
+            foreach my $rid (keys %runnersrunning) {
+                my $testnum = $runnersrunning{$rid};
+                logmsg "current state of test $testnum in [$rid]:\n";
+                displaylogs($rid, $testnum);
             }
         }
     }
@@ -2921,6 +3229,18 @@ while () {
         delete $runnersrunning{$riderror} if(defined $runnersrunning{$riderror});
         $globalabort = 1;
     }
+    $endwaitcnt += $runnerwait;
+    if($endwaitcnt >= 10) {
+        # Once all tests have been scheduled on a runner at the end of a test
+        # run, we wait for their results to come in. If we are still
+        # waiting after a couple of minutes ($endwaitcnt multiplied by
+        # $runnerwait, plus $jobs because that number does not time out), display
+        # the same test runner status as we give with a SIGUSR1. This likely
+        # points to a single test that has hung.
+        logmsg "Hmmm, the tests are taking a while to finish. Here is the status:\n";
+        catch_usr1();
+        $endwaitcnt = 0;
+    }
 }
 
 my $sofar = time() - $start;
@@ -2937,15 +3257,15 @@ foreach my $runnerid (values %runnerids) {
 # Wait for servers to stop
 my $unexpected;
 foreach my $runnerid (values %runnerids) {
-    my ($rid, $unexpect, $logs) = runnerar($runnerid);
-    $unexpected ||= $unexpect;
+    my ($rid, $unexpected_for_runner, $logs) = runnerar($runnerid);
+    $unexpected ||= $unexpected_for_runner;
     logmsg $logs;
 }
 
 # Kill the runners
-# There is a race condition here since we don't know exactly when the runners
-# have each finished shutting themselves down, but we're about to exit so it
-# doesn't make much difference.
+# There is a race condition here since we do not know exactly when the runners
+# have each finished shutting themselves down, but we are about to exit so it
+# does not make much difference.
 foreach my $runnerid (values %runnerids) {
     runnerac_shutdown($runnerid);
     sleep 0;  # give runner a context switch so it can shut itself down
@@ -2962,7 +3282,7 @@ if($all) {
 }
 
 if(%skipped && !$short) {
-    my $s=0;
+    my $s = 0;
     # Temporary hash to print the restraints sorted by the number
     # of their occurrences
     my %restraints;
@@ -2972,11 +3292,11 @@ if(%skipped && !$short) {
         my $r = $_;
         my $skip_count = $skipped{$r};
         my $log_line = sprintf("TESTINFO: \"%s\" %d time%s (", $r, $skip_count,
-                           ($skip_count == 1) ? "" : "s");
+                               ($skip_count == 1) ? "" : "s");
 
         # now gather all test case numbers that had this reason for being
         # skipped
-        my $c=0;
+        my $c = 0;
         my $max = 9;
         for(0 .. scalar @teststat) {
             my $t = $_;
@@ -2994,20 +3314,61 @@ if(%skipped && !$short) {
         $log_line .= ")\n";
         $restraints{$log_line} = $skip_count;
     }
-    foreach my $log_line (sort {$restraints{$b} <=> $restraints{$a}} keys %restraints) {
+    foreach my $log_line (sort {$restraints{$b} <=> $restraints{$a} || uc($a) cmp uc($b)} keys %restraints) {
         logmsg $log_line;
     }
 }
 
-if($total) {
+sub testnumdetails {
+    my ($desc, $numlist) = @_;
+    foreach my $testnum (split(' ', $numlist)) {
+        if(!loadtest("${TESTDIR}/test${testnum}", 1)) {
+            my @info_keywords = getpart("info", "keywords");
+            my $testname = (getpart("client", "name"))[0];
+            chomp $testname;
+            logmsg "$desc $testnum: '$testname'";
+            my $first = 1;
+            for my $k (@info_keywords) {
+                chomp $k;
+                my $sep = ($first == 1) ? " " : ", ";
+                logmsg "$sep$k";
+                $first = 0;
+            }
+            logmsg "\n";
+        }
+    }
+}
+
+if($executed) {
+    if($failedre) {
+        my $sorted = numsortwords($failedre);
+        logmsg "::group::Failed Retried Test details\n";
+        testnumdetails("FAIL-RETRIED", $sorted);
+        logmsg "RETRIED: failed tests: $sorted\n";
+        logmsg "::endgroup::\n";
+    }
+
+    if($passedign) {
+        my $sorted = numsortwords($passedign);
+        logmsg "::group::Passed Ignored Test details\n";
+        testnumdetails("PASSED-IGNORED", $sorted);
+        logmsg "IGNORED: passed tests: $sorted\n";
+        logmsg "::endgroup::\n";
+    }
+
     if($failedign) {
-        logmsg "IGNORED: failed tests: $failedign\n";
+        my $sorted = numsortwords($failedign);
+        testnumdetails("FAIL-IGNORED", $sorted);
+        logmsg "IGNORED: failed tests: $sorted\n";
     }
     logmsg sprintf("TESTDONE: $ok tests out of $total reported OK: %d%%\n",
-                   $ok/$total*100);
+                   $ok / $total * 100);
 
     if($failed && ($ok != $total)) {
-        logmsg "\nTESTFAIL: These test cases failed: $failed\n\n";
+        my $failedsorted = numsortwords($failed);
+        logmsg "\n";
+        testnumdetails("FAIL", $failedsorted);
+        logmsg "\nTESTFAIL: These test cases failed: $failedsorted\n\n";
     }
 }
 else {
@@ -3021,6 +3382,16 @@ else {
     }
 }
 
+if($mintotal) {
+    if($total < $mintotal) {
+        logmsg "TESTFAIL: number of tests run ($total) was below the minimum of: $mintotal\n";
+        exit 1;
+    }
+    else {
+        logmsg "TESTDONE: minimum number of tests was met: $mintotal\n";
+    }
+}
+
 if(($total && (($ok+$ign) != $total)) || !$total || $unexpected) {
     exit 1;
 }
diff --git a/third-party/curl/tests/secureserver.pl b/third-party/curl/tests/secureserver.pl
index 1b71c36c79..5025d47b4b 100644
--- a/third-party/curl/tests/secureserver.pl
+++ b/third-party/curl/tests/secureserver.pl
@@ -24,7 +24,7 @@
 #***************************************************************************
 
 # This is the HTTPS, FTPS, POP3S, IMAPS, SMTPS, server used for curl test
-# harness. Actually just a layer that runs stunnel properly using the
+# harness. Actually a layer that runs stunnel properly using the
 # non-secure test harness servers.
 
 use strict;
@@ -48,9 +48,9 @@ use pathhelp;
 
 my $stunnel = "stunnel";
 
-my $verbose=0; # set to 1 for debugging
+my $verbose = 0; # set to 1 for debugging
 
-my $accept_port = 8991; # just our default, weird enough
+my $accept_port = 8991; # our default, weird enough
 my $target_port = 8999; # default test http-server port
 
 my $stuncert;
@@ -70,8 +70,9 @@ my $ipvnum = 4;       # default IP version of stunneled server
 my $idnum = 1;        # default stunneled server instance number
 my $proto = 'https';  # default secure server protocol
 my $conffile;         # stunnel configuration file
-my $capath;           # certificate chain PEM folder
+my $cafile;           # certificate CA PEM file
 my $certfile;         # certificate chain PEM file
+my $mtls = 0;         # Whether to verify client certificates
 
 #***************************************************************************
 # stunnel requires full path specification for several files.
@@ -171,8 +172,11 @@ while(@ARGV) {
             shift @ARGV;
         }
     }
+    elsif($ARGV[0] eq '--mtls') {
+        $mtls = 1;
+    }
     else {
-        print STDERR "\nWarning: secureserver.pl unknown parameter: $ARGV[0]\n";
+        print STDERR "\nWarning: secureserver.pl unknown parameter: '$ARGV[0]'\n";
     }
     shift @ARGV;
 }
@@ -195,23 +199,25 @@ if(!$logfile) {
 
 $conffile = "$piddir/${proto}_stunnel.conf";
 
-$capath = abs_path($path);
-$certfile = "$srcdir/". ($stuncert?"certs/$stuncert":"stunnel.pem");
+$cafile = abs_path("$path/certs/test-ca.cacert");
+$certfile = $stuncert ? "certs/$stuncert" : "certs/test-localhost.pem";
 $certfile = abs_path($certfile);
 
 my $ssltext = uc($proto) ." SSL/TLS:";
 
+my $host_ip = ($ipvnum == 6) ? '::1' : '127.0.0.1';
+
 #***************************************************************************
 # Find out version info for the given stunnel binary
 #
 foreach my $veropt (('-version', '-V')) {
-    foreach my $verstr (qx("$stunnel" $veropt 2>&1)) {
+    foreach my $verstr (qx($stunnel $veropt 2>&1)) {
         if($verstr =~ /^stunnel (\d+)\.(\d+) on /) {
             $ver_major = $1;
             $ver_minor = $2;
         }
         elsif($verstr =~ /^sslVersion.*fips *= *yes/) {
-            # the fips option causes an error if stunnel doesn't support it
+            # the fips option causes an error if stunnel does not support it
             $fips_support = 1;
             last
         }
@@ -219,7 +225,7 @@ foreach my $veropt (('-version', '-V')) {
     last if($ver_major);
 }
 if((!$ver_major) || !defined($ver_minor)) {
-    if(-x "$stunnel" && ! -d "$stunnel") {
+    if(-x $stunnel && ! -d $stunnel) {
         print "$ssltext Unknown stunnel version\n";
     }
     else {
@@ -243,8 +249,8 @@ if($stunnel_version < 310) {
 if($stunnel =~ /tstunnel(\.exe)?$/) {
     $tstunnel_windows = 1;
 
-    # convert Cygwin/MinGW paths to Win32 format
-    $capath = pathhelp::sys_native_abs_path($capath);
+    # convert Cygwin/MinGW paths to Windows format
+    $cafile = pathhelp::sys_native_abs_path($cafile);
     $certfile = pathhelp::sys_native_abs_path($certfile);
 }
 
@@ -255,6 +261,8 @@ if($stunnel_version < 400) {
     if($stunnel_version >= 319) {
         $socketopt = "-O a:SO_REUSEADDR=1";
     }
+    # TODO: we do not use $host_ip in this old version. I find
+    # no documentation how to. But maybe ipv6 is not available anyway?
     $cmd  = "\"$stunnel\" -p $certfile -P $pidfile ";
     $cmd .= "-d $accept_port -r $target_port -f -D $loglevel ";
     $cmd .= ($socketopt) ? "$socketopt " : "";
@@ -276,24 +284,34 @@ if($stunnel_version < 400) {
 #
 if($stunnel_version >= 400) {
     $socketopt = "a:SO_REUSEADDR=1";
-    if(($stunnel_version >= 534) && $tstunnel_windows) {
-        # SO_EXCLUSIVEADDRUSE is on by default on Vista or newer,
-        # but does not work together with SO_REUSEADDR being on.
-        $socketopt .= "\nsocket = a:SO_EXCLUSIVEADDRUSE=0";
+    my $conffile_cmdline;
+    if($tstunnel_windows) {
+        if($stunnel_version >= 534) {
+            # SO_EXCLUSIVEADDRUSE is on by default on Vista or newer,
+            # but does not work together with SO_REUSEADDR being on.
+            $socketopt .= "\nsocket = a:SO_EXCLUSIVEADDRUSE=0";
+        }
+        $conffile_cmdline = pathhelp::sys_native_abs_path($conffile);
     }
-    $cmd  = "\"$stunnel\" $conffile ";
+    else {
+        $conffile_cmdline = $conffile;
+    }
+    $cmd  = "\"$stunnel\" $conffile_cmdline ";
     $cmd .= ">$logfile 2>&1";
     # setup signal handler
     $SIG{INT} = \&exit_signal_handler;
     $SIG{TERM} = \&exit_signal_handler;
     # stunnel configuration file
-    if(open(my $stunconf, ">", "$conffile")) {
-        print $stunconf "CApath = $capath\n";
+    if(open(my $stunconf, ">", $conffile)) {
         print $stunconf "cert = $certfile\n";
         print $stunconf "debug = $loglevel\n";
         print $stunconf "socket = $socketopt\n";
+        if($mtls) {
+            print $stunconf "CAfile = $cafile\n";
+            print $stunconf "verifyChain = yes\n";
+        }
         if($fips_support) {
-            # disable fips in case OpenSSL doesn't support it
+            # disable fips in case OpenSSL does not support it
             print $stunconf "fips = no\n";
         }
         if(!$tstunnel_windows) {
@@ -304,8 +322,8 @@ if($stunnel_version >= 400) {
         }
         print $stunconf "\n";
         print $stunconf "[curltest]\n";
-        print $stunconf "accept = $accept_port\n";
-        print $stunconf "connect = $target_port\n";
+        print $stunconf "accept = $host_ip:$accept_port\n";
+        print $stunconf "connect = $host_ip:$target_port\n";
         if(!close($stunconf)) {
             print "$ssltext Error closing file $conffile\n";
             exit 1;
@@ -318,22 +336,11 @@ if($stunnel_version >= 400) {
     if($verbose) {
         print uc($proto) ." server (stunnel $ver_major.$ver_minor)\n";
         print "cmd: $cmd\n";
-        print "CApath = $capath\n";
-        print "cert = $certfile\n";
-        print "debug = $loglevel\n";
-        print "socket = $socketopt\n";
-        if($fips_support) {
-            print "fips = no\n";
-        }
-        if(!$tstunnel_windows) {
-            print "pid = $pidfile\n";
-            print "output = $logfile\n";
-            print "foreground = yes\n";
-        }
+        print "stunnel config at $conffile:\n";
+        open (my $writtenconf, '<', $conffile) or die "$ssltext could not open the config file after writing\n";
+        print <$writtenconf>;
         print "\n";
-        print "[curltest]\n";
-        print "accept = $accept_port\n";
-        print "connect = $target_port\n";
+        close ($writtenconf);
     }
 }
 
@@ -348,7 +355,7 @@ print STDERR "RUN: $cmd\n" if($verbose);
 #
 if($tstunnel_windows) {
     # Fake pidfile for tstunnel on Windows.
-    if(open(my $out, ">", "$pidfile")) {
+    if(open(my $out, ">", $pidfile)) {
         print $out $$ . "\n";
         close($out);
     }
@@ -358,12 +365,12 @@ if($tstunnel_windows) {
 
     # Put an "exec" in front of the command so that the child process
     # keeps this child's process ID by being tied to the spawned shell.
-    exec("exec $cmd") || die "Can't exec() $cmd: $!";
-    # exec() will create a new process, but ties the existence of the
+    exec("exec $cmd") or die "Cannot exec() $cmd: $!";
+    # exec() creates a new process, but ties the existence of the
     # new process to the parent waiting perl.exe and sh.exe processes.
 
     # exec() should never return back here to this process. We protect
-    # ourselves by calling die() just in case something goes really bad.
+    # ourselves by calling die() in case something goes really bad.
     die "error: exec() has returned";
 }
 
diff --git a/third-party/curl/tests/server/.checksrc b/third-party/curl/tests/server/.checksrc
new file mode 100644
index 0000000000..3980c21141
--- /dev/null
+++ b/third-party/curl/tests/server/.checksrc
@@ -0,0 +1,19 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+allowfunc accept
+allowfunc calloc
+allowfunc fprintf
+allowfunc free
+allowfunc freeaddrinfo
+allowfunc getaddrinfo
+allowfunc malloc
+allowfunc printf
+allowfunc realloc
+allowfunc recv
+allowfunc send
+allowfunc snprintf
+allowfunc socket
+allowfunc sscanf
+allowfunc vsnprintf
diff --git a/third-party/curl/tests/server/.gitignore b/third-party/curl/tests/server/.gitignore
index 3149a27180..8f6424697e 100644
--- a/third-party/curl/tests/server/.gitignore
+++ b/third-party/curl/tests/server/.gitignore
@@ -2,13 +2,5 @@
 #
 # SPDX-License-Identifier: curl
 
-fake_ntlm
-getpart
-resolve
-rtspd
-sockfilt
-sws
-tftpd
-socksd
-disabled
-mqttd
+servers
+servers.c
diff --git a/third-party/curl/tests/server/CMakeLists.txt b/third-party/curl/tests/server/CMakeLists.txt
index 46c943a8be..bf1431c7fc 100644
--- a/third-party/curl/tests/server/CMakeLists.txt
+++ b/third-party/curl/tests/server/CMakeLists.txt
@@ -21,62 +21,35 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-set(TARGET_LABEL_PREFIX "Test server ")
 
-if(MSVC)
-  set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} /wd4306")
+# Get BUNDLE, FIRST_C, FIRST_H, UTILS_C, UTILS_H, CURLX_C, TOOLX_C, TESTS_C variables
+curl_transform_makefile_inc("Makefile.inc" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
+include("${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
+
+if(_CURL_TESTS_CONCAT)
+  set(_mk_unity_extra "--concat" "-I${CMAKE_CURRENT_SOURCE_DIR}")
 endif()
 
-function(SETUP_EXECUTABLE TEST_NAME)    # ARGN are the files in the test
-  add_executable(${TEST_NAME} EXCLUDE_FROM_ALL ${ARGN})
-  add_dependencies(testdeps ${TEST_NAME})
-  string(TOUPPER ${TEST_NAME} UPPER_TEST_NAME)
+add_custom_command(OUTPUT "${BUNDLE}.c"
+  COMMAND ${PERL_EXECUTABLE} "${PROJECT_SOURCE_DIR}/scripts/mk-unity.pl" ${_mk_unity_extra}
+    --include ${UTILS_C} ${CURLX_C} ${TOOLX_C} --test ${TESTS_C} > "${BUNDLE}.c"
+  DEPENDS
+    "${PROJECT_SOURCE_DIR}/scripts/mk-unity.pl" "${CMAKE_CURRENT_SOURCE_DIR}/Makefile.inc"
+    ${FIRST_C} ${FIRST_H} ${UTILS_C} ${CURLX_C} ${TOOLX_C} ${TESTS_C}
+  VERBATIM)
 
-  include_directories(
-    ${CURL_SOURCE_DIR}/lib      # To be able to reach "curl_setup_once.h"
-    ${CURL_BINARY_DIR}/lib      # To be able to reach "curl_config.h"
-    ${CURL_BINARY_DIR}/include  # To be able to reach "curl/curl.h"
-    ${CURL_SOURCE_DIR}/src      # To be able to reach "tool_xattr.h"
-    )
-  if(USE_ARES)
-    include_directories(${CARES_INCLUDE_DIR})
-  endif()
+add_executable(${BUNDLE} EXCLUDE_FROM_ALL "${BUNDLE}.c")
+add_dependencies(tt ${BUNDLE})
+target_link_libraries(${BUNDLE} ${CURL_NETWORK_AND_TIME_LIBS})
+target_include_directories(${BUNDLE} PRIVATE
+  "${PROJECT_BINARY_DIR}/lib"            # for "curl_config.h"
+  "${PROJECT_SOURCE_DIR}/lib"            # for "curl_setup.h", curlx
+  "${PROJECT_SOURCE_DIR}/src"            # for toolx
+  "${CMAKE_CURRENT_SOURCE_DIR}"          # for the generated bundle source to find included test sources
+)
+set_target_properties(${BUNDLE} PROPERTIES OUTPUT_NAME "${BUNDLE}" PROJECT_LABEL "Test ${BUNDLE}" UNITY_BUILD OFF)
 
-  target_link_libraries(${TEST_NAME} ${CURL_LIBS})
-
-  # Test servers simply are standalone programs that do not use libcurl
-  # library.  For convenience and to ease portability of these servers,
-  # some source code files from the libcurl subdirectory are also used
-  # to build the servers.  In order to achieve proper linkage of these
-  # files on Win32 targets it is necessary to build the test servers
-  # with CURL_STATICLIB defined, independently of how libcurl is built.
-  set_target_properties(${TEST_NAME} PROPERTIES
-    COMPILE_DEFINITIONS CURL_STATICLIB)       # ${UPPER_TEST_NAME}
-  set_target_properties(${TEST_NAME} PROPERTIES
-    PROJECT_LABEL "${TARGET_LABEL_PREFIX}${TEST_NAME}")
-endfunction()
-
-
-transform_makefile_inc("Makefile.inc"
-  "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
-include(${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake)
-
-foreach(EXECUTABLE_NAME ${noinst_PROGRAMS})
-  setup_executable(${EXECUTABLE_NAME} ${${EXECUTABLE_NAME}_SOURCES})
-endforeach()
-
-
-# SET(useful
-# getpart.c getpart.h
-# ${CURL_SOURCE_DIR}/lib/strequal.c
-# ${CURL_SOURCE_DIR}/lib/base64.c
-# ${CURL_SOURCE_DIR}/lib/mprintf.c
-# ${CURL_SOURCE_DIR}/lib/memdebug.c
-# ${CURL_SOURCE_DIR}/lib/timeval.c
-# )
-
-# SETUP_EXECUTABLE(sws sws.c util.c util.h ${useful})
-# SETUP_EXECUTABLE(resolve resolve.c util.c util.h ${useful})
-# SETUP_EXECUTABLE(sockfilt sockfilt.c util.c util.h ${useful} ${CURL_SOURCE_DIR}/lib/inet_pton.c)
-# SETUP_EXECUTABLE(getpart testpart.c ${useful})
-# SETUP_EXECUTABLE(tftpd tftpd.c util.c util.h ${useful} tftp.h)
+if(NOT _CURL_TESTS_CONCAT)
+  set_target_properties(${BUNDLE} PROPERTIES C_CLANG_TIDY "")
+  curl_add_clang_tidy_test_target("${BUNDLE}-clang-tidy" ${BUNDLE} ${FIRST_C} ${UTILS_C} ${TESTS_C})
+endif()
diff --git a/third-party/curl/tests/server/Makefile.am b/third-party/curl/tests/server/Makefile.am
index b08942263c..5427c6df0b 100644
--- a/third-party/curl/tests/server/Makefile.am
+++ b/third-party/curl/tests/server/Makefile.am
@@ -31,25 +31,31 @@ AUTOMAKE_OPTIONS = foreign nostdinc
 # $(top_srcdir)/include is for libcurl's external include files
 # $(top_builddir)/lib is for libcurl's generated lib/curl_config.h file
 # $(top_srcdir)/lib for libcurl's lib/curl_setup.h and other "borrowed" files
+# $(top_srcdir)/src for toolx header files
+# $(srcdir) for the generated bundle source to find included test sources
 
 AM_CPPFLAGS = -I$(top_srcdir)/include        \
               -I$(top_builddir)/lib          \
-              -I$(top_srcdir)/lib
+              -I$(top_srcdir)/lib            \
+              -I$(top_srcdir)/src            \
+              -I$(srcdir)
 
-disabled_CPPFLAGS = $(AM_CPPFLAGS) \
-              -I$(top_srcdir)/src
+# Get BUNDLE, FIRST_C, FIRST_H, UTILS_C, UTILS_H, CURLX_C, TOOLX_C, TESTS_C variables
+include Makefile.inc
+
+EXTRA_DIST = CMakeLists.txt .checksrc $(FIRST_C) $(FIRST_H) $(UTILS_C) $(UTILS_H) $(TESTS_C)
+
+CFLAGS += @CURL_CFLAG_EXTRAS@
 
 # Prevent LIBS from being used for all link targets
 LIBS = $(BLANK_AT_MAKETIME)
 
-if DOING_NATIVE_WINDOWS
-AM_CPPFLAGS += -DCURL_STATICLIB
-endif
+$(BUNDLE).c: $(top_srcdir)/scripts/mk-unity.pl Makefile.inc $(FIRST_C) $(UTILS_C) $(CURLX_C) $(TOOLX_C) $(TESTS_C)
+	@PERL@ $(top_srcdir)/scripts/mk-unity.pl --include $(UTILS_C) $(CURLX_C) $(TOOLX_C) --test $(TESTS_C) > $(BUNDLE).c
 
-# Makefile.inc provides neat definitions
-include Makefile.inc
-
-EXTRA_DIST = base64.pl Makefile.inc CMakeLists.txt
+noinst_PROGRAMS = $(BUNDLE)
+LDADD = @CURL_NETWORK_AND_TIME_LIBS@
+CLEANFILES = $(BUNDLE).c
 
 CHECKSRC = $(CS_$(V))
 CS_0 = @echo "  RUN     " $@;
@@ -57,9 +63,11 @@ CS_1 =
 CS_ = $(CS_0)
 
 checksrc:
-	$(CHECKSRC)@PERL@ $(top_srcdir)/scripts/checksrc.pl $(srcdir)/*.[ch]
+	$(CHECKSRC)(@PERL@ $(top_srcdir)/scripts/checksrc.pl -D$(srcdir) -W$(srcdir)/$(BUNDLE).c $(FIRST_C) $(FIRST_H) $(UTILS_C) $(UTILS_H) $(TESTS_C))
 
-if CURLDEBUG
-# for debug builds, we scan the sources on all regular make invokes
+if NOT_CURL_CI
 all-local: checksrc
 endif
+
+clean-local:
+	rm -f $(BUNDLE)
diff --git a/third-party/curl/tests/server/Makefile.inc b/third-party/curl/tests/server/Makefile.inc
index efd2fa05e1..33a578b859 100644
--- a/third-party/curl/tests/server/Makefile.inc
+++ b/third-party/curl/tests/server/Makefile.inc
@@ -21,97 +21,45 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+# Shared between CMakeLists.txt and Makefile.am
 
-noinst_PROGRAMS = getpart resolve rtspd sockfilt sws tftpd fake_ntlm    \
- socksd disabled mqttd
+BUNDLE = servers
 
-CURLX_SRCS = \
- ../../lib/mprintf.c \
- ../../lib/nonblock.c \
- ../../lib/strtoofft.c \
- ../../lib/warnless.c \
- ../../lib/timediff.c \
- ../../lib/dynbuf.c \
- ../../lib/strdup.c \
- ../../lib/strcase.c \
- ../../lib/curl_multibyte.c
+# Files referenced from the bundle source
+FIRST_C = first.c
+FIRST_H = first.h
 
-CURLX_HDRS = \
- ../../lib/curlx.h \
- ../../lib/nonblock.h \
- ../../lib/strtoofft.h \
- ../../lib/warnless.h \
- ../../lib/timediff.h \
- ../../lib/curl_ctype.h \
- ../../lib/dynbuf.h \
- ../../lib/strdup.h \
- ../../lib/curl_multibyte.h
+# Common files used by test programs
+UTILS_C = getpart.c util.c
+UTILS_H =
 
-USEFUL = \
- getpart.c \
- getpart.h \
- server_setup.h \
- ../../lib/base64.c \
- ../../lib/curl_base64.h \
- ../../lib/memdebug.c \
- ../../lib/memdebug.h
+CURLX_C = \
+  ../../lib/curlx/base64.c \
+  ../../lib/curlx/fopen.c \
+  ../../lib/curlx/inet_ntop.c \
+  ../../lib/curlx/inet_pton.c \
+  ../../lib/curlx/multibyte.c \
+  ../../lib/curlx/nonblock.c \
+  ../../lib/curlx/snprintf.c \
+  ../../lib/curlx/strcopy.c \
+  ../../lib/curlx/strerr.c \
+  ../../lib/curlx/strparse.c \
+  ../../lib/curlx/timediff.c \
+  ../../lib/curlx/timeval.c \
+  ../../lib/curlx/wait.c \
+  ../../lib/curlx/warnless.c \
+  ../../lib/curlx/winapi.c
 
-UTIL = \
- util.c \
- util.h
+TOOLX_C = \
+  ../../src/toolx/tool_time.c
 
-getpart_SOURCES = $(CURLX_SRCS) $(CURLX_HDRS) $(USEFUL) \
- testpart.c
-getpart_LDADD = @CURL_NETWORK_AND_TIME_LIBS@
-getpart_CFLAGS = $(AM_CFLAGS)
-
-resolve_SOURCES = $(CURLX_SRCS) $(CURLX_HDRS) $(USEFUL) $(UTIL) \
- resolve.c
-resolve_LDADD = @CURL_NETWORK_AND_TIME_LIBS@
-resolve_CFLAGS = $(AM_CFLAGS)
-
-rtspd_SOURCES = $(CURLX_SRCS) $(CURLX_HDRS) $(USEFUL) $(UTIL) \
- server_sockaddr.h \
- rtspd.c
-rtspd_LDADD = @CURL_NETWORK_AND_TIME_LIBS@
-rtspd_CFLAGS = $(AM_CFLAGS)
-
-sockfilt_SOURCES = $(CURLX_SRCS) $(CURLX_HDRS) $(USEFUL) $(UTIL) \
- server_sockaddr.h \
- sockfilt.c \
- ../../lib/inet_pton.c
-sockfilt_LDADD = @CURL_NETWORK_AND_TIME_LIBS@
-sockfilt_CFLAGS = $(AM_CFLAGS)
-
-socksd_SOURCES = $(CURLX_SRCS) $(CURLX_HDRS) $(USEFUL) $(UTIL) \
- server_sockaddr.h socksd.c \
- ../../lib/inet_pton.c
-socksd_LDADD = @CURL_NETWORK_AND_TIME_LIBS@
-socksd_CFLAGS = $(AM_CFLAGS)
-
-mqttd_SOURCES = $(CURLX_SRCS) $(CURLX_HDRS) $(USEFUL) $(UTIL) \
- server_sockaddr.h mqttd.c \
- ../../lib/inet_pton.c
-mqttd_LDADD = @CURL_NETWORK_AND_TIME_LIBS@
-mqttd_CFLAGS = $(AM_CFLAGS)
-
-sws_SOURCES = $(CURLX_SRCS) $(CURLX_HDRS) $(USEFUL) $(UTIL) \
- server_sockaddr.h \
- sws.c \
- ../../lib/inet_pton.c
-sws_LDADD = @CURL_NETWORK_AND_TIME_LIBS@
-sws_CFLAGS = $(AM_CFLAGS)
-
-tftpd_SOURCES = $(CURLX_SRCS) $(CURLX_HDRS) $(USEFUL) $(UTIL) \
- server_sockaddr.h \
- tftpd.c \
- tftp.h
-tftpd_LDADD = @CURL_NETWORK_AND_TIME_LIBS@
-tftpd_CFLAGS = $(AM_CFLAGS)
-
-fake_ntlm_SOURCES = $(CURLX_SRCS) $(CURLX_HDRS) $(USEFUL) $(UTIL) \
- fake_ntlm.c
-fake_ntlm_LDADD = @CURL_NETWORK_AND_TIME_LIBS@
-fake_ntlm_CFLAGS = $(AM_CFLAGS)
-
-disabled_SOURCES = disabled.c
+# All test servers
+TESTS_C = \
+  dnsd.c \
+  mqttd.c \
+  resolve.c \
+  rtspd.c \
+  sockfilt.c \
+  socksd.c \
+  sws.c \
+  tftpd.c
diff --git a/third-party/curl/tests/server/base64.pl b/third-party/curl/tests/server/base64.pl
deleted file mode 100644
index 885e6f4199..0000000000
--- a/third-party/curl/tests/server/base64.pl
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-use MIME::Base64 qw(encode_base64);
-
-my $buf;
-while(read(STDIN, $buf, 60*57)) {
-    my $enc = encode_base64($buf);
-    print "$enc";
-}
diff --git a/third-party/curl/tests/server/disabled.c b/third-party/curl/tests/server/disabled.c
deleted file mode 100644
index 0b84134fc2..0000000000
--- a/third-party/curl/tests/server/disabled.c
+++ /dev/null
@@ -1,117 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-/*
- * The purpose of this tool is to figure out which, if any, features that are
- * disabled which should otherwise exist and work. These aren't visible in
- * regular curl -V output.
- *
- * Disabled protocols are visible in curl_version_info() and are not included
- * in this table.
- */
-
-#include "curl_setup.h"
-#include "multihandle.h" /* for ENABLE_WAKEUP */
-#include "tool_xattr.h" /* for USE_XATTR */
-#include <stdio.h>
-
-static const char *disabled[]={
-#ifdef CURL_DISABLE_BINDLOCAL
-  "bindlocal",
-#endif
-#ifdef CURL_DISABLE_COOKIES
-  "cookies",
-#endif
-#ifdef CURL_DISABLE_BASIC_AUTH
-  "basic-auth",
-#endif
-#ifdef CURL_DISABLE_BEARER_AUTH
-  "bearer-auth",
-#endif
-#ifdef CURL_DISABLE_DIGEST_AUTH
-  "digest-auth",
-#endif
-#ifdef CURL_DISABLE_NEGOTIATE_AUTH
-  "negotiate-auth",
-#endif
-#ifdef CURL_DISABLE_AWS
-  "aws",
-#endif
-#ifdef CURL_DISABLE_DOH
-  "DoH",
-#endif
-#ifdef CURL_DISABLE_HTTP_AUTH
-  "HTTP-auth",
-#endif
-#ifdef CURL_DISABLE_MIME
-  "Mime",
-#endif
-#ifdef CURL_DISABLE_NETRC
-  "netrc",
-#endif
-#ifdef CURL_DISABLE_PARSEDATE
-  "parsedate",
-#endif
-#ifdef CURL_DISABLE_PROXY
-  "proxy",
-#endif
-#ifdef CURL_DISABLE_SHUFFLE_DNS
-  "shuffle-dns",
-#endif
-#ifdef CURL_DISABLE_TYPECHECK
-  "typecheck",
-#endif
-#ifdef CURL_DISABLE_VERBOSE_STRINGS
-  "verbose-strings",
-#endif
-#ifndef ENABLE_WAKEUP
-  "wakeup",
-#endif
-#ifdef CURL_DISABLE_HEADERS_API
-  "headers-api",
-#endif
-#ifndef USE_XATTR
-  "xattr",
-#endif
-#ifdef CURL_DISABLE_FORM_API
-  "form-api",
-#endif
-#if (SIZEOF_TIME_T < 5)
-  "large-time",
-#endif
-  NULL
-};
-
-int main(int argc, char **argv)
-{
-  int i;
-
-  (void) argc;
-  (void) argv;
-
-  for(i = 0; disabled[i]; i++)
-    printf("%s\n", disabled[i]);
-
-  return 0;
-}
diff --git a/third-party/curl/tests/server/dnsd.c b/third-party/curl/tests/server/dnsd.c
new file mode 100644
index 0000000000..8fb899bf26
--- /dev/null
+++ b/third-party/curl/tests/server/dnsd.c
@@ -0,0 +1,1077 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#ifndef __AMIGA__
+
+static int dnsd_wrotepidfile = 0;
+static int dnsd_wroteportfile = 0;
+
+#ifdef HAVE_SYS_SELECT_H
+#include <sys/select.h>
+#endif
+
+static uint16_t get16bit(const unsigned char **pkt, size_t *size)
+{
+  const unsigned char *p = *pkt;
+  (*pkt) += 2;
+  *size -= 2;
+  return (uint16_t)((p[0] << 8) | p[1]);
+}
+
+#define BLOB_MAX_LEN         4096
+
+struct blob {
+  uint8_t data[BLOB_MAX_LEN];
+  size_t dlen;
+};
+
+static void blob_reset(struct blob *b)
+{
+  memset(b->data, 0, sizeof(b->data));
+  b->dlen = 0;
+}
+
+static int blob_add(struct blob *b, uint8_t n)
+{
+  if(b->dlen + 1 > BLOB_MAX_LEN)
+    return 1;
+  b->data[b->dlen] = n;
+  b->dlen += 1;
+  return 0;
+}
+
+static int blob_addn(struct blob *b, const uint8_t *data, size_t n)
+{
+  if(b->dlen + n > BLOB_MAX_LEN)
+    return 1;
+  memcpy(&b->data[b->dlen], data, n);
+  b->dlen += n;
+  return 0;
+}
+
+static int blob_add_uint16(struct blob *b, uint16_t n)
+{
+  if(b->dlen + 2 > BLOB_MAX_LEN)
+    return 1;
+  b->data[b->dlen] = (n >> 8) & 0xffU;
+  b->data[b->dlen + 1] = n & 0xffU;
+  b->dlen += 2;
+  return 0;
+}
+
+static int blob_addchars(struct blob *b, const char *data, size_t n)
+{
+  return blob_addn(b, (const uint8_t *)data, n);
+}
+
+static int qname2str(const unsigned char **pkt, size_t *size,
+                     char *name, size_t name_max)
+{
+  unsigned char length;
+  size_t o = 0;
+  const unsigned char *p = *pkt;
+
+  do {
+    int i;
+    length = *p++;
+    if(*size < length)
+      /* too long */
+      return 1;
+    if(length && o)
+      name[o++] = '.';
+    if(o + length >= name_max - 1)
+      return 1;
+    for(i = 0; i < length; i++) {
+      name[o++] = *p++;
+    }
+  } while(length);
+  *size -= (p - *pkt);
+  *pkt = p;
+  name[o] = '\0';
+  return 0;
+}
+
+static int blob_add_qname_part(struct blob *b, struct Curl_str *str)
+{
+  size_t dot, skip;
+
+  for(dot = 0; dot < str->len; ++dot) {
+    if(str->str[dot] == '.')
+      break;
+  }
+  if(!dot || (dot > 63)) /* RFC 1035, ch. 3.1 */
+    return 1;
+  if(blob_add(b, (uint8_t)dot) ||
+     (dot && blob_addchars(b, str->str, dot)))
+    return 1;
+
+  skip = dot;
+  if(dot < str->len)
+    skip += 1;
+  str->str += skip;
+  str->len -= skip;
+  return 0;
+}
+
+static int blob_add_qname(struct blob *b, const struct Curl_str *str)
+{
+  struct Curl_str s = *str;
+
+  while(s.len) {
+    if(s.str[0] == '.') {
+      if(s.len != 1)
+        return 1;
+      break;
+    }
+    else {
+      if(blob_add_qname_part(b, &s))
+        return 1;
+    }
+  }
+  return blob_add(b, 0);
+}
+
+#define QTYPE_A     1
+#define QTYPE_AAAA  28
+#define QTYPE_HTTPS 0x41
+
+#if 0
+#define HTTPS_RR_CODE_MANDATORY       0x00
+#endif
+#define HTTPS_RR_CODE_ALPN            0x01
+#define HTTPS_RR_CODE_NO_DEF_ALPN     0x02
+#if 0
+#define HTTPS_RR_CODE_PORT            0x03
+#define HTTPS_RR_CODE_IPV4            0x04
+#define HTTPS_RR_CODE_ECH             0x05
+#define HTTPS_RR_CODE_IPV6            0x06
+#endif
+
+static const char *type2string(uint16_t qtype)
+{
+  switch(qtype) {
+  case QTYPE_A:
+    return "A";
+  case QTYPE_AAAA:
+    return "AAAA";
+  case QTYPE_HTTPS:
+    return "HTTPS";
+  }
+  return "<unknown>";
+}
+
+/*
+ * Handle initial connection protocol.
+ *
+ * Return query (qname + type + class), type and id.
+ */
+static int store_incoming(int qid, const unsigned char *data, size_t size,
+                          unsigned char *qbuf, size_t qbuflen, size_t *qlen,
+                          uint16_t *qtype, uint16_t *idp)
+{
+  FILE *server;
+  char dumpfile[256];
+#if 0
+  size_t i;
+#endif
+  uint16_t qd;
+  const uint8_t *qptr;
+  char name[256];
+  size_t qsize;
+
+  *qlen = 0;
+  *qtype = 0;
+  *idp = 0;
+
+  snprintf(dumpfile, sizeof(dumpfile), "%s/dnsd.input", logdir);
+
+  /* Open request dump file. */
+  server = curlx_fopen(dumpfile, "ab");
+  if(!server) {
+    char errbuf[STRERROR_LEN];
+    int error = errno;
+    logmsg("fopen() failed with error (%d) %s",
+           error, curlx_strerror(error, errbuf, sizeof(errbuf)));
+    logmsg("Error opening file '%s'", dumpfile);
+    return -1;
+  }
+
+  /*
+                                    1  1  1  1  1  1
+      0  1  2  3  4  5  6  7  8  9  0  1  2  3  4  5
+    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+    |                      ID                       |
+    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+    |QR|   Opcode  |AA|TC|RD|RA|   Z    |   RCODE   |
+    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+    |                    QDCOUNT                    |
+    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+    |                    ANCOUNT                    |
+    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+    |                    NSCOUNT                    |
+    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+    |                    ARCOUNT                    |
+    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+   */
+  *idp = get16bit(&data, &size);
+  data += 2; /* skip the next 16 bits */
+  size -= 2;
+#if 0
+  fprintf(server, "QR: %x\n", (*idp & 0x8000) > 15);
+  fprintf(server, "OPCODE: %x\n", (*idp & 0x7800) >> 11);
+  fprintf(server, "TC: %x\n", (*idp & 0x200) >> 9);
+  fprintf(server, "RD: %x\n", (*idp & 0x100) >> 8);
+  fprintf(server, "Z: %x\n", (*idp & 0x70) >> 4);
+  fprintf(server, "RCODE: %x\n", (*idp & 0x0f));
+#endif
+  (void)get16bit(&data, &size);
+
+  data += 6; /* skip ANCOUNT, NSCOUNT and ARCOUNT */
+  size -= 6;
+
+  /* store pointer and size at the QD point */
+  qsize = size;
+  qptr = data;
+
+  if(!qname2str(&data, &size, name, sizeof(name))) {
+    qd = get16bit(&data, &size);
+    fprintf(server, "QNAME %s QTYPE %s\n", name, type2string(qd));
+    *qtype = qd;
+    logmsg("[%d] Question for '%s' type %x / %s",
+           qid, name, qd, type2string(qd));
+
+    (void)get16bit(&data, &size);
+
+    *qlen = qsize - size; /* total size of the query */
+    if(*qlen > qbuflen) {
+      logmsg("dnsd: query too large: %lu > %lu",
+             (unsigned long)*qlen, (unsigned long)qbuflen);
+      curlx_fclose(server);
+      return -1;
+    }
+    memcpy(qbuf, qptr, *qlen);
+  }
+  else
+    logmsg("Bad input qname");
+#if 0
+  for(i = 0; i < size; i++) {
+    fprintf(server, "%02d", (unsigned int)data[i]);
+  }
+  fprintf(server, "\n");
+#endif
+
+  curlx_fclose(server);
+
+  return 0;
+}
+
+static int add_answer(struct blob *body,
+                      const unsigned char *a, size_t alen,
+                      uint16_t qtype)
+{
+  uint8_t prefix[10] = {
+    0xc0, 0x0c, /* points to the query at this fixed packet index */
+    0x00, 0x00,
+    0x00, 0x01, /* QCLASS IN */
+    0x00, 0x00,
+    0x0a, 0x14, /* TTL, Time to live: 2580 (43 minutes) */
+  };
+
+  /* QTYPE */
+  prefix[2] = (unsigned char)(qtype >> 8);
+  prefix[3] = (unsigned char)(qtype & 0xff);
+
+  if(blob_addn(body, prefix, sizeof(prefix)))
+    return 1;
+  if((alen > UINT16_MAX) || blob_add_uint16(body, (uint16_t)alen))
+    return 1;
+  return blob_addn(body, a, alen);
+}
+
+#ifdef _WIN32
+#define SENDTO3 int
+#else
+#define SENDTO3 size_t
+#endif
+
+#define INSTRUCTIONS "dnsd.cmd"
+
+static curlx_struct_stat finfo_last;
+static unsigned char ipv4_pref[4];
+static unsigned char ipv6_pref[16];
+static unsigned char ancount_a;
+static unsigned char ancount_aaaa;
+
+static timediff_t a_delay_ms;
+static timediff_t aaaa_delay_ms;
+static timediff_t https_delay_ms;
+
+static int query_id = -1;
+
+static struct blob httpsrr;
+
+struct resp {
+  struct resp *next;
+  int qid;
+  struct curltime send_ts;
+  struct sockaddr addr;
+  curl_socklen_t addrlen;
+  struct blob body;
+};
+
+static struct resp *resp_queue;
+
+static CURLcode send_resp(curl_socket_t sock, struct resp *resp)
+{
+  ssize_t rc;
+  int sockerr = 0;
+
+  do {
+    rc = sendto(sock, (const void *)resp->body.data, (SENDTO3)resp->body.dlen,
+                0, &resp->addr, resp->addrlen);
+  } while((rc < 0) && ((sockerr = SOCKERRNO) == SOCKEINTR));
+  if(rc < 0) {
+    char errbuf[STRERROR_LEN];
+    logmsg("failed sending %zu bytes, error: (%d) %s", resp->body.dlen,
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+    return CURLE_SEND_ERROR;
+  }
+  else if(rc != (ssize_t)resp->body.dlen) {
+    logmsg("failed sending %zu bytes, sent: %zd", resp->body.dlen, rc);
+    return CURLE_SEND_ERROR;
+  }
+  logmsg("[%d] sent response", resp->qid);
+  return CURLE_OK;
+}
+
+static void queue_resp(struct resp *resp)
+{
+  struct resp **panchor = &resp_queue;
+  while(*panchor) {
+    timediff_t ms = curlx_ptimediff_ms(&(*panchor)->send_ts, &resp->send_ts);
+    if(ms > 0) /* resp is to be sent before *panchor */
+      break;
+    panchor = &(*panchor)->next;
+  }
+  resp->next = *panchor;
+  *panchor = resp;
+}
+
+static timediff_t send_resp_queue(curl_socket_t sock)
+{
+  struct resp **panchor = &resp_queue;
+  struct curltime now = curlx_now();
+  timediff_t timeout_ms = 0;
+
+  while(*panchor) {
+    struct resp *resp = *panchor;
+    timediff_t ms = curlx_ptimediff_ms(&resp->send_ts, &now);
+
+    if(ms > 0) {
+      timeout_ms = ms;
+      break;
+    }
+    *panchor = resp->next;
+    send_resp(sock, resp);
+    curlx_free(resp);
+  }
+  return timeout_ms;
+}
+
+static void clear_resp_queue(void)
+{
+  while(resp_queue) {
+    struct resp *resp = resp_queue;
+    resp_queue = resp->next;
+    curlx_free(resp);
+  }
+}
+
+/* this is an answer to a question */
+static struct resp *
+create_resp(int qid, const struct sockaddr *addr, curl_socklen_t addrlen,
+            const unsigned char *qbuf, size_t qlen,
+            uint16_t qtype, uint16_t id)
+{
+  struct resp *resp;
+  int a;
+  timediff_t delay_ms = 0;
+  char addrbuf[128]; /* IP address buffer */
+  uint8_t header[12] = {
+    0x80, 0xea, /* ID, overwrite */
+    0x81, 0x80,
+    /*
+    Flags: 0x8180 Standard query response, No error
+        1... .... .... .... = Response: Message is a response
+        .000 0... .... .... = Opcode: Standard query (0)
+        .... .0.. .... .... = Authoritative: Server is not an authority for
+                              domain
+        .... ..0. .... .... = Truncated: Message is not truncated
+        .... ...1 .... .... = Recursion desired: Do query recursively
+        .... .... 1... .... = Recursion available: Server can do recursive
+                              queries
+        .... .... .0.. .... = Z: reserved (0)
+        .... .... ..0. .... = Answer authenticated: Answer/authority portion
+                              was not authenticated by the server
+        .... .... ...0 .... = Non-authenticated data: Unacceptable
+        .... .... .... 0000 = Reply code: No error (0)
+    */
+    0x0, 0x1, /* QDCOUNT a single question */
+    0x0, 0x0, /* ANCOUNT number of answers */
+    0x0, 0x0, /* NSCOUNT */
+    0x0, 0x0  /* ARCOUNT */
+  };
+  uint16_t ancount = 0;
+
+  switch(qtype) {
+  case QTYPE_A:
+    ancount = ancount_a;
+    delay_ms = a_delay_ms;
+    break;
+  case QTYPE_AAAA:
+    ancount = ancount_aaaa;
+    delay_ms = aaaa_delay_ms;
+    break;
+  case QTYPE_HTTPS:
+    if(httpsrr.dlen)
+      ancount = 1;
+    delay_ms = https_delay_ms;
+    break;
+  }
+
+  resp = curlx_calloc(1, sizeof(*resp));
+  if(!resp)
+    goto error;
+
+  resp->qid = qid;
+  /* on some platforms `curl_socklen_t` is an `int`. Casting might
+  * wrap this, but then it still has to fit our record size. */
+  if((size_t)addrlen > sizeof(resp->addr)) {
+    logmsg("unable to handle addrlen of %zu", (size_t)addrlen);
+    goto error;
+  }
+  memcpy(&resp->addr, CURL_UNCONST(addr), addrlen);
+  resp->addrlen = addrlen;
+
+  header[0] = (uint8_t)(id >> 8);
+  header[1] = (uint8_t)(id & 0xff);
+
+  header[6] = (uint8_t)(ancount >> 8);
+  header[7] = (uint8_t)(ancount & 0xff);
+
+  if(blob_addn(&resp->body, header, sizeof(header)))
+    goto error;
+
+  if(blob_addn(&resp->body, qbuf, qlen)) {
+    logmsg("unable to handle query of length %zu", qlen);
+    goto error;
+  }
+
+  switch(qtype) {
+  case QTYPE_A:
+    for(a = 0; a < ancount_a; a++) {
+      const unsigned char *store = ipv4_pref;
+      if(add_answer(&resp->body, store, sizeof(ipv4_pref), QTYPE_A))
+        goto error;
+      logmsg("[%d] response A (%x) '%s'", qid, (unsigned int)QTYPE_A,
+             curlx_inet_ntop(AF_INET, store, addrbuf, sizeof(addrbuf)));
+    }
+    if(!ancount_a)
+      logmsg("[%d] response A empty", qid);
+    break;
+  case QTYPE_AAAA:
+    for(a = 0; a < ancount_aaaa; a++) {
+      const unsigned char *store = ipv6_pref;
+      if(add_answer(&resp->body, store, sizeof(ipv6_pref), QTYPE_AAAA))
+        goto error;
+      logmsg("[%d] response AAAA (%x) '%s'", qid, (unsigned int)QTYPE_AAAA,
+             curlx_inet_ntop(AF_INET6, store, addrbuf, sizeof(addrbuf)));
+    }
+    if(!ancount_aaaa)
+      logmsg("[%d] response AAAA empty", qid);
+    break;
+  case QTYPE_HTTPS:
+    if(httpsrr.dlen) {
+      if(add_answer(&resp->body, httpsrr.data, httpsrr.dlen, QTYPE_HTTPS)) {
+        logmsg("[%d] error adding https %zu response bytes", qid,
+               httpsrr.dlen);
+        goto error;
+      }
+      logmsg("[%d] response HTTPS (%x), %zu bytes", qid,
+             (unsigned int)QTYPE_HTTPS, httpsrr.dlen);
+    }
+    else
+      logmsg("[%d] response HTTPS, no record", qid);
+    break;
+  }
+
+  resp->send_ts = curlx_now();
+  if(delay_ms > 0) {
+    int usec = (int)((delay_ms % 1000) * 1000);
+    resp->send_ts.tv_sec += (time_t)(delay_ms / 1000);
+    resp->send_ts.tv_usec += usec;
+    if(resp->send_ts.tv_usec >= 1000000) {
+      resp->send_ts.tv_sec++;
+      resp->send_ts.tv_usec -= 1000000;
+    }
+    logmsg("[%d] delay response by %" FMT_TIMEDIFF_T "ms", qid, delay_ms);
+  }
+  return resp;
+
+error:
+  logmsg("[%d] failed to create response", qid);
+  curlx_free(resp);
+  return NULL;
+}
+
+static int read_https_alpn_part(struct blob *b, struct Curl_str *str)
+{
+  size_t i, skip;
+
+  for(i = 0; i < str->len; ++i) {
+    if(str->str[i] == ',')
+      break;
+  }
+  if(i > 256)
+    return 1;
+  if(blob_add(b, (uint8_t)i) || blob_addchars(b, str->str, i))
+    return 1;
+  skip = i + ((i < str->len) ? 1 : 0);
+  str->str += skip;
+  str->len -= skip;
+  return 0;
+}
+
+static int read_https_alpn(struct blob *b, const char **ps)
+{
+  struct Curl_str word;
+  struct blob tmp;
+
+  blob_reset(&tmp);
+  if(curlx_str_word(ps, &word, UINT16_MAX))
+    return 1;
+  while(word.len) {
+    if(read_https_alpn_part(&tmp, &word))
+      return 1;
+  }
+
+  if(tmp.dlen > UINT16_MAX)
+    return 1;
+
+  if(blob_add_uint16(b, HTTPS_RR_CODE_ALPN) ||
+     blob_add_uint16(b, (uint16_t)tmp.dlen) ||
+     blob_addn(b, tmp.data, tmp.dlen))
+    return 1;
+  return 0;
+}
+
+static int read_https(struct blob *b, const char *s)
+{
+  struct Curl_str word;
+  curl_off_t n;
+
+  blob_reset(b);
+  /* Parse a HTTPS textual representation inspired by RFC 9460 */
+  curlx_str_passblanks(&s);
+  if(curlx_str_number(&s, &n, UINT16_MAX))
+    return 1;
+  if(blob_add_uint16(b, (uint16_t)n))
+    return 1;
+
+  curlx_str_passblanks(&s);
+  if(curlx_str_word(&s, &word, UINT16_MAX)) {
+    logmsg("https: unable to read target qname, input=%s", s);
+    return 1;
+  }
+  if(blob_add_qname(b, &word))
+    return 1;
+
+  while(*s) {
+    curlx_str_passblanks(&s);
+    if(!*s)
+      break;
+    if(!strncmp("alpn=", s, 5)) {
+      s += 5;
+      if(read_https_alpn(b, &s))
+        return 1;
+    }
+    else if(!strncmp("no-default-alpn", s, 15)) {
+      s += 15;
+      if(blob_add_uint16(b, HTTPS_RR_CODE_NO_DEF_ALPN) ||
+         blob_add_uint16(b, 0))
+        return 1;
+    }
+    else
+      return 1;
+  }
+  return 0;
+}
+
+static void read_instructions(void)
+{
+  char file[256];
+  FILE *f;
+  curlx_struct_stat finfo;
+
+  snprintf(file, sizeof(file), "%s/" INSTRUCTIONS, logdir);
+  if((curlx_stat(file, &finfo) == 0) &&
+     (finfo.st_mtime == finfo_last.st_mtime) &&
+     (finfo.st_size == finfo_last.st_size)
+#ifndef _WIN32
+     && (finfo.st_ino == finfo_last.st_ino)
+#endif
+#ifdef __APPLE__
+     && (finfo.st_mtimespec.tv_nsec == finfo_last.st_mtimespec.tv_nsec)
+#elif defined(_POSIX_C_SOURCE)
+#if _POSIX_C_SOURCE >= 200809L
+     && (finfo.st_mtim.tv_nsec == finfo_last.st_mtim.tv_nsec)
+#endif
+#endif
+     ) {
+    /* looks the same as before, skip reading it again */
+    return;
+  }
+  /* reset defaults */
+  a_delay_ms = aaaa_delay_ms = https_delay_ms = 0;
+  blob_reset(&httpsrr);
+  finfo_last = finfo;
+
+  logmsg("read instructions from %s", file);
+  f = curlx_fopen(file, FOPEN_READTEXT);
+  if(f) {
+    char buf[256];
+    ancount_aaaa = ancount_a = 0;
+    while(fgets(buf, sizeof(buf), f)) {
+      const char *rtype = NULL;
+      char *p = strchr(buf, '\n');
+      if(p) {
+        int rc;
+        *p = 0;
+        if(!strncmp("A: ", buf, 3)) {
+          rc = curlx_inet_pton(AF_INET, &buf[3], ipv4_pref);
+          ancount_a = (rc == 1);
+          rtype = "A";
+        }
+        else if(!strncmp("AAAA: ", buf, 6)) {
+          char *p6 = &buf[6];
+          if(*p6 == '[') {
+            char *pt = strchr(p6, ']');
+            if(pt)
+              *pt = 0;
+            p6++;
+          }
+          rc = curlx_inet_pton(AF_INET6, p6, ipv6_pref);
+          ancount_aaaa = (rc == 1);
+          rtype = "AAAA";
+        }
+        else if(!strncmp("HTTPS: ", buf, 7)) {
+          rc = read_https(&httpsrr, &buf[7]) ? 0 : 1;
+          rtype = "HTTPS";
+        }
+        else if(!strncmp("Delay-A: ", buf, 9)) {
+          curl_off_t ms;
+          const char *pms = &buf[9];
+          rc = 0;
+          if(!curlx_str_number(&pms, &ms, 100000)) {
+            a_delay_ms = (timediff_t)ms;
+            rc = 1;
+          }
+        }
+        else if(!strncmp("Delay-AAAA: ", buf, 12)) {
+          curl_off_t ms;
+          const char *pms = &buf[12];
+          rc = 0;
+          if(!curlx_str_number(&pms, &ms, 100000)) {
+            aaaa_delay_ms = (timediff_t)ms;
+            rc = 1;
+          }
+        }
+        else if(!strncmp("Delay-HTTPS: ", buf, 13)) {
+          curl_off_t ms;
+          const char *pms = &buf[13];
+          rc = 0;
+          if(!curlx_str_number(&pms, &ms, 100000)) {
+            https_delay_ms = (timediff_t)ms;
+            rc = 1;
+          }
+        }
+        else {
+          /* accept empty line */
+          rc = buf[0] ? 0 : 1;
+        }
+        if(rc != 1) {
+          logmsg("Bad line in %s: '%s'\n", file, buf);
+        }
+        else if(rtype) {
+          logmsg("added %s record via '%s'", rtype, buf);
+        }
+      }
+    }
+    logmsg("set delays: A=%" FMT_TIMEDIFF_T "ms AAAA=%" FMT_TIMEDIFF_T
+           "ms HTTPS=%" FMT_TIMEDIFF_T "ms",
+           a_delay_ms, aaaa_delay_ms, https_delay_ms);
+    curlx_fclose(f);
+  }
+  else
+    logmsg("Error opening file '%s'", file);
+}
+
+static int test_dnsd(int argc, const char **argv)
+{
+  srvr_sockaddr_union_t me;
+  ssize_t n = 0;
+  int arg = 1;
+  uint16_t port = 9123; /* UDP */
+  curl_socket_t sock = CURL_SOCKET_BAD;
+  int flag;
+  int rc;
+  int sockerr;
+  char errbuf[STRERROR_LEN];
+  int result = 0;
+  struct resp *resp;
+
+  pidname = ".dnsd.pid";
+  serverlogfile = "log/dnsd.log";
+  serverlogslocked = 0;
+
+  while(argc > arg) {
+    const char *opt;
+    curl_off_t num;
+    if(!strcmp("--verbose", argv[arg])) {
+      arg++;
+      /* nothing yet */
+    }
+    else if(!strcmp("--version", argv[arg])) {
+      printf("dnsd IPv4%s\n",
+#ifdef USE_IPV6
+             "/IPv6"
+#else
+             ""
+#endif
+      );
+      return 0;
+    }
+    else if(!strcmp("--pidfile", argv[arg])) {
+      arg++;
+      if(argc > arg)
+        pidname = argv[arg++];
+    }
+    else if(!strcmp("--portfile", argv[arg])) {
+      arg++;
+      if(argc > arg)
+        portname = argv[arg++];
+    }
+    else if(!strcmp("--logfile", argv[arg])) {
+      arg++;
+      if(argc > arg)
+        serverlogfile = argv[arg++];
+    }
+    else if(!strcmp("--logdir", argv[arg])) {
+      arg++;
+      if(argc > arg)
+        logdir = argv[arg++];
+    }
+    else if(!strcmp("--ipv4", argv[arg])) {
+#ifdef USE_IPV6
+      ipv_inuse = "IPv4";
+      use_ipv6 = FALSE;
+#endif
+      arg++;
+    }
+    else if(!strcmp("--ipv6", argv[arg])) {
+#ifdef USE_IPV6
+      ipv_inuse = "IPv6";
+      use_ipv6 = TRUE;
+#endif
+      arg++;
+    }
+    else if(!strcmp("--port", argv[arg])) {
+      arg++;
+      if(argc > arg) {
+        opt = argv[arg];
+        if(!curlx_str_number(&opt, &num, 0xffff))
+          port = (uint16_t)num;
+        arg++;
+      }
+    }
+    else {
+      if(argv[arg])
+        fprintf(stderr, "unknown option: %s\n", argv[arg]);
+      puts("Usage: dnsd [option]\n"
+           " --version\n"
+           " --logfile [file]\n"
+           " --logdir [directory]\n"
+           " --pidfile [file]\n"
+           " --portfile [file]\n"
+           " --ipv4\n"
+           " --ipv6\n"
+           " --port [port]\n");
+      return 0;
+    }
+  }
+
+  snprintf(loglockfile, sizeof(loglockfile), "%s/%s/dnsd-%s.lock",
+           logdir, SERVERLOGS_LOCKDIR, ipv_inuse);
+
+#ifdef USE_IPV6
+  if(!use_ipv6)
+#endif
+    sock = socket(AF_INET, SOCK_DGRAM, 0);
+#ifdef USE_IPV6
+  else
+    sock = socket(AF_INET6, SOCK_DGRAM, 0);
+#endif
+
+  if(sock == CURL_SOCKET_BAD) {
+    sockerr = SOCKERRNO;
+    logmsg("Error creating socket (%d) %s",
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+    result = 1;
+    goto dnsd_cleanup;
+  }
+
+  flag = 1;
+  if(setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&flag, sizeof(flag))) {
+    sockerr = SOCKERRNO;
+    logmsg("setsockopt(SO_REUSEADDR) failed with error (%d) %s",
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+    result = 1;
+    goto dnsd_cleanup;
+  }
+
+#ifdef USE_IPV6
+  if(!use_ipv6) {
+#endif
+    memset(&me.sa4, 0, sizeof(me.sa4));
+    me.sa4.sin_family = AF_INET;
+    me.sa4.sin_addr.s_addr = INADDR_ANY;
+    me.sa4.sin_port = htons(port);
+    rc = bind(sock, &me.sa, sizeof(me.sa4));
+#ifdef USE_IPV6
+  }
+  else {
+    memset(&me.sa6, 0, sizeof(me.sa6));
+    me.sa6.sin6_family = AF_INET6;
+    me.sa6.sin6_addr = in6addr_any;
+    me.sa6.sin6_port = htons(port);
+    rc = bind(sock, &me.sa, sizeof(me.sa6));
+  }
+#endif /* USE_IPV6 */
+  if(rc) {
+    sockerr = SOCKERRNO;
+    logmsg("Error binding socket on port %hu (%d) %s", port,
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+    result = 1;
+    goto dnsd_cleanup;
+  }
+
+  if(!port) {
+    /* The system was supposed to choose a port number, figure out which
+       port we actually got and update the listener port value with it. */
+    curl_socklen_t la_size;
+    srvr_sockaddr_union_t localaddr;
+    memset(&localaddr, 0, sizeof(localaddr));
+#ifdef USE_IPV6
+    if(!use_ipv6)
+#endif
+      la_size = sizeof(localaddr.sa4);
+#ifdef USE_IPV6
+    else
+      la_size = sizeof(localaddr.sa6);
+#endif
+    if(getsockname(sock, &localaddr.sa, &la_size) < 0) {
+      sockerr = SOCKERRNO;
+      logmsg("getsockname() failed with error (%d) %s",
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+      sclose(sock);
+      goto dnsd_cleanup;
+    }
+    switch(localaddr.sa.sa_family) {
+    case AF_INET:
+      port = ntohs(localaddr.sa4.sin_port);
+      break;
+#ifdef USE_IPV6
+    case AF_INET6:
+      port = ntohs(localaddr.sa6.sin6_port);
+      break;
+#endif
+    default:
+      break;
+    }
+    if(!port) {
+      /* Real failure, listener port shall not be zero beyond this point. */
+      logmsg("Apparently getsockname() succeeded, with listener port zero.");
+      logmsg("A valid reason for this failure is a binary built without");
+      logmsg("proper network library linkage. This might not be the only");
+      logmsg("reason, but double check it before anything else.");
+      result = 2;
+      goto dnsd_cleanup;
+    }
+  }
+
+  dnsd_wrotepidfile = write_pidfile(pidname);
+  if(!dnsd_wrotepidfile) {
+    result = 1;
+    goto dnsd_cleanup;
+  }
+
+  if(portname) {
+    dnsd_wroteportfile = write_portfile(portname, port);
+    if(!dnsd_wroteportfile) {
+      result = 1;
+      goto dnsd_cleanup;
+    }
+  }
+
+  logmsg("Running %s version on port UDP/%d", ipv_inuse, (int)port);
+  curlx_nonblock(sock, TRUE);
+
+  for(;;) {
+    uint16_t id = 0;
+    uint8_t inbuffer[1500];
+    srvr_sockaddr_union_t from;
+    curl_socklen_t fromlen;
+    uint8_t qbuf[256]; /* query storage */
+    size_t qlen = 0; /* query size */
+    uint16_t qtype = 0;
+    timediff_t timeout_ms = 0;
+    fromlen = sizeof(from);
+#ifdef USE_IPV6
+    if(!use_ipv6)
+#endif
+      fromlen = sizeof(from.sa4);
+#ifdef USE_IPV6
+    else
+      fromlen = sizeof(from.sa6);
+#endif
+
+    timeout_ms = send_resp_queue(sock);
+
+    {
+      fd_set readfds;
+      struct timeval tv;
+      int maxfd = (int)sock;
+
+      FD_ZERO(&readfds);
+      FD_SET(sock, &readfds);
+      if(!timeout_ms || (timeout_ms > 100))
+        timeout_ms = 100;
+
+      rc = select(maxfd + 1, &readfds, NULL, NULL,
+                  curlx_mstotv(&tv, timeout_ms));
+
+      if(rc == -1) {
+        logmsg("error %d returned by select()", SOCKERRNO);
+      }
+      else if(!rc) { /* timeout */
+        continue;
+      }
+    }
+    n = (ssize_t)recvfrom(sock, (char *)inbuffer, sizeof(inbuffer), 0,
+                          &from.sa, &fromlen);
+    if(got_exit_signal)
+      break;
+    if(n < 0) {
+      logmsg("recvfrom");
+      result = 3;
+      break;
+    }
+
+    /* read once per incoming query, which is probably more than one
+       per test case */
+    read_instructions();
+
+    ++query_id;
+    store_incoming(query_id, inbuffer, n,
+                   qbuf, sizeof(qbuf), &qlen, &qtype, &id);
+
+    set_advisor_read_lock(loglockfile);
+    serverlogslocked = 1;
+
+    resp = create_resp(query_id, &from.sa, fromlen, qbuf,
+                       qlen, qtype, id);
+    if(!resp)
+      logmsg("error creating response");
+    else
+      queue_resp(resp);
+
+    if(got_exit_signal)
+      break;
+
+    if(serverlogslocked) {
+      serverlogslocked = 0;
+      clear_advisor_read_lock(loglockfile);
+    }
+  }
+
+dnsd_cleanup:
+
+#if 0
+  if((peer != sock) && (peer != CURL_SOCKET_BAD))
+    sclose(peer);
+#endif
+
+  if(sock != CURL_SOCKET_BAD)
+    sclose(sock);
+
+  if(got_exit_signal)
+    logmsg("signalled to die");
+
+  if(dnsd_wrotepidfile)
+    unlink(pidname);
+  if(dnsd_wroteportfile)
+    unlink(portname);
+
+  if(serverlogslocked) {
+    serverlogslocked = 0;
+    clear_advisor_read_lock(loglockfile);
+  }
+
+  clear_resp_queue();
+  restore_signal_handlers(TRUE);
+
+  if(got_exit_signal) {
+    logmsg("========> %s dnsd (port: %d pid: %ld) exits with signal (%d)",
+           ipv_inuse, (int)port, (long)our_getpid(), exit_signal);
+    /*
+     * To properly set the return status of the process we
+     * must raise the same signal SIGINT or SIGTERM that we
+     * caught and let the old handler take care of it.
+     */
+    raise(exit_signal);
+  }
+
+  logmsg("========> dnsd quits");
+  return result;
+}
+#else
+static int test_dnsd(int argc, const char **argv)
+{
+  (void)argc;
+  (void)argv;
+  fprintf(stderr, "dnsd on AmigaOS is unsupported\n");
+  return 1;
+}
+#endif
diff --git a/third-party/curl/tests/server/fake_ntlm.c b/third-party/curl/tests/server/fake_ntlm.c
deleted file mode 100644
index fe59578f42..0000000000
--- a/third-party/curl/tests/server/fake_ntlm.c
+++ /dev/null
@@ -1,286 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Mandy Wu, <mandy.wu@intel.com>
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "server_setup.h"
-
-/*
- * This is a fake ntlm_auth, which is used for testing NTLM single-sign-on.
- * When DEBUGBUILD is defined, libcurl invoke this tool instead of real winbind
- * daemon helper /usr/bin/ntlm_auth. This tool will accept commands and
- * responses with a pre-written string saved in test case test2005.
- */
-
-#define ENABLE_CURLX_PRINTF
-#include "curlx.h" /* from the private lib dir */
-#include "getpart.h"
-#include "util.h"
-
-/* include memdebug.h last */
-#include "memdebug.h"
-
-#define LOGFILE "%s/fake_ntlm%ld.log"
-const char *logdir = "log";
-
-const char *serverlogfile;
-
-/*
- * Returns an allocated buffer with printable representation of input
- * buffer contents or returns NULL on out of memory condition.
- */
-static char *printable(char *inbuf, size_t inlength)
-{
-  char *outbuf;
-  char *newbuf;
-  size_t newsize;
-  size_t outsize;
-  size_t outincr = 0;
-  size_t i, o = 0;
-
-#define HEX_FMT_STR  "[0x%02X]"
-#define HEX_STR_LEN  6
-#define NOTHING_STR  "[NOTHING]"
-#define NOTHING_LEN  9
-
-  if(!inlength)
-    inlength = strlen(inbuf);
-
-  if(inlength) {
-    outincr = ((inlength/2) < (HEX_STR_LEN + 1)) ?
-      HEX_STR_LEN + 1 : inlength/2;
-    outsize = inlength + outincr;
-  }
-  else
-    outsize = NOTHING_LEN + 1;
-
-  outbuf = malloc(outsize);
-  if(!outbuf)
-    return NULL;
-
-  if(!inlength) {
-    msnprintf(&outbuf[0], outsize, "%s", NOTHING_STR);
-    return outbuf;
-  }
-
-  for(i = 0; i<inlength; i++) {
-
-    if(o > outsize - (HEX_STR_LEN + 1)) {
-      newsize = outsize + outincr;
-      newbuf = realloc(outbuf, newsize);
-      if(!newbuf) {
-        free(outbuf);
-        return NULL;
-      }
-      outbuf = newbuf;
-      outsize = newsize;
-    }
-
-    if((inbuf[i] > 0x20) && (inbuf[i] < 0x7F)) {
-      outbuf[o] = inbuf[i];
-      o++;
-    }
-    else {
-      msnprintf(&outbuf[o], outsize - o, HEX_FMT_STR, inbuf[i]);
-      o += HEX_STR_LEN;
-    }
-
-  }
-  outbuf[o] = '\0';
-
-  return outbuf;
-}
-
-int main(int argc, char *argv[])
-{
-  char buf[1024];
-  char logfilename[256];
-  FILE *stream;
-  int error;
-  char *type1_input = NULL, *type3_input = NULL;
-  char *type1_output = NULL, *type3_output = NULL;
-  size_t size = 0;
-  long testnum;
-  const char *env;
-  int arg = 1;
-  const char *helper_user = "unknown";
-  const char *helper_proto = "unknown";
-  const char *helper_domain = "unknown";
-  bool use_cached_creds = FALSE;
-  char *msgbuf;
-
-  buf[0] = '\0';
-
-  while(argc > arg) {
-    if(!strcmp("--use-cached-creds", argv[arg])) {
-      use_cached_creds = TRUE;
-      arg++;
-    }
-    else if(!strcmp("--helper-protocol", argv[arg])) {
-      arg++;
-      if(argc > arg)
-        helper_proto = argv[arg++];
-    }
-    else if(!strcmp("--username", argv[arg])) {
-      arg++;
-      if(argc > arg)
-        helper_user = argv[arg++];
-    }
-    else if(!strcmp("--domain", argv[arg])) {
-      arg++;
-      if(argc > arg)
-        helper_domain = argv[arg++];
-    }
-    else {
-      puts("Usage: fake_ntlm [option]\n"
-           " --use-cached-creds\n"
-           " --helper-protocol [protocol]\n"
-           " --username [username]\n"
-           " --domain [domain]");
-      exit(1);
-    }
-  }
-
-  env = getenv("CURL_NTLM_LOGDIR");
-  if(env) {
-    logdir = env;
-  }
-
-  env = getenv("CURL_NTLM_AUTH_TESTNUM");
-  if(env) {
-    char *endptr;
-    long lnum = strtol(env, &endptr, 10);
-    if((endptr != env + strlen(env)) || (lnum < 1L)) {
-      fprintf(stderr, "Test number not valid in CURL_NTLM_AUTH_TESTNUM");
-      exit(1);
-    }
-    testnum = lnum;
-  }
-  else {
-    fprintf(stderr, "Test number not specified in CURL_NTLM_AUTH_TESTNUM");
-    exit(1);
-  }
-
-  /* logmsg cannot be used until this file name is set */
-  msnprintf(logfilename, sizeof(logfilename), LOGFILE, logdir, testnum);
-  serverlogfile = logfilename;
-
-  logmsg("fake_ntlm (user: %s) (proto: %s) (domain: %s) (cached creds: %s)",
-         helper_user, helper_proto, helper_domain,
-         (use_cached_creds) ? "yes" : "no");
-
-  env = getenv("CURL_NTLM_AUTH_SRCDIR");
-  if(env) {
-    path = env;
-  }
-
-  stream = test2fopen(testnum, logdir);
-  if(!stream) {
-    error = errno;
-    logmsg("fopen() failed with error: %d %s", error, strerror(error));
-    logmsg("Couldn't open test file %ld", testnum);
-    exit(1);
-  }
-  else {
-    /* get the ntlm_auth input/output */
-    error = getpart(&type1_input, &size, "ntlm_auth_type1", "input", stream);
-    fclose(stream);
-    if(error || size == 0) {
-      logmsg("getpart() type 1 input failed with error: %d", error);
-      exit(1);
-    }
-  }
-
-  stream = test2fopen(testnum, logdir);
-  if(!stream) {
-    error = errno;
-    logmsg("fopen() failed with error: %d %s", error, strerror(error));
-    logmsg("Couldn't open test file %ld", testnum);
-  }
-  else {
-    size = 0;
-    error = getpart(&type3_input, &size, "ntlm_auth_type3", "input", stream);
-    fclose(stream);
-    if(error || size == 0) {
-      logmsg("getpart() type 3 input failed with error: %d", error);
-      exit(1);
-    }
-  }
-
-  while(fgets(buf, sizeof(buf), stdin)) {
-    if(strcmp(buf, type1_input) == 0) {
-      stream = test2fopen(testnum, logdir);
-      if(!stream) {
-        error = errno;
-        logmsg("fopen() failed with error: %d %s", error, strerror(error));
-        logmsg("Couldn't open test file %ld", testnum);
-        exit(1);
-      }
-      else {
-        size = 0;
-        error = getpart(&type1_output, &size, "ntlm_auth_type1", "output",
-                        stream);
-        fclose(stream);
-        if(error || size == 0) {
-          logmsg("getpart() type 1 output failed with error: %d", error);
-          exit(1);
-        }
-      }
-      printf("%s", type1_output);
-      fflush(stdout);
-    }
-    else if(strncmp(buf, type3_input, strlen(type3_input)) == 0) {
-      stream = test2fopen(testnum, logdir);
-      if(!stream) {
-        error = errno;
-        logmsg("fopen() failed with error: %d %s", error, strerror(error));
-        logmsg("Couldn't open test file %ld", testnum);
-        exit(1);
-      }
-      else {
-        size = 0;
-        error = getpart(&type3_output, &size, "ntlm_auth_type3", "output",
-                        stream);
-        fclose(stream);
-        if(error || size == 0) {
-          logmsg("getpart() type 3 output failed with error: %d", error);
-          exit(1);
-        }
-      }
-      printf("%s", type3_output);
-      fflush(stdout);
-    }
-    else {
-      printf("Unknown request\n");
-      msgbuf = printable(buf, 0);
-      if(msgbuf) {
-        logmsg("invalid input: '%s'\n", msgbuf);
-        free(msgbuf);
-      }
-      else
-        logmsg("OOM formatting invalid input: '%s'\n", buf);
-      exit(1);
-    }
-  }
-  logmsg("Exit");
-  return 1;
-}
diff --git a/third-party/curl/tests/server/first.c b/third-party/curl/tests/server/first.c
new file mode 100644
index 0000000000..31ba5f72b4
--- /dev/null
+++ b/third-party/curl/tests/server/first.c
@@ -0,0 +1,59 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+#include <stdio.h>
+
+int main(int argc, const char **argv)
+{
+  entry_func_t entry_func;
+  const char *entry_name;
+  size_t tmp;
+
+  if(argc < 2) {
+    fprintf(stderr, "Pass servername as first argument\n");
+    return 1;
+  }
+
+  entry_name = argv[1];
+  entry_func = NULL;
+  for(tmp = 0; s_entries[tmp].ptr; ++tmp) {
+    if(!strcmp(entry_name, s_entries[tmp].name)) {
+      entry_func = s_entries[tmp].ptr;
+      break;
+    }
+  }
+
+  if(!entry_func) {
+    fprintf(stderr, "Test '%s' not found.\n", entry_name);
+    return 99;
+  }
+
+#ifdef _WIN32
+  if(win32_init())
+    return 2;
+#endif
+
+  return entry_func(argc - 1, argv + 1);
+}
diff --git a/third-party/curl/tests/server/first.h b/third-party/curl/tests/server/first.h
new file mode 100644
index 0000000000..3bd75a2d88
--- /dev/null
+++ b/third-party/curl/tests/server/first.h
@@ -0,0 +1,181 @@
+#ifndef HEADER_SERVER_FIRST_H
+#define HEADER_SERVER_FIRST_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+/* Test servers are standalone programs that do not use libcurl
+ * library.  For convenience and to ease portability of these servers,
+ * some source code files from the libcurl subdirectory are also used
+ * to build the servers.  In order to achieve proper linkage of these
+ * files on Windows targets it is necessary to build the test servers
+ * with CURL_STATICLIB defined, independently of how libcurl is built.
+ * For other platforms, this macro is a no-op and safe to set.
+ */
+#define CURL_STATICLIB
+
+#define WITHOUT_LIBCURL
+#define CURL_NO_OLDIES
+
+#include "curl_setup.h"
+
+typedef int (*entry_func_t)(int, const char **);
+
+struct entry_s {
+  const char *name;
+  entry_func_t ptr;
+};
+
+extern const struct entry_s s_entries[];
+
+#include <signal.h>
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_NETINET_IN6_H
+#include <netinet/in6.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+#ifdef HAVE_NETDB_H
+#include <netdb.h>
+#endif
+
+#include "curlx/base64.h" /* for curlx_base64* */
+#include "curlx/fopen.h" /* for curlx_f*() */
+#include "curlx/inet_ntop.h" /* for curlx_inet_ntop() */
+#include "curlx/inet_pton.h" /* for curlx_inet_pton() */
+#include "curlx/nonblock.h" /* for curlx_nonblock() */
+#include "curlx/strcopy.h" /* for curlx_strcopy() */
+#include "curlx/strerr.h" /* for curlx_strerror() */
+#include "curlx/strparse.h" /* for curlx_str_* parsing functions */
+#include "curlx/timediff.h" /* for timediff_t type and related functions */
+#include "curlx/timeval.h" /* for curlx_now type and related functions */
+#include "curlx/wait.h" /* for curlx_wait_ms() */
+#include "curlx/winapi.h" /* for curlx_winapi_strerror() */
+
+#ifdef _WIN32
+#include <curlx/snprintf.h>
+#define snprintf curlx_win32_snprintf
+#endif
+
+#ifdef _WIN32
+#  define CURL_STRNICMP(p1, p2, n) _strnicmp(p1, p2, n)
+#elif defined(HAVE_STRCASECMP)
+#  ifdef HAVE_STRINGS_H
+#  include <strings.h>
+#  endif
+#  define CURL_STRNICMP(p1, p2, n) strncasecmp(p1, p2, n)
+#elif defined(HAVE_STRCMPI)
+#  define CURL_STRNICMP(p1, p2, n) strncmpi(p1, p2, n)
+#elif defined(HAVE_STRICMP)
+#  define CURL_STRNICMP(p1, p2, n) strnicmp(p1, p2, n)
+#else
+#  error "missing case insensitive comparison function"
+#endif
+
+enum {
+  DOCNUMBER_NOTHING    = -7,
+  DOCNUMBER_QUIT       = -6,
+  DOCNUMBER_BADCONNECT = -5,
+  DOCNUMBER_INTERNAL   = -4,
+  DOCNUMBER_CONNECT    = -3,
+  DOCNUMBER_WERULEZ    = -2,
+  DOCNUMBER_404        = -1
+};
+
+#ifdef USE_UNIX_SOCKETS
+#ifdef HAVE_SYS_UN_H
+#include <sys/un.h> /* for sockaddr_un */
+#endif
+#endif /* USE_UNIX_SOCKETS */
+
+typedef union {
+  struct sockaddr      sa;
+  struct sockaddr_in   sa4;
+#ifdef USE_IPV6
+  struct sockaddr_in6  sa6;
+#endif
+#ifdef USE_UNIX_SOCKETS
+  struct sockaddr_un   sau;
+#endif
+} srvr_sockaddr_union_t;
+
+/* getpart */
+#define GPE_NO_BUFFER_SPACE  (-2)
+#define GPE_OUT_OF_MEMORY    (-1)
+#define GPE_OK               0
+#define GPE_END_OF_FILE      1
+
+extern int getpart(char **outbuf, size_t *outlen,
+                   const char *main, const char *sub, FILE *stream);
+
+/* utility functions */
+extern void logmsg(const char *msg, ...) CURL_PRINTF(1, 2);
+extern void loghex(const unsigned char *buffer, ssize_t len);
+extern int win32_init(void);
+extern FILE *test2fopen(long testno, const char *logdir2);
+extern curl_off_t our_getpid(void);
+extern int write_pidfile(const char *filename);
+extern int write_portfile(const char *filename, int port);
+extern void set_advisor_read_lock(const char *filename);
+extern void clear_advisor_read_lock(const char *filename);
+extern void storerequest(const char *reqbuf, size_t totalsize,
+                         const char *filename);
+static volatile int got_exit_signal = 0;
+static volatile int exit_signal = 0;
+#ifdef _WIN32
+static HANDLE exit_event = NULL;
+#endif
+extern void install_signal_handlers(bool keep_sigalrm);
+extern void restore_signal_handlers(bool keep_sigalrm);
+#ifdef USE_UNIX_SOCKETS
+extern int bind_unix_socket(curl_socket_t sock, const char *unix_socket,
+                            struct sockaddr_un *sau);
+#endif
+extern curl_socket_t sockdaemon(curl_socket_t sock,
+                                unsigned short *listenport,
+                                const char *unix_socket,
+                                bool bind_only);
+
+/* global variables */
+static const char *srcpath = "."; /* pointing to the test directory */
+static const char *pidname = NULL;
+static const char *portname = NULL; /* none by default */
+static const char *serverlogfile = NULL;
+static int serverlogslocked;
+static const char *configfile = NULL;
+static const char *logdir = "log";
+static char loglockfile[256];
+#ifdef USE_IPV6
+static bool use_ipv6 = FALSE;
+#endif
+static const char *ipv_inuse = "IPv4";
+static unsigned short server_port = 0;
+static const char *socket_type = "IPv4";
+static int socket_domain = AF_INET;
+
+#define SERVERLOGS_LOCKDIR "lock"  /* within logdir */
+
+#endif /* HEADER_SERVER_FIRST_H */
diff --git a/third-party/curl/tests/server/getpart.c b/third-party/curl/tests/server/getpart.c
index 7d3bff75a6..0cc95f6333 100644
--- a/third-party/curl/tests/server/getpart.c
+++ b/third-party/curl/tests/server/getpart.c
@@ -21,25 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "server_setup.h"
-
-#include "getpart.h"
-
-#define ENABLE_CURLX_PRINTF
-/* make the curlx header define all printf() functions to use the curlx_*
-   versions instead */
-#include "curlx.h" /* from the private lib dir */
-
-/* just to please curl_base64.h we create a fake struct */
-struct Curl_easy {
-  int fake;
-};
-
-#include "curl_base64.h"
-#include "curl_memory.h"
-
-/* include memdebug.h last */
-#include "memdebug.h"
+#include "first.h"
 
 #define EAT_SPACE(p) while(*(p) && ISSPACE(*(p))) (p)++
 
@@ -51,52 +33,6 @@ struct Curl_easy {
 #define show(x) Curl_nop_stmt
 #endif
 
-#if defined(_MSC_VER) && defined(_DLL)
-#  pragma warning(disable:4232) /* MSVC extension, dllimport identity */
-#endif
-
-curl_malloc_callback Curl_cmalloc = (curl_malloc_callback)malloc;
-curl_free_callback Curl_cfree = (curl_free_callback)free;
-curl_realloc_callback Curl_crealloc = (curl_realloc_callback)realloc;
-curl_strdup_callback Curl_cstrdup = (curl_strdup_callback)strdup;
-curl_calloc_callback Curl_ccalloc = (curl_calloc_callback)calloc;
-#if defined(WIN32) && defined(UNICODE)
-curl_wcsdup_callback Curl_cwcsdup = (curl_wcsdup_callback)_wcsdup;
-#endif
-
-#if defined(_MSC_VER) && defined(_DLL)
-#  pragma warning(default:4232) /* MSVC extension, dllimport identity */
-#endif
-
-
-/*
- * Curl_convert_clone() returns a malloced copy of the source string (if
- * returning CURLE_OK), with the data converted to network format. This
- * function is used by base64 code in libcurl built to support data
- * conversion. This is a DUMMY VERSION that returns data unmodified - for
- * use by the test server only.
- */
-CURLcode Curl_convert_clone(struct Curl_easy *data,
-                            const char *indata,
-                            size_t insize,
-                            char **outbuf);
-CURLcode Curl_convert_clone(struct Curl_easy *data,
-                            const char *indata,
-                            size_t insize,
-                            char **outbuf)
-{
-  char *convbuf;
-  (void)data;
-
-  convbuf = malloc(insize);
-  if(!convbuf)
-    return CURLE_OUT_OF_MEMORY;
-
-  memcpy(convbuf, indata, insize);
-  *outbuf = convbuf;
-  return CURLE_OK;
-}
-
 /*
  * line_length()
  *
@@ -114,7 +50,7 @@ static size_t line_length(const char *buffer, int bytestocheck)
   }
   if(*buffer != '\n') {
     /*
-     * We didn't find a new line so the last byte must be a
+     * We did not find a new line so the last byte must be a
      * '\0' character inserted by fgets() which we should not
      * count.
      */
@@ -131,7 +67,7 @@ static size_t line_length(const char *buffer, int bytestocheck)
  *
  * Calling function may call this multiple times with same 'buffer'
  * and 'bufsize' pointers to avoid multiple buffer allocations. Buffer
- * will be reallocated and 'bufsize' increased until whole line fits in
+ * is reallocated and 'bufsize' increased until whole line fits in
  * buffer before returning it.
  *
  * Calling function is responsible to free allocated buffer.
@@ -141,7 +77,6 @@ static size_t line_length(const char *buffer, int bytestocheck)
  *   GPE_END_OF_FILE
  *   GPE_OK
  */
-
 static int readline(char **buffer, size_t *bufsize, size_t *length,
                     FILE *stream)
 {
@@ -149,7 +84,7 @@ static int readline(char **buffer, size_t *bufsize, size_t *length,
   char *newptr;
 
   if(!*buffer) {
-    *buffer = calloc(128, 1);
+    *buffer = calloc(1, 128);
     if(!*buffer)
       return GPE_OUT_OF_MEMORY;
     *bufsize = 128;
@@ -158,8 +93,10 @@ static int readline(char **buffer, size_t *bufsize, size_t *length,
   for(;;) {
     int bytestoread = curlx_uztosi(*bufsize - offset);
 
-    if(!fgets(*buffer + offset, bytestoread, stream))
+    if(!fgets(*buffer + offset, bytestoread, stream)) {
+      *length = 0;
       return (offset != 0) ? GPE_OK : GPE_END_OF_FILE;
+    }
 
     *length = offset + line_length(*buffer + offset, bytestoread);
     if(*(*buffer + *length - 1) == '\n')
@@ -193,9 +130,9 @@ static int readline(char **buffer, size_t *bufsize, size_t *length,
  *
  * If the source buffer is indicated to be base64 encoded, this appends the
  * decoded data, binary or whatever, to the destination. The source buffer
- * may not hold binary data, only a null terminated string is valid content.
+ * may not hold binary data, only a null-terminated string is valid content.
  *
- * Destination buffer will be enlarged and relocated as needed.
+ * Destination buffer is enlarged and relocated as needed.
  *
  * Calling function is responsible to provide preallocated destination
  * buffer and also to deallocate it when no longer needed.
@@ -204,13 +141,13 @@ static int readline(char **buffer, size_t *bufsize, size_t *length,
  *   GPE_OUT_OF_MEMORY
  *   GPE_OK
  */
-
-static int appenddata(char  **dst_buf,   /* dest buffer */
-                      size_t *dst_len,   /* dest buffer data length */
-                      size_t *dst_alloc, /* dest buffer allocated size */
-                      char   *src_buf,   /* source buffer */
-                      size_t  src_len,   /* source buffer length */
-                      int     src_b64)   /* != 0 if source is base64 encoded */
+static int appenddata(char **dst_buf,      /* dest buffer */
+                      size_t *dst_len,     /* dest buffer data length */
+                      size_t *dst_alloc,   /* dest buffer allocated size */
+                      const char *src_buf, /* source buffer */
+                      size_t src_len,      /* source buffer length */
+                      int src_b64)         /* != 0 if source is base64
+                                              encoded */
 {
   size_t need_alloc = 0;
 
@@ -246,10 +183,10 @@ static int appenddata(char  **dst_buf,   /* dest buffer */
   return GPE_OK;
 }
 
-static int decodedata(char  **buf,   /* dest buffer */
-                      size_t *len)   /* dest buffer data length */
+static int decodedata(char **buf,  /* dest buffer */
+                      size_t *len) /* dest buffer data length */
 {
-  CURLcode error = CURLE_OK;
+  CURLcode result = CURLE_OK;
   unsigned char *buf64 = NULL;
   size_t src_len = 0;
 
@@ -257,17 +194,17 @@ static int decodedata(char  **buf,   /* dest buffer */
     return GPE_OK;
 
   /* base64 decode the given buffer */
-  error = Curl_base64_decode(*buf, &buf64, &src_len);
-  if(error)
+  result = curlx_base64_decode(*buf, &buf64, &src_len);
+  if(result)
     return GPE_OUT_OF_MEMORY;
 
   if(!src_len) {
     /*
-    ** currently there is no way to tell apart an OOM condition in
-    ** Curl_base64_decode() from zero length decoded data. For now,
-    ** let's just assume it is an OOM condition, currently we have
-    ** no input for this function that decodes to zero length data.
-    */
+     * currently there is no way to tell apart an OOM condition in
+     * curlx_base64_decode() from zero length decoded data. For now,
+     * let's assume it is an OOM condition, currently we have
+     * no input for this function that decodes to zero length data.
+     */
     free(buf64);
 
     return GPE_OUT_OF_MEMORY;
@@ -293,8 +230,8 @@ static int decodedata(char  **buf,   /* dest buffer */
  * Data is returned in a dynamically allocated buffer, a pointer to this data
  * and the size of the data is stored at the addresses that caller specifies.
  *
- * If the returned data is a string the returned size will be the length of
- * the string excluding null termination. Otherwise it will just be the size
+ * If the returned data is a string the returned size is the length of
+ * the string excluding null-termination. Otherwise it is the size
  * of the returned binary data.
  *
  * Calling function is responsible to free returned buffer.
@@ -304,22 +241,21 @@ static int decodedata(char  **buf,   /* dest buffer */
  *   GPE_OUT_OF_MEMORY
  *   GPE_OK
  */
-
 int getpart(char **outbuf, size_t *outlen,
             const char *main, const char *sub, FILE *stream)
 {
-# define MAX_TAG_LEN 200
-  char couter[MAX_TAG_LEN + 1]; /* current outermost section */
-  char cmain[MAX_TAG_LEN + 1];  /* current main section */
-  char csub[MAX_TAG_LEN + 1];   /* current sub section */
-  char ptag[MAX_TAG_LEN + 1];   /* potential tag */
-  char patt[MAX_TAG_LEN + 1];   /* potential attributes */
+#define MAX_TAG_LEN 200
+  char curouter[MAX_TAG_LEN + 1]; /* current outermost section */
+  char curmain[MAX_TAG_LEN + 1];  /* current main section */
+  char cursub[MAX_TAG_LEN + 1];   /* current sub section */
+  char ptag[MAX_TAG_LEN + 1];     /* potential tag */
+  char patt[MAX_TAG_LEN + 1];     /* potential attributes */
   char *buffer = NULL;
   char *ptr;
   char *end;
   union {
     ssize_t sig;
-     size_t uns;
+    size_t uns;
   } len;
   size_t bufsize = 0;
   size_t outalloc = 256;
@@ -343,7 +279,7 @@ int getpart(char **outbuf, size_t *outlen,
     return GPE_OUT_OF_MEMORY;
   *(*outbuf) = '\0';
 
-  couter[0] = cmain[0] = csub[0] = ptag[0] = patt[0] = '\0';
+  curouter[0] = curmain[0] = cursub[0] = ptag[0] = patt[0] = '\0';
 
   while((error = readline(&buffer, &bufsize, &datalen, stream)) == GPE_OK) {
 
@@ -353,8 +289,7 @@ int getpart(char **outbuf, size_t *outlen,
     if('<' != *ptr) {
       if(in_wanted_part) {
         show(("=> %s", buffer));
-        error = appenddata(outbuf, outlen, &outalloc, buffer, datalen,
-                           base64);
+        error = appenddata(outbuf, outlen, &outalloc, buffer, datalen, base64);
         if(error)
           break;
       }
@@ -365,8 +300,8 @@ int getpart(char **outbuf, size_t *outlen,
 
     if('/' == *ptr) {
       /*
-      ** closing section tag
-      */
+       * closing section tag
+       */
 
       ptr++;
       end = ptr;
@@ -379,14 +314,11 @@ int getpart(char **outbuf, size_t *outlen,
       memcpy(ptag, ptr, len.uns);
       ptag[len.uns] = '\0';
 
-      if((STATE_INSUB == state) && !strcmp(csub, ptag)) {
+      if((STATE_INSUB == state) && !strcmp(cursub, ptag)) {
         /* end of current sub section */
         state = STATE_INMAIN;
-        csub[0] = '\0';
+        cursub[0] = '\0';
         if(in_wanted_part) {
-          /* end of wanted part */
-          in_wanted_part = 0;
-
           /* Do we need to base64 decode the data? */
           if(base64) {
             error = decodedata(outbuf, outlen);
@@ -398,14 +330,11 @@ int getpart(char **outbuf, size_t *outlen,
           break;
         }
       }
-      else if((STATE_INMAIN == state) && !strcmp(cmain, ptag)) {
+      else if((STATE_INMAIN == state) && !strcmp(curmain, ptag)) {
         /* end of current main section */
         state = STATE_OUTER;
-        cmain[0] = '\0';
+        curmain[0] = '\0';
         if(in_wanted_part) {
-          /* end of wanted part */
-          in_wanted_part = 0;
-
           /* Do we need to base64 decode the data? */
           if(base64) {
             error = decodedata(outbuf, outlen);
@@ -417,22 +346,18 @@ int getpart(char **outbuf, size_t *outlen,
           break;
         }
       }
-      else if((STATE_OUTER == state) && !strcmp(couter, ptag)) {
+      else if((STATE_OUTER == state) && !strcmp(curouter, ptag)) {
         /* end of outermost file section */
         state = STATE_OUTSIDE;
-        couter[0] = '\0';
-        if(in_wanted_part) {
-          /* end of wanted part */
-          in_wanted_part = 0;
+        curouter[0] = '\0';
+        if(in_wanted_part)
           break;
-        }
       }
-
     }
     else if(!in_wanted_part) {
       /*
-      ** opening section tag
-      */
+       * opening section tag
+       */
 
       /* get potential tag */
       end = ptr;
@@ -467,27 +392,27 @@ int getpart(char **outbuf, size_t *outlen,
 
       if(STATE_OUTSIDE == state) {
         /* outermost element (<testcase>) */
-        strcpy(couter, ptag);
+        curlx_strcopy(curouter, sizeof(curouter), ptag, strlen(ptag));
         state = STATE_OUTER;
         continue;
       }
       else if(STATE_OUTER == state) {
         /* start of a main section */
-        strcpy(cmain, ptag);
+        curlx_strcopy(curmain, sizeof(curmain), ptag, strlen(ptag));
         state = STATE_INMAIN;
         continue;
       }
       else if(STATE_INMAIN == state) {
         /* start of a sub section */
-        strcpy(csub, ptag);
+        curlx_strcopy(cursub, sizeof(cursub), ptag, strlen(ptag));
         state = STATE_INSUB;
-        if(!strcmp(cmain, main) && !strcmp(csub, sub)) {
+        if(!strcmp(curmain, main) && !strcmp(cursub, sub)) {
           /* start of wanted part */
           in_wanted_part = 1;
           if(strstr(patt, "base64="))
-              /* bit rough test, but "mostly" functional, */
-              /* treat wanted part data as base64 encoded */
-              base64 = 1;
+            /* bit rough test, but "mostly" functional, */
+            /* treat wanted part data as base64 encoded */
+            base64 = 1;
           if(strstr(patt, "nonewline=")) {
             show(("* setting nonewline\n"));
             nonewline = 1;
@@ -495,7 +420,6 @@ int getpart(char **outbuf, size_t *outlen,
         }
         continue;
       }
-
     }
 
     if(in_wanted_part) {
diff --git a/third-party/curl/tests/server/getpart.h b/third-party/curl/tests/server/getpart.h
deleted file mode 100644
index e9323d4c9a..0000000000
--- a/third-party/curl/tests/server/getpart.h
+++ /dev/null
@@ -1,36 +0,0 @@
-#ifndef HEADER_CURL_SERVER_GETPART_H
-#define HEADER_CURL_SERVER_GETPART_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "server_setup.h"
-
-#define GPE_NO_BUFFER_SPACE -2
-#define GPE_OUT_OF_MEMORY   -1
-#define GPE_OK               0
-#define GPE_END_OF_FILE      1
-
-int getpart(char **outbuf, size_t *outlen,
-            const char *main, const char *sub, FILE *stream);
-
-#endif /* HEADER_CURL_SERVER_GETPART_H */
diff --git a/third-party/curl/tests/server/mqttd.c b/third-party/curl/tests/server/mqttd.c
index e6e5cf0635..286495a63e 100644
--- a/third-party/curl/tests/server/mqttd.c
+++ b/third-party/curl/tests/server/mqttd.c
@@ -21,10 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "server_setup.h"
-#include <stdlib.h>
-#include <string.h>
-#include "util.h"
+#include "first.h"
 
 /* Function
  *
@@ -33,181 +30,121 @@
  * Read commands from FILE (set with --config). The commands control how to
  * act and is reset to defaults each client TCP connect.
  *
- * Config file keywords:
- *
- * TODO
  */
 
 /* based on sockfilt.c */
 
-#ifdef HAVE_SIGNAL_H
-#include <signal.h>
-#endif
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-#ifdef HAVE_NETINET_IN6_H
-#include <netinet/in6.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
-
-#define ENABLE_CURLX_PRINTF
-/* make the curlx header define all printf() functions to use the curlx_*
-   versions instead */
-#include "curlx.h" /* from the private lib dir */
-#include "getpart.h"
-#include "inet_pton.h"
-#include "server_sockaddr.h"
-#include "warnless.h"
-
-/* include memdebug.h last */
-#include "memdebug.h"
-
-#ifdef USE_WINSOCK
-#undef  EINTR
-#define EINTR    4 /* errno.h value */
-#undef  EAGAIN
-#define EAGAIN  11 /* errno.h value */
-#undef  ENOMEM
-#define ENOMEM  12 /* errno.h value */
-#undef  EINVAL
-#define EINVAL  22 /* errno.h value */
-#endif
-
-#define DEFAULT_PORT 1883 /* MQTT default port */
-
-#ifndef DEFAULT_LOGFILE
-#define DEFAULT_LOGFILE "log/mqttd.log"
-#endif
-
-#ifndef DEFAULT_CONFIG
-#define DEFAULT_CONFIG "mqttd.config"
-#endif
-
 #define MQTT_MSG_CONNECT    0x10
 #define MQTT_MSG_CONNACK    0x20
 #define MQTT_MSG_PUBLISH    0x30
-#define MQTT_MSG_PUBACK     0x40
+/* #define MQTT_MSG_PUBACK     0x40 */
 #define MQTT_MSG_SUBSCRIBE  0x82
 #define MQTT_MSG_SUBACK     0x90
+#define MQTT_MSG_PINGRESP   0xd0
 #define MQTT_MSG_DISCONNECT 0xe0
 
-#define MQTT_CONNACK_LEN 4
-#define MQTT_SUBACK_LEN 5
-#define MQTT_CLIENTID_LEN 12 /* "curl0123abcd" */
-#define MQTT_HEADER_LEN 5    /* max 5 bytes */
-
-struct configurable {
+struct mqttd_configurable {
+  int testnum;
   unsigned char version; /* initial version byte in the request must match
                             this */
   bool publish_before_suback;
   bool short_publish;
   bool excessive_remaining;
+  bool pingresp_as_connack; /* send PINGRESP with payload instead of CONNACK */
+  bool disconnect_malformed; /* DISCONNECT with nonzero remlen */
   unsigned char error_connack;
-  int testnum;
+  unsigned char remlen_connack;
 };
 
-#define REQUEST_DUMP  "server.input"
+#define REQUEST_DUMP   "server.input"
 #define CONFIG_VERSION 5
 
-static struct configurable config;
+static struct mqttd_configurable m_config;
 
-const char *serverlogfile = DEFAULT_LOGFILE;
-static const char *configfile = DEFAULT_CONFIG;
-static const char *logdir = "log";
-static char loglockfile[256];
-
-#ifdef ENABLE_IPV6
-static bool use_ipv6 = FALSE;
-#endif
-static const char *ipv_inuse = "IPv4";
-static unsigned short port = DEFAULT_PORT;
-
-static void resetdefaults(void)
+static void mqttd_resetdefaults(void)
 {
   logmsg("Reset to defaults");
-  config.version = CONFIG_VERSION;
-  config.publish_before_suback = FALSE;
-  config.short_publish = FALSE;
-  config.excessive_remaining = FALSE;
-  config.error_connack = 0;
-  config.testnum = 0;
+  m_config.version = CONFIG_VERSION;
+  m_config.publish_before_suback = FALSE;
+  m_config.short_publish = FALSE;
+  m_config.excessive_remaining = FALSE;
+  m_config.pingresp_as_connack = FALSE;
+  m_config.disconnect_malformed = FALSE;
+  m_config.error_connack = 0;
+  m_config.remlen_connack = 0;
+  m_config.testnum = 0;
 }
 
-static unsigned char byteval(char *value)
+static void mqttd_getconfig(void)
 {
-  unsigned long num = strtoul(value, NULL, 10);
-  return num & 0xff;
-}
-
-static void getconfig(void)
-{
-  FILE *fp = fopen(configfile, FOPEN_READTEXT);
-  resetdefaults();
+  FILE *fp = curlx_fopen(configfile, FOPEN_READTEXT);
+  mqttd_resetdefaults();
   if(fp) {
     char buffer[512];
     logmsg("parse config file");
     while(fgets(buffer, sizeof(buffer), fp)) {
       char key[32];
       char value[32];
-      if(2 == sscanf(buffer, "%31s %31s", key, value)) {
+      const char *pval;
+      curl_off_t num;
+      if(sscanf(buffer, "%31s %31s", key, value) == 2) {
         if(!strcmp(key, "version")) {
-          config.version = byteval(value);
-          logmsg("version [%d] set", config.version);
+          pval = value;
+          if(!curlx_str_number(&pval, &num, 0xff)) {
+            m_config.version = (unsigned char)num;
+            logmsg("version [%d] set", m_config.version);
+          }
         }
         else if(!strcmp(key, "PUBLISH-before-SUBACK")) {
           logmsg("PUBLISH-before-SUBACK set");
-          config.publish_before_suback = TRUE;
+          m_config.publish_before_suback = TRUE;
         }
         else if(!strcmp(key, "short-PUBLISH")) {
           logmsg("short-PUBLISH set");
-          config.short_publish = TRUE;
+          m_config.short_publish = TRUE;
+        }
+        else if(!strcmp(key, "PINGRESP-as-CONNACK")) {
+          logmsg("PINGRESP-as-CONNACK set");
+          m_config.pingresp_as_connack = TRUE;
+        }
+        else if(!strcmp(key, "DISCONNECT-malformed")) {
+          logmsg("DISCONNECT-malformed set");
+          m_config.disconnect_malformed = TRUE;
         }
         else if(!strcmp(key, "error-CONNACK")) {
-          config.error_connack = byteval(value);
-          logmsg("error-CONNACK = %d", config.error_connack);
+          pval = value;
+          if(!curlx_str_number(&pval, &num, 0xff)) {
+            m_config.error_connack = (unsigned char)num;
+            logmsg("error-CONNACK = %d", m_config.error_connack);
+          }
+        }
+        else if(!strcmp(key, "remlen-CONNACK")) {
+          pval = value;
+          if(!curlx_str_number(&pval, &num, 0xff)) {
+            m_config.remlen_connack = (unsigned char)num;
+            logmsg("remlen-CONNACK = %d", m_config.remlen_connack);
+          }
         }
         else if(!strcmp(key, "Testnum")) {
-          config.testnum = atoi(value);
-          logmsg("testnum = %d", config.testnum);
+          pval = value;
+          if(!curlx_str_number(&pval, &num, INT_MAX)) {
+            m_config.testnum = (int)num;
+            logmsg("testnum = %d", m_config.testnum);
+          }
         }
         else if(!strcmp(key, "excessive-remaining")) {
           logmsg("excessive-remaining set");
-          config.excessive_remaining = TRUE;
+          m_config.excessive_remaining = TRUE;
         }
       }
     }
-    fclose(fp);
+    curlx_fclose(fp);
   }
   else {
     logmsg("No config file '%s' to read", configfile);
   }
 }
 
-static void loghex(unsigned char *buffer, ssize_t len)
-{
-  char data[12000];
-  ssize_t i;
-  unsigned char *ptr = buffer;
-  char *optr = data;
-  ssize_t width = 0;
-  int left = sizeof(data);
-
-  for(i = 0; i<len && (left >= 0); i++) {
-    msnprintf(optr, left, "%02x", ptr[i]);
-    width += 2;
-    optr += 2;
-    left -= 2;
-  }
-  if(width)
-    logmsg("'%s'", data);
-}
-
 typedef enum {
   FROM_CLIENT,
   FROM_SERVER
@@ -216,42 +153,53 @@ typedef enum {
 static void logprotocol(mqttdir dir,
                         const char *prefix, size_t remlen,
                         FILE *output,
-                        unsigned char *buffer, ssize_t len)
+                        const unsigned char *buffer, ssize_t len)
 {
   char data[12000] = "";
   ssize_t i;
-  unsigned char *ptr = buffer;
+  const unsigned char *ptr = buffer;
   char *optr = data;
   int left = sizeof(data);
 
-  for(i = 0; i<len && (left >= 0); i++) {
-    msnprintf(optr, left, "%02x", ptr[i]);
+  for(i = 0; i < len && (left >= 0); i++) {
+    snprintf(optr, left, "%02x", ptr[i]);
     optr += 2;
     left -= 2;
   }
-  fprintf(output, "%s %s %zx %s\n",
-          dir == FROM_CLIENT? "client": "server",
-          prefix, remlen,
-          data);
+  fprintf(output, "%s %s %x %s\n",
+          dir == FROM_CLIENT ? "client" : "server",
+          prefix, (unsigned int)remlen, data);
 }
 
-
 /* return 0 on success */
 static int connack(FILE *dump, curl_socket_t fd)
 {
-  unsigned char packet[]={
+  unsigned char packet[] = {
     MQTT_MSG_CONNACK, 0x02,
     0x00, 0x00
   };
   ssize_t rc;
+  const char *label = "CONNACK";
 
-  packet[3] = config.error_connack;
+  if(m_config.pingresp_as_connack) {
+    /* Send a PINGRESP (0xD0) with remaining_length=2 and payload
+       mimicking a successful CONNACK. MQTT 3.1.1 s. 3.13.1 requires
+       PINGRESP to have remaining_length=0, so this is malformed. */
+    packet[0] = MQTT_MSG_PINGRESP;
+    label = "PINGRESP-as-CONNACK";
+    logmsg("Sending malformed PINGRESP in place of CONNACK");
+  }
 
-  rc = swrite(fd, (char *)packet, sizeof(packet));
+  if(m_config.remlen_connack)
+    packet[1] = m_config.remlen_connack;
+  packet[3] = m_config.error_connack;
+
+  rc = swrite(fd, packet, sizeof(packet));
   if(rc > 0) {
-    logmsg("WROTE %d bytes [CONNACK]", rc);
+    logmsg("WROTE %zd bytes [%s]", rc, label);
     loghex(packet, rc);
-    logprotocol(FROM_SERVER, "CONNACK", 2, dump, packet, sizeof(packet));
+    logprotocol(FROM_SERVER, label, packet[1], dump,
+                packet, rc);
   }
   if(rc == sizeof(packet)) {
     return 0;
@@ -262,7 +210,7 @@ static int connack(FILE *dump, curl_socket_t fd)
 /* return 0 on success */
 static int suback(FILE *dump, curl_socket_t fd, unsigned short packetid)
 {
-  unsigned char packet[]={
+  unsigned char packet[] = {
     MQTT_MSG_SUBACK, 0x03,
     0, 0, /* filled in below */
     0x00
@@ -271,9 +219,9 @@ static int suback(FILE *dump, curl_socket_t fd, unsigned short packetid)
   packet[2] = (unsigned char)(packetid >> 8);
   packet[3] = (unsigned char)(packetid & 0xff);
 
-  rc = swrite(fd, (char *)packet, sizeof(packet));
+  rc = swrite(fd, packet, sizeof(packet));
   if(rc == sizeof(packet)) {
-    logmsg("WROTE %d bytes [SUBACK]", rc);
+    logmsg("WROTE %zd bytes [SUBACK]", rc);
     loghex(packet, rc);
     logprotocol(FROM_SERVER, "SUBACK", 3, dump, packet, rc);
     return 0;
@@ -285,7 +233,7 @@ static int suback(FILE *dump, curl_socket_t fd, unsigned short packetid)
 /* return 0 on success */
 static int puback(FILE *dump, curl_socket_t fd, unsigned short packetid)
 {
-  unsigned char packet[]={
+  unsigned char packet[] = {
     MQTT_MSG_PUBACK, 0x00,
     0, 0 /* filled in below */
   };
@@ -293,11 +241,11 @@ static int puback(FILE *dump, curl_socket_t fd, unsigned short packetid)
   packet[2] = (unsigned char)(packetid >> 8);
   packet[3] = (unsigned char)(packetid & 0xff);
 
-  rc = swrite(fd, (char *)packet, sizeof(packet));
+  rc = swrite(fd, packet, sizeof(packet));
   if(rc == sizeof(packet)) {
-    logmsg("WROTE %d bytes [PUBACK]", rc);
+    logmsg("WROTE %zd bytes [PUBACK]", rc);
     loghex(packet, rc);
-    logprotocol(FROM_SERVER, dump, packet, rc);
+    logprotocol(FROM_SERVER, "PUBACK", 0, dump, packet, rc);
     return 0;
   }
   logmsg("Failed sending [PUBACK]");
@@ -308,25 +256,37 @@ static int puback(FILE *dump, curl_socket_t fd, unsigned short packetid)
 /* return 0 on success */
 static int disconnect(FILE *dump, curl_socket_t fd)
 {
-  unsigned char packet[]={
+  unsigned char packet[] = {
     MQTT_MSG_DISCONNECT, 0x00,
+    0x00, 0x00 /* extra bytes for malformed variant */
   };
-  ssize_t rc = swrite(fd, (char *)packet, sizeof(packet));
-  if(rc == sizeof(packet)) {
-    logmsg("WROTE %d bytes [DISCONNECT]", rc);
+  size_t pktlen = 2;
+  const char *label = "DISCONNECT";
+  ssize_t rc;
+
+  if(m_config.disconnect_malformed) {
+    /* Send DISCONNECT with remaining_length=2 (must be 0 per spec) */
+    packet[1] = 0x02;
+    pktlen = 4;
+    label = "DISCONNECT-malformed";
+    logmsg("Sending malformed DISCONNECT with nonzero remaining_length");
+  }
+
+  rc = swrite(fd, packet, pktlen);
+  if(rc > 0) {
+    logmsg("WROTE %zd bytes [%s]", rc, label);
     loghex(packet, rc);
-    logprotocol(FROM_SERVER, "DISCONNECT", 0, dump, packet, rc);
+    logprotocol(FROM_SERVER, label, packet[1], dump, packet, rc);
+  }
+  if(rc == (ssize_t)pktlen) {
     return 0;
   }
-  logmsg("Failed sending [DISCONNECT]");
+  logmsg("Failed sending [%s]", label);
   return 1;
 }
 
-
-
 /*
   do
-
      encodedByte = X MOD 128
 
      X = X DIV 128
@@ -346,10 +306,10 @@ static int disconnect(FILE *dump, curl_socket_t fd)
 */
 
 /* return number of bytes used */
-static int encode_length(size_t packetlen,
-                         unsigned char *remlength) /* 4 bytes */
+static size_t encode_length(size_t packetlen,
+                            unsigned char *remlength) /* 4 bytes */
 {
-  int bytes = 0;
+  size_t bytes = 0;
   unsigned char encode;
 
   do {
@@ -369,8 +329,7 @@ static int encode_length(size_t packetlen,
   return bytes;
 }
 
-
-static size_t decode_length(unsigned char *buf,
+static size_t decode_length(const unsigned char *buffer,
                             size_t buflen, size_t *lenbytes)
 {
   size_t len = 0;
@@ -379,7 +338,7 @@ static size_t decode_length(unsigned char *buf,
   unsigned char encoded = 0x80;
 
   for(i = 0; (i < buflen) && (encoded & 0x80); i++) {
-    encoded = buf[i];
+    encoded = buffer[i];
     len += (encoded & 0x7f) * mult;
     mult *= 0x80;
   }
@@ -390,23 +349,22 @@ static size_t decode_length(unsigned char *buf,
   return len;
 }
 
-
 /* return 0 on success */
 static int publish(FILE *dump,
                    curl_socket_t fd, unsigned short packetid,
-                   char *topic, char *payload, size_t payloadlen)
+                   char *topic, const char *payload, size_t payloadlen)
 {
   size_t topiclen = strlen(topic);
   unsigned char *packet;
   size_t payloadindex;
-  ssize_t remaininglength = topiclen + 2 + payloadlen;
-  ssize_t packetlen;
-  ssize_t sendamount;
+  size_t remaininglength = topiclen + 2 + payloadlen;
+  size_t packetlen;
+  size_t sendamount;
   ssize_t rc;
   unsigned char rembuffer[4];
-  int encodedlen;
+  size_t encodedlen;
 
-  if(config.excessive_remaining) {
+  if(m_config.excessive_remaining) {
     /* manually set illegal remaining length */
     rembuffer[0] = 0xff;
     rembuffer[1] = 0xff;
@@ -423,7 +381,7 @@ static int publish(FILE *dump,
   if(!packet)
     return 1;
 
-  packet[0] = MQTT_MSG_PUBLISH; /* TODO: set QoS? */
+  packet[0] = MQTT_MSG_PUBLISH;
   memcpy(&packet[1], rembuffer, encodedlen);
 
   (void)packetid;
@@ -431,47 +389,49 @@ static int publish(FILE *dump,
 
   packet[1 + encodedlen] = (unsigned char)(topiclen >> 8);
   packet[2 + encodedlen] = (unsigned char)(topiclen & 0xff);
+  /* NOLINTNEXTLINE(bugprone-not-null-terminated-result) */
   memcpy(&packet[3 + encodedlen], topic, topiclen);
 
   payloadindex = 3 + topiclen + encodedlen;
   memcpy(&packet[payloadindex], payload, payloadlen);
 
   sendamount = packetlen;
-  if(config.short_publish)
+  if(m_config.short_publish)
     sendamount -= 2;
 
-  rc = swrite(fd, (char *)packet, sendamount);
+  rc = swrite(fd, packet, sendamount);
   if(rc > 0) {
-    logmsg("WROTE %d bytes [PUBLISH]", rc);
+    logmsg("WROTE %zd bytes [PUBLISH]", rc);
     loghex(packet, rc);
     logprotocol(FROM_SERVER, "PUBLISH", remaininglength, dump, packet, rc);
   }
-  if(rc == packetlen)
+  free(packet);
+  if((size_t)rc == packetlen)
     return 0;
   return 1;
 }
 
-#define MAX_TOPIC_LENGTH 65535
+#define MAX_TOPIC_LENGTH     65535
 #define MAX_CLIENT_ID_LENGTH 32
 
 static char topic[MAX_TOPIC_LENGTH + 1];
 
-static int fixedheader(curl_socket_t fd,
-                       unsigned char *bytep,
-                       size_t *remaining_lengthp,
-                       size_t *remaining_length_bytesp)
+static bool fixedheader(curl_socket_t fd,
+                        unsigned char *bytep,
+                        size_t *remaining_lengthp,
+                        size_t *remaining_length_bytesp)
 {
   /* get the fixed header */
   unsigned char buffer[10];
 
   /* get the first two bytes */
-  ssize_t rc = sread(fd, (char *)buffer, 2);
-  int i;
+  ssize_t rc = sread(fd, buffer, 2);
+  size_t i;
   if(rc < 2) {
-    logmsg("READ %d bytes [SHORT!]", rc);
-    return 1; /* fail */
+    logmsg("READ %zd bytes [SHORT!]", rc);
+    return FALSE; /* fail */
   }
-  logmsg("READ %d bytes", rc);
+  logmsg("READ %zd bytes", rc);
   loghex(buffer, rc);
   *bytep = buffer[0];
 
@@ -479,28 +439,27 @@ static int fixedheader(curl_socket_t fd,
   i = 1;
   while(buffer[i] & 0x80) {
     i++;
-    rc = sread(fd, (char *)&buffer[i], 1);
+    rc = sread(fd, &buffer[i], 1);
     if(rc != 1) {
       logmsg("Remaining Length broken");
-      return 1;
+      return FALSE;
     }
   }
   *remaining_lengthp = decode_length(&buffer[1], i, remaining_length_bytesp);
-  logmsg("Remaining Length: %ld [%d bytes]", (long) *remaining_lengthp,
+  logmsg("Remaining Length: %zu [%zu bytes]", *remaining_lengthp,
          *remaining_length_bytesp);
-  return 0;
+  return TRUE;
 }
 
 static curl_socket_t mqttit(curl_socket_t fd)
 {
-  size_t buff_size = 10*1024;
+  size_t buff_size = 10 * 1024;
   unsigned char *buffer = NULL;
-  ssize_t rc;
   unsigned char byte;
   unsigned short packet_id;
   size_t payload_len;
   size_t client_id_length;
-  unsigned int topic_len;
+  size_t topic_len;
   size_t remaining_length = 0;
   size_t bytes = 0; /* remaining length field size in bytes */
   char client_id[MAX_CLIENT_ID_LENGTH];
@@ -514,14 +473,14 @@ static curl_socket_t mqttit(curl_socket_t fd)
     'M','Q','T','T',  /* protocol name */
     0x04              /* protocol level */
   };
-  msnprintf(dumpfile, sizeof(dumpfile), "%s/%s", logdir, REQUEST_DUMP);
-  dump = fopen(dumpfile, "ab");
+  snprintf(dumpfile, sizeof(dumpfile), "%s/%s", logdir, REQUEST_DUMP);
+  dump = curlx_fopen(dumpfile, "ab");
   if(!dump)
     goto end;
 
-  getconfig();
+  mqttd_getconfig();
 
-  testno = config.testnum;
+  testno = m_config.testnum;
 
   if(testno)
     logmsg("Found test number %ld", testno);
@@ -531,6 +490,7 @@ static curl_socket_t mqttit(curl_socket_t fd)
     logmsg("Out of memory, unable to allocate buffer");
     goto end;
   }
+  memset(buffer, 0, buff_size);
 
   do {
     unsigned char usr_flag = 0x80;
@@ -539,40 +499,41 @@ static curl_socket_t mqttit(curl_socket_t fd)
     const size_t client_id_offset = 12;
     size_t start_usr;
     size_t start_passwd;
+    ssize_t rc = 0;
 
     /* get the fixed header */
-    rc = fixedheader(fd, &byte, &remaining_length, &bytes);
-    if(rc)
+    if(!fixedheader(fd, &byte, &remaining_length, &bytes))
       break;
 
     if(remaining_length >= buff_size) {
+      unsigned char *newbuffer;
       buff_size = remaining_length;
-      buffer = realloc(buffer, buff_size);
-      if(!buffer) {
-        logmsg("Failed realloc of size %lu", buff_size);
+      newbuffer = realloc(buffer, buff_size);
+      if(!newbuffer) {
+        logmsg("Failed realloc of size %zu", buff_size);
         goto end;
       }
+      buffer = newbuffer;
     }
 
     if(remaining_length) {
       /* reading variable header and payload into buffer */
-      rc = sread(fd, (char *)buffer, remaining_length);
+      rc = sread(fd, buffer, remaining_length);
       if(rc > 0) {
-        logmsg("READ %d bytes", rc);
+        logmsg("READ %zd bytes", rc);
         loghex(buffer, rc);
       }
     }
 
     if(byte == MQTT_MSG_CONNECT) {
-      logprotocol(FROM_CLIENT, "CONNECT", remaining_length,
-                  dump, buffer, rc);
+      logprotocol(FROM_CLIENT, "CONNECT", remaining_length, dump, buffer, rc);
 
       if(memcmp(protocol, buffer, sizeof(protocol))) {
         logmsg("Protocol preamble mismatch");
         goto end;
       }
       /* ignore the connect flag byte and two keepalive bytes */
-      payload_len = (buffer[10] << 8) | buffer[11];
+      payload_len = (size_t)(buffer[10] << 8) | buffer[11];
       /* first part of the payload is the client ID */
       client_id_length = payload_len;
 
@@ -580,23 +541,25 @@ static curl_socket_t mqttit(curl_socket_t fd)
       conn_flags = buffer[7];
 
       start_usr = client_id_offset + payload_len;
-      if(usr_flag == (unsigned char)(conn_flags & usr_flag)) {
+      if(usr_flag == (conn_flags & usr_flag)) {
         logmsg("User flag is present in CONN flag");
-        payload_len += (buffer[start_usr] << 8) | buffer[start_usr + 1];
+        payload_len += (size_t)(buffer[start_usr] << 8) |
+                       buffer[start_usr + 1];
         payload_len += 2; /* MSB and LSB for user length */
       }
 
       start_passwd = client_id_offset + payload_len;
-      if(passwd_flag == (char)(conn_flags & passwd_flag)) {
+      if(passwd_flag == (conn_flags & passwd_flag)) {
         logmsg("Password flag is present in CONN flags");
-        payload_len += (buffer[start_passwd] << 8) | buffer[start_passwd + 1];
+        payload_len += (size_t)(buffer[start_passwd] << 8) |
+                       buffer[start_passwd + 1];
         payload_len += 2; /* MSB and LSB for password length */
       }
 
       /* check the length of the payload */
       if((ssize_t)payload_len != (rc - 12)) {
-        logmsg("Payload length mismatch, expected %x got %x",
-               rc - 12, payload_len);
+        logmsg("Payload length mismatch, expected %zd got %zd",
+               rc - 12, (ssize_t)payload_len);
         goto end;
       }
       /* check the length of the client ID */
@@ -634,32 +597,43 @@ static curl_socket_t mqttit(curl_socket_t fd)
       packet_id = (unsigned short)((buffer[0] << 8) | buffer[1]);
 
       /* two bytes topic length */
-      topic_len = (buffer[2] << 8) | buffer[3];
+      topic_len = (size_t)(buffer[2] << 8) | buffer[3];
       if(topic_len != (remaining_length - 5)) {
-        logmsg("Wrong topic length, got %d expected %d",
+        logmsg("Wrong topic length, got %zu expected %zu",
                topic_len, remaining_length - 5);
         goto end;
       }
       memcpy(topic, &buffer[4], topic_len);
       topic[topic_len] = 0;
 
-      /* there's a QoS byte (two bits) after the topic */
+      /* there is a QoS byte (two bits) after the topic */
 
       logmsg("SUBSCRIBE to '%s' [%d]", topic, packet_id);
       stream = test2fopen(testno, logdir);
+      if(!stream) {
+        char errbuf[STRERROR_LEN];
+        error = errno;
+        logmsg("fopen() failed with error (%d) %s",
+               error, curlx_strerror(error, errbuf, sizeof(errbuf)));
+        logmsg("Could not open test file %ld", testno);
+        goto end;
+      }
       error = getpart(&data, &datalen, "reply", "data", stream);
       if(!error) {
-        if(!config.publish_before_suback) {
+        if(!m_config.publish_before_suback) {
           if(suback(dump, fd, packet_id)) {
             logmsg("failed sending SUBACK");
+            free(data);
             goto end;
           }
         }
         if(publish(dump, fd, packet_id, topic, data, datalen)) {
           logmsg("PUBLISH failed");
+          free(data);
           goto end;
         }
-        if(config.publish_before_suback) {
+        free(data);
+        if(m_config.publish_before_suback) {
           if(suback(dump, fd, packet_id)) {
             logmsg("failed sending SUBACK");
             goto end;
@@ -667,7 +641,7 @@ static curl_socket_t mqttit(curl_socket_t fd)
         }
       }
       else {
-        char *def = (char *)"this is random payload yes yes it is";
+        const char *def = "this is random payload yes yes it is";
         publish(dump, fd, packet_id, topic, def, strlen(def));
       }
       disconnect(dump, fd);
@@ -676,22 +650,20 @@ static curl_socket_t mqttit(curl_socket_t fd)
       size_t topiclen;
 
       logmsg("Incoming PUBLISH");
-      logprotocol(FROM_CLIENT, "PUBLISH", remaining_length,
-                  dump, buffer, rc);
+      logprotocol(FROM_CLIENT, "PUBLISH", remaining_length, dump, buffer, rc);
 
-      topiclen = (buffer[1 + bytes] << 8) | buffer[2 + bytes];
-      logmsg("Got %d bytes topic", topiclen);
-      /* TODO: verify topiclen */
+      topiclen = (size_t)(buffer[1 + bytes] << 8) | buffer[2 + bytes];
+      logmsg("Got %zu bytes topic", topiclen);
 
 #ifdef QOS
-      /* TODO: handle packetid if there is one. Send puback if QoS > 0 */
+      /* Handle packetid if there is one. Send puback if QoS > 0 */
       puback(dump, fd, 0);
 #endif
       /* expect a disconnect here */
       /* get the request */
-      rc = sread(fd, (char *)&buffer[0], 2);
+      rc = sread(fd, &buffer[0], 2);
 
-      logmsg("READ %d bytes [DISCONNECT]", rc);
+      logmsg("READ %zd bytes [DISCONNECT]", rc);
       loghex(buffer, rc);
       logprotocol(FROM_CLIENT, "DISCONNECT", 0, dump, buffer, rc);
       goto end;
@@ -706,9 +678,9 @@ end:
   if(buffer)
     free(buffer);
   if(dump)
-    fclose(dump);
+    curlx_fclose(dump);
   if(stream)
-    fclose(stream);
+    curlx_fclose(stream);
   return CURL_SOCKET_BAD;
 }
 
@@ -718,7 +690,7 @@ end:
   if sockfd is CURL_SOCKET_BAD, listendfd is a listening socket we must
   accept()
 */
-static bool incoming(curl_socket_t listenfd)
+static bool mqttd_incoming(curl_socket_t listenfd)
 {
   fd_set fds_read;
   fd_set fds_write;
@@ -731,7 +703,7 @@ static bool incoming(curl_socket_t listenfd)
   }
 
 #ifdef HAVE_GETPPID
-  /* As a last resort, quit if socks5 process becomes orphan. */
+  /* As a last resort, quit if mqttd process becomes orphan. */
   if(getppid() <= 1) {
     logmsg("process becomes orphan, exiting");
     return FALSE;
@@ -740,7 +712,8 @@ static bool incoming(curl_socket_t listenfd)
 
   do {
     ssize_t rc;
-    int error = 0;
+    int sockerr = 0;
+    char errbuf[STRERROR_LEN];
     curl_socket_t sockfd = listenfd;
     int maxfd = (int)sockfd;
 
@@ -748,7 +721,7 @@ static bool incoming(curl_socket_t listenfd)
     FD_ZERO(&fds_write);
     FD_ZERO(&fds_err);
 
-    /* there's always a socket to wait for */
+    /* there is always a socket to wait for */
     FD_SET(sockfd, &fds_read);
 
     do {
@@ -758,24 +731,24 @@ static bool incoming(curl_socket_t listenfd)
         logmsg("signalled to die, exiting...");
         return FALSE;
       }
-    } while((rc == -1) && ((error = SOCKERRNO) == EINTR));
+    } while((rc == -1) && ((sockerr = SOCKERRNO) == SOCKEINTR));
 
     if(rc < 0) {
-      logmsg("select() failed with error: (%d) %s",
-             error, strerror(error));
+      logmsg("select() failed with error (%d) %s",
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
       return FALSE;
     }
 
     if(FD_ISSET(sockfd, &fds_read)) {
       curl_socket_t newfd = accept(sockfd, NULL, NULL);
-      if(CURL_SOCKET_BAD == newfd) {
-        error = SOCKERRNO;
-        logmsg("accept(%d, NULL, NULL) failed with error: (%d) %s",
-               sockfd, error, sstrerror(error));
+      if(newfd == CURL_SOCKET_BAD) {
+        sockerr = SOCKERRNO;
+        logmsg("accept() failed with error (%d) %s",
+               sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
       }
       else {
-        logmsg("====> Client connect, fd %d. Read config from %s",
-               newfd, configfile);
+        logmsg("====> Client connect, fd %ld. "
+               "Read config from %s", (long)newfd, configfile);
         set_advisor_read_lock(loglockfile);
         (void)mqttit(newfd); /* until done */
         clear_advisor_read_lock(loglockfile);
@@ -789,215 +762,85 @@ static bool incoming(curl_socket_t listenfd)
   return TRUE;
 }
 
-static curl_socket_t sockdaemon(curl_socket_t sock,
-                                unsigned short *listenport)
-{
-  /* passive daemon style */
-  srvr_sockaddr_union_t listener;
-  int flag;
-  int rc;
-  int totdelay = 0;
-  int maxretr = 10;
-  int delay = 20;
-  int attempt = 0;
-  int error = 0;
-
-  do {
-    attempt++;
-    flag = 1;
-    rc = setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
-         (void *)&flag, sizeof(flag));
-    if(rc) {
-      error = SOCKERRNO;
-      logmsg("setsockopt(SO_REUSEADDR) failed with error: (%d) %s",
-             error, sstrerror(error));
-      if(maxretr) {
-        rc = wait_ms(delay);
-        if(rc) {
-          /* should not happen */
-          logmsg("wait_ms() failed with error: %d", rc);
-          sclose(sock);
-          return CURL_SOCKET_BAD;
-        }
-        if(got_exit_signal) {
-          logmsg("signalled to die, exiting...");
-          sclose(sock);
-          return CURL_SOCKET_BAD;
-        }
-        totdelay += delay;
-        delay *= 2; /* double the sleep for next attempt */
-      }
-    }
-  } while(rc && maxretr--);
-
-  if(rc) {
-    logmsg("setsockopt(SO_REUSEADDR) failed %d times in %d ms. Error: (%d) %s",
-           attempt, totdelay, error, strerror(error));
-    logmsg("Continuing anyway...");
-  }
-
-  /* When the specified listener port is zero, it is actually a
-     request to let the system choose a non-zero available port. */
-
-#ifdef ENABLE_IPV6
-  if(!use_ipv6) {
-#endif
-    memset(&listener.sa4, 0, sizeof(listener.sa4));
-    listener.sa4.sin_family = AF_INET;
-    listener.sa4.sin_addr.s_addr = INADDR_ANY;
-    listener.sa4.sin_port = htons(*listenport);
-    rc = bind(sock, &listener.sa, sizeof(listener.sa4));
-#ifdef ENABLE_IPV6
-  }
-  else {
-    memset(&listener.sa6, 0, sizeof(listener.sa6));
-    listener.sa6.sin6_family = AF_INET6;
-    listener.sa6.sin6_addr = in6addr_any;
-    listener.sa6.sin6_port = htons(*listenport);
-    rc = bind(sock, &listener.sa, sizeof(listener.sa6));
-  }
-#endif /* ENABLE_IPV6 */
-  if(rc) {
-    error = SOCKERRNO;
-    logmsg("Error binding socket on port %hu: (%d) %s",
-           *listenport, error, sstrerror(error));
-    sclose(sock);
-    return CURL_SOCKET_BAD;
-  }
-
-  if(!*listenport) {
-    /* The system was supposed to choose a port number, figure out which
-       port we actually got and update the listener port value with it. */
-    curl_socklen_t la_size;
-    srvr_sockaddr_union_t localaddr;
-#ifdef ENABLE_IPV6
-    if(!use_ipv6)
-#endif
-      la_size = sizeof(localaddr.sa4);
-#ifdef ENABLE_IPV6
-    else
-      la_size = sizeof(localaddr.sa6);
-#endif
-    memset(&localaddr.sa, 0, (size_t)la_size);
-    if(getsockname(sock, &localaddr.sa, &la_size) < 0) {
-      error = SOCKERRNO;
-      logmsg("getsockname() failed with error: (%d) %s",
-             error, sstrerror(error));
-      sclose(sock);
-      return CURL_SOCKET_BAD;
-    }
-    switch(localaddr.sa.sa_family) {
-    case AF_INET:
-      *listenport = ntohs(localaddr.sa4.sin_port);
-      break;
-#ifdef ENABLE_IPV6
-    case AF_INET6:
-      *listenport = ntohs(localaddr.sa6.sin6_port);
-      break;
-#endif
-    default:
-      break;
-    }
-    if(!*listenport) {
-      /* Real failure, listener port shall not be zero beyond this point. */
-      logmsg("Apparently getsockname() succeeded, with listener port zero.");
-      logmsg("A valid reason for this failure is a binary built without");
-      logmsg("proper network library linkage. This might not be the only");
-      logmsg("reason, but double check it before anything else.");
-      sclose(sock);
-      return CURL_SOCKET_BAD;
-    }
-  }
-
-  /* start accepting connections */
-  rc = listen(sock, 5);
-  if(0 != rc) {
-    error = SOCKERRNO;
-    logmsg("listen(%d, 5) failed with error: (%d) %s",
-           sock, error, sstrerror(error));
-    sclose(sock);
-    return CURL_SOCKET_BAD;
-  }
-
-  return sock;
-}
-
-
-int main(int argc, char *argv[])
+static int test_mqttd(int argc, const char *argv[])
 {
   curl_socket_t sock = CURL_SOCKET_BAD;
   curl_socket_t msgsock = CURL_SOCKET_BAD;
   int wrotepidfile = 0;
   int wroteportfile = 0;
-  const char *pidname = ".mqttd.pid";
-  const char *portname = ".mqttd.port";
   bool juggle_again;
-  int error;
+  int sockerr;
+  char errbuf[STRERROR_LEN];
   int arg = 1;
 
-  while(argc>arg) {
+  pidname = ".mqttd.pid";
+  portname = ".mqttd.port";
+  serverlogfile = "log/mqttd.log";
+  configfile = "mqttd.config";
+  server_port = 1883; /* MQTT default port */
+
+  while(argc > arg) {
+    const char *opt;
+    curl_off_t num;
     if(!strcmp("--version", argv[arg])) {
       printf("mqttd IPv4%s\n",
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
              "/IPv6"
 #else
              ""
 #endif
-             );
+      );
       return 0;
     }
     else if(!strcmp("--pidfile", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         pidname = argv[arg++];
     }
     else if(!strcmp("--portfile", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         portname = argv[arg++];
     }
     else if(!strcmp("--config", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         configfile = argv[arg++];
     }
     else if(!strcmp("--logfile", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         serverlogfile = argv[arg++];
     }
     else if(!strcmp("--logdir", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         logdir = argv[arg++];
     }
     else if(!strcmp("--ipv6", argv[arg])) {
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
+      socket_domain = AF_INET6;
       ipv_inuse = "IPv6";
-      use_ipv6 = TRUE;
 #endif
       arg++;
     }
     else if(!strcmp("--ipv4", argv[arg])) {
       /* for completeness, we support this option as well */
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
+      socket_domain = AF_INET;
       ipv_inuse = "IPv4";
-      use_ipv6 = FALSE;
 #endif
       arg++;
     }
     else if(!strcmp("--port", argv[arg])) {
       arg++;
-      if(argc>arg) {
-        char *endptr;
-        unsigned long ulnum = strtoul(argv[arg], &endptr, 10);
-        if((endptr != argv[arg] + strlen(argv[arg])) ||
-           ((ulnum != 0UL) && ((ulnum < 1025UL) || (ulnum > 65535UL)))) {
-          fprintf(stderr, "mqttd: invalid --port argument (%s)\n",
-                  argv[arg]);
+      if(argc > arg) {
+        opt = argv[arg];
+        if(curlx_str_number(&opt, &num, 0xffff)) {
+          fprintf(stderr, "mqttd: invalid --port argument (%s)\n", argv[arg]);
           return 0;
         }
-        port = curlx_ultous(ulnum);
+        server_port = (unsigned short)num;
         arg++;
       }
     }
@@ -1016,59 +859,48 @@ int main(int argc, char *argv[])
     }
   }
 
-  msnprintf(loglockfile, sizeof(loglockfile), "%s/%s/mqtt-%s.lock",
-            logdir, SERVERLOGS_LOCKDIR, ipv_inuse);
+  snprintf(loglockfile, sizeof(loglockfile), "%s/%s/mqtt-%s.lock",
+           logdir, SERVERLOGS_LOCKDIR, ipv_inuse);
 
-#ifdef WIN32
-  win32_init();
-  atexit(win32_cleanup);
-
-  setmode(fileno(stdin), O_BINARY);
-  setmode(fileno(stdout), O_BINARY);
-  setmode(fileno(stderr), O_BINARY);
-#endif
+  CURL_BINMODE(stdin);
+  CURL_BINMODE(stdout);
+  CURL_BINMODE(stderr);
 
   install_signal_handlers(FALSE);
 
-#ifdef ENABLE_IPV6
-  if(!use_ipv6)
-#endif
-    sock = socket(AF_INET, SOCK_STREAM, 0);
-#ifdef ENABLE_IPV6
-  else
-    sock = socket(AF_INET6, SOCK_STREAM, 0);
-#endif
+  sock = socket(socket_domain, SOCK_STREAM, 0);
 
-  if(CURL_SOCKET_BAD == sock) {
-    error = SOCKERRNO;
-    logmsg("Error creating socket: (%d) %s", error, sstrerror(error));
+  if(sock == CURL_SOCKET_BAD) {
+    sockerr = SOCKERRNO;
+    logmsg("Error creating socket (%d) %s",
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
     goto mqttd_cleanup;
   }
 
   {
     /* passive daemon style */
-    sock = sockdaemon(sock, &port);
-    if(CURL_SOCKET_BAD == sock) {
+    sock = sockdaemon(sock, &server_port, NULL, FALSE);
+    if(sock == CURL_SOCKET_BAD) {
       goto mqttd_cleanup;
     }
     msgsock = CURL_SOCKET_BAD; /* no stream socket yet */
   }
 
   logmsg("Running %s version", ipv_inuse);
-  logmsg("Listening on port %hu", port);
+  logmsg("Listening on port %hu", server_port);
 
   wrotepidfile = write_pidfile(pidname);
   if(!wrotepidfile) {
     goto mqttd_cleanup;
   }
 
-  wroteportfile = write_portfile(portname, port);
+  wroteportfile = write_portfile(portname, server_port);
   if(!wroteportfile) {
     goto mqttd_cleanup;
   }
 
   do {
-    juggle_again = incoming(sock);
+    juggle_again = mqttd_incoming(sock);
   } while(juggle_again);
 
 mqttd_cleanup:
diff --git a/third-party/curl/tests/server/resolve.c b/third-party/curl/tests/server/resolve.c
index 37432e4c85..ac72cddd3a 100644
--- a/third-party/curl/tests/server/resolve.c
+++ b/third-party/curl/tests/server/resolve.c
@@ -21,7 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "server_setup.h"
+#include "first.h"
 
 /* Purpose
  *
@@ -33,60 +33,39 @@
  *
  */
 
-#ifdef HAVE_SIGNAL_H
-#include <signal.h>
-#endif
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-#ifdef _XOPEN_SOURCE_EXTENDED
-/* This define is "almost" required to build on HPUX 11 */
-#include <arpa/inet.h>
-#endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
-
-#define ENABLE_CURLX_PRINTF
-/* make the curlx header define all printf() functions to use the curlx_*
-   versions instead */
-#include "curlx.h" /* from the private lib dir */
-#include "util.h"
-
-/* include memdebug.h last */
-#include "memdebug.h"
-
-static bool use_ipv6 = FALSE;
-static const char *ipv_inuse = "IPv4";
-
-const char *serverlogfile = ""; /* for a util.c function we don't use */
-
-int main(int argc, char *argv[])
+static int test_resolve(int argc, const char *argv[])
 {
   int arg = 1;
   const char *host = NULL;
   int rc = 0;
 
-  while(argc>arg) {
+  while(argc > arg) {
     if(!strcmp("--version", argv[arg])) {
       printf("resolve IPv4%s\n",
-#if defined(CURLRES_IPV6)
+#ifdef CURLRES_IPV6
              "/IPv6"
 #else
              ""
 #endif
-             );
+      );
       return 0;
     }
     else if(!strcmp("--ipv6", argv[arg])) {
+#ifdef CURLRES_IPV6
       ipv_inuse = "IPv6";
       use_ipv6 = TRUE;
       arg++;
+#else
+      puts("IPv6 support has been disabled in this program");
+      return 1;
+#endif
     }
     else if(!strcmp("--ipv4", argv[arg])) {
       /* for completeness, we support this option as well */
       ipv_inuse = "IPv4";
+#ifdef CURLRES_IPV6
       use_ipv6 = FALSE;
+#endif
       arg++;
     }
     else {
@@ -97,24 +76,19 @@ int main(int argc, char *argv[])
     puts("Usage: resolve [option] <host>\n"
          " --version\n"
          " --ipv4"
-#if defined(CURLRES_IPV6)
+#ifdef CURLRES_IPV6
          "\n --ipv6"
 #endif
-         );
+    );
     return 1;
   }
 
-#ifdef WIN32
-  win32_init();
-  atexit(win32_cleanup);
-#endif
-
-#if defined(CURLRES_IPV6)
+#ifdef CURLRES_IPV6
   if(use_ipv6) {
     /* Check that the system has IPv6 enabled before checking the resolver */
     curl_socket_t s = socket(PF_INET6, SOCK_DGRAM, 0);
     if(s == CURL_SOCKET_BAD)
-      /* an IPv6 address was requested and we can't get/use one */
+      /* an IPv6 address was requested and we cannot get/use one */
       rc = -1;
     else {
       sclose(s);
@@ -130,29 +104,26 @@ int main(int argc, char *argv[])
     hints.ai_family = use_ipv6 ? PF_INET6 : PF_INET;
     hints.ai_socktype = SOCK_STREAM;
     hints.ai_flags = 0;
-    /* Use parenthesis around functions to stop them from being replaced by
-       the macro in memdebug.h */
-    rc = (getaddrinfo)(host, "80", &hints, &ai);
+    rc = getaddrinfo(host, "80", &hints, &ai);
     if(rc == 0)
-      (freeaddrinfo)(ai);
+      freeaddrinfo(ai);
   }
 #else
-  if(use_ipv6) {
-    puts("IPv6 support has been disabled in this program");
-    return 1;
-  }
-  else {
-    /* gethostbyname() resolve */
-    struct hostent *he;
+  {
+    struct hostent *he;  /* gethostbyname() resolve */
 
+#ifdef __AMIGA__
+    he = gethostbyname((unsigned char *)CURL_UNCONST(host));
+#else
     he = gethostbyname(host);
+#endif
 
     rc = !he;
   }
 #endif
 
   if(rc)
-    printf("Resolving %s '%s' didn't work\n", ipv_inuse, host);
+    printf("Resolving %s '%s' did not work\n", ipv_inuse, host);
 
   return !!rc;
 }
diff --git a/third-party/curl/tests/server/rtspd.c b/third-party/curl/tests/server/rtspd.c
index 1e962c115c..36973185ed 100644
--- a/third-party/curl/tests/server/rtspd.c
+++ b/third-party/curl/tests/server/rtspd.c
@@ -21,7 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "server_setup.h"
+#include "first.h"
 
 /*
  * curl's test suite Real Time Streaming Protocol (RTSP) server.
@@ -29,57 +29,16 @@
  * This source file was started based on curl's HTTP test suite server.
  */
 
-#ifdef HAVE_SIGNAL_H
-#include <signal.h>
-#endif
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-#ifdef HAVE_NETINET_IN6_H
-#include <netinet/in6.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
 #ifdef HAVE_NETINET_TCP_H
 #include <netinet/tcp.h> /* for TCP_NODELAY */
 #endif
 
-#define ENABLE_CURLX_PRINTF
-/* make the curlx header define all printf() functions to use the curlx_*
-   versions instead */
-#include "curlx.h" /* from the private lib dir */
-#include "getpart.h"
-#include "util.h"
-#include "server_sockaddr.h"
-
-/* include memdebug.h last */
-#include "memdebug.h"
-
-#ifdef USE_WINSOCK
-#undef  EINTR
-#define EINTR    4 /* errno.h value */
-#undef  ERANGE
-#define ERANGE  34 /* errno.h value */
-#endif
-
-#ifdef ENABLE_IPV6
-static bool use_ipv6 = FALSE;
-#endif
-static const char *ipv_inuse = "IPv4";
-static int serverlogslocked = 0;
-
-#define REQBUFSIZ 150000
-#define REQBUFSIZ_TXT "149999"
-
-static long prevtestno = -1;    /* previous test number we served */
-static long prevpartno = -1;    /* previous part number we served */
-static bool prevbounce = FALSE; /* instructs the server to increase the part
-                                   number for a test in case the identical
-                                   testno+partno request shows up again */
+static long rtspd_prevtestno = -1;    /* previous test number we served */
+static long rtspd_prevpartno = -1;    /* previous part number we served */
+static bool rtspd_prevbounce = FALSE; /* instructs the server to override the
+                                         requested part number to
+                                         prevpartno + 1 when prevtestno and
+                                         current test are the same */
 
 #define RCMD_NORMALREQ 0 /* default request, use the tests file normally */
 #define RCMD_IDLE      1 /* told to sit idle */
@@ -91,24 +50,24 @@ typedef enum {
   RPROT_HTTP = 2
 } reqprot_t;
 
-#define SET_RTP_PKT_CHN(p,c)  ((p)[1] = (unsigned char)((c) & 0xFF))
+#define SET_RTP_PKT_CHN(p, c)  ((p)[1] = (char)((c) & 0xFF))
 
-#define SET_RTP_PKT_LEN(p,l) (((p)[2] = (unsigned char)(((l) >> 8) & 0xFF)), \
-                              ((p)[3] = (unsigned char)((l) & 0xFF)))
+#define SET_RTP_PKT_LEN(p, l) (((p)[2] = (char)(((l) >> 8) & 0xFF)), \
+                               ((p)[3] = (char)((l) & 0xFF)))
 
-struct httprequest {
-  char reqbuf[REQBUFSIZ]; /* buffer area for the incoming request */
+struct rtspd_httprequest {
+  char reqbuf[150000]; /* buffer area for the incoming request */
   size_t checkindex; /* where to start checking of the request */
   size_t offset;     /* size of the incoming request */
   long testno;       /* test number found in the request */
   long partno;       /* part number found in the request */
   bool open;      /* keep connection open info, as found in the request */
-  bool auth_req;  /* authentication required, don't wait for body unless
-                     there's an Authorization header */
+  bool auth_req;  /* authentication required, do not wait for body unless
+                     there is an Authorization header */
   bool auth;      /* Authorization header present in the incoming request */
   size_t cl;      /* Content-Length of the incoming request */
   bool digest;    /* Authorization digest header found */
-  bool ntlm;      /* Authorization ntlm header found */
+  bool ntlm;      /* Authorization NTLM header found */
   int pipe;       /* if non-zero, expect this many requests to do a "piped"
                      request/response */
   int skip;       /* if non-zero, the server is instructed to not read this
@@ -117,41 +76,28 @@ struct httprequest {
                      - skip bytes. */
   int rcmd;       /* doing a special command, see defines above */
   reqprot_t protocol; /* request protocol, HTTP or RTSP */
-  int prot_version;   /* HTTP or RTSP version (major*10 + minor) */
+  int prot_version;   /* HTTP or RTSP version (major * 10 + minor) */
   bool pipelining;    /* true if request is pipelined */
   char *rtp_buffer;
   size_t rtp_buffersize;
 };
 
-static int ProcessRequest(struct httprequest *req);
-static void storerequest(char *reqbuf, size_t totalsize);
-
-#define DEFAULT_PORT 8999
-
-#ifndef DEFAULT_LOGFILE
-#define DEFAULT_LOGFILE "log/rtspd.log"
-#endif
-
-const char *serverlogfile = DEFAULT_LOGFILE;
-const char *logdir = "log";
-char loglockfile[256];
-
 #define RTSPDVERSION "curl test suite RTSP server/0.1"
 
 #define REQUEST_DUMP  "server.input"
 #define RESPONSE_DUMP "server.response"
 
 /* very-big-path support */
-#define MAXDOCNAMELEN 140000
+#define MAXDOCNAMELEN     140000
 #define MAXDOCNAMELEN_TXT "139999"
 
-#define REQUEST_KEYWORD_SIZE 256
+#define REQUEST_KEYWORD_SIZE     256
 #define REQUEST_KEYWORD_SIZE_TXT "255"
 
 #define CMD_AUTH_REQUIRED "auth_required"
 
-/* 'idle' means that it will accept the request fine but never respond
-   any data. Just keep the connection alive. */
+/* 'idle' means that it accepts the request fine but never responds
+   any data. Keep the connection alive. */
 #define CMD_IDLE "idle"
 
 /* 'stream' means to send a never-ending stream of data */
@@ -159,63 +105,53 @@ char loglockfile[256];
 
 #define END_OF_HEADERS "\r\n\r\n"
 
-enum {
-  DOCNUMBER_NOTHING = -7,
-  DOCNUMBER_QUIT    = -6,
-  DOCNUMBER_BADCONNECT = -5,
-  DOCNUMBER_INTERNAL = -4,
-  DOCNUMBER_CONNECT = -3,
-  DOCNUMBER_WERULEZ = -2,
-  DOCNUMBER_404     = -1
-};
-
-
 /* sent as reply to a QUIT */
-static const char *docquit =
-"HTTP/1.1 200 Goodbye" END_OF_HEADERS;
+static const char *docquit_rtsp = "HTTP/1.1 200 Goodbye" END_OF_HEADERS;
 
 /* sent as reply to a CONNECT */
 static const char *docconnect =
-"HTTP/1.1 200 Mighty fine indeed" END_OF_HEADERS;
+  "HTTP/1.1 200 Mighty fine indeed" END_OF_HEADERS;
 
 /* sent as reply to a "bad" CONNECT */
 static const char *docbadconnect =
-"HTTP/1.1 501 Forbidden you fool" END_OF_HEADERS;
+  "HTTP/1.1 501 Forbidden you fool" END_OF_HEADERS;
 
 /* send back this on HTTP 404 file not found */
-static const char *doc404_HTTP = "HTTP/1.1 404 Not Found\r\n"
-    "Server: " RTSPDVERSION "\r\n"
-    "Connection: close\r\n"
-    "Content-Type: text/html"
-    END_OF_HEADERS
-    "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n"
-    "<HTML><HEAD>\n"
-    "<TITLE>404 Not Found</TITLE>\n"
-    "</HEAD><BODY>\n"
-    "<H1>Not Found</H1>\n"
-    "The requested URL was not found on this server.\n"
-    "<P><HR><ADDRESS>" RTSPDVERSION "</ADDRESS>\n" "</BODY></HTML>\n";
+static const char *doc404_HTTP =
+  "HTTP/1.1 404 Not Found\r\n"
+  "Server: " RTSPDVERSION "\r\n"
+  "Connection: close\r\n"
+  "Content-Type: text/html"
+  END_OF_HEADERS
+  "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n"
+  "<HTML><HEAD>\n"
+  "<TITLE>404 Not Found</TITLE>\n"
+  "</HEAD><BODY>\n"
+  "<H1>Not Found</H1>\n"
+  "The requested URL was not found on this server.\n"
+  "<P><HR><ADDRESS>" RTSPDVERSION "</ADDRESS>\n"
+  "</BODY></HTML>\n";
 
 /* send back this on RTSP 404 file not found */
 static const char *doc404_RTSP = "RTSP/1.0 404 Not Found\r\n"
-    "Server: " RTSPDVERSION
-    END_OF_HEADERS;
+  "Server: " RTSPDVERSION
+  END_OF_HEADERS;
 
 /* Default size to send away fake RTP data */
 #define RTP_DATA_SIZE 12
 static const char *RTP_DATA = "$_1234\n\0Rsdf";
 
-static int ProcessRequest(struct httprequest *req)
+static int rtspd_ProcessRequest(struct rtspd_httprequest *req)
 {
-  char *line = &req->reqbuf[req->checkindex];
+  const char *line = &req->reqbuf[req->checkindex];
   bool chunked = FALSE;
   static char request[REQUEST_KEYWORD_SIZE];
   static char doc[MAXDOCNAMELEN];
   static char prot_str[5];
   int prot_major, prot_minor;
-  char *end = strstr(line, END_OF_HEADERS);
+  const char *end = strstr(line, END_OF_HEADERS);
 
-  logmsg("ProcessRequest() called with testno %ld and line [%s]",
+  logmsg("rtspd_ProcessRequest() called with testno %ld and line [%s]",
          req->testno, line);
 
   /* try to figure out the request characteristics as soon as possible, but
@@ -228,8 +164,9 @@ static int ProcessRequest(struct httprequest *req)
             prot_str,
             &prot_major,
             &prot_minor) == 5) {
-    char *ptr;
-    char logbuf[256];
+    const char *ptr;
+    const char *pval;
+    curl_off_t testnum;
 
     if(!strcmp(prot_str, "HTTP")) {
       req->protocol = RPROT_HTTP;
@@ -243,7 +180,7 @@ static int ProcessRequest(struct httprequest *req)
       return 1;
     }
 
-    req->prot_version = prot_major*10 + prot_minor;
+    req->prot_version = (prot_major * 10) + prot_minor;
 
     /* find the last slash */
     ptr = strrchr(doc, '/');
@@ -252,12 +189,11 @@ static int ProcessRequest(struct httprequest *req)
     if(ptr) {
       FILE *stream;
       if((strlen(doc) + strlen(request)) < 200)
-        msnprintf(logbuf, sizeof(logbuf), "Got request: %s %s %s/%d.%d",
-                  request, doc, prot_str, prot_major, prot_minor);
+        logmsg("Got request: %s %s %s/%d.%d",
+               request, doc, prot_str, prot_major, prot_minor);
       else
-        msnprintf(logbuf, sizeof(logbuf), "Got a *HUGE* request %s/%d.%d",
-                  prot_str, prot_major, prot_minor);
-      logmsg("%s", logbuf);
+        logmsg("Got a *HUGE* request %s/%d.%d",
+               prot_str, prot_major, prot_minor);
 
       if(!strncmp("/verifiedserver", ptr, 15)) {
         logmsg("Are-we-friendly question received");
@@ -277,7 +213,14 @@ static int ProcessRequest(struct httprequest *req)
       while(*ptr && !ISDIGIT(*ptr))
         ptr++;
 
-      req->testno = strtol(ptr, &ptr, 10);
+      pval = ptr;
+      if(!curlx_str_number(&pval, &testnum, INT_MAX))
+        req->testno = (long)testnum;
+      else {
+        req->protocol = RPROT_NONE;
+        logmsg("rtspd: failed to read the test number from '%s'", doc);
+        return 1;
+      }
 
       if(req->testno > 10000) {
         req->partno = req->testno % 10000;
@@ -286,16 +229,16 @@ static int ProcessRequest(struct httprequest *req)
       else
         req->partno = 0;
 
-      msnprintf(logbuf, sizeof(logbuf), "Requested test number %ld part %ld",
-                req->testno, req->partno);
-      logmsg("%s", logbuf);
+      logmsg("Requested test number %ld part %ld", req->testno, req->partno);
 
       stream = test2fopen(req->testno, logdir);
 
       if(!stream) {
+        char errbuf[STRERROR_LEN];
         int error = errno;
-        logmsg("fopen() failed with error: %d %s", error, strerror(error));
-        logmsg("Couldn't open test file %ld", req->testno);
+        logmsg("fopen() failed with error (%d) %s",
+               error, curlx_strerror(error, errbuf, sizeof(errbuf)));
+        logmsg("Could not open test file %ld", req->testno);
         req->open = FALSE; /* closes connection */
         return 1; /* done */
       }
@@ -312,9 +255,9 @@ static int ProcessRequest(struct httprequest *req)
 
         /* get the custom server control "commands" */
         int error = getpart(&cmd, &cmdsize, "reply", "servercmd", stream);
-        fclose(stream);
+        curlx_fclose(stream);
         if(error) {
-          logmsg("getpart() failed with error: %d", error);
+          logmsg("getpart() failed with error (%d)", error);
           req->open = FALSE; /* closes connection */
           return 1; /* done */
         }
@@ -337,15 +280,15 @@ static int ProcessRequest(struct httprequest *req)
               logmsg("instructed to stream");
               req->rcmd = RCMD_STREAM;
             }
-            else if(1 == sscanf(ptr, "pipe: %d", &num)) {
+            else if(sscanf(ptr, "pipe: %d", &num) == 1) {
               logmsg("instructed to allow a pipe size of %d", num);
               if(num < 0)
                 logmsg("negative pipe size ignored");
               else if(num > 0)
-                req->pipe = num-1; /* decrease by one since we don't count the
-                                      first request in this number */
+                req->pipe = num - 1; /* decrease by one since we do not count
+                                        the first request in this number */
             }
-            else if(1 == sscanf(ptr, "skip: %d", &num)) {
+            else if(sscanf(ptr, "skip: %d", &num) == 1) {
               logmsg("instructed to skip this number of bytes %d", num);
               req->skip = num;
             }
@@ -374,6 +317,7 @@ static int ProcessRequest(struct httprequest *req)
 
                 /* Fill it with junk data */
                 for(i = 0; i < rtp_size; i += RTP_DATA_SIZE) {
+                  /* NOLINTNEXTLINE(bugprone-not-null-terminated-result) */
                   memcpy(rtp_scratch + 4 + i, RTP_DATA, RTP_DATA_SIZE);
                 }
 
@@ -382,12 +326,17 @@ static int ProcessRequest(struct httprequest *req)
                   req->rtp_buffersize = rtp_size + 4;
                 }
                 else {
-                  req->rtp_buffer = realloc(req->rtp_buffer,
-                                            req->rtp_buffersize +
-                                            rtp_size + 4);
-                  memcpy(req->rtp_buffer + req->rtp_buffersize, rtp_scratch,
-                         rtp_size + 4);
-                  req->rtp_buffersize += rtp_size + 4;
+                  char *rtp_buffer = realloc(req->rtp_buffer,
+                                             req->rtp_buffersize +
+                                             rtp_size + 4);
+                  if(rtp_buffer) {
+                    req->rtp_buffer = rtp_buffer;
+                    memcpy(req->rtp_buffer + req->rtp_buffersize, rtp_scratch,
+                           rtp_size + 4);
+                    req->rtp_buffersize += rtp_size + 4;
+                  }
+                  else
+                    logmsg("failed resizing buffer.");
                   free(rtp_scratch);
                 }
                 logmsg("rtp_buffersize is %zu, rtp_size is %d.",
@@ -412,23 +361,26 @@ static int ProcessRequest(struct httprequest *req)
     else {
       if(sscanf(req->reqbuf, "CONNECT %" MAXDOCNAMELEN_TXT "s HTTP/%d.%d",
                 doc, &prot_major, &prot_minor) == 3) {
-        msnprintf(logbuf, sizeof(logbuf),
-                  "Received a CONNECT %s HTTP/%d.%d request",
-                  doc, prot_major, prot_minor);
-        logmsg("%s", logbuf);
+        logmsg("Received a CONNECT %s HTTP/%d.%d request",
+               doc, prot_major, prot_minor);
 
         if(req->prot_version == 10)
           req->open = FALSE; /* HTTP 1.0 closes connection by default */
 
         if(!strncmp(doc, "bad", 3))
-          /* if the host name starts with bad, we fake an error here */
+          /* if the hostname starts with bad, we fake an error here */
           req->testno = DOCNUMBER_BADCONNECT;
         else if(!strncmp(doc, "test", 4)) {
-          /* if the host name starts with test, the port number used in the
-             CONNECT line will be used as test number! */
-          char *portp = strchr(doc, ':');
-          if(portp && (*(portp + 1) != '\0') && ISDIGIT(*(portp + 1)))
-            req->testno = strtol(portp + 1, NULL, 10);
+          /* if the hostname starts with test, the port number used in the
+             CONNECT line is used as test number! */
+          const char *portp = strchr(doc, ':');
+          if(portp && (*(portp + 1) != '\0') && ISDIGIT(*(portp + 1))) {
+            pval = portp + 1;
+            if(!curlx_str_number(&pval, &testnum, INT_MAX))
+              req->testno = (long)testnum;
+            else
+              req->testno = DOCNUMBER_CONNECT;
+          }
           else
             req->testno = DOCNUMBER_CONNECT;
         }
@@ -443,11 +395,11 @@ static int ProcessRequest(struct httprequest *req)
   }
 
   if(!end) {
-    /* we don't have a complete request yet! */
-    logmsg("ProcessRequest returned without a complete request");
+    /* we do not have a complete request yet! */
+    logmsg("rtspd_ProcessRequest returned without a complete request");
     return 0; /* not complete yet */
   }
-  logmsg("ProcessRequest found a complete request");
+  logmsg("rtspd_ProcessRequest found a complete request");
 
   if(req->pipe)
     /* we do have a full set, advance the checkindex to after the end of the
@@ -457,7 +409,7 @@ static int ProcessRequest(struct httprequest *req)
   /* **** Persistence ****
    *
    * If the request is an HTTP/1.0 one, we close the connection unconditionally
-   * when we're done.
+   * when we are done.
    *
    * If the request is an HTTP/1.1 one, we MUST check for a "Connection:"
    * header that might say "close". If it does, we close a connection when
@@ -469,34 +421,28 @@ static int ProcessRequest(struct httprequest *req)
     if(got_exit_signal)
       return 1; /* done */
 
-    if((req->cl == 0) && strncasecompare("Content-Length:", line, 15)) {
-      /* If we don't ignore content-length, we read it and we read the whole
-         request including the body before we return. If we've been told to
-         ignore the content-length, we will return as soon as all headers
+    if((req->cl == 0) && !CURL_STRNICMP("Content-Length:", line, 15)) {
+      /* If we do not ignore content-length, we read it and we read the whole
+         request including the body before we return. If we have been told to
+         ignore the content-length, we return as soon as all headers
          have been received */
-      char *endptr;
-      char *ptr = line + 15;
-      unsigned long clen = 0;
-      while(*ptr && ISSPACE(*ptr))
-        ptr++;
-      endptr = ptr;
-      errno = 0;
-      clen = strtoul(ptr, &endptr, 10);
-      if((ptr == endptr) || !ISSPACE(*endptr) || (ERANGE == errno)) {
+      curl_off_t clen;
+      const char *p = line + strlen("Content-Length:");
+      if(curlx_str_numblanks(&p, &clen)) {
         /* this assumes that a zero Content-Length is valid */
-        logmsg("Found invalid Content-Length: (%s) in the request", ptr);
+        logmsg("Found invalid '%s' in the request", line);
         req->open = FALSE; /* closes connection */
         return 1; /* done */
       }
-      req->cl = clen - req->skip;
+      req->cl = (size_t)clen - req->skip;
 
-      logmsg("Found Content-Length: %lu in the request", clen);
+      logmsg("Found Content-Length: %zu in the request", (size_t)clen);
       if(req->skip)
-        logmsg("... but will abort after %zu bytes", req->cl);
+        logmsg("... but going to abort after %zu bytes", req->cl);
       break;
     }
-    else if(strncasecompare("Transfer-Encoding: chunked", line,
-                            strlen("Transfer-Encoding: chunked"))) {
+    else if(!CURL_STRNICMP("Transfer-Encoding: chunked", line,
+                           strlen("Transfer-Encoding: chunked"))) {
       /* chunked data coming in */
       chunked = TRUE;
     }
@@ -598,66 +544,11 @@ static int ProcessRequest(struct httprequest *req)
   return 1; /* done */
 }
 
-/* store the entire request in a file */
-static void storerequest(char *reqbuf, size_t totalsize)
-{
-  int res;
-  int error = 0;
-  size_t written;
-  size_t writeleft;
-  FILE *dump;
-  char dumpfile[256];
-
-  msnprintf(dumpfile, sizeof(dumpfile), "%s/%s", logdir, REQUEST_DUMP);
-
-  if(!reqbuf)
-    return;
-  if(totalsize == 0)
-    return;
-
-  do {
-    dump = fopen(dumpfile, "ab");
-  } while(!dump && ((error = errno) == EINTR));
-  if(!dump) {
-    logmsg("Error opening file %s error: %d %s",
-           dumpfile, error, strerror(error));
-    logmsg("Failed to write request input to %s", dumpfile);
-    return;
-  }
-
-  writeleft = totalsize;
-  do {
-    written = fwrite(&reqbuf[totalsize-writeleft],
-                     1, writeleft, dump);
-    if(got_exit_signal)
-      goto storerequest_cleanup;
-    if(written > 0)
-      writeleft -= written;
-  } while((writeleft > 0) && ((error = errno) == EINTR));
-
-  if(writeleft == 0)
-    logmsg("Wrote request (%zu bytes) input to %s", totalsize, dumpfile);
-  else if(writeleft > 0) {
-    logmsg("Error writing file %s error: %d %s",
-           dumpfile, error, strerror(error));
-    logmsg("Wrote only (%zu bytes) of (%zu bytes) request input to %s",
-           totalsize-writeleft, totalsize, dumpfile);
-  }
-
-storerequest_cleanup:
-
-  do {
-    res = fclose(dump);
-  } while(res && ((error = errno) == EINTR));
-  if(res)
-    logmsg("Error closing file %s error: %d %s",
-           dumpfile, error, strerror(error));
-}
-
 /* return 0 on success, non-zero on failure */
-static int get_request(curl_socket_t sock, struct httprequest *req)
+static int rtspd_get_request(curl_socket_t sock, struct rtspd_httprequest *req)
 {
-  int error;
+  int sockerr;
+  char errbuf[STRERROR_LEN];
   int fail = 0;
   int done_processing = 0;
   char *reqbuf = req->reqbuf;
@@ -671,7 +562,7 @@ static int get_request(curl_socket_t sock, struct httprequest *req)
     pipereq_length = req->offset - req->checkindex;
   }
 
-  /*** Init the httprequest structure properly for the upcoming request ***/
+  /* Init the httprequest structure properly for the upcoming request */
 
   req->checkindex = 0;
   req->offset = 0;
@@ -692,9 +583,9 @@ static int get_request(curl_socket_t sock, struct httprequest *req)
   req->rtp_buffer = NULL;
   req->rtp_buffersize = 0;
 
-  /*** end of httprequest init ***/
+  /* end of httprequest init */
 
-  while(!done_processing && (req->offset < REQBUFSIZ-1)) {
+  while(!done_processing && (req->offset < sizeof(req->reqbuf) - 1)) {
     if(pipereq_length && pipereq) {
       memmove(reqbuf, pipereq, pipereq_length);
       got = curlx_uztosz(pipereq_length);
@@ -703,11 +594,12 @@ static int get_request(curl_socket_t sock, struct httprequest *req)
     else {
       if(req->skip)
         /* we are instructed to not read the entire thing, so we make sure to
-           only read what we're supposed to and NOT read the enire thing the
+           only read what we are supposed to and NOT read the entire thing the
            client wants to send! */
         got = sread(sock, reqbuf + req->offset, req->cl);
       else
-        got = sread(sock, reqbuf + req->offset, REQBUFSIZ-1 - req->offset);
+        got = sread(sock, reqbuf + req->offset,
+                    sizeof(req->reqbuf) - 1 - req->offset);
     }
     if(got_exit_signal)
       return 1;
@@ -716,14 +608,15 @@ static int get_request(curl_socket_t sock, struct httprequest *req)
       fail = 1;
     }
     else if(got < 0) {
-      error = SOCKERRNO;
-      logmsg("recv() returned error: (%d) %s", error, sstrerror(error));
+      sockerr = SOCKERRNO;
+      logmsg("recv() returned error (%d) %s",
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
       fail = 1;
     }
     if(fail) {
       /* dump the request received so far to the external file */
       reqbuf[req->offset] = '\0';
-      storerequest(reqbuf, req->offset);
+      storerequest(reqbuf, req->offset, REQUEST_DUMP);
       return 1;
     }
 
@@ -732,7 +625,7 @@ static int get_request(curl_socket_t sock, struct httprequest *req)
     req->offset += (size_t)got;
     reqbuf[req->offset] = '\0';
 
-    done_processing = ProcessRequest(req);
+    done_processing = rtspd_ProcessRequest(req);
     if(got_exit_signal)
       return 1;
     if(done_processing && req->pipe) {
@@ -742,23 +635,24 @@ static int get_request(curl_socket_t sock, struct httprequest *req)
     }
   }
 
-  if((req->offset == REQBUFSIZ-1) && (got > 0)) {
+  if((req->offset == sizeof(req->reqbuf) - 1) && (got > 0)) {
     logmsg("Request would overflow buffer, closing connection");
     /* dump request received so far to external file anyway */
-    reqbuf[REQBUFSIZ-1] = '\0';
+    reqbuf[sizeof(req->reqbuf) - 1] = '\0';
     fail = 1;
   }
-  else if(req->offset > REQBUFSIZ-1) {
+  else if(req->offset > sizeof(req->reqbuf) - 1) {
     logmsg("Request buffer overflow, closing connection");
     /* dump request received so far to external file anyway */
-    reqbuf[REQBUFSIZ-1] = '\0';
+    reqbuf[sizeof(req->reqbuf) - 1] = '\0';
     fail = 1;
   }
   else
     reqbuf[req->offset] = '\0';
 
   /* dump the request to an external file */
-  storerequest(reqbuf, req->pipelining ? req->checkindex : req->offset);
+  storerequest(reqbuf, req->pipelining ? req->checkindex : req->offset,
+               REQUEST_DUMP);
   if(got_exit_signal)
     return 1;
 
@@ -766,7 +660,7 @@ static int get_request(curl_socket_t sock, struct httprequest *req)
 }
 
 /* returns -1 on failure */
-static int send_doc(curl_socket_t sock, struct httprequest *req)
+static int rtspd_send_doc(curl_socket_t sock, struct rtspd_httprequest *req)
 {
   ssize_t written;
   size_t count;
@@ -779,12 +673,11 @@ static int send_doc(curl_socket_t sock, struct httprequest *req)
   bool sendfailure = FALSE;
   size_t responsesize;
   int error = 0;
-  int res;
+  char errbuf[STRERROR_LEN];
   static char weare[256];
   char responsedump[256];
 
-  msnprintf(responsedump, sizeof(responsedump), "%s/%s",
-            logdir, RESPONSE_DUMP);
+  snprintf(responsedump, sizeof(responsedump), "%s/%s", logdir, RESPONSE_DUMP);
 
   logmsg("Send response number %ld part %ld", req->testno, req->partno);
 
@@ -792,19 +685,19 @@ static int send_doc(curl_socket_t sock, struct httprequest *req)
   default:
   case RCMD_NORMALREQ:
     break; /* continue with business as usual */
-  case RCMD_STREAM:
-#define STREAMTHIS "a string to stream 01234567890\n"
-    count = strlen(STREAMTHIS);
+  case RCMD_STREAM: {
+    static const char streamthis[] = "a string to stream 01234567890\n";
     for(;;) {
-      written = swrite(sock, STREAMTHIS, count);
+      written = swrite(sock, streamthis, sizeof(streamthis) - 1);
       if(got_exit_signal)
         return -1;
-      if(written != (ssize_t)count) {
+      if(written != (ssize_t)(sizeof(streamthis) - 1)) {
         logmsg("Stopped streaming");
         break;
       }
     }
     return -1;
+  }
   case RCMD_IDLE:
     /* Do nothing. Sit idle. Pretend it rains. */
     return 0;
@@ -819,17 +712,17 @@ static int send_doc(curl_socket_t sock, struct httprequest *req)
     switch(req->testno) {
     case DOCNUMBER_QUIT:
       logmsg("Replying to QUIT");
-      buffer = docquit;
+      buffer = docquit_rtsp;
       break;
     case DOCNUMBER_WERULEZ:
       /* we got a "friends?" question, reply back that we sure are */
       logmsg("Identifying ourselves as friends");
-      msnprintf(msgbuf, sizeof(msgbuf), "RTSP_SERVER WE ROOLZ: %"
-                CURL_FORMAT_CURL_OFF_T "\r\n", our_getpid());
+      snprintf(msgbuf, sizeof(msgbuf), "RTSP_SERVER WE ROOLZ: %ld\r\n",
+               (long)our_getpid());
       msglen = strlen(msgbuf);
-      msnprintf(weare, sizeof(weare),
-                "HTTP/1.1 200 OK\r\nContent-Length: %zu\r\n\r\n%s",
-                msglen, msgbuf);
+      snprintf(weare, sizeof(weare),
+               "HTTP/1.1 200 OK\r\nContent-Length: %u\r\n\r\n%s",
+               (unsigned int)msglen, msgbuf);
       buffer = weare;
       break;
     case DOCNUMBER_INTERNAL:
@@ -859,20 +752,21 @@ static int send_doc(curl_socket_t sock, struct httprequest *req)
   }
   else {
     FILE *stream = test2fopen(req->testno, logdir);
-    char partbuf[80]="data";
-    if(0 != req->partno)
-      msnprintf(partbuf, sizeof(partbuf), "data%ld", req->partno);
+    char partbuf[80] = "data";
+    if(req->partno)
+      snprintf(partbuf, sizeof(partbuf), "data%ld", req->partno);
     if(!stream) {
       error = errno;
-      logmsg("fopen() failed with error: %d %s", error, strerror(error));
-      logmsg("Couldn't open test file");
+      logmsg("fopen() failed with error (%d) %s",
+             error, curlx_strerror(error, errbuf, sizeof(errbuf)));
+      logmsg("Could not open test file");
       return 0;
     }
     else {
       error = getpart(&ptr, &count, "reply", partbuf, stream);
-      fclose(stream);
+      curlx_fclose(stream);
       if(error) {
-        logmsg("getpart() failed with error: %d", error);
+        logmsg("getpart() failed with error (%d)", error);
         return 0;
       }
       buffer = ptr;
@@ -887,17 +781,18 @@ static int send_doc(curl_socket_t sock, struct httprequest *req)
     stream = test2fopen(req->testno, logdir);
     if(!stream) {
       error = errno;
-      logmsg("fopen() failed with error: %d %s", error, strerror(error));
-      logmsg("Couldn't open test file");
+      logmsg("fopen() failed with error (%d) %s",
+             error, curlx_strerror(error, errbuf, sizeof(errbuf)));
+      logmsg("Could not open test file");
       free(ptr);
       return 0;
     }
     else {
       /* get the custom server control "commands" */
       error = getpart(&cmd, &cmdsize, "reply", "postcmd", stream);
-      fclose(stream);
+      curlx_fclose(stream);
       if(error) {
-        logmsg("getpart() failed with error: %d", error);
+        logmsg("getpart() failed with error (%d)", error);
         free(ptr);
         return 0;
       }
@@ -911,25 +806,26 @@ static int send_doc(curl_socket_t sock, struct httprequest *req)
   }
 
   /* If the word 'swsclose' is present anywhere in the reply chunk, the
-     connection will be closed after the data has been sent to the requesting
+     connection is closed after the data has been sent to the requesting
      client... */
   if(strstr(buffer, "swsclose") || !count) {
     persistent = FALSE;
     logmsg("connection close instruction \"swsclose\" found in response");
   }
   if(strstr(buffer, "swsbounce")) {
-    prevbounce = TRUE;
+    rtspd_prevbounce = TRUE;
     logmsg("enable \"swsbounce\" in the next request");
   }
   else
-    prevbounce = FALSE;
+    rtspd_prevbounce = FALSE;
 
-  dump = fopen(responsedump, "ab");
+  dump = curlx_fopen(responsedump, "ab");
   if(!dump) {
     error = errno;
-    logmsg("fopen() failed with error: %d %s", error, strerror(error));
-    logmsg("Error opening file: %s", responsedump);
-    logmsg("couldn't create logfile: %s", responsedump);
+    logmsg("fopen() failed with error (%d) %s",
+           error, curlx_strerror(error, errbuf, sizeof(errbuf)));
+    logmsg("Error opening file '%s'", responsedump);
+    logmsg("could not create logfile '%s'", responsedump);
     free(ptr);
     free(cmd);
     return -1;
@@ -937,8 +833,8 @@ static int send_doc(curl_socket_t sock, struct httprequest *req)
 
   responsesize = count;
   do {
-    /* Ok, we send no more than 200 bytes at a time, just to make sure that
-       larger chunks are split up so that the client will need to do multiple
+    /* Ok, we send no more than 200 bytes at a time, to make sure that
+       larger chunks are split up so that the client needs to do multiple
        recv() calls to get it and thus we exercise that code better */
     size_t num = count;
     if(num > 200)
@@ -958,7 +854,7 @@ static int send_doc(curl_socket_t sock, struct httprequest *req)
 
     count -= written;
     buffer += written;
-  } while(count>0);
+  } while(count > 0);
 
   /* Send out any RTP data */
   if(req->rtp_buffer) {
@@ -981,12 +877,9 @@ static int send_doc(curl_socket_t sock, struct httprequest *req)
     req->rtp_buffersize = 0;
   }
 
-  do {
-    res = fclose(dump);
-  } while(res && ((error = errno) == EINTR));
-  if(res)
-    logmsg("Error closing file %s error: %d %s",
-           responsedump, error, strerror(error));
+  if(curlx_fclose(dump))
+    logmsg("Error closing file %s error (%d) %s", responsedump,
+           errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
 
   if(got_exit_signal) {
     free(ptr);
@@ -997,7 +890,7 @@ static int send_doc(curl_socket_t sock, struct httprequest *req)
   if(sendfailure) {
     logmsg("Sending response failed. Only (%zu bytes) of "
            "(%zu bytes) were sent",
-           responsesize-count, responsesize);
+           responsesize - count, responsesize);
     free(ptr);
     free(cmd);
     return -1;
@@ -1013,20 +906,17 @@ static int send_doc(curl_socket_t sock, struct httprequest *req)
     int num;
     ptr = cmd;
     do {
-      if(2 == sscanf(ptr, "%31s %d", command, &num)) {
+      if(sscanf(ptr, "%31s %d", command, &num) == 2) {
         if(!strcmp("wait", command)) {
           logmsg("Told to sleep for %d seconds", num);
           quarters = num * 4;
-          while(quarters > 0) {
+          while((quarters > 0) && !got_exit_signal) {
             quarters--;
-            res = wait_ms(250);
-            if(got_exit_signal)
-              break;
-            if(res) {
+            if(curlx_wait_ms(250)) {
               /* should not happen */
-              error = errno;
-              logmsg("wait_ms() failed with error: (%d) %s",
-                     error, strerror(error));
+              int sockerr = SOCKERRNO;
+              logmsg("curlx_wait_ms() failed with error (%d) %s",
+                     sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
               break;
             }
           }
@@ -1046,14 +936,13 @@ static int send_doc(curl_socket_t sock, struct httprequest *req)
   free(cmd);
   req->open = persistent;
 
-  prevtestno = req->testno;
-  prevpartno = req->partno;
+  rtspd_prevtestno = req->testno;
+  rtspd_prevpartno = req->partno;
 
   return 0;
 }
 
-
-int main(int argc, char *argv[])
+static int test_rtspd(int argc, const char *argv[])
 {
   srvr_sockaddr_union_t me;
   curl_socket_t sock = CURL_SOCKET_BAD;
@@ -1061,58 +950,62 @@ int main(int argc, char *argv[])
   int wrotepidfile = 0;
   int wroteportfile = 0;
   int flag;
-  unsigned short port = DEFAULT_PORT;
-  const char *pidname = ".rtsp.pid";
-  const char *portname = NULL; /* none by default */
-  struct httprequest req;
+  unsigned short port = 8999;
+  struct rtspd_httprequest req;
   int rc;
-  int error;
+  int sockerr;
+  char errbuf[STRERROR_LEN];
   int arg = 1;
 
   memset(&req, 0, sizeof(req));
 
-  while(argc>arg) {
+  pidname = ".rtsp.pid";
+  serverlogfile = "log/rtspd.log";
+  serverlogslocked = 0;
+
+  while(argc > arg) {
+    const char *opt;
+    curl_off_t num;
     if(!strcmp("--version", argv[arg])) {
       printf("rtspd IPv4%s"
-             "\n"
-             ,
-#ifdef ENABLE_IPV6
+             "\n",
+#ifdef USE_IPV6
              "/IPv6"
 #else
              ""
 #endif
-             );
+      );
       return 0;
     }
     else if(!strcmp("--pidfile", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         pidname = argv[arg++];
     }
     else if(!strcmp("--portfile", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         portname = argv[arg++];
     }
     else if(!strcmp("--logfile", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         serverlogfile = argv[arg++];
     }
     else if(!strcmp("--logdir", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         logdir = argv[arg++];
     }
     else if(!strcmp("--ipv4", argv[arg])) {
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
       ipv_inuse = "IPv4";
       use_ipv6 = FALSE;
 #endif
       arg++;
     }
     else if(!strcmp("--ipv6", argv[arg])) {
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
       ipv_inuse = "IPv6";
       use_ipv6 = TRUE;
 #endif
@@ -1120,17 +1013,17 @@ int main(int argc, char *argv[])
     }
     else if(!strcmp("--port", argv[arg])) {
       arg++;
-      if(argc>arg) {
-        char *endptr;
-        unsigned long ulnum = strtoul(argv[arg], &endptr, 10);
-        port = curlx_ultous(ulnum);
+      if(argc > arg) {
+        opt = argv[arg];
+        if(!curlx_str_number(&opt, &num, 0xffff))
+          port = (unsigned short)num;
         arg++;
       }
     }
     else if(!strcmp("--srcdir", argv[arg])) {
       arg++;
-      if(argc>arg) {
-        path = argv[arg];
+      if(argc > arg) {
+        srcpath = argv[arg];
         arg++;
       }
     }
@@ -1149,41 +1042,36 @@ int main(int argc, char *argv[])
     }
   }
 
-  msnprintf(loglockfile, sizeof(loglockfile), "%s/%s/rtsp-%s.lock",
-            logdir, SERVERLOGS_LOCKDIR, ipv_inuse);
+  snprintf(loglockfile, sizeof(loglockfile), "%s/%s/rtsp-%s.lock",
+           logdir, SERVERLOGS_LOCKDIR, ipv_inuse);
 
-#ifdef WIN32
-  win32_init();
-  atexit(win32_cleanup);
-#endif
+  install_signal_handlers(FALSE);
 
-  install_signal_handlers(false);
-
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
   if(!use_ipv6)
 #endif
     sock = socket(AF_INET, SOCK_STREAM, 0);
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
   else
     sock = socket(AF_INET6, SOCK_STREAM, 0);
 #endif
 
-  if(CURL_SOCKET_BAD == sock) {
-    error = SOCKERRNO;
-    logmsg("Error creating socket: (%d) %s", error, sstrerror(error));
+  if(sock == CURL_SOCKET_BAD) {
+    sockerr = SOCKERRNO;
+    logmsg("Error creating socket (%d) %s",
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
     goto server_cleanup;
   }
 
   flag = 1;
-  if(0 != setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
-            (void *)&flag, sizeof(flag))) {
-    error = SOCKERRNO;
-    logmsg("setsockopt(SO_REUSEADDR) failed with error: (%d) %s",
-           error, sstrerror(error));
+  if(setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&flag, sizeof(flag))) {
+    sockerr = SOCKERRNO;
+    logmsg("setsockopt(SO_REUSEADDR) failed with error (%d) %s",
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
     goto server_cleanup;
   }
 
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
   if(!use_ipv6) {
 #endif
     memset(&me.sa4, 0, sizeof(me.sa4));
@@ -1191,7 +1079,7 @@ int main(int argc, char *argv[])
     me.sa4.sin_addr.s_addr = INADDR_ANY;
     me.sa4.sin_port = htons(port);
     rc = bind(sock, &me.sa, sizeof(me.sa4));
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
   }
   else {
     memset(&me.sa6, 0, sizeof(me.sa6));
@@ -1200,11 +1088,11 @@ int main(int argc, char *argv[])
     me.sa6.sin6_port = htons(port);
     rc = bind(sock, &me.sa, sizeof(me.sa6));
   }
-#endif /* ENABLE_IPV6 */
-  if(0 != rc) {
-    error = SOCKERRNO;
-    logmsg("Error binding socket on port %hu: (%d) %s",
-           port, error, sstrerror(error));
+#endif /* USE_IPV6 */
+  if(rc) {
+    sockerr = SOCKERRNO;
+    logmsg("Error binding socket on port %hu (%d) %s", port,
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
     goto server_cleanup;
   }
 
@@ -1213,19 +1101,19 @@ int main(int argc, char *argv[])
        port we actually got and update the listener port value with it. */
     curl_socklen_t la_size;
     srvr_sockaddr_union_t localaddr;
-#ifdef ENABLE_IPV6
+    memset(&localaddr, 0, sizeof(localaddr));
+#ifdef USE_IPV6
     if(!use_ipv6)
 #endif
       la_size = sizeof(localaddr.sa4);
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
     else
       la_size = sizeof(localaddr.sa6);
 #endif
-    memset(&localaddr.sa, 0, (size_t)la_size);
     if(getsockname(sock, &localaddr.sa, &la_size) < 0) {
-      error = SOCKERRNO;
-      logmsg("getsockname() failed with error: (%d) %s",
-             error, sstrerror(error));
+      sockerr = SOCKERRNO;
+      logmsg("getsockname() failed with error (%d) %s",
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
       sclose(sock);
       goto server_cleanup;
     }
@@ -1233,7 +1121,7 @@ int main(int argc, char *argv[])
     case AF_INET:
       port = ntohs(localaddr.sa4.sin_port);
       break;
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
     case AF_INET6:
       port = ntohs(localaddr.sa6.sin6_port);
       break;
@@ -1254,18 +1142,17 @@ int main(int argc, char *argv[])
   logmsg("Running %s version on port %d", ipv_inuse, (int)port);
 
   /* start accepting connections */
-  rc = listen(sock, 5);
-  if(0 != rc) {
-    error = SOCKERRNO;
-    logmsg("listen() failed with error: (%d) %s",
-           error, sstrerror(error));
+  if(listen(sock, 5)) {
+    sockerr = SOCKERRNO;
+    logmsg("listen() failed with error (%d) %s",
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
     goto server_cleanup;
   }
 
   /*
-  ** As soon as this server writes its pid file the test harness will
-  ** attempt to connect to this server and initiate its verification.
-  */
+   * As soon as this server writes its pid file the test harness attempts
+   * to connect to this server and initiate its verification.
+   */
 
   wrotepidfile = write_pidfile(pidname);
   if(!wrotepidfile)
@@ -1282,39 +1169,39 @@ int main(int argc, char *argv[])
 
     if(got_exit_signal)
       break;
-    if(CURL_SOCKET_BAD == msgsock) {
-      error = SOCKERRNO;
-      logmsg("MAJOR ERROR: accept() failed with error: (%d) %s",
-             error, sstrerror(error));
+    if(msgsock == CURL_SOCKET_BAD) {
+      sockerr = SOCKERRNO;
+      logmsg("MAJOR ERROR, accept() failed with error (%d) %s",
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
       break;
     }
 
     /*
-    ** As soon as this server acepts a connection from the test harness it
-    ** must set the server logs advisor read lock to indicate that server
-    ** logs should not be read until this lock is removed by this server.
-    */
+     * As soon as this server accepts a connection from the test harness it
+     * must set the server logs advisor read lock to indicate that server
+     * logs should not be read until this lock is removed by this server.
+     */
 
     set_advisor_read_lock(loglockfile);
     serverlogslocked = 1;
 
     logmsg("====> Client connect");
 
-#ifdef TCP_NODELAY
+#if defined(TCP_NODELAY) && !defined(__EMSCRIPTEN__)
     /*
      * Disable the Nagle algorithm to make it easier to send out a large
      * response in many small segments to torture the clients more.
      */
     flag = 1;
     if(setsockopt(msgsock, IPPROTO_TCP, TCP_NODELAY,
-                   (void *)&flag, sizeof(flag)) == -1) {
+                  (void *)&flag, sizeof(flag)) == -1) {
       logmsg("====> TCP_NODELAY failed");
     }
 #endif
 
-    /* initialization of httprequest struct is done in get_request(), but due
-       to pipelining treatment the pipelining struct field must be initialized
-       previously to FALSE every time a new connection arrives. */
+    /* initialization of httprequest struct is done in rtspd_get_request(),
+       but due to pipelining treatment the pipelining struct field must be
+       initialized previously to FALSE every time a new connection arrives. */
 
     req.pipelining = FALSE;
 
@@ -1322,25 +1209,24 @@ int main(int argc, char *argv[])
       if(got_exit_signal)
         break;
 
-      if(get_request(msgsock, &req))
+      if(rtspd_get_request(msgsock, &req))
         /* non-zero means error, break out of loop */
         break;
 
-      if(prevbounce) {
+      if(rtspd_prevbounce) {
         /* bounce treatment requested */
-        if((req.testno == prevtestno) &&
-           (req.partno == prevpartno)) {
-          req.partno++;
+        if(req.testno == rtspd_prevtestno) {
+          req.partno = rtspd_prevpartno + 1;
           logmsg("BOUNCE part number to %ld", req.partno);
         }
         else {
-          prevbounce = FALSE;
-          prevtestno = -1;
-          prevpartno = -1;
+          rtspd_prevbounce = FALSE;
+          rtspd_prevtestno = -1;
+          rtspd_prevpartno = -1;
         }
       }
 
-      send_doc(msgsock, &req);
+      rtspd_send_doc(msgsock, &req);
       if(got_exit_signal)
         break;
 
@@ -1395,11 +1281,11 @@ server_cleanup:
     clear_advisor_read_lock(loglockfile);
   }
 
-  restore_signal_handlers(false);
+  restore_signal_handlers(FALSE);
 
   if(got_exit_signal) {
     logmsg("========> %s rtspd (port: %d pid: %ld) exits with signal (%d)",
-           ipv_inuse, (int)port, (long)getpid(), exit_signal);
+           ipv_inuse, (int)port, (long)our_getpid(), exit_signal);
     /*
      * To properly set the return status of the process we
      * must raise the same signal SIGINT or SIGTERM that we
diff --git a/third-party/curl/tests/server/server_setup.h b/third-party/curl/tests/server/server_setup.h
deleted file mode 100644
index 8bdcc913b1..0000000000
--- a/third-party/curl/tests/server/server_setup.h
+++ /dev/null
@@ -1,31 +0,0 @@
-#ifndef HEADER_CURL_SERVER_SETUP_H
-#define HEADER_CURL_SERVER_SETUP_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#define CURL_NO_OLDIES
-
-#include "curl_setup.h" /* portability help from the lib directory */
-
-#endif /* HEADER_CURL_SERVER_SETUP_H */
diff --git a/third-party/curl/tests/server/server_sockaddr.h b/third-party/curl/tests/server/server_sockaddr.h
deleted file mode 100644
index c48c7c7c38..0000000000
--- a/third-party/curl/tests/server/server_sockaddr.h
+++ /dev/null
@@ -1,43 +0,0 @@
-#ifndef HEADER_CURL_SERVER_SOCKADDR_H
-#define HEADER_CURL_SERVER_SOCKADDR_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "server_setup.h"
-
-#ifdef HAVE_SYS_UN_H
-#include <sys/un.h> /* for sockaddr_un */
-#endif
-
-typedef union {
-  struct sockaddr      sa;
-  struct sockaddr_in   sa4;
-#ifdef ENABLE_IPV6
-  struct sockaddr_in6  sa6;
-#endif
-#ifdef USE_UNIX_SOCKETS
-  struct sockaddr_un   sau;
-#endif
-} srvr_sockaddr_union_t;
-
-#endif /* HEADER_CURL_SERVER_SOCKADDR_H */
diff --git a/third-party/curl/tests/server/sockfilt.c b/third-party/curl/tests/server/sockfilt.c
index d478b4f426..d25195af2d 100644
--- a/third-party/curl/tests/server/sockfilt.c
+++ b/third-party/curl/tests/server/sockfilt.c
@@ -21,7 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "server_setup.h"
+#include "first.h"
 
 /* Purpose
  *
@@ -44,7 +44,7 @@
  *
  * o We want FTP-SSL support, which means that a connection that starts with
  *   plain sockets needs to be able to "go SSL" in the midst. This would also
- *   require some nasty perl stuff I'd rather avoid.
+ *   require some nasty perl stuff I would rather avoid.
  *
  * (Source originally based on sws.c)
  */
@@ -57,25 +57,24 @@
  *
  * This program is intended to be highly portable and as such it must be kept
  * as simple as possible, due to this the only signal handling mechanisms used
- * will be those of ANSI C, and used only in the most basic form which is good
+ * are those of ANSI C, and used only in the most basic form which is good
  * enough for the purpose of this program.
  *
  * For the above reason and the specific needs of this program signals SIGHUP,
- * SIGPIPE and SIGALRM will be simply ignored on systems where this can be
- * done.  If possible, signals SIGINT and SIGTERM will be handled by this
+ * SIGPIPE and SIGALRM are ignored on systems where this can be
+ * done.  If possible, signals SIGINT and SIGTERM are handled by this
  * program as an indication to cleanup and finish execution as soon as
- * possible.  This will be achieved with a single signal handler
+ * possible.  This is achieved with a single signal handler
  * 'exit_signal_handler' for both signals.
  *
  * The 'exit_signal_handler' upon the first SIGINT or SIGTERM received signal
- * will just set to one the global var 'got_exit_signal' storing in global var
+ * sets to one the global var 'got_exit_signal' storing in global var
  * 'exit_signal' the signal that triggered this change.
  *
  * Nothing fancy that could introduce problems is used, the program at certain
  * points in its normal flow checks if var 'got_exit_signal' is set and in
- * case this is true it just makes its way out of loops and functions in
- * structured and well behaved manner to achieve proper program cleanup and
- * termination.
+ * case this is true it makes its way out of loops and functions in structured
+ * and well behaved manner to achieve proper program cleanup and termination.
  *
  * Even with the above mechanism implemented it is worthwhile to note that
  * other signals might still be received, or that there might be systems on
@@ -85,63 +84,14 @@
  * it!
  */
 
-#ifdef HAVE_SIGNAL_H
-#include <signal.h>
-#endif
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-#ifdef HAVE_NETINET_IN6_H
-#include <netinet/in6.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
-
-#define ENABLE_CURLX_PRINTF
-/* make the curlx header define all printf() functions to use the curlx_*
-   versions instead */
-#include "curlx.h" /* from the private lib dir */
-#include "getpart.h"
-#include "inet_pton.h"
-#include "util.h"
-#include "server_sockaddr.h"
-#include "timediff.h"
-#include "warnless.h"
-
-/* include memdebug.h last */
-#include "memdebug.h"
-
-#ifdef USE_WINSOCK
-#undef  EINTR
-#define EINTR    4 /* errno.h value */
-#undef  EAGAIN
-#define EAGAIN  11 /* errno.h value */
-#undef  ENOMEM
-#define ENOMEM  12 /* errno.h value */
-#undef  EINVAL
-#define EINVAL  22 /* errno.h value */
-#endif
-
-#define DEFAULT_PORT 8999
-
-#ifndef DEFAULT_LOGFILE
-#define DEFAULT_LOGFILE "log/sockfilt.log"
-#endif
-
-const char *serverlogfile = DEFAULT_LOGFILE;
+/* buffer is this excessively large only to be able to support things like
+   test 1003 which tests exceedingly large server response lines */
+#define BUFFER_SIZE 17010
 
 static bool verbose = FALSE;
-static bool bind_only = FALSE;
-#ifdef ENABLE_IPV6
-static bool use_ipv6 = FALSE;
-#endif
-static const char *ipv_inuse = "IPv4";
-static unsigned short port = DEFAULT_PORT;
-static unsigned short connectport = 0; /* if non-zero, we activate this mode */
+static bool s_bind_only = FALSE;
+static unsigned short server_connectport = 0; /* if non-zero,
+                                                 we activate this mode */
 
 enum sockmode {
   PASSIVE_LISTEN,    /* as a server waiting for connections */
@@ -150,7 +100,7 @@ enum sockmode {
   ACTIVE_DISCONNECT  /* as a client, disconnected from server */
 };
 
-#ifdef WIN32
+#if defined(_WIN32) && !defined(CURL_WINDOWS_UWP)
 /*
  * read-wrapper to support reading from stdin on Windows.
  */
@@ -177,11 +127,9 @@ static ssize_t read_wincon(int fd, void *buf, size_t count)
     return rcount;
   }
 
-  errno = GetLastError();
+  errno = (int)GetLastError();
   return -1;
 }
-#undef  read
-#define read(a,b,c) read_wincon(a,b,c)
 
 /*
  * write-wrapper to support writing to stdout and stderr on Windows.
@@ -212,28 +160,35 @@ static ssize_t write_wincon(int fd, const void *buf, size_t count)
     return wcount;
   }
 
-  errno = GetLastError();
+  errno = (int)GetLastError();
   return -1;
 }
-#undef  write
-#define write(a,b,c) write_wincon(a,b,c)
+#define SOCKFILT_read  read_wincon
+#define SOCKFILT_write write_wincon
+#else
+#define SOCKFILT_read  read
+#define SOCKFILT_write write
 #endif
 
+/* On Windows, we sometimes get this for a broken pipe, seemingly
+ * when the client closed stdin? */
+#define CURL_WIN32_EPIPE 109
+
 /*
- * fullread is a wrapper around the read() function. This will repeat the call
+ * fullread is a wrapper around the read() function. This repeats the call
  * to read() until it actually has read the complete number of bytes indicated
  * in nbytes or it fails with a condition that cannot be handled with a simple
  * retry of the read call.
  */
-
 static ssize_t fullread(int filedes, void *buffer, size_t nbytes)
 {
   int error;
   ssize_t nread = 0;
 
   do {
-    ssize_t rc = read(filedes,
-                      (unsigned char *)buffer + nread, nbytes - nread);
+    ssize_t rc = SOCKFILT_read(filedes,
+                               (unsigned char *)buffer + nread,
+                               nbytes - nread);
 
     if(got_exit_signal) {
       logmsg("signalled to die");
@@ -241,12 +196,19 @@ static ssize_t fullread(int filedes, void *buffer, size_t nbytes)
     }
 
     if(rc < 0) {
+      char errbuf[STRERROR_LEN];
       error = errno;
+      /* !checksrc! disable ERRNOVAR 1 */
       if((error == EINTR) || (error == EAGAIN))
         continue;
+      if(error == CURL_WIN32_EPIPE) {
+        logmsg("got Windows ERROR_BROKEN_PIPE on fd=%d, treating as close",
+               filedes);
+        return 0;
+      }
       logmsg("reading from file descriptor: %d,", filedes);
-      logmsg("unrecoverable read() failure: (%d) %s",
-             error, strerror(error));
+      logmsg("unrecoverable read() failure (%d) %s",
+             error, curlx_strerror(error, errbuf, sizeof(errbuf)));
       return -1;
     }
 
@@ -266,20 +228,20 @@ static ssize_t fullread(int filedes, void *buffer, size_t nbytes)
 }
 
 /*
- * fullwrite is a wrapper around the write() function. This will repeat the
+ * fullwrite is a wrapper around the write() function. This repeats the
  * call to write() until it actually has written the complete number of bytes
  * indicated in nbytes or it fails with a condition that cannot be handled
  * with a simple retry of the write call.
  */
-
 static ssize_t fullwrite(int filedes, const void *buffer, size_t nbytes)
 {
   int error;
   ssize_t nwrite = 0;
 
   do {
-    ssize_t wc = write(filedes, (const unsigned char *)buffer + nwrite,
-                       nbytes - nwrite);
+    ssize_t wc = SOCKFILT_write(filedes,
+                                (const unsigned char *)buffer + nwrite,
+                                nbytes - nwrite);
 
     if(got_exit_signal) {
       logmsg("signalled to die");
@@ -287,12 +249,14 @@ static ssize_t fullwrite(int filedes, const void *buffer, size_t nbytes)
     }
 
     if(wc < 0) {
+      char errbuf[STRERROR_LEN];
       error = errno;
+      /* !checksrc! disable ERRNOVAR 1 */
       if((error == EINTR) || (error == EAGAIN))
         continue;
       logmsg("writing to file descriptor: %d,", filedes);
-      logmsg("unrecoverable write() failure: (%d) %s",
-             error, strerror(error));
+      logmsg("unrecoverable write() failure (%d) %s",
+             error, curlx_strerror(error, errbuf, sizeof(errbuf)));
       return -1;
     }
 
@@ -313,11 +277,10 @@ static ssize_t fullwrite(int filedes, const void *buffer, size_t nbytes)
 
 /*
  * read_stdin tries to read from stdin nbytes into the given buffer. This is a
- * blocking function that will only return TRUE when nbytes have actually been
+ * blocking function that only returns TRUE when nbytes have actually been
  * read or FALSE when an unrecoverable error has been detected. Failure of this
  * function is an indication that the sockfilt process should terminate.
  */
-
 static bool read_stdin(void *buffer, size_t nbytes)
 {
   ssize_t nread = fullread(fileno(stdin), buffer, nbytes);
@@ -330,14 +293,14 @@ static bool read_stdin(void *buffer, size_t nbytes)
 
 /*
  * write_stdout tries to write to stdio nbytes from the given buffer. This is a
- * blocking function that will only return TRUE when nbytes have actually been
+ * blocking function that only returns TRUE when nbytes have actually been
  * written or FALSE when an unrecoverable error has been detected. Failure of
  * this function is an indication that the sockfilt process should terminate.
  */
-
 static bool write_stdout(const void *buffer, size_t nbytes)
 {
-  ssize_t nwrite = fullwrite(fileno(stdout), buffer, nbytes);
+  ssize_t nwrite;
+  nwrite = fullwrite(fileno(stdout), buffer, nbytes);
   if(nwrite != (ssize_t)nbytes) {
     logmsg("exiting...");
     return FALSE;
@@ -345,39 +308,39 @@ static bool write_stdout(const void *buffer, size_t nbytes)
   return TRUE;
 }
 
-static void lograw(unsigned char *buffer, ssize_t len)
+static void lograw(const unsigned char *buffer, ssize_t len)
 {
   char data[120];
   ssize_t i;
-  unsigned char *ptr = buffer;
+  const unsigned char *ptr = buffer;
   char *optr = data;
   ssize_t width = 0;
   int left = sizeof(data);
 
-  for(i = 0; i<len; i++) {
+  for(i = 0; i < len; i++) {
     switch(ptr[i]) {
     case '\n':
-      msnprintf(optr, left, "\\n");
+      snprintf(optr, left, "\\n");
       width += 2;
       optr += 2;
       left -= 2;
       break;
     case '\r':
-      msnprintf(optr, left, "\\r");
+      snprintf(optr, left, "\\r");
       width += 2;
       optr += 2;
       left -= 2;
       break;
     default:
-      msnprintf(optr, left, "%c", (ISGRAPH(ptr[i]) ||
-                                   ptr[i] == 0x20) ?ptr[i]:'.');
+      snprintf(optr, left, "%c", (ISGRAPH(ptr[i]) ||
+                                  ptr[i] == 0x20) ? ptr[i] : '.');
       width++;
       optr++;
       left--;
       break;
     }
 
-    if(width>60) {
+    if(width > 60) {
       logmsg("'%s'", data);
       width = 0;
       optr = data;
@@ -388,30 +351,62 @@ static void lograw(unsigned char *buffer, ssize_t len)
     logmsg("'%s'", data);
 }
 
-#ifdef USE_WINSOCK
 /*
- * WinSock select() does not support standard file descriptors,
+ * handle the DATA command
+ * maxlen is the available space in buffer (input)
+ * *buffer_len is the amount of data in the buffer (output)
+ */
+static bool read_data_block(unsigned char *buffer, ssize_t maxlen,
+                            ssize_t *buffer_len)
+{
+  curl_off_t value;
+  const char *endp;
+
+  if(!read_stdin(buffer, 5))
+    return FALSE;
+
+  buffer[5] = '\0';
+
+  endp = (const char *)buffer;
+  if(curlx_str_hex(&endp, &value, 0xfffff)) {
+    logmsg("Failed to decode buffer size");
+    return FALSE;
+  }
+  *buffer_len = (ssize_t)value;
+  if(*buffer_len > maxlen) {
+    logmsg("Buffer size (%zd bytes) too small for data size error "
+           "(%zd bytes)", maxlen, *buffer_len);
+    return FALSE;
+  }
+  logmsg("> %zd bytes data, server => client", *buffer_len);
+
+  if(!read_stdin(buffer, *buffer_len))
+    return FALSE;
+
+  lograw(buffer, *buffer_len);
+
+  return TRUE;
+}
+
+#if defined(USE_WINSOCK) && !defined(CURL_WINDOWS_UWP)
+/*
+ * Winsock select() does not support standard file descriptors,
  * it can only check SOCKETs. The following function is an attempt
  * to re-create a select() function with support for other handle types.
  *
- * select() function with support for WINSOCK2 sockets and all
+ * select() function with support for Winsock2 sockets and all
  * other handle types supported by WaitForMultipleObjectsEx() as
  * well as disk files, anonymous and names pipes, and character input.
  *
- * https://msdn.microsoft.com/en-us/library/windows/desktop/ms687028.aspx
- * https://msdn.microsoft.com/en-us/library/windows/desktop/ms741572.aspx
+ * https://learn.microsoft.com/windows/win32/api/synchapi/nf-synchapi-waitformultipleobjectsex
+ * https://learn.microsoft.com/windows/win32/api/winsock2/nf-winsock2-wsaenumnetworkevents
  */
 struct select_ws_wait_data {
   HANDLE handle; /* actual handle to wait for during select */
   HANDLE signal; /* internal event to signal handle trigger */
   HANDLE abort;  /* internal event to abort waiting threads */
 };
-#ifdef _WIN32_WCE
-static DWORD WINAPI select_ws_wait_thread(LPVOID lpParameter)
-#else
-#include <process.h>
-static unsigned int WINAPI select_ws_wait_thread(void *lpParameter)
-#endif
+static DWORD WINAPI select_ws_wait_thread(void *lpParameter)
 {
   struct select_ws_wait_data *data;
   HANDLE signal, handle, handles[2];
@@ -420,7 +415,7 @@ static unsigned int WINAPI select_ws_wait_thread(void *lpParameter)
   DWORD type, length, ret;
 
   /* retrieve handles from internal structure */
-  data = (struct select_ws_wait_data *) lpParameter;
+  data = (struct select_ws_wait_data *)lpParameter;
   if(data) {
     handle = data->handle;
     handles[0] = data->abort;
@@ -434,181 +429,177 @@ static unsigned int WINAPI select_ws_wait_thread(void *lpParameter)
   /* retrieve the type of file to wait on */
   type = GetFileType(handle);
   switch(type) {
-    case FILE_TYPE_DISK:
-       /* The handle represents a file on disk, this means:
-        * - WaitForMultipleObjectsEx will always be signalled for it.
-        * - comparison of current position in file and total size of
-        *   the file can be used to check if we reached the end yet.
-        *
-        * Approach: Loop till either the internal event is signalled
-        *           or if the end of the file has already been reached.
-        */
-      while(WaitForMultipleObjectsEx(1, handles, FALSE, 0, FALSE)
-            == WAIT_TIMEOUT) {
-        /* get total size of file */
-        length = 0;
-        size.QuadPart = 0;
-        size.LowPart = GetFileSize(handle, &length);
-        if((size.LowPart != INVALID_FILE_SIZE) ||
-            (GetLastError() == NO_ERROR)) {
-          size.HighPart = length;
-          /* get the current position within the file */
-          pos.QuadPart = 0;
-          pos.LowPart = SetFilePointer(handle, 0, &pos.HighPart, FILE_CURRENT);
-          if((pos.LowPart != INVALID_SET_FILE_POINTER) ||
-              (GetLastError() == NO_ERROR)) {
-            /* compare position with size, abort if not equal */
-            if(size.QuadPart == pos.QuadPart) {
-              /* sleep and continue waiting */
-              SleepEx(0, FALSE);
-              continue;
-            }
-          }
-        }
-        /* there is some data available, stop waiting */
-        logmsg("[select_ws_wait_thread] data available, DISK: %p", handle);
-        SetEvent(signal);
-      }
-      break;
-
-    case FILE_TYPE_CHAR:
-       /* The handle represents a character input, this means:
-        * - WaitForMultipleObjectsEx will be signalled on any kind of input,
-        *   including mouse and window size events we do not care about.
-        *
-        * Approach: Loop till either the internal event is signalled
-        *           or we get signalled for an actual key-event.
-        */
-      while(WaitForMultipleObjectsEx(2, handles, FALSE, INFINITE, FALSE)
-            == WAIT_OBJECT_0 + 1) {
-        /* check if this is an actual console handle */
-        if(GetConsoleMode(handle, &ret)) {
-          /* retrieve an event from the console buffer */
-          length = 0;
-          if(PeekConsoleInput(handle, &inputrecord, 1, &length)) {
-            /* check if the event is not an actual key-event */
-            if(length == 1 && inputrecord.EventType != KEY_EVENT) {
-              /* purge the non-key-event and continue waiting */
-              ReadConsoleInput(handle, &inputrecord, 1, &length);
-              continue;
-            }
-          }
-        }
-        /* there is some data available, stop waiting */
-        logmsg("[select_ws_wait_thread] data available, CHAR: %p", handle);
-        SetEvent(signal);
-      }
-      break;
-
-    case FILE_TYPE_PIPE:
-       /* The handle represents an anonymous or named pipe, this means:
-        * - WaitForMultipleObjectsEx will always be signalled for it.
-        * - peek into the pipe and retrieve the amount of data available.
-        *
-        * Approach: Loop till either the internal event is signalled
-        *           or there is data in the pipe available for reading.
-        */
-      while(WaitForMultipleObjectsEx(1, handles, FALSE, 0, FALSE)
-            == WAIT_TIMEOUT) {
-        /* peek into the pipe and retrieve the amount of data available */
-        length = 0;
-        if(PeekNamedPipe(handle, NULL, 0, NULL, &length, NULL)) {
-          /* if there is no data available, sleep and continue waiting */
-          if(length == 0) {
+  case FILE_TYPE_DISK:
+    /* The handle represents a file on disk, this means:
+     * - WaitForMultipleObjectsEx is always signalled for it.
+     * - comparison of current position in file and total size of
+     *   the file can be used to check if we reached the end yet.
+     *
+     * Approach: Loop till either the internal event is signalled
+     *           or if the end of the file has already been reached.
+     */
+    while(WaitForMultipleObjectsEx(1, handles, FALSE, 0, FALSE)
+          == WAIT_TIMEOUT) {
+      /* get total size of file */
+      length = 0;
+      size.QuadPart = 0;
+      size.LowPart = GetFileSize(handle, &length);
+      if((size.LowPart != INVALID_FILE_SIZE) ||
+         (GetLastError() == NO_ERROR)) {
+        size.HighPart = (LONG)length;
+        /* get the current position within the file */
+        pos.QuadPart = 0;
+        pos.LowPart = SetFilePointer(handle, 0, &pos.HighPart, FILE_CURRENT);
+        if((pos.LowPart != INVALID_SET_FILE_POINTER) ||
+           (GetLastError() == NO_ERROR)) {
+          /* compare position with size, abort if not equal */
+          if(size.QuadPart == pos.QuadPart) {
+            /* sleep and continue waiting */
             SleepEx(0, FALSE);
             continue;
           }
-          else {
-            logmsg("[select_ws_wait_thread] PeekNamedPipe len: %d", length);
+        }
+      }
+      /* there is some data available, stop waiting */
+      logmsg("[select_ws_wait_thread] data available, DISK: %p", handle);
+      SetEvent(signal);
+    }
+    break;
+
+  case FILE_TYPE_CHAR:
+    /* The handle represents a character input, this means:
+     * - WaitForMultipleObjectsEx is signalled on any kind of input,
+     *   including mouse and window size events we do not care about.
+     *
+     * Approach: Loop till either the internal event is signalled
+     *           or we get signalled for an actual key-event.
+     */
+    while(WaitForMultipleObjectsEx(2, handles, FALSE, INFINITE, FALSE)
+          == WAIT_OBJECT_0 + 1) {
+      /* check if this is an actual console handle */
+      if(GetConsoleMode(handle, &ret)) {
+        /* retrieve an event from the console buffer */
+        length = 0;
+        if(PeekConsoleInput(handle, &inputrecord, 1, &length)) {
+          /* check if the event is not an actual key-event */
+          if(length == 1 && inputrecord.EventType != KEY_EVENT) {
+            /* purge the non-key-event and continue waiting */
+            ReadConsoleInput(handle, &inputrecord, 1, &length);
+            continue;
           }
         }
+      }
+      /* there is some data available, stop waiting */
+      logmsg("[select_ws_wait_thread] data available, CHAR: %p", handle);
+      SetEvent(signal);
+    }
+    break;
+
+  case FILE_TYPE_PIPE:
+    /* The handle represents an anonymous or named pipe, this means:
+     * - WaitForMultipleObjectsEx is always signalled for it.
+     * - peek into the pipe and retrieve the amount of data available.
+     *
+     * Approach: Loop till either the internal event is signalled
+     *           or there is data in the pipe available for reading.
+     */
+    while(WaitForMultipleObjectsEx(1, handles, FALSE, 0, FALSE)
+          == WAIT_TIMEOUT) {
+      /* peek into the pipe and retrieve the amount of data available */
+      length = 0;
+      if(PeekNamedPipe(handle, NULL, 0, NULL, &length, NULL)) {
+        /* if there is no data available, sleep and continue waiting */
+        if(length == 0) {
+          SleepEx(0, FALSE);
+          continue;
+        }
         else {
-          /* if the pipe has NOT been closed, sleep and continue waiting */
-          ret = GetLastError();
-          if(ret != ERROR_BROKEN_PIPE) {
-            logmsg("[select_ws_wait_thread] PeekNamedPipe error: %d", ret);
-            SleepEx(0, FALSE);
-            continue;
-          }
-          else {
-            logmsg("[select_ws_wait_thread] pipe closed, PIPE: %p", handle);
-          }
+          logmsg("[select_ws_wait_thread] PeekNamedPipe len: %lu", length);
         }
-        /* there is some data available, stop waiting */
-        logmsg("[select_ws_wait_thread] data available, PIPE: %p", handle);
-        SetEvent(signal);
       }
-      break;
+      else {
+        /* if the pipe has NOT been closed, sleep and continue waiting */
+        ret = GetLastError();
+        if(ret != ERROR_BROKEN_PIPE) {
+          char buffer[WINAPI_ERROR_LEN];
+          curlx_winapi_strerror(ret, buffer, sizeof(buffer));
+          logmsg("[select_ws_wait_thread] PeekNamedPipe error: (0x%08lx) - %s",
+                 ret, buffer);
+          if(ret == ERROR_NOT_SUPPORTED)  /* avoid potential endless loop */
+             break;
+          SleepEx(0, FALSE);
+          continue;
+        }
+        else {
+          logmsg("[select_ws_wait_thread] pipe closed, PIPE: %p", handle);
+        }
+      }
+      /* there is some data available, stop waiting */
+      logmsg("[select_ws_wait_thread] data available, PIPE: %p", handle);
+      SetEvent(signal);
+    }
+    break;
 
-    default:
-      /* The handle has an unknown type, try to wait on it */
-      if(WaitForMultipleObjectsEx(2, handles, FALSE, INFINITE, FALSE)
-         == WAIT_OBJECT_0 + 1) {
-        logmsg("[select_ws_wait_thread] data available, HANDLE: %p", handle);
-        SetEvent(signal);
-      }
-      break;
+  default:
+    /* The handle has an unknown type, try to wait on it */
+    if(WaitForMultipleObjectsEx(2, handles, FALSE, INFINITE, FALSE)
+       == WAIT_OBJECT_0 + 1) {
+      logmsg("[select_ws_wait_thread] data available, HANDLE: %p", handle);
+      SetEvent(signal);
+    }
+    break;
   }
 
   return 0;
 }
+
 static HANDLE select_ws_wait(HANDLE handle, HANDLE signal, HANDLE abort)
 {
-#ifdef _WIN32_WCE
-  typedef HANDLE curl_win_thread_handle_t;
-#elif defined(__MINGW32__) && !defined(__MINGW64_VERSION_MAJOR)
-  typedef unsigned long curl_win_thread_handle_t;
-#else
-  typedef uintptr_t curl_win_thread_handle_t;
-#endif
   struct select_ws_wait_data *data;
-  curl_win_thread_handle_t thread;
 
   /* allocate internal waiting data structure */
   data = malloc(sizeof(struct select_ws_wait_data));
   if(data) {
+    HANDLE thread;
+
     data->handle = handle;
     data->signal = signal;
     data->abort = abort;
 
     /* launch waiting thread */
-#ifdef _WIN32_WCE
-    thread = CreateThread(NULL, 0,  &select_ws_wait_thread, data, 0, NULL);
-#else
-    thread = _beginthreadex(NULL, 0, &select_ws_wait_thread, data, 0, NULL);
-#endif
+    thread = CreateThread(NULL, 0, &select_ws_wait_thread, data, 0, NULL);
 
     /* free data if thread failed to launch */
     if(!thread) {
       free(data);
     }
-    return (HANDLE)thread;
+    return thread;
   }
   return NULL;
 }
+
 struct select_ws_data {
   int fd;                /* provided file descriptor  (indexed by nfd) */
-  long wsastate;         /* internal pre-select state (indexed by nfd) */
+  long wsastate;         /* internal preselect state  (indexed by nfd) */
   curl_socket_t wsasock; /* internal socket handle    (indexed by nws) */
   WSAEVENT wsaevent;     /* internal select event     (indexed by nws) */
   HANDLE signal;         /* internal thread signal    (indexed by nth) */
   HANDLE thread;         /* internal thread handle    (indexed by nth) */
 };
+
 static int select_ws(int nfds, fd_set *readfds, fd_set *writefds,
                      fd_set *exceptfds, struct timeval *tv)
 {
   DWORD timeout_ms, wait, nfd, nth, nws, i;
   HANDLE abort, signal, handle, *handles;
-  fd_set readsock, writesock, exceptsock;
   struct select_ws_data *data;
   WSANETWORKEVENTS wsaevents;
   curl_socket_t wsasock;
-  int error, ret, fd;
-  WSAEVENT wsaevent;
+  int ret, fd;
 
   /* check if the input value is valid */
   if(nfds < 0) {
-    errno = EINVAL;
+    SET_SOCKERRNO(SOCKEINVAL);
     return -1;
   }
 
@@ -629,7 +620,7 @@ static int select_ws(int nfds, fd_set *readfds, fd_set *writefds,
   /* create internal event to abort waiting threads */
   abort = CreateEvent(NULL, TRUE, FALSE, NULL);
   if(!abort) {
-    errno = ENOMEM;
+    SET_SOCKERRNO(SOCKENOMEM);
     return -1;
   }
 
@@ -637,7 +628,7 @@ static int select_ws(int nfds, fd_set *readfds, fd_set *writefds,
   data = calloc(nfds, sizeof(struct select_ws_data));
   if(!data) {
     CloseHandle(abort);
-    errno = ENOMEM;
+    SET_SOCKERRNO(SOCKENOMEM);
     return -1;
   }
 
@@ -646,16 +637,18 @@ static int select_ws(int nfds, fd_set *readfds, fd_set *writefds,
   if(!handles) {
     CloseHandle(abort);
     free(data);
-    errno = ENOMEM;
+    SET_SOCKERRNO(SOCKENOMEM);
     return -1;
   }
 
   /* loop over the handles in the input descriptor sets */
   nfd = 0; /* number of handled file descriptors */
   nth = 0; /* number of internal waiting threads */
-  nws = 0; /* number of handled WINSOCK sockets */
+  nws = 0; /* number of handled Winsock sockets */
   for(fd = 0; fd < nfds; fd++) {
-    wsasock = curlx_sitosk(fd);
+    fd_set readsock, writesock, exceptsock;
+
+    wsasock = (curl_socket_t)fd;
     wsaevents.lNetworkEvents = 0;
     handles[nfd] = 0;
 
@@ -665,12 +658,12 @@ static int select_ws(int nfds, fd_set *readfds, fd_set *writefds,
 
     if(FD_ISSET(wsasock, readfds)) {
       FD_SET(wsasock, &readsock);
-      wsaevents.lNetworkEvents |= FD_READ|FD_ACCEPT|FD_CLOSE;
+      wsaevents.lNetworkEvents |= FD_READ | FD_ACCEPT | FD_CLOSE;
     }
 
     if(FD_ISSET(wsasock, writefds)) {
       FD_SET(wsasock, &writesock);
-      wsaevents.lNetworkEvents |= FD_WRITE|FD_CONNECT|FD_CLOSE;
+      wsaevents.lNetworkEvents |= FD_WRITE | FD_CONNECT | FD_CLOSE;
     }
 
     if(FD_ISSET(wsasock, exceptfds)) {
@@ -707,19 +700,22 @@ static int select_ws(int nfds, fd_set *readfds, fd_set *writefds,
         nfd++;
       }
       else {
+        WSAEVENT wsaevent;
         wsaevent = WSACreateEvent();
         if(wsaevent != WSA_INVALID_EVENT) {
           if(wsaevents.lNetworkEvents & FD_WRITE) {
-            send(wsasock, NULL, 0, 0); /* reset FD_WRITE */
+            swrite(wsasock, NULL, 0); /* reset FD_WRITE */
           }
-          error = WSAEventSelect(wsasock, wsaevent, wsaevents.lNetworkEvents);
-          if(error != SOCKET_ERROR) {
+          if(WSAEventSelect(wsasock, wsaevent, wsaevents.lNetworkEvents)
+             == 0) {
             handles[nfd] = (HANDLE)wsaevent;
             data[nws].wsasock = wsasock;
             data[nws].wsaevent = wsaevent;
             data[nfd].wsastate = 0;
-            tv->tv_sec = 0;
-            tv->tv_usec = 0;
+            if(tv) {
+              tv->tv_sec = 0;
+              tv->tv_usec = 0;
+            }
             /* check if the socket is already ready */
             if(select(fd + 1, &readsock, &writesock, &exceptsock, tv) == 1) {
               logmsg("[select_ws] socket %d is ready", fd);
@@ -782,7 +778,7 @@ static int select_ws(int nfds, fd_set *readfds, fd_set *writefds,
   for(i = 0; i < nfd; i++) {
     fd = data[i].fd;
     handle = handles[i];
-    wsasock = curlx_sitosk(fd);
+    wsasock = (curl_socket_t)fd;
 
     /* check if the current internal handle was triggered */
     if(wait != WAIT_FAILED && (wait - WAIT_OBJECT_0) <= i &&
@@ -799,19 +795,18 @@ static int select_ws(int nfds, fd_set *readfds, fd_set *writefds,
         FD_CLR(wsasock, exceptfds);
       }
       else {
-        /* try to handle the event with the WINSOCK2 functions */
+        /* try to handle the event with the Winsock2 functions */
         wsaevents.lNetworkEvents = 0;
-        error = WSAEnumNetworkEvents(wsasock, handle, &wsaevents);
-        if(error != SOCKET_ERROR) {
+        if(WSAEnumNetworkEvents(wsasock, handle, &wsaevents) == 0) {
           /* merge result from pre-check using select */
           wsaevents.lNetworkEvents |= data[i].wsastate;
 
           /* remove from descriptor set if not ready for read/accept/close */
-          if(!(wsaevents.lNetworkEvents & (FD_READ|FD_ACCEPT|FD_CLOSE)))
+          if(!(wsaevents.lNetworkEvents & (FD_READ | FD_ACCEPT | FD_CLOSE)))
             FD_CLR(wsasock, readfds);
 
           /* remove from descriptor set if not ready for write/connect */
-          if(!(wsaevents.lNetworkEvents & (FD_WRITE|FD_CONNECT|FD_CLOSE)))
+          if(!(wsaevents.lNetworkEvents & (FD_WRITE | FD_CONNECT | FD_CLOSE)))
             FD_CLR(wsasock, writefds);
 
           /* remove from descriptor set if not exceptional */
@@ -858,8 +853,63 @@ static int select_ws(int nfds, fd_set *readfds, fd_set *writefds,
 
   return ret;
 }
-#define select(a,b,c,d,e) select_ws(a,b,c,d,e)
-#endif  /* USE_WINSOCK */
+#define SOCKFILT_select(a, b, c, d, e) select_ws(a, b, c, d, e)
+#else
+#define SOCKFILT_select(a, b, c, d, e) select(a, b, c, d, e)
+#endif /* USE_WINSOCK */
+
+/* Perform the disconnect handshake with sockfilt
+ * This involves waiting for the disconnect acknowledgment after the DISC
+ * command, while throwing away anything else that might come in before
+ * that.
+ */
+static bool disc_handshake(void)
+{
+  if(!write_stdout("DISC\n", 5))
+    return FALSE;
+
+  do {
+    unsigned char buffer[BUFFER_SIZE];
+    ssize_t buffer_len;
+    if(!read_stdin(buffer, 5))
+      return FALSE;
+    logmsg("Received %c%c%c%c (on stdin)",
+           buffer[0], buffer[1], buffer[2], buffer[3]);
+
+    if(!memcmp("ACKD", buffer, 4)) {
+      /* got the ack we were waiting for */
+      break;
+    }
+    else if(!memcmp("DISC", buffer, 4)) {
+      logmsg("Crikey! Client also wants to disconnect");
+      if(!write_stdout("ACKD\n", 5))
+        return FALSE;
+    }
+    else if(!memcmp("DATA", buffer, 4)) {
+      /* We must read more data to stay in sync */
+      logmsg("Throwing away data bytes");
+      if(!read_data_block(buffer, sizeof(buffer), &buffer_len))
+        return FALSE;
+    }
+    else if(!memcmp("QUIT", buffer, 4)) {
+      /* die */
+      logmsg("quits");
+      return FALSE;
+    }
+    else {
+      logmsg("Unexpected message error; aborting");
+      /*
+       * The only other messages that could occur here are PING and PORT,
+       * and both of them occur at the start of a test when nothing should be
+       * trying to DISC. Therefore, we should not ever get here, but if we
+       * do, it is probably due to some kind of unclean shutdown situation so
+       * us shutting down is what we probably ought to be doing, anyway.
+       */
+      return FALSE;
+    }
+  } while(TRUE);
+  return TRUE;
+}
 
 /*
   sockfdp is a pointer to an established stream or CURL_SOCKET_BAD
@@ -878,11 +928,10 @@ static bool juggle(curl_socket_t *sockfdp,
   curl_socket_t sockfd = CURL_SOCKET_BAD;
   int maxfd = -99;
   ssize_t rc;
-  int error = 0;
+  int sockerr = 0;
+  char errbuf[STRERROR_LEN];
 
- /* 'buffer' is this excessively large only to be able to support things like
-    test 1003 which tests exceedingly large server response lines */
-  unsigned char buffer[17010];
+  unsigned char buffer[BUFFER_SIZE];
   char data[16];
 
   if(got_exit_signal) {
@@ -891,7 +940,7 @@ static bool juggle(curl_socket_t *sockfdp,
   }
 
 #ifdef HAVE_GETPPID
-  /* As a last resort, quit if sockfilt process becomes orphan. Just in case
+  /* As a last resort, quit if sockfilt process becomes orphan. In case
      parent ftpserver process has died without killing its sockfilt children */
   if(getppid() <= 1) {
     logmsg("process becomes orphan, exiting");
@@ -914,7 +963,7 @@ static bool juggle(curl_socket_t *sockfdp,
 
     /* server mode */
     sockfd = listenfd;
-    /* there's always a socket to wait for */
+    /* there is always a socket to wait for */
     FD_SET(sockfd, &fds_read);
     maxfd = (int)sockfd;
     break;
@@ -922,13 +971,13 @@ static bool juggle(curl_socket_t *sockfdp,
   case PASSIVE_CONNECT:
 
     sockfd = *sockfdp;
-    if(CURL_SOCKET_BAD == sockfd) {
+    if(sockfd == CURL_SOCKET_BAD) {
       /* eeek, we are supposedly connected and then this cannot be -1 ! */
       logmsg("socket is -1! on %s:%d", __FILE__, __LINE__);
       maxfd = 0; /* stdin */
     }
     else {
-      /* there's always a socket to wait for */
+      /* there is always a socket to wait for */
       FD_SET(sockfd, &fds_read);
       maxfd = (int)sockfd;
     }
@@ -938,7 +987,7 @@ static bool juggle(curl_socket_t *sockfdp,
 
     sockfd = *sockfdp;
     /* sockfd turns CURL_SOCKET_BAD when our connection has been closed */
-    if(CURL_SOCKET_BAD != sockfd) {
+    if(sockfd != CURL_SOCKET_BAD) {
       FD_SET(sockfd, &fds_read);
       maxfd = (int)sockfd;
     }
@@ -957,23 +1006,19 @@ static bool juggle(curl_socket_t *sockfdp,
 
   } /* switch(*mode) */
 
-
   do {
-
     /* select() blocking behavior call on blocking descriptors please */
-
-    rc = select(maxfd + 1, &fds_read, &fds_write, &fds_err, &timeout);
+    rc = SOCKFILT_select(maxfd + 1, &fds_read, &fds_write, &fds_err, &timeout);
 
     if(got_exit_signal) {
       logmsg("signalled to die, exiting...");
       return FALSE;
     }
-
-  } while((rc == -1) && ((error = errno) == EINTR));
+  } while((rc == -1) && ((sockerr = SOCKERRNO) == SOCKEINTR));
 
   if(rc < 0) {
-    logmsg("select() failed with error: (%d) %s",
-           error, strerror(error));
+    logmsg("select() failed with error (%d) %s",
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
     return FALSE;
   }
 
@@ -981,7 +1026,6 @@ static bool juggle(curl_socket_t *sockfdp,
     /* timeout */
     return TRUE;
 
-
   if(FD_ISSET(fileno(stdin), &fds_read)) {
     ssize_t buffer_len;
     /* read from stdin, commands/data to be dealt with and possibly passed on
@@ -1006,7 +1050,7 @@ static bool juggle(curl_socket_t *sockfdp,
            buffer[0], buffer[1], buffer[2], buffer[3]);
 
     if(!memcmp("PING", buffer, 4)) {
-      /* send reply on stdout, just proving we are alive */
+      /* send reply on stdout, proving we are alive */
       if(!write_stdout("PONG\n", 5))
         return FALSE;
     }
@@ -1014,43 +1058,31 @@ static bool juggle(curl_socket_t *sockfdp,
     else if(!memcmp("PORT", buffer, 4)) {
       /* Question asking us what PORT number we are listening to.
          Replies to PORT with "IPv[num]/[port]" */
-      msnprintf((char *)buffer, sizeof(buffer), "%s/%hu\n", ipv_inuse, port);
-      buffer_len = (ssize_t)strlen((char *)buffer);
-      msnprintf(data, sizeof(data), "PORT\n%04zx\n", buffer_len);
+      snprintf((char *)buffer, sizeof(buffer), "%s/%hu\n",
+               ipv_inuse, server_port);
+      buffer_len = (ssize_t)strlen((const char *)buffer);
+      snprintf(data, sizeof(data), "PORT\n%04x\n", (unsigned int)buffer_len);
       if(!write_stdout(data, 10))
         return FALSE;
       if(!write_stdout(buffer, buffer_len))
         return FALSE;
     }
     else if(!memcmp("QUIT", buffer, 4)) {
-      /* just die */
+      /* die */
       logmsg("quits");
       return FALSE;
     }
     else if(!memcmp("DATA", buffer, 4)) {
       /* data IN => data OUT */
-
-      if(!read_stdin(buffer, 5))
+      if(!read_data_block(buffer, sizeof(buffer), &buffer_len))
         return FALSE;
 
-      buffer[5] = '\0';
-
-      buffer_len = (ssize_t)strtol((char *)buffer, NULL, 16);
-      if(buffer_len > (ssize_t)sizeof(buffer)) {
-        logmsg("ERROR: Buffer size (%zu bytes) too small for data size "
-               "(%zd bytes)", sizeof(buffer), buffer_len);
+      if(buffer_len < 0)
         return FALSE;
-      }
-      logmsg("> %zd bytes data, server => client", buffer_len);
-
-      if(!read_stdin(buffer, buffer_len))
-        return FALSE;
-
-      lograw(buffer, buffer_len);
 
       if(*mode == PASSIVE_LISTEN) {
         logmsg("*** We are disconnected!");
-        if(!write_stdout("DISC\n", 5))
+        if(!disc_handshake())
           return FALSE;
       }
       else {
@@ -1064,7 +1096,7 @@ static bool juggle(curl_socket_t *sockfdp,
     }
     else if(!memcmp("DISC", buffer, 4)) {
       /* disconnect! */
-      if(!write_stdout("DISC\n", 5))
+      if(!write_stdout("ACKD\n", 5))
         return FALSE;
       if(sockfd != CURL_SOCKET_BAD) {
         logmsg("====> Client forcibly disconnected");
@@ -1081,17 +1113,16 @@ static bool juggle(curl_socket_t *sockfdp,
     }
   }
 
-
-  if((sockfd != CURL_SOCKET_BAD) && (FD_ISSET(sockfd, &fds_read)) ) {
+  if((sockfd != CURL_SOCKET_BAD) && (FD_ISSET(sockfd, &fds_read))) {
     ssize_t nread_socket;
     if(*mode == PASSIVE_LISTEN) {
-      /* there's no stream set up yet, this is an indication that there's a
+      /* there is no stream set up yet, this is an indication that there is a
          client connecting. */
       curl_socket_t newfd = accept(sockfd, NULL, NULL);
-      if(CURL_SOCKET_BAD == newfd) {
-        error = SOCKERRNO;
-        logmsg("accept(%d, NULL, NULL) failed with error: (%d) %s",
-               sockfd, error, sstrerror(error));
+      if(newfd == CURL_SOCKET_BAD) {
+        sockerr = SOCKERRNO;
+        logmsg("accept() failed with error (%d) %s",
+               sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
       }
       else {
         logmsg("====> Client connect");
@@ -1107,7 +1138,7 @@ static bool juggle(curl_socket_t *sockfdp,
     nread_socket = sread(sockfd, buffer, sizeof(buffer));
 
     if(nread_socket > 0) {
-      msnprintf(data, sizeof(data), "DATA\n%04zx\n", nread_socket);
+      snprintf(data, sizeof(data), "DATA\n%04x\n", (unsigned int)nread_socket);
       if(!write_stdout(data, 10))
         return FALSE;
       if(!write_stdout(buffer, nread_socket))
@@ -1119,7 +1150,7 @@ static bool juggle(curl_socket_t *sockfdp,
 
     if(nread_socket <= 0) {
       logmsg("====> Client disconnect");
-      if(!write_stdout("DISC\n", 5))
+      if(!disc_handshake())
         return FALSE;
       sclose(sockfd);
       *sockfdp = CURL_SOCKET_BAD;
@@ -1134,173 +1165,36 @@ static bool juggle(curl_socket_t *sockfdp,
   return TRUE;
 }
 
-static curl_socket_t sockdaemon(curl_socket_t sock,
-                                unsigned short *listenport)
-{
-  /* passive daemon style */
-  srvr_sockaddr_union_t listener;
-  int flag;
-  int rc;
-  int totdelay = 0;
-  int maxretr = 10;
-  int delay = 20;
-  int attempt = 0;
-  int error = 0;
-
-  do {
-    attempt++;
-    flag = 1;
-    rc = setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
-         (void *)&flag, sizeof(flag));
-    if(rc) {
-      error = SOCKERRNO;
-      logmsg("setsockopt(SO_REUSEADDR) failed with error: (%d) %s",
-             error, sstrerror(error));
-      if(maxretr) {
-        rc = wait_ms(delay);
-        if(rc) {
-          /* should not happen */
-          error = errno;
-          logmsg("wait_ms() failed with error: (%d) %s",
-                 error, strerror(error));
-          sclose(sock);
-          return CURL_SOCKET_BAD;
-        }
-        if(got_exit_signal) {
-          logmsg("signalled to die, exiting...");
-          sclose(sock);
-          return CURL_SOCKET_BAD;
-        }
-        totdelay += delay;
-        delay *= 2; /* double the sleep for next attempt */
-      }
-    }
-  } while(rc && maxretr--);
-
-  if(rc) {
-    logmsg("setsockopt(SO_REUSEADDR) failed %d times in %d ms. Error: (%d) %s",
-           attempt, totdelay, error, strerror(error));
-    logmsg("Continuing anyway...");
-  }
-
-  /* When the specified listener port is zero, it is actually a
-     request to let the system choose a non-zero available port. */
-
-#ifdef ENABLE_IPV6
-  if(!use_ipv6) {
-#endif
-    memset(&listener.sa4, 0, sizeof(listener.sa4));
-    listener.sa4.sin_family = AF_INET;
-    listener.sa4.sin_addr.s_addr = INADDR_ANY;
-    listener.sa4.sin_port = htons(*listenport);
-    rc = bind(sock, &listener.sa, sizeof(listener.sa4));
-#ifdef ENABLE_IPV6
-  }
-  else {
-    memset(&listener.sa6, 0, sizeof(listener.sa6));
-    listener.sa6.sin6_family = AF_INET6;
-    listener.sa6.sin6_addr = in6addr_any;
-    listener.sa6.sin6_port = htons(*listenport);
-    rc = bind(sock, &listener.sa, sizeof(listener.sa6));
-  }
-#endif /* ENABLE_IPV6 */
-  if(rc) {
-    error = SOCKERRNO;
-    logmsg("Error binding socket on port %hu: (%d) %s",
-           *listenport, error, sstrerror(error));
-    sclose(sock);
-    return CURL_SOCKET_BAD;
-  }
-
-  if(!*listenport) {
-    /* The system was supposed to choose a port number, figure out which
-       port we actually got and update the listener port value with it. */
-    curl_socklen_t la_size;
-    srvr_sockaddr_union_t localaddr;
-#ifdef ENABLE_IPV6
-    if(!use_ipv6)
-#endif
-      la_size = sizeof(localaddr.sa4);
-#ifdef ENABLE_IPV6
-    else
-      la_size = sizeof(localaddr.sa6);
-#endif
-    memset(&localaddr.sa, 0, (size_t)la_size);
-    if(getsockname(sock, &localaddr.sa, &la_size) < 0) {
-      error = SOCKERRNO;
-      logmsg("getsockname() failed with error: (%d) %s",
-             error, sstrerror(error));
-      sclose(sock);
-      return CURL_SOCKET_BAD;
-    }
-    switch(localaddr.sa.sa_family) {
-    case AF_INET:
-      *listenport = ntohs(localaddr.sa4.sin_port);
-      break;
-#ifdef ENABLE_IPV6
-    case AF_INET6:
-      *listenport = ntohs(localaddr.sa6.sin6_port);
-      break;
-#endif
-    default:
-      break;
-    }
-    if(!*listenport) {
-      /* Real failure, listener port shall not be zero beyond this point. */
-      logmsg("Apparently getsockname() succeeded, with listener port zero.");
-      logmsg("A valid reason for this failure is a binary built without");
-      logmsg("proper network library linkage. This might not be the only");
-      logmsg("reason, but double check it before anything else.");
-      sclose(sock);
-      return CURL_SOCKET_BAD;
-    }
-  }
-
-  /* bindonly option forces no listening */
-  if(bind_only) {
-    logmsg("instructed to bind port without listening");
-    return sock;
-  }
-
-  /* start accepting connections */
-  rc = listen(sock, 5);
-  if(0 != rc) {
-    error = SOCKERRNO;
-    logmsg("listen(%d, 5) failed with error: (%d) %s",
-           sock, error, sstrerror(error));
-    sclose(sock);
-    return CURL_SOCKET_BAD;
-  }
-
-  return sock;
-}
-
-
-int main(int argc, char *argv[])
+static int test_sockfilt(int argc, const char *argv[])
 {
   srvr_sockaddr_union_t me;
   curl_socket_t sock = CURL_SOCKET_BAD;
   curl_socket_t msgsock = CURL_SOCKET_BAD;
   int wrotepidfile = 0;
   int wroteportfile = 0;
-  const char *pidname = ".sockfilt.pid";
-  const char *portname = NULL; /* none by default */
   bool juggle_again;
   int rc;
-  int error;
+  int sockerr;
+  char errbuf[STRERROR_LEN];
   int arg = 1;
   enum sockmode mode = PASSIVE_LISTEN; /* default */
   const char *addr = NULL;
 
-  while(argc>arg) {
+  pidname = ".sockfilt.pid";
+  serverlogfile = "log/sockfilt.log";
+  server_port = 8999;
+
+  while(argc > arg) {
+    const char *opt;
+    curl_off_t num;
     if(!strcmp("--version", argv[arg])) {
       printf("sockfilt IPv4%s\n",
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
              "/IPv6"
 #else
              ""
 #endif
-             );
+      );
       return 0;
     }
     else if(!strcmp("--verbose", argv[arg])) {
@@ -1309,7 +1203,7 @@ int main(int argc, char *argv[])
     }
     else if(!strcmp("--pidfile", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         pidname = argv[arg++];
     }
     else if(!strcmp("--portfile", argv[arg])) {
@@ -1319,34 +1213,34 @@ int main(int argc, char *argv[])
     }
     else if(!strcmp("--logfile", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         serverlogfile = argv[arg++];
     }
     else if(!strcmp("--ipv6", argv[arg])) {
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
+      socket_domain = AF_INET6;
       ipv_inuse = "IPv6";
-      use_ipv6 = TRUE;
 #endif
       arg++;
     }
     else if(!strcmp("--ipv4", argv[arg])) {
       /* for completeness, we support this option as well */
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
+      socket_domain = AF_INET;
       ipv_inuse = "IPv4";
-      use_ipv6 = FALSE;
 #endif
       arg++;
     }
     else if(!strcmp("--bindonly", argv[arg])) {
-      bind_only = TRUE;
+      s_bind_only = TRUE;
       arg++;
     }
     else if(!strcmp("--port", argv[arg])) {
       arg++;
-      if(argc>arg) {
-        char *endptr;
-        unsigned long ulnum = strtoul(argv[arg], &endptr, 10);
-        port = curlx_ultous(ulnum);
+      if(argc > arg) {
+        opt = argv[arg];
+        if(!curlx_str_number(&opt, &num, 0xffff))
+          server_port = (unsigned short)num;
         arg++;
       }
     }
@@ -1354,23 +1248,21 @@ int main(int argc, char *argv[])
       /* Asked to actively connect to the specified local port instead of
          doing a passive server-style listening. */
       arg++;
-      if(argc>arg) {
-        char *endptr;
-        unsigned long ulnum = strtoul(argv[arg], &endptr, 10);
-        if((endptr != argv[arg] + strlen(argv[arg])) ||
-           (ulnum < 1025UL) || (ulnum > 65535UL)) {
+      if(argc > arg) {
+        opt = argv[arg];
+        if(curlx_str_number(&opt, &num, 0xffff)) {
           fprintf(stderr, "sockfilt: invalid --connect argument (%s)\n",
                   argv[arg]);
           return 0;
         }
-        connectport = curlx_ultous(ulnum);
+        server_connectport = (unsigned short)num;
         arg++;
       }
     }
     else if(!strcmp("--addr", argv[arg])) {
       /* Set an IP address to use with --connect; otherwise use localhost */
       arg++;
-      if(argc>arg) {
+      if(argc > arg) {
         addr = argv[arg];
         arg++;
       }
@@ -1392,65 +1284,56 @@ int main(int argc, char *argv[])
     }
   }
 
-#ifdef WIN32
-  win32_init();
-  atexit(win32_cleanup);
+  CURL_BINMODE(stdin);
+  CURL_BINMODE(stdout);
+  CURL_BINMODE(stderr);
 
-  setmode(fileno(stdin), O_BINARY);
-  setmode(fileno(stdout), O_BINARY);
-  setmode(fileno(stderr), O_BINARY);
-#endif
+  install_signal_handlers(FALSE);
 
-  install_signal_handlers(false);
+  sock = socket(socket_domain, SOCK_STREAM, 0);
 
-#ifdef ENABLE_IPV6
-  if(!use_ipv6)
-#endif
-    sock = socket(AF_INET, SOCK_STREAM, 0);
-#ifdef ENABLE_IPV6
-  else
-    sock = socket(AF_INET6, SOCK_STREAM, 0);
-#endif
-
-  if(CURL_SOCKET_BAD == sock) {
-    error = SOCKERRNO;
-    logmsg("Error creating socket: (%d) %s", error, sstrerror(error));
+  if(sock == CURL_SOCKET_BAD) {
+    sockerr = SOCKERRNO;
+    logmsg("Error creating socket (%d) %s",
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
     write_stdout("FAIL\n", 5);
     goto sockfilt_cleanup;
   }
 
-  if(connectport) {
+  if(server_connectport) {
     /* Active mode, we should connect to the given port number */
     mode = ACTIVE;
-#ifdef ENABLE_IPV6
-    if(!use_ipv6) {
-#endif
+    switch(socket_domain) {
+    case AF_INET:
       memset(&me.sa4, 0, sizeof(me.sa4));
       me.sa4.sin_family = AF_INET;
-      me.sa4.sin_port = htons(connectport);
+      me.sa4.sin_port = htons(server_connectport);
       me.sa4.sin_addr.s_addr = INADDR_ANY;
       if(!addr)
         addr = "127.0.0.1";
-      Curl_inet_pton(AF_INET, addr, &me.sa4.sin_addr);
+      curlx_inet_pton(AF_INET, addr, &me.sa4.sin_addr);
 
       rc = connect(sock, &me.sa, sizeof(me.sa4));
-#ifdef ENABLE_IPV6
-    }
-    else {
+      break;
+#ifdef USE_IPV6
+    case AF_INET6:
       memset(&me.sa6, 0, sizeof(me.sa6));
       me.sa6.sin6_family = AF_INET6;
-      me.sa6.sin6_port = htons(connectport);
+      me.sa6.sin6_port = htons(server_connectport);
       if(!addr)
         addr = "::1";
-      Curl_inet_pton(AF_INET6, addr, &me.sa6.sin6_addr);
+      curlx_inet_pton(AF_INET6, addr, &me.sa6.sin6_addr);
 
       rc = connect(sock, &me.sa, sizeof(me.sa6));
+      break;
+#endif /* USE_IPV6 */
+    default:
+      rc = 1;
     }
-#endif /* ENABLE_IPV6 */
     if(rc) {
-      error = SOCKERRNO;
-      logmsg("Error connecting to port %hu: (%d) %s",
-             connectport, error, sstrerror(error));
+      sockerr = SOCKERRNO;
+      logmsg("Error connecting to port %hu (%d) %s", server_connectport,
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
       write_stdout("FAIL\n", 5);
       goto sockfilt_cleanup;
     }
@@ -1459,8 +1342,8 @@ int main(int argc, char *argv[])
   }
   else {
     /* passive daemon style */
-    sock = sockdaemon(sock, &port);
-    if(CURL_SOCKET_BAD == sock) {
+    sock = sockdaemon(sock, &server_port, NULL, s_bind_only);
+    if(sock == CURL_SOCKET_BAD) {
       write_stdout("FAIL\n", 5);
       goto sockfilt_cleanup;
     }
@@ -1469,12 +1352,12 @@ int main(int argc, char *argv[])
 
   logmsg("Running %s version", ipv_inuse);
 
-  if(connectport)
-    logmsg("Connected to port %hu", connectport);
-  else if(bind_only)
-    logmsg("Bound without listening on port %hu", port);
+  if(server_connectport)
+    logmsg("Connected to port %hu", server_connectport);
+  else if(s_bind_only)
+    logmsg("Bound without listening on port %hu", server_port);
   else
-    logmsg("Listening on port %hu", port);
+    logmsg("Listening on port %hu", server_port);
 
   wrotepidfile = write_pidfile(pidname);
   if(!wrotepidfile) {
@@ -1482,7 +1365,7 @@ int main(int argc, char *argv[])
     goto sockfilt_cleanup;
   }
   if(portname) {
-    wroteportfile = write_portfile(portname, port);
+    wroteportfile = write_portfile(portname, server_port);
     if(!wroteportfile) {
       write_stdout("FAIL\n", 5);
       goto sockfilt_cleanup;
@@ -1506,7 +1389,7 @@ sockfilt_cleanup:
   if(wroteportfile)
     unlink(portname);
 
-  restore_signal_handlers(false);
+  restore_signal_handlers(FALSE);
 
   if(got_exit_signal) {
     logmsg("============> sockfilt exits with signal (%d)", exit_signal);
diff --git a/third-party/curl/tests/server/socksd.c b/third-party/curl/tests/server/socksd.c
index e53001d320..9e1caedc2d 100644
--- a/third-party/curl/tests/server/socksd.c
+++ b/third-party/curl/tests/server/socksd.c
@@ -21,8 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "server_setup.h"
-#include <stdlib.h>
+#include "first.h"
 
 /* Function
  *
@@ -41,11 +40,11 @@
  *                              state
  * "nmethods_max [number: 3]" - the minimum numberf NMETHODS the client must
  *                              state
- * "user [string]" - the user name that must match (if method is 2)
+ * "user [string]" - the username that must match (if method is 2)
  * "password [string]" - the password that must match (if method is 2)
  * "backend [IPv4]" - numerical IPv4 address of backend to connect to
  * "backendport [number:0]" - TCP port of backend to connect to. 0 means use
-                              the client's specified port number.
+ *                            the client's specified port number.
  * "method [number: 0]" - connect method to respond with:
  *                        0 - no auth
  *                        1 - GSSAPI (not supported)
@@ -57,64 +56,10 @@
 
 /* based on sockfilt.c */
 
-#ifdef HAVE_SIGNAL_H
-#include <signal.h>
-#endif
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-#ifdef HAVE_NETINET_IN6_H
-#include <netinet/in6.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
-
-#define ENABLE_CURLX_PRINTF
-/* make the curlx header define all printf() functions to use the curlx_*
-   versions instead */
-#include "curlx.h" /* from the private lib dir */
-#include "getpart.h"
-#include "inet_pton.h"
-#include "util.h"
-#include "server_sockaddr.h"
-#include "warnless.h"
-
-/* include memdebug.h last */
-#include "memdebug.h"
-
-#ifdef USE_WINSOCK
-#undef  EINTR
-#define EINTR    4 /* errno.h value */
-#undef  EAGAIN
-#define EAGAIN  11 /* errno.h value */
-#undef  ENOMEM
-#define ENOMEM  12 /* errno.h value */
-#undef  EINVAL
-#define EINVAL  22 /* errno.h value */
-#endif
-
-#define DEFAULT_PORT 8905
-
-#ifndef DEFAULT_LOGFILE
-#define DEFAULT_LOGFILE "log/socksd.log"
-#endif
-
-#ifndef DEFAULT_REQFILE
-#define DEFAULT_REQFILE "log/socksd-request.log"
-#endif
-
-#ifndef DEFAULT_CONFIG
-#define DEFAULT_CONFIG "socksd.config"
-#endif
-
 static const char *backendaddr = "127.0.0.1";
 static unsigned short backendport = 0; /* default is use client's */
 
-struct configurable {
+struct socksd_configurable {
   unsigned char version; /* initial version byte in the request must match
                             this */
   unsigned char nmethods_min; /* minimum number of nmethods to expect */
@@ -129,166 +74,145 @@ struct configurable {
   char password[256];
 };
 
-#define CONFIG_VERSION 5
-#define CONFIG_NMETHODS_MIN 1 /* unauth, gssapi, auth */
-#define CONFIG_NMETHODS_MAX 3
+#define CONFIG_VERSION         5
+#define CONFIG_NMETHODS_MIN    1 /* unauth, gssapi, auth */
+#define CONFIG_NMETHODS_MAX    3
 #define CONFIG_RESPONSEVERSION CONFIG_VERSION
-#define CONFIG_RESPONSEMETHOD 0 /* no auth */
-#define CONFIG_REQCMD 1 /* CONNECT */
-#define CONFIG_PORT backendport
-#define CONFIG_ADDR backendaddr
-#define CONFIG_CONNECTREP 0
+#define CONFIG_RESPONSEMETHOD  0 /* no auth */
+#define CONFIG_REQCMD          1 /* CONNECT */
+#define CONFIG_PORT            backendport
+#define CONFIG_ADDR            backendaddr
+#define CONFIG_CONNECTREP      0
 
-static struct configurable config;
+static struct socksd_configurable s_config;
 
-const char *serverlogfile = DEFAULT_LOGFILE;
-static const char *reqlogfile = DEFAULT_REQFILE;
-static const char *configfile = DEFAULT_CONFIG;
+static const char *reqlogfile = "log/socksd-request.log";
 
-static const char *socket_type = "IPv4";
-static unsigned short port = DEFAULT_PORT;
-
-static void resetdefaults(void)
+static void socksd_resetdefaults(void)
 {
   logmsg("Reset to defaults");
-  config.version = CONFIG_VERSION;
-  config.nmethods_min = CONFIG_NMETHODS_MIN;
-  config.nmethods_max = CONFIG_NMETHODS_MAX;
-  config.responseversion = CONFIG_RESPONSEVERSION;
-  config.responsemethod = CONFIG_RESPONSEMETHOD;
-  config.reqcmd = CONFIG_REQCMD;
-  config.connectrep = CONFIG_CONNECTREP;
-  config.port = CONFIG_PORT;
-  strcpy(config.addr, CONFIG_ADDR);
-  strcpy(config.user, "user");
-  strcpy(config.password, "password");
+  s_config.version = CONFIG_VERSION;
+  s_config.nmethods_min = CONFIG_NMETHODS_MIN;
+  s_config.nmethods_max = CONFIG_NMETHODS_MAX;
+  s_config.responseversion = CONFIG_RESPONSEVERSION;
+  s_config.responsemethod = CONFIG_RESPONSEMETHOD;
+  s_config.reqcmd = CONFIG_REQCMD;
+  s_config.connectrep = CONFIG_CONNECTREP;
+  s_config.port = CONFIG_PORT;
+  curlx_strcopy(s_config.addr, sizeof(s_config.addr),
+                CONFIG_ADDR, strlen(CONFIG_ADDR));
+  curlx_strcopy(s_config.user, sizeof(s_config.user),
+                "user", strlen("user"));
+  curlx_strcopy(s_config.password, sizeof(s_config.password),
+                "password", strlen("password"));
 }
 
-static unsigned char byteval(char *value)
+static void socksd_getconfig(void)
 {
-  unsigned long num = strtoul(value, NULL, 10);
-  return num & 0xff;
-}
-
-static unsigned short shortval(char *value)
-{
-  unsigned long num = strtoul(value, NULL, 10);
-  return num & 0xffff;
-}
-
-static enum {
-  socket_domain_inet = AF_INET
-#ifdef ENABLE_IPV6
-  , socket_domain_inet6 = AF_INET6
-#endif
-#ifdef USE_UNIX_SOCKETS
-  , socket_domain_unix = AF_UNIX
-#endif
-} socket_domain = AF_INET;
-
-static void getconfig(void)
-{
-  FILE *fp = fopen(configfile, FOPEN_READTEXT);
-  resetdefaults();
+  FILE *fp = curlx_fopen(configfile, FOPEN_READTEXT);
+  socksd_resetdefaults();
   if(fp) {
     char buffer[512];
     logmsg("parse config file");
     while(fgets(buffer, sizeof(buffer), fp)) {
       char key[32];
-      char value[32];
-      if(2 == sscanf(buffer, "%31s %31s", key, value)) {
+      char value[260];
+      const char *pval;
+      curl_off_t num;
+      if(sscanf(buffer, "%31s %259s", key, value) == 2) {
         if(!strcmp(key, "version")) {
-          config.version = byteval(value);
-          logmsg("version [%d] set", config.version);
+          pval = value;
+          if(!curlx_str_number(&pval, &num, 0xff)) {
+            s_config.version = (unsigned char)num;
+            logmsg("version [%d] set", s_config.version);
+          }
         }
         else if(!strcmp(key, "nmethods_min")) {
-          config.nmethods_min = byteval(value);
-          logmsg("nmethods_min [%d] set", config.nmethods_min);
+          pval = value;
+          if(!curlx_str_number(&pval, &num, 0xff)) {
+            s_config.nmethods_min = (unsigned char)num;
+            logmsg("nmethods_min [%d] set", s_config.nmethods_min);
+          }
         }
         else if(!strcmp(key, "nmethods_max")) {
-          config.nmethods_max = byteval(value);
-          logmsg("nmethods_max [%d] set", config.nmethods_max);
+          pval = value;
+          if(!curlx_str_number(&pval, &num, 0xff)) {
+            s_config.nmethods_max = (unsigned char)num;
+            logmsg("nmethods_max [%d] set", s_config.nmethods_max);
+          }
         }
         else if(!strcmp(key, "backend")) {
-          strcpy(config.addr, value);
-          logmsg("backend [%s] set", config.addr);
+          curlx_strcopy(s_config.addr, sizeof(s_config.addr),
+                        value, strlen(value));
+          logmsg("backend [%s] set", s_config.addr);
         }
         else if(!strcmp(key, "backendport")) {
-          config.port = shortval(value);
-          logmsg("backendport [%d] set", config.port);
+          pval = value;
+          if(!curlx_str_number(&pval, &num, 0xffff)) {
+            s_config.port = (unsigned short)num;
+            logmsg("backendport [%d] set", s_config.port);
+          }
         }
         else if(!strcmp(key, "user")) {
-          strcpy(config.user, value);
-          logmsg("user [%s] set", config.user);
+          curlx_strcopy(s_config.user, sizeof(s_config.user),
+                        value, strlen(value));
+          logmsg("user [%s] set", s_config.user);
         }
         else if(!strcmp(key, "password")) {
-          strcpy(config.password, value);
-          logmsg("password [%s] set", config.password);
+          curlx_strcopy(s_config.password, sizeof(s_config.password),
+                        value, strlen(value));
+          logmsg("password [%s] set", s_config.password);
         }
         /* Methods:
-           o  X'00' NO AUTHENTICATION REQUIRED
-           o  X'01' GSSAPI
-           o  X'02' USERNAME/PASSWORD
+           o  0x00 NO AUTHENTICATION REQUIRED
+           o  0x01 GSSAPI
+           o  0x02 USERNAME/PASSWORD
         */
         else if(!strcmp(key, "method")) {
-          config.responsemethod = byteval(value);
-          logmsg("method [%d] set", config.responsemethod);
+          pval = value;
+          if(!curlx_str_number(&pval, &num, 0xff)) {
+            s_config.responsemethod = (unsigned char)num;
+            logmsg("method [%d] set", s_config.responsemethod);
+          }
         }
         else if(!strcmp(key, "response")) {
-          config.connectrep = byteval(value);
-          logmsg("response [%d] set", config.connectrep);
+          pval = value;
+          if(!curlx_str_number(&pval, &num, 0xff)) {
+            s_config.connectrep = (unsigned char)num;
+            logmsg("response [%d] set", s_config.connectrep);
+          }
         }
       }
     }
-    fclose(fp);
+    curlx_fclose(fp);
   }
 }
 
-static void loghex(unsigned char *buffer, ssize_t len)
-{
-  char data[1200];
-  ssize_t i;
-  unsigned char *ptr = buffer;
-  char *optr = data;
-  ssize_t width = 0;
-  int left = sizeof(data);
-
-  for(i = 0; i<len && (left >= 0); i++) {
-    msnprintf(optr, left, "%02x", ptr[i]);
-    width += 2;
-    optr += 2;
-    left -= 2;
-  }
-  if(width)
-    logmsg("'%s'", data);
-}
-
 /* RFC 1928, SOCKS5 byte index */
-#define SOCKS5_VERSION 0
+#define SOCKS5_VERSION  0
 #define SOCKS5_NMETHODS 1 /* number of methods that is listed */
 
 /* in the request: */
-#define SOCKS5_REQCMD 1
+#define SOCKS5_REQCMD   1
 #define SOCKS5_RESERVED 2
-#define SOCKS5_ATYP 3
-#define SOCKS5_DSTADDR 4
+#define SOCKS5_ATYP     3
+#define SOCKS5_DSTADDR  4
 
 /* connect response */
-#define SOCKS5_REP 1
+#define SOCKS5_REP     1
 #define SOCKS5_BNDADDR 4
 
 /* auth request */
-#define SOCKS5_ULEN 1
+#define SOCKS5_ULEN  1
 #define SOCKS5_UNAME 2
 
-#define SOCKS4_CD 1
+#define SOCKS4_CD      1
 #define SOCKS4_DSTPORT 2
 
 /* connect to a given IPv4 address, not the one asked for */
 static curl_socket_t socksconnect(unsigned short connectport,
                                   const char *connectaddr)
 {
-  int rc;
   srvr_sockaddr_union_t me;
   curl_socket_t sock = socket(AF_INET, SOCK_STREAM, 0);
   if(sock == CURL_SOCKET_BAD)
@@ -297,14 +221,13 @@ static curl_socket_t socksconnect(unsigned short connectport,
   me.sa4.sin_family = AF_INET;
   me.sa4.sin_port = htons(connectport);
   me.sa4.sin_addr.s_addr = INADDR_ANY;
-  Curl_inet_pton(AF_INET, connectaddr, &me.sa4.sin_addr);
+  curlx_inet_pton(AF_INET, connectaddr, &me.sa4.sin_addr);
 
-  rc = connect(sock, &me.sa, sizeof(me.sa4));
-
-  if(rc) {
-    int error = SOCKERRNO;
-    logmsg("Error connecting to %s:%hu: (%d) %s",
-           connectaddr, connectport, error, sstrerror(error));
+  if(connect(sock, &me.sa, sizeof(me.sa4))) {
+    char errbuf[STRERROR_LEN];
+    int sockerr = SOCKERRNO;
+    logmsg("Failed connecting to %s:%hu (%d) %s", connectaddr, connectport,
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
     return CURL_SOCKET_BAD;
   }
   logmsg("Connected fine to %s:%d", connectaddr, connectport);
@@ -312,7 +235,7 @@ static curl_socket_t socksconnect(unsigned short connectport,
 }
 
 static curl_socket_t socks4(curl_socket_t fd,
-                            unsigned char *buffer,
+                            const unsigned char *buffer,
                             ssize_t rc)
 {
   unsigned char response[256 + 16];
@@ -325,16 +248,16 @@ static curl_socket_t socks4(curl_socket_t fd,
     return CURL_SOCKET_BAD;
   }
   if(rc < 9) {
-    logmsg("SOCKS4 connect message too short: %d", rc);
+    logmsg("SOCKS4 connect message too short: %zd", rc);
     return CURL_SOCKET_BAD;
   }
-  if(!config.port)
-    s4port = (unsigned short)((buffer[SOCKS4_DSTPORT]<<8) |
+  if(!s_config.port)
+    s4port = (unsigned short)((buffer[SOCKS4_DSTPORT] << 8) |
                               (buffer[SOCKS4_DSTPORT + 1]));
   else
-    s4port = config.port;
+    s4port = s_config.port;
 
-  connfd = socksconnect(s4port, config.addr);
+  connfd = socksconnect(s4port, s_config.addr);
   if(connfd == CURL_SOCKET_BAD) {
     /* failed */
     cd = 91;
@@ -347,12 +270,12 @@ static curl_socket_t socks4(curl_socket_t fd,
   response[1] = cd; /* result */
   /* copy port and address from connect request */
   memcpy(&response[2], &buffer[SOCKS4_DSTPORT], 6);
-  rc = (send)(fd, (char *)response, 8, 0);
+  rc = swrite(fd, response, 8);
   if(rc != 8) {
     logmsg("Sending SOCKS4 response failed!");
     return CURL_SOCKET_BAD;
   }
-  logmsg("Sent %d bytes", rc);
+  logmsg("Sent %zd bytes", rc);
   loghex(response, rc);
 
   if(cd == 90)
@@ -367,63 +290,76 @@ static curl_socket_t socks4(curl_socket_t fd,
 
 static curl_socket_t sockit(curl_socket_t fd)
 {
-  unsigned char buffer[256 + 16];
-  unsigned char response[256 + 16];
+  unsigned char buffer[(2 * 256) + 16];
+  unsigned char response[(2 * 256) + 16];
   ssize_t rc;
   unsigned char len;
   unsigned char type;
   unsigned char rep = 0;
-  unsigned char *address;
+  const unsigned char *address;
   unsigned short socksport;
   curl_socket_t connfd = CURL_SOCKET_BAD;
   unsigned short s5port;
 
-  getconfig();
+  socksd_getconfig();
 
-  rc = recv(fd, (char *)buffer, sizeof(buffer), 0);
+  rc = sread(fd, buffer, sizeof(buffer));
+  if(rc <= 0) {
+    logmsg("SOCKS identifier message missing, recv returned %zd", rc);
+    return CURL_SOCKET_BAD;
+  }
 
-  logmsg("READ %d bytes", rc);
+  logmsg("READ %zd bytes", rc);
   loghex(buffer, rc);
 
   if(buffer[SOCKS5_VERSION] == 4)
     return socks4(fd, buffer, rc);
 
-  if(buffer[SOCKS5_VERSION] != config.version) {
-    logmsg("VERSION byte not %d", config.version);
+  if(rc < 3) {
+    logmsg("SOCKS5 identifier message too short: %zd", rc);
     return CURL_SOCKET_BAD;
   }
-  if((buffer[SOCKS5_NMETHODS] < config.nmethods_min) ||
-     (buffer[SOCKS5_NMETHODS] > config.nmethods_max)) {
+
+  if(buffer[SOCKS5_VERSION] != s_config.version) {
+    logmsg("VERSION byte not %d", s_config.version);
+    return CURL_SOCKET_BAD;
+  }
+  if((buffer[SOCKS5_NMETHODS] < s_config.nmethods_min) ||
+     (buffer[SOCKS5_NMETHODS] > s_config.nmethods_max)) {
     logmsg("NMETHODS byte not within %d - %d ",
-           config.nmethods_min, config.nmethods_max);
+           s_config.nmethods_min, s_config.nmethods_max);
     return CURL_SOCKET_BAD;
   }
   /* after NMETHODS follows that many bytes listing the methods the client
      says it supports */
   if(rc != (buffer[SOCKS5_NMETHODS] + 2)) {
-    logmsg("Expected %d bytes, got %d", buffer[SOCKS5_NMETHODS] + 2, rc);
+    logmsg("Expected %d bytes, got %zd", buffer[SOCKS5_NMETHODS] + 2, rc);
     return CURL_SOCKET_BAD;
   }
   logmsg("Incoming request deemed fine!");
 
   /* respond with two bytes: VERSION + METHOD */
-  response[0] = config.responseversion;
-  response[1] = config.responsemethod;
-  rc = (send)(fd, (char *)response, 2, 0);
+  response[0] = s_config.responseversion;
+  response[1] = s_config.responsemethod;
+  rc = swrite(fd, response, 2);
   if(rc != 2) {
     logmsg("Sending response failed!");
     return CURL_SOCKET_BAD;
   }
-  logmsg("Sent %d bytes", rc);
+  logmsg("Sent %zd bytes", rc);
   loghex(response, rc);
 
   /* expect the request or auth */
-  rc = recv(fd, (char *)buffer, sizeof(buffer), 0);
+  rc = sread(fd, buffer, sizeof(buffer));
+  if(rc <= 0) {
+    logmsg("SOCKS5 request or auth message missing, recv returned %zd", rc);
+    return CURL_SOCKET_BAD;
+  }
 
-  logmsg("READ %d bytes", rc);
+  logmsg("READ %zd bytes", rc);
   loghex(buffer, rc);
 
-  if(config.responsemethod == 2) {
+  if(s_config.responsemethod == 2) {
     /* RFC 1929 authentication
        +----+------+----------+------+----------+
        |VER | ULEN |  UNAME   | PLEN |  PASSWD  |
@@ -435,7 +371,7 @@ static curl_socket_t sockit(curl_socket_t fd)
     unsigned char plen;
     bool login = TRUE;
     if(rc < 5) {
-      logmsg("Too short auth input: %d", rc);
+      logmsg("Too short auth input: %zd", rc);
       return CURL_SOCKET_BAD;
     }
     if(buffer[SOCKS5_VERSION] != 1) {
@@ -444,63 +380,67 @@ static curl_socket_t sockit(curl_socket_t fd)
     }
     ulen = buffer[SOCKS5_ULEN];
     if(rc < 4 + ulen) {
-      logmsg("Too short packet for username: %d", rc);
+      logmsg("Too short packet for username: %zd", rc);
       return CURL_SOCKET_BAD;
     }
     plen = buffer[SOCKS5_ULEN + ulen + 1];
     if(rc < 3 + ulen + plen) {
-      logmsg("Too short packet for ulen %d plen %d: %d", ulen, plen, rc);
+      logmsg("Too short packet for ulen %d plen %d: %zd", ulen, plen, rc);
       return CURL_SOCKET_BAD;
     }
-    if((ulen != strlen(config.user)) ||
-       (plen != strlen(config.password)) ||
-       memcmp(&buffer[SOCKS5_UNAME], config.user, ulen) ||
-       memcmp(&buffer[SOCKS5_UNAME + ulen + 1], config.password, plen)) {
+    if((ulen != strlen(s_config.user)) ||
+       (plen != strlen(s_config.password)) ||
+       memcmp(&buffer[SOCKS5_UNAME], s_config.user, ulen) ||
+       memcmp(&buffer[SOCKS5_UNAME + ulen + 1], s_config.password, plen)) {
       /* no match! */
       logmsg("mismatched credentials!");
       login = FALSE;
     }
     response[0] = 1;
     response[1] = login ? 0 : 1;
-    rc = (send)(fd, (char *)response, 2, 0);
+    rc = swrite(fd, response, 2);
     if(rc != 2) {
       logmsg("Sending auth response failed!");
       return CURL_SOCKET_BAD;
     }
-    logmsg("Sent %d bytes", rc);
+    logmsg("Sent %zd bytes", rc);
     loghex(response, rc);
     if(!login)
       return CURL_SOCKET_BAD;
 
     /* expect the request */
-    rc = recv(fd, (char *)buffer, sizeof(buffer), 0);
+    rc = sread(fd, buffer, sizeof(buffer));
+    if(rc <= 0) {
+      logmsg("SOCKS5 request message missing, recv returned %zd", rc);
+      return CURL_SOCKET_BAD;
+    }
 
-    logmsg("READ %d bytes", rc);
+    logmsg("READ %zd bytes", rc);
     loghex(buffer, rc);
   }
   if(rc < 6) {
-    logmsg("Too short for request: %d", rc);
+    logmsg("Too short for request: %zd", rc);
     return CURL_SOCKET_BAD;
   }
 
-  if(buffer[SOCKS5_VERSION] != config.version) {
-    logmsg("Request VERSION byte not %d", config.version);
+  if(buffer[SOCKS5_VERSION] != s_config.version) {
+    logmsg("Request VERSION byte not %d", s_config.version);
     return CURL_SOCKET_BAD;
   }
   /* 1 == CONNECT */
-  if(buffer[SOCKS5_REQCMD] != config.reqcmd) {
-    logmsg("Request COMMAND byte not %d", config.reqcmd);
+  if(buffer[SOCKS5_REQCMD] != s_config.reqcmd) {
+    logmsg("Request COMMAND byte not %d", s_config.reqcmd);
     return CURL_SOCKET_BAD;
   }
   /* reserved, should be zero */
   if(buffer[SOCKS5_RESERVED]) {
-    logmsg("Request COMMAND byte not %d", config.reqcmd);
+    logmsg("Request COMMAND byte not %d", s_config.reqcmd);
     return CURL_SOCKET_BAD;
   }
   /* ATYP:
-     o  IP V4 address: X'01'
-     o  DOMAINNAME: X'03'
-     o  IP V6 address: X'04'
+     o  IPv4 address: 0x01
+     o  domain name:  0x03
+     o  IPv6 address: 0x04
   */
   type = buffer[SOCKS5_ATYP];
   address = &buffer[SOCKS5_DSTADDR];
@@ -524,14 +464,14 @@ static curl_socket_t sockit(curl_socket_t fd)
     return CURL_SOCKET_BAD;
   }
   if(rc < (4 + len + 2)) {
-    logmsg("Request too short: %d, expected %d", rc, 4 + len + 2);
+    logmsg("Request too short: %zd, expected %d", rc, 4 + len + 2);
     return CURL_SOCKET_BAD;
   }
   logmsg("Received ATYP %d", type);
 
   {
     FILE *dump;
-    dump = fopen(reqlogfile, "ab");
+    dump = curlx_fopen(reqlogfile, "ab");
     if(dump) {
       int i;
       fprintf(dump, "atyp %u =>", type);
@@ -544,7 +484,7 @@ static curl_socket_t sockit(curl_socket_t fd)
       case 3:
         /* The first octet of the address field contains the number of octets
            of name that follow */
-        fprintf(dump, " %.*s\n", len-1, &address[1]);
+        fprintf(dump, " %.*s\n", len - 1, &address[1]);
         break;
       case 4:
         /* 16 bytes IPv6 address */
@@ -554,43 +494,42 @@ static curl_socket_t sockit(curl_socket_t fd)
         fprintf(dump, "\n");
         break;
       }
-      fclose(dump);
+      curlx_fclose(dump);
     }
   }
 
-  if(!config.port) {
-    unsigned char *portp = &buffer[SOCKS5_DSTADDR + len];
-    s5port = (unsigned short)((portp[0]<<8) | (portp[1]));
+  if(!s_config.port) {
+    const unsigned char *portp = &buffer[SOCKS5_DSTADDR + len];
+    s5port = (unsigned short)((portp[0] << 8) | (portp[1]));
   }
   else
-    s5port = config.port;
+    s5port = s_config.port;
 
-  if(!config.connectrep)
-    connfd = socksconnect(s5port, config.addr);
+  if(!s_config.connectrep)
+    connfd = socksconnect(s5port, s_config.addr);
 
   if(connfd == CURL_SOCKET_BAD) {
     /* failed */
     rep = 1;
   }
   else {
-    rep = config.connectrep;
+    rep = s_config.connectrep;
   }
 
-  /* */
-  response[SOCKS5_VERSION] = config.responseversion;
+  response[SOCKS5_VERSION] = s_config.responseversion;
 
   /*
-    o  REP    Reply field:
-    o  X'00' succeeded
-    o  X'01' general SOCKS server failure
-    o  X'02' connection not allowed by ruleset
-    o  X'03' Network unreachable
-    o  X'04' Host unreachable
-    o  X'05' Connection refused
-    o  X'06' TTL expired
-    o  X'07' Command not supported
-    o  X'08' Address type not supported
-    o  X'09' to X'FF' unassigned
+    o  REP  Reply field:
+    o  0x00 succeeded
+    o  0x01 general SOCKS server failure
+    o  0x02 connection not allowed by ruleset
+    o  0x03 Network unreachable
+    o  0x04 Host unreachable
+    o  0x05 Connection refused
+    o  0x06 TTL expired
+    o  0x07 Command not supported
+    o  0x08 Address type not supported
+    o  0x09 to 0xFF unassigned
   */
   response[SOCKS5_REP] = rep;
   response[SOCKS5_RESERVED] = 0; /* must be zero */
@@ -605,12 +544,12 @@ static curl_socket_t sockit(curl_socket_t fd)
   memcpy(&response[SOCKS5_BNDADDR + len],
          &buffer[SOCKS5_DSTADDR + len], sizeof(socksport));
 
-  rc = (send)(fd, (char *)response, len + 6, 0);
+  rc = swrite(fd, response, len + 6);
   if(rc != (len + 6)) {
     logmsg("Sending connect response failed!");
     return CURL_SOCKET_BAD;
   }
-  logmsg("Sent %d bytes", rc);
+  logmsg("Sent %zd bytes", rc);
   loghex(response, rc);
 
   if(!rep)
@@ -638,10 +577,9 @@ static int tunnel(struct perclient *cp, fd_set *fds)
   char buffer[512];
   if(FD_ISSET(cp->clientfd, fds)) {
     /* read from client, send to remote */
-    nread = recv(cp->clientfd, buffer, sizeof(buffer), 0);
+    nread = sread(cp->clientfd, buffer, sizeof(buffer));
     if(nread > 0) {
-      nwrite = send(cp->remotefd, (char *)buffer,
-                    (SEND_TYPE_ARG3)nread, 0);
+      nwrite = swrite(cp->remotefd, buffer, nread);
       if(nwrite != nread)
         return 1;
       cp->fromclient += nwrite;
@@ -651,10 +589,9 @@ static int tunnel(struct perclient *cp, fd_set *fds)
   }
   if(FD_ISSET(cp->remotefd, fds)) {
     /* read from remote, send to client */
-    nread = recv(cp->remotefd, buffer, sizeof(buffer), 0);
+    nread = sread(cp->remotefd, buffer, sizeof(buffer));
     if(nread > 0) {
-      nwrite = send(cp->clientfd, (char *)buffer,
-                    (SEND_TYPE_ARG3)nread, 0);
+      nwrite = swrite(cp->clientfd, buffer, nread);
       if(nwrite != nread)
         return 1;
       cp->fromremote += nwrite;
@@ -671,7 +608,7 @@ static int tunnel(struct perclient *cp, fd_set *fds)
   if sockfd is CURL_SOCKET_BAD, listendfd is a listening socket we must
   accept()
 */
-static bool incoming(curl_socket_t listenfd)
+static bool socksd_incoming(curl_socket_t listenfd)
 {
   fd_set fds_read;
   fd_set fds_write;
@@ -696,7 +633,8 @@ static bool incoming(curl_socket_t listenfd)
   do {
     int i;
     ssize_t rc;
-    int error = 0;
+    int sockerr = 0;
+    char errbuf[STRERROR_LEN];
     curl_socket_t sockfd = listenfd;
     int maxfd = (int)sockfd;
 
@@ -704,7 +642,7 @@ static bool incoming(curl_socket_t listenfd)
     FD_ZERO(&fds_write);
     FD_ZERO(&fds_err);
 
-    /* there's always a socket to wait for */
+    /* there is always a socket to wait for */
     FD_SET(sockfd, &fds_read);
 
     for(i = 0; i < 2; i++) {
@@ -727,25 +665,25 @@ static bool incoming(curl_socket_t listenfd)
         logmsg("signalled to die, exiting...");
         return FALSE;
       }
-    } while((rc == -1) && ((error = errno) == EINTR));
+    } while((rc == -1) && ((sockerr = SOCKERRNO) == SOCKEINTR));
 
     if(rc < 0) {
-      logmsg("select() failed with error: (%d) %s",
-             error, strerror(error));
+      logmsg("select() failed with error (%d) %s",
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
       return FALSE;
     }
 
     if((clients < 2) && FD_ISSET(sockfd, &fds_read)) {
       curl_socket_t newfd = accept(sockfd, NULL, NULL);
-      if(CURL_SOCKET_BAD == newfd) {
-        error = SOCKERRNO;
-        logmsg("accept(%d, NULL, NULL) failed with error: (%d) %s",
-               sockfd, error, sstrerror(error));
+      if(newfd == CURL_SOCKET_BAD) {
+        sockerr = SOCKERRNO;
+        logmsg("accept() failed with error (%d) %s",
+               sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
       }
       else {
         curl_socket_t remotefd;
-        logmsg("====> Client connect, fd %d. Read config from %s",
-               newfd, configfile);
+        logmsg("====> Client connect, "
+               "Read config from %s", configfile);
         remotefd = sockit(newfd); /* SOCKS until done */
         if(remotefd == CURL_SOCKET_BAD) {
           logmsg("====> Client disconnect");
@@ -764,7 +702,6 @@ static bool incoming(curl_socket_t listenfd)
           cp->used = TRUE;
           clients++;
         }
-
       }
     }
     for(i = 0; i < 2; i++) {
@@ -785,224 +722,80 @@ static bool incoming(curl_socket_t listenfd)
   return TRUE;
 }
 
-static curl_socket_t sockdaemon(curl_socket_t sock,
-                                unsigned short *listenport
-#ifdef USE_UNIX_SOCKETS
-        , const char *unix_socket
-#endif
-        )
-{
-  /* passive daemon style */
-  srvr_sockaddr_union_t listener;
-  int flag;
-  int rc;
-  int totdelay = 0;
-  int maxretr = 10;
-  int delay = 20;
-  int attempt = 0;
-  int error = 0;
-
-  do {
-    attempt++;
-    flag = 1;
-    rc = setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
-         (void *)&flag, sizeof(flag));
-    if(rc) {
-      error = SOCKERRNO;
-      logmsg("setsockopt(SO_REUSEADDR) failed with error: (%d) %s",
-             error, sstrerror(error));
-      if(maxretr) {
-        rc = wait_ms(delay);
-        if(rc) {
-          /* should not happen */
-          error = errno;
-          logmsg("wait_ms() failed with error: (%d) %s",
-                 error, strerror(error));
-          sclose(sock);
-          return CURL_SOCKET_BAD;
-        }
-        if(got_exit_signal) {
-          logmsg("signalled to die, exiting...");
-          sclose(sock);
-          return CURL_SOCKET_BAD;
-        }
-        totdelay += delay;
-        delay *= 2; /* double the sleep for next attempt */
-      }
-    }
-  } while(rc && maxretr--);
-
-  if(rc) {
-    logmsg("setsockopt(SO_REUSEADDR) failed %d times in %d ms. Error: (%d) %s",
-           attempt, totdelay, error, strerror(error));
-    logmsg("Continuing anyway...");
-  }
-
-  /* When the specified listener port is zero, it is actually a
-     request to let the system choose a non-zero available port. */
-
-  switch(socket_domain) {
-    case AF_INET:
-      memset(&listener.sa4, 0, sizeof(listener.sa4));
-      listener.sa4.sin_family = AF_INET;
-      listener.sa4.sin_addr.s_addr = INADDR_ANY;
-      listener.sa4.sin_port = htons(*listenport);
-      rc = bind(sock, &listener.sa, sizeof(listener.sa4));
-      break;
-#ifdef ENABLE_IPV6
-    case AF_INET6:
-      memset(&listener.sa6, 0, sizeof(listener.sa6));
-      listener.sa6.sin6_family = AF_INET6;
-      listener.sa6.sin6_addr = in6addr_any;
-      listener.sa6.sin6_port = htons(*listenport);
-      rc = bind(sock, &listener.sa, sizeof(listener.sa6));
-      break;
-#endif /* ENABLE_IPV6 */
-#ifdef USE_UNIX_SOCKETS
-    case AF_UNIX:
-    rc = bind_unix_socket(sock, unix_socket, &listener.sau);
-#endif
-  }
-
-  if(rc) {
-    error = SOCKERRNO;
-#ifdef USE_UNIX_SOCKETS
-    if(socket_domain == AF_UNIX)
-      logmsg("Error binding socket on path %s: (%d) %s",
-             unix_socket, error, sstrerror(error));
-    else
-#endif
-      logmsg("Error binding socket on port %hu: (%d) %s",
-             *listenport, error, sstrerror(error));
-    sclose(sock);
-    return CURL_SOCKET_BAD;
-  }
-
-  if(!*listenport
-#ifdef USE_UNIX_SOCKETS
-          && !unix_socket
-#endif
-    ) {
-    /* The system was supposed to choose a port number, figure out which
-       port we actually got and update the listener port value with it. */
-    curl_socklen_t la_size;
-    srvr_sockaddr_union_t localaddr;
-#ifdef ENABLE_IPV6
-    if(socket_domain == AF_INET6)
-      la_size = sizeof(localaddr.sa6);
-    else
-#endif
-      la_size = sizeof(localaddr.sa4);
-    memset(&localaddr.sa, 0, (size_t)la_size);
-    if(getsockname(sock, &localaddr.sa, &la_size) < 0) {
-      error = SOCKERRNO;
-      logmsg("getsockname() failed with error: (%d) %s",
-             error, sstrerror(error));
-      sclose(sock);
-      return CURL_SOCKET_BAD;
-    }
-    switch(localaddr.sa.sa_family) {
-    case AF_INET:
-      *listenport = ntohs(localaddr.sa4.sin_port);
-      break;
-#ifdef ENABLE_IPV6
-    case AF_INET6:
-      *listenport = ntohs(localaddr.sa6.sin6_port);
-      break;
-#endif
-    default:
-      break;
-    }
-    if(!*listenport) {
-      /* Real failure, listener port shall not be zero beyond this point. */
-      logmsg("Apparently getsockname() succeeded, with listener port zero.");
-      logmsg("A valid reason for this failure is a binary built without");
-      logmsg("proper network library linkage. This might not be the only");
-      logmsg("reason, but double check it before anything else.");
-      sclose(sock);
-      return CURL_SOCKET_BAD;
-    }
-  }
-
-  /* start accepting connections */
-  rc = listen(sock, 5);
-  if(0 != rc) {
-    error = SOCKERRNO;
-    logmsg("listen(%d, 5) failed with error: (%d) %s",
-           sock, error, sstrerror(error));
-    sclose(sock);
-    return CURL_SOCKET_BAD;
-  }
-
-  return sock;
-}
-
-
-int main(int argc, char *argv[])
+static int test_socksd(int argc, const char *argv[])
 {
   curl_socket_t sock = CURL_SOCKET_BAD;
   curl_socket_t msgsock = CURL_SOCKET_BAD;
   int wrotepidfile = 0;
   int wroteportfile = 0;
-  const char *pidname = ".socksd.pid";
-  const char *portname = NULL; /* none by default */
   bool juggle_again;
-  int error;
+  char errbuf[STRERROR_LEN];
   int arg = 1;
 
-#ifdef USE_UNIX_SOCKETS
   const char *unix_socket = NULL;
-  bool unlink_socket = false;
+#ifdef USE_UNIX_SOCKETS
+  bool unlink_socket = FALSE;
 #endif
 
-  while(argc>arg) {
+  pidname = ".socksd.pid";
+  serverlogfile = "log/socksd.log";
+  configfile = "socksd.config";
+  server_port = 8905;
+
+  while(argc > arg) {
+    const char *opt;
+    curl_off_t num;
     if(!strcmp("--version", argv[arg])) {
       printf("socksd IPv4%s\n",
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
              "/IPv6"
 #else
              ""
 #endif
-             );
+      );
       return 0;
     }
     else if(!strcmp("--pidfile", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         pidname = argv[arg++];
     }
     else if(!strcmp("--portfile", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         portname = argv[arg++];
     }
     else if(!strcmp("--config", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         configfile = argv[arg++];
     }
     else if(!strcmp("--backend", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         backendaddr = argv[arg++];
     }
     else if(!strcmp("--backendport", argv[arg])) {
       arg++;
-      if(argc>arg)
-        backendport = (unsigned short)atoi(argv[arg++]);
+      if(argc > arg) {
+        opt = argv[arg];
+        if(!curlx_str_number(&opt, &num, 0xffff))
+          backendport = (unsigned short)num;
+        arg++;
+      }
     }
     else if(!strcmp("--logfile", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         serverlogfile = argv[arg++];
     }
     else if(!strcmp("--reqfile", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         reqlogfile = argv[arg++];
     }
     else if(!strcmp("--ipv6", argv[arg])) {
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
       socket_domain = AF_INET6;
       socket_type = "IPv6";
 #endif
@@ -1010,21 +803,21 @@ int main(int argc, char *argv[])
     }
     else if(!strcmp("--ipv4", argv[arg])) {
       /* for completeness, we support this option as well */
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
       socket_type = "IPv4";
 #endif
       arg++;
     }
     else if(!strcmp("--unix-socket", argv[arg])) {
       arg++;
-      if(argc>arg) {
+      if(argc > arg) {
 #ifdef USE_UNIX_SOCKETS
         struct sockaddr_un sau;
         unix_socket = argv[arg];
         if(strlen(unix_socket) >= sizeof(sau.sun_path)) {
           fprintf(stderr,
-                  "socksd: socket path must be shorter than %zu chars: %s\n",
-              sizeof(sau.sun_path), unix_socket);
+                  "socksd: socket path must be shorter than %u chars: %s\n",
+                  (unsigned int)sizeof(sau.sun_path), unix_socket);
           return 0;
         }
         socket_domain = AF_UNIX;
@@ -1035,10 +828,10 @@ int main(int argc, char *argv[])
     }
     else if(!strcmp("--port", argv[arg])) {
       arg++;
-      if(argc>arg) {
-        char *endptr;
-        unsigned long ulnum = strtoul(argv[arg], &endptr, 10);
-        port = curlx_ultous(ulnum);
+      if(argc > arg) {
+        opt = argv[arg];
+        if(!curlx_str_number(&opt, &num, 0xffff))
+          server_port = (unsigned short)num;
         arg++;
       }
     }
@@ -1055,44 +848,34 @@ int main(int argc, char *argv[])
            " --ipv4\n"
            " --ipv6\n"
            " --unix-socket [file]\n"
-           " --bindonly\n"
            " --port [port]\n");
       return 0;
     }
   }
 
-#ifdef WIN32
-  win32_init();
-  atexit(win32_cleanup);
+  CURL_BINMODE(stdin);
+  CURL_BINMODE(stdout);
+  CURL_BINMODE(stderr);
 
-  setmode(fileno(stdin), O_BINARY);
-  setmode(fileno(stdout), O_BINARY);
-  setmode(fileno(stderr), O_BINARY);
-#endif
-
-  install_signal_handlers(false);
+  install_signal_handlers(FALSE);
 
   sock = socket(socket_domain, SOCK_STREAM, 0);
 
-  if(CURL_SOCKET_BAD == sock) {
-    error = SOCKERRNO;
-    logmsg("Error creating socket: (%d) %s",
-           error, sstrerror(error));
+  if(sock == CURL_SOCKET_BAD) {
+    int sockerr = SOCKERRNO;
+    logmsg("Error creating socket (%d) %s",
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
     goto socks5_cleanup;
   }
 
   {
     /* passive daemon style */
-    sock = sockdaemon(sock, &port
-#ifdef USE_UNIX_SOCKETS
-            , unix_socket
-#endif
-            );
-    if(CURL_SOCKET_BAD == sock) {
+    sock = sockdaemon(sock, &server_port, unix_socket, FALSE);
+    if(sock == CURL_SOCKET_BAD) {
       goto socks5_cleanup;
     }
 #ifdef USE_UNIX_SOCKETS
-    unlink_socket = true;
+    unlink_socket = TRUE;
 #endif
     msgsock = CURL_SOCKET_BAD; /* no stream socket yet */
   }
@@ -1101,10 +884,10 @@ int main(int argc, char *argv[])
 
 #ifdef USE_UNIX_SOCKETS
   if(socket_domain == AF_UNIX)
-    logmsg("Listening on unix socket %s", unix_socket);
+    logmsg("Listening on Unix socket %s", unix_socket);
   else
 #endif
-  logmsg("Listening on port %hu", port);
+  logmsg("Listening on port %hu", server_port);
 
   wrotepidfile = write_pidfile(pidname);
   if(!wrotepidfile) {
@@ -1112,14 +895,14 @@ int main(int argc, char *argv[])
   }
 
   if(portname) {
-    wroteportfile = write_portfile(portname, port);
+    wroteportfile = write_portfile(portname, server_port);
     if(!wroteportfile) {
       goto socks5_cleanup;
     }
   }
 
   do {
-    juggle_again = incoming(sock);
+    juggle_again = socksd_incoming(sock);
   } while(juggle_again);
 
 socks5_cleanup:
@@ -1131,10 +914,10 @@ socks5_cleanup:
     sclose(sock);
 
 #ifdef USE_UNIX_SOCKETS
-  if(unlink_socket && socket_domain == AF_UNIX) {
-    error = unlink(unix_socket);
-    logmsg("unlink(%s) = %d (%s)", unix_socket, error, strerror(error));
-  }
+  if(unlink_socket && socket_domain == AF_UNIX && unix_socket &&
+     unlink(unix_socket))
+    logmsg("unlink(%s): %d (%s)", unix_socket,
+           errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
 #endif
 
   if(wrotepidfile)
@@ -1142,7 +925,7 @@ socks5_cleanup:
   if(wroteportfile)
     unlink(portname);
 
-  restore_signal_handlers(false);
+  restore_signal_handlers(FALSE);
 
   if(got_exit_signal) {
     logmsg("============> socksd exits with signal (%d)", exit_signal);
diff --git a/third-party/curl/tests/server/sws.c b/third-party/curl/tests/server/sws.c
index e6b7e2de11..04e6025fa5 100644
--- a/third-party/curl/tests/server/sws.c
+++ b/third-party/curl/tests/server/sws.c
@@ -21,7 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "server_setup.h"
+#include "first.h"
 
 /* sws.c: simple (silly?) web server
 
@@ -30,75 +30,28 @@
 
  */
 
-#ifdef HAVE_SIGNAL_H
-#include <signal.h>
-#endif
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-#ifdef HAVE_NETINET_IN6_H
-#include <netinet/in6.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
 #ifdef HAVE_NETINET_TCP_H
 #include <netinet/tcp.h> /* for TCP_NODELAY */
 #endif
 
-#define ENABLE_CURLX_PRINTF
-/* make the curlx header define all printf() functions to use the curlx_*
-   versions instead */
-#include "curlx.h" /* from the private lib dir */
-#include "getpart.h"
-#include "inet_pton.h"
-#include "util.h"
-#include "server_sockaddr.h"
-
-/* include memdebug.h last */
-#include "memdebug.h"
-
-#ifdef USE_WINSOCK
-#undef  EINTR
-#define EINTR    4 /* errno.h value */
-#undef  EAGAIN
-#define EAGAIN  11 /* errno.h value */
-#undef  ERANGE
-#define ERANGE  34 /* errno.h value */
-#endif
-
-static enum {
-  socket_domain_inet = AF_INET
-#ifdef ENABLE_IPV6
-  , socket_domain_inet6 = AF_INET6
-#endif
-#ifdef USE_UNIX_SOCKETS
-  , socket_domain_unix = AF_UNIX
-#endif
-} socket_domain = AF_INET;
 static bool use_gopher = FALSE;
-static int serverlogslocked = 0;
 static bool is_proxy = FALSE;
 
-#define REQBUFSIZ (2*1024*1024)
-
 #define MAX_SLEEP_TIME_MS 250
 
-static long prevtestno = -1;    /* previous test number we served */
-static long prevpartno = -1;    /* previous part number we served */
-static bool prevbounce = FALSE; /* instructs the server to increase the part
-                                   number for a test in case the identical
-                                   testno+partno request shows up again */
+static long sws_prevtestno = -1;    /* previous test number we served */
+static long sws_prevpartno = -1;    /* previous part number we served */
+static bool sws_prevbounce = FALSE; /* instructs the server to override the
+                                       requested part number to
+                                       prevpartno + 1 when prevtestno and
+                                       current test are the same */
 
 #define RCMD_NORMALREQ 0 /* default request, use the tests file normally */
 #define RCMD_IDLE      1 /* told to sit idle */
 #define RCMD_STREAM    2 /* told to stream */
 
-struct httprequest {
-  char reqbuf[REQBUFSIZ]; /* buffer area for the incoming request */
+struct sws_httprequest {
+  char reqbuf[2 * 1024 * 1024]; /* buffer area for the incoming request */
   bool connect_request; /* if a CONNECT */
   unsigned short connect_port; /* the port number CONNECT used */
   size_t checkindex; /* where to start checking of the request */
@@ -106,12 +59,12 @@ struct httprequest {
   long testno;       /* test number found in the request */
   long partno;       /* part number found in the request */
   bool open;      /* keep connection open info, as found in the request */
-  bool auth_req;  /* authentication required, don't wait for body unless
-                     there's an Authorization header */
+  bool auth_req;  /* authentication required, do not wait for body unless
+                     there is an Authorization header */
   bool auth;      /* Authorization header present in the incoming request */
   size_t cl;      /* Content-Length of the incoming request */
   bool digest;    /* Authorization digest header found */
-  bool ntlm;      /* Authorization ntlm header found */
+  bool ntlm;      /* Authorization NTLM header found */
   int delay;      /* if non-zero, delay this number of msec after connect */
   int writedelay; /* if non-zero, delay this number of milliseconds between
                      writes in the response */
@@ -121,9 +74,9 @@ struct httprequest {
                      - skip bytes. */
   int rcmd;       /* doing a special command, see defines above */
   int prot_version;  /* HTTP version * 10 */
-  int callcount;  /* times ProcessRequest() gets called */
+  int callcount;  /* times sws_ProcessRequest() gets called */
   bool skipall;   /* skip all incoming data */
-  bool noexpect;  /* refuse Expect: (don't read the body) */
+  bool noexpect;  /* refuse Expect: (do not read the body) */
   bool connmon;   /* monitor the state of the connection, log disconnects */
   bool upgrade;   /* test case allows upgrade */
   bool upgrade_request; /* upgrade request found and allowed */
@@ -137,19 +90,6 @@ struct httprequest {
 static curl_socket_t all_sockets[MAX_SOCKETS];
 static size_t num_sockets = 0;
 
-static int ProcessRequest(struct httprequest *req);
-static void storerequest(const char *reqbuf, size_t totalsize);
-
-#define DEFAULT_PORT 8999
-
-#ifndef DEFAULT_LOGFILE
-#define DEFAULT_LOGFILE "log/sws.log"
-#endif
-
-const char *serverlogfile = DEFAULT_LOGFILE;
-static const char *logdir = "log";
-static char loglockfile[256];
-
 #define SWSVERSION "curl test suite HTTP server/0.1"
 
 #define REQUEST_DUMP  "server.input"
@@ -160,27 +100,29 @@ static char loglockfile[256];
 #define REQUEST_PROXY_DUMP  "proxy.input"
 #define RESPONSE_PROXY_DUMP "proxy.response"
 
+#define REQUEST_DUMP_FILENAME \
+  (is_proxy ? REQUEST_PROXY_DUMP : REQUEST_DUMP)
+
 /* file in which additional instructions may be found */
-#define DEFAULT_CMDFILE "log/server.cmd"
-const char *cmdfile = DEFAULT_CMDFILE;
+static const char *cmdfile = "log/server.cmd";
 
 /* very-big-path support */
-#define MAXDOCNAMELEN 140000
+#define MAXDOCNAMELEN     140000
 #define MAXDOCNAMELEN_TXT "139999"
 
-#define REQUEST_KEYWORD_SIZE 256
+#define REQUEST_KEYWORD_SIZE     256
 #define REQUEST_KEYWORD_SIZE_TXT "255"
 
 #define CMD_AUTH_REQUIRED "auth_required"
 
-/* 'idle' means that it will accept the request fine but never respond
-   any data. Just keep the connection alive. */
+/* 'idle' means that it accepts the request fine but never responds
+   any data. Keep the connection alive. */
 #define CMD_IDLE "idle"
 
 /* 'stream' means to send a never-ending stream of data */
 #define CMD_STREAM "stream"
 
-/* 'connection-monitor' will output when a server/proxy connection gets
+/* 'connection-monitor' outputs when a server/proxy connection gets
    disconnected as for some cases it is important that it gets done at the
    proper point - like with NTLM */
 #define CMD_CONNECTIONMONITOR "connection-monitor"
@@ -196,71 +138,94 @@ const char *cmdfile = DEFAULT_CMDFILE;
 
 #define END_OF_HEADERS "\r\n\r\n"
 
-enum {
-  DOCNUMBER_NOTHING = -4,
-  DOCNUMBER_QUIT    = -3,
-  DOCNUMBER_WERULEZ = -2,
-  DOCNUMBER_404     = -1
-};
-
 static const char *end_of_headers = END_OF_HEADERS;
 
 /* sent as reply to a QUIT */
-static const char *docquit =
-"HTTP/1.1 200 Goodbye" END_OF_HEADERS;
+static const char *docquit_sws = "HTTP/1.1 200 Goodbye" END_OF_HEADERS;
 
 /* send back this on 404 file not found */
-static const char *doc404 = "HTTP/1.1 404 Not Found\r\n"
-    "Server: " SWSVERSION "\r\n"
-    "Connection: close\r\n"
-    "Content-Type: text/html"
-    END_OF_HEADERS
-    "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n"
-    "<HTML><HEAD>\n"
-    "<TITLE>404 Not Found</TITLE>\n"
-    "</HEAD><BODY>\n"
-    "<H1>Not Found</H1>\n"
-    "The requested URL was not found on this server.\n"
-    "<P><HR><ADDRESS>" SWSVERSION "</ADDRESS>\n" "</BODY></HTML>\n";
+static const char *doc404 =
+  "HTTP/1.1 404 Not Found\r\n"
+  "Server: " SWSVERSION "\r\n"
+  "Connection: close\r\n"
+  "Content-Type: text/html"
+  END_OF_HEADERS
+  "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n"
+  "<HTML><HEAD>\n"
+  "<TITLE>404 Not Found</TITLE>\n"
+  "</HEAD><BODY>\n"
+  "<H1>Not Found</H1>\n"
+  "The requested URL was not found on this server.\n"
+  "<P><HR><ADDRESS>" SWSVERSION "</ADDRESS>\n"
+  "</BODY></HTML>\n";
+
+/* This function returns a pointer to STATIC memory. It converts the given
+ * binary lump to a hex formatted string usable for output in logs or
+ * whatever.
+ */
+static char *data_to_hex(const char *data, size_t len)
+{
+  static char buf[256 * 3];
+  size_t i;
+  char *optr = buf;
+  const char *iptr = data;
+
+  if(len > 255)
+    len = 255;
+
+  for(i = 0; i < len; i++) {
+    if((data[i] >= 0x20) && (data[i] < 0x7f))
+      *optr++ = *iptr++;
+    else {
+      snprintf(optr, 4, "%%%02x", (unsigned char)*iptr++);
+      optr += 3;
+    }
+  }
+  *optr = 0; /* in case no sprintf was used */
+
+  return buf;
+}
 
 /* work around for handling trailing headers */
 static int already_recv_zeroed_chunk = FALSE;
 
+#if defined(TCP_NODELAY) && defined(CURL_TCP_NODELAY_SUPPORTED)
 /* returns true if the current socket is an IP one */
 static bool socket_domain_is_ip(void)
 {
   switch(socket_domain) {
   case AF_INET:
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
   case AF_INET6:
 #endif
-    return true;
+    return TRUE;
   default:
-  /* case AF_UNIX: */
-    return false;
+    /* case AF_UNIX: */
+    return FALSE;
   }
 }
+#endif
 
 /* parse the file on disk that might have a test number for us */
-static int parse_cmdfile(struct httprequest *req)
+static int parse_cmdfile(struct sws_httprequest *req)
 {
-  FILE *f = fopen(cmdfile, FOPEN_READTEXT);
+  FILE *f = curlx_fopen(cmdfile, FOPEN_READTEXT);
   if(f) {
     int testnum = DOCNUMBER_NOTHING;
     char buf[256];
     while(fgets(buf, sizeof(buf), f)) {
-      if(1 == sscanf(buf, "Testnum %d", &testnum)) {
+      if(sscanf(buf, "Testnum %d", &testnum) == 1) {
         logmsg("[%s] cmdfile says testnum %d", cmdfile, testnum);
         req->testno = testnum;
       }
     }
-    fclose(f);
+    curlx_fclose(f);
   }
   return 0;
 }
 
 /* based on the testno, parse the correct server commands */
-static int parse_servercmd(struct httprequest *req)
+static int sws_parse_servercmd(struct sws_httprequest *req)
 {
   FILE *stream;
   int error;
@@ -270,30 +235,32 @@ static int parse_servercmd(struct httprequest *req)
   req->connmon = FALSE;
 
   if(!stream) {
+    char errbuf[STRERROR_LEN];
     error = errno;
-    logmsg("fopen() failed with error: %d %s", error, strerror(error));
-    logmsg("  Couldn't open test file %ld", req->testno);
+    logmsg("fopen() failed with error (%d) %s",
+           error, curlx_strerror(error, errbuf, sizeof(errbuf)));
+    logmsg("  Could not open test file %ld", req->testno);
     req->open = FALSE; /* closes connection */
     return 1; /* done */
   }
   else {
     char *orgcmd = NULL;
-    char *cmd = NULL;
+    const char *cmd = NULL;
     size_t cmdsize = 0;
     int num = 0;
 
     /* get the custom server control "commands" */
     error = getpart(&orgcmd, &cmdsize, "reply", "servercmd", stream);
-    fclose(stream);
+    curlx_fclose(stream);
     if(error) {
-      logmsg("getpart() failed with error: %d", error);
+      logmsg("getpart() failed with error (%d)", error);
       req->open = FALSE; /* closes connection */
       return 1; /* done */
     }
 
     cmd = orgcmd;
     while(cmd && cmdsize) {
-      char *check;
+      const char *check;
 
       if(!strncmp(CMD_AUTH_REQUIRED, cmd, strlen(CMD_AUTH_REQUIRED))) {
         logmsg("instructed to require authorization header");
@@ -321,7 +288,7 @@ static int parse_servercmd(struct httprequest *req)
         logmsg("swsclose: close this connection after response");
         req->close = TRUE;
       }
-      else if(1 == sscanf(cmd, "skip: %d", &num)) {
+      else if(sscanf(cmd, "skip: %d", &num) == 1) {
         logmsg("instructed to skip this number of bytes %d", num);
         req->skip = num;
       }
@@ -329,18 +296,18 @@ static int parse_servercmd(struct httprequest *req)
         logmsg("instructed to reject Expect: 100-continue");
         req->noexpect = TRUE;
       }
-      else if(1 == sscanf(cmd, "delay: %d", &num)) {
+      else if(sscanf(cmd, "delay: %d", &num) == 1) {
         logmsg("instructed to delay %d msecs after connect", num);
         req->delay = num;
       }
-      else if(1 == sscanf(cmd, "writedelay: %d", &num)) {
+      else if(sscanf(cmd, "writedelay: %d", &num) == 1) {
         logmsg("instructed to delay %d msecs between packets", num);
         req->writedelay = num;
       }
       else {
         logmsg("Unknown <servercmd> instruction found: %s", cmd);
       }
-      /* try to deal with CRLF or just LF */
+      /* try to deal with CRLF or LF */
       check = strchr(cmd, '\r');
       if(!check)
         check = strchr(cmd, '\n');
@@ -364,20 +331,21 @@ static int parse_servercmd(struct httprequest *req)
   return 0; /* OK! */
 }
 
-static int ProcessRequest(struct httprequest *req)
+static int sws_ProcessRequest(struct sws_httprequest *req)
 {
-  char *line = &req->reqbuf[req->checkindex];
+  const char *line = &req->reqbuf[req->checkindex];
   bool chunked = FALSE;
   static char request[REQUEST_KEYWORD_SIZE];
-  char logbuf[456];
   int prot_major = 0;
   int prot_minor = 0;
-  char *end = strstr(line, end_of_headers);
+  const char *end = strstr(line, end_of_headers);
+  const char *pval;
+  curl_off_t num;
 
   req->callcount++;
 
-  logmsg("Process %d bytes request%s", req->offset,
-         req->callcount > 1?" [CONTINUED]":"");
+  logmsg("Process %zu bytes request%s", req->offset,
+         req->callcount > 1 ? " [CONTINUED]" : "");
 
   /* try to figure out the request characteristics as soon as possible, but
      only once! */
@@ -391,19 +359,16 @@ static int ProcessRequest(struct httprequest *req)
   }
 
   else if(req->testno == DOCNUMBER_NOTHING) {
-    char *http;
+    const char *http;
     bool fine = FALSE;
-    char *httppath = NULL;
+    const char *httppath = NULL;
     size_t npath = 0; /* httppath length */
 
-    if(sscanf(line,
-              "%" REQUEST_KEYWORD_SIZE_TXT"s ", request)) {
+    if(sscanf(line, "%" REQUEST_KEYWORD_SIZE_TXT "s ", request) == 1) {
       http = strstr(line + strlen(request), "HTTP/");
 
-      if(http && sscanf(http, "HTTP/%d.%d",
-                        &prot_major,
-                        &prot_minor) == 2) {
-        /* between the request keyword and HTTP/ there's a path */
+      if(http && sscanf(http, "HTTP/%d.%d", &prot_major, &prot_minor) == 2) {
+        /* between the request keyword and HTTP/ there is a path */
         httppath = line + strlen(request);
         npath = http - httppath;
 
@@ -422,9 +387,9 @@ static int ProcessRequest(struct httprequest *req)
     }
 
     if(fine) {
-      char *ptr;
+      const char *ptr;
 
-      req->prot_version = prot_major*10 + prot_minor;
+      req->prot_version = (prot_major * 10) + prot_minor;
 
       /* find the last slash */
       ptr = &httppath[npath];
@@ -437,12 +402,10 @@ static int ProcessRequest(struct httprequest *req)
       /* get the number after it */
       if(*ptr == '/') {
         if((npath + strlen(request)) < 400)
-          msnprintf(logbuf, sizeof(logbuf), "Got request: %s %.*s HTTP/%d.%d",
-                    request, npath, httppath, prot_major, prot_minor);
+          logmsg("Got request: %s %.*s HTTP/%d.%d",
+                 request, (int)npath, httppath, prot_major, prot_minor);
         else
-          msnprintf(logbuf, sizeof(logbuf), "Got a *HUGE* request HTTP/%d.%d",
-                    prot_major, prot_minor);
-        logmsg("%s", logbuf);
+          logmsg("Got a *HUGE* request HTTP/%d.%d", prot_major, prot_minor);
 
         if(!strncmp("/verifiedserver", ptr, 15)) {
           logmsg("Are-we-friendly question received");
@@ -458,7 +421,9 @@ static int ProcessRequest(struct httprequest *req)
 
         ptr++; /* skip the slash */
 
-        req->testno = strtol(ptr, &ptr, 10);
+        pval = ptr;
+        if(!curlx_str_number(&pval, &num, INT_MAX))
+          req->testno = (long)num;
 
         if(req->testno > 10000) {
           req->partno = req->testno % 10000;
@@ -468,30 +433,24 @@ static int ProcessRequest(struct httprequest *req)
           req->partno = 0;
 
         if(req->testno) {
-
-          msnprintf(logbuf, sizeof(logbuf), "Serve test number %ld part %ld",
-                    req->testno, req->partno);
-          logmsg("%s", logbuf);
+          logmsg("Serve test number %ld part %ld", req->testno, req->partno);
         }
         else {
           logmsg("No test number in path");
           req->testno = DOCNUMBER_NOTHING;
         }
-
       }
 
       if(req->testno == DOCNUMBER_NOTHING) {
-        /* didn't find any in the first scan, try alternative test case
+        /* did not find any in the first scan, try alternative test case
            number placements */
         static char doc[MAXDOCNAMELEN];
         if(sscanf(req->reqbuf, "CONNECT %" MAXDOCNAMELEN_TXT "s HTTP/%d.%d",
                   doc, &prot_major, &prot_minor) == 3) {
-          char *portp = NULL;
+          const char *portp = NULL;
 
-          msnprintf(logbuf, sizeof(logbuf),
-                    "Received a CONNECT %s HTTP/%d.%d request",
-                    doc, prot_major, prot_minor);
-          logmsg("%s", logbuf);
+          logmsg("Received a CONNECT %s HTTP/%d.%d request",
+                 doc, prot_major, prot_minor);
 
           req->connect_request = TRUE;
 
@@ -499,14 +458,13 @@ static int ProcessRequest(struct httprequest *req)
             req->open = FALSE; /* HTTP 1.0 closes connection by default */
 
           if(doc[0] == '[') {
-            char *p = &doc[1];
-            unsigned long part = 0;
+            const char *p = &doc[1];
+            curl_off_t part = 0;
             /* scan through the hexgroups and store the value of the last group
                in the 'part' variable and use as test case number!! */
             while(*p && (ISXDIGIT(*p) || (*p == ':') || (*p == '.'))) {
-              char *endp;
-              part = strtoul(p, &endp, 16);
-              if(ISXDIGIT(*p))
+              const char *endp = p;
+              if(!curlx_str_hex(&endp, &part, 0xffff))
                 p = endp;
               else
                 p++;
@@ -518,18 +476,18 @@ static int ProcessRequest(struct httprequest *req)
             else
               portp = p + 1;
 
-            req->testno = part;
+            req->testno = (long)part;
           }
           else
             portp = strchr(doc, ':');
 
           if(portp && (*(portp + 1) != '\0') && ISDIGIT(*(portp + 1))) {
-            unsigned long ulnum = strtoul(portp + 1, NULL, 10);
-            if(!ulnum || (ulnum > 65535UL))
+            pval = portp + 1;
+            if(curlx_str_number(&pval, &num, 0xffff) ||
+               (num <= 0) || (num > 65535))
               logmsg("Invalid CONNECT port received");
             else
-              req->connect_port = curlx_ultous(ulnum);
-
+              req->connect_port = (unsigned short)num;
           }
           logmsg("Port number: %d, test case number: %ld",
                  req->connect_port, req->testno);
@@ -545,28 +503,33 @@ static int ProcessRequest(struct httprequest *req)
         req->testno = DOCNUMBER_404;
       }
       else
-        parse_servercmd(req);
+        sws_parse_servercmd(req);
     }
     else if((req->offset >= 3)) {
-      unsigned char *l = (unsigned char *)line;
+      const unsigned char *l = (const unsigned char *)line;
       logmsg("** Unusual request. Starts with %02x %02x %02x (%c%c%c)",
              l[0], l[1], l[2], l[0], l[1], l[2]);
     }
   }
 
   if(!end) {
-    /* we don't have a complete request yet! */
+    /* we do not have a complete request yet! */
     logmsg("request not complete yet");
     return 0; /* not complete yet */
   }
-  logmsg("- request found to be complete (%d)", req->testno);
+  logmsg("- request found to be complete (%ld)", req->testno);
 
   if(req->testno == DOCNUMBER_NOTHING) {
     /* check for a Testno: header with the test case number */
-    char *testno = strstr(line, "\nTestno: ");
+    const char *testno = strstr(line, "\nTestno: ");
     if(testno) {
-      req->testno = strtol(&testno[9], NULL, 10);
-      logmsg("Found test number %d in Testno: header!", req->testno);
+      pval = &testno[9];
+      if(!curlx_str_number(&pval, &num, INT_MAX)) {
+        req->testno = (long)num;
+        logmsg("Found test number %ld in Testno: header!", req->testno);
+      }
+      else
+        logmsg("No Testno: number");
     }
     else {
       logmsg("No Testno: header");
@@ -574,12 +537,12 @@ static int ProcessRequest(struct httprequest *req)
   }
 
   /* find and parse <servercmd> for this test */
-  parse_servercmd(req);
+  sws_parse_servercmd(req);
 
   if(use_gopher) {
     /* when using gopher we cannot check the request until the entire
        thing has been received */
-    char *ptr;
+    const char *ptr;
 
     /* find the last slash in the line */
     ptr = strrchr(line, '/');
@@ -591,7 +554,9 @@ static int ProcessRequest(struct httprequest *req)
       while(*ptr && !ISDIGIT(*ptr))
         ptr++;
 
-      req->testno = strtol(ptr, &ptr, 10);
+      pval = ptr;
+      if(!curlx_str_number(&pval, &num, INT_MAX))
+        req->testno = (long)num;
 
       if(req->testno > 10000) {
         req->partno = req->testno % 10000;
@@ -600,17 +565,15 @@ static int ProcessRequest(struct httprequest *req)
       else
         req->partno = 0;
 
-      msnprintf(logbuf, sizeof(logbuf),
-                "Requested GOPHER test number %ld part %ld",
-                req->testno, req->partno);
-      logmsg("%s", logbuf);
+      logmsg("Requested GOPHER test number %ld part %ld",
+             req->testno, req->partno);
     }
   }
 
   /* **** Persistence ****
    *
    * If the request is an HTTP/1.0 one, we close the connection unconditionally
-   * when we're done.
+   * when we are done.
    *
    * If the request is an HTTP/1.1 one, we MUST check for a "Connection:"
    * header that might say "close". If it does, we close a connection when
@@ -622,42 +585,35 @@ static int ProcessRequest(struct httprequest *req)
     if(got_exit_signal)
       return 1; /* done */
 
-    if((req->cl == 0) && strncasecompare("Content-Length:", line, 15)) {
-      /* If we don't ignore content-length, we read it and we read the whole
-         request including the body before we return. If we've been told to
-         ignore the content-length, we will return as soon as all headers
+    if((req->cl == 0) && !CURL_STRNICMP("Content-Length:", line, 15)) {
+      /* If we do not ignore content-length, we read it and we read the whole
+         request including the body before we return. If we have been told to
+         ignore the content-length, we return as soon as all headers
          have been received */
-      char *endptr;
-      char *ptr = line + 15;
-      unsigned long clen = 0;
-      while(*ptr && ISSPACE(*ptr))
-        ptr++;
-      endptr = ptr;
-      errno = 0;
-      clen = strtoul(ptr, &endptr, 10);
-      if((ptr == endptr) || !ISSPACE(*endptr) || (ERANGE == errno)) {
+      curl_off_t clen;
+      const char *p = line + strlen("Content-Length:");
+      if(curlx_str_numblanks(&p, &clen)) {
         /* this assumes that a zero Content-Length is valid */
-        logmsg("Found invalid Content-Length: (%s) in the request", ptr);
+        logmsg("Found invalid '%s' in the request", line);
         req->open = FALSE; /* closes connection */
         return 1; /* done */
       }
       if(req->skipall)
         req->cl = 0;
       else
-        req->cl = clen - req->skip;
+        req->cl = (size_t)clen - req->skip;
 
-      logmsg("Found Content-Length: %lu in the request", clen);
+      logmsg("Found Content-Length: %zu in the request", (size_t)clen);
       if(req->skip)
-        logmsg("... but will abort after %zu bytes", req->cl);
+        logmsg("... but going to abort after %zu bytes", req->cl);
     }
-    else if(strncasecompare("Transfer-Encoding: chunked", line,
-                            strlen("Transfer-Encoding: chunked"))) {
+    else if(!CURL_STRNICMP("Transfer-Encoding: chunked", line,
+                           strlen("Transfer-Encoding: chunked"))) {
       /* chunked data coming in */
       chunked = TRUE;
     }
-    else if(req->noexpect &&
-            strncasecompare("Expect: 100-continue", line,
-                            strlen("Expect: 100-continue"))) {
+    else if(req->noexpect && !CURL_STRNICMP("Expect: 100-continue", line,
+                                            strlen("Expect: 100-continue"))) {
       if(req->cl)
         req->cl = 0;
       req->skipall = TRUE;
@@ -670,7 +626,7 @@ static int ProcessRequest(struct httprequest *req)
         return 1; /* done */
       }
       else if(strstr(req->reqbuf, "\r\n0\r\n")) {
-        char *last_crlf_char = strstr(req->reqbuf, "\r\n\r\n");
+        const char *last_crlf_char = strstr(req->reqbuf, "\r\n\r\n");
         while(TRUE) {
           if(!strstr(last_crlf_char + 4, "\r\n\r\n"))
             break;
@@ -704,8 +660,8 @@ static int ProcessRequest(struct httprequest *req)
     /* Negotiate iterations */
     static long prev_testno = -1;
     static long prev_partno = -1;
-    logmsg("Negotiate: prev_testno: %d, prev_partno: %d",
-            prev_testno, prev_partno);
+    logmsg("Negotiate: prev_testno: %ld, prev_partno: %ld",
+           prev_testno, prev_partno);
     if(req->testno != prev_testno) {
       prev_testno = req->testno;
       prev_partno = req->partno;
@@ -786,64 +742,283 @@ static int ProcessRequest(struct httprequest *req)
   return 1; /* done */
 }
 
-/* store the entire request in a file */
-static void storerequest(const char *reqbuf, size_t totalsize)
+/* returns -1 on failure */
+static int sws_send_doc(curl_socket_t sock, struct sws_httprequest *req)
 {
-  int res;
-  int error = 0;
-  size_t written;
-  size_t writeleft;
+  ssize_t written;
+  size_t count;
+  const char *buffer;
+  char *ptr = NULL;
+  FILE *stream;
+  char *cmd = NULL;
+  size_t cmdsize = 0;
   FILE *dump;
-  char dumpfile[256];
+  bool persistent = TRUE;
+  bool sendfailure = FALSE;
+  size_t responsesize;
+  int error = 0;
+  char errbuf[STRERROR_LEN];
+  static char weare[256];
+  char responsedump[256];
 
-  msnprintf(dumpfile, sizeof(dumpfile), "%s/%s",
-            logdir, is_proxy?REQUEST_PROXY_DUMP:REQUEST_DUMP);
+  snprintf(responsedump, sizeof(responsedump), "%s/%s",
+           logdir, is_proxy ? RESPONSE_PROXY_DUMP : RESPONSE_DUMP);
 
-  if(!reqbuf)
-    return;
-  if(totalsize == 0)
-    return;
+  switch(req->rcmd) {
+  default:
+  case RCMD_NORMALREQ:
+    break; /* continue with business as usual */
+  case RCMD_STREAM: {
+    static const char streamthis[] = "a string to stream 01234567890\n";
+    for(;;) {
+      written = swrite(sock, streamthis, sizeof(streamthis) - 1);
+      if(got_exit_signal)
+        return -1;
+      if(written != (ssize_t)(sizeof(streamthis) - 1)) {
+        logmsg("Stopped streaming");
+        break;
+      }
+    }
+    return -1;
+  }
+  case RCMD_IDLE:
+    /* Do nothing. Sit idle. Pretend it rains. */
+    return 0;
+  }
 
-  do {
-    dump = fopen(dumpfile, "ab");
-  } while(!dump && ((error = errno) == EINTR));
+  req->open = FALSE;
+
+  if(req->testno < 0) {
+    size_t msglen;
+    char msgbuf[64];
+
+    switch(req->testno) {
+    case DOCNUMBER_QUIT:
+      logmsg("Replying to QUIT");
+      buffer = docquit_sws;
+      break;
+    case DOCNUMBER_WERULEZ:
+      /* we got a "friends?" question, reply back that we sure are */
+      logmsg("Identifying ourselves as friends");
+      snprintf(msgbuf, sizeof(msgbuf), "WE ROOLZ: %ld\r\n",
+               (long)our_getpid());
+      msglen = strlen(msgbuf);
+      if(use_gopher)
+        snprintf(weare, sizeof(weare), "%s", msgbuf);
+      else
+        snprintf(weare, sizeof(weare),
+                 "HTTP/1.1 200 OK\r\nContent-Length: %u\r\n\r\n%s",
+                 (unsigned int)msglen, msgbuf);
+      buffer = weare;
+      break;
+    case DOCNUMBER_404:
+    default:
+      logmsg("Replying to with a 404");
+      buffer = doc404;
+      break;
+    }
+
+    count = strlen(buffer);
+  }
+  else {
+    char partbuf[80];
+
+    /* select the <data> tag for "normal" requests and the <connect> one
+       for CONNECT requests (within the <reply> section) */
+    const char *section = req->connect_request ? "connect" : "data";
+
+    if(req->partno)
+      snprintf(partbuf, sizeof(partbuf), "%s%ld", section, req->partno);
+    else
+      snprintf(partbuf, sizeof(partbuf), "%s", section);
+
+    logmsg("Send response test%ld section <%s>", req->testno, partbuf);
+
+    stream = test2fopen(req->testno, logdir);
+    if(!stream) {
+      error = errno;
+      logmsg("fopen() failed with error (%d) %s",
+             error, curlx_strerror(error, errbuf, sizeof(errbuf)));
+      return 0;
+    }
+    else {
+      error = getpart(&ptr, &count, "reply", partbuf, stream);
+      curlx_fclose(stream);
+      if(error) {
+        logmsg("getpart() failed with error (%d)", error);
+        return 0;
+      }
+      buffer = ptr;
+    }
+
+    if(got_exit_signal) {
+      free(ptr);
+      return -1;
+    }
+
+    /* re-open the same file again */
+    stream = test2fopen(req->testno, logdir);
+    if(!stream) {
+      error = errno;
+      logmsg("fopen() failed with error (%d) %s",
+             error, curlx_strerror(error, errbuf, sizeof(errbuf)));
+      free(ptr);
+      return 0;
+    }
+    else {
+      /* get the custom server control "commands" */
+      error = getpart(&cmd, &cmdsize, "reply", "postcmd", stream);
+      curlx_fclose(stream);
+      if(error) {
+        logmsg("getpart() failed with error (%d)", error);
+        free(ptr);
+        return 0;
+      }
+    }
+  }
+
+  if(got_exit_signal) {
+    free(ptr);
+    free(cmd);
+    return -1;
+  }
+
+  /* If the word 'swsclose' is present anywhere in the reply chunk, the
+     connection is closed after the data has been sent to the requesting
+     client... */
+  if(strstr(buffer, "swsclose") || !count || req->close) {
+    persistent = FALSE;
+    logmsg("connection close instruction \"swsclose\" found in response");
+  }
+  if(strstr(buffer, "swsbounce")) {
+    sws_prevbounce = TRUE;
+    logmsg("enable \"swsbounce\" in the next request");
+  }
+  else
+    sws_prevbounce = FALSE;
+
+  dump = curlx_fopen(responsedump, "ab");
   if(!dump) {
-    logmsg("[2] Error opening file %s error: %d %s",
-           dumpfile, error, strerror(error));
-    logmsg("Failed to write request input ");
-    return;
+    error = errno;
+    logmsg("fopen() failed with error (%d) %s",
+           error, curlx_strerror(error, errbuf, sizeof(errbuf)));
+    logmsg("  [5] Error opening file '%s'", responsedump);
+    free(ptr);
+    free(cmd);
+    return -1;
   }
 
-  writeleft = totalsize;
+  responsesize = count;
   do {
-    written = fwrite(&reqbuf[totalsize-writeleft],
-                     1, writeleft, dump);
-    if(got_exit_signal)
-      goto storerequest_cleanup;
-    if(written > 0)
-      writeleft -= written;
-  } while((writeleft > 0) && ((error = errno) == EINTR));
+    /* Ok, we send no more than N bytes at a time, to make sure that
+       larger chunks are split up so that the client needs to do multiple
+       recv() calls to get it and thus we exercise that code better */
+    size_t num = count;
+    if(num > 20)
+      num = 20;
 
-  if(writeleft == 0)
-    logmsg("Wrote request (%zu bytes) input to %s", totalsize, dumpfile);
-  else if(writeleft > 0) {
-    logmsg("Error writing file %s error: %d %s",
-           dumpfile, error, strerror(error));
-    logmsg("Wrote only (%zu bytes) of (%zu bytes) request input to %s",
-           totalsize-writeleft, totalsize, dumpfile);
+retry:
+    written = swrite(sock, buffer, num);
+    if(written < 0) {
+      if(SOCK_EAGAIN(SOCKERRNO)) {
+        curlx_wait_ms(10);
+        goto retry;
+      }
+      sendfailure = TRUE;
+      break;
+    }
+
+    /* write to file as well */
+    fwrite(buffer, 1, (size_t)written, dump);
+
+    count -= written;
+    buffer += written;
+
+    if(req->writedelay) {
+      int msecs_left = req->writedelay;
+      int intervals = msecs_left / MAX_SLEEP_TIME_MS;
+      if(msecs_left % MAX_SLEEP_TIME_MS)
+        intervals++;
+      logmsg("Pausing %d milliseconds after writing %zd bytes",
+             msecs_left, written);
+      while((intervals > 0) && !got_exit_signal) {
+        int sleep_time = msecs_left > MAX_SLEEP_TIME_MS ?
+          MAX_SLEEP_TIME_MS : msecs_left;
+        intervals--;
+        curlx_wait_ms(sleep_time);
+        msecs_left -= sleep_time;
+      }
+    }
+  } while((count > 0) && !got_exit_signal);
+
+  if(curlx_fclose(dump))
+    logmsg("Error closing file %s error (%d) %s", responsedump,
+           errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
+
+  if(got_exit_signal) {
+    free(ptr);
+    free(cmd);
+    return -1;
   }
 
-storerequest_cleanup:
+  if(sendfailure) {
+    logmsg("Sending response failed. Only (%zu bytes) of (%zu bytes) "
+           "were sent",
+           responsesize - count, responsesize);
+    sws_prevtestno = req->testno;
+    sws_prevpartno = req->partno;
+    free(ptr);
+    free(cmd);
+    return -1;
+  }
 
-  do {
-    res = fclose(dump);
-  } while(res && ((error = errno) == EINTR));
-  if(res)
-    logmsg("Error closing file %s error: %d %s",
-           dumpfile, error, strerror(error));
+  logmsg("Response sent (%zu bytes) and written to %s",
+         responsesize, responsedump);
+  free(ptr);
+
+  if(cmdsize > 0) {
+    char command[32];
+    int quarters;
+    int num;
+    ptr = cmd;
+    do {
+      if(sscanf(ptr, "%31s %d", command, &num) == 2) {
+        if(!strcmp("wait", command)) {
+          logmsg("Told to sleep for %d seconds", num);
+          quarters = num * 4;
+          while((quarters > 0) && !got_exit_signal) {
+            quarters--;
+            if(curlx_wait_ms(250)) {
+              /* should not happen */
+              int sockerr = SOCKERRNO;
+              logmsg("curlx_wait_ms() failed with error (%d) %s",
+                     sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+              break;
+            }
+          }
+          if(!quarters)
+            logmsg("Continuing after sleeping %d seconds", num);
+        }
+        else
+          logmsg("Unknown command in reply command section");
+      }
+      ptr = strchr(ptr, '\n');
+      if(ptr)
+        ptr++;
+      else
+        ptr = NULL;
+    } while(ptr && *ptr);
+  }
+  free(cmd);
+  req->open = use_gopher ? FALSE : persistent;
+
+  sws_prevtestno = req->testno;
+  sws_prevpartno = req->partno;
+
+  return 0;
 }
 
-static void init_httprequest(struct httprequest *req)
+static void init_httprequest(struct sws_httprequest *req)
 {
   req->checkindex = 0;
   req->offset = 0;
@@ -870,11 +1045,9 @@ static void init_httprequest(struct httprequest *req)
   req->upgrade_request = 0;
 }
 
-static int send_doc(curl_socket_t sock, struct httprequest *req);
-
 /* returns 1 if the connection should be serviced again immediately, 0 if there
    is no data waiting, or < 0 if it should be closed */
-static int get_request(curl_socket_t sock, struct httprequest *req)
+static int sws_get_request(curl_socket_t sock, struct sws_httprequest *req)
 {
   int fail = 0;
   char *reqbuf = req->reqbuf;
@@ -884,28 +1057,30 @@ static int get_request(curl_socket_t sock, struct httprequest *req)
   if(req->upgrade_request) {
     /* upgraded connection, work it differently until end of connection */
     logmsg("Upgraded connection, this is no longer HTTP/1");
-    send_doc(sock, req);
+    sws_send_doc(sock, req);
 
     /* dump the request received so far to the external file */
     reqbuf[req->offset] = '\0';
-    storerequest(reqbuf, req->offset);
+    storerequest(reqbuf, req->offset, REQUEST_DUMP_FILENAME);
     req->offset = 0;
 
     /* read websocket traffic */
     if(req->open) {
       logmsg("wait for websocket traffic");
       do {
-        got = sread(sock, reqbuf + req->offset, REQBUFSIZ - req->offset);
+        got = sread(sock, reqbuf + req->offset,
+                    sizeof(req->reqbuf) - 1 - req->offset);
         if(got > 0) {
           req->offset += got;
-          logmsg("Got %zu bytes from client", got);
+          logmsg("Got %zd bytes from client", got);
         }
 
-        if((got == -1) && ((EAGAIN == errno) || (EWOULDBLOCK == errno))) {
+        if((got == -1) && SOCK_EAGAIN(SOCKERRNO)) {
           int rc;
           fd_set input;
           fd_set output;
-          struct timeval timeout = {1, 0}; /* 1000 ms */
+          struct timeval timeout = { 0 };
+          timeout.tv_sec = 1; /* 1000 ms */
 
           logmsg("Got EAGAIN from sread");
           FD_ZERO(&input);
@@ -915,7 +1090,7 @@ static int get_request(curl_socket_t sock, struct httprequest *req)
           do {
             logmsg("Wait until readable");
             rc = select((int)sock + 1, &input, &output, NULL, &timeout);
-          } while(rc < 0 && errno == EINTR && !got_exit_signal);
+          } while(rc < 0 && SOCKERRNO == SOCKEINTR && !got_exit_signal);
           logmsg("readable %d", rc);
           if(rc)
             got = 1;
@@ -929,7 +1104,7 @@ static int get_request(curl_socket_t sock, struct httprequest *req)
       logmsg("log the websocket traffic");
       /* dump the incoming websocket traffic to the external file */
       reqbuf[req->offset] = '\0';
-      storerequest(reqbuf, req->offset);
+      storerequest(reqbuf, req->offset, REQUEST_DUMP_FILENAME);
       req->offset = 0;
     }
     init_httprequest(req);
@@ -937,18 +1112,19 @@ static int get_request(curl_socket_t sock, struct httprequest *req)
     return -1;
   }
 
-  if(req->offset >= REQBUFSIZ-1) {
+  if(req->offset >= sizeof(req->reqbuf) - 1) {
     /* buffer is already full; do nothing */
     overflow = 1;
   }
   else {
     if(req->skip)
       /* we are instructed to not read the entire thing, so we make sure to
-         only read what we're supposed to and NOT read the entire thing the
+         only read what we are supposed to and NOT read the entire thing the
          client wants to send! */
       got = sread(sock, reqbuf + req->offset, req->cl);
     else
-      got = sread(sock, reqbuf + req->offset, REQBUFSIZ-1 - req->offset);
+      got = sread(sock, reqbuf + req->offset,
+                  sizeof(req->reqbuf) - 1 - req->offset);
 
     if(got_exit_signal)
       return -1;
@@ -957,18 +1133,20 @@ static int get_request(curl_socket_t sock, struct httprequest *req)
       fail = 1;
     }
     else if(got < 0) {
-      int error = SOCKERRNO;
-      if(EAGAIN == error || EWOULDBLOCK == error) {
+      char errbuf[STRERROR_LEN];
+      int sockerr = SOCKERRNO;
+      if(SOCK_EAGAIN(sockerr)) {
         /* nothing to read at the moment */
         return 0;
       }
-      logmsg("recv() returned error: (%d) %s", error, sstrerror(error));
+      logmsg("recv() returned error (%d) %s",
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
       fail = 1;
     }
     if(fail) {
       /* dump the request received so far to the external file */
       reqbuf[req->offset] = '\0';
-      storerequest(reqbuf, req->offset);
+      storerequest(reqbuf, req->offset, REQUEST_DUMP_FILENAME);
       return -1;
     }
 
@@ -977,21 +1155,21 @@ static int get_request(curl_socket_t sock, struct httprequest *req)
     req->offset += (size_t)got;
     reqbuf[req->offset] = '\0';
 
-    req->done_processing = ProcessRequest(req);
+    req->done_processing = sws_ProcessRequest(req);
     if(got_exit_signal)
       return -1;
   }
 
-  if(overflow || (req->offset == REQBUFSIZ-1 && got > 0)) {
+  if(overflow || (req->offset == sizeof(req->reqbuf) - 1 && got > 0)) {
     logmsg("Request would overflow buffer, closing connection");
     /* dump request received so far to external file anyway */
-    reqbuf[REQBUFSIZ-1] = '\0';
+    reqbuf[sizeof(req->reqbuf) - 1] = '\0';
     fail = 1;
   }
-  else if(req->offset > REQBUFSIZ-1) {
+  else if(req->offset > sizeof(req->reqbuf) - 1) {
     logmsg("Request buffer overflow, closing connection");
     /* dump request received so far to external file anyway */
-    reqbuf[REQBUFSIZ-1] = '\0';
+    reqbuf[sizeof(req->reqbuf) - 1] = '\0';
     fail = 1;
   }
   else
@@ -999,300 +1177,24 @@ static int get_request(curl_socket_t sock, struct httprequest *req)
 
   /* at the end of a request dump it to an external file */
   if(fail || req->done_processing)
-    storerequest(reqbuf, req->offset);
+    storerequest(reqbuf, req->offset, REQUEST_DUMP_FILENAME);
   if(got_exit_signal)
     return -1;
 
   return fail ? -1 : 1;
 }
 
-/* returns -1 on failure */
-static int send_doc(curl_socket_t sock, struct httprequest *req)
-{
-  ssize_t written;
-  size_t count;
-  const char *buffer;
-  char *ptr = NULL;
-  FILE *stream;
-  char *cmd = NULL;
-  size_t cmdsize = 0;
-  FILE *dump;
-  bool persistent = TRUE;
-  bool sendfailure = FALSE;
-  size_t responsesize;
-  int error = 0;
-  int res;
-  static char weare[256];
-  char responsedump[256];
-
-  msnprintf(responsedump, sizeof(responsedump), "%s/%s",
-            logdir, is_proxy?RESPONSE_PROXY_DUMP:RESPONSE_DUMP);
-
-  switch(req->rcmd) {
-  default:
-  case RCMD_NORMALREQ:
-    break; /* continue with business as usual */
-  case RCMD_STREAM:
-#define STREAMTHIS "a string to stream 01234567890\n"
-    count = strlen(STREAMTHIS);
-    for(;;) {
-      written = swrite(sock, STREAMTHIS, count);
-      if(got_exit_signal)
-        return -1;
-      if(written != (ssize_t)count) {
-        logmsg("Stopped streaming");
-        break;
-      }
-    }
-    return -1;
-  case RCMD_IDLE:
-    /* Do nothing. Sit idle. Pretend it rains. */
-    return 0;
-  }
-
-  req->open = FALSE;
-
-  if(req->testno < 0) {
-    size_t msglen;
-    char msgbuf[64];
-
-    switch(req->testno) {
-    case DOCNUMBER_QUIT:
-      logmsg("Replying to QUIT");
-      buffer = docquit;
-      break;
-    case DOCNUMBER_WERULEZ:
-      /* we got a "friends?" question, reply back that we sure are */
-      logmsg("Identifying ourselves as friends");
-      msnprintf(msgbuf, sizeof(msgbuf), "WE ROOLZ: %"
-                CURL_FORMAT_CURL_OFF_T "\r\n", our_getpid());
-      msglen = strlen(msgbuf);
-      if(use_gopher)
-        msnprintf(weare, sizeof(weare), "%s", msgbuf);
-      else
-        msnprintf(weare, sizeof(weare),
-                  "HTTP/1.1 200 OK\r\nContent-Length: %zu\r\n\r\n%s",
-                  msglen, msgbuf);
-      buffer = weare;
-      break;
-    case DOCNUMBER_404:
-    default:
-      logmsg("Replying to with a 404");
-      buffer = doc404;
-      break;
-    }
-
-    count = strlen(buffer);
-  }
-  else {
-    char partbuf[80];
-
-    /* select the <data> tag for "normal" requests and the <connect> one
-       for CONNECT requests (within the <reply> section) */
-    const char *section = req->connect_request?"connect":"data";
-
-    if(req->partno)
-      msnprintf(partbuf, sizeof(partbuf), "%s%ld", section, req->partno);
-    else
-      msnprintf(partbuf, sizeof(partbuf), "%s", section);
-
-    logmsg("Send response test%ld section <%s>", req->testno, partbuf);
-
-    stream = test2fopen(req->testno, logdir);
-    if(!stream) {
-      error = errno;
-      logmsg("fopen() failed with error: %d %s", error, strerror(error));
-      return 0;
-    }
-    else {
-      error = getpart(&ptr, &count, "reply", partbuf, stream);
-      fclose(stream);
-      if(error) {
-        logmsg("getpart() failed with error: %d", error);
-        return 0;
-      }
-      buffer = ptr;
-    }
-
-    if(got_exit_signal) {
-      free(ptr);
-      return -1;
-    }
-
-    /* re-open the same file again */
-    stream = test2fopen(req->testno, logdir);
-    if(!stream) {
-      error = errno;
-      logmsg("fopen() failed with error: %d %s", error, strerror(error));
-      free(ptr);
-      return 0;
-    }
-    else {
-      /* get the custom server control "commands" */
-      error = getpart(&cmd, &cmdsize, "reply", "postcmd", stream);
-      fclose(stream);
-      if(error) {
-        logmsg("getpart() failed with error: %d", error);
-        free(ptr);
-        return 0;
-      }
-    }
-  }
-
-  if(got_exit_signal) {
-    free(ptr);
-    free(cmd);
-    return -1;
-  }
-
-  /* If the word 'swsclose' is present anywhere in the reply chunk, the
-     connection will be closed after the data has been sent to the requesting
-     client... */
-  if(strstr(buffer, "swsclose") || !count || req->close) {
-    persistent = FALSE;
-    logmsg("connection close instruction \"swsclose\" found in response");
-  }
-  if(strstr(buffer, "swsbounce")) {
-    prevbounce = TRUE;
-    logmsg("enable \"swsbounce\" in the next request");
-  }
-  else
-    prevbounce = FALSE;
-
-  dump = fopen(responsedump, "ab");
-  if(!dump) {
-    error = errno;
-    logmsg("fopen() failed with error: %d %s", error, strerror(error));
-    logmsg("  [5] Error opening file: %s", responsedump);
-    free(ptr);
-    free(cmd);
-    return -1;
-  }
-
-  responsesize = count;
-  do {
-    /* Ok, we send no more than N bytes at a time, just to make sure that
-       larger chunks are split up so that the client will need to do multiple
-       recv() calls to get it and thus we exercise that code better */
-    size_t num = count;
-    if(num > 20)
-      num = 20;
-
-retry:
-    written = swrite(sock, buffer, num);
-    if(written < 0) {
-      if((EWOULDBLOCK == SOCKERRNO) || (EAGAIN == SOCKERRNO)) {
-        wait_ms(10);
-        goto retry;
-      }
-      sendfailure = TRUE;
-      break;
-    }
-
-    /* write to file as well */
-    fwrite(buffer, 1, (size_t)written, dump);
-
-    count -= written;
-    buffer += written;
-
-    if(req->writedelay) {
-      int msecs_left = req->writedelay;
-      int intervals = msecs_left / MAX_SLEEP_TIME_MS;
-      if(msecs_left%MAX_SLEEP_TIME_MS)
-        intervals++;
-      logmsg("Pausing %d milliseconds after writing %d bytes",
-         msecs_left, written);
-      while((intervals > 0) && !got_exit_signal) {
-        int sleep_time = msecs_left > MAX_SLEEP_TIME_MS ?
-          MAX_SLEEP_TIME_MS : msecs_left;
-        intervals--;
-        wait_ms(sleep_time);
-        msecs_left -= sleep_time;
-      }
-    }
-  } while((count > 0) && !got_exit_signal);
-
-  do {
-    res = fclose(dump);
-  } while(res && ((error = errno) == EINTR));
-  if(res)
-    logmsg("Error closing file %s error: %d %s",
-           responsedump, error, strerror(error));
-
-  if(got_exit_signal) {
-    free(ptr);
-    free(cmd);
-    return -1;
-  }
-
-  if(sendfailure) {
-    logmsg("Sending response failed. Only (%zu bytes) of (%zu bytes) "
-           "were sent",
-           responsesize-count, responsesize);
-    prevtestno = req->testno;
-    prevpartno = req->partno;
-    free(ptr);
-    free(cmd);
-    return -1;
-  }
-
-  logmsg("Response sent (%zu bytes) and written to %s",
-         responsesize, responsedump);
-  free(ptr);
-
-  if(cmdsize > 0) {
-    char command[32];
-    int quarters;
-    int num;
-    ptr = cmd;
-    do {
-      if(2 == sscanf(ptr, "%31s %d", command, &num)) {
-        if(!strcmp("wait", command)) {
-          logmsg("Told to sleep for %d seconds", num);
-          quarters = num * 4;
-          while((quarters > 0) && !got_exit_signal) {
-            quarters--;
-            res = wait_ms(250);
-            if(res) {
-              /* should not happen */
-              error = errno;
-              logmsg("wait_ms() failed with error: (%d) %s",
-                     error, strerror(error));
-              break;
-            }
-          }
-          if(!quarters)
-            logmsg("Continuing after sleeping %d seconds", num);
-        }
-        else
-          logmsg("Unknown command in reply command section");
-      }
-      ptr = strchr(ptr, '\n');
-      if(ptr)
-        ptr++;
-      else
-        ptr = NULL;
-    } while(ptr && *ptr);
-  }
-  free(cmd);
-  req->open = use_gopher?FALSE:persistent;
-
-  prevtestno = req->testno;
-  prevpartno = req->partno;
-
-  return 0;
-}
-
 static curl_socket_t connect_to(const char *ipaddr, unsigned short port)
 {
   srvr_sockaddr_union_t serveraddr;
   curl_socket_t serverfd;
-  int error;
+  int sockerr;
+  char errbuf[STRERROR_LEN];
   int rc = 0;
   const char *op_br = "";
   const char *cl_br = "";
 
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
   if(socket_domain == AF_INET6) {
     op_br = "[";
     cl_br = "]";
@@ -1302,34 +1204,43 @@ static curl_socket_t connect_to(const char *ipaddr, unsigned short port)
   if(!ipaddr)
     return CURL_SOCKET_BAD;
 
-  logmsg("about to connect to %s%s%s:%hu",
-         op_br, ipaddr, cl_br, port);
-
+  logmsg("about to connect to %s%s%s:%hu", op_br, ipaddr, cl_br, port);
 
   serverfd = socket(socket_domain, SOCK_STREAM, 0);
-  if(CURL_SOCKET_BAD == serverfd) {
-    error = SOCKERRNO;
-    logmsg("Error creating socket for server connection: (%d) %s",
-           error, sstrerror(error));
+  if(serverfd == CURL_SOCKET_BAD) {
+    sockerr = SOCKERRNO;
+    logmsg("Error creating socket for server connection (%d) %s",
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
     return CURL_SOCKET_BAD;
   }
 
-#ifdef TCP_NODELAY
+#if defined(TCP_NODELAY) && defined(CURL_TCP_NODELAY_SUPPORTED)
   if(socket_domain_is_ip()) {
     /* Disable the Nagle algorithm */
     curl_socklen_t flag = 1;
-    if(0 != setsockopt(serverfd, IPPROTO_TCP, TCP_NODELAY,
-                       (void *)&flag, sizeof(flag)))
+    if(setsockopt(serverfd, IPPROTO_TCP, TCP_NODELAY,
+                  (void *)&flag, sizeof(flag)))
       logmsg("====> TCP_NODELAY for server connection failed");
   }
 #endif
 
+  /* We want to do the connect() in a non-blocking mode, since
+   * Windows has an internal retry logic that may lead to long
+   * timeouts if the peer is not listening. */
+  if(curlx_nonblock(serverfd, TRUE)) {
+    sockerr = SOCKERRNO;
+    logmsg("curlx_nonblock(TRUE) failed with error (%d) %s",
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+    sclose(serverfd);
+    return CURL_SOCKET_BAD;
+  }
+
   switch(socket_domain) {
   case AF_INET:
     memset(&serveraddr.sa4, 0, sizeof(serveraddr.sa4));
     serveraddr.sa4.sin_family = AF_INET;
     serveraddr.sa4.sin_port = htons(port);
-    if(Curl_inet_pton(AF_INET, ipaddr, &serveraddr.sa4.sin_addr) < 1) {
+    if(curlx_inet_pton(AF_INET, ipaddr, &serveraddr.sa4.sin_addr) < 1) {
       logmsg("Error inet_pton failed AF_INET conversion of '%s'", ipaddr);
       sclose(serverfd);
       return CURL_SOCKET_BAD;
@@ -1337,12 +1248,12 @@ static curl_socket_t connect_to(const char *ipaddr, unsigned short port)
 
     rc = connect(serverfd, &serveraddr.sa, sizeof(serveraddr.sa4));
     break;
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
   case AF_INET6:
     memset(&serveraddr.sa6, 0, sizeof(serveraddr.sa6));
     serveraddr.sa6.sin6_family = AF_INET6;
     serveraddr.sa6.sin6_port = htons(port);
-    if(Curl_inet_pton(AF_INET6, ipaddr, &serveraddr.sa6.sin6_addr) < 1) {
+    if(curlx_inet_pton(AF_INET6, ipaddr, &serveraddr.sa6.sin6_addr) < 1) {
       logmsg("Error inet_pton failed AF_INET6 conversion of '%s'", ipaddr);
       sclose(serverfd);
       return CURL_SOCKET_BAD;
@@ -1350,7 +1261,7 @@ static curl_socket_t connect_to(const char *ipaddr, unsigned short port)
 
     rc = connect(serverfd, &serveraddr.sa, sizeof(serveraddr.sa6));
     break;
-#endif /* ENABLE_IPV6 */
+#endif /* USE_IPV6 */
 #ifdef USE_UNIX_SOCKETS
   case AF_UNIX:
     logmsg("Proxying through Unix socket is not (yet?) supported.");
@@ -1364,16 +1275,54 @@ static curl_socket_t connect_to(const char *ipaddr, unsigned short port)
   }
 
   if(rc) {
-    error = SOCKERRNO;
-    logmsg("Error connecting to server port %hu: (%d) %s",
-           port, error, sstrerror(error));
+    sockerr = SOCKERRNO;
+    if((sockerr == SOCKEINPROGRESS) || SOCK_EAGAIN(sockerr)) {
+      fd_set output;
+      struct timeval timeout = { 0 };
+      timeout.tv_sec = 1; /* 1000 ms */
+
+      FD_ZERO(&output);
+      FD_SET(serverfd, &output);
+      while(1) {
+        rc = select((int)serverfd + 1, NULL, &output, NULL, &timeout);
+        sockerr = SOCKERRNO;
+        if(rc < 0 && sockerr != SOCKEINTR)
+          goto error;
+        else if(rc > 0) {
+          curl_socklen_t errSize = sizeof(sockerr);
+          if(getsockopt(serverfd, SOL_SOCKET, SO_ERROR,
+                        (void *)&sockerr, &errSize))
+            sockerr = SOCKERRNO;
+          if((sockerr == 0) || (SOCKEISCONN == sockerr))
+            goto success;
+          else if((sockerr != SOCKEINPROGRESS) && !SOCK_EAGAIN(sockerr))
+            goto error;
+        }
+        else if(!rc) {
+          logmsg("Timeout connecting to server port %hu", port);
+          sclose(serverfd);
+          return CURL_SOCKET_BAD;
+        }
+      }
+    }
+error:
+    logmsg("Error connecting to server port %hu (%d) %s", port,
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
     sclose(serverfd);
     return CURL_SOCKET_BAD;
   }
-
+success:
   logmsg("connected fine to %s%s%s:%hu, now tunnel",
          op_br, ipaddr, cl_br, port);
 
+  if(curlx_nonblock(serverfd, FALSE)) {
+    sockerr = SOCKERRNO;
+    logmsg("curlx_nonblock(FALSE) failed with error (%d) %s",
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+    sclose(serverfd);
+    return CURL_SOCKET_BAD;
+  }
+
   return serverfd;
 }
 
@@ -1385,14 +1334,14 @@ static curl_socket_t connect_to(const char *ipaddr, unsigned short port)
  * either end.
  *
  * When doing FTP through a CONNECT proxy, we expect that the data connection
- * will be setup while the first connect is still being kept up. Therefore we
+ * is setup while the first connect is still being kept up. Therefore we
  * must accept a new connection and deal with it appropriately.
  */
 
-#define data_or_ctrl(x) ((x)?"DATA":"CTRL")
+#define data_or_ctrl(x) ((x) ? "DATA" : "CTRL")
 
-#define CTRL  0
-#define DATA  1
+#define SWS_CTRL 0
+#define SWS_DATA 1
 
 static void http_connect(curl_socket_t *infdp,
                          curl_socket_t rootfd,
@@ -1400,10 +1349,10 @@ static void http_connect(curl_socket_t *infdp,
                          unsigned short ipport,
                          int keepalive_secs)
 {
-  curl_socket_t serverfd[2] = {CURL_SOCKET_BAD, CURL_SOCKET_BAD};
-  curl_socket_t clientfd[2] = {CURL_SOCKET_BAD, CURL_SOCKET_BAD};
-  ssize_t toc[2] = {0, 0}; /* number of bytes to client */
-  ssize_t tos[2] = {0, 0}; /* number of bytes to server */
+  curl_socket_t serverfd[2] = { CURL_SOCKET_BAD, CURL_SOCKET_BAD };
+  curl_socket_t clientfd[2] = { CURL_SOCKET_BAD, CURL_SOCKET_BAD };
+  ssize_t toc[2] = { 0, 0 }; /* number of bytes to client */
+  ssize_t tos[2] = { 0, 0 }; /* number of bytes to server */
   char readclient[2][256];
   char readserver[2][256];
   bool poll_client_rd[2] = { TRUE, TRUE };
@@ -1412,24 +1361,24 @@ static void http_connect(curl_socket_t *infdp,
   bool poll_server_wr[2] = { TRUE, TRUE };
   bool primary = FALSE;
   bool secondary = FALSE;
-  int max_tunnel_idx; /* CTRL or DATA */
+  int max_tunnel_idx; /* SWS_CTRL or SWS_DATA */
   int loop;
   int i;
   int timeout_count = 0;
 
   /* primary tunnel client endpoint already connected */
-  clientfd[CTRL] = *infdp;
+  clientfd[SWS_CTRL] = *infdp;
 
   /* Sleep here to make sure the client reads CONNECT response's
      'end of headers' separate from the server data that follows.
      This is done to prevent triggering libcurl known bug #39. */
   for(loop = 2; (loop > 0) && !got_exit_signal; loop--)
-    wait_ms(250);
+    curlx_wait_ms(250);
   if(got_exit_signal)
     goto http_connect_cleanup;
 
-  serverfd[CTRL] = connect_to(ipaddr, ipport);
-  if(serverfd[CTRL] == CURL_SOCKET_BAD)
+  serverfd[SWS_CTRL] = connect_to(ipaddr, ipport);
+  if(serverfd[SWS_CTRL] == CURL_SOCKET_BAD)
     goto http_connect_cleanup;
 
   /* Primary tunnel socket endpoints are now connected. Tunnel data back and
@@ -1437,24 +1386,25 @@ static void http_connect(curl_socket_t *infdp,
      tunnel, simultaneously allowing establishment, operation and teardown of
      a secondary tunnel that may be used for passive FTP data connection. */
 
-  max_tunnel_idx = CTRL;
+  max_tunnel_idx = SWS_CTRL;
   primary = TRUE;
 
   while(!got_exit_signal) {
 
     fd_set input;
     fd_set output;
-    struct timeval timeout = {1, 0}; /* 1000 ms */
     ssize_t rc;
     curl_socket_t maxfd = (curl_socket_t)-1;
+    struct timeval timeout = { 0 };
+    timeout.tv_sec = 1; /* 1000 ms */
 
     FD_ZERO(&input);
     FD_ZERO(&output);
 
-    if((clientfd[DATA] == CURL_SOCKET_BAD) &&
-       (serverfd[DATA] == CURL_SOCKET_BAD) &&
-       poll_client_rd[CTRL] && poll_client_wr[CTRL] &&
-       poll_server_rd[CTRL] && poll_server_wr[CTRL]) {
+    if((clientfd[SWS_DATA] == CURL_SOCKET_BAD) &&
+       (serverfd[SWS_DATA] == CURL_SOCKET_BAD) &&
+       poll_client_rd[SWS_CTRL] && poll_client_wr[SWS_CTRL] &&
+       poll_server_rd[SWS_CTRL] && poll_server_wr[SWS_CTRL]) {
       /* listener socket is monitored to allow client to establish
          secondary tunnel only when this tunnel is not established
          and primary one is fully operational */
@@ -1502,7 +1452,7 @@ static void http_connect(curl_socket_t *infdp,
 
     do {
       rc = select((int)maxfd + 1, &input, &output, NULL, &timeout);
-    } while(rc < 0 && errno == EINTR && !got_exit_signal);
+    } while(rc < 0 && SOCKERRNO == SOCKEINTR && !got_exit_signal);
 
     if(got_exit_signal)
       break;
@@ -1515,32 +1465,32 @@ static void http_connect(curl_socket_t *infdp,
       /* ---------------------------------------------------------- */
 
       /* passive mode FTP may establish a secondary tunnel */
-      if((clientfd[DATA] == CURL_SOCKET_BAD) &&
-         (serverfd[DATA] == CURL_SOCKET_BAD) && FD_ISSET(rootfd, &input)) {
+      if((clientfd[SWS_DATA] == CURL_SOCKET_BAD) &&
+         (serverfd[SWS_DATA] == CURL_SOCKET_BAD) && FD_ISSET(rootfd, &input)) {
         /* a new connection on listener socket (most likely from client) */
         curl_socket_t datafd = accept(rootfd, NULL, NULL);
         if(datafd != CURL_SOCKET_BAD) {
-          static struct httprequest *req2;
+          static struct sws_httprequest *req2;
           int err = 0;
           if(!req2) {
             req2 = malloc(sizeof(*req2));
             if(!req2)
-              exit(1);
+              goto http_connect_cleanup;  /* fail */
           }
           memset(req2, 0, sizeof(*req2));
           logmsg("====> Client connect DATA");
-#ifdef TCP_NODELAY
+#if defined(TCP_NODELAY) && defined(CURL_TCP_NODELAY_SUPPORTED)
           if(socket_domain_is_ip()) {
             /* Disable the Nagle algorithm */
             curl_socklen_t flag = 1;
-            if(0 != setsockopt(datafd, IPPROTO_TCP, TCP_NODELAY,
-                               (void *)&flag, sizeof(flag)))
+            if(setsockopt(datafd, IPPROTO_TCP, TCP_NODELAY,
+                          (void *)&flag, sizeof(flag)))
               logmsg("====> TCP_NODELAY for client DATA connection failed");
           }
 #endif
           init_httprequest(req2);
           while(!req2->done_processing) {
-            err = get_request(datafd, req2);
+            err = sws_get_request(datafd, req2);
             if(err < 0) {
               /* this socket must be closed, done or not */
               break;
@@ -1549,26 +1499,26 @@ static void http_connect(curl_socket_t *infdp,
 
           /* skip this and close the socket if err < 0 */
           if(err >= 0) {
-            err = send_doc(datafd, req2);
+            err = sws_send_doc(datafd, req2);
             if(!err && req2->connect_request) {
               /* sleep to prevent triggering libcurl known bug #39. */
               for(loop = 2; (loop > 0) && !got_exit_signal; loop--)
-                wait_ms(250);
+                curlx_wait_ms(250);
               if(!got_exit_signal) {
                 /* connect to the server */
-                serverfd[DATA] = connect_to(ipaddr, req2->connect_port);
-                if(serverfd[DATA] != CURL_SOCKET_BAD) {
+                serverfd[SWS_DATA] = connect_to(ipaddr, req2->connect_port);
+                if(serverfd[SWS_DATA] != CURL_SOCKET_BAD) {
                   /* secondary tunnel established, now we have two
                      connections */
-                  poll_client_rd[DATA] = TRUE;
-                  poll_client_wr[DATA] = TRUE;
-                  poll_server_rd[DATA] = TRUE;
-                  poll_server_wr[DATA] = TRUE;
-                  max_tunnel_idx = DATA;
+                  poll_client_rd[SWS_DATA] = TRUE;
+                  poll_client_wr[SWS_DATA] = TRUE;
+                  poll_server_rd[SWS_DATA] = TRUE;
+                  poll_server_wr[SWS_DATA] = TRUE;
+                  max_tunnel_idx = SWS_DATA;
                   secondary = TRUE;
-                  toc[DATA] = 0;
-                  tos[DATA] = 0;
-                  clientfd[DATA] = datafd;
+                  toc[SWS_DATA] = 0;
+                  tos[SWS_DATA] = 0;
+                  clientfd[SWS_DATA] = datafd;
                   datafd = CURL_SOCKET_BAD;
                 }
               }
@@ -1608,7 +1558,7 @@ static void http_connect(curl_socket_t *infdp,
           }
         }
         if(serverfd[i] != CURL_SOCKET_BAD) {
-          len = sizeof(readserver[i])-toc[i];
+          len = sizeof(readserver[i]) - toc[i];
           if(len && FD_ISSET(serverfd[i], &input)) {
             /* read from server */
             rc = sread(serverfd[i], &readserver[i][toc[i]], len);
@@ -1640,7 +1590,7 @@ static void http_connect(curl_socket_t *infdp,
               logmsg("[%s] SENT \"%s\"", data_or_ctrl(i),
                      data_to_hex(readserver[i], rc));
               if(toc[i] - rc)
-                memmove(&readserver[i][0], &readserver[i][rc], toc[i]-rc);
+                memmove(&readserver[i][0], &readserver[i][rc], toc[i] - rc);
               toc[i] -= rc;
             }
           }
@@ -1660,7 +1610,7 @@ static void http_connect(curl_socket_t *infdp,
               logmsg("[%s] SENT \"%s\"", data_or_ctrl(i),
                      data_to_hex(readclient[i], rc));
               if(tos[i] - rc)
-                memmove(&readclient[i][0], &readclient[i][rc], tos[i]-rc);
+                memmove(&readclient[i][0], &readclient[i][rc], tos[i] - rc);
               tos[i] -= rc;
             }
           }
@@ -1707,7 +1657,7 @@ static void http_connect(curl_socket_t *infdp,
 
       if(tcp_fin_wr)
         /* allow kernel to place FIN bit packet on the wire */
-        wait_ms(250);
+        curlx_wait_ms(250);
 
       /* socket clearing */
       for(i = 0; i <= max_tunnel_idx; i++) {
@@ -1719,7 +1669,7 @@ static void http_connect(curl_socket_t *infdp,
               clientfd[i] = CURL_SOCKET_BAD;
               if(serverfd[i] == CURL_SOCKET_BAD) {
                 logmsg("[%s] ENDING", data_or_ctrl(i));
-                if(i == DATA)
+                if(i == SWS_DATA)
                   secondary = FALSE;
                 else
                   primary = FALSE;
@@ -1733,7 +1683,7 @@ static void http_connect(curl_socket_t *infdp,
               serverfd[i] = CURL_SOCKET_BAD;
               if(clientfd[i] == CURL_SOCKET_BAD) {
                 logmsg("[%s] ENDING", data_or_ctrl(i));
-                if(i == DATA)
+                if(i == SWS_DATA)
                   secondary = FALSE;
                 else
                   primary = FALSE;
@@ -1745,7 +1695,7 @@ static void http_connect(curl_socket_t *infdp,
 
       /* ---------------------------------------------------------- */
 
-      max_tunnel_idx = secondary ? DATA : CTRL;
+      max_tunnel_idx = secondary ? SWS_DATA : SWS_CTRL;
 
       if(!primary)
         /* exit loop upon primary tunnel teardown */
@@ -1763,7 +1713,7 @@ static void http_connect(curl_socket_t *infdp,
 
 http_connect_cleanup:
 
-  for(i = DATA; i >= CTRL; i--) {
+  for(i = SWS_DATA; i >= SWS_CTRL; i--) {
     if(serverfd[i] != CURL_SOCKET_BAD) {
       logmsg("[%s] CLOSING server socket (cleanup)", data_or_ctrl(i));
       shutdown(serverfd[i], SHUT_RDWR);
@@ -1783,20 +1733,20 @@ http_connect_cleanup:
   *infdp = CURL_SOCKET_BAD;
 }
 
-static void http_upgrade(struct httprequest *req)
+static void http_upgrade(struct sws_httprequest *req)
 {
   (void)req;
-  logmsg("Upgraded to ... %u", req->upgrade_request);
+  logmsg("Upgraded to ... %d", (int)req->upgrade_request);
   /* left to implement */
 }
 
-
 /* returns a socket handle, or 0 if there are no more waiting sockets,
    or < 0 if there was an error */
 static curl_socket_t accept_connection(curl_socket_t sock)
 {
   curl_socket_t msgsock = CURL_SOCKET_BAD;
-  int error;
+  int sockerr;
+  char errbuf[STRERROR_LEN];
   int flag = 1;
 
   if(MAX_SOCKETS == num_sockets) {
@@ -1807,44 +1757,50 @@ static curl_socket_t accept_connection(curl_socket_t sock)
   msgsock = accept(sock, NULL, NULL);
 
   if(got_exit_signal) {
-    if(CURL_SOCKET_BAD != msgsock)
+    if(msgsock != CURL_SOCKET_BAD)
       sclose(msgsock);
     return CURL_SOCKET_BAD;
   }
 
-  if(CURL_SOCKET_BAD == msgsock) {
-    error = SOCKERRNO;
-    if(EAGAIN == error || EWOULDBLOCK == error) {
+  if(msgsock == CURL_SOCKET_BAD) {
+    sockerr = SOCKERRNO;
+    if(SOCK_EAGAIN(sockerr)) {
       /* nothing to accept */
       return 0;
     }
-    logmsg("MAJOR ERROR: accept() failed with error: (%d) %s",
-           error, sstrerror(error));
+    logmsg("MAJOR ERROR, accept() failed with error (%d) %s",
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
     return CURL_SOCKET_BAD;
   }
 
-  if(0 != curlx_nonblock(msgsock, TRUE)) {
-    error = SOCKERRNO;
-    logmsg("curlx_nonblock failed with error: (%d) %s",
-           error, sstrerror(error));
+  if(curlx_nonblock(msgsock, TRUE)) {
+    sockerr = SOCKERRNO;
+    logmsg("curlx_nonblock failed with error (%d) %s",
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
     sclose(msgsock);
     return CURL_SOCKET_BAD;
   }
 
-  if(0 != setsockopt(msgsock, SOL_SOCKET, SO_KEEPALIVE,
-                     (void *)&flag, sizeof(flag))) {
-    error = SOCKERRNO;
-    logmsg("setsockopt(SO_KEEPALIVE) failed with error: (%d) %s",
-           error, sstrerror(error));
-    sclose(msgsock);
-    return CURL_SOCKET_BAD;
+#if defined(_WIN32) && defined(USE_UNIX_SOCKETS)
+  if(socket_domain != AF_UNIX) {
+#endif
+    if(setsockopt(msgsock, SOL_SOCKET, SO_KEEPALIVE,
+                  (void *)&flag, sizeof(flag))) {
+      sockerr = SOCKERRNO;
+      logmsg("setsockopt(SO_KEEPALIVE) failed with error (%d) %s",
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+      sclose(msgsock);
+      return CURL_SOCKET_BAD;
+    }
+#if defined(_WIN32) && defined(USE_UNIX_SOCKETS)
   }
+#endif
 
   /*
-  ** As soon as this server accepts a connection from the test harness it
-  ** must set the server logs advisor read lock to indicate that server
-  ** logs should not be read until this lock is removed by this server.
-  */
+   * As soon as this server accepts a connection from the test harness it
+   * must set the server logs advisor read lock to indicate that server
+   * logs should not be read until this lock is removed by this server.
+   */
 
   if(!serverlogslocked)
     set_advisor_read_lock(loglockfile);
@@ -1855,14 +1811,14 @@ static curl_socket_t accept_connection(curl_socket_t sock)
   all_sockets[num_sockets] = msgsock;
   num_sockets += 1;
 
-#ifdef TCP_NODELAY
+#if defined(TCP_NODELAY) && defined(CURL_TCP_NODELAY_SUPPORTED)
   if(socket_domain_is_ip()) {
     /*
      * Disable the Nagle algorithm to make it easier to send out a large
      * response in many small segments to torture the clients more.
      */
-    if(0 != setsockopt(msgsock, IPPROTO_TCP, TCP_NODELAY,
-                       (void *)&flag, sizeof(flag)))
+    if(setsockopt(msgsock, IPPROTO_TCP, TCP_NODELAY,
+                  (void *)&flag, sizeof(flag)))
       logmsg("====> TCP_NODELAY failed");
   }
 #endif
@@ -1872,7 +1828,8 @@ static curl_socket_t accept_connection(curl_socket_t sock)
 
 /* returns 1 if the connection should be serviced again immediately, 0 if there
    is no data waiting, or < 0 if it should be closed */
-static int service_connection(curl_socket_t msgsock, struct httprequest *req,
+static int service_connection(curl_socket_t *msgsock,
+                              struct sws_httprequest *req,
                               curl_socket_t listensock,
                               const char *connecthost,
                               int keepalive_secs)
@@ -1881,28 +1838,27 @@ static int service_connection(curl_socket_t msgsock, struct httprequest *req,
     return -1;
 
   while(!req->done_processing) {
-    int rc = get_request(msgsock, req);
+    int rc = sws_get_request(*msgsock, req);
     if(rc <= 0) {
       /* Nothing further to read now, possibly because the socket was closed */
       return rc;
     }
   }
 
-  if(prevbounce) {
+  if(sws_prevbounce) {
     /* bounce treatment requested */
-    if((req->testno == prevtestno) &&
-       (req->partno == prevpartno)) {
-      req->partno++;
+    if(req->testno == sws_prevtestno) {
+      req->partno = sws_prevpartno + 1;
       logmsg("BOUNCE part number to %ld", req->partno);
     }
     else {
-      prevbounce = FALSE;
-      prevtestno = -1;
-      prevpartno = -1;
+      sws_prevbounce = FALSE;
+      sws_prevtestno = -1;
+      sws_prevpartno = -1;
     }
   }
 
-  send_doc(msgsock, req);
+  sws_send_doc(*msgsock, req);
   if(got_exit_signal)
     return -1;
 
@@ -1918,11 +1874,11 @@ static int service_connection(curl_socket_t msgsock, struct httprequest *req,
   if(req->connect_request) {
     /* a CONNECT request, setup and talk the tunnel */
     if(!is_proxy) {
-      logmsg("received CONNECT but isn't running as proxy!");
+      logmsg("received CONNECT but not running as proxy!");
       return 1;
     }
     else {
-      http_connect(&msgsock, listensock, connecthost, req->connect_port,
+      http_connect(msgsock, listensock, connecthost, req->connect_port,
                    keepalive_secs);
       return -1;
     }
@@ -1947,69 +1903,74 @@ static int service_connection(curl_socket_t msgsock, struct httprequest *req,
   return -1;
 }
 
-int main(int argc, char *argv[])
+static int test_sws(int argc, const char *argv[])
 {
   srvr_sockaddr_union_t me;
   curl_socket_t sock = CURL_SOCKET_BAD;
   int wrotepidfile = 0;
   int wroteportfile = 0;
   int flag;
-  unsigned short port = DEFAULT_PORT;
+  unsigned short port = 8999;
 #ifdef USE_UNIX_SOCKETS
   const char *unix_socket = NULL;
-  bool unlink_socket = false;
+  bool unlink_socket = FALSE;
 #endif
-  const char *pidname = ".http.pid";
-  const char *portname = ".http.port";
-  struct httprequest *req = NULL;
+  struct sws_httprequest *req = NULL;
   int rc = 0;
-  int error;
+  int sockerr;
+  char errbuf[STRERROR_LEN];
   int arg = 1;
   const char *connecthost = "127.0.0.1";
-  const char *socket_type = "IPv4";
   char port_str[11];
   const char *location_str = port_str;
   int keepalive_secs = 5;
   const char *protocol_type = "HTTP";
 
-  /* a default CONNECT port is basically pointless but still ... */
+  /* a default CONNECT port is pointless, but still ... */
   size_t socket_idx;
 
-  while(argc>arg) {
+  pidname = ".http.pid";
+  portname = ".http.port";
+  serverlogfile = "log/sws.log";
+  serverlogslocked = 0;
+
+  while(argc > arg) {
+    const char *opt;
+    curl_off_t num;
     if(!strcmp("--version", argv[arg])) {
       puts("sws IPv4"
-#ifdef ENABLE_IPV6
-             "/IPv6"
+#ifdef USE_IPV6
+           "/IPv6"
 #endif
 #ifdef USE_UNIX_SOCKETS
-             "/unix"
+           "/unix"
 #endif
-          );
+      );
       return 0;
     }
     else if(!strcmp("--pidfile", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         pidname = argv[arg++];
     }
     else if(!strcmp("--portfile", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         portname = argv[arg++];
     }
     else if(!strcmp("--logfile", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         serverlogfile = argv[arg++];
     }
     else if(!strcmp("--logdir", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         logdir = argv[arg++];
     }
     else if(!strcmp("--cmdfile", argv[arg])) {
       arg++;
-      if(argc>arg)
+      if(argc > arg)
         cmdfile = argv[arg++];
     }
     else if(!strcmp("--gopher", argv[arg])) {
@@ -2025,7 +1986,7 @@ int main(int argc, char *argv[])
       arg++;
     }
     else if(!strcmp("--ipv6", argv[arg])) {
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
       socket_type = "IPv6";
       socket_domain = AF_INET6;
       location_str = port_str;
@@ -2034,13 +1995,13 @@ int main(int argc, char *argv[])
     }
     else if(!strcmp("--unix-socket", argv[arg])) {
       arg++;
-      if(argc>arg) {
+      if(argc > arg) {
 #ifdef USE_UNIX_SOCKETS
         unix_socket = argv[arg];
         if(strlen(unix_socket) >= sizeof(me.sau.sun_path)) {
           fprintf(stderr,
-                  "sws: socket path must be shorter than %zu chars: %s\n",
-                  sizeof(me.sau.sun_path), unix_socket);
+                  "sws: socket path must be shorter than %u chars: %s\n",
+                  (unsigned int)sizeof(me.sau.sun_path), unix_socket);
           return 0;
         }
         socket_type = "unix";
@@ -2052,47 +2013,42 @@ int main(int argc, char *argv[])
     }
     else if(!strcmp("--port", argv[arg])) {
       arg++;
-      if(argc>arg) {
-        char *endptr;
-        unsigned long ulnum = strtoul(argv[arg], &endptr, 10);
-        if((endptr != argv[arg] + strlen(argv[arg])) ||
-           (ulnum && ((ulnum < 1025UL) || (ulnum > 65535UL)))) {
-          fprintf(stderr, "sws: invalid --port argument (%s)\n",
-                  argv[arg]);
+      if(argc > arg) {
+        opt = argv[arg];
+        if(curlx_str_number(&opt, &num, 0xffff)) {
+          fprintf(stderr, "sws: invalid --port argument (%s)\n", argv[arg]);
           return 0;
         }
-        port = curlx_ultous(ulnum);
+        port = (unsigned short)num;
         arg++;
       }
     }
     else if(!strcmp("--srcdir", argv[arg])) {
       arg++;
-      if(argc>arg) {
-        path = argv[arg];
+      if(argc > arg) {
+        srcpath = argv[arg];
         arg++;
       }
     }
     else if(!strcmp("--keepalive", argv[arg])) {
       arg++;
-      if(argc>arg) {
-        char *endptr;
-        unsigned long ulnum = strtoul(argv[arg], &endptr, 10);
-        if((endptr != argv[arg] + strlen(argv[arg])) ||
-           (ulnum && (ulnum > 65535UL))) {
+      if(argc > arg) {
+        opt = argv[arg];
+        if(curlx_str_number(&opt, &num, 0xffff)) {
           fprintf(stderr, "sws: invalid --keepalive argument (%s), must "
                   "be number of seconds\n", argv[arg]);
           return 0;
         }
-        keepalive_secs = curlx_ultous(ulnum);
+        keepalive_secs = (unsigned short)num;
         arg++;
       }
     }
     else if(!strcmp("--connect", argv[arg])) {
-      /* The connect host IP number that the proxy will connect to no matter
+      /* The connect host IP number that the proxy connects to no matter
          what the client asks for, but also use this as a hint that we run as
          a proxy and do a few different internal choices */
       arg++;
-      if(argc>arg) {
+      if(argc > arg) {
         connecthost = argv[arg];
         arg++;
         is_proxy = TRUE;
@@ -2117,16 +2073,11 @@ int main(int argc, char *argv[])
     }
   }
 
-  msnprintf(loglockfile, sizeof(loglockfile), "%s/%s/sws-%s%s-%s.lock",
-            logdir, SERVERLOGS_LOCKDIR, protocol_type,
-            is_proxy ? "-proxy" : "", socket_type);
+  snprintf(loglockfile, sizeof(loglockfile), "%s/%s/sws-%s%s-%s.lock",
+           logdir, SERVERLOGS_LOCKDIR, protocol_type,
+           is_proxy ? "-proxy" : "", socket_type);
 
-#ifdef WIN32
-  win32_init();
-  atexit(win32_cleanup);
-#endif
-
-  install_signal_handlers(false);
+  install_signal_handlers(FALSE);
 
   req = calloc(1, sizeof(*req));
   if(!req)
@@ -2137,24 +2088,31 @@ int main(int argc, char *argv[])
   all_sockets[0] = sock;
   num_sockets = 1;
 
-  if(CURL_SOCKET_BAD == sock) {
-    error = SOCKERRNO;
-    logmsg("Error creating socket: (%d) %s", error, sstrerror(error));
+  if(sock == CURL_SOCKET_BAD) {
+    sockerr = SOCKERRNO;
+    logmsg("Error creating socket (%d) %s",
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
     goto sws_cleanup;
   }
 
-  flag = 1;
-  if(0 != setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
-                     (void *)&flag, sizeof(flag))) {
-    error = SOCKERRNO;
-    logmsg("setsockopt(SO_REUSEADDR) failed with error: (%d) %s",
-           error, sstrerror(error));
-    goto sws_cleanup;
+#if defined(_WIN32) && defined(USE_UNIX_SOCKETS)
+  if(socket_domain != AF_UNIX) {
+#endif
+    flag = 1;
+    if(setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
+                  (void *)&flag, sizeof(flag))) {
+      sockerr = SOCKERRNO;
+      logmsg("setsockopt(SO_REUSEADDR) failed with error (%d) %s",
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+      goto sws_cleanup;
+    }
+#if defined(_WIN32) && defined(USE_UNIX_SOCKETS)
   }
-  if(0 != curlx_nonblock(sock, TRUE)) {
-    error = SOCKERRNO;
-    logmsg("curlx_nonblock failed with error: (%d) %s",
-           error, sstrerror(error));
+#endif
+  if(curlx_nonblock(sock, TRUE)) {
+    sockerr = SOCKERRNO;
+    logmsg("curlx_nonblock failed with error (%d) %s",
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
     goto sws_cleanup;
   }
 
@@ -2166,7 +2124,7 @@ int main(int argc, char *argv[])
     me.sa4.sin_port = htons(port);
     rc = bind(sock, &me.sa, sizeof(me.sa4));
     break;
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
   case AF_INET6:
     memset(&me.sa6, 0, sizeof(me.sa6));
     me.sa6.sin6_family = AF_INET6;
@@ -2174,22 +2132,22 @@ int main(int argc, char *argv[])
     me.sa6.sin6_port = htons(port);
     rc = bind(sock, &me.sa, sizeof(me.sa6));
     break;
-#endif /* ENABLE_IPV6 */
+#endif /* USE_IPV6 */
 #ifdef USE_UNIX_SOCKETS
   case AF_UNIX:
     rc = bind_unix_socket(sock, unix_socket, &me.sau);
 #endif /* USE_UNIX_SOCKETS */
   }
-  if(0 != rc) {
-    error = SOCKERRNO;
+  if(rc) {
+    sockerr = SOCKERRNO;
 #ifdef USE_UNIX_SOCKETS
     if(socket_domain == AF_UNIX)
-      logmsg("Error binding socket on path %s: (%d) %s",
-             unix_socket, error, sstrerror(error));
+      logmsg("Error binding socket on path %s (%d) %s", unix_socket,
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
     else
 #endif
-      logmsg("Error binding socket on port %hu: (%d) %s",
-             port, error, sstrerror(error));
+      logmsg("Error binding socket on port %hu (%d) %s", port,
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
     goto sws_cleanup;
   }
 
@@ -2198,19 +2156,19 @@ int main(int argc, char *argv[])
        port we actually got and update the listener port value with it. */
     curl_socklen_t la_size;
     srvr_sockaddr_union_t localaddr;
-#ifdef ENABLE_IPV6
+    memset(&localaddr, 0, sizeof(localaddr));
+#ifdef USE_IPV6
     if(socket_domain != AF_INET6)
 #endif
       la_size = sizeof(localaddr.sa4);
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
     else
       la_size = sizeof(localaddr.sa6);
 #endif
-    memset(&localaddr.sa, 0, (size_t)la_size);
     if(getsockname(sock, &localaddr.sa, &la_size) < 0) {
-      error = SOCKERRNO;
-      logmsg("getsockname() failed with error: (%d) %s",
-             error, sstrerror(error));
+      sockerr = SOCKERRNO;
+      logmsg("getsockname() failed with error (%d) %s",
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
       sclose(sock);
       goto sws_cleanup;
     }
@@ -2218,7 +2176,7 @@ int main(int argc, char *argv[])
     case AF_INET:
       port = ntohs(localaddr.sa4.sin_port);
       break;
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
     case AF_INET6:
       port = ntohs(localaddr.sa6.sin6_port);
       break;
@@ -2239,28 +2197,28 @@ int main(int argc, char *argv[])
 #ifdef USE_UNIX_SOCKETS
   if(socket_domain != AF_UNIX)
 #endif
-    msnprintf(port_str, sizeof(port_str), "port %hu", port);
+    snprintf(port_str, sizeof(port_str), "port %hu", port);
 
   logmsg("Running %s %s version on %s",
          protocol_type, socket_type, location_str);
 
   /* start accepting connections */
-  rc = listen(sock, 5);
-  if(0 != rc) {
-    error = SOCKERRNO;
-    logmsg("listen() failed with error: (%d) %s", error, sstrerror(error));
+  if(listen(sock, 50)) {
+    sockerr = SOCKERRNO;
+    logmsg("listen() failed with error (%d) %s",
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
     goto sws_cleanup;
   }
 
 #ifdef USE_UNIX_SOCKETS
   /* listen succeeds, so let's assume a valid listening Unix socket */
-  unlink_socket = true;
+  unlink_socket = TRUE;
 #endif
 
   /*
-  ** As soon as this server writes its pid file the test harness will
-  ** attempt to connect to this server and initiate its verification.
-  */
+   * As soon as this server writes its pid file the test harness attempts
+   * to connect to this server and initiate its verification.
+   */
 
   wrotepidfile = write_pidfile(pidname);
   if(!wrotepidfile)
@@ -2270,8 +2228,8 @@ int main(int argc, char *argv[])
   if(!wroteportfile)
     goto sws_cleanup;
 
-  /* initialization of httprequest struct is done before get_request(), but
-     the pipelining struct field must be initialized previously to FALSE
+  /* initialization of httprequest struct is done before sws_get_request(),
+     but the pipelining struct field must be initialized previously to FALSE
      every time a new connection arrives. */
 
   init_httprequest(req);
@@ -2279,16 +2237,17 @@ int main(int argc, char *argv[])
   for(;;) {
     fd_set input;
     fd_set output;
-    struct timeval timeout = {0, 250000L}; /* 250 ms */
     curl_socket_t maxfd = (curl_socket_t)-1;
     int active;
+    struct timeval timeout = { 0 };
+    timeout.tv_usec = 250000L; /* 250 ms */
 
     /* Clear out closed sockets */
     for(socket_idx = num_sockets - 1; socket_idx >= 1; --socket_idx) {
-      if(CURL_SOCKET_BAD == all_sockets[socket_idx]) {
-        char *dst = (char *) (all_sockets + socket_idx);
-        char *src = (char *) (all_sockets + socket_idx + 1);
-        char *end = (char *) (all_sockets + num_sockets);
+      if(all_sockets[socket_idx] == CURL_SOCKET_BAD) {
+        char *dst = (char *)(all_sockets + socket_idx);
+        char *src = (char *)(all_sockets + socket_idx + 1);
+        char *end = (char *)(all_sockets + num_sockets);
         memmove(dst, src, end - src);
         num_sockets -= 1;
       }
@@ -2311,16 +2270,18 @@ int main(int argc, char *argv[])
     if(got_exit_signal)
       goto sws_cleanup;
 
+    sockerr = 0;
     do {
       rc = select((int)maxfd + 1, &input, &output, NULL, &timeout);
-    } while(rc < 0 && errno == EINTR && !got_exit_signal);
+    } while(rc < 0 && ((sockerr = SOCKERRNO) == SOCKEINTR &&
+            !got_exit_signal));
 
     if(got_exit_signal)
       goto sws_cleanup;
 
     if(rc < 0) {
-      error = SOCKERRNO;
-      logmsg("select() failed with error: (%d) %s", error, sstrerror(error));
+      logmsg("select() failed with error (%d) %s",
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
       goto sws_cleanup;
     }
 
@@ -2336,11 +2297,12 @@ int main(int argc, char *argv[])
       curl_socket_t msgsock;
       do {
         msgsock = accept_connection(sock);
-        logmsg("accept_connection %d returned %d", sock, msgsock);
-        if(CURL_SOCKET_BAD == msgsock)
+        logmsg("accept_connection %ld returned %ld",
+               (long)sock, (long)msgsock);
+        if(msgsock == CURL_SOCKET_BAD)
           goto sws_cleanup;
         if(req->delay)
-          wait_ms(req->delay);
+          curlx_wait_ms(req->delay);
       } while(msgsock > 0);
       active--;
     }
@@ -2354,7 +2316,7 @@ int main(int argc, char *argv[])
 
         /* Service this connection until it has nothing available */
         do {
-          rc = service_connection(all_sockets[socket_idx], req, sock,
+          rc = service_connection(&all_sockets[socket_idx], req, sock,
                                   connecthost, keepalive_secs);
           if(got_exit_signal)
             goto sws_cleanup;
@@ -2364,15 +2326,16 @@ int main(int argc, char *argv[])
 
             if(req->connmon) {
               const char *keepopen = "[DISCONNECT]\n";
-              storerequest(keepopen, strlen(keepopen));
+              storerequest(keepopen, strlen(keepopen), REQUEST_DUMP_FILENAME);
+              req->connmon = FALSE;
             }
 
             if(!req->open)
               /* When instructed to close connection after server-reply we
-                 wait a very small amount of time before doing so. If this
+                 wait a small amount of time before doing so. If this
                  is not done client might get an ECONNRESET before reading
                  a single byte of server-reply. */
-              wait_ms(50);
+              curlx_wait_ms(50);
 
             if(all_sockets[socket_idx] != CURL_SOCKET_BAD) {
               sclose(all_sockets[socket_idx]);
@@ -2387,20 +2350,20 @@ int main(int argc, char *argv[])
               goto sws_cleanup;
           }
 
-          /* Reset the request, unless we're still in the middle of reading */
+          /* Reset the request, unless we are still in the middle of reading */
           if(rc && !req->upgrade_request)
             /* Note: resetting the HTTP request here can cause problems if:
              * 1) req->skipall is TRUE,
              * 2) the socket is still open, and
              * 3) (stale) data is still available (or about to be available)
              *    on that socket
-             * In that case, this loop will run once more and treat that stale
+             * In that case, this loop runs once more and treat that stale
              * data (in service_connection()) as the first data received on
              * this new HTTP request and report "** Unusual request" (skipall
              * would have otherwise caused that data to be ignored). Normally,
-             * that socket will be closed by the client and there won't be any
-             * stale data to cause this, but stranger things have happened (see
-             * issue #11678).
+             * that socket is closed by the client and there is no stale data
+             * to cause this, but stranger things have happened
+             * (see issue #11678).
              */
             init_httprequest(req);
         } while(rc > 0);
@@ -2415,17 +2378,17 @@ sws_cleanup:
 
   for(socket_idx = 1; socket_idx < num_sockets; ++socket_idx)
     if((all_sockets[socket_idx] != sock) &&
-     (all_sockets[socket_idx] != CURL_SOCKET_BAD))
+       (all_sockets[socket_idx] != CURL_SOCKET_BAD))
       sclose(all_sockets[socket_idx]);
 
   if(sock != CURL_SOCKET_BAD)
     sclose(sock);
 
 #ifdef USE_UNIX_SOCKETS
-  if(unlink_socket && socket_domain == AF_UNIX) {
-    rc = unlink(unix_socket);
-    logmsg("unlink(%s) = %d (%s)", unix_socket, rc, strerror(rc));
-  }
+  if(unlink_socket && socket_domain == AF_UNIX && unix_socket &&
+     unlink(unix_socket))
+    logmsg("unlink(%s): %d (%s)", unix_socket,
+           errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
 #endif
 
   free(req);
@@ -2443,11 +2406,11 @@ sws_cleanup:
     clear_advisor_read_lock(loglockfile);
   }
 
-  restore_signal_handlers(false);
+  restore_signal_handlers(FALSE);
 
   if(got_exit_signal) {
     logmsg("========> %s sws (%s pid: %ld) exits with signal (%d)",
-           socket_type, location_str, (long)getpid(), exit_signal);
+           socket_type, location_str, (long)our_getpid(), exit_signal);
     /*
      * To properly set the return status of the process we
      * must raise the same signal SIGINT or SIGTERM that we
diff --git a/third-party/curl/tests/server/testpart.c b/third-party/curl/tests/server/testpart.c
deleted file mode 100644
index 489b218a0d..0000000000
--- a/third-party/curl/tests/server/testpart.c
+++ /dev/null
@@ -1,51 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "server_setup.h"
-
-#include "getpart.h"
-
-#include "curl_printf.h"
-
-/* include memdebug.h last */
-#include "memdebug.h"
-
-int main(int argc, char **argv)
-{
-  char  *part;
-  size_t partlen;
-
-  if(argc< 3) {
-    printf("./testpart main sub\n");
-  }
-  else {
-    int rc = getpart(&part, &partlen, argv[1], argv[2], stdin);
-    size_t i;
-    if(rc)
-      return rc;
-    for(i = 0; i < partlen; i++)
-      printf("%c", part[i]);
-    free(part);
-  }
-  return 0;
-}
diff --git a/third-party/curl/tests/server/tftp.h b/third-party/curl/tests/server/tftp.h
deleted file mode 100644
index 70e2197219..0000000000
--- a/third-party/curl/tests/server/tftp.h
+++ /dev/null
@@ -1,63 +0,0 @@
-#ifndef HEADER_CURL_SERVER_TFTP_H
-#define HEADER_CURL_SERVER_TFTP_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "server_setup.h"
-
-/* This file is a rewrite/clone of the arpa/tftp.h file for systems without
-   it. */
-
-#define SEGSIZE 512 /* data segment size */
-
-#if defined(__GNUC__) && ((__GNUC__ >= 3) || \
-  ((__GNUC__ == 2) && defined(__GNUC_MINOR__) && (__GNUC_MINOR__ >= 7)))
-#  define PACKED_STRUCT __attribute__((__packed__))
-#else
-#  define PACKED_STRUCT /* NOTHING */
-#endif
-
-/* Using a packed struct as binary in a program is begging for problems, but
-   the tftpd server was written like this so we have this struct here to make
-   things build. */
-
-struct tftphdr {
-  short th_opcode;         /* packet type */
-  unsigned short th_block; /* all sorts of things */
-  char th_data[1];         /* data or error string */
-} PACKED_STRUCT;
-
-#define th_stuff th_block
-#define th_code  th_block
-#define th_msg   th_data
-
-#define EUNDEF    0
-#define ENOTFOUND 1
-#define EACCESS   2
-#define ENOSPACE  3
-#define EBADOP    4
-#define EBADID    5
-#define EEXISTS   6
-#define ENOUSER   7
-
-#endif /* HEADER_CURL_SERVER_TFTP_H */
diff --git a/third-party/curl/tests/server/tftpd.c b/third-party/curl/tests/server/tftpd.c
index 8bcd452d04..f730506649 100644
--- a/third-party/curl/tests/server/tftpd.c
+++ b/third-party/curl/tests/server/tftpd.c
@@ -49,40 +49,19 @@
  *
  * SPDX-License-Identifier: BSD-4-Clause-UC
  */
-
-#include "server_setup.h"
+#include "first.h"
 
 #ifdef HAVE_SYS_IOCTL_H
-#include <sys/ioctl.h>
-#endif
-#ifdef HAVE_SIGNAL_H
-#include <signal.h>
+#include <sys/ioctl.h>  /* for ioctl() */
 #endif
 #ifdef HAVE_FCNTL_H
 #include <fcntl.h>
 #endif
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-#ifdef HAVE_ARPA_TFTP_H
-#include <arpa/tftp.h>
-#else
-#include "tftp.h"
-#endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
 #ifdef HAVE_SYS_FILIO_H
-/* FIONREAD on Solaris 7 */
-#include <sys/filio.h>
+#include <sys/filio.h>  /* FIONREAD on Solaris 7 */
 #endif
 
-#ifdef HAVE_SETJMP_H
-#include <setjmp.h>
-#endif
+#include <setjmp.h>  /* for sigjmp_buf, sigsetjmp() */
 
 #ifdef HAVE_PWD_H
 #include <pwd.h>
@@ -90,34 +69,56 @@
 
 #include <ctype.h>
 
-#define ENABLE_CURLX_PRINTF
-/* make the curlx header define all printf() functions to use the curlx_*
-   versions instead */
-#include "curlx.h" /* from the private lib dir */
-#include "getpart.h"
-#include "util.h"
-#include "server_sockaddr.h"
-
-/* include memdebug.h last */
-#include "memdebug.h"
-
 /*****************************************************************************
-*                      STRUCT DECLARATIONS AND DEFINES                       *
-*****************************************************************************/
+ *  This is a rewrite/clone of the arpa/tftp.h file for systems without it.  *
+ *****************************************************************************/
 
-#ifndef PKTSIZE
+#define SEGSIZE 512 /* data segment size */
 #define PKTSIZE (SEGSIZE + 4)  /* SEGSIZE defined in arpa/tftp.h */
+
+#if defined(__GNUC__) && ((__GNUC__ >= 3) || \
+  ((__GNUC__ == 2) && defined(__GNUC_MINOR__) && (__GNUC_MINOR__ >= 7)))
+#  define PACKED_STRUCT __attribute__((__packed__))
+#else
+#  define PACKED_STRUCT /* NOTHING */
 #endif
 
-struct testcase {
-  char *buffer;   /* holds the file data to send to the client */
-  size_t bufsize; /* size of the data in buffer */
-  char *rptr;     /* read pointer into the buffer */
-  size_t rcount;  /* amount of data left to read of the file */
-  long testno;    /* test case number */
-  int ofile;      /* file descriptor for output file when uploading to us */
+/* Using a packed struct as binary in a program is begging for problems, but
+   the tftpd server was written like this so we have this struct here to make
+   things build. */
 
-  int writedelay; /* number of seconds between each packet */
+struct tftphdr {
+  unsigned short th_opcode; /* packet type */
+  unsigned short th_block;  /* all sorts of things */
+  char th_data[1];          /* data or error string */
+} PACKED_STRUCT;
+
+#define th_stuff th_block
+#define th_code  th_block
+#define th_msg   th_data
+
+#define TFTP_EUNDEF    0
+#define TFTP_ENOTFOUND 1
+#define TFTP_EACCESS   2
+#define TFTP_ENOSPACE  3
+#define TFTP_EBADOP    4
+#define TFTP_EBADID    5
+#define TFTP_EEXISTS   6
+#define TFTP_ENOUSER   7
+
+/*****************************************************************************
+ *                      STRUCT DECLARATIONS AND DEFINES                      *
+ *****************************************************************************/
+
+struct testcase {
+  char *buffer;     /* holds the file data to send to the client */
+  size_t bufsize;   /* size of the data in buffer */
+  const char *rptr; /* read pointer into the buffer */
+  size_t rcount;    /* amount of data left to read of the file */
+  long testno;      /* test case number */
+  int ofile;        /* file descriptor for output file when uploading to us */
+
+  int writedelay;   /* number of seconds between each packet */
 };
 
 struct formats {
@@ -127,7 +128,7 @@ struct formats {
 
 struct errmsg {
   int e_code;
-  const char *e_msg;
+  char e_msg[STRERROR_LEN];
 };
 
 typedef union {
@@ -145,8 +146,8 @@ struct bf {
   tftphdr_storage_t buf;  /* room for data packet */
 };
 
-#define BF_ALLOC -3       /* alloc'd but not yet filled */
-#define BF_FREE  -2       /* free */
+#define BF_ALLOC (-3)       /* allocated but not yet filled */
+#define BF_FREE  (-2)       /* free */
 
 #define opcode_RRQ   1
 #define opcode_WRQ   2
@@ -154,33 +155,24 @@ struct bf {
 #define opcode_ACK   4
 #define opcode_ERROR 5
 
-#define TIMEOUT      5
+#define TIMEOUT 5
 
-#undef MIN
-#define MIN(x,y) ((x)<(y)?(x):(y))
-
-#ifndef DEFAULT_LOGFILE
-#define DEFAULT_LOGFILE "log/tftpd.log"
-#endif
-
-#define REQUEST_DUMP  "server.input"
-
-#define DEFAULT_PORT 8999 /* UDP */
+#define REQUEST_DUMP "server.input"
 
 /*****************************************************************************
-*                              GLOBAL VARIABLES                              *
-*****************************************************************************/
+ *                              GLOBAL VARIABLES                             *
+ *****************************************************************************/
 
 static struct errmsg errmsgs[] = {
-  { EUNDEF,       "Undefined error code" },
-  { ENOTFOUND,    "File not found" },
-  { EACCESS,      "Access violation" },
-  { ENOSPACE,     "Disk full or allocation exceeded" },
-  { EBADOP,       "Illegal TFTP operation" },
-  { EBADID,       "Unknown transfer ID" },
-  { EEXISTS,      "File already exists" },
-  { ENOUSER,      "No such user" },
-  { -1,           0 }
+  { TFTP_EUNDEF,       "Undefined error code" },
+  { TFTP_ENOTFOUND,    "File not found" },
+  { TFTP_EACCESS,      "Access violation" },
+  { TFTP_ENOSPACE,     "Disk full or allocation exceeded" },
+  { TFTP_EBADOP,       "Illegal TFTP operation" },
+  { TFTP_EBADID,       "Unknown transfer ID" },
+  { TFTP_EEXISTS,      "File already exists" },
+  { TFTP_ENOUSER,      "No such user" },
+  { -1,                "" }
 };
 
 static const struct formats formata[] = {
@@ -198,80 +190,27 @@ static int current;     /* index of buffer in use */
 static int newline = 0;    /* fillbuf: in middle of newline expansion */
 static int prevchar = -1;  /* putbuf: previous char (cr check) */
 
-static tftphdr_storage_t buf;
+static tftphdr_storage_t trsbuf;
 static tftphdr_storage_t ackbuf;
 
-static srvr_sockaddr_union_t from;
-static curl_socklen_t fromlen;
-
 static curl_socket_t peer = CURL_SOCKET_BAD;
 
 static unsigned int timeout;
 static unsigned int maxtimeout = 5 * TIMEOUT;
 
-#ifdef ENABLE_IPV6
-static bool use_ipv6 = FALSE;
-#endif
-static const char *ipv_inuse = "IPv4";
-
-const char *serverlogfile = DEFAULT_LOGFILE;
-static const char *logdir = "log";
-static char loglockfile[256];
-static const char *pidname = ".tftpd.pid";
-static const char *portname = NULL; /* none by default */
-static int serverlogslocked = 0;
-static int wrotepidfile = 0;
-static int wroteportfile = 0;
+static int tftpd_wrotepidfile = 0;
+static int tftpd_wroteportfile = 0;
 
 #ifdef HAVE_SIGSETJMP
 static sigjmp_buf timeoutbuf;
 #endif
 
+/*****************************************************************************
+ *                          FUNCTION IMPLEMENTATIONS                         *
+ *****************************************************************************/
+
 #if defined(HAVE_ALARM) && defined(SIGALRM)
 static const unsigned int rexmtval = TIMEOUT;
-#endif
-
-/*****************************************************************************
-*                            FUNCTION PROTOTYPES                             *
-*****************************************************************************/
-
-static struct tftphdr *rw_init(int);
-
-static struct tftphdr *w_init(void);
-
-static struct tftphdr *r_init(void);
-
-static void read_ahead(struct testcase *test, int convert);
-
-static ssize_t write_behind(struct testcase *test, int convert);
-
-static int synchnet(curl_socket_t);
-
-static int do_tftp(struct testcase *test, struct tftphdr *tp, ssize_t size);
-
-static int validate_access(struct testcase *test, const char *fname, int mode);
-
-static void sendtftp(struct testcase *test, const struct formats *pf);
-
-static void recvtftp(struct testcase *test, const struct formats *pf);
-
-static void nak(int error);
-
-#if defined(HAVE_ALARM) && defined(SIGALRM)
-
-static void mysignal(int sig, void (*handler)(int));
-
-static void timer(int signum);
-
-static void justtimeout(int signum);
-
-#endif /* HAVE_ALARM && SIGALRM */
-
-/*****************************************************************************
-*                          FUNCTION IMPLEMENTATIONS                          *
-*****************************************************************************/
-
-#if defined(HAVE_ALARM) && defined(SIGALRM)
 
 /*
  * Like signal(), but with well-defined semantics.
@@ -284,6 +223,9 @@ static void mysignal(int sig, void (*handler)(int))
   sigaction(sig, &sa, NULL);
 }
 
+#ifdef HAVE_SIGSETJMP
+CURL_NORETURN
+#endif
 static void timer(int signum)
 {
   (void)signum;
@@ -292,12 +234,12 @@ static void timer(int signum)
 
   timeout += rexmtval;
   if(timeout >= maxtimeout) {
-    if(wrotepidfile) {
-      wrotepidfile = 0;
+    if(tftpd_wrotepidfile) {
+      tftpd_wrotepidfile = 0;
       unlink(pidname);
     }
-    if(wroteportfile) {
-      wroteportfile = 0;
+    if(tftpd_wroteportfile) {
+      tftpd_wroteportfile = 0;
       unlink(portname);
     }
     if(serverlogslocked) {
@@ -318,6 +260,36 @@ static void justtimeout(int signum)
 
 #endif /* HAVE_ALARM && SIGALRM */
 
+/*
+ * Send a nak packet (error message).  Error code passed in is one of the
+ * standard TFTP codes, or a Unix errno offset by 100.
+ */
+static void nak(int error)
+{
+  struct tftphdr *tp;
+  int length;
+  struct errmsg *pe;
+
+  tp = &trsbuf.hdr;
+  tp->th_opcode = htons(opcode_ERROR);
+  tp->th_code = htons((unsigned short)error);
+  for(pe = errmsgs; pe->e_code >= 0; pe++)
+    if(pe->e_code == error)
+      break;
+  if(pe->e_code < 0) {
+    curlx_strerror(error - 100, pe->e_msg, sizeof(pe->e_msg));
+    tp->th_code = TFTP_EUNDEF;   /* set 'undef' errorcode */
+  }
+  length = (int)strlen(pe->e_msg);
+
+  /* we use memcpy() instead of strcpy() in order to avoid buffer overflow
+   * report from glibc with FORTIFY_SOURCE */
+  memcpy(tp->th_msg, pe->e_msg, length + 1);
+  length += 5;
+  if(swrite(peer, &trsbuf.storage[0], length) != length)
+    logmsg("nak: fail\n");
+}
+
 /*
  * init for either read-ahead or write-behind.
  * zero for write-behind, one for read-head.
@@ -326,7 +298,7 @@ static struct tftphdr *rw_init(int x)
 {
   newline = 0;                    /* init crlf flag */
   prevchar = -1;
-  bfs[0].counter =  BF_ALLOC;     /* pass out the first buffer */
+  bfs[0].counter = BF_ALLOC;      /* pass out the first buffer */
   current = 0;
   bfs[1].counter = BF_FREE;
   nextone = x;                    /* ahead or behind? */
@@ -343,31 +315,12 @@ static struct tftphdr *r_init(void)
   return rw_init(1); /* read-ahead */
 }
 
-/* Have emptied current buffer by sending to net and getting ack.
-   Free it and return next buffer filled with data.
- */
-static int readit(struct testcase *test, struct tftphdr **dpp,
-                  int convert /* if true, convert to ascii */)
-{
-  struct bf *b;
-
-  bfs[current].counter = BF_FREE; /* free old one */
-  current = !current;             /* "incr" current */
-
-  b = &bfs[current];              /* look at new buffer */
-  if(b->counter == BF_FREE)      /* if it's empty */
-    read_ahead(test, convert);    /* fill it */
-
-  *dpp = &b->buf.hdr;             /* set caller's ptr */
-  return b->counter;
-}
-
 /*
- * fill the input buffer, doing ascii conversions if requested
+ * fill the input buffer, doing ASCII conversions if requested
  * conversions are  lf -> cr, lf  and cr -> cr, nul
  */
 static void read_ahead(struct testcase *test,
-                       int convert /* if true, convert to ascii */)
+                       int convert /* if true, convert to ASCII */)
 {
   int i;
   char *p;
@@ -376,7 +329,7 @@ static void read_ahead(struct testcase *test,
   struct tftphdr *dp;
 
   b = &bfs[nextone];              /* look at "next" buffer */
-  if(b->counter != BF_FREE)      /* nop if not free */
+  if(b->counter != BF_FREE)       /* nop if not free */
     return;
   nextone = !nextone;             /* "incr" next buffer ptr */
 
@@ -385,7 +338,7 @@ static void read_ahead(struct testcase *test,
   if(convert == 0) {
     /* The former file reading code did this:
        b->counter = read(fileno(file), dp->th_data, SEGSIZE); */
-    size_t copy_n = MIN(SEGSIZE, test->rcount);
+    size_t copy_n = CURLMIN(SEGSIZE, test->rcount);
     memcpy(dp->th_data, test->rptr, copy_n);
 
     /* decrease amount, advance pointer */
@@ -396,7 +349,7 @@ static void read_ahead(struct testcase *test,
   }
 
   p = dp->th_data;
-  for(i = 0 ; i < SEGSIZE; i++) {
+  for(i = 0; i < SEGSIZE; i++) {
     if(newline) {
       if(prevchar == '\n')
         c = '\n';       /* lf to cr,lf */
@@ -406,7 +359,7 @@ static void read_ahead(struct testcase *test,
     }
     else {
       if(test->rcount) {
-        c = test->rptr[0];
+        c = (unsigned char)test->rptr[0];
         test->rptr++;
         test->rcount--;
       }
@@ -423,19 +376,23 @@ static void read_ahead(struct testcase *test,
   b->counter = (int)(p - dp->th_data);
 }
 
-/* Update count associated with the buffer, get new buffer from the queue.
-   Calls write_behind only if next buffer not available.
+/* Have emptied current buffer by sending to net and getting ack.
+   Free it and return next buffer filled with data.
  */
-static int writeit(struct testcase *test, struct tftphdr * volatile *dpp,
-                   int ct, int convert)
+static int readit(struct testcase *test, struct tftphdr * volatile *dpp,
+                  int convert /* if true, convert to ASCII */)
 {
-  bfs[current].counter = ct;      /* set size of data to write */
-  current = !current;             /* switch to other buffer */
-  if(bfs[current].counter != BF_FREE)     /* if not free */
-    write_behind(test, convert);     /* flush it */
-  bfs[current].counter = BF_ALLOC;        /* mark as alloc'd */
-  *dpp =  &bfs[current].buf.hdr;
-  return ct;                      /* this is a lie of course */
+  struct bf *b;
+
+  bfs[current].counter = BF_FREE; /* free old one */
+  current = !current;             /* "incr" current */
+
+  b = &bfs[current];              /* look at new buffer */
+  if(b->counter == BF_FREE)       /* if empty */
+    read_ahead(test, convert);    /* fill it */
+
+  *dpp = &b->buf.hdr;             /* set caller's ptr */
+  return b->counter;
 }
 
 /*
@@ -455,22 +412,29 @@ static ssize_t write_behind(struct testcase *test, int convert)
   struct tftphdr *dp;
 
   b = &bfs[nextone];
-  if(b->counter < -1)            /* anything to flush? */
-    return 0;                     /* just nop if nothing to do */
+  if(b->counter < -1)             /* anything to flush? */
+    return 0;                     /* nop if nothing to do */
 
   if(!test->ofile) {
     char outfile[256];
-    msnprintf(outfile, sizeof(outfile), "%s/upload.%ld", logdir, test->testno);
-#ifdef WIN32
-    test->ofile = open(outfile, O_CREAT|O_RDWR|O_BINARY, 0777);
+    snprintf(outfile, sizeof(outfile), "%s/upload.%ld", logdir, test->testno);
+    test->ofile = curlx_open(outfile, O_CREAT | O_RDWR | CURL_O_BINARY,
+#ifdef _WIN32
+                             _S_IREAD | _S_IWRITE
 #else
-    test->ofile = open(outfile, O_CREAT|O_RDWR, 0777);
+                             S_IRUSR | S_IWUSR | S_IXUSR |
+                             S_IRGRP | S_IWGRP | S_IXGRP |
+                             S_IROTH | S_IWOTH | S_IXOTH
 #endif
+                       );
     if(test->ofile == -1) {
-      logmsg("Couldn't create and/or open file %s for upload!", outfile);
+      logmsg("Could not create and/or open file %s for upload!", outfile);
       return -1; /* failure! */
     }
   }
+  else if(test->ofile <= 0) {
+    return -1; /* failure! */
+  }
 
   count = b->counter;             /* remember byte count */
   b->counter = BF_FREE;           /* reset flag */
@@ -487,18 +451,17 @@ static ssize_t write_behind(struct testcase *test, int convert)
   p = writebuf;
   ct = count;
   while(ct--) {                   /* loop over the buffer */
-    c = *p++;                     /* pick up a character */
+    c = (unsigned char)*p++;      /* pick up a character */
     if(prevchar == '\r') {        /* if prev char was cr */
-      if(c == '\n')               /* if have cr,lf then just */
-        lseek(test->ofile, -1, SEEK_CUR); /* smash lf on top of the cr */
-      else
-        if(c == '\0')             /* if have cr,nul then */
-          goto skipit;            /* just skip over the putc */
-      /* else just fall through and allow it */
+      if(c == '\n')                            /* if have cr,lf then */
+        curl_lseek(test->ofile, -1, SEEK_CUR); /* smash lf on top of the cr */
+      else if(c == '\0')          /* if have cr,nul then */
+        goto skipit;              /* skip over the putc */
+      /* else fall through and allow it */
     }
     /* formerly
        putc(c, file); */
-    if(1 != write(test->ofile, &c, 1))
+    if(write(test->ofile, &c, 1) != 1)
       break;
 skipit:
     prevchar = c;
@@ -506,11 +469,26 @@ skipit:
   return count;
 }
 
+/* Update count associated with the buffer, get new buffer from the queue.
+   Calls write_behind only if next buffer not available.
+ */
+static int writeit(struct testcase *test, struct tftphdr * volatile *dpp,
+                   int ct, int convert)
+{
+  bfs[current].counter = ct;      /* set size of data to write */
+  current = !current;             /* switch to other buffer */
+  if(bfs[current].counter != BF_FREE)     /* if not free */
+    write_behind(test, convert);          /* flush it */
+  bfs[current].counter = BF_ALLOC;        /* mark as allocated */
+  *dpp = &bfs[current].buf.hdr;
+  return ct;                      /* this is a lie of course */
+}
+
 /* When an error has occurred, it is possible that the two sides are out of
  * synch.  Ie: that what I think is the other side's response to packet N is
  * really their response to packet N-1.
  *
- * So, to try to prevent that, we flush all the input queued up for us on the
+ * To try to prevent that, we flush all the input queued up for us on the
  * network connection on our host.
  *
  * We return the number of packets we flushed (mostly for reporting when trace
@@ -519,35 +497,33 @@ skipit:
 
 static int synchnet(curl_socket_t f /* socket to flush */)
 {
-
-#if defined(HAVE_IOCTLSOCKET)
-  unsigned long i;
-#else
-  int i;
-#endif
   int j = 0;
   char rbuf[PKTSIZE];
   srvr_sockaddr_union_t fromaddr;
   curl_socklen_t fromaddrlen;
 
   for(;;) {
-#if defined(HAVE_IOCTLSOCKET)
-    (void) ioctlsocket(f, FIONREAD, &i);
+#ifdef HAVE_IOCTLSOCKET_CAMEL_FIONBIO
+    long i;
+    (void)IoctlSocket(f, FIONBIO, &i);
+#elif defined(HAVE_IOCTLSOCKET)
+    unsigned long i;
+    (void)ioctlsocket(f, FIONREAD, &i);
 #else
-    (void) ioctl(f, FIONREAD, &i);
+    int i;
+    (void)ioctl(f, FIONREAD, &i);
 #endif
     if(i) {
       j++;
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
       if(!use_ipv6)
 #endif
         fromaddrlen = sizeof(fromaddr.sa4);
-#ifdef ENABLE_IPV6
+#ifdef USE_IPV6
       else
         fromaddrlen = sizeof(fromaddr.sa6);
 #endif
-      (void) recvfrom(f, rbuf, sizeof(rbuf), 0,
-                      &fromaddr.sa, &fromaddrlen);
+      (void)recvfrom(f, rbuf, sizeof(rbuf), 0, &fromaddr.sa, &fromaddrlen);
     }
     else
       break;
@@ -555,340 +531,354 @@ static int synchnet(curl_socket_t f /* socket to flush */)
   return j;
 }
 
-int main(int argc, char **argv)
+/* Based on the testno, parse the correct server commands. */
+static int tftpd_parse_servercmd(struct testcase *req)
 {
-  srvr_sockaddr_union_t me;
-  struct tftphdr *tp;
-  ssize_t n = 0;
-  int arg = 1;
-  unsigned short port = DEFAULT_PORT;
-  curl_socket_t sock = CURL_SOCKET_BAD;
-  int flag;
-  int rc;
+  FILE *stream;
   int error;
-  struct testcase test;
-  int result = 0;
 
-  memset(&test, 0, sizeof(test));
-
-  while(argc>arg) {
-    if(!strcmp("--version", argv[arg])) {
-      printf("tftpd IPv4%s\n",
-#ifdef ENABLE_IPV6
-             "/IPv6"
-#else
-             ""
-#endif
-             );
-      return 0;
-    }
-    else if(!strcmp("--pidfile", argv[arg])) {
-      arg++;
-      if(argc>arg)
-        pidname = argv[arg++];
-    }
-    else if(!strcmp("--portfile", argv[arg])) {
-      arg++;
-      if(argc>arg)
-        portname = argv[arg++];
-    }
-    else if(!strcmp("--logfile", argv[arg])) {
-      arg++;
-      if(argc>arg)
-        serverlogfile = argv[arg++];
-    }
-    else if(!strcmp("--logdir", argv[arg])) {
-      arg++;
-      if(argc>arg)
-        logdir = argv[arg++];
-    }
-    else if(!strcmp("--ipv4", argv[arg])) {
-#ifdef ENABLE_IPV6
-      ipv_inuse = "IPv4";
-      use_ipv6 = FALSE;
-#endif
-      arg++;
-    }
-    else if(!strcmp("--ipv6", argv[arg])) {
-#ifdef ENABLE_IPV6
-      ipv_inuse = "IPv6";
-      use_ipv6 = TRUE;
-#endif
-      arg++;
-    }
-    else if(!strcmp("--port", argv[arg])) {
-      arg++;
-      if(argc>arg) {
-        char *endptr;
-        unsigned long ulnum = strtoul(argv[arg], &endptr, 10);
-        port = curlx_ultous(ulnum);
-        arg++;
-      }
-    }
-    else if(!strcmp("--srcdir", argv[arg])) {
-      arg++;
-      if(argc>arg) {
-        path = argv[arg];
-        arg++;
-      }
-    }
-    else {
-      puts("Usage: tftpd [option]\n"
-           " --version\n"
-           " --logfile [file]\n"
-           " --logdir [directory]\n"
-           " --pidfile [file]\n"
-           " --portfile [file]\n"
-           " --ipv4\n"
-           " --ipv6\n"
-           " --port [port]\n"
-           " --srcdir [path]");
-      return 0;
-    }
-  }
-
-  msnprintf(loglockfile, sizeof(loglockfile), "%s/%s/tftp-%s.lock",
-            logdir, SERVERLOGS_LOCKDIR, ipv_inuse);
-
-#ifdef WIN32
-  win32_init();
-  atexit(win32_cleanup);
-#endif
-
-  install_signal_handlers(true);
-
-#ifdef ENABLE_IPV6
-  if(!use_ipv6)
-#endif
-    sock = socket(AF_INET, SOCK_DGRAM, 0);
-#ifdef ENABLE_IPV6
-  else
-    sock = socket(AF_INET6, SOCK_DGRAM, 0);
-#endif
-
-  if(CURL_SOCKET_BAD == sock) {
-    error = SOCKERRNO;
-    logmsg("Error creating socket: (%d) %s", error, sstrerror(error));
-    result = 1;
-    goto tftpd_cleanup;
-  }
-
-  flag = 1;
-  if(0 != setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
-            (void *)&flag, sizeof(flag))) {
-    error = SOCKERRNO;
-    logmsg("setsockopt(SO_REUSEADDR) failed with error: (%d) %s",
-           error, sstrerror(error));
-    result = 1;
-    goto tftpd_cleanup;
-  }
-
-#ifdef ENABLE_IPV6
-  if(!use_ipv6) {
-#endif
-    memset(&me.sa4, 0, sizeof(me.sa4));
-    me.sa4.sin_family = AF_INET;
-    me.sa4.sin_addr.s_addr = INADDR_ANY;
-    me.sa4.sin_port = htons(port);
-    rc = bind(sock, &me.sa, sizeof(me.sa4));
-#ifdef ENABLE_IPV6
+  stream = test2fopen(req->testno, logdir);
+  if(!stream) {
+    char errbuf[STRERROR_LEN];
+    error = errno;
+    logmsg("fopen() failed with error (%d) %s",
+           error, curlx_strerror(error, errbuf, sizeof(errbuf)));
+    logmsg("  Could not open test file %ld", req->testno);
+    return 1; /* done */
   }
   else {
-    memset(&me.sa6, 0, sizeof(me.sa6));
-    me.sa6.sin6_family = AF_INET6;
-    me.sa6.sin6_addr = in6addr_any;
-    me.sa6.sin6_port = htons(port);
-    rc = bind(sock, &me.sa, sizeof(me.sa6));
-  }
-#endif /* ENABLE_IPV6 */
-  if(0 != rc) {
-    error = SOCKERRNO;
-    logmsg("Error binding socket on port %hu: (%d) %s", port, error,
-           sstrerror(error));
-    result = 1;
-    goto tftpd_cleanup;
-  }
+    char *orgcmd = NULL;
+    const char *cmd = NULL;
+    size_t cmdsize = 0;
+    int num = 0;
 
-  if(!port) {
-    /* The system was supposed to choose a port number, figure out which
-       port we actually got and update the listener port value with it. */
-    curl_socklen_t la_size;
-    srvr_sockaddr_union_t localaddr;
-#ifdef ENABLE_IPV6
-    if(!use_ipv6)
-#endif
-      la_size = sizeof(localaddr.sa4);
-#ifdef ENABLE_IPV6
-    else
-      la_size = sizeof(localaddr.sa6);
-#endif
-    memset(&localaddr.sa, 0, (size_t)la_size);
-    if(getsockname(sock, &localaddr.sa, &la_size) < 0) {
-      error = SOCKERRNO;
-      logmsg("getsockname() failed with error: (%d) %s",
-             error, sstrerror(error));
-      sclose(sock);
-      goto tftpd_cleanup;
-    }
-    switch(localaddr.sa.sa_family) {
-    case AF_INET:
-      port = ntohs(localaddr.sa4.sin_port);
-      break;
-#ifdef ENABLE_IPV6
-    case AF_INET6:
-      port = ntohs(localaddr.sa6.sin6_port);
-      break;
-#endif
-    default:
-      break;
-    }
-    if(!port) {
-      /* Real failure, listener port shall not be zero beyond this point. */
-      logmsg("Apparently getsockname() succeeded, with listener port zero.");
-      logmsg("A valid reason for this failure is a binary built without");
-      logmsg("proper network library linkage. This might not be the only");
-      logmsg("reason, but double check it before anything else.");
-      result = 2;
-      goto tftpd_cleanup;
-    }
-  }
-
-  wrotepidfile = write_pidfile(pidname);
-  if(!wrotepidfile) {
-    result = 1;
-    goto tftpd_cleanup;
-  }
-
-  if(portname) {
-    wroteportfile = write_portfile(portname, port);
-    if(!wroteportfile) {
-      result = 1;
-      goto tftpd_cleanup;
-    }
-  }
-
-  logmsg("Running %s version on port UDP/%d", ipv_inuse, (int)port);
-
-  for(;;) {
-    fromlen = sizeof(from);
-#ifdef ENABLE_IPV6
-    if(!use_ipv6)
-#endif
-      fromlen = sizeof(from.sa4);
-#ifdef ENABLE_IPV6
-    else
-      fromlen = sizeof(from.sa6);
-#endif
-    n = (ssize_t)recvfrom(sock, &buf.storage[0], sizeof(buf.storage), 0,
-                          &from.sa, &fromlen);
-    if(got_exit_signal)
-      break;
-    if(n < 0) {
-      logmsg("recvfrom");
-      result = 3;
-      break;
+    /* get the custom server control "commands" */
+    error = getpart(&orgcmd, &cmdsize, "reply", "servercmd", stream);
+    curlx_fclose(stream);
+    if(error) {
+      logmsg("getpart() failed with error (%d)", error);
+      return 1; /* done */
     }
 
-    set_advisor_read_lock(loglockfile);
-    serverlogslocked = 1;
-
-#ifdef ENABLE_IPV6
-    if(!use_ipv6) {
-#endif
-      from.sa4.sin_family = AF_INET;
-      peer = socket(AF_INET, SOCK_DGRAM, 0);
-      if(CURL_SOCKET_BAD == peer) {
-        logmsg("socket");
-        result = 2;
-        break;
+    cmd = orgcmd;
+    while(cmd && cmdsize) {
+      const char *check;
+      if(sscanf(cmd, "writedelay: %d", &num) == 1) {
+        logmsg("instructed to delay %d secs between packets", num);
+        req->writedelay = num;
       }
-      if(connect(peer, &from.sa, sizeof(from.sa4)) < 0) {
-        logmsg("connect: fail");
-        result = 1;
-        break;
+      else {
+        logmsg("Unknown <servercmd> instruction found: %s", cmd);
       }
-#ifdef ENABLE_IPV6
+      /* try to deal with CRLF or LF */
+      check = strchr(cmd, '\r');
+      if(!check)
+        check = strchr(cmd, '\n');
+
+      if(check) {
+        /* get to the letter following the newline */
+        while((*check == '\r') || (*check == '\n'))
+          check++;
+
+        if(!*check)
+          /* if we reached a zero, get out */
+          break;
+        cmd = check;
+      }
+      else
+        break;
+    }
+    free(orgcmd);
+  }
+
+  return 0; /* OK! */
+}
+
+/*
+ * Validate file access.
+ */
+static int validate_access(struct testcase *test,
+                           const char *filename, unsigned short mode)
+{
+  const char *ptr;
+
+  logmsg("trying to get file: %s mode %x", filename, mode);
+
+  if(!strncmp("verifiedserver", filename, 14)) {
+    char weare[128];
+    size_t count;
+    snprintf(weare, sizeof(weare), "WE ROOLZ: %ld\r\n", (long)our_getpid());
+    count = strlen(weare);
+
+    logmsg("Are-we-friendly question received");
+    test->buffer = curlx_strdup(weare);
+    test->rptr = test->buffer; /* set read pointer */
+    test->bufsize = count;    /* set total count */
+    test->rcount = count;     /* set data left to read */
+    return 0; /* fine */
+  }
+
+  /* find the last slash */
+  ptr = strrchr(filename, '/');
+
+  if(ptr) {
+    char partbuf[80] = "data";
+    long partno;
+    long testno;
+    const char *pval;
+    curl_off_t num;
+    FILE *stream;
+
+    ptr++; /* skip the slash */
+
+    /* skip all non-numericals following the slash */
+    while(*ptr && !ISDIGIT(*ptr))
+      ptr++;
+
+    /* get the number */
+    pval = ptr;
+    if(!curlx_str_number(&pval, &num, INT_MAX))
+      testno = (long)num;
+    else {
+      logmsg("tftpd: failed to read the test number from '%s'", filename);
+      return TFTP_EACCESS;
+    }
+
+    if(testno > 10000) {
+      partno = testno % 10000;
+      testno /= 10000;
+    }
+    else
+      partno = 0;
+
+    logmsg("requested test number %ld part %ld", testno, partno);
+
+    test->testno = testno;
+
+    (void)tftpd_parse_servercmd(test);
+
+    stream = test2fopen(testno, logdir);
+
+    if(partno)
+      snprintf(partbuf, sizeof(partbuf), "data%ld", partno);
+
+    if(!stream) {
+      char errbuf[STRERROR_LEN];
+      int error = errno;
+      logmsg("fopen() failed with error (%d) %s",
+             error, curlx_strerror(error, errbuf, sizeof(errbuf)));
+      logmsg("Could not open test file for test: %ld", testno);
+      return TFTP_EACCESS;
     }
     else {
-      from.sa6.sin6_family = AF_INET6;
-      peer = socket(AF_INET6, SOCK_DGRAM, 0);
-      if(CURL_SOCKET_BAD == peer) {
-        logmsg("socket");
-        result = 2;
-        break;
+      size_t count;
+      int error = getpart(&test->buffer, &count, "reply", partbuf, stream);
+      curlx_fclose(stream);
+      if(error) {
+        logmsg("getpart() failed with error (%d)", error);
+        return TFTP_EACCESS;
       }
-      if(connect(peer, &from.sa, sizeof(from.sa6)) < 0) {
-        logmsg("connect: fail");
-        result = 1;
-        break;
+      if(test->buffer) {
+        test->rptr = test->buffer; /* set read pointer */
+        test->bufsize = count;    /* set total count */
+        test->rcount = count;     /* set data left to read */
       }
+      else
+        return TFTP_EACCESS;
     }
+  }
+  else {
+    logmsg("no slash found in path");
+    return TFTP_EACCESS; /* failure */
+  }
+
+  logmsg("file opened and all is good");
+  return 0;
+}
+
+/*
+ * Send the requested file.
+ */
+static void sendtftp(struct testcase *test, const struct formats *pf)
+{
+  int size;
+  ssize_t n;
+  /* These are volatile to live through a siglongjmp */
+  volatile unsigned short sendblock; /* block count */
+  struct tftphdr * volatile sdp = r_init(); /* data buffer */
+  struct tftphdr * const sap = &ackbuf.hdr; /* ack buffer */
+
+  sendblock = 1;
+#if defined(HAVE_ALARM) && defined(SIGALRM)
+  mysignal(SIGALRM, timer);
 #endif
-
-    maxtimeout = 5*TIMEOUT;
-
-    tp = &buf.hdr;
-    tp->th_opcode = ntohs(tp->th_opcode);
-    if(tp->th_opcode == opcode_RRQ || tp->th_opcode == opcode_WRQ) {
-      memset(&test, 0, sizeof(test));
-      if(do_tftp(&test, tp, n) < 0)
-        break;
-      free(test.buffer);
+  do {
+    size = readit(test, (struct tftphdr * volatile *)&sdp, pf->f_convert);
+    if(size < 0) {
+      nak(errno + 100);
+      return;
     }
-    sclose(peer);
-    peer = CURL_SOCKET_BAD;
-
-    if(got_exit_signal)
-      break;
-
-    if(serverlogslocked) {
-      serverlogslocked = 0;
-      clear_advisor_read_lock(loglockfile);
+    sdp->th_opcode = htons(opcode_DATA);
+    sdp->th_block = htons(sendblock);
+    timeout = 0;
+#ifdef HAVE_SIGSETJMP
+    (void)sigsetjmp(timeoutbuf, 1);
+#endif
+    if(test->writedelay) {
+      logmsg("Pausing %d seconds before %d bytes", test->writedelay, size);
+      curlx_wait_ms(1000 * test->writedelay);
     }
 
-    logmsg("end of one transfer");
+send_data:
+    logmsg("write");
+    if(swrite(peer, sdp, size + 4) != size + 4) {
+      logmsg("write: fail");
+      return;
+    }
+    read_ahead(test, pf->f_convert);
+    for(;;) {
+#ifdef HAVE_ALARM
+      alarm(rexmtval);        /* read the ack */
+#endif
+      logmsg("read");
+      n = sread(peer, &ackbuf.storage[0], sizeof(ackbuf.storage));
+      logmsg("read: %zd", n);
+#ifdef HAVE_ALARM
+      alarm(0);
+#endif
+      if(got_exit_signal)
+        return;
+      if(n < 0) {
+        logmsg("read: fail");
+        return;
+      }
+      sap->th_opcode = ntohs(sap->th_opcode);
+      sap->th_block = ntohs(sap->th_block);
 
+      if(sap->th_opcode == opcode_ERROR) {
+        logmsg("got ERROR");
+        return;
+      }
+
+      if(sap->th_opcode == opcode_ACK) {
+        if(sap->th_block == sendblock) {
+          break;
+        }
+        /* Re-synchronize with the other side */
+        (void)synchnet(peer);
+        if(sap->th_block == (sendblock - 1)) {
+          goto send_data;
+        }
+      }
+    }
+    sendblock++;
+  } while(size == SEGSIZE);
+}
+
+/*
+ * Receive a file.
+ */
+static void recvtftp(struct testcase *test, const struct formats *pf)
+{
+  ssize_t n, size;
+  /* These are volatile to live through a siglongjmp */
+  volatile unsigned short recvblock; /* block count */
+  struct tftphdr * volatile rdp;     /* data buffer */
+  struct tftphdr *rap;      /* ack buffer */
+
+  recvblock = 0;
+  rdp = w_init();
+#if defined(HAVE_ALARM) && defined(SIGALRM)
+  mysignal(SIGALRM, timer);
+#endif
+  rap = &ackbuf.hdr;
+  do {
+    timeout = 0;
+    rap->th_opcode = htons(opcode_ACK);
+    rap->th_block = htons(recvblock);
+    recvblock++;
+#ifdef HAVE_SIGSETJMP
+    (void)sigsetjmp(timeoutbuf, 1);
+#endif
+send_ack:
+    logmsg("write");
+    if(swrite(peer, &ackbuf.storage[0], 4) != 4) {
+      logmsg("write: fail");
+      goto abort;
+    }
+    write_behind(test, pf->f_convert);
+    for(;;) {
+#ifdef HAVE_ALARM
+      alarm(rexmtval);
+#endif
+      logmsg("read");
+      n = sread(peer, rdp, PKTSIZE);
+      logmsg("read: %zd", n);
+#ifdef HAVE_ALARM
+      alarm(0);
+#endif
+      if(got_exit_signal)
+        goto abort;
+      if(n < 0) {                        /* really? */
+        logmsg("read: fail");
+        goto abort;
+      }
+      rdp->th_opcode = ntohs(rdp->th_opcode);
+      rdp->th_block = ntohs(rdp->th_block);
+      if(rdp->th_opcode == opcode_ERROR)
+        goto abort;
+      if(rdp->th_opcode == opcode_DATA) {
+        if(rdp->th_block == recvblock) {
+          break;                         /* normal */
+        }
+        /* Re-synchronize with the other side */
+        (void)synchnet(peer);
+        if(rdp->th_block == (recvblock - 1))
+          goto send_ack;                 /* rexmit */
+      }
+    }
+
+    size = writeit(test, &rdp, (int)(n - 4), pf->f_convert);
+    if(size != (n - 4)) {                /* ahem */
+      if(size < 0)
+        nak(errno + 100);
+      else
+        nak(TFTP_ENOSPACE);
+      goto abort;
+    }
+  } while(size == SEGSIZE);
+  write_behind(test, pf->f_convert);
+  /* close the output file as early as possible after upload completion */
+  if(test->ofile > 0) {
+    curlx_close(test->ofile);
+    test->ofile = 0;
   }
 
-tftpd_cleanup:
-
-  if(test.ofile > 0)
-    close(test.ofile);
-
-  if((peer != sock) && (peer != CURL_SOCKET_BAD))
-    sclose(peer);
-
-  if(sock != CURL_SOCKET_BAD)
-    sclose(sock);
-
+  rap->th_opcode = htons(opcode_ACK);  /* send the "final" ack */
+  rap->th_block = htons(recvblock);
+  (void)swrite(peer, &ackbuf.storage[0], 4);
+#if defined(HAVE_ALARM) && defined(SIGALRM)
+  mysignal(SIGALRM, justtimeout);        /* abort read on timeout */
+  alarm(rexmtval);
+#endif
+  /* normally times out and quits */
+  n = sread(peer, &trsbuf.storage[0], sizeof(trsbuf.storage));
+#ifdef HAVE_ALARM
+  alarm(0);
+#endif
   if(got_exit_signal)
-    logmsg("signalled to die");
-
-  if(wrotepidfile)
-    unlink(pidname);
-  if(wroteportfile)
-    unlink(portname);
-
-  if(serverlogslocked) {
-    serverlogslocked = 0;
-    clear_advisor_read_lock(loglockfile);
+    goto abort;
+  if(n >= 4 &&                               /* if read some data */
+     rdp->th_opcode == opcode_DATA &&        /* and got a data block */
+     recvblock == rdp->th_block) {           /* then my last ack was lost */
+    (void)swrite(peer, &ackbuf.storage[0], 4);  /* resend final ack */
   }
-
-  restore_signal_handlers(true);
-
-  if(got_exit_signal) {
-    logmsg("========> %s tftpd (port: %d pid: %ld) exits with signal (%d)",
-           ipv_inuse, (int)port, (long)getpid(), exit_signal);
-    /*
-     * To properly set the return status of the process we
-     * must raise the same signal SIGINT or SIGTERM that we
-     * caught and let the old handler take care of it.
-     */
-    raise(exit_signal);
+abort:
+  /* make sure the output file is closed in case of abort */
+  if(test->ofile > 0) {
+    curlx_close(test->ofile);
+    test->ofile = 0;
   }
-
-  logmsg("========> tftpd quits");
-  return result;
 }
 
 /*
@@ -899,7 +889,8 @@ static int do_tftp(struct testcase *test, struct tftphdr *tp, ssize_t size)
   char *cp;
   int first = 1, ecode;
   const struct formats *pf;
-  char *filename, *mode = NULL;
+  const char *filename;
+  char *mode = NULL;
 #ifdef USE_WINSOCK
   DWORD recvtimeout, recvtimeoutbak;
 #endif
@@ -908,14 +899,16 @@ static int do_tftp(struct testcase *test, struct tftphdr *tp, ssize_t size)
   FILE *server;
   char dumpfile[256];
 
-  msnprintf(dumpfile, sizeof(dumpfile), "%s/%s", logdir, REQUEST_DUMP);
+  snprintf(dumpfile, sizeof(dumpfile), "%s/%s", logdir, REQUEST_DUMP);
 
   /* Open request dump file. */
-  server = fopen(dumpfile, "ab");
+  server = curlx_fopen(dumpfile, "ab");
   if(!server) {
+    char errbuf[STRERROR_LEN];
     int error = errno;
-    logmsg("fopen() failed with error: %d %s", error, strerror(error));
-    logmsg("Error opening file: %s", dumpfile);
+    logmsg("fopen() failed with error (%d) %s",
+           error, curlx_strerror(error, errbuf, sizeof(errbuf)));
+    logmsg("Error opening file '%s'", dumpfile);
     return -1;
   }
 
@@ -925,10 +918,10 @@ static int do_tftp(struct testcase *test, struct tftphdr *tp, ssize_t size)
   cp = (char *)&tp->th_stuff;
   filename = cp;
   do {
-    bool endofit = true;
-    while(cp < &buf.storage[size]) {
+    bool endofit = TRUE;
+    while(cp < &trsbuf.storage[size]) {
       if(*cp == '\0') {
-        endofit = false;
+        endofit = FALSE;
         break;
       }
       cp++;
@@ -939,7 +932,7 @@ static int do_tftp(struct testcase *test, struct tftphdr *tp, ssize_t size)
 
     /* before increasing pointer, make sure it is still within the legal
        space */
-    if((cp + 1) < &buf.storage[size]) {
+    if((cp + 1) < &trsbuf.storage[size]) {
       ++cp;
       if(first) {
         /* store the mode since we need it later */
@@ -960,9 +953,9 @@ static int do_tftp(struct testcase *test, struct tftphdr *tp, ssize_t size)
       break;
   } while(1);
 
-  if(*cp) {
-    nak(EBADOP);
-    fclose(server);
+  if(*cp || !mode) {
+    nak(TFTP_EBADOP);
+    curlx_fclose(server);
     return 3;
   }
 
@@ -974,13 +967,13 @@ static int do_tftp(struct testcase *test, struct tftphdr *tp, ssize_t size)
       *cp = (char)tolower((int)*cp);
 
   /* store input protocol */
-  fclose(server);
+  curlx_fclose(server);
 
   for(pf = formata; pf->f_mode; pf++)
-    if(strcmp(pf->f_mode, mode) == 0)
+    if(!strcmp(pf->f_mode, mode))
       break;
   if(!pf->f_mode) {
-    nak(EBADOP);
+    nak(TFTP_EBADOP);
     return 2;
   }
   ecode = validate_access(test, filename, tp->th_opcode);
@@ -1012,375 +1005,341 @@ static int do_tftp(struct testcase *test, struct tftphdr *tp, ssize_t size)
   return 0;
 }
 
-/* Based on the testno, parse the correct server commands. */
-static int parse_servercmd(struct testcase *req)
+static int test_tftpd(int argc, const char **argv)
 {
-  FILE *stream;
-  int error;
+  srvr_sockaddr_union_t me;
+  struct tftphdr *tp;
+  ssize_t n = 0;
+  int arg = 1;
+  unsigned short port = 8999; /* UDP */
+  curl_socket_t sock = CURL_SOCKET_BAD;
+  int flag;
+  int rc;
+  int sockerr;
+  char errbuf[STRERROR_LEN];
+  struct testcase test;
+  int result = 0;
+  srvr_sockaddr_union_t from;
+  curl_socklen_t fromlen;
 
-  stream = test2fopen(req->testno, logdir);
-  if(!stream) {
-    error = errno;
-    logmsg("fopen() failed with error: %d %s", error, strerror(error));
-    logmsg("  Couldn't open test file %ld", req->testno);
-    return 1; /* done */
-  }
-  else {
-    char *orgcmd = NULL;
-    char *cmd = NULL;
-    size_t cmdsize = 0;
-    int num = 0;
+  memset(&test, 0, sizeof(test));
 
-    /* get the custom server control "commands" */
-    error = getpart(&orgcmd, &cmdsize, "reply", "servercmd", stream);
-    fclose(stream);
-    if(error) {
-      logmsg("getpart() failed with error: %d", error);
-      return 1; /* done */
+  pidname = ".tftpd.pid";
+  serverlogfile = "log/tftpd.log";
+  serverlogslocked = 0;
+
+  while(argc > arg) {
+    const char *opt;
+    curl_off_t num;
+    if(!strcmp("--version", argv[arg])) {
+      printf("tftpd IPv4%s\n",
+#ifdef USE_IPV6
+             "/IPv6"
+#else
+             ""
+#endif
+      );
+      return 0;
     }
-
-    cmd = orgcmd;
-    while(cmd && cmdsize) {
-      char *check;
-      if(1 == sscanf(cmd, "writedelay: %d", &num)) {
-        logmsg("instructed to delay %d secs between packets", num);
-        req->writedelay = num;
-      }
-      else {
-        logmsg("Unknown <servercmd> instruction found: %s", cmd);
-      }
-      /* try to deal with CRLF or just LF */
-      check = strchr(cmd, '\r');
-      if(!check)
-        check = strchr(cmd, '\n');
-
-      if(check) {
-        /* get to the letter following the newline */
-        while((*check == '\r') || (*check == '\n'))
-          check++;
-
-        if(!*check)
-          /* if we reached a zero, get out */
-          break;
-        cmd = check;
-      }
-      else
-        break;
+    else if(!strcmp("--pidfile", argv[arg])) {
+      arg++;
+      if(argc > arg)
+        pidname = argv[arg++];
     }
-    free(orgcmd);
-  }
-
-  return 0; /* OK! */
-}
-
-
-/*
- * Validate file access.
- */
-static int validate_access(struct testcase *test,
-                           const char *filename, int mode)
-{
-  char *ptr;
-
-  logmsg("trying to get file: %s mode %x", filename, mode);
-
-  if(!strncmp("verifiedserver", filename, 14)) {
-    char weare[128];
-    size_t count = msnprintf(weare, sizeof(weare), "WE ROOLZ: %"
-                             CURL_FORMAT_CURL_OFF_T "\r\n", our_getpid());
-
-    logmsg("Are-we-friendly question received");
-    test->buffer = strdup(weare);
-    test->rptr = test->buffer; /* set read pointer */
-    test->bufsize = count;    /* set total count */
-    test->rcount = count;     /* set data left to read */
-    return 0; /* fine */
-  }
-
-  /* find the last slash */
-  ptr = strrchr(filename, '/');
-
-  if(ptr) {
-    char partbuf[80]="data";
-    long partno;
-    long testno;
-    FILE *stream;
-
-    ptr++; /* skip the slash */
-
-    /* skip all non-numericals following the slash */
-    while(*ptr && !ISDIGIT(*ptr))
-      ptr++;
-
-    /* get the number */
-    testno = strtol(ptr, &ptr, 10);
-
-    if(testno > 10000) {
-      partno = testno % 10000;
-      testno /= 10000;
+    else if(!strcmp("--portfile", argv[arg])) {
+      arg++;
+      if(argc > arg)
+        portname = argv[arg++];
     }
-    else
-      partno = 0;
-
-
-    logmsg("requested test number %ld part %ld", testno, partno);
-
-    test->testno = testno;
-
-    (void)parse_servercmd(test);
-
-    stream = test2fopen(testno, logdir);
-
-    if(0 != partno)
-      msnprintf(partbuf, sizeof(partbuf), "data%ld", partno);
-
-    if(!stream) {
-      int error = errno;
-      logmsg("fopen() failed with error: %d %s", error, strerror(error));
-      logmsg("Couldn't open test file for test : %d", testno);
-      return EACCESS;
+    else if(!strcmp("--logfile", argv[arg])) {
+      arg++;
+      if(argc > arg)
+        serverlogfile = argv[arg++];
+    }
+    else if(!strcmp("--logdir", argv[arg])) {
+      arg++;
+      if(argc > arg)
+        logdir = argv[arg++];
+    }
+    else if(!strcmp("--ipv4", argv[arg])) {
+#ifdef USE_IPV6
+      ipv_inuse = "IPv4";
+      use_ipv6 = FALSE;
+#endif
+      arg++;
+    }
+    else if(!strcmp("--ipv6", argv[arg])) {
+#ifdef USE_IPV6
+      ipv_inuse = "IPv6";
+      use_ipv6 = TRUE;
+#endif
+      arg++;
+    }
+    else if(!strcmp("--port", argv[arg])) {
+      arg++;
+      if(argc > arg) {
+        opt = argv[arg];
+        if(!curlx_str_number(&opt, &num, 0xffff))
+          port = (unsigned short)num;
+        arg++;
+      }
+    }
+    else if(!strcmp("--srcdir", argv[arg])) {
+      arg++;
+      if(argc > arg) {
+        srcpath = argv[arg];
+        arg++;
+      }
     }
     else {
-      size_t count;
-      int error = getpart(&test->buffer, &count, "reply", partbuf, stream);
-      fclose(stream);
-      if(error) {
-        logmsg("getpart() failed with error: %d", error);
-        return EACCESS;
-      }
-      if(test->buffer) {
-        test->rptr = test->buffer; /* set read pointer */
-        test->bufsize = count;    /* set total count */
-        test->rcount = count;     /* set data left to read */
-      }
-      else
-        return EACCESS;
+      puts("Usage: tftpd [option]\n"
+           " --version\n"
+           " --logfile [file]\n"
+           " --logdir [directory]\n"
+           " --pidfile [file]\n"
+           " --portfile [file]\n"
+           " --ipv4\n"
+           " --ipv6\n"
+           " --port [port]\n"
+           " --srcdir [path]");
+      return 0;
     }
   }
+
+  snprintf(loglockfile, sizeof(loglockfile), "%s/%s/tftp-%s.lock",
+           logdir, SERVERLOGS_LOCKDIR, ipv_inuse);
+
+  install_signal_handlers(TRUE);
+
+#ifdef USE_IPV6
+  if(!use_ipv6)
+#endif
+    sock = socket(AF_INET, SOCK_DGRAM, 0);
+#ifdef USE_IPV6
+  else
+    sock = socket(AF_INET6, SOCK_DGRAM, 0);
+#endif
+
+  if(sock == CURL_SOCKET_BAD) {
+    sockerr = SOCKERRNO;
+    logmsg("Error creating socket (%d) %s",
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+    result = 1;
+    goto tftpd_cleanup;
+  }
+
+  flag = 1;
+  if(setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&flag, sizeof(flag))) {
+    sockerr = SOCKERRNO;
+    logmsg("setsockopt(SO_REUSEADDR) failed with error (%d) %s",
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+    result = 1;
+    goto tftpd_cleanup;
+  }
+
+#ifdef USE_IPV6
+  if(!use_ipv6) {
+#endif
+    memset(&me.sa4, 0, sizeof(me.sa4));
+    me.sa4.sin_family = AF_INET;
+    me.sa4.sin_addr.s_addr = INADDR_ANY;
+    me.sa4.sin_port = htons(port);
+    rc = bind(sock, &me.sa, sizeof(me.sa4));
+#ifdef USE_IPV6
+  }
   else {
-    logmsg("no slash found in path");
-    return EACCESS; /* failure */
+    memset(&me.sa6, 0, sizeof(me.sa6));
+    me.sa6.sin6_family = AF_INET6;
+    me.sa6.sin6_addr = in6addr_any;
+    me.sa6.sin6_port = htons(port);
+    rc = bind(sock, &me.sa, sizeof(me.sa6));
+  }
+#endif /* USE_IPV6 */
+  if(rc) {
+    sockerr = SOCKERRNO;
+    logmsg("Error binding socket on port %hu (%d) %s", port,
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+    result = 1;
+    goto tftpd_cleanup;
   }
 
-  logmsg("file opened and all is good");
-  return 0;
-}
-
-/*
- * Send the requested file.
- */
-static void sendtftp(struct testcase *test, const struct formats *pf)
-{
-  int size;
-  ssize_t n;
-  /* These are volatile to live through a siglongjmp */
-  volatile unsigned short sendblock; /* block count */
-  struct tftphdr * volatile sdp = r_init(); /* data buffer */
-  struct tftphdr * const sap = &ackbuf.hdr; /* ack buffer */
-
-  sendblock = 1;
-#if defined(HAVE_ALARM) && defined(SIGALRM)
-  mysignal(SIGALRM, timer);
+  if(!port) {
+    /* The system was supposed to choose a port number, figure out which
+       port we actually got and update the listener port value with it. */
+    curl_socklen_t la_size;
+    srvr_sockaddr_union_t localaddr;
+    memset(&localaddr, 0, sizeof(localaddr));
+#ifdef USE_IPV6
+    if(!use_ipv6)
 #endif
-  do {
-    size = readit(test, (struct tftphdr **)&sdp, pf->f_convert);
-    if(size < 0) {
-      nak(errno + 100);
-      return;
+      la_size = sizeof(localaddr.sa4);
+#ifdef USE_IPV6
+    else
+      la_size = sizeof(localaddr.sa6);
+#endif
+    if(getsockname(sock, &localaddr.sa, &la_size) < 0) {
+      sockerr = SOCKERRNO;
+      logmsg("getsockname() failed with error (%d) %s",
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+      sclose(sock);
+      goto tftpd_cleanup;
     }
-    sdp->th_opcode = htons((unsigned short)opcode_DATA);
-    sdp->th_block = htons(sendblock);
-    timeout = 0;
-#ifdef HAVE_SIGSETJMP
-    (void) sigsetjmp(timeoutbuf, 1);
-#endif
-    if(test->writedelay) {
-      logmsg("Pausing %d seconds before %d bytes", test->writedelay,
-             size);
-      wait_ms(1000*test->writedelay);
-    }
-
-send_data:
-    logmsg("write");
-    if(swrite(peer, sdp, size + 4) != size + 4) {
-      logmsg("write: fail");
-      return;
-    }
-    read_ahead(test, pf->f_convert);
-    for(;;) {
-#ifdef HAVE_ALARM
-      alarm(rexmtval);        /* read the ack */
-#endif
-      logmsg("read");
-      n = sread(peer, &ackbuf.storage[0], sizeof(ackbuf.storage));
-      logmsg("read: %zd", n);
-#ifdef HAVE_ALARM
-      alarm(0);
-#endif
-      if(got_exit_signal)
-        return;
-      if(n < 0) {
-        logmsg("read: fail");
-        return;
-      }
-      sap->th_opcode = ntohs((unsigned short)sap->th_opcode);
-      sap->th_block = ntohs(sap->th_block);
-
-      if(sap->th_opcode == opcode_ERROR) {
-        logmsg("got ERROR");
-        return;
-      }
-
-      if(sap->th_opcode == opcode_ACK) {
-        if(sap->th_block == sendblock) {
-          break;
-        }
-        /* Re-synchronize with the other side */
-        (void) synchnet(peer);
-        if(sap->th_block == (sendblock-1)) {
-          goto send_data;
-        }
-      }
-
-    }
-    sendblock++;
-  } while(size == SEGSIZE);
-}
-
-/*
- * Receive a file.
- */
-static void recvtftp(struct testcase *test, const struct formats *pf)
-{
-  ssize_t n, size;
-  /* These are volatile to live through a siglongjmp */
-  volatile unsigned short recvblock; /* block count */
-  struct tftphdr * volatile rdp;     /* data buffer */
-  struct tftphdr *rap;      /* ack buffer */
-
-  recvblock = 0;
-  rdp = w_init();
-#if defined(HAVE_ALARM) && defined(SIGALRM)
-  mysignal(SIGALRM, timer);
-#endif
-  rap = &ackbuf.hdr;
-  do {
-    timeout = 0;
-    rap->th_opcode = htons((unsigned short)opcode_ACK);
-    rap->th_block = htons(recvblock);
-    recvblock++;
-#ifdef HAVE_SIGSETJMP
-    (void) sigsetjmp(timeoutbuf, 1);
-#endif
-send_ack:
-    logmsg("write");
-    if(swrite(peer, &ackbuf.storage[0], 4) != 4) {
-      logmsg("write: fail");
-      goto abort;
-    }
-    write_behind(test, pf->f_convert);
-    for(;;) {
-#ifdef HAVE_ALARM
-      alarm(rexmtval);
-#endif
-      logmsg("read");
-      n = sread(peer, rdp, PKTSIZE);
-      logmsg("read: %zd", n);
-#ifdef HAVE_ALARM
-      alarm(0);
-#endif
-      if(got_exit_signal)
-        goto abort;
-      if(n < 0) {                       /* really? */
-        logmsg("read: fail");
-        goto abort;
-      }
-      rdp->th_opcode = ntohs((unsigned short)rdp->th_opcode);
-      rdp->th_block = ntohs(rdp->th_block);
-      if(rdp->th_opcode == opcode_ERROR)
-        goto abort;
-      if(rdp->th_opcode == opcode_DATA) {
-        if(rdp->th_block == recvblock) {
-          break;                         /* normal */
-        }
-        /* Re-synchronize with the other side */
-        (void) synchnet(peer);
-        if(rdp->th_block == (recvblock-1))
-          goto send_ack;                 /* rexmit */
-      }
-    }
-
-    size = writeit(test, &rdp, (int)(n - 4), pf->f_convert);
-    if(size != (n-4)) {                 /* ahem */
-      if(size < 0)
-        nak(errno + 100);
-      else
-        nak(ENOSPACE);
-      goto abort;
-    }
-  } while(size == SEGSIZE);
-  write_behind(test, pf->f_convert);
-  /* close the output file as early as possible after upload completion */
-  if(test->ofile > 0) {
-    close(test->ofile);
-    test->ofile = 0;
-  }
-
-  rap->th_opcode = htons((unsigned short)opcode_ACK);  /* send the "final"
-                                                          ack */
-  rap->th_block = htons(recvblock);
-  (void) swrite(peer, &ackbuf.storage[0], 4);
-#if defined(HAVE_ALARM) && defined(SIGALRM)
-  mysignal(SIGALRM, justtimeout);        /* just abort read on timeout */
-  alarm(rexmtval);
-#endif
-  /* normally times out and quits */
-  n = sread(peer, &buf.storage[0], sizeof(buf.storage));
-#ifdef HAVE_ALARM
-  alarm(0);
-#endif
-  if(got_exit_signal)
-    goto abort;
-  if(n >= 4 &&                               /* if read some data */
-     rdp->th_opcode == opcode_DATA &&        /* and got a data block */
-     recvblock == rdp->th_block) {           /* then my last ack was lost */
-    (void) swrite(peer, &ackbuf.storage[0], 4);  /* resend final ack */
-  }
-abort:
-  /* make sure the output file is closed in case of abort */
-  if(test->ofile > 0) {
-    close(test->ofile);
-    test->ofile = 0;
-  }
-  return;
-}
-
-/*
- * Send a nak packet (error message).  Error code passed in is one of the
- * standard TFTP codes, or a Unix errno offset by 100.
- */
-static void nak(int error)
-{
-  struct tftphdr *tp;
-  int length;
-  struct errmsg *pe;
-
-  tp = &buf.hdr;
-  tp->th_opcode = htons((unsigned short)opcode_ERROR);
-  tp->th_code = htons((unsigned short)error);
-  for(pe = errmsgs; pe->e_code >= 0; pe++)
-    if(pe->e_code == error)
+    switch(localaddr.sa.sa_family) {
+    case AF_INET:
+      port = ntohs(localaddr.sa4.sin_port);
       break;
-  if(pe->e_code < 0) {
-    pe->e_msg = strerror(error - 100);
-    tp->th_code = EUNDEF;   /* set 'undef' errorcode */
+#ifdef USE_IPV6
+    case AF_INET6:
+      port = ntohs(localaddr.sa6.sin6_port);
+      break;
+#endif
+    default:
+      break;
+    }
+    if(!port) {
+      /* Real failure, listener port shall not be zero beyond this point. */
+      logmsg("Apparently getsockname() succeeded, with listener port zero.");
+      logmsg("A valid reason for this failure is a binary built without");
+      logmsg("proper network library linkage. This might not be the only");
+      logmsg("reason, but double check it before anything else.");
+      result = 2;
+      goto tftpd_cleanup;
+    }
   }
-  length = (int)strlen(pe->e_msg);
 
-  /* we use memcpy() instead of strcpy() in order to avoid buffer overflow
-   * report from glibc with FORTIFY_SOURCE */
-  memcpy(tp->th_msg, pe->e_msg, length + 1);
-  length += 5;
-  if(swrite(peer, &buf.storage[0], length) != length)
-    logmsg("nak: fail\n");
+  tftpd_wrotepidfile = write_pidfile(pidname);
+  if(!tftpd_wrotepidfile) {
+    result = 1;
+    goto tftpd_cleanup;
+  }
+
+  if(portname) {
+    tftpd_wroteportfile = write_portfile(portname, port);
+    if(!tftpd_wroteportfile) {
+      result = 1;
+      goto tftpd_cleanup;
+    }
+  }
+
+  logmsg("Running %s version on port UDP/%d", ipv_inuse, (int)port);
+
+  for(;;) {
+    fromlen = sizeof(from);
+#ifdef USE_IPV6
+    if(!use_ipv6)
+#endif
+      fromlen = sizeof(from.sa4);
+#ifdef USE_IPV6
+    else
+      fromlen = sizeof(from.sa6);
+#endif
+    n = (ssize_t)recvfrom(sock, &trsbuf.storage[0], sizeof(trsbuf.storage), 0,
+                          &from.sa, &fromlen);
+    if(got_exit_signal)
+      break;
+    if(n < 0) {
+      logmsg("recvfrom");
+      result = 3;
+      break;
+    }
+
+    set_advisor_read_lock(loglockfile);
+    serverlogslocked = 1;
+
+#ifdef USE_IPV6
+    if(!use_ipv6) {
+#endif
+      from.sa4.sin_family = AF_INET;
+      peer = socket(AF_INET, SOCK_DGRAM, 0);
+      if(peer == CURL_SOCKET_BAD) {
+        logmsg("socket");
+        result = 2;
+        break;
+      }
+      if(connect(peer, &from.sa, sizeof(from.sa4)) < 0) {
+        logmsg("connect: fail");
+        result = 1;
+        break;
+      }
+#ifdef USE_IPV6
+    }
+    else {
+      from.sa6.sin6_family = AF_INET6;
+      peer = socket(AF_INET6, SOCK_DGRAM, 0);
+      if(peer == CURL_SOCKET_BAD) {
+        logmsg("socket");
+        result = 2;
+        break;
+      }
+      if(connect(peer, &from.sa, sizeof(from.sa6)) < 0) {
+        logmsg("connect: fail");
+        result = 1;
+        break;
+      }
+    }
+#endif
+
+    maxtimeout = 5 * TIMEOUT;
+
+    tp = &trsbuf.hdr;
+    tp->th_opcode = ntohs(tp->th_opcode);
+    if(tp->th_opcode == opcode_RRQ || tp->th_opcode == opcode_WRQ) {
+      memset(&test, 0, sizeof(test));
+      if(do_tftp(&test, tp, n) < 0)
+        break;
+      free(test.buffer);
+    }
+    sclose(peer);
+    peer = CURL_SOCKET_BAD;
+
+    if(got_exit_signal)
+      break;
+
+    if(serverlogslocked) {
+      serverlogslocked = 0;
+      clear_advisor_read_lock(loglockfile);
+    }
+
+    logmsg("end of one transfer");
+  }
+
+tftpd_cleanup:
+
+  if(test.ofile > 0)
+    curlx_close(test.ofile);
+
+  if((peer != sock) && (peer != CURL_SOCKET_BAD))
+    sclose(peer);
+
+  if(sock != CURL_SOCKET_BAD)
+    sclose(sock);
+
+  if(got_exit_signal)
+    logmsg("signalled to die");
+
+  if(tftpd_wrotepidfile)
+    unlink(pidname);
+  if(tftpd_wroteportfile)
+    unlink(portname);
+
+  if(serverlogslocked) {
+    serverlogslocked = 0;
+    clear_advisor_read_lock(loglockfile);
+  }
+
+  restore_signal_handlers(TRUE);
+
+  if(got_exit_signal) {
+    logmsg("========> %s tftpd (port: %d pid: %ld) exits with signal (%d)",
+           ipv_inuse, (int)port, (long)our_getpid(), exit_signal);
+    /*
+     * To properly set the return status of the process we
+     * must raise the same signal SIGINT or SIGTERM that we
+     * caught and let the old handler take care of it.
+     */
+    raise(exit_signal);
+  }
+
+  logmsg("========> tftpd quits");
+  return result;
 }
diff --git a/third-party/curl/tests/server/util.c b/third-party/curl/tests/server/util.c
index d18c225aef..77d635a9e9 100644
--- a/third-party/curl/tests/server/util.c
+++ b/third-party/curl/tests/server/util.c
@@ -21,81 +21,35 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "server_setup.h"
+#include "first.h"
 
-#ifdef HAVE_SIGNAL_H
-#include <signal.h>
-#endif
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-#ifdef _XOPEN_SOURCE_EXTENDED
-/* This define is "almost" required to build on HPUX 11 */
-#include <arpa/inet.h>
-#endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
-#ifdef HAVE_POLL_H
-#include <poll.h>
-#elif defined(HAVE_SYS_POLL_H)
-#include <sys/poll.h>
-#endif
-#ifdef __MINGW32__
-#include <w32api.h>
+#include <toolx/tool_time.h>
+
+#ifdef HAVE_FCNTL_H
+#include <fcntl.h>
 #endif
 
-#define ENABLE_CURLX_PRINTF
-/* make the curlx header define all printf() functions to use the curlx_*
-   versions instead */
-#include "curlx.h" /* from the private lib dir */
-#include "getpart.h"
-#include "util.h"
-#include "timeval.h"
-
-#ifdef USE_WINSOCK
-#undef  EINTR
-#define EINTR    4 /* errno.h value */
-#undef  EINVAL
-#define EINVAL  22 /* errno.h value */
+#ifdef _WIN32
+#include <share.h>
 #endif
 
-/* MinGW with w32api version < 3.6 declared in6addr_any as extern,
-   but lacked the definition */
-#if defined(ENABLE_IPV6) && defined(__MINGW32__)
-#if (__W32API_MAJOR_VERSION < 3) || \
-    ((__W32API_MAJOR_VERSION == 3) && (__W32API_MINOR_VERSION < 6))
-const struct in6_addr in6addr_any = {{ IN6ADDR_ANY_INIT }};
-#endif /* w32api < 3.6 */
-#endif /* ENABLE_IPV6 && __MINGW32__ */
-
-static struct timeval tvnow(void);
-
-/* This function returns a pointer to STATIC memory. It converts the given
- * binary lump to a hex formatted string usable for output in logs or
- * whatever.
- */
-char *data_to_hex(char *data, size_t len)
+void loghex(const unsigned char *buffer, ssize_t len)
 {
-  static char buf[256*3];
-  size_t i;
-  char *optr = buf;
-  char *iptr = data;
+  char data[12000];
+  ssize_t i;
+  const unsigned char *ptr = buffer;
+  char *optr = data;
+  ssize_t width = 0;
+  int left = sizeof(data);
 
-  if(len > 255)
-    len = 255;
-
-  for(i = 0; i < len; i++) {
-    if((data[i] >= 0x20) && (data[i] < 0x7f))
-      *optr++ = *iptr++;
-    else {
-      msnprintf(optr, 4, "%%%02x", *iptr++);
-      optr += 3;
-    }
+  for(i = 0; i < len && (left > 2); i++) {
+    snprintf(optr, left, "%02x", ptr[i]);
+    width += 2;
+    optr += 2;
+    left -= 2;
   }
-  *optr = 0; /* in case no sprintf was used */
-
-  return buf;
+  if(width)
+    logmsg("'%s'", data);
 }
 
 void logmsg(const char *msg, ...)
@@ -103,205 +57,135 @@ void logmsg(const char *msg, ...)
   va_list ap;
   char buffer[2048 + 1];
   FILE *logfp;
-  struct timeval tv;
+  struct curltime tv;
+  CURLcode result;
   time_t sec;
-  struct tm *now;
-  char timebuf[20];
+  struct tm now;
+  char timebuf[50];
   static time_t epoch_offset;
   static int    known_offset;
 
   if(!serverlogfile) {
-    fprintf(stderr, "Error: serverlogfile not set\n");
+    fprintf(stderr, "Error: Server log file not set\n");
     return;
   }
 
-  tv = tvnow();
+  tv = curlx_now();
   if(!known_offset) {
     epoch_offset = time(NULL) - tv.tv_sec;
     known_offset = 1;
   }
   sec = epoch_offset + tv.tv_sec;
-  /* !checksrc! disable BANNEDFUNC 1 */
-  now = localtime(&sec); /* not thread safe but we don't care */
+  result = toolx_localtime(sec, &now);
+  if(result)
+    memset(&now, 0, sizeof(now));
 
-  msnprintf(timebuf, sizeof(timebuf), "%02d:%02d:%02d.%06ld",
-            (int)now->tm_hour, (int)now->tm_min, (int)now->tm_sec,
-            (long)tv.tv_usec);
+  snprintf(timebuf, sizeof(timebuf), "%02d:%02d:%02d.%06ld",
+           now.tm_hour, now.tm_min, now.tm_sec, (long)tv.tv_usec);
 
   va_start(ap, msg);
-  mvsnprintf(buffer, sizeof(buffer), msg, ap);
+/* Suppress for builds where CURL_PRINTF() is not set */
+#ifdef CURL_HAVE_DIAG
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wformat-nonliteral"
+#endif
+  vsnprintf(buffer, sizeof(buffer), msg, ap);
+#ifdef CURL_HAVE_DIAG
+#pragma GCC diagnostic pop
+#endif
   va_end(ap);
 
-  logfp = fopen(serverlogfile, "ab");
+  do {
+    logfp = curlx_fopen(serverlogfile, "ab");
+    /* !checksrc! disable ERRNOVAR 1 */
+  } while(!logfp && (errno == EINTR));
   if(logfp) {
     fprintf(logfp, "%s %s\n", timebuf, buffer);
-    fclose(logfp);
+    curlx_fclose(logfp);
   }
   else {
+    char errbuf[STRERROR_LEN];
     int error = errno;
-    fprintf(stderr, "fopen() failed with error: %d %s\n",
-            error, strerror(error));
-    fprintf(stderr, "Error opening file: %s\n", serverlogfile);
+    fprintf(stderr, "fopen() failed with error (%d) %s\n",
+            error, curlx_strerror(error, errbuf, sizeof(errbuf)));
+    fprintf(stderr, "Error opening file '%s'\n", serverlogfile);
     fprintf(stderr, "Msg not logged: %s %s\n", timebuf, buffer);
   }
 }
 
-#ifdef WIN32
-/* use instead of strerror() on generic Windows */
-static const char *win32_strerror(int err, char *buf, size_t buflen)
-{
-  if(!FormatMessageA((FORMAT_MESSAGE_FROM_SYSTEM |
-                      FORMAT_MESSAGE_IGNORE_INSERTS), NULL, err,
-                     LANG_NEUTRAL, buf, (DWORD)buflen, NULL))
-    msnprintf(buf, buflen, "Unknown error %lu (%#lx)", err, err);
-  return buf;
-}
-
-/* use instead of perror() on generic windows */
-void win32_perror(const char *msg)
-{
-  char buf[512];
-  DWORD err = SOCKERRNO;
-  win32_strerror(err, buf, sizeof(buf));
-  if(msg)
-    fprintf(stderr, "%s: ", msg);
-  fprintf(stderr, "%s\n", buf);
-}
-
-void win32_init(void)
-{
-#ifdef USE_WINSOCK
-  WORD wVersionRequested;
-  WSADATA wsaData;
-  int err;
-
-  wVersionRequested = MAKEWORD(2, 2);
-  err = WSAStartup(wVersionRequested, &wsaData);
-
-  if(err) {
-    perror("Winsock init failed");
-    logmsg("Error initialising winsock -- aborting");
-    exit(1);
-  }
-
-  if(LOBYTE(wsaData.wVersion) != LOBYTE(wVersionRequested) ||
-     HIBYTE(wsaData.wVersion) != HIBYTE(wVersionRequested) ) {
-    WSACleanup();
-    perror("Winsock init failed");
-    logmsg("No suitable winsock.dll found -- aborting");
-    exit(1);
-  }
-#endif  /* USE_WINSOCK */
-}
-
-void win32_cleanup(void)
+#ifdef _WIN32
+static void win32_cleanup(void)
 {
 #ifdef USE_WINSOCK
   WSACleanup();
-#endif  /* USE_WINSOCK */
+#endif
 
   /* flush buffers of all streams regardless of their mode */
   _flushall();
 }
 
-/* socket-safe strerror (works on WinSock errors, too */
-const char *sstrerror(int err)
+int win32_init(void)
 {
-  static char buf[512];
-  return win32_strerror(err, buf, sizeof(buf));
+  curlx_now_init();
+#ifdef USE_WINSOCK
+  {
+    WORD wVersionRequested;
+    WSADATA wsaData;
+    int err;
+    char buffer[STRERROR_LEN];
+
+    wVersionRequested = MAKEWORD(2, 2);
+    err = WSAStartup(wVersionRequested, &wsaData);
+    if(err) {
+      curlx_strerror(SOCKERRNO, buffer, sizeof(buffer));
+      fprintf(stderr, "Winsock init failed: %s\n", buffer);
+      logmsg("Error initializing Winsock -- aborting");
+      return 1;
+    }
+
+    if(LOBYTE(wsaData.wVersion) != LOBYTE(wVersionRequested) ||
+       HIBYTE(wsaData.wVersion) != HIBYTE(wVersionRequested)) {
+      WSACleanup();
+      curlx_strerror(SOCKERRNO, buffer, sizeof(buffer));
+      fprintf(stderr, "Winsock init failed: %s\n", buffer);
+      logmsg("No suitable winsock.dll found -- aborting");
+      return 1;
+    }
+  }
+#endif /* USE_WINSOCK */
+  atexit(win32_cleanup);
+  return 0;
 }
-#endif  /* WIN32 */
+#endif /* _WIN32 */
 
-/* set by the main code to point to where the test dir is */
-const char *path = ".";
-
-FILE *test2fopen(long testno, const char *logdir)
+/* fopens the test case file */
+FILE *test2fopen(long testno, const char *logdir2)
 {
   FILE *stream;
   char filename[256];
   /* first try the alternative, preprocessed, file */
-  msnprintf(filename, sizeof(filename), ALTTEST_DATA_PATH, logdir, testno);
-  stream = fopen(filename, "rb");
-  if(stream)
-    return stream;
-
-  /* then try the source version */
-  msnprintf(filename, sizeof(filename), TEST_DATA_PATH, path, testno);
-  stream = fopen(filename, "rb");
+  snprintf(filename, sizeof(filename), "%s/test%ld", logdir2, testno);
+  stream = curlx_fopen(filename, "rb");
 
   return stream;
 }
 
-/*
- * Portable function used for waiting a specific amount of ms.
- * Waiting indefinitely with this function is not allowed, a
- * zero or negative timeout value will return immediately.
- *
- * Return values:
- *   -1 = system call error, or invalid timeout value
- *    0 = specified timeout has elapsed
- */
-int wait_ms(int timeout_ms)
-{
-#if !defined(MSDOS) && !defined(USE_WINSOCK)
-#ifndef HAVE_POLL_FINE
-  struct timeval pending_tv;
-#endif
-  struct timeval initial_tv;
-  int pending_ms;
-#endif
-  int r = 0;
-
-  if(!timeout_ms)
-    return 0;
-  if(timeout_ms < 0) {
-    errno = EINVAL;
-    return -1;
-  }
-#if defined(MSDOS)
-  delay(timeout_ms);
-#elif defined(USE_WINSOCK)
-  Sleep(timeout_ms);
+#ifdef _WIN32
+#define t_getpid() GetCurrentProcessId()
 #else
-  pending_ms = timeout_ms;
-  initial_tv = tvnow();
-  do {
-    int error;
-#if defined(HAVE_POLL_FINE)
-    r = poll(NULL, 0, pending_ms);
-#else
-    pending_tv.tv_sec = pending_ms / 1000;
-    pending_tv.tv_usec = (pending_ms % 1000) * 1000;
-    r = select(0, NULL, NULL, NULL, &pending_tv);
-#endif /* HAVE_POLL_FINE */
-    if(r != -1)
-      break;
-    error = errno;
-    if(error && (error != EINTR))
-      break;
-    pending_ms = timeout_ms - (int)timediff(tvnow(), initial_tv);
-    if(pending_ms <= 0)
-      break;
-  } while(r == -1);
-#endif /* USE_WINSOCK */
-  if(r)
-    r = -1;
-  return r;
-}
+#define t_getpid() getpid()
+#endif
 
 curl_off_t our_getpid(void)
 {
-  curl_off_t pid;
-
-  pid = (curl_off_t)getpid();
-#if defined(WIN32) || defined(_WIN32)
-  /* store pid + 65536 to avoid conflict with Cygwin/msys PIDs, see also:
-   * - https://cygwin.com/git/?p=newlib-cygwin.git;a=commit; ↵
-   *   h=b5e1003722cb14235c4f166be72c09acdffc62ea
-   * - https://cygwin.com/git/?p=newlib-cygwin.git;a=commit; ↵
-   *   h=448cf5aa4b429d5a9cebf92a0da4ab4b5b6d23fe
+  curl_off_t pid = (curl_off_t)t_getpid();
+#ifdef _WIN32
+  /* store pid + MAX_PID to avoid conflict with Cygwin/msys PIDs, see also:
+   * - 2019-01-31: https://cygwin.com/git/?p=newlib-cygwin.git;a=commit;h=b5e1003722cb14235c4f166be72c09acdffc62ea
+   * - 2019-02-02: https://cygwin.com/git/?p=newlib-cygwin.git;a=commit;h=448cf5aa4b429d5a9cebf92a0da4ab4b5b6d23fe
+   * - 2024-12-19: https://cygwin.com/git/?p=newlib-cygwin.git;a=commit;h=363357c023ce01e936bdaedf0f479292a8fa4e0f
    */
-  pid += 65536;
+  pid += 4194304;
 #endif
   return pid;
 }
@@ -312,27 +196,31 @@ int write_pidfile(const char *filename)
   curl_off_t pid;
 
   pid = our_getpid();
-  pidfile = fopen(filename, "wb");
+  pidfile = curlx_fopen(filename, "wb");
   if(!pidfile) {
-    logmsg("Couldn't write pid file: %s %s", filename, strerror(errno));
+    char errbuf[STRERROR_LEN];
+    logmsg("Could not write pid file: %s (%d) %s", filename,
+           errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
     return 0; /* fail */
   }
-  fprintf(pidfile, "%" CURL_FORMAT_CURL_OFF_T "\n", pid);
-  fclose(pidfile);
-  logmsg("Wrote pid %" CURL_FORMAT_CURL_OFF_T " to %s", pid, filename);
+  fprintf(pidfile, "%ld\n", (long)pid);
+  curlx_fclose(pidfile);
+  logmsg("Wrote pid %ld to %s", (long)pid, filename);
   return 1; /* success */
 }
 
 /* store the used port number in a file */
 int write_portfile(const char *filename, int port)
 {
-  FILE *portfile = fopen(filename, "wb");
+  FILE *portfile = curlx_fopen(filename, "wb");
   if(!portfile) {
-    logmsg("Couldn't write port file: %s %s", filename, strerror(errno));
+    char errbuf[STRERROR_LEN];
+    logmsg("Could not write port file: %s (%d) %s", filename,
+           errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
     return 0; /* fail */
   }
   fprintf(portfile, "%d\n", port);
-  fclose(portfile);
+  curlx_fclose(portfile);
   logmsg("Wrote port %d to %s", port, filename);
   return 1; /* success */
 }
@@ -341,149 +229,110 @@ void set_advisor_read_lock(const char *filename)
 {
   FILE *lockfile;
   int error = 0;
-  int res;
+  char errbuf[STRERROR_LEN];
 
   do {
-    lockfile = fopen(filename, "wb");
+    lockfile = curlx_fopen(filename, "wb");
+    /* !checksrc! disable ERRNOVAR 1 */
   } while(!lockfile && ((error = errno) == EINTR));
   if(!lockfile) {
-    logmsg("Error creating lock file %s error: %d %s",
-           filename, error, strerror(error));
+    logmsg("Error creating lock file %s error (%d) %s", filename,
+           error, curlx_strerror(error, errbuf, sizeof(errbuf)));
     return;
   }
 
-  do {
-    res = fclose(lockfile);
-  } while(res && ((error = errno) == EINTR));
-  if(res)
-    logmsg("Error closing lock file %s error: %d %s",
-           filename, error, strerror(error));
+  if(curlx_fclose(lockfile))
+    logmsg("Error closing lock file %s error (%d) %s", filename,
+           errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
 }
 
 void clear_advisor_read_lock(const char *filename)
 {
   int error = 0;
-  int res;
+  int rc;
 
   /*
-  ** Log all removal failures. Even those due to file not existing.
-  ** This allows to detect if unexpectedly the file has already been
-  ** removed by a process different than the one that should do this.
-  */
+   * Log all removal failures. Even those due to file not existing.
+   * This allows to detect if unexpectedly the file has already been
+   * removed by a process different than the one that should do this.
+   */
 
   do {
-    res = unlink(filename);
-  } while(res && ((error = errno) == EINTR));
-  if(res)
-    logmsg("Error removing lock file %s error: %d %s",
-           filename, error, strerror(error));
-}
-
-
-#if defined(WIN32) && !defined(MSDOS)
-
-static struct timeval tvnow(void)
-{
-  /*
-  ** GetTickCount() is available on _all_ Windows versions from W95 up
-  ** to nowadays. Returns milliseconds elapsed since last system boot,
-  ** increases monotonically and wraps once 49.7 days have elapsed.
-  **
-  ** GetTickCount64() is available on Windows version from Windows Vista
-  ** and Windows Server 2008 up to nowadays. The resolution of the
-  ** function is limited to the resolution of the system timer, which
-  ** is typically in the range of 10 milliseconds to 16 milliseconds.
-  */
-  struct timeval now;
-#if defined(_WIN32_WINNT) && (_WIN32_WINNT >= 0x0600) && \
-    (!defined(__MINGW32__) || defined(__MINGW64_VERSION_MAJOR))
-  ULONGLONG milliseconds = GetTickCount64();
-#else
-  DWORD milliseconds = GetTickCount();
-#endif
-  now.tv_sec = (long)(milliseconds / 1000);
-  now.tv_usec = (long)((milliseconds % 1000) * 1000);
-  return now;
-}
-
-#elif defined(HAVE_CLOCK_GETTIME_MONOTONIC)
-
-static struct timeval tvnow(void)
-{
-  /*
-  ** clock_gettime() is granted to be increased monotonically when the
-  ** monotonic clock is queried. Time starting point is unspecified, it
-  ** could be the system start-up time, the Epoch, or something else,
-  ** in any case the time starting point does not change once that the
-  ** system has started up.
-  */
-  struct timeval now;
-  struct timespec tsnow;
-  if(0 == clock_gettime(CLOCK_MONOTONIC, &tsnow)) {
-    now.tv_sec = tsnow.tv_sec;
-    now.tv_usec = (int)(tsnow.tv_nsec / 1000);
+    rc = unlink(filename);
+    /* !checksrc! disable ERRNOVAR 1 */
+  } while(rc && ((error = errno) == EINTR));
+  if(rc) {
+    char errbuf[STRERROR_LEN];
+    logmsg("Error removing lock file %s error (%d) %s", filename,
+           error, curlx_strerror(error, errbuf, sizeof(errbuf)));
   }
-  /*
-  ** Even when the configure process has truly detected monotonic clock
-  ** availability, it might happen that it is not actually available at
-  ** run-time. When this occurs simply fallback to other time source.
-  */
-#ifdef HAVE_GETTIMEOFDAY
-  else
-    (void)gettimeofday(&now, NULL);
-#else
-  else {
-    now.tv_sec = time(NULL);
-    now.tv_usec = 0;
+}
+
+/* store the entire request in a file */
+void storerequest(const char *reqbuf, size_t totalsize, const char *filename)
+{
+  int error = 0;
+  char errbuf[STRERROR_LEN];
+  size_t written;
+  size_t writeleft;
+  FILE *dump;
+  char dumpfile[256];
+
+  snprintf(dumpfile, sizeof(dumpfile), "%s/%s", logdir, filename);
+
+  if(!reqbuf)
+    return;
+  if(totalsize == 0)
+    return;
+
+  do {
+    dump = curlx_fopen(dumpfile, "ab");
+    /* !checksrc! disable ERRNOVAR 1 */
+  } while(!dump && ((error = errno) == EINTR));
+  if(!dump) {
+    logmsg("storerequest: Error opening file %s error (%d) %s", dumpfile,
+           error, curlx_strerror(error, errbuf, sizeof(errbuf)));
+    return;
   }
-#endif
-  return now;
-}
 
-#elif defined(HAVE_GETTIMEOFDAY)
+  writeleft = totalsize;
+  do {
+    written = fwrite(&reqbuf[totalsize - writeleft], 1, writeleft, dump);
+    if(got_exit_signal)
+      goto storerequest_cleanup;
+    if(written > 0)
+      writeleft -= written;
+    error = errno;
+    /* !checksrc! disable ERRNOVAR 1 */
+  } while((writeleft > 0) && (error == EINTR));
 
-static struct timeval tvnow(void)
-{
-  /*
-  ** gettimeofday() is not granted to be increased monotonically, due to
-  ** clock drifting and external source time synchronization it can jump
-  ** forward or backward in time.
-  */
-  struct timeval now;
-  (void)gettimeofday(&now, NULL);
-  return now;
-}
+  if(writeleft == 0)
+    logmsg("Wrote request (%zu bytes) input to %s", totalsize, dumpfile);
+  else if(writeleft > 0) {
+    logmsg("Error writing file %s error (%d) %s", dumpfile,
+           error, curlx_strerror(error, errbuf, sizeof(errbuf)));
+    logmsg("Wrote only (%zu bytes) of (%zu bytes) request input to %s",
+           totalsize - writeleft, totalsize, dumpfile);
+  }
 
-#else
+storerequest_cleanup:
 
-static struct timeval tvnow(void)
-{
-  /*
-  ** time() returns the value of time in seconds since the Epoch.
-  */
-  struct timeval now;
-  now.tv_sec = time(NULL);
-  now.tv_usec = 0;
-  return now;
-}
-
-#endif
-
-long timediff(struct timeval newer, struct timeval older)
-{
-  timediff_t diff = newer.tv_sec-older.tv_sec;
-  if(diff >= (LONG_MAX/1000))
-    return LONG_MAX;
-  else if(diff <= (LONG_MIN/1000))
-    return LONG_MIN;
-  return (long)(newer.tv_sec-older.tv_sec)*1000+
-    (long)(newer.tv_usec-older.tv_usec)/1000;
+  if(curlx_fclose(dump))
+    logmsg("Error closing file %s error (%d) %s", dumpfile,
+           errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
 }
 
 /* vars used to keep around previous signal handlers */
 
 typedef void (*SIGHANDLER_T)(int);
 
+#if defined(_MSC_VER) && (_MSC_VER <= 1700)
+/* Workaround for warning C4306:
+   'type cast' : conversion from 'int' to 'void (__cdecl *)(int)' */
+#undef SIG_ERR
+#define SIG_ERR  ((SIGHANDLER_T)(size_t)-1)
+#endif
+
 #ifdef SIGHUP
 static SIGHANDLER_T old_sighup_handler  = SIG_ERR;
 #endif
@@ -504,44 +353,66 @@ static SIGHANDLER_T old_sigint_handler  = SIG_ERR;
 static SIGHANDLER_T old_sigterm_handler = SIG_ERR;
 #endif
 
-#if defined(SIGBREAK) && defined(WIN32)
+#if defined(SIGBREAK) && defined(_WIN32)
 static SIGHANDLER_T old_sigbreak_handler = SIG_ERR;
 #endif
 
-#ifdef WIN32
-#ifdef _WIN32_WCE
+#if defined(_WIN32) && !defined(CURL_WINDOWS_UWP)
 static DWORD thread_main_id = 0;
-#else
-static unsigned int thread_main_id = 0;
-#endif
 static HANDLE thread_main_window = NULL;
 static HWND hidden_main_window = NULL;
 #endif
 
-/* var which if set indicates that the program should finish execution */
-volatile int got_exit_signal = 0;
-
-/* if next is set indicates the first signal handled in exit_signal_handler */
-volatile int exit_signal = 0;
-
-#ifdef WIN32
-/* event which if set indicates that the program should finish */
-HANDLE exit_event = NULL;
-#endif
-
-/* signal handler that will be triggered to indicate that the program
+/* signal handler that is triggered to indicate that the program
  * should finish its execution in a controlled manner as soon as possible.
- * The first time this is called it will set got_exit_signal to one and
- * store in exit_signal the signal that triggered its execution.
+ * The first time this is called it sets got_exit_signal to 1 and
+ * stores in exit_signal the signal that triggered its execution.
+ *
+ * Only call signal-safe functions from the signal handler, as required by
+ * the POSIX specification:
+ *   https://pubs.opengroup.org/onlinepubs/9699919799/functions/V2_chap02.html
+ * Hence, do not call 'logmsg()', and instead use 'open/write/close' to
+ * log errors.
  */
+/* suppress warnings seen in configurations where 'write()' has the attribute
+   'warn_unused_result', which is not silenced by casting to '(void)'. */
+#if defined(CURL_HAVE_DIAG) && !defined(__clang__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wunused-result" /* GCC 4.5+ */
+#endif
 static void exit_signal_handler(int signum)
 {
   int old_errno = errno;
-  logmsg("exit_signal_handler: %d", signum);
+  if(!serverlogfile) {
+    static const char msg[] = "exit_signal_handler: serverlogfile not set\n";
+    (void)write(STDERR_FILENO, msg, sizeof(msg) - 1);
+  }
+  else {
+    int fd = -1;
+#ifdef _WIN32
+    if(!_sopen_s(&fd, serverlogfile, _O_WRONLY | _O_CREAT | _O_APPEND,
+                 _SH_DENYNO, _S_IREAD | _S_IWRITE) &&
+       fd != -1) {
+#else
+    /* !checksrc! disable BANNEDFUNC 1 */
+    fd = open(serverlogfile, O_WRONLY | O_CREAT | O_APPEND, S_IRUSR | S_IWUSR);
+    if(fd != -1) {
+#endif
+      static const char msg[] = "exit_signal_handler: called\n";
+      (void)write(fd, msg, sizeof(msg) - 1);
+      curlx_close(fd);
+    }
+    else {
+      static const char msg[] = "exit_signal_handler: failed opening ";
+      (void)write(STDERR_FILENO, msg, sizeof(msg) - 1);
+      (void)write(STDERR_FILENO, serverlogfile, strlen(serverlogfile));
+      (void)write(STDERR_FILENO, "\n", 1);
+    }
+  }
   if(got_exit_signal == 0) {
     got_exit_signal = 1;
     exit_signal = signum;
-#ifdef WIN32
+#ifdef _WIN32
     if(exit_event)
       (void)SetEvent(exit_event);
 #endif
@@ -549,8 +420,11 @@ static void exit_signal_handler(int signum)
   (void)signal(signum, exit_signal_handler);
   errno = old_errno;
 }
+#if defined(CURL_HAVE_DIAG) && !defined(__clang__)
+#pragma GCC diagnostic pop
+#endif
 
-#ifdef WIN32
+#ifdef _WIN32
 /* CTRL event handler for Windows Console applications to simulate
  * SIGINT, SIGTERM and SIGBREAK on CTRL events and trigger signal handler.
  *
@@ -558,37 +432,47 @@ static void exit_signal_handler(int signum)
  * SIGINT is not supported for any Win32 application. When a CTRL+C
  * interrupt occurs, Win32 operating systems generate a new thread
  * to specifically handle that interrupt. This can cause a single-thread
- * application, such as one in UNIX, to become multithreaded and cause
+ * application, such as one in UNIX, to become multi-threaded and cause
  * unexpected behavior.
  * [...]
- * The SIGILL and SIGTERM signals are not generated under Windows.
+ * The SIGKILL and SIGTERM signals are not generated under Windows.
  * They are included for ANSI compatibility. Therefore, you can set
  * signal handlers for these signals by using signal, and you can also
  * explicitly generate these signals by calling raise. Source:
- * https://docs.microsoft.com/de-de/cpp/c-runtime-library/reference/signal
+ * https://learn.microsoft.com/cpp/c-runtime-library/reference/signal
  */
 static BOOL WINAPI ctrl_event_handler(DWORD dwCtrlType)
 {
   int signum = 0;
-  logmsg("ctrl_event_handler: %d", dwCtrlType);
+  logmsg("ctrl_event_handler: %lu", dwCtrlType);
   switch(dwCtrlType) {
 #ifdef SIGINT
-    case CTRL_C_EVENT: signum = SIGINT; break;
+  case CTRL_C_EVENT:
+    signum = SIGINT;
+    break;
 #endif
 #ifdef SIGTERM
-    case CTRL_CLOSE_EVENT: signum = SIGTERM; break;
+  case CTRL_CLOSE_EVENT:
+    signum = SIGTERM;
+    break;
 #endif
 #ifdef SIGBREAK
-    case CTRL_BREAK_EVENT: signum = SIGBREAK; break;
+  case CTRL_BREAK_EVENT:
+    signum = SIGBREAK;
+    break;
 #endif
-    default: return FALSE;
+  default:
+    return FALSE;
   }
   if(signum) {
-    logmsg("ctrl_event_handler: %d -> %d", dwCtrlType, signum);
+    logmsg("ctrl_event_handler: %lu -> %d", dwCtrlType, signum);
     raise(signum);
   }
   return TRUE;
 }
+#endif
+
+#if defined(_WIN32) && !defined(CURL_WINDOWS_UWP)
 /* Window message handler for Windows applications to add support
  * for graceful process termination via taskkill (without /f) which
  * sends WM_CLOSE to all Windows of a process (even hidden ones).
@@ -603,12 +487,16 @@ static LRESULT CALLBACK main_window_proc(HWND hwnd, UINT uMsg,
   if(hwnd == hidden_main_window) {
     switch(uMsg) {
 #ifdef SIGTERM
-      case WM_CLOSE: signum = SIGTERM; break;
+    case WM_CLOSE:
+      signum = SIGTERM;
+      break;
 #endif
-      case WM_DESTROY: PostQuitMessage(0); break;
+    case WM_DESTROY:
+      PostQuitMessage(0);
+      break;
     }
     if(signum) {
-      logmsg("main_window_proc: %d -> %d", uMsg, signum);
+      logmsg("main_window_proc: %u -> %d", uMsg, signum);
       raise(signum);
     }
   }
@@ -616,23 +504,22 @@ static LRESULT CALLBACK main_window_proc(HWND hwnd, UINT uMsg,
 }
 /* Window message queue loop for hidden main window, details see above.
  */
-#ifdef _WIN32_WCE
-static DWORD WINAPI main_window_loop(LPVOID lpParameter)
-#else
-#include <process.h>
-static unsigned int WINAPI main_window_loop(void *lpParameter)
-#endif
+static DWORD WINAPI main_window_loop(void *lpParameter)
 {
   WNDCLASS wc;
   BOOL ret;
   MSG msg;
+  DWORD err;
+  char buffer[WINAPI_ERROR_LEN];
 
   ZeroMemory(&wc, sizeof(wc));
   wc.lpfnWndProc = (WNDPROC)main_window_proc;
   wc.hInstance = (HINSTANCE)lpParameter;
   wc.lpszClassName = TEXT("MainWClass");
   if(!RegisterClass(&wc)) {
-    perror("RegisterClass failed");
+    err = GetLastError();
+    curlx_winapi_strerror(err, buffer, sizeof(buffer));
+    fprintf(stderr, "RegisterClass failed: %s\n", buffer);
     return (DWORD)-1;
   }
 
@@ -642,16 +529,20 @@ static unsigned int WINAPI main_window_loop(void *lpParameter)
                                       CW_USEDEFAULT, CW_USEDEFAULT,
                                       CW_USEDEFAULT, CW_USEDEFAULT,
                                       (HWND)NULL, (HMENU)NULL,
-                                      wc.hInstance, (LPVOID)NULL);
+                                      wc.hInstance, NULL);
   if(!hidden_main_window) {
-    perror("CreateWindowEx failed");
+    err = GetLastError();
+    curlx_winapi_strerror(err, buffer, sizeof(buffer));
+    fprintf(stderr, "CreateWindowEx failed: (0x%08lx) - %s\n", err, buffer);
     return (DWORD)-1;
   }
 
   do {
     ret = GetMessage(&msg, NULL, 0, 0);
     if(ret == -1) {
-      perror("GetMessage failed");
+      err = GetLastError();
+      curlx_winapi_strerror(err, buffer, sizeof(buffer));
+      fprintf(stderr, "GetMessage failed: (0x%08lx) - %s\n", err, buffer);
       return (DWORD)-1;
     }
     else if(ret) {
@@ -679,7 +570,7 @@ static SIGHANDLER_T set_signal(int signum, SIGHANDLER_T handler,
   sa.sa_handler = handler;
   sigemptyset(&sa.sa_mask);
   sigaddset(&sa.sa_mask, signum);
-  sa.sa_flags = restartable? SA_RESTART: 0;
+  sa.sa_flags = restartable ? SA_RESTART : 0;
 
   if(sigaction(signum, &sa, &oldsa))
     return SIG_ERR;
@@ -690,9 +581,9 @@ static SIGHANDLER_T set_signal(int signum, SIGHANDLER_T handler,
 
 #ifdef HAVE_SIGINTERRUPT
   if(oldhdlr != SIG_ERR)
-    siginterrupt(signum, (int) restartable);
+    siginterrupt(signum, (int)restartable);
 #else
-  (void) restartable;
+  (void)restartable;
 #endif
 
   return oldhdlr;
@@ -701,16 +592,10 @@ static SIGHANDLER_T set_signal(int signum, SIGHANDLER_T handler,
 
 void install_signal_handlers(bool keep_sigalrm)
 {
-#ifdef WIN32
-#ifdef _WIN32_WCE
-  typedef HANDLE curl_win_thread_handle_t;
-#elif defined(__MINGW32__) && !defined(__MINGW64_VERSION_MAJOR)
-  typedef unsigned long curl_win_thread_handle_t;
-#else
-  typedef uintptr_t curl_win_thread_handle_t;
-#endif
-  curl_win_thread_handle_t thread;
-  /* setup windows exit event before any signal can trigger */
+  char errbuf[STRERROR_LEN];
+  (void)errbuf;
+#ifdef _WIN32
+  /* setup Windows exit event before any signal can trigger */
   exit_event = CreateEvent(NULL, TRUE, FALSE, NULL);
   if(!exit_event)
     logmsg("cannot create exit event");
@@ -719,20 +604,23 @@ void install_signal_handlers(bool keep_sigalrm)
   /* ignore SIGHUP signal */
   old_sighup_handler = set_signal(SIGHUP, SIG_IGN, FALSE);
   if(old_sighup_handler == SIG_ERR)
-    logmsg("cannot install SIGHUP handler: %s", strerror(errno));
+    logmsg("cannot install SIGHUP handler: (%d) %s",
+           errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
 #endif
 #ifdef SIGPIPE
   /* ignore SIGPIPE signal */
   old_sigpipe_handler = set_signal(SIGPIPE, SIG_IGN, FALSE);
   if(old_sigpipe_handler == SIG_ERR)
-    logmsg("cannot install SIGPIPE handler: %s", strerror(errno));
+    logmsg("cannot install SIGPIPE handler: (%d) %s",
+           errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
 #endif
 #ifdef SIGALRM
   if(!keep_sigalrm) {
     /* ignore SIGALRM signal */
     old_sigalrm_handler = set_signal(SIGALRM, SIG_IGN, FALSE);
     if(old_sigalrm_handler == SIG_ERR)
-      logmsg("cannot install SIGALRM handler: %s", strerror(errno));
+      logmsg("cannot install SIGALRM handler: (%d) %s",
+             errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
   }
 #else
   (void)keep_sigalrm;
@@ -741,68 +629,69 @@ void install_signal_handlers(bool keep_sigalrm)
   /* handle SIGINT signal with our exit_signal_handler */
   old_sigint_handler = set_signal(SIGINT, exit_signal_handler, TRUE);
   if(old_sigint_handler == SIG_ERR)
-    logmsg("cannot install SIGINT handler: %s", strerror(errno));
+    logmsg("cannot install SIGINT handler: (%d) %s",
+           errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
 #endif
 #ifdef SIGTERM
   /* handle SIGTERM signal with our exit_signal_handler */
   old_sigterm_handler = set_signal(SIGTERM, exit_signal_handler, TRUE);
   if(old_sigterm_handler == SIG_ERR)
-    logmsg("cannot install SIGTERM handler: %s", strerror(errno));
+    logmsg("cannot install SIGTERM handler: (%d) %s",
+           errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
 #endif
-#if defined(SIGBREAK) && defined(WIN32)
+#if defined(SIGBREAK) && defined(_WIN32)
   /* handle SIGBREAK signal with our exit_signal_handler */
   old_sigbreak_handler = set_signal(SIGBREAK, exit_signal_handler, TRUE);
   if(old_sigbreak_handler == SIG_ERR)
-    logmsg("cannot install SIGBREAK handler: %s", strerror(errno));
+    logmsg("cannot install SIGBREAK handler: (%d) %s",
+           errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
 #endif
-#ifdef WIN32
+#ifdef _WIN32
   if(!SetConsoleCtrlHandler(ctrl_event_handler, TRUE))
     logmsg("cannot install CTRL event handler");
-#ifdef _WIN32_WCE
-  thread = CreateThread(NULL, 0, &main_window_loop,
-                        (LPVOID)GetModuleHandle(NULL), 0, &thread_main_id);
-#else
-  thread = _beginthreadex(NULL, 0, &main_window_loop,
-                          (void *)GetModuleHandle(NULL), 0, &thread_main_id);
-#endif
-  thread_main_window = (HANDLE)thread;
+
+#ifndef CURL_WINDOWS_UWP
+  thread_main_window = CreateThread(NULL, 0, &main_window_loop,
+                                    GetModuleHandle(NULL), 0, &thread_main_id);
   if(!thread_main_window || !thread_main_id)
     logmsg("cannot start main window loop");
 #endif
+#endif
 }
 
 void restore_signal_handlers(bool keep_sigalrm)
 {
 #ifdef SIGHUP
   if(SIG_ERR != old_sighup_handler)
-    (void) set_signal(SIGHUP, old_sighup_handler, FALSE);
+    (void)set_signal(SIGHUP, old_sighup_handler, FALSE);
 #endif
 #ifdef SIGPIPE
   if(SIG_ERR != old_sigpipe_handler)
-    (void) set_signal(SIGPIPE, old_sigpipe_handler, FALSE);
+    (void)set_signal(SIGPIPE, old_sigpipe_handler, FALSE);
 #endif
 #ifdef SIGALRM
   if(!keep_sigalrm) {
     if(SIG_ERR != old_sigalrm_handler)
-      (void) set_signal(SIGALRM, old_sigalrm_handler, FALSE);
+      (void)set_signal(SIGALRM, old_sigalrm_handler, FALSE);
   }
 #else
   (void)keep_sigalrm;
 #endif
 #ifdef SIGINT
   if(SIG_ERR != old_sigint_handler)
-    (void) set_signal(SIGINT, old_sigint_handler, FALSE);
+    (void)set_signal(SIGINT, old_sigint_handler, FALSE);
 #endif
 #ifdef SIGTERM
   if(SIG_ERR != old_sigterm_handler)
-    (void) set_signal(SIGTERM, old_sigterm_handler, FALSE);
+    (void)set_signal(SIGTERM, old_sigterm_handler, FALSE);
 #endif
-#if defined(SIGBREAK) && defined(WIN32)
+#if defined(SIGBREAK) && defined(_WIN32)
   if(SIG_ERR != old_sigbreak_handler)
-    (void) set_signal(SIGBREAK, old_sigbreak_handler, FALSE);
+    (void)set_signal(SIGBREAK, old_sigbreak_handler, FALSE);
 #endif
-#ifdef WIN32
+#ifdef _WIN32
   (void)SetConsoleCtrlHandler(ctrl_event_handler, FALSE);
+#ifndef CURL_WINDOWS_UWP
   if(thread_main_window && thread_main_id) {
     if(PostThreadMessage(thread_main_id, WM_APP, 0, 0)) {
       if(WaitForSingleObjectEx(thread_main_window, INFINITE, TRUE)) {
@@ -819,65 +708,246 @@ void restore_signal_handlers(bool keep_sigalrm)
     }
   }
 #endif
+#endif
 }
 
 #ifdef USE_UNIX_SOCKETS
 
 int bind_unix_socket(curl_socket_t sock, const char *unix_socket,
-        struct sockaddr_un *sau) {
-    int error;
-    int rc;
+                     struct sockaddr_un *sau)
+{
+  char errbuf[STRERROR_LEN];
+  int rc;
+  size_t len;
 
-    memset(sau, 0, sizeof(struct sockaddr_un));
-    sau->sun_family = AF_UNIX;
-    strncpy(sau->sun_path, unix_socket, sizeof(sau->sun_path) - 1);
-    rc = bind(sock, (struct sockaddr*)sau, sizeof(struct sockaddr_un));
-    if(0 != rc && SOCKERRNO == EADDRINUSE) {
-      struct_stat statbuf;
-      /* socket already exists. Perhaps it is stale? */
-      curl_socket_t unixfd = socket(AF_UNIX, SOCK_STREAM, 0);
-      if(CURL_SOCKET_BAD == unixfd) {
-        logmsg("Failed to create socket at %s: (%d) %s",
-               unix_socket, SOCKERRNO, sstrerror(SOCKERRNO));
-        return -1;
-      }
-      /* check whether the server is alive */
-      rc = connect(unixfd, (struct sockaddr*)sau, sizeof(struct sockaddr_un));
-      error = SOCKERRNO;
-      sclose(unixfd);
-      if(0 != rc && ECONNREFUSED != error) {
-        logmsg("Failed to connect to %s: (%d) %s",
-               unix_socket, error, sstrerror(error));
-        return rc;
-      }
-      /* socket server is not alive, now check if it was actually a socket. */
-#ifdef WIN32
-      /* Windows does not have lstat function. */
-      rc = curlx_win32_stat(unix_socket, &statbuf);
-#else
-      rc = lstat(unix_socket, &statbuf);
-#endif
-      if(0 != rc) {
-        logmsg("Error binding socket, failed to stat %s: (%d) %s",
-               unix_socket, errno, strerror(errno));
-        return rc;
-      }
-#ifdef S_IFSOCK
-      if((statbuf.st_mode & S_IFSOCK) != S_IFSOCK) {
-        logmsg("Error binding socket, failed to stat %s", unix_socket);
-        return -1;
-      }
-#endif
-      /* dead socket, cleanup and retry bind */
-      rc = unlink(unix_socket);
-      if(0 != rc) {
-        logmsg("Error binding socket, failed to unlink %s: (%d) %s",
-               unix_socket, errno, strerror(errno));
-        return rc;
-      }
-      /* stale socket is gone, retry bind */
-      rc = bind(sock, (struct sockaddr*)sau, sizeof(struct sockaddr_un));
+  if(!unix_socket) {
+    logmsg("Unix socket domain path not specified.");
+    return -1;
+  }
+
+  len = strlen(unix_socket);
+
+  memset(sau, 0, sizeof(struct sockaddr_un));
+  sau->sun_family = AF_UNIX;
+  if(len >= sizeof(sau->sun_path) - 1) {
+    logmsg("Too long unix socket domain path (%zu)", len);
+    return -1;
+  }
+  curlx_strcopy(sau->sun_path, sizeof(sau->sun_path), unix_socket, len);
+  rc = bind(sock, (struct sockaddr *)sau, sizeof(struct sockaddr_un));
+  if(rc && SOCKERRNO == SOCKEADDRINUSE) {
+    int sockerr;
+    /* socket already exists. Perhaps it is stale? */
+    curl_socket_t unixfd = socket(AF_UNIX, SOCK_STREAM, 0);
+    if(unixfd == CURL_SOCKET_BAD) {
+      sockerr = SOCKERRNO;
+      logmsg("Failed to create socket at %s (%d) %s", unix_socket,
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+      return -1;
     }
-    return rc;
+    /* check whether the server is alive */
+    rc = connect(unixfd, (struct sockaddr*)sau, sizeof(struct sockaddr_un));
+    sockerr = SOCKERRNO;
+    sclose(unixfd);
+    if(rc && sockerr != SOCKECONNREFUSED) {
+      logmsg("Failed to connect to %s (%d) %s", unix_socket,
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+      return rc;
+    }
+#if !defined(_WIN32) && defined(S_IFSOCK) /* No lstat(), S_IFSOCK on Windows */
+    /* socket server is not alive, now check if it was actually a socket. */
+    {
+      curlx_struct_stat statbuf;
+      rc = lstat(unix_socket, &statbuf);
+      if(rc && errno != ENOENT) {
+        logmsg("Error binding socket, failed to stat %s (%d) %s", unix_socket,
+               errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
+        return -1;
+      }
+      if(!rc && (statbuf.st_mode & S_IFMT) != S_IFSOCK) {
+        logmsg("Error binding socket, %s is not a socket", unix_socket);
+        return -1;
+      }
+    }
+#endif
+    /* dead socket, cleanup and retry bind */
+    if(unlink(unix_socket) && errno != ENOENT) {
+      logmsg("Error binding socket, failed to unlink %s: %d (%s)", unix_socket,
+             errno, curlx_strerror(errno, errbuf, sizeof(errbuf)));
+      return -1;
+    }
+    /* stale socket is gone, retry bind */
+    rc = bind(sock, (struct sockaddr *)sau, sizeof(struct sockaddr_un));
+  }
+  return rc;
 }
 #endif
+
+curl_socket_t sockdaemon(curl_socket_t sock,
+                         unsigned short *listenport,
+                         const char *unix_socket,
+                         bool bind_only)
+{
+  /* passive daemon style */
+  srvr_sockaddr_union_t listener;
+  int flag;
+  int rc;
+  int totdelay = 0;
+  int maxretr = 10;
+  int delay = 20;
+  int attempt = 0;
+  int sockerr = 0;
+  char errbuf[STRERROR_LEN];
+
+#ifndef USE_UNIX_SOCKETS
+  (void)unix_socket;
+#endif
+
+#if defined(_WIN32) && defined(USE_UNIX_SOCKETS)
+  if(socket_domain != AF_UNIX) {
+#endif
+    do {
+      attempt++;
+      flag = 1;
+      rc = setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
+                      (void *)&flag, sizeof(flag));
+      if(rc) {
+        sockerr = SOCKERRNO;
+        logmsg("setsockopt(SO_REUSEADDR) failed with error (%d) %s",
+               sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+        if(maxretr) {
+          if(curlx_wait_ms(delay)) {
+            /* should not happen */
+            sockerr = SOCKERRNO;
+            logmsg("curlx_wait_ms() failed with error (%d) %s",
+                   sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+            sclose(sock);
+            return CURL_SOCKET_BAD;
+          }
+          if(got_exit_signal) {
+            logmsg("signalled to die, exiting...");
+            sclose(sock);
+            return CURL_SOCKET_BAD;
+          }
+          totdelay += delay;
+          delay *= 2; /* double the sleep for next attempt */
+        }
+      }
+    } while(rc && maxretr--);
+
+    if(rc) {
+      logmsg("setsockopt(SO_REUSEADDR) failed %d times in %d ms. "
+             "Error (%d) %s", attempt, totdelay,
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+      logmsg("Continuing anyway...");
+    }
+#if defined(_WIN32) && defined(USE_UNIX_SOCKETS)
+  }
+#endif
+
+  /* When the specified listener port is zero, it is actually a
+     request to let the system choose a non-zero available port. */
+
+  switch(socket_domain) {
+  case AF_INET:
+    memset(&listener.sa4, 0, sizeof(listener.sa4));
+    listener.sa4.sin_family = AF_INET;
+    listener.sa4.sin_addr.s_addr = INADDR_ANY;
+    listener.sa4.sin_port = htons(*listenport);
+    rc = bind(sock, &listener.sa, sizeof(listener.sa4));
+    break;
+#ifdef USE_IPV6
+  case AF_INET6:
+    memset(&listener.sa6, 0, sizeof(listener.sa6));
+    listener.sa6.sin6_family = AF_INET6;
+    listener.sa6.sin6_addr = in6addr_any;
+    listener.sa6.sin6_port = htons(*listenport);
+    rc = bind(sock, &listener.sa, sizeof(listener.sa6));
+    break;
+#endif /* USE_IPV6 */
+#ifdef USE_UNIX_SOCKETS
+  case AF_UNIX:
+    rc = bind_unix_socket(sock, unix_socket, &listener.sau);
+    break;
+#endif
+  default:
+    rc = 1;
+  }
+
+  if(rc) {
+    sockerr = SOCKERRNO;
+#ifdef USE_UNIX_SOCKETS
+    if(socket_domain == AF_UNIX)
+      logmsg("Error binding socket on path %s (%d) %s", unix_socket,
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+    else
+#endif
+      logmsg("Error binding socket on port %hu (%d) %s", *listenport,
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+    sclose(sock);
+    return CURL_SOCKET_BAD;
+  }
+
+  if(!*listenport
+#ifdef USE_UNIX_SOCKETS
+     && !unix_socket
+#endif
+    ) {
+    /* The system was supposed to choose a port number, figure out which
+       port we actually got and update the listener port value with it. */
+    curl_socklen_t la_size;
+    srvr_sockaddr_union_t localaddr;
+    memset(&localaddr, 0, sizeof(localaddr));
+#ifdef USE_IPV6
+    if(socket_domain == AF_INET6)
+      la_size = sizeof(localaddr.sa6);
+    else
+#endif
+      la_size = sizeof(localaddr.sa4);
+    if(getsockname(sock, &localaddr.sa, &la_size) < 0) {
+      sockerr = SOCKERRNO;
+      logmsg("getsockname() failed with error (%d) %s",
+             sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+      sclose(sock);
+      return CURL_SOCKET_BAD;
+    }
+    switch(localaddr.sa.sa_family) {
+    case AF_INET:
+      *listenport = ntohs(localaddr.sa4.sin_port);
+      break;
+#ifdef USE_IPV6
+    case AF_INET6:
+      *listenport = ntohs(localaddr.sa6.sin6_port);
+      break;
+#endif
+    default:
+      break;
+    }
+    if(!*listenport) {
+      /* Real failure, listener port shall not be zero beyond this point. */
+      logmsg("Apparently getsockname() succeeded, with listener port zero.");
+      logmsg("A valid reason for this failure is a binary built without");
+      logmsg("proper network library linkage. This might not be the only");
+      logmsg("reason, but double check it before anything else.");
+      sclose(sock);
+      return CURL_SOCKET_BAD;
+    }
+  }
+
+  /* bindonly option forces no listening */
+  if(bind_only) {
+    logmsg("instructed to bind port without listening");
+    return sock;
+  }
+
+  /* start accepting connections */
+  if(listen(sock, 5)) {
+    sockerr = SOCKERRNO;
+    logmsg("listen(%ld, 5) failed with error (%d) %s", (long)sock,
+           sockerr, curlx_strerror(sockerr, errbuf, sizeof(errbuf)));
+    sclose(sock);
+    return CURL_SOCKET_BAD;
+  }
+
+  return sock;
+}
diff --git a/third-party/curl/tests/server/util.h b/third-party/curl/tests/server/util.h
deleted file mode 100644
index a12f4dbf07..0000000000
--- a/third-party/curl/tests/server/util.h
+++ /dev/null
@@ -1,99 +0,0 @@
-#ifndef HEADER_CURL_SERVER_UTIL_H
-#define HEADER_CURL_SERVER_UTIL_H
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "server_setup.h"
-
-char *data_to_hex(char *data, size_t len);
-void logmsg(const char *msg, ...);
-long timediff(struct timeval newer, struct timeval older);
-
-#define TEST_DATA_PATH "%s/data/test%ld"
-#define ALTTEST_DATA_PATH "%s/test%ld"
-#define SERVERLOGS_LOCKDIR "lock"  /* within logdir */
-
-/* global variable, where to find the 'data' dir */
-extern const char *path;
-
-/* global variable, log file name */
-extern const char *serverlogfile;
-
-extern const char *cmdfile;
-
-#ifdef WIN32
-#include <process.h>
-#include <fcntl.h>
-
-#define sleep(sec) Sleep ((sec)*1000)
-
-#undef perror
-#define perror(m) win32_perror(m)
-void win32_perror(const char *msg);
-
-void win32_init(void);
-void win32_cleanup(void);
-const char *sstrerror(int err);
-#else   /* WIN32 */
-
-#define sstrerror(e) strerror(e)
-#endif  /* WIN32 */
-
-/* fopens the test case file */
-FILE *test2fopen(long testno, const char *logdir);
-
-int wait_ms(int timeout_ms);
-curl_off_t our_getpid(void);
-int write_pidfile(const char *filename);
-int write_portfile(const char *filename, int port);
-void set_advisor_read_lock(const char *filename);
-void clear_advisor_read_lock(const char *filename);
-int strncasecompare(const char *first, const char *second, size_t max);
-
-/* global variable which if set indicates that the program should finish */
-extern volatile int got_exit_signal;
-
-/* global variable which if set indicates the first signal handled */
-extern volatile int exit_signal;
-
-#ifdef WIN32
-/* global event which if set indicates that the program should finish */
-extern HANDLE exit_event;
-#endif
-
-void install_signal_handlers(bool keep_sigalrm);
-void restore_signal_handlers(bool keep_sigalrm);
-
-#ifdef USE_UNIX_SOCKETS
-
-#include <curl/curl.h> /* for curl_socket_t */
-
-#ifdef HAVE_SYS_UN_H
-#include <sys/un.h> /* for sockaddr_un */
-#endif /* HAVE_SYS_UN_H */
-
-int bind_unix_socket(curl_socket_t sock, const char *unix_socket,
-        struct sockaddr_un *sau);
-#endif  /* USE_UNIX_SOCKETS */
-
-#endif  /* HEADER_CURL_SERVER_UTIL_H */
diff --git a/third-party/curl/tests/serverhelp.pm b/third-party/curl/tests/serverhelp.pm
index 502b6eb440..66c971b499 100644
--- a/third-party/curl/tests/serverhelp.pm
+++ b/third-party/curl/tests/serverhelp.pm
@@ -29,6 +29,8 @@ package serverhelp;
 use strict;
 use warnings;
 
+use Time::HiRes;
+
 BEGIN {
     use base qw(Exporter);
 
@@ -45,25 +47,27 @@ BEGIN {
         server_cmdfilename
         server_inputfilename
         server_outputfilename
+        server_exe
+        server_exe_args
         mainsockf_pidfilename
         mainsockf_logfilename
         datasockf_pidfilename
         datasockf_logfilename
     );
-
-    # sub second timestamping needs Time::HiRes
-    eval {
-        no warnings "all";
-        require Time::HiRes;
-        import  Time::HiRes qw( gettimeofday );
-    }
 }
 
+use globalconfig;
+use pathhelp qw(
+    exe_ext
+    );
+use testutil qw(
+    exerunner
+    );
 
-our $logfile;  # server log file name, for logmsg
+our $logfile;  # server log filename, for logmsg
 
 #***************************************************************************
-# Just for convenience, test harness uses 'https' and 'httptls' literals as
+# For convenience, test harness uses 'https' and 'httptls' literals as
 # values for 'proto' variable in order to differentiate different servers.
 # 'https' literal is used for stunnel based https test servers, and 'httptls'
 # is used for non-stunnel https test servers.
@@ -72,28 +76,19 @@ our $logfile;  # server log file name, for logmsg
 # logmsg is general message logging subroutine for our test servers.
 #
 sub logmsg {
-    my $now;
-    # sub second timestamping needs Time::HiRes
-    if($Time::HiRes::VERSION) {
-        my ($seconds, $usec) = gettimeofday();
-        my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) =
-            localtime($seconds);
-        $now = sprintf("%02d:%02d:%02d.%06d ", $hour, $min, $sec, $usec);
-    }
-    else {
-        my $seconds = time();
-        my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) =
-            localtime($seconds);
-        $now = sprintf("%02d:%02d:%02d ", $hour, $min, $sec);
-    }
-    if(open(my $logfilefh, ">>", "$logfile")) {
+    my ($seconds, $usec) = Time::HiRes::gettimeofday();
+    my ($sec, $min, $hour, $mday, $mon, $year, $wday, $yday, $isdst) = localtime($seconds);
+    my $now = sprintf("%02d:%02d:%02d.%06d ", $hour, $min, $sec, $usec);
+    # we see warnings on Windows run that $logfile is used uninitialized
+    # TODO: not found yet where this comes from
+    $logfile = "serverhelp_uninitialized.log" if(!$logfile);
+    if(open(my $logfilefh, ">>", $logfile)) {
         print $logfilefh $now;
         print $logfilefh @_;
         close($logfilefh);
     }
 }
 
-
 #***************************************************************************
 # Return server characterization factors given a server id string.
 #
@@ -104,13 +99,13 @@ sub serverfactors {
     my $idnum;
 
     if($server =~
-        /^((ftp|http|imap|pop3|smtp|http-pipe)s?)(\d*)(-ipv6|)$/) {
+        /^((ftp|http|imap|pop3|smtp)s?)(\d*)(-ipv6|)$/) {
         $proto  = $1;
         $idnum  = ($3 && ($3 > 1)) ? $3 : 1;
         $ipvnum = ($4 && ($4 =~ /6$/)) ? 6 : 4;
     }
     elsif($server =~
-        /^(tftp|sftp|socks|ssh|rtsp|gopher|httptls)(\d*)(-ipv6|)$/) {
+        /^(dns|tftp|sftp|socks|ssh|rtsp|gopher|httptls)(\d*)(-ipv6|)$/) {
         $proto  = $1;
         $idnum  = ($2 && ($2 > 1)) ? $2 : 1;
         $ipvnum = ($3 && ($3 =~ /6$/)) ? 6 : 4;
@@ -121,7 +116,6 @@ sub serverfactors {
     return($proto, $ipvnum, $idnum);
 }
 
-
 #***************************************************************************
 # Return server name string formatted for presentation purposes
 #
@@ -130,7 +124,7 @@ sub servername_str {
 
     $proto = uc($proto) if($proto);
     die "unsupported protocol: '$proto'" unless($proto &&
-        ($proto =~ /^(((FTP|HTTP|HTTP\/2|HTTP\/3|IMAP|POP3|GOPHER|SMTP|HTTP-PIPE)S?)|(TFTP|SFTP|SOCKS|SSH|RTSP|HTTPTLS|DICT|SMB|SMBS|TELNET|MQTT))$/));
+        ($proto =~ /^(((DNS|FTP|HTTP|HTTP\/2|HTTP\/3|IMAP|POP3|GOPHER|SMTP|HTTPS-MTLS)S?)|(TFTP|SFTP|SOCKS|SSH|RTSP|HTTPTLS|DICT|SMB|SMBS|TELNET|MQTT|MQTTS))$/));
 
     $ipver = (not $ipver) ? 'ipv4' : lc($ipver);
     die "unsupported IP version: '$ipver'" unless($ipver &&
@@ -145,7 +139,6 @@ sub servername_str {
     return "${proto}${idnum}${ipver}";
 }
 
-
 #***************************************************************************
 # Return server name string formatted for identification purposes
 #
@@ -154,9 +147,8 @@ sub servername_id {
     return lc(servername_str($proto, $ipver, $idnum));
 }
 
-
 #***************************************************************************
-# Return server name string formatted for file name purposes
+# Return server name string formatted for filename purposes
 #
 sub servername_canon {
     my ($proto, $ipver, $idnum) = @_;
@@ -166,115 +158,131 @@ sub servername_canon {
     return $string;
 }
 
-
 #***************************************************************************
-# Return file name for server pid file.
+# Return filename for server pid file.
 #
 sub server_pidfilename {
     my ($piddir, $proto, $ipver, $idnum) = @_;
     my $trailer = '_server.pid';
-    return "${piddir}/". servername_canon($proto, $ipver, $idnum) ."$trailer";
+    return "${piddir}/". servername_canon($proto, $ipver, $idnum) . $trailer;
 }
 
 #***************************************************************************
-# Return file name for server port file.
+# Return filename for server port file.
 #
 sub server_portfilename {
     my ($piddir, $proto, $ipver, $idnum) = @_;
     my $trailer = '_server.port';
-    return "${piddir}/". servername_canon($proto, $ipver, $idnum) ."$trailer";
+    return "${piddir}/". servername_canon($proto, $ipver, $idnum) . $trailer;
 }
 
-
 #***************************************************************************
-# Return file name for server log file.
+# Return filename for server log file.
 #
 sub server_logfilename {
     my ($logdir, $proto, $ipver, $idnum) = @_;
     my $trailer = '_server.log';
     $trailer = '_stunnel.log' if(lc($proto) =~ /^(ftp|http|imap|pop3|smtp)s$/);
-    return "${logdir}/". servername_canon($proto, $ipver, $idnum) ."$trailer";
+    return "${logdir}/". servername_canon($proto, $ipver, $idnum) . $trailer;
 }
 
-
 #***************************************************************************
-# Return file name for server commands file.
+# Return filename for server commands file.
 #
 sub server_cmdfilename {
     my ($logdir, $proto, $ipver, $idnum) = @_;
     my $trailer = '_server.cmd';
-    return "${logdir}/". servername_canon($proto, $ipver, $idnum) ."$trailer";
+    return "${logdir}/". servername_canon($proto, $ipver, $idnum) . $trailer;
 }
 
-
 #***************************************************************************
-# Return file name for server input file.
+# Return filename for server input file.
 #
 sub server_inputfilename {
     my ($logdir, $proto, $ipver, $idnum) = @_;
     my $trailer = '_server.input';
-    return "${logdir}/". servername_canon($proto, $ipver, $idnum) ."$trailer";
+    return "${logdir}/". servername_canon($proto, $ipver, $idnum) . $trailer;
 }
 
-
 #***************************************************************************
-# Return file name for server output file.
+# Return filename for server output file.
 #
 sub server_outputfilename {
     my ($logdir, $proto, $ipver, $idnum) = @_;
     my $trailer = '_server.output';
-    return "${logdir}/". servername_canon($proto, $ipver, $idnum) ."$trailer";
+    return "${logdir}/". servername_canon($proto, $ipver, $idnum) . $trailer;
 }
 
+#***************************************************************************
+# Return filename for a server executable
+#
+sub server_exe {
+    my ($name, $ext) = @_;
+    if(!defined $ext) {
+        $ext = 'SRV';
+    }
+    return exerunner() . $SRVDIR . "servers" . exe_ext($ext) . " $name";
+}
 
 #***************************************************************************
-# Return file name for main or primary sockfilter pid file.
+# Return filename for a server executable as an argument list
+#
+sub server_exe_args {
+    my ($name, $ext) = @_;
+    if(!defined $ext) {
+        $ext = 'SRV';
+    }
+    my @cmd = ($SRVDIR . "servers" . exe_ext($ext), $name);
+    if($ENV{'CURL_TEST_EXE_RUNNER'}) {
+        unshift @cmd, $ENV{'CURL_TEST_EXE_RUNNER'};
+    }
+    return @cmd;
+}
+
+#***************************************************************************
+# Return filename for main or primary sockfilter pid file.
 #
 sub mainsockf_pidfilename {
     my ($piddir, $proto, $ipver, $idnum) = @_;
     die "unsupported protocol: '$proto'" unless($proto &&
         (lc($proto) =~ /^(ftp|imap|pop3|smtp)s?$/));
-    my $trailer = (lc($proto) =~ /^ftps?$/) ? '_sockctrl.pid':'_sockfilt.pid';
-    return "${piddir}/". servername_canon($proto, $ipver, $idnum) ."$trailer";
+    my $trailer = (lc($proto) =~ /^ftps?$/) ? '_sockctrl.pid' : '_sockfilt.pid';
+    return "${piddir}/". servername_canon($proto, $ipver, $idnum) . $trailer;
 }
 
-
 #***************************************************************************
-# Return file name for main or primary sockfilter log file.
+# Return filename for main or primary sockfilter log file.
 #
 sub mainsockf_logfilename {
     my ($logdir, $proto, $ipver, $idnum) = @_;
     die "unsupported protocol: '$proto'" unless($proto &&
         (lc($proto) =~ /^(ftp|imap|pop3|smtp)s?$/));
-    my $trailer = (lc($proto) =~ /^ftps?$/) ? '_sockctrl.log':'_sockfilt.log';
-    return "${logdir}/". servername_canon($proto, $ipver, $idnum) ."$trailer";
+    my $trailer = (lc($proto) =~ /^ftps?$/) ? '_sockctrl.log' : '_sockfilt.log';
+    return "${logdir}/". servername_canon($proto, $ipver, $idnum) . $trailer;
 }
 
-
 #***************************************************************************
-# Return file name for data or secondary sockfilter pid file.
+# Return filename for data or secondary sockfilter pid file.
 #
 sub datasockf_pidfilename {
     my ($piddir, $proto, $ipver, $idnum) = @_;
     die "unsupported protocol: '$proto'" unless($proto &&
         (lc($proto) =~ /^ftps?$/));
     my $trailer = '_sockdata.pid';
-    return "${piddir}/". servername_canon($proto, $ipver, $idnum) ."$trailer";
+    return "${piddir}/". servername_canon($proto, $ipver, $idnum) . $trailer;
 }
 
-
 #***************************************************************************
-# Return file name for data or secondary sockfilter log file.
+# Return filename for data or secondary sockfilter log file.
 #
 sub datasockf_logfilename {
     my ($logdir, $proto, $ipver, $idnum) = @_;
     die "unsupported protocol: '$proto'" unless($proto &&
         (lc($proto) =~ /^ftps?$/));
     my $trailer = '_sockdata.log';
-    return "${logdir}/". servername_canon($proto, $ipver, $idnum) ."$trailer";
+    return "${logdir}/". servername_canon($proto, $ipver, $idnum) . $trailer;
 }
 
-
 #***************************************************************************
 # End of library
 1;
diff --git a/third-party/curl/tests/servers.pm b/third-party/curl/tests/servers.pm
index 00753090f3..474a12c377 100644
--- a/third-party/curl/tests/servers.pm
+++ b/third-party/curl/tests/servers.pm
@@ -29,6 +29,7 @@
 package servers;
 
 use IO::Socket;
+use Time::HiRes;
 use strict;
 use warnings;
 
@@ -54,11 +55,11 @@ BEGIN {
         # functions
         qw(
             checkcmd
-            clearlocks
             serverfortest
             stopserver
             stopservers
             subvariables
+            localhttp
         ),
 
         # for debugging only
@@ -76,6 +77,7 @@ use serverhelp qw(
     server_pidfilename
     server_portfilename
     server_logfilename
+    server_exe
     );
 
 use sshhelp qw(
@@ -101,7 +103,9 @@ use sshhelp qw(
 use pathhelp qw(
     exe_ext
     os_is_win
+    build_sys_abs_path
     sys_native_abs_path
+    shell_quote
     );
 
 use processhelp;
@@ -110,53 +114,57 @@ use testutil qw(
     logmsg
     runclient
     runclientoutput
+    exerunner
     );
 
-
-my %serverpidfile; # all server pid file names, identified by server id
-my %serverportfile;# all server port file names, identified by server id
-my $sshdvernum;  # for socks server, ssh daemon version number
-my $sshdverstr;  # for socks server, ssh daemon version string
-my $sshderror;   # for socks server, ssh daemon version error
-my %doesntrun;    # servers that don't work, identified by pidfile
+my %serverpidfile; # all server pid filenames, identified by server id
+my %serverportfile;# all server port filenames, identified by server id
+my $sshdvernum;    # for socks server, ssh daemon version number
+my $sshdverstr;    # for socks server, ssh daemon version string
+my $sshderror;     # for socks server, ssh daemon version error
+my %doesntrun;     # servers that do not work, identified by pidfile
 my %PORT = (nolisten => 47); # port we use for a local non-listening service
-my $server_response_maxtime=13;
+my $server_response_maxtime = 13;
 my $httptlssrv = find_httptlssrv();
-my %run;          # running server
-my %runcert;      # cert file currently in use by an ssl running server
-my $CLIENTIP="127.0.0.1";  # address which curl uses for incoming connections
-my $CLIENT6IP="[::1]";     # address which curl uses for incoming connections
-my $posix_pwd=$pwd;        # current working directory
-my $h2cver = "h2c"; # this version is decided by the nghttp2 lib being used
-my $portrange = 999;       # space from which to choose a random port
-                           # don't increase without making sure generated port
-                           # numbers will always be valid (<=65535)
-my $HOSTIP="127.0.0.1";    # address on which the test server listens
-my $HOST6IP="[::1]";       # address on which the test server listens
-my $HTTPUNIXPATH;          # HTTP server Unix domain socket path
-my $SOCKSUNIXPATH;         # socks server Unix domain socket path
+my %run;           # running server
+my %runcert;       # cert file currently in use by an SSL running server
+my $CLIENTIP = "127.0.0.1";  # address which curl uses for incoming connections
+my $CLIENT6IP = "[::1]";     # address which curl uses for incoming connections
+my $posix_pwd = build_sys_abs_path($pwd);  # current working directory in POSIX format
+my $h2cver = "h2c";          # this version is decided by the nghttp2 lib being used
+my $HOSTIP = "127.0.0.1";    # address on which the test server listens
+my $HOST6IP = "[::1]";       # address on which the test server listens
+my $HTTPUNIXPATH;            # HTTP server Unix domain socket path
+my $SOCKSUNIXPATH;           # socks server Unix domain socket path
 my $SSHSRVMD5 = "[uninitialized]";    # MD5 of ssh server public key
 my $SSHSRVSHA256 = "[uninitialized]"; # SHA256 of ssh server public key
-my $USER;                  # name of the current user
-my $sshdid;                # for socks server, ssh daemon version id
-my $ftpchecktime=1;        # time it took to verify our test FTP server
+my $USER;                    # name of the current user
+my $sshdid;                  # for socks server, ssh daemon version id
+my $ftpchecktime = 1;        # time it took to verify our test FTP server
+my $SERVER_TIMEOUT_SEC = 15; # time for a server to spin up
 
 # Variables shared with runtests.pl
-our $SOCKSIN="socksd-request.log"; # what curl sent to the SOCKS proxy
+our $SOCKSIN = "socksd-request.log"; # what curl sent to the SOCKS proxy
 our $err_unexpected; # error instead of warning on server unexpectedly alive
 our $debugprotocol;  # nonzero for verbose server logs
 our $stunnel;        # path to stunnel command
 
-
 #######################################################################
 # Check for a command in the PATH of the test server.
 #
 sub checkcmd {
-    my ($cmd, @extrapaths)=@_;
-    my @paths=(split(m/[:]/, $ENV{'PATH'}), "/usr/sbin", "/usr/local/sbin",
-               "/sbin", "/usr/bin", "/usr/local/bin", @extrapaths);
+    my ($cmd, @extrapaths) = @_;
+    my @paths;
+    if($^O eq 'MSWin32' || $^O eq 'dos' || $^O eq 'os2') {
+        # PATH separator is different
+        @paths = (split(';', $ENV{'PATH'}), @extrapaths);
+    }
+    else {
+        @paths = (split(':', $ENV{'PATH'}), "/usr/sbin", "/usr/local/sbin",
+                  "/sbin", "/usr/bin", "/usr/local/bin", @extrapaths);
+    }
     for(@paths) {
-        if( -x "$_/$cmd" && ! -d "$_/$cmd") {
+        if(-x "$_/$cmd" . exe_ext('SYS') && ! -d "$_/$cmd" . exe_ext('SYS')) {
             # executable bit but not a directory!
             return "$_/$cmd";
         }
@@ -175,7 +183,7 @@ sub getfreeport {
                                  Type      => SOCK_STREAM,
                                  Reuse     => 1,
                                  Listen    => 10 )
-        or die "Couldn't create tcp server socket: $@\n";
+        or die "Could not create tcp server socket: $@\n";
 
     return $server->sockport();
 }
@@ -185,107 +193,79 @@ use File::Temp qw/ tempfile/;
 #######################################################################
 # Initialize configuration variables
 sub initserverconfig {
-    my ($fh, $socks) = tempfile("/tmp/curl-socksd-XXXXXXXX");
-    close($fh);
-    unlink($socks);
-    my ($f2, $http) = tempfile("/tmp/curl-http-XXXXXXXX");
-    close($f2);
-    unlink($http);
-    $SOCKSUNIXPATH = $socks; # SOCKS Unix domain socket
-    $HTTPUNIXPATH = $http;   # HTTP Unix domain socket
+    $SOCKSUNIXPATH = "$pwd/$LOGDIR/$PIDDIR/socks-uds"; # SOCKS Unix domain socket
+    $HTTPUNIXPATH = "$pwd/$LOGDIR/$PIDDIR/http-uds";   # HTTP Unix domain socket
     $stunnel = checkcmd("stunnel4") || checkcmd("tstunnel") || checkcmd("stunnel");
 
     # get the name of the current user
     $USER = $ENV{USER};          # Linux
-    if (!$USER) {
+    if(!$USER) {
         $USER = $ENV{USERNAME};     # Windows
-        if (!$USER) {
-            $USER = $ENV{LOGNAME};  # Some Unix (I think)
-        }
+    }
+    if(!$USER) {
+        $USER = $ENV{LOGNAME};  # Some Unix (I think)
+    }
+    if(!$USER) {
+        $USER = qx(whoami);
+        chomp $USER;
+    }
+    if(!$USER) {
+        $USER = qx(id -un);
+        chomp $USER;
     }
     init_serverpidfile_hash();
 }
 
 #######################################################################
-# Load serverpidfile and serverportfile hashes with file names for all
+# Load serverpidfile and serverportfile hashes with filenames for all
 # possible servers.
 #
 sub init_serverpidfile_hash {
-  for my $proto (('ftp', 'gopher', 'http', 'imap', 'pop3', 'smtp', 'http/2', 'http/3')) {
-    for my $ssl (('', 's')) {
-      for my $ipvnum ((4, 6)) {
-        for my $idnum ((1, 2, 3)) {
-          my $serv = servername_id("$proto$ssl", $ipvnum, $idnum);
-          my $pidf = server_pidfilename("$LOGDIR/$PIDDIR", "$proto$ssl",
-                                        $ipvnum, $idnum);
-          $serverpidfile{$serv} = $pidf;
-          my $portf = server_portfilename("$LOGDIR/$PIDDIR", "$proto$ssl",
-                                          $ipvnum, $idnum);
-          $serverportfile{$serv} = $portf;
-        }
-      }
-    }
-  }
-  for my $proto (('tftp', 'sftp', 'socks', 'ssh', 'rtsp', 'httptls',
-                  'dict', 'smb', 'smbs', 'telnet', 'mqtt')) {
-    for my $ipvnum ((4, 6)) {
-      for my $idnum ((1, 2)) {
-        my $serv = servername_id($proto, $ipvnum, $idnum);
-        my $pidf = server_pidfilename("$LOGDIR/$PIDDIR", $proto, $ipvnum,
-                                      $idnum);
-        $serverpidfile{$serv} = $pidf;
-        my $portf = server_portfilename("$LOGDIR/$PIDDIR", $proto, $ipvnum,
-                                        $idnum);
-        $serverportfile{$serv} = $portf;
-      }
-    }
-  }
-  for my $proto (('http', 'imap', 'pop3', 'smtp', 'http/2', 'http/3')) {
-    for my $ssl (('', 's')) {
-      my $serv = servername_id("$proto$ssl", "unix", 1);
-      my $pidf = server_pidfilename("$LOGDIR/$PIDDIR", "$proto$ssl",
-                                    "unix", 1);
-      $serverpidfile{$serv} = $pidf;
-      my $portf = server_portfilename("$LOGDIR/$PIDDIR", "$proto$ssl",
-                                      "unix", 1);
-      $serverportfile{$serv} = $portf;
-    }
-  }
-}
-
-
-#######################################################################
-# Kill the processes that still have lock files in a directory
-#
-sub clearlocks {
-    my $dir = $_[0];
-    my $done = 0;
-
-    if(os_is_win()) {
-        $dir = sys_native_abs_path($dir);
-        $dir =~ s/\//\\\\/g;
-        my $handle = "handle.exe";
-        if($ENV{"PROCESSOR_ARCHITECTURE"} =~ /64$/) {
-            $handle = "handle64.exe";
-        }
-        my @handles = `$handle $dir -accepteula -nobanner`;
-        for my $tryhandle (@handles) {
-            if($tryhandle =~ /^(\S+)\s+pid:\s+(\d+)\s+type:\s+(\w+)\s+([0-9A-F]+):\s+(.+)\r\r/) {
-                logmsg "Found $3 lock of '$5' ($4) by $1 ($2)\n";
-                # Ignore stunnel since we cannot do anything about its locks
-                if("$3" eq "File" && "$1" ne "tstunnel.exe") {
-                    logmsg "Killing IMAGENAME eq $1 and PID eq $2\n";
-                    system("taskkill.exe -f -fi \"IMAGENAME eq $1\" -fi \"PID eq $2\" >nul 2>&1");
-                    $done = 1;
+    for my $proto (('ftp', 'gopher', 'http', 'imap', 'pop3', 'smtp', 'http/2', 'http/3')) {
+        for my $ssl (('', 's')) {
+            for my $ipvnum ((4, 6)) {
+                for my $idnum ((1, 2, 3)) {
+                    my $serv = servername_id("$proto$ssl", $ipvnum, $idnum);
+                    my $pidf = server_pidfilename("$LOGDIR/$PIDDIR", "$proto$ssl",
+                                                  $ipvnum, $idnum);
+                    $serverpidfile{$serv} = $pidf;
+                    my $portf = server_portfilename("$LOGDIR/$PIDDIR", "$proto$ssl",
+                                                    $ipvnum, $idnum);
+                    $serverportfile{$serv} = $portf;
                 }
             }
         }
     }
-    return $done;
+    for my $proto (('tftp', 'sftp', 'socks', 'ssh', 'rtsp', 'httptls',
+                    'dict', 'smb', 'smbs', 'telnet', 'mqtt', 'mqtts',
+                    'https-mtls', 'dns')) {
+        for my $ipvnum ((4, 6)) {
+            for my $idnum ((1, 2)) {
+                my $serv = servername_id($proto, $ipvnum, $idnum);
+                my $pidf = server_pidfilename("$LOGDIR/$PIDDIR", $proto, $ipvnum,
+                                              $idnum);
+                $serverpidfile{$serv} = $pidf;
+                my $portf = server_portfilename("$LOGDIR/$PIDDIR", $proto, $ipvnum,
+                                                $idnum);
+                $serverportfile{$serv} = $portf;
+            }
+        }
+    }
+    for my $proto (('http', 'imap', 'pop3', 'smtp', 'http/2', 'http/3')) {
+        for my $ssl (('', 's')) {
+            my $serv = servername_id("$proto$ssl", "unix", 1);
+            my $pidf = server_pidfilename("$LOGDIR/$PIDDIR", "$proto$ssl",
+                                          "unix", 1);
+            $serverpidfile{$serv} = $pidf;
+            my $portf = server_portfilename("$LOGDIR/$PIDDIR", "$proto$ssl",
+                                            "unix", 1);
+            $serverportfile{$serv} = $portf;
+        }
+    }
 }
 
 #######################################################################
-# Check if a given child process has just died. Reaps it if so.
+# Check if a given child process has died. Reaps it if so.
 #
 sub checkdied {
     my $pid = $_[0];
@@ -294,10 +274,9 @@ sub checkdied {
     }
     use POSIX ":sys_wait_h";
     my $rc = pidwait($pid, &WNOHANG);
-    return ($rc == $pid)?1:0;
+    return ($rc == $pid) ? 1 : 0;
 }
 
-
 ##############################################################################
 # This function makes sure the right set of server is running for the
 # specified test case. This is a useful design when we run single tests as not
@@ -312,11 +291,12 @@ sub checkdied {
 #          4 for an unsupported server type
 #
 sub serverfortest {
-    my (@what)=@_;
+    my (@what) = @_;
 
     for(my $i = scalar(@what) - 1; $i >= 0; $i--) {
         my $srvrline = $what[$i];
         chomp $srvrline if($srvrline);
+
         if($srvrline =~ /^(\S+)((\s*)(.*))/) {
             my $server = "${1}";
             my $lnrest = "${2}";
@@ -325,8 +305,13 @@ sub serverfortest {
                 $server = "${1}${4}${5}";
                 $tlsext = uc("TLS-${3}");
             }
-            if(! grep /^\Q$server\E$/, @protocols) {
-                if(substr($server,0,5) ne "socks") {
+
+            my @lprotocols = @protocols;
+
+            push @lprotocols, "dns";
+
+            if(! grep /^\Q$server\E$/, @lprotocols) {
+                if(substr($server, 0, 5) ne "socks") {
                     if($tlsext) {
                         return ("curl lacks $tlsext support", 4);
                     }
@@ -342,15 +327,14 @@ sub serverfortest {
     return &startservers(@what);
 }
 
-
 #######################################################################
 # Start a new thread/process and run the given command line in there.
 # Return the pids (yes plural) of the new child process to the parent.
 #
 sub startnew {
-    my ($cmd, $pidfile, $timeout, $fakepidfile)=@_;
+    my ($cmd, $pidfile, $timeout, $fakepidfile) = @_;
 
-    logmsg "startnew: $cmd\n" if ($verbose);
+    logmsg "startnew: $cmd\n" if($verbose);
 
     my $child = fork();
 
@@ -367,26 +351,26 @@ sub startnew {
 
         # Put an "exec" in front of the command so that the child process
         # keeps this child's process ID.
-        exec("exec $cmd") || die "Can't exec() $cmd: $!";
+        exec("exec $cmd") or die "Cannot exec() $cmd: $!";
 
         # exec() should never return back here to this process. We protect
-        # ourselves by calling die() just in case something goes really bad.
+        # ourselves by calling die() in case something goes really bad.
         die "error: exec() has returned";
     }
 
-    # Ugly hack but ssh client and gnutls-serv don't support pid files
-    if ($fakepidfile) {
-        if(open(my $out, ">", "$pidfile")) {
+    # Ugly hack but ssh client and gnutls-serv do not support pid files
+    if($fakepidfile) {
+        if(open(my $out, ">", $pidfile)) {
             print $out $child . "\n";
-            close($out) || die "Failure writing pidfile";
+            close($out) or die "Failure writing pidfile";
             logmsg "startnew: $pidfile faked with pid=$child\n" if($verbose);
         }
         else {
             logmsg "startnew: failed to write fake $pidfile with pid=$child\n";
         }
         # could/should do a while connect fails sleep a bit and loop
-        portable_sleep($timeout);
-        if (checkdied($child)) {
+        Time::HiRes::sleep($timeout);
+        if(checkdied($child)) {
             logmsg "startnew: child process has failed to start\n" if($verbose);
             return (-1,-1);
         }
@@ -395,20 +379,20 @@ sub startnew {
     my $pid2 = 0;
     my $count = $timeout;
     while($count--) {
-        $pid2 = pidfromfile($pidfile);
+        $pid2 = pidfromfile($pidfile, 0);
         if(($pid2 > 0) && pidexists($pid2)) {
             # if $pid2 is valid, then make sure this pid is alive, as
-            # otherwise it is just likely to be the _previous_ pidfile or
+            # otherwise it is likely to be the _previous_ pidfile or
             # similar!
             last;
         }
-        if (checkdied($child)) {
+        if(checkdied($child)) {
             logmsg "startnew: child process has died, server might start up\n"
                 if($verbose);
-            # We can't just abort waiting for the server with a
+            # We cannot abort waiting for the server with a
             # return (-1,-1);
             # because the server might have forked and could still start
-            # up normally. Instead, just reduce the amount of time we remain
+            # up normally. Instead, reduce the amount of time we remain
             # waiting.
             $count >>= 2;
         }
@@ -421,7 +405,6 @@ sub startnew {
     return ($child, $pid2);
 }
 
-
 #######################################################################
 # Return the port to use for the given protocol.
 #
@@ -430,13 +413,13 @@ sub protoport {
     return $PORT{$proto} || "[not running]";
 }
 
-
 #######################################################################
-# Stop a test server along with pids which aren't in the %run hash yet.
+# Stop a test server along with pids which are not in the %run hash yet.
 # This also stops all servers which are relative to the given one.
 #
 sub stopserver {
     my ($server, $pidlist) = @_;
+    my $ipvnum = 4;
 
     #
     # kill sockfilter processes for pingpong relative server
@@ -444,7 +427,7 @@ sub stopserver {
     if($server =~ /^(ftp|imap|pop3|smtp)s?(\d*)(-ipv6|)$/) {
         my $proto  = $1;
         my $idnum  = ($2 && ($2 > 1)) ? $2 : 1;
-        my $ipvnum = ($3 && ($3 =~ /6$/)) ? 6 : 4;
+        $ipvnum = ($3 && ($3 =~ /6$/)) ? 6 : 4;
         killsockfilters("$LOGDIR/$PIDDIR", $proto, $ipvnum, $idnum, $verbose);
     }
     #
@@ -452,11 +435,11 @@ sub stopserver {
     #
     my @killservers;
     if($server =~ /^(ftp|http|imap|pop3|smtp)s((\d*)(-ipv6|-unix|))$/) {
-        # given a stunnel based ssl server, also kill non-ssl underlying one
+        # given a stunnel based SSL server, also kill non-SSL underlying one
         push @killservers, "${1}${2}";
     }
     elsif($server =~ /^(ftp|http|imap|pop3|smtp)((\d*)(-ipv6|-unix|))$/) {
-        # given a non-ssl server, also kill stunnel based ssl piggybacking one
+        # given a non-SSL server, also kill stunnel based SSL piggybacking one
         push @killservers, "${1}s${2}";
     }
     elsif($server =~ /^(socks)((\d*)(-ipv6|))$/) {
@@ -493,25 +476,29 @@ sub stopserver {
     my $result = 0;
     foreach my $server (@killservers) {
         my $pidfile = $serverpidfile{$server};
-        my $pid = processexists($pidfile);
-        if($pid > 0) {
-            if($err_unexpected) {
-                logmsg "ERROR: ";
-                $result = -1;
-            }
-            else {
-                logmsg "Warning: ";
-            }
-            logmsg "$server server unexpectedly alive\n";
-            killpid($verbose, $pid);
-        }
         unlink($pidfile) if(-f $pidfile);
     }
+    #
+    # cleanup server lock files
+    #
+    foreach my $server (@killservers) {
+        # servers seem to produce (some of) these lock files
+        my @lockfiles = (
+            "$LOGDIR/$LOCKDIR/$server.lock",
+            "$LOGDIR/$LOCKDIR/$server-IPv$ipvnum.lock",
+            "$LOGDIR/$LOCKDIR/sws-".uc($server)."-IPv$ipvnum.lock"
+            );
+        foreach my $lockfile (@lockfiles) {
+            if(-f $lockfile) {
+                unlink($lockfile);
+                logmsg "RUN: kill $server, cleaned up $lockfile\n" if($verbose);
+            }
+        }
+    }
 
     return $result;
 }
 
-
 #######################################################################
 # Return flags to let curl use an external HTTP proxy
 #
@@ -522,27 +509,28 @@ sub getexternalproxyflags {
 #######################################################################
 # Verify that the server that runs on $ip, $port is our server.  This also
 # implies that we can speak with it, as there might be occasions when the
-# server runs fine but we cannot talk to it ("Failed to connect to ::1: Can't
+# server runs fine but we cannot talk to it ("Failed to connect to ::1: Cannot
 # assign requested address")
 #
 sub verifyhttp {
-    my ($proto, $ipvnum, $idnum, $ip, $port_or_path) = @_;
+    my ($proto, $ipvnum, $idnum, $ip, $port_or_path, $do_http3) = @_;
     my $server = servername_id($proto, $ipvnum, $idnum);
-    my $bonus="";
+    my $bonus = "";
     # $port_or_path contains a path for Unix sockets, sws ignores the port
     my $port = ($ipvnum eq "unix") ? 80 : $port_or_path;
+    my $infix = ($do_http3) ? "_h3" : "";
 
     my $verifyout = "$LOGDIR/".
-        servername_canon($proto, $ipvnum, $idnum) .'_verify.out';
+        servername_canon($proto, $ipvnum, $idnum) .$infix .'_verify.out';
     unlink($verifyout) if(-f $verifyout);
 
     my $verifylog = "$LOGDIR/".
-        servername_canon($proto, $ipvnum, $idnum) .'_verify.log';
+        servername_canon($proto, $ipvnum, $idnum) .$infix .'_verify.log';
     unlink($verifylog) if(-f $verifylog);
 
     if($proto eq "gopher") {
         # gopher is funny
-        $bonus="1/";
+        $bonus = "1/";
     }
 
     my $flags = "--max-time $server_response_maxtime ";
@@ -555,9 +543,10 @@ sub verifyhttp {
     if($proxy_address) {
         $flags .= getexternalproxyflags();
     }
+    $flags .= "--http3-only " if($do_http3);
     $flags .= "\"$proto://$ip:$port/${bonus}verifiedserver\"";
 
-    my $cmd = "$VCURL $flags 2>$verifylog";
+    my $cmd = exerunner() . "$VCURL $flags 2>$verifylog";
 
     # verify if our/any server is running on this port
     logmsg "RUN: $cmd\n" if($verbose);
@@ -571,7 +560,7 @@ sub verifyhttp {
 
     if($res && $verbose) {
         logmsg "RUN: curl command returned $res\n";
-        if(open(my $file, "<", "$verifylog")) {
+        if(open(my $file, "<", $verifylog)) {
             while(my $string = <$file>) {
                 logmsg "RUN: $string" if($string !~ /^([ \t]*)$/);
             }
@@ -580,7 +569,7 @@ sub verifyhttp {
     }
 
     my $data;
-    if(open(my $file, "<", "$verifyout")) {
+    if(open(my $file, "<", $verifyout)) {
         while(my $string = <$file>) {
             $data = $string;
             last; # only want first line
@@ -593,7 +582,7 @@ sub verifyhttp {
         $pid = 0+$1;
     }
     elsif($res == 6) {
-        # curl: (6) Couldn't resolve host '::1'
+        # curl: (6) Could not resolve hostname '::1'
         logmsg "RUN: failed to resolve host ($proto://$ip:$port/verifiedserver)\n";
         return -1;
     }
@@ -607,14 +596,14 @@ sub verifyhttp {
 #######################################################################
 # Verify that the server that runs on $ip, $port is our server.  This also
 # implies that we can speak with it, as there might be occasions when the
-# server runs fine but we cannot talk to it ("Failed to connect to ::1: Can't
+# server runs fine but we cannot talk to it ("Failed to connect to ::1: Cannot
 # assign requested address")
 #
 sub verifyftp {
     my ($proto, $ipvnum, $idnum, $ip, $port) = @_;
     my $server = servername_id($proto, $ipvnum, $idnum);
-    my $time=time();
-    my $extra="";
+    my $time = time();
+    my $extra = "";
 
     my $verifylog = "$LOGDIR/".
         servername_canon($proto, $ipvnum, $idnum) .'_verify.log';
@@ -634,7 +623,7 @@ sub verifyftp {
     }
     $flags .= "\"$proto://$ip:$port/verifiedserver\"";
 
-    my $cmd = "$VCURL $flags 2>$verifylog";
+    my $cmd = exerunner() . "$VCURL $flags 2>$verifylog";
 
     # check if this is our server running on this port:
     logmsg "RUN: $cmd\n" if($verbose);
@@ -661,12 +650,12 @@ sub verifyftp {
     }
     # we can/should use the time it took to verify the FTP server as a measure
     # on how fast/slow this host/FTP is.
-    my $took = int(0.5+time()-$time);
+    my $took = int(0.5 + time() - $time);
 
     if($verbose) {
         logmsg "RUN: Verifying our test $server server took $took seconds\n";
     }
-    $ftpchecktime = $took>=1?$took:1; # make sure it never is below 1
+    $ftpchecktime = ($took >= 1) ? $took : 1; # make sure it never is below 1
 
     return $pid;
 }
@@ -674,7 +663,7 @@ sub verifyftp {
 #######################################################################
 # Verify that the server that runs on $ip, $port is our server.  This also
 # implies that we can speak with it, as there might be occasions when the
-# server runs fine but we cannot talk to it ("Failed to connect to ::1: Can't
+# server runs fine but we cannot talk to it ("Failed to connect to ::1: Cannot
 # assign requested address")
 #
 sub verifyrtsp {
@@ -700,7 +689,7 @@ sub verifyrtsp {
     # currently verification is done using http
     $flags .= "\"http://$ip:$port/verifiedserver\"";
 
-    my $cmd = "$VCURL $flags 2>$verifylog";
+    my $cmd = exerunner() . "$VCURL $flags 2>$verifylog";
 
     # verify if our/any server is running on this port
     logmsg "RUN: $cmd\n" if($verbose);
@@ -714,7 +703,7 @@ sub verifyrtsp {
 
     if($res && $verbose) {
         logmsg "RUN: curl command returned $res\n";
-        if(open(my $file, "<", "$verifylog")) {
+        if(open(my $file, "<", $verifylog)) {
             while(my $string = <$file>) {
                 logmsg "RUN: $string" if($string !~ /^[ \t]*$/);
             }
@@ -723,7 +712,7 @@ sub verifyrtsp {
     }
 
     my $data;
-    if(open(my $file, "<", "$verifyout")) {
+    if(open(my $file, "<", $verifyout)) {
         while(my $string = <$file>) {
             $data = $string;
             last; # only want first line
@@ -736,7 +725,7 @@ sub verifyrtsp {
         $pid = 0+$1;
     }
     elsif($res == 6) {
-        # curl: (6) Couldn't resolve host '::1'
+        # curl: (6) Could not resolve hostname '::1'
         logmsg "RUN: failed to resolve host ($proto://$ip:$port/verifiedserver)\n";
         return -1;
     }
@@ -771,13 +760,13 @@ sub verifysftp {
     my ($proto, $ipvnum, $idnum, $ip, $port) = @_;
     my $server = servername_id($proto, $ipvnum, $idnum);
     my $verified = 0;
-    # Find out sftp client canonical file name
+    # Find out sftp client canonical filename
     my $sftp = find_sftp();
     if(!$sftp) {
         logmsg "RUN: SFTP server cannot find $sftpexe\n";
         return -1;
     }
-    # Find out ssh client canonical file name
+    # Find out ssh client canonical filename
     my $ssh = find_ssh();
     if(!$ssh) {
         logmsg "RUN: SFTP server cannot find $sshexe\n";
@@ -788,7 +777,7 @@ sub verifysftp {
     my $cmd = "\"$sftp\" -b $LOGDIR/$PIDDIR/$sftpcmds -F $LOGDIR/$PIDDIR/$sftpconfig -S \"$ssh\" $ip > $sftplog 2>&1";
     my $res = runclient($cmd);
     # Search for pwd command response in log file
-    if(open(my $sftplogfile, "<", "$sftplog")) {
+    if(open(my $sftplogfile, "<", $sftplog)) {
         while(<$sftplogfile>) {
             if(/^Remote working directory: /) {
                 $verified = 1;
@@ -804,7 +793,7 @@ sub verifysftp {
 # Verify that the non-stunnel HTTP TLS extensions capable server that runs
 # on $ip, $port is our server.  This also implies that we can speak with it,
 # as there might be occasions when the server runs fine but we cannot talk
-# to it ("Failed to connect to ::1: Can't assign requested address")
+# to it ("Failed to connect to ::1: Cannot assign requested address")
 #
 sub verifyhttptls {
     my ($proto, $ipvnum, $idnum, $ip, $port) = @_;
@@ -833,7 +822,7 @@ sub verifyhttptls {
     }
     $flags .= "\"https://$ip:$port/verifiedserver\"";
 
-    my $cmd = "$VCURL $flags 2>$verifylog";
+    my $cmd = exerunner() . "$VCURL $flags 2>$verifylog";
 
     # verify if our/any server is running on this port
     logmsg "RUN: $cmd\n" if($verbose);
@@ -847,7 +836,7 @@ sub verifyhttptls {
 
     if($res && $verbose) {
         logmsg "RUN: curl command returned $res\n";
-        if(open(my $file, "<", "$verifylog")) {
+        if(open(my $file, "<", $verifylog)) {
             while(my $string = <$file>) {
                 logmsg "RUN: $string" if($string !~ /^([ \t]*)$/);
             }
@@ -856,7 +845,7 @@ sub verifyhttptls {
     }
 
     my $data;
-    if(open(my $file, "<", "$verifyout")) {
+    if(open(my $file, "<", $verifyout)) {
         while(my $string = <$file>) {
             $data .= $string;
         }
@@ -871,7 +860,7 @@ sub verifyhttptls {
         return $pid;
     }
     elsif($res == 6) {
-        # curl: (6) Couldn't resolve host '::1'
+        # curl: (6) Could not resolve hostname '::1'
         logmsg "RUN: failed to resolve host (https://$ip:$port/verifiedserver)\n";
         return -1;
     }
@@ -883,15 +872,15 @@ sub verifyhttptls {
 }
 
 #######################################################################
-# STUB for verifying socks
+# For verifying mqtt and socks
 #
-sub verifysocks {
+sub verifypid {
     my ($proto, $ipvnum, $idnum, $ip, $port) = @_;
     my $pidfile = server_pidfilename("$LOGDIR/$PIDDIR", $proto, $ipvnum,
                                      $idnum);
     my $pid = processexists($pidfile);
     if($pid < 0) {
-        logmsg "RUN: SOCKS server has died after starting up\n";
+        logmsg "RUN: $proto server has died\n";
     }
     return $pid;
 }
@@ -899,14 +888,14 @@ sub verifysocks {
 #######################################################################
 # Verify that the server that runs on $ip, $port is our server.  This also
 # implies that we can speak with it, as there might be occasions when the
-# server runs fine but we cannot talk to it ("Failed to connect to ::1: Can't
+# server runs fine but we cannot talk to it ("Failed to connect to ::1: Cannot
 # assign requested address")
 #
 sub verifysmb {
     my ($proto, $ipvnum, $idnum, $ip, $port) = @_;
     my $server = servername_id($proto, $ipvnum, $idnum);
-    my $time=time();
-    my $extra="";
+    my $time = time();
+    my $extra = "";
 
     my $verifylog = "$LOGDIR/".
         servername_canon($proto, $ipvnum, $idnum) .'_verify.log';
@@ -920,7 +909,7 @@ sub verifysmb {
     $flags .= $extra;
     $flags .= "\"$proto://$ip:$port/SERVER/verifiedserver\"";
 
-    my $cmd = "$VCURL $flags 2>$verifylog";
+    my $cmd = exerunner() . "$VCURL $flags 2>$verifylog";
 
     # check if this is our server running on this port:
     logmsg "RUN: $cmd\n" if($verbose);
@@ -959,14 +948,14 @@ sub verifysmb {
 #######################################################################
 # Verify that the server that runs on $ip, $port is our server.  This also
 # implies that we can speak with it, as there might be occasions when the
-# server runs fine but we cannot talk to it ("Failed to connect to ::1: Can't
+# server runs fine but we cannot talk to it ("Failed to connect to ::1: Cannot
 # assign requested address")
 #
 sub verifytelnet {
     my ($proto, $ipvnum, $idnum, $ip, $port) = @_;
     my $server = servername_id($proto, $ipvnum, $idnum);
-    my $time=time();
-    my $extra="";
+    my $time = time();
+    my $extra = "";
 
     my $verifylog = "$LOGDIR/".
         servername_canon($proto, $ipvnum, $idnum) .'_verify.log';
@@ -980,7 +969,8 @@ sub verifytelnet {
     $flags .= $extra;
     $flags .= "\"$proto://$ip:$port\"";
 
-    my $cmd = "echo 'verifiedserver' | $VCURL $flags 2>$verifylog";
+    my $cmd = "echo 'verifiedserver' | " .
+        exerunner() . "$VCURL $flags 2>$verifylog";
 
     # check if this is our server running on this port:
     logmsg "RUN: $cmd\n" if($verbose);
@@ -1022,7 +1012,7 @@ sub verifytelnet {
 # particular can take a long time to start if it needs to generate
 # keys on a slow or loaded host.
 #
-# Just for convenience, test harness uses 'https' and 'httptls' literals
+# For convenience, test harness uses 'https' and 'httptls' literals
 # as values for 'proto' variable in order to differentiate different
 # servers. 'https' literal is used for stunnel based https test servers,
 # and 'httptls' is used for non-stunnel https test servers.
@@ -1030,6 +1020,7 @@ sub verifytelnet {
 
 my %protofunc = ('http' => \&verifyhttp,
                  'https' => \&verifyhttp,
+                 'https-mtls' => \&verifypid,
                  'rtsp' => \&verifyrtsp,
                  'ftp' => \&verifyftp,
                  'pop3' => \&verifyftp,
@@ -1038,51 +1029,31 @@ my %protofunc = ('http' => \&verifyhttp,
                  'ftps' => \&verifyftp,
                  'pop3s' => \&verifyftp,
                  'imaps' => \&verifyftp,
+                 'mqtt' => \&verifypid,
+                 'mqtts' => \&verifypid,
                  'smtps' => \&verifyftp,
                  'tftp' => \&verifyftp,
                  'ssh' => \&verifyssh,
-                 'socks' => \&verifysocks,
-                 'socks5unix' => \&verifysocks,
+                 'dns' => \&verifypid,
+                 'socks' => \&verifypid,
+                 'socks5unix' => \&verifypid,
                  'gopher' => \&verifyhttp,
                  'httptls' => \&verifyhttptls,
                  'dict' => \&verifyftp,
                  'smb' => \&verifysmb,
                  'telnet' => \&verifytelnet);
 
-sub verifyserver {
-    my ($proto, $ipvnum, $idnum, $ip, $port) = @_;
-
-    my $count = 30; # try for this many seconds
-    my $pid;
-
-    while($count--) {
-        my $fun = $protofunc{$proto};
-
-        $pid = &$fun($proto, $ipvnum, $idnum, $ip, $port);
-
-        if($pid > 0) {
-            last;
-        }
-        elsif($pid < 0) {
-            # a real failure, stop trying and bail out
-            return 0;
-        }
-        sleep(1);
-    }
-    return $pid;
-}
-
 #######################################################################
 # Single shot server responsiveness test. This should only be used
 # to verify that a server present in %run hash is still functional
 #
 sub responsiveserver {
-    my ($proto, $ipvnum, $idnum, $ip, $port) = @_;
+    my ($proto, $ipvnum, $idnum, $ip, $port, $do_http3) = @_;
     my $prev_verbose = $verbose;
 
     $verbose = 0;
     my $fun = $protofunc{$proto};
-    my $pid = &$fun($proto, $ipvnum, $idnum, $ip, $port);
+    my $pid = &$fun($proto, $ipvnum, $idnum, $ip, $port, $do_http3);
     $verbose = $prev_verbose;
 
     if($pid > 0) {
@@ -1094,7 +1065,6 @@ sub responsiveserver {
     return 0;
 }
 
-
 #######################################################################
 # start the http server
 #
@@ -1103,7 +1073,7 @@ sub runhttpserver {
     my $ip = $HOSTIP;
     my $ipvnum = 4;
     my $idnum = 1;
-    my $exe = "$perl $srcdir/http-server.pl";
+    my $exe = "$perl " . shell_quote("$srcdir/http-server.pl");
     my $verbose_flag = "--verbose ";
     my $keepalive_secs = 30; # forwarded to sws, was 5 by default which
                              # led to pukes in CI jobs
@@ -1126,14 +1096,14 @@ sub runhttpserver {
 
     my $pidfile = $serverpidfile{$server};
 
-    # don't retry if the server doesn't work
-    if ($doesntrun{$pidfile}) {
+    # do not retry if the server does not work
+    if($doesntrun{$pidfile}) {
         return (2, 0, 0, 0);
     }
 
     my $pid = processexists($pidfile);
     if($pid > 0) {
-        stopserver($server, "$pid");
+        stopserver($server, $pid);
     }
     unlink($pidfile) if(-f $pidfile);
 
@@ -1160,32 +1130,27 @@ sub runhttpserver {
     $flags .= "--srcdir \"$srcdir\"";
 
     my $cmd = "$exe $flags";
+
+    unlink($portfile); # need to see a new one
     my ($httppid, $pid2) = startnew($cmd, $pidfile, 15, 0);
 
     if($httppid <= 0 || !pidexists($httppid)) {
         # it is NOT alive
         logmsg "RUN: failed to start the $srvrname server\n";
-        stopserver($server, "$pid2");
+        stopserver($server, $pid2);
         $doesntrun{$pidfile} = 1;
         return (1, 0, 0, 0);
     }
 
     # where is it?
     my $port = 0;
-    if(!$port_or_path) {
-        $port = $port_or_path = pidfromfile($portfile);
-    }
-
-    # Server is up. Verify that we can speak to it.
-    my $pid3 = verifyserver($proto, $ipvnum, $idnum, $ip, $port_or_path);
-    if(!$pid3) {
-        logmsg "RUN: $srvrname server failed verification\n";
-        # failed to talk to it properly. Kill the server and return failure
-        stopserver($server, "$httppid $pid2");
+    $port = $port_or_path = pidfromfile($portfile, $SERVER_TIMEOUT_SEC);
+    if(!$port) {
+        logmsg "RUN: timeout for $srvrname to produce port file $portfile\n";
+        stopserver($server, $pid2);
         $doesntrun{$pidfile} = 1;
         return (1, 0, 0, 0);
     }
-    $pid2 = $pid3;
 
     if($verb) {
         logmsg "RUN: $srvrname server is on PID $httppid port $port_or_path\n";
@@ -1194,30 +1159,29 @@ sub runhttpserver {
     return (0, $httppid, $pid2, $port);
 }
 
-
 #######################################################################
 # start the http2 server
 #
 sub runhttp2server {
     my ($verb) = @_;
-    my $proto="http/2";
+    my $proto = "http/2";
     my $ipvnum = 4;
     my $idnum = 0;
-    my $exe = "$perl $srcdir/http2-server.pl";
+    my $exe = "$perl " . shell_quote("$srcdir/http2-server.pl");
     my $verbose_flag = "--verbose ";
 
     my $server = servername_id($proto, $ipvnum, $idnum);
 
     my $pidfile = $serverpidfile{$server};
 
-    # don't retry if the server doesn't work
-    if ($doesntrun{$pidfile}) {
+    # do not retry if the server does not work
+    if($doesntrun{$pidfile}) {
         return (2, 0, 0, 0, 0);
     }
 
     my $pid = processexists($pidfile);
     if($pid > 0) {
-        stopserver($server, "$pid");
+        stopserver($server, $pid);
     }
     unlink($pidfile) if(-f $pidfile);
 
@@ -1239,7 +1203,7 @@ sub runhttp2server {
 
     if($http2pid <= 0 || !pidexists($http2pid)) {
         # it is NOT alive
-        stopserver($server, "$pid2");
+        stopserver($server, $pid2);
         $doesntrun{$pidfile} = 1;
         $http2pid = $pid2 = 0;
         logmsg "RUN: failed to start the $srvrname server\n";
@@ -1261,24 +1225,24 @@ sub runhttp2server {
 #
 sub runhttp3server {
     my ($verb, $cert) = @_;
-    my $proto="http/3";
+    my $proto = "http/3";
     my $ipvnum = 4;
     my $idnum = 0;
-    my $exe = "$perl $srcdir/http3-server.pl";
+    my $exe = "$perl " . shell_quote("$srcdir/http3-server.pl");
     my $verbose_flag = "--verbose ";
 
     my $server = servername_id($proto, $ipvnum, $idnum);
 
     my $pidfile = $serverpidfile{$server};
 
-    # don't retry if the server doesn't work
-    if ($doesntrun{$pidfile}) {
+    # do not retry if the server does not work
+    if($doesntrun{$pidfile}) {
         return (2, 0, 0, 0);
     }
 
     my $pid = processexists($pidfile);
     if($pid > 0) {
-        stopserver($server, "$pid");
+        stopserver($server, $pid);
     }
     unlink($pidfile) if(-f $pidfile);
 
@@ -1300,7 +1264,7 @@ sub runhttp3server {
 
     if($http3pid <= 0 || !pidexists($http3pid)) {
         # it is NOT alive
-        stopserver($server, "$pid3");
+        stopserver($server, $pid3);
         $doesntrun{$pidfile} = 1;
         $http3pid = $pid3 = 0;
         logmsg "RUN: failed to start the $srvrname server\n";
@@ -1337,19 +1301,19 @@ sub runhttpsserver {
 
     my $pidfile = $serverpidfile{$server};
 
-    # don't retry if the server doesn't work
-    if ($doesntrun{$pidfile}) {
+    # do not retry if the server does not work
+    if($doesntrun{$pidfile}) {
         return (2, 0, 0, 0);
     }
 
     my $pid = processexists($pidfile);
     if($pid > 0) {
-        stopserver($server, "$pid");
+        stopserver($server, $pid);
     }
     unlink($pidfile) if(-f $pidfile);
 
     my $srvrname = servername_str($proto, $ipvnum, $idnum);
-    $certfile = 'stunnel.pem' unless($certfile);
+    $certfile = 'certs/test-localhost.pem' unless($certfile);
     my $logfile = server_logfilename($LOGDIR, $proto, $ipvnum, $idnum);
 
     my $flags = "";
@@ -1358,11 +1322,17 @@ sub runhttpsserver {
     $flags .= "--logdir \"$LOGDIR\" ";
     $flags .= "--id $idnum " if($idnum > 1);
     $flags .= "--ipv$ipvnum --proto $proto ";
-    $flags .= "--certfile \"$certfile\" " if($certfile ne 'stunnel.pem');
+    $flags .= "--certfile \"$certfile\" " if($certfile ne 'certs/test-localhost.pem');
     $flags .= "--stunnel \"$stunnel\" --srcdir \"$srcdir\" ";
+    if($proto eq "https-mtls") {
+        $flags .= "--mtls ";
+    }
     if($proto eq "gophers") {
         $flags .= "--connect " . protoport("gopher");
     }
+    elsif($proto eq "mqtts") {
+        $flags .= "--connect " . protoport("mqtt");
+    }
     elsif(!$proxy) {
         $flags .= "--connect " . protoport("http");
     }
@@ -1373,12 +1343,12 @@ sub runhttpsserver {
 
     my $port = getfreeport($ipvnum);
     my $options = "$flags --accept $port";
-    my $cmd = "$perl $srcdir/secureserver.pl $options";
+    my $cmd = "$perl " . shell_quote("$srcdir/secureserver.pl") . " " . $options;
     my ($httpspid, $pid2) = startnew($cmd, $pidfile, 15, 0);
 
     if($httpspid <= 0 || !pidexists($httpspid)) {
         # it is NOT alive
-        # don't call stopserver since that will also kill the dependent
+        # do not call stopserver since that also kills the dependent
         # server that has already been started properly
         $doesntrun{$pidfile} = 1;
         $httpspid = $pid2 = 0;
@@ -1403,7 +1373,7 @@ sub runhttpsserver {
 sub runhttptlsserver {
     my ($verb, $ipv6) = @_;
     my $proto = "httptls";
-    my $ip = ($ipv6 && ($ipv6 =~ /6$/)) ? "$HOST6IP" : "$HOSTIP";
+    my $ip = ($ipv6 && ($ipv6 =~ /6$/)) ? $HOST6IP : $HOSTIP;
     my $ipvnum = ($ipv6 && ($ipv6 =~ /6$/)) ? 6 : 4;
     my $idnum = 1;
 
@@ -1415,14 +1385,14 @@ sub runhttptlsserver {
 
     my $pidfile = $serverpidfile{$server};
 
-    # don't retry if the server doesn't work
-    if ($doesntrun{$pidfile}) {
+    # do not retry if the server does not work
+    if($doesntrun{$pidfile}) {
         return (2, 0, 0, 0);
     }
 
     my $pid = processexists($pidfile);
     if($pid > 0) {
-        stopserver($server, "$pid");
+        stopserver($server, $pid);
     }
     unlink($pidfile) if(-f $pidfile);
 
@@ -1443,7 +1413,7 @@ sub runhttptlsserver {
 
     if($httptlspid <= 0 || !pidexists($httptlspid)) {
         # it is NOT alive
-        stopserver($server, "$pid2");
+        stopserver($server, $pid2);
         $doesntrun{$pidfile} = 1;
         $httptlspid = $pid2 = 0;
         logmsg "RUN: failed to start the $srvrname server\n";
@@ -1469,7 +1439,7 @@ sub runpingpongserver {
         return (4, 0, 0);
     }
 
-    my $ip = ($ipv6 && ($ipv6 =~ /6$/)) ? "$HOST6IP" : "$HOSTIP";
+    my $ip = ($ipv6 && ($ipv6 =~ /6$/)) ? $HOST6IP : $HOSTIP;
     my $ipvnum = ($ipv6 && ($ipv6 =~ /6$/)) ? 6 : 4;
     my $idnum = ($id && ($id =~ /^(\d+)$/) && ($id > 1)) ? $id : 1;
 
@@ -1478,14 +1448,14 @@ sub runpingpongserver {
     my $pidfile = $serverpidfile{$server};
     my $portfile = $serverportfile{$server};
 
-    # don't retry if the server doesn't work
-    if ($doesntrun{$pidfile}) {
+    # do not retry if the server does not work
+    if($doesntrun{$pidfile}) {
         return (2, 0, 0);
     }
 
     my $pid = processexists($pidfile);
     if($pid > 0) {
-        stopserver($server, "$pid");
+        stopserver($server, $pid);
     }
     unlink($pidfile) if(-f $pidfile);
 
@@ -1501,33 +1471,29 @@ sub runpingpongserver {
     $flags .= "--id $idnum " if($idnum > 1);
     $flags .= "--ipv$ipvnum --port 0 --addr \"$ip\"";
 
-    my $cmd = "$perl $srcdir/ftpserver.pl $flags";
+    unlink($portfile); # need to see a new one
+    my $cmd = "$perl " . shell_quote("$srcdir/ftpserver.pl") . " " . $flags;
     my ($ftppid, $pid2) = startnew($cmd, $pidfile, 15, 0);
 
     if($ftppid <= 0 || !pidexists($ftppid)) {
         # it is NOT alive
         logmsg "RUN: failed to start the $srvrname server\n";
-        stopserver($server, "$pid2");
+        stopserver($server, $pid2);
         $doesntrun{$pidfile} = 1;
         return (1, 0, 0);
     }
 
     # where is it?
-    my $port = pidfromfile($portfile);
+    my $port = pidfromfile($portfile, $SERVER_TIMEOUT_SEC);
+    if(!$port) {
+        logmsg "RUN: timeout for $srvrname to produce port file $portfile\n";
+        stopserver($server, $pid2);
+        $doesntrun{$pidfile} = 1;
+        return (1, 0, 0, 0);
+    }
 
     logmsg "PINGPONG runs on port $port ($portfile)\n" if($verb);
 
-    # Server is up. Verify that we can speak to it.
-    my $pid3 = verifyserver($proto, $ipvnum, $idnum, $ip, $port);
-    if(!$pid3) {
-        logmsg "RUN: $srvrname server failed verification\n";
-        # failed to talk to it properly. Kill the server and return failure
-        stopserver($server, "$ftppid $pid2");
-        $doesntrun{$pidfile} = 1;
-        return (1, 0, 0);
-    }
-    $pid2 = $pid3;
-
     logmsg "RUN: $srvrname server is PID $ftppid port $port\n" if($verb);
 
     # Assign the correct port variable!
@@ -1541,7 +1507,7 @@ sub runpingpongserver {
 #
 sub runsecureserver {
     my ($verb, $ipv6, $certfile, $proto, $clearport) = @_;
-    my $ip = ($ipv6 && ($ipv6 =~ /6$/)) ? "$HOST6IP" : "$HOSTIP";
+    my $ip = ($ipv6 && ($ipv6 =~ /6$/)) ? $HOST6IP : $HOSTIP;
     my $ipvnum = ($ipv6 && ($ipv6 =~ /6$/)) ? 6 : 4;
     my $idnum = 1;
 
@@ -1553,19 +1519,19 @@ sub runsecureserver {
 
     my $pidfile = $serverpidfile{$server};
 
-    # don't retry if the server doesn't work
-    if ($doesntrun{$pidfile}) {
+    # do not retry if the server does not work
+    if($doesntrun{$pidfile}) {
         return (2, 0, 0, 0);
     }
 
     my $pid = processexists($pidfile);
     if($pid > 0) {
-        stopserver($server, "$pid");
+        stopserver($server, $pid);
     }
     unlink($pidfile) if(-f $pidfile);
 
     my $srvrname = servername_str($proto, $ipvnum, $idnum);
-    $certfile = 'stunnel.pem' unless($certfile);
+    $certfile = 'certs/test-localhost.pem' unless($certfile);
     my $logfile = server_logfilename($LOGDIR, $proto, $ipvnum, $idnum);
 
     my $flags = "";
@@ -1574,19 +1540,19 @@ sub runsecureserver {
     $flags .= "--logdir \"$LOGDIR\" ";
     $flags .= "--id $idnum " if($idnum > 1);
     $flags .= "--ipv$ipvnum --proto $proto ";
-    $flags .= "--certfile \"$certfile\" " if($certfile ne 'stunnel.pem');
+    $flags .= "--certfile \"$certfile\" " if($certfile ne 'certs/test-localhost.pem');
     $flags .= "--stunnel \"$stunnel\" --srcdir \"$srcdir\" ";
     $flags .= "--connect $clearport";
 
     my $port = getfreeport($ipvnum);
     my $options = "$flags --accept $port";
 
-    my $cmd = "$perl $srcdir/secureserver.pl $options";
+    my $cmd = "$perl " . shell_quote("$srcdir/secureserver.pl") . " " . $options;
     my ($protospid, $pid2) = startnew($cmd, $pidfile, 15, 0);
 
     if($protospid <= 0 || !pidexists($protospid)) {
         # it is NOT alive
-        # don't call stopserver since that will also kill the dependent
+        # do not call stopserver since that also kills the dependent
         # server that has already been started properly
         $doesntrun{$pidfile} = 1;
         $protospid = $pid2 = 0;
@@ -1624,14 +1590,14 @@ sub runtftpserver {
 
     my $pidfile = $serverpidfile{$server};
 
-    # don't retry if the server doesn't work
-    if ($doesntrun{$pidfile}) {
+    # do not retry if the server does not work
+    if($doesntrun{$pidfile}) {
         return (2, 0, 0, 0);
     }
 
     my $pid = processexists($pidfile);
     if($pid > 0) {
-        stopserver($server, "$pid");
+        stopserver($server, $pid);
     }
     unlink($pidfile) if(-f $pidfile);
 
@@ -1648,29 +1614,25 @@ sub runtftpserver {
     $flags .= "--id $idnum " if($idnum > 1);
     $flags .= "--ipv$ipvnum --port 0 --srcdir \"$srcdir\"";
 
-    my $cmd = "$perl $srcdir/tftpserver.pl $flags";
+    unlink($portfile); # need to see a new one
+    my $cmd = "$perl " . shell_quote("$srcdir/tftpserver.pl") . " " . $flags;
     my ($tftppid, $pid2) = startnew($cmd, $pidfile, 15, 0);
 
     if($tftppid <= 0 || !pidexists($tftppid)) {
         # it is NOT alive
         logmsg "RUN: failed to start the $srvrname server\n";
-        stopserver($server, "$pid2");
+        stopserver($server, $pid2);
         $doesntrun{$pidfile} = 1;
         return (1, 0, 0, 0);
     }
 
-    my $port = pidfromfile($portfile);
-
-    # Server is up. Verify that we can speak to it.
-    my $pid3 = verifyserver($proto, $ipvnum, $idnum, $ip, $port);
-    if(!$pid3) {
-        logmsg "RUN: $srvrname server failed verification\n";
-        # failed to talk to it properly. Kill the server and return failure
-        stopserver($server, "$tftppid $pid2");
+    my $port = pidfromfile($portfile, $SERVER_TIMEOUT_SEC);
+    if(!$port) {
+        logmsg "RUN: timeout for $srvrname to produce port file $portfile\n";
+        stopserver($server, $pid2);
         $doesntrun{$pidfile} = 1;
         return (1, 0, 0, 0);
     }
-    $pid2 = $pid3;
 
     if($verb) {
         logmsg "RUN: $srvrname server on PID $tftppid port $port\n";
@@ -1679,6 +1641,77 @@ sub runtftpserver {
     return (0, $pid2, $tftppid, $port);
 }
 
+#######################################################################
+# start the dns server
+#
+sub rundnsserver {
+    my ($id, $verb, $ipv6) = @_;
+    my $ip = $HOSTIP;
+    my $proto = 'dns';
+    my $ipvnum = 4;
+    my $idnum = ($id && ($id =~ /^(\d+)$/) && ($id > 1)) ? $id : 1;
+
+    if($ipv6) {
+        # if IPv6, use a different setup
+        $ipvnum = 6;
+        $ip = $HOST6IP;
+    }
+
+    my $server = servername_id($proto, $ipvnum, $idnum);
+
+    my $pidfile = $serverpidfile{$server};
+
+    # do not retry if the server does not work
+    if($doesntrun{$pidfile}) {
+        return (2, 0, 0, 0);
+    }
+
+    my $pid = processexists($pidfile);
+    if($pid > 0) {
+        stopserver($server, $pid);
+    }
+    unlink($pidfile) if(-f $pidfile);
+
+    my $srvrname = servername_str($proto, $ipvnum, $idnum);
+    my $portfile = $serverportfile{$server};
+    my $logfile = server_logfilename($LOGDIR, $proto, $ipvnum, $idnum);
+
+    my $cmd = server_exe('dnsd');
+    $cmd .= " --port 0";
+    $cmd .= " --verbose" if($debugprotocol);
+    $cmd .= " --pidfile \"$pidfile\"";
+    $cmd .= " --portfile \"$portfile\"";
+    $cmd .= " --logfile \"$logfile\"";
+    $cmd .= " --logdir \"$LOGDIR\"";
+    $cmd .= " --id $idnum" if($idnum > 1);
+    $cmd .= " --ipv$ipvnum";
+
+    unlink($portfile); # need to see a new one
+    # start DNS server on a random port
+    my ($dnspid, $pid2) = startnew($cmd, $pidfile, 15, 0);
+
+    if($dnspid <= 0 || !pidexists($dnspid)) {
+        # it is NOT alive
+        logmsg "RUN: failed to start the $srvrname server\n";
+        stopserver($server, $pid2);
+        $doesntrun{$pidfile} = 1;
+        return (1, 0, 0, 0);
+    }
+
+    my $port = pidfromfile($portfile, $SERVER_TIMEOUT_SEC);
+    if(!$port) {
+        logmsg "RUN: timeout for $srvrname to produce port file $portfile\n";
+        stopserver($server, $pid2);
+        $doesntrun{$pidfile} = 1;
+        return (1, 0, 0, 0);
+    }
+
+    if($verb) {
+        logmsg "RUN: $srvrname server on PID $dnspid port $port\n";
+    }
+
+    return (0, $pid2, $dnspid, $port);
+}
 
 #######################################################################
 # start the rtsp server
@@ -1701,14 +1734,14 @@ sub runrtspserver {
     my $pidfile = $serverpidfile{$server};
     my $portfile = $serverportfile{$server};
 
-    # don't retry if the server doesn't work
-    if ($doesntrun{$pidfile}) {
+    # do not retry if the server does not work
+    if($doesntrun{$pidfile}) {
         return (2, 0, 0, 0);
     }
 
     my $pid = processexists($pidfile);
     if($pid > 0) {
-        stopserver($server, "$pid");
+        stopserver($server, $pid);
     }
     unlink($pidfile) if(-f $pidfile);
 
@@ -1724,29 +1757,25 @@ sub runrtspserver {
     $flags .= "--id $idnum " if($idnum > 1);
     $flags .= "--ipv$ipvnum --port 0 --srcdir \"$srcdir\"";
 
-    my $cmd = "$perl $srcdir/rtspserver.pl $flags";
+    unlink($portfile); # need to see a new one
+    my $cmd = "$perl " . shell_quote("$srcdir/rtspserver.pl") . " " . $flags;
     my ($rtsppid, $pid2) = startnew($cmd, $pidfile, 15, 0);
 
     if($rtsppid <= 0 || !pidexists($rtsppid)) {
         # it is NOT alive
         logmsg "RUN: failed to start the $srvrname server\n";
-        stopserver($server, "$pid2");
+        stopserver($server, $pid2);
         $doesntrun{$pidfile} = 1;
         return (1, 0, 0, 0);
     }
 
-    my $port = pidfromfile($portfile);
-
-    # Server is up. Verify that we can speak to it.
-    my $pid3 = verifyserver($proto, $ipvnum, $idnum, $ip, $port);
-    if(!$pid3) {
-        logmsg "RUN: $srvrname server failed verification\n";
-        # failed to talk to it properly. Kill the server and return failure
-        stopserver($server, "$rtsppid $pid2");
+    my $port = pidfromfile($portfile, $SERVER_TIMEOUT_SEC);
+    if(!$port) {
+        logmsg "RUN: timeout for $srvrname to produce port file $portfile\n";
+        stopserver($server, $pid2);
         $doesntrun{$pidfile} = 1;
         return (1, 0, 0, 0);
     }
-    $pid2 = $pid3;
 
     if($verb) {
         logmsg "RUN: $srvrname server PID $rtsppid port $port\n";
@@ -1755,19 +1784,29 @@ sub runrtspserver {
     return (0, $rtsppid, $pid2, $port);
 }
 
+#***************************************************************************
+# Return key algorithm string
+#
+sub sshkeyalgostr {
+    my ($algo) = @_;
+    my %algomap = (
+        ecdsa => 'ecdsa-sha2-nistp256',
+    );
+    return exists $algomap{$algo} ? $algomap{$algo} : 'ssh-' . $algo;
+}
 
 #######################################################################
 # Start the ssh (scp/sftp) server
 #
 sub runsshserver {
     my ($id, $verb, $ipv6) = @_;
-    my $ip=$HOSTIP;
+    my $ip = $HOSTIP;
     my $proto = 'ssh';
     my $ipvnum = 4;
     my $idnum = ($id && ($id =~ /^(\d+)$/) && ($id > 1)) ? $id : 1;
 
     if(!$USER) {
-        logmsg "Can't start ssh server due to lack of USER name\n";
+        logmsg "Cannot start ssh server due to lack of username\n";
         return (4, 0, 0, 0);
     }
 
@@ -1775,8 +1814,8 @@ sub runsshserver {
 
     my $pidfile = $serverpidfile{$server};
 
-    # don't retry if the server doesn't work
-    if ($doesntrun{$pidfile}) {
+    # do not retry if the server does not work
+    if($doesntrun{$pidfile}) {
         return (2, 0, 0, 0);
     }
 
@@ -1788,7 +1827,7 @@ sub runsshserver {
 
     my $pid = processexists($pidfile);
     if($pid > 0) {
-        stopserver($server, "$pid");
+        stopserver($server, $pid);
     }
     unlink($pidfile) if(-f $pidfile);
 
@@ -1803,6 +1842,9 @@ sub runsshserver {
     $flags .= "--id $idnum " if($idnum > 1);
     $flags .= "--ipv$ipvnum --addr \"$ip\" ";
     $flags .= "--user \"$USER\"";
+    if(defined $feature{"sshkeyalgo"}) {
+        $flags .= ' --keyalgo ' . $feature{"sshkeyalgo"};
+    }
 
     my @tports;
     my $port = getfreeport($ipvnum);
@@ -1811,7 +1853,7 @@ sub runsshserver {
 
     my $options = "$flags --sshport $port";
 
-    my $cmd = "$perl $srcdir/sshserver.pl $options";
+    my $cmd = "$perl " . shell_quote("$srcdir/sshserver.pl") . " " . $options;
     my ($sshpid, $pid2) = startnew($cmd, $pidfile, 60, 0);
 
     # on loaded systems sshserver start up can take longer than the
@@ -1820,7 +1862,7 @@ sub runsshserver {
     # zero pid2 above.
     if($sshpid <= 0 || !pidexists($sshpid)) {
         # it is NOT alive
-        stopserver($server, "$pid2");
+        stopserver($server, $pid2);
         $doesntrun{$pidfile} = 1;
         $sshpid = $pid2 = 0;
         logmsg "RUN: failed to start the $srvrname server on $port\n";
@@ -1829,8 +1871,8 @@ sub runsshserver {
 
     # once it is known that the ssh server is alive, sftp server
     # verification is performed actually connecting to it, authenticating
-    # and performing a very simple remote command.  This verification is
-    # tried only one time.
+    # and performing a simple remote command.  This verification is tried
+    # only one time.
 
     $sshdlog = server_logfilename($LOGDIR, 'ssh', $ipvnum, $idnum);
     $sftplog = server_logfilename($LOGDIR, 'sftp', $ipvnum, $idnum);
@@ -1848,7 +1890,7 @@ sub runsshserver {
         logmsg "RUN: failed to verify the $srvrname server on $port\n";
         return (5, 0, 0, 0);
     }
-    # we're happy, no need to loop anymore!
+    # we are happy, no need to loop anymore!
     $doesntrun{$pidfile} = 0;
 
     my $hostfile;
@@ -1857,7 +1899,7 @@ sub runsshserver {
        !close($hostfile) ||
        ($SSHSRVMD5 !~ /^[a-f0-9]{32}$/i))
     {
-        my $msg = "Fatal: $srvrname pubkey md5 missing : \"$hstpubmd5f\" : $!";
+        my $msg = "Fatal: $srvrname pubkey MD5 missing : \"$hstpubmd5f\" : $!";
         logmsg "$msg\n";
         stopservers($verb);
         die $msg;
@@ -1867,7 +1909,7 @@ sub runsshserver {
        (read($hostfile, $SSHSRVSHA256, 48) == 0) ||
        !close($hostfile))
     {
-        my $msg = "Fatal: $srvrname pubkey sha256 missing : \"$hstpubsha256f\" : $!";
+        my $msg = "Fatal: $srvrname pubkey SHA256 missing : \"$hstpubsha256f\" : $!";
         logmsg "$msg\n";
         stopservers($verb);
         die $msg;
@@ -1883,7 +1925,7 @@ sub runsshserver {
 #
 sub runmqttserver {
     my ($id, $verb, $ipv6) = @_;
-    my $ip=$HOSTIP;
+    my $ip = $HOSTIP;
     my $proto = 'mqtt';
     my $port = protoport($proto);
     my $ipvnum = 4;
@@ -1893,23 +1935,24 @@ sub runmqttserver {
     my $pidfile = $serverpidfile{$server};
     my $portfile = $serverportfile{$server};
 
-    # don't retry if the server doesn't work
-    if ($doesntrun{$pidfile}) {
+    # do not retry if the server does not work
+    if($doesntrun{$pidfile}) {
         return (2, 0, 0);
     }
 
     my $pid = processexists($pidfile);
     if($pid > 0) {
-        stopserver($server, "$pid");
+        stopserver($server, $pid);
     }
     unlink($pidfile) if(-f $pidfile);
 
     my $srvrname = servername_str($proto, $ipvnum, $idnum);
     my $logfile = server_logfilename($LOGDIR, $proto, $ipvnum, $idnum);
 
+    unlink($portfile); # need to see a new one
     # start our MQTT server - on a random port!
-    my $cmd="server/mqttd".exe_ext('SRV').
-        " --port 0 ".
+    my $cmd = server_exe('mqttd').
+        " --port 0".
         " --pidfile $pidfile".
         " --portfile $portfile".
         " --config $LOGDIR/$SERVERCMD".
@@ -1920,19 +1963,24 @@ sub runmqttserver {
     if($sockspid <= 0 || !pidexists($sockspid)) {
         # it is NOT alive
         logmsg "RUN: failed to start the $srvrname server\n";
-        stopserver($server, "$pid2");
+        stopserver($server, $pid2);
         $doesntrun{$pidfile} = 1;
         return (1, 0, 0);
     }
 
-    my $mqttport = pidfromfile($portfile);
-    $PORT{"mqtt"} = $mqttport;
+    my $mqttport = pidfromfile($portfile, $SERVER_TIMEOUT_SEC);
+    if(!$mqttport) {
+        logmsg "RUN: timeout for $srvrname to produce port file $portfile\n";
+        stopserver($server, $pid2);
+        $doesntrun{$pidfile} = 1;
+        return (1, 0, 0, 0);
+    }
 
     if($verb) {
         logmsg "RUN: $srvrname server is now running PID $pid2 on PORT $mqttport\n";
     }
 
-    return (0, $pid2, $sockspid);
+    return (0, $pid2, $sockspid, $mqttport);
 }
 
 #######################################################################
@@ -1940,7 +1988,7 @@ sub runmqttserver {
 #
 sub runsocksserver {
     my ($id, $verb, $ipv6, $is_unix) = @_;
-    my $ip=$HOSTIP;
+    my $ip = $HOSTIP;
     my $proto = 'socks';
     my $ipvnum = 4;
     my $idnum = ($id && ($id =~ /^(\d+)$/) && ($id > 1)) ? $id : 1;
@@ -1949,14 +1997,14 @@ sub runsocksserver {
 
     my $pidfile = $serverpidfile{$server};
 
-    # don't retry if the server doesn't work
-    if ($doesntrun{$pidfile}) {
+    # do not retry if the server does not work
+    if($doesntrun{$pidfile}) {
         return (2, 0, 0, 0);
     }
 
     my $pid = processexists($pidfile);
     if($pid > 0) {
-        stopserver($server, "$pid");
+        stopserver($server, $pid);
     }
     unlink($pidfile) if(-f $pidfile);
 
@@ -1964,19 +2012,21 @@ sub runsocksserver {
     my $portfile = $serverportfile{$server};
     my $logfile = server_logfilename($LOGDIR, $proto, $ipvnum, $idnum);
 
+    unlink($portfile); # need to see a new one
     # start our socks server, get commands from the FTP cmd file
-    my $cmd="";
+    my $cmd = "";
     if($is_unix) {
-        $cmd="server/socksd".exe_ext('SRV').
+        $cmd = server_exe('socksd').
             " --pidfile $pidfile".
             " --reqfile $LOGDIR/$SOCKSIN".
             " --logfile $logfile".
             " --unix-socket $SOCKSUNIXPATH".
             " --backend $HOSTIP".
             " --config $LOGDIR/$SERVERCMD";
+        $portfile = "none";
     } else {
-        $cmd="server/socksd".exe_ext('SRV').
-            " --port 0 ".
+        $cmd = server_exe('socksd').
+            " --port 0".
             " --pidfile $pidfile".
             " --portfile $portfile".
             " --reqfile $LOGDIR/$SOCKSIN".
@@ -1989,12 +2039,21 @@ sub runsocksserver {
     if($sockspid <= 0 || !pidexists($sockspid)) {
         # it is NOT alive
         logmsg "RUN: failed to start the $srvrname server\n";
-        stopserver($server, "$pid2");
+        stopserver($server, $pid2);
         $doesntrun{$pidfile} = 1;
         return (1, 0, 0, 0);
     }
 
-    my $port = pidfromfile($portfile);
+    my $port = 0;
+    if($portfile ne "none") {
+        $port = pidfromfile($portfile, $SERVER_TIMEOUT_SEC);
+        if(!$port) {
+            logmsg "RUN: timeout for $srvrname to produce port file $portfile\n";
+            stopserver($server, $pid2);
+            $doesntrun{$pidfile} = 1;
+            return (1, 0, 0, 0);
+        }
+    }
 
     if($verb) {
         logmsg "RUN: $srvrname server is now running PID $pid2\n";
@@ -2021,14 +2080,14 @@ sub rundictserver {
 
     my $pidfile = $serverpidfile{$server};
 
-    # don't retry if the server doesn't work
-    if ($doesntrun{$pidfile}) {
+    # do not retry if the server does not work
+    if($doesntrun{$pidfile}) {
         return (2, 0, 0, 0);
     }
 
     my $pid = processexists($pidfile);
     if($pid > 0) {
-        stopserver($server, "$pid");
+        stopserver($server, $pid);
     }
     unlink($pidfile) if(-f $pidfile);
 
@@ -2049,7 +2108,7 @@ sub rundictserver {
 
     if($dictpid <= 0 || !pidexists($dictpid)) {
         # it is NOT alive
-        stopserver($server, "$pid2");
+        stopserver($server, $pid2);
         $doesntrun{$pidfile} = 1;
         $dictpid = $pid2 = 0;
         logmsg "RUN: failed to start the $srvrname server\n";
@@ -2082,14 +2141,14 @@ sub runsmbserver {
 
     my $pidfile = $serverpidfile{$server};
 
-    # don't retry if the server doesn't work
-    if ($doesntrun{$pidfile}) {
+    # do not retry if the server does not work
+    if($doesntrun{$pidfile}) {
         return (2, 0, 0, 0);
     }
 
     my $pid = processexists($pidfile);
     if($pid > 0) {
-        stopserver($server, "$pid");
+        stopserver($server, $pid);
     }
     unlink($pidfile) if(-f $pidfile);
 
@@ -2110,7 +2169,7 @@ sub runsmbserver {
 
     if($smbpid <= 0 || !pidexists($smbpid)) {
         # it is NOT alive
-        stopserver($server, "$pid2");
+        stopserver($server, $pid2);
         $doesntrun{$pidfile} = 1;
         $smbpid = $pid2 = 0;
         logmsg "RUN: failed to start the $srvrname server\n";
@@ -2143,14 +2202,14 @@ sub runnegtelnetserver {
 
     my $pidfile = $serverpidfile{$server};
 
-    # don't retry if the server doesn't work
-    if ($doesntrun{$pidfile}) {
+    # do not retry if the server does not work
+    if($doesntrun{$pidfile}) {
         return (2, 0, 0, 0);
     }
 
     my $pid = processexists($pidfile);
     if($pid > 0) {
-        stopserver($server, "$pid");
+        stopserver($server, $pid);
     }
     unlink($pidfile) if(-f $pidfile);
 
@@ -2170,7 +2229,7 @@ sub runnegtelnetserver {
 
     if($ntelpid <= 0 || !pidexists($ntelpid)) {
         # it is NOT alive
-        stopserver($server, "$pid2");
+        stopserver($server, $pid2);
         $doesntrun{$pidfile} = 1;
         $ntelpid = $pid2 = 0;
         logmsg "RUN: failed to start the $srvrname server\n";
@@ -2185,15 +2244,12 @@ sub runnegtelnetserver {
     return (0+!$ntelpid, $ntelpid, $pid2, $port);
 }
 
-
-
-
 #######################################################################
 # Single shot http and gopher server responsiveness test. This should only
 # be used to verify that a server present in %run hash is still functional
 #
 sub responsive_http_server {
-    my ($proto, $verb, $alt, $port_or_path) = @_;
+    my ($proto, $verb, $alt, $port_or_path, $do_http3) = @_;
     my $ip = $HOSTIP;
     my $ipvnum = 4;
     my $idnum = 1;
@@ -2211,7 +2267,20 @@ sub responsive_http_server {
         $ipvnum = "unix";
     }
 
-    return &responsiveserver($proto, $ipvnum, $idnum, $ip, $port_or_path);
+    return &responsiveserver($proto, $ipvnum, $idnum, $ip, $port_or_path, $do_http3);
+}
+
+#######################################################################
+# Single shot mqtt server responsiveness test. This should only
+# be used to verify that a server present in %run hash is still functional
+#
+sub responsive_mqtt_server {
+    my ($proto, $id, $verb, $ipv6) = @_;
+    my $ip = ($ipv6 && ($ipv6 =~ /6$/)) ? $HOST6IP : $HOSTIP;
+    my $ipvnum = ($ipv6 && ($ipv6 =~ /6$/)) ? 6 : 4;
+    my $idnum = ($id && ($id =~ /^(\d+)$/) && ($id > 1)) ? $id : 1;
+
+    return &responsiveserver($proto, $ipvnum, $idnum, $ip);
 }
 
 #######################################################################
@@ -2221,7 +2290,7 @@ sub responsive_http_server {
 sub responsive_pingpong_server {
     my ($proto, $id, $verb, $ipv6) = @_;
     my $port;
-    my $ip = ($ipv6 && ($ipv6 =~ /6$/)) ? "$HOST6IP" : "$HOSTIP";
+    my $ip = ($ipv6 && ($ipv6 =~ /6$/)) ? $HOST6IP : $HOSTIP;
     my $ipvnum = ($ipv6 && ($ipv6 =~ /6$/)) ? 6 : 4;
     my $idnum = ($id && ($id =~ /^(\d+)$/) && ($id > 1)) ? $id : 1;
     my $protoip = $proto . ($ipvnum == 6? '6': '');
@@ -2281,6 +2350,28 @@ sub responsive_tftp_server {
     return &responsiveserver($proto, $ipvnum, $idnum, $ip, $port);
 }
 
+#######################################################################
+# Single shot dns server responsiveness test. This should only be
+# used to verify that a server present in %run hash is still functional
+#
+sub responsive_dns_server {
+    my ($id, $verb, $ipv6) = @_;
+    my $proto = 'dns';
+    my $port = protoport($proto);
+    my $ip = $HOSTIP;
+    my $ipvnum = 4;
+    my $idnum = ($id && ($id =~ /^(\d+)$/) && ($id > 1)) ? $id : 1;
+
+    if($ipv6) {
+        # if IPv6, use a different setup
+        $ipvnum = 6;
+        $port = protoport('dns6');
+        $ip = $HOST6IP;
+    }
+
+    return &responsiveserver($proto, $ipvnum, $idnum, $ip, $port);
+}
+
 #######################################################################
 # Single shot non-stunnel HTTP TLS extensions capable server
 # responsiveness test. This should only be used to verify that a
@@ -2291,12 +2382,12 @@ sub responsive_httptls_server {
     my $ipvnum = ($ipv6 && ($ipv6 =~ /6$/)) ? 6 : 4;
     my $proto = "httptls";
     my $port = protoport($proto);
-    my $ip = "$HOSTIP";
+    my $ip = $HOSTIP;
     my $idnum = 1;
 
-    if ($ipvnum == 6) {
+    if($ipvnum == 6) {
         $port = protoport("httptls6");
-        $ip = "$HOST6IP";
+        $ip = $HOST6IP;
     }
 
     return &responsiveserver($proto, $ipvnum, $idnum, $ip, $port);
@@ -2315,22 +2406,22 @@ sub responsive_httptls_server {
 sub startservers {
     my @what = @_;
     my ($pid, $pid2);
-    my $serr;  # error while starting a server (as as the return enumerations)
+    my $serr;  # error while starting a server (as of the return enumerations)
     for(@what) {
         my (@whatlist) = split(/\s+/,$_);
         my $what = lc($whatlist[0]);
         $what =~ s/[^a-z0-9\/-]//g;
 
         my $certfile;
-        if($what =~ /^(ftp|gopher|http|imap|pop3|smtp)s((\d*)(-ipv6|-unix|))$/) {
-            $certfile = ($whatlist[1]) ? $whatlist[1] : 'stunnel.pem';
+        if($what =~ /^(ftp|gopher|http|imap|pop3|smtp)s|https-mtls((\d*)(-ipv6|-unix|))$/) {
+            $certfile = ($whatlist[1]) ? $whatlist[1] : 'certs/test-localhost.pem';
         }
 
         if(($what eq "pop3") ||
            ($what eq "ftp") ||
            ($what eq "imap") ||
            ($what eq "smtp")) {
-            if($torture && $run{$what} &&
+            if($run{$what} &&
                !responsive_pingpong_server($what, "", $verbose)) {
                 if(stopserver($what)) {
                     return ("failed stopping unresponsive ".uc($what)." server", 3);
@@ -2342,11 +2433,11 @@ sub startservers {
                     return ("failed starting ". uc($what) ." server", $serr);
                 }
                 logmsg sprintf("* pid $what => %d %d\n", $pid, $pid2) if($verbose);
-                $run{$what}="$pid $pid2";
+                $run{$what} = "$pid $pid2";
             }
         }
         elsif($what eq "ftp-ipv6") {
-            if($torture && $run{'ftp-ipv6'} &&
+            if($run{'ftp-ipv6'} &&
                !responsive_pingpong_server("ftp", "", $verbose, "ipv6")) {
                 if(stopserver('ftp-ipv6')) {
                     return ("failed stopping unresponsive FTP-IPv6 server", 3);
@@ -2359,11 +2450,11 @@ sub startservers {
                 }
                 logmsg sprintf("* pid ftp-ipv6 => %d %d\n", $pid,
                        $pid2) if($verbose);
-                $run{'ftp-ipv6'}="$pid $pid2";
+                $run{'ftp-ipv6'} = "$pid $pid2";
             }
         }
         elsif($what eq "gopher") {
-            if($torture && $run{'gopher'} &&
+            if($run{'gopher'} &&
                !responsive_http_server("gopher", $verbose, 0,
                                        protoport("gopher"))) {
                 if(stopserver('gopher')) {
@@ -2378,13 +2469,13 @@ sub startservers {
                 }
                 logmsg sprintf ("* pid gopher => %d %d\n", $pid, $pid2)
                     if($verbose);
-                $run{'gopher'}="$pid $pid2";
+                $run{'gopher'} = "$pid $pid2";
             }
         }
         elsif($what eq "gopher-ipv6") {
-            if($torture && $run{'gopher-ipv6'} &&
+            if($run{'gopher-ipv6'} &&
                !responsive_http_server("gopher", $verbose, "ipv6",
-                                       protoport("gopher"))) {
+                                       protoport("gopher6"))) {
                 if(stopserver('gopher-ipv6')) {
                     return ("failed stopping unresponsive GOPHER-IPv6 server", 3);
                 }
@@ -2397,35 +2488,13 @@ sub startservers {
                 }
                 logmsg sprintf("* pid gopher-ipv6 => %d %d\n", $pid,
                                $pid2) if($verbose);
-                $run{'gopher-ipv6'}="$pid $pid2";
-            }
-        }
-        elsif($what eq "http/3") {
-            if(!$run{'http/3'}) {
-                ($serr, $pid, $pid2, $PORT{"http3"}) = runhttp3server($verbose);
-                if($pid <= 0) {
-                    return ("failed starting HTTP/3 server", $serr);
-                }
-                logmsg sprintf ("* pid http/3 => %d %d\n", $pid, $pid2)
-                    if($verbose);
-                $run{'http/3'}="$pid $pid2";
-            }
-        }
-        elsif($what eq "http/2") {
-            if(!$run{'http/2'}) {
-                ($serr, $pid, $pid2, $PORT{"http2"}, $PORT{"http2tls"}) =
-                    runhttp2server($verbose);
-                if($pid <= 0) {
-                    return ("failed starting HTTP/2 server", $serr);
-                }
-                logmsg sprintf ("* pid http/2 => %d %d\n", $pid, $pid2)
-                    if($verbose);
-                $run{'http/2'}="$pid $pid2";
+                $run{'gopher-ipv6'} = "$pid $pid2";
             }
         }
         elsif($what eq "http") {
-            if($torture && $run{'http'} &&
+            if($run{'http'} &&
                !responsive_http_server("http", $verbose, 0, protoport('http'))) {
+                logmsg "* restarting unresponsive HTTP server\n";
                 if(stopserver('http')) {
                     return ("failed stopping unresponsive HTTP server", 3);
                 }
@@ -2434,15 +2503,15 @@ sub startservers {
                 ($serr, $pid, $pid2, $PORT{'http'}) =
                     runhttpserver("http", $verbose, 0);
                 if($pid <= 0) {
-                    return ("failed starting HTTP server", $serr);
+                    return ("failed starting HTTP server (for http)", $serr);
                 }
                 logmsg sprintf ("* pid http => %d %d\n", $pid, $pid2)
                     if($verbose);
-                $run{'http'}="$pid $pid2";
+                $run{'http'} = "$pid $pid2";
             }
         }
         elsif($what eq "http-proxy") {
-            if($torture && $run{'http-proxy'} &&
+            if($run{'http-proxy'} &&
                !responsive_http_server("http", $verbose, "proxy",
                                        protoport("httpproxy"))) {
                 if(stopserver('http-proxy')) {
@@ -2457,11 +2526,11 @@ sub startservers {
                 }
                 logmsg sprintf ("* pid http-proxy => %d %d\n", $pid, $pid2)
                     if($verbose);
-                $run{'http-proxy'}="$pid $pid2";
+                $run{'http-proxy'} = "$pid $pid2";
             }
         }
         elsif($what eq "http-ipv6") {
-            if($torture && $run{'http-ipv6'} &&
+            if($run{'http-ipv6'} &&
                !responsive_http_server("http", $verbose, "ipv6",
                                        protoport("http6"))) {
                 if(stopserver('http-ipv6')) {
@@ -2476,11 +2545,11 @@ sub startservers {
                 }
                 logmsg sprintf("* pid http-ipv6 => %d %d\n", $pid, $pid2)
                     if($verbose);
-                $run{'http-ipv6'}="$pid $pid2";
+                $run{'http-ipv6'} = "$pid $pid2";
             }
         }
         elsif($what eq "rtsp") {
-            if($torture && $run{'rtsp'} &&
+            if($run{'rtsp'} &&
                !responsive_rtsp_server($verbose)) {
                 if(stopserver('rtsp')) {
                     return ("failed stopping unresponsive RTSP server", 3);
@@ -2492,11 +2561,11 @@ sub startservers {
                     return ("failed starting RTSP server", $serr);
                 }
                 logmsg sprintf("* pid rtsp => %d %d\n", $pid, $pid2) if($verbose);
-                $run{'rtsp'}="$pid $pid2";
+                $run{'rtsp'} = "$pid $pid2";
             }
         }
         elsif($what eq "rtsp-ipv6") {
-            if($torture && $run{'rtsp-ipv6'} &&
+            if($run{'rtsp-ipv6'} &&
                !responsive_rtsp_server($verbose, "ipv6")) {
                 if(stopserver('rtsp-ipv6')) {
                     return ("failed stopping unresponsive RTSP-IPv6 server", 3);
@@ -2509,13 +2578,13 @@ sub startservers {
                 }
                 logmsg sprintf("* pid rtsp-ipv6 => %d %d\n", $pid, $pid2)
                     if($verbose);
-                $run{'rtsp-ipv6'}="$pid $pid2";
+                $run{'rtsp-ipv6'} = "$pid $pid2";
             }
         }
         elsif($what =~ /^(ftp|imap|pop3|smtp)s$/) {
             my $cproto = $1;
             if(!$stunnel) {
-                # we can't run ftps tests without stunnel
+                # we cannot run ftps tests without stunnel
                 return ("no stunnel", 4);
             }
             if($runcert{$what} && ($runcert{$what} ne $certfile)) {
@@ -2524,7 +2593,7 @@ sub startservers {
                     return ("failed stopping $what server with different cert", 3);
                 }
             }
-            if($torture && $run{$cproto} &&
+            if($run{$cproto} &&
                !responsive_pingpong_server($cproto, "", $verbose)) {
                 if(stopserver($cproto)) {
                     return ("failed stopping unresponsive $cproto server", 3);
@@ -2536,7 +2605,7 @@ sub startservers {
                     return ("failed starting $cproto server", $serr);
                 }
                 logmsg sprintf("* pid $cproto => %d %d\n", $pid, $pid2) if($verbose);
-                $run{$cproto}="$pid $pid2";
+                $run{$cproto} = "$pid $pid2";
             }
             if(!$run{$what}) {
                 ($serr, $pid, $pid2, $PORT{$what}) =
@@ -2547,24 +2616,40 @@ sub startservers {
                 }
                 logmsg sprintf("* pid $what => %d %d\n", $pid, $pid2)
                     if($verbose);
-                $run{$what}="$pid $pid2";
+                $run{$what} = "$pid $pid2";
             }
         }
         elsif($what eq "file") {
             # we support it but have no server!
         }
-        elsif($what eq "https") {
+        elsif($what eq "https" || $what eq "https-mtls") {
             if(!$stunnel) {
-                # we can't run https tests without stunnel
+                # we cannot run https tests without stunnel
                 return ("no stunnel", 4);
             }
-            if($runcert{'https'} && ($runcert{'https'} ne $certfile)) {
+            if($runcert{$what} && ($runcert{$what} ne $certfile)) {
                 # stop server when running and using a different cert
-                if(stopserver('https')) {
+                if(stopserver($what)) {
                     return ("failed stopping HTTPS server with different cert", 3);
                 }
+                # also stop http server, we do not know which state it is in
+                if($run{'http'} && stopserver('http')) {
+                    return ("failed stopping HTTP server", 3);
+                }
             }
-            if($torture && $run{'http'} &&
+            if($run{$what} &&
+               !responsive_http_server($what, $verbose, 0,
+                                       protoport($what))) {
+                if(stopserver($what)) {
+                    return ("failed stopping unresponsive HTTPS server", 3);
+                }
+                # also stop http server, we do not know which state it is in
+                if($run{'http'} && stopserver('http')) {
+                    return ("failed stopping unresponsive HTTP server", 3);
+                }
+            }
+            # check a running http server if we not already checked https
+            if($run{'http'} && !$run{$what} &&
                !responsive_http_server("http", $verbose, 0,
                                        protoport('http'))) {
                 if(stopserver('http')) {
@@ -2575,25 +2660,106 @@ sub startservers {
                 ($serr, $pid, $pid2, $PORT{'http'}) =
                     runhttpserver("http", $verbose, 0);
                 if($pid <= 0) {
-                    return ("failed starting HTTP server", $serr);
+                    return ("failed starting HTTP server (for https/https-mtls)", $serr);
                 }
                 logmsg sprintf("* pid http => %d %d\n", $pid, $pid2) if($verbose);
-                $run{'http'}="$pid $pid2";
+                $run{'http'} = "$pid $pid2";
             }
-            if(!$run{'https'}) {
-                ($serr, $pid, $pid2, $PORT{'https'}) =
-                    runhttpsserver($verbose, "https", "", $certfile);
+            if(!$run{$what}) {
+                ($serr, $pid, $pid2, $PORT{$what}) =
+                    runhttpsserver($verbose, $what, "", $certfile);
                 if($pid <= 0) {
                     return ("failed starting HTTPS server (stunnel)", $serr);
                 }
-                logmsg sprintf("* pid https => %d %d\n", $pid, $pid2)
+                logmsg sprintf("* pid $what => %d %d\n", $pid, $pid2)
                     if($verbose);
-                $run{'https'}="$pid $pid2";
+                $run{$what} = "$pid $pid2";
+            }
+        }
+        elsif($what eq "http/2") {
+            # http/2 server proxies to an HTTP server
+            if($run{'http/2'} &&
+               !responsive_http_server("https", $verbose, 0, protoport('http2tls'))) {
+                logmsg "* restarting unresponsive HTTP/2 server\n";
+                if(stopserver('http/2')) {
+                    return ("failed stopping unresponsive HTTP/2 server", 3);
+                }
+                # also stop http server, we do not know which state it is in
+                if($run{'http'} && stopserver('http')) {
+                    return ("failed stopping HTTP server", 3);
+                }
+            }
+            # check a running http server if we not already checked http/2
+            if($run{'http'} && !$run{'http/2'} &&
+               !responsive_http_server("http", $verbose, 0,
+                                       protoport('http'))) {
+                if(stopserver('http')) {
+                    return ("failed stopping unresponsive HTTP server", 3);
+                }
+            }
+            if(!$run{'http'}) {
+                ($serr, $pid, $pid2, $PORT{'http'}) =
+                    runhttpserver("http", $verbose, 0);
+                if($pid <= 0) {
+                    return ("failed starting HTTP server (for http/2)", $serr);
+                }
+                logmsg sprintf("* pid http => %d %d\n", $pid, $pid2) if($verbose);
+                $run{'http'} = "$pid $pid2";
+            }
+            if(!$run{'http/2'}) {
+                ($serr, $pid, $pid2, $PORT{"http2"}, $PORT{"http2tls"}) =
+                    runhttp2server($verbose);
+                if($pid <= 0) {
+                    return ("failed starting HTTP/2 server", $serr);
+                }
+                logmsg sprintf ("* pid http/2 => %d %d\n", $pid, $pid2)
+                    if($verbose);
+                $run{'http/2'} = "$pid $pid2";
+            }
+        }
+        elsif($what eq "http/3") {
+            # http/3 server proxies to an HTTP server
+            if($run{'http/3'} &&
+               !responsive_http_server("https", $verbose, 0, protoport('http3'), 1)) {
+                logmsg "* restarting unresponsive HTTP/3 server\n";
+                if(stopserver('http/3')) {
+                    return ("failed stopping unresponsive HTTP/3 server", 3);
+                }
+                # also stop http server, we do not know which state it is in
+                if($run{'http'} && stopserver('http')) {
+                    return ("failed stopping HTTP server", 3);
+                }
+            }
+            # check a running http server if we not already checked http/3
+            if($run{'http'} && !$run{'http/3'} &&
+               !responsive_http_server("http", $verbose, 0,
+                                       protoport('http'))) {
+                if(stopserver('http')) {
+                    return ("failed stopping unresponsive HTTP server", 3);
+                }
+            }
+            if(!$run{'http'}) {
+                ($serr, $pid, $pid2, $PORT{'http'}) =
+                    runhttpserver("http", $verbose, 0);
+                if($pid <= 0) {
+                    return ("failed starting HTTP server (for http/3)", $serr);
+                }
+                logmsg sprintf("* pid http => %d %d\n", $pid, $pid2) if($verbose);
+                $run{'http'} = "$pid $pid2";
+            }
+            if(!$run{'http/3'}) {
+                ($serr, $pid, $pid2, $PORT{"http3"}) = runhttp3server($verbose);
+                if($pid <= 0) {
+                    return ("failed starting HTTP/3 server", $serr);
+                }
+                logmsg sprintf ("* pid http/3 => %d %d\n", $pid, $pid2)
+                    if($verbose);
+                $run{'http/3'} = "$pid $pid2";
             }
         }
         elsif($what eq "gophers") {
             if(!$stunnel) {
-                # we can't run TLS tests without stunnel
+                # we cannot run TLS tests without stunnel
                 return ("no stunnel", 4);
             }
             if($runcert{'gophers'} && ($runcert{'gophers'} ne $certfile)) {
@@ -2602,7 +2768,7 @@ sub startservers {
                     return ("failed stopping GOPHERS server with different cert", 3);
                 }
             }
-            if($torture && $run{'gopher'} &&
+            if($run{'gopher'} &&
                !responsive_http_server("gopher", $verbose, 0,
                                        protoport('gopher'))) {
                 if(stopserver('gopher')) {
@@ -2611,15 +2777,14 @@ sub startservers {
             }
             if(!$run{'gopher'}) {
                 my $port;
-                ($serr, $pid, $pid2, $port) =
-                    runhttpserver("gopher", $verbose, 0);
+                ($serr, $pid, $pid2, $port) = runhttpserver("gopher", $verbose, 0);
                 $PORT{'gopher'} = $port;
                 if($pid <= 0) {
                     return ("failed starting GOPHER server", $serr);
                 }
                 logmsg sprintf("* pid gopher => %d %d\n", $pid, $pid2) if($verbose);
                 logmsg "GOPHERPORT => $port\n" if($verbose);
-                $run{'gopher'}="$pid $pid2";
+                $run{'gopher'} = "$pid $pid2";
             }
             if(!$run{'gophers'}) {
                 my $port;
@@ -2632,12 +2797,12 @@ sub startservers {
                 logmsg sprintf("* pid gophers => %d %d\n", $pid, $pid2)
                     if($verbose);
                 logmsg "GOPHERSPORT => $port\n" if($verbose);
-                $run{'gophers'}="$pid $pid2";
+                $run{'gophers'} = "$pid $pid2";
             }
         }
         elsif($what eq "https-proxy") {
             if(!$stunnel) {
-                # we can't run https-proxy tests without stunnel
+                # we cannot run https-proxy tests without stunnel
                 return ("no stunnel", 4);
             }
             if($runcert{'https-proxy'} &&
@@ -2663,15 +2828,15 @@ sub startservers {
                 }
                 logmsg sprintf("* pid https-proxy => %d %d\n", $pid, $pid2)
                     if($verbose);
-                $run{'https-proxy'}="$pid $pid2";
+                $run{'https-proxy'} = "$pid $pid2";
             }
         }
         elsif($what eq "httptls") {
             if(!$httptlssrv) {
-                # for now, we can't run http TLS-EXT tests without gnutls-serv
+                # for now, we cannot run http TLS-EXT tests without gnutls-serv
                 return ("no gnutls-serv (with SRP support)", 4);
             }
-            if($torture && $run{'httptls'} &&
+            if($run{'httptls'} &&
                !responsive_httptls_server($verbose, "IPv4")) {
                 if(stopserver('httptls')) {
                     return ("failed stopping unresponsive HTTPTLS server", 3);
@@ -2685,15 +2850,15 @@ sub startservers {
                 }
                 logmsg sprintf("* pid httptls => %d %d\n", $pid, $pid2)
                     if($verbose);
-                $run{'httptls'}="$pid $pid2";
+                $run{'httptls'} = "$pid $pid2";
             }
         }
         elsif($what eq "httptls-ipv6") {
             if(!$httptlssrv) {
-                # for now, we can't run http TLS-EXT tests without gnutls-serv
+                # for now, we cannot run http TLS-EXT tests without gnutls-serv
                 return ("no gnutls-serv", 4);
             }
-            if($torture && $run{'httptls-ipv6'} &&
+            if($run{'httptls-ipv6'} &&
                !responsive_httptls_server($verbose, "ipv6")) {
                 if(stopserver('httptls-ipv6')) {
                     return ("failed stopping unresponsive HTTPTLS-IPv6 server", 3);
@@ -2707,11 +2872,28 @@ sub startservers {
                 }
                 logmsg sprintf("* pid httptls-ipv6 => %d %d\n", $pid, $pid2)
                     if($verbose);
-                $run{'httptls-ipv6'}="$pid $pid2";
+                $run{'httptls-ipv6'} = "$pid $pid2";
+            }
+        }
+        elsif($what eq "dns") {
+            if($run{'dns'} &&
+               !responsive_dns_server("", $verbose)) {
+                if(stopserver('dns')) {
+                    return ("failed stopping unresponsive DNS server", 3);
+                }
+            }
+            if(!$run{'dns'}) {
+                ($serr, $pid, $pid2, $PORT{'dns'}) =
+                    rundnsserver("", $verbose);
+                if($pid <= 0) {
+                    return ("failed starting DNS server", $serr);
+                }
+                logmsg sprintf("* pid dns => %d %d\n", $pid, $pid2) if($verbose);
+                $run{'dns'} = "$pid $pid2";
             }
         }
         elsif($what eq "tftp") {
-            if($torture && $run{'tftp'} &&
+            if($run{'tftp'} &&
                !responsive_tftp_server("", $verbose)) {
                 if(stopserver('tftp')) {
                     return ("failed stopping unresponsive TFTP server", 3);
@@ -2724,11 +2906,11 @@ sub startservers {
                     return ("failed starting TFTP server", $serr);
                 }
                 logmsg sprintf("* pid tftp => %d %d\n", $pid, $pid2) if($verbose);
-                $run{'tftp'}="$pid $pid2";
+                $run{'tftp'} = "$pid $pid2";
             }
         }
         elsif($what eq "tftp-ipv6") {
-            if($torture && $run{'tftp-ipv6'} &&
+            if($run{'tftp-ipv6'} &&
                !responsive_tftp_server("", $verbose, "ipv6")) {
                 if(stopserver('tftp-ipv6')) {
                     return ("failed stopping unresponsive TFTP-IPv6 server", 3);
@@ -2741,7 +2923,7 @@ sub startservers {
                     return ("failed starting TFTP-IPv6 server", $serr);
                 }
                 logmsg sprintf("* pid tftp-ipv6 => %d %d\n", $pid, $pid2) if($verbose);
-                $run{'tftp-ipv6'}="$pid $pid2";
+                $run{'tftp-ipv6'} = "$pid $pid2";
             }
         }
         elsif($what eq "sftp" || $what eq "scp") {
@@ -2751,7 +2933,7 @@ sub startservers {
                     return ("failed starting SSH server", $serr);
                 }
                 logmsg sprintf("* pid ssh => %d %d\n", $pid, $pid2) if($verbose);
-                $run{'ssh'}="$pid $pid2";
+                $run{'ssh'} = "$pid $pid2";
             }
         }
         elsif($what eq "socks4" || $what eq "socks5" ) {
@@ -2761,7 +2943,7 @@ sub startservers {
                     return ("failed starting socks server", $serr);
                 }
                 logmsg sprintf("* pid socks => %d %d\n", $pid, $pid2) if($verbose);
-                $run{'socks'}="$pid $pid2";
+                $run{'socks'} = "$pid $pid2";
             }
         }
         elsif($what eq "socks5unix") {
@@ -2771,21 +2953,57 @@ sub startservers {
                     return ("failed starting socks5unix server", $serr);
                 }
                 logmsg sprintf("* pid socks5unix => %d %d\n", $pid, $pid2) if($verbose);
-                $run{'socks5unix'}="$pid $pid2";
+                $run{'socks5unix'} = "$pid $pid2";
             }
         }
         elsif($what eq "mqtt" ) {
+            if($run{'mqtt'} &&
+               !responsive_mqtt_server("mqtt", "", $verbose)) {
+                if(stopserver('mqtt')) {
+                    return ("failed stopping unresponsive MQTT server", 3);
+                }
+            }
             if(!$run{'mqtt'}) {
-                ($serr, $pid, $pid2) = runmqttserver("", $verbose);
+                ($serr, $pid, $pid2, $PORT{"mqtt"}) = runmqttserver("", $verbose);
                 if($pid <= 0) {
                     return ("failed starting mqtt server", $serr);
                 }
                 logmsg sprintf("* pid mqtt => %d %d\n", $pid, $pid2) if($verbose);
-                $run{'mqtt'}="$pid $pid2";
+                $run{'mqtt'} = "$pid $pid2";
+            }
+        }
+        elsif($what eq "mqtts" ) {
+            if(!$stunnel) {
+                # we cannot run mqtts tests without stunnel
+                return ("no stunnel", 4);
+            }
+            if($run{'mqtt'} &&
+               !responsive_mqtt_server("mqtt", "", $verbose)) {
+                if(stopserver('mqtt')) {
+                    return ("failed stopping unresponsive MQTT server", 3);
+                }
+            }
+            if(!$run{'mqtt'}) {
+                ($serr, $pid, $pid2, $PORT{"mqtt"}) = runmqttserver("", $verbose);
+                if($pid <= 0) {
+                    return ("failed starting mqtt server", $serr);
+                }
+                logmsg sprintf("* pid mqtt => %d %d\n", $pid, $pid2) if($verbose);
+                $run{'mqtt'} = "$pid $pid2";
+            }
+            if(!$run{$what}) {
+                ($serr, $pid, $pid2, $PORT{$what}) =
+                    runhttpsserver($verbose, $what, "", $certfile);
+                if($pid <= 0) {
+                    return ("failed starting MQTTS server (stunnel)", $serr);
+                }
+                logmsg sprintf("* pid $what => %d %d\n", $pid, $pid2)
+                    if($verbose);
+                $run{$what} = "$pid $pid2";
             }
         }
         elsif($what eq "http-unix") {
-            if($torture && $run{'http-unix'} &&
+            if($run{'http-unix'} &&
                !responsive_http_server("http", $verbose, "unix", $HTTPUNIXPATH)) {
                 if(stopserver('http-unix')) {
                     return ("failed stopping unresponsive HTTP-unix server", 3);
@@ -2800,7 +3018,7 @@ sub startservers {
                 }
                 logmsg sprintf("* pid http-unix => %d %d\n", $pid, $pid2)
                     if($verbose);
-                $run{'http-unix'}="$pid $pid2";
+                $run{'http-unix'} = "$pid $pid2";
             }
         }
         elsif($what eq "dict") {
@@ -2811,7 +3029,7 @@ sub startservers {
                 }
                 logmsg sprintf ("* pid DICT => %d %d\n", $pid, $pid2)
                     if($verbose);
-                $run{'dict'}="$pid $pid2";
+                $run{'dict'} = "$pid $pid2";
             }
         }
         elsif($what eq "smb") {
@@ -2822,7 +3040,7 @@ sub startservers {
                 }
                 logmsg sprintf ("* pid SMB => %d %d\n", $pid, $pid2)
                     if($verbose);
-                $run{'smb'}="$pid $pid2";
+                $run{'smb'} = "$pid $pid2";
             }
         }
         elsif($what eq "telnet") {
@@ -2834,14 +3052,11 @@ sub startservers {
                 }
                 logmsg sprintf ("* pid neg TELNET => %d %d\n", $pid, $pid2)
                     if($verbose);
-                $run{'telnet'}="$pid $pid2";
+                $run{'telnet'} = "$pid $pid2";
             }
         }
-        elsif($what eq "none") {
-            logmsg "* starts no server\n" if ($verbose);
-        }
         else {
-            warn "we don't support a server for $what";
+            warn "we do not support a server for $what";
             return ("no server for $what", 4);
         }
     }
@@ -2904,7 +3119,6 @@ sub stopservers {
     return $result;
 }
 
-
 #######################################################################
 # substitute the variable stuff into either a joined up file or
 # a command, in either case passed by reference
@@ -2919,15 +3133,15 @@ sub subvariables {
 
     # test server ports
     # Substitutes variables like %HTTPPORT and %SMTP6PORT with the server ports
-    foreach my $proto ('DICT',
+    foreach my $proto ('DICT', 'DNS',
                        'FTP', 'FTP6', 'FTPS',
                        'GOPHER', 'GOPHER6', 'GOPHERS',
-                       'HTTP', 'HTTP6', 'HTTPS',
+                       'HTTP', 'HTTP6', 'HTTPS', 'HTTPS-MTLS',
                        'HTTPSPROXY', 'HTTPTLS', 'HTTPTLS6',
                        'HTTP2', 'HTTP2TLS',
                        'HTTP3',
                        'IMAP', 'IMAP6', 'IMAPS',
-                       'MQTT',
+                       'MQTT', 'MQTTS',
                        'NOLISTEN',
                        'POP3', 'POP36', 'POP3S',
                        'RTSP', 'RTSP6',
@@ -2949,6 +3163,10 @@ sub subvariables {
     $$thing =~ s/${prefix}SOCKSUNIXPATH/$SOCKSUNIXPATH/g;
 
     # client IP addresses
+    my $nb = $CLIENT6IP;
+    $nb =~ s/^\[(.*)\]/$1/; # trim off the brackets
+
+    $$thing =~ s/${prefix}CLIENT6IP-NB/$nb/g;
     $$thing =~ s/${prefix}CLIENT6IP/$CLIENT6IP/g;
     $$thing =~ s/${prefix}CLIENTIP/$CLIENTIP/g;
 
@@ -2957,13 +3175,19 @@ sub subvariables {
     $$thing =~ s/${prefix}HOSTIP/$HOSTIP/g;
 
     # misc
+    $$thing =~ s/${prefix}PERL/$perlcmd/g;
     $$thing =~ s/${prefix}CURL/$CURL/g;
     $$thing =~ s/${prefix}LOGDIR/$LOGDIR/g;
     $$thing =~ s/${prefix}PWD/$pwd/g;
-    $$thing =~ s/${prefix}POSIX_PWD/$posix_pwd/g;
     $$thing =~ s/${prefix}VERSION/$CURLVERSION/g;
+    $$thing =~ s/${prefix}VERNUM/$CURLVERNUM/g;
+    $$thing =~ s/${prefix}DATE/$DATE/g;
     $$thing =~ s/${prefix}TESTNUMBER/$testnum/g;
+    my $resolve = server_exe('resolve', 'TOOL');
+    $$thing =~ s/${prefix}RESOLVE/$resolve/g;
 
+    # POSIX/MSYS/Cygwin curl needs: file://localhost/d/path/to
+    # Windows native    curl needs: file://localhost/D:/path/to
     my $file_pwd = $pwd;
     if($file_pwd !~ /^\//) {
         $file_pwd = "/$file_pwd";
@@ -2972,31 +3196,39 @@ sub subvariables {
     # this only works after the SSH server has been started
     # TODO: call sshversioninfo early and store $sshdid so this substitution
     # always works
-    if ($sshdid && $sshdid =~ /OpenSSH-Windows/) {
+    if($sshdid && $sshdid =~ /OpenSSH-Windows/) {
         $ssh_pwd = $file_pwd;
     }
 
     $$thing =~ s/${prefix}FILE_PWD/$file_pwd/g;
-    $$thing =~ s/${prefix}SSH_PWD/$ssh_pwd/g;
+    $$thing =~ s/${prefix}SCP_PWD/$posix_pwd/g;
+    $$thing =~ s/${prefix}SFTP_PWD/$ssh_pwd/g;
     $$thing =~ s/${prefix}SRCDIR/$srcdir/g;
+    $$thing =~ s/${prefix}CERTDIR/./g;
     $$thing =~ s/${prefix}USER/$USER/g;
+    $$thing =~ s/${prefix}DEV_NULL/$dev_null/g;
+    my $libtests = $LIBDIR . 'libtests' . exe_ext('TOOL');
+    $$thing =~ s/${prefix}LIBTESTS/$libtests/g;
 
     $$thing =~ s/${prefix}SSHSRVMD5/$SSHSRVMD5/g;
     $$thing =~ s/${prefix}SSHSRVSHA256/$SSHSRVSHA256/g;
+    my $keyalgostr = sshkeyalgostr(defined $feature{"sshkeyalgo"} ? $feature{"sshkeyalgo"} : "");
+    $$thing =~ s/${prefix}SSHKEYALGO/$keyalgostr/g;
 
-    # The purpose of FTPTIME2 and FTPTIME3 is to provide times that can be
+    # The purpose of FTPTIME2 is to provide times that can be
     # used for time-out tests and that would work on most hosts as these
     # adjust for the startup/check time for this particular host. We needed to
-    # do this to make the test suite run better on very slow hosts.
-    my $ftp2 = $ftpchecktime * 2;
-    my $ftp3 = $ftpchecktime * 3;
+    # do this to make the test suite run better on slow hosts.
+    my $ftp2 = $ftpchecktime * 8;
 
     $$thing =~ s/${prefix}FTPTIME2/$ftp2/g;
-    $$thing =~ s/${prefix}FTPTIME3/$ftp3/g;
 
     # HTTP2
     $$thing =~ s/${prefix}H2CVER/$h2cver/g;
 }
 
+sub localhttp {
+    return $HOSTIP eq "127.0.0.1";
+}
 
 1;
diff --git a/third-party/curl/tests/smbserver.py b/third-party/curl/tests/smbserver.py
index 3de8d69c0a..44daefc15a 100644
--- a/third-party/curl/tests/smbserver.py
+++ b/third-party/curl/tests/smbserver.py
@@ -21,12 +21,11 @@
 #
 # SPDX-License-Identifier: curl
 #
-"""Server for testing SMB"""
-
-from __future__ import (absolute_import, division, print_function,
-                        unicode_literals)
+"""Server for testing SMB."""
 
 import argparse
+import configparser
+import importlib.util
 import logging
 import os
 import signal
@@ -37,22 +36,16 @@ import threading
 # Import our curl test data helper
 from util import ClosingFileHandler, TestData
 
-if sys.version_info.major >= 3:
-    import configparser
-else:
-    import ConfigParser as configparser
-
 # impacket needs to be installed in the Python environment
-try:
-    import impacket
-except ImportError:
-    sys.stderr.write('Python package impacket needs to be installed!\n')
-    sys.stderr.write('Use pip or your package manager to install it.\n')
+if importlib.util.find_spec('impacket') is None:
+    sys.stderr.write(
+        'Warning: Python package impacket is required for smb testing; '
+        'use pip or your package manager to install it\n')
     sys.exit(1)
+
 from impacket import smb as imp_smb
 from impacket import smbserver as imp_smbserver
-from impacket.nt_errors import (STATUS_ACCESS_DENIED, STATUS_NO_SUCH_FILE,
-                                STATUS_SUCCESS)
+from impacket.nt_errors import STATUS_ACCESS_DENIED, STATUS_NO_SUCH_FILE, STATUS_SUCCESS
 
 log = logging.getLogger(__name__)
 SERVER_MAGIC = "SERVER_MAGIC"
@@ -62,7 +55,8 @@ VERIFIED_RSP = "WE ROOLZ: {pid}\n"
 
 
 class ShutdownHandler(threading.Thread):
-    """Cleanly shut down the SMB server
+    """
+    Cleanly shut down the SMB server.
 
     This can only be done from another thread while the server is in
     serve_forever(), so a thread is spawned here that waits for a shutdown
@@ -81,7 +75,7 @@ class ShutdownHandler(threading.Thread):
         signal.signal(signal.SIGTERM, self._sighandler)
 
     def __exit__(self, *_):
-        # Call for shutdown just in case it wasn't done already
+        # Call for shutdown in case it was not done already
         self.shutdown_event.set()
         # Wait for thread, and therefore also the server, to finish
         self.join()
@@ -89,7 +83,7 @@ class ShutdownHandler(threading.Thread):
         signal.signal(signal.SIGINT, signal.SIG_DFL)
         signal.signal(signal.SIGTERM, signal.SIG_DFL)
         # Delete any temporary files created by the server during its run
-        log.info("Deleting %d temporary files", len(self.server.tmpfiles))
+        log.info("Deleting %d temporary file(s)", len(self.server.tmpfiles))
         for f in self.server.tmpfiles:
             os.unlink(f)
 
@@ -105,14 +99,12 @@ class ShutdownHandler(threading.Thread):
 
 
 def smbserver(options):
-    """Start up a TCP SMB server that serves forever
-
-    """
+    """Start up a TCP SMB server that serves forever."""
     if options.pidfile:
         pid = os.getpid()
         # see tests/server/util.c function write_pidfile
         if os.name == "nt":
-            pid += 65536
+            pid += 4194304
         with open(options.pidfile, "w") as f:
             f.write(str(pid))
 
@@ -122,7 +114,7 @@ def smbserver(options):
     smb_config.set("global", "server_name", "SERVICE")
     smb_config.set("global", "server_os", "UNIX")
     smb_config.set("global", "server_domain", "WORKGROUP")
-    smb_config.set("global", "log_file", "")
+    smb_config.set("global", "log_file", "None")
     smb_config.set("global", "credentials_file", "")
 
     # We need a share which allows us to test that the server is running
@@ -132,7 +124,7 @@ def smbserver(options):
     smb_config.set("SERVER", "share type", "0")
     smb_config.set("SERVER", "path", SERVER_MAGIC)
 
-    # Have a share for tests.  These files will be autogenerated from the
+    # Have a share for tests.  These files are auto-generated from the
     # test input.
     smb_config.add_section("TESTS")
     smb_config.set("TESTS", "comment", "tests")
@@ -141,7 +133,7 @@ def smbserver(options):
     smb_config.set("TESTS", "path", TESTS_MAGIC)
 
     if not options.srcdir or not os.path.isdir(options.srcdir):
-        raise ScriptException("--srcdir is mandatory")
+        raise ScriptError("--srcdir is mandatory")
 
     test_data_dir = os.path.join(options.srcdir, "data")
 
@@ -153,7 +145,7 @@ def smbserver(options):
 
     # Start a thread that cleanly shuts down the server on a signal
     with ShutdownHandler(smb_server):
-        # This will block until smb_server.shutdown() is called
+        # This blocks until smb_server.shutdown() is called
         smb_server.serve_forever()
 
     return 0
@@ -178,7 +170,7 @@ class TestSmbServer(imp_smbserver.SMBSERVER):
         self.ctd = TestData(test_data_directory)
 
         # Override smbComNtCreateAndX so we can pretend to have files which
-        # don't exist.
+        # do not exist.
         self.hookSmbCommand(imp_smb.SMB.SMB_COM_NT_CREATE_ANDX,
                             self.create_and_x)
 
@@ -190,24 +182,23 @@ class TestSmbServer(imp_smbserver.SMBSERVER):
         """
         conn_data = smb_server.getConnectionData(conn_id)
 
-        # Wrap processing in a try block which allows us to throw SmbException
+        # Wrap processing in a try block which allows us to throw SmbError
         # to control the flow.
         try:
-            ncax_parms = imp_smb.SMBNtCreateAndX_Parameters(
+            ncax_params = imp_smb.SMBNtCreateAndX_Parameters(
                 smb_command["Parameters"])
 
             path = self.get_share_path(conn_data,
-                                       ncax_parms["RootFid"],
+                                       ncax_params["RootFid"],
                                        recv_packet["Tid"])
             log.info("[SMB] Requested share path: %s", path)
 
-            disposition = ncax_parms["Disposition"]
+            disposition = ncax_params["Disposition"]
             log.debug("[SMB] Requested disposition: %s", disposition)
 
             # Currently we only support reading files.
             if disposition != imp_smb.FILE_OPEN:
-                raise SmbException(STATUS_ACCESS_DENIED,
-                                   "Only support reading files")
+                raise SmbError(STATUS_ACCESS_DENIED, "Only support reading files")
 
             # Check to see if the path we were given is actually a
             # magic path which needs generating on the fly.
@@ -220,8 +211,7 @@ class TestSmbServer(imp_smbserver.SMBSERVER):
 
             flags2 = recv_packet["Flags2"]
             ncax_data = imp_smb.SMBNtCreateAndX_Data(flags=flags2,
-                                                     data=smb_command[
-                                                         "Data"])
+                                                     data=smb_command["Data"])
             requested_file = imp_smbserver.decodeSMBString(
                 flags2,
                 ncax_data["FileName"])
@@ -230,29 +220,29 @@ class TestSmbServer(imp_smbserver.SMBSERVER):
             if path == SERVER_MAGIC:
                 fid, full_path = self.get_server_path(requested_file)
             else:
-                assert (path == TESTS_MAGIC)
+                assert path == TESTS_MAGIC
                 fid, full_path = self.get_test_path(requested_file)
 
             self.tmpfiles.append(full_path)
 
-            resp_parms = imp_smb.SMBNtCreateAndXResponse_Parameters()
+            resp_params = imp_smb.SMBNtCreateAndXResponse_Parameters()
             resp_data = ""
 
             # Simple way to generate a fid
             if len(conn_data["OpenedFiles"]) == 0:
                 fakefid = 1
             else:
-                fakefid = conn_data["OpenedFiles"].keys()[-1] + 1
-            resp_parms["Fid"] = fakefid
-            resp_parms["CreateAction"] = disposition
+                fakefid = max(conn_data["OpenedFiles"].keys()) + 1
+            resp_params["Fid"] = fakefid
+            resp_params["CreateAction"] = disposition
 
             if os.path.isdir(path):
-                resp_parms[
+                resp_params[
                     "FileAttributes"] = imp_smb.SMB_FILE_ATTRIBUTE_DIRECTORY
-                resp_parms["IsDirectory"] = 1
+                resp_params["IsDirectory"] = 1
             else:
-                resp_parms["IsDirectory"] = 0
-                resp_parms["FileAttributes"] = ncax_parms["FileAttributes"]
+                resp_params["IsDirectory"] = 0
+                resp_params["FileAttributes"] = ncax_params["FileAttributes"]
 
             # Get this file's information
             resp_info, error_code = imp_smbserver.queryPathInformation(
@@ -260,19 +250,19 @@ class TestSmbServer(imp_smbserver.SMBSERVER):
                 level=imp_smb.SMB_QUERY_FILE_ALL_INFO)
 
             if error_code != STATUS_SUCCESS:
-                raise SmbException(error_code, "Failed to query path info")
+                raise SmbError(error_code, "Failed to query path info")
 
-            resp_parms["CreateTime"] = resp_info["CreationTime"]
-            resp_parms["LastAccessTime"] = resp_info[
+            resp_params["CreateTime"] = resp_info["CreationTime"]
+            resp_params["LastAccessTime"] = resp_info[
                 "LastAccessTime"]
-            resp_parms["LastWriteTime"] = resp_info["LastWriteTime"]
-            resp_parms["LastChangeTime"] = resp_info[
+            resp_params["LastWriteTime"] = resp_info["LastWriteTime"]
+            resp_params["LastChangeTime"] = resp_info[
                 "LastChangeTime"]
-            resp_parms["FileAttributes"] = resp_info[
+            resp_params["FileAttributes"] = resp_info[
                 "ExtFileAttributes"]
-            resp_parms["AllocationSize"] = resp_info[
+            resp_params["AllocationSize"] = resp_info[
                 "AllocationSize"]
-            resp_parms["EndOfFile"] = resp_info["EndOfFile"]
+            resp_params["EndOfFile"] = resp_info["EndOfFile"]
 
             # Let's store the fid for the connection
             # smbServer.log("Create file %s, mode:0x%x" % (pathName, mode))
@@ -281,14 +271,14 @@ class TestSmbServer(imp_smbserver.SMBSERVER):
             conn_data["OpenedFiles"][fakefid]["FileName"] = path
             conn_data["OpenedFiles"][fakefid]["DeleteOnClose"] = False
 
-        except SmbException as s:
-            log.debug("[SMB] SmbException hit: %s", s)
+        except SmbError as s:
+            log.debug("[SMB] SmbError hit: %s", s)
             error_code = s.error_code
-            resp_parms = ""
+            resp_params = ""
             resp_data = ""
 
         resp_cmd = imp_smb.SMBCommand(imp_smb.SMB.SMB_COM_NT_CREATE_ANDX)
-        resp_cmd["Parameters"] = resp_parms
+        resp_cmd["Parameters"] = resp_params
         resp_cmd["Data"] = resp_data
         smb_server.setConnectionData(conn_id, conn_data)
 
@@ -301,16 +291,14 @@ class TestSmbServer(imp_smbserver.SMBSERVER):
             if root_fid > 0:
                 # If we have a rootFid, the path is relative to that fid
                 path = conn_data["OpenedFiles"][root_fid]["FileName"]
-                log.debug("RootFid present %s!" % path)
+                log.debug(f'RootFid present {path}!')
             else:
                 if "path" in conn_shares[tid]:
                     path = conn_shares[tid]["path"]
                 else:
-                    raise SmbException(STATUS_ACCESS_DENIED,
-                                       "Connection share had no path")
+                    raise SmbError(STATUS_ACCESS_DENIED, "Connection share had no path")
         else:
-            raise SmbException(imp_smbserver.STATUS_SMB_BAD_TID,
-                               "TID was invalid")
+            raise SmbError(imp_smbserver.STATUS_SMB_BAD_TID, "TID was invalid")
 
         return path
 
@@ -318,20 +306,20 @@ class TestSmbServer(imp_smbserver.SMBSERVER):
         log.debug("[SMB] Get server path '%s'", requested_filename)
 
         if requested_filename not in [VERIFIED_REQ]:
-            raise SmbException(STATUS_NO_SUCH_FILE, "Couldn't find the file")
+            raise SmbError(STATUS_NO_SUCH_FILE, "Could not find the file")
 
         fid, filename = tempfile.mkstemp()
         log.debug("[SMB] Created %s (%d) for storing '%s'",
                   filename, fid, requested_filename)
 
-        contents = ""
+        contents = b''
 
         if requested_filename == VERIFIED_REQ:
             log.debug("[SMB] Verifying server is alive")
             pid = os.getpid()
             # see tests/server/util.c function write_pidfile
             if os.name == "nt":
-                pid += 65536
+                pid += 4194304
             contents = VERIFIED_RSP.format(pid=pid).encode('utf-8')
 
         self.write_to_fid(fid, contents)
@@ -357,25 +345,26 @@ class TestSmbServer(imp_smbserver.SMBSERVER):
             self.write_to_fid(fid, contents)
             return fid, filename
 
-        except Exception:
+        except Exception as e:
             log.exception("Failed to make test file")
-            raise SmbException(STATUS_NO_SUCH_FILE, "Failed to make test file")
+            raise SmbError(STATUS_NO_SUCH_FILE, "Failed to make test file") from e
 
 
-class SmbException(Exception):
+class SmbError(Exception):
     def __init__(self, error_code, error_message):
-        super(SmbException, self).__init__(error_message)
+        super(SmbError, self).__init__(error_message)
         self.error_code = error_code
 
 
-class ScriptRC(object):
-    """Enum for script return codes"""
+class ScriptRC:
+    """Enum for script return codes."""
+
     SUCCESS = 0
     FAILURE = 1
     EXCEPTION = 2
 
 
-class ScriptException(Exception):
+class ScriptError(Exception):
     pass
 
 
@@ -389,9 +378,9 @@ def get_options():
     parser.add_argument("--verbose", action="store", type=int, default=0,
                         help="verbose output")
     parser.add_argument("--pidfile", action="store",
-                        help="file name for the PID")
+                        help="filename for the PID")
     parser.add_argument("--logfile", action="store",
-                        help="file name for the log")
+                        help="filename for the log")
     parser.add_argument("--srcdir", action="store", help="test directory")
     parser.add_argument("--id", action="store", help="server ID")
     parser.add_argument("--ipv4", action="store_true", default=0,
@@ -401,9 +390,7 @@ def get_options():
 
 
 def setup_logging(options):
-    """
-    Set up logging from the command line options
-    """
+    """Set up logging from the command line options."""
     root_logger = logging.getLogger()
     add_stdout = False
 
@@ -416,7 +403,7 @@ def setup_logging(options):
         handler.setLevel(logging.DEBUG)
         root_logger.addHandler(handler)
     else:
-        # The logfile wasn't specified. Add a stdout logger.
+        # The logfile was not specified. Add a stdout logger.
         add_stdout = True
 
     if options.verbose:
@@ -424,7 +411,7 @@ def setup_logging(options):
         root_logger.setLevel(logging.DEBUG)
         add_stdout = True
     else:
-        root_logger.setLevel(logging.INFO)
+        root_logger.setLevel(logging.WARNING)
 
     if add_stdout:
         stdout_handler = logging.StreamHandler(sys.stdout)
@@ -443,8 +430,8 @@ if __name__ == '__main__':
     # Run main script.
     try:
         rc = smbserver(options)
-    except Exception as e:
-        log.exception(e)
+    except Exception:
+        log.exception('Error in SMB server')
         rc = ScriptRC.EXCEPTION
 
     if options.pidfile and os.path.isfile(options.pidfile):
diff --git a/third-party/curl/tests/sshhelp.pm b/third-party/curl/tests/sshhelp.pm
index c8df594b2f..2481de3278 100644
--- a/third-party/curl/tests/sshhelp.pm
+++ b/third-party/curl/tests/sshhelp.pm
@@ -50,6 +50,7 @@ BEGIN {
         $hstpubsha256f
         $cliprvkeyf
         $clipubkeyf
+        display_file_top
         display_sshdconfig
         display_sshconfig
         display_sftpconfig
@@ -90,14 +91,13 @@ our $sshlog          = undef;                    # ssh client log file
 our $sftplog         = undef;                    # sftp client log file
 our $sftpcmds        = 'curl_sftp_cmds';         # sftp client commands batch file
 our $knownhosts      = 'curl_client_knownhosts'; # ssh knownhosts file
-our $hstprvkeyf      = 'curl_host_rsa_key';      # host private key file
-our $hstpubkeyf      = 'curl_host_rsa_key.pub';  # host public key file
-our $hstpubmd5f      = 'curl_host_rsa_key.pub_md5';  # md5 hash of host public key
-our $hstpubsha256f   = 'curl_host_rsa_key.pub_sha256';  # sha256 hash of host public key
+our $hstprvkeyf      = 'curl_host_key';          # host private key file
+our $hstpubkeyf      = 'curl_host_key.pub';      # host public key file
+our $hstpubmd5f      = 'curl_host_key.pub_md5';  # md5 hash of host public key
+our $hstpubsha256f   = 'curl_host_key.pub_sha256';  # sha256 hash of host public key
 our $cliprvkeyf      = 'curl_client_key';        # client private key file
 our $clipubkeyf      = 'curl_client_key.pub';    # client public key file
 
-
 #***************************************************************************
 # Absolute paths where to look for sftp-server plugin, when not in PATH
 #
@@ -123,7 +123,6 @@ our @sftppath = qw(
     /opt/ssh/libexec
     );
 
-
 #***************************************************************************
 # Absolute paths where to look for httptlssrv (gnutls-serv), when not in PATH
 #
@@ -147,7 +146,6 @@ our @httptlssrvpath = qw(
     /opt/gnutls/libexec
     );
 
-
 #***************************************************************************
 # Create or overwrite the given file with lines from an array of strings
 #
@@ -173,22 +171,34 @@ sub dump_array {
     return $error;
 }
 
-
 #***************************************************************************
 # Display contents of the given file
 #
 sub display_file {
     my $filename = $_[0];
     print "=== Start of file $filename\n";
-    if(open(my $displayfh, "<", "$filename")) {
+    if(open(my $displayfh, "<", $filename)) {
         while(my $line = <$displayfh>) {
-            print "$line";
+            print $line;
         }
         close $displayfh;
     }
     print "=== End of file $filename\n";
 }
 
+#***************************************************************************
+# Display first line of the given file
+#
+sub display_file_top {
+    my $filename = $_[0];
+    print "=== Top of file $filename\n";
+    if(open(my $displayfh, "<", $filename)) {
+        my $line = <$displayfh>;
+        print $line;
+        close $displayfh;
+    }
+    print "=== End of file $filename\n";
+}
 
 #***************************************************************************
 # Display contents of the ssh daemon config file
@@ -197,7 +207,6 @@ sub display_sshdconfig {
     display_file($sshdconfig);
 }
 
-
 #***************************************************************************
 # Display contents of the ssh client config file
 #
@@ -205,7 +214,6 @@ sub display_sshconfig {
     display_file($sshconfig);
 }
 
-
 #***************************************************************************
 # Display contents of the sftp client config file
 #
@@ -213,7 +221,6 @@ sub display_sftpconfig {
     display_file($sftpconfig);
 }
 
-
 #***************************************************************************
 # Display contents of the ssh daemon log file
 #
@@ -222,7 +229,6 @@ sub display_sshdlog {
     display_file($sshdlog);
 }
 
-
 #***************************************************************************
 # Display contents of the ssh client log file
 #
@@ -231,7 +237,6 @@ sub display_sshlog {
     display_file($sshlog);
 }
 
-
 #***************************************************************************
 # Display contents of the sftp client log file
 #
@@ -240,7 +245,6 @@ sub display_sftplog {
     display_file($sftplog);
 }
 
-
 #***************************************************************************
 # Find a file somewhere in the given path
 #
@@ -257,7 +261,6 @@ sub find_file {
     return "";
 }
 
-
 #***************************************************************************
 # Find an executable file somewhere in the given path
 #
@@ -276,7 +279,6 @@ sub find_exe_file {
     return "";
 }
 
-
 #***************************************************************************
 # Find a file in environment path or in our sftppath
 #
@@ -288,7 +290,6 @@ sub find_file_spath {
     return find_file($filename, @spath);
 }
 
-
 #***************************************************************************
 # Find an executable file in environment path or in our httptlssrvpath
 #
@@ -300,7 +301,6 @@ sub find_exe_file_hpath {
     return find_exe_file($filename, @hpath);
 }
 
-
 #***************************************************************************
 # Find ssh daemon and return canonical filename
 #
@@ -308,7 +308,6 @@ sub find_sshd {
     return find_file_spath($sshdexe);
 }
 
-
 #***************************************************************************
 # Find ssh client and return canonical filename
 #
@@ -316,7 +315,6 @@ sub find_ssh {
     return find_file_spath($sshexe);
 }
 
-
 #***************************************************************************
 # Find sftp-server plugin and return canonical filename
 #
@@ -324,7 +322,6 @@ sub find_sftpsrv {
     return find_file_spath($sftpsrvexe);
 }
 
-
 #***************************************************************************
 # Find sftp client and return canonical filename
 #
@@ -332,7 +329,6 @@ sub find_sftp {
     return find_file_spath($sftpexe);
 }
 
-
 #***************************************************************************
 # Find ssh-keygen and return canonical filename
 #
@@ -340,14 +336,13 @@ sub find_sshkeygen {
     return find_file_spath($sshkeygenexe);
 }
 
-
 #***************************************************************************
 # Find httptlssrv (gnutls-serv) and return canonical filename
 #
 sub find_httptlssrv {
     my $p = find_exe_file_hpath($httptlssrvexe);
     if($p) {
-        my @o = `"$p" -l`;
+        my @o = qx("$p" -l);
         my $found;
         for(@o) {
             if(/Key exchange: SRP/) {
@@ -360,7 +355,6 @@ sub find_httptlssrv {
     return "";
 }
 
-
 #***************************************************************************
 # Return version info for the given ssh client or server binaries
 #
@@ -387,7 +381,7 @@ sub sshversioninfo {
             if($tmpstr =~ /OpenSSH[_-](\d+)\.(\d+)(\.(\d+))*/i) {
                 $major = $1;
                 $minor = $2;
-                $patch = $4?$4:0;
+                $patch = $4 ? $4 : 0;
                 $sshid = 'OpenSSH';
                 $versnum = (100*$major) + (10*$minor) + $patch;
                 $versstr = "$sshid $major.$minor.$patch";
@@ -397,7 +391,7 @@ sub sshversioninfo {
             if($tmpstr =~ /OpenSSH[_-]for[_-]Windows[_-](\d+)\.(\d+)(\.(\d+))*/i) {
                 $major = $1;
                 $minor = $2;
-                $patch = $4?$4:0;
+                $patch = $4 ? $4 : 0;
                 $sshid = 'OpenSSH-Windows';
                 $versnum = (100*$major) + (10*$minor) + $patch;
                 $versstr = "$sshid $major.$minor.$patch";
@@ -407,7 +401,7 @@ sub sshversioninfo {
             if($tmpstr =~ /Sun[_-]SSH[_-](\d+)\.(\d+)(\.(\d+))*/i) {
                 $major = $1;
                 $minor = $2;
-                $patch = $4?$4:0;
+                $patch = $4 ? $4 : 0;
                 $sshid = 'SunSSH';
                 $versnum = (100*$major) + (10*$minor) + $patch;
                 $versstr = "$sshid $major.$minor.$patch";
@@ -421,7 +415,6 @@ sub sshversioninfo {
     return ($sshid, $versnum, $versstr, $error);
 }
 
-
 #***************************************************************************
 # End of library
 1;
diff --git a/third-party/curl/tests/sshserver.pl b/third-party/curl/tests/sshserver.pl
index 2a69561892..2461b668b1 100644
--- a/third-party/curl/tests/sshserver.pl
+++ b/third-party/curl/tests/sshserver.pl
@@ -60,6 +60,7 @@ use sshhelp qw(
     $hstpubsha256f
     $cliprvkeyf
     $clipubkeyf
+    display_file_top
     display_sshdconfig
     display_sshconfig
     display_sftpconfig
@@ -79,7 +80,6 @@ use sshhelp qw(
 # Subs imported from serverhelp module
 #
 use serverhelp qw(
-    logmsg
     $logfile
     server_pidfilename
     server_logfilename
@@ -96,6 +96,7 @@ my $listenaddr = '127.0.0.1'; # default address on which to listen
 my $ipvnum = 4;               # default IP version of listener address
 my $idnum = 1;                # default ssh daemon instance number
 my $proto = 'ssh';            # protocol the ssh daemon speaks
+my $keyalgo = 'rsa';          # key algorithm
 my $path = getcwd();          # current working directory
 my $logdir = $path .'/log';   # directory for log files
 my $piddir;                   # directory for server config files
@@ -107,7 +108,7 @@ my $error;
 my @cfgarr;
 
 #***************************************************************************
-# Returns a path of the given file name in the log directory (PiddirPath)
+# Returns a path of the given filename in the log directory (PiddirPath)
 #
 sub pp {
     my $file = $_[0];
@@ -115,6 +116,14 @@ sub pp {
     # TODO: do Windows path conversion here
 }
 
+#***************************************************************************
+# Save the message to the log and print it
+sub logmsg {
+    my $msg = $_[0];
+    serverhelp::logmsg $msg;
+    print $msg;
+}
+
 #***************************************************************************
 # Parse command line options
 #
@@ -182,8 +191,14 @@ while(@ARGV) {
             }
         }
     }
+    elsif($ARGV[0] eq '--keyalgo') {
+        if($ARGV[1]) {
+            $keyalgo = $ARGV[1];
+            shift @ARGV;
+        }
+    }
     else {
-        print STDERR "\nWarning: sshserver.pl unknown parameter: $ARGV[0]\n";
+        print STDERR "\nWarning: sshserver.pl unknown parameter: '$ARGV[0]'\n";
     }
     shift @ARGV;
 }
@@ -193,7 +208,7 @@ while(@ARGV) {
 #
 
 #***************************************************************************
-# Default ssh daemon pid file name & directory
+# Default ssh daemon pid filename & directory
 #
 if($pidfile) {
     # Use our pidfile directory to store server config files
@@ -206,7 +221,7 @@ else {
 }
 
 #***************************************************************************
-# ssh and sftp server log file names
+# ssh and sftp server log filenames
 #
 $sshdlog = server_logfilename($logdir, 'ssh', $ipvnum, $idnum);
 $sftplog = server_logfilename($logdir, 'sftp', $ipvnum, $idnum);
@@ -215,14 +230,13 @@ $logfile = "$logdir/sshserver.log";  # used by logmsg
 #***************************************************************************
 # Logging level for ssh server and client
 #
-my $loglevel = $debugprotocol?'DEBUG3':'DEBUG2';
-
+my $loglevel = $debugprotocol ? 'DEBUG3' : 'DEBUG2';
 
 #***************************************************************************
 # Validate username
 #
 if(!$username) {
-    $error = 'Will not run ssh server without a user name';
+    $error = 'Will not run ssh server without a username';
 }
 elsif($username eq 'root') {
     $error = 'Will not run ssh server as root to mitigate security risks';
@@ -232,9 +246,8 @@ if($error) {
     exit 1;
 }
 
-
 #***************************************************************************
-# Find out ssh daemon canonical file name
+# Find out ssh daemon canonical filename
 #
 my $sshd = find_sshd();
 if(!$sshd) {
@@ -242,7 +255,6 @@ if(!$sshd) {
     exit 1;
 }
 
-
 #***************************************************************************
 # Find out ssh daemon version info
 #
@@ -255,7 +267,6 @@ if(!$sshdid) {
 }
 logmsg "ssh server found $sshd is $sshdverstr\n" if($verbose);
 
-
 #***************************************************************************
 #  ssh daemon command line options we might use and version support
 #
@@ -273,7 +284,6 @@ logmsg "ssh server found $sshd is $sshdverstr\n" if($verbose);
 #  -t:  test config file     : SunSSH 1.0.0 and later
 #  -?:  sshd version info    : SunSSH 1.0.0 and later
 
-
 #***************************************************************************
 # Verify minimum ssh daemon version
 #
@@ -283,9 +293,8 @@ if((($sshdid =~ /OpenSSH/) && ($sshdvernum < 299)) ||
     exit 1;
 }
 
-
 #***************************************************************************
-# Find out sftp server plugin canonical file name
+# Find out sftp server plugin canonical filename
 #
 my $sftpsrv = find_sftpsrv();
 if(!$sftpsrv) {
@@ -294,9 +303,8 @@ if(!$sftpsrv) {
 }
 logmsg "sftp server plugin found $sftpsrv\n" if($verbose);
 
-
 #***************************************************************************
-# Find out sftp client canonical file name
+# Find out sftp client canonical filename
 #
 my $sftp = find_sftp();
 if(!$sftp) {
@@ -305,9 +313,8 @@ if(!$sftp) {
 }
 logmsg "sftp client found $sftp\n" if($verbose);
 
-
 #***************************************************************************
-# Find out ssh keygen canonical file name
+# Find out ssh keygen canonical filename
 #
 my $sshkeygen = find_sshkeygen();
 if(!$sshkeygen) {
@@ -316,9 +323,8 @@ if(!$sshkeygen) {
 }
 logmsg "ssh keygen found $sshkeygen\n" if($verbose);
 
-
 #***************************************************************************
-# Find out ssh client canonical file name
+# Find out ssh client canonical filename
 #
 my $ssh = find_ssh();
 if(!$ssh) {
@@ -326,7 +332,6 @@ if(!$ssh) {
     exit 1;
 }
 
-
 #***************************************************************************
 # Find out ssh client version info
 #
@@ -339,7 +344,6 @@ if(!$sshid) {
 }
 logmsg "ssh client found $ssh is $sshverstr\n" if($verbose);
 
-
 #***************************************************************************
 #  ssh client command line options we might use and version support
 #
@@ -359,7 +363,6 @@ logmsg "ssh client found $ssh is $sshverstr\n" if($verbose);
 # -vv:  increase verbosity           : SunSSH 1.0.0 and later
 #  -V:  ssh version info             : SunSSH 1.0.0 and later
 
-
 #***************************************************************************
 # Verify minimum ssh client version
 #
@@ -369,7 +372,6 @@ if((($sshid =~ /OpenSSH/) && ($sshvernum < 299)) ||
     exit 1;
 }
 
-
 #***************************************************************************
 #  ssh keygen command line options we actually use and version support
 #
@@ -378,6 +380,7 @@ if((($sshid =~ /OpenSSH/) && ($sshvernum < 299)) ||
 #  -N:  new passphrase   : OpenSSH 1.2.1 and later
 #  -q:  quiet keygen     : OpenSSH 1.2.1 and later
 #  -t:  key type         : OpenSSH 2.5.0 and later
+#  -m:  key format       : OpenSSH 5.6.0 and later
 #
 #  -C:  identity comment : SunSSH 1.0.0 and later
 #  -f:  key filename     : SunSSH 1.0.0 and later
@@ -385,6 +388,9 @@ if((($sshid =~ /OpenSSH/) && ($sshvernum < 299)) ||
 #  -q:  quiet keygen     : SunSSH 1.0.0 and later
 #  -t:  key type         : SunSSH 1.0.0 and later
 
+$sshdconfig = pp($sshdconfig);
+$sshconfig = pp($sshconfig);
+$sftpconfig = pp($sftpconfig);
 
 #***************************************************************************
 # Generate host and client key files for curl's tests
@@ -395,75 +401,100 @@ if((! -e pp($hstprvkeyf)) || (! -s pp($hstprvkeyf)) ||
    (! -e pp($hstpubsha256f)) || (! -s pp($hstpubsha256f)) ||
    (! -e pp($cliprvkeyf)) || (! -s pp($cliprvkeyf)) ||
    (! -e pp($clipubkeyf)) || (! -s pp($clipubkeyf))) {
-    # Make sure all files are gone so ssh-keygen doesn't complain
+    # Make sure all files are gone so ssh-keygen does not complain
     unlink(pp($hstprvkeyf), pp($hstpubkeyf), pp($hstpubmd5f),
            pp($hstpubsha256f), pp($cliprvkeyf), pp($clipubkeyf));
+
+    my @sshkeygenopt;
+    if(($sshid =~ /OpenSSH/) && ($sshvernum >= 560) && ($keyalgo ne 'ed25519')) {
+        # Override the default key format. Necessary to force legacy PEM format
+        # for libssh2 crypto backends that do not understand the OpenSSH (RFC4716)
+        # format, e.g. WinCNG.
+        # Accepted values: RFC4716, PKCS8, PEM (see also 'man ssh-keygen')
+        # Default to the most compatible format for tests.
+        push @sshkeygenopt, '-m', $ENV{'CURL_TEST_SSH_KEY_FORMAT'} ? $ENV{'CURL_TEST_SSH_KEY_FORMAT'} : 'PEM';
+    }
     logmsg "generating host keys...\n" if($verbose);
-    if(system "\"$sshkeygen\" -q -t rsa -f " . pp($hstprvkeyf) . " -C 'curl test server' -N ''") {
+    if(system($sshkeygen, ('-q', '-t', $keyalgo, '-f', pp($hstprvkeyf), '-C', 'curl test server', '-N', '', @sshkeygenopt))) {
         logmsg "Could not generate host key\n";
         exit 1;
     }
+    display_file_top(pp($hstprvkeyf)) if($verbose);
     logmsg "generating client keys...\n" if($verbose);
-    if(system "\"$sshkeygen\" -q -t rsa -f " . pp($cliprvkeyf) . " -C 'curl test client' -N ''") {
+    if(system($sshkeygen, ('-q', '-t', $keyalgo, '-f', pp($cliprvkeyf), '-C', 'curl test client', '-N', '', @sshkeygenopt))) {
         logmsg "Could not generate client key\n";
         exit 1;
     }
-    # Make sure that permissions are restricted so openssh doesn't complain
-    system "chmod 600 " . pp($hstprvkeyf);
-    system "chmod 600 " . pp($cliprvkeyf);
+    display_file_top(pp($cliprvkeyf)) if($verbose);
+    # Make sure that permissions are restricted so openssh does not complain
+    chmod 0600, pp($hstprvkeyf);
+    chmod 0600, pp($cliprvkeyf);
+    if(($^O eq 'cygwin' || $^O eq 'msys') && -e "/bin/setfacl") {
+        # https://cygwin.com/cygwin-ug-net/setfacl.html
+        system('/bin/setfacl', ('--remove-all', pp($hstprvkeyf)));
+    }
+    elsif(pathhelp::os_is_win()) {
+        # https://ss64.com/nt/icacls.html
+        $ENV{'MSYS2_ARG_CONV_EXCL'} = '/reset';
+        system('icacls', (pathhelp::sys_native_abs_path(pp($hstprvkeyf)), '/reset'));
+        system('icacls', (pathhelp::sys_native_abs_path(pp($hstprvkeyf)), '/grant:r', "$username:(R)"));
+        system('icacls', (pathhelp::sys_native_abs_path(pp($hstprvkeyf)), '/inheritance:r'));
+    }
     # Save md5 and sha256 hashes of public host key
     open(my $rsakeyfile, "<", pp($hstpubkeyf));
     my @rsahostkey = do { local $/ = ' '; <$rsakeyfile> };
     close($rsakeyfile);
     if(!$rsahostkey[1]) {
-        logmsg "Failed parsing base64 encoded RSA host key\n";
+        logmsg "Failed parsing base64 encoded SSH host key\n";
         exit 1;
     }
     open(my $pubmd5file, ">", pp($hstpubmd5f));
     print $pubmd5file md5_hex(decode_base64($rsahostkey[1]));
     close($pubmd5file);
     if((! -e pp($hstpubmd5f)) || (! -s pp($hstpubmd5f))) {
-        logmsg "Failed writing md5 hash of RSA host key\n";
+        logmsg "Failed writing MD5 hash of SSH host key\n";
         exit 1;
     }
     open(my $pubsha256file, ">", pp($hstpubsha256f));
     print $pubsha256file sha256_base64(decode_base64($rsahostkey[1]));
     close($pubsha256file);
     if((! -e pp($hstpubsha256f)) || (! -s pp($hstpubsha256f))) {
-        logmsg "Failed writing sha256 hash of RSA host key\n";
+        logmsg "Failed writing SHA256 hash of SSH host key\n";
         exit 1;
     }
 }
 
-
 #***************************************************************************
-# Convert paths for curl's tests running on Windows with Cygwin/Msys OpenSSH
+# Convert paths for curl's tests running on Windows with Cygwin/MSYS OpenSSH
 #
 my $clipubkeyf_config;
 my $hstprvkeyf_config;
 my $pidfile_config;
 my $sftpsrv_config;
-if ($sshdid =~ /OpenSSH-Windows/) {
+my $sshdconfig_abs;
+if($sshdid =~ /OpenSSH-Windows/) {
     # Ensure to use native Windows paths with OpenSSH for Windows
     $clipubkeyf_config = pathhelp::sys_native_abs_path(pp($clipubkeyf));
     $hstprvkeyf_config = pathhelp::sys_native_abs_path(pp($hstprvkeyf));
     $pidfile_config = pathhelp::sys_native_abs_path($pidfile);
     $sftpsrv_config = pathhelp::sys_native_abs_path($sftpsrv);
+    $sshdconfig_abs = pathhelp::sys_native_abs_path($sshdconfig);
 }
-elsif (pathhelp::os_is_win()) {
+elsif(pathhelp::os_is_win()) {
     # Ensure to use MinGW/Cygwin paths
-    $clipubkeyf_config = pathhelp::build_sys_abs_path($clipubkeyf_config);
-    $hstprvkeyf_config = pathhelp::build_sys_abs_path($hstprvkeyf_config);
-    $pidfile_config = pathhelp::build_sys_abs_path($pidfile_config);
+    $clipubkeyf_config = pathhelp::build_sys_abs_path(pp($clipubkeyf));
+    $hstprvkeyf_config = pathhelp::build_sys_abs_path(pp($hstprvkeyf));
+    $pidfile_config = pathhelp::build_sys_abs_path($pidfile);
     $sftpsrv_config = "internal-sftp";
+    $sshdconfig_abs = pathhelp::build_sys_abs_path($sshdconfig);
 }
 else {
     $clipubkeyf_config = abs_path(pp($clipubkeyf));
     $hstprvkeyf_config = abs_path(pp($hstprvkeyf));
     $pidfile_config = $pidfile;
     $sftpsrv_config = $sftpsrv;
+    $sshdconfig_abs = abs_path($sshdconfig);
 }
-my $sshdconfig_abs = pathhelp::sys_native_abs_path(pp($sshdconfig));
 
 #***************************************************************************
 #  ssh daemon configuration file options we might use and version support
@@ -473,7 +504,7 @@ my $sshdconfig_abs = pathhelp::sys_native_abs_path(pp($sshdconfig));
 #  AllowTcpForwarding               : OpenSSH 2.3.0 and later
 #  AllowUsers                       : OpenSSH 1.2.1 and later
 #  AuthorizedKeysFile               : OpenSSH 2.9.9 and later
-#  AuthorizedKeysFile2              : OpenSSH 2.9.9 and later
+#  AuthorizedKeysFile2              : OpenSSH 2.9.9 till 5.9
 #  Banner                           : OpenSSH 2.5.0 and later
 #  ChallengeResponseAuthentication  : OpenSSH 2.5.0 and later
 #  Ciphers                          : OpenSSH 2.1.0 and later [3]
@@ -501,7 +532,8 @@ my $sshdconfig_abs = pathhelp::sys_native_abs_path(pp($sshdconfig));
 #  KerberosOrLocalPasswd            : OpenSSH 1.2.1 and later [1]
 #  KerberosTgtPassing               : OpenSSH 1.2.1 and later [1]
 #  KerberosTicketCleanup            : OpenSSH 1.2.1 and later [1]
-#  KeyRegenerationInterval          : OpenSSH 1.2.1 and later
+#  KexAlgorithms                    : OpenSSH 5.7.0 and later (7.0.0 for '+' support, 7.5.0 for '-' support)
+#  KeyRegenerationInterval          : OpenSSH 1.2.1 till 7.3
 #  ListenAddress                    : OpenSSH 1.2.1 and later
 #  LoginGraceTime                   : OpenSSH 1.2.1 and later
 #  LogLevel                         : OpenSSH 1.2.1 and later
@@ -524,16 +556,16 @@ my $sshdconfig_abs = pathhelp::sys_native_abs_path(pp($sshdconfig));
 #  Protocol                         : OpenSSH 2.1.0 and later
 #  PubkeyAuthentication             : OpenSSH 2.5.0 and later
 #  RhostsAuthentication             : OpenSSH 1.2.1 and later
-#  RhostsRSAAuthentication          : OpenSSH 1.2.1 and later
-#  RSAAuthentication                : OpenSSH 1.2.1 and later
-#  ServerKeyBits                    : OpenSSH 1.2.1 and later
+#  RhostsRSAAuthentication          : OpenSSH 1.2.1 till 7.3
+#  RSAAuthentication                : OpenSSH 1.2.1 till 7.3
+#  ServerKeyBits                    : OpenSSH 1.2.1 till 7.3
 #  SkeyAuthentication               : OpenSSH 1.2.1 and later [1]
 #  StrictModes                      : OpenSSH 1.2.1 and later
 #  Subsystem                        : OpenSSH 2.2.0 and later
 #  SyslogFacility                   : OpenSSH 1.2.1 and later
 #  TCPKeepAlive                     : OpenSSH 3.8.0 and later
 #  UseDNS                           : OpenSSH 3.7.0 and later
-#  UseLogin                         : OpenSSH 1.2.1 and later
+#  UseLogin                         : OpenSSH 1.2.1 till 7.3
 #  UsePAM                           : OpenSSH 3.7.0 and later [1][2]
 #  UsePrivilegeSeparation           : OpenSSH 3.2.2 and later
 #  VerifyReverseMapping             : OpenSSH 3.1.0 and later
@@ -546,7 +578,6 @@ my $sshdconfig_abs = pathhelp::sys_native_abs_path(pp($sshdconfig));
 #  [2] Option specific for portable versions
 #  [3] Option not used in our ssh server config file
 
-
 #***************************************************************************
 # Initialize sshd config with options actually supported in OpenSSH 2.9.9
 #
@@ -557,29 +588,29 @@ push @cfgarr, "# $sshdverstr sshd configuration file for curl testing";
 push @cfgarr, '#';
 
 # AllowUsers and DenyUsers options should use lowercase on Windows
-# and do not support quotes around values for some unknown reason.
-if ($sshdid =~ /OpenSSH-Windows/) {
+# and do not support quotes around values for an unknown reason.
+if($sshdid =~ /OpenSSH-Windows/) {
     my $username_lc = lc $username;
-    if (exists $ENV{USERDOMAIN}) {
+    push @cfgarr, "AllowUsers " . ($username_lc =~ s/ /\?/gr);  # replace space with '?'
+    if(exists $ENV{USERDOMAIN}) {
         my $userdomain_lc = lc $ENV{USERDOMAIN};
         $username_lc = "$userdomain_lc\\$username_lc";
+        push @cfgarr, "AllowUsers " . ($username_lc =~ s/ /\?/gr);  # replace space with '?'
     }
-    $username_lc =~ s/ /\?/g; # replace space with ?
-    push @cfgarr, "DenyUsers !$username_lc";
-    push @cfgarr, "AllowUsers $username_lc";
 } else {
-    push @cfgarr, "DenyUsers !$username";
     push @cfgarr, "AllowUsers $username";
 }
 
 push @cfgarr, "AuthorizedKeysFile $clipubkeyf_config";
-push @cfgarr, "AuthorizedKeysFile2 $clipubkeyf_config";
+if(!($sshdid =~ /OpenSSH/) || ($sshdvernum <= 590)) {
+    push @cfgarr, "AuthorizedKeysFile2 $clipubkeyf_config";
+}
 push @cfgarr, "HostKey $hstprvkeyf_config";
-if ($sshdid !~ /OpenSSH-Windows/) {
+if($sshdid !~ /OpenSSH-Windows/) {
     push @cfgarr, "PidFile $pidfile_config";
     push @cfgarr, '#';
 }
-if(($sshdid =~ /OpenSSH/) && ($sshdvernum >= 880)) {
+if(($sshdid =~ /OpenSSH/) && ($sshdvernum >= 880) && ($keyalgo eq 'rsa')) {
     push @cfgarr, 'HostKeyAlgorithms +ssh-rsa';
     push @cfgarr, 'PubkeyAcceptedKeyTypes +ssh-rsa';
 }
@@ -598,7 +629,12 @@ push @cfgarr, 'HostbasedAuthentication no';
 push @cfgarr, 'HostbasedUsesNameFromPacketOnly no';
 push @cfgarr, 'IgnoreRhosts yes';
 push @cfgarr, 'IgnoreUserKnownHosts yes';
-push @cfgarr, 'KeyRegenerationInterval 0';
+if(($sshdid =~ /OpenSSH/) && ($sshdvernum >= 700) && $ENV{'CURL_TEST_SSH_ENABLE_KEX'}) {
+    push @cfgarr, 'KexAlgorithms +' . $ENV{'CURL_TEST_SSH_ENABLE_KEX'};
+}
+if(($sshdid =~ /OpenSSH/) && ($sshdvernum >= 750) && $ENV{'CURL_TEST_SSH_DISABLE_KEX'}) {
+    push @cfgarr, 'KexAlgorithms -' . $ENV{'CURL_TEST_SSH_DISABLE_KEX'};
+}
 push @cfgarr, 'LoginGraceTime 30';
 push @cfgarr, "LogLevel $loglevel";
 push @cfgarr, 'MaxStartups 5';
@@ -608,27 +644,28 @@ push @cfgarr, 'PermitRootLogin no';
 push @cfgarr, 'PrintLastLog no';
 push @cfgarr, 'PrintMotd no';
 push @cfgarr, 'PubkeyAuthentication yes';
-push @cfgarr, 'RhostsRSAAuthentication no';
-push @cfgarr, 'RSAAuthentication no';
-push @cfgarr, 'ServerKeyBits 768';
 push @cfgarr, 'StrictModes no';
 push @cfgarr, "Subsystem sftp \"$sftpsrv_config\"";
 push @cfgarr, 'SyslogFacility AUTH';
-push @cfgarr, 'UseLogin no';
+if(!($sshdid =~ /OpenSSH/) || ($sshdvernum <= 730)) {
+    push @cfgarr, 'KeyRegenerationInterval 0';
+    push @cfgarr, 'RhostsRSAAuthentication no';
+    push @cfgarr, 'RSAAuthentication no';
+    push @cfgarr, 'ServerKeyBits 768';
+    push @cfgarr, 'UseLogin no';
+}
 push @cfgarr, 'X11Forwarding no';
 push @cfgarr, '#';
 
-
 #***************************************************************************
 # Write out initial sshd configuration file for curl's tests
 #
-$error = dump_array(pp($sshdconfig), @cfgarr);
+$error = dump_array($sshdconfig, @cfgarr);
 if($error) {
     logmsg "$error\n";
     exit 1;
 }
 
-
 #***************************************************************************
 # Verifies at run time if sshd supports a given configuration file option
 #
@@ -640,25 +677,24 @@ sub sshd_supports_opt {
         ($sshdid =~ /SunSSH/)) {
         # ssh daemon supports command line options -t -f and -o
         $err = grep /((Unsupported)|(Bad configuration)|(Deprecated)) option.*$option/,
-                    `\"$sshd\" -t -f $sshdconfig_abs -o \"$option=$value\" 2>&1`;
+                    qx(\"$sshd\" -t -f $sshdconfig_abs -o \"$option=$value\" 2>&1);
         return !$err;
     }
     if(($sshdid =~ /OpenSSH/) && ($sshdvernum >= 299)) {
         # ssh daemon supports command line options -t and -f
-        $err = dump_array(pp($sshdconfig), (@cfgarr, "$option $value"));
+        $err = dump_array($sshdconfig, (@cfgarr, "$option $value"));
         if($err) {
             logmsg "$err\n";
             return 0;
         }
         $err = grep /((Unsupported)|(Bad configuration)|(Deprecated)) option.*$option/,
-                    `\"$sshd\" -t -f $sshdconfig_abs 2>&1`;
-        unlink pp($sshdconfig);
+                    qx(\"$sshd\" -t -f $sshdconfig_abs 2>&1);
+        unlink $sshdconfig;
         return !$err;
     }
     return 0;
 }
 
-
 #***************************************************************************
 # Kerberos Authentication support may have not been built into sshd
 #
@@ -678,7 +714,6 @@ if(sshd_supports_opt('KerberosTicketCleanup','yes')) {
     push @cfgarr, 'KerberosTicketCleanup yes';
 }
 
-
 #***************************************************************************
 # Andrew File System support may have not been built into sshd
 #
@@ -686,7 +721,6 @@ if(sshd_supports_opt('AFSTokenPassing','no')) {
     push @cfgarr, 'AFSTokenPassing no';
 }
 
-
 #***************************************************************************
 # S/Key authentication support may have not been built into sshd
 #
@@ -694,7 +728,6 @@ if(sshd_supports_opt('SkeyAuthentication','no')) {
     push @cfgarr, 'SkeyAuthentication no';
 }
 
-
 #***************************************************************************
 # GSSAPI Authentication support may have not been built into sshd
 #
@@ -720,7 +753,6 @@ if(sshd_supports_opt('GSSUseSessionCredCache','no')) {
 }
 push @cfgarr, '#';
 
-
 #***************************************************************************
 # Options that might be supported or not in sshd OpenSSH 2.9.9 and later
 #
@@ -780,39 +812,37 @@ if(sshd_supports_opt('X11UseLocalhost','yes')) {
 }
 push @cfgarr, '#';
 
-
 #***************************************************************************
 # Write out resulting sshd configuration file for curl's tests
 #
-$error = dump_array(pp($sshdconfig), @cfgarr);
+$error = dump_array($sshdconfig, @cfgarr);
 if($error) {
     logmsg "$error\n";
     exit 1;
 }
 
-
 #***************************************************************************
 # Verify that sshd actually supports our generated configuration file
 #
-if(system "\"$sshd\" -t -f $sshdconfig_abs > $sshdlog 2>&1") {
+if(system("\"$sshd\" -t -f $sshdconfig_abs > $sshdlog 2>&1")) {
     logmsg "sshd configuration file $sshdconfig failed verification\n";
     display_sshdlog();
     display_sshdconfig();
     exit 1;
 }
 
-
 #***************************************************************************
 # Generate ssh client host key database file for curl's tests
 #
 if((! -e pp($knownhosts)) || (! -s pp($knownhosts))) {
     logmsg "generating ssh client known hosts file...\n" if($verbose);
     unlink(pp($knownhosts));
-    if(open(my $rsakeyfile, "<", pp($hstpubkeyf))) {
-        my @rsahostkey = do { local $/ = ' '; <$rsakeyfile> };
-        if(close($rsakeyfile)) {
+    if(open(my $keyfile, "<", pp($hstpubkeyf))) {
+        chomp(my $line = <$keyfile>);
+        if(close($keyfile)) {
             if(open(my $knownhostsh, ">", pp($knownhosts))) {
-                print $knownhostsh "$listenaddr ssh-rsa $rsahostkey[1]\n";
+                my @hostkey = split /\s+/, $line;
+                print $knownhostsh "$listenaddr $hostkey[0] $hostkey[1]\n";
                 if(!close($knownhostsh)) {
                     $error = "Error: cannot close file $knownhosts";
                 }
@@ -834,28 +864,26 @@ if((! -e pp($knownhosts)) || (! -s pp($knownhosts))) {
     }
 }
 
-
 #***************************************************************************
 # Convert paths for curl's tests running on Windows using Cygwin OpenSSH
 #
 my $identity_config;
 my $knownhosts_config;
-if ($sshdid =~ /OpenSSH-Windows/) {
+if($sshdid =~ /OpenSSH-Windows/) {
     # Ensure to use native Windows paths with OpenSSH for Windows
     $identity_config = pathhelp::sys_native_abs_path(pp($identity));
     $knownhosts_config = pathhelp::sys_native_abs_path(pp($knownhosts));
 }
-elsif (pathhelp::os_is_win()) {
+elsif(pathhelp::os_is_win()) {
     # Ensure to use MinGW/Cygwin paths
-    $identity_config = pathhelp::build_sys_abs_path($identity_config);
-    $knownhosts_config = pathhelp::build_sys_abs_path($knownhosts_config);
+    $identity_config = pathhelp::build_sys_abs_path(pp($identity));
+    $knownhosts_config = pathhelp::build_sys_abs_path(pp($knownhosts));
 }
 else {
     $identity_config = abs_path(pp($identity));
     $knownhosts_config = abs_path(pp($knownhosts));
 }
 
-
 #***************************************************************************
 #  ssh client configuration file options we might use and version support
 #
@@ -932,7 +960,6 @@ else {
 #  [2] Option specific for portable versions
 #  [3] Option not used in our ssh client config file
 
-
 #***************************************************************************
 # Initialize ssh config with options actually supported in OpenSSH 2.9.9
 #
@@ -950,7 +977,7 @@ push @cfgarr, 'Protocol 2';
 push @cfgarr, '#';
 
 # BindAddress option is not supported by OpenSSH for Windows
-if (!($sshdid =~ /OpenSSH-Windows/)) {
+if(!($sshdid =~ /OpenSSH-Windows/)) {
     push @cfgarr, "BindAddress $listenaddr";
 }
 
@@ -976,8 +1003,8 @@ push @cfgarr, 'PasswordAuthentication no';
 push @cfgarr, 'PreferredAuthentications publickey';
 push @cfgarr, 'PubkeyAuthentication yes';
 
-# RSA authentication options are not supported by OpenSSH for Windows
-if (!($sshdid =~ /OpenSSH-Windows/)) {
+# RSA authentication options are deprecated by newer OpenSSH
+if(!($sshid =~ /OpenSSH/) || ($sshvernum <= 730)) {
     push @cfgarr, 'RhostsRSAAuthentication no';
     push @cfgarr, 'RSAAuthentication no';
 }
@@ -988,7 +1015,6 @@ push @cfgarr, 'StrictHostKeyChecking no';
 push @cfgarr, 'UsePrivilegedPort no';
 push @cfgarr, '#';
 
-
 #***************************************************************************
 # Options supported in ssh client newer than OpenSSH 2.9.9
 #
@@ -1088,17 +1114,15 @@ if(($sshid =~ /OpenSSH/) && ($sshvernum >= 380)) {
 
 push @cfgarr, '#';
 
-
 #***************************************************************************
 # Write out resulting ssh client configuration file for curl's tests
 #
-$error = dump_array(pp($sshconfig), @cfgarr);
+$error = dump_array($sshconfig, @cfgarr);
 if($error) {
     logmsg "$error\n";
     exit 1;
 }
 
-
 #***************************************************************************
 # Initialize client sftp config with options actually supported.
 #
@@ -1116,18 +1140,16 @@ for(my $i = scalar(@cfgarr) - 1; $i > 0; $i--) {
     }
 }
 
-
 #***************************************************************************
 # Write out resulting sftp client configuration file for curl's tests
 #
-$error = dump_array(pp($sftpconfig), @cfgarr);
+$error = dump_array($sftpconfig, @cfgarr);
 if($error) {
     logmsg "$error\n";
     exit 1;
 }
 @cfgarr = ();
 
-
 #***************************************************************************
 # Generate client sftp commands batch file for sftp server verification
 #
@@ -1151,9 +1173,9 @@ logmsg "RUN: $cmd\n" if($verbose);
 #***************************************************************************
 # Start the ssh server daemon on Windows without forking it
 #
-if ($sshdid =~ /OpenSSH-Windows/) {
+if($sshdid =~ /OpenSSH-Windows/) {
     # Fake pidfile for ssh server on Windows.
-    if(open(my $out, ">", "$pidfile")) {
+    if(open(my $out, ">", $pidfile)) {
         print $out $$ . "\n";
         close($out);
     }
@@ -1163,36 +1185,36 @@ if ($sshdid =~ /OpenSSH-Windows/) {
 
     # Put an "exec" in front of the command so that the child process
     # keeps this child's process ID by being tied to the spawned shell.
-    exec("exec $cmd") || die "Can't exec() $cmd: $!";
-    # exec() will create a new process, but ties the existence of the
+    exec("exec $cmd") or die "Cannot exec() $cmd: $!";
+    # exec() creates a new process, but ties the existence of the
     # new process to the parent waiting perl.exe and sh.exe processes.
 
     # exec() should never return back here to this process. We protect
-    # ourselves by calling die() just in case something goes really bad.
+    # ourselves by calling die() in case something goes really bad.
     die "error: exec() has returned";
 }
 
 #***************************************************************************
 # Start the ssh server daemon without forking it
 #
-my $rc = system($cmd);
+# "exec" avoids the shell process sticking around
+my $rc = system("exec " . $cmd);
 if($rc == -1) {
     logmsg "\"$sshd\" failed with: $!\n";
 }
 elsif($rc & 127) {
     logmsg sprintf("\"$sshd\" died with signal %d, and %s coredump\n",
-                   ($rc & 127), ($rc & 128)?'a':'no');
+                   ($rc & 127), ($rc & 128) ? 'a' : 'no');
 }
 elsif($verbose && ($rc >> 8)) {
     logmsg sprintf("\"$sshd\" exited with %d\n", $rc >> 8);
 }
 
-
 #***************************************************************************
 # Clean up once the server has stopped
 #
 unlink(pp($hstprvkeyf), pp($hstpubkeyf), pp($hstpubmd5f), pp($hstpubsha256f),
        pp($cliprvkeyf), pp($clipubkeyf), pp($knownhosts),
-       pp($sshdconfig), pp($sshconfig), pp($sftpconfig));
+       $sshdconfig, $sshconfig, $sftpconfig);
 
 exit 0;
diff --git a/third-party/curl/tests/stunnel.pem b/third-party/curl/tests/stunnel.pem
deleted file mode 100644
index b7dd1e879f..0000000000
--- a/third-party/curl/tests/stunnel.pem
+++ /dev/null
@@ -1,165 +0,0 @@
-extensions = x509v3
-[ x509v3 ]
-subjectAltName = DNS:localhost
-keyUsage	= keyEncipherment,digitalSignature,keyAgreement
-extendedKeyUsage = serverAuth
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid
-basicConstraints = CA:false
-authorityInfoAccess     = @issuer_info
-crlDistributionPoints   = @crl_info
-
-[ crl_ext ]
-authorityKeyIdentifier  = keyid:always
-authorityInfoAccess     = @issuer_info
-
-[ issuer_info ]
-caIssuers;URI.0         = http://test.curl.se/ca/EdelCurlRoot.cer
-
-[ crl_info ]
-URI.0                   = http://test.curl.se/ca/EdelCurlRoot.crl
-
-[ req ]
-default_bits                    = 12048
-distinguished_name              = req_DN
-default_md			= sha256
-string_mask			= utf8only
-[ req_DN ]
-countryName                     = "Country Name is Northern Nowhere"
-countryName_value            = NN
-organizationName              = "Organization Name"
-organizationName_value     = Edel Curl Arctic Illudium Research Cloud
-commonName                      = "Common Name"
-commonName_value              = localhost
-
-[something]
-# The key
-# the certificate
-# some dhparam
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCrCrAD0Hb+Xs4V
-3mHV45FvfNa7yiaOeL4mNdGmWfHVPFU+CSzsoNSvDjxaorWweFGVYoCAcchOn1lZ
-k0ASsqnOss0Xi58n8+PPI3gG0gYjX5sg7EJ3Zq2kXoK0TZRy6hNkcvzLgyzXoYv1
-LkzTwYiyyJgZX++Y/GKAs2fMHyP8XzjNgm4tltk1k/4pomllwN9Fqz+sFxgAgEq3
-ybq4Xym7xKwWl8xXNBDJNmVsPtiJRcilQoR8Xs0a6PE+VbMhD9A2E/LEL7lzQfqH
-qtxE1mSW5FpQ+Uqf4KLnafStWs86IOWnCeLP6BmhAK6ouyICNFyzz7UkTHa/renx
-uNOGun2TAgMBAAECggEAH0BsKb5Ax7h90jwYRzL141d9isFkaxq/r46c2FbN24bT
-EmstxKycP8ILoAnjxbMuQOvHC/D+RvNRqY7Aocn4Qdakp50wvuWOpc3Ww/RC/9qb
-pxfUCyn9Jy/HlPcp3RdM5MknzG2S13Fid7F2gyh0+CmztMs1JZBT1S0ylXbJJfbY
-1pdlHcf9oEbYo36vGd9rtJHAFzsFfwua0idl76XYuOnR3bpOkHl1B5cJ8jpOliPv
-VTmzn0cIgAmk7IByHHqGQ0u30PFiElI9kEbkKWoxAM1hq1pFU58jQhvp0ZkjVENL
-bSFB2B4DbyosxPlbUgvJCN4B7nclqzYqBdrrk6/ZLQKBgQC1lDrPSGIGXLwvkZYS
-xc0wtaCC7u6m7zV8rzh5HGcEoVvtmya/VyoZR8KGIpSor8COIkZqFtan6C77C3MH
-wClbu2Kn3FkGb76D5U2Xwl38zepzjn8Z5qXc3bZfccrsDY1gXPicgsmcKUY9xV5/
-T0RjESDKB+xxkJpCjia6klm2NQKBgQDxJNuqB6frDYKaj7mW/rvyHqkeT94J6eDY
-BcMZVKeHRNWcBMOvJDChVmpsCjJPOWHhHOlAE755NxWn8wpgyiUcac3BiysMgvTT
-pyH8UVWaP/DWYOfpuhtcLPkIjKnPijOvshpyWBxfXNIejiovoT6E3IXKOxr5g5yq
-U/9a5+I9pwKBgDyJG4YpkoyedBrDxa2ihkL7+nRMZgH/c+yKmiA+aNXxWa2AcU2P
-KLje5KpFcxw948s/AAy0aoH19Vu6uHHYDbHIah6eZouvy2s7kj/LC/yRRd2anyMq
-cxeMTxXI4ScLaZu7wyKis8Y9OG61k0iMS7dfaXgRZjGCTPttWtoOmpwVAoGAd2k+
-EXuLDl15UBpd18S6wxGlw2nfVN9oxPBNhUyjTNusP38oe6EbJ7mIJ4oBEbQjoPrV
-EjL0vkelxK4YdIeFSwWlqvLEVYS/wdNgg/auwhxpoW8JSHctNz7Z7v7g0/Hm2FkE
-uZyiKCLptdHGWCGruNUOt27/U5F10e6YY6ayJL8CgYEAoE/ddHIlrKFzcZ0cu47R
-ky4D4x32ceC2au4eGPLMDItPjceXe8I6zgB5P8/U5U3PRw5oWabpAf5lAcRwa12c
-23xgy9O5QNlyps/rAdnVjwxqGwEd5E2LrZ2+JDflPRGunx2VO5v9CxXvsxu9F3Rj
-tREtebHe2H7u5jNsIQArnRI=
------END PRIVATE KEY-----
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 16717980999635 (0xf3475519fd3)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = Northern Nowhere Trust Anchor
-        Validity
-            Not Before: Dec 23 12:21:39 2022 GMT
-            Not After : Mar 11 12:21:39 2031 GMT
-        Subject:
-            countryName               = NN
-            organizationName          = Edel Curl Arctic Illudium Research Cloud
-            commonName                = localhost
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:ab:0a:b0:03:d0:76:fe:5e:ce:15:de:61:d5:e3:
-                    91:6f:7c:d6:bb:ca:26:8e:78:be:26:35:d1:a6:59:
-                    f1:d5:3c:55:3e:09:2c:ec:a0:d4:af:0e:3c:5a:a2:
-                    b5:b0:78:51:95:62:80:80:71:c8:4e:9f:59:59:93:
-                    40:12:b2:a9:ce:b2:cd:17:8b:9f:27:f3:e3:cf:23:
-                    78:06:d2:06:23:5f:9b:20:ec:42:77:66:ad:a4:5e:
-                    82:b4:4d:94:72:ea:13:64:72:fc:cb:83:2c:d7:a1:
-                    8b:f5:2e:4c:d3:c1:88:b2:c8:98:19:5f:ef:98:fc:
-                    62:80:b3:67:cc:1f:23:fc:5f:38:cd:82:6e:2d:96:
-                    d9:35:93:fe:29:a2:69:65:c0:df:45:ab:3f:ac:17:
-                    18:00:80:4a:b7:c9:ba:b8:5f:29:bb:c4:ac:16:97:
-                    cc:57:34:10:c9:36:65:6c:3e:d8:89:45:c8:a5:42:
-                    84:7c:5e:cd:1a:e8:f1:3e:55:b3:21:0f:d0:36:13:
-                    f2:c4:2f:b9:73:41:fa:87:aa:dc:44:d6:64:96:e4:
-                    5a:50:f9:4a:9f:e0:a2:e7:69:f4:ad:5a:cf:3a:20:
-                    e5:a7:09:e2:cf:e8:19:a1:00:ae:a8:bb:22:02:34:
-                    5c:b3:cf:b5:24:4c:76:bf:ad:e9:f1:b8:d3:86:ba:
-                    7d:93
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Alternative Name: 
-                DNS:localhost
-            X509v3 Key Usage: 
-                Digital Signature, Key Encipherment, Key Agreement
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication
-            X509v3 Subject Key Identifier: 
-                9C:97:B0:3D:B3:50:B1:F6:D4:71:E2:EB:CB:80:EA:93:7C:98:CC:72
-            X509v3 Authority Key Identifier: 
-                87:CB:B1:33:2E:C1:67:7E:71:E3:E5:2B:4C:4D:A4:B3:6E:D2:5B:A9
-            X509v3 Basic Constraints: 
-                CA:FALSE
-            Authority Information Access: 
-                CA Issuers - URI:http://test.curl.se/ca/EdelCurlRoot.cer
-            X509v3 CRL Distribution Points: 
-                Full Name:
-                  URI:http://test.curl.se/ca/EdelCurlRoot.crl
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        0b:8a:ed:6a:87:fa:71:15:88:25:58:85:1b:4a:09:bf:43:00:
-        35:93:78:0d:72:14:30:51:e2:93:83:a1:da:1b:2f:a9:31:ae:
-        b7:c7:4c:72:c2:5e:32:24:f1:96:93:70:d5:3f:b5:85:80:13:
-        75:32:cf:0e:f8:5d:c4:a2:29:84:43:2c:75:81:26:12:6a:a0:
-        cb:7b:57:c1:92:78:85:08:fa:64:50:c2:7b:83:02:4d:79:13:
-        bc:61:64:4d:b8:6b:d5:f1:84:6b:12:5c:69:90:ad:40:47:c0:
-        ed:dd:ea:8a:66:7e:87:85:19:aa:89:d3:3c:08:72:08:a1:4d:
-        63:60:5b:9b:17:9e:00:12:a1:00:52:ca:78:01:88:18:c7:ed:
-        5b:c7:e4:d9:eb:bd:3f:af:92:53:3f:fe:58:57:0d:fc:f4:7b:
-        7b:a2:4f:e9:b9:5c:b5:a4:52:50:b4:56:5a:44:8e:d9:d0:ed:
-        de:8f:7e:ac:1c:58:76:5b:a8:79:c9:95:ab:85:1d:db:4c:13:
-        82:4a:a5:41:1b:29:f5:d3:96:df:80:d1:1e:00:7d:ba:35:94:
-        57:81:e1:08:2a:81:6b:1c:30:50:37:01:1a:0e:26:4f:6b:ed:
-        c9:50:17:37:2b:33:3f:68:fe:c6:f0:21:8c:e7:b2:79:55:f2:
-        42:bd:2f:b0
------BEGIN CERTIFICATE-----
-MIIERDCCAyygAwIBAgIGDzR1UZ/TMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNVBAYT
-Ak5OMTEwLwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNo
-IENsb3VkMSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjAe
-Fw0yMjEyMjMxMjIxMzlaFw0zMTAzMTExMjIxMzlaMFQxCzAJBgNVBAYTAk5OMTEw
-LwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNoIENsb3Vk
-MRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQCrCrAD0Hb+Xs4V3mHV45FvfNa7yiaOeL4mNdGmWfHVPFU+CSzsoNSvDjxa
-orWweFGVYoCAcchOn1lZk0ASsqnOss0Xi58n8+PPI3gG0gYjX5sg7EJ3Zq2kXoK0
-TZRy6hNkcvzLgyzXoYv1LkzTwYiyyJgZX++Y/GKAs2fMHyP8XzjNgm4tltk1k/4p
-omllwN9Fqz+sFxgAgEq3ybq4Xym7xKwWl8xXNBDJNmVsPtiJRcilQoR8Xs0a6PE+
-VbMhD9A2E/LEL7lzQfqHqtxE1mSW5FpQ+Uqf4KLnafStWs86IOWnCeLP6BmhAK6o
-uyICNFyzz7UkTHa/renxuNOGun2TAgMBAAGjggEGMIIBAjAUBgNVHREEDTALggls
-b2NhbGhvc3QwCwYDVR0PBAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1Ud
-DgQWBBScl7A9s1Cx9tRx4uvLgOqTfJjMcjAfBgNVHSMEGDAWgBSHy7EzLsFnfnHj
-5StMTaSzbtJbqTAJBgNVHRMEAjAAMEMGCCsGAQUFBwEBBDcwNTAzBggrBgEFBQcw
-AoYnaHR0cDovL3Rlc3QuY3VybC5zZS9jYS9FZGVsQ3VybFJvb3QuY2VyMDgGA1Ud
-HwQxMC8wLaAroCmGJ2h0dHA6Ly90ZXN0LmN1cmwuc2UvY2EvRWRlbEN1cmxSb290
-LmNybDANBgkqhkiG9w0BAQsFAAOCAQEAC4rtaof6cRWIJViFG0oJv0MANZN4DXIU
-MFHik4Oh2hsvqTGut8dMcsJeMiTxlpNw1T+1hYATdTLPDvhdxKIphEMsdYEmEmqg
-y3tXwZJ4hQj6ZFDCe4MCTXkTvGFkTbhr1fGEaxJcaZCtQEfA7d3qimZ+h4UZqonT
-PAhyCKFNY2BbmxeeABKhAFLKeAGIGMftW8fk2eu9P6+SUz/+WFcN/PR7e6JP6blc
-taRSULRWWkSO2dDt3o9+rBxYdluoecmVq4Ud20wTgkqlQRsp9dOW34DRHgB9ujWU
-V4HhCCqBaxwwUDcBGg4mT2vtyVAXNyszP2j+xvAhjOeyeVXyQr0vsA==
------END CERTIFICATE-----
diff --git a/third-party/curl/tests/symbol-scan.pl b/third-party/curl/tests/symbol-scan.pl
deleted file mode 100644
index 2b9ac37596..0000000000
--- a/third-party/curl/tests/symbol-scan.pl
+++ /dev/null
@@ -1,245 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-#
-# This script grew out of help from Przemyslaw Iskra and Balint Szilakszi
-# a late evening in the #curl IRC channel.
-#
-
-use strict;
-use warnings;
-use vars qw($Cpreprocessor);
-
-#
-# configurehelp perl module is generated by configure script
-#
-my $rc = eval {
-    require configurehelp;
-    configurehelp->import(qw(
-        $Cpreprocessor
-    ));
-    1;
-};
-# Set default values if configure has not generated a configurehelp.pm file.
-# This is the case with cmake.
-if (!$rc) {
-    $Cpreprocessor = 'cpp';
-}
-
-# we may get the dir root pointed out
-my $root=$ARGV[0] || ".";
-
-# need an include directory when building out-of-tree
-my $i = ($ARGV[1]) ? "-I$ARGV[1] " : '';
-
-my $verbose=0;
-my $summary=0;
-my $misses=0;
-
-my @manrefs;
-my @syms;
-my %doc;
-my %rem;
-
-# scanenum runs the preprocessor on curl.h so it will process all enums
-# included by it, which *should* be all headers
-sub scanenum {
-    my ($file) = @_;
-    open my $h_in, "-|", "$Cpreprocessor $i$file" || die "Cannot preprocess $file";
-    while ( <$h_in> ) {
-        if ( /enum\s+(\S+\s+)?{/ .. /}/ ) {
-            s/^\s+//;
-            next unless /^CURL/;
-            chomp;
-            s/[,\s].*//;
-            push @syms, $_;
-        }
-    }
-    close $h_in || die "Error preprocessing $file";
-}
-
-sub scanheader {
-    my ($f)=@_;
-    open my $h, "<", "$f";
-    while(<$h>) {
-        if (/^#define ((LIB|)CURL[A-Za-z0-9_]*)/) {
-            push @syms, $1;
-        }
-    }
-    close $h;
-}
-
-sub scanallheaders {
-    my $d = "$root/include/curl";
-    opendir(my $dh, $d) ||
-        die "Can't opendir: $!";
-    my @headers = grep { /.h\z/ } readdir($dh);
-    closedir $dh;
-    foreach my $h (@headers) {
-        scanenum("$d/$h");
-        scanheader("$d/$h");
-    }
-}
-
-sub checkmanpage {
-    my ($m) = @_;
-
-    open(my $mh, "<", "$m");
-    my $line = 1;
-    while(<$mh>) {
-        # strip off formatting
-        $_ =~ s/\\f[BPRI]//;
-        # detect global-looking 'CURL[BLABLA]_*' symbols
-        while(s/\W(CURL(AUTH|E|H|MOPT|OPT|SHOPT|UE|M|SSH|SSLBACKEND|HEADER|FORM|FTP|PIPE|MIMEOPT|GSSAPI|ALTSVC|PROTO|PROXY|UPART|USESSL|_READFUNC|_WRITEFUNC|_CSELECT|_FORMADD|_IPRESOLVE|_REDIR|_RTSPREQ|_TIMECOND|_VERSION)_[a-zA-Z0-9_]+)//) {
-            my $s = $1;
-            # skip two "special" ones
-            if($s !~ /^(CURLE_OBSOLETE|CURLOPT_TEMPLATE)/) {
-                push @manrefs, "$1:$m:$line";
-            }
-        }
-        $line++;
-    }
-    close($mh);
-}
-
-sub scanman3dir {
-    my ($d) = @_;
-    opendir(my $dh, $d) ||
-        die "Can't opendir: $!";
-    my @mans = grep { /.3\z/ } readdir($dh);
-    closedir $dh;
-    for my $m (@mans) {
-        checkmanpage("$d/$m");
-    }
-}
-
-
-scanallheaders();
-scanman3dir("$root/docs/libcurl");
-scanman3dir("$root/docs/libcurl/opts");
-
-open my $s, "<", "$root/docs/libcurl/symbols-in-versions";
-while(<$s>) {
-    if(/(^[^ \n]+) +(.*)/) {
-        my ($sym, $rest)=($1, $2);
-        if($doc{$sym}) {
-            print "Detected duplicate symbol: $sym\n";
-            $misses++;
-            next;
-        }
-        $doc{$sym}=$sym;
-        my @a=split(/ +/, $rest);
-        if($a[2]) {
-            # this symbol is documented to have been present the last time
-            # in this release
-            $rem{$sym}=$a[2];
-        }
-    }
-}
-close $s;
-
-my $ignored=0;
-for my $e (sort @syms) {
-    # OBSOLETE - names that are just placeholders for a position where we
-    # previously had a name, that is now removed. The OBSOLETE names should
-    # never be used for anything.
-    #
-    # CURL_EXTERN - is a define used for libcurl functions that are external,
-    # public. No app or other code should ever use it.
-    #
-    # CURLINC_ - defines for header dual-include prevention, ignore those.
-    #
-    # CURL_TEMP_ - are defined and *undefined* again within the file
-    #
-    # *_LAST and *_LASTENTRY are just prefix for the placeholders used for the
-    # last entry in many enum series.
-    #
-
-    if($e =~ /(OBSOLETE|^CURL_EXTERN|^CURLINC_|_LAST\z|_LASTENTRY\z|^CURL_TEMP_)/) {
-        $ignored++;
-        next;
-    }
-    if($doc{$e}) {
-        if($verbose) {
-            print $e."\n";
-        }
-        $doc{$e}="used";
-        next;
-    }
-    else {
-        print $e."\n";
-        $misses++;
-    }
-}
-
-#
-# now scan through all symbols that were present in the symbols-in-versions
-# but not in the headers
-#
-# If the symbols were marked 'removed' in symbols-in-versions we don't output
-# anything about it since that is perfectly fine.
-#
-
-my $anyremoved;
-
-for my $e (sort keys %doc) {
-    if(($doc{$e} ne "used") && !$rem{$e}) {
-
-        if(!$anyremoved++) {
-            print "Missing symbols mentioned in symbols-in-versions\n";
-            print "Add them to a header, or mark them as removed.\n";
-        }
-
-        print "$e\n";
-        $misses++;
-    }
-}
-
-my %warned;
-for my $r (@manrefs) {
-    if($r =~ /^([^:]+):(.*)/) {
-        my ($sym, $file)=($1, $2);
-        if(!$doc{$sym} && !$warned{$sym, $file}) {
-            print "$file: $sym is not a public symbol\n";
-            $warned{$sym, $file} = 1;
-        }
-    }
-}
-
-if($summary) {
-    print "Summary:\n";
-    printf "%d symbols in headers (out of which %d are ignored)\n", scalar(@syms),
-    $ignored;
-    printf "%d symbols in headers are interesting\n",
-    scalar(@syms)- $ignored;
-    printf "%d symbols are listed in symbols-in-versions\n (out of which %d are listed as removed)\n", scalar(keys %doc), scalar(keys %rem);
-    printf "%d symbols in symbols-in-versions should match the ones in headers\n", scalar(keys %doc) - scalar(keys %rem);
-}
-
-if($misses) {
-    exit 0; # there are stuff to attend to!
-}
-else {
-    print "OK\n";
-}
diff --git a/third-party/curl/tests/test1119.pl b/third-party/curl/tests/test1119.pl
new file mode 100644
index 0000000000..47ec214120
--- /dev/null
+++ b/third-party/curl/tests/test1119.pl
@@ -0,0 +1,247 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+# This script grew out of help from Przemyslaw Iskra and Balint Szilakszi
+# a late evening in the #curl IRC channel.
+#
+
+use strict;
+use warnings;
+use vars qw($Cpreprocessor);
+
+#
+# configurehelp perl module is generated by configure script
+#
+my $rc = eval {
+    require configurehelp;
+    configurehelp->import(qw(
+        $Cpreprocessor
+    ));
+    1;
+};
+# Set default values if configure has not generated a configurehelp.pm file.
+# This is the case with cmake.
+if(!$rc) {
+    $Cpreprocessor = 'cpp';
+}
+
+# we may get the directory root pointed out
+my $root = $ARGV[0] || ".";
+
+# need an include directory when building out-of-tree
+my $i = ($ARGV[1]) ? "-I$ARGV[1] " : '';
+
+my $verbose = 0;
+my $summary = 0;
+my $misses = 0;
+
+my @manrefs;
+my @syms;
+my %doc;
+my %rem;
+
+# scanenum runs the preprocessor on curl.h so it processes all enums
+# included by it, which *should* be all headers
+sub scanenum {
+    my ($file) = @_;
+    open my $h_in, "-|", "$Cpreprocessor $i$file" or die "Cannot preprocess $file";
+    while(<$h_in>) {
+        if(/enum\s+(\S+\s+)?{/ .. /}/) {
+            s/^\s+//;
+            next unless /^CURL/;
+            chomp;
+            s/[,\s].*//;
+            push @syms, $_;
+        }
+    }
+    close $h_in or die "Error preprocessing $file";
+}
+
+sub scanheader {
+    my ($f) = @_;
+    open(my $h, "<", $f);
+    while(<$h>) {
+        if(/^#define ((LIB|)CURL[A-Za-z0-9_]*)/) {
+            push @syms, $1;
+        }
+    }
+    close $h;
+}
+
+sub scanallheaders {
+    my $d = "$root/include/curl";
+    opendir(my $dh, $d) or die "Cannot opendir: $!";
+    my @headers = grep { /.h\z/ } readdir($dh);
+    closedir $dh;
+    foreach my $h (@headers) {
+        scanenum("$d/$h");
+        scanheader("$d/$h");
+    }
+}
+
+sub checkmanpage {
+    my ($m) = @_;
+
+    # detect global-looking 'CURL[BLABLA]_*' symbols
+    my $global_pat = '\W(CURL(AUTH|E|H|MOPT|OPT|SHOPT|UE|M|SSH|SSLBACKEND|HEADER|FORM|FTP|PIPE|MIMEOPT|GSSAPI|' .
+        'ALTSVC|PROTO|PROXY|UPART|USESSL|_READFUNC|_WRITEFUNC|_CSELECT|_FORMADD|_IPRESOLVE|_REDIR|_RTSPREQ|'.
+        '_TIMECOND|_VERSION)_[a-zA-Z0-9_]+)';
+    my $global_re = qr/$global_pat/;
+
+    open(my $mh, "<", $m);
+    my $line = 1;
+    while(<$mh>) {
+        # strip off formatting
+        $_ =~ s/(^|[^A-Z0-9])[*_]+/ /;
+        while(s/$global_re//) {
+            my $s = $1;
+            # skip two "special" ones
+            if($s !~ /(^(CURLE_OBSOLETE|CURLOPT_TEMPLATE))|_$/) {
+                push @manrefs, "$s:$m:$line";
+            }
+        }
+        $line++;
+    }
+    close($mh);
+}
+
+sub scanman_md_dir {
+    my ($d) = @_;
+    opendir(my $dh, $d) or die "Cannot opendir: $!";
+    my @mans = grep { /.md\z/ } readdir($dh);
+    closedir $dh;
+    for my $m (@mans) {
+        checkmanpage("$d/$m");
+    }
+}
+
+scanallheaders();
+scanman_md_dir("$root/docs/libcurl");
+scanman_md_dir("$root/docs/libcurl/opts");
+
+open(my $s, "<", "$root/docs/libcurl/symbols-in-versions");
+while(<$s>) {
+    if(/(^[^ \n]+) +(.*)/) {
+        my ($sym, $rest) = ($1, $2);
+        if($doc{$sym}) {
+            print "Detected duplicate symbol: $sym\n";
+            $misses++;
+            next;
+        }
+        $doc{$sym} = $sym;
+        my @a = split(/ +/, $rest);
+        if($a[2]) {
+            # this symbol is documented to have been present the last time
+            # in this release
+            $rem{$sym} = $a[2];
+        }
+    }
+}
+close $s;
+
+my $ignored = 0;
+for my $e (sort @syms) {
+    # OBSOLETE - names that are placeholders for a position where we
+    # previously had a name, that is now removed. The OBSOLETE names should
+    # never be used for anything.
+    #
+    # CURL_EXTERN - is a define used for libcurl functions that are external,
+    # public. No app or other code should ever use it.
+    #
+    # CURLINC_ - defines for header dual-include prevention, ignore those.
+    #
+    # CURL_TEMP_ - are defined and *undefined* again within the file
+    #
+    # *_LAST and *_LASTENTRY are suffix for the placeholders used for the
+    # last entry in many enum series.
+    #
+
+    if($e =~ /(OBSOLETE|CURLE_RESERVED|^CURL_EXTERN|^CURLINC_|_LAST\z|_LASTENTRY\z|^CURL_TEMP_)/) {
+        $ignored++;
+        next;
+    }
+    if($doc{$e}) {
+        if($verbose) {
+            print $e."\n";
+        }
+        $doc{$e} = "used";
+        next;
+    }
+    else {
+        print $e."\n";
+        $misses++;
+    }
+}
+
+#
+# now scan through all symbols that were present in the symbols-in-versions
+# but not in the headers
+#
+# If the symbols were marked 'removed' in symbols-in-versions we do not output
+# anything about it since that is perfectly fine.
+#
+
+my $anyremoved;
+
+for my $e (sort keys %doc) {
+    if(($doc{$e} ne "used") && !$rem{$e}) {
+
+        if(!$anyremoved++) {
+            print "Missing symbols mentioned in symbols-in-versions\n";
+            print "Add them to a header, or mark them as removed.\n";
+        }
+
+        print "$e\n";
+        $misses++;
+    }
+}
+
+my %warned;
+for my $r (@manrefs) {
+    if($r =~ /^([^:]+):(.*)/) {
+        my ($sym, $file) = ($1, $2);
+        if(!$doc{$sym} && !$warned{$sym, $file}) {
+            print "$file: $sym is not a public symbol\n";
+            $warned{$sym, $file} = 1;
+        }
+    }
+}
+
+if($summary) {
+    print "Summary:\n";
+    printf "%d symbols in headers (out of which %d are ignored)\n", scalar(@syms),
+    $ignored;
+    printf "%d symbols in headers are interesting\n",
+    scalar(@syms)- $ignored;
+    printf "%d symbols are listed in symbols-in-versions\n (out of which %d are listed as removed)\n", scalar(keys %doc), scalar(keys %rem);
+    printf "%d symbols in symbols-in-versions should match the ones in headers\n", scalar(keys %doc) - scalar(keys %rem);
+}
+
+if($misses) {
+    exit 0; # there are stuff to attend to!
+}
+else {
+    print "OK\n";
+}
diff --git a/third-party/curl/tests/test1135.pl b/third-party/curl/tests/test1135.pl
new file mode 100644
index 0000000000..907a08d20b
--- /dev/null
+++ b/third-party/curl/tests/test1135.pl
@@ -0,0 +1,108 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+my $sort = 0;
+
+# we may get the directory root pointed out
+my $root = shift @ARGV;
+while(defined $root) {
+
+    if($root =~ /--heading=(.*)/) {
+        print "$1\n";
+        $root = shift @ARGV;
+        next;
+    }
+    elsif($root =~ /--sort/) {
+        $sort = 1;
+        $root = shift @ARGV;
+        next;
+    }
+
+    last;
+}
+
+if(!defined $root) {
+    $root = ".";
+}
+
+$root = "$root/include/curl";
+opendir(D, $root) or die "Cannot open directory $root: $!\n";
+my @dir = readdir(D);
+closedir(D);
+
+my @incs;
+foreach (sort(@dir)) {
+    if($_ =~ /\.h$/) {
+        push(@incs, "$root/$_");
+    }
+}
+
+my $verbose = 0;
+my $summary = 0;
+my $misses = 0;
+
+my @out;
+foreach my $f (@incs) {
+    open H, "<$f" or die;
+    my $first = "";
+    while(<H>) {
+        s/CURL_DEPRECATED\(.*"\)//;
+        s/  */ /g;
+        if(/^(^CURL_EXTERN .*?)\(/) {
+            my $decl = $1;
+            $decl =~ s/\r$//;
+            $decl =~ /([a-z_]+)$/;
+            push(@out, $1);
+        }
+        elsif(/^(^CURL_EXTERN .*)/) {
+            # handle two-line declarations
+            my $decl = $1;
+            $decl =~ s/\r$//;
+            $first = $decl;
+        }
+        elsif($first) {
+            if(/^ *(.*)\(/) {
+                my $decl = $1;
+                $decl =~ s/\r$//;
+                $first .= $decl;
+                $first =~ /([a-z_]+)$/;
+                push(@out, $1);
+            }
+            $first = "";
+        }
+    }
+    close H;
+}
+
+if($sort) {
+    @out = sort(@out);
+}
+
+foreach (@out) {
+    print("$_\n");
+}
diff --git a/third-party/curl/tests/test1139.pl b/third-party/curl/tests/test1139.pl
new file mode 100644
index 0000000000..81a33bb537
--- /dev/null
+++ b/third-party/curl/tests/test1139.pl
@@ -0,0 +1,316 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+# Scan symbols-in-version (which is verified to be correct by test 1119), then
+# verify that each option mention in there that should have its own man page
+# actually does.
+#
+# In addition, make sure that every current option to curl_easy_setopt,
+# curl_easy_getinfo and curl_multi_setopt are also mentioned in their
+# corresponding main (index) man page.
+#
+# src/tool_getparam.c lists all options curl can parse
+# docs/curl.1 documents all command line options
+# src/tool_listhelp.c outputs all options with curl -h
+# - make sure they are all in sync
+#
+# Output all deviances to stderr.
+
+use strict;
+use warnings;
+
+# we may get the directory roots pointed out
+my $root = $ARGV[0] || ".";
+my $buildroot = $ARGV[1] || ".";
+my $syms = "$root/docs/libcurl/symbols-in-versions";
+my $curlh = "$root/include/curl/curl.h";
+my $errors = 0;
+
+# the prepopulated alias list is the CURLINFO_* defines that are used for the
+# debug function callback and the fact that they use the same prefix as the
+# curl_easy_getinfo options was a mistake.
+my %alias = (
+    'CURLINFO_DATA_IN' => 'none',
+    'CURLINFO_DATA_OUT' => 'none',
+    'CURLINFO_END' => 'none',
+    'CURLINFO_HEADER_IN' => 'none',
+    'CURLINFO_HEADER_OUT' => 'none',
+    'CURLINFO_LASTONE' => 'none',
+    'CURLINFO_NONE' => 'none',
+    'CURLINFO_SSL_DATA_IN' => 'none',
+    'CURLINFO_SSL_DATA_OUT' => 'none',
+    'CURLINFO_TEXT' => 'none'
+    );
+
+sub scanmdpage {
+    my ($file, @words) = @_;
+
+    open(my $mh, "<", $file) or die "could not open $file";
+    my @m;
+    while(<$mh>) {
+        if($_ =~ /^## (.*)/) {
+            my $w = $1;
+            # "unquote" minuses
+            $w =~ s/\\-/-/g;
+            push @m, $w;
+        }
+    }
+    close($mh);
+
+    my @ms = sort @m;
+    for my $i (0 .. $#m) {
+        if($ms[$i] ne $m[$i]) {
+            print STDERR "$file:1:ERROR: $m[$i] is not alphabetical (expected $ms[$i])\n";
+            $errors++;
+            # no point in reporting many
+            last;
+        }
+    }
+    foreach my $m (@words) {
+        my @g = grep(/$m\b/, @m);
+        if(!$g[0]) {
+            print STDERR "Missing mention of $m in $file\n";
+            $errors++;
+        }
+    }
+}
+
+my $r;
+
+# check for define aliases
+open($r, "<", $curlh) or die "no curl.h";
+while(<$r>) {
+    if(/^\#define (CURL(OPT|INFO|MOPT)_\w+) (.*)/) {
+        $alias{$1} = $3;
+    }
+}
+close($r);
+
+my @curlopt;
+my @curlinfo;
+my @curlmopt;
+open($r, "<", $syms) or die "no input file";
+while(<$r>) {
+    chomp;
+    my $l= $_;
+    if($l =~ /(CURL(OPT|INFO|MOPT)_\w+) *([0-9.]*) *([0-9.-]*) *([0-9.]*)/) {
+        my ($opt, $type, $add, $dep, $rem) = ($1, $2, $3, $4, $5);
+
+        if($alias{$opt}) {
+            #print "$opt => $alias{$opt}\n";
+        }
+        elsif($rem) {
+            # $opt was removed in $rem
+            # so do not check for that
+        }
+        else {
+            if($type eq "OPT") {
+                push @curlopt, $opt,
+            }
+            elsif($type eq "INFO") {
+                push @curlinfo, $opt,
+            }
+            elsif($type eq "MOPT") {
+                push @curlmopt, $opt,
+            }
+            if(! -f "$root/docs/libcurl/opts/$opt.md") {
+                print STDERR "Missing $opt.md\n";
+                $errors++;
+            }
+        }
+    }
+}
+close($r);
+
+scanmdpage("$root/docs/libcurl/curl_easy_setopt.md", @curlopt);
+scanmdpage("$root/docs/libcurl/curl_easy_getinfo.md", @curlinfo);
+scanmdpage("$root/docs/libcurl/curl_multi_setopt.md", @curlmopt);
+
+# using this hash array, we can skip specific options
+my %opts = (
+    # pretend these --no options exists in tool_getparam.c
+    '--no-alpn' => 1,
+    '--no-npn' => 1,
+    '-N, --no-buffer' => 1,
+    '--no-sessionid' => 1,
+    '--no-keepalive' => 1,
+    '--no-progress-meter' => 1,
+    '--no-clobber' => 1,
+
+    # pretend these options without -no exist in curl.1 and tool_listhelp.c
+    '--alpn' => 6,
+    '--npn' => 6,
+    '--eprt' => 6,
+    '--epsv' => 6,
+    '--keepalive' => 6,
+    '-N, --buffer' => 6,
+    '--sessionid' => 6,
+    '--progress-meter' => 6,
+    '--clobber' => 6,
+
+    # deprecated options do not need to be in tool_help.c nor curl.1
+    '--krb4' => 6,
+    '--ftp-ssl' => 6,
+    '--ftp-ssl-reqd' => 6,
+    '--include' => 6,
+
+    # for tests and debug only, can remain hidden
+    '--test-duphandle' => 6,
+    '--test-event' => 6,
+    '--wdebug' => 6,
+    );
+
+#########################################################################
+# parse the curl code that parses the command line arguments!
+open($r, "<", "$root/src/tool_getparam.c") or die "no input file";
+my $list;
+my @getparam; # store all parsed parameters
+
+my $prevlong = "";
+my $no = 0;
+while(<$r>) {
+    $no++;
+    chomp;
+    if(/struct LongShort aliases/) {
+        $list = 1;
+    }
+    elsif($list) {
+        if(/^  \{(\"[^,]*\").*\'(.)\',/) {
+            my ($l, $s) = ($1, $2);
+            my $sh;
+            my $lo;
+            my $title;
+            if(($l cmp $prevlong) < 0) {
+                print STDERR "tool_getparam.c:$no: '$l' is NOT placed in alpha-order\n";
+            }
+            if($l =~ /\"(.*)\"/) {
+                # long option
+                $lo = $1;
+                $title = "--$lo";
+            }
+            if($s ne " ") {
+                # a short option
+                $sh = $s;
+                $title = "-$sh, $title";
+            }
+            push @getparam, $title;
+            $opts{$title} |= 1;
+            $prevlong = $l;
+        }
+    }
+}
+close($r);
+
+#########################################################################
+# parse the curl.1 man page, extract all documented command line options
+# The man page may or may not be rebuilt, so check both possible locations
+open($r, "<", "$buildroot/docs/cmdline-opts/curl.1") or
+    open($r, "<", "$root/docs/cmdline-opts/curl.1") or
+    die "failed getting curl.1";
+my @manpage; # store all parsed parameters
+while(<$r>) {
+    chomp;
+    my $l= $_;
+    $l =~ s/\\-/-/g;
+    if($l =~ /^\.IP \"(-[^\"]*)\"/) {
+        my $str = $1;
+        my $combo;
+        if($str =~ /^-(.), --([a-z0-9.-]*)/) {
+            # figure out the -short, --long combo
+            $combo = "-$1, --$2";
+        }
+        elsif($str =~ /^--([a-z0-9.-]*)/) {
+            # figure out the --long name
+            $combo = "--$1";
+        }
+        if($combo) {
+            push @manpage, $combo;
+            $opts{$combo} |= 2;
+        }
+    }
+}
+close($r);
+
+#########################################################################
+# parse the curl code that outputs the curl -h list
+open($r, "<", "$root/src/tool_listhelp.c") or die "no input file";
+my @toolhelp; # store all parsed parameters
+while(<$r>) {
+    chomp;
+    my $l= $_;
+    if(/^  \{ \" *(.*)/) {
+        my $str = $1;
+        my $combo;
+        if($str =~ /^-(.), --([a-z0-9.-]*)/) {
+            # figure out the -short, --long combo
+            $combo = "-$1, --$2";
+        }
+        elsif($str =~ /^--([a-z0-9.-]*)/) {
+            # figure out the --long name
+            $combo = "--$1";
+        }
+        if($combo) {
+            push @toolhelp, $combo;
+            $opts{$combo} |= 4;
+        }
+    }
+}
+close($r);
+
+#
+# Now we have three arrays with options to cross-reference.
+
+foreach my $o (keys %opts) {
+    my $where = $opts{$o};
+
+    if($where != 7) {
+        # this is not in all three places
+        $errors++;
+        my $exists;
+        my $missing;
+        if($where & 1) {
+            $exists = " tool_getparam.c";
+        }
+        else {
+            $missing = " tool_getparam.c";
+        }
+        if($where & 2) {
+            $exists.= " curl.1";
+        }
+        else {
+            $missing.= " curl.1";
+        }
+        if($where & 4) {
+            $exists .= " tool_listhelp.c";
+        }
+        else {
+            $missing .= " tool_listhelp.c";
+        }
+
+        print STDERR "$o is not in$missing (but in$exists)\n";
+    }
+}
+
+print STDERR "$errors\n";
diff --git a/third-party/curl/tests/test1140.pl b/third-party/curl/tests/test1140.pl
new file mode 100644
index 0000000000..d7f56043f4
--- /dev/null
+++ b/third-party/curl/tests/test1140.pl
@@ -0,0 +1,115 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+# scan man pages to find basic syntactic problems such as unbalanced \f
+# codes or references to non-existing curl man pages.
+
+use strict;
+use warnings;
+
+my $docsroot = $ARGV[0] || '.';
+
+if(!$docsroot || ($docsroot eq "-g")) {
+    print "Usage: test1140.pl <docs root dir> [manpages]\n";
+    exit;
+}
+
+shift @ARGV;
+
+my @f = @ARGV;
+my %manp;
+my $errors = 0;
+
+sub manpresent {
+    my ($man) = @_;
+    if($manp{$man}) {
+        return 1;
+    }
+    elsif(-r "$docsroot/$man" ||
+          -r "$docsroot/libcurl/$man" ||
+          -r "$docsroot/libcurl/opts/$man") {
+        $manp{$man} = 1;
+        return 1;
+    }
+    return 0;
+}
+
+sub file {
+    my ($f) = @_;
+    open(my $fh, "<", $f) or die "test1140.pl could not open $f";
+    my $line = 1;
+    while(<$fh>) {
+        chomp;
+        my $l = $_;
+        while($l =~ s/\\f(.)([^ ]*)\\f(.)//) {
+            my ($pre, $str, $post) = ($1, $2, $3);
+            if($str =~ /^\\f[ib]/i) {
+                print "error: $f:$line: double-highlight\n";
+                $errors++;
+            }
+            if($post ne "P") {
+                print "error: $f:$line: missing \\fP after $str\n";
+                $errors++;
+            }
+            if($str =~ /((libcurl|curl)([^ ]*))\(3\)/i) {
+                my $man = "$1.3";
+                $man =~ s/\\//g; # cut off backslashes
+                if(!manpresent($man)) {
+                    print "error: $f:$line: referring to non-existing man page $man\n";
+                    $errors++;
+                }
+                if($pre ne "I") {
+                    print "error: $f:$line: use \\fI before $str\n";
+                    $errors++;
+                }
+            }
+        }
+        if($l =~ /(curl([^ ]*)\(3\))/i) {
+            print "error: $f:$line: non-referencing $1\n";
+            $errors++;
+        }
+        if($l =~ /^\.BR (.*)/) {
+            my $i= $1;
+            while($i =~ s/((lib|)curl([^ ]*)) *\"\(3\)(,|) *\" *//i ) {
+                my $man = "$1.3";
+                $man =~ s/\\//g; # cut off backslashes
+                if(!manpresent($man)) {
+                    print "error: $f:$line: referring to non-existing man page $man\n";
+                    $errors++;
+                }
+            }
+        }
+        $line++;
+    }
+    close($fh);
+}
+
+foreach my $f (@f) {
+    file($f);
+}
+
+print "OK\n" if(!$errors);
+
+exit ($errors ? 1 : 0);
diff --git a/third-party/curl/tests/test1165.pl b/third-party/curl/tests/test1165.pl
new file mode 100644
index 0000000000..ef6b34f328
--- /dev/null
+++ b/third-party/curl/tests/test1165.pl
@@ -0,0 +1,215 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+# the DISABLE options that can be set by configure
+my %disable;
+# the DISABLE options that can be set by CMakeLists.txt
+my %disable_cmake;
+# the DISABLE options propagated via curl_config-cmake.h.in
+my %disable_cmake_config_h;
+# the DISABLE options that are used in C files
+my %file;
+# the DISABLE options that are documented
+my %docs;
+
+# we may get the directory root pointed out
+my $root = $ARGV[0] || ".";
+my $DOCS = "CURL-DISABLE.md";
+
+sub scanconf {
+    my ($f) = @_;
+    open S, "<$f";
+    while(<S>) {
+        if(/(CURL_DISABLE_[A-Z0-9_]+)/g) {
+            my ($sym) = ($1);
+            if(not $sym =~ /^(CURL_DISABLE_TYPECHECK)$/) {
+                $disable{$sym} = 1;
+            }
+        }
+    }
+    close S;
+}
+
+sub scan_configure {
+    opendir(my $m, "$root/m4") or die "Cannot opendir $root/m4: $!";
+    my @m4 = grep { /\.m4$/ } readdir($m);
+    closedir $m;
+    scanconf("$root/configure.ac");
+    # scan all m4 files too
+    for my $e (@m4) {
+        scanconf("$root/m4/$e");
+    }
+}
+
+sub scanconf_cmake {
+    my ($hashr, $f) = @_;
+    open S, "<$f";
+    while(<S>) {
+        if(/(CURL_DISABLE_[A-Z0-9_]+)/g) {
+            my ($sym) = ($1);
+            if(not $sym =~ /^(CURL_DISABLE_INSTALL|CURL_DISABLE_SRP|CURL_DISABLE_TYPECHECK)$/) {
+                $hashr->{$sym} = 1;
+            }
+        }
+    }
+    close S;
+}
+
+sub scan_cmake {
+    scanconf_cmake(\%disable_cmake, "$root/CMakeLists.txt");
+}
+
+sub scan_cmake_config_h {
+    scanconf_cmake(\%disable_cmake_config_h, "$root/lib/curl_config-cmake.h.in");
+}
+
+my %whitelisted = (
+  'CURL_DISABLE_DEPRECATION' => 1,
+  'CURL_DISABLE_TYPECHECK' => 1,
+);
+
+sub scan_file {
+    my ($source) = @_;
+    open F, "<$source";
+    while(<F>) {
+        while(s/(CURL_DISABLE_[A-Z0-9_]+)//) {
+            my ($sym) = ($1);
+
+            if(!$whitelisted{$sym}) {
+                $file{$sym} = $source;
+            }
+        }
+    }
+    close F;
+}
+
+sub scan_dir {
+    my ($dir) = @_;
+    opendir(my $dh, $dir) or die "Cannot opendir $dir: $!";
+    my @cfiles = grep { /\.[ch]\z/ && -f "$dir/$_" } readdir($dh);
+    closedir $dh;
+    for my $f (sort @cfiles) {
+        scan_file("$dir/$f");
+    }
+}
+
+sub scan_sources {
+    scan_dir("$root/include/curl");
+    scan_dir("$root/src");
+    scan_dir("$root/lib");
+    scan_dir("$root/lib/vtls");
+    scan_dir("$root/lib/vauth");
+}
+
+sub scan_docs {
+    open F, "<$root/docs/$DOCS";
+    my $line = 0;
+    while(<F>) {
+        $line++;
+        if(/^## `(CURL_DISABLE_[A-Z0-9_]+)`/g) {
+            my ($sym) = ($1);
+            if(not $sym =~ /^(CURL_DISABLE_TYPECHECK)$/) {
+                $docs{$sym} = $line;
+            }
+        }
+    }
+    close F;
+}
+
+scan_configure();
+scan_cmake();
+scan_cmake_config_h();
+scan_sources();
+scan_docs();
+
+my $error = 0;
+# Check the configure symbols for use in code
+for my $s (sort keys %disable) {
+    if(!$file{$s}) {
+        printf "Present in configure.ac, not used by code: %s\n", $s;
+        $error++;
+    }
+    if(!$docs{$s}) {
+        printf "Present in configure.ac, not documented in $DOCS: %s\n", $s;
+        $error++;
+    }
+}
+
+# Check the CMakeLists.txt symbols for use in code
+for my $s (sort keys %disable_cmake) {
+    if(!$file{$s}) {
+        printf "Present in CMakeLists.txt, not used by code: %s\n", $s;
+        $error++;
+    }
+    if(!$docs{$s}) {
+        printf "Present in CMakeLists.txt, not documented in $DOCS: %s\n", $s;
+        $error++;
+    }
+}
+
+# Check the CMakeLists.txt symbols for use in curl_config-cmake.h.in
+for my $s (sort keys %disable_cmake) {
+    if(!$disable_cmake_config_h{$s}) {
+        printf "Present in CMakeLists.txt, not propagated via curl_config-cmake.h.in: %s\n", $s;
+        $error++;
+    }
+}
+
+# Check the code symbols for use in configure
+for my $s (sort keys %file) {
+    if(!$disable{$s}) {
+        printf "Not set by configure: %s (%s)\n", $s, $file{$s};
+        $error++;
+    }
+    if(!$disable_cmake{$s}) {
+        printf "Not set by CMakeLists.txt: %s (%s)\n", $s, $file{$s};
+        $error++;
+    }
+    if(!$docs{$s}) {
+        printf "Used in code, not documented in $DOCS: %s\n", $s;
+        $error++;
+    }
+}
+
+# Check the documented symbols
+for my $s (sort keys %docs) {
+    if(!$disable{$s}) {
+        printf "Documented but not in configure: %s\n", $s;
+        $error++;
+    }
+    if(!$disable_cmake{$s}) {
+        printf "Documented but not in CMakeLists.txt: %s\n", $s;
+        $error++;
+    }
+    if(!$file{$s}) {
+        printf "Documented, but not used by code: %s\n", $s;
+        $error++;
+    }
+}
+
+exit $error;
diff --git a/third-party/curl/tests/test1167.pl b/third-party/curl/tests/test1167.pl
new file mode 100644
index 0000000000..a0bdb385db
--- /dev/null
+++ b/third-party/curl/tests/test1167.pl
@@ -0,0 +1,156 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+# This script grew out of help from Przemyslaw Iskra and Balint Szilakszi
+# a late evening in the #curl IRC channel.
+#
+
+use strict;
+use warnings;
+use vars qw($Cpreprocessor);
+
+#
+# configurehelp perl module is generated by configure script
+#
+my $rc = eval {
+    require configurehelp;
+    configurehelp->import(qw(
+        $Cpreprocessor
+    ));
+    1;
+};
+# Set default values if configure has not generated a configurehelp.pm file.
+# This is the case with cmake.
+if(!$rc) {
+    $Cpreprocessor = 'cpp';
+}
+
+my $verbose = 0;
+
+# verbose mode when -v is the first argument
+if($ARGV[0] eq "-v") {
+    $verbose = 1;
+    shift;
+}
+
+# we may get the directory root pointed out
+my $root = $ARGV[0] || ".";
+
+# need an include directory when building out-of-tree
+my $i = ($ARGV[1]) ? "-I$ARGV[1] " : '';
+
+my $incdir = "$root/include/curl";
+
+my $summary = 0;
+my $misses = 0;
+
+my @syms;
+
+sub scanenums {
+    my ($file) = @_;
+    my $skipit = 0;
+
+    open(H_IN, "-|", "$Cpreprocessor -DCURL_DISABLE_DEPRECATION $i$file") or
+        die "Cannot preprocess $file";
+    while(<H_IN>) {
+        my ($line, $linenum) = ($_, $.);
+        if(/^#(line|) (\d+) \"(.*)\"/) {
+            # if the included file is not in our incdir, then we skip this section
+            # until next #line
+            #
+            if($3 !~ /^$incdir/) {
+                $skipit = 1;
+                next;
+            }
+            # parse this!
+            $skipit = 0;
+            next;
+        }
+        if($skipit) {
+            next;
+        }
+        if(/^#/) {
+            next;
+        }
+        if(/enum\s+(\S+\s+)?{/ .. /}/) {
+            s/^\s+//;
+            chomp;
+            s/[,\s].*//;
+            if(($_ !~ /\}(;|)/) &&
+               ($_ ne "typedef") &&
+               ($_ ne "enum") &&
+               ($_ ne "=") &&
+               ($_ !~ /^\d+$/) &&
+               ($_ !~ /^[ \t]*$/)) {
+                if($verbose) {
+                    print "Source: $Cpreprocessor $i$file\n";
+                    print "Symbol: $_\n";
+                    print "Line #$linenum: $line\n\n";
+                }
+                push @syms, $_;
+            }
+        }
+    }
+    close H_IN or die "Error preprocessing $file";
+}
+
+sub scanheader {
+    my ($f) = @_;
+    scanenums($f);
+    open(H, '<', $f);
+    while(<H>) {
+        my ($line, $linenum) = ($_, $.);
+        if(/^ *# *define +([^ \n]*)/) {
+            if($verbose) {
+                print "Source: $f\n";
+                print "Symbol: $1\n";
+                print "Line #$linenum: $line\n\n";
+            }
+            push @syms, $1;
+        }
+    }
+    close H;
+}
+
+opendir(my $dh, $incdir) or die "Cannot opendir $incdir: $!";
+my @hfiles = grep { /\.h$/ } readdir($dh);
+closedir $dh;
+
+for(@hfiles) {
+    scanheader("$incdir/$_");
+}
+
+my $errors = 0;
+for my $s (@syms) {
+    if($s !~ /^(lib|)curl/i) {
+        print "Bad symbols in public header files:\n" if(!$errors);
+        $errors++;
+        print "  $s\n";
+    }
+}
+if($errors) {
+    exit 1;
+}
+printf "%d fine symbols found\n", scalar(@syms);
diff --git a/third-party/curl/tests/test1173.pl b/third-party/curl/tests/test1173.pl
new file mode 100644
index 0000000000..14894c625b
--- /dev/null
+++ b/third-party/curl/tests/test1173.pl
@@ -0,0 +1,394 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+# Scan man page(s) and detect some simple and yet common formatting mistakes.
+#
+# Output all deviances to stderr.
+
+use strict;
+use warnings;
+use File::Basename;
+
+# get the filename first
+my $symbolsinversions = shift @ARGV;
+
+# we may get the directory roots pointed out
+my @manpages = @ARGV;
+my $errors = 0;
+
+my %docsdirs;
+my %optblessed;
+my %funcblessed;
+my @optorder = (
+    'NAME',
+    'SYNOPSIS',
+    'DESCRIPTION',
+     #'DEFAULT', # CURLINFO_ has no default
+    'PROTOCOLS',
+    'EXAMPLE',
+    'AVAILABILITY',
+    'RETURN VALUE',
+    'SEE ALSO'
+    );
+my @funcorder = (
+    'NAME',
+    'SYNOPSIS',
+    'DESCRIPTION',
+    'EXAMPLE',
+    'AVAILABILITY',
+    'RETURN VALUE',
+    'SEE ALSO'
+    );
+my %shline; # section => line number
+
+my %symbol;
+
+# some CURLINFO_ symbols are not actual options for curl_easy_getinfo,
+# mark them as "deprecated" to hide them from link-warnings
+my %deprecated = (
+    CURLINFO_TEXT => 1,
+    CURLINFO_HEADER_IN => 1,
+    CURLINFO_HEADER_OUT => 1,
+    CURLINFO_DATA_IN => 1,
+    CURLINFO_DATA_OUT => 1,
+    CURLINFO_SSL_DATA_IN => 1,
+    CURLINFO_SSL_DATA_OUT => 1,
+    CURLOPT_EGDSOCKET => 1,
+    CURLOPT_RANDOM_FILE => 1,
+    );
+sub allsymbols {
+    open(my $f, "<", $symbolsinversions) or die "$symbolsinversions: $|";
+    while(<$f>) {
+        if($_ =~ /^([^ ]*) +(.*)/) {
+            my ($name, $info) = ($1, $2);
+            $symbol{$name} = $name;
+
+            if($info =~ /([0-9.]+) +([0-9.]+)/) {
+                $deprecated{$name} = $info;
+            }
+        }
+    }
+    close($f);
+}
+
+my %ref = (
+    'curl.1' => 1
+    );
+sub checkref {
+    my ($f, $sec, $file, $line) = @_;
+    my $present = 0;
+    #print STDERR "check $f.$sec\n";
+    if($ref{"$f.$sec"}) {
+        # present
+        return;
+    }
+    foreach my $d (keys %docsdirs) {
+        if(-f "$d/$f.$sec") {
+            $present = 1;
+            $ref{"$f.$sec"} = 1;
+            last;
+        }
+    }
+    if(!$present) {
+        print STDERR "$file:$line broken reference to $f($sec)\n";
+        $errors++;
+    }
+}
+
+# option-looking words that are not options
+my %allownonref = (
+    'CURLINFO_TEXT' => 1,
+    'CURLINFO_HEADER_IN' => 1,
+    'CURLINFO_HEADER_OUT' => 1,
+    'CURLINFO_DATA_IN' => 1,
+    'CURLINFO_DATA_OUT' => 1,
+    'CURLINFO_SSL_DATA_IN' => 1,
+    'CURLINFO_SSL_DATA_OUT' => 1,
+    );
+
+sub scanmanpage {
+    my ($file) = @_;
+    my $reqex = 0;
+    my $inseealso = 0;
+    my $inexample = 0;
+    my $insynop = 0;
+    my $exsize = 0;
+    my $synopsize = 0;
+    my $shc = 0;
+    my $optpage = 0; # option or function
+    my @sh;
+    my $SH = "";
+    my @separators;
+    my @sepline;
+
+    open(my $m, "<", $file) or die "test1173.pl could not open $file";
+    if($file =~ /[\/\\](CURL|curl_)([^\/\\]*).3/) {
+        # This is a man page for libcurl. It requires an example unless it is
+        # considered deprecated.
+        $reqex = 1 unless defined $deprecated{'CURL'.$2};
+        if($1 eq "CURL") {
+            $optpage = 1;
+        }
+    }
+    my $line = 1;
+    while(<$m>) {
+        chomp;
+        if($_ =~ /^.so /) {
+            # this man page is a referral
+            close($m);
+            return;
+        }
+        if(($_ =~ /^\.SH SYNOPSIS/i) && ($reqex)) {
+            # this is for libcurl man page SYNOPSIS checks
+            $insynop = 1;
+            $inexample = 0;
+        }
+        elsif($_ =~ /^\.SH EXAMPLE/i) {
+            $insynop = 0;
+            $inexample = 1;
+        }
+        elsif($_ =~ /^\.SH \"SEE ALSO\"/i) {
+            $inseealso = 1;
+        }
+        elsif($_ =~ /^\.SH/i) {
+            $insynop = 0;
+            $inexample = 0;
+        }
+        elsif($inseealso) {
+            if($_ =~ /^\.BR (.*)/i) {
+                my $f = $1;
+                if($f =~ /^(lib|)curl/i) {
+                    $f =~ s/[\n\r]//g;
+                    if($f =~ s/([a-z_0-9-]*) \(([13])\)([, ]*)//i) {
+                        push @separators, $3;
+                        push @sepline, $line;
+                        checkref($1, $2, $file, $line);
+                    }
+                    if($f !~ /^ *$/) {
+                        print STDERR "$file:$line bad SEE ALSO format\n";
+                        $errors++;
+                    }
+                }
+                else {
+                    if($f =~ /.*(, *)\z/) {
+                        push @separators, $1;
+                        push @sepline, $line;
+                    }
+                    else {
+                        push @separators, " ";
+                        push @sepline, $line;
+                    }
+                }
+            }
+        }
+        elsif($inexample) {
+            $exsize++;
+            if($_ =~ /[^\\]\\n/) {
+                print STDERR "$file:$line '\\n' need to be '\\\\n'!\n";
+            }
+        }
+        elsif($insynop) {
+            $synopsize++;
+            if(($synopsize == 1) && ($_ !~ /\.nf/)) {
+                print STDERR "$file:$line:1:ERROR: be .nf for proper formatting\n";
+            }
+        }
+        if($_ =~ /^\.SH ([^\r\n]*)/i) {
+            my $n = $1;
+            # remove enclosing quotes
+            $n =~ s/\"(.*)\"\z/$1/;
+            push @sh, $n;
+            $shline{$n} = $line;
+            $SH = $n;
+        }
+
+        if($_ =~ /^\'/) {
+            print STDERR "$file:$line line starts with single quote!\n";
+            $errors++;
+        }
+        if($_ =~ /\\f([BI])(.*)/) {
+            my ($format, $rest) = ($1, $2);
+            if($rest !~ /\\fP/) {
+                print STDERR "$file:$line missing \\f${format} terminator!\n";
+                $errors++;
+            }
+        }
+        my $c = $_;
+        while($c =~ s/\\f([BI])((lib|)curl[a-z_0-9-]*)\(([13])\)//i) {
+            checkref($2, $4, $file, $line);
+        }
+        if(($_ =~ /\\f([BI])((libcurl|CURLOPT_|CURLSHOPT_|CURLINFO_|CURLMOPT_|curl_easy_|curl_multi_|curl_url|curl_mime|curl_global|curl_share)[a-zA-Z_0-9-]+)(.)/) &&
+           ($4 ne "(")) {
+            my $word = $2;
+
+            if(!$allownonref{$word}) {
+                print STDERR "$file:$line curl ref to $word without section\n";
+                $errors++;
+            }
+        }
+        if($_ =~ /(.*)\\f([^BIP])/) {
+            my ($pre, $format) = ($1, $2);
+            if($pre !~ /\\\z/) {
+                # only if there was not another backslash before the \f
+                print STDERR "$file:$line suspicious \\f format!\n";
+                $errors++;
+            }
+        }
+        if(($SH =~ /^(DESCRIPTION|RETURN VALUE|AVAILABILITY)/i) &&
+           ($_ =~ /(.*)((curl_multi|curl_easy|curl_url|curl_global|curl_url|curl_share)[a-zA-Z_0-9-]+)/) &&
+           ($1 !~ /\\fI$/)) {
+            print STDERR "$file:$line unrefed curl call: $2\n";
+            $errors++;
+        }
+
+        if($optpage && $SH && ($SH !~ /^(SYNOPSIS|EXAMPLE|NAME|SEE ALSO)/i) &&
+           ($_ =~ /(.*)(CURL(OPT_|MOPT_|INFO_|SHOPT_)[A-Z0-9_]*)/)) {
+            # an option with its own man page, check that it is tagged
+            # for linking
+            my ($pref, $symbol) = ($1, $2);
+            if($deprecated{$symbol}) {
+                # let it be
+            }
+            elsif($pref !~ /\\fI\z/) {
+                print STDERR "$file:$line option $symbol missing \\fI tagging\n";
+                $errors++;
+            }
+        }
+        if($_ =~ /[ \t]+$/) {
+            print STDERR "$file:$line trailing whitespace\n";
+            $errors++;
+        }
+        $line++;
+    }
+    close($m);
+
+    if(@separators) {
+        # all except the last one need comma
+        for(0 .. $#separators - 1) {
+            my $l = $_;
+            my $sep = $separators[$l];
+            if($sep ne ",") {
+                printf STDERR "$file:%d: bad not-last SEE ALSO separator: '%s'\n",
+                    $sepline[$l], $sep;
+                $errors++;
+            }
+        }
+        # the last one should not do comma
+        my $sep = $separators[$#separators];
+        if($sep eq ",") {
+            printf STDERR "$file:%d: superfluous comma separator\n",
+                $sepline[$#separators];
+            $errors++;
+        }
+    }
+
+    if($reqex) {
+        # only for libcurl options man-pages
+
+        my $shcount = scalar(@sh); # before @sh gets shifted
+        if($exsize < 2) {
+            print STDERR "$file:$line missing EXAMPLE section\n";
+            $errors++;
+        }
+
+        if($shcount < 3) {
+            print STDERR "$file:$line too few man page sections!\n";
+            $errors++;
+            return;
+        }
+
+        my $got = "start";
+        my $i = 0;
+        my $shused = 1;
+        my @shorig = @sh;
+        my @order = $optpage ? @optorder : @funcorder;
+        my $blessed = $optpage ? \%optblessed : \%funcblessed;
+
+        while($got) {
+            my $finesh;
+            $got = shift(@sh);
+            if($got) {
+                if($$blessed{$got}) {
+                    $i = $$blessed{$got};
+                    $finesh = $got; # a mandatory one
+                }
+            }
+            if($i && defined($finesh)) {
+                # mandatory section
+
+                if($i != $shused) {
+                    printf STDERR "$file:%u Got %s, when %s was expected\n",
+                        $shline{$finesh},
+                        $finesh,
+                        $order[$shused-1];
+                    $errors++;
+                    return;
+                }
+                $shused++;
+                if($i == scalar(@order)) {
+                    # last mandatory one, exit
+                    last;
+                }
+            }
+        }
+
+        if($i != scalar(@order)) {
+            printf STDERR "$file:$line missing mandatory section: %s\n",
+                $order[$i];
+            printf STDERR "$file:$line section found at index %u: '%s'\n",
+                $i, $shorig[$i];
+            printf STDERR " Found %u used sections\n", $shcount;
+            $errors++;
+        }
+    }
+}
+
+allsymbols();
+
+if(!$symbol{'CURLALTSVC_H1'}) {
+    print STDERR "did not get the symbols-in-version!\n";
+    exit;
+}
+
+my $ind = 1;
+for my $s (@optorder) {
+    $optblessed{$s} = $ind++
+}
+$ind = 1;
+for my $s (@funcorder) {
+    $funcblessed{$s} = $ind++
+}
+
+for my $m (@manpages) {
+    $docsdirs{dirname($m)}++;
+}
+
+for my $m (@manpages) {
+    scanmanpage($m);
+}
+
+print STDERR "ok\n" if(!$errors);
+
+exit $errors;
diff --git a/third-party/curl/tests/test1175.pl b/third-party/curl/tests/test1175.pl
new file mode 100644
index 0000000000..b929ff41ee
--- /dev/null
+++ b/third-party/curl/tests/test1175.pl
@@ -0,0 +1,80 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+# we may get the directory root pointed out
+my $root = $ARGV[0] || ".";
+
+my %error; # from the include file
+my %docs; # from libcurl-errors.3
+
+sub getdocserrors {
+    open(my $f, "<", "$root/docs/libcurl/libcurl-errors.md");
+    while(<$f>) {
+        if($_ =~ /^## (CURL[EM]_[^ ]*)/) {
+            my ($symbol) = ($1);
+            if($symbol =~ /OBSOLETE/) {
+                ;
+            }
+            else {
+                $docs{$symbol} = 1;
+            }
+        }
+    }
+    close($f);
+}
+
+sub getincludeerrors {
+    open(my $f, "<", "$root/docs/libcurl/symbols-in-versions");
+    while(<$f>) {
+        if($_ =~ /^(CURL[EM]_[^ \t]*)[ \t]*([0-9.]+)[ \t]*(.*)/) {
+            my ($symbol, $added, $rest) = ($1,$2,$3);
+            if($rest =~ /^([0-9.]+)/) {
+                # removed!
+            }
+            else {
+                $error{$symbol} = $added;
+            }
+        }
+    }
+    close($f);
+}
+
+getincludeerrors();
+getdocserrors();
+
+for(sort keys %error) {
+    if($error{$_} && !$docs{$_}) {
+        print "$_ is not in libcurl-errors.md\n";
+    }
+}
+
+for(sort keys %docs) {
+    if($docs{$_} && !$error{$_}) {
+        print "$_ is not in symbols-in-versions\n";
+    }
+}
diff --git a/third-party/curl/tests/test1177.pl b/third-party/curl/tests/test1177.pl
new file mode 100644
index 0000000000..cf5bd44fa7
--- /dev/null
+++ b/third-party/curl/tests/test1177.pl
@@ -0,0 +1,95 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+# Verify that curl_version_info.3 documents all the CURL_VERSION_ bits
+# from the header.
+#
+
+use strict;
+use warnings;
+
+my $manpage = $ARGV[0];
+my $header = $ARGV[1];
+my $source = $ARGV[2];
+my %manversion;
+my %headerversion;
+my %manname;
+my %sourcename;
+my $error = 0;
+
+open(my $m, "<", $manpage);
+while(<$m>) {
+    if($_ =~ / mask bit: (CURL_VERSION_[A-Z0-9_]+)/i) {
+        $manversion{$1}++;
+    }
+    if($_ =~ /^\.ip (.*)/i) {
+        $manname{$1}++;
+    }
+}
+close($m);
+
+open(my $h, "<", $header);
+while(<$h>) {
+    if($_ =~ /^\#define (CURL_VERSION_[A-Z0-9_]+)/i) {
+        $headerversion{$1}++;
+    }
+}
+close($h);
+
+open(my $s, "<", $source);
+while(<$s>) {
+    if($_ =~ /FEATURE\("([^"]*)"/) {
+      $sourcename{$1}++;
+    }
+}
+close($s);
+$sourcename{'NTLM_WB'}++; # deprecated, fake its presence in code
+
+for my $h (keys %headerversion) {
+    if(!$manversion{$h}) {
+        print STDERR "$manpage: missing $h\n";
+        $error++;
+    }
+}
+for my $h (keys %manversion) {
+    if(!$headerversion{$h}) {
+        print STDERR "$manpage: $h is not in the header!\n";
+        $error++;
+    }
+}
+for my $n (keys %sourcename) {
+    if(!$manname{$n}) {
+        print STDERR "$manpage: missing feature name $n\n";
+        $error++;
+    }
+}
+for my $n (keys %manname) {
+    if(!$sourcename{$n} && ($n ne "\"no name\"")) {
+        print STDERR "$manpage: $n is not in the source!\n";
+        $error++;
+    }
+}
+
+exit $error;
diff --git a/third-party/curl/tests/test1222.pl b/third-party/curl/tests/test1222.pl
new file mode 100644
index 0000000000..0d6a5ffc2c
--- /dev/null
+++ b/third-party/curl/tests/test1222.pl
@@ -0,0 +1,335 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+#
+###########################################################################
+#
+# Check that the deprecated statuses of functions and enum values in header
+# files, man pages and symbols-in-versions are in sync.
+
+use strict;
+use warnings;
+
+use File::Basename;
+
+my $root = $ARGV[0] || ".";
+my $bldroot = $ARGV[1] || ".";
+
+my $incdir = "$root/include/curl";
+my $docdir = "$bldroot/docs";
+my $libdocdir = "$docdir/libcurl";
+
+my $errcode = 0;
+
+# Symbol-indexed hashes.
+# Values are:
+#     X       Not deprecated
+#     ?       Deprecated in unknown version
+#     x.yy.z  Deprecated in version x.yy.z
+my %syminver;       # Symbols-in-versions deprecations.
+my %hdr;            # Public header files deprecations.
+my %funcman;        # Function man pages deprecations.
+my %optman;         # Option man pages deprecations.
+
+# Scan header file for public function and enum values. Flag them with
+# the version they are deprecated in, if some.
+sub scan_header {
+    my ($f) = @_;
+    my $line = "";
+    my $incomment = 0;
+    my $inenum = 0;
+
+    open(my $h, "<", $f);
+    while(<$h>) {
+        s/^\s*(.*?)\s*$/$1/;      # Trim.
+        # Remove multi-line comment trail.
+        if($incomment) {
+            if($_ !~ /.*?\*\/\s*(.*)$/) {
+                next;
+            }
+            $_ = $1;
+            $incomment = 0;
+        }
+        if($line ne "") {
+            # Unfold line.
+            $_ = "$line $1";
+            $line = "";
+        }
+        # Remove comments.
+        while($_ =~ /^(.*?)\/\*.*?\*\/(.*)$/) {
+            $_ = "$1 $2";
+        }
+        if($_ =~ /^(.*)\/\*/) {
+            $_ = "$1 ";
+            $incomment = 1;
+        }
+        s/^\s*(.*?)\s*$/$1/;      # Trim again.
+        # Ignore preprocessor directives and blank lines.
+        if($_ =~ /^(?:#|$)/) {
+            next;
+        }
+        # Handle lines that may be continued as if they were folded.
+        if($_ !~ /[;,{}]$/) {
+            # Folded line.
+            $line = $_;
+            next;
+        }
+        if($_ =~ /CURLOPTDEPRECATED\(/) {
+            # Handle deprecated CURLOPT_* option.
+            if($_ !~ /CURLOPTDEPRECATED\(\s*(\S+)\s*,(?:.*?,){2}\s*(.*?)\s*,.*"\)/) {
+                # Folded line.
+                $line = $_;
+                next;
+            }
+            $hdr{$1} = $2;
+        }
+        elsif($_ =~ /CURLOPT\(/) {
+            # Handle non-deprecated CURLOPT_* option.
+            if($_ !~ /CURLOPT\(\s*(\S+)\s*(?:,.*?){2}\)/) {
+                # Folded line.
+                $line = $_;
+                next;
+            }
+            $hdr{$1} = "X";
+        }
+        else {
+            my $version = "X";
+
+            # Get other kind of deprecation from this line.
+            if($_ =~ /CURL_DEPRECATED\(/) {
+                if($_ !~ /^(.*)CURL_DEPRECATED\(\s*(\S+?)\s*,.*?"\)(.*)$/) {
+                    # Folded line.
+                    $line = $_;
+                    next;
+                }
+                $version = $2;
+                $_ = "$1 $3";
+            }
+            if($_ =~ /^CURL_EXTERN\s+.*\s+(\S+?)\s*\(/) {
+                # Flag public function.
+                $hdr{$1} = $version;
+            }
+            elsif($inenum && $_ =~ /(\w+)\s*[,=}]/) {
+                # Flag enum value.
+                $hdr{$1} = $version;
+            }
+        }
+        # Remember if we are in an enum definition.
+        $inenum |= ($_ =~ /\benum\b/);
+        if($_ =~ /}/) {
+            $inenum = 0;
+        }
+    }
+    close $h;
+}
+
+# Scan function man page for options.
+# Each option has to be declared as ".IP <option>" where <option> starts with
+# the prefix. Flag each option with its deprecation version, if some.
+sub scan_man_for_opts {
+    my ($f, $prefix) = @_;
+    my $opt = "";
+    my $line = "";
+
+    open(my $m, "<", $f);
+    while(<$m>) {
+        if($_ =~ /^\./) {
+            # roff directive found: end current option paragraph.
+            my $o = $opt;
+            $opt = "";
+            if($_ =~ /^\.IP\s+((?:$prefix)_\w+)/) {
+                # A new option has been found.
+                $opt = $1;
+            }
+            $_ = $line;     # Get full paragraph.
+            $line = "";
+            s/\\f.//g;      # Remove font formatting.
+            s/\s+/ /g;      # One line with single space only.
+            if($o) {
+                $funcman{$o} = "X";
+                # Check if paragraph is mentioning deprecation.
+                while($_ =~ /(?:deprecated|obsoleted?)\b\s*(?:in\b|since\b)?\s*(?:version\b|curl\b|libcurl\b)?\s*(\d[0-9.]*\d)?\b\s*(.*)$/i) {
+                    $funcman{$o} = $1 || "?";
+                    $_ = $2;
+                }
+            }
+        }
+        else {
+            # Text line: accumulate.
+            $line .= $_;
+        }
+    }
+    close $m;
+}
+
+# Scan man page for deprecation in DESCRIPTION and/or AVAILABILITY sections.
+sub scan_man_page {
+    my ($path, $sym, $table) = @_;
+    my $version = "X";
+
+    if(open(my $fh, "<", $path)) {
+        my $section = "";
+        my $line = "";
+
+        while(<$fh>) {
+            if($_ =~ /\.so\s+man3\/(.*\.3\b)/) {
+                # Handle man page inclusion.
+                scan_man_page(dirname($path) . "/$1", $sym, $table);
+                $version = exists($$table{$sym})? $$table{$sym}: $version;
+            }
+            elsif($_ =~ /^\./) {
+                # Line is a roff directive.
+                if($_ =~ /^\.SH\b\s*(\w*)/) {
+                    # Section starts. End previous one.
+                    my $sh = $section;
+
+                    $section = $1;
+                    $_ = $line;     # Previous section text.
+                    $line = "";
+                    s/\\f.//g;
+                    s/\s+/ /g;
+                    s/\\f.//g;      # Remove font formatting.
+                    s/\s+/ /g;      # One line with single space only.
+                    if($sh =~ /DESCRIPTION|DEPRECATED/) {
+                        while($_ =~ /(?:deprecated|obsoleted?)\b\s*(?:in\b|since\b)?\s*(?:version\b|curl\b|libcurl\b)?\s*(\d[0-9.]*\d)?\b\s*(.*)$/i) {
+                            # Flag deprecation status.
+                            if($version ne "X" && $version ne "?") {
+                                if($1 && $1 ne $version) {
+                                    print "error: $sym man page lists unmatching deprecation versions $version and $1\n";
+                                    $errcode++;
+                                }
+                            }
+                            else {
+                                $version = $1 || "?";
+                            }
+                            $_ = $2;
+                        }
+                    }
+                }
+            }
+            else {
+                # Text line: accumulate.
+                $line .= $_;
+            }
+        }
+        close $fh;
+        $$table{$sym} = $version;
+    }
+}
+
+# Read symbols-in-versions.
+open(my $fh, "<", "$root/docs/libcurl/symbols-in-versions") or
+    die "$root/docs/libcurl/symbols-in-versions";
+while(<$fh>) {
+    if($_ =~ /^((?:CURL|LIBCURL)\S+)\s+\S+\s*(\S*)\s*(\S*)$/) {
+        if($3 eq "") {
+            $syminver{$1} = "X";
+            if($2 ne "" && $2 ne ".") {
+                $syminver{$1} = $2;
+            }
+        }
+    }
+}
+close($fh);
+
+if(!glob("$libdocdir/*.3")) {
+    print "curl built without the libcurl manual. Skipping test 1222.\n";
+    exit 0;
+}
+
+# Get header filenames,
+opendir(my $dh, $incdir) or die "Cannot opendir $incdir";
+my @hfiles = grep { /\.h$/ } readdir($dh);
+closedir $dh;
+
+# Get functions and enum symbols from header files.
+for(@hfiles) {
+    scan_header("$incdir/$_");
+}
+
+# Get function statuses from man pages.
+foreach my $sym (keys %hdr) {
+    if($sym =~ /^(?:curl|curlx)_\w/) {
+        scan_man_page("$libdocdir/$sym.3", $sym, \%funcman);
+    }
+}
+
+# Get options from function man pages.
+scan_man_for_opts("$libdocdir/curl_easy_setopt.3", "CURLOPT");
+scan_man_for_opts("$libdocdir/curl_easy_getinfo.3", "CURLINFO");
+
+# Get deprecation status from option man pages.
+foreach my $sym (keys %syminver) {
+    if($sym =~ /^(?:CURLOPT|CURLINFO)_\w+$/) {
+        scan_man_page("$libdocdir/opts/$sym.3", $sym, \%optman);
+    }
+}
+
+# Print results.
+my %keys = (%syminver, %funcman, %optman, %hdr);
+my $leader = <<HEADER
+Legend:
+<empty> Not listed
+X       Not deprecated
+?       Deprecated in unknown version
+x.yy.z  Deprecated in version x.yy.z
+
+Symbol                                 symbols-in  func man  opt man   .h
+                                       -versions
+HEADER
+        ;
+foreach my $sym (sort {$a cmp $b} keys %keys) {
+    if($sym =~ /^(?:CURLOPT|CURLINFO|curl|curlx)_\w/) {
+        my $s = exists($syminver{$sym})? $syminver{$sym}: " ";
+        my $f = exists($funcman{$sym})? $funcman{$sym}: " ";
+        my $o = exists($optman{$sym})? $optman{$sym}: " ";
+        my $h = exists($hdr{$sym})? $hdr{$sym}: " ";
+        my $r = " ";
+
+        # There are deprecated symbols in symbols-in-versions that are aliases
+        # and thus not listed anywhere else. Ignore them.
+        "$f$o$h" =~ /[X ]{3}/ && next;
+
+        # Check for inconsistencies between deprecations from the different sources.
+        foreach my $k ($s, $f, $o, $h) {
+            $r = $r eq " "? $k: $r;
+            if($k ne " " && $r ne $k) {
+                if($r eq "?") {
+                    $r = $k ne "X"? $k: "!";
+                }
+                elsif($r eq "X" || $k ne "?") {
+                    $r = "!";
+                }
+            }
+        }
+
+        if($r eq "!") {
+            print $leader;
+            $leader = "";
+            printf("%-38s %-11s %-9s %-9s %s\n", $sym, $s, $f, $o, $h);
+            $errcode++;
+        }
+    }
+}
+
+exit $errcode;
diff --git a/third-party/curl/tests/test1275.pl b/third-party/curl/tests/test1275.pl
new file mode 100644
index 0000000000..3b33bb3cf0
--- /dev/null
+++ b/third-party/curl/tests/test1275.pl
@@ -0,0 +1,131 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+my $root = $ARGV[0] || "..";
+
+my @m;
+if(open(O, '-|', 'git', 'ls-files', '--', $root)) {
+    push @m, <O>;
+    close(O);
+}
+
+my $errors = 0;
+
+my %accepted = ('curl' => 1,
+                'libcurl' => 1,
+                'macOS' => 1,
+                'wolfSSL' => 1,
+                'mbedTLS' => 1,
+                'rustls' => 1,
+                'c-ares' => 1);
+
+sub checkfile {
+    my ($f) = @_;
+    chomp $f;
+    if($f !~ /\.md\z/) {
+        return;
+    }
+    open(my $fh, "<", $f);
+    my $l;
+    my $prevl = '';
+    my $ignore = 0;
+    my $metadata = 0;
+    while(<$fh>) {
+        my $line = $_;
+        chomp $line;
+        $l++;
+        if(($l == 1) && ($line =~ /^---/)) {
+            # first line is a meta-data divider, skip to the next one
+            $metadata = 1;
+            next;
+        }
+        elsif($metadata) {
+            if($line !~ /^---/) {
+                next;
+            }
+            $metadata = 0;
+            next;
+        }
+        if($line =~ /^    /) {
+            # leading 4-space; reset previous-line context and skip checks
+            $prevl = '';
+            next;
+        }
+        if($line =~ /^(\`\`\`|\~\~\~)/) {
+            # start or stop ignore-mode
+            $ignore ^= 1;
+        }
+        if(!$ignore) {
+            if(($prevl =~ /\.\z/) && ($line =~ /^( *)([a-z][A-Za-z-]*)/)) {
+                my ($prefix, $word) = ($1, $2);
+                if($word =~ /^[a-z]/ && !$accepted{$word}) {
+                    my $c = length($prefix);
+                    print STDERR
+                        "$f:$l:$c:error: lowercase $word after period\n";
+                    print STDERR "$line\n";
+                    print STDERR ' ' x $c;
+                    print STDERR "^\n";
+                    $errors++;
+                }
+            }
+            elsif($line =~ /^(.*)\. +([a-z-]+)/) {
+                my ($prefix, $word) = ($1, $2);
+
+                if(($prefix =~ /\.\.\z/) ||
+                   ($prefix =~ /[0-9]\z/) ||
+                   ($prefix =~ /e.g\z/) ||
+                   ($prefix =~ /i.e\z/) ||
+                   ($prefix =~ /E.g\z/) ||
+                   ($prefix =~ /etc\z/) ||
+                   ($word !~ /^[a-z]/) ||
+                   $accepted{$word}) {
+                }
+                else {
+                    my $c = length($prefix) + 2;
+                    print STDERR
+                        "$f:$l:$c:error: lowercase $word after period\n";
+                    print STDERR "$line\n";
+                    print STDERR ' ' x $c;
+                    print STDERR "^\n";
+                    $errors++;
+                }
+            }
+        }
+        $prevl = $line;
+    }
+    close($fh);
+}
+
+for my $f (@m) {
+    checkfile($f);
+}
+
+if($errors) {
+    exit 1;
+}
+print "ok\n";
diff --git a/third-party/curl/tests/test1276.pl b/third-party/curl/tests/test1276.pl
new file mode 100644
index 0000000000..da818b6d7f
--- /dev/null
+++ b/third-party/curl/tests/test1276.pl
@@ -0,0 +1,69 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+sub showline {
+    my ($l) = @_;
+    $l =~ s/([^\x20-\x7f])/sprintf "%%%02x", ord $1/eg;
+    return $l;
+}
+
+my $root = $ARGV[0] || '..';
+
+open(my $fh, "-|", 'perl', "$root/lib/optiontable.pl", "$root/include/curl/curl.h");
+binmode $fh;
+my @gen = <$fh>;
+close($fh);
+
+open($fh, "<", "$root/lib/easyoptions.c");
+binmode $fh;
+my @file = <$fh>;
+close($fh);
+
+if(join("", @gen) ne join("", @file)) {
+    print "easyoptions.c need to be regenerated!\n";
+
+    printf "easyoptions.c is %u lines\n", scalar(@file);
+    printf "generated file is %u lines\n", scalar(@gen);
+    my $e = 0;
+    for my $i (0 .. $#gen) {
+        # strip CRLFs to unify
+        $gen[$i] =~ s/[\r\n]//g;
+        $file[$i] =~ s/[\r\n]//g;
+        if($gen[$i] ne $file[$i]) {
+            printf "File: %u:%s\nGen:  %u:%s\n",
+                $i + 1, showline($file[$i]),
+                $i + 1, showline($gen[$i]);
+            $e++;
+            if($e > 10) {
+                # only show 10 lines diff
+                last;
+            }
+        }
+    }
+    exit 1 if($e);
+}
diff --git a/third-party/curl/tests/test1477.pl b/third-party/curl/tests/test1477.pl
new file mode 100644
index 0000000000..0973c9c951
--- /dev/null
+++ b/third-party/curl/tests/test1477.pl
@@ -0,0 +1,101 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+# Check that libcurl-errors.3 and the public header files have the same set of
+# error codes.
+
+use strict;
+use warnings;
+
+# we may get the directory roots pointed out
+my $root = $ARGV[0] || ".";
+my $buildroot = $ARGV[1] || ".";
+my $manpge = "$buildroot/docs/libcurl/libcurl-errors.3";
+my $curlh = "$root/include/curl";
+my $errors = 0;
+
+my @hnames;
+my %wherefrom;
+my @mnames;
+my %manfrom;
+
+sub scanheader {
+    my ($file) = @_;
+    open H, "<$file";
+    my $line = 0;
+    while(<H>) {
+        $line++;
+        if($_ =~ /^  (CURL(E|UE|SHE|HE|M)_[A-Z0-9_]*)/) {
+            my ($name) = ($1);
+            if(($name !~ /(OBSOLETE|CURLE_RESERVED)/) && ($name !~ /_LAST\z/)) {
+                push @hnames, $name;
+                if($wherefrom{$name}) {
+                    print STDERR "double: $name\n";
+                }
+                $wherefrom{$name} = "$file:$line";
+            }
+        }
+    }
+    close(H);
+}
+
+sub scanmanpage {
+    my ($file) = @_;
+    open H, "<$file";
+    my $line = 0;
+    while(<H>) {
+        $line++;
+        if($_ =~ /^\.IP \"(CURL(E|UE|SHE|HE|M)_[A-Z0-9_]*)/) {
+            my ($name) = ($1);
+            if($name !~ /(CURLM_CALL_MULTI_SOCKET)/) {
+                push @mnames, $name;
+                $manfrom{$name} = "$file:$line";
+            }
+        }
+    }
+    close(H);
+}
+
+opendir(my $dh, $curlh) or die "Cannot opendir $curlh: $!";
+my @hfiles = grep { /\.h$/ } readdir($dh);
+closedir $dh;
+
+for(sort @hfiles) {
+    scanheader("$curlh/$_");
+}
+scanmanpage($manpge);
+
+print "Result\n";
+for my $h (sort @hnames) {
+    if(!$manfrom{$h}) {
+        printf "$h from %s, not in man page\n", $wherefrom{$h};
+    }
+}
+
+for my $m (sort @mnames) {
+    if(!$wherefrom{$m}) {
+        printf "$m from %s, not in any header\n", $manfrom{$m};
+    }
+}
diff --git a/third-party/curl/tests/test1486.pl b/third-party/curl/tests/test1486.pl
new file mode 100644
index 0000000000..93b5dbb63f
--- /dev/null
+++ b/third-party/curl/tests/test1486.pl
@@ -0,0 +1,113 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+# we may get the directory root pointed out
+my $root = $ARGV[0] || ".";
+
+my %insrc; # variable set in source
+my %indocs; # variable described in docs
+
+my $srccount = 1;
+sub getsrcvars {
+    open(my $f, "<", "$root/../src/tool_writeout.c");
+    my $mode = 0;
+    while(<$f>) {
+        if(!$mode &&
+           ($_ =~ /^static const struct writeoutvar/)) {
+            $mode = 1;
+        }
+        if($mode) {
+            if($_ =~ /^}/) {
+                last;
+            }
+            if($_ =~ /^  \{ \"([^\"]*)/) {
+                my $var = $1;
+                $insrc{$var} = $srccount++;
+            }
+        }
+    }
+    close($f);
+}
+
+my %special = (
+    'header{name}' => 1,
+    'output{filename}' => 1,
+    'time{format}' => 1,
+    );
+
+sub getdocsvars {
+    open(my $f, "<", "$root/../docs/cmdline-opts/write-out.md");
+    while(<$f>) {
+        chomp;
+        $_ =~ s/[\r\n]//g;
+        if($_ =~ /^\#\# *\z/) {
+            last;
+        }
+        elsif($_ =~ /^\#\# \`([^\`]*)\`/) {
+            if(!$special{$1}) {
+                $indocs{$1} = 1;
+            }
+        }
+    }
+    close($f);
+}
+
+getsrcvars();
+getdocsvars();
+
+my $error = 0;
+
+if((scalar(keys %indocs) < 10) || (scalar(keys %insrc) < 10)) {
+    print "problems to extract variables\n";
+    $error++;
+}
+
+# also verify that the source code lists them alphabetically
+my $check = 1;
+for(sort keys %insrc) {
+    if($insrc{$_} && !$indocs{$_}) {
+        print "$_ is not mentioned in write.out.md\n";
+        $error++;
+    }
+    if($insrc{$_} ne $check) {
+        print "$_ is not in alphabetical order\n";
+        $error++;
+    }
+    $check++;
+}
+
+for(sort keys %indocs) {
+    if($indocs{$_} && !$insrc{$_}) {
+        print "$_ documented, but not used in source code\n";
+        $error++;
+    }
+}
+
+print "OK\n" if(!$error);
+
+exit $error;
diff --git a/third-party/curl/tests/test1488.pl b/third-party/curl/tests/test1488.pl
new file mode 100644
index 0000000000..b940fb7f14
--- /dev/null
+++ b/third-party/curl/tests/test1488.pl
@@ -0,0 +1,141 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+# This script grew out of help from Przemyslaw Iskra and Balint Szilakszi
+# a late evening in the #curl IRC channel.
+#
+
+use strict;
+use warnings;
+use vars qw($Cpreprocessor);
+use allversions;
+
+#
+# configurehelp perl module is generated by configure script
+#
+my $rc = eval {
+    require configurehelp;
+    configurehelp->import(qw(
+        $Cpreprocessor
+    ));
+    1;
+};
+# Set default values if configure has not generated a configurehelp.pm file.
+# This is the case with cmake.
+if(!$rc) {
+    $Cpreprocessor = 'cpp';
+}
+
+# we may get the directory root pointed out
+my $root = $ARGV[0] || ".";
+
+# need an include directory when building out-of-tree
+my $i = ($ARGV[1]) ? "-I$ARGV[1] " : '';
+my $error = 0;
+
+my $versions = $ARGV[2];
+
+my @syms;
+my %manpage;
+my %symadded;
+
+our %pastversion;
+
+sub checkmanpage {
+    my ($m) = @_;
+
+    open(my $mh, "<", $m);
+    my $line = 1;
+    my $title;
+    my $addedin;
+    while(<$mh>) {
+        if(/^Title: (.*)/i) {
+            $title = $1;
+        }
+        elsif(/^Added-in: ([an0-9.\/]*)/i) {
+            $addedin = $1;
+
+            if(($addedin ne "n/a") && !$pastversion{$addedin}) {
+                print "$m: was added in a never released version: $addedin\n";
+                $error++;
+            }
+        }
+        if($addedin && $title) {
+            if($manpage{$title}) {
+                print "$title is a duplicate symbol in file $m\n";
+                $error++;
+            }
+            $manpage{$title} = $addedin;
+            last;
+        }
+        $line++;
+    }
+    close($mh);
+}
+
+sub scanman_md_dir {
+    my ($d) = @_;
+    opendir(my $dh, $d) or die "Cannot opendir: $!";
+    my @mans = grep { /.md\z/ } readdir($dh);
+    closedir $dh;
+    for my $m (@mans) {
+        checkmanpage("$d/$m");
+    }
+}
+
+# get all the past versions
+allversions($versions);
+
+scanman_md_dir("$root/docs/libcurl");
+scanman_md_dir("$root/docs/libcurl/opts");
+
+open my $s, "<", "$root/docs/libcurl/symbols-in-versions";
+while(<$s>) {
+    chomp;
+    if(/^(\S+) +([0-9.]*)/) {
+        my ($sym, $ver) = ($1, $2);
+        push @syms, $sym;
+
+        $symadded{$sym} = $ver;
+        if(!$pastversion{$ver}) {
+            printf "SIV: says $sym was added in non-existing %s\n", $ver;
+            $error++;
+        }
+    }
+}
+close $s;
+
+my $ignored = 0;
+for my $e (sort @syms) {
+    if($manpage{$e}) {
+        if($manpage{$e} ne $symadded{$e}) {
+            printf "%s.md says version %s, but SIV says %s\n",
+                $e, $manpage{$e}, $symadded{$e};
+            $error++;
+        }
+    }
+}
+print "OK\n" if(!$error);
+exit $error;
diff --git a/third-party/curl/tests/test1544.pl b/third-party/curl/tests/test1544.pl
new file mode 100644
index 0000000000..2703ac1e74
--- /dev/null
+++ b/third-party/curl/tests/test1544.pl
@@ -0,0 +1,147 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+#
+###########################################################################
+#
+# Check the OS/400 translating wrapper properly handles all translatable
+# string options.
+
+use strict;
+use warnings;
+
+my $root = $ARGV[0] || ".";
+my $incdir = "$root/include/curl";
+my $os400dir = "$root/projects/OS400";
+my $errcount = 0;
+
+# Scan header file for string option definitions.
+sub scan_header {
+    my ($f) = @_;
+    my $line = "";
+    my $incomment = 0;
+    my @stringopts;
+
+    open(my $h, "<", $f);
+    while(<$h>) {
+        s/^\s*(.*?)\s*$/$1/;      # Trim.
+        # Remove multi-line comment trail.
+        if($incomment) {
+            if($_ !~ /.*?\*\/\s*(.*)$/) {
+                next;
+            }
+            $_ = $1;
+            $incomment = 0;
+        }
+        if($line ne "") {
+            # Unfold line.
+            $_ = "$line $1";
+            $line = "";
+        }
+        if($_ =~ /^(.*)\\$/) {
+            $line = "$1 ";
+            next;
+        }
+        # Remove comments.
+        while($_ =~ /^(.*?)\/\*.*?\*\/(.*)$/) {
+            $_ = "$1 $2";
+        }
+        if($_ =~ /^(.*)\/\*/) {
+            $_ = "$1 ";
+            $incomment = 1;
+        }
+        s/^\s*(.*?)\s*$/$1/;      # Trim again.
+        # Ignore preprocessor directives and blank lines.
+        if($_ =~ /^(?:#|$)/) {
+            next;
+        }
+        # Handle lines that may be continued as if they were folded.
+        if($_ !~ /[;,{}]$/ || $_ =~ /[^)],$/) {
+            # Folded line.
+            $line = $_;
+            next;
+        }
+        # Keep string options only.
+        if($_ =~ /CURLOPT(?:DEPRECATED)?\s*\(\s*([^, \t]+)\s*,\s*CURLOPTTYPE_STRINGPOINT/) {
+            push(@stringopts, $1);
+        }
+    }
+    close $h;
+    return @stringopts;
+}
+
+# Scan projects/OS400/ccsidcurl.c for translatable string option cases.
+sub scan_wrapper_for_strings {
+    my ($f) = @_;
+    my $inarmor = 0;
+    my @stringopts;
+
+    open(my $h, "<", $f);
+    while(<$h>) {
+        if($_ =~ /(BEGIN|END) TRANSLATABLE STRING OPTIONS/) {
+            $inarmor = $1 eq "BEGIN";
+        }
+        elsif($inarmor && $_ =~ /case\s+([^:]+):/) {
+            push(@stringopts, $1);
+        }
+    }
+    close $h;
+    return @stringopts;
+}
+
+# Get translatable string options from header file.
+my @stringdefs = scan_header("$incdir/curl.h");
+
+# Get translated string options.
+my @stringrefs = scan_wrapper_for_strings("$os400dir/ccsidcurl.c");
+
+# Lists should be equal: check differences.
+my %diff;
+@diff{@stringdefs} = 0..$#stringdefs;
+delete @diff{@stringrefs};
+
+foreach(keys %diff) {
+    print "$_ is not translated\n";
+    delete $diff{$_};
+    $errcount++;
+}
+
+@diff{@stringrefs} = 0..$#stringrefs;
+delete @diff{@stringdefs};
+
+foreach(keys %diff) {
+    print "translated option $_ does not exist\n";
+    $errcount++;
+}
+
+# Check translated string option cases are sorted alphanumerically.
+foreach(my $i = 1; $i < $#stringrefs; $i++) {
+    if($stringrefs[$i] lt $stringrefs[$i - 1]) {
+        print("Translated string options are not sorted (" . $stringrefs[$i - 1] .
+              "/" . $stringrefs[$i] . ")\n");
+        $errcount++;
+        last;
+    }
+}
+
+exit !!$errcount;
diff --git a/third-party/curl/tests/test1707.pl b/third-party/curl/tests/test1707.pl
new file mode 100644
index 0000000000..a19940d141
--- /dev/null
+++ b/third-party/curl/tests/test1707.pl
@@ -0,0 +1,130 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+# This script grew out of help from Przemyslaw Iskra and Balint Szilakszi
+# a late evening in the #curl IRC channel.
+#
+
+use strict;
+use warnings;
+
+my $curl = shift @ARGV;
+my $opt = shift @ARGV;
+my $txt = shift @ARGV;
+
+my $longopt;
+my $shortopt;
+if($opt =~ /^--/) {
+    $longopt = $opt;
+}
+else {
+    $shortopt = $opt;
+}
+
+# first run the help command
+my @curlout; open(O, '-|', $curl, '-h', $opt) or die; push @curlout, <O>; close(O);
+
+# figure out the short+long option combo using -h all*/
+open(C, '-|', $curl, '-h', 'all');
+if($shortopt) {
+    while(<C>) {
+        if(/^ +$opt, ([^ ]*)/) {
+            $longopt = $1;
+            last;
+        }
+    }
+}
+else {
+    while(<C>) {
+        my $f  = $_;
+        if(/ $opt /) {
+            if($f =~ /^ *(-(.)), $longopt/) {
+                $shortopt = $1;
+            }
+            last;
+        }
+    }
+}
+close(C);
+
+my $fullopt;
+if($shortopt) {
+    $fullopt = "$shortopt, $longopt";
+}
+else {
+    $fullopt = $longopt;
+}
+
+open(R, "<$txt");
+my $show = 0;
+my @txtout;
+while(<R>) {
+    if(/^    $fullopt/) {
+        $show = 1;
+    }
+    elsif(/^    -/ && $show) {
+        last;
+    }
+    if($show) {
+        push @txtout, $_;
+    }
+}
+close(R);
+
+my $error = 0;
+if(scalar(@curlout) != scalar(@txtout)) {
+    printf "curl -h $opt is %d lines, $txt says %d lines\n",
+        scalar(@curlout), scalar(@txtout);
+    $error++;
+}
+else {
+    # same size, compare line by line
+    for my $i (0 .. $#curlout) {
+        # trim CRLF from the data
+        $curlout[$i] =~ s/[\r\n]//g;
+        $txtout[$i] =~ s/[\r\n]//g;
+        if($curlout[$i] ne $txtout[$i]) {
+            printf "Line %d\n", $i;
+            printf "-h   : %s (%d bytes)\n", $curlout[$i],
+                length($curlout[$i]);
+            printf "file : %s (%d bytes)\n", $txtout[$i],
+                length($txtout[$i]);
+
+            if(length($curlout[$i]) == length($txtout[$i])) {
+                my $l = length($curlout[$i]);
+                for my $c (0 .. $l) {
+                    my $o = substr($curlout[$i], $c, 1);
+                    my $t = substr($txtout[$i], $c, 1);
+                    if($o ne $t) {
+                        print "-h   col %d: %02x\n", $c, ord($o);
+                        print "file col %d: %02x\n", $c, ord($t);
+                    }
+                }
+            }
+            $error++;
+        }
+    }
+}
+exit $error;
diff --git a/third-party/curl/tests/test745.pl b/third-party/curl/tests/test745.pl
new file mode 100644
index 0000000000..2e46dd938d
--- /dev/null
+++ b/third-party/curl/tests/test745.pl
@@ -0,0 +1,92 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+# we may get the directory root pointed out
+my $root = $ARGV[0] || ".";
+
+my %typecheck; # from the include file
+my %enum; # from libcurl-errors.3
+
+sub gettypecheck {
+    open(my $f, "<", "$root/include/curl/typecheck-gcc.h") or die "no typecheck file";
+    while(<$f>) {
+        chomp;
+        if($_ =~ /\(option\) == (CURL[^ \)]*)/) {
+            $typecheck{$1}++;
+        }
+    }
+    close($f);
+}
+
+sub getinclude {
+    my $f;
+    open($f, "<", "$root/include/curl/curl.h") or die "no curl.h";
+    while(<$f>) {
+        if($_ =~ /\((CURLOPT[^,]*), (CURLOPTTYPE_[^,]*)/) {
+            my ($opt, $type) = ($1, $2);
+            if($type !~ /LONG|VALUES|BLOB|OFF_T/) {
+                $enum{$opt}++;
+            }
+        }
+    }
+    $enum{"CURLOPT_SOCKS5_GSSAPI_SERVICE"}++;
+    $enum{"CURLOPT_CONV_FROM_NETWORK_FUNCTION"}++;
+    $enum{"CURLOPT_CONV_FROM_UTF8_FUNCTION"}++;
+    $enum{"CURLOPT_CONV_TO_NETWORK_FUNCTION"}++;
+    close($f);
+
+    open($f, "<", "$root/include/curl/multi.h") or die "no curl.h";
+    while(<$f>) {
+        if($_ =~ /\((CURLMOPT[^,]*), (CURLOPTTYPE_[^,]*)/) {
+            my ($opt, $type) = ($1, $2);
+            if($type !~ /LONG|OFF_T/) {
+                $enum{$opt}++;
+            }
+        }
+    }
+    close($f);
+}
+
+gettypecheck();
+getinclude();
+
+my $error;
+for(sort keys %typecheck) {
+    if($typecheck{$_} && !$enum{$_}) {
+        print "$_ is not in curl.h\n";
+        $error++;
+    }
+}
+
+for(sort keys %enum) {
+    if($enum{$_} && !$typecheck{$_}) {
+        print "$_ is not checked in typecheck-gcc-h\n";
+        $error++;
+    }
+}
+print "OK\n" if(!$error);
diff --git a/third-party/curl/tests/test971.pl b/third-party/curl/tests/test971.pl
new file mode 100644
index 0000000000..221f78bf9b
--- /dev/null
+++ b/third-party/curl/tests/test971.pl
@@ -0,0 +1,145 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+# - Get all options mentioned in the $cmddir.
+# - Make sure they are all mentioned in the $opts document
+# - Make sure that the version in $opts matches the version in the file in
+#   $cmddir
+#
+
+use strict;
+use warnings;
+
+use allversions;
+
+my $opts = $ARGV[0];
+my $cmddir = $ARGV[1];
+my $versions = $ARGV[2];
+
+my %file;
+my %oiv;
+my $error = 0;
+
+sub cmdfiles {
+    my ($dir) = @_;
+
+    opendir(my $dh, $dir) or die "Cannot opendir $dir: $!";
+    my @opts = grep { /[a-z0-9].*\.md$/ && -f "$dir/$_" } readdir($dh);
+    closedir $dh;
+
+    for(@opts) {
+        $_ =~ s/\.md$//;
+        $file{$_} = 1;
+    }
+    return @opts;
+}
+
+sub mentions {
+    my ($f) = @_;
+    my @options;
+    open(my $fh, "<", $f);
+    while(<$fh>) {
+        chomp;
+        if(/(.*) +([0-9.]+)/) {
+            my ($flag, $version) = ($1, $2);
+
+            # store the name without the leading dashes
+            $flag =~ s/^--//;
+
+            # cut out short option (if present)
+            $flag =~ s/ \(-.\)//;
+
+            # store the name without trailing space
+            $flag =~ s/ +$//;
+
+            push @options, $flag;
+
+            # options-in-versions says...
+            $oiv{$flag} = $version;
+        }
+    }
+    close($fh);
+    return @options;
+}
+
+sub versioncheck {
+    my ($f, $v) = @_;
+    open(my $fh, "<", "$cmddir/$f.md");
+    while(<$fh>) {
+        chomp;
+        if(/^Added: ([0-9.]+)/) {
+            if($1 ne $v) {
+                print STDERR "$f lists $v in doc but $1 in file\n";
+                $error++;
+            }
+            last;
+        }
+    }
+    close($fh);
+}
+
+our %pastversion;
+
+# get all the past versions
+allversions($versions);
+
+# get all the files
+my @cmdopts = cmdfiles($cmddir);
+
+# get all the options mentioned in $o
+my @veropts = mentions($opts);
+
+# check if all files are in the doc
+for my $c (sort @cmdopts) {
+    if($oiv{$c}) {
+        if(!$pastversion{$oiv{$c}}) {
+            printf STDERR "$c: %s is not a proper release\n",
+                $oiv{$c};
+            $error++;
+        }
+
+        # present, but at same version?
+        versioncheck($c, $oiv{$c});
+    }
+    else {
+        print STDERR "--$c is in the option directory but not in $opts!\n";
+        $error++;
+    }
+}
+
+# check if the all options in the doc have files
+for my $v (sort @veropts) {
+    if($file{$v}) {
+        # present
+    }
+    else {
+        print STDERR "$v is in the doc but NOT as a file!\n";
+        $error++;
+    }
+}
+
+print STDERR "ok\n" if(!$error);
+
+exit $error;
diff --git a/third-party/curl/tests/testcurl.1 b/third-party/curl/tests/testcurl.1
deleted file mode 100644
index c88b275706..0000000000
--- a/third-party/curl/tests/testcurl.1
+++ /dev/null
@@ -1,126 +0,0 @@
-.\" **************************************************************************
-.\" *                                  _   _ ____  _
-.\" *  Project                     ___| | | |  _ \| |
-.\" *                             / __| | | | |_) | |
-.\" *                            | (__| |_| |  _ <| |___
-.\" *                             \___|\___/|_| \_\_____|
-.\" *
-.\" * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-.\" *
-.\" * This software is licensed as described in the file COPYING, which
-.\" * you should have received as part of this distribution. The terms
-.\" * are also available at https://curl.se/docs/copyright.html.
-.\" *
-.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-.\" * copies of the Software, and permit persons to whom the Software is
-.\" * furnished to do so, under the terms of the COPYING file.
-.\" *
-.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-.\" * KIND, either express or implied.
-.\" *
-.\" * SPDX-License-Identifier: curl
-.\" *
-.\" **************************************************************************
-.\"
-.TH testcurl.pl 1 "24 Mar 2010" testcurl testcurl
-.SH NAME
-testcurl.pl \- (automatically) test curl
-.SH SYNOPSIS
-.B testcurl.pl [options] [dir] > output
-.SH DESCRIPTION
-\fItestcurl.pl\fP is the master script to use for automatic testing of curl
-off git or daily snapshots. It is written for the purpose of being run from a
-crontab job or similar at a regular interval. The output is suitable to be
-mailed to curl-autocompile@haxx.se to be dealt with automatically (make sure
-the subject includes the word "autobuild" as the mail gets silently discarded
-otherwise).  The most current build status (with a reasonable backlog) will be
-published on the curl site, at https://curl.se/dev/builds.html
-
-\fIoptions\fP may be omitted. See \fI--setup\fP for what happens then.
-
-\fIdir\fP is a curl source dir, possibly a daily snapshot one. Using this will
-make testcurl.pl skip the 'buildconf' stage and thus it removes the dependency
-on automake, autoconf, libtool, GNU m4 and possibly a few other things.
-
-testcurl.pl will run 'buildconf' (or similar), run configure, build curl and
-libcurl in a separate build directory and then run 'make test' to test the
-fresh build.
-.SH OPTIONS
-.IP "--configure=[options]"
-Configure options passed to configure.
-.IP "--crosscompile"
-This is a cross-compile. Makes \fItestcurl.pl\fP skip a few things.
-.IP "--desc=[desc]"
-Description of your test system. Displayed on the build summary page on the
-weba site.
-.IP "--email=[email]"
-Set email address to report as. Displayed in the build logs on the site.
-.IP "--mktarball=[command]"
-Generic command to run after completed test.
-.IP "--name=[name]"
-Set name to report as. Displayed in the build summary on the site.
-.IP "--nobuildconf"
-Don't run buildconf. Useful when many builds use the same source tree, as then
-only one need to do this. Also, if multiple processes run tests simultaneously
-on the same source tree (like several hosts on a NFS mounted dir),
-simultaneous buildconf invokes may cause problems. (Added in 7.14.1)
-.IP "--nogitpull"
-Don't update from git even though it is a git tree. Useful to still be able to
-test even though your network is down, or similar.
-.IP "--runtestopts=[options]"
-Options that is passed to the runtests.pl script. Useful for disabling valgrind
-by force, and similar.
-.IP "--setup=[file name]"
-File name to read setup from (deprecated). The old style of providing info.
-If info is missing when testcurl.pl is started, it will prompt you and then
-store the info in a 'setup' file, which it will look for on each invoke. Use
-\fI--name\fP, \fI--email\fP, \fI--configure\fP and \fI--desc\fP instead.
-.IP "--target=[your os]"
-Specify your target environment. Recognized strings include 'vc', 'mingw32',
-and \&'borland'.
-.SH "INITIAL SETUP"
-First you make a checkout from git (or you write a script that downloads daily
-snapshots automatically, find inspiration in
-https://curl.se/dev/autocurl.txt ):
-
-.nf
-  $ mkdir daily-curl
-  $ cd daily-curl
-  $ git clone https://github.com/curl/curl.git
-.fi
-
-With the curl sources checked out, or downloaded, you can start testing right
-away. If you want to use \fItestcurl.pl\fP without command line arguments and
-to have it store and remember the config in its 'setup' file, then start it
-manually now and fill in the answers to the questions it prompts you for:
-
-.nf
-  $ ./curl/tests/testcurl.pl
-.fi
-
-Now you are ready to go. If you let the script run, it will perform a full
-cycle and spit out lots of output. Mail us that output as described above.
-.SH "CRONTAB EXAMPLE"
-The crontab could include something like this:
-
-.nf
-\# autobuild curl:
-0 4 * * * cd daily-curl && ./testit.sh
-.fi
-
-Where testit.sh is a shell script that could look similar to this:
-
-.nf
-mail="mail -s autobuild curl-autocompile@haxx.se"
-name="--name=whoami"
-email="--email=iamme@nowhere"
-desc='"--desc=supermachine Turbo 2000"'
-testprog="perl ./curl/tests/testcurl.pl $name $email $desc"
-opts1="--configure=--enable-debug"
-opts2="--configure=--enable-ipv6"
-
-# run first test
-$testprog $opts1 | $mail
-
-# run second test
-$testprog $opts2 | $mail
diff --git a/third-party/curl/tests/testcurl.pl b/third-party/curl/tests/testcurl.pl
index 09b0d98b18..ae836e4411 100644
--- a/third-party/curl/tests/testcurl.pl
+++ b/third-party/curl/tests/testcurl.pl
@@ -33,8 +33,8 @@
 # at a regular interval. The output is suitable to be mailed to
 # curl-autocompile@haxx.se to be dealt with automatically (make sure the
 # subject includes the word "autobuild" as the mail gets silently discarded
-# otherwise).  The most current build status (with a reasonable backlog) will
-# be published on the curl site, at https://curl.se/auto/
+# otherwise).  The most current build status (with a reasonable backlog) is
+# published on the curl site, at https://curl.se/auto/
 
 # USAGE:
 # testcurl.pl [options] [curl-daily-name] > output
@@ -49,23 +49,25 @@
 # --mktarball=[command]    Command to run after completed test
 # --name=[name]            Set name to report as
 # --notes=[notes]          More human-readable information about this configuration
-# --nocvsup                Don't pull from git even though it is a git tree
-# --nogitpull              Don't pull from git even though it is a git tree
-# --nobuildconf            Don't run buildconf
-# --noconfigure            Don't run configure
+# --nocvsup                Do not pull from git even though it is a git tree
+# --nogitpull              Do not pull from git even though it is a git tree
+# --nobuildconf            Do not run autoreconf -fi
+# --noconfigure            Do not run configure
 # --runtestopts=[options]  Options to pass to runtests.pl
-# --setup=[file name]      File name to read setup from (deprecated)
+# --setup=[filename]       Filename to read setup from (deprecated)
 # --target=[your os]       Specify your target environment.
 #
 # if [curl-daily-name] is omitted, a 'curl' git directory is assumed.
 #
 
 use strict;
+use warnings;
 
 use Cwd;
+use File::Path;
 use File::Spec;
 
-# Turn on warnings (equivalent to -w, which can't be used with /usr/bin/env)
+# Turn on warnings (equivalent to -w, which cannot be used with /usr/bin/env)
 #BEGIN { $^W = 1; }
 
 use vars qw($version $fixed $infixed $CURLDIR $git $pwd $build $buildlog
@@ -76,98 +78,101 @@ use vars qw($name $email $desc $confopts $runtestopts $setupfile $mktarball
             $extvercmd $nogitpull $nobuildconf $crosscompile
             $timestamp $notes);
 
-# version of this script
-$version='2023-03-28';
-$fixed=0;
+$notes = '';
+$runtestopts = '';
 
-# Determine if we're running from git or a canned copy of curl,
+# version of this script
+$version = '2024-11-28';
+$fixed = 0;
+
+# Determine if we are running from git or a canned copy of curl,
 # or if we got a specific target option or setup file option.
-$CURLDIR="curl";
-if (-f ".git/config") {
-  $CURLDIR = "./";
+$CURLDIR = "curl";
+if(-f ".git/config") {
+    $CURLDIR = "./";
 }
 
-$git=1;
+$git = 1;
 $setupfile = 'setup';
 $configurebuild = 1;
-while ($ARGV[0]) {
-  if ($ARGV[0] =~ /--target=/) {
-    $targetos = (split(/=/, shift @ARGV, 2))[1];
-  }
-  elsif ($ARGV[0] =~ /--setup=/) {
-    $setupfile = (split(/=/, shift @ARGV, 2))[1];
-  }
-  elsif ($ARGV[0] =~ /--extvercmd=/) {
-    $extvercmd = (split(/=/, shift @ARGV, 2))[1];
-  }
-  elsif ($ARGV[0] =~ /--mktarball=/) {
-    $mktarball = (split(/=/, shift @ARGV, 2))[1];
-  }
-  elsif ($ARGV[0] =~ /--name=/) {
-    $name = (split(/=/, shift @ARGV, 2))[1];
-  }
-  elsif ($ARGV[0] =~ /--email=/) {
-    $email = (split(/=/, shift @ARGV, 2))[1];
-  }
-  elsif ($ARGV[0] =~ /--desc=/) {
-    $desc = (split(/=/, shift @ARGV, 2))[1];
-  }
-  elsif ($ARGV[0] =~ /--notes=/) {
-    $notes = (split(/=/, shift @ARGV, 2))[1];
-  }
-  elsif ($ARGV[0] =~ /--configure=(.*)/) {
-    $confopts = $1;
-    shift @ARGV;
-  }
-  elsif (($ARGV[0] eq "--nocvsup") || ($ARGV[0] eq "--nogitpull")) {
-    $nogitpull=1;
-    shift @ARGV;
-  }
-  elsif ($ARGV[0] =~ /--nobuildconf/) {
-    $nobuildconf=1;
-    shift @ARGV;
-  }
-  elsif ($ARGV[0] =~ /--noconfigure/) {
-    $configurebuild=0;
-    shift @ARGV;
-  }
-  elsif ($ARGV[0] =~ /--crosscompile/) {
-    $crosscompile=1;
-    shift @ARGV;
-  }
-  elsif ($ARGV[0] =~ /--runtestopts=/) {
-    $runtestopts = (split(/=/, shift @ARGV, 2))[1];
-  }
-  else {
-    $CURLDIR=shift @ARGV;
-    $git=0; # a given dir, assume not using git
-  }
+while($ARGV[0]) {
+    if($ARGV[0] =~ /--target=/) {
+        $targetos = (split(/=/, shift @ARGV, 2))[1];
+    }
+    elsif($ARGV[0] =~ /--setup=/) {
+        $setupfile = (split(/=/, shift @ARGV, 2))[1];
+    }
+    elsif($ARGV[0] =~ /--extvercmd=/) {
+        $extvercmd = (split(/=/, shift @ARGV, 2))[1];
+    }
+    elsif($ARGV[0] =~ /--mktarball=/) {
+        $mktarball = (split(/=/, shift @ARGV, 2))[1];
+    }
+    elsif($ARGV[0] =~ /--name=/) {
+        $name = (split(/=/, shift @ARGV, 2))[1];
+    }
+    elsif($ARGV[0] =~ /--email=/) {
+        $email = (split(/=/, shift @ARGV, 2))[1];
+    }
+    elsif($ARGV[0] =~ /--desc=/) {
+        $desc = (split(/=/, shift @ARGV, 2))[1];
+    }
+    elsif($ARGV[0] =~ /--notes=/) {
+        $notes = (split(/=/, shift @ARGV, 2))[1];
+    }
+    elsif($ARGV[0] =~ /--configure=(.*)/) {
+        $confopts = $1;
+        shift @ARGV;
+    }
+    elsif(($ARGV[0] eq "--nocvsup") || ($ARGV[0] eq "--nogitpull")) {
+        $nogitpull = 1;
+        shift @ARGV;
+    }
+    elsif($ARGV[0] =~ /--nobuildconf/) {
+        $nobuildconf = 1;
+        shift @ARGV;
+    }
+    elsif($ARGV[0] =~ /--noconfigure/) {
+        $configurebuild = 0;
+        shift @ARGV;
+    }
+    elsif($ARGV[0] =~ /--crosscompile/) {
+        $crosscompile = 1;
+        shift @ARGV;
+    }
+    elsif($ARGV[0] =~ /--runtestopts=/) {
+        $runtestopts = (split(/=/, shift @ARGV, 2))[1];
+    }
+    else {
+        $CURLDIR = shift @ARGV;
+        $git = 0; # a given dir, assume not using git
+    }
 }
 
 # Do the platform-specific stuff here
 $confheader = 'curl_config.h';
 $binext = '';
 $libext = '.la'; # .la since both libcurl and libcares are made with libtool
-if ($^O eq 'MSWin32' || $targetos) {
-  if (!$targetos) {
-    # If no target defined on Win32 lets assume vc
-    $targetos = 'vc';
-  }
-  if ($targetos =~ /vc/ || $targetos =~ /borland/) {
-    $binext = '.exe';
-    $libext = '.lib';
-  }
-  elsif ($targetos =~ /mingw/) {
-    $binext = '.exe';
-    if ($^O eq 'MSWin32') {
-      $libext = '.a';
+if($^O eq 'MSWin32' || $targetos) {
+    if(!$targetos) {
+        # If no target defined on Windows, let's assume vc
+        $targetos = 'vc';
+    }
+    if($targetos =~ /vc/ || $targetos =~ /borland/) {
+        $binext = '.exe';
+        $libext = '.lib';
+    }
+    elsif($targetos =~ /mingw/) {
+        $binext = '.exe';
+        if($^O eq 'MSWin32') {
+            $libext = '.a';
+        }
     }
-  }
 }
 
-if (($^O eq 'MSWin32' || $^O eq 'cygwin' || $^O eq 'msys') &&
-    ($targetos =~ /vc/ || $targetos =~ /mingw32/ ||
-     $targetos =~ /borland/)) {
+if(($^O eq 'MSWin32' || $^O eq 'cygwin' || $^O eq 'msys') &&
+   ($targetos =~ /vc/ || $targetos =~ /mingw32/ ||
+    $targetos =~ /borland/)) {
 
   # Set these things only when building ON Windows and for Win32 platform.
   # FOR Windows since we might be cross-compiling on another system. Non-
@@ -177,63 +182,51 @@ if (($^O eq 'MSWin32' || $^O eq 'cygwin' || $^O eq 'msys') &&
   $confheader = 'config-win32.h';
 }
 
-$ENV{LC_ALL}="C" if (($ENV{LC_ALL}) && ($ENV{LC_ALL} !~ /^C$/));
-$ENV{LC_CTYPE}="C" if (($ENV{LC_CTYPE}) && ($ENV{LC_CTYPE} !~ /^C$/));
-$ENV{LANG}="C";
-
-sub rmtree($) {
-    my $target = $_[0];
-    if ($^O eq 'MSWin32') {
-      foreach (glob($target)) {
-        s:/:\\:g;
-        system("rd /s /q $_");
-      }
-    } else {
-      system("rm -rf $target");
-    }
-}
+$ENV{LC_ALL} = "C" if(($ENV{LC_ALL}) && ($ENV{LC_ALL} !~ /^C$/));
+$ENV{LC_CTYPE} = "C" if(($ENV{LC_CTYPE}) && ($ENV{LC_CTYPE} !~ /^C$/));
+$ENV{LANG} = "C";
 
 sub grepfile($$) {
     my ($target, $fn) = @_;
     open(my $fh, "<", $fn) or die;
-    while (<$fh>) {
-      if (/$target/) {
-        close($fh);
-        return 1;
-      }
+    while(<$fh>) {
+        if(/$target/) {
+            close($fh);
+            return 1;
+        }
     }
     close($fh);
     return 0;
 }
 
 sub logit($) {
-    my $text=$_[0];
-    if ($text) {
-      print "testcurl: $text\n";
+    my $text = $_[0];
+    if($text) {
+        print "testcurl: $text\n";
     }
 }
 
 sub logit_spaced($) {
-    my $text=$_[0];
-    if ($text) {
-      print "\ntestcurl: $text\n\n";
+    my $text = $_[0];
+    if($text) {
+        print "\ntestcurl: $text\n\n";
     }
 }
 
 sub mydie($){
-    my $text=$_[0];
-    logit "$text";
+    my $text = $_[0];
+    logit $text;
     chdir $pwd; # cd back to the original root dir
 
-    if ($pwd && $build) {
-      # we have a build directory name, remove the dir
-      logit "removing the $build dir";
-      rmtree "$pwd/$build";
+    if($pwd && $build) {
+        # we have a build directory name, remove the dir
+        logit "removing the $build dir";
+        rmtree "$pwd/$build";
     }
-    if (-r $buildlog) {
-      # we have a build log output file left, remove it
-      logit "removing the $buildlogname file";
-      unlink "$buildlog";
+    if(-r $buildlog) {
+        # we have a build log output file left, remove it
+        logit "removing the $buildlogname file";
+        unlink $buildlog;
     }
     logit "ENDING HERE"; # last line logged!
     exit 1;
@@ -243,71 +236,70 @@ sub get_host_triplet {
   my $triplet;
   my $configfile = "$pwd/$build/lib/curl_config.h";
 
-  if(-f $configfile && -s $configfile && open(my $libconfigh, "<", "$configfile")) {
-    while(<$libconfigh>) {
-      if($_ =~ /^\#define\s+OS\s+"*([^"][^"]*)"*\s*/) {
-        $triplet = $1;
-        last;
+  if(-f $configfile && -s $configfile && open(my $libconfigh, "<", $configfile)) {
+      while(<$libconfigh>) {
+          if($_ =~ /^\#define\s+CURL_OS\s+"*([^"][^"]*)"*\s*/) {
+              $triplet = $1;
+              last;
+          }
       }
-    }
-    close($libconfigh);
+      close($libconfigh);
   }
   return $triplet;
 }
 
 if($name && $email && $desc) {
-  # having these fields set are enough to continue, skip reading the setup
-  # file
-  $infixed=4;
-  $fixed=4;
+    # having these fields set are enough to continue, skip reading the setup
+    # file
+    $infixed = 4;
+    $fixed = 4;
 }
-elsif (open(my $f, "<", "$setupfile")) {
-  while (<$f>) {
-    if (/(\w+)=(.*)/) {
-      eval "\$$1=$2;";
+elsif(open(my $f, "<", $setupfile)) {
+    while(<$f>) {
+        if(/(\w+)=(.*)/) {
+            eval "\$$1=$2;";
+        }
     }
-  }
-  close($f);
-  $infixed=$fixed;
+    close($f);
+    $infixed = $fixed;
 }
 else {
-  $infixed=0;    # so that "additional args to configure" works properly first time...
+    $infixed = 0;    # so that "additional args to configure" works properly first time...
 }
 
-if (!$name) {
-  print "please enter your name\n";
-  $name = <>;
-  chomp $name;
-  $fixed=1;
+if(!$name) {
+    print "please enter your name\n";
+    $name = <>;
+    chomp $name;
+    $fixed = 1;
 }
 
-if (!$email) {
-  print "please enter your contact email address\n";
-  $email = <>;
-  chomp $email;
-  $fixed=2;
+if(!$email) {
+    print "please enter your contact email address\n";
+    $email = <>;
+    chomp $email;
+    $fixed = 2;
 }
 
-if (!$desc) {
-  print "please enter a one line system description\n";
-  $desc = <>;
-  chomp $desc;
-  $fixed=3;
+if(!$desc) {
+    print "please enter a one line system description\n";
+    $desc = <>;
+    chomp $desc;
+    $fixed = 3;
 }
 
-if (!$confopts) {
-  if ($infixed < 4) {
-    print "please enter your additional arguments to configure\n";
-    print "examples: --with-openssl --enable-debug --enable-ipv6\n";
-    $confopts = <>;
-    chomp $confopts;
-  }
+if(!$confopts) {
+    if($infixed < 4) {
+        print "please enter your additional arguments to configure\n";
+        print "examples: --with-openssl --enable-debug --enable-ipv6\n";
+        $confopts = <>;
+        chomp $confopts;
+    }
 }
 
-
-if ($fixed < 4) {
-    $fixed=4;
-    open(my $f, ">", "$setupfile") or die;
+if($fixed < 4) {
+    $fixed = 4;
+    open(my $f, ">", $setupfile) or die;
     print $f "name='$name'\n";
     print $f "email='$email'\n";
     print $f "desc='$desc'\n";
@@ -318,10 +310,10 @@ if ($fixed < 4) {
 }
 
 # Enable picky compiler warnings unless explicitly disabled
-if (($confopts !~ /--enable-debug/) &&
-    ($confopts !~ /--enable-warnings/) &&
-    ($confopts !~ /--disable-warnings/)) {
-  $confopts .= " --enable-warnings";
+if(($confopts !~ /--enable-debug/) &&
+   ($confopts !~ /--enable-warnings/) &&
+   ($confopts !~ /--disable-warnings/)) {
+    $confopts .= " --enable-warnings";
 }
 
 my $str1066os = 'o' x 1066;
@@ -338,450 +330,452 @@ logit "DESC = $desc";
 logit "NOTES = $notes";
 logit "CONFOPTS = $confopts";
 logit "RUNTESTOPTS = ".$runtestopts;
-logit "CPPFLAGS = ".$ENV{CPPFLAGS};
-logit "CFLAGS = ".$ENV{CFLAGS};
-logit "LDFLAGS = ".$ENV{LDFLAGS};
-logit "LIBS = ".$ENV{LIBS};
-logit "CC = ".$ENV{CC};
-logit "TMPDIR = ".$ENV{TMPDIR};
-logit "MAKEFLAGS = ".$ENV{MAKEFLAGS};
-logit "ACLOCAL_FLAGS = ".$ENV{ACLOCAL_FLAGS};
-logit "PKG_CONFIG_PATH = ".$ENV{PKG_CONFIG_PATH};
-logit "DYLD_LIBRARY_PATH = ".$ENV{DYLD_LIBRARY_PATH};
-logit "LD_LIBRARY_PATH = ".$ENV{LD_LIBRARY_PATH};
-logit "LIBRARY_PATH = ".$ENV{LIBRARY_PATH};
-logit "SHLIB_PATH = ".$ENV{SHLIB_PATH};
-logit "LIBPATH = ".$ENV{LIBPATH};
+logit "CPPFLAGS = ".($ENV{CPPFLAGS} || '');
+logit "CFLAGS = ".($ENV{CFLAGS} || '');
+logit "LDFLAGS = ".($ENV{LDFLAGS} || '');
+logit "LIBS = ".($ENV{LIBS} || '');
+logit "CC = ".($ENV{CC} || '');
+logit "TMPDIR = ".($ENV{TMPDIR} || '');
+logit "MAKEFLAGS = ".($ENV{MAKEFLAGS} || '');
+logit "ACLOCAL_FLAGS = ".($ENV{ACLOCAL_FLAGS} || '');
+logit "PKG_CONFIG_PATH = ".($ENV{PKG_CONFIG_PATH} || '');
+logit "DYLD_LIBRARY_PATH = ".($ENV{DYLD_LIBRARY_PATH} || '');
+logit "LD_LIBRARY_PATH = ".($ENV{LD_LIBRARY_PATH} || '');
+logit "LIBRARY_PATH = ".($ENV{LIBRARY_PATH} || '');
+logit "SHLIB_PATH = ".($ENV{SHLIB_PATH} || '');
+logit "LIBPATH = ".($ENV{LIBPATH} || '');
 logit "target = ".$targetos;
 logit "version = $version"; # script version
 logit "date = $timestamp";  # When the test build starts
 
 $str1066os = undef;
 
-# Make $pwd to become the path without newline. We'll use that in order to cut
+# Make $pwd to become the path without newline. We use that in order to cut
 # off that path from all possible logs and error messages etc.
 $pwd = getcwd();
 
 my $have_embedded_ares = 0;
 
-if (-d $CURLDIR) {
-  if ($git && -d "$CURLDIR/.git") {
-    logit "$CURLDIR is verified to be a fine git source dir";
-    # remove the generated sources to force them to be re-generated each
-    # time we run this test
-    unlink "$CURLDIR/src/tool_hugehelp.c";
-    # find out if curl source dir has an in-tree c-ares repo
-    $have_embedded_ares = 1 if (-f "$CURLDIR/ares/GIT-INFO");
-  } elsif (!$git && -f "$CURLDIR/tests/testcurl.pl") {
-    logit "$CURLDIR is verified to be a fine daily source dir";
-    # find out if curl source dir has an in-tree c-ares extracted tarball
-    $have_embedded_ares = 1 if (-f "$CURLDIR/ares/ares_build.h");
-  } else {
-    mydie "$CURLDIR is not a daily source dir or checked out from git!"
-  }
+if(-d $CURLDIR) {
+    if($git && -d "$CURLDIR/.git") {
+        logit "$CURLDIR is verified to be a fine git source dir";
+        # remove the generated sources to force them to be re-generated each
+        # time we run this test
+        unlink "$CURLDIR/src/tool_hugehelp.c";
+        # find out if curl source directory has an in-tree c-ares repo
+        $have_embedded_ares = 1 if(-f "$CURLDIR/ares/GIT-INFO");
+    } elsif(!$git && -f "$CURLDIR/tests/testcurl.pl") {
+        logit "$CURLDIR is verified to be a fine daily source dir";
+        # find out if curl source directory has an in-tree c-ares extracted tarball
+        $have_embedded_ares = 1 if(-f "$CURLDIR/ares/ares_build.h");
+    } else {
+        mydie "$CURLDIR is not a daily source directory or checked out from git!"
+    }
 }
 
 # make the path absolute so we can use it everywhere
-$CURLDIR = File::Spec->rel2abs("$CURLDIR");
+$CURLDIR = File::Spec->rel2abs($CURLDIR);
 
-$build="build-$$";
-$buildlogname="buildlog-$$";
-$buildlog="$pwd/$buildlogname";
+$build = "build-$$";
+$buildlogname = "buildlog-$$";
+$buildlog = "$pwd/$buildlogname";
 
 # remove any previous left-overs
-rmtree "build-*";
-rmtree "buildlog-*";
+foreach(glob("build-*")) { rmtree $_; }
+foreach(glob("buildlog-*")) { rmtree $_; }
 
 # this is to remove old build logs that ended up in the wrong dir
-foreach (glob("$CURLDIR/buildlog-*")) { unlink $_; }
+foreach(glob("$CURLDIR/buildlog-*")) { unlink $_; }
 
-# create a dir to build in
+# create a directory to build in
 mkdir $build, 0777;
 
-if (-d $build) {
-  logit "build dir $build was created fine";
+if(-d $build) {
+    logit "build directory $build was created fine";
 } else {
-  mydie "failed to create dir $build";
+    mydie "failed to create directory $build";
 }
 
 # get in the curl source tree root
 chdir $CURLDIR;
 
 # Do the git thing, or not...
-if ($git) {
-  my $gitstat = 0;
-  my @commits;
-
-  # update quietly to the latest git
-  if($nogitpull) {
-    logit "skipping git pull (--nogitpull)";
-  } else {
-    logit "run git pull in curl";
-    system("git pull 2>&1");
-    $gitstat += $?;
-    logit "failed to update from curl git ($?), continue anyway" if ($?);
-
-    # Set timestamp to the UTC the git update took place.
-    $timestamp = scalar(gmtime)." UTC" if (!$gitstat);
-  }
-
-  # get the last 5 commits for show (even if no pull was made)
-  @commits=`git log --pretty=oneline --abbrev-commit -5`;
-  logit "The most recent curl git commits:";
-  for (@commits) {
-    chomp ($_);
-    logit "  $_";
-  }
-
-  if (-d "ares/.git") {
-    chdir "ares";
+if($git) {
+    my $gitstat = 0;
+    my @commits;
 
+    # update quietly to the latest git
     if($nogitpull) {
-      logit "skipping git pull (--nogitpull) in ares";
+        logit "skipping git pull (--nogitpull)";
     } else {
-      logit "run git pull in ares";
-      system("git pull 2>&1");
-      $gitstat += $?;
-      logit "failed to update from ares git ($?), continue anyway" if ($?);
+        logit "run git pull in curl";
+        system("git pull 2>&1");
+        $gitstat += $?;
+        logit "failed to update from curl git ($?), continue anyway" if($?);
 
-      # Set timestamp to the UTC the git update took place.
-      $timestamp = scalar(gmtime)." UTC" if (!$gitstat);
+        # Set timestamp to the UTC the git update took place.
+        $timestamp = scalar(gmtime)." UTC" if(!$gitstat);
     }
 
     # get the last 5 commits for show (even if no pull was made)
-    @commits=`git log --pretty=oneline --abbrev-commit -5`;
-    logit "The most recent ares git commits:";
-    for (@commits) {
-      chomp ($_);
-      logit "  $_";
+    @commits = qx(git log --pretty=oneline --abbrev-commit -5);
+    logit "The most recent curl git commits:";
+    for(@commits) {
+        chomp ($_);
+        logit "  $_";
     }
 
-    chdir "$CURLDIR";
-  }
+    if(-d "ares/.git") {
+        chdir "ares";
 
-  if($nobuildconf) {
-    logit "told to not run buildconf";
-  }
-  elsif ($configurebuild) {
-    # remove possible left-overs from the past
-    unlink "configure";
-    unlink "autom4te.cache";
+        if($nogitpull) {
+            logit "skipping git pull (--nogitpull) in ares";
+        } else {
+            logit "run git pull in ares";
+            system("git pull 2>&1");
+            $gitstat += $?;
+            logit "failed to update from ares git ($?), continue anyway" if($?);
 
-    # generate the build files
-    logit "invoke autoreconf";
-    open(my $f, "-|", "autoreconf -fi 2>&1") or die;
-    open(my $log, ">", "$buildlog") or die;
-    while (<$f>) {
-      my $ll = $_;
-      print $ll;
-      print $log $ll;
+            # Set timestamp to the UTC the git update took place.
+            $timestamp = scalar(gmtime)." UTC" if(!$gitstat);
+        }
+
+        # get the last 5 commits for show (even if no pull was made)
+        @commits = qx(git log --pretty=oneline --abbrev-commit -5);
+        logit "The most recent ares git commits:";
+        for (@commits) {
+            chomp ($_);
+            logit "  $_";
+        }
+
+        chdir $CURLDIR;
     }
-    close($f);
-    close($log);
 
-    logit "buildconf was successful";
-  }
-  else {
-    logit "buildconf was successful (dummy message)";
-  }
+    if($nobuildconf) {
+        logit "told to not run autoreconf -fi";
+    }
+    elsif($configurebuild) {
+        # remove possible left-overs from the past
+        unlink "configure";
+        unlink "autom4te.cache";
+
+        # generate the build files
+        logit "invoke autoreconf";
+        open(my $f, "-|", "autoreconf -fi 2>&1") or die;
+        open(my $log, ">", $buildlog) or die;
+        while(<$f>) {
+            my $ll = $_;
+            print $ll;
+            print $log $ll;
+        }
+        close($f);
+        close($log);
+
+        logit "autoreconf -fi was successful";
+    }
+    else {
+        logit "autoreconf -fi was successful (dummy message)";
+    }
+
+} else {
+    # Show snapshot git commit when available
+    if(open (my $f, '<', "docs/tarball-commit.txt")) {
+        my $commit = <$f>;
+        chomp $commit;
+        logit "The most recent curl git commits:";
+        logit "  $commit";
+        close($f);
+    }
 }
 
-# Set timestamp to the one in curlver.h if this isn't a git test build.
-if ((-f "include/curl/curlver.h") &&
+# Set timestamp to the one in curlver.h if this is not a git test build.
+if((-f "include/curl/curlver.h") &&
     (open(my $f, "<", "include/curl/curlver.h"))) {
-  while (<$f>) {
-    chomp;
-    if ($_ =~ /^\#define\s+LIBCURL_TIMESTAMP\s+\"(.+)\".*$/) {
-      my $stampstring = $1;
-      if ($stampstring !~ /DEV/) {
-          $stampstring =~ s/\s+UTC//;
-          $timestamp = $stampstring." UTC";
-      }
-      last;
+    while(<$f>) {
+        chomp;
+        if($_ =~ /^\#define\s+LIBCURL_TIMESTAMP\s+\"(.+)\".*$/) {
+            my $stampstring = $1;
+            if($stampstring !~ /DEV/) {
+               $stampstring =~ s/\s+UTC//;
+                $timestamp = $stampstring." UTC";
+            }
+            last;
+        }
     }
-  }
-  close($f);
+    close($f);
 }
 
 # Show timestamp we are using for this test build.
 logit "timestamp = $timestamp";
 
-if ($configurebuild) {
-  if (-f "configure") {
-    logit "configure created (at least it exists)";
-  } else {
-    mydie "no configure created/found";
-  }
+if($configurebuild) {
+    if(-f "configure") {
+        logit "configure created (at least it exists)";
+    } else {
+        mydie "no configure created/found";
+    }
 } else {
-  logit "configure created (dummy message)"; # dummy message to feign success
+   logit "configure created (dummy message)"; # dummy message to feign success
 }
 
 sub findinpath {
-  my $c;
-  my $e;
-  my $x = ($^O eq 'MSWin32') ? '.exe' : '';
-  my $s = ($^O eq 'MSWin32') ? ';' : ':';
-  my $p=$ENV{'PATH'};
-  my @pa = split($s, $p);
-  for $c (@_) {
-    for $e (@pa) {
-      if( -x "$e/$c$x") {
-        return $c;
-      }
+    my $c;
+    my $e;
+    my $x = ($^O eq 'MSWin32') ? '.exe' : '';
+    my $s = ($^O eq 'MSWin32') ? ';' : ':';
+    my $p = $ENV{'PATH'};
+    my @pa = split($s, $p);
+    for $c (@_) {
+        for $e (@pa) {
+            if(-x "$e/$c$x") {
+                return $c;
+            }
+        }
     }
-  }
 }
 
 my $make = findinpath("gmake", "make", "nmake");
 if(!$make) {
-    mydie "Couldn't find make in the PATH";
+    mydie "Could not find make in the PATH";
 }
 # force to 'nmake' for VC builds
-$make = "nmake" if ($targetos =~ /vc/);
+$make = "nmake" if($targetos =~ /vc/);
 logit "going with $make as make";
 
 # change to build dir
 chdir "$pwd/$build";
 
-if ($configurebuild) {
-  # run configure script
-  print `$CURLDIR/configure $confopts 2>&1`;
+if($configurebuild) {
+    # run configure script
+    print qx($CURLDIR/configure $confopts 2>&1);
 
-  if (-f "lib/Makefile") {
-    logit "configure seems to have finished fine";
-  } else {
-    mydie "configure didn't work";
-  }
-} else {
-  logit "copying files to build dir ...";
-  if ($^O eq 'MSWin32') {
-    system("xcopy /s /q \"$CURLDIR\" .");
-    system("buildconf.bat");
-  }
-  elsif ($^O eq 'linux') {
-    system("cp -afr $CURLDIR/* .");
-    system("cp -af $CURLDIR/Makefile.dist Makefile");
-    system("$make -i -C lib -f Makefile.$targetos prebuild");
-    system("$make -i -C src -f Makefile.$targetos prebuild");
-    if (-d "$CURLDIR/ares") {
-      system("cp -af $CURLDIR/ares/ares_build.h.dist ./ares/ares_build.h");
-      system("$make -i -C ares -f Makefile.$targetos prebuild");
+    if(-f "lib/Makefile") {
+        logit "configure seems to have finished fine";
+    } else {
+        mydie "configure did not work";
+    }
+} else {
+    logit "copying files to build directory ...";
+    if($^O eq 'MSWin32') {
+        system('xcopy', ('/s', '/q', $CURLDIR, '.'));
     }
-  }
 }
 
 if(-f "./libcurl.pc") {
-  logit_spaced "display libcurl.pc";
-  if(open(my $f, "<", "libcurl.pc")) {
-    while(<$f>) {
-      my $ll = $_;
-      print $ll if(($ll !~ /^ *#/) && ($ll !~ /^ *$/));
+    logit_spaced "display libcurl.pc";
+    if(open(my $f, "<", "libcurl.pc")) {
+        while(<$f>) {
+            my $ll = $_;
+            print $ll if(($ll !~ /^ *#/) && ($ll !~ /^ *$/));
+        }
+        close($f);
     }
-    close($f);
-  }
 }
 
+my $f;
+
 logit_spaced "display lib/$confheader";
-open(my $f, "<", "lib/$confheader") or die "lib/$confheader: $!";
-while (<$f>) {
-  print if /^ *#/;
+open($f, "<", "lib/$confheader") or die "lib/$confheader: $!";
+while(<$f>) {
+    print if /^ *#/;
 }
 close($f);
 
-if (($have_embedded_ares) &&
+if(($have_embedded_ares) &&
     (grepfile("^#define USE_ARES", "lib/$confheader"))) {
-  print "\n";
-  logit "setup to build ares";
+    print "\n";
+    logit "setup to build ares";
 
-  if(-f "./ares/libcares.pc") {
-    logit_spaced  "display ares/libcares.pc";
-    if(open($f, "<", "ares/libcares.pc")) {
-      while(<$f>) {
-        my $ll = $_;
-        print $ll if(($ll !~ /^ *#/) && ($ll !~ /^ *$/));
-      }
-      close($f);
+    if(-f "./ares/libcares.pc") {
+        logit_spaced  "display ares/libcares.pc";
+        if(open($f, "<", "ares/libcares.pc")) {
+            while(<$f>) {
+                my $ll = $_;
+                print $ll if(($ll !~ /^ *#/) && ($ll !~ /^ *$/));
+            }
+            close($f);
+        }
     }
-  }
 
-  if(-f "./ares/ares_build.h") {
-    logit_spaced "display ares/ares_build.h";
-    if(open($f, "<", "ares/ares_build.h")) {
-      while(<$f>) {
-        my $ll = $_;
-        print $ll if(($ll =~ /^ *# *define *CARES_/) && ($ll !~ /__CARES_BUILD_H/));
-      }
-      close($f);
+    if(-f "./ares/ares_build.h") {
+        logit_spaced "display ares/ares_build.h";
+        if(open($f, "<", "ares/ares_build.h")) {
+            while(<$f>) {
+                my $ll = $_;
+                print $ll if(($ll =~ /^ *# *define *CARES_/) && ($ll !~ /__CARES_BUILD_H/));
+            }
+            close($f);
+        }
+    }
+    else {
+        mydie "no ares_build.h created/found";
     }
-  }
-  else {
-    mydie "no ares_build.h created/found";
-  }
 
-  $confheader =~ s/curl/ares/;
-  logit_spaced "display ares/$confheader";
-  if(open($f, "<", "ares/$confheader")) {
-      while (<$f>) {
-          print if /^ *#/;
-      }
-      close($f);
-  }
+    $confheader =~ s/curl/ares/;
+    logit_spaced "display ares/$confheader";
+    if(open($f, "<", "ares/$confheader")) {
+        while(<$f>) {
+            print if /^ *#/;
+        }
+        close($f);
+    }
 
-  print "\n";
-  logit "build ares";
-  chdir "ares";
+    print "\n";
+    logit "build ares";
+    chdir "ares";
 
-  if ($targetos && !$configurebuild) {
-      logit "$make -f Makefile.$targetos";
-      open($f, "-|", "$make -f Makefile.$targetos 2>&1") or die;
-  }
-  else {
-      logit "$make";
-      open($f, "-|", "$make 2>&1") or die;
-  }
-  while (<$f>) {
-    s/$pwd//g;
-    print;
-  }
-  close($f);
+    if($targetos && !$configurebuild) {
+        logit "$make -f Makefile.$targetos";
+        open($f, "-|", "$make -f Makefile.$targetos 2>&1") or die;
+    }
+    else {
+        logit $make;
+        open($f, "-|", "$make 2>&1") or die;
+    }
+    while(<$f>) {
+        s/$pwd//g;
+        print;
+    }
+    close($f);
 
-  if (-f "libcares$libext") {
-    logit "ares is now built successfully (libcares$libext)";
-  } else {
-    mydie "ares build failed (libcares$libext)";
-  }
+    if(-f "libcares$libext") {
+        logit "ares is now built successfully (libcares$libext)";
+    } else {
+        mydie "ares build failed (libcares$libext)";
+    }
 
-  # cd back to the curl build dir
-  chdir "$pwd/$build";
+    # cd back to the curl build dir
+    chdir "$pwd/$build";
 }
 
 my $mkcmd = "$make -i" . ($targetos && !$configurebuild ? " $targetos" : "");
-logit "$mkcmd";
-open(my $f, "-|", "$mkcmd 2>&1") or die;
-while (<$f>) {
-  s/$pwd//g;
-  print;
+logit $mkcmd;
+open($f, "-|", "$mkcmd 2>&1") or die;
+while(<$f>) {
+    s/$pwd//g;
+    print;
 }
 close($f);
 
-if (-f "lib/libcurl$libext") {
-  logit "libcurl was created fine (libcurl$libext)";
+if(-f "lib/libcurl$libext") {
+    logit "libcurl was created fine (libcurl$libext)";
 }
 else {
-  mydie "libcurl was not created (libcurl$libext)";
+    mydie "libcurl was not created (libcurl$libext)";
 }
 
-if (-f "src/curl$binext") {
-  logit "curl was created fine (curl$binext)";
+if(-f "src/curl$binext") {
+    logit "curl was created fine (curl$binext)";
 }
 else {
-  mydie "curl was not created (curl$binext)";
+    mydie "curl was not created (curl$binext)";
 }
 
-if (!$crosscompile || (($extvercmd ne '') && (-x $extvercmd))) {
-  logit "display curl${binext} --version output";
-  my $cmd = ($extvercmd ne '' ? $extvercmd.' ' : '')."./src/curl${binext} --version|";
-  open($f, "<", $cmd);
-  while(<$f>) {
-    # strip CR from output on non-win32 platforms (wine on Linux)
-    s/\r// if ($^O ne 'MSWin32');
-    print;
-  }
-  close($f);
+if(!$crosscompile || (($extvercmd ne '') && (-x $extvercmd))) {
+    logit "display curl${binext} --version output";
+    my $cmd = ($extvercmd ne '' ? $extvercmd.' ' : '')."./src/curl${binext} --version|";
+    open($f, "<", $cmd);
+    while(<$f>) {
+        # strip CR from output on non-Windows platforms (WINE on Linux)
+        s/\r// if($^O ne 'MSWin32');
+        print;
+    }
+    close($f);
 }
 
-if ($configurebuild && !$crosscompile) {
-  my $host_triplet = get_host_triplet();
-  # build example programs for selected build targets
-  if(($host_triplet =~ /([^-]+)-([^-]+)-irix(.*)/) ||
-     ($host_triplet =~ /([^-]+)-([^-]+)-aix(.*)/) ||
-     ($host_triplet =~ /([^-]+)-([^-]+)-osf(.*)/) ||
-     ($host_triplet =~ /([^-]+)-([^-]+)-solaris2(.*)/)) {
-    chdir "$pwd/$build/docs/examples";
-    logit_spaced "build examples";
-    open($f, "-|", "$make -i 2>&1") or die;
-    open(my $log, ">", "$buildlog") or die;
-    while (<$f>) {
-      s/$pwd//g;
-      print;
-      print $log $_;
+if($configurebuild && !$crosscompile) {
+    my $host_triplet = get_host_triplet();
+    # build example programs for selected build targets
+    if(($host_triplet =~ /([^-]+)-([^-]+)-irix(.*)/) ||
+       ($host_triplet =~ /([^-]+)-([^-]+)-aix(.*)/) ||
+       ($host_triplet =~ /([^-]+)-([^-]+)-osf(.*)/) ||
+       ($host_triplet =~ /([^-]+)-([^-]+)-solaris2(.*)/)) {
+        chdir "$pwd/$build/docs/examples";
+        logit_spaced "build examples";
+        open($f, "-|", "$make -i 2>&1") or die;
+        open(my $log, ">", $buildlog) or die;
+        while(<$f>) {
+            s/$pwd//g;
+            print;
+            print $log $_;
+        }
+        close($f);
+        close($log);
+        chdir "$pwd/$build";
+    }
+    # build and run full test suite
+    my $o;
+    if($runtestopts) {
+        $o = "TEST_F=\"$runtestopts\" ";
+    }
+    logit "$make -k ${o}test-full";
+    open($f, "-|", "$make -k ${o}test-full 2>&1") or die;
+    open(my $log, ">", $buildlog) or die;
+    while(<$f>) {
+        s/$pwd//g;
+        print;
+        print $log $_;
     }
     close($f);
     close($log);
-    chdir "$pwd/$build";
-  }
-  # build and run full test suite
-  my $o;
-  if($runtestopts) {
-      $o = "TEST_F=\"$runtestopts\" ";
-  }
-  logit "$make -k ${o}test-full";
-  open($f, "-|", "$make -k ${o}test-full 2>&1") or die;
-  open(my $log, ">", "$buildlog") or die;
-  while (<$f>) {
-    s/$pwd//g;
-    print;
-    print $log $_;
-  }
-  close($f);
-  close($log);
 
-  if (grepfile("^TEST", $buildlog)) {
-    logit "tests were run";
-  } else {
-    mydie "test suite failure";
-  }
+    if(grepfile("^TEST", $buildlog)) {
+        logit "tests were run";
+    } else {
+        mydie "test suite failure";
+    }
 
-  if (grepfile("^TESTFAIL:", $buildlog)) {
-    logit "the tests were not successful";
-  } else {
-    logit "the tests were successful!";
-  }
+    if(grepfile("^TESTFAIL:", $buildlog)) {
+        logit "the tests were not successful";
+    } else {
+        logit "the tests were successful!";
+    }
 }
 else {
-  if($crosscompile) {
-    my $host_triplet = get_host_triplet();
-    # build example programs for selected cross-compiles
-    if(($host_triplet =~ /([^-]+)-([^-]+)-mingw(.*)/) ||
-       ($host_triplet =~ /([^-]+)-([^-]+)-android(.*)/)) {
-      chdir "$pwd/$build/docs/examples";
-      logit_spaced "build examples";
-      open($f, "-|", "$make -i 2>&1") or die;
-      open(my $log, ">", "$buildlog") or die;
-      while (<$f>) {
-        s/$pwd//g;
-        print;
-        print $log $_;
-      }
-      close($f);
-      close($log);
-      chdir "$pwd/$build";
+    if($crosscompile) {
+        my $host_triplet = get_host_triplet();
+        # build example programs for selected cross-compiles
+        if(($host_triplet =~ /([^-]+)-([^-]+)-mingw(.*)/) ||
+           ($host_triplet =~ /([^-]+)-([^-]+)-android(.*)/)) {
+            chdir "$pwd/$build/docs/examples";
+            logit_spaced "build examples";
+            open($f, "-|", "$make -i 2>&1") or die;
+            open(my $log, ">", $buildlog) or die;
+            while(<$f>) {
+                s/$pwd//g;
+                print;
+                print $log $_;
+            }
+            close($f);
+            close($log);
+            chdir "$pwd/$build";
+        }
+        # build test harness programs for selected cross-compiles
+        if($host_triplet =~ /([^-]+)-([^-]+)-mingw(.*)/) {
+            chdir "$pwd/$build/tests";
+            logit_spaced "build test harness";
+            open(my $f, "-|", "$make -i 2>&1") or die;
+            open(my $log, ">", $buildlog) or die;
+            while(<$f>) {
+                s/$pwd//g;
+                print;
+                print $log $_;
+            }
+            close($f);
+            close($log);
+            chdir "$pwd/$build";
+        }
+        logit_spaced "cross-compiling, cannot run tests";
     }
-    # build test harness programs for selected cross-compiles
-    if($host_triplet =~ /([^-]+)-([^-]+)-mingw(.*)/) {
-      chdir "$pwd/$build/tests";
-      logit_spaced "build test harness";
-      open(my $f, "-|", "$make -i 2>&1") or die;
-      open(my $log, ">", "$buildlog") or die;
-      while (<$f>) {
-        s/$pwd//g;
-        print;
-        print $log $_;
-      }
-      close($f);
-      close($log);
-      chdir "$pwd/$build";
-    }
-    logit_spaced "cross-compiling, can't run tests";
-  }
-  # dummy message to feign success
-  print "TESTDONE: 1 tests out of 0 (dummy message)\n";
+    # dummy message to feign success
+    print "TESTDONE: 1 tests out of 0 (dummy message)\n";
 }
 
 # create a tarball if we got that option.
-if (($mktarball ne '') && (-x $mktarball)) {
-  system($mktarball);
+if(($mktarball ne '') && (-x $mktarball)) {
+    system($mktarball);
 }
 
+logit "enddate = ".scalar(gmtime)." UTC";  # When the run ends
 # mydie to cleanup
 mydie "ending nicely";
diff --git a/third-party/curl/tests/testutil.pm b/third-party/curl/tests/testutil.pm
index ece0b6e053..a5e79df58d 100644
--- a/third-party/curl/tests/testutil.pm
+++ b/third-party/curl/tests/testutil.pm
@@ -37,9 +37,13 @@ BEGIN {
         runclient
         runclientoutput
         setlogfunc
-        shell_quote
+        exerunner
+        subtextfile
+        subchars
         subbase64
         subnewlines
+        subsha256base64file
+        substrippemfile
     );
 
     our @EXPORT_OK = qw(
@@ -48,17 +52,18 @@ BEGIN {
     );
 }
 
+use Digest::SHA qw(sha256);
 use MIME::Base64;
 
 use globalconfig qw(
     $torture
     $verbose
-);
+    $dev_null
+    );
 
 my $logfunc;      # optional reference to function for logging
 my @logmessages;  # array holding logged messages
 
-
 #######################################################################
 # Log an informational message
 # If a log callback function was set in setlogfunc, it is called. If not,
@@ -66,7 +71,7 @@ my @logmessages;  # array holding logged messages
 #
 # logmsg must only be called by one of the runner_* entry points and functions
 # called by them, or else logs risk being lost, since those are the only
-# functions that know about and will return buffered logs.
+# functions that know about and return buffered logs.
 sub logmsg {
     if(!scalar(@_)) {
         return;
@@ -81,7 +86,7 @@ sub logmsg {
 #######################################################################
 # Set the function to use for logging
 sub setlogfunc {
-    ($logfunc)=@_;
+    ($logfunc) = @_;
 }
 
 #######################################################################
@@ -92,8 +97,38 @@ sub clearlogs {
     return $loglines;
 }
 
-
 #######################################################################
+
+sub includefile {
+    my ($f, $text) = @_;
+    open(F, "<$f");
+    if($text) {
+        binmode F, ':crlf';
+    }
+    my @a = <F>;
+    close(F);
+    return join("", @a);
+}
+
+sub subtextfile {
+    my ($thing) = @_;
+
+    my $count = ($$thing =~ s/%includetext ([^%]*)%[\n\r]+/includefile($1, 1)/ge);
+
+    return $count > 0;
+}
+
+sub subchars {
+    my ($thing) = @_;
+
+    $$thing =~ s/%SP/ /g;    # space
+    $$thing =~ s/%TAB/\t/g;  # horizontal tab
+    $$thing =~ s/%CR/\r/g;   # carriage return aka \r aka 0x0d
+    $$thing =~ s/%LT/</g;
+    $$thing =~ s/%GT/>/g;
+    $$thing =~ s/%AMP/&/g;
+}
+
 sub subbase64 {
     my ($thing) = @_;
 
@@ -113,13 +148,29 @@ sub subbase64 {
         $d =~ s/%([0-9A-Fa-f]{2})/chr(hex($1))/eg;
         $$thing =~ s/%%HEX%%/$d/;
     }
+    # repeat
     while($$thing =~ s/%repeat\[(\d+) x (.*?)\]%/%%REPEAT%%/i) {
         # decode %NN characters
         my ($d, $n) = ($2, $1);
         $d =~ s/%([0-9A-Fa-f]{2})/chr(hex($1))/eg;
+        $n =~ s/%([0-9A-Fa-f]{2})/chr(hex($1))/eg;
         my $all = $d x $n;
         $$thing =~ s/%%REPEAT%%/$all/;
     }
+
+    # days
+    while($$thing =~ s/%days\[(.*?)\]/%%DAYS%%/i) {
+        # convert to now + given days in epoch seconds, align to a 60 second
+        # boundary. Then provide two alternatives.
+        my $now = time();
+        my $d = ($1 * 24 * 3600) + $now + 30;
+        $d = int($d / 60) * 60;
+        my $d2 = $d + 60;
+        $$thing =~ s/%%DAYS%%/%alternatives[$d,$d2]/;
+    }
+
+    # include a file
+    $$thing =~ s/%include ([^%]*)%[\n\r]+/includefile($1, 0)/ge;
 }
 
 my $prevupdate;  # module scope so it remembers the last value
@@ -132,15 +183,9 @@ sub subnewlines {
         return;
     }
 
-    # When curl is built with Hyper, it gets all response headers delivered as
-    # name/value pairs and curl "invents" the newlines when it saves the
-    # headers. Therefore, curl will always save headers with CRLF newlines
-    # when built to use Hyper. By making sure we deliver all tests using CRLF
-    # as well, all test comparisons will survive without knowing about this
-    # little quirk.
-
-    if(($$thing =~ /^HTTP\/(1.1|1.0|2|3) [1-5][^\x0d]*\z/) ||
-       ($$thing =~ /^(GET|POST|PUT|DELETE) \S+ HTTP\/\d+(\.\d+)?/) ||
+    if(($$thing =~ /^HTTP\/(1.1|1.0|2|3) ([1-5]|9)[^\x0d]*\z/) ||
+       ($$thing =~ /^(GET|HEAD|POST|PUT|DELETE|CONNECT) \S+ HTTP\/\d+(\.\d+)?/) ||
+       ($$thing =~ /^(SETUP|GET_PARAMETER|OPTIONS|ANNOUNCE|DESCRIBE) \S+ RTSP\/\d+(\.\d+)?/) ||
        (($$thing =~ /^[a-z0-9_-]+: [^\x0d]*\z/i) &&
         # skip curl error messages
         ($$thing !~ /^curl: \(\d+\) /))) {
@@ -150,7 +195,7 @@ sub subnewlines {
     }
     else {
         if(($$thing =~ /^\n\z/) && $prevupdate) {
-            # if there's a blank link after a line we update, we hope it is
+            # if there is a blank line after a line we update, we hope it is
             # the empty line following headers
             $$thing =~ s/\x0a/\x0d\x0a/;
         }
@@ -162,7 +207,7 @@ sub subnewlines {
 # Run the application under test and return its return code
 #
 sub runclient {
-    my ($cmd)=@_;
+    my ($cmd) = @_;
     my $ret = system($cmd);
     print "CMD ($ret): $cmd\n" if($verbose && !$torture);
     return $ret;
@@ -177,28 +222,60 @@ sub runclient {
 # Run the application under test and return its stdout
 #
 sub runclientoutput {
-    my ($cmd)=@_;
-    return `$cmd 2>/dev/null`;
+    my ($cmd) = @_;
+    return qx($cmd 2>$dev_null);
 
 # This is one way to test curl on a remote machine
-#    my @out = `ssh $CLIENTIP cd \'$pwd\' \\; \'$cmd\'`;
+#    my @out = qx(ssh $CLIENTIP cd \'$pwd\' \\; \'$cmd\');
 #    sleep 2;    # time to allow the NFS server to be updated
 #    return @out;
 }
 
-
 #######################################################################
-# Quote an argument for passing safely to a Bourne shell
-# This does the same thing as String::ShellQuote but doesn't need a package.
+# Return custom tool (e.g. wine or qemu) to run curl binaries.
 #
-sub shell_quote {
-    my ($s)=@_;
-    if($s !~ m/^[-+=.,_\/:a-zA-Z0-9]+$/) {
-        # string contains a "dangerous" character--quote it
-        $s =~ s/'/'"'"'/g;
-        $s = "'" . $s . "'";
+sub exerunner {
+    if($ENV{'CURL_TEST_EXE_RUNNER'}) {
+        return $ENV{'CURL_TEST_EXE_RUNNER'} . ' ';
     }
-    return $s;
+    return '';
 }
 
+sub get_sha256_base64 {
+    my ($file_path) = @_;
+    return encode_base64(sha256(do { local $/; open my $fh, '<:raw', $file_path or die $!; <$fh> }), "");
+}
+
+sub subsha256base64file {
+    my ($thing) = @_;
+
+    # SHA-256 base64
+    while($$thing =~ s/%sha256b64file\[(.*?)\]sha256b64file%/%%SHA256B64FILE%%/i) {
+        my $file_path = $1;
+        $file_path =~ s/%([0-9A-Fa-f]{2})/chr(hex($1))/eg;
+        my $hash_b64 = get_sha256_base64($file_path);
+        $$thing =~ s/%%SHA256B64FILE%%/$hash_b64/;
+    }
+}
+
+sub get_file_content {
+    my ($file_path) = @_;
+    my $content = do { local $/; open my $fh, '<', $file_path or die $!; <$fh> };
+    $content =~ s/(^|-----END .*?-----[\r\n]?)(.*?)(-----BEGIN .*?-----|$)/$1$3/gs;
+    $content =~ s/\r\n/\n/g;
+    chomp($content);
+    return $content;
+}
+
+sub substrippemfile {
+    my ($thing) = @_;
+
+    # File content substitution
+    while($$thing =~ s/%strippemfile\[(.*?)\]strippemfile%/%%FILE%%/i) {
+        my $file_path = $1;
+        $file_path =~ s/%([0-9A-Fa-f]{2})/chr(hex($1))/eg;
+        my $file_content = get_file_content($file_path);
+        $$thing =~ s/%%FILE%%/$file_content/;
+    }
+}
 1;
diff --git a/third-party/curl/tests/tftpserver.pl b/third-party/curl/tests/tftpserver.pl
index 52ad01f0c2..2ea46dccf9 100644
--- a/third-party/curl/tests/tftpserver.pl
+++ b/third-party/curl/tests/tftpserver.pl
@@ -34,14 +34,11 @@ BEGIN {
 use serverhelp qw(
     server_pidfilename
     server_logfilename
-    );
-
-use pathhelp qw(
-    exe_ext
+    server_exe
     );
 
 my $verbose = 0;     # set to 1 for debugging
-my $port = 8997;     # just a default
+my $port = 8997;     # a default
 my $ipvnum = 4;      # default IP version of tftp server
 my $idnum = 1;       # default tftp server instance number
 my $proto = 'tftp';  # protocol the tftp server speaks
@@ -49,7 +46,6 @@ my $pidfile;
 my $portfile;
 my $logfile;
 my $srcdir;
-my $fork;
 
 my $flags  = "";
 my $path   = '.';
@@ -108,7 +104,7 @@ while(@ARGV) {
         $verbose = 1;
     }
     else {
-        print STDERR "\nWarning: tftpserver.pl unknown parameter: $ARGV[0]\n";
+        print STDERR "\nWarning: tftpserver.pl unknown parameter: '$ARGV[0]'\n";
     }
     shift @ARGV;
 }
@@ -130,4 +126,4 @@ $flags .= "--pidfile \"$pidfile\" ".
 $flags .= "--ipv$ipvnum --port $port --srcdir \"$srcdir\"";
 
 $| = 1;
-exec("exec server/tftpd".exe_ext('SRV')." $flags");
+exec("exec ".server_exe('tftpd')." $flags");
diff --git a/third-party/curl/tests/tunit/.gitignore b/third-party/curl/tests/tunit/.gitignore
new file mode 100644
index 0000000000..97fa1ba521
--- /dev/null
+++ b/third-party/curl/tests/tunit/.gitignore
@@ -0,0 +1,6 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+tunits
+tunits.c
diff --git a/third-party/curl/tests/tunit/CMakeLists.txt b/third-party/curl/tests/tunit/CMakeLists.txt
new file mode 100644
index 0000000000..c6ac279a66
--- /dev/null
+++ b/third-party/curl/tests/tunit/CMakeLists.txt
@@ -0,0 +1,57 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+# Get BUNDLE, FIRST_C, TESTS_C variables
+curl_transform_makefile_inc("Makefile.inc" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
+include("${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
+
+if(_CURL_TESTS_CONCAT)
+  set(_mk_unity_extra "--concat" "-I${CMAKE_CURRENT_SOURCE_DIR}" "-I${PROJECT_SOURCE_DIR}/tests/libtest")
+endif()
+
+add_custom_command(OUTPUT "${BUNDLE}.c"
+  COMMAND ${PERL_EXECUTABLE} "${PROJECT_SOURCE_DIR}/scripts/mk-unity.pl" ${_mk_unity_extra}
+    --test ${TESTS_C} > "${BUNDLE}.c"
+  DEPENDS
+    "${PROJECT_SOURCE_DIR}/scripts/mk-unity.pl" "${CMAKE_CURRENT_SOURCE_DIR}/Makefile.inc"
+    ${FIRST_C} ${FIRST_H} ${TESTS_C}
+  VERBATIM)
+
+add_executable(${BUNDLE} EXCLUDE_FROM_ALL "${BUNDLE}.c")
+add_dependencies(tt ${BUNDLE})
+target_link_libraries(${BUNDLE} curltool ${LIB_SELECTED})
+target_include_directories(${BUNDLE} PRIVATE
+  "${PROJECT_BINARY_DIR}/lib"            # for "curl_config.h"
+  "${PROJECT_SOURCE_DIR}/lib"            # for "curl_setup.h", curlx
+  "${PROJECT_SOURCE_DIR}/src"            # for tool headers
+  "${PROJECT_SOURCE_DIR}/tests/libtest"  # for "first.h", "unitcheck.h"
+  "${CMAKE_CURRENT_SOURCE_DIR}"          # for the generated bundle source to find included test sources
+)
+target_compile_definitions(${BUNDLE} PRIVATE ${CURL_DEBUG_MACROS})
+set_target_properties(${BUNDLE} PROPERTIES OUTPUT_NAME "${BUNDLE}" PROJECT_LABEL "Test ${BUNDLE}" UNITY_BUILD OFF)
+
+if(NOT _CURL_TESTS_CONCAT)
+  set_target_properties(${BUNDLE} PROPERTIES C_CLANG_TIDY "")
+  curl_add_clang_tidy_test_target("${BUNDLE}-clang-tidy" ${BUNDLE} ${FIRST_C} ${TESTS_C})
+endif()
diff --git a/third-party/curl/tests/tunit/Makefile.am b/third-party/curl/tests/tunit/Makefile.am
new file mode 100644
index 0000000000..c45a4b908b
--- /dev/null
+++ b/third-party/curl/tests/tunit/Makefile.am
@@ -0,0 +1,82 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+AUTOMAKE_OPTIONS = foreign nostdinc
+
+# Specify our include paths here, and do it relative to $(top_srcdir) and
+# $(top_builddir), to ensure that these paths which belong to the library
+# being currently built and tested are searched before the library which
+# might possibly already be installed in the system.
+#
+# $(top_srcdir)/include is for libcurl's external include files
+# $(top_builddir)/lib is for libcurl's generated lib/curl_config.h file
+# $(top_srcdir)/lib for libcurl's lib/curl_setup.h and other "borrowed" files
+# $(srcdir) for the generated bundle source to find included test sources
+
+AM_CPPFLAGS = -I$(top_srcdir)/include        \
+              -I$(top_builddir)/lib          \
+              -I$(top_srcdir)/lib            \
+              -I$(top_srcdir)/src            \
+              -I$(top_srcdir)/tests/libtest  \
+              -I$(srcdir)
+
+# Get BUNDLE, FIRST_C, TESTS_C variables
+include Makefile.inc
+
+EXTRA_DIST = CMakeLists.txt README.md $(TESTS_C)
+
+CFLAGS += @CURL_CFLAG_EXTRAS@
+
+# Prevent LIBS from being used for all link targets
+LIBS = $(BLANK_AT_MAKETIME)
+
+AM_CPPFLAGS += -DCURL_STATICLIB -DUNITTESTS
+if DEBUGBUILD
+AM_CPPFLAGS += -DDEBUGBUILD
+endif
+
+if BUILD_UNITTESTS
+$(BUNDLE).c: $(top_srcdir)/scripts/mk-unity.pl Makefile.inc $(FIRST_C) $(TESTS_C)
+	@PERL@ $(top_srcdir)/scripts/mk-unity.pl --test $(TESTS_C) > $(BUNDLE).c
+
+noinst_PROGRAMS = $(BUNDLE)
+LDADD = $(top_builddir)/src/libcurltool.la $(top_builddir)/lib/libcurl.la
+CLEANFILES = $(BUNDLE).c
+else
+noinst_PROGRAMS =
+endif
+
+CHECKSRC = $(CS_$(V))
+CS_0 = @echo "  RUN     " $@;
+CS_1 =
+CS_ = $(CS_0)
+
+checksrc:
+	$(CHECKSRC)(@PERL@ $(top_srcdir)/scripts/checksrc.pl -D$(srcdir) -W$(srcdir)/$(BUNDLE).c $(TESTS_C))
+
+if NOT_CURL_CI
+all-local: checksrc
+endif
+
+clean-local:
+	rm -f $(BUNDLE)
diff --git a/third-party/curl/tests/tunit/Makefile.inc b/third-party/curl/tests/tunit/Makefile.inc
new file mode 100644
index 0000000000..27a6163173
--- /dev/null
+++ b/third-party/curl/tests/tunit/Makefile.inc
@@ -0,0 +1,38 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Shared between CMakeLists.txt and Makefile.am
+
+BUNDLE = tunits
+
+# Files referenced from the bundle source
+FIRST_C = ../libtest/first.c
+
+# All tool unit test programs
+TESTS_C = \
+  tool1394.c \
+  tool1604.c \
+  tool1621.c \
+  tool1622.c \
+  tool1623.c \
+  tool1720.c
diff --git a/third-party/curl/tests/tunit/README.md b/third-party/curl/tests/tunit/README.md
new file mode 100644
index 0000000000..0dc29f024e
--- /dev/null
+++ b/third-party/curl/tests/tunit/README.md
@@ -0,0 +1,11 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+# Tool unit tests
+
+This directory is for unit testing of tool functions. They are separate from
+libcurl unit tests, because how these live/work outside of the library and the
+libcurl unit tests live/work *inside*.
diff --git a/third-party/curl/tests/tunit/tool1394.c b/third-party/curl/tests/tunit/tool1394.c
new file mode 100644
index 0000000000..8c29f2c375
--- /dev/null
+++ b/third-party/curl/tests/tunit/tool1394.c
@@ -0,0 +1,122 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "tool_getparam.h"
+
+static CURLcode test_tool1394(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  struct cert {
+    const char *param;
+    const char *cert;
+    const char *passwd;
+  };
+
+  static const struct cert values[] = {
+    /* -E parameter */        /* exp. cert name */  /* exp. passphrase */
+    {"foo:bar:baz",            "foo",                "bar:baz"},
+    {"foo\\:bar:baz",          "foo:bar",            "baz"},
+    {"foo\\\\:bar:baz",        "foo\\",              "bar:baz"},
+    {"foo:bar\\:baz",          "foo",                "bar\\:baz"},
+    {"foo:bar\\\\:baz",        "foo",                "bar\\\\:baz"},
+    {"foo\\bar\\baz",          "foo\\bar\\baz",      NULL},
+    {"foo\\\\bar\\\\baz",      "foo\\bar\\baz",      NULL},
+    {"foo\\",                  "foo\\",              NULL},
+    {"foo\\\\",                "foo\\",              NULL},
+    {"foo:bar\\",              "foo",                "bar\\"},
+    {"foo:bar\\\\",            "foo",                "bar\\\\"},
+    {"foo:bar:",               "foo",                "bar:"},
+    {"foo\\::bar\\:",          "foo:",               "bar\\:"},
+    {"pkcs11:foobar",          "pkcs11:foobar",      NULL},
+    {"PKCS11:foobar",          "PKCS11:foobar",      NULL},
+    {"PkCs11:foobar",          "PkCs11:foobar",      NULL},
+#ifdef _WIN32
+    {"c:\\foo:bar:baz",        "c:\\foo",            "bar:baz"},
+    {"c:\\foo\\:bar:baz",      "c:\\foo:bar",        "baz"},
+    {"c:\\foo\\\\:bar:baz",    "c:\\foo\\",          "bar:baz"},
+    {"c:\\foo:bar\\:baz",      "c:\\foo",            "bar\\:baz"},
+    {"c:\\foo:bar\\\\:baz",    "c:\\foo",            "bar\\\\:baz"},
+    {"c:\\foo\\bar\\baz",      "c:\\foo\\bar\\baz",  NULL},
+    {"c:\\foo\\\\bar\\\\baz",  "c:\\foo\\bar\\baz",  NULL},
+    {"c:\\foo\\",              "c:\\foo\\",          NULL},
+    {"c:\\foo\\\\",            "c:\\foo\\",          NULL},
+    {"c:\\foo:bar\\",          "c:\\foo",            "bar\\"},
+    {"c:\\foo:bar\\\\",        "c:\\foo",            "bar\\\\"},
+    {"c:\\foo:bar:",           "c:\\foo",            "bar:"},
+    {"c:\\foo\\::bar\\:",      "c:\\foo:",           "bar\\:"},
+#endif
+    {NULL, NULL, NULL}
+  };
+  const struct cert *p;
+  char *certname, *passphrase;
+  ParameterError err;
+  for(p = &values[0]; p->param; p++) {
+    err = parse_cert_parameter(p->param, &certname, &passphrase);
+    if(!err) {
+      if(certname) {
+        if(strcmp(p->cert, certname)) {
+          curl_mprintf("expected certname '%s' but got '%s' "
+                       "for -E param '%s'\n", p->cert, certname, p->param);
+          fail("assertion failure");
+        }
+      }
+      else {
+        curl_mprintf("expected certname '%s' but got NULL "
+                     "for -E param '%s'\n", p->cert, p->param);
+        fail("assertion failure");
+      }
+    }
+    else if(certname) {
+      curl_mprintf("expected certname NULL but got '%s' "
+                   "for -E param '%s'\n", certname, p->param);
+      fail("assertion failure");
+    }
+    if(p->passwd) {
+      if(passphrase) {
+        if(strcmp(p->passwd, passphrase)) {
+          curl_mprintf("expected passphrase '%s' but got '%s'"
+                       "for -E param '%s'\n", p->passwd, passphrase, p->param);
+          fail("assertion failure");
+        }
+      }
+      else {
+        curl_mprintf("expected passphrase '%s' but got NULL "
+                     "for -E param '%s'\n", p->passwd, p->param);
+        fail("assertion failure");
+      }
+    }
+    else if(passphrase) {
+      curl_mprintf("expected passphrase NULL but got '%s' "
+                   "for -E param '%s'\n", passphrase, p->param);
+      fail("assertion failure");
+    }
+    if(certname)
+      curlx_free(certname);
+    if(passphrase)
+      curlx_free(passphrase);
+  }
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/tunit/tool1604.c b/third-party/curl/tests/tunit/tool1604.c
new file mode 100644
index 0000000000..f16b0bfe0a
--- /dev/null
+++ b/third-party/curl/tests/tunit/tool1604.c
@@ -0,0 +1,232 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+
+#if defined(_WIN32) || defined(MSDOS)
+#include "tool_cfgable.h"
+#include "tool_doswin.h"
+
+static void getflagstr(char *buf, size_t len, int flags)
+{
+  curl_msnprintf(buf, len, "%s,%s",
+                 ((flags & SANITIZE_ALLOW_PATH) ?
+                  "SANITIZE_ALLOW_PATH" : ""),
+                 ((flags & SANITIZE_ALLOW_RESERVED) ?
+                  "SANITIZE_ALLOW_RESERVED" : ""));
+}
+
+static void getcurlcodestr(char *buf, size_t len, int cc)
+{
+  curl_msnprintf(buf, len, "%s (%d)",
+             (cc == SANITIZE_ERR_OK ? "SANITIZE_ERR_OK" :
+              cc == SANITIZE_ERR_BAD_ARGUMENT ? "SANITIZE_ERR_BAD_ARGUMENT" :
+              cc == SANITIZE_ERR_INVALID_PATH ? "SANITIZE_ERR_INVALID_PATH" :
+              cc == SANITIZE_ERR_OUT_OF_MEMORY ? "SANITIZE_ERR_OUT_OF_MEMORY" :
+              "unexpected error code - add name"), cc);
+}
+#endif
+
+static CURLcode test_tool1604(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+#if defined(_WIN32) || defined(MSDOS)
+  struct data {
+    const char *input;
+    int flags;
+    const char *expected_output;
+    SANITIZEcode expected_result;
+  };
+
+  /* START sanitize_file_name */
+  struct data data[] = {
+    { "", 0,
+      "", SANITIZE_ERR_OK
+    },
+    { "normal filename", 0,
+      "normal filename", SANITIZE_ERR_OK
+    },
+    { "control\tchar", 0,
+      "control_char", SANITIZE_ERR_OK
+    },
+    { "banned*char", 0,
+      "banned_char", SANITIZE_ERR_OK
+    },
+    { "f:foo", 0,
+      "f_foo", SANITIZE_ERR_OK
+    },
+    { "f:foo", SANITIZE_ALLOW_PATH,
+      "f:foo", SANITIZE_ERR_OK
+    },
+    { "f:\\foo", 0,
+      "f__foo", SANITIZE_ERR_OK
+    },
+    { "f:\\foo", SANITIZE_ALLOW_PATH,
+      "f:\\foo", SANITIZE_ERR_OK
+    },
+    { "f:/foo", 0,
+      "f__foo", SANITIZE_ERR_OK
+    },
+    { "f:/foo", SANITIZE_ALLOW_PATH,
+      "f:/foo", SANITIZE_ERR_OK
+    },
+#ifndef MSDOS
+    { "\\\\?\\C:\\foo", SANITIZE_ALLOW_PATH,
+      "\\\\?\\C:\\foo", SANITIZE_ERR_OK
+    },
+    { "\\\\?\\C:\\foo", 0,
+      "____C__foo", SANITIZE_ERR_OK
+    },
+#endif
+    { "foo:bar", 0,
+      "foo_bar", SANITIZE_ERR_OK
+    },
+    { "foo|<>/bar\\\":?*baz", 0,
+      "foo____bar_____baz", SANITIZE_ERR_OK
+    },
+    { "f:foo::$DATA", 0,
+      "f_foo__$DATA", SANITIZE_ERR_OK
+    },
+    { "con . air", 0,
+      "con _ air", SANITIZE_ERR_OK
+    },
+    { "con.air", 0,
+      "con_air", SANITIZE_ERR_OK
+    },
+    { "con:/x", 0,
+      "con__x", SANITIZE_ERR_OK
+    },
+    { "file . . . .  ..  .", 0,
+      "file", SANITIZE_ERR_OK
+    },
+    { "foo . . ? . . ", 0,
+      "foo . . _", SANITIZE_ERR_OK
+    },
+    { "com1", 0,
+      "_com1", SANITIZE_ERR_OK
+    },
+    { "com1", SANITIZE_ALLOW_RESERVED,
+      "com1", SANITIZE_ERR_OK
+    },
+    { "f:\\com1", 0,
+      "f__com1", SANITIZE_ERR_OK
+    },
+    { "f:\\com1", SANITIZE_ALLOW_PATH,
+      "f:\\_com1", SANITIZE_ERR_OK
+    },
+    { "f:\\com1", SANITIZE_ALLOW_RESERVED,
+      "f__com1", SANITIZE_ERR_OK
+    },
+    { "f:\\com1", SANITIZE_ALLOW_RESERVED | SANITIZE_ALLOW_PATH,
+      "f:\\com1", SANITIZE_ERR_OK
+    },
+    { "com1:\\com1", SANITIZE_ALLOW_PATH,
+      "_com1:\\_com1", SANITIZE_ERR_OK
+    },
+    { "com1:\\com1", SANITIZE_ALLOW_RESERVED | SANITIZE_ALLOW_PATH,
+      "com1:\\com1", SANITIZE_ERR_OK
+    },
+    { "com1:\\com1", SANITIZE_ALLOW_RESERVED,
+      "com1__com1", SANITIZE_ERR_OK
+    },
+#ifndef MSDOS
+    { "\\com1", SANITIZE_ALLOW_PATH,
+      "\\_com1", SANITIZE_ERR_OK
+    },
+    { "\\\\com1", SANITIZE_ALLOW_PATH,
+      "\\\\com1", SANITIZE_ERR_OK
+    },
+    { "\\\\?\\C:\\com1", SANITIZE_ALLOW_PATH,
+      "\\\\?\\C:\\com1", SANITIZE_ERR_OK
+    },
+#endif
+    { "CoM1", 0,
+      "_CoM1", SANITIZE_ERR_OK
+    },
+    { "CoM1", SANITIZE_ALLOW_RESERVED,
+      "CoM1", SANITIZE_ERR_OK
+    },
+    { "COM56", 0,
+      "COM56", SANITIZE_ERR_OK
+    },
+    { NULL, 0,
+      NULL, SANITIZE_ERR_BAD_ARGUMENT
+    },
+  };
+
+  size_t i;
+
+  for(i = 0; i < CURL_ARRAYSIZE(data); ++i) {
+    char *output = NULL;
+    char flagstr[256];
+    char receivedstr[256];
+    char expectedstr[256];
+    const char *flg = flagstr;
+    const char *rec = receivedstr;
+    const char *exp = expectedstr;
+    SANITIZEcode res;
+
+    res = sanitize_file_name(&output, data[i].input, data[i].flags);
+
+    if(res == data[i].expected_result &&
+       ((!output && !data[i].expected_output) ||
+        (output && data[i].expected_output &&
+         !strcmp(output, data[i].expected_output)))) { /* OK */
+      curlx_free(output);
+      continue;
+    }
+
+    getflagstr(flagstr, sizeof(flagstr), data[i].flags);
+    abort_unless(flg, "out of memory");
+    getcurlcodestr(receivedstr, sizeof(receivedstr), res);
+    abort_unless(rec, "out of memory");
+    getcurlcodestr(expectedstr, sizeof(expectedstr), data[i].expected_result);
+    abort_unless(exp, "out of memory");
+
+    unitfail++;
+    curl_mfprintf(stderr, "\n"
+                  "%s:%d sanitize_file_name failed.\n"
+                  "input: %s\n"
+                  "flags: %s\n"
+                  "output: %s\n"
+                  "result: %s\n"
+                  "expected output: %s\n"
+                  "expected result: %s\n",
+                  __FILE__, __LINE__,
+                  data[i].input,
+                  flagstr,
+                  output ? output : "(null)",
+                  receivedstr,
+                  data[i].expected_output ? data[i].expected_output : "(null)",
+                  expectedstr);
+
+    curlx_free(output);
+  }
+  /* END sanitize_file_name */
+#else
+  curl_mfprintf(stderr, "Skipped test not for this platform\n");
+#endif /* _WIN32 || MSDOS */
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/tunit/tool1621.c b/third-party/curl/tests/tunit/tool1621.c
new file mode 100644
index 0000000000..6965d14706
--- /dev/null
+++ b/third-party/curl/tests/tunit/tool1621.c
@@ -0,0 +1,84 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "tool_xattr.h"
+
+static CURLcode test_tool1621(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+#ifdef USE_XATTR  /* Required for stripcredentials() */
+
+  struct checkthis {
+    const char *input;
+    const char *output;
+  };
+
+  static const struct checkthis tests[] = {
+    { "ninja://foo@example.com", "(null)" },  /* unsupported scheme */
+#if defined(USE_SSL) && !defined(CURL_DISABLE_POP3)
+    { "pop3s://foo@example.com", "pop3s://example.com/" },
+#endif
+#ifndef CURL_DISABLE_LDAP
+    { "ldap://foo@example.com", "ldap://example.com/" },
+#endif
+#if defined(USE_SSL) && !defined(CURL_DISABLE_HTTP)
+    { "https://foo@example.com", "https://example.com/" },
+    { "https://localhost:45", "https://localhost:45/" },
+    { "https://foo@localhost:45", "https://localhost:45/" },
+    { "https://user:pass@localhost:45", "https://localhost:45/" },
+#endif
+#ifndef CURL_DISABLE_HTTP
+    { "http://daniel:password@localhost", "http://localhost/" },
+    { "http://daniel@localhost", "http://localhost/" },
+    { "http://localhost/", "http://localhost/" },
+    { "http://odd%40host/", "(null)" },  /* bad host */
+    { "http://user@odd%40host/", "(null)" },  /* bad host */
+    { "http://host/@path/", "http://host/@path/" },
+    { "http://emptypw:@host/", "http://host/" },
+    { "http://:emptyuser@host/", "http://host/" },
+    { "http://odd%40user@host/", "http://host/" },
+    { "http://only%40one%40host/", "(null)" },  /* bad host */
+    { "http://odder%3auser@host/", "http://host/" },
+#endif
+    { NULL, NULL } /* end marker */
+  };
+
+  int i;
+
+  for(i = 0; tests[i].input; i++) {
+    const char *url = tests[i].input;
+    char *stripped = stripcredentials(url);
+    const char *strippedstr = stripped ? stripped : "(null)";
+    curl_mprintf("Test %d got input \"%s\", output: \"%s\", "
+                 "expected: \"%s\"\n",
+                 i, tests[i].input, strippedstr, tests[i].output);
+
+    fail_if(strcmp(tests[i].output, strippedstr), tests[i].output);
+    curl_free(stripped);
+  }
+#endif
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/tunit/tool1622.c b/third-party/curl/tests/tunit/tool1622.c
new file mode 100644
index 0000000000..6844cf0ec5
--- /dev/null
+++ b/third-party/curl/tests/tunit/tool1622.c
@@ -0,0 +1,98 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "tool_progress.h"
+
+static CURLcode test_tool1622(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  char buffer[9];
+  curl_off_t secs;
+  int i;
+  static const curl_off_t check[] = {
+    /* bytes to check */
+    131072,
+    12645826,
+    1073741824,
+    12938588979,
+    1099445657078333,
+    0 /* end of list */
+  };
+  struct exactcase {
+    curl_off_t value;
+    const char *output;
+  };
+  static const struct exactcase timecases[] = {
+    { 0, "        " },
+    { 1, "00:00:01" },
+    { 524287, "  6d 01h" },
+    { 134217727, " 51m 23d" },
+    { 4294967295, "    136y" },
+    { 4398046511103, " >99999y" },
+    { 0, NULL }
+  };
+  static const struct exactcase datacases[] = {
+    { 0, "    0" },
+    { 99999, "99999" },
+    { 100000, "97.6k" },
+    { 131072, " 128k" },
+    { 12645826, "12.0M" },
+    { 1099445657078333, " 999T" },
+    { 0, NULL }
+  };
+
+  puts("timebuf");
+  for(i = 0, secs = 0; i < 63; i++) {
+    timebuf(buffer, sizeof(buffer), secs);
+    curl_mprintf("%20" FMT_OFF_T " - %s\n", secs, buffer);
+    fail_unless(strlen(buffer) == 8, "timebuf output width");
+    secs *= 2;
+    secs++;
+  }
+  puts("max5data");
+  for(i = 0, secs = 0; i < 63; i++) {
+    max5data(secs, buffer, sizeof(buffer));
+    curl_mprintf("%20" FMT_OFF_T " - %s\n", secs, buffer);
+    fail_unless(strlen(buffer) == 5, "max5data output width");
+    secs *= 2;
+    secs++;
+  }
+  for(i = 0; check[i]; i++) {
+    secs = check[i];
+    max5data(secs, buffer, sizeof(buffer));
+    curl_mprintf("%20" FMT_OFF_T " - %s\n", secs, buffer);
+    fail_unless(strlen(buffer) == 5, "max5data check output width");
+  }
+  for(i = 0; timecases[i].output; i++) {
+    timebuf(buffer, sizeof(buffer), timecases[i].value);
+    fail_unless(!strcmp(buffer, timecases[i].output), timecases[i].output);
+  }
+  for(i = 0; datacases[i].output; i++) {
+    max5data(datacases[i].value, buffer, sizeof(buffer));
+    fail_unless(!strcmp(buffer, datacases[i].output), datacases[i].output);
+  }
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/tunit/tool1623.c b/third-party/curl/tests/tunit/tool1623.c
new file mode 100644
index 0000000000..e15aab8904
--- /dev/null
+++ b/third-party/curl/tests/tunit/tool1623.c
@@ -0,0 +1,125 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "tool_getparam.h"
+
+struct check1623 {
+  const char *input;
+  curl_off_t amount;
+  ParameterError err;
+};
+
+static CURLcode test_tool1623(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  int i;
+  static const struct check1623 check[] = {
+    { "0", 0, PARAM_OK },
+    { "00", 0, PARAM_OK },
+    { "000", 0, PARAM_OK },
+    { "1", 1, PARAM_OK },
+    { "1b", 1, PARAM_OK },
+    { "99B", 99, PARAM_OK },
+    { "2", 2, PARAM_OK },
+    { "3", 3, PARAM_OK },
+    { "4", 4, PARAM_OK },
+    { "5", 5, PARAM_OK },
+    { "6", 6, PARAM_OK },
+    { "7", 7, PARAM_OK },
+    { "77", 77, PARAM_OK },
+    { "8", 8, PARAM_OK },
+    { "9", 9, PARAM_OK },
+    { "10", 10, PARAM_OK },
+    { "010", 10, PARAM_OK },
+    { "000000000000000000000000000000000010", 10, PARAM_OK },
+    { "1k", 1024, PARAM_OK },
+    { "2K", 2048, PARAM_OK },
+    { "3k", 3072, PARAM_OK },
+    { "4K", 4096, PARAM_OK },
+    { "5k", 5120, PARAM_OK },
+    { "6K", 6144, PARAM_OK },
+    { "7k", 7168, PARAM_OK },
+    { "8K", 8192, PARAM_OK },
+    { "9k", 9216, PARAM_OK },
+    { "10K", 10240, PARAM_OK },
+    { "20M", 20971520, PARAM_OK },
+    { "30G", 32212254720, PARAM_OK },
+    { "40T", 43980465111040, PARAM_OK },
+    { "50P", 56294995342131200, PARAM_OK },
+    { "1.1k", 1126, PARAM_OK },
+    { "1.01k", 1034, PARAM_OK },
+    { "1.001k", 1025, PARAM_OK },
+    { "1.0001k", 1024, PARAM_OK },
+    { "22.1m", 23173529, PARAM_OK },
+    { "22.01m", 23079157, PARAM_OK },
+    { "22.001m", 23069720, PARAM_OK },
+    { "22.0001m", 23068776, PARAM_OK },
+    { "22.00001m", 23068682, PARAM_OK },
+    { "22.000001m", 23068673, PARAM_OK },
+    { "22.0000001m", 23068672, PARAM_OK },
+    { "22.000000001m", 23068672, PARAM_OK },
+    { "3.4", 0, PARAM_BAD_USE },
+    { "3.14b", 0, PARAM_BAD_USE },
+    { "5000.9P", 5630512844129278361, PARAM_OK },
+    { "5000.99P", 5630614175120894197, PARAM_OK },
+    { "5000.999P", 5630624308220055781, PARAM_OK },
+    { "5000.9999P", 5630625321529969316, PARAM_OK },
+    { "8191P", 9222246136947933184, PARAM_OK },
+    { "8191.9999999P", 9223372036735343194, PARAM_OK },
+    { "8192P", 0, PARAM_NUMBER_TOO_LARGE },
+    { "9223372036854775807", 9223372036854775807, PARAM_OK },
+    { "9223372036854775808", 0, PARAM_NUMBER_TOO_LARGE },
+    { "a", 0, PARAM_BAD_NUMERIC },
+    { "-2", 0, PARAM_BAD_NUMERIC },
+    { "+2", 0, PARAM_BAD_NUMERIC },
+    { "2,2k", 0, PARAM_BAD_USE },
+    { NULL, 0, PARAM_OK } /* end of list */
+  };
+
+  for(i = 0; check[i].input; i++) {
+    bool ok = FALSE;
+    curl_off_t output = 0;
+    ParameterError err = GetSizeParameter(check[i].input, &output);
+    if(err != check[i].err)
+      curl_mprintf("'%s' unexpectedly returned %d \n",
+                   check[i].input, (int)err);
+    else if(check[i].amount != output)
+      curl_mprintf("'%s' unexpectedly gave %" FMT_OFF_T "\n",
+                   check[i].input, output);
+    else {
+#if 0 /* enable for debugging */
+      if(err)
+        curl_mprintf("'%s' returned %d\n", check[i].input, (int)err);
+      else
+        curl_mprintf("'%s' == %" FMT_OFF_T "\n", check[i].input, output);
+#endif
+      ok = TRUE;
+    }
+    if(!ok)
+      unitfail++;
+  }
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/tunit/tool1720.c b/third-party/curl/tests/tunit/tool1720.c
new file mode 100644
index 0000000000..80e3c157ba
--- /dev/null
+++ b/third-party/curl/tests/tunit/tool1720.c
@@ -0,0 +1,79 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "tool_dirhie.h"
+
+static CURLcode test_tool1720(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  static const char *check[] = {
+    "",
+    "(null)",
+    "filename",
+    "(null)",
+    "foo/bar/",
+    "foo|foo/bar|",
+    "foo/bar/filename",
+    "foo|foo/bar|",
+    "/foo/bar/filename",
+    "/foo|/foo/bar|",
+#if defined(_WIN32) || defined(MSDOS)
+    "C:/foo/bar/filename",
+    "C:/foo|C:/foo/bar|",
+    "C:foo/bar/filename",
+    "C:foo|C:foo/bar|",
+    "foo\\bar\\filename",
+    "foo|foo\\bar|",
+    "\\foo\\bar\\filename",
+    "\\foo|\\foo\\bar|",
+    "C:\\foo\\bar\\filename",
+    "C:\\foo|C:\\foo\\bar|",
+    "C:foo\\bar\\filename",
+    "C:foo|C:foo\\bar|",
+#endif
+  };
+
+  size_t i;
+  struct dynbuf *res = create_dir_hierarchy_trace_dynres();
+
+  curlx_dyn_init(res, 256);
+
+  for(i = 0; i < CURL_ARRAYSIZE(check); i += 2) {
+    const char *actual;
+    curlx_dyn_reset(res);
+    create_dir_hierarchy(check[i]);
+    actual = curlx_dyn_ptr(res);
+    if(!actual)
+      actual = "(null)";
+    if(strcmp(check[i + 1], actual)) {
+      curl_mprintf("Expected '%s' got '%s'\n", check[i + 1], actual);
+      unitfail++;
+    }
+  }
+
+  curlx_dyn_free(res);
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/.gitignore b/third-party/curl/tests/unit/.gitignore
index 8f0bb90bdf..bae3c1a760 100644
--- a/third-party/curl/tests/unit/.gitignore
+++ b/third-party/curl/tests/unit/.gitignore
@@ -2,4 +2,5 @@
 #
 # SPDX-License-Identifier: curl
 
-/unit[0-9][0-9][0-9][0-9]
+units
+units.c
diff --git a/third-party/curl/tests/unit/CMakeLists.txt b/third-party/curl/tests/unit/CMakeLists.txt
index 9ca9a97cc9..46710ce1ea 100644
--- a/third-party/curl/tests/unit/CMakeLists.txt
+++ b/third-party/curl/tests/unit/CMakeLists.txt
@@ -22,21 +22,40 @@
 #
 ###########################################################################
 
-transform_makefile_inc("Makefile.inc" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
-include(${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake)
+# Get BUNDLE, FIRST_C, TESTS_C variables
+curl_transform_makefile_inc("Makefile.inc" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
+include("${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake")
 
-include_directories(
-  ${CURL_SOURCE_DIR}/lib          # To be able to reach "curl_setup_once.h"
-  ${CURL_SOURCE_DIR}/tests/libtest
-  ${CURL_SOURCE_DIR}/src
-  ${CURL_BINARY_DIR}/lib          # To be able to reach "curl_config.h"
-  ${CURL_BINARY_DIR}/include      # To be able to reach "curl/curl.h"
-)
-
-if (ENABLE_CURLDEBUG) # running unittests require curl to compiled with CURLDEBUG
-  foreach(_testfile ${UNITPROGS})
-    add_executable(${_testfile} EXCLUDE_FROM_ALL ${_testfile}.c ${UNITFILES})
-    add_dependencies(testdeps ${_testfile})
-    target_link_libraries(${_testfile} curltool curlu)
-  endforeach()
+if(_CURL_TESTS_CONCAT)
+  set(_mk_unity_extra "--concat" "-I${CMAKE_CURRENT_SOURCE_DIR}" "-I${PROJECT_SOURCE_DIR}/tests/libtest")
+endif()
+
+add_custom_command(OUTPUT "${BUNDLE}.c"
+  COMMAND ${PERL_EXECUTABLE} "${PROJECT_SOURCE_DIR}/scripts/mk-unity.pl" ${_mk_unity_extra}
+    --test ${TESTS_C} > "${BUNDLE}.c"
+  DEPENDS
+    "${PROJECT_SOURCE_DIR}/scripts/mk-unity.pl" "${CMAKE_CURRENT_SOURCE_DIR}/Makefile.inc"
+    ${FIRST_C} ${FIRST_H} ${TESTS_C}
+  VERBATIM)
+
+add_executable(${BUNDLE} EXCLUDE_FROM_ALL "${BUNDLE}.c")
+add_dependencies(${BUNDLE} curlu-unitprotos)
+add_dependencies(tt ${BUNDLE})
+target_link_libraries(${BUNDLE} curlu)
+target_include_directories(${BUNDLE} PRIVATE
+  "${PROJECT_BINARY_DIR}/lib"            # for "curl_config.h", "unitprotos.h"
+  "${PROJECT_SOURCE_DIR}/lib"            # for "curl_setup.h", curlx
+  "${PROJECT_SOURCE_DIR}/tests/libtest"  # for "first.h", "unitcheck.h"
+  "${CMAKE_CURRENT_SOURCE_DIR}"          # for the generated bundle source to find included test sources
+)
+# unit tests are small pretend-libcurl-programs, pass BUILDING_LIBCURL to reflect that
+target_compile_definitions(${BUNDLE} PRIVATE ${CURL_DEBUG_MACROS} "BUILDING_LIBCURL")
+set_target_properties(${BUNDLE} PROPERTIES OUTPUT_NAME "${BUNDLE}" PROJECT_LABEL "Test ${BUNDLE}" UNITY_BUILD OFF)
+
+if(NOT _CURL_TESTS_CONCAT)
+  set_target_properties(${BUNDLE} PROPERTIES C_CLANG_TIDY "")
+  curl_add_clang_tidy_test_target("${BUNDLE}-clang-tidy" ${BUNDLE} ${FIRST_C} ${TESTS_C})
+  if(TARGET "${BUNDLE}-clang-tidy")
+    add_dependencies("${BUNDLE}-clang-tidy" curlu-unitprotos)
+  endif()
 endif()
diff --git a/third-party/curl/tests/unit/Makefile.am b/third-party/curl/tests/unit/Makefile.am
index dc10b890e7..34fbbf8f5f 100644
--- a/third-party/curl/tests/unit/Makefile.am
+++ b/third-party/curl/tests/unit/Makefile.am
@@ -31,25 +31,44 @@ AUTOMAKE_OPTIONS = foreign nostdinc
 # $(top_srcdir)/include is for libcurl's external include files
 # $(top_builddir)/lib is for libcurl's generated lib/curl_config.h file
 # $(top_srcdir)/lib for libcurl's lib/curl_setup.h and other "borrowed" files
+# $(srcdir) for the generated bundle source to find included test sources
 
 AM_CPPFLAGS = -I$(top_srcdir)/include        \
               -I$(top_builddir)/lib          \
               -I$(top_srcdir)/lib            \
-              -I$(top_srcdir)/src            \
-              -I$(top_srcdir)/tests/libtest
+              -I$(top_srcdir)/tests/libtest  \
+              -I$(srcdir)
 
-EXTRA_DIST = Makefile.inc CMakeLists.txt README.md
+# Get BUNDLE, FIRST_C, TESTS_C variables
+include Makefile.inc
+
+EXTRA_DIST = CMakeLists.txt README.md $(TESTS_C)
 
 CFLAGS += @CURL_CFLAG_EXTRAS@
 
 # Prevent LIBS from being used for all link targets
 LIBS = $(BLANK_AT_MAKETIME)
 
-LDADD = $(top_builddir)/src/libcurltool.la   \
-        $(top_builddir)/lib/libcurlu.la      \
-        @LDFLAGS@ @LIBCURL_LIBS@
-
 AM_CPPFLAGS += -DCURL_STATICLIB -DUNITTESTS
+if DEBUGBUILD
+AM_CPPFLAGS += -DDEBUGBUILD
+endif
+# unit tests are small pretend-libcurl-programs, pass BUILDING_LIBCURL to reflect that
+AM_CPPFLAGS += -DBUILDING_LIBCURL
+
+if BUILD_UNITTESTS
+$(BUNDLE).c: $(top_srcdir)/scripts/mk-unity.pl Makefile.inc $(FIRST_C) $(TESTS_C) $(top_builddir)/lib/unitprotos.h
+	@PERL@ $(top_srcdir)/scripts/mk-unity.pl --test $(TESTS_C) > $(BUNDLE).c
+
+$(top_builddir)/lib/unitprotos.h:
+	(cd $(top_builddir)/lib && $(MAKE) unitprotos.h)
+
+noinst_PROGRAMS = $(BUNDLE)
+LDADD = $(top_builddir)/lib/libcurlu.la
+CLEANFILES = $(BUNDLE).c
+else
+noinst_PROGRAMS =
+endif
 
 CHECKSRC = $(CS_$(V))
 CS_0 = @echo "  RUN     " $@;
@@ -57,13 +76,11 @@ CS_1 =
 CS_ = $(CS_0)
 
 checksrc:
-	$(CHECKSRC)@PERL@ $(top_srcdir)/scripts/checksrc.pl $(srcdir)/*.[ch]
+	$(CHECKSRC)(@PERL@ $(top_srcdir)/scripts/checksrc.pl -D$(srcdir) -W$(srcdir)/$(BUNDLE).c $(TESTS_C))
 
-# Makefile.inc provides neat definitions
-include Makefile.inc
-
-if BUILD_UNITTESTS
-noinst_PROGRAMS = $(UNITPROGS)
-else
-noinst_PROGRAMS =
+if NOT_CURL_CI
+all-local: checksrc
 endif
+
+clean-local:
+	rm -f $(BUNDLE)
diff --git a/third-party/curl/tests/unit/Makefile.inc b/third-party/curl/tests/unit/Makefile.inc
index 36e922b2a2..18d97b051c 100644
--- a/third-party/curl/tests/unit/Makefile.inc
+++ b/third-party/curl/tests/unit/Makefile.inc
@@ -21,112 +21,31 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+# Shared between CMakeLists.txt and Makefile.am
 
-# these files are used in every single unit test program
+BUNDLE = units
 
-UNITFILES = curlcheck.h \
- ../libtest/test.h \
- ../libtest/first.c
+# Files referenced from the bundle source
+FIRST_C = ../libtest/first.c
 
-# These are all unit test programs
-UNITPROGS = unit1300          unit1302 unit1303 unit1304 unit1305 unit1307 \
- unit1308 unit1309 unit1323 \
- unit1330 unit1394 unit1395 unit1396 unit1397 unit1398 \
- unit1399 \
- unit1600 unit1601 unit1602 unit1603 unit1604 unit1605 unit1606 unit1607 \
- unit1608 unit1609 unit1610 unit1611 unit1612 unit1614 \
- unit1620 unit1621 \
- unit1650 unit1651 unit1652 unit1653 unit1654 unit1655 \
- unit1660 unit1661 \
- unit2600 unit2601 unit2602 unit2603 \
- unit3200
-
-unit1300_SOURCES = unit1300.c $(UNITFILES)
-
-unit1302_SOURCES = unit1302.c $(UNITFILES)
-
-unit1303_SOURCES = unit1303.c $(UNITFILES)
-
-unit1304_SOURCES = unit1304.c $(UNITFILES)
-
-unit1305_SOURCES = unit1305.c $(UNITFILES)
-
-unit1307_SOURCES = unit1307.c $(UNITFILES)
-
-unit1308_SOURCES = unit1308.c $(UNITFILES)
-
-unit1309_SOURCES = unit1309.c $(UNITFILES)
-
-unit1323_SOURCES = unit1323.c $(UNITFILES)
-
-unit1330_SOURCES = unit1330.c $(UNITFILES)
-
-unit1394_SOURCES = unit1394.c $(UNITFILES)
-
-unit1395_SOURCES = unit1395.c $(UNITFILES)
-
-unit1396_SOURCES = unit1396.c $(UNITFILES)
-
-unit1397_SOURCES = unit1397.c $(UNITFILES)
-
-unit1398_SOURCES = unit1398.c $(UNITFILES)
-
-unit1399_SOURCES = unit1399.c $(UNITFILES)
-
-unit1600_SOURCES = unit1600.c $(UNITFILES)
-
-unit1601_SOURCES = unit1601.c $(UNITFILES)
-
-unit1602_SOURCES = unit1602.c $(UNITFILES)
-
-unit1603_SOURCES = unit1603.c $(UNITFILES)
-
-unit1604_SOURCES = unit1604.c $(UNITFILES)
-
-unit1605_SOURCES = unit1605.c $(UNITFILES)
-
-unit1606_SOURCES = unit1606.c $(UNITFILES)
-
-unit1607_SOURCES = unit1607.c $(UNITFILES)
-
-unit1608_SOURCES = unit1608.c $(UNITFILES)
-
-unit1609_SOURCES = unit1609.c $(UNITFILES)
-
-unit1610_SOURCES = unit1610.c $(UNITFILES)
-
-unit1611_SOURCES = unit1611.c $(UNITFILES)
-
-unit1612_SOURCES = unit1612.c $(UNITFILES)
-
-unit1614_SOURCES = unit1614.c $(UNITFILES)
-
-unit1620_SOURCES = unit1620.c $(UNITFILES)
-
-unit1621_SOURCES = unit1621.c $(UNITFILES)
-
-unit1650_SOURCES = unit1650.c $(UNITFILES)
-
-unit1651_SOURCES = unit1651.c $(UNITFILES)
-
-unit1652_SOURCES = unit1652.c $(UNITFILES)
-
-unit1653_SOURCES = unit1653.c $(UNITFILES)
-
-unit1654_SOURCES = unit1654.c $(UNITFILES)
-
-unit1655_SOURCES = unit1655.c $(UNITFILES)
-
-unit1660_SOURCES = unit1660.c $(UNITFILES)
-
-unit1661_SOURCES = unit1661.c $(UNITFILES)
-
-unit2600_SOURCES = unit2600.c $(UNITFILES)
-
-unit2601_SOURCES = unit2601.c $(UNITFILES)
-
-unit2602_SOURCES = unit2602.c $(UNITFILES)
-
-unit2603_SOURCES = unit2603.c $(UNITFILES)
-
-unit3200_SOURCES = unit3200.c $(UNITFILES)
+# All unit test programs
+TESTS_C = \
+  unit1300.c            unit1302.c unit1303.c unit1304.c unit1305.c \
+  unit1307.c            unit1309.c \
+  unit1323.c unit1330.c \
+  unit1395.c unit1396.c unit1397.c unit1398.c unit1399.c \
+  unit1600.c unit1601.c unit1602.c unit1603.c            unit1605.c unit1606.c \
+  unit1607.c unit1608.c unit1609.c unit1610.c unit1611.c unit1612.c unit1614.c \
+  unit1615.c unit1616.c                                  unit1620.c \
+  unit1625.c unit1626.c unit1627.c \
+  unit1636.c \
+  unit1650.c unit1651.c unit1652.c unit1653.c unit1654.c unit1655.c unit1656.c \
+  unit1657.c unit1658.c            unit1660.c unit1661.c unit1663.c unit1664.c \
+             unit1666.c unit1667.c unit1668.c unit1669.c \
+  unit1674.c unit1675.c unit1676.c \
+  unit1979.c unit1980.c \
+  unit2413.c \
+  unit2600.c unit2601.c unit2602.c unit2603.c unit2604.c unit2605.c \
+  unit3200.c                                             unit3205.c \
+  unit3211.c unit3212.c unit3213.c unit3214.c            unit3216.c unit3219.c \
+  unit3300.c unit3301.c unit3302.c unit3303.c unit3304.c unit3400.c
diff --git a/third-party/curl/tests/unit/README.md b/third-party/curl/tests/unit/README.md
index f111190050..28908a7a15 100644
--- a/third-party/curl/tests/unit/README.md
+++ b/third-party/curl/tests/unit/README.md
@@ -12,9 +12,9 @@ big and complicated, we should split them into smaller and testable ones.
 ## Build Unit Tests
 
 `./configure --enable-debug` is required for the unit tests to build. To
-enable unit tests, there will be a separate static libcurl built that will be
-used exclusively for linking unit test programs. Just build everything as
-normal, and then you can run the unit test cases as well.
+enable unit tests, there is a separate static libcurl built that is used
+exclusively for linking unit test programs. Build everything as normal, and
+then you can run the unit test cases as well.
 
 ## Run Unit Tests
 
@@ -25,8 +25,8 @@ can `cd tests` and `make` and then invoke individual unit tests with
 
 ## Debug Unit Tests
 
-If a specific test fails you will get told. The test case then has output left
-in the %LOGDIR subdirectory, but most importantly you can re-run the test again
+If a specific test fails you get told. The test case then has output left in
+the %LOGDIR subdirectory, but most importantly you can re-run the test again
 using gdb by doing `./runtests.pl -g NNNN`. That is, add a `-g` to make it
 start up gdb and run the same case using that.
 
@@ -37,7 +37,7 @@ source file. The source file should be named `unitNNNN.c` where `NNNN` is a
 previously unused number.
 
 Add your test to `tests/unit/Makefile.inc` (if it is a unit test). Add your
-test data file name to `tests/data/Makefile.inc`
+test data filename to `tests/data/Makefile.am`
 
 You also need a separate file called `tests/data/testNNNN` (using the same
 number) that describes your test case. See the test1300 file for inspiration
@@ -45,29 +45,85 @@ and the `tests/FILEFORMAT.md` documentation.
 
 For the actual C file, here's a simple example:
 ~~~c
+    #include "unitcheck.h"
 
-    #include "curlcheck.h"
+    #include "a libcurl header.h" /* from the lib directory */
 
-    #include "a libcurl header.h" /* from the lib dir */
+    static CURLcode test_unit9998(const char *arg)
+    {
+      UNITTEST_BEGIN_SIMPLE
 
-    static CURLcode unit_setup( void )
+      /* here you start doing things and checking that the results are good */
+
+      fail_unless(size == 0, "initial size should be zero");
+      fail_if(!head, "head should not be initiated to NULL");
+
+      /* you end the test code like this: */
+
+      UNITTEST_END_SIMPLE
+    }
+~~~
+
+Here's an example using optional initialization and cleanup:
+~~~c
+    #include "unitcheck.h"
+
+    #include "a libcurl header.h" /* from the lib directory */
+
+    static CURLcode t9999_setup(void)
     {
       /* whatever you want done first */
       return CURLE_OK;
     }
 
-    static void unit_stop( void )
+    static void t9999_stop(void)
     {
       /* done before shutting down and exiting */
     }
 
-    UNITTEST_START
+    static CURLcode test_unit9999(const char *arg)
+    {
+      UNITTEST_BEGIN(t9999_setup())
 
       /* here you start doing things and checking that the results are good */
 
-      fail_unless( size == 0 , "initial size should be zero" );
-      fail_if( head == NULL , "head should not be initiated to NULL" );
+      fail_unless(size == 0, "initial size should be zero");
+      fail_if(!head, "head should not be initiated to NULL");
 
       /* you end the test code like this: */
 
-    UNITTEST_STOP
+      UNITTEST_END(t9999_stop())
+    }
+~~~
+
+## Testing static functions
+
+Lots of internal functions are made static, and they *should* be static if
+they are private within a single source file.
+
+The curl build system provides a way to write unit tests that let us properly
+test these functions while keeping them static in release builds.
+
+A function that is static in the build but should be provided for unit testing
+needs to replace its `static` keyword with `UNITTEST` and it needs to have a
+prototype provided immediately above it.
+
+An example `add_two_integers()` function for unit testing:
+
+~~~c
+
+    UNITTEST int add_two_integers(int a, int b);
+    UNITTEST int add_two_integers(int a, int b)
+    {
+      return a + b;
+    }
+
+~~~
+
+Since the function is static and is private for this source file, it should
+not have its prototype in any header file.
+
+When building unit tests, the build system automatically generates the
+`lib/unitprotos.h` header file with all the prototypes for `UNITTEST`
+functions provided in any libcurl C source code files. (This is done by the
+`scripts/extract-unit-protos` script.)
diff --git a/third-party/curl/tests/unit/curlcheck.h b/third-party/curl/tests/unit/curlcheck.h
deleted file mode 100644
index 7c0ac4fb1d..0000000000
--- a/third-party/curl/tests/unit/curlcheck.h
+++ /dev/null
@@ -1,113 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "test.h"
-
-/* The fail macros mark the current test step as failed, and continue */
-#define fail_if(expr, msg)                                \
-  do {                                                    \
-    if(expr) {                                            \
-      fprintf(stderr, "%s:%d Assertion '%s' met: %s\n",   \
-              __FILE__, __LINE__, #expr, msg);            \
-      unitfail++;                                         \
-    }                                                     \
-  } while(0)
-
-#define fail_unless(expr, msg)                             \
-  do {                                                     \
-    if(!(expr)) {                                          \
-      fprintf(stderr, "%s:%d Assertion '%s' failed: %s\n", \
-              __FILE__, __LINE__, #expr, msg);             \
-      unitfail++;                                          \
-    }                                                      \
-  } while(0)
-
-#define verify_memory(dynamic, check, len)                              \
-  do {                                                                  \
-    if(dynamic && memcmp(dynamic, check, len)) {                             \
-      fprintf(stderr, "%s:%d Memory buffer mismatch size %d. '%s' is not\n", \
-              __FILE__, __LINE__, len,                                  \
-              hexdump((const unsigned char *)check, len));              \
-      fprintf(stderr, "%s:%d the same as '%s'\n", __FILE__, __LINE__,   \
-              hexdump((const unsigned char *)dynamic, len));            \
-      unitfail++;                                                       \
-    }                                                                   \
-  } while(0)
-
-/* fail() is for when the test case figured out by itself that a check
-   proved a failure */
-#define fail(msg) do {                                                 \
-    fprintf(stderr, "%s:%d test failed: '%s'\n",                       \
-            __FILE__, __LINE__, msg);                                  \
-    unitfail++;                                                        \
-  } while(0)
-
-
-/* The abort macros mark the current test step as failed, and exit the test */
-#define abort_if(expr, msg)                                     \
-  do {                                                          \
-    if(expr) {                                                  \
-      fprintf(stderr, "%s:%d Abort assertion '%s' met: %s\n",   \
-              __FILE__, __LINE__, #expr, msg);                  \
-      unitfail++;                                               \
-      goto unit_test_abort;                                     \
-    }                                                           \
-  } while(0)
-
-#define abort_unless(expr, msg)                                         \
-  do {                                                                  \
-    if(!(expr)) {                                                       \
-      fprintf(stderr, "%s:%d Abort assertion '%s' failed: %s\n",        \
-              __FILE__, __LINE__, #expr, msg);                          \
-      unitfail++;                                                       \
-      goto unit_test_abort;                                             \
-    }                                                                   \
-  } while(0)
-
-#define abort_test(msg)                                       \
-  do {                                                        \
-    fprintf(stderr, "%s:%d test aborted: '%s'\n",             \
-            __FILE__, __LINE__, msg);                         \
-    unitfail++;                                               \
-    goto unit_test_abort;                                     \
-  } while(0)
-
-
-extern int unitfail;
-
-#define UNITTEST_START                          \
-  int test(char *arg)                           \
-  {                                             \
-    (void)arg;                                  \
-    if(unit_setup()) {                          \
-      fail("unit_setup() failure");             \
-    }                                           \
-    else {
-
-#define UNITTEST_STOP                           \
-    goto unit_test_abort; /* avoid warning */   \
-unit_test_abort:                                \
-    unit_stop();                                \
-  }                                             \
-  return unitfail;                              \
-  }
diff --git a/third-party/curl/tests/unit/unit1300.c b/third-party/curl/tests/unit/unit1300.c
index acbf89b90e..7f0ec0d0c7 100644
--- a/third-party/curl/tests/unit/unit1300.c
+++ b/third-party/curl/tests/unit/unit1300.c
@@ -21,14 +21,9 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "llist.h"
 
-static struct Curl_llist llist;
-
-static struct Curl_llist llist_destination;
-
 static void test_Curl_llist_dtor(void *key, void *value)
 {
   /* used by the llist API, does nothing here */
@@ -36,68 +31,67 @@ static void test_Curl_llist_dtor(void *key, void *value)
   (void)value;
 }
 
-static CURLcode unit_setup(void)
+static CURLcode test_unit1300(const char *arg)
 {
-  Curl_llist_init(&llist, test_Curl_llist_dtor);
-  Curl_llist_init(&llist_destination, test_Curl_llist_dtor);
-  return CURLE_OK;
-}
+  UNITTEST_BEGIN_SIMPLE
 
-static void unit_stop(void)
-{
-}
+  struct Curl_llist llist;
+  struct Curl_llist llist_destination;
 
-UNITTEST_START
-{
   int unusedData_case1 = 1;
   int unusedData_case2 = 2;
   int unusedData_case3 = 3;
-  struct Curl_llist_element case1_list;
-  struct Curl_llist_element case2_list;
-  struct Curl_llist_element case3_list;
-  struct Curl_llist_element case4_list;
-  struct Curl_llist_element *head;
-  struct Curl_llist_element *element_next;
-  struct Curl_llist_element *element_prev;
-  struct Curl_llist_element *to_remove;
-  size_t llist_size = Curl_llist_count(&llist);
+  struct Curl_llist_node case1_list;
+  struct Curl_llist_node case2_list;
+  struct Curl_llist_node case3_list;
+  struct Curl_llist_node case4_list;
+  struct Curl_llist_node *head;
+  struct Curl_llist_node *element_next;
+  struct Curl_llist_node *element_prev;
+  struct Curl_llist_node *to_remove;
+  size_t llist_size;
+
+  Curl_llist_init(&llist, test_Curl_llist_dtor);
+  Curl_llist_init(&llist_destination, test_Curl_llist_dtor);
 
   /**
    * testing llist_init
    * case 1:
    * list initiation
    * @assumptions:
-   * 1: list size will be 0
-   * 2: list head will be NULL
-   * 3: list tail will be NULL
-   * 4: list dtor will be NULL
-  */
+   * 1: list size is 0
+   * 2: list head is NULL
+   * 3: list tail is NULL
+   * 4: list dtor is NULL
+   */
 
-  fail_unless(llist.size == 0, "list initial size should be zero");
-  fail_unless(llist.head == NULL, "list head should initiate to NULL");
-  fail_unless(llist.tail == NULL, "list tail should intiate to NULL");
-  fail_unless(llist.dtor == test_Curl_llist_dtor,
-               "list dtor should initiate to test_Curl_llist_dtor");
+  fail_unless(Curl_llist_count(&llist) == 0,
+              "list initial size should be zero");
+  fail_unless(!Curl_llist_head(&llist),
+              "list head should initiate to NULL");
+  fail_unless(!llist_tail(&llist),
+              "list tail should initiate to NULL");
 
   /**
    * testing Curl_llist_insert_next
    * case 1:
    * list is empty
    * @assumptions:
-   * 1: list size will be 1
-   * 2: list head will hold the data "unusedData_case1"
-   * 3: list tail will be the same as list head
+   * 1: list size is 1
+   * 2: list head holds the data "unusedData_case1"
+   * 3: list tail is the same as list head
    */
 
-  Curl_llist_insert_next(&llist, llist.head, &unusedData_case1, &case1_list);
+  Curl_llist_insert_next(&llist, Curl_llist_head(&llist), &unusedData_case1,
+                         &case1_list);
 
   fail_unless(Curl_llist_count(&llist) == 1,
               "List size should be 1 after adding a new element");
   /* test that the list head data holds my unusedData */
-  fail_unless(llist.head->ptr == &unusedData_case1,
+  fail_unless(Curl_node_elem(Curl_llist_head(&llist)) == &unusedData_case1,
               "head ptr should be first entry");
   /* same goes for the list tail */
-  fail_unless(llist.tail == llist.head,
+  fail_unless(llist_tail(&llist) == Curl_llist_head(&llist),
               "tail and head should be the same");
 
   /**
@@ -109,11 +103,12 @@ UNITTEST_START
    * 2: the list tail should be our newly created element
    */
 
-  Curl_llist_insert_next(&llist, llist.head,
+  Curl_llist_insert_next(&llist, Curl_llist_head(&llist),
                          &unusedData_case3, &case3_list);
-  fail_unless(llist.head->next->ptr == &unusedData_case3,
+  fail_unless(Curl_node_elem(Curl_node_next(Curl_llist_head(&llist))) ==
+                &unusedData_case3,
               "the node next to head is not getting set correctly");
-  fail_unless(llist.tail->ptr == &unusedData_case3,
+  fail_unless(Curl_node_elem(llist_tail(&llist)) == &unusedData_case3,
               "the list tail is not getting set correctly");
 
   /**
@@ -125,38 +120,39 @@ UNITTEST_START
    * 2: the list tail should different from newly created element
    */
 
-  Curl_llist_insert_next(&llist, llist.head,
+  Curl_llist_insert_next(&llist, Curl_llist_head(&llist),
                          &unusedData_case2, &case2_list);
-  fail_unless(llist.head->next->ptr == &unusedData_case2,
+  fail_unless(Curl_node_elem(Curl_node_next(Curl_llist_head(&llist))) ==
+                &unusedData_case2,
               "the node next to head is not getting set correctly");
-  /* better safe than sorry, check that the tail isn't corrupted */
-  fail_unless(llist.tail->ptr != &unusedData_case2,
+  /* better safe than sorry, check that the tail is not corrupted */
+  fail_unless(Curl_node_elem(llist_tail(&llist)) != &unusedData_case2,
               "the list tail is not getting set correctly");
 
-  /* unit tests for Curl_llist_remove */
+  /* unit tests for Curl_node_remove */
 
   /**
    * case 1:
    * list has >1 element, removing head
    * @assumptions:
-   * 1: list size will be decremented by one
-   * 2: head will be the head->next
-   * 3: "new" head's previous will be NULL
+   * 1: list size is decremented by one
+   * 2: head is head->next
+   * 3: "new" head's previous is NULL
    */
 
-  head = llist.head;
+  head = Curl_llist_head(&llist);
   abort_unless(head, "llist.head is NULL");
-  element_next = head->next;
+  element_next = Curl_node_next(head);
   llist_size = Curl_llist_count(&llist);
 
-  Curl_llist_remove(&llist, llist.head, NULL);
+  Curl_node_remove(Curl_llist_head(&llist));
 
-  fail_unless(Curl_llist_count(&llist) ==  (llist_size-1),
-               "llist size not decremented as expected");
-  fail_unless(llist.head == element_next,
-               "llist new head not modified properly");
-  abort_unless(llist.head, "llist.head is NULL");
-  fail_unless(llist.head->prev == NULL,
+  fail_unless(Curl_llist_count(&llist) == (llist_size - 1),
+              "llist size not decremented as expected");
+  fail_unless(Curl_llist_head(&llist) == element_next,
+              "llist new head not modified properly");
+  abort_unless(Curl_llist_head(&llist), "llist.head is NULL");
+  fail_unless(!llist_node_prev(Curl_llist_head(&llist)),
               "new head previous not set to null");
 
   /**
@@ -165,59 +161,108 @@ UNITTEST_START
    * @setup:
    * 1: insert another element to the list to make element >=2
    * @assumptions:
-   * 1: list size will be decremented by one ; tested
-   * 2: element->previous->next will be element->next
-   * 3: element->next->previous will be element->previous
+   * 1: list size is decremented by one ; tested
+   * 2: element->previous->next is element->next
+   * 3: element->next->previous is element->previous
    */
-  Curl_llist_insert_next(&llist, llist.head, &unusedData_case3,
+  Curl_llist_insert_next(&llist, Curl_llist_head(&llist), &unusedData_case3,
                          &case4_list);
   llist_size = Curl_llist_count(&llist);
   fail_unless(llist_size == 3, "should be 3 list members");
 
-  to_remove = llist.head->next;
+  to_remove = Curl_node_next(Curl_llist_head(&llist));
   abort_unless(to_remove, "to_remove is NULL");
-  element_next = to_remove->next;
-  element_prev = to_remove->prev;
-  Curl_llist_remove(&llist, to_remove, NULL);
-  fail_unless(element_prev->next == element_next,
+  element_next = Curl_node_next(to_remove);
+  element_prev = llist_node_prev(to_remove);
+  Curl_node_remove(to_remove);
+  fail_unless(Curl_node_next(element_prev) == element_next,
               "element previous->next is not being adjusted");
   abort_unless(element_next, "element_next is NULL");
-  fail_unless(element_next->prev == element_prev,
+  fail_unless(llist_node_prev(element_next) == element_prev,
               "element next->previous is not being adjusted");
 
   /**
    * case 3:
    * removing the tail with list having >=1 element
    * @assumptions
-   * 1: list size will be decremented by one ;tested
-   * 2: element->previous->next will be element->next ;tested
-   * 3: element->next->previous will be element->previous ;tested
-   * 4: list->tail will be tail->previous
+   * 1: list size is decremented by one ;tested
+   * 2: element->previous->next is element->next ;tested
+   * 3: element->next->previous is element->previous ;tested
+   * 4: list->tail is tail->previous
    */
 
-  to_remove = llist.tail;
-  element_prev = to_remove->prev;
-  Curl_llist_remove(&llist, to_remove, NULL);
-  fail_unless(llist.tail == element_prev,
+  to_remove = llist_tail(&llist);
+  element_prev = llist_node_prev(to_remove);
+  Curl_node_remove(to_remove);
+  fail_unless(llist_tail(&llist) == element_prev,
               "llist tail is not being adjusted when removing tail");
 
   /**
    * case 4:
    * removing head with list having 1 element
    * @assumptions:
-   * 1: list size will be decremented by one ;tested
-   * 2: list head will be null
-   * 3: list tail will be null
+   * 1: list size is decremented by one ;tested
+   * 2: list head is NULL
+   * 3: list tail is NULL
    */
 
-  to_remove = llist.head;
-  Curl_llist_remove(&llist, to_remove, NULL);
-  fail_unless(llist.head == NULL,
+  to_remove = Curl_llist_head(&llist);
+  Curl_node_remove(to_remove);
+  fail_unless(!Curl_llist_head(&llist),
               "llist head is not NULL while the llist is empty");
-  fail_unless(llist.tail == NULL,
+  fail_unless(!llist_tail(&llist),
               "llist tail is not NULL while the llist is empty");
 
+  /**
+   * testing Curl_llist_append
+   * case 1:
+   * list is empty
+   * @assumptions:
+   * 1: the element next to head should be our newly created element
+   * 2: the list tail should different from newly created element
+   */
+  Curl_llist_append(&llist, &unusedData_case1, &case1_list);
+  fail_unless(Curl_llist_count(&llist) == 1,
+              "List size should be 1 after appending a new element");
+  /* test that the list head data holds my unusedData */
+  fail_unless(Curl_node_elem(Curl_llist_head(&llist)) == &unusedData_case1,
+              "head ptr should be first entry");
+  /* same goes for the list tail */
+  fail_unless(llist_tail(&llist) == Curl_llist_head(&llist),
+              "tail and head should be the same");
+
+  /**
+   * testing Curl_llist_append
+   * case 2:
+   * list is not empty
+   * @assumptions:
+   * 1: the list head-next should be the newly created element
+   * 2: the list tail should be the newly created element
+   */
+  Curl_llist_append(&llist, &unusedData_case2, &case2_list);
+  fail_unless(Curl_node_elem(Curl_node_next(Curl_llist_head(&llist))) ==
+                &unusedData_case2,
+              "the node next to head is not getting set correctly");
+  fail_unless(Curl_node_elem(llist_tail(&llist)) == &unusedData_case2,
+              "the list tail is not getting set correctly");
+
+  /**
+   * testing Curl_llist_append
+   * case 3:
+   * list is has 2 members
+   * @assumptions:
+   * 1: the list head-next should remain the same
+   * 2: the list tail should be the newly created element
+   */
+  Curl_llist_append(&llist, &unusedData_case3, &case3_list);
+  fail_unless(Curl_node_elem(Curl_node_next(Curl_llist_head(&llist))) ==
+                &unusedData_case2,
+              "the node next to head did not stay the same");
+  fail_unless(Curl_node_elem(llist_tail(&llist)) == &unusedData_case3,
+              "the list tail is not getting set correctly");
+
   Curl_llist_destroy(&llist, NULL);
   Curl_llist_destroy(&llist_destination, NULL);
+
+  UNITTEST_END_SIMPLE
 }
-UNITTEST_STOP
diff --git a/third-party/curl/tests/unit/unit1302.c b/third-party/curl/tests/unit/unit1302.c
index cf3c9b07e6..e840486511 100644
--- a/third-party/curl/tests/unit/unit1302.c
+++ b/third-party/curl/tests/unit/unit1302.c
@@ -21,171 +21,180 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "urldata.h"
-#include "url.h" /* for Curl_safefree */
-#include "curl_base64.h"
-#include "memdebug.h" /* LAST include file */
+#include "url.h" /* for curlx_safefree */
 
-static struct Curl_easy *data;
+struct etest {
+  const char *input;
+  size_t ilen;
+  const char *output;
+  size_t olen;
+};
 
-static CURLcode unit_setup(void)
+static CURLcode test_unit1302(const char *arg)
 {
-  CURLcode res = CURLE_OK;
+  UNITTEST_BEGIN_SIMPLE
+  CURLcode result;
+  unsigned int i;
 
-  global_init(CURL_GLOBAL_ALL);
-  data = curl_easy_init();
-  if(!data) {
-    curl_global_cleanup();
-    return CURLE_OUT_OF_MEMORY;
+  /* common base64 encoding */
+  struct etest encode[] = {
+    { "iiiiii", 1, "aQ==", 4 },
+    { "iiiiii", 2, "aWk=", 4 },
+    { "iiiiii", 3, "aWlp", 4 },
+    { "iiiiii", 4, "aWlpaQ==", 8 },
+    { "iiiiii", 5, "aWlpaWk=", 8 },
+    { "iiiiii", 6, "aWlpaWlp", 8 },
+    { "iiiiiii", 7, "aWlpaWlpaQ==", 12 },
+    { "iiiiiiii", 8, "aWlpaWlpaWk=", 12 },
+    { "iiiiiiiii", 9, "aWlpaWlpaWlp", 12 },
+    { "iiiiiiiiii", 10, "aWlpaWlpaWlpaQ==", 16 },
+    { "iiiiiiiiiii", 11, "aWlpaWlpaWlpaWk=", 16 },
+    { "iiiiiiiiiiii", 12, "aWlpaWlpaWlpaWlp", 16 },
+    { "\xff\x01\xfe\x02", 4, "/wH+Ag==", 8 },
+    { "\xff\xff\xff\xff", 4, "/////w==", 8 },
+    { "\x00\x00\x00\x00", 4, "AAAAAA==", 8 },
+    { "\x00\x00\x00\x00", 1, "AA==", 4 },
+  };
+
+  /* base64 URL encoding */
+  struct etest url[] = {
+    { "", 0, "", 0 },
+    { "iiiiiiiiiii", 1, "aQ", 2 },
+    { "iiiiiiiiiii", 2, "aWk", 3 },
+    { "iiiiiiiiiii", 3, "aWlp", 4 },
+    { "iiiiiiiiiii", 4, "aWlpaQ", 6 },
+    { "iiiiiiiiiii", 5, "aWlpaWk", 7 },
+    { "iiiiiiiiiii", 6, "aWlpaWlp", 8 },
+    { "iiiiiiiiiii", 7, "aWlpaWlpaQ", 10 },
+    { "iiiiiiiiiii", 8, "aWlpaWlpaWk", 11 },
+    { "iiiiiiiiiii", 9, "aWlpaWlpaWlp", 12 },
+    { "iiiiiiiiiii", 10, "aWlpaWlpaWlpaQ", 14 },
+    { "iiiiiiiiiii", 11, "aWlpaWlpaWlpaWk", 15 },
+    { "iiiiiiiiiiii", 12, "aWlpaWlpaWlpaWlp", 16 },
+    { "\xff\x01\xfe\x02", 4, "_wH-Ag", 6 },
+    { "\xff\xff\xff\xff", 4, "_____w", 6 },
+    { "\xff\x00\xff\x00", 4, "_wD_AA", 6 },
+    { "\x00\xff\x00\xff", 4, "AP8A_w", 6 },
+    { "\x00\x00\x00\x00", 4, "AAAAAA", 6 },
+    { "\x00", 1, "AA", 2 },
+    { "\x01", 1, "AQ", 2 },
+    { "\x02", 1, "Ag", 2 },
+    { "\x03", 1, "Aw", 2 },
+    { "\x04", 1, "BA", 2 }, /* spellchecker:disable-line */
+    { "\x05", 1, "BQ", 2 },
+    { "\x06", 1, "Bg", 2 },
+    { "\x07", 1, "Bw", 2 },
+    { "\x08", 1, "CA", 2 },
+    { "\x09", 1, "CQ", 2 },
+    { "\x0a", 1, "Cg", 2 },
+    { "\x0b", 1, "Cw", 2 },
+    { "\x0c", 1, "DA", 2 },
+    { "\x0d", 1, "DQ", 2 },
+    { "\x0e", 1, "Dg", 2 },
+    { "\x0f", 1, "Dw", 2 },
+    { "\x10", 1, "EA", 2 },
+  };
+
+  /* bad decode inputs */
+  struct etest badecode[] = {
+    { "", 0, "", 0 },         /* no dats means error */
+    { "", 0, "a", 1 },        /* data is too short */
+    { "", 0, "aQ", 2 },       /* data is too short */
+    { "", 0, "aQ=", 3 },      /* data is too short */
+    { "", 0, "====", 1 },     /* data is only padding characters */
+    { "", 0, "====", 2 },     /* data is only padding characters */
+    { "", 0, "====", 3 },     /* data is only padding characters */
+    { "", 0, "====", 4 },     /* data is only padding characters */
+    { "", 0, "a===", 4 },     /* contains three padding characters */
+    { "", 0, "a=Q=", 4 },     /* contains a padding character mid input */
+    { "", 0, "aWlpa=Q=", 8 }, /* contains a padding character mid input */
+    { "", 0, "a\x1f==", 4 },  /* contains illegal base64 character */
+    { "", 0, "abcd ", 5 },    /* contains illegal base64 character */
+    { "", 0, "abcd  ", 6 },   /* contains illegal base64 character */
+    { "", 0, " abcd", 5 },    /* contains illegal base64 character */
+    { "", 0, "_abcd", 5 },    /* contains illegal base64 character */
+    { "", 0, "abcd-", 5 },    /* contains illegal base64 character */
+    { "", 0, "abcd_", 5 },    /* contains illegal base64 character */
+    { "", 0, "aWlpaWlpaQ==-", 17 }, /* bad character after padding */
+    { "", 0, "aWlpaWlpaQ==_", 17 }, /* bad character after padding */
+    { "", 0, "aWlpaWlpaQ== ", 17 }, /* bad character after padding */
+    { "", 0, "aWlpaWlpaQ=", 15 } /* unaligned size, missing a padding char */
+  };
+
+  for(i = 0; i < CURL_ARRAYSIZE(encode); i++) {
+    const struct etest *e = &encode[i];
+    char *out;
+    unsigned char *decoded;
+    size_t olen;
+    size_t dlen;
+
+    /* first encode */
+    result = curlx_base64_encode((const uint8_t *)e->input, e->ilen,
+                                 &out, &olen);
+    abort_unless(result == CURLE_OK, "return code should be CURLE_OK");
+    abort_unless(olen == e->olen, "wrong output size");
+    if(memcmp(out, e->output, e->olen)) {
+      curl_mfprintf(stderr, "Test %u encoded badly\n", i);
+      unitfail++;
+    }
+    curlx_safefree(out);
+
+    /* then verify decode */
+    result = curlx_base64_decode(e->output, &decoded, &dlen);
+    if(result != CURLE_OK) {
+      curl_mfprintf(stderr, "Test %u URL decode returned %d\n", i,
+                    (int)result);
+      unitfail++;
+    }
+    if(dlen != e->ilen) {
+      curl_mfprintf(stderr, "Test %u URL decode output length %zu "
+                    "instead of %zu\n", i, dlen, e->ilen);
+      unitfail++;
+    }
+    if(memcmp(decoded, e->input, dlen)) {
+      curl_mfprintf(stderr, "Test %u URL decoded badly. Got '%s', "
+                    "expected '%s'\n", i, decoded, e->input);
+      unitfail++;
+    }
+
+    curlx_safefree(decoded);
   }
-  return res;
+
+  for(i = 0; i < CURL_ARRAYSIZE(url); i++) {
+    const struct etest *e = &url[i];
+    char *out;
+    size_t olen;
+    result = curlx_base64url_encode((const uint8_t *)e->input, e->ilen,
+                                    &out, &olen);
+    abort_unless(result == CURLE_OK, "return code should be CURLE_OK");
+    if(olen != e->olen) {
+      curl_mfprintf(stderr, "Test %u URL encoded output length %zu "
+                    "instead of %zu\n", i, olen, e->olen);
+    }
+    if(out && memcmp(out, e->output, e->olen)) {
+      curl_mfprintf(stderr, "Test %u URL encoded badly. Got '%s', "
+                    "expected '%s'\n", i, out, e->output);
+      unitfail++;
+    }
+    curlx_safefree(out);
+  }
+
+  for(i = 0; i < CURL_ARRAYSIZE(badecode); i++) {
+    struct etest *e = &badecode[i];
+    unsigned char *decoded;
+    size_t dlen;
+
+    /* then verify decode with illegal inputs */
+    result = curlx_base64_decode(e->output, &decoded, &dlen);
+    if(result != CURLE_BAD_CONTENT_ENCODING) {
+      curl_mfprintf(stderr, "Test %u URL bad decoded badly. "
+                    "Returned '%d', expected '%d'\n",
+                    i, (int)result, CURLE_BAD_CONTENT_ENCODING);
+      unitfail++;
+    }
+  }
+
+  UNITTEST_END_SIMPLE
 }
-
-static void unit_stop(void)
-{
-  curl_easy_cleanup(data);
-  curl_global_cleanup();
-}
-
-UNITTEST_START
-
-char *output;
-unsigned char *decoded;
-size_t size = 0;
-unsigned char anychar = 'x';
-CURLcode rc;
-
-rc = Curl_base64_encode("i", 1, &output, &size);
-fail_unless(rc == CURLE_OK, "return code should be CURLE_OK");
-fail_unless(size == 4, "size should be 4");
-verify_memory(output, "aQ==", 4);
-Curl_safefree(output);
-
-rc = Curl_base64_encode("ii", 2, &output, &size);
-fail_unless(rc == CURLE_OK, "return code should be CURLE_OK");
-fail_unless(size == 4, "size should be 4");
-verify_memory(output, "aWk=", 4);
-Curl_safefree(output);
-
-rc = Curl_base64_encode("iii", 3, &output, &size);
-fail_unless(rc == CURLE_OK, "return code should be CURLE_OK");
-fail_unless(size == 4, "size should be 4");
-verify_memory(output, "aWlp", 4);
-Curl_safefree(output);
-
-rc = Curl_base64_encode("iiii", 4, &output, &size);
-fail_unless(rc == CURLE_OK, "return code should be CURLE_OK");
-fail_unless(size == 8, "size should be 8");
-verify_memory(output, "aWlpaQ==", 8);
-Curl_safefree(output);
-
-rc = Curl_base64_encode("\xff\x01\xfe\x02", 4, &output, &size);
-fail_unless(rc == CURLE_OK, "return code should be CURLE_OK");
-fail_unless(size == 8, "size should be 8");
-verify_memory(output, "/wH+Ag==", 8);
-Curl_safefree(output);
-
-rc = Curl_base64url_encode("\xff\x01\xfe\x02", 4, &output, &size);
-fail_unless(rc == CURLE_OK, "return code should be CURLE_OK");
-fail_unless(size == 6, "size should be 6");
-verify_memory(output, "_wH-Ag", 6);
-Curl_safefree(output);
-
-rc = Curl_base64url_encode("iiii", 4, &output, &size);
-fail_unless(rc == CURLE_OK, "return code should be CURLE_OK");
-fail_unless(size == 6, "size should be 6");
-verify_memory(output, "aWlpaQ", 6);
-Curl_safefree(output);
-
-/* 0 length makes it do strlen() */
-rc = Curl_base64_encode("iiii", 0, &output, &size);
-fail_unless(rc == CURLE_OK, "return code should be CURLE_OK");
-fail_unless(size == 8, "size should be 8");
-verify_memory(output, "aWlpaQ==", 8);
-Curl_safefree(output);
-
-rc = Curl_base64_encode("", 0, &output, &size);
-fail_unless(rc == CURLE_OK, "return code should be CURLE_OK");
-fail_unless(size == 0, "size should be 0");
-fail_unless(output && !output[0], "output should be a zero-length string");
-Curl_safefree(output);
-
-rc = Curl_base64url_encode("", 0, &output, &size);
-fail_unless(rc == CURLE_OK, "return code should be CURLE_OK");
-fail_unless(size == 0, "size should be 0");
-fail_unless(output && !output[0], "output should be a zero-length string");
-Curl_safefree(output);
-
-rc = Curl_base64_decode("aWlpaQ==", &decoded, &size);
-fail_unless(rc == CURLE_OK, "return code should be CURLE_OK");
-fail_unless(size == 4, "size should be 4");
-verify_memory(decoded, "iiii", 4);
-Curl_safefree(decoded);
-
-rc = Curl_base64_decode("aWlp", &decoded, &size);
-fail_unless(rc == CURLE_OK, "return code should be CURLE_OK");
-fail_unless(size == 3, "size should be 3");
-verify_memory(decoded, "iii", 3);
-Curl_safefree(decoded);
-
-rc = Curl_base64_decode("aWk=", &decoded, &size);
-fail_unless(rc == CURLE_OK, "return code should be CURLE_OK");
-fail_unless(size == 2, "size should be 2");
-verify_memory(decoded, "ii", 2);
-Curl_safefree(decoded);
-
-rc = Curl_base64_decode("aQ==", &decoded, &size);
-fail_unless(rc == CURLE_OK, "return code should be CURLE_OK");
-fail_unless(size == 1, "size should be 1");
-verify_memory(decoded, "i", 2);
-Curl_safefree(decoded);
-
-/* This is illegal input as the data is too short */
-size = 1; /* not zero */
-decoded = &anychar; /* not NULL */
-rc = Curl_base64_decode("aQ", &decoded, &size);
-fail_unless(rc == CURLE_BAD_CONTENT_ENCODING,
-            "return code should be CURLE_BAD_CONTENT_ENCODING");
-fail_unless(size == 0, "size should be 0");
-fail_if(decoded, "returned pointer should be NULL");
-
-/* This is illegal input as it contains three padding characters */
-size = 1; /* not zero */
-decoded = &anychar; /* not NULL */
-rc = Curl_base64_decode("a===", &decoded, &size);
-fail_unless(rc == CURLE_BAD_CONTENT_ENCODING,
-            "return code should be CURLE_BAD_CONTENT_ENCODING");
-fail_unless(size == 0, "size should be 0");
-fail_if(decoded, "returned pointer should be NULL");
-
-/* This is illegal input as it contains a padding character mid input */
-size = 1; /* not zero */
-decoded = &anychar; /* not NULL */
-rc = Curl_base64_decode("a=Q=", &decoded, &size);
-fail_unless(rc == CURLE_BAD_CONTENT_ENCODING,
-            "return code should be CURLE_BAD_CONTENT_ENCODING");
-fail_unless(size == 0, "size should be 0");
-fail_if(decoded, "returned pointer should be NULL");
-
-/* This is also illegal input as it contains a padding character mid input */
-size = 1; /* not zero */
-decoded = &anychar; /* not NULL */
-rc = Curl_base64_decode("aWlpa=Q=", &decoded, &size);
-fail_unless(rc == CURLE_BAD_CONTENT_ENCODING,
-            "return code should be CURLE_BAD_CONTENT_ENCODING");
-fail_unless(size == 0, "size should be 0");
-fail_if(decoded, "returned pointer should be NULL");
-
-/* This is garbage input as it contains an illegal base64 character */
-size = 1; /* not zero */
-decoded = &anychar; /* not NULL */
-rc = Curl_base64_decode("a\x1f==", &decoded, &size);
-fail_unless(rc == CURLE_BAD_CONTENT_ENCODING,
-            "return code should be CURLE_BAD_CONTENT_ENCODING");
-fail_unless(size == 0, "size should be 0");
-fail_if(decoded, "returned pointer should be NULL");
-
-
-UNITTEST_STOP
diff --git a/third-party/curl/tests/unit/unit1303.c b/third-party/curl/tests/unit/unit1303.c
index c022496c3d..50cdaa12f1 100644
--- a/third-party/curl/tests/unit/unit1303.c
+++ b/third-party/curl/tests/unit/unit1303.c
@@ -21,41 +21,41 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "urldata.h"
 #include "connect.h"
-#include "memdebug.h" /* LAST include file */
 
-static struct Curl_easy *data;
-
-static CURLcode unit_setup(void)
+static CURLcode t1303_setup(struct Curl_easy **easy)
 {
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
-  data = curl_easy_init();
-  if(!data) {
+  *easy = curl_easy_init();
+  if(!*easy) {
     curl_global_cleanup();
     return CURLE_OUT_OF_MEMORY;
   }
-  return res;
+  return result;
 }
 
-static void unit_stop(void)
+static void t1303_stop(struct Curl_easy *easy)
 {
-  curl_easy_cleanup(data);
+  curl_easy_cleanup(easy);
   curl_global_cleanup();
 }
 
-/* BASE is just a define to make us fool around with decently large number so
-   that we aren't zero-based */
+/* BASE is a define to make us fool around with decently large number so
+   that we are not zero-based */
 #define BASE 1000000
 
 /* macro to set the pretended current time */
-#define NOW(x,y) now.tv_sec = x; now.tv_usec = y
+#define NOW(x, y) \
+  now.tv_sec = x; \
+  now.tv_usec = y
 /* macro to set the millisecond based timeouts to use */
-#define TIMEOUTS(x,y) data->set.timeout = x; data->set.connecttimeout = y
+#define TIMEOUTS(x, y)         \
+  easy->set.timeout = x;       \
+  easy->set.connecttimeout = y
 
 /*
  * To test:
@@ -66,88 +66,94 @@ static void unit_stop(void)
  * N           various values of now
  */
 
-struct timetest {
-  int now_s;
-  int now_us;
-  int timeout_ms;
-  int connecttimeout_ms;
-  bool connecting;
-  timediff_t result;
-  const char *comment;
-};
-
-UNITTEST_START
+static CURLcode test_unit1303(const char *arg)
 {
+  struct Curl_easy *easy;
+
+  UNITTEST_BEGIN(t1303_setup(&easy))
+
   struct curltime now;
   unsigned int i;
 
+  struct timetest {
+    int now_s;
+    int now_us;
+    unsigned int timeout_ms;
+    unsigned int connecttimeout_ms;
+    bool connecting;
+    timediff_t result;
+    const char *comment;
+  };
+
   const struct timetest run[] = {
-  /* both timeouts set, not connecting */
-  {BASE + 4, 0,      10000, 8000, FALSE, 6000, "6 seconds should be left"},
-  {BASE + 4, 990000, 10000, 8000, FALSE, 5010, "5010 ms should be left"},
-  {BASE + 10, 0,     10000, 8000, FALSE, -1,   "timeout is -1, expired"},
-  {BASE + 12, 0,     10000, 8000, FALSE, -2000, "-2000, overdue 2 seconds"},
+    /* both timeouts set, not connecting */
+    {BASE + 4, 0,      10000, 8000, FALSE, 6000, "6 seconds should be left"},
+    {BASE + 4, 990000, 10000, 8000, FALSE, 5010, "5010 ms should be left"},
+    {BASE + 10, 0,     10000, 8000, FALSE, -1,   "timeout is -1, expired"},
+    {BASE + 12, 0,     10000, 8000, FALSE, -2000, "-2000, overdue 2 seconds"},
 
-  /* both timeouts set, connecting */
-  {BASE + 4, 0,      10000, 8000, TRUE, 4000, "4 seconds should be left"},
-  {BASE + 4, 990000, 10000, 8000, TRUE, 3010, "3010 ms should be left"},
-  {BASE + 8, 0,      10000, 8000, TRUE, -1,   "timeout is -1, expired"},
-  {BASE + 10, 0,     10000, 8000, TRUE, -2000, "-2000, overdue 2 seconds"},
+    /* both timeouts set, connecting */
+    {BASE + 4, 0,      10000, 8000, TRUE, 4000, "4 seconds should be left"},
+    {BASE + 4, 990000, 10000, 8000, TRUE, 3010, "3010 ms should be left"},
+    {BASE + 8, 0,      10000, 8000, TRUE, -1,   "timeout is -1, expired"},
+    {BASE + 10, 0,     10000, 8000, TRUE, -2000, "-2000, overdue 2 seconds"},
 
-  /* no connect timeout set, not connecting */
-  {BASE + 4, 0,      10000, 0, FALSE, 6000, "6 seconds should be left"},
-  {BASE + 4, 990000, 10000, 0, FALSE, 5010, "5010 ms should be left"},
-  {BASE + 10, 0,     10000, 0, FALSE, -1,   "timeout is -1, expired"},
-  {BASE + 12, 0,     10000, 0, FALSE, -2000, "-2000, overdue 2 seconds"},
+    /* no connect timeout set, not connecting */
+    {BASE + 4, 0,      10000, 0, FALSE, 6000, "6 seconds should be left"},
+    {BASE + 4, 990000, 10000, 0, FALSE, 5010, "5010 ms should be left"},
+    {BASE + 10, 0,     10000, 0, FALSE, -1,   "timeout is -1, expired"},
+    {BASE + 12, 0,     10000, 0, FALSE, -2000, "-2000, overdue 2 seconds"},
 
-  /* no connect timeout set, connecting */
-  {BASE + 4, 0,      10000, 0, TRUE, 6000, "6 seconds should be left"},
-  {BASE + 4, 990000, 10000, 0, TRUE, 5010, "5010 ms should be left"},
-  {BASE + 10, 0,     10000, 0, TRUE, -1,   "timeout is -1, expired"},
-  {BASE + 12, 0,     10000, 0, TRUE, -2000, "-2000, overdue 2 seconds"},
+    /* no connect timeout set, connecting */
+    {BASE + 4, 0,      10000, 0, TRUE, 6000, "6 seconds should be left"},
+    {BASE + 4, 990000, 10000, 0, TRUE, 5010, "5010 ms should be left"},
+    {BASE + 10, 0,     10000, 0, TRUE, -1,   "timeout is -1, expired"},
+    {BASE + 12, 0,     10000, 0, TRUE, -2000, "-2000, overdue 2 seconds"},
 
-  /* only connect timeout set, not connecting */
-  {BASE + 4, 0,      0, 10000, FALSE, 0, "no timeout active"},
-  {BASE + 4, 990000, 0, 10000, FALSE, 0, "no timeout active"},
-  {BASE + 10, 0,     0, 10000, FALSE, 0, "no timeout active"},
-  {BASE + 12, 0,     0, 10000, FALSE, 0, "no timeout active"},
+    /* only connect timeout set, not connecting */
+    {BASE + 4, 0,      0, 10000, FALSE, 0, "no timeout active"},
+    {BASE + 4, 990000, 0, 10000, FALSE, 0, "no timeout active"},
+    {BASE + 10, 0,     0, 10000, FALSE, 0, "no timeout active"},
+    {BASE + 12, 0,     0, 10000, FALSE, 0, "no timeout active"},
 
-  /* only connect timeout set, connecting */
-  {BASE + 4, 0,      0, 10000, TRUE, 6000, "6 seconds should be left"},
-  {BASE + 4, 990000, 0, 10000, TRUE, 5010, "5010 ms should be left"},
-  {BASE + 10, 0,     0, 10000, TRUE, -1,   "timeout is -1, expired"},
-  {BASE + 12, 0,     0, 10000, TRUE, -2000, "-2000, overdue 2 seconds"},
+    /* only connect timeout set, connecting */
+    {BASE + 4, 0,      0, 10000, TRUE, 6000, "6 seconds should be left"},
+    {BASE + 4, 990000, 0, 10000, TRUE, 5010, "5010 ms should be left"},
+    {BASE + 10, 0,     0, 10000, TRUE, -1,   "timeout is -1, expired"},
+    {BASE + 12, 0,     0, 10000, TRUE, -2000, "-2000, overdue 2 seconds"},
 
-  /* no timeout set, not connecting */
-  {BASE + 4, 0,      0, 0, FALSE, 0, "no timeout active"},
-  {BASE + 4, 990000, 0, 0, FALSE, 0, "no timeout active"},
-  {BASE + 10, 0,     0, 0, FALSE, 0, "no timeout active"},
-  {BASE + 12, 0,     0, 0, FALSE, 0, "no timeout active"},
+    /* no timeout set, not connecting */
+    {BASE + 4, 0,      0, 0, FALSE, 0, "no timeout active"},
+    {BASE + 4, 990000, 0, 0, FALSE, 0, "no timeout active"},
+    {BASE + 10, 0,     0, 0, FALSE, 0, "no timeout active"},
+    {BASE + 12, 0,     0, 0, FALSE, 0, "no timeout active"},
 
-  /* no timeout set, connecting */
-  {BASE + 4, 0,      0, 0, TRUE, 296000, "no timeout active"},
-  {BASE + 4, 990000, 0, 0, TRUE, 295010, "no timeout active"},
-  {BASE + 10, 0,     0, 0, TRUE, 290000, "no timeout active"},
-  {BASE + 12, 0,     0, 0, TRUE, 288000, "no timeout active"},
-
-  /* both timeouts set, connecting, connect timeout the longer one */
-  {BASE + 4, 0,      10000, 12000, TRUE, 6000, "6 seconds should be left"},
+    /* no timeout set, connecting */
+    {BASE + 4, 0,      0, 0, TRUE, 296000, "no timeout active"},
+    {BASE + 4, 990000, 0, 0, TRUE, 295010, "no timeout active"},
+    {BASE + 10, 0,     0, 0, TRUE, 290000, "no timeout active"},
+    {BASE + 12, 0,     0, 0, TRUE, 288000, "no timeout active"},
 
+    /* both timeouts set, connecting, connect timeout the longer one */
+    {BASE + 4, 0,      10000, 12000, TRUE, 6000, "6 seconds should be left"},
   };
 
   /* this is the pretended start time of the transfer */
-  data->progress.t_startsingle.tv_sec = BASE;
-  data->progress.t_startsingle.tv_usec = 0;
-  data->progress.t_startop.tv_sec = BASE;
-  data->progress.t_startop.tv_usec = 0;
+  easy->progress.t_startsingle.tv_sec = BASE;
+  easy->progress.t_startsingle.tv_usec = 0;
+  easy->progress.t_startop.tv_sec = BASE;
+  easy->progress.t_startop.tv_usec = 0;
 
-  for(i = 0; i < sizeof(run)/sizeof(run[0]); i++) {
+  for(i = 0; i < CURL_ARRAYSIZE(run); i++) {
     timediff_t timeout;
     NOW(run[i].now_s, run[i].now_us);
     TIMEOUTS(run[i].timeout_ms, run[i].connecttimeout_ms);
-    timeout =  Curl_timeleft(data, &now, run[i].connecting);
+    easy->progress.now = now;
+    easy->mstate = run[i].connecting ? MSTATE_INIT : MSTATE_DO;
+    timeout = timeleft_now_ms(easy, &now);
     if(timeout != run[i].result)
       fail(run[i].comment);
   }
+
+  UNITTEST_END(t1303_stop(easy))
 }
-UNITTEST_STOP
diff --git a/third-party/curl/tests/unit/unit1304.c b/third-party/curl/tests/unit/unit1304.c
index 0288562c6f..0c788818a5 100644
--- a/third-party/curl/tests/unit/unit1304.c
+++ b/third-party/curl/tests/unit/unit1304.c
@@ -21,178 +21,146 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-#include "netrc.h"
-#include "memdebug.h" /* LAST include file */
+#include "unitcheck.h"
 
 #ifndef CURL_DISABLE_NETRC
+#include "netrc.h"
+#include "creds.h"
 
-static char *login;
-static char *password;
-
-static CURLcode unit_setup(void)
+static CURLcode t1304_setup(struct Curl_easy **easy)
 {
-  password = strdup("");
-  login = strdup("");
-  if(!password || !login) {
-    Curl_safefree(password);
-    Curl_safefree(login);
+  CURLcode result = CURLE_OK;
+
+  global_init(CURL_GLOBAL_ALL);
+  *easy = curl_easy_init();
+  if(!*easy) {
+    curl_global_cleanup();
     return CURLE_OUT_OF_MEMORY;
   }
-  return CURLE_OK;
+  return result;
 }
 
-static void unit_stop(void)
+static void t1304_stop(struct Curl_easy *easy)
 {
-  Curl_safefree(password);
-  Curl_safefree(login);
+  curl_easy_cleanup(easy);
+  curl_global_cleanup();
 }
 
-UNITTEST_START
-  int result;
+static bool t1304_no_user(struct Curl_creds *creds)
+{
+  return !creds || !creds->user[0];
+}
+
+static bool t1304_no_passwd(struct Curl_creds *creds)
+{
+  return !creds || !creds->passwd[0];
+}
+
+static CURLcode test_unit1304(const char *arg)
+{
+  struct Curl_creds *cr_out = NULL;
+  struct Curl_easy *data;
+  NETRCcode res;
+  struct store_netrc store;
+
+  UNITTEST_BEGIN(t1304_setup(&data))
 
   /*
    * Test a non existent host in our netrc file.
    */
-  result = Curl_parsenetrc("test.example.com", &login, &password, arg);
-  fail_unless(result == 1, "Host not found should return 1");
-  abort_unless(password != NULL, "returned NULL!");
-  fail_unless(password[0] == 0, "password should not have been changed");
-  abort_unless(login != NULL, "returned NULL!");
-  fail_unless(login[0] == 0, "login should not have been changed");
+  Curl_netrc_init(&store);
+  res = Curl_netrc_scan(data, &store, "test.example.com", NULL, arg, &cr_out);
+  fail_unless(res == NETRC_NO_MATCH, "expected no match");
+  fail_unless(!cr_out, "creds did not return NULL!");
+  Curl_netrc_cleanup(&store);
 
   /*
    * Test a non existent login in our netrc file.
    */
-  free(login);
-  login = strdup("me");
-  abort_unless(login != NULL, "returned NULL!");
-  result = Curl_parsenetrc("example.com", &login, &password, arg);
-  fail_unless(result == 0, "Host should have been found");
-  abort_unless(password != NULL, "returned NULL!");
-  fail_unless(password[0] == 0, "password should not have been changed");
-  abort_unless(login != NULL, "returned NULL!");
-  fail_unless(strncmp(login, "me", 2) == 0,
-              "login should not have been changed");
+  Curl_netrc_init(&store);
+  res = Curl_netrc_scan(data, &store, "example.com", "me", arg, &cr_out);
+  fail_unless(res == NETRC_NO_MATCH, "expected no match");
+  fail_unless(t1304_no_passwd(cr_out), "password is not NULL!");
+  Curl_netrc_cleanup(&store);
 
   /*
    * Test a non existent login and host in our netrc file.
    */
-  free(login);
-  login = strdup("me");
-  abort_unless(login != NULL, "returned NULL!");
-  result = Curl_parsenetrc("test.example.com", &login, &password, arg);
-  fail_unless(result == 1, "Host not found should return 1");
-  abort_unless(password != NULL, "returned NULL!");
-  fail_unless(password[0] == 0, "password should not have been changed");
-  abort_unless(login != NULL, "returned NULL!");
-  fail_unless(strncmp(login, "me", 2) == 0,
-              "login should not have been changed");
+  Curl_netrc_init(&store);
+  res = Curl_netrc_scan(data, &store, "test.example.com", "me", arg, &cr_out);
+  fail_unless(res == NETRC_NO_MATCH, "expected no match");
+  fail_unless(t1304_no_passwd(cr_out), "password is not NULL!");
+  Curl_netrc_cleanup(&store);
 
   /*
    * Test a non existent login (substring of an existing one) in our
    * netrc file.
    */
-  free(login);
-  login = strdup("admi");
-  abort_unless(login != NULL, "returned NULL!");
-  result = Curl_parsenetrc("example.com", &login, &password, arg);
-  fail_unless(result == 0, "Host should have been found");
-  abort_unless(password != NULL, "returned NULL!");
-  fail_unless(password[0] == 0, "password should not have been changed");
-  abort_unless(login != NULL, "returned NULL!");
-  fail_unless(strncmp(login, "admi", 4) == 0,
-              "login should not have been changed");
+  Curl_netrc_init(&store);
+  res = Curl_netrc_scan(data, &store, "example.com", "a", arg, &cr_out);
+  fail_unless(res == NETRC_NO_MATCH, "expected no match");
+  fail_unless(t1304_no_passwd(cr_out), "password is not NULL!");
+  Curl_netrc_cleanup(&store);
 
   /*
    * Test a non existent login (superstring of an existing one)
    * in our netrc file.
    */
-  free(login);
-  login = strdup("adminn");
-  abort_unless(login != NULL, "returned NULL!");
-  result = Curl_parsenetrc("example.com", &login, &password, arg);
-  fail_unless(result == 0, "Host should have been found");
-  abort_unless(password != NULL, "returned NULL!");
-  fail_unless(password[0] == 0, "password should not have been changed");
-  abort_unless(login != NULL, "returned NULL!");
-  fail_unless(strncmp(login, "adminn", 6) == 0,
-              "login should not have been changed");
+  Curl_netrc_init(&store);
+  res = Curl_netrc_scan(
+    data, &store, "example.com", "administrator", arg, &cr_out);
+  fail_unless(res == NETRC_NO_MATCH, "expected no match");
+  fail_unless(t1304_no_passwd(cr_out), "password is not NULL!");
+  Curl_netrc_cleanup(&store);
 
   /*
-   * Test for the first existing host in our netrc file
-   * with login[0] = 0.
+   * Test for the first existing host in our netrc file with no user
    */
-  free(login);
-  login = strdup("");
-  abort_unless(login != NULL, "returned NULL!");
-  result = Curl_parsenetrc("example.com", &login, &password, arg);
-  fail_unless(result == 0, "Host should have been found");
-  abort_unless(password != NULL, "returned NULL!");
-  fail_unless(strncmp(password, "passwd", 6) == 0,
+  Curl_netrc_init(&store);
+  res = Curl_netrc_scan(data, &store, "example.com", NULL, arg, &cr_out);
+  fail_unless(res == NETRC_OK, "Host should have been found");
+  fail_unless(!strncmp(Curl_creds_passwd(cr_out), "passwd", 6),
               "password should be 'passwd'");
-  abort_unless(login != NULL, "returned NULL!");
-  fail_unless(strncmp(login, "admin", 5) == 0, "login should be 'admin'");
+  fail_unless(!t1304_no_user(cr_out), "returned NULL!");
+  fail_unless(!strncmp(Curl_creds_user(cr_out), "admin", 5),
+              "login should be 'admin'");
+  Curl_netrc_cleanup(&store);
 
   /*
-   * Test for the first existing host in our netrc file
-   * with login[0] != 0.
+   * Test for the second existing host in our netrc file with no user
    */
-  free(password);
-  password = strdup("");
-  abort_unless(password != NULL, "returned NULL!");
-  result = Curl_parsenetrc("example.com", &login, &password, arg);
-  fail_unless(result == 0, "Host should have been found");
-  abort_unless(password != NULL, "returned NULL!");
-  fail_unless(strncmp(password, "passwd", 6) == 0,
-              "password should be 'passwd'");
-  abort_unless(login != NULL, "returned NULL!");
-  fail_unless(strncmp(login, "admin", 5) == 0, "login should be 'admin'");
+  Curl_netrc_init(&store);
+  res = Curl_netrc_scan(data, &store, "curl.example.com", NULL, arg, &cr_out);
+  fail_unless(res == NETRC_OK, "Host should have been found");
+  fail_unless(!strncmp(Curl_creds_passwd(cr_out), "none", 4),
+                      "password should be 'none'");
+  fail_unless(!t1304_no_user(cr_out), "returned NULL!");
+  fail_unless(!strncmp(Curl_creds_user(cr_out), "none", 4),
+              "login should be 'none'");
+  Curl_netrc_cleanup(&store);
 
   /*
-   * Test for the second existing host in our netrc file
-   * with login[0] = 0.
+   * Test for the last host where we do not want to see the password
+   * if the login does not match.
    */
-  free(password);
-  password = strdup("");
-  abort_unless(password != NULL, "returned NULL!");
-  free(login);
-  login = strdup("");
-  abort_unless(login != NULL, "returned NULL!");
-  result = Curl_parsenetrc("curl.example.com", &login, &password, arg);
-  fail_unless(result == 0, "Host should have been found");
-  abort_unless(password != NULL, "returned NULL!");
-  fail_unless(strncmp(password, "none", 4) == 0,
-              "password should be 'none'");
-  abort_unless(login != NULL, "returned NULL!");
-  fail_unless(strncmp(login, "none", 4) == 0, "login should be 'none'");
+  Curl_netrc_init(&store);
+  res = Curl_netrc_scan(
+    data, &store, "curl.example.com", "hilarious", arg, &cr_out);
+  fail_unless(res == NETRC_NO_MATCH, "expect no match");
+  fail_unless(!Curl_creds_has_passwd(cr_out), "password must be NULL");
+  Curl_netrc_cleanup(&store);
 
-  /*
-   * Test for the second existing host in our netrc file
-   * with login[0] != 0.
-   */
-  free(password);
-  password = strdup("");
-  abort_unless(password != NULL, "returned NULL!");
-  result = Curl_parsenetrc("curl.example.com", &login, &password, arg);
-  fail_unless(result == 0, "Host should have been found");
-  abort_unless(password != NULL, "returned NULL!");
-  fail_unless(strncmp(password, "none", 4) == 0,
-              "password should be 'none'");
-  abort_unless(login != NULL, "returned NULL!");
-  fail_unless(strncmp(login, "none", 4) == 0, "login should be 'none'");
+  Curl_creds_unlink(&cr_out);
 
-UNITTEST_STOP
+  UNITTEST_END(t1304_stop(data))
+}
 
 #else
-static CURLcode unit_setup(void)
+
+static CURLcode test_unit1304(const char *arg)
 {
-  return CURLE_OK;
+  UNITTEST_BEGIN_SIMPLE
+  UNITTEST_END_SIMPLE
 }
-static void unit_stop(void)
-{
-}
-UNITTEST_START
-UNITTEST_STOP
 
 #endif
diff --git a/third-party/curl/tests/unit/unit1305.c b/third-party/curl/tests/unit/unit1305.c
index 19cc62c44a..93f2e7cc7b 100644
--- a/third-party/curl/tests/unit/unit1305.c
+++ b/third-party/curl/tests/unit/unit1305.c
@@ -21,64 +21,51 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
+#include "unitcheck.h"
 
 #ifdef HAVE_NETINET_IN_H
-#  include <netinet/in.h>
+#include <netinet/in.h>
 #endif
 #ifdef HAVE_NETDB_H
-#  include <netdb.h>
+#include <netdb.h>
 #endif
 #ifdef HAVE_ARPA_INET_H
-#  include <arpa/inet.h>
+#include <arpa/inet.h>
 #endif
 
-#define ENABLE_CURLX_PRINTF
-#include "curlx.h"
-
+#include "curl_addrinfo.h"
 #include "hash.h"
-#include "hostip.h"
+#include "dnscache.h"
 
-#include "memdebug.h" /* LAST include file */
-
-static struct Curl_easy *data;
-static struct Curl_hash hp;
+static struct Curl_dnscache hp;
 static char *data_key;
 static struct Curl_dns_entry *data_node;
 
-static CURLcode unit_setup(void)
+static CURLcode t1305_setup(void)
 {
-  data = curl_easy_init();
-  if(!data) {
-    curl_global_cleanup();
-    return CURLE_OUT_OF_MEMORY;
-  }
-
-  Curl_init_dnscache(&hp, 7);
+  Curl_dnscache_init(&hp, 7);
   return CURLE_OK;
 }
 
-static void unit_stop(void)
+static void t1305_stop(void)
 {
   if(data_node) {
     Curl_freeaddrinfo(data_node->addr);
-    free(data_node);
+    curlx_free(data_node);
   }
-  free(data_key);
-  Curl_hash_destroy(&hp);
-
-  curl_easy_cleanup(data);
-  curl_global_cleanup();
+  curlx_free(data_key);
+  Curl_dnscache_destroy(&hp);
 }
 
 static struct Curl_addrinfo *fake_ai(void)
 {
   static struct Curl_addrinfo *ai;
-  static const char dummy[]="dummy";
+  static const char dummy[] = "dummy";
   size_t namelen = sizeof(dummy); /* including the null-terminator */
 
-  ai = calloc(1, sizeof(struct Curl_addrinfo) + sizeof(struct sockaddr_in) +
-              namelen);
+  ai = curlx_calloc(1,
+                    sizeof(struct Curl_addrinfo) + sizeof(struct sockaddr_in) +
+                    namelen);
   if(!ai)
     return NULL;
 
@@ -95,11 +82,11 @@ static struct Curl_addrinfo *fake_ai(void)
 
 static CURLcode create_node(void)
 {
-  data_key = aprintf("%s:%d", "dummy", 0);
+  data_key = curl_maprintf("%s:%d", "dummy", 0);
   if(!data_key)
     return CURLE_OUT_OF_MEMORY;
 
-  data_node = calloc(1, sizeof(struct Curl_dns_entry));
+  data_node = curlx_calloc(1, sizeof(struct Curl_dns_entry));
   if(!data_node)
     return CURLE_OUT_OF_MEMORY;
 
@@ -110,23 +97,25 @@ static CURLcode create_node(void)
   return CURLE_OK;
 }
 
-
-UNITTEST_START
+static CURLcode test_unit1305(const char *arg)
+{
+  UNITTEST_BEGIN(t1305_setup())
 
   struct Curl_dns_entry *nodep;
   size_t key_len;
 
   /* Test 1305 exits without adding anything to the hash */
-  if(strcmp(arg, "1305") != 0) {
-    CURLcode rc = create_node();
-    abort_unless(rc == CURLE_OK, "data node creation failed");
+  if(testnum == 1306) {
+    CURLcode result = create_node();
+    abort_unless(result == CURLE_OK, "data node creation failed");
     key_len = strlen(data_key);
 
-    data_node->inuse = 1; /* hash will hold the reference */
-    nodep = Curl_hash_add(&hp, data_key, key_len + 1, data_node);
+    data_node->refcount = 1; /* hash holds the reference */
+    nodep = Curl_hash_add(&hp.entries, data_key, key_len + 1, data_node);
     abort_unless(nodep, "insertion into hash failed");
-    /* Freeing will now be done by Curl_hash_destroy */
+    /* Freeing is done now by Curl_hash_destroy */
     data_node = NULL;
   }
 
-UNITTEST_STOP
+  UNITTEST_END(t1305_stop())
+}
diff --git a/third-party/curl/tests/unit/unit1307.c b/third-party/curl/tests/unit/unit1307.c
index 440b390602..833319b611 100644
--- a/third-party/curl/tests/unit/unit1307.c
+++ b/third-party/curl/tests/unit/unit1307.c
@@ -21,20 +21,10 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
-#include "curl_fnmatch.h"
-
-static CURLcode unit_setup(void)
-{
-  return CURLE_OK;
-}
-
-static void unit_stop(void)
-{
-}
+#include "unitcheck.h"
 
 #ifndef CURL_DISABLE_FTP
+#include "curl_fnmatch.h"
 
 /*
    CURL_FNMATCH_MATCH    0
@@ -45,212 +35,19 @@ static void unit_stop(void)
 #define MATCH   CURL_FNMATCH_MATCH
 #define NOMATCH CURL_FNMATCH_NOMATCH
 
-#define LINUX_DIFFER 0x80
-#define LINUX_SHIFT 8
-#define LINUX_MATCH ((CURL_FNMATCH_MATCH << LINUX_SHIFT) | LINUX_DIFFER)
+#define LINUX_DIFFER  0x80
+#define LINUX_SHIFT   8
+#define LINUX_MATCH   ((CURL_FNMATCH_MATCH   << LINUX_SHIFT) | LINUX_DIFFER)
 #define LINUX_NOMATCH ((CURL_FNMATCH_NOMATCH << LINUX_SHIFT) | LINUX_DIFFER)
-#define LINUX_FAIL ((CURL_FNMATCH_FAIL << LINUX_SHIFT) | LINUX_DIFFER)
+#define LINUX_FAIL    ((CURL_FNMATCH_FAIL    << LINUX_SHIFT) | LINUX_DIFFER)
 
-#define MAC_DIFFER 0x40
-#define MAC_SHIFT 16
-#define MAC_MATCH ((CURL_FNMATCH_MATCH << MAC_SHIFT) | MAC_DIFFER)
-#define MAC_NOMATCH ((CURL_FNMATCH_NOMATCH << MAC_SHIFT) | MAC_DIFFER)
-#define MAC_FAIL ((CURL_FNMATCH_FAIL << MAC_SHIFT) | MAC_DIFFER)
-
-struct testcase {
-  const char *pattern;
-  const char *string;
-  int result;
-};
-
-static const struct testcase tests[] = {
-  /* brackets syntax */
-  {"*[*[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[["
-   "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[["
-   "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[\001\177[[[[[[[[[[[[[[[[[[[[[",
-   "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[["
-   "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[["
-   "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[",
-   NOMATCH|MAC_FAIL},
-
-  { "\\[",                      "[",                      MATCH },
-  { "[",                        "[",             NOMATCH|LINUX_MATCH|MAC_FAIL},
-  { "[]",                       "[]",            NOMATCH|LINUX_MATCH|MAC_FAIL},
-  { "[][]",                     "[",                      MATCH },
-  { "[][]",                     "]",                      MATCH },
-  { "[[]",                      "[",                      MATCH },
-  { "[[[]",                     "[",                      MATCH },
-  { "[[[[]",                    "[",                      MATCH },
-  { "[[[[]",                    "[",                      MATCH },
-
-  { "[][[]",                    "]",                      MATCH },
-  { "[][[[]",                   "[",                      MATCH },
-  { "[[]",                      "]",                      NOMATCH },
-
-  { "[a@]",                     "a",                      MATCH },
-
-  { "[a-z]",                    "a",                      MATCH },
-  { "[a-z]",                    "A",                      NOMATCH },
-  { "?[a-z]",                   "?Z",                     NOMATCH },
-  { "[A-Z]",                    "C",                      MATCH },
-  { "[A-Z]",                    "c",                      NOMATCH },
-  { "[0-9]",                    "7",                      MATCH },
-  { "[7-8]",                    "7",                      MATCH },
-  { "[7-]",                     "7",                      MATCH },
-  { "[7-]",                     "-",                      MATCH },
-  { "[7-]",                     "[",                      NOMATCH },
-  { "[a-bA-F]",                 "F",                      MATCH },
-  { "[a-bA-B9]",                "9",                      MATCH },
-  { "[a-bA-B98]",               "8",                      MATCH },
-  { "[a-bA-B98]",               "C",                      NOMATCH },
-  { "[a-bA-Z9]",                "F",                      MATCH },
-  { "[a-bA-Z9]ero*",            "Zero chance.",           MATCH },
-  { "S[a-][x]opho*",            "Saxophone",              MATCH },
-  { "S[a-][x]opho*",            "SaXophone",              NOMATCH },
-  { "S[a-][x]*.txt",            "S-x.txt",                MATCH },
-  { "[\\a-\\b]",                "a",                      MATCH },
-  { "[\\a-\\b]",                "b",                      MATCH },
-  { "[?*[][?*[][?*[]",          "?*[",                    MATCH },
-  { "[][?*-]",                  "]",                      MATCH },
-  { "[][?*-]",                  "[",                      MATCH },
-  { "[][?*-]",                  "?",                      MATCH },
-  { "[][?*-]",                  "*",                      MATCH },
-  { "[][?*-]",                  "-",                      MATCH },
-  { "[]?*-]",                   "-",                      MATCH },
-  { "[\xFF]",                   "\xFF", MATCH|LINUX_FAIL|MAC_FAIL},
-  { "?/b/c",                    "a/b/c",                  MATCH },
-  { "^_{}~",                    "^_{}~",                  MATCH },
-  { "!#%+,-./01234567889",      "!#%+,-./01234567889",    MATCH },
-  { "PQRSTUVWXYZ]abcdefg",      "PQRSTUVWXYZ]abcdefg",    MATCH },
-  { ":;=@ABCDEFGHIJKLMNO",      ":;=@ABCDEFGHIJKLMNO",    MATCH },
-
-  /* negate */
-  { "[!a]",                     "b",                      MATCH },
-  { "[!a]",                     "a",                      NOMATCH },
-  { "[^a]",                     "b",                      MATCH },
-  { "[^a]",                     "a",                      NOMATCH },
-  { "[^a-z0-9A-Z]",             "a",                      NOMATCH },
-  { "[^a-z0-9A-Z]",             "-",                      MATCH },
-  { "curl[!a-z]lib",            "curl lib",               MATCH },
-  { "curl[! ]lib",              "curl lib",               NOMATCH },
-  { "[! ][ ]",                  "  ",                     NOMATCH },
-  { "[! ][ ]",                  "a ",                     MATCH },
-  { "*[^a].t?t",                "a.txt",                  NOMATCH },
-  { "*[^a].t?t",                "ba.txt",                 NOMATCH },
-  { "*[^a].t?t",                "ab.txt",                 MATCH },
-  { "*[^a]",                    "",                       NOMATCH },
-  { "[!\xFF]",                  "",             NOMATCH|LINUX_FAIL},
-  { "[!\xFF]",                  "\xFF",  NOMATCH|LINUX_FAIL|MAC_FAIL},
-  { "[!\xFF]",                  "a",      MATCH|LINUX_FAIL|MAC_FAIL},
-  { "[!?*[]",                   "?",                      NOMATCH },
-  { "[!!]",                     "!",                      NOMATCH },
-  { "[!!]",                     "x",                      MATCH },
-
-  { "[[:alpha:]]",              "a",                      MATCH },
-  { "[[:alpha:]]",              "9",                      NOMATCH },
-  { "[[:alnum:]]",              "a",                      MATCH },
-  { "[[:alnum:]]",              "[",                      NOMATCH },
-  { "[[:alnum:]]",              "]",                      NOMATCH },
-  { "[[:alnum:]]",              "9",                      MATCH },
-  { "[[:digit:]]",              "9",                      MATCH },
-  { "[[:xdigit:]]",             "9",                      MATCH },
-  { "[[:xdigit:]]",             "F",                      MATCH },
-  { "[[:xdigit:]]",             "G",                      NOMATCH },
-  { "[[:upper:]]",              "U",                      MATCH },
-  { "[[:upper:]]",              "u",                      NOMATCH },
-  { "[[:lower:]]",              "l",                      MATCH },
-  { "[[:lower:]]",              "L",                      NOMATCH },
-  { "[[:print:]]",              "L",                      MATCH },
-  { "[[:print:]]",              "\10",                    NOMATCH },
-  { "[[:print:]]",              "\10",                    NOMATCH },
-  { "[[:space:]]",              " ",                      MATCH },
-  { "[[:space:]]",              "x",                      NOMATCH },
-  { "[[:graph:]]",              " ",                      NOMATCH },
-  { "[[:graph:]]",              "x",                      MATCH },
-  { "[[:blank:]]",              "\t",                     MATCH },
-  { "[[:blank:]]",              " ",                      MATCH },
-  { "[[:blank:]]",              "\r",                     NOMATCH },
-  { "[^[:blank:]]",             "\t",                     NOMATCH },
-  { "[^[:print:]]",             "\10",                    MATCH },
-  { "[[:lower:]][[:lower:]]",   "ll",                     MATCH },
-  { "[[:foo:]]",                "bar",                    NOMATCH|MAC_FAIL},
-  { "[[:foo:]]",                "f]",         MATCH|LINUX_NOMATCH|MAC_FAIL},
-
-  { "Curl[[:blank:]];-)",       "Curl ;-)",               MATCH },
-  { "*[[:blank:]]*",            " ",                      MATCH },
-  { "*[[:blank:]]*",            "",                       NOMATCH },
-  { "*[[:blank:]]*",            "hi, im_Pavel",           MATCH },
-
-  /* common using */
-  { "filename.dat",             "filename.dat",           MATCH },
-  { "*curl*",                   "lets use curl!!",        MATCH },
-  { "filename.txt",             "filename.dat",           NOMATCH },
-  { "*.txt",                    "text.txt",               MATCH },
-  { "*.txt",                    "a.txt",                  MATCH },
-  { "*.txt",                    ".txt",                   MATCH },
-  { "*.txt",                    "txt",                    NOMATCH },
-  { "??.txt",                   "99.txt",                 MATCH },
-  { "??.txt",                   "a99.txt",                NOMATCH },
-  { "?.???",                    "a.txt",                  MATCH },
-  { "*.???",                    "somefile.dat",           MATCH },
-  { "*.???",                    "photo.jpeg",             NOMATCH },
-  { ".*",                       ".htaccess",              MATCH },
-  { ".*",                       ".",                      MATCH },
-  { ".*",                       "..",                     MATCH },
-
-  /* many stars => one star */
-  { "**.txt",                   "text.txt",               MATCH },
-  { "***.txt",                  "t.txt",                  MATCH },
-  { "****.txt",                 ".txt",                   MATCH },
-
-  /* empty string or pattern */
-  { "",                         "",                       MATCH },
-  { "",                         "hello",                  NOMATCH },
-  { "file",                     "",                       NOMATCH  },
-  { "?",                        "",                       NOMATCH },
-  { "*",                        "",                       MATCH },
-  { "x",                        "",                       NOMATCH },
-
-  /* backslash */
-  { "\\",                       "\\",                     MATCH|LINUX_NOMATCH},
-  { "\\\\",                     "\\",                     MATCH },
-  { "\\\\",                     "\\\\",                   NOMATCH },
-  { "\\?",                      "?",                      MATCH },
-  { "\\*",                      "*",                      MATCH },
-  { "?.txt",                    "?.txt",                  MATCH },
-  { "*.txt",                    "*.txt",                  MATCH },
-  { "\\?.txt",                  "?.txt",                  MATCH },
-  { "\\*.txt",                  "*.txt",                  MATCH },
-  { "\\?.txt",                  "x.txt",                  NOMATCH },
-  { "\\*.txt",                  "x.txt",                  NOMATCH },
-  { "\\*\\\\.txt",              "*\\.txt",                MATCH },
-  { "*\\**\\?*\\\\*",           "cc*cc?cccc",             NOMATCH },
-  { "*\\?*\\**",                "cc?cc",                  NOMATCH },
-  { "\\\"\\$\\&\\'\\(\\)",      "\"$&'()",                MATCH },
-  { "\\*\\?\\[\\\\\\`\\|",      "*?[\\`|",                MATCH },
-  { "[\\a\\b]c",                "ac",                     MATCH },
-  { "[\\a\\b]c",                "bc",                     MATCH },
-  { "[\\a\\b]d",                "bc",                     NOMATCH },
-  { "[a-bA-B\\?]",              "?",                      MATCH },
-  { "cu[a-ab-b\\r]l",           "curl",                   MATCH },
-  { "[\\a-z]",                  "c",                      MATCH },
-
-  { "?*?*?.*?*",                "abc.c",                  MATCH },
-  { "?*?*?.*?*",                "abcc",                   NOMATCH },
-  { "?*?*?.*?*",                "abc.",                   NOMATCH },
-  { "?*?*?.*?*",                "abc.c++",                MATCH },
-  { "?*?*?.*?*",                "abcdef.c++",             MATCH },
-  { "?*?*?.?",                  "abcdef.c",               MATCH },
-  { "?*?*?.?",                  "abcdef.cd",              NOMATCH },
-
-  { "Lindmätarv",               "Lindmätarv",             MATCH },
-
-  { "",                         "",                       MATCH},
-  {"**]*[*[\x13]**[*\x13)]*]*[**[*\x13~r-]*]**[.*]*[\xe3\xe3\xe3\xe3\xe3\xe3"
-   "\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3"
-   "\xe3\xe3\xe3\xe3\xe3*[\x13]**[*\x13)]*]*[*[\x13]*[~r]*]*\xba\x13\xa6~b-]*",
-                                "a",                      NOMATCH|LINUX_FAIL}
-};
+#define MAC_DIFFER    0x40
+#define MAC_SHIFT     16
+#if 0
+#define MAC_MATCH     ((CURL_FNMATCH_MATCH   << MAC_SHIFT) | MAC_DIFFER)
+#define MAC_NOMATCH   ((CURL_FNMATCH_NOMATCH << MAC_SHIFT) | MAC_DIFFER)
+#endif
+#define MAC_FAIL      ((CURL_FNMATCH_FAIL    << MAC_SHIFT) | MAC_DIFFER)
 
 static const char *ret2name(int i)
 {
@@ -267,35 +64,234 @@ static const char *ret2name(int i)
   /* not reached */
 }
 
-enum system {
-  SYSTEM_CUSTOM,
-  SYSTEM_LINUX,
-  SYSTEM_MACOS
-};
-
-UNITTEST_START
+static CURLcode test_unit1307(const char *arg)
 {
-  int testnum = sizeof(tests) / sizeof(struct testcase);
-  int i;
+  UNITTEST_BEGIN_SIMPLE
+
+  struct testcase {
+    const char *pattern;
+    const char *string;
+    int result;
+  };
+
+  static const struct testcase tests[] = {
+    /* brackets syntax */
+    {"*[*[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[["
+     "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[["
+     "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[\001\177[[[[[[[[[[[[[[[[[[[[[",
+     "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[["
+     "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[["
+     "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[",
+     NOMATCH|MAC_FAIL},
+
+    { "\\[",                      "[",                      MATCH },
+    { "[",                        "[",           NOMATCH|LINUX_MATCH|MAC_FAIL},
+    { "[]",                       "[]",          NOMATCH|LINUX_MATCH|MAC_FAIL},
+    { "[][]",                     "[",                      MATCH },
+    { "[][]",                     "]",                      MATCH },
+    { "[[]",                      "[",                      MATCH },
+    { "[[[]",                     "[",                      MATCH },
+    { "[[[[]",                    "[",                      MATCH },
+    { "[[[[]",                    "[",                      MATCH },
+
+    { "[][[]",                    "]",                      MATCH },
+    { "[][[[]",                   "[",                      MATCH },
+    { "[[]",                      "]",                      NOMATCH },
+
+    { "[a@]",                     "a",                      MATCH },
+
+    { "[a-z]",                    "a",                      MATCH },
+    { "[a-z]",                    "A",                      NOMATCH },
+    { "?[a-z]",                   "?Z",                     NOMATCH },
+    { "[A-Z]",                    "C",                      MATCH },
+    { "[A-Z]",                    "c",                      NOMATCH },
+    { "[0-9]",                    "7",                      MATCH },
+    { "[7-8]",                    "7",                      MATCH },
+    { "[7-]",                     "7",                      MATCH },
+    { "[7-]",                     "-",                      MATCH },
+    { "[7-]",                     "[",                      NOMATCH },
+    { "[a-bA-F]",                 "F",                      MATCH },
+    { "[a-bA-B9]",                "9",                      MATCH },
+    { "[a-bA-B98]",               "8",                      MATCH },
+    { "[a-bA-B98]",               "C",                      NOMATCH },
+    { "[a-bA-Z9]",                "F",                      MATCH },
+    { "[a-bA-Z9]ero*",            "Zero chance.",           MATCH },
+    { "S[a-][x]opho*",            "Saxophone",              MATCH },
+    { "S[a-][x]opho*",            "SaXophone",              NOMATCH },
+    { "S[a-][x]*.txt",            "S-x.txt",                MATCH },
+    { "[\\a-\\b]",                "a",                      MATCH },
+    { "[\\a-\\b]",                "b",                      MATCH },
+    { "[?*[][?*[][?*[]",          "?*[",                    MATCH },
+    { "[][?*-]",                  "]",                      MATCH },
+    { "[][?*-]",                  "[",                      MATCH },
+    { "[][?*-]",                  "?",                      MATCH },
+    { "[][?*-]",                  "*",                      MATCH },
+    { "[][?*-]",                  "-",                      MATCH },
+    { "[]?*-]",                   "-",                      MATCH },
+    { "[\xFF]",                   "\xFF", MATCH|LINUX_FAIL|MAC_FAIL},
+    { "?/b/c",                    "a/b/c",                  MATCH },
+    { "^_{}~",                    "^_{}~",                  MATCH },
+    { "!#%+,-./01234567889",      "!#%+,-./01234567889",    MATCH },
+    { "PQRSTUVWXYZ]abcdefg",      "PQRSTUVWXYZ]abcdefg",    MATCH },
+    { ":;=@ABCDEFGHIJKLMNO",      ":;=@ABCDEFGHIJKLMNO",    MATCH },
+
+    /* negate */
+    { "[!a]",                     "b",                      MATCH },
+    { "[!a]",                     "a",                      NOMATCH },
+    { "[^a]",                     "b",                      MATCH },
+    { "[^a]",                     "a",                      NOMATCH },
+    { "[^a-z0-9A-Z]",             "a",                      NOMATCH },
+    { "[^a-z0-9A-Z]",             "-",                      MATCH },
+    { "curl[!a-z]lib",            "curl lib",               MATCH },
+    { "curl[! ]lib",              "curl lib",               NOMATCH },
+    { "[! ][ ]",                  "  ",                     NOMATCH },
+    { "[! ][ ]",                  "a ",                     MATCH },
+    { "*[^a].t?t",                "a.txt",                  NOMATCH },
+    { "*[^a].t?t",                "ca.txt",                 NOMATCH },
+    { "*[^a].t?t",                "ac.txt",                 MATCH },
+    { "*[^a]",                    "",                       NOMATCH },
+    { "[!\xFF]",                  "",             NOMATCH|LINUX_FAIL},
+    { "[!\xFF]",                  "\xFF",  NOMATCH|LINUX_FAIL|MAC_FAIL},
+    { "[!\xFF]",                  "a",      MATCH|LINUX_FAIL|MAC_FAIL},
+    { "[!?*[]",                   "?",                      NOMATCH },
+    { "[!!]",                     "!",                      NOMATCH },
+    { "[!!]",                     "x",                      MATCH },
+
+    { "[[:alpha:]]",              "a",                      MATCH },
+    { "[[:alpha:]]",              "9",                      NOMATCH },
+    { "[[:alnum:]]",              "a",                      MATCH },
+    { "[[:alnum:]]",              "[",                      NOMATCH },
+    { "[[:alnum:]]",              "]",                      NOMATCH },
+    { "[[:alnum:]]",              "9",                      MATCH },
+    { "[[:digit:]]",              "9",                      MATCH },
+    { "[[:xdigit:]]",             "9",                      MATCH },
+    { "[[:xdigit:]]",             "F",                      MATCH },
+    { "[[:xdigit:]]",             "G",                      NOMATCH },
+    { "[[:upper:]]",              "U",                      MATCH },
+    { "[[:upper:]]",              "u",                      NOMATCH },
+    { "[[:lower:]]",              "l",                      MATCH },
+    { "[[:lower:]]",              "L",                      NOMATCH },
+    { "[[:print:]]",              "L",                      MATCH },
+    { "[[:print:]]",              "\10",                    NOMATCH },
+    { "[[:print:]]",              "\10",                    NOMATCH },
+    { "[[:space:]]",              " ",                      MATCH },
+    { "[[:space:]]",              "x",                      NOMATCH },
+    { "[[:graph:]]",              " ",                      NOMATCH },
+    { "[[:graph:]]",              "x",                      MATCH },
+    { "[[:blank:]]",              "\t",                     MATCH },
+    { "[[:blank:]]",              " ",                      MATCH },
+    { "[[:blank:]]",              "\r",                     NOMATCH },
+    { "[^[:blank:]]",             "\t",                     NOMATCH },
+    { "[^[:print:]]",             "\10",                    MATCH },
+    { "[[:lower:]][[:lower:]]",   "ll",                     MATCH },
+    { "[[:foo:]]",                "bar",                    NOMATCH|MAC_FAIL},
+    { "[[:foo:]]",                "f]",         MATCH|LINUX_NOMATCH|MAC_FAIL},
+
+    { "curl[[:blank:]];-)",       "curl ;-)",               MATCH },
+    { "*[[:blank:]]*",            " ",                      MATCH },
+    { "*[[:blank:]]*",            "",                       NOMATCH },
+    { "*[[:blank:]]*",            "hi, im_Pavel",           MATCH },
+
+    /* common using */
+    { "Filename.dat",             "Filename.dat",           MATCH },
+    { "*curl*",                   "lets use curl!!",        MATCH },
+    { "filename.txt",             "filename.dat",           NOMATCH },
+    { "*.txt",                    "text.txt",               MATCH },
+    { "*.txt",                    "a.txt",                  MATCH },
+    { "*.txt",                    ".txt",                   MATCH },
+    { "*.txt",                    "txt",                    NOMATCH },
+    { "??.txt",                   "99.txt",                 MATCH },
+    { "??.txt",                   "a99.txt",                NOMATCH },
+    { "?.???",                    "a.txt",                  MATCH },
+    { "*.???",                    "somefile.dat",           MATCH },
+    { "*.???",                    "photo.jpeg",             NOMATCH },
+    { ".*",                       ".htaccess",              MATCH },
+    { ".*",                       ".",                      MATCH },
+    { ".*",                       "..",                     MATCH },
+
+    /* many stars => one star */
+    { "**.txt",                   "text.txt",               MATCH },
+    { "***.txt",                  "t.txt",                  MATCH },
+    { "****.txt",                 ".txt",                   MATCH },
+
+    /* empty string or pattern */
+    { "",                         "",                       MATCH },
+    { "",                         "hello",                  NOMATCH },
+    { "file",                     "",                       NOMATCH  },
+    { "?",                        "",                       NOMATCH },
+    { "*",                        "",                       MATCH },
+    { "x",                        "",                       NOMATCH },
+
+    /* backslash */
+    { "\\",                       "\\",                   MATCH|LINUX_NOMATCH},
+    { "\\\\",                     "\\",                     MATCH },
+    { "\\\\",                     "\\\\",                   NOMATCH },
+    { "\\?",                      "?",                      MATCH },
+    { "\\*",                      "*",                      MATCH },
+    { "?.txt",                    "?.txt",                  MATCH },
+    { "*.txt",                    "*.txt",                  MATCH },
+    { "\\?.txt",                  "?.txt",                  MATCH },
+    { "\\*.txt",                  "*.txt",                  MATCH },
+    { "\\?.txt",                  "x.txt",                  NOMATCH },
+    { "\\*.txt",                  "x.txt",                  NOMATCH },
+    { "\\*\\\\.txt",              "*\\.txt",                MATCH },
+    { "*\\**\\?*\\\\*",           "cc*cc?cccc",             NOMATCH },
+    { "*\\?*\\**",                "cc?cc",                  NOMATCH },
+    { "\\\"\\$\\&\\'\\(\\)",      "\"$&'()",                MATCH },
+    { "\\*\\?\\[\\\\\\`\\|",      "*?[\\`|",                MATCH },
+    { "[\\a\\b]c",                "ac",                     MATCH },
+    { "[\\a\\b]c",                "bc",                     MATCH },
+    { "[\\a\\b]d",                "bc",                     NOMATCH },
+    { "[a-bA-B\\?]",              "?",                      MATCH },
+    { "cu[a-ab-b\\r]l",           "curl",                   MATCH },
+    { "[\\a-z]",                  "c",                      MATCH },
+
+    { "?*?*?.*?*",                "abc.c",                  MATCH },
+    { "?*?*?.*?*",                "abcc",                   NOMATCH },
+    { "?*?*?.*?*",                "abc.",                   NOMATCH },
+    { "?*?*?.*?*",                "abc.c++",                MATCH },
+    { "?*?*?.*?*",                "abcdef.c++",             MATCH },
+    { "?*?*?.?",                  "abcdef.c",               MATCH },
+    { "?*?*?.?",                  "abcdef.cd",              NOMATCH },
+
+    /* https://codepoints.net/U+00E4 Latin Small Letter A with Diaeresis */
+    { "Lindm\xc3\xa4tarv",        "Lindm\xc3\xa4tarv",      MATCH },
+
+    { "",                         "",                       MATCH},
+    {"**]*[*[\x13]**[*\x13)]*]*[**[*\x13~r-]*]**[.*]*[\xe3\xe3\xe3\xe3\xe3\xe3"
+     "\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3"
+     "\xe3\xe3\xe3\xe3\xe3*[\x13]**[*\x13)]*]*[*[\x13]*[~r]*]*\xba\x13\xa6~b-]"
+     "*",
+                                  "a",                      NOMATCH|LINUX_FAIL}
+  };
+
+  size_t i;
+
+  enum system {
+    SYSTEM_CUSTOM,
+    SYSTEM_LINUX,
+    SYSTEM_MACOS
+  };
+
   enum system machine;
 
 #ifdef HAVE_FNMATCH
-  if(strstr(OS, "apple") || strstr(OS, "darwin")) {
-    machine = SYSTEM_MACOS;
-  }
-  else
-    machine = SYSTEM_LINUX;
-  printf("Tested with system fnmatch(), %s-style\n",
-         machine == SYSTEM_LINUX ? "linux" : "mac");
+#ifdef __APPLE__
+  machine = SYSTEM_MACOS;
 #else
-  printf("Tested with custom fnmatch()\n");
+  machine = SYSTEM_LINUX;
+#endif
+  curl_mprintf("Tested with system fnmatch(), %s-style\n",
+               machine == SYSTEM_LINUX ? "linux" : "mac");
+#else
+  curl_mprintf("Tested with custom fnmatch()\n");
   machine = SYSTEM_CUSTOM;
 #endif
 
-  for(i = 0; i < testnum; i++) {
+  for(i = 0; i < CURL_ARRAYSIZE(tests); i++) {
     int result = tests[i].result;
     int rc = Curl_fnmatch(NULL, tests[i].pattern, tests[i].string);
-    if(result & (LINUX_DIFFER|MAC_DIFFER)) {
+    if(result & (LINUX_DIFFER | MAC_DIFFER)) {
       if((result & LINUX_DIFFER) && (machine == SYSTEM_LINUX))
         result >>= LINUX_SHIFT;
       else if((result & MAC_DIFFER) && (machine == SYSTEM_MACOS))
@@ -303,19 +299,23 @@ UNITTEST_START
       result &= 0x03; /* filter off all high bits */
     }
     if(rc != result) {
-      printf("Curl_fnmatch(\"%s\", \"%s\") should return %s (returns %s)"
-             " [%d]\n",
-             tests[i].pattern, tests[i].string, ret2name(result),
-             ret2name(rc), i);
+      curl_mprintf("Curl_fnmatch(\"%s\", \"%s\") should return %s (returns %s)"
+                   " [%zu]\n",
+                   tests[i].pattern, tests[i].string, ret2name(result),
+                   ret2name(rc), i);
       fail("pattern mismatch");
     }
   }
+
+  UNITTEST_END_SIMPLE
 }
-UNITTEST_STOP
 
 #else
 
-UNITTEST_START
-UNITTEST_STOP
+static CURLcode test_unit1307(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+  UNITTEST_END_SIMPLE
+}
 
 #endif
diff --git a/third-party/curl/tests/unit/unit1308.c b/third-party/curl/tests/unit/unit1308.c
deleted file mode 100644
index 3e2cf4b31e..0000000000
--- a/third-party/curl/tests/unit/unit1308.c
+++ /dev/null
@@ -1,98 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#define CURL_DISABLE_DEPRECATION  /* Testing the form api */
-#include "curlcheck.h"
-
-#include <curl/curl.h>
-
-static CURLcode unit_setup(void)
-{
-  return CURLE_OK;
-}
-
-static void unit_stop(void)
-{
-
-}
-
-static size_t print_httppost_callback(void *arg, const char *buf, size_t len)
-{
-  fwrite(buf, len, 1, stdout);
-  (*(size_t *) arg) += len;
-  return len;
-}
-
-UNITTEST_START
-  int rc;
-  struct curl_httppost *post = NULL;
-  struct curl_httppost *last = NULL;
-  size_t total_size = 0;
-  char buffer[] = "test buffer";
-
-  rc = curl_formadd(&post, &last, CURLFORM_COPYNAME, "name",
-                    CURLFORM_COPYCONTENTS, "content", CURLFORM_END);
-
-  fail_unless(rc == 0, "curl_formadd returned error");
-
-  /* after the first curl_formadd when there's a single entry, both pointers
-     should point to the same struct */
-  fail_unless(post == last, "post and last weren't the same");
-
-  rc = curl_formadd(&post, &last, CURLFORM_COPYNAME, "htmlcode",
-                    CURLFORM_COPYCONTENTS, "<HTML></HTML>",
-                    CURLFORM_CONTENTTYPE, "text/html", CURLFORM_END);
-
-  fail_unless(rc == 0, "curl_formadd returned error");
-
-  rc = curl_formadd(&post, &last, CURLFORM_COPYNAME, "name_for_ptrcontent",
-                   CURLFORM_PTRCONTENTS, buffer, CURLFORM_END);
-
-  fail_unless(rc == 0, "curl_formadd returned error");
-
-  rc = curl_formget(post, &total_size, print_httppost_callback);
-
-  fail_unless(rc == 0, "curl_formget returned error");
-
-  fail_unless(total_size == 488, "curl_formget got wrong size back");
-
-  curl_formfree(post);
-
-  /* start a new formpost with a file upload and formget */
-  post = last = NULL;
-
-  rc = curl_formadd(&post, &last,
-                    CURLFORM_PTRNAME, "name of file field",
-                    CURLFORM_FILE, arg,
-                    CURLFORM_FILENAME, "custom named file",
-                    CURLFORM_END);
-
-  fail_unless(rc == 0, "curl_formadd returned error");
-
-  rc = curl_formget(post, &total_size, print_httppost_callback);
-  fail_unless(rc == 0, "curl_formget returned error");
-  fail_unless(total_size == 851, "curl_formget got wrong size back");
-
-  curl_formfree(post);
-
-UNITTEST_STOP
diff --git a/third-party/curl/tests/unit/unit1309.c b/third-party/curl/tests/unit/unit1309.c
index 5c5801abd6..607e49aa88 100644
--- a/third-party/curl/tests/unit/unit1309.c
+++ b/third-party/curl/tests/unit/unit1309.c
@@ -21,21 +21,8 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "splay.h"
-#include "warnless.h"
-
-
-static CURLcode unit_setup(void)
-{
-  return CURLE_OK;
-}
-
-static void unit_stop(void)
-{
-
-}
 
 static void splayprint(struct Curl_tree *t, int d, char output)
 {
@@ -46,13 +33,12 @@ static void splayprint(struct Curl_tree *t, int d, char output)
     return;
 
   splayprint(t->larger, d + 1, output);
-  for(i = 0; i<d; i++)
+  for(i = 0; i < d; i++)
     if(output)
-      printf("  ");
+      curl_mprintf("  ");
 
   if(output) {
-    printf("%ld.%ld[%d]", (long)t->key.tv_sec,
-           (long)t->key.tv_usec, i);
+    curl_mprintf("%ld.%ld[%d]", (long)t->key.tv_sec, (long)t->key.tv_usec, i);
   }
 
   for(count = 0, node = t->samen; node != t; node = node->samen, count++)
@@ -60,85 +46,88 @@ static void splayprint(struct Curl_tree *t, int d, char output)
 
   if(output) {
     if(count)
-      printf(" [%d more]\n", count);
+      curl_mprintf(" [%d more]\n", count);
     else
-      printf("\n");
+      curl_mprintf("\n");
   }
 
   splayprint(t->smaller, d + 1, output);
 }
 
-UNITTEST_START
+static CURLcode test_unit1309(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
 
 /* number of nodes to add to the splay tree */
 #define NUM_NODES 50
 
   struct Curl_tree *root, *removed;
-  struct Curl_tree nodes[NUM_NODES*3];
-  size_t storage[NUM_NODES*3];
+  struct Curl_tree nodes[NUM_NODES * 3];
+  size_t storage[NUM_NODES * 3];
   int rc;
   int i, j;
-  struct curltime tv_now = {0, 0};
-  root = NULL;              /* the empty tree */
+  struct curltime tv_now = { 0, 0 };
+  root = NULL; /* the empty tree */
 
   /* add nodes */
   for(i = 0; i < NUM_NODES; i++) {
     struct curltime key;
 
     key.tv_sec = 0;
-    key.tv_usec = (541*i)%1023;
+    key.tv_usec = (541 * i) % 1023;
     storage[i] = key.tv_usec;
-    nodes[i].payload = &storage[i];
-    root = Curl_splayinsert(key, root, &nodes[i]);
+    Curl_splayset(&nodes[i], &storage[i]);
+    root = Curl_splayinsert(&key, root, &nodes[i]);
   }
 
   puts("Result:");
   splayprint(root, 0, 1);
 
   for(i = 0; i < NUM_NODES; i++) {
-    int rem = (i + 7)%NUM_NODES;
-    printf("Tree look:\n");
+    int rem = (i + 7) % NUM_NODES;
+    curl_mprintf("Tree look:\n");
     splayprint(root, 0, 1);
-    printf("remove pointer %d, payload %zu\n", rem,
-           *(size_t *)nodes[rem].payload);
+    curl_mprintf("remove pointer %d, payload %zu\n", rem,
+                 *(size_t *)Curl_splayget(&nodes[rem]));
     rc = Curl_splayremove(root, &nodes[rem], &root);
     if(rc) {
       /* failed! */
-      printf("remove %d failed!\n", rem);
+      curl_mprintf("remove %d failed!\n", rem);
       fail("remove");
     }
   }
 
-  fail_unless(root == NULL, "tree not empty after removing all nodes");
+  fail_unless(!root, "tree not empty after removing all nodes");
 
   /* rebuild tree */
   for(i = 0; i < NUM_NODES; i++) {
     struct curltime key;
 
     key.tv_sec = 0;
-    key.tv_usec = (541*i)%1023;
+    key.tv_usec = (541 * i) % 1023;
 
     /* add some nodes with the same key */
     for(j = 0; j <= i % 3; j++) {
-      storage[i * 3 + j] = key.tv_usec*10 + j;
-      nodes[i * 3 + j].payload = &storage[i * 3 + j];
-      root = Curl_splayinsert(key, root, &nodes[i * 3 + j]);
+      storage[(i * 3) + j] = (key.tv_usec * 10) + j;
+      Curl_splayset(&nodes[(i * 3) + j], &storage[(i * 3) + j]);
+      root = Curl_splayinsert(&key, root, &nodes[(i * 3) + j]);
     }
   }
 
   removed = NULL;
   for(i = 0; i <= 1100; i += 100) {
-    printf("Removing nodes not larger than %d\n", i);
+    curl_mprintf("Removing nodes not larger than %d\n", i);
     tv_now.tv_usec = i;
-    root = Curl_splaygetbest(tv_now, root, &removed);
+    root = Curl_splaygetbest(&tv_now, root, &removed);
     while(removed) {
-      printf("removed payload %zu[%zu]\n",
-             (*(size_t *)removed->payload) / 10,
-             (*(size_t *)removed->payload) % 10);
-      root = Curl_splaygetbest(tv_now, root, &removed);
+      curl_mprintf("removed payload %zu[%zu]\n",
+                   *(size_t *)Curl_splayget(removed) / 10,
+                   *(size_t *)Curl_splayget(removed) % 10);
+      root = Curl_splaygetbest(&tv_now, root, &removed);
     }
   }
 
-  fail_unless(root == NULL, "tree not empty when it should be");
+  fail_unless(!root, "tree not empty when it should be");
 
-UNITTEST_STOP
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit1323.c b/third-party/curl/tests/unit/unit1323.c
index bdd02b5de5..86eb4e25cc 100644
--- a/third-party/curl/tests/unit/unit1323.c
+++ b/third-party/curl/tests/unit/unit1323.c
@@ -21,48 +21,41 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
+#include "unitcheck.h"
 
-#include "timeval.h"
-
-static CURLcode unit_setup(void)
+static CURLcode test_unit1323(const char *arg)
 {
-  return CURLE_OK;
-}
+  UNITTEST_BEGIN_SIMPLE
 
-static void unit_stop(void)
-{
-
-}
-
-struct a {
-  struct curltime first;
-  struct curltime second;
-  time_t result;
-};
-
-UNITTEST_START
-{
-  struct a tests[] = {
-    { {36762, 8345 }, {36761, 995926 }, 13 },
-    { {36761, 995926 }, {36762, 8345 }, -13 },
-    { {36761, 995926 }, {0, 0}, 36761995 },
-    { {0, 0}, {36761, 995926 }, -36761995 },
+  struct a {
+    struct curltime first;
+    struct curltime second;
+    timediff_t result;
   };
+
+  struct a tests[] = {
+    { { 36762, 8345 }, { 36761, 995926 }, 13 },
+    { { 36761, 995926 }, { 36762, 8345 }, -13 },
+    { { 36761, 995926 }, { 0, 0 }, 36761995 },
+    { { 0, 0 }, { 36761, 995926 }, -36761995 },
+  };
+
   size_t i;
 
-  for(i = 0; i < sizeof(tests)/sizeof(tests[0]); i++) {
-    timediff_t result = Curl_timediff(tests[i].first, tests[i].second);
+  for(i = 0; i < CURL_ARRAYSIZE(tests); i++) {
+    timediff_t result = curlx_timediff_ms(tests[i].first, tests[i].second);
     if(result != tests[i].result) {
-      printf("%ld.%06u to %ld.%06u got %d, but expected %ld\n",
-             (long)tests[i].first.tv_sec,
-             tests[i].first.tv_usec,
-             (long)tests[i].second.tv_sec,
-             tests[i].second.tv_usec,
-             (int)result,
-             (long)tests[i].result);
+      curl_mprintf("%ld.%06d to %ld.%06d got %" FMT_TIMEDIFF_T
+                   ", but expected %" FMT_TIMEDIFF_T "\n",
+                   (long)tests[i].first.tv_sec,
+                   tests[i].first.tv_usec,
+                   (long)tests[i].second.tv_sec,
+                   tests[i].second.tv_usec,
+                   result,
+                   tests[i].result);
       fail("unexpected result!");
     }
   }
+
+  UNITTEST_END_SIMPLE
 }
-UNITTEST_STOP
diff --git a/third-party/curl/tests/unit/unit1330.c b/third-party/curl/tests/unit/unit1330.c
index 2e27e8093f..79df0e58df 100644
--- a/third-party/curl/tests/unit/unit1330.c
+++ b/third-party/curl/tests/unit/unit1330.c
@@ -21,23 +21,14 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
+#include "unitcheck.h"
 
-#include "memdebug.h"
-
-
-static CURLcode unit_setup(void)
+static CURLcode test_unit1330(const char *arg)
 {
-  return CURLE_OK;
+  UNITTEST_BEGIN_SIMPLE
+
+  char *ptr = curlx_malloc(1330);
+  curlx_safefree(ptr);
+
+  UNITTEST_END_SIMPLE
 }
-
-static void unit_stop(void)
-{
-}
-
-UNITTEST_START
-
-char *ptr = malloc(1330);
-Curl_safefree(ptr);
-
-UNITTEST_STOP
diff --git a/third-party/curl/tests/unit/unit1394.c b/third-party/curl/tests/unit/unit1394.c
deleted file mode 100644
index e4e9981844..0000000000
--- a/third-party/curl/tests/unit/unit1394.c
+++ /dev/null
@@ -1,133 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "curlcheck.h"
-
-#include "tool_getparam.h"
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include "memdebug.h" /* LAST include file */
-
-static CURLcode unit_setup(void)
-{
-  return CURLE_OK;
-}
-
-static void unit_stop(void)
-{
-
-}
-
-UNITTEST_START
-
-  const char *values[] = {
-    /* -E parameter */        /* exp. cert name */  /* exp. passphrase */
-    "foo:bar:baz",            "foo",                "bar:baz",
-    "foo\\:bar:baz",          "foo:bar",            "baz",
-    "foo\\\\:bar:baz",        "foo\\",              "bar:baz",
-    "foo:bar\\:baz",          "foo",                "bar\\:baz",
-    "foo:bar\\\\:baz",        "foo",                "bar\\\\:baz",
-    "foo\\bar\\baz",          "foo\\bar\\baz",      NULL,
-    "foo\\\\bar\\\\baz",      "foo\\bar\\baz",      NULL,
-    "foo\\",                  "foo\\",              NULL,
-    "foo\\\\",                "foo\\",              NULL,
-    "foo:bar\\",              "foo",                "bar\\",
-    "foo:bar\\\\",            "foo",                "bar\\\\",
-    "foo:bar:",               "foo",                "bar:",
-    "foo\\::bar\\:",          "foo:",               "bar\\:",
-    "pkcs11:foobar",          "pkcs11:foobar",      NULL,
-    "PKCS11:foobar",          "PKCS11:foobar",      NULL,
-    "PkCs11:foobar",          "PkCs11:foobar",      NULL,
-#ifdef WIN32
-    "c:\\foo:bar:baz",        "c:\\foo",            "bar:baz",
-    "c:\\foo\\:bar:baz",      "c:\\foo:bar",        "baz",
-    "c:\\foo\\\\:bar:baz",    "c:\\foo\\",          "bar:baz",
-    "c:\\foo:bar\\:baz",      "c:\\foo",            "bar\\:baz",
-    "c:\\foo:bar\\\\:baz",    "c:\\foo",            "bar\\\\:baz",
-    "c:\\foo\\bar\\baz",      "c:\\foo\\bar\\baz",  NULL,
-    "c:\\foo\\\\bar\\\\baz",  "c:\\foo\\bar\\baz",  NULL,
-    "c:\\foo\\",              "c:\\foo\\",          NULL,
-    "c:\\foo\\\\",            "c:\\foo\\",          NULL,
-    "c:\\foo:bar\\",          "c:\\foo",            "bar\\",
-    "c:\\foo:bar\\\\",        "c:\\foo",            "bar\\\\",
-    "c:\\foo:bar:",           "c:\\foo",            "bar:",
-    "c:\\foo\\::bar\\:",      "c:\\foo:",           "bar\\:",
-#endif
-    NULL,                     NULL,                 NULL,
-  };
-  const char **p;
-  char *certname, *passphrase;
-  for(p = values; *p; p += 3) {
-    parse_cert_parameter(p[0], &certname, &passphrase);
-    if(p[1]) {
-      if(certname) {
-        if(strcmp(p[1], certname)) {
-          printf("expected certname '%s' but got '%s' "
-              "for -E param '%s'\n", p[1], certname, p[0]);
-          fail("assertion failure");
-        }
-      }
-      else {
-        printf("expected certname '%s' but got NULL "
-            "for -E param '%s'\n", p[1], p[0]);
-        fail("assertion failure");
-      }
-    }
-    else {
-      if(certname) {
-        printf("expected certname NULL but got '%s' "
-            "for -E param '%s'\n", certname, p[0]);
-        fail("assertion failure");
-      }
-    }
-    if(p[2]) {
-      if(passphrase) {
-        if(strcmp(p[2], passphrase)) {
-          printf("expected passphrase '%s' but got '%s'"
-              "for -E param '%s'\n", p[2], passphrase, p[0]);
-          fail("assertion failure");
-        }
-      }
-      else {
-        printf("expected passphrase '%s' but got NULL "
-            "for -E param '%s'\n", p[2], p[0]);
-        fail("assertion failure");
-      }
-    }
-    else {
-      if(passphrase) {
-        printf("expected passphrase NULL but got '%s' "
-            "for -E param '%s'\n", passphrase, p[0]);
-        fail("assertion failure");
-      }
-    }
-    if(certname)
-      free(certname);
-    if(passphrase)
-      free(passphrase);
-  }
-
-UNITTEST_STOP
diff --git a/third-party/curl/tests/unit/unit1395.c b/third-party/curl/tests/unit/unit1395.c
index d01403f337..d25d0e3005 100644
--- a/third-party/curl/tests/unit/unit1395.c
+++ b/third-party/curl/tests/unit/unit1395.c
@@ -21,85 +21,155 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
+#include "unitcheck.h"
 
-/* copied from urlapi.c */
-extern int dedotdotify(const char *input, size_t clen, char **out);
-
-#include "memdebug.h"
-
-static CURLcode unit_setup(void)
+static CURLcode test_unit1395(const char *arg)
 {
-  return CURLE_OK;
-}
-
-static void unit_stop(void)
-{
-
-}
-
-struct dotdot {
-  const char *input;
-  const char *output;
-};
-
-UNITTEST_START
+  UNITTEST_BEGIN_SIMPLE
 
   unsigned int i;
   int fails = 0;
+
+  struct dotdot {
+    const char *input;
+    const char *output;
+  };
+
   const struct dotdot pairs[] = {
+    { "/%2f%2e%2e%2f/../a", "/a" },
+    { "/%2f%2e%2e%2f/../", "/" },
+    { "/%2f%2e%2e%2f/.", "/%2f%2e%2e%2f/" },
+    { "/%2f%2e%2e%2f/", "/%2f%2e%2e%2f/" },
+    { "/%2f%2e%2e%2f", "/%2f%2e%2e%2f" },
+    { "/%2f%2e%2e%2", "/%2f%2e%2e%2" },
+    { "/%2f%2e%2e%", "/%2f%2e%2e%" },
+    { "/%2f%2e%2e", "/%2f%2e%2e" },
+    { "/%2f%2e%2", "/%2f%2e%2" },
+    { "/%2f%2e%", "/%2f%2e%" },
+    { "/%2f%2e", "/%2f%2e" },
+    { "/%2f%2", "/%2f%2" },
+    { "/%2f%", "/%2f%" },
+    { "/%2f", "/%2f" },
+    { "/%2", "/%2" },
+    { "%2f%2e%2e%2f/../a", "%2f%2e%2e%2f/a" },
+    { "%2f%2e%2e%2f/../", "%2f%2e%2e%2f/" },
+    { "%2f%2e%2e%2f/.", "%2f%2e%2e%2f/" },
+    { "%2f%2e%2e%2f/", "%2f%2e%2e%2f/" },
+    { "%2f%2e%2e%2f", "%2f%2e%2e%2f" },
+    { "%2f%2e%2e%2", "%2f%2e%2e%2" },
+    { "%2f%2e%2e%", "%2f%2e%2e%" },
+    { "%2f%2e%2e", "%2f%2e%2e" },
+    { "%2f%2e%2", "%2f%2e%2" },
+    { "%2f%2e%", "%2f%2e%" },
+    { "%2f%2e", "%2f%2e" },
+    { "%2f%2", "%2f%2" },
+    { "%2f%", "%2f%" },
+    { "%2f", "%2f" },
+    { "%2", "%2" },
+    { "%", NULL },
+    { "2", NULL },
+    { "e", NULL },
+    { ".", NULL },
+    { "./", "" },
+    { "..", "" },
+    { "../", "" },
+    { "../a", "a" },
+    { "///moo.", "///moo." },
+    { ".///moo.", "//moo." },
+    { "./moo..", "moo.." },
+    { "./moo../", "moo../" },
+    { "./moo../.m", "moo../.m" },
+    { "./moo", "moo" },
+    { "../moo", "moo" },
+    { "../moo?", "moo?" },
+    { "../moo?#", "moo?#" },
+    { "../moo?#?..", "moo?#?.." },
+    { "/../moo/..", "/" },
+    { "/a/c/%2e%2E/b", "/a/b" },
+    { "/a/%2e/g", "/a/g" },
+    { "/a/b/c/./g", "/a/b/c/g" },
+    { "/a/c/../b", "/a/b" },
     { "/a/b/c/./../../g", "/a/g" },
+    { "/a/b/c/./%2e%2E/../g", "/a/g" },
+    { "/a/b/c/./../%2e%2E/g", "/a/g" },
+    { "/a/b/c/%2E/%2e%2E/%2e%2E/g", "/a/g" },
     { "mid/content=5/../6", "mid/6" },
     { "/hello/../moo", "/moo" },
     { "/1/../1", "/1" },
     { "/1/./1", "/1/1" },
+    { "/1/%2e/1", "/1/1" },
+    { "/1/%2E/1", "/1/1" },
     { "/1/..", "/" },
     { "/1/.", "/1/" },
+    { "/1/%2e", "/1/" },
+    { "/1/%2E", "/1/" },
     { "/1/./..", "/" },
+    { "/1/%2e/.%2E", "/" },
+    { "/1/./%2e.", "/" },
     { "/1/./../2", "/2" },
     { "/hello/1/./../2", "/hello/2" },
-    { "test/this", NULL },
+    { "test/this", "test/this" },
     { "test/this/../now", "test/now" },
-    { "/1../moo../foo", "/1../moo../foo"},
-    { "/../../moo", "/moo"},
-    { "/../../moo?", "/moo?"},
-    { "/123?", NULL},
-    { "/../moo/..?", "/" },
+    { "/1../moo../foo", "/1../moo../foo" },
+    { "/../../moo", "/moo" },
+    { "/../../moo?", "/moo?" },
+    { "/123?", "/123?" },
     { "/", NULL },
     { "", NULL },
     { "/.../", "/.../" },
-    { "./moo", "moo" },
-    { "../moo", "moo" },
     { "/.", "/" },
     { "/..", "/" },
     { "/moo/..", "/" },
     { "/..", "/" },
     { "/.", "/" },
+    { "////../a", "///a" },
+    { "/../../../../../../", "/" },
+    { "/..//..//", "//" },
+    { "/.config/../ssh", "/ssh" },
+    { "/..config/..", "/" },
+    { "/.../a", "/.../a" },
+    { "/a/%2E%2e/b", "/b" },
+    { "/a/%2e./b", "/b" },
+    { "/a/.%2e/b", "/b" },
+    { "/%2f..%2f", "/%2f..%2f" },
+    { "/a/b/.", "/a/b/" },
+    { "/a/b/..", "/a/" },
+    { "well-known", "well-known" },
+    { ".well-known", ".well-known" },
+    { "..well-known", "..well-known" },
+    { "...well-known", "...well-known" },
+    { "....well-known", "....well-known" },
+    { "%2ewell-known", "%2ewell-known" },
+    { "%2Ewell-known", "%2Ewell-known" },
+    { "../.well-known", ".well-known" },
   };
 
-  for(i = 0; i < sizeof(pairs)/sizeof(pairs[0]); i++) {
+  for(i = 0; i < CURL_ARRAYSIZE(pairs); i++) {
     char *out;
     int err = dedotdotify(pairs[i].input, strlen(pairs[i].input), &out);
     abort_unless(err == 0, "returned error");
     abort_if(err && out, "returned error with output");
 
-    if(out && strcmp(out, pairs[i].output)) {
-      fprintf(stderr, "Test %u: '%s' gave '%s' instead of '%s'\n",
-              i, pairs[i].input, out, pairs[i].output);
+    if(out && pairs[i].output && strcmp(out, pairs[i].output)) {
+      curl_mfprintf(stderr, "Test %u: '%s' gave '%s' instead of '%s'\n",
+                    i, pairs[i].input, out, pairs[i].output);
       fail("Test case output mismatched");
       fails++;
     }
-    else if(!out && pairs[i].output) {
-      fprintf(stderr, "Test %u: '%s' gave '%s' instead of NULL\n",
-              i, pairs[i].input, out);
+    else if((!out && pairs[i].output) ||
+            (out && !pairs[i].output)) {
+      curl_mfprintf(stderr, "Test %u: '%s' gave '%s' instead of '%s'\n",
+                    i, pairs[i].input, out ? out : "(null)",
+                    pairs[i].output ? pairs[i].output : "(null)");
       fail("Test case output mismatched");
       fails++;
     }
     else
-      fprintf(stderr, "Test %u: OK\n", i);
-    free(out);
+      curl_mfprintf(stderr, "Test %u: OK\n", i);
+    curlx_free(out);
   }
 
   fail_if(fails, "output mismatched");
 
-UNITTEST_STOP
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit1396.c b/third-party/curl/tests/unit/unit1396.c
index 43f9c86672..5b03e092bb 100644
--- a/third-party/curl/tests/unit/unit1396.c
+++ b/third-party/curl/tests/unit/unit1396.c
@@ -21,97 +21,97 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
+#include "unitcheck.h"
 
-static CURL *hnd;
-
-static CURLcode unit_setup(void)
+static CURLcode t1396_setup(void)
 {
-  CURLcode res = CURLE_OK;
-
+  CURLcode result = CURLE_OK;
   global_init(CURL_GLOBAL_ALL);
-  return res;
+  return result;
 }
 
-static void unit_stop(void)
+static void t1396_stop(CURL *easy)
 {
-  if(hnd)
-    curl_easy_cleanup(hnd);
+  if(easy)
+    curl_easy_cleanup(easy);
   curl_global_cleanup();
 }
 
-struct test {
-  const char *in;
-  int inlen;
-  const char *out;
-  int outlen;
-};
-
-UNITTEST_START
+static CURLcode test_unit1396(const char *arg)
 {
+  CURL *easy;
+
+  UNITTEST_BEGIN(t1396_setup())
+
+  struct test {
+    const char *in;
+    int inlen;
+    const char *out;
+    int outlen;
+  };
+
   /* unescape, this => that */
-  const struct test list1[]={
-    {"%61", 3, "a", 1},
-    {"%61a", 4, "aa", 2},
-    {"%61b", 4, "ab", 2},
-    {"%6 1", 4, "%6 1", 4},
-    {"%61", 1, "%", 1},
-    {"%61", 2, "%6", 2},
-    {"%6%a", 4, "%6%a", 4},
-    {"%6a", 0, "j", 1},
-    {"%FF", 0, "\xff", 1},
-    {"%FF%00%ff", 9, "\xff\x00\xff", 3},
-    {"%-2", 0, "%-2", 3},
-    {"%FG", 0, "%FG", 3},
-    {NULL, 0, NULL, 0} /* end of list marker */
+  const struct test list1[] = {
+    { "%61", 3, "a", 1 },
+    { "%61a", 4, "aa", 2 },
+    { "%61b", 4, "ab", 2 },
+    { "%6 1", 4, "%6 1", 4 },
+    { "%61", 1, "%", 1 },
+    { "%61", 2, "%6", 2 },
+    { "%6%a", 4, "%6%a", 4 },
+    { "%6a", 0, "j", 1 },
+    { "%FF", 0, "\xff", 1 },
+    { "%FF%00%ff", 9, "\xff\x00\xff", 3 },
+    { "%-2", 0, "%-2", 3 },
+    { "%FG", 0, "%FG", 3 },
+    { NULL, 0, NULL, 0 } /* end of list marker */
   };
   /* escape, this => that */
-  const struct test list2[]={
-    {"a", 1, "a", 1},
-    {"/", 1, "%2F", 3},
-    {"a=b", 3, "a%3Db", 5},
-    {"a=b", 0, "a%3Db", 5},
-    {"a=b", 1, "a", 1},
-    {"a=b", 2, "a%3D", 4},
-    {"1/./0", 5, "1%2F.%2F0", 9},
-    {"-._~!#%&", 0, "-._~%21%23%25%26", 16},
-    {"a", 2, "a%00", 4},
-    {"a\xff\x01g", 4, "a%FF%01g", 8},
-    {NULL, 0, NULL, 0} /* end of list marker */
+  const struct test list2[] = {
+    { "a", 1, "a", 1 },
+    { "/", 1, "%2F", 3 },
+    { "a=b", 3, "a%3Db", 5 },
+    { "a=b", 0, "a%3Db", 5 },
+    { "a=b", 1, "a", 1 },
+    { "a=b", 2, "a%3D", 4 },
+    { "1/./0", 5, "1%2F.%2F0", 9 },
+    { "-._~!#%&", 0, "-._~%21%23%25%26", 16 },
+    { "a", 2, "a%00", 4 },
+    { "a\xff\x01g", 4, "a%FF%01g", 8 },
+    { NULL, 0, NULL, 0 } /* end of list marker */
   };
   int i;
 
-  hnd = curl_easy_init();
-  abort_unless(hnd != NULL, "returned NULL!");
+  easy = curl_easy_init();
+  abort_unless(easy, "returned NULL!");
   for(i = 0; list1[i].in; i++) {
     int outlen;
-    char *out = curl_easy_unescape(hnd,
-                                   list1[i].in, list1[i].inlen,
-                                   &outlen);
+    char *out = curl_easy_unescape(easy, list1[i].in, list1[i].inlen, &outlen);
 
-    abort_unless(out != NULL, "returned NULL!");
+    abort_unless(out, "returned NULL!");
     fail_unless(outlen == list1[i].outlen, "wrong output length returned");
     fail_unless(!memcmp(out, list1[i].out, list1[i].outlen),
                 "bad output data returned");
 
-    printf("curl_easy_unescape test %d DONE\n", i);
+    curl_mprintf("curl_easy_unescape test %d DONE\n", i);
 
     curl_free(out);
   }
 
   for(i = 0; list2[i].in; i++) {
     int outlen;
-    char *out = curl_easy_escape(hnd, list2[i].in, list2[i].inlen);
-    abort_unless(out != NULL, "returned NULL!");
+    char *out = curl_easy_escape(easy, list2[i].in, list2[i].inlen);
+    abort_unless(out, "returned NULL!");
 
     outlen = (int)strlen(out);
     fail_unless(outlen == list2[i].outlen, "wrong output length returned");
     fail_unless(!memcmp(out, list2[i].out, list2[i].outlen),
                 "bad output data returned");
 
-    printf("curl_easy_escape test %d DONE (%s)\n", i, out);
+    curl_mprintf("curl_easy_escape test %d DONE (%s)\n", i, out);
 
     curl_free(out);
   }
+
+  UNITTEST_END(t1396_stop(easy))
 }
-UNITTEST_STOP
diff --git a/third-party/curl/tests/unit/unit1397.c b/third-party/curl/tests/unit/unit1397.c
index bf65d9231a..b133f2cc99 100644
--- a/third-party/curl/tests/unit/unit1397.c
+++ b/third-party/curl/tests/unit/unit1397.c
@@ -21,104 +21,94 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
+#include "unitcheck.h"
+#include "vtls/hostcheck.h"
 
-
-static CURLcode unit_setup(void)
+static CURLcode test_unit1397(const char *arg)
 {
-  return CURLE_OK;
-}
-
-static void unit_stop(void)
-{
-}
+  UNITTEST_BEGIN_SIMPLE
 
 /* only these backends define the tested functions */
 #if defined(USE_OPENSSL) || defined(USE_SCHANNEL)
-#include "vtls/hostcheck.h"
-struct testcase {
-  const char *host;
-  const char *pattern;
-  bool match;
-};
 
-static struct testcase tests[] = {
-  {"", "", FALSE},
-  {"a", "", FALSE},
-  {"", "b", FALSE},
-  {"a", "b", FALSE},
-  {"aa", "bb", FALSE},
-  {"\xff", "\xff", TRUE},
-  {"aa.aa.aa", "aa.aa.bb", FALSE},
-  {"aa.aa.aa", "aa.aa.aa", TRUE},
-  {"aa.aa.aa", "*.aa.bb", FALSE},
-  {"aa.aa.aa", "*.aa.aa", TRUE},
-  {"192.168.0.1", "192.168.0.1", TRUE},
-  {"192.168.0.1", "*.168.0.1", FALSE},
-  {"192.168.0.1", "*.0.1", FALSE},
-  {"h.ello", "*.ello", FALSE},
-  {"h.ello.", "*.ello", FALSE},
-  {"h.ello", "*.ello.", FALSE},
-  {"h.e.llo", "*.e.llo", TRUE},
-  {"h.e.llo", " *.e.llo", FALSE},
-  {" h.e.llo", "*.e.llo", TRUE},
-  {"h.e.llo.", "*.e.llo", TRUE},
-  {"*.e.llo.", "*.e.llo", TRUE},
-  {"************.e.llo.", "*.e.llo", TRUE},
-  {"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-   "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
-   "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"
-   "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
-   "EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
-   ".e.llo.", "*.e.llo", TRUE},
-  {"\xfe\xfe.e.llo.", "*.e.llo", TRUE},
-  {"h.e.llo.", "*.e.llo.", TRUE},
-  {"h.e.llo", "*.e.llo.", TRUE},
-  {".h.e.llo", "*.e.llo.", FALSE},
-  {"h.e.llo", "*.*.llo.", FALSE},
-  {"h.e.llo", "h.*.llo", FALSE},
-  {"h.e.llo", "h.e.*", FALSE},
-  {"hello", "*.ello", FALSE},
-  {"hello", "**llo", FALSE},
-  {"bar.foo.example.com", "*.example.com", FALSE},
-  {"foo.example.com", "*.example.com", TRUE},
-  {"baz.example.net", "b*z.example.net", FALSE},
-  {"foobaz.example.net", "*baz.example.net", FALSE},
-  {"xn--l8j.example.local", "x*.example.local", FALSE},
-  {"xn--l8j.example.net", "*.example.net", TRUE},
-  {"xn--l8j.example.net", "*j.example.net", FALSE},
-  {"xn--l8j.example.net", "xn--l8j.example.net", TRUE},
-  {"xn--l8j.example.net", "xn--l8j.*.net", FALSE},
-  {"xl8j.example.net", "*.example.net", TRUE},
-  {"fe80::3285:a9ff:fe46:b619", "*::3285:a9ff:fe46:b619", FALSE},
-  {"fe80::3285:a9ff:fe46:b619", "fe80::3285:a9ff:fe46:b619", TRUE},
-  {NULL, NULL, FALSE}
-};
+  struct testcase {
+    const char *host;
+    const char *pattern;
+    bool match;
+  };
+
+  static const struct testcase tests[] = {
+    { ".hello.com", "*.hello.com", FALSE },
+    { "a.hello.com", "*.hello.com", TRUE },
+    { "", "", FALSE },
+    { "a", "", FALSE },
+    { "", "b", FALSE },
+    { "a", "b", FALSE },
+    { "aa", "bb", FALSE },
+    { "\xff", "\xff", TRUE },
+    { "aa.aa.aa", "aa.aa.bb", FALSE },
+    { "aa.aa.aa", "aa.aa.aa", TRUE },
+    { "aa.aa.aa", "*.aa.bb", FALSE },
+    { "aa.aa.aa", "*.aa.aa", TRUE },
+    { "192.168.0.1", "192.168.0.1", TRUE },
+    { "192.168.0.1", "*.168.0.1", FALSE },
+    { "192.168.0.1", "*.0.1", FALSE },
+    { "h.ello", "*.ello", FALSE },
+    { "h.ello.", "*.ello", FALSE },
+    { "h.ello", "*.ello.", FALSE },
+    { "h.e.llo", "*.e.llo", TRUE },
+    { "h.e.llo", " *.e.llo", FALSE },
+    { " h.e.llo", "*.e.llo", TRUE },
+    { "h.e.llo.", "*.e.llo", TRUE },
+    { "*.e.llo.", "*.e.llo", TRUE },
+    { "************.e.llo.", "*.e.llo", TRUE },
+    { "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+      "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+      "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"
+      "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
+      "EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
+      ".e.llo.", "*.e.llo", TRUE },
+    { "\xfe\xfe.e.llo.", "*.e.llo", TRUE },
+    { "h.e.llo.", "*.e.llo.", TRUE },
+    { "h.e.llo", "*.e.llo.", TRUE },
+    { ".h.e.llo", "*.e.llo.", FALSE },
+    { "h.e.llo", "*.*.llo.", FALSE },
+    { "h.e.llo", "h.*.llo", FALSE },
+    { "h.e.llo", "h.e.*", FALSE },
+    { "hello", "*.ello", FALSE },
+    { "hello", "**llo", FALSE },
+    { "bar.foo.example.com", "*.example.com", FALSE },
+    { "foo.example.com", "*.example.com", TRUE },
+    { "baz.example.net", "b*z.example.net", FALSE },
+    { "foobaz.example.net", "*baz.example.net", FALSE },
+    { "xn--l8j.example.local", "x*.example.local", FALSE },
+    { "xn--l8j.example.net", "*.example.net", TRUE },
+    { "xn--l8j.example.net", "*j.example.net", FALSE },
+    { "xn--l8j.example.net", "xn--l8j.example.net", TRUE },
+    { "xn--l8j.example.net", "xn--l8j.*.net", FALSE },
+    { "xl8j.example.net", "*.example.net", TRUE },
+    { "fe80::3285:a9ff:fe46:b619", "*::3285:a9ff:fe46:b619", FALSE },
+    { "fe80::3285:a9ff:fe46:b619", "fe80::3285:a9ff:fe46:b619", TRUE },
+    { NULL, NULL, FALSE }
+  };
 
-UNITTEST_START
-{
   int i;
   for(i = 0; tests[i].host; i++) {
     if(tests[i].match != Curl_cert_hostcheck(tests[i].pattern,
                                              strlen(tests[i].pattern),
                                              tests[i].host,
                                              strlen(tests[i].host))) {
-      fprintf(stderr,
-              "HOST: %s\n"
-              "PTRN: %s\n"
-              "did %sMATCH\n",
-              tests[i].host,
-              tests[i].pattern,
-              tests[i].match ? "NOT ": "");
+      curl_mfprintf(stderr,
+                    "HOST: %s\n"
+                    "PTRN: %s\n"
+                    "did %sMATCH\n",
+                    tests[i].host,
+                    tests[i].pattern,
+                    tests[i].match ? "NOT " : "");
       unitfail++;
     }
   }
-}
-
-UNITTEST_STOP
-#else
-
-UNITTEST_START
-
-UNITTEST_STOP
 #endif
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit1398.c b/third-party/curl/tests/unit/unit1398.c
index bf8af12d36..7f2267e438 100644
--- a/third-party/curl/tests/unit/unit1398.c
+++ b/third-party/curl/tests/unit/unit1398.c
@@ -21,78 +21,205 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#define CURL_NO_FMT_CHECKS
+#include "unitcheck.h"
 
-#include "curlcheck.h"
+#ifdef CURL_HAVE_DIAG
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wformat"
+#endif
 
-#include "curl/mprintf.h"
+static CURLcode test_unit1398(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
 
-static CURLcode unit_setup(void) {return CURLE_OK;}
-static void unit_stop(void) {}
+  int rc;
+  char buf[3] = { 'b', 'u', 'g' };
+  static const char *str = "bug";
+  int width = 3;
+  char output[130];
 
-UNITTEST_START
+/* #define curl_msnprintf snprintf */
 
-int rc;
-char buf[3] = {'b', 'u', 'g'};
-const char *str = "bug";
-int width = 3;
-char output[24];
+  /* negative precision is treated as if omitted */
+  rc = curl_msnprintf(output, sizeof(output), "%.*s", -1, str);
+  fail_unless(rc == 3, "return code should be 3");
+  fail_unless(!strcmp(output, "bug"), "wrong output");
 
-/*#define curl_msnprintf snprintf */
+  rc = curl_msnprintf(output, sizeof(output), "%.*s", -1, "0123456789");
+  fail_unless(rc == 10, "return code should be 10");
+  fail_unless(!strcmp(output, "0123456789"), "wrong output");
 
-/* without a trailing zero */
-rc = curl_msnprintf(output, 4, "%.*s", width, buf);
-fail_unless(rc == 3, "return code should be 3");
-fail_unless(!strcmp(output, "bug"), "wrong output");
+  rc = curl_msnprintf(output, sizeof(output), "%.*s", 0, "0123456789");
+  fail_unless(rc == 0, "return code should be 0");
+  fail_unless(!strcmp(output, ""), "wrong output");
 
-/* with a trailing zero */
-rc = curl_msnprintf(output, 4, "%.*s", width, str);
-fail_unless(rc == 3, "return code should be 3");
-fail_unless(!strcmp(output, "bug"), "wrong output");
+  rc = curl_msnprintf(output, sizeof(output), "%.*s", -2, str);
+  fail_unless(rc == 3, "return code should be 3");
+  fail_unless(!strcmp(output, "bug"), "wrong output");
 
-width = 2;
-/* one byte less */
-rc = curl_msnprintf(output, 4, "%.*s", width, buf);
-fail_unless(rc == 2, "return code should be 2");
-fail_unless(!strcmp(output, "bu"), "wrong output");
+  rc = curl_msnprintf(output, sizeof(output), "%.*d", -3, 10000);
+  fail_unless(rc == 5, "return code should be 5");
+  fail_unless(!strcmp(output, "10000"), "wrong output");
 
-/* string with larger precision */
-rc = curl_msnprintf(output, 8, "%.8s", str);
-fail_unless(rc == 3, "return code should be 3");
-fail_unless(!strcmp(output, "bug"), "wrong output");
+  rc = curl_msnprintf(output, sizeof(output), "%.*d", 0, 1234567);
+  fail_unless(rc == 7, "return code should be 0");
+  fail_unless(!strcmp(output, "1234567"), "wrong output");
 
-/* longer string with precision */
-rc = curl_msnprintf(output, 8, "%.3s", "0123456789");
-fail_unless(rc == 3, "return code should be 3");
-fail_unless(!strcmp(output, "012"), "wrong output");
+  /* without a trailing zero */
+  rc = curl_msnprintf(output, 4, "%.*s", width, buf);
+  fail_unless(rc == 3, "return code should be 3");
+  fail_unless(!strcmp(output, "bug"), "wrong output");
 
-/* negative width */
-rc = curl_msnprintf(output, 8, "%-8s", str);
-fail_unless(rc == 7, "return code should be 7");
-fail_unless(!strcmp(output, "bug    "), "wrong output");
+  /* with a trailing zero */
+  rc = curl_msnprintf(output, 4, "%.*s", width, str);
+  fail_unless(rc == 3, "return code should be 3");
+  fail_unless(!strcmp(output, "bug"), "wrong output");
 
-/* larger width that string length */
-rc = curl_msnprintf(output, 8, "%8s", str);
-fail_unless(rc == 7, "return code should be 7");
-fail_unless(!strcmp(output, "     bu"), "wrong output");
+  width = 2;
+  /* one byte less */
+  rc = curl_msnprintf(output, 4, "%.*s", width, buf);
+  fail_unless(rc == 2, "return code should be 2");
+  fail_unless(!strcmp(output, "bu"), "wrong output");
 
-/* output a number in a limited output */
-rc = curl_msnprintf(output, 4, "%d", 10240);
-fail_unless(rc == 3, "return code should be 3");
-fail_unless(!strcmp(output, "102"), "wrong output");
+  /* string with larger precision */
+  rc = curl_msnprintf(output, 8, "%.8s", str);
+  fail_unless(rc == 3, "return code should be 3");
+  fail_unless(!strcmp(output, "bug"), "wrong output");
 
-/* padded strings */
-rc = curl_msnprintf(output, 16, "%8s%8s", str, str);
-fail_unless(rc == 15, "return code should be 15");
-fail_unless(!strcmp(output, "     bug     bu"), "wrong output");
+  /* longer string with precision */
+  rc = curl_msnprintf(output, 8, "%.3s", "0123456789");
+  fail_unless(rc == 3, "return code should be 3");
+  fail_unless(!strcmp(output, "012"), "wrong output");
 
-/* padded numbers */
-rc = curl_msnprintf(output, 16, "%8d%8d", 1234, 5678);
-fail_unless(rc == 15, "return code should be 15");
-fail_unless(!strcmp(output, "    1234    567"), "wrong output");
+  /* negative width */
+  rc = curl_msnprintf(output, 8, "%-8s", str);
+  fail_unless(rc == 7, "return code should be 7");
+  fail_unless(!strcmp(output, "bug    "), "wrong output");
 
-/* double precision */
-rc = curl_msnprintf(output, 24, "%.*1$.99d", 3, 5678);
-fail_unless(rc == 0, "return code should be 0");
+  /* larger width that string length */
+  rc = curl_msnprintf(output, 8, "%8s", str);
+  fail_unless(rc == 7, "return code should be 7");
+  fail_unless(!strcmp(output, "     bu"), "wrong output");
 
-UNITTEST_STOP
+  /* output a number in a limited output */
+  rc = curl_msnprintf(output, 4, "%d", 10240);
+  fail_unless(rc == 3, "return code should be 3");
+  fail_unless(!strcmp(output, "102"), "wrong output");
+
+  /* padded strings */
+  rc = curl_msnprintf(output, 16, "%8s%8s", str, str);
+  fail_unless(rc == 15, "return code should be 15");
+  fail_unless(!strcmp(output, "     bug     bu"), "wrong output");
+
+  /* padded numbers */
+  rc = curl_msnprintf(output, 16, "%8d%8d", 1234, 5678);
+  fail_unless(rc == 15, "return code should be 15");
+  fail_unless(!strcmp(output, "    1234    567"), "wrong output");
+
+#if defined(__clang__) && \
+  (__clang_major__ > 3 || (__clang_major__ == 3 && __clang_minor__ >= 1))
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wformat-non-iso"
+#endif
+  /* double precision */
+  rc = curl_msnprintf(output, 24, "%2$.*1$.99d", 3, 5678);
+  fail_unless(rc == 0, "return code should be 0");
+#if defined(__clang__) && \
+  (__clang_major__ > 3 || (__clang_major__ == 3 && __clang_minor__ >= 1))
+#pragma clang diagnostic pop
+#endif
+
+  /* 129 input % flags */
+  rc = curl_msnprintf(output, 130,
+                      "%s%s%s%s%s%s%s%s%s%s" /* 10 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 20 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 30 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 40 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 50 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 60 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 70 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 80 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 90 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 100 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 110 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 120 */
+                      "%s%s%s%s%s%s%s%s%s",  /* 129 */
+
+                      "a", "", "", "", "", "", "", "", "", "", /* 10 */
+                      "b", "", "", "", "", "", "", "", "", "", /* 20 */
+                      "c", "", "", "", "", "", "", "", "", "", /* 30 */
+                      "d", "", "", "", "", "", "", "", "", "", /* 40 */
+                      "e", "", "", "", "", "", "", "", "", "", /* 50 */
+                      "f", "", "", "", "", "", "", "", "", "", /* 60 */
+                      "g", "", "", "", "", "", "", "", "", "", /* 70 */
+                      "h", "", "", "", "", "", "", "", "", "", /* 80 */
+                      "i", "", "", "", "", "", "", "", "", "", /* 90 */
+                      "j", "", "", "", "", "", "", "", "", "", /* 100 */
+                      "k", "", "", "", "", "", "", "", "", "", /* 110 */
+                      "l", "", "", "", "", "", "", "", "", "", /* 120 */
+                      "m", "", "", "", "", "", "", "", ""      /* 129 */
+  );
+  fail_unless(rc == 0, "return code should be 0");
+
+  /* 128 input % flags */
+  rc = curl_msnprintf(output, 130,
+                      "%s%s%s%s%s%s%s%s%s%s" /* 10 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 20 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 30 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 40 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 50 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 60 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 70 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 80 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 90 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 100 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 110 */
+                      "%s%s%s%s%s%s%s%s%s%s" /* 120 */
+                      "%s%s%s%s%s%s%s%s",    /* 128 */
+
+                      "a", "", "", "", "", "", "", "", "", "", /* 10 */
+                      "b", "", "", "", "", "", "", "", "", "", /* 20 */
+                      "c", "", "", "", "", "", "", "", "", "", /* 30 */
+                      "d", "", "", "", "", "", "", "", "", "", /* 40 */
+                      "e", "", "", "", "", "", "", "", "", "", /* 50 */
+                      "f", "", "", "", "", "", "", "", "", "", /* 60 */
+                      "g", "", "", "", "", "", "", "", "", "", /* 70 */
+                      "h", "", "", "", "", "", "", "", "", "", /* 80 */
+                      "i", "", "", "", "", "", "", "", "", "", /* 90 */
+                      "j", "", "", "", "", "", "", "", "", "", /* 100 */
+                      "k", "", "", "", "", "", "", "", "", "", /* 110 */
+                      "l", "", "", "", "", "", "", "", "", "", /* 120 */
+                      "m", "", "", "", "", "", "", ""          /* 128 */
+  );
+  fail_unless(rc == 13, "return code should be 13");
+
+  /* 129 output segments */
+  rc = curl_msnprintf(output, 130,
+                      "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%" /* 20 */
+                      "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%" /* 40 */
+                      "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%" /* 60 */
+                      "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%" /* 80 */
+                      "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%" /* 100 */
+                      "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%" /* 120 */
+                      "%%%%%%%%%%%%%%%%%%"                       /* 129 */
+  );
+  fail_unless(rc == 0, "return code should be 0");
+
+  /* 128 output segments */
+  rc = curl_msnprintf(output, 129,
+                      "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%" /* 20 */
+                      "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%" /* 40 */
+                      "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%" /* 60 */
+                      "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%" /* 80 */
+                      "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%" /* 100 */
+                      "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%" /* 120 */
+                      "%%%%%%%%%%%%%%%%"                         /* 128 */
+  );
+  fail_unless(rc == 128, "return code should be 128");
+
+  UNITTEST_END_SIMPLE
+}
+
+#ifdef CURL_HAVE_DIAG
+#pragma GCC diagnostic pop
+#endif
diff --git a/third-party/curl/tests/unit/unit1399.c b/third-party/curl/tests/unit/unit1399.c
index 1a293ac76b..909b13e8b2 100644
--- a/third-party/curl/tests/unit/unit1399.c
+++ b/third-party/curl/tests/unit/unit1399.c
@@ -21,21 +21,27 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "urldata.h"
 #include "progress.h"
 
-static int usec_magnitude = 1000000;
-
-static bool unit_setup(void)
+static CURLcode t1399_setup(struct Curl_easy **easy)
 {
-  return CURLE_OK;
+  CURLcode result = CURLE_OK;
+
+  global_init(CURL_GLOBAL_ALL);
+  *easy = curl_easy_init();
+  if(!*easy) {
+    curl_global_cleanup();
+    return CURLE_OUT_OF_MEMORY;
+  }
+  return result;
 }
 
-static void unit_stop(void)
+static void t1399_stop(struct Curl_easy *easy)
 {
-
+  curl_easy_cleanup(easy);
+  curl_global_cleanup();
 }
 
 /*
@@ -54,18 +60,21 @@ static void fake_t_startsingle_time(struct Curl_easy *data,
 
 static bool usec_matches_seconds(timediff_t time_usec, int expected_seconds)
 {
+  static int usec_magnitude = 1000000;
+
   int time_sec = (int)(time_usec / usec_magnitude);
   bool same = (time_sec == expected_seconds);
-  fprintf(stderr, "is %d us same as %d seconds? %s\n",
-          (int)time_usec, expected_seconds,
-          same?"Yes":"No");
+  curl_mfprintf(stderr, "is %d us same as %d seconds? %s\n",
+                (int)time_usec, expected_seconds,
+                same ? "Yes" : "No");
   return same;
 }
 
 static void expect_timer_seconds(struct Curl_easy *data, int seconds)
 {
   char msg[64];
-  msnprintf(msg, sizeof(msg), "about %d seconds should have passed", seconds);
+  curl_msnprintf(msg, sizeof(msg), "about %d seconds should have passed",
+                 seconds);
   fail_unless(usec_matches_seconds(data->progress.t_nslookup, seconds), msg);
   fail_unless(usec_matches_seconds(data->progress.t_connect, seconds), msg);
   fail_unless(usec_matches_seconds(data->progress.t_appconnect, seconds), msg);
@@ -80,40 +89,47 @@ static void expect_timer_seconds(struct Curl_easy *data, int seconds)
  * E.g., if t_starttransfer took 2 seconds initially and took another 1
  * second for the redirect request, then the resulting t_starttransfer should
  * be 3 seconds. */
-UNITTEST_START
-  struct Curl_easy data;
-  struct curltime now = Curl_now();
+static CURLcode test_unit1399(const char *arg)
+{
+  struct Curl_easy *data;
+  struct curltime now = curlx_now();
 
-  data.progress.t_nslookup = 0;
-  data.progress.t_connect = 0;
-  data.progress.t_appconnect = 0;
-  data.progress.t_pretransfer = 0;
-  data.progress.t_starttransfer = 0;
-  data.progress.t_redirect = 0;
-  data.progress.start.tv_sec = now.tv_sec - 2;
-  data.progress.start.tv_usec = now.tv_usec;
-  fake_t_startsingle_time(&data, now, -2);
+  UNITTEST_BEGIN(t1399_setup(&data))
 
-  Curl_pgrsTime(&data, TIMER_NAMELOOKUP);
-  Curl_pgrsTime(&data, TIMER_CONNECT);
-  Curl_pgrsTime(&data, TIMER_APPCONNECT);
-  Curl_pgrsTime(&data, TIMER_PRETRANSFER);
-  Curl_pgrsTime(&data, TIMER_STARTTRANSFER);
+  data->multi = NULL;
+  data->progress.now = now;
+  data->progress.t_nslookup = 0;
+  data->progress.t_connect = 0;
+  data->progress.t_appconnect = 0;
+  data->progress.t_pretransfer = 0;
+  data->progress.t_starttransfer = 0;
+  data->progress.t_redirect = 0;
+  data->progress.start.tv_sec = now.tv_sec - 2;
+  data->progress.start.tv_usec = now.tv_usec;
+  fake_t_startsingle_time(data, now, -2);
 
-  expect_timer_seconds(&data, 2);
+  Curl_pgrsTime(data, TIMER_NAMELOOKUP);
+  Curl_pgrsTime(data, TIMER_CONNECT);
+  Curl_pgrsTime(data, TIMER_APPCONNECT);
+  Curl_pgrsTime(data, TIMER_PRETRANSFER);
+  Curl_pgrsTime(data, TIMER_STARTTRANSFER);
+
+  expect_timer_seconds(data, 2);
 
   /* now simulate the redirect */
-  data.progress.t_redirect = data.progress.t_starttransfer + 1;
-  fake_t_startsingle_time(&data, now, -1);
+  data->progress.t_redirect = data->progress.t_starttransfer + 1;
+  fake_t_startsingle_time(data, now, -1);
 
-  Curl_pgrsTime(&data, TIMER_NAMELOOKUP);
-  Curl_pgrsTime(&data, TIMER_CONNECT);
-  Curl_pgrsTime(&data, TIMER_APPCONNECT);
-  Curl_pgrsTime(&data, TIMER_PRETRANSFER);
+  Curl_pgrsTime(data, TIMER_NAMELOOKUP);
+  Curl_pgrsTime(data, TIMER_CONNECT);
+  Curl_pgrsTime(data, TIMER_APPCONNECT);
+  Curl_pgrsTime(data, TIMER_PRETRANSFER);
   /* ensure t_starttransfer is only set on the first invocation by attempting
    * to set it twice */
-  Curl_pgrsTime(&data, TIMER_STARTTRANSFER);
-  Curl_pgrsTime(&data, TIMER_STARTTRANSFER);
+  Curl_pgrsTime(data, TIMER_STARTTRANSFER);
+  Curl_pgrsTime(data, TIMER_STARTTRANSFER);
 
-  expect_timer_seconds(&data, 3);
-UNITTEST_STOP
+  expect_timer_seconds(data, 3);
+
+  UNITTEST_END(t1399_stop(data))
+}
diff --git a/third-party/curl/tests/unit/unit1600.c b/third-party/curl/tests/unit/unit1600.c
index ee36c5e65c..011faccccd 100644
--- a/third-party/curl/tests/unit/unit1600.c
+++ b/third-party/curl/tests/unit/unit1600.c
@@ -21,55 +21,66 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "urldata.h"
 #include "curl_ntlm_core.h"
 
-static CURL *easy;
-
-static CURLcode unit_setup(void)
+static CURLcode t1600_setup(CURL **easy)
 {
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
-  easy = curl_easy_init();
-  if(!easy) {
+  *easy = curl_easy_init();
+  if(!*easy) {
     curl_global_cleanup();
     return CURLE_OUT_OF_MEMORY;
   }
-  return res;
+  return result;
 }
 
-static void unit_stop(void)
+static void t1600_stop(CURL *easy)
 {
   curl_easy_cleanup(easy);
   curl_global_cleanup();
 }
 
-UNITTEST_START
+static CURLcode test_unit1600(const char *arg)
+{
+  CURL *easy;
 
-#if defined(USE_NTLM) && (!defined(USE_WINDOWS_SSPI) || \
-                          defined(USE_WIN32_CRYPTO))
+  UNITTEST_BEGIN(t1600_setup(&easy))
+
+#if defined(USE_NTLM) &&                                    \
+  (!defined(USE_WINDOWS_SSPI) || defined(USE_WIN32_CRYPTO))
   unsigned char output[21];
-  unsigned char *testp = output;
+
   Curl_ntlm_core_mk_nt_hash("1", output);
 
-  verify_memory(testp,
-              "\x69\x94\x3c\x5e\x63\xb4\xd2\xc1\x04\xdb"
-              "\xbc\xc1\x51\x38\xb7\x2b\x00\x00\x00\x00\x00", 21);
+  verify_memory(output,
+                "\x69\x94\x3c\x5e\x63\xb4\xd2\xc1\x04\xdb"
+                "\xbc\xc1\x51\x38\xb7\x2b\x00\x00\x00\x00\x00",
+                21);
 
   Curl_ntlm_core_mk_nt_hash("hello-you-fool", output);
 
-  verify_memory(testp,
-              "\x39\xaf\x87\xa6\x75\x0a\x7a\x00\xba\xa0"
-              "\xd3\x4f\x04\x9e\xc1\xd0\x00\x00\x00\x00\x00", 21);
+  verify_memory(output,
+                "\x39\xaf\x87\xa6\x75\x0a\x7a\x00\xba\xa0"
+                "\xd3\x4f\x04\x9e\xc1\xd0\x00\x00\x00\x00\x00",
+                21);
 
-/* !checksrc! disable LONGLINE 2 */
-  Curl_ntlm_core_mk_nt_hash("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", output);
+  Curl_ntlm_core_mk_nt_hash(
+    "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+    "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+    "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+    "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+    "AAAAAAAA",
+    output);
 
-  verify_memory(testp,
-                "\x36\x9d\xae\x06\x84\x7e\xe1\xc1\x4a\x94\x39\xea\x6f\x44\x8c\x65\x00\x00\x00\x00\x00", 21);
+  verify_memory(output,
+                "\x36\x9d\xae\x06\x84\x7e\xe1\xc1\x4a\x94\x39\xea\x6f\x44\x8c"
+                "\x65\x00\x00\x00\x00\x00",
+                21);
 #endif
 
-UNITTEST_STOP
+  UNITTEST_END(t1600_stop(easy))
+}
diff --git a/third-party/curl/tests/unit/unit1601.c b/third-party/curl/tests/unit/unit1601.c
index 4623bb7769..8da6f4c2fc 100644
--- a/third-party/curl/tests/unit/unit1601.c
+++ b/third-party/curl/tests/unit/unit1601.c
@@ -21,40 +21,30 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "curl_md5.h"
 
-static CURLcode unit_setup(void)
+static CURLcode test_unit1601(const char *arg)
 {
-  return CURLE_OK;
-}
+  UNITTEST_BEGIN_SIMPLE
 
-static void unit_stop(void)
-{
+#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) || \
+  !defined(CURL_DISABLE_DIGEST_AUTH)
 
-}
-
-UNITTEST_START
-
-#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) \
-    || !defined(CURL_DISABLE_DIGEST_AUTH)
-
-  const char string1[] = "1";
-  const char string2[] = "hello-you-fool";
+  static const char string1[] = "1";
+  static const char string2[] = "hello-you-fool";
   unsigned char output[MD5_DIGEST_LEN];
-  unsigned char *testp = output;
 
-  Curl_md5it(output, (const unsigned char *) string1, strlen(string1));
+  Curl_md5it(output, (const unsigned char *)string1, strlen(string1));
 
-  verify_memory(testp, "\xc4\xca\x42\x38\xa0\xb9\x23\x82\x0d\xcc\x50\x9a\x6f"
+  verify_memory(output, "\xc4\xca\x42\x38\xa0\xb9\x23\x82\x0d\xcc\x50\x9a\x6f"
                 "\x75\x84\x9b", MD5_DIGEST_LEN);
 
-  Curl_md5it(output, (const unsigned char *) string2, strlen(string2));
+  Curl_md5it(output, (const unsigned char *)string2, strlen(string2));
 
-  verify_memory(testp, "\x88\x67\x0b\x6d\x5d\x74\x2f\xad\xa5\xcd\xf9\xb6\x82"
+  verify_memory(output, "\x88\x67\x0b\x6d\x5d\x74\x2f\xad\xa5\xcd\xf9\xb6\x82"
                 "\x87\x5f\x22", MD5_DIGEST_LEN);
 #endif
 
-
-UNITTEST_STOP
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit1602.c b/third-party/curl/tests/unit/unit1602.c
index f7dc4a212d..cca3667a0d 100644
--- a/third-party/curl/tests/unit/unit1602.c
+++ b/third-party/curl/tests/unit/unit1602.c
@@ -21,36 +21,33 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
-#define ENABLE_CURLX_PRINTF
-#include "curlx.h"
-
+#include "unitcheck.h"
 #include "hash.h"
 
-#include "memdebug.h" /* LAST include file */
-
-static struct Curl_hash hash_static;
-
-static void mydtor(void *p)
+static void t1602_mydtor(void *p)
 {
   int *ptr = (int *)p;
-  free(ptr);
+  curlx_free(ptr);
 }
 
-static CURLcode unit_setup(void)
+static CURLcode t1602_setup(struct Curl_hash *hash)
 {
-  Curl_hash_init(&hash_static, 7, Curl_hash_str,
-                 Curl_str_key_compare, mydtor);
+  Curl_hash_init(hash, 7, Curl_hash_str,
+                 curlx_str_key_compare, t1602_mydtor);
   return CURLE_OK;
 }
 
-static void unit_stop(void)
+static void t1602_stop(struct Curl_hash *hash)
 {
-  Curl_hash_destroy(&hash_static);
+  Curl_hash_destroy(hash);
 }
 
-UNITTEST_START
+static CURLcode test_unit1602(const char *arg)
+{
+  struct Curl_hash hash;
+
+  UNITTEST_BEGIN(t1602_setup(&hash))
+
   int *value;
   int *value2;
   int *nodep;
@@ -59,23 +56,23 @@ UNITTEST_START
   int key = 20;
   int key2 = 25;
 
-
-  value = malloc(sizeof(int));
-  abort_unless(value != NULL, "Out of memory");
+  value = curlx_malloc(sizeof(int));
+  abort_unless(value, "Out of memory");
   *value = 199;
-  nodep = Curl_hash_add(&hash_static, &key, klen, value);
+  nodep = Curl_hash_add(&hash, &key, klen, value);
   if(!nodep)
-    free(value);
+    curlx_free(value);
   abort_unless(nodep, "insertion into hash failed");
-  Curl_hash_clean(&hash_static);
+  Curl_hash_clean(&hash);
 
   /* Attempt to add another key/value pair */
-  value2 = malloc(sizeof(int));
-  abort_unless(value2 != NULL, "Out of memory");
+  value2 = curlx_malloc(sizeof(int));
+  abort_unless(value2, "Out of memory");
   *value2 = 204;
-  nodep = Curl_hash_add(&hash_static, &key2, klen, value2);
+  nodep = Curl_hash_add(&hash, &key2, klen, value2);
   if(!nodep)
-    free(value2);
+    curlx_free(value2);
   abort_unless(nodep, "insertion into hash failed");
 
-UNITTEST_STOP
+  UNITTEST_END(t1602_stop(&hash))
+}
diff --git a/third-party/curl/tests/unit/unit1603.c b/third-party/curl/tests/unit/unit1603.c
index 004fdbccba..6ba89999c0 100644
--- a/third-party/curl/tests/unit/unit1603.c
+++ b/third-party/curl/tests/unit/unit1603.c
@@ -21,43 +21,51 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
-#define ENABLE_CURLX_PRINTF
-#include "curlx.h"
-
+#include "unitcheck.h"
 #include "hash.h"
 
-#include "memdebug.h" /* LAST include file */
+static const size_t slots = 3;
 
-static struct Curl_hash hash_static;
-static const int slots = 3;
-
-static void mydtor(void *p)
+static void t1603_mydtor(void *p)
 {
   /* Data are statically allocated */
- (void)p; /* unused */
+  (void)p;
 }
 
-static CURLcode unit_setup(void)
+static size_t elem_dtor_calls;
+
+static void my_elem_dtor(void *key, size_t key_len, void *p)
 {
-  Curl_hash_init(&hash_static, slots, Curl_hash_str,
-                 Curl_str_key_compare, mydtor);
+  (void)p;
+  (void)key;
+  (void)key_len;
+  ++elem_dtor_calls;
+}
+
+static CURLcode t1603_setup(struct Curl_hash *hash_static)
+{
+  Curl_hash_init(hash_static, slots, Curl_hash_str,
+                 curlx_str_key_compare, t1603_mydtor);
   return CURLE_OK;
 }
 
-static void unit_stop(void)
+static void t1603_stop(struct Curl_hash *hash_static)
 {
-  Curl_hash_destroy(&hash_static);
+  Curl_hash_destroy(hash_static);
 }
 
-UNITTEST_START
+static CURLcode test_unit1603(const char *arg)
+{
+  struct Curl_hash hash_static;
+
+  UNITTEST_BEGIN(t1603_setup(&hash_static))
+
   char key1[] = "key1";
   char key2[] = "key2b";
   char key3[] = "key3";
   char key4[] = "key4";
   char notakey[] = "notakey";
-  char *nodep;
+  const char *nodep;
   int rc;
 
   /* Ensure the key hashes are as expected in order to test both hash
@@ -67,8 +75,9 @@ UNITTEST_START
      Curl_hash_str(key2, strlen(key2), slots) != 0 ||
      Curl_hash_str(key3, strlen(key3), slots) != 2 ||
      Curl_hash_str(key4, strlen(key4), slots) != 1)
-    fprintf(stderr, "Warning: hashes are not computed as expected on this "
-            "architecture; test coverage will be less comprehensive\n");
+    curl_mfprintf(stderr,
+                  "Warning: hashes are not computed as expected on this "
+                  "architecture; test coverage is less comprehensive\n");
 
   nodep = Curl_hash_add(&hash_static, &key1, strlen(key1), &key1);
   fail_unless(nodep, "insertion into hash failed");
@@ -147,7 +156,23 @@ UNITTEST_START
   nodep = Curl_hash_pick(&hash_static, &key3, strlen(key3));
   fail_unless(nodep == key3, "hash retrieval failed");
 
+  /* Add element with own destructor */
+  nodep = Curl_hash_add2(&hash_static, &key1, strlen(key1), &key1,
+                         my_elem_dtor);
+  fail_unless(nodep, "add2 insertion into hash failed");
+  fail_unless(elem_dtor_calls == 0, "element destructor count should be 0");
+  /* Add it again, should invoke destructor on first */
+  nodep = Curl_hash_add2(&hash_static, &key1, strlen(key1), &key1,
+                         my_elem_dtor);
+  fail_unless(nodep, "add2 again, insertion into hash failed");
+  fail_unless(elem_dtor_calls == 1, "element destructor count should be 1");
+  /* remove, should invoke destructor */
+  rc = Curl_hash_delete(&hash_static, &key1, strlen(key1));
+  fail_unless(rc == 0, "hash delete failed");
+  fail_unless(elem_dtor_calls == 2, "element destructor count should be 1");
+
   /* Clean up */
   Curl_hash_clean(&hash_static);
 
-UNITTEST_STOP
+  UNITTEST_END(t1603_stop(&hash_static))
+}
diff --git a/third-party/curl/tests/unit/unit1604.c b/third-party/curl/tests/unit/unit1604.c
deleted file mode 100644
index 411b94a028..0000000000
--- a/third-party/curl/tests/unit/unit1604.c
+++ /dev/null
@@ -1,358 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "curlcheck.h"
-
-#include "tool_cfgable.h"
-#include "tool_doswin.h"
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include "memdebug.h" /* LAST include file */
-
-static CURLcode unit_setup(void)
-{
-  return CURLE_OK;
-}
-
-static void unit_stop(void)
-{
-
-}
-
-#if defined(MSDOS) || defined(WIN32)
-
-static char *getflagstr(int flags)
-{
-  char *buf = malloc(256);
-  if(buf) {
-    msnprintf(buf, 256, "%s,%s,%s,%s",
-              ((flags & SANITIZE_ALLOW_COLONS) ?
-               "SANITIZE_ALLOW_COLONS" : ""),
-              ((flags & SANITIZE_ALLOW_PATH) ?
-               "SANITIZE_ALLOW_PATH" : ""),
-              ((flags & SANITIZE_ALLOW_RESERVED) ?
-               "SANITIZE_ALLOW_RESERVED" : ""),
-              ((flags & SANITIZE_ALLOW_TRUNCATE) ?
-               "SANITIZE_ALLOW_TRUNCATE" : ""));
-  }
-  return buf;
-}
-
-static char *getcurlcodestr(int cc)
-{
-  char *buf = malloc(256);
-  if(buf) {
-    msnprintf(buf, 256, "%s (%d)",
-              (cc == SANITIZE_ERR_OK ? "SANITIZE_ERR_OK" :
-               cc == SANITIZE_ERR_BAD_ARGUMENT ? "SANITIZE_ERR_BAD_ARGUMENT" :
-               cc == SANITIZE_ERR_INVALID_PATH ? "SANITIZE_ERR_INVALID_PATH" :
-               cc == SANITIZE_ERR_OUT_OF_MEMORY ? "SANITIZE_ERR_OUT_OF_MEMORY":
-               "unexpected error code - add name"),
-              cc);
-  }
-  return buf;
-}
-
-struct data {
-  const char *input;
-  int flags;
-  const char *expected_output;
-  SANITIZEcode expected_result;
-};
-
-UNITTEST_START
-{ /* START sanitize_file_name */
-  struct data data[] = {
-    { "", 0,
-      "", SANITIZE_ERR_OK
-    },
-    { "normal filename", 0,
-      "normal filename", SANITIZE_ERR_OK
-    },
-    { "control\tchar", 0,
-      "control_char", SANITIZE_ERR_OK
-    },
-    { "banned*char", 0,
-      "banned_char", SANITIZE_ERR_OK
-    },
-    { "f:foo", 0,
-      "f_foo", SANITIZE_ERR_OK
-    },
-    { "f:foo", SANITIZE_ALLOW_COLONS,
-      "f:foo", SANITIZE_ERR_OK
-    },
-    { "f:foo", SANITIZE_ALLOW_PATH,
-      "f:foo", SANITIZE_ERR_OK
-    },
-    { "f:\\foo", 0,
-      "f__foo", SANITIZE_ERR_OK
-    },
-    { "f:\\foo", SANITIZE_ALLOW_PATH,
-      "f:\\foo", SANITIZE_ERR_OK
-    },
-    { "f:/foo", 0,
-      "f__foo", SANITIZE_ERR_OK
-    },
-    { "f:/foo", SANITIZE_ALLOW_PATH,
-      "f:/foo", SANITIZE_ERR_OK
-    },
-#ifndef MSDOS
-    { "\\\\?\\C:\\foo", SANITIZE_ALLOW_PATH,
-      "\\\\?\\C:\\foo", SANITIZE_ERR_OK
-    },
-    { "\\\\?\\C:\\foo", 0,
-      "____C__foo", SANITIZE_ERR_OK
-    },
-#endif
-    { "foo:bar", 0,
-      "foo_bar", SANITIZE_ERR_OK
-    },
-    { "foo|<>/bar\\\":?*baz", 0,
-      "foo____bar_____baz", SANITIZE_ERR_OK
-    },
-    { "f:foo::$DATA", 0,
-      "f_foo__$DATA", SANITIZE_ERR_OK
-    },
-    { "con . air", 0,
-      "con _ air", SANITIZE_ERR_OK
-    },
-    { "con.air", 0,
-      "con_air", SANITIZE_ERR_OK
-    },
-    { "con:/x", 0,
-      "con__x", SANITIZE_ERR_OK
-    },
-    { "file . . . .  ..  .", 0,
-      "file", SANITIZE_ERR_OK
-    },
-    { "foo . . ? . . ", 0,
-      "foo . . _", SANITIZE_ERR_OK
-    },
-    { "com1", 0,
-      "_com1", SANITIZE_ERR_OK
-    },
-    { "com1", SANITIZE_ALLOW_RESERVED,
-      "com1", SANITIZE_ERR_OK
-    },
-    { "f:\\com1", 0,
-      "f__com1", SANITIZE_ERR_OK
-    },
-    { "f:\\com1", SANITIZE_ALLOW_PATH,
-      "f:\\_com1", SANITIZE_ERR_OK
-    },
-    { "f:\\com1", SANITIZE_ALLOW_RESERVED,
-      "f__com1", SANITIZE_ERR_OK
-    },
-    { "f:\\com1", SANITIZE_ALLOW_RESERVED | SANITIZE_ALLOW_COLONS,
-      "f:_com1", SANITIZE_ERR_OK
-    },
-    { "f:\\com1", SANITIZE_ALLOW_RESERVED | SANITIZE_ALLOW_PATH,
-      "f:\\com1", SANITIZE_ERR_OK
-    },
-    { "com1:\\com1", SANITIZE_ALLOW_PATH,
-      "_com1:\\_com1", SANITIZE_ERR_OK
-    },
-    { "com1:\\com1", SANITIZE_ALLOW_RESERVED | SANITIZE_ALLOW_PATH,
-      "com1:\\com1", SANITIZE_ERR_OK
-    },
-    { "com1:\\com1", SANITIZE_ALLOW_RESERVED,
-      "com1__com1", SANITIZE_ERR_OK
-    },
-#ifndef MSDOS
-    { "\\com1", SANITIZE_ALLOW_PATH,
-      "\\_com1", SANITIZE_ERR_OK
-    },
-    { "\\\\com1", SANITIZE_ALLOW_PATH,
-      "\\\\com1", SANITIZE_ERR_OK
-    },
-    { "\\\\?\\C:\\com1", SANITIZE_ALLOW_PATH,
-      "\\\\?\\C:\\com1", SANITIZE_ERR_OK
-    },
-#endif
-    { "CoM1", 0,
-      "_CoM1", SANITIZE_ERR_OK
-    },
-    { "CoM1", SANITIZE_ALLOW_RESERVED,
-      "CoM1", SANITIZE_ERR_OK
-    },
-    { "COM56", 0,
-      "COM56", SANITIZE_ERR_OK
-    },
-    /* At the moment we expect a maximum path length of 259. I assume MSDOS
-       has variable max path lengths depending on compiler that are shorter
-       so currently these "good" truncate tests won't run on MSDOS */
-#ifndef MSDOS
-    { "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-      "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
-      "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"
-      "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
-      "EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
-      "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
-        SANITIZE_ALLOW_TRUNCATE,
-      "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-      "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
-      "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"
-      "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
-      "EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
-      "FFFFF", SANITIZE_ERR_OK
-    },
-    { "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-      "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
-      "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"
-      "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
-      "EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
-      "FFF\\FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
-        SANITIZE_ALLOW_TRUNCATE | SANITIZE_ALLOW_PATH,
-      "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-      "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
-      "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"
-      "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
-      "EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
-      "FFF\\FFFFF", SANITIZE_ERR_OK
-    },
-    { "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-      "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
-      "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"
-      "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
-      "EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
-      "FFF\\FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
-        SANITIZE_ALLOW_TRUNCATE,
-      "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-      "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
-      "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"
-      "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
-      "EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
-      "FFF_F", SANITIZE_ERR_OK
-    },
-#endif /* !MSDOS */
-    { "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-      "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
-      "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"
-      "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
-      "EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
-      "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
-        0,
-      NULL, SANITIZE_ERR_INVALID_PATH
-    },
-    { "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-      "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
-      "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"
-      "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
-      "EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
-      "FFFF\\FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
-        SANITIZE_ALLOW_TRUNCATE,
-      NULL, SANITIZE_ERR_INVALID_PATH
-    },
-    { "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-      "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
-      "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"
-      "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
-      "EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
-      "FFFFFFFFFFFFFFFFFFFFFFFFF\\FFFFFFFFFFFFFFFFFFFFFFFF",
-        SANITIZE_ALLOW_TRUNCATE | SANITIZE_ALLOW_PATH,
-      NULL, SANITIZE_ERR_INVALID_PATH
-    },
-    { "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-      "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
-      "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"
-      "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
-      "EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
-      "FFF\\FFFFFFFFFFFFFFFFFFFFF:FFFFFFFFFFFFFFFFFFFFFFFF",
-        SANITIZE_ALLOW_TRUNCATE | SANITIZE_ALLOW_PATH,
-      NULL, SANITIZE_ERR_INVALID_PATH
-    },
-    { "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-      "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
-      "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"
-      "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
-      "EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
-      "FF\\F:FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
-        SANITIZE_ALLOW_TRUNCATE | SANITIZE_ALLOW_PATH,
-      NULL, SANITIZE_ERR_INVALID_PATH
-    },
-    { NULL, 0,
-      NULL, SANITIZE_ERR_BAD_ARGUMENT
-    },
-  };
-
-  size_t i;
-
-  for(i = 0; i < sizeof(data) / sizeof(data[0]); ++i) {
-    char *output = NULL;
-    char *flagstr = NULL;
-    char *received_ccstr = NULL;
-    char *expected_ccstr = NULL;
-    SANITIZEcode res;
-
-    res = sanitize_file_name(&output, data[i].input, data[i].flags);
-
-    if(res == data[i].expected_result &&
-       ((!output && !data[i].expected_output) ||
-        (output && data[i].expected_output &&
-         !strcmp(output, data[i].expected_output)))) { /* OK */
-      free(output);
-      continue;
-    }
-
-    flagstr = getflagstr(data[i].flags);
-    abort_unless(flagstr, "out of memory");
-    received_ccstr = getcurlcodestr(res);
-    abort_unless(received_ccstr, "out of memory");
-    expected_ccstr = getcurlcodestr(data[i].expected_result);
-    abort_unless(expected_ccstr, "out of memory");
-
-    unitfail++;
-    fprintf(stderr, "\n"
-            "%s:%d sanitize_file_name failed.\n"
-            "input: %s\n"
-            "flags: %s\n"
-            "output: %s\n"
-            "result: %s\n"
-            "expected output: %s\n"
-            "expected result: %s\n",
-            __FILE__, __LINE__,
-            data[i].input,
-            flagstr,
-            (output ? output : "(null)"),
-            received_ccstr,
-            (data[i].expected_output ? data[i].expected_output : "(null)"),
-            expected_ccstr);
-
-    free(output);
-    free(flagstr);
-    free(received_ccstr);
-    free(expected_ccstr);
-  }
-} /* END sanitize_file_name */
-
-#else
-UNITTEST_START
-{
-  fprintf(stderr, "Skipped test not for this platform\n");
-}
-#endif /* MSDOS || WIN32 */
-
-UNITTEST_STOP
diff --git a/third-party/curl/tests/unit/unit1605.c b/third-party/curl/tests/unit/unit1605.c
index d0006d2b5f..baeb121085 100644
--- a/third-party/curl/tests/unit/unit1605.c
+++ b/third-party/curl/tests/unit/unit1605.c
@@ -21,39 +21,42 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "llist.h"
 
-static CURL *easy;
-
-static CURLcode unit_setup(void)
+static CURLcode t1605_setup(CURL **easy)
 {
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
-  easy = curl_easy_init();
-  if(!easy) {
+  *easy = curl_easy_init();
+  if(!*easy) {
     curl_global_cleanup();
     return CURLE_OUT_OF_MEMORY;
   }
-  return res;
+  return result;
 }
 
-static void unit_stop(void)
+static void t1605_stop(CURL *easy)
 {
   curl_easy_cleanup(easy);
   curl_global_cleanup();
 }
 
-UNITTEST_START
+static CURLcode test_unit1605(const char *arg)
+{
+  CURL *easy;
+
+  UNITTEST_BEGIN(t1605_setup(&easy))
+
   int len;
   char *esc;
 
   esc = curl_easy_escape(easy, "", -1);
-  fail_unless(esc == NULL, "negative string length can't work");
+  fail_unless(!esc, "negative string length cannot work");
 
   esc = curl_easy_unescape(easy, "%41%41%41%41", -1, &len);
-  fail_unless(esc == NULL, "negative string length can't work");
+  fail_unless(!esc, "negative string length cannot work");
 
-UNITTEST_STOP
+  UNITTEST_END(t1605_stop(easy))
+}
diff --git a/third-party/curl/tests/unit/unit1606.c b/third-party/curl/tests/unit/unit1606.c
index faa8941557..fb94f14698 100644
--- a/third-party/curl/tests/unit/unit1606.c
+++ b/third-party/curl/tests/unit/unit1606.c
@@ -21,50 +21,48 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
-#include "speedcheck.h"
+#include "unitcheck.h"
+#include "progress.h"
 #include "urldata.h"
 
-static CURL *easy;
-
-static CURLcode unit_setup(void)
+static CURLcode t1606_setup(struct Curl_easy **easy)
 {
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
-  easy = curl_easy_init();
-  if(!easy) {
+  *easy = curl_easy_init();
+  if(!*easy) {
     curl_global_cleanup();
     return CURLE_OUT_OF_MEMORY;
   }
-  return res;
+  return result;
 }
 
-static void unit_stop(void)
+static void t1606_stop(struct Curl_easy *easy)
 {
   curl_easy_cleanup(easy);
   curl_global_cleanup();
 }
 
-static int runawhile(long time_limit,
+static int runawhile(struct Curl_easy *easy,
+                     long time_limit,
                      long speed_limit,
                      curl_off_t speed,
                      int dec)
 {
   int counter = 1;
-  struct curltime now = {1, 0};
+  struct curltime now = { 1, 0 };
   CURLcode result;
   int finaltime;
 
   curl_easy_setopt(easy, CURLOPT_LOW_SPEED_LIMIT, speed_limit);
   curl_easy_setopt(easy, CURLOPT_LOW_SPEED_TIME, time_limit);
-  Curl_speedinit(easy);
+  Curl_pgrsReset(easy);
 
   do {
     /* fake the current transfer speed */
     easy->progress.current_speed = speed;
-    result = Curl_speedcheck(easy, now);
+    result = pgrs_speedcheck(easy, &now);
     if(result)
       break;
     /* step the time */
@@ -77,17 +75,18 @@ static int runawhile(long time_limit,
   return finaltime;
 }
 
-UNITTEST_START
-  fail_unless(runawhile(41, 41, 40, 0) == 41,
-              "wrong low speed timeout");
-  fail_unless(runawhile(21, 21, 20, 0) == 21,
-              "wrong low speed timeout");
-  fail_unless(runawhile(60, 60, 40, 0) == 60,
-              "wrong log speed timeout");
-  fail_unless(runawhile(50, 50, 40, 0) == 50,
-              "wrong log speed timeout");
-  fail_unless(runawhile(40, 40, 40, 0) == 99,
-              "should not time out");
-  fail_unless(runawhile(10, 50, 100, 2) == 36,
-              "bad timeout");
-UNITTEST_STOP
+static CURLcode test_unit1606(const char *arg)
+{
+  struct Curl_easy *easy;
+
+  UNITTEST_BEGIN(t1606_setup(&easy))
+
+  fail_unless(runawhile(easy, 41, 41, 40, 0) == 41, "wrong low speed timeout");
+  fail_unless(runawhile(easy, 21, 21, 20, 0) == 21, "wrong low speed timeout");
+  fail_unless(runawhile(easy, 60, 60, 40, 0) == 60, "wrong log speed timeout");
+  fail_unless(runawhile(easy, 50, 50, 40, 0) == 50, "wrong log speed timeout");
+  fail_unless(runawhile(easy, 40, 40, 40, 0) == 99, "should not time out");
+  fail_unless(runawhile(easy, 10, 50, 100, 2) == 36, "bad timeout");
+
+  UNITTEST_END(t1606_stop(easy))
+}
diff --git a/third-party/curl/tests/unit/unit1607.c b/third-party/curl/tests/unit/unit1607.c
index cd2657147d..d4052b762f 100644
--- a/third-party/curl/tests/unit/unit1607.c
+++ b/third-party/curl/tests/unit/unit1607.c
@@ -21,106 +21,95 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "urldata.h"
-#include "connect.h"
-#include "share.h"
+#include "curl_addrinfo.h"
 
-#include "memdebug.h" /* LAST include file */
-
-static void unit_stop(void)
+static CURLcode t1607_setup(void)
 {
-  curl_global_cleanup();
-}
-
-static CURLcode unit_setup(void)
-{
-  CURLcode res = CURLE_OK;
-
+  CURLcode result = CURLE_OK;
   global_init(CURL_GLOBAL_ALL);
-
-  return res;
+  return result;
 }
 
-struct testcase {
-  /* host:port:address[,address]... */
-  const char *optval;
-
-  /* lowercase host and port to retrieve the addresses from hostcache */
-  const char *host;
-  int port;
-
-  /* whether we expect a permanent or non-permanent cache entry */
-  bool permanent;
-
-  /* 0 to 9 addresses expected from hostcache */
-  const char *address[10];
-};
-
-
-/* In builds without IPv6 support CURLOPT_RESOLVE should skip over those
-   addresses, so we have to do that as well. */
-static const char skip = 0;
-#ifdef ENABLE_IPV6
+static CURLcode test_unit1607(const char *arg)
+{
+  /* In builds without IPv6 support CURLOPT_RESOLVE should skip over those
+     addresses, so we have to do that as well. */
+  static const char skip = 0;
+#ifdef USE_IPV6
 #define IPV6ONLY(x) x
 #else
 #define IPV6ONLY(x) &skip
 #endif
 
-/* CURLOPT_RESOLVE address parsing tests */
-static const struct testcase tests[] = {
-  /* spaces aren't allowed, for now */
-  { "test.com:80:127.0.0.1, 127.0.0.2",
-    "test.com", 80, TRUE, { NULL, }
-  },
-  { "TEST.com:80:,,127.0.0.1,,,127.0.0.2,,,,::1,,,",
-    "test.com", 80, TRUE, { "127.0.0.1", "127.0.0.2", IPV6ONLY("::1"), }
-  },
-  { "test.com:80:::1,127.0.0.1",
-    "test.com", 80, TRUE, { IPV6ONLY("::1"), "127.0.0.1", }
-  },
-  { "test.com:80:[::1],127.0.0.1",
-    "test.com", 80, TRUE, { IPV6ONLY("::1"), "127.0.0.1", }
-  },
-  { "test.com:80:::1",
-    "test.com", 80, TRUE, { IPV6ONLY("::1"), }
-  },
-  { "test.com:80:[::1]",
-    "test.com", 80, TRUE, { IPV6ONLY("::1"), }
-  },
-  { "test.com:80:127.0.0.1",
-    "test.com", 80, TRUE, { "127.0.0.1", }
-  },
-  { "test.com:80:,127.0.0.1",
-    "test.com", 80, TRUE, { "127.0.0.1", }
-  },
-  { "test.com:80:127.0.0.1,",
-    "test.com", 80, TRUE, { "127.0.0.1", }
-  },
-  { "test.com:0:127.0.0.1",
-    "test.com", 0, TRUE, { "127.0.0.1", }
-  },
-  { "+test.com:80:127.0.0.1,",
-    "test.com", 80, FALSE, { "127.0.0.1", }
-  },
-};
+  UNITTEST_BEGIN(t1607_setup())
 
-UNITTEST_START
-{
-  int i;
-  int testnum = sizeof(tests) / sizeof(struct testcase);
+  struct testcase {
+    /* host:port:address[,address]... */
+    const char *optval;
+
+    /* lowercase host and port to retrieve the addresses from hostcache */
+    const char *host;
+    int port;
+
+    /* whether we expect a permanent or non-permanent cache entry */
+    bool permanent;
+
+    /* 0 to 9 addresses expected from hostcache */
+    const char *address[10];
+  };
+
+  /* CURLOPT_RESOLVE address parsing tests */
+  static const struct testcase tests[] = {
+    /* spaces are not allowed, for now */
+    { "test.com:80:127.0.0.1, 127.0.0.2",
+      "test.com", 80, TRUE, { NULL, }
+    },
+    { "TEST.com:80:,,127.0.0.1,,,127.0.0.2,,,,::1,,,",
+      "test.com", 80, TRUE, { "127.0.0.1", "127.0.0.2", IPV6ONLY("::1"), }
+    },
+    { "test.com:80:::1,127.0.0.1",
+      "test.com", 80, TRUE, { IPV6ONLY("::1"), "127.0.0.1", }
+    },
+    { "test.com:80:[::1],127.0.0.1",
+      "test.com", 80, TRUE, { IPV6ONLY("::1"), "127.0.0.1", }
+    },
+    { "test.com:80:::1",
+      "test.com", 80, TRUE, { IPV6ONLY("::1"), }
+    },
+    { "test.com:80:[::1]",
+      "test.com", 80, TRUE, { IPV6ONLY("::1"), }
+    },
+    { "test.com:80:127.0.0.1",
+      "test.com", 80, TRUE, { "127.0.0.1", }
+    },
+    { "test.com:80:,127.0.0.1",
+      "test.com", 80, TRUE, { "127.0.0.1", }
+    },
+    { "test.com:80:127.0.0.1,",
+      "test.com", 80, TRUE, { "127.0.0.1", }
+    },
+    { "test.com:0:127.0.0.1",
+      "test.com", 0, TRUE, { "127.0.0.1", }
+    },
+    { "+test.com:80:127.0.0.1,",
+      "test.com", 80, FALSE, { "127.0.0.1", }
+    },
+  };
+
+  size_t i;
   struct Curl_multi *multi = NULL;
   struct Curl_easy *easy = NULL;
   struct curl_slist *list = NULL;
 
-  for(i = 0; i < testnum; ++i) {
-    int j;
-    int addressnum = sizeof(tests[i].address) / sizeof(*tests[i].address);
+  for(i = 0; i < CURL_ARRAYSIZE(tests); ++i) {
+    size_t j;
+    size_t addressnum = CURL_ARRAYSIZE(tests[i].address);
     struct Curl_addrinfo *addr;
     struct Curl_dns_entry *dns;
     void *entry_id;
-    bool problem = false;
+    bool problem = FALSE;
     easy = curl_easy_init();
     if(!easy)
       goto error;
@@ -137,18 +126,18 @@ UNITTEST_START
 
     Curl_loadhostpairs(easy);
 
-    entry_id = (void *)aprintf("%s:%d", tests[i].host, tests[i].port);
+    entry_id = (void *)curl_maprintf("%s:%d", tests[i].host, tests[i].port);
     if(!entry_id)
       goto error;
-    dns = Curl_hash_pick(easy->dns.hostcache, entry_id, strlen(entry_id) + 1);
-    free(entry_id);
-    entry_id = NULL;
+    dns = Curl_hash_pick(&multi->dnscache.entries,
+                         entry_id, strlen(entry_id) + 1);
+    curlx_safefree(entry_id);
 
     addr = dns ? dns->addr : NULL;
 
     for(j = 0; j < addressnum; ++j) {
-      int port = 0;
-      char ipaddress[MAX_IPADR_LEN] = {0};
+      uint16_t port = 0;
+      char ipaddress[MAX_IPADR_LEN] = { 0 };
 
       if(!addr && !tests[i].address[j])
         break;
@@ -156,62 +145,69 @@ UNITTEST_START
       if(tests[i].address[j] == &skip)
         continue;
 
-      if(addr && !Curl_addr2string(addr->ai_addr, addr->ai_addrlen,
-                                   ipaddress, &port)) {
-        fprintf(stderr, "%s:%d tests[%d] failed. getaddressinfo failed.\n",
-                __FILE__, __LINE__, i);
-        problem = true;
+      if(addr && !sockaddr2string(addr->ai_addr, addr->ai_addrlen,
+                                  ipaddress, &port)) {
+        curl_mfprintf(stderr, "%s:%d tests[%zu] failed. "
+                      "getaddressinfo failed.\n",
+                      __FILE__, __LINE__, i);
+        problem = TRUE;
         break;
       }
 
       if(addr && !tests[i].address[j]) {
-        fprintf(stderr, "%s:%d tests[%d] failed. the retrieved addr "
-                "is %s but tests[%d].address[%d] is NULL.\n",
-                __FILE__, __LINE__, i, ipaddress, i, j);
-        problem = true;
+        curl_mfprintf(stderr, "%s:%d tests[%zu] failed. the retrieved addr "
+                      "is %s but tests[%zu].address[%zu] is NULL.\n",
+                      __FILE__, __LINE__, i, ipaddress, i, j);
+        problem = TRUE;
         break;
       }
 
       if(!addr && tests[i].address[j]) {
-        fprintf(stderr, "%s:%d tests[%d] failed. the retrieved addr "
-                "is NULL but tests[%d].address[%d] is %s.\n",
-                __FILE__, __LINE__, i, i, j, tests[i].address[j]);
-        problem = true;
+        curl_mfprintf(stderr, "%s:%d tests[%zu] failed. the retrieved addr "
+                      "is NULL but tests[%zu].address[%zu] is %s.\n",
+                      __FILE__, __LINE__, i, i, j, tests[i].address[j]);
+        problem = TRUE;
         break;
       }
 
       if(!curl_strequal(ipaddress, tests[i].address[j])) {
-        fprintf(stderr, "%s:%d tests[%d] failed. the retrieved addr "
-                "%s is not equal to tests[%d].address[%d] %s.\n",
-                __FILE__, __LINE__, i, ipaddress, i, j, tests[i].address[j]);
-        problem = true;
+        curl_mfprintf(stderr, "%s:%d tests[%zu] failed. the retrieved addr "
+                      "%s is not equal to tests[%zu].address[%zu] %s.\n",
+                      __FILE__, __LINE__, i, ipaddress, i, j,
+                      tests[i].address[j]);
+        problem = TRUE;
         break;
       }
 
       if(port != tests[i].port) {
-        fprintf(stderr, "%s:%d tests[%d] failed. the retrieved port "
-                "for tests[%d].address[%d] is %d but tests[%d].port is %d.\n",
-                __FILE__, __LINE__, i, i, j, port, i, tests[i].port);
-        problem = true;
+        curl_mfprintf(stderr, "%s:%d tests[%zu] failed. the retrieved port "
+                      "for tests[%zu].address[%zu] is %d "
+                      "but tests[%zu].port is %d.\n",
+                      __FILE__, __LINE__, i, i, j, port, i, tests[i].port);
+        problem = TRUE;
         break;
       }
 
-      if(dns->timestamp && tests[i].permanent) {
-        fprintf(stderr, "%s:%d tests[%d] failed. the timestamp is not zero "
-                "but tests[%d].permanent is TRUE\n",
-                __FILE__, __LINE__, i, i);
-        problem = true;
+      if(dns->timestamp.tv_sec && tests[i].permanent) {
+        curl_mfprintf(stderr,
+                      "%s:%d tests[%zu] failed. the timestamp is not zero "
+                      "but tests[%zu].permanent is TRUE\n",
+                      __FILE__, __LINE__, i, i);
+        problem = TRUE;
         break;
       }
 
-      if(dns->timestamp == 0 && !tests[i].permanent) {
-        fprintf(stderr, "%s:%d tests[%d] failed. the timestamp is zero "
-                "but tests[%d].permanent is FALSE\n",
-                __FILE__, __LINE__, i, i);
-        problem = true;
+      if(dns->timestamp.tv_sec == 0 && !tests[i].permanent) {
+        curl_mfprintf(stderr, "%s:%d tests[%zu] failed. the timestamp is zero "
+                      "but tests[%zu].permanent is FALSE\n",
+                      __FILE__, __LINE__, i, i);
+        problem = TRUE;
         break;
       }
 
+      if(!addr)
+        break;
+
       addr = addr->ai_next;
     }
 
@@ -231,5 +227,6 @@ error:
   curl_easy_cleanup(easy);
   curl_multi_cleanup(multi);
   curl_slist_free_all(list);
+
+  UNITTEST_END(curl_global_cleanup())
 }
-UNITTEST_STOP
diff --git a/third-party/curl/tests/unit/unit1608.c b/third-party/curl/tests/unit/unit1608.c
index f734b77885..bc977e2154 100644
--- a/third-party/curl/tests/unit/unit1608.c
+++ b/third-party/curl/tests/unit/unit1608.c
@@ -21,48 +21,41 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
-#include "hostip.h"
+#include "unitcheck.h"
 
 #ifndef CURL_DISABLE_SHUFFLE_DNS
+#include "urldata.h"
+#include "curl_addrinfo.h"
 
-CURLcode Curl_shuffle_addr(struct Curl_easy *data,
-                           struct Curl_addrinfo **addr);
+static struct Curl_addrinfo addrs[8];
 
-#define NUM_ADDRS 8
-static struct Curl_addrinfo addrs[NUM_ADDRS];
-
-static CURLcode unit_setup(void)
+static CURLcode t1608_setup(void)
 {
-  int i;
-  for(i = 0; i < NUM_ADDRS - 1; i++) {
+  size_t i;
+  for(i = 0; i < CURL_ARRAYSIZE(addrs) - 1; i++) {
     addrs[i].ai_next = &addrs[i + 1];
   }
 
   return CURLE_OK;
 }
 
-static void unit_stop(void)
+static CURLcode test_unit1608(const char *arg)
 {
-  curl_global_cleanup();
-}
-
-UNITTEST_START
+  UNITTEST_BEGIN(t1608_setup())
 
   int i;
-  CURLcode code;
+  CURLcode result;
   struct Curl_addrinfo *addrhead = addrs;
 
   struct Curl_easy *easy = curl_easy_init();
   abort_unless(easy, "out of memory");
 
-  code = curl_easy_setopt(easy, CURLOPT_DNS_SHUFFLE_ADDRESSES, 1L);
-  abort_unless(code == CURLE_OK, "curl_easy_setopt failed");
+  result = curl_easy_setopt(easy, CURLOPT_DNS_SHUFFLE_ADDRESSES, 1L);
+  abort_unless(result == CURLE_OK, "curl_easy_setopt failed");
 
   /* Shuffle repeatedly and make sure that the list changes */
   for(i = 0; i < 10; i++) {
-    if(CURLE_OK != Curl_shuffle_addr(easy, &addrhead))
+    if(CURLE_OK != dns_shuffle_addr(easy, &addrhead))
       break;
     if(addrhead != addrs)
       break;
@@ -73,17 +66,15 @@ UNITTEST_START
 
   abort_unless(addrhead != addrs, "addresses are not being reordered");
 
-UNITTEST_STOP
+  UNITTEST_END(curl_global_cleanup())
+}
 
 #else
-static CURLcode unit_setup(void)
+
+static CURLcode test_unit1608(const char *arg)
 {
-  return CURLE_OK;
+  UNITTEST_BEGIN_SIMPLE
+  UNITTEST_END_SIMPLE
 }
-static void unit_stop(void)
-{
-}
-UNITTEST_START
-UNITTEST_STOP
 
 #endif
diff --git a/third-party/curl/tests/unit/unit1609.c b/third-party/curl/tests/unit/unit1609.c
index 19c59ada3e..1132a1a7cf 100644
--- a/third-party/curl/tests/unit/unit1609.c
+++ b/third-party/curl/tests/unit/unit1609.c
@@ -21,102 +21,93 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "urldata.h"
 #include "connect.h"
-#include "share.h"
+#include "curl_addrinfo.h"
 
-#include "memdebug.h" /* LAST include file */
-
-static void unit_stop(void)
+static CURLcode t1609_setup(void)
 {
-  curl_global_cleanup();
-}
-
-static CURLcode unit_setup(void)
-{
-  CURLcode res = CURLE_OK;
-
+  CURLcode result = CURLE_OK;
   global_init(CURL_GLOBAL_ALL);
-
-  return res;
+  return result;
 }
 
-struct testcase {
-  /* host:port:address[,address]... */
-  const char *optval;
-
-  /* lowercase host and port to retrieve the addresses from hostcache */
-  const char *host;
-  int port;
-
-  /* 0 to 9 addresses expected from hostcache */
-  const char *address[10];
-};
-
-
 /* CURLOPT_RESOLVE address parsing test - to test the following defect fix:
 
- 1) if there is already existing host:port pair in the DNS cache and
- we call CURLOPT_RESOLVE, it should also replace addresses.
- for example, if there is "test.com:80" with address "1.1.1.1"
- and we called CURLOPT_RESOLVE with address "2.2.2.2", then DNS entry needs to
- reflect that.
+  1. if there is already existing host:port pair in the DNS cache and
+     we call CURLOPT_RESOLVE, it should also replace addresses.
+     for example, if there is "test.com:80" with address "1.1.1.1"
+     and we called CURLOPT_RESOLVE with address "2.2.2.2", then DNS entry
+     needs to reflect that.
 
- 2) when cached address is already there and close to expire, then by the
- time request is made, it can get expired.  This happens because, when
- we set address using CURLOPT_RESOLVE,
- it usually marks as permanent (by setting timestamp to zero). However,
- if address already exists
-in the cache, then it does not mark it, but just leaves it as it is.
- So we fixing this by timestamp to zero if address already exists too.
+  2. when cached address is already there and close to expire, then by the
+     time request is made, it can get expired.  This happens because, when
+     we set address using CURLOPT_RESOLVE,
+     it usually marks as permanent (by setting timestamp to zero). However,
+     if address already exists in the cache, then it does not mark it, but
+     leaves it as it is.
+     We are fixing this by setting timestamp to zero if address already
+     exists too.
 
-Test:
+  Test:
 
- - insert new entry
- - verify that timestamp is not zero
- - call set options with CURLOPT_RESOLVE
- - then, call Curl_loadhostpairs
+  - insert new entry
+  - verify that timestamp is not zero
+  - call set options with CURLOPT_RESOLVE
+  - then, call Curl_loadhostpairs
 
- expected result: cached address has zero timestamp.
+  expected result: cached address has zero timestamp.
 
- - call set options with CURLOPT_RESOLVE with same host:port pair,
-   different address.
- - then, call Curl_loadhostpairs
+  - call set options with CURLOPT_RESOLVE with same host:port pair,
+    different address.
+  - then, call Curl_loadhostpairs
 
- expected result: cached address has zero timestamp and new address
+  expected result: cached address has zero timestamp and new address
 */
 
-static const struct testcase tests[] = {
-  /* spaces aren't allowed, for now */
-  { "test.com:80:127.0.0.1",
-    "test.com", 80, { "127.0.0.1", }
-  },
-  { "test.com:80:127.0.0.2",
-    "test.com", 80, { "127.0.0.2", }
-  },
-};
-
-UNITTEST_START
+static CURLcode test_unit1609(const char *arg)
 {
-  int i;
-  int testnum = sizeof(tests) / sizeof(struct testcase);
+  UNITTEST_BEGIN(t1609_setup())
+
+  struct testcase {
+    /* host:port:address[,address]... */
+    const char *optval;
+
+    /* lowercase host and port to retrieve the addresses from hostcache */
+    const char *host;
+    int port;
+
+    /* 0 to 9 addresses expected from hostcache */
+    const char *address[10];
+  };
+
+  static const struct testcase tests[] = {
+    /* spaces are not allowed, for now */
+    { "test.com:80:127.0.0.1",
+      "test.com", 80, { "127.0.0.1", }
+    },
+    { "test.com:80:127.0.0.2",
+      "test.com", 80, { "127.0.0.2", }
+    },
+  };
+
+  size_t i;
   struct Curl_multi *multi = NULL;
   struct Curl_easy *easy = NULL;
   struct curl_slist *list = NULL;
 
-/* important: we setup cache outside of the loop
-  and also clean cache after the loop. In contrast,for example,
-  test 1607 sets up and cleans cache on each iteration. */
+  /* important: we setup cache outside of the loop
+     and also clean cache after the loop. In contrast, for example,
+     test 1607 sets up and cleans cache on each iteration. */
 
-  for(i = 0; i < testnum; ++i) {
-    int j;
-    int addressnum = sizeof (tests[i].address) / sizeof (*tests[i].address);
+  for(i = 0; i < CURL_ARRAYSIZE(tests); ++i) {
+    size_t j;
+    size_t addressnum = CURL_ARRAYSIZE(tests[i].address);
     struct Curl_addrinfo *addr;
     struct Curl_dns_entry *dns;
     void *entry_id;
-    bool problem = false;
+    bool problem = FALSE;
     easy = curl_easy_init();
     if(!easy) {
       curl_global_cleanup();
@@ -138,69 +129,74 @@ UNITTEST_START
     if(Curl_loadhostpairs(easy))
       goto error;
 
-    entry_id = (void *)aprintf("%s:%d", tests[i].host, tests[i].port);
+    entry_id = (void *)curl_maprintf("%s:%d", tests[i].host, tests[i].port);
     if(!entry_id)
       goto error;
 
-    dns = Curl_hash_pick(easy->dns.hostcache, entry_id, strlen(entry_id) + 1);
-    free(entry_id);
-    entry_id = NULL;
+    dns = Curl_hash_pick(&multi->dnscache.entries,
+                         entry_id, strlen(entry_id) + 1);
+    curlx_safefree(entry_id);
 
     addr = dns ? dns->addr : NULL;
 
     for(j = 0; j < addressnum; ++j) {
-      int port = 0;
-      char ipaddress[MAX_IPADR_LEN] = {0};
+      uint16_t port = 0;
+      char ipaddress[MAX_IPADR_LEN] = { 0 };
 
       if(!addr && !tests[i].address[j])
         break;
 
-      if(addr && !Curl_addr2string(addr->ai_addr, addr->ai_addrlen,
-                                   ipaddress, &port)) {
-        fprintf(stderr, "%s:%d tests[%d] failed. Curl_addr2string failed.\n",
-                __FILE__, __LINE__, i);
-        problem = true;
+      if(addr && !sockaddr2string(addr->ai_addr, addr->ai_addrlen,
+                                  ipaddress, &port)) {
+        curl_mfprintf(stderr,
+                      "%s:%d tests[%zu] failed. Curl_addr2string failed.\n",
+                      __FILE__, __LINE__, i);
+        problem = TRUE;
         break;
       }
 
       if(addr && !tests[i].address[j]) {
-        fprintf(stderr, "%s:%d tests[%d] failed. the retrieved addr "
-                "is %s but tests[%d].address[%d] is NULL.\n",
-                __FILE__, __LINE__, i, ipaddress, i, j);
-        problem = true;
+        curl_mfprintf(stderr, "%s:%d tests[%zu] failed. the retrieved addr "
+                      "is %s but tests[%zu].address[%zu] is NULL.\n",
+                      __FILE__, __LINE__, i, ipaddress, i, j);
+        problem = TRUE;
         break;
       }
 
       if(!addr && tests[i].address[j]) {
-        fprintf(stderr, "%s:%d tests[%d] failed. the retrieved addr "
-                "is NULL but tests[%d].address[%d] is %s.\n",
-                __FILE__, __LINE__, i, i, j, tests[i].address[j]);
-        problem = true;
+        curl_mfprintf(stderr, "%s:%d tests[%zu] failed. the retrieved addr "
+                      "is NULL but tests[%zu].address[%zu] is %s.\n",
+                      __FILE__, __LINE__, i, i, j, tests[i].address[j]);
+        problem = TRUE;
         break;
       }
 
       if(!curl_strequal(ipaddress, tests[i].address[j])) {
-        fprintf(stderr, "%s:%d tests[%d] failed. the retrieved addr "
-                "%s is not equal to tests[%d].address[%d] %s.\n",
-                __FILE__, __LINE__, i, ipaddress, i, j, tests[i].address[j]);
-        problem = true;
+        curl_mfprintf(stderr, "%s:%d tests[%zu] failed. the retrieved addr "
+                      "%s is not equal to tests[%zu].address[%zu] %s.\n",
+                      __FILE__, __LINE__, i, ipaddress, i, j,
+                      tests[i].address[j]);
+        problem = TRUE;
         break;
       }
 
       if(port != tests[i].port) {
-        fprintf(stderr, "%s:%d tests[%d] failed. the retrieved port "
-                "for tests[%d].address[%d] is %d but tests[%d].port is %d.\n",
-                __FILE__, __LINE__, i, i, j, port, i, tests[i].port);
-        problem = true;
+        curl_mfprintf(stderr, "%s:%d tests[%zu] failed. the retrieved port "
+                      "for tests[%zu].address[%zu] is %d "
+                      "but tests[%zu].port is %d.\n",
+                      __FILE__, __LINE__, i, i, j, port, i, tests[i].port);
+        problem = TRUE;
         break;
       }
 
+      if(!addr)
+        break;
+
       addr = addr->ai_next;
     }
 
     curl_easy_cleanup(easy);
     easy = NULL;
-    Curl_hash_destroy(&multi->hostcache);
     curl_multi_cleanup(multi);
     multi = NULL;
     curl_slist_free_all(list);
@@ -216,5 +212,6 @@ error:
   curl_easy_cleanup(easy);
   curl_multi_cleanup(multi);
   curl_slist_free_all(list);
+
+  UNITTEST_END(curl_global_cleanup())
 }
-UNITTEST_STOP
diff --git a/third-party/curl/tests/unit/unit1610.c b/third-party/curl/tests/unit/unit1610.c
index b4c6ef4d34..450b5cf3c2 100644
--- a/third-party/curl/tests/unit/unit1610.c
+++ b/third-party/curl/tests/unit/unit1610.c
@@ -21,46 +21,43 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "curl_sha256.h"
 
-static CURLcode unit_setup(void)
+static CURLcode t1610_setup(void)
 {
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
   global_init(CURL_GLOBAL_ALL);
-  return res;
+  return result;
 }
 
-static void unit_stop(void)
+static CURLcode test_unit1610(const char *arg)
 {
-  curl_global_cleanup();
-}
+  UNITTEST_BEGIN(t1610_setup())
 
-UNITTEST_START
+#if !defined(CURL_DISABLE_AWS) || !defined(CURL_DISABLE_DIGEST_AUTH) || \
+  defined(USE_LIBSSH2)
 
-#if !defined(CURL_DISABLE_AWS) || !defined(CURL_DISABLE_DIGEST_AUTH) \
-    || defined(USE_LIBSSH2)
+  static const char string1[] = "1";
+  static const char string2[] = "hello-you-fool";
+  unsigned char output[CURL_SHA256_DIGEST_LENGTH];
 
-  const char string1[] = "1";
-  const char string2[] = "hello-you-fool";
-  unsigned char output[SHA256_DIGEST_LENGTH];
-  unsigned char *testp = output;
+  Curl_sha256it(output, (const unsigned char *)string1, strlen(string1));
 
-  Curl_sha256it(output, (const unsigned char *) string1, strlen(string1));
-
-  verify_memory(testp,
+  verify_memory(output,
                 "\x6b\x86\xb2\x73\xff\x34\xfc\xe1\x9d\x6b\x80\x4e\xff\x5a\x3f"
                 "\x57\x47\xad\xa4\xea\xa2\x2f\x1d\x49\xc0\x1e\x52\xdd\xb7\x87"
-                "\x5b\x4b", SHA256_DIGEST_LENGTH);
+                "\x5b\x4b",
+                CURL_SHA256_DIGEST_LENGTH);
 
-  Curl_sha256it(output, (const unsigned char *) string2, strlen(string2));
+  Curl_sha256it(output, (const unsigned char *)string2, strlen(string2));
 
-  verify_memory(testp,
+  verify_memory(output,
                 "\xcb\xb1\x6a\x8a\xb9\xcb\xb9\x35\xa8\xcb\xa0\x2e\x28\xc0\x26"
                 "\x30\xd1\x19\x9c\x1f\x02\x17\xf4\x7c\x96\x20\xf3\xef\xe8\x27"
-                "\x15\xae", SHA256_DIGEST_LENGTH);
+                "\x15\xae",
+                CURL_SHA256_DIGEST_LENGTH);
 #endif
 
-
-UNITTEST_STOP
+  UNITTEST_END(curl_global_cleanup())
+}
diff --git a/third-party/curl/tests/unit/unit1611.c b/third-party/curl/tests/unit/unit1611.c
index 0062ac6c37..15e5e5b6d1 100644
--- a/third-party/curl/tests/unit/unit1611.c
+++ b/third-party/curl/tests/unit/unit1611.c
@@ -21,40 +21,32 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "curl_md4.h"
 
-static CURLcode unit_setup(void)
+static CURLcode test_unit1611(const char *arg)
 {
-  return CURLE_OK;
-}
-
-static void unit_stop(void)
-{
-
-}
-
-UNITTEST_START
+  UNITTEST_BEGIN_SIMPLE
 
 #ifdef USE_CURL_NTLM_CORE
-  const char string1[] = "1";
-  const char string2[] = "hello-you-fool";
+  static const char string1[] = "1";
+  static const char string2[] = "hello-you-fool";
   unsigned char output[MD4_DIGEST_LENGTH];
-  unsigned char *testp = output;
 
-  Curl_md4it(output, (const unsigned char *) string1, strlen(string1));
+  Curl_md4it(output, (const unsigned char *)string1, strlen(string1));
 
-  verify_memory(testp,
+  verify_memory(output,
                 "\x8b\xe1\xec\x69\x7b\x14\xad\x3a\x53\xb3\x71\x43\x61\x20\x64"
-                "\x1d", MD4_DIGEST_LENGTH);
+                "\x1d",
+                MD4_DIGEST_LENGTH);
 
-  Curl_md4it(output, (const unsigned char *) string2, strlen(string2));
+  Curl_md4it(output, (const unsigned char *)string2, strlen(string2));
 
-  verify_memory(testp,
+  verify_memory(output,
                 "\xa7\x16\x1c\xad\x7e\xbe\xdb\xbc\xf8\xc7\x23\x10\x2d\x2c\xe2"
-                "\x0b", MD4_DIGEST_LENGTH);
+                "\x0b",
+                MD4_DIGEST_LENGTH);
 #endif
 
-
-UNITTEST_STOP
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit1612.c b/third-party/curl/tests/unit/unit1612.c
index 1f5b34d137..8518d65974 100644
--- a/third-party/curl/tests/unit/unit1612.c
+++ b/third-party/curl/tests/unit/unit1612.c
@@ -21,50 +21,42 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "curl_hmac.h"
 #include "curl_md5.h"
 
-static CURLcode unit_setup(void)
+static CURLcode test_unit1612(const char *arg)
 {
-  return CURLE_OK;
-}
+  UNITTEST_BEGIN_SIMPLE
 
-static void unit_stop(void)
-{
+#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) || \
+  !defined(CURL_DISABLE_DIGEST_AUTH)
 
-}
-
-UNITTEST_START
-
-#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) \
-    || !defined(CURL_DISABLE_DIGEST_AUTH)
-
-  const char password[] = "Pa55worD";
-  const char string1[] = "1";
-  const char string2[] = "hello-you-fool";
+  static const char password[] = "Pa55worD";
+  static const char string1[] = "1";
+  static const char string2[] = "hello-you-fool";
   unsigned char output[HMAC_MD5_LENGTH];
-  unsigned char *testp = output;
 
-  Curl_hmacit(Curl_HMAC_MD5,
-              (const unsigned char *) password, strlen(password),
-              (const unsigned char *) string1, strlen(string1),
+  Curl_hmacit(&Curl_HMAC_MD5,
+              (const unsigned char *)password, strlen(password),
+              (const unsigned char *)string1, strlen(string1),
               output);
 
-  verify_memory(testp,
+  verify_memory(output,
                 "\xd1\x29\x75\x43\x58\xdc\xab\x78\xdf\xcd\x7f\x2b\x29\x31\x13"
-                "\x37", HMAC_MD5_LENGTH);
+                "\x37",
+                HMAC_MD5_LENGTH);
 
-  Curl_hmacit(Curl_HMAC_MD5,
-              (const unsigned char *) password, strlen(password),
-              (const unsigned char *) string2, strlen(string2),
+  Curl_hmacit(&Curl_HMAC_MD5,
+              (const unsigned char *)password, strlen(password),
+              (const unsigned char *)string2, strlen(string2),
               output);
 
-  verify_memory(testp,
+  verify_memory(output,
                 "\x75\xf1\xa7\xb9\xf5\x40\xe5\xa4\x98\x83\x9f\x64\x5a\x27\x6d"
-                "\xd0", HMAC_MD5_LENGTH);
+                "\xd0",
+                HMAC_MD5_LENGTH);
 #endif
 
-
-UNITTEST_STOP
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit1614.c b/third-party/curl/tests/unit/unit1614.c
index ef03e3b4c7..0b6909284d 100644
--- a/third-party/curl/tests/unit/unit1614.c
+++ b/third-party/curl/tests/unit/unit1614.c
@@ -21,144 +21,171 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
+#include "unitcheck.h"
+#include "proxy.h"
 
-#include "noproxy.h"
-
-static CURLcode unit_setup(void)
+static CURLcode test_unit1614(const char *arg)
 {
-  return CURLE_OK;
-}
+  UNITTEST_BEGIN_SIMPLE
 
-static void unit_stop(void)
-{
-
-}
-
-struct check {
-  const char *a;
-  const char *n;
-  unsigned int bits;
-  bool match;
-};
-
-struct noproxy {
-  const char *a;
-  const char *n;
-  bool match;
-  bool space; /* space separated */
-};
-
-UNITTEST_START
 #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_PROXY)
-{
   int i;
   int err = 0;
-  struct check list4[]= {
-    { "192.160.0.1", "192.160.0.1", 33, FALSE},
-    { "192.160.0.1", "192.160.0.1", 32, TRUE},
-    { "192.160.0.1", "192.160.0.1", 0, TRUE},
-    { "192.160.0.1", "192.160.0.1", 24, TRUE},
-    { "192.160.0.1", "192.160.0.1", 26, TRUE},
-    { "192.160.0.1", "192.160.0.1", 20, TRUE},
-    { "192.160.0.1", "192.160.0.1", 18, TRUE},
-    { "192.160.0.1", "192.160.0.1", 12, TRUE},
-    { "192.160.0.1", "192.160.0.1", 8, TRUE},
-    { "192.160.0.1", "10.0.0.1", 8, FALSE},
-    { "192.160.0.1", "10.0.0.1", 32, FALSE},
-    { "192.160.0.1", "10.0.0.1", 0, FALSE},
-    { NULL, NULL, 0, FALSE} /* end marker */
+
+  struct check {
+    const char *a;
+    const char *n;
+    unsigned int bits;
+    bool match;
   };
-  struct check list6[]= {
-    { "::1", "::1", 0, TRUE},
-    { "::1", "::1", 128, TRUE},
-    { "::1", "0:0::1", 128, TRUE},
-    { "::1", "0:0::1", 129, FALSE},
-    { "fe80::ab47:4396:55c9:8474", "fe80::ab47:4396:55c9:8474", 64, TRUE},
-    { NULL, NULL, 0, FALSE} /* end marker */
+  struct check list4[] = {
+    { "192.160.0.1", "192.160.0.1", 33, FALSE },
+    { "192.160.0.1", "192.160.0.1", 32, TRUE },
+    { "192.160.0.1", "192.160.0.1", 0, TRUE },
+    { "192.160.0.1", "192.160.0.1", 24, TRUE },
+    { "192.160.0.1", "192.160.0.1", 26, TRUE },
+    { "192.160.0.1", "192.160.0.1", 20, TRUE },
+    { "192.160.0.1", "192.160.0.1", 18, TRUE },
+    { "192.160.0.1", "192.160.0.1", 12, TRUE },
+    { "192.160.0.1", "192.160.0.1", 8, TRUE },
+    { "192.160.0.1", "10.0.0.1", 8, FALSE },
+    { "192.160.0.1", "10.0.0.1", 32, FALSE },
+    { "192.160.0.1", "10.0.0.1", 0, FALSE },
+    { NULL, NULL, 0, FALSE } /* end marker */
   };
-  struct noproxy list[]= {
-    { "www.example.com", "localhost .example.com .example.de", TRUE, TRUE},
-    { "www.example.com", "localhost,.example.com,.example.de", TRUE, FALSE},
-    { "www.example.com.", "localhost,.example.com,.example.de", TRUE, FALSE},
-    { "example.com", "localhost,.example.com,.example.de", TRUE, FALSE},
-    { "example.com.", "localhost,.example.com,.example.de", TRUE, FALSE},
-    { "www.example.com", "localhost,.example.com.,.example.de", TRUE, FALSE},
-    { "www.example.com", "localhost,www.example.com.,.example.de",
-      TRUE, FALSE},
-    { "example.com", "localhost,example.com,.example.de", TRUE, FALSE},
-    { "example.com.", "localhost,example.com,.example.de", TRUE, FALSE},
-    { "nexample.com", "localhost,example.com,.example.de", FALSE, FALSE},
-    { "www.example.com", "localhost,example.com,.example.de", TRUE, FALSE},
-    { "127.0.0.1", "127.0.0.1,localhost", TRUE, FALSE},
-    { "127.0.0.1", "127.0.0.1,localhost,", TRUE, FALSE},
-    { "127.0.0.1", "127.0.0.1/8,localhost,", TRUE, FALSE},
-    { "127.0.0.1", "127.0.0.1/28,localhost,", TRUE, FALSE},
-    { "127.0.0.1", "127.0.0.1/31,localhost,", TRUE, FALSE},
-    { "127.0.0.1", "localhost,127.0.0.1", TRUE, FALSE},
+#ifdef USE_IPV6
+  struct check list6[] = {
+    { "::1", "::1", 0, TRUE },
+    { "::1", "::1", 128, TRUE },
+    { "::1", "0:0::1", 128, TRUE },
+    { "::1", "0:0::1", 129, FALSE },
+    { "fe80::ab47:4396:55c9:8474", "fe80::ab47:4396:55c9:8474", 64, TRUE },
+    { NULL, NULL, 0, FALSE } /* end marker */
+  };
+#endif
+  struct noproxy {
+    const char *a;
+    const char *n;
+    bool match;
+  };
+  struct noproxy list[] = {
+    { "www.example.com", "localhost .example.com .example.de", FALSE },
+    { "www.example.com", "localhost,.example.com,.example.de", TRUE },
+    { "www.example.com.", "localhost,.example.com,.example.de", TRUE },
+    { "example.com", "localhost,.example.com,.example.de", TRUE },
+    { "example.com.", "localhost,.example.com,.example.de", TRUE },
+    { "www.example.com", "localhost,.example.com.,.example.de", TRUE },
+    { "www.example.com", "localhost,www.example.com.,.example.de", TRUE },
+    { "example.com", "localhost,example.com,.example.de", TRUE },
+    { "example.com.", "localhost,example.com,.example.de", TRUE },
+    { "nexample.com", "localhost,example.com,.example.de", FALSE },
+    { "www.example.com", "localhost,example.com,.example.de", TRUE },
+    { "127.0.0.1", "127.0.0.1,localhost", TRUE },
+    { "127.0.0.1", "127.0.0.1,localhost,", TRUE },
+    { "127.0.0.1", "127.0.0.1/8,localhost,", TRUE },
+    { "127.0.0.1", "127.0.0.1/28,localhost,", TRUE },
+    { "127.0.0.1", "127.0.0.1/31,localhost,", TRUE },
+    { "127.0.0.1", "localhost,127.0.0.1", TRUE },
     { "127.0.0.1", "localhost,127.0.0.1.127.0.0.1.127.0.0.1.127.0.0.1."
       "127.0.0.1.127.0.0.1.127.0.0.1.127.0.0.1.127.0.0.1.127.0.0.1.127."
-      "0.0.1.127.0.0.1.127.0.0." /* 128 bytes "address" */, FALSE, FALSE},
+      "0.0.1.127.0.0.1.127.0.0." /* 128 bytes "address" */, FALSE },
     { "127.0.0.1", "localhost,127.0.0.1.127.0.0.1.127.0.0.1.127.0.0.1."
       "127.0.0.1.127.0.0.1.127.0.0.1.127.0.0.1.127.0.0.1.127.0.0.1.127."
-      "0.0.1.127.0.0.1.127.0.0" /* 127 bytes "address" */, FALSE, FALSE},
-    { "localhost", "localhost,127.0.0.1", TRUE, FALSE},
-    { "localhost", "127.0.0.1,localhost", TRUE, FALSE},
-    { "foobar", "barfoo", FALSE, FALSE},
-    { "foobar", "foobar", TRUE, FALSE},
-    { "192.168.0.1", "foobar", FALSE, FALSE},
-    { "192.168.0.1", "192.168.0.0/16", TRUE, FALSE},
-    { "192.168.0.1", "192.168.0.0/24", TRUE, FALSE},
-    { "192.168.0.1", "192.168.0.0/32", FALSE, FALSE},
-    { "192.168.0.1", "192.168.0.0", FALSE, FALSE},
-    { "192.168.1.1", "192.168.0.0/24", FALSE, FALSE},
-    { "192.168.1.1", "foo, bar, 192.168.0.0/24", FALSE, FALSE},
-    { "192.168.1.1", "foo, bar, 192.168.0.0/16", TRUE, FALSE},
-    { "[::1]", "foo, bar, 192.168.0.0/16", FALSE, FALSE},
-    { "[::1]", "foo, bar, ::1/64", TRUE, FALSE},
-    { "bar", "foo, bar, ::1/64", TRUE, FALSE},
-    { "BAr", "foo, bar, ::1/64", TRUE, FALSE},
-    { "BAr", "foo,,,,,              bar, ::1/64", TRUE, FALSE},
-    { "www.example.com", "foo, .example.com", TRUE, FALSE},
-    { "www.example.com", "www2.example.com, .example.net", FALSE, FALSE},
-    { "example.com", ".example.com, .example.net", TRUE, FALSE},
-    { "nonexample.com", ".example.com, .example.net", FALSE, FALSE},
-    { NULL, NULL, FALSE, FALSE}
+      "0.0.1.127.0.0.1.127.0.0" /* 127 bytes "address" */, FALSE },
+    { "localhost", "localhost,127.0.0.1", TRUE },
+    { "localhost", "127.0.0.1,localhost", TRUE },
+    { "foobar", "barfoo", FALSE },
+    { "foobar", "foobar", TRUE },
+    { "192.168.0.1", "foobar", FALSE },
+    { "192.168.0.1", "192.168.0.0/16", TRUE },
+    { "192.168.0.1", "192.168.0.0/16a", FALSE },
+    { "192.168.0.1", "192.168.0.0/16 ", TRUE },
+    { "192.168.0.1", "192.168.0.0/a16", FALSE },
+    { "192.168.0.1", "192.168.0.0/ 16", FALSE },
+    { "192.168.0.1", "192.168.0.0/24", TRUE },
+    { "192.168.0.1", "192.168.0.0/32", FALSE },
+    { "192.168.0.1", "192.168.0.1/32", TRUE },
+    { "192.168.0.1", "192.168.0.1/33", FALSE },
+    { "192.168.0.1", "192.168.0.0", FALSE },
+    { "192.168.1.1", "192.168.0.0/24", FALSE },
+    { "192.168.1.1", "192.168.0.0/33", FALSE },
+    { "192.168.1.1", "foo, bar, 192.168.0.0/24", FALSE },
+    { "192.168.1.1", "foo, bar, 192.168.0.0/16", TRUE },
+#ifdef USE_IPV6
+    { "::1", "foo, bar, 192.168.0.0/16", FALSE },
+    { "::1", "foo, bar, ::1/64", TRUE },
+    { "::1", "::1/64", TRUE },
+    { "::1", "::1/96", TRUE },
+    { "::1", "::1/129", FALSE },
+    { "::1", "::1/128", TRUE },
+    { "::1", "::1/127", TRUE },
+    { "::1", "::1/a127", FALSE },
+    { "::1", "::1/127a", FALSE },
+    { "::1", "::1/ 127", FALSE },
+    { "::1", "::1/127 ", TRUE },
+    { "::1", "::1/126", TRUE },
+    { "::1", "::1/125", TRUE },
+    { "::1", "::1/124", TRUE },
+    { "::1", "::1/123", TRUE },
+    { "::1", "::1/122", TRUE },
+    { "2001:db8:8000::1", "2001:db8::/65", FALSE },
+    { "2001:db8:8000::1", "2001:db8::/66", FALSE },
+    { "2001:db8:8000::1", "2001:db8::/67", FALSE },
+    { "2001:db8:8000::1", "2001:db8::/68", FALSE },
+    { "2001:db8:8000::1", "2001:db8::/69", FALSE },
+    { "2001:db8:8000::1", "2001:db8::/70", FALSE },
+    { "2001:db8:8000::1", "2001:db8::/71", FALSE },
+    { "2001:db8:8000::1", "2001:db8::/72", FALSE },
+    { "2001:db8::1", "2001:db8::/65", TRUE },
+    { "2001:db8::1", "2001:db8::/66", TRUE },
+    { "2001:db8::1", "2001:db8::/67", TRUE },
+    { "2001:db8::1", "2001:db8::/68", TRUE },
+    { "2001:db8::1", "2001:db8::/69", TRUE },
+    { "2001:db8::1", "2001:db8::/70", TRUE },
+    { "2001:db8::1", "2001:db8::/71", TRUE },
+    { "2001:db8::1", "2001:db8::/72", TRUE },
+    { "::1", "::1/129", FALSE },
+    { "bar", "foo, bar, ::1/64", TRUE },
+    { "BAr", "foo, bar, ::1/64", TRUE },
+    { "BAr", "foo,,,,,              bar, ::1/64", TRUE },
+#endif
+    { "www.example.com", "foo, .example.com", TRUE },
+    { "www.example.com", "www2.example.com, .example.net", FALSE },
+    { "example.com", ".example.com, .example.net", TRUE },
+    { "nonexample.com", ".example.com, .example.net", FALSE },
+    { NULL, NULL, FALSE }
   };
   for(i = 0; list4[i].a; i++) {
-    bool match = Curl_cidr4_match(list4[i].a, list4[i].n, list4[i].bits);
+    bool match = cidr4_match(list4[i].a, list4[i].n, list4[i].bits);
     if(match != list4[i].match) {
-      fprintf(stderr, "%s in %s/%u should %smatch\n",
-              list4[i].a, list4[i].n, list4[i].bits,
-              list4[i].match ? "": "not ");
+      curl_mfprintf(stderr, "%s in %s/%u should %smatch\n",
+                    list4[i].a, list4[i].n, list4[i].bits,
+                    list4[i].match ? "" : "not ");
       err++;
     }
   }
+#ifdef USE_IPV6
   for(i = 0; list6[i].a; i++) {
-    bool match = Curl_cidr6_match(list6[i].a, list6[i].n, list6[i].bits);
+    bool match = cidr6_match(list6[i].a, list6[i].n, list6[i].bits);
     if(match != list6[i].match) {
-      fprintf(stderr, "%s in %s/%u should %smatch\n",
-              list6[i].a, list6[i].n, list6[i].bits,
-              list6[i].match ? "": "not ");
+      curl_mfprintf(stderr, "%s in %s/%u should %smatch\n",
+                    list6[i].a, list6[i].n, list6[i].bits,
+                    list6[i].match ? "" : "not ");
       err++;
     }
   }
+#endif
   for(i = 0; list[i].a; i++) {
-    bool spacesep = FALSE;
-    bool match = Curl_check_noproxy(list[i].a, list[i].n, &spacesep);
+    bool match = proxy_check_noproxy(list[i].a, list[i].n);
     if(match != list[i].match) {
-      fprintf(stderr, "%s in %s should %smatch\n",
-              list[i].a, list[i].n,
-              list[i].match ? "": "not ");
-      err++;
-    }
-    if(spacesep != list[i].space) {
-      fprintf(stderr, "%s is claimed to be %sspace separated\n",
-              list[i].n, list[i].space?"":"NOT ");
+      curl_mfprintf(stderr, "%s in %s should %smatch\n",
+                    list[i].a, list[i].n,
+                    list[i].match ? "" : "not ");
       err++;
     }
   }
   fail_if(err, "errors");
-}
 #endif
-UNITTEST_STOP
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit1615.c b/third-party/curl/tests/unit/unit1615.c
new file mode 100644
index 0000000000..705ef392f1
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1615.c
@@ -0,0 +1,147 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) Evgeny Grin (Karlson2k), <k2k@narod.ru>.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "curl_sha512_256.h"
+
+static CURLcode test_unit1615(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+#ifdef CURL_HAVE_SHA512_256
+
+  static const char test_str1[] = "1";
+  static const unsigned char precomp_hash1[CURL_SHA512_256_DIGEST_LENGTH] = {
+    0x18, 0xd2, 0x75, 0x66, 0xbd, 0x1a, 0xc6, 0x6b, 0x23, 0x32, 0xd8,
+    0xc5, 0x4a, 0xd4, 0x3f, 0x7b, 0xb2, 0x20, 0x79, 0xc9, 0x06, 0xd0,
+    0x5f, 0x49, 0x1f, 0x3f, 0x07, 0xa2, 0x8d, 0x5c, 0x69, 0x90
+  };
+  static const char test_str2[] = "hello-you-fool";
+  static const unsigned char precomp_hash2[CURL_SHA512_256_DIGEST_LENGTH] = {
+    0xaf, 0x6f, 0xb4, 0xb0, 0x13, 0x9b, 0xee, 0x13, 0xd1, 0x95, 0x3c,
+    0xb8, 0xc7, 0xcd, 0x5b, 0x19, 0xf9, 0xcd, 0xcd, 0x21, 0xef, 0xdf,
+    0xa7, 0x42, 0x5c, 0x07, 0x13, 0xea, 0xcc, 0x1a, 0x39, 0x76
+  };
+  static const char test_str3[] = "abc";
+  static const unsigned char precomp_hash3[CURL_SHA512_256_DIGEST_LENGTH] = {
+    0x53, 0x04, 0x8E, 0x26, 0x81, 0x94, 0x1E, 0xF9, 0x9B, 0x2E, 0x29,
+    0xB7, 0x6B, 0x4C, 0x7D, 0xAB, 0xE4, 0xC2, 0xD0, 0xC6, 0x34, 0xFC,
+    0x6D, 0x46, 0xE0, 0xE2, 0xF1, 0x31, 0x07, 0xE7, 0xAF, 0x23
+  };
+  static const char test_str4[] = ""; /* empty, zero size input */
+  static const unsigned char precomp_hash4[CURL_SHA512_256_DIGEST_LENGTH] = {
+    0xc6, 0x72, 0xb8, 0xd1, 0xef, 0x56, 0xed, 0x28, 0xab, 0x87, 0xc3,
+    0x62, 0x2c, 0x51, 0x14, 0x06, 0x9b, 0xdd, 0x3a, 0xd7, 0xb8, 0xf9,
+    0x73, 0x74, 0x98, 0xd0, 0xc0, 0x1e, 0xce, 0xf0, 0x96, 0x7a
+  };
+  static const char test_str5[] =
+    "abcdefghijklmnopqrstuvwxyzzyxwvutsrqponMLKJIHGFEDCBA"
+    "abcdefghijklmnopqrstuvwxyzzyxwvutsrqponMLKJIHGFEDCBA";
+  static const unsigned char precomp_hash5[CURL_SHA512_256_DIGEST_LENGTH] = {
+    0xad, 0xe9, 0x5d, 0x55, 0x3b, 0x9e, 0x45, 0x69, 0xdb, 0x53, 0xa4,
+    0x04, 0x92, 0xe7, 0x87, 0x94, 0xff, 0xc9, 0x98, 0x5f, 0x93, 0x03,
+    0x86, 0x45, 0xe1, 0x97, 0x17, 0x72, 0x7c, 0xbc, 0x31, 0x15
+  };
+  static const char test_str6[] =
+    "/long/long/long/long/long/long/long/long/long/long/long"
+    "/long/long/long/long/long/long/long/long/long/long/long"
+    "/long/long/long/long/long/long/long/long/long/long/long"
+    "/long/long/long/long/long/long/long/long/long/long/long"
+    "/long/long/long/long/long/long/long/long/long/long/long"
+    "/long/long/long/long/long/long/long/long/long/long/long"
+    "/long/long/long/long/path?with%20some=parameters";
+  static const unsigned char precomp_hash6[CURL_SHA512_256_DIGEST_LENGTH] = {
+    0xbc, 0xab, 0xc6, 0x2c, 0x0a, 0x22, 0xd5, 0xcb, 0xac, 0xac, 0xe9,
+    0x25, 0xcf, 0xce, 0xaa, 0xaf, 0x0e, 0xa1, 0xed, 0x42, 0x46, 0x8a,
+    0xe2, 0x01, 0xee, 0x2f, 0xdb, 0x39, 0x75, 0x47, 0x73, 0xf1
+  };
+  static const char test_str7[] = "Simple string.";
+  static const unsigned char precomp_hash7[CURL_SHA512_256_DIGEST_LENGTH] = {
+    0xde, 0xcb, 0x3c, 0x81, 0x65, 0x4b, 0xa0, 0xf5, 0xf0, 0x45, 0x6b,
+    0x7e, 0x61, 0xf5, 0x0d, 0xf5, 0x38, 0xa4, 0xfc, 0xb1, 0x8a, 0x95,
+    0xff, 0x59, 0xbc, 0x04, 0x82, 0xcf, 0x23, 0xb2, 0x32, 0x56
+  };
+  static const unsigned char test_seq8[] = {
+    255, 254, 253, 252, 251, 250, 249, 248, 247, 246, 245, 244, 243, 242, 241,
+    240, 239, 238, 237, 236, 235, 234, 233, 232, 231, 230, 229, 228, 227, 226,
+    225, 224, 223, 222, 221, 220, 219, 218, 217, 216, 215, 214, 213, 212, 211,
+    210, 209, 208, 207, 206, 205, 204, 203, 202, 201, 200, 199, 198, 197, 196,
+    195, 194, 193, 192, 191, 190, 189, 188, 187, 186, 185, 184, 183, 182, 181,
+    180, 179, 178, 177, 176, 175, 174, 173, 172, 171, 170, 169, 168, 167, 166,
+    165, 164, 163, 162, 161, 160, 159, 158, 157, 156, 155, 154, 153, 152, 151,
+    150, 149, 148, 147, 146, 145, 144, 143, 142, 141, 140, 139, 138, 137, 136,
+    135, 134, 133, 132, 131, 130, 129, 128, 127, 126, 125, 124, 123, 122, 121,
+    120, 119, 118, 117, 116, 115, 114, 113, 112, 111, 110, 109, 108, 107, 106,
+    105, 104, 103, 102, 101, 100, 99,  98,  97,  96,  95,  94,  93,  92,  91,
+    90,  89,  88,  87,  86,  85,  84,  83,  82,  81,  80,  79,  78,  77,  76,
+    75,  74,  73,  72,  71,  70,  69,  68,  67,  66,  65,  64,  63,  62,  61,
+    60,  59,  58,  57,  56,  55,  54,  53,  52,  51,  50,  49,  48,  47,  46,
+    45,  44,  43,  42,  41,  40,  39,  38,  37,  36,  35,  34,  33,  32,  31,
+    30,  29,  28,  27,  26,  25,  24,  23,  22,  21,  20,  19,  18,  17,  16,
+    15,  14,  13,  12,  11,  10,  9,   8,   7,   6,   5,   4,   3,   2,   1
+  }; /* 255..1 sequence */
+  static const unsigned char precomp_hash8[CURL_SHA512_256_DIGEST_LENGTH] = {
+    0x22, 0x31, 0xf2, 0xa1, 0xb4, 0x89, 0xb2, 0x44, 0xf7, 0x66, 0xa0,
+    0xb8, 0x31, 0xed, 0xb7, 0x73, 0x8a, 0x34, 0xdc, 0x11, 0xc8, 0x2c,
+    0xf2, 0xb5, 0x88, 0x60, 0x39, 0x6b, 0x5c, 0x06, 0x70, 0x37
+  };
+
+  unsigned char output_buf[CURL_SHA512_256_DIGEST_LENGTH];
+
+  Curl_sha512_256it(output_buf, (const unsigned char *)test_str1,
+                    CURL_ARRAYSIZE(test_str1) - 1);
+  verify_memory(output_buf, precomp_hash1, CURL_SHA512_256_DIGEST_LENGTH);
+
+  Curl_sha512_256it(output_buf, (const unsigned char *)test_str2,
+                    CURL_ARRAYSIZE(test_str2) - 1);
+  verify_memory(output_buf, precomp_hash2, CURL_SHA512_256_DIGEST_LENGTH);
+
+  Curl_sha512_256it(output_buf, (const unsigned char *)test_str3,
+                    CURL_ARRAYSIZE(test_str3) - 1);
+  verify_memory(output_buf, precomp_hash3, CURL_SHA512_256_DIGEST_LENGTH);
+
+  Curl_sha512_256it(output_buf, (const unsigned char *)test_str4,
+                    CURL_ARRAYSIZE(test_str4) - 1);
+  verify_memory(output_buf, precomp_hash4, CURL_SHA512_256_DIGEST_LENGTH);
+
+  Curl_sha512_256it(output_buf, (const unsigned char *)test_str5,
+                    CURL_ARRAYSIZE(test_str5) - 1);
+  verify_memory(output_buf, precomp_hash5, CURL_SHA512_256_DIGEST_LENGTH);
+
+  Curl_sha512_256it(output_buf, (const unsigned char *)test_str6,
+                    CURL_ARRAYSIZE(test_str6) - 1);
+  verify_memory(output_buf, precomp_hash6, CURL_SHA512_256_DIGEST_LENGTH);
+
+  Curl_sha512_256it(output_buf, (const unsigned char *)test_str7,
+                    CURL_ARRAYSIZE(test_str7) - 1);
+  verify_memory(output_buf, precomp_hash7, CURL_SHA512_256_DIGEST_LENGTH);
+
+  Curl_sha512_256it(output_buf, test_seq8,
+                    CURL_ARRAYSIZE(test_seq8));
+  verify_memory(output_buf, precomp_hash8, CURL_SHA512_256_DIGEST_LENGTH);
+
+#endif /* CURL_HAVE_SHA512_256 */
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit1616.c b/third-party/curl/tests/unit/unit1616.c
new file mode 100644
index 0000000000..cd7d0cca54
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1616.c
@@ -0,0 +1,85 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "uint-hash.h"
+
+static void t1616_mydtor(uint32_t id, void *elem)
+{
+  int *ptr = (int *)elem;
+  (void)id;
+  curlx_free(ptr);
+}
+
+static CURLcode t1616_setup(struct uint_hash *hash)
+{
+  Curl_uint32_hash_init(hash, 15, t1616_mydtor);
+  return CURLE_OK;
+}
+
+static void t1616_stop(struct uint_hash *hash)
+{
+  Curl_uint32_hash_destroy(hash);
+}
+
+static CURLcode test_unit1616(const char *arg)
+{
+  struct uint_hash hash;
+
+  UNITTEST_BEGIN(t1616_setup(&hash))
+
+  int *value, *v;
+  int *value2;
+  bool ok;
+
+  uint32_t key = 20;
+  uint32_t key2 = 25;
+
+  value = curlx_malloc(sizeof(int));
+  abort_unless(value, "Out of memory");
+  *value = 199;
+  ok = Curl_uint32_hash_set(&hash, key, value);
+  if(!ok)
+    curlx_free(value);
+  abort_unless(ok, "insertion into hash failed");
+  v = Curl_uint32_hash_get(&hash, key);
+  abort_unless(v == value, "lookup present entry failed");
+  v = Curl_uint32_hash_get(&hash, key2);
+  abort_unless(!v, "lookup missing entry failed");
+  uint_hash_clear(&hash);
+
+  /* Attempt to add another key/value pair */
+  value2 = curlx_malloc(sizeof(int));
+  abort_unless(value2, "Out of memory");
+  *value2 = 204;
+  ok = Curl_uint32_hash_set(&hash, key2, value2);
+  if(!ok)
+    curlx_free(value2);
+  abort_unless(ok, "insertion into hash failed");
+  v = Curl_uint32_hash_get(&hash, key2);
+  abort_unless(v == value2, "lookup present entry failed");
+  v = Curl_uint32_hash_get(&hash, key);
+  abort_unless(!v, "lookup missing entry failed");
+
+  UNITTEST_END(t1616_stop(&hash))
+}
diff --git a/third-party/curl/tests/unit/unit1620.c b/third-party/curl/tests/unit/unit1620.c
index 8b6f34ca7d..6ba9a5bb0d 100644
--- a/third-party/curl/tests/unit/unit1620.c
+++ b/third-party/curl/tests/unit/unit1620.c
@@ -21,73 +21,120 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "urldata.h"
 #include "url.h"
 
-#include "memdebug.h" /* LAST include file */
-
-static CURLcode unit_setup(void)
+static CURLcode t1620_setup(void)
 {
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
   global_init(CURL_GLOBAL_ALL);
-  return res;
+  return result;
 }
 
-static void unit_stop(void)
+static void t1620_parse(const char *input,
+                        const char *exp_username,
+                        const char *exp_password,
+                        const char *exp_options)
 {
-  curl_global_cleanup();
+  char *userstr = NULL;
+  char *passwdstr = NULL;
+  char *options = NULL;
+  CURLcode result = Curl_parse_login_details(input, strlen(input), &userstr,
+                                             &passwdstr, &options);
+  fail_unless(result == CURLE_OK, "Curl_parse_login_details() failed");
+
+  fail_unless(!!exp_username == !!userstr, "username expectation failed");
+  fail_unless(!!exp_password == !!passwdstr, "password expectation failed");
+  fail_unless(!!exp_options == !!options, "options expectation failed");
+
+  if(!unitfail) {
+    fail_unless(!userstr || !exp_username ||
+                !strcmp(userstr, exp_username),
+                "userstr should be equal to exp_username");
+    fail_unless(!passwdstr || !exp_password ||
+                !strcmp(passwdstr, exp_password),
+                "passwdstr should be equal to exp_password");
+    fail_unless(!options || !exp_options ||
+                !strcmp(options, exp_options),
+                "options should be equal to exp_options");
+  }
+
+  curlx_free(userstr);
+  curlx_free(passwdstr);
+  curlx_free(options);
 }
 
-UNITTEST_START
+static CURLcode test_unit1620(const char *arg)
 {
-  int rc;
+  UNITTEST_BEGIN(t1620_setup())
+
+  CURLcode result;
   struct Curl_easy *empty;
-  const char *hostname = "hostname";
+  struct Curl_easy *dupe = NULL;
   enum dupstring i;
+  bool connected = FALSE;
 
-  bool async = FALSE;
-  bool protocol_connect = FALSE;
-
-  rc = Curl_open(&empty);
-  if(rc)
+  result = Curl_open(&empty);
+  if(result)
     goto unit_test_abort;
-  fail_unless(rc == CURLE_OK, "Curl_open() failed");
+  fail_unless(result == CURLE_OK, "Curl_open() failed");
 
-  rc = Curl_connect(empty, &async, &protocol_connect);
-  fail_unless(rc == CURLE_URL_MALFORMAT,
+  result = Curl_connect(empty, &connected);
+  fail_unless(result == CURLE_URL_MALFORMAT,
               "Curl_connect() failed to return CURLE_URL_MALFORMAT");
 
   fail_unless(empty->magic == CURLEASY_MAGIC_NUMBER,
               "empty->magic should be equal to CURLEASY_MAGIC_NUMBER");
 
   /* double invoke to ensure no dependency on internal state */
-  rc = Curl_connect(empty, &async, &protocol_connect);
-  fail_unless(rc == CURLE_URL_MALFORMAT,
+  result = Curl_connect(empty, &connected);
+  fail_unless(result == CURLE_URL_MALFORMAT,
               "Curl_connect() failed to return CURLE_URL_MALFORMAT");
 
-  rc = Curl_init_userdefined(empty);
-  fail_unless(rc == CURLE_OK, "Curl_userdefined() failed");
+  result = Curl_init_do(empty, empty->conn);
+  fail_unless(result == CURLE_OK, "Curl_init_do() failed");
 
-  rc = Curl_init_do(empty, empty->conn);
-  fail_unless(rc == CURLE_OK, "Curl_init_do() failed");
+  result = curl_easy_setopt((CURL *)empty, CURLOPT_NOBODY, 1L);
+  fail_unless(result == CURLE_OK, "curl_easy_setopt(CURLOPT_NOBODY) failed");
 
-  rc = Curl_parse_login_details(
-                          hostname, strlen(hostname), NULL, NULL, NULL);
-  fail_unless(rc == CURLE_OK,
-              "Curl_parse_login_details() failed");
+  dupe = (struct Curl_easy *)curl_easy_duphandle((CURL *)empty);
+  if(!dupe)
+    Curl_close(&empty);
+  abort_unless(dupe, "curl_easy_duphandle() failed");
+
+  result = Curl_init_do(dupe, NULL);
+  fail_unless(result == CURLE_OK, "Curl_init_do() on duplicate failed");
+  fail_unless(dupe->req.no_body, "duplicate handle should keep no_body");
+  fail_unless(dupe->state.httpreq == HTTPREQ_HEAD,
+              "duplicate handle should use HTTPREQ_HEAD");
+
+  t1620_parse("hostname", "hostname", NULL, NULL);
+  t1620_parse("user:password", "user", "password", NULL);
+  t1620_parse("user:password;options", "user", "password", "options");
+  t1620_parse("user:password;options;more", "user", "password",
+              "options;more");
+  t1620_parse("", "", NULL, NULL);
+  t1620_parse(":", "", "", NULL);
+  t1620_parse(":;", "", "", NULL);
+  t1620_parse(":password", "", "password", NULL);
+  t1620_parse(":password;", "", "password", NULL);
+  t1620_parse(";options", "", NULL, "options");
+  t1620_parse("user;options", "user", NULL, "options");
+  t1620_parse("user:;options", "user", "", "options");
+  t1620_parse("user;options:password", "user", "password", "options");
+  t1620_parse("user;options:", "user", "", "options");
 
   Curl_freeset(empty);
   for(i = (enum dupstring)0; i < STRING_LAST; i++) {
-    fail_unless(empty->set.str[i] == NULL,
-                "Curl_free() did not set to NULL");
+    fail_unless(!empty->set.str[i], "Curl_free() did not set to NULL");
   }
 
-  Curl_free_request_state(empty);
+  result = Curl_close(&dupe);
+  fail_unless(result == CURLE_OK, "Curl_close() failed for duplicate");
 
-  rc = Curl_close(&empty);
-  fail_unless(rc == CURLE_OK, "Curl_close() failed");
+  result = Curl_close(&empty);
+  fail_unless(result == CURLE_OK, "Curl_close() failed");
 
+  UNITTEST_END(curl_global_cleanup())
 }
-UNITTEST_STOP
diff --git a/third-party/curl/tests/unit/unit1621.c b/third-party/curl/tests/unit/unit1621.c
deleted file mode 100644
index c384e044d7..0000000000
--- a/third-party/curl/tests/unit/unit1621.c
+++ /dev/null
@@ -1,81 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "curlcheck.h"
-
-#include "urldata.h"
-#include "url.h"
-
-#include "memdebug.h" /* LAST include file */
-
-static CURLcode unit_setup(void)
-{
-  return CURLE_OK;
-}
-
-static void unit_stop(void)
-{
-}
-
-#if defined(__MINGW32__)  || \
-  (!defined(HAVE_FSETXATTR) && \
-  (!defined(__FreeBSD_version) || (__FreeBSD_version < 500000)))
-UNITTEST_START
-UNITTEST_STOP
-#else
-
-char *stripcredentials(const char *url);
-
-struct checkthis {
-  const char *input;
-  const char *output;
-};
-
-static const struct checkthis tests[] = {
-  { "ninja://foo@example.com", "ninja://foo@example.com" },
-  { "https://foo@example.com", "https://example.com/" },
-  { "https://localhost:45", "https://localhost:45/" },
-  { "https://foo@localhost:45", "https://localhost:45/" },
-  { "http://daniel:password@localhost", "http://localhost/" },
-  { "http://daniel@localhost", "http://localhost/" },
-  { "http://localhost/", "http://localhost/" },
-  { NULL, NULL } /* end marker */
-};
-
-UNITTEST_START
-{
-  int i;
-
-  for(i = 0; tests[i].input; i++) {
-    const char *url = tests[i].input;
-    char *stripped = stripcredentials(url);
-    printf("Test %u got input \"%s\", output: \"%s\"\n",
-           i, tests[i].input, stripped);
-
-    fail_if(stripped && strcmp(tests[i].output, stripped),
-            tests[i].output);
-    curl_free(stripped);
-  }
-}
-UNITTEST_STOP
-#endif
diff --git a/third-party/curl/tests/unit/unit1625.c b/third-party/curl/tests/unit/unit1625.c
new file mode 100644
index 0000000000..370b65a4fa
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1625.c
@@ -0,0 +1,135 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+
+#ifndef CURL_DISABLE_HTTP
+#include "urldata.h"
+#include "url.h"
+
+struct check1625 {
+  const char *in;
+  const char *hdr;
+  const char *extract;
+  bool expect;
+};
+
+static CURLcode test_unit1625(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  size_t i;
+  static const struct check1625 list[] = {
+    /* basic case */
+    { "Encoding: gzip, chunked", "Encoding:", "chunked", TRUE },
+    /* single value */
+    { "Encoding: chunked", "Encoding:", "chunked", TRUE },
+    /* third token */
+    { "Encoding: a, b, chunked", "Encoding:", "chunked", TRUE },
+    /* fourth token */
+    { "Encoding: a, b, c, chunked", "Encoding:", "chunked", TRUE },
+    /* in middle of three tokens */
+    { "Encoding: a, chunked, ninja", "Encoding:", "chunked", TRUE },
+    /* empty incoming header */
+    { "Encoding:", "Encoding:", "chunked", FALSE },
+    /* spaces in header */
+    { "Encoding:   ", "Encoding:", "chunked", FALSE },
+    /* last among several with no spaces */
+    { "Encoding: ab,cd,ef,gh,ig,kl", "Encoding:", "kl", TRUE },
+    /* double commas */
+    { "Encoding: ab,,kl", "Encoding:", "kl", TRUE },
+    /* repeated commas */
+    { "Encoding: ab,cd,,,,kl", "Encoding:", "kl", TRUE },
+    /* first token of four */
+    { "Encoding: chunked, a, b, c", "Encoding:", "chunked", TRUE },
+    /* different case */
+    { "Encoding: gzip, chunked", "Encoding:", "CHUNKED", TRUE },
+    /* another different case */
+    { "Encoding: gzip, CHUNKED", "Encoding:", "chunked", TRUE },
+    /* incoming header different case */
+    { "encoDING: gzip, CHUNKED", "encoding:", "chunked", TRUE },
+    /* incoming header upper case */
+    { "ENCODING: gzip, chunked", "encoding:", "chunked", TRUE },
+    /* the other value */
+    { "Encoding: gzip, chunked", "Encoding:", "gzip", TRUE },
+    /* without space */
+    { "Encoding: gzip,chunked", "Encoding:", "gzip", TRUE },
+    /* multiple spaces */
+    { "Encoding:    gzip,     chunked", "Encoding:", "chunked", TRUE },
+    /* tabs */
+    { "Encoding: gzip, \tchunked", "Encoding:", "chunked", TRUE },
+    /* end with CR */
+    { "Encoding: gzip\r\n", "Encoding:", "gzip", TRUE },
+    /* end with LF */
+    { "Encoding: gzip\n", "Encoding:", "gzip", TRUE },
+    /* end with tab */
+    { "Encoding: gzip\t", "Encoding:", "gzip", TRUE },
+    /* end with space + LF */
+    { "Encoding: gzip \n", "Encoding:", "gzip", TRUE },
+    /* missing value */
+    { "Encoding: gzip, chunked", "Encoding:", "br", FALSE },
+    /* wrong header */
+    { "Encoding: gzip, chunked", "Encodin:", "chunked", FALSE },
+    /* prefix only */
+    { "Encoding: gzip2, chunked", "Encoding:", "gzip", FALSE },
+    /* prefix with letter */
+    { "Encoding: gzipp, chunked", "Encoding:", "gzip", FALSE },
+    /* suffix only */
+    { "Encoding: agzip, chunked", "Encoding:", "gzip", FALSE },
+    /* not the right header */
+    { "Decoding: gzip, chunked", "Encoding:", "gzip", FALSE },
+    /* hyphenated */
+    { "Encoding: super-nice", "Encoding:", "super-nice", TRUE },
+    /* hyphenated second token */
+    { "Encoding: extra-good, super-nice", "Encoding:", "super-nice", TRUE },
+  };
+
+  for(i = 0; i < CURL_ARRAYSIZE(list); i++) {
+    bool check = Curl_compareheader(list[i].in,
+                                    list[i].hdr, strlen(list[i].hdr),
+                                    list[i].extract, strlen(list[i].extract));
+    if(check != list[i].expect) {
+      curl_mprintf("Input: %s\n"
+                   "Header: %s\n"
+                   "Look for: %s\n"
+                   "Returned: %s\n",
+                   list[i].in, list[i].hdr, list[i].extract,
+                   check ? "TRUE" : "FALSE");
+      break;
+    }
+  }
+
+  curl_mprintf("%zu invokes\n", i);
+
+  if(i != CURL_ARRAYSIZE(list))
+    return CURLE_FAILED_INIT;
+
+  UNITTEST_END_SIMPLE
+}
+#else /* CURL_DISABLE_HTTP */
+static CURLcode test_unit1625(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+  UNITTEST_END_SIMPLE
+}
+#endif
diff --git a/third-party/curl/tests/unit/unit1626.c b/third-party/curl/tests/unit/unit1626.c
new file mode 100644
index 0000000000..81ce3b2e0a
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1626.c
@@ -0,0 +1,129 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+
+#ifndef CURL_DISABLE_HTTP
+#include "urldata.h"
+#include "url.h"
+
+struct check1626 {
+  const char *in; /* send this in */
+  const char *out; /* expect this out */
+};
+
+static CURLcode test_unit1626(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  size_t i;
+  static const struct check1626 list[] = {
+    /* basic */
+    { "Header: value", "value" },
+    /* no space */
+    { "Header:value", "value" },
+    /* multiple spaces */
+    { "Header:    value", "value" },
+    /* tabs */
+    { "Header: \tvalue", "value" },
+    /* trailing space */
+    { "Header: value  ", "value" },
+    /* leading and trailing spaces */
+    { "Header:    value   ", "value" },
+    /* nothing after colon */
+    { "Header:", "" },
+    /* spaces-only after colon */
+    { "Header:  ", "" },
+    /* spaces and tabs after colon */
+    { "Header: \t ", "" },
+    /* spaces in the value */
+    { "Header: one two", "one two" },
+    /* multiple spaces in the value */
+    { "Header: one two a b c ", "one two a b c" },
+    /* realistic */
+    { "Header: text/html", "text/html" },
+    /* ending with CR */
+    { "Header: value\r", "value" },
+    /* ending with LF */
+    { "Header: value\n", "value" },
+    /* quoted value */
+    { "Header: \"value\"\n", "\"value\"" },
+    /* quoted value with trailing space */
+    { "Header: \"value\"  ", "\"value\"" },
+    /* leading whitespace before header name */
+    { " Header: value", "value" },
+    /* tab before colon */
+    { "Header\t: value", "value" },
+    /* mixed whitespace after colon */
+    { "Header:\t  value", "value" },
+    /* value containing colon */
+    { "Header: foo:bar", "foo:bar" },
+    /* multiple colons */
+    { "Header: foo:bar:baz", "foo:bar:baz" },
+    /* tab-only value */
+    { "Header:\t\t", "" },
+    /* CRLF ending */
+    { "Header: value\r\n", "value" },
+    /* value with internal tabs */
+    { "Header: foo\tbar", "foo\tbar" },
+    /* value with leading tab trimmed */
+    { "Header:\tfoo", "foo" },
+    /* colon with spaces before it */
+    { "Header : value", "value" },
+    /* multiple spaces before colon */
+    { "Header    : value", "value" },
+    /* spaces around colon */
+    { "Header :    value", "value" },
+  };
+
+  for(i = 0; i < CURL_ARRAYSIZE(list); i++) {
+    bool ok;
+    char *get = Curl_copy_header_value(list[i].in);
+
+    ok = get && !strcmp(list[i].out, get);
+    if(!ok) {
+      curl_mprintf("Input: %s\n"
+                   "Got: %s\n"
+                   "Expected: %s\n",
+                   list[i].in, get, list[i].out);
+    }
+    curlx_free(get);
+    if(!ok)
+      break;
+  }
+
+  curl_mprintf("%zu invokes\n", i);
+
+  if(i != CURL_ARRAYSIZE(list))
+    return CURLE_FAILED_INIT;
+
+  UNITTEST_END_SIMPLE
+}
+#else
+/* for HTTP-disabled builds */
+static CURLcode test_unit1626(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+  UNITTEST_END_SIMPLE
+}
+#endif
diff --git a/third-party/curl/tests/unit/unit1627.c b/third-party/curl/tests/unit/unit1627.c
new file mode 100644
index 0000000000..1d1f598358
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1627.c
@@ -0,0 +1,104 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "urldata.h"
+#include "url.h"
+#include "strcase.h"
+
+static CURLcode test_unit1627(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  size_t i, j;
+  /* existing schemes in different cases */
+  static const char *okay[] = {
+    /* all upper */
+    "DICT", "FILE", "FTP", "FTPS", "GOPHER", "GOPHERS", "HTTP", "HTTPS",
+    "IMAP", "IMAPS", "LDAP", "LDAPS", "MQTT", "MQTTS", "POP3", "POP3S",
+    "RTSP", "SCP", "SFTP", "SMB", "SMBS", "SMTP", "SMTPS",
+    "TELNET", "TFTP", "WS", "WSS",
+    /* all lower */
+    "dict", "file", "ftp", "ftps", "gopher", "gophers", "http", "https",
+    "imap", "imaps", "ldap", "ldaps", "mqtt", "mqtts", "pop3", "pop3s",
+    "rtsp", "scp", "sftp", "smb", "smbs", "smtp", "smtps",
+    "telnet", "tftp", "ws", "wss",
+    /* mixed */
+    "diCt", "fIle", "Ftp", "ftpS", "Gopher", "gOphers", "htTp", "httPs",
+    "imAP", "imaPS", "LDap", "LDAps", "mQTT", "mqtTS", "pOP3", "pOP3s",
+    "RtsP", "ScP", "SFtP", "Smb", "smBS", "sMTP", "SMTPs",
+    "TELNEt", "tFTP", "Ws", "wSS",
+  };
+  /* non-existing schemes */
+  static const char *notokay[] = {
+    "a", "A", "htt", "ttp", "httt", "http+", "HTTPP", "HTTPPS", "HTTSP",
+    "GROPHER", "D1CT", "AbG", "zLQp", "mNrtW", "PkY", "bVcxZq", "LmO",
+    "iUhyT", "rEwQA", "xSdfG", "nBvC", "pOiuY", "tRewQ", "aSdfG", "hJkl",
+    "mNbV", "cXz", "pOiU", "yTrE", "wQaS", "dFghJ", "kLmN", "bVcX", "zPoI",
+    "uYtR", "eWqA", "sDfG", "hJkL", "zXcV", "bNmM", "qWeR", "tYuI", "oPaS",
+    "dFgH", "jKlZ", "xCvB", "nMqW", "eRtY", "uIoP", "aSdF", "gHjK", "lZxC",
+    "vBnM", "QwEr", "TyUi", "OpAs", "DfGh", "JkLz", "XcVb", "NmqW", "ErTy",
+    "UiOp", "AsDf", "GhJk", "LzXc", "VbNm", "qweR", "tyuI", "opaD", "fghJ",
+    "klzx", "cvbn", "mQW", "ErTy", "UiOp", "AsDf", "GhJk", "LzXc", "VbNm",
+    "QwEr", "TyUi", "OpAs", "DfGh", "JkLz", "XcVb", "NmqW", "ErTy", "UiOp",
+    "AsDf", "GhJk", "LzXc", "VbNm", "qWeR", "tYuI", "oPaS", "dFgH", "jKlZ",
+    "xCvB", "nMqW", "eRtY", "uIoP", "aSdF", "gHjK", "lZxC", "vBnM", "QwEr",
+    "TyUi", "OpAs", "DfGh", "JkLz", "XcVb", "NmqW", "ErTy", "UiOp", "AsDf",
+    "GhJk", "LzXc", "VbNm"
+  };
+
+  for(i = 0; i < CURL_ARRAYSIZE(okay); i++) {
+    char buffer[32];
+    const struct Curl_scheme *get = Curl_get_scheme(okay[i]);
+    if(get) {
+      /* verify that we got the correct scheme */
+      if(!curl_strequal(get->name, okay[i]))
+        get = NULL;
+    }
+    if(!get) {
+      curl_mprintf("Input: %s, expected okay\n", okay[i]);
+      break;
+    }
+    Curl_strntolower(buffer, okay[i], strlen(okay[i]));
+    buffer[strlen(okay[i])] = 0;
+    if(strcmp(buffer, get->name)) {
+      curl_mprintf("Input: %s is not lowercase: %s\n", buffer, get->name);
+      break;
+    }
+  }
+  for(j = 0; j < CURL_ARRAYSIZE(notokay); j++) {
+    const struct Curl_scheme *get = Curl_get_scheme(notokay[j]);
+    if(get) {
+      curl_mprintf("Input: %s, expected not okay\n", notokay[j]);
+      break;
+    }
+  }
+
+  curl_mprintf("%zu invokes\n", i + j);
+
+  if(i != CURL_ARRAYSIZE(okay) ||
+     j != CURL_ARRAYSIZE(notokay))
+    return CURLE_FAILED_INIT;
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit1636.c b/third-party/curl/tests/unit/unit1636.c
new file mode 100644
index 0000000000..ec72b8ab31
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1636.c
@@ -0,0 +1,82 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+
+#ifndef CURL_DISABLE_PROGRESS_METER
+static CURLcode test_unit1636(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  char buffer[9];
+  curl_off_t secs;
+  int i;
+  static const curl_off_t check[] = {
+    /* bytes to check */
+    131072,
+    12645826,
+    1073741824,
+    12938588979,
+    1099445657078333,
+    0 /* end of list */
+  };
+
+  puts("time2str");
+  for(i = 0, secs = 0; i < 63; i++) {
+    time2str(buffer, sizeof(buffer), secs);
+    curl_mprintf("%20" FMT_OFF_T " - %s\n", secs, buffer);
+    if(strlen(buffer) != 7) {
+      curl_mprintf("^^ was too long!\n");
+    }
+    secs *= 2;
+    secs++;
+  }
+  puts("max6out");
+  for(i = 0, secs = 0; i < 63; i++) {
+    max6out(secs, buffer, sizeof(buffer));
+    curl_mprintf("%20" FMT_OFF_T " - %s\n", secs, buffer);
+    if(strlen(buffer) != 6) {
+      curl_mprintf("^^ was too long!\n");
+    }
+    secs *= 2;
+    secs++;
+  }
+  for(i = 0; check[i]; i++) {
+    secs = check[i];
+    max6out(secs, buffer, sizeof(buffer));
+    curl_mprintf("%20" FMT_OFF_T " - %s\n", secs, buffer);
+    if(strlen(buffer) != 6) {
+      curl_mprintf("^^ was too long!\n");
+    }
+  }
+
+  UNITTEST_END(curl_global_cleanup())
+}
+
+#else /* CURL_DISABLE_PROGRESS_METER */
+static CURLcode test_unit1636(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+  UNITTEST_END_SIMPLE
+}
+#endif
diff --git a/third-party/curl/tests/unit/unit1650.c b/third-party/curl/tests/unit/unit1650.c
index 1993616bf1..cdc3375d3c 100644
--- a/third-party/curl/tests/unit/unit1650.c
+++ b/third-party/curl/tests/unit/unit1650.c
@@ -21,64 +21,56 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "doh.h"
-#include "dynbuf.h"
 
-static CURLcode unit_setup(void)
+static CURLcode test_unit1650(const char *arg)
 {
-  return CURLE_OK;
-}
-
-static void unit_stop(void)
-{
-
-}
+  UNITTEST_BEGIN_SIMPLE
 
 #ifndef CURL_DISABLE_DOH
-#define DNS_PREAMBLE "\x00\x00\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00"
-#define LABEL_TEST "\x04\x74\x65\x73\x74"
-#define LABEL_HOST "\x04\x68\x6f\x73\x74"
-#define LABEL_NAME "\x04\x6e\x61\x6d\x65"
-#define DNSA_TYPE "\x01"
-#define DNSAAAA_TYPE "\x1c"
-#define DNSA_EPILOGUE "\x00\x00" DNSA_TYPE "\x00\x01"
+
+#define DNS_PREAMBLE     "\x00\x00\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00"
+#define LABEL_TEST       "\x04\x74\x65\x73\x74"
+#define LABEL_HOST       "\x04\x68\x6f\x73\x74"
+#define LABEL_NAME       "\x04\x6e\x61\x6d\x65"
+#define DNSA_TYPE        "\x01"
+#define DNSAAAA_TYPE     "\x1c"
+#define DNSA_EPILOGUE    "\x00\x00" DNSA_TYPE "\x00\x01"
 #define DNSAAAA_EPILOGUE "\x00\x00" DNSAAAA_TYPE "\x00\x01"
 
 #define DNS_Q1 DNS_PREAMBLE LABEL_TEST LABEL_HOST LABEL_NAME DNSA_EPILOGUE
 #define DNS_Q2 DNS_PREAMBLE LABEL_TEST LABEL_HOST LABEL_NAME DNSAAAA_EPILOGUE
 
-struct dohrequest {
-  /* input */
-  const char *name;
-  DNStype type;
+  struct dohrequest {
+    /* input */
+    const char *name;
+    DNStype type;
 
-  /* output */
-  const char *packet;
-  size_t size;
-  int rc;
-};
+    /* output */
+    const char *packet;
+    size_t size;
+    DOHcode rc;
+  };
 
+  static const struct dohrequest req[] = {
+    {"test.host.name", CURL_DNS_TYPE_A, DNS_Q1, sizeof(DNS_Q1)-1, DOH_OK },
+    {"test.host.name", CURL_DNS_TYPE_AAAA, DNS_Q2, sizeof(DNS_Q2)-1, DOH_OK },
+    {"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz"
+     ".host.name",
+     CURL_DNS_TYPE_AAAA, NULL, 0, DOH_DNS_BAD_LABEL }
+  };
 
-static const struct dohrequest req[] = {
-  {"test.host.name", DNS_TYPE_A, DNS_Q1, sizeof(DNS_Q1)-1, 0 },
-  {"test.host.name", DNS_TYPE_AAAA, DNS_Q2, sizeof(DNS_Q2)-1, 0 },
-  {"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz"
-   ".host.name",
-   DNS_TYPE_AAAA, NULL, 0, DOH_DNS_BAD_LABEL }
-};
+  struct dohresp {
+    /* input */
+    const char *packet;
+    size_t size;
+    DNStype type;
 
-struct dohresp {
-  /* input */
-  const char *packet;
-  size_t size;
-  DNStype type;
-
-  /* output */
-  int rc;
-  const char *out;
-};
+    /* output */
+    DOHcode rc;
+    const char *out;
+  };
 
 #define DNS_FOO_EXAMPLE_COM                                          \
   "\x00\x00\x01\x00\x00\x01\x00\x01\x00\x00\x00\x00\x03\x66\x6f\x6f" \
@@ -86,46 +78,46 @@ struct dohresp {
   "\x01\xc0\x0c\x00\x01\x00\x01\x00\x00\x00\x37\x00\x04\x7f\x00\x00" \
   "\x01"
 
-static const char full49[] = DNS_FOO_EXAMPLE_COM;
+  static const char full49[] = DNS_FOO_EXAMPLE_COM;
 
-static const struct dohresp resp[] = {
-  {"\x00\x00", 2, DNS_TYPE_A, DOH_TOO_SMALL_BUFFER, NULL },
+  static const struct dohresp resp[] = {
+  {"\x00\x00", 2, CURL_DNS_TYPE_A, DOH_TOO_SMALL_BUFFER, NULL },
   {"\x00\x01\x00\x01\x00\x01\x00\x01\x00\x01\x00\x01", 12,
-   DNS_TYPE_A, DOH_DNS_BAD_ID, NULL },
+   CURL_DNS_TYPE_A, DOH_DNS_BAD_ID, NULL },
   {"\x00\x00\x00\x01\x00\x01\x00\x01\x00\x01\x00\x01", 12,
-   DNS_TYPE_A, DOH_DNS_BAD_RCODE, NULL },
+   CURL_DNS_TYPE_A, DOH_DNS_BAD_RCODE, NULL },
   {"\x00\x00\x01\x00\x00\x01\x00\x01\x00\x00\x00\x00\x03\x66\x6f\x6f", 16,
-   DNS_TYPE_A, DOH_DNS_OUT_OF_RANGE, NULL },
+   CURL_DNS_TYPE_A, DOH_DNS_OUT_OF_RANGE, NULL },
   {"\x00\x00\x01\x00\x00\x01\x00\x01\x00\x00\x00\x00\x03\x66\x6f\x6f\x00", 17,
-   DNS_TYPE_A, DOH_DNS_OUT_OF_RANGE, NULL },
+   CURL_DNS_TYPE_A, DOH_DNS_OUT_OF_RANGE, NULL },
   {"\x00\x00\x01\x00\x00\x01\x00\x01\x00\x00\x00\x00\x03\x66\x6f\x6f\x00"
    "\x00\x01\x00\x01", 21,
-   DNS_TYPE_A, DOH_DNS_OUT_OF_RANGE, NULL },
+   CURL_DNS_TYPE_A, DOH_DNS_OUT_OF_RANGE, NULL },
   {"\x00\x00\x01\x00\x00\x01\x00\x01\x00\x00\x00\x00\x03\x66\x6f\x6f\x00"
    "\x00\x01\x00\x01"
    "\x04", 18,
-   DNS_TYPE_A, DOH_DNS_OUT_OF_RANGE, NULL },
+   CURL_DNS_TYPE_A, DOH_DNS_OUT_OF_RANGE, NULL },
 
   {"\x00\x00\x01\x00\x00\x01\x00\x01\x00\x00\x00\x00\x04\x63\x75\x72"
    "\x6c\x04\x63\x75\x72\x6c\x00\x00\x05\x00\x01\xc0\x0c\x00\x05\x00"
    "\x01\x00\x00\x00\x37\x00\x11\x08\x61\x6e\x79\x77\x68\x65\x72\x65"
    "\x06\x72\x65\x61\x6c\x6c\x79\x00", 56,
-   DNS_TYPE_A, DOH_OK, "anywhere.really "},
+   CURL_DNS_TYPE_A, DOH_OK, "anywhere.really (55)"},
 
-  {DNS_FOO_EXAMPLE_COM, 49, DNS_TYPE_A, DOH_OK, "127.0.0.1 "},
+  {DNS_FOO_EXAMPLE_COM, 49, CURL_DNS_TYPE_A, DOH_OK, "127.0.0.1 (55)"},
 
   {"\x00\x00\x01\x00\x00\x01\x00\x01\x00\x00\x00\x00\x04\x61\x61\x61"
    "\x61\x07\x65\x78\x61\x6d\x70\x6c\x65\x03\x63\x6f\x6d\x00\x00\x1c"
-   "\x00\x01\xc0\x0c\x00\x1c\x00\x01\x00\x00\x00\x37\x00\x10\x20\x20"
+   "\x00\x01\xc0\x0c\x00\x1c\x00\x01\x00\x00\x01\x37\x00\x10\x20\x20"
    "\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\x20", 62,
-   DNS_TYPE_AAAA, DOH_OK,
-   "2020:2020:0000:0000:0000:0000:0000:2020 " },
+   CURL_DNS_TYPE_AAAA, DOH_OK,
+   "2020:2020:0000:0000:0000:0000:0000:2020 (311)" },
 
   {"\x00\x00\x01\x00\x00\x01\x00\x01\x00\x00\x00\x00\x04\x63\x75\x72"
    "\x6c\x04\x63\x75\x72\x6c\x00\x00\x05\x00\x01\xc0\x0c\x00\x05\x00"
    "\x01\x00\x00\x00\x37\x00"
    "\x07\x03\x61\x6e\x79\xc0\x27\x00", 46,
-   DNS_TYPE_A, DOH_DNS_LABEL_LOOP, NULL},
+   CURL_DNS_TYPE_A, DOH_DNS_LABEL_LOOP, NULL},
 
   /* packet with NSCOUNT == 1 */
   {"\x00\x00\x01\x00\x00\x01\x00\x01\x00\x01\x00\x00\x04\x61\x61\x61"
@@ -136,65 +128,63 @@ static const struct dohresp resp[] = {
    "\00\x04\x01\x01\x01\x01", /* RDDATA */
 
    62 + 30,
-   DNS_TYPE_AAAA, DOH_OK,
-   "2020:2020:0000:0000:0000:0000:0000:2020 " },
+   CURL_DNS_TYPE_AAAA, DOH_OK,
+   "2020:2020:0000:0000:0000:0000:0000:2020 (55)" },
 
-  /* packet with ARCOUNT == 1 */
+  /* packet with ARCOUNT == 1, and a capped TTL */
   {"\x00\x00\x01\x00\x00\x01\x00\x01\x00\x00\x00\x01\x04\x61\x61\x61"
    "\x61\x07\x65\x78\x61\x6d\x70\x6c\x65\x03\x63\x6f\x6d\x00\x00\x1c"
-   "\x00\x01\xc0\x0c\x00\x1c\x00\x01\x00\x00\x00\x37\x00\x10\x20\x20"
+   "\x00\x01\xc0\x0c\x00\x1c\x00\x01\x00\xff\xff\x37\x00\x10\x20\x20"
    "\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\x20"
    LABEL_TEST LABEL_HOST LABEL_NAME DNSAAAA_EPILOGUE "\x00\x00\x00\x01"
    "\00\x04\x01\x01\x01\x01", /* RDDATA */
 
    62 + 30,
-   DNS_TYPE_AAAA, DOH_OK,
-   "2020:2020:0000:0000:0000:0000:0000:2020 " },
+   CURL_DNS_TYPE_AAAA, DOH_OK,
+   "2020:2020:0000:0000:0000:0000:0000:2020 (86400)" },
 
-};
+  };
 
-UNITTEST_START
-{
   size_t size = 0;
   unsigned char buffer[256];
   size_t i;
   unsigned char *p;
 
-  for(i = 0; i < sizeof(req) / sizeof(req[0]); i++) {
-    int rc = doh_encode(req[i].name, req[i].type,
-                        buffer, sizeof(buffer), &size);
+  for(i = 0; i < CURL_ARRAYSIZE(req); i++) {
+    DOHcode rc = doh_req_encode(req[i].name, req[i].type,
+                                buffer, sizeof(buffer), &size);
     if(rc != req[i].rc) {
-      fprintf(stderr, "req %zu: Expected return code %d got %d\n", i,
-              req[i].rc, rc);
+      curl_mfprintf(stderr, "req %zu: Expected return code %d got %d\n", i,
+                    (int)req[i].rc, (int)rc);
       abort_if(rc != req[i].rc, "return code");
     }
     if(size != req[i].size) {
-      fprintf(stderr, "req %zu: Expected size %zu got %zu\n", i,
-              req[i].size, size);
-      fprintf(stderr, "DNS encode made: %s\n", hexdump(buffer, size));
+      curl_mfprintf(stderr, "req %zu: Expected size %zu got %zu\n", i,
+                    req[i].size, size);
+      curl_mfprintf(stderr, "DNS encode made: %s\n", hexdump(buffer, size));
       abort_if(size != req[i].size, "size");
     }
     if(req[i].packet && memcmp(req[i].packet, buffer, size)) {
-      fprintf(stderr, "DNS encode made: %s\n", hexdump(buffer, size));
-      fprintf(stderr, "... instead of: %s\n",
-             hexdump((unsigned char *)req[i].packet, size));
+      curl_mfprintf(stderr, "DNS encode made: %s\n", hexdump(buffer, size));
+      curl_mfprintf(stderr, "... instead of: %s\n",
+                    hexdump((const unsigned char *)req[i].packet, size));
       abort_if(req[i].packet && memcmp(req[i].packet, buffer, size),
                "contents");
     }
   }
 
-  for(i = 0; i < sizeof(resp) / sizeof(resp[0]); i++) {
+  for(i = 0; i < CURL_ARRAYSIZE(resp); i++) {
     struct dohentry d;
-    int rc;
+    DOHcode rc;
     char *ptr;
     size_t len;
     int u;
     de_init(&d);
-    rc = doh_decode((const unsigned char *)resp[i].packet, resp[i].size,
-                    resp[i].type, &d);
+    rc = doh_resp_decode((const unsigned char *)resp[i].packet, resp[i].size,
+                         resp[i].type, &d);
     if(rc != resp[i].rc) {
-      fprintf(stderr, "resp %zu: Expected return code %d got %d\n", i,
-              resp[i].rc, rc);
+      curl_mfprintf(stderr, "resp %zu: Expected return code %d got %d\n", i,
+                    (int)resp[i].rc, (int)rc);
       abort_if(rc != resp[i].rc, "return code");
     }
     len = sizeof(buffer);
@@ -203,9 +193,9 @@ UNITTEST_START
       size_t o;
       struct dohaddr *a;
       a = &d.addr[u];
-      if(resp[i].type == DNS_TYPE_A) {
+      if(resp[i].type == CURL_DNS_TYPE_A) {
         p = &a->ip.v4[0];
-        msnprintf(ptr, len, "%u.%u.%u.%u ", p[0], p[1], p[2], p[3]);
+        curl_msnprintf(ptr, len, "%u.%u.%u.%u ", p[0], p[1], p[2], p[3]);
         o = strlen(ptr);
         len -= o;
         ptr += o;
@@ -214,41 +204,44 @@ UNITTEST_START
         int j;
         for(j = 0; j < 16; j += 2) {
           size_t l;
-          msnprintf(ptr, len, "%s%02x%02x", j?":":"", a->ip.v6[j],
-                   a->ip.v6[j + 1]);
+          curl_msnprintf(ptr, len, "%s%02x%02x", j ? ":" : "", a->ip.v6[j],
+                         a->ip.v6[j + 1]);
           l = strlen(ptr);
           len -= l;
           ptr += l;
         }
-        msnprintf(ptr, len, " ");
+        curl_msnprintf(ptr, len, " ");
         len--;
         ptr++;
       }
     }
     for(u = 0; u < d.numcname; u++) {
       size_t o;
-      msnprintf(ptr, len, "%s ", Curl_dyn_ptr(&d.cname[u]));
+      curl_msnprintf(ptr, len, "%s ", curlx_dyn_ptr(&d.cname[u]));
       o = strlen(ptr);
       len -= o;
       ptr += o;
     }
+    curl_msnprintf(ptr, len, "(%u)", d.ttl);
     de_cleanup(&d);
-    if(resp[i].out && strcmp((char *)buffer, resp[i].out)) {
-      fprintf(stderr, "resp %zu: Expected %s got %s\n", i,
-              resp[i].out, buffer);
-      abort_if(resp[i].out && strcmp((char *)buffer, resp[i].out), "content");
+    if(resp[i].out && strcmp((const char *)buffer, resp[i].out)) {
+      curl_mfprintf(stderr, "resp %zu: Expected %s got %s\n", i,
+                    resp[i].out, buffer);
+      abort_if(resp[i].out && strcmp((const char *)buffer, resp[i].out),
+               "content");
     }
   }
 
   /* pass all sizes into the decoder until full */
-  for(i = 0; i < sizeof(full49)-1; i++) {
+  for(i = 0; i < sizeof(full49) - 1; i++) {
     struct dohentry d;
-    int rc;
+    DOHcode rc;
     memset(&d, 0, sizeof(d));
-    rc = doh_decode((const unsigned char *)full49, i, DNS_TYPE_A, &d);
+    rc = doh_resp_decode((const unsigned char *)full49,
+                         i, CURL_DNS_TYPE_A, &d);
     if(!rc) {
       /* none of them should work */
-      fprintf(stderr, "%zu: %d\n", i, rc);
+      curl_mfprintf(stderr, "%zu: %d\n", i, (int)rc);
       abort_if(!rc, "error rc");
     }
   }
@@ -256,42 +249,37 @@ UNITTEST_START
   /* and try all pieces from the other end of the packet */
   for(i = 1; i < sizeof(full49); i++) {
     struct dohentry d;
-    int rc;
+    DOHcode rc;
     memset(&d, 0, sizeof(d));
-    rc = doh_decode((const unsigned char *)&full49[i], sizeof(full49)-i-1,
-                    DNS_TYPE_A, &d);
+    rc = doh_resp_decode((const unsigned char *)&full49[i],
+                         sizeof(full49) - i - 1, CURL_DNS_TYPE_A, &d);
     if(!rc) {
       /* none of them should work */
-      fprintf(stderr, "2 %zu: %d\n", i, rc);
+      curl_mfprintf(stderr, "2 %zu: %d\n", i, (int)rc);
       abort_if(!rc, "error rc");
     }
   }
 
   {
-    int rc;
+    DOHcode rc;
     struct dohentry d;
     struct dohaddr *a;
     memset(&d, 0, sizeof(d));
-    rc = doh_decode((const unsigned char *)full49, sizeof(full49)-1,
-                    DNS_TYPE_A, &d);
+    rc = doh_resp_decode((const unsigned char *)full49,
+                         sizeof(full49) - 1, CURL_DNS_TYPE_A, &d);
     fail_if(d.numaddr != 1, "missing address");
     a = &d.addr[0];
     p = &a->ip.v4[0];
-    msnprintf((char *)buffer, sizeof(buffer),
-              "%u.%u.%u.%u", p[0], p[1], p[2], p[3]);
-    if(rc || strcmp((char *)buffer, "127.0.0.1")) {
-      fprintf(stderr, "bad address decoded: %s, rc == %d\n", buffer, rc);
-      abort_if(rc || strcmp((char *)buffer, "127.0.0.1"), "bad address");
+    curl_msnprintf((char *)buffer, sizeof(buffer),
+                   "%u.%u.%u.%u", p[0], p[1], p[2], p[3]);
+    if(rc || strcmp((const char *)buffer, "127.0.0.1")) {
+      curl_mfprintf(stderr, "bad address decoded: %s, rc == %d\n", buffer,
+                    (int)rc);
+      abort_if(rc || strcmp((const char *)buffer, "127.0.0.1"), "bad address");
     }
     fail_if(d.numcname, "bad cname counter");
   }
-}
-UNITTEST_STOP
-
-#else /* CURL_DISABLE_DOH */
-UNITTEST_START
-/* nothing to do, just succeed */
-UNITTEST_STOP
-
-
 #endif
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit1651.c b/third-party/curl/tests/unit/unit1651.c
index 58d2f10762..fc84b33657 100644
--- a/third-party/curl/tests/unit/unit1651.c
+++ b/third-party/curl/tests/unit/unit1651.c
@@ -21,331 +21,348 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "vtls/x509asn1.h"
 
-static CURLcode unit_setup(void)
+static CURLcode test_unit1651(const char *arg)
 {
-  return CURLE_OK;
-}
+  UNITTEST_BEGIN_SIMPLE
 
-static void unit_stop(void)
-{
+#if defined(USE_GNUTLS) || defined(USE_SCHANNEL)
 
-}
-#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP)
+  /* cert captured from gdb when connecting to curl.se on October 26
+     2018. */
+  static unsigned char cert[] = {
+    0x30, 0x82, 0x0F, 0x5B, 0x30, 0x82, 0x0E, 0x43, 0xA0, 0x03, 0x02, 0x01,
+    0x02, 0x02, 0x0C, 0x08, 0x77, 0x99, 0x2C, 0x6B, 0x67, 0xE1, 0x18, 0xD6,
+    0x66, 0x66, 0x9E, 0x30, 0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7,
+    0x0D, 0x01, 0x01, 0x0B, 0x05, 0x00, 0x30, 0x57, 0x31, 0x0B, 0x30, 0x09,
+    0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x42, 0x45, 0x31, 0x19, 0x30,
+    0x17, 0x06, 0x03, 0x55, 0x04, 0x0A, 0x13, 0x10, 0x47, 0x6C, 0x6F, 0x62,
+    0x61, 0x6C, 0x53, 0x69, 0x67, 0x6E, 0x20, 0x6E, 0x76, 0x2D, 0x73, 0x61,
+    0x31, 0x2D, 0x30, 0x2B, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x24, 0x47,
+    0x6C, 0x6F, 0x62, 0x61, 0x6C, 0x53, 0x69, 0x67, 0x6E, 0x20, 0x43, 0x6C,
+    0x6F, 0x75, 0x64, 0x53, 0x53, 0x4C, 0x20, 0x43, 0x41, 0x20, 0x2D, 0x20,
+    0x53, 0x48, 0x41, 0x32, 0x35, 0x36, 0x20, 0x2D, 0x20, 0x47, 0x33, 0x30,
+    0x1E, 0x17, 0x0D, 0x31, 0x38, 0x31, 0x30, 0x32, 0x32, 0x31, 0x37, 0x31,
+    0x38, 0x32, 0x31, 0x5A, 0x17, 0x0D, 0x31, 0x39, 0x30, 0x33, 0x32, 0x31,
+    0x31, 0x33, 0x34, 0x33, 0x34, 0x34, 0x5A, 0x30, 0x77, 0x31, 0x0B, 0x30,
+    0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x13,
+    0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08, 0x0C, 0x0A, 0x43, 0x61, 0x6C,
+    0x69, 0x66, 0x6F, 0x72, 0x6E, 0x69, 0x61, 0x31, 0x16, 0x30, 0x14, 0x06,
+    0x03, 0x55, 0x04, 0x07, 0x0C, 0x0D, 0x53, 0x61, 0x6E, 0x20, 0x46, 0x72,
+    0x61, 0x6E, 0x63, 0x69, 0x73, 0x63, 0x6F, 0x31, 0x15, 0x30, 0x13, 0x06,
+    0x03, 0x55, 0x04, 0x0A, 0x0C, 0x0C, 0x46, 0x61, 0x73, 0x74, 0x6C, 0x79,
+    0x2C, 0x20, 0x49, 0x6E, 0x63, 0x2E, 0x31, 0x24, 0x30, 0x22, 0x06, 0x03,
+    0x55, 0x04, 0x03, 0x0C, 0x1B, 0x6A, 0x32, 0x2E, 0x73, 0x68, 0x61, 0x72,
+    0x65, 0x64, 0x2E, 0x67, 0x6C, 0x6F, 0x62, 0x61, 0x6C, 0x2E, 0x66, 0x61,
+    0x73, 0x74, 0x6C, 0x79, 0x2E, 0x6E, 0x65, 0x74, 0x30, 0x82, 0x01, 0x22,
+    0x30, 0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01,
+    0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0F, 0x00, 0x30, 0x82, 0x01, 0x0A,
+    0x02, 0x82, 0x01, 0x01, 0x00, 0xC2, 0x72, 0xA2, 0x4A, 0xEF, 0x26, 0x42,
+    0xD7, 0x85, 0x74, 0xC9, 0xB4, 0x9F, 0xE3, 0x31, 0xD1, 0x40, 0x77, 0xC9,
+    0x4B, 0x4D, 0xFE, 0xC8, 0x75, 0xF3, 0x32, 0x76, 0xAD, 0xF9, 0x08, 0x22,
+    0x9E, 0xFA, 0x2F, 0xFE, 0xEC, 0x6C, 0xC4, 0xF5, 0x1F, 0x70, 0xC9, 0x8F,
+    0x07, 0x48, 0x31, 0xAD, 0x75, 0x18, 0xFC, 0x06, 0x5A, 0x4F, 0xDD, 0xFD,
+    0x05, 0x39, 0x6F, 0x22, 0xF9, 0xAD, 0x62, 0x1A, 0x9E, 0xA6, 0x16, 0x48,
+    0x75, 0x8F, 0xB8, 0x07, 0x18, 0x25, 0x1A, 0x87, 0x30, 0xB0, 0x3C, 0x6F,
+    0xE0, 0x9D, 0x90, 0x63, 0x2A, 0x16, 0x1F, 0x0D, 0x10, 0xFC, 0x06, 0x7E,
+    0xEA, 0x51, 0xE2, 0xB0, 0x6D, 0x42, 0x4C, 0x2C, 0x59, 0xF4, 0x6B, 0x99,
+    0x3E, 0x82, 0x1D, 0x08, 0x04, 0x2F, 0xA0, 0x63, 0x3C, 0xAA, 0x0E, 0xE1,
+    0x5D, 0x67, 0x2D, 0xB3, 0xF4, 0x15, 0xD6, 0x16, 0x4E, 0xAA, 0x91, 0x45,
+    0x6B, 0xC5, 0xA6, 0xED, 0x83, 0xAF, 0xF1, 0xD7, 0x42, 0x5E, 0x9B, 0xC8,
+    0x39, 0x0C, 0x06, 0x76, 0x7A, 0xB8, 0x3E, 0x16, 0x70, 0xF5, 0xEB, 0x8B,
+    0x33, 0x5A, 0xA9, 0x03, 0xED, 0x79, 0x0E, 0xAD, 0xBB, 0xC4, 0xF8, 0xDA,
+    0x93, 0x53, 0x2A, 0xC4, 0xC9, 0x1A, 0xD1, 0xC3, 0x44, 0xD7, 0xC6, 0xD0,
+    0xC6, 0xAC, 0x13, 0xE3, 0xB5, 0x73, 0x3A, 0xDF, 0x54, 0x15, 0xFB, 0xB4,
+    0x6B, 0x36, 0x39, 0x18, 0xB5, 0x61, 0x12, 0xF0, 0x37, 0xAB, 0x81, 0x5F,
+    0x0C, 0xE7, 0xDF, 0xC1, 0xC5, 0x5E, 0x99, 0x67, 0x85, 0xFF, 0xAD, 0xD6,
+    0x82, 0x09, 0x1F, 0x27, 0xE5, 0x32, 0x52, 0x18, 0xEC, 0x35, 0x2F, 0x6C,
+    0xC9, 0xE6, 0x87, 0xCE, 0x30, 0xF6, 0xDA, 0x04, 0x3F, 0xA5, 0x8A, 0x0C,
+    0xAE, 0x5B, 0xB0, 0xEC, 0x29, 0x9B, 0xEE, 0x8F, 0x52, 0x1E, 0xE2, 0x56,
+    0x19, 0x45, 0x80, 0x3C, 0x02, 0x57, 0x5C, 0x52, 0xD9, 0x02, 0x03, 0x01,
+    0x00, 0x01, 0xA3, 0x82, 0x0C, 0x05, 0x30, 0x82, 0x0C, 0x01, 0x30, 0x0E,
+    0x06, 0x03, 0x55, 0x1D, 0x0F, 0x01, 0x01, 0xFF, 0x04, 0x04, 0x03, 0x02,
+    0x05, 0xA0, 0x30, 0x81, 0x8A, 0x06, 0x08, 0x2B, 0x06, 0x01, 0x05, 0x05,
+    0x07, 0x01, 0x01, 0x04, 0x7E, 0x30, 0x7C, 0x30, 0x42, 0x06, 0x08, 0x2B,
+    0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x02, 0x86, 0x36, 0x68, 0x74, 0x74,
+    0x70, 0x3A, 0x2F, 0x2F, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x2E, 0x67,
+    0x6C, 0x6F, 0x62, 0x61, 0x6C, 0x73, 0x69, 0x67, 0x6E, 0x2E, 0x63, 0x6F,
+    0x6D, 0x2F, 0x63, 0x61, 0x63, 0x65, 0x72, 0x74, 0x2F, 0x63, 0x6C, 0x6F,
+    0x75, 0x64, 0x73, 0x73, 0x6C, 0x73, 0x68, 0x61, 0x32, 0x67, 0x33, 0x2E,
+    0x63, 0x72, 0x74, 0x30, 0x36, 0x06, 0x08, 0x2B, 0x06, 0x01, 0x05, 0x05,
+    0x07, 0x30, 0x01, 0x86, 0x2A, 0x68, 0x74, 0x74, 0x70, 0x3A, 0x2F, 0x2F,
+    0x6F, 0x63, 0x73, 0x70, 0x32, 0x2E, 0x67, 0x6C, 0x6F, 0x62, 0x61, 0x6C,
+    0x73, 0x69, 0x67, 0x6E, 0x2E, 0x63, 0x6F, 0x6D, 0x2F, 0x63, 0x6C, 0x6F,
+    0x75, 0x64, 0x73, 0x73, 0x6C, 0x73, 0x68, 0x61, 0x32, 0x67, 0x33, 0x30,
+    0x56, 0x06, 0x03, 0x55, 0x1D, 0x20, 0x04, 0x4F, 0x30, 0x4D, 0x30, 0x41,
+    0x06, 0x09, 0x2B, 0x06, 0x01, 0x04, 0x01, 0xA0, 0x32, 0x01, 0x14, 0x30,
+    0x34, 0x30, 0x32, 0x06, 0x08, 0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x02,
+    0x01, 0x16, 0x26, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3A, 0x2F, 0x2F, 0x77,
+    0x77, 0x77, 0x2E, 0x67, 0x6C, 0x6F, 0x62, 0x61, 0x6C, 0x73, 0x69, 0x67,
+    0x6E, 0x2E, 0x63, 0x6F, 0x6D, 0x2F, 0x72, 0x65, 0x70, 0x6F, 0x73, 0x69,
+    0x74, 0x6F, 0x72, 0x79, 0x2F, 0x30, 0x08, 0x06, 0x06, 0x67, 0x81, 0x0C,
+    0x01, 0x02, 0x02, 0x30, 0x09, 0x06, 0x03, 0x55, 0x1D, 0x13, 0x04, 0x02,
+    0x30, 0x00, 0x30, 0x82, 0x09, 0x96, 0x06, 0x03, 0x55, 0x1D, 0x11, 0x04,
+    0x82, 0x09, 0x8D, 0x30, 0x82, 0x09, 0x89, 0x82, 0x1B, 0x6A, 0x32, 0x2E,
+    0x73, 0x68, 0x61, 0x72, 0x65, 0x64, 0x2E, 0x67, 0x6C, 0x6F, 0x62, 0x61,
+    0x6C, 0x2E, 0x66, 0x61, 0x73, 0x74, 0x6C, 0x79, 0x2E, 0x6E, 0x65, 0x74,
+    0x82, 0x0D, 0x2A, 0x2E, 0x61, 0x32, 0x70, 0x72, 0x65, 0x73, 0x73, 0x65,
+    0x2E, 0x66, 0x72, 0x82, 0x19, 0x2A, 0x2E, 0x61, 0x64, 0x76, 0x65, 0x6E,
+    0x74, 0x69, 0x73, 0x74, 0x62, 0x6F, 0x6F, 0x6B, 0x63, 0x65, 0x6E, 0x74,
+    0x65, 0x72, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x14, 0x2A, 0x2E, 0x61, 0x70,
+    0x69, 0x2E, 0x6C, 0x6F, 0x6C, 0x65, 0x73, 0x70, 0x6F, 0x72, 0x74, 0x73,
+    0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0C, 0x2A, 0x2E, 0x62, 0x61, 0x61, 0x74,
+    0x63, 0x68, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x17, 0x2A, 0x2E, 0x62, 0x69,
+    0x6F, 0x74, 0x65, 0x63, 0x68, 0x77, 0x65, 0x65, 0x6B, 0x62, 0x6F, 0x73,
+    0x74, 0x6F, 0x6E, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x10, 0x2A, 0x2E, 0x62,
+    0x6F, 0x78, 0x6F, 0x66, 0x73, 0x74, 0x79, 0x6C, 0x65, 0x2E, 0x63, 0x6F,
+    0x6D, 0x82, 0x0C, 0x2A, 0x2E, 0x63, 0x61, 0x73, 0x70, 0x65, 0x72, 0x2E,
+    0x63, 0x6F, 0x6D, 0x82, 0x11, 0x2A, 0x2E, 0x63, 0x68, 0x61, 0x6B, 0x72,
+    0x61, 0x6C, 0x69, 0x6E, 0x75, 0x78, 0x2E, 0x6F, 0x72, 0x67, 0x82, 0x18,
+    0x2A, 0x2E, 0x63, 0x6F, 0x6E, 0x76, 0x65, 0x72, 0x74, 0x2E, 0x64, 0x73,
+    0x2E, 0x76, 0x65, 0x72, 0x69, 0x7A, 0x6F, 0x6E, 0x2E, 0x63, 0x6F, 0x6D,
+    0x82, 0x15, 0x2A, 0x2E, 0x64, 0x65, 0x76, 0x73, 0x70, 0x61, 0x63, 0x65,
+    0x73, 0x68, 0x69, 0x70, 0x2E, 0x63, 0x6F, 0x6D, 0x2E, 0x61, 0x75, 0x82,
+    0x1B, 0x2A, 0x2E, 0x64, 0x65, 0x76, 0x73, 0x70, 0x61, 0x63, 0x65, 0x73,
+    0x68, 0x69, 0x70, 0x69, 0x6E, 0x76, 0x65, 0x73, 0x74, 0x2E, 0x63, 0x6F,
+    0x6D, 0x2E, 0x61, 0x75, 0x82, 0x0A, 0x2A, 0x2E, 0x65, 0x63, 0x68, 0x6C,
+    0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0F, 0x2A, 0x2E, 0x66, 0x69, 0x6C, 0x65,
+    0x73, 0x74, 0x61, 0x63, 0x6B, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x16, 0x2A,
+    0x2E, 0x66, 0x69, 0x6C, 0x65, 0x73, 0x74, 0x61, 0x63, 0x6B, 0x2E, 0x6F,
+    0x6E, 0x65, 0x6D, 0x6F, 0x62, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0D, 0x2A,
+    0x2E, 0x66, 0x69, 0x73, 0x2D, 0x73, 0x6B, 0x69, 0x2E, 0x63, 0x6F, 0x6D,
+    0x82, 0x0C, 0x2A, 0x2E, 0x66, 0x69, 0x73, 0x73, 0x6B, 0x69, 0x2E, 0x63,
+    0x6F, 0x6D, 0x82, 0x14, 0x2A, 0x2E, 0x66, 0x70, 0x2E, 0x62, 0x72, 0x61,
+    0x6E, 0x64, 0x66, 0x6F, 0x6C, 0x64, 0x65, 0x72, 0x2E, 0x63, 0x6F, 0x6D,
+    0x82, 0x0F, 0x2A, 0x2E, 0x66, 0x73, 0x2E, 0x65, 0x6E, 0x70, 0x6C, 0x75,
+    0x67, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0E, 0x2A, 0x2E, 0x66, 0x73, 0x2E,
+    0x65, 0x6E, 0x70, 0x6C, 0x75, 0x67, 0x2E, 0x69, 0x6E, 0x82, 0x10, 0x2A,
+    0x2E, 0x66, 0x73, 0x2E, 0x68, 0x65, 0x72, 0x6F, 0x69, 0x6E, 0x65, 0x2E,
+    0x63, 0x6F, 0x6D, 0x82, 0x18, 0x2A, 0x2E, 0x66, 0x73, 0x2E, 0x6C, 0x65,
+    0x61, 0x72, 0x6E, 0x7A, 0x69, 0x6C, 0x6C, 0x69, 0x6F, 0x6E, 0x63, 0x64,
+    0x6E, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x18, 0x2A, 0x2E, 0x66, 0x73, 0x2E,
+    0x6C, 0x6F, 0x63, 0x61, 0x6C, 0x7A, 0x69, 0x6C, 0x6C, 0x69, 0x6F, 0x6E,
+    0x63, 0x64, 0x6E, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x12, 0x2A, 0x2E, 0x66,
+    0x73, 0x2E, 0x6D, 0x69, 0x6E, 0x64, 0x66, 0x6C, 0x61, 0x73, 0x68, 0x2E,
+    0x63, 0x6F, 0x6D, 0x82, 0x16, 0x2A, 0x2E, 0x66, 0x73, 0x2E, 0x6F, 0x70,
+    0x73, 0x7A, 0x69, 0x6C, 0x6C, 0x69, 0x6F, 0x6E, 0x63, 0x64, 0x6E, 0x2E,
+    0x63, 0x6F, 0x6D, 0x82, 0x10, 0x2A, 0x2E, 0x66, 0x73, 0x2E, 0x70, 0x69,
+    0x78, 0x76, 0x61, 0x6E, 0x61, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x15, 0x2A,
+    0x2E, 0x66, 0x73, 0x2E, 0x71, 0x61, 0x7A, 0x69, 0x6C, 0x6C, 0x69, 0x6F,
+    0x6E, 0x63, 0x64, 0x6E, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x17, 0x2A, 0x2E,
+    0x66, 0x73, 0x2E, 0x74, 0x65, 0x73, 0x74, 0x7A, 0x69, 0x6C, 0x6C, 0x69,
+    0x6F, 0x6E, 0x63, 0x64, 0x6E, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x09, 0x2A,
+    0x2E, 0x68, 0x61, 0x78, 0x78, 0x2E, 0x73, 0x65, 0x82, 0x0D, 0x2A, 0x2E,
+    0x68, 0x6F, 0x6D, 0x65, 0x61, 0x77, 0x61, 0x79, 0x2E, 0x6C, 0x6B, 0x82,
+    0x0F, 0x2A, 0x2E, 0x69, 0x64, 0x61, 0x74, 0x61, 0x6C, 0x69, 0x6E, 0x6B,
+    0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x16, 0x2A, 0x2E, 0x69, 0x64, 0x61, 0x74,
+    0x61, 0x6C, 0x69, 0x6E, 0x6B, 0x6D, 0x61, 0x65, 0x73, 0x74, 0x72, 0x6F,
+    0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x11, 0x2A, 0x2E, 0x69, 0x6D, 0x67, 0x2D,
+    0x74, 0x61, 0x62, 0x6F, 0x6F, 0x6C, 0x61, 0x2E, 0x63, 0x6F, 0x6D, 0x82,
+    0x0F, 0x2A, 0x2E, 0x6A, 0x75, 0x6C, 0x69, 0x61, 0x6C, 0x61, 0x6E, 0x67,
+    0x2E, 0x6F, 0x72, 0x67, 0x82, 0x10, 0x2A, 0x2E, 0x6B, 0x69, 0x6E, 0x64,
+    0x73, 0x6E, 0x61, 0x63, 0x6B, 0x73, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x10,
+    0x2A, 0x2E, 0x6B, 0x73, 0x73, 0x76, 0x61, 0x6E, 0x69, 0x6C, 0x6C, 0x61,
+    0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0E, 0x2A, 0x2E, 0x6B, 0x73, 0x74, 0x63,
+    0x6F, 0x72, 0x72, 0x61, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x10, 0x2A, 0x2E,
+    0x6B, 0x73, 0x74, 0x76, 0x61, 0x6E, 0x69, 0x6C, 0x6C, 0x61, 0x2E, 0x63,
+    0x6F, 0x6D, 0x82, 0x0C, 0x2A, 0x2E, 0x6E, 0x65, 0x77, 0x73, 0x31, 0x32,
+    0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x1B, 0x2A, 0x2E, 0x70, 0x61, 0x72, 0x74,
+    0x69, 0x64, 0x65, 0x6E, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x2E, 0x73,
+    0x77, 0x69, 0x73, 0x63, 0x6F, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x13, 0x2A,
+    0x2E, 0x73, 0x68, 0x6F, 0x70, 0x72, 0x61, 0x63, 0x68, 0x65, 0x6C, 0x7A,
+    0x6F, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0A, 0x2A, 0x2E, 0x74, 0x61,
+    0x73, 0x74, 0x79, 0x2E, 0x63, 0x6F, 0x82, 0x0C, 0x2A, 0x2E, 0x74, 0x65,
+    0x64, 0x63, 0x64, 0x6E, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x15, 0x2A, 0x2E,
+    0x75, 0x70, 0x6C, 0x6F, 0x61, 0x64, 0x73, 0x2E, 0x66, 0x6F, 0x6C, 0x69,
+    0x6F, 0x68, 0x64, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x14, 0x2A, 0x2E, 0x76,
+    0x6F, 0x75, 0x63, 0x68, 0x65, 0x72, 0x63, 0x6F, 0x64, 0x65, 0x73, 0x2E,
+    0x63, 0x6F, 0x2E, 0x75, 0x6B, 0x82, 0x0D, 0x2A, 0x2E, 0x77, 0x65, 0x61,
+    0x74, 0x68, 0x65, 0x72, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0D, 0x61, 0x2E,
+    0x69, 0x63, 0x61, 0x6E, 0x76, 0x61, 0x73, 0x2E, 0x63, 0x6F, 0x6D, 0x82,
+    0x0B, 0x61, 0x32, 0x70, 0x72, 0x65, 0x73, 0x73, 0x65, 0x2E, 0x66, 0x72,
+    0x82, 0x17, 0x61, 0x64, 0x76, 0x65, 0x6E, 0x74, 0x69, 0x73, 0x74, 0x62,
+    0x6F, 0x6F, 0x6B, 0x63, 0x65, 0x6E, 0x74, 0x65, 0x72, 0x2E, 0x63, 0x6F,
+    0x6D, 0x82, 0x11, 0x61, 0x70, 0x69, 0x2D, 0x6D, 0x65, 0x72, 0x72, 0x79,
+    0x6A, 0x61, 0x6E, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x12, 0x61, 0x70,
+    0x69, 0x73, 0x2E, 0x69, 0x64, 0x61, 0x74, 0x61, 0x6C, 0x69, 0x76, 0x65,
+    0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0F, 0x61, 0x70, 0x70, 0x2D, 0x61, 0x70,
+    0x69, 0x2E, 0x74, 0x65, 0x64, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x12, 0x61,
+    0x70, 0x70, 0x2E, 0x62, 0x69, 0x72, 0x63, 0x68, 0x62, 0x6F, 0x78, 0x2E,
+    0x63, 0x6F, 0x2E, 0x75, 0x6B, 0x82, 0x0F, 0x61, 0x70, 0x70, 0x2E, 0x62,
+    0x69, 0x72, 0x63, 0x68, 0x62, 0x6F, 0x78, 0x2E, 0x65, 0x73, 0x82, 0x1A,
+    0x61, 0x70, 0x70, 0x2E, 0x73, 0x74, 0x61, 0x67, 0x69, 0x6E, 0x67, 0x2E,
+    0x62, 0x69, 0x72, 0x63, 0x68, 0x62, 0x6F, 0x78, 0x2E, 0x63, 0x6F, 0x2E,
+    0x75, 0x6B, 0x82, 0x17, 0x61, 0x70, 0x70, 0x2E, 0x73, 0x74, 0x61, 0x67,
+    0x69, 0x6E, 0x67, 0x2E, 0x62, 0x69, 0x72, 0x63, 0x68, 0x62, 0x6F, 0x78,
+    0x2E, 0x65, 0x73, 0x82, 0x0A, 0x62, 0x61, 0x61, 0x74, 0x63, 0x68, 0x2E,
+    0x63, 0x6F, 0x6D, 0x82, 0x13, 0x62, 0x65, 0x72, 0x6E, 0x61, 0x72, 0x64,
+    0x63, 0x6F, 0x6E, 0x74, 0x72, 0x6F, 0x6C, 0x73, 0x2E, 0x63, 0x6F, 0x6D,
+    0x82, 0x15, 0x62, 0x69, 0x6F, 0x74, 0x65, 0x63, 0x68, 0x77, 0x65, 0x65,
+    0x6B, 0x62, 0x6F, 0x73, 0x74, 0x6F, 0x6E, 0x2E, 0x63, 0x6F, 0x6D, 0x82,
+    0x0E, 0x62, 0x6F, 0x78, 0x6F, 0x66, 0x73, 0x74, 0x79, 0x6C, 0x65, 0x2E,
+    0x63, 0x6F, 0x6D, 0x82, 0x0A, 0x63, 0x61, 0x73, 0x70, 0x65, 0x72, 0x2E,
+    0x63, 0x6F, 0x6D, 0x82, 0x0D, 0x63, 0x64, 0x6E, 0x2E, 0x69, 0x72, 0x73,
+    0x64, 0x6E, 0x2E, 0x6E, 0x65, 0x74, 0x82, 0x0F, 0x63, 0x68, 0x61, 0x6B,
+    0x72, 0x61, 0x6C, 0x69, 0x6E, 0x75, 0x78, 0x2E, 0x6F, 0x72, 0x67, 0x82,
+    0x13, 0x64, 0x65, 0x76, 0x73, 0x70, 0x61, 0x63, 0x65, 0x73, 0x68, 0x69,
+    0x70, 0x2E, 0x63, 0x6F, 0x6D, 0x2E, 0x61, 0x75, 0x82, 0x0B, 0x64, 0x69,
+    0x67, 0x69, 0x64, 0x61, 0x79, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x22, 0x64,
+    0x69, 0x67, 0x69, 0x74, 0x61, 0x6C, 0x4C, 0x69, 0x62, 0x72, 0x61, 0x72,
+    0x79, 0x2E, 0x62, 0x65, 0x72, 0x6E, 0x61, 0x72, 0x64, 0x63, 0x6F, 0x6E,
+    0x74, 0x72, 0x6F, 0x6C, 0x73, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x14, 0x64,
+    0x72, 0x77, 0x70, 0x2E, 0x73, 0x74, 0x61, 0x67, 0x69, 0x6E, 0x67, 0x2E,
+    0x6D, 0x6F, 0x6F, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x08, 0x65, 0x63, 0x68,
+    0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x14, 0x66, 0x69, 0x6C, 0x65, 0x73,
+    0x74, 0x61, 0x63, 0x6B, 0x2E, 0x6F, 0x6E, 0x65, 0x6D, 0x6F, 0x62, 0x2E,
+    0x63, 0x6F, 0x6D, 0x82, 0x0D, 0x66, 0x73, 0x2E, 0x65, 0x6E, 0x70, 0x6C,
+    0x75, 0x67, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x16, 0x66, 0x73, 0x2E, 0x6C,
+    0x65, 0x61, 0x72, 0x6E, 0x7A, 0x69, 0x6C, 0x6C, 0x69, 0x6F, 0x6E, 0x63,
+    0x64, 0x6E, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x16, 0x66, 0x73, 0x2E, 0x6C,
+    0x6F, 0x63, 0x61, 0x6C, 0x7A, 0x69, 0x6C, 0x6C, 0x69, 0x6F, 0x6E, 0x63,
+    0x64, 0x6E, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x14, 0x66, 0x73, 0x2E, 0x6F,
+    0x70, 0x73, 0x7A, 0x69, 0x6C, 0x6C, 0x69, 0x6F, 0x6E, 0x63, 0x64, 0x6E,
+    0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x13, 0x66, 0x73, 0x2E, 0x71, 0x61, 0x7A,
+    0x69, 0x6C, 0x6C, 0x69, 0x6F, 0x6E, 0x63, 0x64, 0x6E, 0x2E, 0x63, 0x6F,
+    0x6D, 0x82, 0x15, 0x66, 0x73, 0x2E, 0x74, 0x65, 0x73, 0x74, 0x7A, 0x69,
+    0x6C, 0x6C, 0x69, 0x6F, 0x6E, 0x63, 0x64, 0x6E, 0x2E, 0x63, 0x6F, 0x6D,
+    0x82, 0x0B, 0x68, 0x6F, 0x6D, 0x65, 0x61, 0x77, 0x61, 0x79, 0x2E, 0x6C,
+    0x6B, 0x82, 0x12, 0x69, 0x6D, 0x67, 0x2E, 0x74, 0x72, 0x69, 0x67, 0x67,
+    0x65, 0x72, 0x6D, 0x61, 0x69, 0x6C, 0x2E, 0x69, 0x6F, 0x82, 0x0E, 0x6B,
+    0x69, 0x6E, 0x64, 0x73, 0x6E, 0x61, 0x63, 0x6B, 0x73, 0x2E, 0x63, 0x6F,
+    0x6D, 0x82, 0x0E, 0x6B, 0x73, 0x73, 0x76, 0x61, 0x6E, 0x69, 0x6C, 0x6C,
+    0x61, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0C, 0x6B, 0x73, 0x74, 0x63, 0x6F,
+    0x72, 0x72, 0x61, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0D, 0x6D, 0x65, 0x6E,
+    0x75, 0x2E, 0x74, 0x72, 0x65, 0x65, 0x7A, 0x2E, 0x69, 0x6F, 0x82, 0x17,
+    0x6D, 0x6F, 0x62, 0x69, 0x6C, 0x65, 0x61, 0x70, 0x69, 0x2E, 0x69, 0x64,
+    0x61, 0x74, 0x61, 0x6C, 0x69, 0x6E, 0x6B, 0x2E, 0x63, 0x6F, 0x6D, 0x82,
+    0x0A, 0x6E, 0x65, 0x77, 0x73, 0x31, 0x32, 0x2E, 0x63, 0x6F, 0x6D, 0x82,
+    0x0B, 0x6F, 0x6D, 0x6E, 0x69, 0x67, 0x6F, 0x6E, 0x2E, 0x63, 0x6F, 0x6D,
+    0x82, 0x0E, 0x6F, 0x72, 0x65, 0x69, 0x6C, 0x6C, 0x79, 0x2E, 0x72, 0x65,
+    0x76, 0x69, 0x65, 0x77, 0x82, 0x11, 0x70, 0x6F, 0x70, 0x79, 0x6F, 0x75,
+    0x72, 0x62, 0x75, 0x62, 0x62, 0x6C, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x82,
+    0x18, 0x70, 0x72, 0x6F, 0x64, 0x2E, 0x62, 0x65, 0x72, 0x6E, 0x61, 0x72,
+    0x64, 0x63, 0x6F, 0x6E, 0x74, 0x72, 0x6F, 0x6C, 0x73, 0x2E, 0x63, 0x6F,
+    0x6D, 0x82, 0x18, 0x72, 0x65, 0x6C, 0x65, 0x61, 0x73, 0x65, 0x2D, 0x70,
+    0x72, 0x69, 0x6D, 0x65, 0x2E, 0x73, 0x70, 0x6F, 0x6B, 0x65, 0x6F, 0x2E,
+    0x63, 0x6F, 0x6D, 0x82, 0x19, 0x72, 0x65, 0x70, 0x6F, 0x73, 0x69, 0x74,
+    0x6F, 0x72, 0x69, 0x65, 0x73, 0x2E, 0x73, 0x65, 0x6E, 0x73, 0x75, 0x61,
+    0x70, 0x70, 0x2E, 0x6F, 0x72, 0x67, 0x82, 0x0C, 0x72, 0x6C, 0x2E, 0x74,
+    0x61, 0x6C, 0x69, 0x73, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x11, 0x73, 0x68,
+    0x6F, 0x70, 0x72, 0x61, 0x63, 0x68, 0x65, 0x6C, 0x7A, 0x6F, 0x65, 0x2E,
+    0x63, 0x6F, 0x6D, 0x82, 0x0F, 0x73, 0x74, 0x61, 0x67, 0x69, 0x6E, 0x67,
+    0x2E, 0x6D, 0x6F, 0x6F, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x14, 0x73, 0x74,
+    0x61, 0x74, 0x69, 0x63, 0x2E, 0x70, 0x6C, 0x75, 0x6D, 0x63, 0x61, 0x63,
+    0x68, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x14, 0x73, 0x74, 0x61, 0x79,
+    0x69, 0x6E, 0x67, 0x61, 0x6C, 0x69, 0x76, 0x65, 0x2E, 0x6D, 0x73, 0x66,
+    0x2E, 0x6F, 0x72, 0x67, 0x82, 0x08, 0x74, 0x61, 0x73, 0x74, 0x79, 0x2E,
+    0x63, 0x6F, 0x82, 0x0C, 0x74, 0x6F, 0x70, 0x73, 0x70, 0x65, 0x65, 0x64,
+    0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x13, 0x75, 0x70, 0x6C, 0x6F, 0x61, 0x64,
+    0x73, 0x2E, 0x66, 0x6F, 0x6C, 0x69, 0x6F, 0x68, 0x64, 0x2E, 0x63, 0x6F,
+    0x6D, 0x82, 0x1A, 0x75, 0x73, 0x2D, 0x65, 0x75, 0x2E, 0x66, 0x69, 0x6C,
+    0x65, 0x73, 0x74, 0x61, 0x63, 0x6B, 0x63, 0x6F, 0x6E, 0x74, 0x65, 0x6E,
+    0x74, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x12, 0x76, 0x6F, 0x75, 0x63, 0x68,
+    0x65, 0x72, 0x63, 0x6F, 0x64, 0x65, 0x73, 0x2E, 0x63, 0x6F, 0x2E, 0x75,
+    0x6B, 0x82, 0x0B, 0x77, 0x65, 0x61, 0x74, 0x68, 0x65, 0x72, 0x2E, 0x63,
+    0x6F, 0x6D, 0x82, 0x13, 0x77, 0x6F, 0x6D, 0x65, 0x6E, 0x73, 0x68, 0x65,
+    0x61, 0x6C, 0x74, 0x68, 0x2D, 0x6A, 0x70, 0x2E, 0x63, 0x6F, 0x6D, 0x82,
+    0x19, 0x77, 0x6F, 0x72, 0x6B, 0x65, 0x72, 0x62, 0x65, 0x65, 0x2E, 0x73,
+    0x74, 0x61, 0x67, 0x69, 0x6E, 0x67, 0x2E, 0x6D, 0x6F, 0x6F, 0x2E, 0x63,
+    0x6F, 0x6D, 0x82, 0x0A, 0x77, 0x77, 0x77, 0x2E, 0x61, 0x67, 0x66, 0x2E,
+    0x64, 0x6B, 0x82, 0x14, 0x77, 0x77, 0x77, 0x2E, 0x61, 0x76, 0x65, 0x6E,
+    0x69, 0x72, 0x2D, 0x73, 0x75, 0x69, 0x73, 0x73, 0x65, 0x2E, 0x63, 0x68,
+    0x82, 0x11, 0x77, 0x77, 0x77, 0x2E, 0x63, 0x61, 0x6E, 0x73, 0x74, 0x61,
+    0x72, 0x2E, 0x63, 0x6F, 0x2E, 0x6E, 0x7A, 0x82, 0x15, 0x77, 0x77, 0x77,
+    0x2E, 0x63, 0x61, 0x6E, 0x73, 0x74, 0x61, 0x72, 0x62, 0x6C, 0x75, 0x65,
+    0x2E, 0x63, 0x6F, 0x2E, 0x6E, 0x7A, 0x82, 0x16, 0x77, 0x77, 0x77, 0x2E,
+    0x63, 0x61, 0x6E, 0x73, 0x74, 0x61, 0x72, 0x62, 0x6C, 0x75, 0x65, 0x2E,
+    0x63, 0x6F, 0x6D, 0x2E, 0x61, 0x75, 0x82, 0x1D, 0x77, 0x77, 0x77, 0x2E,
+    0x63, 0x68, 0x61, 0x6D, 0x70, 0x69, 0x6F, 0x6E, 0x73, 0x68, 0x6F, 0x63,
+    0x6B, 0x65, 0x79, 0x6C, 0x65, 0x61, 0x67, 0x75, 0x65, 0x2E, 0x6E, 0x65,
+    0x74, 0x82, 0x0F, 0x77, 0x77, 0x77, 0x2E, 0x65, 0x78, 0x74, 0x65, 0x72,
+    0x72, 0x6F, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0C, 0x77, 0x77, 0x77, 0x2E,
+    0x65, 0x7A, 0x75, 0x70, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0B, 0x77, 0x77,
+    0x77, 0x2E, 0x65, 0x7A, 0x75, 0x70, 0x2E, 0x64, 0x65, 0x82, 0x0B, 0x77,
+    0x77, 0x77, 0x2E, 0x65, 0x7A, 0x75, 0x70, 0x2E, 0x65, 0x75, 0x82, 0x0B,
+    0x77, 0x77, 0x77, 0x2E, 0x65, 0x7A, 0x75, 0x70, 0x2E, 0x6E, 0x6C, 0x82,
+    0x11, 0x77, 0x77, 0x77, 0x2E, 0x66, 0x72, 0x61, 0x6E, 0x6B, 0x62, 0x6F,
+    0x64, 0x79, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0D, 0x77, 0x77, 0x77, 0x2E,
+    0x67, 0x6C, 0x6F, 0x73, 0x73, 0x79, 0x2E, 0x63, 0x6F, 0x82, 0x0F, 0x77,
+    0x77, 0x77, 0x2E, 0x67, 0x6F, 0x6C, 0x64, 0x63, 0x75, 0x70, 0x2E, 0x6F,
+    0x72, 0x67, 0x82, 0x0F, 0x77, 0x77, 0x77, 0x2E, 0x69, 0x63, 0x61, 0x6E,
+    0x76, 0x61, 0x73, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0D, 0x77, 0x77, 0x77,
+    0x2E, 0x6D, 0x6F, 0x6E, 0x69, 0x6E, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x16,
+    0x77, 0x77, 0x77, 0x2E, 0x6F, 0x64, 0x65, 0x6E, 0x73, 0x65, 0x2D, 0x6D,
+    0x61, 0x72, 0x63, 0x69, 0x70, 0x61, 0x6E, 0x2E, 0x64, 0x6B, 0x82, 0x15,
+    0x77, 0x77, 0x77, 0x2E, 0x6F, 0x6E, 0x65, 0x63, 0x6C, 0x69, 0x63, 0x6B,
+    0x64, 0x72, 0x69, 0x76, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x12, 0x77,
+    0x77, 0x77, 0x2E, 0x6F, 0x72, 0x65, 0x69, 0x6C, 0x6C, 0x79, 0x2E, 0x72,
+    0x65, 0x76, 0x69, 0x65, 0x77, 0x82, 0x15, 0x77, 0x77, 0x77, 0x2E, 0x70,
+    0x6F, 0x70, 0x79, 0x6F, 0x75, 0x72, 0x62, 0x75, 0x62, 0x62, 0x6C, 0x65,
+    0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0E, 0x77, 0x77, 0x77, 0x2E, 0x72, 0x61,
+    0x77, 0x6E, 0x65, 0x74, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0E, 0x77, 0x77,
+    0x77, 0x2E, 0x73, 0x70, 0x6F, 0x6B, 0x65, 0x6F, 0x2E, 0x63, 0x6F, 0x6D,
+    0x82, 0x10, 0x77, 0x77, 0x77, 0x2E, 0x74, 0x65, 0x61, 0x72, 0x73, 0x68,
+    0x65, 0x65, 0x74, 0x2E, 0x63, 0x6F, 0x82, 0x10, 0x77, 0x77, 0x77, 0x2E,
+    0x74, 0x6F, 0x70, 0x73, 0x70, 0x65, 0x65, 0x64, 0x2E, 0x63, 0x6F, 0x6D,
+    0x82, 0x16, 0x77, 0x77, 0x77, 0x2E, 0x77, 0x68, 0x69, 0x74, 0x65, 0x6B,
+    0x65, 0x79, 0x76, 0x69, 0x6C, 0x6C, 0x61, 0x73, 0x2E, 0x63, 0x6F, 0x6D,
+    0x30, 0x1D, 0x06, 0x03, 0x55, 0x1D, 0x25, 0x04, 0x16, 0x30, 0x14, 0x06,
+    0x08, 0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x01, 0x06, 0x08, 0x2B,
+    0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x02, 0x30, 0x1D, 0x06, 0x03, 0x55,
+    0x1D, 0x0E, 0x04, 0x16, 0x04, 0x14, 0xA8, 0x29, 0xFD, 0xA9, 0xA5, 0x1A,
+    0x1C, 0x37, 0x0B, 0x20, 0x3B, 0x98, 0xB7, 0x25, 0x39, 0xCC, 0xE5, 0x2F,
+    0xF4, 0x94, 0x30, 0x1F, 0x06, 0x03, 0x55, 0x1D, 0x23, 0x04, 0x18, 0x30,
+    0x16, 0x80, 0x14, 0xA9, 0x2B, 0x87, 0xE1, 0xCE, 0x24, 0x47, 0x3B, 0x1B,
+    0xBF, 0xCF, 0x85, 0x37, 0x02, 0x55, 0x9D, 0x0D, 0x94, 0x58, 0xE6, 0x30,
+    0x82, 0x01, 0x04, 0x06, 0x0A, 0x2B, 0x06, 0x01, 0x04, 0x01, 0xD6, 0x79,
+    0x02, 0x04, 0x02, 0x04, 0x81, 0xF5, 0x04, 0x81, 0xF2, 0x00, 0xF0, 0x00,
+    0x77, 0x00, 0xA4, 0xB9, 0x09, 0x90, 0xB4, 0x18, 0x58, 0x14, 0x87, 0xBB,
+    0x13, 0xA2, 0xCC, 0x67, 0x70, 0x0A, 0x3C, 0x35, 0x98, 0x04, 0xF9, 0x1B,
+    0xDF, 0xB8, 0xE3, 0x77, 0xCD, 0x0E, 0xC8, 0x0D, 0xDC, 0x10, 0x00, 0x00,
+    0x01, 0x66, 0x9C, 0xC8, 0xE7, 0x38, 0x00, 0x00, 0x04, 0x03, 0x00, 0x48,
+    0x30, 0x46, 0x02, 0x21, 0x00, 0xD9, 0x58, 0x6E, 0xFC, 0x4C, 0x3C, 0xAF,
+    0xF9, 0x5B, 0x7F, 0xDA, 0x54, 0x95, 0xAF, 0xCF, 0xB3, 0x57, 0xB9, 0x56,
+    0x2C, 0xE8, 0xE0, 0xB1, 0x20, 0x9B, 0xCB, 0x75, 0xAC, 0x4E, 0x54, 0xE9,
+    0x9D, 0x02, 0x21, 0x00, 0xE8, 0xF0, 0xC0, 0x49, 0x23, 0x8E, 0x3D, 0x9B,
+    0xA5, 0x87, 0xA3, 0xBE, 0x6C, 0x21, 0x62, 0xBB, 0xD2, 0x44, 0x5C, 0xE4,
+    0x7A, 0xCC, 0x46, 0x26, 0x04, 0x19, 0xA4, 0x2D, 0x9B, 0x1C, 0x5D, 0x3A,
+    0x00, 0x75, 0x00, 0x6F, 0x53, 0x76, 0xAC, 0x31, 0xF0, 0x31, 0x19, 0xD8,
+    0x99, 0x00, 0xA4, 0x51, 0x15, 0xFF, 0x77, 0x15, 0x1C, 0x11, 0xD9, 0x02,
+    0xC1, 0x00, 0x29, 0x06, 0x8D, 0xB2, 0x08, 0x9A, 0x37, 0xD9, 0x13, 0x00,
+    0x00, 0x01, 0x66, 0x9C, 0xC8, 0xE6, 0x20, 0x00, 0x00, 0x04, 0x03, 0x00,
+    0x46, 0x30, 0x44, 0x02, 0x20, 0x14, 0xC8, 0x9F, 0xAC, 0x27, 0x48, 0xBE,
+    0x4D, 0x0E, 0xC3, 0x26, 0x2E, 0x34, 0xCA, 0x38, 0xBA, 0x11, 0x3A, 0x68,
+    0x71, 0x88, 0xEB, 0x24, 0x26, 0x59, 0x3E, 0xAC, 0xA8, 0x63, 0xCC, 0x8A,
+    0x0A, 0x02, 0x20, 0x0F, 0x22, 0xBF, 0x0D, 0x1F, 0x8A, 0x8D, 0x1D, 0x91,
+    0x33, 0x3A, 0x40, 0xE4, 0x23, 0x78, 0xFA, 0x22, 0xF5, 0x9B, 0xCB, 0x04,
+    0x4F, 0x53, 0x2D, 0x20, 0x75, 0x2F, 0x76, 0x8A, 0xB1, 0xCD, 0x9D, 0x30,
+    0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0B,
+    0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x03, 0x41, 0x0F, 0xF3, 0xA6,
+    0x62, 0xA2, 0xE5, 0xB4, 0x8D, 0xA8, 0x08, 0x71, 0x7B, 0xB3, 0xE3, 0x51,
+    0x61, 0x0D, 0xC0, 0x67, 0x6C, 0x3C, 0x9C, 0x00, 0x0B, 0x63, 0x77, 0xB6,
+    0xB6, 0x11, 0x67, 0x77, 0xA5, 0xE1, 0x49, 0xE0, 0x7F, 0xB7, 0x1D, 0x61,
+    0xFB, 0x83, 0x9C, 0x83, 0x42, 0xE9, 0x31, 0xCA, 0x51, 0xE3, 0xC1, 0xBD,
+    0x9B, 0x2F, 0xB5, 0x35, 0x05, 0x72, 0x7F, 0x40, 0xA6, 0x7C, 0xC9, 0xF1,
+    0x59, 0xA7, 0x15, 0xB8, 0x12, 0xDA, 0xF8, 0xCE, 0x83, 0x61, 0xFC, 0x47,
+    0x96, 0x9E, 0x74, 0xFE, 0xCD, 0xE4, 0x61, 0x92, 0xF2, 0x2E, 0x0C, 0x08,
+    0x4B, 0x60, 0x2D, 0xF6, 0x50, 0x07, 0x83, 0xCA, 0xAF, 0xB9, 0x41, 0x33,
+    0x4A, 0x3E, 0x84, 0xC7, 0x73, 0xC6, 0x1F, 0xFF, 0x7A, 0xDF, 0xAE, 0x47,
+    0x25, 0x32, 0xEB, 0xC0, 0x43, 0x0C, 0xA6, 0x23, 0x13, 0x46, 0xC3, 0xFA,
+    0x44, 0xEA, 0x20, 0xEA, 0xCB, 0x18, 0x17, 0x00, 0xB6, 0xE7, 0x6D, 0x8A,
+    0x14, 0x8C, 0x6A, 0xCA, 0x88, 0x4C, 0xDA, 0xA8, 0xB9, 0x08, 0xAF, 0x39,
+    0xEE, 0xCF, 0xD7, 0xF7, 0x32, 0xC0, 0xF4, 0xCF, 0x4E, 0x22, 0x38, 0xF7,
+    0xAF, 0xAE, 0x7D, 0x58, 0x5F, 0xA5, 0x2D, 0x4D, 0xBB, 0x86, 0x10, 0xB3,
+    0x93, 0x62, 0x64, 0x27, 0xBF, 0xB1, 0xBB, 0x8F, 0x9F, 0xFC, 0x07, 0x3C,
+    0x4B, 0x16, 0x7A, 0x84, 0x5E, 0xAF, 0xAD, 0x57, 0x9C, 0xFF, 0x7A, 0xA7,
+    0xE0, 0x90, 0x89, 0x1C, 0xE8, 0xE5, 0x11, 0xF7, 0xB6, 0xDC, 0xCD, 0x5E,
+    0xF7, 0x30, 0xA2, 0x2E, 0x67, 0x6D, 0x4A, 0x70, 0x26, 0xEA, 0xCD, 0x27,
+    0x70, 0x77, 0x54, 0x57, 0x09, 0x03, 0x56, 0x4A, 0x33, 0x60, 0x00, 0x27,
+    0xFE, 0xA7, 0xD7, 0xA9, 0xC4, 0xEC, 0x17, 0x17, 0x8D, 0x87, 0x70, 0x6B,
+    0x48, 0x88, 0x61, 0x54, 0x4A, 0x2B, 0xB7, 0x6A, 0x12, 0x08, 0xFB,
+  };
 
-/* cert captured from gdb when connecting to curl.se on October 26
-   2018 */
-static unsigned char cert[] = {
-  0x30, 0x82, 0x0F, 0x5B, 0x30, 0x82, 0x0E, 0x43, 0xA0, 0x03, 0x02, 0x01, 0x02,
-  0x02, 0x0C, 0x08, 0x77, 0x99, 0x2C, 0x6B, 0x67, 0xE1, 0x18, 0xD6, 0x66, 0x66,
-  0x9E, 0x30, 0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01,
-  0x0B, 0x05, 0x00, 0x30, 0x57, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,
-  0x06, 0x13, 0x02, 0x42, 0x45, 0x31, 0x19, 0x30, 0x17, 0x06, 0x03, 0x55, 0x04,
-  0x0A, 0x13, 0x10, 0x47, 0x6C, 0x6F, 0x62, 0x61, 0x6C, 0x53, 0x69, 0x67, 0x6E,
-  0x20, 0x6E, 0x76, 0x2D, 0x73, 0x61, 0x31, 0x2D, 0x30, 0x2B, 0x06, 0x03, 0x55,
-  0x04, 0x03, 0x13, 0x24, 0x47, 0x6C, 0x6F, 0x62, 0x61, 0x6C, 0x53, 0x69, 0x67,
-  0x6E, 0x20, 0x43, 0x6C, 0x6F, 0x75, 0x64, 0x53, 0x53, 0x4C, 0x20, 0x43, 0x41,
-  0x20, 0x2D, 0x20, 0x53, 0x48, 0x41, 0x32, 0x35, 0x36, 0x20, 0x2D, 0x20, 0x47,
-  0x33, 0x30, 0x1E, 0x17, 0x0D, 0x31, 0x38, 0x31, 0x30, 0x32, 0x32, 0x31, 0x37,
-  0x31, 0x38, 0x32, 0x31, 0x5A, 0x17, 0x0D, 0x31, 0x39, 0x30, 0x33, 0x32, 0x31,
-  0x31, 0x33, 0x34, 0x33, 0x34, 0x34, 0x5A, 0x30, 0x77, 0x31, 0x0B, 0x30, 0x09,
-  0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11,
-  0x06, 0x03, 0x55, 0x04, 0x08, 0x0C, 0x0A, 0x43, 0x61, 0x6C, 0x69, 0x66, 0x6F,
-  0x72, 0x6E, 0x69, 0x61, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x07,
-  0x0C, 0x0D, 0x53, 0x61, 0x6E, 0x20, 0x46, 0x72, 0x61, 0x6E, 0x63, 0x69, 0x73,
-  0x63, 0x6F, 0x31, 0x15, 0x30, 0x13, 0x06, 0x03, 0x55, 0x04, 0x0A, 0x0C, 0x0C,
-  0x46, 0x61, 0x73, 0x74, 0x6C, 0x79, 0x2C, 0x20, 0x49, 0x6E, 0x63, 0x2E, 0x31,
-  0x24, 0x30, 0x22, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0C, 0x1B, 0x6A, 0x32, 0x2E,
-  0x73, 0x68, 0x61, 0x72, 0x65, 0x64, 0x2E, 0x67, 0x6C, 0x6F, 0x62, 0x61, 0x6C,
-  0x2E, 0x66, 0x61, 0x73, 0x74, 0x6C, 0x79, 0x2E, 0x6E, 0x65, 0x74, 0x30, 0x82,
-  0x01, 0x22, 0x30, 0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01,
-  0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0F, 0x00, 0x30, 0x82, 0x01, 0x0A,
-  0x02, 0x82, 0x01, 0x01, 0x00, 0xC2, 0x72, 0xA2, 0x4A, 0xEF, 0x26, 0x42, 0xD7,
-  0x85, 0x74, 0xC9, 0xB4, 0x9F, 0xE3, 0x31, 0xD1, 0x40, 0x77, 0xC9, 0x4B, 0x4D,
-  0xFE, 0xC8, 0x75, 0xF3, 0x32, 0x76, 0xAD, 0xF9, 0x08, 0x22, 0x9E, 0xFA, 0x2F,
-  0xFE, 0xEC, 0x6C, 0xC4, 0xF5, 0x1F, 0x70, 0xC9, 0x8F, 0x07, 0x48, 0x31, 0xAD,
-  0x75, 0x18, 0xFC, 0x06, 0x5A, 0x4F, 0xDD, 0xFD, 0x05, 0x39, 0x6F, 0x22, 0xF9,
-  0xAD, 0x62, 0x1A, 0x9E, 0xA6, 0x16, 0x48, 0x75, 0x8F, 0xB8, 0x07, 0x18, 0x25,
-  0x1A, 0x87, 0x30, 0xB0, 0x3C, 0x6F, 0xE0, 0x9D, 0x90, 0x63, 0x2A, 0x16, 0x1F,
-  0x0D, 0x10, 0xFC, 0x06, 0x7E, 0xEA, 0x51, 0xE2, 0xB0, 0x6D, 0x42, 0x4C, 0x2C,
-  0x59, 0xF4, 0x6B, 0x99, 0x3E, 0x82, 0x1D, 0x08, 0x04, 0x2F, 0xA0, 0x63, 0x3C,
-  0xAA, 0x0E, 0xE1, 0x5D, 0x67, 0x2D, 0xB3, 0xF4, 0x15, 0xD6, 0x16, 0x4E, 0xAA,
-  0x91, 0x45, 0x6B, 0xC5, 0xA6, 0xED, 0x83, 0xAF, 0xF1, 0xD7, 0x42, 0x5E, 0x9B,
-  0xC8, 0x39, 0x0C, 0x06, 0x76, 0x7A, 0xB8, 0x3E, 0x16, 0x70, 0xF5, 0xEB, 0x8B,
-  0x33, 0x5A, 0xA9, 0x03, 0xED, 0x79, 0x0E, 0xAD, 0xBB, 0xC4, 0xF8, 0xDA, 0x93,
-  0x53, 0x2A, 0xC4, 0xC9, 0x1A, 0xD1, 0xC3, 0x44, 0xD7, 0xC6, 0xD0, 0xC6, 0xAC,
-  0x13, 0xE3, 0xB5, 0x73, 0x3A, 0xDF, 0x54, 0x15, 0xFB, 0xB4, 0x6B, 0x36, 0x39,
-  0x18, 0xB5, 0x61, 0x12, 0xF0, 0x37, 0xAB, 0x81, 0x5F, 0x0C, 0xE7, 0xDF, 0xC1,
-  0xC5, 0x5E, 0x99, 0x67, 0x85, 0xFF, 0xAD, 0xD6, 0x82, 0x09, 0x1F, 0x27, 0xE5,
-  0x32, 0x52, 0x18, 0xEC, 0x35, 0x2F, 0x6C, 0xC9, 0xE6, 0x87, 0xCE, 0x30, 0xF6,
-  0xDA, 0x04, 0x3F, 0xA5, 0x8A, 0x0C, 0xAE, 0x5B, 0xB0, 0xEC, 0x29, 0x9B, 0xEE,
-  0x8F, 0x52, 0x1E, 0xE2, 0x56, 0x19, 0x45, 0x80, 0x3C, 0x02, 0x57, 0x5C, 0x52,
-  0xD9, 0x02, 0x03, 0x01, 0x00, 0x01, 0xA3, 0x82, 0x0C, 0x05, 0x30, 0x82, 0x0C,
-  0x01, 0x30, 0x0E, 0x06, 0x03, 0x55, 0x1D, 0x0F, 0x01, 0x01, 0xFF, 0x04, 0x04,
-  0x03, 0x02, 0x05, 0xA0, 0x30, 0x81, 0x8A, 0x06, 0x08, 0x2B, 0x06, 0x01, 0x05,
-  0x05, 0x07, 0x01, 0x01, 0x04, 0x7E, 0x30, 0x7C, 0x30, 0x42, 0x06, 0x08, 0x2B,
-  0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x02, 0x86, 0x36, 0x68, 0x74, 0x74, 0x70,
-  0x3A, 0x2F, 0x2F, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x2E, 0x67, 0x6C, 0x6F,
-  0x62, 0x61, 0x6C, 0x73, 0x69, 0x67, 0x6E, 0x2E, 0x63, 0x6F, 0x6D, 0x2F, 0x63,
-  0x61, 0x63, 0x65, 0x72, 0x74, 0x2F, 0x63, 0x6C, 0x6F, 0x75, 0x64, 0x73, 0x73,
-  0x6C, 0x73, 0x68, 0x61, 0x32, 0x67, 0x33, 0x2E, 0x63, 0x72, 0x74, 0x30, 0x36,
-  0x06, 0x08, 0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x86, 0x2A, 0x68,
-  0x74, 0x74, 0x70, 0x3A, 0x2F, 0x2F, 0x6F, 0x63, 0x73, 0x70, 0x32, 0x2E, 0x67,
-  0x6C, 0x6F, 0x62, 0x61, 0x6C, 0x73, 0x69, 0x67, 0x6E, 0x2E, 0x63, 0x6F, 0x6D,
-  0x2F, 0x63, 0x6C, 0x6F, 0x75, 0x64, 0x73, 0x73, 0x6C, 0x73, 0x68, 0x61, 0x32,
-  0x67, 0x33, 0x30, 0x56, 0x06, 0x03, 0x55, 0x1D, 0x20, 0x04, 0x4F, 0x30, 0x4D,
-  0x30, 0x41, 0x06, 0x09, 0x2B, 0x06, 0x01, 0x04, 0x01, 0xA0, 0x32, 0x01, 0x14,
-  0x30, 0x34, 0x30, 0x32, 0x06, 0x08, 0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x02,
-  0x01, 0x16, 0x26, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3A, 0x2F, 0x2F, 0x77, 0x77,
-  0x77, 0x2E, 0x67, 0x6C, 0x6F, 0x62, 0x61, 0x6C, 0x73, 0x69, 0x67, 0x6E, 0x2E,
-  0x63, 0x6F, 0x6D, 0x2F, 0x72, 0x65, 0x70, 0x6F, 0x73, 0x69, 0x74, 0x6F, 0x72,
-  0x79, 0x2F, 0x30, 0x08, 0x06, 0x06, 0x67, 0x81, 0x0C, 0x01, 0x02, 0x02, 0x30,
-  0x09, 0x06, 0x03, 0x55, 0x1D, 0x13, 0x04, 0x02, 0x30, 0x00, 0x30, 0x82, 0x09,
-  0x96, 0x06, 0x03, 0x55, 0x1D, 0x11, 0x04, 0x82, 0x09, 0x8D, 0x30, 0x82, 0x09,
-  0x89, 0x82, 0x1B, 0x6A, 0x32, 0x2E, 0x73, 0x68, 0x61, 0x72, 0x65, 0x64, 0x2E,
-  0x67, 0x6C, 0x6F, 0x62, 0x61, 0x6C, 0x2E, 0x66, 0x61, 0x73, 0x74, 0x6C, 0x79,
-  0x2E, 0x6E, 0x65, 0x74, 0x82, 0x0D, 0x2A, 0x2E, 0x61, 0x32, 0x70, 0x72, 0x65,
-  0x73, 0x73, 0x65, 0x2E, 0x66, 0x72, 0x82, 0x19, 0x2A, 0x2E, 0x61, 0x64, 0x76,
-  0x65, 0x6E, 0x74, 0x69, 0x73, 0x74, 0x62, 0x6F, 0x6F, 0x6B, 0x63, 0x65, 0x6E,
-  0x74, 0x65, 0x72, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x14, 0x2A, 0x2E, 0x61, 0x70,
-  0x69, 0x2E, 0x6C, 0x6F, 0x6C, 0x65, 0x73, 0x70, 0x6F, 0x72, 0x74, 0x73, 0x2E,
-  0x63, 0x6F, 0x6D, 0x82, 0x0C, 0x2A, 0x2E, 0x62, 0x61, 0x61, 0x74, 0x63, 0x68,
-  0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x17, 0x2A, 0x2E, 0x62, 0x69, 0x6F, 0x74, 0x65,
-  0x63, 0x68, 0x77, 0x65, 0x65, 0x6B, 0x62, 0x6F, 0x73, 0x74, 0x6F, 0x6E, 0x2E,
-  0x63, 0x6F, 0x6D, 0x82, 0x10, 0x2A, 0x2E, 0x62, 0x6F, 0x78, 0x6F, 0x66, 0x73,
-  0x74, 0x79, 0x6C, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0C, 0x2A, 0x2E, 0x63,
-  0x61, 0x73, 0x70, 0x65, 0x72, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x11, 0x2A, 0x2E,
-  0x63, 0x68, 0x61, 0x6B, 0x72, 0x61, 0x6C, 0x69, 0x6E, 0x75, 0x78, 0x2E, 0x6F,
-  0x72, 0x67, 0x82, 0x18, 0x2A, 0x2E, 0x63, 0x6F, 0x6E, 0x76, 0x65, 0x72, 0x74,
-  0x2E, 0x64, 0x73, 0x2E, 0x76, 0x65, 0x72, 0x69, 0x7A, 0x6F, 0x6E, 0x2E, 0x63,
-  0x6F, 0x6D, 0x82, 0x15, 0x2A, 0x2E, 0x64, 0x65, 0x76, 0x73, 0x70, 0x61, 0x63,
-  0x65, 0x73, 0x68, 0x69, 0x70, 0x2E, 0x63, 0x6F, 0x6D, 0x2E, 0x61, 0x75, 0x82,
-  0x1B, 0x2A, 0x2E, 0x64, 0x65, 0x76, 0x73, 0x70, 0x61, 0x63, 0x65, 0x73, 0x68,
-  0x69, 0x70, 0x69, 0x6E, 0x76, 0x65, 0x73, 0x74, 0x2E, 0x63, 0x6F, 0x6D, 0x2E,
-  0x61, 0x75, 0x82, 0x0A, 0x2A, 0x2E, 0x65, 0x63, 0x68, 0x6C, 0x2E, 0x63, 0x6F,
-  0x6D, 0x82, 0x0F, 0x2A, 0x2E, 0x66, 0x69, 0x6C, 0x65, 0x73, 0x74, 0x61, 0x63,
-  0x6B, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x16, 0x2A, 0x2E, 0x66, 0x69, 0x6C, 0x65,
-  0x73, 0x74, 0x61, 0x63, 0x6B, 0x2E, 0x6F, 0x6E, 0x65, 0x6D, 0x6F, 0x62, 0x2E,
-  0x63, 0x6F, 0x6D, 0x82, 0x0D, 0x2A, 0x2E, 0x66, 0x69, 0x73, 0x2D, 0x73, 0x6B,
-  0x69, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0C, 0x2A, 0x2E, 0x66, 0x69, 0x73, 0x73,
-  0x6B, 0x69, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x14, 0x2A, 0x2E, 0x66, 0x70, 0x2E,
-  0x62, 0x72, 0x61, 0x6E, 0x64, 0x66, 0x6F, 0x6C, 0x64, 0x65, 0x72, 0x2E, 0x63,
-  0x6F, 0x6D, 0x82, 0x0F, 0x2A, 0x2E, 0x66, 0x73, 0x2E, 0x65, 0x6E, 0x70, 0x6C,
-  0x75, 0x67, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0E, 0x2A, 0x2E, 0x66, 0x73, 0x2E,
-  0x65, 0x6E, 0x70, 0x6C, 0x75, 0x67, 0x2E, 0x69, 0x6E, 0x82, 0x10, 0x2A, 0x2E,
-  0x66, 0x73, 0x2E, 0x68, 0x65, 0x72, 0x6F, 0x69, 0x6E, 0x65, 0x2E, 0x63, 0x6F,
-  0x6D, 0x82, 0x18, 0x2A, 0x2E, 0x66, 0x73, 0x2E, 0x6C, 0x65, 0x61, 0x72, 0x6E,
-  0x7A, 0x69, 0x6C, 0x6C, 0x69, 0x6F, 0x6E, 0x63, 0x64, 0x6E, 0x2E, 0x63, 0x6F,
-  0x6D, 0x82, 0x18, 0x2A, 0x2E, 0x66, 0x73, 0x2E, 0x6C, 0x6F, 0x63, 0x61, 0x6C,
-  0x7A, 0x69, 0x6C, 0x6C, 0x69, 0x6F, 0x6E, 0x63, 0x64, 0x6E, 0x2E, 0x63, 0x6F,
-  0x6D, 0x82, 0x12, 0x2A, 0x2E, 0x66, 0x73, 0x2E, 0x6D, 0x69, 0x6E, 0x64, 0x66,
-  0x6C, 0x61, 0x73, 0x68, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x16, 0x2A, 0x2E, 0x66,
-  0x73, 0x2E, 0x6F, 0x70, 0x73, 0x7A, 0x69, 0x6C, 0x6C, 0x69, 0x6F, 0x6E, 0x63,
-  0x64, 0x6E, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x10, 0x2A, 0x2E, 0x66, 0x73, 0x2E,
-  0x70, 0x69, 0x78, 0x76, 0x61, 0x6E, 0x61, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x15,
-  0x2A, 0x2E, 0x66, 0x73, 0x2E, 0x71, 0x61, 0x7A, 0x69, 0x6C, 0x6C, 0x69, 0x6F,
-  0x6E, 0x63, 0x64, 0x6E, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x17, 0x2A, 0x2E, 0x66,
-  0x73, 0x2E, 0x74, 0x65, 0x73, 0x74, 0x7A, 0x69, 0x6C, 0x6C, 0x69, 0x6F, 0x6E,
-  0x63, 0x64, 0x6E, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x09, 0x2A, 0x2E, 0x68, 0x61,
-  0x78, 0x78, 0x2E, 0x73, 0x65, 0x82, 0x0D, 0x2A, 0x2E, 0x68, 0x6F, 0x6D, 0x65,
-  0x61, 0x77, 0x61, 0x79, 0x2E, 0x6C, 0x6B, 0x82, 0x0F, 0x2A, 0x2E, 0x69, 0x64,
-  0x61, 0x74, 0x61, 0x6C, 0x69, 0x6E, 0x6B, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x16,
-  0x2A, 0x2E, 0x69, 0x64, 0x61, 0x74, 0x61, 0x6C, 0x69, 0x6E, 0x6B, 0x6D, 0x61,
-  0x65, 0x73, 0x74, 0x72, 0x6F, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x11, 0x2A, 0x2E,
-  0x69, 0x6D, 0x67, 0x2D, 0x74, 0x61, 0x62, 0x6F, 0x6F, 0x6C, 0x61, 0x2E, 0x63,
-  0x6F, 0x6D, 0x82, 0x0F, 0x2A, 0x2E, 0x6A, 0x75, 0x6C, 0x69, 0x61, 0x6C, 0x61,
-  0x6E, 0x67, 0x2E, 0x6F, 0x72, 0x67, 0x82, 0x10, 0x2A, 0x2E, 0x6B, 0x69, 0x6E,
-  0x64, 0x73, 0x6E, 0x61, 0x63, 0x6B, 0x73, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x10,
-  0x2A, 0x2E, 0x6B, 0x73, 0x73, 0x76, 0x61, 0x6E, 0x69, 0x6C, 0x6C, 0x61, 0x2E,
-  0x63, 0x6F, 0x6D, 0x82, 0x0E, 0x2A, 0x2E, 0x6B, 0x73, 0x74, 0x63, 0x6F, 0x72,
-  0x72, 0x61, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x10, 0x2A, 0x2E, 0x6B, 0x73, 0x74,
-  0x76, 0x61, 0x6E, 0x69, 0x6C, 0x6C, 0x61, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0C,
-  0x2A, 0x2E, 0x6E, 0x65, 0x77, 0x73, 0x31, 0x32, 0x2E, 0x63, 0x6F, 0x6D, 0x82,
-  0x1B, 0x2A, 0x2E, 0x70, 0x61, 0x72, 0x74, 0x69, 0x64, 0x65, 0x6E, 0x74, 0x69,
-  0x66, 0x69, 0x65, 0x72, 0x2E, 0x73, 0x77, 0x69, 0x73, 0x63, 0x6F, 0x2E, 0x63,
-  0x6F, 0x6D, 0x82, 0x13, 0x2A, 0x2E, 0x73, 0x68, 0x6F, 0x70, 0x72, 0x61, 0x63,
-  0x68, 0x65, 0x6C, 0x7A, 0x6F, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0A, 0x2A,
-  0x2E, 0x74, 0x61, 0x73, 0x74, 0x79, 0x2E, 0x63, 0x6F, 0x82, 0x0C, 0x2A, 0x2E,
-  0x74, 0x65, 0x64, 0x63, 0x64, 0x6E, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x15, 0x2A,
-  0x2E, 0x75, 0x70, 0x6C, 0x6F, 0x61, 0x64, 0x73, 0x2E, 0x66, 0x6F, 0x6C, 0x69,
-  0x6F, 0x68, 0x64, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x14, 0x2A, 0x2E, 0x76, 0x6F,
-  0x75, 0x63, 0x68, 0x65, 0x72, 0x63, 0x6F, 0x64, 0x65, 0x73, 0x2E, 0x63, 0x6F,
-  0x2E, 0x75, 0x6B, 0x82, 0x0D, 0x2A, 0x2E, 0x77, 0x65, 0x61, 0x74, 0x68, 0x65,
-  0x72, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0D, 0x61, 0x2E, 0x69, 0x63, 0x61, 0x6E,
-  0x76, 0x61, 0x73, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0B, 0x61, 0x32, 0x70, 0x72,
-  0x65, 0x73, 0x73, 0x65, 0x2E, 0x66, 0x72, 0x82, 0x17, 0x61, 0x64, 0x76, 0x65,
-  0x6E, 0x74, 0x69, 0x73, 0x74, 0x62, 0x6F, 0x6F, 0x6B, 0x63, 0x65, 0x6E, 0x74,
-  0x65, 0x72, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x11, 0x61, 0x70, 0x69, 0x2D, 0x6D,
-  0x65, 0x72, 0x72, 0x79, 0x6A, 0x61, 0x6E, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x82,
-  0x12, 0x61, 0x70, 0x69, 0x73, 0x2E, 0x69, 0x64, 0x61, 0x74, 0x61, 0x6C, 0x69,
-  0x76, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0F, 0x61, 0x70, 0x70, 0x2D, 0x61,
-  0x70, 0x69, 0x2E, 0x74, 0x65, 0x64, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x12, 0x61,
-  0x70, 0x70, 0x2E, 0x62, 0x69, 0x72, 0x63, 0x68, 0x62, 0x6F, 0x78, 0x2E, 0x63,
-  0x6F, 0x2E, 0x75, 0x6B, 0x82, 0x0F, 0x61, 0x70, 0x70, 0x2E, 0x62, 0x69, 0x72,
-  0x63, 0x68, 0x62, 0x6F, 0x78, 0x2E, 0x65, 0x73, 0x82, 0x1A, 0x61, 0x70, 0x70,
-  0x2E, 0x73, 0x74, 0x61, 0x67, 0x69, 0x6E, 0x67, 0x2E, 0x62, 0x69, 0x72, 0x63,
-  0x68, 0x62, 0x6F, 0x78, 0x2E, 0x63, 0x6F, 0x2E, 0x75, 0x6B, 0x82, 0x17, 0x61,
-  0x70, 0x70, 0x2E, 0x73, 0x74, 0x61, 0x67, 0x69, 0x6E, 0x67, 0x2E, 0x62, 0x69,
-  0x72, 0x63, 0x68, 0x62, 0x6F, 0x78, 0x2E, 0x65, 0x73, 0x82, 0x0A, 0x62, 0x61,
-  0x61, 0x74, 0x63, 0x68, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x13, 0x62, 0x65, 0x72,
-  0x6E, 0x61, 0x72, 0x64, 0x63, 0x6F, 0x6E, 0x74, 0x72, 0x6F, 0x6C, 0x73, 0x2E,
-  0x63, 0x6F, 0x6D, 0x82, 0x15, 0x62, 0x69, 0x6F, 0x74, 0x65, 0x63, 0x68, 0x77,
-  0x65, 0x65, 0x6B, 0x62, 0x6F, 0x73, 0x74, 0x6F, 0x6E, 0x2E, 0x63, 0x6F, 0x6D,
-  0x82, 0x0E, 0x62, 0x6F, 0x78, 0x6F, 0x66, 0x73, 0x74, 0x79, 0x6C, 0x65, 0x2E,
-  0x63, 0x6F, 0x6D, 0x82, 0x0A, 0x63, 0x61, 0x73, 0x70, 0x65, 0x72, 0x2E, 0x63,
-  0x6F, 0x6D, 0x82, 0x0D, 0x63, 0x64, 0x6E, 0x2E, 0x69, 0x72, 0x73, 0x64, 0x6E,
-  0x2E, 0x6E, 0x65, 0x74, 0x82, 0x0F, 0x63, 0x68, 0x61, 0x6B, 0x72, 0x61, 0x6C,
-  0x69, 0x6E, 0x75, 0x78, 0x2E, 0x6F, 0x72, 0x67, 0x82, 0x13, 0x64, 0x65, 0x76,
-  0x73, 0x70, 0x61, 0x63, 0x65, 0x73, 0x68, 0x69, 0x70, 0x2E, 0x63, 0x6F, 0x6D,
-  0x2E, 0x61, 0x75, 0x82, 0x0B, 0x64, 0x69, 0x67, 0x69, 0x64, 0x61, 0x79, 0x2E,
-  0x63, 0x6F, 0x6D, 0x82, 0x22, 0x64, 0x69, 0x67, 0x69, 0x74, 0x61, 0x6C, 0x4C,
-  0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x2E, 0x62, 0x65, 0x72, 0x6E, 0x61, 0x72,
-  0x64, 0x63, 0x6F, 0x6E, 0x74, 0x72, 0x6F, 0x6C, 0x73, 0x2E, 0x63, 0x6F, 0x6D,
-  0x82, 0x14, 0x64, 0x72, 0x77, 0x70, 0x2E, 0x73, 0x74, 0x61, 0x67, 0x69, 0x6E,
-  0x67, 0x2E, 0x6D, 0x6F, 0x6F, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x08, 0x65, 0x63,
-  0x68, 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x14, 0x66, 0x69, 0x6C, 0x65, 0x73,
-  0x74, 0x61, 0x63, 0x6B, 0x2E, 0x6F, 0x6E, 0x65, 0x6D, 0x6F, 0x62, 0x2E, 0x63,
-  0x6F, 0x6D, 0x82, 0x0D, 0x66, 0x73, 0x2E, 0x65, 0x6E, 0x70, 0x6C, 0x75, 0x67,
-  0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x16, 0x66, 0x73, 0x2E, 0x6C, 0x65, 0x61, 0x72,
-  0x6E, 0x7A, 0x69, 0x6C, 0x6C, 0x69, 0x6F, 0x6E, 0x63, 0x64, 0x6E, 0x2E, 0x63,
-  0x6F, 0x6D, 0x82, 0x16, 0x66, 0x73, 0x2E, 0x6C, 0x6F, 0x63, 0x61, 0x6C, 0x7A,
-  0x69, 0x6C, 0x6C, 0x69, 0x6F, 0x6E, 0x63, 0x64, 0x6E, 0x2E, 0x63, 0x6F, 0x6D,
-  0x82, 0x14, 0x66, 0x73, 0x2E, 0x6F, 0x70, 0x73, 0x7A, 0x69, 0x6C, 0x6C, 0x69,
-  0x6F, 0x6E, 0x63, 0x64, 0x6E, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x13, 0x66, 0x73,
-  0x2E, 0x71, 0x61, 0x7A, 0x69, 0x6C, 0x6C, 0x69, 0x6F, 0x6E, 0x63, 0x64, 0x6E,
-  0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x15, 0x66, 0x73, 0x2E, 0x74, 0x65, 0x73, 0x74,
-  0x7A, 0x69, 0x6C, 0x6C, 0x69, 0x6F, 0x6E, 0x63, 0x64, 0x6E, 0x2E, 0x63, 0x6F,
-  0x6D, 0x82, 0x0B, 0x68, 0x6F, 0x6D, 0x65, 0x61, 0x77, 0x61, 0x79, 0x2E, 0x6C,
-  0x6B, 0x82, 0x12, 0x69, 0x6D, 0x67, 0x2E, 0x74, 0x72, 0x69, 0x67, 0x67, 0x65,
-  0x72, 0x6D, 0x61, 0x69, 0x6C, 0x2E, 0x69, 0x6F, 0x82, 0x0E, 0x6B, 0x69, 0x6E,
-  0x64, 0x73, 0x6E, 0x61, 0x63, 0x6B, 0x73, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0E,
-  0x6B, 0x73, 0x73, 0x76, 0x61, 0x6E, 0x69, 0x6C, 0x6C, 0x61, 0x2E, 0x63, 0x6F,
-  0x6D, 0x82, 0x0C, 0x6B, 0x73, 0x74, 0x63, 0x6F, 0x72, 0x72, 0x61, 0x2E, 0x63,
-  0x6F, 0x6D, 0x82, 0x0D, 0x6D, 0x65, 0x6E, 0x75, 0x2E, 0x74, 0x72, 0x65, 0x65,
-  0x7A, 0x2E, 0x69, 0x6F, 0x82, 0x17, 0x6D, 0x6F, 0x62, 0x69, 0x6C, 0x65, 0x61,
-  0x70, 0x69, 0x2E, 0x69, 0x64, 0x61, 0x74, 0x61, 0x6C, 0x69, 0x6E, 0x6B, 0x2E,
-  0x63, 0x6F, 0x6D, 0x82, 0x0A, 0x6E, 0x65, 0x77, 0x73, 0x31, 0x32, 0x2E, 0x63,
-  0x6F, 0x6D, 0x82, 0x0B, 0x6F, 0x6D, 0x6E, 0x69, 0x67, 0x6F, 0x6E, 0x2E, 0x63,
-  0x6F, 0x6D, 0x82, 0x0E, 0x6F, 0x72, 0x65, 0x69, 0x6C, 0x6C, 0x79, 0x2E, 0x72,
-  0x65, 0x76, 0x69, 0x65, 0x77, 0x82, 0x11, 0x70, 0x6F, 0x70, 0x79, 0x6F, 0x75,
-  0x72, 0x62, 0x75, 0x62, 0x62, 0x6C, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x18,
-  0x70, 0x72, 0x6F, 0x64, 0x2E, 0x62, 0x65, 0x72, 0x6E, 0x61, 0x72, 0x64, 0x63,
-  0x6F, 0x6E, 0x74, 0x72, 0x6F, 0x6C, 0x73, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x18,
-  0x72, 0x65, 0x6C, 0x65, 0x61, 0x73, 0x65, 0x2D, 0x70, 0x72, 0x69, 0x6D, 0x65,
-  0x2E, 0x73, 0x70, 0x6F, 0x6B, 0x65, 0x6F, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x19,
-  0x72, 0x65, 0x70, 0x6F, 0x73, 0x69, 0x74, 0x6F, 0x72, 0x69, 0x65, 0x73, 0x2E,
-  0x73, 0x65, 0x6E, 0x73, 0x75, 0x61, 0x70, 0x70, 0x2E, 0x6F, 0x72, 0x67, 0x82,
-  0x0C, 0x72, 0x6C, 0x2E, 0x74, 0x61, 0x6C, 0x69, 0x73, 0x2E, 0x63, 0x6F, 0x6D,
-  0x82, 0x11, 0x73, 0x68, 0x6F, 0x70, 0x72, 0x61, 0x63, 0x68, 0x65, 0x6C, 0x7A,
-  0x6F, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0F, 0x73, 0x74, 0x61, 0x67, 0x69,
-  0x6E, 0x67, 0x2E, 0x6D, 0x6F, 0x6F, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x14, 0x73,
-  0x74, 0x61, 0x74, 0x69, 0x63, 0x2E, 0x70, 0x6C, 0x75, 0x6D, 0x63, 0x61, 0x63,
-  0x68, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x14, 0x73, 0x74, 0x61, 0x79, 0x69,
-  0x6E, 0x67, 0x61, 0x6C, 0x69, 0x76, 0x65, 0x2E, 0x6D, 0x73, 0x66, 0x2E, 0x6F,
-  0x72, 0x67, 0x82, 0x08, 0x74, 0x61, 0x73, 0x74, 0x79, 0x2E, 0x63, 0x6F, 0x82,
-  0x0C, 0x74, 0x6F, 0x70, 0x73, 0x70, 0x65, 0x65, 0x64, 0x2E, 0x63, 0x6F, 0x6D,
-  0x82, 0x13, 0x75, 0x70, 0x6C, 0x6F, 0x61, 0x64, 0x73, 0x2E, 0x66, 0x6F, 0x6C,
-  0x69, 0x6F, 0x68, 0x64, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x1A, 0x75, 0x73, 0x2D,
-  0x65, 0x75, 0x2E, 0x66, 0x69, 0x6C, 0x65, 0x73, 0x74, 0x61, 0x63, 0x6B, 0x63,
-  0x6F, 0x6E, 0x74, 0x65, 0x6E, 0x74, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x12, 0x76,
-  0x6F, 0x75, 0x63, 0x68, 0x65, 0x72, 0x63, 0x6F, 0x64, 0x65, 0x73, 0x2E, 0x63,
-  0x6F, 0x2E, 0x75, 0x6B, 0x82, 0x0B, 0x77, 0x65, 0x61, 0x74, 0x68, 0x65, 0x72,
-  0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x13, 0x77, 0x6F, 0x6D, 0x65, 0x6E, 0x73, 0x68,
-  0x65, 0x61, 0x6C, 0x74, 0x68, 0x2D, 0x6A, 0x70, 0x2E, 0x63, 0x6F, 0x6D, 0x82,
-  0x19, 0x77, 0x6F, 0x72, 0x6B, 0x65, 0x72, 0x62, 0x65, 0x65, 0x2E, 0x73, 0x74,
-  0x61, 0x67, 0x69, 0x6E, 0x67, 0x2E, 0x6D, 0x6F, 0x6F, 0x2E, 0x63, 0x6F, 0x6D,
-  0x82, 0x0A, 0x77, 0x77, 0x77, 0x2E, 0x61, 0x67, 0x66, 0x2E, 0x64, 0x6B, 0x82,
-  0x14, 0x77, 0x77, 0x77, 0x2E, 0x61, 0x76, 0x65, 0x6E, 0x69, 0x72, 0x2D, 0x73,
-  0x75, 0x69, 0x73, 0x73, 0x65, 0x2E, 0x63, 0x68, 0x82, 0x11, 0x77, 0x77, 0x77,
-  0x2E, 0x63, 0x61, 0x6E, 0x73, 0x74, 0x61, 0x72, 0x2E, 0x63, 0x6F, 0x2E, 0x6E,
-  0x7A, 0x82, 0x15, 0x77, 0x77, 0x77, 0x2E, 0x63, 0x61, 0x6E, 0x73, 0x74, 0x61,
-  0x72, 0x62, 0x6C, 0x75, 0x65, 0x2E, 0x63, 0x6F, 0x2E, 0x6E, 0x7A, 0x82, 0x16,
-  0x77, 0x77, 0x77, 0x2E, 0x63, 0x61, 0x6E, 0x73, 0x74, 0x61, 0x72, 0x62, 0x6C,
-  0x75, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x2E, 0x61, 0x75, 0x82, 0x1D, 0x77, 0x77,
-  0x77, 0x2E, 0x63, 0x68, 0x61, 0x6D, 0x70, 0x69, 0x6F, 0x6E, 0x73, 0x68, 0x6F,
-  0x63, 0x6B, 0x65, 0x79, 0x6C, 0x65, 0x61, 0x67, 0x75, 0x65, 0x2E, 0x6E, 0x65,
-  0x74, 0x82, 0x0F, 0x77, 0x77, 0x77, 0x2E, 0x65, 0x78, 0x74, 0x65, 0x72, 0x72,
-  0x6F, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0C, 0x77, 0x77, 0x77, 0x2E, 0x65, 0x7A,
-  0x75, 0x70, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0B, 0x77, 0x77, 0x77, 0x2E, 0x65,
-  0x7A, 0x75, 0x70, 0x2E, 0x64, 0x65, 0x82, 0x0B, 0x77, 0x77, 0x77, 0x2E, 0x65,
-  0x7A, 0x75, 0x70, 0x2E, 0x65, 0x75, 0x82, 0x0B, 0x77, 0x77, 0x77, 0x2E, 0x65,
-  0x7A, 0x75, 0x70, 0x2E, 0x6E, 0x6C, 0x82, 0x11, 0x77, 0x77, 0x77, 0x2E, 0x66,
-  0x72, 0x61, 0x6E, 0x6B, 0x62, 0x6F, 0x64, 0x79, 0x2E, 0x63, 0x6F, 0x6D, 0x82,
-  0x0D, 0x77, 0x77, 0x77, 0x2E, 0x67, 0x6C, 0x6F, 0x73, 0x73, 0x79, 0x2E, 0x63,
-  0x6F, 0x82, 0x0F, 0x77, 0x77, 0x77, 0x2E, 0x67, 0x6F, 0x6C, 0x64, 0x63, 0x75,
-  0x70, 0x2E, 0x6F, 0x72, 0x67, 0x82, 0x0F, 0x77, 0x77, 0x77, 0x2E, 0x69, 0x63,
-  0x61, 0x6E, 0x76, 0x61, 0x73, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0D, 0x77, 0x77,
-  0x77, 0x2E, 0x6D, 0x6F, 0x6E, 0x69, 0x6E, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x16,
-  0x77, 0x77, 0x77, 0x2E, 0x6F, 0x64, 0x65, 0x6E, 0x73, 0x65, 0x2D, 0x6D, 0x61,
-  0x72, 0x63, 0x69, 0x70, 0x61, 0x6E, 0x2E, 0x64, 0x6B, 0x82, 0x15, 0x77, 0x77,
-  0x77, 0x2E, 0x6F, 0x6E, 0x65, 0x63, 0x6C, 0x69, 0x63, 0x6B, 0x64, 0x72, 0x69,
-  0x76, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x12, 0x77, 0x77, 0x77, 0x2E, 0x6F,
-  0x72, 0x65, 0x69, 0x6C, 0x6C, 0x79, 0x2E, 0x72, 0x65, 0x76, 0x69, 0x65, 0x77,
-  0x82, 0x15, 0x77, 0x77, 0x77, 0x2E, 0x70, 0x6F, 0x70, 0x79, 0x6F, 0x75, 0x72,
-  0x62, 0x75, 0x62, 0x62, 0x6C, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x82, 0x0E, 0x77,
-  0x77, 0x77, 0x2E, 0x72, 0x61, 0x77, 0x6E, 0x65, 0x74, 0x2E, 0x63, 0x6F, 0x6D,
-  0x82, 0x0E, 0x77, 0x77, 0x77, 0x2E, 0x73, 0x70, 0x6F, 0x6B, 0x65, 0x6F, 0x2E,
-  0x63, 0x6F, 0x6D, 0x82, 0x10, 0x77, 0x77, 0x77, 0x2E, 0x74, 0x65, 0x61, 0x72,
-  0x73, 0x68, 0x65, 0x65, 0x74, 0x2E, 0x63, 0x6F, 0x82, 0x10, 0x77, 0x77, 0x77,
-  0x2E, 0x74, 0x6F, 0x70, 0x73, 0x70, 0x65, 0x65, 0x64, 0x2E, 0x63, 0x6F, 0x6D,
-  0x82, 0x16, 0x77, 0x77, 0x77, 0x2E, 0x77, 0x68, 0x69, 0x74, 0x65, 0x6B, 0x65,
-  0x79, 0x76, 0x69, 0x6C, 0x6C, 0x61, 0x73, 0x2E, 0x63, 0x6F, 0x6D, 0x30, 0x1D,
-  0x06, 0x03, 0x55, 0x1D, 0x25, 0x04, 0x16, 0x30, 0x14, 0x06, 0x08, 0x2B, 0x06,
-  0x01, 0x05, 0x05, 0x07, 0x03, 0x01, 0x06, 0x08, 0x2B, 0x06, 0x01, 0x05, 0x05,
-  0x07, 0x03, 0x02, 0x30, 0x1D, 0x06, 0x03, 0x55, 0x1D, 0x0E, 0x04, 0x16, 0x04,
-  0x14, 0xA8, 0x29, 0xFD, 0xA9, 0xA5, 0x1A, 0x1C, 0x37, 0x0B, 0x20, 0x3B, 0x98,
-  0xB7, 0x25, 0x39, 0xCC, 0xE5, 0x2F, 0xF4, 0x94, 0x30, 0x1F, 0x06, 0x03, 0x55,
-  0x1D, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0xA9, 0x2B, 0x87, 0xE1, 0xCE,
-  0x24, 0x47, 0x3B, 0x1B, 0xBF, 0xCF, 0x85, 0x37, 0x02, 0x55, 0x9D, 0x0D, 0x94,
-  0x58, 0xE6, 0x30, 0x82, 0x01, 0x04, 0x06, 0x0A, 0x2B, 0x06, 0x01, 0x04, 0x01,
-  0xD6, 0x79, 0x02, 0x04, 0x02, 0x04, 0x81, 0xF5, 0x04, 0x81, 0xF2, 0x00, 0xF0,
-  0x00, 0x77, 0x00, 0xA4, 0xB9, 0x09, 0x90, 0xB4, 0x18, 0x58, 0x14, 0x87, 0xBB,
-  0x13, 0xA2, 0xCC, 0x67, 0x70, 0x0A, 0x3C, 0x35, 0x98, 0x04, 0xF9, 0x1B, 0xDF,
-  0xB8, 0xE3, 0x77, 0xCD, 0x0E, 0xC8, 0x0D, 0xDC, 0x10, 0x00, 0x00, 0x01, 0x66,
-  0x9C, 0xC8, 0xE7, 0x38, 0x00, 0x00, 0x04, 0x03, 0x00, 0x48, 0x30, 0x46, 0x02,
-  0x21, 0x00, 0xD9, 0x58, 0x6E, 0xFC, 0x4C, 0x3C, 0xAF, 0xF9, 0x5B, 0x7F, 0xDA,
-  0x54, 0x95, 0xAF, 0xCF, 0xB3, 0x57, 0xB9, 0x56, 0x2C, 0xE8, 0xE0, 0xB1, 0x20,
-  0x9B, 0xCB, 0x75, 0xAC, 0x4E, 0x54, 0xE9, 0x9D, 0x02, 0x21, 0x00, 0xE8, 0xF0,
-  0xC0, 0x49, 0x23, 0x8E, 0x3D, 0x9B, 0xA5, 0x87, 0xA3, 0xBE, 0x6C, 0x21, 0x62,
-  0xBB, 0xD2, 0x44, 0x5C, 0xE4, 0x7A, 0xCC, 0x46, 0x26, 0x04, 0x19, 0xA4, 0x2D,
-  0x9B, 0x1C, 0x5D, 0x3A, 0x00, 0x75, 0x00, 0x6F, 0x53, 0x76, 0xAC, 0x31, 0xF0,
-  0x31, 0x19, 0xD8, 0x99, 0x00, 0xA4, 0x51, 0x15, 0xFF, 0x77, 0x15, 0x1C, 0x11,
-  0xD9, 0x02, 0xC1, 0x00, 0x29, 0x06, 0x8D, 0xB2, 0x08, 0x9A, 0x37, 0xD9, 0x13,
-  0x00, 0x00, 0x01, 0x66, 0x9C, 0xC8, 0xE6, 0x20, 0x00, 0x00, 0x04, 0x03, 0x00,
-  0x46, 0x30, 0x44, 0x02, 0x20, 0x14, 0xC8, 0x9F, 0xAC, 0x27, 0x48, 0xBE, 0x4D,
-  0x0E, 0xC3, 0x26, 0x2E, 0x34, 0xCA, 0x38, 0xBA, 0x11, 0x3A, 0x68, 0x71, 0x88,
-  0xEB, 0x24, 0x26, 0x59, 0x3E, 0xAC, 0xA8, 0x63, 0xCC, 0x8A, 0x0A, 0x02, 0x20,
-  0x0F, 0x22, 0xBF, 0x0D, 0x1F, 0x8A, 0x8D, 0x1D, 0x91, 0x33, 0x3A, 0x40, 0xE4,
-  0x23, 0x78, 0xFA, 0x22, 0xF5, 0x9B, 0xCB, 0x04, 0x4F, 0x53, 0x2D, 0x20, 0x75,
-  0x2F, 0x76, 0x8A, 0xB1, 0xCD, 0x9D, 0x30, 0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48,
-  0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0B, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00,
-  0x03, 0x41, 0x0F, 0xF3, 0xA6, 0x62, 0xA2, 0xE5, 0xB4, 0x8D, 0xA8, 0x08, 0x71,
-  0x7B, 0xB3, 0xE3, 0x51, 0x61, 0x0D, 0xC0, 0x67, 0x6C, 0x3C, 0x9C, 0x00, 0x0B,
-  0x63, 0x77, 0xB6, 0xB6, 0x11, 0x67, 0x77, 0xA5, 0xE1, 0x49, 0xE0, 0x7F, 0xB7,
-  0x1D, 0x61, 0xFB, 0x83, 0x9C, 0x83, 0x42, 0xE9, 0x31, 0xCA, 0x51, 0xE3, 0xC1,
-  0xBD, 0x9B, 0x2F, 0xB5, 0x35, 0x05, 0x72, 0x7F, 0x40, 0xA6, 0x7C, 0xC9, 0xF1,
-  0x59, 0xA7, 0x15, 0xB8, 0x12, 0xDA, 0xF8, 0xCE, 0x83, 0x61, 0xFC, 0x47, 0x96,
-  0x9E, 0x74, 0xFE, 0xCD, 0xE4, 0x61, 0x92, 0xF2, 0x2E, 0x0C, 0x08, 0x4B, 0x60,
-  0x2D, 0xF6, 0x50, 0x07, 0x83, 0xCA, 0xAF, 0xB9, 0x41, 0x33, 0x4A, 0x3E, 0x84,
-  0xC7, 0x73, 0xC6, 0x1F, 0xFF, 0x7A, 0xDF, 0xAE, 0x47, 0x25, 0x32, 0xEB, 0xC0,
-  0x43, 0x0C, 0xA6, 0x23, 0x13, 0x46, 0xC3, 0xFA, 0x44, 0xEA, 0x20, 0xEA, 0xCB,
-  0x18, 0x17, 0x00, 0xB6, 0xE7, 0x6D, 0x8A, 0x14, 0x8C, 0x6A, 0xCA, 0x88, 0x4C,
-  0xDA, 0xA8, 0xB9, 0x08, 0xAF, 0x39, 0xEE, 0xCF, 0xD7, 0xF7, 0x32, 0xC0, 0xF4,
-  0xCF, 0x4E, 0x22, 0x38, 0xF7, 0xAF, 0xAE, 0x7D, 0x58, 0x5F, 0xA5, 0x2D, 0x4D,
-  0xBB, 0x86, 0x10, 0xB3, 0x93, 0x62, 0x64, 0x27, 0xBF, 0xB1, 0xBB, 0x8F, 0x9F,
-  0xFC, 0x07, 0x3C, 0x4B, 0x16, 0x7A, 0x84, 0x5E, 0xAF, 0xAD, 0x57, 0x9C, 0xFF,
-  0x7A, 0xA7, 0xE0, 0x90, 0x89, 0x1C, 0xE8, 0xE5, 0x11, 0xF7, 0xB6, 0xDC, 0xCD,
-  0x5E, 0xF7, 0x30, 0xA2, 0x2E, 0x67, 0x6D, 0x4A, 0x70, 0x26, 0xEA, 0xCD, 0x27,
-  0x70, 0x77, 0x54, 0x57, 0x09, 0x03, 0x56, 0x4A, 0x33, 0x60, 0x00, 0x27, 0xFE,
-  0xA7, 0xD7, 0xA9, 0xC4, 0xEC, 0x17, 0x17, 0x8D, 0x87, 0x70, 0x6B, 0x48, 0x88,
-  0x61, 0x54, 0x4A, 0x2B, 0xB7, 0x6A, 0x12, 0x08, 0xFB,
-};
-
-UNITTEST_START
-{
   CURLcode result;
   const char *beg = (const char *)&cert[0];
   const char *end = (const char *)&cert[sizeof(cert)];
@@ -354,7 +371,7 @@ UNITTEST_START
   int byte;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
-    fprintf(stderr, "curl_global_init() failed\n");
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
     return TEST_ERR_MAJOR_BAD;
   }
 
@@ -366,11 +383,11 @@ UNITTEST_START
 
     /* a poor man's fuzzing of some initial data to make sure nothing bad
        happens */
-    for(byte = 1 ; byte < 255; byte += 17) {
+    for(byte = 1; byte < 255; byte += 17) {
       for(i = 0; i < 45; i++) {
-        char backup = cert[i];
-        cert[i] = (unsigned char) (byte & 0xff);
-        (void) Curl_extract_certinfo(data, 0, beg, end);
+        unsigned char backup = cert[i];
+        cert[i] = (unsigned char)(byte & 0xff);
+        (void)Curl_extract_certinfo(data, 0, beg, end);
         cert[i] = backup;
       }
     }
@@ -378,15 +395,9 @@ UNITTEST_START
     curl_easy_cleanup(data);
   }
   curl_global_cleanup();
-}
-UNITTEST_STOP
-
 #else
-
-UNITTEST_START
-{
-  puts("not tested since Curl_extract_certinfo() is not built-in");
-}
-UNITTEST_STOP
-
+  puts("not tested since Curl_extract_certinfo() is not built in");
 #endif
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit1652.c b/third-party/curl/tests/unit/unit1652.c
index ef27262164..312fe8a4b0 100644
--- a/third-party/curl/tests/unit/unit1652.c
+++ b/third-party/curl/tests/unit/unit1652.c
@@ -21,10 +21,9 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "urldata.h"
-#include "sendf.h"
+#include "curl_trc.h"
 
 /*
  * This test hardcodes the knowledge of the buffer size which is internal to
@@ -32,110 +31,134 @@
  * updated to still be valid.
  */
 
-static struct Curl_easy *data;
-
 static char input[4096];
-static char result[4096];
-
-int debugf_cb(CURL *handle, curl_infotype type, char *buf, size_t size,
-              void *userptr);
+static char output[4096];
 
 /*
- * This debugf callback is simply dumping the string into the static buffer
- * for the unit test to inspect. Since we know that we're only dealing with
+ * This debugf callback dumps the string into the static buffer
+ * for the unit test to inspect. Since we know that we are only dealing with
  * text we can afford the luxury of skipping the type check here.
  */
-int
-debugf_cb(CURL *handle, curl_infotype type, char *buf, size_t size,
-                void *userptr)
+static int debugf_cb(CURL *handle, curl_infotype type, char *buf, size_t size,
+                     void *userptr)
 {
   (void)handle;
   (void)type;
   (void)userptr;
 
-  memset(result, '\0', sizeof(result));
-  memcpy(result, buf, size);
+  memset(output, '\0', sizeof(output));
+  memcpy(output, buf, size);
   return 0;
 }
 
-static CURLcode
-unit_setup(void)
+static CURLcode t1652_setup(struct Curl_easy **easy)
 {
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
-  data = curl_easy_init();
-  if(!data) {
+  *easy = curl_easy_init();
+  if(!*easy) {
     curl_global_cleanup();
     return CURLE_OUT_OF_MEMORY;
   }
-  curl_easy_setopt(data, CURLOPT_DEBUGFUNCTION, debugf_cb);
-  curl_easy_setopt(data, CURLOPT_VERBOSE, 1L);
-  return res;
+  curl_easy_setopt(*easy, CURLOPT_DEBUGFUNCTION, debugf_cb);
+  curl_easy_setopt(*easy, CURLOPT_VERBOSE, 1L);
+  return result;
 }
 
-static void
-unit_stop(void)
+static void t1652_stop(struct Curl_easy *easy)
 {
-  curl_easy_cleanup(data);
+  curl_easy_cleanup(easy);
   curl_global_cleanup();
 }
 
 static int verify(const char *info, const char *two)
 {
   /* the 'info' one has a newline appended */
-  char *nl = strchr(info, '\n');
+  const char *nl = strchr(info, '\n');
   if(!nl)
     return 1; /* nope */
   return strncmp(info, two, nl - info);
 }
 
-UNITTEST_START
+static CURLcode test_unit1652(const char *arg)
+{
+  struct Curl_easy *easy;
 
-/* Injecting a simple short string via a format */
-msnprintf(input, sizeof(input), "Simple Test");
-Curl_infof(data, "%s", input);
-fail_unless(verify(result, input) == 0, "Simple string test");
+  UNITTEST_BEGIN(t1652_setup(&easy))
 
-/* Injecting a few different variables with a format */
-Curl_infof(data, "%s %u testing %lu", input, 42, 43L);
-fail_unless(verify(result, "Simple Test 42 testing 43\n") == 0,
-            "Format string");
+#if defined(CURL_HAVE_DIAG) && !defined(__clang__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wformat"  /* for GCC v5 to v8 */
+#pragma GCC diagnostic ignored "-Wformat-zero-length"
+#if __GNUC__ >= 7
+#pragma GCC diagnostic ignored "-Wformat-overflow"
+#endif
+#endif
 
-/* Variations of empty strings */
-Curl_infof(data, "");
-fail_unless(strlen(result) == 1, "Empty string");
-Curl_infof(data, "%s", NULL);
-fail_unless(verify(result, "(nil)") == 0, "Passing NULL as string");
+  /* Injecting a simple short string via a format */
+  curl_msnprintf(input, sizeof(input), "Simple Test");
+  Curl_infof(easy, "%s", input);
+  fail_unless(verify(output, input) == 0, "Simple string test");
 
-/* A string just long enough to not be truncated */
-memset(input, '\0', sizeof(input));
-memset(input, 'A', 2047);
-Curl_infof(data, "%s", input);
-fail_unless(strlen(result) == 2048, "No truncation of infof input");
-fail_unless(verify(result, input) == 0, "No truncation of infof input");
-fail_unless(result[sizeof(result) - 1] == '\0',
-            "No truncation of infof input");
+  /* Injecting a few different variables with a format */
+  Curl_infof(easy, "%s %d testing %ld", input, 42, 43L);
+  fail_unless(verify(output, "Simple Test 42 testing 43\n") == 0,
+              "Format string");
 
-/* Just over the limit for truncation without newline */
-memset(input + 2047, 'A', 4);
-Curl_infof(data, "%s", input);
-fail_unless(strlen(result) == 2048, "Truncation of infof input 1");
-fail_unless(result[sizeof(result) - 1] == '\0', "Truncation of infof input 1");
+  /* Variations of empty strings */
+  Curl_infof(easy, "");
+  fail_unless(strlen(output) == 1, "Empty string");
+  Curl_infof(easy, "%s", (char *)NULL);
+  fail_unless(verify(output, "(nil)") == 0, "Passing NULL as string");
 
-/* Just over the limit for truncation with newline */
-memset(input + 2047, 'A', 4);
-memset(input + 2047 + 4, '\n', 1);
-Curl_infof(data, "%s", input);
-fail_unless(strlen(result) == 2048, "Truncation of infof input 2");
-fail_unless(result[sizeof(result) - 1] == '\0', "Truncation of infof input 2");
+  /* Note: libcurl's tracebuffer hold 2048 bytes, so the max strlen() we
+   * get out of it is 2047, since we need a \0 at the end.
+   * Curl_infof() in addition adds a \n at the end, making the effective
+   * output 2046 characters.
+   * Any input that long or longer is truncated, ending in '...\n'.
+   */
 
-/* Way over the limit for truncation with newline */
-memset(input, '\0', sizeof(input));
-memset(input, 'A', sizeof(input) - 1);
-Curl_infof(data, "%s", input);
-fail_unless(strlen(result) == 2048, "Truncation of infof input 3");
-fail_unless(result[sizeof(result) - 1] == '\0', "Truncation of infof input 3");
+  /* A string long enough to not be truncated */
+  memset(input, '\0', sizeof(input));
+  memset(input, 'A', 2045);
+  Curl_infof(easy, "%s", input);
+  curl_mfprintf(stderr, "output len %zu: %s", strlen(output), output);
+  /* output is input + \n */
+  fail_unless(strlen(output) == 2046, "No truncation of infof input");
+  fail_unless(verify(output, input) == 0, "No truncation of infof input");
+  fail_unless(output[sizeof(output) - 1] == '\0',
+              "No truncation of infof input");
 
+  /* Over the limit without newline for truncation via '...' */
+  memset(input + 2045, 'A', 4);
+  Curl_infof(easy, "%s", input);
+  curl_mfprintf(stderr, "output len %zu: %s", strlen(output), output);
+  fail_unless(strlen(output) == 2047, "Truncation of infof input 1");
+  fail_unless(output[sizeof(output) - 1] == '\0',
+              "Truncation of infof input 1");
 
-UNITTEST_STOP
+  /* Over the limit with newline for truncation via '...' */
+  memset(input + 2045, 'A', 4);
+  memset(input + 2045 + 4, '\n', 1);
+  Curl_infof(easy, "%s", input);
+  curl_mfprintf(stderr, "output len %zu: %s", strlen(output), output);
+  fail_unless(strlen(output) == 2047, "Truncation of infof input 2");
+  fail_unless(output[sizeof(output) - 1] == '\0',
+              "Truncation of infof input 2");
+
+  /* Way over the limit for truncation via '...' */
+  memset(input, '\0', sizeof(input));
+  memset(input, 'A', sizeof(input) - 1);
+  Curl_infof(easy, "%s", input);
+  curl_mfprintf(stderr, "output len %zu: %s", strlen(output), output);
+  fail_unless(strlen(output) == 2047, "Truncation of infof input 3");
+  fail_unless(output[sizeof(output) - 1] == '\0',
+              "Truncation of infof input 3");
+
+#if defined(CURL_HAVE_DIAG) && !defined(__clang__)
+#pragma GCC diagnostic pop
+#endif
+
+  UNITTEST_END(t1652_stop(easy))
+}
diff --git a/third-party/curl/tests/unit/unit1653.c b/third-party/curl/tests/unit/unit1653.c
index d543fb0276..64445c4514 100644
--- a/third-party/curl/tests/unit/unit1653.c
+++ b/third-party/curl/tests/unit/unit1653.c
@@ -21,44 +21,29 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "urldata.h"
 #include "curl/urlapi.h"
 #include "urlapi-int.h"
 
-
-static CURLU *u;
-
-static CURLcode
-unit_setup(void)
-{
-  return CURLE_OK;
-}
-
-static void
-unit_stop(void)
-{
-  curl_global_cleanup();
-}
-
-#define free_and_clear(x) free(x); x = NULL
-
-static CURLUcode parse_port(CURLU *url,
-                           char *h, bool has_scheme)
+static CURLUcode my_parse_port(CURLU *url, const char *h, bool has_scheme)
 {
   struct dynbuf host;
   CURLUcode ret;
-  Curl_dyn_init(&host, 10000);
-  if(Curl_dyn_add(&host, h))
+  curlx_dyn_init(&host, 10000);
+  if(curlx_dyn_add(&host, h))
     return CURLUE_OUT_OF_MEMORY;
-  ret = Curl_parse_port(url, &host, has_scheme);
-  Curl_dyn_free(&host);
+  ret = parse_port(url, &host, has_scheme);
+  curlx_dyn_free(&host);
   return ret;
 }
 
-UNITTEST_START
+static CURLcode test_unit1653(const char *arg)
 {
+  UNITTEST_BEGIN_SIMPLE
+
+  CURLU *u;
+
   CURLUcode ret;
   char *ipv6port = NULL;
   char *portnum;
@@ -67,109 +52,109 @@ UNITTEST_START
   u = curl_url();
   if(!u)
     goto fail;
-  ipv6port = strdup("[fe80::250:56ff:fea7:da15]");
+  ipv6port = curlx_strdup("[fe80::250:56ff:fea7:da15]");
   if(!ipv6port)
     goto fail;
-  ret = parse_port(u, ipv6port, FALSE);
+  ret = my_parse_port(u, ipv6port, FALSE);
   fail_unless(ret == CURLUE_OK, "parse_port returned error");
   ret = curl_url_get(u, CURLUPART_PORT, &portnum, CURLU_NO_DEFAULT_PORT);
   fail_unless(ret != CURLUE_OK, "curl_url_get portnum returned something");
-  free_and_clear(ipv6port);
+  curlx_safefree(ipv6port);
   curl_url_cleanup(u);
 
   /* Invalid IPv6 */
   u = curl_url();
   if(!u)
     goto fail;
-  ipv6port = strdup("[fe80::250:56ff:fea7:da15|");
+  ipv6port = curlx_strdup("[fe80::250:56ff:fea7:da15|");
   if(!ipv6port)
     goto fail;
-  ret = parse_port(u, ipv6port, FALSE);
+  ret = my_parse_port(u, ipv6port, FALSE);
   fail_unless(ret != CURLUE_OK, "parse_port true on error");
-  free_and_clear(ipv6port);
+  curlx_safefree(ipv6port);
   curl_url_cleanup(u);
 
   u = curl_url();
   if(!u)
     goto fail;
-  ipv6port = strdup("[fe80::250:56ff;fea7:da15]:808");
+  ipv6port = curlx_strdup("[fe80::250:56ff;fea7:da15]:808");
   if(!ipv6port)
     goto fail;
-  ret = parse_port(u, ipv6port, FALSE);
+  ret = my_parse_port(u, ipv6port, FALSE);
   fail_unless(ret == CURLUE_OK, "parse_port returned error");
   ret = curl_url_get(u, CURLUPART_PORT, &portnum, 0);
   fail_unless(ret == CURLUE_OK, "curl_url_get portnum returned error");
   fail_unless(portnum && !strcmp(portnum, "808"), "Check portnumber");
 
   curl_free(portnum);
-  free_and_clear(ipv6port);
+  curlx_safefree(ipv6port);
   curl_url_cleanup(u);
 
   /* Valid IPv6 with zone index and port number */
   u = curl_url();
   if(!u)
     goto fail;
-  ipv6port = strdup("[fe80::250:56ff:fea7:da15%25eth3]:80");
+  ipv6port = curlx_strdup("[fe80::250:56ff:fea7:da15%25eth3]:80");
   if(!ipv6port)
     goto fail;
-  ret = parse_port(u, ipv6port, FALSE);
+  ret = my_parse_port(u, ipv6port, FALSE);
   fail_unless(ret == CURLUE_OK, "parse_port returned error");
   ret = curl_url_get(u, CURLUPART_PORT, &portnum, 0);
   fail_unless(ret == CURLUE_OK, "curl_url_get portnum returned error");
   fail_unless(portnum && !strcmp(portnum, "80"), "Check portnumber");
   curl_free(portnum);
-  free_and_clear(ipv6port);
+  curlx_safefree(ipv6port);
   curl_url_cleanup(u);
 
   /* Valid IPv6 with zone index without port number */
   u = curl_url();
   if(!u)
     goto fail;
-  ipv6port = strdup("[fe80::250:56ff:fea7:da15%25eth3]");
+  ipv6port = curlx_strdup("[fe80::250:56ff:fea7:da15%25eth3]");
   if(!ipv6port)
     goto fail;
-  ret = parse_port(u, ipv6port, FALSE);
+  ret = my_parse_port(u, ipv6port, FALSE);
   fail_unless(ret == CURLUE_OK, "parse_port returned error");
-  free_and_clear(ipv6port);
+  curlx_safefree(ipv6port);
   curl_url_cleanup(u);
 
   /* Valid IPv6 with port number */
   u = curl_url();
   if(!u)
     goto fail;
-  ipv6port = strdup("[fe80::250:56ff:fea7:da15]:81");
+  ipv6port = curlx_strdup("[fe80::250:56ff:fea7:da15]:81");
   if(!ipv6port)
     goto fail;
-  ret = parse_port(u, ipv6port, FALSE);
+  ret = my_parse_port(u, ipv6port, FALSE);
   fail_unless(ret == CURLUE_OK, "parse_port returned error");
   ret = curl_url_get(u, CURLUPART_PORT, &portnum, 0);
   fail_unless(ret == CURLUE_OK, "curl_url_get portnum returned error");
   fail_unless(portnum && !strcmp(portnum, "81"), "Check portnumber");
   curl_free(portnum);
-  free_and_clear(ipv6port);
+  curlx_safefree(ipv6port);
   curl_url_cleanup(u);
 
   /* Valid IPv6 with syntax error in the port number */
   u = curl_url();
   if(!u)
     goto fail;
-  ipv6port = strdup("[fe80::250:56ff:fea7:da15];81");
+  ipv6port = curlx_strdup("[fe80::250:56ff:fea7:da15];81");
   if(!ipv6port)
     goto fail;
-  ret = parse_port(u, ipv6port, FALSE);
+  ret = my_parse_port(u, ipv6port, FALSE);
   fail_unless(ret != CURLUE_OK, "parse_port true on error");
-  free_and_clear(ipv6port);
+  curlx_safefree(ipv6port);
   curl_url_cleanup(u);
 
   u = curl_url();
   if(!u)
     goto fail;
-  ipv6port = strdup("[fe80::250:56ff:fea7:da15]80");
+  ipv6port = curlx_strdup("[fe80::250:56ff:fea7:da15]80");
   if(!ipv6port)
     goto fail;
-  ret = parse_port(u, ipv6port, FALSE);
+  ret = my_parse_port(u, ipv6port, FALSE);
   fail_unless(ret != CURLUE_OK, "parse_port true on error");
-  free_and_clear(ipv6port);
+  curlx_safefree(ipv6port);
   curl_url_cleanup(u);
 
   /* Valid IPv6 with no port after the colon, should use default if a scheme
@@ -177,40 +162,40 @@ UNITTEST_START
   u = curl_url();
   if(!u)
     goto fail;
-  ipv6port = strdup("[fe80::250:56ff:fea7:da15]:");
+  ipv6port = curlx_strdup("[fe80::250:56ff:fea7:da15]:");
   if(!ipv6port)
     goto fail;
-  ret = parse_port(u, ipv6port, TRUE);
+  ret = my_parse_port(u, ipv6port, TRUE);
   fail_unless(ret == CURLUE_OK, "parse_port returned error");
-  free_and_clear(ipv6port);
+  curlx_safefree(ipv6port);
   curl_url_cleanup(u);
 
-  /* Incorrect zone index syntax, but the port extractor doesn't care */
+  /* Incorrect zone index syntax, but the port extractor does not care */
   u = curl_url();
   if(!u)
     goto fail;
-  ipv6port = strdup("[fe80::250:56ff:fea7:da15!25eth3]:180");
+  ipv6port = curlx_strdup("[fe80::250:56ff:fea7:da15!25eth3]:180");
   if(!ipv6port)
     goto fail;
-  ret = parse_port(u, ipv6port, FALSE);
+  ret = my_parse_port(u, ipv6port, FALSE);
   fail_unless(ret == CURLUE_OK, "parse_port returned error");
   ret = curl_url_get(u, CURLUPART_PORT, &portnum, 0);
   fail_unless(ret == CURLUE_OK, "curl_url_get portnum returned error");
   fail_unless(portnum && !strcmp(portnum, "180"), "Check portnumber");
   curl_free(portnum);
-  free_and_clear(ipv6port);
+  curlx_safefree(ipv6port);
   curl_url_cleanup(u);
 
   /* Non percent-encoded zone index */
   u = curl_url();
   if(!u)
     goto fail;
-  ipv6port = strdup("[fe80::250:56ff:fea7:da15%eth3]:80");
+  ipv6port = curlx_strdup("[fe80::250:56ff:fea7:da15%eth3]:80");
   if(!ipv6port)
     goto fail;
-  ret = parse_port(u, ipv6port, FALSE);
+  ret = my_parse_port(u, ipv6port, FALSE);
   fail_unless(ret == CURLUE_OK, "parse_port returned error");
-  free_and_clear(ipv6port);
+  curlx_safefree(ipv6port);
   curl_url_cleanup(u);
 
   /* No scheme and no digits following the colon - not accepted. Because that
@@ -218,15 +203,15 @@ UNITTEST_START
   u = curl_url();
   if(!u)
     goto fail;
-  ipv6port = strdup("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-                    "aaaaaaaaaaaaaaaaaaaaaa:");
+  ipv6port = curlx_strdup("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+                          "aaaaaaaaaaaaaaaaaaaaaa:");
   if(!ipv6port)
     goto fail;
-  ret = parse_port(u, ipv6port, FALSE);
+  ret = my_parse_port(u, ipv6port, FALSE);
   fail_unless(ret == CURLUE_BAD_PORT_NUMBER, "parse_port did wrong");
 fail:
-  free(ipv6port);
+  curlx_free(ipv6port);
   curl_url_cleanup(u);
 
+  UNITTEST_END_SIMPLE
 }
-UNITTEST_STOP
diff --git a/third-party/curl/tests/unit/unit1654.c b/third-party/curl/tests/unit/unit1654.c
index f7ca3911b6..ef42153ba1 100644
--- a/third-party/curl/tests/unit/unit1654.c
+++ b/third-party/curl/tests/unit/unit1654.c
@@ -21,93 +21,125 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "urldata.h"
 #include "altsvc.h"
 
-static CURLcode
-unit_setup(void)
+static CURLcode test_unit1654(const char *arg)
 {
-  return CURLE_OK;
-}
+  UNITTEST_BEGIN_SIMPLE
 
-static void
-unit_stop(void)
-{
-  curl_global_cleanup();
-}
-
-UNITTEST_START
 #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_ALTSVC)
-{
   char outname[256];
   CURL *curl;
   CURLcode result;
   struct altsvcinfo *asi = Curl_altsvc_init();
   abort_if(!asi, "Curl_altsvc_i");
   result = Curl_altsvc_load(asi, arg);
-  if(result) {
-    fail_if(result, "Curl_altsvc_load");
+  fail_if(result, "Curl_altsvc_load");
+  if(result)
     goto fail;
-  }
   curl_global_init(CURL_GLOBAL_ALL);
   curl = curl_easy_init();
-  if(!curl) {
-    fail_if(!curl, "curl_easy_init");
+  fail_if(!curl, "curl_easy_init");
+  if(!curl)
     goto fail;
-  }
-  fail_unless(asi->list.size == 4, "wrong number of entries");
-  msnprintf(outname, sizeof(outname), "%s-out", arg);
+  fail_unless(Curl_llist_count(&asi->list) == 4, "wrong number of entries");
+  curl_msnprintf(outname, sizeof(outname), "%s-out", arg);
 
   result = Curl_altsvc_parse(curl, asi, "h2=\"example.com:8080\"\r\n",
                              ALPN_h1, "example.org", 8080);
   fail_if(result, "Curl_altsvc_parse() failed!");
-  fail_unless(asi->list.size == 5, "wrong number of entries");
+  fail_unless(Curl_llist_count(&asi->list) == 5, "wrong number of entries");
 
   result = Curl_altsvc_parse(curl, asi, "h3=\":8080\"\r\n",
                              ALPN_h1, "2.example.org", 8080);
   fail_if(result, "Curl_altsvc_parse(2) failed!");
-  fail_unless(asi->list.size == 6, "wrong number of entries");
+  fail_unless(Curl_llist_count(&asi->list) == 6, "wrong number of entries");
 
   result = Curl_altsvc_parse(curl, asi,
-                             "h2=\"example.com:8080\", h3=\"yesyes.com\"\r\n",
+                             "h2=\"example.com:8080\", "
+                             "h3=\"yesyes.com:8080\"\r\n",
                              ALPN_h1, "3.example.org", 8080);
   fail_if(result, "Curl_altsvc_parse(3) failed!");
   /* that one should make two entries */
-  fail_unless(asi->list.size == 8, "wrong number of entries");
+  fail_unless(Curl_llist_count(&asi->list) == 8, "wrong number of entries");
 
   result = Curl_altsvc_parse(curl, asi,
                              "h2=\"example.com:443\"; ma = 120;\r\n",
                              ALPN_h2, "example.org", 80);
   fail_if(result, "Curl_altsvc_parse(4) failed!");
-  fail_unless(asi->list.size == 9, "wrong number of entries");
+  fail_unless(Curl_llist_count(&asi->list) == 9, "wrong number of entries");
 
   /* quoted 'ma' value */
   result = Curl_altsvc_parse(curl, asi,
                              "h2=\"example.net:443\"; ma=\"180\";\r\n",
                              ALPN_h2, "example.net", 80);
-  fail_if(result, "Curl_altsvc_parse(4) failed!");
-  fail_unless(asi->list.size == 10, "wrong number of entries");
-
-  result =
-    Curl_altsvc_parse(curl, asi,
-                      "h2=\":443\", h3=\":443\"; ma = 120; persist = 1\r\n",
-                      ALPN_h1, "curl.se", 80);
   fail_if(result, "Curl_altsvc_parse(5) failed!");
-  fail_unless(asi->list.size == 12, "wrong number of entries");
+  fail_unless(Curl_llist_count(&asi->list) == 10, "wrong number of entries");
+
+  result = Curl_altsvc_parse(curl, asi,
+                             "h2=\":443\"; ma=180, h3=\":443\"; "
+                             "persist = \"1\"; ma = 120;\r\n",
+                             ALPN_h1, "curl.se", 80);
+  fail_if(result, "Curl_altsvc_parse(6) failed!");
+  fail_unless(Curl_llist_count(&asi->list) == 12, "wrong number of entries");
 
   /* clear that one again and decrease the counter */
   result = Curl_altsvc_parse(curl, asi, "clear;\r\n",
                              ALPN_h1, "curl.se", 80);
+  fail_if(result, "Curl_altsvc_parse(7) failed!");
+  fail_unless(Curl_llist_count(&asi->list) == 10, "wrong number of entries");
+
+  result = Curl_altsvc_parse(curl, asi,
+                             "h2=\":443\", h3=\":443\"; "
+                             "persist = \"1\"; ma = 120;\r\n",
+                             ALPN_h1, "curl.se", 80);
   fail_if(result, "Curl_altsvc_parse(6) failed!");
-  fail_unless(asi->list.size == 10, "wrong number of entries");
+  fail_unless(Curl_llist_count(&asi->list) == 12, "wrong number of entries");
+
+  /* clear - without semicolon */
+  result = Curl_altsvc_parse(curl, asi, "clear\r\n",
+                             ALPN_h1, "curl.se", 80);
+  fail_if(result, "Curl_altsvc_parse(7) failed!");
+  fail_unless(Curl_llist_count(&asi->list) == 10, "wrong number of entries");
+
+  /* only a non-existing alpn */
+  result = Curl_altsvc_parse(curl, asi,
+                             "h6=\"example.net:443\"; ma=\"180\";\r\n",
+                             ALPN_h2, "5.example.net", 80);
+  fail_if(result, "Curl_altsvc_parse(8) failed!");
+
+  /* missing quote in alpn host */
+  result = Curl_altsvc_parse(curl, asi,
+                             "h2=\"example.net:443,; ma=\"180\";\r\n",
+                             ALPN_h2, "6.example.net", 80);
+  fail_if(result, "Curl_altsvc_parse(9) failed!");
+
+  /* missing port in hostname */
+  result = Curl_altsvc_parse(curl, asi,
+                             "h2=\"example.net\"; ma=\"180\";\r\n",
+                             ALPN_h2, "7.example.net", 80);
+  fail_if(result, "Curl_altsvc_parse(10) failed!");
+
+  /* illegal port in hostname */
+  result = Curl_altsvc_parse(curl, asi,
+                             "h2=\"example.net:70000\"; ma=\"180\";\r\n",
+                             ALPN_h2, "8.example.net", 80);
+  fail_if(result, "Curl_altsvc_parse(11) failed!");
+
+  result = Curl_altsvc_parse(curl, asi,
+                             "h2=\"test2.se:443\"; ma=\"180 \" ; unknown=2, "
+                             "h2=\"test3.se:443\"; ma = 120;\r\n",
+                             ALPN_h2, "test.se", 443);
+  fail_if(result, "Curl_altsvc_parse(12) failed!");
 
   Curl_altsvc_save(curl, asi, outname);
 
   curl_easy_cleanup(curl);
 fail:
   Curl_altsvc_cleanup(&asi);
-}
 #endif
-UNITTEST_STOP
+
+  UNITTEST_END(curl_global_cleanup())
+}
diff --git a/third-party/curl/tests/unit/unit1655.c b/third-party/curl/tests/unit/unit1655.c
index ca88f71503..ff3dc53481 100644
--- a/third-party/curl/tests/unit/unit1655.c
+++ b/third-party/curl/tests/unit/unit1655.c
@@ -21,170 +21,154 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
+#include "unitcheck.h"
+#include "doh.h"
 
-#include "doh.h" /* from the lib dir */
-
-static CURLcode unit_setup(void)
+static CURLcode test_unit1655(const char *arg)
 {
-  /* whatever you want done first */
-  return CURLE_OK;
-}
-
-static void unit_stop(void)
-{
-    /* done before shutting down and exiting */
-}
+  UNITTEST_BEGIN_SIMPLE
 
 #ifndef CURL_DISABLE_DOH
+  /*
+   * Prove detection of write overflow using a short buffer and a name
+   * of maximal valid length.
+   *
+   * Prove detection of other invalid input.
+   */
+  do {
+    static const char max[] =
+      /* ..|....1.........2.........3.........4.........5.........6... */
+      /* 3456789012345678901234567890123456789012345678901234567890123 */
+      "this.is.a.maximum-length.hostname."                  /* 34:  34 */
+      "with-no-label-of-greater-length-than-the-sixty-three-characters."
+                                                            /* 64:  98 */
+      "specified.in.the.RFCs."                              /* 22: 120 */
+      "and.with.a.QNAME.encoding.whose.length.is.exactly."  /* 50: 170 */
+      "the.maximum.length.allowed."                         /* 27: 197 */
+      "that.is.two-hundred.and.fifty-six."                  /* 34: 231 */
+      "including.the.last.null."                            /* 24: 255 */
+      "";
+    static const char toolong[] =
+      /* ..|....1.........2.........3.........4.........5.........6... */
+      /* 3456789012345678901234567890123456789012345678901234567890123 */
+      "here.is.a.hostname.which.is.only.barely.too.long."   /* 49:  49 */
+      "to.be.encoded.as.a.QNAME.of.the.maximum.allowed.length."
+                                                            /* 55: 104 */
+      "which.is.256.including.a.final.zero-length.label."   /* 49: 153 */
+      "representing.the.root.node.so.that.a.name.with."     /* 47: 200 */
+      "a.trailing.dot.may.have.up.to."                      /* 30: 230 */
+      "255.characters.never.more."                          /* 26: 256 */
+      "";
+    static const char emptylabel[] =
+      "this.is.an.otherwise-valid.hostname."
+      ".with.an.empty.label.";
+    static const char outsizelabel[] =
+      "this.is.an.otherwise-valid.hostname."
+      "with-a-label-of-greater-length-than-the-sixty-three-characters-"
+      "specified.in.the.RFCs.";
+    size_t i;
 
-UNITTEST_START
+    struct test {
+      const char *name;
+      const DOHcode expected_result;
+    };
 
-/*
- * Prove detection of write overflow using a short buffer and a name
- * of maximal valid length.
- *
- * Prove detection of other invalid input.
- */
-do {
-  static const char max[] =
-    /* ..|....1.........2.........3.........4.........5.........6... */
-    /* 3456789012345678901234567890123456789012345678901234567890123 */
-    "this.is.a.maximum-length.hostname."                  /* 34:  34 */
-    "with-no-label-of-greater-length-than-the-sixty-three-characters."
-                                                          /* 64:  98 */
-    "specified.in.the.RFCs."                              /* 22: 120 */
-    "and.with.a.QNAME.encoding.whose.length.is.exactly."  /* 50: 170 */
-    "the.maximum.length.allowed."                         /* 27: 197 */
-    "that.is.two-hundred.and.fifty-six."                  /* 34: 231 */
-    "including.the.last.null."                            /* 24: 255 */
-    "";
-  static const char toolong[] =
-    /* ..|....1.........2.........3.........4.........5.........6... */
-    /* 3456789012345678901234567890123456789012345678901234567890123 */
-    "here.is.a.hostname.which.is.just.barely.too.long."   /* 49:  49 */
-    "to.be.encoded.as.a.QNAME.of.the.maximum.allowed.length."
-                                                          /* 55: 104 */
-    "which.is.256.including.a.final.zero-length.label."   /* 49: 153 */
-    "representing.the.root.node.so.that.a.name.with."     /* 47: 200 */
-    "a.trailing.dot.may.have.up.to."                      /* 30: 230 */
-    "255.characters.never.more."                          /* 26: 256 */
-    "";
-  static const char emptylabel[] =
-    "this.is.an.otherwise-valid.hostname."
-    ".with.an.empty.label.";
-  static const char outsizelabel[] =
-    "this.is.an.otherwise-valid.hostname."
-    "with-a-label-of-greater-length-than-the-sixty-three-characters-"
-    "specified.in.the.RFCs.";
-  int i;
+    /* plays the role of struct dnsprobe in urldata.h */
+    struct demo {
+      unsigned char dohbuffer[255 + 16]; /* deliberately short buffer */
+      unsigned char canary1;
+      unsigned char canary2;
+      unsigned char canary3;
+    };
 
-  struct test {
-    const char *name;
-    const DOHcode expected_result;
-  };
+    const struct test playlist[4] = {
+      { toolong, DOH_DNS_NAME_TOO_LONG },  /* expect early failure */
+      { emptylabel, DOH_DNS_BAD_LABEL },   /* also */
+      { outsizelabel, DOH_DNS_BAD_LABEL }, /* also */
+      { max, DOH_OK }                      /* expect buffer overwrite */
+    };
 
-  /* plays the role of struct dnsprobe in urldata.h */
-  struct demo {
-    unsigned char dohbuffer[255 + 16]; /* deliberately short buffer */
-    unsigned char canary1;
-    unsigned char canary2;
-    unsigned char canary3;
-  };
+    for(i = 0; i < CURL_ARRAYSIZE(playlist); i++) {
+      const char *name = playlist[i].name;
+      size_t olen = 100000;
+      struct demo victim;
+      DOHcode d;
 
-  const struct test playlist[4] = {
-    { toolong, DOH_DNS_NAME_TOO_LONG },  /* expect early failure */
-    { emptylabel, DOH_DNS_BAD_LABEL },   /* also */
-    { outsizelabel, DOH_DNS_BAD_LABEL }, /* also */
-    { max, DOH_OK }                      /* expect buffer overwrite */
-  };
+      victim.canary1 = 87; /* magic numbers, arbitrarily picked */
+      victim.canary2 = 35;
+      victim.canary3 = 41;
+      d = doh_req_encode(name, CURL_DNS_TYPE_A, victim.dohbuffer,
+                         sizeof(struct demo), /* allow room for overflow */
+                         &olen);
 
-  for(i = 0; i < (int)(sizeof(playlist)/sizeof(*playlist)); i++) {
-    const char *name = playlist[i].name;
-    size_t olen = 100000;
-    struct demo victim;
-    DOHcode d;
-
-    victim.canary1 = 87; /* magic numbers, arbitrarily picked */
-    victim.canary2 = 35;
-    victim.canary3 = 41;
-    d = doh_encode(name, DNS_TYPE_A, victim.dohbuffer,
-                   sizeof(struct demo), /* allow room for overflow */
-                   &olen);
-
-    fail_unless(d == playlist[i].expected_result,
-                "result returned was not as expected");
-    if(d == playlist[i].expected_result) {
-      if(name == max) {
-        fail_if(victim.canary1 == 87,
-                "demo one-byte buffer overwrite did not happen");
+      fail_unless(d == playlist[i].expected_result,
+                  "result returned was not as expected");
+      if(d == playlist[i].expected_result) {
+        if(name == max) {
+          fail_if(victim.canary1 == 87,
+                  "demo one-byte buffer overwrite did not happen");
+        }
+        else {
+          fail_unless(victim.canary1 == 87,
+                      "one-byte buffer overwrite has happened");
+        }
+        fail_unless(victim.canary2 == 35,
+                    "two-byte buffer overwrite has happened");
+        fail_unless(victim.canary3 == 41,
+                    "three-byte buffer overwrite has happened");
       }
-      else {
-        fail_unless(victim.canary1 == 87,
-                    "one-byte buffer overwrite has happened");
-      }
-      fail_unless(victim.canary2 == 35,
-                  "two-byte buffer overwrite has happened");
-      fail_unless(victim.canary3 == 41,
-                  "three-byte buffer overwrite has happened");
-    }
-    else {
-      if(d == DOH_OK) {
-        fail_unless(olen <= sizeof(victim.dohbuffer), "wrote outside bounds");
+      else if(d == DOH_OK) {
+        fail_unless(olen <= sizeof(victim.dohbuffer),
+                    "wrote outside bounds");
         fail_unless(olen > strlen(name), "unrealistic low size");
       }
     }
-  }
-} while(0);
+  } while(0);
 
-/* run normal cases and try to trigger buffer length related errors */
-do {
-  DNStype dnstype = DNS_TYPE_A;
-  unsigned char buffer[128];
-  const size_t buflen = sizeof(buffer);
-  const size_t magic1 = 9765;
-  size_t olen1 = magic1;
-  const char *sunshine1 = "a.com";
-  const char *dotshine1 = "a.com.";
-  const char *sunshine2 = "aa.com";
-  size_t olen2;
-  DOHcode ret2;
-  size_t olen;
+  /* run normal cases and try to trigger buffer length related errors */
+  do {
+    DNStype dnstype = CURL_DNS_TYPE_A;
+    unsigned char buffer[128];
+    const size_t buflen = sizeof(buffer);
+    const size_t magic1 = 9765;
+    size_t olen1 = magic1;
+    static const char *sunshine1 = "a.com";
+    static const char *dotshine1 = "a.com.";
+    static const char *sunshine2 = "aa.com";
+    size_t olen2;
+    DOHcode ret2;
+    size_t olen;
 
-  DOHcode ret = doh_encode(sunshine1, dnstype, buffer, buflen, &olen1);
-  fail_unless(ret == DOH_OK, "sunshine case 1 should pass fine");
-  fail_if(olen1 == magic1, "olen has not been assigned properly");
-  fail_unless(olen1 > strlen(sunshine1), "bad out length");
+    DOHcode ret = doh_req_encode(sunshine1, dnstype, buffer, buflen, &olen1);
+    fail_unless(ret == DOH_OK, "sunshine case 1 should pass fine");
+    fail_if(olen1 == magic1, "olen has not been assigned properly");
+    fail_unless(olen1 > strlen(sunshine1), "bad out length");
 
-  /* with a trailing dot, the response should have the same length */
-  olen2 = magic1;
-  ret2 = doh_encode(dotshine1, dnstype, buffer, buflen, &olen2);
-  fail_unless(ret2 == DOH_OK, "dotshine case should pass fine");
-  fail_if(olen2 == magic1, "olen has not been assigned properly");
-  fail_unless(olen1 == olen2, "olen should not grow for a trailing dot");
+    /* with a trailing dot, the response should have the same length */
+    olen2 = magic1;
+    ret2 = doh_req_encode(dotshine1, dnstype, buffer, buflen, &olen2);
+    fail_unless(ret2 == DOH_OK, "dotshine case should pass fine");
+    fail_if(olen2 == magic1, "olen has not been assigned properly");
+    fail_unless(olen1 == olen2, "olen should not grow for a trailing dot");
 
-  /* add one letter, the response should be one longer */
-  olen2 = magic1;
-  ret2 = doh_encode(sunshine2, dnstype, buffer, buflen, &olen2);
-  fail_unless(ret2 == DOH_OK, "sunshine case 2 should pass fine");
-  fail_if(olen2 == magic1, "olen has not been assigned properly");
-  fail_unless(olen1 + 1 == olen2, "olen should grow with the hostname");
+    /* add one letter, the response should be one longer */
+    olen2 = magic1;
+    ret2 = doh_req_encode(sunshine2, dnstype, buffer, buflen, &olen2);
+    fail_unless(ret2 == DOH_OK, "sunshine case 2 should pass fine");
+    fail_if(olen2 == magic1, "olen has not been assigned properly");
+    fail_unless(olen1 + 1 == olen2, "olen should grow with the hostname");
 
-  /* pass a short buffer, should fail */
-  ret = doh_encode(sunshine1, dnstype, buffer, olen1 - 1, &olen);
-  fail_if(ret == DOH_OK, "short buffer should have been noticed");
+    /* pass a short buffer, should fail */
+    ret = doh_req_encode(sunshine1, dnstype, buffer, olen1 - 1, &olen);
+    fail_if(ret == DOH_OK, "short buffer should have been noticed");
 
-  /* pass a minimum buffer, should succeed */
-  ret = doh_encode(sunshine1, dnstype, buffer, olen1, &olen);
-  fail_unless(ret == DOH_OK, "minimal length buffer should be long enough");
-  fail_unless(olen == olen1, "bad buffer length");
-} while(0);
-UNITTEST_STOP
+    /* pass a minimum buffer, should succeed */
+    ret = doh_req_encode(sunshine1, dnstype, buffer, olen1, &olen);
+    fail_unless(ret == DOH_OK, "minimal length buffer should be long enough");
+    fail_unless(olen == olen1, "bad buffer length");
+  } while(0);
 
-#else /* CURL_DISABLE_DOH */
+#endif /* CURL_DISABLE_DOH */
 
-UNITTEST_START
-/* nothing to do, just succeed */
-UNITTEST_STOP
-
-#endif
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit1656.c b/third-party/curl/tests/unit/unit1656.c
new file mode 100644
index 0000000000..4dea282c9e
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1656.c
@@ -0,0 +1,125 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+
+#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_MBEDTLS)
+#include "vtls/x509asn1.h"
+
+struct test_spec {
+  const char *input;
+  const char *exp_output;
+  CURLcode result_exp;
+};
+
+static bool do_test(const struct test_spec *spec, size_t i,
+                    struct dynbuf *dbuf)
+{
+  CURLcode result;
+  const char *in = spec->input;
+
+  curlx_dyn_reset(dbuf);
+  result = GTime2str(dbuf, in, in + strlen(in));
+  if(result != spec->result_exp) {
+    curl_mfprintf(stderr, "test %zu: expect result %d, got %d\n",
+                  i, (int)spec->result_exp, (int)result);
+    return FALSE;
+  }
+  else if(!result && strcmp(spec->exp_output, curlx_dyn_ptr(dbuf))) {
+    curl_mfprintf(stderr,
+                  "test %zu: input '%s', expected output '%s', got '%s'\n",
+                  i, in, spec->exp_output, curlx_dyn_ptr(dbuf));
+    return FALSE;
+  }
+
+  return TRUE;
+}
+
+static CURLcode test_unit1656(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  static const struct test_spec test_specs[] = {
+    { "190321134340", "1903-21-13 43:40:00", CURLE_OK },
+    { "", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
+    { "WTF", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
+    { "0WTF", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
+    { "19032113434", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
+    { "19032113434WTF", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
+    { "190321134340.", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
+    { "190321134340.1", "1903-21-13 43:40:00.1", CURLE_OK },
+    { "19032113434017.0", "1903-21-13 43:40:17", CURLE_OK },
+    { "19032113434017.01", "1903-21-13 43:40:17.01", CURLE_OK },
+    { "19032113434003.001", "1903-21-13 43:40:03.001", CURLE_OK },
+    { "19032113434003.090", "1903-21-13 43:40:03.09", CURLE_OK },
+    { "190321134340Z", "1903-21-13 43:40:00 GMT", CURLE_OK },
+    { "19032113434017.0Z", "1903-21-13 43:40:17 GMT", CURLE_OK },
+    { "19032113434017.01Z", "1903-21-13 43:40:17.01 GMT", CURLE_OK },
+    { "19032113434003.001Z", "1903-21-13 43:40:03.001 GMT", CURLE_OK },
+    { "19032113434003.090Z", "1903-21-13 43:40:03.09 GMT", CURLE_OK },
+    { "190321134340CET", "1903-21-13 43:40:00 CET", CURLE_OK },
+    { "19032113434017.0CET", "1903-21-13 43:40:17 CET", CURLE_OK },
+    { "19032113434017.01CET", "1903-21-13 43:40:17.01 CET", CURLE_OK },
+    { "190321134340+02:30", "1903-21-13 43:40:00 UTC+02:30", CURLE_OK },
+    { "19032113434017.0+02:30", "1903-21-13 43:40:17 UTC+02:30", CURLE_OK },
+    { "19032113434017.01+02:30", "1903-21-13 43:40:17.01 UTC+02:30",
+      CURLE_OK },
+    { "190321134340-3", "1903-21-13 43:40:00 UTC-3", CURLE_OK },
+    { "19032113434017.0-04", "1903-21-13 43:40:17 UTC-04", CURLE_OK },
+    { "19032113434017.01-01:10", "1903-21-13 43:40:17.01 UTC-01:10",
+      CURLE_OK },
+  };
+
+  size_t i;
+  struct dynbuf dbuf;
+  bool all_ok = TRUE;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  curlx_dyn_init(&dbuf, 32 * 1024);
+
+  for(i = 0; i < CURL_ARRAYSIZE(test_specs); ++i) {
+    if(!do_test(&test_specs[i], i, &dbuf))
+      all_ok = FALSE;
+  }
+  fail_unless(all_ok, "some tests of Curl_x509_GTime2str() fails");
+
+  curlx_dyn_free(&dbuf);
+  curl_global_cleanup();
+
+  UNITTEST_END_SIMPLE
+}
+
+#else
+
+static CURLcode test_unit1656(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+  puts("not tested since Curl_x509_GTime2str() is not built in");
+  UNITTEST_END_SIMPLE
+}
+
+#endif
diff --git a/third-party/curl/tests/unit/unit1657.c b/third-party/curl/tests/unit/unit1657.c
new file mode 100644
index 0000000000..79f026beba
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1657.c
@@ -0,0 +1,125 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+
+#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_MBEDTLS)
+#include "vtls/x509asn1.h"
+
+struct test1657_spec {
+  CURLcode (*setbuf)(const struct test1657_spec *spec, struct dynbuf *buf);
+  size_t n;
+  CURLcode result_exp;
+};
+
+static CURLcode make1657_nested(const struct test1657_spec *spec,
+                                struct dynbuf *buf)
+{
+  CURLcode result;
+  size_t i;
+  unsigned char open_undef[] = { 0x32, 0x80 };
+  unsigned char close_undef[] = { 0x00, 0x00 };
+
+  for(i = 0; i < spec->n; ++i) {
+    result = curlx_dyn_addn(buf, open_undef, sizeof(open_undef));
+    if(result)
+      return result;
+  }
+  for(i = 0; i < spec->n; ++i) {
+    result = curlx_dyn_addn(buf, close_undef, sizeof(close_undef));
+    if(result)
+      return result;
+  }
+  return CURLE_OK;
+}
+
+static const struct test1657_spec test1657_specs[] = {
+  { make1657_nested, 3, CURLE_OK },
+  { make1657_nested, 16, CURLE_OK },
+  { make1657_nested, 17, CURLE_BAD_FUNCTION_ARGUMENT },
+  { make1657_nested, 1024, CURLE_BAD_FUNCTION_ARGUMENT },
+};
+
+static bool do_test1657(const struct test1657_spec *spec, size_t i,
+                        struct dynbuf *buf)
+{
+  CURLcode result;
+  struct Curl_asn1Element elem;
+  const char *in;
+  const char *ptr;
+
+  memset(&elem, 0, sizeof(elem));
+  curlx_dyn_reset(buf);
+  result = spec->setbuf(spec, buf);
+  if(result) {
+    curl_mfprintf(stderr, "test %zu: error setting buf %d\n", i, (int)result);
+    return FALSE;
+  }
+  in = curlx_dyn_ptr(buf);
+  ptr = getASN1Element(&elem, in, in + curlx_dyn_len(buf));
+  result = ptr ? CURLE_OK : CURLE_BAD_FUNCTION_ARGUMENT;
+  if(result != spec->result_exp) {
+    curl_mfprintf(stderr, "test %zu: expect result %d, got %d\n",
+                  i, (int)spec->result_exp, (int)result);
+    return FALSE;
+  }
+  return TRUE;
+}
+
+static CURLcode test_unit1657(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  size_t i;
+  bool all_ok = TRUE;
+  struct dynbuf dbuf;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  curlx_dyn_init(&dbuf, 32 * 1024);
+
+  for(i = 0; i < CURL_ARRAYSIZE(test1657_specs); ++i) {
+    if(!do_test1657(&test1657_specs[i], i, &dbuf))
+      all_ok = FALSE;
+  }
+  fail_unless(all_ok, "some tests of getASN1Element() fails");
+
+  curlx_dyn_free(&dbuf);
+  curl_global_cleanup();
+
+  UNITTEST_END_SIMPLE
+}
+
+#else
+
+static CURLcode test_unit1657(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+  puts("not tested since getASN1Element() is not built in");
+  UNITTEST_END_SIMPLE
+}
+
+#endif
diff --git a/third-party/curl/tests/unit/unit1658.c b/third-party/curl/tests/unit/unit1658.c
new file mode 100644
index 0000000000..1491e9338f
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1658.c
@@ -0,0 +1,565 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+
+/* DoH + HTTPSRR are required */
+#if !defined(CURL_DISABLE_DOH) && defined(USE_HTTPSRR)
+#include "doh.h"
+#include "httpsrr.h"
+
+static CURLcode t1658_setup(void)
+{
+  /* whatever you want done first */
+  curl_global_init(CURL_GLOBAL_ALL);
+  return CURLE_OK;
+}
+
+/*
+ * The idea here is that we pass one DNS packet at the time to the decoder. we
+ * then generate a string output with the results and compare if it matches
+ * the expected. One by one.
+ */
+
+static char rrbuffer[256];
+static void rrresults(struct Curl_https_rrinfo *rr, CURLcode result)
+{
+  char *p = rrbuffer;
+  const char *pend = rrbuffer + sizeof(rrbuffer);
+  curl_msnprintf(rrbuffer, sizeof(rrbuffer), "r:%d|", (int)result);
+  p += strlen(rrbuffer);
+
+  if(rr) {
+    unsigned int i;
+    curl_msnprintf(p, pend - p, "p:%d|", rr->priority);
+    p += strlen(p);
+
+    curl_msnprintf(p, pend - p, "%s|", rr->target ? rr->target : "-");
+    p += strlen(p);
+
+    for(i = 0; i < MAX_HTTPSRR_ALPNS && rr->alpns[i] != ALPN_none; i++) {
+      curl_msnprintf(p, pend - p, "alpn:%x|", rr->alpns[i]);
+      p += strlen(p);
+    }
+    if(rr->no_def_alpn) {
+      curl_msnprintf(p, pend - p, "no-def-alpn|");
+      p += strlen(p);
+    }
+    if(rr->port_set) {
+      curl_msnprintf(p, pend - p, "port:%d|", rr->port);
+      p += strlen(p);
+    }
+    if(rr->ipv4hints) {
+      for(i = 0; i < rr->ipv4hints_len; i += 4) {
+        curl_msnprintf(p, pend - p, "ipv4:%d.%d.%d.%d|",
+                       rr->ipv4hints[i],
+                       rr->ipv4hints[i + 1],
+                       rr->ipv4hints[i + 2],
+                       rr->ipv4hints[i + 3]);
+        p += strlen(p);
+      }
+    }
+    if(rr->echconfiglist) {
+      curl_msnprintf(p, pend - p, "ech:");
+      p += strlen(p);
+      for(i = 0; i < rr->echconfiglist_len; i++) {
+        curl_msnprintf(p, pend - p, "%02x", rr->echconfiglist[i]);
+        p += strlen(p);
+      }
+      curl_msnprintf(p, pend - p, "|");
+      p += strlen(p);
+    }
+    if(rr->ipv6hints) {
+      for(i = 0; i < rr->ipv6hints_len; i += 16) {
+        int x;
+        curl_msnprintf(p, pend - p, "ipv6:");
+        p += strlen(p);
+        for(x = 0; x < 16; x += 2) {
+          curl_msnprintf(p, pend - p, "%s%02x%02x",
+                         x ? ":" : "",
+                         rr->ipv6hints[i + x],
+                         rr->ipv6hints[i + x + 1]);
+          p += strlen(p);
+        }
+        curl_msnprintf(p, pend - p, "|");
+        p += strlen(p);
+      }
+    }
+  }
+}
+
+static CURLcode test_unit1658(const char *arg)
+{
+  UNITTEST_BEGIN(t1658_setup())
+
+  /* The "SvcParamKeys" specified within the HTTPS RR packet *must* be
+     provided in numerical order. */
+
+  struct test {
+    const char *name;
+    const unsigned char *dns;
+    size_t len; /* size of the dns packet */
+    const char *expect;
+  };
+
+  static const struct test t[] = {
+    {
+      "single h2 alpn",
+      (const unsigned char *)"\x00\x00" /* 16-bit prio */
+      "\x04name\x00" /* RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x03" /* data size */
+      "\x02" /* length byte */
+      "h2",
+      15,
+      "r:0|p:0|name.|alpn:10|"
+    },
+    {
+      "single h2 alpn missing last byte",
+      (const unsigned char *)"\x00\x00" /* 16-bit prio */
+      "\x04name\x00" /* RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x03" /* data size */
+      "\x02" /* length byte */
+      "h", /* missing byte */
+      14,
+      "r:8|"
+    },
+    {
+      "two alpns",
+      (const unsigned char *)"\x00\x00" /* 16-bit prio */
+      "\x04name\x04some\x00" /* RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x06" /* data size */
+      "\x02" /* ALPN length byte */
+      "h2"
+      "\x02" /* APLN length byte */
+      "h3",
+      23,
+      "r:0|p:0|name.some.|alpn:10|alpn:20|"
+    },
+    {
+      "wrong syntax alpns",
+      (const unsigned char *)"\x00\x00" /* 16-bit prio */
+      "\x04name\x04some\x00" /* RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x06" /* data size */
+      "\x02" /* ALPN length byte */
+      "h2"
+      "\x03" /* APLN length byte (WRONG) */
+      "h3",
+      23,
+      "r:61|"
+    },
+    {
+      "five alpns (ignore dupes)", /* we only support four */
+      (const unsigned char *)"\x00\x00" /* 16-bit prio */
+      "\x04name\x04some\x00" /* RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x0f" /* data size */
+      "\x02" /* ALPN length byte */
+      "h2"
+      "\x02" /* ALPN length byte */
+      "h2"
+      "\x02" /* ALPN length byte */
+      "h2"
+      "\x02" /* ALPN length byte */
+      "h2"
+      "\x02" /* APLN length byte */
+      "h3",
+      32,
+      "r:0|p:0|name.some.|alpn:10|alpn:20|"
+    },
+    {
+      "rname only",
+      (const unsigned char *)"\x00\x00" /* 16-bit prio */
+      "\x04name\x04some\x00", /* RNAME */
+      13,
+      "r:0|p:0|name.some.|"
+    },
+    {
+      "rname with low ascii byte",
+      (const unsigned char *)"\x00\x00" /* 16-bit prio */
+      "\x04name\x04som\x03\x00", /* RNAME */
+      13,
+      "r:8|"
+    },
+    {
+      "rname with null byte",
+      (const unsigned char *)"\x00\x00" /* 16-bit prio */
+      "\x04sa\x00e\x04some\x00", /* RNAME */
+      13,
+      "r:27|"
+    },
+    {
+      "rname only (missing byte)",
+      (const unsigned char *)"\x00\x00" /* 16-bit prio */
+      "\x04name\x05some\x00", /* RNAME */
+      /* it lacks a byte */
+      13,
+      "r:27|"
+    },
+    {
+      "unrecognized alpn",
+      (const unsigned char *)"\x00\x00" /* 16-bit prio */
+      "\x04name\x04some\x00" /* RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x06" /* data size */
+      "\x02" /* ALPN length byte */
+      "h8" /* unrecognized */
+      "\x02" /* APLN length byte */
+      "h1",
+      23,
+      "r:0|p:0|name.some.|alpn:8|"
+    },
+    {
+      "alnt + no-default-alpn",
+      (const unsigned char *)"\x00\x00" /* 16-bit prio */
+      "\x04name\x04some\x00" /* RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x03" /* data size */
+      "\x02" /* ALPN length byte */
+      "h2"
+      "\x00\x02" /* RR (2 == NO DEFAULT ALPN) */
+      "\x00\x00", /* must be zero */
+      24,
+      "r:0|p:0|name.some.|alpn:10|no-def-alpn|"
+    },
+    {
+      "alnt + no-default-alpn with size",
+      (const unsigned char *)"\x00\x00" /* 16-bit prio */
+      "\x04name\x04some\x00" /* RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x03" /* data size */
+      "\x02" /* ALPN length byte */
+      "h2"
+      "\x00\x02" /* RR (2 == NO DEFAULT ALPN) */
+      "\x00\x01" /* must be zero */
+      "\xff",
+      25,
+      "r:43|"
+    },
+    {
+      "alnt + no-default-alpn with size too short package",
+      (const unsigned char *)"\x00\x00" /* 16-bit prio */
+      "\x04name\x04some\x00" /* RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x03" /* data size */
+      "\x02" /* ALPN length byte */
+      "h2"
+      "\x00\x02" /* RR (2 == NO DEFAULT ALPN) */
+      "\x00\x01", /* must be zero */
+      /* missing last byte in the packet */
+      24,
+      "r:8|"
+    },
+    {
+      "rname + blank alpn field",
+      (const unsigned char *)"\x11\x11" /* 16-bit prio */
+      "\x04name\x04some\x00" /* RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x00", /* data size, strictly speaking this is illegal:
+                     "one or more alpn-ids" */
+      17,
+      "r:0|p:4369|name.some.|"
+    },
+    {
+      "no rname + blank alpn",
+      (const unsigned char *)"\x00\x11" /* 16-bit prio */
+      "\x00" /* no RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x00", /* data size */
+      7,
+      "r:0|p:17|.|"
+    },
+    {
+      "unsupported field",
+      (const unsigned char *)"\xff\xff" /* 16-bit prio */
+      "\x00" /* no RNAME */
+      "\x00\x07" /* RR (7 == not a supported data) */
+      "\x00\x02" /* data size */
+      "FF", /* unknown to curl */
+      9,
+      "r:0|p:65535|.|"
+    },
+    {
+      "unsupported field (wrong size)",
+      (const unsigned char *)"\xff\xff" /* 16-bit prio */
+      "\x00" /* no RNAME */
+      "\x00\x07" /* RR (7 == not a supported data) */
+      "\x00\x02" /* data size */
+      "F", /* unknown to curl */
+      8,
+      "r:8|"
+    },
+    {
+      "port number",
+      (const unsigned char *)"\x00\x10" /* 16-bit prio */
+      "\x00" /* no RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x03" /* data size */
+      "\x02" /* ALPN length byte */
+      "h2"
+      "\x00\x03" /* RR (3 == PORT) */
+      "\x00\x02" /* data size */
+      "\x12\x34", /* port number */
+      16,
+      "r:0|p:16|.|alpn:10|port:4660|"
+    },
+    {
+      "port number with wrong size (3 bytes)",
+      (const unsigned char *)"\x00\x10" /* 16-bit prio */
+      "\x00" /* no RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x03" /* data size */
+      "\x02" /* ALPN length byte */
+      "h2"
+      "\x00\x03" /* RR (3 == PORT) */
+      "\x00\x03" /* data size */
+      "\x12\x34\x00", /* 24-bit port number */
+      17,
+      "r:43|"
+    },
+    {
+      "port number with wrong size (1 byte)",
+      (const unsigned char *)"\x00\x10" /* 16-bit prio */
+      "\x00" /* no RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x03" /* data size */
+      "\x02" /* ALPN length byte */
+      "h2"
+      "\x00\x03" /* RR (3 == PORT) */
+      "\x00\x01" /* data size */
+      "\x12", /* 8-bit port number */
+      15,
+      "r:43|"
+    },
+    {
+      "alpn + two ipv4 addresses",
+      (const unsigned char *)"\x00\x10" /* 16-bit prio */
+      "\x00" /* no RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x03" /* data size */
+      "\x02" /* ALPN length byte */
+      "h2"
+      "\x00\x04" /* RR (4 == Ipv4hints) */
+      "\x00\x08" /* data size */
+      "\xc0\xa8\x00\x01"  /* 32 bits */
+      "\xc0\xa8\x00\x02", /* 32 bits */
+      22,
+      "r:0|p:16|.|alpn:10|ipv4:192.168.0.1|ipv4:192.168.0.2|"
+    },
+    {
+      "alpn + two ipv4 addresses in wrong order",
+      (const unsigned char *)"\x00\x10" /* 16-bit prio */
+      "\x00" /* no RNAME */
+      "\x00\x04" /* RR (4 == Ipv4hints) */
+      "\x00\x08" /* data size */
+      "\xc0\xa8\x00\x01"  /* 32 bits */
+      "\xc0\xa8\x00\x02" /* 32 bits */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x03" /* data size */
+      "\x02" /* ALPN length byte */
+      "h2",
+      22,
+      "r:8|"
+    },
+    {
+      "alpn + ipv4 address with wrong size",
+      (const unsigned char *)"\x00\x10" /* 16-bit prio */
+      "\x00" /* no RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x03" /* data size */
+      "\x02" /* ALPN length byte */
+      "h2"
+      "\x00\x04" /* RR (4 == Ipv4hints) */
+      "\x00\x05" /* data size */
+      "\xc0\xa8\x00\x01\xff",  /* 32 + 8 bits */
+      19,
+      "r:43|"
+    },
+    {
+      "alpn + one ipv6 address",
+      (const unsigned char *)"\x00\x10" /* 16-bit prio */
+      "\x00" /* no RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x03" /* data size */
+      "\x02" /* ALPN length byte */
+      "h2"
+      "\x00\x06" /* RR (6 == Ipv6hints) */
+      "\x00\x10" /* data size */
+      "\xfe\x80\xda\xbb\xc1\xff\xfe\xa3\x8a\x22\x12\x34\x56\x78\x91\x23",
+      30,
+      "r:0|p:16|.|alpn:10|ipv6:fe80:dabb:c1ff:fea3:8a22:1234:5678:9123|"
+    },
+    {
+      "alpn + one ipv6 address with wrong size",
+      (const unsigned char *)"\x00\x10" /* 16-bit prio */
+      "\x00" /* no RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x03" /* data size */
+      "\x02" /* ALPN length byte */
+      "h2"
+      "\x00\x06" /* RR (6 == Ipv6hints) */
+      "\x00\x11" /* data size */
+      "\xfe\x80\xda\xbb\xc1\xff\xfe\xa3\x8a\x22\x12\x34\x56\x78\x91\x23\x45",
+      31,
+      "r:43|"
+    },
+    {
+      "alpn + two ipv6 addresses",
+      (const unsigned char *)"\x00\x10" /* 16-bit prio */
+      "\x00" /* no RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x03" /* data size */
+      "\x02" /* ALPN length byte */
+      "h2"
+      "\x00\x06" /* RR (6 == Ipv6hints) */
+      "\x00\x20" /* data size */
+      "\xfe\x80\xda\xbb\xc1\xff\xfe\xa3\x8a\x22\x12\x34\x56\x78\x91\x23"
+      "\xee\x80\xda\xbb\xc1\xff\xfe\xa3\x8a\x22\x12\x34\x56\x78\x91\x25",
+      46,
+      "r:0|p:16|.|alpn:10|ipv6:fe80:dabb:c1ff:fea3:8a22:1234:5678:9123|"
+      "ipv6:ee80:dabb:c1ff:fea3:8a22:1234:5678:9125|"
+    },
+    {
+      "alpn + ech",
+      (const unsigned char *)"\x00\x10" /* 16-bit prio */
+      "\x00" /* no RNAME */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x03" /* data size */
+      "\x02" /* ALPN length byte */
+      "h2"
+      "\x00\x05" /* RR (5 == ECH) */
+      "\x00\x10" /* data size */
+      "\xfe\x80\xda\xbb\xc1\xff\xfe\xa3\x8a\x22\x12\x34\x56\x78\x91\x23",
+      30,
+      "r:0|p:16|.|alpn:10|ech:fe80dabbc1fffea38a22123456789123|"
+    },
+    {
+      "fully packed",
+      (const unsigned char *)"\xa0\x0b" /* 16-bit prio */
+      "\x00" /* no RNAME */
+      "\x00\x00" /* RR (0 == MANDATORY) */
+      "\x00\x00" /* data size */
+      "\x00\x01" /* RR (1 == ALPN) */
+      "\x00\x06" /* data size */
+      "\x02" /* ALPN length byte */
+      "h2"
+      "\x02" /* ALPN length byte */
+      "h1"
+      "\x00\x02" /* RR (2 == NO DEFAULT ALPN) */
+      "\x00\x00" /* must be zero */
+      "\x00\x03" /* RR (3 == PORT) */
+      "\x00\x02" /* data size */
+      "\xbc\x71" /* port number */
+      "\x00\x04" /* RR (4 == Ipv4hints) */
+      "\x00\x08" /* data size */
+      "\xc0\xa8\x00\x01" /* 32 bits */
+      "\xc0\xa8\x00\x02" /* 32 bits */
+      "\x00\x05" /* RR (5 == ECH) */
+      "\x00\x10" /* data size */
+      "\xfe\x80\xda\xbb\xc1\xff\x7e\xb3\x8a\x22\x12\x34\x56\x78\x91\x23"
+      "\x00\x06" /* RR (6 == Ipv6hints) */
+      "\x00\x20" /* data size */
+      "\xfe\x80\xda\xbb\xc1\xff\xfe\xa3\x8a\x22\x12\x34\x56\x78\x91\x23"
+      "\xee\x80\xda\xbb\xc1\xff\xfe\xa3\x8a\x22\x12\x34\x56\x78\x91\x25"
+      "\x01\x07" /* RR (263 == not supported) */
+      "\x00\x04" /* data size */
+      "FFAA", /* unknown to the world */
+      103,
+      "r:0|p:40971|.|alpn:10|alpn:8|no-def-alpn|port:48241|"
+      "ipv4:192.168.0.1|ipv4:192.168.0.2|"
+      "ech:fe80dabbc1ff7eb38a22123456789123|"
+      "ipv6:fe80:dabb:c1ff:fea3:8a22:1234:5678:9123|"
+      "ipv6:ee80:dabb:c1ff:fea3:8a22:1234:5678:9125|"
+    },
+    {
+      "rname too long label",
+      (const unsigned char *)"\x00\x00" /* 16-bit prio */
+      "\x40"
+      "0123456789012345678901234567890123456789012345678901234567890123"
+      "\x04some\x00", /* RNAME */
+      73,
+      "r:27|",
+    },
+    {
+      "rname long label",
+      (const unsigned char *)"\x00\x00" /* 16-bit prio */
+      "\x3f"
+      "012345678901234567890123456789012345678901234567890123456789012"
+      "\x04some\x00", /* RNAME */
+      72,
+      "r:0|p:0|"
+      "012345678901234567890123456789012345678901234567890123456789012.some.|",
+    },
+  };
+
+  CURLcode result = CURLE_OUT_OF_MEMORY;
+  CURL *easy;
+
+  easy = curl_easy_init();
+  /* so that we get the log output: */
+  curl_easy_setopt(easy, CURLOPT_VERBOSE, 1L);
+  if(easy) {
+    unsigned int i;
+
+    for(i = 0; i < CURL_ARRAYSIZE(t); i++) {
+      struct Curl_https_rrinfo *hrr;
+
+      curl_mprintf("test %u: %s\n", i, t[i].name);
+
+      result = doh_resp_decode_httpsrr(easy, t[i].dns, t[i].len, &hrr);
+
+      /* create an output */
+      rrresults(hrr, result);
+
+      /* is the output the expected? */
+      if(strcmp(rrbuffer, t[i].expect)) {
+        curl_mfprintf(stderr, "Test %s (%u) failed\n"
+                      "Expected: %s\n"
+                      "Received: %s\n", t[i].name, i, t[i].expect, rrbuffer);
+        unitfail++;
+      }
+
+      /* free the generated struct */
+      if(hrr) {
+        Curl_httpsrr_cleanup(hrr);
+        curl_free(hrr);
+      }
+    }
+    curl_easy_cleanup(easy);
+  }
+
+  UNITTEST_END(curl_global_cleanup())
+}
+
+#else /* CURL_DISABLE_DOH || !USE_HTTPSRR */
+
+static CURLcode test_unit1658(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+  UNITTEST_END_SIMPLE
+}
+
+#endif
diff --git a/third-party/curl/tests/unit/unit1660.c b/third-party/curl/tests/unit/unit1660.c
index 938d1a185f..f2d72705d5 100644
--- a/third-party/curl/tests/unit/unit1660.c
+++ b/third-party/curl/tests/unit/unit1660.c
@@ -21,103 +21,86 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
+#include "unitcheck.h"
 
+#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_HSTS)
 #include "urldata.h"
 #include "hsts.h"
 
-static CURLcode
-unit_setup(void)
-{
-  return CURLE_OK;
-}
-
-static void
-unit_stop(void)
-{
-  curl_global_cleanup();
-}
-
-#if defined(CURL_DISABLE_HTTP) || defined(CURL_DISABLE_HSTS)
-UNITTEST_START
-{
-  return 0; /* nothing to do when HTTP or HSTS are disabled */
-}
-UNITTEST_STOP
-#else
-
-struct testit {
-  const char *host;
-  const char *chost; /* if non-NULL, use to lookup with */
-  const char *hdr; /* if NULL, just do the lookup */
-  const CURLcode result; /* parse result */
-};
-
-static const struct testit headers[] = {
-  /* two entries read from disk cache, verify first */
-  { "-", "readfrom.example", NULL, CURLE_OK},
-  { "-", "old.example", NULL, CURLE_OK},
-  /* delete the remaining one read from disk */
-  { "readfrom.example", NULL, "max-age=\"0\"", CURLE_OK},
-
-  { "example.com", NULL, "max-age=\"31536000\"\r\n", CURLE_OK },
-  { "example.com", NULL, "max-age=\"21536000\"\r\n", CURLE_OK },
-  { "example.com", NULL, "max-age=\"21536000\"; \r\n", CURLE_OK },
-  { "example.com", NULL, "max-age=\"21536000\"; includeSubDomains\r\n",
-    CURLE_OK },
-  { "example.org", NULL, "max-age=\"31536000\"\r\n", CURLE_OK },
-  { "this.example", NULL, "max=\"31536\";", CURLE_BAD_FUNCTION_ARGUMENT },
-  { "this.example", NULL, "max-age=\"31536", CURLE_BAD_FUNCTION_ARGUMENT },
-  { "this.example", NULL, "max-age=31536\"", CURLE_OK },
-  /* max-age=0 removes the entry */
-  { "this.example", NULL, "max-age=0", CURLE_OK },
-  { "another.example", NULL, "includeSubDomains; ",
-    CURLE_BAD_FUNCTION_ARGUMENT },
-
-  /* Two max-age is illegal */
-  { "example.com", NULL,
-    "max-age=\"21536000\"; includeSubDomains; max-age=\"3\";",
-    CURLE_BAD_FUNCTION_ARGUMENT },
-  /* Two includeSubDomains is illegal */
-  { "2.example.com", NULL,
-    "max-age=\"21536000\"; includeSubDomains; includeSubDomains;",
-    CURLE_BAD_FUNCTION_ARGUMENT },
-  /* use a unknown directive "include" that should be ignored */
-  { "3.example.com", NULL, "max-age=\"21536000\"; include; includeSubDomains;",
-    CURLE_OK },
-  /* remove the "3.example.com" one, should still match the example.com */
-  { "3.example.com", NULL, "max-age=\"0\"; includeSubDomains;",
-    CURLE_OK },
-  { "-", "foo.example.com", NULL, CURLE_OK},
-  { "-", "foo.xample.com", NULL, CURLE_OK},
-
-  /* should not match */
-  { "example.net", "forexample.net", "max-age=\"31536000\"\r\n", CURLE_OK },
-
-  /* should not match either, since forexample.net is not in the example.net
-     domain */
-  { "example.net", "forexample.net",
-    "max-age=\"31536000\"; includeSubDomains\r\n", CURLE_OK },
-  /* remove example.net again */
-  { "example.net", NULL, "max-age=\"0\"; includeSubDomains\r\n", CURLE_OK },
-
-  /* make this live for 7 seconds */
-  { "expire.example", NULL, "max-age=\"7\"\r\n", CURLE_OK },
-  { NULL, NULL, NULL, CURLE_OK }
-};
-
 static void showsts(struct stsentry *e, const char *chost)
 {
   if(!e)
-    printf("'%s' is not HSTS\n", chost);
+    curl_mprintf("'%s' is not HSTS\n", chost);
   else {
-    printf("%s [%s]: %" CURL_FORMAT_CURL_OFF_T "%s\n",
-           chost, e->host, e->expires,
-           e->includeSubDomains ? " includeSubDomains" : "");
+    curl_mprintf("%s [%s]: %" CURL_FORMAT_CURL_OFF_T "%s\n",
+                 chost, e->host, e->expires,
+                 e->includeSubDomains ? " includeSubDomains" : "");
   }
 }
 
-UNITTEST_START
+static CURLcode test_unit1660(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  struct testit {
+    const char *host;
+    const char *chost;     /* if non-NULL, use to lookup with */
+    const char *hdr;       /* if NULL, do the lookup */
+    const CURLcode result; /* parse result */
+  };
+
+  static const struct testit headers[] = {
+    /* two entries read from disk cache, verify first */
+    { "-", "readfrom.example", NULL, CURLE_OK },
+    { "-", "old.example", NULL, CURLE_OK },
+    /* delete the remaining one read from disk */
+    { "readfrom.example", NULL, "max-age=\"0\"", CURLE_OK },
+
+    { "example.com", NULL, "max-age=\"31536000\"\r\n", CURLE_OK },
+    { "example.com", NULL, "max-age=\"21536000\"\r\n", CURLE_OK },
+    { "example.com", NULL, "max-age=\"21536000\"; \r\n", CURLE_OK },
+    { "example.com", NULL, "max-age=\"21536000\"; includeSubDomains\r\n",
+      CURLE_OK },
+    { "example.org", NULL, "max-age=\"31536000\"\r\n", CURLE_OK },
+    { "this.example", NULL, "max=\"31536\";", CURLE_BAD_FUNCTION_ARGUMENT },
+    { "this.example", NULL, "max-age=\"31536", CURLE_BAD_FUNCTION_ARGUMENT },
+    { "this.example", NULL, "max-age=31536\"", CURLE_OK },
+    /* max-age=0 removes the entry */
+    { "this.example", NULL, "max-age=0", CURLE_OK },
+    { "another.example", NULL, "includeSubDomains; ",
+      CURLE_BAD_FUNCTION_ARGUMENT },
+
+    /* Two max-age is illegal */
+    { "example.com", NULL,
+      "max-age=\"21536000\"; includeSubDomains; max-age=\"3\";",
+      CURLE_BAD_FUNCTION_ARGUMENT },
+    /* Two includeSubDomains is illegal */
+    { "2.example.com", NULL,
+      "max-age=\"21536000\"; includeSubDomains; includeSubDomains;",
+      CURLE_BAD_FUNCTION_ARGUMENT },
+    /* use an unknown directive "include" that should be ignored */
+    { "3.example.com", NULL,
+      "max-age=\"21536000\"; include; includeSubDomains;", CURLE_OK },
+    /* remove the "3.example.com" one, should still match the example.com */
+    { "3.example.com", NULL, "max-age=\"0\"; includeSubDomains;", CURLE_OK },
+    { "-", "foo.example.com", NULL, CURLE_OK },
+    { "-", "foo.xample.com", NULL, CURLE_OK },
+
+    /* should not match */
+    { "example.net", "forexample.net", "max-age=\"31536000\"\r\n", CURLE_OK },
+
+    /* should not match either, since forexample.net is not in the example.net
+       domain */
+    { "example.net", "forexample.net",
+      "max-age=\"31536000\"; includeSubDomains\r\n", CURLE_OK },
+    /* remove example.net again */
+    { "example.net", NULL, "max-age=\"0\"; includeSubDomains\r\n", CURLE_OK },
+
+    /* make this live for 7 seconds */
+    { "expire.example", NULL, "max-age=\"7\"\r\n", CURLE_OK },
+    { NULL, NULL, NULL, CURLE_OK }
+  };
+
   CURLcode result;
   struct stsentry *e;
   struct hsts *h = Curl_hsts_init();
@@ -138,42 +121,50 @@ UNITTEST_START
 
   Curl_hsts_loadfile(easy, h, arg);
 
-  for(i = 0; headers[i].host ; i++) {
+  for(i = 0; headers[i].host; i++) {
     if(headers[i].hdr) {
       result = Curl_hsts_parse(h, headers[i].host, headers[i].hdr);
 
       if(result != headers[i].result) {
-        fprintf(stderr, "Curl_hsts_parse(%s) failed: %d\n",
-                headers[i].hdr, result);
+        curl_mfprintf(stderr, "Curl_hsts_parse(%s) failed: %d\n",
+                      headers[i].hdr, (int)result);
         unitfail++;
         continue;
       }
       else if(result) {
-        printf("Input %u: error %d\n", i, (int) result);
+        curl_mprintf("Input %d: error %d\n", i, (int)result);
         continue;
       }
     }
 
     chost = headers[i].chost ? headers[i].chost : headers[i].host;
-    e = Curl_hsts(h, chost, TRUE);
+    e = hsts_check(h, chost, strlen(chost), TRUE);
     showsts(e, chost);
   }
 
-  printf("Number of entries: %zu\n", h->list.size);
+  curl_mprintf("Number of entries: %zu\n", Curl_llist_count(&h->list));
 
   /* verify that it is exists for 7 seconds */
   chost = "expire.example";
   for(i = 100; i < 110; i++) {
-    e = Curl_hsts(h, chost, TRUE);
+    e = hsts_check(h, chost, strlen(chost), TRUE);
     showsts(e, chost);
     deltatime++; /* another second passed */
   }
 
-  msnprintf(savename, sizeof(savename), "%s.save", arg);
+  curl_msnprintf(savename, sizeof(savename), "%s.save", arg);
   (void)Curl_hsts_save(easy, h, savename);
   Curl_hsts_cleanup(&h);
   curl_easy_cleanup(easy);
   curl_global_cleanup();
 
-UNITTEST_STOP
+  UNITTEST_END(curl_global_cleanup())
+}
+#else
+static CURLcode test_unit1660(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+  puts("nothing to do when HTTP or HSTS are disabled");
+  UNITTEST_END_SIMPLE
+}
 #endif
diff --git a/third-party/curl/tests/unit/unit1661.c b/third-party/curl/tests/unit/unit1661.c
index 265e483b5a..a12b72d740 100644
--- a/third-party/curl/tests/unit/unit1661.c
+++ b/third-party/curl/tests/unit/unit1661.c
@@ -21,44 +21,45 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "bufref.h"
 
-static struct bufref bufref;
-
 static int freecount = 0;
 
 static void test_free(void *p)
 {
   fail_unless(p, "pointer to free may not be NULL");
   freecount++;
-  free(p);
+  curlx_free(p);
 }
 
-static CURLcode unit_setup(void)
+static CURLcode t1661_setup(struct bufref *bufref)
 {
-  Curl_bufref_init(&bufref);
+  Curl_bufref_init(bufref);
   return CURLE_OK;
 }
 
-static void unit_stop(void)
+static void t1661_stop(struct bufref *bufref)
 {
+  Curl_bufref_free(bufref);
 }
 
-UNITTEST_START
+static CURLcode test_unit1661(const char *arg)
 {
-  char *buffer = NULL;
+  struct bufref bufref;
+
+  UNITTEST_BEGIN(t1661_setup(&bufref))
+
+  const char *buffer = NULL;
   CURLcode result = CURLE_OK;
 
   /**
    * testing Curl_bufref_init.
    * @assumptions:
-   * 1: data size will be 0
-   * 2: reference will be NULL
-   * 3: destructor will be NULL
+   * 1: data size is 0
+   * 2: reference is NULL
+   * 3: destructor is NULL
    */
-
   fail_unless(!bufref.ptr, "Initial reference must be NULL");
   fail_unless(!bufref.len, "Initial length must be NULL");
   fail_unless(!bufref.dtor, "Destructor must be NULL");
@@ -66,50 +67,48 @@ UNITTEST_START
   /**
    * testing Curl_bufref_set
    */
-
-  buffer = malloc(13);
+  buffer = curlx_malloc(13);
   abort_unless(buffer, "Out of memory");
   Curl_bufref_set(&bufref, buffer, 13, test_free);
 
-  fail_unless((char *) bufref.ptr == buffer, "Referenced data badly set");
+  fail_unless((const char *)bufref.ptr == buffer, "Referenced data badly set");
   fail_unless(bufref.len == 13, "Data size badly set");
   fail_unless(bufref.dtor == test_free, "Destructor badly set");
 
   /**
    * testing Curl_bufref_ptr
    */
-
-  fail_unless((char *) Curl_bufref_ptr(&bufref) == buffer,
+  fail_unless((const char *)Curl_bufref_ptr(&bufref) == buffer,
               "Wrong pointer value returned");
 
   /**
    * testing Curl_bufref_len
    */
-
   fail_unless(Curl_bufref_len(&bufref) == 13, "Wrong data size returned");
 
   /**
-   * testing Curl_bufref_memdup
+   * testing Curl_bufref_memdup0
    */
-
-  result = Curl_bufref_memdup(&bufref, "1661", 3);
+  result = Curl_bufref_memdup0(&bufref, "1661", 3);
   abort_unless(result == CURLE_OK, curl_easy_strerror(result));
   fail_unless(freecount == 1, "Destructor not called");
-  fail_unless((char *) bufref.ptr != buffer, "Returned pointer not set");
-  buffer = (char *) Curl_bufref_ptr(&bufref);
+  fail_unless((const char *)bufref.ptr != buffer, "Returned pointer not set");
+  buffer = Curl_bufref_ptr(&bufref);
   fail_unless(buffer, "Allocated pointer is NULL");
   fail_unless(bufref.len == 3, "Wrong data size stored");
-  fail_unless(!buffer[3], "Duplicated data should have been truncated");
-  fail_unless(!strcmp(buffer, "166"), "Bad duplicated data");
+  if(buffer) {
+    fail_unless(!buffer[3], "Duplicated data should have been truncated");
+    fail_unless(!strcmp(buffer, "166"), "Bad duplicated data");
+  }
 
   /**
    * testing Curl_bufref_free
    */
-
   Curl_bufref_free(&bufref);
   fail_unless(freecount == 1, "Wrong destructor called");
   fail_unless(!bufref.ptr, "Initial reference must be NULL");
   fail_unless(!bufref.len, "Initial length must be NULL");
   fail_unless(!bufref.dtor, "Destructor must be NULL");
+
+  UNITTEST_END(t1661_stop(&bufref))
 }
-UNITTEST_STOP
diff --git a/third-party/curl/tests/unit/unit1663.c b/third-party/curl/tests/unit/unit1663.c
new file mode 100644
index 0000000000..42fe782f87
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1663.c
@@ -0,0 +1,90 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_NETINET_IN6_H
+#include <netinet/in6.h>
+#endif
+
+#include "cf-socket.h"
+
+static CURLcode t1663_setup(void)
+{
+  CURLcode result = CURLE_OK;
+  global_init(CURL_GLOBAL_ALL);
+  return result;
+}
+
+static void t1663_parse(const char *input_data,
+                        const char *exp_dev,
+                        const char *exp_iface,
+                        const char *exp_host,
+                        CURLcode result_exp)
+{
+  char *dev = NULL;
+  char *iface = NULL;
+  char *host = NULL;
+  CURLcode result = Curl_parse_interface(input_data, &dev, &iface, &host);
+  fail_unless(result == result_exp, "Curl_parse_interface() failed");
+
+  fail_unless(!!exp_dev == !!dev, "dev expectation failed.");
+  fail_unless(!!exp_iface == !!iface, "iface expectation failed");
+  fail_unless(!!exp_host == !!host, "host expectation failed");
+
+  if(!unitfail) {
+    fail_unless(!dev || !exp_dev || !strcmp(dev, exp_dev),
+                "dev should be equal to exp_dev");
+    fail_unless(!iface || !exp_iface || !strcmp(iface, exp_iface),
+                "iface should be equal to exp_iface");
+    fail_unless(!host || !exp_host || !strcmp(host, exp_host),
+                "host should be equal to exp_host");
+  }
+
+  curlx_free(dev);
+  curlx_free(iface);
+  curlx_free(host);
+}
+
+static CURLcode test_unit1663(const char *arg)
+{
+  UNITTEST_BEGIN(t1663_setup())
+
+  t1663_parse("dev", "dev", NULL, NULL, CURLE_OK);
+  t1663_parse("if!eth0", NULL, "eth0", NULL, CURLE_OK);
+  t1663_parse("host!myname", NULL, NULL, "myname", CURLE_OK);
+  t1663_parse("ifhost!eth0!myname", NULL, "eth0", "myname", CURLE_OK);
+  t1663_parse("", NULL, NULL, NULL, CURLE_BAD_FUNCTION_ARGUMENT);
+  t1663_parse("!", "!", NULL, NULL, CURLE_OK);
+  t1663_parse("if!", NULL, NULL, NULL, CURLE_BAD_FUNCTION_ARGUMENT);
+  t1663_parse("if!eth0!blubb", NULL, "eth0!blubb", NULL, CURLE_OK);
+  t1663_parse("host!", NULL, NULL, NULL, CURLE_BAD_FUNCTION_ARGUMENT);
+  t1663_parse("ifhost!", NULL, NULL, NULL, CURLE_BAD_FUNCTION_ARGUMENT);
+  t1663_parse("ifhost!eth0", NULL, NULL, NULL, CURLE_BAD_FUNCTION_ARGUMENT);
+  t1663_parse("ifhost!eth0!", NULL, NULL, NULL, CURLE_BAD_FUNCTION_ARGUMENT);
+
+  UNITTEST_END(curl_global_cleanup())
+}
diff --git a/third-party/curl/tests/unit/unit1664.c b/third-party/curl/tests/unit/unit1664.c
new file mode 100644
index 0000000000..17a04a37f2
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1664.c
@@ -0,0 +1,489 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_NETINET_IN6_H
+#include <netinet/in6.h>
+#endif
+
+static CURLcode t1664_setup(void)
+{
+  CURLcode result = CURLE_OK;
+  global_init(CURL_GLOBAL_ALL);
+  return result;
+}
+
+static CURLcode test_unit1664(const char *arg)
+{
+  UNITTEST_BEGIN(t1664_setup())
+
+  static const char *wordparse[] = {
+    "word",
+    "word ",
+    " word ",
+    "wo rd",
+    "word(",
+    "wor(d",
+    "perfect",
+    "",
+    "longerth",
+    NULL
+  };
+
+  int i;
+  curl_mprintf("curlx_str_word\n");
+  for(i = 0; wordparse[i]; i++) {
+    struct Curl_str out;
+    const char *line = wordparse[i];
+    const char *orgline = line;
+    int rc = curlx_str_word(&line, &out, 7);
+    curl_mprintf("%d: (\"%s\") %d, \"%.*s\" [%d], line %d\n",
+                 i, orgline, rc, (int)out.len, out.str, (int)out.len,
+                 (int)(line - orgline));
+  }
+
+  curl_mprintf("curlx_str_until\n");
+  for(i = 0; wordparse[i]; i++) {
+    struct Curl_str out;
+    const char *line = wordparse[i];
+    const char *orgline = line;
+    int rc = curlx_str_until(&line, &out, 7, 'd');
+    curl_mprintf("%d: (\"%s\") %d, \"%.*s\" [%d], line %d\n",
+                 i, orgline, rc, (int)out.len, out.str, (int)out.len,
+                 (int)(line - orgline));
+  }
+
+  {
+    static const char *qwords[] = {
+      "\"word\"",
+      "\"word",
+      "word\"",
+      "\"word\"\"",
+      "\"word\" ",
+      " \"word\"",
+      "\"perfect\"",
+      "\"p r e t\"",
+      "\"perfec\\\"",
+      "\"trail\\\"\"",
+      "\"trail2\\\"\"",
+      "\"trail33\\\"\"",
+      "\"0\\\\\\\\\\\\\"",
+      "\"1\\\\\\\\\\\\\\\"",
+      "\"\"",
+      "",
+      "\"longerth\"",
+      NULL
+    };
+
+    curl_mprintf("curlx_str_quotedword\n");
+    for(i = 0; qwords[i]; i++) {
+      struct Curl_str out;
+      const char *line = qwords[i];
+      const char *orgline = line;
+      int rc = curlx_str_quotedword(&line, &out, 7);
+      curl_mprintf("%d: (\"%s\") %d, \"%.*s\" [%d], line %d\n",
+                   i, orgline, rc, (int)out.len, out.str, (int)out.len,
+                   (int)(line - orgline));
+    }
+  }
+
+  {
+    static const char *single[] = {
+      "a",
+      "aa",
+      "A",
+      "b",
+      "\\",
+      " ",
+      "",
+      NULL
+    };
+    curl_mprintf("curlx_str_single\n");
+    for(i = 0; single[i]; i++) {
+      const char *line = single[i];
+      const char *orgline = line;
+      int rc = curlx_str_single(&line, 'a');
+      curl_mprintf("%d: (\"%s\") %d, line %d\n",
+                   i, orgline, rc, (int)(line - orgline));
+    }
+  }
+
+  {
+    static const char *single[] = {
+      "a",
+      "aa",
+      "A",
+      "b",
+      "\\",
+      " ",
+      "\t",
+      "\n",
+      "",
+      NULL
+    };
+    curl_mprintf("curlx_str_singlespace\n");
+    for(i = 0; single[i]; i++) {
+      const char *line = single[i];
+      const char *orgline = line;
+      int rc = curlx_str_singlespace(&line);
+      curl_mprintf("%d: (\"%s\") %d, line %d\n",
+                   i, orgline, rc, (int)(line - orgline));
+    }
+  }
+
+  {
+    static const char *single[] = {
+      "a",
+      "aa",
+      "A",
+      "b",
+      "\\",
+      " ",
+      "",
+      NULL
+    };
+    curl_mprintf("curlx_str_single\n");
+    for(i = 0; single[i]; i++) {
+      const char *line = single[i];
+      const char *orgline = line;
+      int rc = curlx_str_single(&line, 'a');
+      curl_mprintf("%d: (\"%s\") %d, line %d\n",
+                   i, orgline, rc, (int)(line - orgline));
+    }
+  }
+
+  {
+    static const char *nums[] = {
+      "1",
+      "10000",
+      "1234",
+      "1235",
+      "1236",
+      "01234",
+      "00000000000000000000000000001234",
+      "0123 345",
+      "0123O345",
+      "-12",
+      " 123",
+      "",
+      NULL
+    };
+    curl_mprintf("curlx_str_number\n");
+    for(i = 0; nums[i]; i++) {
+      curl_off_t num;
+      const char *line = nums[i];
+      const char *orgline = line;
+      int rc = curlx_str_number(&line, &num, 1235);
+      curl_mprintf("%d: (\"%s\") %d, [%" CURL_FORMAT_CURL_OFF_T "] line %d\n",
+                   i, orgline, rc, num, (int)(line - orgline));
+    }
+  }
+
+  {
+    struct t {
+      const char *str;
+      curl_off_t max;
+    };
+    static struct t nums[] = {
+      { "00", 8},
+      { "1", 8},
+      { "1", 1},
+      { "2", 1},
+      { "2", 2},
+      { "5", 6},
+      { "000000000000000000000006", 6},
+      { "7", 6},
+      { "8", 6},
+      { "9", 8},
+      { "10", 10},
+      { "11", 10},
+      { "12", 10},
+      {NULL, 0}
+    };
+    curl_mprintf("curlx_str_number varying max\n");
+    for(i = 0; nums[i].str; i++) {
+      curl_off_t num;
+      const char *line = nums[i].str;
+      const char *orgline = line;
+      int rc = curlx_str_number(&line, &num, nums[i].max);
+      curl_mprintf("%d: (\"%s\") max %" CURL_FORMAT_CURL_OFF_T
+                   " == %d, [%" CURL_FORMAT_CURL_OFF_T "]\n",
+                   i, orgline, nums[i].max, rc, num);
+    }
+  }
+
+  {
+    struct t {
+      const char *str;
+      curl_off_t max;
+    };
+    static struct t nums[] = {
+      { "00", 8},
+      { "1", 8},
+      { "1", 1},
+      { "2", 1},
+      { "2", 2},
+      { "5", 6},
+      { "000000000000000000000006", 6},
+      { "7", 6},
+      { "8", 6},
+      { "9", 8},
+      { "a", 14},
+      { "b", 14},
+      { "c", 14},
+      { "d", 14},
+      { "e", 14},
+      { "f", 14},
+      { "f", 15},
+      { "10", 16},
+      { "11", 16},
+      { "12", 16},
+      {NULL, 0}
+    };
+    curl_mprintf("curlx_str_hex varying max\n");
+    for(i = 0; nums[i].str; i++) {
+      curl_off_t num;
+      const char *line = nums[i].str;
+      const char *orgline = line;
+      int rc = curlx_str_hex(&line, &num, nums[i].max);
+      curl_mprintf("%d: (\"%s\") max %" CURL_FORMAT_CURL_OFF_T
+                   " == %d, [%" CURL_FORMAT_CURL_OFF_T "]\n",
+                   i, orgline, nums[i].max, rc, num);
+    }
+  }
+
+  {
+    struct t {
+      const char *str;
+      curl_off_t max;
+    };
+    static struct t nums[] = {
+      { "00", 4},
+      { "1", 4},
+      { "1", 4},
+      { "2", 4},
+      { "3", 4},
+      { "4", 4},
+      { "5", 4},
+      { "000000000000000000000006", 6},
+      { "7", 7},
+      { "10", 8},
+      { "11", 8},
+      { "11", 9},
+      { "12", 9},
+      { "13", 9},
+      { "8", 10},
+      {NULL, 0}
+    };
+    curl_mprintf("curlx_str_octal varying max\n");
+    for(i = 0; nums[i].str; i++) {
+      curl_off_t num;
+      const char *line = nums[i].str;
+      const char *orgline = line;
+      int rc = curlx_str_octal(&line, &num, nums[i].max);
+      curl_mprintf("%d: (\"%s\") max %" CURL_FORMAT_CURL_OFF_T
+                   " == %d, [%" CURL_FORMAT_CURL_OFF_T "]\n",
+                   i, orgline, nums[i].max, rc, num);
+    }
+  }
+
+  {
+    /* CURL_OFF_T is typically 9223372036854775807 */
+    static const char *nums[] = {
+      "9223372036854775807", /* 2^63 -1 */
+      "9223372036854775808", /* 2^63 */
+      "18446744073709551615", /* 2^64 - 1 */
+      "18446744073709551616", /* 2^64 */
+      "18446744073709551617", /* 2^64 + 1 */
+      "0123456799a",
+      "0123456789",
+      "123498760b",
+      "1234987607611298232",
+      "1111111111111111111",
+      "2222222222222222222",
+      "00000000000000000000000000000009223372036854775807",
+      "3333333333333333333",
+      "4444444444444444444",
+      "5555555555555555555",
+      "6666666666666666666",
+      "7777777777777777777",
+      "8888888888888888888",
+      "999999999999999999",
+      NULL
+    };
+    curl_mprintf("curlx_str_number / max\n");
+    for(i = 0; nums[i]; i++) {
+      curl_off_t num;
+      const char *line = nums[i];
+      const char *orgline = line;
+      int rc = curlx_str_number(&line, &num, CURL_OFF_T_MAX);
+      curl_mprintf("%d: (\"%s\") %d, [%" CURL_FORMAT_CURL_OFF_T "] line %d\n",
+                   i, orgline, rc, num, (int)(line - orgline));
+    }
+  }
+
+  {
+    static const char *newl[] = {
+      "a",
+      "aa",
+      "A",
+      "b",
+      "\\",
+      " ",
+      "\n",
+      "\r",
+      "\r\n",
+      "\x0c",
+      "",
+      NULL
+    };
+    curl_mprintf("curlx_str_newline\n");
+    for(i = 0; newl[i]; i++) {
+      const char *line = newl[i];
+      const char *orgline = line;
+      int rc = curlx_str_newline(&line);
+      curl_mprintf("%d: (%%%02x) %d, line %d\n",
+                   i, (unsigned int)*orgline, rc, (int)(line - orgline));
+    }
+  }
+
+  {
+    static const char *nums[] = {
+      "1",
+      "1000",
+      "1234",
+      "1235",
+      "1236",
+      "01234",
+      "00000000000000000000000000001234",
+      "0123 345",
+      "0123O345",
+      "-12",
+      " 123",
+      "",
+      NULL
+    };
+    curl_mprintf("curlx_str_hex\n");
+    for(i = 0; nums[i]; i++) {
+      curl_off_t num;
+      const char *line = nums[i];
+      const char *orgline = line;
+      int rc = curlx_str_hex(&line, &num, 0x1235);
+      curl_mprintf("%d: (\"%s\") %d, [%" CURL_FORMAT_CURL_OFF_T "] line %d\n",
+                   i, orgline, rc, num, (int)(line - orgline));
+    }
+  }
+
+  {
+    static const char *nums[] = {
+      "1",
+      "1000",
+      "1234",
+      "1235",
+      "1236",
+      "01234",
+      "00000000000000000000000000001234",
+      "0123 345",
+      "0123O345",
+      "-12",
+      " 123",
+      "",
+      NULL
+    };
+    curl_mprintf("curlx_str_octal\n");
+    for(i = 0; nums[i]; i++) {
+      curl_off_t num;
+      const char *line = nums[i];
+      const char *orgline = line;
+      int rc = curlx_str_octal(&line, &num, 01235);
+      curl_mprintf("%d: (\"%s\") %d, [%" CURL_FORMAT_CURL_OFF_T "] line %d\n",
+                   i, orgline, rc, num, (int)(line - orgline));
+    }
+  }
+
+  {
+    /* CURL_OFF_T is typically 2^63-1 */
+    static const char *nums[] = {
+      "777777777777777777777", /* 2^63 -1 */
+      "1000000000000000000000", /* 2^63 */
+      "111111111111111111111",
+      "222222222222222222222",
+      "333333333333333333333",
+      "444444444444444444444",
+      "555555555555555555555",
+      "666666666666666666666",
+      NULL
+    };
+    curl_mprintf("curlx_str_octal / max\n");
+    for(i = 0; nums[i]; i++) {
+      curl_off_t num;
+      const char *line = nums[i];
+      const char *orgline = line;
+      int rc = curlx_str_octal(&line, &num, CURL_OFF_T_MAX);
+      curl_mprintf("%d: (\"%s\") %d, [%" CURL_FORMAT_CURL_OFF_T "] line %d\n",
+                   i, orgline, rc, num, (int)(line - orgline));
+    }
+  }
+
+  {
+    /* CURL_OFF_T is typically 2^63-1 */
+    static const char *nums[] = {
+      "7FFFFFFFFFFFFFFF", /* 2^63 -1 */
+      "8000000000000000", /* 2^63 */
+      "1111111111111111",
+      "2222222222222222",
+      "3333333333333333",
+      "4444444444444444",
+      "5555555555555555",
+      "6666666666666666",
+      "7777777777777777",
+      "888888888888888",
+      "999999999999999",
+      "aaaaaaaaAAAAAAA",
+      "bbbbbbbbBBBBBBB",
+      "BBBBBBBBbbbbbbb",
+      "ccccccccCCCCCCC",
+      "ddddddddDDDDDDD",
+      "eeeeeeeeEEEEEEE",
+      "ffffffffFFFFFFF",
+      "abcdef",
+      "ABCDEF",
+      NULL
+    };
+    curl_mprintf("curlx_str_hex / max\n");
+    for(i = 0; nums[i]; i++) {
+      curl_off_t num;
+      const char *line = nums[i];
+      const char *orgline = line;
+      int rc = curlx_str_hex(&line, &num, CURL_OFF_T_MAX);
+      curl_mprintf("%d: (\"%s\") %d, [%" CURL_FORMAT_CURL_OFF_T "] line %d\n",
+                   i, orgline, rc, num, (int)(line - orgline));
+    }
+  }
+
+  UNITTEST_END(curl_global_cleanup())
+}
diff --git a/third-party/curl/tests/unit/unit1666.c b/third-party/curl/tests/unit/unit1666.c
new file mode 100644
index 0000000000..c2f20c977a
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1666.c
@@ -0,0 +1,202 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+
+#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_MBEDTLS) || \
+  defined(USE_RUSTLS)
+#include "vtls/x509asn1.h"
+#include "vtls/vtls.h"
+
+struct test_1666 {
+  const char *oid;
+  const size_t size;
+  const char *dotted;
+  CURLcode result_exp;
+};
+
+/* the size of the object needs to deduct the null-terminator */
+#define OID(x) x, sizeof(x) - 1
+
+static bool test1666(const struct test_1666 *spec, size_t i,
+                     struct dynbuf *dbuf)
+{
+  CURLcode result;
+  const char *oid = spec->oid;
+  bool ok = TRUE;
+
+  curlx_dyn_reset(dbuf);
+  result = encodeOID(dbuf, oid, oid + spec->size);
+  if(result != spec->result_exp) {
+    curl_mfprintf(stderr, "test %zu: expect result %d, got %d\n",
+                  i, (int)spec->result_exp, (int)result);
+    if(!spec->result_exp) {
+      curl_mfprintf(stderr, "test %zu: expected output '%s'\n",
+                    i, spec->dotted);
+    }
+    ok = FALSE;
+  }
+  else if(!result && strcmp(spec->dotted, curlx_dyn_ptr(dbuf))) {
+    curl_mfprintf(stderr,
+                  "test %zu: expected output '%s', got '%s'\n",
+                  i, spec->dotted, curlx_dyn_ptr(dbuf));
+    ok = FALSE;
+  }
+
+  return ok;
+}
+
+static CURLcode test_unit1666(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  static const struct test_1666 test_specs[] = {
+    { "", 0, "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { "\x81", 0, "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { OID("\x8F\xFF\xFF\xFF\x7F"), "2.4294967215", CURLE_OK },
+    { OID("\x90\x80\x80\x80\x00"), "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { OID("\x88\x80\x80\x80\x4F"), "2.2147483647", CURLE_OK },
+    { OID("\x88\x80\x80\x80\x50"), "2.2147483648", CURLE_OK },
+    { OID("\x88\x80\x80\x80\x51"), "2.2147483649", CURLE_OK },
+    { OID("\x88\x80\x80\x80\x52"), "2.2147483650", CURLE_OK },
+    { OID("\x8F\xFF\xFF\xFF\x7F\x8F\xFF\xFF\xFF\x7F"),
+      "2.4294967215.4294967295", CURLE_OK },
+    { OID("\xB7\x28\x02"), "2.7000.2", CURLE_OK },
+    { OID("\x81\x00"), "2.48", CURLE_OK },
+    { OID("\x81\x00\x01"), "2.48.1", CURLE_OK },
+    { OID("\x81\x00\x02"), "2.48.2", CURLE_OK },
+    { OID("\xC0\x80\x81\x1F"), "2.134217807", CURLE_OK },
+    { OID("\x2b\x06\x01\x04\x01\x82\x37\x15\x14"), "1.3.6.1.4.1.311.21.20",
+      CURLE_OK },
+    { OID("\x2b\x06\x01\x04\x01\x82\x37\x15"), "1.3.6.1.4.1.311.21",
+      CURLE_OK },
+    { OID("\x2b\x06\x01\x04\x01\x82\x37"), "1.3.6.1.4.1.311", CURLE_OK },
+    { OID("\x2b\x06\x01\x04\x01"), "1.3.6.1.4.1", CURLE_OK },
+    { OID("\x2b\x06\x01\x04"), "1.3.6.1.4", CURLE_OK },
+    { OID("\x2b\x06\x01"), "1.3.6.1", CURLE_OK },
+    { OID("\x2b\x06"), "1.3.6", CURLE_OK },
+    { OID("\x2b"), "1.3", CURLE_OK },
+    { OID("\x2c"), "1.4", CURLE_OK },
+    { OID("\x2d"), "1.5", CURLE_OK },
+    { OID("\x2e"), "1.6", CURLE_OK },
+    { OID("\x2f"), "1.7", CURLE_OK },
+    { OID("\x30"), "1.8", CURLE_OK },
+    { OID("\x31"), "1.9", CURLE_OK },
+    { OID("\x32"), "1.10", CURLE_OK },
+    { OID("\x50"), "2.0", CURLE_OK },
+    { OID("\x7f"), "2.47", CURLE_OK },
+    { OID("\xff\x7f"), "2.16303", CURLE_OK },
+    { OID("\xff"), "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { OID("\xff\x80\x01"), "2.2080689", CURLE_OK },
+    { OID("\xff\x80\x80\x01"), "2.266338225", CURLE_OK },
+    { OID("\x80\x80\x80\x80\x01"), "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { OID("\x80\x80\x80\x80\x80\x01"), "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { OID("\x80\x80\x80\x80\x80\x80\x01"), "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { OID("\x80\xff\x7f"), "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { OID("\x80\xff\xff\xff\x7f"), "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { OID("\x2b\xff\xff\xff\xff\x7f"), "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { OID("\x80\x80"), "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { OID("\x80\x80\x80"), "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { OID("\x80\x80\x80\x80"), "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { OID("\x80\x80\x80\x80\x80"), "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { OID("\x80\x80\x80\x80\x80\x80"), "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { OID("\x2b\x06\x01\x04\x01\xee"), "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { OID("\x00"), "0.0", CURLE_OK },
+    { OID("\x01"), "0.1", CURLE_OK },
+    { OID("\x02"), "0.2", CURLE_OK },
+    { OID("\x03"), "0.3", CURLE_OK },
+    { OID("\x04"), "0.4", CURLE_OK },
+    { OID("\x05"), "0.5", CURLE_OK },
+    { OID("\x2b\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01"
+          "\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01"
+          "\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01"),
+      "1.3.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1"
+      ".1.1.1.1.1.1.1.1", CURLE_OK },
+    { OID("\x2b\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64"
+          "\x64\x64\x64\x64\x64\x64\x64\x64\x64\x7f"),
+      "", CURLE_TOO_LARGE },
+    { OID("\x2b\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64"
+          "\x64\x64\x64\x64\x64\x64\x64\x64\x64\x63"),
+      "", CURLE_TOO_LARGE },
+    { OID("\x2b\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64"
+          "\x64\x64\x64\x64\x64\x64\x64\x64\x64\x09"),
+      "", CURLE_TOO_LARGE },
+    { OID("\x2b\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01"
+          "\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01"
+          "\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01"
+          "\x01\x01\x01\x01\x01\x01\x01\x01"),
+      "", CURLE_TOO_LARGE },
+    /* one byte shorter than the previous is below the limit: */
+    { OID("\x2b\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01"
+          "\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01"
+          "\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01"
+          "\x01\x01\x01\x01\x01\x01\x01"),
+      "1.3.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1"
+      ".1.1.1.1.1.1.1.1.1.1.1.1.1.1.1", CURLE_OK },
+    { OID("\x78"), "2.40", CURLE_OK },
+    { OID("\x81\x34"), "2.100", CURLE_OK },
+    { OID("\x2b\x00\x01"), "1.3.0.1", CURLE_OK },
+    { OID("\x2b\x06\x01\x00"), "1.3.6.1.0", CURLE_OK },
+    { OID("\x2b\x8f\xff\xff\xff\x7f"), "1.3.4294967295", CURLE_OK },
+    { OID("\x2b\x81\x00"), "1.3.128", CURLE_OK },
+    { OID("\x2b\x80\x05"), "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { OID("\x2b\x80\x80\x01"), "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { OID("\x2b\x06\x81"), "", CURLE_BAD_FUNCTION_ARGUMENT },
+  };
+
+  size_t i;
+  struct dynbuf dbuf;
+  bool all_ok = TRUE;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  /* the real code uses CURL_X509_STR_MAX for maximum size, but we set a
+     smaller one here so that we can test running into the limit a little
+     easier */
+  curlx_dyn_init(&dbuf, 100);
+
+  for(i = 0; i < CURL_ARRAYSIZE(test_specs); ++i) {
+    if(!test1666(&test_specs[i], i, &dbuf))
+      all_ok = FALSE;
+  }
+  fail_unless(all_ok, "some tests of encodeOID() failed");
+
+  curlx_dyn_free(&dbuf);
+  curl_global_cleanup();
+
+  UNITTEST_END_SIMPLE
+}
+
+#else
+
+static CURLcode test_unit1666(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+  puts("not tested since encodeOID() is not built in");
+  UNITTEST_END_SIMPLE
+}
+
+#endif
diff --git a/third-party/curl/tests/unit/unit1667.c b/third-party/curl/tests/unit/unit1667.c
new file mode 100644
index 0000000000..345bd052cf
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1667.c
@@ -0,0 +1,335 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+
+#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_MBEDTLS) || \
+  defined(USE_RUSTLS)
+
+#include "vtls/x509asn1.h"
+#include "vtls/vtls.h"
+
+struct test_1667 {
+  unsigned char tag;
+  const char *asn1;
+  const size_t size;
+  const char *out;
+  CURLcode result_exp;
+};
+
+static bool test1667(const struct test_1667 *spec, size_t i,
+                     struct dynbuf *dbuf)
+{
+  CURLcode result;
+  bool ok = TRUE;
+  struct Curl_asn1Element elem;
+
+  curlx_dyn_reset(dbuf);
+
+  /* setup private struct for this invoke */
+  elem.tag = spec->tag;
+  elem.header = NULL;
+  elem.beg = spec->asn1;
+  elem.end = elem.beg + spec->size;
+  elem.eclass = 0;
+  elem.constructed = 0;
+
+  result = ASN1tostr(dbuf, &elem);
+  if(result != spec->result_exp) {
+    curl_mfprintf(stderr, "test %zu (type %u): expect result %d, got %d\n",
+                  i, spec->tag, (int)spec->result_exp, (int)result);
+    if(!spec->result_exp) {
+      curl_mfprintf(stderr, "test %zu: expected output '%s'\n",
+                    i, spec->out);
+    }
+    ok = FALSE;
+  }
+  else if(!result) {
+    /* use strlen on the pointer instead of curlx_dyn_len() because for some
+       of these type, the code explicitly adds a null-terminator which is then
+       counted as buffer size. */
+    size_t actual_len = strlen(curlx_dyn_ptr(dbuf));
+    if(strlen(spec->out) != actual_len) {
+      curl_mfprintf(stderr,
+                    "test %zu (type %u): "
+                    "unexpected length. Got %zu, expected %zu)\n",
+                    i, spec->tag, actual_len, strlen(spec->out));
+      ok = FALSE;
+    }
+    if(strcmp(spec->out, curlx_dyn_ptr(dbuf))) {
+      size_t loop;
+      const uint8_t *data = curlx_dyn_uptr(dbuf);
+      const size_t len = curlx_dyn_len(dbuf);
+      curl_mfprintf(stderr,
+                    "test %zu (type %u): "
+                    "expected output '%s', got '%s' (length %zu)\n",
+                    i, spec->tag, spec->out, data, len);
+      for(loop = 0; loop < len; loop++)
+        curl_mfprintf(stderr, "test %zu: index %zu byte %02x\n",
+                      i, loop, data[loop]);
+      ok = FALSE;
+    }
+  }
+
+  return ok;
+}
+
+static CURLcode test_unit1667(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  static const struct test_1667 test_specs[] = {
+    /* unsupported type > CURL_ASN1_BMP_STRING (30) */
+    { 31, "abcde", 5, "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { 99, "abcde", 5, "", CURLE_BAD_FUNCTION_ARGUMENT },
+
+    /*
+      (many different) strings:
+
+      CURL_ASN1_UTF8_STRING
+      CURL_ASN1_NUMERIC_STRING
+      CURL_ASN1_PRINTABLE_STRING
+      CURL_ASN1_TELETEX_STRING
+      CURL_ASN1_IA5_STRING
+      CURL_ASN1_VISIBLE_STRING
+      CURL_ASN1_UNIVERSAL_STRING
+      CURL_ASN1_BMP_STRING
+    */
+    { CURL_ASN1_UTF8_STRING, "abcde", 5, "abcde", CURLE_OK },
+    /* a with ring, a with umlaut, o with umlaut in UTF-8 encoding */
+    { CURL_ASN1_UTF8_STRING, "\xc3\xa5\xc3\xa4\xc3\xb6", 6,
+      "\xc3\xa5\xc3\xa4\xc3\xb6", CURLE_OK },
+    { CURL_ASN1_NUMERIC_STRING, "abcde", 5, "abcde", CURLE_OK },
+    { CURL_ASN1_PRINTABLE_STRING, "abcde", 5, "abcde", CURLE_OK },
+    { CURL_ASN1_TELETEX_STRING, "abcde", 5, "abcde", CURLE_OK },
+    { CURL_ASN1_IA5_STRING, "abcde", 5, "abcde", CURLE_OK },
+    { CURL_ASN1_VISIBLE_STRING, "abcde", 5, "abcde", CURLE_OK },
+    { CURL_ASN1_UNIVERSAL_STRING, "abcde", 5, "abcde",
+      CURLE_BAD_FUNCTION_ARGUMENT },
+    { CURL_ASN1_UNIVERSAL_STRING, "abcd", 4, "abcd",
+      CURLE_WEIRD_SERVER_REPLY },
+    { CURL_ASN1_UNIVERSAL_STRING, "\x00\x00\x12\x34", 4, "\xe1\x88\xb4",
+      CURLE_OK },
+    { CURL_ASN1_BMP_STRING, "abcde", 5, "abcde", CURLE_BAD_FUNCTION_ARGUMENT },
+
+    /* Generalized Time */
+    /* GTime2str() is tested separately in unit test 1656 */
+    { CURL_ASN1_GENERALIZED_TIME, "19851106210627.3", 16,
+      "1985-11-06 21:06:27.3", CURLE_OK },
+    { CURL_ASN1_GENERALIZED_TIME, "19851106210627.3Z", 17,
+      "1985-11-06 21:06:27.3 GMT", CURLE_OK },
+    { CURL_ASN1_GENERALIZED_TIME, "19851106210627.3-0500", 21,
+      "1985-11-06 21:06:27.3 UTC-0500", CURLE_OK },
+    /* Generalized Time: Invalid month (13). Still fine! */
+    { CURL_ASN1_GENERALIZED_TIME, "20231301000000Z", 15,
+      "2023-13-01 00:00:00 GMT", CURLE_OK },
+    /* Generalized Time: Valid millisecond precision */
+    { CURL_ASN1_GENERALIZED_TIME, "20230101000000.123Z", 19,
+      "2023-01-01 00:00:00.123 GMT", CURLE_OK },
+
+    /* UTC Time */
+    { CURL_ASN1_UTC_TIME, "991231235959Z", 13, "1999-12-31 23:59:59 GMT",
+      CURLE_OK },
+    { CURL_ASN1_UTC_TIME, "991231235959+0200", 17, "1999-12-31 23:59:59 +0200",
+      CURLE_OK },
+    { CURL_ASN1_UTC_TIME, "991231235959-0200", 17, "1999-12-31 23:59:59 -0200",
+      CURLE_OK },
+    { CURL_ASN1_UTC_TIME, "991231235959+999", 16, "1999-12-31 23:59:59 +999",
+      CURLE_OK },
+    /* Leap year check (Feb 29, 2024) */
+    { CURL_ASN1_UTC_TIME, "240229120000Z", 13, "2024-02-29 12:00:00 GMT",
+      CURLE_OK },
+    /* Century roll-over (00-49 is 20xx, 50-99 is 19xx) */
+    { CURL_ASN1_UTC_TIME, "491231235959Z", 13, "2049-12-31 23:59:59 GMT",
+      CURLE_OK },
+    { CURL_ASN1_UTC_TIME, "500101000000Z", 13, "1950-01-01 00:00:00 GMT",
+      CURLE_OK },
+
+    /* Object Identifier (encodeOID() is tested in unit test 1666) */
+
+    /* 1.2.840.10040.4.1 */
+    { CURL_ASN1_OBJECT_IDENTIFIER, "\x2A\x86\x48\xCE\x38\x04\x01", 7,
+      "dsa", CURLE_OK },
+    /* 1.2.840.113549.1.1.13 */
+    { CURL_ASN1_OBJECT_IDENTIFIER, "\x2A\x86\x48\x86\xF7\x0D\x01\x01\x0D", 9,
+      "sha512WithRSAEncryption", CURLE_OK },
+    /* 1.2.840.10040.4.2 */
+    { CURL_ASN1_OBJECT_IDENTIFIER, "\x2A\x86\x48\xCE\x38\x04\x02", 7,
+      "1.2.840.10040.4.2", CURLE_OK },
+    /* 2.16.840.1.101.3.4.2.3 */
+    { CURL_ASN1_OBJECT_IDENTIFIER, "\x60\x86\x48\x01\x65\x03\x04\x02\x03", 9,
+      "sha512", CURLE_OK },
+    /* 2.999 -> (2*40) + 999 = 1079. 1079 in VLQ is 0x88 0x37 */
+    { CURL_ASN1_OBJECT_IDENTIFIER, "\x88\x37\x03", 3, "2.999.3",
+      CURLE_OK },
+    /* 1.0 (Minimum possible OID length/value)
+       (1*40) + 0 = 40 (0x28) */
+    { CURL_ASN1_OBJECT_IDENTIFIER, "\x28", 1, "1.0", CURLE_OK },
+    /* Malformed (Incomplete multi-byte SID, MSB set but no following byte) */
+    { CURL_ASN1_OBJECT_IDENTIFIER, "\x88", 1, "",
+      CURLE_BAD_FUNCTION_ARGUMENT },
+
+    /* NULL */
+    { CURL_ASN1_NULL, "", 0, "", CURLE_OK },
+    { CURL_ASN1_NULL, "a", 1, "", CURLE_OK },
+    { CURL_ASN1_NULL, "aa", 2, "", CURLE_OK },
+
+    /* Octet string */
+    { CURL_ASN1_OCTET_STRING, "\x00\x00\x00\x04\x05", 5, "00:00:00:04:05:",
+      CURLE_OK },
+    { CURL_ASN1_OCTET_STRING, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+      "\xff\xff", 14, "", CURLE_TOO_LARGE},
+
+    /* Bit string. The first byte is number of unused bits. */
+    { CURL_ASN1_BIT_STRING, "\x00\x55", 2, "55:", CURLE_OK },
+    /* Invalid number of unused bits (> 7) */
+    { CURL_ASN1_BIT_STRING, "\x08\x55", 2, "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { CURL_ASN1_BIT_STRING, "\x00\xaa\x55", 3, "aa:55:", CURLE_OK },
+    { CURL_ASN1_BIT_STRING, "\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+      "\xff\xff", 15, "", CURLE_TOO_LARGE},
+    /* 3 unused bits, data 0xF0 (11110000)
+       The '0' at the end of 11110... are the unused bits. */
+    { CURL_ASN1_BIT_STRING, "\x03\xf0", 2, "f0:", CURLE_OK },
+
+    /* Integer */
+    { CURL_ASN1_INTEGER, "\x00", 1, "0", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\x01", 1, "1", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\x09", 1, "9", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\x0a", 1, "10", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\xb", 1, "11", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\x11", 1, "17", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\x7f", 1, "127", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\x80", 1, "-128", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\x81", 1, "-127", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\x82", 1, "-126", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\xff", 1, "-1", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\x27\x0f", 2, "9999", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\x27\x10", 2, "0x2710", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\x7f\x81", 2, "0x7f81", CURLE_OK },
+
+    /* sign-extended, would be -32385 in decimal */
+    { CURL_ASN1_INTEGER, "\x81\x7f", 2, "0xffff817f", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\xff\xff", 2, "-1", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\x00\x00", 2, "0", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\x01\x02\x03", 3, "0x10203", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\xff\x02\xff", 3, "0xffff02ff", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\x00\xff\x00", 3, "0xff00", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\x01\x02\x03\x04", 4, "0x1020304", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\xff\x02\x03\x04", 4, "0xff020304", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\x00\x00\x00\x04", 4, "4", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\x00\x00\x00\x04\x05", 5, "00:00:00:04:05:",
+      CURLE_OK },
+    { CURL_ASN1_INTEGER, "\xff\x00\x00\x04\x05", 5, "ff:00:00:04:05:",
+      CURLE_OK },
+    { CURL_ASN1_INTEGER, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff",
+      11, "ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+      "\xff", 12, "ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:", CURLE_OK },
+    { CURL_ASN1_INTEGER, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+      "\xff\xff", 14, "", CURLE_TOO_LARGE},
+    { CURL_ASN1_INTEGER, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+      "\xff\xff\xff", 15, "", CURLE_TOO_LARGE },
+    { CURL_ASN1_INTEGER, "", 0, "", CURLE_BAD_FUNCTION_ARGUMENT },
+    /* Leading zero required if the MSB of the next byte is 1 (to keep it
+       positive) */
+    { CURL_ASN1_INTEGER, "\x00\x80", 2, "128", CURLE_OK },
+
+    /* Enumerated works the same as Integer */
+    { CURL_ASN1_ENUMERATED, "\x00", 1, "0", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\x01", 1, "1", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\x09", 1, "9", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\x0a", 1, "10", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\xb", 1, "11", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\x11", 1, "17", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\x7f", 1, "127", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\x80", 1, "-128", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\xff", 1, "-1", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\x7f\x81", 2, "0x7f81", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\xff\xff", 2, "-1", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\x00\x00", 2, "0", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\x01\x02\x03", 3, "0x10203", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\xff\x02\xff", 3, "0xffff02ff", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\x00\xff\x00", 3, "0xff00", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\x01\x02\x03\x04", 4, "0x1020304", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\xff\x02\x03\x04", 4, "0xff020304", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\x00\x00\x00\x04", 4, "4", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\x00\x00\x00\x04\x05", 5, "00:00:00:04:05:",
+      CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\xff\x00\x00\x04\x05", 5, "ff:00:00:04:05:",
+      CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff",
+      11, "ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+      "\xff", 12, "ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:", CURLE_OK },
+    { CURL_ASN1_ENUMERATED, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+      "\xff\xff", 14, "", CURLE_TOO_LARGE},
+    { CURL_ASN1_ENUMERATED, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+      "\xff\xff\xff", 15, "", CURLE_TOO_LARGE },
+    { CURL_ASN1_ENUMERATED, "", 0, "", CURLE_BAD_FUNCTION_ARGUMENT },
+
+    /* Boolean */
+    { CURL_ASN1_BOOLEAN, "\xff", 1, "TRUE", CURLE_OK },
+    { CURL_ASN1_BOOLEAN, "\x01", 1, "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { CURL_ASN1_BOOLEAN, "\x02", 1, "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { CURL_ASN1_BOOLEAN, "\x00", 1, "FALSE", CURLE_OK },
+    { CURL_ASN1_BOOLEAN, "\x01\x01", 2, "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { CURL_ASN1_BOOLEAN, "\x00\x01", 2, "", CURLE_BAD_FUNCTION_ARGUMENT },
+    { CURL_ASN1_BOOLEAN, "", 0, "", CURLE_BAD_FUNCTION_ARGUMENT },
+  };
+
+  size_t i;
+  struct dynbuf dbuf;
+  bool all_ok = TRUE;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  /* the real code uses CURL_X509_STR_MAX for maximum size, but we set a
+     smaller one here so that we can test running into the limit a little
+     easier */
+  curlx_dyn_init(&dbuf, 40);
+
+  for(i = 0; i < CURL_ARRAYSIZE(test_specs); ++i) {
+    if(!test1667(&test_specs[i], i, &dbuf))
+      all_ok = FALSE;
+  }
+  fail_unless(all_ok, "some tests of ASN1tostr() failed");
+
+  curlx_dyn_free(&dbuf);
+  curl_global_cleanup();
+
+  UNITTEST_END_SIMPLE
+}
+
+#else
+
+static CURLcode test_unit1667(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+  puts("not tested since ASN1tostr() is not built in");
+  UNITTEST_END_SIMPLE
+}
+
+#endif
diff --git a/third-party/curl/tests/unit/unit1668.c b/third-party/curl/tests/unit/unit1668.c
new file mode 100644
index 0000000000..2c467b3c89
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1668.c
@@ -0,0 +1,177 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+
+#ifndef CURL_DISABLE_FTP
+
+struct test_1668 {
+  const char *in;
+  const char *out;
+  bool rc;
+};
+
+static bool test1668(const struct test_1668 *spec, size_t i)
+{
+  bool rc;
+  bool ok = TRUE;
+  int year = 0, month = 0, day = 0, hour = 0, minute = 0, second = 0;
+
+  rc = ftp_213_date(spec->in,
+                    &year, &month, &day, &hour, &minute, &second);
+
+  if(rc != spec->rc) {
+    curl_mfprintf(stderr, "test %zu: expected result %d, got %d for %s\n",
+                  i, spec->rc, rc, spec->in);
+    ok = FALSE;
+  }
+  else if(rc) {
+    char buffer[80];
+    curl_msnprintf(buffer, sizeof(buffer),
+                   "%04d-%02d-%02d %02d:%02d:%02d",
+                   year, month, day, hour, minute, second);
+    if(strcmp(buffer, spec->out)) {
+      curl_mfprintf(stderr,
+                    "test %zu: (from input %s) got '%s' expected '%s'\n", i,
+                    spec->in, buffer, spec->out);
+      ok = FALSE;
+    }
+  }
+
+  return ok;
+}
+
+static CURLcode test_unit1668(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  static const struct test_1668 test_specs[] = {
+    /* fractions are ignored, even when invalid */
+    { "19980320114234.123", "1998-03-20 11:42:34", TRUE },
+    { "19980320114234.000", "1998-03-20 11:42:34", TRUE },
+    { "19980320114234.aaa", "1998-03-20 11:42:34", TRUE },
+    { "19980320114234.999", "1998-03-20 11:42:34", TRUE },
+    { "19980320114234", "1998-03-20 11:42:34", TRUE },
+    { "09980320114234", "0998-03-20 11:42:34", TRUE },
+    { "10980320114234", "1098-03-20 11:42:34", TRUE },
+    { "19080320114234", "1908-03-20 11:42:34", TRUE },
+    { "19900320114234", "1990-03-20 11:42:34", TRUE },
+    /* invalid month is accepted */
+    { "19980020114234", "1998-00-20 11:42:34", TRUE },
+    /* invalid day is accepted */
+    { "19980300114234", "1998-03-00 11:42:34", TRUE },
+    { "19980320014234", "1998-03-20 01:42:34", TRUE },
+    { "19980320110234", "1998-03-20 11:02:34", TRUE },
+    { "19980320114204", "1998-03-20 11:42:04", TRUE },
+    { "19980320114230", "1998-03-20 11:42:30", TRUE },
+    /* not all invalid times are accepted */
+    { "19980320256565", "", FALSE },
+    { "19980320236565", "", FALSE },
+    { "19980320235865", "", FALSE },
+    /* invalid February is okay */
+    { "19980231114234", "1998-02-31 11:42:34", TRUE },
+    { ":9980231114234", "", FALSE },
+    { "a9980231114234", "", FALSE },
+    { "1:980231114234", "", FALSE },
+    { "1a980231114234", "", FALSE },
+    { "19:80231114234", "", FALSE },
+    { "19b80231114234", "", FALSE },
+    { "199:0231114234", "", FALSE },
+    { "199c0231114234", "", FALSE },
+    { "1998:231114234", "", FALSE },
+    { "1998d231114234", "", FALSE },
+    { "19980:31114234", "", FALSE },
+    { "19980e31114234", "", FALSE },
+    { "199802:1114234", "", FALSE },
+    { "199802f1114234", "", FALSE },
+    { "1998023:114234", "", FALSE },
+    { "1998023/114234", "", FALSE },
+    { "19980231:14234", "", FALSE },
+    { "19980231x14234", "", FALSE },
+    { "199802311:4234", "", FALSE },
+    { "199802311z4234", "", FALSE },
+    { "1998023111:234", "", FALSE },
+    { "1998023111&234", "", FALSE },
+    { "19980231114:34", "", FALSE },
+    { "19980231114#34", "", FALSE },
+    { "199802311142:4", "", FALSE },
+    { "199802311142!4", "", FALSE },
+    { "1998023111423:", "", FALSE },
+    { "1998023111423@", "", FALSE },
+
+    { "19980320114234--", "1998-03-20 11:42:34", TRUE },
+    { " 19980320114234", "", FALSE },
+    { "1998032011423", "", FALSE },
+    { "199803201142", "", FALSE },
+    { "19980320114", "", FALSE },
+    { "199803201", "", FALSE },
+    { "19980320", "", FALSE },
+    { "1998032", "", FALSE },
+    { "199803", "", FALSE },
+    { "19980", "", FALSE },
+    { "1998", "", FALSE },
+    { "199", "", FALSE },
+    { "19", "", FALSE },
+    { "1", "", FALSE },
+    { "", "", FALSE },
+    { "20260320114234.123", "2026-03-20 11:42:34", TRUE },
+    { "30260320114234.123", "3026-03-20 11:42:34", TRUE },
+    { "40260320114234.123", "4026-03-20 11:42:34", TRUE },
+    { "19980320114234\xff", "1998-03-20 11:42:34", TRUE },
+    { "1998\x7e""320114234\xff", "", FALSE },
+    { "1998\x7f""320114234\xff", "", FALSE },
+    { "1998\x80""320114234\xff", "", FALSE },
+    { "1998\x81""320114234\xff", "", FALSE },
+    { "1998\x82""320114234\xff", "", FALSE },
+    { "\xcc", "", FALSE },
+    { "\x55", "", FALSE },
+  };
+
+  size_t i;
+  bool all_ok = TRUE;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  for(i = 0; i < CURL_ARRAYSIZE(test_specs); ++i) {
+    if(!test1668(&test_specs[i], i))
+      all_ok = FALSE;
+  }
+  fail_unless(all_ok, "some tests of ftp_213_date() failed");
+  curl_global_cleanup();
+
+  UNITTEST_END_SIMPLE
+}
+
+#else /* without FTP */
+
+static CURLcode test_unit1668(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+  puts("not tested since FTP is disabled");
+  UNITTEST_END_SIMPLE
+}
+
+#endif
diff --git a/third-party/curl/tests/unit/unit1669.c b/third-party/curl/tests/unit/unit1669.c
new file mode 100644
index 0000000000..625e004084
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1669.c
@@ -0,0 +1,58 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+
+#include "urldata.h"
+#include "altsvc.h"
+
+static CURLcode test_unit1669(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_ALTSVC)
+  char outname[256];
+  CURL *curl;
+  CURLcode result;
+  struct altsvcinfo *asi = Curl_altsvc_init();
+  abort_if(!asi, "Curl_altsvc_init");
+  result = Curl_altsvc_load(asi, arg);
+  fail_if(result, "Curl_altsvc_load");
+  if(result)
+    goto fail;
+  curl_global_init(CURL_GLOBAL_ALL);
+  curl = curl_easy_init();
+  fail_if(!curl, "curl_easy_init");
+  if(!curl)
+    goto fail;
+  fail_unless(Curl_llist_count(&asi->list) == MAX_ALTSVC_ENTRIES,
+              "wrong number of entries");
+  curl_msnprintf(outname, sizeof(outname), "%s-out", arg);
+
+  curl_easy_cleanup(curl);
+fail:
+  Curl_altsvc_cleanup(&asi);
+#endif
+
+  UNITTEST_END(curl_global_cleanup())
+}
diff --git a/third-party/curl/tests/unit/unit1674.c b/third-party/curl/tests/unit/unit1674.c
new file mode 100644
index 0000000000..51870892fd
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1674.c
@@ -0,0 +1,85 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+
+#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_HSTS)
+
+#include "urldata.h"
+#include "hsts.h"
+
+/* create a HSTS file with lots of unique hostnames all using the same
+   fixed expire time */
+static void render_unit1674(const char *file)
+{
+  FILE *f = curlx_fopen(file, FOPEN_WRITETEXT);
+  size_t i;
+  if(!f)
+    return;
+  for(i = 0; i < (MAX_HSTS_ENTRIES + 5); i++) {
+    curl_mfprintf(f, "host%zu.readfrom.example \"20211001 04:47:41\"\n", i);
+  }
+  curlx_fclose(f);
+}
+
+static CURLcode test_unit1674(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  struct hsts *h = Curl_hsts_init();
+  CURL *easy;
+  char savename[256];
+
+  abort_unless(h, "Curl_hsts_init()");
+
+  render_unit1674(arg);
+
+  curl_global_init(CURL_GLOBAL_ALL);
+  easy = curl_easy_init();
+  if(!easy) {
+    Curl_hsts_cleanup(&h);
+    abort_unless(easy, "curl_easy_init()");
+  }
+
+  Curl_hsts_loadfile(easy, h, arg);
+
+  if(Curl_llist_count(&h->list) == MAX_HSTS_ENTRIES)
+    curl_mprintf("OK\n");
+  else
+    curl_mprintf("Number of entries: %zu\n", Curl_llist_count(&h->list));
+
+  curl_msnprintf(savename, sizeof(savename), "%s.save", arg);
+  (void)Curl_hsts_save(easy, h, savename);
+  Curl_hsts_cleanup(&h);
+  curl_easy_cleanup(easy);
+
+  UNITTEST_END(curl_global_cleanup())
+}
+#else
+static CURLcode test_unit1674(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+  puts("nothing to do when HTTP or HSTS are disabled");
+  UNITTEST_END_SIMPLE
+}
+#endif
diff --git a/third-party/curl/tests/unit/unit1675.c b/third-party/curl/tests/unit/unit1675.c
new file mode 100644
index 0000000000..7e869651d0
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1675.c
@@ -0,0 +1,443 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "urlapi-int.h"
+#include "curlx/dynbuf.h"
+
+static CURLcode test_unit1675(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  /* Test ipv4_normalize */
+  {
+    struct dynbuf host;
+    int fails = 0;
+    unsigned int i;
+    struct ipv4_test {
+      const char *in;
+      const char *out;
+    };
+    const struct ipv4_test tests[] = {
+      { "0x.0x.0x.0x", NULL }, /* invalid hex */
+      { "0x.0x.0x", NULL }, /* invalid hex */
+      { "0x.0x", NULL }, /* invalid hex */
+      { "0x", NULL }, /* invalid hex */
+      { "0", "0.0.0.0" },
+      { "00", "0.0.0.0" },
+      { "00000000000", "0.0.0.0" },
+      { "127.0.0.1", "127.0.0.1" },
+      { "0177.0.0.1", "127.0.0.1" },
+      { "00177.0.0.1", "127.0.0.1" },
+      { "0x7f.0.0.1", "127.0.0.1" },
+      { "0x07f.0.0.1", "127.0.0.1" },
+      { "1", "0.0.0.1" },
+      { "010", "0.0.0.8" },
+      { "001", "0.0.0.1" },
+      { "127", "0.0.0.127" },
+      { "127.1", "127.0.0.1" },
+      { "127.0.1", "127.0.0.1" },
+      { "1.16777215", "1.255.255.255" },
+      { "1.16777216", NULL }, /* overflow */
+      { "1.1.65535", "1.1.255.255" },
+      { "1.1.65536", NULL }, /* overflow */
+      { "0x7f000001", "127.0.0.1" },
+      { "0x7F000001", "127.0.0.1" },
+      { "0x7g000001", NULL }, /* bad hex */
+      { "2130706433", "127.0.0.1" },
+      { "017700000001", "127.0.0.1" },
+      { "000000000017700000001", "127.0.0.1" },
+      { "192.168.0.1", "192.168.0.1" },
+      { "0300.0250.0000.0001", "192.168.0.1" },
+      { "0xc0.0xa8.0.1", "192.168.0.1" },
+      { "0xc0a80001", "192.168.0.1" },
+      { "3232235521", "192.168.0.1" },
+      { "4294967294", "255.255.255.254" },
+      { "4294967295", "255.255.255.255" },
+      { "037777777777", "255.255.255.255" },
+      { "0xFFFFFFFF", "255.255.255.255" },
+      { "0xFFFFFfff", "255.255.255.255" },
+      { "1.2.3.4.5", NULL }, /* too many parts */
+      { "256.0.0.1", NULL }, /* overflow */
+      { "1.256.0.1", NULL }, /* overflow */
+      { "1.1.256.1", NULL }, /* overflow */
+      { "1.0.0.256", NULL }, /* overflow */
+      { "0x100.0.0.1", NULL }, /* overflow */
+      { "1.0x100.0.1", NULL }, /* overflow */
+      { "1.1.0x100.1", NULL }, /* overflow */
+      { "1.1.1.0x100", NULL }, /* overflow */
+      { "0400.0.0.1", NULL }, /* overflow */
+      { "4.0400.0.1", NULL }, /* overflow */
+      { "4.4.0400.1", NULL }, /* overflow */
+      { "4.4.4.0400", NULL }, /* overflow */
+      { "4294967296", NULL }, /* overflow */
+      { "040000000000", NULL }, /* overflow */
+      { "0x100000000", NULL }, /* overflow */
+      { "1.2.3.-4", NULL }, /* negative */
+      { "1.2.-3.4", NULL }, /* negative */
+      { "1.-2.3.4", NULL }, /* negative */
+      { "-1.2.3.4", NULL }, /* negative */
+      { "-12", NULL }, /* negative */
+      { "-12.1", NULL }, /* negative */
+      { "-12.2.3", NULL }, /* negative */
+      { " 1.2.3.4", NULL }, /* space */
+      { "1. 2.3.4", NULL }, /* space */
+      { "1.2. 3.4", NULL }, /* space */
+      { "1.2.3. 4", NULL }, /* space */
+    };
+
+    curlx_dyn_init(&host, 256);
+    for(i = 0; i < CURL_ARRAYSIZE(tests); i++) {
+      int rc;
+      curlx_dyn_reset(&host);
+      if(curlx_dyn_add(&host, tests[i].in)) {
+        curlx_dyn_free(&host);
+        return CURLE_OUT_OF_MEMORY;
+      }
+      rc = ipv4_normalize(&host);
+      if(tests[i].out) {
+        if((rc != HOST_IPV4) ||
+           strcmp(curlx_dyn_ptr(&host), tests[i].out)) {
+          curl_mfprintf(stderr, "ipv4_normalize('%s') failed: "
+                        "expected '%s', got '%s'\n",
+                        tests[i].in, tests[i].out, curlx_dyn_ptr(&host));
+          fails++;
+        }
+      }
+      else if(rc == HOST_IPV4) {
+        curl_mfprintf(stderr, "ipv4_normalize('%s') succeeded unexpectedly:"
+                      " got '%s'\n",
+                      tests[i].in, curlx_dyn_ptr(&host));
+        fails++;
+      }
+    }
+    curlx_dyn_free(&host);
+    abort_if(fails, "ipv4_normalize tests failed");
+  }
+
+  /* Test urlencode_str */
+  {
+    struct dynbuf out;
+    int fails = 0;
+    unsigned int i;
+    struct urlencode_test {
+      const char *in;
+      bool relative;
+      unsigned int query;
+      const char *out;
+    };
+    const struct urlencode_test tests[] = {
+      { "http://leave\x01/hello\x01world", FALSE, QUERY_NO,
+        "http://leave\x01/hello%01world" },
+      { "http://leave/hello\x01world", FALSE, QUERY_NO,
+        "http://leave/hello%01world" },
+      { "http://le ave/hello\x01world", FALSE, QUERY_NO,
+        "http://le ave/hello%01world" },
+      { "hello\x01world", TRUE, QUERY_NO, "hello%01world" },
+      { "hello\xf0world", TRUE, QUERY_NO, "hello%F0world" },
+      { "hello world", TRUE, QUERY_NO, "hello%20world" },
+      { "hello%20world", TRUE, QUERY_NO, "hello%20world" },
+      { "hello world", TRUE, QUERY_YES, "hello+world" },
+      { "a+b c", TRUE, QUERY_NO, "a+b%20c" },
+      { "a%20b%20c", TRUE, QUERY_NO, "a%20b%20c" },
+      { "a%aab%aac", TRUE, QUERY_NO, "a%AAb%AAc" },
+      { "a%aab%AAc", TRUE, QUERY_NO, "a%AAb%AAc" },
+      { "w%w%x", TRUE, QUERY_NO, "w%w%x" },
+      { "w%wf%xf", TRUE, QUERY_NO, "w%wf%xf" },
+      { "w%fw%fw", TRUE, QUERY_NO, "w%fw%fw" },
+      { "a+b c", TRUE, QUERY_YES, "a+b+c" },
+      { "/foo/bar", TRUE, QUERY_NO, "/foo/bar" },
+      { "/foo/bar", TRUE, QUERY_YES, "/foo/bar" },
+      { "/foo/ bar", TRUE, QUERY_NO, "/foo/%20bar" },
+      { "/foo/ bar", TRUE, QUERY_YES, "/foo/+bar" },
+      { "~-._", TRUE, QUERY_NO, "~-._" },
+      { "~-._", TRUE, QUERY_YES, "~-._" },
+      { "foo bar?foo bar", TRUE, QUERY_NO, "foo%20bar?foo%20bar" },
+      { "foo bar?foo bar", TRUE, QUERY_NOT_YET, "foo%20bar?foo+bar" },
+    };
+
+    curlx_dyn_init(&out, 256);
+    for(i = 0; i < CURL_ARRAYSIZE(tests); i++) {
+      CURLUcode uc;
+      curlx_dyn_reset(&out);
+      uc = urlencode_str(&out, tests[i].in, strlen(tests[i].in),
+                         tests[i].relative, tests[i].query);
+      if(uc || strcmp(curlx_dyn_ptr(&out), tests[i].out)) {
+        curl_mfprintf(stderr, "urlencode_str('%s', query=%u) failed:"
+                      " expected '%s', got '%s'\n",
+                      tests[i].in, tests[i].query, tests[i].out,
+                      uc ? "error" : curlx_dyn_ptr(&out));
+        fails++;
+      }
+    }
+    curlx_dyn_free(&out);
+    abort_if(fails, "urlencode_str tests failed");
+  }
+
+  /* Test ipv6_parse */
+  {
+    struct Curl_URL u;
+    int fails = 0;
+    unsigned int i;
+    struct ipv6_test {
+      const char *in;
+      const char *out_host;
+      const char *out_zone;
+    };
+    const struct ipv6_test tests[] = {
+      { "[::1]", "[::1]", NULL },
+      { "[fe80::1%eth0]", "[fe80::1]", "eth0" },
+      { "[fe80::1%25eth0]", "[fe80::1]", "eth0" },
+      { "[::1", NULL, NULL }, /* missing bracket */
+      { "[]", NULL, NULL }, /* empty */
+    };
+
+    for(i = 0; i < CURL_ARRAYSIZE(tests); i++) {
+      CURLUcode uc;
+      char hostname[256];
+      memset(&u, 0, sizeof(u));
+      curlx_strcopy(hostname, sizeof(hostname),
+                    tests[i].in, strlen(tests[i].in));
+      uc = ipv6_parse(&u, hostname, strlen(hostname));
+      if(tests[i].out_host) {
+        if(uc || strcmp(hostname, tests[i].out_host)) {
+          curl_mfprintf(stderr, "ipv6_parse('%s') host failed:"
+                        " expected '%s', got '%s'\n",
+                        tests[i].in, tests[i].out_host,
+                        uc ? "error" : hostname);
+          fails++;
+        }
+        if(!uc && tests[i].out_zone) {
+          if(!u.zoneid || strcmp(u.zoneid, tests[i].out_zone)) {
+            curl_mfprintf(stderr, "ipv6_parse('%s') zone failed:"
+                          " expected '%s', got '%s'\n",
+                          tests[i].in, tests[i].out_zone,
+                          u.zoneid ? u.zoneid : "(null)");
+            fails++;
+          }
+        }
+      }
+      else if(!uc) {
+        curl_mfprintf(stderr, "ipv6_parse('%s') succeeded unexpectedly\n",
+                      tests[i].in);
+        fails++;
+      }
+      curlx_free(u.host);
+      curlx_free(u.zoneid);
+    }
+    abort_if(fails, "ipv6_parse tests failed");
+  }
+
+  /* Test parse_file */
+  {
+    CURLU *u;
+    const char *path;
+    size_t pathlen;
+    int fails = 0;
+    unsigned int i;
+    struct file_test {
+      const char *in;
+      const char *out_path;
+      bool fine;
+    };
+    const struct file_test tests[] = {
+      { "file:///etc/hosts", "/etc/hosts", TRUE },
+      { "file://localhost/etc/hosts", "/etc/hosts", TRUE },
+      { "file://apple/etc/hosts", "/etc/hosts", FALSE },
+      { "file:foo", NULL, FALSE },
+      { "file:./", NULL, FALSE },
+      { "file:?q", NULL, FALSE },
+      { "file:#f", NULL, FALSE },
+#ifdef _WIN32
+      { "file:///c:/windows/system32", "c:/windows/system32", TRUE },
+      { "file://localhost/c:/windows/system32", "c:/windows/system32", TRUE },
+#endif
+    };
+
+    for(i = 0; i < CURL_ARRAYSIZE(tests); i++) {
+      CURLUcode uc;
+      u = curl_url();
+      if(!u)
+        return CURLE_OUT_OF_MEMORY;
+
+      uc = parse_file(tests[i].in, strlen(tests[i].in), u, &path, &pathlen);
+      if(!tests[i].fine && !uc) {
+        curl_mfprintf(stderr, "Unexpectedly fine for input '%s'\n",
+                      tests[i].in);
+        fails++;
+      }
+      if(tests[i].fine &&
+         (uc ||
+          strncmp(path, tests[i].out_path, pathlen) ||
+          strlen(tests[i].out_path) != pathlen)) {
+        curl_mfprintf(stderr, "parse_file('%s') failed:"
+                      " expected path '%s'; got path '%.*s'\n",
+                      tests[i].in, tests[i].out_path,
+                      (int)pathlen, path);
+        fails++;
+      }
+      curl_url_cleanup(u);
+    }
+    abort_if(fails, "parse_file tests failed");
+  }
+
+  /* Test same origin check. For now, we can only do that when
+   * schemes are supported by libcurl. */
+#ifndef CURL_DISABLE_HTTP
+  {
+    CURLU *base, *href;
+    int fails = 0;
+    unsigned int i;
+    bool match;
+    struct origin_test {
+      const char *base;
+      const char *scheme;
+      const char *host;
+      const char *port;
+      const char *path;
+      bool expect_match;
+    };
+    const struct origin_test tests[] = {
+      { "http://host:123/x", "http", "host", "123", "/y", TRUE },
+      { "http://host:123/x", NULL, "host", "123", "/y", TRUE },
+      { "http://host:123/x", NULL, NULL, NULL, "/y", TRUE },
+      { "http://host:80/x", "http", "host", "123", "/y", FALSE },
+      { "http://host:80/x", "http", "host", NULL, "/y", TRUE },
+      { "http://host/x", "http", "host", "80", "/y", TRUE },
+#ifdef USE_SSL
+      { "http://host:123/x", "https", "host", "123", "/y", FALSE },
+      { "https://host/x", "http", "host", "443", "/y", FALSE },
+      { "https://host/x", "https", "host", "443", "/y", TRUE },
+#endif
+    };
+
+    for(i = 0; i < CURL_ARRAYSIZE(tests); i++) {
+      CURLUcode uc;
+      base = curl_url();
+      href = curl_url();
+      if(!base || !href) {
+        curl_mfprintf(stderr, "%u: failed to allocate memory\n", i);
+        fails++;
+        goto loop_end;
+      }
+      uc = curl_url_set(base, CURLUPART_URL, tests[i].base, 0);
+      if(uc) {
+        curl_mfprintf(stderr, "failed to parse %u base %s -> %d\n", i,
+                      tests[i].base, (int)uc);
+        fails++;
+        goto loop_end;
+      }
+      if(tests[i].scheme)
+        uc = curl_url_set(href, CURLUPART_SCHEME, tests[i].scheme, 0);
+      if(!uc && tests[i].host)
+        uc = curl_url_set(href, CURLUPART_HOST, tests[i].host, 0);
+      if(!uc && tests[i].port)
+        uc = curl_url_set(href, CURLUPART_PORT, tests[i].port, 0);
+      if(!uc && tests[i].path)
+        uc = curl_url_set(href, CURLUPART_PATH, tests[i].path, 0);
+      if(uc) {
+        curl_mfprintf(stderr, "failed to parse %u href %s://%s:%s%s -> %d\n",
+                      i, tests[i].scheme, tests[i].host, tests[i].port,
+                      tests[i].path, (int)uc);
+        fails++;
+        goto loop_end;
+      }
+
+      match = Curl_url_same_origin(base, href);
+      if(match != tests[i].expect_match) {
+        curl_mfprintf(stderr, "ERROR: %u base %s and href %s://%s:%s%s %s\n",
+                      i, tests[i].base, tests[i].scheme, tests[i].host,
+                      tests[i].port, tests[i].path,
+                      match ? "matched" : "did not match");
+        fails++;
+      }
+
+loop_end:
+      curl_url_cleanup(base);
+      curl_url_cleanup(href);
+    }
+    abort_if(fails, "same_origin tests failed");
+  }
+#endif /* !CURL_DISABLE_HTTP */
+
+  /* Test parse_hostname_login */
+  {
+    struct Curl_URL u;
+    int fails = 0;
+    unsigned int i;
+    struct test {
+      CURLUcode uc;
+      const char *in;
+      const char *scheme;
+      unsigned int flags;
+      const char *user;
+      const char *password;
+      const char *options;
+      size_t offset;
+    };
+    const struct test tests[] = {
+      { CURLUE_OK, "foo:bar@host", NULL, 0, "foo", "bar", "o", 8 },
+      { CURLUE_OK, "foo:bar;abc@host", "imap", 0, "foo", "bar", "abc", 12 },
+      { CURLUE_OK, "foo:bar;abc@host", NULL, 0, "foo", "bar;abc", "o", 12 },
+      { CURLUE_USER_NOT_ALLOWED, "foo:bar@host", NULL, CURLU_DISALLOW_USER,
+        NULL, NULL, NULL, 0 },
+      { CURLUE_OK, "host", NULL, 0, NULL, NULL, NULL, 0 },
+    };
+
+    for(i = 0; i < CURL_ARRAYSIZE(tests); i++) {
+      CURLUcode uc;
+      size_t offset = 0;
+      memset(&u, 0, sizeof(u));
+      u.scheme = CURL_UNCONST(tests[i].scheme);
+      u.user = curlx_strdup("u");
+      u.password = curlx_strdup("p");
+      u.options = curlx_strdup("o");
+      uc = parse_hostname_login(&u, tests[i].in, strlen(tests[i].in),
+                                tests[i].flags, &offset);
+      if(uc != tests[i].uc ||
+         !!u.user != !!tests[i].user ||
+         (u.user && tests[i].user &&
+          strcmp(u.user, tests[i].user)) ||
+         !!u.password != !!tests[i].password ||
+         (u.password && tests[i].password &&
+          strcmp(u.password, tests[i].password)) ||
+         !!u.options != !!tests[i].options ||
+         (u.options && tests[i].options &&
+          strcmp(u.options, tests[i].options)) ||
+         offset != tests[i].offset) {
+        curl_mfprintf(stderr, "%u: parse_hostname_login('%s') host failed:"
+                      " expected '%d/%s/%s/%s/%zu', got '%d/%s/%s/%s/%zu'\n",
+                      i, tests[i].in, (int)tests[i].uc, tests[i].user,
+                      tests[i].password, tests[i].options, tests[i].offset,
+                      (int)uc, u.user, u.password, u.options, offset);
+        fails++;
+      }
+      curlx_safefree(u.user);
+      curlx_safefree(u.password);
+      curlx_safefree(u.options);
+    }
+    abort_if(fails, "parse_hostname_login tests failed");
+  }
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit1676.c b/third-party/curl/tests/unit/unit1676.c
new file mode 100644
index 0000000000..5f33f9f285
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1676.c
@@ -0,0 +1,119 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "vtls/x509asn1.h"
+#include "vtls/vtls.h"
+
+static CURLcode test_unit1676(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+#if defined(USE_GNUTLS) || defined(USE_MBEDTLS) || defined(USE_RUSTLS) || \
+  defined(USE_SCHANNEL)
+
+  /*
+   * Minimal DER-encoded X.509 certificate with a DH public key.
+   * Hand-crafted to exercise the do_pubkey() dhpublicnumber branch.
+   *
+   * The DH parameters contain two distinct INTEGER values:
+   *   p = 0x11 (renders as "17" via int2str decimal format)
+   *   g = 0x22 (renders as "34")
+   * The public key value is:
+   *   pub_key = 0x33 (renders as "51")
+   *
+   * OID 1.2.840.10046.2.1 = dhpublicnumber
+   */
+  static const unsigned char cert[] = {
+    0x30, 0x81, 0x85, 0x30, 0x72, 0xA0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x01,
+    0x01, 0x30, 0x0B, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01,
+    0x01, 0x0B, 0x30, 0x0F, 0x31, 0x0D, 0x30, 0x0B, 0x06, 0x03, 0x55, 0x04,
+    0x03, 0x0C, 0x04, 0x74, 0x65, 0x73, 0x74, 0x30, 0x1E, 0x17, 0x0D, 0x32,
+    0x35, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5A,
+    0x17, 0x0D, 0x32, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30,
+    0x30, 0x30, 0x5A, 0x30, 0x0F, 0x31, 0x0D, 0x30, 0x0B, 0x06, 0x03, 0x55,
+    0x04, 0x03, 0x0C, 0x04, 0x74, 0x65, 0x73, 0x74, 0x30, 0x19, 0x30, 0x11,
+    0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3E, 0x02, 0x01, 0x30, 0x06, 0x02,
+    0x01, 0x11, 0x02, 0x01, 0x22, 0x03, 0x04, 0x00, 0x02, 0x01, 0x33, 0x30,
+    0x0B, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0B,
+    0x03, 0x02, 0x00, 0xFF
+  };
+
+  CURLcode result;
+  const char *beg = (const char *)&cert[0];
+  const char *end = (const char *)&cert[sizeof(cert)];
+  struct Curl_easy *data;
+  struct curl_slist *slist;
+  const char *dhp_value = NULL;
+  const char *dhg_value = NULL;
+  const char *dhpk_value = NULL;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  data = curl_easy_init();
+  if(!data) {
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  data->set.ssl.certinfo = 1;
+  result = Curl_ssl_init_certinfo(data, 1);
+  if(result) {
+    curl_easy_cleanup(data);
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  result = Curl_extract_certinfo(data, 0, beg, end);
+  fail_unless(result == CURLE_OK, "Curl_extract_certinfo returned error");
+  if(result == CURLE_OK) {
+    /* Walk certinfo entries to find dh(p), dh(g), and dh(pub_key) */
+    for(slist = data->info.certs.certinfo[0]; slist; slist = slist->next) {
+      if(!strncmp(slist->data, "dh(p):", 6))
+        dhp_value = slist->data + 6;
+      else if(!strncmp(slist->data, "dh(g):", 6))
+        dhg_value = slist->data + 6;
+      else if(!strncmp(slist->data, "dh(pub_key):", 12))
+        dhpk_value = slist->data + 12;
+    }
+
+    abort_unless(dhp_value, "dh(p) not found in certinfo");
+    abort_unless(dhg_value, "dh(g) not found in certinfo");
+    abort_unless(dhpk_value, "dh(pub_key) not found in certinfo");
+    fail_if(!strcmp(dhp_value, dhg_value),
+            "dh(p) and dh(g) have the same value (bug: g re-reads p)");
+    fail_unless(!strcmp(dhp_value, "17"), "dh(p) expected 17 (0x11)");
+    fail_unless(!strcmp(dhg_value, "34"), "dh(g) expected 34 (0x22)");
+    fail_unless(!strcmp(dhpk_value, "51"), "dh(pub_key) expected 51 (0x33)");
+  }
+
+  curl_easy_cleanup(data);
+  curl_global_cleanup();
+#else
+  puts("not tested since Curl_extract_certinfo() is not built in");
+#endif
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit1979.c b/third-party/curl/tests/unit/unit1979.c
new file mode 100644
index 0000000000..76e65fb70b
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1979.c
@@ -0,0 +1,142 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "http_aws_sigv4.h"
+
+static CURLcode test_unit1979(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_AWS)
+  struct testcase {
+    const char *testname;
+    const bool normalize;
+    const char *url_part;
+    const char *canonical_url;
+  };
+
+  static const struct testcase testcases[] = {
+    {
+      "test-equals-encode",
+      TRUE,
+      "/a=b",
+      "/a%3Db"
+    },
+    {
+      "test-equals-noencode",
+      FALSE,
+      "/a=b",
+      "/a=b"
+    },
+    {
+      "test-s3-tables",
+      TRUE,
+      "/tables/arn%3Aaws%3As3tables%3Aus-east-1%3A022954301426%3Abucket%2Fja"
+      "soehartablebucket/jasoeharnamespace/jasoehartable/encryption",
+      "/tables/arn%253Aaws%253As3tables%253Aus-east-1%253A022954301426%253Ab"
+      "ucket%252Fjasoehartablebucket/jasoeharnamespace/jasoehartable/encrypt"
+      "ion"
+    },
+    {
+      "get-vanilla",
+      TRUE,
+      "/",
+      "/"
+    },
+    {
+      "get-unreserved",
+      TRUE,
+      "/-._~0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",
+      "/-._~0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+    },
+    {
+      "get-slashes-unnormalized",
+      FALSE,
+      "//example//",
+      "//example//"
+    },
+    {
+      "get-space-normalized",
+      TRUE,
+      "/example space/",
+      "/example%20space/"
+    },
+    {
+      "get-plus-normalized",
+      TRUE,
+      "/example+space/",
+      "/example%2Bspace/"
+    },
+    {
+      "get-slash-dot-slash-unnormalized",
+      FALSE,
+      "/./",
+      "/./"
+    },
+    {
+      "get-slash-unnormalized",
+      FALSE,
+      "//",
+      "//"
+    },
+    {
+      "get-relative-relative-unnormalized",
+      FALSE,
+      "/example1/example2/../..",
+      "/example1/example2/../.."
+    }
+  };
+
+  size_t i;
+
+  for(i = 0; i < CURL_ARRAYSIZE(testcases); i++) {
+    struct dynbuf canonical_path;
+
+    char buffer[1024];
+    const char *canonical_path_string;
+    int result;
+    int msnprintf_result;
+
+    curlx_dyn_init(&canonical_path, CURL_MAX_HTTP_HEADER);
+
+    result = canon_path(testcases[i].url_part, strlen(testcases[i].url_part),
+                        &canonical_path, testcases[i].normalize);
+    canonical_path_string = curlx_dyn_ptr(&canonical_path);
+    msnprintf_result = curl_msnprintf(buffer, sizeof(buffer),
+                                      "%s: Received \"%s\" "
+                                      "and should be \"%s\", normalize (%d)",
+                                      testcases[i].testname,
+                                      curlx_dyn_ptr(&canonical_path),
+                                      testcases[i].canonical_url,
+                                      testcases[i].normalize);
+    fail_unless(msnprintf_result >= 0, "curl_msnprintf fails");
+    fail_unless(!result && canonical_path_string &&
+                  !strcmp(canonical_path_string, testcases[i].canonical_url),
+                buffer);
+    curlx_dyn_free(&canonical_path);
+  }
+#endif /* !CURL_DISABLE_HTTP && !CURL_DISABLE_AWS */
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit1980.c b/third-party/curl/tests/unit/unit1980.c
new file mode 100644
index 0000000000..c15e11cb88
--- /dev/null
+++ b/third-party/curl/tests/unit/unit1980.c
@@ -0,0 +1,117 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "http_aws_sigv4.h"
+
+static CURLcode test_unit1980(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_AWS)
+  struct testcase {
+    const char *testname;
+    const char *query_part;
+    const char *canonical_query;
+  };
+
+  static const struct testcase testcases[] = {
+    {
+      "no-value",
+      "Param1=",
+      "Param1="
+    },
+    {
+      "test-439",
+      "name=me&noval&aim=b%aad&weirdo=*.//-",
+      "aim=b%AAd&name=me&noval=&weirdo=%2A.%2F%2F-"
+    },
+    {
+      "blank-query-params",
+      "hello=a&b&c=&d",
+      "b=&c=&d=&hello=a"
+    },
+    {
+      "get-vanilla-query-order-key-case",
+      "Param2=value2&Param1=value1",
+      "Param1=value1&Param2=value2"
+    },
+    {
+      "get-vanilla-query-unreserved",
+      "-._~0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz="
+      "-._~0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",
+      "-._~0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz="
+      "-._~0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+    },
+    {
+      "get-vanilla-empty-query-key",
+      "Param1=value1",
+      "Param1=value1"
+    },
+    {
+      "get-vanilla-query-order-encoded",
+      "Param-3=Value3&Param=Value2&%E1%88%B4=Value1",
+      "%E1%88%B4=Value1&Param=Value2&Param-3=Value3"
+    },
+    {
+      "space-plus",
+      "p3= &p1=+&p2=%20",
+      "p1=%20&p2=%20&p3=%20"
+    },
+    {
+      "2b-incoming",
+      "p3=%2b&p1=+",
+      "p1=%20&p3=%2B"
+    },
+  };
+
+  size_t i;
+
+  for(i = 0; i < CURL_ARRAYSIZE(testcases); i++) {
+    struct dynbuf canonical_query;
+
+    char buffer[1024];
+    const char *canonical_query_ptr;
+    int result;
+    int msnprintf_result;
+
+    curlx_dyn_init(&canonical_query, CURL_MAX_HTTP_HEADER);
+
+    result = canon_query(testcases[i].query_part, &canonical_query);
+    canonical_query_ptr = curlx_dyn_ptr(&canonical_query);
+    msnprintf_result = curl_msnprintf(buffer, sizeof(buffer),
+                                      "%s: Received \"%s\" "
+                                      "and should be \"%s\"",
+                                      testcases[i].testname,
+                                      canonical_query_ptr,
+                                      testcases[i].canonical_query);
+    fail_unless(msnprintf_result >= 0, "curl_msnprintf fails");
+    fail_unless(!result && canonical_query_ptr &&
+                  !strcmp(canonical_query_ptr, testcases[i].canonical_query),
+                buffer);
+    curlx_dyn_free(&canonical_query);
+  }
+#endif /* !CURL_DISABLE_HTTP && !CURL_DISABLE_AWS */
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit2413.c b/third-party/curl/tests/unit/unit2413.c
new file mode 100644
index 0000000000..a800971ae1
--- /dev/null
+++ b/third-party/curl/tests/unit/unit2413.c
@@ -0,0 +1,112 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "urldata.h"
+
+static CURLcode test_create2413(const char *name,
+                                CURL *curl,
+                                const struct Curl_scheme *scheme,
+                                const char *hostname,
+                                uint16_t port,
+                                const char *exp_hostname,
+                                bool exp_ipv6,
+                                const char *exp_zoneid)
+{
+  struct Curl_peer *peer = NULL;
+  CURLcode result;
+
+  result = Curl_peer_create((struct Curl_easy *)curl,
+                            scheme, hostname, port, &peer);
+  if(result) {
+    curl_mfprintf(stderr, "%s: create failed %d", name, (int)result);
+    goto out;
+  }
+
+  result = CURLE_FAILED_INIT;
+  if(peer->scheme != scheme) {
+    curl_mfprintf(stderr, "%s: has wrong scheme", name);
+  }
+  else if(!curl_strequal(peer->user_hostname, hostname)) {
+    curl_mfprintf(stderr, "%s: user_hostname=%s, expected %s", name,
+                  peer->user_hostname, exp_hostname);
+  }
+  else if(exp_hostname && !curl_strequal(peer->hostname, exp_hostname))
+    curl_mfprintf(stderr, "%s: hostname=%s, expected %s", name,
+                  peer->hostname, exp_hostname);
+  else if(peer->port != port)
+    curl_mfprintf(stderr, "%s: port=%u, expected %u", name,
+                  peer->port, port);
+  else if((bool)peer->ipv6 != exp_ipv6)
+    curl_mfprintf(stderr, "%s: ipv6=%d, expected %d", name,
+                  peer->ipv6, exp_ipv6);
+  else if(exp_zoneid &&
+          (!peer->zoneid || !curl_strequal(exp_zoneid, peer->zoneid)))
+    curl_mfprintf(stderr, "%s: zoneid=%s, expected %s", name,
+                  peer->zoneid, exp_zoneid);
+  else if(!exp_zoneid && peer->zoneid)
+    curl_mfprintf(stderr, "%s: zoneid=%s, expected nothing", name,
+                  peer->zoneid);
+  else
+    result = CURLE_OK;
+
+out:
+  Curl_peer_unlink(&peer);
+  fail_unless(!result, "check failed");
+  return result;
+}
+
+static CURLcode test_unit2413(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+  CURL *curl;
+  struct Curl_peer *peer = NULL;
+
+  curl_global_init(CURL_GLOBAL_ALL);
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_global_cleanup();
+    goto unit_test_abort;
+  }
+
+  test_create2413("peer1", curl, &Curl_scheme_https, "test.curl.se", 1234,
+                            "test.curl.se", FALSE, NULL);
+  test_create2413("peer2", curl, &Curl_scheme_https, "127.0.0.1", 1234,
+                            "127.0.0.1", FALSE, NULL);
+  test_create2413("peer3", curl, &Curl_scheme_https, "::1", 1234,
+                            "::1", TRUE, NULL);
+  test_create2413("peer3", curl, &Curl_scheme_https, "[::1]", 1234,
+                            "::1", TRUE, NULL);
+  test_create2413("peer4", curl, &Curl_scheme_https, "test.curl.se.", 1234,
+                            "test.curl.se.", FALSE, NULL);
+  test_create2413("peer5", curl, &Curl_scheme_https, "[::1%tada]", 1234,
+                            "::1", TRUE, "tada");
+  test_create2413("peer6", curl, &Curl_scheme_https, "::1%tada", 1234,
+                            "::1", TRUE, "tada");
+
+  curl_easy_cleanup(curl);
+  Curl_peer_unlink(&peer);
+  curl_global_cleanup();
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit2600.c b/third-party/curl/tests/unit/unit2600.c
index 7b86bb7fb8..a8affbb9eb 100644
--- a/third-party/curl/tests/unit/unit2600.c
+++ b/third-party/curl/tests/unit/unit2600.c
@@ -21,7 +21,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
+#include "unitcheck.h"
 
 #ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
@@ -40,57 +40,42 @@
 #include <inet.h>
 #endif
 
-#ifdef HAVE_SETJMP_H
-#include <setjmp.h>
-#endif
-#ifdef HAVE_SIGNAL_H
-#include <signal.h>
-#endif
-
 #include "urldata.h"
 #include "connect.h"
 #include "cfilters.h"
+#include "cf-ip-happy.h"
 #include "multiif.h"
+#include "select.h"
+#include "sockaddr.h"
+#include "curl_addrinfo.h"
 #include "curl_trc.h"
 
-/* copied from hostip.c to switch using SIGALARM for timeouts.
- * SIGALARM has only seconds resolution, so our tests will not work
- * here. */
-#if defined(CURLRES_SYNCH) && \
-    defined(HAVE_ALARM) && defined(SIGALRM) && defined(HAVE_SIGSETJMP)
-#define USE_ALARM_TIMEOUT
-#endif
-
-
-static CURL *easy;
-
-static CURLcode unit_setup(void)
+static CURLcode t2600_setup(CURL **easy)
 {
-  CURLcode res = CURLE_OK;
+  CURLcode result = CURLE_OK;
 
   global_init(CURL_GLOBAL_ALL);
-  easy = curl_easy_init();
-  if(!easy) {
+  *easy = curl_easy_init();
+  if(!*easy) {
     curl_global_cleanup();
     return CURLE_OUT_OF_MEMORY;
   }
-  curl_easy_setopt(easy, CURLOPT_VERBOSE, 1L);
-  return res;
+  curl_global_trace("all");
+  curl_easy_setopt(*easy, CURLOPT_VERBOSE, 1L);
+  return result;
 }
 
-static void unit_stop(void)
+static void t2600_stop(CURL *easy)
 {
   curl_easy_cleanup(easy);
   curl_global_cleanup();
 }
 
-#ifdef DEBUGBUILD
-
 struct test_case {
   int id;
   const char *url;
   const char *resolve_info;
-  unsigned char ip_version;
+  long ip_version;
   timediff_t connect_timeout_ms;
   timediff_t he_timeout_ms;
   timediff_t cf4_fail_delay_ms;
@@ -100,8 +85,9 @@ struct test_case {
   int exp_cf6_creations;
   timediff_t min_duration_ms;
   timediff_t max_duration_ms;
-  CURLcode exp_result;
+  CURLcode result_exp;
   const char *pref_family;
+  uint32_t max_concurrent;
 };
 
 struct ai_family_stats {
@@ -117,14 +103,18 @@ struct test_result {
   struct curltime ended;
   struct ai_family_stats cf4;
   struct ai_family_stats cf6;
+  uint32_t max_concurrent;
+  uint32_t ongoing;
 };
 
-static struct test_case *current_tc;
+static const struct test_case *current_tc;
 static struct test_result *current_tr;
+static int test_idx;
 
 struct cf_test_ctx {
+  int idx;
   int ai_family;
-  int transport;
+  uint8_t transport_peer;
   char id[16];
   struct curltime started;
   timediff_t fail_delay_ms;
@@ -134,78 +124,97 @@ struct cf_test_ctx {
 static void cf_test_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
 {
   struct cf_test_ctx *ctx = cf->ctx;
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-  infof(data, "%04dms: cf[%s] destroyed",
-       (int)Curl_timediff(Curl_now(), current_tr->started), ctx->id);
-#else
-  (void)data;
-#endif
-  free(ctx);
+  current_tr->ongoing--;
+  infof(data, "%04dms: cf[%s] destroyed, now %u ongoing",
+        (int)curlx_timediff_ms(curlx_now(), current_tr->started),
+        ctx->id, current_tr->ongoing);
+  curlx_free(ctx);
   cf->ctx = NULL;
 }
 
 static CURLcode cf_test_connect(struct Curl_cfilter *cf,
                                 struct Curl_easy *data,
-                                bool blocking, bool *done)
+                                bool *done)
 {
   struct cf_test_ctx *ctx = cf->ctx;
   timediff_t duration_ms;
 
   (void)data;
-  (void)blocking;
   *done = FALSE;
-  duration_ms = Curl_timediff(Curl_now(), ctx->started);
+  duration_ms = curlx_timediff_ms(curlx_now(), ctx->started);
   if(duration_ms >= ctx->fail_delay_ms) {
     infof(data, "%04dms: cf[%s] fail delay reached",
-         (int)duration_ms, ctx->id);
+          (int)duration_ms, ctx->id);
     return CURLE_COULDNT_CONNECT;
   }
-  if(duration_ms)
+  if(duration_ms) {
     infof(data, "%04dms: cf[%s] continuing", (int)duration_ms, ctx->id);
-  Curl_expire(data, ctx->fail_delay_ms - duration_ms, EXPIRE_RUN_NOW);
+    curlx_wait_ms(10);
+  }
+  Curl_expire(data, ctx->fail_delay_ms - duration_ms, EXPIRE_TIMEOUT);
   return CURLE_OK;
 }
 
-static struct Curl_cftype cft_test = {
-  "TEST",
-  CF_TYPE_IP_CONNECT,
-  CURL_LOG_LVL_NONE,
-  cf_test_destroy,
-  cf_test_connect,
-  Curl_cf_def_close,
-  Curl_cf_def_get_host,
-  Curl_cf_def_get_select_socks,
-  Curl_cf_def_data_pending,
-  Curl_cf_def_send,
-  Curl_cf_def_recv,
-  Curl_cf_def_cntrl,
-  Curl_cf_def_conn_is_alive,
-  Curl_cf_def_conn_keep_alive,
-  Curl_cf_def_query,
-};
+static CURLcode cf_test_adjust_pollset(struct Curl_cfilter *cf,
+                                       struct Curl_easy *data,
+                                       struct easy_pollset *ps)
+{
+  struct cf_test_ctx *ctx = cf->ctx;
+  /* for testing, give one socket with events back */
+  return Curl_pollset_set(data, ps, ctx->idx, TRUE, TRUE);
+}
 
 static CURLcode cf_test_create(struct Curl_cfilter **pcf,
                                struct Curl_easy *data,
+                               struct Curl_peer *origin,
+                               struct Curl_peer *peer,
+                               uint8_t transport_peer,
                                struct connectdata *conn,
-                               const struct Curl_addrinfo *ai,
-                               int transport)
+                               struct Curl_sockaddr_ex *addr,
+                               struct Curl_peer *tunnel_peer,
+                               uint8_t transport_above)
 {
+  static const struct Curl_cftype cft_test = {
+    "TEST",
+    CF_TYPE_IP_CONNECT,
+    CURL_LOG_LVL_NONE,
+    cf_test_destroy,
+    cf_test_connect,
+    Curl_cf_def_shutdown,
+    cf_test_adjust_pollset,
+    Curl_cf_def_data_pending,
+    Curl_cf_def_send,
+    Curl_cf_def_recv,
+    Curl_cf_def_cntrl,
+    Curl_cf_def_conn_is_alive,
+    Curl_cf_def_conn_keep_alive,
+    Curl_cf_def_query,
+  };
+
   struct cf_test_ctx *ctx = NULL;
   struct Curl_cfilter *cf = NULL;
   timediff_t created_at;
   CURLcode result;
 
   (void)data;
+  (void)origin;
+  (void)peer;
   (void)conn;
-  ctx = calloc(sizeof(*ctx), 1);
+  (void)tunnel_peer;
+  (void)transport_above;
+  ctx = curlx_calloc(1, sizeof(*ctx));
   if(!ctx) {
     result = CURLE_OUT_OF_MEMORY;
     goto out;
   }
-  ctx->ai_family = ai->ai_family;
-  ctx->transport = transport;
-  ctx->started = Curl_now();
-#ifdef ENABLE_IPV6
+  ctx->idx = test_idx++;
+  ctx->ai_family = addr->family;
+  ctx->transport_peer = transport_peer;
+  ctx->started = curlx_now();
+  current_tr->ongoing++;
+  if(current_tr->ongoing > current_tr->max_concurrent)
+    current_tr->max_concurrent = current_tr->ongoing;
+#ifdef USE_IPV6
   if(ctx->ai_family == AF_INET6) {
     ctx->stats = &current_tr->cf6;
     ctx->fail_delay_ms = current_tc->cf6_fail_delay_ms;
@@ -221,42 +230,41 @@ static CURLcode cf_test_create(struct Curl_cfilter **pcf,
     ctx->stats->creations++;
   }
 
-  created_at = Curl_timediff(ctx->started, current_tr->started);
+  created_at = curlx_timediff_ms(ctx->started, current_tr->started);
   if(ctx->stats->creations == 1)
     ctx->stats->first_created = created_at;
   ctx->stats->last_created = created_at;
-  infof(data, "%04dms: cf[%s] created", (int)created_at, ctx->id);
+  infof(data, "%04dms: cf[%s] created, now %u ongoing",
+        (int)created_at, ctx->id, current_tr->ongoing);
 
   result = Curl_cf_create(&cf, &cft_test, ctx);
   if(result)
     goto out;
 
-  Curl_expire(data, ctx->fail_delay_ms, EXPIRE_RUN_NOW);
+  Curl_expire(data, ctx->fail_delay_ms, EXPIRE_TIMEOUT);
 
 out:
-  *pcf = (!result)? cf : NULL;
+  *pcf = (!result) ? cf : NULL;
   if(result) {
-    free(cf);
-    free(ctx);
+    curlx_free(cf);
+    curlx_free(ctx);
   }
   return result;
 }
 
-static void check_result(struct test_case *tc,
-                         struct test_result *tr)
+static void check_result(const struct test_case *tc, struct test_result *tr)
 {
   char msg[256];
   timediff_t duration_ms;
 
-  duration_ms = Curl_timediff(tr->ended, tr->started);
-  fprintf(stderr, "%d: test case took %dms\n", tc->id, (int)duration_ms);
+  duration_ms = curlx_timediff_ms(tr->ended, tr->started);
+  curl_mfprintf(stderr, "%d: test case took %dms\n", tc->id, (int)duration_ms);
 
-  if(tr->result != tc->exp_result
-    && CURLE_OPERATION_TIMEDOUT != tr->result) {
+  if(tr->result != tc->result_exp && tr->result != CURLE_OPERATION_TIMEDOUT) {
     /* on CI we encounter the TIMEOUT result, since images get less CPU
      * and events are not as sharply timed. */
     curl_msprintf(msg, "%d: expected result %d but got %d",
-                  tc->id, tc->exp_result, tr->result);
+                  tc->id, (int)tc->result_exp, (int)tr->result);
     fail(msg);
   }
   if(tr->cf4.creations != tc->exp_cf4_creations) {
@@ -270,8 +278,7 @@ static void check_result(struct test_case *tc,
     fail(msg);
   }
 
-#ifndef USE_ALARM_TIMEOUT
-  duration_ms = Curl_timediff(tr->ended, tr->started);
+  duration_ms = curlx_timediff_ms(tr->ended, tr->started);
   if(duration_ms < tc->min_duration_ms) {
     curl_msprintf(msg, "%d: expected min duration of %dms, but took %dms",
                   tc->id, (int)tc->min_duration_ms, (int)duration_ms);
@@ -282,13 +289,12 @@ static void check_result(struct test_case *tc,
                   tc->id, (int)tc->max_duration_ms, (int)duration_ms);
     fail(msg);
   }
-#endif
   if(tr->cf6.creations && tr->cf4.creations && tc->pref_family) {
-    /* did ipv4 and ipv6 both, expect the preferred family to start right arway
+    /* did ipv4 and ipv6 both, expect the preferred family to start right away
      * with the other being delayed by the happy_eyeball_timeout */
-    struct ai_family_stats *stats1 = !strcmp(tc->pref_family, "v6")?
+    struct ai_family_stats *stats1 = !strcmp(tc->pref_family, "v6") ?
                                      &tr->cf6 : &tr->cf4;
-    struct ai_family_stats *stats2 = !strcmp(tc->pref_family, "v6")?
+    struct ai_family_stats *stats2 = !strcmp(tc->pref_family, "v6") ?
                                      &tr->cf4 : &tr->cf6;
 
     if(stats1->first_created > 100) {
@@ -297,11 +303,7 @@ static void check_result(struct test_case *tc,
                     tc->id, stats1->family, (int)stats1->first_created);
       fail(msg);
     }
-#ifndef USE_ALARM_TIMEOUT
     if(stats2->first_created < tc->he_timeout_ms) {
-#else
-    if(stats2->first_created < 1000) {
-#endif
       curl_msprintf(msg, "%d: expected ip%s to start delayed after %dms, "
                     "instead first attempt made after %dms",
                     tc->id, stats2->family, (int)tc->he_timeout_ms,
@@ -309,41 +311,39 @@ static void check_result(struct test_case *tc,
       fail(msg);
     }
   }
+  if(tr->max_concurrent != tc->max_concurrent) {
+    curl_msprintf(msg, "%d: expected max %u ongoing, but reported %u",
+                  tc->id, tc->max_concurrent, tr->max_concurrent);
+    fail(msg);
+  }
 }
 
-static void test_connect(struct test_case *tc)
+static void test_connect(CURL *easy, const struct test_case *tc)
 {
   struct test_result tr;
   struct curl_slist *list = NULL;
 
-  Curl_debug_set_transport_provider(TRNSPRT_TCP, cf_test_create);
+  debug_set_transport_provider(TRNSPRT_TCP, cf_test_create);
   current_tc = tc;
   current_tr = &tr;
 
   list = curl_slist_append(NULL, tc->resolve_info);
   fail_unless(list, "error allocating resolve list entry");
   curl_easy_setopt(easy, CURLOPT_RESOLVE, list);
-  curl_easy_setopt(easy, CURLOPT_IPRESOLVE, (long)tc->ip_version);
+  curl_easy_setopt(easy, CURLOPT_IPRESOLVE, tc->ip_version);
   curl_easy_setopt(easy, CURLOPT_CONNECTTIMEOUT_MS,
                    (long)tc->connect_timeout_ms);
-#ifdef USE_ALARM_TIMEOUT
-  /* we only 1sec timer resolution here */
-  curl_easy_setopt(easy, CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS,
-                   (tc->he_timeout_ms > tc->connect_timeout_ms)?
-                   3000L : 1000L);
-#else
   curl_easy_setopt(easy, CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS,
                    (long)tc->he_timeout_ms);
-#endif
 
   curl_easy_setopt(easy, CURLOPT_URL, tc->url);
   memset(&tr, 0, sizeof(tr));
   tr.cf6.family = "v6";
   tr.cf4.family = "v4";
 
-  tr.started = Curl_now();
+  tr.started = curlx_now();
   tr.result = curl_easy_perform(easy);
-  tr.ended = Curl_now();
+  tr.ended = curlx_now();
 
   curl_easy_setopt(easy, CURLOPT_RESOLVE, NULL);
   curl_slist_free_all(list);
@@ -354,8 +354,6 @@ static void test_connect(struct test_case *tc)
   check_result(tc, &tr);
 }
 
-#endif /* DEBUGBUILD */
-
 /*
  * How these test cases work:
  * - replace the creation of the TCP socket filter with our test filter
@@ -367,58 +365,75 @@ static void test_connect(struct test_case *tc)
  * Max Duration checks needs to be conservative since CI jobs are not
  * as sharp.
  */
-#define TURL "http://test.com:123"
+#define TURL "http://abc.test:123"
 
 #define R_FAIL      CURLE_COULDNT_CONNECT
 /* timeout values accounting for low cpu resources in CI */
 #define TC_TMOT     90000  /* 90 sec max test duration */
 #define CNCT_TMOT   60000  /* 60sec connect timeout */
 
-static struct test_case TEST_CASES[] = {
-  /* TIMEOUT_MS,    FAIL_MS      CREATED    DURATION     Result, HE_PREF */
-  /* CNCT   HE      v4    v6     v4 v6      MIN   MAX */
-  { 1, TURL, "test.com:123:192.0.2.1", CURL_IPRESOLVE_WHATEVER,
-    CNCT_TMOT, 150, 200,  200,    1,  0,      200,  TC_TMOT,  R_FAIL, NULL },
-  /* 1 ipv4, fails after ~200ms, reports COULDNT_CONNECT   */
-  { 2, TURL, "test.com:123:192.0.2.1,192.0.2.2", CURL_IPRESOLVE_WHATEVER,
-    CNCT_TMOT, 150, 200,  200,    2,  0,      400,  TC_TMOT,  R_FAIL, NULL },
-  /* 2 ipv4, fails after ~400ms, reports COULDNT_CONNECT   */
-#ifdef ENABLE_IPV6
-  { 3, TURL, "test.com:123:::1", CURL_IPRESOLVE_WHATEVER,
-    CNCT_TMOT, 150, 200,  200,    0,  1,      200,  TC_TMOT,  R_FAIL, NULL },
-  /* 1 ipv6, fails after ~200ms, reports COULDNT_CONNECT   */
-  { 4, TURL, "test.com:123:::1,::2", CURL_IPRESOLVE_WHATEVER,
-    CNCT_TMOT, 150, 200,  200,    0,  2,      400,  TC_TMOT,  R_FAIL, NULL },
-  /* 2 ipv6, fails after ~400ms, reports COULDNT_CONNECT   */
+static CURLcode test_unit2600(const char *arg)
+{
+  CURL *easy;
+
+  UNITTEST_BEGIN(t2600_setup(&easy))
+
+  static const struct test_case TEST_CASES[] = {
+    /* TIMEOUT_MS,    FAIL_MS      CREATED    DURATION     Result, HE_PREF */
+    /* CNCT   HE      v4    v6     v4 v6      MIN   MAX  MAX_CONCURRENT */
+    { 1, TURL, "abc.test:123:192.0.2.1", CURL_IPRESOLVE_WHATEVER,
+      CNCT_TMOT, 150, 250,  250,    1,  0,      200,  TC_TMOT,  R_FAIL, NULL,
+      1 },
+    /* 1 ipv4, fails after ~200ms, reports COULDNT_CONNECT */
+    { 2, TURL, "abc.test:123:192.0.2.1,192.0.2.2", CURL_IPRESOLVE_WHATEVER,
+      CNCT_TMOT, 150, 250,  250,    2,  0,      400,  TC_TMOT,  R_FAIL, NULL,
+      2 },
+    /* 2 ipv4, fails after ~400ms, reports COULDNT_CONNECT */
+#ifdef USE_IPV6
+    { 3, TURL, "abc.test:123:::1", CURL_IPRESOLVE_WHATEVER,
+      CNCT_TMOT, 150, 250,  250,    0,  1,      200,  TC_TMOT,  R_FAIL, NULL,
+      1 },
+    /* 1 ipv6, fails after ~200ms, reports COULDNT_CONNECT */
+    { 4, TURL, "abc.test:123:::1,::2", CURL_IPRESOLVE_WHATEVER,
+      CNCT_TMOT, 150, 250,  250,    0,  2,      400,  TC_TMOT,  R_FAIL, NULL,
+      2 },
+    /* 2 ipv6, fails after ~400ms, reports COULDNT_CONNECT */
+    { 5, TURL, "abc.test:123:192.0.2.1,::1", CURL_IPRESOLVE_WHATEVER,
+      CNCT_TMOT, 150, 250, 250,     1,  1,      350,  TC_TMOT,  R_FAIL, "v6",
+      2 },
+    /* mixed ip4+6, v6 always first, v4 kicks in on HE, fails after ~350ms */
+    { 6, TURL, "abc.test:123:::1,192.0.2.1", CURL_IPRESOLVE_WHATEVER,
+      CNCT_TMOT, 150, 250, 250,     1,  1,      350,  TC_TMOT,  R_FAIL, "v6",
+      2 },
+    /* mixed ip6+4, v6 starts, v4 never starts due to high HE, TIMEOUT */
+    { 7, TURL, "abc.test:123:192.0.2.1,::1", CURL_IPRESOLVE_V4,
+      CNCT_TMOT, 150, 500, 500,     1,  0,      400,  TC_TMOT,  R_FAIL, NULL,
+      1 },
+    /* mixed ip4+6, but only use v4, check it uses full connect timeout,
+       although another address of the 'wrong' family is available */
+    { 8, TURL, "abc.test:123:::1,192.0.2.1", CURL_IPRESOLVE_V6,
+      CNCT_TMOT, 150, 500, 500,     0,  1,      400,  TC_TMOT,  R_FAIL, NULL,
+      1 },
+    /* mixed ip4+6, but only use v6, check it uses full connect timeout,
+       although another address of the 'wrong' family is available */
+    { 9, TURL, "abc.test:123:::1,192.0.2.1,::2,::3", CURL_IPRESOLVE_WHATEVER,
+      CNCT_TMOT, 50,  400,  400,    1,  3,      550,  TC_TMOT,  R_FAIL, NULL,
+      4 },
+    /* 1 v4, 3 v6, fails after (3*HE)+400ms, ~550ms, COULDNT_CONNECT */
+    { 10, TURL, "abc.test:123:::1,192.0.2.1,::2,::3,::4,::5,::6,::7,::8",
+      CURL_IPRESOLVE_WHATEVER,
+      CNCT_TMOT, 20,  500,  500,    1,  8,      550,  TC_TMOT,  R_FAIL, NULL,
+      6 },
+    /* 1 v4, 8 v6, MUST meet limit of 6 concurrent attempts */
 
-  { 5, TURL, "test.com:123:192.0.2.1,::1", CURL_IPRESOLVE_WHATEVER,
-    CNCT_TMOT, 150, 200, 200,     1,  1,      350,  TC_TMOT,  R_FAIL, "v4" },
-  /* mixed ip4+6, v4 starts, v6 kicks in on HE, fails after ~350ms */
-  { 6, TURL, "test.com:123:::1,192.0.2.1", CURL_IPRESOLVE_WHATEVER,
-    CNCT_TMOT, 150, 200, 200,     1,  1,      350,  TC_TMOT,  R_FAIL, "v6" },
-  /* mixed ip6+4, v6 starts, v4 never starts due to high HE, TIMEOUT */
-  { 7, TURL, "test.com:123:192.0.2.1,::1", CURL_IPRESOLVE_V4,
-    CNCT_TMOT, 150, 500, 500,     1,  0,      400,  TC_TMOT,  R_FAIL, NULL },
-  /* mixed ip4+6, but only use v4, check it uses full connect timeout,
-     although another address of the 'wrong' family is available */
-  { 8, TURL, "test.com:123:::1,192.0.2.1", CURL_IPRESOLVE_V6,
-    CNCT_TMOT, 150, 500, 500,     0,  1,      400,  TC_TMOT,  R_FAIL, NULL },
-  /* mixed ip4+6, but only use v6, check it uses full connect timeout,
-     although another address of the 'wrong' family is available */
 #endif
-};
+  };
 
-UNITTEST_START
-
-#if defined(DEBUGBUILD)
   size_t i;
 
-  for(i = 0; i < sizeof(TEST_CASES)/sizeof(TEST_CASES[0]); ++i) {
-    test_connect(&TEST_CASES[i]);
+  for(i = 0; i < CURL_ARRAYSIZE(TEST_CASES); ++i) {
+    test_connect(easy, &TEST_CASES[i]);
   }
-#else
-  (void)TEST_CASES;
-  (void)test_connect;
-#endif
 
-UNITTEST_STOP
+  UNITTEST_END(t2600_stop(easy))
+}
diff --git a/third-party/curl/tests/unit/unit2601.c b/third-party/curl/tests/unit/unit2601.c
index c0c413be5e..21cdb13836 100644
--- a/third-party/curl/tests/unit/unit2601.c
+++ b/third-party/curl/tests/unit/unit2601.c
@@ -21,28 +21,17 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "urldata.h"
 #include "bufq.h"
 #include "curl_trc.h"
 
-static CURLcode unit_setup(void)
-{
-  CURLcode res = CURLE_OK;
-  return res;
-}
-
-static void unit_stop(void)
-{
-}
-
 static const char *tail_err(struct bufq *q)
 {
   struct buf_chunk *chunk;
 
   if(!q->tail) {
-    return q->head? "tail is NULL, but head is not" : NULL;
+    return q->head ? "tail is NULL, but head is not" : NULL;
   }
 
   chunk = q->head;
@@ -64,39 +53,40 @@ static void dump_bufq(struct bufq *q, const char *msg)
   const char *terr;
   size_t n;
 
-  fprintf(stderr, "bufq[chunk_size=%zu, max_chunks=%zu] %s\n",
-          q->chunk_size, q->max_chunks, msg);
-  fprintf(stderr, "- queue[\n");
+  curl_mfprintf(stderr, "bufq[chunk_size=%zu, max_chunks=%zu] %s\n",
+                q->chunk_size, q->max_chunks, msg);
+  curl_mfprintf(stderr, "- queue[\n");
   chunk = q->head;
   while(chunk) {
-    fprintf(stderr, "    chunk[len=%zu, roff=%zu, woff=%zu]\n",
-            chunk->dlen, chunk->r_offset, chunk->w_offset);
+    curl_mfprintf(stderr, "    chunk[len=%zu, roff=%zu, woff=%zu]\n",
+                  chunk->dlen, chunk->r_offset, chunk->w_offset);
     chunk = chunk->next;
   }
-  fprintf(stderr, "  ]\n");
+  curl_mfprintf(stderr, "  ]\n");
   terr = tail_err(q);
-  fprintf(stderr, "- tail: %s\n", terr? terr : "ok");
+  curl_mfprintf(stderr, "- tail: %s\n", terr ? terr : "ok");
   n = 0;
   chunk = q->spare;
   while(chunk) {
     ++n;
     chunk = chunk->next;
   }
-  fprintf(stderr, "- chunks: %zu\n", q->chunk_count);
-  fprintf(stderr, "- spares: %zu\n", n);
+  curl_mfprintf(stderr, "- chunks: %zu\n", q->chunk_count);
+  curl_mfprintf(stderr, "- spares: %zu\n", n);
 }
 
-static unsigned char test_data[32*1024];
-
 static void check_bufq(size_t pool_spares,
                        size_t chunk_size, size_t max_chunks,
                        size_t wsize, size_t rsize, int opts)
 {
+  static unsigned char test_data[32 * 1024];
+
   struct bufq q;
   struct bufc_pool pool;
   size_t max_len = chunk_size * max_chunks;
   CURLcode result;
-  ssize_t n, i;
+  ssize_t i;
+  size_t n2;
   size_t nwritten, nread;
 
   if(pool_spares > 0) {
@@ -109,23 +99,22 @@ static void check_bufq(size_t pool_spares,
 
   fail_unless(q.chunk_size == chunk_size, "chunk_size init wrong");
   fail_unless(q.max_chunks == max_chunks, "max_chunks init wrong");
-  fail_unless(q.head == NULL, "init: head not NULL");
-  fail_unless(q.tail == NULL, "init: tail not NULL");
-  fail_unless(q.spare == NULL, "init: spare not NULL");
+  fail_unless(!q.head, "init: head not NULL");
+  fail_unless(!q.tail, "init: tail not NULL");
+  fail_unless(!q.spare, "init: spare not NULL");
   fail_unless(Curl_bufq_len(&q) == 0, "init: bufq length != 0");
 
-  n = Curl_bufq_write(&q, test_data, wsize, &result);
-  fail_unless(n >= 0, "write: negative size returned");
-  fail_unless((size_t)n <= wsize, "write: wrong size returned");
+  result = Curl_bufq_write(&q, test_data, wsize, &n2);
+  fail_unless(n2 <= wsize, "write: wrong size returned");
   fail_unless(result == CURLE_OK, "write: wrong result returned");
 
   /* write empty bufq full */
   nwritten = 0;
   Curl_bufq_reset(&q);
   while(!Curl_bufq_is_full(&q)) {
-    n = Curl_bufq_write(&q, test_data, wsize, &result);
-    if(n >= 0) {
-      nwritten += (size_t)n;
+    result = Curl_bufq_write(&q, test_data, wsize, &n2);
+    if(!result) {
+      nwritten += n2;
     }
     else if(result != CURLE_AGAIN) {
       fail_unless(result == CURLE_AGAIN, "write-loop: unexpected result");
@@ -133,8 +122,8 @@ static void check_bufq(size_t pool_spares,
     }
   }
   if(nwritten != max_len) {
-    fprintf(stderr, "%zu bytes written, but max_len=%zu\n",
-            nwritten, max_len);
+    curl_mfprintf(stderr, "%zu bytes written, but max_len=%zu\n",
+                  nwritten, max_len);
     dump_bufq(&q, "after writing full");
     fail_if(TRUE, "write: bufq full but nwritten wrong");
   }
@@ -142,9 +131,9 @@ static void check_bufq(size_t pool_spares,
   /* read full bufq empty */
   nread = 0;
   while(!Curl_bufq_is_empty(&q)) {
-    n = Curl_bufq_read(&q, test_data, rsize, &result);
-    if(n >= 0) {
-      nread += (size_t)n;
+    result = Curl_bufq_read(&q, test_data, rsize, &n2);
+    if(!result) {
+      nread += n2;
     }
     else if(result != CURLE_AGAIN) {
       fail_unless(result == CURLE_AGAIN, "read-loop: unexpected result");
@@ -152,8 +141,8 @@ static void check_bufq(size_t pool_spares,
     }
   }
   if(nread != max_len) {
-    fprintf(stderr, "%zu bytes read, but max_len=%zu\n",
-            nwritten, max_len);
+    curl_mfprintf(stderr, "%zu bytes read, but max_len=%zu\n",
+                  nwritten, max_len);
     dump_bufq(&q, "after reading empty");
     fail_if(TRUE, "read: bufq empty but nread wrong");
   }
@@ -163,13 +152,13 @@ static void check_bufq(size_t pool_spares,
   }
 
   for(i = 0; i < 1000; ++i) {
-    n = Curl_bufq_write(&q, test_data, wsize, &result);
-    if(n < 0 && result != CURLE_AGAIN) {
+    result = Curl_bufq_write(&q, test_data, wsize, &n2);
+    if(result && result != CURLE_AGAIN) {
       fail_unless(result == CURLE_AGAIN, "rw-loop: unexpected write result");
       break;
     }
-    n = Curl_bufq_read(&q, test_data, rsize, &result);
-    if(n < 0 && result != CURLE_AGAIN) {
+    result = Curl_bufq_read(&q, test_data, rsize, &n2);
+    if(result && result != CURLE_AGAIN) {
       fail_unless(result == CURLE_AGAIN, "rw-loop: unexpected read result");
       break;
     }
@@ -177,35 +166,35 @@ static void check_bufq(size_t pool_spares,
 
   /* Test SOFT_LIMIT option */
   Curl_bufq_free(&q);
-  Curl_bufq_init2(&q, chunk_size, max_chunks, (opts|BUFQ_OPT_SOFT_LIMIT));
+  Curl_bufq_init2(&q, chunk_size, max_chunks, (opts | BUFQ_OPT_SOFT_LIMIT));
   nwritten = 0;
   while(!Curl_bufq_is_full(&q)) {
-    n = Curl_bufq_write(&q, test_data, wsize, &result);
-    if(n < 0 || (size_t)n != wsize) {
-      fail_unless(n > 0 && (size_t)n == wsize, "write should be complete");
+    result = Curl_bufq_write(&q, test_data, wsize, &n2);
+    if(result || n2 != wsize) {
+      fail_unless(!result && n2 == wsize, "write should be complete");
       break;
     }
-    nwritten += (size_t)n;
+    nwritten += n2;
   }
   if(nwritten < max_len) {
-    fprintf(stderr, "%zu bytes written, but max_len=%zu\n",
-            nwritten, max_len);
+    curl_mfprintf(stderr, "%zu bytes written, but max_len=%zu\n",
+                  nwritten, max_len);
     dump_bufq(&q, "after writing full");
     fail_if(TRUE, "write: bufq full but nwritten wrong");
   }
   /* do one more write on a full bufq, should work */
-  n = Curl_bufq_write(&q, test_data, wsize, &result);
-  fail_unless(n > 0 && (size_t)n == wsize, "write should be complete");
-  nwritten += (size_t)n;
+  result = Curl_bufq_write(&q, test_data, wsize, &n2);
+  fail_unless(!result && n2 == wsize, "write should be complete");
+  nwritten += n2;
   /* see that we get all out again */
   nread = 0;
   while(!Curl_bufq_is_empty(&q)) {
-    n = Curl_bufq_read(&q, test_data, rsize, &result);
-    if(n <= 0) {
-      fail_unless(n > 0, "read-loop: unexpected fail");
+    result = Curl_bufq_read(&q, test_data, rsize, &n2);
+    if(result) {
+      fail_unless(result, "read-loop: unexpected fail");
       break;
     }
-    nread += (size_t)n;
+    nread += n2;
   }
   fail_unless(nread == nwritten, "did not get the same out as put in");
 
@@ -215,15 +204,18 @@ static void check_bufq(size_t pool_spares,
     Curl_bufcp_free(&pool);
 }
 
-UNITTEST_START
-  struct bufq q;
-  ssize_t n;
-  CURLcode result;
-  unsigned char buf[16*1024];
+static CURLcode test_unit2601(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
 
-  Curl_bufq_init(&q, 8*1024, 12);
-  n = Curl_bufq_read(&q, buf, 128, &result);
-  fail_unless(n < 0 && result == CURLE_AGAIN, "read empty fail");
+  struct bufq q;
+  size_t n;
+  CURLcode result;
+  unsigned char buf[16 * 1024];
+
+  Curl_bufq_init(&q, 8 * 1024, 12);
+  result = Curl_bufq_read(&q, buf, 128, &n);
+  fail_unless(result && result == CURLE_AGAIN, "read empty fail");
   Curl_bufq_free(&q);
 
   check_bufq(0, 1024, 4, 128, 128, BUFQ_OPT_NONE);
@@ -232,7 +224,7 @@ UNITTEST_START
   check_bufq(0, 1024, 4, 16000, 3000, BUFQ_OPT_NONE);
 
   check_bufq(0, 8000, 10, 1234, 1234, BUFQ_OPT_NONE);
-  check_bufq(0, 8000, 10, 8*1024, 4*1024, BUFQ_OPT_NONE);
+  check_bufq(0, 8000, 10, 8 * 1024, 4 * 1024, BUFQ_OPT_NONE);
 
   check_bufq(0, 1024, 4, 128, 128, BUFQ_OPT_NO_SPARES);
   check_bufq(0, 1024, 4, 129, 127, BUFQ_OPT_NO_SPARES);
@@ -243,4 +235,5 @@ UNITTEST_START
   check_bufq(8, 8000, 10, 1234, 1234, BUFQ_OPT_NONE);
   check_bufq(8, 1024, 4, 129, 127, BUFQ_OPT_NO_SPARES);
 
-UNITTEST_STOP
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit2602.c b/third-party/curl/tests/unit/unit2602.c
index 41476c60f0..6da472787e 100644
--- a/third-party/curl/tests/unit/unit2602.c
+++ b/third-party/curl/tests/unit/unit2602.c
@@ -21,24 +21,14 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
-
+#include "unitcheck.h"
 #include "urldata.h"
-#include "dynbuf.h"
 #include "dynhds.h"
 #include "curl_trc.h"
 
-static CURLcode unit_setup(void)
+static CURLcode test_unit2602(const char *arg)
 {
-  return CURLE_OK;
-}
-
-static void unit_stop(void)
-{
-}
-
-
-UNITTEST_START
+  UNITTEST_BEGIN_SIMPLE
 
   struct dynhds hds;
   struct dynbuf dbuf;
@@ -52,7 +42,7 @@ UNITTEST_START
   fail_if(Curl_dynhds_add(&hds, "test2", 5, "456", 3), "add failed");
   /* remove and add without exceeding limits */
   for(i = 0; i < 100; ++i) {
-    if(Curl_dynhds_remove(&hds, "test2", 5) != 1) {
+    if(dynhds_remove(&hds, "test2", 5) != 1) {
       fail_if(TRUE, "should");
       break;
     }
@@ -64,7 +54,7 @@ UNITTEST_START
   fail_unless(Curl_dynhds_count(&hds) == 2, "should hold 2");
   /* set, replacing previous entry without exceeding limits */
   for(i = 0; i < 100; ++i) {
-    if(Curl_dynhds_set(&hds, "test2", 5, "456", 3)) {
+    if(dynhds_set(&hds, "test2", 5, "456", 3)) {
       fail_if(TRUE, "add failed");
       break;
     }
@@ -74,16 +64,16 @@ UNITTEST_START
   result = Curl_dynhds_add(&hds, "test3", 5, "789", 3);
   fail_unless(result, "add should have failed");
 
-  fail_unless(Curl_dynhds_count_name(&hds, "test", 4) == 0, "false positive");
-  fail_unless(Curl_dynhds_count_name(&hds, "test1", 4) == 0, "false positive");
+  fail_unless(dynhds_count_name(&hds, "test", 4) == 0, "false positive");
+  fail_unless(dynhds_count_name(&hds, "test1", 4) == 0, "false positive");
   fail_if(Curl_dynhds_get(&hds, "test1", 4), "false positive");
   fail_unless(Curl_dynhds_get(&hds, "test1", 5), "false negative");
-  fail_unless(Curl_dynhds_count_name(&hds, "test1", 5) == 1, "should");
-  fail_unless(Curl_dynhds_ccount_name(&hds, "test2") == 1, "should");
+  fail_unless(dynhds_count_name(&hds, "test1", 5) == 1, "should");
+  fail_unless(dynhds_ccount_name(&hds, "test2") == 1, "should");
   fail_unless(Curl_dynhds_cget(&hds, "test2"), "should");
-  fail_unless(Curl_dynhds_ccount_name(&hds, "TEST2") == 1, "should");
-  fail_unless(Curl_dynhds_ccontains(&hds, "TesT2"), "should");
-  fail_unless(Curl_dynhds_contains(&hds, "TeSt2", 5), "should");
+  fail_unless(dynhds_ccount_name(&hds, "TEST2") == 1, "should");
+  fail_unless(dynhds_ccontains(&hds, "TesT2"), "should");
+  fail_unless(dynhds_contains(&hds, "TeSt2", 5), "should");
   Curl_dynhds_free(&hds);
 
   /* add header exceeding max overall length */
@@ -94,55 +84,44 @@ UNITTEST_START
   Curl_dynhds_reset(&hds);
   Curl_dynhds_free(&hds);
 
-  Curl_dynhds_init(&hds, 128, 4*1024);
+  Curl_dynhds_init(&hds, 128, 4 * 1024);
   fail_if(Curl_dynhds_add(&hds, "test1", 5, "123", 3), "add failed");
   fail_if(Curl_dynhds_add(&hds, "test1", 5, "123", 3), "add failed");
   fail_if(Curl_dynhds_cadd(&hds, "blablabla", "thingies"), "add failed");
   fail_if(Curl_dynhds_h1_cadd_line(&hds, "blablabla: thingies"), "add failed");
-  fail_unless(Curl_dynhds_ccount_name(&hds, "blablabla") == 2, "should");
-  fail_unless(Curl_dynhds_cremove(&hds, "blablabla") == 2, "should");
-  fail_if(Curl_dynhds_ccontains(&hds, "blablabla"), "should not");
+  fail_unless(dynhds_ccount_name(&hds, "blablabla") == 2, "should");
+  fail_unless(dynhds_cremove(&hds, "blablabla") == 2, "should");
+  fail_if(dynhds_ccontains(&hds, "blablabla"), "should not");
 
   result = Curl_dynhds_h1_cadd_line(&hds, "blablabla thingies");
   fail_unless(result, "add should have failed");
   if(!result) {
-    fail_unless(Curl_dynhds_ccount_name(&hds, "bLABlaBlA") == 0, "should");
+    fail_unless(dynhds_ccount_name(&hds, "bLABlaBlA") == 0, "should");
     fail_if(Curl_dynhds_cadd(&hds, "Bla-Bla", "thingies"), "add failed");
 
-    Curl_dyn_init(&dbuf, 32*1024);
+    curlx_dyn_init(&dbuf, 32 * 1024);
     fail_if(Curl_dynhds_h1_dprint(&hds, &dbuf), "h1 print failed");
-    if(Curl_dyn_ptr(&dbuf)) {
-      fail_if(strcmp(Curl_dyn_ptr(&dbuf),
+    if(curlx_dyn_ptr(&dbuf)) {
+      fail_if(strcmp(curlx_dyn_ptr(&dbuf),
                      "test1: 123\r\ntest1: 123\r\nBla-Bla: thingies\r\n"),
-                     "h1 format differs");
+              "h1 format differs");
     }
-    Curl_dyn_free(&dbuf);
+    curlx_dyn_free(&dbuf);
   }
 
   Curl_dynhds_free(&hds);
-  Curl_dynhds_init(&hds, 128, 4*1024);
-  /* continuation without previous header fails */
-  result = Curl_dynhds_h1_cadd_line(&hds, " indented value");
-  fail_unless(result, "add should have failed");
 
-  /* continuation with previous header must succeed */
-  fail_if(Curl_dynhds_h1_cadd_line(&hds, "ti1: val1"), "add");
-  fail_if(Curl_dynhds_h1_cadd_line(&hds, " val2"), "add indent");
-  fail_if(Curl_dynhds_h1_cadd_line(&hds, "ti2: val1"), "add");
-  fail_if(Curl_dynhds_h1_cadd_line(&hds, "\tval2"), "add indent");
-  fail_if(Curl_dynhds_h1_cadd_line(&hds, "ti3: val1"), "add");
-  fail_if(Curl_dynhds_h1_cadd_line(&hds, "     val2"), "add indent");
-
-  Curl_dyn_init(&dbuf, 32*1024);
+  curlx_dyn_init(&dbuf, 32 * 1024);
   fail_if(Curl_dynhds_h1_dprint(&hds, &dbuf), "h1 print failed");
-  if(Curl_dyn_ptr(&dbuf)) {
-    fprintf(stderr, "indent concat: %s\n", Curl_dyn_ptr(&dbuf));
-    fail_if(strcmp(Curl_dyn_ptr(&dbuf),
+  if(curlx_dyn_ptr(&dbuf)) {
+    curl_mfprintf(stderr, "indent concat: %s\n", curlx_dyn_ptr(&dbuf));
+    fail_if(strcmp(curlx_dyn_ptr(&dbuf),
                    "ti1: val1 val2\r\nti2: val1 val2\r\nti3: val1 val2\r\n"),
-                   "wrong format");
+            "wrong format");
   }
-  Curl_dyn_free(&dbuf);
+  curlx_dyn_free(&dbuf);
 
   Curl_dynhds_free(&hds);
 
-UNITTEST_STOP
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit2603.c b/third-party/curl/tests/unit/unit2603.c
index 3c61776360..0198ccf7f4 100644
--- a/third-party/curl/tests/unit/unit2603.c
+++ b/third-party/curl/tests/unit/unit2603.c
@@ -21,25 +21,36 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
+#include "unitcheck.h"
 
+#ifndef CURL_DISABLE_HTTP
 #include "urldata.h"
-#include "http.h"
 #include "http1.h"
 #include "curl_trc.h"
 
-static CURLcode unit_setup(void)
-{
-  return CURLE_OK;
-}
-
-static void unit_stop(void)
+static void check_eq(const char *s, const char *exp_s, const char *name)
 {
+  if(s && exp_s) {
+    if(strcmp(s, exp_s)) {
+      curl_mfprintf(stderr, "expected %s: '%s' but got '%s'\n",
+                    name, exp_s, s);
+      fail("unexpected req component");
+    }
+  }
+  else if(!s && exp_s) {
+    curl_mfprintf(stderr, "expected %s: '%s' but got NULL\n", name, exp_s);
+    fail("unexpected req component");
+  }
+  else if(s && !exp_s) {
+    curl_mfprintf(stderr, "expected %s: NULL but got '%s'\n", name, s);
+    fail("unexpected req component");
+  }
 }
 
 struct tcase {
   const char **input;
   const char *default_scheme;
+  const char *custom_method;
   const char *method;
   const char *scheme;
   const char *authority;
@@ -48,49 +59,31 @@ struct tcase {
   size_t input_remain;
 };
 
-static void check_eq(const char *s, const char *exp_s, const char *name)
-{
-  if(s && exp_s) {
-    if(strcmp(s, exp_s)) {
-      fprintf(stderr, "expected %s: '%s' but got '%s'\n", name, exp_s, s);
-      fail("unexpected req component");
-    }
-  }
-  else if(!s && exp_s) {
-    fprintf(stderr, "expected %s: '%s' but got NULL\n", name, exp_s);
-    fail("unexpected req component");
-  }
-  else if(s && !exp_s) {
-    fprintf(stderr, "expected %s: NULL but got '%s'\n", name, s);
-    fail("unexpected req component");
-  }
-}
-
-static void parse_success(struct tcase *t)
+static void parse_success(const struct tcase *t)
 {
   struct h1_req_parser p;
-  const char *buf;
+  const uint8_t *buf;
   size_t buflen, i, in_len, in_consumed;
-  CURLcode err;
-  ssize_t nread;
+  CURLcode result;
+  size_t nread;
 
   Curl_h1_req_parse_init(&p, 1024);
   in_len = in_consumed = 0;
   for(i = 0; t->input[i]; ++i) {
-    buf = t->input[i];
-    buflen = strlen(buf);
+    buf = (const uint8_t *)t->input[i];
+    buflen = strlen(t->input[i]);
     in_len += buflen;
-    nread = Curl_h1_req_parse_read(&p, buf, buflen, t->default_scheme,
-                                   0, &err);
-    if(nread < 0) {
-      fprintf(stderr, "got err %d parsing: '%s'\n", err, buf);
+    result = Curl_h1_req_parse_read(&p, buf, buflen, t->default_scheme,
+                                    t->custom_method, 0, &nread);
+    if(result) {
+      curl_mfprintf(stderr, "got result %d parsing: '%s'\n", (int)result, buf);
       fail("error consuming");
     }
-    in_consumed += (size_t)nread;
-    if((size_t)nread != buflen) {
+    in_consumed += nread;
+    if(nread != buflen) {
       if(!p.done) {
-        fprintf(stderr, "only %zd/%zu consumed for: '%s'\n",
-                nread, buflen, buf);
+        curl_mfprintf(stderr, "only %zu/%zu consumed for: '%s'\n",
+                      nread, buflen, buf);
         fail("not all consumed");
       }
     }
@@ -99,8 +92,8 @@ static void parse_success(struct tcase *t)
   fail_if(!p.done, "end not detected");
   fail_if(!p.req, "not request created");
   if(t->input_remain != (in_len - in_consumed)) {
-    fprintf(stderr, "expected %zu input bytes to remain, but got %zu\n",
-            t->input_remain, in_len - in_consumed);
+    curl_mfprintf(stderr, "expected %zu input bytes to remain, but got %zu\n",
+                  t->input_remain, in_len - in_consumed);
     fail("unexpected input consumption");
   }
   if(p.req) {
@@ -109,82 +102,91 @@ static void parse_success(struct tcase *t)
     check_eq(p.req->authority, t->authority, "authority");
     check_eq(p.req->path, t->path, "path");
     if(Curl_dynhds_count(&p.req->headers) != t->header_count) {
-      fprintf(stderr, "expected %zu headers but got %zu\n", t->header_count,
-             Curl_dynhds_count(&p.req->headers));
+      curl_mfprintf(stderr, "expected %zu headers but got %zu\n",
+                    t->header_count, Curl_dynhds_count(&p.req->headers));
       fail("unexpected req header count");
     }
   }
 
   Curl_h1_req_parse_free(&p);
 }
+#endif
 
-static const char *T1_INPUT[] = {
-  "GET /path HTTP/1.1\r\nHost: test.curl.se\r\n\r\n",
-  NULL,
-};
-static struct tcase TEST1a = {
-  T1_INPUT, NULL, "GET", NULL, NULL, "/path", 1, 0
-};
-static struct tcase TEST1b = {
-  T1_INPUT, "https", "GET", "https", NULL, "/path", 1, 0
-};
+static CURLcode test_unit2603(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
 
-static const char *T2_INPUT[] = {
-  "GET /path HTT",
-  "P/1.1\r\nHost: te",
-  "st.curl.se\r\n\r",
-  "\n12345678",
-  NULL,
-};
-static struct tcase TEST2 = {
-  T2_INPUT, NULL, "GET", NULL, NULL, "/path", 1, 8
-};
+#ifndef CURL_DISABLE_HTTP
+  static const char *T1_INPUT[] = {
+    "GET /path HTTP/1.1\r\nHost: test.curl.se\r\n\r\n",
+    NULL,
+  };
+  static const struct tcase TEST1a = {
+    T1_INPUT, NULL, NULL, "GET", NULL, NULL, "/path", 1, 0
+  };
+  static const struct tcase TEST1b = {
+    T1_INPUT, "https", NULL, "GET", "https", NULL, "/path", 1, 0
+  };
 
-static const char *T3_INPUT[] = {
-  "GET ftp://ftp.curl.se/xxx?a=2 HTTP/1.1\r\nContent-Length: 0\r",
-  "\nUser-Agent: xxx\r\n\r\n",
-  NULL,
-};
-static struct tcase TEST3a = {
-  T3_INPUT, NULL, "GET", "ftp", "ftp.curl.se", "/xxx?a=2", 2, 0
-};
+  static const char *T2_INPUT[] = {
+    "GET /path HTT",
+    "P/1.1\r\nHost: te",
+    "st.curl.se\r\n\r",
+    "\n12345678",
+    NULL,
+  };
+  static const struct tcase TEST2 = {
+    T2_INPUT, NULL, NULL, "GET", NULL, NULL, "/path", 1, 8
+  };
 
-static const char *T4_INPUT[] = {
-  "CONNECT ftp.curl.se:123 HTTP/1.1\r\nContent-Length: 0\r\n",
-  "User-Agent: xxx\r\n",
-  "nothing:  \r\n\r\n\n\n",
-  NULL,
-};
-static struct tcase TEST4a = {
-  T4_INPUT, NULL, "CONNECT", NULL, "ftp.curl.se:123", NULL, 3, 2
-};
+  static const char *T3_INPUT[] = {
+    "GET ftp://ftp.curl.se/xxx?a=2 HTTP/1.1\r\nContent-Length: 0\r",
+    "\nUser-Agent: xxx\r\n\r\n",
+    NULL,
+  };
+  static const struct tcase TEST3a = {
+    T3_INPUT, NULL, NULL, "GET", "ftp", "ftp.curl.se", "/xxx?a=2", 2, 0
+  };
 
-static const char *T5_INPUT[] = {
-  "OPTIONS * HTTP/1.1\r\nContent-Length: 0\r\nBlabla: xxx.yyy\r",
-  "\n\tzzzzzz\r\n\r\n",
-  "123",
-  NULL,
-};
-static struct tcase TEST5a = {
-  T5_INPUT, NULL, "OPTIONS", NULL, NULL, "*", 2, 3
-};
+  static const char *T4_INPUT[] = {
+    "CONNECT ftp.curl.se:123 HTTP/1.1\r\nContent-Length: 0\r\n",
+    "User-Agent: xxx\r\n",
+    "nothing:  \r\n\r\n\n\n",
+    NULL,
+  };
+  static const struct tcase TEST4a = {
+    T4_INPUT, NULL, NULL, "CONNECT", NULL, "ftp.curl.se:123", NULL, 3, 2
+  };
 
-static const char *T6_INPUT[] = {
-  "PUT /path HTTP/1.1\nHost: test.curl.se\n\n123",
-  NULL,
-};
-static struct tcase TEST6a = {
-  T6_INPUT, NULL, "PUT", NULL, NULL, "/path", 1, 3
-};
+  static const char *T6_INPUT[] = {
+    "PUT /path HTTP/1.1\nHost: test.curl.se\n\n123",
+    NULL,
+  };
+  static const struct tcase TEST6a = {
+    T6_INPUT, NULL, NULL, "PUT", NULL, NULL, "/path", 1, 3
+  };
 
-UNITTEST_START
+  /* test a custom method with space, #19543 */
+  static const char *T7_INPUT[] = {
+    "IN SANE /path HTTP/1.1\r\nContent-Length: 0\r\n\r\n",
+    NULL,
+  };
+  static const struct tcase TEST7a = {
+    T7_INPUT, NULL, NULL, "IN", NULL, NULL, "SANE /path", 1, 0
+  };
+  static const struct tcase TEST7b = {
+    T7_INPUT, NULL, "IN SANE", "IN SANE", NULL, NULL, "/path", 1, 0
+  };
 
   parse_success(&TEST1a);
   parse_success(&TEST1b);
   parse_success(&TEST2);
   parse_success(&TEST3a);
   parse_success(&TEST4a);
-  parse_success(&TEST5a);
   parse_success(&TEST6a);
+  parse_success(&TEST7a);
+  parse_success(&TEST7b);
+#endif
 
-UNITTEST_STOP
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit2604.c b/third-party/curl/tests/unit/unit2604.c
new file mode 100644
index 0000000000..770aec15be
--- /dev/null
+++ b/third-party/curl/tests/unit/unit2604.c
@@ -0,0 +1,115 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "vssh/vssh.h"
+
+static CURLcode test_unit2604(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+#ifdef USE_SSH
+
+  struct set {
+    const char *cp;
+    const char *expect; /* the returned content */
+    const char *next;   /* what cp points to after the call */
+    const char *home;
+    CURLcode result;
+  };
+
+#ifdef CURL_HAVE_DIAG
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Woverlength-strings"
+#endif
+
+/* 60 a's */
+#define SA60 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+/* 540 a's */
+#define SA540 SA60 SA60 SA60 SA60 SA60 SA60 SA60 SA60 SA60
+  int i;
+  const size_t too_long = 90720;
+  struct set list[] = {
+    { "-too-long-", "", "", "", CURLE_TOO_LARGE },
+    { SA540 " c", SA540, "c", "/", CURLE_OK },
+    { "\" " SA540 "\" c", " " SA540, "c", "/", CURLE_OK },
+    { "a a", "a", "a", "/home/", CURLE_OK },
+    { "b a", "b", "a", "/", CURLE_OK },
+    { "a", "a", "", "/home/", CURLE_OK },
+    { "b", "b", "", "/", CURLE_OK },
+    { "\"foo bar\"\tb", "foo bar", "b", "/", CURLE_OK },
+    { "/~/hej", "/home/user/hej", "", "/home/user", CURLE_OK },
+    { "\"foo bar", "", "", "/", CURLE_QUOTE_ERROR },
+    { "\"foo\\\"bar\" a", "foo\"bar", "a", "/", CURLE_OK },
+    { "\"foo\\\'bar\" b", "foo\'bar", "b", "/", CURLE_OK },
+    { "\"foo\\\\bar\" c", "foo\\bar", "c", "/", CURLE_OK },
+    { "\"foo\\pbar\" c", "foo\\bar", "", "/", CURLE_QUOTE_ERROR },
+    { "\"\" c", "", "", "", CURLE_QUOTE_ERROR },
+    { "foo\"", "foo\"", "", "/", CURLE_OK },
+    { "foo \"", "foo", "\"", "/", CURLE_OK },
+    { "   \t\t   \t  ", "", "", "/", CURLE_QUOTE_ERROR },
+    { "              ", "", "", "/", CURLE_QUOTE_ERROR },
+    { "", "", "", "/", CURLE_QUOTE_ERROR },
+    { "       \r \n  ", "\r", "\n  ", "/", CURLE_OK },
+    { NULL, NULL, NULL, NULL, CURLE_OK }
+  };
+
+#ifdef CURL_HAVE_DIAG
+#pragma GCC diagnostic pop
+#endif
+
+  char *cp0 = curlx_calloc(1, too_long + 1);
+  fail_unless(cp0, "could not alloc too long value");
+  memset(cp0, 'a', too_long);
+
+  for(i = 0; list[i].home; i++) {
+    char *path;
+    const char *cp = i == 0 ? cp0 : list[i].cp;
+    CURLcode result = Curl_get_pathname(&cp, &path, list[i].home);
+    curl_mprintf("%d - Curl_get_pathname(\"%s\", ... \"%s\") == %d\n", i,
+                 list[i].cp, list[i].home, (int)list[i].result);
+    if(result != list[i].result) {
+      curl_mprintf("... returned %d\n", (int)result);
+      unitfail++;
+    }
+    if(!result) {
+      if(cp && strcmp(cp, list[i].next)) {
+        curl_mprintf("... cp points to '%s', not '%s' as expected\n",
+                     cp, list[i].next);
+        unitfail++;
+      }
+      if(path && strcmp(path, list[i].expect)) {
+        curl_mprintf("... gave '%s', not '%s' as expected\n",
+                     path, list[i].expect);
+        unitfail++;
+      }
+      curl_free(path);
+    }
+  }
+
+  curlx_free(cp0);
+
+#endif
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit2605.c b/third-party/curl/tests/unit/unit2605.c
new file mode 100644
index 0000000000..e3962a22e8
--- /dev/null
+++ b/third-party/curl/tests/unit/unit2605.c
@@ -0,0 +1,112 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "vssh/vssh.h"
+
+static CURLcode test_unit2605(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+#ifdef USE_SSH
+  CURL *curl;
+  struct range {
+    const char *r;
+    curl_off_t filesize;
+    curl_off_t start;
+    curl_off_t size;
+    CURLcode result;
+  };
+
+  int i;
+  struct range list[] = {
+    { "0-9", 100, 0, 10, CURLE_OK },
+    { "1-10", 100, 1, 10, CURLE_OK },
+    { "222222-222222", 300000, 222222, 1, CURLE_OK },
+    { "4294967296 - 4294967297", 4294967298, 4294967296, 2, CURLE_OK },
+    { "-10", 100, 90, 10, CURLE_OK },
+    { "-20", 100, 80, 20, CURLE_OK },
+    { "-1", 100, 99, 1, CURLE_OK },
+    { "-0", 100, 0, 0, CURLE_RANGE_ERROR },
+    { "--2", 100, 0, 0, CURLE_RANGE_ERROR },
+    { "-100", 100, 0, 100, CURLE_OK },
+    { "-101", 100, 0, 100, CURLE_OK },
+    { "-1000", 100, 0, 100, CURLE_OK },
+    { "2-1000", 100, 2, 98, CURLE_OK },
+    { ".2-3", 100, 0, 0, CURLE_RANGE_ERROR },
+    { "+2-3", 100, 0, 0, CURLE_RANGE_ERROR },
+    { "2 - 3", 100, 2, 2, CURLE_OK },
+    { " 2 - 3", 100, 2, 2, CURLE_RANGE_ERROR }, /* no leading space */
+    { "2 - 3 ", 100, 2, 2, CURLE_RANGE_ERROR }, /* no trailing space */
+    { "3-2", 100, 0, 0, CURLE_RANGE_ERROR },
+    { "2.-3", 100, 0, 0, CURLE_RANGE_ERROR },
+    { "-3-2", 100, 0, 0, CURLE_RANGE_ERROR },
+    { "101-102", 100, 0, 0, CURLE_RANGE_ERROR },
+    { "0-", 100, 0, 100, CURLE_OK },
+    { "1-", 100, 1, 99, CURLE_OK },
+    { "99-", 100, 99, 1, CURLE_OK },
+    { "100-", 100, 0, 0, CURLE_RANGE_ERROR },
+    { NULL, 0, 0, 0, CURLE_OK }
+  };
+
+  curl_global_init(CURL_GLOBAL_ALL);
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+
+    for(i = 0; list[i].r; i++) {
+      curl_off_t start;
+      curl_off_t size;
+      CURLcode result;
+      curl_mprintf("%d: '%s' (file size: %" FMT_OFF_T ")\n", i, list[i].r,
+                   list[i].filesize);
+      result = Curl_ssh_range(curl, list[i].r, list[i].filesize, &start,
+                              &size);
+      if(result != list[i].result) {
+        curl_mprintf("... returned %d\n", (int)result);
+        unitfail++;
+      }
+      if(!result) {
+        if(start != list[i].start) {
+          curl_mprintf("... start (%" FMT_OFF_T ") was not %" FMT_OFF_T "\n",
+                       start, list[i].start);
+          unitfail++;
+        }
+        if(size != list[i].size) {
+          curl_mprintf("... size (%" FMT_OFF_T ") was not %" FMT_OFF_T "\n",
+                       size, list[i].size);
+          unitfail++;
+        }
+      }
+    }
+    curl_easy_cleanup(curl);
+  }
+  curl_global_cleanup();
+
+  if(!unitfail)
+    curl_mprintf("ok\n");
+
+#endif
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit3200.c b/third-party/curl/tests/unit/unit3200.c
index eff5667720..3a7a37597c 100644
--- a/third-party/curl/tests/unit/unit3200.c
+++ b/third-party/curl/tests/unit/unit3200.c
@@ -21,155 +21,149 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#include "curlcheck.h"
+#include "unitcheck.h"
 #include "curl_get_line.h"
 
-#if !defined(CURL_DISABLE_COOKIES) || !defined(CURL_DISABLE_ALTSVC) ||  \
+static CURLcode test_unit3200(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+#if !defined(CURL_DISABLE_COOKIES) || !defined(CURL_DISABLE_ALTSVC) || \
   !defined(CURL_DISABLE_HSTS) || !defined(CURL_DISABLE_NETRC)
 
-/* The test XML does not supply a way to write files without newlines
- * so we write our own
- */
+#ifdef CURL_HAVE_DIAG
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Woverlength-strings"
+#endif
+
+  /* The test XML does not supply a way to write files without newlines
+   * so we write our own
+   */
 
 #define C64 "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
 #define C256 C64 C64 C64 C64
 #define C1024 C256 C256 C256 C256
 #define C4096 C1024 C1024 C1024 C1024
 
-static CURLcode unit_setup(void)
-{
-  return CURLE_OK;
-}
+  static const char *filecontents[] = {
+    /* Both should be read */
+    "LINE1\n"
+    "LINE2 NEWLINE\n",
 
-static CURLcode unit_stop(void)
-{
-  return CURLE_OK;
-}
+    /* Both should be read */
+    "LINE1\n"
+    "LINE2 NONEWLINE",
 
-#ifdef __GNUC__
-#pragma GCC diagnostic ignored "-Woverlength-strings"
+    /* Only first should be read */
+    "LINE1\n"
+    C4096,
+
+    /* First line should be read */
+    "LINE1\n"
+    C4096 "SOME EXTRA TEXT",
+
+    /* Only first should be read */
+    "LINE1\n"
+    C4096 "SOME EXTRA TEXT\n"
+    "LINE3\n",
+
+    "LINE1\x1aTEST"
+  };
+
+#ifdef CURL_HAVE_DIAG
+#pragma GCC diagnostic pop
 #endif
 
-#define NUMTESTS 6
-static const char *filecontents[] = {
-  /* Both should be read */
-  "LINE1\n"
-  "LINE2 NEWLINE\n",
-
-  /* Both should be read */
-  "LINE1\n"
-  "LINE2 NONEWLINE",
-
-  /* Only first should be read */
-  "LINE1\n"
-  C4096,
-
-  /* First line should be read */
-  "LINE1\n"
-  C4096 "SOME EXTRA TEXT",
-
-  /* First and third line should be read */
-  "LINE1\n"
-  C4096 "SOME EXTRA TEXT\n"
-  "LINE3\n",
-
-  "LINE1\x1aTEST"
-};
-
-#ifdef __GNUC__
-#pragma GCC diagnostic warning "-Woverlength-strings"
-#endif
-
-
-UNITTEST_START
   size_t i;
-  for(i = 0; i < NUMTESTS; i++) {
+  CURLcode result = CURLE_OK;
+  for(i = 0; i < CURL_ARRAYSIZE(filecontents); i++) {
     FILE *fp;
-    char buf[4096];
-    int len = 4096;
-    char *line;
+    struct dynbuf buf;
+    size_t len = 4096;
+    const char *line;
+    bool eof;
+    curlx_dyn_init(&buf, len);
 
-    fp = fopen(arg, "wb");
-    abort_unless(fp != NULL, "Cannot open testfile");
+    fp = curlx_fopen(arg, "wb");
+    abort_unless(fp, "Cannot open testfile");
     fwrite(filecontents[i], 1, strlen(filecontents[i]), fp);
-    fclose(fp);
+    curlx_fclose(fp);
 
-    fp = fopen(arg, "rb");
-    abort_unless(fp != NULL, "Cannot open testfile");
+    fp = curlx_fopen(arg, "rb");
+    abort_unless(fp, "Cannot open testfile");
 
-    fprintf(stderr, "Test %zd...", i);
+    curl_mfprintf(stderr, "Test %zu...", i);
     switch(i) {
-      case 0:
-        line = Curl_get_line(buf, len, fp);
-        fail_unless(line && !strcmp("LINE1\n", line),
-          "First line failed (1)");
-        line = Curl_get_line(buf, len, fp);
-        fail_unless(line && !strcmp("LINE2 NEWLINE\n", line),
-          "Second line failed (1)");
-        line = Curl_get_line(buf, len, fp);
-        abort_unless(line == NULL, "Missed EOF (1)");
-        break;
-      case 1:
-        line = Curl_get_line(buf, len, fp);
-        fail_unless(line && !strcmp("LINE1\n", line),
-          "First line failed (2)");
-        line = Curl_get_line(buf, len, fp);
-        fail_unless(line && !strcmp("LINE2 NONEWLINE\n", line),
-          "Second line failed (2)");
-        line = Curl_get_line(buf, len, fp);
-        abort_unless(line == NULL, "Missed EOF (2)");
-        break;
-      case 2:
-        line = Curl_get_line(buf, len, fp);
-        fail_unless(line && !strcmp("LINE1\n", line),
-          "First line failed (3)");
-        line = Curl_get_line(buf, len, fp);
-        fail_unless(line == NULL,
-          "Did not detect max read on EOF (3)");
-        break;
-      case 3:
-        line = Curl_get_line(buf, len, fp);
-        fail_unless(line && !strcmp("LINE1\n", line),
-          "First line failed (4)");
-        line = Curl_get_line(buf, len, fp);
-        fail_unless(line == NULL,
-          "Did not ignore partial on EOF (4)");
-        break;
-      case 4:
-        line = Curl_get_line(buf, len, fp);
-        fail_unless(line && !strcmp("LINE1\n", line),
-          "First line failed (5)");
-        line = Curl_get_line(buf, len, fp);
-        fail_unless(line && !strcmp("LINE3\n", line),
-          "Third line failed (5)");
-        line = Curl_get_line(buf, len, fp);
-        abort_unless(line == NULL, "Missed EOF (5)");
-        break;
-      case 5:
-        line = Curl_get_line(buf, len, fp);
-        fail_unless(line && !strcmp("LINE1\x1aTEST\n", line),
-          "Missed/Misinterpreted ^Z (6)");
-        line = Curl_get_line(buf, len, fp);
-        abort_unless(line == NULL, "Missed EOF (6)");
-        break;
-      default:
-        abort_unless(1, "Unknown case");
-        break;
+    case 0:
+      result = Curl_get_line(&buf, fp, &eof);
+      line = curlx_dyn_ptr(&buf);
+      fail_unless(!result && line && !strcmp("LINE1\n", line),
+                  "First line failed (1)");
+      result = Curl_get_line(&buf, fp, &eof);
+      line = curlx_dyn_ptr(&buf);
+      fail_unless(!result && line && !strcmp("LINE2 NEWLINE\n", line),
+                  "Second line failed (1)");
+      result = Curl_get_line(&buf, fp, &eof);
+      abort_unless(eof, "Missed EOF (1)");
+      break;
+    case 1:
+      result = Curl_get_line(&buf, fp, &eof);
+      line = curlx_dyn_ptr(&buf);
+      fail_unless(!result && line && !strcmp("LINE1\n", line),
+                  "First line failed (2)");
+      result = Curl_get_line(&buf, fp, &eof);
+      line = curlx_dyn_ptr(&buf);
+      fail_unless(!result && line && !strcmp("LINE2 NONEWLINE\n", line),
+                  "Second line failed (2)");
+      result = Curl_get_line(&buf, fp, &eof);
+      abort_unless(eof, "Missed EOF (2)");
+      break;
+    case 2:
+      result = Curl_get_line(&buf, fp, &eof);
+      line = curlx_dyn_ptr(&buf);
+      fail_unless(!result && line && !strcmp("LINE1\n", line),
+                  "First line failed (3)");
+      result = Curl_get_line(&buf, fp, &eof);
+      fail_unless(!curlx_dyn_len(&buf),
+                  "Did not detect max read on EOF (3)");
+      break;
+    case 3:
+      result = Curl_get_line(&buf, fp, &eof);
+      line = curlx_dyn_ptr(&buf);
+      fail_unless(!result && line && !strcmp("LINE1\n", line),
+                  "First line failed (4)");
+      result = Curl_get_line(&buf, fp, &eof);
+      fail_unless(!curlx_dyn_len(&buf),
+                  "Did not ignore partial on EOF (4)");
+      break;
+    case 4:
+      result = Curl_get_line(&buf, fp, &eof);
+      line = curlx_dyn_ptr(&buf);
+      fail_unless(!result && line && !strcmp("LINE1\n", line),
+                  "First line failed (5)");
+      result = Curl_get_line(&buf, fp, &eof);
+      fail_unless(!curlx_dyn_len(&buf),
+                  "Did not bail out on too long line");
+      break;
+    case 5:
+      result = Curl_get_line(&buf, fp, &eof);
+      line = curlx_dyn_ptr(&buf);
+      fail_unless(!result && line && !strcmp("LINE1\x1aTEST\n", line),
+                  "Missed/Misinterpreted ^Z (6)");
+      result = Curl_get_line(&buf, fp, &eof);
+      abort_unless(eof, "Missed EOF (6)");
+      break;
+    default:
+      abort_unless(1, "Unknown case");
+      break;
     }
-    fclose(fp);
-    fprintf(stderr, "OK\n");
+    curlx_dyn_free(&buf);
+    curlx_fclose(fp);
+    curl_mfprintf(stderr, "OK\n");
   }
-UNITTEST_STOP
-
-#else
-static CURLcode unit_setup(void)
-{
-  return CURLE_OK;
-}
-static void unit_stop(void)
-{
-}
-UNITTEST_START
-UNITTEST_STOP
+  return result;
 
 #endif
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit3205.c b/third-party/curl/tests/unit/unit3205.c
new file mode 100644
index 0000000000..039b679d0a
--- /dev/null
+++ b/third-party/curl/tests/unit/unit3205.c
@@ -0,0 +1,614 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Jan Venekamp, <jan@venekamp.net>
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "vtls/cipher_suite.h"
+
+static CURLcode test_unit3205(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+#if defined(USE_MBEDTLS) || defined(USE_RUSTLS)
+
+  struct test_cs_entry {
+    uint16_t id;
+    const char *rfc;
+    const char *openssl;
+  };
+
+  static const struct test_cs_entry test_cs_list[] = {
+    { 0x1301, "TLS_AES_128_GCM_SHA256",
+              NULL },
+    { 0x1302, "TLS_AES_256_GCM_SHA384",
+              NULL },
+    { 0x1303, "TLS_CHACHA20_POLY1305_SHA256",
+              NULL },
+    { 0x1304, "TLS_AES_128_CCM_SHA256",
+              NULL },
+    { 0x1305, "TLS_AES_128_CCM_8_SHA256",
+              NULL },
+    { 0xC02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+              "ECDHE-ECDSA-AES128-GCM-SHA256" },
+    { 0xC02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+              "ECDHE-ECDSA-AES256-GCM-SHA384" },
+    { 0xC02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+              "ECDHE-RSA-AES128-GCM-SHA256" },
+    { 0xC030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+              "ECDHE-RSA-AES256-GCM-SHA384" },
+    { 0xCCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
+              "ECDHE-RSA-CHACHA20-POLY1305" },
+    { 0xCCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
+              "ECDHE-ECDSA-CHACHA20-POLY1305" },
+#ifdef USE_MBEDTLS
+    { 0x002F, "TLS_RSA_WITH_AES_128_CBC_SHA",
+              "AES128-SHA" },
+    { 0x0035, "TLS_RSA_WITH_AES_256_CBC_SHA",
+              "AES256-SHA" },
+    { 0x003C, "TLS_RSA_WITH_AES_128_CBC_SHA256",
+              "AES128-SHA256" },
+    { 0x003D, "TLS_RSA_WITH_AES_256_CBC_SHA256",
+              "AES256-SHA256" },
+    { 0x009C, "TLS_RSA_WITH_AES_128_GCM_SHA256",
+              "AES128-GCM-SHA256" },
+    { 0x009D, "TLS_RSA_WITH_AES_256_GCM_SHA384",
+              "AES256-GCM-SHA384" },
+    { 0xC004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA",
+              "ECDH-ECDSA-AES128-SHA" },
+    { 0xC005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA",
+              "ECDH-ECDSA-AES256-SHA" },
+    { 0xC009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
+              "ECDHE-ECDSA-AES128-SHA" },
+    { 0xC00A, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
+              "ECDHE-ECDSA-AES256-SHA" },
+    { 0xC00E, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA",
+              "ECDH-RSA-AES128-SHA" },
+    { 0xC00F, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA",
+              "ECDH-RSA-AES256-SHA" },
+    { 0xC013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+              "ECDHE-RSA-AES128-SHA" },
+    { 0xC014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+              "ECDHE-RSA-AES256-SHA" },
+    { 0xC023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
+              "ECDHE-ECDSA-AES128-SHA256" },
+    { 0xC024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
+              "ECDHE-ECDSA-AES256-SHA384" },
+    { 0xC025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256",
+              "ECDH-ECDSA-AES128-SHA256" },
+    { 0xC026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384",
+              "ECDH-ECDSA-AES256-SHA384" },
+    { 0xC027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
+              "ECDHE-RSA-AES128-SHA256" },
+    { 0xC028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
+              "ECDHE-RSA-AES256-SHA384" },
+    { 0xC029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256",
+              "ECDH-RSA-AES128-SHA256" },
+    { 0xC02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384",
+              "ECDH-RSA-AES256-SHA384" },
+    { 0xC02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256",
+              "ECDH-ECDSA-AES128-GCM-SHA256" },
+    { 0xC02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384",
+              "ECDH-ECDSA-AES256-GCM-SHA384" },
+    { 0xC031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256",
+              "ECDH-RSA-AES128-GCM-SHA256" },
+    { 0xC032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384",
+              "ECDH-RSA-AES256-GCM-SHA384" },
+    { 0x0001, "TLS_RSA_WITH_NULL_MD5",
+              "NULL-MD5" },
+    { 0x0002, "TLS_RSA_WITH_NULL_SHA",
+              "NULL-SHA" },
+    { 0x002C, "TLS_PSK_WITH_NULL_SHA",
+              "PSK-NULL-SHA" },
+    { 0x002D, "TLS_DHE_PSK_WITH_NULL_SHA",
+              "DHE-PSK-NULL-SHA" },
+    { 0x002E, "TLS_RSA_PSK_WITH_NULL_SHA",
+              "RSA-PSK-NULL-SHA" },
+    { 0x0033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
+              "DHE-RSA-AES128-SHA" },
+    { 0x0039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
+              "DHE-RSA-AES256-SHA" },
+    { 0x003B, "TLS_RSA_WITH_NULL_SHA256",
+              "NULL-SHA256" },
+    { 0x0067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
+              "DHE-RSA-AES128-SHA256" },
+    { 0x006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
+              "DHE-RSA-AES256-SHA256" },
+    { 0x008C, "TLS_PSK_WITH_AES_128_CBC_SHA",
+              "PSK-AES128-CBC-SHA" },
+    { 0x008D, "TLS_PSK_WITH_AES_256_CBC_SHA",
+              "PSK-AES256-CBC-SHA" },
+    { 0x0090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA",
+              "DHE-PSK-AES128-CBC-SHA" },
+    { 0x0091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA",
+              "DHE-PSK-AES256-CBC-SHA" },
+    { 0x0094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA",
+              "RSA-PSK-AES128-CBC-SHA" },
+    { 0x0095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA",
+              "RSA-PSK-AES256-CBC-SHA" },
+    { 0x009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
+              "DHE-RSA-AES128-GCM-SHA256" },
+    { 0x009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
+              "DHE-RSA-AES256-GCM-SHA384" },
+    { 0x00A8, "TLS_PSK_WITH_AES_128_GCM_SHA256",
+              "PSK-AES128-GCM-SHA256" },
+    { 0x00A9, "TLS_PSK_WITH_AES_256_GCM_SHA384",
+              "PSK-AES256-GCM-SHA384" },
+    { 0x00AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256",
+              "DHE-PSK-AES128-GCM-SHA256" },
+    { 0x00AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384",
+              "DHE-PSK-AES256-GCM-SHA384" },
+    { 0x00AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256",
+              "RSA-PSK-AES128-GCM-SHA256" },
+    { 0x00AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384",
+              "RSA-PSK-AES256-GCM-SHA384" },
+    { 0x00AE, "TLS_PSK_WITH_AES_128_CBC_SHA256",
+              "PSK-AES128-CBC-SHA256" },
+    { 0x00AF, "TLS_PSK_WITH_AES_256_CBC_SHA384",
+              "PSK-AES256-CBC-SHA384" },
+    { 0x00B0, "TLS_PSK_WITH_NULL_SHA256",
+              "PSK-NULL-SHA256" },
+    { 0x00B1, "TLS_PSK_WITH_NULL_SHA384",
+              "PSK-NULL-SHA384" },
+    { 0x00B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256",
+              "DHE-PSK-AES128-CBC-SHA256" },
+    { 0x00B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384",
+              "DHE-PSK-AES256-CBC-SHA384" },
+    { 0x00B4, "TLS_DHE_PSK_WITH_NULL_SHA256",
+              "DHE-PSK-NULL-SHA256" },
+    { 0x00B5, "TLS_DHE_PSK_WITH_NULL_SHA384",
+              "DHE-PSK-NULL-SHA384" },
+    { 0x00B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256",
+              "RSA-PSK-AES128-CBC-SHA256" },
+    { 0x00B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384",
+              "RSA-PSK-AES256-CBC-SHA384" },
+    { 0x00B8, "TLS_RSA_PSK_WITH_NULL_SHA256",
+              "RSA-PSK-NULL-SHA256" },
+    { 0x00B9, "TLS_RSA_PSK_WITH_NULL_SHA384",
+              "RSA-PSK-NULL-SHA384" },
+    { 0xC001, "TLS_ECDH_ECDSA_WITH_NULL_SHA",
+              "ECDH-ECDSA-NULL-SHA" },
+    { 0xC006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA",
+              "ECDHE-ECDSA-NULL-SHA" },
+    { 0xC00B, "TLS_ECDH_RSA_WITH_NULL_SHA",
+              "ECDH-RSA-NULL-SHA" },
+    { 0xC010, "TLS_ECDHE_RSA_WITH_NULL_SHA",
+              "ECDHE-RSA-NULL-SHA" },
+    { 0xC035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA",
+              "ECDHE-PSK-AES128-CBC-SHA" },
+    { 0xC036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA",
+              "ECDHE-PSK-AES256-CBC-SHA" },
+    { 0xCCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256",
+              "PSK-CHACHA20-POLY1305" },
+    { 0xC09C, "TLS_RSA_WITH_AES_128_CCM",
+              "AES128-CCM" },
+    { 0xC09D, "TLS_RSA_WITH_AES_256_CCM",
+              "AES256-CCM" },
+    { 0xC0A0, "TLS_RSA_WITH_AES_128_CCM_8",
+              "AES128-CCM8" },
+    { 0xC0A1, "TLS_RSA_WITH_AES_256_CCM_8",
+              "AES256-CCM8" },
+    { 0xC0AC, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM",
+              "ECDHE-ECDSA-AES128-CCM" },
+    { 0xC0AD, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM",
+              "ECDHE-ECDSA-AES256-CCM" },
+    { 0xC0AE, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8",
+              "ECDHE-ECDSA-AES128-CCM8" },
+    { 0xC0AF, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8",
+              "ECDHE-ECDSA-AES256-CCM8" },
+    /* entries marked ns are non-"standard", they are not in OpenSSL */
+    { 0x0041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA",
+              "CAMELLIA128-SHA" },
+    { 0x0045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA",
+              "DHE-RSA-CAMELLIA128-SHA" },
+    { 0x0084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA",
+              "CAMELLIA256-SHA" },
+    { 0x0088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA",
+              "DHE-RSA-CAMELLIA256-SHA" },
+    { 0x00BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256",
+              "CAMELLIA128-SHA256" },
+    { 0x00BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
+              "DHE-RSA-CAMELLIA128-SHA256" },
+    { 0x00C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256",
+              "CAMELLIA256-SHA256" },
+    { 0x00C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256",
+              "DHE-RSA-CAMELLIA256-SHA256" },
+    { 0xC037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256",
+              "ECDHE-PSK-AES128-CBC-SHA256" },
+    { 0xC038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384",
+              "ECDHE-PSK-AES256-CBC-SHA384" },
+    { 0xC039, "TLS_ECDHE_PSK_WITH_NULL_SHA",
+              "ECDHE-PSK-NULL-SHA" },
+    { 0xC03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256",
+              "ECDHE-PSK-NULL-SHA256" },
+    { 0xC03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384",
+              "ECDHE-PSK-NULL-SHA384" },
+    { 0xC03C, "TLS_RSA_WITH_ARIA_128_CBC_SHA256",
+              "ARIA128-SHA256" /* ns */ },
+    { 0xC03D, "TLS_RSA_WITH_ARIA_256_CBC_SHA384",
+              "ARIA256-SHA384" /* ns */ },
+    { 0xC044, "TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256",
+              "DHE-RSA-ARIA128-SHA256" /* ns */ },
+    { 0xC045, "TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384",
+              "DHE-RSA-ARIA256-SHA384" /* ns */ },
+    { 0xC048, "TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256",
+              "ECDHE-ECDSA-ARIA128-SHA256" /* ns */ },
+    { 0xC049, "TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384",
+              "ECDHE-ECDSA-ARIA256-SHA384" /* ns */ },
+    { 0xC04A, "TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256",
+              "ECDH-ECDSA-ARIA128-SHA256" /* ns */ },
+    { 0xC04B, "TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384",
+              "ECDH-ECDSA-ARIA256-SHA384" /* ns */ },
+    { 0xC04C, "TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256",
+              "ECDHE-ARIA128-SHA256" /* ns */ },
+    { 0xC04D, "TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384",
+              "ECDHE-ARIA256-SHA384" /* ns */ },
+    { 0xC04E, "TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256",
+              "ECDH-ARIA128-SHA256" /* ns */ },
+    { 0xC04F, "TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384",
+              "ECDH-ARIA256-SHA384" /* ns */ },
+    { 0xC050, "TLS_RSA_WITH_ARIA_128_GCM_SHA256",
+              "ARIA128-GCM-SHA256" },
+    { 0xC051, "TLS_RSA_WITH_ARIA_256_GCM_SHA384",
+              "ARIA256-GCM-SHA384" },
+    { 0xC052, "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256",
+              "DHE-RSA-ARIA128-GCM-SHA256" },
+    { 0xC053, "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384",
+              "DHE-RSA-ARIA256-GCM-SHA384" },
+    { 0xC05C, "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256",
+              "ECDHE-ECDSA-ARIA128-GCM-SHA256" },
+    { 0xC05D, "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384",
+              "ECDHE-ECDSA-ARIA256-GCM-SHA384" },
+    { 0xC05E, "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256",
+              "ECDH-ECDSA-ARIA128-GCM-SHA256" /* ns */ },
+    { 0xC05F, "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384",
+              "ECDH-ECDSA-ARIA256-GCM-SHA384" /* ns */ },
+    { 0xC060, "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256",
+              "ECDHE-ARIA128-GCM-SHA256" },
+    { 0xC061, "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384",
+              "ECDHE-ARIA256-GCM-SHA384" },
+    { 0xC062, "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256",
+              "ECDH-ARIA128-GCM-SHA256" /* ns */ },
+    { 0xC063, "TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384",
+              "ECDH-ARIA256-GCM-SHA384" /* ns */ },
+    { 0xC064, "TLS_PSK_WITH_ARIA_128_CBC_SHA256",
+              "PSK-ARIA128-SHA256" /* ns */ },
+    { 0xC065, "TLS_PSK_WITH_ARIA_256_CBC_SHA384",
+              "PSK-ARIA256-SHA384" /* ns */ },
+    { 0xC066, "TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256",
+              "DHE-PSK-ARIA128-SHA256" /* ns */ },
+    { 0xC067, "TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384",
+              "DHE-PSK-ARIA256-SHA384" /* ns */ },
+    { 0xC068, "TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256",
+              "RSA-PSK-ARIA128-SHA256" /* ns */ },
+    { 0xC069, "TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384",
+              "RSA-PSK-ARIA256-SHA384" /* ns */ },
+    { 0xC06A, "TLS_PSK_WITH_ARIA_128_GCM_SHA256",
+              "PSK-ARIA128-GCM-SHA256" },
+    { 0xC06B, "TLS_PSK_WITH_ARIA_256_GCM_SHA384",
+              "PSK-ARIA256-GCM-SHA384" },
+    { 0xC06C, "TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256",
+              "DHE-PSK-ARIA128-GCM-SHA256" },
+    { 0xC06D, "TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384",
+              "DHE-PSK-ARIA256-GCM-SHA384" },
+    { 0xC06E, "TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256",
+              "RSA-PSK-ARIA128-GCM-SHA256" },
+    { 0xC06F, "TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384",
+              "RSA-PSK-ARIA256-GCM-SHA384" },
+    { 0xC070, "TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256",
+              "ECDHE-PSK-ARIA128-SHA256" /* ns */ },
+    { 0xC071, "TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384",
+              "ECDHE-PSK-ARIA256-SHA384" /* ns */ },
+    { 0xC072, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256",
+              "ECDHE-ECDSA-CAMELLIA128-SHA256" },
+    { 0xC073, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384",
+              "ECDHE-ECDSA-CAMELLIA256-SHA384" },
+    { 0xC074, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256",
+              "ECDH-ECDSA-CAMELLIA128-SHA256" /* ns */ },
+    { 0xC075, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384",
+              "ECDH-ECDSA-CAMELLIA256-SHA384" /* ns */ },
+    { 0xC076, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
+              "ECDHE-RSA-CAMELLIA128-SHA256" },
+    { 0xC077, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384",
+              "ECDHE-RSA-CAMELLIA256-SHA384" },
+    { 0xC078, "TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256",
+              "ECDH-CAMELLIA128-SHA256" /* ns */ },
+    { 0xC079, "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384",
+              "ECDH-CAMELLIA256-SHA384" /* ns */ },
+    { 0xC07A, "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256",
+              "CAMELLIA128-GCM-SHA256" /* ns */ },
+    { 0xC07B, "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384",
+              "CAMELLIA256-GCM-SHA384" /* ns */ },
+    { 0xC07C, "TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256",
+              "DHE-RSA-CAMELLIA128-GCM-SHA256" /* ns */ },
+    { 0xC07D, "TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384",
+              "DHE-RSA-CAMELLIA256-GCM-SHA384" /* ns */ },
+    { 0xC086, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256",
+              "ECDHE-ECDSA-CAMELLIA128-GCM-SHA256" /* ns */ },
+    { 0xC087, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384",
+              "ECDHE-ECDSA-CAMELLIA256-GCM-SHA384" /* ns */ },
+    { 0xC088, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256",
+              "ECDH-ECDSA-CAMELLIA128-GCM-SHA256" /* ns */ },
+    { 0xC089, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384",
+              "ECDH-ECDSA-CAMELLIA256-GCM-SHA384" /* ns */ },
+    { 0xC08A, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256",
+              "ECDHE-CAMELLIA128-GCM-SHA256" /* ns */ },
+    { 0xC08B, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384",
+              "ECDHE-CAMELLIA256-GCM-SHA384" /* ns */ },
+    { 0xC08C, "TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256",
+              "ECDH-CAMELLIA128-GCM-SHA256" /* ns */ },
+    { 0xC08D, "TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384",
+              "ECDH-CAMELLIA256-GCM-SHA384" /* ns */ },
+    { 0xC08E, "TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256",
+              "PSK-CAMELLIA128-GCM-SHA256" /* ns */ },
+    { 0xC08F, "TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384",
+              "PSK-CAMELLIA256-GCM-SHA384" /* ns */ },
+    { 0xC090, "TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256",
+              "DHE-PSK-CAMELLIA128-GCM-SHA256" /* ns */ },
+    { 0xC091, "TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384",
+              "DHE-PSK-CAMELLIA256-GCM-SHA384" /* ns */ },
+    { 0xC092, "TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256",
+              "RSA-PSK-CAMELLIA128-GCM-SHA256" /* ns */ },
+    { 0xC093, "TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384",
+              "RSA-PSK-CAMELLIA256-GCM-SHA384" /* ns */ },
+    { 0xC094, "TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256",
+              "PSK-CAMELLIA128-SHA256" },
+    { 0xC095, "TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384",
+              "PSK-CAMELLIA256-SHA384" },
+    { 0xC096, "TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256",
+              "DHE-PSK-CAMELLIA128-SHA256" },
+    { 0xC097, "TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384",
+              "DHE-PSK-CAMELLIA256-SHA384" },
+    { 0xC098, "TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256",
+              "RSA-PSK-CAMELLIA128-SHA256" },
+    { 0xC099, "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384",
+              "RSA-PSK-CAMELLIA256-SHA384" },
+    { 0xC09A, "TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256",
+              "ECDHE-PSK-CAMELLIA128-SHA256" },
+    { 0xC09B, "TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384",
+              "ECDHE-PSK-CAMELLIA256-SHA384" },
+    { 0xC09E, "TLS_DHE_RSA_WITH_AES_128_CCM",
+              "DHE-RSA-AES128-CCM" },
+    { 0xC09F, "TLS_DHE_RSA_WITH_AES_256_CCM",
+              "DHE-RSA-AES256-CCM" },
+    { 0xC0A2, "TLS_DHE_RSA_WITH_AES_128_CCM_8",
+              "DHE-RSA-AES128-CCM8" },
+    { 0xC0A3, "TLS_DHE_RSA_WITH_AES_256_CCM_8",
+              "DHE-RSA-AES256-CCM8" },
+    { 0xC0A4, "TLS_PSK_WITH_AES_128_CCM",
+              "PSK-AES128-CCM" },
+    { 0xC0A5, "TLS_PSK_WITH_AES_256_CCM",
+              "PSK-AES256-CCM" },
+    { 0xC0A6, "TLS_DHE_PSK_WITH_AES_128_CCM",
+              "DHE-PSK-AES128-CCM" },
+    { 0xC0A7, "TLS_DHE_PSK_WITH_AES_256_CCM",
+              "DHE-PSK-AES256-CCM" },
+    { 0xC0A8, "TLS_PSK_WITH_AES_128_CCM_8",
+              "PSK-AES128-CCM8" },
+    { 0xC0A9, "TLS_PSK_WITH_AES_256_CCM_8",
+              "PSK-AES256-CCM8" },
+    { 0xC0AA, "TLS_PSK_DHE_WITH_AES_128_CCM_8",
+              "DHE-PSK-AES128-CCM8" },
+    { 0xC0AB, "TLS_PSK_DHE_WITH_AES_256_CCM_8",
+              "DHE-PSK-AES256-CCM8" },
+    { 0xCCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
+              "DHE-RSA-CHACHA20-POLY1305" },
+    { 0xCCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256",
+              "ECDHE-PSK-CHACHA20-POLY1305" },
+    { 0xCCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256",
+              "DHE-PSK-CHACHA20-POLY1305" },
+    { 0xCCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256",
+              "RSA-PSK-CHACHA20-POLY1305" },
+#endif
+  };
+
+  static const char *cs_test_string =
+    "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:"
+    "TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:"
+    "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:"
+    "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:"
+    "ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:"
+    "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:"
+    "ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:"
+    "ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:"
+    "ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:"
+    "DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:"
+    "AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:"
+    "DES-CBC3-SHA:"
+    ":: GIBBERISH ::"
+  ;
+
+  struct test_str_entry {
+    uint16_t id;
+    const char *str;
+  };
+  static const struct test_str_entry test_str_list[] = {
+    { 0x1301, "TLS_AES_128_GCM_SHA256" },
+    { 0x1302, "TLS_AES_256_GCM_SHA384" },
+    { 0x1303, "TLS_CHACHA20_POLY1305_SHA256" },
+    { 0xC02B, "ECDHE-ECDSA-AES128-GCM-SHA256" },
+    { 0xC02F, "ECDHE-RSA-AES128-GCM-SHA256" },
+    { 0xC02C, "ECDHE-ECDSA-AES256-GCM-SHA384" },
+    { 0xC030, "ECDHE-RSA-AES256-GCM-SHA384" },
+    { 0xCCA9, "ECDHE-ECDSA-CHACHA20-POLY1305" },
+    { 0xCCA8, "ECDHE-RSA-CHACHA20-POLY1305" },
+#ifdef USE_MBEDTLS
+    { 0x009E, "DHE-RSA-AES128-GCM-SHA256" },
+    { 0x009F, "DHE-RSA-AES256-GCM-SHA384" },
+#else
+    { 0x0000, "DHE-RSA-AES128-GCM-SHA256" },
+    { 0x0000, "DHE-RSA-AES256-GCM-SHA384" },
+#endif
+#ifdef USE_MBEDTLS
+    { 0xCCAA, "DHE-RSA-CHACHA20-POLY1305" },
+#else
+    { 0x0000, "DHE-RSA-CHACHA20-POLY1305" },
+#endif
+#ifdef USE_MBEDTLS
+    { 0xC023, "ECDHE-ECDSA-AES128-SHA256" },
+    { 0xC027, "ECDHE-RSA-AES128-SHA256" },
+    { 0xC009, "ECDHE-ECDSA-AES128-SHA" },
+    { 0xC013, "ECDHE-RSA-AES128-SHA" },
+    { 0xC024, "ECDHE-ECDSA-AES256-SHA384" },
+    { 0xC028, "ECDHE-RSA-AES256-SHA384" },
+    { 0xC00A, "ECDHE-ECDSA-AES256-SHA" },
+    { 0xC014, "ECDHE-RSA-AES256-SHA" },
+#else
+    { 0x0000, "ECDHE-ECDSA-AES128-SHA256" },
+    { 0x0000, "ECDHE-RSA-AES128-SHA256" },
+    { 0x0000, "ECDHE-ECDSA-AES128-SHA" },
+    { 0x0000, "ECDHE-RSA-AES128-SHA" },
+    { 0x0000, "ECDHE-ECDSA-AES256-SHA384" },
+    { 0x0000, "ECDHE-RSA-AES256-SHA384" },
+    { 0x0000, "ECDHE-ECDSA-AES256-SHA" },
+    { 0x0000, "ECDHE-RSA-AES256-SHA" },
+#endif
+#ifdef USE_MBEDTLS
+    { 0x0067, "DHE-RSA-AES128-SHA256" },
+    { 0x006B, "DHE-RSA-AES256-SHA256" },
+#else
+    { 0x0000, "DHE-RSA-AES128-SHA256" },
+    { 0x0000, "DHE-RSA-AES256-SHA256" },
+#endif
+#ifdef USE_MBEDTLS
+    { 0x009C, "AES128-GCM-SHA256" },
+    { 0x009D, "AES256-GCM-SHA384" },
+    { 0x003C, "AES128-SHA256" },
+    { 0x003D, "AES256-SHA256" },
+    { 0x002F, "AES128-SHA" },
+    { 0x0035, "AES256-SHA" },
+#else
+    { 0x0000, "AES128-GCM-SHA256" },
+    { 0x0000, "AES256-GCM-SHA384" },
+    { 0x0000, "AES128-SHA256" },
+    { 0x0000, "AES256-SHA256" },
+    { 0x0000, "AES128-SHA" },
+    { 0x0000, "AES256-SHA" },
+#endif
+    { 0x0000, "DES-CBC3-SHA" },
+    { 0x0000, "GIBBERISH" },
+    { 0x0000, "" },
+  };
+
+  size_t i;
+  for(i = 0; i < CURL_ARRAYSIZE(test_cs_list); i++) {
+    const struct test_cs_entry *test = &test_cs_list[i];
+    const char *expect;
+    char buf[64] = "";
+    char alt[64] = "";
+    uint16_t id;
+
+    /* test Curl_cipher_suite_lookup_id() for rfc name */
+    if(test->rfc) {
+      id = Curl_cipher_suite_lookup_id(test->rfc, strlen(test->rfc));
+      if(id != test->id) {
+        curl_mfprintf(stderr, "Curl_cipher_suite_lookup_id FAILED for \"%s\", "
+                      "result = 0x%04x, expected = 0x%04x\n",
+                      test->rfc, id, test->id);
+        unitfail++;
+      }
+    }
+
+    /* test Curl_cipher_suite_lookup_id() for OpenSSL name */
+    if(test->openssl) {
+      id = Curl_cipher_suite_lookup_id(test->openssl, strlen(test->openssl));
+      if(id != test->id) {
+        curl_mfprintf(stderr, "Curl_cipher_suite_lookup_id FAILED for \"%s\", "
+                      "result = 0x%04x, expected = 0x%04x\n",
+                      test->openssl, id, test->id);
+        unitfail++;
+      }
+    }
+
+    /* test Curl_cipher_suite_get_str() prefer rfc name */
+    buf[0] = '\0';
+    expect = test->rfc ? test->rfc : test->openssl;
+
+    Curl_cipher_suite_get_str(test->id, buf, sizeof(buf), TRUE);
+
+    if(expect && strcmp(buf, expect)) {
+      curl_mfprintf(stderr, "Curl_cipher_suite_get_str FAILED for 0x%04x, "
+                    "result = \"%s\", expected = \"%s\"\n",
+                    test->id, buf, expect);
+      unitfail++;
+    }
+
+    /* test Curl_cipher_suite_get_str() prefer OpenSSL name */
+    buf[0] = '\0';
+    expect = test->openssl ? test->openssl : test->rfc;
+
+    Curl_cipher_suite_get_str(test->id, buf, sizeof(buf), FALSE);
+
+    /* suites matched by EDH alias return the DHE name */
+    if(test->id >= 0x0011 && test->id < 0x0017) {
+      if(expect && !memcmp(expect, "EDH-", 4)) {
+        curlx_strcopy(alt, sizeof(alt), expect, strlen(expect));
+        expect = (const char *)memcpy(alt, "DHE-", sizeof("DHE-") - 1);
+      }
+      if(expect && !memcmp(expect + 4, "EDH-", 4)) {
+        curlx_strcopy(alt, sizeof(alt), expect, strlen(expect));
+        expect = (const char *)memcpy(alt + 4, "DHE-", sizeof("DHE-") - 1) - 4;
+      }
+    }
+
+    if(expect && strcmp(buf, expect)) {
+      curl_mfprintf(stderr, "Curl_cipher_suite_get_str FAILED for 0x%04x, "
+                    "result = \"%s\", expected = \"%s\"\n",
+                    test->id, buf, expect);
+      unitfail++;
+    }
+  }
+
+  /* test Curl_cipher_suite_walk_str() */
+  {
+    const char *ptr, *end = cs_test_string;
+    int j = 0;
+    uint16_t id;
+    size_t len;
+
+    for(ptr = cs_test_string; ptr[0] != '\0'; ptr = end) {
+      const struct test_str_entry *test = &test_str_list[j];
+      abort_if(j == CURL_ARRAYSIZE(test_str_list), "should have been done");
+
+      id = Curl_cipher_suite_walk_str(&ptr, &end);
+      len = end - ptr;
+
+      if(id != test->id) {
+        curl_mfprintf(stderr, "Curl_cipher_suite_walk_str FAILED for \"%s\" "
+                      "unexpected cipher, "
+                      "result = 0x%04x, expected = 0x%04x\n",
+                      test->str, id, test->id);
+        unitfail++;
+      }
+      if(len > 64 || strncmp(ptr, test->str, len)) {
+        curl_mfprintf(stderr, "Curl_cipher_suite_walk_str ABORT for \"%s\" "
+                      "unexpected pointers\n",
+                      test->str);
+        unitfail++;
+        goto unit_test_abort;
+      }
+      j++;
+    }
+  }
+#endif /* USE_MBEDTLS || USE_RUSTLS */
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit3211.c b/third-party/curl/tests/unit/unit3211.c
new file mode 100644
index 0000000000..0d1dde200d
--- /dev/null
+++ b/third-party/curl/tests/unit/unit3211.c
@@ -0,0 +1,149 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "urldata.h"
+#include "uint-bset.h"
+#include "curl_trc.h"
+
+static void check_set(const char *name, uint32_t capacity,
+                      const uint32_t *s, size_t slen)
+{
+  struct uint32_bset bset;
+  size_t i, j;
+  uint32_t n, c;
+
+  curl_mfprintf(stderr, "test %s, capacity=%u, %zu numbers\n",
+                name, capacity, slen);
+  Curl_uint32_bset_init(&bset);
+  fail_unless(!Curl_uint32_bset_resize(&bset, capacity), "bset resize failed");
+  c = uint32_bset_capacity(&bset);
+  fail_unless(c == (((capacity + 63) / 64) * 64), "wrong capacity");
+
+  Curl_uint32_bset_clear(&bset);
+  c = Curl_uint32_bset_count(&bset);
+  fail_unless(c == 0, "set count is not 0");
+
+  for(i = 0; i < slen; ++i) { /* add all */
+    fail_unless(Curl_uint32_bset_add(&bset, s[i]), "failed to add");
+    for(j = i + 1; j < slen; ++j)
+      fail_unless(!Curl_uint32_bset_contains(&bset, s[j]),
+                  "unexpectedly found");
+  }
+
+  for(i = 0; i < slen; ++i) { /* all present */
+    fail_unless(Curl_uint32_bset_contains(&bset, s[i]),
+                "failed presence check");
+  }
+
+  /* iterator over all numbers */
+  fail_unless(Curl_uint32_bset_first(&bset, &n), "first failed");
+  fail_unless(n == s[0], "first not correct number");
+  for(i = 1; i < slen; ++i) {
+    fail_unless(Curl_uint32_bset_next(&bset, n, &n), "next failed");
+    if(n != s[i]) {
+      curl_mfprintf(stderr, "expected next to be %u, not %u\n", s[i], n);
+      fail_unless(n == s[i], "next not correct number");
+    }
+  }
+
+  /* Adding capacity number does not work (0 - capacity-1) */
+  c = uint32_bset_capacity(&bset);
+  fail_unless(!Curl_uint32_bset_add(&bset, c), "add out of range worked");
+  /* The count it correct */
+  c = Curl_uint32_bset_count(&bset);
+  fail_unless(c == slen, "set count is wrong");
+
+  for(i = 0; i < slen; i += 2) { /* remove every 2nd */
+    Curl_uint32_bset_remove(&bset, s[i]);
+    fail_unless(!Curl_uint32_bset_contains(&bset, s[i]), "unexpectedly found");
+  }
+  for(i = 1; i < slen; i += 2) { /* others still there */
+    fail_unless(Curl_uint32_bset_contains(&bset, s[i]), "unexpectedly gone");
+  }
+  /* The count is half */
+  c = Curl_uint32_bset_count(&bset);
+  fail_unless(c == slen / 2, "set count is wrong");
+
+  Curl_uint32_bset_clear(&bset);
+  c = Curl_uint32_bset_count(&bset);
+  fail_unless(c == 0, "set count is not 0");
+  for(i = 0; i < slen; i++) { /* none present any longer */
+    fail_unless(!Curl_uint32_bset_contains(&bset, s[i]), "unexpectedly there");
+  }
+
+  for(i = 0; i < slen; ++i) { /* add all again */
+    fail_unless(Curl_uint32_bset_add(&bset, s[i]), "failed to add");
+  }
+
+  fail_unless(!Curl_uint32_bset_resize(&bset, capacity * 2),
+              "resize double failed");
+  for(i = 0; i < slen; i++) { /* all still present after resize */
+    fail_unless(Curl_uint32_bset_contains(&bset, s[i]), "unexpectedly lost");
+  }
+
+  fail_unless(!Curl_uint32_bset_resize(&bset, capacity), "resize back failed");
+  for(i = 0; i < slen; i++)  /* all still present after resize back */
+    fail_unless(Curl_uint32_bset_contains(&bset, s[i]), "unexpectedly lost");
+
+  fail_unless(!Curl_uint32_bset_resize(&bset, capacity / 2),
+              "resize half failed");
+  /* halved the size, what numbers remain in set? */
+  c = uint32_bset_capacity(&bset);
+  n = 0;
+  for(i = 0; i < slen; ++i) {
+    if(s[i] < c)
+      ++n;
+  }
+  fail_unless(n == Curl_uint32_bset_count(&bset), "set count(halved) wrong");
+  for(i = 0; i < n; i++)  /* still present after resize half */
+    fail_unless(Curl_uint32_bset_contains(&bset, s[i]), "unexpectedly lost");
+
+  Curl_uint32_bset_destroy(&bset);
+}
+
+static CURLcode test_unit3211(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  static const uint32_t s1[] = {
+    /* spread numbers, some at slot edges */
+    0, 1, 4, 17, 63, 64, 65, 66, 90, 99,
+  };
+  static const uint32_t s2[] = {
+    /* set with all bits in slot1 set */
+    64, 65, 66, 67, 68, 69, 70, 71,
+    72, 73, 74, 75, 76, 77, 78, 79,
+    80, 81, 82, 83, 84, 85, 86, 87,
+    88, 89, 90, 91, 92, 93, 94, 95,
+    96, 97, 98, 99, 100, 101, 102, 103,
+    104, 105, 106, 107, 108, 109, 110, 111,
+    112, 113, 114, 115, 116, 117, 118, 119,
+    120, 121, 122, 123, 124, 125, 126, 127,
+  };
+
+  check_set("s1", 100, s1, CURL_ARRAYSIZE(s1));
+  check_set("s2", 1000, s2, CURL_ARRAYSIZE(s2));
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit3212.c b/third-party/curl/tests/unit/unit3212.c
new file mode 100644
index 0000000000..26a2209721
--- /dev/null
+++ b/third-party/curl/tests/unit/unit3212.c
@@ -0,0 +1,134 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "urldata.h"
+#include "uint-table.h"
+#include "curl_trc.h"
+
+#define TBL_SIZE 100
+
+static CURLcode t3212_setup(struct uint32_tbl *tbl)
+{
+  Curl_uint32_tbl_init(tbl, NULL);
+  return Curl_uint32_tbl_resize(tbl, TBL_SIZE);
+}
+
+static void t3212_stop(struct uint32_tbl *tbl)
+{
+  Curl_uint32_tbl_destroy(tbl);
+}
+
+static CURLcode test_unit3212(const char *arg)
+{
+  struct uint32_tbl tbl;
+  int dummy;
+
+  UNITTEST_BEGIN(t3212_setup(&tbl))
+
+  uint32_t i, key, n;
+  void *entry;
+
+  fail_unless(Curl_uint32_tbl_capacity(&tbl) == TBL_SIZE, "wrong capacity");
+
+  for(i = 0; i < TBL_SIZE; ++i) {
+    fail_unless(Curl_uint32_tbl_add(&tbl, &dummy, &key), "failed to add");
+    fail_unless(key == i, "unexpected key assigned");
+  }
+  /* table should be full now */
+  fail_unless(Curl_uint32_tbl_count(&tbl) == TBL_SIZE, "wrong count");
+  fail_unless(!Curl_uint32_tbl_add(&tbl, &dummy, &key), "could add more");
+  /* remove every 2nd entry, from full table */
+  n = TBL_SIZE;
+  for(i = 0; i < TBL_SIZE; i += 2) {
+    Curl_uint32_tbl_remove(&tbl, i);
+    --n;
+    fail_unless(Curl_uint32_tbl_count(&tbl) == n, "wrong count after remove");
+  }
+  /* remove same again, should not change count */
+  for(i = 0; i < TBL_SIZE; i += 2) {
+    Curl_uint32_tbl_remove(&tbl, i);
+    fail_unless(Curl_uint32_tbl_count(&tbl) == n, "wrong count after remove");
+  }
+  /* still contains all odd entries */
+  for(i = 1; i < TBL_SIZE; i += 2) {
+    fail_unless(Curl_uint32_tbl_contains(&tbl, i), "does not contain");
+    fail_unless(Curl_uint32_tbl_get(&tbl, i) == &dummy,
+                "does not contain dummy");
+  }
+  /* get the first key */
+  fail_unless(Curl_uint32_tbl_first(&tbl, &key, &entry), "first failed");
+  fail_unless(key == 1, "unexpected first key");
+  fail_unless(entry == &dummy, "unexpected first entry");
+  /* get the second key */
+  fail_unless(Curl_uint32_tbl_next(&tbl, 1, &key, &entry), "next1 failed");
+  fail_unless(key == 3, "unexpected second key");
+  fail_unless(entry == &dummy, "unexpected second entry");
+  /* get the key after 42 */
+  fail_unless(Curl_uint32_tbl_next(&tbl, 42, &key, &entry), "next42 failed");
+  fail_unless(key == 43, "unexpected next42 key");
+  fail_unless(entry == &dummy, "unexpected next42 entry");
+
+  /* double capacity */
+  n = Curl_uint32_tbl_count(&tbl);
+  fail_unless(!Curl_uint32_tbl_resize(&tbl, TBL_SIZE * 2),
+              "error doubling size");
+  fail_unless(Curl_uint32_tbl_count(&tbl) == n, "wrong resize count");
+  /* resize to half of original */
+  fail_unless(!Curl_uint32_tbl_resize(&tbl, TBL_SIZE / 2),
+              "error halving size");
+  fail_unless(Curl_uint32_tbl_count(&tbl) == n / 2, "wrong half size count");
+  for(i = 1; i < TBL_SIZE / 2; i += 2) {
+    fail_unless(Curl_uint32_tbl_contains(&tbl, i), "does not contain");
+    fail_unless(Curl_uint32_tbl_get(&tbl, i) == &dummy,
+                "does not contain dummy");
+  }
+  /* clear */
+  uint32_tbl_clear(&tbl);
+  fail_unless(!Curl_uint32_tbl_count(&tbl), "count not 0 after clear");
+  for(i = 0; i < TBL_SIZE / 2; ++i) {
+    fail_unless(!Curl_uint32_tbl_contains(&tbl, i),
+                "does contain, should not");
+  }
+  /* add after clear gets key 0 again */
+  fail_unless(Curl_uint32_tbl_add(&tbl, &dummy, &key), "failed to add");
+  fail_unless(key == 0, "unexpected key assigned");
+  /* remove it again and add, should get key 1 */
+  Curl_uint32_tbl_remove(&tbl, key);
+  fail_unless(Curl_uint32_tbl_add(&tbl, &dummy, &key), "failed to add");
+  fail_unless(key == 1, "unexpected key assigned");
+  /* clear, fill, remove one, add, should get the removed key again */
+  uint32_tbl_clear(&tbl);
+  for(i = 0; i < Curl_uint32_tbl_capacity(&tbl); ++i)
+    fail_unless(Curl_uint32_tbl_add(&tbl, &dummy, &key), "failed to add");
+  fail_unless(!Curl_uint32_tbl_add(&tbl, &dummy, &key), "add on full");
+  Curl_uint32_tbl_remove(&tbl, 17);
+  fail_unless(Curl_uint32_tbl_add(&tbl, &dummy, &key), "failed to add again");
+  fail_unless(key == 17, "unexpected key assigned");
+  /* and again, triggering key search wrap around */
+  Curl_uint32_tbl_remove(&tbl, 17);
+  fail_unless(Curl_uint32_tbl_add(&tbl, &dummy, &key), "failed to add again");
+  fail_unless(key == 17, "unexpected key assigned");
+
+  UNITTEST_END(t3212_stop(&tbl))
+}
diff --git a/third-party/curl/tests/unit/unit3213.c b/third-party/curl/tests/unit/unit3213.c
new file mode 100644
index 0000000000..85437511a7
--- /dev/null
+++ b/third-party/curl/tests/unit/unit3213.c
@@ -0,0 +1,123 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "urldata.h"
+#include "uint-spbset.h"
+#include "curl_trc.h"
+
+static void check_spbset(const char *name, const uint32_t *s, size_t slen)
+{
+  struct uint32_spbset bset;
+  size_t i, j;
+  uint32_t c, n;
+
+  curl_mfprintf(stderr, "test %s, %zu numbers\n", name, slen);
+
+  Curl_uint32_spbset_init(&bset);
+
+  uint32_spbset_clear(&bset);
+  c = Curl_uint32_spbset_count(&bset);
+  fail_unless(c == 0, "set count is not 0");
+
+  for(i = 0; i < slen; ++i) { /* add all */
+    fail_unless(Curl_uint32_spbset_add(&bset, s[i]), "failed to add");
+    for(j = i + 1; j < slen; ++j)
+      fail_unless(!Curl_uint32_spbset_contains(&bset, s[j]),
+                  "unexpectedly found");
+  }
+
+  for(i = 0; i < slen; ++i) { /* all present */
+    fail_unless(Curl_uint32_spbset_contains(&bset, s[i]),
+                "failed presence check");
+  }
+
+  /* iterator over all numbers */
+  fail_unless(Curl_uint32_spbset_first(&bset, &n), "first failed");
+  fail_unless(n == s[0], "first not correct number");
+  for(i = 1; i < slen; ++i) {
+    fail_unless(Curl_uint32_spbset_next(&bset, n, &n), "next failed");
+    if(n != s[i]) {
+      curl_mfprintf(stderr, "expected next to be %u, not %u\n", s[i], n);
+      fail_unless(n == s[i], "next not correct number");
+    }
+  }
+
+  for(i = 0; i < slen; i += 2) { /* remove every 2nd */
+    Curl_uint32_spbset_remove(&bset, s[i]);
+    fail_unless(!Curl_uint32_spbset_contains(&bset, s[i]),
+                "unexpectedly found");
+  }
+  for(i = 1; i < slen; i += 2) { /* others still there */
+    fail_unless(Curl_uint32_spbset_contains(&bset, s[i]), "unexpectedly gone");
+  }
+  /* The count is half */
+  c = Curl_uint32_spbset_count(&bset);
+  fail_unless(c == slen / 2, "set count is wrong");
+
+  uint32_spbset_clear(&bset);
+  c = Curl_uint32_spbset_count(&bset);
+  fail_unless(c == 0, "set count is not 0");
+  for(i = 0; i < slen; i++) { /* none present any longer */
+    fail_unless(!Curl_uint32_spbset_contains(&bset, s[i]),
+                "unexpectedly there");
+  }
+
+  for(i = 0; i < slen; ++i) { /* add all again */
+    fail_unless(Curl_uint32_spbset_add(&bset, s[i]), "failed to add");
+  }
+
+  Curl_uint32_spbset_destroy(&bset);
+}
+
+static CURLcode test_unit3213(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  static const uint32_t s1[] = {
+    /* spread numbers, some at slot edges */
+    0, 1, 4, 17, 63, 64, 65, 66, 90, 99,
+  };
+  static const uint32_t s2[] = {
+    /* set with all bits in slot1 set */
+    64, 65, 66, 67, 68, 69, 70, 71,
+    72, 73, 74, 75, 76, 77, 78, 79,
+    80, 81, 82, 83, 84, 85, 86, 87,
+    88, 89, 90, 91, 92, 93, 94, 95,
+    96, 97, 98, 99, 100, 101, 102, 103,
+    104, 105, 106, 107, 108, 109, 110, 111,
+    112, 113, 114, 115, 116, 117, 118, 119,
+    120, 121, 122, 123, 124, 125, 126, 127,
+  };
+  static const uint32_t s3[] = {
+    /* very spread numbers */
+    2232, 5167, 8204, 8526, 8641, 10056, 10140, 10611,
+    10998, 11626, 13735, 15539, 17947, 24295, 27833, 30318,
+  };
+
+  check_spbset("s1", s1, CURL_ARRAYSIZE(s1));
+  check_spbset("s2", s2, CURL_ARRAYSIZE(s2));
+  check_spbset("s3", s3, CURL_ARRAYSIZE(s3));
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit3214.c b/third-party/curl/tests/unit/unit3214.c
new file mode 100644
index 0000000000..8f22f53cc6
--- /dev/null
+++ b/third-party/curl/tests/unit/unit3214.c
@@ -0,0 +1,85 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "urldata.h"
+
+static void checksize(const char *name, size_t size, size_t allowed)
+{
+  if(size > allowed) {
+    curl_mfprintf(stderr, "BAD: struct %s is %zu bytes, "
+                  "allowed to be %zu: %zu bytes too big\n",
+                  name, size, allowed, size - allowed);
+    unitfail++;
+  }
+  else {
+    curl_mprintf("FINE: struct %s is %zu bytes, "
+                 "allowed %zu (margin: %zu bytes)\n",
+                 name, size, allowed, allowed - size);
+  }
+}
+
+/* the maximum sizes we allow specific structs to grow to */
+#define MAX_CURL_EASY           5370
+#define MAX_CONNECTDATA         1300
+#define MAX_CURL_MULTI          850
+#define MAX_CURL_HTTPPOST       112
+#define MAX_CURL_SLIST          16
+#define MAX_CURL_KHKEY          24
+#define MAX_CURL_HSTSENTRY      40
+#define MAX_CURL_INDEX          16
+#define MAX_CURL_MIME           96
+#define MAX_CURL_MIMEPART       440
+#define MAX_CURL_CERTINFO       16
+#define MAX_CURL_TLSSESSIONINFO 16
+#define MAX_CURL_BLOB           24
+#define MAX_CURLMSG             24
+#define MAX_CURL_HEADER         48
+
+static CURLcode test_unit3214(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  checksize("Curl_easy", sizeof(struct Curl_easy), MAX_CURL_EASY);
+  checksize("connectdata", sizeof(struct connectdata), MAX_CONNECTDATA);
+  checksize("Curl_multi", sizeof(struct Curl_multi), MAX_CURL_MULTI);
+
+  /* public structs MUST NOT change (unless controlled), but exact sizes
+     depend on architecture */
+  checksize("curl_httppost", sizeof(struct curl_httppost), MAX_CURL_HTTPPOST);
+  checksize("curl_slist", sizeof(struct curl_slist), MAX_CURL_SLIST);
+  checksize("curl_khkey", sizeof(struct curl_khkey), MAX_CURL_KHKEY);
+  checksize("curl_hstsentry", sizeof(struct curl_hstsentry),
+            MAX_CURL_HSTSENTRY);
+  checksize("curl_index", sizeof(struct curl_index), MAX_CURL_INDEX);
+  checksize("curl_mime", sizeof(struct curl_mime), MAX_CURL_MIME);
+  checksize("curl_mimepart", sizeof(struct curl_mimepart), MAX_CURL_MIMEPART);
+  checksize("curl_certinfo", sizeof(struct curl_certinfo), MAX_CURL_CERTINFO);
+  checksize("curl_tlssessioninfo", sizeof(struct curl_tlssessioninfo),
+            MAX_CURL_TLSSESSIONINFO);
+  checksize("curl_blob", sizeof(struct curl_blob), MAX_CURL_BLOB);
+  checksize("CURLMsg", sizeof(struct CURLMsg), MAX_CURLMSG);
+  checksize("curl_header", sizeof(struct curl_header), MAX_CURL_HEADER);
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit3216.c b/third-party/curl/tests/unit/unit3216.c
new file mode 100644
index 0000000000..6bf922545f
--- /dev/null
+++ b/third-party/curl/tests/unit/unit3216.c
@@ -0,0 +1,103 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "ratelimit.h"
+
+static CURLcode test_unit3216(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+  struct Curl_rlimit r;
+  struct curltime ts;
+
+  /* A ratelimit that is unlimited */
+  ts = curlx_now();
+  Curl_rlimit_init(&r, 0, 0, &ts);
+  fail_unless(Curl_rlimit_avail(&r, &ts) == CURL_OFF_T_MAX, "inf");
+  Curl_rlimit_drain(&r, 1000000, &ts);
+  fail_unless(Curl_rlimit_avail(&r, &ts) == CURL_OFF_T_MAX, "drain keep inf");
+  fail_unless(Curl_rlimit_wait_ms(&r, &ts) == 0, "inf never waits");
+
+  Curl_rlimit_block(&r, TRUE, &ts);
+  fail_unless(Curl_rlimit_avail(&r, &ts) == 0, "inf blocked to 0");
+  Curl_rlimit_drain(&r, 1000000, &ts);
+  fail_unless(Curl_rlimit_avail(&r, &ts) == 0, "blocked inf");
+  Curl_rlimit_block(&r, FALSE, &ts);
+  fail_unless(Curl_rlimit_avail(&r, &ts) == CURL_OFF_T_MAX,
+              "unblocked unlimited");
+
+  /* A ratelimit that give 10 tokens per second */
+  ts = curlx_now();
+  Curl_rlimit_init(&r, 10, 0, &ts);
+  fail_unless(Curl_rlimit_avail(&r, &ts) == 10, "initial 10");
+  Curl_rlimit_drain(&r, 5, &ts);
+  fail_unless(Curl_rlimit_avail(&r, &ts) == 5, "drain to 5");
+  Curl_rlimit_drain(&r, 3, &ts);
+  fail_unless(Curl_rlimit_avail(&r, &ts) == 2, "drain to 2");
+  ts.tv_usec += 1000; /* 1ms */
+  Curl_rlimit_drain(&r, 3, &ts);
+  fail_unless(Curl_rlimit_avail(&r, &ts) == -1, "drain to -1");
+  fail_unless(Curl_rlimit_wait_ms(&r, &ts) == 1099, "wait 1099ms");
+  ts.tv_usec += 1000; /* 1ms */
+  fail_unless(Curl_rlimit_wait_ms(&r, &ts) == 1098, "wait 1098ms");
+  ts.tv_sec += 1;
+  fail_unless(Curl_rlimit_avail(&r, &ts) == 9, "10 inc per sec");
+  ts.tv_sec += 1;
+  fail_unless(Curl_rlimit_avail(&r, &ts) == 19, "10 inc per sec(2)");
+
+  ts = curlx_now();
+  Curl_rlimit_block(&r, TRUE, &ts);
+  fail_unless(Curl_rlimit_avail(&r, &ts) == 0, "10 blocked to 0");
+  Curl_rlimit_block(&r, FALSE, &ts);
+  fail_unless(Curl_rlimit_avail(&r, &ts) == 10, "unblocked 10");
+
+  /* A ratelimit that give 10 tokens per second, max burst 15/s */
+  ts = curlx_now();
+  Curl_rlimit_init(&r, 10, 15, &ts);
+  fail_unless(Curl_rlimit_avail(&r, &ts) == 10, "initial 10");
+  Curl_rlimit_drain(&r, 5, &ts);
+  fail_unless(Curl_rlimit_avail(&r, &ts) == 5, "drain to 5");
+  Curl_rlimit_drain(&r, 3, &ts);
+  fail_unless(Curl_rlimit_avail(&r, &ts) == 2, "drain to 2");
+  Curl_rlimit_drain(&r, 3, &ts);
+  fail_unless(Curl_rlimit_avail(&r, &ts) == -1, "drain to -1");
+  ts.tv_sec += 1;
+  fail_unless(Curl_rlimit_avail(&r, &ts) == 9, "10 inc per sec");
+  ts.tv_sec += 1;
+  fail_unless(Curl_rlimit_avail(&r, &ts) == 15, "10/15 burst limit");
+  ts.tv_sec += 1;
+  fail_unless(Curl_rlimit_avail(&r, &ts) == 15, "10/15 burst limit(2)");
+  Curl_rlimit_drain(&r, 15, &ts);
+  fail_unless(Curl_rlimit_avail(&r, &ts) == 0, "drain to 0");
+  fail_unless(Curl_rlimit_wait_ms(&r, &ts) == 1000, "wait 1 sec");
+  ts.tv_usec += 500000; /* half a sec, cheating on second carry */
+  fail_unless(Curl_rlimit_avail(&r, &ts) == 0, "0 after 0.5 sec");
+  fail_unless(Curl_rlimit_wait_ms(&r, &ts) == 500, "wait 0.5 sec");
+  ts.tv_sec += 1;
+  fail_unless(Curl_rlimit_avail(&r, &ts) == 10, "10 after 1.5 sec");
+  fail_unless(Curl_rlimit_wait_ms(&r, &ts) == 0, "wait 0");
+  ts.tv_usec += 500000; /* half a sec, cheating on second carry */
+  fail_unless(Curl_rlimit_avail(&r, &ts) == 15, "10 after 2 sec");
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit3219.c b/third-party/curl/tests/unit/unit3219.c
new file mode 100644
index 0000000000..2d3be5d436
--- /dev/null
+++ b/third-party/curl/tests/unit/unit3219.c
@@ -0,0 +1,43 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "protocol.h"
+
+static CURLcode test_unit3219(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+  fail_unless((CURLPROTO_MASK & CURLPROTO_HTTP) == CURLPROTO_HTTP,
+              "mask should include HTTP");
+  fail_unless((CURLPROTO_MASK & CURLPROTO_GOPHERS) == CURLPROTO_GOPHERS,
+              "mask should include the highest public protocol bit");
+  fail_unless((CURLPROTO_MASK & CURLPROTO_WS) == 0,
+              "mask should exclude websocket protocol bits");
+  fail_unless((CURLPROTO_MASK & CURLPROTO_WSS) == 0,
+              "mask should exclude secure websocket protocol bits");
+  fail_unless((CURLPROTO_MASK & CURLPROTO_MQTTS) == 0,
+              "mask should exclude internal-only protocols");
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit3300.c b/third-party/curl/tests/unit/unit3300.c
new file mode 100644
index 0000000000..6df79097c4
--- /dev/null
+++ b/third-party/curl/tests/unit/unit3300.c
@@ -0,0 +1,162 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+
+#include "curlx/wait.h"
+#include "thrdpool.h"
+
+#ifdef USE_THREADS
+
+struct unit3300_ctx {
+  uint32_t total;
+  uint32_t taken;
+  uint32_t returned;
+};
+
+static uint32_t unit3300_item = 23;
+static uint32_t unit3300_delay_ms = 0;
+
+static void unit3300_ctx_init(struct unit3300_ctx *ctx,
+                              uint32_t total,
+                              uint32_t delay_ms)
+{
+  memset(ctx, 0, sizeof(*ctx));
+  ctx->total = total;
+  unit3300_delay_ms = delay_ms;
+}
+
+static void *unit3300_take(void *user_data, const char **pdescription,
+                           timediff_t *ptimeout_ms)
+{
+  struct unit3300_ctx *ctx = user_data;
+  *pdescription = NULL;
+  *ptimeout_ms = 0;
+  if(ctx->taken < ctx->total) {
+    ctx->taken++;
+    return &unit3300_item;
+  }
+  return NULL;
+}
+
+static void unit3300_process(void *item)
+{
+  fail_unless(item == &unit3300_item, "process unexpected item");
+  if(unit3300_delay_ms) {
+    curlx_wait_ms(unit3300_delay_ms);
+  }
+}
+
+static void unit3300_return(void *item, void *user_data)
+{
+  struct unit3300_ctx *ctx = user_data;
+  (void)item;
+  if(ctx) {
+    ctx->returned++;
+    fail_unless(ctx->returned <= ctx->total, "returned too many");
+  }
+}
+
+static CURLcode test_unit3300(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+  struct curl_thrdpool *tpool;
+  struct unit3300_ctx ctx;
+  CURLcode result;
+
+  /* pool without minimum, does not start anything */
+  unit3300_ctx_init(&ctx, 10, 0);
+  result = Curl_thrdpool_create(&tpool, "unit3300a", 0, 2, 0,
+                                unit3300_take, unit3300_process,
+                                unit3300_return, &ctx);
+  fail_unless(!result, "pool-a create");
+  Curl_thrdpool_destroy(tpool, TRUE);
+  fail_unless(!ctx.returned, "pool-a unexpected items returned");
+  fail_unless(!ctx.taken, "pool-a unexpected items taken");
+
+  /* pool without minimum, signal start, consumes everything */
+  unit3300_ctx_init(&ctx, 10, 0);
+  result = Curl_thrdpool_create(&tpool, "unit3300b", 0, 2, 0,
+                                unit3300_take, unit3300_process,
+                                unit3300_return, &ctx);
+  fail_unless(!result, "pool-b create");
+  result = Curl_thrdpool_signal(tpool, 2);
+  fail_unless(!result, "pool-b signal");
+  Curl_thrdpool_await_idle(tpool, 0);
+  Curl_thrdpool_destroy(tpool, TRUE);
+  fail_unless(ctx.returned == ctx.total, "pool-b items returned missing");
+  fail_unless(ctx.taken == ctx.total, "pool-b items taken missing");
+
+  /* pool with minimum, consumes everything without signal */
+  unit3300_ctx_init(&ctx, 10, 0);
+  result = Curl_thrdpool_create(&tpool, "unit3300c", 1, 2, 0,
+                                unit3300_take, unit3300_process,
+                                unit3300_return, &ctx);
+  fail_unless(!result, "pool-c create");
+  Curl_thrdpool_await_idle(tpool, 0);
+  Curl_thrdpool_destroy(tpool, TRUE);
+  fail_unless(ctx.returned == ctx.total, "pool-c items returned missing");
+  fail_unless(ctx.taken == ctx.total, "pool-c items taken missing");
+
+  /* pool with many max, signal abundance, consumes everything */
+  unit3300_ctx_init(&ctx, 100, 0);
+  result = Curl_thrdpool_create(&tpool, "unit3300d", 0, 50, 0,
+                                unit3300_take, unit3300_process,
+                                unit3300_return, &ctx);
+  fail_unless(!result, "pool-d create");
+  result = Curl_thrdpool_signal(tpool, 100);
+  fail_unless(!result, "pool-d signal");
+  Curl_thrdpool_await_idle(tpool, 0);
+  Curl_thrdpool_destroy(tpool, TRUE);
+  fail_unless(ctx.returned == ctx.total, "pool-d items returned missing");
+  fail_unless(ctx.taken == ctx.total, "pool-d items taken missing");
+
+  /* pool with 1 max, many to take, no await, destroy without join */
+  unit3300_ctx_init(&ctx, 10000000, 1);
+  result = Curl_thrdpool_create(&tpool, "unit3300e", 0, 1, 0,
+                                unit3300_take, unit3300_process,
+                                unit3300_return, &ctx);
+  fail_unless(!result, "pool-e create");
+  result = Curl_thrdpool_signal(tpool, 100);
+  fail_unless(!result, "pool-e signal");
+  Curl_thrdpool_destroy(tpool, FALSE);
+  fail_unless(ctx.returned < ctx.total, "pool-e returned all");
+  fail_unless(ctx.taken < ctx.total, "pool-e took all");
+#ifdef DEBUGBUILD
+  /* pool thread notices destruction and should immediately abort.
+   * No memory leak should be reported. if the wait is too short on
+   * a slow system, thread sanitizer freaks out as memdebug
+   * is called by threads after main thread shut down. */
+  curlx_wait_ms(1000);
+#endif
+
+  UNITTEST_END_SIMPLE
+}
+
+#else
+static CURLcode test_unit3300(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+  UNITTEST_END_SIMPLE
+}
+#endif /* USE_THREADS */
diff --git a/third-party/curl/tests/unit/unit3301.c b/third-party/curl/tests/unit/unit3301.c
new file mode 100644
index 0000000000..67b126200d
--- /dev/null
+++ b/third-party/curl/tests/unit/unit3301.c
@@ -0,0 +1,142 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+
+#include "curlx/wait.h"
+#include "thrdqueue.h"
+#include "curl_threads.h"
+
+#ifdef USE_THREADS
+
+struct unit3301_item {
+  int id;
+  BIT(processed);
+};
+
+struct unit3301_ctx {
+  volatile int event;
+};
+
+static struct unit3301_item *unit3301_item_create(int id)
+{
+  struct unit3301_item *uitem;
+  uitem = curlx_calloc(1, sizeof(*uitem));
+  if(uitem) {
+    uitem->id = id;
+    curl_mfprintf(stderr, "created item %d\n", uitem->id);
+  }
+  return uitem;
+}
+
+static void unit3301_item_free(void *item)
+{
+  struct unit3301_item *uitem = item;
+  curl_mfprintf(stderr, "free item %d\n", uitem->id);
+  curlx_free(uitem);
+}
+
+static void unit3301_event(const struct curl_thrdq *tqueue,
+                           Curl_thrdq_event ev,
+                           void *user_data)
+{
+  struct unit3301_ctx *ctx = user_data;
+  (void)tqueue;
+  switch(ev) {
+  case CURL_THRDQ_EV_ITEM_DONE:
+    ctx->event = 1;
+    break;
+  default:
+    break;
+  }
+}
+
+static void unit3301_process(void *item)
+{
+  struct unit3301_item *uitem = item;
+  curlx_wait_ms(1);
+  uitem->processed = TRUE;
+}
+
+static CURLcode test_unit3301(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+  struct curl_thrdq *tqueue;
+  struct unit3301_ctx ctx;
+  int i, count, nrecvd;
+  CURLcode result;
+
+  /* create and teardown queue */
+  memset(&ctx, 0, sizeof(ctx));
+  result = Curl_thrdq_create(&tqueue, "unit3301-a", 0, 0, 2, 1,
+                             unit3301_item_free, unit3301_process,
+                             unit3301_event, &ctx);
+  fail_unless(!result, "queue-a create");
+  Curl_thrdq_destroy(tqueue, TRUE);
+  tqueue = NULL;
+  fail_unless(!ctx.event, "queue-a unexpected done count");
+
+  /* create queue, have it process `count` items */
+  count = 10;
+  memset(&ctx, 0, sizeof(ctx));
+  result = Curl_thrdq_create(&tqueue, "unit3301-b", 0, 0, 2, 1,
+                             unit3301_item_free, unit3301_process,
+                             unit3301_event, &ctx);
+  fail_unless(!result, "queue-b create");
+  for(i = 0; i < count; ++i) {
+    struct unit3301_item *uitem = unit3301_item_create(i);
+    fail_unless(uitem, "queue-b item create");
+    result = Curl_thrdq_send(tqueue, uitem, NULL, 0);
+    fail_unless(!result, "queue-b send");
+  }
+
+  result = thrdq_await_done(tqueue, 0);
+  fail_unless(!result, "queue-b await done");
+
+  nrecvd = 0;
+  for(i = 0; i < count; ++i) {
+    void *item;
+    result = Curl_thrdq_recv(tqueue, &item);
+    fail_unless(!result, "queue-b recv");
+    if(item) {
+      struct unit3301_item *uitem = item;
+      curl_mfprintf(stderr, "received item %d\n", uitem->id);
+      ++nrecvd;
+      fail_unless(uitem->processed, "queue-b recv unprocessed item");
+      unit3301_item_free(item);
+    }
+  }
+  Curl_thrdq_destroy(tqueue, TRUE);
+  tqueue = NULL;
+  fail_unless(nrecvd == count, "queue-b unexpected done count");
+
+  UNITTEST_END_SIMPLE
+}
+
+#else
+static CURLcode test_unit3301(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+  UNITTEST_END_SIMPLE
+}
+#endif /* USE_THREADS */
diff --git a/third-party/curl/tests/unit/unit3302.c b/third-party/curl/tests/unit/unit3302.c
new file mode 100644
index 0000000000..6c0abed90c
--- /dev/null
+++ b/third-party/curl/tests/unit/unit3302.c
@@ -0,0 +1,89 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "urldata.h"
+
+static CURLcode test_unit3302(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
+  struct Curl_easy *easy;
+  CURLcode result;
+
+  curl_global_init(CURL_GLOBAL_ALL);
+  easy = curl_easy_init();
+  if(!easy) {
+    curl_global_cleanup();
+    goto unit_test_abort; /* OOM during setup, not a test failure */
+  }
+
+  /* CURLGSSAPI_DELEGATION_FLAG must be stored */
+  result = curl_easy_setopt(easy, CURLOPT_GSSAPI_DELEGATION,
+                            CURLGSSAPI_DELEGATION_FLAG);
+  fail_unless(result == CURLE_OK,
+              "setopt DELEGATION_FLAG returned error");
+  fail_unless(easy->set.gssapi_delegation == CURLGSSAPI_DELEGATION_FLAG,
+              "DELEGATION_FLAG not stored in data->set");
+
+  /* CURLGSSAPI_DELEGATION_POLICY_FLAG must be stored */
+  result = curl_easy_setopt(easy, CURLOPT_GSSAPI_DELEGATION,
+                            CURLGSSAPI_DELEGATION_POLICY_FLAG);
+  fail_unless(result == CURLE_OK,
+              "setopt DELEGATION_POLICY_FLAG returned error");
+  fail_unless(easy->set.gssapi_delegation == CURLGSSAPI_DELEGATION_POLICY_FLAG,
+              "DELEGATION_POLICY_FLAG not stored in data->set");
+
+  /* both flags together */
+  result = curl_easy_setopt(easy, CURLOPT_GSSAPI_DELEGATION,
+                            CURLGSSAPI_DELEGATION_FLAG |
+                            CURLGSSAPI_DELEGATION_POLICY_FLAG);
+  fail_unless(result == CURLE_OK,
+              "setopt both flags returned error");
+  fail_unless(easy->set.gssapi_delegation ==
+              (CURLGSSAPI_DELEGATION_FLAG | CURLGSSAPI_DELEGATION_POLICY_FLAG),
+              "both delegation flags not stored in data->set");
+
+  /* CURLGSSAPI_DELEGATION_NONE must clear the field */
+  result = curl_easy_setopt(easy, CURLOPT_GSSAPI_DELEGATION,
+                            CURLGSSAPI_DELEGATION_NONE);
+  fail_unless(result == CURLE_OK,
+              "setopt DELEGATION_NONE returned error");
+  fail_unless(easy->set.gssapi_delegation == 0,
+              "gssapi_delegation not cleared by DELEGATION_NONE");
+
+  /* unknown bits must be masked off */
+  result = curl_easy_setopt(easy, CURLOPT_GSSAPI_DELEGATION, 0xFFL);
+  fail_unless(result == CURLE_OK,
+              "setopt 0xFF returned error");
+  fail_unless(easy->set.gssapi_delegation ==
+              (CURLGSSAPI_DELEGATION_FLAG | CURLGSSAPI_DELEGATION_POLICY_FLAG),
+              "unknown bits not masked off");
+
+  curl_easy_cleanup(easy);
+  curl_global_cleanup();
+#endif /* HAVE_GSSAPI || USE_WINDOWS_SSPI */
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit3303.c b/third-party/curl/tests/unit/unit3303.c
new file mode 100644
index 0000000000..56f52ebf57
--- /dev/null
+++ b/third-party/curl/tests/unit/unit3303.c
@@ -0,0 +1,140 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "unitcheck.h"
+#include "urldata.h"
+
+#ifdef USE_SSL
+#include "vtls/vtls.h"
+#endif
+
+static CURLcode test_unit3303(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+#ifdef USE_SSL
+  CURL *curl;
+  struct connectdata *conn;
+  struct ssl_primary_config *primary;
+  char *saved;
+  static char alt_passwd[] = "wrong";
+  static char alt_key[]    = "other.key";
+  static char alt_ktype[]  = "DER";
+  static char alt_ctype[]  = "P12";
+  struct Curl_peer *origin = NULL;
+  CURLcode result;
+
+  curl_global_init(CURL_GLOBAL_ALL);
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_global_cleanup();
+    goto unit_test_abort;
+  }
+
+  result = Curl_peer_create((struct Curl_easy *)curl,
+                            &Curl_scheme_https,
+                            "test.curl.se", 1234, &origin);
+  if(result) {
+    curl_easy_cleanup(curl);
+    curl_global_cleanup();
+    goto unit_test_abort;
+  }
+  Curl_peer_link(&((struct Curl_easy *)curl)->state.initial_origin, origin);
+
+  curl_easy_setopt(curl, CURLOPT_SSLCERT, "client.pem");
+  curl_easy_setopt(curl, CURLOPT_SSLKEY, "client.key");
+  curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "secret");
+  curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM");
+  curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, "PEM");
+
+  if(Curl_ssl_easy_config_complete((struct Curl_easy *)curl, origin)) {
+    Curl_peer_unlink(&origin);
+    curl_easy_cleanup(curl);
+    curl_global_cleanup();
+    goto unit_test_abort;
+  }
+
+  conn = curlx_calloc(1, sizeof(*conn));
+  if(!conn || Curl_ssl_conn_config_init((struct Curl_easy *)curl, conn)) {
+    if(conn)
+      Curl_ssl_conn_config_cleanup(conn);
+    curlx_free(conn);
+    Curl_peer_unlink(&origin);
+    curl_easy_cleanup(curl);
+    curl_global_cleanup();
+    goto unit_test_abort;
+  }
+
+  /* Baseline: identical config must match. */
+  fail_unless(Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
+                                         FALSE),
+              "identical mTLS config should match");
+
+  primary = &((struct Curl_easy *)curl)->set.ssl.primary;
+
+  /* Different key_passwd must not match. */
+  saved = primary->key_passwd;
+  primary->key_passwd = alt_passwd;
+  fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
+                                          FALSE),
+              "different key_passwd must not reuse conn");
+  primary->key_passwd = saved;
+
+  /* Different key path must not match. */
+  saved = primary->key;
+  primary->key = alt_key;
+  fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
+                                          FALSE),
+              "different key must not reuse conn");
+  primary->key = saved;
+
+  /* Different key type must not match. */
+  saved = primary->key_type;
+  primary->key_type = alt_ktype;
+  fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
+                                          FALSE),
+              "different key_type must not reuse conn");
+  primary->key_type = saved;
+
+  /* Different cert type must not match. */
+  saved = primary->cert_type;
+  primary->cert_type = alt_ctype;
+  fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
+                                          FALSE),
+              "different cert_type must not reuse conn");
+  primary->cert_type = saved;
+
+  /* All fields restored: must match again. */
+  fail_unless(Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
+                                         FALSE),
+              "restored mTLS config should match");
+
+  Curl_ssl_conn_config_cleanup(conn);
+  curlx_free(conn);
+  curl_easy_cleanup(curl);
+  Curl_peer_unlink(&origin);
+  curl_global_cleanup();
+#endif /* USE_SSL */
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit3304.c b/third-party/curl/tests/unit/unit3304.c
new file mode 100644
index 0000000000..bb2bd77b86
--- /dev/null
+++ b/third-party/curl/tests/unit/unit3304.c
@@ -0,0 +1,166 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+/* Unit tests for TLS session cache peer key discrimination on mTLS fields.
+ * Verifies that Curl_ssl_peer_key_build() produces distinct keys when two
+ * handles differ only on key, key_type or cert_type.  key_passwd is NOT
+ * embedded in the peer key; it is compared separately at session lookup via
+ * cf_ssl_scache_match_auth(), following the same pattern as SRP
+ * credentials. */
+
+#include "unitcheck.h"
+#include "urldata.h"
+#include "peer.h"
+
+#ifdef USE_SSL
+#include "vtls/vtls.h"
+#include "vtls/vtls_scache.h"
+#endif
+
+static CURLcode test_unit3304(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+#ifdef USE_SSL
+  struct Curl_peer origin;
+  struct ssl_peer peer;
+  struct ssl_primary_config ssl;
+  char *key1 = NULL;
+  char *key2 = NULL;
+  static char base_hostname[] = "example.com";
+  static char base_cert[]     = "client.pem";
+  static char base_key[]      = "client.key";
+  static char base_passwd[]   = "secret";
+  static char base_ctype[]    = "PEM";
+  static char base_ktype[]    = "PEM";
+  static char alt_key[]       = "other.key";
+  static char alt_ktype[]     = "DER";
+  static char alt_ctype[]     = "P12";
+  static char lc_ctype[]      = "pem";
+  static char lc_ktype[]      = "pem";
+
+  memset(&origin, 0, sizeof(origin));
+  origin.hostname = base_hostname;
+  origin.port = 443;
+
+  memset(&peer, 0, sizeof(peer));
+  peer.origin = &origin;
+  peer.transport = TRNSPRT_TCP;
+
+  memset(&ssl, 0, sizeof(ssl));
+  ssl.verifypeer = TRUE;
+  ssl.verifyhost = TRUE;
+  ssl.clientcert = base_cert;
+  ssl.key        = base_key;
+  ssl.key_passwd = base_passwd;
+  ssl.cert_type  = base_ctype;
+  ssl.key_type   = base_ktype;
+
+  /* Baseline: same config produces same key. */
+  fail_unless(!Curl_ssl_peer_key_make(&peer, &ssl, "test", &key1),
+              "peer key build failed");
+  fail_unless(!Curl_ssl_peer_key_make(&peer, &ssl, "test", &key2),
+              "peer key build failed");
+  fail_unless(key1 && key2 && !strcmp(key1, key2),
+              "identical config should produce identical peer key");
+  curlx_safefree(key1);
+  curlx_safefree(key2);
+
+  /* key_passwd is NOT in the peer key: lookup uses timing-safe comparison
+   * via cf_ssl_scache_match_auth(), same as SRP credentials. */
+  fail_unless(!Curl_ssl_peer_key_make(&peer, &ssl, "test", &key1),
+              "peer key build failed");
+  ssl.key_passwd = NULL;
+  fail_unless(!Curl_ssl_peer_key_make(&peer, &ssl, "test", &key2),
+              "peer key build failed");
+  fail_unless(key1 && key2 && !strcmp(key1, key2),
+              "key_passwd must not affect the peer key");
+  curlx_safefree(key1);
+  curlx_safefree(key2);
+  ssl.key_passwd = base_passwd;
+
+  /* Different key path must produce a different peer key. */
+  fail_unless(!Curl_ssl_peer_key_make(&peer, &ssl, "test", &key1),
+              "peer key build failed");
+  ssl.key = alt_key;
+  fail_unless(!Curl_ssl_peer_key_make(&peer, &ssl, "test", &key2),
+              "peer key build failed");
+  fail_unless(key1 && key2 && strcmp(key1, key2),
+              "different key must produce different peer key");
+  curlx_safefree(key1);
+  curlx_safefree(key2);
+  ssl.key = base_key;
+
+  /* Different key_type must produce a different peer key. */
+  fail_unless(!Curl_ssl_peer_key_make(&peer, &ssl, "test", &key1),
+              "peer key build failed");
+  ssl.key_type = alt_ktype;
+  fail_unless(!Curl_ssl_peer_key_make(&peer, &ssl, "test", &key2),
+              "peer key build failed");
+  fail_unless(key1 && key2 && strcmp(key1, key2),
+              "different key_type must produce different peer key");
+  curlx_safefree(key1);
+  curlx_safefree(key2);
+  ssl.key_type = base_ktype;
+
+  /* Different cert_type must produce a different peer key. */
+  fail_unless(!Curl_ssl_peer_key_make(&peer, &ssl, "test", &key1),
+              "peer key build failed");
+  ssl.cert_type = alt_ctype;
+  fail_unless(!Curl_ssl_peer_key_make(&peer, &ssl, "test", &key2),
+              "peer key build failed");
+  fail_unless(key1 && key2 && strcmp(key1, key2),
+              "different cert_type must produce different peer key");
+  curlx_safefree(key1);
+  curlx_safefree(key2);
+  ssl.cert_type = base_ctype;
+
+  /* cert_type is case-insensitive: "PEM" and "pem" must produce the
+   * same peer key, consistent with the conn-reuse comparison. */
+  fail_unless(!Curl_ssl_peer_key_make(&peer, &ssl, "test", &key1),
+              "peer key build failed");
+  ssl.cert_type = lc_ctype;
+  fail_unless(!Curl_ssl_peer_key_make(&peer, &ssl, "test", &key2),
+              "peer key build failed");
+  fail_unless(key1 && key2 && !strcmp(key1, key2),
+              "cert_type case must not affect peer key");
+  curlx_safefree(key1);
+  curlx_safefree(key2);
+  ssl.cert_type = base_ctype;
+
+  /* key_type is case-insensitive: "PEM" and "pem" must produce the
+   * same peer key. */
+  fail_unless(!Curl_ssl_peer_key_make(&peer, &ssl, "test", &key1),
+              "peer key build failed");
+  ssl.key_type = lc_ktype;
+  fail_unless(!Curl_ssl_peer_key_make(&peer, &ssl, "test", &key2),
+              "peer key build failed");
+  fail_unless(key1 && key2 && !strcmp(key1, key2),
+              "key_type case must not affect peer key");
+  curlx_safefree(key1);
+  curlx_safefree(key2);
+#endif /* USE_SSL */
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/unit/unit3400.c b/third-party/curl/tests/unit/unit3400.c
new file mode 100644
index 0000000000..060cc61799
--- /dev/null
+++ b/third-party/curl/tests/unit/unit3400.c
@@ -0,0 +1,261 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+#include "unitcheck.h"
+
+#include "bufq.h"
+#include "vquic/capsule.h"
+
+#if defined(USE_PROXY_HTTP3) && defined(USE_NGTCP2) && \
+  !defined(CURL_DISABLE_PROXY) && !defined(CURL_DISABLE_HTTP)
+static void queue_bytes(struct bufq *q, const unsigned char *src, size_t len)
+{
+  size_t nwritten = 0;
+  CURLcode result = Curl_bufq_write(q, src, len, &nwritten);
+  fail_unless(result == CURLE_OK, "queue failed");
+  fail_unless(nwritten == len, "queue short write");
+}
+#endif
+
+#if defined(USE_PROXY_HTTP3) && \
+  !defined(CURL_DISABLE_PROXY) && !defined(CURL_DISABLE_HTTP)
+static void check_capsule_hdr(size_t payload_len,
+                              const unsigned char *expected,
+                              size_t expected_len)
+{
+  unsigned char hdr[HTTP_CAPSULE_HEADER_MAX_SIZE];
+  size_t hdr_len;
+
+  memset(hdr, 0xA5, sizeof(hdr));
+  hdr_len = capsule_encap_udp_hdr(hdr, sizeof(hdr), payload_len);
+  fail_unless(hdr_len == expected_len, "capsule header length mismatch");
+  fail_unless(!memcmp(hdr, expected, expected_len),
+              "capsule header bytes mismatch");
+}
+
+static void test_capsule_encap_udp_hdr_boundaries(void)
+{
+  const unsigned char p0[] = { 0x00, 0x01, 0x00 };
+  const unsigned char p62[] = { 0x00, 0x3F, 0x00 };
+  const unsigned char p63[] = { 0x00, 0x40, 0x40, 0x00 };
+  const unsigned char p64[] = { 0x00, 0x40, 0x41, 0x00 };
+  const unsigned char p16382[] = { 0x00, 0x7F, 0xFF, 0x00 };
+  const unsigned char p16383[] = { 0x00, 0x80, 0x00, 0x40, 0x00, 0x00 };
+  const unsigned char p16384[] = { 0x00, 0x80, 0x00, 0x40, 0x01, 0x00 };
+
+  check_capsule_hdr(0, p0, sizeof(p0));
+  check_capsule_hdr(62, p62, sizeof(p62));
+  check_capsule_hdr(63, p63, sizeof(p63));
+  check_capsule_hdr(64, p64, sizeof(p64));
+  check_capsule_hdr(16382, p16382, sizeof(p16382));
+  check_capsule_hdr(16383, p16383, sizeof(p16383));
+  check_capsule_hdr(16384, p16384, sizeof(p16384));
+}
+
+#endif /* !CURL_DISABLE_PROXY && !CURL_DISABLE_HTTP */
+
+#if defined(USE_PROXY_HTTP3) && defined(USE_NGTCP2) && \
+  !defined(CURL_DISABLE_PROXY) && !defined(CURL_DISABLE_HTTP)
+static void check_capsule_result(struct bufq *q,
+                                 const unsigned char *capsule, size_t capslen,
+                                 size_t outlen, CURLcode expect_err,
+                                 size_t expect_nread)
+{
+  unsigned char out[32];
+  CURLcode err = CURLE_OK;
+  size_t nread;
+
+  memset(out, 0, sizeof(out));
+  Curl_bufq_reset(q);
+  if(capsule && capslen)
+    queue_bytes(q, capsule, capslen);
+
+  nread = Curl_capsule_process_udp_raw(NULL, NULL, q, out, outlen, &err);
+  fail_unless(err == expect_err, "unexpected capsule error");
+  fail_unless(nread == expect_nread, "unexpected capsule read size");
+}
+
+static void test_capsule_encode_decode_roundtrip(void)
+{
+  struct bufq q;
+  unsigned char payload[128];
+  unsigned char out[128];
+  CURLcode result, err;
+  size_t payload_len;
+  size_t i, nread;
+
+  Curl_bufq_init2(&q, 32, 8, BUFQ_OPT_NONE);
+
+  for(i = 0; i < sizeof(payload); ++i)
+    payload[i] = (unsigned char)i;
+
+  for(i = 0; i < 2; ++i) {
+    payload_len = i ? 64 : 7;
+    memset(out, 0, sizeof(out));
+    Curl_bufq_reset(&q);
+
+    result = Curl_capsule_encap_udp_datagram(&q, payload, payload_len);
+    fail_unless(result == CURLE_OK, "failed to encapsulate UDP datagram");
+
+    err = CURLE_OK;
+    nread = Curl_capsule_process_udp_raw(NULL, NULL, &q, out, sizeof(out),
+                                         &err);
+    fail_unless(err == CURLE_OK, "failed to decode UDP datagram");
+    fail_unless(nread == payload_len, "decoded payload length mismatch");
+    fail_unless(!memcmp(out, payload, payload_len),
+                "decoded payload bytes mismatch");
+    fail_unless(Curl_bufq_is_empty(&q), "decoded capsule must be consumed");
+  }
+  Curl_bufq_free(&q);
+}
+
+static void test_capsule_sequential_decode(void)
+{
+  /* Verify that multiple back-to-back capsules in the same bufq are
+     each decoded in turn and the buffer is fully consumed. */
+  struct bufq q;
+  unsigned char out[8];
+  CURLcode err;
+  size_t nread;
+  /* Two back-to-back 3-byte UDP capsules */
+  const unsigned char two_caps[] = {
+    0x00, 0x04, 0x00, 0x11, 0x22, 0x33,   /* capsule 1: [0x11,0x22,0x33] */
+    0x00, 0x04, 0x00, 0xAA, 0xBB, 0xCC    /* capsule 2: [0xAA,0xBB,0xCC] */
+  };
+
+  Curl_bufq_init2(&q, 32, 4, BUFQ_OPT_NONE);
+
+  queue_bytes(&q, two_caps, sizeof(two_caps));
+
+  /* First capsule */
+  memset(out, 0, sizeof(out));
+  err = CURLE_OK;
+  nread = Curl_capsule_process_udp_raw(NULL, NULL, &q, out, sizeof(out), &err);
+  fail_unless(err == CURLE_OK, "sequential: first capsule decode failed");
+  fail_unless(nread == 3, "sequential: first capsule size mismatch");
+  fail_unless(out[0] == 0x11 && out[1] == 0x22 && out[2] == 0x33,
+              "sequential: first capsule bytes mismatch");
+
+  /* Second capsule */
+  memset(out, 0, sizeof(out));
+  err = CURLE_OK;
+  nread = Curl_capsule_process_udp_raw(NULL, NULL, &q, out, sizeof(out), &err);
+  fail_unless(err == CURLE_OK, "sequential: second capsule decode failed");
+  fail_unless(nread == 3, "sequential: second capsule size mismatch");
+  fail_unless(out[0] == 0xAA && out[1] == 0xBB && out[2] == 0xCC,
+              "sequential: second capsule bytes mismatch");
+
+  /* Buffer must be empty after both capsules */
+  fail_unless(Curl_bufq_is_empty(&q),
+              "sequential: buffer must be empty after two capsules");
+
+  /* No more data - CURLE_AGAIN expected */
+  err = CURLE_OK;
+  nread = Curl_capsule_process_udp_raw(NULL, NULL, &q, out, sizeof(out), &err);
+  fail_unless(err == CURLE_AGAIN,
+              "sequential: empty queue should return AGAIN");
+  fail_unless(nread == 0, "sequential: empty queue should read zero bytes");
+
+  Curl_bufq_free(&q);
+}
+
+static void test_capsule_decode_paths(void)
+{
+  struct bufq q;
+  unsigned char out[8];
+  CURLcode err = CURLE_OK;
+  size_t nread;
+  const unsigned char invalid_type[] = { 0x01 };
+  const unsigned char partial_len[] = { 0x00, 0x40 };
+  const unsigned char invalid_context[] = { 0x00, 0x01, 0x01 };
+  const unsigned char invalid_caps_len[] = { 0x00, 0x00, 0x00 };
+  const unsigned char partial_payload[] = { 0x00, 0x04, 0x00, 0x11, 0x22 };
+  const unsigned char payload_3b[] = { 0x00, 0x04, 0x00, 0x11, 0x22, 0x33 };
+  const unsigned char payload_empty[] = { 0x00, 0x01, 0x00 };
+
+  Curl_bufq_init2(&q, 32, 4, BUFQ_OPT_NONE);
+
+  check_capsule_result(&q, NULL, 0, 0, CURLE_BAD_FUNCTION_ARGUMENT, 0);
+  check_capsule_result(&q, NULL, 0, sizeof(out), CURLE_AGAIN, 0);
+  check_capsule_result(&q, invalid_type, sizeof(invalid_type), sizeof(out),
+                       CURLE_RECV_ERROR, 0);
+  check_capsule_result(&q, partial_len, sizeof(partial_len), sizeof(out),
+                       CURLE_AGAIN, 0);
+  check_capsule_result(&q, invalid_context, sizeof(invalid_context),
+                       sizeof(out), CURLE_RECV_ERROR, 0);
+  check_capsule_result(&q, invalid_caps_len, sizeof(invalid_caps_len),
+                       sizeof(out), CURLE_RECV_ERROR, 0);
+  check_capsule_result(&q, partial_payload, sizeof(partial_payload),
+                       sizeof(out), CURLE_AGAIN, 0);
+
+  /* oversized payload is rejected and discarded */
+  Curl_bufq_reset(&q);
+  queue_bytes(&q, payload_3b, sizeof(payload_3b));
+  nread = Curl_capsule_process_udp_raw(NULL, NULL, &q, out, 2, &err);
+  fail_unless(err == CURLE_RECV_ERROR,
+              "expected RECV_ERROR for short output buffer");
+  fail_unless(nread == 0, "expected zero read on short output buffer");
+  fail_unless(Curl_bufq_is_empty(&q), "oversized capsule must be discarded");
+
+  /* zero-length UDP payload is accepted and consumed */
+  Curl_bufq_reset(&q);
+  queue_bytes(&q, payload_empty, sizeof(payload_empty));
+  nread = Curl_capsule_process_udp_raw(NULL, NULL, &q, out, sizeof(out), &err);
+  fail_unless(err == CURLE_OK, "zero-length UDP payload should succeed");
+  fail_unless(nread == 0, "zero-length UDP payload should read zero");
+  fail_unless(Curl_bufq_is_empty(&q), "zero-length capsule must be consumed");
+
+  /* normal payload decode */
+  Curl_bufq_reset(&q);
+  queue_bytes(&q, payload_3b, sizeof(payload_3b));
+  memset(out, 0, sizeof(out));
+  nread = Curl_capsule_process_udp_raw(NULL, NULL, &q, out, sizeof(out), &err);
+  fail_unless(err == CURLE_OK, "payload decode should succeed");
+  fail_unless(nread == 3, "payload decode size mismatch");
+  fail_unless(out[0] == 0x11 && out[1] == 0x22 && out[2] == 0x33,
+              "payload decode bytes mismatch");
+  fail_unless(Curl_bufq_is_empty(&q), "payload capsule must be consumed");
+
+  Curl_bufq_free(&q);
+}
+#endif /* USE_NGTCP2 && !CURL_DISABLE_PROXY && !CURL_DISABLE_HTTP */
+
+static CURLcode test_unit3400(const char *arg)
+{
+  UNITTEST_BEGIN_SIMPLE
+
+#if defined(USE_PROXY_HTTP3) && \
+  !defined(CURL_DISABLE_PROXY) && !defined(CURL_DISABLE_HTTP)
+  test_capsule_encap_udp_hdr_boundaries();
+#endif
+
+#if defined(USE_PROXY_HTTP3) && defined(USE_NGTCP2) && \
+  !defined(CURL_DISABLE_PROXY) && !defined(CURL_DISABLE_HTTP)
+  test_capsule_encode_decode_roundtrip();
+  test_capsule_decode_paths();
+  test_capsule_sequential_decode();
+#endif
+
+  UNITTEST_END_SIMPLE
+}
diff --git a/third-party/curl/tests/util.py b/third-party/curl/tests/util.py
index 051c6934d9..7db47d0a00 100644
--- a/third-party/curl/tests/util.py
+++ b/third-party/curl/tests/util.py
@@ -21,10 +21,7 @@
 #
 # SPDX-License-Identifier: curl
 #
-"""Module for extracting test data from the test data folder and other utils"""
-
-from __future__ import (absolute_import, division, print_function,
-                        unicode_literals)
+"""Module for extracting test data from the test data folder and other utils."""
 
 import logging
 import os
@@ -32,7 +29,6 @@ import re
 
 log = logging.getLogger(__name__)
 
-
 REPLY_DATA = re.compile("<reply>[ \t\n\r]*<data[^<]*>(.*?)</data>", re.MULTILINE | re.DOTALL)
 
 
@@ -64,29 +60,30 @@ class ClosingFileHandler(logging.StreamHandler):
                 self.release()
         return result
 
-class TestData(object):
+
+class TestData:
     def __init__(self, data_folder):
         self.data_folder = data_folder
 
     def get_test_data(self, test_number):
-        # Create the test file name
+        # Create the test filename
         filename = os.path.join(self.data_folder,
                                 "test{0}".format(test_number))
 
         log.debug("Parsing file %s", filename)
 
-        with open(filename, "rb") as f:
-            contents = f.read().decode("utf-8")
+        with open(filename, "r", encoding='us-ascii') as f:
+            contents = f.read()
 
         m = REPLY_DATA.search(contents)
         if not m:
-            raise Exception("Couldn't find a <reply><data> section")
+            raise Exception("Could not find a <reply><data> section")
 
-        # Left-strip the data so we don't get a newline before our data.
+        # Left-strip the data so we do not get a newline before our data.
         return m.group(1).lstrip()
 
 
 if __name__ == '__main__':
     td = TestData("./data")
-    data = td.get_test_data(1)
+    data = td.get_test_data(1451)
     print(data)
diff --git a/third-party/curl/tests/valgrind.pm b/third-party/curl/tests/valgrind.pm
index a0bce30c8b..1d0a629d80 100644
--- a/third-party/curl/tests/valgrind.pm
+++ b/third-party/curl/tests/valgrind.pm
@@ -35,13 +35,12 @@ BEGIN {
     );
 }
 
-
 use File::Basename;
 
 sub valgrindparse {
     my ($file) = @_;
     my @o;
-    open(my $val, "<", "$file");
+    open(my $val, "<", $file) or return;
     @o = <$val>;
     close($val);
     return @o;
diff --git a/third-party/curl/tests/valgrind.supp b/third-party/curl/tests/valgrind.supp
index 6e570b1bf7..aad7255248 100644
--- a/third-party/curl/tests/valgrind.supp
+++ b/third-party/curl/tests/valgrind.supp
@@ -1,12 +1,3 @@
-{
-   zstd_decompression-1.3.3-on-Ubuntu-18.04_with_hyper
-   Memcheck:Cond
-   fun:ZSTD_decompressStream
-   fun:zstd_unencode_write
-   fun:Curl_unencode_write
-   fun:hyper_body_chunk
-}
-
 {
    zstd_decompression-1.3.3-on-Ubuntu-18.04
    Memcheck:Cond
@@ -14,7 +5,7 @@
    fun:zstd_unencode_write
    fun:Curl_unencode_write
    fun:readwrite_data
-   fun:Curl_readwrite
+   fun:Curl_sendrecv
    fun:multi_runsingle
    fun:curl_multi_perform
    fun:easy_transfer
@@ -31,7 +22,7 @@
    Memcheck:Cond
    fun:ZSTD_decompressStream
    fun:zstd_unencode_write
-   fun:Curl_readwrite
+   fun:Curl_sendrecv
    fun:multi_runsingle
    fun:curl_multi_perform
    fun:curl_easy_perform
@@ -130,22 +121,10 @@
 }
 
 {
-   openssl-1.0.1-error-as-seen-on-travis
-   Memcheck:Cond
-   fun:ASN1_STRING_set
-   fun:ASN1_mbstring_ncopy
-   fun:ASN1_mbstring_copy
-   fun:ASN1_STRING_to_UTF8
-   obj:/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
-   obj:/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
-   fun:ASN1_item_ex_d2i
-   obj:/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
-   obj:/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
-   fun:ASN1_item_ex_d2i
-   obj:/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
-   obj:/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
-   fun:ASN1_item_ex_d2i
-   fun:ASN1_item_d2i
-   fun:PEM_X509_INFO_read_bio
-   fun:X509_load_cert_crl_file
+   inet_pton6-Debian-GLIBC-2.40-3
+   Memcheck:Overlap
+   fun:__memcpy_chk
+   fun:memmove
+   fun:inet_pton6
+   fun:ipv6_parse
 }
diff --git a/third-party/curl/tests/version-scan.pl b/third-party/curl/tests/version-scan.pl
deleted file mode 100644
index 3c055d9b3d..0000000000
--- a/third-party/curl/tests/version-scan.pl
+++ /dev/null
@@ -1,94 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-#
-# Verify that curl_version_info.3 documents all the CURL_VERSION_ bits
-# from the header.
-#
-
-use strict;
-use warnings;
-
-my $manpage=$ARGV[0];
-my $header=$ARGV[1];
-my $source=$ARGV[2];
-my %manversion;
-my %headerversion;
-my %manname;
-my %sourcename;
-my $error=0;
-
-open(my $m, "<", "$manpage");
-while(<$m>) {
-    if($_ =~ / mask bit: (CURL_VERSION_[A-Z0-9_]+)/i) {
-        $manversion{$1}++;
-    }
-    if($_ =~ /^\.ip """([^"]+)"""/i) {
-        $manname{$1}++;
-    }
-}
-close($m);
-
-open(my $h, "<", "$header");
-while(<$h>) {
-    if($_ =~ /^\#define (CURL_VERSION_[A-Z0-9_]+)/i) {
-        $headerversion{$1}++;
-    }
-}
-close($h);
-
-open(my $s, "<", "$source");
-while(<$s>) {
-    if($_ =~ /FEATURE\("([^"]*)"/) {
-      $sourcename{$1}++;
-    }
-}
-close($s);
-
-for my $h (keys %headerversion) {
-    if(!$manversion{$h}) {
-        print STDERR "$manpage: missing $h\n";
-        $error++;
-    }
-}
-for my $h (keys %manversion) {
-    if(!$headerversion{$h}) {
-        print STDERR "$manpage: $h is not in the header!\n";
-        $error++;
-    }
-}
-for my $n (keys %sourcename) {
-    if(!$manname{$n}) {
-        print STDERR "$manpage: missing feature name $n\n";
-        $error++;
-    }
-}
-for my $n (keys %manname) {
-    if(!$sourcename{$n}) {
-        print STDERR "$manpage: $n is not in the source!\n";
-        $error++;
-    }
-}
-
-exit $error;
diff --git a/third-party/curl/winbuild/.gitignore b/third-party/curl/winbuild/.gitignore
deleted file mode 100644
index 0d7f2b276f..0000000000
--- a/third-party/curl/winbuild/.gitignore
+++ /dev/null
@@ -1,6 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-*.idb
-*.inc
diff --git a/third-party/curl/winbuild/Makefile.vc b/third-party/curl/winbuild/Makefile.vc
deleted file mode 100644
index 44d9604bac..0000000000
--- a/third-party/curl/winbuild/Makefile.vc
+++ /dev/null
@@ -1,310 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-#***************************************************************************
-
-!IF "$(MODE)"=="static"
-TARGET = $(LIB_NAME_STATIC)
-AS_DLL = false
-CFGSET=true
-!ELSEIF "$(MODE)"=="dll"
-TARGET = $(LIB_NAME_DLL)
-AS_DLL = true
-CFGSET=true
-!ELSE
-!MESSAGE Invalid mode: $(MODE)
-
-#######################
-# Usage
-#
-
-!MESSAGE See winbuild/README.md for usage
-!ERROR please choose a valid mode
-
-!ENDIF
-
-!INCLUDE "../lib/Makefile.inc"
-LIBCURL_OBJS=$(CSOURCES:.c=.obj)
-
-!INCLUDE "../src/Makefile.inc"
-
-# tool_hugehelp has a special rule
-CURL_OBJS=$(CURL_CFILES:tool_hugehelp.c=)
-
-CURL_OBJS=$(CURL_OBJS:.c=.obj)
-
-
-# backwards compatible check for USE_SSPI
-!IFDEF USE_SSPI
-ENABLE_SSPI = $(USE_SSPI)
-!ENDIF
-
-# default options
-
-!IFNDEF MACHINE
-# Note: nmake magically changes the value of PROCESSOR_ARCHITECTURE from "AMD64"
-# to "x86" when building in a 32 bit build environment on a 64 bit machine.
-!IF "$(PROCESSOR_ARCHITECTURE)"=="AMD64"
-MACHINE = x64
-!ELSE
-MACHINE = x86
-!ENDIF
-!ENDIF
-
-!IFNDEF ENABLE_IDN
-USE_IDN = true
-!ELSEIF "$(ENABLE_IDN)"=="yes"
-USE_IDN = true
-!ELSEIF "$(ENABLE_IDN)"=="no"
-USE_IDN = false
-!ENDIF
-
-!IFNDEF ENABLE_IPV6
-USE_IPV6 = true
-!ELSEIF "$(ENABLE_IPV6)"=="yes"
-USE_IPV6 = true
-!ELSEIF "$(ENABLE_IPV6)"=="no"
-USE_IPV6 = false
-!ENDIF
-
-!IFNDEF ENABLE_SSPI
-USE_SSPI = true
-!ELSEIF "$(ENABLE_SSPI)"=="yes"
-USE_SSPI = true
-!ELSEIF "$(ENABLE_SSPI)"=="no"
-USE_SSPI = false
-!ENDIF
-
-!IFNDEF ENABLE_SCHANNEL
-!IF DEFINED(WITH_SSL) || DEFINED(WITH_MBEDTLS)
-USE_SCHANNEL = false
-!ELSE
-USE_SCHANNEL = $(USE_SSPI)
-!ENDIF
-!ELSEIF "$(ENABLE_SCHANNEL)"=="yes"
-USE_SCHANNEL = true
-!ELSEIF "$(ENABLE_SCHANNEL)"=="no"
-USE_SCHANNEL = false
-!ENDIF
-
-!IFNDEF ENABLE_OPENSSL_AUTO_LOAD_CONFIG
-ENABLE_OPENSSL_AUTO_LOAD_CONFIG = true
-!ELSEIF "$(ENABLE_OPENSSL_AUTO_LOAD_CONFIG)"=="yes"
-!UNDEF ENABLE_OPENSSL_AUTO_LOAD_CONFIG
-ENABLE_OPENSSL_AUTO_LOAD_CONFIG = true
-!ELSEIF "$(ENABLE_OPENSSL_AUTO_LOAD_CONFIG)"=="no"
-!UNDEF ENABLE_OPENSSL_AUTO_LOAD_CONFIG
-ENABLE_OPENSSL_AUTO_LOAD_CONFIG = false
-!ENDIF
-
-!IFNDEF ENABLE_UNICODE
-USE_UNICODE = false
-!ELSEIF "$(ENABLE_UNICODE)"=="yes"
-USE_UNICODE = true
-!ELSEIF "$(ENABLE_UNICODE)"=="no"
-USE_UNICODE = false
-!ENDIF
-
-CONFIG_NAME_LIB = libcurl
-
-!IF "$(WITH_SSL)"=="dll"
-USE_SSL = true
-SSL     = dll
-!ELSEIF "$(WITH_SSL)"=="static"
-USE_SSL = true
-SSL     = static
-!ENDIF
-
-!IF "$(ENABLE_NGHTTP2)"=="yes"
-# compatibility bit, WITH_NGHTTP2 is the correct flag
-WITH_NGHTTP2 = dll
-USE_NGHTTP2  = true
-NGHTTP2      = dll
-!ELSEIF "$(WITH_NGHTTP2)"=="dll"
-USE_NGHTTP2 = true
-NGHTTP2     = dll
-!ELSEIF "$(WITH_NGHTTP2)"=="static"
-USE_NGHTTP2 = true
-NGHTTP2     = static
-!ENDIF
-
-!IFNDEF USE_NGHTTP2
-USE_NGHTTP2 = false
-!ENDIF
-
-!IF "$(ENABLE_MSH3)"=="yes"
-# compatibility bit, WITH_MSH3 is the correct flag
-WITH_MSH3    = dll
-USE_MSH3     = true
-MSH3         = dll
-!ELSEIF "$(WITH_MSH3)"=="dll"
-USE_MSH3     = true
-MSH3         = dll
-!ELSEIF "$(WITH_MSH3)"=="static"
-USE_MSH3     = true
-MSH3         = static
-!ENDIF
-
-!IFNDEF USE_MSH3
-USE_MSH3 = false
-!ENDIF
-
-!IF "$(WITH_MBEDTLS)"=="dll" || "$(WITH_MBEDTLS)"=="static"
-USE_MBEDTLS = true
-MBEDTLS     = $(WITH_MBEDTLS)
-!ENDIF
-
-!IF "$(WITH_CARES)"=="dll"
-USE_CARES = true
-CARES     = dll
-!ELSEIF "$(WITH_CARES)"=="static"
-USE_CARES = true
-CARES     = static
-!ENDIF
-
-!IF "$(WITH_ZLIB)"=="dll"
-USE_ZLIB = true
-ZLIB     = dll
-!ELSEIF "$(WITH_ZLIB)"=="static"
-USE_ZLIB = true
-ZLIB     = static
-!ENDIF
-
-!IF "$(WITH_SSH2)"=="dll"
-USE_SSH2 = true
-SSH2     = dll
-!ELSEIF "$(WITH_SSH2)"=="static"
-USE_SSH2 = true
-SSH2     = static
-!ENDIF
-
-!IF "$(WITH_SSH)"=="dll"
-USE_SSH = true
-SSH     = dll
-!ELSEIF "$(WITH_SSH)"=="static"
-USE_SSH = true
-SSH     = static
-!ENDIF
-
-CONFIG_NAME_LIB = $(CONFIG_NAME_LIB)-vc$(VC)-$(MACHINE)
-
-!IF "$(DEBUG)"=="yes"
-CONFIG_NAME_LIB = $(CONFIG_NAME_LIB)-debug
-!ELSE
-CONFIG_NAME_LIB = $(CONFIG_NAME_LIB)-release
-!ENDIF
-
-!IF "$(AS_DLL)"=="true"
-CONFIG_NAME_LIB = $(CONFIG_NAME_LIB)-dll
-!ELSE
-CONFIG_NAME_LIB = $(CONFIG_NAME_LIB)-static
-!ENDIF
-
-!IF "$(USE_SSL)"=="true"
-CONFIG_NAME_LIB = $(CONFIG_NAME_LIB)-ssl-$(SSL)
-!ENDIF
-
-!IF "$(USE_MBEDTLS)"=="true"
-CONFIG_NAME_LIB = $(CONFIG_NAME_LIB)-mbedtls-$(MBEDTLS)
-!ENDIF
-
-!IF "$(USE_CARES)"=="true"
-CONFIG_NAME_LIB = $(CONFIG_NAME_LIB)-cares-$(CARES)
-!ENDIF
-
-!IF "$(USE_ZLIB)"=="true"
-CONFIG_NAME_LIB = $(CONFIG_NAME_LIB)-zlib-$(ZLIB)
-!ENDIF
-
-!IF "$(USE_SSH2)"=="true"
-CONFIG_NAME_LIB = $(CONFIG_NAME_LIB)-ssh2-$(SSH2)
-!ENDIF
-
-!IF "$(USE_SSH)"=="true"
-CONFIG_NAME_LIB = $(CONFIG_NAME_LIB)-ssh-$(SSH)
-!ENDIF
-
-!IF "$(USE_IPV6)"=="true"
-CONFIG_NAME_LIB = $(CONFIG_NAME_LIB)-ipv6
-!ENDIF
-
-!IF "$(USE_SSPI)"=="true"
-CONFIG_NAME_LIB = $(CONFIG_NAME_LIB)-sspi
-!ENDIF
-
-!IF "$(USE_SCHANNEL)"=="true"
-CONFIG_NAME_LIB = $(CONFIG_NAME_LIB)-schannel
-!ENDIF
-
-!IF "$(USE_NGHTTP2)"=="true"
-CONFIG_NAME_LIB = $(CONFIG_NAME_LIB)-nghttp2-$(NGHTTP2)
-!ENDIF
-
-!IF "$(USE_MSH3)"=="true"
-CONFIG_NAME_LIB = $(CONFIG_NAME_LIB)-msh3
-!ENDIF
-
-!MESSAGE configuration name: $(CONFIG_NAME_LIB)
-
-# Note these directories are removed by this makefile's 'clean' so they should
-# not be changed to point to user-specified directories that may contain other
-# data. MakefileBuild.vc uses the same variable names but allows some user
-# changes and therefore does not remove the directories.
-BUILD_DIR=../builds/$(CONFIG_NAME_LIB)
-LIBCURL_DIROBJ = ..\builds\$(CONFIG_NAME_LIB)-obj-lib
-CURL_DIROBJ = ..\builds\$(CONFIG_NAME_LIB)-obj-curl
-DIRDIST = ..\builds\$(CONFIG_NAME_LIB)\
-
-$(MODE):
-	@SET DIROBJ=$(LIBCURL_DIROBJ)
-	@SET MACRO_NAME=LIBCURL_OBJS
-	@SET OUTFILE=LIBCURL_OBJS.inc
-	@CALL gen_resp_file.bat $(LIBCURL_OBJS)
-
-	@SET DIROBJ=$(CURL_DIROBJ)
-	@SET MACRO_NAME=CURL_OBJS
-	@SET OUTFILE=CURL_OBJS.inc
-	@CALL gen_resp_file.bat $(CURL_OBJS)
-
-	@SET CONFIG_NAME_LIB=$(CONFIG_NAME_LIB)
-	@SET MACHINE=$(MACHINE)
-	@SET USE_NGHTTP2=$(USE_NGHTTP2)
-	@SET USE_MSH3=$(USE_MSH3)
-	@SET USE_IDN=$(USE_IDN)
-	@SET USE_IPV6=$(USE_IPV6)
-	@SET USE_SSPI=$(USE_SSPI)
-	@SET USE_SCHANNEL=$(USE_SCHANNEL)
-	@SET USE_UNICODE=$(USE_UNICODE)
-# compatibility bit
-	@SET WITH_NGHTTP2=$(WITH_NGHTTP2)
-
-	@$(MAKE) /NOLOGO /F MakefileBuild.vc
-
-copy_from_lib:
-	echo copying .c...
-	FOR %%i IN ($(CURLX_CFILES:/=\)) DO copy %%i ..\src\
-
-clean:
-	@if exist $(LIBCURL_DIROBJ) rd /s /q $(LIBCURL_DIROBJ)
-	@if exist $(CURL_DIROBJ) rd /s /q $(CURL_DIROBJ)
-	@if exist $(DIRDIST) rd /s /q $(DIRDIST)
-	$(MAKE) /NOLOGO /F MakefileBuild.vc $@
diff --git a/third-party/curl/winbuild/MakefileBuild.vc b/third-party/curl/winbuild/MakefileBuild.vc
deleted file mode 100644
index d77946b195..0000000000
--- a/third-party/curl/winbuild/MakefileBuild.vc
+++ /dev/null
@@ -1,714 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-#***************************************************************************
-
-###########################################################################
-#
-# Makefile for building libcurl with MSVC
-#
-# Usage: see README.md
-#
-##############################################################
-
-CFGSET=FALSE
-WINBUILD_DIR=`cd`
-
-# Utilities.
-# If a path is required that contains characters such as space, quote the path.
-MT         = mt.exe
-RC         = rc.exe
-ZIP        = zip.exe
-
-# Allow changing C compiler via environment variable CC (default cl.exe)
-# This command macro is not set by default: https://msdn.microsoft.com/en-us/library/ms933742.aspx
-!If "$(CC)" == ""
-CC = cl.exe
-!Endif
-
-!IF "$(VC)"=="6"
-CC_NODEBUG  = $(CC) /O2 /DNDEBUG
-CC_DEBUG    = $(CC) /Od /Gm /Zi /D_DEBUG /GZ
-CFLAGS      = /I. /I../lib /I../include /nologo /W4 /GX /DWIN32 /YX /FD /c /DBUILDING_LIBCURL
-!ELSE
-CC_NODEBUG  = $(CC) /O2 /DNDEBUG
-CC_DEBUG    = $(CC) /Od /D_DEBUG /RTC1 /Z7 /LDd
-CFLAGS      = /I. /I ../lib /I../include /nologo /W4 /EHsc /DWIN32 /FD /c /DBUILDING_LIBCURL
-!ENDIF
-
-LFLAGS     = /nologo /machine:$(MACHINE)
-LNKDLL     = link.exe /DLL
-# Use lib.exe instead of link.exe as link.exe /lib has the following bad habits:
-# - optimizing options like /opt:ref raises warnings (at least in Visual Studio 2015)
-# - all (including Windows) dependencies are aggregated (as static parts)
-# - link.exe /lib is not documented (anymore) at MSDN
-# Instead of id: just create an archive, that contains all objects
-LNKLIB     = lib.exe
-
-CFLAGS_PDB = /Zi
-LFLAGS_PDB = /incremental:no /opt:ref,icf /DEBUG
-
-CFLAGS_LIBCURL_STATIC  = /DCURL_STATICLIB
-
-WIN_LIBS    = ws2_32.lib wldap32.lib advapi32.lib crypt32.lib
-
-BASE_NAME              = libcurl
-BASE_NAME_DEBUG        = $(BASE_NAME)_debug
-BASE_NAME_STATIC       = $(BASE_NAME)_a
-BASE_NAME_STATIC_DEBUG = $(BASE_NAME_STATIC)_debug
-
-LIB_NAME_STATIC        = $(BASE_NAME_STATIC).lib
-LIB_NAME_STATIC_DEBUG  = $(BASE_NAME_STATIC_DEBUG).lib
-LIB_NAME_DLL           = $(BASE_NAME).dll
-LIB_NAME_IMP           = $(BASE_NAME).lib
-LIB_NAME_DLL_DEBUG     = $(BASE_NAME_DEBUG).dll
-LIB_NAME_IMP_DEBUG     = $(BASE_NAME_DEBUG).lib
-
-PDB_NAME_STATIC        = $(BASE_NAME_STATIC).pdb
-PDB_NAME_STATIC_DEBUG  = $(BASE_NAME_STATIC_DEBUG).pdb
-PDB_NAME_DLL           = $(BASE_NAME).pdb
-PDB_NAME_DLL_DEBUG     = $(BASE_NAME_DEBUG).pdb
-
-# CURL Command section
-PROGRAM_NAME  = curl.exe
-CURL_CFLAGS   = /I../lib /I../include /nologo /W4 /EHsc /DWIN32 /FD /c
-CURL_LFLAGS   = /out:$(DIRDIST)\bin\$(PROGRAM_NAME) /subsystem:console $(LFLAGS)
-CURL_RESFLAGS = /i../include
-
-#############################################################
-## Nothing more to do below this line!
-LIBCURL_SRC_DIR = ..\lib
-CURL_SRC_DIR = ..\src
-
-!IFNDEF WITH_DEVEL
-WITH_DEVEL   = ../../deps
-!ENDIF
-DEVEL_INCLUDE= $(WITH_DEVEL)/include
-DEVEL_LIB    = $(WITH_DEVEL)/lib
-
-!IF EXISTS("$(DEVEL_INCLUDE)")
-CFLAGS       = $(CFLAGS) /I"$(DEVEL_INCLUDE)"
-!ENDIF
-!IF EXISTS("$(DEVEL_LIB)")
-LFLAGS       = $(LFLAGS) "/LIBPATH:$(DEVEL_LIB)"
-!ENDIF
-
-!IFDEF SSL_PATH
-SSL_INC_DIR  = $(SSL_PATH)\include
-SSL_LIB_DIR  = $(SSL_PATH)\lib
-SSL_LFLAGS   = $(SSL_LFLAGS) "/LIBPATH:$(SSL_LIB_DIR)"
-!ELSE
-SSL_INC_DIR=$(DEVEL_INCLUDE)\openssl
-SSL_LIB_DIR=$(DEVEL_LIB)
-!ENDIF
-
-!IF "$(WITH_SSL)"=="dll" || "$(WITH_SSL)"=="static"
-!IF EXISTS("$(SSL_LIB_DIR)\libssl.lib")
-SSL_LIBS     = libssl.lib libcrypto.lib
-!ELSE
-SSL_LIBS     = libeay32.lib ssleay32.lib
-!ENDIF
-USE_SSL      = true
-SSL          = $(WITH_SSL)
-!IF "$(WITH_SSL)"=="static"
-WIN_LIBS     = $(WIN_LIBS) gdi32.lib user32.lib crypt32.lib
-!ENDIF
-!ENDIF
-
-!IFDEF USE_SSL
-SSL_CFLAGS   = /DUSE_OPENSSL /I"$(SSL_INC_DIR)"
-!IF EXISTS("$(SSL_INC_DIR)\is_boringssl.h")
-SSL_CFLAGS   = $(SSL_CFLAGS) /DHAVE_BORINGSSL
-!ENDIF
-!IF "$(ENABLE_OPENSSL_AUTO_LOAD_CONFIG)"=="false"
-SSL_CFLAGS   = $(SSL_CFLAGS) /DCURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG
-!ENDIF
-!ENDIF
-
-
-!IFDEF NGHTTP2_PATH
-NGHTTP2_INC_DIR  = $(NGHTTP2_PATH)\include
-NGHTTP2_LIB_DIR  = $(NGHTTP2_PATH)\lib
-NGHTTP2_LFLAGS   = $(NGHTTP2_LFLAGS) "/LIBPATH:$(NGHTTP2_LIB_DIR)"
-!ELSE
-NGHTTP2_INC_DIR  = $(DEVEL_INCLUDE)
-NGHTTP2_LIB_DIR  = $(DEVEL_LIB)
-!ENDIF
-
-!IF "$(WITH_NGHTTP2)"=="dll"
-NGHTTP2_CFLAGS   = /DUSE_NGHTTP2 /I"$(NGHTTP2_INC_DIR)"
-NGHTTP2_LIBS     = nghttp2.lib
-!ELSEIF "$(WITH_NGHTTP2)"=="static"
-NGHTTP2_CFLAGS   = /DUSE_NGHTTP2 /DNGHTTP2_STATICLIB /I"$(NGHTTP2_INC_DIR)"
-!IF EXISTS("$(NGHTTP2_LIB_DIR)\nghttp2_static.lib")
-NGHTTP2_LIBS     = nghttp2_static.lib
-!ELSE
-NGHTTP2_LIBS     = nghttp2.lib
-!ENDIF
-!ENDIF
-
-!IFDEF MSH3_PATH
-MSH3_INC_DIR     = $(MSH3_PATH)\include
-MSH3_LIB_DIR     = $(MSH3_PATH)\lib
-MSH3_LFLAGS      = $(MSH3_LFLAGS) "/LIBPATH:$(MSH3_LIB_DIR)"
-!ELSE
-MSH3_INC_DIR     = $(DEVEL_INCLUDE)
-MSH3_LIB_DIR     = $(DEVEL_LIB)
-!ENDIF
-
-!IF "$(WITH_MSH3)"=="dll"
-MSH3_CFLAGS      = /DUSE_MSH3 /I"$(MSH3_INC_DIR)"
-MSH3_LIBS        = msh3.lib
-!ELSEIF "$(WITH_MSH3)"=="static"
-MSH3_CFLAGS      = /DUSE_MSH3 /DMSH3_STATICLIB /I"$(MSH3_INC_DIR)"
-!IF EXISTS("$(NGHTTP2_LIB_DIR)\msh3_static.lib")
-MSH3_LIBS        = msh3_static.lib
-!ELSE
-MSH3_LIBS        = msh3.lib
-!ENDIF
-!ENDIF
-
-!IFDEF MBEDTLS_PATH
-MBEDTLS_INC_DIR  = $(MBEDTLS_PATH)\include
-MBEDTLS_LIB_DIR  = $(MBEDTLS_PATH)\lib
-MBEDTLS_LFLAGS   = $(MBEDTLS_LFLAGS) "/LIBPATH:$(MBEDTLS_LIB_DIR)"
-!ELSE
-MBEDTLS_INC_DIR  = $(DEVEL_INCLUDE)
-MBEDTLS_LIB_DIR  = $(DEVEL_LIB)
-!ENDIF
-
-!IF "$(WITH_MBEDTLS)"=="dll" || "$(WITH_MBEDTLS)"=="static"
-USE_MBEDTLS    = true
-MBEDTLS        = $(WITH_MBEDTLS)
-MBEDTLS_CFLAGS = /DUSE_MBEDTLS /I"$(MBEDTLS_INC_DIR)"
-MBEDTLS_LIBS   = mbedtls.lib mbedcrypto.lib mbedx509.lib
-!ENDIF
-
-
-!IFDEF CARES_PATH
-CARES_INC_DIR  = $(CARES_PATH)\include
-CARES_LIB_DIR  = $(CARES_PATH)\lib
-CARES_LFLAGS   = $(CARES_LFLAGS) "/LIBPATH:$(CARES_LIB_DIR)"
-!ELSE
-CARES_INC_DIR  = $(DEVEL_INCLUDE)/cares
-CARES_LIB_DIR  = $(DEVEL_LIB)
-!ENDIF
-
-!IF "$(WITH_CARES)"=="dll"
-!IF "$(DEBUG)"=="yes"
-CARES_LIBS     = caresd.lib
-!ELSE
-CARES_LIBS     = cares.lib
-!ENDIF
-USE_CARES      = true
-CARES          = dll
-!ELSEIF "$(WITH_CARES)"=="static"
-!IF "$(DEBUG)"=="yes"
-CARES_LIBS     = libcaresd.lib
-!ELSE
-CARES_LIBS     = libcares.lib
-!ENDIF
-USE_CARES      = true
-CARES          = static
-!ENDIF
-
-!IFDEF USE_CARES
-CARES_CFLAGS   = /DUSE_ARES /I"$(CARES_INC_DIR)"
-!IF "$(CARES)"=="static"
-CARES_CFLAGS   = $(CARES_CFLAGS) /DCARES_STATICLIB
-!ENDIF
-!ENDIF
-
-
-!IFDEF ZLIB_PATH
-ZLIB_INC_DIR = $(ZLIB_PATH)\include
-ZLIB_LIB_DIR = $(ZLIB_PATH)\lib
-ZLIB_LFLAGS  = $(ZLIB_LFLAGS) "/LIBPATH:$(ZLIB_LIB_DIR)"
-!ELSE
-ZLIB_INC_DIR = $(DEVEL_INCLUDE)
-ZLIB_LIB_DIR = $(DEVEL_LIB)
-!ENDIF
-
-# Depending on how zlib is built the libraries have different names, we
-# try to handle them all.
-!IF "$(WITH_ZLIB)"=="dll"
-!IF EXISTS("$(ZLIB_LIB_DIR)\zlibwapi.lib")
-ZLIB_LIBS = zlibwapi.lib
-ADDITIONAL_ZLIB_CFLAGS = /DZLIB_WINAPI
-!ELSEIF EXISTS("$(ZLIB_LIB_DIR)\zdll.lib")
-ZLIB_LIBS   = zdll.lib
-!ELSE
-ZLIB_LIBS   = zlib.lib
-!ENDIF
-USE_ZLIB    = true
-ZLIB        = dll
-!ELSEIF "$(WITH_ZLIB)"=="static"
-!IF EXISTS("$(ZLIB_LIB_DIR)\zlibstat.lib")
-ZLIB_LIBS   = zlibstat.lib
-ADDITIONAL_ZLIB_CFLAGS = /DZLIB_WINAPI
-!ELSEIF EXISTS("$(ZLIB_LIB_DIR)\zlibstatic.lib")
-ZLIB_LIBS   = zlibstatic.lib
-!ELSEIF EXISTS("$(ZLIB_LIB_DIR)\zlib.lib")
-ZLIB_LIBS   = zlib.lib
-!ELSE
-ZLIB_LIBS   = zlib_a.lib
-!ENDIF
-USE_ZLIB    = true
-ZLIB        = static
-!ENDIF
-
-!IFDEF USE_ZLIB
-ZLIB_CFLAGS = /DHAVE_LIBZ $(ADDITIONAL_ZLIB_CFLAGS) /I"$(ZLIB_INC_DIR)"
-!ENDIF
-
-
-!IFDEF SSH2_PATH
-SSH2_INC_DIR= $(SSH2_PATH)\include
-SSH2_LIB_DIR= $(SSH2_PATH)\lib
-SSH2_LFLAGS = $(SSH2_LFLAGS) "/LIBPATH:$(SSH2_LIB_DIR)"
-!ELSE
-SSH2_LIB_DIR= $(DEVEL_LIB)
-SSH2_INC_DIR= $(DEVEL_INCLUDE)/libssh2
-!ENDIF
-
-!IF "$(WITH_SSH2)"=="dll"
-SSH2_LIBS   = libssh2.lib
-USE_SSH2    = true
-SSH2        = dll
-!ELSEIF "$(WITH_SSH2)"=="static"
-# libssh2 NMakefile on Windows at default creates a static library without _a suffix
-!IF EXISTS("$(SSH2_LIB_DIR)\libssh2.lib")
-SSH2_LIBS   = libssh2.lib
-!ELSE
-SSH2_LIBS   = libssh2_a.lib
-!ENDIF
-WIN_LIBS     = $(WIN_LIBS) user32.lib
-USE_SSH2    = true
-SSH2        = static
-!ENDIF
-
-!IFDEF USE_SSH2
-SSH2_CFLAGS = /DUSE_LIBSSH2
-SSH2_CFLAGS = $(SSH2_CFLAGS) /I"$(SSH2_INC_DIR)"
-!ENDIF
-
-
-!IFDEF SSH_PATH
-SSH_INC_DIR= $(SSH_PATH)\include
-SSH_LIB_DIR= $(SSH_PATH)\lib
-SSH_LFLAGS = $(SSH_LFLAGS) "/LIBPATH:$(SSH_LIB_DIR)"
-!ELSE
-SSH_LIB_DIR= $(DEVEL_LIB)
-SSH_INC_DIR= $(DEVEL_INCLUDE)
-!ENDIF
-
-!IF "$(WITH_SSH)"=="dll" || "$(WITH_SSH)"=="static"
-SSH_LIBS   = ssh.lib
-USE_SSH    = true
-SSH        = $(WITH_SSH)
-!ENDIF
-
-!IFDEF USE_SSH
-SSH_CFLAGS = /DUSE_LIBSSH
-SSH_CFLAGS = $(SSH_CFLAGS) /I"$(SSH_INC_DIR)"
-!ENDIF
-
-
-!IFNDEF USE_IDN
-USE_IDN   = true
-!ELSEIF "$(USE_IDN)"=="yes"
-USE_IDN   = true
-!ENDIF
-
-!IF "$(USE_IDN)"=="true"
-IDN_CFLAGS = $(IDN_CFLAGS) /DUSE_WIN32_IDN
-WIN_LIBS   = $(WIN_LIBS) Normaliz.lib
-!ENDIF
-
-
-!IFNDEF USE_IPV6
-USE_IPV6  = true
-!ELSEIF "$(USE_IPV6)"=="yes"
-USE_IPV6  = true
-!ENDIF
-
-!IF "$(USE_IPV6)"=="true"
-IPV6_CFLAGS = $(IPV6_CFLAGS) /DUSE_IPV6
-!ENDIF
-
-
-!IFNDEF USE_SSPI
-USE_SSPI  = true
-!ELSEIF "$(USE_SSPI)"=="yes"
-USE_SSPI  = true
-!ENDIF
-
-!IF "$(USE_SSPI)"=="true"
-SSPI_CFLAGS = $(SSPI_CFLAGS) /DUSE_WINDOWS_SSPI
-!ENDIF
-
-
-!IFNDEF USE_SCHANNEL
-!IF "$(USE_SSL)"=="true"
-USE_SCHANNEL  = false
-!ELSE
-USE_SCHANNEL  = $(USE_SSPI)
-!ENDIF
-!ELSEIF "$(USE_SCHANNEL)"=="yes"
-USE_SCHANNEL  = true
-!ENDIF
-
-
-!IF "$(USE_SCHANNEL)"=="true"
-!IF "$(USE_SSPI)"!="true"
-!ERROR cannot build with Schannel without SSPI
-!ENDIF
-SSPI_CFLAGS = $(SSPI_CFLAGS) /DUSE_SCHANNEL
-WIN_LIBS    = $(WIN_LIBS) Crypt32.lib
-!ENDIF
-
-
-!IF "$(GEN_PDB)"=="yes"
-GEN_PDB = true
-!ENDIF
-
-
-!IFDEF EMBED_MANIFEST
-MANIFESTTOOL = $(MT) -manifest $(DIRDIST)\bin\$(PROGRAM_NAME).manifest -outputresource:$(DIRDIST)\bin\$(PROGRAM_NAME);1
-!ELSE
-CURL_RC_FLAGS = $(CURL_RC_FLAGS) /dCURL_EMBED_MANIFEST
-!ENDIF
-
-# Runtime library configuration
-!IF "$(RTLIBCFG)"=="static"
-RTLIB = /MT
-RTLIB_DEBUG = /MTd
-!ELSE
-RTLIB = /MD
-RTLIB_DEBUG  = /MDd
-!ENDIF
-
-!IF "$(MODE)"=="static"
-TARGET = $(LIB_NAME_STATIC)
-CURL_LIBCURL_LIBNAME=$(LIB_NAME_STATIC)
-AS_DLL = false
-CFGSET = true
-!ELSEIF "$(MODE)"=="dll"
-TARGET = $(LIB_NAME_DLL)
-CURL_LIBCURL_LIBNAME=$(LIB_NAME_IMP)
-AS_DLL = true
-CFGSET = true
-!ENDIF
-
-!IF "$(CFGSET)" == "FALSE"
-!ERROR please choose a valid mode
-!ENDIF
-
-
-
-# CURL_XX macros are for the curl.exe command
-
-!IF "$(DEBUG)"=="yes"
-RC_FLAGS = /dDEBUGBUILD=1 /Fo $@ $(LIBCURL_SRC_DIR)\libcurl.rc
-CURL_CC       = $(CC_DEBUG) $(RTLIB_DEBUG)
-CURL_RC_FLAGS = $(CURL_RC_FLAGS) /i../include /dDEBUGBUILD=1 /Fo $@ $(CURL_SRC_DIR)\curl.rc
-!ELSE
-RC_FLAGS = /dDEBUGBUILD=0 /Fo $@ $(LIBCURL_SRC_DIR)\libcurl.rc
-CURL_CC       = $(CC_NODEBUG) $(RTLIB)
-CURL_RC_FLAGS = $(CURL_RC_FLAGS) /i../include /dDEBUGBUILD=0 /Fo $@ $(CURL_SRC_DIR)\curl.rc
-!ENDIF
-
-!IF "$(AS_DLL)" == "true"
-
-LNK       = $(LNKDLL) $(LFLAGS) $(WIN_LIBS) /out:$(LIB_DIROBJ)\$(TARGET)
-!IF "$(DEBUG)"=="yes"
-TARGET    = $(LIB_NAME_DLL_DEBUG)
-LNK       = $(LNK) /DEBUG /IMPLIB:$(LIB_DIROBJ)\$(LIB_NAME_IMP_DEBUG)
-PDB       = $(PDB_NAME_DLL_DEBUG)
-CURL_LIBS = /IMPLIB:$(LIB_DIROBJ)\$(LIB_NAME_IMP_DEBUG)
-!ELSE
-TARGET    = $(LIB_NAME_DLL)
-LNK       = $(LNK)  /IMPLIB:$(LIB_DIROBJ)\$(LIB_NAME_IMP)
-PDB       = $(PDB_NAME_DLL)
-CURL_LIBS = /IMPLIB:$(LIB_DIROBJ)\$(LIB_NAME_IMP)
-!ENDIF
-RESOURCE  = $(LIB_DIROBJ)\libcurl.res
-
-# AS_DLL
-!ELSE
-
-!IF "$(DEBUG)"=="yes"
-TARGET   = $(LIB_NAME_STATIC_DEBUG)
-PDB      = $(PDB_NAME_STATIC_DEBUG)
-!ELSE
-TARGET   = $(LIB_NAME_STATIC)
-PDB      = $(PDB_NAME_STATIC)
-!ENDIF
-LNK      = $(LNKLIB) /out:$(LIB_DIROBJ)\$(TARGET)
-CURL_CC  = $(CURL_CC) $(CFLAGS_LIBCURL_STATIC)
-
-# AS_DLL
-!ENDIF
-
-!IF "$(USE_SSL)"=="true"
-CFLAGS = $(CFLAGS) $(SSL_CFLAGS)
-LFLAGS = $(LFLAGS) $(SSL_LFLAGS) $(SSL_LIBS)
-!ENDIF
-
-!IF "$(USE_MBEDTLS)"=="true"
-CFLAGS = $(CFLAGS) $(MBEDTLS_CFLAGS)
-LFLAGS = $(LFLAGS) $(MBEDTLS_LFLAGS) $(MBEDTLS_LIBS)
-!ENDIF
-
-!IF "$(USE_CARES)"=="true"
-CFLAGS = $(CFLAGS) $(CARES_CFLAGS)
-LFLAGS = $(LFLAGS) $(CARES_LFLAGS) $(CARES_LIBS)
-!ENDIF
-
-!IF "$(USE_ZLIB)"=="true"
-CFLAGS = $(CFLAGS) $(ZLIB_CFLAGS)
-LFLAGS = $(LFLAGS) $(ZLIB_LFLAGS) $(ZLIB_LIBS)
-!ENDIF
-
-!IF "$(USE_SSH2)"=="true"
-CFLAGS = $(CFLAGS) $(SSH2_CFLAGS)
-LFLAGS = $(LFLAGS) $(SSH2_LFLAGS) $(SSH2_LIBS)
-!ENDIF
-
-!IF "$(USE_SSH)"=="true"
-CFLAGS = $(CFLAGS) $(SSH_CFLAGS)
-LFLAGS = $(LFLAGS) $(SSH_LFLAGS) $(SSH_LIBS)
-!ENDIF
-
-!IF "$(USE_IDN)"=="true"
-CFLAGS = $(CFLAGS) $(IDN_CFLAGS)
-!ENDIF
-
-!IF "$(USE_IPV6)"=="true"
-CFLAGS = $(CFLAGS) $(IPV6_CFLAGS)
-!ENDIF
-
-!IF "$(USE_SSPI)"=="true"
-CFLAGS = $(CFLAGS) $(SSPI_CFLAGS)
-!ENDIF
-
-!IF "$(USE_NGHTTP2)"=="true"
-CFLAGS = $(CFLAGS) $(NGHTTP2_CFLAGS)
-LFLAGS = $(LFLAGS) $(NGHTTP2_LFLAGS) $(NGHTTP2_LIBS)
-!ENDIF
-
-!IF "$(USE_MSH3)"=="true"
-CFLAGS = $(CFLAGS) $(MSH3_CFLAGS)
-LFLAGS = $(LFLAGS) $(MSH3_LFLAGS) $(MSH3_LIBS)
-!ENDIF
-
-!IF "$(GEN_PDB)"=="true"
-CFLAGS = $(CFLAGS) $(CFLAGS_PDB) /Fd"$(LIB_DIROBJ)\$(PDB)"
-LFLAGS = $(LFLAGS) $(LFLAGS_PDB)
-!ENDIF
-
-!IF ( "$(USE_SSL)"=="true" && "$(USE_SCHANNEL)"=="true" ) \
- || ( "$(USE_SSL)"=="true" && "$(USE_MBEDTLS)"=="true" ) \
- || ( "$(USE_MBEDTLS)"=="true" && "$(USE_SCHANNEL)"=="true" )
-CFLAGS = $(CFLAGS) /DCURL_WITH_MULTI_SSL
-!ENDIF
-
-!IF "$(USE_UNICODE)"=="true"
-CFLAGS = $(CFLAGS) /DUNICODE /D_UNICODE
-!ENDIF
-
-LIB_DIROBJ = ..\builds\$(CONFIG_NAME_LIB)-obj-lib
-CURL_DIROBJ = ..\builds\$(CONFIG_NAME_LIB)-obj-curl
-
-!IFDEF WITH_PREFIX
-DIRDIST = $(WITH_PREFIX)
-!ELSE
-DIRDIST = ..\builds\$(CONFIG_NAME_LIB)\
-!ENDIF
-
-#
-# curl.exe
-#
-CURL_LINK = link.exe /incremental:no /libpath:"$(DIRDIST)\lib"
-
-!IF "$(CFGSET)" != "FALSE"
-# A mode was provided, so the library can be built.
-#
-!include CURL_OBJS.inc
-!include LIBCURL_OBJS.inc
-
-!IF "$(AS_DLL)" == "true"
-LIB_OBJS = $(LIBCURL_OBJS) $(RESOURCE)
-!ELSE
-LIB_OBJS = $(LIBCURL_OBJS)
-!ENDIF
-
-EXE_OBJS = $(CURL_OBJS) $(CURL_DIROBJ)\curl.res
-
-all : $(TARGET) $(PROGRAM_NAME)
-
-package: $(TARGET)
-	@cd $(DIRDIST)
-	@-$(ZIP) -9 -q -r ..\$(CONFIG_NAME_LIB).zip .>nul 2<&1
-	@cd $(MAKEDIR)
-
-$(TARGET): $(LIB_OBJS) $(LIB_DIROBJ) $(DIRDIST)
-	@echo Using SSL: $(USE_SSL)
-	@echo Using NGHTTP2: $(USE_NGHTTP2)
-	@echo Using MSH3: $(USE_MSH3)
-	@echo Using c-ares: $(USE_CARES)
-	@echo Using SSH2: $(USE_SSH2)
-	@echo Using SSH: $(USE_SSH)
-	@echo Using ZLIB: $(USE_ZLIB)
-	@echo Using IDN:  $(USE_IDN)
-	@echo Using IPv6: $(USE_IPV6)
-	@echo Using SSPI: $(USE_SSPI)
-	@echo Using Schannel: $(USE_SCHANNEL)
-	@echo CFLAGS:     $(CFLAGS)
-	@echo LFLAGS:     $(LFLAGS)
-	@echo GenPDB:     $(GEN_PDB)
-	@echo Debug:      $(DEBUG)
-	@echo Machine:    $(MACHINE)
-	$(LNK) $(LIB_OBJS)
-	@echo Copying libs...
-	@if exist $(LIB_DIROBJ)\$(LIB_NAME_DLL) copy $(LIB_DIROBJ)\$(LIB_NAME_DLL)       $(DIRDIST)\bin\ /y >nul 2<&1
-	@if exist $(LIB_DIROBJ)\$(LIB_NAME_STATIC) copy $(LIB_DIROBJ)\$(LIB_NAME_STATIC)    $(DIRDIST)\lib\ /y >nul 2<&1
-	@if exist $(LIB_DIROBJ)\$(LIB_NAME_DLL_DEBUG) copy $(LIB_DIROBJ)\$(LIB_NAME_DLL_DEBUG) $(DIRDIST)\bin\ /y >nul 2<&1
-	@if exist $(LIB_DIROBJ)\$(LIB_NAME_STATIC_DEBUG) copy $(LIB_DIROBJ)\$(LIB_NAME_STATIC_DEBUG) $(DIRDIST)\lib\ /y >nul 2<&1
-	@if exist $(LIB_DIROBJ)\$(LIB_NAME_IMP) copy $(LIB_DIROBJ)\$(LIB_NAME_IMP)       $(DIRDIST)\lib\ /y >nul 2<&1
-	@if exist $(LIB_DIROBJ)\$(LIB_NAME_IMP_DEBUG) copy $(LIB_DIROBJ)\$(LIB_NAME_IMP_DEBUG) $(DIRDIST)\lib >nul 2<&1
-	@-copy $(LIB_DIROBJ)\*.exp                 $(DIRDIST)\lib /y >nul 2<&1
-	@-copy $(LIB_DIROBJ)\*.pdb                 $(DIRDIST)\lib /y >nul 2<&1
-	@-copy ..\include\curl\*.h   $(DIRDIST)\include\curl\ /y  >nul 2<&1
-
-$(LIB_OBJS): $(LIB_DIROBJ) $(DIRDIST)
-
-$(DIRDIST):
-	@if not exist "$(DIRDIST)\bin" mkdir $(DIRDIST)\bin
-	@if not exist "$(DIRDIST)\include" mkdir $(DIRDIST)\include
-	@if not exist "$(DIRDIST)\include\curl" mkdir $(DIRDIST)\include\curl
-	@if not exist "$(DIRDIST)\lib" mkdir $(DIRDIST)\lib
-
-$(LIB_DIROBJ):
-	@if not exist "$(LIB_DIROBJ)" mkdir $(LIB_DIROBJ)
-	@if not exist "$(LIB_DIROBJ)\vauth" mkdir $(LIB_DIROBJ)\vauth
-	@if not exist "$(LIB_DIROBJ)\vtls" mkdir $(LIB_DIROBJ)\vtls
-	@if not exist "$(LIB_DIROBJ)\vssh" mkdir $(LIB_DIROBJ)\vssh
-	@if not exist "$(LIB_DIROBJ)\vquic" mkdir $(LIB_DIROBJ)\vquic
-
-$(CURL_DIROBJ):
-	@if not exist "$(CURL_DIROBJ)" mkdir $(CURL_DIROBJ)
-# we need a lib dir for the portability functions from libcurl
-# we use the .c directly here
-	@if not exist "$(CURL_DIROBJ)" mkdir $(CURL_DIROBJ)\lib
-
-.SUFFIXES: .c .obj .res
-
-{$(LIBCURL_SRC_DIR)\}.c{$(LIB_DIROBJ)\}.obj::
-	$(CURL_CC) $(CFLAGS) /Fo"$(LIB_DIROBJ)\\"  $<
-
-{$(LIBCURL_SRC_DIR)\vauth\}.c{$(LIB_DIROBJ)\vauth\}.obj::
-	$(CURL_CC) $(CFLAGS) /Fo"$(LIB_DIROBJ)\vauth\\"  $<
-
-{$(LIBCURL_SRC_DIR)\vtls\}.c{$(LIB_DIROBJ)\vtls\}.obj::
-	$(CURL_CC) $(CFLAGS) /Fo"$(LIB_DIROBJ)\vtls\\"  $<
-
-{$(LIBCURL_SRC_DIR)\vssh\}.c{$(LIB_DIROBJ)\vssh\}.obj::
-	$(CURL_CC) $(CFLAGS) /Fo"$(LIB_DIROBJ)\vssh\\"  $<
-
-{$(LIBCURL_SRC_DIR)\vquic\}.c{$(LIB_DIROBJ)\vquic\}.obj::
-	$(CURL_CC) $(CFLAGS) /Fo"$(LIB_DIROBJ)\vquic\\"  $<
-
-$(LIB_DIROBJ)\libcurl.res: $(LIBCURL_SRC_DIR)\libcurl.rc
-	$(RC) $(RC_FLAGS)
-
-#
-# curl.exe
-#
-
-
-!IF "$(MODE)"=="static"
-!IF "$(DEBUG)"=="yes"
-CURL_LIBCURL_LIBNAME=$(LIB_NAME_STATIC_DEBUG)
-!ELSE
-CURL_LIBCURL_LIBNAME=$(LIB_NAME_STATIC)
-!ENDIF
-!ELSEIF "$(MODE)"=="dll"
-!IF "$(DEBUG)"=="yes"
-CURL_LIBCURL_LIBNAME=$(LIB_NAME_IMP_DEBUG)
-!ELSE
-CURL_LIBCURL_LIBNAME=$(LIB_NAME_IMP)
-!ENDIF
-!ENDIF
-
-CURL_FROM_LIBCURL=$(CURL_DIROBJ)\tool_hugehelp.obj \
- $(CURL_DIROBJ)\nonblock.obj \
- $(CURL_DIROBJ)\strtoofft.obj \
- $(CURL_DIROBJ)\warnless.obj \
- $(CURL_DIROBJ)\curl_multibyte.obj \
- $(CURL_DIROBJ)\version_win32.obj \
- $(CURL_DIROBJ)\dynbuf.obj \
- $(CURL_DIROBJ)\base64.obj
-
-$(PROGRAM_NAME): $(CURL_DIROBJ) $(CURL_FROM_LIBCURL) $(EXE_OBJS)
-	$(CURL_LINK) $(CURL_LFLAGS) $(CURL_LIBCURL_LIBNAME) $(WIN_LIBS) $(CURL_FROM_LIBCURL) $(EXE_OBJS)
-	$(MANIFESTTOOL)
-
-{$(CURL_SRC_DIR)\}.c{$(CURL_DIROBJ)\}.obj::
-	$(CURL_CC) $(CURL_CFLAGS) /Fo"$(CURL_DIROBJ)\\"  $<
-
-$(CURL_DIROBJ)\tool_hugehelp.obj: $(CURL_SRC_DIR)\tool_hugehelp.c
-	$(CURL_CC) $(CURL_CFLAGS) /Zm200 /Fo"$@" $(CURL_SRC_DIR)\tool_hugehelp.c
-$(CURL_DIROBJ)\nonblock.obj: ../lib/nonblock.c
-	$(CURL_CC) $(CURL_CFLAGS) /Fo"$@" ../lib/nonblock.c
-$(CURL_DIROBJ)\strtoofft.obj: ../lib/strtoofft.c
-	$(CURL_CC) $(CURL_CFLAGS) /Fo"$@" ../lib/strtoofft.c
-$(CURL_DIROBJ)\warnless.obj: ../lib/warnless.c
-	$(CURL_CC) $(CURL_CFLAGS) /Fo"$@" ../lib/warnless.c
-$(CURL_DIROBJ)\curl_multibyte.obj: ../lib/curl_multibyte.c
-	$(CURL_CC) $(CURL_CFLAGS) /Fo"$@" ../lib/curl_multibyte.c
-$(CURL_DIROBJ)\version_win32.obj: ../lib/version_win32.c
-	$(CURL_CC) $(CURL_CFLAGS) /Fo"$@" ../lib/version_win32.c
-$(CURL_DIROBJ)\dynbuf.obj: ../lib/dynbuf.c
-	$(CURL_CC) $(CURL_CFLAGS) /Fo"$@" ../lib/dynbuf.c
-$(CURL_DIROBJ)\base64.obj: ../lib/base64.c
-	$(CURL_CC) $(CURL_CFLAGS) /Fo"$@" ../lib/base64.c
-$(CURL_DIROBJ)\curl.res: $(CURL_SRC_DIR)\curl.rc
-	rc $(CURL_RC_FLAGS)
-
-!ENDIF  # End of case where a config was provided.
-
-# Makefile.vc's clean removes (LIB)CURL_DIROBJ and DIRDIST dirs then calls
-# this clean. Note those are the original directories we control and not the
-# directories possibly modified by this makefile to point to user-specified
-# directories.
-# For example, don't remove DIRDIST here since it may contain user files if it
-# has been changed by WITH_PREFIX to a different output dir (eg C:\usr\local).
-clean:
-	@-erase /s *.dll 2> NUL
-	@-erase /s *.exp 2> NUL
-	@-erase /s *.idb 2> NUL
-	@-erase /s *.lib 2> NUL
-	@-erase /s *.obj 2> NUL
-	@-erase /s *.pch 2> NUL
-	@-erase /s *.pdb 2> NUL
-	@-erase /s *.res 2> NUL
diff --git a/third-party/curl/winbuild/README.md b/third-party/curl/winbuild/README.md
deleted file mode 100644
index 207b115672..0000000000
--- a/third-party/curl/winbuild/README.md
+++ /dev/null
@@ -1,199 +0,0 @@
-<!--
-Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-
-SPDX-License-Identifier: curl
--->
-
-# Building curl with Visual C++
-
- This document describes how to compile, build and install curl and libcurl
- from sources using the Visual C++ build tool. To build with VC++, you will of
- course have to first install VC++. The minimum required version of VC is 6
- (part of Visual Studio 6). However using a more recent version is strongly
- recommended.
-
- VC++ is also part of the Windows Platform SDK. You do not have to install the
- full Visual Studio or Visual C++ if all you want is to build curl.
-
- The latest Platform SDK can be downloaded freely from [Windows SDK and
- emulator
- archive](https://developer.microsoft.com/en-us/windows/downloads/sdk-archive)
-
-## Prerequisites
-
- If you wish to support zlib, OpenSSL, c-ares, ssh2, you will have to download
- them separately and copy them to the `deps` directory as shown below:
-
-    somedirectory\
-     |_curl-src
-     | |_winbuild
-     |
-     |_deps
-       |_ lib
-       |_ include
-       |_ bin
-
- It is also possible to create the `deps` directory in some other random places
- and tell the `Makefile` its location using the `WITH_DEVEL` option.
-
-## Building straight from git
-
- When you check out code git and build it, as opposed from a released source
- code archive, you need to first run the `buildconf.bat` batch file (present
- in the source code root directory) to set things up.
-
-## Open a command prompt
-
-Open a Visual Studio Command prompt:
-
- Using the **'Developer Command Prompt for VS [version]'** menu entry: where
- [version} is the Visual Studio version. The developer prompt at default uses
- the x86 mode. It is required to call `Vcvarsall.bat` to setup the prompt for
- the machine type you want. This type of command prompt may not exist in all
- Visual Studio versions.
-
- See also: [Developer Command Prompt for Visual
- Studio](https://docs.microsoft.com/en-us/dotnet/framework/tools/developer-command-prompt-for-vs)
- and [How to: Enable a 64-Bit, x64 hosted MSVC toolset on the command
- line](https://docs.microsoft.com/en-us/cpp/build/how-to-enable-a-64-bit-visual-cpp-toolset-on-the-command-line)
-
- Using the **'VS [version] [platform] [type] Command Prompt'** menu entry:
- where [version] is the Visual Studio version, [platform] is e.g. x64 and
- [type] Native of Cross platform build. This type of command prompt may not
- exist in all Visual Studio versions.
-
- See also: [Set the Path and Environment Variables for Command-Line Builds](https://docs.microsoft.com/en-us/cpp/build/building-on-the-command-line)
-
-## Build in the console
-
- Once you are in the console, go to the winbuild directory in the Curl
- sources:
-
-    cd curl-src\winbuild
-
- Then you can call `nmake /f Makefile.vc` with the desired options (see
- below). The builds will be in the top src directory, `builds\` directory, in
- a directory named using the options given to the nmake call.
-
-    nmake /f Makefile.vc mode=<static or dll> <options>
-
-where `<options>` is one or many of:
-
- - `VC=<num>`                    - VC version. 6 or later.
- - `WITH_DEVEL=<path>`           - Paths for the development files (SSL, zlib, etc.)
-                                   Defaults to sibling directory: `../deps`
- - `WITH_SSL=<dll/static>`       - Enable OpenSSL support, DLL or static
- - `WITH_NGHTTP2=<dll/static>`   - Enable HTTP/2 support, DLL or static
- - `WITH_MSH3=<dll/static>`      - Enable (experimental) HTTP/3 support, DLL or static
- - `WITH_MBEDTLS=<dll/static>`   - Enable mbedTLS support, DLL or static
- - `WITH_CARES=<dll/static>`     - Enable c-ares support, DLL or static
- - `WITH_ZLIB=<dll/static>`      - Enable zlib support, DLL or static
- - `WITH_SSH=<dll/static>`       - Enable libSSH support, DLL or static
- - `WITH_SSH2=<dll/static>`      - Enable libSSH2 support, DLL or static
- - `WITH_PREFIX=<dir>`           - Where to install the build
- - `ENABLE_SSPI=<yes/no>`        - Enable SSPI support, defaults to yes
- - `ENABLE_IPV6=<yes/no>`        - Enable IPv6, defaults to yes
- - `ENABLE_IDN=<yes or no>`      - Enable use of Windows IDN APIs, defaults to yes
-                                   Requires Windows Vista or later
- - `ENABLE_SCHANNEL=<yes/no>`    - Enable native Windows SSL support, defaults
-                                   to yes if SSPI and no other SSL library
- - `ENABLE_OPENSSL_AUTO_LOAD_CONFIG=<yes/no>`
-                                 - Enable loading OpenSSL configuration
-                                   automatically, defaults to yes
- - `ENABLE_UNICODE=<yes/no>`     - Enable UNICODE support, defaults to no
- - `GEN_PDB=<yes/no>`            - Generate External Program Database
-                                   (debug symbols for release build)
- - `DEBUG=<yes/no>`              - Debug builds
- - `MACHINE=<x86/x64/arm64>`     - Target architecture (default is x86)
- - `CARES_PATH=<path>`           - Custom path for c-ares
- - `MBEDTLS_PATH=<path>`         - Custom path for mbedTLS
- - `NGHTTP2_PATH=<path>`         - Custom path for nghttp2
- - `MSH3_PATH=<path>`            - Custom path for msh3
- - `SSH2_PATH=<path>`            - Custom path for libSSH2
- - `SSL_PATH=<path>`             - Custom path for OpenSSL
- - `ZLIB_PATH=<path>`            - Custom path for zlib
-
-## Static linking of Microsoft's C runtime (CRT):
-
- If you are using mode=static nmake will create and link to the static build
- of libcurl but *not* the static CRT. If you must you can force nmake to link
- in the static CRT by passing `RTLIBCFG=static`. Typically you shouldn't use
- that option, and nmake will default to the DLL CRT. `RTLIBCFG` is rarely used
- and therefore rarely tested. When passing `RTLIBCFG` for a configuration that
- was already built but not with that option, or if the option was specified
- differently, you must destroy the build directory containing the
- configuration so that nmake can build it from scratch.
-
- This option is not recommended unless you have enough development experience
- to know how to match the runtime library for linking (that is, the CRT). If
- `RTLIBCFG=static` then release builds use `/MT` and debug builds use `/MTd`.
-
-## Building your own application with libcurl (Visual Studio example)
-
- When you build curl and libcurl, nmake will show the relative path where the
- output directory is. The output directory is named from the options nmake used
- when building. You may also see temp directories of the same name but with
- suffixes -obj-curl and -obj-lib.
-
- For example let's say you've built curl.exe and libcurl.dll from the Visual
- Studio 2010 x64 Win64 Command Prompt:
-
-    nmake /f Makefile.vc mode=dll VC=10
-
- The output directory will have a name similar to
- `..\builds\libcurl-vc10-x64-release-dll-ipv6-sspi-schannel`.
-
- The output directory contains subdirectories bin, lib and include. Those are
- the directories to set in your Visual Studio project. You can either copy the
- output directory to your project or leave it in place. Following the example,
- let's assume you leave it in place and your curl top source directory is
- `C:\curl-7.82.0`. You would set these options for configurations using the
- x64 platform:
-
-~~~
- - Configuration Properties > Debugging > Environment
-    PATH=C:\curl-7.82.0\builds\libcurl-vc10-x64-release-dll-ipv6-sspi-schannel\bin;%PATH%
-
- - C/C++ > General > Additional Include Directories
-    C:\curl-7.82.0\builds\libcurl-vc10-x64-release-dll-ipv6-sspi-schannel\include;
-
- - Linker > General > Additional Library Directories
-    C:\curl-7.82.0\builds\libcurl-vc10-x64-release-dll-ipv6-sspi-schannel\lib;
-
- - Linker > Input > Additional Dependencies
-    libcurl.lib;
-~~~
-
- For configurations using the x86 platform (aka Win32 platform) you would
- need to make a separate x86 build of libcurl.
-
- If you build libcurl static (`mode=static`) or debug (`DEBUG=yes`) then the
- library name will vary and separate builds may be necessary for separate
- configurations of your project within the same platform. This is discussed in
- the next section.
-
-## Building your own application with a static libcurl
-
- When building an application that uses the static libcurl library on Windows,
- you must define `CURL_STATICLIB`. Otherwise the linker will look for dynamic
- import symbols.
-
- The static library name has an `_a` suffix in the basename and the debug
- library name has a `_debug` suffix in the basename. For example,
- `libcurl_a_debug.lib` is a static debug build of libcurl.
-
- You may need a separate build of libcurl for each VC configuration combination
- (for example: Debug|Win32, Debug|x64, Release|Win32, Release|x64).
-
- You must specify any additional dependencies needed by your build of static
- libcurl (for example:
- `advapi32.lib;crypt32.lib;normaliz.lib;ws2_32.lib;wldap32.lib`).
-
-## Legacy Windows and SSL
-
- When you build curl using the build files in this directory the default SSL
- backend will be Schannel (Windows SSPI), the native SSL library that comes
- with the Windows OS. Schannel in Windows <= XP is not able to connect to
- servers that no longer support the legacy handshakes and algorithms used by
- those versions. If you will be using curl in one of those earlier versions of
- Windows you should choose another SSL backend like OpenSSL.
diff --git a/third-party/curl/winbuild/gen_resp_file.bat b/third-party/curl/winbuild/gen_resp_file.bat
deleted file mode 100644
index d0735daac6..0000000000
--- a/third-party/curl/winbuild/gen_resp_file.bat
+++ /dev/null
@@ -1,34 +0,0 @@
-@echo off
-rem ***************************************************************************
-rem *                                  _   _ ____  _
-rem *  Project                     ___| | | |  _ \| |
-rem *                             / __| | | | |_) | |
-rem *                            | (__| |_| |  _ <| |___
-rem *                             \___|\___/|_| \_\_____|
-rem *
-rem * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-rem *
-rem * This software is licensed as described in the file COPYING, which
-rem * you should have received as part of this distribution. The terms
-rem * are also available at https://curl.se/docs/copyright.html.
-rem *
-rem * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-rem * copies of the Software, and permit persons to whom the Software is
-rem * furnished to do so, under the terms of the COPYING file.
-rem *
-rem * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-rem * KIND, either express or implied.
-rem *
-rem * SPDX-License-Identifier: curl
-rem *
-rem ***************************************************************************
-
-if exist %OUTFILE% (
-  del %OUTFILE%
-)
-
-echo %MACRO_NAME% = \> %OUTFILE%
-for %%i in (%*) do echo		%DIROBJ%/%%i \>> %OUTFILE%
-echo. >> %OUTFILE%
-
-:END
diff --git a/third-party/curl/winbuild/makedebug.cmd b/third-party/curl/winbuild/makedebug.cmd
deleted file mode 100644
index 3f523c82f9..0000000000
--- a/third-party/curl/winbuild/makedebug.cmd
+++ /dev/null
@@ -1,36 +0,0 @@
-@echo off
-rem ***************************************************************************
-rem *                                  _   _ ____  _
-rem *  Project                     ___| | | |  _ \| |
-rem *                             / __| | | | |_) | |
-rem *                            | (__| |_| |  _ <| |___
-rem *                             \___|\___/|_| \_\_____|
-rem *
-rem * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-rem *
-rem * This software is licensed as described in the file COPYING, which
-rem * you should have received as part of this distribution. The terms
-rem * are also available at https://curl.se/docs/copyright.html.
-rem *
-rem * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-rem * copies of the Software, and permit persons to whom the Software is
-rem * furnished to do so, under the terms of the COPYING file.
-rem *
-rem * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-rem * KIND, either express or implied.
-rem *
-rem * SPDX-License-Identifier: curl
-rem *
-rem ***************************************************************************
-
-where.exe nmake.exe >nul 2>&1
-
-IF %ERRORLEVEL% == 1 (
-  ECHO Error: Can't find `nmake.exe` - be sure to run this script from within a Developer Command-Prompt
-  ECHO.
-) ELSE (
-  nmake /f Makefile.vc mode=static DEBUG=yes GEN_PDB=yes
-  IF %ERRORLEVEL% NEQ 0 (
-    ECHO "Error: Build Failed"
-  )
-)
diff --git a/vendor.yaml b/vendor.yaml
index e4ff979589..a6306847c4 100644
--- a/vendor.yaml
+++ b/vendor.yaml
@@ -43,7 +43,7 @@ third-party/sse2neon:
   git: https://github.com/DLTcollab/sse2neon/releases/tag/v1.9.1
   license: MIT
 third-party/curl:
-  git: https://github.com/curl/curl/tree/curl-8_3_0
+  git: https://github.com/curl/curl/tree/curl-8_21_0
   license: MIT-like
 third-party/draco:
   git: https://github.com/google/draco